From 924e677459027a8c126e20abb35a922fe7bcb395 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 2 Oct 2023 16:02:29 -0700 Subject: [PATCH 001/237] xplat-copilot-8348943 --- windows/client-management/copilot-overview.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 windows/client-management/copilot-overview.md diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md new file mode 100644 index 0000000000..03652ef8a4 --- /dev/null +++ b/windows/client-management/copilot-overview.md @@ -0,0 +1,14 @@ +--- +title: Copilot in Windows Overview +description: Learn about Copilot in Windows. +ms.topic: overview +ms.date: 10/26/2023 +appliesto: +- ✅ Windows 11, version 22H2 or later +--- + +# What is Copilot in Windows? + +Copilot in Windows provides centralized generative AI assistance to your users right from the desktop. + +## From 4a4aabf26cb2092d3f6c866d05789fc5476c382b Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 4 Oct 2023 15:01:31 -0700 Subject: [PATCH 002/237] xplat-copilot-8348943 --- windows/client-management/copilot-overview.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 03652ef8a4..557a48b03e 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -9,6 +9,19 @@ appliesto: # What is Copilot in Windows? -Copilot in Windows provides centralized generative AI assistance to your users right from the desktop. +>**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). + +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows is a bit different from Copilot in Edge, which provides assistance in the browser. However, both user experiences can share the same underlying chat provider platform. + +## Chat provider platforms for Copilot in Windows + +Copilot in Windows uses one of the following chat provider platforms, dependant on your organization's configuration: + +- [Bing chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it), which is intended for consumer use scenarios +- [Bing chat enterprise](/bing-chat-enterprise/overview), which is intended for business use scenarios + - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. + + + + -## From ce9bbd317623170639adbdfac43c8769819f2f8d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 5 Oct 2023 07:15:01 -0700 Subject: [PATCH 003/237] xplat-copilot-8348943 --- windows/client-management/copilot-overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 557a48b03e..3d37b8c2f9 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -11,7 +11,9 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows is a bit different from Copilot in Edge, which provides assistance in the browser. However, both user experiences can share the same underlying chat provider platform. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar on the Windows desktop, docked to the right. + +Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences can share the same underlying chat provider platform. ## Chat provider platforms for Copilot in Windows From a31e324d8a007257aa1f0ae1ed9b4f9af5cb45e2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 5 Oct 2023 07:29:56 -0700 Subject: [PATCH 004/237] dep-psr-8412957 --- windows/whats-new/deprecated-features.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index e13121f3d9..44e79e6fc5 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 09/01/2023 +ms.date: 10/07/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -36,9 +36,10 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | -| AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | -| TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| +| Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft ClipChamp. | October 2023 | +| WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | +| AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | +| TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| | Cortana in Windows | Cortana in Windows as a standalone app is deprecated. This change only impacts Cortana in Windows, and your productivity assistant, Cortana, will continue to be available in Outlook mobile, Teams mobile, Microsoft Teams display, and Microsoft Teams rooms. | June 2023 | | Microsoft Support Diagnostic Tool (MSDT) | [MSDT](/windows-server/administration/windows-commands/msdt) is deprecated and will be removed in a future release of Windows. MSDT is used to gather diagnostic data for analysis by support professionals. For more information, see [Resources for deprecated features](deprecated-features-resources.md) | January 2023 | | Universal Windows Platform (UWP) Applications for 32-bit Arm | This change is applicable only to devices with an Arm processor, for example Snapdragon processors from Qualcomm. If you have a PC built with a processor from Intel or AMD, this content is not applicable. If you are not sure which type of processor you have, check **Settings** > **System** > **About**.

Support for 32-bit Arm versions of applications will be removed in a future release of Windows 11. After this change, for the small number of applications affected, app features might be different and you might notice a difference in performance. For more technical details about this change, see [Update app architecture from Arm32 to Arm64](/windows/arm/arm32-to-arm64). | January 2023 | From 8740f322058e496378a1e0f6126db3e499f49692 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 5 Oct 2023 07:35:43 -0700 Subject: [PATCH 005/237] dep-psr-8412957 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 44e79e6fc5..c15728063a 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft ClipChamp. | October 2023 | +| Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp. | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | | AllJoyn | Microsoft's implementation of AllJoyn which included the [Windows.Devices.AllJoyn API namespace](/uwp/api/windows.devices.alljoyn), a [Win32 API](/windows/win32/api/_alljoyn/), a [management configuration service provider (CSP)](/windows/client-management/mdm/alljoynmanagement-csp), and an [Alljoyn Router Service](/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server#alljoyn-router-service) has been deprecated. [AllJoyn](https://openconnectivity.org/technology/reference-implementation/alljoyn/), sponsored by AllSeen Alliance, was an open source discovery and communication protocol for Internet of Things scenarios such as turning on/off lights or reading temperatures.AllSeen Alliance promoted the AllJoyn project from 2013 until 2016 when it merged with the Open Connectivity Foundation (OCF), the sponsors of [Iotivity.org](https://iotivity.org/), another protocol for Internet of Things scenarios. Customers should refer to the [Iotivity.org](https://iotivity.org/) website for alternatives such as [Iotivity Lite](https://github.com/iotivity/iotivity-lite) or [Iotivity](https://github.com/iotivity/iotivity). | August 17, 2023 | | TLS 1.0 and 1.1 | Over the past several years, internet standards and regulatory bodies have [deprecated or disallowed](https://www.ietf.org/rfc/rfc8996.html) TLS versions 1.0 and 1.1 due to various security issues. Starting in Windows 11 Insider Preview builds for September 2023 and continuing in future Windows OS releases, TLS 1.0 and 1.1 will be disabled by default. This change increases the security posture of Windows customers and encourages modern protocol adoption. For organizations that need to use these versions, there's an option to re-enable TLS 1.0 or TLS 1.1. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | August 1, 2023| From 6e6ce0a2979b6e99270aa70d950cc198cd94a759 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 08:30:28 -0700 Subject: [PATCH 006/237] stash --- windows/client-management/copilot-overview.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 3d37b8c2f9..6164173c16 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -11,9 +11,8 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar on the Windows desktop, docked to the right. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar on the Windows desktop, docked to the right. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it can possibly be used to access sensitive information. -Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences can share the same underlying chat provider platform. ## Chat provider platforms for Copilot in Windows @@ -23,7 +22,9 @@ Copilot in Windows uses one of the following chat provider platforms, dependant - [Bing chat enterprise](/bing-chat-enterprise/overview), which is intended for business use scenarios - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. - +## How to enable Copilot in Windows + +Copilot in Windows won't be enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). One a managed device installs the 2023 annual update, From 4f9dfe5e188f43ed55bb2dcff92c6f620ac9b302 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 9 Oct 2023 15:58:26 -0700 Subject: [PATCH 007/237] copilot-xplat-8348943 --- windows/client-management/copilot-overview.md | 45 +++++++++++++++++-- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 6164173c16..b82d5e86ed 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -11,20 +11,57 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar on the Windows desktop, docked to the right. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it can possibly be used to access sensitive information. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar on the Windows desktop, docked to the right. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. ## Chat provider platforms for Copilot in Windows Copilot in Windows uses one of the following chat provider platforms, dependant on your organization's configuration: -- [Bing chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it), which is intended for consumer use scenarios -- [Bing chat enterprise](/bing-chat-enterprise/overview), which is intended for business use scenarios +- [Bing Chat Enterprise](/bing-chat-enterprise/overview), which is intended for business use scenarios - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. + - With Bing Chat Enterprise, user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. +- [Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it), which is intended for consumer use scenarios ## How to enable Copilot in Windows -Copilot in Windows won't be enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). One a managed device installs the 2023 annual update, +1. [Configure the chat provider](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) platform that Copilot in Windows uses: + - [Bing Chat Enterprise](/bing-chat-enterprise/overview) (highly recommended for business environments) + - Bing Chat (default, intended for consumer environments) + +1. Ensure the Copilot in Windows user experience is enabled: + - Windows 11, version 22H2 clients + - Windows 11 clients with the 2023 annual update installed (coming soon) +### Configure the chat provider platform that Copilot in Windows uses +**Bing Chat Enterprise:** +1. By default, Bing Chat Enterprise is enabled for users with one of the following licenses: + - Microsoft 365 E3 or E5 + - Microsoft 365 A3 or A5 for faculty + - Business Standard + - Business Premium +1. Verify that users have the license by signing into the [Microsoft 365 admin center](https://admin.microsoft.com/). +1. In the admin enter, select **Users** > **Active users** and verify that they have one of the licenses listed above. +1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. +1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. +1. Verify that **Bing Chat Enterprise** is enabled for the user. + + + +### Enable Copilot in Windows for Windows 11, version 22H2 clients + +Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + +To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: + +**GPOs/CSPs to set** + +### Windows 11 clients with the 2023 annual update installed (coming soon) + + +One a managed device installs the 2023 annual update, the Copilot in Windows user experience is enabled by default. Organizations that aren't ready to use Copilot in Windows can disable it until they are ready by using either of the following permanent controls: + +- **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) +- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** \ No newline at end of file From 4124d5918ae3041225d011a8cbacf2d95c9a1bc9 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 10 Oct 2023 15:25:09 -0700 Subject: [PATCH 008/237] edits --- windows/client-management/copilot-overview.md | 47 ++++++++++++++++--- 1 file changed, 40 insertions(+), 7 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index b82d5e86ed..3e25d89345 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -36,27 +36,60 @@ Copilot in Windows uses one of the following chat provider platforms, dependant ### Configure the chat provider platform that Copilot in Windows uses -**Bing Chat Enterprise:** -1. By default, Bing Chat Enterprise is enabled for users with one of the following licenses: +Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. + +#### Bing Chat as the chat provider platform + +Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: +- Bing Chat Enterprise isn't configured for the user +- Bing Chat Enterprise is turned off +- The user isn't signed in with a Microsoft account rather than a Microsoft Entra account, + +Bing Chat is intended for consumer use scenarios and has the following privacy and security protections: + +1. Review [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a), and the privacy statement for using Bing Chat, which is in the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement). Ensure you include the product specific guidance in the Microsoft privacy statement for Bing under the Search, Microsoft Edge, and artificial intelligence section. + +#### Bing Chat Enterprise as the chat provider platform (recommended for business environments) + +1. Review the Bing Chat Enterprise [privacy statement](https://learn.microsoft.com/bing-chat-enterprise/privacy-and-protections). +1. By default, Bing Chat Enterprise is enabled for users that are assigned one of the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - Business Standard - Business Premium 1. Verify that users have the license by signing into the [Microsoft 365 admin center](https://admin.microsoft.com/). -1. In the admin enter, select **Users** > **Active users** and verify that they have one of the licenses listed above. +1. In the admin center, select **Users** > **Active users** and verify that users have one of the licenses listed above. 1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. - +```http +*would be nice to have a Graph query that lists users that do/do not have BCE app enabled* +*licensedetails does output BCE, so its a matter of just getting the query right* +**powershell or http preferably** +Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails +{ + "servicePlanId": "0d0c0d31-fae7-41f2-b909-eaf4d7f26dba", + "servicePlanName": "Bing_Chat_Enterprise", + "provisioningStatus": "Success", + "appliesTo": "User" +}, +https://learn.microsoft.com/graph/api/resources/licensedetails +``` ### Enable Copilot in Windows for Windows 11, version 22H2 clients -Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. +Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. -To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: +To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you'll need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: -**GPOs/CSPs to set** +1. Verify that the users accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. +1. Apply a policy to disable temporary enterprise control. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: + - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** + + - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) + - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. +1. ### Windows 11 clients with the 2023 annual update installed (coming soon) From 4d13dbacffdfd99be3afb6363259bbe8706b8fa1 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 10 Oct 2023 15:56:18 -0700 Subject: [PATCH 009/237] edits --- windows/client-management/copilot-overview.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 3e25d89345..89a8bd5042 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -39,15 +39,17 @@ Copilot in Windows uses one of the following chat provider platforms, dependant Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. #### Bing Chat as the chat provider platform - -Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: + +Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: + - Bing Chat Enterprise isn't configured for the user -- Bing Chat Enterprise is turned off -- The user isn't signed in with a Microsoft account rather than a Microsoft Entra account, +- Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) +- The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise -Bing Chat is intended for consumer use scenarios and has the following privacy and security protections: +The Bing Chat is a consumer experience and doesn't offer commercial data protection. Users in your organization get consumer Bing Chat without these extra protections. The following privacy and security protections apply for Bing Chat: -1. Review [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a), and the privacy statement for using Bing Chat, which is in the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement). Ensure you include the product specific guidance in the Microsoft privacy statement for Bing under the Search, Microsoft Edge, and artificial intelligence section. +- [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) +- The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. #### Bing Chat Enterprise as the chat provider platform (recommended for business environments) From cf7868e20428c47745c9fed019a57f898ddf003f Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 13 Oct 2023 16:06:01 -0700 Subject: [PATCH 010/237] add enable opt updates --- windows/client-management/copilot-overview.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 89a8bd5042..d3c255916f 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -91,7 +91,13 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you'l - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. -1. +1. Depending on how soon you start deploying Copilot in Windows, you may also need to also enable optional updates with one of the following policies: + Enable optional updates for Windows 11, version 22H2 and later + - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** + - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) + - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. + > [!NOTE] + > Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). When setting the policy for optional updates, ensure you select an option that includes CFRs. For more information, see [Enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) ### Windows 11 clients with the 2023 annual update installed (coming soon) From 8df1cfe248fe173620a8d3bd803c9a700ac1c0ec Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 10:17:27 -0700 Subject: [PATCH 011/237] edits --- windows/client-management/copilot-overview.md | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index d3c255916f..ba951762b1 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -1,6 +1,6 @@ --- title: Copilot in Windows Overview -description: Learn about Copilot in Windows. +description: Learn about managing Copilot in Windows for commercial environments. ms.topic: overview ms.date: 10/26/2023 appliesto: @@ -91,18 +91,25 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you'l - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. -1. Depending on how soon you start deploying Copilot in Windows, you may also need to also enable optional updates with one of the following policies: - Enable optional updates for Windows 11, version 22H2 and later +1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you may also need to also [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - > [!NOTE] - > Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). When setting the policy for optional updates, ensure you select an option that includes CFRs. For more information, see [Enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) + + > [!Note] + > These optional updates policies apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for optional updates, ensure you select one of the following options that includes CFRs: + > - Automatically receive optional updates (including CFRs) + > - Users can select which optional updates to receive + + + + + ### Windows 11 clients with the 2023 annual update installed (coming soon) - -One a managed device installs the 2023 annual update, the Copilot in Windows user experience is enabled by default. Organizations that aren't ready to use Copilot in Windows can disable it until they are ready by using either of the following permanent controls: +One a managed device installs the 2023 annual update, likely to be called 23H2, the Copilot in Windows user experience is enabled by default. Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: - **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) -- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** \ No newline at end of file +- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** + From 7b459fa2f3444cf2bdae60cebfeaeee7de6538f2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:27:41 -0700 Subject: [PATCH 012/237] edits --- windows/client-management/copilot-overview.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index ba951762b1..7478d3f8a9 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -18,15 +18,15 @@ Copilot in Windows provides centralized generative AI assistance to your users r Copilot in Windows uses one of the following chat provider platforms, dependant on your organization's configuration: -- [Bing Chat Enterprise](/bing-chat-enterprise/overview), which is intended for business use scenarios - - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. +- **[Bing Chat Enterprise](/bing-chat-enterprise/overview)**: intended for commercial use scenarios - With Bing Chat Enterprise, user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. -- [Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it), which is intended for consumer use scenarios + - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. +- **[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it)**: intended for consumer use scenarios ## How to enable Copilot in Windows 1. [Configure the chat provider](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) platform that Copilot in Windows uses: - - [Bing Chat Enterprise](/bing-chat-enterprise/overview) (highly recommended for business environments) + - [Bing Chat Enterprise](/bing-chat-enterprise/overview) (highly recommended for commercial environments) - Bing Chat (default, intended for consumer environments) 1. Ensure the Copilot in Windows user experience is enabled: @@ -34,11 +34,11 @@ Copilot in Windows uses one of the following chat provider platforms, dependant - Windows 11 clients with the 2023 annual update installed (coming soon) -### Configure the chat provider platform that Copilot in Windows uses +## Configure the chat provider platform that Copilot in Windows uses Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. -#### Bing Chat as the chat provider platform +### Bing Chat as the chat provider platform Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: @@ -51,7 +51,7 @@ The Bing Chat is a consumer experience and doesn't offer commercial data protect - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. -#### Bing Chat Enterprise as the chat provider platform (recommended for business environments) +### Bing Chat Enterprise as the chat provider platform (recommended for commercial environments) 1. Review the Bing Chat Enterprise [privacy statement](https://learn.microsoft.com/bing-chat-enterprise/privacy-and-protections). 1. By default, Bing Chat Enterprise is enabled for users that are assigned one of the following licenses: @@ -79,6 +79,8 @@ Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails https://learn.microsoft.com/graph/api/resources/licensedetails ``` +## Ensure the Copilot in Windows user experience is enabled + ### Enable Copilot in Windows for Windows 11, version 22H2 clients Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. From 5c6f760b8dbd4a81ac7e626af9ea51798194706d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 12:58:40 -0700 Subject: [PATCH 013/237] edits --- windows/client-management/copilot-overview.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 7478d3f8a9..966866d506 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -65,6 +65,10 @@ The Bing Chat is a consumer experience and doesn't offer commercial data protect 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. +> [!Note] +> If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. + + ```http *would be nice to have a Graph query that lists users that do/do not have BCE app enabled* *licensedetails does output BCE, so its a matter of just getting the query right* From 7a8592d9273ef4e04c35151c8c347c96de3a8eca Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 13:37:13 -0700 Subject: [PATCH 014/237] edits --- windows/client-management/copilot-overview.md | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 966866d506..f2ac9a9385 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -11,29 +11,28 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar on the Windows desktop, docked to the right. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. + +At a high level, configuring Copilot in Windows for your organization involves the following steps: + +1. Configure the chat provider platform that Copilot in Windows uses: + - Bing Chat Enterprise (highly recommended for commercial environments) + - Bing Chat (default, intended for consumer environments) +1. Ensure the Copilot in Windows user experience is enabled: + - Windows 11, version 22H2 clients + - Windows 11 clients with the 2023 annual update installed (coming soon) +1. Verify other settings that may impact Copilot in Windows and its underlying chat provider ## Chat provider platforms for Copilot in Windows -Copilot in Windows uses one of the following chat provider platforms, dependant on your organization's configuration: +Copilot in Windows uses one of the following chat provider platforms, dependent on your organization's configuration: - **[Bing Chat Enterprise](/bing-chat-enterprise/overview)**: intended for commercial use scenarios - With Bing Chat Enterprise, user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. - **[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it)**: intended for consumer use scenarios -## How to enable Copilot in Windows - -1. [Configure the chat provider](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) platform that Copilot in Windows uses: - - [Bing Chat Enterprise](/bing-chat-enterprise/overview) (highly recommended for commercial environments) - - Bing Chat (default, intended for consumer environments) - -1. Ensure the Copilot in Windows user experience is enabled: - - Windows 11, version 22H2 clients - - Windows 11 clients with the 2023 annual update installed (coming soon) - - ## Configure the chat provider platform that Copilot in Windows uses Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. @@ -89,15 +88,15 @@ https://learn.microsoft.com/graph/api/resources/licensedetails Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. -To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you'll need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: +To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: -1. Verify that the users accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. +1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. 1. Apply a policy to disable temporary enterprise control. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. -1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you may also need to also [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: +1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. From 6550e91928b62f5d72082dd3a5c937739ca0ce9d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 14:55:00 -0700 Subject: [PATCH 015/237] edits --- windows/client-management/copilot-overview.md | 62 ++++++++++--------- 1 file changed, 32 insertions(+), 30 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index f2ac9a9385..0a759a25d9 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -15,23 +15,34 @@ Copilot in Windows provides centralized generative AI assistance to your users r At a high level, configuring Copilot in Windows for your organization involves the following steps: -1. Configure the chat provider platform that Copilot in Windows uses: - - Bing Chat Enterprise (highly recommended for commercial environments) - - Bing Chat (default, intended for consumer environments) -1. Ensure the Copilot in Windows user experience is enabled: - - Windows 11, version 22H2 clients - - Windows 11 clients with the 2023 annual update installed (coming soon) +1. Understand the available chat provider platforms for Copilot in Windows +1. Configure the chat provider platform that Copilot in Windows uses +1. Ensure the Copilot in Windows user experience is enabled 1. Verify other settings that may impact Copilot in Windows and its underlying chat provider +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: + +- **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) +- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** ## Chat provider platforms for Copilot in Windows -Copilot in Windows uses one of the following chat provider platforms, dependent on your organization's configuration: +Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. -- **[Bing Chat Enterprise](/bing-chat-enterprise/overview)**: intended for commercial use scenarios - - With Bing Chat Enterprise, user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. - - Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. -- **[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it)**: intended for consumer use scenarios +**Bing Chat**: + +[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and doesn't offer commercial data protection. Users in your organization get consumer Bing Chat without extra commercial protections. The following privacy and security protections apply for Bing Chat: + - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) + - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. + +**Bing Chat Enterprise**: + +[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios. The following privacy and security protections apply for Bing Chat Enterprise: + +- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). +- Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. + > [!Note] + > Bing Chat Enterprise doesn't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise can't access Microsoft 365 Apps data, such as email, calendar, or files. ## Configure the chat provider platform that Copilot in Windows uses @@ -42,24 +53,20 @@ Configuring the correct chat provider platform for Copilot in Windows is importa Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: - Bing Chat Enterprise isn't configured for the user +- T user isn't assigned a license that includes Bing Chat Enterprise - Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) - The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise -The Bing Chat is a consumer experience and doesn't offer commercial data protection. Users in your organization get consumer Bing Chat without these extra protections. The following privacy and security protections apply for Bing Chat: +### Bing Chat Enterprise as the chat provider platform -- [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) -- The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. +Bing Chat Enterprise (recommended for commercial environments), is used as the chat provider platform for Copilot in Windows when all of the following conditions occur: -### Bing Chat Enterprise as the chat provider platform (recommended for commercial environments) - -1. Review the Bing Chat Enterprise [privacy statement](https://learn.microsoft.com/bing-chat-enterprise/privacy-and-protections). -1. By default, Bing Chat Enterprise is enabled for users that are assigned one of the following licenses: - - Microsoft 365 E3 or E5 +1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). +1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: + - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - Business Standard - Business Premium -1. Verify that users have the license by signing into the [Microsoft 365 admin center](https://admin.microsoft.com/). -1. In the admin center, select **Users** > **Active users** and verify that users have one of the licenses listed above. 1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. @@ -101,15 +108,10 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - > [!Note] - > These optional updates policies apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for optional updates, ensure you select one of the following options that includes CFRs: - > - Automatically receive optional updates (including CFRs) - > - Users can select which optional updates to receive - - - - - + > [!Note] + > The optional updates policies apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for optional updates, ensure you select one of the following options that includes CFRs: + > - Automatically receive optional updates (including CFRs) + > - Users can select which optional updates to receive ### Windows 11 clients with the 2023 annual update installed (coming soon) From 73ff492e2cd88befe6173faeb09dc4dca067a469 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:07:08 -0700 Subject: [PATCH 016/237] edits --- windows/client-management/copilot-overview.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 0a759a25d9..8602118750 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -53,7 +53,7 @@ Configuring the correct chat provider platform for Copilot in Windows is importa Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: - Bing Chat Enterprise isn't configured for the user -- T user isn't assigned a license that includes Bing Chat Enterprise +- The user isn't assigned a license that includes Bing Chat Enterprise - Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) - The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise @@ -107,11 +107,10 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - - > [!Note] - > The optional updates policies apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for optional updates, ensure you select one of the following options that includes CFRs: - > - Automatically receive optional updates (including CFRs) - > - Users can select which optional updates to receive + + The optional updates policies apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for optional updates, ensure you select one of the following options that includes CFRs: + - Automatically receive optional updates (including CFRs) + - Users can select which optional updates to receive ### Windows 11 clients with the 2023 annual update installed (coming soon) From 8ffd65adea35060daaa8b7cd0fe5142da97c664a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:40:57 -0700 Subject: [PATCH 017/237] edits --- windows/client-management/copilot-overview.md | 32 +++++++++++++------ 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 8602118750..47c930532a 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -18,12 +18,15 @@ At a high level, configuring Copilot in Windows for your organization involves t 1. Understand the available chat provider platforms for Copilot in Windows 1. Configure the chat provider platform that Copilot in Windows uses 1. Ensure the Copilot in Windows user experience is enabled -1. Verify other settings that may impact Copilot in Windows and its underlying chat provider +1. Verify other settings that might impact Copilot in Windows and its underlying chat provider -Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot when it's available to them. + +|   | Setting | +|---|---| +| **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | +| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | -- **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) -- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** ## Chat provider platforms for Copilot in Windows @@ -71,8 +74,8 @@ Bing Chat Enterprise (recommended for commercial environments), is used as the c 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. -> [!Note] -> If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. + > [!Note] + > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. ```http @@ -91,7 +94,8 @@ https://learn.microsoft.com/graph/api/resources/licensedetails ## Ensure the Copilot in Windows user experience is enabled -### Enable Copilot in Windows for Windows 11, version 22H2 clients +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. +### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. @@ -108,14 +112,22 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - The optional updates policies apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for optional updates, ensure you select one of the following options that includes CFRs: + These policies of optional updates apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: - Automatically receive optional updates (including CFRs) + - This selection places devices into an early CFR phase - Users can select which optional updates to receive -### Windows 11 clients with the 2023 annual update installed (coming soon) +1. Managed Windows 11, version 22H2 devices will display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. -One a managed device installs the 2023 annual update, likely to be called 23H2, the Copilot in Windows user experience is enabled by default. Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: +### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update installed (coming soon) + +One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. + +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. + +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: - **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) - **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** +## Other settings that might impact Copilot in Windows and its underlying chat provider \ No newline at end of file From fea2a184bae412598ce9a7a852bf10272a33de59 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:50:26 -0700 Subject: [PATCH 018/237] edits --- windows/client-management/copilot-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 47c930532a..8184f69213 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -123,7 +123,7 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: From 5ff994f00243acd5bbb150166272b8db51ab670c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:52:25 -0700 Subject: [PATCH 019/237] edits --- windows/client-management/copilot-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 8184f69213..282c68eeb5 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -119,7 +119,7 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n 1. Managed Windows 11, version 22H2 devices will display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. -### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update installed (coming soon) +### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update (coming soon) One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. @@ -130,4 +130,4 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t - **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) - **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** -## Other settings that might impact Copilot in Windows and its underlying chat provider \ No newline at end of file +## Other settings that might impact Copilot in Windows and its underlying chat provider From 6ab5523eb5bd0b3ccdcce738fea65001de8cb3b4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:59:22 -0700 Subject: [PATCH 020/237] edits --- windows/client-management/copilot-overview.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 282c68eeb5..0da24c3e3d 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -15,10 +15,10 @@ Copilot in Windows provides centralized generative AI assistance to your users r At a high level, configuring Copilot in Windows for your organization involves the following steps: -1. Understand the available chat provider platforms for Copilot in Windows -1. Configure the chat provider platform that Copilot in Windows uses -1. Ensure the Copilot in Windows user experience is enabled -1. Verify other settings that might impact Copilot in Windows and its underlying chat provider +1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) +1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows +1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled +1. Verify [other settings that might impact Copilot in Windows](#other-settings-that-might-impact-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot when it's available to them. @@ -123,7 +123,9 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings impact Copilot in Windows. For more information, see: +- [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) +- [Other settings that might impact Copilot in Windows and its underlying chat provider](#other-settings-that-might-impact-copilot-in-windows-and-its-underlying-chat-provider) Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: @@ -131,3 +133,5 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t - **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** ## Other settings that might impact Copilot in Windows and its underlying chat provider + + Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. \ No newline at end of file From 7f802f70bbee2638588bead40073a565dbd66169 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 16:33:49 -0700 Subject: [PATCH 021/237] edits --- windows/client-management/copilot-overview.md | 9 +++++++-- .../bing-chat-enterprise-chat-provider.png | Bin 0 -> 105734 bytes 2 files changed, 7 insertions(+), 2 deletions(-) create mode 100644 windows/client-management/images/bing-chat-enterprise-chat-provider.png diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 0da24c3e3d..62dbaa8c80 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -77,7 +77,6 @@ Bing Chat Enterprise (recommended for commercial environments), is used as the c > [!Note] > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. - ```http *would be nice to have a Graph query that lists users that do/do not have BCE app enabled* *licensedetails does output BCE, so its a matter of just getting the query right* @@ -92,6 +91,10 @@ Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails https://learn.microsoft.com/graph/api/resources/licensedetails ``` +When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There is also a shield emblem labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: + +:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: + ## Ensure the Copilot in Windows user experience is enabled Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. @@ -134,4 +137,6 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Other settings that might impact Copilot in Windows and its underlying chat provider - Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. \ No newline at end of file +Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some setting which affect Bing Chat, Bing Chat Enterprise, and the Microsoft Edge sidebar can also affect Copilot in Windows. + +The following settings might impact Copilot in Windows and its underlying chat provider: \ No newline at end of file diff --git a/windows/client-management/images/bing-chat-enterprise-chat-provider.png b/windows/client-management/images/bing-chat-enterprise-chat-provider.png new file mode 100644 index 0000000000000000000000000000000000000000..6213a99d1602f414ae39b545e7fe52b7bec0e395 GIT binary patch literal 105734 zcmeF3RZv`AwC5ub8gD{ym*7rt3zm=sClK7--L-KG5Ik5QArRcU8+UJ<;O+^~IE^$i z&G+3qQ&Us(HdA*V=7DO?sbhQZwb%Zy-&*HHt17?6#UjUg^ym@pI|VuQM~|KmKYD~7 z3wVaw<3xJjj{14*rv6suQN;-5U(^Pgm9&!dqes;V*f%EVsBKJV1s%6XkEkLZ{vI0? z5QaQ@bYJ*RPWq#_;eHNAFqP(9MB4)7C$syL{0lZJIo9`TANPZa{H}T;K!5^(XLZ3V zY|sla008ttI%(Mt8>kR`W)3UA_Zb;#5c6~Ms(oiETZ5DwnB#Yw&(3V{YV~S$vvjna zud@Mv#Z_kd91fHL&^=?I=tKR40omii{@I}}+xgG-FFF&{UYV%hiB%8B$=NDsKO9Cc zz{r8x4M-w?PW*730xl-@!*M?%{%@Qfr_PtD*qlQB3pj&iM;eg%>3Uv1Q8Z2-Cjb=hi5q)r3{ow`Oi>? zeNQd)VI-HAH>S-WQ&h$ID9D*zrOyz&oD)qULb+mY2WWMW`Be3J2fNBQndT;6!hRr%E&e4ma7Ta8h;o6!J zU)=iCifN()*+2K5-?2YjiU1I~ylhCrz|z>%wD;txOCoH`pO!l~k(L{fsQ$~`tnc%= z&yTHB9~$Ox1y>Ozbs8+`kLEcBWg=>7F8QL0G1hYQE_B_+7BdE3;7b23cEn8E-PA$L zg(1z|QKZ!DMeBuxA53pqUFgXteV1@5-#__*I&q3Xf*#ZH-gpWt3WvHRFa$E)@*?V~ z43K!uO`00^gMqJDDzOS+Qm-&)w&vN`s_zj5b2PaWZMzOuhA)0 zIz_6i_V}+4N4E4CsIx~03aaWCHsM_qt7`sO>o;3%rEi^ngAnuFymncC{}O=1ib?l| zeZc{mbNg2%sK#Sjr%&=~KxH0JY~T1TrAt@<+|H=h$$x_aad*+SQbgr8#0#0$wVPYH zLqO}d|Cnfk>1@XB?~g?5>gq1n65U2b`V8-{XBJSM>%sl}(eW6|3qV3%^hS4rf` z{oRG#^MP zCXrOz63>U*Y4v^o7B1HheHCC=HV9bd`Z^YuD5NSG)^uVFkky&iaU3$r!R(_ay|c>o z=?y$d&hwUz?!Va zqT#bc-9kRZZl}d_SRw$!+TzPE39I{t8x=%ko1xhSXB1&1wwFmiu`b8Te8-$e->=Q* z8w~S@uy$8~OjHt10m$VL+I9;^oWQvIe%0{0@Y77o#xqrN&X+TS!XvYXL&i@)87f$i7qOxMgDwC0!ddobwv z&j}#B%jeSG;E}QG3g}hE5S8h&>Xh$?$zSqZ;>)30I^HggL1j*JJr=o-ZFC8eIBI|D zvioJfc2v@HkhN$w*YCi_Z@)T{gorfibX01E8nsdXyF>~21Q=%wkY;%WV?YDtk-5hn@ z>Qjjmc{kGfCMc88wqioE9@T1D``es(aQe%rZsDxM*84iQcfL+n4F=b$ zb0y^z^A(j&l;os7<|pHXd@Y3~se|60B?mm`N{zqvV(6&6>AH7EC{`}tIK8N!BabVs zXdF~I*c=E3YVQmrPGuTz(vr3^ZVF*1a?niB>R5Wb+$UMbbb7j)pCRf|62!NOGC)Y4 zdb?`hTd8X`J*Sp)f3j^2N{`=affL+aFNcN!hFDJ+<>fbym9riPyd73nX<>ICBykS< zQ+#Mo|JzznciV~o?&=Ju?Yr4bl%^&^0eL4+GW)V9u-!I`+Lrm|&y%1>qu2Wfk~E@F zpX7jJ46E70prHKGrc2Pu{6*`T)=MTArC%LW%-j-`wdzdmfT|F_Xs0W5Q;<%560U4f9 zbGEESP^^QKl)Q%sqI8U!y{q&1JG;B_1CK%>ch`H!CdW7y)$K%Cyy^$%j(|X0hKpX} zauVt!h@U8kA@^(HN>0AXL0_0yg(DW6@klz3gs>Q!@o}P83r$VAJ>xK29?okiT3+^pd(QK%p8iHC(FaVz`^oX0Va$j?O8M87t9jwW&ahx;%c^k ze|IPWS(+cmhh1VEPTP|KWHC@jKEp+kwIqZ%c)@>;Jw>f+n(ES@x zx_{h51aqh_ZvhW~Dow6_3UB8W<(N4yUb;yLgMJH9v?N5fNB1p=A+$$JY7d}xl?~H( z7w!C7+Flrbhv~{S-v!;6%dV@IjuoMrB^0wiD?eY8d7nCJEMX4MW}HK7In6pw7Qc=z zkYlt>)m%~g{fWpEGa0wc1Q8Nfu&oG<)N+$iL87)Jl>od?GI&fngHPEaIzNjYSTpCi zt2aYzCl$3<2c_V3ll$#Y@z0WR$=2Ut#VQFc{cbuXzG^R8Ovg7xrib3tY#}m?izC3_pSEJnuzsGLPPie$l8spu9yY|n1|4q&LOJqD#G>y z{T6!RWLXzudGPsODut>IW+|sgJe)zu2WNQ|+)UuJrI8WAzH?QG3Re3dUP#w>g;3CNvkE5P0o>ACWg^+ymCg%xO zlw*__!v5xe@)x69?u2M23XmJTDnSEy9)YC=Io8jta*}qhK8#ZTOw#8#l)<~a%`>we zPGb0nnZ=Mb?MR!$&dcA&lm6qGSa)MGu_R-hcg2$6{5h^?r;wDzLL6*1+m9QH-6Yc! zvMSsplR8k#IV#gNEBC_JZ5H9E~MyaxP zim8bjKlP7yl=*k-1^4*`GI2o5k?g-K2Gz~ZJECU2ao!G7Kh?CIKizI7tIUrEBKVyc zA5_(BIdpmVuz#S>anYrZ>aP5I^KA4$)WwpQk(7xGO8(7FeKLYCY;Bp;k<4Yi9O43Ha}cXw8V2*LMnmpuQaa#a*X9xiXD#~%7JOn#zYpeTqr z;L4J#_$&J-H{yEnInT?Xm*e{3*nti!*PVV2Spxis6N8;O{J^ukdS{vj^wHVj3xtzX zEqvO!;F~Q4wWn6Vh%A64=zL0$HOqyj9k-zK!qC`j)ODAOmlDKma;PL)Cc5D%)|L-v zoN|CxfkjKSmNt!%@I&qcXwHYgpc*(hf_+2s&*b8rrQN4_gHeRG}tU$o`pLmD}LONaONRbVkwZ#mAQCSAAf zkOOpSJMT=JnupTwumvjATZ-Mm6Va}L*R13^n8JGJGCz>ajHG)W$KB9kc ztoMk@zbfLU_sBkZM68*VZQk7o5kl@{ASz@2!{`F%)E!*K5q^g8cTTJVQ7Pm=eCIML z(Q5xwbn?#q5c@Vl_5=fNn*~mVhhtP$>EJpr4}9LMQl8n#wK}wI#HG1&NnWBlyay*p zI;9SgL+0!jN$8sj;X)409#ZEtP4sTzBvfz>FNj2q0Q7Yh6+FD8&^a<}6MPi2PCYI>VTQfEa*9-KB^Xn`-eoGIZ?1ave0|ewvGAm=V!u zh1j19WQltF#fOgAhdI}~fQH=m1#y@&UPP7!39-_3-4EPuQPJ^4R^-tTO`Clml~;Da zRaoWR-?ppLTfg3d`o%HhoA{@u{G(vEQ3vWkk1Ycin_8>N)=|Tft-UTfr+GJi7(&tk zY9w60mx%Ao`l;sgdfCqf+U(P;wguU0mfWCQcPSixkDbt=>A4k1=Epj#!{)&qgY%&e zTI98@Ew+1cR8^DPf_GO<`y)Z4f>}F|B!_A&?&llEjmblFO3wh*K-0|*F~E_qv(RT3 zDz+h|%Zc>X&Aro!A5-W!3=tLMs;&lot0w!MJPH|pogPwva8*17?DMCa48qMh+DaxX zq2pFkfU??3aoa)jrK2}W)M83l7-1x`GB>R_vW!vKyKb^70fVM1Upm?C?Sx5>I5=2| zuW^h3PYJdzFk^|fAbp0O7(XrTl*Aa7$+8#YV)rYGzON;A>ET0{1X;9?2Po1qM#mKp zh`0Maju&)BR%T+PCUvh2FViK&#Wo}ek*$s;O8pW}`1&+d4HfqiYjS;Z3(g5M^Gt*b zWmX+ap0X}w=boOrA~U9%C@l+Y7~9XlTh>DfKOFw+%;0`AQ2kB%v%{)YUfF}iUrmib z9Bm-+yMAm_TGByUj?P7#-9&2rtKs?lc+?g`i}_1{WhM}f1R0azzk*!e3A##K!Rc7& za(RUCTknn*^g7T-?tW^sZM)gx4$xU{9HG`>LhstMQ; zS!3KR)2`61057@D5d}Tgf=6WCW{0OaESnky!ZU;gKwirJH??_HpN>mLNtrwh{SUuu z+03;=u1}O9%6d=(V&)2IZih6wQ&@*2P2%!hi-V#f|m&)(2x%`ZEstVk~LNt|-(9aQ7UzP@|iV?jvw zZle)p7{SPUi9?@+yl$U4i}Wj~3tqR_%9S$mH1B?YX_+)W-O!hHgiHrbR!IMuljcj- z6m2}y;L&FZNqpvrJ)`@1KejI*1~fDxP#hiOcE!;G{b9hN-z`IvIIoO$CUuT9w8p)Q z_y;;h7wZU?SoBc8ZY2q^!vXD&BgSullhmN^{AdcNy2D<6KHcmuyFwSVI@)!VYW;fWY+ zwKBT-9SQI1%eF4MU!U=u*n?CbbKWKlGAQ#Lq4i(yZSEIZRX~=#@h}ovml5`J^Fp)z zg4T!CMUH;+H7%!{8V7G88eWU3DL`h^*}_QwieIjV-U$rd0Li?*daVRNFN}FG@k2YE zB#-3Ko`F7zY9OMSbEE7k4HcCiVY=Uo3ej+n@Jgh>&3_0Aq7El&;Wcft5fj9W$SC)>` z%#%G%gwQ1nwy{HHm3Q-30I}E{6Q2k9PUXD%7_z6er{~hU)Z865s(6mobo?%G zA78-b#h=RQw(vKyzANeTR97bR{bpw-b+nVx$+D-fFHi6F7m`{lzH z)~Q`ezoYG)jo(qF2maHAGi7dTicNPNeM9rTSzCG=1DQ!P1@}^P-PTX@+hf0ZJK-B* zE`MlWVDfde`~n3o;FtnK#R#XDW+AFAUN=jF?ZpsR3TGFDMkt&h_$SqmDxp4!>0~zsFbj=2L< z)-y=!!lg4LtVYm7CwGq`rE$tU*YWvDmejHNW3vaUdz{?QiP=K~^TM}2Wj*jsWBF#1 zuIT@TrdF$u^F%#7#X}E0mZnof-O6;6;r}e8HUFuU_0vlUn>Ws!FVp)Ss%HdmQkwq9 zvqYIZL+3^{@v(Rv3jgBplVhPIEpZwtRzqo>Wiw-Uzj0A#?C}KqTftJ12^0X42J5C) z0U5G1rL|Mu7yf%e6iVe2J8X6{(AF1Yr{Tur-4OCpgm&becBh{oR?ducjz*`C>yK(5k;z~{YqWuWA*Y?%d`Y^ zA@^qM^f|d{W)dn15cTOZ5jECdZRiw}qu7Y(jDr&!TUzR3Mz%-Uj7c&y$G)5b()$b5 zwlHlf?PC#Q6uD27oZEjNU@iY+h^uMe^pl}a;SwsIK}1U3&?yt4#`R0mmZ$&C1`QMy zdbceW*g=vooy-0VHze-cbsLg4aJj^l49Gm4Yeuafk&U*@Dkb4&30-_me(ffajvi+l4?R{L@z}^I?IRItj#V*R+lm z75BG?l*p^ZD$?MhT;IVF;SC%l>PgKD)dzI-^jcQ`8QJ!-`l{loJT0Z1c^-(w$6WuD zcZUPP;Avf0-+%}i4hmAel{(p*F$!v-@;~Zm#i0)QhfY@p-NGE(Zat0C_(%-glUlBZ zoe&nmCJ7Wy&Ev}_Y0%4a6yOuvO40E52~#ru9xr&Z(12n{{(fN(6i)K~YLt6z%Q(k} zZV2BbS0RHNq%e<)f&!WzBAP>n{Z`~bE6%L~Ue^O{yPdxr4Z7Qiv_mYqjn>Q290uJZ zZ+VpeP{6$99$XZcmbP|E6Z^6H_3uU_ACsgXP^ggMZs;0zoX3X`u|YB6?V?>QPTpM< z_BWTuTIE`|NMV-RIm@iM^wzVN$ZlrIwY}u!r6mUxlMSTeotm1mh$Z2!a7sV~UUt#U zmm1yL+BrF0Yz<`bS;Vv;mkuG^L07O=N?NuI{LW_Jb|lYGNME>6c13kBd8^cK3yReD z?gv0+`vlJ}KiSsnsY+iL8HyijxscfvLKX4x3s&co0piu#KWi`#beXA;Yk`l^rv)$jnmSfwq;{q<0X8brm zOI};+c`bRgbZmdVk9YF_eu1^hs*M8DU@&+tYx#`nUU(Z7d^=!JxhJ-DVc=XsThBRH zrgtPSMDikbf(O!SEr)B&5+tUv<7Qe8JeHG#6Z7qlQv8o&jp~*>7lyev989Q2J20d! zrJJ_W^qLjE8FcQ?)dn;)9W=tA(o%o$my@63i;u-7u~*c0I>kB!?ue}%-}bqke)eka znhChwGdkR(7d7<#`|_}`c8U}49uH-FLeoxIRBPWgcS z;dp*9GCy+Tv)Blp$R^OKIkP)D*m`r$D(_rHlZW{!p783U1@}p%TfS#Vlm=~Vxm=G8 zq~dz2%I(z&WMA`x4u^b{jd^hX6SKgv64HUn> zIbH5ILUmm04XPt|Bwp54zcNJ5&&mSlsA&(rawoe(bE8 zn~#1?{Nz-O^!oKBPlG!u2`XsPiDq;df9ZYaib?&D3* z5^EK)hL46O!-nZ52>K+4^4oumd&0xb4qE=Mq>i-uxuDjqkVoyW^L%%IA!3bg=#}9r z^;!6ex#Dx!*zNqhq(ffXiMi%01m5Zc|IPuUbKvk z@{_U+NdpLJj~Q{^kkXUIjTw?+iL6I4e2w5SC+HqJxucW_z)F6T$$y-WA5i=kkx_QF z8j3HNGe-XU$Lc!*)ZFk@kk|hBLBQ`CpS#6dCYz9)H>X17uXEB8M?c$&kDMTfu6p1x!Ouc7SS0O<#?W) z(sm;0>ybMH*f=5upy=$!5d=Vup(0~?%U~}fw2k59mne|?C2!$T9V~3Yn795&oL0J-Hy!jY@A3BgqkfiTJ|C+-JHykj!hQB_w}{hZ z)y&u@LmTaOAyyy}*8G6o)j2@G!;&PbprqZt(H1yDEHy(_$tiZ4m+O>pdpGCpa2~c6 zWpsCvemAb#j3cf!c<6Fu&C-P-?!X&#=P!nu0DCH5+EG(~d&iwt6i@2LnVZF1oCv=Y zf`3B=5vbEG&9|l)sCDv9LsP}%i=C4HXXJu zNS!~nt89U+5UV5}fy#_-cRzXVd?nUp!7laA39AFwZG-_p;Cc^#8Peh>!uxN=!jYT-0~Iq%8^C?)8V^9 zO;S^)*Yw0Z-5h4_D#B}M_kS#(=Zdbm3?F$jZFSwC4^ju+9D5$NTwK3GdzSksLg7gD zNZaaBwd)XXpZ6%{o1Be-Fy#n^;!(7*M}+E`%puS)IKjriYs%w0Y_wq*ciTR!Mq=J1 zBMfqnqGw3=!4nY2c2E`NHv_p5V>h0M2`~PSAYA%lBv$HVe;*7kz>I>)RtVT-1-X|f zEqZ1fRZcy-Pb$@c4%HNmW;OgSVhKZ~l>;6s7&yd!`Eop2b~~Odf+xAN_qbhrkEwD^iQb>>9dk4+vZoI{g$==)P!_96GULV!5*sqw{qkSovhD^g-=)# zlM~9X0lz11{(yyap3weJkxK-o)XpjqPG~g;b+pB?`Mo;d#ts)|B<%=4eJlqj{qiHHxt7hA4#*f^^aMAF)?o_B}; z8^2tKIMZ&P`q()*oaYx7_F!Y9$*HJ}1{cU3R{uL-{ixUi)&Bp|f|vh)_y78-^IuWu z^#8!Pn_8$d)JsWz4rM01hcza~ZXAuO9e{O5pTIu)a;C$y3$>~%OcONUTd=1LpAgmR zPX*)~_@z{0K+9js@U_vM?WJQ^c;5r>8i-{2`#1IT^mIA$?DC1|x>=a`9p+zoSpa2l z#O|^pbUq(Nh~L>|YRiPprgvJ4fmhex7n-Kp_SA4Xq`A@Qc}{%)Qf&%>#WZk{f3t0g zH$IY}!%JKV<|c@lx&O@&sW(_Po&KD&w`JITsf18=s|4H-gwnmSs9D|>C)9kWM;tH( z$~m-J&M_G=KB{%uM?+sm=U*=&vLj>HpobppF^rSz#(4_*p1?m3thtz9na=jd1y6--}6w_RQv^JMTon`n8sa4p@E8w^Tsys67_4nuM9Ak1ZPJx&SQ*FK(#<3ln z2Fyi=H+FS$>U9iYl9X7?%%~5aXy}#+PullRjn0D>@(OytnU~5_Ox_A*)&F@vqyG{W zU&o=LoFb`Z8jzURP`mrdcTCQ8&QF{op$73X9fc$((|1WLv$}pQ)9*(b(`#C$ zH3xN}*c&I78(5YWMObWHDR!DO#1t`5!oC1KhjuI4SH&9|1;s9Nb9ah8=XI#Ab$L6@ zN2Ppprd2kf;Yn{5H{5V!n8j}fv9P;T`Wh<4L{>9J;&8G*$+3b|*OviQH=>ADH&3WD zz=&^O{7v>a-b82>i^hg~(n+UL z{e}M^EUiq(PH^Mk+6GMA;~_8xU1|;A?!IQ=+Oc?JL`8!1mpYSnhM|A@sR~YeU+U4a z=-}q)w@ln<{E|6gK0Ukrue==TcJvIkqf`_O($6$3uC^`{MF9H8c$$Rpf6m`;*WNAM-ToB?AlT2a3ZW(LHfu=@~hS~99 zoRn6txli%v>u8WS=ZMj0K z#p%&|4O=Yr@XObFY9iDD!^Hg4^LkZ-r?JDidiGQfW@VhoVEgjj9yGeXCeCbYV=``Z zx=n#?!jcWoD)pU@LGCCL#@&EP$dpaVjZGKvxcOO9hO^hs9d}T+bPv$)`&YL;5q8a5 z&r#4j$TqK)wr41uqpAK6vkadTh?)6jBU>N>mru(Bl&>2v^YSwiqm+9FP=QO+*HOeg zah+-*CV7_nt1;l{R4BW+xKVY8sO-iR%GqcYG1Zu@;CySP!mjhFm$Symn;EMi4putV zBde|$RzJTkn3fQsP$M`}gYCEmz@*dCc=dw5o2N^IJn7qOMKqI;+C(Cm>G#SkFJO)? z_xQ-fN()Y-VI5u#h@sWDT4hDl?9LSS++MiHP8Lj-vkPSZFmdTXV=rO&v+ye+hQP9k zTKVPJl*q`*#VEKZsBLAww`>hfVUEbl2mO=i;kBa$H$5#YeW$O85rTJ1M$`hxSAIeH zH#`Msdj23}arjBM`#-JW)bUTx?%9Ivr(7#F*(}&Um8NCgW=x6p&P`Va)V7FwRdfDf z({U0o+lt|bBym>yv66lP6WA0Nn=ovKT-rTPy!5v>!vvt)a$18hy7T-T!r~dI)O38uFYPC zX-lBwvuOrq0e$d&!FGxaSlzud-~OdleV?*U7gNiIp6BHHdAZxo3mDi_m%yYWQBLGJ zk%zRjL0l^dhOz>!FgYlwA#F54mgD*E`SZPV*XTMRkjNh2VlC3q)Fq^7x>=mKRX#pxrcEvgZZ$bCfrD$O&{QPLrv|u^4l=47-Cmb>}&g`>LkP{KS|! z=CiAc&vhZcscygiA|zH!*(W5bo}m}KP7`zq zqD*>6OOK$dfj~yAEovBI2&`XjEg?o_u|%aYG%s3~X2)BEe)B^SRC{*&bkwSTR;s+C zt!jUxDjU$Mc)xmg>FHlwsWCBi@i*WqQ&?EjB-M4`y#=#-ZsuY4vvVMhHwzG5S$wPD zkqMXl3Blx#;$raBE_KY0en7R-+$5ACO#AkqrM1KSDHD{7gKa4do^u!`U+HmpM!n}~ z)WuhxqpbY`)s$U2H2(mjAOJbM%;0ymr ze`M@MS!0^nUwM|+snnrYURO2MI#t`3ThATLS#DJ*XxH=Isi|8vw-i0;qT$9+8-prR z%B0M^>b}?SX`j&LRm$$xv#~gzVlH7qJ?80&^&8Xk>ik8tY5u5!w&FK^Sc$N4t&lO0+(CHqT%CW zbxM=f9^%w_3z@3%VWzy%pap=m^)JWtKYpxLj_ck7ioY0er90rPuR2&p(MHpAnFo7# z78-AYFcP%N@zM0En6T(kLU+| z(2>Xp5;P^o%hnm%Qd{Zo%Pi|F_P^j%F&rt}`hH^%wg)p4XL+oqeXBiaiygz1{5``E zqDq2!Jcbe0{03hhNZ6B>jbD~NGdDa#AX8>o4+{pG3a>5GWZ$~4)T7D)9n#9(^=y(q zWq~0L-7&DZZj8<+9l$VIMviM41(gVWK`b2_)1efrx;62f9@MNLEcX|H!A##=#Ug5=7MB*_JBM}l-6Lsh`%E{!&zv1+ zxLc=iGRRtBYb$Dmq#s5o;tD6@ zlf6A;!j6oY!?&eswiEl2)QfdA^za%(ZM0*cALos4kn~!*nHoWKw6?K#elP|D^&Q|z zSM0MBKvaZx0~b&KA$WK~=i;H^pxJGv9RU$|zeuI}At5|$Y#_cXYHdi@ccdAUEEn{`d zZ>B25#8~FWyirTik9-d?-cnrd`{4ygsXI?agpW*=Ce5vVBg&!oL}OWnE-keYlJ?-S zx14^TZdsB{oGs)X0SRxB1VQ)0W9IPdwhw+lmtS!cYYPud~r6s@AH?E6bs zUKtqo!BU}j^un05NDF*5*{6FEl+81^ofF*uw#|CCJ1oJVxSCLMM4OcudnonKVM7#} z93U#DYF|El4`3LZ`0U*KSdqf*3OVe%eeFTlUGgA1alKf%v<3FmuW)hgJr#j;`G#B~I&?(BeCoqk>*Q(IG zi&)^K<#KI^A;cr{yB=gs^MP1vS@YW2RHNQNQO19vuOBOq?vnXdjjC|ERpdo{E|xf% zp`viqaXin>V-Mc7_0{9xeb8UQt3w*F?TmdJSD3Z{N+A@4)P>8Js~^8fR$bf|NDG1? z%hz$7(arYcwJwRCQ-t8jjxGu~t!l3Kwu(Rmtx~w_2 zxc7QUonIwfisqN*J#b+7g5tn6dhHbWyefPpHi3c;x z?di~f^$%^1>oHAuP3EcPd;q^w?LuDbP_EIX94egTMU`m)#@l01wIk$aY-E0OWM?Ds zf>rC0pP{T7aNVhxsS*;RtJzs0JSVv?^!^gxg#n-+QBk{ce=9Zu%eiT;XQDlSRa3(P zz&8m64P%pP)nsk+9egc&I!yO*MB6t5;ZnNOy83^KKRxG`?wN8E__Z%HHM&We5ilJ9 zZgH9!oh3J$sZ!@4?>uJWvckHZj%LL$k-#LBdx!rDLb6_D=sn2QjC|#1Is$ijN7s!i zg`tysN}6w+NFG0{>a5A|9exK)w;MUqBw5%LYMb))nj6)vK`;HtuH~}+M6HA6-HPR` z;|nA=Q@s2KE(w241F{0|rA#H78Q4{u(!}moeh>w99YarT z~bX@DEUNw$JCIzm14f=-<7 z%L|Nn>X_cMDr#%}$gI5PMXvh8FmEM5k|4@oz6z$JH%+D4I)4_B!iJ5$%|4_a!|5>~$ooq0-Nbu|KRBUI(1Wif(m^0!d2MBm(tu zWsuO(`reVY3wB9VE4aQkvvxl+4hALZ5(9}lK*;N@5)Vhw;d#%6sU>)mSb*1Cnij(> z5@q>hcK$%umv2&{QwH9p#uIWFWM@QW#@QsyguK0S`I_*3i-p>Fsck*0(E_$TSg{wY zpW(pIool*ungCY(iwT<&9jf7Uq^M`)IodD6F6-?$bdstjJnqR!06Q=r^yeROV|BHs zvk7pcX>-r;N#gCLcKc?Ml6Btd%x+Jf^I+C9EcOa2d*xz}ZDgSitWo!1-@VUQ6y6mqQgs36ZD4Qw^?=4UI!i726o(EVY%Q7Smom#vz7T_Y; zx>!?mY~D=EAzj0G?Y}QmSkyJxLWP)Rm4Y7kaIuSZsJTA2l3ON28a!Z8j^%X4xLe&*6(xV^zm2)WQY z`tSquu;V#(Y-{~-wHi&|-YpHU!HL>L>kW(C6<7BHtUmBk)eWY6S?6wUzr0ji?tc&0 z>Z)Dct<|u8Arl`^O7qn^zjeO7PY{`*G@@8#->@rzm8t&ngxYv9r?}HCq{AzE*-hH_ zNIUFoQ*?{2%*xjw$92Sy8x#r3I0tt6@<|z$>-gm_QD^(rI;jAX@Pv87fvoD#2GX9d z{1Z7;(=}JRX?q6t4et}=+l~p)@5QJjs}}32d+vn9JAH4E)VI@DO86v^jkgOHIl`H} zuG$ILNgn67AF4}U)~e6Vi+-5C{expy$yxVh0pq8JTxSQF3keTA$tPiAk9FS-#M$R$ zqj9QHuFvJuVT_8uPPpRUS8my&h)S4dvvOeX783RD0N?NNjd{;bx)lwG{y;PabXnaU zUN2nscFV81|CjA}L zw-9kZk0PUHtv?f#a_TH>x@olP1j|xRB-4Z3m%GX2WLaiNg|?v$L0QVPf(PX&b3w&D z3S?4Yolkm4IIW=iEAu%7FbL{RAW+pG{$08=p*yuj=GXe<1$0R}W_i87fPlXrwtG5a zi3ZOd(uGg7>+AH#u{a$A3}fTXW!ws-p*9J*eaYxORqs&N zp7>$P0T%uE$z|V1s%7LVtyFi)+ea_5Nu?iEDNCe96R>U)MxLwY<@sQ2s~j;Z@G)_3 zGVeL5&Mp^W(oH<5@07LAlIa6Fc0Y%04=Q}&!_(Di)gmyG?5h4$&QQ99cpuqMlwUo!y{Rtm_xn{*&{EBj7CKL4$&PY**tC)Bj-o1W{vZaBr zIjDqnEPIRAdi89h)@w=Hug!7A%#nSjEtgR>;u?L5;CGx<%fSqgFT5$Ig)b)v2mpYz zmSSfYNn(Z{;f*QSTXZ^7-BA%^hORBu%fAuBw>3a|s)xR%GW1P_5~H93G{aWn%5blQ zqs~8;-_eK3uD76*%oFX+rVUC&9*G+7rysq36;V&wfgK%T!Oh4~t@!$5y{{xf2-oBP4P?3Tv$8@9hb6E z1SG-Zk+e@}qaLA>)oH>xb&1q+3Vdj@hBYnbD>6C|v0rBD*=%77Pf>VgqIa$`2HEFF z((5GBBZ{SIC%}xyCXrU&0K|^&Hl>?y=LetV?so8BJKg_nywj=v=L2{yvzv-^7(z4?u2Fc+rc z{dhK?M#sL-A58{!zcv%eQzj#k5gTxQJS_{jil=)W`1U7*A)(BV5R`mo4b6`alOOMO z;++#c5%7Y-fbK(l2V+^ab!RN%i*0M7g6d z3cW)Kncg3q)Aea;y9MKBp=CfUF$vUiaC#SqoEoQ%a>CzQA8#+lTY8h0=7b zW6O$QfjEtfl>TC-P}W%PMKY_AzddoAoo#BaVQE^n8s3|>HKRwY9i=bdk9eQ{K;IV= z{0bzC6QZY$dN%RZk84niH6=h%q+443BcnWK2ei+XgYQe%%aji?w{Jif-;-D52~b}X zXjPN>p)?gxEqVgkPP3c4)ZZ+pMf<*-rj6Gtkx7G|*5$i#^12#ZS;4z{eIr5~x(|gz zGXY#qigeG3!%c?`ef`tUg&R~4ICa5s;|Yaf{F~#h-dtfmMB|HChGvE(sL(n-_hiuR^Xm0WC zw3OtI0s;Ma31YD)ZW?2gw>n)j{6a87>uA}cLW=?Gv{9c`D|o3n+M1@}3#hL!gg)4w zhFfQWD#vV!66rIOT-l&d8qApf{)?V~D~?FM+wQkDiX4mz*s`<(H$0T;+$;8TWSTOu zLN&4F+hIL%3r3!u^mZsfs;jHZkq&!f3c5XU;ot&f_Um=TVFyMs=$4oNllPh>) zhDYkujmi6%H@NQ+Xgm`5bc_B-PL7^|m5u)JozX2Y5+CT&`UEa&vPx!@hXiWOj3?I&KmE{PhiV)@f7?8Ow*9_ z-kaVG|G`ntmeoD1f8BSTOGH%{W~@MV73o6m2hy868Iu9w=NL)tw0J(h6J)GmeJ+7{ ziBWrzucT(^*)&%0-Vmvo$fs|I$wRCit_o5~5c3)rLv=c%Bh~uL2E>a&%b&?^2nmuB zqbkU&i;seG0IX@{^Ggos%p7>6O<)zf7bL;F7;%0;k|7_!7N{D(S1LuRqRIa4<^Z4| zG=uLqzKeCjdB=$nTifP;AMxbMEr*+ka?8{nLt5|0tLu{aJgRZDQPasX-&A-Ki8%C?CJ^6hWLu!TImOHGm57c_;s;pnX1tJ8R=`}g@hDuE5y48Hw2fqhT?^GZ4E}-Ky z)^3yDS!cGy*Vu9DlzI}|@4VB<$zbzNc!K5{4%|AAM(>t)HMRO)9Q;E#xV1`2Hfmo#$<+?-?^2&F~zpRN3f$63XGcLIv*h7C>S`L2EEhX8|#Vhf_bph9L== zq~{f#a$0OC366`Q5sJfeC1@Y*xf~hB0Izqi1aBdxAsv2Pi@y0<)zuD5h?}P^(+{3d zz19_Md$V`?shbT1_)b;%%oaUNe%Uj(IYj8LBSZG**v7=QI6-%Z8?YP1eK_$~<;XaZ zdXSJoFp6$7Ty;<${h>j$f)!wB%rlgA9yJs!M3ifaYNZeG*xxyzqMxs!KrtbgO#s4b}JyZERXH-y(y7gM0` zPHN4*>4?sinIhYM-}6&y(N2?@r#VFBCN^qg)@2Q=A*IZsW<=F0=i6)GNB(J@q1h2C zyJ`8ymkq$1<_3nFN2CQ$2p&bD4`Pf1CqnCke*iG)8Nwc&%QgTbfzzA`?K*t7zYdDl zwZecl4dWHVjn{08a9vCF%)&?A*!1UxTR ze22tu1Rp5g5(R(H3RouBP5=API-7*OM9-DOsy%!eM^QQiru;!3i^hR(WG)=Iq(FKC z|DH!Xv2^l^@2p`+Sr5lXt=oy%`>Sy)fFnr0n^^j0ID&1=&TQDXHlFjM;uK(@`ZpqBG)Aj7-a%Z6L z@h=kci9e?41wCDDMi3xya;mF;)M78kdy?s;?hUMZu=GsgPhBX%di=^Ge{7~JLEJl) zu!Pb^;KaSfU714kl}jLK`@a?U?+cmh)FD2UoQa&0*SC8=(z6nHI5wH$n;mh=uNSC< zjO$9HF(ib`LfLq@-_FhiZM#;6$gg?pB-r?&1fq(`Rnsjn-8eaSVr8QtSjm#vdiR ziyk0}``UWvmAq-cye*vF$m0OKth0XEkTX=|;5_$?Pci0`yYU%tSmGT$vph!s5Ixpg zP$CmVI~vV&^(0$2ebQHoGZ<`4i;GXUQjItjqo#&++TdmU;N9g)Vl@1=?932H$Tt*K zq3O&w)_NnPi`LGn53P)^_KUY)|6{`2>s4wfgdS8SC22mS z(Z#|-Lg2)2Uvn{VGxBQ|e=Pj_t}S^JgB!Qsc?=}svQ@!@NV`<<7U@TvM$$f)%( zI)E#CvB*Z#lTWkW?g5R$hy>=!h(nWdJrW$cswQoK;{C>8pLSK{FXyk-3T=#=|GtSF z#l~Lr`9pBuF6TpIcJ34Ykm=}h%`#ZoeAzGlvVa>N=4%J*cU7cgB5)({Z!!2Bm*ej& z5A!`#*lS&CB*lqXYJJp)`4(i50g|NX0Lj0mFJxP7pa70(1Iv*S^=Mgh#MF@-=Jc2o z#6eq`F0D}8ll6TG>g!@`Ne=G|TI!US%1Sw}-LF-%$ZevjQK8KIu<#NjliS$%@8bIQbT$SiM`0Oo9M13|8MF6>wn&p*J)26Gb%HI`T9#oAxQf;yq2A! zZ!|i7)V0PN=Y~igd;1?=4t=T`P0%ZxWhrn1;S~cxW_Z^%gJ2R{lj}ilQxu3%@4sx& zN7(CF7lyfd_mKz7Ut^1e;MGge&l^+ovpAqw;I+cee41Om0*}!gj$Ua(>e=Vy2n7?B z$hWPyzybvhifP)~!f|-08Ree6{2oumO<31@m{C5YJ&6~7Zlh|&@M055!T0SO8~2rn z?n%O{t_!9w&30}W%H7lNS>0&agA0y~n0yEonW?Vjv2IlB*fWev^W4DfK6NMMQi$9| z93mr8)IDSRBC)(tv~efGyhLE*c=(s6oH`8<$yV-R1`4>vE*XgN`^Apf_a}s(#$COg zXOB9`73I9ZjVK_9PTqLIvTOZ!#((DHu2#CUf6fx~%LUHO4w%5$+Ync*$KSv>Ic=S~ zf+??Kf1iBW`?C*m|APqXAFh9Gvf+7K{n+8#1tWfRrODrgT6FIxXiU!urfD4o`o)A&kj9 z(-kacdZDeN)`OuQ6rLKt+!-8@va0tG87Hb1l(s3o)eppVN~mqA*F>e-pm@d~Q)*K4 z@3n}Yhw&l4$=TRncKHQt^DVf6J!9LjFYrfq?ADRp#@8U;Fgd-csBoq-qAHRgIk+o& zHc@!wQGul=m$7kQ(d2T3k50A;&tT#7vzqz_A9*FN!%p<*NJcKuQwHAp$6CpmPQG|U zoHcdLqHHhf!k#sCiEBFAtQ1)|eEY16-GPZkn;Q)_kizItsG1nwu=fs^5BU76+2KdJ zy3>`uWbJugkFp2%b)rg0q(<>u*jcUb#X#1M^E_$>pOg!9sNwvR z)paN%A>_7YaY<^JpWm#R^w9Gd4R(QrkdWAvX~@V_Hrx`7rI%Uf7u)d=Q;mXxNkF!g zt23Dn`+WGTJC*+!OBB;|=;9T&&Y)IR7SY24)85gdk4H3x^YJ;~54x54l@^E+y>s?Q z8>hQ#vdrVnxgz^W=XRFxI9Q~l@uz8OMXc*j9Y;;BT5?C*)K}^H8MUji99om1T&$sH zsR1t~ij@a(H8^_IHKiZqO(-zAIQx*)wwN%Ca8@s0?eqF7Aw*KRd}4W{s~Xe%ITlRv_Q@ zJdRw=sMBGw9Aq@}-+2bN<)7a(oUIyN=OLWa0Y-R#lbx1e2jmXPql{K;tM@HB3b6=HTb`oaj!zxK$9*72Y`&gs`oB9obv zoB>)8UI)Wvxx*aKe0L?$$~}Y1jaZEyg`1YeByQ@O$Iv>-N%6cto}?OL71mjFn%_{1 zc$JXT@8pkh9G^gBn^;Ffg+*j^<*;Y~^j92L)MxkWAIx^pvPa`vJfMoq^yG0l^pwFs zXWC)RX_V7!NMRv$tiPDfTqzT-Irn!xw}Qny|7)>Ld`4Mj=@7=>^@iJV+Ls1yKzJ@- z*dC6@hHrGd)QQ>efMdi&jOSfOL_zHClL{BTbRhz9N@y+pIm5-LSb?uq7cC^1H?wxXrh(o;*YkdYX7rOJht<8oz_KJR zv!XHm(hTHc@1}z5Wz@TdXnVAOx+1TNC(<2CPUNv455KHTH$<{ctgMf~vdDH;o7M}8 zCD?l3;$^ARa#WIK2tgv=bCp@2kdrMyvwYW(Jj;&Q80 zU7M2g==wt@|L6-#?7@>OM}7Ot2zHkTcYZbxnMq7G8va%7z0?_jJ!e<_y>bL6a7qXW zh{{Q%$R7TF5hSL2 zleap5N(&OhDguP;>~XJh1j4|JIUFSU?uY&y$@|W(hZ8vsyCvFPKZ%09R&+1Y#<8YTI!h6bXRQ6%{)e5PKg`h??FpArJPxgu#)u8sRYGtDn^-(wE7Y(E z)%3z*Ssh!ZVc`I(S{Sd?M?Li1j;|v3%Ys>FQZFE;5A}A1Tt4m*Z?vqkzjxff{H>-`+ZKf)YlIT$=cz&=1=YLZR$tdI+sDl zz&M>udCG3FuK;^!-lp!$Uk)Z$?;%PKs%sdZ1~FZ+=EF#|G1**4Sey`h`BQ8ApD1jN z)IU-{b%I0^>K(axV=J^BWd8!$m0%^+sGS1NXv7>0mqaZJh%<3Dg$$2dBDinPBP(on zrZo{?GK9@<7&)k68r3VG(#fI*p8GSbCNaE^I@LY0#?6HHV|wT#0ke~e&!D{Qa*dY z0?wD>HMw`0um70D!zdTW$aAwdg!}DE&JVx zcciBw?9qW(xrd(1_1b@HCsbPtc?l9%iMN{Zw1U*XXhtc-`*!>j>d+sR2UFoHLWpV9 zM3iSgj2z_;Ir9Tr^4!)ejhO*|C|uHDj3ur;XIpd zTV@OolA-@WrOjyAI)_8(tmhND$j;PDc6_eovMp2z>NnK+7PFy%kJ}Ox{a3YMt#I17 z+CFy1lW@PvraIHkSUlbDH>31c6A6pM)>JX@EgcDw$rc6;q)!?9Hd$pJR|eOFgkVuH zy(m{5iRhGX0(bh%&o>2sU74$-xOJ?rMH1nIeJChW;Js^4YNGgtRoS6t@bHYNp1Kr` z0cS*8=Wsol`EdqcesEK=ZSo1u6U{KS=U?m1($%&dEU$ViSD!>UxN|qsc8T-7bHH=2 z8Ce!?+n7gIxaS+(rbkm9F7ea0an(ZXqz$UWRg(HmjOSP70|^I@?}%mbLo%Nbb9%pJK$$HC%nM-8c`HF3^+u`u24F_&sCZdse5OheF}s9JV(0 zz+n1bU2@sUV5(%3wT@jBkt>IqJa0y8^Ye;{iDm4TbiL+dR&zx6rXJ)uNQ}&FRlZKU zB2H(~GL0Z@WM=&t-p478BsK|MkLs{bzdA$1Y(3A8(+54ujGpatsmUbh8Z7F`ar2%n zKV$t#j<5*NDQd1Jp=iX@^Y3R1FkT~14Q^9>5m+vDt(@Pud>L8DHf4$_k1fY5*iEY2ANoX%4E7ek`vRb~K#&m&Y)R1RjVEUd;*IL~o>)?a7I$xPMi?&Y>%3GXAmhU@UVj+`#*Nd*<{e7E7aUvY`rK4EI%IduyzsI(( z7qqLZ;Up|qVWxPt4|q-(T`RsU8>4 zm~0R=#(a`XGClu;BE-A-^7lnL9o6q7fzgi9qYq&`q%Y2hkS~E?<7pty=%cPF>eUGo zc8q(cGsS8b9i6O#tw?z}w{f#0?aSq8H!$pc?#A|PJxF#{qh|nOYCU*jMYEV>eCe0-Md{wHmmxX1byxta@fy4KLwzQlA5{Tq4l0w5zuEgNlFE`g&Xn z_{qbBt+=J1CT9*JvYPcPMfMMe9z((p;{Hs)pWRoL>v>mcmBrKu;bD3rd06_ZGba~fRcTH=YYMBNS$=JS8&R2??ImXZ)ErfHwQ zo}Zf5WPDGYpNKetMUaq)SvlL(-f=a&CZm|Uzu9l7_9new%9fEgt7y_64DSV9Z#A>R zz&OByQG6sKSup~+izRHv^(Qjz$$k0ZpA=Qd6N(a?%JH6GyJEOYHjd!}dn7hPdr8xb z4Upnm-}xGyBL(8NocfWU-28|yUl#tj`&hx~q?Dkwak@WsVZ6t7dtdd;ugx2D4!KPA z-1Di4bK0WMj@pV;gDJ>O^PO((B5OT-vSviXeJ1WA$3f&c_{}fjG;euUn`J|?+iH|> z%Dy|zJ4p@siR0}=Fy|QYsw)(eH(#{r%&zCp@Q$tuywE&4jOx+S5jMB_O3v6VbN5c} z*%aYLO}g_+4i+b^vb1R*cpKZJ9xreY>insIR~WNj%~j()(^sU%?8dcxUpt5yjj6NIs9(zk zA~(M;YOfYAA3S)W?)vm=${UL+S9rrba-lcTDbV|qUQZV-9!$ZmdSV*}e>3-YiuGXB zhQ#Ht>^8HwcSD|8P{SWE`@zDkviE3q)A&v=;4R8-FKX`&i%jnND>PxQ=?2K}4;+ZM`P$9-3Lf=O zkXJkdeT>B)}v5nT@eWNXk#kaNd&e=1r5aHJHXT=XZ z$CDaUK_o9Hv=^$#o_~AtJ>)mIsj=VWsqewn`O5T&LR}oS|16H!`wF8gRP2Gs`h@&=SK?!+A|GIA$U{2>;hk9Or&`wcROa>NkTaj$=#W*y&+lejw+Hp!YfdC&@t$#KdbvWH@0^lMf!+@Pe%( z6LjaEj-Y*mD1t?`R1aV+OY)R(E`)TxijTO zsK{!^s!DZ#Jy21U7z(AWsJQ2wFK#maW6Jtf{(Hf@D%CoRD#vJF7R*_OZuKG^yR+Iq zIz|LR@c~KZ{;bqJ6%G`)^7zSJ0>AZnYacPV>~ub~ORRK|%%Az*0x`Ch!y+(~r=0!w zL)B@f&RQpiVw{qC<3&!*M0W`8N+!PoZ+E|XE;dt)F}Hjm#rxx+VW@_|$tu`^2o_j# zP)u!w{O)~RaXO$4Zd(2wO(3xx%%kJ1pM2qRS>tsoSoEF@|MyySw>Ykxv_H1j)I5KN<4W#^_*-XcBV6^5g18@Mf%VzyyAN;( zg6X8{M-I|-T(D|avTj@61ILz+fFT7#hFwmGx-YNcxSk>W$B}J#L}H)X%YS|M8Dyi% z5hRp2e!a$fk)9>Sp4MCPu>#kPlcpEaQ#OnDMI56GUuO6Q{(aT{#z1aIZ%TL!Siy!8ytDR~(5BJaTj_sG1IA$G*h^KYq0qfxAwEZQ#RzUL)B6!=S z5G6`1%gKcL*?H^xg*-33c@XG$bMvn1UBme}0A!iFEjspR6bU&ctFE|QW~+s9c1GLM zGotA$_)U0n_D%+xsD;aF^DV}-7oqqC{Tw*szxP$~ACG%nJT0Ve|>iCe@75Bh*-k69m z(2b9@?+HT^E^61K#}B1(c(87;ayU~|gUOG*Z(S{rvTdyXaX%;j1xBHLCF5VQ*ceU@ zE&FR^oWaZ90OLCt8$bBhI_J*Pukp?G%ZDezKbg$w=1S(f)Le2}W~~j22AkYp4Veu( zn6g&Q=3Kd_X*likHn%maRdl{i-6~3hE6)8UO-`yYvPvdnBi~;S#C%W-$62ISpTv!X z|J8RgTB+OAF4EqvL{5g0o!|#|v=W}5O%TcAKfSB}4PpXsJfRW(IWAqP*zjiQO`@8H z0WWaS>$vhl+JFl&6sbZuv@Vh|e~+_DPSoAhU=43G zU(H8t>%UxKEDFqju)P?c-}v+$kN}8BR4Cm(x@P(P;+aZN&myKBJ4X4 z8KCtj9Q4rkxD^cZM-bn%1#;pykTzIVAAEPeSwnPdjc#;|bLsw~LmG6>zZZM_?tp8y z$Th0wBBQ$4SuN#I{!>@I-qFLCw{taYz&-^uvpd*-3{qZr1GWB}YIu>2O|>n9@%yed zo5+C7s!-22(JDXD)ol!x0$w4znto0M&+z=SKKVYcsijeBWK~k7{?(mF37y%ez*v@o zgmdp|#%y<`(g2Dv%4gZsc$q%)eK*zF+4L?tDbg}GGXNR?iLXXK(>$qPw3n}{^93G- z(tF7j>*f~up)iD*(x?wIS?%UZ!Aj>jV$g~&=blLpUMdsy&*}+7kROo4pR^Tddo7wobpaLVNF5zwvbB)PHuAsLnk2dIt6+N(s*!gL>&pMCi_#fb z%iugZObLl-y1-pxp%*2J{Vn=ZqX@bXiu38;6R0!m>x2~d9b&JKtXkJ?n$Fotk^a6^ zoq<&GLV7oF-O80DD@il$FAlhG>B^12_z-ka`nq;6rHW1JaA`?HW*lb-c(`-uRKh=o zKTfUfW z(YnxP5kBD_T%QQ@ZbLizaQVeSM&k0*#}S%VoAzN`(^P*2Nm{k2TIb!qnOuQ^q09d3 z;yt%rFv9Rkmy>hnVT;d~=^8*42ehKzHf;HLoF~1)1)hXeCVpfa1Oj0QJ^V9wWB8>K zGS-+wKdQhj-;68Ugl;uduCm(r>6lYB>!3o{8BSFvPtUdaeL&)wEPHLt`rGlSoa69< zx+}4?Pes$NzW=_Qehw4q<7wvS%N<*t-M^U%=?Da=nE!U-{C=k|dj?Jd88OGYc3n8x zWtr1SSU0Wn9x#FQ`<#*MtNYl=s-^t41Pt;!_*zh9;3~zZz3y@v&4O(amKFMRlbNt? z!*kP(^z`|2=->G}x4(M6t_@Pxy4QyXAlb9*d|7};0+@FCSvXfdjb56Hkpx1Wmu|p; zO^4=}{v-myqn>oR5BJeoknMoK3epg@4Oy=EiZ85mHESn#@x&Yk-yB?vk zr!_s=<+@+@w?F-%%R5c66p|~rPT3|C+Zm)?g|L`u= zZDwW`z{>eNQ!86x^*RGeEL16Vq+xxApnWw0(SJeDy&`2$UO=JNaBmYcjw6T5;dtTXDk2Hz<&xs4><~p!rq&} z>=5qa;M(BhuIfXHv|A)HRWl?B``U%@DvnPyJGH}%_e!N&x&=wxd-tUdnIlvqgRo_p zmFHx~vf$=shCyE@xkm*yD_`*#T>g2&p!p`J#3idZgrY4*#+#k~UccMnD}{Py_+9_s zou{=4_h`&E*BjcRw?SA7`X9#Dg-JuMpK&RCL%VAv-i!Op_S{`kSNRDaLq~c0Uo)(q zixhe|e2ln@CoIhe;F%^+>fF8MZ@^x`cQ6XE=wX9-k?XzYkFF!T-A&%O=kAT05)K6} zA^qnQJYX{TO%~LEp-CcIYb-)|BZ%10y_brp_jaA|rN)^$p9}TAed*p?)||R1sl*P_SIK6VQFm!@6Rc zW7beDuU#PvL??!+fq@&k0RMrn$JIp!?@fl;IrueYldm^oA5Z1hsrQ~=UU_9IH^QeO z5xSkMCgA`a;~)gak-%i~ST#JHuiCzLKaaZR@;wzV!OwVw`;&uCGU%RvET8en6He}&(s9_@eDsQ%?$ft1cC-p zUwGc@F`VFa#m8mhqpAQz3ri88NtF#SH{vlcw}RQ)HE{O@tJz>s@BiAPt;%KwA zL6i~i1PqBHwq=5zr$V50>kO8h@%{a>1yj&0Zv_nyHXwQ8d=e}&b`|8O4>c$rk4{c*jI*hwZ|%yRT>gAnzKBlL$J}48 z3W;ODyQ}P$@v@aRRh91`I6XF#^WHaf1D9%&k9IfUkdj`x8$8xMI0a z`BOLnHjTaCGuJtX>Mkm)%M*O>JpfYY(uT`+S#FrZi~++cjV=u4&sOIYIe5?jTV%<8 zj=xjmhx(j&!5(Gn8UtKkVBL2(mLg}Z5Z%&9zMECL2Mgfkf}8s{q9ia5#_SsQg>Uxl ze0LA$l&DemhBqm^4Eo_MkL;SRHmWx>J-eO*cWwx7z_B=$|3FFSemK0jP1H#7N8 z{M9#&XMJ{io3D<02oa~ zD>j|={{Fth&e*azbVmq|GNh;gI&-6awF`T z8@*91PZWI6wsslI6M&EJyEfnGrE|c*_^1aK+T!(O%^rY!hey&uq}8-sKwyc3+T6P( zY)I)8d_%}#rw7CMHka2%XJ>#?f&IfWq+N!i4vcx#_czDVee6JV^oy?2!)}oUhvrM zwDOh&d{y_}_;Sv>?+J!G@p#}%Q$(x+W&@=vJdOXR%qz>#X)T+3>#bIUR=8*hY4&W+hIw?L|fBNk0oL>LcO+N7o7X_)k^}?KNAHlcF z>o9Ih<0z?JdGfH>Xrpv?K1)^><(+VJ%=Bm@-AY(;ruu@t=u{Y1g)uZ1tx}9zSbkbuVCn#X@ z;`0QS7+uLzHBn(;8CFG73jA6im|}^-^pENe@I6giyzI>zv~W=kLfhy2?dt3{rVx_& z-wfY!Rf)IFT~X}gg*G<;Jv;^J z$W-9!uryj2)=JRb)h6V@5&#|`P!h?(7lnYA1&zA>hsNaI$=vQLCQFTEi@6| zONJ6=H$Ei74kED{ArNGJ=B|!T@+zL>W4lXzef@U=*D;YGP!oWD?tadJUEQtH_g(5Y zNl?(1$ekTb`mnT}02!Zko0nDlgY)K<6k2o3ERLKQ0|aA75D^8+r37vOsurm5{Sanh zp)0R}=(b#Lf!jgd<}I^^etG8zc60?lhCKjKoM{WhTYX3LZ=DY+Nh|l5&p#MAYUh_j zXefcOu87P!Y`GC@iw?vr=3KCJht`m@pYFDKj7T6yGToa^+3sQiLB-6b_G^6-Lahv*-9en zR4P^qerkFp*x+Qt-f8I@Huv$YJqCJ7H|>CN8|bMzOtAjQ{ZF7_K(?O}tR{lsYz>3g z@D#vGhfgscJvx%_vJd!_=TN?Ndv&@G;7rSPZ0lImw1}gq?`&`Pi8peO*24eitR_^U zrJ^PJGfS`xNC4pM&d1Q2n<%fL>GTG~PiyKxFHkL4dsIJ1%SiShY z1k(5FcZ)UINmr_He9G@pw=P_mS904C0HbzU5zSan4%Yxt#eejIqvD`03Ev>a?}H7> zB$@J-b67#?hB4VPTKWqU$`zpnkzZY15mFa(BqdJ?+Mh&r2fxaRjNbf(>u*(5H5oR= z2+pMXlJzY)R%nRG5RBc*2n3_3HDe(>p4ET=6q9WF)U>s`c3vH1Wu=@>5^lNX6}U+% z0as*l-u2(^?IYrrOeyuD?KD7jzur*R@yN&HinS3L9JM&nWKrorh;0NRd^I;WC7BmYXj zOYmQ4Out-(>$`|&5-!u5+?*V$Kh{j&bC5*6S#1#9YUjAxP-l>LLai*c=HOA$Xg>)v zSm#NTCGoeG266yTdnEc3QhQFVcW&(jcvy~S$CjVRbS;x^MC1XiW2zdyxdrr~&tUS` z{;uZ0b0}geiJ*ktZck(rs!zx;rT{D#)+0~aVaS6Qd=i@{Tsu?b4WlATym{SC?QS{# z@spnEq5H7s${Y?p4VF0Wxf{{A#*e)u9b3v01^eX1%RFTPw^^eC*9W-YpHUfsuY&1v z!WRpkhs0>1Z2C#-e4qM+k!fPj)uqlqz*+xi;P1O%8RgcScsrldw7c-+pq;uOb0W=G zgVzW_T=*5yx3)Avbnpg%J7)#rhNV-+{OsH6PJoar4IyO4jpw9Zlo-X25JYIrN*{BF zc6EOu;)w=e-*90`7@K}vI|Gf<0=IZVvhHzCDInPp(+_7)d@UyqU=d7FQw)!nI#nch zW<;x_@$N_D2&;e%(+jsmjtOk!ql(WrcKHv3HVj3gKi2L5NYc$6X&&Z!CI_Tv6mfSa2@gt5u=-+CWpC(5_-UYEO161J1sUX7Y(XFZ_q7Ob3&b-SC z3qUv$%0j!o9%$fuJ)X59#2~Nz-w~8Kmer3INL!qPB#}9LITR26)+@pnVCdgFBk-M$ zl2jwani*bF$zdm``+r+gYNHA!9FjPc^jwQo0`8j~Ko`64CJ?`!;n_9p6U- z+w{o8AFFp>Ww(H^Yz`Gs-SEEx*;R^+AXLR5k z^m1-fdJ|K|@xC2}WIqcY zY{=aU#1-(KrQZo@c1<%E-UTafLPq_7#EuhF-_ZMPROx1M6}+R8hvmO`CwkmLf=vo+ zwBTz4BSQh+7O>DkPg>{`7#@UtQuPBqh9cw&?{^5f&+CkReC8Ltr6_2#=8mWE5iiP3 z>JySb^Yp2#zck7B&?m_FWx}XK16}v^#5Zit{ORSLb9l&TZ-2ufudOeuPvzlb!djPIAhp(Fl}k_kK#=u6~=<4nG(zD9JDlVEv!^ zD4S^+P~$K2;yPKM1x-K!@bb&!QZ^#;^?6b zkMe^b(`{V4{%VWT;@GrStgAgnJm3x}SBR&^E!p3u~l7~OISKiNk z7qtjzcyCLp2r#^}nwgSOcAf$;tYIn;#z=eDLx$l>unW@> zX`5i557*PHI2E&Y-a213uy{=cXB|0{O~GSdHFi01|P zb5u(HFXn$s$^Uo4utiiS&U*3K_v1K_Y+?Q02RA-_VkS%=iTJPV2mI7PBCq`PX<&p# zoE(Fr5K!=8`RYwI^Z!^b_&+~I$Xnc!Y&uTh-JsHEIt)ytjp4qps37^&`wxazT6WkR z5qj-^CjQK{r3yc61H*!Yo1H9-ml3D|uc>^LkOoKL^PF^C)^Kmy!55M!(ay}zo;Dns z6`DOCILE1RgS}jP9e<`*aXGGgWR-0`T$82U%mqjjGV{WevGuYP0l)|oskZ}Do4LTE z@T9Ql!8=cn`B$3HKUjaUTM+JFx9P?e@@)TbA?ET>?ES}#5Du-#-$<1j|9Iwa{N=(4 z*)kKX^HUqSuME_eR<^DM%VSHy*<0ZVwim26<>Ai0_cUn&O<&@}#Uy+yG!bTlg&a%# z@!||+_dSI<&pb^_2DQ`6qKrn#Z`T`9fQ z!SN}lWS~4G+_7%2kp^()l+P4qvA-Vh;7&eu$0O%F>d&iCGpOT(!9hvEUBa?pYtO{j zogSW^-ZWzdfKYQ1uy1g2aa9A6IiT8zW^EIXJC}1;rj;0rUq_>tGZ%!>fwQM1|?k*PmSK!_2T*x3COtw_l8;ex&mcKD`K4(eC9_5O9mMcdhlt@Bf!e0dZ&adrexe z9+6x8%&_$Rxx}gqy9MI>H0KMG{X#Y?WPA4)WRJ?R!pKA9i8qac&)riAQtK&a$7-N= zb}Hi2yhvfeZcmi2_WOf&8!zC6nFb;S8@4R3a+~TIGkt?c>+I@cJ3)^kcl%#g)E64V zW^AGA`kemRIfo3=JtCw1mPVX>PuK=oWVx(HhCZr-=as!){Ovd z%kG`{W+>dmV$XQB%qH*nvVCkPWE7x|gM}A>Qow&E@6`Z8X;HOjDf`ukp&{uTYdWYt zZJR<-m6QLQMQh+aP4?pEXE|5%WV_ahJ~@$ba19|;PM;vdu`7g2{?76=Yu(PfR%$C1 zo1IS1F8<_7n_`?Z#g^+*0Oumc$Bltdxwvst>aZ-sWwuxPdNkUDPf_b6p!Ct0ER-se z;_jPrwLB`-4sUjG1R>NAmA378j!cefG_uosTg}!E<+B;(LDM z+=@vt{X9S22vx;n*>55t%j!s8?3D%_Wj#NBM^K)P1kx z4|jo(LWk}%U~fkP`|r3K5Xd3`^NckRY@d5S!42b=x{IWz1t z=>ycHrU5<8FHsh6k6#CSi|-v;>PPk1n0anL!buw`clZ0We@}`GNkid>ibH;rCzHa? zzRgX7yhG}cJD@|;f{qd~+R^h(9s>D0+_0T1^6fpKYp}aHXeh}55}pOnBMNVPDGHzJ ztUVP+?*hR|%fiLlM%3ze0RkcfAT!@Sg?dhT`0i{56$mnQgQ~)lI0u% z#q{brgkp^MhCtSFm*iPl*?dg(kofN9s+zZa7ph{(({z~=P3L{~7D5Pf;seTWFK?!5 zBk66qn=XxRxFd1vn9*af-8f|F>JY3_I4K6CzuS-T zoS)O}j1YFTS54{fZWen1E~V;dAoNH6285wL$cn5Pz=pJZxL_H7oj};lwkLO#GQzt3 zQZ(@1p1Vy$WtwfLlx7y!CZ4>H8P}UNCTmVa)Ox$=zRuaqz_0-p7;1Y*Wutwqy87HXm|{P$NJ z3{osda}=aAs{KoUNSeyt$asiCvN_k|+Wgn^N^xug?^wCqb)kgb_=11CJ(TlHFmSqg z5?=Y}`w3cDvn9OxHO_h-+RK)KjNfEW#pXo6GQ2TNlVu*oD_3NY?PvG4qZEHCoG{Jd!$ax%T16F z0MxOkkU=8w)@XBMQeNvhh6kXITWD88=|zsq#kOFAQ0JV!3g+C_GtlphrT7P*Li4#y zDlA&XXvd~yhnD4T6%PP&IM539lKF$vc(0wBd6ye}^HQIS7Y{Rp6!Xl65IV1;m%iQj zx_*4q17%AqckOidBmarXa?EKTQQQIRxwp7(gUVNO0Wh%LWaoGu)O7<*hJ$FXZ^o}g z@6N{ef9GeO&<4MGf-1=avfp2|okGuDQ3f;v%UqUPIKoGSp6r%Px>UmI{7#Th) zBYimPruxQbJ6BsjY6$T+WYpLs$-0E?1GPsN!0bB>q-17F&zuuP#4|E7e5|wXR-q$o zbI16(^ajXjV?y6sFu4ctK;O#_rv0zp*faqA*G@E(dqOIp4WsKafNqCz6d%c14NKn? zia4He>=EwbuUZ3+I3HWgwvb__?N$R~5Up2~7%h&pB-kyHJ^ax!lrN#%1;muj6Ggqg zr4mw7zw<)kbU?s6i|x(#wP=BM?PYk(P?>xlUs)o*s@Vqk4oFDPQ$WVsKbN}(3IH}J)obI$3mO6G3OE00@=Xyh?j*8C zdaE^1)BE1tY)Nt>nc8UwzSZ79W*wWVL=ohi^CA3n$l=e7BDKvLk1!Y)Uz@4+2k_uk z1b)2DTXBkJU_V|!y@`i0r9m1vQD_p{4ro$^A+1EYe#a}aBBbS=g^BfP!x;u@3O2ZcluZTI+e z!FW*&H$(DjO$h_0KOhOK{*kewOMd9^Y}EVO0@WdS^Agh|Q9>|91VhdWkj_<#$W{hF z?izWY)a_m8)D3lr0=b+$Z*dXJQvKCQZ~Q^@Q#!UJS1Uc66vkShbet06Ebz3w$zkY{ z#-4z$8f@A}Pr5B}1M_RsFe=zW$2vk)dF|+;dw>j=&Q7#<)ydC+Ib)cmJM^pzbS*m| z?u~Ih$cJ&Q=6&7o&^kiv*u$V-OFWIm7~>=Go7@gl@%!-e%~(TnYryb&TQ4!!R31_=d_N+B4DfzUJQM()Uz@{zQU6n0?TkTN=*q21K%ZYi zphi?*TbTESt^uz+&LeKs5Pa?+-E=<1xlzYh%!8z3djkw*W7^ig`sXj~3TjDK4ifR0 zDU|SODfGMGp>-f5-QLyWC>K;Q_y$kh)lnDhK8)__UHRs!72L4vd1*iU7Qwac-16Sx zcu-1n@3*##!z96ikd@U}GwU?IkBH9DsC+wplcIRX>i%hR>T%wk<6Nt`XPG3l;Rj-_ zE#d4G77@}EXQ*Bma>%u5-19LnGnkyUIIcT`0V{@o?*^rTlOokEtvg~O=fwwCmUyjm z+}Ex&woKc9+XOr8@yY|%2JEm{@r@MYy`8@$)u<{AwG=*E_fun!_NOA3(&c*i#0W-v zZm}sK98=K4pkMcoRf{W(uEkdmIl{notw3qP;G;&6%YjlGWaR$Q%+*x${rce#qVHg? z2nIxcmNmtynmcTQT*rDjauJBnoOt>!X$<#>o?1iBf**n9qMmiTp(JpwcW%DCA#O4j z6fa@j7(AdXJIN<*nznW8&LXR<-|1`jD0GCGKF(&uof1xrI^Ct(^71!8T3MwJ zDyQ2_cLL(j%6{Y}CvXGoiS&oCUk{S-d(|9$m;)r0_otm@`6X`5+idEB-WLsv=Q;j& z%aX^G%M!02KxXOTYsYk9ZHfz-tF5oRt^KFh{fwv=z#!H7VwRW!gN)bhmmW2_Iw?t5k ztQYX(Bf$@(_sb7G?%jwRN_|tAYrPO|<5J@zW37aCXsrKiZ7vfSJhA7BGi&%_RqGhY zveBdV9d*n0=CkNu1JhE-5>!0msz_4}zV>5#KUo3o3^i**rs*5BoM{anfRHY?QFh+E zaF%(jpIx#?2-=3VH9lA=%2JNrJySy!w&vDHAr!gxojhLJ>2BIuzk&B3!jKt?yfR_f zl?WKIs_#z?)fu;3&NfmmVi;oxQK&lWA6^FZKbBI#@TzDyaxoLDgMRGDs85g+{)Qd1 z%2?XtrZMfdI*hR*oY6Mhtm5fAtmn2k39p_VLNycR)c^M_?LsYj>b9(rs`88%_$OV2TPX=hZ}SLv1_F?<}-E*#wPS0%|; z^|yDL%0XLGu&eX9)6ayoJh}n*uxv4MBW!=tt@c{>o=A2qtH(hFud7mrw*aMjd;>|V z*cJTLZ_!Cfxrecg$I~BPZ0DDAlOY=%N=Do+M8e_>n5xSSQi*q832rh3+X`b#EctRH9-mF-rW3EzHbT7^6UW5m3i7!ee zo>JrpLLi@lqvsjl^Y7HS8)5xZ{BJyTP`KS!H!OWEU(IcTH93jDJbl?|{OwM8Au28M zY(AZVZ?Z*ZjH)9p9nWr$0Pdyks9eVc&o;iL5Pxeu`i*W2vjLEx$|^`w&Ja?NFMhn8 zv*uQRX!=9s1?_H*XZAHK*_6v**Ie zTt%exGg%sZDIV;TTJ|vB{MoD$szFZ2xJ19j(Dq15p9E zeSBRfRnKY~RpafRmnX+k$`l+U!!pP;(|+-2e(Co3skPUcJQH#;-|vuq&gnHxc@>^r zcJ0e#?18E)Qr)vizTp?f@3wE_voP~V3R9!o>*=N!Dmj?@c4;&0rc2}BJrbutgV_}p ztnxq*{|_`j2OUvJNQ~58ZLZ)(5SjwP9A;q`x_0-|tI{AiF|n2D*b`SsX-wIv465Im=PvH1civ{}z{&HFn-l4+G?l8=OJEDvv4rwsTQa6b0&0)&7Z zV{EN^GtPUaS5ejVj-?fs2v)=bmRLk3lzEi?QrpHvT=WJ}-0bY;nz7SYuOh7cYYqK4 zS4&5?{Mpiw((7RQ|rTYR~0M~tGGws_IP(RotIniwDJo(L)y-|77BcFwt=#8zQ$ zm_ZGST&l!$8qK41MT3hhyvj}xK~H2ATJIX!6`mubmB(DA(j#3En9{M<%Rx5U#H8no zNbe_)WnB26!FGm~enl%3Nl;0gg2fOd8`0DEe6oBcO=f;Pkak)|aiX4cg&TIwDe~#^ z^%ch)e}{21snpKhejxl7j_0&NrXUsFeUWkHVK4MJVNayUXC_z?&e_hECB*u%o2hrR z#}zGjx_)ceCHrgcUv~@@k0(F5#bwXo5#eQoTjq;Zex%HYjC-mwmZ`s3xOty`=Sq5V zGm1jxNe`)2w&pT%2(?o4IjWJ=GPWbKR)3XlHY`A~u=Q!io?5I(sg;=FQY{?7G*eC+I($2&bTCVYGZo%pp;&YQB9#-BJF&3>J` z7!P7Te;qlXbE=?QpRh`nIgX_{U1{JtIU#;jrDu{LzjZLT!ty7NLFC-jo7Jm>v(K%q z#^SV+_DIJQldx}P` zT=a=G-&!|G_z(E53MKt+x)F?t@U-gsuJFfdJbhX7WR=+CQpmS_E*pC0wxY zqGbOTUnY#l&n3Asr#`yY%X#?u@Ht*}NkGqSTP6}EVc{D;7$+1;`w{^tjCUH9*~@H&D5ONDFbFkZ>Q~pcDDs zIK>?Mgay|C``1rm?`;mc%GI2_lM5DnZkJQud5lnuyP+CFN0 zE#*v2?x1e54MGs(e;5K^q|omjW37I)T|4q~QvC+Y8rw$v2?}e3Hk1^)qj_?(;Djj% zx0p%aQKbVWP%4FoE&*Zrz{=Adm#O+SwL z+MvfyWKp$4wkUZs0!GGSZrZ1#XPv~$D8>3ion+I9@2nMZvkq0!hZc-;qDL_+8HF{F zSvDU^vINvK+h)2&OmT@g2rMDzTka9TN42Z8eJxJ_At5`5v1Q`srvu#Egzn5B>P!~f znHwGbWoH)rDi_MHn@hv}6>o1oY%yt`kV@#^{>OE+?U2lpew5c@S&CMUwE0971NyuU zaxc)d@HR;Vi68fElxKR+Mh8fRG3G2?fp0+LprO#aHBXvU4g>;rs zTwioR!J5n7b5iU@kB}=%omaNY*!Y~jHmtaSx|MfCcs)SfZ$+!|poJJBJP%7eGKaal zw%n_sTKxHrnmPPcCF^ld6{WIJb!k7j-EL4vh^*rDY;stgvq52 zyKRKb9)1FuO;g{7KqH!S_ zIl?2KN-}M^kJ^QNCk%7STJ>L9CVVxmitFerPZO2@#@zed?58T?+Kk&hf%@%vm}@ic z#q6`i8aHIekEV7GZ1l(1m>D;MHj^NyNEV41PUYp9h^5(hcvFyN4O+8aEVNwCxyu)Y zaHcq;1Aq?Pj@V5jN9sMoE#jKg`&DwM?*h0mCo!Ki%NvX1{oMP6&EF=3`XzoNbYWN3 zSyUn^TCTU)Qk4b4XFZy#zNx@nJ9OCm7wqZx;{wp!p;|5DXFE06Wd)J~^(oZ4V+>^n zN1&V#1xxA(%O7n2Rh2-Wj0mij39_Hrf2O{)r)rs)i1ZWigW~IDSAJEg#f@&_aHtBl z!vJzseHxWMxmD&fZ$kJp4u|8etpfje#wDI8!oEOnzAMSs(5F!#DxCmA944u1FuDimWe4blFbVY5fuAQ*)?`H0?kl#axcpr+=q8#7j*7gi|EK)tK zDGNn7r`e`!<-@YMw9=S=`fQVqB(^RV)fY zGMaCW%#l;xHVRvCeMGRItmwZV{w1u`9AU5@S7k(Z_LwsiF{q-@>O*s)%SqIoLVcvj zQN=P!eZmwk_9Uv4+W&Icap&1v5&K=fpEP50hh-P5EFIS?xx11zxRE|REdk-;qsVF9 zX7-@(w4bUYZ)0|4R}BkU27VL!=S{%By%$3IO)7tVq327oFHNCCWV5W$A@K9Pj-BLg z0juRyMxNob1dbLj@FGPOq?KxUb4!fVO7st>V%DjulEAMc*|ppL`#rz7KR>*X8C{%k z4SRBNA}p~`o9tAPdNIn(m|f9}tLt}C>OkwBI`^?1;hLc zIGij}qU_V;Mhm!wRK6AH@$B-AH1mtPms+KTt+O(fd_`c>vY(OY zn6O5;l1KBWtkE%a*E$z=b}PHPl)EkN2r2(CM~b7d6yLe?^3B5x#G`Lmv@&ZiR}5Tq z%|m9G6!lYU@X;jRw=iwhq+&n$=!KAqG4|{Q{+ag|UejHbhXI0NL;iEei+7Yv$2(oFE1JLsz*4xawp(wjAa2c=CMw)EiE~oEQT#9kX6N0(BWd77sIsRn^OY-1cnG@$fPn|ZMLigL-6 z3sCFDl2}$Z-#(r-^F}l4n}ogBYWV?|yODl6D>!HE+b`sVV(XS*OSiFnSS^2P!1+_6 z^~sDMKWi7}4*B;EA7z4w4%4*AJVysq>VbFo8B8hG3~=9!dNtW1aMa#&YFRexL6k_* z`ABac8Y2s}6*|e*iAM2Jx~1rDO5B|14kcRrBH1LKdi)D06zchRW)%LH7lztO7 z6TWByq$_|p(MCbYcWK?*?IZDu5HJ-}r?C3Pllk5?AZbOp$Qj~kXCz;uMC7XjvBCWT zS5kfv1I`v{YVi_4n}Jx*|L9fJjXn-Rrf8?S7#P-o?%e42oNlJs@D}8rEUaPls~~v%u6Nh z-!eBJ#soL~Jo)myk|wghc;?8Wet=vR3>%@xwq`08j500iak|XPZ27%LY^Et<7l=#d zay?th!Q((D8I81r?5k+r7$4IuzbnVwNgPv1p#tA@nu&!!?n`bMzoZwLv??^gs` z;z7T3?&`|Q!zS8_x$F0IDZ%Tm6R&cRyhb=qyEZ=s&CILo+P;4M8c=)30`|U_li8A< zmIs|>yVSK%u8=#2i>uh*e@Y3xjgM>9oFVq4i$pfIhNnLbc*U!!TSz%>mC7+Ogpro= zS=!>_Ij<{$S6cmiQ5h*D7nzOTOU67`3k!B zaT5mn{`JTP)8!`#q*+vdzhwAF0VSh1NP#3+Oeujt1oZH&e(?|g{-tj8AOE&}$;eFn zM04jlxOCKmwBXg<=TtO**;P?@daf<~T{K}7VAX3-M_t)}a?^^eF+d_T2FR@T2UCHK{(zyGa1UtIq7s`68JHoES#mi{ z;dF*>@cVcArN0k>Mm?@{7!b%Ef9Oia4fPB@@_OXE=3vhL2^tFT-{1NlOgOcKQ5py_ z`y(WsGuO&GxZFyhuV}#HK4lD0X5r-zGJDg}t&IVm@3Wqk(@2h^M8LZNrOM_$MT`oa z{7+Eqmj7t*5l9xQM?i_i=Cg6{ps|DSn8T;9vv>W&Y7y1r?lE71-laN5lk-!rD^E1NqbZk)-Qd$ zTmY3PtAUzmNKbA{6_D=F7rSXMm3-Yd1|K~!J9_8rW675;09kV7;LjmZMfszrBbWb< z_Dx42oEheW+AVXPQLdYdm#w!jDzyk^A@2=S%YFN{9Ro1oF~DZF2dmcL!~LR)iXXJn z^Y9a(eqm3$0kIWkNJ%`T4$-Mf&ULqlGu>owds+~UBjt`H4 zz@~VEn+LOe0QfgEV{|ju&5xdMFzV!BCiE1}JRALf-q9FYF~4}$ICTNYBTiHP2gTG> zs!Wp^t+cW|X-v?Vt)MY8Aie`$TO>M2)~lZRO>r5HZE{(H7>h@J1B#oap+Hd87y)JC zm9&m{&J`L3l+IR(*Vk^K`x1YB(;-zKdl)hU*GzRH^Y=MgNc&2mI8QXHV7Gw#$UlNwq^2p`dzP|MSPl(Fq?!@yZ5dq0 zO)Lu-CtpelQngyImjOlvd?x7+Dhu>zi+xj%>AXu8i za*{lojG~nXkfW0(yyxOD!kum%oVHMbHb=HaE-ps2VfcMTqeDsUJ98Y?0}S@ybtHX+ z$>t0GB`mb!u6IQ-GmoD|dKsbuXVMx^Z6<2Ub=WNY46PfQXCk@R4`sJ?mq z_wO+WN>t+bpIf&^xJ; z*!u>T&wS!L!VUFJYv@DmQTgGdDjcvULUCHj0yI(_<>H&PC?&?k8y<@~vQT}Sk>yjs z-p4ht=v++y`5orNt#hslN52n6(k^1LP`~$pfplTVsF_= zKyDr#o7}IuOay`kC^~u54(<@|y0ndFy(w@zv5OC{z zCDtLzr?(q%2YQw<^w)(@?|!_~-RT~0o};%5s{~>IoapnCW=7{?k}Hs5Y*i)Q@lMyqct9@?RLwY9Xx!E7f(>dEqEUsMNo;JALhHHLhW zSirdf6!$+W49MKKTLE9{z6-?y`ay(r5~ChHJIsLxSaEaFM<{KkgavtpY8cSd%DqyS zCTU}}&72vtG79%H*{p5J zlK0F@u<0jC^oY&>R(94*cHQ|>AG_T7`Xe7ilVhSHy(qlacmf8kT%@OIRHTdw4Dm9Y zCY=p`7`O5FxG;FaFJwU20MTTk)67q2S2; ze*hk+-xf4^ioV|E&LSgw&zs;KUq(sE!cdfZ;ue zt(v4P6Qfx`2Ezv_$0ppnh4-r)&xG}~(xBqdKG2FzVZdQORyVmkNv>GT79z7IMtyHBj+2%HnRwtrnIo6Q$G-^xn6JziFzQ0-^J_%_}||% z`TVd$VKh;Li#5$}Avb~DrQWT+>W>@52!zg;av0mtOJ^@FPgNskM$?Q*xs^+R;fu(p%{~&ZU;DtLx z;UXp4)P9c-S7RRo1+BfjygZQV%K85J@P78^_ug$k7Q?-bjV|>L?0kM6oZQP2?3ra> z*PL8-xcAe{14h7JNbd`%OU3uEjevpu1K5{ZrpGU5Ky*;`2y8^>eQpotfr$DuP`cs< z&3v7Fp)F|37o4oc#l^i(N9_e)OE_grfUsg8=(>(8i>pSjm5gu?>>SnWW{7tVIaq_} z;`7#A#~4s2td`WRKfl+DIjF^t0InWZRAh8)Z0+~^oPGak(*fqC{c#WcXaD_?jO8;RMQ%NjPV~;mjo5e>0T3vZ7DsddXH7%BJg*gS~z9 zkby9*{O)ZiwsQbl;;J8dvb|9F5_lQ~kxB#oAOhN9Ii39Oi_@2_BhrMAA8xuaDu`MSMj*_`H(6f;-7jF#D=y=Ex%se zGT^4SGPgCs+kvFlaeKbgES7%+u%7ChT0aIK+AaPX2GZ_gBcW$5M5y|Z7fs#G(yCJ8 z*&iW_3A7oF0ScuhyHjPNKfrWiJfH)tH)`K#dOcvZtYh_Un%VZcprH1KS1(kMIN__rJ7PIf#*NZzX@`zvzi!%+w{J3+x26nHLnqXlOm z?YfI((js|Sz%xjiy2m`1W_zo_4}?K$lAkPiWMpJk!I8e_L9gt8 z+~yZn~&%d}OBltnsJ`r#d1-A_RR*>M@L`Z%p z-gjMvlQ=kX4lJxXmdjv^o?{p@18uifTgKr;9x5VVmh+F7LOt3u6L46`6ugF51JD8; z;^!e*6wnF2;Y(%35RDd0%-b%-iuDx+nvrK%)KoqrF00R}o=Z?@zywA-^P7Cl8S{8; zhw~V)3oRgKFp$m?ud$0S((KixTR;4>T0IpIfMLm@-cR&byCR8IYuM1Ti}d)mPhpBr zU-}uF=bVgzh&v_K(WMuI)eQ^X!g%zhkKDDcx;|W^IM%l1;BcCS*A4AA^V80eGHlh zHEsEU?eGjE5&G0@?_a|akTm>0U=dZBhRBeTR6SnJO|HlmvF31cTFjvZlmyjB9fIpG z{g8_6nVJqce6MiU`JRTvjOI9+z>1q2ENZFu8}&CbL%(xhQ;~nVQe2(QojN18U5h*i zM5Z}G)e^AU1BS`V+DTa>j*o(H4Ri8V?3Iz}>Qdyx7m%*5%A%Rb<=bz@9K&1%4wpW{ zj+C8m=i;&wyDs*7WL6I`E-uf0yguEUkyV}Al0hoh;9P}J>Y0WEL3o-R8qD=Pe~bdh zMz6$JPhfylyeXqa>CR-jWXgsWpZ3RA+e|0dV*baCHC!`mHjUC;LV`<-#mfhrgsn?7 ziM>7+hY5I=oM;+};U>J(Y+Wph8usM%-{W7^D<0hvwIVX9g}E?2Ijk35L0@Xs_VTK( z#)k1+{&zfC)?3kB!kS_6mrHkgwi8>7h7@M-MCt!dmfr2z}q&C53YmSh{IuAD>s ze^IeC0?XD3w)KGZ0WT05y~TVFnVuC%?F3BdGpp^(D&(g9i=T$18Xgc)L^FX*SK?ls;}E$4tj@&PHqqta+@$ zuW;zY(Kgf)aAF~LnmXqpClv3Xx00gW2(l-MNU2{ODab-|G~kG7P_IlfJgsi?mt-Gy`Oo_|12!o-l*H+r2r?0Yr z=rpv?gF?vVYg0LgSiEk5CIN+KmNgkem*~L?DIp5VS*Y8F*F?u|N1{7Ts0xJ+B5MEg{8V(Sj`NlgeJtH#q>Mt z`m8dqb-7_lk)H088~m|NfD(E0B38yreEe6#42?^a2j8ZQ>v!uy;<=73#Ui&dqIlsB zzVUXx+o*bqq}yZ&1H>Qc`4Z-Wo~?f#7p6vnwdRM(c+?Y2?YWs>yu1`Dt4*TgE)`bi zv!8=yAMb-bbW7{XQaFQrOX`)H3YxaKq85tDyPx$OX2L4*o$vclb_m5qRgwf-+nuSXyCAcoa~r`7m+N~E#WhM3dqbAogVUr4z4CPy=XozKRtBbS$*Kk=s|SG{YuCIdR3Vgzu3^C78xE>~aB0i{7>J$=iZ@-g#1lS!=P z+1Y&ydEfn5WwGfeO}QvdSOUoeZ)Sp0I$<06krrut7+Ujb==4qAwHhb(FOd|~rj=2N z)+??`c765Q1%A_CXkD5uR_U3&gIfr`6GQ}U(MA#DTrE@)KeaBr{e`{-*e|gzkj*Hu z&OMy2iB;;{8>GvQI}W?0ZEKlxfD1Z6W^3rm3(mT~cB-#23I7|i6ecchW*q%WVHl4O-b!POIC&1|=?t7#-k zUFiZ{6h3WZqTa}@7Z8ATr^r}}%%`a)ygyEhYl(rc&84fN=8DnqlDuBkN!v|PfN2K6 z9&YjoFH8I2=wC(Y?Ypejpv&ef?o(4!okRXRY4$g5d<9=qC7_Afoog&FC9%g6FtM-u z2b5l=?Z|8Ah-8)$Stp>A3GFI>@K|mfZn{87rhS*PU!hlXTgp_s3U6f_x*q1O7D}B= z^$xumAUk&@iHT`tcV*`(d2yChCCY8cqZrmd&z3YvvCTN6VJ^x=XFS%~;9yuT97SfsgrE#xILjtZpPe;6U_?X&8@OSZa`Ush}@?9A2 zVgDJCZm$>_9M|!CQ*LIV39B@sEQECR<{HLTz!fk&a?<2v$! zw*nIbGorcTL!K==xf;c|9aVNc&$r;}(iyeEGV0^&q1MAM{GWc^dAQvqhDsV_{p5wrFQ-?Z z`|(S0beT8TDtAHo!bgR;xlprk(?|EkP}in155Xp^zc;v05!U}cn*`Z>KxSuo_dEYr zdW5=he%|LUcL{xB|1(cF*R?m{*rcc1QOv?)sDaA6N4NFIiAzyJj?km*)(}B#YI%`z zag&KeD7_}^f)NvUGIm|#B_WJODyGa^DIJ)+kW&$NzmO8dU$siUp>O&{-+SSvqO^*l zyWf|8P|v-;z)!q=H&Y-S?xs%^0+|4EDsBa-M7eh`55Ic5dEX>c@Q4pC4`Fm|z$%k! zQ`4MA&u5n^;L&q@@Tr-H4y)3&>Nq1;ShmybG&27r28-)%51G$1a<}`%{p}yvuHlc% zA?ZyNGw<3jYhQomkehq2^T)M!Z&kwEiBs1?WfU7FI^N{B@$_G_Ad%UUrYo3!xVU!@ zc8v*xdnJXiAZz-5Lz64VnJ8ZEvJM+66>-aS%x{<4t?j5#?t|(F&-Xg7W*a3sPtI$P z7w8EQ!SzrrsT%9*elE>GK?ot zRw*{?+y_bJO&*G7NUB5Ed!|BLgK!%{eKI^xhi$%FP*AQ=Qnee!l5rG%r}ZYXMM{wD z=BrP8@-emFKGO{)u1wM=ILXy*-Kap}Wy9#Kx3t^j*u|eMlUe18+bb7}r3&g{`=WW~ zxb8C7G`7w7@S8gW=@OeLy^to?^F>0-C|BF(6{x4OE{YfDn!$EAS!i;2D5zirjN!Bg ztkF)LptLy%!zD4x@Wv#-zfS?lIbj=emTQK~)^c_Kt~{{58>GcDZca}Bp`D8kgXc>_ zzDrE4xw_+Pu(o>_pW#+_px&|9LjxQdgqz5#4)sX8`v2#U*Azg1eS2oFKo;7?%rD<2*cqkGeWtw%ol_w=MMQ$5_4nt!3P z3LMt5I01hGfe*Xl@x z)BLx@JIk|?o+4MdQg}4s89^wYwa-J2b8(XUE5ND|vYXdk1cjJtfU9&vNR~R1)y#W_ z6m*Lyc7n{#1hc()sUG>gNHsL`X@^7~7j>*L)EGDXl3UF4=ck!ZFi*_y-knt_=yvz< zsb#T7Vj4BsFo|@Iwt=$-4;~y{^-~7}G-hC6&hPYG8SEXca$+z3Y%1fm?g(6aVh5SI zqbS1^)zpB<$da=x$kjsGV)_A+V+*cINb@nh8-0C=}s5LLsgeW(EcZ zjLc!ARz%<7VWehpr3x!;FAL$ymDa{zOLNOH2jd=V0G%%dsBaft=_$adRsr?@uc^&* zo57EUq9?$n%yOgQq~zj*{j5I-wErS`7qGpMa==L+0r~to`D6DU(Z z5IY_~2mSL+sCeV$u-Rsevotf zSpbs|wcf+9{)@(o^OKW3UCD``ImxK1c6=fSV}Hsi4YB1>?S{3P98efm0rXD|?a?|+ z(l?Z+LLTVc*NUDCb$I;@U-9zt_8Gt!Kio@AnwEYAz&DmlrgSHbz%FPXXo-dac4H4@ zi;ezfv(1WjFix4D5inLO5Y<#BD4Y)`7%EwixPWO|X-)Oz>2G(fN>jQx7v!BI^qstW zS_5BAu9H;w1V4vpj0F6J)tVA#GcswDtFAG1!@bp*=w$=i3! zynYX~8$7gO0w!R+j)$8w63=$+0!?9KK&!NV(2km?l08|iSOXa1-nw@z#gd>487+q$ zWay_b8AZ?MHx3mPo*k?^IgM6sVJ}6{urJ1OY#AC^lDZVy|6*XS*=(UcTgiHpyyJfQ zu;TI2A%sWmtqkE~VAIb4o}@9Q-w2EpeX$)!BTE3%EQ7$S9Ae_b?;6}ko?AZ-+8zZQ zEv!LC2ljk4^W0W)`HWzwe;Plhte!%CZ`KUEIgsybSHJ=XI|%xQDF z8H4Gth$UY-2jJ35U3>tjvyKvyb4+hswLb(vr{gP|)G|V1vSCn>Tq7kt;LMBKoR*uP z15l?uwj;jSC%#4Ovs8{SQgy{*eZ02ed+Q}z%Ri|GYh_Zv`K`X}4Uxjpe6s&_F05Z0 zy~c3Wn6pEI{C;|Z7r<~$F3!&!j3-w$x;=CJ_qQw&S7*hU$WR0BxLjAgKL36ta-V|l zpB)URZpEnt%8;!BjcOs|1(a^8`-0-xPCnu0eV+7N+S+Sf*FP0S2LdGS_z8?n{d_u< zZhwmyp=bK%uNaFAw+-qKyY^qVaO_T?s=YmgS9Rbjr~@GUQF8*q!}t`TkS=bYq#$VN z2#(T4mmG}$Dv-o)4XOH>S#sX|Cq)v6SUXm{-EjQpJJR(|otI>@Hw zonF>Ip=31w4ozgy7}rD2Pku}9K0lWvr%xmqlEI17PB1YF=xmZbIolgLu&jK6Hi)_u z`

pvSWDWEGpFP*;YHt*AoTW^$YNY${TkpUJryUH{~k-WeE%KG~X7je@a<2_ev?~ zyKZSNxVx0gayn5pkcsAdKH8%Q4Z?&Uw6d%4@WGJMX;TVvvIci^NNFs8BT6ic%_`wW zuqzLyEu3VhG&>XA(dF;pj!Nw6iSAD~%V*KV$}-85iF;bMAz^7U6W2z<6je&Og@1s# zI#zwlEiVTow>JyU<}8eo)Tv!-u{F!Mrq6T;S=D=+T>N=9_x`#t*zDJho8TNz>{1m^F3ODq2Sr*Y!Hrt`0`=Yk|uU3fNv|sE) zB-aGeQ}U7LceTmTuotPamykw7EXMD;?hD1R6egrbbRIRPZ5cV2k;Mb z-X1%TLV28S4M58MS$ah3R%cBn=gC7NnD<&rQAe*YF}WoT{koKq@eY@Ad0hogpjGo} zoLWvFqIxLMPEvjOfcWM!Vv}~X9b8Hv$F5|gC?&$!4bGAz`@LT7Yn#WI_)9Rq_j*~U za_lt|AC_0dJV&H<`&G`GG%y_PhZLrp09no5XiZ>`#|2T#XOkHNb*SkhB5(1{=kpBL z+@1oh>&AA+BfQ2Z#7T1vF^&Pn<7R2sclzjdMuxyPo28-o!xk~sQ^zA+@8zl*0L=MG zTUdxgQ`-r}}UYh=ZVH$@YWKuS&Y7Tsp=Xokgo)&QDywl40QI3C31F|EYjScBKMACzy{4=0KLTjl%P9y z)V7FhN?McF+YyEU8c~CxYZCDa=5k1duVS7W<}-6?>34)ZkW0^1FA@7_d@=6U<|lqjB-WDAm7GUJWdZXOp@daYf_sS^bW;oKFtO{~XEJyfQg8vH2^ z&V8qVX#oX0<}QY#wzCLR{%pF(s6tbiS?rIzt)cUVH2FU_)=-s5(YC+rrl*P`8~w1k!*`fG8H#GmmpE+;_G8)St+WBzu06xqSDo6 z?2clr0*V$TrD|rE{!Bn;*qO*7H~`&NvXMq`>s9^98R=T^Szn`&_)y!+h6j-#K=Irr z+uhLLaH-6Qi7?U6qk9$XtaHDnezY)g)yh6{Dacu%Ueo(BoK=pmhn_(vit1hI-)PGax!DJ%g&+UDM^>t4LJ`CFn}; z&|FkL=rDLO`moCXCu6k#O-^1}e@lq@V_0J!;=(_4d)xi`l`H)&Tu|nrO%Kei|CbB|%2YJt z9y2mqj{i+wjJbMk-tUm@n&;6+_Q?~7y(;bMy7jTJuvFyHm&4}Q%0g?J*3@OY14-r< zO=kMQ^@WO>dZ}WFI(hx4JTnp<^_LJ^sS}c=XL9-<1J_3SF%ucrmj<1lo@S6hzt3L? z&cd0!*ZqSP;)$(T9xf|jVqww9gN9;9nUb113JeF!<39zp%iws&I`1fk;j`sUh=-tu z#7y#+PuaIvW;9%q7`|_$cvr5pFYGnw9+pjwOf_KMM}p^ETiJ%&1MygKQBlwH=gK!H6kguu`20tD&|#*Py;!tUdST{`=`0mKYpyX5G92m)BeLk zaA#ng*EX^Kphb;elt1j|0V$MT^VSJF(=z|2{#+|^YZh8C4%Tj?)fOJDm4!z9kC1U{ zSRqvh)rkNw?6Bj;xAC9tXpK`!DJrX;8$oG!+kkS+rN7>RMmHW-atpISm-q;|>w|0m zmkeFXGB5ZQ^eatrL80CFuTVNap!5j&_eV7Uo4gt}VWGpTJBQHXrbtu;q<-*^|5H@) zR?3)qyRv}o?d?B0e{Tf{G@!w%{_~%^MXLMH;s*+yB2A9Ta9-Jw?6i4)V{Qg!-Q1g} z)_&VcgZk4$`ZY^izB$4=6p2~$J4u#%$%HT!O;E$RF}TQQ8%x(AasW)5xqi>C213xG*)oZ+q~!doONA z9EPU*UHSO$zeV}^E%+6_RhFs1J8%58LQV@s_1W$r7oQi@JDat9?S6@;SqQ9J!fNpc zaQ>u>t1UUKa@RgX{?49||C{$5b2(~#qHYY`!GQ(c2oxcq!efv@mxa>G ze2bUc)@&4Nn^kSGqMQY$z;OWQF$-t_QRi_fun5FK=}+BE1pDb1c*`o}-y6vtFf39# zpLFHTlL`PaA3w7MhA&mbbaE)FN1laT3~u~FYy^9Ohcl65086ohm@x9d={4XP@cZ{4 z27FBBcEvPO*hoOMNsyx!^m{(E3};IH!i?uW-z0}fMr-l1>!skB7p2PLj=hAV zD)?mt>i^Ok_6+&bAl5W@oUHeeuFl>r>E>2{ERw!0~eX&^2KIG?Hsb9|N4m@#1U?ipv(Aw!*-}USZR?EJ~T420~!7+T|hNXefXFaLg)&L z!RpU=-hfRcg>^$75g&_+Dgi~g7Xy-GJMC7BLWoe|arDQ8ux6N*u^GMG`kq_7Nh%t0 zNi_3WU}9GYsE7FLgT*G2jbJ9(?*nG~udOJQ;-4@^z0#}q-VNKo&q@^&>L0E|P5*1& z7!V*$`}_Ey@q)AX*V~4j#Zg?-Jra{Nkw>TGzRP;YV3M8IgmVX;qMzFYSX}dIJ|u|^ zu($u<56IN}O~iCRqXBr+apW<>8U$dSk)@nKXMoiuD0rz9eI7K%_-BU7SrCi^J11-4 z>=X}}_n$#g34tvGn868J;>~52w(iBFLog}+A!8hPuUkC`QAtc<=gH@6p@_A^w;q6O z7&HH{?H%wU<2!c}6`0K}Y~T}sdp9@t=4INJ@2wF_NBV{5Sa)u6Iph`rICJ-0wh0`4azw- zt=8h|N#o?Ht-0H&_V8vlhoYG}%~bOMpX(wb`wOA|05_2i22_=TeX?}UzS_3cSl z+5x5Ph$Z3yzj)OMqJwE6&enIYn}8YiDzzN;YR15?GJt_TQyQqS)mI3jQfUc=uu&76 zmk<0JPrzE3rxvzoBcoxP9|B}y5A#GnfQK~Peea%EK5rz~)(hb(uDww{AHqS^r#&~^k59B# zFP7`5Sz?=wxP7ZeZ@(i~v4(5l8^%+KS8+Li&WC5hlzah!;($c(3J0GW&;R`B6Kg|% z(}*P@&Ytqy(dBL|6R#?g*z>`Yxk-*#GY0x?$Jj>rsTq~VVO_I+YNXKj>DK1MzU#6B zI}BP^y>(VMs3?%*yq)M9ot{hI?9*_%t?k0E#Xb3OozyDH?>*P7&tGu#>vXpJMZo!y zZD3<9%Xl&!=CCP8Y)nj_%jyN-5Pd`Khps5Ox=vkjm}j?1@N_G=z0ZCt@UAs(hAZ21 zKnqj+=GDp!$2{wjBHT?!b48lr^Cfi;`p}k+(B9BNqbo)C`{W7>ona4x$SEJ_gYLQL*cP$p|-Sz+T zP|e)!W|YMh34koi{C1?8mmVtr^Y6#wL6PDi3xc3jR79lb4XOV@-CKr5)&6h4ASsOq z3^{~^bV*2uASz%WC>>HaEj4s^sR$^YHr+6EjDob%J@n8uz`(Gtxqr|9Ii4NQj^o(- z#eV65Ff(h`y4JPM?|FVsS+fB(a$L^l2%RU+eeuceCjajf>i2l!<{*U zA>0fc$_?`~$_MYNpR&IM3OcIr1(R9urI&dWAbJk-7oA){#$Y*Js?|twwdyy~ATjZ@ zn#W_FMho0PwgSA^r}x+Y4BiPhkh|NZTOb`QEa{tkYNQ~O^}LOtMkeG%fH zh`1|&D6VBJ@rKVmeBiFlM=4@a8U#YHUHlz_PZ4rc0~t0nQJJwSsd*0eS1605=y(?n zxCkKjMNyM0t|(Cj;;0GIUmMzmj@Jomo$cJw<5CFA!R5}M$f4QiB)(Ox3LV}Qq+TV z$9{t|oA6WZK}~Qfc5oS!(-S<5WJ~(hTwI)p|9h-}H^JIc?A;2-^dXJWm-?;zeB>yP zT5&6f)TbYxE)y292ped$gxcN8S@Y7&Lyrp+j#8QdsYmutkUUdh++A3b2viUeVYoid zg^mVMXl|8;CFi>uOlILl>mBm(k5w$d!qe~7%VTzZN7N?l^?Puvc})WLyS>3UZvyP4 zTtTK~H?ZMXPlu9L0mJopp$Mg=b0Y$62&=}u9)es-fx80Kd1^5!eI;7Ol^jBkj55fH zZ$14rG?Mpp5-h!NT6r)K_{WI58m28%s(0R9rBl7R0Ia^rKIzDUt{0b}>(^jxm8sgiJ<=Q^jJ%hm&=yX0rcX`R z#MLt(Zn1a+|NS@&y(`+Y^t7LpCT2gfcvIPqr%fia&%6nx$eW8zo`&C+(lQ#sL*9e( zr4j_zRj+>$f_PCCkreh3=$gCM-k!Twu;K}(CsV*7y@?Qi3|uMGLx@hdzfbXRv^QmH#mjZN!X#g9zK4D*Q!9cik!)W#0S)A zBE3z6{iB!8v4bye%p8NwQVS#LjBDfMdYna@i@Htbj#>}%@DN#!5V5obmLulVEtsiT z$DeEp_#;1QwFZk`1Ky8&B7~w#VV|ISM1zcTd@b@3GD)E=@U!9f#KzBZx!C{SG#U(LzDE1X!YM4&z8@Nq57 zW8_AA_I*c=qbKiN*k8>g>xi!(^-I8#gX{Mv-*d#O0(1x1=-zj9*8a%z@Nk=#F$Gk@iEk z*^#F<|HN2uFxhvbjPNyX_`VB(UH@GCmXh5h??#^aN3vKMvZcMp2+TJ*18G$TLOqfC zT-My)#6uebWbg4}&`Mtx`8Df1Vj0z04*P^+5)?Emeh|4_c$C}x*Wd0{BK-ZS>5$i& ze-VN&OTz<}0^pN)0sf(6*{2s`1`0}j)%@ZjpoDz)lbVv1#U8~T?*rD6DzR`^mS+Zx ztG?#?w{|_=4ZXHwC77!)8B|2X&MR*=pZCza%`?S^LR2Caj;~`5?+TU#?I93xPWG6I>dWBorf*sfzhArmr(j&iLq%DTD4OhzVG6&>VssGy2Yq{|&kN#4 zA9~+D8PG3)&+En~q(MrbvNJ4=sIAs(f8n@YouHz5pF;{pDmDYK)>dOm+vhLdRPX7^ zT>e#1iDrEr6a1V4d3td;s3pFs)}2I~|89|9{2F_kkJCB^Xd>IW1l3qNY%331Q=tM@VgZ}NSFpt>LPp@6M)Jyd~3i`6~CXEMbH zECCvRKmFkj?x*bd9f>m1_k%^4|JygPXR;JZPT=y(e@D?bLX6BhfTrU8onHA_su;ex z3Qq{Sv!npGePF0rX|k}Qs_zjD;h&l~ zvJ3b7h*3F1_^SqX9k!ii9+=!Yk&A296?_E!`HfoOxu#EHsrxh+uYG=1f=qaFy+ziS zA+-Q@*%^fXAB8Up{Q5ohPm#M$>ZfAl9T8;N*M6%fWYWsW_V8fC)gWA5B*KegVgkkx zu&q<5uEvv9)=UnRwLQhtm6jzzg1LG8Te+q9U5mY;?$HQH=LZ_m9EQ0;K1F;Z7%+Uj z^%js=WsO&Ts=rzdgO$q>1MSYuRZJREbxzp%M2l?&DUp=dqH4I@eU2*I-IWo3Ch)B% zh(l22VYK5)#;<4R%Nu2DF#QCGjew$n{tkDk$HDvd_ea7q8vM%dTlZ*dWF1y*`0d`` z?tu*YIh+?D};`FGWl3U%0y*$RwmL z8r4fjNJJ40vo9T{kwj5+GASj!PwYwi`$@@qk|XG#(*VDVGK@EfGW6BU-`=bVw>4#F z{10**?c~jgidpfZ-pRroes;QDiGO?lcVXCyMU%;r^&mr{2m6B$#kr}w6z!Mj;pVb5 z`n*Gtdv>euFjRI$u2ATSH*+S|Y475(D+&IfIL*L&--A0j15!DK=OdL;1$us>nx|rv z1k3y%8kDkyH6C(|^JS*rv^SOXCPYT2+p8)(R*UJ$7iUn5F`#xm9SZBt7Jb60afq8! z*dH&nP?dWB_kaCcAjooafAAqWX9mfCX_o)-DskQU-^+ym%9H;$h!zZFL0OwPeWleK zmoo&|F`}qkHKnccPA6PK06nB)}I+Wc0J^JbEU?mN(Z81QCZofW1+Aw(X#8Ua{!sDhu z+RdQW@%&okdFJF7ZRFP5IEUypj=})dqO2e>LZPa~bDQu@C$I zrK$jy{vwHHBj#0PWF)S4fJFgT4%{WCK?&+vxcM7Sw}I9b6?J|4{@ocM;7>qm_8d9n zMf(DHu(rS~x$3W>`78p=I*!)-fgRyeMQlMQ8JE}lFB!r5w(J_PE!hDN)VJi$1(Bq7 zC2A0j&MpU?AtS(r<%o;1d2LM$fBW|BLM|up9mXD9;;8 zns67LcINik7BMSsI=TLgZ#p<9xJVZsUOU;JG91^M383WmB#p+4bX`L1H%UmH-h-G9PGJr;IM|&yt)*Tz7(RPATc7ZI6wT z9UNYsFe>>@?*tw*r7P1v`9aaev)ycJqQIN-Nv8s19z5VZXW@Ywuc|ZMn|E|NJr!3H z374reawKTlsc8D4KJD#w5T$UnOP+j=qFQbUZgPgFZnqwb)ILhz*e-6kUi0pg zq@I9Rj_}(O?+oWpZ@V-(Rj2MUb14>G&blfeqN{#7w;r5&1k4;_4@EQYdNi8P1=}IkxDlCH_pb^o7}?^{BA^h@9bYz)6ftf^&gbunk=x3Ag=0qsjhKP%AySq zr2GGF0n62X2mT2NOM)axkR8r!hO6NO)uSuW1G8qoNrCS_mgW~u*9(&`I)8Fh0*P~4 z`AeZzaxD-_rhwMt3`#nG(9_dTg1@v8i2!MRo51s<{nQ!oXk)iB5c1@S)r>Os)H-+$ zr}*R^0>OIEAt9Rc#h7_;V6ICorzg%qh9e6wUe6z)81Hj8hjCg@EZ~x>pxAJ97lGy0 zOehE2zcZAjm`Q!ky<;qI^$jvXWkJ|bN$F9i$GIz)(>EcvKnp0cOe^=FX*mKZ z+XF&>WM8t=kIb?^K15ehoy!i-oVy}^TNqMY_z9M-q9<*$6Sw>F=coD9TWSWj<)?c4 zj_dv!Kwh~99akue9Boc@mY&W|)(*5i&tCXoUlwrEa(U6GF>O(NXQslS`i9|RQikk6 ze29s~2Lx84y|^J=rgkvkv{5E0_pW8w{>)f0GE7~s`owu^QVV!ePiGB90=sL61so^8 z^-=$5(3N$o!Q zJsmE3@7C;E$d}fA^m5AF5P@ySQ*VvGl)N}tb^Ku`c(jQ;v|XdDtKQY5tg350`=iK6 zU%T{La3amo#RB>H(Mh--?e*Zh7q>9|Y4VfsgQxx|l-`!0kIw8}uL>`cl7AFUGnO0{ zKcut!H*S|>ZLt~ir<>du?=HQajOnSkouJpy)%OE6*;xyrhRVV7tBr7@+1X^t6Xl-x zG~?_SXA77qYu=5ql1v;lMVb8lww}^iR}?jLr|kS6P7l)5zH8bq2 zKp)HgAQf?|60Y)>Mauq7Fau6o#bslIZ8yRe&!Dnyd6%ci>G=9(1d@J$HI^ zw{@pm9r8Vd(W>cKx&krpJ6RgApnTFjvsak?=umOtT5; zTs5E>l+dlCH@B7?8ftS@MI}4Nv?d{cbyZr+s0^HzYl68gu7Q3+)+{BBY5iI92=l&g zm&8;1{;caGCso=0nCE705!GdPENqMs#U9m?=P?3MA2h+`ovY)V%&l0o*)byUY!voJ?Z7@8akbc*}^G*?Kr^F`r_mACH=LQ$bm|)%LwF z4QF-KDZ2*i5;r7-f#&h#aDht9<5)so(5KGV_BY13*0jmn%PghP>xQ0Qpv6&&$P)pj z6U1TII1eL8)YdBR0s&#i*cg96&qn?H%M1faOh_r4{5?lon}ILls@hK~oExX^&I#^s zk+>SwU>Hxmm-PmQlIn6y8z)0-(&N=6E&hmoz*o3lT`$LOMy4`hQO<`wkDtX%NqQye zOpp)o8yMIqTqh^fgncZXZFYVV)5HMFQ% zAvqIU^4=KwWp;kVw(A>nctld>zyCHKO%lAQNb0`#Cn0OE>Uevu?;O2}>WoTYv!rg> zH^~m*G$sA&y^~Wy)6K0+%hUS%^e;lsd;C?Q`t*se8=G}=lPGdN$G7`>VkG|HHDX9I zF|pE|&Myf|c(2aGz{7sYrB9qNY0ytyVJ}>zo85Le;6aha=n4(XZseizB3dgFX&0QJ zAwLX|NtN2AArmH9#DTyJ17GynD2cQ`qFrltH@DK%wc?%hciOps!Fjj?WP*MPUMe}YgT2ES2* zhAPnisM25L^fSn81{nD-2+Sqw<_2Y1A~m%h*8I+p=QHXJ`CM4#D6IFofQa+$t8b1r z(IRm~k)>2U`m7D3N{7YSrNmv=973L-Qab}hB%cH|D_9YBSk!vxBqSGY?tdiK}7&i3D>^+}cpJGMtUx_Ubb(9LZ|8k<+3oZE4k4QSNyRyt;JG+Iy7k1V+NM1}fP3q+PUdQJgf=Pi3=wmq zPJHhXf`}|4EdVyQ&d@GxCEfE-!VS0Qk9FbLmZ5Qg-;7&3hu z5uJhk4eCESz7$o813bgLD;X(`0Cc8U-%KB`{-Jx{L5m{6ZG6#oFu-14(+^ST3aDDb zxdV4bqBsI$a-GC}e&@W;he2+>`mI$P+e@5oU+YXR`FFheH8KV5hYWi=v-n82t-;WXES9k_v+oxF$TN@+iN*@Czj2*nB zZgGbVJ3-7NT%LjP_Hjk|pwF|H;EpC_bW12r1!5k`(MFE1@KYZGm&~O+mv<GMZ zE38r{p^3wEvR3%FMzDv7Tju=P2%Y!B{6P6LSNI1kgkn#_wW#`;lVdB$@r|&v@_*-VxR5Oq z5L1P!&OvKNTS{m2CnK+#d#D1vM0 zE!zI2b__5V7C+sL2eP8iYAXjlf#UsVBgjc0(YJ*$V)a|H#`*mh)fSM1d%5;EG}T7e zAV&0-10g+5L+KAMaChOBQhGQej$~yDTa0XpkMtO+xe=}O8|U1vqgv1G)|nbIB=l{% zH4PyxjlTTqNh8znujie3eCkI2-@BeO_DxHnS1@Elg5=%$-e9ki<&7%4^E%pd;b$^X zMg|I#uXHK1@?OUxSGTIaF{M<9aqx#YI*>MUturseDaC^}MX`ygD}Ev@k$=?2Z)nQ1 zm{6OlXhZl^eMXNas{&+hAd06~5Ea~;aO^K^Ujxh?vKGb|aoKsA8m00Aezv03@_qe6 zU2ku^S?uwN@5%ZAQaJIJ0-r*>0w2YMZoHe>T&dBA(ul~w7X1CUC8`nkEwZ#k7>bl` z#Dh5i14VD{KB4=a0r^c&(>*_C?xIi;O5#v)3E(B5MqAObkymCVO16XAEutTHyNCq$K1#_OF-fxl~Q;LVKC zagI7;pG8d8nFygNDg0{(nt5sOfnC7R21$5pxg0PdB%xe)2BFc830HZOpPGM?L&Wa#A7;& z<$o2NLZwVD%YC@(qflTipJy@4i3IVLrhzI*4qbwB z4gvA=PekGQwA-wiYXUDx_DuEz?nFiUws1A+ zo%7J&AjpFq$EiMq2mK2F{ejGkj~tq`sOU5I((aZFHMH<&Y%9*X^B_Kr`tlR79)C_A z6xWqoxp|dHy5u3ElooFMwlo^&L8i`Fu8|UeE)6v}ge zYe1^2P_P$vx65^4&L+)dY_bSSXw2e~&J0FsN5xOw_uIwH6s^nuQQtlNd>zS;ef#f<{`E^AOyfu5(@^ zx*u4Usdn)ELCY}SsBQld@f*W?GNys1!9fY*x;zhe{pV`aWPvAeeX#^lf}f)1@P(fYU3u?tSjGFbT0!_MEbVlM9cx#Q08 zSI2Bu>sJKr$>nP-;t;)F@u+lHaWTkSyLh`WJ6;7l_+4GdAlK}B)hkZHn(9M>+A4Xf6uoL!T>Mp;UdgUGdyA}==U zao76p(C7UU zL>#?8v|rqdM}Lj_mit#yS*R%wOa;e%G{3$-^vpLx76LPhph#O5%*nr!0#7FpQ=$61 zw4|)z?wkRz=xP#I@>g^WD)A(=_r@v4yTtF)jd#gkEt+EPb^l=+Z6*&aUOD&g>_FdI zcMV?4)Z4ymx3H=aP9g3I;Wc|$9ND@Wk{S>&R|`XZPu{MzgC0Q5!##|2|Q87tYfD9 z(Z8rmXXH4=+KQt^XqQHWrH3)f?w@r#3vJ`?OavTT;&Gn3F71-qI`PHdxV!CQ*)P!_5 zF*oaI@_;^!^RE8SjH>y-zy0se|F@;u|0NRtU*}f=0EUq@S#A{~4~p#yKr#4>%Avte z&0`w^m)wGqg8>j}6J2^7okLMu? z9KiwhfDbqMf1RAoFQwr$q5-~-L>!?*8i2awx2s22$^C)u1cz>phYYP&1&DgwwRq>-gwxqm#XmudlF`R_D z76i@u03#TM>;&qy)%UWNMnw=Qlg0^Kpd>kP#@MBy8#w6H9Y;SUD(?b|nM1a`Pc6ux zDQmt0D9{t2D@=p%^lq{TP)w%`jGb*jzN|*smNm&8yj7zzv*xXK5@lI0aq>6-l^HOGTRE+H%%I z%^r!<%=}KaHtu!isfJ%Hj65mS{8wn}#FZ~kTg40Ge6!H_x)=BP*39g(y_^QJAS*n1Vrj4jH>P*NNNbnU7l2e6{%Fp`5DR1~AY%F4=I6&`8)T(iG_*}wKWa9ARh zl@Rg=Ke?Sj8(#Hrp%%s(NPZqlfkpD9IZA=&6F3=?2*I1_wA2X_UYp%&c!OPSp#;r% ze!#?r3ousV9B1(#z_&l;FIGPXMwA^uWD*W$E7}L&ZE_MvguS+X0I(3?cnx^=ESv@7qr|Ev}^=7|I+Mr$Tlu(dvJK@T%2kUrzXkq6i8SuIGEf` zE9?i)w-yU>25<}^j#Zi|>t2BNUSI<^7S0H~4iwFTYz$e;Wawu?9BohZ)q3yZ-D_D$ zoZvZ^ynN?6rx6v%qYH8V&baek_aPJ)7F^Tr#De*!uXPgbr@mWM9bD7Vbu`oo{p%ye z4{ttwcyJ1%+>3hiiNj?nfkkG(pH)_womvIXk#v5tjZ&lziOFM$LL#r@H+n+Q?JwSe zly|{EHOM>p=XWZp#iW7OVDP~cWJn3bS;AmlgT&TCVi($wsyEJ1_zhe*xH>KW%a<>< zLwv})mF==*8hCVKd+!bOas1_e z$eur+rzs%~4e52l>qx;pdk*O(v7dCR9kLWjY$TjGQ<|pZYVeP3fYvH;ZaG_h5<_F< z4l3`vo)Qx%i4VYgfBEo>0FT$dI9VTI*h)&B0y6=0)oOuvKDGYhpl`c_T(nwpK(;gZ zy(4%IJIRR!Cth$1xZ%c-L-2a>2J83mlzwyzek+Rh+>b+nAn}fQRWZwQmd8K^ZbpPq z1YCd%w8-i62@_KZkXQjd3E<BIOf0tlgXR(L$n$|Y1rOju7xCM#*&o;1m<{OCdxD@=b5n6NY2b6PJB z;-Q|s-%EbU7)H><7y?xThoj=<%}Zo%4E(=MW$v8 zZ!&jl@L61GOFlj~G@OQilysVCDx1!fxf-?A&7g7qHLw%hGO~82=i2&@UKSd|Uu{#> zC^FLE0zhN}JxwLe_RkuUx^ z+bA*I%3Nbdk0!geIMEjuOWQ1$XO!=n1@!V>>^a|T@~Rj!BdOm|$vi~e^xx=Jo<^WA z=K~7VUPZrF^UY7NFv)J*>+wl$HL>a5p3UX{Ec*IVX9<)(%iix6gBSV!8?)6 zVI_B-{He`O9r)2#yhF5Oirwb#@z^m zCsW=hDY@!+k#91Cgw?^+?*wdA6f$MXerpEpMJf7kyu9PSK04UfS5;A(THhmrIVCxX z>>I43q?Q|NL_=ShD_@qER1LO|YcZzo6Xh=- z0RWQU>CkD+Rr7EVb~XM{)~T=bTt}m@a$6AWSkC{T<5|hB5vpO^?xphQKjaS|T=;4R zfB;s&-)_niIhn}SbxG=F=7&Qc91G{OF*3`?jF;|YWbs@5nPt`9rcI)Mnq!kg^AvvP zoW}=x?gnqAV6ISgcGhQ<(lx@#%CqM`T9PEmoJ+n{j@Uk8bv0KA$_<2#mniAhR`8fB z9X}ouzdtf>Cj-$nV>-@SAT7DYiGvl;-IZsKM7OTg8noEC^ z9%BQC>Y01`dEPn{Mi*ky^{Jj)uLjKm(w@H`sOk^)|JGNQSW*<|uUu+5cFFc5@NQZsGamo@(p{GN>=5TLzLW)(ib9uGUOD9FJxmu#*XVo5 z;)-h20C-CDWjq$u#@RDG-hEg@|`n*F2x86V3D zHghbvv)}1Eoo<~R9q;64YS2j#yv^h|UXfW+zMp0=B1cCuro4CGoL^pebh^bC>y8hhgIp^vE)L4!T^`L7uC4l*!Z)@o6aJUk!`X3Xp9QsP^ev`j zakqIxu#^_sfP{_}uvx)tqQuav)9nCxIoADr}WtkGx`-gE^e$e~*y~sf9PsJ85bMuc2*ksHJ zIm^k8W6=D`tl#-s(9V$q7Un1q`pZt5rcc|=&lS4xo+SmrwtdZI9;u%#KfIZ9Myt?5NmfIW#IW zsAyYe?$c2AN1dFbwS34QFXs{^cc&!UK{>f%r!?fyZA=TK>B=;6&PN?uS{1gYdum`U zuLUx_jP8T;Fa3F1x^Y>mAsSQC(l=K-GA4hQTWp419<4DyVs(YlQ|PKIc)a1bUD29M z4zw7|umsQC>26CcCACtIUwv;vZ@4uLb~*C%1fih=$0LK8f1>Sod6GYw7{C2qB+fdc z+@)r}EwtX8KSH2@zlCT%YgPB&KQwW28+y`m?@>3p>x>WcT0_o%BTjizf$x^VWRQ&O zx>%eCSLfrqc4@9p+(k$8@;&RK4#H@=?6-Y?{RMY0^mNNr{V$fC+^olKDnzeSWAWxx zdWjPg@k>Rnzsf=X!?L+UCnkdYG%Is#6X}1?5sRoZ-(TCRo9j`c3MZBuKlYc7&>7l^wOkezf!*gt!UK0h-Q2w@ z!=8knrPMR8Q%s2HHOMdnSyFRl$?=U67IAbmHUn>#>2IET8C8<9nfNOFcDHZup)?Ii z^O;F)OnA1>e{jm7H6ZVMnmh+PF|tYI_xx3Odt9?GX-xYaQL_v@F$@Lko6mOfzc|Zn zxn~3=jdJOuu6|j%qVZjrD$1reCih49_aTSuJA9PIO?TcinykWqm8UuWvf^;aZwW;G zJ@n#P5ukIAYGM#O`x}fDzP#(IxxiF(PjQ0jGv4fNl6klE%f(6b_EsG+ru3nPAiJ0X zbzfsZpZ6{SD{8!gyJRizdB8&!u`JI(V*C{H1f(Qmu8qug#m8o^zQ1PgOKV4S=H$nQ zLi)}}Orbir`5JPHU#9S#RzfX8guR%@DRlf>7~w%?%x}xTMAtU^8>?#jqgtGx^5>;| z+k?=AFCU4W;9s9F)4vQAEb0?#joS{M4R&sBrmj=_>=Ye%l!JEqopt`uv&aZEdPBqT zkixclA6ZN8B!259%R~`A%o4C0>V3G@@L+eGzl%xk^TKuNygAMWQMX4%I_*RF)GHKr zH<4}$wb@M*L54F&$LCs+yn?wh#e(0*1Ntv$@xEtOAsB>&H)!rb0ooAaJX$N^gjpsd_cVVYQjFmv|%I8yHCmZZ-RMj z%J)ZI?F)l$#BnZU8r@_p&Wnd6dL)`uwQ^^y)5l@0m?*q5^<=y>frHPmak!ie;@4>sx#g}Uf+0J|9dPd3kf|K5# zZLdh_ZO9mf*uOZ<6a4f+f7}iT&%gcqb?R-Kyu-@CX7LAMd7-dkWAjF14`1z(4-)Nx zo#B%$jy|FS=Os<~&;SUrlZU9`ybVq~Pm+EZmudTq(bh0Uyw3`6WB8h5_ztVQbOw1T=_P~d@*y}e8YJc~B zA7?sLF(kOecm!t~rO33PtpDD*lyKW+dYrvIhgkf;+JreExC}AL2_)toBeCI&LExb% zUj5MfBF#H{T*2QP+iP{mX}Oq(vHI)mQ`L-pZQ5Ur@lBr$`8($G?O1%Cq_Gn^P%(>z zeJ!a%1=ThiD`ByW&V$N!O2-MOdH3qu+qEWaNiN4~l`pxbPs zz04Y~?cUX`qGJ#2_m;bonAdAw1G_KXX20p*zv%v%)4bndtVmI6Lt}S;_r&hv7aQ_5 zGPOlC7nb*{9A@aS zDbAe#Xvjg|?LsJUFhk_Q5E$h;e!h0thQivJruV@cSx;9#YF#!b&in7+`!b`Y+?{%2 z+(de?3Fk-Q_I(!|tUg{gYh7CAb=EsUQ}es?7l#J&n@M~Zd5Bz-My6BJYHY(Ge6FEg zRSV-1(^JH<7c+dXbNu0Cx;RICL6#Ik?%mm&{=PaX4$DP;5s~WDy2)Q-v(C904mH{6 zI$gmZ3-f!hjm?Kn=kH@{cg&(E=NQecGg%M(1)WCQZ7HBj=wQ^GF?jH1uk{ATm?S&1 zS1eoZA(Vk=`b$=n5<;j z^^-mL?6dPBrmDI9qr~f91{d*%Q>zVe9~n4z`*)AW9WN~8j9$3T!S3C(4iei5VC2a$ z(`*@ZPhE2yH{H={7A4(6V5=9z_#L+zlY>puDu{RI&s_a?%GNZ*S#*6IMMTLv%h7X3 z^Yx3*7fwHrO&4C4BK_}7<`#K6*|C2>9F z<(R{@;UKuadbsp$y#REm$7ptUAR@dyT~;~x$jsb_kfx@{YqU_WQaHPQYpg7|aD?)G z*@g)FMmGoAI5_3rQ{4#qQdt=}U*pI(IuRV)u>L4V#Tp-xRdYiB73`-5}*ZgjSr zTR0^NCj%jFWMOsNG8H@z%~Fv|*guQu`4`et!rH>u!Kg4kbt%*0AC`P{eb@v?z|au1 zLsVg{j4w{~=ZOx+gs(#0>s z;gqogCT-@cB9ej%E>6R&SF(t*!9Gsv7<-rh{OlJGDF;)IpbIJaH1b)NQvoMCpHq50 zO+QX|Ruj7Rjw?^8GB&E5y|#NCDRqnamWYN2P*x*o`tOf~*wGPo{TduBvpzy%B9Fyr z>+MH403sLFprfP{AVH0B zT|3P{FUHNC{Aq_l11NtQO`Z{Z5t zyg@c#`k(J52A>~t%PoFfkQMUyv9x3bW#B#GPC(v>_LbG6p%ap%P1goGZaGbSHsF5@ z`QQ4o3}|~2fF!ZKRg|LpuXUSBb^&i1hvWeBuvjbdVKE$l_7e2+RkQ?RG&yad0ehj& z72OQA!Ydq2p!1h0;U}2ZK1rPq9R-QXHV~UjZa1+ zUk8l69FV?VQ4ZoI-Be4VWXHgGTO+> zbeTYd7)?2_$~W4YA8;uVuK>39fy2_dHX6+O9C0Nv7axGTtLXqh?Iz9X&S;Y84~}sJ z{&5_p0dtI}iNbaDu;cfLY_;QTV0itQrnklP4f@7{><@CSct%X!%OPwHMm8*WBYf&&-ep1$J%-hTA< z8+ED*T-f&nOefAS*2l|oLGz9mHlra5%p1>kSSbQ&7)X-<2X|-?hiydx&`7^`#Jyy8 zMW=8|>2iROo829(sL#RSRSf|Cb$2l)o~(-)!`B_r75M@}mc`X_%ZS11Z70WFfxX?< ztGVO~dr}GnI5hU(e^kcxXUUBMX0$=3m}OW=!)it?Fx*aoG2FVK{!DMa1kT>Jg^MO9 zGD-FztXVpiLH-$yPyhkuEpXk{0Z^L%@>{Kd?nLo6nPI6{9rIg^QPA6V#lYo3YRpP3q+f?&f{j!;B$Oy9Xmf^ z5wi$s#p*~;cCommHSiiWK+Gu6;A$0>2P5+>9I+M$?8I?C<^?n<-kJkKz+0W{yMJ@z zQMd*!XV7GYD+m3%EJ(LR!Tn(Fcx!UhT+-Td0a(Fnag)p3L$KDIxR=&1k>$!{?P4*z zbznY<5h(?6hkxh1h#Td)9&J;~eSN%lC7~q7LE| zv{>KNs)iH$5+pHh0iWa^di^JN@{vOenA2XsE70r{KDhbwhA%h<+p&B(d#1vqQW}p+ zcj$Zc%0Pg8ZRxLdfO%0U4)N5rZJ z#JKdwz!Ww2U*PBq%jz!)i@3TXkW2C}468uc4_RSHbFs^mS75bTrIggPoDW1FN3G*1 z6YeqbYoQN5S`Qgg!wkfzKonH~!UHJnunXCuXxT>)f1}vr=13JmdiAJK+J) z;ahTI-crE#or8^@^N5Po;vkLYU_ojQ{GP@j5pJzbz1Ve+)e;80U{~w*AJgs-hMI&j+S77F=>WoC13Pa1SVi(At=a_C!8 z_x-#YBSs_s~mps4^`1v z&>@8b_=pmP=#$#&YjccnV^5i3o-lrO{)H6|R!cmHAFs-*H^H!E8sTM@xf?r-T&#<2 zmq@d>=Bxzm?SX1;9J;a$rtDdcz^O8q8Tu1{iF@ed!$<$Q8PW^Pj*L7t=ZwOlqw-Rt z9hDjD7sRFXryz;9^y~Fo^nd72=r2_}r9=eTFSUa(A+@p#-hM}YB&ZJ_OQz+RU6cg| zmK2#Z%L0~=qX_F);o=aPIancXSUiUZ2ab;x`aZ8Q5|;zt!&TqTG)e{8kkChA7409o zM*lu;xweEqNKhJ}K{QJQd2X}>X?TN%s2&L9Fm_R%v9}%GjAl3imh$CYws1d(6=h&x zxr2PcAoZUEV_|V?mP%(41QyD6YgH^pguCyC5iUkU$krAD+JB~qD2S3uMG$q|6xV9u zzDdhQN*=+pA6~Aa@CK1Z{p9Cib@7#Dfppq#0rllrj+!aq0D41dXaRH(4d?(>D%RYbM-S8+l?hL~b;Cw3#6#+-+ zE<4#0Z#zpUZ80V$O-2NS#g*q>jfdd9n$LDFJ31gx4ZdsFRpa;~91FHmh3}yM*Ti51swl1Y@TNFk%NwRa9D=;7AIq22{hqYF*rod=toyK9=GOtT7GIB zVAp_6VI97YT#4@7gSMah24p4omn7QW)?K%c9Er1A3V>P0=sD6BhWhZbKztKe_BVXi z{%Vheg|_3lD^4yjH@M90aOlbM`6BL&bgT3+sH(D-CT|yI;{S-bra(=h)^%@gB7mri z108#4^N;#%oP-uqMkl6i0~f*ZC+ES7ZZI=k@Pp9M;uE+S}nVStAY@C;1x3>&y>VM$= z4Um!&DQOT;hNRLkDFs20FF8^eFsV_}Fr>SsOG3J1)aY(Ox?zMk8p#p=!|(n-ydU2@ z@!76R*g5BO-tl@zeE|csXs%^y-m|OYgg7N(Cxs6_I zYqeFkuk`A7Jn-vlexFpq#K`>U%h4rQueG&dWwVtP;VQ0*58s*KA|=-?sKHf417q$A}1)F_^>08C*s}`jhs9Ur)=W0!{0{c$F+PhRWASI`I!kiV;LrzA7u__Fl&v9TsW`v~4k+(UD@{!I26 zdi*c9*w0?#>majG2Y(V9Ne6apbS`WnK&44dPbfOXGJDd+O_~7{Ar| z<OyO7se*10%`82=B6g?3;!n-5aE(P$&6hmq&Bht zzu=bt9|$mP<=(e9lVeq1EHoPQDE3qgce6LT;mJg!ifbcU6w&ypnREC~iB;)+0h2B_ z!3%0dj__h|^6ZG7@aL9cHN(vSiQ&O&OJV*qb>d{fpw>wQOZ6i+r#16Fs)R?wPWnIs zGQX&3V6+fV#(*rLSddbE81=KVi!dx9qtfEjr|5m2=m(SrAn#aYPx*Vd=r_Kd0k8q~ z00BYLE@|817Ud@8#p|i(f*ni(G0}5Y76@R}A%`7c;l2Yfh}6_sBxWX} z%4D0bBG~`aS>M{4PSypPZJ3Sy7dS@;vd*7;xtd>(UTwiAnebUO= zwb@?a7-dPStCSD~ZHczVx>^2SPmDcW5L?}F+dyy)fb7&;hF`v@18AO8WsRk^)j~WG zJlv6Ax|S!@-HqUKvUt~bvDmrM5O5LMfdA5Y`-u#9`buTj5`Q(V5|0fhX9eSbRp zvwfO6{+PgzrLIW6u|E6=OMu^GZEmnt|>=FjJySMeWR<%q!cmJ$Br>DS8$ z_#SnqdzzTB({Ei);%KLaQ%@EtHg2x;`aYL|c15OC%eckY{ZgqnImDxx>*F*Lr1rN* z*DA@^A~HHa?pvPVgp-1iDDR$e*5TX}h>1V0WyD^T0oIx>poZJ`KC!TPN$=L7>+Do# z8k}si8@G%(pa~tGO=QZF()3_s4Wpq#mrz+Wpbz=hC7`|Umu=U|7}n_?-zt=Un&Z~%%Z2%FWOnw^_4ksM z-~d6SrEoH3y~L}b!E({JoAs4`@^W1(1KeXGCwtSdcUfgS_ud9~+U;IhBp_1`>~PBSp6q+e$h8{^CqP zB1@mUIACg}x#i>L^Jmx_X9&Wh@=5DpL`$cJ;l6)|?iCJc#*nU?nj2=uB;ErU(;rb% z@^3$lGINMI@BHa4jZaMU$QpZMk?g>EpH{i&)N)yr&_Wa^hk{VrQxa}hRT|_L%p@lt z9E4${M$j;Qf(UBrm}#0P+el>?jVQ-!COa{0u1)&CrzkftKh455YNBr>5-_ekw90>> z!krOCH+4bXVWJ*Dbhfo+bfp8y8>%&*r&<=48fFrv_d5=B8uwSQ6Wu$SE~zP+%hOIe z;WAtzcwGGiR3YRhe^VOsfOFyxU;nY=8L#v5w-b4O0+s~Bs!80(e;yl#eU{Z_Rq_XD z-d%Oz`t8|GV~@0RcdtXMHBsmvtuzZq%$~QVW`$h*1q8uvrA}oi6P6xUyxQ%%;%XAcUhy+!wXM63uubxhM>2MGyd(*DX zOODB;^97B9KW}nmHiwUYJ&s)y8vFdhA5Z%0chjQ;Z(snWdlm7f7hrnZTVmD|hM%x= z>ps!AT3GpfZw+%um-(7(b`4$l;stL~dE0q?mm|fqhsLW@X$5w4vKrLvqc+9llp~*e zB5VU+5UVj)D~F#i+etm*HP1`&9z(pDK#8?Gy!Ih2C&EtO5c}88MW34(JUNs|{@UID zY;cP}l&XD0etUT6*ppgMll=n2annFdyZnfpzS56lKMGLGEenD=CjN`5(0N;5xI`wN z#5s-bnwB-jKP0E544~A4XoxN&-Y^nT>qi@X#tmQ}S)mpS@Sz)G=)HBJn~gFspm|RU zbfRY3xG5O(bR@<*L&3^D_@m3X(IE!nX6>0o4&D9!jzcLlwcY}b-Ys)48HJJB!$Z6i z+%Wvgzsfu|$*6lrl7d^4I+05BzDZ=1$tvmL^~^*0IUKxz4u4pYJ0T13$Dh;Oo~NZU zY?4i(P3L*T3-KAlM5HoO5489;#EsRSQc%(KD9hD7&9qcDtGd@1vEu6`u$ZarAb2?Y ztWl;zTkN`3IroBe>p(Gl)9CY-4cnGNM*4lQLVo9{D;DCl$00ggfRUAsyjn-^pN4ms<>uX+)MGFYlC>JtvR zPrmPoPg4oJ)q7Q0d}G7WdXY`|WFDWF=L^hDMOou1)eIoQl{oB~&L3VG?3PTA)^^%T z_G>MFCC1F;#0dv$syx-u5cpI%&UHMnm|j|Q)xibobJ=pdJy&8Pd{;Z(UH&z&y5l8z z%R7h~WDlt=y1IsJxXom)C1&a;W$Nz?J12H)hHYXy<)b{`x1MR}PJ6#kgs9WZzIed7Ul76?$d{;fVGav30 zd9?zv;~a-t*WmetgkXPpijc5CX0Ekt7Pn6HA= z>nZ#$xF_3zeGTBP`_$tHhXtQYyyRKSW(y8kPYUJBJjJ}mRGN_Lne{qdxyx%dXliQd zFseI=>%n{9l;(cSh);;uGn5agEp+bfG}?ED>B}KnD9E_AHB#cmw^!Eq_$mpdSJzf2 z3pTAX;#KN3HkuARdBr{uez@w*;u=hEv$GF94)dyy6WgoDRZH~gv~dg>b_FRoeurm% zdk*on?3@wS{W?L<@oCvTc*p!ryA$%gV=yn?8rG+kPevdsxhbBdI&GI(i3h+nSKLvY zfHn1HKp&g+I$N{>F4zj74Z}`Io^7mAmXev<{H6bnE5H8HjFFmn770sbT zWd7ZHD8#gaPSj2iXNe{!znB`i+^tWbtOK|ch(?rX{3C0vO%H-$?!rqa|-Cut~erOjQMuMLaYI=s}f07&ro13s#FP-LUwr&{K zdJRg#z&|xmYH7_iikDj%BpS8%JkD6hku9v{wT7}&vX4w{LF~6qwFC;fNUpK>oi`n+ zXCX{R@ZMI37zXUW24tt3hh7k>K}*!kw|0BB$GO=7EWTSBXM-6;R{Y)vPmZ`^BX}T+k6BgP7aN{A zY#IfTQMI0a85=#Pn16liZq2UyubM2a?{_11${=7!%zN=^Yl5}hnC`!6DfI`5lfx`aCyC}xpd_Y7Qx;aX0ov`--AGAGe zVY>cba|*j#xAf=E#Y4;kIAkb*J5E#WOyY-H1B-Lcfc>}rH7kt$VLXWZeMk2FwKbNZ zIN+bv=mlOLuC>G1@JqYzwLq2Yk&S3yQF=vRwE)PW!zAG2<^0#W{kr{|FPr}I^AD;` z{N>Fu;=fwhavHeDo-85rKcQP!6(j-|a?53M)i zoU5{1(pink5%@t?eGUx#4~Mc_uTmwXZ)5+iEH;uZKCdFa`xF3^0b2aE_BG(QoxI4U;<`+un?KH(ue&t1ymq*sl zM_x4%dmTN*ZtrRDpa=JB+>AymZs@pe{e*Nn#lBPNZTXT+wa9v4Zvs?z7p?Z|m<-)V zxy(nZHtGz=#QyDBFE5@2dVTFipH6x4&a2lg*{b&rRld>JO)#jvOc9 ztdv)5s=mHB!8u%cp&R&xol&cL_*GAWRi{DY+NzU6UW1UyqQQb>wG)#8T4k)%Am3GLIh<4pIhk+U;#&biJD257(`uRcW z5MbI@0sF&)8Hh`Z|8+9~>h)B!hf5RCEAtZR6}fZW?pzRTP)#s9MSQWmEDv@pHoBru z`e?I~k(%0P-JN+Sb67oQ0X$OQj<)`jFIx&7jYQ7nVRY5z_oiHqCrhBWJVK5KUEvjd zgPID`x+ht3JSVw3ttPlTSl3c<^jAeIV|gU+mT#oUe7J@r z{kUYeiXpAyMQzd1fU->7^pKfc;u`Fx(PWxRucUhC;Qa@Gx2gd7iL~Yn^i-Xn)(diGH0!njlgH`!>1yL6~dpw6(ru9gc_VyRL%>_{re zn~1bpZf`u>v0-TXT8)HX{PP$=sxM0|t01mr#JA&#O7|O^t>MPvpcj_5>0#nJsh*KL zK@PDxt@_k1HvLz@<>q?kiC_4uH8`1NJteJG{6l(<0c+@-Fnx+SUa)lNjvfaH{7l^i zN~acm``qjLg)khd2|NhCRr2{ScQIy7RGPiCug->+(#n0dJnW6 zZwqZ@u!wsXQMndrQ=0Cv6uOuW`uaD!s0ug*2{90s+C<5KcE9f%@t2ZQjU0>?4^<1e z?1gqn+!hy1s_1+lNi)NBo76JYG8Tk2;d#s{r;1!qH*IB$?_Ps4YR`DQ=az2f1y8$P z*3CCfOIcHZZ~Dckoes+LdT;}7^&AP{S$i832BS#&Va&RzfMLS5Wv^5{ZtGBHN}E`i z3E~T6Jb(B{BLIRJsS^O~Mz7oZIo1cop&BcIMH(SvnYFeVv{3NxVF_O6JsLX1W^%g| zFh$Vg`P*$PeQT6A!CIpXM?uGw1^&-3DL5?jtpkG$s>hY9YM0cX)Z4b6(g_Z`MjFf> znQP9Tt8zdT5qd72A4;-|`UZ-(bS)rRPQVio+VafSX4ARq4H7b$r@~-i0NR42q69Dt z)#*+X&gM|&#=His%RgCZ*`nWB&_UhZ>8>Dm>%nb#vr zsQri7zX43veTnKjIqzF*k-tN2hRV^_Jt&9@4vw+fdy;zp_s4HNC8r&TaT*I-T#Xms z7xQL+d0d}gh@!1k#rJUPOGCUbq*$hGjMqYw>d-BN3&o%MN!q}Th zmJ!!Yz4j6l>~`XQiA~gl;*3wmgD!ty^?c88Ts^`5Q z!QJYW>~-7q{`96+RkwTn17jL5inUsn05xZog0UiMdt=iRI|VB)rzX)`?zL{ByYjqPcn#jol{KG1tF zS~Zq#f%V6nqz1RUU{4)^tK$l=fpn5{3q0Fgt>%%X!aUhdKOESPF3knNf()B5f7h}8I3w;tfNc~vnZZkXzhd}oTLMWLCIF}D%|VZTDqD)DQM#1 ziyuk{3UQ=l4RoYgimM2x(sf?g_wqQXvjh#g$YlK(>MpLx4&?&bnY;oo@1jdg6`fkd zRWkV9vlkeGYGvw5>-%;wAA-f3l+=G}>LhD6xW$L5JH8ql`u$7b*i~eGhLe6ty?UtQ zDw~xMa7@M?=vW5G^FT)=QiJDwBPMQy)f0qapHUC(*_cR!*2Vl?KOSnle#)5X=y}^|Tmt>D$dON(Ha40x zsXX-gi(jD`V**PhBdvKyl38TTMQU<)LT7fWHk)-vrAbh+EH^@DWT;b=;(6y91}-|! z!}7fqF~Fz@7(pg-jA1hpJUkDKJ(y|1p5@suGeX}ANHk9 zD1RI3E5Uj#GJz}U^D4;LN~WwG;fea!$6Kfsr`0`@DE7(}309*m=$5e*_NM!^OQXrDbj+ zER3so|3=|PRc=TxCd;|?nF+=aCFjUQ9}v`Rm0*JHrE;WbdZ(I@{`XPk)Tdm4t_dhw z4hdq$F~jviPMbdUF+rwRz$0tT|GGnhj5G>Ras?BT%c38*Lsy+wR9_zo$3B&N+`%?P z5Xuo{)aO6l)?mdd0t_TlD-18}$0aN9DjsY-o|pxv$fj?chq6`96+nmHH`Cq4OidEF zjLE}Y7Ls}++>>BAE$0oVVL`BYrdZ7V4#8V`>oUOxFoKEWX39DF{AY>{x1i(J2~lJc z6}~A_&Yn%+2`diYsB&&?BUg$b`QID=q*|g#SLT?t=UQ8OXQssAxG-^r#R~fOK=O7> znfp!01GeBw68{tHRr?Ni352>Nr7`0vDdy1ahl*z_jz4=oUswWkp4D;x2DW)4!aef- z9lhzA88duwFcjHDAWfctQTCZJ88It>oWUG1PAWRLEpNJnDv|^<0Pjw||34P)*mnzb zyWH=j$c#wWSa`USdY2!BP=I;-PxMz6*H)KyF3p7bqf~jgIasbVf-0EQJ!e-{RucuS z;D(MvkK5H_MO#S+tfM#(lC>#PDI&E^TZVyoW#afn1gAt0R_R3rzz(H)SZb()lf#IQ zne9OPpPWks6P|WL$vO3|_@crB-jF3prg{E2juwx92N&`|jAH$ozme%)} z(Fta^b;!B)!z~^$06j8lUGdXRe$jQ+^6rglU`ho|{|URlGUH@A5J+YzP}h4_s;l!!6pt<4N>asBvWv)34)>uD8r!QF z$axm^``3*znEJ04ez5AEs;7f1#qdo`;pte1oCt+UR@Fk$xxP~j#LOumK0aRT@RQj^ zKtO_#RBz)(A|z1=7m+Gx1K(FZ>~sD2z~AlVs!6nYtPjgq={M>+cHU^SCEN?E=TgN| zA2hT^PziKxHu>nhwx$IMvrCK^TXnFz3mJI$m+E`(By{nbNU=Qxt zE;Q$Kszb{+(sDPtPQ3H}An}-JNbet*$+^y6l-@~GLyo-qBNSOYC4OLd#fmWhz~E*> zCo?ypbwh-9Wje3Og4VqK!#eikS-6qJRr^8}SoLcj%CjzooLc!NZ4AsrF3@DktShm= z#H;+K{YG`|Mdb$BlTIe#cf;-uvV%b$OqntbWHJ*0M!Xxn19!VjFXU=o>y}moYXi3- z_p0#`B;%$(>=<}0mX(m`8l(abq1Qu48|R;uVj<=%Lf^)BSE1+iQY}Qzf`MRH$rV3= z%5#>g4$l!aGqVj!A=@Q=kb^Jla=>bg$e-Bdxi+uqikqf#TM)^P?P8;|6E<)!W5`XQ z0>}m`1nM1apAvDy^4?nW%N2&GSMPD$m_C=6v*xe-k2;njPwT;19Cni48c;n?fo;I^ zkd3Jx(XBLSXCQGkklbY^BrgpChKPIb7&y1be;2IA1T1QSds=SwaObK1F*BEMK5N^} z{SI_5rp_Kbf0iP<;}27}WlV+5sb7s6VnbTLP%?F8Fr4@~(l=bMRS|1(rGhrKh zo|Rm}pkcFrU<=rWBSr+)p8Sekp1 zZ23MFVNg)b90~BYkSvmpJ;Nc9( z`O6aw%=-$>^nXs#uXN3aQ_MW}8uE$hMScOI(!vW3;EG7E2&UWSi=sPxJHr^Hjfocg(?jq3nKbH(m4b3@Jk%EqfrYOOuKaaij zKxJGN5}Y`jBWWg%?pnHAZ#*Do5IoRTZ68tC)qn}-C$17#=Z5$iTiB^pA*Dv0V|Mm9 zAy;}u#eX2QCm<8+g-}zO?YZJdIlFCWt#`>f8T!OGB{>!kG>}=LyB@cu{54W7Twm*0 z@354^J+7c}wPbC*d5s1#)`1p7cRR*jow zJin%90uD^E8=bzey5qGk0^5~$yA9$y6@I(GRHmA8Wxc`_^{W6acJ8%gdf{;v3DGEu za5pjvdsTS>gn(zfoEeMm#S@OzJY33eSEe)8)pOWmjG=~w9ip}MP_H8CK#>Zyv>(M z)t6XAlqSI!o17~PFXWNR@=PEGHFI``qEeG&lhl>d(iaXLKXTg$KZJTd+ln8pb(^d% zDN=Pw)kuN;+_;$P35oOlQyN=k#0iN){fGJG0>S<)=^8-1tlQg7d;2mSYA~m%rxwJT zx`Wd*MCeEvP4Nn$k4L@1+mCi+Cf_WCsKSH$o+(c&V|=lrpXaR?0DV&k=rn*I<^1@u z2O0%pL3c>AeJYFPmS*Z_*&F0Ly=%FX_+h5zRgB?Ie4AvXcjpKpRe9v~!;##R>=Zz#=@0&g6kvqmTH83k_fXYli{mZl)K0R7@Lb|lTl)0BgNjkeg z(tPaVJcXA(KWm#|yoGYe+x0qKLhd+tmB?<980ysQ&n^iqIthyJrR3~hosCpGE`bL} z&R1TGpU?T(oTN`z7m>ILL3>_{?&0~L$8hr3 zLgmvdTR~2h+EdU;6$7v69OAa)!nr-Vb(X1BWK_lb`sw_R3tbaKgIyvFF*4cP^_D~2 za;uhz_DQjmg;zFfw35zB;SVBzEvP<9VAHpf8ej}ZFom`M1LE{iJHpe?1TtZ*`fZNJPgX9%p=!`V)FbjlD~j0HqbrnL85G ze*0ZHz-Z}(?A?rIdR1rr<2~WC@AV64U>rddqmvalK={ycmWm10a5Mm#2dpCP{HrQe z2MGoBftgsD1xDQ1Q<&OsE`Rwl<>zV2s?ScyNQ@cJG?;mq8wYJTQZCe|Mlf`;_yunL(HzFgp%ZIiebMBn`pMP(SAlow|tH+jA zDhB#DkmDo8^N6h-TXZp?m|!Ku_jr5fNnpE{HtxSZu(e&(-h&^94%%o<(hq{TDtLD1bTcRMbmoO9g>J$sg*+!rF%2OUtlE1p%zkZN zd{l}h)QHBW6HE)+2-vm0R(GzBh+3Qz<5sthcYRN|Emr6dCvHqL14(62Vqe&IP5x$W z8^BCa)P{o#>^?O!FzcysiilpjSO#25`;xI{~K3AWJh@deS%u=o8wF=Lmptu zSOjpl<~@nN-*>;G@OfL|bhhJrB00B#CemF)p#`%KtO6hUeNbEmzD2g)=bcR1I<#bT zce|0qG<Fju4hqkH#9(#0DRa8T?!zb&xL)De)QiY)_bP zB!l=RcH}xm%BztH6hjZ1NUDnUzusnDf5qv~f%OE6PA%bZpvj_Ek{8ckX~%u2%1r6N zH%C_fBaW3>55*Vd!Ii|R*aI6moO`uA94bzUCG_e!P<%80aP~Cpw^e}Q>2C4zoHq$- zj8SR>PIu9*pl5X!;W<4J%saRn50*5uP4{SRM*Ouo?QgiPJW{MKnSZoslbCZ>G2nc0 z`s+5MibXZDYKzCUF9Uq)?s3(Zx^vTcW7D~W9kXt*#56cCfy%k7&X~Lg5uV=l!>@!v znQ^d8$(yWZ`)&%M^U2ZD@F=qe)3J9vaM>{4kJty7VJKhe`OybS-l_CREIcft5VnQQM0q%%Az)5yAZ`57pZ`udgSaT5mj%HVz9@ zQx?fjpd#-zeZG#;h}# z+C&jouKTs2)#D#PZqScz?bY&b8!c*iu6}4>rRDT29V?go7Kac1CkYyPh!sYbJf8(x zNY@Q+BqU;gm|IC7r13KY4i4gJv4xp3H+|^{H0CMA>?WDqyI{b#A?I{ksEE9e|L)s0 z`jFWzRG zAgK-J)vdH=x0=u8!}I!plr}Dya7nV*`lv)sf$mKVjcC;wg1BH497Yhf}7^ zx<`bzi~EKCMX*e{)Gi@A+(EM_e#hPUQA9-*(x#;At*r= zIs|Tb1#NEKwB!fCNAMDs4g$XCdU;4C+gIBzH((>YS=$%7)m8fxO(WH-X=Pp_4q}p0DCv?SA$EDD<5bEm^WFU40Z_OSwI@L>QrP zySuxWh#o||1kJux_z&+laiB0epXJ00u(bMsjurDvdUy8|5O-|+dmR|#=mcQTF@m=X zzq~+@5e(5?4oAOrko;D$;xuuu7b8{BBzSXyJW&MA+K}I=2fa&h9TY_h~Je znVmh?)H~ZqaOz+k6?6G(Ssiw4y^BUx8Qi!O0LK0P&cc~$UG1sCB;nxj+{s%V4PAT9 z1_~-O!?#bLYC!^&u-2ShLm{E3Wi)(&*}l};i$AHUHs*^Aw5!{V5W8AO))x_2apM?U zz!3bW4|7X}hzt^ig_8d?)X}M9wfbFNx_en}vs|{e2^_lj*zw^R5*dJga%& zFYnFCJ&<0p@+u|;9=+oh>*K+9>(v)cFk0)R7*zFSfGD2(l^jPGj-PO0fyD`XuOOew z10SCsZ4u#o1*)H(XASy&NKD}H`UM;W%trW$06b>#nGV1XVGg!)LyO)Ie`Fv~!{J!j z^UO*I@U>9ivRYGH_W2|)|Ku#;j=VX$Yxa?r4gju3_gN?BYP|jkCl#X{_eDfOH(Oh? z7jWUCX6k`5UbaqcID@!zi>*=xQy`PA^i_)h1JJ>2At5%PzxxaRKnZI3?!^Hp&yGZ6 z6sdj6e?46t)p8!(YdvD{o$3Hig4J0G%Kr1igY&~AwENFia#GnQv&IWMW<%!b!_Svp z+ix(^xfQlj}%>KvO1GGTg$)3z%mSvR{*HZI+@* zZENdQ;%Vse=17K`JU@8bg$GRV4Q*Y%CEq4pB(HJ5K4;VR*<$S?zDCb-jQ5_C`jbpY zR*(%7EipGzlGP6KwxUW~F8?llh9*@@Co6U|XFpyg9&|QJJ`j+G4tx+&*aD6R+s$0T zEIpbB5}rVZ_B3_*s;AfD11$y7=o3zE2U?3w#T=$gytP##bm6_tI4L?CLC(>Cq_{?t z;k~5C=k{@!whMAf7W$lyhoYBZW2Z-8#=0P0*FMAgD+>?ooc7M7m0`_RIbuW#@y8}r zThk(lu`aXL$h^$!WN6Fzgi(8*A!y;V>h&oVb~|KLe>aN7rNcL9fFNvunR@}u%S}eV zmv+U2-{GtOqHV>)n7{XtxH11`KCQXUkh|^Nyw;L6F=oZT``or?wyylhvZ>Y&`z&Q%W+3`+fUBr?okwb$BBST zwX(ArOQ^bFccL!u{@FXG-L0I5 z#UDh32Qj+8h@S#)@GeQl=4P|9?Yumrsj{Z<+OXFa<2kneR3<;@@an!OXDC1{A@Ro)~;a_L3e4>McRdiDQSC(577($CL|;(@hDfBs`PfDHZ-T4 zJT4hBhrDDesrryAUOqv19LC)m2T^ki`N(h)Hhkfh@-bsYw}3%E%>J{sV4aOhH$9A= ztHdTXQcHhgYz~>jx^@3J-=WvMVUBkJ%TTQN=vA~bvAM=zc#QbWjfsrcOS49BTbT- zt{DvpN=Wtl@M$km=<7|tN5n^7D?|@@EaimD{^e zaW=PPyo{L#qkEpCJyA5ayK{BbucDU6g@B69#p(WRd48$OFY}xBkbGgpLfh!_%}$dH zki4|P)GdXM93+Yv^G_>=&Q6sn>0y4iW>SjF{uixn?UsI=w(8vDsoQYEwP(3IkF2De z+Od@s{vmaVWua={@KDD%|}M?!&v?0TOzQg;SraJ;Q0DS>tfhlQ!n>3hj&F2 z44njFS06CqU)<;>T+A@PDyx;Q^+7JZuzN7ZvdDLR0SkJ%yx)WLnOd_?0z48O4%K$?=}=hG}*M2k!(Zd`!a+&xOYDIsEejbW$5{?;-2TqkNlCw|dg zy%XHzy~T-$-s$s*tSeQS8PJ;ZDosJZMgH?fOk;1LdXxrA)}6mkYai~3cb?vyDIzhH zy>qL=nO}mIUHyp{?4yTY@ziE9MOC@&9@})X)m2}Yi?&5x?b{;{<>w)4WBQ40T%24o zDIn{C2?8Ov102};{H$T`o;99PW0Xzpt@%j7QyqE37(pyxv^KVR@SeM!6rs3M&oKIQ z*RwA`dvl8b$Q9ZNzL@PHp@UBf4wl%sRZ=$Ac%S{N6Iz>JopKrmfJjVDb0l?4aE~SX zXoj!*w${sdB$W@#7DhP|N$Ns=H@r{YEA$o1X1!^A={1iEY5(J_>tcM5!GI=Q^aqjOZuk%oO`G<@T}-OPcjYSZ zyig!3m3(&v25{v|L^2>-=0B}f83@Lub_v_uurF_^m&yefm zQ=l(sAV95e=L2R$iz%>Sf8lmHIW*^<@p@l`F`*Q}&0lEkZfOsaQMU`~j||3%WkiYX z>9~M{+-HH7;H_`M0WU~h_YOP{((E$+&jmNe820(QUrb1xV0M)2-D6nc*em!qE~&D-B^x)pdK`V@I1e zmV@O>vs(Ht5IyMieXaj=KW9pb&IEc2E^I!HpA&XLndM~Cnd~-gLe6&Gbzwn_ccd80vC@_USwV761IIHU%7S%m%Kc!I6-2pif#D% zE=lzl&96mM&dmRphQ_R#VV@AT*BeUA=go-nDzqB2nQav zk0L!1sB7}2mcDmaG#@2ZnXRMtGj~NA#>v+-HC3vdcRh3=Zdn`JqB-ixw(RopLbg*H zsal5S2H1bd0sFX;kJHXtTEBWYhSOk@Vmwe>N_l{Bs$f;EPi^(P)K4=i)0$G{`S&f& zMw>ky{M6V7sY0;8SMxbR@jxg_6M!i@jp$?M$|5%6M;t@!wto(GghZbXI#;bxUe5DE z^8kx4|D$3?yapvi(J3ZgGZA9pR5+ZjXUyKsP+Ac|!F-$tNzFb*tWAG}&6I0NKr=L5 ztT7|$TjML?mZk-QU`z%ia`?Y26*!jCg{dP{oOduD$T!r+m7Sn9f#>ewZ`X3di9GgU zjY;+e3^R9<;HtDj0yR*FQ!Jo9S5XE=8c>O8aJIjXIld^KbOQ&kJ_!L4sUXul^Dt@& z+{5b!{RijnWd|ZB-9*O#MV~S3t$@_@Q1OqYjZbRu3*3=|`oaNP55#ay(GYEh1Lyb9 zFz)h#zN6vc(iyJe&H7zOuR-C~U%R7qjRrLmbw*MTInopQL2XLEdT39cxP0mPJX9$Z zpu$~WI5ew~SM-58h@j3Bk=5{BPtED4=F@uix{)>|gd1gCs!?~8xn{j%Vw1+x#=^E_ zn9F185Pr%4O`et}4vxopwz$e>_dVJ5sh0v)Uryb)ht zCz!ge-27a91(@C!{+Eu5+LD2A|Nq;)4y-l)$hy* zgDk8g58cf*TLk~X_qy&s@F|B<#edhy5`4R~zq+QSt#w}aijbx@H{MNg7Sp18La>Urksk7+BDe>x8Ah=~R+LBGhBZ>3FJAMJiGq z4O>+j2^S9apEbK@J>*y>)Yl0JQ{P@=gIy7Het$>}N=Z55Z7~wElofqr(PM{2MRw?u zG=NW@m(Z>vdO1S~0j&Q3@F**=vkHgHAy4>74-d&+n<>jD1zlH{;;qfc0nNNL;aoPl zL)Vq*^uselH(u_A$~5MK3_R*C;TNGF^g;8($BQqIUCnB;JB|!IIYm9G<$$+OQdb6% z5(+A>MB+|KjY?=!md)k;`b{^chzl68=b1{q37h^ofE%2-~e z6?={A`vZ7oMOmV~h+DoxAet7G@S?6S(5hoD1Btr$_866jip>2F(w{`aLezS#+RpFm zUu#~#TdxSIwTvlM_zy($EE`pP^&{pxGo`uYafZ%fnb$l%QscOlk`n&H($&N0=7b=g<3KSezQcm>Rjyn zh#@Q5UjH*{aXs9J5lC2!y_tR$- zLJna?$@U#Xt>@1&^LS2L2W2v*;Q@1IaMkO$`D&lSLhe2(Ah+>EhxL)INwljMJbzDo z_J@j>RYxq@yMS=i05LxM^2>eJb=iC@- zK=ITF%5)39jJqGP@=@aU+CJyt&%(%4^N#k>>K2w-BKbA2z@>pl72_H*bTPmca;mgw5-f z&Z{CpZ#BD~+zmcQp8q%uXLuvSC>cnhx=oVKC1hIFuUM&s9X%sA9zLmmOWodG#K!$& zPdCL>m3s@SY-uj?eA|gMM``{S%64b50X(}t(0>EWO!}TPnV=c#8_w*`K?OgBcDD`X z>$mJ*5Xl7pjQdQKL`J2YrNYep_#mM|N8wy?;q+p6_W*&#J|>}M+LYG7QI-C-yWsD7 zweIdoa(JE9;@W?Zo6pJ!L6^yKdLXBTrW-AwEH4JNW69E zBan+vtEgBT0_DTkXlRXN8WM&yJl6le_TDlq%P8y?q#Nn(?(XiE?vPGtq#ItkOS+Lz z0Vx%g?nXjMr9rw=V)pAdbLRVTX0Dm@U2~lubNI&_&-?6n_TKlp*S*%=M7rQb85$@~ zt$}A{z4@{Gd=B}%H9W0BIWH}qgN1LVsFe`oO=BFPGbhCX#3_x@nx$Z2`$u?Y*k})5OZ7<9}!JAw6#aO`Y98m}%xO=Su ze&|HcawW19X4^`{f0Th;K6CY2DE~Rd{%7v0?*xf~euH>u#8%x9JQG zqjS(DS+q@d*iQ4pMZ=ueXT3?cgukK>_D^B7*t-{Emxp5GU;Y5Dsn!vzy?W}j4kRu~ zYijrq$DF_fAA5sAzH||^N!dD)DnNlGZ2Zdd%(+9Xf|2BW@U*}h%if;lQAqBWL_w@p z9)FG{@Zt$3#YKZ&t7cmure6i(%aMRhg|6dJqSZp^gELA`TZ~@-fysfcMi=7cJZzluZf~6SfPC%lfji@8L6EnXUAGxP|Q}mc;lXq&Oaf!~(Y#WM8 z7?V2t8P+GpwKB;Upf9AmUq7z-%0XA{9W!vO$u|3qmfia)o0XlH1y>CQKY!jon%sbc za;(V$3q85Wgyh`9dfOr<>HE;8y9;6DOCsLUMi!`D*{lq66pMzLM~fb?2j}nhWFWIEEP(a=q)h73k7q#%G)>vVSnc%1uuWZD=HcP6aj;T%d z`KJZ!MAF(DbGSxw;w~@cu zeCmy(Q|M+Rbiw&QZ;-Ht?TsW+9P~vKs^lNAXa7^4btCqk@}TRZE8x^N4o%8KRY>tc z#RD*-EK*=)Pe@2``OtpV1ei7p1}07nrXYWNSXJQG1eHrfLr1SL0=FM!q%*v~(i!H{ zV#Z~W#f8U_S7*r2V)8N7}?dz99J%EwP2OJ_1y|Kbp2;G2Qx;{-4R1b~i4GqlRP z>Uo|usPnCba!mw-Z%!QD|1Fsar0?PL)s4&mV)zMY{3=Qlt1CHn%`wj3LPS|xt62OjK#z6*9a#wC&=2S?wIKM`33^DJgq zLERB6Qbb2UZL%w|+8#*#45=|`m z^eS;8%--$ttI12ZuTOtFpUxrDz4HlD54)O@6Qs_yYpE(vqDyRSY!6G!Nu$*55oQn0 z!zbKstAKZQ5i*2Q0Qjkc#URt)DWUO)X~PU23FE}QCk^QiU+VG3<{O}}Ie&dgEaU|; zkV`*J-CaRy`QnAV%|O!WgL7ZBhxh=>cPSN7pnED&vNA~FXEuI1Ix-SWxeQ7R1^rJf zJKc59*Fd)OVou3~m6i1XFc3b1db6V-QkOKQY4 z39XC^;~EmX+PNu1#IMh(7ay4$Aag&M)HgBNTd7Z2i5=LqU>2%<^Z9~D|9pp(ZPFWIvz$OfFE(s0z>JEqi zFM*xvZ18mf4?COj-QBs<#U4QBcsUYy z|J&oC*@Mr}?=;QRa}TVy-$30KLH`K$5i0-o&9FGe;5G?$-DR>f$~9w> zkfUk{cI<{nvbZkn2;3yhAf^wMQ+1N>(Xxp1ubkSs8dG5Io14Esc~xjnXBetm@B2Hz zA#9wh^S){Fo0*S-++>*C+%hp(snC|A`CroiP|-iEU}#=KvsY64vIh4ja`kcwF+w$N zP7lZ!Pcgp`y*iXs({TD3go5gA3bxTYVS%Iw3qZ0H_;xytf4`$;-b8 zkU=umlc&QXF0#LtB-yDYoHVQnztR;9=zyDhtHX?Rh_ zlyDg#Ln2C|DdYq|YYypfo3{qk%QU%J9j{tQa^uSc}2;kbv4Y^vVa87UH%Y}jT0(oiT(LwdW zt$`rN77R)Z%iUlztPk#OrvraJ%A_@pAXRXC|M@=OAR?5UrD)(Pp(RO4j3dhGGjcuc zfg@rj7856fE8_#!p8iQ4$-V7#CCc~@Z{Gu*^a0p#uPpe+UP}m$-Ku5Rx&Q^^3!&@R zpJXDrA`=7qjCf#X%m5gvnVDQ8uR5Uqr)7ifr4-uF7Fl-~pAQFtEtXPm`tn!72`CjC)VwR;=(_#3et~ukgWibqr!(^V*^+c`|pFy5Q)2rXq zDZsk;r_rO{PFE0i_65Tc=3%1fMsQN~*3obr4qerk>#YgRu#ulMbFnw85@zTt=~RBr z9_~6pRa6Fil(uEh0;nP*9))a&(u^jPGMCW@Bp09H(Alw5Gq06Os-EQ$e~+b+s^|Gq z$pIE(iBp+&&%^r?XEr69%W?m1ff={f>RAGx;yZSq^nrw`JE_C^M(6q{RUhg1hpGxP z+7{!{1Gk{_a?JISgrZ0&D3Zx~OLGn4q4g<^vOI6}93!ux1V7L4>Ql?U_ptD46(WBR zn$?s@V+wA8T5NxwrVe!4De`L(`;cP8109iC+|l$9DhLZ-`p2IpY=XF}!LvA?gL-Zl zn8`;^55kZ&BVN(??OAw=q5+J;f-x6SjuT1Visq9dW`9u$3UY`ks+khy9y}xlM|}=+ z%q7>Z$_9lNUus1uwyK!e?bmXUQGs|RsD8I1>s4!^Pk#TaL zid}%l6w}r~_Wdo-{H^HbGVvg=24?7Rd#0X@9MH;1=^uve5ghhzAE6i?;SZ+JGPXr^ zBi09Xk?EW9FB#SJVVdXMiv0R3(k1=A-+wlRWdBW>w=#2l_e8gz|8=|E@gq69y(C7; zcyu>nv_9rCxgI|Rj+2s<>w9Scx13t@5CXjDND7%WU2XQ}-a7Ew{|~Ebj`Q)7~uY?ZTVFSj}e15?AU$lB*sf)VuU7HNO$z3 zjOk7&6IeMGX$~3p@2VtmxW>3)D>OoQ9bpfVK9Kkf9<-CU#anWcRv-D~iyyjfb_){f_-XV#OhXM@)P7W?``g$40%V-p4p-iivL!~1XCdBM<-wff3sBB)xHZc;HdVH8>_SCILb_;k^ zqEqpZ#Ly)~aXm`J0=|^;mBMd|>~1K%tcb>BjY-ctm^TO;sAI zNIR|8n?JT@N}({S{Q5hy1pE#ST2?o$zB|t?P_gv?4TXD1_vRLzveDkht#*<*q-yy?TuZ8=2OHt|T!v=Onby@f~~I z_0^Bydb5@F;*G0;Uqy!nW^#|AIgpO5&W^S&watEao5MWdjM`))SM2SM;>^o8kxlhM zZ|~ZFS6K7oL)G-T&`)<0*-9G^0e*q2*YJ(1rUOSb`3uY$g`Z<;S~}Qvn|~yg)TzHm zMK=?{;HK9yKrf-mirjBSaiqprZyg*7U}$Yz7H%U)6@`V@h7&M%TUACX$Gs7^8~gu8yNManhfao;#iG7n z(FN(kLPvS3R#hpZmw+Se)>5Gd-^^s@I@TJeVn7oi$Jy7wWfm%5@?O2S6_@vFJpz>_lh>6PRiT`{`+OF{C?*!_Nj=Tc>zwlamb$MEJN7&yn8*d44)vuEH5{@7ACU3KEU z`f=!bbaTxKBMI3jFFJ5Ne>W#thLdohVA5d;R_pWfUl(R-EZ6)KG&?2iol#9(s!Lhn ztWe#fAkvEI^H)W)R$l^Fn-5XNw^_(bWRn8&O;-X;DxN+^89bM%&enaSy2uEbi_%gjgkc61CdOjb6gW5tEbI^C2^(!pj5n=s zQ^5IF7~9irLal;&82{rWM4oeblKoJQoEl>&pYc2|s(t{;4;Pta{+9em07+v+{XtIP zQVZ1^1A%%4k`6ziP*JZ)Y)!6x?TsKSG?p#m5V~#3;{UBi$v$e~j?ptd;sc8jkF?U{ zPrPQhN5+}r16K?&m2!-%J_`{kRBsgArk#S9$3MdTBI(;(G9rBCj9WDp;V)mIt}?_cS&nO0VAE3Rmlb=gDE++(wf`jl zv1n2FclZHgcoInxkw2$#fE*Ym@nsjYJOHXP%@|-^B zGScf=KL$O%P{M$5%&B)BOh|ORlX<(Vl-Atr$f}8lR`FkW_eE|uGu570o*`M7$zgED zQINtI_by|sTN~5J*$ZGoBGPY&zs=(a*>Jm{@^jCM3BA4{JL0uGjz0*cqJR9Z@?{qk z(kP87I#}BK4tiC@ScdnVcT=mkB~N-j>&W~#rll^S2girghlUifPZO$6_u*4LaoVYl zXYzh+vqmiyg0zkCRdV;OM<=fb&Gt}Sbu!QVRC<171TGOLJRC&oGAjvAHq%%}R0^Jb zXE1j<`%BK2K}HKg4+4f!6si;6*b#9SwuqMZ1B3FqEp-oMMr+!hFo|rd>t^+lVOx!C zQyAVpQeUw}O`ba>>1*ZW)U#%4J?!C@T@dTC#qi}XZJR6_oD$;lO2jQ_6hPD^yqBcXZ@>O~1eM|RjC(rU&0&2gl0%n<>IJp_!Xkgy+?^RA*D3}>{ z+|tW*1DGS}($uFCaf}_YS25kH0hD0W^t?hP2S=C(SmY@#!;LC9h>HBQQG>bI-WX+1 zuyWjay(&9?bvP^FGXQBUMipF{!B+nP#%$&(v28oX@v=l6dEMz=m8B@%#h*2N0M(2f zlZsBGx9<;)@*)|A^g{9rdDe*T9L#WT%8TSrF?NamM@ADPUWQJTx5-)Zd+GT%I86wA zlx^5!FxpnF!5X5wZ(6Nke@q@AeU^InO(Fp;JuoVdk<-||V}|XUnfzX=pn7lrW&9{{ z4y7Bv^^6O9zeXB|&q9JS4>hySO)NLARoB2-puBuj%k3TIdTrlR92RaE1Bp6UwDO^J z4@r5X!}8T8d3>CnYQd&aTwI)Th_0>(AuTQKG>_K5|E-wW<>lqyaN|Q?)FDPg$HBp2 z!HA9qpT&>qkp=Ie$yw2W_oB-huyJtGd;Z^kZORG6sZv>wZdp4_W9D~i;EJNWY`%Y6 zF6LVPH2&vH>XD;4aTbaBJqx+JK;@edwgJ_EI=RB0*16&VUcu0t-;coDo&wr^-z(K} zPJm@mtb508mAmQj(J3H*D{w+Jmldhy`Bi5sUe{>^e5Km@vO_ zU+K`+gR;^R&_G*AVS4RiCZ2Y%Z4tn5Q|mLhLKb7qnMk5`o8^0=*JcV9za6rDfJCm{Uw z)hDsQG9Ef$()EaIY30m%|1o^sXz9So=(YLBLfL4A^kFJ+m(zl?wg1K@CHa43z?8|F zhiDU{0E)>g`B_L56yvSNPOos-{|?x}1ZHAByZZYl(`sD(JAf|EDVYdv5q-YC$aj%t zOlT#zl8y#i-)S|JMgy(5(%e;E;+uKS7Y&7IF5cPw8(=4RfSc@i%v;4OXrDqy4M-3P zNdhSM-U`@@tr>RS>F*X@{=4@#uZ>^6t?VH*b-{V+0E>4Iz}YCEo74?d$7o;!IIp=H zIhIAQuUsZU+xq790w|f@I0r@Py#Puj4AaK34J@p4n+e0-hPV?w2!Fp zNPIr1NZhL++~ykzNqnQ~pwJ54=ne%TqZ#0aijZK+%kZW5Sy;krei}TIzwN4VVZ0 zw=Z?cbtl~SFzTB`0L<5QgC0kb`(W|~L0|9}*4Y%6`vGI6JG0?i*uUllm?kfdF zjlEHR`CxPKYqC{7@U0p=4g_#>53pw=&BPM=@-`7hiWHQzd=CyB8h@ zN*j2S-8z-SnM|>oQV;ygUm%m z6N1c;6ux{0KsEFC`PwajUSfho06LH#4av2NA?X2igk)gG)q8-|LGu>}XSW0Z8ba1r zz!GC`|9+V^Am?P}AU;idEun4*225E^{0P3@gg9@igzr;AbNq}h*9gct+01Auh)1)Fn zXsP3kUv{xXPz)$|2OH zisp=70`)V6QwS3@xsVJ9lKqM-^t2P8hqYmB4a+UxK)t;DlTlI!DTCM(s4=KUIav&C zJldf}x3%a$m8vH*V`U{yp2WdYnbUxG4azv|)g0fzM!F&WfF-KV+etS z4%-??_aq2efhyj_L0rHn_AbQan~?e!ugOw`)_~9g+e5Xd zzf>|LPh`ahq>B{g(Ea(e8lSGio`^=f&QI2QE3U191aaIk>{XV7L8`+Vu!2jXB%bIU zBgaCCA;OZC69<+zQw`1Df`0=>x_92DiW8fL;>YryhF&#>0eCy?>=Edx(gXwSUb|IW z%J`(#av29FPAEH*5hnt-N>b|(r5m9iRt1%U9)?=Dj&?dn0sN-)KbGd6TYPA5CQ5>g{bJ%*7dk5lmR`x7_MExOKO_=GRzaG_BZ`(4ibA+Q7 zO_V1yU&*9JkPZK3(Q6ky1E(*j>e@#*bc%g*#*S3}yz=r1Fq0g$U-#af-U4(yPB7f_ z9C$y*Z;0cW_x!le62((E=mk~n#49D@pZwSNlfgg{qhla9Z)R$UI_*JnMOks^ie3bc zd>F(Tu~bZsq>sQgyrFu!8FZ3G15R>Ss_AL6zKqL+)Gk9d)KU>`QC?VH@YBD~wxs!S zNasO~M1=!vMJh6armEM>R`(x4Ml@z3%P1T<7IN8#DHiTAfBtu6Z;xxER7cgB6uazR zB-7H?$)JVd{j^WAy=M@~Jk3!+Vk-2IZQaaJ>j9PdRD;^`h-Jp&)k(&iaWWE&8FO_F zmOqP^pVtNsN#<61+2kJDE5P5Pximy|D{y;2v@=0MPi~h&cXa^zfbsZhT3boxlz!~i zqRsbD%h5WLfs6&dJX?L+HJ=$Kn}SHD542&pw=+E+v%9X#2WDbyXKAk204|_JGv^u=Z(CXQ|aRisE@4PffWVSm73p z*sSSBKI(Or3Ke$rR2)xMajRk9Bq=2~{xpn{y_FdN-N1zTc5=3dK05AZ&;F3Mp_h!^ zd1H3V7U9ekk!1#t5gO^tfLvMWVZI*PdO2-Q>m6wl6HLCS{v{}WDV;!(mR6yw?*xiw zY-|E$R`PyCJYvRr7qJF#9#IIo{I>GIX$BIaJi&=KmgQ=cNP9BW`VMne%6R*b4pOw#p(&Lmt_+-7HLd$NgzRkNfiJ@QW?giw<+$M| zw{^81^$mRI zDYRG|{Y`>_wD2k1FRq(9tVI5ejocAYr&WJzZzQ}d1q!No`@(6YXFd;0^f_uT-a7}g zI;A}WqcpY%PiK@QKGk%34KG-3q`sC`PZzTu9bGr-a$38!ZL6v$02H&4YV{%BqPbd$ zW2=K5#L&fz{_T2%$jvIG7Z#ZuJ5wZ8^6t+c1t$!7qIDF=@W-ID5gnTVAMD`mO}K_l?;c>NkrPz>x?5FXZS5ep`T*Tk%cr`BY)Y4U zxHB5$I1vZ(3t=$G)I>e!GKHpcYv6bjQFpNSj6-j?HYiE>^{%>^cgmce&8nLi^y5x= zHSCi=$$j^r8VY)ATdCwM9b^@2Aj(OJk6VKxuol?{5^2@O1U(W;_>Dx!Y$}eLaS|z& zC%A(*;yaw57v<%nmg6DMM44lxr$Y%*+en_95C4@j!+umQ{vB9Z|M?<&7oE*Hw|ho= ze(xKK=FkOPcf3RF4|(sRLPb+|KPmLx6ZrE=S2O31@>D7b+Z-XgK54+TDZvn-NKHa+{^ z7>gC@r*~pkmuiC`3Z5SE-koNUbVwfB9M0U}Q)CJv@68b4KZO0zX=BmpEe>Mny0N}^ zyf9ul^~nX~6H3bAKP^Q6arsjaH@EN-qbDIxf)jbdU`9~k-0stu%Qv5WL7$i<^OOJf zEB}R9`+qP*|Ic5;?+b^8m;Dzdh%y$1)<#jOhJDTjr#B&}eR8Ft>nH}_81{DIs|oIn zB);sF=WAehL&;>)y78dJhy!woF|nYF(e4j?Kunow0KB1W z^9L-1As`Dxa0INTp>cKk$e-y-HK>BREa2*_??V^WW$zjFHIV5__~4vJ8?BHN`fx{K zdiSmW;&AEnxWj#cOOwhxFqf4DRD&KMD?!e-4bCp9scXHlu}~>I=n<{bPqR!Zm9orX zvRE6T@>(O8nb9Bs8{7|I=** zNL|ho5bZaE<@JWqZ{*d@G~z)jkDJ_QR@W8*7)m#uR^?+cEI2DJ{$$i#`*>;#ACy90)L`Kg5eJEiN z>f#NJc%uM4hz;s_d}<_s4R^aR8A_-DCd3H{NM5HT#LWsNCDMQ4YV5-W0tZghZ*pUO z0WBgLm=%1vs6RUZ5v3I{dcc@74?5%@K0!@le1FJY$W#*SwfhGjh0h(F{2MXog?UMW z*P@Af0L_d7$Y1LR&f&k~*a1v0LcFtK2kN<$Vd%kwbVbuBC{UVm1(C=M`_*;LHxQ*} zKk^}pZ-5vvH{y7NiM9*`SL9SW4qAB`pgtzRp|^T=YjEg%}Hf z8$RgXbUF{FADMy-E&;u7Mr?$MIS4weNsLdYw5%D?GPp;;Je^^;g2E6kAmX)xMnL99 z%g0b{XnvRB*6Y0=Y?N%s8%&BtPt~4+=t$nc6BK}WnYODKtL zK(un|gKc&fZ&xwmzTz$0XamvOn%*RWIr2!fCCqONR}ma>7p$(_BFrGZFMaURl<>6h z6%rDql-Pt>@Tbx`4sy1LNN|`|vp?Y~l&!Sqh70(Cox5ByqM3(3Rckkxw*h8%kjToZ zbS3R)dW=Fw@^2)h#i@=tZ{3O4*a7qtEI!d8xjD2&^T8Udk;x@=N$IgX*_(20a9fY5 zIk1rar}IpyD0n>WiPV~!PlYZ;n77>U)RNeAAbRoJ9lBTpNLlhEl!6uPhSmmD3PJ-x zB|M!qakY7-_|m0&^r}H5(C?s+5uDfNV_CAxHf97*bBn{ttncw}i9oWrYlrT6J|4Ql z@Ieu*9ysoU0AVh3cv%vto|2kU7~1VK;+y+xI6TQHL_0bREmx7-v76J4(TVL-M?m3X zn!yv_*nDUdL5Y);yVXGf2tL`aRGC!PM~|{DdiGhD!iE{w=PNT5|W01Xq5pL zx~7Zz#p?PxCX#-TTh}$SdGU;N&2x}~Xv45|ua$@1v)H2t74z$oAQ1EOpUA3Xr`4HE zyO_`AvB&NA&-JB<0cx*IV?2Z8GxVVl()1M+7;3CpA zBW+2THf$xGG7Hf%kWoEXe*w%CSr%bK^Cs#$--?n3nGK5wegOB^!o+K8u#hvsK^jXQ zSkJUH9u3_BTui%lOk1It#VZkP{5U?wZ!XbV$C0#Uofh(MD0XY?_fB$lHc*UQ?=u6LEyeLZ)xdw-+ zi^b`JvsE4|qCYPF$THoO1W^e!kSj)JT%Y!H#?eei`C4OpwmI5T*csHJbp?t<=x*cj z>H9!KI{wf^3RnPr#u$2ayRzpuMbefhJkN+ug!w<2+EPwTZbKG|gm4Jv5tF0_iXR}@ zoSXfgg@^46Q+(P^A`x>@HaAr9RfSX#4V1_ebegyW_v{u1XhLz>0rE=`^|Zk|hpN?f z|JBu%v{r)^ok*B#<9mAs>g9yRfM)1ZkVHVodI0 z=93Z0v&@+3hBxhsO2hm{y4dpmqfBArxQI#xz1tDMRy`Ti>%e47?3L_yi%K zheG-PPN^WlFc@x^a!?gNxLWdb?*Og}Km5kU`$x5A$qgwMqDtLmnp9Z>GyDbQr?4-XSrZihOIbPXnuZgH0T6iYr2-s1=kcXTG#Yv+Mawc*5=dhyyGH&R2qjV| z>#^>MLM?mcP{9W7?h?*72ryJD4LPc{2)IFJ>*jn5dec;vp9fPYOap&-fvgvP5*+C> zXu>O`VeZ#AzYj00BG~NiZ%!N2pdVcV*6nl&3HjrV;lPuG6%G9r2RQS-1ahBW`lJ&D%(2riO;eU?gR%${K1A2U4hr-269-xeqFtWUE1J1GaGz zL$6Orb*${+W{Hmve+SzVIm>i&!#;iK>3KCyM3p!u5SCl%-Z?F%Aiqe3h92F2v6?t# z5&c=Ijp|Ws9da@;gw=bZDfKL~2g@@8QG`GtR;sDxYlAX1`-x>5^EAk9=JH!dR)Znf z5BInHi2Nnh#d3HLD@wt6#{OS&Z&B(i1~g3g|1M$spQAzL{|D(|+NdWisT>bNEhcX@ Q81Sc}pdnu`YZ>{!0X Date: Tue, 17 Oct 2023 08:14:39 -0700 Subject: [PATCH 022/237] edits --- windows/client-management/copilot-overview.md | 30 +++++++++++-------- 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 62dbaa8c80..a6faa910aa 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -20,7 +20,7 @@ At a high level, configuring Copilot in Windows for your organization involves t 1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled 1. Verify [other settings that might impact Copilot in Windows](#other-settings-that-might-impact-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider -Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot when it's available to them. +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot in Windows and the icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot in Windows when it's available to them. |   | Setting | |---|---| @@ -34,22 +34,27 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat **Bing Chat**: -[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and doesn't offer commercial data protection. Users in your organization get consumer Bing Chat without extra commercial protections. The following privacy and security protections apply for Bing Chat: +[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. **Bing Chat Enterprise**: -[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios. The following privacy and security protections apply for Bing Chat Enterprise: +[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: - With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). -- Bing chat enterprise is available, at no additional cost, for customers who are licensed for Microsoft 365 E3 or E5, A3 or A5 for faculty, Business Standard, or Business Premium. +- Bing chat enterprise is available, at no additional cost, for the following licenses: + - Microsoft 365 E3 or E5 + - Microsoft 365 A3 or A5 for faculty + - Business Standard + - Business Premium + > [!Note] > Bing Chat Enterprise doesn't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise can't access Microsoft 365 Apps data, such as email, calendar, or files. ## Configure the chat provider platform that Copilot in Windows uses -Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. +Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. ### Bing Chat as the chat provider platform @@ -68,6 +73,7 @@ Bing Chat Enterprise (recommended for commercial environments), is used as the c 1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty + - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). - Business Standard - Business Premium 1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. @@ -91,7 +97,7 @@ Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails https://learn.microsoft.com/graph/api/resources/licensedetails ``` -When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There is also a shield emblem labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: +When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield emblem labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: :::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: @@ -120,23 +126,23 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - This selection places devices into an early CFR phase - Users can select which optional updates to receive -1. Managed Windows 11, version 22H2 devices will display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. +1. Managed Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. ### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update (coming soon) One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings impact Copilot in Windows. For more information, see: +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) -- [Other settings that might impact Copilot in Windows and its underlying chat provider](#other-settings-that-might-impact-copilot-in-windows-and-its-underlying-chat-provider) +- [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: - **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) - **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** -## Other settings that might impact Copilot in Windows and its underlying chat provider +## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some setting which affect Bing Chat, Bing Chat Enterprise, and the Microsoft Edge sidebar can also affect Copilot in Windows. +Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and the Microsoft Edge sidebar can also affect Copilot in Windows. -The following settings might impact Copilot in Windows and its underlying chat provider: \ No newline at end of file +The following settings might affect Copilot in Windows and its underlying chat provider: \ No newline at end of file From 016afbfd5359870fb03345b56b3195b9e27cceb4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 08:50:46 -0700 Subject: [PATCH 023/237] edits --- windows/client-management/copilot-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index a6faa910aa..5460203adf 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -8,7 +8,7 @@ appliesto: --- # What is Copilot in Windows? - + >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. @@ -18,7 +18,7 @@ At a high level, configuring Copilot in Windows for your organization involves t 1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) 1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows 1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled -1. Verify [other settings that might impact Copilot in Windows](#other-settings-that-might-impact-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider +1. Verify [other settings that might affect Copilot in Windows](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot in Windows and the icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot in Windows when it's available to them. From 8cabf154e1f7c1996ae87918a26a809b50c3c683 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 09:09:59 -0700 Subject: [PATCH 024/237] edits --- windows/client-management/copilot-overview.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 5460203adf..91b9e6b36a 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -145,4 +145,5 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and the Microsoft Edge sidebar can also affect Copilot in Windows. -The following settings might affect Copilot in Windows and its underlying chat provider: \ No newline at end of file +The following settings might affect Copilot in Windows and its underlying chat provider: + From 5a772de6a939cb0e2ff9a66cfd268d5b2e212fbe Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 10:56:46 -0700 Subject: [PATCH 025/237] edits --- windows/client-management/copilot-overview.md | 29 ++++++++++++++++--- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 91b9e6b36a..742a6e2f87 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -11,7 +11,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. At a high level, configuring Copilot in Windows for your organization involves the following steps: @@ -34,10 +34,11 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat **Bing Chat**: -[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: +[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. + **Bing Chat Enterprise**: [Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: @@ -143,7 +144,27 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and the Microsoft Edge sidebar can also affect Copilot in Windows. +Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: -The following settings might affect Copilot in Windows and its underlying chat provider: +**Bing SafeSearch settings**: +If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it will block chat providers for Copilot in Windows. The following network changes will block the chat providers for Copilot in Windows, [Bing Chat Enterprise in the Edge sidebar](/bing-chat-enterprise/edge), and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat): +- mapping `www.bing.com` to `strict.bing.com` +- mapping `edgeservices.bing.com` to `strict.bing.com` +- mapping `www.bing.com` to `nochat.bing.com` +- blocking `bing.com` + +**Microsoft Edge policies**: + +- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it will block Bing Chat in the Microsoft Edge sidebar and Bing Chat Enterprise in the Microsoft Edge sidebar from being displayed. +- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it will block Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need to read the current webpage context to provide page summarizations and for sending a string the user selects from the webpage into the chat provider. + +**Search settings**: + +- Setting [ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) to `Hide` might interfere with the Copilot in Windows user experience. +- Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows, Bing Chat in the Microsoft Edge sidebar, and Bing Chat Enterprise in the Microsoft Edge sidebar user experiences. + +**Account settings** + +- [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) +-[RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) \ No newline at end of file From 6fbe174913a5d5eb9fd122ac54cac7d3abcc7143 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:23:08 -0700 Subject: [PATCH 026/237] edits --- windows/client-management/copilot-overview.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index 742a6e2f87..c488a12cbc 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -1,5 +1,5 @@ --- -title: Copilot in Windows Overview +title: Manage Copilot in Windows description: Learn about managing Copilot in Windows for commercial environments. ms.topic: overview ms.date: 10/26/2023 @@ -11,7 +11,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. At a high level, configuring Copilot in Windows for your organization involves the following steps: @@ -137,14 +137,14 @@ While the user experience for Copilot in Windows is enabled by default, you stil - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) - [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) -Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using either of the following permanent controls: +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using the following policy: - **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) - **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** ## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: +Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings may affect Copilot in Windows and its underlying chat provider: **Bing SafeSearch settings**: @@ -166,5 +166,6 @@ If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8 **Account settings** -- [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) --[RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) \ No newline at end of file +- The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Bing Chat in the Microsoft Edge sidebar. +- The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. + From e89a1a265ee269f4e1b46d240772d4082abb4ab2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:33:18 -0700 Subject: [PATCH 027/237] edits --- windows/client-management/copilot-overview.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index c488a12cbc..b83ceaae40 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -11,7 +11,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. At a high level, configuring Copilot in Windows for your organization involves the following steps: @@ -144,11 +144,11 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings may affect Copilot in Windows and its underlying chat provider: +Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: **Bing SafeSearch settings**: -If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it will block chat providers for Copilot in Windows. The following network changes will block the chat providers for Copilot in Windows, [Bing Chat Enterprise in the Edge sidebar](/bing-chat-enterprise/edge), and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat): +If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows, [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge), and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat): - mapping `www.bing.com` to `strict.bing.com` - mapping `edgeservices.bing.com` to `strict.bing.com` - mapping `www.bing.com` to `nochat.bing.com` @@ -156,8 +156,8 @@ If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8 **Microsoft Edge policies**: -- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it will block Bing Chat in the Microsoft Edge sidebar and Bing Chat Enterprise in the Microsoft Edge sidebar from being displayed. -- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it will block Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need to read the current webpage context to provide page summarizations and for sending a string the user selects from the webpage into the chat provider. +- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Bing Chat in the Microsoft Edge sidebar and Bing Chat Enterprise in the Microsoft Edge sidebar from being displayed. +- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. **Search settings**: From ea36036d32bc79750935c3124aa37e3b309c9dd1 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:35:33 -0700 Subject: [PATCH 028/237] edits --- windows/client-management/copilot-overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md index b83ceaae40..963e9bb45d 100644 --- a/windows/client-management/copilot-overview.md +++ b/windows/client-management/copilot-overview.md @@ -13,7 +13,9 @@ appliesto: Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. -At a high level, configuring Copilot in Windows for your organization involves the following steps: +## Manage Copilot in Windows for commercial environments + +At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: 1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) 1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows From 435e75d1f16b1569fab9145acaf30b006629f6f1 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:39:25 -0700 Subject: [PATCH 029/237] move content to manage copilot page --- .../manage-windows-copilot.md | 170 ++++++++++++++++-- 1 file changed, 156 insertions(+), 14 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index bc4adbca9d..9b30f58ce9 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -1,31 +1,173 @@ --- title: Manage Copilot in Windows -description: Learn how to manage Copilot in Windows using MDM and group policy. +description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: article -ms.date: 10/16/2023 +ms.date: 10/18/2023 appliesto: -- ✅ Windows 11 +- ✅ Windows 11, version 22H2 or later --- -# Manage Copilot in Windows +# What is Copilot in Windows? + +>**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Windows is the first PC platform to provide centralized AI assistance for customers. Together, with Bing Chat, Copilot in Windows helps you bring your ideas to life, complete complex projects and collaborate instead of spending energy finding, launching and working across multiple applications. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. -This article lists settings available to manage Copilot in Windows. To learn more about Copilot in Windows, see [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). +## Manage Copilot in Windows for commercial environments -## Turn off Copilot in Windows +At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: -This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot. The Copilot icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot when it's available to them. +1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) +1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows +1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled +1. Verify [other settings that might affect Copilot in Windows](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider -| | Setting | -|------------------|---------------------------------------------------------------------------------------------------------| -| **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot in Windows and the icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot in Windows when it's available to them. + +|   | Setting | +|---|---| +| **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | | **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | +## Chat provider platforms for Copilot in Windows -## Related articles +Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. -- [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0) +**Bing Chat**: + +[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: + - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) + - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. + + +**Bing Chat Enterprise**: + +[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: + +- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). +- Bing chat enterprise is available, at no additional cost, for the following licenses: + - Microsoft 365 E3 or E5 + - Microsoft 365 A3 or A5 for faculty + - Business Standard + - Business Premium + + > [!Note] + > Bing Chat Enterprise doesn't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise can't access Microsoft 365 Apps data, such as email, calendar, or files. + +## Configure the chat provider platform that Copilot in Windows uses + +Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. + +### Bing Chat as the chat provider platform + +Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: + +- Bing Chat Enterprise isn't configured for the user +- The user isn't assigned a license that includes Bing Chat Enterprise +- Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) +- The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise + +### Bing Chat Enterprise as the chat provider platform + +Bing Chat Enterprise (recommended for commercial environments), is used as the chat provider platform for Copilot in Windows when all of the following conditions occur: + +1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). +1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: + - Microsoft 365 E3 or E5 + - Microsoft 365 A3 or A5 for faculty + - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). + - Business Standard + - Business Premium +1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. +1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. +1. Verify that **Bing Chat Enterprise** is enabled for the user. + + > [!Note] + > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. + +```http +*would be nice to have a Graph query that lists users that do/do not have BCE app enabled* +*licensedetails does output BCE, so its a matter of just getting the query right* +**powershell or http preferably** +Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails +{ + "servicePlanId": "0d0c0d31-fae7-41f2-b909-eaf4d7f26dba", + "servicePlanName": "Bing_Chat_Enterprise", + "provisioningStatus": "Success", + "appliesTo": "User" +}, +https://learn.microsoft.com/graph/api/resources/licensedetails +``` + +When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield emblem labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: + +:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: + +## Ensure the Copilot in Windows user experience is enabled + +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. +### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients + +Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + +To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: + +1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. +1. Apply a policy to disable temporary enterprise control. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: + - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** + + - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) + - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. +1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: + - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** + - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) + - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. + + These policies of optional updates apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: + - Automatically receive optional updates (including CFRs) + - This selection places devices into an early CFR phase + - Users can select which optional updates to receive + +1. Managed Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. + +### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update (coming soon) + +One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. + +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: +- [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) +- [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) + +Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using the following policy: + +- **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) +- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** + +## Other settings that might affect Copilot in Windows and its underlying chat provider + +Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: + +**Bing SafeSearch settings**: + +If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows, [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge), and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat): +- mapping `www.bing.com` to `strict.bing.com` +- mapping `edgeservices.bing.com` to `strict.bing.com` +- mapping `www.bing.com` to `nochat.bing.com` +- blocking `bing.com` + +**Microsoft Edge policies**: + +- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Bing Chat in the Microsoft Edge sidebar and Bing Chat Enterprise in the Microsoft Edge sidebar from being displayed. +- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. + +**Search settings**: + +- Setting [ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) to `Hide` might interfere with the Copilot in Windows user experience. +- Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows, Bing Chat in the Microsoft Edge sidebar, and Bing Chat Enterprise in the Microsoft Edge sidebar user experiences. + +**Account settings** + +- The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Bing Chat in the Microsoft Edge sidebar. +- The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. -- [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/copilot-in-windows-your-data-and-privacy-3e265e82-fc76-4d0a-afc0-4a0de528b73a) From 13427d3c5f64df40810b40479699fedd41e9ed2b Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 11:40:31 -0700 Subject: [PATCH 030/237] delete unneeded md file --- windows/client-management/copilot-overview.md | 173 ------------------ 1 file changed, 173 deletions(-) delete mode 100644 windows/client-management/copilot-overview.md diff --git a/windows/client-management/copilot-overview.md b/windows/client-management/copilot-overview.md deleted file mode 100644 index 963e9bb45d..0000000000 --- a/windows/client-management/copilot-overview.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: Manage Copilot in Windows -description: Learn about managing Copilot in Windows for commercial environments. -ms.topic: overview -ms.date: 10/26/2023 -appliesto: -- ✅ Windows 11, version 22H2 or later ---- - -# What is Copilot in Windows? - ->**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). - -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. - -## Manage Copilot in Windows for commercial environments - -At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: - -1. Understand the [available chat provider platforms for Copilot in Windows](#chat-provider-platforms-for-copilot-in-windows) -1. [Configure the chat provider platform](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) used by Copilot in Windows -1. Ensure the [Copilot in Windows user experience](#ensure-the-copilot-in-windows-user-experience-is-enabled) is enabled -1. Verify [other settings that might affect Copilot in Windows](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) and its underlying chat provider - -Organizations that aren't ready to use Copilot in Windows can disable it until they're ready with the **Turn off Windows Copilot** policy. This policy setting allows you to turn off Copilot in Windows. If you enable this policy setting, users can't use Copilot in Windows and the icon doesn't appear on the taskbar either. If you disable or don't configure this policy setting, users can use Copilot in Windows when it's available to them. - -|   | Setting | -|---|---| -| **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | -| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | - - -## Chat provider platforms for Copilot in Windows - -Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. - -**Bing Chat**: - -[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: - - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. - - -**Bing Chat Enterprise**: - -[Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: - -- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). -- Bing chat enterprise is available, at no additional cost, for the following licenses: - - Microsoft 365 E3 or E5 - - Microsoft 365 A3 or A5 for faculty - - Business Standard - - Business Premium - - > [!Note] - > Bing Chat Enterprise doesn't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise can't access Microsoft 365 Apps data, such as email, calendar, or files. - -## Configure the chat provider platform that Copilot in Windows uses - -Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. - -### Bing Chat as the chat provider platform - -Bing Chat is used as the default chat provider platform for Copilot in Windows when any of the following conditions occur: - -- Bing Chat Enterprise isn't configured for the user -- The user isn't assigned a license that includes Bing Chat Enterprise -- Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) -- The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise - -### Bing Chat Enterprise as the chat provider platform - -Bing Chat Enterprise (recommended for commercial environments), is used as the chat provider platform for Copilot in Windows when all of the following conditions occur: - -1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). -1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: - - Microsoft 365 E3 or E5 - - Microsoft 365 A3 or A5 for faculty - - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). - - Business Standard - - Business Premium -1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. -1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. -1. Verify that **Bing Chat Enterprise** is enabled for the user. - - > [!Note] - > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. - -```http -*would be nice to have a Graph query that lists users that do/do not have BCE app enabled* -*licensedetails does output BCE, so its a matter of just getting the query right* -**powershell or http preferably** -Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails -{ - "servicePlanId": "0d0c0d31-fae7-41f2-b909-eaf4d7f26dba", - "servicePlanName": "Bing_Chat_Enterprise", - "provisioningStatus": "Success", - "appliesTo": "User" -}, -https://learn.microsoft.com/graph/api/resources/licensedetails -``` - -When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield emblem labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: - -:::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: - -## Ensure the Copilot in Windows user experience is enabled - -Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. -### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients - -Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. - -To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: - -1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. -1. Apply a policy to disable temporary enterprise control. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** - - - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. -1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: - - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - - These policies of optional updates apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: - - Automatically receive optional updates (including CFRs) - - This selection places devices into an early CFR phase - - Users can select which optional updates to receive - -1. Managed Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. - -### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update (coming soon) - -One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. - -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: -- [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) -- [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) - -Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using the following policy: - -- **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) -- **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** - -## Other settings that might affect Copilot in Windows and its underlying chat provider - -Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: - -**Bing SafeSearch settings**: - -If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows, [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge), and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat): -- mapping `www.bing.com` to `strict.bing.com` -- mapping `edgeservices.bing.com` to `strict.bing.com` -- mapping `www.bing.com` to `nochat.bing.com` -- blocking `bing.com` - -**Microsoft Edge policies**: - -- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Bing Chat in the Microsoft Edge sidebar and Bing Chat Enterprise in the Microsoft Edge sidebar from being displayed. -- If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. - -**Search settings**: - -- Setting [ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) to `Hide` might interfere with the Copilot in Windows user experience. -- Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows, Bing Chat in the Microsoft Edge sidebar, and Bing Chat Enterprise in the Microsoft Edge sidebar user experiences. - -**Account settings** - -- The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Bing Chat in the Microsoft Edge sidebar. -- The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. - From 66fc11dfd9060dfe038ec02761d5ae3f2acc51de Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 12:06:35 -0700 Subject: [PATCH 031/237] tweaks --- .../manage-windows-copilot.md | 24 +++++++++++-------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 9b30f58ce9..e089d23ff7 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -46,18 +46,18 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat [Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: - With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). -- Bing chat enterprise is available, at no additional cost, for the following licenses: +- Bing Chat Enterprise is available, at no additional cost, for the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - Business Standard - Business Premium > [!Note] - > Bing Chat Enterprise doesn't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise can't access Microsoft 365 Apps data, such as email, calendar, or files. + > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. ## Configure the chat provider platform that Copilot in Windows uses -Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. +Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. ### Bing Chat as the chat provider platform @@ -68,9 +68,9 @@ Bing Chat is used as the default chat provider platform for Copilot in Windows w - Bing Chat Enterprise is [turned off](/bing-chat-enterprise/manage) - The user isn't signed in with a Microsoft Entra account that's licensed for Bing Chat Enterprise -### Bing Chat Enterprise as the chat provider platform +### Bing Chat Enterprise as the chat provider platform (recommended for commercial environments) -Bing Chat Enterprise (recommended for commercial environments), is used as the chat provider platform for Copilot in Windows when all of the following conditions occur: +To verify that Bing Chat Enterprise is enabled for the user as the chat provider platform for Copilot in Windows, use the following instructions: 1. Sign into the [Microsoft 365 admin center](https://admin.microsoft.com/). 1. In the admin center, select **Users** > **Active users** and verify that users are assigned a license that includes Bing Chat Enterprise. Bing Chat Enterprise is included and enabled by default for users that are assigned one of the following licenses: @@ -100,13 +100,14 @@ Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails https://learn.microsoft.com/graph/api/resources/licensedetails ``` -When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield emblem labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: +When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: :::image type="content" source="images/bing-chat-enterprise-chat-provider.png" alt-text="Screenshot of the Copilot in Windows user experience when Bing Chat Enterprise is the chat provider." lightbox="images/bing-chat-enterprise-chat-provider.png"::: ## Ensure the Copilot in Windows user experience is enabled -Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. + ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. @@ -114,22 +115,25 @@ Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: 1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. -1. Apply a policy to disable temporary enterprise control. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: +1. Apply a policy to disable temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. + > [!Important] + > For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + 1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowOptionalUpdates](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalupdates) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow optional updates** under the **Windows Update for Business** category. - These policies of optional updates apply to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: + The optional updates policy applies to Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later. When setting policy for [optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates), ensure you select one of the following options that includes CFRs: - Automatically receive optional updates (including CFRs) - This selection places devices into an early CFR phase - Users can select which optional updates to receive -1. Managed Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. +1. Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. ### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update (coming soon) From 703b20c37fd55d2357a06f2a44f2e20c8ce79ccb Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 14:58:39 -0700 Subject: [PATCH 032/237] tweaks --- windows/client-management/manage-windows-copilot.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index e089d23ff7..344b751a17 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -135,9 +135,9 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n 1. Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. -### Enable the Copilot in Windows user experience for Windows 11 clients with the 2023 annual update (coming soon) +### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients (coming soon) -One a managed device installs the upcoming 2023 annual update, likely to be called version 23H2, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. +One a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) From a61806ae3b98e3cef4a0976a17b7a575975e99dc Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 15:39:25 -0700 Subject: [PATCH 033/237] tweaks --- windows/client-management/manage-windows-copilot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 344b751a17..0f9fabc6e9 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -106,7 +106,7 @@ When Bing Chat Enterprise is the chat provider platform, the user experience cle ## Ensure the Copilot in Windows user experience is enabled -Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. The Copilot in Windows user experience is enabled by default for managed Windows 11, version 22H2 devices. +Once you've configured the chat provider platform that Copilot in Windows uses, you need to ensure that the Copilot in Windows user experience is enabled. Ensuring the Copilot in Windows user experience is enabled varies by the Windows version. ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients From bdc0bb7b57830ded1b3c0285e4b3db9a03bf9a3a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 17 Oct 2023 15:40:36 -0700 Subject: [PATCH 034/237] tweaks --- windows/client-management/manage-windows-copilot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 0f9fabc6e9..be8fbd06e0 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -110,7 +110,7 @@ Once you've configured the chat provider platform that Copilot in Windows uses, ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients -Copilot in Windows isn't enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. +Copilot in Windows isn't technically enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: From 2666c53991b5e2cdf576ea475f5670766b26b262 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 18 Oct 2023 08:32:33 -0700 Subject: [PATCH 035/237] tweaks --- .../manage-windows-copilot.md | 31 ++++++++++++------- 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index be8fbd06e0..c449d9582c 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -86,18 +86,25 @@ To verify that Bing Chat Enterprise is enabled for the user as the chat provider > [!Note] > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. -```http -*would be nice to have a Graph query that lists users that do/do not have BCE app enabled* -*licensedetails does output BCE, so its a matter of just getting the query right* -**powershell or http preferably** -Ex output from my lab: GET https://graph.microsoft.com/v1.0/me/licenseDetails -{ - "servicePlanId": "0d0c0d31-fae7-41f2-b909-eaf4d7f26dba", - "servicePlanName": "Bing_Chat_Enterprise", - "provisioningStatus": "Success", - "appliesTo": "User" -}, -https://learn.microsoft.com/graph/api/resources/licensedetails +The following PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: + +```powershell +# Install graph module +if (-not (Get-Module Microsoft.Graph.Users)) { + Install-Module Microsoft.Graph.Users +} + +# Connect to MS graph +Connect-MgGraph -Scopes 'User.Read.All' + +# Get all users +$users = Get-MgUser -All -ConsistencyLevel eventual -Property Id, DisplayName, Mail, UserPrincipalName, AssignedPlans + +# Users with BCE enabled +$users | Where-Object { $_.AssignedPlans -and $_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -eq "Enabled" } | Format-Table + +# Users without BCE enabled +$users | Where-Object { -not $_.AssignedPlans -or ($_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -ne "Enabled") } | Format-Table ``` When Bing Chat Enterprise is the chat provider platform, the user experience clearly states that **Your personal and company data are protected in this chat**. There's also a shield symbol labeled **Protected** at the top of the Copilot in Windows sidebar and the provider is listed under the Copilot logo when the sidebar is first opened. The following image shows the message that's displayed when Bing Chat Enterprise is the chat provider platform for Copilot in Windows: From dfa48ff0ccdaa034e012ae6193904c517b8979bc Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 18 Oct 2023 08:38:55 -0700 Subject: [PATCH 036/237] tweaks --- windows/client-management/manage-windows-copilot.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index c449d9582c..8346d968d7 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -89,21 +89,21 @@ To verify that Bing Chat Enterprise is enabled for the user as the chat provider The following PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: ```powershell -# Install graph module +# Install Microsoft Graph module if (-not (Get-Module Microsoft.Graph.Users)) { Install-Module Microsoft.Graph.Users } -# Connect to MS graph +# Connect to Microsoft Graph Connect-MgGraph -Scopes 'User.Read.All' # Get all users $users = Get-MgUser -All -ConsistencyLevel eventual -Property Id, DisplayName, Mail, UserPrincipalName, AssignedPlans -# Users with BCE enabled +# Users with Bing Chat Enterprise enabled $users | Where-Object { $_.AssignedPlans -and $_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -eq "Enabled" } | Format-Table -# Users without BCE enabled +# Users without Bing Chat Enterprise enabled $users | Where-Object { -not $_.AssignedPlans -or ($_.AssignedPlans.Service -eq "Bing" -and $_.AssignedPlans.CapabilityStatus -ne "Enabled") } | Format-Table ``` From 2c3987cb971ed8bc48503e07d2dfe5d56e4da80e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 18 Oct 2023 09:19:19 -0700 Subject: [PATCH 037/237] tweaks --- windows/client-management/manage-windows-copilot.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 8346d968d7..af2457bb3f 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -82,6 +82,7 @@ To verify that Bing Chat Enterprise is enabled for the user as the chat provider 1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. +1. If you prefer to view a user's licenses from the Azure portal, you will find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes Bing Chat Enterprise, and verify that it's listed as **On**. > [!Note] > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. From 56a8b0eb2feacef2fd43d7c7004f6c33abfe618a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 18 Oct 2023 09:19:55 -0700 Subject: [PATCH 038/237] tweaks --- windows/client-management/manage-windows-copilot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index af2457bb3f..e2abb0472f 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -82,7 +82,7 @@ To verify that Bing Chat Enterprise is enabled for the user as the chat provider 1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. -1. If you prefer to view a user's licenses from the Azure portal, you will find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes Bing Chat Enterprise, and verify that it's listed as **On**. +1. If you prefer to view a user's licenses from the [Azure portal](https://portal.azure.com), you will find it under **Microsoft Entra ID** > **Users**. Select the user's name, then **Licenses**. Select a license that includes Bing Chat Enterprise, and verify that it's listed as **On**. > [!Note] > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. From 9f0e3f075da413992f297a88b44fcc28d3ae0eed Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Fri, 20 Oct 2023 18:41:17 -0700 Subject: [PATCH 039/237] Edits and clarification based on customer feedback Partial commit, still need to upload updated images, indicated using comments in this commit. --- .../deployment/do/mcc-enterprise-deploy.md | 34 +++++++++++++------ 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 10f5b9cddf..e72b4a9189 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -194,12 +194,14 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p >
>
[D] Do not run **[R] Run once** [S] Suspend [?] Help (default is "D"): -1. Choose whether you would like to create a new virtual switch or select an existing one. Name your switch and select the Net Adapter to use for the switch. A computer restart will be required if you're creating a new switch. +1. Choose whether you would like to create a new external virtual switch or select an existing external virtual switch. + If creating a new external virtual switch, name your switch and be sure to choose a Local Area Connection (USB adapters work as well however, we do not recommend using Wi-Fi). A computer restart will be required if you're creating a new switch. > [!NOTE] > Restarting your computer after creating a switch is recommended. You'll notice network delays during installation if the computer has not been restarted. - If you restarted your computer after creating a switch, start from Step 2 above and skip step 5. + If you restarted your computer after creating a switch, start from Step 2 above and skip to step 5. + If you opt to use an existing external switch, select the switch from the presented options. Local Area Connection (or USB) is preferable to Wi-Fi. :::image type="content" source="./images/ent-mcc-script-new-switch.png" alt-text="Screenshot of the installer script running in PowerShell when a new switch is created." lightbox="./images/ent-mcc-script-new-switch.png"::: @@ -207,25 +209,35 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p :::image type="content" source="./images/ent-mcc-script-existing-switch.png" alt-text="Screenshot of the installer script running in PowerShell when using an existing switch." lightbox="./images/ent-mcc-script-existing-switch.png"::: -1. Decide whether you would like to use dynamic or static address for the Eflow VM +1. Decide whether you would like to use dynamic or static address for the Eflow VM. If you choose to use a static IP, do not use the IP address of the server. It is a VM, and it will have its own IP. :::image type="content" source="./images/ent-mcc-script-dynamic-address.png" alt-text="Screenshot of the installer script running in PowerShell asking if you'd like to use a dynamic address." lightbox="./images/ent-mcc-script-dynamic-address.png"::: > [!NOTE] > Choosing a dynamic IP address might assign a different IP address when the MCC restarts. A static IP address is recommended so you don't have to change this value in your management solution when MCC restarts. -1. Choose where you would like to download, install, and store the virtual hard disk for EFLOW. You'll also be asked how much memory, storage, and how many cores you would like to allocate for the VM. For this example, we chose the default values for all prompts. + The IP address you assign to the EFLOW VM should be within the same subnet as the host server (based on the subnet mask) and not used by any other machine on the network. + For example, for host configuration where the server IP Address is 192.168.1.202 and the subnet mask is 255.255.255.0, the static IP can be anything 192.168.1.* except 192.168.1.202 + + If you would like to use your own DNS server instead of Google DNS 8.8.8.8, select **n** and set your own DNS server IP. + + If you use a dynamic IP address, the DHCP server will automatically configure the IP address and DNS settings. + +1. Choose where you would like to download, install, and store the virtual hard disk for EFLOW. You'll also be asked how much memory, storage, and how many cores you would like to allocate for the VM. For this example, we chose the default values for download path, install path, and virtual hard disk path. + + Please refer to the [Sizing Recommendations](/mcc-enterprise-prerequisites#sizing-recommendations) for memory, virtual storage, and CPU cores. For this example we chose the recommend values for a Branch Office/Small Enterprise deployment. + -1. Follow the Azure Device Login link and sign into the Azure portal. - - :::image type="content" source="./images/ent-mcc-script-device-code.png" alt-text="Screenshot of the installer script running in PowerShell displaying the code and URL to use for the Azure portal." lightbox="./images/ent-mcc-script-device-code.png"::: - -1. If this is your first MCC deployment, select **n** so that a new IoT Hub can be created. If you have already configured MCC before, choose **y** so that your MCCs are grouped in the same IoT Hub. +1. + + When the installation is complete, you should see the following output (the values below will be your own) :::image type="content" source="./images/ent-mcc-script-complete.png" alt-text="Screenshot of the installer script displaying the completion summary in PowerShell." lightbox="./images/ent-mcc-script-complete.png"::: + 1. Your MCC deployment is now complete. @@ -251,14 +263,14 @@ Connect to the EFLOW VM and check if MCC is properly running: :::image type="content" source="./images/ent-mcc-connect-eflowvm.png" alt-text="Screenshot of running connect-EflowVm, sudo -s, and iotedge list from PowerShell." lightbox="./images/ent-mcc-connect-eflowvm.png"::: -You should see MCC, edgeAgent, and edgeHub running. If you see edgeAgent or edgeHub but not MCC, try this command in a few minutes. The MCC container can take a few minutes to deploy. +You should see MCC, edgeAgent, and edgeHub running. If you see edgeAgent or edgeHub but not MCC, try this command in a few minutes. The MCC container can take a few minutes to deploy. If iotedge list times out, you can run docker ps -a to list the running containers. #### Verify server side For a validation of properly functioning MCC, execute the following command in the EFLOW VM or any device in the network. Replace with the IP address of the cache server. ```powershell -wget [http:///mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com] +wget http:///mscomtest/wuidt.gif?cacheHostOrigin=au.download.windowsupdate.com ``` A successful test result will display a status code of 200 along with additional information. From 50ba4a4a474142452f2f3dd657e5516b48ace48e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 24 Oct 2023 08:12:11 -0700 Subject: [PATCH 040/237] off-mdag-dep-8690636 --- windows/whats-new/deprecated-features.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 75c9ea7697..8c97fabc2e 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 10/18/2023 +ms.date: 10/31/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -36,6 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | +| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. | October 2023 | | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | From 5638e0b2f256b47ba2e4965f155dbe945c31614c Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 24 Oct 2023 10:11:05 -0700 Subject: [PATCH 041/237] off-mdag-dep-8690636 --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 8c97fabc2e..5b5f329903 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. | October 2023 | +| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/protect-against-threats) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | October 2023 | | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | From f51682aacf80bf3a5941fffe8b9e2e5026e3ba7d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 24 Oct 2023 10:44:32 -0700 Subject: [PATCH 042/237] edit --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 5b5f329903..487d603e5c 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | -| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/protect-against-threats) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | October 2023 | +| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/protect-against-threats#safe-attachments-policies-in-microsoft-defender-for-office-365) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | October 2023 | | Timeline for Microsoft Entra accounts | Cross-device syncing of Microsoft Entra user activity history will stop starting in January 2024. Microsoft will stop storing this data in the cloud, aligning with [the previous change for Microsoft accounts (MSA)](https://blogs.windows.com/windows-insider/2021/04/14/announcing-windows-10-insider-preview-build-21359) in 2021. The timeline user experience was retired in Windows 11, although it remains in Windows 10. The timeline user experience and all your local activity history still remains on Windows 10 devices. Users can access web history using their browser and access recent files through OneDrive and Office. | October 2023 | | VBScript | VBScript is being deprecated. In future releases of Windows, VBScript will be available as a feature on demand before its removal from the operating system. For more information, see [Resources for deprecated features](deprecated-features-resources.md#vbscript). | October 2023 | | WordPad | WordPad is no longer being updated and will be removed in a future release of Windows. We recommend Microsoft Word for rich text documents like .doc and .rtf and Windows Notepad for plain text documents like .txt. | September 1, 2023 | From a93d21064431978d882147b963a1acf31fe7f855 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 09:41:26 -0700 Subject: [PATCH 043/237] Copilot in Edge rebrand for sidebar --- windows/client-management/manage-windows-copilot.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index e2abb0472f..f0e8fa08b8 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -11,7 +11,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to be an assistant that can help your users get things done in Windows. Copilot in Windows is a bit different from [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge) (and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat)), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Bing Chat Enterprise in the Microsoft Edge sidebar, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows is a bit different from [Copilot in Edge](/bing-chat-enterprise/edge), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. ## Manage Copilot in Windows for commercial environments @@ -158,11 +158,11 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Other settings that might affect Copilot in Windows and its underlying chat provider -Copilot in Windows and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Bing Chat in the Microsoft Edge sidebar can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: +Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: **Bing SafeSearch settings**: -If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows, [Bing Chat Enterprise in the Microsoft Edge sidebar](/bing-chat-enterprise/edge), and [Bing Chat in the Microsoft Edge sidebar](https://www.microsoft.com/edge/features/bing-chat): +If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: - mapping `www.bing.com` to `strict.bing.com` - mapping `edgeservices.bing.com` to `strict.bing.com` - mapping `www.bing.com` to `nochat.bing.com` @@ -170,16 +170,16 @@ If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8 **Microsoft Edge policies**: -- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Bing Chat in the Microsoft Edge sidebar and Bing Chat Enterprise in the Microsoft Edge sidebar from being displayed. +- If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Copilot in Edge from being displayed. - If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. **Search settings**: - Setting [ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) to `Hide` might interfere with the Copilot in Windows user experience. -- Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows, Bing Chat in the Microsoft Edge sidebar, and Bing Chat Enterprise in the Microsoft Edge sidebar user experiences. +- Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows and the Copilot in Edge user experiences. **Account settings** -- The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Bing Chat in the Microsoft Edge sidebar. +- The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Copilot in Edge. - The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. From 39f41a385c25652014c8688db77745f1df5d92f2 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 10:55:57 -0700 Subject: [PATCH 044/237] edits --- .../manage-windows-copilot.md | 35 +++++++++++++------ 1 file changed, 24 insertions(+), 11 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index f0e8fa08b8..daf8b34bc2 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -11,7 +11,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows is a bit different from [Copilot in Edge](/bing-chat-enterprise/edge), which provides assistance in the browser, since it can also perform actions such as changing Windows settings or performing common tasks in Windows. However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. ## Manage Copilot in Windows for commercial environments @@ -45,7 +45,7 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat [Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: -- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, Microsoft has no eyes-on access, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). +- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). - Bing Chat Enterprise is available, at no additional cost, for the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty @@ -160,25 +160,38 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share the same underlying chat provider platform. This also means that some settings that affect Bing Chat, Bing Chat Enterprise, and Copilot in Edge can also affect Copilot in Windows. The following common settings might affect Copilot in Windows and its underlying chat provider: -**Bing SafeSearch settings**: +### Bing settings -If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: -- mapping `www.bing.com` to `strict.bing.com` -- mapping `edgeservices.bing.com` to `strict.bing.com` -- mapping `www.bing.com` to `nochat.bing.com` -- blocking `bing.com` +1. Block access to only the public version of Bing Chat for all users on your network: -**Microsoft Edge policies**: + - Map `www.bing.com` to `nochat.bing.com` on your router or proxy server + - Map `edgeservices.bing.com` to `nochat.bing.com` to block access to Bing Chat + + This block only applies when devices are connected to your corporate network. Bing Chat is a public service, like search, and will remain available if accessed outside the corporate network. Bing Chat Enterprise will still be available if the public version of Bing Chat is blocked. To also block Bing Chat Enterprise, use its service plan, as detailed here: [Turn off Bing Chat Enterprise](/bing-chat-enterprise/manage#turn-off--enterprise) + + +2. If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: + - mapping `www.bing.com` to `strict.bing.com` + - mapping `edgeservices.bing.com` to `strict.bing.com` + - blocking `bing.com` + +3. If Bing Chat Enterprise is turned on for your organization, users will be able to access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: + + |Key |Value | + |:---------|:------------| + |com.microsoft.intune.mam.managedbrowser.Chat| **true** (default) shows the interface
**false** hides the interface | + +### Microsoft Edge policies - If [HubsSidebarEnabled](/deployedge/microsoft-edge-policies#hubssidebarenabled) is set to `disabled`, it blocks Copilot in Edge from being displayed. - If [DiscoverPageContextEnabled](/deployedge/microsoft-edge-policies#discoverpagecontextenabled) is set to `disabled`, it blocks Bing Chat and Bing Chat Enterprise from reading the current webpage context. The chat providers need access to the current webpage context for providing page summarizations and sending user selected strings from the webpage into the chat provider. -**Search settings**: +### Search settings - Setting [ConfigureSearchOnTaskbarMode](/windows/client-management/mdm/policy-csp-search#configuresearchontaskbarmode) to `Hide` might interfere with the Copilot in Windows user experience. - Setting [AllowSearchHighlights](/windows/client-management/mdm/policy-csp-search#allowsearchhighlights) to `disabled` might interfere with the Copilot in Windows and the Copilot in Edge user experiences. -**Account settings** +### Account settings - The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Copilot in Edge. - The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. From 360141f39397dfcfc9bebdbe4fa47361514ced3d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 12:35:06 -0700 Subject: [PATCH 045/237] edits --- .../manage-windows-copilot.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index daf8b34bc2..ef615fb09d 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -11,7 +11,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly pass sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly copy and paste sensitive information into the chat provider. ## Manage Copilot in Windows for commercial environments @@ -32,11 +32,11 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Chat provider platforms for Copilot in Windows -Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. +Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because users can copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. **Bing Chat**: -[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: +[Bing Chat](https://www.microsoft.com/bing/do-more-with-ai/what-is-bing-chat-and-how-can-you-use-it) is a consumer experience and if a user isn't signed in with their Microsoft account, the number of chat queries per user has a daily limit. Bing Chat doesn't offer the same commercial data protection as Bing Chat Enterprise does. The following privacy and security protections apply for Bing Chat: - [Copilot in Windows: Your data and privacy](https://support.microsoft.com/windows/3e265e82-fc76-4d0a-afc0-4a0de528b73a) - The privacy statement for using Bing Chat follows the [Microsoft privacy statement](https://privacy.microsoft.com/privacystatement) including the product specific guidance in the Microsoft privacy statement for **Bing** under the **Search, Microsoft Edge, and artificial intelligence** section. @@ -45,19 +45,19 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat [Bing Chat Enterprise](/bing-chat-enterprise/overview) is intended for commercial use scenarios and offers commercial data protection. The following privacy and security protections apply for Bing Chat Enterprise: -- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). +- With [Bing Chat Enterprise](/bing-chat-enterprise/overview), user and organizational data is protected, chat data isn't saved, and your data isn't used to train the underlying large language models. Because of this protection, chat history, 3rd-party plugins, and the Bing mobile app for iOS or Android aren't currently supported. Bing Chat Enterprise is accessible from mobile browsers, including Edge mobile on iOS and Android. Review the Bing Chat Enterprise [privacy statement](/bing-chat-enterprise/privacy-and-protections). - Bing Chat Enterprise is available, at no additional cost, for the following licenses: - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - - Business Standard - - Business Premium + - Microsoft 365 Business Standard + - Microsoft 365 Business Premium > [!Note] > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. ## Configure the chat provider platform that Copilot in Windows uses -Configuring the correct chat provider platform for Copilot in Windows is important because users can pass sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. +Configuring the correct chat provider platform for Copilot in Windows is important because users can copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. ### Bing Chat as the chat provider platform @@ -77,8 +77,8 @@ To verify that Bing Chat Enterprise is enabled for the user as the chat provider - Microsoft 365 E3 or E5 - Microsoft 365 A3 or A5 for faculty - Currently, Microsoft 365 A3 and A5 for faculty requires additional configuration. For more information, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage). - - Business Standard - - Business Premium + - Microsoft 365 Business Standard + - Microsoft 365 Business Premium 1. To verify that Bing Chat Enterprise is enabled for the user, select the user's **Display name** to open the flyout menu. 1. In the flyout, select the **Licenses & apps** tab, then expand the **Apps** list. 1. Verify that **Bing Chat Enterprise** is enabled for the user. @@ -87,7 +87,7 @@ To verify that Bing Chat Enterprise is enabled for the user as the chat provider > [!Note] > If you previously disabled Bing Chat Enterprise using the URL, `https://aka.ms/TurnOffBCE`, see [Manage Bing Chat Enterprise](/bing-chat-enterprise/manage) for verifying that Bing Chat Enterprise is enabled for your users. -The following PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: +The following sample PowerShell script connects to Microsoft Graph and lists which users that have Bing Chat Enterprise enabled and disabled: ```powershell # Install Microsoft Graph module @@ -118,7 +118,7 @@ Once you've configured the chat provider platform that Copilot in Windows uses, ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients -Copilot in Windows isn't technically enabled by default for manged Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. +Copilot in Windows isn't technically enabled by default for managed Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: @@ -145,7 +145,7 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n ### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients (coming soon) -One a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. +Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) From 2e6ee722b7297264d4bc6616e2570e3d997842d4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 13:47:52 -0700 Subject: [PATCH 046/237] edits --- windows/client-management/manage-windows-copilot.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index ef615fb09d..3360fd2b5f 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -120,10 +120,10 @@ Once you've configured the chat provider platform that Copilot in Windows uses, Copilot in Windows isn't technically enabled by default for managed Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. -To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to turn off temporary enterprise control for these devices. Since disabling [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: +To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to enable features under temporary enterprise control for these devices. Since enabling features behind [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: 1. Verify that the user accounts have the correct chat provider platform configured for Copilot in Windows. For more information, see the [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) section. -1. Apply a policy to disable temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: +1. Apply a policy to enable features under temporary enterprise control for managed clients. The following polices apply to Windows 11, version 22H2 with [KB5022845](https://support.microsoft.com/en-us/topic/february-14-2023-kb5022845-os-build-22621-1265-90a807f4-d2e8-486e-8a43-d09e66319f38) and later: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Manage end user experience\\**Enable features introduced via servicing that are off by default** - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) @@ -162,7 +162,7 @@ Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share ### Bing settings -1. Block access to only the public version of Bing Chat for all users on your network: +- Block access to only the public version of Bing Chat for all users on your network: - Map `www.bing.com` to `nochat.bing.com` on your router or proxy server - Map `edgeservices.bing.com` to `nochat.bing.com` to block access to Bing Chat @@ -170,12 +170,12 @@ Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share This block only applies when devices are connected to your corporate network. Bing Chat is a public service, like search, and will remain available if accessed outside the corporate network. Bing Chat Enterprise will still be available if the public version of Bing Chat is blocked. To also block Bing Chat Enterprise, use its service plan, as detailed here: [Turn off Bing Chat Enterprise](/bing-chat-enterprise/manage#turn-off--enterprise) -2. If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: +- If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: - mapping `www.bing.com` to `strict.bing.com` - mapping `edgeservices.bing.com` to `strict.bing.com` - blocking `bing.com` -3. If Bing Chat Enterprise is turned on for your organization, users will be able to access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: +- If Bing Chat Enterprise is turned on for your organization, users will be able to access it through Edge mobile when signed in with their work account. If you would like to remove the Bing Chat button from the Edge mobile interface, you can use an [Intune Mobile Application Management (MAM) policy for Microsoft Edge](/mem/intune/apps/manage-microsoft-edge) to remove it: |Key |Value | |:---------|:------------| From e8d2dc72e8abc9cbb83a0dd8e230aec68edaa671 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 13:53:08 -0700 Subject: [PATCH 047/237] add preview note --- windows/client-management/manage-windows-copilot.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 3360fd2b5f..ba89f9d930 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -13,6 +13,9 @@ appliesto: Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly copy and paste sensitive information into the chat provider. +> [!Note] +> Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. + ## Manage Copilot in Windows for commercial environments At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: From f2a6e983dbf020ad269a389f8767c2d19e53d47a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 13:53:47 -0700 Subject: [PATCH 048/237] edits --- windows/client-management/manage-windows-copilot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index ba89f9d930..6be25291bd 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -2,7 +2,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: article -ms.date: 10/18/2023 +ms.date: 10/31/2023 appliesto: - ✅ Windows 11, version 22H2 or later --- From 5c15e73ead859dce74412b30c3ce9c13976b3e91 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 13:59:45 -0700 Subject: [PATCH 049/237] edits --- windows/client-management/manage-windows-copilot.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 6be25291bd..8f4fc3beea 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -7,7 +7,7 @@ appliesto: - ✅ Windows 11, version 22H2 or later --- -# What is Copilot in Windows? +# Manage Copilot in Windows >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). @@ -16,7 +16,7 @@ Copilot in Windows provides centralized generative AI assistance to your users r > [!Note] > Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. -## Manage Copilot in Windows for commercial environments +## Configure Copilot in Windows for commercial environments At a high level, managing and configuring Copilot in Windows for your organization involves the following steps: From 7a1d78d007f2939c09ae3b3f02bd0754d302d93e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 14:07:25 -0700 Subject: [PATCH 050/237] edits --- windows/client-management/manage-windows-copilot.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 8f4fc3beea..5fe29b596f 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -131,8 +131,8 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. - > [!Important] - > For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + > [!Important] + > For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. 1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** From 32afc847d10efbb6547982ecc912350c6a0965b6 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 14:15:54 -0700 Subject: [PATCH 051/237] edits --- windows/client-management/manage-windows-copilot.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 5fe29b596f..327eb32165 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -14,7 +14,8 @@ appliesto: Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly copy and paste sensitive information into the chat provider. > [!Note] -> Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. +> - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. +> - Copilot in Windows will be available in all global markets, including the UK, except mainland China, Belarus, Russia, and the European Economic Area. ## Configure Copilot in Windows for commercial environments From 0983a4b399891b44331c1ff328abad9af768f51e Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 14:56:13 -0700 Subject: [PATCH 052/237] AI edits --- windows/client-management/manage-windows-copilot.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 327eb32165..e457ec80f3 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -200,3 +200,6 @@ Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share - The [AllowMicrosoftAccountConnection](/windows/client-management/mdm/policy-csp-accounts#allowmicrosoftaccountconnection) setting might allow users to use their personal Microsoft account with Copilot in Windows and Copilot in Edge. - The [RestrictToEnterpriseDeviceAuthenticationOnly](/windows/client-management/mdm/policy-csp-accounts#restricttoenterprisedeviceauthenticationonly) setting might prevent access to chat providers since it blocks user authentication. +## Microsoft's commitment to responsible AI + +Microsoft has been on a responsible AI journey since 2017, when we defined our principles and approach to ensuring this technology is used in a way that is driven by ethical principles that put people first. For more about our responsible AI journey, the ethical principles that guide us, and the tooling and capabilities we've created to assure that we develop AI technology responsibly, see [Responsible AI](https://www.microsoft.com/ai/responsible-ai). From dabc86ba0d97b600d9faedfb285ff7283fefbc39 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 25 Oct 2023 16:04:31 -0700 Subject: [PATCH 053/237] metadata update --- windows/client-management/manage-windows-copilot.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index e457ec80f3..5afe7ecfe8 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -2,6 +2,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: article +ms.technology: itpro-windows-copilot ms.date: 10/31/2023 appliesto: - ✅ Windows 11, version 22H2 or later From 1bec149c57563e1947c57d5a94dd975ff2f1c407 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 30 Oct 2023 12:12:27 -0700 Subject: [PATCH 054/237] edits --- windows/client-management/manage-windows-copilot.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 5afe7ecfe8..6a6104f2c5 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -16,7 +16,7 @@ Copilot in Windows provides centralized generative AI assistance to your users r > [!Note] > - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. -> - Copilot in Windows will be available in all global markets, including the UK, except mainland China, Belarus, Russia, and the European Economic Area. +> - Copilot in Windows is being released in preview to select global markets as part of our latest update to Windows 11. The initial markets for the Copilot in Windows preview include North America and parts of Asia and South America. It is our intention to add additional markets over time. ## Configure Copilot in Windows for commercial environments @@ -58,7 +58,7 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat - Microsoft 365 Business Premium > [!Note] - > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which is used in Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. + > Bing Chat Enterprise and Bing Chat don't have access to Microsoft Graph, unlike [Microsoft 365 Copilot](/microsoft-365-copilot/microsoft-365-copilot-overview) which can be used in the Microsoft 365 apps. This means that Bing Chat Enterprise and Bing Chat can't access Microsoft 365 Apps data, such as email, calendar, or files. ## Configure the chat provider platform that Copilot in Windows uses @@ -123,7 +123,7 @@ Once you've configured the chat provider platform that Copilot in Windows uses, ### Enable the Copilot in Windows user experience for Windows 11, version 22H2 clients -Copilot in Windows isn't technically enabled by default for managed Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. +Copilot in Windows isn't technically enabled by default for managed Windows 11, version 22H2 devices because it's behind a [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control). For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager, Microsoft Intune, and Windows Autopatch are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you need to enable features under temporary enterprise control for these devices. Since enabling features behind [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) can be impactful, you should test this change before deploying it broadly. To enable Copilot in Windows for managed Windows 11, version 22H2 devices, use the following instructions: @@ -134,7 +134,7 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n - **CSP**: ./Device/Vendor/MSFT/Policy/Config/Update/[AllowTemporaryEnterpriseFeatureControl](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowtemporaryenterprisefeaturecontrol) - In the Intune [settings catalog](/mem/intune/configuration/settings-catalog), this setting is named **Allow Temporary Enterprise Feature Control** under the **Windows Update for Business** category. > [!Important] - > For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. + > For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager, Microsoft Intune, and Windows Autopatch are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. 1. Copilot in Windows will be initially deployed to devices using a controlled feature rollout (CFR). Depending on how soon you start deploying Copilot in Windows, you might also need to [enable optional updates](/windows/deployment/update/waas-configure-wufb#enable-optional-updates) with one of the following policies: - **Group Policy:** Computer Configuration\Administrative Templates\Windows Components\Windows Update\Windows Update for Business\\**Allow updates to Windows optional features** @@ -148,11 +148,11 @@ To enable Copilot in Windows for managed Windows 11, version 22H2 devices, you n 1. Windows 11, version 22H2 devices display Copilot in Windows when the CFR is enabled for the device. CFRs are enabled for devices in phases, sometimes called waves. -### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients (coming soon) +### Enable the Copilot in Windows user experience for Windows 11, version 23H2 clients Once a managed device installs the version 23H2 update, the [temporary enterprise control](/windows/whats-new/temporary-enterprise-feature-control) for Copilot in Windows will be removed. This means that Copilot in Windows will be enabled by default for these devices. -While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: +While the user experience for Copilot in Windows is enabled by default, you still need to verify that the correct chat provider platform configured for Copilot in Windows. While every effort has been made to ensure that Bing Chat Enterprise is the default chat provider for commercial organizations, it's still possible that Bing Chat might still be used if the configuration is incorrect, or if other settings are affecting Copilot in Windows. For more information, see: - [Configure the chat provider platform that Copilot in Windows uses](#configure-the-chat-provider-platform-that-copilot-in-windows-uses) - [Other settings that might affect Copilot in Windows and its underlying chat provider](#other-settings-that-might-affect-copilot-in-windows-and-its-underlying-chat-provider) From a40ef7ffc7aa0c898a58d98cbde451a560be3f22 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 1 Nov 2023 09:16:08 -0700 Subject: [PATCH 055/237] edits --- .../client-management/manage-windows-copilot.md | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 6a6104f2c5..86382c61a1 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -3,7 +3,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: article ms.technology: itpro-windows-copilot -ms.date: 10/31/2023 +ms.date: 11/02/2023 appliesto: - ✅ Windows 11, version 22H2 or later --- @@ -12,7 +12,7 @@ appliesto: >**Looking for consumer information?** See [Welcome to Copilot in Windows](https://support.microsoft.com/windows/welcome-to-copilot-in-windows-675708af-8c16-4675-afeb-85a5a476ccb0). -Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since users can possibly copy and paste sensitive information into the chat provider. +Copilot in Windows provides centralized generative AI assistance to your users right from the Windows desktop. Copilot in Windows appears as a side bar docked on the Windows desktop. It's designed to help your users get things done in Windows. Copilot in Windows can perform common tasks in Windows like changing Windows settings, which makes it different from the browser-based [Copilot in Edge](/bing-chat-enterprise/edge). However, both user experiences, Copilot in Windows and Copilot in Edge, can share the same underlying chat provider platform. It's important for organizations to properly configure the chat provider platform that Copilot in Windows uses, since it is possible for users to copy and paste sensitive information into the chat provider. > [!Note] > - Copilot in Windows is currently available as a preview. We will continue to experiment with new ideas and methods using your feedback. @@ -37,7 +37,7 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t ## Chat provider platforms for Copilot in Windows -Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because users can copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. +Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat provider platform. The chat provider platform is the underlying service that Copilot in Windows uses to communicate with the user. The chat provider platform that Copilot in Windows uses is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. **Bing Chat**: @@ -62,7 +62,7 @@ Copilot in Windows can use either Bing Chat or Bing Chat Enterprise as its chat ## Configure the chat provider platform that Copilot in Windows uses -Configuring the correct chat provider platform for Copilot in Windows is important because users can copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. +Configuring the correct chat provider platform for Copilot in Windows is important because it is possible for users to copy and paste sensitive information into the chat provider. Each chat provider platform has different privacy and security protections. Once you have selected the chat provider platform that you want to use for Copilot in Windows, ensure it's configured for your organization's users. The following sections describe how to configure the chat provider platform that Copilot in Windows uses. ### Bing Chat as the chat provider platform @@ -167,14 +167,6 @@ Copilot in Windows and [Copilot in Edge](/bing-chat-enterprise/edge), can share ### Bing settings -- Block access to only the public version of Bing Chat for all users on your network: - - - Map `www.bing.com` to `nochat.bing.com` on your router or proxy server - - Map `edgeservices.bing.com` to `nochat.bing.com` to block access to Bing Chat - - This block only applies when devices are connected to your corporate network. Bing Chat is a public service, like search, and will remain available if accessed outside the corporate network. Bing Chat Enterprise will still be available if the public version of Bing Chat is blocked. To also block Bing Chat Enterprise, use its service plan, as detailed here: [Turn off Bing Chat Enterprise](/bing-chat-enterprise/manage#turn-off--enterprise) - - - If [SafeSearch](https://support.microsoft.com/topic/946059ed-992b-46a0-944a-28e8fb8f1814) is enabled for Bing, it can block chat providers for Copilot in Windows. The following network changes block the chat providers for Copilot in Windows and Copilot in Edge: - mapping `www.bing.com` to `strict.bing.com` - mapping `edgeservices.bing.com` to `strict.bing.com` From e9c010e8e9777cdfb5cdbae81d8678c1dfe36674 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 2 Nov 2023 12:10:42 -0400 Subject: [PATCH 056/237] Add new seting and reformatting --- .../enhanced-phishing-protection.md | 100 ++++++++++-------- 1 file changed, 57 insertions(+), 43 deletions(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 38961897cb..0ec622546b 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -37,43 +37,49 @@ Enhanced Phishing Protection provides robust phishing protections for work or sc ## Configure Enhanced Phishing Protection for your organization -Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. Follow these instructions to configure your devices using either Microsoft Intune, GPO or CSP. +Enhanced Phishing Protection can be configured via Microsoft Intune, Group Policy Objects (GPO) or Configuration Service Providers (CSP) with an MDM service. These settings are available to configure your devices using either Microsoft Intune, GPO or CSP. + +| Setting | Description | +|--|--| +| Automatic Data Collection | This policy setting determines whether Enhanced Phishing Protection can collect additional information-such as content displayed, sounds played, and application memory-when your users enter their work or school password into a suspicious website or app. This information is used only for security purposes and helps SmartScreen determine whether the website or app is malicious.

  • If you enable this policy setting, Enhanced Phishing Protection may automatically collect additional content for security analysis from a suspicious website or app when your users enter their work or school password into that website or app.
  • If you disable this policy setting, Enhanced Phishing Protection will not collect additional content for security analysis when your users enter their work or school password into a suspicious site or app.
  • If this policy is not set, Enhanced Phishing Protection automatic data collection will honor the end user's settings.
    • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | +| Notify Malicious | This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above. | +| Notify Password Reuse | This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password. | +| Notify Unsafe App | This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps. | #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) To configure devices using Microsoft Intune, create a [**Settings catalog** policy][MEM-2], and use the settings listed under the category **`SmartScreen > Enhanced Phishing Protection`**: -|Setting|Description| -|---------|---------| -|Service Enabled |This policy setting determines whether Enhanced Phishing Protection is in audit mode or off. Users don't see any notifications for any protection scenarios when Enhanced Phishing Protection is in audit mode. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender.
  • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | -|Notify Malicious|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above.| -|Notify Password Reuse |This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password.| -|Notify Unsafe App|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps.| +- Automatic Data Collection +- Service Enabled +- Notify Malicious +- Notify Password Reuse +- Notify Unsafe App Assign the policy to a security group that contains as members the devices or users that you want to configure. #### [:::image type="icon" source="images/icons/group-policy.svg"::: **GPO**](#tab/gpo) -Enhanced Phishing Protection can be configured using the following Administrative Templates policy settings: +Enhanced Phishing Protection can be configured using the following group policy settings found under **Administrative Templates > Windows Components > Windows Defender SmartScreen > Enhanced Phishing Protection**: -|Setting|Description| -|---------|---------| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Service Enabled |This policy setting determines whether Enhanced Phishing Protection is in audit mode or off. Users don't see any notifications for any protection scenarios when Enhanced Phishing Protection is in audit mode. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender.
  • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Malicious|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Password Reuse |This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Unsafe App|This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps.| +- Automatic Data Collection +- Service Enabled +- Notify Malicious +- Notify Password Reuse +- Notify Unsafe App #### [:::image type="icon" source="images/icons/windows-os.svg"::: **CSP**](#tab/csp) Enhanced Phishing Protection can be configured using the [WebThreatDefense CSP][WIN-1]. -| Setting | OMA-URI | Data type | -|-------------------------|---------------------------------------------------------------------------|-----------| -| **AutomaticDataCollection** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/AutomaticDataCollection` | Integer | -| **NotifyMalicious** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyMalicious` | Integer | -| **NotifyPasswordReuse** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyPasswordReuse` | Integer | -| **NotifyUnsafeApp** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyUnsafeApp` | Integer | -| **ServiceEnabled** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/ServiceEnabled` | Integer | +| Setting | OMA-URI | Data type | +|-----------------------------|-------------------------------------------------------------------------------|-----------| +| **AutomaticDataCollection** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/AutomaticDataCollection` | Integer | +| **NotifyMalicious** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyMalicious` | Integer | +| **NotifyPasswordReuse** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyPasswordReuse` | Integer | +| **NotifyUnsafeApp** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/NotifyUnsafeApp` | Integer | +| **ServiceEnabled** | `./Device/Vendor/MSFT/Policy/Config/WebThreatDefense/ServiceEnabled` | Integer | --- @@ -82,33 +88,44 @@ Enhanced Phishing Protection can be configured using the [WebThreatDefense CSP][ By default, Enhanced Phishing Protection is deployed in audit mode, preventing notifications to the users for any protection scenarios. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender. Users aren't warned if they enter their work or school password into a phishing site, if they reuse their password, or if they unsafely store their password in applications. Because of this possibility, it's recommended that you configure Enhanced Phishing Protection to warn users during all protection scenarios. To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen settings. + +| Setting | Recommendation | +|---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Automatic Data Collection | **Enabled**: Turns on collection of additional content for security analysis from a suspicious website or app to improve Microsoft's threat intelligence | +| Service Enabled | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | +| Notify Malicious | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | +| Notify Password Reuse | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | +| Notify Unsafe App | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | + #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) -|Settings catalog element|Recommendation| -|---------|---------| -|Service Enabled|**Enable**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users.| -|Notify Malicious|**Enable**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password.| -|Notify Password Reuse|**Enable**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password.| -|Notify Unsafe App|**Enable**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps.| +| Settings catalog element | Recommended value | +|---------------------------|-------------------| +| Automatic Data Collection | **Enabled** | +| Service Enabled | **Enabled** | +| Notify Malicious | **Enabled** | +| Notify Password Reuse | **Enabled** | +| Notify Unsafe App | **Enabled** | #### [:::image type="icon" source="images/icons/group-policy.svg"::: **GPO**](#tab/gpo) -|Group Policy setting|Recommendation| -|---------|---------| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Service Enabled| **Enable**: Enhanced Phishing Protection is enabled in audit mode and your users are unable to turn it off.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Malicious|**Enable**: Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate. It encourages users to change their password.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Password Reuse|**Enable**: Enhanced Phishing Protection warns users if they reuse their work or school password and encourages them to change it.| -|Administrative Templates\Windows Components\Windows Defender SmartScreen\Enhanced Phishing Protection\Notify Unsafe App|**Enable**: Enhanced Phishing Protection warns users if they store their password in Notepad and Microsoft 365 Office Apps.| +| Group Policy setting | Recommended value | +|---------------------------|-------------------| +| Automatic Data Collection | **Enabled** | +| Service Enabled | **Enabled** | +| Notify Malicious | **Enabled** | +| Notify Password Reuse | **Enabled** | +| Notify Unsafe App | **Enabled** | #### [:::image type="icon" source="images/icons/windows-os.svg"::: **CSP**](#tab/csp) -|MDM setting|Recommendation| -|---------|---------| -|ServiceEnabled|**1**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users.| -|NotifyMalicious|**1**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password.| -|NotifyPasswordReuse|**1**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password.| -|NotifyUnsafeApp|**1**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps.| - +| MDM setting | Recommended value | +|-------------------------|-------------------| +| AutomaticDataCollection | **1** | +| ServiceEnabled | **1** | +| NotifyMalicious | **1** | +| NotifyPasswordReuse | **1** | +| NotifyUnsafeApp | **1** | --- @@ -121,7 +138,4 @@ To better help you protect your organization, we recommend turning on and using [WIN-1]: /windows/client-management/mdm/policy-csp-webthreatdefense - [MEM-2]: /mem/intune/configuration/settings-catalog - - From 6452e7263480b13028d65fd2eead6c812aeb4a00 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 2 Nov 2023 12:44:21 -0400 Subject: [PATCH 057/237] Minor updates --- .../enhanced-phishing-protection.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 0ec622546b..313b641bca 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -1,7 +1,7 @@ --- title: Enhanced Phishing Protection in Microsoft Defender SmartScreen description: Learn how Enhanced Phishing Protection for Microsoft Defender SmartScreen helps protect Microsoft school or work passwords against phishing and unsafe usage on sites and apps. -ms.date: 09/25/2023 +ms.date: 11/02/2023 ms.topic: conceptual appliesto: - ✅ Windows 11, version 22H2 @@ -41,12 +41,14 @@ Enhanced Phishing Protection can be configured via Microsoft Intune, Group Polic | Setting | Description | |--|--| -| Automatic Data Collection | This policy setting determines whether Enhanced Phishing Protection can collect additional information-such as content displayed, sounds played, and application memory-when your users enter their work or school password into a suspicious website or app. This information is used only for security purposes and helps SmartScreen determine whether the website or app is malicious.
  • If you enable this policy setting, Enhanced Phishing Protection may automatically collect additional content for security analysis from a suspicious website or app when your users enter their work or school password into that website or app.
  • If you disable this policy setting, Enhanced Phishing Protection will not collect additional content for security analysis when your users enter their work or school password into a suspicious site or app.
  • If this policy is not set, Enhanced Phishing Protection automatic data collection will honor the end user's settings.
    • If you enable this policy setting, Enhanced Phishing Protection may automatically collect additional content for security analysis from a suspicious website or app when your users enter their work or school password into that website or app.
  • If you disable this policy setting, Enhanced Phishing Protection won't collect additional content for security analysis when your users enter their work or school password into a suspicious site or app.
  • If this policy isn't set, Enhanced Phishing Protection automatic data collection honors the end user's settings.
    • | | Service Enabled | This policy setting determines whether Enhanced Phishing Protection is in audit mode or off. Users don't see any notifications for any protection scenarios when Enhanced Phishing Protection is in audit mode. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender.
  • If you enable or don't configure this setting, Enhanced Phishing Protection is enabled in audit mode, preventing users to turn it off.
  • If you disable this policy setting, Enhanced Phishing Protection is off. When off, Enhanced Phishing Protection doesn't capture events, send data, or notify users. Additionally, your users are unable to turn it on.
    • | | Notify Malicious | This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school password into one of the following malicious scenarios: into a reported phishing site, into a sign-in URL with an invalid certificate, or into an application connecting to either a reported phishing site or a sign-in URL with an invalid certificate
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they type their work or school password into one of the malicious scenarios described above and encourages them to change their password.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they type their work or school password into one of the malicious scenarios described above. | | Notify Password Reuse | This policy setting determines whether Enhanced Phishing Protection warns your users if they reuse their work or school password.
  • If you enable this policy setting, Enhanced Phishing Protection warns users if they reuse their work, or school password and encourages them to change it.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they reuse their work or school password. | | Notify Unsafe App | This policy setting determines whether Enhanced Phishing Protection warns your users if they type their work or school passwords in Notepad or Microsoft 365 Office Apps.
  • If you enable this policy setting, Enhanced Phishing Protection warns your users if they store their password in Notepad or Microsoft 365 Office Apps.
  • If you disable or don't configure this policy setting, Enhanced Phishing Protection doesn't warn users if they store their password in Notepad or Microsoft 365 Office Apps. | +Follow these instructions to configure your devices using either Microsoft Intune, GPO or CSP. + #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) To configure devices using Microsoft Intune, create a [**Settings catalog** policy][MEM-2], and use the settings listed under the category **`SmartScreen > Enhanced Phishing Protection`**: From c008b5b446e67a80ed4c300a7b024ec899396875 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Fri, 3 Nov 2023 08:09:26 -0700 Subject: [PATCH 058/237] edit csp location --- windows/client-management/manage-windows-copilot.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index 86382c61a1..e8c129e081 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -3,7 +3,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows for commercial environments using MDM and group policy. Learn about the chat providers available to Copilot in Windows. ms.topic: article ms.technology: itpro-windows-copilot -ms.date: 11/02/2023 +ms.date: 11/06/2023 appliesto: - ✅ Windows 11, version 22H2 or later --- @@ -31,7 +31,7 @@ Organizations that aren't ready to use Copilot in Windows can disable it until t |   | Setting | |---|---| -| **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | +| **CSP** | ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | | **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** | @@ -158,7 +158,7 @@ While the user experience for Copilot in Windows is enabled by default, you stil Organizations that aren't ready to use Copilot in Windows can disable it until they're ready by using the following policy: -- **CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot) +- **CSP**: ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) - **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot** ## Other settings that might affect Copilot in Windows and its underlying chat provider From a6bd5308b342d6a163a70ddaba8b18b957380025 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 7 Nov 2023 15:59:20 -0800 Subject: [PATCH 059/237] Update mcc-enterprise-deploy.md edit metadata --- windows/deployment/do/mcc-enterprise-deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index e72b4a9189..69ff6025d9 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -13,7 +13,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Microsoft Connected Cache for Enterprise and Education -ms.date: 03/10/2023 +ms.date: 11/07/2023 --- # Deploy your cache node From ae0633f0b1e1f4e9ff4b056f5436b55b146db32f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 8 Nov 2023 17:47:57 -0500 Subject: [PATCH 060/237] Port from word doc --- .../network-security/windows-firewall/TOC.yml | 2 + .../windows-firewall/hyper-v-firewall.md | 96 +++++++++++++++++++ 2 files changed, 98 insertions(+) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml index 6057d602da..a216ae58ee 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml @@ -148,6 +148,8 @@ items: href: assign-security-group-filters-to-the-gpo.md - name: Change rules from request to require mode href: Change-Rules-From-Request-To-Require-Mode.Md + - name: Configure Hyper-V firewall + href: hyper-v-firewall.md - name: Configure authentication methods href: Configure-authentication-methods.md - name: Configure data protection (Quick Mode) settings diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md new file mode 100644 index 0000000000..71ed4ba1de --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -0,0 +1,96 @@ +--- +title: Hyper-V firewall +description: Learn how +ms.topic: how-to +ms.date: 11/08/2023 +--- + +# Configure Hyper-V firewall rules + +Hyper-V Firewall is a new network firewall solution introduced with Windows 11 22H2. This firewall solution enables filtering inbound and outbound traffic to/from containers that are being hosted by Windows, including the Windows Subsystem for Linux (WSL). + +## Manage locally from PowerShell + +Follow the steps below to manage Hyper-V firewall locally on your machine via the command line. + +### Get the VMCreatorId GUID + +Hyper-V firewall rules are enabled per VMCreatorId. First you need to obtain this, which you can do by running: + +```powershell +Get-NetFirewallHyperVVMCreator +``` + +This will output a VmCreatorId. Please note that these are unique, and so the one shown below is exclusive to WSL. + +```powershell +VMCreatorId  : {40E0AC32-46A5-438A-A0B2-2B479E8F2E90} +FriendlyName : WSL +``` + +### Firewall Settings + +Hyper-V Firewall has settings that apply in general to a VMCreatorId. To see these you can use the [Get-NetFirewallHyperVVMSetting]( https://learn.microsoft.com/powershell/module/netsecurity/get-netfirewallhypervvmsetting?view=windowsserver2022-ps) commandlet. For example, you can get the policies affecting WSL with the command below: + +```powershell +Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore -Name "{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}" +``` + +This will output these values: + +1. Enabled (True/False) - if Hyper-V Firewall is enabled for WSL VMs +2. DefaultInboundAction, DefaultOutboundAction - these are default rule policies as applied to packets entering or leaving the WSL container. These are the defaults (which can be configured more specifically later) +3. LoopbackEnabled - this tracks if loopback traffic between the host and the container is allowed (without requiring any special Hyper-V Firewall rules). WSL enables this by default, to allow the Windows Host to talk to WSL, and WSL to talk to the Windows Host +4. AllowHostPolicyMerge - this setting determines how Windows Host Firewall Enterprise Settings (GP), Hyper-V Firewall Enterprise Settings (MDM), Windows Host Firewall Enterprise Settings (MDM), local Hyper-V Firewall settings, and local Host Firewall settings interact + + a. This setting is detailed with Set-NetFirewallHyperVVMSetting: [Set-NetFirewallHyperVVMSetting (NetSecurity) | Microsoft Learn](https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervvmsetting?view=windowsserver2022-ps) + +> [!NOTE] +> `-PolicyStore ActiveStore` returns the *applied* settings. + +You can set specific settings using the [Set-NetFirewallHyperVVMSetting]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervvmsetting?view=windowsserver2022-ps) command. For example, the command below sets the default inbound connection to Allow: + +```powershell +Set-NetFirewallHyperVVMSetting -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -DefaultInboundAction Allow +``` + +### Firewall Rules + +Hyper-V firewall rules can be enumerated and created from PowerShell. To view rules please use the [Get-NetFirewallHyperVRule]( https://learn.microsoft.com/powershell/module/netsecurity/get-netfirewallhypervrule?view=windowsserver2022-ps ) commandlet. For example, to view firewall rules that only pertain to WSL you can use the command below: + +```powershell +Get-NetFirewallHyperVRule -VMCreatorId "{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}" +``` + +And to set specific rules you can use the [Set-NetFirewallHyperVRule]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervrule?view=windowsserver2022-ps) commandlet. + +For example, you can create an inbound rule to allow TCP traffic to the Windows Subsystem for Linux (WSL) on port 80 with this PowerShell command: + +```powershell +New-NetFirewallHyperVRule -Name MyWebServer -DisplayName "My Web Server" -Direction Inbound -VMCreatorId "{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}" -Protocol TCP -LocalPorts 80 +``` + +### Targeting Hyper-V firewall rules and settings to specific profiles + +Hyper-V firewall rules and settings can be targeted to the Firewall profile of the networks that are connected. These are the same Firewall Profiles that the Windows Firewall targets (Public Profile, Private Profile, Domain Profile). This has similar policy options as the above Hyper-V firewall PowerShell commandlets, but are just applied to specific profiles for the connected Windows Host network adapter. + +You can view these settings per profile with this command: + +```powershell +Get-NetFirewallHyperVProfile -PolicyStore ActiveStore +``` + +> [!NOTE] +> `-PolicyStore ActiveStore` returns the *applied* settings. + +The values here are the same as above, with one additional one: + +- AllowLocalFirewallRules: This setting determines how Enterprise (MDM) Hyper-V Firewall Rules interact with locally defined Hyper-V Firewall Rules. If this is set to True, then Windows will apply both the Hyper-V Firewall Rules from Enterprise Policies and the locally defined Hyper-V Firewall Rules. If this is set to False, then the locally defined Hyper-V Firewall rules are not applied, and only the Hyper-V Firewall Rules pushed by the Enterprise Policies are applied. + +You can set these settings per profile using the [Set-NetFirewallHyperVProfile]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervprofile?view=windowsserver2022-ps) commandlet. + +You can set rules per profile using the [Set-NetFirewallHyperVRule]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervrule?view=windowsserver2022-ps) commandlet with the `-Profile` option. + +## Manage from Intune + +You can also manage these settings online via Intune. From 26ece5360a2de1b3345994cb4794c9daf86eff22 Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Wed, 8 Nov 2023 17:57:11 -0800 Subject: [PATCH 061/237] Update mcc-enterprise-update-uninstall.md remove updating instructions as those are no longer applicable --- windows/deployment/do/mcc-enterprise-update-uninstall.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-update-uninstall.md b/windows/deployment/do/mcc-enterprise-update-uninstall.md index 207c2cf5fb..0b0a332d17 100644 --- a/windows/deployment/do/mcc-enterprise-update-uninstall.md +++ b/windows/deployment/do/mcc-enterprise-update-uninstall.md @@ -1,6 +1,6 @@ --- -title: Update or uninstall MCC for Enterprise and Education -description: Details on how to update or uninstall Microsoft Connected Cache (MCC) for Enterprise and Education for your environment. +title: Uninstall MCC for Enterprise and Education +description: Details on how to uninstall Microsoft Connected Cache (MCC) for Enterprise and Education for your environment. ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to @@ -18,6 +18,7 @@ appliesto: ms.date: 10/12/2022 --- + ## Uninstall MCC Please contact the MCC Team before uninstalling to let us know if you're facing issues. From de52079be8abbee1a887c6a0cf962cad6d173c97 Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Wed, 8 Nov 2023 18:24:21 -0800 Subject: [PATCH 062/237] Update mcc-enterprise-deploy.md few more edits to common issues --- .../deployment/do/mcc-enterprise-deploy.md | 82 +++++++++++++++++-- 1 file changed, 76 insertions(+), 6 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 69ff6025d9..3b508e8d19 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -228,23 +228,21 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p Please refer to the [Sizing Recommendations](/mcc-enterprise-prerequisites#sizing-recommendations) for memory, virtual storage, and CPU cores. For this example we chose the recommend values for a Branch Office/Small Enterprise deployment. -1. - When the installation is complete, you should see the following output (the values below will be your own) +1. When the installation is complete, you should see the following output (the values below will be your own) :::image type="content" source="./images/ent-mcc-script-complete.png" alt-text="Screenshot of the installer script displaying the completion summary in PowerShell." lightbox="./images/ent-mcc-script-complete.png"::: 1. Your MCC deployment is now complete. - - 1. If you don't see any errors, continue to the next section to validate your MCC deployment. Your VM will not appear in Hyper-V Manager as it is an EFLOW VM. - 1. After validating your MCC is properly functional, review your management solution documentation, such as [Intune](/mem/intune/configuration/delivery-optimization-windows), to set the cache host policy to the IP address of your MCC. - 1. If you had errors during your deployment, see the [Common Issues](#common-issues) section in this article. + If you don't see any errors, continue to the next section to validate your MCC deployment. Your VM will not appear in Hyper-V Manager as it is an EFLOW VM. + - After validating your MCC is properly functional, review your management solution documentation, such as [Intune](/mem/intune/configuration/delivery-optimization-windows), to set the cache host policy to the IP address of your MCC. + - If you had errors during your deployment, see the [Common Issues](#common-issues) section in this article. ## Verify proper functioning MCC server @@ -264,6 +262,12 @@ Connect to the EFLOW VM and check if MCC is properly running: :::image type="content" source="./images/ent-mcc-connect-eflowvm.png" alt-text="Screenshot of running connect-EflowVm, sudo -s, and iotedge list from PowerShell." lightbox="./images/ent-mcc-connect-eflowvm.png"::: You should see MCC, edgeAgent, and edgeHub running. If you see edgeAgent or edgeHub but not MCC, try this command in a few minutes. The MCC container can take a few minutes to deploy. If iotedge list times out, you can run docker ps -a to list the running containers. +If the 3 containers are still not running, run the following commands to check if DNS resolution is working correctly: +```bash +ping www.microsoft.com +resolvectl query microsoft.com +``` +See the [common issues](#common-issues) section for more information. #### Verify server side @@ -331,3 +335,69 @@ This command will provide the current status of the starting, stopping of a cont > [!NOTE] > You should consult the IoT Edge troubleshooting guide ([Common issues and resolutions for Azure IoT Edge](/azure/iot-edge/troubleshoot)) for any issues you may encounter configuring IoT Edge, but we've listed a few issues that we encountered during our internal validation. +> + +### DNS needs to be configured + +Run the following IoT Edge install state check: + +```bash +sudo iotedge check --verbose +``` + +If you see issues with ports 5671, 443, and 8883, your IoT Edge device needs to update the DNS for Docker. + +To configure the device to work with your DNS, use the following steps: + +1. Use `ifconfig` to find the appropriate NIC adapter name. + + ```bash + ifconfig + ``` + +1. Run `nmcli device show ` to show the DNS name for the ethernet adapter. For example, to show DNS information for **eno1**: + + ```bash + nmcli device show eno1 + ``` + + :::image type="content" source="images/mcc-isp-nmcli.png" alt-text="Screenshot of a sample output of nmcli command to show network adapter information." lightbox="./images/mcc-isp-nmcli.png"::: + +1. Open or create the Docker configuration file used to configure the DNS server. + + ```bash + sudo nano /etc/docker/daemon.json + ``` + +1. Paste the following string into the **daemon.json** file, and include the appropriate DNS server address. For example, in the previous screenshot, `IP4.DNS[1]` is `10.50.10.50`. + + ```bash + { "dns": ["x.x.x.x"]} + ``` + +1. Save the changes to daemon.json. If you need to change permissions on this file, use the following command: + + ```bash + sudo chmod 555 /etc/docker/daemon.json + ``` + +1. Restart Docker to pick up the new DNS setting. Then restart IoT Edge. + + ```bash + sudo systemctl restart docker + sudo systemctl daemon-reload + sudo restart IoTEdge + ``` + +### Resolve DNS issues +Follow these steps if you see a DNS error when trying to resolve hostnames during the provisioning or download of container: +Run ``` Get-EflowVmEndpoint ``` to get interface name + +Once you get the name +```bash +Set-EflowVmDNSServers -vendpointName "interface name from above" -dnsServers @("DNS_IP_ADDRESS") +Stop-EflowVm +Start-EflowVm +``` + + From 7692b222d1e89dd9af24602a52bb15a72ee183f6 Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Wed, 8 Nov 2023 18:33:25 -0800 Subject: [PATCH 063/237] new screenshots for Enterprise MCC doc edits --- windows/deployment/do/images/assigning-ip-2.png | Bin 0 -> 6774 bytes .../deployment/do/images/external-switch-1.jpg | Bin 0 -> 31124 bytes .../do/images/installation-complete-7.png | Bin 0 -> 60113 bytes .../do/images/installation-info-4.png | Bin 0 -> 13937 bytes .../deployment/do/images/memory-storage-5.png | Bin 0 -> 14534 bytes .../portal-installation-instructions-6.png | Bin 0 -> 29343 bytes .../deployment/do/images/use-custom-dns-3.png | Bin 0 -> 7754 bytes 7 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/deployment/do/images/assigning-ip-2.png create mode 100644 windows/deployment/do/images/external-switch-1.jpg create mode 100644 windows/deployment/do/images/installation-complete-7.png create mode 100644 windows/deployment/do/images/installation-info-4.png create mode 100644 windows/deployment/do/images/memory-storage-5.png create mode 100644 windows/deployment/do/images/portal-installation-instructions-6.png create mode 100644 windows/deployment/do/images/use-custom-dns-3.png diff --git a/windows/deployment/do/images/assigning-ip-2.png b/windows/deployment/do/images/assigning-ip-2.png new file mode 100644 index 0000000000000000000000000000000000000000..4403b7e68b085683b3f284fab2bed7ea29b81762 GIT binary patch literal 6774 zcmdT|XH-*bmyRML9YH{9K%_|Z0*bVR-XRpJq3NYaM>?UY5fMRp5d=aJ0!r__N*54< zAYE!m=$$}FCik0f&6=4%^Lu`rv(H}pyk);@?dN&+8*ONyNlV2}1pokOwYAiY0f6ft zN#B0Au9MzgBZw7}x#nxEsRAe;<;0Mj8_vr5$^bxBJT?9qImxH=*0S^k0O)%Dd9L+) z6*~X`?9|$7%1?uAce2}z=e4H$qhwBL-Hj@{m?|3{l6O_-4N_Kq(^?*++!od>@9tWo zF8S7aV@+V5_f;m;f`TJR2-`%ncr>15WsKm~F37;J5jt*6VrAv7@<3OGAgI@3D;sHH z0FO3d?CPH_D8V`n$Ve7*U7nU?zEE#VlT3nmCF-AG^ZyZq1E89AyTpq8skU%-WZXMl=jJsK@#Tg{TWW|!(^}A7L&4z8Me9GsPid0Fptxq zgM}qcyt3qn8}e#8Hkiw_a&QZadJM9VEq~tN-amauk~e+2A2q(b*WCgpzLdGholtqI zXMWX0#N*-!;FhqdCo#_@ed0rdU#8W~2UHn}rGt9q*bF?&!yDb;>8$!)dj-+dMz*%? z5$9KDJv}vZ3o+)#6-su;k~ulCbU1xg<{Jy%`k$pU#fzE32J_xs;!y{F#-1-^KDF5e zQY1&o2mS)P-ib68v>zYyxM}+N+gQU`50h(?w3^=G(GFUq9K_7IbI6fE% zAMp4%6Aja*yL9#O6(<_%?vYyf0Nmfm22tdD)jOCEP6h_t5qj*@_vQ*0I%*F!ALM*4 zjA14m+WnHcOuf|33lkGO%20Xpyu}cn%c%UuJMI`H4w|}Z_^+sbDUF~_V@lOI%P3-h#m>Xl@)x5*#G0SsF9o}5fSwA z(66sybdxKMuF}BeqW~NYMNaGi+uhc9%<%0K>Xk+rEUT&XOE#-26^Ff@k?}?S)9F%j z`{DSW(9uyL*0xeK{j&}9eh~T{`EbQ(v1-E+kZwx!>zHp+BDdZ4;)l?DX*%j>gS_up zQ>yhKE-_>nSir}Jb#Eth#xj?FR8DY=Lgce@M>(gXRdX`#sn=1~4~+{4iYUDQ9d&td za`4!3B1lvp{JAseiUvDFwbis6K&y)w2w6x2n#*{8x;#DpYAJjn z)y-w;sD67lZ_?91WA9{y<}rouxOsERvU1_af?Z-DLcx~NmA}<>S1V+UrC<$g#W65Y)NW)Y~jicl-oLzc{g`) zKEwzvm6Bl;XO^KcJgX@$P=Wnat?vc(lVi;sKi_lNOO4Cm733dL}5Q96F|W?;@={d!-@(nVQ0az8$#U2&mV3KAW8 zOG?c7J|Y?e@hEW|yDc-9=tGmw)p7x6l2^ z1as7Xn~;b$=)PviYmcni`Jhvq42}A%kfBsMn~e=Ii&_kRbjzKNn;2j-eCqT3=NA6> zk*$IdFMCXDxp7YQs6S zbAfzJPpA1Eg%|&xAidR?3xkAH;zv#n8=PI#D`obg=`jdUq?N}i?zInV=|0Qx<>Cm$ z8ZjHPKwH8{=Gq~gnuQE-`h^$JYAAAyp;GENT7({^_SToL>|ZSHug%xhcu7b!7LCCo zcH0kqrjb`Jpf1P3;9y)7`$HGUV5K9E)5eds#|v=ORo56WkREk~g4>*BqGEQeJf}Kl z&f_^~GbH_|Yi@n_$^h$6eDiIZA-Y>bOKpNLett@d^5A~$^A{!w;XmJceBjcL;Uu#R z_7lixWKz94wU+^k93Z9G-2GHEn98Yzh%3+mHqk8DKCA}k#Dmir$I0**>-a|p?Tqc)NEILD^BwS9LzqF zP=Ie-8Of8wx=PxX^zS8ryN;V>6ySlgp?(7B-2xhAb}F%0WDA-5mIiW189aWpV}csW1!V| zUU=XB6tX3?ppZV2V#zIain>|&jq*ba-hYVpB~bv-R)}62pz76pXg^cx)s(C8T5ggx zS8m)P@e^9B5xjotQMa-=tax>3QxVnoYI?ByG$gP)tYOv>0ART_MBZv(%kG&%W}o=w zInuvAW{e@r8Af|dJ4Eg-AXn1ba-jMDSOCKrY%gCGpNhrhjY5r<7 zSL&!pMIU0g*o7cMcoXufHK@hG;N2rQefHV6d0;v-9l%0TBmbGs9}6X_ZGqKB$4%<9rlkeM$j*HONZ#zsGj(Bf=8k>{zeOND}6U)^W#y) zwr8-4sL%$EGGpP)9BlJm)c`S}dJjh<`f~Wo#PJKKI6h=ev@;`=xrJ zu+9Jzezo+Q+8RaG3W~>eKB=jutsGR-FEk3`o4=v~RH{wc1KA#}C=**I?^9e6tO$W( zvMh<`Wq4!FwFDz{6;uk`p6Gw=+}tzfhu%+!TZf}B#>k(To8s=upxZv%(ce|F<>-)& zWcB|VbfE9Cw*Kg>;GVN-<^{*6gPDW(x>TmIUZK{=`@g9u0HWEEi$;WBk%QaVr*Gf3oTZAP#-7D8NmTKZ(TdzV%!E^}4x$ z=H>Ng0#(=M`sL|o2cM+GMHfXrO&_kxN$zMp5i{TXfz3))dIbu1{IwCxEwxv5l6{PMyOo@8ju5N7r1-E;=idd(sw4+TN9f}3h zdVbxAmV}qp>fLI|oeI*(X(1PH)3g%`8B}5_xc1;@;DnygrDGag?nxo+*}oUE>VL@g zabx8$%mKGn8ND1~-Y=K7WcN$!>{`>QIJRF#Y3`gQY|!Psv%uh5XNM0(>ji$-)zE=U zStC>Mi+r%-{w+No6X(shKZrA$u(VU=v|4Wb9+SV?A&%FE=UIP(*%N?0=1V(BtWRJw zVtW5_E6=xMhPZ?OtKnnC*TSe6I&pp2DQ0(0(*PHh#gZIPM7QtxYrK zgs$VS*-U{Js%WfmO-q;GIN&l&AoL{ zTz9Cfuc6#Ri)!#Sz~g9AS)U^U`sHhKclB5>5t+rqfs@A#6W;<1Xn>S|CqG8jvCs64 zxtB;t^y<|aKS6rP8r!a$9EsC!jh4CI!I_lPFKir%5X$6JSONCQn_UJivdWqTgW9A? zOW{P!T@So=;GceGOYE|DPM3pj*g$ns3A0zO!)jARje}R*(~>aalwvw*EG_0=WBX&3 zlaluMjs)p@_HRXMcvyzM+qqVkSM5YWL^=KzJ;6jYe-H%gRbYPc#|p&U5m-28v-Kt< zm?GkY>Zz?29KMK@OQFRi0G$`f7Z29GjuuHb6h_Lo5}Z3iGpZLeP)Ct2&{fZqV)Dpa|8O9whyn{8yxWGWEo zXpzOYJW0^m5?hTu7(@+ts1B_QwGKZxIs&FJ<#~jvY`83J3YJGe@8MKarf!F#e9lt2 z!>TyuuKm1W68_!{Q#YZm5%VrS`Su>y@UYzTuX9sCY8Z=i#vDc<=m5SxM{Q|W^C=%q zA-&5006e~XzHH$&01}%d9_OzkZ)RM2%{TeNtsW!(#%9^yq6S#7m5hauRXz=p?S)UT zrne^30026quGw(^@QN&g%x0TjqHhWSsAPQjFNXd?-S!gHiaZoY#Bqm+IJ1lH+ zJH+~DRvF)ch2^lR2qyrL)>pmbN62>5I7lq!zE^KZ?26HV`UfUHF6U(V`|Xqva4K`# zLpaRE2G-juzQ+ozdZ_Oj_2zG@uszhBg5CEC3J2o=1V@4{2gxt_KqDu`` zNAwz-OhAwZ|9Yt*>tu-CS$j~W%R9Ti+aFIF|*|JVqmHP=T=up3Ccjd=RchKa+7cO6H zj@%u2YDL;C7m32TMoW!Yl}8eSB3T<=)0m$HC|IZWOtXCWO#^)Tko4@lXLLy98vn})Vv4iD@t_xgj0H_rZSK@^e_pC zys@54hr2sosLK^Fdt?3S@nBUqSKVQzQM(zJRCh0Iq@ld)!PAB;>wrmqp$w0_m8E9I z|3&Qw76w)}S%|7;Lhsr~8Rqe?Ib;cvioY?l(zeCVgiQ{&7`#&5iCqNWE1b5gM37DS zifCRTaAoR1Y{e((46L697d8F~tVtz4D-Gp=_v`FlRY_&`H+YX=zTTh_ly? zRLeY*Erq<$a*7o3z0ZeI4&BP^KPauaI7 zzi3U2Xk=SQ6%}OBi98?Mg6@`DEZ@{0ny!cfop@tS_kVYEfvN@e-?_5?aSFHLmwm>k zDa$9n>;!qI4Wmd={<^#T^rITxw)pr0e|l74vR#HVuU_ac;^NVC?jd zuxPn+m|VPEX!df&n#G}F=*)!mj)yEu*E#c*WmGb9 zpU(+128U;VZlsen<$a5cPZbJG=V<6ua8?hdX8RsQKZ;@=BGTbHFDn~Glup-n__f`| zBdl~vBl)A;^G%|J2S-Nz)0oW~O>MjUOv!3sFCw>6TijC2$p>Z5Iy!^31is#qFbxm* zY55_i7fGycQNQ(UP=dcJLM_LOW@&)dRRnizr`TRdw84cTk=W39NDquosk)QCA6D>j zQ3QhNA_5QKR4L8 z4rpa0$&*5TkvNHj`q(*xw(ZFLFb5}Uh*-EpP`&DaUL^IHL>vBWhgLa{-C6b1`z>ma zNNfjSBPDG_kd+awW+ZoK%V9GVqV65#QVd7lw4+NTE*g9??2wmqr+B$zf zn8JWflgsn1@b=GL23?^N;^JGaYL-7HnE;gs_Z^TS2OL)uv-F-;2b8YeP~0!iw|)#% zbD?Js6+tKT5CKKp{6-8*JC$6@bihJ{ujOB-+o?EN4?(2j3PkT+laDaWG5j;6ygazR z{F2K{V+)i3v4#LT`;vdR298Kb%+!C1SYja79>YJ|yEx0c``QPOJj|r;`D$C_#<1_iVPo~3Y{qW%CJ-Q;I`s5K*ekB?b^p0Y`qE|&|=Jr|D^1d#_$t8n&&3q#**H% zBUGRw!ziNsr%)N_tjzPB7DRGd%Gt3c#e85X;3p)2LY6B*lRgSQd;5#DPZ>qPtDUB8 z#utAi?!PG!1pHzC3C}*oFEC2GZ!RvGYx8%s&QFYQKG!Y?S)l%(XlCg9vpBZ zgzt_n>B!vdF-ME@1UX{6+H%K~Dq5w6SQ6=4W0|%d!cx>K*|-i$JiK`&@)4N-UU|al z;+N<3;k<(v9(Aecc6z#b^^8o*_`l49DgD7S3v0)3{K_sYZ;l4WG;PIhTn>{5KS)$qnP!PZ&;3v+Ne&FYaNo(4)c7A#vC_;C&%1}DcSgEt`g&vjuB`o>tI`&W~Z z<7MofT7=&TcT;;%yRS>8ff3+cx;j2X7Q2*~d77W*!Lp6R-Y=`5ST?^z6ouR+h{zL^ zhac-)xCwA)*zdXa7>G5o-kX=UyuZ;zf#vo;qzpJ-&k4tQK3K|z3gFW1!e0_e3OVxo zDM?`&+iuK#B6S~aq^k{E3e^l1yUrx<_8Sbdx}+A z=Ztgz?~QTpxc80wcE%hd*;#vMeOY_1_04b2^>_a78sLSBg0cbt2?+`C;rRvly9kg2 zV4$M|(a|t~Kp-Y21{Mx6E)F&}4h10*J~0g?9W4zdH8njGH!J;1PDW~KHj!7HynKR! zf^@86Qlk8l+ya99|J(!#6B82$8;2Yhmz+0zn7#e{sEUm0A>>zM-+Hxuv_Ox37QT*Wl39G<;@uZhir=zOlKry|cTwe{gHWUI>GzLC&LRl@~M;D@({J|K+Z{mN{ zbYU_IXrGaoyG~+}G6}9TpZ^2xU&#LVfQ9^jLiS(4{wFR300#x>dGJsO0IvaOEgX4g zG%&JHLen|T;S{;%k9prw7+X z38n0LG$wxwuMot7eu}3hwUH(=@fXrWo}jsAv-SJ#7PSLh1@*0IBi0QBTPw78Znax# z)!rgxW`Ah5IN)I7wGoU3CL1-J(G<@~%0dJ$$DIl!ZN5_1ytzmnTWZT@>jX--7o&va zwo|>CfI)aR6f(iA=|0qZ3EdqI>MzZyTvcHt{@^>MV`GIvgsNoV0`E%iH;F%U>|(49 z!lfHQY+5=-owp*+o$<;XO6#aD(RGBr_`XMNa%<^+T$EC8x;YNL$W)z}+mC9*?t^b74u^e57mwj}+)iPdGN`GgE@GJ&*qBdSFoOO8f{nY>>p4H!lKGHO`3 zt~*q!s=un9?C~0^oN+xGYq*2W3$?3i7Siu2-XJ;3EkzhIy8 z*>AiyS_7oqhhwYT2;`(|8Es}730OG+6!gJ&9_7HuX`^%B{g&_5_1qx{3YfbrFwIAS zL3W9Mp6SEmxeRqC$$TcA;zXNS;l6&z!OjLtw5g9Pd(QVS4EpS@In;Ef^ZDnv;qk@Z z2nff!@ROB;0Nvv)9}9&qq;XZhN^^n}JDHyE5DW2PTYjg=nqHTN1Cg6w%Sy! zsF7d;x^Kd+NQ^%ik%Pn{IohJSkDp!f&$KoyLZc1J#{89&xB6EMJEQ1hXGleyEQ(Z1 zWYGp4-W~!lz2nu9gT_SizVf|TH{m=FFiWZvy&X0!GuCc z*YbjT?csVb2ah}Quzs1U$B1az*3H;1wrugOz{^q}+*g2O?Aw}g<3A*g9{Kx}OD%Yr zF3bmZ{ChTMgA``3gc+-GFb2n_C!niAz^rtMA2!^huLk($@&ru;{3v?)2Sx>#@(#@KiciD5 zSc|&S>iSvuzr=UjKWfQPt)3-~vZUi??xYu)k~3T|G-a_|g4Lao^Z=WZ7S!5Rkrrk+ znb?mUYQo!XJq*f{;{vv30utw~z-iiS;HUeh7^ORkKR-uN;HPFiThBLh}0Qxe0aDXczaIn0E4S6=bSfjvBZ|)`^^LUGp;bVOK zffR@9W`C-{{#*)nfvvNw`ynHSxyLK|@v)-7mE8_S8jkO|LE`DzGzVmws~q#TWkOfz z*y*3cJ|{rMSUm*>KE~Pw{EWTE_W6*p-(uWI&~;;#rDV`nbG%qz-RXWcpt7}>gE#5_ z(FvSm6K}L&dn=+hrNOA^f>PaJmFP+=M$U znaTBt?lQZkWy-jzh8dI71lM_aij68eQ=tG|Zrs_>T&k~|^K&nOm%w2duf#)ev>vw0G)cv!@zCMHD`+o7Aq26y#9MRE1an@1dXg(*>OL#o?u+UXPkUf?6;k_q((8K z63R8A)sV#WLew|~ukV|%I>r_>G_wEs%4-u7At9MG^-S~k32ONct(S)>j2C^N|CI-n zQ?dan4ow`#%DXc0*3`aO78FYGP zG+3;7xs6MI+h}pZ^G+L=Pt=~X6DQ1>I`u7OIv>)+;+O&Im)+Q zll7U&S6+SZ27RN~l9@t#@LcWQp1-fQ+tjI@x*FyP3+f?n{2J1)9_Wn(zFga6Wh^3j z_8>bu%BP(I=IG0N^Mf&=7{~W?{4zz`+{#^yIij@pWxiEW+#ZG-Ey9!m6<2PUqs!&Y z%w9C}ThO*MpwRQ>j&`QZf8Y{3ld$~E0>WWQEpb?pm_&!ehucnK`xVwyv&Q;Jh=@kR zBd0yFh69vbLE!U!#`&OheZ=#%JsYii9#XG04Jx7=gag4}NFW8m{1%sUc)s995^Ig~ z_M2?Crg7iCHMydOqXOF;3!Kb$Ke3-VgMf(<5 zi!HiN5Kpaz^MV)|AJsa+u6{0(+bLb;(IhkJe7_ol@#|#6FTUswDyB1Wf~o4g9NcBU zK0^DOn@P1o+nZy@uf(n(#&CjS2Av&OzVSkD>ZyZI>`gOQ+YN2gSG!FZ@lQ=}8aZ-xl_cl4mk!=4zSi61hLF4SPi*2E)vCL0jr5tOm zyWq&Ye_Na0-+FqHl5shCVE6C`sfcy~f)sZ!UdI4r-p_Ob=al( zmoOj7w=uF(jeIE5GicCwx8i`tK|cJN>O}8EIX5nvS9@IMSPc{SS4PMWzQjg2JR; zWUi&BuTb9|kp*WUO~>C){{_?vy*@@N`U|i&d8)6Aa$;!f3C?bfz5-t4V7b5VpW6N) zP~X-~z?x*i<{8oNxjRSG0>AZ@F8PS8;a9i}DdtlE>6Sr;wBE~~lfoq2)U%4_&;GQ@iouV6IlxR&nW z4XdBF-}Dice`m6A&4*_F*0yV*{gJz@2q~7Q*8bI+{Px#xYwBbsyZ{>%@yOOP+f+*7 zBI#^*u)rG`Fjcszj3mKz>3e{dJn_GoINOS?HX9rU?b21$){vFK&CPEL0fD|lc4P9= zSYN&5-8P_p5lES^(SI;?d6dcv6ZqY%EUhg9P;fi=XWaC2Vf7H8)+Ac<&oBZ9=o@Wf`0jrc7R=;2hbe_KV{%nZ};0i@o_ z@&l!OKNVJ)BK8raKQ;|>rpgORbwE#P5?|harM(gBlxp6;suF*E_ZMLK$dk#saC@Jn zcUkAj*GeM*70@0oF;jQMnQP>yO2B#C2JggAduohA7jp0w>Zh*KtH`*9_ixVc(~#}3 zAtXP)(`5}cFXG93Kms>Pm6m&^q1SBEAkQ0JY-qXTX3uYCCXq&?q6Q}jXLwX%Kfbvg z4-afG_L*Q)%D)7;+o1z=GJ=3IujYIU^8zK^R?L=-N9iz`rUhzm*AnAps2(~h0x3dN ztFZPF{&DImjW=E?69aWWH@L=ra2JS*n^f0$L$*Nh8qEAGPPw)}?S!k2G3KNb0x84L?y@|fXGe+h+7G&im(kP=(05);ODS z4+tu$A0zl8Nm>g~<_m4xXnPpYg}XO+PM@AsP|BdB`=m+D?`P23-K1_vR7js{wk8)g zH@Ct30>ug$;0?Tw%}mjO*Lx^+byG(kCaT?Jlv$||TcQ0HqAp@uZPo4QUQZl64Vt?5 z*EUxij}`TL?_05)18at#S~ZaO@*4}#4`?K1y#H^96pl2LevIKS90rYX{~(@M z5^c72A3}0}xqa33*mS*9dM8WyC_l%=I(2LnNyF`vlUWWQ+zH7se`g(?fip*U^Zm~d zm;b%=81=80E1p0`s+wt0fK{cDcc@WyBgjw6^bZ1U&|tmUT`Nl+Aew`h+H+H3y>?ik zKK-^4e$D*zQL@AZvU^W(gi4cHyFekGJZyIXLsaxue545#K!)VKDWgNlk&HF#j|u?m zz*nGe+3AXuSK1}8#1MtM>Kr^p%<&(eM zjhVpspMliji@H{63-5lhQBO)LGlf3{iMj&ZrMbWRt;f^1zJMH$E~9rTesc_S)>ADD zTcvehY)t8ygsmmVN1nOF`8vO5ce87WS`BD^ju1{!eRiz)KZIZ`XIwFT5=7cFT6nc? zk87Xam0iqCN6Wz2O9zV__#&P;jt5~Jzb;*e0}N-H=A!F+p;2HQkV}Of z%E2|BLiw5xy|YzX=hrUl{-}!{qNB(f5HhFL8uDU8mRhH_a?ON7M)qCpa zI&J(zd5gcs_WdRU^wY=AwFfM~(Q{~?mrcQwSYX_LR43F*HFB>)?;m>M-@CSU9t~}( z^ptvoasAOH&*tETB5ZLvtc~JiDTg+*sl3(i`!Nd?Kv+=lPvJE)P7-SP$@&W`>Dd_bHoKPv)c%xls04d@y4-&fS*jm$*Jsw|h;y z-yqJuV6d-O6A+fBEWMEIm7vyVB(<5r0vOmdUh1Hqtz-@NsrS2QiSSBhTxzztb@oi~ z9{1Ok^Kylt{b)*BGs>kW&Nfw7tgIa<-~u6*S=F zQ@p$+OEIJCiV+Wg^9i(a4wgr)F zj%@>PIf;n)wxAhqCeq&vjG88|#*eTKVP);C$09~ivfl~cM34Bdt|K~e^wZ@_4|oj* zEpeaVo(b0em;xA!Qm#2`6KM^3G@%A8KinH28H?p3jADoXEQ<5<3J9}MSk&?Bo`$sY zR9Cf|LDqVKB=)=abW1~*S#9t?MAI{n{GaW0(qGzpMs3I}dy|vW3fvm&}-t zZf~`h3x&rn1(cfh!&zS@>}q$kw}M*B7Qdh9Q(2|xS(ERFsC(z&o&xuONc!0p9i+${ z*^=7(OiO;5Ukf$*;ePtU20?Q?n+~=xGa?lb%KxPOP34C~4LoKbtG+Mh&6OF|x{ost zCa0t1>?NioQL9+-pXt{N@>SWa3q9XaL1Ud;U{7&t0L}z3=dNk*CZ%zLD`ddW$@Qld zc0RU8H2StlBONcnf!IL1Kws)Z%veO;FkZYhbNPezcW%b%iTk$_Cs^yBWJK4%6heK* zhvEg>xd;#F5>Em zWoYAIl*@mW??Wa>(9w#|3u$7i?C5Z7{AKD zCQ>QEz&vtuT;YwVW#9%7cwH*4p3PELZn%GL9WXNdg0Vqe;Lf8={01geR^|nrfk2KS zQ;3xp+e5iq7Xu}Otb*QNM$&XMsoJV8g69ewI1R{3L+{1N#roZ1XM@D?UwFIr-|9^T zu2VO@KpYS$+eBJeBfm{5F;|u(VPDNudcaGzUzhSXSQ#i;>T`o>z?er*($P-YFk z-W1)}eZBtSz;zK3^=l*RVCkgzBABJ+>6T20v+iXSmwnB_pA$BBLmc-Dhe1 zDLVD3Q>$~fh6t^tc!~<)Fb~lW1D}vXe=EXWR6RERBw~+kr{55m*`Fr9B0N+Z7sT)CAEj5sC4HiTu`*Qtn9`A zRB9cGVsCLv@VlbXttEp!1(@Z%Q?^fwVSfmDvvG5y>R!_et_BiQ`4$fJ|=9dR~0R^TPH)ZdeduxirVc;GTx7yv7jN z;u)IdcRm}$GU?BZ-WX6)(UHe9e?-ie?69yMM+AKdd~NDoZelt%+oR=YFHzzMmf^ox z{08!Jfh8z#So-VQzy4B>YppevpJJbiPhQ_2=~Xb+B7&^NT#C*s^dRuK*~@8^Im9POhngA%?lI-J8+4nYp+$u#cs}{l8*rKu($)SCpoj5I- zZO<#Q>rz1^KUG*=TT_C>vaAExz+_h8OUDihgR{8xZ1K!7_sQ7UhBA-)bw|t(cLRiW zxGx1GU`}Ga!f4>_OxW>FQd&YO0ksB8XH|Uoo@_rps@F}0a@$8c zNe%nTg?(*B*BFN8N3~6j-EfnpvB^d(103I26~F}Cp9kU2G!Ms*`>29i4!&0%TJ6lZ5<$9XwOSQ01b(+OlHM=9_*@=Sr`sd+wx6l}aJ zPWhz842OceWMftKc>L{2;9j=``M*VBZfnMsvk`^B0mQwI{`>wN2WVIBh#i2^w^xjCBEQ8wjsM zCQgh^w~=0Wu9E1-$JwV0Z>}0F*gN!avX<2I^bFsgWQt3mSr~TgL}-|9e3PX5_!oeQ z{fm>yUgIbkPTD#CEFu^j5l{$Zw$_dLVr{`pJh{XdHETO+A3c)qG=%y1VtN>u4TSN; zvzB&Xuh#{}V7FX_3hp=6f5skPBt^?Y0shvWGGYVkGWh3(!Fcg_=^iAp^GwZ`xmhz- z{H4l70F@f1wGe!ky4;3|BS|%jRI;B4adoiYS3;545dPulU1)}m(5S1FHa3-nDuXrH zJi5Bql3&{Us z0YbtgN|oZ%v;f&37W4A?b(h1zqSZTl<+|)%y(q_H?(c=&>njQyZgqanfe1!m@g4gLSmC zAAhbM06M$*o_ElK3$NX)$*wbM_Q~zAZm~r^8^#dD&en?d5_0SLLs*+AH|5Cf4)%9a zPB?IL2MbS9pxRa=qtI<^(W&gheiH1b@iX_OeCc_wM9JXByl#Orr29<~<`&{TCRVg> z%Gpp?J^i6$a`pzot(P!l1|#o2fy{e!EupxlRNr;L!!kT$_&G-j0**ch zH9c!u^?31KMMmF0E$9CQ*!+6bBeq2dnKu72HMkmJJkMQx-zZ+Nd{gwHacA9v87G{# zR{GN?Da?KSwpSY*ba=+&Zfg+}9|@KDcJI=%2tPiZ|?vmr$cp{Vt&B0ue8w>L9V<0<#^ zWnF9YkQjgtyb|T|ly9gW!MMw9a}|t3eT`0+SXVeMT78J&c=582wp8-4vFvt29>aW`F|s<+%j}KU z*oJcJPbxRKbdRD7ZB9<~E&NZpq;Uf&|2df$kkPV3IUv$=3e#cHr25&8T1@>`KHPeb{ben0Dj+_$jM0V!vBxMiAl;sKV)YrP7?qAk8fP=kYl9ed~GM zFsCm#t;2MMSig^ELbKhFmy~@6UgjWV75O>-wI1(pdLk$U|8JY z(Z!vJ*DIG4Dm|c#PEoa+P$l%K6Pi0oA?}pOXyD~loNWojKS;@9hNzF5wKg;wR^`Ea zM%IZKYS@uAv?GH5jH>2)e>q6-F8$~Oh7{Wo$q6+s-eBD1H4dlTyCNB*>>tZeD-@Uu z9_}`fc{YM%p03MIqqnR>gQpAhpdxASBZW9m{zJbvA&ar9OV_IxuCir1w5D89w#s>X zdD&D60LHXI1=6Cr0zby~38(rdO%7OFw;ZS)Awhy_OG9tJRRi#@kbqzOMf}#=-$+Q5 z(0|`j8@f3%R3|T?pm)W3UXAYLtJWtxXw)C5(uH9*Z{(y}UnMCSSP((e1MrOw!)w-C z!zNBQTQmOx>gvreEB0cTUU4{ak{F!mx@3u4<^9ZrNJ>-<1XeECy|(QL@%|WoY-uHP zWDuOi&o|)UCPUqjy{`ILCUMwW%+bnALB`xqHXg)VNKgW%}5f2N+mauF=t4r!!$W985hu)VjD?B_ZpP5Bu z^%&PaT7FI#q*i&pcE||!*lXLUUGp@-4Yp9Y}<}?~i zUYbP?&(B(XAL#@8Qhvgd=JoYj&iZ9zDevQ8X!M7x96VYnMxB)VBk*+P%E{}W$esQ2 z50(7v62nyO(raCQ_ENA;WN;dPOz0{w?c~b-o5OF#4eS5`t(vB3EA|+cyibt)B$PO9 ztjkbfF-n9y;G138{6m$euCC#gOkYnS4&84qPMZTt`xHE5-R5hJ{Ch-9+Wa%|{_2J{)w})nOn58MIe-nhf>`(PSjwT|r~tGG3U$Lz z8$>y=QFp0-!mkHtw{>6;mzh+UyvFmAyVSCdljx09M`86Wiog+4}k(=o7xZ zZD{z&;N!K_F=L)5q1b%H_FM?_K2CmjNs;VZ{Hb&6mZD|n(E%ofw$~>kKWk3Suj{k$?7M1Ny+o9jg7>T7Y z*o{BVp;|ke$sYbuqXeX_OzoU6a6z^+XH;u@!@g+2GdyYQaqaf7op0-~Ax2z$eXy{C z6fn8R02{`EMuDX!+A)usc)|1=?qe>J7p}0o zs5~Xw&~lfY04R%FBvD*qV*e&#^&0v?4+i$+vsROy3T7agPaqVb#l zK_oSuOc~A^ayoV$1Z`90MJ)wRS?fDs55wpAU-~Ae|v^Y@Yj{$wQ3CQ zp=SL|f+oUMp^NLif9JPOiZKje7Q0EHE(|sy^dU?}QUT-&@Pt;?8r z8escWlB9THVM*mySi{90YuwF}I)5CC+O>y#lTnnFqMQWQY_He~@=>ehRrtm*U+#}8I9q642S8a<53HrYZXWmHGI^S&W*LOf zw}|-aPtKX0``Ks2Naj7=bH30puQE9=bH@6Z0&hyEm1H0V0%<_HsRT9-953FRJg6$Q zP0_m;nJ7YRdsuy(|EP2dlE$tHbH|13%)rV#;hbqJ0I9>jp!yO$5EdT>swj_FM`F@nmShvu5e zqZBo%%ACiyb13Rv;Q|~XBuY%wNb_0sQI$g54OLXb<%K_-tNZm1Fo%!t70A4dp-D(T z0@tFVXt*CW|13;#GuB!vC#)D!gc1ccv5AfO-IUheDQX9EBdmfcXU8NKUNp0Uztpo1`5>xu6oi0O>l_hqKSrT!dmBa6rc0ER++&);ZSIAq~K5B%0Y_W z+{=^x#bZ}N&-kSw-4hCL31^JM0VX$42RWnKR8g!p9OiW7SEg@k4z+mHV#b@H`s9Do z|6Jg0;~l75m;Po#|Co~LwYe4a@;INfhV7dQExo!jW2L|-z-P+#Ho-&{LQ_7afw#$I z6ZReXX+!2nVkVPA=?|Ppz>btus~df{HK|g03^@p!Z|#a&FG-*Oz?5U=lvBt6R^KEd zfN7c3OGBQxeZI8iqIQ-NT6C!ICS6pDFjxeISwU@QMY6^2HEU2BSsN6IkyIXgT9Q+q z3;&Q>nk)=oKC? zn~|R5!BQy;Q=Q!W3VnnHK&BjW$l(C_9sCy0sz&4Uw9#{{fQIqz2j^M$$Mjze-&rzG zbo1oe;wWNic#$OO3IOJ2ciI(dD#{DefMT5=WKJ-C{Tg+@Z5gdk_qN*AZJn;Hr=mJL5xmil;R>Jrr4c9X zsxUdP^IN{eNOpbHZfR++R%k0;(e^2;D?gr8hath3D14WCvm^&!!d^A09=d`>r1H>El8eL9T)j&%Qpg8q7d7%2v_{!K`A_%CojE%qrpJLge!cB|3L>DK(1~ zgMgIBqiPdbe|6;c${jt{>Y>o=?iMq=gS4;_MEeNkN_NqKKt34K%cn?vfKN||%s{Ra z?RNLxlp}3rw>QnFuC0zNWQC-)wL!xCQ9<39KiXM%D^^a1deP9NV87PhFlA4;2Pyh= zdB3qTpv*K7YXxBwXJ%5~&`7vS#RqXAh>ndn5aWVMJGdXu*1JNa5B`) zYkc=f;uUL4T{HBYV#Ci6yAr8u7vOOJ5+M_eMA? zjbZjd?mGGj*3~f0pXcbWf`^`wHpi!gip<$DIn?ooI!iXQ2w)fw1UBj=-_qI=C6dVX zU_ES>KJ--}g(*0}CF@%b4t5~gGbPa+X%tpeEU9-fF|(CDu_&Z;%7aW+rvb7{5C`gR1#U2xL1lf zAf-XP&?Z&dS8igfwV>waTU-yD5KxVmrjblyF7nRGw1z5kCZr-<4NG!|u4!Vydc5i+GN* zuf6x?L6CzwDqxH0G6)4dDPU!nnsVfPc}Yhx&rX;!tR|ByrhH@NZun)~XqVWM0{)6r zAUmLU#-EuxIk&P@2*Q7{uzNvvlpsNPH%OgBjqlr=Hnp?B;B&nFmBr*-;D_enLGyuB zpF1skOJn$e!X#(q%QPw~$fYDVjggPEbr&_Y^J^4CM9UIaN{aPNZigJ?+lF#fy5-3ep-}q~$=w+pOY$T3T5J5=*=UK= z-AjI+oB%!qV2--`Lcik#;vScy*X1d@*?TZg571ojS-$Gj#8dUt%D0Wnj_{31v=zCCJjWt+J~pFIGY1AwXx0n+sSnZP zBw@*Yi$%{l5W&y*W=Zaqe*v;^aAHpfO*pQcd>H3evIj;zK97q+s@D)Tp{#MhiZ^Yt z(b&P%Be6)MF`W@$%_$Q>Ux<4M z+4rWQ$CHIG>ee*WhWml~LToB{ESh4HLc2Km$qDAK1d%!?O-}0QK3~D7X9KX5`tu4Z z=Ds_*Fp|@Rq9G{GK3VR1IVLq^QBQGOOke-3edb!JkNlwYCb^#vd*QS1b{RP}p?(j~ z8$INKRqyou&W82j|I{+Fac6RM^hph*@Wt}7^#pk5;9*5xy#^i_wVz~fMBUZfRCv6S z9#PvKDWit~J3@eZWc(y%HyTWe-UI2wUwq%;wI9;TInzj3PjTi@lWaeX+z6jwpHg1%Ka zcjjnn`JY4G2U#%7G*hj6!_+a?iFqnHF1Nw>gYxQQ z64JKb&GhmJLqmvi!3QO!iMki)8YmOUfmjY&&v`TF9;!jkXaWM_6e~#p;6TkcJj}Ad zW`%9qeIC~D*FR0UUiEu-&^mbV-mTFQlSUxJ?Y*RwWr3}}DZZ_He@i>O$nek1uJ}EZ zY8Y0|+9rhnK#RkFt8q;GS; z)~f;1p;9(eg5x-LMFumu4F;UY=8f2pK*_I!$}DpJlP9h@RdlD%8UhK)B3JBZvc7%l zRLzF8oAmDTDIX4(*d~j`pH_;-)@edCJc!v%&aGTJ7shjkQUFKt)(t&uO z3P6Re0I{eFk&p#sIAi_=TvPsYM%PMImuW2nY2MWai7hu0z*b;sVP0NfsE)yiN~!Yv zk$s3bnV$C-lLyV~0%icQ_A#WOAu}gPT@>{%;34MujP4VQJ)5J2{gc!wn77GbN;}Mq zT3S(4iaiWKtXCN9Rc2%t^%Pm|RQSB7%?zsVX!Ai^lWP@0nVJ z69ynf!^jn7fX~~J7a%~E%x-f951ty{^EO6vHlf$GPYnvT^dRkx`;m1D>Km*Kx5G5R zMHMx+sM|}-6(oi zOWCWaVkDK&c!Zl|S=rZ~N}-3n zs4-U9^6KP*=AHlR_Z557Op80H&UHr~92(AtO9wdRh7pnlODF++jhE%SGuI+#j(H+q zw$ZVFrEu|&=Dok~LD_j3BwQLi_v5*gb$qW%Yg&k?WFNs3wgwl<B$+#ncEy_tO|L(Eorx(+SyAgz8cl+y-C9q#dkLriE0y#Jg=$5To#)2)?||xToA9-gj?1WI2_vGxKq-pZ8JPK#H0# zCBImt4$Cnfy;*$k0fq+o!gcp26zJ!!ISyM}Gqn+yJyo8CYe&g>Ot{es&Y!gTrR$U2 zIk=SWTp!gZH@}z#{HWyIYH=a`^=0^!)wKlm_P7t=4A-~Zq``j&n-W~sf2Zo5vZ2h7 zB4MAB#aW5LK7zETu2@~^rkOSbvPXkWugt!UAo?|xO4Ok-hO{RY2GDJ4$eQvD*`Z+g z?$RRmq6{ZGI`mjezvwP0H{Dy?GV0WrsnolcPx96Zm3V z<9gZf!Zj$9A3H{azz&n{yNf7xLUfZTx!Bm|;GPZ27~6AlnW}&CZu~ti1h-?~>&v>B zF@Ffgng=RvXvK&BVt#1F*Bni-K^Q!hG*PK`kalvITSlzkFYDS%{am`Lz%X4^wSe@o z@k>Ftm@Wto)Cs*Rn7b+#tUCJ1u;o<0e{Ldufk#mn#|xy^i->S{Z=SsN>vSJ3VXRIb zZJSc6lOc{>VZ(-H%RVQs)A7H0cnjWCN1j6JD3mo`z244E{^XJ+JJ9H$R}c}y!*%TO zz3}_0PCLj0YQ~IZE{$O+33dd^WnF71omKQ#6$YP15AbJV+H{#9d5p|0PH6y@0Q$24V4Y23Z*61(K0dwK*5Fhkk-?6J zEXK43)I`SrHme*glP?+ct@0xDajEN~;e=k&sq=mcG9#ZNj`WYUNFW0t}GCyNN zIVXGLGeR@gWl*=SrRpS06ENvF9R72)Y=mOO_3CVbw+e z$Rvc^gJL5^)MY!YA(B7G8ihS)GjTv=y6v1frtx!j4}!OYcWH>FIpHX$i~L@bM@A*Y z)ekHDw96}nR9nrXc;Cgi4i;Nqi(kEHl%Wpb{b4V@(j`zXX-gttmS#7qKegq73ZG@+ zKqv934tAu&N%w7Ufy!XAdyF}6{3G@U zIL+>C0^IR5rmP}I>w&rDEBl<*aH=Z~KIzjDKw%G#m*l~KE%LX|?S*!8XJS9q&To@G zdUD1s7KW%q5G}UUzB9G}uhru;lVOrXS|2Q0rlAkUv7ME*<$)D{D{`x0sZIeZY%1Qd zIAn=WL+rrwKhP16&3{K|8G#wiTrw5XtU6eM=Cw)@WV=PO455q63iQ`&qG!0JHR99z z^mef?pUd{qztAFsds}ScmwD^&tqClO=Bh*8>pEI&!q2eDr4rNAn;O!DL!uU%K(c&p zFF$b1<+u!%ooV{xC`8dlOQ`q+O$OUaJxKstou@ zz%97&Ru3<{F42EX#w{U8z=q61DmVkm3fjucODll{Umv~o>vYnaaSCp_`#`AP&Ok|2 z+ZAK-G=j`*x7T1*Gs2s4A|oR&u+9x1S?X{>!`#-vux^(gbz&x67oB-A(6$|$ESFys zz#W2`;yYdfa6~I&Y>wIhYZY|38L{b=WO zP5696#>eb*TkO2ZY}BN#YfIR(itq-4;`Z-pNH@ne>T2F|Dlti04Zx|FbRgxkAZ2}! zu1*6ibK&An?WH5+@#CcH-9U~P(yLq=& zqdWcRNy66g)a8M#?skPGNFGT9U1!9`U}FxFK+IA^4}#VwA8-gCAtBr)H=g(Ud>+(EilKKk5_FL%&4+7@d3$lRS58Zj;a7C`T}v+M75+ zHc&?dKL!ICcmVdB3z#mTAo&5^_ZW|p$0qN_lWdc04I@r$0Q8-=2$(L#f!Rdea@~nm z%E<+-k*M|&0@y@6w6as)a@uYt_GPMaNw<8(BEhL0meTNQ#VKIDJkobBYN0tyZT+u| z)@*GpXi*=YL!S|g6*N2+R{m1dTtSk7X%nND>uEi6Yz;2Umk+%T4Nyt?lv%WDjLEFN zSidx?c&mP@lxUW6Y?(~(d_^Oryk3xa7c8{PX?ABCH6t@R*x%fF6u2YA=Hh=i=BMzc zzDZ2PTi?1A8&WH4$`M7Tw80GH9X@x@qK!D5SVO_m(|EC2n{uJ5->HnKQwKam&U2mf zFpo?FUHP&Kb2qb?{Huwhjt9$uQT4R8Z|BS>c8LPv_29WoGdE24&H_4LqckhT&M|uw zj3wDiveSG|U-awt@AyLC#XHW$ERIwHaU3k;mqJofL+-XEr)vdHm1~`_0ZcLzAzkUQ zrVt6qbi@aQlWv$vJdh>b>jswX1-b%{te>rD2XzyAN41FX^suA|7v}(a=f(1s&GNZ^ zv|N~pE=96^`*w?~2e`+Tcr)(_%dPjX&~eOW8>FdVex8WcO$kGTNKmRXe$;VAnW5Qb z!R67a_F3dlOPtEbzg&aETw;F6}f+C$LsIy}qX*!$0$+UdYr#UXaE!k*=u-|{jqiQS&b zUI*SxubB4`nvPFwH;UjJ5CGE8ujL18wKuqCWLb&lcVmt{1u;u60-R~aDveLn-(`41 z@Q$6ab9AW=yfOAQoA@KPPow9)3}n?`28B8Vjv<$;5(8#ysZQ7C^qUN<357z%Uu<8z z&cvy_wS_9Kx8EhGb5I8m`uk$FL=Tj)1+(|CL?!xQv5*ssXq_gl6_+cAb3WwT;2hh* zB^nP!$a;_fS?oa_T!7==ZRbOVKX4*rOii@D$v_^P%IK~yCFFKKiMk*8<5T9gUwdhc zhf>@Jr8In0Uif;rwwgonNNB~%a(Kfibrgp$2O=`5vBHQJ2eJkePc7~XFFBBo>7QZ< z341b1;S>hmc*~5z#IT;dZ}B&rdswOtU_F=M>~JlUO>e5OEU~|#SiU!gTCAB_Y6sK- zvu*IKlU?!l#gBRzF4^N(xMv0rCFfe z^cBx!S({@S2Obr{MK$ZtXb=uVt>iss+|emU%b6RV%P$7JMm7I3;xNe|tsns4gJE2i z=zKR**qzwly)?!LyXS*(oox=yQ7w0Q3-HhPGNsOEETZ{C}26#Xk zPjhlcZsnxNpPY95cvx<@nBR7r5zLS$j-PB;kEzJ?OU6C%+gxpDzfjPtRkMaE_CXd6 z-{+LaV@nKY=1760jlUk^jnUfL{D0V0#LZonOlgJ?)+@h*cq-Pm(F@PHNwH3(zhgyy=N_RMQSIF z|3p6P9G_x1HH{sJRZIK8AXM zufDVw$}eymHj|3e2&P^GcE6o5K}kQ8bTY1q36JkY0CoAF6lBqdJVTbw-y7DrHII2# ztPJtHac4h5snD)Qi)849=FBnS=e(prI>V_6>Q`3U`0(%)pA=lhM11mzR&|XnE;cp) zZMA6Foay9p;uz`4?$O`#Cei*GB)E{M^SyZ zYWOf;j6Hsf>BS=S@~R<0&mo3gi1mDW_;WdPG zFV*R66j+yLz-~r?UgF{Tg1?+xjlgl5rcwI%`9Oy&<#+tC82S)D8s>b1PD~!9;a_jh z8)3||(jsgkj@#?rJ*)E5!`mrF{|z*Rr6G^+{DkesO*Yi;$Ng3e6+J#cow&+_nKHPt z(?N}y`XYlAVdHpM+_d*1@s%n7vrqbMaKv$qZ59ZIVAsl3TzSJ8Jg6!hVmKk#pVOS= zaeXcEI;B01$VVwnU}JEd;VEfLO%Bhafup0z;!xoB)|6O3v~|mOjIQo~Imxk>R$bqd z&qFb~D0w*LMCli!THwa#A{0bX5OPHtbM=nYMcf$E#!i1DA+g|NI{aOco{jH?Oq9T5 zN&P{Yc@tSuG=091KaKl0H&q3+av;HaBAC#gA>cp@(Lr0czd-iR)TE~Qf}H)ObCPC? zmse?&?42IAhnObohKrw@jaR>`%9|8oHcnc@tgj(*z86X`BDyI z_t`#rcY^nz?lft?!H6dtrSa-qK@O@K?6$RuFW!O)*veqv+d9E$O=r4S&7a3aNIpkK zrT>WsESw3nlR#^`s>^e$gFT9kT2&}GHjAB!zW8w^(4B2N(^VWn<0UQtj1=ivLgng#AL&Xy+V(3GyQ2#D#RQ3 zIk!DI?i%zwO%=leD13OEiPX9=lY1yjrimT-W=a{iq7@T4MDy?rq5|*?`e1ze^E1meLQRCWkB!=tZ1#PL&|Yv8SZr$cK)rlc8~W{iJa5vTU`5zWo5F}n%?q>Y}iJu$AI zt34h^m`Zo>HL=waNIogV%JUs?bF%{0XIaf0Hzk;+4Qc1C@{2^)%!+o|kvyikD-3-wH;#KGDLJ}7e4?4_IRr~Le=tzy$gj0iuUxpt$w-+sh`; z^T1@0vB9I(UD{2_ieH6x2^fI;l>q*tq&PK3^q4T#$!FP-=P|JikZKfY3 z+eI>v_EV>J&2p|unAy*-$*+Htgom@#-iYwVeX0AxJ|uOL_b)(!nW#R-GtyWF?Ehq_ zS@vnfD|)HofAX;YecWG?YdMK`2+tj3XK3xWue|`1s_)#iCj-td@7XN*27jRH`%jn) z_zou*mhPf<>-*kgI#e#k$cbM~h$Ce1XeN??2D_5u6!-NlNhMQ@-y7#4ebVi0$`1^i za*9JbzBzzjFhOc%v4>o*w%EEVWjDXZ&gPN|>g_}E`jLHMh1)k*1ynAJbXJwPdAFV8 zHy0({KZTE)k*F>$A*myXWDWfZp__E5Isf&mzg4==pAp6J1U?+=rM5%zUBq+=59q`y zTDzJaKaSvU(@Mj2cX9)9yIf<8=f(PG^GS2k8FMd@u{U}!XSxMrX2-}DeRggsj?HQR zT4|B82s^C?&Y8LKQCkPTZGyAO(A}523rTL88~L`3#Qv4;Uq!D`ahi29U@TPrl6*_y zlWR3Cs=(eq0!br@gvyUCqb?@zFA_tHPNHG?gbHnGcLonLZqQ_M&L-!P`Yc+RY=(0; zcJA@-ckh*y*#4S+#=adC?S28-_7nYw@&mYWm3zGntvYvpw=fjZb$aJMH=csJX82-S0qMgxK&EPYGf?nzknT zg2HYGE@DDm(1#Zf?zPF!1B#pzw za&$(4(eMHOZLHKKg#RVd*X8;qHh3qGwRr|* zjY4(^)u_bL=PyY)+KNnVbWeCU>EZ5yzy3{j|6V#h_Yv&m#J5fHz}R_lQ1CB+v7rMr zND0-aSys3J^$=j!kC1)ZKOwZqL-XS?q?_ob7K5xix{RQ52|!vU97&+^mg4)o{;P8P@pt5m%*Bp*VEPiC0QGQ$OFok85aiQkC4$C$sP}V4T>YxG#A==_3`Rjs`v?Bcb|t+0>iU{IV>n3{Mwt z%CXTkr58zx0OD33AMZ&uoA~XD|80yDsS2V)tY+f0>I~Du&q1H_RYVR=JXOB%-_uu? z|Kzek`efC0S6^6}vp=OYTT7f1C)QDlu`P75U`Bx{sd!ZOy_n|X-T~IRbOROQ8(YWa z7gG%x^1mx0;7y&@LD1tX=R>Z!?Rc5+)6s5)q`a^y@06!@;H%wBJ$#!pCYo<&xOEvm z>5jcCj8%O!3Rqht#W_Xm2{d(K=Jp;sC`|*8V}?tUP5Ke}6|CQjaw>q3{9YI7YG=AH zIeBJZ#F6#!=lX=-Vlu|#X(T77QL!PuItvl-mmAb)fHPJ$X1IB<)LX{o(HjrA{7c{}4ta6LAU@(-Gyb}G z-$EC*S5obl|78H=u;SjuLYC>%S|6~ zEDBXc_Z}&&C~Py}5n(Z*t7b6R!>(CRQB)}Jaj_xznpv8hfuRpsp!*LVRsBv|`?_^V8(V zPxyR!zTko+eN5N0lPNt|AW6I?wX!kRA?9b$u&uD{?i2LyY5`o}U5b(EQM*#1@p;x?SQFe(8ez`t z>N-8R47IH5PgfK8{m*pD`nE6F8*%o}DNq;BdUDQ`&8LZpdyRi@KcOX3Rb%|89>Dt< z^DjX2%O;PP_2S{hhiQLuukA)r7vaYu4_(IT0TI$)6W9sRAEe@1VUXm**Vfqu-{+{0X*t z*>0Lcm0I!hV9&|P{X&;8HsdLn(!~C13p;-3TciwgTpMV+AW5*c7KoG-*aBihzyLk< z8ong#Hw_EWrb<@Aa4*~QRQoq+zfr@Ij4BS8bP@;s?Q3va@S&tWl$JZ*bhBm7 z7o@PSc!BCkJvLxf#Gtg%`+^N~de~`Pnt9aUMvf70Sl0Gqu9-%#q`YNy==y?lMvRa9bXf>Lp@5vora0r8(^2EoO5^n4__>)r>k zMT!B7XF>P)zD#9;Oh`FUD%Em^MJkmPKf#~~YBo*xv2&aM&(9>qzTup;*+7UOyKQ?- z9}7dYNVL@LUp`?$+6e}Ur_D(vV?>LphiV);V+^@U_r(#qb`aQWPx5^UA=eSF5fRrU zdJFaSV_bT64-&u;q7>k#_nTX{?Mw(By|cAfu4SpM+~mTmO8Aj~Nx`QteLx(9tvYkB z@~x@BIg=3HXO>W5pT>(FDIxu+rkrIHa8+Y+Z(gAm;Tgc*EUz7JBC1X6yc1*W!SHO- zOC-_n=xrU$6Sk)8>uKXu-XZy%fBuU-Lv)}B#ynY`gqH|mnfr!-*0Hr{?q$9cekJ6! z`_WMEty7r>y0r?m7^W%E)m|&QDoz-iKAyINBu{(oJ-OKe_Jsg;Fcr;mhjMw44{ex2 z^FoeuySPC`vwFJtAg6B!&s`~8ZHn1%k+=Le6R~n1$Oiz}XtHVE2(ndZ3$8F#uze%*FrL?o*26ma@`2?i+QQ54lOhwR#?h~6* zWV`f1unjAqzspE?RoW@1A0caT`+5*`DMvF!5vyLy0e4I#IZR|+ZMSENt`dwBqilT2 zAJ6a(> z=wLDbQ$=8(r(e|Tvg2JGNO}6Pwo&vuHndbT2gE#fneEu9XOiIfzdTYQ$joBzkkcM) zt?h9yt~rZq?C(`g82mvUO#BDDAqEPvp-TDldRhfmLOW@3Ba0a|{$V4`A?4^mqGrg3 zG2u}s=f>wLLXoSV1*9SF^ky+GFUjKTyrb&bBgo**kAT*y<8#*QTfJos-c0#27ozpuN7ES$JOWd-^nk8DK` z$IlS@-$h~g5B1iY%lBsQm6G@PgrcO+QgNI5?45SsU|Ag z^#{r+%b@0KlOwh!SOel4td-h@F;7J?+t0TpP5lU&WpL)dP;BS#nn@R)vnH9gcVzP% zk>VpkK9qP71$M?RsNL)f6u*tl4a&lR_^6Vd?9pzea3+^5kEd~@GGlg;-bWTS$XxAW zl*{14ywPJOMQN2d3%H}lx?TL5E|Uc@+mvRm(u`9xOpnYV>JN)`D^@puXkK6;@k?Ue z;vb)C+>JKXJ{jli^+>dNweXWXdNiOjlXr8X{|iHH6c6dlgbHMVs!C6j%yzmhVhCF# zv0b_+<)n=Sa?y94@`JPUHKGUg_J`LEmP)2Y9LF+V-Aut-OfJn3U`I6JXMrPr7*DN$ zHi~mgB{KWUyQz-5Wlw=JOvBE*?05Y6!Y}iKYmA!>7A|&fP8&-@P#I*Y$a*1Jqu}urr$I% zlUoEun5MsNZfwYOG%_?rbFz=%^I+ks4`NLzIb)Z1S+b1{KVUY% z9Fa4T3ZRzZA#cO0U)F8S_4B~;S+3cI--_&Jd+6oV&~k}2wl{2@PW;`HISalxWuWl-CJetjEElURPjlR*Om zY{+mKmZFcd8w~Cq63Z1YLpWa}yNYUf( zz?}aB?`SKH%lEms2uvLtL0iXOoAz@MnFRYH1cW76pisFco;hqzV3E`&hRsNIeA=DX zHo(87x&O#>{|}x=?5ARR=)qaW;0V}>`(|70tfoN~3gM;5VklE}3RcK~Ll-B!ejn zoy+UTC{HWscR+Z+>kz(}CqN|Z!A(7dU5(XKpp65~0s#)e5b9NK&~NmtR%_ZH=JNsRe;=)Z*#% z4oRzTj)>WsxAl9|Bz%V!ayM2n?mD3Arg>}Bm8qEsu;MVn ztcU9Bu{+g9|CaAD<*i9eyh+rwvXJ+udwIL@CQX-!waHDh=2meDZ(7?s(c#)n4kr$A zDMo_YwS#_nrq(mgqv^SM;FUJTvIZNnj60fvO)tyZk}2iQWgA z=+-7}2b4K%{w$dPMYYR`$3{j5CFxXB%O8xgJl~%@$W9xv(X8!cc}IEF&nFqhkJP98 zK6+xU`j|0Nvev3oM)OSdv;P4o0Hdf@<|k9DSeme({YvBl=jky4c*zk1yv-tF{PT@^ zPTcti`Uy-J)5;#CB(;uTW?0V1G6q7OC2qeMyeb1gUW@f>?vQVo2kg*$ktj+|x&D&n ztqpQghtJf~nM(?=`gn$+xYK+FlE=Y#luDcBazR`Tm~{s#URkx06<1q6IYm9ikj!H} ziWJFFy8u$1FaOxepl0U}JELpM9GOcVUq7DxahBU!g*?vkGA~SB_Cn-UFZPTpr&v{%m~&(KQ$-H4oj$KuZXnM z&@x=!l(wFh!JR72TyCh$1q4ZeJsD4ieG~B~*Sh`=_-DzpogSBlZ~TOha>1jKYHg&? zzJNET!#Cz*w=v!C1j~8RziJ8ykY6>*X`bJcPQ9qUK8@urIGT zXE5w3`1jbgk;9Xm9aGj-pIA1C=I(Ly`y0lAe>>s-Qy74MJK_IB7?=MrrPcqNF#ZjF zvTgdH-xA;ZYt@V|m15utwbc-Q>VMTY=1a<+_Sbnx#57(eFWz+s zL8PGO%+#`0atVfWf*y7JMGzb2>+eu>115 zL9Hd_h3R8J;<@w!xN-fL->Ue-@#34%Si~{a+BT-&{oZky{xNr;u7^~0PA0tkPaCKs zs}1y!#kjws3$iPxw}|Qio=0lX($MZLKz}FnH%o-bor|}$l}vc0xy(SnCLdah>+%wr28_)?YDWK_!@g~ zQMf5cz>snC)36I+jAj2W3l^$w!!+QXo3=G)=^1{9H&7o1v2tXqUP11K6Iy;CD~f~q}hR3V~ie`K}Y&ny*;LX!_~oTD$#!^&vcpR^nyAWc|V;TvOo z%B8CU-|1h^;pBR(EoY<@^ z)ycVO_M7b#)b7(+6?g_;Ys(K<05_VKBFL?4nj0$y zWZK_}@|W5^2PFGOP7HH%MM~X4nI1-Ecm;s*z)M@rh-_vdjc!?{mvq1CWXW*r=W5Uk zILO*ucMlI>*SMj01#a{RL>+(HvGquao(Eb(htLbHWMY`2f2F7J=Oqhw#SP{1T2Su- zCUu0R2cLDU}?y?Vzz;5oV^!;l1bca3mSsh z5?M!;bnHQ^Qr#B*)gfvLg8X5u)h7P}xUUWPS*@6|O>hray$dps)Q|4)&H;RSb@~@l zSG7+vQlVV3+{Zci2=D8>Iu_R8YJVzfp+cjKs}zlkXrk8~A5|J4Mir*y*>9cVhs>WY z#vflEggeS4*jFH;2r z-%anP0IW)=wa)ohhz_Wla0wv|aQ{1$}*<|F7qh zrL`_2MXs4XLEsY$YDE9^5WkN{l;I5(|8M&E`yYZ(fNx+I)q>w&pg&)NtZDPlwV~(g zc*kFn8Wwlx%Cd}bfmDI2lxKEC->9>^Hin03CL>;7$|O1Ue$rX+JCIqGM-as;T&-(2Bq;|p;XMbxI@%O)~E+eskE2xG3?ZVrIRTAkUNX<2zq>=|f9WaUfH6^&ggdtQ2LUj_XTccORCHPrtsHm{4t z;bAtTIGok}-5ck}KXxs>vvgaUb2gl)$|sog`^q!& zj`10sI-T|($maYy)lr|<%mW~jY^^-{mifw97&1@lBq=2f`ny*U_N$I^@w(}nDQtG- z$jv{^R3`}A4MfA>4N(i3nd@*Xwldob$sbhN`EsZgs?^4n=O)dcMP3^>Y-^#!lNkgkhKMfY~Ca{~OwOw<`OMBZt; zexZTfl{nM*_`#*F(tfE!q2;UQvOo40f=mhjVlm7Fm$;hwxo}?R2fC((4??IEerkc; z+85VzU!Q`r>~JTG&M79ZZsbkK_DSN*Npc{tw| zaB^B@Lsmrt1cKHET6^{uA|<7p{Kn2~t}pC-_%D*1XmZDNA=9)6CrtbwQxJA38x(LNlq zIWpa5SW8E~HHJsG`!t2(fVQ#j#w+Jq;(MZnC1-cR^?Mzl#piBqO~_b3(D`X=gO zdx|D$>LhV=A!?5dbXyR;!}NQp6Pkjbt}6H^wva0K0Y%DRA+FpHmS7Nz5dcO~YAdJ4Ex^h-_aQgCFB_5@P9 zrr`C`&ppEsT>8bSv*^QeHMZ6g4;q96pZ`S*E!m|bs~79`jFdu;ctQR^Ve?Q+Jat;~ zYvEoaRe{&Lk|VV8^IJNlj9*d$^6VLsCnM?qPj9^c501x8;JaHD_mxXpxo)IH+D9uT zC2N7_ZNmeN+gfAMn}%JPK_oVrnx7mKF`L?G4Bzv~#{<6K+@x6nH&-VYU-xACvI-FV zQuZINHnw72IDtZtCnj?OEMXq;Zdv~B42jWR!GHx21(t~AN@q<#oj0HP;6NJN*0=Pz zsOe|M-_E!?aof!Mp!@pW3H5fGd{OBqDc6iLBnWU4w(QRaK zNyEH9qe#S(7-2Q0`xQF;^&brRPUVckv!PIb%JmNLj(r<(hfc%Ojm|*-33-G;*Y{Sp zTp3hCXe^HC_tD{gCLMJt%u*z7`;oE!{1Zl{hyBB$lvuQ5x<|++2Ri3A<`C|^Iuh)4 zBXqPZ@_Jy=bG6TjordPJYEBO?WAU?p`+-w)`+^wZXJ-0uIoqq|`0OlsObTKYZG+`< z@katNF2@(a8za$c!?u1YX`sG{=!EHD12eEI*U K_p$!9{67F)5j!LR literal 0 HcmV?d00001 diff --git a/windows/deployment/do/images/installation-complete-7.png b/windows/deployment/do/images/installation-complete-7.png new file mode 100644 index 0000000000000000000000000000000000000000..8b1517348ad68592add34fece28a25e5a75adfb9 GIT binary patch literal 60113 zcmd43cT^Nz`z4B^qM)Dz$)H5ZNY03WeM;UexAMesbFPAsb`oZm}qEd&t#+}RMF7T z@zBuj-#)$%w8Zp2lLbERIjBm#M=Kp7+XlWoFcnh}LqjW%#Jc|c5cvMYR$AKu4Gp{f z?&n^&O};T2+Rhgl2{Cn7gS}=SOY&}~b78re@{>Qe+_tLoQ6agnXfTO_{U&<6I$max zcQTlrM)G~am8~Ah`=+p?K#?7&t^WRJM&|35t!Jur2TWs+X5STb&`6MH;4srg;HrEr zSo}k<^WYIC!;keJ1Cn^{H|M=La}9_5oRy80jli#S)?SZ-LkxdM7iX7^fygw6je$Ky zTd2Ov6QH+fXv*L2-H84@>OoHcZWRsfoysTvdv^!;5C6Yt2w=&JHZo;n9HJn7a^ES7 zlE4W=Me9m_Ro0Fe9wh%%7&9(&xs#9PR1`?@707z zse`R;m-0}}h-7eN=SG7lJiwxLAzdU_%H0^jH^{;(`%Pq2Pyda zy%$m~U?YuF1~J=ZQZ|Z)vx(Eg35q<((rr=tHXaXZt!!f}S$r5$8hI6^id=Z)Y|(f> z!^duDDw@hbHw7@wl>WN)PJl;~|U6Ay`zUb8+C0g6%pW)|tt6nEZ0Yz*^R1&wY7=?%T(pChj*I^Z1XL4tK z&Nf~PG;`E3E3x$^FwQRgGY=my3Axyw>L|K-Bfx1+|=x zqApu6GRYfTcq?++c-2|N=B-A#?@fl>uXcyPW?!QT`z_cT_J0Y%KaTDs6_9xG052Oc z)pt#${bc_vz7rX*>D8w`=GZzaW4HZ&{Y^!8`xh03t5`lT?92Wi^k0p%1UO7uV$pyw?U{*Ws9 z#V>)$WS`5He0H@1t|jA_Qs7j}kgl64M~!7poDi=_@?kK6q0LW6=E$IHdnV1HQb&E5 z9;Q-r+-abfs{_hkJgZoFtff5yCoYq6dz15@9VF(_v~vozJMVOO!8Mh1?yrFnrxlEh`>Xl4$cI2oD@sjMgJvxNg%F8EG)1LY=wXGRKD9Zs6I6bsvzc_JG(&%KUf$E2Jt zA`hBT*GoPt@&4<;0$;%Zfv!`0)PnZL-H${Hg0TV!*RRz;>f0Y4JvWPs_UJ$!+6wKT z4Y%CfK+pG;ejb>WUavM>r=QM1e73!I&La44C#uGNY5Fk-RL?ⅈI>Oxk{Uc+v+PB zk2}Rz3JhdTa57x%u1?Y~7M)%$rDZ-^E_GolbsvbPpIe-t?r&u>tx4lM+0AflRGo&y z3YYBT2Ffro(Bg8NU=r>rPS->Qr&W+ILKc$KX0^j<%aaNgIX7+uqxNIVcHNxzd(3kW z?cL=t+}6ttY?z&NDD)~=71^)_Q*}0Svhd6vn7MwROd_^Ab%hPDhDjL?+Gt~YNruixEYs{j2#d^rh~n{jpXy*r_mO&7qh$Yb{LOmSTi%GRqJf zfL>$v4K*_4;+1w1N{Yw!xl>>GtVt+Mn6fg4G*S4yE0S+NT9kH&wvr!5Y5(!g+GclZ zV~T`b((EBgW_67Tq6xNbS7ACPgZPSC3Vm*{VcH0(n3N@738s!g26{m)Z@V;>uphHm z=bbORP&j*&5GvQG8+Wc;s@t3m+W`9dL-fNbh`?H_ls3yvYMvHmGdm(Pvgvje%a^)tRTOJ4$96k6KN-eV zJZ8*}Sl}F6F+L7QYB}#Z=H_ligY>o8DMSYP4-<~E``Pp%=fP~|;Z7H)*+J`jU~s+b z-pYjh^Jf*H>(+%C?w6&uoT%l>biv!{1;#pNd(Ah=J`A5;z(3tA;M^iHI+d(bZ-&?? zFHf${=mX)-sFT^>#t-{$hM z!;U+$MsJTd#I`fL4LLEfaXKBm^}#|&jNLBAC|{-RlBZ0lbhny?N;?)SlnSX|x1RTN z15+?nXuF|rJcNlt32DiY^Lhhyv-~8RwK}@5(LBK89kjJK8qn$C8diGS z#_LzSLUwyA!e)GJLw41fY0Io=$^mTGXd?;j2@&Cv5UvmpCKbU$xNYWBf(v5!&CT z`c9)u4f^jlKVl1tSqi4gcehbU$2(qO8$6i^+(2}WD51UM&CtJRi`AA8i~1*vY*Odc z#kk8EZJE&e|2Ad3`JH;#fEIH9e{+MNCI3U}?jeJTRAHVh@&4yhzu7bW;E&Y{;|!i} zWw3n6tz$1&=!I3R!5u+|x%onnPFN(HW9{%K!_R`c)M#kmtn<6ysVJeyZjuGheINXc7^B2wPZu@6z^BP(gXYuf8)7>nd z`W&i|`A<_bvFxZfCJ_rlCaX!O$2m;I*x4a#^dX6na*A5WqsRaw#?d2I&TU+{@_k4A z_=h)|E37fFsrW`;hZlywEFRFWy67)?Aw9NUK~x$nCJdhz!{ZozoRX@^6Jlan!AZE` z<foB5W@LuB@ps6?U-?%f{9> zhN-VO8=pdX3UU$&%k2M*8025wyVa2A|%dXhjB~MAi@GiYDOj>LR#1ZG__oLya-4Nipc4h=Z$Kitp&)QLskzC=ySSi7_sf@M zk5WDXU)wruIhBf3S+y~e{c^GA(jmkvhk4^7RU<~nEX-9dc;ouLv8j@ zDOaz`5I-%;qK5*odLWEo;cI?(&l?z5EQWeak6ky+l7iUg9zTq_7!MpSE!aT8S4%ea(#TC?mzH$0)h9NZb*q&ZRz2P z%xiRmC|{@7K--@ZEKf!LFfu_>7IBrs0IhmM!n+vl^^lqV?(g_JujifFxC~M5-SK0| zkXo&+Q9?tTMyQ+dmuF$ljDee9?WClVKD!~8yWNCL(vOFFJvO7a>z!ePyZq54#bgzb zOB@I;aBt$(gPnR@GZ=<~a0%*|=1rbSr4PkyMJk$DD2EfB0?dS?gh>LPlgtJM;$-!W zlg;J4Vk_kf9^ zgQ+WGF%3TGzD_$FD(<8=8XN`Ix6AhsAVw5~sJ zH5g3ntM61FRYJd*t#_%}c5hW|yGP;p{@~$?wh9lZr1&yUyM^2E{>i%$8-h~lZY33F zGBqfxeEvn)df0;j*ZE<60dJgW|1Z7%m48(3m$U2k*X?;LZi&TQx;9wgka|WvLmQzb zK&H+wlJCe$L93}lcn6}4#4z&?=1x_TjQTG3#+EsPlt^zVow}N2e)yk9@@>z}$vN%X z7r8alhp8%>Te>gDEHdzrr0mRD{@hL$>~~*(?bL4;79MW*XhW#akJpuaHU;;cRd>y^ zN*fja$lj-KVETorPn3jp`dbMg)oJ(FRMHAqd;j6h{zb~#{BhyG&`TOn`JejMhZM4IyNN(x>s9Y z>Y8PYKaME>WD_k>;H;OL`^qIhoYml@D#Q{Y&+sIqg2hRzDR6CP)t+<8;-%{LhxMNJ zrT)0N?~=l`p%y8!C;8yCr;T5s*H*6>O|{?Ve1*eJ+SMXw?2kGQ&FMAuj_Y>%#S0v7 zlo56(9FLyow8d}J%>5Q>EItoD$=&@bI&(psq;D~DZM}08W|}k z*$N6IDOaRA?7Y>*KDa2^?+9k1(DJHhNGwf1&W@$Bs*%~%<9TaVE%hasO<(J(ywj#r zgN+}d!G{WYJH;tEMYD!E{2coo+0j@D4EAh^2*~3?)~Zq`c7~tt)OiXgl5s<&I3wJ4 z3QRZhd8gDU3T9$)Yj7eB%xFsUh-eH#J0xdSWp!1(Ke90u#z=_;j&E!`k>KOR3c>Jw zIvwN64t7VE6q)g3IZN3va>o&E2dQ#|aie%*Q^W3RA|&dyD`Bdp+d6CK%Y}qmt}_=N z7}nT<4ss0?x!?1_=Qn<&yG2F2#scAo(_(E%dLAUsR9{oKq$px)Y+uzs9&=e`^xv7 zgIA1JT-Iq;^kdwUG?nAQC@#8XjO}ism z?fMLw$D4{Dp@owK9NsNp(D=%(%(YoNuX4N)FONAw;90QAut6DgT|Qh6T(RP<-u%2N zM?mkMJ`X5uJOV$O+8cHur6SlSsqeRbwU&*HwyaGZfoyZ`%n#I-PsZAQSZ zW=0!br0Dz-7ePK8a;DXJd&75obIHGyGR>QAal*}(Q@MtDC{{DOtQ_^$ZtiBaWE1fj z23#q=iW0y&FInycyzQ7dl-M3JbBeZp$2bW2?UnG^ncU@L_4l^QKL|T?b!%Lta5^K; z(18SnJsz3*$UMtS{5C>4B41D>6Jx$W`-wo+Wxn1@tuVQw=g(*wFMT_m2wNs^{?KeX zJ8MepH5rPA-y1H=cFy>c4#M@YcO5HBSk|#CJ7+HQOBAj-B}&8&ACSjF+7t3C_dO+= zyxt0(CWvb)w#9;|$VD|q#v8l~rVcI)-l=r<##?GhFru*8=Tef`Z~&5RDiq=g+=eA7 z0ATyhSNn;bVEQ?4^iKbY=`^JfUQx;%PxVq;Rr*@2{So&{+Jm23tyHe^^HXChr{^h$ zfydKr@vCl|mHYQby}RWslOX=9AjQn9~dMl;Enm(;Yc^N`a6B+;BaWIj^Q!|u|b7CL&dSKT{UIfX+3Hq zK%%9%u5U(z%|Gv-I|N34@$!8NJ{qx7u_7jO@**eWEZaxNcc`dmTQLd&@t&zS;}e*y7J4!;n=FSASW?y$_|jhpQ!8TdJ`?|1Kkx%Enz>u+Xk`?hCz$RDY4meYBQ zeZ~0pxxBuumP~b1)*^<7z_+Rq!_=FA#mXw`H9RG+go@Tx zdOo4Ipn{^#O{R!ShhRMx=ym{$H&ZEmfMK)kSg<}Q&72o;&w=yw`;1+DWurH-78005 z(;re3)UM30pp>R^`Nc+o4TvRggQ{jD>i~OP<8uFgF=wvHEQt`VptA=;_)Qveq)Jmq zECCBFY$p-~WqhbiO($j~USs9=9hI-f46Whhd3SG6! znpj!#I!GWvxcjoIJlT9@ftDntMxqp zDH-;Gt14L291%q2N+X=If#st;e@1^f64JmM$~5m^THZH9Y;&9aJo1N&C)X{33#~2> zg!RH*ieG~1v{%4QN)?ro;=U?R>9HEU8*A+m<^ylbkb*n$5G3xJplYG@(!H#2^Kymk zb&fmIJ2k*ydsYGnUiSPC;S)T^>qMiXAU) zBOK@YaDkCNjc4t3@is1_-i@ZIjYVgF`OU`@x$iDdbqs$epa=O-DaV3nZgoKf9wOw4 zm2PsL%}n5Yviy-2+JlQK_E6SPImP#he$pMwG2;Z0+^Hqc7=F6SkIaCE?YQ@mnFi-p zEJ|%82hmFb%{Ni6FJh*tDeq|s(%AO{>x#Sw!1zy00KajcP8RvhlgWG3rZ#IJASJ!F ztmy#k9SOw8KL_XuYKY$+%h~*;B)}9wJEi`eS|~AyaqJ1QXZ%b0G@^f0y!#89X_z;Jd)+GdwJ^SdlH?!qxitC%zJhoe?n2seAzj^^nn}WD|8GcQ~HeEX#|S zj>PXhJg`njJAIr9a7}#DWFk(v3sbL)d*l8po<;x5if3@ph%fPR)tr_h`9^~km&QBn zShZIeM;fNzjAMSI(>TVq2+Xj(?dxea{ulSC_332p2%#%5!eIU15qT}?I z%2_JZE23p!o@W(DHmL0@PX*x`wDqMkE+WS7HY8>;#D@Gcw&lG*8oC+@!FB)bb^rI3 zEg+4ql-Kakv*sdL3Xn6I@!M|=-6iE&)5xIo?*l3MUTG?(W3jMX2pNYCq-qP;nk91y zbaQg0RG|G(7h0n?l{5+~+ce(n;Zj~<1q9u6!J#h?f+D$j=n{KKR99Gw;XzYB0>fj% zNq>!+qE!hH_K*$~jrvXKN2gRET{UzlM?q$l62#q-|C;9V$!xWaz%qOXyVa_S3gZS}Lsab4Sf-5Lhk=?mxnV5cK| zVhX93He1gnpUa0$=`x*!8q)$#<>jW94x*sv&Fd}S?AX<@fF2d&$e_Wjbn=>hQGI@h2lb8_DzQfsI?0$mpSBZj;_-YMc(vjn^9$gMrSP$YR`OdWjA>rcerhMTDO)reFQe1*!QqWKRhmswP`wt0j3KhU;JH!*YYcqL z9terz8%I&i_@LXk1`&B$0P}@V?&XH@mG5f=yxVjldmWK%<~TF(Q}|kUVGE6)@A4mzkn=e*uZ2k4WQyqbtrk){;#4PUDrX z)g!iXgxS8Ju6+vswC6<*H+6{wyEMCeJ{FL=NV2&o{5H|W`TmN15zuV~xQJ1Ih1{uQ zyr33%ew3P4>cLVMvhRKJ!0F_j{@Xz2?TF0XbrC)7_Lwv|zd6P@zgce7sT6VDy2<-h z@W%My4VDW86leyrp4@tW>0sym>t&iyQ_F;HXzpOB}{#n|OpA&Q?3Q!B!~- znWmyNk3USuS5bI?Qj1Fg`AS_;z8qv4!5m2BbGJD0SSf0SLQWAY4O!K+&LbBkS$c6c z%r6>iYR5vme$1}p(#!v}rm4NoT_rZ<-w@}>%J-_EIdY^)zj>_~BMweRNa5=l-!IU zsp)|x2Pbs+7Qx%;W8k5Gz1-*^y87*gayo@xsew%0^$8g;qG3Q~b5F=84i_V-&s;Flj3DvFTImQiM^a%a3UAN@arZVVkCUI zSe8yd8NWHrOL+V1OKXS4ZLTJB^<1Kenz6pzXK6tLHwCgwY6@Pa&~-qv?X_%c`3^D& z#@Bcdv?P3z1+RFM*WV~5FmjsnqU?566mf6#(rindio2i$V=ThAgq9MJ|JtZcY1K&~ zYv84OCgrG*3+v@(Ztqj@nu0uv%twxr9%~~cj>$kExiU3tEZq5_& zb?FhCmbq0R%KuoUhDsG1m#{CLiofa2Ba1)SeN3J$+%B`)$`imtG7y>x$Jkhlj{ zDODd8xnh%E(WeAzK7DS6&3MtoHx%GgYAj0yovg}BmxEOoQR4&8vy~HQvk3Z_>OY#S z6dE{sh&X&Yn{j+T zpm^*8HlrgTAM0~ZbW=;L0SV49t}?Y}UfVk4GVUxfOs-wb?1rj8u=uFoqB6_wedABP z;}H{W&K~;6eRn)CZR)DV2a|p9<89lDi>_;?MyG}`)zhA`Qf4BhbxGUvco1Vm;sWX3*KqGQrYb{0mXLJJC4IUhs;yX<)ZL@`fWh!cIjQj8EG) z&Sd(~(&+k&aKo(l47@6t?n?BxRu?t47p#Aj5ryNk?Ql9rQ0i@J*LldyE9H$RQgbH* zFFHWA8}Fml+3F~|za6pE|8dDI$axA4(^Tq7+|2dxdkXgJ9xm90&DobPy=fze#N1R< zOBpw!&mt{3e$d(>6Y<@P;lC>Y%VNM2sSpd~21_L`8D$KR@Flho@y$t0!};8I_sl#o`0HOE2{cs}) zpYcW45QYB7CVB%Uqpoa1kLvX?oq{lZd;4pj3xvfAmi6#F9_x|nZ&ahll7+z>QwMcq zsHIy&Pjux|sr68uV+$|IzD(vqe^|OZ@3=-J_-sVXO^5#^U+*WSqN^~yfw~B(mMeoE zY@?6uHI&h=WzqFmc=+f(ch?D-h6X^=Q`PO3HcFGSJ!5sr_M1`tjMcNf%pk3C{EgZ8 zzG`pslFtsvHT7l{1LXd(?B^F3=rB^4?{?Rzb49zyhaZJfo0RxyW%&wNXg~_jey0xy zrn0TN{5iGDQzyWghUL4&QMr)$jlc0KrU{dOD0aqm5Gk z!OeTF*6x$=#(*l^L4n9L>zmOBSa_HI z&vL0^*W<)@BK8MfK~<%Bw^g0e^^)hmhLOhs8M}||DFjak*aVL;80?P2D-2tC2`d``fq-<^T^a-hKR0l$p*=ts^@^zVU&EVcEuSOoh zDvpxDG&j2{2RRql!>F&NWjonFSV|JHry1O8SoJwl{@Mp~bVw?#_PZquHi3HfGPnmCD)sMnbnHH5!gM?xMcjNpt!^2Y%<$oAI{{tRf|MZPae1M92|3VKMjs+b#CYmpCf+G$ zLy&io#ScD6X6jDG>b`$I4P?jM>y-+B1|?v@%g|8lwRKffY@9V?XVnm&8 zcD4Z%rn)w}^R&k2_LMS9H%6>?$?w#AWo6X%`B^ft`_uPAsY8V(JD*q-n$gpq6t%JF z&8a86m~j|mYoFQsdEwTppfwZ`{rY`Zthum29J9Lh^OI;LmDt#&)J-mkKL3%>AwY__ z@Ui6itBE?&s6Vb{-6$#W~@E> zCWX%zYgKTUtcUCS0-cO3B|D~l9h|_DhhCg6)nwnsx)hS(TiiWnu z#F$*NMo|NZ&K^4}Nd@k^V*z0sM4KkPyO#d?&9()(WjJ&%UEdUCmg>!E0%9Y_w%oGy z?H_bhFP5nN)T?AIS!Py-px2^r6@6#nbNms&9AtwwPF!0U%C{ljnq~$3q3(WpasG0% zp9QiKO2Y3sNKXDBBX~wIWuFW#!FWX zk>TL+iv7OeY+-b?ccQrSPEh?zQ+@dBGD~iRy=yZ! zWamdlPwr#DU1;OP2Vk5~KX> z`a({CKxgXq0)QmEcx^>Z)#Ojz(F^C_<;LA%Wn)xSdPH+q@4SB#oX$D`hW_RO=O$gK z_z_LyJ+`{(HiXP1Iuf86zmdbH;QTLoXQ;rXTi%_!&i9dGus@rCtDa}iaE+ZCQQ_cYKkW7ILuJ~r>g33ZNZXno<$ zoTE?%F}UB>qoeIT23Y#fL1m3UU+vjXeAdX9MzlJM1=C4e2dBSxLde+ny>{w${t{)u zkdxwwT)TfQYeL>)}g0H|rsaPGqHRWa&3-xINCAeB9zR_r*D?kNbQqolr`!_U`)Tq)QKU zb=b&%tHCXu8VYm6!xhSY^ybE<`5ay)6qczDbEBdCv@C()4~a;i3sKqJFD-Q{O(G_fVaD=eRAmamp8-KBx~@m|vkadi?odbstAKLs?&{YDj!l zYz5M(b&iLGF7&-sk*NZdnqDOxro^Q3(Yk@IkHlKPAw!6(^lX{YN6YKk@Ib*X!A2)5 z(gV^WR0kGBL;G=u6U5eKc20Kn4CnTF2HsVRI{axW3l-gA>I{clOAn)!XjLsIPCn52 zkz~_5N3dZZmdxrIOnBse_%}Lm|8j|sltWD*it+&FNX4XeTE?qiuwaDo=JMb!`C5A$elx5cbp-gj^|1}h(##^| z9VV<>9ST;q5*Y!WZ&o1g^$kN~?`s%P!XA*!&V8rVvTEUQ{D>mujibz65OL9C^~hYB ztcop!%QYk)lK!KA7r@{17d?ReHsf+?<%j^%X=H3?dnq|gSza-ffBWXre&rw$4eeDM zpuS8dy%v#r|AdSj4?`}WH$5o@KXcc+s0lXKUHReCI6JdzD_7=xdYhtICksAm4BJ%U zVNez(r5Yva$Bw)-5+3v z5s@aTXyscKz52$dzIJN4+r7%Al-6YWdWxb~=YB6=|^Vx%S-uxfGbtQrFgRZ`$62WIDWqm(_IkxY?Nc_Hh~Di0lm>J_yqZu;Ct7pL=SrY; zeU_)Q^{QZaM;qP1ok7rICxCEM%U>t`Z8bl6gcv`Cfk+>;Y&7_T;rA^Kr^vTaeVn&->jpMRceZi>_Eb5ufnerKFF}D98$UUb<^JN zJlV$m(bEqFMDy2He3_i|is@NT)#KQ-nlIK9S@AGG>XPUUv8pSoY6uoELhy&f!*!Zl zTA6_fwuMYA;ld-tpUi?{!Yw zb+tf}OA_;6Y72P({4`S#y7z+>d;BXbl($tjPIKHcfu@|2?Y;Ryy0U6;7T?_sIqmG{XR%!{aA=}Ly zXSDFPnRaT7IP;I>K1Yd*z^`kBZ%Et0$kVg)Ewg*zGW<_)M3hO#BKjM zm*G!Nng2>N_^UXz)LuCVxE12L6^FuMxJ!uHyMZ~cf#Vh(eCY+UfWq$;_2_S$th0A# zU$l|(q^|77Gj-dpceGGC^)={A{RcpB%KidKlb=~A_1?0sT8{Q$xyYfzYuH3y(Vx5Y zXmHofCnR=Jc#q70%BQ6QRxpt{9|EB`*v<^c(Q0;7M&*FDf4yz-BZ(UG{11F!?<;Vl znT&iKNA$={m?H7M;wPk7>mG{My(CT}S@bD!UcT21nL9$qFdsCrqJ`2k*vsl{M66@F zj5zu0&c%bgExfe*zu(m&UN29Q${}Xic5U;4^NT29fN?}is~}HME8tPt52`dtx7}CT2cLCBok8XWe zeyA?RL>z70)llTJcyDH<63mASk_4E2#)kVE|NNKQ8DPwhb$+ninFA3D#k zUc<;#IOsq}&8f|Um%ux4K4OscS=V*jIrlf#)Dp)no996a|Z}i>>uI9C&0D=A@`Y$=BD- zAPQ0v_ktl*6knA*?^pQ;e(cZnE+Gqag5MK+M-I(rWi*hqc;EjGKS>4w_L@)h828$Z z&>55S4INaqzZ;W>^yI&hG2QRe1Zn0!;}g8kJNQU29@m;DGBrL9Fq04g@c6a7vSU;F z&G+_K%b%Vga?BU^V|0hi`+y|)>0e+fx+`4%{I`Y6@g=&K7kl|9%N$8YsehL(pSbDC z4=?M4#)|$QQAum36++h~VW9L#zS!eK1k2GO%TS`OcRL}s{hoXaPC=Hls4@lH>=r=XL-_AUWZU0b*~J9=)M@ zKV=M7Q0^F$&y0TghYh{5ztGjWU7cr>_YOF{&_r;tWcRgeO!qg!=T=Lyi1EQFE|9>zH{SL#fDeo|>-ala8GK^Nl-LdF9aFXRiAe8^(=AyGMpAont@xHNs zyK|lc#@V=*^3+EZIH>OP2RF?p+kGuQYg88!M?+-~(I>sW(n}^DV~E*aL2ESMOY+)V zn|fI>04}Mf6OUFaUA+n50+#`dEcB{Xvf5)yX^~pRX4WE56oirx;+-i`m2<*KXe798 zffURyEBUoF2P~Oy1{oavX3NLRL-d^~={VA$u_c>;Ixiv}bGfgzb2ccmD=nYdmSAW= z4Y;;t1U1<`XOo!^bY8m9t(Nt%uS*k6hgPReONu7D<4(<;GlQ>*#g~^7H^<*s>48f` zNUb>;>P!p$m`2yu#>=1yfhR_Y<0+@yLs9Wu;@x)}gYY$)tGx)Z<03X1)%yMIW%Bd> z3*A;5RN^ZS-@!U5Txb;tJFBq*n%5RQQGm~=Mw8daX1Y1Y;f9J0UKK_by9nK?ZJyF=PXtx)<}r3u?&F@ zjp>=X`p+{@{`KfufH>WfV}$d2y?c-&+2bmk#nla_tRM_Qd7t>!rQrwbap2A`(S^eS zLl$7MQW%S7d21WlAhYLIq442n1F8lx0d0JRaBCbnhRoo)3^-&YGiLSJv}AaF`ZW{R zEJA={QXSL(6u(3u%775w6}TQubOMUG^8w$2n4HSggY>OG!Y8XW31KUl%Y!eaep>Ko z!yMyDRhn8-_gCmw_Y_lI&M;R> z@qX&>DJSXVQ_k!yK!Grb1CXDDg`t-_2DY; zIrr4Oyuy6kXbkt!8IB}-4+PjGCLfU3SMTaoKa1XbHdQNeq{4Cnjx!~0(zC|CuC~3}HL3cpv*<}ueY3Ba zBpz2Jc&gJXxlNCGi8Za!Dhha8*%r+K>-QVD)r`Notj6c&*tU(zC4jj=`1P4kPNbm$ zo)wAlF8Y@YI_s8SKAW)?BiH_kFD3iO;`3XaXgW(Hn?MVzQKBK~#YuB0)gOfKKR2Y% zI=+}^o4l6WpVL`|4!iBXmC?g~*w0_vGQa;_-;nLZUmvhLQVMAOH0zu4$jz^ZfP?{; z7gl&4>))=RfUd;9FKGTwzjnS2EcuICJ&66B5n~v1{%KXm9K~R=@o@T)J7MJLuQ8_* z^7{G$`fsP@o9^O@1_x<+3aJ6B!Cw5p>{jX38iXQG(LKU}+|*38%lAHrltz1)(2KNX#TG+J)ng^nNQ%=D`z zY)8x=xW2=&TP*~C)S?os!=n}c+z>E!fRW6-9) zar1~+YF34&tVmqB9Va|@p`+I|(IH;CRDErLY;hyUZLS(cDMpDWH)?q;L@(DLFuw-Q zlQ0pX9|_G_bc@@Ka(BLY203DbPX*erSq^yV{CGJ)2b@CkQL!=U%mq&^--QH~2R3|X zZST@ey*jvPyDz~eRA_=g?zRJ`&2yYiSpwxJ03K}U>HmMcgkoulDYuZ503hUfg}EfAPJQbofDT;o31lk>m} zA4E^DcQ0M@_~A}g&$mR&giT4FuPj}UpCe_dYw%$pW9QQs|9L?Kmj>C*4GMH459mPo zeV64#_s|+CHZ94CDJ(1;R#kPDVv^Izb&@Eke`$5BkM-JlQQgt~hOpE6k^7Zh;sV|q z17iT?nKQ}{&eR^iubi_AY=vhcG4d3q7nGt4#B}LhYe3E0@lf-57MH)Rmzavebom@F zTJ?d;GR|_IJzSBggkY%5*HWF}r!H8#_&93P@r#w2ZBnIWpvxaGpKGz>YbaqShA8qi zd4+J*oaj{>r4UNc=Sb-`S}TU!c0;A+5%}VJ9qRhN?xRS9F?!1?5HfEmaZ3DOZYLRp zUs*qsN88?(KhDj8_wi2X(uCBDJJNB)0*;1e&Apd^r^};e>`JEHlqrrc#{TwhPX}8} z{D?J3I~8O$nMalFpMe#j7$QeVB^519!4qmeo8EEE%xi%`!M?y!;QF}2H6lHh95#uS zsN;xazd60LKjbWk)Gp$SdyKEpDI%X$Jf9@uhjrZ9f-dJoRtvamj{@}8=I3<-H;0r`tIQAyQ#(OHU zD%4mgU2rTQWl(bczpMO*?r$Og&NfA0L$$qkQvEAtX|vcS(Eg9@>2JGz&d{r??JZc3`*EuHjl> zmFaYEIhQsbu-y?JXY3kiI<2Tb$}6xoBl>Y1LIdT|4gNZIOtX?w{oD;M9k%;y>vE#l z@MYfhBLkI_H#9yXefJw_B6jKp%&fK@Opqf|6tmqCL4ZM~-;46c1*9K{B(YJ}se~fZ{MH0u5t0bS}J`e>57Wl<1A)++TU^3GhD0b6b_eYT9 z0ua_70k^wXRK&r=efprVzs%|XMci9PMftzoqnIctNQ0D$bcqrILnsZ>F(5G_-7s_w zDj?F`Dc#*E4MTSd5a)G?M{-Tbh5f}6A%B(?pQbc#k44NQCSKLludVEd zc<&Lw@NKb?{W3NTa$!H{1W5H+`ltBl3;N7jUm3CMXe~`u0y97yx-TERw55v#*wwkQStii8U}bB(ApeVA%>7qccHxBj=r z2ts2N5T@pp=x{cBU*~7J_;fNDkCpx*l_Ll+UzSon&#JNuk)T4NJCw2z&9unHgT><3 z90NHfzEJUyuMgw@(HM~hzvva=es{4S;_%Ka^JnA1BJRg41p`swM)2EQ7QM2f{PzH0Z_xRr_?K{_@y4VvBJ2Kw^p$G;*)n(9$B&f`CT z_T1yB*B_2dOAy|nveAUXztkLt_i91^%nq9lA*KfSTm=JO$d2Cj;}vs5UifM>3%7$T zBWC=O{dG6+Hzq>=UojCdidC{SY(`99Y=nF$g$|)-#fnQk=`0>@?3+#cI2>jAdX##h zeCmUMXL;Z9C4C6kCzxUo_x=+T;j^wE$Nn(*XZ!aedEF;H8ew zi`FDmRw&M!P^5_sOi$ZN}8MnQ=HyH3y56*~>2y+{J4Rg6Zwp*3Z* zglNXCRnq9Mp2MeNQ4cj1q9+W+mb?z5s~5lblp2P}Q_Z01Kr*k}^8(=00(k!`BZ8Bv zW?H~6tD2q#xRe3v;e9UXX$QBf{qX?qI$6W>!d*h6tFO^DpraCq_z1H>XxaOrdZm7U zsG!r&F+e(`s7d7`FXXaz8r-y1aSqpQqjo#AU8Szmyi>OfHZ&+FrY8|lKAdb_*U0+I z2-weO>GU5x4fRcPHzZu;37fcDt(e&Q>Kes{%7ZHa0(9XUU+T7N{oP-A_Fx7lkLcpV zG#d*&Wa0u#2-4FvbbBIunOJIj9s{vV^f*?b&IEN9`PZ_b?h1WQ9YF9~6sCx$&7$1z z?mDl51ATKOuE%o57fvs?KlJlT0sE08MvC+a~<8D1v?+) za2H5^sT{rMy380k4{nuP3B&&$P1VfC(wkNkZU7kE(_Ma)oXF#z<$Pk}4=AdV!>cUz@y;%sF`7 z@lk!FDfR@tD(*5si8s=gCv23(R?RkBK2h+`V9Q*gaQuqfvvW7mV>4Rbj)!;nvSWU) z%6ZXo@Z*&P1Opherg$t&@m>5bJu#ee4F9-{f2m>oe~~cu|DyQ(&!1Gb0*!7 ztNHVLc7r(IpKHWS>T+O}DkA`X^+icBkrG;tzgtWy_ldLp2YVDruu!A5?psWIY3j(P zkq7_vl^1ztun4-<0+sy!J7L zu{tK}dV`bU5y&D?AiXtDO^|JDSX2rch<7PPUh9$)CfgU1C*8hInHV3 zIbgh#C;|9}n4~YP&3fAhp zb#8HD$YAhoL+^31X|3ajo|~zZ-i>lIaUMpbJ*yh`=hB`)8@@5X)wVA28XV($p(vPx zde^h_G^ia6d1pza4(R@#YO+&d!FNamS$N!KM{xuYQuJ$2q&;DI)-ALi6#Y^fEs0yN zoE!3}trx;DF|6~xv(k@w3X%CQa#-XQPy;3xKV`{$sBV)a!qy)%};3cu= z`)w$0^!5x6$`j@dsBmp6m3*)Yj#n&QKD0cuj%j7m&Z$T`?c z7Npt!s^O*nxPRnAEU#*k-)xKBSTy4mX{7l#Ky{8r=8%}x_9M#><646D?a^Gri)Lja z%t};?#R)g}qm9&H8NVi?=*;Y(7P6*_1p(R!wOj$mM@{~vTT?_HQ-@24*i=_X-u+HsM{EuAMXN_@6Zp+pWi&i0i~Qq1d`|1=FkVabdRB{=|5(l z36*xSUF7j_+dUdFr%;^s_vC#Kkr&l3qL(F>RRO#L>H?3$eO3GDILY;x%*1Pd=e3y# zyeV~Y$xx+6AEk>@3|yO}m!eQM?M3?xGD#@5hZxRj*akE#(lbo)h5k34_rk-3S|FAN zGa@$Gvnu0D&>lHUS~8@883GlaTIUPobeM- zPIYEHP5V;kQ;v;JL@QDaFb0y!Qd+XsmwJ6|G>s^_d(oK0>0^FUy%atDK36%X-S)w! z3(s!+n#$NTe+}DWW-;CuSn>zyx+jrhiRsf&<~t_*1_*0p1ydiXL9_Zxg+`D}3HG!t z*H))|>}vZQ@ZPeTsG0k5Ds3@@cQ}5;eZ2bBak{a=7b~~q>Qik6%-ny=iJoU3x$a?N=`lNq5!hZ{0*b+7Fp&848^@^%;H4YlFLJ~RcU$osM^t|p?bZc@F6 z>b|I@O{Q9wDz*?rM@4@L-LGq z7{~ut)cg=T@3c`fECBhlPR^1UPJl7k^uYYvd)aJVZZihHC)ruAn|m0i_!}y@E2bFg zUvT+W+Oz2_H@*w1ztB^YKCX|@V=Ww#Q}I0pC(7;n$u=u8;3(QV z3brxa9ov)mC!lxKKYlDaZu@jd}d9!n*BYAyg7B+7g|PKf{AQRY!c|zqulBmUnjVzaJ8ofBrG5-@fc-RN%8Ax7%$w=OsqB_sQ@VuD z1Tzk(MOc)Vl?vk6WFTrApJ-mVAv)$W&N1u;Fp#YZBzJYgReadAaP?`|I_dP0`0&z< zlMRwl%(ODAut7o^fm6Kx6CD<9OIvpJYG5}L+07PzKa=Pk{f)A`W8YC81L}ZM3#`Rg;r%TqD%ZV0*IWNLcu`7hl18 z?zLIDH$uNhx!Wm;QpX=v`KZHaV6|R_--a{inY2Rvk|p8Ycnd3omJ+P@0IA z2H)>{ZYy1V+F*W81=@2(VgKN!nc&?EviD_eSj*vd7pmX+5ld!z0A;Z*9$MZR&Q=~O zq#4b3Cb)Hf$H=BMTp($>UWjnVFJ$A_wmvqWpo`|<%5cc^u26)GQ4!OF=OiSk$T zwG=>IP+|&IT?QN-u1S8~yg;OaW@#CC)IEQXjmjnO<>S}u1Uf38W6{UV*8yTE+p*g~O z2C7|F)JIfBc^;ZdRtFn%r#g-Ls+_H-2&w2J6z#6+<0p(9U-oArYa5Mgb?Zu_a2IkN zUC%AG_RjW!`<15lZNI~0s4*+RMZA?4mFM3B)pW7f|NQlJ8d~ju*QmyE%vj$q64jW* z-;eusPKk-aLE(Y)?Tv!$5#0r+;E%rV4yO%eyigmgdlm~Y-b96_?8;YqvPrG4>0cyo zF*j^Z{4}22s$D*a^d#yR5;+wKIudWuUas;qEbr@LnrhWz&FGnD_lR|2^oH~sig@%5 zn@$p?F7Ib_jlZtI%vfAJEY3grnI^$jdbj#mmIAS2t{BS)OcskSjE1*%o$a*rfU+J( z=~H-m$UgT{UT)*tTK75SiL5T*g6F~u^R#P<$LpA3_UaTKup5)GgF5?BlIMn-hq&YT zb)vh5Kc=JgysIKpo@UIwu?=jB%YPVyV;qhay@hQe+>WEOaj0S?))2FH@O0x{e;|48 zgmIa^OMtPr3z_s2{+YEbZeD&3nL}(UUYW>SIShqWe}uQH7u##w)CSkrwcx@io3SCW1qA7<@x&5LvYR1B7KjiHcQS{6eS{j3z5@N0wXN*D7T9nTFLti?|I7_YC)p&ZdRqEFt@ zD^hDDc|>92^hk^jdIFp z(V3tsAu-|>8C87N#GRj_=;|~|1tUb$1yDQlGoHCgIjJY-*i2Dvq#Z0PQS{jx+zz1& zcRgKaO#f0wK7M?Eog*{!fhNne`d*a0@8P^6ujX>7KH?}^(;L&E2Q(5)PP0ZCk^w@e;l1@tg))0qV;*OLf~tDm6YOpuod%!qdoZRFQG z!YF;{2>$+ z;rd6gM}jYN?qG%G`R|{P(o?SF(Jw!G@eCo!eple|EB4W|qHfON$N~9+N=0Lglc^!}Zh7atVBg3DeKWP>wrPp>IrnrHD|R8e2H^%V-oMwq!Y5e)4z*+?@h5;M-tIm zaQ93`U2iRN{rY&c;%cDts6Y{V%$+q*-B=?z?S`iANls(i%Y1=i{2IS8z>m=&?x8L> z>-cVb*>(Glj@MK}3I#^B{f~VdVXI+zLHg?n&Zoq7^{2lxx-jbhWtPEi_L>D(PV$)e zrOZ{zT6KUaH7Tzu@fst0McKLYW>qz5GP3IhHeZiJEAb&QZppJm+df#Oqi8_fYlx4Di<-J#1g zdWz%m@)E=9mM*>EM_ddH)t8UD3W|9w^L45TZP-G|hNBgUCum-+9 zndo$osqn>M1WO(Rj0|r_YddU&-J|Tgqty$9T{C%EQEyg7T2*7|9`n9roN&Z_15O3C zFq_BK8?-(xTO(ssPzGhlA=K7uwVVfB8@pSI&?26Lyi?;EV;l>m3MbQ=X{%+x5T1Ya z2yJN!K}HC?WZTM2bvLUfXBM;9Vv`AFW-`t$s`?z^sXe}y0SrZC@`HbEb^EVL^LOyk zTbLFnn987Ur{9>~PK(Ce!b?3?>f9_?25w z^q}8mPr2TmZ`#vG35{UlF>N_m?=wy9Zo{a4UX@ATgAX&~&Q2lAV{XW*s z=|U7}^~@sn!pp8T#|BzAc}e%e8@fbXd=qGWSGXocGFq5>Na6{nJB3XYD^;?6;{t~< z+kc@#kuq9PHQJ`Iz-Q6}#1=O0HOP$A!*ydoK!NO`4bGdLT{uA-WST8v@c>DFWO-T6 zWK*-B1C49d-YnfdEOID6q`<&%@wqWsOB3(~g(JlMCz<>Rlz5fGf&j!ScGr z>mm>3IZO;;f225}9k1nAn3d!XgkSk19`W%LvZ=2>&`Tt+Un2amH=yh|uva8&A?MRb zJ*=K3b(;O?TQ-ICN)J}M$Cqet+jFxBYmw-zagL|;g*88v$|fBd9*1%)gq7i+_%g5L zhiD|Jj)GNi%k8Cw-v#XZNgI%o`a@eCm*Iyq^gk8qWo3j%5Iv~BT7I&bjcv#~C zh}az{C-){W8SkC=#pn$6T7KtxDbwOT`N2oH;ozk{7zh)b04Y)eczE9dvey!Ba<~4M z0rmv=b83o?3+d&Po8w<^VK}hw@*-Y9H}gw+Gb->;d4KeOaan)UB5lImfz=cO2w*Pm z{$nipUlEM|e+TIPlb|vzAEo>V$c}W~Tb$CPd6VLK>SqxG$w*1Dvoqe&jVznksG6UN zkM#B4GA1o_m}K7q=w8r+HUYAs#IWpK<+-GO_ak6I0DUwa&tpAIS|54sA$pepop9T% z=^0CR9WAt`YD1a_2F51KrmbngJ7o!OASw6v5`;Vg0m(XdASi8Wsd9!dyJ!-6;&X)K zyKq}J$!$0=;}Jdp|w>EnFdZtCto9^q&(n`!xwR-sUis6;^b_@zJ(?f?`pa2 zlb1483(WCytognd(l0t4Ln(28zAX{A$$67bpY&Rl#*ntRMKt0jwrSE!#Z(})OGcL! zvzCv!DWEl^`E`IE&ocP7_>CMV!g0HvuwJm-3Gld>1kNk7vn{HJA@mA5fn5Of*u=zm ziPngoN06QzHs-mxZ_+5F)WqW^Y~NbQ z=lh6T(U~S%eT@edQ{Ra$W$Cjg;)ntP|8oXRc@>Zo=EJg5dNR4uTX=RCL*x=c$xDj- zog()sG}7OII$vq%c}#@1=K$qQ~dbt)Y?Ozny96ItW9xDe^V}ox8uh6c*SQj5420sS*xMsyC>iGsllJj z5;X3H>7P@5Zy;pyu3eEX-OJ2b6faT8a)2k*clsq{Ds`wO+fA(?nSO9fq>65WeHuHH@rsJ4eAO^qY!33?ToPyBAuHa z?vc&$^B0U|Ip(gm+B>-ra5cTQtLrU{PgGBIR!5D)5RcfPi$wSJ6$%)Gk00Zb`W(Wk z68M_eBfn2^Ip==Ln@w<2k1s$fw0Ar-Pz6?91oa@EGgZ507ttXyO4C?kuAP!_Zvn_Q z^n*D{#)5vVZuHBgDkc2oBoNAL5Fqq(5lHG?IiJonaV2E)$V#|8uFLdv(KkOqRkSXe z+rXFu=ELWwms#pM-@1A;&dlYSCI>ksYymDYmrqWK;S{@l8x=GlQ#w!SraLsgTzOP) zh95zV$E`q$xUXOFFs2)HRE5}ACXO1_@Mm5+rM($O3iCv{IrlVUnIO@bqv-TI@klBk zX)m$W2>A)Q_xqV#wv0eV{NtwZFmy~tsYCVHNdW`Q16HGZ9kbKl=3fG@tje9v;z&Yf2=BbaRC6g|mtk4}!5967Vd z=#y~g+sYj$L*ZnGPq9VM5FrMtadJy(BEGr}4KkrcYTJ5Iee!dQVD9n@1BRO28rwUq7i&9)POk*HBBFEFcgt04Dq-LG?M z?s?&9Y66@Vv5wd^XuW~)L*AShZ_@$mtYnN}7>)nb{RL-K;3@{dSR(T1KQ8^+SOgt) zba;`V1Lz<3owE4k7sy(0tKnxxd76V1Yd8C&sqPVNe;F2_lx<+FpKwJPu=-GBQ}`Gf z`Fu=V4He>$A#D^9wF|SnJ1p!kG1-u^_##>?x}C{Lbq@%KR}O}YN#8I7ahSqCm95IDG0bPq_8QD+(r$%Yw=cP{eKUsvgCPF<+qFox3tN&me(Wwe zez*uT&(!ab_L~)RLka5^5U@+Du7=+Agvo&6%BYU$U5@A z#GUl+fnc@-&};~_7gi)(cO4i^M$!F$O#9|H{y7gy!=u7sNBlK?t2jV-`tFfIu4F^5 zQ*AnM4j6ThlXw{4+W`c-!tyU4xz~!np{y39sk7RDlrDU7fM>jV{hGSMTYZI1Lo7#v zgGQA}mDBelsx;Spt1?_2wUNUTu-2fBVRZ{JUVxxInn(a z()YdT1mWt8IcG1bjT|~1YU&-==6mM6Rhk-!Jcx|YTJ2zjPlVS*-ODMqtQ%( zB4B6y=C-%xm<4_k7Y>L#SFPm1gVD5#In@t24sv!15Ia-TS8Qa!6*aW}02C!gXq*Rl z!{BRP?oumoNY)-d@Taq@*Q@%0#M(T;9=Oz3|L&Ru>qsyAnSfIklfd0mYx%sr@cISj zJE)*~R^nbO?ocHP?TNF*J#j)Mxve{)yWH7*;)K4cRA3n3>i#^I{^8{Q9AqiIKbp*P zyLSU_HRYuB0B{N(6WuTCCKgfzT9r~#J>TqSK*ks}xdI4)IuJAi)(B;LpXJwVfa7FE zhUkibUk$Z9DtGoMPc&Io9Rq@(KT+xanzh-k9wP>y_$z7fa7UA%Vdg*|5MMGEa6x>h zRhyICrM{m(2X~A1p=g}>b-uv94pjf5xR%>7qUwz_N9kQPDGNGX`rC|bdLsh-bLYf9 zVdMo>sSiIPlFZTw5{g8fyqKE|mb%}}<$1_x?d6G7vPVF?n7+N$g3)WlEl3e!FZukv1>1BqyQo9HoRIE zCdofy=fn1#p7gw&Q{*aruC>R^ZOM?A-N(98TxmHa9U}Iu;GxMTuOjhxF$IrWqLN!% z^|hyf^m>q{4MO|tVk`?BP(wm)@-S@t#pCFYYf8G=4SP~o=A7p;!jd8b*D>f=bX?^4 z?^r^95;~{55%v~+=Af2Tc=nRWVYob%k;%6b^sd_J9k7mug$h$zDan;QZmdJO$oBmmn@nO|_*qL{M zc&6t-3;YrAjDCWBkNazo(EKbITL9b^KwWX;pA1|Bde*EbYXv*w<`tlty?w`Tl~2&{ z{R%N?RK~=#{6JU%`{ggyZDLN~kIWw!qY2(p<^!k+22gXY0>#LTyHWLamjXDKSX+Js zl+c4p5?uw$$K+`1DaGXLxhls{n<_BZf`q(ON0gZ12#%lx0G?XF#Twln&}mG#XnXcB zIdFhVW;0o4JlRC;vuDpkjy%D-UTSSR?-i^phz))$E}LeNd}fcr^d&Ctu)5IsJ-fGZ zX3y1}zb&)!0b5k6t=r{Ep}7=Dc8Sgf-IP2x5K4W-UYk0-@kcDkuG@rGb=1(nU|&o~ zDxH@@h<#;L!0u}RZZIeb#VJT#w4~Tnu&(w6shpAIQc}qbzNl?E$>N73ou&eTJ~rLJ zMKkpO2G9v&I(%laW%bJsY26nEk455tx^q^p6nq@$6-Ckm8wEi6)iDV@_rX%{iqc^3257q15U-k7C1i8gF&|_*?oq7N!Ju)w#EE^F>7Gt?eUqjwFL%5-w3aj}RvDck z86z9yHbxg+o!?pgHRn48`F$3Y*I8!`T=_Sm*8M@$u8Vbt6<#PJ&)gk&AQ-xS)GW=G zC}j=gy@HYiGHKUl9|<d;n1c_rRXSBD;5pjWC~B?E?BnClcRncUC^(s_c9w;=JX)I@UvfIZGX zx0iRnv{xIt@}Vn#ch!Fj8$q%Vz)@Q$>l|h4CbpFD!)-ZOaXDS{4nK;b1{J9Znc!xn zAqMWe*fq9}BFor)_+dId8$%3dm}b6cy!t-3q=(8k(%(o$1KbIyfYW%J>7i}2C8r|+ z2iq211!aCP>V#_qZ9Y-7V4=!wsn5L-y}-3Zz8KE+GBmer(k&!5r<}{g5swKHonYAo zH2}lk4~Olpnk{`T^_!l3hHHilDY&h%JUkupHG#lDSM&DIDAerd)vm}Q6dDMpNqMpd zzAver7^B0nB5t1UdR%^Yu$ph1jo(g5GM!3N=o)D`B|ZCl_YC);rOyO3@%|Uo-ch>0 zu&7u(l0hWPD^*TgGS=lwZ+YANwRY_X``tFEiz02at(8dGv=dV@J7aKpY|dspQVc%w zk-$RF*%E21!UCB(P0igCdIQ`gt>=xaZE2_0l=qu|)+I1p<1YVi+>G2P1_dlP1B7t#rA`nOLZ3xvs2RtJUNQEC<9pC0+>fda=wC zkCl<1z+7ktY*h4HT(DVSz$zy&tApNOCz`YIFKS$76?X>CRt7mP{>$9P*TZXgg}bGa zTqzKVRgoO~QufcD(%HG=!WxyQyw^vtfP1MGrF%l?ehM`GJ3+U+bE^M$-v#D>+-!;E313pG8kx&7Q14i* z+fGxS9oM}TP;hBb3l@;6Y&>pNsL`wdUS^HM!`aW<@GQ(Xu6KbmFylcl zscR*{Obxw==9Ws!jMzb&nN|axeA6I5LL9*4%GLfK6F{g&N)zcf2SyIX)-ooOkv$ zZ^8U*&c0Lheoe+!tTloei(Tp3mEw}{8J(FuP#B99so+|{9anGb`M55=PFPgWWe$$+ zeV6`xqwHMUij0kJ722YTKf>%H@hbdub2M|dEuskbX!)@a(7gt9SQtiNK z*L~Y*--R*jFi6sg{Fh<m>(X8Izd*q@Qp(;XHX)JpvqpWY!O)}l@5ZmDyN;Hms$7=^ zE%`^1v`?5c|6Yo1XN?HGL96GYR;Taq!h(1)P{blCPdC18K5F0>ZMG)q`+5nd-MKAP z9?eN$Qr#euTGO9gF3+kd||&n2KsstU^? zU7+qC(8UC9dc%Vz%?Ub-)lr)PfUm2<<6p!}vB7B-dJ1j%~@CptYo`vpk31ElE(cY&c?y~d)DG6e& zO#Fz!ea;a2Iuh6+24oN>_>y!MEBkn&5doDd%WVYUyVo)&bxM#{!W{+tz1f+;eD0*# z_1X}W$^~AK5w3;C{#Di z>?e70c{s>#9Gap2U&ze_>0gzYwSIy!O+2Hg(8e?EU_IZGnP|`DOa#WIpb>d2fjS;% zPFi0f?dWrZR+`EJ0sj3+WyrA5`jOxDUE}xzy!|GV=H_U4Qv54jtNGD9+sQ}1hE2cA z-@W$smix}q-neW?`{(KAz!*{$KV2W6$4jy1mup2#LFAwM_a51k)+D>Kg@Yy_N{PV+ zoCHc=W@Lspr=U`!daC`t4Q2({E8f5- z|3Tcm03|hN#|#;L1eg#v7+XRy1=y5`#2;p^Um}LMcWVX!l0uBZGnKNXqTw5%?F0*0 z?EWf3m~67h$R+6+U+eGNmKnLjw+yB>4uOpeDIV+L?noz8-zSoQ<$Rv$JG+>7QY#jK z4+yAnPXXy{G^W@NTl-~}wy)L|G?aehMeub2e1QMo#J_{?zfLsV|165*H{rb_a3~P3 z6P~4a%r7Aj;;*foq$vwvt%z!kW+(6hllSkIyI_CE(Mk^eS>=3BX;bASMTZY#3m7g4 z(_RB^I{>&OqQ3!G<)96zcMZ5B{0OOQz}@ekyny@!aR2hT(;*76Nl$CyWa);Z@$o94 z^wO;i>o;|P<~6(|eZ}|={QAN#yvyy|l#BaI?XSa!9wF8r7d{@_ta&AjOXi~(D7c6fo2O3w-Ih!v9hS?8STGP-^@NTMPd?`|+~rgc1{ILC1QN#t3ECH_z)ITECh* znqUfMZYo6WJ?ZoQZmc}%RrBOEmoL@nK$HQDpQd`#M-a=)J zJ<6dk;<0*Yjtu;dM!AlBZO5!I5rYCyNDaUi6uLzgT(?02E!V}ZO}Ns+78P@+@-3nzDIEHgMR{u}Fpm5gRqv3?L{n)sn;wAOT zQ^MzWF@2KnLw+M|$Js=fAQ*O!?H+ZGli$ZoT1MvJLhPDAwy{tqmZqZYaA@`y%Imj< z7@w$+?fC{&2g2+>cE&5D@`~Agh_H(y(Z>0Jgt+Y#dk!Wz@HGcxcrZN=nFi7UKjw2J z`Uc#OIC4MIXov7=x^anyw@^ZALRGnbdmF@L#@QmT$e7g6SjXbPY2Efdqy-!oiO`B0r5T_^uP_ zZMTcR_e|#s=*S?gRUu8^mAnYKoH9O+{uJ^x%C&KQDr(eR^0&BTITWS%qUmmj+mkoG zZ8_@ZHyq~5Q*)SoC*CsMC9%B`kq$cI<^Al%vtXuX)`om{! zs_7e1Z@Y;vw?&gwP51(XaS(DO4r)06&;*Vv%vt}ND3HL`c)nTVtHbU$&$~DgQBI4m zlUyBE+?2A6L%+;OBv_q4;UA);@ux=h{9B`P{;g4oi~Mu}g`M^3d>q6+qMBKrs-^d4 zdwK#^;j=}5%;*A}_al)z72PlVT&_`)M=+yII5R6LY5eJ1h;)c^3~}15nq&&1+`B10u^Rj_XwPNI9~LZi^W4%Q4J(@i zhV8%?8VZ1+DUeh#-{m{6=yxH1{ht^!;#_6+zyDQr)BWY2eVK!|{ty!3GK z&*ROKw#yp*i&#UV*VVI+$~MY+&W8+?(hIFmiReR5ewCt6^=ltwY+ddC0y0r|X$JoX zg{s$X-@x2-e&b-MFY>!oZO)W}(NgLQRL1tMy9r;ULD}GD;3sHWrKLet zORqgLN6O$+3)w1stz=2`XmkZE5xsbCHF?|3dBa~$)}n*<`f`uR{)39%e$&_hD#COE zf68(Z1g<;hO#-M`8wj8x>%UO3lk*xC!vR8dpa>vThuH6+a4P-~s-@S2>g?XiF+iwN z0)*<1KBsv|9;ooV7T)Q7<>Fd1Mvob-A+GVbUJTf<88ue?3;INfpG=bs==>3xKUXuWZRewnU_r>fshZLaPQ>|hs@V(Ks%iOE=kGZ8`^q( ziJKN7r2+X~s!CZ>le}-RSRLmfR2p$( zFDmaf>uOYh;T2+tN7u{}M{m3(@|y>90@bL*C8?NPt!gpN)>LHC?CIhu&}a{WckApe zhPgL;biG^6j0NJ%uRgGruz6O+4wUIKed6R<-#ujrUW#1l*QWf)Mi{gb@T?=_XL_Y4 zT2Zj6`wqN+>y+QCDiPRDM&$mq>x=&HKL3}KX$Q{~y&14sE$Ba3u;C8IN ziG?K1xNoT)>zC7!f^U?@1HhSbP4r_3$epX+R0^keQtCn~OZ}gU&*4W&-my!4D~RV( zE>X{8)SuKbq9jikVj#El1Vd6pvC{DsOWlr9HyM1Lwk?d+$mKWRnTjc!;9ESc2_euO zcF1^XTu9O#-A>1pY}sjU=E@dTWbUpwcC7gl_#)}h>3sp>H-Xh* zY>$O_HF*kyNrm`KR0|7twU+ZG$~cHk>2^||-Omv&K(6WFD|_SD*Vc4_5?kUSGAB;m z4T4Q>4*-L(`E6W9|m!76Wk4wMg|8D3R9BUN@wq>bgr55EUXg#KO zzgd_K^t&NOqYvay8$JT}!zJKXGCL%wZr}K`zZbx%nn~={NuHnnms5@Y52wn9uf+X_ zQ$;HN;Z$X_{vSBiZV~+=`7CnU$A(&iCQLyD6KhwuqEjbkmnon3qJAl<3%W%UN4|R} zfEODyA2J`w8NL7CsuJFu|593m7YsOnG){=xTbEiC3A5SFE^56Fuy(2es}G7e4baMC z90-nW9_QH!>+gwHxAZ(4!_~l9(A-nHt|~3BlvGbXnf@QEO5pIuz{pOxEKZnS4cf1= zU3858cm+_lz$%(b#lAn)%cMSs?7Jav7u~Q2i zm=-LUTozetbiy$Yus8VS`Oy^icN;f=3rocNJ&OttTbW4a>R1gk*(8VA@m{*U`uXy@ z4%9km)>ooRa#~c5#pS?d<7vy6{w%aX0lNs3j}27>m{oj3#DVC?NFT|$)TO=XV1Mcdcd<$>J80wMNF{sERn|KUxr9weGX+p0E3X%bV#9p;)z)=)YxNWES zO?lA9=z-syRA0KFOamW%^N^S8=WDJN#u%apgkr+Vx|y;LnWX;H=4V9GKyF&aGB52d z_uR?jXhsqI#!fznVKqRvUJrn5l#(g5Rx~A1> z?RDQ?)IOd-jqfFnm>aL&kaz`j_*jfxzdL;LzKx&yeU#f4$IB{mHFs}1SMPJmteV%g1NpOE965)%I zj73{{*CllF>h0$W=uZ~)Wex^dM+WoFDmg6kZd40c3jmMu+C5lRp=^WT8EN&>Dp$6S ztR93`dAHh%3Pgv#n(gop5Cd1qHcVKf&50eu%HFWD3<8Yy+9xr0? zt*UmaroynjTP@C=>tf>e9v*bZy#&2>TM{?4g&DzQI+UYu;597z9K|vwtR}jz;Tjsy z!hkV4Bj>RGa$GG$8SCZ`+w%4;;L#P1I?lU2Dx3UEiZof?n{%p{!fKn1{zj!c@h3w3 z9L!-{pt;9?*p$%Rc5_O0=-a#mu+q`&nB{j7+NCn-Jm{C1@SHfX>$LxQ{Cxi+qs#(y z`+@3P5D6Dhiqc#0)|peY-AhX06A|~rVNw&+gjWJXh)T@dF9q2e7#P(=KqczC`VN@S zdx@y38DUaM;v_mFwYg#*I<+uw^^|<{&jRE;-=|2ixkN9Y5oINCjteR4C&}3WJ8RUg z`~4p_ehgV|n_c!VDvbNo0`P>UY=@XWfMGoyX(^M$leBnzKV~D?jXG3uF73w5Qv|Ie z%91z|KpSD8*+B(z`F>PrL}Zz{Q(L9L_1jwCf$v}U?!_-Zykpf~w$JInehnsBMR3>c zwP6KkwYF230eJdw=H||WDJQ#mSw^K~HUSEz**h7od~u74%i30v%7JL!ZU&|zPmIS)KUg0;#1dFQbM zQ&ZJ@-s{fV;CDX`ZT&=IsnY0B6Fr%8K4*Hp8xbQST?lX%NiOPrDu^6pFV&p-?@v;# z{z}a#v*iEr5@Gz~C7P1z$(aDyPhg<$_~rLN-!CO>81rr^1MOJD)jameO^s6Y+Z$uB zBjCQd_SxJkiG{W^E_2}ZS~l#r#NHl#sDL51l+p?tm$oY*zO)wOTjMyRlu#J$fRULWjVTScI0)euvThHPGIU20k z{(x#iZAryT*~B{fq~i#@vf)R+XIDz!=Ka7~ylIU zjhHVx%AXp!!D&o$oDOvHqdcsq2xGPrr>d z?k2e5Imu6YrD8U05E=m+lIn@gtM?Zex7< z+4jRF{OFk?KUg$7CrUj0OoXc=uvT$HA85oI4eLL*#l{-Di&#K?JKOc@qw``C__^_& z7WaBrMvZbN5YJ!7S<4p!#p(^#JJ3zmpg}7jNNZGw_P$lwbimO?1w5_XkaK+1olPH< z6i$)#x<%oSs!DNaI*xOk<*DL0LtCeK3!Kkgm*s#gOhwAT_L2ZGL(YI4Zs>#B6)Uorq2sD-k|w{*w=YFI}u zXm52wqv@=|In<1;dZ}t0yza)RAG-w``whY^E*(6&Z0R*1-H=x5#ITj8%sd1KS#?opgFW!kh!56EXoRoGynnE%ByE92N`hkp3U9NVKqIdzi*F5> zsQ$jMc)%pf>FN-OAeqQ|8)tZJAZ5GQIvfsfN!gA+-3b&oRig!rLLWYU-pn)>-KMc% z%;2&n{$0}QGl8nJLK~9=Le)8mku>4vFn<5eJ7jX#o|duK2pOgp)CsNnlcX+Qz5e+r zn>I+XHc@YM?u{h>$AFw5oCm@-(-~Iu5z&-kjef6uhk)_*^hciJm|uz3#N=m^;qNt3|+Mh*r~@ZeBTQYwA*;%TC~uI=Jt zwU)Zcn$jAjSDD58pc}U&YF+5;P}yc3tdZC9$g%1Gx#KE z@FV7ZZ5L8JkVLeIpL|6JU7+PDkZmBosgK3?^Zv;=au%V zQ;=5XqZ{alI#Obp$_+Zlghfpu2D;oH4{Xvx;UE=-fP2|#sW$RN+3$b=t3BlLgS1ObeHq{Ex( zi1hiVJFz>BfAs}!|L6-4qPG)Q2bN`xMGDsu|@Dc_?IsTVy0A zdiaKu4zS9E*yzWs$TgQh@S98M|4u*mc*fKjICdJ;`Y*6!W%-Zm?d~=j0w=)OA6XWG zKW9F-j&C&Q66KP~I||FyLGyrhciZ)-Kiz*|L8OTi({)8G-Yfm;;qQ|8DU2MF_>v~A z`~vc|7ryS>#)KPMFV?xlPR(3+d|yN^Qt!ff?KS9uU8MXJ)Zu?f3;-8ak22+L0_>r= za>9m}(hNg6vX_)|*=6~18SpGmz;A~PPrtMag!=ExR7JSx0LnPT=OUfdVPzlS!fWY| z56Yr*W&#Q0eJf@%`Y+Z3X*ND?m$nA7*k!TvZ|Ak9FX2C)7<1p(_Us9@lr)jpXUU>X zcZi-)*o3+N`oG9~%dn^#w_ntFlt)w$Nu>no5CxSQKs;s4{&4t$*D%7&thMfS-@p48F)HcwnhKGn5>l+iNKrF{ z)?h+JS1boxl=iBw7?W-}E#ahLJtf(<1;u}50HEoOGdk_B|7 z3I{})Xd>Bg2hRdX-uavMG4jD!0{2#`oLAjeJgiV}d`!1Ho)QBMyEPe)OIoe6hK??= zmMoAJy&`E^T*`P_6w=w))ZxDInq1r8_O*zI#H~dfD}axMd|?4PZEvhf;a{3N=;>kc zT%}`91E5tmn+YHvWKriBn=JyL%Wh$#>jaQidp>sYe`y3)DgPslz%FqED|qBg6+X%9 zXYfH;GV>#w>X4~A98+&YEj58X*0(><)_SQ`zkc}{D$^Xys+Qg5B<&V=V0~I|!FIU> zCo}tIG2xs3?rFNCj91*LrN&bMm*W5h`Fb5epvMG7#{yFQI9Gl*=s<$*yPf$x{kFNn ze0G4<=nBMw6q?3Bnh8Zbim+S)ca6yhTD-KXy)SqdqB8>-f z7awr?OeHc%frfAj>niyo7%Khqq6oO{Gzk)CSOG@wtnU77n|NLZ9#M^ZWzmb%pUxPc zq3!Qtg&W4EI&3-YxmEC?EOo;`MOylPiAg_PXW=UK?_G|sW#bd_am?@bIvTWXj{1LE z?4nB;3uOrg9Mxu8I5V1Hn-yMl&z_RU%9wUbj=bmB5G0s8ZzAfmsnO5JMJoXL6Q3)v z2 z`asSLK<--Lktcw~DM(?ftf7XlXfj8v#7viZ+F#rOfGNLmO&&1+n>>J94v+_S3V{|l zFXKx(Xv==2dWaIjkSV;@0~RdxtY2p%rz*D^3gv?G9@Adxxm~jda>-tPPk52i2MGpr zd&MPT_eiNs14BWRSj`-(Sb~z#+K3lluB2D<5nX{TY24oCr!9$Smu5A2*zIMy?EEI= zK?CIZ&K^)&H;v&lp7jSE9Bbch=+9Z4(Wxs)YRG-%_7(#!=iZ_7I`uitND31w-V)JG zmO4Etl?j!Mf16>FM4%Zyic>(iGs|%5%$+tpnnWj*02IX=3uDy$n3zsZu;A)S<1Wlr z@t!3ZS&OgOgsqM#*JLe$2d?iW_MX}e)3n)JMO^r^13y}x%*7VepmR)kz|zJdocLGm zt&cQ}f{K8Q=f>wCz`_>z4%`vb{zuLh?Fkf)7_3@lmmN0ZqSJ-Rt_m!-KR%BMD_ zgcS2qHFrq@_}@QN9^?o%8=7|&#=)%B8eTG>EzMBh7Jw;mn&9sEi{10Nd3yyMFOzMv zqI79j^56{D@S>^pn=i&m^PCG8obR?|0Ts2;Z+WIKu@VyZU`d|)Qz!q#m?mgmoYvbb z-8z}@@X$bhVOl$x!5ALQC}`YX{CaiSUZlT}XtfMKU&X{IuI5T5T#Faz6aFH)qG5*q zUz2CoIqy9Wt0d{``G}U=I!Y9Z4HR!#)j9eYpqh}4);`R|^9}a@WTUMXd6XT8ri@cy z)`bWk=UK$*q=6f9RU7FmQ1Lh|?!nRul-P+D?5iN;k=$@0nVF*5=%LIaVMC!rT3Prf z_waD9I7=8%KXnLG7IWX8mHvWBGUirQxFw7|E^Z!wL(~YyuU}U+y;p-TK9!vV=-;!d z&e%+4y4HF$NSqMSV!xiuOBQ}i<~XdSUy$V;wi)yd8}HW$QH>zV@RX_yzArPOC(4Y< zR_W-=V@sQquhMCmN&p|a)aVy00iWD&iMxZ88|?EFliFe=<@&r%Jfmtw+dWgIj9#_#Z;F!yJO}p*JJBo3V@gbMW=mM1 zux$YHeFu3AY^6?}Ao^x*UM!%#Hjk9e`1+j6qu|~5dnZuwbMx#K$k{>P6D*}FE*(}L zRTDQ#B0*B!3;OyvSjDVF_Buv)Fe+y1{m%OG2QS|2H{5E0oaxv4w3O3VAHDQ$&;$IA zc}wsUg+2Hu1@e$k`3C!z5*1vZWo;klVS+>>4Uq*fUT(Cz=~ zG%ace(eUxmBNv!k2XI9n-MQU4J}Tyb;sVlEGOBZ4jkK*@*xL2X&W@WH=5`~)EkW9e ziXl0MIgC>Njo%ynzl>qS(a`yJ`sb(2TqYwe&oI%s4L6CH3TpE)BZfn=DEmc zJPn{2Dt>)}zrChyWhh{;TMpusYlxb9wtgFL+EMslrryB6{>MH2 zrVHEy&d&|3*Sii*BWqYmS(v?UG#PFC3#qDYo?_#{E#KTOP{1T<|6s|j(}~}fhZQaL zImo~y{w7D|FRUEb*2DB4pZ8CWVIhGNVgbatCIAWaX0?2-R@trRa=yayqdvI&1F`~` z@!bK}K+mTRfpZ$|WdmdE4hG)({RQMYtYbMVV(Ehy zRob&gY!epv_puM!Xuu$Bo(j#Pxp{cNCv_zFD-Y5vyWpO~BUik@#~hi>9g!cZMgNuD z&+Mh6?bX=g&Qtpi8t~v{Z=g+HA}UB@0ilk&Ibt8{+L23fwI*;l zX*SLGwwmpVdcgmqUDP)L82pQT`c|82M&(=aDuK__s~R%qA*@do4ik`AOq94|tEh;B?oS7F{+1jj2^rJC*lcO2;}9hb74zP~H4&y?o>tVdLlD8=_MgNOTgA`<%N|GQ( zo3^=Xjd3!k%H@trdwSkjkzUN0H~H{pv2~5`%9NX>jP8PXPOU$UkUwz2NcY^S@q zk`1EnF{*XIo*wmEP2RRwlPYo`fl9@nxNJ_BE0$}eUprV#K88QBt&}V1mP%* zFq#zqV^Jb2OV};fhxQr!biHN1+j=Q68R&-f$SBeunnvBjnT+7v-V&l7ODnJkLote7 z2fGh+hhU}=iLbLz_JoZ%mK+c)?0LhI`MSUrk{$R)0|gHI&<)}-YC%Q=Q7^DW+kU9c zVTd92!O#CMon4;(MTT5iPwai4p-+uDYX1z$D+SU}?7aOUk4(~Qwre~>jk#~3(6JA0 zQJdfw%09p`3pACVDFFe~tup8U`)Sx;0;YnmwFQ8HY296pY8i`gTGj#t{7=B*YVX;RpZSc%#mz3DUz6j<2muKYty^eB z7g$hBcd8LdF3VONZe997Zd7g{fRCKiKbpfy0-e0WR=_5Ks)ox@+HQTkRYLVj(HV~14K3Hom-)W$f=7#*_Wd;Se%0#;prK)g>lolc{L-;_I_=BP$2@?^a* zQ6sP(&WsONCDRC$s_lfJPx2qOSlIH8N->vMX27aMEvQk{7wqk3Ri+n8(DGy5;cv3Q(pWl2{;Uf8Z>Uhz-2~a;}LxJsz zC7)~>omgVyKF9u(IqV|7^Y4Cd-$gtJLx=#t$}%Lpf>ze&)Bej~0qFpubS5#c*UgNj z{9r7HzSk0W1{jEyk;Q;C)p%_7sdLUk19l?T#Ud-tcdiTGFt*?kAW}5T;9R6|aR)wZ z!HdEcyw6q>E!PFF3MhDD*n;;3QfrPacsSUCm-lzUTgMi>R^yGg7|PbU!TgfTP+=00 zCKVf_k37g+HdT#V)je9yI4LJL`>;)5v8Xf|J zfS5OZ2<{LPP$UsIb0#__2$l;(`O-Ow{YR5W9`}mGm52$VnBe^EL$6uatTUN9|;jl{*$?zhVS zoz|44ieum-0|=Ipls-}_DI5ajb3ad%-IsnPQ24}u+vfs)2;_iWgM~8&KkrM~PX%39 zLRDG7GG+z&RKUN=Bfzka7@zQ!lVBK!TpH;P~b2eS3 zrnlc#kN55ZPMmjYz$}Xr`CGO5!>}+UZ)&;(H5>me9r(NXUvF0PH(}n^&dUfxX56n~ z!j^w1N9l{q3RucfIzTyU0De`o)IXG?15mZ!*H4|0+VAB~bzWkXufCrSffb!-ByDYp1fjx$c^PAvD{hg5JaETL#|;$>Zt#O2}#RAX(eZ=QvqoR=E(fq)ses_ z%7|2dK#Z>q{g-$7!GLDgL8BwvyAe4d01zM~>fM4jyr8_Mx!(WM{&l4FR;32F<*k9(^G_^@h*CFj6_0&(=H? z_e!X`d%YL``oHbPeI;Gzrv9S88|#a<;4Zp|bguOz-dB(Hg)zD=#l~K*#R-9_3|Na} z*EFjdbo~rEXwe#Pn738+r!qZ&LKl zu=n2k5LSRqRC6b#FVvl52CzsQn3iX{NzV;f@TX1olw2$C8F|3L2Y+IBtg(Jg8UV?C zRU>fbe4?Vq%I^PBY?f_t(=slwOh-E}+Ii{Cu~n2)VegQimr5*R)juxXWhK#H+nUgX z3(tKT6sxooF_U|`N}brJqiTB^6~I8LMh!zWj1Jcqy#qE$5`nu6Z?0AiuRd_nFA6T% zRML~u2F_g^I==#xMOd2qy`EcZw$=VVx3J6awJ&UbuBJ=fF}59LKPJkm7>uJOSyi5T z$j6C&`kUI$Usife!us>?t`Ez?yk*vsTrWi+FJ*bkcAFWbER^H(_9=$`nK!Rr@STcO z+DPBXs@%AmoC>nTFMrU}s(joKWlhP7(R}@4Tjj3>%$JzBjkExhYJ@7AHz6+pgB6G+ z74F{hipBD+63UU^L}$(|?^sMN+X72dj*LFbh^?3R|4{i}zWujh08j`0V4oSAMq4OY zYg~J2Oo4v5T=6!Hodwz5^Oru;l@e>vxjp^Y%3JaG? zic)&GHj#hr`&%XMkvV9jg>eQ1Byv0)UFS^kuc```dU)3aFbOVlRfcC{3f| z2jhYz&*e}ES4s)9qTq{BDN)4X#V5`rS}>JvZyz8fJ&PL@M*C{=J$?=@Jv-disC!Nm zhI~~i&djJEaG;7*1w<4@tgeb7~ihV z*uS-zRR5dtG(AdyaqanawAGDg9XC>CkUA6Yqq}Daq6B+GxN*dc*Jp+$>doQU+!m?>Q)@2ozBiARu`sW&4u^URRB=}U zQH;QsGmcbWu$~-%J(rrWeO>$%51m9o?zj|={PW8sx zZQrAnIgZV2J%z>v??Z(-==s=*+&>Jpg_^V@|(hOiL*byF?u^G_6A^R<0Jv*r3DLYe${y+osCCj@iKD zbrM@)d8|=~GsKor4GQK#_XsC^scz{<4hp-kQNR7RD@2^rG?e~Qhb&mA=9SX=C_ zFjcJr|Ij3!v>lc8*dw*M%og;#pccFECeQ)FZDM8Xls$5IY(kc6@ynIb*uXe7?hRp* zb)BWhza+FQD*CC3xu=eqN$Hex-Ym)Mqfa!d-wb=}&ld*^P%Hi#JXo#kFpaO&IZ<5n}6sn9I;>&V43Z5UJ<5-+nTJXyp9x3G|!dM!Nn{VS&on*fJd5HMn| zW^Pr&$k9gm&o0I>qN5~7pJq4u93pBeObVH=kf??7697g0#-Em;a$$ZkMQtjRUu+mK zK58SxF?+|8=9m8EbANhWzI$2BH1x{r8^ctgfxfloW@|l9TXKKgUpLP9aUTyCAyQJP z7c~jp5sE;?l&Hed+lh@1bebl_>Cx`Pk-(1hnkWvDRrn6j2`i?%h4Uz0xzAS zHtxqE2|h08%n&X-qYH9$wTs9$kKee~CDq4l_kgzkolCKs!fN!{o9on?1+>Y#OK*8_7Uw``}pweTR zx_$Qz<)Sz5Gp}U42V+kDMI!X0I{5UKctvTBvtfZhzRTp>9_yqxmk?Vx;-fK%X>?hR zOXr2thh{PjO6!xt-2sI4_I%kPy%MZN zKHPhkEMeoLU)H3q9(uM_qR)mcSYOzaOBy>?NC)p1Kg3CQz~?v!iQaBz0ZU--vqoQF zs`R&!jiN3f+Qs(uKJ`(|3uqEaGr4QtiVwD~*AV?p%_X|?w`XP6KOzU*f0zpYw;#}v z2LclGRnvfogg>@KxdElG?D@C*g&`a241YeJC=&T4&voE>Ak@P6dp})4<9DGz0~dR%=!tgdUP?EuMT>k6INJhHP@SwCF|ar^E8r#s69YF7;f#pw zbiM|Dp>!XO8njx-?Imd$`=Sv$-XqmU{G#MhExrRmeXBs!+gw(kW5oj?EwF$4r`}H+ zYTQFLLV>-WX*YzR*2TxTa6zQ zlsZ(sS<9+>c_Q+}<04Rad|FzC=C%4*gjUIas27KImaWwjXaNNEpeoY7kFdXtDeeH6ML{#^iS&q>?B&9@#V zR8poZiSD^8x zEgAAdj}Z=0Z3RJlSLm*+0F~}iGWa=7OPD#pkT8#L*tZE@YN2=lVz&0yZ<>fX{v9u& zR{%p1;?eLY;W0mkG2{qA+tNx_5_!Q&j8rQurmfl>ESq5H2j*DI`uKRjU(CkJhN>8a z1pG3aA9c*#{#YWR!0R}X(fBj|1#`W?_Q$h6aTHH4G!8BO3wk(n^7#{VjsC3xEo{q7 zW9CF5X%n+m)bf-Dy&JWaSeS834?$XxIJ!GFvZ%XK>b{~fvoXGKtxG6g2C6)5sb z$nE`g?1@MkAPZsDyH2E&loq`gup+237qLmHaz&-|4WS9V+%(#A`FrySEo9U zWE!37yT@r@Wj31jaOVMxT!z;*rS#Km)t&GHkTJ=f7f#orOZ#eDzsh~m6!4(`szI&%V%u9aCm zcWMV$>GzJO7c~Qw>^R0tUf?n^FrPwlWIo5y>`bqQLU(A&Li=UK)t;wruMycJy4|<^ zqY1TXk~WnQ)X(EHPNu?0M`uMFz4rbnv(|pTJ5&^u5PLV0KLZF$n!$@1)8XsJ79PWb zG34@ShyOjwS%RHqv*g$i`5c0rl{@ODCRHPA@j{_oR8n?sqM?w7Po@4y^&i*7$-nso z-$mRh2&uP#vHZR2T_YE0PVyPDPWqLKM?58o?QM(-^-J#X@!8=N=l1yKmB%WDkm{I)eD>DR~1jasvJJI+~;{m|*%C{n%HxuMbg za&n_e^=d84lD95{gLAW+E|-CiY1WT|5#la~snv_CN-MRB2?mmOMq=ML=@wMG$z{Z- zDCAVD;5{boh0yXgG2OKoICgzi_nZo)ovfMsPl{Y?MpS>kd=W@-83U}r1!gG=iWCS%BZyy8reImeN}fk^HgbEm*$Tr#z@v z@g`(obg@YjIbnR!KcF$=UR<@fgr^a-0o`7gOnfkSogCcybDb?I7hPMv;GW-d(@dS$0nLxCQe!fF4>P&S;K5tyiFoxWm`ody$y58A7Y=T$)rby>`Fk3-qW zD_S|q20}XT?Hbs3h$I>hJcEF0w&h$CY(q4j#8-RJ=J<83k{_1sOm0fcj68=nRD1xj z0OgIuV(Q(OEd-e>r?-vuvYr0?2CfG5vZ}0RDa%7>AVZ&6;q|GFe;FzhBd0Js$8I-g zc>Zaqi7cw}uH(aG_uhChzdZhoxV(jY9zTiEj1^jB-M7UJ%AqY3#usr=+|?Ic+c?I9 zEP6(+3baUwk!i2ptV+*?`EfiqFI_VI(?^q`)oG1%YSxr}W@0@%UCA6aUa*)sD)ey@ zJI>YdxWUBJ6?2QggPcAVx$~_vw{n3z6VwH4NjS`X{f<>+9YoP@b@xZAC%{Wpg>KN) z>Q@l$`zRkcD1C>7*$IKUbt*|DskCXnlyXp3_>V7wfCuH7SyC2m;c;3 z3PH(WLHCt4g9n6y(O7`KAnd+Bf`EWjo}PxF7YWP~U>w^OHk|rz9@($HFD-Ko)0WSC zKa79GnOq7u57;B>U`mSOS^K=v3$f>xomQQ-Qm#mz9e(SlOPhB7rkOQG>L;5pIV6{) z73vqU6AMN)3{9uZH++U66q*L643N51Kp;eYH4?Cb(wN1lXY`t|x3WOhsE+w%;_~^z z7?G5SI$8yPLO8R9_XKmpc8z)({~in$XxeV*Yk#@T`<^u4;Iy0Tk+&&*g8<9c?*wI7 zRLq$6;H10MJ*l%kIVIsiUj!q}WyM@*=G=aw&n9Do8lVoY=TMs|g`-pQaP<|kMm2el z?Y^_I#N?-o=Fl?QkL6}5#=bvFYdKac-xx!ujoPgm9M(Jc?F(0T)`rQ}ugk*vEU)Z* zgj+pj=9QK`yOo~eV^x-@ zAnQz(NlcVR%F+-!%8I5=4QhE5B0b2C@lM^BN$QABz}+;?^UHgt)^WQcDS>dBYMd)= z;$6Cum1T3k^}uF{ir|LcK|eP-*^Goc}sUE;p)(tig8--(c-c6_gfnD71LeU`h^Cxyp#iyfMQM4wt<9sT+q$S6@x_e}x58{*uvpy994eUMk)#lG%3YYGNlUs8m^P8P z8{TPRHX?`Z8&}o5c7nRbe>;i?KFwLZ=PO#lqWCes%gKvEdpf4O*QU3$oY-G#3$Ibq zE&9=h2NKpxyhqV7gG}{O=Fw(WXuPbfSAnLvA+8XKo_1-K zPDZZ9B?G}SW?nMp-p-$l-NTaf31Vd!yN-jSR&elw;>R|!63jybEu)jUWB>!2Sn&@i$F~coz=A;>v?M*Sc1_i5Fj_)tb&%xsOL8Dsy+6BBulFc|6ZY zE{8Zg;pG0SwSr*L8lO*4qyn@|q!p9%_S9cvwg7WDe7Nro2U7)Cc_X|TLWG+1gQhU7 zYSO1(h#`}9l!#BacqZe5>eWF%CQz-xh^`rZxVA5p+csg_8e6(0w7IXhe|cWr6~Vf_ zyW^ryjK4@~{B>tMkeX-%3d9%=_uyBh9VL==*0plgAuk|P`b)LY?;O3u*tE|0ysJFH zJ-kL(d%^(G6DkQ3o8OPb9?6DH>aZS$=ETqKvW6Z4>{nHzxJQn^Mx^XEh1Z!Xy4p;X zObuP*mna&Gem|F_)lwx73s5Yr1AkaODOS(bGn%+`L^ z5`eR?>e_3!l^hoZt#Qwa6t=9^tpCX<-JwE~i0(OSJI}p)b*xZu@FRgxEiKEEpRpL3 z-)2fhbV0>$y_oy8--jypSO-XG(nB2T@qykPEs>L$Q3O|0w0goo5+)`BiseFx<)R_a znFSYe#nG7!Rx$6Zs2w3N3c17)BI1L1;zXqK1EM79uzuVDl}dUZSG_@X0V5o>Ts4$v zKysF!+0F~4xgG5fcI)6>p=egBnM*bw@1Eq6`aC=Fc}FtB4OYSxuCx+~Gk_J>d6(q+ zAmWz_8w{_r*mqL%(Q@gK&Gm5!UPV`?vQ=rhE{Pb4ek(Kuou3 zj*81k*l^7iVHqW#jpot#0_18s62IByTn`^Y8hQDoc8Xfhd-HrjsY}$a$xG<0)V)xk z@?KyIG8oePYAkc3qaU(;h7XxEjBsgo`H0|)MB_%VHGXwR2SN?QD8pans>xS+E*_5; zu?!E@LJwtFvMw-Z0z#KUNBv8e-mvh?VQkuY^C+tj3MRN27xN{zktGrRf>!{kvo*Cq zf!F+aThIT!6F|SpH#SDZ1D9wwyr`S z+vi%m1rZt(H`7r~CVUzdR+}C*mi2g@`>dDPm9!2i?FK;CApH6qZDB|cO-2&q~sO$gVn70bFHCMGvE(mZxC|H=KwIn&(@v@@uu1q z0R3T38U7S;3AJOKPVP^VtinL>slxeTPw! zz|N185uL!HlhmoKoc+m==QR&ES{JzZy=2p3ziWtp)qw#g#k4m+4nI8cC&b-4=hTF` z^dvv``R?s7>xY`7BV7CldJ^Z(AhO=zdK`Spl3Us}FDveyEBKt_PNZUXR*N^L49bi- zoZViRp9sPhF(>mu|Vl)t)-UUdGH-NQLOq zv8wycs5g3?`V%~&peuu;M`DD|9TyIWM*%p9r>JEt**#uX@v`m&QSB+{||BNetG}It&?h|Cy$6nYGBv~UFkYtb}^f? zp3V3dpuG$?rEvJf^5TJTpg5V4_gbFQ78=Q1r~XQ!UPD z-A=1g1ht`WCzZZnhJ1IgLPGwEL+-}`h07Lt?$Isxq5YAv;pFJZV>f20`V%cG3-q|4 z8C|ThlG>^@zBg{jx=%~UDZb^WhVo9s1R$d;o>J%u`8HYwA^qH6NKd$iNk7X`ALmhL zP!Qw7W0;v7xAxXiKV}V)O)57{KUdEI?sR7u!#D((cK2{tBuJy_mTolydkrk8jypp<1J|XJ|S!Bg;rq()^BV4;57zm9xCh@JrciDSA zKJk3G%U&JQEz0NWTCe_#O~SUpTzQby=Y<_8CIS|`te)H85lpe==0QzG0i~+{4Fk(Z zQaj1M?j~GjOO)rT{0A4k2CY3YB#?9+>uEM^jKm@0@b;N9aO;4Wc=3z8j{_H{ z%@~!-7ZSWi{E2EJlhZY_A0O$}4C$f~F1+lpY)_$VCYG3OR1DERwX%G*>XlhIV?EQH zZBXx=8*z4r4$21NwKX9EM%lmafJ>joUmdP(<6UVrJ$UBFulMjGxpm!$f8)KSdEsDe z*`8fOrMtJpqQfr#m2<)r2t5?-F*?NIVzBZkm%LX?-e`{vFcFcy;O)%KQrCudSJ1Gc zk+a30(uQ9!Xn-8GCLbVs3>z1}n%>KEjaTY&4sbls^fbi8FYxJ^F}ts804Yln{&nlj zU&h-<=5Vli@sfPIgn}7B>ut|7scNEFMUwdp8#8Z*jhQFWZAumsWEnxrct@&J=14nf zNOF2Ucaa_1*4y)14W0MGfn3g`y6n@o)W^Ph_?-Bs2@$~)^B_in`Hk$^_?HKXf{A(+ zAC{w*=uM?ip;b6`7Q(R z{K-k3W}?XM{rj<)bqn{5jUpmlL1eBMu^abp;DgnTrU+_l;;FVWy1KDk%zN)Y-mA@I z2e$UOycqhSgm56zw~?Fj+*>@W_w;Y2C`P(o?0MbE%ekkvh8$Xwf1P}84^Q-pb=fC0 zZ%xmeJ*A)e(o1u?&2b6Alh|SSrRTCBHtT9;%R3ct@G}8d=bb!`!u!Gy93vXSDCxK7 z5pfWFA2SRZvu_>E5tz}2@>!X(LdVWfxu#vN;(&3NYG5n-L)648!m2lJJp0si)L!jx z{T=zsI!m}&-P^w|9Jm|Uq41If_u>jyZ|b$)PWkjzV`rPWLutu&dpdX^XOVgBP7YoTPp`C`0aiDv_n$G;hE;dfG%G?adhSZHxW4!z}Ie z`bITpnIK~E%#bdfKs?uV0X<6&_%2TiUDmE5tWEUZUp;5!!^oodd&mFKkv|94@W9uB z^1tRw{|e6kZ?AFxStnZt!ifI(wF|z#h^qeZ>`%wx$^WvxwE<_bqW+W0Ka_U?r2GD^pP-;@B_e#RB zc+SZFnZE8Pqc<%818KMIT(MxIxa8g4ucI@1g;s?e#8NExH0thKX?b(h4b<^ee4YT8 zrWu#H5Zqgmqx=3b2h*SR4c)S)HG(Pp7SL;TTwjBG8dWImg9bj>8eem^yxJ-MInBNQ!x0^RyqfJ>#XyRY5KF}q@%0mKdbar3 zUwh1T05tE@Cp<9ffA?LF{4BwhOi*d1!^HUIP2wgYd)^lwK3fVJQ$?lLYI6xkm&4P? z`f5=3vPFw#n@ewKVOMh}l+xOXug>(ohLpNx%%-9sKnf9zimtWx2P}#e=2Ts!ZQTaO z`@O`@JO-?qrSN3C=ffWOgl>fWNTge}x@SpV0uMRLzvcG*s+=WoNO^VcJZhj*&D(dN zlZf~Q-3i~>?kbmfgsJc0cP_fuh1%rdD%Rmo-zpSok|;xz48xIZnN9tx58iB;okph{ zr`F~`t<2-$IfV!J3YSzX-?Wk23p2meXt^qpM5U?lC^U|#UiBO0WHqN5`EK)0WwFQf zt(J@)nG4s`m9L1|fWNOW!vf?`++kkf-7QGff5YTj}&Oc|F z)ajKQezwZJUyxHEbicq;t3Z=PL6|&Omf`{A?t(zhM=l(d&~R5zSp{L6?+ z52ciwV~nj+m2a0i{#-dH)r@AFrCU4Qp9B$;+)}aNEcUP`W>pIhqtcG@)VixaE+;G+ zSKBs0mZW4b?iAh%1E_Srsh`ZG9aULTIBzYwaN17LKPxi0h;e>V%)j9m@q=~-)9$S^ zk*QI~*~mIR|IA>(^t-2(iETVYNY0+uJIlQP{vk05tLk3yy60S^Pg6qx&Bgn*nu-~^ zfnr1Hdjx&iQY;b5B2!C`@-?mXW*nxI*C@#-V<(F=bKyJ>OGAF$G4HSFKE!o~x#$Q+ zDlOfZF%PhdAM^HHcNe#fH?&kOwuvj_s_NSZ8=4bm;J?n))BQrbO;vVFT>S8%NNoFH z)#Ih=f_FTf39+V9yJR-9IiA2(eA!lz*7_@t(k6(wrEQSQ-mx>ZXSu+@gXMt4NlZpS zr}<^_Bb}C*x5n&_=U;2?5tD-M{CLK@IW&y;9XgXAGySJgzVd^N5LoDZ{vUXa#gB}& zMrS1lEldIqLFWSQ;+*_2;hh;RC%Kily^h zK0E#H!eznZ^zMa(zb?jtG|Op;ZZ%W*jTR+%y|nCaemIdnetkYwX06NgA_6c9Ca!*W zthF6waOVe?jTMWZ=ZRbD(wy6zUHnk~S)MWHO0&7mDyxrszQUSFVWL_Od`#z3?d7EQ zr{1YstvoxfobdAtyk9qQiQZ}CySt~WGwU{ZyIWCJ{8hm=EMXP zuZ z(?YP+f17LY=8eFw{c$P>q;582LpB*`WYMXRpvFSgrr^Os8MJN&5%13-TnFt3nQ#1f zc9p(Q<=Z10#7(L|>C=GWqH;x}PGX@mlx1YeVRNJh7q@PF_LKYmHg5xxQqKrGdJbC> zJfG+SUry|M`z4-rj7)7Gjx7~hpD*(Yln5&7oy-Z%QHq{|9wL4nW(&EWrs9A>4jM0PQ`kSP?v_<_1b12aNUiQ4hQfno|U7x@t!_(h;e z9jm1fc6O$`le76UYLt(u2u#97>`(cvwRF884&6(5V`6};wc^kp26G)j+>2V&LgqDE ziD$GG%^8qUp+l)i8}yFHRZ&Y(3r~aD)_#Lv+SUHi0ghwuPB@1Ug7)i5nQrMF`lQfD zpckQnEE=TT(WjZD5-ft5;j+&D?3lQCSWqS9W z2aJtdOUoaqFH1i8_;=zn>Rq zs@Ghg>efTlU>_4sy`d6`74=7Xg;I-`V{3U55nE46>7gzG(4)oS%8tA%Q)P(Y zx=b;PW_YuY(b=LnF1gee zlCXQ-B`;q96A2x5w~EcULVTyX*A)=|XvZ8)?s>74mkJphmXx4(v00c+Mz3AG2Hx2> z*0f$`bd}PqKnY=KypJeyMTUxo2d#}*=!73gs`s9M@bGo(n z;QNuy9u}nKyQ?z@R*@sevBA2VS`%Z67xVos${3W#sZW6kDRAI|xz=hZoE(;z&*@rx z^mgT1@D{2OpEgO>~eC$?j7kXkZzVLNTdHm4BEZiJfE6a9Gs#l*PAprTK+XU+!N#) zGO+LaqD$mfv9~&eI{o~A)pecGaCTjrAfAXCj28aF>Ki8NCAc)@deNT!j1G*zuK<*}Z`gRYMpJ}Bq$*S1(iLog_^BM_qYov_M z_WEjGNlKMw{|x(hz1jOvlTgSYprP0&?<%1nVpvyO{)SBa$x*!%%|d6Hec-!`n4F-O z*Q0hpNXMkQH3^FLgiLs8&+`X9zb~R1&StkCfhFypV0udYul~3Ndp7bhNfOvNmM?oF zlbauPkHWn?9j~YTbB^)$Qbc~^aw~6`WSs`wDAW&(7>)2TDRi4w^{h*L*!z$n0R659 z(YZ;B+)E|&d!x&AKf*cb99~bA!MUH=1f3A=&39myoox(Y+q~HSJ-oeBD=!GiE%_bH zkn=A|*x85^vdxR>NllG-3(8wrwCM(loyo;}i9B`KUha91%DDIAg|3b&Izu!6#_mNk zmWf#=a2&a@=HpN^qXXL@&9?d7Uq%0WujOcJ!M~I_Y1{rPEwx4gFZs%cfa)i3b%N~py5tWa;Sk>C{&SoRMz{W>fF29_@gIl;`u9HoJ{(4l zG!XXfYQ7QlQ6?^dFGn;tl8^<*e5AB?Hz2+?Ue#-i(@m!?D~UT#79L!wJ6mB9wF80; zhZGNBnB8iS2+jyDT22KusJ5HN-7h}A_@L6b;vcpm#fOCJuY3%zY~W}5%*ar#IQk>r zN(q52CFC|I0ROF4TpDgKbJWj0kl9e@@vnaHb`t-~p9>8~FK@n)_?uchLG2hcNAm_W zjHKL%<=NNrh5i{T71R%T^{ZKnvlY+Y^21go`m(n<4jrg9 zX=ptuA9cOTiA*;tjO zAc{uCqIn~tzwO@C>Or~)0Ob%Uh@A_TA7*Vy(2e~OmR;zo3wlR%lgaV@G#*{~Xh0~Z z)YyxnoE|S6At<4;1n~KsH%%bKaXCfLGu)~{Ky`>5*Y?*$k zJ}uE$t(MqxJVZ#^2n#uDV6WxU!&k?CtSD>e7wl4)v(qobE1s;r8G;~6QfdjHb%P^? zKE76|KVY30=r?d+@|KLt<2HP8qQUO4)7B+2-I`~Mo?osLKw1&wFoR4RsOcZu7g6`M z5N`5#QLcApj@s6H0Ls;i1}JNg!^g^unBxmU%+ADsMAitoePj&NRjFN?MbP-TPPD@jOjiRP?M?QEx= z<9)_A2NgpxJ*)$H)+yC_%C0ZQBh;s~swt7JYoW0BTRCn1-9vA^c?JNVxVQEWnkMlf zt_ELU?jIjvcn_ijUw4}xPx*(}n$UOIe=wvn6rH5DYVKv8mpCWZ4&3bt9}s2^`dqPi zHc4PSX!MnLU@633R^jPMTEBemynYa36`xvL%HJZL98VOI$q^LYby2l38tr74CEh>+ z_-{Wp8md>Rs$617Ve+!dPov~fwLV2N-4|~yEd>gOiBl2kq~0lE{z`QOM)on^tL|a< zV&vhk-GhdN#j`6fUWixUm~~AN*cO-|>_WWCWC3$sbQdkTTW?|rGthMmL5N7^`E*%< ziZsk0>lT))InCFo0p12kvI{ss-#m@RzOZbyYm;gvUWoAialf+Dhs0vC_P;0lT811b z)`Ut&_w)ENnv|x8&AacisJJ#)2+tbMXaZ+m;WK+)dFZd~;+OFsb);kQ?+$-8DOVrz zpf{s_e}6pLPI%7oqmwU7f?)y{`pV!;f>);3h+V^*{|pF#aFTrJvZ-f={SGnJVGIY0 zf-WczgMI~8VzSlk&W;?BL{a^~@lBc(4Viljxl^EH#trXP|0s3xB5l>hGewwAEYVUZ<6vK&(A`*9_jMLmwP@PJa zcwZ^nFvi&MU#XmD!hDOdUtAFO$#PaHf~iO5vvCrBoKcc~Wn(y#$sHo1Ge8aisDm8| zWY^5CdulE6myKSrevUe9Kq8?9TnDz|2*iJaDhQGOjI24LM2pTnQ0n^n))`XZ-jLtPmvSJ{DB(uye%Kix7YSI?^tHtmtog$h^ zju5e|9uV$0II;f+vWn6`!T}uv4h<~(FlIvcOw?Cd?wIpfhU;20h?=G{9{xM^seCcj z3mW2JIqSQ$=H7soA&aMoK6s0+rp~er!Ng{9?|eI8*RY^=bg5|&XNTfsbO6Q9Cvkfg zwN;hqSDQ|>=QgI%6l%oWcn5d8p7if$7|pxZI2I1Zn(#G>lv#PTu0bzzG-`Ox)MImTU2J+PJ(hu(g86WlRL+#J%1A06PUC z4XREm+$f12S+%!yjJqu_hTo#9LdsouB(k{7P|6F8+x2`p;!if2y&A9xnmxH6+dATTUoSR;-3K^5FuIKXPtB$AL zSav4wm$6ZHswOPK)5Ao zWVMqT;?5FrODu_!T-D9;%(7{;6IxWP^M=x@!O>2Dgxp&=lowKKi6~F@ggp&A3(N`} za(aghUWXOKOB_RD0qrgvx;SjT*HV|yAHWc!n5~l$#+_<(wuBu%!QuH!RXw*UVBS5U zgD^?Orr0b`y{lpAB>;hX_rEn8y4tJ`a5II0>dBmayb zXT0;DO^pAFX6!c}t{{@drj~8J#;9MicE&+8{%%P;xMg1e65_t!t0{dhT7OP#zA5Vr zdi_x>+%D2j_iPecbOa@NbO$NNC6|J(L0yQdbiSDo5;Rv20`Bd#B#%1j_&r2DM@6_f z-CD$G>*yJmU}->kl-hp{UI`o!X_duY=PKw+p+E00!ylv;cH;^gEfswohBE zIK6wGnw$PWmrX$}4gsv7`0IGe)FF}NbnheqS5fGp3o!(bQbck^pqW90df!SyboKFa znY(ne-9UU_<(C7ZgyZE-is#RCz$1L1zb9A5?%$O(9M7{reEjsNI)ih1-n`}J0<~2& zwZ!S56D037tKMgp={=)aTNFq_QhLEqi{V5luDcrFDX~tjho|5 zC{1%A(4P5U5^B|tKKC3?H|TK_B6J=-u+41QOVGbwmJ>at{NZF|MA@jx;6)Lmz_-7Oe|U3@TL?f!X!x@ks~r#gJbfVcwH6oZ&w_-b zF9Ep)(ecLoxH{pJvRX}8QPXfyk?|@(H5A!Qc)5hFNFFTt`+&4%WIfE0AtyFT1F8?491e|Vuz@%988WDmL#5Iy@U_)I@ zmGuGg=@cEGAJD=xe!$D+85*-^3@0~#_GNNzZcKJJzI2sj8^72hiP|d@whPFnjzd5g zT}>&Uh;;*-8f=^1-zSBMB39oNAnK8Z?ag7?CQeekL9Q{ByXHKCzJgfBs)oU6DlT3$bnL(MUqiFlkO{ft*h=u|=N*u&~I@%T#m9{_f^FG9eFpJr3_L`zfO zw>nMrzVRnQ0i~kb7g+vLJGI(XrqwTn<5K@Y0ViqT@1Nov#Md@iAX2VS_~$&-7JYz zPNzoFVXkB8ne{xgIquZdJ$`by7DyO2{7tYv;X#= zCsJaae_+?~|Lwvaj>eDq$k+cu?6tU3mf>6%{Od97^kR~Yb^hi?`zMlr$)F)a?wf(X zXj}S0&R%Ca*hu;4yN^p^Ph^>cNXobab9AQB?gbtWDUH%^GV7LK2K%P#e|o@b%3!6^ IXO^M=1FXmX4FCWD literal 0 HcmV?d00001 diff --git a/windows/deployment/do/images/installation-info-4.png b/windows/deployment/do/images/installation-info-4.png new file mode 100644 index 0000000000000000000000000000000000000000..41c2121e72d33629d007d4069565fad99200173f GIT binary patch literal 13937 zcmche1yEegx~_o;8XzPM;Sy6fq;-}OUHMeYR#F$NM6(hCK7X$>T#C-sl@P&Aas z?}fM+s>dH>R}DEyr1BBc{l|@`Rub2Jj#de;&Ku*=1kg2CGQ=^t^GBvh-fzi?!EF6~ z?N}(vK+Vm~%|p#i!vYP?Jq`}ik&%(f5Om(?`Vkwg9Zqq#hI$Ns06u*T^s(UjsvvOw zQKgiA{#T9indD={e~QNcaF+}owYc}qxM9B>2L&H-vD;Ift0p>_*;9z^uGpk?Zjf&L z2s!vtuH`}Kn*ZVUD4Q9tae!sa`fece9@g*xs{mciLO9Pv@E06?_dOnDFC9(}!8bXk z>Un>HNh058b*VT{^1Ot&2x`$OxYdDEOwO2GwC5yk;bYz<9(QoXHbAX;ki$g;Ghbir z;|j9{@76IA9VKutj4dwhBwFXmbrbqZzOdWe@`t1m39w|-KS4wwPbmH7-= zMf=Lcr!97HyC}YL)3kFeju=s$hQ85l3jPUIiIz1#9R*%rEYAuQ`d=KcKAfsfk^CLn zGgLOlY$(7ZJM{AhnXe{3_ZH^KbAmr+urGC{NVqUn336h8PYO=e*GqLS?TmMBbUzPt zSQ_yarYQTgpg(UXmu^`;nz)=brdxF7W*@Rhg=R8-mwpRnP zKVm=A+b$Zz?p#>Zhh9xEyNBsA${o8lUeD96piEQx>JC=N9L-ByqEyz|e`JTT8T5N_ zwuQlera3|kz4*k8t=Th26MP8}ytgmL;%abRvSSxhV35{4#C^TskdE=SV#Nrn5RQV_ zkM1>CwGb2$J(fAgsothnxp@(X6>J5myMAruI?1#m>7`gN#j5s2xh2>Y7Q;xh%h*Tr zboCapais5z_N^2BgZj_#1wGV8cxpg(PleS&?7(&=+NbG5gAJ)8@?IgAqPmN~X zKhUs&ZF?t831==@YR%*2vR8-~C0_nX3%8xMx=~p5r7?SuiN382!tQ0G#vQ<|awaUr z6{p+qTi|;!(o=|r-`M=f@1}gX(#g@MC|mkP72^9!yli>$uj;E`AXeA`Th0THYxvV4 z#u+h(QFEk}$N5|AG`o8uh@IoRYZhPTwSAB5;RiT{#d>1Tc`O>#Ss zvFGDW7o$%v{ybo9dzh>6-6v!(Znu#ibLx0n2oERlPxZh|rD*e8-1f&KVR)jg%u5_8 z_|`XLOCmij{VIDVM(|Z9(HI$q{j0mf(t|q9ew_x9n9qo7L6@s9npHGG@!X5)w#Ls& z=lz#cT1BL906L8;4)W3_B$+@23Fz9xcNu(J@IdHypBOWCIB3e8iIuOW5j5T<2fC-Z zk$VQQ*$oBXFCHWI3_;m0$Dk{Qhx5s+`(@Bww(s_lBjpXiLIiPcdUH{;Cue$VNwoKH zMMG>^A+jmP_-Eim%C`N!WF)-y!7bUW;q!By0LSFD(E%sV=3$1Y7SiI!p0nv@0d?3N zAB+_2c+J3~6)i_@=eH?%cDnQxrqFrj1o8Ngfy&gujH6zi-U9*ph{Z}|aKAouuGY+# zR1#UV0tWvcZNGV@O{^k%C<5=k61zok-j1<2OG-ZQf?RqBhc|FGQP4{ENZm@-XP81xf$yYh=!zx;vhgz4<3(uk(>k7X%b=mQtX%||L@6`~0 zv0J@M5qI+(orM}UC|9fmn5R>{0bCoQ+oLy|*^TRf2*sQQ9kf&~60b}__kN(bAyoAH z#Ysl7XQ$_;6-kJ)lJvbZQ!$@o!iO?%30@GaE%W|bqb&)ghW^hW?DSBGN3Ch(vlMCo zP30~%dKsOLbv;0OSoh1cdn`g|k=f?JHn@0uQz=uV9!|gUQb4TVh`VE$MgyGiS)eWr zG&Dl<7>?V0s@~B>HZmwa*c-!X0V`PirqeW6W#fLcCA0m?5S$^F`Hsu<;wbZ)5*f6u z4`Z#aAX{`NyF)zOm}dH|+pT(1nu-ehKI~gPocMziEAqeUl8cn1KE|i~IhS9unQk}3Gs06gNDR9G>rva%6lN-4NQG@BJZ#2GVmsXy_Fjwy{8t&Kk zLm$dkHgjqpHr+2SG&iw&oIFpbD<1at1)8?39`1z2@8JcRKT?|0RYAvu*&N^sXv=`{ zq5Rpbd&7Bb`s&?L%Qcjv9d@IddB1bTl6K)EG-U z6X>b{{OS2fNFTni{ud|yn`{4{>|*>`)%x8<_*aGiqO{P z6(!CVzb)w|6Nt`aF5)88*oJgtabkN7EXK!EijJm;NhK%TmEQ=;_|0&GWj{){)NM?h zGlofxpmWBby6=NXH)E)pq(3AM4oTzbCG_#%|eV#Q`g?x zfBm$)(rEy$xzjs2n9lR22^iEJ-K%*V{9p?omb^YT8F<;-u#E!~ht}0> zxXb7uO0tJqc5TzbK)*Z_;h+7~-Y1QZC=s)M;s!n4+};k4y{UJ9_cj0Wky~npB=BlM z$9kTe6tI!eDV7hC4i$?T;`3^^!OMFx5_?Xt9clxgs%(?@nfkGEKA@`dLTVg`8^R1$ zSq8F*YXU6=x}Jk82Y=D7L9U8k|JWC&3^(_ z6)qo+K8>aM6f(!te>PctTX7gu$wG25!tha4OsDih+Pie1F)80EzTnaSkqAN`9 zwX|vY6J)QO?XA)4s{k_Co}$~4_gZl7SIrjF|9n|7%D6GfRjmXBfoX}ra$7K(K#zID zb}_CLQQAXXk!7=5F?6WAaln8S?P1NrwI*x-y%LjEsrIQ!bOz7)V4&P6IihiFBI$l? zAtKI1Cu+<}rWXSq-%C^A(5;`>6|Bj;)4XtGOpZy6*fdIULV$h3RAQq5qH@8tM*VaQ z+RVA5*8rqO##jA}+!P0ws+?VDbportO!heB zAW8KiF99hl)RLh|+*`MWk9Ohoghi5inBi720M;4Tmwa%;lI7-w(^8HAcN4wSzI|ej z+dE>OiMIVPdi%@(6aqaQlo*}op*XuK)m?#pCYYt(HSm&TNuM)$&U&o(|1{60P}JUFq4Dlv~K zs&KBOF~;)>knnBM7i8HkGlG)}(1x_u7L8(@(H?4%dmInEn;C%*F6)tEtK#^l8Sgbt zqMR8mwN5G}cYP$$d2GVa!Sb|o|)H)hJz{H5Ni^l{rI4o*j#}zqq8i=Ob6tCuU zK7~_>+90mKjx2APON+lFIR+ie5X;%n{~NUVLC%jdN18$JA+)v&oMCY>PVnRsSxZwUsghP1;-0A zRJrx^+DSy+9I7H>emm$Ir3c|)5y^>+ysaB$>p8AC)2caVT?f{o{EDwLAhMD#ZPgnj z)cGQ1vk=SEx6}`Dxppt3F>?EGAL@_N8bLTLN!xWa=WB%H(Z6 zJ=#~#K698 zYCJ>%Pp_JzyzjSu`JG825CfW6hgu=tk6IAlTU9EOb3;*(!NQXQet$5ts^Z{>-ZKvD zKjq$?)mvZZn@FJUXMV0c@ZeMq0s;UkTxSFRHxOtFW+ZrkGaIbx+Y)1?DP1q&GZEj$kK+GluoW-qT);E~><-?9U4jJ}eaDO*i5pW`XG0?{oLWakV zNVISRL2C`Igx%gl;dtL`{CYi`wnzm&KeZEPdJEf1H8qXA7JI>DX78t-5dO6lT+IKc zAw?rm%J41Qp=DU!)9MxGcTn|==DW)w4WI9&&gg< zjFaI{;?5BnfG#geG2v;^B;opuOM#z&^4npZQ2qupNWDRAe*vKHqTvP$90x+=YeJy7 z+fQ0i^NwL#P~EY}I`BZF`E}OUYo^T_`>OsK&ut5@fH1A-smhNB^-mU^A(I^9!X93D zBi7n+;(?=sqv@GtuWn>R6;H03md2l~ zA;mEOA?7-yV@X@dbH15;enBp(2gpbtxWlYcyhTZtZUpTKq%6FA{6XbbpSbCezHoiL z!A5EX_i2*mMLr}Hyv)Qe@;+MV6+K<7@frJTc8v6;h_eNi?e8f;5(ZlI-}Eof6-ret z@^15Cd@!c;NEqBFOEyXL8<~=j@3I6X3z6OmJi^j&#Y?;y7F-HcP<_#!;Vt?+-+J^_ zeK6Nea*$ho)#Vz6QJBJmcB=10;qiv!L$%9ixUkh$4zUIi!K3$-p5j_wEdeLm%C zSRmz@vV76tm#{(rncxBO;fVkG35?p9f75PdwN%JXT0s6wO$n0&kw;K)*BW8?J!_(o z>0WVm^M0Yzq`!xu!@erG1w!GV1nyz88iV((YNX%NB?>-LxJ8uYmVz>GiAV!lFQDMWNH8RS^2T6;VDZb*xMCo%W_JVlLc7S(&ev z`CM=%wSooX@Yrus)&2wre0i<=#DR^)M}%ScxQRA#;qXYB&=OS5$5Rox8)NDQ{qZ3h z#L1r>C3rLZV|||hL?PPaxG$}{u$1+SgET5gLvS+#p zZfJt}v|hLbSBa-N&QjE`JokxuBI)LR*RryqN=^>DtWEy(U3pRe-hN!=OnWY|q8@9S zwJSArDuH@ltKhI7ycofwS6pPVYW8_~gT$gaYpZ$wX_9D^a|5;0-Uv2Ws~F&I-?(=R z-8hUJ%n4*Z_pj=jhHjeJEgzHy`+{@X-B)Fvj`HY-@L$?Gl0vOx44xD z?5_5Sn30?{m>1N^hEK{#bI4EaEJ?9rA6C?~=lC&vg_U`)34A{6`)J&%Hn48rSbj{u zx~eAHQqIz*qK z@;iVMlmgtqdVa7(sGrg6*dTE~8K|FGU>c^B8K8Yn2|k4AR<4w5fEn4bZs+7X=a|Hg znfJuQY_BLr6i29fEJw+Ot0F2KP3E?o;a;gA`UAionQ2KHpk=thyqTj!EH6=Hb9F9X zpzb7K8Yr@j9`xoBwZ^Tyd`^ZqX5kwx<)MGjJxjQpamJNW^F=hph!?P?ZB|{}rVo4} z_VA@yu?0eBaJfO@@>W=cs5Zd@t@@YafzZ;b6tQPUN6^FBPmjYMcM2O*nROHr7l{vh zG^-r&)Kb$Hd~T{6Is5?cm1V4KK^(z{pB-<`5%Jpq$wi#f<0=0-vi;Yaz6`sRN<(dx z_Xf^Jy3L$teYAP4e)I&G(_{=)FRbJby7m&4#C2}3h6o8QAg%9~S~V-=q?Y8OXi2<7 z2=?6*se6HPS29vk%6>4MkOI@!bjQ_JON*N#^@CKoOcM$T6R`BlwFW~2q;1{Pny)$x zeISGWDGntS;HY~WP+0Egip79pN-XaI_vxpx*7K-YFe@R6N^%Jkq|U?7txoE8NGb(o z+y5->#p}5rgJNX$7V*6~s*7;DhTq>#*+e6!QXJ~dMS?!Yo67cyBr14MqLE!nH4c;o zETk3yzlb*OCfa2L4JgDV_F4sJ&k^fB-EYF;3+^it@%z!`^QN^Ve>iKXx9bj zABOhjZbU)TACdap(;!78{ z-TWch-n+A*N!#=6Qjx5CTahVJ>cMn-ESYn$me;q~L|zI0v#JXu#dJDRN$pBrcgQ2- z6#F7NGF=tY0|$i0+W0fb$!qz7txPR(5sXJKJH7jY^5>bv*lpX&)3|(vo!adqn>X-( zRZxT?e0D>FUm|dQI`B$@3O^M`NBhOwrM_|mZ;7sQ7ogF0!&P4ytp2J!s4o_k_p~ln ze@qZ;nRA{yKD!S^Yi=^;fovy zL1U8#pwCH|E?3=xs#nX4dQ>TuEWJ^C5XJOeeV%Fj1)!(F-2*^y3&(a*z}QWvof6ml z(3#w@goqW9bR2<=uSN`&7dHq_$zRl0Hf7AF+Kl4g1@-W8Xq<(u?VbblynK100%|Qv zS%(de`Es|c7-XVTLr|?XI|zQ(rhb@H#jtw|{VJ3{q7l4cSS2)}($CtXJWXVm z$=CYnU4Gwx#(goJH7=-0?L+HuJ@Kr&AY_3MQ)u=8FzYB(RDeFvut{AD&Vr#ktH@i- zbrG+7<;#$o%+&#VfqO)wSm3NN_!<%yO#jvNgfx2zHeWI|_vKdcn3 zIR+#5Y>d5jT1+1v2jE!_RpUz<^fMfZ%MO>2`XcJ&McFjE;th&l2td0jKCI{Y^5@Gz z_Jjqo!69KYw}%5NH$P?E=$tTiJ)kp;4y(g`*W2fH8!b3cqz91@vC!%N2iMEJiIaE9*-kc{@q#ovFg-*)B7Goi zFl!gWD|WLLiz9aZt__9Xx~tni1Hy%}!inxbgF1~|_|k{U3n4#~+%U(WjVlxWTWZKD2 z5Ko_oZE{D~_#-L%*VvEH#fj&sVQz746QRS1zX+|>?9+%8dieav)JXl|`TfnGe_7R^ zv|_yKBDY1Qa^d1l*jX+wk5+%acGT%H#;>v?)xPE@Er?txRsrsL^JP4`!N+Trk0+T& zjpmIhC$iH&DgAZde@npsmk7V%D&=eV$4c;6p8pT8{V$gY{&k1{@+=4E?@M~ipxg05 zx$q$G!~D~|Z8=B$3v_K_$%&5pV&-B+DMd|{vu3A$Q*-bD4PPagcm`o`LH}O1t&u_x zrZd~PD&?n>-wLkQ=)B)%psmB1v_Cc1jCKv7Ek-+VNp32QBNC`kY)TVjOIi~`d0eRE zktUc7rl#Oy>#kk5VK!C4#4|tsP`0WMWPMz>*JykBYrDkiVm>_ftG7L886(wRGy9Dw zqBykqf``<^kEt{_LuWbD_FtVdM@qM041 zm_77``vu8MPr|d(x138aVD;f@2;C0L2X@<2pI2-3*IX>+&K~hC^$IqGxp%52JVr&z zSPRfXDhh1v!F|*dbO?yuPHz1-g~FTOD+Q@4Hzb@y|s?gZJV7Ylsu`uIiNv{1F} z@K@GD5!WZMhvD7a+_qb|kB!eyM!@-Z51wl7;AFYf*Ou)qM7+D?#fsWlN8lAvqS~1{ z^Vj1iYZg~^MYvpsII41*FHNCd1+%rnPmvsGUSUM@{17^)_la3!YPg+(wHzie<7qj_ z9WUfX8PxwG$*ESNm3fr#`L!CmRck*?g;kW$ZIq-q+T?z|hwj{J6OzCEap#V3i7||5 zNwDpGf+{5IG->@$(f-=yFVS8rkz4|>@t0`-u9&fRe!ZVE1w@G=Z2OHkiY)qD2y?Qt z!bKVpha^sN9T|0n0DmhYvD%^3{wS!FLYn%0w52Vc*LBJzuwUgRyPpPvA$0g2MkF&P zBnx1YOMvnZd&xPzh7L#Z#MR0xKESfKc@gnS_yGl`M7I@RO2Fizh6)DB_Tv26X#wPk zT-DS|bM*_uM(Xm=IRM_{sxG8rVvPK&;nKQ-BH7ZCey9pym@U&O_b(0pa$%<) z&7WEW_OE%VnTgG#f#@AtNowC)-<@->(7iG&umw)AewHh4oir7mW0?b{z!Jk#MP~rH z4N&q@z8syFMf@6LFGFv;{iQzQ5aSkWCZy!g+#2t@F_Z4T!-77Pv;k?Vvq*ycYazp~ z%Lef6f@%8qy)GCHN`W&_IBe3EVu;M@mPEErWPaYOf+%Vs7k2yM)XY5jm|7!veloNa zC%#{7zZ6H?E~!R(C5COWnNYvEqmI$}I3I|pM2wJ8 zawn^)`Dik=T9Y}GVXYk|R0JT^gAqUkNI|_ zd>!SWY~^H=Vs!O(Ah(G|NuK02^902oU7a?LWub3is~oMD=YQ+yI*7P0mItPUq;r+7 zupP6gM!a>&Y7J!0kMy2n*>!OW&&PJ$i}(cJYH?v(9lN+IbHn(`0lA>p?d7xj3D}7u z8D}F4SL1jb4@vAoBm)`F_Y&2#p6)RpQ4rMH14?KOC8P#{Q2Ij)xFPv*NES-<(uy*R}#=$5OqrUr-pgjeri*vykaN}*2$B{g7yCyTzq@!Jc@Pm7`e{j|&%CZ6@C#88vMxJ5ROeip=f}}f ztLU~EHYjo>CF`?rZdlC6+^eE70t(_x$I&zO{$j>QdX-NpodBTtU4#acrQ}r-w4u@@ zhG!5uW~SPqa*t9?lCQ{rfi45P1(vcu`LdS*7<&XCKyLxSgk&SvQNf$)r?()^d|fp?tCMk;+S&9 zk$|O=?-RTBvQ}Ev;;+CNMclO%FNx@<^-@QwX}uaAS3@K}dA`dyV$&~I2%;pVh`j~V z>eh1h6?Y>qOr=Pz7!Q~pY}90F30>gM=deE$L}2S@G1qdr0`}77$c2X>u{H5M2|4)v zLs7mpRn4l%F5Q$S+$pQ_Cz0mMwD*cJ4YAGeZL?~`FlP&pRcimnkWl16HbrMi88<>Z zV)l2_{muOR+wMLVoSl-$#JN&g|4@PcM-yK4)BvH*yMt2M5L~pjoE@~LKUqZ^;24}3 zsp=?-ty`>A5{#)Jh65LP2XAnlMieYcEN*MZTw-K!m#`~dFt^bh-4wIRFo&M(ZL2pO zJiF!Uy)v2pUL^42u=x@gj_zFio;>T^*uxhdtpc7Fo7knNXj_^EO-c?XGxnNOa~rCw zGylf^fe)#ybgio2H(aEXJnWCqrLx>nU%{qh@^jgfiO!gKvU*x@6;R(*J3wBAmhQ2B zzWmjk)b96sg%Lo*5Ns6I0;Wrn5YI=?1oL&qTG=!3u?u|_0=JW&BHn~V&(089>idnk zv78$_T8^#gv_+iWu8Uatezvo+sxl4LLJE^lr{Zq9KC}e(Nz+EIoc*TQa7s;~liM-CLn@9|yRdxM-4x$cq;`AUD-_F|J zl~Kvyp`?gw4Bm5Oh?H}bzHcrEHkFewN7A}eN|aKQ`{8ZFG`~)=o$@O9I(jn* zv8KAe%4js;{ROxdsdBxac>8fTH(07#a$fUC0~pvAt`g|nF!K0JGh_LEI@cggb`DcM z{CxCX$rgVfy0DWT{PRYoG$i<(X~uRy{T0l3lTjQmY%2Gin9=r`F1axJp)RgFOkm3K z`q0W3$f`9mc2m+9?t|A4`{Kz zv{GhvGPUu&JMElrNilzGc7ZNN9lcA%z zHnNch!ki26ThTshN*`kNFgLO`d?(hdjA7&!W%W7mw@B@7u4=?4AmFVfOOC?H#z*swSiL7kJ9{TrPc|e(Ie92Uu?D^& z{HW4?=}$rr)^at1o-cWQV5sRQdy|-p$qF29aNENBnOY$bN~*L1Wlg+qCPC`K`j@eD z?dKn->SOtL_LKh}TmJt#Yl9%TFZ@xAr)cw?vM!u;AdWNvUg$_9?M3GWJj5Or+iwdUG)q@0StyBq@RlLbV;U3ro{|8iV1b%6qLN zYJU-}2QVq7{W)_}*bA2J-r*7r_5xMRo_cH)PR%JI>QEb*=r1YdW z&K$Ff6Nvb@7p;5^D9oUVkUsCGhA(xwnIAwSA<)4i1A$`a$dou@S1_&bMB=ASLM6?73l@ zhz(0iY@SGdrU73M9_tZNt@vWePY>Q#7Gnmp*b>se{bQGBccgK3ygh{$rq=94k1tX# ze;{=jn@Li+&^ueMxT)ZgZv*n0fep(VGT#Oc_m*22FS~Xbl#EBdFP6{5tb_E z0cU_G_xBx&?;Q~-Kc8F3<^If8l+EnF{&b-%uidghb>?j@wG3i{_AKl;^uZ-)Cp@jP z6{vAcCs#P^#s59$D*hjwyIb_1I5#pHpUba7`!z_0s?5Aa2J4RlMN!I-%)vQ0JXWZ^ zsfHl^AjObu{atpb0COPeViq|vIns>|I%8#IThP0r<^boAkp4Pu4&)>z`q$JPW4_@Y zqg^vaDGj{Bi_y%-7qi%x81;Fd5SE+tQIE3;Bv5T_Cct5U z@s8d!Y)UCw3heF5WevfPo{ zCcZJ|x;c%3WOL6mq$9EiSTY;g8l}R`l%k!xqt}o@PDTCrYg556x>GLFsow zNwFATh(3NpWiwDp&V6QYn`q!4D^<7S%Fm+PORH(RX)DLB_KV?4Xwc;&{pgTp^vc8_ zKAYEBq_dQmI{dlI&p{*6NginsM?CoN|zr z%Sgr7R-$E((9?c-e%8`6E@SPN*oK~BXODq?j_HLvS)FO?G(%75Tf1P}?nFFlGa${x<cJFm>2!e1mJaP|Gp z0JC#0wbaQ}v5x#YS4{89-*hR-p2wo!JC~*&hz$Rk2f1*~-xK^==9{Rc{=rTf5_i6C z^l*1@kY=_Ok9t16{aQ(xx6w29v-dL=rLxC-yCTeT<-g!cx`YkAbRm133eww(T6c<3 z>c73-iuHP;OX*nK4LTP=7kr?t7O3_!@D$vqL~{uC%Tx6D?(>s5HGTjf;_aoyKG=Of ztoIT#OE8$ds+w1PW92Q#xZ&>den#%YZG^KMp22EIt-y=7USghvZ|FiN{akc6p^xvp z#L2M(%K+4mj@4VZBgVV8QczDL*-!S&ik5qsdRf?^UTia-es(R=g`xmqtemjb$_1S0 z2?qC28qqw|_D$7ebo(DRNup*iAy&T-sZV+ZXM)T#nh$d8flY5bKvExb^cNNSa|plQ zz+m5xrPRV&>)ROzA^t<9LmqAM5t6Y)%qY@uy|LBYvtEGrN-dZESDDi zYCgihY4f^>f=yi5&+BZ++Egsbcde1Z?rS;Ms>3M5$iiwnCe*#`tOag(*z6?&uiYS$ zV=0F}>S>qxFFhvo{Q`USG*R)oAV?WS1Rv#2~Ev~8wqvws0p8*_TB$fxgQ&#-qz0pLyeN!Vl5skSz(e35-8Qy4T zj$OsqF(@HzsV-B}ezSrDkxyy(n4)l!n|6wNRU~imyBco|ktnEsw6LPc)q~9al(*KW zG-`81UZ1f4Z-lrgl9>-AL@JR9d>)$xyS`|o0T%;SMr?YBdZi&91 ztV@qv*SHnqqJpRuP6Lr4&J-$G9yS!ta#Py!hkw}ERhZ~iZ8*)U*2YY@mY|_+pcHHE zY_=*KM@@S(!b{glH+fCK00}8y?oLa?4-+plm2>TP!K4WE?MKM$uJJZ-v44sv!I#{* z`s9lF4_BZ6dE-foN^GL+h~6VynF@(`uD>zLN?eiRfh|(ZjyGcWnZ@MY9Q{$pmt@p` l`ZeUg{&zguA8=(JC{DXJPw1<|3jd(Df{coEx#Wj${|l({BHRD~ literal 0 HcmV?d00001 diff --git a/windows/deployment/do/images/memory-storage-5.png b/windows/deployment/do/images/memory-storage-5.png new file mode 100644 index 0000000000000000000000000000000000000000..8e5b56f5c2ea6566540b683fe2a495e015c45f10 GIT binary patch literal 14534 zcmcJWcTkgGx9_nc0wVZBloq860t$%KAiekAkzQ1qbV5{`)BvGK??ox0cZi7e-g_ss zPy?X^5^m7==9nu;vxUFy381O%k=a#9)u1h;PD z+wbpO$G>`touA?VU31ltl^`hTr`^Qg+_Vu_7AGJmgAiZ5y@kIga+1?`B_O!hdi8g$ z!?D1UfIz@dUP@fc(_|+VuCda5a*~=qPjjjg^seld4>3KPnc~K?a$!m0nfyHlnI&c3?_HT+~w{L9iWp~W>a^0{y|lVPOfbuTz|X||lKtSmS(lC}m2!u)d$ z-|wFb`TKGN{O`L@RoD7o{OgTRRX6@Ww=I}cmUNKFflC|?ySF}}qqq>t;HKzY2Xm~8 zrsX;rfzfZM%xO{#O%!K<`Vl0^xNh^Hx(?F?4|n&-AWe{Q zLLSQQej@cz+uafS9aAHK5~d;N&GI=+7TXfz$?aWHE+uRfKR@s0Q%u7lpb``*HvMc_ zUN9BH2335uPC;4x@{kl8$FzR4{(MOHxPmfGeJ)&rW8>}E(Nt&cs2SK!Dh(n&7*jr5 z5|jC6P9^x(D;B56E@ytuV+ndK2O_a2!`wOw{U^h_9Bk`G{rhV*#kP|G8N&sBbgFk_ zGkf2l`8ryA;dQeOaPePhtYmi{Pua?XNm55Q;k$55zgda_O^T=;z<0 zKS~$7y*f>oPN&p<#`TWbMt6NEb935UR|-sfB16?a4`fH`m=Zh`2ibg+DRDI1={lTC z4<4n_q0!!qH{9i^h)&owbBKwFktYj^Uj9oXTe!FkXG!#QNHq(f( zK3e<|nxQ2_bp*%#OjUgY&xoz|Ti=7&9n07GH6=DM4r>LO1HW*9$hF@Y=~0soi=cIBt6(}2JWm_oq$u_=LF3!N23Vzc!cM%d=PdJHDV=KYy6&ob41Gy| z@JKDP3;q&RkF?@@Qy;B*t6ue4Z~hT{Hs>;IMMGP7U_0a z)=5B3eX_QT2Th5p0*vxX-x_jP;!5R9ocJz4FmBN(I(qub4(wyjl7{F>baVt3`1`|UN0^X8NON96Mkyvqkk|OCU@91TRC16etX?4349A=&e?VR4aZBv?%KLaeI+ls?r`FBlIiP@enb zRL22e*fn+}InAEKtuEGE28UNpg<*sMDkkN;eT-tiTL~A>Cz@6U5h}(fQLXu`-FEw7HjYbReFDm1JZwq4CC0DR1HH?!=M9huEhH z9LECnK--bvZ1r(22+xE>0ZbeI)Y@7c=Hx1J)ihjBt@WXM9@)&;_<&e~sY6;o>3*+sx~2xk+Rwqg?Q1GEon z+7VEH`f8Z;b(AB}UMc;9k9)*`l)4zsxl2J4%WNxpe|GnSpz&e($UVA%e&V+)aXhT< zfdjC{_L%!F);aXA#?{3S)isg9YDTEq=?P|=0<7mS)lSEVs_2;>dhgeCGd(pDE{;6& z;DHe9Tyk`(7vlU^ zZ1dC0(Vx(PT6m$@GMTTirFZao4ZX6LEa&{O@PN`&(!EHs+G9IV1>?s!5lW!f=nj~B zLH=DIs-`XWoVzSDQ=2TW&k!F)833T+ z*Fqn&y6=`gF!a6@(5bwPIb*wTU=(`Sntv{z`;s4Wxl(-Bpi(bYjo5W-#9{#W?og4f zuUGchELK9(YyM+j4>NW`X0S1;2Y%Nlc>C^phYeLDO#2=}zn*F(t6k{FBp0)H$p^AA zwqlqpeR?X@DoGUpjM+kl#<)mg8k#^@Po#ikgj-;Q2QP#p6sKE|Du8asm^c48g_Ahk z9;Sd%t@$ajxCPl{jm*FIWDp)|Zl2GZFD>~*?X2C_Yn0LlUoLyh(YM+v9L6`H*efn^ zpFY`AZlO{A>D$nEooUo2_NwRzrG|zPL!yL^P`wbVo&XjygWns(U&0Gx8VtyJWU2j@ z-_N7TXTCk_Yg^UtO;Fm9n&QDOD4lcFHcRQ9*E`iTa9mnTrFXXbgDP#ybw8Z-4=L8HWfrLk zA0RvU{p#1U)e7ix%Wv*&BzN8jfh}`aV&oojB6?w}38LqvTdYxe?X4{5(g?2+LGIw` zw*~aqI||2fRxr(1>_(yQ%J0+0n4@pj`1GA+p?szI1R#W?6P%Dj(2h&cv}$eB)WN!D z9b9;3qOW|d>f|M);m&)Hg!!~I)(elrnRd(arzLAj^)hm)Zx2cybhe&EKAC-ysPag* z+($e;>ghaWY+sQQI#|ZjY=Pd7S~WpThR5Zh)D2}dU1cPekRo4fzmmQE=-m#~0(qfZ z93a7BQ_-DC^D3NPMtZ%R3y%+FCPpU=zWdY;3$MRBzB#Youg1^g?QXZh zZ#YT2Zd}vZ^HS4ZRx#Db5>>v#M;{&v-J7T|Bz7EDwVQJ4iyJ>6B&*0DPARa|FXMP% z&$@&;=#{Nnitr=%U+t1|8RhxOs_KuaoIcF5a~Cl(g0n?e2yhclFQs_1(ZNoSL}7_u zqFo$5X!zbs>1w%y1I};C4+Sd>l5ekt<+aOmUqicft~i>8rDU$?*?LncBeM7Ftschn zz?vXlv(mOcXK0z`{hmD^TnKwT;2}+c#GJ+ObEYwM-I&q1)I-~xtnrzdUCZO#O=54> zys>F`K@(J+696P%2k9v2kl@zojXQ^Kfii2)`ygy7@0FE&#S~wP)_9hCJn3arefTVl zr9IzR}GU(xy>WZ<7^Dndo4xMvOcrOLEx8R49J0xLy`3lCB z@7PWPLMA#)Z~V}m+Eb1_`=qi~_8=?E&*+f6s#d7b$Yq;@kh`(oIcNN>f*3gwQ)&{# z3bQ^XgSM+!7n)o%oe&vY^;k*@D9d;fk8Z8Kn8xHwGSnnd<4-lLc8w(AEXCVJx-v-tvf2#%^8nF zvscmm_ErU(B!{2Rw@Y{@K5vUpe70FpflbIKr^mWB%5dE2P~L8!V5H#>jx%c!L>yV|6L?jmXX~<+Ojgzj+_HUQcoP*z}Uk=XdWyvvgA( zLjN5|aXa%92jJKAZpnpY4`tD@bsOwb?MH$lpVeiF@55>CuTReEjB;rdPW#UMe+^6c~ApLmS@QsK? z@214m(LvR>K#BtN-jq`}Bg2$C?e}2+2tXT(HFdhTf<9@~rX@|(9oYiBoZfDf0hcZB zQAvAA%*-*f&Uy6rymf!X&pk>DlX%iVA*nTdDH`T??hnY{(giU&Q~EgAH``jKkhEE( z>v$>b70lL=g!v8JVGdo# z10b`?yc2B=l<|Oc7<04<#Ziq0CLNy!DfQMQoRvMD(Gk0z-^$&1n@$~~XBtRA@Ka;I zSGMx@QfqlbzN2gJqvuq;Jp=@5ffzUoDai%Ls_TVTm+U9i_m+#n0ro&fJdS1XkDtjM zFE0_nsJ+V~jqT?uf0)kI6KYeeyn3>!r_@uE&a^qj< zrYG#AME$S!&*^J6kN&G&=4+#eEeU2gBi|>3;NCjV_>{$@)7tdHnr_1l6H^GrpZTd~T(cfOhZQSeCN0_iB(5B=xPAlDD({%;)%t?8 zdaLiZk~Bx3uOygR?B3uUq`7>6)K`D3kFD|xy^eBvM7S>Lakk9r*(2Kq+wT7XP(%cJ zfO$S15tUgHbn`~o_ONBKCrF!@MX;d`aIyLt5PsG)yeLZGbK9&f6TM^m@u6rq+U?i; zEx1#h(BAIQ3n2jx<7*@3UZY47$j1c0JK7{1*UHb5?hTB&>IXlwyjDi_>u=rPbw#Lc zJ!RiqB0btnv1w`eVl=f<;ol{&5Lmpry(J>VXH0YWir{CPOQie)mR=>he_a{0$uPH= zJV)O9?!w9gZOwnVaidPP7FA~6C;P!Mxx^?zI>t->gD}taM!m8JM@DP?{jxV`hd?S zvcbP*>7w&^{y8K!+6*f&A1QZ9u*1oNjG0iZXM?YK8T1h;V>TFLG952As_wB>>B}C_ zFM|?FinUrr;2xyV2Grr?Q|{_g=$n%-MmBOh{@QdeSLmS7hZmMxCz|OvP^-7fH9WmUAFWus_A-Dpe$g=-e5YpB@{{uo`XFLc2CQW%ZT@e&{Np=_|E75-rRgbKJ zOW{l}-|ogoT72##^ea!SobYP6@v8dtBHG)!G zofE=J+nfz)P!sgEyvJ9&g30EA?fp609)VwsYk1~3lITc<5bFY^W=C3XQYsE2>QVXR zybY3e?t{f01(p{y2gKJ_=51q1{EKHL-XG5B_=vFG+toKh)R&Iy25duk#Xms}>s1-i z2Yu*q|7I_~?MGPIgO+x)gl3A9dTv=Q_;EW`^ZR@~*k)@wD{f(|IkR@UZKRplO8;1? z;Gz8Xanwk|^w8L@lv-Vy@7G!nVJH=M5T1BV%Sod1k7(N|A5(1~|9`EK!;j6qF1r&na`=r?l1i zN_C9h-HI#xp7lUHUcKwL<JR~J5+)Efh$hOly^m?rF+Eae8H>A6l`&RpR{4K>Gy z0qgvWO)rV!U(m{Yy7!~oviFAlVmmc?!3Hf@HS5;LFVlRtu~|W)Gk?%Q?BD1hyk!dX zl9;aHzoLd8%-2F&N@_c160*sCsPec}wDhkXTPT_igNeNhUqU=H+L{WU&y=R#XSDPK`FMVU zJ^y3#@qH1<{mhlgSqo}{C$X4*rzJjFue~_=$VJYVmr#+$R$12)6_`YxH)j&(YoFer z+g9^Y(9$1*j}iSHfuaDa$P26T16i6M61?FgMSP1g%!hIjF0EUNP*P6sqg&!(e5N;l z`X{{@)g6;EAGae|1kR;3k7?P( z@@w2Qb%7;EALbP=QC)Z#bC3-DFRjlc+)(k9^YHodkfKMsSdoft(}la?C=EFeer}HA zx+!Rfc*tK+n6|;)-J4le#03wLBUbCcA`DSZqTlHDg+pP2wu;NAF3zwTLF#A8cZ4SP zag=$%Kb?!Jz*9)Ah`R|CFHD6C1R(+87NjMr1O#K>_egpmnoKFNbkY{ROsqD3zWWcS zM^mKL_n%1k50!aO%6&jYPJNZ~eUv*gvhtM?5H}mboK9=4bh0Kk!Nd9awwiw1KK0s? zY8<&p1qbP{{k&qPm406yk34w!d>{lzk0W~#J`BdMZj#Q3AW_`bCI@818 z=R+j@LL}wR7)pMm!HWvZp_i7oEhXM_>cAxe`Zd_LZD+*Fu0Ni_{=fj{)KL5q68kIq z%^%@@J9x+B$Hmc9zs z1tKgDyIMNljW!~?O#z}pa^R<~^t*nC*(^4O4_xnc1QyOFrY^$79J`NL_V2({GBzE) zB(OT4=&9b`3V7SMB6G9Ph-rA7=b>(<3R82?9!1G2K_>er&ZSLlT$<^*EAqR| zpsDwiq1fDzvk5L%ESwJN_|4;9>$z?Q9t>Xs`J;ZO@t;F5jXf9uN$YD7pvPNyJI=i#-1UQmA;~?(u`aon#A0%8-A- zL294xGz!{8%0iWZ*8vkkV~1I<091IJn`pt`b+Oca`O;^W`HWIr6$IK>oB5#1{@%y1 zhk4ZXnbGoww?&l5FaowWGA3A@W@*Ylbh(08&b0Y4g&uaDtuN3|5`~&fSX22GW+u#8 ztG&s`-47-_{Cr)wTGNbAXUZmbr6OF4&uVRROaeFn4shGSH2>9gm$(mXPhXv@vt*g~ zbwKAkx=*+hMCc`Uq%K6PsNOYXpVu8W<{!qT6XxX`v|Q&*vM7=Q|&N_&$N@5uUnJF&^JT*0loL z6BZUuq;mCR`)&NAmO(cHMou%h8~>J62Os5EIlmtLV;!`mX~YXsPq=-q$cSq6u+U&(orC`~t zn_t3pKg7^vj^fFtm1g4s7I~x8qlNpPm5-UL00&yj)!mJrE(!M4m>laoOJn@V=MNfq z?lmG_ZUzT;jn^oejp?b!2_7Ke6B@2E{ zWL6*-#M#8ekyS4LV3iAT9?EB6-o^|u$~&|C(5*|d)<9o`Qsas(>`~*YQ&g3``U1XFZ&=!;Vm%t62XF92+KZhshUl2)UG-V$4QnQ6DNoS9(~3# zK!LhkZ+|4_4QP!^zPyxjTzk+jNAX~7_p7~L`%YJ+AKC1KL`lPlMwQNcWMtDTe)hT$ zxJvJ3P{Ts2-RRkNPZwdb_?MwWqn((ciZMJ;;jfFvP2N`U?i3A+=_z6W&SvlEyOf-^ z6738-&tjmYoe>y~=CZ+@npu?20D5XRTvOrDjH3$T?mm2K2V$rn<@`Jh+M@pKz7r8mWjPzT|8S`mGN6yUq5j4Or9t zOo(tdx8&j%^TQkjI#0ySI)w<9kzQn+LMEP5T%9?Y(y~OSZ)dG1cd^^fx$nrEg7r)!_r3)p%V1Ha}D0bXZ4! zrC^RGD<8t*Lt1-OpLbOB5KP98Vd_Y=_r{|evh^#J7!)y5a0Au8&7g z6i>{Jww-U?U6CLfW+*zR=#(mow+7UWD4G~>|#^rab9EklEoKT&00>8q`1HPt$u&Ra+~ zc9}pMHRj!`h-q)dS6S}4$Csr-pHYWd=_#rp@u-TFklzo{l2Q2##2@WX3ev=WsR=7s z5k=Z2-qEADoSr%}F@{}fs)4_n3P&-`{cC29omKGXYJA%aZA7f{%~Xd1x}dGkhulQF z2AL9*lsfDC=wc^JXy9Vh^Fmeujwz{9ttXYnNi?i~Oy5^bf9XZ1$}jod7HKMP_3ZK3 zJz|5XImj5#w}(zEKHs@HQKN?ym~Wr)NMAgTlh(&^dHr7D86Y%>wn)VMk}nWJAgq_1EU&{By^QOTg3;%gQ-?QarU@6< z-zSo7FlqTASlZ_--g|D{v^y&sXjr)DT%H>LowELqTU2>LcCT+PwNu~=`?HD!G=0Dt+$*psyxEk*# zuMxl?yF}z?+J~!%)X*evcM<`(N!+ z_n(jdyZwCOvC2Zo66i6Jo~w~NDso#EPOt_~=Y{<==6^nV_iLs7P62foIt%uU(L6C@#!mkmR+(W%tvTcc%N|?rh8IBIehn_k8F^3`fo1AMbhNDp;-O|G2d9Owt2jX%_3yduNKcBRg?nCK(e++6lsDV5o@*`o@N z7O&z~2bZq(f7cm2A(hH{tuv#~|IdZDj|<=S(GR=f8-hz6HiS^;X4^lrQfd_Ms)X4+ zaiVquI&LXa@jgusUr!+l&lOKIata4Vo#T}+RohX_8KU_tKrG{2!;(94ns5SjjakF% z#kk8R$44tmyw`80j5ILD#a7C1*4zGK$QQ;I`DrxiBh>9izPKbvuOf9sYrD}=&Noj7H3^we_EQAThbs4J{-7CFF-w&#t&{SuuE(GpS?OC%zo!iR6 z;+DKA>pw{5dcJxMB8@nF4x+qu5OdcK7b5cI!}3(J4jaNb!FL{@JAjE?I<}PEyCo7m zJ#DyPEt8vH*dnmI7EokTlChwP&%pm(%+S($u?%UBMUzq8Ay_I9pgVf-*dX}Bf(=9O z>yC0J1m!wD#-vn=$0%Y|Ozi|nom?>TDIE$VI5Pz}JeL`JU27)4-4!fSh%64yHV#?p zyP5s`HzAF`F}p;ZA74uK>*oFUHn{4eZIW51#F(@d65W6wpe^dE|3 zIG5tu>DPBu>u8_$O6kBay<=f|J;f8vIwBpP!rT#GXv{JDtb0xUZ`{_`>fs|3AG9jw z*M03AnoIy-tlT@vy1^VW?6Q@OkKlH^*rqy>JZL~+`nA@8j+PP-?x42VBO{z7GQf6% zMj!j7oJ9FQaVz8SHJNnzdl-7G1^f5smp+4)7wmT&N4}ibm<+ly3C_o7K#T0r*z+l9 zuspRtD}V!cw9*{eDJrU()o(Mv(41rB!t7U&&nKA8qs4z|lBZ75iu9d7LO3eI=B6yg z`wvRC@4}xzyv<^uYIKFdx(_c9)B9D9ZnKEpvgQ7;NRV1xraL0P-uSWHCv&G)yAd1S zeE0)$q-<;?SD|8x+jI!bH(6CltJw2)&h!<|ev?065k7bGHkhx0R(-6V zRp-|E{@5Vhg}^DN*<2;7{;=#p(tMy;dRN6L7C%u^&m=w&-e+G=h|q@z>z=Y`*dzpt z&^T*#mW4l8kzmG;#i`2iQKU=P4W>3k7Fa^BPI*e+SW9td+hz4tn+OzqG+gZY^)>9S zV^dm5Ctc*q)C(Kl9mI0+ky4zQ?&&N_(p;Or$OvBxor>tT=gKjNqUE>jF__%T0SprPb9M{gXIAG zz>LW@(x8TgVqR+C%3(7PvzAqS4M%T-9Suc4l(=tr=D)#$6VC+yW+_UgbdD0=9{hec zpcnHY77=SSBnDlsl~Pg}t-(}C4cSFL&!nZCX{+Qs|V?_OYNmUkU(v+82% z^4Yzt`gk6kE%RvC5VuAy(1$QibmR)tr|3Tk3_+WRw zw*A{}L36j)*&8ubaCGbvcs4U(v7Q+P&Sj!h?>bjvEL?kev-M&sIO*2YY`B)Kg0jz(HTk) zyZPdjqTEZ9@^iMGN^LbifHp5n)vf89eS@4Q*|jZ&Ao>Q6DO&uso4tLY{u%x+-Rh| zZi>w6yV9m{1xGF;jIY06nLWla`VA3-p5JUn!&r);-{*aFi)HCWI@s`|@Y?P1cm8=> zy&DmxEu!COjZ9bPx#<*a>;81Z(U~k0)PXfNprW_}?7jx-89_rkEyysWhrLEJ`qo6E!zzIoaa`qWo#<0l_x3pEg!2K(+*5YMctnSPAuA|Vtteq*cte3%PTOFV z#^Dr|KPvD&wVR`~St1F{0Le)9Jhr}%Kk@D&bZM?;DUvPgt#-40p+_HIJsOyQI-l`( z_;KcL;5T79p-lzcZ-apVfdM(Bk0_k$8OY!c$B|jv7tfs2M5wS6%$#rHo z)%hc2RKKU#rbb7^U2mJ4t2}7u%a+Ptb|+ouZyq=s9`|kn;xN&ZF)o?%08HDj{^L+G z{@V>XLfXPVJbYG&7uHn0wInnaDq@aF$6O!z%sBIT>0ola=ZpZA*;*>gfBfvd=Mm~U zTvr?7r$QO6jpyF}Px$c|dC-FQQcv`%r{Ndg%2WQx-8rltZiwkB%~Eta0y!6QK_7{P z2&IdL&BeIbbzvn%`#K+=McF>$H2D5}heXSZq}&BZ@9TZ9t?=-1EWpCtn-<<(GWi}| zj?Z0SW!~crhOn6hCx+^!&h37?j~cGXlx-2EU9VXj`2Zwk>6wTAx*#zQ4mYDP`x-^^zwzgLRuV?8*E@p>3#pk_d}+ zJ5Mp1QD(|_^p~>UD}4`otZ!+H-+lLC7@siJ%6)VG2f32K{@`Ooc%?uDEt7$vXv z3>qlr=UX`m>$_U_(4o!ak}}0*+Zi)QnVG^xhQg&SzSlwZPMIsGrMY~d2f%UYOR4i@g))IWn!N4`kD!*2!a zSC8^Y{;tzaOJk+9Z3{P1iNemVPo$3}mb|(8a;M zuV})?_j&cmh+o20Rzv1*`Od8Wd6^5clboFvXLR2WzhmvFsJ!xd_AU@?(Y(85`Qjz* zIjYm^!pc>O6)rk>HXlm8%T*)TKx%$$N5IOS2p$lJ>IT-BxWtJ0=y=T^o10G5zltt> zBG!4ksyLlMkM7D*Bd%4yA9y^xWy;NKSd1k${4EpN z#&X$!!fPE9GcsoIVyOy{%eGj4et+J*Bc-q?Sh-*6CK@@Atd)-NzQ;VnC817_*!?|c zvD3A!-ogxtnMP=JsC8iHeox8qn>=2uJyjj|DOH7UN0*wr-%ON4mBl3Rj&KDS)1yRt%SM&Fb(@M@hIIu%I)i+d`q7OjVsV%H zJHs|6a#<2}Q|u$G6eJ#-!D8hT9B;(91QE@J@Y=cI@1Uum}7&Ln-O*gjgW6 z9+J8Hut4 zVjmUVz(>FG@d5y~&;G*ce#6X5nC2gypl9=+^(mk6)cyDRpN||^ob~VP`c>sFyO=Iq zS02%Dyl=d`N7O~56nN?9H|Ei@?2LwaOzcetTsQsPa3?Ts0&d}%s`xk<>%`e7*_@eATXL>y9bp#3I zfk%N@q))cBj@u&LPe*?01zjH~aq+P1l@3Vm_WEd>VmLW4UGCAsU&aCpSp)b2g};S& zV1&f6GT!+fW%)4VayQ^=Cd}sa`d@DT4N*6K=Qhr{_G{{n42#pZh`aqa$tq;O7@yU$ z_B>bB^>?1_BN{Qo{aJ8_wk_PJhsDo*)Jf02WdD5$|(QWz6nJLwEEzeV6zo);!-p=y^t5U?YKkf%=BXZA#3RPRC`Np zL%Qf@Le5K1RN1nsBSXCE0JPw6szQM4Swj4V*yso(MO|>L$4aa04>&9GJ{`ro*uqH4 zjv5-M<{1Zzd&dDsl{r=ZS6{i9JUB$#S3q>vA>c;ir=%8KOIWx`nYbv%GX2;210GVpCgewAsPX*CfAj_ z* zI=ksT`dihs{9A}I7A$x^S=Xsy!TPlzM(k?(equ_q21t6covYU^?A%Hca{qwxuR{#x zbX^>N`a2bpI(T&5=l+?0m>cT*y|HMWh2>Y(&A3LQ@Q*vu%k4J|ie9svuh9Yoa;yMNOn9G~4``B9iZ!6WPV|P|jrBT_@wY*=;KAs4sk^S()wxia!Zc z5a@Q>>NEVnh?Ss9MGrQe;Uf)auT1hiJn}DWot8KIasj}2(<_dKoBZMEUt~seX|}3K zW{^}Ya&;&uAQ4L>UGeXk#^>eHJiB|QK;1_tr*Nhid}98(!)>?phpF}A}1%qkNEu|*iX z%tVIEWcKRhr!{~b?ol$cstjZ;q}`#J@yEP+A>X@WqO;rk(i$N?*hh_jc4Mtfl1%!X zC@#O!bQP0;Y|b|dp5I2?RYnsdGS>l|)yQ-(g5xh*zgs0cM|@P@=FVKvUg>P@ayw3J zyhy)+#aBV%SBEecy*a{)w!7jZFXS#!qLTcu5HK+)h&the}6^4^gX- zYlMXjbcfUU=K}H93o!wfKQ0&FHrsh)`QO!@|5@qze`zO?OJ4%QSvCpLpW?As-zG1u LB2^+`_T~QoIg~*X literal 0 HcmV?d00001 diff --git a/windows/deployment/do/images/portal-installation-instructions-6.png b/windows/deployment/do/images/portal-installation-instructions-6.png new file mode 100644 index 0000000000000000000000000000000000000000..201a1aa1d640eb5384d6b7b561b7fed1ad9b2fe9 GIT binary patch literal 29343 zcmd4(V{|27^frpd9oy;{JGRrYZQHhO+qP}nw$V|iV|CJTpPk?PKj+)I@BMPeeLw86 zR#lBvyJ}&s`8@NP6{#R6jsS}b3jzXyASofD1OfuK1OfsY3JnH4qi-F|04zYAmBfWW z>gMpzfCmufg0g}jAdT^G?}m`TV;BbsO=l1g#Nn?W=(v4_2?&T2tE7maiih4+FOq|f zxZnOu%E;5z7M}MJC)Uj>>a^zo%)sc}XyddbtpfTWsA4FSy`(C+y66&RQY-F&ro#Y9 zfC^RUs4>+mW{5C+;?j&od=Y@m`Kgpll?fa!2b3zR;K~)%8?78{2F7C;@~Nq>rg!gM zQ(LRPrQ`Flf8Bo1`{5flFJiz=d09YSp5Jc&=R=qO$Aw>gzLvgzJMf`FK-%(tQ2qn| zs@X6p@O+iXDF3@sR*@&_NH=#^w^;P$aq{puj?s{N-2BA-t91*s{L+>pzUk}W;!e|h zm*G@q@d69*e8Ac%OcjCLW@4S}A!qcG=*DEbbhLD7q~8m{S2H@H=GC~9%Lm|H#hXqx z7wxn>9b=Jq+KBnZou^0d>H=LNJsHZ7+}+|a=}`PyCW2!zN7XTr`d6AGNRyEB7qvS{ zb1QM~=khTQMoFTXi!uUDZPMhVGbG`oqjd@n@-a18z6R0_QQPE-DkgUpPW_WMcHbrd zYf2CyN2bk-u}lm4=sYeYPsBn(E(*6W10nuhA@@hx&DY6$3c&CQ;dYu%V9|N23oedk@K(}}b; ziia*YzLjmn8x}Yx@zeNeErtrdd`*$0MON3VDk=yHY&-zvVdd+q%l%acX-lFsxcaIL zTtirW`>K$D{U2TynXbkidaPS0b_r|D@$av0*7DDr;~(hG;a}Cco+Xz)lGjWkP7F~P z#6DQqY5HwCvJ$(m@Wz=;AGCr{P6m$b*Bu52@eg%B_6@ub-ONVF+SOVO4f7!1rR=kvrWtiCKgmRq)UFOl|I zk@Pv#GMe1v&cy=($(m|9(unL>bLECge!SoVvC-C&yV|(rt$gQHI3?P)90kB@Li**11*!t3%N&18Z2RE5CXZ&wmdue)THk*OoWTh zOdUI@B&W$Y>Yw_4!S-I&qfWOCi&yj3s&%I}(?~^(Ge#xP!LYX($q{)6uO9zw8r-qB5 zUTp=RLm+gcFYPFuOClpm3Jbfs2vizXY)lqM2NXc!GOTVw-2f}ZQc(b+1fcg(EWco2 z!YsH?GsF(P*<%(vcs@F7u%*$5*U5EsKE-U(zI3i33x8NMdTpS^ET;J>8)~JmV^>mj zgx;y#@3CDH$+6hbg^8W0zQ%*%VMtJ$WdE3OZ}Wil22o?!&I(x;+t!wX+e6+J;9(`im2 zuQ~BDe}g@$1(eVzz8v07(kwvi4ec0VLGUX__=Q7 zN##d+1JGr8gA(%K0K{eT{8A(TN$qA2&SDkLfgucX_Fc_L?7d4iYejWk?5O0Drd`@2 z+Ezd%8KhCY=`Qj`Q(6B_=;gpdJ3 z8`1WMBqsks!F+@3Y&$EDH^V*`GZo)auzAf8{#ojsWGn2JKb2wXw34Sv+$ZNpmkw`%>qL;I#rYd2o$NM;^5$hMK?*Vz~N`=3dKWG*_|1xGvYTK#Y5ff4rH09{f z=XaDbpJWYoE2EKUq3$_(jE1yuAeCYqU|ht%l>+8Yy61FMF~pe|FrutpmvW`5q|UH& z6hyIZF4Ag;lDl$q6sA+yqPNfjR)4ZuPvyL7$rUgXS3G@pSI0ybq#Gv%sm}cq;1C&v zyOiqmDAVo$r7mazHM}@mW9+cty&YDFC&|mTL~hk-Hpybq+SlSS%Zxyox3d_l(4FWF zW06xxK31_s!56aXdMcr}N@%*jFDHa28C;a55@kzCsjAJlL0J`mFNGb|7B6I1;sO5J zwdF2uA$ER771V?#^})7*YvbN3Y)_4_fhaajUs@TmB0Uj8p51MIsfwq*IqTnE?~uV; z$~CQ-D5i49m7OjujqT>GZr**l!P~Jmx)Sq;#4JoX&byx3FgGdnM|BeEU<*H4qE zX68@amXg)DP4MXsN>aC(y6WxJ=jpV+BA07s%;~4FX&p$`SPZW6McHQV^&P#HLblr- z^+s( zeRPF&I1}h?8xrwC(llz>H6^dQ%2JC#&aKH}928~2M%QR?TOh`WYZYg*qDFBF!Pu)k ztoH~I+LV5LUP3GZ=Q!B5?p1}DjeU$|rBiyxbAw^tqg}WTd(}lJE)!#JTRCbS*r3?L^@=WOX92-=tjhHg+; z*H&);QH#xyFKem619{ChCV7M zPiuAADJT@Ch_g;=vCS7;-eI~hjwfFkY{tw5&YX!>cmB83V znRPfxpPebQUB@i{i^>5}yS*4^5p|Gfs>Q>3H;F?J4}*#472SfInj=4JB&+b@wI&s9 ziB{_-O>>>WmVyeK9IwUH{3Hd=J1YDmk%{-@b`}50(30*&^$rSic^^_{YPxe@JD5;gYCCm0eCeLYcSrp z^K^(}^)Zjls>SAb#r3Bohx=u*Om<#bQMR>jn0%Ggs(J=F<_3lAdDX=ninrYJvLBm% zaczGh@^s5OeD^)Ko1|HeD^&7X8LM6Sq{%nsmLgdu15=jR&>jKbRN+ zP22PZ0EkEm-2Ok8TC!IK%^kSj-z#_prTTu?x)O6`)0;>*+Dd9AA@o%c0$Xok2qj4=T5s3`SMGwNOY2^m-W-0Y6%aQL%)6=c48@Io0V9Fw#Vo6D zwFD8$4l@`KS;Efqc1*kFp8p*7v{>gZ9T`~Db)S!Uru|X##2N}DJ2`wDcXS#u2-uc! z^G*AsDqOG${nThb8sg;!V#Tq+En0)ZJ@+_6mEgvV*_SXHR*>ZBG%?H-LMMoJoKU1j zCVk-n(J94{$$7lfT-TFE$V1Tqys1+wn+Abm>#NlL3Lf?i#r1U-e>Zq`EPo={Qw$cT z8bK?j;-BWJebV;0Ws`K?-9D>!k(J+aKpvrFomo}LxKLD2{2Z%f)}T^3UI99bL3ok( z&U&*6(PS>tliJUA=c$l&JzsE5mPU&Q_4SV)x2{(s5EH!^y*7DUQ>KTgmcExuq&08iw8I+< z2QRH!;^SQv^0=yp)=@bCA8kOq`sS+P%I>rOGNtBS({RQ-|DcDEfo*O|$-KL9b~tX+ zYlO{UaD*iEIcN4;HRPf)wZC#hviu(AERKCFRR_81XDD(1W33#lg2P=10(=pp}r!aTQ})?EflOTi%)%IIXoI<^;(mp`&1t# zxPE+T>TZO6-(WH=uqOeY|ABr%>Bb!2&)X@3hF>cr=;PhYPrGUUiag6 z_f@qtc(|6vDX$&>Dsx3u7ga1Gt|aqmFaq&v!gdH^|vZj5RIc>|-NW0CER} zbV=2cp}-e1SYNWT3Qx|qo(E$5&C}}$=O-YK@QEx$LI*Z|o9h&?qnGg6;@NrhKiFO` zE14D8OaZI5%xzD8pCE%;GJeXVV_Yli3HJrqb{14DTm@?TCrT0KkN0#^6{PWe2ns70;MpM-LIGx^A&tBybtN4}5OoR-)rdgz z^@0xfQ>-kR@rsYEBnBYBXzWVCidA<^R`}yAfffRV2wp#K(&=B8+1I~yCt|Acn6aEG zk?j4f3bb`+;9~7)CT4WxD@!vdySe~pC37En<9-n3V&9+ER`ZjC&omV;SIwHzQXj37 zU7u;NZ->C^49{g@F*2p}FUwJy5^XGs1A(Uss-ZOG14=9l0EwGpCNE zA(ezcVP=QZiB)1dqe4|eX$Ut%VpovqC7#Ura_M>6)Bimmn%b&GK4N9K_4O~cCzr@Kn!+D2w61*2Rmp8XfB9i z)Kqw)igR~6pWegFX5yMROq&(^E>pT}jSXV2VjK525~lH`Lya=ggEV}o_RJHP6mq61 z5dj#b02$3j8z}*lW*#g8rm}ANHTcucaQ&Frqne3TWFW%9+O&*#HlemfSUxdCDuFN| zjxd7;c7p-d7vZza)$}xTxIHDbfIPi<8Iuu;w-q2(0cS&~4?s7MhI~`ViTSQ(Sf}B3 zu8P?5YBW%93jTDED%dF0$eNq*Lp4IMTa`UxcW;%81j~BFTv&9370J!EuRh_{ns87P zx=3;e*xwtrEg4$}=Lm!opC}EHOK|%{meVINS~8RQtLy0F^H$za`)*k@8}HVaM9VzP zkkt%&<))!6X_ZW^yG=Pb($Utrsikvn)ExV4Lyg95sq>Yfd2ZFv>PIe&kdw0R!knFo z)G*ZYenHL1BDzBhdCOXFN?-PuUdthIv|+DVKK8FNPN1dkn6IO#&2PG`8)|=owz|$A zqev8KQcRtJEyHcn(K5~z-c5x0Kk-yVi&}J5Wd6K`E3K&rk#U$?DudQqZ*2WjxCI(S zKSN$Q)R?pXHU?Lu;pCTJyZP%4N(f1{Tc|ZfwY-6JC|V4;5PGs$8k+N&>mXv+4irq85pN zTillRoLR2O5CA=2fUi^5mP1jzj*mdf$EcEZk)dBivH}dt(tjPD*OV}ymQHT$B%M;w z=6CIA`#0lz?W38vvK*AIS&p>mU#j}+nKk z_p*7Z^U6&fq=AO|2fcP%uVbw#Tm*uytn1pfE&J&IVo&>dppxZPSF$A9%!dqwAO0_+?R9ulF~C}y$3&sg5{AWO7G|74^2|xL_-sYDm$woz5Xqx z>R2U;a=|exFjfdLZQ^^tp@$yD9w#x!sIdXCyPyOiI|t z)I0bv_6uxJTI3bG3Mu2mpLa6m-&0ctvP_P?i&;2k2cm*Fw)5JB;!Rw8c6@D)zxG?s zS*Ur)&zNaM^?p}kNln)novbnc*16SZ=}~QF{*Q5GeK2Zh^dkj9RTVo)%T6S{uc6ZZ zRNb8hl^xPIr7(NM5k+z1=`LmEr|j*ywRZK#^AKn3m`UwThJjm1aXX9;f0>X78d66_ z-mqcm*;6G0xc5MGcnp<`ZT|%2?UlM{-m~h-=h}L4Q9oT4*Vj$tS2YOyk?%Osn)LAw zBw8KjA0LOfd|#vva;H3U)Z?-5mP405<~r+ueC)Nf9geeM%w%y-Z$o~Z$$q-NNQ)9w zl+>rlCo|ysNz@eTCsx+|?`H%qzU#-KYM0tX(=eJ0Y7DreSe+2;tz&+99=beSfxiG2t+?>Cm(e<3X@V#Im9J6@x)l$ds5uBMu~0L&gEaw-61ll*`~l?Nu{x>u+INLo)t6FL&x0YRQ@fdXA4t9Te)eM_(uh_QbGLgQ~LWkR-D<8X8W(GOrxp_~BSXR#O@D*Lxp-VF|R- zYtfdg`y;2r8Hsd@{F?V~h>A;tsxlqz?7}W~>$ErMKE@wnROf^-50JSDW|&%Sg0e-p z*G-(6IlE?1b?i zmo0%ll6#NLq-QoC!?9`Jq0ea;7H+}z+n*V-_}=yBz{yGb)L4etW^C?lU&+;!2JX5@ zW;W7ZA?R5};b(xmHDFFNF-;Zd%G9rf41teOmS0^c$DKP?^hqhhU?j1r)Uk)IdV@b} z3C*MtEJHOI3t^`*$deNPYvAW=pzfl{V+E+|Q`XXkZ0u>c#y0C&seKo>r&jd_2xn8F z#l+*(jK`0LANuOFnjT3V5+RrntKtj&J3d^JnZl{F!rtG|wWQq7JEOVv7OY~+wlu4f zR1vQyT`&@1W8ZVMC3tK_6BXvu@c4WEs(LOcBxc{4X9{z z3hMIaCuFU)PFqQ7fR#CQ;5c1Z>JoNdq1v0;&59z$m|gAyxW9#eqcUfn6Bz2sLm~LF zx<1f?7vpQO)QW>4h`NHxzVp2@3~MFX%S%4^XW0hI%~7)nA0Qk}1zHv-(@IUB@j$la zAF^hWSu|vJECTy?K$NL?nwtcMdf*J@s!DR~eku^--j-w~|7y%MD|;()$e2sCPCxPC znDHX6w4rM{@-1Rrlfyk9tb&Lex2ymp!EVc2aVr}|$4~1bu)Yrv8*eWdS&cin>CA(e zi7QVDSzmWACcsG7HAozO3&oh8jFnOi#`Pkaq8}>4`H_tUMdRkF8-K|T^{4J!4UMvp7f|AFufU_YIa?>d8Op1Z+I1CG)1tpibOKe ze{bNSt9BBiqAA5aoSEHgorgvq2FzmZh@0c}?V+I?a(wkH8&yc-G91S!uj4rD26d)} zqjoXg90rSG#wdTgvhA4f;PR4+A&O~8KeRyf3KrURDL?UfUOi@XDNiWKC&3MB5UYFZ z3JNHb{g%_ISt7OO4P9Wf(XAdXX=geR6{R*GS6qCRNLJe1YFCur;OE@AY4FGUdB}f*IG~_ zJQ}EiJ>ZE{G{}Ty^mde}Zg5A)&;8!pV==Ko%LB@7(&u!Axtv)K;Q2PO=mWPJhv%iH;y(Ki4o7u6$lR=J4eu5BVVCu-xk9zD2NTF z7933|LvS0}mq=$e_{X}y4S)C)^uXHBJ{p;tP|=6Ar(cbDSeif(0dgx6@c%V-Fm|Rj z&qv~w_VMDzO3*nrO3rtx3GlhL+po*om4~m zL-hNXQAwL3>5-tlKT_zu#-ncs?`XkaW3g|mt{+@mpsf7|qG9|)v(F07t~Wabat^y} z86Rfs0hIp##2{AUYKiz4bBvF5{wQX?^Nnlo%qw2ZZ@gkxSzpECOKju+ZfK``q4i3P zt6irIu#YgZn3}v&-iIcI+nYppbV31T+nHp*!6jaP8xyhUIBGm&qDKWVJEL<(w(|@0N1B= zSo%_;O(tR#ExIt&^gs`GQb(y4!gA6X6CLyBgsseMXMB~Q{JUMJD%rW2!aoza9crgs zuK?Lpxo>Q9f^0?)6SRD)m0p=&0Vi}M+~D0N<|T|5Ra0r^3j;f@?xL{NNLs!j8sca! zp#SV7|8Pjm(gX6cTBpJc!WOv_(<)MKQpp(`rsau;t9ZA}c49c87n9^-TIW;@GgCHQ zP~RjIbc{kyy_09{d3NFfgV#tMQ!!HC2Zo{$vb0~(hp>xoXX&A3c0w+8M}lRLw>q-j=_-8Z9+0&5Bzx<-)t>bG zJOdKf4(^6E4`+2iMa?gtAI>SAJfo?xVVaY9N1#-rq|A&+1z^sVB|k(tpAi2(hA|QO zqlA&H9Pr^dQs*c$DS-Ifq;#RKrY4NnfLmAYlz7^7F=~PwFrS#)5hKk<%n*s|Sigpx zj#9B+W1cmDEG;8Xic-=Qr{b8nmN=hE)sY`Koj%5qdCFgubXB`i=WLB$V#;CjG$ z;1Z^bV8M;n`&C6qsf54i3Jki~hyjYYRiJk8W=Bao<9I~~?b&0UewNlwjYMls+?Y3^ zQ?$r0Xj1h^<^8e#;0O&=Y@-QvPdNrn<5f8IK@-9s;~PDp3>mD@={u(2}|X@SWeP zsC#@|E>o~j@cyP>TOsUu2TO2C0#qMw%*RZk#Lgd00^huu>4D-1|0LNi-Gk2U3Ja6~ z`kFl=PgMY@#teWxHcE}dX^aQ*Y(uamqcu3LS-xa7$;-wfp)<<)rH(~Cb#z;fVzyJo z-72Ww?TfRktz!{>mjXKDy~h^ht!CIfT$OX~{2S}4T8mybhgs<4dH9K+HkjK$Nrbw< z)v*YHIR}zVb?{@jQf_pdymXv=75v}tQW}GBR6a|RQ}x_CIr9^#9<*_TEW18As4ivwR`n%epZ}@qI>0(fO3UH0)Kan8WE@*! zaxUXB?cT;uis`(bL9rUdk-Uj&I;{}rF+eQSgCp%PrJfzfYdUK5l%r8Q#qP&AXl1Nm zLfj$=ks=AXN=DYDEV=44WDhDEyS)$_r5bMgW{Oyi1q}X}4dA8fR2$KmM7AGS-G}^a z^FgCbpYCo~8aGH9g20#n;*3ts2&77{o!_#BZ}}cSqMN74yFAXW)w)BYMl2b;N9dSRiKmlSw>SKDn@k-xUZVzE#Z!qTYdZrs}j=D z{4dSSLV2MBhE1s3m;?%qzyFMeBi{8TP2yKTJm0m#hSmoewOtlwkm{S@WcH4u$`BrB z^QBV@x?@Q*)?sk4k@{R7Z?pJ9)P9#>zm>b}#G{_enKc#lS*)$Gw zzAmzNBGbsJPB9yniYlF}s(&j`#A8?H49_W<$u`V6IOcjiEEYHAs5^6eO#a6(Rtg>? zwN*@aHBC`e=zFVupqTyeloxz`dRM}ms193Wn{4AjaI5AE5rpr|rfctl5v={#0L|#e`ehicF zea^C^xzkEj;!z6#%{FMJd8qYK1{7f#7@WB6Gm)2CJmu(Ja~IxWE$=w1_3MQoJ8`Xnn^hx7b zE#ovNxu4ur!e5n5yR)0m+uRmlq5Z?d6HGR`e#!Ayq^3(WQ%sDsTf`vW!KnK^!E7bk zwc~;EGJP8&liaR*X}sQx?V2X%d)l~CoAmK3fy%p#*ABiGq2wRL3JYPhqJa;$^Ju5a zU~W_?{4U|4Ppw{HiK5=x>z&r(He%Br`E+J#Ajrf)&i)wcKc%r)$S#Lz`4y@xf^1&s{h789v@$5>6F3PEpMIUPZn z9A$|BucidoYFTxw9jsgJ>tjvoFHvAWiyZ0iEqbG$_d6v2k;f&F8zm(S3b?;Zu_efr z3|_#5Z5?3!wX)Q}H{`*Mz>rJ&loR0$3`JJE=~bWBI0YvNwNd>FRC#TNP zSC+0J|G(AENr#-hjJE1MUFDlLs*9;C;%IXVXugs7AO$cjS*_p!YDD~kXz6rW?AKqB zK*RCf`F-9rAl@7`Qvw-yf&xZ21!#o3y_U(h<~ts0W7G!^D@~Js=`r>nkY# z|6Xn&ScyCC_^=f79$2B`+w zSj1N~d4{xz(qMkq-*TkG`vh{CSSAE^=IYb2&cwNW&(mspW>Q4oF&-{J!~IZXqG~(n zX_YX4uUL+caS2XC1)!lWXd(5BP+CD7OyGA=9HPzBA=eLt^?R!&|F8^0S;{sBJ#lQQ zSY~Uoq_|=N>l{^blu6OqsDelOikCL-DSffEo^?b!H|QP4HraFZiT*rs|Q;(r%N(n}~>mJ~b>A{}*kLOec;}+U= zZbILWsXF+r`Z<>Ic+K#uxA=karcxbDw8PI1{=d|YvR8q>vGMUWXlD`;ih&_UvXjlt z_kwe8n>oE1Sbz?4B#nb z0HQ?&*_vE(&13n&&rsF%zj{wfYko^`-aQ2~y{xu*Ff05hLXq9f-R;3#>Cb7cNjM=S z-k=>4>yMCurALGuSH!1PgRE~SB(@0ZR)m6wOu3}i^ARzp^U!=XD3B4On_Nlm(RD4) zZOkevloHr=r>f|1mU#G8i6d;J#D6PEfPdH>hpEhCCZ1X~7{+u!bkEf)>gdMGMymGh z(jz~W@UNY2OU?7($kHQIuQ`kQd^PF+Qf=T~PG{PzlA~#@OysXt2|B*p@H;BdaoZ#u zc0|cCdDu*7n=bPW=ut@=|bX5lJp(whO`#zRLfJBjfIXksc5`v4;6p^CDZE|MJ; zVljtG3lz%vl)ypAl>-jKm%c*wOJCuomGirK?AS?w%T@iFHUgnH6{xaY@~Tgx{Ew~q zU5R#&?{==`P{}z345GO+Rk|f zPsv}m23)47>Awj;9Y(EvrwA1!|fP~2ncNVY)eUC#o#UNYG35;j+PvCh_R zGJhz`v7P#qvub#-kZcwHjr{GT-Qh5J>F2?* z(~F3b%w@?-y8jN2mE#I4^tYMvSrEdDmX>EWt7Ml^#`>a+QX9dpeu?PIYTg)Y%VRL} zj{Xk0@I`(IB=%_v%;WjyVIL7j0*PbYw`nJXO?e&t7PGL-a#W3Qrs%m@^@hM)7&i~A z$*FRUjI5$8F4Tn@3r>5wG9>S`4GZ1iab&7U$}oeS9uMig2oVbN5OjY2L|(H(ZUD)M zmK~X{B2OSz7YyW>*l(qzq-Ne6 z8n~P#mu7t+1b2ONK1?<9i%OlfE6DMEUd_Wp>N^=Bax3sUA9F?erdWfAyh(Jg(yJ8| zuxIjHbV~A$kU)8jJ)P$DcO}z;QB8X;SmRvrrkncue&@Q22OM#)utD(tD&aa{o`=hN zC)mHp@dfIB^f^A?KdTtmCKY5dJI5YmfPjZ{6hC6mxL#p?v55kYp7i?ud@d`IQfCo6 zy7Djxw-a+_8V>0S5`Au6DLK>FZ)lPVT{7^Fu?#T)%;tz55=F*LeU5B1UY(wR%jlBX z=V4LTWR}HA6tdK`k=WUos2wR4EK;77G|cS^NP9QElf0W87N;u)(4pAQyr`d_pj^H` zSj;B$kA#Y|OlDt6O$=Qwyvm90i+s`T#A2Knr>BTm-7(yghmv#TBAiOVyCbt=M@T^! zK>HctkJO9?n|SAjxG+|zNRGw~nan3d`vFWIpty8X5rs`1J)peg`o!f^^*E8);;@(Y z(q>G!*QrB1e)8aXSh+1zw5kbxa6vRH%D;MCGs!7N*=e@W%7<=`lb)qkd#V(W5#^U? zxlY)l)>Aj>h7AmF0in+n|Gj#J<7 zjw1|BujI%}{T=D|PcRdKN}x1YQ6~RV12kTkEPy63j`_^y)>H32sVJzC(G7@gAOUL7 zZ&sq!OjL_#Zx2`551x-*Voe*eimLEe4GgsE$dg-o^mvmLT3$K>no@3ibX1L$C(~g? z*(I}POX${r@Q+N_`YY9HkAG#FbZn{A)B(pM?I^9U#MnV-QeTs&56)Al2yix3ZQd2y zjJg?6tKqN1+6)_$UF~LFlhsY6aiyWG$%SNQx`$=H9){t^7KA4Tv`n4%BgwpT&n0$~ zUxKF@qhB;wU1-3JMyYhnU^_|8=DZ;C7aG%Qt$RTyB@Pl&$5@;|ceL?68tJgYtpI|X z^t?7(cKF}`y`X(aF2nJ|RPP1K?D&u^c=5!DvE_x_QD}f_nA6CSAlyD^E2ad7Ayk-( zG{|=Rni3B%|CD}G$r z=Zx0S7yOTbhn&V=4F`VG?z>+<4EJS0kVA%+$&;E2m{ku`L63J3r10Q7kbJ6LQW1)h zx?ouOP{p*DJx6bK%pe;wqv1Dy06ppox;M(^LD3LRzCL`w>JZyid6b>ap3BvPE;y;R zdPapU0Ya>-(P^@cdl`;&wp#YUHJezx34$|uBLjot)&?N5|I$DL z)2#+@5ythc16c*J7ou8HwgjcRy#1TR#ID8EZi2kVy1WrKEiq50O!f?b89%}eZr>T1 z*}{$@1VddrcHdtRKPp=vbDzv!VU|j9m!V`Tj33dq@tUE2D?o(^QbQ3xw1h#4)i8+s8R*27D^q+Zp6p2Qyl zHFx9!-)~rOUDJC&X&|Z$E(OJHY-U)6SB+hWH%4_kT0DeW25 zuTJD*ATIO%)>0~Y&k{GNgb!b--E4Mb?k1M==D?H>_Y;zmTTktzYVQ)%Rl>R6dvs@7x#b2XZ~48I zJ-LFMNwqUhjhvU}Rj)KJsXkPzoKTxN>^JZm3Y1Qj$()^v8n`7zvK7W4b6MhE5ne7M zjIj*AN_8Q;vO*r3jKdCqqUrBPR1NFE6>|7YO6x0W$XZcp{>diCiN18Fj@qP4ay6}9 zZW4AEHd9F+sXK#+DA`&cMR&{^eH}pMNj8+^A5CMWu%zQd9?>}YuAeGAcveT?%Egm6(R}bB% zKo{*k19O>+pfO$8&gsC_JzhIVbRl6=pXRf%q#eyEG|!%dx}nMcLr zKwp_0IjLBR_a2_dhWA&uqzUFP+ErY>T!A73RWz+0LgA4C{yqwI`N=n;RQeyraUX&1 z$uAMK*4_Zpn)M{nk(8eapOiJ}Klw85Tw<{5(3SM609vs-nt?zXC5S``hrxu*a z!%%?QapmKq>luW6&gSB^PWO3wd&HrK`dFW~wePopSQJsbJ+6q>HUZzd9Ih;fFkBy| zTpeOMiLyPxi{f92WT+Cco-M|4;q3rq+9|E!z-AD{sCp8n(Q)&FgeBlL}WdMRnu z#sB=<=T!XXPxDT+FN8oRWnD>dw*T+tM*BOQX;ERn|J*B_x!)@dGv?Rj7P8vbiTk_p z@BaUaALD;CZS3Fp%lNmx)%%{``27m^+q+@d*?;@(&HVMb2apy3U74HD&D(bt(?il% z?Ss$c8^4R<_`Zw3>vlMzoTH0#rz~;rP01MqKmoQ?dr{yFJ<#*N*WKs*^5;o6o8B>D z$XG)GD5d>k5B?}wIx^GywnflQQiE)V0bwowD?f*U$EV*@@{fOT{*USZe#=kW z^O*m;;`j$yTlGBD(9aAj_V1YFf+tPt4755rjO5qec^m|<=Vfo33uprq_x55K$cB}c z^wsmHxJi4(^V{T)f9ad@`)|+lpU?7rpWFZLe!26%xBY;B)Bb+4gJSrPF(!xguGR?M zafRG#Gl;f*XuNg&e$$!WIpt0H*d$8b4zc^(f}WI)$>dp84aXKjExjQ=N?m43Rl;~z zWLm*=iZDgS>>iXt(UfPtn*ol;0|e&a0Hs?{>;a>XQZ=Vkzm@JhlnhS+GRX;eGr z)i7$&t(~V=R#X5S>F8R~Yj7onp-N-gAoRTPQM*H^fvV{(n^~^%fx@cQSf%p!{M5}q zMGvS7)R$WF*^26K(yKS%0uVqB&^T8HYp?&`!H-$~&w2fq3;&ae$bV;QbXxV+7d@ z8tR$mpE0TYJ6vVEN8EFxEzS}2J!u6@PIBF%<3G`J`+6eWi1MAfvwWmNdU%Xm;t&4lw^qPJSn6U>g zD^X^Xnr5=bQ(j|<@-JK1$q0wc+@Q3fP7Usd(Tvp9@wUmPR6{;*HLpxkRG0D}`6lcx z+NKI;rXXfJfeZ0nehl7SbN-Itv9*_r>Vxvvgt>ub9WP^1M)DeeUd z6qmM8BtQjPyjXFE;!xZPP$KX3P5%_Vvt*#C(a`f1C^S-WV${eI9)oOZqiR75dyS z1naG>YMt|*dvCvce*%TMzQuRHss0>=#Y)+)CR$4q&IR3l#v+Ms@&5q22O_N~seo2l zmhVi8JQU#-RhCDa_z%0@9;G}O{7mCI@SQ!YAj$kouhJ@bDX1x=IY=|H&1w+qvleCv z&KY>MSf(MreQ0>2&(x;S?TUO$fSI7dvkax>4}hvq)hLVLS2dDFi=S$I;7wv z9k_(*P-gS0?Rb1z*QM>i!Lj*AZms_5_&=4Vw9?!EbgZoj5%p8- zU)`f4{W_XleGTxbNS6IigM^&I`ENf2RetU{=xV1|m@=^#>v4T_$R{4=dHhS1&`~r7 zockvX9u;OPaxy@p&-r3daX=MjCP0(c5C}VL|MMx2`I%hP`9S#sx1atWB6YHYgwS46 zx)fKJeoW}bT2iGzb*k3!Ve8BnrE6YDASC8|8lH7?I8%vU}v z_-jmk6DzNL!R_&Ai7V#hD!__}`2?SI_QTU|h63{Cvc_%&zuL$ks-gmRpx+wd?r1_X zW$}Hkq6ItOu=ta&bAwQK3J~&AjeRQ#kR37aXZRK4a_#C3YL^MUm|=w3IP$+4T0^Px z3>u*WN3J@`U@YIfP0YT!jzxadrfqDT?QHiU0WyIaULU5Y-3gP0EHlM*D{k*Htgo`J zVMYZu)Kt#Tg;Xq_7@VGed##hr$-ZAY`^-6pgvlG6qGy6_?D2a#={;*L}f3Kh?v(E zeJLNN)It(rD^4~;m7mfMeEZ$7!#z=2HRZRCM%l4hUb9bR+{awrIC&{V?x%1-XnmtQ^^ftVLfB8wd{xfZ_u_1pqVNNL zk2_C4ywwihKC*E0*`=b*5x4Oq*7u=Z54k=GeY7DTcEE8wfq=&~ihSo#YEUtOP zl`Ctq%AwpdB?k>tmS&7Jv(MNJvR+xdce}j5u zZt?WwP%dONNzl_R)8WF`gb_iSF*>DN1C+v)q@Z&U8nl5 zYg(_5Qo0>zDpMjCIDX6vb#m-z{r0_g7;|ElGpw8KN}~abczYbbCre8LO3lN)bl322 zX}I9WbZL$7-$E`S@XO()tNz_1-{XuBDTrzk>Zj_950OgCOE0aN%qP=nV=FIAqeUeo z(e*<%IA3r+YW-n1@2W3A2=l%D6ur}Ra4xf2U<@#UXMCH3+9`5*GeIB432Z?Ou%QZ7&JB6LJ&l zXbl;ch&&bwmt~IiRHUQxi(xFY?yvGoPatY&{Knw@ZsKfraQ-<(<6mJSUQcmni!3Y6 zTKCSohP_3*g(WwB#)jJL=3X-e{g~WMLj}Ye7^ygqt=(W*g2o7)6t&(1ZO&1vLLbZi zl#*v@6@QN*(`qcZeKgvfgX)BkI^!umH^>r=E78LW2d$EOQ>uAYtw&zJ*vRc2^P+;| z)qC&cNeYBs{pDs1U$sW!kl~7!muUq+6lpWk#_ZWQS}<`t)i1Jb*lFOW|AHk!@&0dN@ryJBV>Z?dJ(rG=*vF_^0!1t#Akm|!vn ztqw6cGD6agCnAOFc0hjN~+;$ex017(c@1pElyRv1DBJAq$9 zPJ8B!{QYIGgWyDf(2>hnL`L4j5ocod;J!Qcf*jn~_v|F&rt)$a1A|m~t{&ZfJG&zX zTZK(h^BICLSH+lZ$kj>SCeQT{t$xZnD4 za~X4c1iM_h#b@$;0s{n7R>3O107ZBxb*wIRGjWPy2Pgq|NzB>xNgtXMs6l^Hc<+j{swU(t$CAiT2;5S_pjm4>F?l@53@g{dKO9=&b^O zFF)u-{D|+?^Ksl7spYF~ksQLSx|@-|)F^z+NB_BdWk6PTr&o86oL}9DrXS)R;HR?` zMfn2WQ2t@xfE?lZ)6!JutsS5^>yJfR{$;b(MT@bQpWU|B@ZhE${t`)S#}?zrLDJ;8 zU5?&5U2#6z#NEXM%-W`=9tyL#yAP;zel52c0tnQ;gv~@*FYI5HtNOXKVNQN@9e8x&S>-KHJI^cvuZcsc&t2F8Upb+p6C7 zJBI|dN4#mk0-ckVxRFTd#G{U>!LUEEKCI= zry0Rj7w2{y;3sb=`J`riy5>Ek{g;L^pMhqnO#q4+Z71qhd#AY41A39(3VYCeyJ!FY zkuBMazo{;MExrN+{-=1t#5jRapj<6@IoG6_BJb)JJ>m@^ZrDIZ3P%LXJ7}{iqC!&{ zem=?)GR?{Tip%po?zx$@kM{|@E$OUmEjHHa`bgGcR_eq1{4-Y#P8vLDE001DVcN6k z{$B80&haAR!?Z?Q0b99(PMx32$O)Ofug*r7IEj_m!hoa=pRz4WqT@0W8$mu{s0+>l z9k6b<6&`4LfMw>DJ?$2oR0OG4y@GA9hb%|dwCt6QJM>Pcu~mNhX?%R(g^Z32H~lo0 z5B@7ELZSv&IG$=1XXB?K7?^g4a5n2|;s@41X-eGJX2K-h{%n2xLwdte zvAV;f&UL&l@0BSl+>tfXePcgh#I-U9UShyrCs?`cJkgb#LCrvw=x$3#xi?mMX62tOn0%prrlP52m$V z=?lIS2V92Mo@hPiN@~ty)v{>+hxXZ771irA7$;i{fLd8Kk1!^>urD&Ar$`8D8UG3*6fN|LZXg2)ov&_M1tO-#*9V$+V*bSHQ34Ha3e7cFARYzOO zRbxUEA%+8zL*XH%Z#6kXOV597=l(@ed6P8dEeQpv))ep&c*Vb$$qbJTaly>t{yuwF zC7C0|;>`Y(Y-%1;Q92C*MUl4jnl5-B9tr`bN~~JBa~OOHit;#N{Hzi)Uxla{{+v#9-KAc{y-g8zr?zGoL zU+5j3?f}C;>5oa$exPs|7rmFnZXPGg5>R$~*R_5_gGUZ*jSM!;Fnib&V$h#h-)lyy z#f{V_ASAZ64ns_JITw&B2Jz`ax5SHB{xEVM=x(+7V5Ff#{Aypa1F6)m3Rg{YPmExX z8GA%R&34jby)hrvhkxSE9$1*Gq&7FvKC>ktjM?(x@72CYd&MX$d4xP*WTlGN;0+~{ z7=}V|7%%r`lH-aFw|rvquf2bJ$mC|ep*;>4=ZoDD9f@PaofD{A`$sBJ+__bm&A3O< zN_f>KluYPB@>lOr`@~N*zk`0oQ7I1$hyLTtR{w_2(npaeV-o#NT`3poIzVFRR^!q;el@< znhomhEBunq3c<_4#*aP2L}#COgB4efUVhar~1c~T|`vs@Co1&+kZb(&C; zJ#{l1GHHNtI`5*RFPwd1pWDL?jg0ESr>wRVR6ns@Ve>5;kyFuqzY;CbHxM&0udJRH zYhs3vYB-CI-LzA7MWI1wBN{#>v9rJBVcpi6(pJ-n4? zrc*uA*ZzA={jpuR5?9>N0g;EDKo~=4n&(_)gk5A93NN&gibn zWQ|d$0ytQ5({J^>MxiRZ>=zVq$zQ$X`&tojNNHaEmgSa!MAn28=y2`5CYdkZT}rP5 zz)AP6X1(HZ`yTKtd49IbW72(^$O#Xb8u?_N=aF$9j^5p%ld!%i!nc1{{5}cHVc6*9 z9L3KJ_E5{I$8>T=Fskl?kHg&#sQ$$up0nt-PcfSo!veoAF9&VIt znlU?o&w^lAxy!eB+uTN`A`=tc98TvVND>S>F?Xc3vlPO~+};=nK_2K&YDNDh^4LA4M9tzG! z;j0lCeSg9J9t!?Z_0|odA0N%WXZQ(0A{ zEL+cCS4@}^H}dQfb8JxvCvK>ncd$E#t1U$K)W+t)+?$4bG=UDK$7y}o(uhA5$>adQ zMclQ*h#ag>sQ|tx=Rp1c$qy)k4h%CxwN>#Il>r_pSpVszssdnO6$X_G?F{6gWsdE3 z&^FG#xyXxe2H5kyWOIfp6{D|<+Dbz*V^wj6U5negOA5L?q|je3(wCF2r2IGgHzB^8 z@sL6K5TD9H^;;qU{ss(@M$MCE{PE4IyR*>At=-_XIIk=(EI18?Tn#~dch}xC`JHt= z&qwfMvJw0@*;z157l{=5$LlfJM@ zcWG#~9=|*l$e0iS=4gHOX?({29JP#T zIlgC%VhJ@8ely`Dp!xp99v>W8*~Sr*1br>0zW(3=$QUO$p8+r)&aR(3K&%bTUAwJR zH3+5*&`%wW^F{Y-*?M?{vC8cXYI=Y}Lh@|A?DiBN(c}?~u*O*?*GaiamOkX>tgMoa z;G%f`*ePC1nS$&sp|IpYJGIoklhhc-n}d-X{Zuh9qR{B38FG1aTm0o{i4K(vLsr5N z;zp!KShFoxBpEnB=VrbsTw8Iws1R+ZCRX3UP=~xf_f(jPOy1#|pKV_GjsIFmP@XN^)}VH0rFOD&C+@cKY-T=ux!Yf{u$nMk~IO74%seH@WJwcU_Z6_uv|F_Xtqnon%FbgA(#uauEumIvy&aFp7v*$@)ci|Ogneqbtxp>4C5-uzhsdVg+pDK z+B0rh*8A0blUv7U z7-dA-?Ha8xE#rT>Hx#Rn@IQvS1!i=4uUEMtC_E_FR)R??hp=70FH2x?fXb<-UXx4jgVPTAU#PO0eq8=p%Pa4t; zkM?Amk=j{t^XY9onNV&4+n;3X-;mU}_POkex;Ks+5WVU8F{H^r@O@4tfY|FPlC z)lPOy4&i~o&WnTze%v&^Mw~fy?!{^xKD`!`{evYBqTVI^l)&KI+26_4#k1g2=rpi@HFLpl??>&oF9FyzB zVM<}+($cfSl7SCqlDhWaWk6-Ip~qRu||e$ z9;7c{i9@!jHmJ%F$0VWRahg4)ni?MkgC`zL?g@@L!JPWjy*!DDvRu;|vc&u@^1WxF zH6f2m_^h6u%|3z$=zEbeS+J{8Q#4$-!HEpau|V(SrkWWpz_$Xu((_P%^~3GsM;RN9 zN?qzt0c)TIn+*Ko$_>N?bHhb0)_wuTkNB-NZB>?gsV;;&ch)l&7AWxa^+Atc$9$jaMpJ>A#ZP#zD_Gg0X& zo8@6B67zx1&G=)2=3n${Swc-*)S*9S+1npCxR}Y*X~)+G`W-)L=7kv4`KhOZ%X_h< z6^=D}2gZ{9f0Q2yBjfc|z5%xJ>(iRWk3)`oAn0PqX(2#gA|U(q+Yiybd6Heew;L)g zE)f4)kCxMg{K{?rH4gtb_iz?|>hiz0L>Si_lwY&W`U<&hhFSLEwYit zJ3u>Uq8mG&(lB@adVdt6Fr9np9Z4D|H zd{0qtGVAGqF^{IZy3!8|wozU6wooSjtCb}bX3Ge(4{V<+u~O)c!EH;(#Wr*avq*9? zN)iS#PE{L8<^frKVIPRbvUyJyIIkMDW@RbwI7OXgSmY@~Fl%wwB@m!gG4;N!izCHv zM=q|DV^_xH6z8rc2C^dF^9lGD%Wgbz_lE$+c=w<0!QejZ*5RzJSf0kcKsgCD0?;f- z?*_yR6373;z`mdh&#X-@hJIi1C2ndkLt%G$N6hZwTVa93DTO^J1kXtLL{7AaLk326 zv*ERLgjzek|3W>gX$OwrmLUulD1~J5VcCL-S(z)AbkW~>=eJ^5pdmaP{8{*c=t+tz z)|(7h{vxXO$4_+X&}m{{m6&#}*V21j`?^rm{XY=aa}W9T?S?0O3-Yxd6MIY60nz%-3#+FtOAMcQKqT9h8U zp3QgoIUeKa@`o@r4h9*N@qKsEHxjR@h0i7~H+#0)NcHjMP|r9tdpez;DLIYq;{vXl zXQEXDrKOSsV4rP%@C@ohW3H|=mG0U{l*k3x_jUfmQ?5&2@!ytdEo1Jluc+G>XD^Rm zM1(WtqCVKr+Qu;Ia;OmG2fxXdlDFLzRWYs9|NiyxqG}FW3Bm#?-Pz+ypLnijxm~k~ zHeAxXgd!izUsUN78j0AEFj6`!S1G4!FLXPDhd6SZL=M8SxbzhF)bC&8FuD@>gxMtiw=_Fi$-_n@$Q)*c) z#$@#*3EZp`@7`OW)EaQDHXMC?_c%NQ^40O_PlzwRvLgfLQ36DG6bEx1BR$&!3>IE5 z6=m|xk>?ZRDIyEO75Yp+C<<#DU6gf9~Y_+XuH3*ZZz^lz-T+N+yiWjdbq=F1lB6u5&&2sm=XcZH zzPasC+f3>_tLG9hUk;=&s<;w;*q~W*IqxhEy2*V{IxoM`g`T&r4}aearl+O4$I$&d zcTbc*M#t+^pgG+6WTnEFUmTR_^gq>5ckdFTa>a>`2z9N_9RJmD%nx#*553PnQU()C z8$KHZZLzrq3;^pxxLA2Ei~ltj4kCg{{}AkF)|CQ#rt;lFwSJdRpORVA_?tjfSz#R{ zKq&RMldfxA6X)q?&2J}tnG}2>xm*e+~(dh?b73bY8 zp?O_pOG+h>x7jx9I;E0T>SIO-yJi6 z5K*p0kR5Zoe-@}-S=+NF^}G#o8v~!)->zj_)(7Vmre56AC8za7aKIaD+F=s4i-0?-gcVzzprv_I)p?O~1y zQ=jg@%{MtSB=-i%)iv$?9-Pdkv#09Zm)AO4Og;i{{jRR)k4vb5`Z1_Y_9*WEz(2ce z8hlB&KEaZzAWd$iU|9Y9M_c#ZGxR4sJGxBjxP3pGesW=<09-tdIHf}|j_)F|6d3&{ zuRk2+dhL?+L&0h~CIXw?lLGg0POLsT{7sVj(l<%HasQU3SaV$bLZULpnt!nT;(JxJ zO+9uaNN5WVhQ{u(|1E{F-K|U-o2_h^ri|1FPYVkvB6x_LxE^panR>C1|8`kKrs<00 zJHU;96w8!1)Xa~4IzO4ch)q;3KJ6lx>)|XHcq+M;l?qfTYr*=SirhRX=+ChbUcjhN z7}$|O(yve%@McJs>F5$-u;l_(n{$H%eodG4tO4_dytYP0mGe29=Bui1w(nI&0yk$$ z|J=}5U9---YoBvD7)YFVXlZ>J14Jspr~dWGb05aP_2*?ur6}W{7MDR_aZ(T8xnPKi^GT+)IT)pP9?Q-6n7`c&`!_R-WYx>k%x6Weh7H*I=mI7;_N4WpJ zUf_)vQ3?HPy-2pVC(*8RUTKE5a(EX6)y5r494Cx(t?=f80w`D7HX|;5d}$ zSNmZN&Hw2HqFJ>E?vgM6E}R^5|{Dm9fonP#ZE>-E{7f&_P z!}Ra*x0p6-IAu148dsZfXXRrk0)r65I z8B?8!!+qjSXizZj6E#Yb?_{gV7M z!=hL9TWuB4PN< zT*nh*vC5;Lz>)gVnDlFSz)f6Jb>>6M)fwl-A1u6-%*|edKG*|$@En5d3GX7`#Y&C3 z4 zD>Lkm34KZ0(61}|RqvLJtXpMT^iI!k>)E85;tJPd$TZU^)Zvj$qmWGNDJ;C$=5oji zd5>uB>D<#?C^u{7CZR(290e}jQO53osd&@Y^UBJ=&uIiIHZ;M^aV8&s93e zTkg_^)gXFXD#}jVv86e9BNeZQd!sXg5{6##5))A-S}7zfCMhrUs*E&d3`PdG5 zE`vM$WDG0o^_pYf{l_RSHREtfEfc}lR}PCHkLS|SYkzW>(o!_Lct%QPye zouPwXGu4$N^PE#X#AKD``g}{yF9#0rNhG)beiR)8664dF#45v1VA>Z(Ua;-`0RkghudY9o_qug zk%9s=6}H_uz*S%wHGpQOx&wF&vFkb`1BvFw%PU%K^Tk?*j*Xo&1aB(Wouz}TfW=Ye zU8DQ{bQ51;bB~cw%!XzlvbFRKlFf+-nuMm}P6ag=dCPC-= zLamk?#lDR_z{;64SSaV~8YIUEhAzLay!2H5ysEY^L{+y{TeJ6l`IV0W@jVdM-Tc7z z_NH;g_`;7zq)cONtdUeu#I-qE0Wn zZT%7}^n~x*Qh1%9?!A7%?MUr2Z?`KWks!teqP>HP-jP4!qXfq(@KQCGA&#$gZbcdL zg42zBv7z#s-#q@c@arE43~{|QX5B9qP7W3_4z8%#I;<7wZo1(|yep1?DiK9ai32wi z`-$xJ(7`=pTA5E;Q8JV`Tgw+ZY8n6^;p-_9`yhSfBkLY#@;8y#Yhnp3b|xm-0o4nE z?!B2$zNu2JeE2|$vLw;M%g{(Ev^2m=ZbywcP$2j=Qh(&D6y<9VMx9aOlW>bT-k)f{ z`_FBQJ&025uc$cwQ&au+&HUF2lQNSe3`yX0fFX>PmzL1uOtAjJvJGJ@d{wfV`d#qn zya!eD&X|Nn!|SUHIBJo3^p=FrNW(p%fl5b$oh@kJw^l2jR#m0%&rptAJAy@|zpQD| z>(NTKPNSQSeL-$Q$Bds9-7cCzH2_M%4Z8PHy!G%i|7TP1wsmcGk~?fhJ(M(PYw>dC z>|P4-KU51FEpINyRK%(>(2LlYqFyc|G7isYUDk2|9Q>{fSAp$aDr1vMg@$w^+w|4r zK9}a0GmEyfCPfna{-;n?JWzARTRN$zskok6qx$+LX9O;i+bHP%fbvT#Qp=J3JR}>i ztwEa^P(|E}nDKee=eyp=Npbgb5JRP0BVzL1KzAggwxO%ftD7Itvr|;rXMI`Ia|5Gm}dez|cR%f75?rYB6(kW|$SGe*RR@|Je_| z41w(AkUS}tx@JWJ=Q&D$E#r%G%Q+p``d1o*yo6y;N8mb48$MI-5ilRxz+L+PwYv!T qFyQ-t8_)lH*8k53)wNaJLW1PnW%NG9+?|>Tl9N$>SMtU<=zjpbC4Tq- literal 0 HcmV?d00001 diff --git a/windows/deployment/do/images/use-custom-dns-3.png b/windows/deployment/do/images/use-custom-dns-3.png new file mode 100644 index 0000000000000000000000000000000000000000..90ef151c05d9588b681a41f829e90042143defcb GIT binary patch literal 7754 zcmai(cT`i&yYEAl4pOBHs7P0OM+Brv5$Roe=cNY-38E-XAwUR7mEH+mx=05Fq_+?$ z0RbtYg-~z&z3Z-X{XJUWenbbN= zOVC0d!tvyXNaY*qg!r9bO57r4_fOo*q}ZMn;BM#*D>h5J0`)_5)H!n z=3Y?Z8wrGWr175u!gtgFz}M2qS4057BSHJQze5!N@1e+{(KeN?tNpI7y+2>pnCk0~ zb|5!cZ=BHS{gRN%Q_xEA$2^e|!&vL>?J~P&t+S)-jjile`q&RONHh)A(%tX9ZN~Z~ zc9cRDEO*ZzdtHBVYAP68Nbt>_y0qW@@;bZpOqy|`1wN~pSpNp~77Mvr(?3?#P%{pU zxN5z*JjuCMX^WUptZ;Z700)7Ci%Top<|ts{x&E96EHY*&WNr6R{mifC`ENxJ$Hwe# z&UTyMys2NjiWgxu^ZY!(wCE80RgEEnv~?x$wHqsZDzLv|XYuW$bNJQJ z>h&n+NuuTL&rVWi5y;?iM9X>Lg{0DhA4LKVJvlxqHaMcKlYQR@&ADBoO6oQGF7e2M zNi{g(dC^UkmW*;R>hk&%?bUrbgZKF}`iFJemE5FgH(pMy(+v^MAGU>cDO#Y8;;-|7%v!ThOQ{$*DV`4#7 zTgtA^XppF*sf$3M{$uHcW8-1}xG;_37NaQi%DszDAKD)=%1Hf>$~i~lY3@JPPZ@qB zF1dG}w@nrd^`LxOilb}$Aq+Rypih5pcrA_oF*%Z-b!ge~A*l%MKfT(&RqLfF+iBeu zDm&@UCWh`j$n%@uc2b$*`^2#;>f>gAf8_Dm^&0e@5&C_i3NU>_D>QsxTFoWCObim{ zcX^axko_|cE|9h-{+&6c#LBD?b$wQz@x~l?QO?qBc~+Z#`vxg>Xk|~!)1ic!9mX?@;Yw*sgr&Yu@hUlaOrSky3SCP0VdO> zdEAlr$r;UvW-6UcnY1jFSFe)tmUA{gp>8h8)*t`#exR3NKf+Me#MR=;?W7IHrOvqB zj63-$Dm4KTZB6!m1_F_eWV{Ws32A+2k~0{QJ&dhjZ%&d|RLXy0yLU6Y*-pKcDbFi= zZFP{_f&3V4+-e&lWR4l(D<`b)=6UnLjE?}=$Zz46FmZQ-dxu6NpMxRi-s3>cq2AxK zcBg1_MhEZ_3JGWY;Sij!CI`F`*04JWx5S`17b!Z1+*~ZNDgF>|*c%62OJ&#xyDmzzYaS5<25p%(%^SDX+hc_%gwfk(l0D9h2T$Ot}^I2b> z_R!=Q1WBMuH2z~;PfO^xeUYl-&>ot`KWd!r7pmhrVjtsYuy4peTjT3I;ud{uBKGsP z;_GR5-%gPp12H#;s(@G7Y?`}dn=%ie-Qe1-A|(?w5s3^7h68@1$9ylPs6IAyI*Uh{k>u976GIqoD&g5D^Nji;~7|>0U z`b*nbyYmg^hhyia{m|z=1tcav4LE#R6zcpWr2l$xQYM8PwZF%W%IZXhU`deV`qO^6 z#i~bVqA51QAxr9aAr2P}Wi>uE&NuZ^I&%>0uv!JP?HwTTd0(M!_>7-bv}OsX3>DS- zR&4z%;wp_YZCcdcX1yPnPvK1!<05182Y36aS&uO{g<1E>L~z%I`Bs${N3PI-aAJ@h zmK5pZy?p5VrgE34CVc$(p~B>*8%jS+(rXX14-!rM?F`eCnVu$B+1|KH@Lr4|1MiU2+TgT9ltlu>0`tA;z{#t&ZU;NjW*K4`; zq;kVpA#k+L=83mU@5v?S0^Z_7be#^?PH6QtQ4vYx;rb0()?5O7&V??r6_tt}R}RpH zoKT!a-%d(;Wmb`hRLhQ(l9oEnXEe{52o;1SW+Cuq)uF3xxM|z7(N#_1J=tl&^ga}m zr2Zbm+7sSCQ^j3%Xc%_TY3kmQ$3AWD;!UAYW82|>Lqp0ovuUU0J+L|Wt7v`++#N$0 zGzgqXcRR|9H(OC8@DuaAhuItRJs!b!fOl!wEHGBk?0-g z(jEj=rq2^Zc(!w};uBP!-B;P45u;3sGs7V-+m!7{bszUu{pE~23ALp-VthlMsD~7v z)Qzb|5iQy7yyp(*(rZoo@39>tqiqNV4Czq_V8QGBy+py)!UDUbrUzAd|phIHzbh3HItDyCu&%m zh2N_mT3+VRQ4WWKp9gQRZ@<^|i^(NF$?aVh?Tu~Mc_{$84H z=SaB>_pwL`!eM5HOmr2-df+97`HrY?k|Mq|0^C zL1IN`QkTm_uR7bijp8+#pbYnNx*`+{-|ZClH;O-Lf2=Wu^|xxYRy&c>b6%rfY=t{u zzIvM0lC)`tV?AKBy~&<7rN8}U&2lTmHsiLoHoI!Z+&?R9YQLB9tD7LW^QeQhX<^h* zivcDeSM;HRM}Z3lv4M=lGpesB%AgwS(QmbX_}+%6u+0jR^s?^&6r`B9tkZD=LwY8; zFC7sUDN6G2)C5FLY>zVy3C^oOkxO+|7Pvn%WMeUv2M`s@^c2^xCzvks z;YRpy;OyAji8`*6rX0c|Q02=I3SRu*pLl@dJJ%a}>xBvnZu?deEd#+2DS=NP?^g7O zzsM}}fo6*yEZBksmld+N}me}yxj<4{(G4rWLIYX1jl=$Jf?on{`RLE26 z!uy~I{f*~MtMgyO#R^k%R~z9q_fj`=yL{RY2hUc3ai*=8WRWX%Tz1fQLbB-FKaZ2y ztiOy~Our13-{G9DH)yVZFEfy0z;A}qHapAE_H$hh7m;J`zJwhHu*#Nd{HE7KZ*D=_ z=2+ED$W~wj<*5oI3$lnHQ-O93MD`ZHlll^@4C;GYE%Cy%)dXeFR32-gV!0K@SmR3q zb}y3TwERv3>^3fhla96NLb@{ja9dq}yr56b4|Por#GuXWJ^cP^$@g-vcWk+QFU_|A zRIIY9Ttwv&biPyoK+K0wBsV@-xDipY0|1dPUjHYC6c7si_Y1(CtXC-pNpD$>S`hAk zj?c4aEXUa%8q>n(G&^R*!42zBu_Xe4*iaZ%=F3+keKLjH2LzZoThdutF;6}`vF#KL zeBb|mVT&hnRHTv4x}}oe`w60bNd2pVA zHHy9EZCqNC&AG%ioH8XRO7+QXWz8w6Jye#h#_+qC+xmfM@n+NPk+dGNtK#@op4XgA+n}W{`X3;NB|3hc@<^P?7A%SSog|r5 zsP|hmbphtYrPo+9Icq2}bA(z;mEg5nSm|KRq+^78?YDR69whP>`0avTW=Wc6ljzZp ziS6EsrdJ_$dQ2d$Fy$M45WmDc z4l|Y!j=c*nIH;hu$Q#VdA}hm@&&vlK?ErBvV;g8+EG(P^VUVt^$9>>G0xs;&aXiV} zp40ISiXw*065v<&_IF~ubvad-14Vqqv0?GQ(6pz%VooXb4zsCZ;|o!Q0LH&QQ8;eK zmgqfw_?~orKunR{f8;@v42K4L{5^p5n;&y=#J@CFIDKfr#b@7Y5&?i#e13fb+pK{c zG`sa#rS@%810I18Oyqxau6^HsQtwv;0RV7^>5YU}U-)@Pr{B%CdciWVPM{FdVVT44 zeN{t&^FA?};rhP+i%t-y`6sUKWbR(UE;FlQBdHJ)QT>}W4yvS}>N$V7Wz0aDx=cxH zkk)5Jy(TcpaMo#+Ug+Qvb`f!9q<}#T30hI*ffB_3q^C%>cje@RtX{Eu5~-u1I~3>}^c=Tp z>dpHZv{YNb=%HCnM;T8C^@SRPN&NmaC4C4DecM19?oSVbd?_UQ*L|DpLE<{JO%M+S zMB=LD68CiC%5~MOrys-3=yx`La43j>!BqbCAF&EZm7iM?KaXd~x%+N2jQ0C{n=|rj zYJwr1?)AsF1Y!T?Y{6cpc?K!b#r5nENvFX)^@un&w68`0E_TX~roa0x6}!T;hN5(9 zhlOEC9MC>uz_9>z?a<2~-w2_u=hQmVp~&F2C_O-@=79v&Iw|~4CV-04s&cTyb@Q!{ zmJq4q8maz-z!%sNZ>a!kscjl8=lpnbHiIB$d178^q0OuUbT`d<=cxv~2WOp?R3$3- zwBxexG_rY4k8RUl5+4*i6ofu2v^*aw^SP96T64$Eo-`-?CS7x-WHM-s^=nB!vg$=s zDRZ%xSsJZ$pE;Rcysuq&ElkXEc(Na!m>Awl7hv`Xow7G0#XcQBL!w6^FZ_Ol;nT6z zmX6M4%YkgeWcX{&XYqle-|=`?-1@bo|6r{n=v%#@m!?gGJ6e$WL%LomAi_+q3~skU zNF!ZY$7{g(@6H0#GE`I6HrPoqb4&Bfm}Bv+FUza7)2k_ciz-jrIR~q+EO8BoluVJgFk8ARGkXpS(=ah0cI~1<`{xOU~k!{U-Lb50c^ zcXEYit_60Vgkn)Sof(&B;EuHG{N4nXwjaPJCoGJmxHW&DyE{5*K>j62c&+rvG06aTjr7 zEYKePJf(wj^Ms-i@;>+%Tx>2lnNYd?UhFPfB~8%t)esNgYMk1eb(ej4PYNOAc8z^U zdF;Gw!^Fv8w$yn=R72*4-7o2T*|vDLP#Hi8IFB7pLgwdrqY>-y@?UnmzB2C&)|nq_ zD_@z7`ND3hL0yw3L7LqqXxUq90R5zaNRJGren)mEP@Tyv8vyay>-)~NefB|4@-3A> zO9)6D8(}o*$p?t^CK76Td_d?4KQwi6kKaNMQM_E3!i%LO|H_YFP4E3B6M}zlGhY#} zy;o+Juv)A94*Qn9sQI6XW8xT5*yPsiHxJN10Kj(T03w$DVP{)vW-jal*Xh&GhUqRV zY9lDhoH{0PY1)^wfp??Km2~Wj2&t%A4^7Gf{8bO zL6wBt7&W@+gZDIslL-Jq4p~Cdp}LQFM5o3NvBOW5-c1GWOiqHQkeck4$| zaSgLv9p&8KcP2^?%Y}yTqdL|-v%lMpk2{ zH`s|lrW4}D=KiWq&M$Y7@G!|CA_F()9l!mBZXPNS%R=>5yN-o$hz+3WV>fG)?P{qK z|3EaGDL6{f!YHf7G)6-tVIFz4_Oon1CUJO386ZZ_(HH!?1{tPU@82y;qsrX>P)}c; z{^|*{(dw)EI`p6|ohNj8+wW`vs_0%ie$oo?;(W6dSJ_v_>qr+L!nB&(`^AvxdoDZq zsp;ONF?PmKZLgvNl~n^lw3)NKC`Dh;lwHBvn4NN4666U@6Neh)ht~RwhPNU!132t# zlgTq-%GluhWg20g-0uy3MzfwM*nG{6`7+=y$(a8#D{E?p@IT0Ny!Yc_)2Pws@a$X? z5mrq-mvaZzh5l$ZOK_J`L|4tq=@vzm+4drIn=yM>`?Sihpi&nSy*fs+)*qBKNzif} zs1yG?jy&ZqOzF!X2eo?!@>a5*qyS+9-*;7Niqe!Y>6b}vx-s_8I zvj$_^2ReFR#Bwvc<))p5g9w@4HS?)0T2^N*j~4YEUTOTJ?cuj3Ke!cX9rkqB$U=^D z!lPDT!irt%ntKF!8xVPKrh#dQVx+H)Hx8)J)v5%$LUHVu6OUkx{c&6UAH$E9txT(> zAThkRv^^6fW=Yf3gmM-b_?AC{E@n7W%jUc9=$^n06WM3=^u-3P3vnVh(t`^M2d$bH za7_R}8*lT_Z|8RnvdnKF7Y}Z~IL^>1o;QsRn28K@HsDNfob?M zy?uxx&pg)N9bba3{SFQN^Ea>sr{UF;v|{MCa2;1#zz-gps6%q`XLcKS^=U6{%8z$e zFP_hBs5vI}Mxad;nrMY_9Oj65e@i^)6HVmUUr6!{PkHH>FWGpsC+bUY_MHA|i+=?L zz>5T7U?$td#3Fcmdfl3>l4^!JDZ_th7t4c3GXrKq>%c4h^{vh$H{Nuv79T{G>4o~j zkL<&@=7yt3juS`xW-8WkYL|JX5V1XMCP`2mUc*SuDxpt#_*MWV2U0$ILrYeKnY^R< zh!@3McBwqJx>9f98Cm7zXv@VTqV`fDyAoq85Wi7yH7M(zh-H z*Ag?h#bs8RPuV2U`DuE;6NCzFfaw$0c)}(LM^_Sl7X?k_HaK zI0bsH->>|)zt`P)rBj0Gc^pB%O7oYC7VaguP)5id5wAJYz5Af1_$+&O`vXhDNKr_# zF2BfL3LAgrGeyY7nK||BeTgrD){kEk`|5%k?Yqp@H}OEU5X3%gfsY7K(QVrv`oPIE zOEvO{ug+_OwD%SGIc#m!%jcqy1s&my!*xTOT-1g?Q&!1>i*2tR77NWDG$#G4J_wNnGut6D{-; zDql>F$-~cCi^xX})Cla_M1)ejDq>L|VRhr~*4Zc7zYc>)VLlmG64uztw|JeBdHDHocnxeeJ{S3B5&OEi|mt@P8UE-6$9hH`d=kn6oG z=My>(x@#4zSEFO6)>&QIA&|p=Q6_cLmpeC1{{Lzr3V*c_E-kzkLNO&?=RVsW!Fz%R z#9DsiRpw;}`U)C@DQ0Xt>A!OebbU)nU)w5VemYp>THy@<&8!I}-$Jv1n`I%-^WDO< zcZFSAb1HI%CvnPV9jAc`;lKbzT%i9+_MV=Kgr0o;7YDpY*k9}5TBtbI?*+ydA07oZ z+6Xg6Njh0PGX?0EtR8%qZ%djAHEJzJ(WsV3d;Ro*9=7EoW&}kSbQS2j!6g-pdg{?# z^KGN&eLBt6?7}6}%BHPcB#YfqfsoL!XW8G8mW6P6G_t7cX7tPDv0ZSJ7LPElNbn5) zkXlX|YL#~ncWkHBWpdqic%^GrbRvHB(tT5rGm_$;D7->qZ~T{A@Dj-r_W!X0il6cS iD~|pzLoq|^Hv~eTIZPp?Sz-9O0BsF@_3EegQU3?8PDj}Q literal 0 HcmV?d00001 From 7047f56824a6c160bd5ffe8def4813c5d48e774a Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Wed, 8 Nov 2023 18:45:55 -0800 Subject: [PATCH 064/237] Update mcc-enterprise-deploy.md added images --- windows/deployment/do/mcc-enterprise-deploy.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 3b508e8d19..6493331af7 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -219,15 +219,19 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p The IP address you assign to the EFLOW VM should be within the same subnet as the host server (based on the subnet mask) and not used by any other machine on the network. For example, for host configuration where the server IP Address is 192.168.1.202 and the subnet mask is 255.255.255.0, the static IP can be anything 192.168.1.* except 192.168.1.202 + :::image type="content" source="./images/external-switch-1.jpg" alt-text="Screenshot of a sample output of ipconfig command showing example of subnet mask." lightbox="./images/external-switch-1.jpg"::: + :::image type="content" source="./images/assigning-ip-2.png" alt-text="Screenshot of multiple installer questions about ipv4 address for Eflow." lightbox="./images/assigning-ip-2.png"::: + If you would like to use your own DNS server instead of Google DNS 8.8.8.8, select **n** and set your own DNS server IP. - + :::image type="content" source="./images/use-custom-dns-3.png" alt-text="Screenshot of multiple installer questions about setting an alternate DNS server." lightbox="./images/use-custom-dns-3.png"::: If you use a dynamic IP address, the DHCP server will automatically configure the IP address and DNS settings. 1. Choose where you would like to download, install, and store the virtual hard disk for EFLOW. You'll also be asked how much memory, storage, and how many cores you would like to allocate for the VM. For this example, we chose the default values for download path, install path, and virtual hard disk path. + :::image type="content" source="./images/installation-info-4.png" alt-text="Screenshot of multiple installer questions about memory and storage." lightbox="./images/installation-info-4.png"::: Please refer to the [Sizing Recommendations](/mcc-enterprise-prerequisites#sizing-recommendations) for memory, virtual storage, and CPU cores. For this example we chose the recommend values for a Branch Office/Small Enterprise deployment. - + :::image type="content" source="./images/memory-storage-5.png" alt-text="Screenshot of multiple installer questions about setting an alternate DNS server." lightbox="./images/memory-storage-5.png"::: - + :::image type="content" source="./images/installation-complete-7" alt-text="Screenshot of expected output when installation is complete." lightbox="./images/installation-complete-7"::: 1. Your MCC deployment is now complete. If you don't see any errors, continue to the next section to validate your MCC deployment. Your VM will not appear in Hyper-V Manager as it is an EFLOW VM. From 15f4b7f836466047ec852f1b7f0bd2a0e6e4b7f3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 09:37:59 -0500 Subject: [PATCH 065/237] adjust/format content and Acrolinx --- .../network-security/windows-firewall/TOC.yml | 4 +- .../windows-firewall/hyper-v-firewall.md | 84 ++++++++++++------- 2 files changed, 54 insertions(+), 34 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml index a216ae58ee..165242f099 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml @@ -148,14 +148,14 @@ items: href: assign-security-group-filters-to-the-gpo.md - name: Change rules from request to require mode href: Change-Rules-From-Request-To-Require-Mode.Md - - name: Configure Hyper-V firewall - href: hyper-v-firewall.md - name: Configure authentication methods href: Configure-authentication-methods.md - name: Configure data protection (Quick Mode) settings href: configure-data-protection-quick-mode-settings.md - name: Configure Group Policy to autoenroll and deploy certificates href: configure-group-policy-to-autoenroll-and-deploy-certificates.md + - name: Configure Hyper-V firewall + href: hyper-v-firewall.md - name: Configure key exchange (main mode) settings href: configure-key-exchange-main-mode-settings.md - name: Configure the rules to require encryption diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 71ed4ba1de..045970b469 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -7,48 +7,51 @@ ms.date: 11/08/2023 # Configure Hyper-V firewall rules -Hyper-V Firewall is a new network firewall solution introduced with Windows 11 22H2. This firewall solution enables filtering inbound and outbound traffic to/from containers that are being hosted by Windows, including the Windows Subsystem for Linux (WSL). +Starting in Windows 11, version 22H2, Hyper-V firewall is a network firewall solution that enables filtering of inbound and outbound traffic to/from containers hosted by Windows, including the Windows Subsystem for Linux (WSL). -## Manage locally from PowerShell +## Configure with PowerShell -Follow the steps below to manage Hyper-V firewall locally on your machine via the command line. +This section describes the steps to manage Hyper-V firewall using PowerShell. -### Get the VMCreatorId GUID +### Obtain the VMCreatorId GUID -Hyper-V firewall rules are enabled per VMCreatorId. First you need to obtain this, which you can do by running: +Hyper-V firewall rules are enabled per *VMCreatorId*. To obtain the VMCreatorId, use the cmdlet: ```powershell Get-NetFirewallHyperVVMCreator ``` -This will output a VmCreatorId. Please note that these are unique, and so the one shown below is exclusive to WSL. +The output contains a VmCreatorId object, which has *unique identifier* (GUID) and *friendly name* properties. For example, the following output shows WSL: ```powershell +PS C:\> Get-NetFirewallHyperVVMCreator VMCreatorId  : {40E0AC32-46A5-438A-A0B2-2B479E8F2E90} FriendlyName : WSL ``` -### Firewall Settings +### Verify Hyper-V firewall settings -Hyper-V Firewall has settings that apply in general to a VMCreatorId. To see these you can use the [Get-NetFirewallHyperVVMSetting]( https://learn.microsoft.com/powershell/module/netsecurity/get-netfirewallhypervvmsetting?view=windowsserver2022-ps) commandlet. For example, you can get the policies affecting WSL with the command below: +Hyper-V firewall has settings that apply in general to a VMCreatorId. Use the [Get-NetFirewallHyperVVMSetting][PS-1] cmdlet to check the settings. For example, you can obtain the policies applied to WSL with the command: ```powershell -Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore -Name "{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}" +Get-NetFirewallHyperVVMSetting -PolicyStore ActiveStore -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' ``` -This will output these values: - -1. Enabled (True/False) - if Hyper-V Firewall is enabled for WSL VMs -2. DefaultInboundAction, DefaultOutboundAction - these are default rule policies as applied to packets entering or leaving the WSL container. These are the defaults (which can be configured more specifically later) -3. LoopbackEnabled - this tracks if loopback traffic between the host and the container is allowed (without requiring any special Hyper-V Firewall rules). WSL enables this by default, to allow the Windows Host to talk to WSL, and WSL to talk to the Windows Host -4. AllowHostPolicyMerge - this setting determines how Windows Host Firewall Enterprise Settings (GP), Hyper-V Firewall Enterprise Settings (MDM), Windows Host Firewall Enterprise Settings (MDM), local Hyper-V Firewall settings, and local Host Firewall settings interact - - a. This setting is detailed with Set-NetFirewallHyperVVMSetting: [Set-NetFirewallHyperVVMSetting (NetSecurity) | Microsoft Learn](https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervvmsetting?view=windowsserver2022-ps) - > [!NOTE] > `-PolicyStore ActiveStore` returns the *applied* settings. -You can set specific settings using the [Set-NetFirewallHyperVVMSetting]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervvmsetting?view=windowsserver2022-ps) command. For example, the command below sets the default inbound connection to Allow: +The output contains the following values: + +| Value | Description | +|--|--| +| `Enabled` (True/False) | True if Hyper-V Firewall is enabled for WSL VMs. | +| `DefaultInboundAction`, `DefaultOutboundAction` | These are default rule policies applied to packets entering or leaving the WSL container. The rule policies can be modified, as described in this article. | +| `LoopbackEnabled` | Tracks if loopback traffic between the host and the container is allowed, without requiring any Hyper-V Firewall rules. WSL enables it by default, to allow the Windows Host to talk to WSL, and WSL to talk to the Windows Host. | +| `AllowHostPolicyMerge` | Determines how Windows Host Firewall Enterprise Settings (GPO), Hyper-V Firewall Enterprise Settings (CSP), Windows Host Firewall Enterprise Settings (CSP), local Hyper-V Firewall settings, and local Host Firewall settings interact.
    This setting is detailed with the [Set-NetFirewallHyperVVMSetting][PS-2] cmdlet. | + +### Configure Hyper-V firewall settings + +To configure Hyper-V firewall, use the [Set-NetFirewallHyperVVMSetting][PS-2] command. For example, the following command sets the default inbound connection to *Allow*: ```powershell Set-NetFirewallHyperVVMSetting -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -DefaultInboundAction Allow @@ -56,25 +59,31 @@ Set-NetFirewallHyperVVMSetting -Name '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -D ### Firewall Rules -Hyper-V firewall rules can be enumerated and created from PowerShell. To view rules please use the [Get-NetFirewallHyperVRule]( https://learn.microsoft.com/powershell/module/netsecurity/get-netfirewallhypervrule?view=windowsserver2022-ps ) commandlet. For example, to view firewall rules that only pertain to WSL you can use the command below: +Hyper-V firewall rules can be enumerated and created from PowerShell. To view rules, use the [Get-NetFirewallHyperVRule][PS-3] cmdlet. For example, to view firewall rules that only pertain to WSL, use the following command: ```powershell -Get-NetFirewallHyperVRule -VMCreatorId "{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}" +Get-NetFirewallHyperVRule -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' ``` -And to set specific rules you can use the [Set-NetFirewallHyperVRule]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervrule?view=windowsserver2022-ps) commandlet. +To configure specific rules, use the [Set-NetFirewallHyperVRule][PS-4] cmdlet. -For example, you can create an inbound rule to allow TCP traffic to the Windows Subsystem for Linux (WSL) on port 80 with this PowerShell command: +For example, to create an inbound rule to allow TCP traffic to WSL on port 80, use the following command: ```powershell -New-NetFirewallHyperVRule -Name MyWebServer -DisplayName "My Web Server" -Direction Inbound -VMCreatorId "{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}" -Protocol TCP -LocalPorts 80 +New-NetFirewallHyperVRule -Name MyWebServer -DisplayName "My Web Server" -Direction Inbound -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}' -Protocol TCP -LocalPorts 80 ``` -### Targeting Hyper-V firewall rules and settings to specific profiles +### Target Hyper-V firewall rules and settings to specific profiles -Hyper-V firewall rules and settings can be targeted to the Firewall profile of the networks that are connected. These are the same Firewall Profiles that the Windows Firewall targets (Public Profile, Private Profile, Domain Profile). This has similar policy options as the above Hyper-V firewall PowerShell commandlets, but are just applied to specific profiles for the connected Windows Host network adapter. +Hyper-V firewall rules and settings can be targeted to the *Firewall profiles*, which are based on the type of network the device is connected to: -You can view these settings per profile with this command: +- Public profile +- Private profile +- Domain profile + +The policy options are similar to the ones already described, but are applied to specific profiles for the connected Windows Host network adapter. + +To view the settings per profile, use the following command: ```powershell Get-NetFirewallHyperVProfile -PolicyStore ActiveStore @@ -83,14 +92,25 @@ Get-NetFirewallHyperVProfile -PolicyStore ActiveStore > [!NOTE] > `-PolicyStore ActiveStore` returns the *applied* settings. -The values here are the same as above, with one additional one: +The output contains an extra value compared to the ones described in the previous section: -- AllowLocalFirewallRules: This setting determines how Enterprise (MDM) Hyper-V Firewall Rules interact with locally defined Hyper-V Firewall Rules. If this is set to True, then Windows will apply both the Hyper-V Firewall Rules from Enterprise Policies and the locally defined Hyper-V Firewall Rules. If this is set to False, then the locally defined Hyper-V Firewall rules are not applied, and only the Hyper-V Firewall Rules pushed by the Enterprise Policies are applied. +| Value | Description | +|--|--| +| `AllowLocalFirewallRules` (True/False)| This setting determines how enterprise Hyper-V firewall rules (CSP or GPO) interact with the locally defined Hyper-V firewall rules:
    - if the value is *True*, both the enterprise Hyper-V firewall rules and the locally defined rules are applied
    - if the value is *False*, the locally defined Hyper-V firewall rules aren't applied, and only enterprise rules are applied. | -You can set these settings per profile using the [Set-NetFirewallHyperVProfile]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervprofile?view=windowsserver2022-ps) commandlet. - -You can set rules per profile using the [Set-NetFirewallHyperVRule]( https://learn.microsoft.com/powershell/module/netsecurity/set-netfirewallhypervrule?view=windowsserver2022-ps) commandlet with the `-Profile` option. +> [!NOTE] +> To configure these **settings** per profile, use the [Set-NetFirewallHyperVProfile][PS-5] cmdlet. +> +> To configure these **rules** per profile using the [Set-NetFirewallHyperVRule][PS-4] cmdlet with the `-Profile` option. ## Manage from Intune You can also manage these settings online via Intune. + + + +[PS-1]: /powershell/module/netsecurity/get-netfirewallhypervvmsetting +[PS-2]: /powershell/module/netsecurity/set-netfirewallhypervvmsetting +[PS-3]: /powershell/module/netsecurity/get-netfirewallhypervrule +[PS-4]: /powershell/module/netsecurity/set-netfirewallhypervrule +[PS-5]: /powershell/module/netsecurity/set-netfirewallhypervprofile From 0c7ab1acd7a3fbb7065af449d746f263d92e4912 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 10:19:45 -0500 Subject: [PATCH 066/237] added example with links to CSP - for review --- .../windows-firewall/hyper-v-firewall.md | 25 +++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 045970b469..33408db506 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -103,9 +103,26 @@ The output contains an extra value compared to the ones described in the previou > > To configure these **rules** per profile using the [Set-NetFirewallHyperVRule][PS-4] cmdlet with the `-Profile` option. -## Manage from Intune +## Configure with Configuration Service Provider (CSP) -You can also manage these settings online via Intune. +You can configure Hyper-V firewall using the [Firewall CSP][CSP-1]. For example, with an MDM solution like Microsoft Intune. + +Here's a list of settings that can be used to configure Hyper-v firewall: + +| | Path | +|--|--| +| **CSP** | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/`[AllowHostPolicyMerge] +| **GPO** | Not available | + +| | Path | +|--|--| +| **CSP** | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/`[AllowLocalPolicyMerge] +| **GPO** | Not available | + +| | Path | +|--|--| +| **CSP** | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{VMCreatorId}/DomainProfile/`[EnableFirewall] +| **GPO** | Not available | @@ -114,3 +131,7 @@ You can also manage these settings online via Intune. [PS-3]: /powershell/module/netsecurity/get-netfirewallhypervrule [PS-4]: /powershell/module/netsecurity/set-netfirewallhypervrule [PS-5]: /powershell/module/netsecurity/set-netfirewallhypervprofile +[CSP-1]: /windows/client-management/mdm/firewall-csp +[AllowHostPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge +[AllowLocalPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileallowlocalpolicymerge +[EnableFirewall]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall \ No newline at end of file From 49c1f9cc386e1ae3ddb14f05d1e83a80d66d22ec Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 08:24:26 -0800 Subject: [PATCH 067/237] Update mcc-enterprise-update-uninstall.md close comment section to fix xyntax error --- windows/deployment/do/mcc-enterprise-update-uninstall.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-enterprise-update-uninstall.md b/windows/deployment/do/mcc-enterprise-update-uninstall.md index 0b0a332d17..67f758188c 100644 --- a/windows/deployment/do/mcc-enterprise-update-uninstall.md +++ b/windows/deployment/do/mcc-enterprise-update-uninstall.md @@ -18,7 +18,7 @@ appliesto: ms.date: 10/12/2022 --- - # Update or uninstall Microsoft Connected Cache for Enterprise and Education Throughout the preview phase, we'll send you security and feature updates for MCC. Follow these steps to perform the update. From 697272464d53285e3bb014ceea15c532e80464a0 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 08:25:34 -0800 Subject: [PATCH 068/237] Update mcc-enterprise-update-uninstall.md oopsie. undoing edit. moving h1 down --- windows/deployment/do/mcc-enterprise-update-uninstall.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-update-uninstall.md b/windows/deployment/do/mcc-enterprise-update-uninstall.md index 67f758188c..a0a00f73f7 100644 --- a/windows/deployment/do/mcc-enterprise-update-uninstall.md +++ b/windows/deployment/do/mcc-enterprise-update-uninstall.md @@ -18,7 +18,7 @@ appliesto: ms.date: 10/12/2022 --- - + -## Uninstall MCC +# Uninstall MCC Please contact the MCC Team before uninstalling to let us know if you're facing issues. From 82d5910c518a3ec46e34a564219a7abcbb7a53c4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 08:33:59 -0800 Subject: [PATCH 069/237] Update windows/deployment/do/mcc-enterprise-deploy.md --- windows/deployment/do/mcc-enterprise-deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 6493331af7..1c93d62e7f 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -241,7 +241,7 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p 1. When the installation is complete, you should see the following output (the values below will be your own) :::image type="content" source="./images/ent-mcc-script-complete.png" alt-text="Screenshot of the installer script displaying the completion summary in PowerShell." lightbox="./images/ent-mcc-script-complete.png"::: - :::image type="content" source="./images/installation-complete-7" alt-text="Screenshot of expected output when installation is complete." lightbox="./images/installation-complete-7"::: + :::image type="content" source="./images/installation-complete-7.png" alt-text="Screenshot of expected output when installation is complete." lightbox="./images/installation-complete-7.png"::: 1. Your MCC deployment is now complete. If you don't see any errors, continue to the next section to validate your MCC deployment. Your VM will not appear in Hyper-V Manager as it is an EFLOW VM. From ce2ca62e5c4c2ae885c229620ac55e35f12f1e0d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 08:36:19 -0800 Subject: [PATCH 070/237] Update windows/deployment/do/mcc-enterprise-deploy.md --- windows/deployment/do/mcc-enterprise-deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 1c93d62e7f..3e972e7f62 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -231,7 +231,7 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p :::image type="content" source="./images/installation-info-4.png" alt-text="Screenshot of multiple installer questions about memory and storage." lightbox="./images/installation-info-4.png"::: Please refer to the [Sizing Recommendations](/mcc-enterprise-prerequisites#sizing-recommendations) for memory, virtual storage, and CPU cores. For this example we chose the recommend values for a Branch Office/Small Enterprise deployment. - :::image type="content" source="./images/memory-storage-5.png" alt-text="Screenshot of multiple installer questions about setting an alternate DNS server." lightbox="./images/memory-storage-5.png"::: + :::image type="content" source="./images/memory-storage-5.png" alt-text="Screenshot of multiple installer questions about memory and storage." lightbox="./images/memory-storage-5.png"::: +The following values apply to Hyper-V firewall rules: +|Value name|Description|Values| +|---|---|---| +|Name

    `HyperVFirewallRules\\Name`|Friendly name of the rule|String| +|Priority

    `HyperVFirewallRules\\Priority`|Specifies the ordering of rule enforcement. If not specified, block rules are ordered ahead of allow rules. A lower priority rule is evaluated before a higher priority one.|int| +|Direction

    `HyperVFirewallRules\\Direction`|Comma separated list.  The rule is enabled based on the traffic direction as following.

    IN - the rule applies to inbound traffic.

    OUT - the rule applies to outbound traffic.

    If not specified the detault is OUT.|String| +|VMCreatorId

    `HyperVFirewallRules\\VMCreatorId`|This field specifies the VM Creator ID that this rule is applicable to. A NULL GUID will result in this rule applying to all VM creators.

    Can be filled in automatically from earlier profile?|String (GUID)| +|Protocol

    `HyperVFirewallRules\\Protocol`|0-255 number representing the ip protocol (TCP = 6, UDP = 17).  If not specified the default is All.|Int| +|LocalAddressRanges

    `HyperVFirewallRules\\LocalAddressRanges`|Consists of one or more comma-delimited tokens specifying the local addresses covered by the rule. "*" is the default value.

    Valid tokens include:

    "*" indicates any local address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.

    A valid IPv6 address.

    An IPv4 address range in the format of "start address - end address" with no spaces included.

    An IPv6 address range in the format of "start address - end address" with no spaces included.  If not specified the default is All.|String| +|LocalPortRanges

    `HyperVFirewallRules\\LocalPortRanges`|Comma Separated list of ranges specifying the local port of the traffic covered by this rule. For example, 100-120,200,300-320.  If not specified the default is All.|String| +|RemoteAddressRanges

    `HyperVFirewallRules\\RemoteAddressRanges`|Consists of one or more comma-delimited tokens specifying the remote addresses covered by the rule. "*" is the default value.

    Valid tokens include:

    "*" indicates any remote address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.

    A valid IPv6 address.

    An IPv4 address range in the format of "start address - end address" with no spaces included.

    An IPv6 address range in the format of "start address - end address" with no spaces included.  If not specified the default is All.|String| +|RemotePortRanges

    `HyperVFirewallRules\\RemotePortRanges`|Comma Separated list of ranges specifying the remote port of the traffic covered by this rule. For example, 100-120,200,300-320.  If not specified the default is All.|String| +|Action

    `HyperVFirewallRules\\Action`|Specifies the action the rule enforces:

    0 - Block

    1 - Allow|Int| +|Enabled

    `HyperVFirewallRules\\Enabled`|Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default.|Boolean| +|Status

    `HyperVFirewallRules\\Status`|Provides information about the specific version of the rule in deployment for monitoring purposes.|String| +|Profiles

    `HyperVFirewallRules\\Profiles`|Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All.|Int| + +### :::image type="icon" source="../../../images/icons/feedback.svg" border="false"::: Provide feedback + +To provide feedback for Hyper-V firewall, open [**Feedback Hub**][FHUB] and use the category **Security and Privacy > Microsoft Defender Firewall and network protection**. + + + +[CSP-1]: /windows/client-management/mdm/policy-csp-authentication#enablepasswordlessexperience [PS-1]: /powershell/module/netsecurity/get-netfirewallhypervvmsetting [PS-2]: /powershell/module/netsecurity/set-netfirewallhypervvmsetting [PS-3]: /powershell/module/netsecurity/get-netfirewallhypervrule From e4b23a6fd356426c4973272003bc897ff1c9e906 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 09:03:08 -0800 Subject: [PATCH 072/237] tweaks, fix link --- windows/deployment/do/mcc-enterprise-deploy.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 3e972e7f62..386d6a0d95 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -200,7 +200,8 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p > [!NOTE] > Restarting your computer after creating a switch is recommended. You'll notice network delays during installation if the computer has not been restarted. - If you restarted your computer after creating a switch, start from Step 2 above and skip to step 5. + If you restarted your computer after creating a switch, start from step 2 above and skip to step 5. + If you opt to use an existing external switch, select the switch from the presented options. Local Area Connection (or USB) is preferable to Wi-Fi. :::image type="content" source="./images/ent-mcc-script-new-switch.png" alt-text="Screenshot of the installer script running in PowerShell when a new switch is created." lightbox="./images/ent-mcc-script-new-switch.png"::: @@ -217,7 +218,7 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p > Choosing a dynamic IP address might assign a different IP address when the MCC restarts. A static IP address is recommended so you don't have to change this value in your management solution when MCC restarts. The IP address you assign to the EFLOW VM should be within the same subnet as the host server (based on the subnet mask) and not used by any other machine on the network. - For example, for host configuration where the server IP Address is 192.168.1.202 and the subnet mask is 255.255.255.0, the static IP can be anything 192.168.1.* except 192.168.1.202 + For example, for host configuration where the server IP Address is 192.168.1.202 and the subnet mask is 255.255.255.0, the static IP can be anything 192.168.1.* except 192.168.1.202. :::image type="content" source="./images/external-switch-1.jpg" alt-text="Screenshot of a sample output of ipconfig command showing example of subnet mask." lightbox="./images/external-switch-1.jpg"::: :::image type="content" source="./images/assigning-ip-2.png" alt-text="Screenshot of multiple installer questions about ipv4 address for Eflow." lightbox="./images/assigning-ip-2.png"::: @@ -228,8 +229,8 @@ Installing MCC on your Windows device is a simple process. A PowerShell script p 1. Choose where you would like to download, install, and store the virtual hard disk for EFLOW. You'll also be asked how much memory, storage, and how many cores you would like to allocate for the VM. For this example, we chose the default values for download path, install path, and virtual hard disk path. - :::image type="content" source="./images/installation-info-4.png" alt-text="Screenshot of multiple installer questions about memory and storage." lightbox="./images/installation-info-4.png"::: - Please refer to the [Sizing Recommendations](/mcc-enterprise-prerequisites#sizing-recommendations) for memory, virtual storage, and CPU cores. For this example we chose the recommend values for a Branch Office/Small Enterprise deployment. + :::image type="content" source="./images/installation-info-4.png" alt-text="Screenshot of multiple installer questions about memory and storage for EFLOW." lightbox="./images/installation-info-4.png"::: + For more information, see [Sizing Recommendations](mcc-enterprise-prerequisites.md#sizing-recommendations) for memory, virtual storage, and CPU cores. For this example we chose the recommend values for a Branch Office/Small Enterprise deployment. :::image type="content" source="./images/memory-storage-5.png" alt-text="Screenshot of multiple installer questions about memory and storage." lightbox="./images/memory-storage-5.png"::: -[CSP-1]: /windows/client-management/mdm/policy-csp-authentication#enablepasswordlessexperience [PS-1]: /powershell/module/netsecurity/get-netfirewallhypervvmsetting [PS-2]: /powershell/module/netsecurity/set-netfirewallhypervvmsetting [PS-3]: /powershell/module/netsecurity/get-netfirewallhypervrule @@ -162,4 +161,5 @@ To provide feedback for Hyper-V firewall, open [**Feedback Hub**][FHUB] and use [CSP-1]: /windows/client-management/mdm/firewall-csp [AllowHostPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge [AllowLocalPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileallowlocalpolicymerge -[EnableFirewall]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall \ No newline at end of file +[EnableFirewall]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall +[INT-1]: /windows/client-management/mdm/firewall-csp From ec3fe9d116d15cd0e2df6138b2da8da1fb1a29c4 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 09:38:20 -0800 Subject: [PATCH 074/237] fix link for moded h2 --- windows/deployment/do/mcc-enterprise-deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 386d6a0d95..64cc63addd 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -29,7 +29,7 @@ To deploy MCC to your server: 1. [Create an MCC Node](#create-an-mcc-node-in-azure) 1. [Edit Cache Node Information](#edit-cache-node-information) 1. [Install MCC on a physical server or VM](#install-mcc-on-windows) -1. [Verify proper functioning MCC server](#verify-proper-functioning-mcc-server) +1. [Verify MCC functionality](#verify-mcc-server-functionality) 1. [Review common Issues](#common-issues) if needed. For questions regarding these instructions contact [msconnectedcache@microsoft.com](mailto:msconnectedcache@microsoft.com) From 9aac0c3233966f112fecf17ae40629d62ab6cacf Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 9 Nov 2023 09:38:47 -0800 Subject: [PATCH 075/237] metadata --- windows/deployment/do/mcc-enterprise-deploy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-enterprise-deploy.md b/windows/deployment/do/mcc-enterprise-deploy.md index 64cc63addd..65d63be915 100644 --- a/windows/deployment/do/mcc-enterprise-deploy.md +++ b/windows/deployment/do/mcc-enterprise-deploy.md @@ -13,7 +13,7 @@ appliesto: - ✅ Windows 11 - ✅ Windows 10 - ✅ Microsoft Connected Cache for Enterprise and Education -ms.date: 11/07/2023 +ms.date: 11/09/2023 --- # Deploy your cache node From 0901fd0901e616270b6b9ae077781fadc57c1d96 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 12:44:36 -0500 Subject: [PATCH 076/237] updates --- .../windows-firewall/hyper-v-firewall.md | 62 +++++++++++-------- 1 file changed, 37 insertions(+), 25 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 142d3c1824..3349d03222 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -28,7 +28,7 @@ The output contains a VmCreator object type, which has unique identifier `VMCrea ```powershell PS C:\> Get-NetFirewallHyperVVMCreator -VMCreatorId  : {40E0AC32-46A5-438A-A0B2-2B479E8F2E90} +VMCreatorId : {40E0AC32-46A5-438A-A0B2-2B479E8F2E90} FriendlyName : WSL ``` @@ -117,35 +117,39 @@ Here's a list of settings that can be used to configure Hyper-v firewall: |Value name|Description| |-|-| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableFirewall]**|This value is an on/off switch for the Hyper-V Firewall. This value controls the settings for all profiles.| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableLoopback]**|Enables loopback between this guest and another guest or the host.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[AllowHostPolicyMerge]**|Enables Hyper-V firewall to use applicable host firewall settings and rules.| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[AllowHostPolicyMerge]**|This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings are applied to Hyper-V Firewall.| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultInboundAction]**|This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree.| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultOutboundAction]**|This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree.| The following values apply to Hyper-V firewall profile settings: `Public`, `Private`, `Domain`: |Value name|Description| |---|---| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall]**|Enables Hyper-V firewall rules for this profile.|[True, False]| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction]**|The default action for outbound traffic that is applied if no rules match the traffic.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction]**|The default action for inbound traffic that is applied if no rules match the traffic.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge]**||| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]**|Enables Hyper-V firewall rules for this profile.|[True, False]| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]**|This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.|[True, False]| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]**|The default action for outbound traffic that is applied if no rules match the traffic.| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]**|The default action for inbound traffic that is applied if no rules match the traffic.| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]**||| The following values apply to Hyper-V firewall rules: -|Value name|Description| -|---|---| -|`HyperVFirewallRules\/`**[Name]**|Friendly name of the rule| -|`HyperVFirewallRules\/`**[Priority]**|Specifies the ordering of rule enforcement. If not specified, block rules are ordered ahead of allow rules. A lower priority rule is evaluated before a higher priority one.| -|`HyperVFirewallRules\/`**[Direction]**|Comma separated list.  The rule is enabled based on the traffic direction as following.

    `IN` - the rule applies to inbound traffic.

    `OUT` - the rule applies to outbound traffic.

    If not specified the detault is OUT.| -|`HyperVFirewallRules\/`**[VMCreatorId]**|This field specifies the VM Creator ID that this rule is applicable to. A NULL GUID will result in this rule applying to all VM creators.

    Can be filled in automatically from earlier profile?| -|Protocol

    `HyperVFirewallRules\/`**[Protocol]**|0-255 number representing the ip protocol (TCP = 6, UDP = 17).  If not specified the default is All.| -|`HyperVFirewallRules\/`**[LocalAddressRanges]**|Consists of one or more comma-delimited tokens specifying the local addresses covered by the rule. "*" is the default value.

    Valid tokens include:

    "*" indicates any local address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.

    A valid IPv6 address.

    An IPv4 address range in the format of "start address - end address" with no spaces included.

    An IPv6 address range in the format of "start address - end address" with no spaces included.  If not specified the default is All.| -|`HyperVFirewallRules\/`**[LocalPortRanges]**|Comma Separated list of ranges specifying the local port of the traffic covered by this rule. For example, 100-120,200,300-320.  If not specified the default is All.| -|`HyperVFirewallRules\/`**[RemoteAddressRanges]**|Consists of one or more comma-delimited tokens specifying the remote addresses covered by the rule. "*" is the default value.

    Valid tokens include:

    "*" indicates any remote address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.

    A valid IPv6 address.

    An IPv4 address range in the format of "start address - end address" with no spaces included.

    An IPv6 address range in the format of "start address - end address" with no spaces included.  If not specified the default is All.| -|`HyperVFirewallRules\/`**[RemotePortRanges]**|Comma Separated list of ranges specifying the remote port of the traffic covered by this rule. For example, 100-120,200,300-320.  If not specified the default is All.| -|`HyperVFirewallRules\/`**[Action]**|Specifies the action the rule enforces:

    0 - Block

    1 - Allow| -|`HyperVFirewallRules\/`**[Enabled]**|Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default.| -|`HyperVFirewallRules\/`**[Status]**|Provides information about the specific version of the rule in deployment for monitoring purposes.| -|`HyperVFirewallRules\/`**[Profiles]**|Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All.| +| Value name | Description | +|--|--| +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Name][RULE]** | Friendly name of the rule. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Priority][RULE]** | Specifies the ordering of rule enforcement. If not specified, block rules are ordered ahead of allow rules. A lower priority rule is evaluated before a higher priority one. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Direction][RULE]** | Comma separated list. The rule is enabled based on the traffic direction as following.

    - `IN`: the rule applies to inbound traffic.

    -`OUT`: the rule applies to outbound traffic.

    If not specified the detault is OUT. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[VMCreatorId][RULE]** | This field specifies the VM Creator ID that this rule is applicable to. A `NULL` GUID will result in this rule applying to all VM creators. | +| Protocol

    `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Protocol][RULE]** | `0-255` number representing the ip protocol (TCP = 6, UDP = 17). If not specified the default is All. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[LocalAddressRanges][RULE]** | Consists of one or more comma-delimited tokens specifying the local addresses covered by the rule. `*` is the default value.

    Valid tokens include:

    `*`: indicates any local address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to `255.255.255.255`.

    A valid IPv6 address.

    An IPv4 address range in the format of *start address - end address* with no spaces included.

    An IPv6 address range in the format of *start address - end address* with no spaces included. If not specified the default is All. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[LocalPortRanges][RULE]** | Comma Separated list of ranges specifying the local port of the traffic covered by this rule. For example, `100-120,200,300-320`. If not specified the default is All. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[RemoteAddressRanges][RULE]** | Consists of one or more comma-delimited tokens specifying the remote addresses covered by the rule. `*` is the default value.

    Valid tokens include:

    `*`: indicates any remote address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to `255.255.255.255`.

    A valid IPv6 address.

    An IPv4 address range in the format of *start address - end address* with no spaces included.

    An IPv6 address range in the format of *start address - end address* with no spaces included. If not specified the default is All. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[RemotePortRanges][RULE]** | Comma Separated list of ranges specifying the remote port of the traffic covered by this rule. For example, `100-120,200,300-320`. If not specified the default is All. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Action][RULE]** | Specifies the action the rule enforces:

    0 - Block

    1 - Allow | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Enabled][RULE]** | Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Status][RULE]** | Provides information about the specific version of the rule in deployment for monitoring purposes. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Profiles][RULE]** | Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All. | ### :::image type="icon" source="../../../images/icons/feedback.svg" border="false"::: Provide feedback @@ -153,13 +157,21 @@ To provide feedback for Hyper-V firewall, open [**Feedback Hub**][FHUB] and use + +[CSP-1]: /windows/client-management/mdm/firewall-csp + +[FHUB]: feedback-hub://?tabid=2&newFeedback=true&feedbackType=1 +[INT-1]: /windows/client-management/mdm/firewall-csp [PS-1]: /powershell/module/netsecurity/get-netfirewallhypervvmsetting [PS-2]: /powershell/module/netsecurity/set-netfirewallhypervvmsetting [PS-3]: /powershell/module/netsecurity/get-netfirewallhypervrule [PS-4]: /powershell/module/netsecurity/set-netfirewallhypervrule [PS-5]: /powershell/module/netsecurity/set-netfirewallhypervprofile -[CSP-1]: /windows/client-management/mdm/firewall-csp + +[RULE]: /windows/client-management/mdm/firewall-csp#mdmstorehypervfirewallrules +[PROFILE]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatorid +[EnableFirewall]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridenablefirewall +[EnableLoopback]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridenableloopback [AllowHostPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge -[AllowLocalPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileallowlocalpolicymerge -[EnableFirewall]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddomainprofileenablefirewall -[INT-1]: /windows/client-management/mdm/firewall-csp +[DefaultOutboundAction]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddefaultoutboundaction +[DefaultInboundAction]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddefaultinboundaction From 1fdbed091df5f457d473db3c0803e60f26534f6b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 12:46:44 -0500 Subject: [PATCH 077/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 3349d03222..beef0bc4fe 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -123,11 +123,11 @@ Here's a list of settings that can be used to configure Hyper-v firewall: |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultInboundAction]**|This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree.| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultOutboundAction]**|This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree.| -The following values apply to Hyper-V firewall profile settings: `Public`, `Private`, `Domain`: +The following values apply to Hyper-V firewall profile settings: *Public*, *Private*, *Domain*: |Value name|Description| |---|---| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]**|Enables Hyper-V firewall rules for this profile.|[True, False]| +|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]**|Enables Hyper-V firewall rules for this profile.| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]**|This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.|[True, False]| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]**|The default action for outbound traffic that is applied if no rules match the traffic.| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]**|The default action for inbound traffic that is applied if no rules match the traffic.| @@ -157,7 +157,6 @@ To provide feedback for Hyper-V firewall, open [**Feedback Hub**][FHUB] and use - [CSP-1]: /windows/client-management/mdm/firewall-csp [FHUB]: feedback-hub://?tabid=2&newFeedback=true&feedbackType=1 From 3de1df9ac8b9ceee6ba9b2c40956f957f57a2c83 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 12:46:59 -0500 Subject: [PATCH 078/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index beef0bc4fe..c1e0c81cdf 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -131,7 +131,6 @@ The following values apply to Hyper-V firewall profile settings: *Public*, *Priv |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]**|This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.|[True, False]| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]**|The default action for outbound traffic that is applied if no rules match the traffic.| |`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]**|The default action for inbound traffic that is applied if no rules match the traffic.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]**||| The following values apply to Hyper-V firewall rules: From a291793a02bda1d0ffc9572fe367f5f5ef5a75fb Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 12:48:18 -0500 Subject: [PATCH 079/237] updates --- .../windows-firewall/hyper-v-firewall.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index c1e0c81cdf..dd4aed1ae8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -115,26 +115,26 @@ You can configure Hyper-V firewall using the [Firewall CSP][CSP-1], for example Here's a list of settings that can be used to configure Hyper-v firewall: -|Value name|Description| -|-|-| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableFirewall]**|This value is an on/off switch for the Hyper-V Firewall. This value controls the settings for all profiles.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableLoopback]**|Enables loopback between this guest and another guest or the host.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[AllowHostPolicyMerge]**|This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings are applied to Hyper-V Firewall.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultInboundAction]**|This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultOutboundAction]**|This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree.| +| CSP path | Description | +|--|--| +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableFirewall]** | This value is an on/off switch for the Hyper-V Firewall. This value controls the settings for all profiles. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableLoopback]** | Enables loopback between this guest and another guest or the host. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[AllowHostPolicyMerge]** | This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings are applied to Hyper-V Firewall. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultInboundAction]** | This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultOutboundAction]** | This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree. | The following values apply to Hyper-V firewall profile settings: *Public*, *Private*, *Domain*: -|Value name|Description| -|---|---| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]**|Enables Hyper-V firewall rules for this profile.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]**|This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced.|[True, False]| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]**|The default action for outbound traffic that is applied if no rules match the traffic.| -|`./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]**|The default action for inbound traffic that is applied if no rules match the traffic.| +| CSP path | Description | +|--|--| +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]** | Enables Hyper-V firewall rules for this profile. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]** | This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced. | [True, False] | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]** | The default action for outbound traffic that is applied if no rules match the traffic. | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]** | The default action for inbound traffic that is applied if no rules match the traffic. | The following values apply to Hyper-V firewall rules: -| Value name | Description | +| CSP path | Description | |--|--| | `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Name][RULE]** | Friendly name of the rule. | | `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Priority][RULE]** | Specifies the ordering of rule enforcement. If not specified, block rules are ordered ahead of allow rules. A lower priority rule is evaluated before a higher priority one. | From 3a797fe367975f0f1e7bf28e00c46fc450358930 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 12:51:29 -0500 Subject: [PATCH 080/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index dd4aed1ae8..92d3e26ea4 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -123,7 +123,7 @@ Here's a list of settings that can be used to configure Hyper-v firewall: | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultInboundAction]** | This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree. | | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultOutboundAction]** | This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree. | -The following values apply to Hyper-V firewall profile settings: *Public*, *Private*, *Domain*: +The following values apply to Hyper-V firewall profile settings: `Public`, `Private`, `Domain`: | CSP path | Description | |--|--| From 6b625b3a1e45893e1dd7b5503d86b6155479a9f1 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 12:57:20 -0500 Subject: [PATCH 081/237] added disclaimer --- .../network-security/windows-firewall/hyper-v-firewall.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 92d3e26ea4..52c2fc7fd6 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -10,7 +10,10 @@ appliesto: # Configure Hyper-V firewall Starting in Windows 11, version 22H2, Hyper-V firewall is a network firewall solution that enables filtering of inbound and outbound traffic to/from containers hosted by Windows, including the Windows Subsystem for Linux (WSL).\ -This article describes how to configure Hyper-V firewall rules and settings using PowerShell, configuration service provider (CSP), or group policy (GPO). +This article describes how to configure Hyper-V firewall rules and settings using PowerShell or configuration service provider (CSP). + +> [!IMPORTANT] +> The configuration oh Hyper-V firewall is not available via group policy (GPO). If Windows Firewall settings are configured via GPO and Hyper-V firewall settings aren't configured via CSP, then the applicable rules and settings are automatically mirrored from the GPO configuration. ## Configure Hyper-V firewall with PowerShell From c8f54ff00987daf7c0ec9f7d77b8d197be5a97df Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 13:04:46 -0500 Subject: [PATCH 082/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 52c2fc7fd6..a5937ee74c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -131,7 +131,7 @@ The following values apply to Hyper-V firewall profile settings: `Public`, `Priv | CSP path | Description | |--|--| | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]** | Enables Hyper-V firewall rules for this profile. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]** | This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced. | [True, False] | +| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]** | This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced. | | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]** | The default action for outbound traffic that is applied if no rules match the traffic. | | `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]** | The default action for inbound traffic that is applied if no rules match the traffic. | From 9e4863b0d0301c3fdfc5efef17bb3f833d799183 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 13:05:07 -0500 Subject: [PATCH 083/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index a5937ee74c..fc9f27f4a5 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -13,7 +13,7 @@ Starting in Windows 11, version 22H2, Hyper-V firewall is a network firewall sol This article describes how to configure Hyper-V firewall rules and settings using PowerShell or configuration service provider (CSP). > [!IMPORTANT] -> The configuration oh Hyper-V firewall is not available via group policy (GPO). If Windows Firewall settings are configured via GPO and Hyper-V firewall settings aren't configured via CSP, then the applicable rules and settings are automatically mirrored from the GPO configuration. +> The configuration of Hyper-V firewall is not available via group policy (GPO). If Windows Firewall settings are configured via GPO and Hyper-V firewall settings aren't configured via CSP, then the applicable rules and settings are automatically mirrored from the GPO configuration. ## Configure Hyper-V firewall with PowerShell From 232deb63e9d9dd343bb6fd42d6881a053267ab35 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 14:55:23 -0500 Subject: [PATCH 084/237] updates --- .../windows-firewall/hyper-v-firewall.md | 49 +++---------------- 1 file changed, 7 insertions(+), 42 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index fc9f27f4a5..d94d736b75 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -114,44 +114,14 @@ The output contains an extra value compared to the ones described in the previou ## Configure Hyper-V firewall with CSP -You can configure Hyper-V firewall using the [Firewall CSP][CSP-1], for example with an MDM solution like Microsoft Intune. To learn how to configure Hyper-V firewall with Microsoft Intune, see [ADD LINK][INT-1]. +You can configure Hyper-V firewall using the [Firewall CSP][CSP-1], for example with an MDM solution like Microsoft Intune. -Here's a list of settings that can be used to configure Hyper-v firewall: +To learn more about the CSP options, follow these links: -| CSP path | Description | -|--|--| -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableFirewall]** | This value is an on/off switch for the Hyper-V Firewall. This value controls the settings for all profiles. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[EnableLoopback]** | Enables loopback between this guest and another guest or the host. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[AllowHostPolicyMerge]** | This value is used as an on/off switch. If this value is true, applicable host firewall rules and settings are applied to Hyper-V Firewall. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultInboundAction]** | This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on inbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}/`**[DefaultOutboundAction]** | This value is the action that the Hyper-V Firewall does by default (and evaluates at the very end) on outbound connections. This value controls the settings for all profiles. It's recommended to instead use the profile setting value under the profile subtree. | +- [Configure Hyper-V firewall settings][SETTINGS]: to configure the Hyper-V firewall settings +- [Configure Hyper-V firewall rules][RULE]: to configure list of rules controlling traffic through the Hyper-V firewall -The following values apply to Hyper-V firewall profile settings: `Public`, `Private`, `Domain`: - -| CSP path | Description | -|--|--| -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[EnableFirewall][PROFILE]** | Enables Hyper-V firewall rules for this profile. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[AllowLocalPolicyMerge][PROFILE]** | This value is used as an on/off switch. If this value is false, Hyper-V Firewall rules from the local store are ignored and not enforced. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultOutboundAction][PROFILE]** | The default action for outbound traffic that is applied if no rules match the traffic. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVVMSettings/{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}//`**[DefaultInboundAction][PROFILE]** | The default action for inbound traffic that is applied if no rules match the traffic. | - -The following values apply to Hyper-V firewall rules: - -| CSP path | Description | -|--|--| -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Name][RULE]** | Friendly name of the rule. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Priority][RULE]** | Specifies the ordering of rule enforcement. If not specified, block rules are ordered ahead of allow rules. A lower priority rule is evaluated before a higher priority one. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Direction][RULE]** | Comma separated list. The rule is enabled based on the traffic direction as following.

    - `IN`: the rule applies to inbound traffic.

    -`OUT`: the rule applies to outbound traffic.

    If not specified the detault is OUT. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[VMCreatorId][RULE]** | This field specifies the VM Creator ID that this rule is applicable to. A `NULL` GUID will result in this rule applying to all VM creators. | -| Protocol

    `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Protocol][RULE]** | `0-255` number representing the ip protocol (TCP = 6, UDP = 17). If not specified the default is All. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[LocalAddressRanges][RULE]** | Consists of one or more comma-delimited tokens specifying the local addresses covered by the rule. `*` is the default value.

    Valid tokens include:

    `*`: indicates any local address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to `255.255.255.255`.

    A valid IPv6 address.

    An IPv4 address range in the format of *start address - end address* with no spaces included.

    An IPv6 address range in the format of *start address - end address* with no spaces included. If not specified the default is All. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[LocalPortRanges][RULE]** | Comma Separated list of ranges specifying the local port of the traffic covered by this rule. For example, `100-120,200,300-320`. If not specified the default is All. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[RemoteAddressRanges][RULE]** | Consists of one or more comma-delimited tokens specifying the remote addresses covered by the rule. `*` is the default value.

    Valid tokens include:

    `*`: indicates any remote address. If present, this must be the only token included.

    A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to `255.255.255.255`.

    A valid IPv6 address.

    An IPv4 address range in the format of *start address - end address* with no spaces included.

    An IPv6 address range in the format of *start address - end address* with no spaces included. If not specified the default is All. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[RemotePortRanges][RULE]** | Comma Separated list of ranges specifying the remote port of the traffic covered by this rule. For example, `100-120,200,300-320`. If not specified the default is All. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Action][RULE]** | Specifies the action the rule enforces:

    0 - Block

    1 - Allow | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Enabled][RULE]** | Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. If not specified - a new rule is disabled by default. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Status][RULE]** | Provides information about the specific version of the rule in deployment for monitoring purposes. | -| `./Vendor/MSFT/Firewall/MdmStore/HyperVFirewallRules//`**[Profiles][RULE]** | Specifies the profiles to which the rule belongs: Domain, Private, Public. See [FW_PROFILE_TYPE](/openspecs/windows_protocols/ms-fasp/7704e238-174d-4a5e-b809-5f3787dd8acc) for the bitmasks that are used to identify profile types. If not specified, the default is All. | +To learn how to configure the firewall with Microsoft Intune, see [Firewall policy for endpoint security][INT-1]. ### :::image type="icon" source="../../../images/icons/feedback.svg" border="false"::: Provide feedback @@ -162,7 +132,7 @@ To provide feedback for Hyper-V firewall, open [**Feedback Hub**][FHUB] and use [CSP-1]: /windows/client-management/mdm/firewall-csp [FHUB]: feedback-hub://?tabid=2&newFeedback=true&feedbackType=1 -[INT-1]: /windows/client-management/mdm/firewall-csp +[INT-1]: /mem/intune/protect/endpoint-security-firewall-policy [PS-1]: /powershell/module/netsecurity/get-netfirewallhypervvmsetting [PS-2]: /powershell/module/netsecurity/set-netfirewallhypervvmsetting [PS-3]: /powershell/module/netsecurity/get-netfirewallhypervrule @@ -170,9 +140,4 @@ To provide feedback for Hyper-V firewall, open [**Feedback Hub**][FHUB] and use [PS-5]: /powershell/module/netsecurity/set-netfirewallhypervprofile [RULE]: /windows/client-management/mdm/firewall-csp#mdmstorehypervfirewallrules -[PROFILE]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatorid -[EnableFirewall]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridenablefirewall -[EnableLoopback]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridenableloopback -[AllowHostPolicyMerge]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoridallowhostpolicymerge -[DefaultOutboundAction]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddefaultoutboundaction -[DefaultInboundAction]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettingsvmcreatoriddefaultinboundaction +[SETTINGS]: /windows/client-management/mdm/firewall-csp#mdmstorehypervvmsettings From f80fbed9af14e264be10e6940b811aca5bb2c669 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 14:57:24 -0500 Subject: [PATCH 085/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index d94d736b75..83bc11858a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -3,6 +3,9 @@ title: Hyper-V firewall description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP). ms.topic: how-to ms.date: 11/08/2023 +author: paolomatarazzo +ms.author: paoloma +ms.topic: article appliesto: - ✅ Windows 11 --- From adc1527abbe9d541ea0e3c6cb1c09027ca6a8526 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 15:01:28 -0500 Subject: [PATCH 086/237] updates --- .../network-security/windows-firewall/hyper-v-firewall.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 83bc11858a..534ffb359d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -5,7 +5,6 @@ ms.topic: how-to ms.date: 11/08/2023 author: paolomatarazzo ms.author: paoloma -ms.topic: article appliesto: - ✅ Windows 11 --- From c4e9b7eb018db952a3e3a0d1ee82216a26b2a3ef Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 16:45:49 -0500 Subject: [PATCH 087/237] [EDU] Freshness --- .openpublishing.redirection.education.json | 15 + education/windows/edu-stickers.md | 10 +- .../windows/set-up-school-pcs-whats-new.md | 97 ------ .../configure-device-settings.md | 6 +- .../configure-devices-overview.md | 2 +- .../{enroll-aadj.md => enroll-entra-join.md} | 6 +- .../enroll-overview.md | 4 +- .../enroll-package.md | 5 +- .../tutorial-school-deployment/index.md | 5 +- .../manage-overview.md | 2 +- .../manage-surface-devices.md | 18 +- .../tutorial-school-deployment/reset-wipe.md | 3 +- ...ure-ad.md => set-up-microsoft-entra-id.md} | 5 +- .../set-up-microsoft-intune.md | 4 +- .../tutorial-school-deployment/toc.yml | 4 +- .../troubleshoot-overview.md | 7 +- .../windows/use-set-up-school-pcs-app.md | 303 +++++++++--------- 17 files changed, 198 insertions(+), 298 deletions(-) delete mode 100644 education/windows/set-up-school-pcs-whats-new.md rename education/windows/tutorial-school-deployment/{enroll-aadj.md => enroll-entra-join.md} (95%) rename education/windows/tutorial-school-deployment/{set-up-azure-ad.md => set-up-microsoft-entra-id.md} (99%) diff --git a/.openpublishing.redirection.education.json b/.openpublishing.redirection.education.json index 94b0deccdb..11fc9cd312 100644 --- a/.openpublishing.redirection.education.json +++ b/.openpublishing.redirection.education.json @@ -159,6 +159,21 @@ "source_path": "education/windows/windows-automatic-redeployment.md", "redirect_url": "/education/windows/autopilot-reset", "redirect_document_id": false + }, + { + "source_path": "education/windows/enroll-aadj.md", + "redirect_url": "/education/windows/enroll-entra-join", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-azure-ad.md", + "redirect_url": "/education/windows/set-up-microsoft-entra-id", + "redirect_document_id": false + }, + { + "source_path": "education/windows/set-up-school-pcs-whats-new.md", + "redirect_url": "/education/windows", + "redirect_document_id": false } ] } diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index d3a6d97411..e15caa2a1a 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -1,21 +1,17 @@ --- title: Configure Stickers for Windows 11 SE description: Learn about the Stickers feature and how to configure it via Intune and provisioning package. -ms.date: 09/15/2022 +ms.date: 11/09/2023 ms.topic: how-to appliesto: - ✅ Windows 11 SE -ms.collection: - - highpri - - education - - tier2 --- # Configure Stickers for Windows 11 SE -Starting in **Windows 11 SE, version 22H2**, *Stickers* is a new feature that allows students to decorate their desktop with digital stickers. Students can choose from over 500 cheerful, education-friendly digital stickers. Stickers can be arranged, resized, and customized on top of the desktop background. Each student's stickers remain, even when the background changes. +Starting in **Windows 11 SE, version 22H2**, *Stickers* is a feature that allows students to decorate their desktop with digital stickers. Students can choose from over 500 cheerful, education-friendly digital stickers. Stickers can be arranged, resized, and customized on top of the desktop background. Each student's stickers remain, even when the background changes. -Similar to the [education theme packs](edu-themes.md "my tooltip example that opens in a new tab"), Stickers is a personalization feature that helps the device feel like it was designed for students. +Similar to the [education theme packs](edu-themes.md), Stickers is a personalization feature that helps the device feel like it was designed for students. :::image type="content" source="./images/win-11-se-stickers.png" alt-text="Windows 11 SE desktop with 3 stickers" border="true"::: diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md deleted file mode 100644 index 97988171bf..0000000000 --- a/education/windows/set-up-school-pcs-whats-new.md +++ /dev/null @@ -1,97 +0,0 @@ ---- -title: What's new in the Windows Set up School PCs app -description: Find out about app updates and new features in Set up School PCs. -ms.topic: whats-new -ms.date: 08/10/2022 ---- - -# What's new in Set up School PCs -Learn what's new with the Set up School PCs app each week. Find out about new app features and functionality, see updated screenshots, and find information about past releases. - -## Week of August 24, 2020 - -### Longer device names supported in app -You can now give devices running Windows 10, version 2004 and later a name that's up to 53 characters long. - -## Week of September 23, 2019 - -### Easier way to deploy Office 365 to your classroom devices - Microsoft Office now appears as an option on the **Apps** screen. Select the app to add it to your provisioning package. Devices install Microsoft 365 Apps for enterprise. This version includes the cloud-connected and most current versions of apps such as Word, PowerPoint, Excel, and Teams. - -## Week of June 24, 2019 - -### Resumed support for Windows 10, version 1903 and later -The previously mentioned provisioning problem was resolved, so the Set up School PCs app once again supports Windows 10, version 1903 and later. The Windows 10 settings that were removed are now back in the app. - -### Device rename made optional for Azure AD-joined devices -When you set up your Azure AD join devices in the app, you no longer need to rename your devices. You can keep existing device names. - -## Week of May 23, 2019 - -### Suspended support for Windows 10, version 1903 and later -Due to a provisioning problem, Set up School PCs has temporarily stopped support for Windows 10, version 1903 and later. All settings in the app that were for Windows 10, version 1903 and later have been removed. When the problem is resolved, support will resume again. - -### Mandatory device rename for Azure AD-joined devices -If you configure Azure AD Join, you're now required to rename your devices during setup. You can't keep existing device names. - -## Week of April 15, 2019 - -### Support for Minecraft Education Edition upgrade - Set up School PCs only adds apps to the provisioning package that meet the minimum supported version for Windows 10. For example, Minecraft is the most recent store app to upgrade; it's only installed on devices running Windows 10, version 1709 and later. If you select an earlier version of Windows, Minecraft won't be included in the provisioning package. - -## Week of April 8, 2019 - -### Apps configured as non-removeable -Apps that you deploy with Set up School PCs are configured as non-removable apps. This feature prevents students from unpinning or uninstalling the apps they need. - -### Domain name automatically added during sign-in -Specify your preferred Azure Active Directory tenant domain name to automatically append it to the username on the sign-in screen. With this setting, students don't need to type out long school domain names. To sign in, they type only their unique usernames. - -### Set up devices with hidden Wi-Fi network -Set up devices so that they connect to a hidden Wi-Fi network. To configure a hidden network, open the app. When you get to **Wireless network**, choose **Add a Wi-Fi network**. Enter in your Wi-Fi information and select **Hidden network**. - - -## Week of December 31, 2018 - -### Add Microsoft Whiteboard to provisioning package -Microsoft Whiteboard is now a Microsoft-recommended app for schools. Whiteboard is a freeform digital canvas where ideas, content, and people come together; students can create and collaborate in real time in the classroom. Add the app to your provisioning package on the **Add apps** page. For more information, see [Use Set up School PCs app](use-set-up-school-pcs-app.md#create-the-provisioning-package). - -## Week of November 5, 2018 - -### Sync school app inventory from Microsoft Store -During setup, you can now add apps from your school's Microsoft Store inventory. After you sign in with your school's Office 365 account, Set up School PCs will sync the apps from Microsoft Store, and make them visible on the **Add apps** page. For more information about adding apps, see [Use Set Up School PCs app](use-set-up-school-pcs-app.md#create-the-provisioning-package). - - -## Week of October 15, 2018 - -The Set up School PCs app was updated with the following changes: - -### Three new setup screens added to the app -The following screens and functionality were added to the setup workflow. Select a screen name to view the relevant steps and screenshots in the Set Up School PCs docs. - -* [**Package name**](use-set-up-school-pcs-app.md#package-name): Customize a package name to make it easy to recognize it from your school's other packages. Azure Active Directory generates the name. It appears as the filename, and as the token name in Azure AD in the Azure portal. - -* [**Product key**](use-set-up-school-pcs-app.md#product-key): Enter a product key to upgrade your current edition of Windows 10, or change the existing product key. - -* [**Personalization**](use-set-up-school-pcs-app.md#personalization): Upload images from your computer to customize how the lock screen and background appears on student devices. - -### Azure AD token expiration extended to 180 days -Packages now expire 180 days from the date you create them. - -### Updated apps with more helpful, descriptive text -The **Skip** buttons in the app now communicate the intent of each action. An **Exit** button also appears on the last page of the app. - -### Option to keep existing device names -The [**Name these devices** screen](use-set-up-school-pcs-app.md#device-names) now gives you the option to keep the original or existing names of your student devices. - -### Skype and Messaging apps to be removed from student PCs by default -The Skype and Messaging apps are part of a selection of apps that are, by default, removed from student devices. - - -## Next steps -Learn how to create provisioning packages and set up devices in the app. -* [What's in my provisioning package?](set-up-school-pcs-provisioning-package.md) -* [Set up School PCs technical reference](set-up-school-pcs-technical.md) -* [Set up Windows 10 devices for education](set-up-windows-10.md) - -When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md). \ No newline at end of file diff --git a/education/windows/tutorial-school-deployment/configure-device-settings.md b/education/windows/tutorial-school-deployment/configure-device-settings.md index f9d1d2046f..fc71325532 100644 --- a/education/windows/tutorial-school-deployment/configure-device-settings.md +++ b/education/windows/tutorial-school-deployment/configure-device-settings.md @@ -1,7 +1,7 @@ --- title: Configure and secure devices with Microsoft Intune description: Learn how to configure policies with Microsoft Intune in preparation for device deployment. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- @@ -88,7 +88,7 @@ To create a security policy: - Windows SmartScreen For more information, see [Security][INT-4]. - + > [!NOTE] > If you require more sophisticated security policies, you can create them in Microsoft Intune. For more information: > - [Antivirus][MEM-2] @@ -98,7 +98,7 @@ For more information, see [Security][INT-4]. > - [Attack surface reduction][MEM-6] > - [Account protection][MEM-7] -________________________________________________________ +--- ## Next steps diff --git a/education/windows/tutorial-school-deployment/configure-devices-overview.md b/education/windows/tutorial-school-deployment/configure-devices-overview.md index 667695adba..fa6e5c218a 100644 --- a/education/windows/tutorial-school-deployment/configure-devices-overview.md +++ b/education/windows/tutorial-school-deployment/configure-devices-overview.md @@ -1,7 +1,7 @@ --- title: Configure devices with Microsoft Intune description: Learn how to configure policies and applications in preparation for device deployment. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- diff --git a/education/windows/tutorial-school-deployment/enroll-aadj.md b/education/windows/tutorial-school-deployment/enroll-entra-join.md similarity index 95% rename from education/windows/tutorial-school-deployment/enroll-aadj.md rename to education/windows/tutorial-school-deployment/enroll-entra-join.md index 9cb7370124..e599fca7ac 100644 --- a/education/windows/tutorial-school-deployment/enroll-aadj.md +++ b/education/windows/tutorial-school-deployment/enroll-entra-join.md @@ -1,9 +1,10 @@ --- title: Enrollment in Intune with standard out-of-box experience (OOBE) description: Learn how to join devices to Microsoft Entra ID from OOBE and automatically get them enrolled in Intune. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- + # Automatic Intune enrollment via Microsoft Entra join If you're setting up a Windows device individually, you can use the out-of-box experience to join it to your school's Microsoft Entra tenant, and automatically enroll it in Intune. @@ -21,7 +22,8 @@ With this process, no advance preparation is needed: :::image type="content" source="./images/win11-login-screen.png" alt-text="Windows 11 login screen" border="false"::: -________________________________________________________ +--- + ## Next steps With the devices joined to Microsoft Entra tenant and managed by Intune, you can use Intune to maintain them and report on their status. diff --git a/education/windows/tutorial-school-deployment/enroll-overview.md b/education/windows/tutorial-school-deployment/enroll-overview.md index fa0b05840b..96b10f34cd 100644 --- a/education/windows/tutorial-school-deployment/enroll-overview.md +++ b/education/windows/tutorial-school-deployment/enroll-overview.md @@ -1,7 +1,7 @@ --- title: Device enrollment overview description: Learn about the different options to enroll Windows devices in Microsoft Intune -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: overview --- @@ -24,7 +24,7 @@ Select one of the following options to learn the next steps about the enrollment > [!div class="op_single_selector"] > - [Automatic Intune enrollment via Microsoft Entra join](enroll-aadj.md) > - [Bulk enrollment with provisioning packages](enroll-package.md) -> - [Enroll devices with Windows Autopilot ](enroll-autopilot.md) +> - [Enroll devices with Windows Autopilot](enroll-autopilot.md) diff --git a/education/windows/tutorial-school-deployment/enroll-package.md b/education/windows/tutorial-school-deployment/enroll-package.md index 0223d55bd5..22f7c70443 100644 --- a/education/windows/tutorial-school-deployment/enroll-package.md +++ b/education/windows/tutorial-school-deployment/enroll-package.md @@ -1,7 +1,7 @@ --- title: Enrollment of Windows devices with provisioning packages description: Learn about how to enroll Windows devices with provisioning packages using SUSPCs and Windows Configuration Designer. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- @@ -49,7 +49,8 @@ All settings defined in the package and in Intune will be applied to the device, :::image type="content" source="./images/win11-oobe-ppkg.gif" alt-text="Windows 11 OOBE - enrollment with provisioning package animation." border="false"::: -________________________________________________________ +--- + ## Next steps With the devices joined to Microsoft Entra tenant and managed by Intune, you can use Intune to maintain them and report on their status. diff --git a/education/windows/tutorial-school-deployment/index.md b/education/windows/tutorial-school-deployment/index.md index a5a1998f71..a5fd6fd8da 100644 --- a/education/windows/tutorial-school-deployment/index.md +++ b/education/windows/tutorial-school-deployment/index.md @@ -1,7 +1,7 @@ --- title: Introduction to the tutorial deploy and manage Windows devices in a school description: Introduction to deployment and management of Windows devices in education environments. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- @@ -60,7 +60,8 @@ In the remainder of this document, we'll discuss the key concepts and benefits o - **Device enrollment:** Setting up Windows devices for deployment and enrolling them in Intune for Education - **Device reset:** Resetting managed devices with Intune for Education -________________________________________________________ +--- + ## Next steps Let's begin with the creation and configuration of your Microsoft Entra tenant and Intune environment. diff --git a/education/windows/tutorial-school-deployment/manage-overview.md b/education/windows/tutorial-school-deployment/manage-overview.md index ff0997fad9..0a51b174b9 100644 --- a/education/windows/tutorial-school-deployment/manage-overview.md +++ b/education/windows/tutorial-school-deployment/manage-overview.md @@ -1,7 +1,7 @@ --- title: Manage devices with Microsoft Intune description: Overview of device management capabilities in Intune for Education, including remote actions, remote assistance and inventory/reporting. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- diff --git a/education/windows/tutorial-school-deployment/manage-surface-devices.md b/education/windows/tutorial-school-deployment/manage-surface-devices.md index 94efd0d46b..028dc739c7 100644 --- a/education/windows/tutorial-school-deployment/manage-surface-devices.md +++ b/education/windows/tutorial-school-deployment/manage-surface-devices.md @@ -1,7 +1,7 @@ --- title: Management functionalities for Surface devices description: Learn about the management capabilities offered to Surface devices, including firmware management and the Surface Management Portal. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial appliesto: - ✅ Surface devices @@ -9,7 +9,7 @@ appliesto: # Management functionalities for Surface devices -Microsoft Surface devices offer many advanced management functionalities, including the possibility to manage firmware settings and a web portal designed for them. +Microsoft Surface devices offer advanced management functionalities, including the possibility to manage firmware settings and a web portal designed for them. ## Manage device firmware for Surface devices @@ -27,20 +27,18 @@ When Surface devices are enrolled in cloud management and users sign in for the To access and use the Surface Management Portal: -1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -2. Select **All services** > **Surface Management Portal** +1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. Select **All services** > **Surface Management Portal** :::image type="content" source="./images/surface-management-portal.png" alt-text="Surface Management Portal within Microsoft Intune" lightbox="./images/surface-management-portal-expanded.png" border="true"::: -3. To obtain insights for all your Surface devices, select **Monitor** +1. To obtain insights for all your Surface devices, select **Monitor** - Devices that are out of compliance or not registered, have critically low storage, require updates, or are currently inactive, are listed here -4. To obtain details on each insights category, select **View report** +1. To obtain details on each insights category, select **View report** - This dashboard displays diagnostic information that you can customize and export -5. To obtain the device's warranty information, select **Device warranty and coverage** -6. To review a list of support requests and their status, select **Support requests** +1. To obtain the device's warranty information, select **Device warranty and coverage** +1. To review a list of support requests and their status, select **Support requests** [INT-1]: /intune/configuration/device-firmware-configuration-interface-windows - [MEM-1]: /mem/autopilot/dfci-management - [SURF-1]: /surface/surface-manage-dfci-guide diff --git a/education/windows/tutorial-school-deployment/reset-wipe.md b/education/windows/tutorial-school-deployment/reset-wipe.md index 1d0edf123a..9646537bac 100644 --- a/education/windows/tutorial-school-deployment/reset-wipe.md +++ b/education/windows/tutorial-school-deployment/reset-wipe.md @@ -1,7 +1,7 @@ --- title: Reset and wipe Windows devices description: Learn about the reset and wipe options for Windows devices using Intune for Education, including scenarios when to delete devices. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- @@ -104,6 +104,7 @@ Repairing Autopilot-enrolled devices can be complex, as OEM requirements must be For more information, see [Autopilot motherboard replacement scenario guidance][MEM-4]. + [MEM-1]: /mem/intune/remote-actions/devices-wipe#delete-devices-from-the-intune-portal [MEM-2]: /mem/intune/remote-actions/devices-wipe#delete-devices-from-the-intune-portal [MEM-3]: /mem/intune/remote-actions/devices-wipe#delete-devices-from-the-azure-active-directory-portal diff --git a/education/windows/tutorial-school-deployment/set-up-azure-ad.md b/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md similarity index 99% rename from education/windows/tutorial-school-deployment/set-up-azure-ad.md rename to education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md index cbfcfae2b5..b1ab1cfc12 100644 --- a/education/windows/tutorial-school-deployment/set-up-azure-ad.md +++ b/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id.md @@ -1,7 +1,7 @@ --- title: Set up Microsoft Entra ID description: Learn how to create and prepare your Microsoft Entra tenant for an education environment. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial appliesto: --- @@ -86,6 +86,7 @@ There are two options for adding users manually, either individually or in bulk: - Select **Microsoft Entra ID** > **Users** > **All users** > **Bulk operations** > **Bulk create** For more information, see [Add multiple users in the Microsoft 365 admin center][M365-4]. + ### Create groups Creating groups is important to simplify multiple tasks, like assigning licenses, delegating administration, deploy settings, applications or to distribute assignments to students. To create groups: @@ -143,7 +144,7 @@ To allow provisioning packages to complete the Microsoft Entra join process: 1. Select Save :::image type="content" source="images/entra-device-settings.png" alt-text="Configure device settings from Microsoft Entra admin center." lightbox="images/entra-device-settings.png"::: -________________________________________________________ +--- ## Next steps diff --git a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md index f55a5262c3..38dc58b276 100644 --- a/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md +++ b/education/windows/tutorial-school-deployment/set-up-microsoft-intune.md @@ -1,7 +1,7 @@ --- title: Set up device management description: Learn how to configure the Intune service and set up the environment for education. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial appliesto: --- @@ -74,7 +74,7 @@ To disable Windows Hello for Business at the tenant level: For more information how to enable Windows Hello for Business on specific devices, see [Create a Windows Hello for Business policy][MEM-4]. -________________________________________________________ +--- ## Next steps diff --git a/education/windows/tutorial-school-deployment/toc.yml b/education/windows/tutorial-school-deployment/toc.yml index a332eb8656..8abc013f68 100644 --- a/education/windows/tutorial-school-deployment/toc.yml +++ b/education/windows/tutorial-school-deployment/toc.yml @@ -4,7 +4,7 @@ items: - name: 1. Prepare your tenant items: - name: Set up Microsoft Entra ID - href: set-up-azure-ad.md + href: set-up-microsoft-entra-id.md - name: Set up Microsoft Intune href: set-up-microsoft-intune.md - name: 2. Configure settings and applications @@ -20,7 +20,7 @@ items: - name: Overview href: enroll-overview.md - name: Enroll devices via Microsoft Entra join - href: enroll-aadj.md + href: enroll-entra-join.md - name: Enroll devices with provisioning packages href: enroll-package.md - name: Enroll devices with Windows Autopilot diff --git a/education/windows/tutorial-school-deployment/troubleshoot-overview.md b/education/windows/tutorial-school-deployment/troubleshoot-overview.md index 5e27915802..0d59f1af56 100644 --- a/education/windows/tutorial-school-deployment/troubleshoot-overview.md +++ b/education/windows/tutorial-school-deployment/troubleshoot-overview.md @@ -1,7 +1,7 @@ --- title: Troubleshoot Windows devices description: Learn how to troubleshoot Windows devices from Intune and contact Microsoft Support for issues related to Intune and other services. -ms.date: 08/31/2022 +ms.date: 11/09/2023 ms.topic: tutorial --- @@ -25,10 +25,9 @@ Here's a collection of resources to help you troubleshoot Windows devices manage Microsoft provides global technical, pre-sales, billing, and subscription support for cloud-based device management services. This support includes Microsoft Intune, Configuration Manager, Windows 365, and Microsoft Managed Desktop. -Follow these steps to obtain support in Microsoft Intune provides many tools that can help you troubleshoot Windows devices. -: +Follow these steps to obtain support in Microsoft Intune provides many tools that can help you troubleshoot Windows devices: -- Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +- Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) - Select **Troubleshooting + support** > **Help and support** :::image type="content" source="images/advanced-support.png" alt-text="Screenshot that shows how to obtain support from Microsoft Intune." lightbox="images/advanced-support.png"::: - Select the required support scenario: Configuration Manager, Intune, Co-management, or Windows 365 diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index f9a55de678..2689df63e5 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -2,88 +2,90 @@ title: Use Set up School PCs app description: Learn how to use the Set up School PCs app and apply the provisioning package. ms.topic: how-to -ms.date: 08/10/2022 +ms.date: 11/09/2023 appliesto: - ✅ Windows 10 --- + # Use the Set up School PCs app -IT administrators and technical teachers can use the **Set up School PCs** app to quickly set up Windows 10 PCs for students. The app configures PCs with the apps and features students need, and it removes the ones they don't need. During setup, if licensed in your tenant, the app enrolls each student PC into a mobile device management (MDM) provider, such as Intune for Education. You can then manage all the settings the app configures through the MDM. +IT administrators and technical teachers can use the **Set up School PCs** app to quickly set up Windows devices for students. The app configures devices with the apps and features students need, and it removes the ones they don't need. During setup, if licensed in your tenant, the app enrolls each student device in Microsoft Intune. You can then manage all the settings the app configures through Intune. -Set up School PCs also: -* Joins each student PC to your organization's Office 365 and Microsoft Entra tenant. -* Enables the optional Autopilot Reset feature, to return devices to a fully configured or known IT-approved state. -* Utilizes Windows Update and maintenance hours to keep student PCs up-to-date, without interfering with class time. -* Locks down the student PC to prevent activity that isn't beneficial to their education. +With Set up School PCs you can: -This article describes how to fill out your school's information in the Set up School PCs app. To learn more about the app's functionality, start with the [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md). +- Joins student devices to your organization's Microsoft Entra tenant +- Enable the optional Autopilot Reset feature, to return devices to a fully configured or known IT-approved state +- Use Windows Update and maintenance hours to keep student devices up-to-date, without interfering with class time +- Lock down student devices to prevent activity that aren't beneficial to their education -## Requirements -Before you begin, make sure that you, your computer, and your school's network are configured with the following requirements. +This article describes how to use the Set up School PCs app. To learn more about the app's functionality, review the [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md). -* Office 365 and Microsoft Entra ID -* [Latest Set up School PCs app](https://www.microsoft.com/store/apps/9nblggh4ls40) -* A NTFS-formatted USB drive that is at least 1 GB, if not installing Office; and at least 8 GB, if installing Office -* Student PCs must either: - * Be within range of the Wi-Fi network that you configured in the app. - * Have a wired Ethernet connection when you set them up. +## Requirements -### Configure USB drive for additional space -USB drives are, by default, FAT32-formatted, and are unable to save more than 4 GB of data. If you plan to install several apps, or large apps like Microsoft Office, you'll need more space. To create more space on the USB drive, reformat it to NTFS. -1. Insert the USB drive into your computer. -2. Go to the **Start** > **This PC**. -3. In the **Devices and drives** section, find your USB drive. Right-click to see its options. -4. Select **Format** from the list to bring up the **Format drive name** window. -5. Set **File system** to **NTFS**. -6. Click **Start** to format the drive. +Before you begin, make sure that your devices and your school's network are configured with the following requirements: -### Prepare existing PC account for new setup -Apply new packages to factory reset or new PCs. If you apply it to a PC that's already set up, you may lose the accounts and data. +- Microsoft Entra ID and Microsoft 365 licenses +- [Latest Set up School PCs app](https://apps.microsoft.com/detail/9NBLGGH4LS40) +- A NTFS-formatted USB drive that is at least 1 GB +- Student devices must either: + - Be within range of the Wi-Fi network that you configured in the app + - Have a wired Ethernet connection when you set them up -If a PC has already been set up, and you want to apply a new package, reset the PC to a clean state. +### Prepare existing PC account for new setup -To begin, go to the **Settings** app on the appropriate PC. -1. Click **Update & Security** > **Recovery**. -2. In the **Reset this PC** section, click **Get started**. -3. Click **Remove everything**. +Apply new packages to factory reset or new devices. If you apply it to a device that's already set up, you may lose the accounts and data. -You can also go to **Start** > **Power** icon. Hold down the Shift key and click **Restart** to load the Windows boot user experience. From there, follow these steps: -1. Click **Troubleshoot** and then choose **Reset this PC**. -2. Select **Remove everything**. -3. If the option appears, select **Only the drive where Windows is installed**. -4. Click **Just remove my files**. -5. Click **Reset**. +If a device is already set up, and you want to apply a new package, reset the device to a clean state. To reset a device, follow these steps: -## Recommendations -This section offers recommendations to prepare you for the best possible setup experience. -### Run the same Windows 10 build on the admin device and the student PCs -We recommend you run the IT administrator or technical teacher's device on the same Windows 10 build as the student PCs. +1. Open the **Settings** app on target device +1. Select **Update & Security** > **Recovery** +1. In the **Reset this PC** section, select **Get started** +1. Select **Remove everything** -### Student PCs should meet OS requirements for the app -Check the OS requirements in the Set up School PCs app. We recommend using the latest Set up School PCs app along with the latest Windows 10 images on the student PCs. +Alternatively, you can also select **Start** > **Power** icon. Hold down Shift while selecting **Restart** to load the Windows boot user experience: -To check the app's OS requirements, go to the Microsoft Store and locate the Set up School PCs app. In the app's description, go to **System Requirements > OS**. +1. Select **Troubleshoot** > **Reset this PC** +1. Select **Remove everything** +1. If the option appears, select **Only the drive where Windows is installed** +1. Select **Just remove my files** +1. Select **Reset** + +## Recommendations + +This section offers recommendations to prepare you for the best possible setup experience. + +### Run the same Windows uild on the admin device and the student devices + +We recommend you run the IT administrator or technical teacher's device on the same Windows build as the student devices. + +### Student devices must meet OS requirements for the app + +Check the OS requirements in the Set up School PCs app. We recommend using the latest Set up School PCs app along with the latest Windows images on the student devices. + +To check the app's OS requirements, go to the Microsoft Store and locate the Set up School PCs app. In the app's description, go to **System Requirements** > **OS**. ### Use app on a PC that is connected to your school's network + We recommend that you run the Set up School PCs app on a computer that's connected to your school's network. That way the app can gather accurate information about your school's wireless networks and cloud subscriptions. If it's not connected, you'll need to enter the information manually. - > [!NOTE] - > Don't use the **Set up Schools PCs** app for PCs that must connect to: - >* Enterprise networks that require the user to accept Terms of Use. - >* Open Wi-Fi networks that require the user to accept Terms of Use. +>[!NOTE] +>Don't use the **Set up Schools PCs** app for devices that must connect to enterprise or open Wi-Fi networds that require the user to accept Terms of Use. ### Run app on an open network or network that requires a basic password -Don't use Set up School PCs over a certification-based network, or one where you have to enter credentials in a browser. If you need to set up many devices over Wi-Fi, make sure that your network configuration can support it. -We recommend that you: -* Configure your DHCP so at least 200 IP addresses are available for your devices. Having available IP addresses will allow you to set up many devices simultaneously. -* Configure your IP addresses to expire after a short time--about 30 minutes. IP addresses will free up quickly so you can continue to set up devices without network issues. +Don't use Set up School PCs over a certificate-based network, or one where you have to enter credentials in a browser. If you need to set up many devices over Wi-Fi, make sure that your network configuration can support it. -> > [!WARNING] -> > Only use the provisioning package on PCs that you want to configure and lock down for students. After you apply the provisioning package to a student PC, the PC must be reset to remove the settings. +We recommend that you: -### Use an additional USB drive -To set up more than one PC at the same time, save the provisioning package to additional USB drives. Then plug the USBs in at the same time during setup. +- Configure your DHCP so at least 200 IP addresses are available for your devices. Having available IP addresses will allow you to set up many devices simultaneously +- Configure your IP addresses to expire after a short time, for example 30 minutes. IP addresses will free up quickly so you can continue to set up devices without network issues. + +>[!WARNING] +>Only use the provisioning package on devices that you want to configure and lock down for students. After you apply the provisioning package to a student device, the PC must be reset to remove the settings. + +### Use an additional USB drive + +To set up more than one PC at the same time, save the provisioning package to additional USB drives. Then plug the USBs in at the same time during setup. ### Limit changes to school-optimized settings @@ -91,191 +93,172 @@ We strongly recommend that you avoid changing preset policies. Changes can slow ## Create the provisioning package -The **Set up School PCs** app guides you through the configuration choices for the student PCs. To begin, open the app on your PC and click **Get started**. - - ![Launch the Set up School PCs app.](images/suspcs/suspc_getstarted_050817.png) +The **Set up School PCs** app guides you through the configuration choices for the student PCs. To begin, open the app on your device and select **Get started**. + +![Launch the Set up School PCs app.](images/suspcs/suspc_getstarted_050817.png) + +### Package name -### Package name Type a unique name to help distinguish your school's provisioning packages. The name appears: -* On the local package folder -* In your tenant's Microsoft Entra account in the Azure portal +- On the local package folder +- In your tenant's Microsoft Entra account in the Azure portal -A package expiration date is also attached to the end of each package. For example, *Set_Up_School_PCs (Expires 4-16-2019)*. The expiration date is 180 days after you create your package. +A package expiration date is also attached to the end of each package. For example, *Set_Up_School_PCs (Expires 1-1-2024)*. The expiration date is 180 days after you create your package. ![Example screenshot of the Set up School PCs app, Name your package screen.](images/suspcs/1810_Name_Your_Package_SUSPC.png) -After you click **Next**, you can no longer change the name in the app. To create a package with a different name, reopen the Set up School PCs app. +After you select **Next**, you can no longer change the name in the app. To create a package with a different name, reopen the Set up School PCs app. To change an existing package's name, right-click the package folder on your device and select **Rename**. This action does not change the name in Microsoft Entra ID. If you have Global Admin permissions, you can go to Microsoft Entra ID in the Azure portal, and rename the package there. - ### Sign in -1. Select how you want to sign in. - a. (Recommended) To enable student PCs to automatically be connect to Office 365, Microsoft Entra ID, and management services like Intune for Education, click **Sign-in**. Then go to step 3. - b. To complete setup without signing in, click **Continue without account**. Student PCs won't be connected to your school's cloud services and managing them will be more difficult later. Continue to [Wireless network](#wireless-network). -2. In the new window, select the account you want to use throughout setup. +1. Select how you want to sign in + 1. (Recommended) To enable student device to automatically connect and authenticate to Microsoft Entra ID, and management services like Microsoft Intune, select **Sign-in**. Then go to step 3 + 1. To complete setup without signing in, select **Continue without account**. Student devices won't connect to your school's cloud services and their management will be more difficult later. Continue to [Wireless network](#wireless-network) +1. In the new window, select the account you want to use throughout setup. ![Sign-in screen showing the option to "Use this account" or use a different "Work or school account."](images/suspcs/1810_choose_account_suspc.png) To add an account not listed: - a. Click **Work or school account** > **Continue**. - b. Type in the account username and click **Next**. - c. Verify the user account and password, if prompted. + 1. Select **Work or school account** > **Continue**. + 1. Type in the account username and select **Next**. + 1. Verify the user account and password, if prompted. - -3. Click **Accept** to allow Set up School PCs to access your account throughout setup. -2. When your account name appears on the page, as shown in the image below, click **Next.** +1. Select **Accept** to allow Set up School PCs to access your account throughout setup +1. When your account name appears on the page, select **Next** ![Example screenshot of the Set up School PC app, Sign in screen, showing that the user's account name appears at the bottom of the page.](images/suspcs/1810_Sign_In_SUSPC.png) ### Wireless network -Add and save the wireless network profile that you want student PCs to connect to. Only skip Wi-Fi setup if you have an Ethernet connection. -Select your school's Wi-Fi network from the list of available wireless networks, or click **Add a wireless network** to manually configure it. Then click **Next.** +Add and save the wireless network profile that you want student devices to connect to. Only skip Wi-Fi setup if you have an Ethernet connection. + +Select your organization's Wi-Fi network from the list of available wireless networks, or select **Add a wireless network** to manually configure it. Then select **Next** ![Example screenshot of the Set up School PC app, Wireless network page with two Wi-Fi networks listed, one of which is selected.](images/suspcs/1810_SUSPC_select_Wifi.png) ### Device names -Create a short name to add as a prefix to each PC. This name will help you recognize and manage this specific group of devices in your mobile device manager. The name must be five (5) characters or less. -To make sure all device names are unique, Set up School PCs automatically appends `_%SERIAL%` to the name. For example, if you add *Math4* as the prefix, the device names will appear as *Math4* followed by a random string of letters and numbers. +Create a name to add as a prefix to each device. This name will help you recognize and manage this group of devices in Intune. -To keep the default name for your devices, click **Continue with existing names**. +To make sure all device names are unique, Set up School PCs automatically appends `_%SERIAL%` to the name. For example, if you add *MATH4* as the prefix, the device names will appear as *MATH4* followed by the device serial number. + +To keep the default name for your devices, select **Continue with existing names**. !["Name these devices" screen with the device field filled in with example device name, "Grd8."](images/suspcs/1810_name-devices_SUSPC.png) - - ### Settings -Select additional settings to include in the provisioning package. To begin, select the operating system on your student PCs. + +Select additional settings to include in the provisioning package. To begin, select the operating system on your student PCs. ![Screenshot of the Current OS version page with the Select OS version menu selected, showing 7 Windows 10 options. All other settings on page are unavailable to select.](images/suspcs/1810_suspc_settings.png) -Setting selections vary based on the OS version you select. The example screenshot below shows the settings that become available when you select **Windows 10 version 1703**. The option to **Enable Autopilot Reset** is not available for this version of Windows 10. - +Setting selections vary based on the OS version you select. ![Example screenshot of the Current OS version page, with Windows 10 version 1803 selected. 4 available settings and 1 unavailable setting are shown, and none are selected.](images/suspcs/1810_SUSPC_available_settings.png) +The following table describes each setting and lists the applicable Windows 10 versions. To find out if a setting is available in your version of Windows 10, look for an *X* in the setting row and in the version column. -> [!NOTE] -> The [**Time zone** setting](use-set-up-school-pcs-app.md#time-zone), shown in the sidebar of the screenshot above, is not made available to versions of Windows 10 in S mode. If you select a version in S mode, **Time zone** will become disabled. +| Setting | What happens if I select it? | Note | +|--|--|--| +| Remove apps pre-installed by the device manufacturer | Uninstalls apps that came loaded on the computer by the device's manufacturer. | Adds about 30 minutes to the provisioning process. | +| Allow local storage (not recommended for shared devices) | Lets students save files to the Desktop and Documents folder on the Student PC. | Not recommended if the device will be shared between different students. | +| Optimize device for a single student, instead of a shared cart or lab | Optimizes the device for use by a single student, rather than many students. | Recommended if the device will be shared between different students. Single-optimized accounts are set to expire, and require a sign-in, 180 days after setup. This setting increases the maximum PC storage to 100% of the available disk space. In this case, student accounts aren't deleted unless the account has been inactive for 180 days. | +| Let guests sign in to these PCs | Allows guests to use student PCs without a school account. | Common to use within a public, shared space, such as a library. Also used when a student loses their password. Adds a **Guest** account to the PC sign-in screen that anyone can sign in to. | +| Enable Autopilot Reset | Lets you remotely reset a student's PC from the lock screen, apply the device's original settings, and enroll it in device management (Microsoft Entra ID and MDM). | Requires Windows 10, version 1709 and WinRE must be enabled on the PC. Setup will fail if both requirements aren't met. | +| Lock screen background | Change the default screen lock background to a custom image. | Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. | | -The following table describes each setting and lists the applicable Windows 10 versions. To find out if a setting is available in your version of Windows 10, look for an *X* in the setting row and in the version column. - -|Setting |1703|1709|1803|1809|What happens if I select it? |Note| -|---------|---------|---------|---------|---------|---------|---------| -|Remove apps pre-installed by the device manufacturer |X|X|X|X| Uninstalls apps that came loaded on the computer by the device's manufacturer. |Adds about 30 minutes to the provisioning process.| -|Allow local storage (not recommended for shared devices) |X|X|X|X| Lets students save files to the Desktop and Documents folder on the Student PC. |Not recommended if the device will be shared between different students.| -|Optimize device for a single student, instead of a shared cart or lab |X|X|X|X|Optimizes the device for use by a single student, rather than many students. |Recommended if the device will be shared between different students. Single-optimized accounts are set to expire, and require a sign-in, 180 days after setup. This setting increases the maximum PC storage to 100% of the available disk space. In this case, student accounts aren't deleted unless the account has been inactive for 180 days. | -|Let guests sign in to these PCs |X|X|X|X|Allows guests to use student PCs without a school account. |Common to use within a public, shared space, such as a library. Also used when a student loses their password. Adds a **Guest** account to the PC sign-in screen that anyone can sign in to.| -|Enable Autopilot Reset |Not available|X|X|X|Lets you remotely reset a student's PC from the lock screen, apply the device's original settings, and enroll it in device management (Microsoft Entra ID and MDM). |Requires Windows 10, version 1709 and WinRE must be enabled on the PC. Setup will fail if both requirements aren't met.| -|Lock screen background|X|X|X|X|Change the default screen lock background to a custom image.|Click **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png.| - -After you've made your selections, click **Next**. +After you've made your selections, select **Next**. ### Time zone > [!WARNING] > If you are using the Autounattend.xml file to reimage your school PCs, do not specify a time zone in the file. If you set the time zone in the file *and* in this app, you will encounter an error. -Choose the time zone where your school's PCs are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, click **Next**. +Choose the time zone where your school's devices are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, click **Next**. ![Choose PC time zone page with the time zone menu expanded to show all time zone selections.](images/suspcs/1810_suspc_timezone.png) -### Product key -Optionally, type in a 25-digit product key to: -* Upgrade your current edition of Windows. For example, if you want to upgrade from Windows 10 Education to Windows 10 Education Pro, enter the product key for the Pro edition. -* Change the product key. If you want to associate student devices with a new or different Windows 10 product key, enter it now. +### Product key + +Optionally, type in a 25-digit product key to upgrade or change the edition of Windows on your student devices. If you don't have a product key, select **Continue without change**. ![Example screenshot of the Set up School PC app, Product key screen, showing a value field, Next button, and Continue without change option.](images/suspcs/1810_suspc_product_key.png) -### Take a Test -Set up the Take a Test app to give online quizzes and high-stakes assessments. During assessments, Windows locks down the student PC so that students can't access anything else on the device. +### Take a Test -1. Select **Yes** to create a Take a Test button on the sign-in screens of your students' PCs. +Set up the Take a Test app to give online quizzes and high-stakes assessments. During assessments, Windows locks down the student devices so that students can't access anything else on the device. - ![Set up Take a Test app page with "Yes" selected to create an app button. Page also has two checkboxes for additional settings and one text field for the assessment URL.](images/suspcs/1810_SUSPC_Take_Test.png) +1. Select **Yes** to create a Take a Test button on the sign-in screens of your students' devices -2. Select from the advanced settings. Available settings include: - * Allow keyboard auto-suggestions: Allows app to suggest words as the student types on the PC's keyboard. - * Allow teachers to monitor online tests: Enables screen capture in the Take a Test app. -3. Enter the URL where the test is hosted. When students log in to the Take a Test account, they'll be able to click or enter the link to view the assessment. -4. Click **Next**. + ![Set up Take a Test app page with "Yes" selected to create an app button. Page also has two checkboxes for additional settings and one text field for the assessment URL.](images/suspcs/1810_SUSPC_Take_Test.png) -### Add apps -Choose from Microsoft recommended apps and your school's own Microsoft Store inventory. The apps you select here are added to the provisioning package and installed on student PCs. After they're assigned, apps are pinned to the device's Start menu. +1. Select from the advanced settings. Available settings include: + - Allow keyboard auto-suggestions: Allows app to suggest words as the student types on the device's keyboard + - Allow teachers to monitor online tests: Enables screen capture in the Take a Test app +1. Enter the URL where the test is hosted. When students log in to the Take a Test account, they'll be able to select or enter the link to view the assessment +1. Select **Next** -If there aren't any apps in your Microsoft Store inventory, or you don't have the permissions to add apps, you'll need to contact your school admin for help. If you receive a message that you can't add the selected apps, click **Continue without apps**. Contact your school admin to get these apps later. +### Personalization -After you've made your selections, click **Next**. +Upload custom images to replace the student devices' default desktop and lock screen backgrounds. Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. +If you don't want to upload custom images or use the images that appear in the app, select **Continue without personalization**. This option does not apply any customizations, and instead uses the devices' default or preset images. - ![Example screenshots of the Add apps screen with selection of recommended apps and school inventory apps.](images/suspcs/1812_Add_Apps_SUSPC.png) +![Example image of the Set up School PCs app, Personalization screen, showing the default desktop and lock screen background photos, a Browse button under each photo, a blue Next button, and a Continue without personalization button.](images/suspcs/1810_SUSPC_personalization.png) -The following table lists the recommended apps you'll see. +### Summary -|App |Note | -|---------|---------| -|Office 365 for Windows 10 in S mode (Education Preview) | Setup is only successful on student PCs that run Windows 10 in S mode. The PC you running the Set up School PCs app is not required to have Windows 10 in S mode. | -|Microsoft Whiteboard | None| -|Minecraft: Education Edition | Free trial| +Review all of the settings for accuracy and completeness +1. To make changes now, select any page along the left side of the window +2. When finished, select **Accept** +![Example image of the Summary screen, showing the user's configurations for Sign-in, Wireless network, Device names, Settings, Time zone, Take a Test. Accept button is available and the page contains three links on the right-hand side to help and support.](images/suspcs/1810_SUSPC_summary.png) -### Personalization -Upload custom images to replace the student devices' default desktop and lock screen backgrounds. Click **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. - -If you don't want to upload custom images or use the images that appear in the app, click **Continue without personalization**. This option does not apply any customizations, and instead uses the devices' default or preset images. - - ![Example image of the Set up School PCs app, Personalization screen, showing the default desktop and lock screen background photos, a Browse button under each photo, a blue Next button, and a Continue without personalization button.](images/suspcs/1810_SUSPC_personalization.png) - - -### Summary -Review all of the settings for accuracy and completeness. Check carefully. To make changes to a saved package, you have to start over. -1. To make changes now, click any page along the left side of the window. -2. When finished, click **Accept**. - - ![Example image of the Summary screen, showing the user's configurations for Sign-in, Wireless network, Device names, Settings, Time zone, Take a Test. Accept button is available and the page contains three links on the right-hand side to help and support.](images/suspcs/1810_SUSPC_summary.png) +> [!NOTE] +> To make changes to a saved package, you have to start over. ### Insert USB -1. Insert a USB drive. The **Save** button will light up when your computer detects the USB. -2. Choose your USB drive from the list and click **Save**. - ![Insert a USB drive now screen with USB drive selection highlighted. Save button is blue and active.](images/suspcs/1810_SUSPC_USB.png) +1. Insert a USB drive. The **Save** button will light up when your computer detects the USB +1. Choose your USB drive from the list and select **Save** -3. When the package is ready, you'll see the filename and package expiration date. You can also click **Add a USB** to save the same provisioning package to another USB drive. When you're done, remove the USB drive and click **Next**. + ![Insert a USB drive now screen with USB drive selection highlighted. Save button is blue and active.](images/suspcs/1810_SUSPC_USB.png) - ![Your provisioning package is ready screen with package filename and expiration date. Shows an active blue, Next button, and a gray Add a USB button.](images/suspcs/1810_SUSPC_Package_ready.png) +1. When the package is ready, you'll see the filename and package expiration date. You can also select **Add a USB** to save the same provisioning package to another USB drive. When you're done, remove the USB drive and select **Next** -## Run package - Get PCs ready -Complete each step on the **Get PCs ready** page to prepare student PCs for set-up. Then click **Next**. - - ![Your provisioning package is ready! screen with 3 steps to get student PCs ready for setup. Save button is active.](images/suspcs/suspc_runpackage_getpcsready.png) +![Your provisioning package is ready screen with package filename and expiration date. Shows an active blue, Next button, and a gray Add a USB button.](images/suspcs/1810_SUSPC_Package_ready.png) + +## Run package - Get PCs ready + +Complete each step on the **Get PCs ready** page to prepare student devices for set-up. Then select **Next**. + +![Your provisioning package is ready! screen with 3 steps to get student devices ready for setup. Save button is active.](images/suspcs/suspc_runpackage_getpcsready.png) ## Run package - Install package on PC -The provisioning package on your USB drive is named SetupSchoolPCs_<*devicename*>(Expires <*expiration date*>.ppkg. A provisioning package applies settings to Windows 10 without reimaging the device. +The provisioning package on your USB drive is named SetupSchoolPCs_<*devicename*>(Expires <*expiration date*>.ppkg. A provisioning package applies settings to Windows without reimaging the device. -When used in context of the Set up School PCs app, the word *package* refers to your provisioning package. The word *provisioning* refers to the act of installing the package on the student PC. This section describes how to apply the settings to a PC in your school. +When used in context of the Set up School PCs app, the word *package* refers to your provisioning package. The word *provisioning* refers to the act of installing the package on the student device. This section describes how to apply the settings to a device in your school. > [!IMPORTANT] -> The PC must have a new or reset Windows 10 image and must not already have been through first-run setup (also referred to as OOBE). For instructions about how to reset a computer's image, see [Prepare existing PC account for new setup](use-set-up-school-pcs-app.md#prepare-existing-pc-account-for-new-setup). +> The devices must have a new or reset Windows image and must not already have been through first-run setup experience (which is referred to as *OOBE*). For instructions about how to reset a devices's image, see [Prepare existing PC account for new setup](use-set-up-school-pcs-app.md#prepare-existing-pc-account-for-new-setup). -1. Start with the student PC turned off or with the PC on the first-run setup screen. In Windows 10 version 1803, the first-run setup screen reads, **Let's start with region. Is this right?** +1. Start with the student device turned off or with the device on the first-run setup screen. If the PC has gone past the account setup screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC** - If the PC has gone past the account setup screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - - ![Example screenshot of the first screen the Windows 10 PC setup for OOBE. United States is selected as the region and the Yes button is active.](images/suspcs/win10_1703_oobe_firstscreen.png) + ![Example screenshot of the first screen the Windows 10 PC setup for OOBE. United States is selected as the region and the Yes button is active.](images/suspcs/win10_1703_oobe_firstscreen.png) -2. Insert the USB drive. Windows automatically recognizes and installs the package. - - ![Screen showing that the installation is automatically beginning, with a loading bar showing the status on the installation.](images/suspcs/suspc_studentpcsetup_installingsetupfile.png) -3. When you receive the message that it's okay to remove the USB drive, remove it from the PC. If there are more PCs to set up, insert the USB drive into the next PC. +1. Insert the USB drive. Windows automatically recognizes and installs the package + + ![Screen showing that the installation is automatically beginning, with a loading bar showing the status on the installation.](images/suspcs/suspc_studentpcsetup_installingsetupfile.png) + +1. When you receive the message that it's okay to remove the USB drive, remove it from the device. If there are more devices to set up, insert the USB drive into the next one ![Screen with message telling user to remove the USB drive.](images/suspcs/suspc_setup_removemediamessage.png) -4. If you didn't set up the package with Microsoft Entra join, continue the Windows device setup experience. If you did configure the package with Microsoft Entra join, the computer is ready for use and no further configurations are required. +1. If you didn't set up the package with Microsoft Entra join, continue the Windows device setup experience. If you did configure the package with Microsoft Entra join, the device is ready for use and no further configurations are required - If successful, you'll see a setup complete message. The PCs start up on the lock screen, with your school's custom background. Upon first use, students and teachers can connect to your school's network and resources. +If successful, you'll see a setup complete message. The PCs start up on the lock screen, with your school's custom background. Upon first use, students and teachers can connect to your school's network and resources. From e1a74147d19c4a6041df2a0f5bfe8459e077362f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 9 Nov 2023 16:57:15 -0500 Subject: [PATCH 088/237] updates --- .openpublishing.redirection.education.json | 8 ++--- .../enroll-overview.md | 2 +- .../tutorial-school-deployment/index.md | 2 +- .../windows/use-set-up-school-pcs-app.md | 36 +++++++++---------- 4 files changed, 24 insertions(+), 24 deletions(-) diff --git a/.openpublishing.redirection.education.json b/.openpublishing.redirection.education.json index 11fc9cd312..9b57ae9f30 100644 --- a/.openpublishing.redirection.education.json +++ b/.openpublishing.redirection.education.json @@ -161,13 +161,13 @@ "redirect_document_id": false }, { - "source_path": "education/windows/enroll-aadj.md", - "redirect_url": "/education/windows/enroll-entra-join", + "source_path": "education/windows/tutorial-school-deployment/enroll-aadj.md", + "redirect_url": "/education/windows/tutorial-school-deployment/enroll-entra-join", "redirect_document_id": false }, { - "source_path": "education/windows/set-up-azure-ad.md", - "redirect_url": "/education/windows/set-up-microsoft-entra-id", + "source_path": "education/windows/tutorial-school-deployment/set-up-azure-ad.md", + "redirect_url": "/education/windows/tutorial-school-deployment/set-up-microsoft-entra-id", "redirect_document_id": false }, { diff --git a/education/windows/tutorial-school-deployment/enroll-overview.md b/education/windows/tutorial-school-deployment/enroll-overview.md index 96b10f34cd..8410be0db9 100644 --- a/education/windows/tutorial-school-deployment/enroll-overview.md +++ b/education/windows/tutorial-school-deployment/enroll-overview.md @@ -22,7 +22,7 @@ This [table][INT-1] describes the ideal scenarios for using either option. It's Select one of the following options to learn the next steps about the enrollment method you chose: > [!div class="op_single_selector"] -> - [Automatic Intune enrollment via Microsoft Entra join](enroll-aadj.md) +> - [Automatic Intune enrollment via Microsoft Entra join](enroll-entra-join.md) > - [Bulk enrollment with provisioning packages](enroll-package.md) > - [Enroll devices with Windows Autopilot](enroll-autopilot.md) diff --git a/education/windows/tutorial-school-deployment/index.md b/education/windows/tutorial-school-deployment/index.md index a5fd6fd8da..6ddb3c8c54 100644 --- a/education/windows/tutorial-school-deployment/index.md +++ b/education/windows/tutorial-school-deployment/index.md @@ -67,7 +67,7 @@ In the remainder of this document, we'll discuss the key concepts and benefits o Let's begin with the creation and configuration of your Microsoft Entra tenant and Intune environment. > [!div class="nextstepaction"] -> [Next: Set up Microsoft Entra ID >](set-up-azure-ad.md) +> [Next: Set up Microsoft Entra ID >](set-up-microsoft-entra-id.md) diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 2689df63e5..d6b1fa3e62 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -54,7 +54,7 @@ Alternatively, you can also select **Start** > **Power** icon. Hold down Sh This section offers recommendations to prepare you for the best possible setup experience. -### Run the same Windows uild on the admin device and the student devices +### Run the same Windows build on the admin device and the student devices We recommend you run the IT administrator or technical teacher's device on the same Windows build as the student devices. @@ -66,7 +66,7 @@ To check the app's OS requirements, go to the Microsoft Store and locate the Set ### Use app on a PC that is connected to your school's network -We recommend that you run the Set up School PCs app on a computer that's connected to your school's network. That way the app can gather accurate information about your school's wireless networks and cloud subscriptions. If it's not connected, you'll need to enter the information manually. +We recommend that you run the Set up School PCs app on a computer that's connected to your school's network. That way the app can gather accurate information about your school's wireless networks and cloud subscriptions. If it's not connected, you need to enter the information manually. >[!NOTE] >Don't use the **Set up Schools PCs** app for devices that must connect to enterprise or open Wi-Fi networds that require the user to accept Terms of Use. @@ -77,8 +77,8 @@ Don't use Set up School PCs over a certificate-based network, or one where you h We recommend that you: -- Configure your DHCP so at least 200 IP addresses are available for your devices. Having available IP addresses will allow you to set up many devices simultaneously -- Configure your IP addresses to expire after a short time, for example 30 minutes. IP addresses will free up quickly so you can continue to set up devices without network issues. +- Configure your DHCP so at least 200 IP addresses are available for your devices. Having available IP addresses allow you to set up many devices simultaneously +- Configure your IP addresses to expire after a short time, for example 30 minutes. IP addresses free up quickly so you can continue to set up devices without network issues. >[!WARNING] >Only use the provisioning package on devices that you want to configure and lock down for students. After you apply the provisioning package to a student device, the PC must be reset to remove the settings. @@ -110,7 +110,7 @@ A package expiration date is also attached to the end of each package. For examp After you select **Next**, you can no longer change the name in the app. To create a package with a different name, reopen the Set up School PCs app. -To change an existing package's name, right-click the package folder on your device and select **Rename**. This action does not change the name in Microsoft Entra ID. If you have Global Admin permissions, you can go to Microsoft Entra ID in the Azure portal, and rename the package there. +To change an existing package's name, right-click the package folder on your device and select **Rename**. This action doesn't change the name in Microsoft Entra ID. If you have Global Admin permissions, you can go to Microsoft Entra ID in the Azure portal, and rename the package there. ### Sign in @@ -141,9 +141,9 @@ Select your organization's Wi-Fi network from the list of available wireless net ### Device names -Create a name to add as a prefix to each device. This name will help you recognize and manage this group of devices in Intune. +Create a name to add as a prefix to each device. This name helps you recognize and manage this group of devices in Intune. -To make sure all device names are unique, Set up School PCs automatically appends `_%SERIAL%` to the name. For example, if you add *MATH4* as the prefix, the device names will appear as *MATH4* followed by the device serial number. +To make sure all device names are unique, Set up School PCs automatically appends `_%SERIAL%` to the name. For example, if you add *MATH4* as the prefix, the device names appear as *MATH4* followed by the device serial number. To keep the default name for your devices, select **Continue with existing names**. @@ -151,7 +151,7 @@ To keep the default name for your devices, select **Continue with existing names ### Settings -Select additional settings to include in the provisioning package. To begin, select the operating system on your student PCs. +Select more settings to include in the provisioning package. To begin, select the operating system on your student PCs. ![Screenshot of the Current OS version page with the Select OS version menu selected, showing 7 Windows 10 options. All other settings on page are unavailable to select.](images/suspcs/1810_suspc_settings.png) @@ -163,12 +163,12 @@ The following table describes each setting and lists the applicable Windows 10 v | Setting | What happens if I select it? | Note | |--|--|--| -| Remove apps pre-installed by the device manufacturer | Uninstalls apps that came loaded on the computer by the device's manufacturer. | Adds about 30 minutes to the provisioning process. | -| Allow local storage (not recommended for shared devices) | Lets students save files to the Desktop and Documents folder on the Student PC. | Not recommended if the device will be shared between different students. | -| Optimize device for a single student, instead of a shared cart or lab | Optimizes the device for use by a single student, rather than many students. | Recommended if the device will be shared between different students. Single-optimized accounts are set to expire, and require a sign-in, 180 days after setup. This setting increases the maximum PC storage to 100% of the available disk space. In this case, student accounts aren't deleted unless the account has been inactive for 180 days. | +| Remove apps preinstalled by the device manufacturer | Uninstalls apps that came loaded on the computer by the device's manufacturer. | Adds about 30 minutes to the provisioning process. | +| Allow local storage (not recommended for shared devices) | Lets students save files to the Desktop and Documents folder on the Student PC. | Not recommended if the device are shared between different students. | +| Optimize device for a single student, instead of a shared cart or lab | Optimizes the device for use by a single student, rather than many students. | Recommended if the device are shared between different students. Single-optimized accounts are set to expire, and require a sign-in, 180 days after setup. This setting increases the maximum PC storage to 100% of the available disk space. In this case, student accounts aren't deleted unless the account has been inactive for 180 days. | | Let guests sign in to these PCs | Allows guests to use student PCs without a school account. | Common to use within a public, shared space, such as a library. Also used when a student loses their password. Adds a **Guest** account to the PC sign-in screen that anyone can sign in to. | -| Enable Autopilot Reset | Lets you remotely reset a student's PC from the lock screen, apply the device's original settings, and enroll it in device management (Microsoft Entra ID and MDM). | Requires Windows 10, version 1709 and WinRE must be enabled on the PC. Setup will fail if both requirements aren't met. | -| Lock screen background | Change the default screen lock background to a custom image. | Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. | | +| Enable Autopilot Reset | Lets you remotely reset a student's PC from the lock screen, apply the device's original settings, and enroll it in device management (Microsoft Entra ID and MDM). | WinRE must be enabled on the device. | +| Lock screen background | Change the default screen lock background to a custom image. | Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. | After you've made your selections, select **Next**. @@ -177,7 +177,7 @@ After you've made your selections, select **Next**. > [!WARNING] > If you are using the Autounattend.xml file to reimage your school PCs, do not specify a time zone in the file. If you set the time zone in the file *and* in this app, you will encounter an error. -Choose the time zone where your school's devices are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, click **Next**. +Choose the time zone where your school's devices are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, select **Next**. ![Choose PC time zone page with the time zone menu expanded to show all time zone selections.](images/suspcs/1810_suspc_timezone.png) @@ -205,7 +205,7 @@ Set up the Take a Test app to give online quizzes and high-stakes assessments. D Upload custom images to replace the student devices' default desktop and lock screen backgrounds. Select **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png. -If you don't want to upload custom images or use the images that appear in the app, select **Continue without personalization**. This option does not apply any customizations, and instead uses the devices' default or preset images. +If you don't want to upload custom images or use the images that appear in the app, select **Continue without personalization**. This option doesn't apply any customizations, and instead uses the devices' default or preset images. ![Example image of the Set up School PCs app, Personalization screen, showing the default desktop and lock screen background photos, a Browse button under each photo, a blue Next button, and a Continue without personalization button.](images/suspcs/1810_SUSPC_personalization.png) @@ -223,12 +223,12 @@ Review all of the settings for accuracy and completeness ### Insert USB -1. Insert a USB drive. The **Save** button will light up when your computer detects the USB +1. Insert a USB drive. The **Save** button lights up when your computer detects the USB 1. Choose your USB drive from the list and select **Save** ![Insert a USB drive now screen with USB drive selection highlighted. Save button is blue and active.](images/suspcs/1810_SUSPC_USB.png) -1. When the package is ready, you'll see the filename and package expiration date. You can also select **Add a USB** to save the same provisioning package to another USB drive. When you're done, remove the USB drive and select **Next** +1. When the package is ready, you see the filename and package expiration date. You can also select **Add a USB** to save the same provisioning package to another USB drive. When you're done, remove the USB drive and select **Next** ![Your provisioning package is ready screen with package filename and expiration date. Shows an active blue, Next button, and a gray Add a USB button.](images/suspcs/1810_SUSPC_Package_ready.png) @@ -247,7 +247,7 @@ When used in context of the Set up School PCs app, the word *package* refers to > [!IMPORTANT] > The devices must have a new or reset Windows image and must not already have been through first-run setup experience (which is referred to as *OOBE*). For instructions about how to reset a devices's image, see [Prepare existing PC account for new setup](use-set-up-school-pcs-app.md#prepare-existing-pc-account-for-new-setup). -1. Start with the student device turned off or with the device on the first-run setup screen. If the PC has gone past the account setup screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC** +1. Start with the student device turned off or with the device on the first-run setup screen. If the device is past the account setup screen, reset the device to start over. To reset the it, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC** ![Example screenshot of the first screen the Windows 10 PC setup for OOBE. United States is selected as the region and the Yes button is active.](images/suspcs/win10_1703_oobe_firstscreen.png) From f35df22c9f9fb884d84ff76574bf6bb8552d09c6 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 9 Nov 2023 14:13:58 -0800 Subject: [PATCH 089/237] Attempt to correct lack of indentation of content in a list item Unfortunately, using includes for the content before this table is likely to prevent proper formatting. --- education/windows/edu-stickers.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index e15caa2a1a..3ac82d2b7c 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -31,9 +31,9 @@ Stickers aren't enabled by default. Follow the instructions below to configure y [!INCLUDE [intune-custom-settings-1](../../includes/configure/intune-custom-settings-1.md)] -| Setting | -|--------| -|
  • OMA-URI: **`./Vendor/MSFT/Policy/Config/Stickers/EnableStickers`**
  • Data type: **Integer**
  • Value: **1**
    • | + | Setting | + |--------| + |
  • OMA-URI: **`./Vendor/MSFT/Policy/Config/Stickers/EnableStickers`**
  • Data type: **Integer**
  • Value: **1**
    • | [!INCLUDE [intune-custom-settings-2](../../includes/configure/intune-custom-settings-2.md)] [!INCLUDE [intune-custom-settings-info](../../includes/configure/intune-custom-settings-info.md)] From c2f71410f8e40b57d37121be0af3bd3b5ba76c69 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 10 Nov 2023 07:54:48 -0500 Subject: [PATCH 090/237] Firewall checklists - freshness --- ...e-based-isolation-policy-design-example.md | 19 ++++---- ...rtificate-based-isolation-policy-design.md | 19 +++----- ...ange-rules-from-request-to-require-mode.md | 40 +++++++--------- ...ist-configuring-basic-firewall-settings.md | 13 ++--- ...uring-rules-for-an-isolated-server-zone.md | 31 +++++------- ...rs-in-a-standalone-isolated-server-zone.md | 27 +++++------ ...configuring-rules-for-the-boundary-zone.md | 13 ++--- ...nfiguring-rules-for-the-encryption-zone.md | 17 +++---- ...nfiguring-rules-for-the-isolated-domain.md | 28 +++++------ ...checklist-creating-group-policy-objects.md | 15 +++--- ...ecklist-creating-inbound-firewall-rules.md | 28 +++-------- ...cklist-creating-outbound-firewall-rules.md | 27 +++-------- ...ts-of-a-standalone-isolated-server-zone.md | 25 +++++----- ...ementing-a-basic-firewall-policy-design.md | 26 +++++----- ...rtificate-based-isolation-policy-design.md | 15 +++--- ...enting-a-domain-isolation-policy-design.md | 21 ++++---- ...andalone-server-isolation-policy-design.md | 13 ++--- .../windows-firewall/server-isolation-gpos.md | 22 +++++---- .../server-isolation-policy-design-example.md | 48 +++++++++---------- .../server-isolation-policy-design.md | 29 +++++------ 20 files changed, 196 insertions(+), 280 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md index 64cb140f2e..8a453cd437 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md @@ -3,12 +3,11 @@ title: Certificate-based Isolation Policy Design Example description: This example uses a fictitious company to illustrate certificate-based isolation policy design in Windows Defender Firewall with Advanced Security. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- # Certificate-based Isolation Policy Design Example - This design example continues to use the fictitious company Woodgrove Bank, as described in the sections [Firewall Policy Design Example](firewall-policy-design-example.md), [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md), and [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). One of the servers that must be included in the domain isolation environment is a device running UNIX that supplies other information to the WGBank dashboard program running on the client devices. This device sends updated information to the WGBank front-end servers as it becomes available, so it's considered unsolicited inbound traffic to the devices that receive this information. @@ -27,20 +26,22 @@ The creation of the IPsec connection security rules for a non-Windows device is The non-Windows device can be effectively made a member of the boundary zone or the encryption zone based on the IPsec rules applied to the device. The only constraint is that the main mode and quick mode encryption algorithms supported by the UNIX device must also be supported by the Windows-based devices with which it communicates. -**Other traffic notes:** +### Other traffic notes -- None of the capabilities of the other designs discussed in this guide are compromised by the use of certificate authentication by a non-Windows device. +- None of the capabilities of the other designs discussed in this guide are compromised by the use of certificate authentication by a non-Windows device. ## Design details Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the devices in their organization. -The inclusion of one or more non-Windows devices to the network requires only a simple addition to the GPOs for devices that must communicate with the non-Windows device. The addition is allowing certificate-based authentication in addition to the Active Directory–supported Kerberos V5 authentication. This certificate-based authoring doesn't require including new rules, just adding certificate-based authentication as an option to the existing rules. +The inclusion of one or more non-Windows devices to the network requires only a simple addition to the GPOs for devices that must communicate with the non-Windows device. The addition is allowing certificate-based authentication in addition to the Active Directory-supported Kerberos V5 authentication. This certificate-based authoring doesn't require including new rules, just adding certificate-based authentication as an option to the existing rules. -When multiple authentication methods are available, two negotiating devices agree on the first one in their lists that match. Because most of the devices in Woodgrove Bank's network run Windows, Kerberos V5 is listed as the first authentication method in the rules. Certificate-based authentication is added as an alternate authentication type. +When multiple authentication methods are available, two negotiating devices agree on the first one in their lists that match. Because most of the devices in Woodgrove Bank's network run Windows, Kerberos V5 is listed as the first authentication method in the rules. Certificate-based authentication is added as an alternate authentication type. -With the help of the Active Directory Users and Computers snap-in, Woodgrove Bank created a group named NAG\_COMPUTER\_WGBUNIX. They then added the device accounts to this group for Windows devices that need to communicate with the non-Windows devices. If all the devices in the isolated domain need to be able to access the non-Windows devices, then the **Domain Computers** group can be added to the group as a member. +With the help of the Active Directory Users and Computers snap-in, Woodgrove Bank created a group named NAG_COMPUTER_WGBUNIX. They then added the device accounts to this group for Windows devices that need to communicate with the non-Windows devices. If all the devices in the isolated domain need to be able to access the non-Windows devices, then the **Domain Computers** group can be added to the group as a member. -Woodgrove Bank then created a GPO that contains the certificate, and then attached security group filters to the GPO that allow read and apply permissions to only members of the NAG\_COMPUTER\_WGBUNIX group. The GPO places the certificate in the **Local Computer / Personal / Certificates** certificate store. The certificate used must chain back to a certificate that is in the **Trusted Root Certification Authorities** store on the local device. +Woodgrove Bank then created a GPO that contains the certificate, and then attached security group filters to the GPO that allow read and apply permissions to only members of the NAG_COMPUTER_WGBUNIX group. The GPO places the certificate in the **Local Computer / Personal / Certificates** certificate store. The certificate used must chain back to a certificate that is in the **Trusted Root Certification Authorities** store on the local device. -**Next:** [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) +> [!div class="nextstepaction"] +> +> [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md index 1af80586c7..f55fd96a04 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md @@ -3,12 +3,11 @@ title: Certificate-based Isolation Policy Design description: Explore the methodology behind Certificate-based Isolation Policy Design and how it defers from Domain Isolation and Server Isolation Policy Design. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- # Certificate-based isolation policy design - In the certificate-based isolation policy design, you provide the same types of protections to your network traffic as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Server Isolation Policy Design](server-isolation-policy-design.md) sections. The only difference is the method used to share identification credentials during the authentication of your network traffic. Domain isolation and server isolation help provide security for the devices on the network that run Windows and that can be joined to an Active Directory domain. However, in most corporate environments there are typically some devices that must run another operating system. These devices can't join an Active Directory domain, without a third-party package being installed. Also, some devices that do run Windows can't join a domain for various reasons. To rely on Kerberos V5 as the authentication protocol, the device needs to be joined to the Active Directory and (for non-Windows devices) support Kerberos as an authentication protocol. @@ -21,14 +20,8 @@ For Windows devices that are part of an Active Directory domain, you can use Gro For more info about this design: -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - -- To learn more about this design, see [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md). - -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). - -- To help you make the decisions required in this design, see [Planning Certificate-based Authentication](planning-certificate-based-authentication.md). - -- For a list of tasks that you can use to deploy your certificate-based policy design, see [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md). - - +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- To learn more about this design, see [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md). +- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). +- To help you make the decisions required in this design, see [Planning Certificate-based Authentication](planning-certificate-based-authentication.md). +- For a list of tasks that you can use to deploy your certificate-based policy design, see [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md b/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md index 12465d4121..cbfaffb255 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md @@ -2,49 +2,41 @@ title: Change Rules from Request to Require Mode description: Learn how to convert a rule from request to require mode and apply the modified GPOs to the client devices. ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 +ms.topic: how-to +ms.date: 11/10/2023 --- # Change Rules from Request to Require Mode - After you confirm that network traffic is being correctly protected by using IPsec, you can change the rules for the domain isolation and encryption zones to require, instead of request, authentication. Don't change the rules for the boundary zone; they must stay in request mode so that devices in the boundary zone can continue to accept connections from devices that aren't part of the isolated domain. -**Administrative credentials** - To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. In this topic: -- [Convert a rule from request to require mode](#to-convert-a-rule-from-request-to-require-mode) - -- [Apply the modified GPOs to the client devices](#to-apply-the-modified-gpos-to-the-client-devices) +- [Convert a rule from request to require mode](#to-convert-a-rule-from-request-to-require-mode) +- [Apply the modified GPOs to the client devices](#to-apply-the-modified-gpos-to-the-client-devices) ## To convert a rule from request to require mode -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the right navigation pane, click **Connection Security Rules**. - -3. In the details pane, double-click the connection security rule that you want to modify. - -4. Click the **Authentication** tab. - -5. In the **Requirements** section, change **Authenticated mode** to **Require inbound and request outbound**, and then click **OK**. +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. In the right navigation pane, click **Connection Security Rules** +1. In the details pane, double-click the connection security rule that you want to modify +1. Click the **Authentication** tab +1. In the **Requirements** section, change **Authenticated mode** to **Require inbound and request outbound**, and then click **OK** ## To apply the modified GPOs to the client devices -1. The next time each device refreshes its Group Policy, it will receive the updated GPO and apply the modified rule. To force an immediate refresh, run the following command from an elevated command prompt: +1. The next time each device refreshes its Group Policy, it will receive the updated GPO and apply the modified rule. To force an immediate refresh, run the following command from an elevated command prompt: - ``` syntax - gpupdate /force + ``` cmd + gpupdate.exe /force ``` -2. To verify that the modified GPO is correctly applied to the client devices, you can run the following command: +1. To verify that the modified GPO is correctly applied to the client devices, you can run the following command: - ``` syntax - gpresult /r /scope computer + ``` cmd + gpresult.exe /r /scope computer ``` -3. Examine the command output for the list of GPOs that are applied to the device, and make sure that the list contains the GPOs you expect to see on that device. +1. Examine the command output for the list of GPOs that are applied to the device, and make sure that the list contains the GPOs you expect to see on that device. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md index 4fb018d543..9b1d50eb96 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md @@ -3,18 +3,15 @@ title: Checklist Configuring Basic Firewall Settings description: Configure Windows Firewall to set inbound and outbound behavior, display notifications, record log files and more of the necessary function for Firewall. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Configuring Basic Firewall Settings +# Checklist: configure basic firewall settings - -This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules. - -**Checklist: Configuring firewall defaults and settings** +This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules: | Task | Reference | | - | - | -| Turn the firewall on and set the default inbound and outbound behavior.| [Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md)| +| Turn the firewall on and set the default inbound and outbound behavior.| [Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md)| | Configure the firewall to not display notifications to the user when a program is blocked, and to ignore locally defined firewall and connection security rules. | [Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) | -| Configure the firewall to record a log file. | [Configure the Windows Defender Firewall with Advanced Security Log](configure-the-windows-firewall-log.md)| +| Configure the firewall to record a log file. | [Configure the Windows Defender Firewall with Advanced Security Log](configure-the-windows-firewall-log.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md index bc3c7307e6..eeacecbac9 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md @@ -3,35 +3,30 @@ title: Checklist Configuring Rules for an Isolated Server Zone description: Use these tasks to configure connection security rules and IPsec settings in GPOs for servers in an isolated server zone that are part of an isolated domain. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Configuring Rules for an Isolated Server Zone - +# Checklist: configure rules for an isolated server zone The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs for servers in an isolated server zone that are part of an isolated domain. For information about creating a standalone isolated server zone that isn't part of an isolated domain, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). In addition to requiring authentication and optionally encryption, servers in an isolated server zone can be accessed only by users or devices who are authenticated members of a network access group (NAG). If you include user accounts in the NAG, then the restrictions can still apply; they're enforced at the application layer, rather than the IP layer. -Devices that are running at least Windows Vista and Windows Server 2008 can identify both devices and users in the NAG because IPsec in these versions of Windows supports AuthIP in addition to IKE. AuthIP adds support for user-based authentication. - The GPOs for an isolated server or group of servers are similar to those GPOs for the isolated domain itself or the encryption zone, if you require encryption to your isolated servers. This checklist refers you to procedures for creating rules and restrictions that allow only members of the NAG to connect to the server. -**Checklist: Configuring rules for isolated servers** - | Task | Reference | | - | - | -| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers and they run different versions of the Windows operating system, then start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.
    Copy the GPO from the isolated domain or from the encryption zone to serve as a starting point. Where your copy already contains elements listed in the following checklist, review the relevant procedures and compare them to your copied GPO’s element to make sure it's constructed in a way that meets the needs of the server isolation zone. |[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| Configure the security group filters and WMI filters on the GPO so that only members of the isolated server zone’s membership group that are running the specified version of Windows can read and apply it.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. If you require encryption for the isolated server zone, then make sure that you choose only algorithm combinations that include encryption. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Create a rule that requests authentication for all network traffic.
    **Important:** As in an isolated domain, don't set the rules to require authentication for inbound traffic until you have completed testing. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Create the NAG to contain the device or user accounts that are allowed to access the servers in the isolated server zone. | [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| -| Create a firewall rule that permits inbound network traffic only if authenticated as a member of the NAG. | [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers and they run different versions of the Windows operating system, then start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.
    Copy the GPO from the isolated domain or from the encryption zone to serve as a starting point. Where your copy already contains elements listed in the following checklist, review the relevant procedures and compare them to your copied GPO's element to make sure it's constructed in a way that meets the needs of the server isolation zone. |[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| Configure the security group filters and WMI filters on the GPO so that only members of the isolated server zone's membership group that are running the specified version of Windows can read and apply it.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | +| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| +| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| +| Configure the data protection (quick mode) algorithm combinations to be used. If you require encryption for the isolated server zone, then make sure that you choose only algorithm combinations that include encryption. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| +| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| +| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| +| Create a rule that requests authentication for all network traffic.
    **Important:** As in an isolated domain, don't set the rules to require authentication for inbound traffic until you have completed testing. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| +| Create the NAG to contain the device or user accounts that are allowed to access the servers in the isolated server zone. | [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| +| Create a firewall rule that permits inbound network traffic only if authenticated as a member of the NAG. | [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| +| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| | Add your test server to the membership group for the isolated server zone. Be sure to add at least one server for each operating system supported by a GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) | Don't change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md index 3157528b1b..e9eccb33bf 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md @@ -3,32 +3,29 @@ title: Checklist Configuring Rules for Servers in a Standalone Isolated Server Z description: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone - +# Checklist: configure rules for servers in a standalone isolated server zone This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs for servers in a standalone isolated server zone that isn't part of an isolated domain. In addition to requiring authentication and optionally encryption, servers in a server isolation zone are accessible only by users or devices that are authenticated as members of a network access group (NAG). The GPOs described here apply only to the isolated servers, not to the client devices that connect to them. For the GPOs for the client devices, see [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md). The GPOs for isolated servers are similar to those GPOs for an isolated domain. This checklist refers you to those procedures for the creation of some of the rules. The other procedures in this checklist are for creating the restrictions that allow only members of the server access group to connect to the server. -**Checklist: Configuring rules for isolated servers** - | Task | Reference | | - | - | -| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers running different versions of the Windows operating system, start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers running different versions of the Windows operating system, start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| | If you're working on a copy of a GPO, modify the group memberships and WMI filters so that they're correct for the devices for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| +| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| | Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) | -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| +| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| +| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| | Configure the authentication methods to be used. This procedure sets the default settings for the device. If you want to set authentication on a per-rule basis, this procedure is optional.| [Configure Authentication Methods](configure-authentication-methods.md) | -| Create a rule that requests authentication for all inbound network traffic.

    **Important:** As in an isolated domain, don't set the rules to require authentication until your testing is complete. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| If your design requires encryption in addition to authentication for access to the isolated servers, then modify the rule to require it. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| +| Create a rule that requests authentication for all inbound network traffic.

    **Important:** As in an isolated domain, don't set the rules to require authentication until your testing is complete. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| +| If your design requires encryption in addition to authentication for access to the isolated servers, then modify the rule to require it. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| | Create the NAG to contain the device or user accounts that are allowed to access the isolated servers. If you have multiple groups of isolated servers that are accessed by different client devices, then create a NAG for each set of servers.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) | -| Create a firewall rule that allows inbound network traffic only if it's authenticated from a user or device that is a member of the zone’s NAG.| [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test server to the membership group for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| - +| Create a firewall rule that allows inbound network traffic only if it's authenticated from a user or device that is a member of the zone's NAG.| [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| +| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Add your test server to the membership group for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| + Don't change the rules for any of your zones to require authentication until all zones have been set up and thoroughly tested. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md index e25ea92a07..2196325d31 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md @@ -3,24 +3,21 @@ title: Checklist Configuring Rules for the Boundary Zone description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Configuring Rules for the Boundary Zone - +# Checklist: configure rules for the boundary zone The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. Rules for the boundary zone are typically the same as those rules for the isolated domain, with the exception that the final rule is left to only request, not require, authentication. -**Checklist: Configuring boundary zone rules** - This checklist assumes that you've already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). After you create a copy for the boundary zone, make sure that you don't change the rule from request authentication to require authentication when you create the other GPOs. | Task | Reference | | - | - | | Make a copy of the domain isolation GPO for this version of Windows to serve as a starting point for the GPO for the boundary zone. Unlike the GPO for the main isolated domain zone, this copy isn't changed after deployment to require authentication.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) | | If you're working on a copy of a GPO, modify the group memberships and WMI filters so that they're correct for the boundary zone and version of Windows for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the boundary zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security configuration is protecting network traffic with authentication when it can, and that unauthenticated traffic is accepted. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| +| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Add your test computers to the membership group for the boundary zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| +| Verify that the connection security configuration is protecting network traffic with authentication when it can, and that unauthenticated traffic is accepted. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md index 50823a255b..8916500bda 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md @@ -3,25 +3,22 @@ title: Checklist Configuring Rules for the Encryption Zone description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Configuring Rules for the Encryption Zone - +# Checklist: configure rules for the encryption zone This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. Rules for the encryption zone are typically the same as those rules for the isolated domain, with the exception that the main rule requires encryption in addition to authentication. -**Checklist: Configuring encryption zone rules** - This checklist assumes that you've already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). You can then copy those GPOs for use with the encryption zone. After you create the copies, modify the main rule to require encryption in addition to the authentication required by the rest of the isolated domain. | Task | Reference | | - | - | -| Make a copy of the domain isolation GPOs to serve as a starting point for the GPOs for the encryption zone.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| Make a copy of the domain isolation GPOs to serve as a starting point for the GPOs for the encryption zone.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| | Modify the group memberships and WMI filters so that they're correct for the encryption zone and the version of Windows for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Add the encryption requirements for the zone. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the encryption zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security rules are protecting network traffic.| [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| +| Add the encryption requirements for the zone. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| +| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Add your test computers to the membership group for the encryption zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| +| Verify that the connection security rules are protecting network traffic.| [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md index 6b3a358d07..51f6cb3c93 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md @@ -3,29 +3,25 @@ title: Checklist Configuring Rules for the Isolated Domain description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Configuring Rules for the Isolated Domain - +# Checklist: configure rules for the isolated domain The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. -**Checklist: Configuring isolated domain rules** - | Task | Reference | | - | - | -| Create a GPO for the computers in the isolated domain running one of the operating systems. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| Create a GPO for the computers in the isolated domain running one of the operating systems. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| | If you're working on a GPO that was copied from another GPO, modify the group memberships and WMI filters so that they're correct for the isolated domain zone and the version of Windows for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create the rule that requests authentication for all inbound network traffic. | [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Link the GPO to the domain level of the AD DS organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the isolated domain. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security rules are protecting network traffic to and from the test computers. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| - +| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| +| Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| +| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| +| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| +| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| +| Create the rule that requests authentication for all inbound network traffic. | [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| +| Link the GPO to the domain level of the AD DS organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Add your test computers to the membership group for the isolated domain. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| +| Verify that the connection security rules are protecting network traffic to and from the test computers. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| Don't change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md index 82e9ed2a65..c9a715cfbc 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md @@ -3,19 +3,18 @@ title: Checklist Creating Group Policy Objects description: Learn to deploy firewall settings, IPsec settings, firewall rules, or connection security rules, by using Group Policy in AD DS. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Creating Group Policy Objects +# Checklist: Create group policy objects (GPOs) - -To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the end by making GPO assignments as easy as dropping a device into a membership group. +To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the end by making GPO assignments as easy as dropping a device into a membership group. The checklists for firewall, domain isolation, and server isolation include a link to this checklist. ## About membership groups -For most GPO deployment tasks, you must determine which devices must receive and apply which GPOs. Because different versions of Windows can support different settings and rules to achieve similar behavior, you might need multiple GPOs: one for each operating system that has settings different from the others to achieve the same result. For example, Windows 11, Windows 10, Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 use rules and settings that are incompatible with Windows 2000, Windows XP, and Windows Server 2003. Therefore, if your network included those older operating systems you would need to create a GPO for each set of operating systems that can share common settings. To deploy typical domain isolation settings and rules, you might have five different GPOs for the versions of Windows discussed in this guide. By following the procedures in this guide, you only need one membership group to manage all five GPOs. The membership group is identified in the security group filter for all five GPOs. To apply the settings to a device, you make that device's account a member of the membership group. WMI filters are used to ensure that the correct GPO is applied. +For most GPO deployment tasks, you must determine which devices must receive and apply which GPOs. Because different versions of Windows can support different settings and rules to achieve similar behavior, you might need multiple GPOs: one for each operating system that has settings different from the others to achieve the same result. Therefore, if your network included those older operating systems you would need to create a GPO for each set of operating systems that can share common settings. To deploy typical domain isolation settings and rules, you might have five different GPOs for the versions of Windows discussed in this guide. By following the procedures in this guide, you only need one membership group to manage all five GPOs. The membership group is identified in the security group filter for all five GPOs. To apply the settings to a device, you make that device's account a member of the membership group. WMI filters are used to ensure that the correct GPO is applied. ## About exclusion groups @@ -23,12 +22,10 @@ A Windows Defender Firewall with Advanced Security design must often take into a You can also use a membership group for one zone as an exclusion group for another zone. For example, devices in the boundary and encryption zones are technically in the main domain isolation zone, but must apply only the GPO for their assigned role. To use the group as an exclusion group, the GPOs for the main isolation zone deny Apply Group Policy permissions to members of the boundary and encryption zones. -**Checklist: Creating Group Policy objects** - | Task | Reference | | - | - | -| Review important concepts and examples for deploying GPOs in a way that best meets the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)| -| Create the membership group in AD DS that will be used to contain device accounts that must receive the GPO.
    If some devices in the membership group are running an operating system that doesn't support WMI filters, such as Windows 2000, create an exclusion group to contain the device accounts for the devices that can't be blocked by using a WMI filter.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| +| Review important concepts and examples for deploying GPOs in a way that best meets the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)| +| Create the membership group in AD DS that will be used to contain device accounts that must receive the GPO.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| | Create a GPO for each version of Windows that has different implementation requirements.| [Create a Group Policy Object](create-a-group-policy-object.md) | | Create security group filters to limit the GPO to only devices that are members of the membership group and to exclude devices that are members of the exclusion group.|[Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) | | Create WMI filters to limit each GPO to only the devices that match the criteria in the filter.| [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md index 38fdcd2fc4..5afd360e1a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md @@ -3,31 +3,17 @@ title: Checklist Creating Inbound Firewall Rules description: Use these tasks for creating inbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Creating Inbound Firewall Rules - +# Checklist: create inbound firewall rules This checklist includes tasks for creating firewall rules in your GPOs. -**Checklist: Creating inbound firewall rules** - | Task | Reference | | - | - | -| Create a rule that allows a program to listen for and accept inbound network traffic on any ports it requires. | [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md)| -| Create a rule that allows inbound network traffic on a specified port number. | [Create an Inbound Port Rule](create-an-inbound-port-rule.md)| -| Create a rule that allows inbound ICMP network traffic. | [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md)| -| Create rules that allow inbound RPC network traffic. | [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md)| -| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md)| - -  - -  - -  - - - - - +| Create a rule that allows a program to listen for and accept inbound network traffic on any ports it requires. | [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md)| +| Create a rule that allows inbound network traffic on a specified port number. | [Create an Inbound Port Rule](create-an-inbound-port-rule.md)| +| Create a rule that allows inbound ICMP network traffic. | [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md)| +| Create rules that allow inbound RPC network traffic. | [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md)| +| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md index 88c2eccca0..d6d1525053 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md @@ -3,31 +3,18 @@ title: Checklist Creating Outbound Firewall Rules description: Use these tasks for creating outbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Creating Outbound Firewall Rules - +# Checklist: create outbound firewall rules This checklist includes tasks for creating outbound firewall rules in your GPOs. ->**Important:**  By default, outbound filtering is disabled. Because all outbound network traffic is permitted, outbound rules are typically used to block traffic that is not wanted on the network. However, it is a best practice for an administrator to create outbound allow rules for those applications that are approved for use on the organization’s network. If you do this, then you have the option to set the default outbound behavior to block, preventing any network traffic that is not specifically authorized by the rules you create. - -**Checklist: Creating outbound firewall rules for Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, or Windows Server 2008 R2** +> [!IMPORTANT] +> By default, outbound filtering is disabled. Because all outbound network traffic is permitted, outbound rules are typically used to block traffic that is not wanted on the network. However, it is a best practice for an administrator to create outbound allow rules for those applications that are approved for use on the organization's network. If you do this, then you have the option to set the default outbound behavior to block, preventing any network traffic that is not specifically authorized by the rules you create. | Task | Reference | | - | - | -| Create a rule that allows a program to send any outbound network traffic on any port it requires. | [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md)| -| Create a rule that allows outbound network traffic on a specified port number. | [Create an Outbound Port Rule](create-an-outbound-port-rule.md)| -| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md)| - -  - -  - -  - - - - - +| Create a rule that allows a program to send any outbound network traffic on any port it requires. | [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md)| +| Create a rule that allows outbound network traffic on a specified port number. | [Create an Outbound Port Rule](create-an-outbound-port-rule.md)| +| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md index ebd45a7ede..4d8a44fecc 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md @@ -3,25 +3,22 @@ title: Create Rules for Standalone Isolated Server Zone Clients description: Checklist for when creating rules for clients of a Standalone Isolated Server Zone ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone - +# Checklist: Create rules for clients of a standalone isolated server zone This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client devices that must connect to servers in an isolated server zone. -**Checklist: Configuring isolated server zone client rules** - | Task | Reference | | - | - | -| Create a GPO for the client devices that must connect to servers in the isolated server zone, and that are running one of the versions of Windows. After you've finished the tasks in this checklist, you can make a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| Create a GPO for the client devices that must connect to servers in the isolated server zone, and that are running one of the versions of Windows. After you've finished the tasks in this checklist, you can make a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| | To determine which devices receive the GPO, assign the NAG for the isolated servers to the security group filter for the GPO. Make sure that each GPO has the WMI filter for the correct version of Windows.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create a rule that requests authentication for network traffic. Because fallback-to-clear behavior in Windows Vista and Windows Server 2008 has no delay when communicating with devices that can't use IPsec, you can use the same any-to-any rule used in an isolated domain.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test devices to the NAG for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| +| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| +| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| +| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| +| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| +| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| +| Create a rule that requests authentication for network traffic. Because fallback-to-clear behavior has no delay when communicating with devices that can't use IPsec, you can use the same any-to-any rule used in an isolated domain.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| +| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Add your test devices to the NAG for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md index 7432f4448f..3d970485cf 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md @@ -3,28 +3,26 @@ title: Checklist Implementing a Basic Firewall Policy Design description: Follow this parent checklist for implementing a basic firewall policy design to ensure successful implementation. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Implementing a Basic Firewall Policy Design - +# Checklist: implement a basic firewall policy design This parent checklist includes cross-reference links to important concepts about the basic firewall policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. ->**Note:**  Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. +> [!NOTE] +> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. The procedures in this section use the Group Policy MMC snap-in interfaces to configure the GPOs, but you can also use Windows PowerShell. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). - **Checklist: Implementing a basic firewall policy design** - | Task | Reference | | - | - | -| Review important concepts and examples for the basic firewall policy design to determine if this design meets the needs of your organization. | [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Basic Firewall Policy Design](basic-firewall-policy-design.md)
    [Firewall Policy Design Example](firewall-policy-design-example.md)
    [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)| -| Create the membership group and a GPO for each set of devices that require different firewall rules. Where GPOs will be similar, such as for Windows 11, Windows 10, and Windows Server 2016, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 10 or Windows 11, make a copy of it for Windows Server 2016, and then follow the steps in this checklist to make the few required changes to the copy. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you are working on a GPO that was copied from another, modify the group membership and WMI filters so that they are correct for the devices for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)| -| Configure the GPO with firewall default settings appropriate for your design.| [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)| -| Create one or more inbound firewall rules to allow unsolicited inbound network traffic.| [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)| -| Create one or more outbound firewall rules to block unwanted outbound network traffic. | [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| +| Review important concepts and examples for the basic firewall policy design to determine if this design meets the needs of your organization. | [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Basic Firewall Policy Design](basic-firewall-policy-design.md)
    [Firewall Policy Design Example](firewall-policy-design-example.md)
    [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)| +| Create the membership group and a GPO for each set of devices that require different firewall rules. Where GPOs will be similar, such as for Windows 11, Windows 10, and Windows Server 2016, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 10 or Windows 11, make a copy of it for Windows Server 2016, and then follow the steps in this checklist to make the few required changes to the copy. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| +| If you are working on a GPO that was copied from another, modify the group membership and WMI filters so that they are correct for the devices for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)| +| Configure the GPO with firewall default settings appropriate for your design.| [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)| +| Create one or more inbound firewall rules to allow unsolicited inbound network traffic.| [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)| +| Create one or more outbound firewall rules to block unwanted outbound network traffic. | [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)| +| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| | Add test devices to the membership group, and then confirm that the devices receive the firewall rules from the GPOs as expected.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| According to the testing and roll-out schedule in your design plan, add device accounts to the membership group to deploy the completed firewall policy settings to your devices. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| +| According to the testing and roll-out schedule in your design plan, add device accounts to the membership group to deploy the completed firewall policy settings to your devices. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md index a0fabcc4f5..edbfae8e7f 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md @@ -3,23 +3,20 @@ title: Checklist Implementing a Certificate-based Isolation Policy Design description: Use these references to learn about using certificates as an authentication option and configure a certificate-based isolation policy design. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Implementing a Certificate-based Isolation Policy Design - +# Checklist: implement a certificate-based isolation policy design This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design. > [!NOTE] > Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist -**Checklist: Implementing certificate-based authentication** - | Task | Reference | | - | - | | Review important concepts and examples for certificate-based authentication to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
    [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
    [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | -| Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you haven't already deployed a CA on your network.| | -| Configure the certificate template for workstation authentication certificates.| [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)| -| Configure Group Policy to automatically deploy certificates based on your template to workstation devices. | [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)| -| On a test device, refresh Group Policy and confirm that the certificate is installed. | [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)| +| Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you haven't already deployed a CA on your network.| | +| Configure the certificate template for workstation authentication certificates.| [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)| +| Configure Group Policy to automatically deploy certificates based on your template to workstation devices. | [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)| +| On a test device, refresh Group Policy and confirm that the certificate is installed. | [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md index dfd0e45e2c..46079fc693 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md @@ -3,11 +3,10 @@ title: Checklist Implementing a Domain Isolation Policy Design description: Use these references to learn about the domain isolation policy design and links to other checklists to complete tasks require to implement this design. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Implementing a Domain Isolation Policy Design - +# Checklist: implementing a domain isolation policy design This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. @@ -16,14 +15,12 @@ This parent checklist includes cross-reference links to important concepts about The procedures in this section use the Group Policy MMC snap-ins to configure the GPOs, but you can also use Windows PowerShell to configure GPOs. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). -**Checklist: Implementing a domain isolation policy design** - | Task | Reference | | - | - | -| Review important concepts and examples for the domain isolation policy design, determine your Windows Defender Firewall with Advanced Security implementation goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Domain Isolation Policy Design](domain-isolation-policy-design.md)
    [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
    [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | -| Create the GPOs and connection security rules for the isolated domain.| [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)| -| Create the GPOs and connection security rules for the boundary zone.| [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)| -| Create the GPOs and connection security rules for the encryption zone.| [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)| -| Create the GPOs and connection security rules for the isolated server zone.| [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)| -| According to the testing and roll-out schedule in your design plan, add computer accounts to the membership group to deploy rules and settings to your computers.| [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| -| After you confirm that network traffic is authenticated by IPsec, you can change authentication rules for the isolated domain and encryption zone from request to require mode.| [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| +| Review important concepts and examples for the domain isolation policy design, determine your Windows Firewall with Advanced Security implementation goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Domain Isolation Policy Design](domain-isolation-policy-design.md)
    [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
    [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | +| Create the GPOs and connection security rules for the isolated domain.| [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)| +| Create the GPOs and connection security rules for the boundary zone.| [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)| +| Create the GPOs and connection security rules for the encryption zone.| [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)| +| Create the GPOs and connection security rules for the isolated server zone.| [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)| +| According to the testing and roll-out schedule in your design plan, add computer accounts to the membership group to deploy rules and settings to your computers.| [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| +| After you confirm that network traffic is authenticated by IPsec, you can change authentication rules for the isolated domain and encryption zone from request to require mode.| [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md index f015a7e0c1..45e296691a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -3,11 +3,10 @@ title: Checklist Implementing a Standalone Server Isolation Policy Design description: Use these tasks to create a server isolation policy design that isn't part of an isolated domain. See references to concepts and links to other checklists. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Checklist: Implementing a Standalone Server Isolation Policy Design - +# Checklist: implementing a standalone server isolation policy design This checklist contains procedures for creating a server isolation policy design that isn't part of an isolated domain. For information on the steps required to create an isolated server zone within an isolated domain, see [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md). @@ -16,13 +15,11 @@ This parent checklist includes cross-reference links to important concepts about > [!NOTE] > Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. -**Checklist: Implementing a standalone server isolation policy design** - | Task | Reference | | - | - | | Review important concepts and examples for the server isolation policy design to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Server Isolation Policy Design](server-isolation-policy-design.md)
    [Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
    [Planning Server Isolation Zones](planning-server-isolation-zones.md) | | Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| -| Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| -| Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| -| After you confirm that network traffic is authenticated by IPsec as expected, you can change authentication rules for the isolated server zone to require authentication instead of requesting it. | [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| +| Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| +| Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| +| After you confirm that network traffic is authenticated by IPsec as expected, you can change authentication rules for the isolated server zone to require authentication instead of requesting it. | [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| | According to the testing and roll-out schedule in your design plan, add device accounts for the client devices to the membership group so that you can deploy the settings. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md index 4cf32d44c0..8ac3b50872 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md @@ -3,23 +3,25 @@ title: Server Isolation GPOs description: Learn about required GPOs for isolation zones and how many server isolation zones you need in Windows Defender Firewall with Advanced Security. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/10/2023 --- # Server Isolation GPOs +Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The *Woodgrove Bank* example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. *Woodgrove Bank* copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. -Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The Woodgrove Bank example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. Woodgrove Bank copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. +All of the device accounts for devices in the SQL Server server isolation zone are added to the group *CG_SRVISO_WGBANK_SQL*. This group is granted **Read** and **Apply Group Policy** permissions in on the GPOs described in this section. The GPOs are only for server versions of Windows. Client devices aren't expected to be members of the server isolation zone, although they can access the servers in the zone by being a member of a network access group (NAG) for the zone. -All of the device accounts for devices in the SQL Server server isolation zone are added to the group CG\_SRVISO\_WGBANK\_SQL. This group is granted Read and Apply Group Policy permissions in on the GPOs described in this section. The GPOs are only for server versions of Windows. Client devices aren't expected to be members of the server isolation zone, although they can access the servers in the zone by being a member of a network access group (NAG) for the zone. +## GPO_SRVISO -## GPO\_SRVISO +This GPO is identical to the *GPO_DOMISO_Encryption* GPO with the following changes: +- The firewall rule that enforces encryption is modified to include the NAGs on the **Users and Computers** tab of the rule. The NAGs-granted permissions include *CG_NAG_SQL_Users* and *CG_NAG_SQL_Computers*. -This GPO is identical to the GPO\_DOMISO\_Encryption GPO with the following changes: +## Next steps -- The firewall rule that enforces encryption is modified to include the NAGs on the **Users and Computers** tab of the rule. The NAGs-granted permissions include CG\_NAG\_SQL\_Users and CG\_NAG\_SQL\_Computers. - - >**Important:**  Earlier versions of Windows support only device-based authentication. If you specify that user authentication is mandatory, only users on devices that are running at least Windows Vista or Windows Server 2008 can connect. - -**Next:** [Planning GPO Deployment](planning-gpo-deployment.md) +> [!div class="nextstepaction"] +> Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. +> +> +> [Plan GPO Deployment >](planning-gpo-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md index e1129a36b1..2a049a459f 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md @@ -3,15 +3,14 @@ title: Server Isolation Policy Design Example description: Learn about server isolation policy design in Windows Defender Firewall with Advanced Security by referring to this example of a fictitious company. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/10/2023 --- # Server Isolation Policy Design Example +This design example continues to use the fictitious company *Woodgrove Bank*, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. -This design example continues to use the fictitious company Woodgrove Bank, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. - -In addition to the protections provided by the firewall and domain isolation, Woodgrove Bank wants to provide extra protection to the devices that are running Microsoft SQL Server for the WGBank program. They contain personal data, including each customer's financial history. Government and industry rules and regulations specify that access to this information must be restricted to only those users who have a legitimate business need. These rules and regulations include a requirement to prevent interception of and access to the information when it is in transit over the network. +In addition to the protections provided by the firewall and domain isolation, *Woodgrove Bank* wants to provide extra protection to the devices that are running Microsoft SQL Server for the WGBank program. They contain personal data, including each customer's financial history. Government and industry rules and regulations specify that access to this information must be restricted to only those users who have a legitimate business need. These rules and regulations include a requirement to prevent interception of and access to the information when it is in transit over the network. The information presented by the WGBank front-end servers to the client devices, and the information presented by the WGPartner servers to the remote partner devices, aren't considered sensitive for the purposes of the government regulations, because they're processed to remove sensitive elements before transmitting the data to the client devices. @@ -23,7 +22,7 @@ Server isolation can also be deployed by itself, to only the devices that must p In short, instead of applying the client GPO to all clients in the domain, you apply the GPO to only the members of the NAG. -If you don't have an Active Directory domain, you can manually apply the connection security rules, use a netsh command-line script, or use a Windows PowerShell script to help automate the configuration of the rules on larger numbers of devices. If you don't have an Active Directory domain, you can't use the Kerberos V5 protocol, but instead must provide the clients and the isolated servers with certificates that are referenced in the connection security rules. +If you don't have an Active Directory domain, you can manually apply the connection security rules, use a netsh command-line script, or use a Windows PowerShell script to help automate the configuration of the rules on larger numbers of devices. If you don't have an Active Directory domain, you can't use the Kerberos V5 protocol, but instead must provide the clients and the isolated servers with certificates that are referenced in the connection security rules. ## Design requirements @@ -33,39 +32,38 @@ The following illustration shows the traffic protection needs for this design ex ![isolated server example.](images/wfas-design3example1.gif) -1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. These accounts include the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it's sent from an authorized computer. Authorization is determined by membership in a network access group (NAG). +1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. These accounts include the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it's sent from an authorized computer. Authorization is determined by membership in a network access group (NAG) +1. All network traffic to and from the SQL Server devices must be encrypted +1. Client devices or users whose accounts aren't members of the NAG can't access the isolated servers -2. All network traffic to and from the SQL Server devices must be encrypted. +### Other traffic notes -3. Client devices or users whose accounts aren't members of the NAG can't access the isolated servers. - -**Other traffic notes:** - -- All of the design requirements shown in the [Firewall Policy Design Example](firewall-policy-design-example.md) section are still enforced. - -- All of the design requirements shown in the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section are still enforced. +- All of the design requirements shown in the [Firewall Policy Design Example](firewall-policy-design-example.md) section are still enforced +- All of the design requirements shown in the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section are still enforced ## Design details -Woodgrove Bank uses Active Directory groups and GPOs to deploy the server isolation settings and rules to the devices on its network. +*Woodgrove Bank* uses Active Directory groups and GPOs to deploy the server isolation settings and rules to the devices on its network. As in the previously described policy design examples, GPOs to implement the domain isolation environment are linked to the domain container in Active Directory, and then WMI filters and security group filters are attached to GPOs to ensure that the correct GPO is applied to each computer. The following groups were created by using the Active Directory Users and Computers snap-in, and all devices that run Windows were added to the correct groups. -- **CG\_SRVISO\_WGBANK\_SQL**. This group contains the computer accounts for the devices that run SQL Server. Members of this group receive a GPO with firewall and connections security rules that require that only users who are members of the group CG\_NAG\_SQL\_USERS can access the server, and only when they're using a computer that is a member of the group CG\_NAG\_SQL\_COMPUTERS. +- **CG_SRVISO_WGBANK_SQL**. This group contains the computer accounts for the devices that run SQL Server. Members of this group receive a GPO with firewall and connections security rules that require that only users who are members of the group CG_NAG_SQL_USERS can access the server, and only when they're using a computer that is a member of the group CG_NAG_SQL_COMPUTERS. ->**Note:**  You can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, devices that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. + > [!NOTE] + > You can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, devices that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. -  -Network access groups (NAGs) aren't used to determine which GPOs are applied to a computer. Instead, these groups determine which users and devices can access the services on the isolated server. + Network access groups (NAGs) aren't used to determine which GPOs are applied to a computer. Instead, these groups determine which users and devices can access the services on the isolated server. -- **CG\_NAG\_SQL\_COMPUTERS**. This network access group contains the computer accounts that are able to access the devices running SQL Server hosting the WGBank data. Members of this group include the WGBank front-end servers, and some client devices from which SQL Server administrators are permitted to work on the servers. +- **CG_NAG_SQL_COMPUTERS**. This network access group contains the computer accounts that are able to access the devices running SQL Server hosting the WGBank data. Members of this group include the WGBank front-end servers, and some client devices from which SQL Server administrators are permitted to work on the servers. +- **CG_NAG_SQL_USERS**. This network access group contains the user accounts of users who are permitted to access the SQL Server devices that host the WGBank data. Members of this group include the service account that the WGBank front-end program uses to run on its devices, and the user accounts for the SQL Server administration team members. -- **CG\_NAG\_SQL\_USERS**. This network access group contains the user accounts of users who are permitted to access the SQL Server devices that host the WGBank data. Members of this group include the service account that the WGBank front-end program uses to run on its devices, and the user accounts for the SQL Server administration team members. +> [!NOTE] +> You can use a single group for both user and computer accounts. Woodgrove Bank chose to keep them separate for clarity. ->**Note:**  You can use a single group for both user and computer accounts. Woodgrove Bank chose to keep them separate for clarity. - -If Woodgrove Bank wants to implement server isolation without domain isolation, the CG\_NAG\_SQL\_COMPUTERS group can also be attached as a security group filter on the GPOs that apply connection security rules to the client devices. By doing this task, all the devices that are authorized to access the isolated server also have the required connection security rules. +If Woodgrove Bank wants to implement server isolation without domain isolation, the *CG_NAG_SQL_COMPUTERS* group can also be attached as a security group filter on the GPOs that apply connection security rules to the client devices. By doing this task, all the devices that are authorized to access the isolated server also have the required connection security rules. You don't have to include the encryption-capable rules on all devices. Instead, you can create GPOs that are applied only to members of the NAG, in addition to the standard domain isolation GPO, that contains connection security rules to support encryption. -**Next:** [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md) +> [!div class="nextstepaction"] +> +> [Certificate-based Isolation Policy Design Example >](certificate-based-isolation-policy-design-example.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md index 327863f5ac..c3a7d7762f 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md @@ -3,12 +3,11 @@ title: Server Isolation Policy Design description: Learn about server isolation policy design, where you assign servers to a zone that allows access only to members of an approved network access group. ms.prod: windows-client ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/10/2023 --- # Server Isolation Policy Design - In the server isolation policy design, you assign servers to a zone that allows access only to users and devices that authenticate as members of an approved network access group (NAG). This design typically begins with a network configured as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. For this design, you then create zones for servers that have more security requirements. The zones can limit access to the server to only members of authorized groups, and can optionally require the encryption of all traffic in or out of these servers. These restrictions and requirements can be done on a per-server basis, or for a group of servers that share common security requirements. @@ -21,11 +20,9 @@ The design is shown in the following illustration, with arrows that show the per Characteristics of this design include: -- Isolated domain (area A) - The same isolated domain described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. If the isolated domain includes a boundary zone, then devices in the boundary zone behave just like other members of the isolated domain in the way that they interact with devices in server isolation zones. - -- Isolated servers (area B) - Devices in the server isolation zones restrict access to devices, and optionally users, that authenticate as a member of a network access group (NAG) authorized to gain access. - -- Encryption zone (area C) - If the data being exchanged is sufficiently sensitive, the connection security rules for the zone can also require that the network traffic be encrypted. Encryption zones are most often implemented as rules that are part of a server isolation zone, instead of as a separate zone. The diagram illustrates the concept as a subset for conceptual purposes only. +- Isolated domain (area A) - The same isolated domain described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. If the isolated domain includes a boundary zone, then devices in the boundary zone behave just like other members of the isolated domain in the way that they interact with devices in server isolation zones. +- Isolated servers (area B) - Devices in the server isolation zones restrict access to devices, and optionally users, that authenticate as a member of a network access group (NAG) authorized to gain access. +- Encryption zone (area C) - If the data being exchanged is sufficiently sensitive, the connection security rules for the zone can also require that the network traffic be encrypted. Encryption zones are most often implemented as rules that are part of a server isolation zone, instead of as a separate zone. The diagram illustrates the concept as a subset for conceptual purposes only. To add support for server isolation, you must ensure that the authentication methods are compatible with the requirements of the isolated server. For example, if you want to authorize user accounts that are members of a NAG in addition to authorizing computer accounts, you must enable both user and computer authentication in your connection security rules. @@ -36,14 +33,12 @@ This design can be applied to devices that are part of an Active Directory fores For more info about this design: -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). +- To learn more about this design, see [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). +- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). +- To help you make the decisions required in this design, see [Planning Server Isolation Zones](planning-server-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md). +- For a list of tasks that you can use to deploy your server isolation policy design, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). -- To learn more about this design, see [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). - -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). - -- To help you make the decisions required in this design, see [Planning Server Isolation Zones](planning-server-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md). - -- For a list of tasks that you can use to deploy your server isolation policy design, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). - -**Next:** [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) +> [!div class="nextstepaction"] +> +> [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) From dba380983c863a2144bbbfe753b03b9da47ae494 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 10 Nov 2023 09:21:26 -0500 Subject: [PATCH 091/237] Firewall freshness and docfx --- windows/security/docfx.json | 10 +- .../network-security/windows-firewall/TOC.yml | 64 ++++---- ...ices-to-the-membership-group-for-a-zone.md | 58 +++---- ...ices-to-the-membership-group-for-a-zone.md | 52 ++----- ...e-files-for-settings-used-in-this-guide.md | 34 ++--- ...ssign-security-group-filters-to-the-gpo.md | 61 +++----- .../best-practices-configuring.md | 142 ++++++++---------- ...andalone-server-isolation-policy-design.md | 2 +- 8 files changed, 167 insertions(+), 256 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index aa4f877c04..7421416038 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -91,9 +91,7 @@ "operating-system-security/data-protection/**/*.md": "paolomatarazzo", "operating-system-security/data-protection/**/*.yml": "paolomatarazzo", "operating-system-security/network-security/**/*.md": "paolomatarazzo", - "operating-system-security/network-security/**/*.yml": "paolomatarazzo", - "operating-system-security/network-security/windows-firewall/**/*.md": "ngangulyms", - "operating-system-security/network-security/windows-firewall/**/*.yml": "ngangulyms" + "operating-system-security/network-security/**/*.yml": "paolomatarazzo" }, "ms.author":{ "application-security//**/*.md": "vinpa", @@ -111,9 +109,7 @@ "operating-system-security/data-protection/**/*.md": "paoloma", "operating-system-security/data-protection/**/*.yml": "paoloma", "operating-system-security/network-security/**/*.md": "paoloma", - "operating-system-security/network-security/**/*.yml": "paoloma", - "operating-system-security/network-security/windows-firewall/*.md": "nganguly", - "operating-system-security/network-security/windows-firewall/*.yml": "nganguly" + "operating-system-security/network-security/**/*.yml": "paoloma" }, "appliesto": { "application-security//**/*.md": [ @@ -220,7 +216,7 @@ "identity-protection/access-control/*.md": "sulahiri", "identity-protection/smart-cards/*.md": "ardenw", "identity-protection/virtual-smart-cards/*.md": "ardenw", - "operating-system-security/network-security/windows-firewall/*.md": "paoloma", + "operating-system-security/network-security/windows-firewall/*.md": "nganguly", "operating-system-security/network-security/vpn/*.md": "pesmith", "operating-system-security/data-protection/personal-data-encryption/*.md":"rhonnegowda", "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck" diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml index 165242f099..3914108b37 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml @@ -21,7 +21,7 @@ items: href: restrict-access-to-only-specified-users-or-devices.md - name: Implementation designs items: - - name: Mapping goals to a design + - name: Map goals to a design href: mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md - name: Basic firewall design href: basic-firewall-policy-design.md @@ -45,11 +45,11 @@ items: href: certificate-based-isolation-policy-design-example.md - name: Design planning items: - - name: Planning your design + - name: Plan your design href: planning-your-windows-firewall-with-advanced-security-design.md - - name: Planning settings for a basic firewall policy + - name: Plan settings for a basic firewall policy href: planning-settings-for-a-basic-firewall-policy.md - - name: Planning domain isolation zones + - name: Plan domain isolation zones items: - name: Domain isolation zones href: planning-domain-isolation-zones.md @@ -61,21 +61,21 @@ items: href: boundary-zone.md - name: Encryption zone href: encryption-zone.md - - name: Planning server isolation zones + - name: Plan server isolation zones href: planning-server-isolation-zones.md - - name: Planning certificate-based authentication + - name: Plan certificate-based authentication href: planning-certificate-based-authentication.md items: - - name: Documenting the Zones + - name: Document the Zones href: documenting-the-zones.md - - name: Planning group policy deployment for your isolation zones + - name: Plan group policy deployment for your isolation zones href: planning-group-policy-deployment-for-your-isolation-zones.md items: - - name: Planning isolation groups for the zones + - name: Plan isolation groups for the zones href: planning-isolation-groups-for-the-zones.md - - name: Planning network access groups + - name: Plan network access groups href: planning-network-access-groups.md - - name: Planning the GPOs + - name: Plan the GPOs href: planning-the-gpos.md items: - name: Firewall GPOs @@ -102,41 +102,41 @@ items: href: gpo-domiso-encryption.md - name: Server isolation GPOs href: server-isolation-gpos.md - - name: Planning GPO deployment + - name: Plan GPO deployment href: planning-gpo-deployment.md - - name: Planning to deploy + - name: Plan to deploy href: planning-to-deploy-windows-firewall-with-advanced-security.md - name: Deployment guide items: - name: Deployment overview href: windows-firewall-with-advanced-security-deployment-guide.md - - name: Implementing your plan + - name: Implement your plan href: implementing-your-windows-firewall-with-advanced-security-design-plan.md - name: Basic firewall deployment items: - - name: "Checklist: Implementing a basic firewall policy design" + - name: "Checklist: Implement a basic firewall policy design" href: checklist-implementing-a-basic-firewall-policy-design.md - name: Domain isolation deployment items: - - name: "Checklist: Implementing a Domain Isolation Policy Design" + - name: "Checklist: Implement a Domain Isolation Policy Design" href: checklist-implementing-a-domain-isolation-policy-design.md - name: Server isolation deployment items: - - name: "Checklist: Implementing a Standalone Server Isolation Policy Design" + - name: "Checklist: Implement a Standalone Server Isolation Policy Design" href: checklist-implementing-a-standalone-server-isolation-policy-design.md - name: Certificate-based authentication items: - - name: "Checklist: Implementing a Certificate-based Isolation Policy Design" + - name: "Checklist: Implement a Certificate-based Isolation Policy Design" href: checklist-implementing-a-certificate-based-isolation-policy-design.md - name: Best practices items: - - name: Configuring the firewall + - name: Configure the firewall href: best-practices-configuring.md - - name: Securing IPsec + - name: Secure IPsec href: securing-end-to-end-ipsec-connections-by-using-ikev2.md - name: PowerShell href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - - name: Isolating Microsoft Store Apps on Your Network + - name: Isolate Microsoft Store Apps on Your Network href: isolating-apps-on-your-network.md - name: How-to items: @@ -220,31 +220,31 @@ items: href: verify-that-network-traffic-is-authenticated.md - name: References items: - - name: "Checklist: Creating Group Policy objects" + - name: "Checklist: Create Group Policy objects" href: checklist-creating-group-policy-objects.md - - name: "Checklist: Creating inbound firewall rules" + - name: "Checklist: Create inbound firewall rules" href: checklist-creating-inbound-firewall-rules.md - - name: "Checklist: Creating outbound firewall rules" + - name: "Checklist: Create outbound firewall rules" href: checklist-creating-outbound-firewall-rules.md - - name: "Checklist: Configuring basic firewall settings" + - name: "Checklist: Configure basic firewall settings" href: checklist-configuring-basic-firewall-settings.md - - name: "Checklist: Configuring rules for the isolated domain" + - name: "Checklist: Configure rules for the isolated domain" href: checklist-configuring-rules-for-the-isolated-domain.md - - name: "Checklist: Configuring rules for the boundary zone" + - name: "Checklist: Configure rules for the boundary zone" href: checklist-configuring-rules-for-the-boundary-zone.md - - name: "Checklist: Configuring rules for the encryption zone" + - name: "Checklist: Configure rules for the encryption zone" href: checklist-configuring-rules-for-the-encryption-zone.md - - name: "Checklist: Configuring rules for an isolated server zone" + - name: "Checklist: Configure rules for an isolated server zone" href: checklist-configuring-rules-for-an-isolated-server-zone.md - - name: "Checklist: Configuring rules for servers in a standalone isolated server zone" + - name: "Checklist: Configure rules for servers in a standalone isolated server zone" href: checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md - - name: "Checklist: Creating rules for clients of a standalone isolated server zone" + - name: "Checklist: Create rules for clients of a standalone isolated server zone" href: checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md - name: "Appendix A: Sample GPO template files for settings used in this guide" href: appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md - name: Troubleshooting items: - - name: Troubleshooting UWP app connectivity issues in Windows Firewall + - name: Troubleshoot UWP app connectivity issues in Windows Firewall href: troubleshooting-uwp-firewall.md - name: Filter origin audit log improvements href: filter-origin-documentation.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md index ffdc421b72..7bfb1addfd 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md @@ -2,50 +2,37 @@ title: Add Production Devices to the Membership Group for a Zone description: Learn how to add production devices to the membership group for a zone and refresh the group policy on the devices in the membership group. ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 +ms.topic: how-to +ms.date: 11/10/2023 --- # Add Production Devices to the Membership Group for a Zone - - After you test the GPOs for your design on a small set of devices, you can deploy them to the production devices. -**Caution**   -For GPOs that contain connection security rules that prevent unauthenticated connections, ensure you set the rules to request, not require, authentication during testing. After you deploy the GPO and confirm that all of your devices are successfully communicating by using authenticated IPsec, then you can modify the GPO to require authentication. Don't change the boundary zone GPO to require mode. +> [!CAUTION] +> For GPOs that contain connection security rules that prevent unauthenticated connections, ensure you set the rules to request, not require, authentication during testing. After you deploy the GPO and confirm that all of your devices are successfully communicating by using authenticated IPsec, then you can modify the GPO to require authentication. Don't change the boundary zone GPO to require mode. - - -The method discussed in this guide uses the **Domain Computers** built-in group. The advantage of this method is that all new devices that are joined to the domain automatically receive the isolated domain GPO. To define this setting successfully, you must make sure that the WMI filters and security group filters exclude devices that must not receive the GPOs. Use device groups that deny both read and apply Group Policy permissions to the GPOs, such as a group used in the CG\_DOMISO\_NOIPSEC example design. Devices that are members of some zones must also be excluded from applying the GPOs for the main isolated domain. For more information, see the "Prevent members of a group from applying a GPO" section in [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md). +The method discussed in this guide uses the *Domain Computers* built-in group. The advantage of this method is that all new devices that are joined to the domain automatically receive the isolated domain GPO. To define this setting successfully, you must make sure that the WMI filters and security group filters exclude devices that must not receive the GPOs. Use device groups that deny both read and apply Group Policy permissions to the GPOs, such as a group used in the *CG_DOMISO_NOIPSEC* example design. Devices that are members of some zones must also be excluded from applying the GPOs for the main isolated domain. For more information, see the "Prevent members of a group from applying a GPO" section in [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md). Without such a group (or groups), you must either add devices individually or use the groups containing device accounts that are available to you. -**Administrative credentials** - To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO. In this topic: -- [Add the group Domain Devices to the GPO membership group](#to-add-domain-devices-to-the-gpo-membership-group) - -- [Refresh Group Policy on the devices in the membership group](#to-refresh-group-policy-on-a-device) - -- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) +- [Add the group Domain Devices to the GPO membership group](#to-add-domain-devices-to-the-gpo-membership-group) +- [Refresh Group Policy on the devices in the membership group](#to-refresh-group-policy-on-a-device) +- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) ## To add domain devices to the GPO membership group -1. Open Active Directory Users and Computers. - -2. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then the container in which you created the membership group. - -3. In the details pane, double-click the GPO membership group to which you want to add computers. - -4. Select the **Members** tab, and then click **Add**. - -5. Type **Domain Computers** in the text box, and then click **OK**. - -6. Click **OK** to close the group properties dialog box. +1. Open Active Directory Users and Computers +1. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then the container in which you created the membership group +1. In the details pane, double-click the GPO membership group to which you want to add computers +1. Select the **Members** tab, and then click **Add** +1. Type **Domain Computers** in the text box, and then click **OK** +1. Click **OK** to close the group properties dialog box After a computer is a member of the group, you can force a Group Policy refresh on the computer. @@ -53,8 +40,8 @@ After a computer is a member of the group, you can force a Group Policy refresh From an elevated command prompt, type the following command: -``` syntax -gpupdate /target:computer /force +``` cmd +gpupdate.exe /target:computer /force ``` After Group Policy is refreshed, you can see which GPOs are currently applied to the computer. @@ -63,15 +50,6 @@ After Group Policy is refreshed, you can see which GPOs are currently applied to From an elevated command prompt, type the following command: -``` syntax -gpresult /r /scope:computer +``` cmd +gpresult.exe /r /scope:computer ``` - - - - - - - - - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md index db692b1afa..2ed1c1a950 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md @@ -2,44 +2,33 @@ title: Add Test Devices to the Membership Group for a Zone description: Learn how to add devices to the group for a zone to test whether your Windows Defender Firewall with Advanced Security implementation works as expected. ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 +ms.topic: how-to +ms.date: 11/10/2023 --- # Add Test Devices to the Membership Group for a Zone - Before you deploy your rules to large numbers of devices, you must thoroughly test the rules to make sure that communications are working as expected. A misplaced WMI filter or an incorrectly typed IP address in a filter list can easily block communications between devices. Although we recommend that you set your rules to request mode until testing and deployment is complete. We also recommend that you initially deploy the rules to a few devices only to be sure that the correct GPOs are being processed by each device. -Add at least one device of each supported operating system type to each membership group. Make sure every GPO for a specific version of Windows and membership group has a device among the test group. After Group Policy has been refreshed on each test device, check the output of the **gpresult** command to confirm that each device is receiving only the GPOs it's supposed to receive. - -**Administrative credentials** +Add at least one device of each supported operating system type to each membership group. Make sure every GPO for a specific version of Windows and membership group has a device among the test group. After Group Policy has been refreshed on each test device, check the output of the `gpresult.exe` command to confirm that each device is receiving only the GPOs it's supposed to receive. To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO. In this topic: -- [Add the test devices to the GPO membership groups](#to-add-test-devices-to-the-gpo-membership-groups) - -- [Refresh Group Policy on the devices in each membership group](#to-refresh-group-policy-on-a-device) - -- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) +- [Add the test devices to the GPO membership groups](#to-add-test-devices-to-the-gpo-membership-groups) +- [Refresh Group Policy on the devices in each membership group](#to-refresh-group-policy-on-a-device) +- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) ## To add test devices to the GPO membership groups -1. Open Active Directory Users and Computers. - -2. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then expand the container that holds your membership group account. - -3. In the details pane, double-click the GPO membership group to which you want to add devices. - -4. Select the **Members** tab, and then click **Add**. - -5. Type the name of the device in the text box, and then click **OK**. - -6. Repeat steps 5 and 6 for each extra device account or group that you want to add. - -7. Click **OK** to close the group properties dialog box. +1. Open Active Directory Users and Computers +1. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then expand the container that holds your membership group account +1. In the details pane, double-click the GPO membership group to which you want to add devices +1. Select the **Members** tab, and then click **Add** +1. Type the name of the device in the text box, and then click **OK** +1. Repeat steps 5 and 6 for each extra device account or group that you want to add +1. Click **OK** to close the group properties dialog box After a device is a member of the group, you can force a Group Policy refresh on the device. @@ -47,8 +36,8 @@ After a device is a member of the group, you can force a Group Policy refresh on From an elevated command prompt, run the following command: -``` syntax -gpupdate /target:device /force +``` cmd +gpupdate /target:device /force ``` After Group Policy is refreshed, you can see which GPOs are currently applied to the device. @@ -57,15 +46,6 @@ After Group Policy is refreshed, you can see which GPOs are currently applied to From an elevated command prompt, run the following command: -``` syntax +``` cmd gpresult /r /scope:computer ``` - -  - -  - - - - - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md index 09b4dfb941..4c3d750caa 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md @@ -3,21 +3,21 @@ title: Appendix A Sample GPO Template Files for Settings Used in this Guide description: Use sample template files import an XML file containing customized registry preferences into a Group Policy Object (GPO). ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/10/2023 --- -# Appendix A: Sample GPO Template Files for Settings Used in this Guide - +# Appendix A: aample GPO template files for settings used in this guide You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). -To manually create the file, build the settings under **Computer Configuration**, **Preferences**, **Windows Settings**, **Registry**. After you have created the settings, drag the container to the desktop. An .xml file is created there. +To manually create the file, build the settings under **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry**. After you create the settings, drag the container to the desktop. An .xml file is created there. -To import an .xml file to GPMC, drag it and drop it on the **Registry** node under **Computer Configuration**, **Preferences**, **Windows Settings**. If you copy the following sample XML code to a file, and then drag and drop it on the **Registry** node, it creates a **Server and Domain Isolation** collection with the six registry keys discussed in this guide. +To import an .xml file to GPMC, drag it and drop it on the **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry** node. If you copy the following sample XML code to a file, and then drag and drop it on the **Registry** node, it creates a **Server and Domain Isolation** collection with the six registry keys discussed in this guide. The following sample file uses item-level targeting to ensure that the registry keys are applied only on the versions of Windows to which they apply. ->**Note:**  The file shown here is for sample use only. It should be customized to meet the requirements of your organization’s deployment. To customize this file, import it into a test GPO, modify the settings, and then drag the Server and Domain Isolation Settings node to your desktop. The new file will contain all of your customization. +> [!NOTE] +> The file shown here is for sample use only. It should be customized to meet the requirements of your organization's deployment. To customize this file, import it into a test GPO, modify the settings, and then drag the Server and Domain Isolation Settings node to your desktop. The new file will contain all of your customization. ```xml @@ -31,11 +31,11 @@ The following sample file uses item-level targeting to ensure that the registry image="12" changed="2008-05-30 20:37:37" uid="{52C38FD7-A081-404C-A8EA-B24A9614D0B5}" - desc="<b>Enable PMTU Discovery</b><p> + desc="Enable PMTU Discovery

    This setting configures whether computers can use PMTU - discovery on the network.<p> - <b>1</b> -- Enable<br> - <b>0</b> -- Disable" + discovery on the network.

    + 1 -- Enable
    + 0 -- Disable" bypassErrors="1"> IPsec Default Exemptions for Windows Server 2008 + and later

    This setting determines which network traffic type is exempt - from any IPsec authentication requirements.<p> - <b>0</b>: Exempts multicast, broadcast, RSVP, Kerberos, ISAKMP<br> - <b>1</b>: Exempts multicast, broadcast, ISAKMP<br> - <b>2</b>: Exempts RSVP, Kerberos, ISAKMP<br> - <b>3</b>: Exempts ISAKMP only" + from any IPsec authentication requirements.

    + 0: Exempts multicast, broadcast, RSVP, Kerberos, ISAKMP
    + 1: Exempts multicast, broadcast, ISAKMP
    + 2: Exempts RSVP, Kerberos, ISAKMP
    + 3: Exempts ISAKMP only" bypassErrors="1"> [!IMPORTANT] >This deployment guide uses the method of adding the Domain Computers group to the membership group for the main isolated domain after testing is complete and you are ready to go live in production. To make this method work, you must prevent any computer that is a member of either the boundary or encryption zone from applying the GPO for the main isolated domain. For example, on the GPOs for the main isolated domain, deny Read and Apply Group Policy permissions to the membership groups for the boundary and encryption zones. -  - -**Administrative credentials** - To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the relevant GPOs. In this topic: -- [Allow members of a group to apply a GPO](#to-allow-members-of-a-group-to-apply-a-gpo) - -- [Prevent members of a group from applying a GPO](#to-prevent-members-of-a-group-from-applying-a-gpo) +- [Allow members of a group to apply a GPO](#to-allow-members-of-a-group-to-apply-a-gpo) +- [Prevent members of a group from applying a GPO](#to-prevent-members-of-a-group-from-applying-a-gpo) ## To allow members of a group to apply a GPO Use the following procedure to add a group to the security filter on the GPO that allows group members to apply the GPO. -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, under **Security Filtering**, click **Authenticated Users**, and then click **Remove**. +1. Open the Group Policy Management console +1. In the navigation pane, find and then select the GPO that you want to modify +1. In the details pane, under **Security Filtering**, select **Authenticated Users**, and then select **Remove** >[!NOTE] - >You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. If the GPO contains User settings, and the **Authenticated Users** group is removed, and new security filtering is added using a security group that only contains user accounts, the GPO can fail to apply. Details and various workarounds are mentioned in this [Microsoft blog](https://techcommunity.microsoft.com/t5/Core-Infrastructure-and-Security/Who-broke-my-user-GPOs/ba-p/258781). + >You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. If the GPO contains User settings, and the **Authenticated Users** group is removed, and new security filtering isdded using a security group that only contains user accounts, the GPO can fail to apply. Details and various workarounds are mentioned in this [Microsoft blog](https://techcommunity.microsoft.com/t5/Core-Infrastructure-and-Security/Who-broke-my-user-GPOsa-p/258781). -4. Click **Add**. +1. Se;ect **Add** +1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain -5. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain. - -## To prevent members of a group from applying a GPO +## To prevent members of a group from applying a GPO Use the following procedure to add a group to the security filter on the GPO that prevents group members from applying the GPO. This is typically used to prevent members of the boundary and encryption zones from applying the GPOs for the isolated domain. -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, click the **Delegation** tab. - -4. Click **Advanced**. - -5. Under the **Group or user names** list, click **Add**. - -6. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain. - -7. Select the group in the **Group or user names** list, and then select the box in the **Deny** column for both **Read** and **Apply group policy**. - -8. Click **OK**, and then in the **Windows Security** dialog box, click **Yes**. - -9. The group appears in the list with **Custom** permissions. +1. Open the Group Policy Management console +1. In the navigation pane, find and then select the GPO that you want to modify +1. In the details pane, select the **Delegation** tab +1. Select **Advanced** +1. Under the **Group or user names** list, select **Add** +1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups lable in the domain +1. Select the group in the **Group or user names** list, and then select the box in the **Deny** column for both **Read** and **Apply group policy** +1. Select **OK**, and then in the **Windows Security** dialog box, select **Yes** +1. The group appears in the list with **Custom** permissions diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index c0f7eb352f..41280919f0 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -1,132 +1,112 @@ --- -title: Best practices for configuring Windows Defender Firewall -description: Learn about best practices for configuring Windows Defender Firewall +title: Best practices for configuring Windows Firewall +description: Learn about best practices for configuring Windows Firewall ms.prod: windows-client -ms.date: 11/09/2022 -ms.collection: - - highpri - - tier3 - - must-keep +ms.date: 11/10/2023 ms.topic: best-practice --- -# Best practices for configuring Windows Defender Firewall +# Best practices for configuring Windows Firewall -Windows Defender Firewall with Advanced Security provides host-based, two-way -network traffic filtering and blocks unauthorized network traffic flowing into -or out of the local device. Configuring your Windows Firewall based on the -following best practices can help you optimize protection for devices in your -network. These recommendations cover a wide range of deployments including home -networks and enterprise desktop/server systems. +Windows Firewall with Advanced Security provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. These recommendations cover a wide range of deployments including home networks and enterprise desktop/server systems. -To open Windows Firewall, go to the **Start** menu, select **Run**, -type **WF.msc**, and then select **OK**. See also [Open Windows Firewall](open-windows-firewall-with-advanced-security.md). +To open Windows Firewall, select **Start** > **Run**, type **wf.msc**, and then select **OK**. See also [Open Windows Firewall](open-windows-firewall-with-advanced-security.md). ## Keep default settings -When you open the Windows Defender Firewall for the first time, you can see the default settings applicable to the local computer. The Overview panel displays security settings for each type of network to which the device can connect. +When you open the Windows Firewall for the first time, you can see the default settings applicable to the local computer. The Overview panel displays security settings for each type of network to which the device can connect. -![Windows Defender Firewall with Advanced Security first time opening.](images/fw01-profiles.png) - -*Figure 1: Windows Defender Firewall* +![Windows Firewall with Advanced Security first time opening.](images/fw01-profiles.png) 1. **Domain profile**: Used for networks where there's a system of account authentication against an Active Directory domain controller 1. **Private profile**: Designed for and best used in private networks such as a home network 1. **Public profile**: Designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, or stores -View detailed settings for each profile by right-clicking the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then selecting **Properties**. +To view detailed settings for each profile, right-click the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then select **Properties**. -Maintain the default settings in Windows Defender -Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. +Maintain the default settings in Windows Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. -![A screenshot of a cell phone Description automatically generated.](images/fw03-defaults.png) - -*Figure 2: Default inbound/outbound settings* +:::image type="content" source="images/fw03-defaults.png" alt-text="Screenshot of the default inbound/outbound Firewall settings."::: > [!IMPORTANT] > To maintain maximum security, do not change the default Block setting for inbound connections. For more on configuring basic firewall settings, see [Turn on Windows Firewall and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md) and [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md). -## Understand rule precedence for inbound rules +## Rule precedence for inbound rules -In many cases, a next step for administrators will be to customize these profiles using rules (sometimes called filters) so that they can work with user apps or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. +In many cases, a next step for administrators is to customize the firewall profiles using *rules* (sometimes called *filters*), so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. -This rule-adding task can be accomplished by right-clicking either **Inbound Rules** or **Outbound Rules**, and selecting **New Rule**. The interface for adding a new rule looks like this: +The rule-adding task can be accomplished by right-clicking either **Inbound Rules** or **Outbound Rules**, and selecting **New Rule**. The interface for adding a new rule looks like this: ![Rule creation wizard.](images/fw02-createrule.png) -*Figure 3: Rule Creation Wizard* +> [!NOTE] +>This article doesn't cover step-by-step rule configuration. See the [Windows Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) for general guidance on policy creation. + +In many cases, allowing specific types of inbound traffic is required for applications to function in the network. Administrators should keep the following rule precedence behaviors in mind when allowing these inbound exceptions: + +1. Explicitly defined allow rules take precedence over the default block setting +1. Explicit block rules take precedence over any conflicting allow rules +1. More specific rules take precedence over less specific rules, except if there are explicit block rules as mentioned in 2. For example, if the parameters of rule 1 include an IP address range, while the parameters of rule 2 include a single IP host address, rule 2 takes precedence. + +> [!TIP] +> Because of 1 and 2, when designing a set of policies you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow. + +A general security recommended practice when creating inbound rules is to be as specific as possible. However, when new rules must be made that use ports or IP addresses, consider using consecutive ranges or subnets instead of individual addresses or ports where possible. This approach avoids creation of multiple filters under the hood, reduces complexity, and helps to avoid performance degradation. > [!NOTE] ->This article does not cover step-by-step rule configuration. See the [Windows Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) for general guidance on policy creation. - -In many cases, allowing specific types of inbound traffic will be required for applications to function in the network. Administrators should keep the following rule precedence behaviors in mind when allowing these inbound exceptions. - -1. Explicitly defined allow rules will take precedence over the default block setting. -1. Explicit block rules will take precedence over any conflicting allow rules. -1. More specific rules will take precedence over less specific rules, except if there are explicit block rules as mentioned in 2. (For example, if the parameters of rule 1 include an IP address range, while the parameters of rule 2 include a single IP host address, rule 2 will take precedence.) - -Because of 1 and 2, it's important that, when designing a set of policies, you make sure that there are no other explicit block rules in place that could inadvertently overlap, thus preventing the traffic flow you wish to allow. - -A general security best practice when creating inbound rules is to be as specific as possible. However, when new rules must be made that use ports or IP addresses, consider using consecutive ranges or subnets instead of individual addresses or ports where possible. This approach avoids creation of multiple filters under the hood, reduces complexity, and helps to avoid performance degradation. - -> [!NOTE] -> Windows Defender Firewall does not support traditional weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors described above. +> Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described. ## Create rules for new applications before first launch ### Inbound allow rules -When first installed, networked applications and services issue a listen call specifying the protocol/port information required for them to function properly. As there's a default block action in Windows Defender Firewall, it's necessary to create inbound exception rules to allow this traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. +When first installed, networked applications and services issue a listen call specifying the protocol/port information required for them to function properly. As there's a default block action in Windows Firewall, it's necessary to create inbound exception rules to allow this traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. -If there's no active application or administrator-defined allow rule(s), a dialog box will prompt the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network. +If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network. -- If the user has admin permissions, they'll be prompted. If they respond *No* or cancel the prompt, block rules will be created. Two rules are typically created, one each for TCP and UDP traffic. +- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic. +- If the user isn't a local admin, they won't be prompted. In most cases, block rules are created. -- If the user isn't a local admin, they won't be prompted. In most cases, block rules will be created. - -In either of the scenarios above, once these rules are added they must be deleted in order to generate the prompt again. If not, the traffic will continue to be blocked. +In either of these scenarios, once the rules are added, they must be deleted to generate the prompt again. If not, the traffic continues to be blocked. > [!NOTE] -> The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. +> The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. ### Known issues with automatic rule creation -When designing a set of firewall policies for your network, it's a best practice to configure allow rules for any networked applications deployed on the host. Having these rules in place before the user first launches the application will help ensure a seamless experience. +When designing a set of firewall policies for your network, it's a recommended practice to configure *allow rules* for any networked applications deployed on the host. Having the rules in place before the user first launches the application helps to ensure a seamless experience. The absence of these staged rules doesn't necessarily mean that in the end an application will be unable to communicate on the network. However, the behaviors involved in the automatic creation of application rules at runtime require user interaction and administrative privilege. If the device is expected to be used by non-administrative users, you should follow best practices and provide these rules before the application's first launch to avoid unexpected networking issues. To determine why some applications are blocked from communicating in the network, check for the following instances: -1. A user with sufficient privileges receives a query notification advising them that the application needs to make a change to the firewall policy. Not fully understanding the prompt, the user cancels or dismisses the prompt. -1. A user lacks sufficient privileges and is therefore not prompted to allow the application to make the appropriate policy changes. -1. Local Policy Merge is disabled, preventing the application or network service from creating local rules. +1. A user with sufficient privileges receives a query notification advising them that the application needs to make a change to the firewall policy. Not fully understanding the prompt, the user cancels or dismisses the prompt +1. A user lacks sufficient privileges and is therefore not prompted to allow the application to make the appropriate policy changes +1. Local Policy Merge is disabled, preventing the application or network service from creating local rules Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. :::image type="content" alt-text="Windows Firewall prompt." source="images/fw04-userquery.png"::: -*Figure 4: Dialog box to allow access* - See also [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md). ## Establish local policy merge and application rules Firewall rules can be deployed: -1. Locally using the Firewall snap-in (**WF.msc**) -1. Locally using PowerShell -1. Remotely using Group Policy if the device is a member of an Active Directory Name, System Center Configuration Manager, or Intune (using workplace join) +1. Locally using the Firewall snap-in (**wf.msc**) +1. Locally using PowerShell +1. Remotely using Group Policy if the device is a member of an Active Directory Name or managed by Configuration Manager +1. Remotely, using a mobile device management (MDM) solution like Microsoft Intune -Rule merging settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for Domain, Private, and Public profiles. +Rule merging settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. The rule-merging settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from Group Policy. ![Customize settings.](images/fw05-rulemerge.png) -*Figure 5: Rule merging setting* - > [!TIP] > In the firewall [configuration service provider](/windows/client-management/mdm/firewall-csp), the equivalent setting is *AllowLocalPolicyMerge*. This setting can be found under each respective profile node, *DomainProfile*, *PrivateProfile*, and *PublicProfile*. @@ -139,14 +119,14 @@ Management (MDM), or both (for hybrid or co-management environments). As a best practice, it's important to list and log such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex or customer application deployments, a more thorough analysis may be needed using network packet capture tools. -In general, to maintain maximum security, admins should only push firewall exceptions for apps and services determined to serve legitimate purposes. +In general, to maintain maximum security, admins should only deploy firewall exceptions for apps and services determined to serve legitimate purposes. > [!NOTE] -> The use of wildcard patterns, such as *C:\*\\teams.exe* is not supported in application rules. We currently only support rules created using the full path to the application(s). +> The use of wildcard patterns, such as *C:\*\\teams.exe* is not supported in application rules. You can only create rules using the full path to the application(s). -## Understand Group Policy Processing +## Understand group policy processing -The Windows Firewall settings configured via group policy are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. +The Windows Firewall settings configured via group policy or CSP are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: @@ -157,13 +137,13 @@ Windows Firewall monitors the registry for changes, and if something is written > [!NOTE] > The actions are triggered whenever something is written to, or deleted from the registry location the GPO settings are stored, regardless if there's really a configuration change. During the process, IPsec connections are disconnected. -Many policy implementations specify that they are updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. To control the behavior of the registry group policy processing, you can use the policy `Computer Configuration > Administrative Templates > System > Group Policy > Configure registry policy processing`. The *Process even if the Group Policy objects have not changed* option updates and reapplies the policies even if the policies have not changed. This option is disabled by default. +Many policy implementations specify that they're updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. To control the behavior of the registry group policy processing, you can use the policy `Computer Configuration > Administrative Templates > System > Group Policy > Configure registry policy processing`. The *Process even if the Group Policy objects haven't changed* option updates and reapplies the policies even if the policies haven't changed. This option is disabled by default. -If you enable the option *Process even if the Group Policy objects have not changed*, the WFP filters get reapplied during **every** background refresh. In case you have ten group policies, the WFP filters get reapplied ten times during the refresh interval. If an error happens during policy processing, the applied settings may be incomplete, resulting in issues like: +If you enable the option *Process even if the Group Policy objects haven't changed*, the WFP filters get reapplied during **every** background refresh. In case you have 10 group policies, the WFP filters get reapplied 10 times during the refresh interval. If an error happens during policy processing, the applied settings might be incomplete, resulting in issues like: -- Windows Defender Firewall blocks inbound or outbound traffic allowed by group policies +- Windows Firewall blocks inbound or outbound traffic allowed by group policies - Local Firewall settings are applied instead of group policy settings -- IPsec connections cannot establish +- IPsec connections can't establish The temporary solution is to refresh the group policy settings, using the command `gpupdate.exe /force`, which requires connectivity to a domain controller. @@ -174,7 +154,7 @@ To avoid the issue, leave the policy `Computer Configuration > Administrative Te > > If there's a requirement to force registry deletion and rewrite, then disable background processing by checking the checkbox next to **Do not apply during periodic background processing**. -## Know how to use "shields up" mode for active attacks +## Know how to use *shields up* mode for active attacks An important firewall feature you can use to mitigate damage during an active attack is the "shields up" mode. It's an informal term referring to an easy method a firewall administrator can use to temporarily increase security in the face of an active attack. @@ -189,7 +169,7 @@ incoming connections, including those in the list of allowed apps** setting foun *Figure 7: Legacy firewall.cpl* -By default, the Windows Defender Firewall will block everything unless there's an exception rule created. This setting overrides the exceptions. +By default, the Windows Firewall blocks everything unless there's an exception rule created. This setting overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access won't work as long as shields up is activated. @@ -201,7 +181,7 @@ What follows are a few general guidelines for configuring outbound rules. - The default configuration of Blocked for Outbound rules can be considered for certain highly secure environments. However, the Inbound rule configuration should never be changed in a way that Allows traffic by default - It's recommended to Allow Outbound by default for most deployments for the sake of simplification around app deployments, unless the enterprise prefers tight security controls over ease-of-use -- In high security environments, an inventory of all enterprise-spanning apps must be taken and logged by the administrator or administrators. Records must include whether an app used requires network connectivity. Administrators will need to create new rules specific to each app that needs network connectivity and push those rules centrally, via group policy (GP), Mobile Device Management (MDM), or both (for hybrid or co-management environments) +- In high security environments, an inventory of all enterprise-spanning apps must be taken and logged by the administrator or administrators. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via group policy (GP), Mobile Device Management (MDM), or both (for hybrid or co-management environments) For tasks related to creating outbound rules, see [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md). @@ -211,21 +191,19 @@ When creating an inbound or outbound rule, you should specify details about the ## Configure Windows Firewall rules with WDAC tagging policies -Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: +Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: ### Step 1: Deploy WDAC AppId Tagging Policies -A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   +A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. -Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  +Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications. ### Step 2: Configure Firewall Rules using PolicyAppId Tags -- **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. -You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. +- **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. +You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `–PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  - - +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md index 45e296691a..7596ee7611 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md @@ -18,7 +18,7 @@ This parent checklist includes cross-reference links to important concepts about | Task | Reference | | - | - | | Review important concepts and examples for the server isolation policy design to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Server Isolation Policy Design](server-isolation-policy-design.md)
    [Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
    [Planning Server Isolation Zones](planning-server-isolation-zones.md) | -| Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| +| Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| | Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| | Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| | After you confirm that network traffic is authenticated by IPsec as expected, you can change authentication rules for the isolated server zone to require authentication instead of requesting it. | [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| From 6e5a5ed0294aebd86821c9c68b15c907cfc4dc19 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 10 Nov 2023 12:11:02 -0500 Subject: [PATCH 092/237] fix issues --- ...le-gpo-template-files-for-settings-used-in-this-guide.md | 2 +- .../assign-security-group-filters-to-the-gpo.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md index 4c3d750caa..03fe642a1d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md @@ -6,7 +6,7 @@ ms.topic: conceptual ms.date: 11/10/2023 --- -# Appendix A: aample GPO template files for settings used in this guide +# Appendix A: sample GPO template files for settings used in this guide You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md index bf0178639f..f708e6a031 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md @@ -29,9 +29,9 @@ Use the following procedure to add a group to the security filter on the GPO tha 1. In the details pane, under **Security Filtering**, select **Authenticated Users**, and then select **Remove** >[!NOTE] - >You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. If the GPO contains User settings, and the **Authenticated Users** group is removed, and new security filtering isdded using a security group that only contains user accounts, the GPO can fail to apply. Details and various workarounds are mentioned in this [Microsoft blog](https://techcommunity.microsoft.com/t5/Core-Infrastructure-and-Security/Who-broke-my-user-GPOsa-p/258781). + >You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. -1. Se;ect **Add** +1. Select **Add** 1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain ## To prevent members of a group from applying a GPO @@ -43,7 +43,7 @@ Use the following procedure to add a group to the security filter on the GPO tha 1. In the details pane, select the **Delegation** tab 1. Select **Advanced** 1. Under the **Group or user names** list, select **Add** -1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups lable in the domain +1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain 1. Select the group in the **Group or user names** list, and then select the box in the **Deny** column for both **Read** and **Apply group policy** 1. Select **OK**, and then in the **Windows Security** dialog box, select **Yes** 1. The group appears in the list with **Custom** permissions From ec8bcd2224e1f90537afa9518a5bfca452855bdc Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 10 Nov 2023 16:13:50 -0500 Subject: [PATCH 093/237] batch1 --- .../network-security/windows-firewall/TOC.yml | 87 -------------- .../basic-firewall-policy-design.md | 51 -------- .../windows-firewall/boundary-zone-gpos.md | 22 ---- .../windows-firewall/boundary-zone.md | 57 --------- ...e-based-isolation-policy-design-example.md | 47 -------- ...rtificate-based-isolation-policy-design.md | 27 ----- .../windows-firewall/documenting-the-zones.md | 21 ---- .../domain-isolation-policy-design-example.md | 52 --------- .../domain-isolation-policy-design.md | 58 --------- .../windows-firewall/encryption-zone-gpos.md | 16 --- .../windows-firewall/encryption-zone.md | 56 --------- .../windows-firewall/exemption-list.md | 46 -------- .../windows-firewall/firewall-gpos.md | 14 --- .../firewall-policy-design-example.md | 100 ---------------- .../windows-firewall/gpo-domiso-boundary.md | 37 ------ .../windows-firewall/gpo-domiso-encryption.md | 51 -------- .../windows-firewall/gpo-domiso-firewall.md | 59 ---------- .../gpo-domiso-isolateddomain-clients.md | 77 ------------ .../gpo-domiso-isolateddomain-servers.md | 20 ---- .../windows-firewall/isolated-domain-gpos.md | 20 ---- .../windows-firewall/isolated-domain.md | 57 --------- ...-firewall-with-advanced-security-design.md | 27 ----- ...anning-certificate-based-authentication.md | 48 -------- .../planning-domain-isolation-zones.md | 24 ---- .../planning-gpo-deployment.md | 110 ------------------ ...icy-deployment-for-your-isolation-zones.md | 22 ---- ...planning-isolation-groups-for-the-zones.md | 34 ------ .../planning-network-access-groups.md | 27 ----- .../planning-server-isolation-zones.md | 68 ----------- ...ng-settings-for-a-basic-firewall-policy.md | 44 ------- .../windows-firewall/planning-the-gpos.md | 51 -------- ...windows-firewall-with-advanced-security.md | 54 --------- ...-firewall-with-advanced-security-design.md | 84 ------------- .../windows-firewall/server-isolation-gpos.md | 27 ----- .../server-isolation-policy-design-example.md | 69 ----------- .../server-isolation-policy-design.md | 44 ------- 36 files changed, 1708 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml index 3914108b37..ab921f1437 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml @@ -19,93 +19,6 @@ items: href: require-encryption-when-accessing-sensitive-network-resources.md - name: Restrict access href: restrict-access-to-only-specified-users-or-devices.md - - name: Implementation designs - items: - - name: Map goals to a design - href: mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md - - name: Basic firewall design - href: basic-firewall-policy-design.md - items: - - name: Basic firewall design example - href: firewall-policy-design-example.md - - name: Domain isolation design - href: domain-isolation-policy-design.md - items: - - name: Domain isolation design example - href: domain-isolation-policy-design-example.md - - name: Server isolation design - href: server-isolation-policy-design.md - items: - - name: Server Isolation design example - href: server-isolation-policy-design-example.md - - name: Certificate-based isolation design - href: certificate-based-isolation-policy-design.md - items: - - name: Certificate-based Isolation design example - href: certificate-based-isolation-policy-design-example.md - - name: Design planning - items: - - name: Plan your design - href: planning-your-windows-firewall-with-advanced-security-design.md - - name: Plan settings for a basic firewall policy - href: planning-settings-for-a-basic-firewall-policy.md - - name: Plan domain isolation zones - items: - - name: Domain isolation zones - href: planning-domain-isolation-zones.md - - name: Exemption list - href: exemption-list.md - - name: Isolated domain - href: isolated-domain.md - - name: Boundary zone - href: boundary-zone.md - - name: Encryption zone - href: encryption-zone.md - - name: Plan server isolation zones - href: planning-server-isolation-zones.md - - name: Plan certificate-based authentication - href: planning-certificate-based-authentication.md - items: - - name: Document the Zones - href: documenting-the-zones.md - - name: Plan group policy deployment for your isolation zones - href: planning-group-policy-deployment-for-your-isolation-zones.md - items: - - name: Plan isolation groups for the zones - href: planning-isolation-groups-for-the-zones.md - - name: Plan network access groups - href: planning-network-access-groups.md - - name: Plan the GPOs - href: planning-the-gpos.md - items: - - name: Firewall GPOs - href: firewall-gpos.md - items: - - name: GPO_DOMISO_Firewall - href: gpo-domiso-firewall.md - - name: Isolated domain GPOs - href: isolated-domain-gpos.md - items: - - name: GPO_DOMISO_IsolatedDomain_Clients - href: gpo-domiso-isolateddomain-clients.md - - name: GPO_DOMISO_IsolatedDomain_Servers - href: gpo-domiso-isolateddomain-servers.md - - name: Boundary zone GPOs - href: boundary-zone-gpos.md - items: - - name: GPO_DOMISO_Boundary - href: gpo-domiso-boundary.md - - name: Encryption zone GPOs - href: encryption-zone-gpos.md - items: - - name: GPO_DOMISO_Encryption - href: gpo-domiso-encryption.md - - name: Server isolation GPOs - href: server-isolation-gpos.md - - name: Plan GPO deployment - href: planning-gpo-deployment.md - - name: Plan to deploy - href: planning-to-deploy-windows-firewall-with-advanced-security.md - name: Deployment guide items: - name: Deployment overview diff --git a/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md deleted file mode 100644 index 748a749676..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Basic Firewall Policy Design -description: Protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses by using basic firewall policy design. -ms.topic: conceptual -ms.date: 11/07/2023 ---- - -# Basic Firewall Policy Design - -Many organizations have a network perimeter firewall that is designed to prevent the entry of malicious traffic in to the organization's network, but don't have a host-based firewall enabled on each device in the organization. - -The Basic Firewall Policy Design helps you to protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses, or that originates from inside your network. In this design, you deploy firewall rules to each device in your organization to allow traffic that is required by the programs that are used. Traffic that doesn't match the rules is dropped. - -Traffic can be blocked or permitted based on the characteristics of each network packet: its source or destination IP address, its source or destination port numbers, the program on the device that receives the inbound packet, and so on. This design can also be deployed together with one or more of the other designs that add IPsec protection to the network traffic permitted. - -Many network administrators don't want to tackle the difficult task of determining all the appropriate rules for every program that is used by the organization, and then maintaining that list over time. In fact, most programs don't require specific firewall rules. The default behavior of Windows and most contemporary applications makes this task easy: - -- On client devices, the default firewall behavior already supports typical client programs. Programs create any required rules for you as part of the installation process. You only have to create a rule if the client program must be able to receive unsolicited inbound network traffic from another device -- When you install a server program that must accept unsolicited inbound network traffic, the installation program likely creates or enables the appropriate rules on the server for you. For example, when you install a server role, the appropriate firewall rules are created and enabled automatically -- For other standard network behavior, the predefined rules that are built into Windows can be configured in a GPO and deployed to the devices in your organization. For example, by using the predefined groups for Core Networking and File and Printer Sharing you can easily configure GPOs with rules for those frequently used networking protocols. - -With a few exceptions, the firewall can be enabled on all configurations. Therefore, we recommend that you enable the firewall on every device in your organization. The term "device" includes servers in your perimeter network, on mobile and remote clients that connect to the network, and on all servers and clients in your internal network. - -> [!CAUTION] -> Stopping the service associated with Windows Defender Firewall with Advanced Security is not supported by Microsoft. - -Windows Defender Firewall with Advanced Security is turned on by default. - -If you turn off the Windows Defender Firewall service you lose other benefits provided by the service, such as the ability to use IPsec connection security rules, Windows Service Hardening, and network protection from forms of attacks that use network fingerprinting. - -Compatible third-party firewall software can programmatically disable only the parts of Windows Defender Firewall that might need to be disabled for compatibility. This approach is the recommended one for third-party firewalls to coexist with the Windows Defender Firewall; third-party firewalls that comply with this recommendation have the certified logo from Microsoft. - -An organization typically uses this design as a first step toward a more comprehensive Windows Defender Firewall design that adds server isolation and domain isolation. - -After implementing this design, you'll have centralized management of the firewall rules applied to all devices that are running Windows in your organization. - -> [!IMPORTANT] -> If you also intend to deploy the [Domain Isolation Policy Design](domain-isolation-policy-design.md), or the [Server Isolation Policy Design](server-isolation-policy-design.md), we recommend that you do the design work for all three designs together, and then deploy in layers that correspond with each design. - -The basic firewall design can be applied to devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the firewall settings and rules. - -For more information about this design: - -- This design coincides with the deployment goal to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) -- To learn more about this design, see [Firewall Policy Design Example](firewall-policy-design-example.md) -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) -- To help you make the decisions required in this design, see [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) -- For a list of detailed tasks that you can use to deploy your basic firewall policy design, see [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) - -> [!div class="nextstepaction"] -> [Domain Isolation Policy Design](domain-isolation-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md deleted file mode 100644 index 16684e9cbd..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Boundary Zone GPOs -description: Learn about GPOs to create that must align with the group you create for the boundary zone in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Boundary Zone GPOs - - -All the devices in the boundary zone are added to the group CG\_DOMISO\_Boundary. You must create multiple GPOs to align with this group, one for each operating system that you have in your boundary zone. This group is granted Read and Apply permissions in Group Policy on the GPOs described in this section. - ->**Note:**  If you are designing GPOs for at least Windows Vista or Windows Server 2008, you can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. - -This recommendation means that you create a GPO for a boundary group for a specific operating system by copying and pasting the corresponding GPO for the isolated domain, and then modifying the new copy to provide the behavior required in the boundary zone. - -The boundary zone GPOs discussed in this guide are only for server versions of Windows because client devices aren't expected to participate in the boundary zone. If the need for one occurs, either create a new GPO for that version of Windows or expand the WMI filter attached to one of the existing boundary zone GPOs to make it apply to the client version of Windows. - -In the Woodgrove Bank example, only the GPO settings for a Web service on at least Windows Server 2008 are discussed. - -- [GPO\_DOMISO\_Boundary\_WS2008](gpo-domiso-boundary.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md deleted file mode 100644 index 36a61d385c..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Boundary Zone -description: Learn how a boundary zone supports devices that must receive traffic from beyond an isolated domain in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Boundary Zone - - -In most organizations, some devices can receive network traffic from devices that aren't part of the isolated domain, and therefore can't authenticate. To accept communications from untrusted devices, create a boundary zone within your isolated domain. - -Devices in the boundary zone are trusted devices that can accept communication requests both from other isolated domain member devices and from untrusted devices. Boundary zone devices try to authenticate any incoming request by using IPsec, initiating an IKE negotiation with the originating device. - -The GPOs you build for the boundary zone include IPsec or connection security rules that request authentication for both inbound and outbound network connections, but don't require it. - -These boundary zone devices might receive unsolicited inbound communications from untrusted devices that use plaintext and must be carefully managed and secured in other ways. Mitigating this extra risk is an important part of deciding whether to add a device to the boundary zone. For example, completing a formal business justification process before adding each device to the boundary zone minimizes the extra risk. The following illustration shows a sample process that can help make such a decision. - -![design flowchart.](images/wfas-designflowchart1.gif) - -The goal of this process is to determine whether the risk of adding a device to a boundary zone can be mitigated to a level that makes it acceptable to the organization. Ultimately, if the risk can't be mitigated, membership must be denied. - -You must create a group in Active Directory to contain the members of the boundary zones. The settings and rules for the boundary zone are typically similar to those settings and rules for the isolated domain, and you can save time and effort by copying those GPOs to serve as a starting point. The primary difference is that the authentication connection security rule must be set to request authentication for both inbound and outbound traffic, instead of requiring inbound authentication and requesting outbound authentication as used by the isolated domain. - - [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section discusses creation of the group and how to link it to the GPOs that apply the rules to members of the group. - -## GPO settings for boundary zone servers running at least Windows Server 2008 - - -The boundary zone GPO for devices running at least Windows Server 2008 should include the following components: - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES, and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. We recommend that you don't include DES or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, use ESP encapsulation. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then you must also include user-based Kerberos V5 authentication as an optional authentication method. Likewise, if any of your domain isolation members can't use Kerberos V5, you must include certificate-based authentication as an optional authentication method. - -- The following connection security rules: - - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment. - - - A connection security rule, from **Any IP address** to **Any IP address**, that requests inbound and outbound authentication. - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) - -**Next:**[Encryption Zone](encryption-zone.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md deleted file mode 100644 index 8a453cd437..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Certificate-based Isolation Policy Design Example -description: This example uses a fictitious company to illustrate certificate-based isolation policy design in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Certificate-based Isolation Policy Design Example - -This design example continues to use the fictitious company Woodgrove Bank, as described in the sections [Firewall Policy Design Example](firewall-policy-design-example.md), [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md), and [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). - -One of the servers that must be included in the domain isolation environment is a device running UNIX that supplies other information to the WGBank dashboard program running on the client devices. This device sends updated information to the WGBank front-end servers as it becomes available, so it's considered unsolicited inbound traffic to the devices that receive this information. - -## Design requirements - -One possible solution to this design example is to include an authentication exemption rule in the GPO applied to the WGBank front-end servers. This rule would instruct the front-end servers to accept traffic from the non-Windows device even though it can't authenticate. - -A more secure solution, and the one selected by Woodgrove Bank, is to include the non-Windows device in the domain isolation design. Because it can't join an Active Directory domain, Woodgrove Bank chose to use certificate-based authentication. Certificates are cryptographically protected documents, encrypted in such a way that their origin can be positively confirmed. - -In this case, Woodgrove Bank used Active Directory Certificate Services to create the appropriate certificate. They might also have acquired and installed a certificate from a third-party commercial certification authority. They then used Group Policy to deploy the certificate to the front-end servers. The GPOs applied to the front-end servers also include updated connection security rules that permit certificate-based authentication in addition to Kerberos V5 authentication. They then manually installed the certificate on the UNIX server. - -The UNIX server is configured with firewall and IPsec connection security rules using the tools that are provided by the operating system vendor. Those rules specify that authentication is performed by using the certificate. - -The creation of the IPsec connection security rules for a non-Windows device is beyond the scope of this document, but support for a certificate that can be used to authenticate such a non-Windows device by using the standard IPsec protocols is the subject of this design. - -The non-Windows device can be effectively made a member of the boundary zone or the encryption zone based on the IPsec rules applied to the device. The only constraint is that the main mode and quick mode encryption algorithms supported by the UNIX device must also be supported by the Windows-based devices with which it communicates. - -### Other traffic notes - -- None of the capabilities of the other designs discussed in this guide are compromised by the use of certificate authentication by a non-Windows device. - -## Design details - -Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the devices in their organization. - -The inclusion of one or more non-Windows devices to the network requires only a simple addition to the GPOs for devices that must communicate with the non-Windows device. The addition is allowing certificate-based authentication in addition to the Active Directory-supported Kerberos V5 authentication. This certificate-based authoring doesn't require including new rules, just adding certificate-based authentication as an option to the existing rules. - -When multiple authentication methods are available, two negotiating devices agree on the first one in their lists that match. Because most of the devices in Woodgrove Bank's network run Windows, Kerberos V5 is listed as the first authentication method in the rules. Certificate-based authentication is added as an alternate authentication type. - -With the help of the Active Directory Users and Computers snap-in, Woodgrove Bank created a group named NAG_COMPUTER_WGBUNIX. They then added the device accounts to this group for Windows devices that need to communicate with the non-Windows devices. If all the devices in the isolated domain need to be able to access the non-Windows devices, then the **Domain Computers** group can be added to the group as a member. - -Woodgrove Bank then created a GPO that contains the certificate, and then attached security group filters to the GPO that allow read and apply permissions to only members of the NAG_COMPUTER_WGBUNIX group. The GPO places the certificate in the **Local Computer / Personal / Certificates** certificate store. The certificate used must chain back to a certificate that is in the **Trusted Root Certification Authorities** store on the local device. - -> [!div class="nextstepaction"] -> -> [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md deleted file mode 100644 index f55fd96a04..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Certificate-based Isolation Policy Design -description: Explore the methodology behind Certificate-based Isolation Policy Design and how it defers from Domain Isolation and Server Isolation Policy Design. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Certificate-based isolation policy design - -In the certificate-based isolation policy design, you provide the same types of protections to your network traffic as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Server Isolation Policy Design](server-isolation-policy-design.md) sections. The only difference is the method used to share identification credentials during the authentication of your network traffic. - -Domain isolation and server isolation help provide security for the devices on the network that run Windows and that can be joined to an Active Directory domain. However, in most corporate environments there are typically some devices that must run another operating system. These devices can't join an Active Directory domain, without a third-party package being installed. Also, some devices that do run Windows can't join a domain for various reasons. To rely on Kerberos V5 as the authentication protocol, the device needs to be joined to the Active Directory and (for non-Windows devices) support Kerberos as an authentication protocol. - -To authenticate with non-domain member devices, IPsec supports using standards-based cryptographic certificates. Because this authentication method is also supported by many third-party operating systems, it can be used as a way to extend your isolated domain to devices that don't run Windows. - -The same principles of the domain and server isolation designs apply to this design. Only devices that can authenticate (in this case, by providing a specified certificate) can communicate with the devices in your isolated domain. - -For Windows devices that are part of an Active Directory domain, you can use Group Policy to deploy the certificates required to communicate with the devices that are trusted but aren't part of the Active Directory domain. For other devices, you'll have to either manually configure them with the required certificates, or use a third-party program to distribute the certificates in a secure manner. - -For more info about this design: - -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). -- To learn more about this design, see [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md). -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). -- To help you make the decisions required in this design, see [Planning Certificate-based Authentication](planning-certificate-based-authentication.md). -- For a list of tasks that you can use to deploy your certificate-based policy design, see [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md deleted file mode 100644 index 16cb030c90..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Documenting the Zones -description: Learn how to document the zone placement of devices in your design for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Documenting the Zones - - -Generally, the task of determining zone membership isn't complex, but it can be time-consuming. Use the information generated during the [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) section of this guide to determine the zone in which to put each host. You can document this zone placement by adding a Group column to the inventory table shown in the Designing a Windows Defender Firewall with Advanced Security Strategy section. A sample is shown here: - -| Host name | Hardware reqs met | Software reqs met | Configuration required | Details | Projected cost | Group | -| - | - | - | - | - | - | -| CLIENT001 | No| No| Upgrade hardware and software.| Current operating system is Windows XP. Old hardware not compatible with newer versions of Windows.| $??| Isolated domain| -| SERVER002 | Yes| No| Join trusted domain, upgrade from Windows Server 2008 to at least Windows Server 2012| No antivirus software present.| $??| Encryption| -| SENSITIVE001 | Yes| Yes| Not required.| Running Windows Server 2012. Ready for inclusion.| $0| Isolated server (in zone by itself)| -| PRINTSVR1 | Yes| Yes| Not required.| Running Windows Server 2008 R2. Ready for inclusion.| $0| Boundary| - -**Next:** [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md deleted file mode 100644 index c01ba555ff..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: Domain Isolation Policy Design Example -description: This example uses a fictitious company to illustrate domain isolation policy design in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Domain Isolation Policy Design Example - - -This design example continues to use the fictitious company Woodgrove Bank, and builds on the example described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section. See that example for an explanation of the basic corporate network infrastructure at Woodgrove Bank with diagrams. - -## Design Requirements - -In addition to the basic protection provided by the firewall rules in the previous design example, you might want to implement domain isolation to provide another layer of security to their networked devices. You can create firewall and connection security rules that use authentication to reduce the risk of communicating with untrusted and potentially hostile devices. - -The following illustration shows the traffic protection needed for this design example. - -![domain isolation policy design.](images/wfas-design2example1.gif) - -1. All devices on the Woodgrove Bank corporate network that are Active Directory domain members must authenticate inbound network traffic as coming from another computer that is a member of the domain. Unless otherwise specified in this section, Woodgrove Bank's devices reject all unsolicited inbound network traffic that isn't authenticated. If the basic firewall design is also implemented, even authenticated inbound network traffic is dropped unless it matches an inbound firewall rule. - -2. The servers hosting the WGPartner programs must be able to receive unsolicited inbound traffic from devices owned by its partners, which aren't members of Woodgrove Bank's domain. - -3. Client devices can initiate non-authenticated outbound communications with devices that aren't members of the domain, such as browsing external Web sites. Unsolicited inbound traffic from non-domain members is blocked. - -4. Devices in the encryption zone require that all network traffic inbound and outbound must be encrypted, in addition to the authentication already required by the isolated domain. - -**Other traffic notes:** - -- All of the design requirements described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section are still enforced. - -## Design Details - -Woodgrove Bank uses Active Directory groups and GPOs to deploy the domain isolation settings and rules to the devices on its network. - -Setting up groups as described here ensures that you don't have to know what operating system a computer is running before assigning it to a group. As in the firewall policy design, a combination of WMI filters and security group filters are used to ensure that members of the group receive the GPO appropriate for the version of Windows running on that computer. For some groups, you might have four or even five GPOs. - -The following groups were created by using the Active Directory Users and Computers MMC snap-in, all devices that run Windows were added to the correct groups, and then the appropriate GPO are applied to the group. To include a device in the isolated domain or any one of its subordinate zones, add the device's account in the appropriate group. - -- **CG\_DOMISO\_ISOLATEDDOMAIN**. The members of this group participate in the isolated domain. After an initial pilot period, followed by a slowly increasing group membership, the membership of this group was eventually replaced with the entry **Domain Computers** to ensure that all devices in the domain participate by default. The WMI filters ensure that the GPO doesn't apply to domain controllers. GPOs with connection security rules to enforce domain isolation behavior are linked to the domain container and applied to the devices in this group. Filters ensure that each computer receives the correct GPO for its operating system type. The rules in the domain isolation GPO require Kerberos v5 authentication for inbound network connections, and request (but not require) it for all outbound connections. - -- **CG\_DOMISO\_NO\_IPSEC**. This group is denied read or apply permissions on any of the domain isolation GPOs. Any computer that can't participate in domain isolation, such as a DHCP server running UNIX, is added to this group. - -- **CG\_DOMISO\_BOUNDARY**. This group contains the computer accounts for all the devices that are part of the boundary group able to receive unsolicited inbound traffic from untrusted devices. Members of the group receive a GPO that configures connection security rules to request (but not require) both inbound and outbound authentication. - -- **CG\_DOMISO\_ENCRYPTION**. This group contains the computer accounts for all the devices that require all inbound and outbound traffic to be both authenticated and encrypted. Members of the group receive a GPO that configures connection security and firewall rules to require both authentication and encryption on all inbound and outbound traffic. - ->**Note:**  If you are designing GPOs for only Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2, you can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, devices that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. - -**Next:** [Server Isolation Policy Design Example](server-isolation-policy-design-example.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md deleted file mode 100644 index abb10fe004..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Domain Isolation Policy Design -description: Learn how to design a domain isolation policy, based on which devices accept only connections from authenticated members of the same isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Domain Isolation Policy Design - - -In the domain isolation policy design, you configure the devices on your network to accept only connections coming from devices that are authenticated as members of the same isolated domain. - -This design typically begins with a network configured as described in the [Basic Firewall Policy Design](basic-firewall-policy-design.md) section. For this design, you then add connection security and IPsec rules to configure devices in the isolated domain to accept only network traffic from other devices that can authenticate as a member of the isolated domain. After the new rules are implemented, your devices reject unsolicited network traffic from devices that aren't members of the isolated domain. - -The isolated domain might not be a single Active Directory domain. It can consist of all the domains in a forest, or domains in separate forests that have two-way trust relationships configured between them. - -By using connection security rules based on IPsec, you provide a logical barrier between devices even if they're connected to the same physical network segment. - -The design is shown in the following illustration, with the arrows that show the permitted communication paths. - -![isolated domain boundary zone.](images/wfasdomainisoboundary.gif) - -Characteristics of this design, as shown in the diagram, include: - -- Isolated domain (area A) - Devices in the isolated domain receive unsolicited inbound traffic only from other members of the isolated domain or from devices referenced in authentication exemption rules. Devices in the isolated domain can send traffic to any device. This traffic includes unauthenticated traffic to devices that aren't in the isolated domain. Devices that can't join an Active Directory domain, but that can use certificates for authentication, can be part of the isolated domain. For more info, see the [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md). - -- Boundary zone (area B) - Devices in the boundary zone are part of the isolated domain but are allowed to accept inbound connections from untrusted devices, such as clients on the Internet. - - Devices in the boundary zone request but don't require authentication to communicate. When a member of the isolated domain communicates with a boundary zone member, the traffic is authenticated. When a device that isn't part of the isolated domain communicates with a boundary zone member the traffic isn't authenticated. - - Because boundary zone devices are exposed to network traffic from untrusted and potentially hostile devices, they must be carefully managed and secured. Put only the devices that must be accessed by external devices in this zone. Use firewall rules to ensure that network traffic is accepted only for services that you want exposed to non-domain member devices. - -- Trusted non-domain members (area C) - Devices on the network that aren't domain members or that can't use IPsec authentication are allowed to communicate by configuring authentication exemption rules. These rules enable devices in the isolated domain to accept inbound connections from these trusted non-domain member devices. - -- Untrusted non-domain members (area D) - Devices that aren't managed by your organization and have an unknown security configuration must have access only to those devices required for your organization to correctly conduct its business. Domain isolation exists to put a logical barrier between these untrusted Devices and your organization's devices. - -After this design is implemented, your administrative team will have centralized management of the firewall and connection security rules applied to the devices in your organization. -> [!IMPORTANT] -> This design builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md), and in turn serves as the foundation for the [Server Isolation Policy Design](server-isolation-policy-design.md). If you plan to deploy all three, we recommend that you do the design work for all three together, and then deploy in the sequence presented. - -This design can be applied to Devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules. - -In order to expand the isolated domain to include Devices that can't be part of an Active Directory domain, see the [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md). - -For more info about this design: - -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), and optionally [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - -- To learn more about this design, see the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md). - -- Before completing the design, gather the info described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). - -- To help you make the decisions required in this design, see [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md). - -- For a list of tasks that you can use to deploy your domain isolation policy design, see [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). - -**Next:** [Server Isolation Policy Design](server-isolation-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md deleted file mode 100644 index eb9e6e58ad..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md +++ /dev/null @@ -1,16 +0,0 @@ ---- -title: Encryption Zone GPOs -description: Learn how to add a device to an encryption zone by adding the device account to the encryption zone group in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Encryption Zone GPOs - - -Handle encryption zones in a similar manner to the boundary zones. A device is added to an encryption zone by adding the device account to the encryption zone group. Woodgrove Bank has a single service that must be protected, and the devices that are running that service are added to the group CG\_DOMISO\_Encryption. This group is granted Read and Apply Group Policy permissions in on the GPO described in this section. - -The GPO is only for server versions of Windows. Client devices aren't expected to participate in the encryption zone. If the need for one occurs, either create a new GPO for that version of Windows or expand the WMI filter attached to one of the existing encryption zone GPOs to make it apply to the client version of Windows. - -- [GPO\_DOMISO\_Encryption](gpo-domiso-encryption.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md deleted file mode 100644 index b421043953..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Encryption Zone -description: Learn how to create an encryption zone to contain devices that host sensitive data and require that the sensitive network traffic be encrypted. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Encryption Zone - - -Some servers in the organization host data that's sensitive, including medical, financial, or other personal data. Government or industry regulations might require that this sensitive information must be encrypted when it's transferred between devices. - -To support the other security requirements of these servers, we recommend that you create an encryption zone to contain the devices and that requires that the sensitive inbound and outbound network traffic is encrypted. - -You must create a group in Active Directory to contain members of the encryption zone. The settings and rules for the encryption zone are typically similar to those settings and rules for the isolated domain, and you can save time and effort by copying those GPOs to serve as a starting point. You then modify the security methods list to include only algorithm combinations that include encryption protocols. - -Creation of the group and how to link it to the GPOs that apply the rules to members of the group are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -## GPO settings for encryption zone servers running at least Windows Server 2008 - - -The GPO for devices that are running at least Windows Server 2008 should include: - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. Check **Require encryption for all connection security rules that use these settings**, and then specify one or more integrity and encryption combinations. We recommend that you don't include DES or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, use ESP encapsulation.. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then you must also include user-based Kerberos V5 authentication as an optional authentication method. Likewise, if any of your domain isolation members can't use Kerberos V5 authentication, then you must include certificate-based authentication as an optional authentication method. - -- The following connection security rules: - - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment. - - - A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication using the default authentication specified earlier in this policy. - - **Important**   - Be sure to begin operations by using request in and request out behavior until you're sure that all the devices in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the GPO to require in, request out. - - - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md). - -- If domain member devices must communicate with devices in the encryption zone, ensure that you include in the isolated domain GPOs quick mode combinations that are compatible with the requirements of the encryption zone GPOs. - -**Next:** [Planning Server Isolation Zones](planning-server-isolation-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md b/windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md deleted file mode 100644 index cb0b5ee9e1..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Exemption List -description: Learn about reasons to add devices to an exemption list in Windows Defender Firewall with Advanced Security and the trade-offs of having too many exemptions. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Exemption List - - -When you implement a server and domain isolation security model in your organization, you're likely to find more challenges. Key infrastructure servers such as DNS servers and DHCP servers typically must be available to all devices on the internal network, yet secured from network attacks. However, if they must remain available to all devices on the network, not just to isolated domain members, then these servers can't require IPsec for inbound access, nor can they use IPsec transport mode for outbound traffic. - -In addition to the infrastructure servers mentioned earlier, there might also be other servers on the network that trusted devices can't use IPsec to access, which would be added to the exemption list. - -Generally, the following conditions are reasons to consider adding a device to the exemption list: - -- If the device must be accessed by trusted devices but it doesn't have a compatible IPsec implementation. - -- If the device must provide services to both trusted and untrusted devices, but doesn't meet the criteria for membership in the boundary zone. - -- If the device must be accessed by trusted devices from different isolated domains that don't have an Active Directory trust relationship established with each other. - -- If the device is a domain controller running version of Windows earlier than Windows Server 2008, or if any of its clients are running a version of Windows earlier than Windows Vista. - -- If the device must support trusted and untrusted devices, but can't use IPsec to help secure communications to trusted devices. - -For large organizations, the list of exemptions might grow large if all the exemptions are implemented by one connection security rule for the whole domain or for all trusted forests. If you can require all devices in your isolated domain to run at least Windows Vista or Windows Server 2008, you can greatly reduce the size of this list. A large exemption list has several unwanted effects on every device that receives the GPO, including the following effects: - -- Reduces the overall effectiveness of isolation. - -- Creates a larger management burden (because of frequent updates). - -- Increases the size of the IPsec policy, which means that it consumes more memory and CPU resources, slows down network throughput, and increases the time required to download and apply the GPO containing the IPsec policy. - -To keep the number of exemptions as small as possible, you have several options: - -- Carefully consider the communications requirements of each isolation zone, especially server-only zones. They might not be required to communicate with every exemption in the domain-level policy for clients. - -- Consolidate server functions. If several exempt services can be hosted at one IP address, the number of exemptions is reduced. - -- Consolidate exempted hosts on the same subnet. Where network traffic volume allows, you might be able to locate the servers on a subnet that is exempted, instead of using exemptions for each IP address. - -As with defining the boundary zone, create a formal process to approve hosts being added to the exemption list. For a model of processing requests for exemptions, see the decision flowchart in the [Boundary Zone](boundary-zone.md) section. - -**Next:** [Isolated Domain](isolated-domain.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md deleted file mode 100644 index 526ffd83a3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md +++ /dev/null @@ -1,14 +0,0 @@ ---- -title: Firewall GPOs -description: In this example, a Group Policy Object is linked to the domain container because the domain controllers aren't part of the isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Firewall GPOs - - -All the devices on Woodgrove Bank's network that run Windows are part of the isolated domain, except domain controllers. To configure firewall rules, the GPO described in this section is linked to the domain container in the Active Directory OU hierarchy, and then filtered by using security group filters and WMI filters. - -The GPO created for the example Woodgrove Bank scenario includes [GPO\_DOMISO\_Firewall](gpo-domiso-firewall.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md deleted file mode 100644 index f290a9943c..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md +++ /dev/null @@ -1,100 +0,0 @@ ---- -title: Basic Firewall Policy Design Example -description: This example features a fictitious company and illustrates firewall policy design for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Basic Firewall Policy Design Example - - -In this example, the fictitious company Woodgrove Bank is a financial services institution. - -Woodgrove Bank has an Active Directory domain that provides Group Policy-based management for all their Windows devices. The Active Directory domain controllers also host Domain Name System (DNS) for host name resolution. Separate devices host Windows Internet Name Service (WINS) for network basic input/output system (NetBIOS) name resolution. A set of devices that are running UNIX provide the Dynamic Host Configuration Protocol (DHCP) services for automatic IP addressing. - -Woodgrove Bank is in the process of migrating their devices from Windows Vista and Windows Server 2008 to Windows 10 and Windows Server 2016. A significant number of the devices at Woodgrove Bank continue to run Windows Vista and Windows Server 2008. Interoperability between the previous and newer operating systems must be maintained. Wherever possible, security features applied to the newer operating systems must also be applied to the previous operating systems. - -A key line-of-business program called WGBank consists of a client program running on most of the desktop devices in the organization. This program accesses several front-end server devices that run the server-side part of WGBank. These front-end servers only do the processing—they don't store the data. The data is stored in several back-end database devices that are running Microsoft SQL Server. - -## Design requirements - -The network administrators want to implement Windows Defender Firewall with Advanced Security throughout their organization to provide another security layer to their overall security strategy. They want to create firewall rules that allow their business programs to operate, while blocking network traffic that isn't wanted. - -The following illustration shows the traffic protection needs for this design example. - -![design example 1.](images/wfas-designexample1.gif) - -1. The network infrastructure servers that are running services, such as Active Directory, DNS, DHCP, or WINS, can receive unsolicited inbound requests from network clients. The network clients can receive the responses from the infrastructure servers. - -2. The WGBank front-end servers can receive unsolicited inbound traffic from the client devices and the WGBank partner servers. The WGBank client devices and partner servers can receive the response. - -3. The WGBank front-end servers can send updated information to the client devices to support real-time display. The clients don't poll for this unsolicited traffic, but must be able to receive it. - -4. The WGBank back-end servers can receive SQL query requests from the WGBank front-end servers. The WGBank front-end servers can receive the corresponding responses. - -5. There's no direct communications between the client devices and the WGBank back-end devices. - -6. There's no unsolicited traffic from the WGBank back-end devices to the WGBank front-end servers. - -7. Company policy prohibits the use of peer-to-peer file transfer software. A recent review by the IT staff found that although the perimeter firewall does prevent most of the programs in this category from working, two programs are being used by staff members that don't require an outside server. Firewall rules must block the network traffic created by these programs. - -8. The WGBank partner servers can receive inbound requests from partner devices through the Internet. - -Other traffic notes: - -- Devices aren't to receive any unsolicited traffic from any computer other than allowed above. - -- Other outbound network traffic from the client devices not identified in this example is permitted. - -## Design details - - -Woodgrove Bank uses Active Directory groups and Group Policy Objects to deploy the firewall settings and rules to the devices on their network. They know that they must deploy policies to the following collections of devices: - -- Client devices that run Windows 11, Windows 10, Windows 8, or Windows 7 - -- WGBank front-end servers that run Windows Server 2016, Windows Server 2012 R2, Windows Server 2012 or Windows Server 2008 R2 (there are none in place yet, but their solution must support adding them) - -- WGBank partner servers that run Windows Server 2008 - -- WGBank back-end SQL Server devices that run Windows Server 2008 (there are none in place yet, but their solution must support adding them) - -- Infrastructure servers that run Windows Server 2008 - -- Active Directory domain controllers that run Windows Server 2008 R2 or Windows Server 2012 - -- DHCP servers that run the UNIX operating system - -After the Woodgrove Bank network administrators evaluated these sets of devices, and compared them to the Active Directory organizational unit (OU) structure, they determined that there wasn't a good one-to-one match between the OUs and the sets. Therefore the firewall GPOs won't be linked directly to OUs that hold the relevant devices. Instead, the GPOs are linked to the domain container in Active Directory, and then WMI and group filters are attached to the GPO to ensure that it's applied to the correct devices. - -Setting up groups as described here ensures that you don't have to know what operating system a computer is running before assigning it to a group. A combination of WMI filters and security group filters are used to ensure that members of the group receive the GPO appropriate for the version of Windows running on that computer. For some groups, you might have four or even five GPOs. - -The following groups were created by using the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, and all devices that run Windows were added to the correct groups: - -- **CG\_FIREWALL\_ALLCOMPUTERS**. Add the predefined and system managed **Domain computers** group as a member of this group. All members of the FIREWALL\_ALLCOMPUTERS group receive an operating system-specific GPO with the common firewall rules applied to all devices. - - The two device types (client and server) are distinguished by using a WMI filters to ensure that only the policy intended for devices that are running a client version of Windows can be applied to that computer. A similar WMI filter on the server GPO ensures that only devices that are running server versions of Windows can apply that GPO. Each of the GPOs also has security group filters to prevent members of the group FIREWALL\_NO\_DEFAULT from receiving either of these two GPOs. - - - Client devices receive a GPO that configures Windows Defender Firewall to enforce the default Windows Defender Firewall behavior (allow outbound, block unsolicited inbound). The client default GPO also includes the built-in firewall rule groups Core Networking and File and Printer Sharing. The Core Networking group is enabled for all profiles, whereas the File and Printer Sharing group is enabled for only the Domain and Private profiles. The GPO also includes inbound firewall rules to allow the WGBank front-end server dashboard update traffic, and rules to prevent company-prohibited programs from sending or receiving network traffic, both inbound and outbound. - - - Server devices receive a GPO that includes similar firewall configuration to the client computer GPO. The primary difference is that the rules are enabled for all profiles (not just domain and private). Also, the rules for WGBank dashboard update aren't included, because it's not needed on server devices. - - All rules are scoped to allow network traffic only from devices on Woodgrove Bank's corporate network. - -- **CG\_FIREWALL\_NO\_DEFAULT**. Members of this group don't receive the default firewall GPO. Devices are added to this group if there's a business requirement for it to be exempted from the default firewall behavior. The use of a group to represent the exceptions instead of the group members directly makes it easier to support the dynamic nature of the client computer population. A new computer joined to the domain is automatically given the appropriate default firewall GPO, unless it's a member of this group. - -- **CG\_FIREWALL\_WGB\_FE**. This group contains the computer accounts for all the WGBank front-end server devices. Members of this group receive a GPO that configures Windows Defender Firewall with inbound firewall rules to allow unsolicited WGBank client traffic. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_WGB\_SQL**. This group contains the computer accounts for all the WGBank back-end devices that run SQL Server. Members of this group receive a GPO that configures Windows Defender Firewall with inbound firewall rules to allow the SQL Server program to receive unsolicited queries only from the WGBank front-end servers. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_BOUNDARY\_WGBANKFE**. This group contains the computer accounts for the servers that host Web services that can be accessed from the Internet. Members of this group receive a GPO that adds an inbound firewall rule to allow inbound HTTP and HTTPS network traffic from any address, including the Internet. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_WINS**. This group contains the computer accounts for all the WINS server devices. Members of this group receive a GPO that configures Windows Defender Firewall with an inbound firewall rule to allow unsolicited inbound requests from WINS clients. Devices in this group also receive the default firewall GPO. - -- **CG\_FIREWALL\_ADDC**. This group contains all the computer accounts for the Active Directory domain controller server devices. Members of this group receive a GPO that configures Windows Defender Firewall with inbound firewall rules to allow unsolicited Active Directory client and server-to-server traffic. Devices in this group also receive the default firewall GPO. - -In your own design, create a group for each computer role in your organization that requires different or more firewall rules. For example, file servers and print servers require more rules to allow the incoming network traffic for those functions. If a function is ordinarily performed on most devices on the network, you might consider adding devices performing those roles to the common default firewall GPO set, unless there's a security reason not to include it there. - -**Next:** [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md deleted file mode 100644 index 741f91081d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: GPO\_DOMISO\_Boundary -description: This example GPO supports devices that aren't part of the isolated domain to access specific servers that must be available to those untrusted devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_Boundary - - -This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. - -This GPO supports the ability for devices that aren't part of the isolated domain to access specific servers that must be available to those untrusted devices. It's intended to only apply to server devices that are running at least Windows Server 2008. - -## IPsec settings - -The copied GPO includes and continues to use the IPsec settings that configure key exchange, main mode, and quick mode algorithms for the isolated domain when authentication can be used. - -## Connection security rules - - -Rename the **Isolated Domain Rule** to **Boundary Zone Rule**. Change the authentication mode to **Request inbound and request outbound**. In this mode, the device uses authentication when it can, such as during communication with a member of the isolated domain. It also supports the "fall back to clear" ability of request mode when an untrusted device that isn't part of the isolated domain connects. - -## Registry settings - - -The boundary zone uses the same registry settings as the isolated domain to optimize IPsec operation. For more information, see the description of the registry settings in [Isolated Domain](isolated-domain.md). - -## Firewall rules - - -Copy the firewall rules for the boundary zone from the GPO that contains the firewall rules for the isolated domain. Customize this copy, removing rules for services not needed on servers in this zone, and adding inbound rules to allow the network traffic for the services that are to be accessed by other devices. For example, Woodgrove Bank added a firewall rule to allow inbound network traffic to TCP port 80 for Web client requests. - -Make sure that the GPO that contains firewall rules for the isolated domain doesn't also apply to the boundary zone to prevent overlapping, and possibly conflicting rules. - -**Next:** [Encryption Zone GPOs](encryption-zone-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md deleted file mode 100644 index b5d7b1384b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: GPO\_DOMISO\_Encryption\_WS2008 -description: This example GPO supports the ability for servers that contain sensitive data to require encryption for all connection requests. -ms.topic: conceptual -ms.prod: windows-client -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_Encryption\_WS2008 - - -This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. Woodgrove Bank began by copying and pasting the GPO for the Windows Server 2008 version of the isolated domain GPO, and then renamed the copy to reflect its new purpose. - -This GPO supports the ability for servers that contain sensitive data to require encryption for all connection requests. It's intended to only apply to server computers that are running Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. - -## IPsec settings - - -The copied GPO includes and continues to use the IPsec settings that configure key exchange, main mode, and quick mode algorithms for the isolated domain. The following changes are made to encryption zone copy of the GPO: - -The encryption zone servers require all connections to be encrypted. To do this encryption, change the IPsec default settings for the GPO to enable the setting **Require encryption for all connection security rules that use these settings**. This setting disables all integrity-only algorithm combinations. - -## Connection security rules - - -Rename the **Isolated Domain Rule** to **Encryption Zone Rule**. Leave the authentication mode setting on **Require inbound and request outbound**. In this mode, the computer forces authentication for all inbound network traffic, and uses it when it can on outbound traffic. - -## Registry settings - - -The encryption zone uses the same registry settings as the isolated domain to optimize IPsec operation. For more information, see the description of the registry settings in [Isolated Domain](isolated-domain.md). - -## Firewall rules - - -Copy the firewall rules for the encryption zone from the GPO that contains the firewall rules for the isolated domain. Customize this copy, removing rules for services not needed on servers in this zone, and adding inbound rules to allow the network traffic for the services that are to be accessed by other computers. For example, Woodgrove Bank added a firewall rule to allow inbound network traffic to TCP port 1433 for SQL Server client requests. - -Change the action for every inbound firewall rule from **Allow the connection** to **Allow only secure connections**, and then select **Require the connections to be encrypted**. - -Make sure that the GPO that contains firewall rules for the isolated domain doesn't also apply to the boundary zone to prevent overlapping, and possibly conflicting rules. - -**Next:** [Server Isolation GPOs](server-isolation-gpos.md) - -  - -  - - - - - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md deleted file mode 100644 index 057cf7bdf5..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: GPO\_DOMISO\_Firewall -description: Learn about the settings and rules in this example GPO, which is authored by using the Group Policy editing tools. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_Firewall - - -This GPO is authored by using the Windows Defender Firewall -with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It is intended to only apply to devices that are running at least Windows 7 or Windows Server 2008. - -## Firewall settings - -This GPO provides the following settings: - -- Unless otherwise stated, the firewall rules and settings described here are applied to all profiles. - -- The firewall is enabled, with inbound, unsolicited connections blocked and outbound connections allowed. - -- Under the domain profile, the settings **Display notifications to the user**, **Apply local firewall rules**, and **Apply local connection security rules** are all set to **No**. These settings are applied only to the domain profile because the devices can only receive an exception rule for a required program from a GPO if they are connected to the domain. Under the public and private profiles, those settings are all set to **Yes**. - - >**Note:**  Enforcing these settings requires that you define any firewall exceptions for programs, because the user cannot manually permit a new program. You must deploy the exception rules by adding them to this GPO. We recommend that you do not enable these settings until you have tested all your applications and have tested the resulting rules in a test lab and then on pilot devices. - -## Firewall rules - -This GPO provides the following rules: - -- Built-in firewall rule groups are configured to support typically required network operation. The following rule groups are set to **Allow the connection**: - - - Core Networking - - - File and Printer Sharing - - - Network Discovery - - - Remote Administration - - - Remote Desktop - - - Remote Event Log Management - - - Remote Scheduled Tasks Management - - - Remote Service Management - - - Remote Volume Management - - - Windows Defender Firewall Remote Management - - - Windows Management Instrumentation (WMI) - - - Windows Remote Management - -- A firewall exception rule to allow required network traffic for the WGBank dashboard program. This inbound rule allows network traffic for the program Dashboard.exe in the %ProgramFiles%\\WGBank folder. The rule is also filtered to only allow traffic on port 1551. This rule is applied only to the domain profile. - -**Next:** [Isolated Domain GPOs](isolated-domain-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md deleted file mode 100644 index 1f72fa6064..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md +++ /dev/null @@ -1,77 +0,0 @@ ---- -title: GPO\_DOMISO\_IsolatedDomain\_Clients -description: Author this GPO by using Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_IsolatedDomain\_Clients - - -This GPO is authored by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It's intended to only apply to client devices that are running Windows 8, Windows 7, or Windows Vista. - -Because client devices can sometimes be portable, the settings and rules for this GPO are applied to only the domain profile. - -## General settings - -This GPO provides the following settings: - -- No firewall settings are included in this GPO. Woodgrove Bank created separate GPOs for firewall settings (see the [Firewall GPOs](firewall-gpos.md) section) in order to share them with all clients in all isolation zones with minimum redundancy. - -- The ICMP protocol is exempted from authentication requirements to support easier network troubleshooting. - -- Diffie-Hellman Group 2 is specified as the key exchange algorithm. This algorithm is the strongest algorithm available that is supported by all the operating systems that are being used at Woodgrove Bank. After Woodgrove Bank has completed the upgrade to versions of Windows that support stronger algorithms, they can remove the weaker key exchange algorithms, and use only the stronger ones. - -- The registry settings shown in the following table. For more information, see the description of the registry settings in [Isolated Domain](isolated-domain.md). - -| Setting | Value | -| - | - | -| Enable PMTU Discovery | 1 | -| IPsec Exemptions | 3 | - -- The main mode security method combinations in the order shown in the following table. - -| Integrity | Encryption | -| - | - | -| Secure Hash Algorithm (SHA-1) | Advanced Encryption Standard (AES-128) | -| SHA-1 | 3DES | - -- The following quick mode security data integrity algorithms combinations in the order shown in the following table. - -| Protocol | Integrity | Key Lifetime (minutes/KB) | -| - | - | - | -| ESP | SHA-1 | 60/100,000 | - -- The quick mode security data integrity and encryption algorithm combinations in the order shown in the following table. - -| Protocol | Integrity | Encryption | Key Lifetime (minutes/KB) | -| - | - | - | - | -| ESP | SHA-1 | AES-128 | 60/100,000| -| ESP | SHA-1 | 3DES | 60/100,000| - ->**Note:**  Do not use the MD5 and DES algorithms in your GPOs. They are included only for compatibility with previous versions of Windows. - -## Connection Security Rules - -This GPO provides the following rules: - -- A connection security rule named **Isolated Domain Rule** with the following settings: - - - From **Any IP address** to **Any IP address**. - - - **Require inbound and request outbound** authentication requirements. - - >**Important:**  On this, and all other GPOs that require authentication, Woodgrove Bank first chose to only request authentication. After confirming that the devices were successfully communicating by using IPsec, they switched the GPOs to require authentication. - - - For **First authentication methods**, select **Computer Kerberos v5** as the primary method. Add certificate-based authentication from **DC=com,DC=woodgrovebank,CN=CorporateCertServer** for devices that can't run Windows or can't join the domain, but must still participate in the isolated domain. - - - For **Second authentication**, select **User Kerberos v5**, and then select the **Second authentication is optional** check box. - -- A connection security rule to exempt devices that are in the exemption list from the requirement to authenticate: - - - The IP addresses of all devices on the exemption list must be added individually under **Endpoint 2**. - - - Authentication mode is set to **Do not authenticate**. - -**Next:** [GPO\_DOMISO\_IsolatedDomain\_Servers](gpo-domiso-isolateddomain-servers.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md b/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md deleted file mode 100644 index 2ca05d9120..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: GPO\_DOMISO\_IsolatedDomain\_Servers -description: Author this GPO by using the Windows Defender Firewall with Advanced Security interface in the Group Policy editing tools. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# GPO\_DOMISO\_IsolatedDomain\_Servers - - -This GPO is authored by using the Windows Defender Firewall interface in the Group Policy editing tools. The User Configuration section of the GPO is disabled. It's intended to only apply to server devices that are running at least Windows Server 2008. - -Because so many of the settings and rules for this GPO are common to those settings and rules in the GPO for at least Windows Vista, you can save time by exporting the Windows Defender Firewall piece of the GPO for at least Windows Vista, and importing it to the GPO for at least Windows Server 2008. After the import, change only the items specified here: - -- This GPO applies all its settings to all profiles: Domain, Private, and Public. Because a server isn't expected to be mobile and changing networks, configuring the GPO in this way prevents a network failure or the addition of a new network adapter from unintentionally switching the device to the Public profile with a different set of rules (the example of a server running Windows Server 2008). - - >**Important:**  Windows Vista and Windows Server 2008 support only one network location profile at a time. The profile for the least secure network type is applied to the device. If you attach a network adapter to a device that is not physically connected to a network, the public network location type is associated with the network adapter and applied to the device. - -**Next:** [Boundary Zone GPOs](boundary-zone-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md deleted file mode 100644 index bc7273b8b5..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Isolated Domain GPOs -description: Learn about GPOs for isolated domains in this example configuration of Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Isolated Domain GPOs - - -All of the devices in the isolated domain are added to the group CG\_DOMISO\_IsolatedDomain. You must create multiple GPOs to align with this group, one for each Windows operating system that must have different rules or settings to implement the basic isolated domain functionality that you have in your isolated domain. This group is granted Read and Apply Group Policy permissions on all the GPOs described in this section. - -Each GPO has a security group filter that prevents the GPO from applying to members of the group GP\_DOMISO\_No\_IPsec. A WMI filter is attached to each GPO to ensure that the GPO is applied to only the specified version of Windows. For more information, see the [Planning GPO Deployment](planning-gpo-deployment.md) section. - -The GPOs created for the Woodgrove Bank isolated domain include: - -- [GPO\_DOMISO\_IsolatedDomain\_Clients](gpo-domiso-isolateddomain-clients.md) - -- [GPO\_DOMISO\_IsolatedDomain\_Servers](gpo-domiso-isolateddomain-servers.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md deleted file mode 100644 index 9925b88452..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Isolated Domain -description: Learn about the isolated domain, which is the primary zone for trusted devices, which use connection security and firewall rules to control communication. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Isolated Domain - -**Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - -The isolated domain is the primary zone for trusted devices. The devices in this zone use connection security and firewall rules to control the communications that can be sent between devices in the zone. - -The term *domain* in this context means a boundary of communications trust instead of an Active Directory domain. In this solution, the two constructs are similar because Active Directory domain authentication (Kerberos V5) is required for accepting inbound connections from trusted devices. However, many Active Directory domains (or forests) can be linked with trust relationships to provide a single, logical, isolated domain. In addition, devices that authenticate by using certificates can also be included in an isolated domain without joining the Active Directory domain. - -For most implementations, an isolated domain will contain the largest number of devices. Other isolation zones can be created for the solution if their communication requirements differ from those requirements of the isolated domain. Examples of these differences are what result in the boundary and encryption zones described in this guide. Conceptually, the isolated domain is just the largest isolation zone, and a superset to the other zones. - -You must create a group in Active Directory to contain members of the isolated domain. You then apply one of several GPOs that contain connection security and firewall rules to the group so that authentication on all inbound network connections is enforced. Creation of the group and how to link the GPOs that apply the rules to its members are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -The GPOs for the isolated domain should contain the following connection security rules and settings. - -## GPO settings for isolated domain members running at least Windows Vista and Windows Server 2008 - - -GPOs for devices running at least Windows Vista and Windows Server 2008 should include: - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you use at least DH4, AES and SHA2 in your settings. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. We recommend that you don't include DES, or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, use ESP encapsulation. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then also include user-based Kerberos V5 as an optional authentication method. Likewise, if any of your isolated domain members can't use Kerberos V5 authentication, then include certificate-based authentication as an optional authentication method. - -- The following connection security rules: - - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, where possible, instead of discrete addresses, if applicable in your environment. - - - A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication by using Kerberos V5 authentication. - - >**Important:**  Be sure to begin operations by using request in and request out behavior until you are sure that all the devices in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the policy to require in, request out.  - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md). - -**Next:** [Boundary Zone](boundary-zone.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md b/windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md deleted file mode 100644 index 438921b4cf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Mapping your implementation goals to a Windows Firewall with Advanced Security design -description: Mapping your implementation goals to a Windows Firewall with Advanced Security design -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Mapping your implementation goals to a Windows Firewall with Advanced Security design - - -After you finish reviewing the existing Windows Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Firewall with Advanced Security design. -> [!IMPORTANT] -> The first three designs presented in this guide build on each other to progress from simpler to more complex. Therefore during deployment, consider implementing them in the order presented. Each deployed design also provides a stable position from which to evaluate your progress, and to make sure that your goals are being met before you continue to the next design. - -Use the following table to determine which Windows Firewall with Advanced Security design maps to the appropriate combination of Windows Firewall with Advanced Security implementation goals for your organization. This table refers only to the Windows Firewall with Advanced Security designs as described in this guide. However, you can create a hybrid or custom Windows Firewall with Advanced Security design by using any combination of the Windows Firewall with Advanced Security implementation goals to meet the needs of your organization. - -| Deployment Goals | Basic Firewall Policy Design | Domain Isolation Policy Design | Server Isolation Policy Design | Certificate-based Isolation Policy Design | -| - |- | - | - | - | -| [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)| Yes| Yes| Yes| Yes| -| [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) | -| Yes| Yes| Yes| -| [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)| -| -| Yes| Yes| -| [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)| -| Optional| Optional| Optional| - -To examine details for a specific design, click the design title at the top of the column in the preceding table. - -**Next:** [Basic Firewall Policy Design](basic-firewall-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md deleted file mode 100644 index da42f627c0..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Planning Certificate-based Authentication -description: Learn how a device unable to join an Active Directory domain can still participate in an isolated domain by using certificate-based authentication. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Certificate-based Authentication - - -Sometimes a device can't join an Active Directory domain, and therefore can't use Kerberos V5 authentication with domain credentials. However, the device can still participate in the isolated domain by using certificate-based authentication. - -The non-domain member server, and the clients that must be able to communicate with it, must be configured to use cryptographic certificates based on the X.509 standard. These certificates can be used as an alternate set of credentials. During IKE negotiation, each device sends a copy of its certificate to the other device. Each device examines the received certificate, and then validates its authenticity. To be considered authentic, the received certificate must be validated by a certification authority certificate in the recipient's Trusted Root Certification Authorities store on the local device. - -Certificates can be acquired from commercial firms, or by an internal certificate server set up as part of the organization's public key infrastructure (PKI). Microsoft provides a complete PKI and certification authority solution with Windows Server 2012, Windows Server 2008 R2, and Windows Server 2008 Active Directory Certificate Services (AD CS). - -## Deploying certificates - -No matter how you acquire your certificates, you must deploy them to clients and servers that require them in order to communicate. - -### Using Active Directory Certificate Services - -If you use AD CS to create your own user and device certificates in-house, then the servers designated as certification authorities (CAs) create the certificates based on administrator-designed templates. AD CS then uses Group Policy to deploy the certificates to domain member devices. Device certificates are deployed when a domain member device starts. User certificates are deployed when a user logs on. - -If you want non-domain member devices to be part of a server isolation zone that requires access by only authorized users, make sure to include certificate mapping to associate the certificates with specific user accounts. When certificate mapping is enabled, the certificate issued to each device or user includes enough identification information to enable IPsec to match the certificate to both user and device accounts. - -AD CS automatically ensures that certificates issued by the CAs are trusted by the client devices by putting the CA certificates in the correct store on each domain member device. - -### Using a commercially purchased certificate for devices running Windows - -You can import the certificates manually onto each device if the number of devices is relatively small. For a deployment to more than a handful of devices, use Group Policy. - -You must first download the vendor's root CA certificate, and then import it to a GPO that deploys it to the Local Computer\\Trusted Root Certification Authorities store on each device that applies the GPO. - -You must also import the purchased certificate into a GPO that deploys it to the Local Computer\\Personal store on each device that applies the GPO. - -### Using a commercially purchased certificate for devices running a non-Windows operating system - -If you're installing the certificates on an operating system other than Windows, see the documentation for that operating system. - -## Configuring IPsec to use the certificates - -When the clients and servers have the certificates available, you can configure the IPsec and connection security rules to include those certificates as a valid authentication method. The authentication method requires the subject name of the certificate, for example: **DC=com,DC=woodgrovebank,CN=CorporateCertServer**. Optionally, select **Enable certificate to account mapping** to support using these credentials for restricting access to users or devices that are members of authorized groups in a server isolation solution. - -Starting in Windows Server 2012, you can configure certificate selection criteria so the desired certificate is selected and/or validated. extended key usage (EKU) criteria can be configured, and name restrictions and certificate thumbprints. This EKU is configured using the **Advanced** button when choosing certificates for the authentication method in the user interface, or through Windows PowerShell. - -**Next:** [Documenting the Zones](documenting-the-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md deleted file mode 100644 index 70214d68c5..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Planning Domain Isolation Zones -description: Learn how to use information you've gathered to make decisions about isolation zones for your environment in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Domain Isolation Zones - - -After you have the required information about your network, Active Directory, and client and server devices, you can use that information to make decisions about the isolation zones you want to use in your environment. - -The bulk of the work in planning server and domain isolation is determining which devices to assign to each isolation zone. Correctly choosing the zone for each device is important to providing the correct level of security without compromising performance or the ability for a device to send or receive required network traffic. - -The zones described in this guide include: - -- [Exemption List](exemption-list.md) - -- [Isolated Domain](isolated-domain.md) - -- [Boundary Zone](boundary-zone.md) - -- [Encryption Zone](encryption-zone.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md deleted file mode 100644 index 0370e8cb08..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md +++ /dev/null @@ -1,110 +0,0 @@ ---- -title: Planning GPO Deployment -description: Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning GPO Deployment - - -You can control which GPOs are applied to devices in Active Directory in a combination of three ways: - -- **Active Directory organizational unit hierarchy**. This method involves linking the GPO to a specific OU in the Active Directory OU hierarchy. All devices in the OU and its subordinate containers receive and apply the GPO. - - Controlling GPO application through linking to OUs is typically used when you can organize the OU hierarchy according to your domain isolation zone requirements. GPOs can apply settings to devices based on their location within Active Directory. If a device is moved from one OU to another, the policy linked to the second OU will eventually take effect when Group Policy detects the change during polling. - -- **Security group filtering**. This method involves linking the GPOs to the domain level (or other parent OU) in the OU hierarchy, and then selecting which devices receive the GPO by using permissions that only allow correct group members to apply the GPO. - - The security group filters are attached to the GPOs themselves. A group is added to the security group filter of the GPO in Active Directory, and then assigned Read and Apply Group Policy permissions. Other groups can be explicitly denied Read and Apply Group Policy permissions. Only those devices whose group membership are granted Read and Apply Group Policy permissions without any explicit deny permissions can apply the GPO. - -- **WMI filtering**. A WMI filter is a query that is run dynamically when the GPO is evaluated. If a device is a member of the result set when the WMI filter query runs, the GPO is applied to the device. - - A WMI filter consists of one or more conditions that are evaluated against the local device. You can check almost any characteristic of the device, its operating system, and its installed programs. If all of the specified conditions are true for the device, the GPO is applied; otherwise the GPO is ignored. - -This guide uses a combination of security group filtering and WMI filtering to provide the most flexible options. If you follow this guidance, even though there might be five different GPOs linked to a specific group because of operating system version differences, only the correct GPO is applied. - -## General considerations - -- Deploy your GPOs before you add any device accounts to the groups that receive the GPOs. That way you can add your devices to the groups in a controlled manner. Be sure to add only a few test devices at first. Before adding many group members, examine the results on the test devices and verify that the configured firewall and connection security rules have the effect that you want. See the following sections for some suggestions on what to test before you continue. - -## Test your deployed groups and GPOs - -After you've deployed your GPOs and added some test devices to the groups, confirm the following before you continue with more group members: - -- Examine the GPOs that are both assigned to and filtered from the device. Run the **gpresult** tool at a command prompt. - -- Examine the rules deployed to the device. Open the Windows Defender Firewall MMC snap-in, expand the **Monitoring** node, and then expand the **Firewall** and **Connection Security** nodes. - -- Verify that communications are authenticated. Open the Windows Defender Firewall MMC snap-in, expand the **Monitoring** node, expand the **Security Associations** node, and then click **Main Mode**. - -- Verify that communications are encrypted when the devices require it. Open the Windows Defender Firewall MMC snap-in, expand the **Monitoring** node, expand the **Security Associations** node, and then select **Quick Mode**. Encrypted connections display a value other than **None** in the **ESP Confidentiality** column. - -- Verify that your programs are unaffected. Run them and confirm that they still work as expected. - -After you've confirmed that the GPOs have been correctly applied, and that the devices are now communicating by using IPsec network traffic in request mode, you can begin to add more devices to the group accounts, in manageable numbers at a time. Continue to monitor and confirm the correct application of the GPOs to the devices. - -## Don't enable require mode until deployment is complete - -If you deploy a GPO that requires authentication to a device before the other devices have a GPO deployed, communication between them might not be possible. Wait until you have all the zones and their GPOs deployed in request mode and confirm (as described in the previous section) that the devices are successfully communicating by using IPsec. - -If there are problems with GPO deployment, or errors in configuration of one or more of the IPsec GPOs, devices can continue to operate, because request mode enables any device to fall back to clear communications. - -Only after you've added all of the devices to their zones, and you've confirmed that communications are working as expected, you can start changing the request mode rules to require mode rules where it's required in the zones. We recommend that you enable require mode in the zones one zone at a time, pausing to confirm that they're functioning properly before you continue. Turn the required mode setting on for the server isolation zones first, then the encryption zone, and then the isolated domain. - -Don't change the boundary zone GPO, because it must stay in request mode for both inbound and outbound connections. - -If you create other zones that require either inbound or outbound require mode, make the setting change in a manner that applies the setting in stages from the smaller groups of devices to the larger groups. - -## Example Woodgrove Bank deployment plans - -Woodgrove Bank links all its GPOs to the domain level container in the Active Directory OU hierarchy. It then uses the following WMI filters and security group filters to control the application of the GPOs to the correct subset of devices. All of the GPOs have the User Configuration section disabled to improve performance. - -### GPO\_DOMISO\_Firewall - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType <> "2"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_IsolatedDomain. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_IsolatedDomain\_Clients - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "1"` - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_IsolatedDomain. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the group CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_IsolatedDomain\_Servers - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "3"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices that are running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_IsolatedDomain. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the group CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_Boundary - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "3"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices that are running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply Group Policy permissions only to devices that are members of the group CG\_DOMISO\_Boundary. The GPO also explicitly denies Read and Apply Group Policy permissions to members of the group CG\_DOMISO\_NO\_IPSEC. - -### GPO\_DOMISO\_Encryption - -- **WMI filter**. The WMI filter allows this GPO to apply only to devices that match the following WMI query: - - `select * from Win32_OperatingSystem where Version like "6.%" and ProductType = "3"` - - >**Note:**  This excludes domain controllers (which report a ProductType value of 2). Do not include domain controllers in the isolated domain if there are devices that are running versions of Windows earlier than Windows Vista and Windows Server 2008. - -- **Security filter**. This GPO grants Read and Apply permissions in Group Policy only to devices that are members of the group CG\_DOMISO\_Encryption. The GPO also explicitly denies Read and Apply permissions in Group Policy to members of the group CG\_DOMISO\_NO\_IPSEC. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md deleted file mode 100644 index 2dc15edfc9..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Planning Group Policy Deployment for Your Isolation Zones -description: Learn how to plan a group policy deployment for your isolation zones after you determine the best logical design for your isolation environment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Group Policy Deployment for Your Isolation Zones - - -After you've decided on the best logical design of your isolation environment for the network and device security requirements, you can start the implementation plan. - -You have a list of isolation zones with the security requirements of each. For implementation, you must plan the groups that will hold the device accounts in each zone, the network access groups that will be used to determine who can access an isolated server, and the GPOs with the connection security and firewall rules to apply to corresponding groups. Finally you must determine how you'll ensure that the policies will only apply to the correct devices within each group. - -- [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) - -- [Planning Network Access Groups](planning-network-access-groups.md) - -- [Planning the GPOs](planning-the-gpos.md) - -- [Planning GPO Deployment](planning-gpo-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md deleted file mode 100644 index b58bf3b769..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Planning Isolation Groups for the Zones -description: Learn about planning isolation groups for the zones in Microsoft Firewall, including information on universal groups and GPOs. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Isolation Groups for the Zones - - -Isolation groups in Active Directory are how you implement the various domain and server isolation zones. A device is assigned to a zone by adding its device account to the group that represents that zone. - -> [!CAUTION] -> Do not add devices to your groups yet. If a device is in a group when the GPO is activated then that GPO is applied to the device. If the GPO is one that requires authentication, and the other devices have not yet received their GPOs, the device that uses the new GPO might not be able to communicate with the others. - -Universal groups are the best option to use for GPO assignment because they apply to the whole forest and reduce the number of groups that must be managed. However, if universal groups are unavailable, you can use domain global groups instead. - -The following table lists typical groups that can be used to manage the domain isolation zones discussed in the Woodgrove Bank example in this guide: - -| Group name | Description | -| - | - | -| CG_DOMISO_No_IPsec | A universal group of device accounts that don't participate in the IPsec environment. Typically consists of infrastructure device accounts that will also be included in exemption lists.
    This group is used in security group filters to ensure that GPOs with IPsec rules aren't applied to group members.| -| CG_DOMISO_IsolatedDomain | A universal group of device accounts that contains the members of the isolated domain.
    During the early days of testing, this group might contain only a small number of devices. During production, it might contain the built-in **Domain Computers** group to ensure that every device in the domain participates.
    Members of this group receive the domain isolation GPO that requires authentication for inbound connections.| -| CG_DOMISO_Boundary | A universal group of device accounts that contains the members of the boundary zone.

    Members of this group receive a GPO that specifies that authentication is requested, but not required.| -| CG_DOMISO_Encryption | A universal group of device accounts that contains the members of the encryption zone.
    Members of this group receive a GPO that specifies that both authentication and encryption are required for all inbound connections. -| CG_SRVISO_*ServerRole* | A universal group of device accounts that contains the members of the server isolation group.
    Members of this group receive the server isolation GPO that requires membership in a network access group in order to connect.
    There will be one group for each set of servers that have different user and device restriction requirements. | - -Multiple GPOs might be delivered to each group. Which one actually becomes applied depends on the security group filters assigned to the GPOs in addition to the results of any WMI filtering assigned to the GPOs. Details of the GPO layout are discussed in the section [Planning the GPOs](planning-the-gpos.md). - -If multiple GPOs are assigned to a group, and similar rules are applied, the rule that most specifically matches the network traffic is the one that is used by the device. For example, if one IPsec rule says to request authentication for all IP traffic, and a second rule from a different GPO says to require authentication for IP traffic to and from a specific IP address, then the second rule takes precedence because it's more specific. - -**Next:** [Planning Network Access Groups](planning-network-access-groups.md) - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md deleted file mode 100644 index 436bc55bbd..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Planning Network Access Groups -description: Learn how to implement a network access group for users and devices that can access an isolated server in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Network Access Groups - - -A network access group (NAG) is used to identify users and devices that have permission to access an isolated server. The server is configured with firewall rules that allow only network connections that are authenticated as originating from a device, and optionally a user, whose accounts are members of its NAG. A member of the isolated domain can belong to as many NAGs as required. - -Minimize the number of NAGs to limit the complexity of the solution. You need one NAG for each server isolation group to restrict the devices or users that are granted access. You can optionally split the NAG into two different groups: one for authorized devices and one for authorized users. - -The NAGs that you create and populate become active by referencing them in the **Users and Computers** tab of the firewall rules in the GPO assigned to the isolated servers. The GPO must also contain connection security rules that require authentication to supply the credentials checked for NAG membership. - -For the Woodgrove Bank scenario, access to the devices running SQL Server which support the WGBank application are restricted to the WGBank front-end servers and to approved administrative users logged on to specific authorized administrative devices. They're also only accessed by the approved admin users and the service account that is used to the run the WGBank front end service. - -| NAG Name | NAG Member Users, Computers, or Groups | Description | -| - | - | - | -| CG_NAG_*ServerRole*_Users| Svr1AdminA
    Svr1AdminB
    Group_AppUsers
    AppSvcAccount| This group is for all users who are authorized to make inbound IPsec connections to the isolated servers in this zone.| -| CG_NAG_*ServerRole*_Computers| Desktop1
    Desktop2
    AdminDT1
    AppAdminDT1| This group contains all devices that are authorized to make inbound IPsec connections to the isolated servers in this zone.| - ->**Note:**  Membership in a NAG does not control the level of IPsec traffic protection. The IKE negotiation is only aware of whether the device or user passed or failed the Kerberos V5 authentication process. The connection security rules in the applied GPO control the security methods that are used for protecting traffic and are independent of the identity being authenticated by Kerberos V5. - -**Next:** [Planning the GPOs](planning-the-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md deleted file mode 100644 index c729611dac..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Planning Server Isolation Zones -description: Learn how to restrict access to a server to approved users by using a server isolation zone in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Server Isolation Zones - - -Sometimes a server hosts data that is sensitive. If your servers host data that must not be compromised, you have several options to help protect that data. One was already addressed: adding the server to the encryption zone. Membership in that zone prevents the server from being accessed by any devices that are outside the isolated domain, and encrypts all network connections to server. - -The second option is to additionally restrict access to the server, not just to members of the isolated domain, but to only those users or devices who have business reasons to access the resources on the server. You can specify only approved users, or you can additionally specify that the approved users can only access the server from approved devices. - -To grant access, you add the approved user and device accounts to network access groups (NAGs) that are referenced in a firewall rule on this server. When the user sends a request to the server, the standard domain isolation rules are invoked. This invocation causes IKE to use Kerberos V5 to exchange credentials with the server. The other firewall rule on the server causes Windows to check the provided device and user accounts for group membership in the NAGs. If either the user or device isn't a member of a required NAG, then the network connection is refused. - -## Isolated domains and isolated servers - -If you're using an isolated domain, the client devices already have the IPsec rules to enable them to authenticate traffic when the server requires it. If you add an isolated server, it must have a GPO applied to its group with the appropriate connection security and firewall rules. The rules enforce authentication and restrict access to only connections that are authenticated as coming from an authorized device or user. - -If you aren't using an isolated domain, but still want to isolate a server that uses IPsec, you must configure the client devices that you want to access the server to use the appropriate IPsec rules. If the client devices are members of an Active Directory domain, you can still use Group Policy to configure the clients. Instead of applying the GPO to the whole domain, you apply the GPO to only members of the NAG. - -## Creating multiple isolated server zones - -Each set of servers that must be accessed by different sets of users should be set up in its own isolated server zone. After one set of GPOs for one isolated server zone has been successfully created and verified, you can copy the GPOs to a new set. You must change the GPO names to reflect the new zone, the name and membership of the isolated server zone group to which the GPOs are applied, and the names and membership of the NAG groups that determine which clients can access the servers in the isolated server zone. - -## Creating the GPOs - -Creation of the groups and how to link them to the GPOs that apply the rules to members of the groups are discussed in the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -An isolated server is often a member of the encryption zone. Therefore, copying that GPO set serves as a good starting point. You then modify the rules to additionally restrict access to only NAG members. - -### GPO settings for isolated servers running at least Windows Server 2008 - -GPOs for devices running at least Windows Server 2008 should include: - ->**Note:**  The connection security rules described here are identical to the ones for the encryption zone. If you do not want to encrypt access and also restrict access to NAG members, you can use connection security rules identical to the main isolated domain. You must still add the firewall rule described at the end of this list to change it into an isolated server zone. - -- IPsec default settings that specify the following options: - - 1. Exempt all ICMP traffic from IPsec. - - 2. Key exchange (main mode) security methods and algorithm. We recommend that you don't include Diffie-Hellman Group 1, DES, or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - 3. Data protection (quick mode) algorithm combinations. Check **Require encryption for all connection security rules that use these settings**, and then specify one or more integrity and encryption combinations. We recommend that you don't include DES or MD5 in any setting. They're included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. - - If any NAT devices are present on your networks, don't use AH because it can't traverse NAT devices. If isolated servers must communicate with hosts in the encryption zone, include an algorithm that is compatible with the requirements of the encryption zone GPOs. - - 4. Authentication methods. Include at least device-based Kerberos V5 authentication for compatibility with the rest of the isolated domain. If you want to restrict access to specific user accounts, also include user-based Kerberos V5 authentication as an optional authentication method. Don't make the user-based authentication method mandatory, or else devices that can't use AuthIP instead of IKE, including Windows XP and Windows Server 2003, can't communicate. Likewise, if any of your domain isolation members can't use Kerberos V5, include certificate-based authentication as an optional authentication method. - -- The following connection security and firewall rules: -s - - A connection security rule that exempts all devices on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, if applicable in your environment. - - - A connection security rule, from **Any IP address** to **Any IP address**, that requires inbound and requests outbound authentication by using Kerberos V5 authentication. - - >**Important:**  Be sure to begin operations by using request in and request out behavior until you are sure that all the devices in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the GPO to require in, request out. - - - A firewall rule that specifies **Allow only secure connections**, **Require encryption**, and on the **Users and Computers** tab includes references to both device and user network access groups. - -- A registry policy that includes the following values: - - - Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\\System\\CurrentControlSet\\Services\\TCPIP\\Parameters\\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) sets the value to **1**. - - >**Note:**  For a sample template for these registry settings, see [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md). - -**Next:** [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md deleted file mode 100644 index 98e6a224a8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Planning Settings for a Basic Firewall Policy -description: Learn how to design a basic policy for Windows Defender Firewall with Advanced Security, the settings and rules that enforce your requirements on devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Settings for a Basic Firewall Policy - - -After you've identified your requirements, and have the information about the network layout and devices available, you can begin to design the GPO settings and rules that will enable you to enforce your requirements on the devices. - -The following list is that of the firewall settings that you might consider for inclusion in a basic firewall design, together with recommendations to serve as a starting point for your analysis: - -- **Profile selection**. The firewall rules can be configured for any of the network location profiles that you see in the Network and Sharing Center: **Domain**, **Public**, and **Private**. Most settings are enforced in the Domain profile, without an option for the user to change them. However, you might want to leave the profile settings configurable by the user on devices that can be taken from the organization's physical network and joined to a public or home network. If you lock down the public and private profiles, you might prevent a user from accessing a required network program or service. Because they aren't on the organization's network, you can't fix a connectivity problem by deploying rule changes in a GPO. For each section that follows, consider each profile and apply the rules to those profiles that make sense for your organization. - - >**Important:**  We recommend that on server devices that you set all rules for all profiles to prevent any unexpected profile switch from disrupting network connectivity. You might consider a similar practice for your desktop devices, and only support different profiles on portable devices. - -- **Firewall state: On**. We recommend that you prevent the user from turning it off. - -- **Default behavior for Inbound connections: Block**. We recommend that you enforce the default behavior of blocking unsolicited inbound connections. To allow network traffic for a specific program, create an inbound rule that serves as an exception to this default behavior. - -- **Default behavior for Outbound connections: Allow**. We recommend that you enforce the default behavior of allowing outbound connections. - -- **Allow unicast response: Yes**. We recommend that you use the default setting of **Yes** unless you have specific requirements to do otherwise. - -- **Apply local firewall rules: Yes**. We recommend that you allow users to create and use local firewall rules. If you set this setting to **No**, then when a user clicks **Allow** on the notification message to allow traffic for a new program, Windows doesn't create a new firewall rule and the traffic remains blocked. - - If you and the IT staff can create and maintain the list of firewall rules for all permitted applications and deploy them by using GPOs, then you can set this value to **No**. - -- **Apply local connection security rules: No**. We recommend that you prevent users from creating and using their own connection security rules. Connection failures caused by conflicting rules can be difficult to troubleshoot. - -- **Logging**. We recommend that you enable logging to a file on the local hard disk. Be sure to limit the size, such as 4096 KB, to avoid causing performance problems by filling the user's hard disk. Be sure to specify a folder to which the Windows Defender Firewall with Advanced Security service account has write permissions. - -- **Inbound rules**. Create inbound rules for programs that must be able to receive unsolicited inbound network packets from another device on the network. Make the rules as specific as possible to reduce the risk of malicious programs exploiting the rules. For example, specify both program and port numbers. Specifying a program ensures that the rule is only active when the program is actually running, and specifying the port number ensures that the program can't receive unexpected traffic on a different port. - - Inbound rules are common on servers, because they host services to which client devices connect. When you install programs and services on a server, the installation program typically creates and enables the rules for you. Examine the rules to ensure that they don't open up more ports than are required. - - >**Important:**  If you create inbound rules that permit RPC network traffic by using the **RPC Endpoint Mapper** and **Dynamic RPC** rule options, then all inbound RPC network traffic is permitted because the firewall cannot filter network traffic based on the UUID of the destination application. - -- **Outbound rules**. Only create outbound rules to block network traffic that must be prevented in all cases. If your organization prohibits the use of certain network programs, you can support that policy by blocking the known network traffic used by the program. Be sure to test the restrictions before you deploy them to avoid interfering with traffic for needed and authorized programs. - -**Next:** [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md deleted file mode 100644 index 88716eaf2a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Planning the GPOs -description: Learn about planning Group Policy Objects for your isolation zones in Windows Defender Firewall with Advanced Security, after you design the zone layout. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning the GPOs - - -When you plan the GPOs for your different isolation zones, you must complete the layout of the required zones and their mappings to the groups that link the devices to the zones. - -## General considerations - -A few things to consider as you plan the GPOs: - -- Don't allow a device to be a member of more than one isolation zone. A device in more than one zone receives multiple and possibly contradictory GPOs. This receipt of multiple GPOs can result in unexpected, and difficult to troubleshoot behavior. - - The examples in this guide show GPOs that are designed to prevent the requirement to belong to multiple zones. - -- Ensure that the IPsec algorithms you specify in your GPOs are compatible across all the versions of Windows. The same principle applies to the data integrity and encryption algorithms. We recommend that you include the more advanced algorithms when you have the option of selecting several in an ordered list. The devices will negotiate down from the top of their lists, selecting one that is configured on both devices. - -- The primary difference in your domain isolation GPOs is whether the rules request or require authentication. - - >**Caution:**  It is **critical** that you begin with all your GPOs set to request authentication instead of requiring it. Since the GPOs are delivered to the devices over time, applying a require policy to one device breaks its ability to communicate with another device that has not yet received its policy. Using request mode at the beginning enables devices to continue communicating by using plaintext connections if required. After you confirm that your devices are using IPsec where expected, you can schedule a conversion of the rules in the GPOs from requesting to requiring authentication, as required by each zone. - -- Windows Defender Firewall* in Windows Vista and Windows Server 2008 only support one network location profile at a time. If you add a second network adapter that is connected to a different network, or not connected at all, you could unintentionally change the profile that is currently active on the device. If your GPO specifies different firewall and connection security rules based on the current network location profile, the behavior of how the device handles network traffic will change accordingly. We recommend for stationary devices, such as desktops and servers, that you assign any rule for the device to all profiles. Apply GPOs that change rules per network location to devices that must move between networks, such as your portable devices. Consider creating a separate domain isolation GPO for your servers that uses the same settings as the GPO for the clients, except that the server GPO specifies the same rules for all network location profiles. - -*Windows Defender Firewall is now called Windows Defender Firewall with Advanced Security in Windows 10 and Windows 11. - - > [!NOTE] - > Devices running Windows 7, Windows Server 2008 R2, and later support different network location types, and therefore profiles, for each network adapter at the same time. Each network adapter is assigned the network location appropriate for the network to which it is connected. Windows Defender Firewall then enforces only those rules that apply to that network type’s profile. So certain types of traffic are blocked when coming from a network adapter connected to a public network, but those same types might be permitted when coming from a private or domain network. - -After you consider these issues, document each GPO that you require, and the details about the connection security and firewall rules that it needs. - -## Woodgrove Bank example GPOs - -The Woodgrove Bank example uses the following set of GPOs to support its domain isolation requirements. This section only discusses the rules and settings for server and domain isolation. GPO settings that affect which devices receive the GPO, such as security group filtering and WMI filtering, are discussed in the [Planning GPO Deployment](planning-gpo-deployment.md) section. - -In this section you can find information about: - -- [Firewall GPOs](firewall-gpos.md) - -- [Isolated Domain GPOs](isolated-domain-gpos.md) - -- [Boundary Zone GPOs](boundary-zone-gpos.md) - -- [Encryption Zone GPOs](encryption-zone-gpos.md) - -- [Server Isolation GPOs](server-isolation-gpos.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md deleted file mode 100644 index 7e7bff476d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: Plan to Deploy Windows Defender Firewall with Advanced Security -description: Use the design information in this article to plan for the deployment of Windows Defender Firewall with Advanced Security in your organization. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning to Deploy Windows Defender Firewall with Advanced Security - - -After you collect information about your environment and decide on a design by following the guidance in the [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md), you can begin to plan the deployment of your design. With the completed design and the information in this topic, you can determine which tasks to perform to deploy Windows Defender Firewall with Advanced Security in your organization. - -## Reviewing your Windows Defender Firewall with Advanced Security Design - -If the design team that created the Windows Defender Firewall design for your organization is different from the deployment team that will implement it, make sure the deployment team reviews the final design with the design team. Review the following information before starting your deployment. - -### Decide which devices apply to which GPO - -The design team's strategy for determining how WMI and security group filters attached to the GPOs will determine which devices apply to which GPO. The deployment team can refer to the following topics in the Windows Defender Firewall with Advanced Security Design Guide: - -- [Planning Isolation Groups for the Zones](planning-isolation-groups-for-the-zones.md) - -- [Planning the GPOs](planning-the-gpos.md) - -- [Planning GPO Deployment](planning-gpo-deployment.md) - -### Configure communication between members and devices - -Decide what communication is to be allowed between members of each of the zones in the isolated domain and devices that aren't part of the isolated domain or members of the isolated domain's exemption list. - -### Exempt domain controllers from IPsec authentication requirements - -It's recommended that domain controllers are exempt from IPsec authentication requirements. If they aren't exempt and authentication fails, then domain clients might not be able to receive Group Policy updates to the IPsec connection security rules from the domain controllers. - -### Configure IPsec authentication rules - -The rationale for configuring all IPsec authentication rules to request, not require, authentication until the successful negotiation of IPsec has been confirmed. If the rules are set to require authentication before confirming that authentication is working correctly, then communications between devices might fail. If the rules are set to request authentication only, then an IPsec authentication failure results in fall-back-to-clear behavior. Communications can continue while the authentication failures are investigated. - -### Make sure all devices can communicate with each other - -For all devices to communicate with each other, they must share a common set of: - -- Authentication methods - -- Main mode key exchange algorithms - -- Quick mode data integrity algorithms - -If at least one set of each doesn't match between two devices, then the devices can't successfully communicate. - -## Deploy your Windows Firewall Design Plan - -After the design and deployment teams agree on these issues, they can proceed with the deployment of the Windows Defender Firewall design. For more information, see [Implementing Your Windows Defender Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md b/windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md deleted file mode 100644 index e048764374..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md +++ /dev/null @@ -1,84 +0,0 @@ ---- -title: Planning Your Windows Defender Firewall with Advanced Security Design -description: After you gather the relevant information, select the design or combination of designs for Windows Defender Firewall with Advanced Security in your environment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Planning Your Windows Defender Firewall with Advanced Security Design - - -After you've gathered the relevant information in the previous sections, and understood the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. - -## Basic firewall design - -We recommend that you deploy at least the basic firewall design. As discussed in the [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) section, host-based firewalls are an important element in a defense-in-depth strategy and complement most other security measures you put in place in your organization. - -When you're ready to examine the options for firewall policy settings, see the [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) section. - -## Algorithm and method support and selection - -To create a domain isolation or server isolation design, you must understand the algorithms available in each version of Windows, and their relative strengths. - -## IPsec performance considerations - -Although IPsec is critically important in securing network traffic going to and from your devices, there are costs associated with its use. The mathematically intensive cryptographic algorithms require a significant amount of computing power, which can prevent your device from making use of all of the available bandwidth. For example, an IPsec-enabled device using the AES encryption protocols on a 10 gigabits per second (Gbps) network link might see a throughput of 4.5 Gbps. This reduction is due to the demands placed on the CPU to perform the cryptographic functions required by the IPsec integrity and encryption algorithms. - -IPsec task offload is a Windows technology that supports network adapters equipped with dedicated cryptographic processors to perform the computationally intensive work required by IPsec. This configuration frees up a device’s CPU and can dramatically increase network throughput. For the same network link as above, the throughput with IPsec task offload enabled improves to about 9.2 Gbps. - -## Domain isolation design - - -Include this design in your plans: - -- If you have an Active Directory domain of which most of the devices are members. - -- If you want to prevent the devices in your organization from accepting any unsolicited network traffic from devices that aren't part of the domain. - -If you plan on including the basic firewall design as part of your deployment, we recommend that you deploy the firewall policies first to confirm that they work properly. Also plan to enable your connection security rules in request mode at first, instead of the more restrictive require mode, until you're sure that the devices are all correctly protecting network traffic with IPsec. If something is wrong, request mode still allows communications to continue while you're troubleshooting. - -When you're ready to examine the options for creating an isolated domain, see the [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) section. - -## Server isolation design - - -Include this design in your plans: - -- If you have an isolated domain and you want to additionally restrict access to specific servers to only authorized users and devices. - -- You aren't deploying an isolated domain, but want to take advantage of similar benefits for a few specific servers. You can restrict access to the isolated servers to only authorized users and devices. - -If you plan to include domain isolation in your deployment, we recommend that you complete that layer and confirm its correct operation before you implement the other server isolation elements. - -When you're ready to examine the options for isolating servers, see the [Planning Server Isolation Zones](planning-server-isolation-zones.md) section. - -## Certificate-based authentication design - - -Include this design in your plans: - -- If you want to implement some of the elements of domain or server isolation on devices that aren't joined to an Active Directory domain, or don't want to use domain membership as an authentication mechanism. - -- You have an isolated domain and want to include a server that isn't a member of the Active Directory domain because the device isn't running Windows, or for any other reason. - -- You must enable external devices that aren't managed by your organization to access information on one of your servers in a secure way. - -If you plan to include domain or server isolation in your deployment, we recommend that you complete those elements and confirm their correct operation before you add certificate-based authentication to the devices that require it. - -When you're ready to examine the options for using certificate-based authentication, see the [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) section. - -## Documenting your design - -After you finish selecting the designs that you'll use, you must assign each of your devices to the appropriate isolation zone and document the assignment for use by the deployment team. - -- [Documenting the Zones](documenting-the-zones.md) - -## Designing groups and GPOs - - -After you've selected a design and assigned your devices to zones, you can begin laying out the isolation groups for each zone, the network access groups for isolated server access, and the GPOs that you'll use to apply the settings and rules to your devices. - -When you're ready to examine the options for the groups, filters, and GPOs, see the [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) section. - -**Next:** [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md deleted file mode 100644 index 8ac3b50872..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Server Isolation GPOs -description: Learn about required GPOs for isolation zones and how many server isolation zones you need in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Server Isolation GPOs - -Each set of devices that have different users or devices accessing them require a separate server isolation zone. Each zone requires one GPO for each version of Windows running on devices in the zone. The *Woodgrove Bank* example has an isolation zone for their devices that run SQL Server. The server isolation zone is logically considered part of the encryption zone. Therefore, server isolation zone GPOs must also include rules for encrypting all isolated server traffic. *Woodgrove Bank* copied the encryption zone GPOs to serve as a starting point, and renamed them to reflect their new purpose. - -All of the device accounts for devices in the SQL Server server isolation zone are added to the group *CG_SRVISO_WGBANK_SQL*. This group is granted **Read** and **Apply Group Policy** permissions in on the GPOs described in this section. The GPOs are only for server versions of Windows. Client devices aren't expected to be members of the server isolation zone, although they can access the servers in the zone by being a member of a network access group (NAG) for the zone. - -## GPO_SRVISO - -This GPO is identical to the *GPO_DOMISO_Encryption* GPO with the following changes: - -- The firewall rule that enforces encryption is modified to include the NAGs on the **Users and Computers** tab of the rule. The NAGs-granted permissions include *CG_NAG_SQL_Users* and *CG_NAG_SQL_Computers*. - -## Next steps - -> [!div class="nextstepaction"] -> Learn how to use security group filtering and WMI filtering to provide the most flexible options for applying GPOs to devices in Active Directory. -> -> -> [Plan GPO Deployment >](planning-gpo-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md deleted file mode 100644 index 2a049a459f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Server Isolation Policy Design Example -description: Learn about server isolation policy design in Windows Defender Firewall with Advanced Security by referring to this example of a fictitious company. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Server Isolation Policy Design Example - -This design example continues to use the fictitious company *Woodgrove Bank*, as described in the [Firewall Policy Design Example](firewall-policy-design-example.md) section and the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section. - -In addition to the protections provided by the firewall and domain isolation, *Woodgrove Bank* wants to provide extra protection to the devices that are running Microsoft SQL Server for the WGBank program. They contain personal data, including each customer's financial history. Government and industry rules and regulations specify that access to this information must be restricted to only those users who have a legitimate business need. These rules and regulations include a requirement to prevent interception of and access to the information when it is in transit over the network. - -The information presented by the WGBank front-end servers to the client devices, and the information presented by the WGPartner servers to the remote partner devices, aren't considered sensitive for the purposes of the government regulations, because they're processed to remove sensitive elements before transmitting the data to the client devices. - -In this guide, the examples show server isolation layered on top of a domain isolation design. If you have an isolated domain, the client devices are already equipped with GPOs that require authentication. You only have to add settings to the isolated server(s) to require authentication on inbound connections, and to check for membership in the NAG. The connection attempt succeeds only if NAG membership is confirmed. - -## Server isolation without domain isolation - -Server isolation can also be deployed by itself, to only the devices that must participate. The GPO on the server is no different from the one discussed in the previous paragraph for a server in an existing isolated domain. The difference is that you must also deploy a GPO with supporting connection security rules to the clients that must be able to communicate with the isolated server. Because those devices must be members of the NAG, that group can also be used in a security group filter on the client GPO. That GPO must contain rules that support the authentication requirements of the isolated server. - -In short, instead of applying the client GPO to all clients in the domain, you apply the GPO to only the members of the NAG. - -If you don't have an Active Directory domain, you can manually apply the connection security rules, use a netsh command-line script, or use a Windows PowerShell script to help automate the configuration of the rules on larger numbers of devices. If you don't have an Active Directory domain, you can't use the Kerberos V5 protocol, but instead must provide the clients and the isolated servers with certificates that are referenced in the connection security rules. - -## Design requirements - -In addition to the protection provided by the firewall rules and domain isolation described in the previous design examples, the network administrators want to implement server isolation to help protect the sensitive data stored on the devices that run SQL Server. - -The following illustration shows the traffic protection needs for this design example. - -![isolated server example.](images/wfas-design3example1.gif) - -1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. These accounts include the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it's sent from an authorized computer. Authorization is determined by membership in a network access group (NAG) -1. All network traffic to and from the SQL Server devices must be encrypted -1. Client devices or users whose accounts aren't members of the NAG can't access the isolated servers - -### Other traffic notes - -- All of the design requirements shown in the [Firewall Policy Design Example](firewall-policy-design-example.md) section are still enforced -- All of the design requirements shown in the [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md) section are still enforced - -## Design details - -*Woodgrove Bank* uses Active Directory groups and GPOs to deploy the server isolation settings and rules to the devices on its network. - -As in the previously described policy design examples, GPOs to implement the domain isolation environment are linked to the domain container in Active Directory, and then WMI filters and security group filters are attached to GPOs to ensure that the correct GPO is applied to each computer. The following groups were created by using the Active Directory Users and Computers snap-in, and all devices that run Windows were added to the correct groups. - -- **CG_SRVISO_WGBANK_SQL**. This group contains the computer accounts for the devices that run SQL Server. Members of this group receive a GPO with firewall and connections security rules that require that only users who are members of the group CG_NAG_SQL_USERS can access the server, and only when they're using a computer that is a member of the group CG_NAG_SQL_COMPUTERS. - - > [!NOTE] - > You can design your GPOs in nested groups. For example, you can make the boundary group a member of the isolated domain group, so that it receives the firewall and basic isolated domain settings through that nested membership, with only the changes supplied by the boundary zone GPO. However, devices that are running older versions of Windows can only support a single IPsec policy being active at a time. The policies for each GPO must be complete (and to a great extent redundant with each other), because you cannot layer them as you can in the newer versions of Windows. For simplicity, this guide describes the techniques used to create the independent, non-layered policies. We recommend that you create and periodically run a script that compares the memberships of the groups that must be mutually exclusive and reports any devices that are incorrectly assigned to more than one group. - - Network access groups (NAGs) aren't used to determine which GPOs are applied to a computer. Instead, these groups determine which users and devices can access the services on the isolated server. - -- **CG_NAG_SQL_COMPUTERS**. This network access group contains the computer accounts that are able to access the devices running SQL Server hosting the WGBank data. Members of this group include the WGBank front-end servers, and some client devices from which SQL Server administrators are permitted to work on the servers. -- **CG_NAG_SQL_USERS**. This network access group contains the user accounts of users who are permitted to access the SQL Server devices that host the WGBank data. Members of this group include the service account that the WGBank front-end program uses to run on its devices, and the user accounts for the SQL Server administration team members. - -> [!NOTE] -> You can use a single group for both user and computer accounts. Woodgrove Bank chose to keep them separate for clarity. - -If Woodgrove Bank wants to implement server isolation without domain isolation, the *CG_NAG_SQL_COMPUTERS* group can also be attached as a security group filter on the GPOs that apply connection security rules to the client devices. By doing this task, all the devices that are authorized to access the isolated server also have the required connection security rules. - -You don't have to include the encryption-capable rules on all devices. Instead, you can create GPOs that are applied only to members of the NAG, in addition to the standard domain isolation GPO, that contains connection security rules to support encryption. - -> [!div class="nextstepaction"] -> -> [Certificate-based Isolation Policy Design Example >](certificate-based-isolation-policy-design-example.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md deleted file mode 100644 index c3a7d7762f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md +++ /dev/null @@ -1,44 +0,0 @@ ---- -title: Server Isolation Policy Design -description: Learn about server isolation policy design, where you assign servers to a zone that allows access only to members of an approved network access group. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Server Isolation Policy Design - -In the server isolation policy design, you assign servers to a zone that allows access only to users and devices that authenticate as members of an approved network access group (NAG). - -This design typically begins with a network configured as described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. For this design, you then create zones for servers that have more security requirements. The zones can limit access to the server to only members of authorized groups, and can optionally require the encryption of all traffic in or out of these servers. These restrictions and requirements can be done on a per-server basis, or for a group of servers that share common security requirements. - -You can implement a server isolation design without using domain isolation. To do this implementation, you use the same principles as domain isolation, but instead of applying them to an Active Directory domain, you apply them only to the devices that must be able to access the isolated servers. The GPO contains connection security and firewall rules that require authentication when communicating with the isolated servers. In this case, the NAGs that determine which users and devices can access the isolated server are also used to determine which devices receive the GPO. - -The design is shown in the following illustration, with arrows that show the permitted communication paths. - -![isolated domain with isolated server.](images/wfas-domainisohighsec.gif) - -Characteristics of this design include: - -- Isolated domain (area A) - The same isolated domain described in the [Domain Isolation Policy Design](domain-isolation-policy-design.md) section. If the isolated domain includes a boundary zone, then devices in the boundary zone behave just like other members of the isolated domain in the way that they interact with devices in server isolation zones. -- Isolated servers (area B) - Devices in the server isolation zones restrict access to devices, and optionally users, that authenticate as a member of a network access group (NAG) authorized to gain access. -- Encryption zone (area C) - If the data being exchanged is sufficiently sensitive, the connection security rules for the zone can also require that the network traffic be encrypted. Encryption zones are most often implemented as rules that are part of a server isolation zone, instead of as a separate zone. The diagram illustrates the concept as a subset for conceptual purposes only. - -To add support for server isolation, you must ensure that the authentication methods are compatible with the requirements of the isolated server. For example, if you want to authorize user accounts that are members of a NAG in addition to authorizing computer accounts, you must enable both user and computer authentication in your connection security rules. - -> [!IMPORTANT] -> This design builds on the [Domain Isolation Policy Design](domain-isolation-policy-design.md), which in turn builds on the [Basic Firewall Policy Design](basic-firewall-policy-design.md). If you plan to deploy all three designs, do the design work for all three together, and then deploy in the sequence presented. - -This design can be applied to devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the connection security rules. - -For more info about this design: - -- This design coincides with the implementation goals to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md), [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md), [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md), and [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). -- To learn more about this design, see [Server Isolation Policy Design Example](server-isolation-policy-design-example.md). -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). -- To help you make the decisions required in this design, see [Planning Server Isolation Zones](planning-server-isolation-zones.md) and [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md). -- For a list of tasks that you can use to deploy your server isolation policy design, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). - -> [!div class="nextstepaction"] -> -> [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) From 12135b28d4417998cde72ed92f9fbd50f5cf1ab9 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 10 Nov 2023 16:55:06 -0500 Subject: [PATCH 094/237] batch1 redirects --- ...blishing.redirection.windows-security.json | 179 +++++++++++++++++- 1 file changed, 177 insertions(+), 2 deletions(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index e573ac4d0a..e2ccdbad58 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7479,6 +7479,181 @@ "source_path": "windows/security/operating-system-security/data-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md", "redirect_url": "/windows/security/operating-system-security/data-protection/bitlocker#device-encryption", "redirect_document_id": false - } + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721530(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725978(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/boundary-zone-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770729(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731463(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/certificate-based-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771822(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/documenting-the-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753825(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725818(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/domain-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732933(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753367(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/encryption-zone-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770426(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exemption-list.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732202(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771233(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731164(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-boundary.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770565(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754085(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-firewall.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731123(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-clients.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770836(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gpo-domiso-isolateddomain-servers.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731908(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731788(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolated-domain-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731447(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721532(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-certificate-based-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730835(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-domain-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771044(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-gpo-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771733(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732752(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-isolation-groups-for-the-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725693(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-network-access-groups.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771664(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-server-isolation-zones.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732615(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754986(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-the-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771716(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947826(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730841(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-gpos.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732486(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj721528(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732413(v=ws.10)", + "redirect_document_id": false + } ] -} \ No newline at end of file +} From 54a3c8ed3933bfeb0c5a2046d78f70f84d904829 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 07:23:01 -0500 Subject: [PATCH 095/237] batch 2 --- ...blishing.redirection.windows-security.json | 122 +++++++++++++++++- .../network-security/windows-firewall/TOC.yml | 64 --------- ...e-files-for-settings-used-in-this-guide.md | 87 ------------- ...ist-configuring-basic-firewall-settings.md | 17 --- ...uring-rules-for-an-isolated-server-zone.md | 32 ----- ...rs-in-a-standalone-isolated-server-zone.md | 31 ----- ...configuring-rules-for-the-boundary-zone.md | 23 ---- ...nfiguring-rules-for-the-encryption-zone.md | 24 ---- ...nfiguring-rules-for-the-isolated-domain.md | 27 ---- ...checklist-creating-group-policy-objects.md | 34 ----- ...ecklist-creating-inbound-firewall-rules.md | 19 --- ...cklist-creating-outbound-firewall-rules.md | 20 --- ...ts-of-a-standalone-isolated-server-zone.md | 24 ---- ...ementing-a-basic-firewall-policy-design.md | 28 ---- ...rtificate-based-isolation-policy-design.md | 22 ---- ...enting-a-domain-isolation-policy-design.md | 26 ---- ...andalone-server-isolation-policy-design.md | 25 ---- ...with-advanced-security-deployment-goals.md | 24 ---- ...wall-with-advanced-security-design-plan.md | 41 ------ ...t-devices-from-unwanted-network-traffic.md | 36 ------ ...n-accessing-sensitive-network-resources.md | 34 ----- ...cess-to-only-specified-users-or-devices.md | 38 ------ ...restrict-access-to-only-trusted-devices.md | 49 ------- ...l-with-advanced-security-design-process.md | 24 ---- ...with-advanced-security-deployment-guide.md | 50 ------- ...all-with-advanced-security-design-guide.md | 93 ------------- 26 files changed, 121 insertions(+), 893 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index e2ccdbad58..835e7d0d31 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7654,6 +7654,126 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732413(v=ws.10)", "redirect_document_id": false - } + } + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770289(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947845(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947794(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947848(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947836(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947800(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947783(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947791(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947799(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947827(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947819(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717261(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717238(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717284(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717277(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732023(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717256(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc772556(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770865(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753064(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725659(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731951(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717241(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732024(v=ws.10)", + "redirect_document_id": false + } ] } diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml index ab921f1437..7645d9d0ab 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml @@ -1,46 +1,6 @@ items: - name: Overview href: windows-firewall-with-advanced-security.md - - name: Plan deployment - items: - - name: Design guide - href: windows-firewall-with-advanced-security-design-guide.md - - name: Design process - href: understanding-the-windows-firewall-with-advanced-security-design-process.md - - name: Implementation goals - items: - - name: Identify implementation goals - href: identifying-your-windows-firewall-with-advanced-security-deployment-goals.md - - name: Protect devices from unwanted network traffic - href: protect-devices-from-unwanted-network-traffic.md - - name: Restrict access to only trusted devices - href: restrict-access-to-only-trusted-devices.md - - name: Require encryption - href: require-encryption-when-accessing-sensitive-network-resources.md - - name: Restrict access - href: restrict-access-to-only-specified-users-or-devices.md - - name: Deployment guide - items: - - name: Deployment overview - href: windows-firewall-with-advanced-security-deployment-guide.md - - name: Implement your plan - href: implementing-your-windows-firewall-with-advanced-security-design-plan.md - - name: Basic firewall deployment - items: - - name: "Checklist: Implement a basic firewall policy design" - href: checklist-implementing-a-basic-firewall-policy-design.md - - name: Domain isolation deployment - items: - - name: "Checklist: Implement a Domain Isolation Policy Design" - href: checklist-implementing-a-domain-isolation-policy-design.md - - name: Server isolation deployment - items: - - name: "Checklist: Implement a Standalone Server Isolation Policy Design" - href: checklist-implementing-a-standalone-server-isolation-policy-design.md - - name: Certificate-based authentication - items: - - name: "Checklist: Implement a Certificate-based Isolation Policy Design" - href: checklist-implementing-a-certificate-based-isolation-policy-design.md - name: Best practices items: - name: Configure the firewall @@ -131,30 +91,6 @@ items: href: turn-on-windows-firewall-and-configure-default-behavior.md - name: Verify Network Traffic href: verify-that-network-traffic-is-authenticated.md - - name: References - items: - - name: "Checklist: Create Group Policy objects" - href: checklist-creating-group-policy-objects.md - - name: "Checklist: Create inbound firewall rules" - href: checklist-creating-inbound-firewall-rules.md - - name: "Checklist: Create outbound firewall rules" - href: checklist-creating-outbound-firewall-rules.md - - name: "Checklist: Configure basic firewall settings" - href: checklist-configuring-basic-firewall-settings.md - - name: "Checklist: Configure rules for the isolated domain" - href: checklist-configuring-rules-for-the-isolated-domain.md - - name: "Checklist: Configure rules for the boundary zone" - href: checklist-configuring-rules-for-the-boundary-zone.md - - name: "Checklist: Configure rules for the encryption zone" - href: checklist-configuring-rules-for-the-encryption-zone.md - - name: "Checklist: Configure rules for an isolated server zone" - href: checklist-configuring-rules-for-an-isolated-server-zone.md - - name: "Checklist: Configure rules for servers in a standalone isolated server zone" - href: checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md - - name: "Checklist: Create rules for clients of a standalone isolated server zone" - href: checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md - - name: "Appendix A: Sample GPO template files for settings used in this guide" - href: appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md - name: Troubleshooting items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall diff --git a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md deleted file mode 100644 index 03fe642a1d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md +++ /dev/null @@ -1,87 +0,0 @@ ---- -title: Appendix A Sample GPO Template Files for Settings Used in this Guide -description: Use sample template files import an XML file containing customized registry preferences into a Group Policy Object (GPO). -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Appendix A: sample GPO template files for settings used in this guide - -You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). - -To manually create the file, build the settings under **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry**. After you create the settings, drag the container to the desktop. An .xml file is created there. - -To import an .xml file to GPMC, drag it and drop it on the **Computer Configuration** > **Preferences** > **Windows Settings** > **Registry** node. If you copy the following sample XML code to a file, and then drag and drop it on the **Registry** node, it creates a **Server and Domain Isolation** collection with the six registry keys discussed in this guide. - -The following sample file uses item-level targeting to ensure that the registry keys are applied only on the versions of Windows to which they apply. - -> [!NOTE] -> The file shown here is for sample use only. It should be customized to meet the requirements of your organization's deployment. To customize this file, import it into a test GPO, modify the settings, and then drag the Server and Domain Isolation Settings node to your desktop. The new file will contain all of your customization. - -```xml - - - - - - - - - - - - - - - - - -``` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md deleted file mode 100644 index 9b1d50eb96..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md +++ /dev/null @@ -1,17 +0,0 @@ ---- -title: Checklist Configuring Basic Firewall Settings -description: Configure Windows Firewall to set inbound and outbound behavior, display notifications, record log files and more of the necessary function for Firewall. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure basic firewall settings - -This checklist includes tasks for configuring a GPO with firewall defaults and settings that are separate from the rules: - -| Task | Reference | -| - | - | -| Turn the firewall on and set the default inbound and outbound behavior.| [Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md)| -| Configure the firewall to not display notifications to the user when a program is blocked, and to ignore locally defined firewall and connection security rules. | [Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program Is Blocked](configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md) | -| Configure the firewall to record a log file. | [Configure the Windows Defender Firewall with Advanced Security Log](configure-the-windows-firewall-log.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md deleted file mode 100644 index eeacecbac9..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Checklist Configuring Rules for an Isolated Server Zone -description: Use these tasks to configure connection security rules and IPsec settings in GPOs for servers in an isolated server zone that are part of an isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for an isolated server zone - -The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs for servers in an isolated server zone that are part of an isolated domain. For information about creating a standalone isolated server zone that isn't part of an isolated domain, see [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md). - -In addition to requiring authentication and optionally encryption, servers in an isolated server zone can be accessed only by users or devices who are authenticated members of a network access group (NAG). If you include user accounts in the NAG, then the restrictions can still apply; they're enforced at the application layer, rather than the IP layer. - -The GPOs for an isolated server or group of servers are similar to those GPOs for the isolated domain itself or the encryption zone, if you require encryption to your isolated servers. This checklist refers you to procedures for creating rules and restrictions that allow only members of the NAG to connect to the server. - -| Task | Reference | -| - | - | -| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers and they run different versions of the Windows operating system, then start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.
    Copy the GPO from the isolated domain or from the encryption zone to serve as a starting point. Where your copy already contains elements listed in the following checklist, review the relevant procedures and compare them to your copied GPO's element to make sure it's constructed in a way that meets the needs of the server isolation zone. |[Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| Configure the security group filters and WMI filters on the GPO so that only members of the isolated server zone's membership group that are running the specified version of Windows can read and apply it.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. If you require encryption for the isolated server zone, then make sure that you choose only algorithm combinations that include encryption. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Create a rule that requests authentication for all network traffic.
    **Important:** As in an isolated domain, don't set the rules to require authentication for inbound traffic until you have completed testing. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Create the NAG to contain the device or user accounts that are allowed to access the servers in the isolated server zone. | [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| -| Create a firewall rule that permits inbound network traffic only if authenticated as a member of the NAG. | [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test server to the membership group for the isolated server zone. Be sure to add at least one server for each operating system supported by a GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) | - -Don't change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md deleted file mode 100644 index e9eccb33bf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone -description: Checklist Configuring Rules for Servers in a Standalone Isolated Server Zone -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for servers in a standalone isolated server zone - -This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs for servers in a standalone isolated server zone that isn't part of an isolated domain. In addition to requiring authentication and optionally encryption, servers in a server isolation zone are accessible only by users or devices that are authenticated as members of a network access group (NAG). The GPOs described here apply only to the isolated servers, not to the client devices that connect to them. For the GPOs for the client devices, see [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md). - -The GPOs for isolated servers are similar to those GPOs for an isolated domain. This checklist refers you to those procedures for the creation of some of the rules. The other procedures in this checklist are for creating the restrictions that allow only members of the server access group to connect to the server. - -| Task | Reference | -| - | - | -| Create a GPO for the devices that need to have access restricted to the same set of client devices. If there are multiple servers running different versions of the Windows operating system, start by creating the GPO for one version of Windows. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you're working on a copy of a GPO, modify the group memberships and WMI filters so that they're correct for the devices for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md) | -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. This procedure sets the default settings for the device. If you want to set authentication on a per-rule basis, this procedure is optional.| [Configure Authentication Methods](configure-authentication-methods.md) | -| Create a rule that requests authentication for all inbound network traffic.

    **Important:** As in an isolated domain, don't set the rules to require authentication until your testing is complete. That way, if the rules don't work as expected, communications aren't affected by a failure to authenticate.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| If your design requires encryption in addition to authentication for access to the isolated servers, then modify the rule to require it. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| -| Create the NAG to contain the device or user accounts that are allowed to access the isolated servers. If you have multiple groups of isolated servers that are accessed by different client devices, then create a NAG for each set of servers.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md) | -| Create a firewall rule that allows inbound network traffic only if it's authenticated from a user or device that is a member of the zone's NAG.| [Restrict Server Access to Members of a Group Only](restrict-server-access-to-members-of-a-group-only.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test server to the membership group for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| - -Don't change the rules for any of your zones to require authentication until all zones have been set up and thoroughly tested. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md deleted file mode 100644 index 2196325d31..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -title: Checklist Configuring Rules for the Boundary Zone -description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for the boundary zone - -The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the boundary zone in an isolated domain. - -Rules for the boundary zone are typically the same as those rules for the isolated domain, with the exception that the final rule is left to only request, not require, authentication. - -This checklist assumes that you've already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). After you create a copy for the boundary zone, make sure that you don't change the rule from request authentication to require authentication when you create the other GPOs. - -| Task | Reference | -| - | - | -| Make a copy of the domain isolation GPO for this version of Windows to serve as a starting point for the GPO for the boundary zone. Unlike the GPO for the main isolated domain zone, this copy isn't changed after deployment to require authentication.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md) | -| If you're working on a copy of a GPO, modify the group memberships and WMI filters so that they're correct for the boundary zone and version of Windows for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the boundary zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security configuration is protecting network traffic with authentication when it can, and that unauthenticated traffic is accepted. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md deleted file mode 100644 index 8916500bda..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Checklist Configuring Rules for the Encryption Zone -description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for the encryption zone - -This checklist includes tasks for configuring connection security rules and IPsec settings in your GPOs to implement the encryption zone in an isolated domain. - -Rules for the encryption zone are typically the same as those rules for the isolated domain, with the exception that the main rule requires encryption in addition to authentication. - -This checklist assumes that you've already created the GPO for the isolated domain as described in [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md). You can then copy those GPOs for use with the encryption zone. After you create the copies, modify the main rule to require encryption in addition to the authentication required by the rest of the isolated domain. - -| Task | Reference | -| - | - | -| Make a copy of the domain isolation GPOs to serve as a starting point for the GPOs for the encryption zone.| [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| Modify the group memberships and WMI filters so that they're correct for the encryption zone and the version of Windows for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Add the encryption requirements for the zone. | [Configure the Rules to Require Encryption](configure-the-rules-to-require-encryption.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the encryption zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Computers to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security rules are protecting network traffic.| [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md deleted file mode 100644 index 51f6cb3c93..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -title: Checklist Configuring Rules for the Isolated Domain -description: Use these tasks to configure connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: configure rules for the isolated domain - -The following checklists include tasks for configuring connection security rules and IPsec settings in your GPOs to implement the main zone in the isolated domain. - -| Task | Reference | -| - | - | -| Create a GPO for the computers in the isolated domain running one of the operating systems. After you've finished the tasks in this checklist and configured the GPO for that version of Windows, you can create a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you're working on a GPO that was copied from another GPO, modify the group memberships and WMI filters so that they're correct for the isolated domain zone and the version of Windows for which this GPO is intended. | [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from computers on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create the rule that requests authentication for all inbound network traffic. | [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Link the GPO to the domain level of the AD DS organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test computers to the membership group for the isolated domain. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| Verify that the connection security rules are protecting network traffic to and from the test computers. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| - -Don't change the rules for any of your zones to require authentication until all of the zones have been set up and are operating correctly. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md deleted file mode 100644 index c9a715cfbc..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Checklist Creating Group Policy Objects -description: Learn to deploy firewall settings, IPsec settings, firewall rules, or connection security rules, by using Group Policy in AD DS. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: Create group policy objects (GPOs) - -To deploy firewall or IPsec settings or firewall or connection security rules, we recommend that you use Group Policy in AD DS. This section describes a tested, efficient method that requires some up-front work, but serves an administrator well in the end by making GPO assignments as easy as dropping a device into a membership group. - -The checklists for firewall, domain isolation, and server isolation include a link to this checklist. - -## About membership groups - -For most GPO deployment tasks, you must determine which devices must receive and apply which GPOs. Because different versions of Windows can support different settings and rules to achieve similar behavior, you might need multiple GPOs: one for each operating system that has settings different from the others to achieve the same result. Therefore, if your network included those older operating systems you would need to create a GPO for each set of operating systems that can share common settings. To deploy typical domain isolation settings and rules, you might have five different GPOs for the versions of Windows discussed in this guide. By following the procedures in this guide, you only need one membership group to manage all five GPOs. The membership group is identified in the security group filter for all five GPOs. To apply the settings to a device, you make that device's account a member of the membership group. WMI filters are used to ensure that the correct GPO is applied. - -## About exclusion groups - -A Windows Defender Firewall with Advanced Security design must often take into account domain-joined devices on the network that can't or must not apply the rules and settings in the GPOs. Because these devices are typically fewer in number than the devices that must apply the GPO, it's easier to use the Domain Members group in the GPO membership group, and then place these exception devices into an exclusion group that is denied Apply Group Policy permissions on the GPO. Because deny permissions take precedence over allow permissions, a device that is a member of both the membership group and the exception group is prevented from applying the GPO. Devices typically found in a GPO exclusion group for domain isolation include the domain controllers, DHCP servers, and DNS servers. - -You can also use a membership group for one zone as an exclusion group for another zone. For example, devices in the boundary and encryption zones are technically in the main domain isolation zone, but must apply only the GPO for their assigned role. To use the group as an exclusion group, the GPOs for the main isolation zone deny Apply Group Policy permissions to members of the boundary and encryption zones. - -| Task | Reference | -| - | - | -| Review important concepts and examples for deploying GPOs in a way that best meets the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md)| -| Create the membership group in AD DS that will be used to contain device accounts that must receive the GPO.| [Create a Group Account in Active Directory](create-a-group-account-in-active-directory.md)| -| Create a GPO for each version of Windows that has different implementation requirements.| [Create a Group Policy Object](create-a-group-policy-object.md) | -| Create security group filters to limit the GPO to only devices that are members of the membership group and to exclude devices that are members of the exclusion group.|[Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md) | -| Create WMI filters to limit each GPO to only the devices that match the criteria in the filter.| [Create WMI Filters for the GPO](create-wmi-filters-for-the-gpo.md) | -| If you're working on a GPO that was copied from another, modify the group memberships and WMI filters so that they're correct for the new zone or version of Windows for which this GPO is intended.|[Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md) | -| Before adding any rules or configuring the GPO, add a few test devices to the membership group, and make sure that the correct GPO is received and applied to each member of the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md) | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md deleted file mode 100644 index 5afd360e1a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -title: Checklist Creating Inbound Firewall Rules -description: Use these tasks for creating inbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: create inbound firewall rules - -This checklist includes tasks for creating firewall rules in your GPOs. - -| Task | Reference | -| - | - | -| Create a rule that allows a program to listen for and accept inbound network traffic on any ports it requires. | [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md)| -| Create a rule that allows inbound network traffic on a specified port number. | [Create an Inbound Port Rule](create-an-inbound-port-rule.md)| -| Create a rule that allows inbound ICMP network traffic. | [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md)| -| Create rules that allow inbound RPC network traffic. | [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md)| -| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Inbound Rules](enable-predefined-inbound-rules.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md deleted file mode 100644 index d6d1525053..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Checklist Creating Outbound Firewall Rules -description: Use these tasks for creating outbound firewall rules in your GPOs for Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: create outbound firewall rules - -This checklist includes tasks for creating outbound firewall rules in your GPOs. - -> [!IMPORTANT] -> By default, outbound filtering is disabled. Because all outbound network traffic is permitted, outbound rules are typically used to block traffic that is not wanted on the network. However, it is a best practice for an administrator to create outbound allow rules for those applications that are approved for use on the organization's network. If you do this, then you have the option to set the default outbound behavior to block, preventing any network traffic that is not specifically authorized by the rules you create. - -| Task | Reference | -| - | - | -| Create a rule that allows a program to send any outbound network traffic on any port it requires. | [Create an Outbound Program or Service Rule](create-an-outbound-program-or-service-rule.md)| -| Create a rule that allows outbound network traffic on a specified port number. | [Create an Outbound Port Rule](create-an-outbound-port-rule.md)| -| Enable a predefined rule or a group of predefined rules. Some predefined rules for basic network services are included as part of the installation of Windows; others can be created when you install a new application or network service. | [Enable Predefined Outbound Rules](enable-predefined-outbound-rules.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md deleted file mode 100644 index 4d8a44fecc..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Create Rules for Standalone Isolated Server Zone Clients -description: Checklist for when creating rules for clients of a Standalone Isolated Server Zone -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: Create rules for clients of a standalone isolated server zone - -This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client devices that must connect to servers in an isolated server zone. - -| Task | Reference | -| - | - | -| Create a GPO for the client devices that must connect to servers in the isolated server zone, and that are running one of the versions of Windows. After you've finished the tasks in this checklist, you can make a copy of it.| [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| To determine which devices receive the GPO, assign the NAG for the isolated servers to the security group filter for the GPO. Make sure that each GPO has the WMI filter for the correct version of Windows.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md) | -| Configure IPsec to exempt all ICMP network traffic from IPsec protection. | [Exempt ICMP from Authentication](exempt-icmp-from-authentication.md)| -| Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec. | [Create an Authentication Exemption List Rule](create-an-authentication-exemption-list-rule.md)| -| Configure the key exchange (main mode) security methods and algorithms to be used. | [Configure Key Exchange (Main Mode) Settings](configure-key-exchange-main-mode-settings.md)| -| Configure the data protection (quick mode) algorithm combinations to be used. | [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md)| -| Configure the authentication methods to be used. | [Configure Authentication Methods](configure-authentication-methods.md)| -| Create a rule that requests authentication for network traffic. Because fallback-to-clear behavior has no delay when communicating with devices that can't use IPsec, you can use the same any-to-any rule used in an isolated domain.| [Create an Authentication Request Rule](create-an-authentication-request-rule.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy. | [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add your test devices to the NAG for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md deleted file mode 100644 index 3d970485cf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md +++ /dev/null @@ -1,28 +0,0 @@ ---- -title: Checklist Implementing a Basic Firewall Policy Design -description: Follow this parent checklist for implementing a basic firewall policy design to ensure successful implementation. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implement a basic firewall policy design - -This parent checklist includes cross-reference links to important concepts about the basic firewall policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. - -The procedures in this section use the Group Policy MMC snap-in interfaces to configure the GPOs, but you can also use Windows PowerShell. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). - -| Task | Reference | -| - | - | -| Review important concepts and examples for the basic firewall policy design to determine if this design meets the needs of your organization. | [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Basic Firewall Policy Design](basic-firewall-policy-design.md)
    [Firewall Policy Design Example](firewall-policy-design-example.md)
    [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md)| -| Create the membership group and a GPO for each set of devices that require different firewall rules. Where GPOs will be similar, such as for Windows 11, Windows 10, and Windows Server 2016, create one GPO, configure it by using the tasks in this checklist, and then make a copy of the GPO for the other version of Windows. For example, create and configure the GPO for Windows 10 or Windows 11, make a copy of it for Windows Server 2016, and then follow the steps in this checklist to make the few required changes to the copy. | [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md)
    [Copy a GPO to Create a New GPO](copy-a-gpo-to-create-a-new-gpo.md)| -| If you are working on a GPO that was copied from another, modify the group membership and WMI filters so that they are correct for the devices for which this GPO is intended.| [Modify GPO Filters to Apply to a Different Zone or Version of Windows](modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md)| -| Configure the GPO with firewall default settings appropriate for your design.| [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md)| -| Create one or more inbound firewall rules to allow unsolicited inbound network traffic.| [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md)| -| Create one or more outbound firewall rules to block unwanted outbound network traffic. | [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md)| -| Link the GPO to the domain level of the Active Directory organizational unit hierarchy.| [Link the GPO to the Domain](link-the-gpo-to-the-domain.md)| -| Add test devices to the membership group, and then confirm that the devices receive the firewall rules from the GPOs as expected.| [Add Test Devices to the Membership Group for a Zone](add-test-devices-to-the-membership-group-for-a-zone.md)| -| According to the testing and roll-out schedule in your design plan, add device accounts to the membership group to deploy the completed firewall policy settings to your devices. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md deleted file mode 100644 index edbfae8e7f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Checklist Implementing a Certificate-based Isolation Policy Design -description: Use these references to learn about using certificates as an authentication option and configure a certificate-based isolation policy design. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implement a certificate-based isolation policy design - -This parent checklist includes cross-reference links to important concepts about using certificates as an authentication option in either a domain isolation or server isolation design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist - -| Task | Reference | -| - | - | -| Review important concepts and examples for certificate-based authentication to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md)
    [Certificate-based Isolation Policy Design Example](certificate-based-isolation-policy-design-example.md)
    [Planning Certificate-based Authentication](planning-certificate-based-authentication.md) | -| Install the Active Directory Certificate Services (AD CS) role as an enterprise root issuing certification authority (CA). This step is required only if you haven't already deployed a CA on your network.| | -| Configure the certificate template for workstation authentication certificates.| [Configure the Workstation Authentication Certificate Template](configure-the-workstation-authentication-certificate-template.md)| -| Configure Group Policy to automatically deploy certificates based on your template to workstation devices. | [Configure Group Policy to Autoenroll and Deploy Certificates](configure-group-policy-to-autoenroll-and-deploy-certificates.md)| -| On a test device, refresh Group Policy and confirm that the certificate is installed. | [Confirm That Certificates Are Deployed Correctly](confirm-that-certificates-are-deployed-correctly.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md deleted file mode 100644 index 46079fc693..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Checklist Implementing a Domain Isolation Policy Design -description: Use these references to learn about the domain isolation policy design and links to other checklists to complete tasks require to implement this design. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implementing a domain isolation policy design - -This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. - -The procedures in this section use the Group Policy MMC snap-ins to configure the GPOs, but you can also use Windows PowerShell to configure GPOs. For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). - -| Task | Reference | -| - | - | -| Review important concepts and examples for the domain isolation policy design, determine your Windows Firewall with Advanced Security implementation goals, and customize this design to meet the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Domain Isolation Policy Design](domain-isolation-policy-design.md)
    [Domain Isolation Policy Design Example](domain-isolation-policy-design-example.md)
    [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) | -| Create the GPOs and connection security rules for the isolated domain.| [Checklist: Configuring Rules for the Isolated Domain](checklist-configuring-rules-for-the-isolated-domain.md)| -| Create the GPOs and connection security rules for the boundary zone.| [Checklist: Configuring Rules for the Boundary Zone](checklist-configuring-rules-for-the-boundary-zone.md)| -| Create the GPOs and connection security rules for the encryption zone.| [Checklist: Configuring Rules for the Encryption Zone](checklist-configuring-rules-for-the-encryption-zone.md)| -| Create the GPOs and connection security rules for the isolated server zone.| [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md)| -| According to the testing and roll-out schedule in your design plan, add computer accounts to the membership group to deploy rules and settings to your computers.| [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md)| -| After you confirm that network traffic is authenticated by IPsec, you can change authentication rules for the isolated domain and encryption zone from request to require mode.| [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md deleted file mode 100644 index 7596ee7611..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Checklist Implementing a Standalone Server Isolation Policy Design -description: Use these tasks to create a server isolation policy design that isn't part of an isolated domain. See references to concepts and links to other checklists. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 11/10/2023 ---- - -# Checklist: implementing a standalone server isolation policy design - -This checklist contains procedures for creating a server isolation policy design that isn't part of an isolated domain. For information on the steps required to create an isolated server zone within an isolated domain, see [Checklist: Configuring Rules for an Isolated Server Zone](checklist-configuring-rules-for-an-isolated-server-zone.md). - -This parent checklist includes cross-reference links to important concepts about the domain isolation policy design. It also contains links to subordinate checklists that will help you complete the tasks that are required to implement this design. - -> [!NOTE] -> Complete the tasks in this checklist in order. When a reference link takes you to a procedure, return to this topic after you complete the steps in that procedure so that you can proceed with the remaining tasks in this checklist. - -| Task | Reference | -| - | - | -| Review important concepts and examples for the server isolation policy design to determine if this design meets your implementation goals and the needs of your organization.| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md)
    [Server Isolation Policy Design](server-isolation-policy-design.md)
    [Server Isolation Policy Design Example](server-isolation-policy-design-example.md)
    [Planning Server Isolation Zones](planning-server-isolation-zones.md) | -| Create the GPOs and connection security rules for isolated servers.| [Checklist: Configuring Rules for Servers in a Standalone Isolated Server Zone](checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md)| -| Create the GPOs and connection security rules for the client devices that must connect to the isolated servers. | [Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone](checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md)| -| Verify that the connection security rules are protecting network traffic on your test devices. | [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md)| -| After you confirm that network traffic is authenticated by IPsec as expected, you can change authentication rules for the isolated server zone to require authentication instead of requesting it. | [Change Rules from Request to Require Mode](change-rules-from-request-to-require-mode.md)| -| According to the testing and roll-out schedule in your design plan, add device accounts for the client devices to the membership group so that you can deploy the settings. | [Add Production Devices to the Membership Group for a Zone](add-production-devices-to-the-membership-group-for-a-zone.md) | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md b/windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md deleted file mode 100644 index c36d7effdf..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Identify implementation goals for Windows Defender Firewall with Advanced Security Deployment -description: Identifying Your Windows Defender Firewall with Advanced Security (WFAS) implementation goals -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Identifying Windows Defender Firewall with Advanced Security implementation goals - -Correctly identifying your Windows Defender Firewall with Advanced Security implementation goals is essential for the success of your Windows Defender Firewall design project. Form a project team that can clearly articulate deployment issues in a vision statement. When you write your vision statement, identify, clarify, and refine your implementation goals. Prioritize and, if possible, combine your implementation goals so that you can design and deploy Windows Defender Firewall by using an iterative approach. You can take advantage of the predefined Windows Defender Firewall implementation goals presented in this guide that are relevant to your scenarios. - -The following table lists the three main tasks for articulating, refining, and later documenting your Windows Defender Firewall implementation goals: - - -| Deployment goal tasks | Reference links | -|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Evaluate predefined Windows Defender Firewall with Advanced Security implementation goals that are provided in this section of the guide, and combine one or more goals to reach your organizational objectives. | Predefined implementation goals:

    • [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md)

    • [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)

    • [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)

    • [Restrict Access to Sensitive Resources to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md)
    | -| Map one goal or a combination of the predefined implementation goals to an existing Windows Defender Firewall with Advanced Security design. |
    • [Mapping Your implementation goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md)
    | -| Based on the status of your current infrastructure, document your implementation goals for your Windows Defender Firewall with Advanced Security design into a deployment plan. |
    • [Designing A Windows Defender Firewall Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md)

    • [Planning Your Windows Defender Firewall Design with Advanced Security](planning-your-windows-firewall-with-advanced-security-design.md)
    | - -
    - -**Next:** [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md deleted file mode 100644 index 8f0342581b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Implementing Your Windows Defender Firewall with Advanced Security Design Plan -description: Implementing Your Windows Defender Firewall with Advanced Security Design Plan -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Implementing Your Windows Defender Firewall with Advanced Security Design Plan - - -The following are important factors in the implementation of your Windows Defender Firewall design plan: - -- **Group Policy**. The Windows Defender Firewall with Advanced Security designs make extensive use of Group Policy deployed by Active Directory Domain Services (AD DS). A sound Group Policy infrastructure is required to successfully deploy the firewall and IPsec settings and rules to the devices on your network. - -- **Perimeter firewall**. Most organizations use a perimeter firewall to help protect the devices on the network from potentially malicious network traffic from outside of the organization's network boundaries. If you plan a deployment that includes a boundary zone to enable external devices to connect to devices in that zone, then you must allow that traffic through the perimeter firewall to the devices in the boundary zone. - -- **Devices running operating systems other than Windows**. If your network includes devices that aren't running the Windows operating system, then you must make sure that required communication with those devices isn't blocked by the restrictions put in place by your design. You must implement one of the following steps: - - - Include those devices in the isolated domain or zone by adding certificate-based authentication to your design. Many other operating systems can participate in an isolated domain or isolated server scenario, as long as certificate-based authentication is used. - - - Include the device in the authentication exemption list included in your design. You can choose this option if for any reason the device can't participate in the isolated domain design. - -## How to implement your Windows Defender Firewall with Advanced Security design using this guide - - -The next step in implementing your design is to determine in what order each of the deployment steps must be performed. This guide uses checklists to help you accomplish the various deployment tasks that are required to implement your design plan. As the following diagram shows, checklists and subchecklists are used as necessary to provide the end-to-end procedure for deploying a design. - -![wfas implementation.](images/wfas-implement.gif) - -Use the following parent checklists in this section of the guide to become familiar with the deployment tasks for implementing your organization's Windows Defender Firewall with Advanced Security design. - -- [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) - -- [Checklist: Implementing a Domain Isolation Policy Design](checklist-implementing-a-domain-isolation-policy-design.md) - -- [Checklist: Implementing a Standalone Server Isolation Policy Design](checklist-implementing-a-standalone-server-isolation-policy-design.md) - -- [Checklist: Implementing a Certificate-based Isolation Policy Design](checklist-implementing-a-certificate-based-isolation-policy-design.md) - -The procedures in these checklists use the Group Policy MMC snap-in interfaces to configure firewall and connection security rules in GPOs, but you can also use Windows PowerShell. For more information, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md). This guide recommends using GPOs in a specific way to deploy the rules and settings for your design. For information about deploying your GPOs, see [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) and the checklist [Checklist: Creating Group Policy Objects](checklist-creating-group-policy-objects.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md b/windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md deleted file mode 100644 index ee0412021e..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Protect devices from unwanted network traffic -description: Learn how running a host-based firewall on every device in your organization can help protect against attacks as part of a defense-in-depth security strategy. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 01/18/2022 ---- - -# Protect devices from unwanted network traffic - - -Although network perimeter firewalls provide important protection to network resources from external threats, there are network threats that a perimeter firewall can't protect against. Some attacks might successfully penetrate the perimeter firewall, and at that point what can stop it? Other attacks might originate from inside the network, such as malware that is brought in on portable media and run on a trusted device. Portable devices are often taken outside the network and connected directly to the Internet, without adequate protection between the device and security threats. - -Reports of targeted attacks against organizations, governments, and individuals have become more widespread in recent years. For a general overview of these threats, also known as advanced persistent threats (APT), see the [Microsoft Security Intelligence Report](https://www.microsoft.com/security/business/security-intelligence-report). - -Running a host-based firewall on every device that your organization manages is an important layer in a "defense-in-depth" security strategy. A host-based firewall can help protect against attacks that originate from inside the network and also provide extra protection against attacks from outside the network that manage to penetrate the perimeter firewall. It also travels with a portable device to provide protection when it's away from the organization's network. - -A host-based firewall helps secure a device by dropping all network traffic that doesn't match the administrator-designed rule set for permitted network traffic. This design, which corresponds to [Basic Firewall Policy Design](basic-firewall-policy-design.md), provides the following benefits: - -- Network traffic that is a reply to a request from the local device is permitted into the device from the network. - -- Network traffic that is unsolicited, but that matches a rule for allowed network traffic, is permitted into the device from the network. - - For example, Woodgrove Bank wants a device that is running SQL Server to be able to receive the SQL queries sent to it by client devices. The firewall policy deployed to the device that is running SQL Server includes firewall rules that specifically allow inbound network traffic for the SQL Server program. - -- Outbound network traffic that isn't blocked is allowed on the network. - - For example, Woodgrove Bank has a corporate policy that prohibits the use of certain peer-to-peer file sharing programs. The firewall policy deployed to the computers on the network includes firewall rules that block both inbound and outbound network traffic for the prohibited programs. All other outbound traffic is permitted. - -The following component is recommended for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more Group Policy objects (GPOs) that can be automatically applied to all relevant computers in the domain. - -Other means of deploying a firewall policy are available, such as creating scripts that use the netsh command-line tool, and then running those scripts on each computer in the organization. This guide uses Active Directory as a recommended means of deployment because of its ability to scale to large organizations. - -**Next:** [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md deleted file mode 100644 index 1070cb1a65..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Require Encryption When Accessing Sensitive Network Resources -description: Windows Defender Firewall with Advanced Security allows you to require that all network traffic in an isolated domain be encrypted. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Require Encryption When Accessing Sensitive Network Resources - - -The use of authentication in the previously described goal ([Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) enables a device in the isolated domain to block traffic from untrusted devices. However, it doesn't prevent an untrusted device from eavesdropping on the network traffic shared between two trusted devices, because by default network packets aren't encrypted. - -For devices that share sensitive information over the network, Windows Defender Firewall with Advanced Security allows you to require that all such network traffic be encrypted. Using encryption can help you comply with regulatory and legislative requirements such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. By creating connection security rules that apply to devices that host and exchange sensitive data, you can help protect the confidentiality of that data by encrypting it. - -The following illustration shows an encryption zone in an isolated domain. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. - -![encryption zone in an isolated domain.](images/wfas-domainisoencrypt.gif) - -This goal provides the following benefits: - -- Devices in the encryption zone require authentication to communicate with other devices. This rule works no differently from the domain isolation goal and design. For more information, see [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md). - -- Devices in the encryption zone require that all inbound and outbound network traffic be encrypted. - - For example, Woodgrove Bank processes sensitive customer data on a device that must be protected from eavesdropping by devices on the network. Connection security rules specify that all traffic must be encrypted by a sufficiently complex encryption algorithm to help protect the data. - -- Devices in the encryption zone are often good candidates for server isolation, where access is limited to only computer accounts and user accounts that are members of an authorized access group. In many organizations, the encryption zone and the server isolation zone are one and the same. For more info, see [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md). - -The following components are required for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more GPOs that can be automatically applied to all relevant devices in the domain. - -**Next:** [Restrict Access to Only Specified Users or Devices](restrict-access-to-only-specified-users-or-devices.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md deleted file mode 100644 index 28c8049c79..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Restrict Access to Only Specified Users or Devices -description: Restrict access to devices and users that are members of domain groups authorized to access that device using Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Restrict Access to Only Specified Users or Computers - - -Domain isolation (as described in the previous goal [Restrict Access to Only Trusted Devices](restrict-access-to-only-trusted-devices.md)) prevents devices that are members of the isolated domain from accepting network traffic from untrusted devices. However, some devices on the network might host sensitive data that must be additionally restricted to only those users and computers that have a business requirement to access the data. - -Windows Defender Firewall with Advanced Security enables you to restrict access to devices and users that are members of domain groups authorized to access that device. These groups are called *network access groups (NAGs)*. When a device authenticates to a server, the server checks the group membership of the computer account and the user account, and grants access only if membership in the NAG is confirmed. Adding this check creates a virtual "secure zone" within the domain isolation zone. You can have multiple devices in a single secure zone, and it's likely that you'll create a separate zone for each set of servers that have specific security access needs. Devices that are part of this server isolation zone are often also part of the encryption zone (see [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md)). - -Restricting access to only users and devices that have a business requirement can help you comply with regulatory and legislative requirements, such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. - -You can restrict access by specifying either computer or user credentials. - -The following illustration shows an isolated server, and examples of devices that can and can't communicate with it. Devices that are outside the Woodgrove corporate network, or computers that are in the isolated domain but aren't members of the required NAG, can't communicate with the isolated server. - -![isolated domain with network access groups.](images/wfas-domainnag.gif) - -This goal, which corresponds to [Server Isolation Policy Design](server-isolation-policy-design.md), provides the following features: - -- Isolated servers accept unsolicited inbound network traffic only from devices or users that are members of the NAG. - -- Isolated servers can be implemented as part of an isolated domain, and treated as another zone. Members of the zone group receive a GPO with rules that require authentication, and that specify that only network traffic authenticated as coming from a member of the NAG is allowed. - -- Server isolation can also be configured independently of an isolated domain. To do so, configure only the devices that must communicate with the isolated server with connection security rules to implement authentication and check NAG membership. - -- A server isolation zone can be simultaneously configured as an encryption zone. To do so, configure the GPO with rules that force encryption in addition to requiring authentication and restricting access to NAG members. For more information, see [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md). - -The following components are required for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more GPOs that can be automatically applied to all relevant devices in the domain. - -**Next:** [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md deleted file mode 100644 index f02e9c5708..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Restrict access to only trusted devices -description: Windows Defender Firewall with Advanced Security enables you to isolate devices you trust and restrict access of untrusted devices to trusted devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Restrict access to only trusted devices - - -Your organizational network likely has a connection to the Internet. You also likely have partners, vendors, or contractors who attach devices that aren't owned by your organization to your network. Because you don't manage those devices, you can't trust them to be free of malicious software, maintained with the latest security updates, or in any way in compliance with your organization's security policies. These untrustworthy devices both on and outside of your physical network must not be permitted to access your organization's devices except where it's truly required. - -To mitigate this risk, you must be able to isolate the devices you trust, and restrict their ability to receive unsolicited network traffic from untrusted devices. By using connection security and firewall rules available in Windows Defender Firewall with Advanced Security, you can logically isolate the devices that you trust by requiring that all unsolicited inbound network traffic be authenticated. Authentication ensures that each device or user can positively identify itself by using credentials that are trusted by the other device. Connection security rules can be configured to use IPsec with the Kerberos V5 protocol available in Active Directory, or certificates issued by a trusted certification authority as the authentication method. - -> [!NOTE] -> Because the primary authentication method recommended for devices that are running Windows is to use the Kerberos V5 protocol with membership in an Active Directory domain, this guide refers to this logical separation of computers as *domain isolation*, even when certificates are used to extend the protection to devices that are not part of an Active Directory domain. - -The protection provided by domain isolation can help you comply with regulatory and legislative requirements, such as those found in the Federal Information Security Management Act of 2002 (FISMA), the Sarbanes-Oxley Act of 2002, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and other government and industry regulations. - -The following illustration shows an isolated domain, with one of the zones that are optionally part of the design. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. - -![domain isolation.](images/wfas-domainiso.gif) - -These goals, which correspond to [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md), provide the following benefits: - -- Devices in the isolated domain accept unsolicited inbound network traffic only when it can be authenticated as coming from another device in the isolated domain. Exemption rules can be defined to allow inbound traffic from trusted computers that for some reason can't perform IPsec authentication. - - For example, Woodgrove Bank wants all of its devices to block all unsolicited inbound network traffic from any device that it doesn't manage. The connection security rules deployed to domain member devices require authentication as a domain member or by using a certificate before an unsolicited inbound network packet is accepted. - -- Devices in the isolated domain can still send outbound network traffic to untrusted devices and receive the responses to the outbound requests. - - For example, Woodgrove Bank wants its users at client devices to be able to access Web sites on the Internet. The default Windows Defender Firewall settings for outbound network traffic allow this access. No other rules are required. - -These goals also support optional zones that can be created to add customized protection to meet the needs of subsets of an organization's devices: - -- Devices in the "boundary zone" are configured to use connection security rules that request but don't require authentication. This configuration enables them to receive unsolicited inbound network traffic from untrusted devices, and also to receive traffic from the other members of the isolated domain. - - For example, Woodgrove Bank has a server that must be accessed by its partners' devices through the Internet. The rules applied to devices in the boundary zone use authentication when the client device can support it, but don't block the connection if the client device can't authenticate. - -- Devices in the "encryption zone" require that all network traffic in and out must be encrypted to secure potentially sensitive material when it's sent over the network. - - For example, Woodgrove Bank wants the devices running SQL Server to only transmit data that is encrypted to help protect the sensitive data stored on those devices. - -The following components are required for this deployment goal: - -- **Active Directory**: Active Directory supports centralized management of connection security rules by configuring the rules in one or more GPOs that can be automatically applied to all relevant devices in the domain. - -**Next:** [Require Encryption When Accessing Sensitive Network Resources](require-encryption-when-accessing-sensitive-network-resources.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md b/windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md deleted file mode 100644 index e397c3d8a7..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Understand WFAS Deployment -description: Resources for helping you understand the Windows Defender Firewall with Advanced Security (WFAS) Design Process -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Understanding the Windows Defender Firewall with Advanced Security Design Process - -Designing any deployment starts by performing several important tasks: - -- [Identifying your windows defender firewall with advanced security design goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) - -- [Mapping your implementation goals to a Windows Defender Firewall with Advanced Security design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) - - -After you identify your implementation goals and map them to a Windows Defender Firewall with Advanced Security design, you can begin documenting the design based on the processes that are described in the following topics: - -- [Designing A Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) - -- [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) - -**Next:** [Identifying Your Windows Defender Firewall with Advanced Security Design Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md deleted file mode 100644 index 7e97506932..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Windows Defender Firewall with Advanced Security deployment overview -description: Use this guide to deploy Windows Defender Firewall with Advanced Security for your enterprise to help protect devices and data that they share across a network. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Windows Defender Firewall with Advanced Security deployment overview - - -You can use the Windows Defender Firewall with Advanced Security MMC snap-in with devices running at least Windows Vista or Windows Server 2008 to help protect the devices and the data that they share across a network. - -You can use Windows Defender Firewall to control access to the device from the network. You can create rules that allow or block network traffic in either direction based on your business requirements. You can also create IPsec connection security rules to help protect your data as it travels across the network from device to device. - -## About this guide - -This guide is intended for use by system administrators and system engineers. It provides detailed guidance for deploying a Windows Defender Firewall with Advanced Security design that you or an infrastructure specialist or system architect in your organization has selected. - -Begin by reviewing the information in [Planning to Deploy Windows Defender Firewall with Advanced Security](planning-to-deploy-windows-firewall-with-advanced-security.md). - -If you haven't yet selected a design, we recommend that you wait to follow the instructions in this guide until after you've reviewed the design options in the [Windows Defender Firewall with Advanced Security Design Guide](windows-firewall-with-advanced-security-design-guide.md) and selected the one most appropriate for your organization. - -After you select your design and gather the required information about the zones (isolation, boundary, and encryption), operating systems to support, and other details, you can then use this guide to deploy your Windows Defender Firewall with Advanced Security design in your production environment. This guide provides steps for deploying any of the following primary designs that are described in the Design Guide: - -- [Basic Firewall Policy Design](basic-firewall-policy-design.md) - -- [Domain Isolation Policy Design](domain-isolation-policy-design.md) - -- [Server Isolation Policy Design](server-isolation-policy-design.md) - -- [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md) - -Use the checklists in [Implementing Your Windows Defender Firewall with Advanced Security Design Plan](implementing-your-windows-firewall-with-advanced-security-design-plan.md) to determine how best to use the instructions in this guide to deploy your particular design. -> [!CAUTION] -> We recommend that you use the techniques documented in this guide only for GPOs that must be deployed to the majority of the devices in your organization, and only when the OU hierarchy in your Active Directory domain does not match the deployment needs of these GPOs. These characteristics are typical of GPOs for server and domain isolation scenarios, but are not typical of most other GPOs. When the OU hierarchy supports it, deploy a GPO by linking it to the lowest level OU that contains all of the accounts to which the GPO applies. - -In a large enterprise environment with hundreds or thousands of GPOs, using this technique with too many GPOs can result in user or device accounts that are members of an excessive number of groups; this creation of accounts can result in network connectivity problems if network protocol limits are exceeded. -  -## What this guide doesn't provide - -This guide doesn't provide: - -- Guidance for creating firewall rules for specific network applications. For this information, see [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) in the Windows Defender Firewall with Advanced Security Design Guide. - -- Guidance for setting up Active Directory Domain Services (AD DS) to support Group Policy. - -- Guidance for setting up certification authorities (CAs) to create certificates for certificate-based authentication. - -For more information about Windows Defender Firewall with Advanced Security, see [Windows Defender Firewall with Advanced Security Overview](windows-firewall-with-advanced-security.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md deleted file mode 100644 index 02d6c56ae0..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Windows Defender Firewall with Advanced Security design guide -description: Learn about common goals for using Windows Defender Firewall with Advanced Security to choose or create a design for deploying the firewall in your enterprise. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Windows Defender Firewall with Advanced Security design guide - - -Windows Defender Firewall with Advanced Security is a host firewall that helps secure the device in two ways. First, it can filter the network traffic permitted to enter the device from the network, and also control what network traffic the device is allowed to send to the network. Second, Windows Defender Firewall supports IPsec, which enables you to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't authenticate can't communicate with your device. By using IPsec, you can also require that specific network traffic be encrypted to prevent it from being read or intercepted while in transit between devices. - -The interface for Windows Defender Firewall is much more capable and flexible than the consumer-friendly interface found in the Windows Defender Firewall Control Panel. They both interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel meets the needs for protecting a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. - -For more overview information, see [Windows Defender Firewall with Advanced Security](windows-firewall-with-advanced-security.md). - -## About this guide - -This guide provides recommendations to help you to choose or create a design for deploying Windows Defender Firewall in your enterprise environment. The guide describes some of the common goals for using Windows Defender Firewall, and then helps you map the goals that apply to your scenario to the designs that are presented in this guide. - -This guide is intended for the IT professional who has been assigned the task of deploying firewall and IPsec technologies on an organization's network to help meet the organization's security goals. - -Windows Defender Firewall should be part of a comprehensive security solution that implements various security technologies, such as perimeter firewalls, intrusion detection systems, virtual private networking (VPN), IEEE 802.1X authentication for wireless and wired connections, and IPsec connection security rules. - -To successfully use this guide, you need a good understanding of both the capabilities provided by Windows Defender Firewall, and how to deliver configuration settings to your managed devices by using Group Policy in Active Directory. - -You can use the implementation goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those goals presented here: - -- **Basic firewall policy design**. Restricts network traffic in and out of your devices to only that which is needed and authorized. - -- **Domain isolation policy design**. Prevents devices that are domain members from receiving unsolicited network traffic from devices that aren't domain members. More "zones" can be established to support the special requirements of some devices, such as: - - - A "boundary zone" for devices that must be able to receive requests from non-isolated devices. - - - An "encryption zone" for devices that store sensitive data that must be protected during network transmission. - -- **Server isolation policy design**. Restricts access to a server to only a limited group of authorized users and devices. This server can be commonly configured as a zone in a domain isolation design, but can also be configured as a stand-alone design, providing many of the benefits of domain isolation to a small set of devices. - -- **Certificate-based isolation policy design**. This design is a complement to either of the previous two designs, and supports any of their capabilities. It uses cryptographic certificates that are deployed to clients and servers for authentication, instead of the Kerberos V5 authentication used by default in Active Directory. This design enables devices that aren't part of an Active Directory domain, such as devices running operating systems other than Windows, to participate in your isolation solution. - -In addition to descriptions and example for each design, you'll find guidelines for gathering required data about your environment. You can then use these guidelines to plan and design your Windows Defender Firewall with Advanced Security deployment. After you read this guide, and finish gathering, documenting, and mapping your organization's requirements, you have the information that you need to begin deploying Windows Defender Firewall using the guidance in the Windows Defender Firewall with Advanced Security Deployment Guide. - -You can find the Windows Defender Firewall with Advanced Security -Deployment Guide at these locations: - -- [Windows Defender Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) - -- (Downloadable Word document) - -## In this section - -| Topic | Description -| - | - | -| [Understanding the Windows Defender Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) | Learn how to get started with the Windows Defender Firewall with Advanced Security design process. | -| [Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals](identifying-your-windows-firewall-with-advanced-security-deployment-goals.md) | Learn how to identify your Windows Defender Firewall with Advanced Security implementation goals. | -| [Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design](mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md) | After you finish reviewing the existing Windows Defender Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design. | -| [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) | To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. | -| [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) | After you've gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs. | -| [Appendix A: Sample GPO Template Files for Settings Used in this Guide](appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md) | You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC). | - -## Terminology used in this guide - -The following table identifies and defines terms used throughout this guide. - -| Term | Definition | -| - | - | -| Active Directory domain | A group of devices and users managed by an administrator by using Active Directory Domain Services (AD DS). Devices in a domain share a common directory database and security policies. Multiple domains can co-exist in a "forest," with trust relationships that establish the forest as the security boundary. | -| Authentication | A process that enables the sender of a message to prove its identity to the receiver. For connection security in Windows, authentication is implemented by the IPsec protocol suite.| -| Boundary zone | A subset of the devices in an isolated domain that must be able to receive unsolicited and non-authenticated network traffic from devices that aren't members of the isolated domain. Devices in the boundary zone request but don't require authentication. They use IPsec to communicate with other devices in the isolated domain.| -| Connection security rule | A rule in Windows Defender Firewall that contains a set of conditions and an action to be applied to network packets that match the conditions. The action can allow the packet, block the packet, or require the packet to be protected by IPsec. In previous versions of Windows, this rule was called an *IPsec rule*.| -| Certificate-based isolation | A way to add devices that can't use Kerberos V5 authentication to an isolated domain, by using an alternate authentication technique. Every device in the isolated domain and the devices that can't use Kerberos V5 are provided with a device certificate that can be used to authenticate with each other. Certificate-based isolation requires a way to create and distribute an appropriate certificate (if you choose not to purchase one from a commercial certificate provider).| -| Domain isolation | A technique for helping protect the devices in an organization by requiring that the devices authenticate each other's identity before exchanging information, and refusing connection requests from devices that can't authenticate. Domain isolation takes advantage of Active Directory domain membership and the Kerberos V5 authentication protocol available to all members of the domain. Also see "Isolated domain" in this table.| -| Encryption zone | A subset of the devices in an isolated domain that process sensitive data. Devices that are part of the encryption zone have all network traffic encrypted to prevent viewing by non-authorized users. Devices that are part of the encryption zone also typically are subject to the access control restrictions of server isolation.| -| Firewall rule | A rule in Windows Defender Firewall that contains a set of conditions used to determine whether a network packet is allowed to pass through the firewall.
    By default, the firewall rules in Windows Server 2016. Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 11, Windows 10, Windows 8, Windows 7, and Windows Vista block unsolicited inbound network traffic. Likewise, by default, all outbound network traffic is allowed. The firewall included in previous versions of Windows only filtered inbound network traffic. | -| Internet Protocol security (IPsec) | A set of industry-standard, cryptography-based protection services and protocols. IPsec protects all protocols in the TCP/IP protocol suite except Address Resolution Protocol (ARP).| -| IPsec policy | A collection of connection security rules that provide the required protection to network traffic entering and leaving the device. The protection includes authentication of both the sending and receiving device, integrity protection of the network traffic exchanged between them, and can include encryption.| -| Isolated domain | An Active Directory domain (or an Active Directory forest, or set of domains with two-way trust relationships) that has Group Policy settings applied to help protect its member devices by using IPsec connection security rules. Members of the isolated domain require authentication on all unsolicited inbound connections (with exceptions handled by the other zones).
    In this guide, the term *isolated domain* refers to the IPsec concept of a group of devices that can share authentication. The term *Active Directory domain* refers to the group of devices that share a security database by using Active Directory.| -| Server isolation | A technique for using group membership to restrict access to a server that is typically already a member of an isolated domain. The extra protection comes from using the authentication credentials of the requesting device to determine its group membership, and then only allowing access if the computer account (and optionally the user account) is a member of an authorized group.| -| Solicited network traffic | Network traffic that is sent in response to a request. By default, Windows Defender Firewall allows all solicited network traffic through.| -| Unsolicited network traffic | Network traffic that isn't a response to an earlier request, and that the receiving device can't necessarily anticipate. By default, Windows Defender Firewall blocks all unsolicited network traffic. | -| Zone | A zone is a logical grouping of devices that share common IPsec policies because of their communications requirements. For example, the boundary zone permits inbound connections from non-trusted devices. The encryption zone requires that all connections be encrypted.
    This term zone isn't related to the one used by Domain Name System (DNS). | - -**Next:** [Understanding the Windows Defender Firewall with Advanced Security Design Process](understanding-the-windows-firewall-with-advanced-security-design-process.md) - -  - -  - - - - - From 7711542e211161971f4ff62deb479b60281121a6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 07:34:19 -0500 Subject: [PATCH 096/237] redirects --- ...blishing.redirection.windows-security.json | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 835e7d0d31..6e7cd36647 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7654,124 +7654,124 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/server-isolation-policy-design-example.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732413(v=ws.10)", "redirect_document_id": false - } + }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770289(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-basic-firewall-settings.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947845(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947794(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947848(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947836(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947800(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947783(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-group-policy-objects.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947791(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-inbound-firewall-rules.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947799(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-outbound-firewall-rules.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947827(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc947819(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717261(v=ws.11)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717238(v=ws.11)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717284(v=ws.11)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717277(v=ws.11)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732023(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717256(v=ws.11)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/protect-devices-from-unwanted-network-traffic.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc772556(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770865(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753064(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-access-to-only-trusted-devices.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc725659(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731951(v=ws.10)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717241(v=ws.11)", "redirect_document_id": false }, { - "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide", + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732024(v=ws.10)", "redirect_document_id": false } From 0d442a31d6c500787849fa970112a109667876be Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 08:30:01 -0500 Subject: [PATCH 097/237] batch 3 --- ...blishing.redirection.windows-security.json | 15 ++ .../network-security/windows-firewall/TOC.yml | 118 ++++------------ ...ices-to-the-membership-group-for-a-zone.md | 55 -------- ...ices-to-the-membership-group-for-a-zone.md | 51 ------- ...ssign-security-group-filters-to-the-gpo.md | 49 ------- ...ange-rules-from-request-to-require-mode.md | 42 ------ .../configure-authentication-methods.md | 58 -------- ...ure-data-protection-quick-mode-settings.md | 56 -------- ...y-to-autoenroll-and-deploy-certificates.md | 32 ----- ...nfigure-key-exchange-main-mode-settings.md | 56 -------- ...nfigure-the-rules-to-require-encryption.md | 50 ------- ...ion-authentication-certificate-template.md | 42 ------ ...notifications-when-a-program-is-blocked.md | 40 ------ ...hat-certificates-are-deployed-correctly.md | 39 ----- .../copy-a-gpo-to-create-a-new-gpo.md | 46 ------ ...ate-a-group-account-in-active-directory.md | 36 ----- .../create-a-group-policy-object.md | 43 ------ ...e-an-authentication-exemption-list-rule.md | 56 -------- .../create-an-authentication-request-rule.md | 78 ---------- .../create-wmi-filters-for-the-gpo.md | 99 ------------- ...ining-the-trusted-state-of-your-devices.md | 133 ------------------ .../enable-predefined-inbound-rules.md | 30 ---- .../enable-predefined-outbound-rules.md | 32 ----- .../exempt-icmp-from-authentication.md | 24 ---- ...-about-your-active-directory-deployment.md | 26 ---- ...out-your-current-network-infrastructure.md | 107 -------------- ...athering-information-about-your-devices.md | 48 ------- .../gathering-other-relevant-information.md | 69 --------- .../gathering-the-information-you-need.md | 22 --- .../link-the-gpo-to-the-domain.md | 32 ----- ...-a-different-zone-or-version-of-windows.md | 68 --------- ...agement-console-to-ip-security-policies.md | 20 --- ...windows-firewall-with-advanced-security.md | 24 ---- ...-management-console-to-windows-firewall.md | 18 --- ...windows-firewall-with-advanced-security.md | 34 ----- ...erver-access-to-members-of-a-group-only.md | 38 ----- ...firewall-and-configure-default-behavior.md | 43 ------ ...y-that-network-traffic-is-authenticated.md | 59 -------- 38 files changed, 42 insertions(+), 1846 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 6e7cd36647..3a9d25e18f 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7774,6 +7774,21 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732024(v=ws.10)", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717262(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717263(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717260(v=ws.11)", + "redirect_document_id": false } ] } diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml index 7645d9d0ab..e0fa759b89 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml @@ -1,97 +1,33 @@ items: - name: Overview href: windows-firewall-with-advanced-security.md - - name: Best practices - items: - - name: Configure the firewall - href: best-practices-configuring.md - - name: Secure IPsec - href: securing-end-to-end-ipsec-connections-by-using-ikev2.md - - name: PowerShell - href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - - name: Isolate Microsoft Store Apps on Your Network - href: isolating-apps-on-your-network.md - - name: How-to - items: - - name: Add Production devices to the membership group for a zone - href: add-production-devices-to-the-membership-group-for-a-zone.md - - name: Add test devices to the membership group for a zone - href: add-test-devices-to-the-membership-group-for-a-zone.md - - name: Assign security group filters to the GPO - href: assign-security-group-filters-to-the-gpo.md - - name: Change rules from request to require mode - href: Change-Rules-From-Request-To-Require-Mode.Md - - name: Configure authentication methods - href: Configure-authentication-methods.md - - name: Configure data protection (Quick Mode) settings - href: configure-data-protection-quick-mode-settings.md - - name: Configure Group Policy to autoenroll and deploy certificates - href: configure-group-policy-to-autoenroll-and-deploy-certificates.md - - name: Configure Hyper-V firewall - href: hyper-v-firewall.md - - name: Configure key exchange (main mode) settings - href: configure-key-exchange-main-mode-settings.md - - name: Configure the rules to require encryption - href: configure-the-rules-to-require-encryption.md - - name: Configure the Windows Firewall log - href: configure-the-windows-firewall-log.md - - name: Configure the workstation authentication certificate template - href: configure-the-workstation-authentication-certificate-template.md - - name: Configure Windows Firewall to suppress notifications when a program is blocked - href: configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md - - name: Confirm that certificates are deployed correctly - href: confirm-that-certificates-are-deployed-correctly.md - - name: Copy a GPO to create a new GPO - href: copy-a-gpo-to-create-a-new-gpo.md - - name: Create a Group Account in Active Directory - href: create-a-group-account-in-active-directory.md - - name: Create a Group Policy Object - href: create-a-group-policy-object.md - - name: Create an authentication exemption list rule - href: create-an-authentication-exemption-list-rule.md - - name: Create an authentication request rule - href: create-an-authentication-request-rule.md - - name: Create an inbound ICMP rule - href: create-an-inbound-icmp-rule.md - - name: Create an inbound port rule - href: create-an-inbound-port-rule.md - - name: Create an inbound program or service rule - href: create-an-inbound-program-or-service-rule.md - - name: Create an outbound port rule - href: create-an-outbound-port-rule.md - - name: Create an outbound program or service rule - href: create-an-outbound-program-or-service-rule.md - - name: Create inbound rules to support RPC - href: create-inbound-rules-to-support-rpc.md - - name: Create WMI filters for the GPO - href: create-wmi-filters-for-the-gpo.md - - name: Create Windows Firewall rules in Intune - href: create-windows-firewall-rules-in-intune.md - - name: Enable predefined inbound rules - href: enable-predefined-inbound-rules.md - - name: Enable predefined outbound rules - href: enable-predefined-outbound-rules.md - - name: Exempt ICMP from authentication - href: exempt-icmp-from-authentication.md - - name: Link the GPO to the domain - href: link-the-gpo-to-the-domain.md - - name: Modify GPO filters - href: modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md - - name: Open IP security policies - href: open-the-group-policy-management-console-to-ip-security-policies.md - - name: Open Group Policy - href: open-the-group-policy-management-console-to-windows-firewall.md - - name: Open Group Policy - href: open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md - - name: Open Windows Firewall - href: open-windows-firewall-with-advanced-security.md - - name: Restrict server access - href: restrict-server-access-to-members-of-a-group-only.md - - name: Enable Windows Firewall - href: turn-on-windows-firewall-and-configure-default-behavior.md - - name: Verify Network Traffic - href: verify-that-network-traffic-is-authenticated.md - - name: Troubleshooting + - name: Configure Hyper-V firewall + href: hyper-v-firewall.md + - name: Configure the Windows Firewall log + href: configure-the-windows-firewall-log.md + - name: Create an inbound ICMP rule + href: create-an-inbound-icmp-rule.md + - name: Create an inbound port rule + href: create-an-inbound-port-rule.md + - name: Create an inbound program or service rule + href: create-an-inbound-program-or-service-rule.md + - name: Create an outbound port rule + href: create-an-outbound-port-rule.md + - name: Create an outbound program or service rule + href: create-an-outbound-program-or-service-rule.md + - name: Create inbound rules to support RPC + href: create-inbound-rules-to-support-rpc.md + - name: Create Windows Firewall rules in Intune + href: create-windows-firewall-rules-in-intune.md + - name: Configure the firewall + href: best-practices-configuring.md + - name: Secure IPsec + href: securing-end-to-end-ipsec-connections-by-using-ikev2.md + - name: PowerShell + href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md + - name: Isolate Microsoft Store Apps on Your Network + href: isolating-apps-on-your-network.md + - name: Troubleshoot items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall href: troubleshooting-uwp-firewall.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md deleted file mode 100644 index 7bfb1addfd..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Add Production Devices to the Membership Group for a Zone -description: Learn how to add production devices to the membership group for a zone and refresh the group policy on the devices in the membership group. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Add Production Devices to the Membership Group for a Zone - -After you test the GPOs for your design on a small set of devices, you can deploy them to the production devices. - -> [!CAUTION] -> For GPOs that contain connection security rules that prevent unauthenticated connections, ensure you set the rules to request, not require, authentication during testing. After you deploy the GPO and confirm that all of your devices are successfully communicating by using authenticated IPsec, then you can modify the GPO to require authentication. Don't change the boundary zone GPO to require mode. - -The method discussed in this guide uses the *Domain Computers* built-in group. The advantage of this method is that all new devices that are joined to the domain automatically receive the isolated domain GPO. To define this setting successfully, you must make sure that the WMI filters and security group filters exclude devices that must not receive the GPOs. Use device groups that deny both read and apply Group Policy permissions to the GPOs, such as a group used in the *CG_DOMISO_NOIPSEC* example design. Devices that are members of some zones must also be excluded from applying the GPOs for the main isolated domain. For more information, see the "Prevent members of a group from applying a GPO" section in [Assign Security Group Filters to the GPO](assign-security-group-filters-to-the-gpo.md). - -Without such a group (or groups), you must either add devices individually or use the groups containing device accounts that are available to you. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO. - -In this topic: - -- [Add the group Domain Devices to the GPO membership group](#to-add-domain-devices-to-the-gpo-membership-group) -- [Refresh Group Policy on the devices in the membership group](#to-refresh-group-policy-on-a-device) -- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) - -## To add domain devices to the GPO membership group - -1. Open Active Directory Users and Computers -1. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then the container in which you created the membership group -1. In the details pane, double-click the GPO membership group to which you want to add computers -1. Select the **Members** tab, and then click **Add** -1. Type **Domain Computers** in the text box, and then click **OK** -1. Click **OK** to close the group properties dialog box - -After a computer is a member of the group, you can force a Group Policy refresh on the computer. - -## To refresh Group Policy on a device - -From an elevated command prompt, type the following command: - -``` cmd -gpupdate.exe /target:computer /force -``` - -After Group Policy is refreshed, you can see which GPOs are currently applied to the computer. - -## To see which GPOs are applied to a device - -From an elevated command prompt, type the following command: - -``` cmd -gpresult.exe /r /scope:computer -``` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md b/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md deleted file mode 100644 index 2ed1c1a950..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Add Test Devices to the Membership Group for a Zone -description: Learn how to add devices to the group for a zone to test whether your Windows Defender Firewall with Advanced Security implementation works as expected. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Add Test Devices to the Membership Group for a Zone - -Before you deploy your rules to large numbers of devices, you must thoroughly test the rules to make sure that communications are working as expected. A misplaced WMI filter or an incorrectly typed IP address in a filter list can easily block communications between devices. Although we recommend that you set your rules to request mode until testing and deployment is complete. We also recommend that you initially deploy the rules to a few devices only to be sure that the correct GPOs are being processed by each device. - -Add at least one device of each supported operating system type to each membership group. Make sure every GPO for a specific version of Windows and membership group has a device among the test group. After Group Policy has been refreshed on each test device, check the output of the `gpresult.exe` command to confirm that each device is receiving only the GPOs it's supposed to receive. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the membership of the group for the GPO. - -In this topic: - -- [Add the test devices to the GPO membership groups](#to-add-test-devices-to-the-gpo-membership-groups) -- [Refresh Group Policy on the devices in each membership group](#to-refresh-group-policy-on-a-device) -- [Check which GPOs apply to a device](#to-see-which-gpos-are-applied-to-a-device) - -## To add test devices to the GPO membership groups - -1. Open Active Directory Users and Computers -1. In the navigation pane, expand **Active Directory Users and Computers**, expand *YourDomainName*, and then expand the container that holds your membership group account -1. In the details pane, double-click the GPO membership group to which you want to add devices -1. Select the **Members** tab, and then click **Add** -1. Type the name of the device in the text box, and then click **OK** -1. Repeat steps 5 and 6 for each extra device account or group that you want to add -1. Click **OK** to close the group properties dialog box - -After a device is a member of the group, you can force a Group Policy refresh on the device. - -## To refresh Group Policy on a device - -From an elevated command prompt, run the following command: - -``` cmd -gpupdate /target:device /force -``` - -After Group Policy is refreshed, you can see which GPOs are currently applied to the device. - -## To see which GPOs are applied to a device - -From an elevated command prompt, run the following command: - -``` cmd -gpresult /r /scope:computer -``` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md deleted file mode 100644 index f708e6a031..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Assign Security Group Filters to the GPO -description: Learn how to use Group Policy Management MMC to assign security group filters to a GPO to make sure that the GPO is applied to the correct computers. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Assign Security Group Filters to the GPO - -To make sure that your GPO is applied to the correct computers, use the Group Policy Management MMC snap-in to assign security group filters to the GPO. - ->[!IMPORTANT] ->This deployment guide uses the method of adding the Domain Computers group to the membership group for the main isolated domain after testing is complete and you are ready to go live in production. To make this method work, you must prevent any computer that is a member of either the boundary or encryption zone from applying the GPO for the main isolated domain. For example, on the GPOs for the main isolated domain, deny Read and Apply Group Policy permissions to the membership groups for the boundary and encryption zones. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the relevant GPOs. - -In this topic: - -- [Allow members of a group to apply a GPO](#to-allow-members-of-a-group-to-apply-a-gpo) -- [Prevent members of a group from applying a GPO](#to-prevent-members-of-a-group-from-applying-a-gpo) - -## To allow members of a group to apply a GPO - -Use the following procedure to add a group to the security filter on the GPO that allows group members to apply the GPO. - -1. Open the Group Policy Management console -1. In the navigation pane, find and then select the GPO that you want to modify -1. In the details pane, under **Security Filtering**, select **Authenticated Users**, and then select **Remove** - - >[!NOTE] - >You must remove the default permission granted to all authenticated users and computers to restrict the GPO to only the groups you specify. - -1. Select **Add** -1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain - -## To prevent members of a group from applying a GPO - -Use the following procedure to add a group to the security filter on the GPO that prevents group members from applying the GPO. This is typically used to prevent members of the boundary and encryption zones from applying the GPOs for the isolated domain. - -1. Open the Group Policy Management console -1. In the navigation pane, find and then select the GPO that you want to modify -1. In the details pane, select the **Delegation** tab -1. Select **Advanced** -1. Under the **Group or user names** list, select **Add** -1. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then select **OK**. If you do not know the name, you can select **Advanced** to browse the list of groups available in the domain -1. Select the group in the **Group or user names** list, and then select the box in the **Deny** column for both **Read** and **Apply group policy** -1. Select **OK**, and then in the **Windows Security** dialog box, select **Yes** -1. The group appears in the list with **Custom** permissions diff --git a/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md b/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md deleted file mode 100644 index cbfaffb255..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Change Rules from Request to Require Mode -description: Learn how to convert a rule from request to require mode and apply the modified GPOs to the client devices. -ms.prod: windows-client -ms.topic: how-to -ms.date: 11/10/2023 ---- - -# Change Rules from Request to Require Mode - -After you confirm that network traffic is being correctly protected by using IPsec, you can change the rules for the domain isolation and encryption zones to require, instead of request, authentication. Don't change the rules for the boundary zone; they must stay in request mode so that devices in the boundary zone can continue to accept connections from devices that aren't part of the isolated domain. - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -In this topic: - -- [Convert a rule from request to require mode](#to-convert-a-rule-from-request-to-require-mode) -- [Apply the modified GPOs to the client devices](#to-apply-the-modified-gpos-to-the-client-devices) - -## To convert a rule from request to require mode - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -1. In the right navigation pane, click **Connection Security Rules** -1. In the details pane, double-click the connection security rule that you want to modify -1. Click the **Authentication** tab -1. In the **Requirements** section, change **Authenticated mode** to **Require inbound and request outbound**, and then click **OK** - -## To apply the modified GPOs to the client devices - -1. The next time each device refreshes its Group Policy, it will receive the updated GPO and apply the modified rule. To force an immediate refresh, run the following command from an elevated command prompt: - - ``` cmd - gpupdate.exe /force - ``` - -1. To verify that the modified GPO is correctly applied to the client devices, you can run the following command: - - ``` cmd - gpresult.exe /r /scope computer - ``` - -1. Examine the command output for the list of GPOs that are applied to the device, and make sure that the list contains the GPOs you expect to see on that device. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md deleted file mode 100644 index 96a9db2d70..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Configure Authentication Methods -description: Learn how to configure authentication methods for devices in an isolated domain or standalone server zone in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Authentication Methods - - -This procedure shows you how to configure the authentication methods that can be used by computers in an isolated domain or standalone isolated server zone. - ->**Note:**  If you follow the steps in the procedure in this topic, you alter the system-wide default settings. Any connection security rule can use these settings by specifying **Default** on the **Authentication** tab. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To configure authentication methods** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane on the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec Settings** tab, click **Customize**. - -4. In the **Authentication Method** section, select the type of authentication that you want to use from among the following: - - 1. **Default**. Selecting this option tells the computer to use the authentication method currently defined by the local administrator in Windows Defender Firewall or by Group Policy as the default. - - 2. **Computer certificate from this certification authority**. Selecting this option and entering the identification of a certification authority (CA) tells the computer to use and require authentication by using a certificate that is issued by the selected CA. If you also select **Accept only health certificates**, then only certificates that include the system health authentication extended key usage (EKU) typically provided in a Network Access Protection (NAP) infrastructure can be used for this rule. - - 3. **Advanced**. Click **Customize** to specify a custom combination of authentication methods required for your scenario. You can specify both a **First authentication method** and a **Second authentication method**. - - The first authentication method can be one of the following methods: - - - **Computer (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works only with other computers that can use AuthIP. User-based authentication using Kerberos V5 isn't supported by IKE v1. - - - **Computer certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by that CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used. - - - **Preshared key (not recommended)**. Selecting this method and entering a preshared key tells the computer to authenticate by exchanging the preshared keys. If they match, then the authentication succeeds. This method isn't recommended, and is included only for backward compatibility and testing purposes. - - If you select **First authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails. - - The second authentication method can be one of the following methods: - - - **User (NTLMv2)**. Selecting this option tells the computer to use and require authentication of the currently signed-in user by using their domain credentials, and uses the NTLMv2 protocol instead of Kerberos V5. This authentication method works only with other computers that can use AuthIP. User-based authentication using Kerberos V5 isn't supported by IKE v1. - - - **User health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require user-based authentication by using a certificate that is issued by the specified CA. If you also select **Enable certificate to account mapping**, then the certificate can be associated with a user in Active Directory for purposes of granting or denying access to specified users or user groups. - - - **Computer health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the computer to use and require authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates that include the system health authentication EKU typically provided in a NAP infrastructure can be used for this rule. - - If you select **Second authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails. - - >**Important:** Make sure that you do not select the check boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails. - -5. Click **OK** on each dialog box to save your changes and return to the Group Policy Management Editor. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md deleted file mode 100644 index a8f2bc0f33..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Configure Data Protection (Quick Mode) Settings -description: Learn how to configure the data protection settings for connection security rules in an isolated domain or a standalone isolated server zone. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Data Protection (Quick Mode) Settings - - -This procedure shows you how to configure the data protection (quick mode) settings for connection security rules in an isolated domain or a standalone isolated server zone. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To configure quick mode settings** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane on the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec Settings** tab, click **Customize**. - -4. In the **Data protection (Quick Mode)** section, click **Advanced**, and then click **Customize**. - -5. If you require encryption for all network traffic in the specified zone, then check **Require encryption for all connection security rules that use these settings**. Selecting this option disables the **Data integrity** section, and forces you to select only integrity algorithms that are combined with an encryption algorithm. If you do not select this option, then you can use only data integrity algorithms. Before selecting this option, consider the performance impact and the increase in network traffic that will result. We recommend that you use this setting only on network traffic that truly requires it, such as to and from computers in the encryption zone. - -6. If you did not select **Require encryption**, then select the data integrity algorithms that you want to use to help protect the data sessions between the two computers. If the data integrity algorithms displayed in the list are not what you want, then do the following: - - 1. From the left column, remove any of the data integrity algorithms that you do not want by selecting the algorithm and then clicking **Remove**. - - 2. Add any required data integrity algorithms by clicking **Add**, selecting the appropriate protocol (ESP or AH) and algorithm (SHA1 or MD5), selecting the key lifetime in minutes or sessions, and then clicking **OK**. We recommend that you do not include MD5 in any combination. It is included for backward compatibility only. We also recommend that you use ESP instead of AH if you have any devices on your network that use network address translation (NAT). - - 3. In **Key lifetime (in sessions)**, type the number of times that the quick mode session can be rekeyed. After this number is reached, the quick mode SA must be renegotiated. Be careful to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance because of the more frequent renegotiating of the quick mode SA. We recommend that you use the default value unless your risk analysis indicates the need for a different value. - - 4. Click **OK** to save your algorithm combination settings. - - 5. After the list contains only the combinations you want, use the up and down arrows to the right of the list to rearrange them in the correct order for your design. The algorithm combination that is first in the list is tried first, and so on. - -7. Select the data integrity and encryption algorithms that you want to use to help protect the data sessions between the two computers. If the algorithm combinations displayed in the list are not what you want, then do the following: - - 1. From the second column, remove any of the data integrity and encryption algorithms that you do not want by selecting the algorithm combination and then clicking **Remove**. - - 2. Add any required integrity and encryption algorithm combinations by clicking **Add**, and then doing the following: - - 3. Select the appropriate protocol (ESP or AH). We recommend that you use ESP instead of AH if you have any devices on your network that use NAT. - - 4. Select the appropriate encryption algorithm. The choices include, in order of decreasing security: AES-256, AES-192, AES-128, 3DES, and DES. We recommend that you do not include DES in any combination. It is included for backward compatibility only. - - 5. Select the appropriate integrity algorithm (SHA1 or MD5). We recommend that you do not include MD5 in any combination. It is included for backward compatibility only. - - 6. In **Key lifetime (in minutes)**, type the number of minutes. When the specified number of minutes has elapsed, any IPsec operations between the two computers that negotiated this key will require a new key. Be careful to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance because of the more frequent rekeying. We recommend that you use the default value unless your risk analysis indicates the need for a different value. - -8. Click **OK** three times to save your settings. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md deleted file mode 100644 index f049b2e663..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Configure Group Policy to Autoenroll and Deploy Certificates -description: Learn how to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Group Policy to Autoenroll and Deploy Certificates - - -You can use this procedure to configure Group Policy to automatically enroll client computer certificates and deploy them to the workstations on your network. Follow this procedure for each GPO that contains IPsec connection security rules that require this certificate. - -**Administrative credentials** - -To complete these procedures, you must be a member of both the Domain Admins group in the root domain of your forest and a member of the Enterprise Admins group. - -**To configure Group Policy to autoenroll certificates** - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane, expand the following path: **Computer Configuration**, **Policies**, **Windows Settings**, **Security Settings**, **Public Key Policies**. - -4. Double-click **Certificate Services Client - Auto-Enrollment**. - -5. In the **Properties** dialog box, change **Configuration Model** to **Enabled**. - -6. Select both **Renew expired certificates, update pending certificates, and remove revoked certificates** and **Update certificates that use certificate templates**. - -7. Click **OK** to save your changes. Computers apply the GPO and download the certificate the next time Group Policy is refreshed. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md deleted file mode 100644 index 02ffc24817..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Configure Key Exchange (Main Mode) Settings -description: Learn how to configure the main mode key exchange settings used to secure the IPsec authentication traffic in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Key Exchange (Main Mode) Settings - - -This procedure shows you how to configure the main mode key exchange settings used to secure the IPsec authentication traffic. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To configure key exchange settings** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane on the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec Settings** tab, click **Customize**. - -4. In the **Key exchange (Main Mode)** section, click **Advanced**, and then click **Customize**. - -5. Select the security methods to be used to help protect the main mode negotiations between the two devices. If the security methods displayed in the list aren't what you want, then do the following steps: - - **Important**   - In Windows Vista, Windows Server 2008, or later, you can specify only one key exchange algorithm. This rule means that if you want to communicate by using IPsec with another device running Windows 8 or Windows Server 2012, then you must select the same key exchange algorithm on both devices. - - Also, if you create a connection security rule that specifies an option that requires AuthIP instead of IKE, then only the one combination of the top integrity and encryption security method is used in the negotiation. Ensure that all of your devices that are running at least Windows Vista and Windows Server 2008 have the same methods at the top of the list and the same key exchange algorithm selected. - - **Note**   - When AuthIP is used, no Diffie-Hellman key exchange protocol is used. Instead, when Kerberos V5 authentication is requested, the Kerberos V5 service ticket secret is used in place of a Diffie-Hellman value. When either certificate authentication or NTLM authentication is requested, a transport level security (TLS) session is established, and its secret is used in place of the Diffie-Hellman value. This event happens no matter which Diffie-Hellman key exchange protocol you select. - - 1. Remove any of the security methods that you don't want by selecting the method and then clicking **Remove**. - - 2. Add any required security method combinations by clicking **Add**, selecting the appropriate encryption algorithm and integrity algorithm from the lists, and then clicking **OK**. - - >**Caution:**  We recommend that you do not include MD5 or DES in any combination. They are included for backward compatibility only. - - 3. After the list contains only the combinations you want, use the "up" and "down" arrows to the right of the list to arrange them in the order of preference. The combination that appears first in the list is tried first, and so on. - -6. From the list on the right, select the key exchange algorithm that you want to use. - - >**Caution:**  We recommend that you do not use Diffie-Hellman Group 1. It is included for backward compatibility only.  - -7. In **Key lifetime (in minutes)**, type the number of minutes. When the specified number of minutes has elapsed, any IPsec operation between the two devices requires a new key. - - >**Note:**  You need to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance. - -8. In **Key lifetime (in sessions)**, type the number of sessions. After the specified number of quick mode sessions have been created within the security association protected by this key, IPsec requires a new key. - -9. Click **OK** three times to save your settings. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md deleted file mode 100644 index ce9b0f15ce..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: Configure the Rules to Require Encryption -description: Learn how to configure rules to add encryption algorithms and delete the algorithm combinations that don't use encryption for zones that require encryption. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure the Rules to Require Encryption - -If you're creating a zone that requires encryption, you must configure the rules to add the encryption algorithms and delete the algorithm combinations that don't use encryption. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To modify an authentication request rule to also require encryption** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Connection Security Rules**. - -3. In the details pane, double-click the connection security rule you want to modify. - -4. On the **Name** page, rename the connection security rule, edit the description to reflect the new use for the rule, and then click **OK**. - -5. In the navigation pane, right-click **Windows Defender Firewall – LDAP://CN={**guid**}**, and then click **Properties**. - -6. Click the **IPsec Settings** tab. - -7. Under **IPsec defaults**, click **Customize**. - -8. Under **Data protection (Quick Mode)**, click **Advanced**, and then click **Customize**. - -9. Click **Require encryption for all connection security rules that use these settings**. - - This setting disables the data integrity rules section. Ensure the **Data integrity and encryption** list contains all of the combinations that your client devices will use to connect to members of the encryption zone. The client devices receive their rules through the GPO for the zone to which they reside. You must make sure that those rules contain at least one of the data integrity and encryption algorithms that are configured in this rule, or the client devices in that zone won't be able to connect to devices in this zone. - -10. If you need to add an algorithm combination, click **Add** and then select the combination of encryption and integrity algorithms. The options are described in [Configure Data Protection (Quick Mode) Settings](configure-data-protection-quick-mode-settings.md). - - **Note**   - Not all of the algorithms available in Windows 8 or Windows Server 2012 and later can be selected in the Windows Defender Firewall with Advanced Security user interface. To select them, you can use Windows PowerShell. - - Quick mode settings can also be configured on a per-rule basis, but not by using the Windows Defender Firewall user interface. Instead, you can create or modify the rules by using Windows PowerShell. - - For more info, see [Windows Defender Firewall with Advanced Security Administration with Windows PowerShell](windows-firewall-with-advanced-security-administration-with-windows-powershell.md) - -11. During negotiation, algorithm combinations are proposed in the order shown in the list. Ensure that the more secure combinations are at the top of the list so that the negotiating devices select the most secure combination that they can jointly support. - -12. Click **OK** three times to save your changes. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md deleted file mode 100644 index fe9d417849..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Configure the Workstation Authentication Template -description: Learn how to configure a workstation authentication certificate template, which is used for device certificates that are enrolled and deployed to workstations. -ms.prod: windows-client -ms.date: 09/07/2021 -ms.topic: conceptual ---- - -# Configure the Workstation Authentication Certificate Template - - -This procedure describes how to configure a certificate template that Active Directory Certification Services (AD CS) uses as the starting point for device certificates that are automatically enrolled and deployed to workstations in the domain. It shows how to create a copy of a template, and then configure the template according to your design requirements. - -**Administrative credentials** - -## To configure the workstation authentication certificate template and autoenrollment -To complete these procedures, you must be a member of both the Domain Admins group in the root domain of your forest, and a member of the Enterprise Admins group. - - -1. On the device where AD CS is installed, open the Certification Authority console. - -2. In the navigation pane, right-click **Certificate Templates**, and then click **Manage**. - -3. In the details pane, click the **Workstation Authentication** template. - -4. On the **Action** menu, click **Duplicate Template**. In the **Duplicate Template** dialog box, select the template version that is appropriate for your deployment, and then click **OK**. For the resulting certificates to have maximum compatibility with the available versions of Windows, we recommended that you select **Windows Server 2003**. - -5. On the **General** tab, in **Template display name**, type a new name for the certificate template, such as **Domain Isolation Workstation Authentication Template**. - -6. Click the **Subject Name** tab. Make sure that **Build from this Active Directory information** is selected. In **Subject name format**, select **Fully distinguished name**. - -7. Click the **Cryptography** tab. You must determine the best minimum key size for your environment. Large key sizes provide better security, but they can affect server performance. We recommended that you use the default setting of 2048. - -8. Click the **Security** tab. In **Group or user names**, click **Domain Computers**, under **Allow**, select **Enroll** and **Autoenroll**, and then click **OK**. - - >**Note:**  If you want do not want to deploy the certificate to every device in the domain, then specify a different group or groups that contain the device accounts that you want to receive the certificate. - -9. Close the Certificate Templates Console. - -10. In the Certification Authority MMC snap-in, in the left pane, right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. - -11. In the **Enable Certificate Templates** dialog box, click the name of the certificate template you configured, and then click **OK**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md deleted file mode 100644 index fe75296fec..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md +++ /dev/null @@ -1,40 +0,0 @@ ---- -title: Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program is Blocked -description: Configure Windows Defender Firewall with Advanced Security to suppress notifications when a program is Blocked -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Configure Windows Defender Firewall with Advanced Security to Suppress Notifications When a Program Is Blocked - - -To configure Windows Defender Firewall with Advanced Security to suppress the display of a notification when it blocks a program that tries to listen for network traffic and to prohibit locally defined rules, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console. - ->**Caution:**  If you choose to disable alerts and prohibit locally defined rules, then you must create firewall rules that allow your users’ programs to send and receive the required network traffic. If a firewall rule is missing, then the user does not receive any kind of warning, the network traffic is silently blocked, and the program might fail. - -We recommend that you don't enable these settings until you've created and tested the required rules. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To configure Windows Defender Firewall to suppress the display of a notification for a blocked program and to ignore locally defined rules - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. - -3. For each network location type (Domain, Private, Public), perform the following steps. - - 1. Click the tab that corresponds to the network location type. - - 2. Under **Settings**, click **Customize**. - - 3. Under **Firewall settings**, change **Display a notification** to **No**. - - 4. Under **Rule merging**, change **Apply local firewall rules** to **No**. - - 5. Although a connection security rule isn't a firewall setting, you can also use this tab to prohibit locally defined connection security rules if you're planning to deploy IPsec rules as part of a server or domain isolation environment. Under **Rule merging**, change **Apply local connection security rules** to **No**. - - 6. Click **OK** twice. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md b/windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md deleted file mode 100644 index dcca043129..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md +++ /dev/null @@ -1,39 +0,0 @@ ---- -title: Confirm That Certificates Are Deployed Correctly -description: Learn how to confirm that a Group Policy is being applied as expected and that the certificates are being properly installed on the workstations. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 01/24/2023 ---- - -# Confirm That Certificates Are Deployed Correctly - -After configuring your certificates and autoenrollment in Group Policy, you can confirm that the policy is being applied as expected, and that the certificates are being properly installed on the workstation devices. - -In these procedures, you refresh Group Policy on a client device, and then confirm that the certificate is deployed correctly. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -In this topic: - -- [Refresh Group Policy on a device](#to-refresh-group-policy-on-a-device) -- [Verify that a certificate is installed](#to-verify-that-a-certificate-is-installed) - -## To refresh Group Policy on a device - - From an elevated command prompt, run the following command: - -``` cmd -gpupdate /target:computer /force -``` - -After Group Policy is refreshed, you can see which GPOs are currently applied to the device. - -## To verify that a certificate is installed - -1. Open the Certificates console -1. In the navigation pane, expand **Trusted Root Certification Authorities**, and then click **Certificates** - - The CA that you created appears in the list. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md deleted file mode 100644 index 2493780e6b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Copy a GPO to Create a New GPO -description: Learn how to make a copy of a GPO by using the Active Directory Users and devices MMC snap-in to create a GPO for boundary zone devices. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Copy a GPO to Create a New GPO - - -To create the GPO for the boundary zone devices, make a copy of the main domain isolation GPO, and then change the settings to request, instead of require, authentication. To make a copy of a GPO, use the Active Directory Users and devices MMC snap-in. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new GPOs. - -**To make a copy of a GPO** - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:**YourForestName, expand **Domains**, expand *YourDomainName*, and then click **Group Policy Objects**. - -3. In the details pane, right-click the GPO you want to copy, and then click **Copy**. - -4. In the navigation pane, right-click **Group Policy Objects** again, and then click **Paste**. - - :::image type="content" alt-text="Screenshot that shows Copy Paste GPO." source="images/grouppolicy-paste.png"::: - -5. In the **Copy GPO** dialog box, click **Preserve the existing permissions**, and then click **OK**. Selecting this option preserves any exception groups to which you denied Read and Apply GPO permissions, making the change simpler. - -6. After the copy is complete, click **OK**. The new GPO is named **Copy of** *original GPO name*. - -7. To rename it, right-click the GPO, and then click **Rename**. - -8. Type the new name, and then press ENTER. - -9. You must change the security filters to apply the policy to the correct group of devices. To change the security filters, click the **Scope** tab, and in the **Security Filtering** section, select the group that grants permissions to all members of the isolated domain, for example **CG\_DOMISO\_IsolatedDomain**, and then click **Remove**. - -10. In the confirmation dialog box, click **OK**. - -11. Click **Add**. - -12. Type the name of the group that contains members of the boundary zone, for example **CG\_DOMISO\_Boundary**, and then click **OK**. - -13. If necessary, change the WMI filter to one appropriate for the new GPO. For example, if the original GPO is for client devices running Windows 10 or Windows 11, and the new boundary zone GPO is for devices running Windows Server 2016, then select a WMI filter that allows only those devices to read and apply the GPO. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md b/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md deleted file mode 100644 index e323d44596..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md +++ /dev/null @@ -1,36 +0,0 @@ ---- -title: Create a Group Account in Active Directory -description: Learn how to create a security group for the computers that are to receive Group Policy settings by using the Active Directory Users and Computers console. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create a Group Account in Active Directory - - -To create a security group to contain the computer accounts for the computers that are to receive a set of Group Policy settings, use the Active Directory Users and Computers console. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new group accounts. - -**To add a new membership group in Active Directory** - -1. Open the Active Directory Users and Computers console. - -2. In the navigation pane, select the container in which you want to store your group. This is typically the **Users** container under the domain. - -3. Click **Action**, click **New**, and then click **Group**. - -4. In the **Group name** text box, type the name for your new group. - - >**Note:**  Be sure to use a name that clearly indicates its purpose. Check to see if your organization has a naming convention for groups. - -5. In the **Description** text box, enter a description of the purpose of this group. - -6. In the **Group scope** section, select either **Global** or **Universal**, depending on your Active Directory forest structure. If your group must include computers from multiple domains, then select **Universal**. If all of the members are from the same domain, then select **Global**. - -7. In the **Group type** section, click **Security**. - -8. Click **OK** to save your group. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md b/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md deleted file mode 100644 index 11638e864b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Create a Group Policy Object -description: Learn how to use the Active Directory Users and Computers MMC snap-in to create a GPO. You must be a member of the Domain Administrators group. -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create a Group Policy Object - - -To create a new GPO, use the Active Directory Users and Computers MMC snap-in. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to create new GPOs. - -To create a new GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:**YourForestName, expand **Domains**, expand *YourDomainName*, and then click **Group Policy Objects**. - -3. Click **Action**, and then click **New**. - -4. In the **Name** text box, type the name for your new GPO. - - > [!NOTE] - > Be sure to use a name that clearly indicates the purpose of the GPO. Check to see if your organization has a naming convention for GPOs. - -5. Leave **Source Starter GPO** set to **(none)**, and then click **OK**. - -6. If your GPO will not contain any user settings, then you can improve performance by disabling the **User Configuration** section of the GPO. To do this, perform these steps: - - 1. In the navigation pane, click the new GPO. - - 2. In the details pane, click the **Details** tab. - - 3. Change the **GPO Status** to **User configuration settings disabled**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md deleted file mode 100644 index 76f020233e..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: Create an Authentication Exemption List Rule -description: Learn how to create rules that exempt devices that cannot communicate by using IPSec from the authentication requirements of your isolation policies. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Authentication Exemption List Rule - - -In almost any isolated server or isolated domain scenario, there are some devices or devices that cannot communicate by using IPsec. This procedure shows you how to create rules that exempt those devices from the authentication requirements of your isolation policies. - -**Important**   -Adding devices to the exemption list for a zone reduces security because it permits devices in the zone to send network traffic that is unprotected by IPsec to the devices on the list. As discussed in the Windows Defender Firewall with Advanced Security Design Guide, you must add only managed and trusted devices to the exemption list. - - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -**To create a rule that exempts specified hosts from authentication** - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Connection Security Rules**. - -3. Click **Action**, and then click **New Rule**. - -4. On the **Rule Type** page of the New Connection Security Rule Wizard, click **Authentication exemption**, and then click **Next**. - -5. On the **Exempt Computers** page, to create a new exemption, click **Add**. To modify an existing exemption, click it, and then click **Edit**. - -6. In the **IP Address** dialog box, do one of the following: - - - To add a single IP address, click **This IP address or subnet**, type the IP address of the host in the text box, and then click **OK**. - - - To add an entire subnet by address, click **This IP address or subnet**, and then type the IP address of the subnet, followed by a forward slash (/) and the number of bits in the corresponding subnet mask. For example, **10.50.0.0/16** represents the class B subnet that begins with address 10.50.0.1, and ends with address **10.50.255.254**. Click **OK** when you are finished. - - - To add the local device’s subnet, click **Predefined set of computers**, select **Local subnet** from the list, and then click **OK**. - - >**Note:**  If you select the local subnet from the list rather than typing the subnet address in manually, the device automatically adjusts the active local subnet to match the device’s current IP address. - - - To add a discrete range of addresses that do not correspond to a subnet, click **This IP address range**, type the beginning and ending IP addresses in the **From** and **To** text boxes, and then click **OK**. - - - To exempt all of the remote hosts that the local device uses for a specified network service, click **Predefined set of computers**, select the network service from the list, and then click **OK**. - -7. Repeat steps 5 and 6 for each exemption that you need to create. - -8. Click **Next** when you have created all of the exemptions. - -9. On the **Profile** page, check the profile for each network location type to which this set of exemptions applies, and then click **Next**. - - >**Caution:**  If all of the exemptions are on the organization’s network and that network is managed by an Active Directory domain, then consider restricting the rule to the Domain profile only. Selecting the wrong profile can reduce the protection for your computer because any computer with an IP address that matches an exemption rule will not be required to authenticate. - -10. On the **Name** page, type the name of the exemption rule, type a description, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md deleted file mode 100644 index 488578107f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md +++ /dev/null @@ -1,78 +0,0 @@ ---- -title: Create an Authentication Request Rule -description: Create a new rule for Windows Defender Firewall with Advanced Security so devices on the network use IPsec protocols and methods before they can communicate. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Authentication Request Rule - -**Applies to:** -- Windows 10 -- Windows 11 -- Windows Server 2016 and above - -After you have configured IPsec algorithms and authentication methods, you can create the rule that requires the devices on the network to use those protocols and methods before they can communicate. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the (Group Policy Objects) GPOs. - -To create the authentication request rule: - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, right-click **Connection Security Rules**, and then click **New Rule**. - -3. On the **Rule Type** page, select **Isolation**, and then click **Next**. - -4. On the **Requirements** page, select **Request authentication for inbound and outbound connections**. - - > [!CAUTION] - > Do not configure the rule to require inbound authentication until you have confirmed that all of your devices are receiving the correct GPOs, and are successfully negotiating IPsec and authenticating with each other. Allowing the devices to communicate even when authentication fails prevents any errors in the GPOs or their distribution from breaking communications on your network. - -5. On the **Authentication Method** page, select the authentication option you want to use on your network. To select multiple methods that are attempted in order until one succeeds, click **Advanced**, click **Customize**, and then click **Add** to add methods to the list. Second authentication methods require Authenticated IP (AuthIP). - - 1. **Default**. Selecting this option tells the device to request authentication by using the method currently defined as the default on the device. This default might have been configured when the operating system was installed or it might have been configured by Group Policy. Selecting this option is appropriate when you have configured system-wide settings by using the [Configure Authentication Methods](configure-authentication-methods.md) procedure. - - 2. **Advanced**. Selecting this option enables you to specify a custom combination of authentication methods required for your scenario. - -6. Optional: If you selected **Advanced** in the previous step, then Click **Customize** to specify a custom combination of authentication methods required for your scenario. You can specify both a **First authentication method** and a **Second authentication method**. - - The **First authentication method** can be one of the following: - - - **Computer (NTLMv2)**. Selecting this option tells the device to use and require authentication of the device by using its domain credentials. This option works only with other devices that can use AuthIP. User-based authentication using Kerberos V5 is not supported by IKE v1. - - - **Computer certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the device to request authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used for this rule. - - - **Preshared key (not recommended)**. Selecting this method and entering a pre-shared key tells the device to authenticate by exchanging the pre-shared keys. If the keys match, then the authentication succeeds. This method is not recommended, and is included for backward compatibility and testing purposes only. - - If you select **First authentication is optional**, then the connection can succeed even if the authentication attempt specified in this column fails. - - The **Second authentication method** can be one of the following: - - - **User (NTLMv2)**. Selecting this option tells the device to use and require authentication of the currently logged-on user by using his or her domain credentials, and uses the NTLMv2 protocol instead of Kerberos V5. This authentication method works only with other devices that can use AuthIP. User-based authentication using NTLMv2 is not supported by IKE v1. - - - **User health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the device to request user-based authentication by using a certificate that is issued by the specified CA. If you also select **Enable certificate to account mapping**, then the certificate can be associated with a user in Active Directory for purposes of granting or denying access to certain users or user groups. - - - **Computer health certificate from this certification authority (CA)**. Selecting this option and entering the identification of a CA tells the device to use and require authentication by using a certificate that is issued by the specified CA. If you also select **Accept only health certificates**, then only certificates issued by a NAP server can be used for this rule. - - If you check **Second authentication is optional**, the connection can succeed even if the authentication attempt specified in this column fails. - - > [!IMPORTANT] - > Make sure that you do not select the boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails. - -7. After you have configured the authentication methods, click **OK** on each dialog box to save your changes and close it, until you return to the **Authentication Method** page in the wizard. Click **Next**. - -8. On the **Profile** page, select the check boxes for the network location type profiles to which this rule applies. - - - On portable devices, consider clearing the **Private** and **Public** boxes to enable the device to communicate without authentication when it is away from the domain network. - - - On devices that do not move from network to network, consider selecting all the profiles. Doing so prevents an unexpected switch in the network location type from disabling the rule. - - Click **Next**. - -9. On the **Name** page, type a name for the connection security rule and a description, and then click **Finish**. - - The new rule appears in the list of connection security rules. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md deleted file mode 100644 index a2cad4e58d..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Create WMI Filters for the GPO -description: Learn how to use WMI filters on a GPO to make sure that each GPO for a group can only be applied to devices running the correct version of Windows. -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create WMI Filters for the GPO - - -To make sure that each GPO associated with a group can only be applied to devices running the correct version of Windows, use the Group Policy Management MMC snap-in to create and assign WMI filters to the GPO. Although you can create a separate membership group for each GPO, you would then have to manage the memberships of the different groups. Instead, use only a single membership group, and let WMI filters automatically ensure the correct GPO is applied to each device. - -- [Create WMI Filters for the GPO](#create-wmi-filters-for-the-gpo) - - [To create a WMI filter that queries for a specified version of Windows](#to-create-a-wmi-filter-that-queries-for-a-specified-version-of-windows) - - [To link a WMI filter to a GPO](#to-link-a-wmi-filter-to-a-gpo) - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -First, create the WMI filter and configure it to look for a specified version (or versions) of the Windows operating system. - -## To create a WMI filter that queries for a specified version of Windows - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, and then select **WMI Filters**. - -3. Select **Action**, and then select **New**. - -4. In the **Name** text box, type the name of the WMI filter. Be sure to use a name that clearly indicates the purpose of the filter. Check to see if your organization has a naming convention. - -5. In the **Description** text box, type a description for the WMI filter. For example, if the filter excludes domain controllers, you might consider stating that in the description. - -6. Select **Add**. - -7. Leave the **Namespace** value set to **root\\CIMv2**. - -8. In the **Query** text box, type: - - ``` syntax - select * from Win32_OperatingSystem where Version like "6.%" - ``` - - This query will return **true** for devices running at least Windows Vista and Windows Server 2008. To set a filter for just Windows 8 and Windows Server 2012, use "6.2%". For Windows 11, Windows 10, and Windows Server 2016, use "10.%". To specify multiple versions, combine them with or, as shown in the following: - - ``` syntax - ... where Version like "6.1%" or Version like "6.2%" - ``` - - To restrict the query to only clients or only servers, add a clause that includes the ProductType parameter. To filter for client operating systems only, such as Windows 8 or Windows 7, use only ProductType="1". For server operating systems that are not domain controllers and for Windows 10 and Windows 11 multi-session, use ProductType="3". For domain controllers only, use ProductType="2". This is a useful distinction, because you often want to prevent your GPOs from being applied to the domain controllers on your network. - - The following clause returns **true** for all devices that are not domain controllers: - - ``` syntax - ... where ProductType="1" or ProductType="3" - ``` - - The following complete query returns **true** for all devices running Windows 10 and Windows 11, and returns **false** for any server operating system or any other client operating system. - - ``` syntax - select * from Win32_OperatingSystem where Version like "10.%" and ProductType="1" - ``` - - Specific versions of Windows 10 can be targeted by including the *major build version* in the query. The following query returns **true** for all devices running Windows 10 20H2 (which has a *major build version* of `19042`), and returns **false** for any server operating system or any other client operating system. Additional information about Windows 10 build versions can be found at [Windows 10 release information](/windows/release-health/release-information). - - ```syntax - select * from Win32_OperatingSystem where Version like "10.0.19042" and ProductType="1" - ``` - - The following query returns **true** for any device running Windows Server 2016, except domain controllers: - - ``` syntax - select * from Win32_OperatingSystem where Version like "10.%" and ProductType="3" - ``` - -9. Select **OK** to save the query to the filter. - -10. Select **Save** to save your completed filter. - -> [!NOTE] -> If you're using multiple queries in the same WMI filter, these queries must all return **TRUE** for the filter requirements to be met and for the GPO to be applied. - -## To link a WMI filter to a GPO - -After you have created a filter with the correct query, link the filter to the GPO. Filters can be reused with many GPOs simultaneously; you do not have to create a new one for each GPO if an existing one meets your needs. - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then select the GPO that you want to modify. - -3. Under **WMI Filtering**, select the correct WMI filter from the list. - -4. Select **Yes** to accept the filter. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md deleted file mode 100644 index 62d1fcb8d8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md +++ /dev/null @@ -1,133 +0,0 @@ ---- -title: Determining the Trusted State of Your Devices -description: Learn how to define the trusted state of devices in your enterprise to help design your strategy for using Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Determining the Trusted State of Your Devices - - -After obtaining information about the devices that are currently part of the IT infrastructure, you must determine at what point a device is considered trusted. The term *trusted* can mean different things to different people. Therefore, you must communicate a firm definition for it to all stakeholders in the project. Failure to do this communication can lead to problems with the security of the trusted environment, because the overall security can't exceed the level of security set by the least secure client that achieves trusted status. - ->**Note:**  In this context, the term *trust* has nothing to do with an Active Directory trust relationship between domains. The trusted state of your devices just indicates the level of risk that you believe the device brings to the network. Trusted devices bring little risk whereas untrusted devices can potentially bring great risk. - -## Trust states - - -To understand this concept, consider the four basic states that apply to devices in a typical IT infrastructure. These states are (in order of risk, lowest risk first): - -- Trusted - -- Trustworthy - -- Known, untrusted - -- Unknown, untrusted - -The remainder of this section defines these states and how to determine which devices in your organization belong in each state. - -### Trusted state - -Classifying a device as trusted means that the device's security risks are managed, but it doesn't imply that it's perfectly secure or invulnerable. The responsibility for this managed state falls to the IT and security administrators, in addition to the users who are responsible for the configuration of the device. A trusted device that is poorly managed will likely become a point of weakness for the network. - -When a device is considered trusted, other trusted devices can reasonably assume that the device won't initiate a malicious act. For example, trusted devices can expect that other trusted devices won't run a virus that attacks them, because all trusted devices are required to use mechanisms (such as antivirus software) to mitigate the threat of viruses. - -Spend some time defining the goals and technology requirements that your organization considers appropriate as the minimum configuration for a device to obtain trusted status. - -A possible list of technology requirements might include: - -- **Operating system.** A trusted client device should run at least Windows Vista. A trusted server should run at least Windows Server 2008. - -- **Domain membership.** A trusted device will belong to a managed Active Directory domain, which means that the IT department has security management rights and can configure member devices by using Group Policy. - -- **Management client.** All trusted devices must run a specific network management client to allow for centralized management and control of security policies, configurations, and software. Configuration Manager is one such management system with an appropriate client. - -- **Antivirus software.** All trusted devices will run antivirus software that is configured to check for and automatically update the latest virus signature files daily. - -- **File system.** All trusted devices will be configured to use the NTFS file system. - -- **BIOS settings.** All trusted portable devices will be configured to use a BIOS-level password that is under the management of the IT support team. - -- **Password requirements.** Trusted clients must use strong passwords. - -It's important to understand that the trusted state isn't constant; it's a transient state that is subject to changing security standards and compliance with those standards. New threats and new defenses emerge constantly. For this reason, the organization's management systems must continually check the trusted devices to ensure ongoing compliance. Additionally, the management systems must be able to issue updates or configuration changes if they're required to help maintain the trusted status. - -A device that continues to meet all these security requirements can be considered trusted. However it's possible that most devices that were identified in the discovery process discussed earlier don't meet these requirements. Therefore, you must identify which devices can be trusted and which ones can't. To help with this process, you use the intermediate *trustworthy* state. The remainder of this section discusses the different states and their implications. - -### Trustworthy state - -It's useful to identify as soon as possible those devices in your current infrastructure that can achieve a trusted state. A *trustworthy state* can be assigned to indicate that the current device can physically achieve the trusted state with required software and configuration changes. - -For each device that is assigned a trustworthy status, make an accompanying configuration note that states what is required to enable the device to achieve trusted status. This information is especially important to both the project design team (to estimate the costs of adding the device to the solution) and the support staff (to enable them to apply the required configuration). - -Generally, trustworthy devices fall into one of the following two groups: - -- **Configuration required.** The current hardware, operating system, and software enable the device to achieve a trustworthy state. However, more configuration changes are required. For example, if the organization requires a secure file system before a device can be considered trusted, a device that uses a FAT32-formatted hard disk doesn't meet this requirement. - -- **Upgrade required.** These devices require upgrades before they can be considered trusted. The following list provides some examples of the type of upgrade these devices might require: - - - **Operating system upgrade required.** If the device's current operating system can't support the security needs of the organization, an upgrade would be required before the device could achieve a trusted state. - - - **Software required.** A device that is missing a required security application, such as an antivirus scanner or a management client, can't be considered trusted until these applications are installed and active. - - - **Hardware upgrade required.** In some cases, a device might require a specific hardware upgrade before it can achieve trusted status. This type of device usually needs an operating system upgrade or another software that forces the required hardware upgrade. For example, security software might require more hard disk space on the device. - - - **Device replacement required.** This category is reserved for devices that can't support the security requirements of the solution because their hardware can't support the minimum acceptable configuration. For example, a device that can't run a secure operating system because it has an old processor (such as a 100 megahertz \[MHz\] x86-based device). - -Use these groups to assign costs for implementing the solution on the devices that require upgrades. - -### Known, untrusted state - -During the process of categorizing an organization's devices, you'll identify some devices that can't achieve trusted status for specific well-understood and well-defined reasons. These reasons might include the following types: - -- **Financial.** The funding isn't available to upgrade the hardware or software for this device. - -- **Political.** The device must remain in an untrusted state because of a political or business situation that doesn't enable it to comply with the stated minimum security requirements of the organization. It's highly recommended that you contact the business owner or independent software vendor (ISV) for the device to discuss the added value of server and domain isolation. - -- **Functional.** The device must run a nonsecure operating system or must operate in a nonsecure manner to perform its role. For example, the device might be required to run an older operating system because a specific line of business application will only work on that operating system. - -There can be multiple functional reasons for a device to remain in the known untrusted state. The following list includes several examples of functional reasons that can lead to a classification of this state: - -- **Devices that run unsupported versions of Windows.** These versions include Windows XP, Windows Millennium Edition, Windows 98, Windows 95, or Windows NT. Devices that run these versions of the Windows operating system can't be classified as trustworthy because these operating systems don't support the required security infrastructure. For example, although Windows NT does support a basic security infrastructure, it doesn't support “deny” ACLs on local resources, any way to ensure the confidentiality and integrity of network communications, smart cards for strong authentication, or centralized management of device configurations (although limited central management of user configurations is supported). - -- **Stand-alone devices.** Devices running any version of Windows which are configured as stand-alone devices or as members of a workgroup usually can't achieve a trustworthy state. Although these devices fully support the minimum required basic security infrastructure, the required security management capabilities are unlikely to be available when the device isn't a part of a trusted domain. - -- **Devices in an untrusted domain.** A device that is a member of a domain that isn't trusted by an organization's IT department can't be classified as trusted. An untrusted domain is a domain that can't provide the required security capabilities to its members. Although the operating systems of devices that are members of this untrusted domain might fully support the minimum required basic security infrastructure, the required security management capabilities can't be fully guaranteed when devices aren't in a trusted domain. - -### Unknown, untrusted state - -The unknown, untrusted state should be considered the default state for all devices. Because devices in this state have a configuration that is unknown, you can assign no trust to them. All planning for devices in this state must assume that the device is an unacceptable risk to the organization. Designers of the solution should strive to minimize the impact that the devices in this state can have on their organizations. - -## Capturing upgrade costs for current devices - - -The final step in this part of the process is to record the approximate cost of upgrading the devices to a point that they can participate in the server and domain isolation design. You must make several key decisions during the design phase of the project that require answers to the following questions: - -- Does the device meet the minimum hardware requirements necessary for isolation? - -- Does the device meet the minimum software requirements necessary for isolation? - -- What configuration changes must be made to integrate this device into the isolation solution? - -- What is the projected cost or impact of making the proposed changes to enable the device to achieve a trusted state? - -By answering these questions, you can quickly determine the level of effort and approximate cost of bringing a particular device or group of devices into the scope of the project. It's important to remember that the state of a device is transitive, and that by performing the listed remedial actions you can change the state of a device from untrusted to trusted. After you decide whether to place a device in a trusted state, you're ready to begin planning and designing the isolation groups, which the next section [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) discusses. - -The following table is an example of a data sheet that you could use to help capture the current state of a device and what would be required for the device to achieve a trusted state. - -| Device name | Hardware reqs met | Software reqs met | Configuration required | Details | Projected cost | -| - | - | - | - | - | - | -| CLIENT001 | No| No| Upgrade hardware and software.| Current operating system is Windows XP. Old hardware isn't compatible with newer versions of Windows.| $??| -| SERVER001 | Yes| No| Join trusted domain and upgrade from Windows Server 2003 to Windows Server 2012.| No antivirus software present.| $??| - -In the previous table, the device CLIENT001 is currently "known, untrusted" because its hardware must be upgraded. However, it could be considered trustworthy if the required upgrades are possible. However, if many devices require the same upgrades, the overall cost of the solution would be much higher. - -The device SERVER001 is "trustworthy" because it meets the hardware requirements but its operating system must be upgraded. It also requires antivirus software. The projected cost is the amount of effort that is required to upgrade the operating system and install antivirus software, along with their purchase costs. - -With the other information that you've gathered in this section, this information will be the foundation of the efforts performed later in the [Planning Domain Isolation Zones](planning-domain-isolation-zones.md) section. - -The costs identified in this section only capture the projected cost of the device upgrades. Many more design, support, test, and training costs should be accounted for in the overall project plan. - -**Next:** [Planning Your Windows Defender Firewall with Advanced Security Design](planning-your-windows-firewall-with-advanced-security-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md deleted file mode 100644 index 68f91e5710..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Enable Predefined Inbound Rules -description: Learn the rules for Windows Defender Firewall with Advanced Security for common networking roles and functions. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Enable Predefined Inbound Rules - - -Windows Defender Firewall with Advanced Security includes many predefined rules for common networking roles and functions. When you install a new server role on a device or enable a network feature on a client device, the installer typically enables the rules required for that role instead of creating new ones. When deploying firewall rules to the devices on the network, you can take advantage of these predefined rules instead of creating new ones. Using this advantage helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To deploy predefined firewall rules that allow inbound network traffic for common network functions - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Inbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Predefined**, select the rule category from the list, and then click **Next**. - -5. On the **Predefined Rules** page, the list of rules defined in the group is displayed. By default, they're all selected. For rules that you don't want to deploy, clear the check boxes next to the rules, and then click **Next**. - -6. On the **Action** page, select **Allow the connection**, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md deleted file mode 100644 index 69eaebf470..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Enable Predefined Outbound Rules -description: Learn to deploy predefined firewall rules that block outbound network traffic for common network functions in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Enable Predefined Outbound Rules - - -By default, Windows Defender Firewall with Advanced Security allows all outbound network traffic unless it matches a rule that prohibits the traffic. Windows Defender Firewall includes many predefined outbound rules that can be used to block network traffic for common networking roles and functions. When you install a new server role on a computer or enable a network feature on a client computer, the installer can install, but typically doesn't enable, outbound block rules for that role. When deploying firewall rules to the computers on the network, you can take advantage of these predefined rules instead of creating new ones. Using this advantage helps to ensure consistency and accuracy, because the rules have been thoroughly tested and are ready for use. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To deploy predefined firewall rules that block outbound network traffic for common network functions - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Outbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Predefined**, select the rule category from the list, and then click **Next**. - -5. On the **Predefined Rules** page, the list of rules defined in the group is displayed. They're all selected by default. For rules that you don't want to deploy, clear the check boxes next to the rules, and then click **Next**. - -6. On the **Action** page, select **Block the connection**, and then click **Finish**. - - The selected rules are added to the GPO. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md b/windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md deleted file mode 100644 index 572b3283f3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Exempt ICMP from Authentication -description: Learn how to add exemptions for any network traffic that uses the ICMP protocol in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Exempt ICMP from Authentication - - -This procedure shows you how to add exemptions for any network traffic that uses the ICMP protocol. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To exempt ICMP network traffic from authentication - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. On the main Windows Defender Firewall with Advanced Security page, click **Windows Defender Firewall Properties**. - -3. On the **IPsec settings** tab, change **Exempt ICMP from IPsec** to **Yes**, and then click **OK**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md deleted file mode 100644 index b030f3c63a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Gathering Information about Your Active Directory Deployment -description: Learn about gathering Active Directory information, including domain layout, organizational unit architecture, and site topology, for your firewall deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Information about Your Active Directory Deployment - - -Active Directory is another important item about which you must gather information. You must understand the forest structure. This structure includes domain layout, organizational unit (OU) architecture, and site topology. This information makes it possible to know where devices are currently placed, their configuration, and the impact of changes to Active Directory that result from implementing Windows Defender Firewall with Advanced Security. Review the following list for information needed: - -- **Names and number of forests**. The forest (not the domain) is the security boundary in an Active Directory implementation. You must understand the current Active Directory architecture to determine the most effective strategy for deploying your firewall and connection security rules using Group Policy. It also enables you to understand which devices can be isolated and how best to accomplish the required degree of isolation. - -- **Names and number of domains**. Authentication in server and domain isolation uses the IKE negotiation process with the Kerberos V5 protocol. This protocol assumes that devices are domain members. - -- **Number and types of trusts**. Trusts affect the logical boundaries of domain isolation and define whether IKE negotiation can occur between devices in different Active Directory domains. - -- **Names and number of sites**. Site architecture is aligned with the network topology. Understanding how sites are defined in Active Directory will help provide insight into replication and other details. Site architecture can provide a better understanding of the current Active Directory deployment. - -- **OU structure**. OUs are logical constructs and can therefore be molded to fit many different requirements and goals. The OU structure is an ideal place to examine how Group Policy is currently used and how the OUs are laid out. You don't have to redesign an already implemented OU structure in order to effectively deploy firewall and connection security policy, but an understanding of the structure helps you know what WMI or group filtering is required to apply each GPO to the correct devices. - -- **Existing IPsec policy**. Because this project culminates in the implementation of IPsec policy, you must understand how the network currently uses IPsec (if at all). Windows Defender Firewall connection security rules for versions of Windows prior to Windows Vista and Windows Server 2008 aren't compatible with earlier versions of Windows. If you already have IPsec policies deployed to devices running Windows XP and Windows Server 2003 in your organization, you must ensure that the new IPsec policies you deploy enable devices using either the old or new IPsec policies to communicate with each other. - -**Next:** [Gathering Information about Your Devices](gathering-information-about-your-devices.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md deleted file mode 100644 index 13cb71d95b..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md +++ /dev/null @@ -1,107 +0,0 @@ ---- -title: Gathering Info about Your Network Infrastructure -description: Learn how to gather info about your network infrastructure so that you can effectively plan for Windows Defender Firewall with Advanced Security deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Information about Your Current Network Infrastructure - - -Perhaps the most important aspect of planning for Windows Defender Firewall with Advanced Security deployment is the network architecture, because IPsec is layered on the Internet Protocol itself. An incomplete or inaccurate understanding of the network can prevent any Windows Defender Firewall solution from being successful. Understanding subnet layout, IP addressing schemes, and traffic patterns are part of this effort, but accurately documenting the following components are important to completing the planning phase of this project: - -- **Network segmentation**. This component includes IP addressing maps, showing how your routers separate each network segment. It includes information about how the routers are configured, and what security filters they impose on network traffic flowing through them. - -- Network address translation (NAT). NAT is a means of separating network segments by using a device that maps all of the IP addresses on one side of the device to a single IP address accessible on the other side. - -- Network infrastructure devices. These devices include the routers, switches, hubs, and other network equipment that makes communications between the devices on the network possible. - -- **Current network traffic model.** This component includes the quantity and the characteristics of the network traffic flowing through your network. - -- Intrusion Detection System (IDS) devices. You'll need to identify if you have any IDS devices on your network that might be negatively impacted by any encryption introduced in an Encryption Zone. - -The goal is to have enough information to be able to identify an asset by its network location, in addition to its physical location. - -Don't use a complex and poorly documented network as a starting point for the design, because it can leave too many unidentified areas that are likely to cause problems during implementation. - -This guidance helps obtain the most relevant information for planning Windows Defender Firewall implementation, but it doesn't try to address other issues, such as TCP/IP addressing or virtual local area network (VLAN) segmentation. - -## Network segmentation - - -If your organization doesn't have its current network architecture documented and available for reference, such documentation should be obtained as soon as possible before you continue with the design and deployment. If the documented information isn't current or hasn't been validated recently, you have two options: - -- Accept that the lack of accurate information can cause risk to the project. - -- Undertake a discovery project, either through manual processes or with network analysis tools that can provide the information you need to document the current network topology. - -Although the required information can be presented in many different ways, a series of schematic diagrams is often the most effective method of illustrating and understanding the current network configuration. When creating network diagrams, don't include too much information. If necessary, use multiple diagrams that show different layers of detail. Use a top-level diagram that illustrates the major sites that make up your organization's network, and then break out each site into a more detailed diagram that captures a deeper level of detail. Continue until you reach the individual IP subnet level, and so have the means to identify the network location of every device in your organization. - -During this process, you might discover some network applications and services that aren't compatible with IPsec. For example, IPsec breaks network-based prioritization and port/protocol-based traffic management. If traffic management or prioritization must be based on ports or protocol, the host itself must be able to perform any traffic management or prioritization. - -Other examples of incompatibility include: - -- Cisco NetFlow on routers can't analyze packets between IPsec members based on protocol or port. - -- Router-based Quality of Service (QoS) can't use ports or protocols to prioritize traffic. However, using firewall rules that specify IP addresses to prioritize traffic aren't affected by this limitation of QoS. For example, a rule that says "From anyone to anyone using port 80 prioritize" doesn't work, but a rule that says "From anyone to 10.0.1.10 prioritize" works. - -- Weighted Fair Queuing and other flow-based router traffic priority methods might fail. - -- Devices that don't support or allow IP protocol 50, the port that is used by Encapsulating Security Payload (ESP). - -- Router access control lists (ACLs) can't examine protocol and port fields in ESP-encrypted packets, and therefore the packets are dropped. ACLs based only on IP address are forwarded as usual. If the device can't parse ESP, any ACLs that specify port or protocol rules won't be processed on the ESP packets. If the device has an ESP parser and uses encryption, ACLs that specify port or protocol rules won't be processed on the ESP packets. - -- Network monitoring tools might be unable to parse ESP packets that aren't encrypted (ESP-Null). - - >**Note:**  Microsoft Message Analyzer can help in troubleshooting of unencrypted IPsec packets. The latest version of Message Analyzer is available on the [Microsoft Download Center](/message-analyzer/microsoft-message-analyzer-operating-guide). -   -## Network address translation (NAT) - -IPsec NAT traversal (NAT-T) enables IPsec peers that are behind NATs to detect the presence of NATs, negotiate IPsec security associations (SAs), and send ESP-protected data even though the addresses in the IPsec-protected IPv4 packets change. IPsec NAT-T doesn't support the use of AH across NAT devices. - -## Network infrastructure devices - -The devices that make up the network infrastructure (routers, switches, load balancers, and firewalls) must be able communicate using IPsec after the solution is implemented. For this reason, you have to examine the following characteristics of these network devices to ensure that they can handle the technical and physical requirements of the design: - -- **Make/model**. You can use this information to determine the features that the device supports. In addition, check the BIOS version or software running on the device to ensure that IPsec is supported. - -- **Amount of RAM**. This information is useful when you're analyzing capacity or the impact of IPsec on the device. - -- **Traffic analysis**. Information, such as peak usage and daily or weekly trends, is helpful to have. The information helps provide a baseline snapshot of the device and how it's used over time. If problems occur after IPsec is implemented, the information can help determine whether the root cause is related to greater usage of the device. - -- **Router ACLs that affect IPsec directly**. ACLs directly affect the ability of specific protocols to function. For example, blocking the Kerberos V5 protocol (UDP and TCP port 88) or IP protocol 50 or 51 prevents IPsec from working. Devices must also be configured to allow IKE traffic (UDP port 500) if using NAT-T (UDP port 4500). - -- **Networks/subnets connected to device interfaces**. This information provides the best picture of what the internal network looks like. Defining the boundary of subnets based on an address range is straightforward and helps identify whether other addresses are either unmanaged or foreign to the internal network (such as IP addresses on the Internet). - -- **VLAN segmentation**. Determining how VLANs are implemented on the network can help you understand traffic patterns and security requirements, and then help to determine how IPsec might augment or interfere with these requirements. - -- **The maximum transmission unit (MTU) size on device interface(s)**. The MTU defines the largest datagram that can be transmitted on a particular interface without being divided into smaller pieces for transmission (a process also known as *fragmentation*). In IPsec communications, the MTU is necessary to anticipate when fragmentation occurs. Packet fragmentation must be tracked for Internet Security Association and Key Management Protocol (ISAKMP) by the router. IPsec configures the MTU size on the session to the minimum-discovered MTU size along the communication path being used, and then set the Don't Fragment bit (DF bit) to 1. - - >**Note:**  If Path MTU (PMTU) discovery is enabled and functioning correctly, you do not have to gather the MTU size on device interfaces. Although sources, such as the Windows Server 2003 Hardening Guide, recommend disabling PMTU discovery, it must be enabled for IPsec to function correctly. - -- **Intrusion detection system (IDS) in use**. Your IDS must have an IPsec-compatible parser to detect ESP packets. If the IDS doesn't have such a parser, it can't determine if data in those packets is encrypted. - -After you obtain this information, you can quickly determine whether you must upgrade the devices to support the requirements of the project, change the ACLs, or take other measures to ensure that the devices can handle the loads needed. - -## Current network traffic model - -After you gather the addressing and network infrastructure information, the next step is to examine the communications flow. For example, if a department such as Human Resources (HR) spans several buildings, and you want to use server isolation with encryption to help protect information in that department, you must know how those buildings are connected to determine the level of "trust" to place in the connection. A highly secured building that is connected by an unprotected cable to another building that isn't secured can be compromised by an eavesdropping or information replay attack. If such an attack is considered a threat, IPsec can help by providing strong mutual authentication and traffic encryption for trusted hosts. IPsec allows you to more securely communicate across untrusted links such as the Internet. - -When you examine traffic flow, look closely at how all managed and unmanaged devices interact. These devices include non-Windows-based devices running Linux, UNIX, and Macintosh. Ask yourself such questions as: - -- Do specific communications occur at the port and protocol level, or are there many sessions between the same hosts across many protocols? - -- How do servers and clients communicate with each other? - -- Are there security devices or projects currently implemented or planned that could affect an isolation deployment? For example, if you use Windows Defender Firewall on your devices to "lock down" specific ports, such as UDP 500, IKE negotiations fail. - -Some of the more common applications and protocols are as follows: - -- **NetBIOS over TCP/IP (NetBT) and server message block (SMB)**. On a LAN, it's common to have ports 137, 138, and 139 enabled for NetBT and port 445 enabled for SMB. These ports provide NetBIOS name resolution services and other features. Unfortunately, they also allow the creation of *null sessions*. A null session is a session that is established on a host that doesn't use the security context of a known user or entity. Frequently, these sessions are anonymous. - -- **Remote procedure call (RPC)**. RPC operates by listening on a port known as the *endpoint mapper*, TCP port 135. The response to a query on this port is an instruction to begin communication on another port in the ephemeral range (ports numbered over 1024). In a network that is segmented by firewalls, RPC communication presents a configuration challenge because it means to open the RPC listener port, and all ports greater than 1024. Opening so many ports increases the attack surface of the whole network and reduces the effectiveness of the firewalls. Because many applications depend on RPC for basic functionality, any firewall and connection security policy must take RPC requirements into account. - -- **Other traffic**. Windows Defender Firewall can help secure transmissions between devices by providing authentication of the packets in addition to encrypting the data that they contain. The important thing to do is to identify what must be protected, and the threats that must be mitigated. Examine and model other traffic or traffic types that must be secured. - -**Next:** [Gathering Information about Your Active Directory Deployment](gathering-information-about-your-active-directory-deployment.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md deleted file mode 100644 index d650107dd8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: Gathering Information about Your Devices -description: Learn what information to gather about the devices in your enterprise to plan your Windows Defender Firewall with Advanced Security deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Information about Your Devices - - -One of the most valuable benefits of conducting an asset discovery project is the large amount of data that is obtained about the client and server devices on the network. When you start designing and planning your isolation zones, you must make decisions that require accurate information about the state of all hosts to ensure that they can use IPsec as planned. - -Capture the following information from each device: - -- **Computer name**. This name is the device's NetBIOS or DNS name that identifies the device on the network. Because a device can have more than one media access control (MAC) or IP address, the device's name is one of the criteria that can be used to determine uniqueness on the network. Because device names can be duplicated under some circumstances, the uniqueness shouldn't be considered absolute. - -- **IP address for each network adapter**. The IP address is the address that is used with the subnet mask to identify a host on the network. An IP address isn't an effective way to identify an asset because it's often subject to change. - -- **Operating system, service pack, and hotfix versions**. The operating system version is a key factor in determining the ability of a host to communicate by using IPsec. It's also important to track the current state of service packs and updates that might be installed, because these packs and updates are often used to determine that minimum security standards have been met. - -- **Domain membership**. This information is used to determine whether a device can obtain IPsec policy from Active Directory or whether it must use a local IPsec policy. - -- **Physical location**. This information is just the location of the device in your organization. It can be used to determine whether a device can participate in a specific isolation group based on its location or the location of the devices that it communicates with regularly. - -- **Hardware type or role**. Some tools that perform host discovery can provide this information by querying the hardware information and running applications to determine its type, such as server, workstation, or portable device. You can use this information to determine the appropriate IPsec policy to assign, whether a specific device can participate in isolation, and in which isolation group to include the device. - -After collecting all this information and consolidating it into a database, perform regular discovery efforts periodically to keep the information current. You need the most complete and up-to-date picture of the managed hosts on their networks to create a design that matches your organization's requirements. - -You can use various methods to gather data from the hosts on the network. These methods range from high-end, fully automated systems to manual data collection. Generally, the use of automated methods to gather data is preferred over manual methods for reasons of speed and accuracy. - -## Automated Discovery - -Using an automated auditing network management system provides valuable information about the current state of the IT infrastructure. - - -## Manual Discovery - - -The biggest difference between manual discovery methods and automated methods is time. - -You can use Windows PowerShell to create a script file that can collect the system configuration information. For more information, see [Windows PowerShell Scripting](https://go.microsoft.com/fwlink/?linkid=110413). - -Whether you use an automatic, manual, or hybrid option to gather the information, one of the biggest issues that can cause problems to the design is capturing the changes between the original inventory scan and the point at which the implementation is ready to start. After the first scan has been completed, make support staff aware that all other changes must be recorded and the updates noted in the inventory. - -This inventory will be critical for planning and implementing your Windows Defender Firewall design. - -**Next:** [Gathering Other Relevant Information](gathering-other-relevant-information.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md deleted file mode 100644 index f57dfc3116..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Gathering Other Relevant Information -description: Learn about additional information you may need to gather to deploy Windows Defender Firewall with Advanced Security policies in your organization. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering Other Relevant Information - - -This topic discusses several other things that you should examine to see whether they'll cause any complications in your ability to deploy Windows Defender Firewall with Advanced Security policies in your organization. - -## Capacity considerations - -Because IPsec uses mathematically intensive cryptographic techniques, it can consume significant overhead on a device. Areas to watch: - -- **Encryption.** You might use 256-bit Advanced Encryption Standard (AES-256) and 384-bit Secure Hash Algorithm (SHA-384) to check integrity in situations that require the strongest available encryption and key exchange protection. If you have NICs that support IPsec Task Offload, you can reduce the effect that encryption has on network throughput. For more information, see [IPsec Task Offload](/previous-versions/windows/it-pro/windows-server-2003/cc776369(v=ws.10)). - -- **Security association (SA) negotiation.** You can use a shorter lifetime for the main mode SA, such as three hours, but then you might need to make tradeoffs. Because each main mode SA occupies approximately 5  KB of RAM, situations in which a server brokers tens of thousands of concurrent connections can lead to overutilization. - -- **NAT devices.** As discussed earlier, NAT doesn't allow Authentication Header (AH) conversations between hosts. If NAT devices exist on the internal network, ESP must be selected instead of AH. - -- **Switches and routers.** Proper capacity planning for the implementation of IPsec is more about thorough testing and expected traffic loads than exact calculations. You might have to upgrade or reconfigure switches or routers that currently exceed 75 percent usage to allow for increased traffic on the device and still provide some extra usage for bursts of traffic. - -- **Other factors.** These include CPU usage on network infrastructure servers, increased overhead on servers and workstations running IPsec (especially servers, because they usually contain more main mode SAs than clients), and increased network latency because of IPsec negotiation. - - >**Note:**  When Microsoft deployed its own domain isolation solution, it found a one to three percent increase in usage on the network as a direct result of IPsec. - -## Group Policy deployment groups and WMI filters - -You don't have to rearrange the organization unit (OU) hierarchy of your Active Directory domains to effectively deploy Windows Defender Firewall GPOs. Instead, you can link your GPOs at the domain level (or another high level container), and then use security group filtering or WMI filtering to ensure that only the appropriate devices or users can apply the GPO settings. We recommend that you use WMI filtering to dynamically ensure that GPOs apply only to devices that are running the correct operating system. It's not necessary to use this technique if your network consists of devices. - -## Different Active Directory trust environments - -When you design a domain isolation policy, consider any logical boundaries that might affect IPsec-secured communications. For example, the trust relationships between your domains and forests are critical in determining an appropriate IKE authentication method. - -Kerberos V5 authentication is recommended for use in a two-way (mutual) domain and forest trust environment. You can use Kerberos V5 for IKE authentication across domains that have two-way trusts established, if the domains are in the same forest or different forests. If the two domains are in different forests, you must configure two external trusts, one for each direction, between the domains. The external trusts must use the fully qualified domain name (FQDN) of the domains, and IPsec policy must allow an IKE initiator in one domain to communicate with any domain controller in the forest domain hierarchy, so that the initiator can obtain a Kerberos V5 ticket from a domain controller in the responder’s domain. If firewalls separate the domains, then you must configure the firewall to allow Kerberos V5 traffic over UDP destination port 88, TCP destination port 88, and UDP destination port 389. - -If the use of Kerberos V5 authentication isn't possible because two-way trusts across forests can't be established as in some large enterprise environments, you can use a public key infrastructure (PKI) and digital certificates to establish IPsec-trusted communication. - -## Creating firewall rules to permit IKE, AH, and ESP traffic - - -In some cases, IPsec-secured traffic might have to pass through a router, perimeter firewall, or other filtering device. If there's a router, unless the router filters TCP and UDP traffic or other upper-level protocol headers, no special configuration is required to allow the IPsec traffic to be forwarded. - -If there's a filtering router or a firewall, you must configure these devices to allow IPsec traffic to be forwarded. Configure the firewall to allow IPsec traffic on UDP source and destination port 500 (IKE), UDP source and destination port 4500 (IPsec NAT-T), and IP Protocol 50 (ESP). You might also have to configure the firewall to allow IPsec traffic on IP protocol 51 (AH) to allow troubleshooting by IPsec administrators and to allow the IPsec traffic to be inspected. - -## Network load balancing and server clusters - -There are challenges implementing connection security for network traffic going to and from network load balancing (NLB) clusters and server clusters. NLB enables multiple servers to be clustered together to provide high availability for a service by providing automatic failover to other nodes in the cluster. Because IPsec matches a security association to a specific device, it prevents different devices from handling the same client connection. If a different node in the cluster responds to an IPsec connection that was originally established by another node, the traffic will be dropped by the client device as untrusted. - -This dropping of traffic means that NLB in "no affinity" mode isn't supported by IPsec at all. If you must use "no affinity" mode in the cluster, then consider including the servers that make up the cluster in your IPsec exemption group, and allowing clients to communicate with the servers without IPsec. - -When a TCP connection is dropped because of a cluster node failover, IPsec detects the TCP connection failure and removes the IPsec SAs for that connection. When the new TCP connection is established to another node, IPsec can negotiate new SAs immediately without having to wait for the obsolete SAs to time out. - -## Network inspection technologies - -Within a TCP/IP packet, IPsec without encryption changes the offsets for the destination ports and protocols. These changes can adversely affect applications that are running on network devices such as routers that monitor and manage traffic on the network. While some network applications have been updated to support IPsec, some aren't yet compatible. Check with the vendor of your device to see whether the changes in the protocol and port fields caused by IPsec are compatible with the device. - -Any device designed to view network traffic, such as hardware protocol analyzers or Microsoft Network Monitor, can't parse ESP-encrypted traffic. Only the destination device, with which the originating device negotiated the connection, can decrypt the traffic. - -In general, IPsec defeats network-based prioritization and port- or protocol-based traffic management. For encrypted packets, there's no workaround; the host itself must handle any traffic management functions. For unencrypted, authenticated-only packets, the devices and applications must be aware of how IPsec changes packets to be able to do anything with them other than route them to the correct host. If you can't upgrade monitoring or management devices to support IPsec, it's important that you record this information and figure it into your domain or server isolation design. - -Network Monitor includes parsers for the ISAKMP (IKE), AH, and ESP protocols. Network Monitor parsers for ESP can parse inside the ESP packet only if ESP null-encryption is being used. Network Monitor can't parse the encrypted parts of IPsec ESP traffic when encryption is performed in software. However, if encryption is performed by an IPsec hardware offload network adapter, the ESP packets can be decrypted when Network Monitor captures them on either the source or the destination and, therefore, they can be parsed. To diagnose ESP software-encrypted communication, you must disable ESP encryption and use ESP-null encryption by changing the IPsec policy or connection security rule on both devices. - -Message Analyzer is available on the [Microsoft Download Center](/message-analyzer/microsoft-message-analyzer-operating-guide). - -**Next:** [Determining the Trusted State of Your Devices](determining-the-trusted-state-of-your-devices.md) \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md b/windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md deleted file mode 100644 index b82d977445..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md +++ /dev/null @@ -1,22 +0,0 @@ ---- -title: Gathering the Information You Need -description: Collect and analyze information about your network, directory services, and devices to prepare for Windows Defender Firewall with Advanced Security deployment. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Gathering the Information You Need - - -Before starting the planning process for a Windows Defender Firewall with Advanced Security deployment, you must collect and analyze up-to-date information about the network, the directory services, and the devices that are already deployed in the organization. This information enables you to create a design that accounts for all possible elements of the existing infrastructure. If the gathered information isn't accurate, problems can occur when devices and devices that weren't considered during the planning phase are encountered during implementation. - -Review each of the following articles for guidance about the kinds of information that you must gather: - -- [Gathering Information about Your Conversational Network Infrastructure](gathering-information-about-your-current-network-infrastructure.md) - -- [Gathering Information about Your Active Directory Deployment](gathering-information-about-your-active-directory-deployment.md) - -- [Gathering Information about Your Devices](gathering-information-about-your-devices.md) - -- [Gathering Other Relevant Information](gathering-other-relevant-information.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md b/windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md deleted file mode 100644 index ca38900f59..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Link the GPO to the Domain -description: Learn how to link a GPO to the Active Directory container for the target devices, after you configure it in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Link the GPO to the Domain - - -After you create the GPO and configure it with security group filters and WMI filters, you must link the GPO to the container in Active Directory that contains all of the target devices. - -If the filters comprehensively control the application of the GPO to only the correct devices, then you can link the GPO to the domain container. Alternatively, you can link the GPO to a site container or organizational unit if you want to limit application of the GPO to that subset of devices. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Domain Admins group, or otherwise be delegated permissions to modify the GPOs. - -To link the GPO to the domain container in Active Directory - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, and then expand *YourDomainName*. - -3. Right-click *YourDomainName*, and then click **Link an Existing GPO**. - -4. In the **Select GPO** dialog box, select the GPO that you want to deploy, and then click **OK**. - -5. The GPO appears in the **Linked Group Policy Objects** tab in the details pane and as a linked item under the domain container in the navigation pane. - -6. You can adjust the order of the linked GPOs to ensure that the higher priority GPOs are processed last. Select a GPO and click the up or down arrows to move it. The GPOs are processed by the client device from the highest link order number to the lowest. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md b/windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md deleted file mode 100644 index 90d89139a8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Modify GPO Filters -description: Learn how to modify GPO filters to apply to a different zone or version of windows in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Modify GPO Filters to Apply to a Different Zone or Version of Windows - - -You must reconfigure your copied GPO so that it contains the correct security group and WMI filters for its new role. If you are creating the GPO for the isolated domain, use the [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) procedure to prevent members of the boundary and encryption zones from incorrectly applying the GPOs for the main isolated domain. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -In this topic: - -- [Change the security group filter for a GPO](#to-change-the-security-group-filter-for-a-gpo) - -- [Block members of a group from applying a GPO](#to-block-members-of-a-group-from-applying-a-gpo) - -- [Remove a block for members of a group from applying a GPO](#to-remove-a-block-for-members-of-group-from-applying-a-gpo) - -## To change the security group filter for a GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, under **Security Filtering**, click the currently assigned security group, and then click **Remove**. - -4. Now you can add the appropriate security group to this GPO. Under **Security Filtering**, click **Add**. - -5. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to apply the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain. - -## To block members of a group from applying a GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, click the **Delegation** tab. - -4. Click **Advanced**. - -5. Under the **Group or user names** list, click **Add**. - -6. In the **Select User, Computer, or Group** dialog box, type the name of the group whose members are to be prevented from applying the GPO, and then click **OK**. If you do not know the name, you can click **Advanced** to browse the list of groups available in the domain. - -7. Select the group in the **Group or user names** list, and then select the boxes in the **Deny** column for both **Read** and **Apply group policy**. - -8. Click **OK**, and then in the **Windows Security** dialog box, click **Yes**. - -9. The group appears in the list with custom permissions. - -## To remove a block for members of group from applying a GPO - -1. Open the Group Policy Management console. - -2. In the navigation pane, find and then click the GPO that you want to modify. - -3. In the details pane, click the **Delegation** tab. - -4. In the **Groups and users** list, select the group that should no longer be blocked, and then click **Remove**. - -5. In the message box, click **OK**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md deleted file mode 100644 index a9137e37d3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -title: Open the Group Policy Management Console to IP Security Policies -description: Learn how to open the Group Policy Management Console to IP Security Policies to configure GPOs for earlier versions of the Windows operating system. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Open the Group Policy Management Console to IP Security Policies - - -Procedures in this guide that refer to GPOs for earlier versions of the Windows operating system instruct you to work with the IP Security Policy section in the Group Policy Management Console (GPMC). - -**To open a GPO to the IP Security Policies section** - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane of the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, and then click **IP Security Policies on Active Directory (**YourDomainName**)**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md deleted file mode 100644 index 49aee564d3..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md +++ /dev/null @@ -1,24 +0,0 @@ ---- -title: Group Policy Management of Windows Firewall with Advanced Security -description: Group Policy Management of Windows Firewall with Advanced Security -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Group Policy Management of Windows Firewall with Advanced Security - - -Most of the procedures in this guide instruct you to use Group Policy settings for Windows Firewall with Advanced Security. - -To open a GPO to Windows Firewall with Advanced Security - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane of the Group Policy Management Editor, navigate to **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - LDAP://cn={**GUID**},cn=…**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md deleted file mode 100644 index 9ba7d78ace..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md +++ /dev/null @@ -1,18 +0,0 @@ ---- -title: Group Policy Management of Windows Defender Firewall -description: Group Policy Management of Windows Defender Firewall with Advanced Security -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Group Policy Management of Windows Defender Firewall - - -To open a GPO to Windows Defender Firewall: - -1. Open the Group Policy Management console. - -2. In the navigation pane, expand **Forest:** *YourForestName*, expand **Domains**, expand *YourDomainName*, expand **Group Policy Objects**, right-click the GPO you want to modify, and then click **Edit**. - -3. In the navigation pane of the Group Policy Object Editor, navigate to **Computer Configuration** > **Administrative Templates** > **Network** > **Network Connections** > **Windows Defender Firewall**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md deleted file mode 100644 index 8440460338..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Open Windows Defender Firewall with Advanced Security -description: Learn how to open the Windows Defender Firewall with Advanced Security console. You must be a member of the Administrators group. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Open Windows Defender Firewall with Advanced Security - - -This procedure shows you how to open the Windows Defender Firewall with Advanced Security console. - -**Administrative credentials** - -To complete this procedure, you must be a member of the Administrators group. For more information, see Additional considerations. - -## To open Windows Defender Firewall using the UI - -Click Start, type **Windows Defender Firewall**, and then press ENTER. - -## To open Windows Defender Firewall from a command prompt - -1. Open a command prompt window. - -2. At the command prompt, type: - - ``` syntax - wf.msc - ``` - -**Additional considerations** - -Although standard users can start the Windows Defender Firewall MMC snap-in, to change most settings the user must be a member of a group with the permissions to modify those settings, such as Administrators. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md b/windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md deleted file mode 100644 index 70a23e653f..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Restrict Server Access to Members of a Group Only -description: Create a firewall rule to access isolated servers running Windows Server 2008 or later and restrict server access to members of a group. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Restrict Server Access to Members of a Group Only - - -After you have configured the IPsec connection security rules that force client devices to authenticate their connections to the isolated server, you must configure the rules that restrict access to only those devices or users who have been identified through the authentication process as members of the isolated server’s access group. - -In this topic: - -- [Create a firewall rule to access isolated servers running Windows Server 2008 or later](#to-create-a-firewall-rule-that-grants-access-to-an-isolated-server) - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To create a firewall rule that grants access to an isolated server - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). You must edit the GPO that applies settings to servers in the isolated server zone. - -2. In the navigation pane, right-click **Inbound Rules**, and then click **New Rule**. - -3. On the **Rule Type** page, click **Custom**, and then click **Next**. - -4. If you must restrict access to a single network program, then you can select **This program path**, and specify the program or service to which to grant access. Otherwise, click **All programs**, and then click **Next**. - -5. If you must restrict access to only some TCP or UDP port numbers, then enter the port numbers on the **Protocol and Ports** page. Otherwise, set **Protocol type** to **Any**, and then click **Next**. - -6. On the **Scope** page, select **Any IP address** for both local and remote addresses, and then click **Next**. - -7. On the **Action** page, click **Allow the connection if it is secure**. If required by your design, you can also click **Customize** and select **Require the connections to be encrypted**. Click **Next**. - -8. On the **Users and Computers** page, select the check box for the type of accounts (computer or user) you want to allow, click **Add**, and then enter the group account that contains the device and user accounts permitted to access the server. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md b/windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md deleted file mode 100644 index 91091b431c..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md +++ /dev/null @@ -1,43 +0,0 @@ ---- -title: Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior -description: Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Turn on Windows Defender Firewall with Advanced Security and Configure Default Behavior - - -To enable Windows Defender Firewall with Advanced Security and configure its default behavior, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To enable Windows Defender Firewall and configure the default behavior - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. - -3. For each network location type (Domain, Private, Public), perform the following steps. - - >**Note:**  The steps shown here indicate the recommended values for a typical deployment. Use the settings that are appropriate for your firewall design. - - 1. Click the tab that corresponds to the network location type. - - 2. Change **Firewall state** to **On (recommended)**. - - 3. Change **Inbound connections** to **Block (default)**. - - 4. Change **Outbound connections** to **Allow (default)**. - -  - -  - - - - - diff --git a/windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md b/windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md deleted file mode 100644 index 686e2d1efc..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Verify That Network Traffic Is Authenticated -description: Learn how to confirm that network traffic is being protected by IPsec authentication after you configure your domain isolation rule to require authentication. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/08/2021 ---- - -# Verify That Network Traffic Is Authenticated - - -After you've configured your domain isolation rule to request, rather than require, authentication, you must confirm that the network traffic sent by the devices on the network is being protected by IPsec authentication as expected. If you switch your rules to require authentication before all of the devices have received and applied the correct GPOs, or if there are any errors in your rules, then communications on the network can fail. By first setting the rules to request authentication, any network connections that fail authentication can continue in clear text while you diagnose and troubleshoot. - -In these procedures, you confirm that the rules you deployed are working correctly. Your next steps depend on which zone you're working on: - -- **Main domain isolation zone.** Before you convert your main domain isolation IPsec rule from request mode to require mode, you must make sure that the network traffic is protected according to your design. By configuring your rules to request and not require authentication at the beginning of operations, devices on the network can continue to communicate even when the main mode authentication or quick mode integrity and encryption rules aren't working correctly. For example, if your encryption zone contains rules that require a certain encryption algorithm, but that algorithm isn't included in a security method combination on the clients, then those clients can't successfully negotiate a quick mode security association, and the server refuses to accept network traffic from the client. By first using request mode only, you have the opportunity to deploy your rules and then examine the network traffic to see if they're working as expected without risking a loss of communications. - -- **Boundary zone.** Confirming correct operation of IPsec is the last step if you're working on the boundary zone GPO. You don't convert the GPO to require mode at any time. - -- **Encryption zone.** Similar to the main isolation zone, after you confirm that the network traffic to zone members is properly authenticated and encrypted, you must convert your zone rules from request mode to require mode. - -> [!NOTE] -> In addition to the steps shown in this procedure, you can also use network traffic capture tools such as [Microsoft Network Monitor](https://www.microsoft.com/download/4865). Network Monitor and similar tools allow you to capture, parse, and display the network packets received by the network adapter on your device. Current versions of these tools include full support for IPsec. They can identify encrypted network packets, but they cannot decrypt them. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -## To verify that network connections are authenticated by using the Windows Defender Firewall with Advanced Security console - -1. Open the Windows Defender Firewall with Advanced Security -console. - -2. In the navigation pane, expand **Monitoring**, and then click **Connection Security Rules**. - - The details pane displays the rules currently in effect on the device. - -3. **To display the Rule Source column** - - 1. In the **Actions** pane, click **View**, and then click **Add/Remove Columns**. - - 2. In the **Available columns** list, select **Rule Source**, and then click **Add**. - - 3. Use the **Move up** and **Move down** buttons to rearrange the order. Click **OK** when you're finished. - - It can take a few moments for the list to be refreshed with the newly added column. - -4. Examine the list for the rules from GPOs that you expect to be applied to this device. - - >**Note:**  If the rules do not appear in the list, then troubleshoot the GPO security group and the WMI filters that are applied to the GPO. Make sure that the local device is a member of the appropriate groups and meets the requirements of the WMI filters. -5. In the navigation pane, expand **Security Associations**, and then click **Main Mode**. - - The current list of main mode associations that have been negotiated with other devices appears in the details column. - -6. Examine the list of main mode security associations for sessions between the local device and the remote device. Make sure that the **1st Authentication Method** and **2nd Authentication Method** columns contain expected values. If your rules specify only a first authentication method, then the **2nd Authentication Method** column displays **No authentication**. If you double-click the row, then the **Properties** dialog box appears with more details about the security association. - -7. In the navigation pane, click **Quick mode**. - -8. Examine the list of quick mode security associations for sessions between the local device and the remote device. Make sure that the **AH Integrity**, **ESP integrity**, and **ESP Confidentiality** columns contain expected values. From e13bdf3e4a587c204d02f3989af03a33e18ad973 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 08:39:18 -0500 Subject: [PATCH 098/237] redirect --- ...blishing.redirection.windows-security.json | 165 ++++++++++++++++++ 1 file changed, 165 insertions(+) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 3a9d25e18f..5cda27e549 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7789,6 +7789,171 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/assign-security-group-filters-to-the-gpo.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717260(v=ws.11)", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/change-rules-from-request-to-require-mode.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717237(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md", + "redirect_url": "previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717279(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-data-protection-quick-mode-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717293(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717253(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-key-exchange-main-mode-settings.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717249(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-rules-to-require-encryption.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717270(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-workstation-authentication-certificate-template.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717275(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717278(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717245(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717246(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-account-in-active-directory.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717247(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717274(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-exemption-list-rule.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717243(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-authentication-request-rule.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717283(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-inbound-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717281(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/enable-predefined-outbound-rules.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717259(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/exempt-icmp-from-authentication.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717292(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/link-the-gpo-to-the-domain.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717264(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717265(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717290(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717269(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717266(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/open-windows-firewall-with-advanced-security.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717254(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717267(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717251(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/verify-that-network-traffic-is-authenticated.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717273(v=ws.11)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md", + "redirect_url": "previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731454(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc770899(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-active-directory-deployment.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771366(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-information-about-your-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc726039(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-other-relevant-information.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc771791(v=ws.10)", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753540(v=ws.10)", + "redirect_document_id": false } ] } From 9feb387af3bae7aecb9f0de59509e51d8673dd92 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 08:47:48 -0500 Subject: [PATCH 099/237] toc updates --- .../operating-system-security/network-security/toc.yml | 4 ++-- .../network-security/windows-firewall/{TOC.yml => toc.yml} | 0 2 files changed, 2 insertions(+), 2 deletions(-) rename windows/security/operating-system-security/network-security/windows-firewall/{TOC.yml => toc.yml} (100%) diff --git a/windows/security/operating-system-security/network-security/toc.yml b/windows/security/operating-system-security/network-security/toc.yml index 9745213bd4..713ead1e6c 100644 --- a/windows/security/operating-system-security/network-security/toc.yml +++ b/windows/security/operating-system-security/network-security/toc.yml @@ -7,8 +7,8 @@ items: href: https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09 - name: Extensible Authentication Protocol (EAP) for network access href: /windows-server/networking/technologies/extensible-authentication-protocol/network-access - - name: Windows Firewall 🔗 - href: windows-firewall/windows-firewall-with-advanced-security.md + - name: Windows Firewall + href: windows-firewall/toc.yml - name: Virtual Private Network (VPN) href: vpn/toc.yml - name: Always On VPN 🔗 diff --git a/windows/security/operating-system-security/network-security/windows-firewall/TOC.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml similarity index 100% rename from windows/security/operating-system-security/network-security/windows-firewall/TOC.yml rename to windows/security/operating-system-security/network-security/windows-firewall/toc.yml From 8997f49f7efbcd4d58a57bf77fac8e88f5c768f8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 09:01:16 -0500 Subject: [PATCH 100/237] update TOC --- .../network-security/windows-firewall/toc.yml | 44 ++++++++++--------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index e0fa759b89..417a72d9a2 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -1,32 +1,34 @@ items: - name: Overview href: windows-firewall-with-advanced-security.md - - name: Configure Hyper-V firewall - href: hyper-v-firewall.md + - name: Configure Windows firewall + href: best-practices-configuring.md - name: Configure the Windows Firewall log href: configure-the-windows-firewall-log.md - - name: Create an inbound ICMP rule - href: create-an-inbound-icmp-rule.md - - name: Create an inbound port rule - href: create-an-inbound-port-rule.md - - name: Create an inbound program or service rule - href: create-an-inbound-program-or-service-rule.md - - name: Create an outbound port rule - href: create-an-outbound-port-rule.md - - name: Create an outbound program or service rule - href: create-an-outbound-program-or-service-rule.md - - name: Create inbound rules to support RPC - href: create-inbound-rules-to-support-rpc.md - - name: Create Windows Firewall rules in Intune - href: create-windows-firewall-rules-in-intune.md - - name: Configure the firewall - href: best-practices-configuring.md - - name: Secure IPsec + - name: Secure connections with IPsec href: securing-end-to-end-ipsec-connections-by-using-ikev2.md - - name: PowerShell + - name: Configure Windows Firewall with PowerShell href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - - name: Isolate Microsoft Store Apps on Your Network + - name: Isolate Microsoft Store apps on your network href: isolating-apps-on-your-network.md + - name: Configure Hyper-V firewall + href: hyper-v-firewall.md + - name: Firewall rules + items: + - name: Create firewall rules with Microsoft Intune + href: create-windows-firewall-rules-in-intune.md + - name: Create an inbound ICMP rule + href: create-an-inbound-icmp-rule.md + - name: Create an inbound port rule + href: create-an-inbound-port-rule.md + - name: Create an inbound program or service rule + href: create-an-inbound-program-or-service-rule.md + - name: Create an outbound port rule + href: create-an-outbound-port-rule.md + - name: Create an outbound program or service rule + href: create-an-outbound-program-or-service-rule.md + - name: Create inbound rules to support RPC + href: create-inbound-rules-to-support-rpc.md - name: Troubleshoot items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall From 129eb062cdc8e3280dc638e4d310ec3fa8733b8c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 09:14:03 -0500 Subject: [PATCH 101/237] index --- ...windows-firewall-with-advanced-security.md => index.md} | 7 +++---- .../network-security/windows-firewall/toc.yml | 2 +- 2 files changed, 4 insertions(+), 5 deletions(-) rename windows/security/operating-system-security/network-security/windows-firewall/{windows-firewall-with-advanced-security.md => index.md} (73%) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md similarity index 73% rename from windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md rename to windows/security/operating-system-security/network-security/windows-firewall/index.md index af1b573655..ae454e148e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -10,14 +10,13 @@ ms.topic: conceptual ms.date: 09/08/2021 --- -# Windows Defender Firewall with Advanced Security +# Windows Firewall with Advanced Security - -This topic is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. +This topic is an overview of the Windows Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. ## Overview of Windows Defender Firewall with Advanced Security -Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a trusted device can't communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. +Windows Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a trusted device can't communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 417a72d9a2..da4d798dcb 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -1,6 +1,6 @@ items: - name: Overview - href: windows-firewall-with-advanced-security.md + href: index.md - name: Configure Windows firewall href: best-practices-configuring.md - name: Configure the Windows Firewall log From 2f07f758cb0cc347f7ee73eba65839be8d31cd3f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 11 Nov 2023 11:23:15 -0500 Subject: [PATCH 102/237] updates --- .../network-security/windows-firewall/toc.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 417a72d9a2..28a9741aa4 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -1,8 +1,10 @@ items: - name: Overview href: windows-firewall-with-advanced-security.md - - name: Configure Windows firewall + - name: Configure Windows Firewall href: best-practices-configuring.md + - name: Configure Hyper-V firewall + href: hyper-v-firewall.md - name: Configure the Windows Firewall log href: configure-the-windows-firewall-log.md - name: Secure connections with IPsec @@ -11,8 +13,6 @@ items: href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - name: Isolate Microsoft Store apps on your network href: isolating-apps-on-your-network.md - - name: Configure Hyper-V firewall - href: hyper-v-firewall.md - name: Firewall rules items: - name: Create firewall rules with Microsoft Intune From 34facc6fca60d1f5b06ee7fca462cfdd99599ed1 Mon Sep 17 00:00:00 2001 From: Office Content Publishing 5 <87502544+officedocspr5@users.noreply.github.com> Date: Sat, 11 Nov 2023 23:32:30 -0800 Subject: [PATCH 103/237] Uploaded file: education-content-updates.md - 2023-11-11 23:32:30.2537 --- .../includes/education-content-updates.md | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/education/includes/education-content-updates.md b/education/includes/education-content-updates.md index bae8eba426..dc91fc136e 100644 --- a/education/includes/education-content-updates.md +++ b/education/includes/education-content-updates.md @@ -2,20 +2,13 @@ -## Week of September 11, 2023 +## Week of November 06, 2023 | Published On |Topic title | Change | |------|------------|--------| -| 9/11/2023 | [Configure education themes for Windows 11](/education/windows/edu-themes) | modified | -| 9/11/2023 | [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in) | modified | - - -## Week of September 04, 2023 - - -| Published On |Topic title | Change | -|------|------------|--------| -| 9/5/2023 | [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in) | modified | -| 9/5/2023 | [Windows for Education documentation](/education/windows/index) | modified | -| 9/5/2023 | [Windows 11 SE Overview](/education/windows/windows-11-se-overview) | modified | +| 11/7/2023 | [Reset devices with Autopilot Reset](/education/windows/autopilot-reset) | modified | +| 11/9/2023 | [Configure Stickers for Windows 11 SE](/education/windows/edu-stickers) | modified | +| 11/9/2023 | What's new in the Windows Set up School PCs app | removed | +| 11/9/2023 | [Management functionalities for Surface devices](/education/windows/tutorial-school-deployment/manage-surface-devices) | modified | +| 11/9/2023 | [Use Set up School PCs app](/education/windows/use-set-up-school-pcs-app) | modified | From f151ac735d140b5ce04bc25f840544ad34db3434 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 07:16:08 -0500 Subject: [PATCH 104/237] fixed redirect --- .openpublishing.redirection.windows-security.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 5cda27e549..2d8efa4060 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7797,7 +7797,7 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-authentication-methods.md", - "redirect_url": "previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717279(v=ws.11)", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717279(v=ws.11)", "redirect_document_id": false }, { From c37a8414677ecb2035b23de697605a0719515af3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 10:08:27 -0500 Subject: [PATCH 105/237] updates --- windows/security/docfx.json | 3 +- .../best-practices-configuring.md | 1 - .../configure-the-windows-firewall-log.md | 28 +- .../create-an-inbound-icmp-rule.md | 1 - .../create-an-inbound-port-rule.md | 21 +- ...eate-an-inbound-program-or-service-rule.md | 1 - .../create-an-outbound-port-rule.md | 47 +- ...ate-an-outbound-program-or-service-rule.md | 50 +- .../create-inbound-rules-to-support-rpc.md | 1 - ...irewall-with-advanced-security-strategy.md | 41 -- .../windows-firewall/hyper-v-firewall.md | 2 - .../windows-firewall/index.md | 5 - .../isolating-apps-on-your-network.md | 1 - .../windows-firewall/quarantine.md | 23 +- ...to-end-ipsec-connections-by-using-ikev2.md | 3 +- ...-administration-with-windows-powershell.md | 431 ++++-------------- 16 files changed, 140 insertions(+), 519 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 7421416038..b981234d62 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -228,8 +228,7 @@ "information-protection/tpm/*.md": "tier1", "threat-protection/auditing/*.md": "tier3", "operating-system-security/data-protection/bitlocker/*.md": "tier1", - "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1", - "operating-system-security/network-security/windows-firewall/*.md": [ "tier2", "must-keep" ] + "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1" } }, "template": [], diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 41280919f0..e9d123de43 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -1,7 +1,6 @@ --- title: Best practices for configuring Windows Firewall description: Learn about best practices for configuring Windows Firewall -ms.prod: windows-client ms.date: 11/10/2023 ms.topic: best-practice --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index e60bc7b3ec..7d0c361563 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -1,46 +1,32 @@ --- title: Configure the Windows Defender Firewall Log description: Learn how to configure Windows Defender Firewall with Advanced Security to log dropped packets or successful connections by using Group Policy Management MMC. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/07/2021 --- # Configure the Windows Defender Firewall with Advanced Security Log - To configure Windows Defender Firewall with Advanced Security to log dropped packets or successful connections, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in. -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - ## To configure the Windows Defender Firewall with Advanced Security log 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - 2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. - 3. For each network location type (Domain, Private, Public), perform the following steps. - 1. Click the tab that corresponds to the network location type. - - 2. Under **Logging**, click **Customize**. - - 3. The default path for the log is **%windir%\\system32\\logfiles\\firewall\\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location. + 1. Click the tab that corresponds to the network location type + 2. Under **Logging**, click **Customize** + 3. The default path for the log is **%windir%\system32\logfiles\firewall\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location > [!IMPORTANT] > The location you specify must have permissions assigned that permit the Windows Defender Firewall service to write to the log file. 5. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. - 6. No logging occurs until you set one of following two options: - - - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes**. - - - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes**. - - 7. Click **OK** twice. + - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** + - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** + 7. Click **OK** twice ### Troubleshoot if the log file is not created or modified @@ -91,4 +77,4 @@ Restart the device to restart the Windows Defender Firewall Service. ### Troubleshoot Slow Log Ingestion -If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. +If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md index b62a240cdb..034f6558c6 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md @@ -1,7 +1,6 @@ --- title: Create an Inbound ICMP Rule description: Learn how to allow inbound ICMP traffic by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md index 5751151190..5dc828a180 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md @@ -1,32 +1,15 @@ --- title: Create an Inbound Port Rule description: Learn to allow traffic on specific ports by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep ms.topic: conceptual ms.date: 09/07/2021 --- # Create an Inbound Port Rule +To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. -To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Defender Firewall -with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -This topic describes how to create a standard port rule for a specified protocol or TCP or UDP port number. For other inbound port rule types, see: - -- [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) - -- [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) - -**To create an inbound port rule** +To create an inbound port rule 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md index 0e3d5bd0c6..f1756dac1d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md @@ -1,7 +1,6 @@ --- title: Create an Inbound Program or Service Rule description: Learn how to allow inbound traffic to a program or service by using the Group Policy Management MMC snap-in to create firewall rules. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md index a014376a16..cd82bee946 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md @@ -1,46 +1,33 @@ --- title: Create an Outbound Port Rule description: Learn to block outbound traffic on a port by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/07/2021 --- -# Create an Outbound Port Rule +# Create an Outbound Port Rule with group policy +By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the *Windows Defender Firewall with Advanced Security* node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. -By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. +> [!NOTE] +> To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. To create an outbound port rule -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. In the navigation pane, select **Outbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** -2. In the navigation pane, click **Outbound Rules**. + > [!NOTE] + > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -3. Click **Action**, and then click **New rule**. +1. On the **Program** page, select **All programs**, and then select **Next** +1. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number -4. On the **Rule Type** page of the New Outbound Rule wizard, click **Custom**, and then click **Next**. + If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next**, - >**Note:**  Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - -5. On the **Program** page, click **All programs**, and then click **Next**. - -6. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number. - - If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. - - To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. - - When you've configured the protocols and ports, click **Next**. - -7. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -8. On the **Action** page, select **Block the connection**, and then click **Next**. - -9. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. - -10. On the **Name** page, type a name and description for your rule, and then click **Finish**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Block the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md index 7893448184..3f6c111b22 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md @@ -1,50 +1,34 @@ --- title: Create an Outbound Program or Service Rule description: Use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. -ms.prod: windows-client ms.topic: conceptual -ms.date: 09/07/2021 +ms.date: 11/13/2023 --- # Create an Outbound Program or Service Rule - By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port. -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - To create an outbound firewall rule for a program or service 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. In the navigation pane, select **Outbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** -2. In the navigation pane, click **Outbound Rules**. + > [!NOTE] + > Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -3. Click **Action**, and then click **New rule**. +1. On the **Program** page, select **This program path** +1. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly +1. Do one of the following: -4. On the **Rule Type** page of the New Outbound Rule Wizard, click **Custom**, and then click **Next**. + - If the executable file contains a single program, select **Next** + - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** - >**Note:**  Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - -5. On the **Program** page, click **This program path**. - -6. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly. - -7. Do one of the following: - - - If the executable file contains a single program, click **Next**. - - - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**. - - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then click **Apply to service with this service short name**, and type the short name for the service in the text box. Click **OK**, and then click **Next**. - -8. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](create-an-outbound-port-rule.md). When you have configured the protocol and port options, click **Next**. - -9. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -10. On the **Action** page, select **Block the connection**, and then click **Next**. - -11. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. - -12. On the **Name** page, type a name and description for your rule, and then click **Finish**. +1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](create-an-outbound-port-rule.md). When you have configured the protocol and port options, select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Block the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md b/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md index e153527fbc..70034fc36b 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md @@ -1,7 +1,6 @@ --- title: Create Inbound Rules to Support RPC description: Learn how to allow RPC network traffic by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/07/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md b/windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md deleted file mode 100644 index 197d05a733..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md +++ /dev/null @@ -1,41 +0,0 @@ ---- -title: Designing a Windows Defender Firewall Strategy -description: Answer the question in this article to design an effective Windows Defender Firewall with Advanced Security Strategy. -ms.prod: windows-client -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Designing a Windows Defender Firewall with Advanced Security Strategy - - -To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment. You must have a good understanding of what tasks the devices on the network perform, and how they use the network to accomplish those tasks. You must understand the network traffic generated by the programs running on the devices. - -- [Gathering the Information You Need](gathering-the-information-you-need.md) - -- [Determining the Trusted State of Your Devices](determining-the-trusted-state-of-your-devices.md) - -The information that you gather will help you answer the following questions. The answers will help you understand your security requirements and select the design that best matches those requirements. The information will also help you when it comes time to deploy your design, by helping you to build a deployment strategy that is cost effective and resource efficient. It will help you project and justify the expected costs associated with implementing the design. - -- What traffic must always be allowed? What are characteristics of the network traffic generated and consumed by the business programs? - -- What traffic must always be blocked? Does your organization have policies that prohibit the use of specific programs? If so, what are the characteristics of the network traffic generated and consumed by the prohibited programs? - -- What traffic on the network can't be protected by IPsec because the devices or devices sending or receiving the traffic don't support IPsec? - -- For each type of network traffic, does the default configuration of the firewall (block all unsolicited inbound network traffic, allow all outbound traffic) allow or block the traffic as required? - -- Do you have an Active Directory domain (or forest of trusted domains) to which all your devices are joined? If you don't, then you can't use Group Policy for easy mass deployment of your firewall and connection security rules. You also can't easily take advantage of Kerberos V5 authentication that all domain clients can use. - -- Which devices must be able to accept unsolicited inbound connections from devices that aren't part of the domain? - -- Which devices contain data that must be encrypted when exchanged with another computer? - -- Which devices contain sensitive data to which access must be restricted to authorized users and devices? - -- Does your organization have specific network troubleshooting devices or devices (such as protocol analyzers) that must be granted unlimited access to the devices on the network, essentially bypassing the firewall? - - -This guide describes how to plan your groups and GPOs for an environment with a mix of operating systems. Details can be found in the section [Planning Group Policy Deployment for Your Isolation Zones](planning-group-policy-deployment-for-your-isolation-zones.md) later in this guide. - -**Next:** [Gathering the Information You Need](gathering-the-information-you-need.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index 534ffb359d..d94d736b75 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -3,8 +3,6 @@ title: Hyper-V firewall description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP). ms.topic: how-to ms.date: 11/08/2023 -author: paolomatarazzo -ms.author: paoloma appliesto: - ✅ Windows 11 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index ae454e148e..2c00e08478 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -1,11 +1,6 @@ --- title: Windows Defender Firewall with Advanced Security description: Learn overview information about the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. -ms.prod: windows-client -ms.collection: - - highpri - - tier3 - - must-keep ms.topic: conceptual ms.date: 09/08/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md index 225ddf3542..f54a928691 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md @@ -1,7 +1,6 @@ --- title: Isolating Microsoft Store Apps on Your Network description: Learn how to customize your firewall configuration to isolate the network access of the new Microsoft Store apps that run on devices added to your network. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/08/2021 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md index 093f4274fb..7db925d52d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md @@ -1,7 +1,6 @@ --- title: Quarantine behavior description: Quarantine behavior is explained in detail. -ms.prod: windows-client ms.topic: conceptual ms.date: 09/08/2021 --- @@ -28,13 +27,13 @@ The quarantine feature creates filters that can be split into three categories: These filters are added in the FWPM_SUBLAYER_MPSSVC_QUARANTINE sublayer and these layers are: -1. FWPM_LAYER_ALE_AUTH_CONNECT_V4 +1. FWPM_LAYER_ALE_AUTH_CONNECT_V4 -2. FWPM_LAYER_ALE_AUTH_CONNECT_V6 +2. FWPM_LAYER_ALE_AUTH_CONNECT_V6 -3. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 +3. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 -4. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 +4. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 >[!NOTE] > Any firewall rules added by the customers will not affect the filters in the quarantine sublayer as filters from Firewall rules are added in the FWPM_SUBLAYER_MPSSVC_WF sublayer. In other words, customers cannot add their own exception filters to prevent packets from being evaluated by quarantine filters. @@ -57,17 +56,17 @@ The interface un-quarantine filters allow all non-loopback packets if the interf The following events describe the general flow of quarantine: -1. There's some change on the current network interface. +1. There's some change on the current network interface. -2. The interface un-quarantine filters will no longer permit new inbound connections. The interface is now in quarantine state. +2. The interface un-quarantine filters will no longer permit new inbound connections. The interface is now in quarantine state. -3. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter. +3. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter. -4. The WFP filters applicable to the old interface state are removed. +4. The WFP filters applicable to the old interface state are removed. 5. The WFP filters applicable to the new interface state are added, which include the un-quarantine filters for this interface. These filters are updated to match the interface's current state. -6. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets. +6. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets. ## Quarantine diagnostics @@ -88,7 +87,7 @@ Inside the wfpdiag.xml, search for `netEvents` that have `FWPM_NET_EVENT_TYPE_CL The characters in the application ID name will be separated by periods: ```XML - \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... ``` The `netEvent` will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. @@ -186,7 +185,7 @@ Sample drop audit with `filterOrigin` as `Quarantine Default`. ![Quarantine default.](images/quarantine-default1.png) -Once the drop’s filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: +Once the drop's filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: ```Powershell Get-NetIPInterface –InterfaceIndex diff --git a/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 43e2f9523d..1f6507af36 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -1,7 +1,6 @@ --- title: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012 description: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012 -ms.prod: windows-client ms.topic: conceptual ms.date: 09/08/2021 --- @@ -158,7 +157,7 @@ Follow these procedures to verify and troubleshoot your IKEv2 IPsec connections: 5. Open the cab file, and then extract the wfpdiag.xml file. -6. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last “errorFrequencyTable” at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: +6. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last "errorFrequencyTable" at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: ```xml diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 6bf60cec66..10546a8315 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -1,34 +1,20 @@ --- title: Windows Defender Firewall with Advanced Security Administration with Windows PowerShell -description: Windows Defender Firewall with Advanced Security Administration with Windows PowerShell -ms.prod: windows-client +description: Windows Defender Firewall with Advanced Security Administration with ms.topic: conceptual ms.date: 09/08/2021 --- - -# Windows Defender Firewall with Advanced Security Administration with Windows PowerShell - - +# Windows Defender Firewall with Advanced Security Administration with The Windows Defender Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Defender Firewall management. It's designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Defender Firewall management in Windows. - You can use Windows PowerShell to manage your firewall and IPsec deployments. This object-oriented scripting environment will make it easier for you to manage policies and monitor network conditions than was possible in netsh. Windows PowerShell allows network settings to be self-discoverable through the syntax and parameters in each of the cmdlets. This guide demonstrates how common tasks were performed in netsh and how you can use Windows PowerShell to accomplish them. - In future versions of Windows, Microsoft might remove the netsh functionality for Windows Defender Firewall. Microsoft recommends that you transition to Windows PowerShell if you currently use netsh to configure and manage Windows Defender Firewall. - Windows PowerShell and netsh command references are at the following locations. - -- [Netsh Commands for Windows Defender Firewall](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771920(v=ws.10)) - +- [Netsh Commands for Windows Defender Firewall](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771920(v=ws.10)) ## Scope - This guide doesn't teach you the fundamentals of Windows Defender Firewall, which can be found in [Windows Defender Firewall](windows-firewall-with-advanced-security.md). It doesn't teach the fundamentals of Windows PowerShell, and it assumes that you're familiar with the Windows PowerShell language and the basic concepts of Windows PowerShell. For more info about Windows PowerShell concepts and usage, see the reference topics in the [Additional resources](#other-resources) section of this guide. - ## Audience and user requirements - This guide is intended for IT pros, system administrators, and IT managers, and it assumes that you're familiar with Windows Defender Firewall, the Windows PowerShell language, and the basic concepts of Windows PowerShell. - ## In this topic - | Section | Description | | - | - | | [Set profile global defaults](#bkmk-profileglobaldefaults) | Enable and control firewall behavior| @@ -37,650 +23,401 @@ This guide is intended for IT pros, system administrators, and IT managers, and | [Deploy basic IPsec rule settings](#deploy-basic-ipsec-rule-settings) | IPsec rules and associated parameters| | [Deploy secure firewall rules with IPsec](#deploy-secure-firewall-rules-with-ipsec) | Domain and server isolation| | [Other resources](#other-resources) | More information about Windows PowerShell| - -## Set profile global defaults - +## Set profile global defaults Global defaults set the device behavior in a per-profile basis. Windows Defender Firewall supports Domain, Private, and Public profiles. - ### Enable Windows Defender Firewall with Advanced Security - Windows Defender Firewall drops traffic that doesn't correspond to allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't being enforced, you may need to enable Windows Defender Firewall. Here's how to enable Windows Defender Firewall on a local domain device: - **Netsh** - -``` syntax -netsh advfirewall set allprofiles state on +``` cmd +netsh.exe advfirewall set allprofiles state on ``` - **Windows PowerShell** - ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` - ### Control Windows Defender Firewall with Advanced Security behavior - The global default settings can be defined through the command-line interface. These modifications are also available through the Windows Defender Firewall with Advanced Security console. - The following scriptlets set the default inbound and outbound actions, specifies protected network connections, and allows notifications to be displayed to the user when a program is blocked from receiving inbound connections. It allows unicast response to multicast or broadcast network traffic, and it specifies logging settings for troubleshooting. - **Netsh** - -``` syntax +```cmd netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound netsh advfirewall set allprofiles settings inboundusernotification enable netsh advfirewall set allprofiles settings unicastresponsetomulticast enable netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log ``` -Windows PowerShell - ```powershell -Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow –NotifyOnListen True -AllowUnicastResponseToMulticast True –LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log +Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow -NotifyOnListen True -AllowUnicastResponseToMulticast True -LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log ``` - ### Disable Windows Defender Firewall with Advanced Security - Microsoft recommends that you don't disable Windows Defender Firewall because you lose other benefits provided by the service, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, [Windows Service Hardening](https://go.microsoft.com/fwlink/?linkid=104976), and [boot time filters](https://blogs.technet.microsoft.com/networking/2009/03/24/stopping-the-windows-authenticating-firewall-service-and-the-boot-time-policy/). - Disabling Windows Defender Firewall with Advanced Security can also cause problems, including: - - Start menu can stop working - Modern applications can fail to install or update - Activation of Windows via phone fails - Application or OS incompatibilities that depend on Windows Defender Firewall - Microsoft recommends disabling Windows Defender Firewall only when installing a third-party firewall, and resetting Windows Defender Firewall back to defaults when the third-party software is disabled or removed. - If disabling Windows Defender Firewall is required, don't disable it by stopping the Windows Defender Firewall service (in the **Services** snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). Stopping the Windows Defender Firewall service isn't supported by Microsoft. - Non-Microsoft firewall software can programmatically disable only the parts of Windows Defender Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose. - The proper method to disable the Windows Defender Firewall is to disable the Windows Defender Firewall Profiles and leave the service running. - Use the following procedure to turn off the firewall, or disable the Group Policy setting **Computer Configuration|Administrative Templates|Network|Network Connections|Windows Defender Firewall|Domain Prolfile|Windows Defender Firewall:Protect all network connections**. For more information, see [Windows Defender Firewall with Advanced Security deployment guide](windows-firewall-with-advanced-security-deployment-guide.md). - The following example disables Windows Defender Firewall for all profiles. - ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False ``` - ## Deploy basic firewall rules - This section provides scriptlet examples for creating, modifying, and deleting firewall rules. - ### Create firewall rules - Adding a firewall rule in Windows PowerShell looks a lot like it did in Netsh, but the parameters and values are specified differently. - Here's an example of how to allow the Telnet application to listen on the network. This firewall rule is scoped to the local subnet by using a keyword instead of an IP address. Just like in Netsh, the rule is created on the local device, and it becomes effective immediately. - **Netsh** - -``` syntax +```cmd netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= %SystemRoot%\System32\tlntsvr.exe remoteip=localsubnet action=allow ``` -Windows PowerShell - ```powershell -New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow +New-NetFirewallRule -DisplayName "Allow Inbound Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow ``` - The following scriptlet shows how to add a basic firewall rule that blocks outbound traffic from a specific application and local port to a Group Policy Object (GPO) in Active Directory. In Windows PowerShell, the policy store is specified as a parameter within the **New-NetFirewall** cmdlet. In Netsh, you must first specify the GPO that the commands in a Netsh session should modify. The commands you enter are run against the contents of the GPO, and the execution remains in effect until the Netsh session is ended or until another set store command is executed. - Here, **domain.contoso.com** is the name of your Active Directory Domain Services (AD DS), and **gpo\_name** is the name of the GPO that you want to modify. Quotation marks are required if there are any spaces in the GPO name. - **Netsh** - -``` syntax +```cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program=%SystemRoot%\System32\telnet.exe protocol=tcp localport=23 action=block ``` -Windows PowerShell - ```powershell -New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe –Protocol TCP –LocalPort 23 -Action Block –PolicyStore domain.contoso.com\gpo_name +New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -LocalPort 23 -Action Block -PolicyStore domain.contoso.com\gpo_name ``` - ### GPO Caching - To reduce the burden on busy domain controllers, Windows PowerShell allows you to load a GPO to your local session, make all your changes in that session, and then save it back at all once. - The following command performs the same actions as the previous example (by adding a Telnet rule to a GPO), but we do so by applying GPO caching in PowerShell. Changing the GPO by loading it onto your local session and using the *-GPOSession* parameter aren't supported in Netsh -Windows PowerShell - ```powershell -$gpo = Open-NetGPO –PolicyStore domain.contoso.com\gpo_name -New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\telnet.exe –Protocol TCP –LocalPort 23 -Action Block –GPOSession $gpo -Save-NetGPO –GPOSession $gpo +$gpo = Open-NetGPO -PolicyStore domain.contoso.com\gpo_name +New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\telnet.exe -Protocol TCP -LocalPort 23 -Action Block -GPOSession $gpo +Save-NetGPO -GPOSession $gpo ``` - This command doesn't batch your individual changes, it loads and saves the entire GPO at once. So if any other changes are made by other administrators, or in a different Windows PowerShell window, saving the GPO overwrites those changes. - ### Modify an existing firewall rule - When a rule is created, Netsh and Windows PowerShell allow you to change rule properties and influence, but the rule maintains its unique identifier (in Windows PowerShell, this identifier is specified with the *-Name* parameter). - For example, you could have a rule **Allow Web 80** that enables TCP port 80 for inbound unsolicited traffic. You can change the rule to match a different remote IP address of a Web server whose traffic will be allowed by specifying the human-readable, localized name of the rule. - **Netsh** - -``` syntax +```cmd netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 ``` -Windows PowerShell - ```powershell -Set-NetFirewallRule –DisplayName “Allow Web 80” -RemoteAddress 192.168.0.2 +Set-NetFirewallRule -DisplayName "Allow Web 80" -RemoteAddress 192.168.0.2 ``` - Netsh requires you to provide the name of the rule for it to be changed and we don't have an alternate way of getting the firewall rule. In Windows PowerShell, you can query for the rule using its known properties. - When you run `Get-NetFirewallRule`, you may notice that common conditions like addresses and ports don't appear. These conditions are represented in separate objects called Filters. As shown before, you can set all the conditions in New-NetFirewallRule and Set-NetFirewallRule. If you want to query for firewall rules based on these fields (ports, addresses, security, interfaces, services), you'll need to get the filter objects themselves. - You can change the remote endpoint of the **Allow Web 80** rule (as done previously) using filter objects. Using Windows PowerShell, you query by port using the port filter, then assuming other rules exist affecting the local port, you build with further queries until your desired rule is retrieved. - -In the following example, we assume the query returns a single firewall rule, which is then piped to the `Set-NetFirewallRule` cmdlet utilizing Windows PowerShell’s ability to pipeline inputs. - -Windows PowerShell +In the following example, we assume the query returns a single firewall rule, which is then piped to the `Set-NetFirewallRule` cmdlet utilizing Windows PowerShell's ability to pipeline inputs. ```powershell -Get-NetFirewallPortFilter | ?{$_.LocalPort -eq 80} | Get-NetFirewallRule | ?{ $_.Direction –eq “Inbound” -and $_.Action –eq “Allow”} | Set-NetFirewallRule -RemoteAddress 192.168.0.2 +Get-NetFirewallPortFilter | ?{$_.LocalPort -eq 80} | Get-NetFirewallRule | ?{ $_.Direction -eq "Inbound" -and $_.Action -eq "Allow"} | Set-NetFirewallRule -RemoteAddress 192.168.0.2 ``` - You can also query for rules using the wildcard character. The following example returns an array of firewall rules associated with a particular program. The elements of the array can be modified in subsequent `Set-NetFirewallRule` cmdlets. -Windows PowerShell - ```powershell Get-NetFirewallApplicationFilter -Program "*svchost*" | Get-NetFirewallRule ``` - Multiple rules in a group can be simultaneously modified when the associated group name is specified in a Set command. You can add firewall rules to specified management groups in order to manage multiple rules that share the same influences. - In the following example, we add both inbound and outbound Telnet firewall rules to the group **Telnet Management**. In Windows PowerShell, group membership is specified when the rules are first created so we re-create the previous example rules. Adding rules to a custom rule group isn't possible in Netsh. -Windows PowerShell - ```powershell -New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management” -New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management” +New-NetFirewallRule -DisplayName "Allow Inbound Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow -Group "Telnet Management" +New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow -Group "Telnet Management" ``` - If the group isn't specified at rule creation time, the rule can be added to the rule group using dot notation in Windows PowerShell. You can't specify the group using `Set-NetFirewallRule` since the command allows querying by rule group. -Windows PowerShell - ```powershell -$rule = Get-NetFirewallRule -DisplayName “Allow Inbound Telnet” -$rule.Group = “Telnet Management” +$rule = Get-NetFirewallRule -DisplayName "Allow Inbound Telnet" +$rule.Group = "Telnet Management" $rule | Set-NetFirewallRule ``` - With the help of the `Set` command, if the rule group name is specified, the group membership isn't modified but rather all rules of the group receive the same modifications indicated by the given parameters. - The following scriptlet enables all rules in a predefined group containing remote management influencing firewall rules. - **Netsh** - -``` syntax +```cmd netsh advfirewall firewall set rule group="Windows Defender Firewall remote management" new enable=yes ``` -Windows PowerShell - ```powershell -Set-NetFirewallRule -DisplayGroup “Windows Defender Firewall Remote Management” –Enabled True +Set-NetFirewallRule -DisplayGroup "Windows Defender Firewall Remote Management" -Enabled True ``` - There's also a separate `Enable-NetFirewallRule` cmdlet for enabling rules by group or by other properties of the rule. -Windows PowerShell - ```powershell -Enable-NetFirewallRule -DisplayGroup “Windows Defender Firewall Remote Management” -Verbose +Enable-NetFirewallRule -DisplayGroup "Windows Defender Firewall Remote Management" -Verbose ``` - ### Delete a firewall rule - Rule objects can be disabled so that they're no longer active. In Windows PowerShell, the **Disable-NetFirewallRule** cmdlet will leave the rule on the system, but put it in a disabled state so the rule no longer is applied and impacts traffic. A disabled firewall rule can be re-enabled by **Enable-NetFirewallRule**. This cmdlet is different from the **Remove-NetFirewallRule**, which permanently removes the rule definition from the device. - The following cmdlet deletes the specified existing firewall rule from the local policy store. - **Netsh** - -``` syntax -netsh advfirewall firewall delete rule name=“Allow Web 80” +```cmd +netsh advfirewall firewall delete rule name="Allow Web 80" ``` -Windows PowerShell - ```powershell -Remove-NetFirewallRule –DisplayName “Allow Web 80” +Remove-NetFirewallRule -DisplayName "Allow Web 80" ``` - Like with other cmdlets, you can also query for rules to be removed. Here, all blocking firewall rules are deleted from the device. -Windows PowerShell - ```powershell -Remove-NetFirewallRule –Action Block +Remove-NetFirewallRule -Action Block ``` - It may be safer to query the rules with the **Get** command and save it in a variable, observe the rules to be affected, then pipe them to the **Remove** command, just as we did for the **Set** commands. The following example shows how you can view all the blocking firewall rules, and then delete the first four rules. -Windows PowerShell - ```powershell -$x = Get-NetFirewallRule –Action Block +$x = Get-NetFirewallRule -Action Block $x $x[0-3] | Remove-NetFirewallRule ``` - ## Manage remotely - Remote management using WinRM is enabled by default. The cmdlets that support the *CimSession* parameter use WinRM and can be managed remotely by default. - The following example returns all firewall rules of the persistent store on a device named **RemoteDevice**. -Windows PowerShell +```powershell +Get-NetFirewallRule -CimSession RemoteDevice +``` +We can perform any modifications or view rules on remote devices by using the *-CimSession* parameter. Here we remove a specific firewall rule from a remote device. ```powershell -Get-NetFirewallRule –CimSession RemoteDevice +$RemoteSession = New-CimSession -ComputerName RemoteDevice +Remove-NetFirewallRule -DisplayName "AllowWeb80" -CimSession $RemoteSession -Confirm ``` - -We can perform any modifications or view rules on remote devices by using the *–CimSession* parameter. Here we remove a specific firewall rule from a remote device. - -Windows PowerShell - -```powershell -$RemoteSession = New-CimSession –ComputerName RemoteDevice -Remove-NetFirewallRule –DisplayName “AllowWeb80” –CimSession $RemoteSession -Confirm -``` - ## Deploy basic IPsec rule settings - An Internet Protocol security (IPsec) policy consists of rules that determine IPsec behavior. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. - Windows PowerShell can create powerful, complex IPsec policies like in Netsh and the Windows Defender Firewall with Advanced Security console. However, because Windows PowerShell is object-based rather than string token-based, configuration in Windows PowerShell offers greater control and flexibility. - In Netsh, the authentication and cryptographic sets were specified as a list of comma-separated tokens in a specific format. In Windows PowerShell, rather than using default settings, you first create your desired authentication or cryptographic proposal objects and bundle them into lists in your preferred order. Then, you create one or more IPsec rules that reference these sets. The benefit of this model is that programmatic access to the information in the rules is much easier. See the following sections for clarifying examples. - ![object model for creating a single ipsec rule.](images/createipsecrule.gif) - ### Create IPsec rules - The following cmdlet creates basic IPsec transport mode rule in a Group Policy Object. An IPsec rule is simple to create; all that is required is the display name, and the remaining properties use default values. Inbound traffic is authenticated and integrity checked using the default quick mode and main mode settings. These default settings can be found in the console under Customize IPsec Defaults. - **Netsh** - -``` syntax +```cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout ``` -Windows PowerShell - ```powershell -New-NetIPsecRule -DisplayName “Require Inbound Authentication” -PolicyStore domain.contoso.com\gpo_name +New-NetIPsecRule -DisplayName "Require Inbound Authentication" -PolicyStore domain.contoso.com\gpo_name ``` - ### Add custom authentication methods to an IPsec rule - If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](/previous-versions/windows/it-pro/windows-server-2003/cc757847(v=ws.10)) . - You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object. - ![crypto set object.](images/qmcryptoset.gif) - In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. - **Netsh** - -``` syntax +```cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall consec add rule name="Require Outbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout qmsecmethods=ah:sha1+esp:sha1-3des ``` -Windows PowerShell - ```powershell -$AHandESPQM = New-NetIPsecQuickModeCryptoProposal -Encapsulation AH,ESP –AHHash SHA1 -ESPHash SHA1 -Encryption DES3 -$QMCryptoSet = New-NetIPsecQuickModeCryptoSet –DisplayName “ah:sha1+esp:sha1-des3” -Proposal $AHandESPQM –PolicyStore domain.contoso.com\gpo_name -New-NetIPsecRule -DisplayName “Require Inbound Authentication” -InboundSecurity Require -OutboundSecurity Request -QuickModeCryptoSet $QMCryptoSet.Name –PolicyStore domain.contoso.com\gpo_name +$AHandESPQM = New-NetIPsecQuickModeCryptoProposal -Encapsulation AH,ESP -AHHash SHA1 -ESPHash SHA1 -Encryption DES3 +$QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "ah:sha1+esp:sha1-des3" -Proposal $AHandESPQM -PolicyStore domain.contoso.com\gpo_name +New-NetIPsecRule -DisplayName "Require Inbound Authentication" -InboundSecurity Require -OutboundSecurity Request -QuickModeCryptoSet $QMCryptoSet.Name -PolicyStore domain.contoso.com\gpo_name ``` - ### IKEv2 IPsec transport rules - A corporate network may need to secure communications with another agency. But, you discover the agency runs non-Windows operating systems and requires the use of the Internet Key Exchange Version 2 (IKEv2) standard. - You can apply IKEv2 capabilities in Windows Server 2012 by specifying IKEv2 as the key module in an IPsec rule. This capability specification can only be done using computer certificate authentication and can't be used with phase-2 authentication. -Windows PowerShell - ```powershell -New-NetIPsecRule -DisplayName “Require Inbound Authentication” -InboundSecurity Require -OutboundSecurity Request –Phase1AuthSet MyCertAuthSet -KeyModule IKEv2 –RemoteAddress $nonWindowsGateway +New-NetIPsecRule -DisplayName "Require Inbound Authentication" -InboundSecurity Require -OutboundSecurity Request -Phase1AuthSet MyCertAuthSet -KeyModule IKEv2 -RemoteAddress $nonWindowsGateway ``` - For more info about IKEv2, including scenarios, see [Securing End-to-End IPsec Connections by Using IKEv2](securing-end-to-end-ipsec-connections-by-using-ikev2.md). - ### Copy an IPsec rule from one policy to another - Firewall and IPsec rules with the same rule properties can be duplicated to simplify the task of re-creating them within different policy stores. - To copy the previously created rule from one policy store to another, the associated objects must also be copied separately. There's no need to copy associated firewall filters. You can query rules to be copied in the same way as other cmdlets. - Copying individual rules is a task that isn't possible through the Netsh interface. Here's how you can accomplish it with Windows PowerShell. -Windows PowerShell - ```powershell -$Rule = Get-NetIPsecRule –DisplayName “Require Inbound Authentication” -$Rule | Copy-NetIPsecRule –NewPolicyStore domain.costoso.com\new_gpo_name -$Rule | Copy-NetPhase1AuthSet –NewPolicyStore domain.costoso.com\new_gpo_name +$Rule = Get-NetIPsecRule -DisplayName "Require Inbound Authentication" +$Rule | Copy-NetIPsecRule -NewPolicyStore domain.costoso.com\new_gpo_name +$Rule | Copy-NetPhase1AuthSet -NewPolicyStore domain.costoso.com\new_gpo_name ``` - ### Handling Windows PowerShell errors - -To handle errors in your Windows PowerShell scripts, you can use the *–ErrorAction* parameter. This parameter is especially useful with the **Remove** cmdlets. If you want to remove a particular rule, you'll notice that it fails if the rule isn't found. When rules are being removed, if the rule isn’t already there, it's acceptable to ignore that error. In this case, you can do the following to suppress any “rule not found” errors during the remove operation. - -Windows PowerShell +To handle errors in your Windows PowerShell scripts, you can use the *-ErrorAction* parameter. This parameter is especially useful with the **Remove** cmdlets. If you want to remove a particular rule, you'll notice that it fails if the rule isn't found. When rules are being removed, if the rule isn't already there, it's acceptable to ignore that error. In this case, you can do the following to suppress any "rule not found" errors during the remove operation. ```powershell -Remove-NetFirewallRule –DisplayName “Contoso Messenger 98” –ErrorAction SilentlyContinue +Remove-NetFirewallRule -DisplayName "Contoso Messenger 98" -ErrorAction SilentlyContinue ``` - -The use of wildcards can also suppress errors, but they could potentially match rules that you didn't intend to remove. These wildcards can be a useful shortcut, but should only be used if you know there aren’t any extra rules that will be accidentally deleted. So the following cmdlet will also remove the rule, suppressing any “not found” errors. - -Windows PowerShell +The use of wildcards can also suppress errors, but they could potentially match rules that you didn't intend to remove. These wildcards can be a useful shortcut, but should only be used if you know there aren't any extra rules that will be accidentally deleted. So the following cmdlet will also remove the rule, suppressing any "not found" errors. ```powershell -Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” +Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" ``` - -When using wildcards, if you want to double-check the set of rules that is matched, you can use the *–WhatIf* parameter. - -Windows PowerShell +When using wildcards, if you want to double-check the set of rules that is matched, you can use the *-WhatIf* parameter. ```powershell -Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” –WhatIf +Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -WhatIf ``` - -If you only want to delete some of the matched rules, you can use the *–Confirm* parameter to get a rule-by-rule confirmation prompt. - -Windows PowerShell +If you only want to delete some of the matched rules, you can use the *-Confirm* parameter to get a rule-by-rule confirmation prompt. ```powershell -Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” –Confirm +Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -Confirm ``` - You can also just perform the whole operation, displaying the name of each rule as the operation is performed. -Windows PowerShell - ```powershell -Remove-NetFirewallRule –DisplayName “Contoso Messenger 98*” –Verbose +Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -Verbose ``` - ### Monitor - The following Windows PowerShell commands are useful in the update cycle of a deployment phase. - To allow you to view all the IPsec rules in a particular store, you can use the following commands. In Netsh, this command doesn't show rules where profile=domain,public or profile=domain,private. It only shows rules that have the single entry domain that is included in the rule. The following command examples will show the IPsec rules in all profiles. - **Netsh** - -``` syntax +```cmd netsh advfirewall consec show rule name=all ``` -Windows PowerShell - ```powershell -Show-NetIPsecRule –PolicyStore ActiveStore +Show-NetIPsecRule -PolicyStore ActiveStore ``` - You can monitor main mode security associations for information such as which peers are currently connected to the device and which protection suite is used to form the security associations. - Use the following cmdlet to view existing main mode rules and their security associations: - **Netsh** - -``` syntax +```cmd netsh advfirewall monitor show mmsa all ``` -Windows PowerShell - ```powershell Get-NetIPsecMainModeSA ``` - ### Find the source GPO of a rule - To view the properties of a particular rule or group of rules, you query for the rule. When a query returns fields that are specified as **NotConfigured**, you can determine which policy store a rule originates from. - -For objects that come from a GPO (the *–PolicyStoreSourceType* parameter is specified as **GroupPolicy** in the **Show** command), if *–TracePolicyStore* is passed, the name of the GPO is found and returned in the **PolicyStoreSource** field. - -Windows PowerShell +For objects that come from a GPO (the *-PolicyStoreSourceType* parameter is specified as **GroupPolicy** in the **Show** command), if *-TracePolicyStore* is passed, the name of the GPO is found and returned in the **PolicyStoreSource** field. ```powershell -Get-NetIPsecRule –DisplayName “Require Inbound Authentication” –TracePolicyStore +Get-NetIPsecRule -DisplayName "Require Inbound Authentication" -TracePolicyStore ``` - It's important to note that the revealed sources don't contain a domain name. - ### Deploy a basic domain isolation policy - IPsec can be used to isolate domain members from non-domain members. Domain isolation uses IPsec authentication to require that the domain-joined devices positively establish the identities of the communicating devices to improve security of an organization. One or more features of IPsec can be used to secure traffic with an IPsec rule object. - To implement domain isolation on your network, the devices in the domain receive IPsec rules that block unsolicited inbound network traffic that isn't protected by IPsec. Here we create an IPsec rule that requires authentication by domain members. Through this authentication, you can isolate domain-joined devices from devices that aren't joined to a domain. In the following examples, Kerberos authentication is required for inbound traffic and requested for outbound traffic. - **Netsh** - -``` syntax +```cmd netsh advfirewall set store gpo=domain.contoso.com\domain_isolation -netsh advfirewall consec add rule name=“Basic Domain Isolation Policy” profile=domain endpoint1=”any” endpoint2=”any” action=requireinrequestout auth1=”computerkerb” +netsh advfirewall consec add rule name="Basic Domain Isolation Policy" profile=domain endpoint1="any" endpoint2="any" action=requireinrequestout auth1="computerkerb" ``` -Windows PowerShell - ```powershell -$kerbprop = New-NetIPsecAuthProposal –Machine –Kerberos -$Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" -Proposal $kerbprop –PolicyStore domain.contoso.com\domain_isolation -New-NetIPsecRule –DisplayName “Basic Domain Isolation Policy” –Profile Domain –Phase1AuthSet $Phase1AuthSet.Name –InboundSecurity Require –OutboundSecurity Request –PolicyStore domain.contoso.com\domain_isolation +$kerbprop = New-NetIPsecAuthProposal -Machine -Kerberos +$Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" -Proposal $kerbprop -PolicyStore domain.contoso.com\domain_isolation +New-NetIPsecRule -DisplayName "Basic Domain Isolation Policy" -Profile Domain -Phase1AuthSet $Phase1AuthSet.Name -InboundSecurity Require -OutboundSecurity Request -PolicyStore domain.contoso.com\domain_isolation ``` - ### Configure IPsec tunnel mode - The following command creates an IPsec tunnel that routes traffic from a private network (192.168.0.0/16) through an interface on the local device (1.1.1.1) attached to a public network to a second device through its public interface (2.2.2.2) to another private network (192.157.0.0/16). All traffic through the tunnel is checked for integrity by using ESP/SHA1, and it's encrypted by using ESP/DES3. - **Netsh** - -``` syntax +```cmd netsh advfirewall consec add rule name="Tunnel from 192.168.0.0/16 to 192.157.0.0/16" mode=tunnel endpoint1=192.168.0.0/16 endpoint2=192.157.0.0/16 localtunnelendpoint=1.1.1.1 remotetunnelendpoint=2.2.2.2 action=requireinrequireout qmsecmethods=esp:sha1-3des ``` -Windows PowerShell - ```powershell $QMProposal = New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -ESPHash SHA1 -Encryption DES3 -$QMCryptoSet = New-NetIPsecQuickModeCryptoSet –DisplayName “esp:sha1-des3” -Proposal $QMProposal -New-NetIPSecRule -DisplayName “Tunnel from HQ to Dallas Branch” -Mode Tunnel -LocalAddress 192.168.0.0/16 -RemoteAddress 192.157.0.0/16 -LocalTunnelEndpoint 1.1.1.1 -RemoteTunnelEndpoint 2.2.2.2 -InboundSecurity Require -OutboundSecurity Require -QuickModeCryptoSet $QMCryptoSet.Name +$QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "esp:sha1-des3" -Proposal $QMProposal +New-NetIPSecRule -DisplayName "Tunnel from HQ to Dallas Branch" -Mode Tunnel -LocalAddress 192.168.0.0/16 -RemoteAddress 192.157.0.0/16 -LocalTunnelEndpoint 1.1.1.1 -RemoteTunnelEndpoint 2.2.2.2 -InboundSecurity Require -OutboundSecurity Require -QuickModeCryptoSet $QMCryptoSet.Name ``` - ## Deploy secure firewall rules with IPsec - In situations where only secure traffic can be allowed through the Windows Defender Firewall, a combination of manually configured firewall and IPsec rules are necessary. The firewall rules determine the level of security for allowed packets, and the underlying IPsec rules secure the traffic. The scenarios can be accomplished in Windows PowerShell and in Netsh, with many similarities in deployment. - ### Create a secure firewall rule (allow if secure) - Configuring firewalls rule to allow connections if they're secure requires the corresponding traffic to be authenticated and integrity protected, and then optionally encrypted by IPsec. - The following example creates a firewall rule that requires traffic to be authenticated. The command permits inbound Telnet network traffic only if the connection from the remote device is authenticated by using a separate IPsec rule. - **Netsh** - -``` syntax +```cmd netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in program=%SystemRoot%\System32\tlntsvr.exe security=authenticate action=allow ``` -Windows PowerShell - ```powershell -New-NetFirewallRule -DisplayName “Allow Authenticated Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -Authentication Required -Action Allow +New-NetFirewallRule -DisplayName "Allow Authenticated Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -Authentication Required -Action Allow ``` - The following command creates an IPsec rule that requires a first (computer) authentication and then attempts an optional second (user) authentication. Creating this rule secures and allows the traffic through the firewall rule requirements for the messenger program. - **Netsh** - -``` syntax +```cmd netsh advfirewall consec add rule name="Authenticate Both Computer and User" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb,computerntlm auth2=userkerb,userntlm,anonymous ``` -Windows PowerShell - ```powershell -$mkerbauthprop = New-NetIPsecAuthProposal -Machine –Kerberos +$mkerbauthprop = New-NetIPsecAuthProposal -Machine -Kerberos $mntlmauthprop = New-NetIPsecAuthProposal -Machine -NTLM -$P1Auth = New-NetIPsecPhase1AuthSet -DisplayName “Machine Auth” –Proposal $mkerbauthprop,$mntlmauthprop +$P1Auth = New-NetIPsecPhase1AuthSet -DisplayName "Machine Auth" -Proposal $mkerbauthprop,$mntlmauthprop $ukerbauthprop = New-NetIPsecAuthProposal -User -Kerberos $unentlmauthprop = New-NetIPsecAuthProposal -User -NTLM $anonyauthprop = New-NetIPsecAuthProposal -Anonymous -$P2Auth = New-NetIPsecPhase2AuthSet -DisplayName “User Auth” -Proposal $ukerbauthprop,$unentlmauthprop,$anonyauthprop -New-NetIPSecRule -DisplayName “Authenticate Both Computer and User” -InboundSecurity Require -OutboundSecurity Require -Phase1AuthSet $P1Auth.Name –Phase2AuthSet $P2Auth.Name +$P2Auth = New-NetIPsecPhase2AuthSet -DisplayName "User Auth" -Proposal $ukerbauthprop,$unentlmauthprop,$anonyauthprop +New-NetIPSecRule -DisplayName "Authenticate Both Computer and User" -InboundSecurity Require -OutboundSecurity Require -Phase1AuthSet $P1Auth.Name -Phase2AuthSet $P2Auth.Name ``` - ### Isolate a server by requiring encryption and group membership - To improve the security of the devices in an organization, you can deploy domain isolation in which domain-members are restricted. They require authentication when communicating among each other and reject non-authenticated inbound connections. To improve the security of servers with sensitive data, this data must be protected by allowing access only to a subset of devices within the enterprise domain. - IPsec can provide this extra layer of protection by isolating the server. In server isolation, sensitive data access is restricted to users and devices with legitimate business need, and the data is additionally encrypted to prevent eavesdropping. - ### Create a firewall rule that requires group membership and encryption - To deploy server isolation, we layer a firewall rule that restricts traffic to authorized users or devices on the IPsec rule that enforces authentication. - -The following firewall rule allows Telnet traffic from user accounts that are members of a custom group called “Authorized to Access Server.” This access can additionally be restricted based on the device, user, or both by specifying the restriction parameters. - -A Security Descriptor Definition Language (SDDL) string is created by extending a user or group’s security identifier (SID). For more information about finding a group’s SID, see: [Finding the SID for a group account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)#bkmk_FINDSID). - +The following firewall rule allows Telnet traffic from user accounts that are members of a custom group called "Authorized to Access Server." This access can additionally be restricted based on the device, user, or both by specifying the restriction parameters. +A Security Descriptor Definition Language (SDDL) string is created by extending a user or group's security identifier (SID). For more information about finding a group's SID, see: [Finding the SID for a group account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)#bkmk_FINDSID). Restricting access to a group allows administrations to extend strong authentication support through Windows Defender Firewall and/or IPsec policies. - The following example shows you how to create an SDDL string that represents security groups. -Windows PowerShell - ```powershell -$user = new-object System.Security.Principal.NTAccount (“corp.contoso.com\Administrators”) +$user = new-object System.Security.Principal.NTAccount ("corp.contoso.com\Administrators") $SIDofSecureUserGroup = $user.Translate([System.Security.Principal.SecurityIdentifier]).Value $secureUserGroup = "D:(A;;CC;;;$SIDofSecureUserGroup)" ``` - By using the previous scriptlet, you can also get the SDDL string for a secure computer group as shown here: -Windows PowerShell - ```powershell $secureMachineGroup = "D:(A;;CC;;;$SIDofSecureMachineGroup)" ``` - For more information about how to create security groups or how to determine the SDDL string, see [Working with SIDs](/previous-versions/windows/it-pro/windows-powershell-1.0/ff730940(v=technet.10)). - Telnet is an application that doesn't provide encryption. This application can send data, such as names and passwords, over the network. This data can be intercepted by malicious users. If an administrator would like to allow the use of Telnet, but protect the traffic, a firewall rule that requires IPsec encryption can be created. This firewall rule is necessary so that the administrator can be certain that when this application is used, all of the traffic sent or received by this port is encrypted. If IPsec fails to authorize the connection, no traffic is allowed from this application. - In this example, we allow only authenticated and encrypted inbound Telnet traffic from a specified secure user group through the creation of the following firewall rule. - **Netsh** - -``` syntax +```cmd netsh advfirewall set store gpo=domain.contoso.com\Server_Isolation -netsh advfirewall firewall add rule name=“Allow Encrypted Inbound Telnet to Group Members Only” program=%SystemRoot%\System32\tlntsvr.exe protocol=TCP dir=in action=allow localport=23 security=authenc rmtusrgrp ="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" +netsh advfirewall firewall add rule name="Allow Encrypted Inbound Telnet to Group Members Only" program=%SystemRoot%\System32\tlntsvr.exe protocol=TCP dir=in action=allow localport=23 security=authenc rmtusrgrp ="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" ``` -Windows PowerShell - ```powershell -New-NetFirewallRule -DisplayName "Allow Encrypted Inbound Telnet to Group Members Only" -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -Direction Inbound -Action Allow -LocalPort 23 -Authentication Required -Encryption Required –RemoteUser $secureUserGroup –PolicyStore domain.contoso.com\Server_Isolation +New-NetFirewallRule -DisplayName "Allow Encrypted Inbound Telnet to Group Members Only" -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -Direction Inbound -Action Allow -LocalPort 23 -Authentication Required -Encryption Required -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\Server_Isolation ``` - ### Endpoint security enforcement - The previous example showed end to end security for a particular application. In situations where endpoint security is required for many applications, having a firewall rule per application can be cumbersome and difficult to manage. Authorization can override the per-rule basis and be done at the IPsec layer. - In this example, we set the global IPsec setting to only allow transport mode traffic to come from an authorized user group with the following cmdlet. Consult the previous examples for working with security groups. -Windows PowerShell - ```powershell Set-NetFirewallSetting -RemoteMachineTransportAuthorizationList $secureMachineGroup ``` - ### Create firewall rules that allow IPsec-protected network traffic (authenticated bypass) - Authenticated bypass allows traffic from a specified trusted device or user to override firewall block rules. This override is helpful when an administrator wants to use scanning servers to monitor and update devices without the need to use port-level exceptions. For more information, see [How to enable authenticated firewall bypass](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)). - In this example, we assume that a blocking firewall rule exists. This example permits any network traffic on any port from any IP address to override the block rule, if the traffic is authenticated as originating from a device or user account that is a member of the specified device or user security group. - **Netsh** - -``` syntax +```cmd netsh advfirewall set store gpo=domain.contoso.com\domain_isolation netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in security=authenticate action="bypass" rmtcomputergrp="D:(A;;CC;;;S-1-5-21-2329867823-2610410949-1491576313-1114)" rmtusrgrp="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" ``` -Windows PowerShell - ```powershell -New-NetFirewallRule –DisplayName “Inbound Secure Bypass Rule" –Direction Inbound –Authentication Required –OverrideBlockRules $true -RemoteMachine $secureMachineGroup –RemoteUser $secureUserGroup –PolicyStore domain.contoso.com\domain_isolation +New-NetFirewallRule -DisplayName "Inbound Secure Bypass Rule" -Direction Inbound -Authentication Required -OverrideBlockRules $true -RemoteMachine $secureMachineGroup -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\domain_isolation ``` ## Other resources - - For more information about Windows PowerShell concepts, see the following topics. - - [Windows PowerShell Getting Started Guide](/powershell/scripting/overview) - - [Windows PowerShell User Guide](/powershell/scripting/overview) - - [Windows PowerShell About Help Topics](https://go.microsoft.com/fwlink/p/?linkid=113206) - - [about\_Functions](/powershell/module/microsoft.powershell.core/about/about_functions) - - [about\_Functions\_Advanced](/powershell/module/microsoft.powershell.core/about/about_functions_advanced) - - [about\_Execution\_Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies) - - [about\_Foreach](/powershell/module/microsoft.powershell.core/about/about_foreach) - - [about\_Objects](/powershell/module/microsoft.powershell.core/about/about_objects) - - [about\_Properties](/powershell/module/microsoft.powershell.core/about/about_properties) - - [about\_While](/powershell/module/microsoft.powershell.core/about/about_while) - - [about\_Scripts](/powershell/module/microsoft.powershell.core/about/about_scripts) - - [about\_Signing](/powershell/module/microsoft.powershell.core/about/about_signing) - - [about\_Throw](/powershell/module/microsoft.powershell.core/about/about_throw) - - [about\_PSSessions](/powershell/module/microsoft.powershell.core/about/about_pssessions) - - [about\_Modules](/powershell/module/microsoft.powershell.core/about/about_modules) - - [about\_Command\_Precedence](/powershell/module/microsoft.powershell.core/about/about_command_precedence) - -  - -  \ No newline at end of file From 4ae3910efea1cfc8eefb2e303aa53d4e137142c3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 10:25:14 -0500 Subject: [PATCH 106/237] metadata updates --- education/windows/autopilot-reset.md | 6 +----- education/windows/index.yml | 1 - education/windows/windows-11-se-overview.md | 1 - windows/application-management/index.yml | 1 - windows/client-management/mdm/index.yml | 1 - windows/configuration/configure-windows-10-taskbar.md | 8 -------- .../configuration/customize-and-export-start-layout.md | 1 - .../customize-start-menu-layout-windows-11.md | 7 ------- windows/configuration/customize-taskbar-windows-11.md | 1 - ...mize-windows-10-start-screens-by-using-group-policy.md | 7 ------- ...d-the-application-user-model-id-of-an-installed-app.md | 7 ------- .../configuration/guidelines-for-assigned-access-app.md | 6 ------ windows/configuration/index.yml | 1 - windows/configuration/kiosk-single-app.md | 5 ----- .../lock-down-windows-10-to-specific-apps.md | 7 ------- .../diagnose-provisioning-packages.md | 1 - .../provisioning-packages/provisioning-install-icd.md | 7 ------- .../provisioning-packages/provisioning-packages.md | 7 ------- .../stop-employees-from-using-microsoft-store.md | 8 -------- .../windows-10-start-layout-options-and-policies.md | 8 -------- windows/configuration/windows-spotlight.md | 7 ------- windows/hub/index.yml | 1 - .../user-account-control/how-it-works.md | 3 --- .../application-control/user-account-control/index.md | 3 --- .../applocker/applocker-overview.md | 1 - .../design/microsoft-recommended-driver-block-rules.md | 1 - .../windows-defender-application-control/wdac.md | 1 - .../install-md-app-guard.md | 3 --- .../md-app-guard-overview.md | 4 ---- .../windows-sandbox-configure-using-wsb-file.md | 3 --- .../windows-sandbox/windows-sandbox-overview.md | 3 --- ...e-virtualization-based-protection-of-code-integrity.md | 4 ---- .../kernel-dma-protection-for-thunderbolt.md | 1 - .../tpm/initialize-and-configure-ownership-of-the-tpm.md | 1 - .../security/hardware-security/tpm/tpm-recommendations.md | 1 - .../tpm/trusted-platform-module-overview.md | 1 - .../tpm/trusted-platform-module-top-node.md | 1 - .../identity-protection/credential-guard/configure.md | 3 --- .../identity-protection/credential-guard/index.md | 1 - .../hello-cert-trust-policy-settings.md | 1 - .../identity-protection/hello-for-business/hello-faq.yml | 1 - .../hello-for-business/hello-feature-pin-reset.md | 1 - .../hello-for-business/hello-manage-in-organization.md | 1 - .../hello-why-pin-is-better-than-password.md | 1 - .../identity-protection/hello-for-business/index.md | 1 - windows/security/identity-protection/passkeys/index.md | 1 - .../identity-protection/passwordless-experience/index.md | 1 - .../identity-protection/remote-credential-guard.md | 1 - windows/security/identity-protection/web-sign-in/index.md | 1 - windows/security/index.yml | 1 - .../data-protection/bitlocker/index.md | 1 - .../data-protection/bitlocker/preboot-recovery-screen.md | 1 - .../data-protection/bitlocker/recovery-overview.md | 1 - .../data-protection/bitlocker/recovery-process.md | 1 - .../security-compliance-toolkit-10.md | 1 - .../windows-security-baselines.md | 1 - .../system-security/secure-the-windows-10-boot-process.md | 1 - .../windows-defender-security-center.md | 3 --- .../microsoft-defender-smartscreen/index.md | 6 +----- .../certification/fips-140-validation.md | 1 - 60 files changed, 2 insertions(+), 160 deletions(-) diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 7b14deeb86..bb0223c8fc 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -5,10 +5,6 @@ ms.date: 08/10/2022 ms.topic: how-to appliesto: - ✅ Windows 10 -ms.collection: - - highpri - - tier2 - - education --- # Reset devices with Autopilot Reset @@ -60,7 +56,7 @@ You can set the policy using one of these methods: ## Trigger Autopilot Reset Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. -] + To trigger Autopilot Reset: 1. From the Windows device lock screen, enter the keystroke: CTRL + WIN + R. diff --git a/education/windows/index.yml b/education/windows/index.yml index 0c159bd537..3c3dfae79b 100644 --- a/education/windows/index.yml +++ b/education/windows/index.yml @@ -10,7 +10,6 @@ metadata: ms.technology: itpro-edu ms.collection: - education - - highpri - tier1 author: paolomatarazzo ms.author: paoloma diff --git a/education/windows/windows-11-se-overview.md b/education/windows/windows-11-se-overview.md index 2fd353ae04..e82eb8a227 100644 --- a/education/windows/windows-11-se-overview.md +++ b/education/windows/windows-11-se-overview.md @@ -6,7 +6,6 @@ ms.date: 11/02/2023 appliesto: - ✅ Windows 11 SE ms.collection: - - highpri - education - tier1 --- diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index b08cd77d57..46ff46e15f 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -14,7 +14,6 @@ metadata: ms.prod: windows-client ms.collection: - tier1 - - highpri # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | tutorial | overview | quickstart | reference | sample | tutorial | video | whats-new diff --git a/windows/client-management/mdm/index.yml b/windows/client-management/mdm/index.yml index 2e6a1b1f54..7944d29d03 100644 --- a/windows/client-management/mdm/index.yml +++ b/windows/client-management/mdm/index.yml @@ -10,7 +10,6 @@ metadata: ms.technology: itpro-manage ms.prod: windows-client ms.collection: - - highpri - tier1 author: vinaypamnani-msft ms.author: vinpa diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index e80c753918..65937f4400 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -1,18 +1,10 @@ --- title: Configure Windows 10 taskbar description: Administrators can pin more apps to the taskbar and remove default pinned apps from the taskbar by adding a section to a layout modification XML file. -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: how-to -ms.localizationpriority: medium ms.date: 08/18/2023 -ms.reviewer: -manager: aaroncz -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure --- # Configure Windows 10 taskbar diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index c7298fc1d3..2173e2ee20 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -10,7 +10,6 @@ ms.topic: how-to ms.localizationpriority: medium ms.date: 08/18/2023 ms.collection: - - highpri - tier1 ms.technology: itpro-configure --- diff --git a/windows/configuration/customize-start-menu-layout-windows-11.md b/windows/configuration/customize-start-menu-layout-windows-11.md index 7ef410564c..2e959a035a 100644 --- a/windows/configuration/customize-start-menu-layout-windows-11.md +++ b/windows/configuration/customize-start-menu-layout-windows-11.md @@ -1,16 +1,9 @@ --- title: Add or remove pinned apps on the Start menu in Windows 11 description: Export Start layout to LayoutModification.json with pinned apps, and add or remove pinned apps. Use the JSON text in an MDM policy to deploy a custom Start menu layout to Windows 11 devices. -manager: aaroncz author: lizgt2000 ms.author: lizlong ms.reviewer: ericpapa -ms.prod: windows-client -ms.localizationpriority: medium -ms.collection: - - highpri - - tier1 -ms.technology: itpro-configure ms.date: 01/10/2023 ms.topic: article --- diff --git a/windows/configuration/customize-taskbar-windows-11.md b/windows/configuration/customize-taskbar-windows-11.md index a38e34c05c..72a4298b7c 100644 --- a/windows/configuration/customize-taskbar-windows-11.md +++ b/windows/configuration/customize-taskbar-windows-11.md @@ -8,7 +8,6 @@ ms.prod: windows-client author: lizgt2000 ms.localizationpriority: medium ms.collection: - - highpri - tier1 ms.technology: itpro-configure ms.date: 08/17/2023 diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 40b7d5daac..94641458ae 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -3,15 +3,8 @@ title: Customize Windows 10 Start and taskbar with group policy description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain. ms.reviewer: manager: aaroncz -ms.prod: windows-client author: lizgt2000 -ms.localizationpriority: medium ms.author: lizlong -ms.topic: article -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md index ee9ad89242..5b78101494 100644 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md @@ -1,17 +1,10 @@ --- title: Find the Application User Model ID of an installed app ms.reviewer: sybruckm -manager: aaroncz description: To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device. author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium -ms.prod: windows-client -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- # Find the Application User Model ID of an installed app diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index f1159c1544..95bcd1a788 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -1,16 +1,10 @@ --- title: Guidelines for choosing an app for assigned access description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience. -ms.prod: windows-client author: lizgt2000 -ms.localizationpriority: medium ms.author: lizlong ms.topic: article ms.reviewer: sybruckm -manager: aaroncz -ms.collection: - - highpri - - tier2 ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/index.yml b/windows/configuration/index.yml index 0eace6a656..6eff88270a 100644 --- a/windows/configuration/index.yml +++ b/windows/configuration/index.yml @@ -9,7 +9,6 @@ metadata: ms.topic: landing-page # Required ms.prod: windows-client ms.collection: - - highpri - tier1 author: aczechowski ms.author: aaroncz diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index e74ea773a1..0218a198e2 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -2,16 +2,11 @@ title: Set up a single-app kiosk on Windows description: A single-use device is easy to set up in Windows Pro, Enterprise, and Education editions. ms.reviewer: sybruckm -manager: aaroncz ms.author: lizlong -ms.prod: windows-client author: lizgt2000 -ms.localizationpriority: medium ms.topic: article ms.collection: - - highpri - tier1 -ms.technology: itpro-configure ms.date: 07/12/2023 --- diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 82a54e8848..a32e707e87 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,17 +1,10 @@ --- title: Set up a multi-app kiosk on Windows 10 description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. -ms.prod: windows-client -ms.technology: itpro-configure author: lizgt2000 ms.author: lizlong -manager: aaroncz ms.reviewer: sybruckm -ms.localizationpriority: medium ms.topic: how-to -ms.collection: - - highpri - - tier2 ms.date: 11/08/2023 appliesto: - ✅ Windows 10 Pro diff --git a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md index 5a71baac61..4000de4867 100644 --- a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md +++ b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md @@ -9,7 +9,6 @@ ms.prod: windows-client ms.technology: itpro-manage author: lizgt2000 ms.date: 01/18/2023 -ms.collection: highpri --- # Diagnose Provisioning Packages diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 22b8f9ad65..2f6782646c 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -1,17 +1,10 @@ --- title: Install Windows Configuration Designer description: Learn how to install and use Windows Configuration Designer so you can easily configure devices running Windows 10/11. -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium ms.reviewer: kevinsheehan -manager: aaroncz -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 96dce6d256..aed5ec0d4a 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -2,16 +2,9 @@ title: Provisioning packages overview description: With Windows 10 and Windows 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Learn about what provisioning packages, are and what they do. ms.reviewer: kevinsheehan -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure ms.date: 12/31/2017 --- diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index 9d33ff603e..416187989e 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -1,18 +1,10 @@ --- title: Configure access to Microsoft Store description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: conceptual -ms.localizationpriority: medium ms.date: 11/29/2022 -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure --- # Configure access to Microsoft Store diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index a3d8dd29c1..2603aa56ac 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -1,18 +1,10 @@ --- title: Customize and manage the Windows 10 Start and taskbar layout description: On Windows devices, customize the start menu layout and taskbar using XML, group policy, provisioning package, or MDM policy. You can add pinned folders, add a start menu size, pin apps to the taskbar, and more. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium ms.date: 08/05/2021 -ms.collection: - - highpri - - tier2 -ms.technology: itpro-configure --- # Customize the Start menu and taskbar layout on Windows 10 and later devices diff --git a/windows/configuration/windows-spotlight.md b/windows/configuration/windows-spotlight.md index 33bd24bcc8..b80b7b3a66 100644 --- a/windows/configuration/windows-spotlight.md +++ b/windows/configuration/windows-spotlight.md @@ -1,17 +1,10 @@ --- title: Configure Windows Spotlight on the lock screen description: Windows Spotlight is an option for the lock screen background that displays different background images on the lock screen. -ms.reviewer: -manager: aaroncz -ms.prod: windows-client author: lizgt2000 ms.author: lizlong ms.topic: article -ms.localizationpriority: medium ms.date: 04/30/2018 -ms.collection: - - highpri - - tier2 ms.technology: itpro-configure --- diff --git a/windows/hub/index.yml b/windows/hub/index.yml index 7c0031c1e0..e651c1901d 100644 --- a/windows/hub/index.yml +++ b/windows/hub/index.yml @@ -10,7 +10,6 @@ metadata: ms.topic: hub-page ms.prod: windows-client ms.collection: - - highpri - tier1 author: paolomatarazzo ms.author: paoloma diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index 2e4ec8b5e5..fa5d96ef91 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -1,9 +1,6 @@ --- title: How User Account Control works description: Learn about User Account Control (UAC) components and how it interacts with the end users. -ms.collection: - - highpri - - tier2 ms.topic: concept-article ms.date: 05/24/2023 --- diff --git a/windows/security/application-security/application-control/user-account-control/index.md b/windows/security/application-security/application-control/user-account-control/index.md index aad3fb9eab..3b5e6e8561 100644 --- a/windows/security/application-security/application-control/user-account-control/index.md +++ b/windows/security/application-security/application-control/user-account-control/index.md @@ -1,9 +1,6 @@ --- title: User Account Control description: Learn how User Account Control (UAC) helps to prevent unauthorized changes to Windows devices. -ms.collection: - - highpri - - tier2 ms.topic: overview ms.date: 05/24/2023 --- diff --git a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md index 7c130ac1f2..8bc7a51202 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md @@ -2,7 +2,6 @@ title: AppLocker description: This article provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.collection: -- highpri - tier3 - must-keep ms.topic: conceptual diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index 3eac346b20..615226657c 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -3,7 +3,6 @@ title: Microsoft recommended driver block rules description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. ms.localizationpriority: medium ms.collection: -- highpri - tier3 - must-keep ms.date: 06/06/2023 diff --git a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md index 22e5196913..500f4c397b 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/wdac.md @@ -3,7 +3,6 @@ title: Application Control for Windows description: Application Control restricts which applications users are allowed to run and the code that runs in the system core. ms.localizationpriority: medium ms.collection: -- highpri - tier3 - must-keep ms.date: 08/30/2023 diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md index ac710efb7a..5deab8192a 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/install-md-app-guard.md @@ -3,9 +3,6 @@ title: Enable hardware-based isolation for Microsoft Edge description: Learn about the Microsoft Defender Application Guard modes (Standalone or Enterprise-managed), and how to install Application Guard in your enterprise. ms.date: 07/11/2023 ms.topic: how-to -ms.collection: - - highpri - - tier2 --- # Prepare to install Microsoft Defender Application Guard diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md index d1547ce21e..8b2235111a 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview.md @@ -1,11 +1,7 @@ --- title: Microsoft Defender Application Guard description: Learn about Microsoft Defender Application Guard and how it helps combat malicious content and malware out on the Internet. -ms.localizationpriority: medium ms.date: 07/11/2023 -ms.collection: - - highpri - - tier2 ms.topic: conceptual --- diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 888bca39ce..b33a5b9f67 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -1,9 +1,6 @@ --- title: Windows Sandbox configuration description: Windows Sandbox configuration -ms.collection: - - highpri - - tier2 ms.topic: article ms.date: 05/25/2023 --- diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md index 928d31e27b..676b2a8179 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md @@ -1,9 +1,6 @@ --- title: Windows Sandbox description: Windows Sandbox overview -ms.collection: - - highpri - - tier2 ms.topic: article ms.date: 05/25/2023 --- diff --git a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md index a3404e644a..2748c9c816 100644 --- a/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity.md @@ -1,10 +1,6 @@ --- title: Enable memory integrity description: This article explains the steps to opt in to using memory integrity on Windows devices. -ms.localizationpriority: medium -ms.collection: - - highpri - - tier2 ms.topic: conceptual ms.date: 03/16/2023 appliesto: diff --git a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md index 8ed52be240..f4092a1bc3 100644 --- a/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt.md @@ -2,7 +2,6 @@ title: Kernel DMA Protection description: Learn how Kernel DMA Protection protects Windows devices against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices. ms.collection: - - highpri - tier1 ms.topic: conceptual ms.date: 07/31/2023 diff --git a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md index e9374612fe..6eab697f4d 100644 --- a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -4,7 +4,6 @@ description: Learn how to view and troubleshoot the Trusted Platform Module (TPM ms.topic: conceptual ms.date: 02/02/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/hardware-security/tpm/tpm-recommendations.md b/windows/security/hardware-security/tpm/tpm-recommendations.md index 1190a55d46..d9a7ce1a95 100644 --- a/windows/security/hardware-security/tpm/tpm-recommendations.md +++ b/windows/security/hardware-security/tpm/tpm-recommendations.md @@ -4,7 +4,6 @@ description: This topic provides recommendations for Trusted Platform Module (TP ms.topic: conceptual ms.date: 02/02/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md index 8d35f5065b..55f111a138 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md @@ -4,7 +4,6 @@ description: Learn about the Trusted Platform Module (TPM) and how Windows uses ms.topic: conceptual ms.date: 02/22/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md b/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md index c19e762bdf..7befac5b61 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md @@ -4,7 +4,6 @@ description: This topic for the IT professional provides links to information ab ms.topic: conceptual ms.date: 02/02/2023 ms.collection: -- highpri - tier1 --- diff --git a/windows/security/identity-protection/credential-guard/configure.md b/windows/security/identity-protection/credential-guard/configure.md index 21c87bfeeb..e6e9d95ed6 100644 --- a/windows/security/identity-protection/credential-guard/configure.md +++ b/windows/security/identity-protection/credential-guard/configure.md @@ -2,9 +2,6 @@ title: Configure Credential Guard description: Learn how to configure Credential Guard using MDM, Group Policy, or the registry. ms.date: 08/31/2023 -ms.collection: - - highpri - - tier2 ms.topic: how-to --- diff --git a/windows/security/identity-protection/credential-guard/index.md b/windows/security/identity-protection/credential-guard/index.md index 710f148343..2827301105 100644 --- a/windows/security/identity-protection/credential-guard/index.md +++ b/windows/security/identity-protection/credential-guard/index.md @@ -4,7 +4,6 @@ description: Learn about Credential Guard and how it isolates secrets so that on ms.date: 08/31/2023 ms.topic: overview ms.collection: - - highpri - tier1 --- diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 8a414df385..a9ac0c22ae 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -2,7 +2,6 @@ title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario ms.collection: -- highpri - tier1 ms.date: 09/07/2023 ms.topic: tutorial diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 661971662b..67399ad857 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -5,7 +5,6 @@ metadata: author: paolomatarazzo ms.author: paoloma ms.collection: - - highpri - tier1 ms.topic: faq ms.date: 08/03/2023 diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index bf642eef73..0f28986895 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -2,7 +2,6 @@ title: PIN reset description: Learn how Microsoft PIN reset service enables your users to recover a forgotten Windows Hello for Business PIN. ms.collection: - - highpri - tier1 ms.date: 08/15/2023 ms.topic: how-to diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 999b35f45b..747447147e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -2,7 +2,6 @@ title: Manage Windows Hello in your organization description: Learn how to create a Group Policy or mobile device management (MDM) policy to configure and deploy Windows Hello for Business. ms.collection: - - highpri - tier1 ms.date: 9/25/2023 ms.topic: reference diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index f137de379f..220d17aff0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -2,7 +2,6 @@ title: Why a PIN is better than an online password description: Windows Hello enables users to sign in to their devices using a PIN. Learn how is a PIN different from (and better than) an online password. ms.collection: - - highpri - tier1 ms.date: 03/15/2023 ms.topic: conceptual diff --git a/windows/security/identity-protection/hello-for-business/index.md b/windows/security/identity-protection/hello-for-business/index.md index 953074993d..78c5cb451b 100644 --- a/windows/security/identity-protection/hello-for-business/index.md +++ b/windows/security/identity-protection/hello-for-business/index.md @@ -2,7 +2,6 @@ title: Windows Hello for Business Overview description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices. ms.collection: - - highpri - tier1 ms.topic: overview ms.date: 04/24/2023 diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index 9ca4657426..44f695a852 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -2,7 +2,6 @@ title: Support for passkeys in Windows description: Learn about passkeys and how to use them on Windows devices. ms.collection: -- highpri - tier1 ms.topic: overview ms.date: 11/07/2023 diff --git a/windows/security/identity-protection/passwordless-experience/index.md b/windows/security/identity-protection/passwordless-experience/index.md index 7ea73c4603..37dc49c775 100644 --- a/windows/security/identity-protection/passwordless-experience/index.md +++ b/windows/security/identity-protection/passwordless-experience/index.md @@ -2,7 +2,6 @@ title: Windows passwordless experience description: Learn how Windows passwordless experience enables your organization to move away from passwords. ms.collection: - - highpri - tier1 ms.date: 09/27/2023 ms.topic: how-to diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 5c99653fe4..ab2a40a041 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -2,7 +2,6 @@ title: Remote Credential Guard description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device. ms.collection: -- highpri - tier1 ms.topic: how-to ms.date: 09/06/2023 diff --git a/windows/security/identity-protection/web-sign-in/index.md b/windows/security/identity-protection/web-sign-in/index.md index ecf5811f4d..d2d61e204a 100644 --- a/windows/security/identity-protection/web-sign-in/index.md +++ b/windows/security/identity-protection/web-sign-in/index.md @@ -6,7 +6,6 @@ ms.topic: how-to appliesto: - ✅ Windows 11 ms.collection: - - highpri - tier1 --- diff --git a/windows/security/index.yml b/windows/security/index.yml index 40983d837f..7433169832 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -9,7 +9,6 @@ metadata: ms.prod: windows-client ms.technology: itpro-security ms.collection: - - highpri - tier1 author: paolomatarazzo ms.author: paoloma diff --git a/windows/security/operating-system-security/data-protection/bitlocker/index.md b/windows/security/operating-system-security/data-protection/bitlocker/index.md index c831cf49df..ebcd29c477 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/index.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/index.md @@ -2,7 +2,6 @@ title: BitLocker overview description: Learn about BitLocker practical applications and requirements. ms.collection: - - highpri - tier1 ms.topic: overview ms.date: 10/30/2023 diff --git a/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md b/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md index e694a95993..3f689cd1c4 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md @@ -2,7 +2,6 @@ title: BitLocker preboot recovery screen description: Learn about the information displayed in the BitLocker preboot recovery screen, depending on configured policy settings and recovery keys status. ms.collection: - - highpri - tier1 ms.topic: concept-article ms.date: 10/30/2023 diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md index d258db515e..80543b6176 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md @@ -2,7 +2,6 @@ title: BitLocker recovery overview description: Learn about BitLocker recovery scenarios, recovery options, and how to determine root cause of failed automatic unlocks. ms.collection: - - highpri - tier1 ms.topic: how-to ms.date: 10/30/2023 diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md index 76c314a7cb..9a83d1ff16 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md @@ -2,7 +2,6 @@ title: BitLocker recovery process description: Learn how to obtain BitLocker recovery information for Microsoft Entra joined, Microsoft Entra hybrid joined, and Active Directory joined devices, and how to restore access to a locked drive. ms.collection: - - highpri - tier1 ms.topic: how-to ms.date: 10/30/2023 diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md index 0376d87c85..7274ec1569 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -3,7 +3,6 @@ title: Microsoft Security Compliance Toolkit Guide description: This article describes how to use Security Compliance Toolkit in your organization. ms.localizationpriority: medium ms.collection: - - highpri - tier3 ms.topic: conceptual ms.date: 10/31/2023 diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md index 63b6cae99b..1463d2af20 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md @@ -3,7 +3,6 @@ title: Security baselines guide description: Learn how to use security baselines in your organization. ms.localizationpriority: medium ms.collection: - - highpri - tier3 ms.topic: conceptual ms.date: 07/11/2023 diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index b1bfa3ebb1..3daa0cbf86 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -4,7 +4,6 @@ description: This article describes how Windows security features help protect y ms.topic: conceptual ms.date: 08/11/2023 ms.collection: - - highpri - tier1 --- diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md index 1970d566b4..5ff128f685 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md @@ -3,9 +3,6 @@ title: Windows Security description: Windows Security brings together common Windows security features into one place. ms.date: 08/11/2023 ms.topic: article -ms.collection: - - highpri - - tier2 --- # Windows Security diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md index 9b52d9fb84..b5af241045 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/index.md @@ -2,11 +2,7 @@ title: Microsoft Defender SmartScreen overview description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. ms.date: 08/11/2023 -ms.topic: article -ms.localizationpriority: high -ms.collection: - - tier2 - - highpri +ms.topic: conceptual appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/security/security-foundations/certification/fips-140-validation.md b/windows/security/security-foundations/certification/fips-140-validation.md index 1cb3c7c91f..8c37615928 100644 --- a/windows/security/security-foundations/certification/fips-140-validation.md +++ b/windows/security/security-foundations/certification/fips-140-validation.md @@ -7,7 +7,6 @@ manager: aaroncz ms.author: paoloma author: paolomatarazzo ms.collection: - - highpri - tier3 ms.topic: reference ms.localizationpriority: medium From e91619dbeeb12d5a5e8a521ec5e33ace06256e8a Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 10:29:22 -0500 Subject: [PATCH 107/237] docsfx update --- windows/security/docfx.json | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index b981234d62..4dffa28451 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -222,7 +222,6 @@ "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck" }, "ms.collection": { - "application-security/application-control/windows-defender-application-control/**/*.md": [ "tier3", "must-keep" ], "identity-protection/hello-for-business/*.md": "tier1", "information-protection/pluton/*.md": "tier1", "information-protection/tpm/*.md": "tier1", From 7fe9b6b26130a5d2fec157865bff36728e24c950 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 10:42:24 -0500 Subject: [PATCH 108/237] updates --- windows/security/docfx.json | 4 +--- .../identity-protection/credential-guard/index.md | 2 -- .../hello-cert-trust-policy-settings.md | 2 -- .../hello-for-business/hello-deployment-rdp-certs.md | 2 -- .../hello-for-business/hello-faq.yml | 2 -- .../hello-for-business/hello-feature-pin-reset.md | 2 -- .../hello-feature-remote-desktop.md | 2 -- .../hello-for-business/hello-identity-verification.md | 2 -- .../hello-manage-in-organization.md | 2 -- .../hello-why-pin-is-better-than-password.md | 2 -- .../identity-protection/hello-for-business/index.md | 2 -- .../identity-protection/remote-credential-guard.md | 2 -- .../security/licensing-and-edition-requirements.md | 2 -- .../data-protection/bitlocker/faq.yml | 4 +--- .../data-protection/bitlocker/index.md | 2 -- .../data-protection/bitlocker/operations-guide.md | 2 -- .../bitlocker/preboot-recovery-screen.md | 2 -- .../data-protection/bitlocker/recovery-overview.md | 2 -- .../data-protection/bitlocker/recovery-process.md | 2 -- .../security-compliance-toolkit-10.md | 3 --- .../windows-security-baselines.md | 3 --- .../certification/fips-140-validation.md | 11 +---------- 22 files changed, 3 insertions(+), 56 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 7421416038..4dffa28451 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -222,14 +222,12 @@ "operating-system-security/device-management/windows-security-configuration-framework/*.md": "jmunck" }, "ms.collection": { - "application-security/application-control/windows-defender-application-control/**/*.md": [ "tier3", "must-keep" ], "identity-protection/hello-for-business/*.md": "tier1", "information-protection/pluton/*.md": "tier1", "information-protection/tpm/*.md": "tier1", "threat-protection/auditing/*.md": "tier3", "operating-system-security/data-protection/bitlocker/*.md": "tier1", - "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1", - "operating-system-security/network-security/windows-firewall/*.md": [ "tier2", "must-keep" ] + "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1" } }, "template": [], diff --git a/windows/security/identity-protection/credential-guard/index.md b/windows/security/identity-protection/credential-guard/index.md index 2827301105..0fe80abdd8 100644 --- a/windows/security/identity-protection/credential-guard/index.md +++ b/windows/security/identity-protection/credential-guard/index.md @@ -3,8 +3,6 @@ title: Credential Guard overview description: Learn about Credential Guard and how it isolates secrets so that only privileged system software can access them. ms.date: 08/31/2023 ms.topic: overview -ms.collection: - - tier1 --- # Credential Guard overview diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index a9ac0c22ae..830d49e11a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -1,8 +1,6 @@ --- title: Configure Windows Hello for Business Policy settings in an on-premises certificate trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business in an on-premises certificate trust scenario -ms.collection: -- tier1 ms.date: 09/07/2023 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 315ce4361f..420aee5ed1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -1,8 +1,6 @@ --- title: Deploy certificates for remote desktop sign-in description: Learn how to deploy certificates to cloud Kerberos trust and key trust users, to enable remote desktop sign-in with supplied credentials. -ms.collection: - - tier1 ms.topic: how-to ms.date: 07/25/2023 --- diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 67399ad857..4f52648ad3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -4,8 +4,6 @@ metadata: description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. author: paolomatarazzo ms.author: paoloma - ms.collection: - - tier1 ms.topic: faq ms.date: 08/03/2023 diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 0f28986895..5dda9f66b2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -1,8 +1,6 @@ --- title: PIN reset description: Learn how Microsoft PIN reset service enables your users to recover a forgotten Windows Hello for Business PIN. -ms.collection: - - tier1 ms.date: 08/15/2023 ms.topic: how-to --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 8e7e89b38e..d7d52bf8c8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -3,8 +3,6 @@ title: Remote Desktop description: Learn how Windows Hello for Business supports using biometrics with remote desktop ms.date: 09/01/2023 ms.topic: conceptual -ms.collection: -- tier1 --- # Remote Desktop diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index ea4c5a3119..61dffe9d37 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -3,8 +3,6 @@ ms.date: 10/09/2023 title: Windows Hello for Business Deployment Prerequisite Overview description: Overview of all the different infrastructure requirements for Windows Hello for Business deployment models ms.topic: overview -ms.collection: -- tier1 appliesto: - ✅ Windows 11 - ✅ Windows 10 diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 747447147e..896453d0bf 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -1,8 +1,6 @@ --- title: Manage Windows Hello in your organization description: Learn how to create a Group Policy or mobile device management (MDM) policy to configure and deploy Windows Hello for Business. -ms.collection: - - tier1 ms.date: 9/25/2023 ms.topic: reference --- diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 220d17aff0..6be7e8008f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -1,8 +1,6 @@ --- title: Why a PIN is better than an online password description: Windows Hello enables users to sign in to their devices using a PIN. Learn how is a PIN different from (and better than) an online password. -ms.collection: - - tier1 ms.date: 03/15/2023 ms.topic: conceptual --- diff --git a/windows/security/identity-protection/hello-for-business/index.md b/windows/security/identity-protection/hello-for-business/index.md index 78c5cb451b..e0be2b5b93 100644 --- a/windows/security/identity-protection/hello-for-business/index.md +++ b/windows/security/identity-protection/hello-for-business/index.md @@ -1,8 +1,6 @@ --- title: Windows Hello for Business Overview description: Learn how Windows Hello for Business replaces passwords with strong two-factor authentication on Windows devices. -ms.collection: - - tier1 ms.topic: overview ms.date: 04/24/2023 --- diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index ab2a40a041..7fee850283 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -1,8 +1,6 @@ --- title: Remote Credential Guard description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device. -ms.collection: -- tier1 ms.topic: how-to ms.date: 09/06/2023 appliesto: diff --git a/windows/security/licensing-and-edition-requirements.md b/windows/security/licensing-and-edition-requirements.md index 6b192f2171..5f18fd26da 100644 --- a/windows/security/licensing-and-edition-requirements.md +++ b/windows/security/licensing-and-edition-requirements.md @@ -1,8 +1,6 @@ --- title: Windows security features licensing and edition requirements description: Learn about Windows licensing and edition requirements for the features included in Windows. -ms.collection: -- tier2 ms.topic: conceptual ms.date: 06/15/2023 appliesto: diff --git a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml index 3973bbbe52..e67401c81a 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/faq.yml +++ b/windows/security/operating-system-security/data-protection/bitlocker/faq.yml @@ -1,9 +1,7 @@ ### YamlMime:FAQ metadata: title: BitLocker FAQ - description: Learn more about BitLocker by reviewing the frequently asked questions. - ms.collection: - - tier1 + description: Learn more about BitLocker by reviewing the frequently asked questions. ms.topic: faq ms.date: 10/30/2023 title: BitLocker FAQ diff --git a/windows/security/operating-system-security/data-protection/bitlocker/index.md b/windows/security/operating-system-security/data-protection/bitlocker/index.md index ebcd29c477..9d9ff5daed 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/index.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/index.md @@ -1,8 +1,6 @@ --- title: BitLocker overview description: Learn about BitLocker practical applications and requirements. -ms.collection: - - tier1 ms.topic: overview ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md index bdbd2a6e80..380ac306c4 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/operations-guide.md @@ -1,8 +1,6 @@ --- title: BitLocker operations guide description: Learn how to use different tools to manage and operate BitLocker. -ms.collection: - - tier1 ms.topic: how-to ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md b/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md index 3f689cd1c4..78ab928ae2 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/preboot-recovery-screen.md @@ -1,8 +1,6 @@ --- title: BitLocker preboot recovery screen description: Learn about the information displayed in the BitLocker preboot recovery screen, depending on configured policy settings and recovery keys status. -ms.collection: - - tier1 ms.topic: concept-article ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md index 80543b6176..a8446d34d2 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview.md @@ -1,8 +1,6 @@ --- title: BitLocker recovery overview description: Learn about BitLocker recovery scenarios, recovery options, and how to determine root cause of failed automatic unlocks. -ms.collection: - - tier1 ms.topic: how-to ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md index 9a83d1ff16..b002833d87 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/recovery-process.md @@ -1,8 +1,6 @@ --- title: BitLocker recovery process description: Learn how to obtain BitLocker recovery information for Microsoft Entra joined, Microsoft Entra hybrid joined, and Active Directory joined devices, and how to restore access to a locked drive. -ms.collection: - - tier1 ms.topic: how-to ms.date: 10/30/2023 --- diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md index 7274ec1569..fa66e1ee5c 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/security-compliance-toolkit-10.md @@ -1,9 +1,6 @@ --- title: Microsoft Security Compliance Toolkit Guide description: This article describes how to use Security Compliance Toolkit in your organization. -ms.localizationpriority: medium -ms.collection: - - tier3 ms.topic: conceptual ms.date: 10/31/2023 --- diff --git a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md index 1463d2af20..851c7a72c1 100644 --- a/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md @@ -1,9 +1,6 @@ --- title: Security baselines guide description: Learn how to use security baselines in your organization. -ms.localizationpriority: medium -ms.collection: - - tier3 ms.topic: conceptual ms.date: 07/11/2023 --- diff --git a/windows/security/security-foundations/certification/fips-140-validation.md b/windows/security/security-foundations/certification/fips-140-validation.md index 8c37615928..4fe6de6b5f 100644 --- a/windows/security/security-foundations/certification/fips-140-validation.md +++ b/windows/security/security-foundations/certification/fips-140-validation.md @@ -1,17 +1,8 @@ --- title: Federal Information Processing Standard (FIPS) 140 Validation description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140. -ms.prod: windows-client -ms.date: 08/18/2023 -manager: aaroncz -ms.author: paoloma -author: paolomatarazzo -ms.collection: - - tier3 +ms.date: 11/13/2023 ms.topic: reference -ms.localizationpriority: medium -ms.reviewer: -ms.technology: itpro-security --- # FIPS 140-2 Validation From e03b7f1f78149b5a2524627a07cc3193a4eb7b5a Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 10:54:55 -0500 Subject: [PATCH 109/237] updates --- .../certification/fips-140-validation.md | 4 +++- .../certification/windows-platform-common-criteria.md | 6 +----- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/windows/security/security-foundations/certification/fips-140-validation.md b/windows/security/security-foundations/certification/fips-140-validation.md index 4fe6de6b5f..295dd13ce0 100644 --- a/windows/security/security-foundations/certification/fips-140-validation.md +++ b/windows/security/security-foundations/certification/fips-140-validation.md @@ -3,6 +3,8 @@ title: Federal Information Processing Standard (FIPS) 140 Validation description: Learn how Microsoft products and cryptographic modules follow the U.S. Federal government standard FIPS 140. ms.date: 11/13/2023 ms.topic: reference +ms.author: paoloma +author: paolomatarazzo --- # FIPS 140-2 Validation @@ -11,7 +13,7 @@ ms.topic: reference The Federal Information Processing Standard (FIPS) Publication 140-2 is a U.S. government standard. FIPS is based on Section 5131 of the Information Technology Management Reform Act of 1996. It defines the minimum security requirements for cryptographic modules in IT products. -The [Cryptographic Module Validation Program (CMVP)][HTTP-1]) is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. +The [Cryptographic Module Validation Program (CMVP)][HTTP-1] is a joint effort of the U.S. National Institute of Standards and Technology (NIST) and the Canadian Centre for Cyber Security (CCCS). It validates cryptographic modules against the Security Requirements for Cryptographic Modules (part of FIPS 140-2) and related FIPS cryptography standards. The FIPS 140-2 security requirements cover 11 areas related to the design and implementation of a cryptographic module. The NIST Information Technology Laboratory operates a related program that validates the FIPS approved cryptographic algorithms in the module. ## Microsoft's approach to FIPS 140-2 validation diff --git a/windows/security/security-foundations/certification/windows-platform-common-criteria.md b/windows/security/security-foundations/certification/windows-platform-common-criteria.md index 0f426874c2..d342773f2c 100644 --- a/windows/security/security-foundations/certification/windows-platform-common-criteria.md +++ b/windows/security/security-foundations/certification/windows-platform-common-criteria.md @@ -1,17 +1,13 @@ --- title: Common Criteria Certifications description: This topic details how Microsoft supports the Common Criteria certification program. -ms.prod: windows-client ms.author: sushmanemali author: s4sush -manager: aaroncz ms.topic: reference -ms.localizationpriority: medium ms.date: 11/4/2022 ms.reviewer: paoloma -ms.technology: itpro-security ms.collection: - - tier3 +- tier3 --- # Common Criteria certifications From 4e62b693a8297392e334cb31a7f6d8d6864dd069 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 11:04:11 -0500 Subject: [PATCH 110/237] Acrolinx --- .../diagnose-provisioning-packages.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md index 4000de4867..e5fbf3eb4f 100644 --- a/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md +++ b/windows/configuration/provisioning-packages/diagnose-provisioning-packages.md @@ -1,7 +1,6 @@ --- title: Diagnose Provisioning Packages description: Diagnose general failures in provisioning. -ms.reviewer: manager: aaroncz ms.author: lizlong ms.topic: article @@ -25,16 +24,16 @@ To apply the power settings successfully with the [correct security context](/wi ## Unable to perform bulk enrollment in Microsoft Entra ID -When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request will be rejected, if the user requesting a bulk token is not authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). +When [enrolling devices into Microsoft Entra ID using provisioning packages](https://techcommunity.microsoft.com/t5/intune-customer-success/bulk-join-a-windows-device-to-azure-ad-and-microsoft-endpoint/ba-p/2381400), the bulk token request is rejected, if the user requesting a bulk token isn't authorized to grant application consent. For more information, see [Configure how users consent to applications](/azure/active-directory/manage-apps/configure-user-consent). > [!NOTE] -> When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request may be rejected. +> When obtaining the bulk token, you should select "No, sign in to this app only" when prompted for authentication. If you select "OK" instead without also selecting "Allow my organization to manage my device", the bulk token request might be rejected. ## Unable to apply a multivariant provisioning package -When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it may be difficult to diagnose why a certain target did not get applied. There may have been improperly authored conditions that did not evaluate as expected. +When applying a [multivariant package](/windows/configuration/provisioning-packages/provisioning-multivariant), it might be difficult to diagnose why a certain target didn't get applied. There may have been improperly authored conditions that didn't evaluate as expected. -Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package was not applied. +Starting in Windows 11, version 22H2, [MdmDiagnosticsTool](/windows/client-management/diagnose-mdm-failures-in-windows-10) includes multivariant condition values to diagnose problems with multivariant packages to determine why the package wasn't applied. You can use the following PowerShell example to review the multivariant conditions in the `MDMDiagReport.xml` report: From 0b2385d07cf0ff361ca158b2de4391c87c94827b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 11:56:16 -0500 Subject: [PATCH 111/237] updates --- .../configure-the-windows-firewall-log.md | 74 +++++++++++++++---- 1 file changed, 61 insertions(+), 13 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 7d0c361563..37cd6f17fb 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -5,11 +5,53 @@ ms.topic: conceptual ms.date: 09/07/2021 --- -# Configure the Windows Defender Firewall with Advanced Security Log +# Configure Windows Firewall logging -To configure Windows Defender Firewall with Advanced Security to log dropped packets or successful connections, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in. +To configure Windows Firewall to log dropped packets or successful connections, you can use: -## To configure the Windows Defender Firewall with Advanced Security log +- Microsoft Intune/MDM +- Group policy with the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in +- PowerShell + +[!INCLUDE [tab-intro](../../../../../includes/configure/tab-intro.md)] + +#### [:::image type="icon" source="../../../images/icons/intune.svg" border="false"::: **Intune/MDM**](#tab/intune) + +### Configure Windows Firewall with Intune + +[!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] + +| Category | Setting name | Value | +|--|--|--| +| | | | + +[!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] + +> [!TIP] +> You can also configure Windows Firewall by using an *TBD* profile in endpoint security. For more information, see [Account protection policy settings for endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security-account-protection-profile-settings). + +Alternatively, you can configure devices using a [custom policy][INT-1] with the [DeviceGuard Policy CSP][CSP-1]. + +| Setting | +|--------| +| **Setting name**: Turn On Virtualization Based Security
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/EnableVirtualizationBasedSecurity`
    **Data type**: int
    **Value**: `1`| +| **Setting name**: Credential Guard Configuration
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/LsaCfgFlags`
    **Data type**: int
    **Value**:
     **Enabled with UEFI lock**: `1`
     **Enabled without lock**: `2`| + +Once the policy is applied, restart the device. + +#### [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) + +### Configure Windows Firewall with group policy + +[!INCLUDE [gpo-settings-1](../../../../../includes/configure/gpo-settings-1.md)] + +| Group policy path | Group policy setting | Value | +| - | - | - | +| **Computer Configuration\Administrative Templates\System\Device Guard** |Turn On Virtualization Based Security | **Enabled** and select one of the options listed under the **Credential Guard Configuration** dropdown:
     - **Enabled with UEFI lock**
     - **Enabled without lock**| + +[!INCLUDE [gpo-settings-2](../../../../../includes/configure/gpo-settings-2.md)] + +Once the policy is applied, restart the device. 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). 2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. @@ -22,11 +64,21 @@ To configure Windows Defender Firewall with Advanced Security to log dropped pac > [!IMPORTANT] > The location you specify must have permissions assigned that permit the Windows Defender Firewall service to write to the log file. - 5. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. - 6. No logging occurs until you set one of following two options: - - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** - - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** - 7. Click **OK** twice +5. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a ize. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. +6. No logging occurs until you set one of following two options: + - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** + - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** +7. Click **OK** twice + +#### [:::image type="icon" source="../../../images/icons/windows-os.svg" border="false"::: **Registry**](#tab/reg) + +### Configure Windows Firewall with PowerShell + +--- + +### Troubleshoot Slow Log Ingestion + +If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. ### Troubleshoot if the log file is not created or modified @@ -73,8 +125,4 @@ $RULE = New-Object System.Security.AccessControl.FileSystemAccessRule ("NT SERVI $ACL.AddAccessRule($RULE) ``` -Restart the device to restart the Windows Defender Firewall Service. - -### Troubleshoot Slow Log Ingestion - -If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. +Restart the device to restart the *Windows Defender Firewall* service. From 6fb803b85cbfc93cb22b9aed5134f8f00950d653 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 11:58:05 -0500 Subject: [PATCH 112/237] fix broken #line7939 link --- .openpublishing.redirection.windows-security.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 2d8efa4060..9615d03df7 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7927,7 +7927,7 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/gathering-the-information-you-need.md", - "redirect_url": "previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731454(v=ws.10)", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731454(v=ws.10)", "redirect_document_id": false }, { From 4a2bcda691fdd64eb08df18a0cc4099587a3b887 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 12:41:23 -0500 Subject: [PATCH 113/237] fix errors --- ...eate-an-inbound-program-or-service-rule.md | 53 ++-- .../create-inbound-rules-to-support-rpc.md | 87 ++---- .../windows-firewall/hyper-v-firewall.md | 4 +- .../isolating-apps-on-your-network.md | 262 +++++++----------- ...to-end-ipsec-connections-by-using-ikev2.md | 12 +- ...-administration-with-windows-powershell.md | 6 +- .../wdsc-firewall-network-protection.md | 2 +- windows/security/threat-protection/index.md | 2 +- 8 files changed, 158 insertions(+), 270 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md index f1756dac1d..2ddcf5a508 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md @@ -7,41 +7,30 @@ ms.date: 09/07/2021 # Create an Inbound Program or Service Rule - To allow inbound network traffic to a specified program or service, use the Windows Defender Firewall with Advanced Securitynode in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port. ->**Note:**  This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](create-an-inbound-port-rule.md) procedure in addition to the steps in this procedure. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. +> [!NOTE] +> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](create-an-inbound-port-rule.md) procedure in addition to the steps in this procedure. To create an inbound firewall rule for a program or service -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Inbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +2. In the navigation pane, click **Inbound Rules** +3. Click **Action**, and then click **New rule** +4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** >**Note:**  Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -5. On the **Program** page, click **This program path**. +5. On the **Program** page, click **This program path** +6. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. +7. Do one of the following: -6. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. + - If the executable file contains a single program, click **Next**. + - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**. + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next**. -7. Do one of the following: - - - If the executable file contains a single program, click **Next**. - - - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**. - - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next**. - - **Important**   - To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: + > [!IMPORTANT] + > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: **sc** **qsidtype** *<ServiceName>* @@ -53,12 +42,8 @@ To create an inbound firewall rule for a program or service In the preceding command, the value of *<Type>* can be **UNRESTRICTED** or **RESTRICTED**. Although the command also permits the value of **NONE**, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as **UNRESTRICTED**. If you change the SID type to **RESTRICTED**, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to **UNRESTRICTED**. -8. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](create-an-inbound-port-rule.md). After you have configured the protocol and port options, click **Next**. - -9. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -10. On the **Action** page, select **Allow the connection**, and then click **Next**. - -11. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. - -12. On the **Name** page, type a name and description for your rule, and then click **Finish**. +8. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](create-an-inbound-port-rule.md). After you have configured the protocol and port options, click **Next** +9. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** +10. On the **Action** page, select **Allow the connection**, and then click **Next** +11. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** +12. On the **Name** page, type a name and description for your rule, and then click **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md b/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md index 70034fc36b..4376871759 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md @@ -7,76 +7,45 @@ ms.date: 09/07/2021 # Create Inbound Rules to Support RPC - To allow inbound remote procedure call (RPC) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically assigned port number. Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - This topic describes how to create rules that allow inbound RPC network traffic. For other inbound port rule types, see: -- [Create an Inbound Port Rule](create-an-inbound-port-rule.md) - -- [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) +- [Create an Inbound Port Rule](create-an-inbound-port-rule.md) +- [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) In this topic: -- [To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service](#to-create-a-rule-to-allow-inbound-network-traffic-to-the-rpc-endpoint-mapper-service) - -- [To create a rule to allow inbound network traffic to RPC-enabled network services](#to-create-a-rule-to-allow-inbound-network-traffic-to-rpc-enabled-network-services) +- [To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service](#to-create-a-rule-to-allow-inbound-network-traffic-to-the-rpc-endpoint-mapper-service) +- [To create a rule to allow inbound network traffic to RPC-enabled network services](#to-create-a-rule-to-allow-inbound-network-traffic-to-rpc-enabled-network-services) ## To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Inbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. - -5. On the **Program** page, click **This Program Path**, and then type **%systemroot%\\system32\\svchost.exe**. - -6. Click **Customize**. - -7. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next**. - -8. On the warning about Windows service-hardening rules, click **Yes**. - -9. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. - -10. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next**. - -11. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -12. On the **Action** page, select **Allow the connection**, and then click **Next**. - -13. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**.   - -14. On the **Name** page, type a name and description for your rule, and then click **Finish**. - +1. In the navigation pane, click **Inbound Rules**. +1. Click **Action**, and then click **New rule**. +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. On the **Program** page, click **This Program Path**, and then type **%systemroot%\\system32\\svchost.exe**. +1. Click **Customize**. +1. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next**. +1. On the warning about Windows service-hardening rules, click **Yes**. +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. +1. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. +1. On the **Action** page, select **Allow the connection**, and then click **Next**. +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. +1. On the **Name** page, type a name and description for your rule, and then click **Finish**. ## To create a rule to allow inbound network traffic to RPC-enabled network services -1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule**. - -2. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. - -3. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize**. - -4. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box. - -5. Click **OK**, and then click **Next**. - -6. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. - -7. For **Local port**, select **RPC Dynamic Ports**, and then click **Next**. - -8. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -9. On the **Action** page, select **Allow the connection**, and then click **Next**. - -10. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. - -11. On the **Name** page, type a name and description for your rule, and then click **Finish**. +1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule**. +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize**. +1. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box. +1. Click **OK**, and then click **Next**. +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. +1. For **Local port**, select **RPC Dynamic Ports**, and then click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. +1. On the **Action** page, select **Allow the connection**, and then click **Next**. +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. +1. On the **Name** page, type a name and description for your rule, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index d94d736b75..f400ceda50 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -55,8 +55,8 @@ The output contains the following values: |--|--| | `Enabled` (True/False) | True if Hyper-V Firewall is enabled for WSL VMs. | | `DefaultInboundAction`, `DefaultOutboundAction` | These are default rule policies applied to packets entering or leaving the WSL container. The rule policies can be modified, as described in this article. | -| `LoopbackEnabled` | Tracks if loopback traffic between the host and the container is allowed, without requiring any Hyper-V Firewall rules. WSL enables it by default, to allow the Windows Host to talk to WSL, and WSL to talk to the Windows Host. | -| `AllowHostPolicyMerge` | Determines how Windows Host Firewall Enterprise Settings (GPO), Hyper-V Firewall Enterprise Settings (CSP), Windows Host Firewall Enterprise Settings (CSP), local Hyper-V Firewall settings, and local Host Firewall settings interact.
    This setting is detailed with the [Set-NetFirewallHyperVVMSetting][PS-2] cmdlet. | +| `LoopbackEnabled` | Tracks if loopback traffic between the host and the container is allowed, without requiring any Hyper-V Firewall rules. WSL enables it by default, to allow the Windows Host to talk to WSL, and WSL to talk to the Windows Host.| +| `AllowHostPolicyMerge` | Determines how Windows Host Firewall Enterprise Settings (GPO), Hyper-V Firewall Enterprise Settings (CSP), Windows Host Firewall Enterprise Settings (CSP), local Hyper-V Firewall settings, and local Host Firewall settings interact.
    This setting is detailed with the [Set-NetFirewallHyperVVMSetting][PS-2] cmdlet.| ### Configure Hyper-V firewall settings diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md index f54a928691..f978413fdb 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md @@ -7,7 +7,6 @@ ms.date: 09/08/2021 # Isolating Microsoft Store Apps on Your Network - When you add new devices to your network, you may want to customize your Windows Defender Firewall with Advanced Security configuration to isolate the network access of the new Microsoft Store apps that run on them. Developers who build Microsoft Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. For example, a developer can decide that their app should only connect to trusted local networks (such as at home or work), and not to the Internet. In this way, developers can define the scope of network access for their app. This network isolation prevents an app from accessing a network and a connection type (inbound or outbound) if the connection has not been configured for the app. Then the network administrator can customize the firewall to further restrict the resources that the app can access. @@ -16,60 +15,51 @@ The ability to set and enforce these network boundaries ensures that apps that g When creating new Microsoft Store apps, a developer can define the following network capabilities for their app: -- **Home\\Work Networking** +## Home\Work Networking - Provides inbound and outbound access to intranet networks that the user has designated as a home or a work network, or if the network has an authenticated domain controller. +Provides inbound and outbound access to intranet networks that the user has designated as a home or a work network, or if the network has an authenticated domain controller. -- **Internet (Client)** +## Internet (Client) - Provides outbound access to the Internet and untrusted networks, such as airports and coffee shops (for example, intranet networks where the user has designated the network as Public). Most apps that require Internet access should use this capability. +Provides outbound access to the Internet and untrusted networks, such as airports and coffee shops (for example, intranet networks where the user has designated the network as Public). Most apps that require Internet access should use this capability. -- **Internet (Client and Server)** +## Internet (Client and Server) - Provides inbound and outbound access to the Internet and untrusted networks, such as airports and coffee shops. This capability is a superset of the **Internet (Client)** capability, and **Internet (Client)** does not need to be enabled if this capability is enabled. +Provides inbound and outbound access to the Internet and untrusted networks, such as airports and coffee shops. This capability is a superset of the **Internet (Client)** capability, and **Internet (Client)** does not need to be enabled if this capability is enabled. -- **Proximity** +## Proximity - Provides near-field communication (NFC) with devices that are in close proximity to the device. Proximity may be used to send files or connect with an application on a proximate device. +Provides near-field communication (NFC) with devices that are in close proximity to the device. Proximity may be used to send files or connect with an application on a proximate device. -**In this topic** +## In this topic To isolate Microsoft Store apps on your network, you need to use Group Policy to define your network isolation settings and create custom Microsoft Store app firewall rules. -- [Prerequisites](#prerequisites) - -- [Step 1: Define your network](#step-1-define-your-network) - -- [Step 2: Create custom firewall rules](#step-2-create-custom-firewall-rules) +- [Prerequisites](#prerequisites) +- [Step 1: Define your network](#step-1-define-your-network) +- [Step 2: Create custom firewall rules](#step-2-create-custom-firewall-rules) ## Prerequisites -- A domain controller is installed on your network, and your devices are joined to the Windows domain. +- A domain controller is installed on your network, and your devices are joined to the Windows domain. +- Your Microsoft Store app is installed on the client device. +- The Remote Server Administration Tools (RSAT) are installed on your client device. When you perform the following steps from your client device, you can select your Microsoft Store app when you create Windows Defender Firewall rules. -- Your Microsoft Store app is installed on the client device. +> [!NOTE] +> Information the user should notice even if skimmingYou can install the RSAT on your device running Windows from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). -- The Remote Server Administration Tools (RSAT) are installed on your client device. When you perform the following steps from your client device, you can select your Microsoft Store app when you create Windows Defender Firewall rules. - - >**Note:**  You can install the RSAT on your device running Windows from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). - -   ## Step 1: Define your network -The **Home\\Work Networking** capability enables access to intranet resources. Administrators can use Group Policy settings to define the scope of the intranet. This ensures that Microsoft Store apps can access intranet resources appropriately. +The **Home\Work Networking** capability enables access to intranet resources. Administrators can use Group Policy settings to define the scope of the intranet. This ensures that Microsoft Store apps can access intranet resources appropriately. A network endpoint is considered part of the **Home\\Work Network** if: -- It is part of the local subnet of a trusted network. - +- It is part of the local subnet of a trusted network. For example, home users generally flag their network as Trusted. Local devices will be designated as such. - -- A device is on a network, and it is authenticated to a domain controller. - - - Endpoints within the intranet address space are considered private. - - - Endpoints within the local subnet are considered private. - -- The device is configured for DirectAccess, and the endpoint is part of the intranet address space. +- A device is on a network, and it is authenticated to a domain controller. + - Endpoints within the intranet address space are considered private. + - Endpoints within the local subnet are considered private. +- The device is configured for DirectAccess, and the endpoint is part of the intranet address space. The intranet address space is composed of configured Active Directory sites and subnets, and it is configured for Windows network isolation specifically by using Group Policy. You can disable the usage of Active Directory sites and subnets by using Group Policy by declaring that your subnet definitions are authoritative. @@ -77,29 +67,22 @@ Any proxies that you configure or that are automatically configured with proxy a All other endpoints that do not meet the previously stated criteria are considered endpoints on the Internet. -**To configure a GPO that defines your intranet address space** - -1. Open the Group Policy Management snap-in (gpmc.msc), right click on the Group Policy you want to use to define your address space, and select **Edit**. - -2. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**. - -3. In the right pane, double-click **Private network ranges for apps**. - -4. In the **Private network ranges for apps** dialog box, click **Enabled**. In the **Private subnets** text box, type the private subnets for your intranet, separated by commas if necessary. +### To configure a GPO that defines your intranet address space +1. Open the Group Policy Management snap-in (gpmc.msc), right click on the Group Policy you want to use to define your address space, and select **Edit**. +1. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**. +1. In the right pane, double-click **Private network ranges for apps**. +1. In the **Private network ranges for apps** dialog box, click **Enabled**. In the **Private subnets** text box, type the private subnets for your intranet, separated by commas if necessary. For example, if the Contoso intranet is defined as 10.0.0.0 with a subnet mask of 255.255.255.0, you would type 10.0.0.0/24 in the **Private subnets** text box. - -5. Double-click **Subnet definitions are authoritative**. +1. Double-click **Subnet definitions are authoritative**. If you want the subnet definitions that you previously created to be the single source for your subnet definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional subnets by using local settings or network isolation heuristics. -**To configure the proxy addresses for the intranet and Internet** +### To configure the proxy addresses for the intranet and Internet -1. Double-click **Internet proxy servers for apps**. Click **Enabled**, and then in the **Domain Proxies** text box, type the IP addresses of your Internet proxy servers, separated by semicolons. - -2. Double-click **Intranet proxy servers for apps**. Click **Enabled**, and then in the IP address text box, type the IP addresses of your intranet proxy servers, separated by semicolons. - -3. Double-click **Proxy definitions are authoritative**. +1. Double-click **Internet proxy servers for apps**. Click **Enabled**, and then in the **Domain Proxies** text box, type the IP addresses of your Internet proxy servers, separated by semicolons. +2. Double-click **Intranet proxy servers for apps**. Click **Enabled**, and then in the IP address text box, type the IP addresses of your intranet proxy servers, separated by semicolons. +3. Double-click **Proxy definitions are authoritative**. If you want the proxy definitions that you previously created to be the single source for your proxy definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional proxies by using local settings or network isolation heuristics. @@ -112,132 +95,89 @@ The following table provides a complete list of the possible app capabilities. | Capability | Name | Description | | - | - | - | | **Internet (Client)** | internetClient | Your outgoing Internet connection.| -| **Internet (Client & Server)** | internetClientServer| Your Internet connection, including incoming unsolicited connections from the Internet The app can send information to or from your device through a firewall. You do not need to declare **internetClient** if this capability is declared. -| **Home\Work Networking** |privateNetworkClientServer| A home or work network. The app can send information to or from your device and other devices on the same network.| -| **Document Library Access**| documentsLibrary| Your Documents library, including the capability to add, change, or delete files. The package can only access file types that are declared in the manifest.| -| **Picture Library Access**| picturesLibrary| Your Pictures library, including the capability to add, change, or delete files.| -| **Video Library Access**| videosLibrary| Your Videos library, including the capability to add, change, or delete files.| -| **Music Library Access**| musicLibrary|Your Music library, including the capability to add, change, or delete files.| -| **Default Windows Credentials**| defaultWindowsCredentials| Your Windows credentials for access to a corporate intranet. This application can impersonate you on the network.| -| **Removable Storage** | removableStorage| A removable storage device, such as an external hard disk, USB flash drive, or MTP portable device, including the capability to add, change, or delete specific files. This package can only access file types that are declared in the manifest.| -| **Shared User Certificates**| sharedUserCertificates| Software and hardware certificates or a smart card, which the app uses to identify you. This capability can be used by an employer, a bank, or government services to identify you.| -| **Location**| location| Provides access to the user's current location.| -| **Microphone** | microphone| Provides access to the microphone's audio feed.| -| **Near-field Proximity** | proximity| Required for near-field communication (NFC) between devices in close proximity. NFC can be used to send files or connect with an app on a proximate device.| -| **Text Messaging** | sms| Provides access to text messaging functionality.| -| **Webcam** | webcam| Provides access to the webcam's video feed.| -| **Other devices (represented by GUIDs)** | <GUID>| Includes specialized devices and Windows Portable Devices.| +| **Internet (Client & Server)** | internetClientServer| Your Internet connection, including incoming unsolicited connections from the Internet The app can send information to or from your device through a firewall. You do not need to declare **internetClient** if this capability is declared.| +| **Home\Work Networking** |privateNetworkClientServer| A home or work network. The app can send information to or from your device and other devices on the same network.| +| **Document Library Access**| documentsLibrary| Your Documents library, including the capability to add, change, or delete files. The package can only access file types that are declared in the manifest.| +| **Picture Library Access**| picturesLibrary| Your Pictures library, including the capability to add, change, or delete files.| +| **Video Library Access**| videosLibrary| Your Videos library, including the capability to add, change, or delete files.| +| **Music Library Access**| musicLibrary|Your Music library, including the capability to add, change, or delete files.| +| **Default Windows Credentials**| defaultWindowsCredentials| Your Windows credentials for access to a corporate intranet. This application can impersonate you on the network.| +| **Removable Storage** | removableStorage| A removable storage device, such as an external hard disk, USB flash drive, or MTP portable device, including the capability to add, change, or delete specific files. This package can only access file types that are declared in the manifest.| +| **Shared User Certificates**| sharedUserCertificates| Software and hardware certificates or a smart card, which the app uses to identify you. This capability can be used by an employer, a bank, or government services to identify you.| +| **Location**| location| Provides access to the user's current location.| +| **Microphone** | microphone| Provides access to the microphone's audio feed.| +| **Near-field Proximity** | proximity| Required for near-field communication (NFC) between devices in close proximity. NFC can be used to send files or connect with an app on a proximate device.| +| **Text Messaging** | sms| Provides access to text messaging functionality.| +| **Webcam** | webcam| Provides access to the webcam's video feed.| +| **Other devices (represented by GUIDs)** | <GUID>| Includes specialized devices and Windows Portable Devices.| You can create a Windows Defender Firewall policy that is scoped to a set of apps that use a specified capability or scoped to a specific Microsoft Store app. For example, you could create a Windows Defender Firewall policy to block Internet access for any apps on your network that have the Documents Library capability. -**To block Internet access for any apps on your network that have the Documents Library capability** +### To block Internet access for any apps on your network that have the Documents Library capability -1. Open the Group Policy Management snap-in (gpmc.msc). - -2. In the left pane, right-click your domain name and click **Create a GPO in this domain, and link it here**. - -3. Type a name for the GPO in the **Name** text box, and then click **OK**. - -4. Right-click the new GPO, and then click **Edit**. - -5. In the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall with Advanced Security**, and click **Windows Defender Firewall – LDAP://…** - -6. Right-click **Outbound Rules**, and then click **New Rule**. - -7. Click **Custom**, and then click **Next**. - -8. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. - -9. On the **Action** page, ensure that **Block the Connection** is selected, and then click **Next**. - -10. On the **Profile** page, click **Next**. - -11. On the **Name** page, type a name for your rule, and then click **Finish**. - -12. In the right pane, right-click your new rule and click **Properties**. - -13. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. - -14. Click **Application Package Properties**, and then click **OK**. - -15. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\Your documents library**, and then click **OK**. - -16. Click the **Scope** tab under **Remote IP addresses**, and then click **Add**. - -17. Click **Predefined set of computers**, select **Internet**, and click **OK**. +1. Open the Group Policy Management snap-in (gpmc.msc). +1. In the left pane, right-click your domain name and click **Create a GPO in this domain, and link it here**. +1. Type a name for the GPO in the **Name** text box, and then click **OK**. +1. Right-click the new GPO, and then click **Edit**. +1. In the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall with Advanced Security**, and click **Windows Defender Firewall - LDAP://…** +1. Right-click **Outbound Rules**, and then click **New Rule**. +1. Click **Custom**, and then click **Next**. +1. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. +1. On the **Action** page, ensure that **Block the Connection** is selected, and then click **Next**. +1. On the **Profile** page, click **Next**. +1. On the **Name** page, type a name for your rule, and then click **Finish**. +1. In the right pane, right-click your new rule and click **Properties**. +1. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. +1. Click **Application Package Properties**, and then click **OK**. +1. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\Your documents library**, and then click **OK**. +1. Click the **Scope** tab under **Remote IP addresses**, and then click **Add**. +1. Click **Predefined set of computers**, select **Internet**, and click **OK**. This scopes the rule to block traffic to Internet devices. -18. Click the **Programs and Services** tab, and in the **Application Packages** area, click **Settings**. +1. Click the **Programs and Services** tab, and in the **Application Packages** area, click **Settings**. +1. Click **Apply to application packages only**, and then click **OK**. -19. Click **Apply to application packages only**, and then click **OK**. + > [!IMPORTANT] + > You must do this to ensure that the rule applies only to Microsoft Store apps and not to other apps. Desktop apps declare all capabilities by default, and this rule would apply to them if you do not configure it this way. - >**Important:**  You must do this to ensure that the rule applies only to Microsoft Store apps and not to other apps. Desktop apps declare all capabilities by default, and this rule would apply to them if you do not configure it this way. - -20. Click **OK** to close the **Properties** dialog box. - -21. Close the Group Policy Management Editor. - -22. In the Group Policy Management snap-in, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**. Click **Remove**, and then click **OK**. - -23. Under **Security Filtering**, click **Add**. - -24. Type **domain computers** in the text box, and then click **OK**. - -25. Close the Group Policy Management snap-in. +1. Click **OK** to close the **Properties** dialog box. +1. Close the Group Policy Management Editor. +1. In the Group Policy Management snap-in, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**. Click **Remove**, and then click **OK**. +1. Under **Security Filtering**, click **Add**. +1. Type **domain computers** in the text box, and then click **OK**. +1. Close the Group Policy Management snap-in. Use the following procedure if you want to block intranet access for a specific media sharing app on your network. -**To block intranet access for a specific media sharing app on your network** +### To block intranet access for a specific media sharing app on your network -1. Open the Group Policy Management snap-in (gpmc.msc). - -2. In the left pane, right-click your domain name, and then click **Create a GPO in this domain, and link it here**. - -3. Type a name for your GPO in the **Name** text box, and then click **OK**. - -4. Right-click your new GPO, and then click **Edit**. - -5. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall**, and then click **Windows Defender Firewall – LDAP://**… - -6. Right-click **Outbound Rules**, and then click **New Rule**. - -7. Click **Custom**, and then click **Next**. - -8. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. - -9. On the **Action** page, ensure **Block the Connection** is selected, and then click **Next**. - -10. On the **Profile** page, click **Next**. - -11. On the **Name** page, type a name for your rule, and then click **Finish**. - -12. In the right pane, right-click your new rule, and then click **Properties**. - -13. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. - -14. Click **Application Package Properties**, and then click **OK**. - -15. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\A home or work network**, and then click **OK**. - -16. Click the **Programs and Services** tab under **Application Packages**, and then click **Settings**. - -17. Click **Apply to this application package**, select the app in the text box, and then click **OK**. - -18. Click **OK** to close the **Properties** dialog box. - -19. Close the Group Policy Management Editor. - -20. In Group Policy Management, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**, click **Remove**, and then click **OK**. - -21. Under **Security Filtering**, click **Add**. - -22. Type **domain computers** in the text box and click **OK**. - -23. Close Group Policy Management. +1. Open the Group Policy Management snap-in (gpmc.msc). +1. In the left pane, right-click your domain name, and then click **Create a GPO in this domain, and link it here**. +1. Type a name for your GPO in the **Name** text box, and then click **OK**. +1. Right-click your new GPO, and then click **Edit**. +1. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall**, and then click **Windows Defender Firewall – LDAP://**… +1. Right-click **Outbound Rules**, and then click **New Rule**. +1. Click **Custom**, and then click **Next**. +1. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. +1. On the **Action** page, ensure **Block the Connection** is selected, and then click **Next**. +1. On the **Profile** page, click **Next**. +1. On the **Name** page, type a name for your rule, and then click **Finish**. +1. In the right pane, right-click your new rule, and then click **Properties**. +1. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. +1. Click **Application Package Properties**, and then click **OK**. +1. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\A home or work network**, and then click **OK**. +1. Click the **Programs and Services** tab under **Application Packages**, and then click **Settings**. +1. Click **Apply to this application package**, select the app in the text box, and then click **OK**. +1. Click **OK** to close the **Properties** dialog box. +1. Close the Group Policy Management Editor. +1. In Group Policy Management, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**, click **Remove**, and then click **OK**. +1. Under **Security Filtering**, click **Add**. +1. Type **domain computers** in the text box and click **OK**. +1. Close Group Policy Management. ## See also -- [Windows Defender Firewall with Advanced Security Overview](windows-firewall-with-advanced-security.md) +- [Windows Defender Firewall with Advanced Security Overview](index.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 1f6507af36..7a662068f1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -146,17 +146,11 @@ Follow these procedures to verify and troubleshoot your IKEv2 IPsec connections: **Use netsh to capture IPsec events.** 1. Open an elevated command prompt. - 2. At the command prompt, type **netsh wfp capture start**. - 3. Reproduce the error event so that it can be captured. - 4. At the command prompt, type **netsh wfp capture stop**. - A wfpdiag.cab file is created in the current folder. - 5. Open the cab file, and then extract the wfpdiag.xml file. - 6. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last "errorFrequencyTable" at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: ```xml @@ -165,13 +159,11 @@ Follow these procedures to verify and troubleshoot your IKEv2 IPsec connections: 32     ``` + In this example, there are 32 instances of the **ERROR\_IPSEC\_IKE\_NO\_CERT** error. So now you can search for **ERROR\_IPSEC\_IKE\_NO\_CERT** to get more details regarding this error. You might not find the exact answer for the issue, but you can find good hints. For example, you might find that there seems to be an issue with the certificates, so you can look at your certificates and the related cmdlets for possible issues. ## See also -- [Windows Defender Firewall with Advanced Security](windows-firewall-with-advanced-security.md) - - - +- [Windows Defender Firewall with Advanced Security](index.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 10546a8315..f52507b076 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -4,14 +4,16 @@ description: Windows Defender Firewall with Advanced Security Administration wit ms.topic: conceptual ms.date: 09/08/2021 --- -# Windows Defender Firewall with Advanced Security Administration with + +# Windows Defender Firewall with Advanced Security Administration with PowerShell + The Windows Defender Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Defender Firewall management. It's designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Defender Firewall management in Windows. You can use Windows PowerShell to manage your firewall and IPsec deployments. This object-oriented scripting environment will make it easier for you to manage policies and monitor network conditions than was possible in netsh. Windows PowerShell allows network settings to be self-discoverable through the syntax and parameters in each of the cmdlets. This guide demonstrates how common tasks were performed in netsh and how you can use Windows PowerShell to accomplish them. In future versions of Windows, Microsoft might remove the netsh functionality for Windows Defender Firewall. Microsoft recommends that you transition to Windows PowerShell if you currently use netsh to configure and manage Windows Defender Firewall. Windows PowerShell and netsh command references are at the following locations. - [Netsh Commands for Windows Defender Firewall](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771920(v=ws.10)) ## Scope -This guide doesn't teach you the fundamentals of Windows Defender Firewall, which can be found in [Windows Defender Firewall](windows-firewall-with-advanced-security.md). It doesn't teach the fundamentals of Windows PowerShell, and it assumes that you're familiar with the Windows PowerShell language and the basic concepts of Windows PowerShell. For more info about Windows PowerShell concepts and usage, see the reference topics in the [Additional resources](#other-resources) section of this guide. +This guide doesn't teach you the fundamentals of Windows Defender Firewall, which can be found in [Windows Firewall](index.md). It doesn't teach the fundamentals of Windows PowerShell, and it assumes that you're familiar with the Windows PowerShell language and the basic concepts of Windows PowerShell. For more info about Windows PowerShell concepts and usage, see the reference topics in the [Additional resources](#other-resources) section of this guide. ## Audience and user requirements This guide is intended for IT pros, system administrators, and IT managers, and it assumes that you're familiar with Windows Defender Firewall, the Windows PowerShell language, and the basic concepts of Windows PowerShell. ## In this topic diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md index 713b98447c..310a26dc87 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -7,7 +7,7 @@ ms.topic: article # Firewall and network protection -The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](../../network-security/windows-firewall/windows-firewall-with-advanced-security.md). +The **Firewall & network protection** section contains information about the firewalls and network connections used by the machine, including the status of Windows Defender Firewall and any other third-party firewalls. IT administrators and IT pros can get configuration guidance from the [Windows Defender Firewall with Advanced Security documentation library](../../network-security/windows-firewall/index.md). This section can be hidden from users of the machine. This information is useful if you don't want employees in your organization to see or have access to user-configured options for the features shown in the section. diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index ffc754aaf6..aafae23e17 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -26,7 +26,7 @@ See the following articles to learn more about the different areas of Windows th - [Network Protection](/microsoft-365/security/defender-endpoint/network-protection) - [Virtualization-Based Protection of Code Integrity](../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) - [Web Protection](/microsoft-365/security/defender-endpoint/web-protection-overview) -- [Windows Firewall](../operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md) +- [Windows Firewall](../operating-system-security/network-security/windows-firewall/index.md) - [Windows Sandbox](../application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md) ## Next-generation protection From 93de6cb533f1a503ad35c0df0df39f0688731099 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 15:20:17 -0500 Subject: [PATCH 114/237] merge rules docs --- windows/security/index.yml | 2 +- .../windows-firewall/configure-rules.md | 183 ++++++++++++++++++ .../create-an-inbound-icmp-rule.md | 55 ------ .../create-an-inbound-port-rule.md | 47 ----- ...eate-an-inbound-program-or-service-rule.md | 49 ----- .../create-an-outbound-port-rule.md | 33 ---- ...ate-an-outbound-program-or-service-rule.md | 34 ---- .../create-inbound-rules-to-support-rpc.md | 51 ----- .../network-security/windows-firewall/toc.yml | 20 +- 9 files changed, 188 insertions(+), 286 deletions(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md diff --git a/windows/security/index.yml b/windows/security/index.yml index 7433169832..069ecf8fb7 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -63,7 +63,7 @@ productDirectory: - url: /windows/security/operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines text: Windows security baselines - url: /windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/ - text: MMicrosoft Defender SmartScreen + text: Microsoft Defender SmartScreen - url: /windows/security/operating-system-security text: Learn more about OS security > diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md new file mode 100644 index 0000000000..0b320334ef --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md @@ -0,0 +1,183 @@ +--- +title: Configure Firewall rules +description: Learn how to configure Windows Firewall rules with the CSP and group policy. +ms.topic: conceptual +ms.date: 09/07/2021 +--- + +## Create an inbound ICMP rule + +To allow inbound Internet Control Message Protocol (ICMP) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows ICMP requests and responses to be sent and received by computers on the network. + +To create an inbound ICMP rule + +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. In the navigation pane, click **Inbound Rules**. +1. Click **Action**, and then click **New rule**. +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. On the **Program** page, click **All programs**, and then click **Next**. +1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each. +1. Click **Customize**. +1. In the **Customize ICMP Settings** dialog box, do one of the following: + - To allow all ICMP network traffic, click **All ICMP types**, and then click **OK**. + - To select one of the predefined ICMP types, click **Specific ICMP types**, and then select each type in the list that you want to allow. Click **OK**. + - To select an ICMP type that does not appear in the list, click **Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, click **Add**, and then select the newly created entry from the list. Click **OK** +1. Click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. +1. On the **Action** page, select **Allow the connection**, and then click **Next**. +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. +1. On the **Name** page, type a name and description for your rule, and then click **Finish**. + +## Create an inbound port rule + +To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. + +To create an inbound port rule + +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. In the navigation pane, click **Inbound Rules**. +1. Click **Action**, and then click **New rule**. +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. + > [!Note] + > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. +1. On the **Program** page, click **All programs**, and then click **Next**. + > [!Note] + > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. +1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number. + If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.\ + To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.\ + When you have configured the protocols and ports, click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. +1. On the **Action** page, select **Allow the connection**, and then click **Next**. +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. + > [!Note] + > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. +1. On the **Name** page, type a name and description for your rule, and then click **Finish**. + + +## Create an outbound port rule + +By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the *Windows Defender Firewall with Advanced Security* node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. + +> [!NOTE] +> To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. + +To create an outbound port rule + +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. In the navigation pane, select **Outbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** + + > [!NOTE] + > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. + +1. On the **Program** page, select **All programs**, and then select **Next** +1. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number + + If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next**, + +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Block the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** + +## Create an inbound program or service rule + +To allow inbound network traffic to a specified program or service, use the Windows Defender Firewall with Advanced Securitynode in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port. + +> [!NOTE] +> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](create-an-inbound-port-rule.md) procedure in addition to the steps in this procedure. + +To create an inbound firewall rule for a program or service + +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. In the navigation pane, click **Inbound Rules** +1. Click **Action**, and then click **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** + > [!NOTE] + > Information the user should notice even if skimmingAlthough you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. +1. On the **Program** page, click **This program path** +1. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. +1. Do one of the following: + - If the executable file contains a single program, click **Next**. + - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**. + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next**. + + > [!IMPORTANT] + > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: `sc qsidtype ` + > + > If the result is `NONE`, then a firewall rule cannot be applied to that service. + + To set a SID type on a service, run the following command: `sc sidtype ` + + In the preceding command, the value of `` can be `UNRESTRICTED` or `RESTRICTED`. Although the command also permits the value of `NONE`, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as `UNRESTRICTED`. If you change the SID type to `RESTRICTED`, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to `UNRESTRICTED`. + +1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](create-an-inbound-port-rule.md). After you have configured the protocol and port options, click **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** +1. On the **Action** page, select **Allow the connection**, and then click **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** +1. On the **Name** page, type a name and description for your rule, and then click **Finish** + +## Create an outbound program or service rule + +By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port. + +To create an outbound firewall rule for a program or service + +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. In the navigation pane, select **Outbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** + + > [!NOTE] + > Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. + +1. On the **Program** page, select **This program path** +1. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly +1. Do one of the following: + + - If the executable file contains a single program, select **Next** + - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** + +1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](create-an-outbound-port-rule.md). When you have configured the protocol and port options, select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Block the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** + +## Create inbound rules to support RPC + +To allow inbound remote procedure call (RPC) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically assigned port number. Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. + +### RPC Endpoint Mapper service + +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. In the navigation pane, click **Inbound Rules**. +1. Click **Action**, and then click **New rule**. +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. On the **Program** page, click **This Program Path**, and then type **%systemroot%\\system32\\svchost.exe**. +1. Click **Customize**. +1. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next**. +1. On the warning about Windows service-hardening rules, click **Yes**. +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. +1. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. +1. On the **Action** page, select **Allow the connection**, and then click **Next**. +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. +1. On the **Name** page, type a name and description for your rule, and then click **Finish**. + +### RPC-enabled network services + +1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule**. +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize**. +1. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box. +1. Click **OK**, and then click **Next**. +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. +1. For **Local port**, select **RPC Dynamic Ports**, and then click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. +1. On the **Action** page, select **Allow the connection**, and then click **Next**. +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. +1. On the **Name** page, type a name and description for your rule, and then click **Finish**. \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md deleted file mode 100644 index 034f6558c6..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: Create an Inbound ICMP Rule -description: Learn how to allow inbound ICMP traffic by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Inbound ICMP Rule - - -To allow inbound Internet Control Message Protocol (ICMP) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows ICMP requests and responses to be sent and received by computers on the network. - -**Administrative credentials** - -To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -This topic describes how to create a port rule that allows inbound ICMP network traffic. For other inbound port rule types, see: - -- [Create an Inbound Port Rule](create-an-inbound-port-rule.md) - -- [Create Inbound Rules to Support RPC](create-inbound-rules-to-support-rpc.md) - -To create an inbound ICMP rule - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Inbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. - -5. On the **Program** page, click **All programs**, and then click **Next**. - -6. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each. - -7. Click **Customize**. - -8. In the **Customize ICMP Settings** dialog box, do one of the following: - - - To allow all ICMP network traffic, click **All ICMP types**, and then click **OK**. - - - To select one of the predefined ICMP types, click **Specific ICMP types**, and then select each type in the list that you want to allow. Click **OK**. - - - To select an ICMP type that does not appear in the list, click **Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, click **Add**, and then select the newly created entry from the list. Click **OK** - -9. Click **Next**. - -10. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -11. On the **Action** page, select **Allow the connection**, and then click **Next**. - -12. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. - -13. On the **Name** page, type a name and description for your rule, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md deleted file mode 100644 index 5dc828a180..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Create an Inbound Port Rule -description: Learn to allow traffic on specific ports by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Inbound Port Rule - -To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. - -To create an inbound port rule - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). - -2. In the navigation pane, click **Inbound Rules**. - -3. Click **Action**, and then click **New rule**. - -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. - - > [!Note] - > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - -5. On the **Program** page, click **All programs**, and then click **Next**. - - > [!Note] - > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. - -6. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number. - - If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall. - - To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. - - When you have configured the protocols and ports, click **Next**. - -7. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. - -8. On the **Action** page, select **Allow the connection**, and then click **Next**. - -9. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. - - > [!Note] - > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. - -10. On the **Name** page, type a name and description for your rule, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md deleted file mode 100644 index 2ddcf5a508..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Create an Inbound Program or Service Rule -description: Learn how to allow inbound traffic to a program or service by using the Group Policy Management MMC snap-in to create firewall rules. -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Inbound Program or Service Rule - -To allow inbound network traffic to a specified program or service, use the Windows Defender Firewall with Advanced Securitynode in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port. - -> [!NOTE] -> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](create-an-inbound-port-rule.md) procedure in addition to the steps in this procedure. - -To create an inbound firewall rule for a program or service - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -2. In the navigation pane, click **Inbound Rules** -3. Click **Action**, and then click **New rule** -4. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** - - >**Note:**  Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - -5. On the **Program** page, click **This program path** -6. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. -7. Do one of the following: - - - If the executable file contains a single program, click **Next**. - - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**. - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next**. - - > [!IMPORTANT] - > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: - - **sc** **qsidtype** *<ServiceName>* - - If the result is **NONE**, then a firewall rule cannot be applied to that service. - - To set a SID type on a service, run the following command: - - **sc** **sidtype** *<ServiceName> <Type>* - - In the preceding command, the value of *<Type>* can be **UNRESTRICTED** or **RESTRICTED**. Although the command also permits the value of **NONE**, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as **UNRESTRICTED**. If you change the SID type to **RESTRICTED**, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to **UNRESTRICTED**. - -8. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](create-an-inbound-port-rule.md). After you have configured the protocol and port options, click **Next** -9. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** -10. On the **Action** page, select **Allow the connection**, and then click **Next** -11. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** -12. On the **Name** page, type a name and description for your rule, and then click **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md deleted file mode 100644 index cd82bee946..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Create an Outbound Port Rule -description: Learn to block outbound traffic on a port by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create an Outbound Port Rule with group policy - -By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the *Windows Defender Firewall with Advanced Security* node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. - -> [!NOTE] -> To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To create an outbound port rule - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -1. In the navigation pane, select **Outbound Rules** -1. Select **Action**, and then select **New rule** -1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** - - > [!NOTE] - > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - -1. On the **Program** page, select **All programs**, and then select **Next** -1. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number - - If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next**, - -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** -1. On the **Action** page, select **Block the connection**, and then select **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** -1. On the **Name** page, type a name and description for your rule, and then select **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md b/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md deleted file mode 100644 index 3f6c111b22..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -title: Create an Outbound Program or Service Rule -description: Use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. -ms.topic: conceptual -ms.date: 11/13/2023 ---- - -# Create an Outbound Program or Service Rule - -By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port. - -To create an outbound firewall rule for a program or service - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, select **Outbound Rules** -1. Select **Action**, and then select **New rule** -1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** - - > [!NOTE] - > Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - -1. On the **Program** page, select **This program path** -1. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly -1. Do one of the following: - - - If the executable file contains a single program, select **Next** - - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** - -1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](create-an-outbound-port-rule.md). When you have configured the protocol and port options, select **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** -1. On the **Action** page, select **Block the connection**, and then select **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** -1. On the **Name** page, type a name and description for your rule, and then select **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md b/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md deleted file mode 100644 index 4376871759..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: Create Inbound Rules to Support RPC -description: Learn how to allow RPC network traffic by using the Group Policy Management MMC snap-in to create rules in Windows Defender Firewall with Advanced Security. -ms.topic: conceptual -ms.date: 09/07/2021 ---- - -# Create Inbound Rules to Support RPC - -To allow inbound remote procedure call (RPC) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically assigned port number. Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. - -This topic describes how to create rules that allow inbound RPC network traffic. For other inbound port rule types, see: - -- [Create an Inbound Port Rule](create-an-inbound-port-rule.md) -- [Create an Inbound ICMP Rule](create-an-inbound-icmp-rule.md) - -In this topic: - -- [To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service](#to-create-a-rule-to-allow-inbound-network-traffic-to-the-rpc-endpoint-mapper-service) -- [To create a rule to allow inbound network traffic to RPC-enabled network services](#to-create-a-rule-to-allow-inbound-network-traffic-to-rpc-enabled-network-services) - -## To create a rule to allow inbound network traffic to the RPC Endpoint Mapper service - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, click **Inbound Rules**. -1. Click **Action**, and then click **New rule**. -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. -1. On the **Program** page, click **This Program Path**, and then type **%systemroot%\\system32\\svchost.exe**. -1. Click **Customize**. -1. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next**. -1. On the warning about Windows service-hardening rules, click **Yes**. -1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. -1. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. -1. On the **Action** page, select **Allow the connection**, and then click **Next**. -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. -1. On the **Name** page, type a name and description for your rule, and then click **Finish**. - -## To create a rule to allow inbound network traffic to RPC-enabled network services - -1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule**. -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. -1. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize**. -1. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box. -1. Click **OK**, and then click **Next**. -1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. -1. For **Local port**, select **RPC Dynamic Ports**, and then click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. -1. On the **Action** page, select **Allow the connection**, and then click **Next**. -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. -1. On the **Name** page, type a name and description for your rule, and then click **Finish**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index ae4a98cb80..25947f873c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -13,22 +13,10 @@ items: href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - name: Isolate Microsoft Store apps on your network href: isolating-apps-on-your-network.md - - name: Firewall rules - items: - - name: Create firewall rules with Microsoft Intune - href: create-windows-firewall-rules-in-intune.md - - name: Create an inbound ICMP rule - href: create-an-inbound-icmp-rule.md - - name: Create an inbound port rule - href: create-an-inbound-port-rule.md - - name: Create an inbound program or service rule - href: create-an-inbound-program-or-service-rule.md - - name: Create an outbound port rule - href: create-an-outbound-port-rule.md - - name: Create an outbound program or service rule - href: create-an-outbound-program-or-service-rule.md - - name: Create inbound rules to support RPC - href: create-inbound-rules-to-support-rpc.md + - name: Configure Windows Firewall rules + href: configure-rules.md + - name: Create firewall rules with Microsoft Intune + href: create-windows-firewall-rules-in-intune.md - name: Troubleshoot items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall From 395f417cc19dcaf7c77e18ba494dcd6ae3834cca Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 16:45:17 -0500 Subject: [PATCH 115/237] includes --- includes/configure/gpo-settings-1.md | 2 +- includes/configure/gpo-settings-2.md | 2 +- includes/configure/registry.md | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 includes/configure/registry.md diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md index d30e2cc685..1b1055fb52 100644 --- a/includes/configure/gpo-settings-1.md +++ b/includes/configure/gpo-settings-1.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure devices using group policy, [create a group policy object (GPO)](/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object) and use the following settings: \ No newline at end of file +To configure a device using group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) or [edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730903(v=ws.10)) a group policy object (GPO) and use the following settings: diff --git a/includes/configure/gpo-settings-2.md b/includes/configure/gpo-settings-2.md index bf8ee52309..88fd46ec27 100644 --- a/includes/configure/gpo-settings-2.md +++ b/includes/configure/gpo-settings-2.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -The policy settings can be configured locally by using the Local Group Policy Editor (`gpedit.msc`), linked to the domain or organizational units, and filtered to security groups. \ No newline at end of file +Group policies can be [linked](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732979(v=ws.10)) to domains or organizational units, [filtered using security groups](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc752992(v=ws.10)), or [filtered using WMI filters](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)). diff --git a/includes/configure/registry.md b/includes/configure/registry.md new file mode 100644 index 0000000000..9f01c1e254 --- /dev/null +++ b/includes/configure/registry.md @@ -0,0 +1,9 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 08/15/2023 +ms.topic: include +ms.prod: windows-client +--- + +To configure devices using the [Registry Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc755256(v=ws.11)), use the following settings: \ No newline at end of file From 7ae7674431b785c93653d64914502076c1349198 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 16:45:57 -0500 Subject: [PATCH 116/237] includes --- includes/configure/gpo-settings-1.md | 2 +- includes/configure/gpo-settings-2.md | 2 +- includes/configure/registry.md | 9 +++++++++ 3 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 includes/configure/registry.md diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md index d30e2cc685..1b1055fb52 100644 --- a/includes/configure/gpo-settings-1.md +++ b/includes/configure/gpo-settings-1.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure devices using group policy, [create a group policy object (GPO)](/windows/security/operating-system-security/network-security/windows-firewall/create-a-group-policy-object) and use the following settings: \ No newline at end of file +To configure a device using group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) or [edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730903(v=ws.10)) a group policy object (GPO) and use the following settings: diff --git a/includes/configure/gpo-settings-2.md b/includes/configure/gpo-settings-2.md index bf8ee52309..88fd46ec27 100644 --- a/includes/configure/gpo-settings-2.md +++ b/includes/configure/gpo-settings-2.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -The policy settings can be configured locally by using the Local Group Policy Editor (`gpedit.msc`), linked to the domain or organizational units, and filtered to security groups. \ No newline at end of file +Group policies can be [linked](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732979(v=ws.10)) to domains or organizational units, [filtered using security groups](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc752992(v=ws.10)), or [filtered using WMI filters](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj717288(v=ws.11)). diff --git a/includes/configure/registry.md b/includes/configure/registry.md new file mode 100644 index 0000000000..9f01c1e254 --- /dev/null +++ b/includes/configure/registry.md @@ -0,0 +1,9 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 08/15/2023 +ms.topic: include +ms.prod: windows-client +--- + +To configure devices using the [Registry Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc755256(v=ws.11)), use the following settings: \ No newline at end of file From 6f600e86203f44f0b57fe69f1a2321a3f7e40d30 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 13 Nov 2023 18:15:05 -0500 Subject: [PATCH 117/237] procedures updates --- .../windows-firewall/configure-rules.md | 154 +++++++++--------- 1 file changed, 78 insertions(+), 76 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md index 0b320334ef..21d4f24da2 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md @@ -1,82 +1,83 @@ --- title: Configure Firewall rules -description: Learn how to configure Windows Firewall rules with the CSP and group policy. +description: Learn how to configure Windows Firewall rules with group policy. ms.topic: conceptual ms.date: 09/07/2021 --- +# Configure Firewall rules + +This article contains examples how to configure Windows Firewall rules using group policy. The examples are based on the *Windows Firewall with Advanced Security* Group Policy Management MMC snap-in. + +> [!NOTE] +> To complete these procedures, you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the Active Directory domain. +> +> To configure a device using the Local Group Policy editor, you must have administrative rights on the device. + ## Create an inbound ICMP rule -To allow inbound Internet Control Message Protocol (ICMP) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows ICMP requests and responses to be sent and received by computers on the network. +This type of rule allows ICMP requests and responses to be received by devices on the network. -To create an inbound ICMP rule +To create an inbound ICMP rule: 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, click **Inbound Rules**. -1. Click **Action**, and then click **New rule**. -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. -1. On the **Program** page, click **All programs**, and then click **Next**. -1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each. -1. Click **Customize**. +1. In the navigation pane, click **Inbound Rules** +1. Click **Action**, and then click **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** +1. On the **Program** page, click **All programs**, and then click **Next** +1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each +1. Click **Customize** 1. In the **Customize ICMP Settings** dialog box, do one of the following: - - To allow all ICMP network traffic, click **All ICMP types**, and then click **OK**. - - To select one of the predefined ICMP types, click **Specific ICMP types**, and then select each type in the list that you want to allow. Click **OK**. + - To allow all ICMP network traffic, click **All ICMP types**, and then click **OK** + - To select one of the predefined ICMP types, click **Specific ICMP types**, and then select each type in the list that you want to allow. Click **OK** - To select an ICMP type that does not appear in the list, click **Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, click **Add**, and then select the newly created entry from the list. Click **OK** -1. Click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. -1. On the **Action** page, select **Allow the connection**, and then click **Next**. -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. -1. On the **Name** page, type a name and description for your rule, and then click **Finish**. +1. Click **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** +1. On the **Action** page, select **Allow the connection**, and then click **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** +1. On the **Name** page, type a name and description for your rule, and then click **Finish** ## Create an inbound port rule -To allow inbound network traffic on only a specified TCP or UDP port number, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. +This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. -To create an inbound port rule +To create an inbound port rule: -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, click **Inbound Rules**. -1. Click **Action**, and then click **New rule**. -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. In the navigation pane, click **Inbound Rules** +1. Click **Action**, and then click **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** > [!Note] > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, click **All programs**, and then click **Next**. +1. On the **Program** page, click **All programs**, and then click **Next** > [!Note] > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. -1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number. +1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.\ To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.\ When you have configured the protocols and ports, click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. -1. On the **Action** page, select **Allow the connection**, and then click **Next**. -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** +1. On the **Action** page, select **Allow the connection**, and then click **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** > [!Note] > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. -1. On the **Name** page, type a name and description for your rule, and then click **Finish**. - +1. On the **Name** page, type a name and description for your rule, and then click **Finish** ## Create an outbound port rule -By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. To block outbound network traffic on a specified TCP or UDP port number, use the *Windows Defender Firewall with Advanced Security* node in the Group Policy Management console to create firewall rules. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. +By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. -> [!NOTE] -> To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs. - -To create an outbound port rule +To create an outbound port rule: 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) 1. In the navigation pane, select **Outbound Rules** 1. Select **Action**, and then select **New rule** 1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** - > [!NOTE] > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - 1. On the **Program** page, select **All programs**, and then select **Next** 1. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number - - If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next**, - + If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next** 1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** 1. On the **Action** page, select **Block the connection**, and then select **Next** 1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** @@ -84,12 +85,12 @@ To create an outbound port rule ## Create an inbound program or service rule -To allow inbound network traffic to a specified program or service, use the Windows Defender Firewall with Advanced Securitynode in the Group Policy Management MMC snap-in to create firewall rules. This type of rule allows the program to listen and receive inbound network traffic on any port. +This type of rule allows the program to listen and receive inbound network traffic on any port. > [!NOTE] -> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](create-an-inbound-port-rule.md) procedure in addition to the steps in this procedure. +> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](#create-an-inbound-port-rule) procedure in addition to the steps in this procedure. -To create an inbound firewall rule for a program or service +To create an inbound firewall rule for a program or service: 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) 1. In the navigation pane, click **Inbound Rules** @@ -100,9 +101,9 @@ To create an inbound firewall rule for a program or service 1. On the **Program** page, click **This program path** 1. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. 1. Do one of the following: - - If the executable file contains a single program, click **Next**. - - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next**. - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next**. + - If the executable file contains a single program, click **Next** + - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next** > [!IMPORTANT] > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: `sc qsidtype ` @@ -121,26 +122,22 @@ To create an inbound firewall rule for a program or service ## Create an outbound program or service rule -By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. To block outbound network traffic for a specified program or service, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create firewall rules. This type of rule prevents the program from sending any outbound network traffic on any port. +By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. This type of rule prevents the program from sending any outbound network traffic on any port. -To create an outbound firewall rule for a program or service +To create an outbound firewall rule for a program or service: -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). +1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) 1. In the navigation pane, select **Outbound Rules** 1. Select **Action**, and then select **New rule** 1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** - > [!NOTE] > Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. - 1. On the **Program** page, select **This program path** 1. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly 1. Do one of the following: - - If the executable file contains a single program, select **Next** - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** - 1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](create-an-outbound-port-rule.md). When you have configured the protocol and port options, select **Next** 1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** 1. On the **Action** page, select **Block the connection**, and then select **Next** @@ -149,35 +146,40 @@ To create an outbound firewall rule for a program or service ## Create inbound rules to support RPC -To allow inbound remote procedure call (RPC) network traffic, use the Windows Defender Firewall with Advanced Security node in the Group Policy Management console to create two firewall rules. The first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service. The second rule allows the network traffic that is sent to the dynamically assigned port number. Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. +To allow inbound remote procedure call (RPC) network traffic, you must create two firewall rules: + +- the first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service +- the second rule allows the network traffic that is sent to the dynamically assigned port number + +Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. ### RPC Endpoint Mapper service 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, click **Inbound Rules**. -1. Click **Action**, and then click **New rule**. -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. -1. On the **Program** page, click **This Program Path**, and then type **%systemroot%\\system32\\svchost.exe**. +1. In the navigation pane, click **Inbound Rules** +1. Click **Action**, and then click **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** +1. On the **Program** page, click **This Program Path**, and then type `%systemroot%\system32\svchost.exe` 1. Click **Customize**. -1. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next**. -1. On the warning about Windows service-hardening rules, click **Yes**. -1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. -1. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. -1. On the **Action** page, select **Allow the connection**, and then click **Next**. -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. -1. On the **Name** page, type a name and description for your rule, and then click **Finish**. +1. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next** +1. On the warning about Windows service-hardening rules, click **Yes** +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** +1. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** +1. On the **Action** page, select **Allow the connection**, and then click **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** +1. On the **Name** page, type a name and description for your rule, and then click **Finish** ### RPC-enabled network services -1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule**. -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next**. -1. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize**. -1. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box. -1. Click **OK**, and then click **Next**. -1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP**. -1. For **Local port**, select **RPC Dynamic Ports**, and then click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next**. -1. On the **Action** page, select **Allow the connection**, and then click **Next**. -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next**. -1. On the **Name** page, type a name and description for your rule, and then click **Finish**. \ No newline at end of file +1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** +1. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize** +1. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box +1. Click **OK**, and then click **Next** +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** +1. For **Local port**, select **RPC Dynamic Ports**, and then click **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** +1. On the **Action** page, select **Allow the connection**, and then click **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** +1. On the **Name** page, type a name and description for your rule, and then click **Finish** From 65d5845a1257b14712758d3970a1d7a71003301f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 07:14:54 -0500 Subject: [PATCH 118/237] updates --- ...blishing.redirection.windows-security.json | 42 ++++- includes/configure/gpo-settings-1.md | 2 +- .../faq-md-app-guard.yml | 2 +- ...e-rules.md => configure-rules-with-gpo.md} | 171 +++++++++--------- ...rshell.md => configure-with-powershell.md} | 22 +-- .../network-security/windows-firewall/toc.yml | 24 +-- .../windows-defender-security-center.md | 2 +- 7 files changed, 150 insertions(+), 115 deletions(-) rename windows/security/operating-system-security/network-security/windows-firewall/{configure-rules.md => configure-rules-with-gpo.md} (67%) rename windows/security/operating-system-security/network-security/windows-firewall/{windows-firewall-with-advanced-security-administration-with-windows-powershell.md => configure-with-powershell.md} (97%) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 9615d03df7..0b63b9fa8f 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -6927,7 +6927,7 @@ }, { "source_path": "windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", "redirect_document_id": false }, { @@ -7954,6 +7954,46 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc753540(v=ws.10)", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell", + "redirect_document_id": false } ] } diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md index 1b1055fb52..cb62ec67ec 100644 --- a/includes/configure/gpo-settings-1.md +++ b/includes/configure/gpo-settings-1.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure a device using group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) or [edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc730903(v=ws.10)) a group policy object (GPO) and use the following settings: +To configure a device using group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use the following settings: diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml index 370243790a..81eb7d52fd 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -121,7 +121,7 @@ sections: answer: | This issue is a known one. To mitigate this issue, you need to create two firewall rules. For information about creating a firewall rule by using Group Policy, see the following resources: - - [Create an inbound icmp rule](../../../operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md) + - [Create an inbound icmp rule](../../../operating-system-security/network-security/windows-firewall/configure-rules.md) - [Open Group Policy management console for Microsoft Defender Firewall](../../../operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) ### First rule (DHCP Server) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md similarity index 67% rename from windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md rename to windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md index 21d4f24da2..ce066c6e1d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md @@ -1,75 +1,70 @@ --- -title: Configure Firewall rules -description: Learn how to configure Windows Firewall rules with group policy. -ms.topic: conceptual -ms.date: 09/07/2021 +title: Configure Windows Firewall rules with group policy +description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. +ms.topic: how-to +ms.date: 11/14/2023 --- -# Configure Firewall rules +# Configure Firewall rules with group policy -This article contains examples how to configure Windows Firewall rules using group policy. The examples are based on the *Windows Firewall with Advanced Security* Group Policy Management MMC snap-in. +This article contains examples how to configure Windows Firewall rules using group policy (GPO), with the *Windows Firewall with Advanced Security* console. -> [!NOTE] -> To complete these procedures, you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the Active Directory domain. -> -> To configure a device using the Local Group Policy editor, you must have administrative rights on the device. +## Access the Windows Firewall with Advanced Security console + +If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. + +If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. ## Create an inbound ICMP rule -This type of rule allows ICMP requests and responses to be received by devices on the network. +This type of rule allows ICMP requests and responses to be received by devices on the network. To create an inbound ICMP rule: -To create an inbound ICMP rule: - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, click **Inbound Rules** -1. Click **Action**, and then click **New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** -1. On the **Program** page, click **All programs**, and then click **Next** +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Program** page, select**All programs**, and then select**Next** 1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each -1. Click **Customize** +1. Select **Customize** 1. In the **Customize ICMP Settings** dialog box, do one of the following: - - To allow all ICMP network traffic, click **All ICMP types**, and then click **OK** - - To select one of the predefined ICMP types, click **Specific ICMP types**, and then select each type in the list that you want to allow. Click **OK** - - To select an ICMP type that does not appear in the list, click **Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, click **Add**, and then select the newly created entry from the list. Click **OK** -1. Click **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** -1. On the **Action** page, select **Allow the connection**, and then click **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** -1. On the **Name** page, type a name and description for your rule, and then click **Finish** + - To allow all ICMP network traffic, select**All ICMP types**, and then select**OK** + - To select one of the predefined ICMP types, select**Specific ICMP types**, and then select each type in the list that you want to allow. Select **OK** + - To select an ICMP type that does not appear in the list, select**Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, select**Add**, and then select the newly created entry from the list. Select **OK** +1. Select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** ## Create an inbound port rule -This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. +This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. To create an inbound port rule: -To create an inbound port rule: - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -1. In the navigation pane, click **Inbound Rules** -1. Click **Action**, and then click **New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** - > [!Note] +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** + > [!NOTE] > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, click **All programs**, and then click **Next** - > [!Note] - > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](create-an-inbound-program-or-service-rule.md) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. +1. On the **Program** page, select**All programs**, and then select**Next** + > [!NOTE] + > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](#create-an-inbound-program-or-service-rule) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. 1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.\ To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.\ - When you have configured the protocols and ports, click **Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** -1. On the **Action** page, select **Allow the connection**, and then click **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** - > [!Note] + When you have configured the protocols and ports, select**Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** + > [!NOTE] > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. -1. On the **Name** page, type a name and description for your rule, and then click **Finish** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** ## Create an outbound port rule -By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. +By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. To create an outbound port rule: -To create an outbound port rule: - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. Open the *Windows Firewall with Advanced Security* console 1. In the navigation pane, select **Outbound Rules** 1. Select **Action**, and then select **New rule** 1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** @@ -92,18 +87,18 @@ This type of rule allows the program to listen and receive inbound network traff To create an inbound firewall rule for a program or service: -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) -1. In the navigation pane, click **Inbound Rules** -1. Click **Action**, and then click **New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** > [!NOTE] > Information the user should notice even if skimmingAlthough you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, click **This program path** +1. On the **Program** page, select**This program path** 1. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. 1. Do one of the following: - - If the executable file contains a single program, click **Next** - - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, click **Customize**, select **Apply to services only**, click **OK**, and then click **Next** - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, click **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, click **Apply to service with this service short name**, and then type the short name for the service in the text box. Click **OK**, and then click **Next** + - If the executable file contains a single program, select**Next** + - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, select**Customize**, select **Apply to services only**, select**OK**, and then select**Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select**Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, select**Apply to service with this service short name**, and then type the short name for the service in the text box. Select **OK**, and then select**Next** > [!IMPORTANT] > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: `sc qsidtype ` @@ -114,19 +109,17 @@ To create an inbound firewall rule for a program or service: In the preceding command, the value of `` can be `UNRESTRICTED` or `RESTRICTED`. Although the command also permits the value of `NONE`, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as `UNRESTRICTED`. If you change the SID type to `RESTRICTED`, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to `UNRESTRICTED`. -1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](create-an-inbound-port-rule.md). After you have configured the protocol and port options, click **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** -1. On the **Action** page, select **Allow the connection**, and then click **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** -1. On the **Name** page, type a name and description for your rule, and then click **Finish** +1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](#create-an-inbound-port-rule). After you have configured the protocol and port options, select**Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** ## Create an outbound program or service rule -By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. This type of rule prevents the program from sending any outbound network traffic on any port. +By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. This type of rule prevents the program from sending any outbound network traffic on any port. To create an outbound firewall rule for a program or service: -To create an outbound firewall rule for a program or service: - -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) +1. Open the *Windows Firewall with Advanced Security* console 1. In the navigation pane, select **Outbound Rules** 1. Select **Action**, and then select **New rule** 1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** @@ -138,7 +131,7 @@ To create an outbound firewall rule for a program or service: - If the executable file contains a single program, select **Next** - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** -1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](create-an-outbound-port-rule.md). When you have configured the protocol and port options, select **Next** +1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](#create-an-outbound-port-rule). When you have configured the protocol and port options, select **Next** 1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** 1. On the **Action** page, select **Block the connection**, and then select **Next** 1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** @@ -155,31 +148,31 @@ Using the two rules configured as described in this topic helps to protect your ### RPC Endpoint Mapper service -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the navigation pane, click **Inbound Rules** -1. Click **Action**, and then click **New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** -1. On the **Program** page, click **This Program Path**, and then type `%systemroot%\system32\svchost.exe` -1. Click **Customize**. -1. In the **Customize Service Settings** dialog box, click **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, click **OK**, and then click **Next** -1. On the warning about Windows service-hardening rules, click **Yes** +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Program** page, select**This Program Path**, and then type `%systemroot%\system32\svchost.exe` +1. Select **Customize**. +1. In the **Customize Service Settings** dialog box, select**Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, select**OK**, and then select**Next** +1. On the warning about Windows service-hardening rules, select**Yes** 1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** -1. For **Local port**, select **RPC Endpoint Mapper**, and then click **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** -1. On the **Action** page, select **Allow the connection**, and then click **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** -1. On the **Name** page, type a name and description for your rule, and then click **Finish** +1. For **Local port**, select **RPC Endpoint Mapper**, and then select**Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** ### RPC-enabled network services -1. On the same GPO you edited in the preceding procedure, click **Action**, and then click **New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, click **Custom**, and then click **Next** -1. On the **Program** page, click **This Program Path**, and then type the path to the executable file that hosts the network service. Click **Customize** -1. In the **Customize Service Settings** dialog box, click **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then click **Apply to service with this service short name**, and then type the short name of the service in the text box -1. Click **OK**, and then click **Next** +1. On the same GPO you edited in the preceding procedure, select**Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Program** page, select**This Program Path**, and then type the path to the executable file that hosts the network service. Select **Customize** +1. In the **Customize Service Settings** dialog box, select**Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then select**Apply to service with this service short name**, and then type the short name of the service in the text box +1. Select **OK**, and then select**Next** 1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** -1. For **Local port**, select **RPC Dynamic Ports**, and then click **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then click **Next** -1. On the **Action** page, select **Allow the connection**, and then click **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then click **Next** -1. On the **Name** page, type a name and description for your rule, and then click **Finish** +1. For **Local port**, select **RPC Dynamic Ports**, and then select**Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md similarity index 97% rename from windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md rename to windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md index f52507b076..2028486959 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md @@ -5,7 +5,7 @@ ms.topic: conceptual ms.date: 09/08/2021 --- -# Windows Defender Firewall with Advanced Security Administration with PowerShell +# Manage Windows Firewall with PowerShell The Windows Defender Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Defender Firewall management. It's designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Defender Firewall management in Windows. You can use Windows PowerShell to manage your firewall and IPsec deployments. This object-oriented scripting environment will make it easier for you to manage policies and monitor network conditions than was possible in netsh. Windows PowerShell allows network settings to be self-discoverable through the syntax and parameters in each of the cmdlets. This guide demonstrates how common tasks were performed in netsh and how you can use Windows PowerShell to accomplish them. @@ -16,19 +16,15 @@ Windows PowerShell and netsh command references are at the following locations. This guide doesn't teach you the fundamentals of Windows Defender Firewall, which can be found in [Windows Firewall](index.md). It doesn't teach the fundamentals of Windows PowerShell, and it assumes that you're familiar with the Windows PowerShell language and the basic concepts of Windows PowerShell. For more info about Windows PowerShell concepts and usage, see the reference topics in the [Additional resources](#other-resources) section of this guide. ## Audience and user requirements This guide is intended for IT pros, system administrators, and IT managers, and it assumes that you're familiar with Windows Defender Firewall, the Windows PowerShell language, and the basic concepts of Windows PowerShell. -## In this topic -| Section | Description | -| - | - | -| [Set profile global defaults](#bkmk-profileglobaldefaults) | Enable and control firewall behavior| -| [Deploy basic firewall rules](#deploy-basic-firewall-rules)| How to create, modify, and delete firewall rules| -| [Manage Remotely](#manage-remotely) | Remote management by using `-CimSession`| -| [Deploy basic IPsec rule settings](#deploy-basic-ipsec-rule-settings) | IPsec rules and associated parameters| -| [Deploy secure firewall rules with IPsec](#deploy-secure-firewall-rules-with-ipsec) | Domain and server isolation| -| [Other resources](#other-resources) | More information about Windows PowerShell| + ## Set profile global defaults + Global defaults set the device behavior in a per-profile basis. Windows Defender Firewall supports Domain, Private, and Public profiles. + ### Enable Windows Defender Firewall with Advanced Security -Windows Defender Firewall drops traffic that doesn't correspond to allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't being enforced, you may need to enable Windows Defender Firewall. Here's how to enable Windows Defender Firewall on a local domain device: + +Windows Defender Firewall drops traffic that doesn't correspond to + allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't being enforced, you may need to enable Windows Defender Firewall. Here's how to enable Windows Defender Firewall on a local domain device: **Netsh** ``` cmd netsh.exe advfirewall set allprofiles state on @@ -37,10 +33,14 @@ netsh.exe advfirewall set allprofiles state on ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` + ### Control Windows Defender Firewall with Advanced Security behavior + The global default settings can be defined through the command-line interface. These modifications are also available through the Windows Defender Firewall with Advanced Security console. The following scriptlets set the default inbound and outbound actions, specifies protected network connections, and allows notifications to be displayed to the user when a program is blocked from receiving inbound connections. It allows unicast response to multicast or broadcast network traffic, and it specifies logging settings for troubleshooting. + **Netsh** + ```cmd netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound netsh advfirewall set allprofiles settings inboundusernotification enable diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 25947f873c..f8b51fad54 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -1,22 +1,24 @@ items: - name: Overview href: index.md - - name: Configure Windows firewall - href: best-practices-configuring.md - - name: Configure Hyper-V firewall + - name: Configure and manage Windows Firewall + items: + - name: Configure Windows firewall + href: best-practices-configuring.md + - name: Configure Windows Firewall rules with group policy + href: configure-rules-with-gpo.md + - name: Configure the Windows Firewall log + href: configure-the-windows-firewall-log.md + - name: Manage Windows Firewall with PowerShell + href: configure-with-powershell.md + - name: Configure firewall rules with Microsoft Intune + href: create-windows-firewall-rules-in-intune.md + - name: Hyper-V firewall href: hyper-v-firewall.md - - name: Configure the Windows Firewall log - href: configure-the-windows-firewall-log.md - name: Secure connections with IPsec href: securing-end-to-end-ipsec-connections-by-using-ikev2.md - - name: Configure Windows Firewall with PowerShell - href: windows-firewall-with-advanced-security-administration-with-windows-powershell.md - name: Isolate Microsoft Store apps on your network href: isolating-apps-on-your-network.md - - name: Configure Windows Firewall rules - href: configure-rules.md - - name: Create firewall rules with Microsoft Intune - href: create-windows-firewall-rules-in-intune.md - name: Troubleshoot items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md index 5ff128f685..a316bca4b5 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/windows-defender-security-center.md @@ -70,7 +70,7 @@ For more information about each section, options for configuring the sections, a > > Microsoft Defender Antivirus will be [disabled automatically when a third-party antivirus product is installed and kept up to date](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-compatibility). > -> Disabling the Windows Security Center Service won't disable Microsoft Defender Antivirus or [Windows Defender Firewall](../../network-security/windows-firewall/windows-firewall-with-advanced-security.md). +> Disabling the Windows Security Center Service won't disable Microsoft Defender Antivirus or [Windows Defender Firewall](../../network-security/windows-firewall/index.md). > [!WARNING] > If you disable the Windows Security Center Service, or configure its associated group policy settings to prevent it from starting or running, **Windows Security** may display stale or inaccurate information about any antivirus or firewall products you have installed on the device. From cb3033c11077848f43bb5400821fb7d3ed05af82 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 07:46:13 -0500 Subject: [PATCH 119/237] updates --- ...blishing.redirection.windows-security.json | 2 +- includes/licensing/_edition-requirements.md | 2 +- includes/licensing/_licensing-requirements.md | 2 +- .../faq-md-app-guard.yml | 5 +- .../sections/operating-system-security.md | 2 +- .../configure-rules-with-gpo.md | 2 +- .../images/powershelllogosmall.gif | Bin 1415 -> 0 bytes .../images/wfas-design2example1.gif | Bin 29827 -> 0 bytes .../images/wfas-design3example1.gif | Bin 22393 -> 0 bytes .../images/wfas-designexample1.gif | Bin 30091 -> 0 bytes .../images/wfas-designflowchart1.gif | Bin 17357 -> 0 bytes .../images/wfas-domainiso.gif | Bin 18347 -> 0 bytes .../images/wfas-domainisoencrypt.gif | Bin 21039 -> 0 bytes .../images/wfas-domainisohighsec.gif | Bin 21301 -> 0 bytes .../images/wfas-domainnag.gif | Bin 17902 -> 0 bytes .../images/wfas-implement.gif | Bin 37159 -> 0 bytes .../images/wfasdomainisoboundary.gif | Bin 30054 -> 0 bytes .../isolating-apps-on-your-network.md | 2 +- ...to-end-ipsec-connections-by-using-ikev2.md | 128 +++++++----------- 19 files changed, 55 insertions(+), 90 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/powershelllogosmall.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-design2example1.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-design3example1.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-designexample1.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-designflowchart1.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainiso.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainisoencrypt.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainisohighsec.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainnag.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfas-implement.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/wfasdomainisoboundary.gif diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 0b63b9fa8f..467d5caba9 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7996,4 +7996,4 @@ "redirect_document_id": false } ] -} +} \ No newline at end of file diff --git a/includes/licensing/_edition-requirements.md b/includes/licensing/_edition-requirements.md index e68a87a3a6..9810ebe8bf 100644 --- a/includes/licensing/_edition-requirements.md +++ b/includes/licensing/_edition-requirements.md @@ -81,7 +81,7 @@ ms.topic: include |**[Windows Autopilot](/autopilot/)**|Yes|Yes|Yes|Yes| |**[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)**|Yes|Yes|Yes|Yes| |**[Windows Defender System Guard](/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows)**|Yes|Yes|Yes|Yes| -|**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security)**|Yes|Yes|Yes|Yes| +|**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)**|Yes|Yes|Yes|Yes| |**[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)**|Yes|Yes|Yes|Yes| |**[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)**|Yes|Yes|Yes|Yes| |**[Windows LAPS](/windows-server/identity/laps/laps-overview)**|Yes|Yes|Yes|Yes| diff --git a/includes/licensing/_licensing-requirements.md b/includes/licensing/_licensing-requirements.md index e87793d3af..022cbf278b 100644 --- a/includes/licensing/_licensing-requirements.md +++ b/includes/licensing/_licensing-requirements.md @@ -81,7 +81,7 @@ ms.topic: include |**[Windows Autopilot](/autopilot/)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Defender System Guard](/windows/security/hardware-security/how-hardware-based-root-of-trust-helps-protect-windows)**|Yes|Yes|Yes|Yes|Yes| -|**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security)**|Yes|Yes|Yes|Yes|Yes| +|**[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/)**|Yes|Yes|Yes|Yes|Yes| |**[Windows Hello for Business Enhanced Security Sign-in (ESS)](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)**|Yes|Yes|Yes|Yes|Yes| |**[Windows LAPS](/windows-server/identity/laps/laps-overview)**|Yes|Yes|Yes|Yes|Yes| diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml index 81eb7d52fd..e1da302edf 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -119,10 +119,7 @@ sections: - question: | Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach the PAC file? answer: | - This issue is a known one. To mitigate this issue, you need to create two firewall rules. For information about creating a firewall rule by using Group Policy, see the following resources: - - - [Create an inbound icmp rule](../../../operating-system-security/network-security/windows-firewall/configure-rules.md) - - [Open Group Policy management console for Microsoft Defender Firewall](../../../operating-system-security/network-security/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md) + This issue is a known one. To mitigate this issue, you need to create two firewall rules. For information about creating a firewall rule with Group Policy, see [Configure Windows Firewall rules with group policy](../../../operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md) ### First rule (DHCP Server) - Program path: `%SystemRoot%\System32\svchost.exe` diff --git a/windows/security/includes/sections/operating-system-security.md b/windows/security/includes/sections/operating-system-security.md index 4a4ee4acf2..685cdad996 100644 --- a/windows/security/includes/sections/operating-system-security.md +++ b/windows/security/includes/sections/operating-system-security.md @@ -37,7 +37,7 @@ ms.topic: include | **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | | **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | Wi-Fi Protected Access (WPA) is a security certification programs designed to secure wireless networks. WPA3 is the latest version of the certification and provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows supports three WPA3 modes: WPA3 personal with the Hash-to-Element (H2E) protocol, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B.

    Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication. | | **Opportunistic Wireless Encryption (OWE)** | Opportunistic Wireless Encryption (OWE) is a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots. | -| **[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security)** | Windows Firewall with Advanced Securityprovides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

    With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. Windows Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | +| **[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)** | Windows Firewall provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

    With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. Windows Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | | **[Virtual private network (VPN)](/windows/security/operating-system-security/network-security/vpn/vpn-guide)** | The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways.

    In Windows 11, the most commonly used VPN controls are integrated right into the Quick Actions pane. From the Quick Actions pane, users can see the status of their VPN, start and stop the VPN tunnels, and access the Settings app for more controls. | | **[Always On VPN (device tunnel)](/Windows-server/remote/remote-access/overview-always-on-vpn)** | With Always On VPN, you can create a dedicated VPN profile for the device. Unlike User Tunnel, which only connects after a user logs on to the device, Device Tunnel allows the VPN to establish connectivity before a user sign-in. Both Device Tunnel and User Tunnel operate independently with their VPN profiles, can be connected at the same time, and can use different authentication methods and other VPN configuration settings as appropriate. | | **[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)** | DirectAccess allows connectivity for remote users to organization network resources without the need for traditional Virtual Private Network (VPN) connections.

    With DirectAccess connections, remote devices are always connected to the organization and there's no need for remote users to start and stop connections. | diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md index ce066c6e1d..f2b4821cd0 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md @@ -13,7 +13,7 @@ This article contains examples how to configure Windows Firewall rules using gro If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. -If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. +If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. ## Create an inbound ICMP rule diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/powershelllogosmall.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/powershelllogosmall.gif deleted file mode 100644 index a27d8b9d9e24c2098b9f3f649698501d92c38420..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1415 zcmV;21$g>LNk%w1VHyAx0QUd@c&x=;qQ%Mg`$<}by3YTI!{^!M>iPcvM`nem$=iLx z<~mw)xaR&ggUMQksW6r2tGdWiYm17;`St(*oZ0v~WR+}sm8!<%m#xNfldURct5bTa zak$gO*Z+II-2VOkjIqR})bjEF|AMNu8hgxvw(PRn+;FkYgqpA|dB&*3%06|wag()r zji!~<>r8Hudz!RYkIE&6*V5|#hOE4Wy!3Xi(bMbpgrc;=>;K&T|Hlm$qP*uIB&$Yloxl{{M=syMndM zxXtRDw$tJN|4wwMXR*@s|MYpY(v7s+>;M1T^8bsi#h%37bGFkxa&0(Fql*a93tk0Xh(o}DR+UojZrOLC!)KhSbiM-lCSagHA(UZE;qQ2FGs>xi6 zw%Y6Sy3_W&+x&#D#X)PFK60ybrM&g}{zwaHd{x`439 zTyc(Ro3oz5=GN!;|MmI#`}$aRc=G@Fe3`3csm5fFz5n|Evf27%k*0g3sL$m0&*lBI z%Gzj_$7_qEQ;oAykG$>w_*;|CxY6%Va@!0V2sMYHK`}*eY|MC0!^8EiveaX|~ z|L^?ubeFk*mA*`No{zM@T$r?trn+K^$XubmpUmN2sLqA5&}*K%kG9ji|NpSp_=Jv_ zvD^2*-}YyevQLA*E?t#QmcDwj?Wn)#naAtg`RAO^>W!|aeXroZ;^cg{@tVHQm8!kK z+3$9rqhO%B!sFbKzT)im^~B=*pyl+;>i>tQz=WsGW1HqlWRP8lw~)ZsIf2!W!r$ch z|CqV5X`#YMYol(2t)8^ZSCO|%4`pqFqGpfT7H4KfsrS{*xb@=uW>=H47J z)2Gi+I1oM@5P>D0kvxT-Fvzim1_%yVeR$Ycpcybj7g{J4u_S?!CwYnp(D5Sy4If(f zDJW2YOtUaiEPT+@(mGEamJK? z7l2!#3{F&HkSG4Eu);sPY|sV-6C5x>7A$}^n2ovDMfLMPn;UMNyP$#ya+~hR|4&Bp)Q%8~d)Y zBqUi%5+#+iXnuWv=Q+>0uY3MF&vWlR_ny~1cJ{W0Mt*$Y08khJ90LBy|8Ua3QAi3W zCWZSa0KO21HwAPHp}Hkd!xDsH3DmR%@jor&F)hLT1B5aRp~TeG6hkOOSl`1F$Wqof zFxK~ktjol#%Y;ZZVx)Ugqo5IH~&Z?ldZ@QTbMN49xHwxx#z z0eKv!=z++{NRQ|)ppfGg-Q`4^Ak#+tXk~^8983wvkJjZ!>j|RucqC5+CG>IiYbgx|u_3{*>3aP|~=N+_s+3w%gd)nBMlOqAp zS@TkI*Ir}uKzh%wte)MPwxxSrt9d;f+61SthjXuIsjh3atE;PI;8V%Kue=dXW6$bd z^S|ggZ37D>6P$Y^oSG3%-YlnWWW8{fQ#Qq^nc&n-{OTH6zxNMMaVADaIL*yn6YKY8 zIXx3gT@#x<6YCQb6Lqtk=2_0b)Mnf4uf_$=$kb-t5~p#AGcvn5GW%&__EXQoueN{F zg-=~eoT-IR3kwTftDKRgUjwVZW|!8dmUd^CK25FejjVH~Rynh)dkd?(zZM22);X)I z>m!?-+4a5Ib2-qQN+(m%ZUYiV3^29y1BRT>7V6rR+rW{_troC(_c%woXt;r zpFZub@BZ4{{q^h9`sOa@)9$bJJ)iM2|RvTv*$&QWozIoaB{ zs;D0rF_dc*OC7&sczJUM>0jl94;7eP7;3DZtRUs6`HVC@n5K6Gzw;BcfzwMoA5Zi# zo~Tbiwdd^`=^4;ORy4xE1g#9nVJ>-&Y@R3`t2f?Rk`VcPw>@m3?m^e-vD+VCR*{BFo!j+Q zef~S;c;bdeJ)w)X<=iLZMeLV6}XMhBa{dH(F#t-oxNK+X*#noS~ZF+p%#Z)m@q z`x?epWhK6LzcKaf$~VF1F}9f7(+HP(qGJdrFL*UsrDn!i-UUM!uh7d^Xn#JqPgydU)=E9+zmN$J7cZ1DHXNU_q_&{fIaxd605ZFl)v{>dx$rK(*d z!Er+lE{E<9li(*AI5mG*zmvyrHF(mHR-d4@SD90ExFPz(`@7VoW~YlmUEQ7~Cr(<* z7pLiOsyL`O(*>cnxY!JnNwMiO%;GDX_cc4`D@H_Q7OWwXcIGvkHMMFuRIbq^XUA6i zAoy`wereH5J5YxRJ1O22inWU-?NIFFK~UBM)dA}@KI3Gu6?ssuQe*JLxzn$dbSds< za!R5SFQ=!smOoVofPK^&*1X!**t6>j0$?X~okrRZcQ7->Gl=ZY-^YIk{j`l$Ey4x8j>$T9UMY};-y2|Po$hb zAM~`tc$U7f$rX!9%iQmM?r1IaDcDayYcX`Mi&sAx**Ar*$a9@=U(3)ncPtHfTN(H# z97Iz#k6Ia4>ipK;>+1xXF~#z?ht@tczoR-7A9n-`k(9HyxNGpa!)k-E;sFHk_|^(Se#)iU0I#Y{(8^BzQTN$@AKlTVW9jiKg2bGH3=uXOHp`a>r*mj2-oP6)@5|mv{MeT>R(Z zGWrdKe_u5#?n)~fS;;6z4?j)~?yC??l4l_Vx;w;+_)pwMtRZlInWxjvq=uyh)X_yV z{N~t7V$9wr6GMag-xc^}rf6zYG#(>~T}H`nf<8MO22}!hLN_aLSwd*zD0S2eL=uF5 zc=*UQq{t)*E`Cxd0XVXod+>ov43SIKU|LDeeXTrn#$N7pp8|%~0ad%&Dg{|0XHJr& zH7;Azd|lGr1lPLp%7H0CEmi{7jl&Yr_T$5S5S|dnc$1>Z-XOI@K76ATW_i@1i$@UR zYhnZF3zm=r_pc>qh9NXtChF?qc(G5);vTTWG0RkREUaX*;J!?~*cxsm-?aDO%y$rK z-z{$632jglZU+{V%ibB=aM2`6A)xZocgB2Gpy3v?_UUj-bwV#dfVsw`frV83w322U z9;$A~?N}DiY>2vi-LRDGrJn{5)!U_4K_x_qidq}FfPQU&IJ(xFpN{}=#}K1x+vglg zT6A-R!b6@Zz=YkJyZwxu^jkiDh>p?9IN}ZmN8>l`FC-?o&d0k(FBkJn${E}d^OG9e zIK5=K0s@N-njg!P`nY71(DZlW;j`a9PIsH@drCaQ&zhmN7l}#Ho33?o9|lA)8+j@% zU!%WJAm9)N&v}GfR2Y_p-}{n&oip^f=JWbFOv652jPoaO4h!_}@$t_dk_YL^<^lgGFe_*sihfjMtkN$hr>_rDCY#%|u$KfT=jBi^%5 zdDm0lJvan&JGk+R4S%=56wKhlN+Faj*Td%*=d4fhlPQObf1@Yy{_&o<`8|%u0Mu)o zA~y%G5#uFOV}+MYs(-GEaE8MsCN-y4=$mXx2U!y#5(-YdNr<#;->}1mHiFZBrHYo8 z(G0+;LppD;5CigM{NCjHt46F)_(W5D3XM-ykTo2wPqO$Wfr#q(Vp~OqYwf7$gx;7} zLJnCOo}IL}vnzu$j(yeMq@|r(tPq4&|5ugdBjbi&6S<-vQEGJv8JTNj`I3+XF_-QQ zC9aXxt8KLcKLqRli4(yO=}8n#W?o~(0j}8Qw(-Z@5nF}c$%yY30)B!njNYR|ErVRu z_qOaNL9|c+{;1WND*T4^3fyXqxO9+-t%SV(n9*|HiJv#{)mu0wUtO2Y#T8}x+qSJ` zu<1B?z|QAH(J+Vd?NGZ9#yAi_@!pDRQ#|r@zNx(%LpO*N4~V;7yl`~DGbzp^4?)ee z>U^SUD8c88@$N8P$NbkiS#ejUrbg z3QSBlU2hv3kNa+$3s|YqRJe)1y7LIt3dg^(PJ_KWarP&rrQ2C&_;YVUxEIUbo=^HU zwx$_*EX+y((Pue~Byk^#;#M{uva;AE0PweK?`i)1X3ZV31_}FHllxH>8U%o+#Y&Le z(p?cL^YiJ^(p}fjHhO$EacKq@9~jO9Vl4c&$^@?q5wEt~f2LYSSxI*=ZTVi23 z1XLat##;~A)yEtA!SORcoov-BOt3)%V95pw1)T{Tf~!Fz z0={$O2bH$I!u^fG8@zr6yOF@U&%G3;V#|nJa7{EjPU0`;{<|ERv>$SLpLeZ0@d{mE zgqb9ijh^P>QW5Z1SmyPGtK?DX&@k8+0*@XDTth~G-{HAh2@b={1rdO~dNgU!<~y4w zn4R#%51zW5Oam*m@@K4;8Rx$|o^VVjXdn80$NRk>&tEEnUI6?@zZObIKmDF&kj?ww zPROkdsV{7b6^nOkPEnfxoWP*p0^IFk=+|NB>J9Eq47$Pwz_HUYJ-*u%#M<$6Rcq8h zz0b!psEat5ei^t~4q}6asr`gqVP`Wo(wir_zxavi+DnWvjfFS{!84b<52li!%nV3~ z%oP^6&J$f9EK^0`I{-igszTKcdRqU=0f@JhpG#mv6^`Nh%iz5;m54Nwtl#0?XD4Z6 zJFxP*%gm~S@57hhxraqs2WheXN zI(IK#!?T;q;DK>J6SbEG(3THxu!J`aX-$(UduMX1k4tv3`8okKmYr*8$;V(A{Uvhe zBqK9FsP-awipc1xdexzN^jnI;0D%6B0V^Tp^2naXVLU~Ki0|zDCL*6d7VOVPdr%PX zfYVPYd|DXDEXMV{93s)aK+OvphzI*H&hrjdTlgS;Uq<{>j@$ z;QP)-&0-*0YFw}Jkf%F*iJXz*EpfYdA#lT*3ZerbVkC)679>bi+F@b0+qCUd1QqIq zjk+s;1fUj{VWI~20tbaD1a!2+zvV*fI>>~2@}0v}wK*`Wk`=}oJa-3bZo4F=%vRn6 zml+U%)>;4G^=NSvs#UE@N=+^Y3%#kw_k_w-w2VH7fz~n53D>F*Sk*~I=(E+wQt=On z5~T=|KI*xw(}+$?72Ba<+E^}ixuSQDuRRg< zflVsM)Q!zo`*SFDaw-TlRVWcvV6bxg3OSotl%3GZCj$mi!i0~C`0G#phj!-y)ax^1 z`GPOsGmNdjNWC7+;B8fvtitj}Nw4ISL3R+Olz+9; z^`lbdkJd(YNl(YNjfc;+KX!E%DbVbKBiNZCF3S>Kmg@%8Y_7&uu9&VQ&|aJ2(V)iGvBQLYFcIVYp9_CRg^c5@cU2UMvq);`O-S7dTf^4zrpq+Ix+!HAQC{t~^0tK0|oQOk<{%k4t9ihD;HV{x@WQgQq1vxv6< zDpEYOkspO)fbh)DJPI=>t#6&$mLJpcc!#g3V>p}z=O07l0;tlHGD3^O_lwO=nZo?o z6afn4vLB{&PuQHuHIm5Jv?X+11o@*%Av_eOk=EX^IC^q7my*pZt3RfIVcUm~8A+7| zGsm0&m}U&>K7lV0+kEl(sXW4f!6a}93k$1nSuZPIlDbhvMz4gH)Nu%iccxs<9TP56 z$O51{mp#$=Wy0}nJwyCSZJWG*H&=?5ph0)e*Ma9cL@s~1Teg0(@55Tw?>sq1;47lC z+fNSGwk!VLNgZONf0H!sz7sNU1&7`-yHIpmT%-JoBs38~Gg)29f5Lj25$4wg;jF25 z4d_vE$Qz#g-wTJMj1X z$Sm@F3&AUU9?5e+ZcYVf=AAKAIUJM(})=3+svdIjT z&%x>&{OcKBR4-xt2@UQZDQH(e&L7J|{iPVU>%C7dc^J+ zTQR(J=dBC(_xd0VVNzuheK`vlWK~61fRP+3LOcX^jG0xm^MXi4?Sv(919O!C+~mjr zFB8`IZ7!a=lnM055Kx)*a5CRaqIG0i7U13~b?OLr@{ZSQir@i$EP^H|D1&ObOu7Ro{xq`($rxo6OzG=3Wf5g9kr?V`0L4a%EVUI}9rI+4=4ci^lCi%!CvlJx%n_CC2+TyF^sCA@kka756;<(hT!j7(7`VSN58eENQIp7Y(k2Oqt_VBKHC z3DPI_I8&z3#_I3Udg?FhP7VIO;IbF$aZ1i>+lt5<+G;tE#7!QX;{!Q`4C_G-8Oonc zPokL4G&W9UL7?$YtED%!?;XAScPII4vP-d%ma2=|Bj0Dgd|i;%ewqZ(ot{{LH1xp1 z;8E09RLh(AR~MP5YaV>e2IW~MJrQPU*%)tf(fl#jy1F&%lbTcOu_mTiY+R1Jw{@bR zm3_lNi99VCRyRkg(QHi1_BFenlW+&(AJca~Tu5kWo_HC7XTS6Re$ zw^|m#S{C;A`K9RdLhxmh+t-#+z)qE0SCln=)dg!HUMqO zS%4%Qwc$l2*(2B=v|Z;4zHy1GTn%79RePxd=Le@$PZmUO$}3G-ZwlNK9T|~&n+U%^ zksrTS=T+s*O=#2-QXMh5cu(h$%5a9w*P1@QfJ`$hlxmaVo^zh&@Aw?E^@6xuyVYd{ zr6anM$4JKpXjDi0!Sf?!4u|s^pE{3r_m!PEzx94pqs>}*QKkGr+6&1mbMkSL?3qAW z@85EXfa-p+wJkl^NmVGrG`sc{L#e@vTb0uCSTo&V-E$4*&hSH-6!WSMSy;Vlusf&2 z?YjDn5w3~3bmquNSrl|c!(qvC#=TarIpn3Y+#UM?4N}e@0mwzq;UB${Rr~kvsB-?m z=48YF%25o>xBJ|V=J7pzh{#rKwn|AeSr-FK&-z}6HW@TiVXDi7qxVTNa`F7G&~%0D zqn6W?LDS{QJsK^+RfSKkrF?xL0ItKr)13x?{md7Rmzff}rH{pC;*Kg}J*K}Uw5j-C zV|tfj>u0?uPa&~HPqAkwD5ykHURZ{L&}I}&dI=FIb}?g9S!yl)=wP*9{?R~gC6i+y zg}d?~ZGnlJ&V01A(eTl*63;JOkZ}IHt#vmehCd#WZb1&9BD-t;>~@PBD5>#i*8Z@F zvAfz9QDHp{2)Pd$Cnxx$q<;=MY%ww1QRhjiZ187&TZs0eybMRo&aiHhhjVI1Ua<>U z(JtrDxaD3U7|15J=;qTD*s6z({Q9o@_Y@j#Z1bnl){)0ZzO#~Q^<0!~V1TNl;2TwZ?mU zx`5|oRM99YTOf8d&WWHfOv0Vbt|h_GttSj?5(9E7+6AGwFKMIFOhlxhly(OZKy)M; z-9FK6*rEWtA4Eajep@bz^u*XeSp}6?1^grlW3)pl$gj7SHFZEa3Qjzp#{8BiPBHRPT#^P)^D$$j?~TfsfaZ1&t!04>lg) z@E8EbSyl*|AP5wKBmV8JOx1c@z#D&GA6m_IRQ)TA;zyBs6845ysXl?*b|(Lk0t{^) zhDksB4bol-pm!wzR0kF~jkf}PSrEq#%56^jN&8|?{6xwIIQ}joj_)QFK6-_%T(%ER z-HfGa@bt=<2umF*TH&*&KDId}CZK?5NFs%mXWgau$pZIOnAnJ#{Qzg}zgf=HC;J}C z5-i1U7%>2BJUrHB__94M{%uXAj29LVKb`YT1K+C~3UibHB$s}1#!B!QrHA(rhRc6u zH#I7+j`&M0$(&5V<_Bw{eesO`zf%RUW$@8~UiJSZpdu^P1H1Wy+$Y&!(GHBSq47^w zRnsa>iDCpw{t5YfvUmp5X@sdEBXkrB9d)w7= zC{dfZJ__k^WsOBA)J5nyq?{B1+KiJYtwNI+ww>n#j1hwl(D1%C+%jrunQKBR8gnYF zSMoSpj0ZKQ>=f4HU7Uq8o{zKo9^8w_&;4>G?iJ51(+9TW2k*G6sq3<$OyKuB+5_j# zx3q%!ncz=W0K(*~$44=_whcQUKGEB;{6K!-*@t<`PMBki3YimsU;2b21GUb$^BL)r zVqQ1}8pW_?jl1J4cLOm#@4>xtg#jr7lH`FtPfiEy}2mbZ1Uhj?gYMWWnNn_&phMGUw(}8sGf}$&Pk+eO0spz{SU1bBe$(5;O(s zI&-vvRA>|yp>6zSJAJZ;_q-HhZnF_=KUX2{_3yi}Hyrup3F*p5&HK1Bt~t`;4muiZ zNS&G@sw3B;>cO0@>IM-l*-33{nlO?W9b3z=JkB>(S3RhsIk*4m^|+9n9WEDg$M<26 zSfJ%O3z^Jp?`kXQbBtD^FPRDy3Z%kL8W(KFkAEZCGUSj= zKQr_sdK360>N!qvEE%T~vBC7mT>^p30B#8gct+VCY4=Q-FN@3BWd5VaFB_k%lzzv94iu~+a=-65`P%k^==t=I7JKjgcUG4X*5VAzZph5+~7 zhjZXkiL3M+qhbAYP+Yi5q93r%1%yote}}b zObhG*tb>z?1jubcgV>E8Jw&WC34Rz0M1Sp#qsHNZ67Kj!S%QFmU@_>Gm;wQQn$_m# zp6oBiB@7lmJA-fv?v~~kvIStj=Hm94(CTb8Tc?!jM$l&k`mLdU8$Z48>XvZ@b}4kb zcy{&#t*4FjaGI&@6b!c@Kt|mj`fT+_ARx0lz&mcMKx%wCe}Xj|>{8nOc`R}5M+FJ2q-~t4Z^cQHLB;jK^UxP(Urs@uFVm0w~{Z> zYiuG?9Djo@Eb}Er^I$NrOP+Ch^&LKVeP3%>6lv(?>Tqm9XZn13diN075S-o}i&^Zf znL&C2Nj-7^H}g;f57LPxX^DVpF_ZsA9| z-JTFih|}ALS3AM2)sxM)Mjy_IHJ6c6Yg6_6AaxS7Knj;zR0;pbQ3gICm;s&jq&D%4 zr{EK!s8l{I^xQstpAI<}1rHTZh>3!?SKjwstCaAH=cw+36DMPNupo_=62JKbtOF3| zol?_gaZn9a-9ShfCWh|A-Gj&4$ezxeYuPt z&-0MYmm#fV&g&Eb<@rp7DcTt_+{ZKV8Yba-a3YPsbuEf3RoC9;XOhREhxahD+B&At4Mm!y9yobdQS_r1c^Axgq%F9XIp+q;rLk zRvz-}2-H&}(F0F_`c>BzpKxV|+k6)mNrzL$2FyOdC9wd`C8e4~jVQ2{1bMhf(}NKZ zof~o1%SU4AT!XqVgPypYYJp8xzR-H4b8J)K9Q(Q1J>*=aqntCUf4*lrsyK+my`qzF zZZ0VlEAOL{bPGWvzsrdlp5@$Aky40qu|XaW|IWIP;mXD%<2;XNfN0ep3Jk(tUQK_Q zL?s(_jzFU25^}o%m;4N_G5RcfCv3vwN=_tVkX1PN*e2x5glhxUD8}~R7N{yVQoCPp4L3oSlVv zyCGu4@JM)4i}{vGp7I<#Zpfh154ulB%FIKqSeoRr-juh*bGLxhK+DU9zUFevl~~Ac zx9SUCl-VGa-_wahdi2ALc$5-#QsczY>AYPMRxAN_5pkQx(Edqoq5<=ncr7oUX_Af* zs9cTXkSdVRKtgsEbP3HA)giw(b1RMYKvOyrPr@fE z5U+TY==RHx3msm4|4tuCNGMSR4n>+Ms7{qI9$Bz7gmDRC3y)&M)^1S)q&1h8Rf-{m zH~lvjYH`3tI%NYEDE98L9OZc)J`h8Zl*SybHT3Fi$(b&B?%xvE7KU|khCdBobX1~} z3=Qut+uC1)5`RJ*_918ayy4pXJ58ODS_fntqWcic}XTIsdWV92Pal*d)Uv}$I){t zxSc)4;Iq}oj66=EBHOX%!SQ0ew-MIA`bCJi_K=X^LVD%Vf>@Mc+~6=*B=w;rBg=3$ zI72DP%`+|n2$5^m1T*6*5an>5IWuC2%R8OJQNH;A>ZxB_eEAvIumLp@$J6+1h|2q} zt)#HwNvE|~KK8U-s-G*v*_IXms^UTXK z#c$Ak+GdjOyncR53{pf=mMMgU+(dr3<5#-#s;(gPKLpr{n&iU{tzX{yFHtn~#ca6> zL#4%2{^onF7qM;Bj1D{u6MJ!g;Ly1Cgfa5;l9hb`85SVZWVH`grO<|*(}weCt)Sp| zmFagpm^%s1F=lIXi!W~l;}*7F+*$@piESNJe^PZx3Yz1(wBOUPf8qI&EXG=DMHr$` zL~5q=d9^PcH=BuEI+Gt&BK`(x>X{GukN?(exEx4BYy;uuK~t??D?8Y5xR6pXKJMG^ zwq82Qc{|A^O0HC4FiUxYh;-V!6mP@BD%A;>HZC*_eF^|Rb0owcIvv0rKH1#{#eOS2 zYNC=UO#On0w$ideCVikAO+LQVE9fpE@Phr}f>*pkeSI51Q&D++#IuwT1<_`>zU5wt z3rphLpqjFdxBYp+c{?3b0I?V!$Cg~0$8Vg`EH|Nn;;|qEK*HDyM&hAr$W-6>Boiut z5y@7m;SR>9G^?n54!JBQ9G?Mzv>N!&sBsfD;Jw@($}!JNMQQ~h25?{`hDY+Y(n z&yY8m^*I)C1q{$U>;$dwP-ml|2j2j`49v-gsT{`|wbbvC2A@Z501-q~qG!Is>%FfG z_R?!x`sx2t&nUw^30x}M_issLZ~p!vq{Z5Fj*p^q1+dyi0oak2WS=PL{?O@`n6A!b z^Kx?#0^u&sy{5H?)G(xSQTAi!$Ta1BE@W(V@yPaD!Bf>q&e|!XAJ&qOj+3#;P{TxM zU6vt_BW$YqmT2@ldQ$e&k!#BdH`Qt+k`vb|_J!t!t&YRaF<^hNp?kr&3*Q2DZbCh( zK@L}Gq`QH82anwN*9Nlq1q$}6bB_dKzy>JU*ySHEc+~uLv^6}U}tGepSAEA)vGUf(1TP2g33|6oP84}BILjYr2>4BT&`CT+|WZz8bF zKV`*V&OMOj@sZJ4yBpD+#e|)~;OMYaEUp*!rO9gJ+)Gvfi7uBBJYu0-UM-)xJ$A`I zE#BXfbksuCdRn1?0+y03sa(zpi^tfZ4 z|J=IznlVo)d!c{K(PI3p;tLIT?^L$l#jV!&!jmzt3Pi+V+U!?U(Iq|2OwET8D+ zwOB>>^2Iqgq)WLueUUNP{sLF9ceNZ==CaWdK*DMk6_vI`&Y}$FrNihMPHlwPeQ7!cbcdCJF zG|P!2bUbqDr{ldqD}EVXq3&bATLJ?pqQQlhiL!_uh$9w+6f$Iriw(h09ZW1=3{9TY zO|aQv@xT@a1rY?UM{F9Pi?I6`b~{VBLr$jSaZziE9sd}PDe;6MccPN1jLl7t9>2V# z{ilKZqYwJ}{N=3s68YuA;?RFx7N>p|`J;I-6x0i(O+12%{892TMjUB%H8{*-BFpc{ zI|^Ndub%p(K#>Z`g@{&T;c8F{6}Ai#@ZA9$d0O%Ta|$qXLW*b%C8H+C3cyy&9x+-z z?X4Ohv>T@<{P(`(VJPEsSX5b>q2;BbllCgh0!#%=V6?@b6^oRpPX10M*-TEbSjyjU ztCScpNkV6I6~S&<2y_uR87ivN!{FCf2~IO!8x`CuV>m=9nMG(xZ>kV5HbXS{1s=jA zsoU6fh#0x(?gPAIJBMF;Odx&C=6)Ot`?de!iU)+DcwMyjs05U#WG!cQ=Mr6qM1+ai z=c^t?Cb-wQQfdz&jK;G1#KtV8|HNjBBAHzS8;qdR(A%m5S<<|W;R3cmDr6*{VTB`c zRi0b>5U)REB3}l8Yb(If1jdDlnR_5Wg8j?$$ia}E!inxF>B_90tH*Y;Im3bG_TllG zX1!;myZYG&6)VcOU9jptZn>;S8MR`y;>sRpekF zu0g&$6TR++Vek*RsRnqspVo7OciJ8g_~{^~_pR*7@HcZq({?&HiKC<-HHL#ryk;McMi^ z45UOfc?fm#PG?-0oUmt50X4BOACX{;P0TXnG{JHb!EwakA{aENmX>Pu4owun+yCo< zod|*os|&1@IPyqDaWId+^5!L!xH$W|WPpS2p#bq?V!=1I9R&nczsSna`pwsOUc{L4 znpf4^*=}J9?g?N!iVoSzXg9XPZ+$SQP(4-f@(EZ;lIXlVpwTR^0XBRTIli2l0cuM4 zwi?FIn78zvmlAte?$_lxzFB3QP#yyn9q|t?FuEXBFy_^u88tK{y%~u8FxxNmiCHc- zEG09SkZbH+P{{mlmHC@WRlh6}^75=pdh>cAP=mL1r6qu_wmkK@;l#YTYJ&KcpP%=p zp#OEOBSz)9zsUD6vMw1C*EW~K1x5hP&hWb&ugRg)dw2NDUg;4a_YV;IFLVYMImgjEvk{RHYG4hGk|8QZ% z;#x`P&3|0mNq%k+<#n4+e8t8JmP@0>?_2pP_nfcVu{hqI?dkK6v1(6$y|{BJGFCZ$ z8Zm6_SbH`>!Q^Bfe7i`qCd<6}WDyV@%=NOhgm5ml132bAdJ|MP;O5Y@mQcT!!rvMjtAyR#DC=&PVlM=(PlR<`nLJDB8F_ zN)B+iw}_oJH3cXRgWWln%cK_7l^jVbm}?mV0;roR_^6M2o#@4k8!-M4zvr%#l`78r z&ZkE0)xAgqQnW`qBB(uYM3;XE>q2(kQK0}y=hN!}{p5gC*8!o%?;R%kRv;bGJ>nKt-W|XkRW3am-E3%7hGU)}0cGO7NsoP2Nt6l7#NuoA=le zC+EQieIYHfzsRNrQ?RF~ku30dvi-7jQT zgej0O)YsyDdUM5=1wH0-z;=hnaZ+ro6V}WFyJ_aph9ele&lB--G9hkH_51`KN+>QM zL<&{~Mds67a+<`d$I7Gkvz#84e=STW98eng$3CCzy@AVgatGT2MMBN1(yj99u6`os za!&V(RlQ#h`uQ1UQGVo2_opu%yoKmm6T9Bs;hzIb;|OC1y`r{Y>IY%VFd|5396mJj z&c*EwFH>KdvugY|Zv>Q2aiOyRl<3RJ%sq&!QjAw+#a-Awa-6b=sD!}0m#_O_#dahu zn|z5eOdz>j>%za*$`e0S$xmsges<>`>hc%7iPK0d(LlL>dz7u&%%@E%hw1i56Ih0( zyv-VNziD?J)9>nPt$enTQ$JE7zE#Psd0YMT3Ri5gLl*eZknrJ%3^R67h9W^5*XxU+ zLdbwKEPcyAL=G!y z#w(BHTKC8!1(uPg1Bo$Gze8}sR7C*6+Z;|4kE!In^vb_&l~fmxF2yZE6LDBF_Ms}l%4Moqwt1SzV$b#n#>z9mkJ z$Fq1B&5s1WnVkImB8w#sMb?K})b^c~=^Ju^&V>uw#4uOSC$-cP-uFpfFrGS=%a8hI1*lmkJ-9!3>H4!C5Qm7f9KAC zfybC}41qmjp)kpnn zW3H!cS-V*rmQf%8Xzo}U^XC1e*bjY{x*B#@#0w*RS*@oWif=5K14ac(ewCGyg2^c`7qRzLsk|sD;|jRO+zQH zq?~&;uc)kM{k-(ykU$^qZ36ns8UC``5djuRsN23Zl-~(#iMPUr26P=z{g?l7O&E~=i|Y#J4J2SYfYI9yz2 z6&pD&L?XuTQ-$0Yls!Cg4Sk=5FJ$F!yM6$SqzV^MJg@wRUrlLP($B_jT_8q;Bv=wm z_f?2ta3?1Jw$S0{*@8PIQtW>zFv}8@UM$b>Wa#%}rtAv1==eXq=Vcxp|JIxFhh;AI z*?|F>E*;gYhLrF1#zZ6s5JxlTYo7#8-m2eHM)qtrKri1sdFrQhvX;8+cOqOIDlE10 zxl$Z5W^clCqJ90s>76>u4Mr!*k_lYYJ664+-|rwmaMXm>hj#1g4#54VvHhh#X#PL? zeYqwlmkwNfPFjhBLMIk$-2e89O?cU2AN4GZDds8!iE-j`o^YEnde^UL@)|l$koj3F zWEhzAaFubUnBhg0z0QYiHoM5zRmbkbKHV0Ysa_I7pt&fq#$zwh$B2iUG(Z5zM=4(D zt*|Pk{uPR-h4CnjtapkDLn!yj&m0a2BW@uX@)XHQiX=RlsfZWV{95>*=RF%kh`*J$%Aof#WSzI=De;ER8^j#2<*{ zK8}|?9M30>3;5Rk`GJr|)uM0W+vT7WK5sd)C1#GM9U%5f6`EsZF_g?(d@-o0*CPH= z$;n>Bh)*cI*87e=$tFSJ_lM0skXuKfPt8cU#v*mo zScKy$-8bR7b3C}TOO&Q+`7WO4K~VAF^Al-(r8lxSgZhL-(Oe@P*0F}*6Su0X*BBrp_5!1l%Yyyu8RYavm&7*HCd%9YEa;$nbUuW_JtvACcX@wIXS zI8cgE)12WIvU*Axy7KAu(mVd&UT&wdo@|O;Df8!D{v~gDG7***K_d%Dll*-if7@t` zJ#1D>pIOtIt1}3zWje@BR_LyE^PA z|2?9;a`gL?RFt#!VRkIHP2GtXd7710raX}3+lI*jyB3BxV!b{n!m>Y4L-nm|WUP(E z+4z?4#|&zlAT7PA5L=Vn!MiL@Pp$y#kA&di2zzsOj@OOuvsTvXy-}1v0>o*`#E%*s zX?R%@`X|ut(K}koaSC`jF8ICRZlZ+e|8;N{UQKvy0A9j?F*X=oV;~X(MoK%nkx~&* z1}ZHrKg1fNOGZdYI6|dCK&8~tEg>!9Xb?og00j4WzCYofd(M0AdGGT)1TdtmzHC+f zVsYmykTJn$<7pY#l?b>PV%>})og3mrJe&3X&&p3(A#*zBO1XUO)=O_j=S?nx#kyV0 z9QZweE%os?<~IW2^M_3@HGsSNT0?3^G<_XXyWOXRyqkvV9o*b3HIlb(@1YN=U?#W_ z04jQ1SVcmpuWI1OeqAcdMj2xMo9*fdH{285*opu26RbbjB|mQfQ;bO6VuqbLDERNg zKToKV*IWv9)Zp6sj+69P-|Eq(<2j+oM?1$42_!_I2I&VwQ`!L&_D+-ZK>B5r*?GeQ zrqaf)>gcr|gOQtEOh3Ta?0b~(NlP7*_sha`tAB!2Na&M0uOP=cu7B(|jF+DEV6k9z;^)T{=)sn@x@eVzHvGd5{Z{896b))_6vsd<@*FfRmpIJudhzf@FmXRH3! z`}NL&Ooi}H;jTAs5});Uk80x{BF7brmo z$%l7p(D}c$IbRB||8lwa96c76;(UH)h>P)oH|M3)e5aFIrw)XC;u2o;<2DG^vRVsK z98}Wvr=DB2)dmT2udIm3P2W-OQfnuxjK2N*ouRtYs)qv+gg)w#FnYoaPHvp~5U;eI zD~zzQPH{I%;#KsRXi8h|d4PnOwm`)6s1MKDK6hwNziE+;TZR@FQ6zzIzoqIM26zh{ zN8w1dO5@#LixLy&cWF$S-XD`ZwGAypIT*P{_R~9KW&}XIeJ$@ZK{d>swY;Kj0BNqbGi%yAhShdz@pT8wZf3SA(ummIsf@=wf({p5y@e9$ow{ zA;!yWQw3&L9!>QLjZ8b~r-o&+*R&NOc&j)S>o#_ylZT})LuF89p6tVmuJ zd|06eG(?S9n=P%X$YX(bH_D+?X_ZpVD;a6p+)N-EtoEi}+UCmUlcmT%#efJVypzUO z>vzlc&;pCTJzpreBWl6gkig_A2Yv2oY5XQ^UDy4CxCd@O^u~#)LJqT=pcDwa{l$W#7-nt z*oM%lv|`I0M;W;%2P2D-Nlo^0WX#KuFB$Z+%1UiTc95bkT-_x}p%T~muKvI(hU>Ap zbd~VgIdTHk>vY!WVg_P!)V>H?s6kgPPN*2RYwBg7Qy8mip zW(=eb>v(=PF)b!KDjAe@BF)hb{Fh>lq>yBqL_pmf&P!_ zD4-Wbw~@98$m5UG{Q4j2b6OQN1YTq>Qv_mjD8~M3O7UmP9eQj^Rs-wt3WCzk-Yk?5 zZK=)s0f`G-;6x%haMAl}ILiiqsO=55XkCG&iW{eu9 z67S2XM|lz{r0~WPx1c|<>Mh>tu9{Get--TKfAx^w))~dzw^=kzFWN}mzK}K>P1YvU zhk2UZ+5h1T$^+76-Jjj0e+pgDV$lbC5iu7IhHmNzdhyuLL}9|qV5tkE3^rv>8knJy z#M<`a(YZ^}+#jV(^oQTrJoj1zuv5-RJ1WY62%W{ow#EpX{mHEG4lW7omTj;bNbo~+ z*qfy?6J8d(fJ<)tvqL>{FhHFBP11e&`_gB{$q2JHF=G<@nR@CO`JnqymfQx@CUlZ= zN*9Y4Q}^%1hE3oyF(sQTvE2`)~O^j$_Nru_De zO{;0xM1%Cta*iBy4h{zTQJofm4rX(8Wl>|IA>t|@kKIUBe1=-^{>+FH2A72FGoi%!;6XgM-(Xi`nph2_LO&AT7xQ(?5NOMqFV5(a1!h+G3;^T|%RlUC) zmb!Is0gRK6{5QQ7!_hlK5JCQLOWm^4941nb~CvHnXca?IDNj-p@K!vHprXUk6( zm;G+B`-uJ7HV-#fQ^FPt>iIA0AD=%D&ro6UIN^p?kZtLUoUY=1)j-_ zT(WcTvIZd^i}B7BA?-W3CIEtfv5)HCM45sPwe>gvd!j$6-I8Om@@tc&wIx*2_aE@- z&=lrsjOgJeu)8zS-yHU~n6IOVyE&34wut+tqL5OzbdRhF+Kn`dt%NOAkOqQ=Yyd1a z>_4r!`WBlx14mrgu&f{^#sCeiOy+&#!%;pK%ZUY!w+E{~`jBNY0xx2}6PV`XCS_x- zowHHrkf!yaAMp_-m)vfO00=xa;Edjo{Se4kgkU$9;fGd@NV=Ih(%BjxiSs369+e27 z?81*1)%r;MYH2Gg6|Bca{8>d|(U+S{ghH*W5Ae0g_4hOO%9+9#YvlC+*MIr;+B#8 zJ?&?NrrF7ub?9@sO^7w=#qy1)=XSs$QOxizIoO6A zzE_N#DPM-s5dzr_cj=Qu)K9s3Wj-nwI%sGe$o9BN@|2n@>{tjRnv{NwZR~76`fjP3 zNuMBgN=+O(Oj;CB7n#g%SvOiYD@waI#FGKs*wKx`8y8UJ7lb>!L8|t7#a0YZr=q{H zJVc^x7i^b?`6LChl!{wh27jD0CxY#r_amZ)I zZmM!9Wc!U67`_{9-5qlI)UNb_s_?j<9HiR_Sa%_967x6GSl-~uTX%e06}DqgH$MhF z(}}Hrtd*%Eo>l5RvgFK-cgX`O?Rju$sZ3-7EnYQR3f{VkdL%3lH@KY&9z$PMwz?=- zbC_x79{f}4=%UemZbxvItMwV&_(vjYMeC7)8#np72AP@3%e$?Vo#-Vu+2>SWgJO|Xdq1ed!oX`6rs7}G=~|D0)~@;&?K?DGmpCtywV2Dd zIO+T<1Ii9-taC*?6{*?`RWIS+W|(3xw;#kvJMW_|Txc40-(LK6wnkRb7XBr88dsojbOi_jKiz-u9xSmvuyWsb!aan+GOr zN~qTc*S2`nG!o;?6q{xdo2r&dNbpXXbaATJhL<~bz82w}j^pqY^cQpEA+R!y%j#wT z>Iey|j&|{GvNO~`xf`5`)U4-Ch4}s_=tE)($?DHKn{Qeht${uN`LGG<1)B6W)ED^BsmH%FH2zqon@24ZouEb3{hfUClRE zLuOF}Lr3(qBO@%o;*NOmxhc6(Tb%6wunfbE|DX(7yYa1@1slcSSM9!h0ZeAi7hFAL z`@ZQf#Apu?8}IAdzs-Y`L(Ho-@m@Rv!o0q4GUx7WdhF{0XJB8pqTW znLBylxBOCEpR*rl2+#v?{RQT*(DKJ}Rl|Y}Ec;`aJtg^lvYgV*6dQQKXKMULP!WAoG zZIFBJ1Lrk>rP7jnE~q>s;{5v#Eysb_+lvDJi|o4X<`p;i53lIt>bZAhOTSCK-M`%6 zK!@=>(Xu?Ja9^|fC?2zP)FuFCImQtFmN+r)09bJU7?+{}3WiWKEO(6thy8?x(>MX2 ziscsP1jK8%B-Z;ic3b{&G=#nwbWb2#mt&+G9iVcjPm1;-!jt)GKlC|ie&o}WYF*qMd<8?03UeMJcr$^OI#$6t}D6OBD{W zq4}=?O&I6C7-HTXP8b2EeOLUoX3?ONxI+yQbznax{i^#Y9qjb#O6fNNCH^KGH~;+9EL>c+2w_N(v-0i;*J=s4#R9t0rAbyZqvZ0tF&mn9 z+PVb=Uh9|1V&5L*y`8oA1Xp!p)Nl{ptJ#09<`uklUgE<046OswpJLe#GABWndq(0# zB~4LZkkwnU0DC#V4_gNCjP)SB#>>}K0p<-})+LL#tl&QIfRPRzlbX>i7#3EZ&R3T@ z8NKhM$u_Uln$7aNlAPYz&bQs$8C2}JPq_>Db`a!=KEdX$eI zBH?E^oS3}srbV28^X6HAxI=;Vt2^Szl`Bq(PKrtaZ__+Z%P^*kCDtVW(ATSVwYL-` zPJNQ@I_uKME5E(X{_|i5#4@oW=dvFuepxZ0iFPX=5I8UE5OYE9k|OJhTn~grg3W#M z)45#Zfig?H6qO^KHhrM4%h2~!H0}MwlM3)D8?|kvz(}w5^1Hu1u}plfxT86kqEgFN zGJ|S;dHDri_bP((lL9)OrECmqK7gyX)pJPI4oB@JP5*mU>Cne^<<@S zu9bQk=1>1IK=DXf9$&w$FEkl>cW|%MYF~f!9C)s`RdnDFf8AEg#aOjJ4$7}vXF1@%7D0kLOy9gg9t4gOjFoA2>kBSCn3Y_t#O7wl^vKI&+PT}$`vUelU*L2llGs|3 z*MADmu99c&(6)uY^iRf`(O!$s8{&6cS4-E7CO?wr+h}RPfw(WSYO>b{I@Fd6()qmV1rJR0CW6s;??9Cf3PlPmR-7UQ0CPY|D8qxPDJ-7Gufh_Fpakrqb z|FXTuu~W@AT`+iZOW%2J`C;Ix6OgPgYA4!sk4mT`07Xg#H1EL_-8*fVVWIkxiX}ZM zLR#iOFc1!)m}mjG~RBnmu{CMHa<#R7HvHVsw{Iyp>DxhV#TZ2B=CE4$%i z6gKNPC79vZ>vQ-aD1_A)m8>3Qe7%D8f|*caAk`yLR%`xtWgw<3U+eB)xMrhQY4P(* zZ(GKO;y^&;gG1V~KhO>+G8JZ#IM6Zk>WiA89nEq{N!iy4f$RHFoE($qtRAARX=%TK zNA4ocgHVOP?4Ia>F1Hwbow}T?o2vWv_@|YH{j0BIcBESRYW}lR$}J~5?V-82txo~y z%rlNRco=RH3ua+uqe4hBLB%X2=8BCOnJ2i^iZe#1%rP2L=ALYJKeM}&#A6)QZP``V z>z*Y44)*x&i<=Vp2JK=+mkiuKPuYkvQdmgOLhn0kpu&ENn4tY!PPr4T~7jkj+ulTBMb-r^F@@#=d*ts=L7oD z{<-?(jtvpm2n{<%y3S1zFF6(Kx^BR#(KvVYZHx)fuU3r7BuFiYB`pKug5uEVp(%f` zhLjPRrIonD2#=}3<%5d$<;c&Klhi5O=P2&FvcPIZCqRLy&Elmxf7{(`xlGrXUp2Q6Ul2QIupO4oa&E;1cau14(Kq#HG;NywD1VCE?DU#mj8Gd)$9 zKet*w0U=-z6?{Ud2(qq2{fx8{rldnG^0EshHtxE?E4}<_ms@&W!$@Vl>$m!_seb6! zKaTSp(^*CmnWIXwBK8elQMg8UAU}*~Zc?r}Zf@1))0=T(^0;0$pj0suYF^2`*&Tl7 zZKLy+T8N3;9ZK@;DQsSwvO5`_1+V2{RazT7@NZ<(W+0Iupi$_pqHLm*`r3dLH)W~^ zVHDv9y!ukLwD2B}NAy&zsJzs4;P-AS%0klgR|Yqn^{=H;9X6y=+7deiLZWjmy<@z)ROe;3~I>kIsU~!^`~kUIykb=f))j2$IT0mSkC} zWQiT-4y67nr@a|T0t9PM_i~fmB*ui+NU+{6iwa-PWzy#9qcL&PBYka6fofB6u|~;g z0;i}i-$jYcpEyq{>zr`nV(sA=75|X4h`Tl(?G8%@xWRf~*fpgwY>0T|V7M3%uNbdd z)=4VG$EbXDi^r@`A`yNtDAt3iO$rO>Gmr0{T77&p^oV&Of>*iChEIg-qs7t`qu_Bf z(JOrDf@4+bnHcgTX-)$3yp0Ioxq4xE({j?|W=?@30Q7vHxS+frlhCTViRR93D)NYi z^cKev_C3{*X`LjJ110Jn)%bp&ZRZa%L}HifC@F0``EQl+Fs9?7@*JmZqoNt!B{(m8 z+awW&Cwpq|XYl758Ugr(?Gd2IHg#mNuVblJG^MQil|`QqXI`C9jIzZeBKg}^1)H1B zs0Yt*=#9qVO84SYTZT*(@V0#0R6kU-qQhZn37dZ?g931*KR1!fjq4x~`D`R!80KV? zJV$NtUvHe1VIO0Q=&66iUIc0Y?W*W>$EvYk>|%RV2K(F<%bY!zSL*SCdtv5`)tNmb zkAHFWn%N?(EWO7_u7ORCCl)UHO@_y)NDBlZ^OvefOY6HuTKUvvdb+%@U>;-5{gC#2 z^Q)EUx0x(}ipu%xd#U&Ln|UO*O%MS`91nBm(wwZG0iC`I1kp6KH*?7RZ(v&cKzDkqnZY#V!`UOj@3B7jl!b1R18yZp7k67ad$K zhYyHSa9FynT|>G%YTeMyeZm`RB6n38d)y0k6cc(HXcp+Xf|^NSTZSw3W;t?jzF z%@&kAUB%?&pj+|BpO_13ASm{&q2@h5PDgyFa41X`q8q-V4o>CGf2OC3wX|;BK?u#q zB>Y!RVU=~{Z*yEQ&39>2e_?&|{nH`F#yK|S|2ye3G4axrcJ@$8yQVVG;QI>Pr|Ztg zW(yI##tU~e5UA4&H(5zucKcwszGd2;=;a7$^)-uf!5vbi=m5b zt~hal%{r5_4=`dls`$jj-vTLht0uN0* zdJ|WEb}K}yln*J)7j$$v`KrMaUj2WyTXngj%oq7g2~zd#t`C|lqJJ_kW90Z`7th1P zOBNsaS6UR|H-bG+<~i>@hcX0`-a18#m&UY{2jf5~1jF`ePJwog8A8&F&U;%<2F#7+ z*hH@%cY@-|;t^93T#4_Gm)6w0<(i7bKsNxJ-Ll52Dha?1wP%8jIcn1k|M!N`7v~Ht z7I|44plrYA8@J&tE}#DPU)7Fkz?UHznT2s;*B3vMzPDW-v%Ly0!wPYJnGJ(c4g>z2 zv|bizF-s~+tcy)}SVfFIr&1m`vZdP+%2$s_7bC)A$^;hSEoXFQe}-UDN}qAncTex`B86oDscaP2rHKpA-YA}1vL zfkq?Kr$DxYsOu-!$?Wx{zy`S9rKkwzn1Bu2wo&rtDBST-zKE{VdH`2@gSsYV?-tG` z+z8O*x^L8Xg`E@~2!0ref0zx8OWm-|t}|jGFmEE+FRRKr?Yb6YNGLb+*xe8)ES@X{ z^=?w%{g145gOO<42>*p)$uMQgXHIDFGCLjh_^?Wzvx(p(Giyy5g>4|wFG1fh{@6Z3 zi79~1Ch??!Z5hLo9~+-!e|IY|au@|wFio2EGTQ?%xfubBDey&`@V`nd5`>s#`a_O( z?Se@}jmOQ4ge$_K0Hc3%wU<3|Mo7OdvB8dQ3?H@N1z~xf0&ce2qcBUo09VivefTgQ zavXLQrk;b6Q|9__6cI~=RRdCc33@+F?+)3pf9?f|t}DEwvM*2+KEyyFCKS0%+k`sX zR&kb{Q8;@p=7}Sp3I$HjMg<1qktEnp8xEmaPLTv1pDe`Wf5PV*l>6|APC@{Zz%;YL zNWbW9Ry=y2kHWl1gXegOWl*F3F@au8C|AlQDH`X2V`_H^+Z+j@uO@c0NpFyjC_rXl z>K2>NE=Q=|69s3%Acnb_&$_YsWT?7de}yL?;&BpbzTsE{+FZl z&&<|$NQlKc_((3FCtc}%&*K-(XR;*=(g^_&0N7GPwuj1oh+$b`0o|Z6(&;Qz(HO)X zS^>_JV~&uuBnDIe=sijQcPi_d+@}Tjr_2~g=$kVwNcLY;R$KfHhe&86k}Ce>$|!*; zZb*91A{p^p+8NE zEfTLZlAsGPpwcl_HA3t${$G#Mt|WnDF_3)_S(E@|>!bPYQCW$|4EufP>s(9=wPa(L zX}%mBiAl0Fe{pq^BOR05+5j!>f40-i8;6H7e-vV&f{7GZ=Pt)4-mia+ZN!`P9i?O% ziP+rb*ubzj(+a31P#+oLx;psWC`bP;lcy#qboc4)L`KEfvjPVb$p8wx<2Bq$QaFPO zy_pd#P7F9zgCFg3Ez&FB3m|p?=p#J5VwZ_X1?M{PNd!Uyk)^!utUXBf9TFme2wCXk zBGL=W2dc*>+3#Qq9o!%Zbasvb3JWKzCkBcmJ(J1K&;-=(B^K|nYT6N>^2?M9wLlMA zKtxROXV$u4Nmh?1!I(N|0g=Py_}Ms$H4G0W5Fh=Jc{x}Cvcp5e2vk_)@haDOkgdDZZj?dbG^homsIGYDZ{Lt%NEHHsrTFAHbf9^`>B&qmjUDOL^l^1imrK za=cbKP4IgMNS4m@8^^y{9Oc*xWD6id4!#mEpJjb<{N`!p-9{wLnO5<(92^iB&`Iao zK_WV*;QghCIuQeDd*h&y~ zI#u~jfIZpb?KBCVJWxiB@tfIVo3wcQUPf*K4^I!Q(zI!jeFMF-TiZ4Gjsj!PrZM$J zypu5j??yn&lHLc5vb0n%Du3b8{j~R|S?|k|+IHt!W!``^>!5xVn9-+q9NLsN0^1!L zlOv^yE2*8os(ly;)C|1sn0*_G>yQv=YNRopZEM|Qt(9(Vk4dA+xRjmEhc(ip#c{8% zjzSfR;V26D3k!QApi2+erl#Ei#sd`6*#JnO;ZRq(PnUiqyEUz|aF?r)2$CdqI-GDs z5J4y^)A=H%s}wd3A}D#6%XX;Ke7?(fsPqCHJ@9WGISNGq0EKiG0JRGY0BGcc0d$Bp z03f-`5$e|k2<(cg>I!Y^@*C;{eC;_u)*C@#^Qr5V1OQy;p?8zngYwy$kwBA^{%ulU zGnE-I%IGv}>r1H`czVRkpIq=8EK(B0XA`zPJ! zi{SUSAq+s@)w=$;?ZK#fef5_8FRFUl{f6brdyTaLl7QX>ZNSyh;h3S`H&ufz+5>s{ zy_5Hbw=9#?w?DWhv-<>g51nw#P?-zshA!f|t*OimWDjv3T6}LvgTi*zW@tNkG$NNR z$g*#SGRnbTw@m@p=7XK!W4tM2{MBQE!(+nLB71=yVshi+R^w-Gjh{^!m#!X{9Uhna zHm<<_QBm%rveie`lyT0Dv5%k(wc(FC-#(sapU{(=FwmJm(wj9-u?eHLrox_>zzNG? z2G*Q?(qwJIo?YDT)+Fnt$t$0+j>D6=uO?mJid_5rZUBI8IEi+Xo7&WydOQIo`=P^5 zxS9d~YI4(zz#;RXX%oF^{g>0GdSiviUKgP#pSM%%V^fZ3pk&~vL1br0!GPu7OivX$ zV|Y5vYEUB|?L!%2*z|;4ow;y-hMG1b4(_sCWI<8pdgeRB3&4SG!|6gmYhtd7pLe^%?e)|lq zF6eYR>HU7nQ7$)NP3Z&^x+6%l8K0qGOh5Q9S8`ofhA`0UejiMi?$LIaF1+wmaX~C2 zQTruyT@DSlq4&=(ywhHMQm|Cm*1w|-C}`_D8D6pwTGoqXKRq1)6@oQLopx399bq)Q zW|oNSHnCjfshLOjEebF2i~i-Bob0f-Ud383MNo$?%rD8xuM}>t7HAJT%hSJo8|szo zue4h90jv$+d-V}$Lj?LuK3g7+&i$9mbYb?_^olit+vYEaGoUk4ek00yBdVqumcd;3 zXZF7x7HRp#>$=NoJENY$o0Of|(-W>!;YF97k?K>9ZOocM&Fr7IjJ|Es%9C5`jKHoy zIJ&rPv3Pj>!s7Y_=aMXC!%%OXun5u72I#z7CVz$|W7ZrWb#lwE(d4%++BzS$Er9E` z-v1r;80tJN7}UUY=cH_B4R@McTQ~p9apPpl=;Ae$8o1kUeVh2JDDsy~?XPWHW^Nmx%jho?v0h4k=K%go zj>zcvt=|11*f#!)Kw+oP?l4oqG0_iXjo(ZjJ&yiP4}5!Q=Q30@GGjRQCBe1Z$*-4u zi@r^rd&XF6{{DUcq?^V#s;Obtt$}avPFWLs1{4O8N0*(nM|DNeWsDgg;s{Xq^yByK zih$ANhdrk$n}vIaXGM>;6pu159A&wpa~a=;gn%7|jQJqHQT7_9Wc-XH0y*=S{V>~? zARo;favG8@o?QrI@EPr{Y|_ss^RYZ3{!r-XfcXTk2JY7m0#tc^-Wb||6tSpEwi36; zW3EDUFhO7WG58xbv68kGZMh$pJ7PIPq`16ouZ+cTh1^Lbv40}vOL};y#E)KwoV}W3 zExe2N>~I+fHfnqFQOu$#X!S36?AFfJwmUy}RzFRDccn!_IV9W8p|aWxWpExs*=*PQ z(r&ec^ufG}$p-DKF4wJDfzDqbH~Yp zcMke4LVh?5SGvEvX*{D!kzE<0|Fzts>pw3+O1 zpp{%^Cy!mYHZLQt8cf^J=DMj8{3dz7>!p5{{txzEI-WJDZ)yttqvy=`f#jM`VPt;fVfI34Fw*lejk8LlrS=Fo(;3C84K){WVj0{GXn^m2@--SgMHWw zm_!)%g7p(=<~aYvF}1qqN@CM)Nw4I}7h8zdGY{j3V}wN-D*Lg-$`Axl*;LN-23AqC2bjmL03VK^*U|VC^~izr8moZ<8xlV4T*rvv^_$L5dEcup^j z&q;HGfAj74m;HwlIXX33d~*yxn{Ty&o2kzE!(0qBW%Nb^cjGMBy$_hVAAU;qzdt+( z3t~bN##5~M!F{gQv|w7hMtiU_3IpMtp^c4o1)ou*o5)K^9jE!r9Yt|{;NvSE(<`+` zsS};7`!YVv*WUl0XZP#%e+II*YZ*HC_+nIlq^EvQAi$RzjNyTv@4no5F4N00VCAJu zN>?mCM=mxeBcNQNK{aeBB0tZpCxr~BidQ9C1WMW=)fc^GnfRCMTL_w5;p7x}(6T_1 zK}&AVn9;3761OL)`{?ngRx^OWTl36BN!15qTO~FZc-UvYX`^#5-au$=)S#`cGhQEu z-RZ(--`Lb6_eu|XV>;5Gz}dySDiR>IN|N6vRvsIVkKK_m(fs-nnX+zvO(5^zkev)p zZQVu|NNnU+*QINz@2z%j_ocgFL#!Yg&mQ~1%=~&@gss)Za(o%H3JCis!~m=>)5=rt zg=VBbu39;BUy9d?Jd*Jr;|N{#cjm>V;`B(?KP>ta!D60;#&kd2{Ws=N3jzr^`c40(yskO0ie0HPMi|0OuassQY`Ra`p z3Gk4jq+@2oJZamSuNxITS7eOaB5G2KFIMr$jhs*PnKI6DsIjg1e6DkL_~Fd${8b6h zb7SQn^7d_B1S|GR#>DgTIPC<#ec30tm`y{X7`g?YAz~-FvRrt9^@C)BQ@{hp9$f&^Ln7;3XsdFxQ|0-=IbD z{*J1QxbJNiZmV}@n)y_CL7NrXbwy0Y%@;Xv*W+$8UlzV{2P;{xRGHn9q)fk2dIwU< zb;~{U>Kxo!j>YMF&FduPpG(_L{y#6@Wh-`7h&(4A;mC6LbBinJxsTZT>i3_GzQm*C zi6*WOY{4uI^KaEJ#|!+Gh|y^iF?rzF6^n9iQ%_FgN)7MeytEf5r~T}nUwx-kR!~yX zpu6CO!*08X=(F9u>DE1%-r(*%%6iMP6fh`0_+=~~#p{M25C4FK(SBxim58+KQQF0+ z;A}?vO$Fc7K{rX|YcwyHwayg&VP7W2yxT7B=Xz%qJhKiybMAqiR<4ZPT?=`7dg4i7 zb{dV63@u{6?`3$_X)MVjv_$yS6CU04ff5~yz}@$@^mO`|w-)+B=hWLK&S|1V@^-n^ WeIJJxPLq{8ji_TqZy_cKK6IsoVbf9?Nq=HFdP zLG7;rq*67K6<|^dm{cH53ZNzxP;v$GuUq}~N{m${&Z+`Ksl-t#tgNh%_SGZ`6=z>9 zWnYQ^>(149=XwmaMZv9F!L5<(7E1UFsEtAZP@~opsr6JURV|=}7|@~{&`1hsB!;vD z5kesjryJ5@ACg24sV0SXl0zHGp)FRSEx_3YlZfun&`?T5i&VUjdLo@1+iMlu?Ht?g z7TZZUD|Cx*rz8zh<2wVAt~w|6QjQq#vmQ@ee#CL+>%Po($mQmG1+!u0g?fV}AwS%W9?T0#n@Lki~N^9G$ug-Hb? zXA4FmN*CfwyU$)7xp;NtM8(3@t5+|Uj-{54QCfttl}p>HYTK#Avz24%6=N4G=i;kZ zvnt2d^Q@BUS1T(k^QtHEs;3L8CsG^d^6IBAwrr%gtY2-MzS=l>ODwofcM32&*TA z-D6ALW2@a`>%C*Em2<-SY2nz|SmU&?cVfMBdbfT-*fJ;Vp5ASr6Sgb}N2b?DrZ>i> zH#+~~xsC1x;n>{z*xW|%!fxl1P&hI&F}E?eusb(5*SjPfSrASvY!5C8rx!LxmUeqr zg=0&*6HB`ztHSA}Uvo>_W2?f6)!mWxzpHS1b$4!cdwNwkx4OHqy1lzFv9S7Ub#-;= zZ*pC@u>NadeRpA9xU~LjX?=I~Z@3{`+Spy%5Uy_gTHV-P-4L$-4Y!4VONHyJtJ}i$ z?cMcl;l}pv_V)JbufISj+}POuoBSpGwf$@3*Y5WJyYSa9;otag(XZXzU%SHHzb5>D zLka;QO2N5_+rvakY6lNBRrY1#RBe}?>Z=?MpB&-@oE}#>kVUY|R&Z&#Gh9UUst@kq z$ZNUFpXPJL!x*DC$fwumvyA)QwX$8S3qX@?vv#A`XpAGZ~_m>$o(b>O7$ zJ9KExpu-)up`vSh!|X$6mz8l_yPj!~^~GW><9m(o0)Al{-wr-9uweeXF_+{uh#Y-{ zj*1$#L*M`KoTI9vh?vZrt}wn`TiT*N!$NB+Bjer{1g^0WYB2v4b)APt!9GPrh&bw@qiZHTIRz z$Y*eStUqUu?9o@<7f0fAs!C>N+g?;15w@GUt{#;BpAdi(Y0(dQjNTr7s9QLnV3E#+ z54^FO=&^pHF z6oD-sH)9U)fe+}SnD$RK+K)`aub49MJzRH<#L8i(BfmZ!cTHFp$at6(kGme2RI{tP zk!v=hrp=@Dy)sHfmQ9KrWB>eEb1}atvxMBiPuKcw_^|eNZB6|h?LN23Lk1BH;W;m4 z0`&Q(`x|W#XDm4YH=y~8h0Lk%mw9nVTlc^4Y#BwtG28o(9d+amZTXg&xKF~EUjNA4{M&>i^l-~ zh`omfK#$#p1ENAF0Qf3VuGsSVheY~S^Ks7eYdaZTg{lWhYu_~gm>4$<+@A#)qIDrQ z6kyq`Wf*NDNq30GoZ9YtiFvfouWBO#z2!-6im#OpajB&S| zrxiL0mzG$=fivfRen5*$!k!)Z02$SrmtWX^abqf#ggDUeemeTt3&kx7GtATBKJm#I zrl=&u~Y9e7nA0n+A1dLHoK@c z|04%fH~G=FawvM0C3M$DJ52y0IWkU^g-ALQy8cWnXoX z+@P2~c@OTqHf2c5-T#FKj^9h>8a7P@SE2P%L_BZ=hynf{HrhE{(K54Bz1`C^+Fup= z?{!CVeNW`Qhc-|zFT@@wIM2;QT)WH$YeA0z3;?L~(`BSmI)M91&LH}KXUS~e(ebHd z$U%mOH`BxLzc?(BxG<1~?zZC{jt|z&21`>rB^kh_c<2hCmH0b~cL0{yPDGJte^U`} zs$BBAxWkP^n)uzsL;8(mKuI@TUMEOY#fnj+yV|S#ht85rm;gIMzu#~_FK^L6mz0cB zDebS!kgzlpi7G#6N^iR3-ij;?#=O$NKUN|)PYT)OjUvxV@*ugyg{f8b-S8{Fm+Q8f z6`NRK>O;elxGVR9R1`9!oi>n3cQg+Vm_;tCs$Za2I~%HPZPRsucih7*$#iWbUB-TA?zfYtLdFrh3aYy zRcM^|*rR62z(JW2Dv{m}@kyGY|2hpArUW*8`7^2+ahkJ`T3X*czD@{s;y6Tj?HDh?hhYs@(JMD=&0A8D2-_oe;Rb z^Pj{A)?6KHb(5-cw&`}?z#NDAWRg*Yzt(! zW2hwQ76(Y=BM*?L!DjKrkqW%{P?Z1NWa1OwC%*z;*Y-kEE)V&C7njVV%*?H1QdJedX8WFLG9wH(~C=NH`XhlYxryrtZk+MeoUyq)LD06Mo z-f7-a^oU`K_%Hu>?c7{$LFxObf&K;@?&eg=vZQj)?33sLC|yiO4BQ5TZej)@&$V&Int_ad^GgUDj7&xbnus1Ds2&?qX9#2z2^eqT z8u2>CANR=TGga)$jQk_6*nJW#ycUOb2C*KemDAbZe`pr@`u9>U4@x*f_^`L;z*-aH zCxDG^SM1}8Rg~bKPeUq+*>hZoStayh)o~5dWf@4KG8I>(ff}R1BdKDu)SUa`=vlhh z`6ifV3ho14()&%0NG*m(26~6ok2+o)p{M5eB3ZChAqhKb3u(u(T1rG8IOhFqLYPvJ zD-@4IL>z()hzarzlC!BzaY1kP3Y{SziDnH^V3;9Rcoj0zBoahI?efy=La*!~QJaKt z4ctYDA(q*j1J=rZPUTD`a|X7KS~hXQP9s=Jr(u;I78%(4)Ph|h4O2xqzQ+YyHVyih zh_f&SL~t?c9cj-g9$FU4D>H>_QOy2_N&R#O4;+@;1iLE`dsBk4{v>my71u$RbV(_W zO2Nc&!X;V~AVA6?7hN{R|8)lLg$aP>!PZEqp90kKX1E3~AGw%swgp_LC9$aoV(D;a zPKh%etjaIRKMT&5E6q9!|EY>>`Y5upmi?s}9p{-F8=yN0KY?yWhgAW|G%>gnP+0K|%f%8h0~*WoUzx@@{k@x|9=;Ro`dX_hb6_9~S2txi z=Y+Gf03I9^)q-Q9Ei|E{R zKSMZl{p3(Ld4%j+14dWMOT3L$4~i#fA!Cd#9+ z32n9oHt3W(7YTdbbSSr}B3O9a?`OXogaEl*Z*_(b)ui~ds$el?N}~YAX3nK{Q*Dwb zmbe6!PrKklE3Wu~&SYH6uSA(G7H_B^ZRrqiKbHbDVm_Wp4ulhCB_>ZuhSyo7QDH`m zAaXrE2dAjKRJQ`xVohOh@nI_#z}`)0(}r=1~9AZJ4L2t;&o zrrd2Ds}?PqkgeUd4tYlxvw(pZbTI*4ESMxMwFxyTvpvLU7&}aiARz9LWMe$7&9{KW z(RGjIfyKl3rfaIv z?F`>AaC*H&lO=Gv>HNC{u*{~I&pr7zI`${Q3mS&`(}b390)*r6{nS&ZnnAVz0?E1X zuBv@3Od|@6k=Ef1*%o>vTN>kTw5``Lr6}i|*06W`6tOu~W zwD21O^b*hlArJ=2N^)mQj5sAnXvIbhpy4y|W{^iB3A@N8&TJVA!1{~~?E^v@B*i=8 zJqtbDgstJZA?c7EZL=XkEAF_I#~#tNkNS`AVQ1T)JiRBsZ&>Un9TOx#y=7^~k^py( z_UjzYH+!&sq|S*x(t@k5w6~KGD#9mWX*|MS4lL@kemM#2D*?V3ByoAqW0}*>LT65O zeOBrZ!ge#jL;~-5j&os)XF4`_Q~MAQX| z@sgjs5Cghk*ML5wa&31KuwJK@#()q{f<@;0z)MEBV0|;;553qTbLIy#vqZDJKafd? zUrb*=!pr=<BNaw{A#$4|?|K#uEnusDlTS zVkCM|#Ynl&&sp(m(~uB4#7zbMq7Lw+iDJI+-lh%-s)ov$`yUp`|63edZ)j=UXDn`P zNC_s-S{XuF`)75Jy8STuuz73G=JWov)=`yS2hZNL^S!OQAp3FbK^(-3i+x)D+z|7! zb^?s#_kh!o?)(Q=pk^%>REWM|6AJcqo?&(I=8@H-b)NgAe~h}Rj@fwIq^hAun=mg; zz_QbNjU*BBV~N;5gEw%<_uKtYDSMTlN`Zrl@j?X!2IJLkF1UOC6{Kk-u9p@StU{+l zN}{0+QvR+>MqhoLFnQ*;6p((vxXx1(=#HU&Sli8PMB)j1yqcMe8-5<=7tbhZm zqw@8D=tF{z9<8;$u(+{HqS@+obsKa^!rrM`5$itrJ!X>p^c4w%DkMqk5%_KiC@}#D zq5}Vw8FP|uWqprt^7mAj@r<2)qv~t!g;AuPuTsY7o_Di$UBl8LUegB&qs!k|Q&zy>bl5o5acA zm>D7!a-NDku5~s)fqDF?Vi^6FiIDrSkC5j≈77&zT>52K=bc#fADFv+4-Ts2`pc zUQUc+`J+wd^`7s4R^%UQDvx*z_5rHeaM+wC)4jZ=yu%Zk7bU(|PP{+uZ6me+C%mo%tekx=FP6$)N?i z@%L)&_5Z5+E9+P`1MZ}{M?6VZEKUi_v>T)4UD_hm7C^9xdd zE8%@Z>XYvzl%NSg=sq>oW*3+uo?1QFYqs;>EZB3N_2YKqgPx||^4bn_Y-a}Q9mVfBl&B#AXAcFR36Q|;k72+a4TxD_dEPz?G^KzsW(TKmo zZ%uwZ0^v}wM#($12`Eu2@HtYn6C2{kAbmB8xLIL$TpC!!m;`!|a=Cr_yzg^lDO!N_ z9!C2kn#hazHODJI{wFJOG!pcAv$Q?|CCC0;`2JKR?e{(bYLk0n5AS#WM5CD}sD>nZ z#`>^?@EB!QHQ)`zFj*8>G1`Y-*1yiHg>aK_<5+#^T>cTmBd%f1$?4k*(03mTm9AkBYX->fMw-2p**ZT)E+OJ-y&ro&Hv6z6WC`WyCO5qcHN5WM>9vBPQm{2a-G+*`#gFgp)rn9*T<4TE^BG`sWQ9TZ`WI&t7NEq`{o?n93ec zzWw!ES$BP~`7CfelQ0GA+lqWQr+q+#dPO?($mTbI_-?43A*mR8weir?%Sr-BS@PEd z0MtL!?&9q`evN9<+LqR@0N_&X@7~fsJ=RDmv6C%~@71=#C@>cCKgr@xqSouI%?+<-eyE|ihn3Kp|M?!=3m?kQX{ zWZa6e{D!UsgIpA&w(XsrXo@QBS%VX=7HRiCc3}fw_-Y{|%(Srxpz?(6#<($WdllOVGwk%!cwRFW9EZAM!mM10tGGDO<) z1BjiEN5}-+LVs53>*`AiKI?g5sjh?9zz0(ZddVf{e$|3t5vA3i_1XPYwzP|7C)6}5 zcP83?6+Q&P`x<=edDbU!;}O@jTpj>Bl`S4CN>bKVZ8&o)`%(CH&(Ee^(+PAz(fM4h zv&yt}Wi^@<^oXy;0-O`79Ac&*fKCOMI@qt+dUGqvg|LCpdx!SUKMp6880?HVwy9i~ z(fre&5f2R{`xmAy1*x}A2M5$%J7=`@`#2X>bFUwSi}J4wd(2paPYt0$8Rl1uiadM` zkxRE?+WY03Lkz^hDzMd=NP{#F$I>s~0U|d*qDEK~6r*V9$?N6~EM6 zq^-<}f4`kxW&u`FwpH{=J^U#eQ57JFyb9J#&T_aFO30*c`-pD|o<&`-VSfh=9_ctV z{_K|4AgGgyO*)=U?8VSqn%$)1^JmkNf5-ZbO&iL|yCB$Ik9CWe5dPjF2NP98v>r%1 zl-TO7SBk7fxGNW~vD8Tr#A#6m<}d$XOLjsFQR1rho8Y5Jxn5-6{i+Lfc1pW1Nn#i2 zs+YEJ9OW0^euQA#@98=VWJo;}Z6k(8ihBlcm(zLpJFoB}G29>6Dx}HIqEW!+6|l8u zZk^&WriStWBH-6kv&8Y7qhC~Z`l*(nQiJrh8@Bstj~#d0Rxd+ve%Crd%GFwt_&uEk zafD-Nebt7F-gLHPd$SrlS_k2 z)gB}67Yy$uD2v3d-Dq^yd?tbj6CeyJJBbT2rm7$3Yg&IPRTlV~B zi2vZCVrylJw2wbFs@l9Nn-%f(SgnFArQck6aS@Q=+I7d=zLoh9-JeU^dtfiWP)N6j zg^`BN6|3SsxIBotILd{;jO8i-vh6l6SqjXcPgA|8TkXd7a3!tuxi+#R06SnRQRZJ9 zbzk&umQk^dhzVXk#f$+lU}Ren_5|s?VpA@xen0-OK_q~KE21Xa=_D!KpW zX_8fTb+!n!RI{{P&zh~;R))DVN#h8+N-bMi(jx_e+dpvf$oY}Xf+~2h-u(iRDk|LN zW$#`g4P{&c!uXj?OAFN;oQd*5A_GR@dlq*xP2D`R&Xpq#A)ZDLA`&*WNo1cJGakBbbqAJ&K3h-{#x=x$dFPQzQ_swLZ-nV zP14@?Zsec}diK)`^?p92@nR<26R$umf44{x@lYA&Np z38Q(3M>%=>NuX;U7uT(Wn00+GkIA>&0w+!^je>@Hw9kCvSq?_L%slK+HR!NmYdP-B zVZ4M*3nJrjhCq)Y4C`Eb^Ngi{<)9nh#Y1j2QbCxgnGa95eq!M)oKsDrIpgF*O-YT) zx#`vKZDGnnlCPZv`lQKS*u~Tgzd}1{bs)a?vI1}OPC{sFq={NOvEP=_(Sc)##HK;ZviKbQt=K`+jdU4p=$v-{X|1KnYlnSa1OkYXdtq66StokY2Pv%Q zMjhcp4TmcqY@o9*=YrrK`=s@i-n_t6uI`aa5 zj4D&bo~>QdoF7qKNyi0H#H17??o_oS&jZi3v=1-)@14~?95NDrb46x;{g=|z+SgNl zS7B6JisVO95*(*9=QFZ9j)ON|!A@1Co<{b}bk_FQEGQt0GKAtE&>}426cJP$hOzAUen&Su%ne2u%hx>gY1WiJyP4Ypj{gOB|6$c;Llo4g$QYI4cn+1Fwv z{jG7j*qQqb*(0ts&i@R@Wo-kw6zMoUZ>n-8Z>ZGJwBu`7o0bwK{)v^O%T7<0u@YlX z^v&DW7@jUv++J)4Dt_~dszM)dj(@!uMQivV`O9_gwwTeNrrbX_)4OjlE@W+02P@>q zxj0^TqeusJgc2+ypl^CT5{4FRm72-t#YtbbIl9|ohNqeO{wt}7;9ilh?d6gUTf#H3 zB72S7N*oQQz~XY4x8dsE>mNiEx9W1EfreXIuiqua!>A5Ax2V*7M**;(vsbOguYLWE zwPf_cMF7HOehElV2en#2f5#2pzxY7WC+36XGe-vQa29U9NNlL_f@Ng5YMo@xqH58n zoSYXyXkmQW@OM288-TQlpd+o)N$`v0bbtJT(#KF4G6O<|{*)|sO-VC5opywPpi$a> z>*NO#GHvKG7+&L7!fj!YcCE1yxB)$%%D!{Ya^Z1jHLb~kgLX&WwajAslbGj*GSK$O z@ZXvHH%-bosUR}Yo}iu$ z{v{Q5iq!YiMUA-$ZmSf@5TOi(TQfZ=L?&LH*(!P#RL3aMr@?K+p`5MMBlBr4$iZ@p z{xCI!K0kYrjT%&aSm(*|oWzoy4V}n!)a_L3FOEXlEqgEewI@34lG(1)F?KcDt%^j1 zEV&gFe~s`ZC&<6VQ7l$0LKw zJVj&Gry}*ah$MN&hq@t!)bx1%Eom2ZGF9q|y#wdvT}3{UZRpVWkmGs5Vehh18LiCv zcP6?3+9Xl@iNp3HG0$wWa%b52n>L&^i1jCiQILwReV+ErKH0VO*eLm=`qtW3=O|?U z31y;Y9e}bJ*ds-e+8lX;xsuGy@xe*vb>%|5Ov)&*lMEy(6<0fdbstVihk~GU;HOBK zFI<%Unpr640F%lhJ;7wMkVrgB7)woW{gIC&rDc83@Ar0-9mlb`z(2NWcS)ep26UpE z!;?Bt9torLShkr9mzS$u0x~257#32f^9;6+AT#F1bu+d&jKdr}R#5$zweHFAq3lgx zgPu$fdCfrTkPts5J=g+f-CCvu+2fI$$2K44LMhS&)Zr=F3Vfpy77(;Kkl5# zq4@Hq&>B`P#GR_KSPW*c;m&tft2FERP~@yrwqQh_Pi?3K(I!OuZ`7~x`XJ?5NwqkN z|F~=6b?Z%IVHt0PQ>Mc~nz~Y8QT~~o{)ng{t|lLEw3&eynYhcAwj)ibCKc?Xrh=%4 zF|{)Dla_k7;Vm2_bq1W&G?B{U=w7w@kT|f0&v?SoD8qSWE5p9IjJX2UxJ|h1JE#i> z>K!$88*&A^2@0)k(fkC{wq;u@0-{KqpM!@@UVhp99(7=N6Tq7BBDe z85egD;Pcr>e)_zmuvWFZ-TAQn4EDXgn!60fiGLC90#PIpf;3E3^2)c`(Uo(a6fOy% z-xYusD6ws4TC;#Op!*!ehlm%Wq>@H1lVHdEdk8;4<$*9g=QPUbn-?^w+U6BW-1TRv zZ2fmoP0=gIRvxcL`ID8?6BQZp_Tun=TuL{maap7Rd#H6KDEkiTAXv&JkWHx0tY^%Y zB;~lw1CsBc3$uINQ+2-4(}<~(_XzM7z^v)##HDC(Sqi@I)8i{SBlu?EB;7WHT#Aj7 z4O>flg~}qN*A2}CHddny0ClwUoTgePdY0kc$=n#(?^HrHPkZof6Oc>Kk7VDMD9VZy zAk~QlHTQ=i{y^_l1b*X!c(2DUlRRAI=Tl&s7u-EO=?(L-x~EOqLgTfoh+1;W&k828 zbUjdg3+rvK|se(v>wuD za-~0${(GT04w6gYFs-mp-@dwEZW1NDGS3KF`Onl+$wil~4g9C922 z%klAdrHFEyX@49FzAFOzpr})#KCrdSIJaUDue+PSw*;LtV>+p653e|P^nYLBUMWzU z(ayw9aeL|rzS=BSFEE1)QF#35Ko4Ut{jE>I)&Jgw3iCu?Z%g+b5f>XEm*Pqu&lBd< zJdnc^@8$=Xde#$%eD1~psr_D#l9u2ZET!wpY zR?+XmIs$yVI=qI<@NlPEUqXxc%b*5R4R2LG+s?im|Os*ZJhM zbFeE2-Ta1dd&9(t`rTU{M1{A~m6;^ash(V+&rDyU3e!vv>!XTPjI_B7U;BnzOB}nO ztgw3g8Y(GYqHWXaeUR7L4H26Zh7||)wD42F=8=~ib1_^Rf)U9~e$8Hs`nD4_wc}l( z_$fIbwOE|3J(+f1sw*=pymUn##?6S~Hjb>bJn*ouLmg(S(Kml#W&N3#0ce#XgFBcT z1~5;!j4`n&97?8+WcNVC(tcCSx--`mr}R%S+nIJRKMi|bp3%7X`o3xV3_|3spHUIr zn8oGbG9-(_%e6flaT|;J^mWMdY*f!Zg)4m+`TZ&e;Ru}3hV2O6k>NkX*;Rvv(V}pmJ$hlhnJ=3f(HA8?LZqPw3D2s zg=Lzb64vtUZG4VruIUOm2aZB!=M%2ok6&cP(%v4N03RbE4F&SE$p;?}Vm`Y&a{R&n zmM{QDjG9~=IEt0#pX%O}s($uL8YhOC@})d#gTs;bHbb6Jh1BibifCHCJ`C={YYY%x z-zOX_9r9fBALP$V2mdP>umJrfRjcurk!@64pU%&*W0c_H!2YQ#zE=eQfmu7J(jKR& zYHg^a04yc@zrk8!wRBC9gt^D8?7m&{p7sE!wM}X@99K9!iKsTOxkkAk)(~gR2Tq zk;r-B+45{$GjJZK+$pp4FbV&|#_VJUI2<33-?@{Og~IOy zDQzlRWbggox4o!r1L6jXynD+J@~?oAdK5Wd6Z5ABft+ovtHqTjCikIK9z{KR>5Fm2 zn@+&bYHlSr3(e^~gbJB9Kt0c9q+aGA63=|Q9{)M*NH!Re1$u_@SVORJt1O&{@K)?U zn>6Bh2dmTfT{X?>$zX2d-R&18SXILB6a%C`H8W2Hon zj-f1m{q@|w3)l)XEyXh z6CiLbUNc&tRwKSuXn* z=*(Q@U%)(0Es(T^K>#1U*-)S&H1uPbzevMJCMYm})IF*WXX{{PDqNuQJwnDaDqFI= zI*aQj?>At?y(u5IBV_$We~Es6U0KGj{3m;F>^R)6HTo$n(exyttzGRlhTDAqyRQwz z;+2$fQwVXsg8ygy_wg0>-_OyA$xhCsadN(r-KFgB5)wp4Q^LowJ?2xdL?JlhAuiU{ zR8qbkM7#8K0KkNZ9b*-gUIQr~D^fG%@6{A6dJg~^tjS4~jSb|c`l&mqaQRb&H>s8m zC5DI0dX)QzNk6}MLXxhSMufQfELXEGzpF!X8H?^er0qbpmHgZ!uI!MQtD4CN3Cp+^ zC@7libo&C@bi!HD4AbFK7%f$Yy9CMQj9Z>c>Un?Q4~4`Nsyu3)IV=KUcw#&{MM*h2 z0+%HO3#VP>nIJ9W*}wNYsSic^i35kRRU8Kk@lw=&c?;z__Enjo3$sNjhGQjEKoZC6 zkp=zLRDzHWoxRY{_i3NRL@YWuqBr2116QCkyq+SIj|CusubX&5xkvkbMS?WkTI)!u z%$jtCr^ycQiM3rrluM0SXi66Cd_dj0xa*?g7#qVMm%L7p8Zn!Gxvlqjv7PD0=xXnG zlZBKEsKD32&a7OdI2~rIz>=q^mc>;$)*!Rm4SSA8!a?zgTyYx=^zW(w%>P1!bO1%B|;5BKKcRnna7*IXTG{NcIAr z-Y>5N7N)rTuse#!wUP511B6dc|<;Pkxzu^qIN{?^SLBd|B_`Y+z7 z<-E?@|Gj4zsPEVw2TU0l$}j=>c{SRCfiHB5B_VD=ZGrldH>sz(?XL}XOxKEYKSIOSRScm&uL za8SA@BsUH5XD|Gq?9jE(p)2Rkn{6?vCrI9Z(7;_Om1dAGB}itm-%^*v(5c)|Iwj`? zl9bReR}0smZ{o+LwlX}{8f}Yam@jCnPu6vpvETa+?g@KL+{N%%2d!Mu2tFit-d3XN z#NvTz5+Ksh7uRsl_20lW)*Npv7}4AxFC&3|(%cX*OJcrftvx%SY>zv;I0nBtQ$=)l zxq`17(1fRT<*@Y;{(qj6r?#^KiQ+`9(&4rds@;)yX-YyM^BuWBw2)+{{Lfpk!aoSI z0A)+{@8O|1O=K3W$x2kn8iJZ-wv7e!yNE51%+OYxa%1d_)1Nqhf(zJo|1ov%>Clwm z6JiEO?u0{9maE7;Vp?~2Vn6wK&9U(;Dd*I^cHy&X8iwf>Sw@j*;ZV2?DQ&N}au&8y z9+>|=l8K{S=(Q&E=Ly)9a9U&HPqq~t;OOt!C=D%&Rr#2KN=|6Y95p9u+vBN^BJTluw!fB@e z-m&s5oK&l!$5dZ~66M~3xq45nwc8i}5m~}zk&B*s@b;Tgu8Qu~YyFnGR@VRqdb6Pc zcdumwoOgBBJym6(W0mS=Gn&&Hyq-b*#mBW1f!&u#snWzRA{%WszwqE(D-J(P%%&3E z#tnQ_d_Q^kpJ+Khi5mUHg!Z=m_mt+fVV7D@Nj_7*tKj6~bnQzUwmDZ5QTW#4`aF!lPm!B(<--W^;4Cw@>|avQxD36JQM=$i*M-is3fNB4{YkTiLT_ z@m`XCW}QyEY3H{Gyp10`e@Pt7`oPJMB(&+AJGv7SRkA1C^mZo1vd}Xs&ATac$2JE^ ztFz1a!c;3_Dg9m%`OKX!{QYlsY}IC_RD*8%kM}G6y{>;Q z2|vwGA^;PZ$>jTYYrnSWdY3r!Zc@J@+|`@^ckLH*ZTPv%P@Mg=g36rMk^Z3$u8GSv z1yP~*vE4S^Q0PDS=eg03f3|m#Gi8+&o(s;&slI*t#!Gr|B<10@r`vry)hW(XK1K_- z5)ydjm+7l(v}p(#wOyZ}8_vIW_HM{&c|Ey_T-C(>?t=WKJIxj9(g|&EX%Sha-QkV# zIy((r0K#tSqF?EKORk=!fKp~&RHJVrdVqYT%#WLK;GSG-L!tRy+dhz~{SD=Z^3Kwv zr5p>)@|?Wzc`|;4?EXM)S@b^%!Cqg@0;tz?ei-Fi=zYQ4#>9YN}St4&;zIk_$A%3OtulkH@{rSzxxoG`Y z!h*m^#FZ%3Gr!ZI)0yp!JQz$6mN#H?-k`3##t`$QS%sP8LjfyC6R z7|df)hAI8+L2}X1MHD$PO)2rcEwA^$j!mG;k@pQjw_M<`1qHFzN3INH(*>GVSY$iiPD=XS$_qqWPJVx3n2)SS zMK+}4g~!#A(RYV!rLMx-lrC^GA0&<4-JG)n4!`^=(4eQ8b40g7Sj0qTAYMZJ8uWlw zKFt38pqg`VD+}Q~yP8)Z&V>+3pp~=A_>Ei#Z{NnJB3(4G%#O??Y1wm+y>&;CIvTQP z{W-Qjyq~GP;s5kblnZJ+!4Z*oX;1^V=yFi{Dlqi#`M7o1nL>#+4Rb+qouvp51eD8v zH8)WaeKNr7LX`&b?@?UHA#(G zyw%n1w$>i8++8c)JMTorN7cApiP6P1tDq zps4;b1({07NHeX)!P&G|_I)aj$AYX>ez+VxYUOR;Y`>lkSRj`)pd&J$dJZ7%oCy>$ zcBpICb@?At=UN3~UxFXB9XwPa*C-kiFsEugrkb@Crauz??6K4_7;1b}$+MmhCqz)( z`@SnvY_09FMyg)zFcS&FgA!Cu1N5gT?*L8R*2?CHH!oXDIOewO-59_}tOVBdPrxce zZG-)vsJV3MLK}WB-n~#$vm9E`71{Xoy#^Z#Ci1cCX?tgGO&BWL>(|)t4VAcrqW-Y0 zv*}mI*xwCZQ8(#9B0+cB>m&As=rx(c6U0se5`mIVUo-+A_p981z}wx zPl~&%w!WLtbs=1^3EV(FyKg_AUT3@0YhN~ioxU4LrChc~6k_{Tx<1|4Efyg{yyFJ` zB)Yf;yFM4s>uq~(UG@BoqML3&9%Vspf2?NqdfFaLKZ;zp*G3EVDRRxGhjL81dOP!k zC{KJxHg0I_ZX@fIv*Ngvi&s470_HVrWzWiw@GF?%0<~dlYxKRqRl_drvJD!MXqVHy zX14~OfetiQd0fH(ay#IZ9r)m}db<>1v|p?nhm3o*HUGb5uL5FueKGoJ@yNN3#jXTE zuWHRuu-?A(KHGXMJ*>a98vw59T(f!)P{BHaL3LnYsMWstCh@^B_nINZ!q4(&xsK-( z58fd{^BbO5DZ0Iy4JnZMLW!Z2b)^TAC)zo}0Xv@Tu&%7&}`Q5y?brF(!Y; z3{aV98-{7{J6{5Lu<+%Uu`K5+i)Q}&5Rmc zv>_b%oAh+-%eju^+`k1tO zL@L%*@RhKZR@wbUxfTXidxyRGHK@U0B|5{I_aJ)sl>XEyS2qpG7U&X@VySU zP(^{Js?c_zGqV5Ge{&{og73kgCY!-5R9ZAtbveEK+6D}vq?5?3i~)qOTiVNM=y+L2 zQe&@?66)SHjS?YUe~0Mpw))>#{~;;189o-HBd$q+s24xLlz)?KP9w#jz>Fpb+$M!% zgY%lhJ#*K>#~*T|!(R2zV;Ii1hQ-QhNgkYwv-o!mYfILTKAq7F3KfQk^8 zt;R$tXDnrB{eacAhPtm;FHV*Tf>*V*z=70 zs~^pVh^W+ic0Xt!u~22NKz+itwzsa|<5A#cYUdc#6wBD-X5>Nku_eCz*!u2i9;yL`>uY0Ps~sXzm|C1s;O{Wq zH-aw4Xv@D@=jHYZ_h^d)il$PV$_jl}2mb2YvQZ{mZo$3#5Fi%=A6<8Jf`h^{f$={D z&!KDVbkm0yW**iMF)t)2zseCF53!m%U<=LwWu75@pupgQ?eA-K6Qf|2qj8Ri1xGQK zbQBZj_kz;UqyMO1eF!UgTq|k9zgOy=#xmaMVP@D>zdOj>FLB@(W^V&s4;JF?bnw6y zFH-}lukBQIO;XmtL-Qyb2wfZSc1jZD_2ri_OiK)1skg!WQ-}I}w`4RuE{Jiagi9V3 zZFUU@DR%RuSFS%UVC(oluh;gPl-Pm{c>n6v8~GFA<=b{#+mm8{oACY6qJ<7yo^DK% zi^#~IBc}GpKvW7ti}T_jUf#B=WHOLr-RF8JZF-W3dCeEeJ>eeoZ1L=Uzjvdi3r@Y0 zxLp_=duJ$!@nixcvD4LbSoeha|1_YCH&w6AdYJ~jwB| zXY3^)c8F9XhN)}AR`t^VY=88q$BpYsF>}oOsXiYiUoD(DPKME&3Ej3P1mPwG+VZ}7 zn?m7{3dmmV5YJ4C$;`G}l-iyr@x@|davX?iEUbpFT+-W{FKK_}#c`rrpHL?0oKF8& z`GZItv+(}{9~a>0qo;=|040zKPDr*SZ^a$dh0cD$Hu!grvoA2LgDLR1kDF;XNbCX( z`a_KG4jaM4wmDOhLiuvRHmEpZ41^o-FH~HDWH<6GKm(=sc{n#iJLEwDQv{+TEIF3% z35>UpAw!uDK=3*`hf>3i(m*uu_DZ}nh;qdpi~vFSfHgD&a6fSrZo@J-L0%7l2Pmm! z)`A`n1Olu!M8Lwczm1#9I*0NDZJgE|OgdM`xFp~@PMpED41^Pm!!%Gfs7L=HG~mM` zAn=Oa0Bj4QDs00il=8eQhC=V~3-Bzqb0{E`uM6CIOE5yYlR-1octd!BDZzv(tOGD8 zJmlU&yGw!*Bs&E(!I>N1F)V|jY%@gMLN^>ut~UC=b7-|IK({+^Loh;&9|5L<#U(sJ z!*>86m_swDdy296Nqfh4p8IW)s947(ZCg4y$f zHPAs0{JfN8{>~2rIgtDSv;a6WS~N&3-j_ZJw?n#ou{UISM(FoxNrG{Ah9Eov*Aqkt zM1drX!#XqrFu20l&jc#mLhp~mCzJsVlrKSGKo5w)QEwiHn8O<6H3qP9D|a|RC>Ssx z2ep3(5hhf)kYPiI4v{)n7K7i z2P}AkRTQ*kE(SsXRFQ34w{PK2bsAl7Q#LO`+ zZg1befj3-5L-#UhqOdkWFwly(ysfp~c_IS?X_+o)(CAWzdw1{LwPeo@*1Bobs-dS> z5A^ldfwE}_<#ddklb9VA1=qiye_KZ;VlrZ!V?w#A555Knp_gI;TMw%{#6UuZ5v;4w z!kA2J0f{Qw5X8X`LG-A-*k-%xH7x`hzydk?Yth9Q7h3;hw1KoBhe4|@5h5lsoC{H~ zOWFt$i6KuI!N?<#JaWh(vk3AMAEEp(l&;(>twgIh0cM;kAy{KG7{LsazdS4$NC7g; z@ufkQ;HWOaUXF`W&N=CH5Ef|KsS-Y{ZXt(EGrMR<%s~nLjUPF{f?$qyfLT+e90MG% zz&a_d)Y6Z#B*zpZFuc;LTF8+xrYLwT)YMbmYKM#zEy$ytVkTwj43cOhXBbB>%~epsdfETx7N9O^;;;cA$YY&<#Z5S2QHrr= z5wzaB0S>HcnZ{gnX&~j^jX73moG!{7$OTE(xs@eGkXTN|MeKo9;g>5FWtecr0VCuA zC}^Tsma;@PhnN&lg5HjaCYm2$?~}t?FD7EObiPq$2GfABWrIiG^K_(-5A?FrctrUh{D@G4lQ87B(zUdRva z#m^?@T-{7rhZ$6wMq=BH7HQ`gruFVzCBFTRX@MKWz)BTn)-h%6#Dr$tb+q%mxdSb% zAtxEiRmuWEg0&cDn_)QjJa1Q+$$D#HNyq;Rm1M|SMvJk_eqH*-0XaUwGHM52B{<}+ zi;i)^xm|dLRT*ZQerD;y`q4|jN@jAbDMQ%-5})3F#&daIrV!)+U;B^{VL6$Yzzwxy z2Gzz_CsEu28unNQ9ddxKuq5v)p#VnK<`)7o5aWIwbY1@9H2@QQZyUgf)knl|gMnqF z3(JrkEbx{<^@O4p%^=4(7GZ>&4Fm%{Xdjk&5bfB;0aMZj z99(W7vonP~!qJRd1W$%q2?Z>eF%5gP;}cPsAI_$-GnS|#8DazkabjYDD69gBb+jKT zqOim=^r9crNCpD$&;vKc!~{`T#5n)#0gYiGu!|uPMJ<@IjWL>{3^~|gSXxj8^t5Xj z(BQ{1+^{-=DM4d)H0Ay9xI+cxzzxgb2Q+|zJCF1M3A>A<59rW~f9Ql6u8^hYLP3;B z@?#vIC<6^HIgk@HVPfuMpgpWX2Op4!b&fdYHIGON^+5#!J^+L@61hc?v;hf*K@1I| zP=;Ap;~(Le1~YEqlW@5LjFAk-KiV;iMI4iwF&RM*vTz5igyI&>SO*Su2$c{R@=Mrs zs0Z8O2rZn^0!BFGI+`&IdCoEmHy9*TOpt>zEaEZz$V_G8=?X?-Whkz2sb!|I4am%b zlHsu)RQ?&zthfRgHf)C^oDl!QnJ57eW_##S>xe@o2$d#uc+5K9Sqt1T;tUe9B{#*h zosrIB7P@RmX241ggrJYBv+zz1XdpqvJRqk6bsrd^A=X&{!i-RS*0~h5olCcM8xXK+P(BP(k z%>fx4LE8InYz7hd1(;GH01<4MAEb~&6htFg6a3dZBrPjf+3AoMb9JBJ$xbp!69V~? zqM;iuS_A-)3J?Pz0zO_yJ4itaGLXRsG>B|&p$z2}D}fC2<*|{c2V@~5KQesl9feaIVY=5Inu*YU63S`Jb zlJRUuEhFR_WlqHy05F3_17HY4xU;3lkP0$ig9=2RfdBvyhe=oZ&WY9!l9QZjRrlD` zrCszvAT0tas5$=vogTtJQgP=m&sqdQ?zE6QO$A8bI@d*R^|6udn^&h90J5I-7=n#! zT?=5=vv$X?nLTR&P(j+pPWHFKJrN+sArv8-*Le8hbWk=nD#cDK(xIB@^E-07b8xY)geX4m`Q-NJWN;vMjXmx$o+NO;39z9ER8 zp5N=33YJG?43l>Y%z;yRxVU2sMdLhN;vj1`i=Yx)-jCy@2l*rZ;@}P$_(39IdWyWB z;Fy01?H>|*xM;divyKSw6XN@bR3i5Do`K}&e0s0&hn_`8n~?vHsP9C!Ia zenI4JPX7kb{4fq7+~LCl5dQw5(j@O7#!vsofd3N00o~yOaShk(59TZo&VLGKC}S(T<;oYp!2j3_8yJexXsLF;L{GG2B|>wXwU}7Kn7oM24qdvQbE>+ zKmbI}2jh$ifUx=mpwik;A!<#{+H4134+wLR;(nplhM>qoOazLM+p^FJ|3SpgECL2l z1jwz-wvYIMnvmP7FbKJA1eb5{ z9%39+tq~pZ5g{=WRShwouOTX7#E1_DHIeq%31ZGk-LMZoZ2okw6k$-!+|UhQkQ7<5 zyKDKP~bLI!j2*3ePN)KU9F z4+^&|9pmvP{ZS(capQ1r40BTUc#`*KGR_o|=4=o6cuxRq5BFxE2+7aeB=QDbP~I+* z;-c{oi_#+}5+w62`9?Ak6OU+6Pz4tv4(9O`MWFNI;0gJ0D95nP(kvipQZE17?H?-P z528{pYfUH*!VBf?7iv&1g;Cx{j0NFsC>u@4wh$UcAl>$oDLoR+ev-=~O(A`*FUKIv z+(8gOjMEyk0V%FCQBL@7QZX|!7GEzf_i`J_^6{DvS}HLjW?%pV^B1zP31{HL;%vlv z^9B{r%LFqxYcJm-062#;IoHq2q|Ysr^9E@!-JH`n{ZYhB(>Q}O&T3604?+(~k1zqy zGR^GP#4_RvkPMgcAKb9>{(v~4vpW}}J;&fGKdmjptUiS^FzJywVYBRJlkqkt6O&S} zNOEyZQb6wo7;)`99qK^QCP5W+@gVeUBy>UxuR@FFLNWC3G?ZvKv_t>%?n65!L`8J& zNR(qt^hDb(MK@+eS@i5&^j=^zB9d&$&}z`c56G*}8V)VXd)Lv?IAy#1xjG)4x ztOI<2445lOO>0Q&rAQAVm8K2?lt6Ky6se>XT56OZ;AOgupbX~gNsZLR%D@PojBJ2( zORuR*p9Mzqpr1mZ3pAlk*#gP7NhZ3)O|c11oyA1QL6kZGul8dc@?d^mAU6HfegG9! zLUbJB#RRPBMH~TQ2u8yiwSyk@R5+9$ULYpAfYn@N4ekR^7f1FswNp)nL**bQDs@ma zAw{&HAp}#*Jd7=d5I6)8&e-A**;7>?LOd&CBNL5P3xz{xqzwN~B@fJmRL77ZBknLK z0wdu<1n812YH}iMPa=#J&ybZ+E|eN#0#(C=A5z3jgHbK>t;0T$I6tff$t(`uOaNR? z)9w@IysQ)Ja}I5f_zvzZqm#?XEDrax_GX~jXt7?GkzsF;FPkyUfUq3{v&`s{JO45v z>TzJxtURl)9(8dGGgc47tjk0UH?i`}I&TIb)-PL6J3q_|%`98tB3uXMLP?>DoMmh1 zt05!q8bsh4bWiu*GvXvI#JKGb1}?{a$g(`ow=6!jGj@sbrKty1OpTyW~5e4r3}*IB@NQ&1oHSa?i#@|A~h}JfDKp?f(q7C6jk-jN-ua#*DmQ$ zb+?Q%(`|dN*C!K#^~fy~aSwbOvh>O=-T2bXzH?sx4Swg(ej&GbxAiS-R!m$qCf0&b z93dv0cOin(7ID%bv)30F()(nW{*0{{ul8wov2_18F&@`(8E%>J?;C3g;8ZVttmCS@&S_bz$6ad{D<9h7B7 zjMz88G+t0oRjn`60FdNBx%zm{`#5g>X4n$J?~@l|{4h{2yASiS&-xI8Ua8Oa6p(v2 zE)Gmt-PEs@87-ADuM%)G1cUkh7|@lw^^^a7uUmO8m|vNK{~(zI50Xn#k`V%lV*&!S zpl5$$6|{hwl;Dy#l_8{W4l#K4^y7fT1V&dus35=y<_lUS!o-}QpDaKV#+LLR%p^0S)Y1xQV+V5L>TPyCE``Wmi)W!PnTV(Al^RDI+eBZ?3?#QpAez=8_Ny z0ny#u^7SHMZ>jAu$FLsD89DzGV!}hr%x1BVhhV}7(Rd5|pPehddxJx(AszCe6J$Ie zszJs(;U8+e6Wlt--CD-qz`lVT4e+}m;voh2n-_AA4DEF_N3jKAc-D5+&6e>!oe?7i zIEP)4-VX5+*^~65w#hqB7@^!jg)hV`&oE{88krCkeT>E9;zIl34PG3`)1eyf`yc8X z4Q|{I?EA)p{Lk+jxe-IZ8jru6^kh2mReXE@o%B=@ibB@)G4qfvPe6Pa{Gc@`62{rtC;rCYO%{0?ZDiLlMiILsyog)=O z-=&=))hx}yQf~Eo<3Ii%XMj4}vii_$(-EQw1v&Xj{wf2rEs0fX;cUcOUSIoD7u$T*RkYPz zWUcr5;t!%4GTsjadt)5lEg-%k^4j7T!s#_W>YdN%Uli$EgdY3=$r+*={2;%%{#mBJ zEvi24A8PH{qU~PY{!hK0M!|mWvAynz^zQK5YfAcxN^F9CbK|l0GfAmSe^iBWtQ9t!nf6#J3oQWnN G0028ffSg4D diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-designexample1.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-designexample1.gif deleted file mode 100644 index f2f730c70f94aec61ccd98971e60ea3d87b6ed23..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 30091 zcmWhz2{hE-7yr(}%rM5-ca0@mmdO$!24h!^HESUXNo0vq&5UjALlmOMzNWDxR2pMn zlPyUak|czLq~HAef6hJUecnCq+;`qR@11w=J=fCOLhqyx1C#*@1prmxAO6pi{*8i? z^8Wx}^X0LIfObBhT?E%ohiVrAdgV~PBKSWsEJ7L<$g7{)V ze2pl+7-L70v@4gitJkyh!Pu2!2sLZ~fVz##6UvncH5lhcdFMs~fuQ7EV`mqs>Rf|y zYr(putGeaOyEU?rNUU4E8{sP8&sOzn!Fxq&d(~@uHDdkSasF98K0b#2jfR0mIR8fA z_M%`In-G|wceTUtYKK)|i&bPfF0z-6#S+5W-6C_XB6|rjEp9QzKrTBnG7`vVyTx?a zkwyumK_5~vyol{jD)%9E_>h=}$!zE3ai8QypJZlW0y7~Y!7Y6nQ_jAc+#8l&@0B$h znDvkJ5^~x8xwA3qETGhN z-1_O<`q}*YX;RBZWCy#bak{8+Ho1K{p?y2KePgybzp=5gsAYD(oK(}&Tii0A+_78U zGM~=e&gx*-v`?oq53-osHSP0R%-#0(4$>$)pUJN8n9uFqEoUw#kFtw;4{`_Djm*XT zQFielyJ+;FXq4UFyI3>G&Yxx%kF%MBvmJxW<>T!3(bbO8<)T@3$LK0^bh&1lJvusC zKh0*2FEhtCTBZ+b=Gl$2>;q;;{XBbgdU0@iqh+4WoIU8B-ELfD56*6M{L{~FjL&ZL z&L7Oq&UP%aN9VT(=h@TqtAmRN)AQTRW%lUe!T93A;6Jj=9$!9~Ufv#D{YTgbv(wYd z2g{4gqpR%M<%9XOVP{-eAwKvKLo(7grCK|7kYZ+pDX~8@tOJ2khnL z=mdw+DWZmxP;YIRS=YjBcg=$bU{npNFYGga#vNoL5% zr%Sr_7Nkhow$#0Ex;WLzm7{QJnn&|VU4H87gO4|*GT;AozPurxe|&zCo?S6PXr>4p zJ3s8IZ0s5s?@Di<8Y(yy_2+M@;u%k!AR1|1{B}ytw}~pp+7_Lg@3hAz^-~4**WOjO zg*-XPnXGI0@re<~?nqGNf*0w<)}7q3{rEa^5ho}2q`m#u_nF!zbZ#rK6$s9q&WRVPq6~8XF+dH-lIq$LoPEnTfi_mlFdWVxghs2HS67O+% zbu!=F5_AcW30;lI=0s^P2*wFz8~!{S(X+3}N>-}KlOjzA!Da=%zn!PWlbu#k6ZEiFu=KQXQ#3oQ@H97^ zkD^<+TvO|?3YEo|W1_dXjb{a$25b5ihAyd3)|HM*ljgfkMU&Qp)}LXv!r`}d5n&Yl z?}Vn*#%ey(zP6P|slEJbjYH<`o7qEE$ND2CcvW1|P7*nMR+86W1IHp#g}zKRlZ2{v zO4BtJRKyWd-__s7aS7H^r+S>730sJ@Ghy{Fl^%iZbbc8+T6&)t2&LQyJx_aLNE+5> zKwKmR&gwAa+n0{;J*JsLM9&GCoyG4tg^uY39y0mu#us;eXpKy@*F`?2 z}aR#Y)kj+<1HbErv}+odX1*da}ig$|zJyv`~({4Xs=pf^u~ z5og$Lp9Z*$xPw2KrP*%bpfsSsaf0kjVgho;$I! z?mAm0iu--0P0?~(%??b}MG|t_=PME6NfSbarO9qth6^|etFiOG$i@WIP4s?y!%bY$ zLaOADIT8T3%M4RR;Y-4vLA+seRx10D1m|iVfW*^bd@&Yc{KyjVb0*y)x0zh45)4=y z8gadiDYliDfDUGo&0M!Kl{-s1<@tF10ec<)70_6>Rqtgqw^*Q4sXX_&w4gdO>1$~h z;T3?f{})q16ht1Kpq+Jz^}c>2N^ z@(H3*4A^;8r?xNA1R6yjvd%7XzTYh`m~n#01(?JSG;$~vQ_UT3YROhD$*Bx?+I%Pa zaOzeIRd<7|WB6$KPz*7!fCh5VCIO+C9uyqS22C(b9y!5r0xT>vMqfZ@Y^hJfDDoac zwfIIY_>q3=$-!&x+A<4u2<~1)+IO^R)``<`&#j7SQEqk)M48lr5!GLZOt zG;i=8&}tYE6=jkhO)N!4)mXz@y%BzGCE^0FE?_pI?5{DwHyoC#B4tS&->1r=o2p== zC}jeiV_;o1Ijd2iNFP zgChCg#<@<*bGk2;XnAl!$QuA3XKuAom>7v99svXO2cLPLB6ZGAPCD7Zoud_#;w}|Y!H&D)7h!f{r2rDdu)M2=2@X0vU*~0P=GJjInYhh-Ho=~NF1vmi4i#P3iTOIm@g(({fB7I=XI+MHS! zsSa>Y(DJr82~{;=w^uhN=!w7mxVEf!E;|$r&yY#K_eg=S^+_`Sq|6C<33naU^va~m zH|K5_SUkbbTs{RszuDzl5gepgVk9St%9vxK8^m=$F!rmbj-0#h`6M+p5cDC7B{mx{ zQ+#=3zVJM_@*ud`@JDii7boWN11t5E9GN!MX-0jGeu8#}Po>0z_Opj@v!omX%Fh+X zlL`f?bolwWABAih;ax;yOrwKpR9Oq~ek#KZ6MLynMNc0BDu32FYrHQ*wrDfMYmQn>-@ z8*?E^q+dJrjz=HAVif{j=d*r)!f>(D{#gC*O$RViW=;K5IV)Tobi6Q+7j-T6A$)8` z5Js%~ym2!r-!8!#(qX@B6$gVQsru!}xl7P>=R_uu2EPGGOX)grsdq-r^TRJ@lzkL) zK3Wg(hK083xEa))o&Vzw3Efl?vLaEGG`@Y=>fT;Bt99D}ZS*KRlkq?(lI!weiMOlO zG+U*8A$)Pb=hy3#_|DBSp1Y5iQOK%fOvzS+yRHma)mixqsm*R+)v>&@`K|%oPWy(q z;%>~H8?rApkvS8PK{B!%chYDxYUPITA>bhqioAW}YC|(n#kf8Lg5{eBYCV^isZf%& z3itKC^ni7@Th~RUpUklm3C<;|m~t-=H5Jhjd_t(}tgptica7 zgueAIi#)t{y^2H}On@6)zWvT8L4`l8Q{lq$G`a8S1xSE+Zlw5bB)Ls6@kDgsG~l5{ zQ>`TMP{(AxD#rWq!L=IzGL7e#C08<_EwPET(n|=STxb(M`#Zu{l_To6h~r82WrB<_ zpdkXdDPrWST(CW`96cgKB+(ZDM#_@2EQpG&$%(Cr%GbHx0v>prdYgAt!!z%wJi%>@ z4Tg@y%-Br-1bVTQc#1fqEV)0zu}?7g1wOWF%R!40(oc~M9fSIYCivnmRW#f_o-01# zdg;{(=rl$48waE#B6OAj)#1A{D0_|W529mJt;4u;1URNysU_4K+!$_w-6Mnmm#K5a zE9T*YLcWkHx1nh907?oaG1iv`IvNmA>CHnT0sZ$?2NMw-0-S3Bg4aWx^DsQO1H|oh z0V*qg-<9G^&s3Yryx8aJBVw0jMIGwlP{eXa1M-cxq9!I)#G3zbGfvf;M`GE&A%{~!6holE#mCMvT|IU8 zZg71~P*1Q`i@C4g!x04W#xZihjWOrokp8|adF51JZ^A8WE+^vITgh_pKS9iukHPIy`W zeJwrfkT#7Z7Vljh0M39wI58Oy+-CP~cqE=RphiLoc7s+x5(38c?JkHFTg{J5CkT{T zs((!4(%u64%1K$a;&p zNH6=nZg!gxNj}qS_uq}P$RyQ8w5SjxuD%udr2(+KTqNm(%!xy^?H|bkw4KpBoYkuS z^wenLqk<;xEdr_p%DM2~fkW&9*E=ZF*|BorZe=l*?-^3N0UCdin}s_WNulwBxH)ce z%jQej(lu5$^92gz{WnkQy6{eJMzjFD+umRy0K?9?wFh+^Z1(S0EK$D^Q^7|_LfB>d z7rttXtzATxBmv+c%LQ*m7hEZy3}T`Uxd+Eg$HBaQmxl0{X@wV?-;}B(BKH7ZJuCAT4gZfL1eQoC~;#77J8n0gtM~ zU^+6q|G8u@4#*n>Rt+U^K5hcMaAmh$k$Vh;J_C7MrBbnkXE+?p3g?;yJT!5nhwf+> zn*9Ri3TPZ6GR;%{7MiU`42qWW;lOm_%k?=pyC*pIHhFHtky}(QeHK{VyY@~>EhwA2 zi6C$tq4SmiyIE=6WrIG%*ch?$m1ViM6cG~BK75rSvFNH_U;L9}u0Vw7@09G4tv$CA zs_b3tIz=4k;F>CE$X_CA~m-HbS@0I_$);8<<@i1b@PW|)s8Kj z$W?vodP0SciFuAPZ`5_}t2MGQ&p9VUseT-=zkZYiYtQbZF9e65I!vF9z7@G!=Fiy! z`yJ_D6$Wel1s1PVS{>@J{uh8@UcZ)jY3KX;z9tvmo%gx7V#_zXN&>G=7&Cj4+SdSF zG)O%p8st$+ReX;}VtJ;DU2-@b8Rmh%wf!qhdd`>Mb}~%+tL)#G(=%2HIxigc0J!aD z2`42QXly>R%Vw?(G1ZYTcWUKJ7|=c2t}jsJ9`+$*403VRpmL0NG=@-5N79(7j>$m&A#B~W#r$sX;!HsKcYdKTXwx52r}{uJ5rTZxrgS}116Q3 zy>1LnjrD=Qg;HWHpvZe-TBf#nw!z@Z6srl<_crAqmzzp8HGkq&iW4|jJ*kv^W9Eft zgnro=QOf0XZOhTc@a(MLY2>Qci2Yzq9!~o>vvE~wbEM!aa00VkxQ0nj__R!K*` z<%c7Cd3Q`+AqrLQ5(G$_7hyWU6*}UWSL+Gwg*>%-2YPEl`iEy9djBA&kN-U)RnP4C zIHQhR>}cX*Va1eAU#Y|}CTqQV^nt3)$+VI>ZaS*^w4Qzk;`^-^dsx&>n}xJm$O;kl zENDT6ys)PBTH?Ia>Cuj07LuU;C0>pP8xPc{`MIG~B-ohT`H0D9NX`3zwkh%LXvFeE zB-a6Y>6`~Vfd(rkEQ!<)sKkC1+86^GzkdJl_3r2=LKF9Ef&g$Qbly%tZ_LT(Pg}9A z-i$s_3M^yHzNw_GZr4ISv!K=h&n)h%2hXY%>Pt+$c*P?qqhpw;u7NWI#K!uXE-mUT za0vUeB)p$?m}PbYH3N&^V>iBTKjgYe9X6K)TXYPRp!&*2m%47h=tixtsIS+cic~k= zpIAX=efv1?)ZN{LTpCrntEa`HeyHj|Ag&vZwTPOrT*P~T??6{{v4R&6~%&P z{yP%&XzBIGtjU6fovlPp>o4~};K+2t=L7*hed_?U?Q!p)9pTGo zu&9*uAFsc|X!HT=G45V0pnP{m{PDuII!FQ?B>{W{k1yN|{c+|8lki$a!9&1czqIi5 z$GhFUG%$FXHCsDg1VQf>y#H>{(UE{fdGTzi17G**nP(WhcDR)RqrI(=y>%??%hoDr ze1S$p(OA&CuRpC6sl3I&b+SNO$tnF<7$n#n+YE3%b$oP1`3?5-py{{n4JiHT?{fM^ z@MCBKqwAdd-e$|=z6)AAq@a(C(oKo)1 zZ}WK>ZOp;~Off>cG`^|)pq%a67+WMCwE)ZUn72;+E6#|oJSybznekz%?8gNY2iS%G zL>=TqdicbKq@!(SRjVNsZ`co4kE|!X7LP3-|JNj6ke8Bh_Np>;gr~3Yc7ieW#A3F3 z1bux(O>uth?RDWGY}JmJ0qVXwa(ltQKb??Czc!!~5LrSDFPd8gD428@vH|I4C- zm`+WhmdMlNSe^COQe~*AFZAb8Z$hy$Rp<@=r`E9+_sh9hH95Zy5KhlRVv;qHRoq?1 zYC3CNzH*6IgY%bfg);l;VhN~#Gr&7#u*z_F@R-ctwx++nXGF5D?z)wPjIfj9X?shZ z)%%*c3zLmvf&3+f0h?XwZ?X;^=7>oOO93E^ssIPKG(Fm>Mder7uR$Abh{7XWdo3%& z>9JHmZX}VP>~v*f$+A(jirj)V6`UL7zCk7F=(ydZq0BrazPHr)TrSEP&sA+QmvlO@ zPo;Q&_^6#{5wN=CPIAn-SnD6Uw5Nh~_dsVx=P18x44-%s@-aTX+{E0M3ciB{7qVxg3=?t zO3}v10=*yiW&>c^9OtVFZr8H5!k%afGhU$ zUahK|seM7{e*D$vCP@!nk=A|C3!Hws=P{hP{wo^Me;2z8-#Ig+6&WKS#kACbo1~02 zM`s0e!7#UU^e$)g^6$NH{)AMn@fPOsX%dq5MLr^>_|dQXq4)k~kr5vGkn6kIqEey0 zQeHp`*Iea2wr@bGbP_dfpkoquCjVmeuUnGFo=`b{_j05bLkPZ!;SE#zd`6wmR`uoH zD@tsqck_3t`}k=pH3%!a9bQ9iR)U=a(pDt;PjmCAq@lr=P8MDPfaP(N|_3(u3cKI_B?|^@u-wWT-;8{efbfP@U2G~>4c21}e69Ipqi<6ELRFDsqIYOL8wJ=RhePfy-#J_qxPoRHvc+q|E1mo+ z=yRY?C-NcD*>^1`5Cv6o4Qj%CGIk#zLjBdz?|OoShP@H~ zp|Tn2iWwfxw!J04b9mcjzJz=%X4qoLTuxN)qYvH>xAOnwzEAVj$K($69_v*MiuE7E zSYI!X)tX+RU)J~b8M({(v!KT?KoKH77QkvU|Cu&AZ+#RQ@t>V&luM@hhml7TzdLzV zyaF#2o2UP#p57#n`zW}JdpCuU8wD=Wvm`vd`Jdm> zlDF6XUhb5iz(^F98Llcz2f*(==NEwjleMy$7~!_)-KNIIs_mFX&fg#vK2gcuwtO~<`P%Akq*ws1>K02L6TX3Ryh_?DLM zf8ty`9=Tb?z)9rehuS*c2iExjf2Z~;4^Bl*5oPphT%aFxA8wv>e0T(xUpQC!frwnY z!Y^V)n&0D^0!cFGN@r}0rq!a!0II7gp<6tjdipgc`tztDWMC=mRq6IX@dBzgM6!6w}( zSs+dU?guv@8f`^t#(xgSBgc~N{EE4rY`f_vv`rgOqpYWke-hn;7XQhAvPn?~9-HdBy-eoT>Sa8E(#4biZq3BH1%9;YmQvu`Uto=uFi)idtDF zZc}}JLh`OhGrA0+(VBEERKOhviy@McgD*+0oyM_7c*bizLCW_Jq|e6~QeyyE39lE7 z!%Lc8h&THCfx`LnHE75D-%3Fz3zBy)bS~MkDrpm!W|3^T=mS=oy^rQ z_GD6%!su$}a7niqG?0}Ui9%Fh7~}gb1q*w>$AJ#b7$gj!2k-Y*?GN;`5Q^yfcNQ|i z>ZD!2f44Ckv6NgRp+hKbfU#iLC42sK3c2pXoDM0G!3|OI;20e2XR2`YN)l)VlpzXM zvNPeKc8EyAFGyNlK>~PsFGZfi*RwkjX?oHLf3nU3{Ia(cX>)ZhIfx~3thA{IaVk?D z9$tpXlDAgET7NUO&h;B00i4lR33o*SX%-wGiW9aQJT(Ub;z=M$3*YY7U*aG<0I_`7 z!ePejv8oLv$ILQ5E(vOLJ060WMEL8)TY;aQb&Ct657t5l%-`BX3exe6Y8N-_2QwVu z{T#}npeDR+#ti7SAOvpL@#Tt5W>W&$TAsO2O31jmL^`xwqY}mNwV&P{zAnKw4gne zR&+hjZ=iM}q1Xo!A(|9sm=M?sGae(Y&W!1rC7z3$PC!>oo{ zR~f#IyCDh-YE3fjw@1FW|N7$fpJUzk>HQ?7-am1;&u{SsG%Ybv;DZE#?GXCh$dyw* z+)(YYQkH z+98l|vjKahmE!`P{vox(UpuskW0mk~lTl_b1%O z0S=T%QizgPMgb;ZQL@@IYX`;@Gz~Zo#~V=q3(3(*%*(Aq)lk8{p*byMEp0PM+$o6i z6g|}=wmseUtunS$0D!b(z+OKk9E1>#=FYgQ3|QIJ=kKq@<$=fXBsaBQHaF8$a@r_% z$d+=>fiOhtKDWqCwDdHqHjDS`Ny`-jPEwCMx)JZp)LLQH*cbxo`y$TMr%~`2#QqtV zKEc`f%4-rBB3eK_nrCe4-I9(ymxy~8ZGXX6H5HAcz7M^RPp^CKa{EDd&+U4{Akmjk0E%{9W~&(IACZ%R+PlG60|+ zkW@CIkN@D@WaEoG1kSyZ)}jynEx{ z7PqH1^Ah#pTw)%Qd{RmeY9^XHN$Q937ph=aXR*i+^xYa5THv_c6NG}OOkp$)Ekog^ z0#iJ0mW@zV>OC|ATr`f@7UfoCalWE{aEyG<&eXxXy!s$TV45Bsv~}%_l{bB?<0P&< zIW=tJ{t>R?JvBMQ;Gs5LGPOT_0Kw2_nwr4Y0Bo~{Ge{}X3-_jX=*h=LSSS^GY-|=( z1z^07lL>FpN^o;3@i3Pt!J3Zhe6j=fUW?V2re$#g$9xcBne~%*QXNo`1K`H9m#I4Fn@~r9XAet z*CaPu3GV_CG*-kW6TA>OP}p*g=rY5G_0Z>f)BQZCAZ@W(jgspHzco#Wy|0;h%#dA@ zeEIf~$i@mR0d|$qGC9C;m5_v8$pB-(MFsJP=A_ooB55v9uJq>GpyL&y5NB7&64dr1 zE947T5ZUt|Bg_LO9bFUu)@|n`#i>i!(~cHI6LA#SWw`B&FpkTF`@cx#Bx1Y7%$InX zAa(JSo46joX~gAP@>I|1LR!#03k2>Ox_0NsC3cftQssaRRSwM!Pl3$~i5z-?zwzK7b>n`EeCX?e`&jVpH zB9{6bY`;*L2E0Om0)3u)g~h0M+lN7T)(LCy3L{BD97%;5^oVe^He}uW*7`Cz;k|{V z`k2@e*Q9gF6^@j|$h>5X&HL2%3H_Zy$WXCT;dSx~cuJ>rr6uLt#>dssrtkmNt=)0$ zuD;sP8y~V6Wa*v|!ifL1m7NNTQ|jONHJ@}>Nz^muhc#y1x;0Kh?`jPb%%vy7n0`|m z(r`OndvsS2P0l^XaoclSY0|xfSx6M zOle6oz<67H+nl;{@$imT5cY*i^RaG&u+o9HqI`}((aU569isWH6E`$arZl6RR`Vx8Kp=OOZmVV9W(slLl?cTq2J%!t;4bY=fL{T8A zKsw724%3L9kogI|qW6hOL^AC`?kHYu%zI7@ICVU@_H?6pb-Zu%_h}ApxymdA*6sY6 zZEG1R6Hy>d4h-#WFiN^!3Ep{PE9PH{P@^ZRKH#~nuXS`~aMP9J${1Ln^yiQjRF?2a z3>`A!(rB{}#oS1<+MFIhZx~u8LkrNU1z_lyh|%5c<@R4WCXgqtfYs)8teCFW_aCBs z*Cqyp7CO@Y%eu#v=aoV5L&bC8Uvt@2CL{VUWsL1oSi2T6g0@O5iZIq)agS}qjJ#t4 z5q}T(Zr;GY{i^jRNq2z5m&ygz%aN_Dz^sDYK2btewvNQj)l#4e@QXJqKV{-l!=0~( zTm~%PQ>0yU1hBtHuJ8X%+>ZxAQjGJQ2KKE?PdUx)>zXLcA$}kCC0{EF`}vKN_eFw7 zUV_JdLTwUuG&$nAf*a}iPC5ZCN$2zrNNsx-BTe%n?Z*vq-S~D8^I|XrbX7#1hCsU} zHVJ2yej>^~Z1Hf*DZeXl&NWfq=tmI%F%^j}4?*D2@m@5r96atU!16+SX9WD7#sQa) zpk9cEg^wlNG;$8n0I>G}rwt193eb01If$x#gb}iSNBE_&!4=jYcE{7F_mjCiWe%Co z6Vc4pLYBO_2_U^c`=AvFh71zXY23flL;&s1q5lOsswCe zlxDRe^oExFX6 z-J=W%H}&RFMIYVf9xpbtX(_8{I~=wZV`?JJz{z;7At0Mm$o@Ut4;P1q{M_CsI;S%A zl$j*(PCN={{I=t6`i$Lg?7jYey_;_OkxrhrL&NE~n0g+Z->CM0Xp%9qCTE!tt@i&BV!y;DL|#qf(BF zVQ_s>Qa1yrCv2eSB$JPZlxN^p>vm);?^E{xyO+mibze1i>>0^)Y0@&i)kAzpZ;Dg{St!wDcHUimf8EwI zN&B<8=wZLWyUDX(wlnLb7zY{T04uByJ}~Ls2FD|t<|j;P{xMw;RB#f?a)M%^lD+|G zkTMic*98UZawP4YD$ygdbrU~i<_bYv8x9^D&iL`Do!|!x>|B&AaqBs?V}gwnES2u1 zJMu<{bA?O#@(91gaJ~zLhv7pmH`6UDvdL6~_|=#Zy`q*WE(w#r55F#My2Fg zo~Jj3H0Hz5XNNaneD7Vpp-cF5l)q>~zm1{231~2sh7o6Y00$?Y@3cJ)DMOomjAA5_ z*8r6G7(;kLM5e^NTeuHRG2E!^)uyL8hjV=ZpnS*-I{@~X)oZ}zjCN0pJJOFHQSRO1 zm2hI{4$?Sf1*)xrg3}}6h(rwZdN(#AWf||Rz!IBPmJW4`5{LVo%Upasl6H)& zXluM|w4>r2-8w+w@GHmY^nHU(hElwB_xNHXAi0l|{wa4A!xKdmOI^ z^^UbIwh-kcLds@;=>1xuMaYuwXQ}zuaBbpHW66DCbEW8n%{cCtT+=OSauP3DNp9SW zTx$Lhsh17YfGW0pDq4mISHKYT{hISAA^y@!nH6se^-UbI<)Z7ic;rL!ONf7IE=O3M zN=z2Ftg z*UM)YDh|3!uexER89Mz=1}-E?`RC}Zm6{{8V;^tImhor0#>=gFC)wcrg!Tcd_@R%> zxs|TOV^)^Hhiv%kk~-`YX@r-MepV6N{%-Fw2%Rw(`y0`yc@#b^5fQEOHpAKm_ z9+q-O?LQEFj7hi{Q_L9~y@+zcnIJ6v(F#b+nbTPWq5Ih_)Ll+KQ0QaM*x6xq8-d%} zPpbFUmd$|(*A`s)C7_>zzQ_acDxR2YFgotS`_}}M=laXSS8`C_4g(7gwTK9p{P=Xb ziQl9pPJ*l!Y+$t{_-7rLeU9m8`I761{na6ENi5e;(W2l+UDD$-pmg@lv=R+?|3`-u z5`tuRjb?}&g5F18N}fD-A^Bs!N)9Qb;SQ5;w!Bw&IOShNzlc&O0zqht$=z$eFf;c? zQ72-}+r;8Sq68Y|cNKi`vGz!_R;cpagD{8gCzx38R{TL$wS8fGD22Og(RGImqBA5< zXFYQs_rBu!0{3qGD)3Mm6zs$MXOyqF_dfMWrq{~nAbL%>o5C2!9nWW&He3=o*D>u@ z6$GN9lzQ@jA6!wEFPN1_zK{jp&@54jyc%Ik)y+mA43%YtX7rsjWrE^ceMMeSz^D!H zy;mP5ben-B-0HdQv@cQ4szJYi!e7@V3&VkPS-+ozKe>2`!ma`#E_IK_NCz9}k@+&Q z{d(m3#Ji%Wk~A(2LTNPa+WHBh&trW@PTk;*wi8i#FaO-3r6-S3mWtT$O3|B-ZE_=U zt2_pxl=Q~2@f6>PtDtV45NE1ax0%%I{T{VTpi~b}_5nN8;?vLTe>jlmFOt05hK!q^ z+&A#A;iQimW6p*@v@MpP=4A()Hc*BQO4#`~AYV_K>Qkgq$IqTGd!+7^t1pH(_zf`@ zB%?OnJ^YG({>xw|q4~!AjkdZu(fH~gH52t3E6c~-DF;pe6V z_LK!oBH`yVfvKj2;=YE5?e zOW|K}eE2HXEr(@31<@iwR-i}oL)G(qV|mxVWUU>C99?r?H!-(Qh`-5aIwREs-9LXm zdQ|p{&z6b#QMiPh6`s$ExFZA=MFL|v3GvuLRKZ8crWvZmTxThhf1lNed;=JoMX6cN z8WIgDGHDA80~$n0egUDx7(P{uiU;fOcj_Y<{CNDUqn|8dnVAcarrU|)J7(-t*Jq_h*#WDgDWhvEB1;2eW&&{6f&GlD)z*mx0qmt)>N0YS2o!h-U&q+*q? z1m5RZhp$!;LX^|$#9ARW^1QHgJXMXXDjkn?0F1}nQIaN0Q*%qtWSsDEB9a3p-XQlG za~ZFTnOlXgiU#JgO!GH6#hrMS0oW*uC<6b~it9nqg%1PfERYjPg=7{I7#Jyigzp4! zAhwldKhZ2lZT{p@6XX9bE?Jvs=b4#UJU~hMX?4V{fZ%ogaS9O&^pi|kL(?N6^GDpv zR=)rot{lc#6P&u7l~K>9ziDx0Hk_gbHrY%z-v`Gfu4_tQ>(k`ZT=-L-JtymiGxW^Q z3df83x$hx!ISHM=@i+j_23UBaJ|~fqEUYbrhf+Y7PnesQ^EoVAXV5=I&Go*p7W!;2 zE@(2ZTR?aC-kM<2B0J9gl3xb2%|z-*&iIjwC(QjWNgnL*AeHR*C?H9A z`PJk%LVQ4PC-4C$AQ{Z(s45Gut9Ufo0~}6A?N3QlhmA%RoQ25JgmRV5u8{3Z5zkCc zw#vHgTZXPe)LI8sVjkd~z{`Q>|GBB?^d3pGcqh^gX}249Y-JwqmuIN=D7JRW{`25}IGp(#AV=a_M5i1k z&@;Z%xX|8H`4XQPwZAu&2#h>4F^Kp8^bh~gF}L;WIz>}f z4nB8cEZ+eL#G0CD1cUXfYWYno1<`)zMvu7>x~$HBe5ILySX^_6$Jwa&X~I<%4&#j1 zNFu>Qt$L!d=N->*07$#)u0dhqZjIJQr_;r}4-!8p&OnX*f|F@O;H5al6Fq1YBdO+ULm%RA5-VpYN{X|uhy^XhQT;**R>Y}M}(12;JaK7POrBcyU_c^O;(~GV+NP*K7Q0Q%hzQD}l@43U6V% z4Ltdkx}~oXzu`I#5I%2uAF|kAK4UMB%|+uGq_dZn&{Kc6AZzbl?z5c9;(-$ z+B8%5Q@Z9*??Ld^ZqzW1CrdQ@;hjiSX(;(>(#e94uA+R9$0;~%v%_qwD-}ns%_Z`O z24BN7`3nKz{ihi&M0A>&uw7N50!ca|F45(Ryc*Um-ikwW(`0AiM0PqJ%@(iN?v<@L zBbQB93h0+nSl6!W1SF?mB9=%VV#-dh|0Jp5fPT=BrlVwr?E0o>SDQHd?buEav^m(( z&P>XiTjU77BRf4>I^H{?U%4*sjKcsp7K~6}LdyglyEnR_kN>kf-h?E|Gu%Ch@r$p* zk|^M5u1=Ap<3%NPgPJ(jV$Zq^QSM5;1onxd6`&x4=NxlLY9;ISLv}})s-YM5q|A(| z-X_t)%NDpjDDVz7q)aHb7r!31l)3OFVIM^_M6Pzbf<@&;m2)}~RX};7swg(a9}sqw zC$poEi+(CV?W?g)XgJo9j|w0E!}Z<*AXiyI!T7PHI`T&Zo6HAi&aay;WShaO z8_(fqgKr9b=-DJ6Zf4LNx4o@lWtK3a-N1XV2~VYxq~f_pt-FS|EL3ML1Sd|Jebee> zTuQv}SCSbJdG_iIkHD70o?S5hUyWK&J8XXgsB%AVXxHd4Y}O>H0tZu7iIS6M4{pD2 ze=^YTt0V0<2xfJjT7nGMtqrRt=y2l&)0jE5ov6w0T1`JHOzDn-vU@gt5`{k*|Vz>DtMl6q1{NjXW--AQ%L41g4wg%8G|SQUAE%^8}RzWSR>OR`z(ou32?r z(52mTjH`-^9Kqccg-#54@|p@G?ufOQVUF2rkSikkhjF}^CwTcYs;aaoq2EXT ziWnZoaR9AyBYL}nilMG>lNWUG5cAqhzt)ip|HMnh8f>-z_sbACDJabA!2`~7^{IZ_@XGZmeH zkcvr}KLLF#2f!9FU7~+B;(qmiSKp~fYMu=FObgjC;Qqv4r^Vs70&h-CGSG zOL=}%gG7#JJu~PxlZY3|w=!P{>%%;BJ*KyBKz%0K`izHcxCY>@(_z?ICF2hOmqoc^ zZ)fhF+p`>NChmP#&wQ^de|aE}l#DUgc_906cC{eS;1o>v8n`Q>6{#hm>`3C!W?FK`UF zCh4}-k`kGG`<+44je!C-F!^>$^U==?zG@)WqiQzEkkIAr{)gxm2ZvIawZg`zc!}gb z_rzf^3!d62eEUZ z_(uwxdxNDW30`o|7^e{it&%T)%ld=fnYxiu9-;3RqyN4oE%P7P`w6Gls@a!k@7v57 zi_ew4uTLECOxBsaH4(kq=~HJ0TeX9lqZ+_%E^190&LbNzz;lf!9_)8bcT$3qe$v-K zUOpDf)qmYQeexf%6qYDZz>Vo^*XP=k%IyJmcOdua$L`-aqP*0nR_3qO0ylKORN|U- zTk+|}HSXi~Hezh7n^NnraHgg{;DDR+xtoI0O!9icb64U9yyN)tk>hh01O5_01Y-g< z&5fAEE2!YsLG|r{fjcw{408P}(yvHLsVRgItZvC1ufG(Kd(Ot?szx+@kC(+|r{Jp) zefME?&5fgxUnV>AgHBW)PXIaSFiAbG3g4ifV@CpAlZ3mnUgj-wxKbVMqrTdF?n{w5 z?&WQr>yGg21Ky-LJc!dY!)>M#?0ML||cp2_->qV$wjNlZn*%KrjzW7?ly<;!so%oL_YnDN?fP};nDZ@wyg z`MRr_k9W{nzx(G#d*oB>qWXIK`OMZ;ICiPbh-4WqCStn&`HR^te8U~LXrRMkMK&0Z+Nt}>2BlF4LND!K0?*o3b)JT3=+o8G$&D`qPbZcQeHmL4E+d-2P%p zj&{dO^mkDi_rRw;}eo7-fFi8D)-QAwP5mK48k&8NCo!gk7gf9V9D zyz+zS+Wk$P!>H8?oE%ndLOB%&kMV!DWAw!rptO$y_1vNhSUeR@(SS@<_&}Mfggnn7 zP5pG8;c9WWrnAEPL{OoEkUW^{E8+VKV6xJ3dH4>?zlrA_GfNJCENXn> zlCsp@YX2~0{wyHD^M$KY0Z^oXR2Jb^6chTGQ%F2sF?9K@9-&F}?0>T>@7$%7Vh1z= zZBFqf1MgAZD`#!$hEZVAJ6}#@B6gN|EmUmJfq3rOEzN{|3b|9@T6aGP@k<=pj8AW} z@CcGW#cXrU`}ei3vU<*KKEdPpxNN!_fmn+Ki)tiG6X#0dbbfv07jgaDJn|uR&gwPg zhFtis?_Bp+>Wryi3AM#%JYR*M1J9kCrP*65a8n>jpF)Qx(nx7H#@zermx(u&NHBJjly5=PzN1}94k3L#+phHjpis03)-nE(Ajz}Uk-HJWF0z!2ea4P8LG)X{e(COR3cj86`J#m-fDo{HcRxker zWnNFN5+|siO1y+NKG8>*4msNhI*G{O;+yjJxS=}zZYA*%^q{#zT#1L4xRASKt}Kq8 zOY<<+wWcHp0nAB4tfU;{BhuYeKK18^kZx;wBwn1U)FDb5vknIo$nvB0(TKppZ}HY( z3l)Rhr+0F#%Fh*%F-2Y5@Qbhlf*`UlncuWJ zQRvjb(UI*GMuZdoeakIAmRLbWz%V|&$m{c$e$pSYBpH(>8T+uW#^)!&6kw0kV3?rh z3bYB&vgM1;+sox%N(%1TH5cHNDJ4MIX{f;OKoRvpsw-JmIXRv;>3oz;xv;cA;Z>zfjy3uW5!X zPj8jHa)vW3awNZE_q(NjbCW;{_L<~yK`X6~HW^2~XbDF()3j3PyeHp-X?)JlO_T&* z**UggOL1s@t+@QaEqUZHgHLKy%qdr2{#IypfUYT!Te7j>uDZ9G;prqQ1gU~kEMi(i z7Wh?kBZRn#U)KtNoLgQfF0o%qDdyAW<0l)Fj?4`OTN>_CqQ17^F=7;v=c%p_+-t<$ z#R%NN#hItLCS*UE56a0AxKni5+-FSq@eS-ZK)$5&9>XBrO~G4U*thN-iD!xRtOnk? z#rv3(FZ_CtuuNJ6aL4oB8QdAF>tNCmkwsa(KEhOv8aFP{C4lJmOm@&6$Q^aJp&>6K zo3xktc;eu^4KF3N&r}3)$mU-+5%V~-qV9D18pl+m7d&_YM*QvFt{)EA`YaoJtoi1REIf2*CoK+^m^h(O!}}!ro7b9v z%Kp^Vs`}F^XItApWmyuH*J!Ke*IN@V8@n@GjR%aRC#JTi#;sqa5yfVH3-XDcyC=X; zJ{5|kRHxC18GNTe9u|O;q$L< zpjKESxPCwp@*MQ64Pq?fQf{?G&`|v|6K%$B*nb4nWrhJRckF~8C*EZgixt9KFu3>V z8aYEm&I{fZkVsZ0Rr|ZeM6}dS;m5FZ_LkKGwp#CMbyi_dlyD8ghOa@5f^Xb*bI?=l zmqL~qY~Xt?v{i{`HEbsdqGXU*r;hP4>gWOfD)5QY_|DOqB`=c!%h zerW^%9}Q^E#DQwqNjz$J9xdn=YAQGgeC4P=QN!TLG{+ZzNhSxC zBsBn1uMyavV}f)i5r7xXVxS4&2oUqMiUc?mEJz*pO1PBxWYn5>fp~wo)bIJ2Uhz38 zSKw*B`vg8y)0N+TU5_KDECsWAcc!CeV%c-MfcM-=AYCBNO{?RquR|XwPj`LYD2mO+I9AsJI`Gh#n(emC=O~(Dv8Cg-VuvBi+ z)FV4m$(is1l`mIgKvZN)>3_Vzx0rokO)i%?ujLEvvzaoa1fx#YH@$QPM{;))t$`@TU`dIA)4F!$gKJkVJpLUOJaYC`Pd7M60()2a9CK$j4EUJ?OAm{&Bv(`ZbD2GksIs*I)#sBp} zoJ%AkjYzEmc+|qJpJ-N9qMgvXg9(LLvC1#m>?_evm$>I!98R7Ssw(yA+b&bxIpFsA zNP~ppLBH1Wd6>LaS-28jk?)P>x`2)A;osvoH=zq$uTOAKD~K9fbK^C5FvNc`3C{-w zc#A&^GW>CyY#3^ROPu|Bsp0n&%%hbiTSXAC2>Ymi5wFIoZ$$j*^WU(&1-J=-!ZZNS zA00R`u%r`E5Sce>(<3ZFOkAE{G*R&5mMjXYxZj`R@ zg=y-RgM_G_YNg`sZ@%`)vE3u{^|QgS&1EPF`sE>(!)9VD#@Xycm})?T>8mBioI{gl zQCWAHVYBYJwi$;zs^Z*|#tNK(9IBx-Rn$VQdv6_6la2dFxkSK9lEY`}o{8L^$JM1Y zu$@>SU)YmZvP)YY2iCYQW`Yo2Id82`XbfREf{38Y?)OVsG-A+Tu90~V1O(Fz0^i2T z{215T8$TwUhig@bl7Z-@c^QLe*k_TJnwGe-lw9aSZ?G2rLerBcGzp)1T$zBZMOJbK zTR^n0NS{YitVyoC56xs9`)7-5eI*N57h!FCa3yKlR`K$XVXq&c-#&PJeMclFojYyk z&7sqvit>ZL4wqAWzGeb7&@t{P6)mY;N<}bpx0&LQH~E6zX>G@z_+j@ zK;xC2?dKEj!_7egWPkx#^vzBeN!`{U0#C?$o#hL$NfemU*mNJ$6WH{KA|A1llUF3o z<~T?_Y0^9;Xn`UL%F#xUiNLXuVL~YMBQZoyTdjzt#*5|N>jPmmbxN~j^e=%`K`?`5 zpc89LNCQwMDCn*!jsShNW@!la9TQzRD9FWa3LT*WMbKcNDFl1@2=uV8ui`6sJ;?F- zc846zL>4&V;&57@M|k3b+Fc4J8K^0O75Huj)J!nUb&!tX7dFqAHVpdG#gc{f2?_e~ z+U{ax3E+i?kVQBThlFG=I6lB*#ZS0_0a%d0!{sSQbGvV!_%uLM@FR|NiHvZ77|o

    #6c>~6Cly%X#}*iAFzO+f%*Ps z$=5Cbm#2`3w7f6yEI|X22U}GA|NFsy!HLKD z0MoJcC%ekee05Zrp=1(9NWCMFC>HqWr%J-ltVz8v{yWyB3^Bd8YQERYf-vg|k`GZp z3Rbu=;f^KUy63xHY1oN^g?$wg3J~Ofn`MN-JHh<;dNjX-^Z-4(j{m`hf9r~KCLK<> zS-wRGazF%d3ES8XgxPN@G#6BGBuYhn)AVD4Z03a(PX1FXG*T&4ExjvjlYnGU;DHqL zvOE-?n21dB;Gu8{(dVPqkvzh>-j9cLg>>J3$BvpQZxJNFXyG)YJ+3|W)Y1}9(c>0z z_wBv4sU6KNc!=FG!48S&ejp+dF}nj&LHNSVubi`S7it84=@Iezfc5fzb`@Rq0*Y5Q zA_0BK{Hg2B6U1l=Xbz4Z#cbf9APP`+IXo#xyZFvyEX14C#D~$IqWe z0}xYmwj{eqr7|w0M_e`J3>U9lp^+#fSMy8MMhd(%us8 zx%_ay_`413I}9!v44%6_lCm z2>_^rU?pg-9HK%7>LY~Z~pM`^mF+m(y1TvBKv zEavbCE}2OJ?BDz@wG~fd%3??35O}dZ0_e~+bR|;9WFfNmXtnfPUe0Y6>F`ysMb1pp z#V3v`KrcIb(ZwfOtQgAG-%2QH`VA?Tp#8jzI}Pkkqrj@fws3q#G;j>A0Eu@MB^~|+ z$%Q8pFVT141Rl*dR{mteV;zjCX1@Nb@rq1Y8cni_^?D0`-R_)764#5GsY6U z*^vq}5KW9pOCl$TR=EfYY9aA@kS&=w|%RUNMlW^Tku$%8r2qR=;LLNvJYZh9l1?fa(bVDQ-Vw@ zT}+_ucrab8H9^LSB{26)HioQKdx6f8Fsj3lG$nn@GR39DpNWjkOV0&sU)g`{g_Df2 z;n#G%6I-lkDc%6d)LVI=;}OC?8Xa6n5Mn0CbR~#i0p{TXMC<4hdq7D!y4`U+_#WY= zUEag1Vuf$$1!xl7mRyxxBKPR4^cEAS*62;2IA$QGI6(w`>{ML9=tymo z=ox$>ZfXt@dDR#5Q@iMzAB1wd$$zZ_@{-8yEMa^Gj|W10$Z;lq;0UI`6kE7XLUA>u zFB0E#+!yAi@=J`(#UMQ92zvB76!#_pWTLiu7fW$hh;;|Fo#B<&QS<0MKVTSMiB!_@ zNSxV}E|WLFtMN{Y4+y0Y9)Xp4_AcIyQlo0qcsppWz+%+QUiN=tX%=%iHZ0X&MkzKd z^cYSYT?6x+Q@#)zd_+iTi4AHrP!yMVp`)_mNh@ktgfq$fF$8X^VF%WeJCMvjahV~% zhx$iMyCx=e-9YMnsVE@yol5Z|`96`Z1j*Jk)t;UwKb*^t`GIp_N+m?l2(v!>%&TW< zQ@5KN8Ws^>X_LidekYT+cK}e^a(GeCkm7=rB#tj;Uh4LJu?bwlHnH+HVDUTg9>PyV zX=R*+pEwiW&T%J78tsoHEbs>tYB;lROp1<3lhI{#rmsoK|CC<@g{Q#2YA3oK>*hCA&7*Kj4K^QJQ@zjgy zMUvq4*Q zMLDadq0-exzDFK2B}Yq^y_2&1No(?b%f!#(juu~CO`9EY;*+k(W8S*)zD?IaT*0QR zO*T>-ZE2rIR%z39TnSch1&*;3b+kGP(g2=V%Mr36T~O>>d&IR~e(~#v40In3`MYsJ znOkOwCKFfHMw8xb8p;&~2-o{A|1CcS0c~z+eE*trER}-TYQ=t?JjQBShxToCOD{U9 zKJGK^5g&WeEEFKb-QgSw#2Ay zeY*Ahk(2;j9pe0`W5Pd}amO^^SP3$$>W*7-pMYSWjpJ~2QO7v%rc(T08hJ6pMqwyV zK0W4kzIU9#SzO)zk9F0Nq8%%PuU>0QYJB3)ubez9Buy-=KT83@t!c)loaDmiMxBE% z$VoIoBmn=`f<_esrZrJ7jfK!yNHJVskuM)k2yoR%Jy6JKm?1cQPPz< zxgE3HlM|l(2X>>R1i@EZGxS@+kOkZfWE~2o#Q1r_WXIm{vkoIh_SSLx@S%V^C#CXc z0TLq<*{Wt0>4DbA{bPEq6;A!h_o||p zg2fZYp8zc{HQMaY+0`)Pg{qH8@$FxuMpjd32~EGs!4h+?ZgJ0Z)_U% zMAWx^RG}IB)GeDC4({=UGWr}*b&mXcX;m@9c|krPzqdNCYC<{V+72c~Y7~kC?Ta5= z+H^Pq^3d{aHTShIJfE{WRv)evYH25@q#8otb{Bh}DKxCpHOd$OjX}QDEG@`6YG7_l zfr1-$Juc})(egvlo43~;?YHmvCTeEtH@trt`2xDo-FQv|inTflz25QykY1KLqOFK(E z&vV}2Nq-HhKib}Nj0uWqY=MkRU!4>@ZRV9IEEDz&*zV{@j>#Y2fAai4WI>z6u zIocxYzhHIj=iXn8=FhoBUWXZw;%P$yw|w%5(W6>T6j*Wx0aM$uzhN2% zcp=0Pl<|W`uKPGxd&Wg$eGx7shoU_XVNFe5mo;nuiJOonjz2;#RDJDBZ?oFwz8J(0_kvyZN(}U&c_QV!~}hz>yNL*z4p#VWTQVA)8>{xZ<4T5@zaz zAhz^X0&tf7{FMTdEtKXtdh}b2?&(cVZdv=tXGbq*nD_6mz>wgjBO!qUwtTD#H7TT8 z1Wg)E^Q-*pWk=>pDjx%WaYz_v%IhMPjysrxBk>fXQVp`E50IkC_+oxflj7keYa9cu z6|rTFN4g|JRo?JhzxC~*QNOzlez$t(6q<5M?!n!#x3BH|GcsbZ{{DIo)=uHI65=(? zFm3@;qURU@Uq0=I_=7%eX@X`Ms#=14^0nuNGQzgX?dA_prtNITshJ)@&b(8wieL}=;hCMTocvR^2|3*=rmi^#ZB3nP6` zrn_!rR1{wb57meCoS1xu;RK35xU86$hKYG4`BU?SYQYN%Mw1L6F}Y2m=6Q2rE&|uB zxlNLZDm)aN+ps3DK_j&j=m|hLgq=67o6I^>mt^azonfT5Hpf+a591zD#N9`ON20)< z?;dZ;kXtDx=6OIn2A49Pl_bZHLr(2k9V<#$AfZ45Bf&3@HwyB}C$DhldRl9c;`lUp zEco-B7|uPBKpm%mPE(B?cRAo3t)C#YQ+IQD-6$FU#Gy6Xi3KoNpHDYW1IDkzx$g9G$fhxzJFf~ZOapIMt_KfIs4#%J(0|LD&PdA!&p0=00`LMw@@qzPrD zb8W`P*$Rtv*H@xd$$TJKo-(zn!dVC7G{*pva<xblfsx1TlKcO!CYnpCXInt#oLY08B70 zZuBze;idGq^53!1xY6+eLR7|JdT=ekQg3xT%jm0tlA5(yS9nfAv|AN>g!|ZIuqbzG zp#$HhF0Woi*dr&B6|UhJUs*{~dv9a&ViWYXYQcE+by^i`t!W*{4*PkdXdZO-QQIrw zTM_<)31M2WXIgvC*?w+E9i-yVV#vx=+LzxYJHUd}jpU?yes zqC^DF_xo;*8Hfab%(`?dB36>b54{0EnbP6cqsrromM(|DS%R&Gu=d zeaSeJx+_|+3ysw>Pq#pA4oSQeaHYx_C$Cp)J^zZn1+S5|S>l1XTQR}@;@#xSDH7*6 zkYOj-mo3CoCtll#>m-){OY{wQ;w9T{?SOX_zGYYfmMduB6v>JA=@{aR6KoK0l~apu zbArCb!Z{JpQ~>w)7ngmQA;K{tQOp=SUnm&Kt;rYrDuT}k;QFNxQB-$vJhIIfFNHg_H*vnca1;4kh?n1gf=j0Nsy>zw9}gjVa!N~fI9N?c8O6s5OWzD_Btcd~&K z(4MQ1Zr+Cw;2!EgfJNv;Dxs`VNC2a3a%sG_7IPDEkz zQ6XHm3E4)<1!kT3CN^NZ@muEi3+$$iM=f(j2}xo@1+F%nLce>N3}ml00i7w=1n%*B(D>`L zL9&25DJvoy%c(BuC%|No4@IB_P@Ie55u@FaFC=>a03H+-5EgKArT7d>;BFB}jwXHk z1>zqW@d=r=zlb;hzq!gFLqGB~c$Os41b_ItD{We_+pz%LuSCkbOb0R9fVK|jz{4^^ZqMUpf`I3k%t^)u9x92>`L_A;v zh{W6KCo3$PVBbzb9s__NDwMNQwp`5nID)4*z0!IMkp%!CBk1M75u+FyU={YaP5Mwj zqbE*ZP2l~-C=ZPk_;e^Q8?%TlvKQG$?ES7l0)VoVN~9BNl)utCqb7(_S<+c!H&dgw zUsZ7*UL%B3AoHkfA*$AGbSnk<~vgfhfu^C*ljE4LBx1TO@AJCxZeIdd7m@T&W?{lf{MdZ#- zI=~4$neosXhz2uwwi$I&mjw11m(XPHg^W`}n7b?WkN8DV*COtTazX!M5iJyfr_U}g zc0S^N>3-lOZXbb|Q_7_L@+R@ z5N4Blrp;X~flp&68nzIPfspM81TzJE@wArOO3QIbD^a!8%&yhqe5+Mvt4%|z-OE;o zwbm1m$IgE^EymsQ?MM{%jO#b#Y2hZwKJ#9Q@2<&v z#Syd{gl#;o_D^8%I2{cVe8k%fG!*V`R?TRADgS97Qa^++#yNk`F&%?QcE1#Eb3zb- z61gv%pC9Wsps4Wb17Zlxx)RNwcLlEs2k`jf*1$)*?g4ug!k^wePhb9z3l~-s!H?KJ zA0o&>FhbhbTzb?`LY|yP1+g32PD$`&9bPk339@Kk3lXb=Z7YV_I8 zI1$%TC&c`zTbX3fli5o^3bA~J;heaCs zgBXJrO~YBt8mq|Ry!D3qk>Q*&-UnHY&t_`kjA}d8D)XQ~Tz&1G_|n*|(sDHbMto$J z$;1z{`XsBKpN5D)`!L25A;#EONYvl4b`|@pA5o@`SEZcph(+38d>I*ixd2^z3?NY5 zTX>0Yl{k2_5tZQuj$Q3nGXkXV9#$ zm7s)@wfi*mx~|8d8D< zJT*k{mXF!2zveqY1dUB7l$Y8XfixZr>i;bz{B3kAgFcxqn^xoWc?t39#~?!IpD)Cl z#Ck|!qD(de|NF09c#G05EWk`?Jp2fFmG4iTe>HVsV=CN%Ys7O9W?xh~GN^vKrYWAz zp>TDl*KjB!00$<}1k^J!WVt=o6!uQTo4Kq4;2NRJ!^X0hgS$43O(UgkL*oUoF-*pE zzBlT3);qU&9?$r9Wl&(!g(1)NfwT*#u5^^g`n%kbDmSn9ZS+^5X4PwCc<6QyE>B95 zbhNHEPWI}k_kT$ETl9?t|+gK340kI=dCg6z94W$yv6 zUe^8{Sv4sFW{=U<-^Bd)ZpY@K#fRzMo=+KBv(CNp1TDxU72VY>_|{4QpA#)x@!ykc z=P&C71atit-1;=c7t!rE6>veM9sAgBmV2G}=+U2n9`SLJkHsA;Guq|QAX?rVlpQA~~ODsl1ZIbPpeP)!!MwDAP%L=5OzkV9ub&=+NU= zHQqiFol;oI&H2&>VJ%aD4t#K@OzuahNGy5gw$w+_VdhXtf73yQ#r7iQzk%h@H@WLG zTI!z^j1ZiI*ZP0oWPN1sseg_CJALP0L-D^)S>!Uw3=Y@w>9K@U?9!gW*s)2d*YmXS zs*LMny9^krVktPhs&xGmTH{kA?5z(7RY&QL&Jq4cDAwfdj`7i|W-fa=msx3nJbDHm z_RyW;c><+pq&6C4u>fgUUz$dxXZ-Uam3s8>M%l=QMQ`b8$r+LOF}@2kmbsg+hbu)J z2R{F;=$R|y%zc>mL1j@(^)wOdA1B90D`!UEt$uiC9XXafv{^i|k=C;*n$;hq_R(7W zFm^2OkL%o|!23tb50EIKqUE`384?#I$n%FT@g1Bql#N9hn0-(TxLx%qHM`-1>v&SX67XW{^ z9xB!%jz$WMZB-X${IcK~+TY%|P{{jie`w_SuV!a^A0)z`WB3XAD=T#G1);d|<%gk) zQ=*|W^A{w(N$I0+h&<_RR4;GLxgL~%MB*gsiQE~FS|*~xAF{|syg*h2fM1h!cGq|K z{?v*1W!=4ZqVd%D9vk+@*0F}R;!6p<7_%I+Ne;iXR<2XZ|k zkYkX2Z8xk#k@lXMI4(J^BLW82RJ;&SRzMq7yuQ#cD2q*Yi`izUiL2s}_Cr*%{Y|7v z4&Px685D$Is-VSIgu!#N@Y9m3<14Op&UYQ}o__J^x?S74^wq1yQgrqvO|j(y@nLp{cDDR}F) zzUZ|Y2c6jhS*iH-gH(s3ocnU4z}c|F!FY5sGDUMF%a)SuxT{8&NT1`8b4V#aHQm?cpJ=n<_)fItD%C?l zmRCxHxK4R|ue&)lQXW~6Y+TBlcy6@(zU!InhR<5J0#QO%8Q7Uf_mt4f!Inv#g+(-P z#p|m`J>5?_rE|8K;xO*Mrovw?&+Ew=~Qx{?b_?&F(tXvXmxG0xM16! zT&R(3KXjubPyocf^5wA~r&HM--&@iI}KcbCj0vu5Y zpHHofjM73saJ@o*UU5B~c#*;lI_15?ynVIe%vj|e>E)@)RBi-wf(hi6nGm~ca%+#Z zc%|oDow@X_iM>g^f~V7#%)8J&XG4 z`vI!3g!$fwnDa+hmS=Ut_F|;G1{>6E+K{1^l)s+*y{R@zH zZ+4mEi>w$8l3-!;yB|f0E=kOKiObjUoaw1`pZv3+%M$eP`ceNMJ@2d$&wPO@`;p3S z1l>-3xd;3BAt~87w;XLHoaMA)+$LDSg}7>Mlb?3J#;*8H_MHp1Mvt6Hg}5<7hi_Ie z{7D`sa&#ftvV$*VG_Nqax+aG(l;!DZJ~rJp$;c-ADqPG^&vy#17#q-Zf8GT{ym)1)hx;xc_G_Ir3D!JcYcB_tioCASRI3sY!5 zG|JB4kK3GkFLqhh^AcZ?vG0#}*Ga)ue;y7H+s z;hUu}ED7LVJ4Q|4SJ*4w@s2py{$s!HncU$k5t3{bpPh6&MnJ?TGRtaq!0=yW z#K8s0rOUf}gAPxOb1Uck1vgDfab$|1QyZy}z0% z#vK+pqiYnsSL}k~-jx4~t~>kfi@}Wwt+uO|8-u*p&Me2h>-~3`k?OtfuXt_x)%7c_ TwcZ=&pYG%8qzfqkz_I@Ug;zfV diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-designflowchart1.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-designflowchart1.gif deleted file mode 100644 index 369d0de5630491c31b1a4cc4ae1fb8f36bcb37b0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17357 zcmeErRZ|;`^EKY!1b2eFLy=+uf=h6xxI^&*#Yu4Y;OvEpupQYc=arTIU< z>-Q_XJ7>U<9N=jNvN)ROxi1t5_f@mpO{$mg=2n6B)QF5?Qvaqmlu+Va_fCN~GI577-p=0Ui$V|5!jkT!2iCGigGH7Qcy)6 z6%`c|6%MG1oQVpLhK2@IL(xKm#rl8XfkL6yPyqu2sDXijiGhZR0o2)m$Hc_I#KgqH z1ZrVo;AO&NVPRoyVPI`x;$aWGLm@Oq0wKWUn%7O?WT6^tMHMCr<5NCM_LtUlK0kbu>ZuO(p zmw37lLWJavPDyOK;LgU)F3&?WGBgf%QwxesDcIcLe{DkRW18f#_EDWSHo&h~b=wz{e`2Rp|Sxr@vA(}vFW zb-gReA>bM*kz>T?vk2pUJ150n#!Yss^7Tt?McT<)TTG~BS|s%uDOVb@qNM-R)5sR5 z?gWcxG$gi#$`ZkH!{HSFEEu|jo!%Ix)@Z%k^U+YEiheK(S@=!mg(s% z=M_gu&3=*GvlmAZ2%*Ta6UdTHsS`w^Q=-BaKLdhBAV%2L*!bp7ZNek<%gQ)h%!kUt zUF_0T!^&nr#lG{`k9!KjN5F$5Qgg4;4+wL?VqY|C=OY+tfXzV;YZ*t{`#?%TbT}G0 zr(Kc=K{rdbbJgSl8Q*~Et^9XdPF02bM)!{> z1WvkLezCXHQ7rnk>RFOHHTQhUI~hv1nr5Xx`3;0=CO?7&vg>N&d71K$qm&*4FasqG z7aL2_sW^ev)Ipo{v4-)BHmsnTCx56rDzuc{f@@`LVAKVlR;}S^aorV6FJyli zI0(Vq3$QWz;Ns|i*E!_@nxU^+20$5O{02o8*bB_^YG*plj9ok%6MCHDI<=aiz7RjY z@4-|vlD~i6YDpn^?&g^>r7cyI+9l`x#PB(B*vk!JyGuGG?tTjf-|f7WdGzA-n#9dA z&zFpHlKdbqR8&lu!h3EQoA2ctu`rc9Z(c9$Pz6?h5>`ZVrUJ8Iu43D?St=NNnuHnKkD?jKuN6HU6xH4q4h2w4Ac-Y(YIeNZF?I-^MXsv{-i|bvhw(b zj0f@Qt}B36#VpRInJ7Y%L1RVH zFi~~je1nWvvC!a5bnbihXu-6Y(`nO=WeP9^Dks^^!~_h4^vHU}%dN&Oy`Q@qJ%TuU zjJTv^QB#)CUpJ{}3Jv=;8M90+IHd$imL$kA7WWv8!_?3Zzgbm@RPOVDv#yBOFQbI< zW@AYLCu|c<$tGX+c-+Ko36q4b0h;nG%EIynY_ay$Kk$z-<@I4~*6Uo_c4d;*dKgi! zRW($#bQ6QAHX(pfSzE~^iHWW0WdR$($KaocHJ-SI*2!5T_gnU~pH<@fH=4=fNzACU z)smyST8H3~th`7^$ng4z-$n*cUH+zDq6iYb%Fk8dFYS?^O-}Lo-&?I*AzjH|lhB%) zIT@mY0zS?w!5XkHgb!zH*Vm+6lgwEW*S$t1%mxg`Uev&~DN@B;uP~n-4B&IwR-MkN zP1{)JWW{F+F00Zbr~?xb-h5LK*ICM^?qFw4%8?V-X^rQ)ckba@SMREvWNVFqE6>(x zso}f{9r#}SOE4o%ZbS-9Fp~H;lVWqH>RabdML}LrwYi|pfKBgxljE0qOJ4NV{%5k{ zg}?PylT>R%)c!mn(hW9VrfZ{;uestv8th6X)~9q?TeD{yR0QhR=lo%9Mfki*a@-q> zTCnyi%?mkb{l;=@XGdiSubTq*<~q{@$fNQ-@Y+y9e8Q9jp8;RCGP5uyjNsh zo<}!h>gvux3HL=6i22SWhPJc~^Gi6#I&-k(3|i{3j@)!Ky*0|e5n%e4Je$6)QY@c|mgM&{ zhxC6Q$K?oGQ)4uam}s6RRJ2;tzZ0qQsMcy8XT1H9-Ec@1)iTC4CYaSVbIkYQY1(SX zJA*+{nxZlefd(GQ{%95DW+Qi66HK2gAoa8 zpv%3;+pc5r}ES9sP$B;B|f~->0Tb0AS0_&mQ~CBZ;;1>6{k$Y z@>0+BcS8@`jjwj;DSwCcc%dwfI>6;`)sY4xe`jm8_;fP4NsJCmwk|GI%sI$xk~ zUJj#0`kJFm?t?<+hAO0(bzgaT7j1OtA<7`Sg>GZ{q-d{I@pmXqP~mt-d+KBPMw_kh zHN!qhwdwhzqx{ZL*87uVl7c|n74ml^5&_?s7rV!_I&ae(-0R6Dhu|{LwPg@#N^3U5 zDnY`UA=}Mjx!rGR6wcx5rn}oS6tYWGMKJ<2Y1Ga4r=1bQ?gx`3F~qNnuj$@}78BgPSZ#r@oyOn*n-^EGfE@8X(MT&S!`#l$_zFu2Z0@n$V7 zo7adV>VR3E*emmU$f1bPXqTe0J~IZ~x2`oD6(C+GuRkgpCQYizdZ>)D3~}@gy;Y#6 z;RuD;U_@1UXDkV#MLJZ%Bdqm-1ZWyv?d*U9)rw`%A(jT_ty4?8K1hftA={KMKr&z1 zO2HUhW#r7{1+&+KAxB~36)-7OxZxq}83I?dh2O#93gz&tQMmje{3m9#EOYcJBwEHc z`UoB^T^_wR8ZCJky@?qk!5p&!iQ%)2`3jHWEsvQPjbS{Dp@bM6#P(puEi%P*LgE&N)pWZ_as%i!?uo9u;=~u?PD**ynBt|u@h7E1RTJ;! zNBnEViR+B%b=x_ay;+1FKG+k-x6}aJjOiOmB*V%=NWUets>F^daw~c3&XKKCDUlnd^G_nEU~f z%vu(A&l#3+4N_EY&Ar0u*eBHCj{}xy3xD(gKRBbB5(4^*gE@ zpEz>Az??wrj1Q{RA+^}v&J+xQ%oUz@ai; zt>H9LraL@|3iK85K8Pw6XB@Z{DfLw^LQ%&TVk9DFVPMv{QRF-~p=+98>}}TM8HwM^tXZ&mSberpo)*a z5vDHN+%V_IPEMzG$X8nyC^IWtjWFI1YUXkclNGC8@eb;w3Rn5l*8EUbL7Q%Ao^FNtmTo0v>QCO8I`>@ zRSry*>gfp_A|UTx?ax>$M&VGiXSTq)^3`=1^_pH^q=CGnOudgyCej;|t5S~FpF4xN z8YhSgSgBz-!t$Yx(_sW#?1&HXL)dDHTA-Y9(3gJ}?TrP7nkupHgBa+lRF@YGrzo}D zw}M$j5~PG8m?fZKjDfR9BHc#(UgHjMzz8V_uPTybZ<0qHd9IA2hLc%~i!uXVq3I}j zV-hI{-wuf=q%($;>td6X{?e&WRuEPHRyQqf8#y9bNdk-#7RZPa79$aNyLDn?(_aZv zf8UmjOWkM?n^uF}Y{Jppr`l}c)J!B%$5h_@ccQu6Iyy@Y*x^7z-s!)uq8TFG(u~%^ zf7r~tUrwRZ!oFXA=nNzw6{7E>gCBDTIJ%1;vS3EK-Q+Q(AO{&z*xpNdE6u-l1272} zk=F-;wD*-6Q!~nc?>niuh8`+0<7L!Mmt!HZ+mJ(Tk)}mt3%ZLD@932Mjlw;2gjnVy zn1dtPR9Bfk>$8B+Y?XwHZ^Y=Wy0WOumy)Ih?dg@k?Cv}9Dx6+cA z=F^gA{AR&|T|5?PA0=teykL(gQ-ALtZ&zif>G$eu$W4$#m8$0tojF`!Eq5J&Ci>)z z#f;nkdBrCSO}x;QrF6uQ)wbcYn0gR3(AWmjEY=0BW_kz$#}BewS9YOT^?W-lB_w9# zBvE~Q?az56)X*o)>k1-L=x7dN@c&Iuqb6`>+J#thp4KZ4ph!DtG5_*F1Tll^x=PTs ziA_Iulo>Km-#ERx^>=|*d=GG^3+|ZDCt-g>#^kC;F=GUJ)0nSLM$zYfZWgWnH(Ax3 zigZ0BA)iDWkMw}+wMB!Lfd{cvVfiag^%q>co z4Qu3VgUK3G3~hmz2xDZ`;e-1Ovyyz@zGT%ovSKWuRC3Ukb5TKN;+CGSntSS2a&%P` zfr6rC<4Jm;v*r_@N*b9`z(T6x37du{Hc+x+PWsvP36fUl=XqYB(;KAMmGgvLT+{KX zbvyBB)hE(NVD>3>Rqx~WOi`*9n}*BAOphf-M(Rq-r~A=WP3aUwf0^kAKhJO}tGLTU z^YG-Z^n)8(6?*aBNC9wCH=#p`l&qs}pxo)^f_lYD=oBr7158Pjlob@f8=|NEq@cfR zUH_qC!YX*yozgfBL#<#>wdP2aC`ldbhbW1iOzx4|XGMTf;cbeX?;>VWF=7@mNtoJ~N5eGN z(?FeNKLexd-^Eo}K)V@*H?tJ&?1mRDiD5qtnxq7fQc&N+niTT7=|ypo!-m(3o#?~b zRc_zRq~$oBSS%O$=D%p_^;6hvfIR;)kr?PSNd;yX^b?5NCNFjbGlPpfHTlU5`gB#o z3RvD54f)b72O8Iu%KNi_V@VwEKmNOVHmo22NrqBUU)Vq)Sq=4EM<}a*ZODd=r$ZYb zeI|W7CL#-Ts4H}(=xfL21r&Kbpqs?O(dXVKy86i3zReo4&4tmy?sHiGRe#l6C+zR7 zzJ@{KorGlX?7Do8R*Ac}h@8^M|G}d8xZ1Zal4^0Udbx zW@MT0a#-s^1OFen1IJ2K?kE%p3!~hO$Xz;E+xO5}YH>V>i#=GYIdC63Sm8X-qyh>N z7>jAO@a@D35F|+?8_Rkmf(gi{M$P9s4nHg&E)ZKRjb^GfrTvCkEMjKr%rR=v^KN6J zC-jHj^6legZdDy64JmZv)VrzWUp@4JhZGD*_^k!CiLWha|g z9yDTw5a;iZ7ABJy^O-xb(Dw`vvFZGf_4?tQ_Tv*P-Pj_VxoZtg1Yr8AH-;(Gt z>G+lM$p5hagFfw*ytnTl9rgKrk7v#=<6FTTymRF?vYoD%#*K)Xg`^kdY9eTZn=Qy7aSP+ zvmV#Kr8NSZqNE+d5rG!?DHZyea6`g{ipyX5d4l^L6Z7r$6OeIVTvSh?<6cle99>_y z(_EFGA0K^KmuVPyjaQ!7(E_To@WO_RcBjz_C>7z4w|`9m?NbdOZh zSv89k5xU2dYOf6kU{rc18hK1Wi(1639eu21$Uh8f{hG;ag(P}N{EdTdVWhYaoZ8^W z*D}3E%d8&KbHgT!{-%a!12>~a+u0&WzKEM?r}A`@Ncx!#8*`cXeuLe0(@eM0@5msW zn<+dT@lE>V9`fshf_DaUsWgI1crgX^5AEC}H#*Z9%3R(75PaK3MT=}Dx}|GnW?_eA zznW+?q;*dQXM5)dI0<|+{y~jJ%5<3wJVe(Sdf|CHD%FJVTCk9z=Nhd=XZrcZY2T8$ z>!W##@nrKCsYAVDe6rL;= zWZ@(G*Vufoo>^ns#8%9UGC81jrd||#yj|kN@Jse#GZ;Ij0>p%5Qb-daskhUHfXF5* zh^IKh1v5?@8U&RSq?QCTw!80$6}adY=OBMx&tPOq!I(c*vogC1l`;L&AQtAK=<}Yx zMYb1clOhFzVFLtz+M%-hSl$@}iWDzEx#vUxuzZ`TwXK?oyHZe=9lyd#MM00-_uFE- z2sDYFtP+%Rc|=Xrs|&2V2Y!`9Fb)8h68%;f-1{?Hx8p0E#N#>YU}&PfB&lDqDlaAh zYd5}RErxv-8tOX6?K47sH&-L(5pu#^+mgaQDnPKl!K%5pu$~xGl$890SjdZX4ha-x zX4O(Oi^ZpCY6Hht-Ms;Ebs)SJb}=IA%%+_tI84=Xn53&c-$S+map z$Mw4Y5+{wO*%Dm2u47bOc|J-%9E!roT^vi`H-S#&uEfty#qox{&dnPBy^goYvMR~y zih4tLmxiv;GnXaa+3Nr^n-!pwObtUCDQU zD8?9EUw;2GMAkjXqBN<6>oZ%SzVaKaVTDE**pw{MJ`R#Vnw?21Kp%K&M38t6MA9@; zrmv(Y>W)XXVaz=EfFyr;QXwU{f~_^K`okdQRH`+r)LT}RW(Ab)p=g#5`(KF%zo`H9 zv;!YeQTkJ&GSdTNB(_Qk^VbAfZroxa1!ZG(xxxYhf(fRvp}2|UQYW&p>(pYLlQPqPHzDj&v?2{2~R8s;X@|UsBThY^^ee= zY9y6qh|_(z8FY1Vv)zYYv>n6jrRUgQ=#LW9SOyZz& zbJ=^tQRIovGhn$vtnZ4BlHYo?{5zKlf0=(5IX+-@Rl?4vh;Wo)266O65gU=0a!o-dn$XY+1-b~qW|xGV52vZh%d zp6Dep%Hyy|a3zroB2ZPoeH75)&8?Rrhd$@d0RU^VKdy7tA(|22jUV9x(q2GJn z0GI*FL`y%gttfd4)Plci7vQA%5Bls2s*V*oFbaIf!xQ%+Q<8$0;%afF$2l(mP@08@ zBYW;B7#`I4$C8jGBh&5h+1Ug%@iYg@EFo&=6_nMO z6V4>9JFyzfAA%g3L=0P%0$w2q^8MeFao%RGdmr!FKY5s0az{0BmRekJ`mk({ z5Pd7wu+FNQ)AyGZq9``$;vsO463)HQ4e+hjs{xg5mhApr`}!X9PKAkfKT6REpJy1L z?E53`7mK1^Jcn=84|Uqe5O$KX0sc__kTnej%&Cd`^9HeVhu)ShiG?BJ{PNCSkNZ{V zaCR|Tk~D|i$K+KnGyi5k=`F`T-VJ!6|NHv>PS@|$6;msh>TS|H?&Xb}D=+@2Uklg0 zs=K!A&EC5%;SUD9>e~Jl(zW&@smLLNfA{U???B|UMOT;)?_MoczynUvXHR9`eFf&u zdIGIHsVgFsmKFcTt`+Qr`X68S_{?zqyRR}J!3HGNj|756Ua1MQBya8>$G>fRRu}s0 z{85l_ZXnT1qPZX>D2yTvznm8?us$_|qR#`tmqmp5C>G(*OQkY?b?^7l#KMC}X$SAJ zx$#kA{yvMx$;HUZ+nir|NX`#8#dUo5{%J4!W?<=GTSr$&*1J{MdXJ1x^*4)>fYmn} zeW4{R^-@!<{QEHimx_bE>+| zHS?@uB7!}o-gCM8%x~W^#03t>n1iO8I8Jm#&42LSyex-&W+{cM-n|li8P!KJKYD5Y zGH*-knA>H1D8RQCZ^_@$e=R|AmdtgYHdMw(L6!VOL;Sc2V2y~yDo^SK$Q=map{ruw ze<6NQNZdz9abFPhscxR|XQ&w_#f{8Lc zvNwYyOGMJuUY`?)gnMduPfiI|TdE_PWpR7(-BDjpI;D=+3V-2DY%C-AK`HOiL&PSS z6*~x|Q^3Y;AjXqQWGF~DfufV&k$kygMZ)G=gaV0oJ`59qKQH%2>PHNp3#3pl4|5#B zzHg9cKlWqc43sh|{0q;hD+?!r$sffLi|{1J5D_pO3bT)VAvbS|jZJf}g;7c6s5FoZ zQSl7#QP6LFYOEbNNJxL$#KX*N|LaQrA@B2o5Ya3+IVraaRYDFuG4{YSc`X(ak^4E& zYZU8xXNSzhEJ|<|iUKL{OXpfYymZix2h#8~ z1_#RO21~baju)(tk(`am+{W$XBYx!~p zs5TN!=4_lQu?yehfkpL8N`pJ zOaNz5q*JOz-l=4I7!7&{xNy4;GE)96vA zho+vUhEih*Hr1wgPo4?QqaN2K8TBTqG=xVF85tLWP#qk=C4n#Z7yPAm6!}a5#&_p`rZ4l=3kc z_R1h?7(9R9ti5bC|B;9<>NMRtuxb1TrV${Bxv9C0N`87RSZxO&O(LHLED-9>t8mSG zedus7A=nNa;s8#^l?tovt54>}YAdDzAqlVQHF|-3^PI#-CIm&|T+H7{q=sa*#T86@ zblDqA=%o?sX;a8wM{MRu^Iga%kcf`2zS+Q*~4oVMO}-)341q+oNNXnNU+F zyEBIObL*DpE%YgLjw!*9%Th@U=-9xV;CfSuad1eY7+BVSc}W-!JY7%qR&BDFRer%s zicI^8f@7G@NG~!10P%1^`z3C{)2N&&-Lc6ha)ufDEAt5qdO;l%DicoahDEmvV|c3| zGb8{0l_yS}j{?xUz?EFYYEz9-R*Qb3vticyYI>hh&ZJQjz!*fmmc_Z&C~nMtplxZe z>iahj8Esz-GeE#capLd$V=(iyYA`rcBh^k}s|RbvCKw4B80mE5HQ1P_YmDetJf>#r zHC~Z)&#Ql0)-r~S>%~n_R7|q6)*78na+8dg6=>MIO$vBTN=#tIn5N~t`RoBv0ivZ9 zm>6bd=vGtS)fyT=OfFjXOX+}R@DjKQrM#gm%a|s7j5{=t<=jXSb3k%DGi@2mm z;)Nsj<8PJ;Bq;2;QA1g)U;MHZN_KvHtDL!rb1KE#!kI&$gx^}gJo2_F2>n&x~h?NdUQ+y$RDT&Zh#xqz~ z#jS`YG!36om_G~eOy_OwymjW&Zh~_pn~LUCiJ;_?;jBfyFm6_CDxWE_`tFD)^f^OxRuszPT7GV6m9w=Est@u-8qSa$lq_Z6Gv@V2j!kK39-kyiSz}z z+4u zTkHIhZHGY!fcj_L1dK1`)G<;Zwn^@L3-o*Gys<#*ai^ORkC{`zu_^M8gi|RI|7HFs zgkQH?dGZ%e8Gc04d98io!_d(uyS6=Z463<$j?>ijqngx34fnHHaPOy`VGmyW^-AmdcY7LWDSizga zfStef6S1j;=scvE*-@uN^->NWq3*2$krERq2?-ZFD;^vF00*U?Z45F^(#|gEO~hxG zOm(SH|taxf>9sM&lu?vUa{M@Y<;RRN`F z=p9Q<6`|(L(g?sXc%sEO@%$2D?)WJ=Iu_3lRi!@HqscQ-)6-&P!f@LJU`M4kCMPQ; zTJn#NuQM6PyO68T>1xsGyG6k_^03qQkOacr__!h_hOT(^<_J6$6q-kLdct`$7ZZAK zQ&w##W}OKN$du!wK1E7y5!{Pg42Q8Ro-NFquiAj~qc>9U`@$UE)2Nyex}?@?CrjgHjla za@ZYB9)oHZi`qxu436Ys>wyv-U!Eaf=;EE`s>l}975cVV=WV5~m|v;@@%(9OUQwL( zS}s%;X!w=YDC}NN;^N?`Q3M``uZUsxRo~o^&_ayO^4I+fXz}WPHfN9V1s@Yk7%ymr z{usidM2WI-`|$47Z%>NfUhKcU#eVxJ|MoTdO=l`OC6xLac##rt;rkV3Ri+sF7y+Jt z_>>TFb9rx>jK5`k31r8nk4Kr;B)lJbAM(*s<@7f)EXHpp7r(3ZU9R}!Jj9>aBp}{9 zAS@;TdRCN5n}b^&pSb!M%ut<-3^;rJl;Icv)qP6o-pq2meOeDtkAI2{;8~4T%_E%1 zmQBm&?~CbjH@L<~$$h$3Fe+DzTb8)vZ+)ofek%Aau$PCoIzNe8OUAyQ_*9=TS)%}c z>S$sh-YRROWX78=`aEq4Xg^{pQBH$b2ccxz`Yfc8!(IAH@JL5a))y!~xMToD+^z?S zl2J(7lJ)qP%WE9tp@R`PR{^QUjm^9G1P!+Af3g)a}x1c5AM|j`n*a8XJ_y* zG0T`^yu1opCQ6|Mx-2$o_Me2FxA(yd3+l*gfk;Nqms;z_u4*Z*Q__!ov@8UTZ~;8k z_Jp_nRdIrYRBYK+=?S|rLEVI3JP*~4>{3^AQMFFTr^I=6Y9OaT?ZJwqHI+~R*rR7H zkfQV-kM2vw1m(3^P+AQVCoHZaChYvXlIZV1Ukrc_+ACrnrz_Af42MF1IO@x zfqHdB!Hu1+dg`!tU!DD;#f2&BPE^&$cG2{#r9>&09bJL4u~-99(i^}qmzua2#N3NS zpKo4o<%?Zoc9Eb0(SaK2GNq_=)E~Uc#gDl%rvF5PG8&iKzEf_Nm}*re;gZ!ju*1j8 zmZ>T1KOsX)En1eGOTE~q@SbM}Rh@ATV7YQG*k#djDaH`6(;xh!9Q%vFiG?7Bc)-F3 z%-XDRv$1=uEkA0d)3@;^s5LZ^SacJ+@tuN?A{cp`^)G4N`OH)viA4RTN3)xvZ@V-tlG%tknV+O1}#(_B|vAb zXQ(`Zz%HTQC6`8tUBKQ+TFyYRW#2+P%}#axWf0iygEz}hsJi8wON{q(E$sP6^miB4 zwl9D3`y8dDu6MECO5RMeJAWFTeIv_sN2V_O67x+xSo-0@87c64yZU$km;D6oUpFx^ znP9ZnRzaa%2owQXB+6OeOB~7_KbmY0)x37ed60lCDl9T=KM(!IY5dcZ#8CMD#>n5F z)nb29t-=WIvXLl&K6;|7$Q}6-H2A6nrg_F>uL^YF&P1f} z0Z)>vTRFqN__*lGb@IjJA@x)4gczD`Dy#v)xLz}^%BM?`KT{O(k00CUuK+NosjExWo`DMjOEFmP8g#c9Ur{G~S%bOk0Z6HTAbmN||k> z4j`RCRRmRA)}-B$5W<-Q=WekWl_cCaze@lcqtPPR97rv4lZ}mZ{QG z_MR_7{JrX&(U>sbEv$;w05QTEx);ajR7OH|g~FBBR;&X=lcxxWvZh4wet_%<{v~QJDK+LQ%NE7!`R$oO%0BD z+epa#MpkRE^wf}^b=T#Psl$ZjZyn#lgRkIK#gv&ymc)x1~cWU`}b;vz!5SG zbNZ3Haq&Q>rHq*KGSzQM{h161HFAqMVu(D;Y$Ubw*e3hXXPvhj)KscKqzcO zv?FkqEsD4C{L`tVU+X&0W^Vm8U04isY-sk*r`yUXhh zi`Cuvt5~BWA1&H2*~r+c&%v#JtXo(p&A_!V_tomS#n~hHf}XHxn{GunOs!DJ%4d~? zX5e*Chppu^5kOD{E53TSdR=|aaR;ziz%D1~4%zMbG|P8k_t)lFFkg&gS8Lh>Gm5Db z$~tK9uU!Y!X!6FrdP*BJ*{!{S6@vE)q5^Db_)TJSJQefC{Y)SLWfF~0DTsBFF@*c7@#Qs}W|spYr+Lb3z0gH6r$O8UQf z(lpmhUGSYC$ug<8b8BE2=>Db^2%Ry-9&V`DV7m^lRdho8iv98z$s(xAsKQFB6FBqc zk|SdX&xRhnk_d5YcuO5}C|ykSY>IJ@6<2Fv@rIS=?MSd1^&0{&D7~(qmLH94Htz zH_93uHQ3>f8@Ofex)J*A*9#lozLWOwX9=f!j4>bJNLu)qcEy-BO0TAj?j>3MG-EX$^*b|M{WfPLvGKknR(C$yjAzUJNU7)%3HJbu`X5DvCgu=EDzk=1 z<|I*&>hAf1#9T4C#|hV!|#g>y#037Ec$tBHAw;B-hyZUxmy3T9cn7aXQ&)Ub>g>mPNx&ox~} zV9mkwE#gv-u>5D}XUM2Mp#&9PW^1SVBeOe*aB9|cs>m5F!@ZnRs{DW8Iis_z13c{b z8OxUA2|v$5>Z7+BJ;r>Uw2`E?HM2XWM-y9(anF^bS@U!3ML7Va{B~zEhD%6ER%vzv zlXE*$W8)}e{P34bl_TrkaOCmJS&=f&i9|BS^O@$19i2L@L5Ls5z88a| zkm9|C;-2)$tp&r7@9u39hC5c`5{4xd4+8n*pbwBI;hLSQz`8zD3&(a;IE8zM!fb6u zelIX6ohItx3~QyrO%ffl8Oc3gE3%o6=pm|R8WPpxUm1vem(P3^Q1P+D@fMrG zdO3$lanC`c#CEINF*f>Sol-Y;vy^qm(!69ZX-uQv9!ZAvzCX{B2-D%HIwF2-S6bOV z(HL_MGa^0lMSSj^69LE1F)gQ8@53W;3L$2vuuzn_ebv%;`i5WA%0sP`ea~Ri3lCu`0x~)Xpgq%Dev{k&iNBHjKzd4xa@Dukl{#zpXaMwH;5xfO@dAydyt9! zk&%fCc8pUDJ};M+_zw|DnEu&#oMMhoKzY`va-axf`w(6A3#5Ky{NW72co6dulL}l! z9mz4_6lYTFFe&5WRHT(R=nQDs*le(XK)0v{7ED_@DjZeoN_ADm5As6?X@6{S85)m$ zcsAu_!hoX1*;Br1D4LApKqi<_tF=D>n2KTnHu?O|F75`@y%Bl*Q!$)ew*3dr@@_u{ zW$GJH-@@P&9YX6>7Oq_mMmcBa6SLeiSxPyArA1lwfpE57oZY+z=00M~+#c7=PgD7Z z^%bJ|{duKz7vqQGwp}f8fMys3)v3ekG0JjQl{xq({FNmc3*p_32Rn^pg? zyPuaA2O7BRxF%NO-b!I5xf@T)t65#b-#%i0)!C@n#+HaKnSS0-^=@qGKO>!+=;u?* zY%r`?BPxw;oaA&J@-{2}SKE{cC#8nW*MV!I*R}$wD*sxPXOHsHH)eUMdI9GAFsx0? zQBjP4_W#4GX5_O8KvF47U+yr$9Yfug@ySQr4UH;F{C-Sn^Nb(Vr23_f+T`N=a4EM+ zV+P$U*EduK4D#XRZ9y0Kp!4{RQqiR>>xb=X4zo?$Od}~WV=@173)5S}Q$|oSfJ?qtw8L#4O=8eEH3YKlQIe_6wV=!2J^kUuqMUK1#IZWYf{NwHeNb5u!E8|61Hn(auB{GsXKSM>Agb`k!F z_DL^?kIB>#C#Tq;0}grpVT7~N+irK}ODttpNIGM!6PT0$1p-6 zubIL3rNgwoN5cHdR);mzcRXl5lI{y$Iy>EQ?$I-!QI0VCVreV=sK7zsoULb>M_`ZJ zoJvsWACG;#Fbmkbf@3QMejA^OfcWF*3cNlL(%J(?<$oQ{+kU*N+9|0=RRu6(BszPv z6necTSFJy*OPDxHl~C^JCa6|He4*p?OvEbD%=48pnT{mv#^*6yuJ)@#40$-OaA8zf zk2lWkjCqqHET#&NUDSin&P%T~-KaeZN|^pC(Jr}~oYFbb&s1++hf<>Q42;sJY-7BN zU2vFO%HyVHYIWxD24j$4$|dvyDc=Q*SD4tYuXq)a$L#Q32LOe4)PCUSZCG*@Rj6HZ z78{*-BU?hAI3c-0U#$@dse-v)aY^yTFAZA~OIS6Yql1^Ou29e4oSou8u*{oWAC}a;otjr$gy)dw+>WElRaUmt&I% zyA#)y#)mj9_u>GwB;BvLQ#CY-QXL9^F&b9hDk!d*)lh`DB-s;_>F8-{ZG#}e*-a?n zP76i}Q1Z7AV^Pj4$Fxe}_~ZuUiiA<*Kgz6JHOGIROxa%FpJQVRp0Bj1t!S&P9OESz z(IS;_eq*U`&izs`FiFIUj3@|0L2)j?4C^tAlFp6iys@Q?4O-`+xqWp=R2Noh#QN(M z>`7noK^cax0?&#rJ~bkJ7wxo3?wk)9cJKV;*6|7Dn9!qibiq7FXD-#ww9u*4<5TVo z8k~jU!9C@k`JbOrW0RlBuY4btBjXMB^Msg$$$ZWeGMO(7goDj} zm~gtM9yYD6qC+(VftFjvJrhZdqVfE*AGq(zENsfp+xrHix1p zjP#WTN&>h*1mezdfiMBu_XZ`GOLTvKIakDcSt0ubJ>o3q@ZG!<$z2zE=J> zZDM_GvTxdz`&ts@2vq{u3cwii+Gw9hyWaP8g}v#H>FZ8;)05NJQ~aj4y07;m@&n#Q z&*t7}hw@;|9_xb+c2m%xI{Tl_s4j?}Egn|laecxmM z0ttXUEVkN0Z7Ma#W0oT#0q%Tzl4MDfCsC$U zxsqi|moH()lsS`TO`A7yMifZUV8MeFcFx#2(1;?RqJ)y{IWXbEh7XxW6#2BWWF<8e z9*Od#=n93YIl+b%JCE2Hrmf&5wYXpv3_<{4eu z2x?J^TF>Bw`k)}xP%#G=KAd=Q<0e;+^yK(tPf#h7lVq;-tKZ|-v1ix5z4B7--@%6$ XKc4b*^5@Z~SHGTpd-w0b2Lu2+IvA$V diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainiso.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainiso.gif deleted file mode 100644 index dd3040653f305cf35bbb999093d7d6fdc30a4f05..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18347 zcmWh!2|N_e7vFmqyX(%KCFIU+U0Fw3LW>GTEhQA8kfYcGyF`{!&Mc8zOC?uY_eQi) za#c$b^3x_sqW$-OpZ9t5eeW}$&%Dpfd}iLvygBUbgtZ9x0`vk#0sy*zfAoJ$`&UXS zssS(o0JRu|T9BHW8bbFvz@R|Qz#3puAZ8MSFv)?KlpwGrve+1ibqUhC1c56P!-*iBbKp-Zj>)+z&A7kR*hz%&g1~j_{WCa8S;DVatef=TV=Lw;y z`0z^Pb%AwM7e2hjH$2ZZyxldXkr37HA64KRlShbY*Sszu#5V%+1Tir&`0GP}0)fEV z+Bd%I`1SU(a6$mNEZ};3`1Q);sXYPYo*;71@$|9K)SlGT)X?;S(5&Vxat@|a5T9P_ zpEDhlGZd9Ia6PLrCTA%AA1>$$EtnPr1zpb@vThXQ<>mR739c86k_$$o$|lyyYB6OK z@nxgrlF`(Xp{UBm)UvUaEbH)EL0(x`Sy@?DdTL8bnkQ1**GihF)7uxDn;T17rYCCCV+I82U7M9H6D92* zD%(F~^=vk_4`uai=k%;+^$2SJ8M~$hB_*|8^94PE#;y-}1KX87i(Oq^B?Ie?J@X|4 zf|j1K=AQY=0YSm2pk-jbWK_^KFws6RpEn`cZcl9=S}YqAbPX+5{*$ANU85^Kql>i@ zg61*7c2Cae=xF1Fpl58QWnz1K;Gb)Pu8Hl&4}yuYv7w2T(TVw?iM7#*we}B!q3N}O z>Fur$g3;+U!O+my^xE|F^!8X|*Sw%-UNH7yePCWNG`~Iie-@0*Zw@W~lY;5__0dJa zhxwI>#m&(b!Sv$hhsE^|i<=WG+lz~f(<|E_R<;H6qaRiT^DCS4|BNf^i~qoyU~z3z zusFZCw*6sUu(Gzj_)o5HudEB!);HJIx7XL#S2hJ}o7?|tt#57%{^|eJZNcWI;Geer zj|KlHgaGjSnVkcR*-b@AYWs0mWxX`9eJ;iLrtLM zYW-d`SK@t?EQgAnA3Yc;!d_XKtzm(6@8YP!N-oFLb>$D;()J&ETr*xpxbIRToHuZ^ z*5?t(ruIqQyNATy45gyC+Eb4_+sgfiTN-AbMjkE9I&!sgx;^g4%KPD`3$tAb-#~j^ zTUh}$$)eAt>sy;X4Kf7kH(l=-ejd&@epFIFRrh(6>CmxptQ<#{7`k`D;(fD=G^6fF ztBDu$=8@6znxxT@4s(tpK=`GmxOL2Ud`sp-6O=^TdR`@Yesee4{O8xg{Q%bPLt(&F zZ+M=-VEp|?iqOK5A~Vos?0=xuyfT6J{7$^_`pC>ZAb_1Bx1RGWTYOP{J^R}6+h*P7 z0xABqt#SS@rt^5f)7vq7&M)N~b*J_P00kkzC#7Q`cQJs6dA!2dme5~kB0o-2RIh*e zN&ARwEZ7`LJf5%e>Eg~@_5IAAP;)ANM=pmh-uxmaFU>sw@%c7YTub7Lq?Cauep+tn z{l$;R#OE@7FAI_MY}2IF@b}bw*aaxc*3rV3F|@!!BX^8Ml;p8FXBTNtx!boXdkXK~ z42$)7P|z~D{Dt24tfe|OWE7zSI6Pf5Uz9cBTvdE#ez_DsbbI2=1F3_dnjR^QE48O~ z@&x>>Yv+b6cvt7kwmvuH4mpPw?zoXO8nQg)zgTl}gxIA!Z&hmVsT}Vns>VFn)~>_* z*Xf<^dzP+swG;z6q)ck5MdQiPx94ZH z&cc%Rn#qrue|*`i93P-foxL+8t7wRC2}@t>uZa&FsE55Om@Pg+n!IQO~!pzB2ETH2q%BXdssZo0VobHcN8yWw{Ttmt5jWNT0|22=f9(Fr% zeRcQj07Ub!Re)!G!-5H$a71s@`@`R5|G|C7hfN=AU*C^@&h$XJP826sBG-e?7!0eKmCdsXHGbZ6|?- zEh6Qg^JExL@Rxpk#V)W81WjA#mZrC5)Ghn!tyGmXT2)^K5lrW&cVBExJ{0e~8~(dDxd4ijk`q zXlA3~sMN6M^#}W_P(51qpK?*1e?8j%^K)@GN%VS#4zZ}q8gkAWo&f(adKmKdfe%db zgtVY`u@asxq^7>*1^j!Awk-#9gIY~;Ts94}O{+3g_xa*oV~sM(veb}o?trgi^Y-?f zx9^$H)oX;={7&T{8a+HD9k$p8r!Qun%gm7LpblWnhLDvOxe9mVn&Mpz0==R<|k2gXD%TSETkit6w(qay2+tWOO1{ zV34HhjC)kSfEUw{NU>YLvEO15kA6*7-eH1iObMH+b4O3L!){&~8#iCQRioNXQ>(BL zgUQ`?vWS0tL3Z_nt#v@@?qph}pQn@LH)^gMg9l$A!mT(>V5u;Wi)5Wc%pEa&p+UfbgIS;URBHC?&CVg^ zw@e)D-f{^FTDFGaxzWL41U$~f@=V@}!o7T;Wu?o(ZCMX$i^PPJ!!h{2$$9+sAD{69 zCr`w!sy5{7_3QIqpODH2Sw)R-{eEEa{iY#7hu&Xw&g7cwhaP>%daI-RyVY(@AbrtU z1$1&q!=N)+ky<~>3Oi4$^Bv7Sey>ERA=T-Kllf`4qxj0B$Bv75&S75Hv7Y348K=Jf z6(I3Y*3~Uk_ME|Z+BwJqYcME%_=Eo>SVm)s5^?*6(&Cy}t|Vi`>D9Q$O0L?O&t;9V zZRbkgu}qH4l9z24WmW$$8^9ZUIQDe+>CMKs%1ZeME+?M<7`kSx81`N#)tS z-|VCl@llL3bEr6}DbC@0h7lKBOB4>oA8>Q(xs`)CpF{#Ho)|E?ljHgc_2Z>rcv8yH zzsLH#k@0=mPQs(Ysm>ttFUZl6Om4i3m{Aq7UMu=C#^xUv}b#dbIrPfsi+|2rI z6}iO&yYWoD+=YDp>IOmL*^-m3{Ftx1(R%dO=bAUMOvRCo3+rd7t=i4|UQes{oqycq zG4jRvPkc!IX|rQy1!iw@ktb<&=j4BL*4)~g4n7@?2=kS=AeZNZs8ABkiPxzTx6g35$kRq)hDCl_(VSr#d#1taxZu$R{B6xB zNh{yi{Rd(b_Lk1Cr>~!_y?gQJ<#D~1TJSwxCDP!{?$Z}C9Ik&WENBlwCdW1P@x=cUA)n5o zmla;uqI7o*Z~A z8CWe>jscuxNm%3HLe*iYNd+7RfM!a7t3lEsiI;DoSpX4;IMgJPvR@VqXHj$~Df*K@ zO*#btu@iR*G93a6bYT z!iL-B%T$x7AU;G(1&qa$%VkUf2$>yXia!o~1d-~A2NM~vOZl*7G2~?|?Gs#L-GCMs zhlt3Bxkpk6trR5|ID{p%^F{U~GZoED(g;AG`htV*!UB2iq zG4xy{iiyZ*V~JGwWQ63MXdqd(?3>g=hhT>5q_}~bVNcRZO+TN+)T`MA-6$Fk+OkA3 z;b-o$&{L79URI#6?=7?VTU7#<$SWRWmy2TXAWG~M6B4WxD#IoT`ywFt-&D0I`dTYl z%_2cVPHvV6-h#cpm*8#$RLULRHLOTE%5Gi?o)NSil z;AtMzHT2Tpq}&Sk{8=kAH9 zk(i7u$VO0@QAmI8T{su$PegrVphgJ!^n$|L&|6gu5p=vLgAdl<0$*d_2yRNv*8&iI zvhSJXQFD;~Vz+hipinOATO_Kwt#GKVSU6sIfPvZt2)ht+bn)P8gn~d706$-%psmP5 zE3Klh&8uz<2H3uC+ya~sFZd;&Uq?g-UR)l^o{>(tS z<4WLSU>f(1m*M^W9{1(7^Jv{D4=zQe9X-O!bDXX`U3)?&0dd_T(Op;?!YVP*25htz zD7eVJh^!=qz}Ep4XHHhdBnXeN(0G@UbHdVS9$hOZ_2N*GlX03_PU7MV;ct9ogMe6d z^Fq~A1JqY8^x6e@P`ebGN7njIqHdRLPRh{RDVl8I&j!fsgxZ_a!mkZ#@)Bwe<q4|hh9f(8)~KkkwjJ#vU{m}_B_7>WjU&~E z9O9P&Rd6nJnTQk-eq>zqm^LLmC5F^d@US}7yfa-C5daU}0!@ga{I>7m>mHvLxzj;F z$Kpy133Rva9GkB-$Axo8T>kWnWseF;ZVM+vB zN>S*fceN{dM(P10&4YlxJj`V3w6_eOt|A~`V2Z7XMTc_Qlm9$wsFT{^LUlBO_qlDS zPj)<==`4s5d5?kU!~qXEOC7}kYK!jr<{-U)gWfYlVgy5-qgGv23{*C*gvhJa&mm9U zxPLMV@g^NMM=1B#?sBY!85BL=?s&d4^Zf6h=Kw`E$eR7T1E_!ljJW_5m>}dV8@#o{(;c)}uBmWkH&qjZ%}g`(^n((tVak2Fz!2|LV5Fa&t^1oF<*%GwcpjRDnNID{#*Ec zWS$4JtBx{&Bj;)$3UxJsCXAaof20>6BDR7|5nj>bGuO&v!Uk!+T{bL=6?-sseozM} zRGw0+C(~`6B;Z16c93z4lXBL^#ZjI=MUm z2LQn~=so_o1^}WvT&_-jmxtiH^DHi10`n^44@V>6l|1UsYa&!f7TO%vubqQtFmsdf zAQx7OEFZ1gQ1}QSx=v^`~HatXpIjETE^ zp->c}lq(eKhN#2{g@#XrG)#n*Oq2lLh3*QSLm^_b-UVHs2z@pYwfip0UzpnPE(ezhv(K_-%WS5ZZr~fFnc8PFef}a{ zZqtwbMS8Mk+65ysPgn?_NPrdrY{~+{#m@M%K72(1Tf#&^9ffU-OwtzDg?xC2osAL` zsrGwHe8voP^P{q06oN3g3q~RcUuMBBG7u$f-bJoZE}M6mFoitLqp*2GUA&7JA<an-fc#kh#P|UYgguG$E!xr>8%Ekqv=I@}BTT6}yltfVmY6 zTI#RplgK#%Y2IdZZeDBw*@zw{EF3;P?>x%0LC?9N=bHQ%;0F=MyI?H61;8E`)$5x*@hi`763ZM8#pCzXhz9 z^kvin?*j_=@|V(Uj7qOgzEIZA+n=+Qz=M7%#Ch8+?o?zRgYm-2Mq*)z;u(ql%R|3n zd?_IYjF8X*9(wm#@d#0LSr=$nD0LQ66(=@W_UEH;`*P`}TMaCfpa05DLk}7w?HpTl zllV9kiV(k<^@xWeo&H)EFVecV(8pg29gWc0g35<=^!&Zochk4z^y(CS@W>>v$u-H{ z4yr>3z6XfDaQ^S%y{x!G(XkKrIxwPZO5ne%5-Ycm(pr!yZs(V^d&~DuPziIZH?yAN zkkY@w5|yiw)6g9*GUE?&!r%>y^_3d{0%O$3DU z&@P$2+c#^g#Ks@4QeK0*gU&s=dK^Wh{opZoLl zng6P{kpiM9#zS->a-&>$dH)=C8JB*5(f4U){pIiVuX}&#-Vv#1JvEQ$*A4;g@P6gz zAt-!=k-}z3-mMX_fC+<5ILY|tz9JM3t*5klDZ4kalp!ARdo}O*T^?kt9VoyEBUkCs zY_`-E1c}TpX~o4g}!g!oyLZsJ)K)gfjbxPr@x1 z&ObbT7c70B|L3m9Cnp~hvm}U6?$JX>2KL-@Ebt7nL&=}$@)L4k57}KNe&{QZ{4Ajf zy4KwN*$ZH6c~EHwJTJ+yl|Hz zhuJszD%CyFI{6SZ>4^$3sUuZhDRn~WFl#-o8bMPCXP202xYFo@PH{Jsd;B*Rglh1r zzMM=Yi{uH;w;r9Kn- zu6N)a&H=)0{tNt=i)Vm)>!zP;D6MspDeLd-MIGYfYkk>HvoMy|4?GBMr zs1PYVBS`w#_dDC9TbWXrILcgla3i8JxX~A1l;B#8$YQXK(QV*WO%1!viE%NNU!Ju! z4&u_nb~K8+bFhi_*4d{1-JO{T8rbanc^s+_t0```S5Car%Y9m1`6ZeMRufLWzeKs3 zv}$OEE|OYuxNV=(JVY&&TPB_LTWB8sKzx&(0&X{aF$6i)6pa6dUFTpgMSr?4XM8kK z!bR(7`Q=gc5tF6cSDpTJAF+dvAYSeW)UeEZUtt-2G^@+A9!HDaogbCYn^;P;Dx+~_ z3L5JDHST2O_p)PNM-Q1EKkjyXUzwF1H0B`nvRuEXeMHP_!Y9|7>QZl5G}>~Rn7S;T z7>MP8GA%C}x1QAw43Z6Wc+!ATPU$f_75?-z3vtKBg~;`zC%f#SeDnv2#hLi-So zE}{EKW|0RK#9QH(9k;D1?6&`&Lffq}$znpPnMK}~>dJB+23TyyX~f}`yv)<`Pw4xd zoNrc@q>V(q*>cpB@ztJ2UVLpg)^47}FjXl%^Q=HONbyJk;B{{30AFUU(JFhRVz)h33a04yFItj&X6JT*49yKoyg3h~Rl*n;f{j8VjJo zuO>fDB(Aw*yU9p*s;urINsyQg`AvPe6zM*q$-7&!F-874M%30vRzhBpE%acy%>E_K zWa#)>=v_pG`7w$$5uAf?H3RHw`r{g%I+);n!3Lh4(EdFPE~Vqz;MDty@7xDP-N3!b|g63;m86~G|=Hi*(=P- zsnYS;yRIt)!G8d9hT4RNP_CvT3CYKDgnV*DBX(S*-*DjAq!{4~8@&>G7`p!MgxT|g zD9W>iQvfkC0xkP3){gyINQ*sWvPixfQuOJ_4w(#Aq~t5ei3&~Fxdq9m6hvP>Z^vwt ztpZZY&C@^HWdbuYc>9Z#XBM5| z6G6Z({Nd2}yQjhn^&`3qw;%XU-RgUb`DpPluBrL@Tr-hF{&z&6sA0m%ldT3zLn7(u&qkVO;ma(>V>rzu_lQBMH2x# zP`=Q~$P_)#9nfdTcq zaA8g~d2dZ6-&Qv>09D#8CsPgBH_qu0@f^I{w5;vlEBrW-*j%sa?sgKcTG_J;mdxLx z*)o3nCAZ3rZW{dPK>|~e{8q3D9=w+lFxC);QQYO?%_-t=11`}7kVaB!%{gah8mDH@ zIefvc8=(+Kl=K?q%bo9_Sg=2d%4zO{_i)orc?RFDv*@>lwWPDA$zH-24-{T056p6E zloQB;5jY0q8mC}%3r}GU@QkrWWFpdSXJyW9hbT9`@d!n*0 zDfS2<79x-nj>~&YcTu8xZg3PjeaZ$e1<#n-dlwc`63d zmTJq;TMZCU?e-M)iO2foph;y4U-Q!pTd&{pH90H)jRlk5d!2-yB-2+%k5aFuO-G)m zh-VVvRZxWsr}0!N2U&Z=ZU62p$v#T``OhejSc*=4lhB3R3IIR$O4am_@Jqb~>(c<6 z7ARmo=;#aM@)@%9nwc6R#qp8Fsmp04ol>4gX+@!EO3?F8sfP@U;Z#&`Keblek_fn3 zOw789+c&Vk+sEaSVOAn!--2`wKz;%Ev--eq<7{iv!`dzZTx|jH)q8)x92c0SQcr{i zD0j%gRk5OJ9u%ccIlUO?!#6t^lcbdps1vSQ?Q^+HxV>a)ysMzeN_5rgZj_u0v+^zjiBG7`$pHvi8LnT+ z|7~eIpI}QY>J0h>&-Aek`U4-P=IKpZ2=T!2q%?&i=>n^C?|fK%99ZQm0FT4*2sk+{ z2+e@L2LKM&1gjCCv6EmYPO69>S+N=t%>oIIB{GxGVizyo7d^MnGPeuWv;V6OUD{9R zY8;j8Qv6C*NIs-^^YQ_Cljl+nwhGsvN%L6gcY~8YST3iEOF?L^Gk^r;nwA zNsZZ}zz7&>2uL5?O8#m@m81*UHF)XFy)sM81v_kVlR|SmUPiMlEiv7f15Z;W2gPe@ z^Y7;G}+fk#td#1Sx2wh+K5x()rfI~#juwMqBMFsnxei+f&T^q7Zuh{eB@KhtHb3LO{MjdtuJpp<&O16S#l^Sw zRntWfX~@???ifH=ROek%nul0(`^sQ8aVW=v6pNEfp}VMKs9-F)J`+W?%sR1TO_hc9 zlGR)dt-GyBCYr-{A8S4~X)92p`)$Fm5y>yk0LDY4&&ftn^Jogg_Y5 z9UesOiH-?TBh%0nu-cA3F-P^hjx~W z@+OWpTSAkFZbj{BNs-VsX3z4=msvPwh(#lwb0q9_v%~Edik9^6w>w*AJCkv*EDRy{ z!bl!*gKybKN+*Y%U%*bCwcPb{;Vm>|U})ceS0A;cpJ2k0*r`jaBt64i*jt1|(a2D( z+kMuZZ#zy;RwdW_AaAVQ3awskT+4PQ9usihH_5z(Z{5jj1b zt4l8ho*Za2pLT}CID+(oK~YK7bpFMM_r!#iv132PN1`SP0cU|R1ls=p2zp_;E|U*o z>{OLQsNWSwXX~XA`wmrqdX>q8Mem~p<4|8#a}J%$J;jG5GvI^s4>coSE0>Jtf`*>v za(~Zy+4m4A0Gch7j2l5jVUCHBj3Y@BKueMb+jELNER~uWh9yPX#$^Q-M|xF+ zgFCzxi)~E{kcB66Xl`-iJI2R9##Lu%8rs*pMZ_O}tg0U#X>9-G_*uI3If6GnnjD}0 zXWg%)gfBl!O(xI`Wx+Xa<7D2+FUM(u*Nk_ofTI?T-b*mYZjD$6f5s%_NPUGp3zo@* zhs&n&dKq*NsU^1|yYNlI6swlGzXQOR@q9DH%T8@t7Gt9tK)y(#NO9R?`x=h-79{QV9I8 zkN;mI@+Ia>aB8|2mf)EOX!-dueHR|S18kN)or2-z89?Hr0U*ZV@-ROj*J$c`+Hq65 zZyc;_oZ&RtG=|T%;=kQ9Njd0ncOWx6a_PPZeO$0C{P7h7esGIisbGZEJPEi((j-9* z#Ec|E{1ch5?}_Q&9FG9{s4VvQ-#E=vl6@)~fog6-wIg>xa`cPhH-3@JMV4R+Ntw=K z7%6t@CGMbd2t08qjZsI^;u~zRQSW&uu}#@alPOLLMt?5=@?E1YVe*=UyNQb4ai)O6oO|s4VF%8yF@; z{x{iB8hbQd@;9mhemr>il1{Wd{9FPwatUrgblBkEdX4`Kee|WyFjarj?e8>MpOISO zK6eIx;V}K|8iA6unah&TdT?Fm&Oqw5IGXYn`6?e4F$uSpMJW+N^N8n4BNyadX2a1o zh(p=JEK4VY5Dht4B9Z2A087+_5o9|y;?imfwo)@c&r4z{&ayIh2A({q9^ZE`#6%upc=^EV3$= zzjQD)nAxQ0Lk^@zz9Eoa>(gKLl5{S#c+1kR(t+Hr(>aORk_XT}bbvx6T!!|2=B8*Q zBS-M&L-c|pcg+P*>Y&X^s<0R zcyt_C4E{QU1)H=%>AgZA`Iiko8o&tAn_SuD=IlRjBVFtp0{K`wikoO zp9^YKt>@BkMi{ zr~(I|giQ;m+W2%U?GhI7_I!32qD?a{HiTx$IjPmWU48NCvG6aO(uALZTR;J9^2ghd zlmn;XZH+aZe=UuV{jxCp21dNo4TeS#(~KCu!1)`2wp7I>Y7`>%znZ}f1K2rq9J$Jb zvklJ(S*9lcfYZTAELQlp%}-#OEr~==&LsB%_G@PA;wUy;S`sJD*pHlLF8SpWK$epI zQy+X@HeLY-3f!OSCrdlXA*=Y%z;W>#k!ovG(S;A=l_wC)(C88YJYkq*PS|1|c1U7_ zXNH9I@AVWXz~hJsYMS5(#J$_HpQ3z<3@6g9vr}+Q^V-DGo&MloBblpH zJ`rjpw&G+$GLB}!zV^vD@i9#_*}Kg6dDQD)vPA;;DTVJ6@VvdR$ZyP(E-8bU$N$#c z-5m@eCvs@Sx3s!HfBVc2ex&6dbojQ#A@u}pe;fuTvT&b<$rdUtV4MzK_FD4tTw#`LG*E7?5ZVTV7XxnG%WKaR@Y~ zX~)*qrplY|AIxB0A1kK6Snq2$el_`CzWTrscN;Fnv(hs9#_Rf%I!ah#L(K%MlBu}W z6z+3JF;lipLBeEEF*@7QAYavN)!+nNjlMc;c>g1t0vAZG;Uy|^!B#Er!&iMY+=}qp zmH&PI=K5CJ0#DXjk*z@~1Wl3?E3-W+je;JW-%|+t`f2iN`=*t&)q{Lw(5v%yV`hid zqm%UwxUZMYUi!Xof1qP6%lff2R&~YNy7{a3!t@h)OFrlQUbW!IKP`K=!}+$TXltjH zvO^Gs;HA&QJ)EL96O94NFCV?Hl!Y@`qsa$8x6Bx9GAQnf64sG@QP7q*qAv0tG7`}; z7g_@XCa$O0`%dApf%XIguAK%i{ch>`?*6E5YTo0gH{rC3vxly2Y^3#F*lvh?Yv%?b z0YE^AovNLeBF+JeZ;s}PE;HtM;vkE3u9cD^KuAE_8#Jk&A8^830$&uZenj8fa*B@L z|Dbj7f<;KPJ5}_g#n~)TB}uZC)n>Ia1F9kcPz9?SNL3r zr{~LDFVLzgPS~0QYTowJ$_?8~D!1X+|2PB|$3+E)F_+mRwzK@@FYyIX7lHzi5J*sP zROQ)gnMdNtIf`OZIIV68=P;HcBob_Y(^5sXW@W+);d%~v06(jO^9~&zF$$( zkdn3($wovywoJ{O=_h1ro3#oLH<;~CO*cYRhPzQ2s@wq_0&|(#12#P6A~v+Q*g*A} zY9Y7dU2})wk=eZ@SevY`tkH`%1z%qaMB#q?o8gLrV2=1p8cyJS{a38M^V)KDuvk-@u~OT%SaIiPhLJ=(%#ECxGZ@ zPnU9D;Ej|kw{D8r*8lyF{4^&?ke==IF#HajD7^Xo#UI=A#1CBQ6ZQWRE7+&C#O$mt zTpuO4g(%I5iKpCXV?)CM?>D1~^$w609d;=c}wR5Vfe(+De5x~6Q3&{MJW{U*k?Vh>bPHl-KX=;P)vrsOUL)M<`1 zgIBxxOan-EAPit=%pLIIs`_UGTITs{YL48=9Ea$BbU!aZ{Ew5~b0t(L+-8Ad>h*Xf*xf&E^m~w7i zZ7S!sDM_}g+<41k9Z004HIn;B`ckCHjJ%Zw~kMfGx+ih5@i#CLDOMY@`N zq_&RBHUfrJo$94z9VNv5*(`^@G*HhQ7ZEfd?P7{#$+$KY4j|e9A~AWZVSC)vTSpyL zb#u}@l>zk{?hjD4bi?q#6U{lY+EN?LY}b&O_VrF4bne=O)!0v14{Ih>MU=L&f@7rN zBurIqf!llpvchJJSEvR;0D>a)1JixOlzYF_0Vip8mnNi9>#M9szduo(cdP{%xof?@ z2hlO=xpj>3#xqRgx^}B0+Ozs<1&%PRb!TU)tj1k$-!ThHS|fih_r7)b8;qs_W$ua3 zVQYDKMNnUWP*h>8S`}W)mLTSrIizKm^~f%Z@c`j1HX(WTAt(`_?91Z=7L+j_pw{0zP`C*`YaP2JE=Wz{n*qW z0Y~vp_VRP+{BuFji>3H`VPRmIzNUfO6(?Uf4VCi(sFbZJ)kTCke$`b9exL;w3fet4 z`&dR??iU9tYsRYx+IOBGxUwKCF*$5_FJ8d~Bi0!F z{z`KFHAcH?ibu)5*G$$`C>kjo@bJp_!Y`*Z(PDM?Nz{Ftn*0wM3uReC%cDR_RG{?_ zmq!7HFg3Knte(hpa>^n?pD+dt?wq&%mZ;@={DzqK#a#8RXC~>L83!GKYaxxjd*Q72 zD}wu|BgDfU-8mFIP!LJND>5NIXD(B~SYX2AuB^e^fHu)z@_x@3=~@JPO1PA{S=54G zo0e1S*?yVEM(bJWb22a)YqxYMqUwLg8u-^gkR-T`D~WQ~p~tUePDu!JBmeBKv7)bL zb~c(Xtc{4fq+L+xcXAh_e+FGHycG%LRR^F99w10Yexq@V0bzV<}8zX*v zrP}JJ^Lx5x*vBzt{WA@oU$2LcRtz3q%e~s*x^T0NYy&U&)bJ!wNfQX3Y}4J0$`O?8 z109<(Jg-#r3^kf(_n~7O_fcn`cnbY}W61|c7Xz+w*45jE4?C&aP1gVp8;T%IhoVPV4)D-p~reBr!cYkANAy!|!3X1$ow{S;7aAfiK1x`9-m_ z_D0drh5yd1zbEGJoH?B0>&@&ok-fKPt<1;79-;|5JL?py<;H(~`*2=B4hrsBC^1~!MZxfPIST7oQAKQ|m!u`;-9I*O~V$A13-(VC2??3x2VCJ(yqS{X8 zjvuj$`|RlRBK(>Cma6If0nG0ERh;|zoL>FfOkEtqW72Q8rK_z{!z@F%72g)AI^)=+%d9MQ0l+-;l zQam&IG~RrIvM6{Lbpv4s4kEnrZ@@I(;0S;_IFoxJ_lF}q{Zmo5!1wY^lU zcvFJ~2RFMJLVC-TND^-2O8KgLbXF!|jUYGQXs49K3J&?$Daq{b1 zCKdy_Q7^TusS44bG#woRFAQs)qn=oiS5CQm&hyKmV~a$;2VP_B*x0HQm^&w=(^XIq z2~_&3_1(v6V?0?DIj1PaMXK4r=VNBDD+;Z;G~R0W5-9!RWll)0y643wCC$f<`})r0 zbp~5?c3+82mF8+JB74mqR}Aq$^q*D9_i|$FM>Rs`bEO1J{+N(hX%+Yhxp{Hn6eG7h zEpgm&zZ^9`ixSE1;;Iu_Uzi3We^LXQq;eliNt_4b_Qpw%t9h2)zGbb#&extvW>;rg zR*Hqpi$EOAuBi;p+GANgZu;p~mU-EKmmC4rSCGpj`DHRpx=$)s#H9Nn;EU{O@0V?X z`JPAiN_iHpWkqX^RqEdu)18nr(x#|}oV*@-4oj26)!yY_}u%b(B-N- zJ57>EAYE}@O*~YlqSqvIk-lng7VQui zeF(`9c?i77I+#-Cez<8bTjbw!xN9%I-I2AhS6!1iQc!cR``DVr9k-ae+7@M%JxA`U z+TXoY4Ha^>jamLuU1ObEH*`n)e)Do|?ZvQSieZX_Iib5_qV5pi&ZfD@6jRsyA@$`Q z2ZM^tvzI87LaXdOx-p9N5Q3fgmhO?xag3qcj-l`T&pXuD<2F%fn1D`u>C4pX#sxy`TyMWdWLhGni_9}!pdz<_>u5mFqm!s#`YeTZPkL?%DFFu2B z^jeulSJ)ZsIAAp+j8}W~>3%xAZ^qUU78_Ju67Zq?x1ULOK1paV#HRnT4C?vdfHiTz z-u!lUwa2uRY8u@=dKw_h`AX#UsvucS1K(624h9>&jvTPiCp&pAAZJWl&0r0+m!GX+ zkRSQ*m;6^1jsw=Zx4|XS71?Vt>tGNq_?JrxyX%Ly#DSzA^Z%GNNtzo9M|W%BH0*|0 z$z!bi{2oz~n)|$+^%$XG9mWW%no`BE@Z^s<{AJCQz4P z=y}pGCNSy&AFQScl%csOM)z8}QVlowTWcWGu-=0#isZ{`Qgrv#bd)|Dq!HY_SD>l< z=z%hISi_O5b_*a)vbXH)H8G*e-d)hbMqqaw4Enm!NF!mUox<4zuJe~^A>UAi_VVUY zaBR0qG}!iBuQBf{yrsv$uU9bCBWx9goCLzZHk!)`Bdml$(UBRZS z_K@*uJ=xxWo>+0fI?)24WT}hPB**k>rRl3jj@OJ9cod}_lDvYBbf2982W*?tYdZVw z)%jr^Y=qhEURxiqW<@vpWmGi*sD^lG^NO(lsK&uRM~xKirKG<7aRH#ByAi*7tx|rN z>VDJLH2S>;vaI@{Q$;n_>9+c#BkTJ8(2ro7FB`UD8^}tk78B?;9tG!;BrC`}u-@;f zV3(>51KxpS-zfXnB948EFs?9hec0=u=3roL;z(tAnE_CQZUr_7`D4Q_$mI04iP0QL zE##4-l_5&j)Uyhx!!S4v@6|g35&mK-q-^j14S*tD?R?_pC{Y z*)7U4Q1WgGIwRPWJj3?850uaEIjz&OZfNFdxw)VO)`dJFyfQ`Mjm}#&oquI2%_J)k z*L|t6>KQGrxh?yHFKc)=hkrG?6j5dzKQs(L9kMmKzXD=TxkEU(9f7!Tl z_-PD$HTq0+%o+2m3X!ohKVq*wjhp#=_0^TQZ1aS7f$?X4#8*8{EcLtk^jG4ms~i(^ zvv~@>t|jT4dGfEP$pUi{yp<%1CCjvum9dolt&{^;s(CBb7MlWZg>1!MJ!2Gc2AdY# znihejU2UZ$W9hV3dNwxwZfkleHlwOF<01A26`MM4o;lc>`3jr$t~Ki;_U4z?o8Pe6 zzgn{eSO#3s#t^m0k!j0Ow#ePzmV3bBmiceJX^IiH?e_hvKq*}QBnaTjz8zt4)!X9G z z`Mf9mHIMm2%!9J~IRFIunsdZAgt@|Bygl23p)We3W4y;-_cyS)#eY1>m%PcJJj$m$ zkehakx4g^0Jj}0nZL55A8(M_lJkIC5&ObN__$tlEH!m-_NB_Kd%Qt8bJ<)Tw(JMC6 zC%ttqJz6)t(?hpoAW#czb1&mZtsneE2j2a;#6grgXp(sR=CRMtWX;Y_9p+=QD zmH%p0t5>mRO$v*KQgwm^>H4<{?6QAg1&PCl_Mf;~wahN7HE2y;yK)AJBZ`lOKoBen zCbb2iM2P|<|1Iok@Y})?77s3*0eQl_lFH1?FvwD9&<_ov#8D0}y@rBL zI_aoG%DVdKs{=9m3Q*=dGdyZcsEIa1kGqmg`-j8ym^#VTA)zW`Zm(Zv^GKunTo zkSJu5NS0dIp#4_dai_JG+;a~K7u|K)t+lIm;Z+yjdFgG@+feH86&T@#86N83hDTKx;)x4>nBp}hzF1>?E#COdj6Du{-Hu0{C&Yi|0WIa# zJe10l@IIPpQrAEh*=BJ`7S%9MAY4qVpgMG_fJAI*$QIFN&hMz3ndbQ2VH+DW%&Da` z1HVaUp41bo4^pOz2M^N77RxLgTbZpx1ZixsFY0>AGM8>z?sjvw4V4YN0OqO8G@N>| zc`~BNLWl|gtq#ospMYnOL;`xA!m98@p*^w73Ce#qiX3vlO&h5SEUl_}?$KwhyEaq= zNF8szmzuyr)fQW9yO>>4<~@gI*xJ)XvcnH(5>YF_GK6lTTD{VmJpX9;szfKw!q!djVEQs!5g#^V=cCAvD4aBO3bV{Fe%w0qoz^^EthjW>Cx_ z;9ass>a3dgJOQrhUXu9U0TGx$1ul?*-qXT8hGK+?uta}T8x4eB<`6SbL`05aOi<{D z9-lR4copPdX(XhgxDAkn!1|XgP!U5J&X9&RwBZeDNCyPUfDZ9M$^`He5i`WjA&IDr zh|mKbO5x-mH?hz+Qcu;A0}l} z2T6paG}A^5G0`Bot0T|;!MnqNrYAU=&_N1ghBjugA|#QcqmU$Z5tx(!kIWMz86hbu zGtLGTYHV5nBbiBJJx!DR!DJ^v37biVGAf@Wnz*l&f@QwK(}onmtmMwRDXt zZ8?-y=8~5OfdvX+5lmqYlbFRc<}s0(Ol2;Unay)r?9yc0dDdZj+nc f^yW9g8BTGIlbq!==Q+`tPIW@Un(d@YKmY(c8z#BD diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainisoencrypt.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainisoencrypt.gif deleted file mode 100644 index 3ba2beae45a8951d68f399dcfd95826d6318a904..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21039 zcmWhzc{J4D8~)4;GlQ{jV;}n(V+$pXCHpcYk)`JmVB&29alGOaZzxO=nx$nLAy!ZX%o_p>+&wH(GEDeo(*FgrLZ~)K%{U2Qi*hsu%V$w8WI;n( z&?K$%HLM8;Y@?)oxukuSp}jB4z8rZ#g2A-S9FVnC=@rI#Y=Yle< zLt9X{SeWPm`{>$p5w+Nec8};B--vudPy{x*{akdr^{rtbhZP+i4dk=D@6qfDW8U|= zyzlkE3t8CsG2 zVX?fuqcest=g&ptcNx~Q?&S>U9LR}YOSQgLwM3)QQp=}q)ow23coS;pyxUo+RWtV*Svj>cE#x2k2hyk#b}YkRXiy1Zqn zrKP>GWgw$xzr1T^t}&yqXS1qnrM7F1FviLlVCDC)YP(j-d)B(Tx(Wwa8B?tMF;>gK zO5qr*Yhb2onAJYKMw?=F4X>5|$75@?|L4t~v9+oh)?rV^*w|S49E;W7UOU6u9VqOX z+H9FQtXg6<&aoPoSi>`$V>2tmGuvHrtg)Hx_9a%&9BW{1e|T=YYl+pq!kU|#JDmD2 zKdWbjHMO)owX{31!kSsy99}sbTREIsIhgb&8+PXZ?dM=STk#f zW1IgmYi{juX>E6DZGUF-aBXdkwKBZ4dAPL6TG`xR`EO)%cWrZ@^So^#G&F>$w z4*vt|{|09Pw_YNx>#5ywa6vV%p?X?xBA>i%fptSk{{y7%)fB_^;=y#3d9tKUW7+F0 zm9te|uQSW?6e|6O3v8O6j6OEJzPa$asbahs6UQlK+gv$WYJF$y)@0+;=?ZMAExW4a z$lGf7rmKs?&#T|p;fhQA#9L}U)Snx#@_y6uZ2m>KRa&aui|xVY8$UJ|-@N!f(-sT4 z)34rIzuZfn2Rn|mDlQLD1@!*uS=sHFTQ_l(?`@)DJvPz4yk83EFI`yuRFr>3;ZyHFc$?8yU5;` ze~{h`save|w0>&x*A5#d-z6K5l`t2{R!XlhDb82zb6e*6q{+V=6rLgwJTA88MQ}M& z0Tb1-2MWTq!mZ#je~&JW8zB7xM|CA{9HbmWK|lE>iUn*;9&fMdkrIG-zcAzT!>{;U zj6?u<$np0293dCx!%QK-dYM1n7V6V)jU&fB*Hl{+evB9#&B`kmzI34X zN>;v9988q~eW9O*WOL!wX*|FNz-leoZr=i9Yg5fu4$_5w4F5^LX9zV)N!{eRq}66H z^=G^t`1AW>TP+V`_*n<%li)s9pt-f6)Sk$4eZTaZA%P7Qr#6=# zu#H~ncgA?hULlUDOrd#w?JOpr09#JGKHXemQ0Nchm`r-euf>=wk4T-#W)>t}>D7J< zSY$Eb=T@uvTuRI+`I5JF+h5LO3ZGo=mqpz-0H4r&EB)b((Rhx`T}^A$EL^ki@{j1_ z*XK0)A45&~8o5u;Xb9RZwXPT4QI$)c9#=!`9yb-p?K=`Kwt?Adu2}I*IQ%F%-5EWa zC9|kYZEtZZbAM-CQk!l#>h&%15d?_V-0TnbDuUoU!=Of^e?NI{MxHqk zacsHQ z&2m0l6V&vKK8D!d%ooC-5^Z09axTEWt+0(&wf{*LM4^c4(9irvd{14oGo6av&ODVS z_@CvW^l*B#N{T)jRbvOA;R`R75NP(5SdSUlinSgxTY4rmP;Yr!k3c%{)0r2h$Mq_* zIbUS1;TSq3#b~C!ae;~FWAY8^Fs}@`JQDDy!7cR;8j_WwbU-#LlI{xnrpi78nGe0} zl=w>r7Z)&sf9o%*I@*l*C8UVlyKX5c>Cvm7C;#wRx1!!?qg{7MW0oL;Xw=A`f)@Mn znBniHQ3B$%LZA&yfqp%h>tM8>K>EWk6e-4f`gIue3##>)X)*Efp~a;PvCDE zJ_Q?v^hQNjX1{)>^>pFIr)xeMpqd5$>yNu9Dl82yD7jhmN1O#G~djGwv!!F7=iTS=bt5GU-8z;dVvm=6P zqk6H#Mfm~XjAZnsW(Zzr#*o(S`*wtVG>bSLMM6un3WJ+rQl9qf7joNM;$^OHCN6ZideRP=A9c%U!W(aVSlZmgUs83@tgs7)q;}IAD{2=t3 zZ+|x7XRI8j(;33`)24CKbc4!Y=fa|7@ox*0pLYF9RckWyMcgqg$$A{h^%n2i9+C6F ziY6ewVmYrT`TVDg`6X0G_^LcA)eVFGe9ZH1wFsjzv~{v|-7-U6X%DOqeB`F%{?566 zed1dWJNT*`X*?@E>szlk)F2vr*Zq~!dHaMjA<-ZTw4cXq&@Ol9(qHkn71H#flRWr5 ze~r&{+vifSB4ssy5rxSQ8qf2l#=l&(B)xUqW%*o&N=-GZX*JxlsFfSwOd4&3swo0o zOlxhc!M>GEC>0jes(Cw==>xFMw7+*S=RJCqpwJ`=SW@=<=D$vx$$xlxGN3V~aNfIk zF6O0kc%9U6$CCQB{Q4A1!y<8#$Hnz6pfz#U-EeTORP}pYExYLb5q(4zZO;=NDGI#< zT{mMK@4IF4rl^~k{Oj*;$r0olm7{RUiAt}#|I;i@Ff{0^rRl)=fW~t3!o_dmIj{G& z_A7F}y_X3#T1q*k?|UqD>08U;5+(QN;%!+T&#%yl%fAcQ=Gp71{2I?$F^rm!vMN|E zSIx+cryDbs^MQ5}MR&EW_^+R34+)<4$YbH+1kE@mB z2VX2tKdS%46J5Ue=8N_R-^l|vEx&oYS?4}q4x3fZm>^j=p$-;(9aL42v2Mn+8 zq*F$urLHPIHQ>+Ahx_5sOy9hF@wHMi@7qmpoVZ=^2sO@ix{q!pY$!iJR?^Gw!Ux(r zfI?Km&15WR-oN^1yy#s2D+hwT)T481(0(7{AB0)`)?@fiH}{var26L}@#Q+>*q<8} zvF@Xv4n9^HG;iOINHbzaus1FU7k%f+2@38P@Oj^7kW#I2VwK9Y3^BV&FXeKHQii{n z;fChcACzdmtFYwL;;fYL*|L1z#frzX_;1*HXrX@!#=2{=J^His(`vcH-(}O~srr*$ zX*@K$yv`}7{XX*!2&^*UZ}R!#;jfEU2`6a`u5~`P_6)XhA?=RAJC4hD&eITbmjMnG zbc^ErCKEpRQ2G*;qi>gcazYm6$MteTb_T@*Sis#UY@j%hBc5a4E$)dc=M0rg_#F@o z5IPhI9;O7BZuTESJZ~5dfm1MjJkY)aj=}M)FcIAt+fhHR0VZOLf!HpU;0$NWz{TOL zty@q$i41Egx`&eh0W&0Eb|5rY4{nqt`rEJ6-r}Rd!cxm>oqb^Y`|yu77n5O;&cuDzes3W z8DK{t*W{g~(Gi37ItEPqxNK4uSs(|lXoGXE4kx{tVn^^LKB^~JTU(b?5Svt3nm;IH zB6%#vprM|-BM{)GIzB&$dw~>g%M<8ini$k`Kd#ichXtn@!q(}8J`3C?mc2a#eDNTK zxuHRuKs?NoaK{-B`9ApIE-)V>(2_{FPT?*MRPv?*Z4r=l2G_w}@*vh35q^CKnej#d zF@(lQQG=^!>3<9b{#pw#!wFIVg0oGd$U619A%!8twZcq?GuQ-vXI|;yoJK)E=cUiK zW;n1WGvvCt)U(*8F?Rzp;nEZdH9nr@A?Gdtp`HcSgJ(JZ=AhLhsxgW-`1G8pEW_6c zx2!^=Gl8@TM1P=C6kiGy$3BhE6cgFfcz)Rrthf-suDI^h9ESAJl#p=w#&kT60x!T<3fG zNFeA@>m+aq`nci4om=_BGWik?Xzm0LrS>2|eB$wrHCGc}f)icPmtWX4k(0)v7Q8Vc zjNTHS!#ew6^G3{I_LZPQ)r=M@XDdG_@t}}Dh|4%%f}$dJBPoBrlA9+J$YFAgPQl_~ z#jU?nek4gqPh=l(q&J|sH;u$tw;r}ta?eZxRhUPC0vt#@VdqQsD-1_l2AE$wqa4jG z8dDS>LG$oPVgec*Xs*{&8moc8@y)zfm@FuYO;tRdhDV56!!tmoh944+fW#BGOGh#x zZ8Vttm%JH(t!t=t$EcCrC z%}IIWaltx+8hI>H8i|G2(V^dwPsFl-nLK1bd%Brns>`NE5{oZI4OMt>i*p{U%zL{c zp2XpePkfajrPn8+8qS^(&N+mW;$S{XjHvuzO~?!aLUGhFVj>5c+qLphGnJz)f-QH` zJPHeeejvG{Wo05{_nG|d3}R%Pgz5w=%Qp4NVaY>}BF*KJkUR-DIs$c_{nFvXgAa)5 z*_5`blQ*p~rhxrNCgNg=hMVEB2hCRP+TiP0WpS)a0-@@KVJHbGoEfgPhqKL4Pg9t6 z85j;0Cr2@=o`U+1Iauu+#Z)-UmLmgQ5BgJ=OfjILc*J@EzQboX%wgt6`Hv{PGZPN- zS++A2-n8&wBnG7KpF=RM%WAzcjF&LLBc@rmlwu4)^Z4AG*P$jI927>=6(&alqbZun zagEW0XL4L+G$qt?m~l0mR6~maxaA*?Xlk?l*Cq<^{IqBD6$X?81u^*pb+3MIHvinr zuKE1q<}0`sk2}x=CWo^`vx(>P(CX(7>MwlmKwa)YU4x%r32%<*Xueb3a+9lt;MsCT z{YBK*CKD{kteUHl^5R;@^EA&F!RoDXD4tYClMW8JV~5y5HSaLEO};`|6PzaVa26VF zGSA6kKux}Kmw##5`D!Ql6&}Uqjs@v3q3PjtJf?oH zgTD8;9$N4UkL^wXUctHOKe%48Ep)?2Uj4J{0pIPxqhHA0?dCwd5)bL&F{ZO0b&DAH zTw_AmvB0$ncq)#IC*>8>vs=yU`Hp9g-Q(Wt5^%F`5NJ492L(x|@;;;VAM){f7^Im?3ijh^|{od3+^m zOzy){Xn;fl4adVnERp=GkwJaRO@;Mdv2I{;59dh;;WO@nnu0exbNR~8&S^MOB*yrL zZ^R8JZEz)0B$f_`R{}vrLOcT)`vE>4QTHn1@*5Y^p#qI(N;K~1NXQ31og^H^ol^I^ z6b^q(UI8?a!050G#rZ0?ad659Dy%((L+ejX*mB1z*O)>>8I;=eD?|x<0<=c$G8N|< z3@_geQJS?)ZAXs`ta7z8tS#q67bJy&zoSl*WGI!(aZV$HPP&a9{Zl$p6Uco=Xq^9) zQhx}bz^dm~Vu z`o_i&#-NO0$*)CvgE>=`$~Lu7O%uSyq96KhL=!1r4us*`KvZ>KblON_-`Yt zKeA3_-%1^k6y_SjOGq&qyYJ22pdr%m?DkhCt`~uT^DgzU8*>oQ{nsWq{R{e^;Rh_b z20}FkNHwdG_N#=D!D}_E2@9O53`h`SDEeE!v&q2ay94KId2iNywkzs)h#gSanMTp9 zM#?0(@a$n-&}zPQDq}6I3wY^kK6+@DG0N3O;|Lknn4JTdl#gwjZ^yiBZCJsrUh^;R zceFnAY)!udC7*0ge$ae*9u}s~mGQ4Gn5)I=YfExb+v(sJX^yS8J2sp>zYyo)=NK)G zcAYQoK-)SxUVeSq&DC`!yxr{N*SGT>@4q&k=KI<%-BSIvX_%|?Rng0yw9ctFo%BDQ z&+P<&QQq53lePwMFrMotgMWKs>)V9v`-!c^f4qOGJkzaZ0F3etD_^4uf6N?r*=lBU~LhImDH0>i^&7wb@2Lz1Ea}m=6Vv#eI5$j2=`^m zYs29(0(Y>Wwg%trxT8KXk-Z9kFOxvV z@4|p7zg4=qxV}p`VAjLJASUAyT#Sz9;*$*k&ryAq6y;7mt5_h?=KGCHvrX5mlVs8p z!hjo9r`7*CWbmb|e#;H?o~XMhVttjTv`#`D4V(MNzlYjhto;E@@-C^NMZ=gUf2>WL zC2&ibkdQmF>bE;ZkZAhnkCtgtr()T}c8ihPaz<*s8ydM5N%{z8{eX*-oec%m7UZ8b zWnXmao>@pmH$JQQOsaIKN*{(8UO_R5KM`?(n4oe{ODNlvO$vPj(QrInH;XYZN%EpzdQ68Et$ z`3?K2lYiR3U#u2HY-k5$^H^SYv^pF4=>Q?QQW_VeL&YCF)?Jjj;c?sX#jX8f$Nb(6 z>)%KBYu8I7!x&(#*!S+LCYJYC7Sudj3E0Z<7#UbjS4S+#a5%iBBvgv9*`etgHkUsX z<+bON*SIS5rJF*;P4<^~naMrcM&9{0R7uofaE{2mc06f4`*;k0$!#jL*~hw@EUNUU zJ>vOvz-pp|O!|t0HP5t#i>XFmIGgb0rG+6I3M)Xq-?|iy26!jQkS6Wz0}C}v$W=y) z@!$fP^iq;dK4ogMHH3(*U0F>o?nKc2idjX&XI=BnXfWG)`UTSzkE?ob<+Bl$V=DIO z6Vt}riP`TeFVCR?$QWwUQT7Mgln$7c*ts?ON7~aR&(@gEd<)=2;<8 zFt#fDdgY@}p4C0i)yyCm(7NC21S_2^!S zVI?hD!w0T@D_+E)UzJ_XzNQ1Fk&G%v5TaD~pIU|RiG_#t9GXo;^3;^cG$9rZ{3#v+r-$T66 zfW+YRD14F;!))nC+)U-~-PWUgt^DjaEF_T5i6tYS^eZNN2*yV7CtGB}DK(gjvIL1$ zubbHx*ufKd9|lESTG{VS^u%8(OXOW&heOa*O&WZFBu9fM?5&*3`{GggHYU4E40G4K z#_65oV97myHE$l@lIgea1uron{K!c<^=Nl6-SCQVGau6OpXnp_1M?I~)TO@zt?63g z<09>WNY@_dgP4sp*$OI51Gj@1t08kWFMM(?iVznE=}^2fCe^}K#opvE!y|C#H9Z74 z!}C7Lar60EF)VvZsVo?-@5`$43#!BY?5P-x9!7?`ix3*X<<=oeIqQ_gu8LtqbzGI4 z9FzEC4jRdl1W6+i4&mcvD6nEooVdsoI~QIN>`1w2EGv+5!waWMJs28gKs2uHll-&} zEN?dE_h=_OsES!oVXdq(t&;ym0VOkgw$j2ZgSQGJMESJ5VQ(EtP z=0yocH1>8ia}`ry;>#wF%yc#RiFq1b1``&7T*Rwcd^R)mzg{gwCM)YvLFRlC z833xhfu(DN5tkHraHl>L%up9nJW1qqkh@%cY^qY(h|@NGZAyAY-?v-mDS4mReJ6vR(auCqS&;O%z{C`E4Y&S@Lw7Io9h_Sx0xM`qW1j_a@sql#;>#GXcFv6%XaFo%-Vqd;(|-&T?x z+RrQ8@Uzec1}Z=yq@7IYLH^3?zt-&s>a}F+D0cq_;-L@_dMz-}kTx3+K+u!K$)5Sg zV&l}o#3{038Y~TgELrLjKn2)W;>p@AgpAWmBNt6dCGbY77qFX<8c)<`Y5tnLcahEA zrAZdHF;}UY=&Q$bjntIWO`STD`y|cU@J8QO)5pa6(WXOINm70fVp}0a#S=b;YH|GR z3VX5!V-Z3kksk+RSAbK7jTzm+tB}A)vV|t}v%EMM9O*lq84ov<4gw5PEt(|xA?J0) z1LiW7%Kh~|<)7c|H4*rnx~=k*^Nr!7+8cTepgYhMwM^ss`LFGIEcJ!#*&usfeYPz z=RR=L!mOKDZ5P!f%P}(6V+@64inXl$2!w*Gl$wSwF7u3G*77`@pGf zLI!0X$&N53y!0InN?3UO@d$bi`sB#{bkqfgXQIAEX2W{ehZ71$O%g6%W;>JhAbN+_zb~6 zNzy4&GkmS>ueRuyw&fPCBd+Ako9+rHNnG9*K5zdm;1^~7b69#T%-F^9pV{?BbD8-2 z%?r^=iYp3cea7&_5?M2@+m$^u!*osq|K>7T;>fjNTw)?T-so}Cr25OLlP{xAvWGDf z?+nF>pg|u>PbHCw5Ww*48~old=DtLu(=0u{wbAJfUZIJu`UxY5=#o0C28RREc6DU; zlMqAdUoKEMuf$KRotO?sM5oy4%&x8J*ciWP!^2!@+;9Cb)}k?XtR zp{@Cn&IIo!6YVVXeRtgsKKbi%J@M!sjHE%Odqx|fNgfMyGuW*zCAm~WZw^89DoKq! z2yr>k=sdX~2=y9`L1KabbT5cK{rw%fBMM@WLjUlf*W@Vi0TBP#SDvMl?DVut?{!nW zHJfrJNI4vN^S5~!IX;F`Zt4%0&n`DRi|B1t2ne>|MzP;EY$F@S+uX$nqT=j2&HCX9 z7gqc3^CgE`8de_r_WMJYg4i=|q+VvzvwQeVqgJsoTj0u{Iaoe48pDdRB}tVwGEJ3ao6%3!=Z#+HOJSg^FuPWg`E zc3g#}FcMEzJ-}w;@8c7rysV}#!Q4oL=kA)HFB@zHCvFE3A1}v`9oE&}=Ev9MdUoT- zDW;!$$l{gSCbHFGuJS3B)?;M6_$=)0V|Z9N>~Yy^3Te19PZ`4KD;BaF!P%t6*hFXB zJW3gST!2YJgQX$*Q!(8YxJ3QDW7WGQ)VJpQbP_(h+XxOTAA!eU67L{2QYtlVZ`n?5 z5ETQ5hv?)`?CW-FoCO&#N=;z9YcRHK`{=D@SYJy0s>SgOpdX-q9Stxt&?cx6|J=X7 zC8Ylai7fSlsK@nhmQmLl{ZyqH3(kh2q!M$|&sD*jd*;C;Y;0ZQ|y1o?mSzSnY z{%2F+`$q64SBIIJs`q8Y{1k^;k~uGS$WFIA9;;@FAvk%$wKg>2WH2;m!U;!`MuXu< z6ZkzW{F#n8wra(k@Vy;-nhN@z2|owoZp}}9s=;~Ooio-y-GrRJswe8nfW;zDh{kD) zJ$@ldb4sDVDl&8`*~Qa{k|{X6B66yPI=M^Yv=1ka2jYz={6F>j{TYeBNaF`W4zGa< z^&Y3C-G?>HPNklsteHN2Kp1O~?O><}unpNbnNKDh=q+@f5QpQX$zZ%L@xHDWfB`K? zntn6W`0tL8r)VhJK~x}hz{JFfcz7&M!VE9*Dk8fy#zp!nFH+d->i_&{OMjM?Y5mq@+Zb zWSstvc-;{AWWJobEBPZ(M)Dz5qL(gqLqaL+XK2 zOy_4#7%OT*+9eOqlgED3og>E1{tel_ctcJle%4ZG<_>Z;o>~)(al3rkO-uOo5H9{0 zL_~8Bep~=_-|*~|1emLma6y9O_~kd_dLX611czCmwBf8xf5WQ!`5TMP%US0m_21uk z*KT#D#=P)7d4oOLJ$V)wOJ$0BYH;>iXFI+tn>q`2;+uWod!pj2wGRAs{Jjis9lQWv z?Ntt9lGI}yBQciAo=6_sc%;cz>8PVoAgYh&n_!FmPaLmj&pBnD8|vW}hq;$6GE)@p8>!sKl2gzP|%{}_?dFz|ceMz>j-+ILbV-kNIdpY@x zfHL$BEw?#_OK`@-T?||d9|hoN2&x^^h@rEU&lj0G;6Gq}l^@_!4jR&S5KgH&M5}i` zb}|$H_&z3^#-;5xX*%M*^iHE+E^z62H1D&KIB)8LUG_ZBmu{oW9QXec{qho}xD&n~ zll{nm&FBMVl_H{llb&5jJc)rZy_dOFs=_B;^?I#S24*>J zT%3H4cR@^0*=@p+?2^a}?Ejn-$!`#OcF<_-w%O$21$c#;jyMK%R^9|&sU>vE^?nxa zdQ}SFKW6D2iD|N&9V= z!d!lG-yUK+M*Z|7qGB(LL*)t4zc4X4k1}}drB)@o)9gy_)=K-qzMjSE63psd@16Gvba=N}?b~CtFhqIu5Dt*S^ra?^uj)g z96-YPHZ((nu1Qnfsj$R$kk_BNR0gan+^-m4pPG_l?>2oOn*f7v(w5drG%ptiP8CrR z|C~4PtDLG$Tc(Qmg;73>&_Pd^0;-mJed5R#Sb`cE?tL5xwI;G^bA6p=VMFo6(+7~I zZI>$!U!MmAw>-h?;I`LpY_A7|S>Qn6Jdkt!_Sb>!Z!_ClYuoy8!dB5Xs-A5_>HBW% zc829lpk<;l)#3)7lrHow%uUJN?=c(mgWx|{%QATU2gk!9)1rVY#Y^x|dI(KvQ!;JZ zHI4kq4OF?&t%yz*9ot$o**eKcOb^+5s=2{hAxMzOCb+NQ%Fsmm7N~;hAMcg)WFt8i zyz00unz(~}xFc4vBmQDXVsJ-N6xiblP(=4%I7qx1@}YZ7u{YpxM#hu=C3t56@Iafh zwP&@cHUvEW4Fa<{2Rsl!PJMFRhFWo!a6E;tUm1B9%32EhWDvDwBr+Ah5vPMA8OxZP#osA$;^8~1wSW|L z&-TThUB#ZN3a~jwbo{mF1pA2<{ptLRz={0npoLeZ@1466ZFfG?4^Pw`fkYiZWX9bB zLJ7v!iE8j4dfMpx_JrXcxLKu|A}g`|IKJ^%axO8EQv1L@02nEWgnay#B^@6`(MG@r zoEVYF3cPJP$&ea#UL9ilVoRACWgv6Y4h4WKK`%sZru-wRp?^7HZc34_OHs~EX@W-< z$sY7?y6JSiYeA>qgFrYkrwWk32WY`|SjyJx&-bqjV-Dgg@nWJoPLo&f%P?WqdpVb* zH2+P-$3%(V{924se`JXoT-JbK*aGe*7q1YbQC}e;J{Qh|35nxgPKn1`b)mESqBhVg zxfS=&?DeR9zgL`M{Ip^^$3Q(O_R8l!gm3S6GN1FpoY9lWbq+6+`=reE9>J{^#mxR>=kDX$-HbKzE-X7=l- z>QZ!Ei9J5Q?)Oyi(#eV6Sz{#Db>^+Oxp({ShOy7&Z&oIr%Lg92+^#+_gD~EfP@dh5 z_I0TGElWLA0}j;c_Or$y;jJ)QeWwKm+;}Be>vXd8_R}t{y;l#dh*r>gYr=Rgyz>0A z6R^Yg>WE~!0kbBmZ{9s~J|datZvsHJE`|zd1TxQ}9iZYz!5d83KC*!FKl7i&l~=-0 z&55tkO!*-~2pXx9kAHK*37cH6VHRJQl&2lxe_~M4)CPhmz;S;0p*-RAa^o-Ja!T26;_&+Z{fVaJ zPTQ!Og2Z^{WHYi@pe647i&}q3k(6WWi%n#>(Mw!X#CI{PJW%ySB+};GJr0+IV}Gq? zY$3yC>?b)iRnEroE_qP&O_3CEg706NMX*SC<;bPkd{lmzKl-{8HxG2C-|UFZDiNl* z!%R(m)?I%o)Z|~DgxD7aUqC8xw^vfuc2k@`3#qD`1ESWS9e#M$<;9r#-h|v(u95FV zKaCM@#v2RC5kMIJdwVJAwxVLUU1pg0U>wNQ{dyiBw3F%3d{NPDzDTVh`ilx|Xo zOF)RzctmXTTtX4`M_?JkRlLOBA3x2()78m%dOj)Je@qpbdqK0RreQ9#`g9A$>O_wH z=Wbd}$XNkaYe$urbA)qu>5}+gW8Ej&(_$1na*gs;qxleebMzE#FLKo6A4PtM-RlNA z@pyZ(M2@0C;#qCF;Mr%_ii{5p+>R}z^rVQ?J)+c&zofXh$ffR{XA=SoA|MFV7@H&4 zeT@`zdmi&|=h&bOQ=jk z9w+oo@i*lld0_pA?@Pln9+iT13nFs3<|xWla3m%Sckh0}?HP@~?<)j~n1U^{$0p)L zH)klG;Fy;$PNB;pFWT}N<}r?CEwP|Ey<6s-+o317_ktd;WD`abwyXcR!OB7KqHV?u$sfdFTUX($h}w!3|P^=G#7p-%tQnH96MmNh#>kbL1?P;G} z4;0~t#H8^csn8Ryw9u0GE%)D^2~ipv=xr9wc8LJ#P3k~wl&~COUUI^yV90d~F?yh$ zsdtaX=Ra6}w(Ssqeurh)$s*GS)gVQomY9T-|4h@2G%#%QvsOCSZ78Mq?uV*>D#U3e z>XAVV$)+QYt6?!yCw+T3#`Wk@KQ=1zC;Y@`U1c`?A`tuu6-21vAg?|-jcPU!7ibMr z3@4h^RR)5$+=F7ht^xw~r7{QKGEdC+YZZ)u%AA8%Y8j^F!q5Kf!S3uVC<{i!bX?Q>A(JtvOO$mI2otiDZs&o z1R8N6U+gZ~j<%q?MW<2KH+jD3eij2D=9`|7IeHrPa9v=d)!aF{*U%PF2cwgbm!$}A zZuqXivqwitn#sMF(5 z(=$#Ni?OTPwtWy!`@`qwXQ3)Mn}Dn9IaOiy6Pq{sTIxYJ_r)V(&LP_+je>|C_2EF- zs>{y=y7=Z>3({jBOvy#Lpx+skX!4s`n}%O+8jhqFU{Das-pHnJm*%4b~0!{4jKNuS>C^N6*@84gsSyBlwO* z31q~5d~)OYI!M)b2HdldV*^EA~+!>Xi$&j^Gox{kZa5i4}oRLP&N*(Jz?WT2S z#+O$@avO(mahr6~yjMMwa!%~D-V{E(PgLcnjf3U&4=yY&jm@asfCQJKnmX(sm*+*{ zRu14K;G7kgK8K;zbFNGRWa1BSiY&qn#>543KT&vaJsDz>c5*4IwFO655`Taxb4Wx?6;3=PkmY--G?nsV%2RVVkd=*FU%<4u!hVu zgav6$FxDSWKK3DZ<%z>obBD>s$gc5<6jSnJXD>$n=~G9K z$3ErkKy<&S-n5o;9#qhS>;q`CnR{UQda3sx7BRD+Umq6V-6KjNsGvhradZz53x1z} zQGCQ(eAb(dha|HHa9b~7EKpz~&YIM79G4J8Sf~ohCS}l%7rfoexCr=T#Py1QfH305 z7x#>0wiX#HAdC>^=ig3rz^(;bH;Bl|OaY>R*TWrR<7Zk~zPVf1nP zo1dp9fFvP+6lny6gL2CLKKF5Pv}h}%c%P$a7X*OEya3nY{n4V8m)=51pC9iSV*iSr zkdO!tj-i*2oJI*+WLX|g6m*U;_k}T^@lj$8C%4V`*yg=!DrY+4y`2BiRKxr(l5W*j zTysuV^}_Oz_t@dN8Cf58n^u%-zt5=R#j&4&e9TAKn3sU<(C$6zFEN6Qq|cZQc^)Kv z_>Q^U<``DlJ;!HxN)d8H(Y9dwI4XZ1@`)+0>&FEf#=>vHFB(RCR*u(l z#jvGtY-d^7>!ad6YULeEk}Vsi!>|wxToTGHF}eLtSbVSsiBYr`#~!%8eY(iN##j*vNstCF z{d~6|X?u~kwoqzhnXx6|Ft&VBgiY{p+4OE4r)yfF?~=;4yz}lS)j9D1BwfQ@02@9o znm{|QBxh>xzZWgfF!DDY!tpwm@!$RU`zO`XZ}mi%)X7+q7MtJeq}6IdGHAoi)XN(X zuz>C3K{_aIJqA=01!8m0Zss(W(Jr_;PoC1iKR1q_83^slLuz zO8nB8rL97#p~YoIAJZeh-|S1jCO!FDLKOMR2t8}(k*rrtchWJ)3$h6_SS{^3Lq zxgofK-gK-u+ph?@5{eyIZ}f}edZcEctMyt06MS8dejM#;9Ygaxv_C&qdTY0QT(9?Z z*abY4B06kC{>P^3eC9}1C9YOwQ-2-219l7qbg(Mc*|uPf^6{ZU5}OYY9@udN{v35S ziRkszo`pBM>xEAs8qM->U}?#XD%lqb&J)0nQFJ}j7i9(TRfi3VH1t?OYFL8z!xBds zY%ZtQmvhLX<=-lsq#nH^1(g#|FIlP+s=GLA*EkEJa-Ypt+8n=e~x3ado5CU~XUJ~#my z=O#Ctyik0^8cCB9@iA$L+{Xji((`>_Qm%!YuLe@FXW&r1d&~zHTYf9~Th}@N^Z~`r z;jgaGG~Tp_yjlBN8))uwfuN64rQZN_?y6a%d+gL`pBj#B$T{({M(D%2u8i=9p8LU}udq}uQ zU(;~qbONc>@iSkoul))RG4=TU-##4*`1;1NkIDWDUI;$iCsQx#qs@8cA*p@mvTYw~ z!tVCMOLbGSBwwY5^IY}kT)DMv&eKQo93=Cm*uEwuKv55pc{}9ojZgEBG*8S)n(}?u zjfIG2lfd6Xzq!aOMXAp@);U>U#g>5x;%vwMD-}KE`aJw)*QfSD)%o9=Y^u0Ar-^P| zMbo0gK8LYIW50fwEzCS1|Bgz9>Y|w@74{XtGPqQpp;{?4O#BM z!{-rrA5%gGUcNa_8xi7+pvWs+hO7<~x3y*7TqI77b6aZ#JbCamFHXOcN!ueDZkV~q z(FIf*6dw4?MOC|PfQ&87TcXcsSwM_82;Jxp8PfG=q0+Z@FY%hQ=6dzl!{27=ug1wE7n;br1N){Gt0W^qqUKSr(cL(GzIk2u zUW0<((;Hyf5#6TG$Op-hCXfXatqh%*M(Kh$(>t0ka{Acxx-nMf=#4Mu`iR;J%}NN@ zC*C#Yyg@RCgwa(CSSP@nLU2*n-&oXoNTK&#uCghPdRD$Cu+u9ZZUx&ggRv|`y;AHA z2udNnr|+8U0gt>!Gt6I~Lx(gQ9`$PT5uMg8I0J*RKem)ox}hkksUSLc4TvcH)%EQ2 ze2-}H{J5`d-9`uCOrB`xhkaan-AD>i({=y!EX(}zSE781DPPR>Cq{(WrRP%vJqCf` zzt)(jB#;Psi7T9doXC&3wS^PBktnvWN;7kTHX0V}m?{tjvoVAn{foL74tz_XR)h*V zPM7{AW3^6a{CKF$!%(hiNkbc0joI z_@EnVelto!(f?6z<1?}*?z+<%o!cK9Z&&w<8@^^k2i$E!n((&L9Sp2T&0fIw432hV zPao*&#NGcYCTeKl+xvo0EI_<-PI;ZgNg)~<8j?=OsG@s~aD<|6%LH?_gt`N8=z*UH z(I5*@E$Ed@KZq?h(%FIjkytNEITOOY=qFC+m$b%2*g1DMmfT8?>{4>~XRxkT`}qc`ZEGw3io z^_$1}oFn>v+BqRudJ?opq(8cqhq{JOI*ZPNpc^$I*n>3~10icVBS%9!EV@xQI;o5L ztsl6lLusXR2@iO=ILH{R=Ta@fvn~`Im3(@xQv{?h`+DsY{t?PNNH@mYp8no9bJUBuS9RFPhV8JmEbT4SKwi^U1B*QnPJ6V-P2Z(`t zmwT1_dtsmZy@Em$I9TPJb3cd!puPIM$3ik#13zp79xyj#D-ghc)u>;*l4N;N@&Xq) z^?G0dDZs-y*fdVVx=Dwmuoyg(fnd@JY;Ia95k1{BY`7q1FI)P zwmWnw6xzz`!Wg`Ou2oJFT(QkBNyb0DdkDN1!viRAfs*CK1n>YJIKw}PLq_+)(7$Ra z*upYI!^*=0DPRG`b9oZz0ZB`}agckt<2;nk!Wz7MiIG53lY-ZSJ)n)fNS6KCr@bz; z!H6yWR5gJk1h(8WQPe+vi{`pA=>I_yfc#VU{oj8>Ho%o!rK(&l!!w}0;Um7%Bb^yp zg1AdQvqwJbzih5^p2MBKiIKny+<;PRf@S|hJAA`85Zf}OweX)5D+oVZ6C3F_ggI1p z8;n7lDZaknfEYLesK5RK(Y>?V{Rx``Dy%``3pba$*;0=|8)UZm_d`T%gZWpsCX7E4 zxEc6I|MXYC^@Et}Tfg?_GxxLEo5jEX|35$&5IE4liWfn|hygY0UqgovAx4xqkzz%Q z7cpkkxRK*SR4+P)6giS)$&m?7rc}9-B|KE9^dx*S^Ti5+H*w-jK=TEUgqBb#V>y&) zQKK6_9#y)OX+)Gwp+-H*>;Gj{RNACw)w-2qQm$XYPJ9}cY+18s(Mt82mhIB9ZQ;h1 zJNN8bx_3ps#k-epU%wjd{uK;S?_k4+5u**9*l%IRk0D1cx>zz@F&cPg*1VZ>XV0HO zhZa4WbZOJ4QKweDnssZ`BtTZ?>(Xj%+qZG&*1el|Z{NRx2Nyn^cyZ&$ktZ*XRd#dd z&!I<`KAn1X>({Yo*S?*5ckkc9hZjGde0lTd(Wh6xo_%}w@8QRnKc9Ym`}f1U8it>L zf5QU?Xv!4;9PrP;1MdP*B3HV3Xqf#V8pf4~x`EIkR|YH)!3{Y)OTmYT0B`^h8Ug_T z005NYA6Fa@QI3B=82`Y90RSNJpAb(bY zwR`c+SKod4?fu9H0gw;hrr3~am66Y_s5YzR&Z zy9tAnxg$q%zX=~y8cody&`%B|otzqT%klFXaE=5Qsg*NuFZ}R|66XNziKNgljJD&J z#{nXO-~VrQDO>;{?qTNES_%+U9A*F_LY&Z{5Fh<#Li0$;`s@EEp8Wk+zx$QL8;!u-0nea2ion8mGuvI-zIQ#yNuh1) zBhdhu7B}bpV;DAi5{!xkI?ahHbr50Ee%cf_A~A_+?t`Dt6e`NPUj6{ro_sie@0QkTD$#H-METRG>ayFw4t#J-9V}YDF!fvz)byS*= z9RKR(JuYf*gbpF(0Hip#6l%y(gEUYY)o790h2(a*Gh9XVs1F7zF(SdkP$3{0w=hmE zd@vePH_%idDxt6t4N;NS{=tb7I>dThBcuarX-G1vP|0u z|IxQ_j?;z9q+JZjQq5^Lq?-P$h%yaI7=VU_fiW1ULu3|%giZvZ6KzN{k5V&|1sH5a&Z<5uQmH{iz>qP;>L}w`PHmnWz>A3B0#~e#NCR-M9M)?l75~L|zAhLB z-gG%y2UsqQnQ{QK-s_6yPK2J5QeS~TS0MloU_We=!s_$`CcMQroZV#Jjm*ne5W7NY zBO)$wlSCp6%L99Z8Wfu7+L7zdE@I82;Z8UTII1i%Tem3 z@{?ov5L6}XHKe0;+o zs~4?HPOMIrQB>P4gRa6@}cv z9XB7s2U!R|9WPTPY9)s;?9QCa^}U*^^SoJ|ayZNQ*TDXVze{2RXlJBq$4gdqxr#_~ zI&HIRRj*?~>w+l}wINpbtXf06pXtfL>r(?2Z2wUR>dBmg;r|XUY#ke4u8w`F)lGZ% z@<~19I*mwE3j=YbOe)sJ0{3(Qp%``* zZ9Gpo-}#hi-esW|y{}Jy^o6D#Eu>$W=~*8V*M|)DvFFI_Jyv_$YXtWj(>=x@ge;eS z{-(b#%JeFtRt0xNt@yNvS}o%Cib#L18yPy0GLqE}j+5_F={?4bf01$6KoR!H2tV7} zYU`7As%g7^M5s^jki=j9@XyEqrUpG=VIC^quUPmk0vfoh0Lah$DB^SS44=5kdPYP~ zjz>)(MBeC$gR~9;8IaxZN$tQ#9>hsa^aE91WOZc3A^&0|M!<`0$VddStpn!(S~gt8e$wo z;T;-68AQP$av>KSLKG0~9Yg^N|3L~3&u+^ z8l(^>sjleo{kn?yWU9{uzy}&a0N0=))<6KR@E?3Y034zMD!?H|u^~i308a5AQV|*& zq7@yY*#gbGz|fHdk$4=3$&kqnp$K`VC)2X6k^jmpxa2KB#7cT7=)fL{B6i8-I?Pez z4M?Jq+sJ5;Dy@W^#nU9>8Y3roN@x>Jjggu{2_L4$vY^P`Aq%wdA95iJbnzb)AqyO0 z4Q}xt=CKs*u_5x23i;6=8^X`d@Vg*_N>1f+-tZWU(R(;yPn4!2Z4HVP%jD3+lElgZ z@CHL91Rc-OR5WZ)Q0OD2k*p?3P#l6&9`PYe5(F+$l3GoD=r0LDv84d8A_Q;%9a17d zpd(XBL;i3h8;RW?dnL#}K>+))l*Bs_id@c0V)mI59bW;VNn z%lb+5;FCMDlRn%tVd``D9wI*rW;D5Fp7mWU#Y(;$Ra4ai%25^k?d_nY(&8>P*2t-4#7lBNQ6b!q!8j% zMkUYzwy#CxAWrv5Od6ydWl|!t=}xnWPC+1>yeC9rBw518Q1wPo_wvBjXKmglP9ZaO z=JY{8P)#n#oU*C=^bANt%1j-?5(e_d3Npu_p&oGzA93sy`>|DVObc`D9iSn{{y`M7 zAPRm_O-p3vl2ap(5&zZ)kpG-!4V@*gjIogrsUf?lr>3X^YkKSyGRk>PEp820Znm{ zyJE2wXAxlkLCBz?7P(6x3k?__Vvs7Xn+Q`WA!kIgsKJnRDZ5Wo)`Z&{bz?!GO=r?n zw1{IHiNa`7NdrW$cur)+Xq+lC(asH#9MxX6k+Mn@RZU7&!2(SOumB^Xd=^zA*Of4% zv(+YYDT~GAq$n)Kjh9Rk{>V~k$uiv7%}>2ZYTYuQYPLzgY!90j;R2*8i^4?3MM#G> z4H?Wr226z>4NQ?Xod3XSOP{iW;$~Vgr%ip7ZuvHs6bWBr?P(jrNOzMk%WO)!PFF66 zX8~89+H^GisDh{x+vaxHwDDbclPJ_STpD!z+?FErFSs^EP1d;(;4ZzP+#iAr3h%?!6hN|kkG&{5s)nJ{MdvbUw;gI`;Ql`uFq#*jolz^a{9J4!H9Ym|GUu=o)xi9vIjnSX&4oConjJ jHF$$LxPv|TgA_qHghhCSNw|bf_=G_?0S3`n`NmEl3z!qY#R!Ue?s9q@?R|+>R)ikw7nU?b5%WW*1bX1s};D&(er91dSAnNKj5IzdKbHZYYX1q-uR2nq<{o`P&p|m z!8_oJcaS$RsMYjJPf(EesVnIhgRXI~So??vq$};jh#pczJ6}2n$m2vrM4Yh4lpNwer!MrR}uxu7uK2TKOokl@nVvI+t$0l5W*pSeRZu9`Rtkyu5s+ z5IvQ5k=8I3+pv=LU_7CDE~{Z?rZnPOD`%z|RoF1oUzMKFy4ldsu-U-Z+R#wiJae;s z<^q&3LVa|j0x$>@+tbR^m52vAPF0X%g zx8X`v&q7yMS84xdX+NjAXQ6PEQ$EZo9p!LFfd|8!m9EnE;g!NEPWd?J!6>I|c%^Eb z(>}W1HM&wd!|57be=x;q9_RFou8)q6HcWAP##dVZd1g30Q=45=oZ+d>);Uhk%zvUQ&fLQK_{#q9I%jHScWPySW@UG7WqWRAcV%T|bdxi+&Y4@^om=0ZTjwmS@2;%x z?yoE?Z0@gY?yhfcu59klZF5#OIqRFdE8F`k+nn|7{q=3m=JxL9_Wt(v_R212`=7nL z|NqS{XZN4(bN2r!=l=rd0304^Vq;l111_xYIoMdet1%u(=W=mz3it#D7&u+qKk;-6Q6x{~7pJ zap<<=c{`TvlLv3>+ywe2=bhiYOh4Y6B6Ga8{(anzufE+qMnAn?|5P9Jadm^2Cv$t9 z%Q|Gfv-A2_-i%-1Ulk~FTtmI+5Mz5A4`ls`x^yiK)W zI7%qBa%1NX9wP&WT2$uKaVs^8fotx){KlM0$cVH$z03vSp$E>tX>U;I=@NJ`Gl$nf zuV=*kXQr=%PV2_n@@=v;`nb-7+Yv`o4k_%WNWy%jyX2k9#if#Ph5yb`jV_}4q?tPm zq`}ad&`Mdn*nXMzOY%J_EKOP-;}~6i#j`Zmb!O~H^cwcAL(#)-UbCNpM;vr&(3jS0 zYv}KeANf!pCZH{C$MMVIB`5oTe%K~t^`^*rZig;%o0LG$!|uV;LV^q~6Dn|C!us{g2w##u))^kEkdYRQkx5?J@bU3JJOT zTKI6|?_^>7T9ea3PijXh9$)S%k)7umC%f$Mp%FS1E7d=NIrf^TpMGsEZxDIRZ{DUS zUkY^|5!#*Ot>WCXc?nx%eKUC35wtg-uubPTE0?|^4EHb{F`VAfYhI{NXZ1Sho>biY zwQ5qK@YC$J=h+E(n48J9z5~yNHU~`oJiqY}g>V0B+i}%>+zwPB+(8Qpo>_lZ4dI?p zJ8t1%IuTy@`v>dzn%$ALsK?gt9f^(yCC_o*IZy|7sDJ_P`p`|OV9lm@o{gt(n5TGK zK6Rmv`^;M_jIDmF(wgWaydD?(J+oUf2@jT0L2WX*b;9F$49mQEEU`2=AECR%lnK>! z0}Foy;D4@dk)|=T-|%Hg^ZXR^&jpZee^g48(!DUjP>Aq(Ca8``HKtz^B=5_kE&V0g8u{=q5id~5Q zPOx}d%U^qzAU~zFsF&ga%cp`gL<=`n_^{nVEDVqGzLWR|;sCl*INsUb>F^z_7xzjd za@%5%-=u)-C?u>Ykq(iXTFdx>pF;Q++8XXq^N^W-Ij}wqB6jB<>_U0kuvQ@Sn2C@3 zUU^bNEnDcPf8y63#haRa?AWesdY(}3(01&I=*U99**NGfo4o|FUn^7pk(A=o2N5^k zlSMBny{cLRU9%x`8@Cc=@mNrr;g|)6D%gOJ)fN+zgqe2;rl@3&=ejfd^zIFC5W!Id z-XHFGN&D&7<(?I%5om&OtGE5u-Zsc^2rta)PxsX$#yhnz;E4D_;{MQ|1DD5#yP~D!R(ER=m;GNysG2Mj!;(^b`z|1RhVU3S zk8H1kP55VOzqWVpO-*96%E9)#*NN)IZ9$8E9{4#(Jk_cpx}j#1)f0oK@Kn?L&=zF0 zeyi@p*2etpZ^P2_)t6kSu?X)Irc`({^JbRa#%uI`z9BoAL_8Y8yH!Q|txW}OnKX}s8!~0G(M~BrD#>=PLIF09}#kp=NTBqaIeLUI7*(9WiU+oTgM8wFsG|TnB}=GdaiF2@=Jgk20*1kgjdVp}r`} z+h`}Yjcu9W4^g-|lboa1M(TKEYsD8>F&U)?>E)er!hXEmF5n~IXN>4K-oZ%AP$rtH z$VI#b@_eYv=&R{%*c8ND#Luo>Kpgiy!|ZBWsE=?;7)8TO;W=Pd*4tcyvWyg9y2=Q= zCv{RbZyn2=(YX6c^dl>t;!)NKGN^btiA#(cp-iZ+zT><~1S{#^=zzrb{PKKBf#pmz zj=!y1928*gB zjqp(R=+AZ+Pbx{@s)uDny>Spha^2; z?1Us-!h`>kWG_Fq#Cb3yOZS>WBp*o>1mLa(vgV!YScG}sfh?@1R}LC`-8A^c&E)D} z;r5@VJOGh7&S5bmHD^U^Yb=DwkAJ>nmVYJ=#BR)Qg}b0*e>U1$3J?KmcW?Dpvp4|^ zQ1{*~$^NRQ_R2|*F=oT$e#H&Oas<#JDdw79zds2GJTRR5ZX7}ImrvS8l2TG78HZ#; zpV}Fx$^2FN_}6XaXV{W>l+`NciFl0RLYSQ)^=uDfj$$Ovy0nxPo%CJc4vW8^D%`Mo zz3Hdqh#`P+gJfW1Apihj!>d`>Z@}m>Zgdq~6i;I$W(}TCqHC_jNDoFpah(Reb#@(QU1@t9loI$$4-Me@QD!+r{g z$&1*y3j5)1PA1W9NwFVKLzet*EU$(wt-|~KVr|}qWeif|m@!KD8!rrRJjzOkPhZa` zhqwC0_WJQ0g-OM+!j~d%Sr1T6_QIaQ0i`WT>vs@Uw;LAsV_@z#2v0McuJDbpG<2!a z3^!pZLHO}gS+KHX)=$X*e>y*wUfq@)^X_^aK3==#rZJIj=>{qE=dIX_sdS?k;Id_E z=`x(@EPYCROF^Vs4Wk_=+p)#hslb&zAa{V_y8naknX;5G%S(vK_fl1Mq%Din=$5$T zG~pk~lL>_sK(8CdLL?XgZ8=AcVpm}FiGj$g??9n$k=br3nsAs4Gsk`~-v*bdjRPDE zv*q0AkfA(-wM>6F5Ll3CSrD&_X2hUx>f!)fxNJKHsT2ulpsqAq&=g6iS&FdqP}29c z>`B8|Vq{Lt?ZoG|Z^{Jl2A~T~h(%b5+eXA&*I>ofw%JO*U`Fq0PgIjEjAUCe$lC-+ zd#l_I#mExtzt9a$`p%cHEOqJ`_h^A!I#qaL52lU2Zo5|eL@m=s{N{N!ypto&I3a%X zg-tBskW>XcR#lZdA1KahyS}v-9#I%s7Z6Fo+<}m99r2GeBlFb2Wk>Ea8evg4-sQMp z?o_LCgWYe0s7d9DxywcVH~!$)HFm19tFXJ^-1|IsOuGKckh2L)vGOz zG2&7lzO85+u0jMWCo@vf`6>nR%0#>TRn&E>OBcr-2eup zG3BUQN~a;$tpIwPM6voW$-=#A-NG1^w(u(+#eM-PR}aO<8OkPel&^|Y!bDWLE@S1? z8@Z*2!*U9MBHpO0ZIPo%_phI(@>8P@8Qs4+7^QtJsT#|rS_lwr?(yTn4^nOwJ*ZV` z%q%mmyXSF(2mhdxH|NfNoeZVm?K>cF4Z{L>RF%E{jPZ90!Fw>WC5_%N40HjAKG%jF zf99sQCGdEw>d11q*=c$^Ptu8`>elJv-x5+Gy#H>`V~f8B0QnK>H#-d(t!?-Bo)yIz zXVZ#emDh@{8fO0TNG&AZgi2K}%kveL1q->AO9qIhprf1R`JQiyATFs4PaZ*uakdL^4|*eKXmwvAU*A;ZhRve3MH#z_Tma&E%yB z!e8T?7RL~MtR~cybQP=V3DC^Wf)|OxCspK6sU?bg*G?I^)UP);%GX^_it3e=Qe1n` zIA4yL2AbQV*xpG+GoXCdgRFr3um?)y`bSw0%-H2itNC$B^s?gGD1Y8elPAkb z+0Zj>HDB7|Fzu%Mm`*aEy`oPI30W#`y@09mzs%cC=IhM%dF8|#BADkOA(c%5b?r6b zobyhDs$Zn4w{P*?Qt)XaA-A#!bP(S%IdFobA=OR|($C@^zS5+&Sh7IlA-4cmiWN&> z;&;Wn280kFF?!xoho5FycO8GRtD(0dB_WMC*1uI!LUpWXCkTe}#U+cXQ;|EVfeU0M zUMjaBpGr*`za=CsLzgK;Vva}q!`K}r&HU*Tp-0NOiXyvfgb;$)0N$-e%@RckO}(JY zVzPWa3lCJ0&iwtn`cu`4VTS#z7Pw@4EyW;~^Uufd(z9U!9-ee`g)a*m9La`hu;fVBWFJ@v9qxcD5t^ zd{XoFOL9o?78M#n7SPS$oxlhrkQV=RE(nb;yvIWm$O02ABb7O%+Sx_+SDS!8K*pcx znoOi~1-N4aC87HMX#Kg_W5agPh2t4ekJ04`MS&7L^yJxPj*Prp1~h7vXS?k91P2gE zV6VpAVL#C83XzAJb*zD+K8n2;LzH`)Ca-3m#yUElBScod_}wc2_qyh}4bo z;N_9g^@qr>1Q#`c|!9i%+t#<#Jf-wcr*t0=HM09nQIH_C6Bmu;_dC|hY%csv^x z#o{*p#C@aj$oJo0bLPH=mhCh!1kfIufMjq)H#q<6f)`2_PI=fr9OBFem95$OJ>5$Gmm^X$zsdCP)7+K zivwtxd_|jQ78_4|(_Uwz_O8dR$DWgAI6_-U{I1x&m~(rHxAx@A_Szrqg&6QAV}F_4 z{b9`EzCnfOVtK(id|lG7pS|7J}r318@Z(e9K3k`f+8vo=s_;mv9R zhb%khYU!A2=6|z+SD25AP7psM%Tw;5<+p!SzdmUiukJ)IeCyqehlvo!C0#e%nlHZg z;Ok#!f-Z2)A}7Ph-A7MKD60|Mwl>aoAu z{x?=$a>3^4S!qH5-+w!!leLj3-Tja6a_b`Cg*AyXXIeRz!qt(`YhUuuB|<#P0(?R- zgpT&d>0t+Fgm?tA4=Fzmm$=##x{`JGXW;hZa_zVR0u!^pe9mt=S6#4&u%CW+;@+<1 zL?|0{e^KgZAC5`psowuHRP9yw@FRD-RYQd5P;w3o$+{=Ok&RI`TDA+_H14Y`4zN_J ze~f+pwOx@nF^q|@F!f54N)W0UFTP}ErF!Lr=IJ$e4Fp_c`20f^{9wonsklB>S=lFO z3PuKrJ1>>~5sR|G{K=v8@ZNn+YT`SzlxZj6Fh6P{xGbS-8t1s7bF8MaV)#~F%Zy4g zUT0EVjP~k0o^mnTBGd1P9!*!n1m&-q>Vkt`xEz)=0Qe_XVraQdv(M%Vqw#|DbG_LjQ*TRgW%=m7S z&Yl|5{m3736Ti5(Pja#1yr=jKbE!#1;>;q~H0~^g2m92$Xwv^CVnQA^xVIzfe zcI@IczLHGNF3tN%re4ZRGA)*9N53}MBA>`Q;GF$)#Teaxwx<*v%zKjiWQk_GJbQK=F2XE z7yg@G#2HM(qJ5KQjOKkdH=iun(BnTA5foDN4$o8d({7y8T;*rnQHg>!vjWzF)rQWR zAiJgHcW!Am5eGazvNEf)xG(9XjJc26WOBR$@!W-~@xP_p1OwZwV8P|Izk5l7_Vo!8 zvy$?mlj~JsB0;I8_yqa4U3xZS{fJ7?CDe7$K1@l8rq9-cF>S61DTBbcj~tiggb`Hr9grp z#LgI42UtQhkgOBQ1m2K^!KWzshT4`*cVe=aMGf3iP-t6z)smBE4EtO~P zARR}p*tx-zG=r6On%FSDEi{jeOHaS4hmxS$)&=bd@{n(M!gUYbTYLR)@1&6zKoSc~ z!Fa<=TaT>B@)lyypmpXsWzHoLb*Y=ECXwt zTYTtJ8s~XDSH{7|lq$6gn#5catLR$o1Z7$JO=T>V5^6=~!?EMT;gyAXAFJ<=TB8gD zx+SH4;VoyxoKg$q@2$t%$o!?*xn~NWj?slQ9R_%=ihyOea#xQX1wpU>>wo#Git3w9 z`DQy8MN$KO2=GfJ(G5%4rA!->)H0F|Yq9+Fl0U&M&yhZ;BSIX5pY1`vP4)4%kYM$h z+pXv2^i=aABxyQ-<(aZCPb!|?QbZBSG&lgdt7}yu^m9Q(?3cwULSC{HqZ@TPo*)~a zMdQ=P)6^})i#e@Z{T_GZGc9D8QIeoOk4-1t2G{t1U`Y+6qZ!gDog~aSFPI<&H5 z^iq783d%Cz4}(X(fXeen1c51IXWC%B8zMS2epEZX5Xejrj5QHel%>nf3;k4RA`e`! ztN7@5b?QQ=An}j?)z=?XYujO6$$HhTldj4DzOrf4tV zzRCIvjN&-yW}cbJL0%*_Nt8bQl27g1HCiTo;5{d00K$kO6_>6x6O|b?ut$xn3R{^ zpvqS&I|LZYkXbP6W9CzbQ{l4AbCOwB-!lv^`TltS#y$$l?9b{^#x33dd<`Oxe3Ju5VQf=KUG4#zsIqprh7W(gyl}ZsdrBxow|{d^E(DI*4+II}i%%#+ zaf*G*r{4pvT+L;ohn#CKan)R(tX28&N(|qx%(E(sfwik?UP*}F{B1jxOc3GolC$3c zbkxfdbp!7K<8#+%j9~eVdgl}CVY6QpRxb?Q`-8D-gj3+=8A>HxVh=9get-G|fks!J zEqpuj#X>IHjE1!kIR*Z31JkV&qQs+u?f&|6*Kl5PEMm$1$L1|@qo5EES-LsDV2>)R zN-j<@*TnmK*sb><>5x8MI9>iKh4$G&o?AT4jK|DB8Bq;f5TBmksr4Ha@nmr_m6YUn z9~&lMF2((B`qCwDwq-`}#Be9VKke3q#BO@OK`jm3`6V!XUG8U>cwTCuyvy5z6}ic4 zC$L8qyCwd>VIV+`36Tv1@Jb&aL4l2)KPVLS_dJLy+!iMekRd-A=D!$8!T|7x0l-=2 zf5To70X(SQ{O1w;A7Owi+#Dd$xnuBAW#+#%mZO-slK}JYkZcZ^aeIh*cOv<-$DO~|pyKGFI8wZ~YPN!2kD^tNl2wm4g`2iT14w3^ z!J~-jE-U&YleMN4w?_~ZNb*3i?YhLR3Ai5i#pV?dPyI?6*)7+m z;2%f~N&id_dX>z%gz?_EbpsDSu?PEA-keS{SaAZ&Vv-vQ`mg6&OP0atsx+Rh0iFU{ zpi**l8T|+fuC7WILJj_lGUQp0DxT`uLP&3G=UgHTEH>)4?!i95f?+CiXHU|40J*UY*2;D;5Aw zI0ldZEAZYh4?qP|j{8tv#qDu7*$)=C99KuZ;@RUi7=cL_bp4I8_+!I zR~>B;r@5J~kHZhhcB6%00F`j6((akR>Ir}PaW~UxPuuq$uXqOSK93|EDR87`vZ7IN zgg)4*jkGwD5Vyq=${d|#wCC6Ooc3Bj1FroG$ zQcc$wCsE__%Hs<9xu4@T3!e<_T+=K*RG|u`c*8q(&Gzyr)gWH z<(O0T^)C6EfN{FxQKsE&$%J?iVL!E}b6yK=Khg=9w5L$18VEwdlq!byWDrE4x+>;P z9k#UNT#!oMBW9;#Rb5#_jkaL;;K_g(S{#;pE)&T4h@->biY>oF{ek(A-{&tgj<~tg z+uqW!qpLCR3r4v3XWeOgiAOTu)7IV>bl4jBFt{nu$E+r6p%aUZ@p!f(0&CoicRQ9& z4<84oT%Jyn8Bcy$p(PEX@0mV)1sA=bJNkM0R$jjm>O+7haphq6^lSGL&1~D(ypsQE zN#*fNr2^V6D6V29vSX9A=_ST}|W zFp=}xTD=TBDdMEgBDL#VKA%mdY2eHgGGW5T6%&SCjGGS}CgEi?O4}2kOjw^8l>=wf z{4Toor$mIKT7i!;rJjj}!|^p| z6U)4;o_H0Z46mvt&N|3{;yP<3dKNa^k}nTGgwJMmB#&f&RC`hwER%dASztAdvf0vFMaaa=mSafK*%JRJfO{9S6g8oF%I=5WIxMz26?&7(h7sns{M?g^!YZb6R z5%3O-!&4)|Q;Zexcgj^H*|Y84buIFmXo74(Uy9qzo@IVmmYnNzxbes_e3@2i9b2iB zU1wCnhfE@qKFy`m39+C4b{nZt5aCzsCL`dYCQSpjXKFVR^-+tuDvSEm1Wv3poDQA+ zBn`hEoBAwbQPR~?3;8&3;)7hF+mAqY^!7b?Tb-iyIO43XvTPv*Eg9xdgJ&)XWR$11 zOwozuz^S=#_4$GMbHtPJ&-k342cBw6vo$Dv1%A!N^K$rP-lAg52U3lxEMgk>xlj8a zbAv_oOaXLI=ei%xcK?D!Z_(?9itO1*H>gPjkEO#!54hGU=*bAy1$o;iOKw*G3e~a@ zKy}Z1wHj!9lzb|oZ`f02!bLm#^Tm`Bo~ny{Vpk z;W`+s&%C((_9C4K6Igf@6TCD5Lrvps()Cd1YGYFU$fHt2nN z2MZo93AxBBK7N%DU*b*r18WK#J(1xk;X3G)e;R%2OB@bH%H$=H*mE>Zp7qrB;3=g! z5a>!x$JO<}?h?ObGWWJlq`@=Zot5kxwLW{S=h@58t#^1iB)3GV(fNU2cVO^TB!wo6 zVwgw4#~ir`ga4*#kn0$p1n24r+0UK9o`%nEE2Md*zlI-FC1#e0)4KufI+)3>#= zK`KKR*R)93Z*e&CN>(*_DVZDd&Xpg4;y~ib;L6~sm9F$qGVC%d$=R+Z!7l0k_+_Qi z1<50y9rSy|P-f4cC#N|F6kq%N{VajBmvNDjiWR)|#G4f=sz*I7E%f@qTU(j zg>;03eg!hDombALVo;RB7F=MRs;UKm8z1yVR(=na;iE02^Jg=SZTu?Ri7FVvf3Ei; zTu?v`PU5-plpG@LclqfJ$lNHu=((c04`j(vLUi$mQP=nlUq&QsTO}gg0g4bucMIsT{6NP&YZ&Di> z?~B2D0)Ptz^r!0^037ADUKfT_JYT_2V(Z-=Y?{bz@3~PEEiIK`AxUuL1IPYr)G1>kep9{{wv&5_+~xr+oQGfl$=kmAsb) zC(;%SxPEg}XTxYxD8?t>WNsYoQv;cUL2!Gpl64`S3*My z;GYs}*l;v0(m%ntjO!ZlY?>-}ESpQAEumU$d-F;{Xr^4)Y0D3Qa#|ar+p*9S=68Y` ziDkliXShx&mJDTI6B5jNa`iH)@%Qs{i5J^`wJ%Q#W2kB<=)vX(HGJ^f8g`u*fQ?GB zuVIi`Nj0}EV%xYBu!i0M=-6oViv0Fzzh10nf_hzYa%PZ^?r+Im=m+A#lSrXME3+T) zi?l&l0Vks~>1D~!TWV`mj)xxCzZc#M!vvfv`))`=UaAqbs{hd8+U%HNfux&^ z^BHl{c5x>S!iBR3;0JG^gXeO`Z_Q2IMm!NnI%CLX@Ppg%nlml=&(@aEOl03)Vy5|C zyg8lIFPFf~rzFYF+{+?iFNE0@%Z!xXmM ze6|$3k9pZ=X$EX74d<$#Znihd=%?`={2i+g_@OcyjzEqG_8+z$39s=G(z4UzftJ|a zJ{%N1k&^;JFxiOJl&U9j&iKiZpUPIra;tx1`Aw$OW{N7JO%Jb&Eu(F!Q2;<5a0H;* zZq{L;cv|JtU@i{*0Ih5}LfBfL%n~0xZ{qG`6s>vSRLLGGa^b!Z!Dd#qI7|@#m8&Wx zE?5ix!-lc4^H}pSLZ01Q^;hI=$Jt9g|J^;^c>Z#}%+cookKU=v-LyTwZZ#`hEvZM5 zzg?s4d-t~LIos*x?p|H}?pM|iN>xx&_fB$$pu&FcX*xZ0`LxjHd_w}+fgZ>n@|#>! z_;h)T9a-kE(?ULT>h!}&gy{=ZH(kAJ44Ojm8x!$_pTpFg44vgU{PL{XkVdew3k#FTnKO1y$^?d=S51APLD6yOW*Z3uolwpJ0%XpP0#m;Xtn3tW9}AO zDBJ3T3x^dJ9>RvpEHa=qF&*q}3G}6@rFY;Fz8WFPy8+I8_pII3YW)@Y=1<_7>P3#@ zmZ%cd1!Cis<<5;~YoP!g{oeq;%ttaWDB^2$uSjeEs-2OLG>UMauHxY@lC1K;|Nd-w z_UH}u5vaQPdM##@qz=lXk;a;rz(CnBH<Kv+6?R@gQN|v=c@UQ=wJ#S36OsSJF0JNz~osVOtgfBg4+HJHuuX-iKW6hTV6-*dB z@|r`caZ@}Yzte82GFXw|pN)V+vHfzu(tpW{7m|x-{Vc8OG<%PUFJT9Qzc(*|0{ZIT z`Y}h+gs3pLB0amiM<3=65~CcThqg0&x8t=Z5I?3IxUvTN`uylwAl6ZGPX!d6h@#!5Q^<|8eiSsB_X>+H(BAl}@_pfblfWCt-_3DJceAr#QQ-DNnfsN_ zoVN@d5ANB>r=^Z}tmB;R)k&okE!73NY6u|u_X=29)l%m2rHOqz1>A)z_>eK@KHRW8NlQpTJzgM`GlY3|w$#OMPH-EY`Uy7@JkycGpj+iGR{J@P=@-0Jgu#<3UBel_tU|7JdKeCAUU)ABXi%4O%? zZpqDJUAgZx;c`X30Rs?ENsD(+?BnktiCdqf)Ij%Ap@YPdC&Ix z>n}a&;*l+*w;ia^TIHcC|23=F-=i5M`elpvXI}V4SmA%a)=zQ{LCoZ+0B$_ZwYH8a zC#}#p$iAe%=Y0Hfi|t(`6B<|(pT?`3h?c182)&vvygLXLEP6(0X)1@J+g8<%qmJA- z&o4TLUIp>0vGRPa(P4Y`C}gzov<#Eyp)C&vjS{v!s+p7bTw3t36Dzg5pu>Jwi40XIz3j4BK5-I$K?e{s1bMj(_;D;`;Qt8B?^;;^PCJ+il-< zHzzWs?3`xmZolT547;Z>`-&GLbhrCqMB(_mH(2jBHFt2V!*Qjpe*2Cc&){W$t}cI> zdk@5kebG9I^xMG(T@HmIlqd6LIl#*YGw91P=NWF&6%ic|xk@#?IVQ<(q;cKh$6gvN zJ)o}}|HJ-PxD#!gA>(J$@sf^T`9+IAR)E_=SCvufjTSCQ%yggAu>^y}twOQ2ColaA zHQ^oKXC8cB8z`LD89aDSP&lX<2zcDw(&nTuSo3aBBc02T916&g-wrth^!X_@rvAF= zsxMT-Rr*{QnX zw>r7ubH4*LYGUNhIzjG|XXHa})BN zz#A3IeZSuy+~KS^Nq--vs3V_eRCW&)6sXemHis7Q#h~JQ(=j97Xn?z{oXws*W<1%k zkPt@{xH1(V>(Fyk;y9O3&((B|y{uc-`3mY1IH*aYWM}4=Gf%^EKcvN5@Y}`#W!f*6 zbqkulVm69bDhgk=mNGY)>yz1^vCo{2f+H}d6DiqT7g*3Fv(@e*P>!#s`{7qbn{Dp$Rmk7QAxS6qw9QS9mMVGeYU zVCnH%Vme{oLjS#e*o7YDTFDdrW51s25vmUg7)?r<*I=oZg8rZQ)Z@$ldy|a8-g~j| zg4PuA`ubJn-s9R*86#-}g*rWy`JZ7b>N)whp- zC+vzQDDv^y9?;OaeQ3NF6OIV;Ou`f_eB9%+tyi#(p`+U>&}+vvh097etrZ2^ z+={NU^R@@)ZIeN>BSdT;L2{!H6vLD?U4ScRtE_n-Oc}~Ow@}7+j6vW&zpcDk#ZDh^Tt>+L_MlB521Gf2P|#%|+`_4=b~mgjC^hX;j`FYW7b8#Y^Y8k#0*NWlwoqA zJ_ZWi)F2a#l~inslml9)HTir|q+WwQHwDubP#RwGW3NHWGO3?__~XAcJ7pURgzT=Q zwSo2OA+}w&kBc38^tRtm+QJym_>vW`bkZU>cS(?KX=+bMGgD9(ff!cyq60si>totR zuV$869?4~h5f=wfRa{%oKXfnyB6b^N&irG*@#W4g)>{~tG4x5kPhVOd4(vVZ309P) z!hL9`dHrL`EDyIqHeb3+s;<%dPb&s~0Q=K?MrCa&mSV|x+fXGm7Gh2&=uRpJedf^h z>j}nsmMG#P$drk6lSvUu)==#YTAw*7;+r-uZBCl=)5Hr$K@6cvc1m>A&V>?v3)PRk zID1IOdDk1k5OXX9y;L0-;g=hICn$r~@X*@Xw^n)kUnGEG5Je~5t?CN zuYo;52lZL>v!$+EFYaTnvUK;I22Va83(L9M7?EBamT@&yH1$`2;5Gq+Q-$l%P4K<3 z*;WcCE%*YLuFG^w0|fJWh=CrY;7Nwo$#vWTMBkGxra5zU6HldIQZRs2E7U>#yK5^h zndO5OtuGq~GV;p1ks@bqW#EOOVC+FJjtr>`RlV0|sRP$Ak0Pj2Io;&^N^l=uR7B#j zP_h;oVn+FVoeP}ieEGnPA%YD+0lmh20mlKba38*6cMUL)$cC!FgYun;V?M-mF+-#av>PUV5q zB&ILFvI{ue2hqSTfQj8LGl6Mmd&s^_>B?T565)Dtyi!@WP(70+q&1d79pl~sGK0R-l?}Ea8q%N~JE}0M{9C?`!w6ku<1<(qr17!W zC-~d<_jLU}2(~ihmTb53LEW#J`a{$ZTVLkoe#YSzwFA4;n&fIjf7;eKb9M6(#N16W zO%33$-(tP9zF6&YODvgS z8b!chzARRPtn#q}_l_A>f=Yey!k!$kng80O9xQvUN6%ATBkB0A*DE;|Xoi^~)e; zJ`aZ0sj?dsN!Z~V8(?(h)^%Hp->#ZE9gQ-Ob2@Gi!ySmWKTY2JzF02(FK@Go&M{+8 zx^R?MoRXFqPQB6~)OXGD2)WmI2ZF7qA+fcV(iWJOuPX1hY3N?*w6*J877c$P#$>`_ zGL{ckSM?Wi1ZpYl`5n{(pv&%PnI9S4VjS}CrtdxEC0Zzw2<9gPv3r5<+rhH82+tFH zn$&|4M35livGM6q?KKWfSoKIb4Wv=oYer${D-rtX>gx5E2l^pqZ17Og#v*&&zu~dP zJJ!!C3luffevK)q*E61dc~Y!bu-Z1+6f1Q<4)z8p<+#{(6I<6Cp@V8I|wr%Ai{LBc7^(}{= zs_+vn#+`f3`yekpG%I)M4(9|NL+W3K_TtKV&7&aLk?wi=jdNnI) zBDovu6$pM*a08felEWw(Z_$S`M5lCVZt}8cG+#DA9FilZgc^`6yz=w!$M4e))##r& zarNMJkFqK!yrVgo8yzH!($)YN4GUIpU9}AC9|j!%>TmwgnQDN4)IC3rcPW01th7)Z z0k1e41i!mrJVKYP1a%y~`lWdjfeB_?M$F4b&UYDH@w-a->5o7MNmg2TOoRrXj?CZO z)zplTl%|dGhKI!&Mo9&stRgWZJ({^K5%(i8-{{w#{?r_?2p@QE#Vw4(Qi*=6@1vg zE$OreNQC;hqs2FnnzCQ}*5m?|4>{XmySK;JH`utfe>=ICySbk`x~IFk z>;L#8fw#NAJG{rcyw5wm*So#nJHF?;zVG|I6Q`3M=ekdMbn_a(2fU6Ce5DnTalf8HiRlC4D zO~PlqQr3A>bUIB`I)2!^5hV~>=zLQc`Aw7nkjMCsbNQ7hLY*Hu&&Lch01=^gJ8ql2 zZlOF{r~@Tj!`8%sGmC~O)cFP~1pp(lL-D8lFidFk`~>C=3lAGwQ@ z{y)q>(qj`J-2UOyMBHn8O^CP=Bz=eTex0X&(mOp(l)&24g!1Ef3GjZO3%~WV{_gkw zKb(1;pMlUxc(1$%0 zI6Xkjpz?1*u73o-Ts0@TSP~bs>2OG|qc#x0AjNcai%k>cB!2%Xf{yXz9 zB}b1P35q%>6Jx=WDm_xsIN^**g9QwN%;*v%!+*#|T6}mW=gyx0fF}L-?f+&~t5>mR z)w-2y*Q{yMcojR=>MR;sDFLytmTgt zl2Vhh-mJPH$QgX7k`+Fjc=3{8jVHfqR_i@VQ{YaCGo5;M>({YYC-FAL6lYc=OUCTl z^eUyy(O?;l#?rIEM?-s}U_Q@y!%g+)BuUG9##f31+Yjq|D6g3$qE3 zGBOuK3p+!w@Fnn5zdZYm)(g-Sw3Jd!rGR8c~2a!9fQC=w6Qi%M9~ zq=Qmr)m5GdBJ|ONJe{mET60-RRXUMHcFttQvU99^?t$~JBZ%g_n+^)jy_9k<+I+xjZHCz_nt(=|L-h1)QSKod0mH(GtjOzVY;DHG)*x-Bp z6*%C78E)9&hatWx;eQv7*y4*Z&N$AA`K?&vk3kMuWUDyd*W-~#zZclE8uC~O^zKJ)k(v;MpfQM^7b$$c#WNCb@qNtI?oA78Ey}{!udFbQcE#~}@kPJr%GY+) zll%cnR`wASMyMbjgE;S1R4GC7NHW0c5o!hi098s7D47M8&wU;8Tfv+r3f%#KguEjm z0DQ-yte7fHG;$$to&uC_kYt7s@km7~Gy$5>1Xz4g%?zIMnBL4^}lPwT37wRCS64c=gLT=$bgft`@ zlz@RilF$HKP+?VOFay0{h&?t^Q=86En8TE^ORpJFU_|x3(HSN(&Z|+YC{@Y03Ix%a#HTzp+9mj|wafsu5+^{sRhwXxw~u2N-~4HI%b(rtcT-313OYlrL7i$iW8an*xMXL5%D1<;>rj<)!9)ow`A*O z4I!q-_B^0rpB zTGb4!q}xOGwld=B$*ES$Dcd9}dwio*PnHQy$xJV>Z95-LR299+RQD!un?Mr@r$FEq zFqi6il@VXHz*`!3SnHk41U0fL+y7uNzPdbBa$1Wl+`$%3iV!PVjia~~3MWJ6Y%o?7 zJiDx@Yh9^v&q=0cm2jC8D;pMz>&B94ZC_t$2thUGc$C948gO7->?Q zER78oV>rzi$36D(zjXX29{-rgMeZBJhHPXdFPTF@K2egH9Azn!#mOIn@|3Zh<*QVg zLs!=Fm$l604SCr(%fL!L%nW8VgG|gIIt#zP5P~0^qblcsK?uIEW<6u9&B`G&apEjz zI%CAnA;5Ep(d88z@0rnC{vg5rJe+(4dd>$a^r5pdx55Z>D~`*`8JTs4r~InXD(iD{ zA}#4382ShKxOAS~2Ak))>Hl!S@$};+7rE8us9fht7q}`+#9miL#HEJuqX(Ais(=C% z%Rul|&arAaOZyAYZV_x`ViWjCrZw)f$q>^AtXHiTzujXm1Wl5>w2Fr+0R#>(1xxy>M*0cE?p5rhCL=pOxis@4DpPj6~&gE z;uFaV1tuQ}$x#H86pRzZjf}l_!A@}3Z9&;OARX&byN|NjeJ(2e;h2W_u4mj%=<8Mhy+pHifAe<;-})0zaG5_)jUy4K;9 z^5UEf&C787;~^h;$v^%JVh{LDCT(aKVDT;4QUH1l?*XZtW0{i8wl6gVDy61D#o^iK*dhIgGxC$wabGH}G%5lov z!lJKnvzsgYIrmU!h&OwQWh^P?eqV|wjOH;!ZRZ9q=hAHd3{Y8i&t(4ZUgAsuZ(gaiG?Vj0kG;0lle zJ#a%TkSs9p1OG|z*pO@iOE3kOCIMXr1y%3`Q6>b(VgzBZ2JJ-#o5clfa0f322fcy@ zc`yj!#0R@#VOHS@kT40Aa0!{P37zl>ov;fwPzY_12)SZm2w@RYVGFsi3%&3Q!7vQP z5Ddvc8b(ZH7EM5CO#i&%;;teM--N{Why`tC0kd!n@h}hd@C(cEYr>}lGE75|A#YA3 zZTR4>;Dyxo<<^EHl&D~8L`|c%f(pJzB*a8ma)eSuOF68NUhGf{_b?Pikq^!ADjo3=6C0hy$`X*>b=+W(d#Z-=kL0%3VaU%3eDu9TuYO2ZT&}TmJ8c|XYv#}~*5m25&H?D-Y z+Kob<;u)8Tv9@UZFk)&r>aU*2NCd+O>Mry!B!RkRnZ(HHBF7d#he#Huh`gvLut+9^ zBI15SAsB+9*ofr3L=-v>CUnvz0Yz@G={#=8q7XtI2O^7Z1+YL31WU4MPBJCwG7ML8 z`u{j1I2dC|TthYX@>YJgI*uNqFFG-~@Npmg1B&AqNbZYW2E8~_#!6O#4F%|2jzzNi(;^!ixN;s+|zvx!% zjyw`*G-+g{PE)2*vn(MBJ@kk&{-f$n#WrY4E#Yz+tD+itlQ(^HHQGiI?B*rO(tLI! z^caP--s2<~3$)6Ult6+xRj)Fth2eC~Dni0a5a*C6B&c-6Iv;{2uxPJ5!ss~dfB#NG zuoy=w!ZV^^0~uN@+YX25U=o{rgqtul!vw=v=*T=3>KNzKXms;F>oPxAV^9iXjJlC8 ze?@#mMI!to;k-mwf~&r6f)W>nIirsX;Ao@7hcDi8Nkt|4sOM7{#X4<6-l9>uLZzin z>bgixG&h1$+K2k+t6Zq>Msp-m5~X?~V_Rx5Gx8=-?B-N3QyO`c8bQ%Vf3y^{A{h^l z(|)nTwt^S6#Xf@RbGQOh?~f}KOb#c^D~geExS~^sV^O<8Q>hF$Z>L8M6(xaGLm2U1 z2$2f$jXrO}K2udy5%oma5LSDv6SV>h3$<3SaaDD-1bH$?)Eb3uW z1%^~1Vk_WqSm#hyOM+IB6&r6gRJ_kC0Iy(1@+$O*z9P|Dh00X>2vxUr4_8$oZm%KE zz;vb}Ta3U6a$!f};|zERdZJN4z7=3Olp*qUYA)jEc*rsG^~T-*n z(D8drMMg*hBPdEI2Erle5hBC`iXK8}FJ*rw^(1B}A~qCOHU%&X#6P~lN}eQ3UNf3P z$$WD5ps0yyD~u0lRT25m*$ou24x^{_A)ZoK=jH$Q5SM0v`J?GM_OVp{}eOOG9oiy?66a3DlqH^X@tLKK23FdoD<(2*lvH%Mt>gZ~?Xc9ldCWCDwjK`Up- zicoKg27>6~moF%^erv)(8W@Re4=RGnHj`If(@6&}Modq>1`#~oLsXtoQ|P8Lrb1K%q9;t{cp~u|u-G7~_$X8gGYo?-f_R95 z#WC!rFglX_`nM#25MA-uE9w|vd^nH&I9c}iAny2&3Ari)`5y+kkQMnK4mpt*nUEW~ zj~{uGZxdT7`I0%2hlxs(F}ahsB9c8hlq-2qMY)t~N0VKPlTF!_8yN(^;+0`JmSuUC zX}Okd`Id1xmvwoUdAXN;`Imt?n1y+miMg1KnFdf9SsM6Z4ve{(o%xxeIhv(;nyI;( Nt=X2lfnfpy06QRbT(tlI diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainnag.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-domainnag.gif deleted file mode 100644 index 9e35fbc193b37fb4f3e85155e26f08ad2fe20b14..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17902 zcmWh!c{J4D8~)5j%&A7}iVd4weZ ztha=O1b{2W;36b&I#Bg;gjP91ryQeGj>1=9@Z~x>Iv9Kf!l(v^Ct!?fgpIQBcs##R z1r8t2Z&o8=R*E6C2wOF2S$SivYOsVFCICnf>SYM^3J!$?0ztu{Ny4QC??A@6G|9NP z0RBuS24mzNqwZeg;^KmHZwDe~&D`_Uy<4=rTXeiz)cw1>y}fn(TXcde@cu0k?%sr8 zvQ}shG=a$L>(_N`)?2oas}!SOCJ#bz-*gqY5}V1GhLwuJ* zd=F5{Wa{X+#CN$QbXg^jc_&vO%9#Z6KhWi!+{07O^iS?_$eMJ|>d`7>24^+-XAO|a zWNZ!7y>LDvZy+zLJf?7@g&gW%x)@Q~l~6oVTwI(`I+k2I=3T*zsF>YPmWZzy+ajwk zXX%j3$Bf#U5jE@Nipji+$@u!kii(Qjny$i{$@r$NZ+f!dr-ZG!nxt`U|Y-wpJZ=dgMX^I(OW_2CZw9mJ+cNTW-)O0S^ zch2VZ95r>0wRDcucP*FpFl%}io4OX;yGCky*2!bcuCA`qfur(){fdFDrk>^E5oY-S zv!!Rby=Sp>j9EU$tQlbz&oVnl)+;8NT_fuUU3oQ=%+9f`uCeu=vGw{{X3HdVY;26# z+1WJ9tek=d>GMdsM-*8J?`$ox+GGP7%u*|T`m zv&fvB-R< z^NZ{IlUvNi^@H{G^|2l1;?@Ckd1P_xXmN|Vymhd=bu_=jT;Doa++i;N13L%nJ4cKA z{{VAq=U{8+h`IG|gQN9*=JEk^YoEEZf3&~9zjJW3bHHTo@9ZBO?H@1?4w(B#%!4E5 z(Z6K=KM+jd*NZcTG-`J$f?LjQh*r^?ff2VTGi$Ew&*4`SgdRMu8Z5vXW(%9QR1e>f zv8&%M$x9x%jq@ETGk;S1xz zGmo5~Tr&O@{pd}-{mX0-%l44BO#xGXQIFai7oHMrD)TH)ODuH8ecNeJ6HgPUF4L;0 zHhnDq;-zdM@ngMR_~NsCam$0b+fxk!?D;U0VgJ3Cy>dcCU!78=)ycZeNWtBSuX<|l zwiHY>eN9BV%R17QQnsH67>QD%-@W_qo2OD6bCRw3F84+fJ@EVA!L^p}Nv&t^yw!DG zeK#F!lgd1G|5gsMAVBqW5Vd51r2Qn;FvBzBhXP=>JWlP3yOngnTs`r@(`?mrT%ok) zG@BSCSCft^!xp-DGY>T^MPhQli^Th84Svk*>DaI}?;6p6oTRe>&% zQ*@M5K)YC$VYb#P#Z?oBhn&0m#`%VaBI~Czi^kb`&ydQvd!_H2OV@7QU;8zm7`)?L zN6r2dRcp2xd?;1!Jj}XTZR8zLnlIVDd6G*FMRO+J24Q?F#9BU`QhgM`ybP-3^F|F@Bz$CMt1FiKgcz~wtJqB2|D`sY-h2WKv^=T~CLq|RfWNEjN2q3(|; zJl&3bg_vXX2~eK*6gWOX(dx`nj?w}gPv$60b{_>mh6SwWNc2~VYF@olHW|qSCkT2k z)TiVJb<`x@nvt<32C-=XXZJ3iyx>kENgVtmeF-=XG;i~?jM*Tgz_%9NW2$NZDb z9`x=boA#+a$k@jW%POtqjGx~oG`og4)7gb^FF?ErI=wt85#w8uVtX_CHjrIexoTnn z!fDmN=LI6*ox(wg10yym?Pt@|QBEjC(ay_|Kk~5UwcaL4JWsW=)plfm^z_%`Z?6U` z+0-XVQ)7A)hpKJt&!1T7b4L-Qr*nTdJ5rM_1X!#plx^^Xf0vT~R8wBHW$}J#d&0B- zVq>(scSe4J&Vy}czs`>q?962O&NoDdsXpfGbQadDynyJ^P(+YR_z5lQfFEt$l3{x) zsruVFm5aN^_8@FB-zsooOwvo#2>Ijx6`JDVhg{kmt&`%!GGTLwh8qD2hb~CGr zNQGW1EWSu`wFK?-`Njo=^UUoeqF7?BWkpPD%FE*y6vJbZ5$1Uy*?!4aSlhlI{bp$3 zH@#wh&)0aIXn6Yh1GLA1=W)qB%zbw4WsRb)=uO8dil}uekghT>CyvK){Ot zDn7lssy1jo_Ni3t&LKwpRUNh~F4!*U-6)%E9ENVNu_D;F>v!hoFmv3tEGjc<iFXVHHjn8e76e412v0@q+fy0qoQz_YkNiuA z#>P&awm#JmJ~jKduyyK)`wKfiWaum5&I~}Fx+2)-^^o8+&qg%zMaowJ5{WTW1#8m^ z)eIRB|89CT!7$$N^(EuW`s_X)?69Y_O;i0#XA5tw3w*bKdt$xUJaqPFcATi=4F`v~e(Z-`R?0Kyz?4|H*5Ba#fL7UkTRSZZAxj2!$?8;06fRqQpVW8){- zNmnDh5D)+heAO_LP0MllaqmRe*Dnnqxkny`I^eE@@+LyoME>dP4p9$8=VIKtH#5nZvhuRf*=?exeWJ;tPms#iv8o);4>D zK9tEx!D^RSGD>AP%;Z_}3vfhlGwnic>?K6czq!x$3R~wWVx(sul1rU=%^;Fpj&|-+FeOL+UjEi)Mu0!NvTi z&r9DRi9_E08s}gC_p^AX(yyulO3+u&RQZ}BR2JW_HE`>8htkE=)(?14I{wx5_0)^+ z7TR{xx$PanA)3bn63HDlxMp=|Zso)Yrp-6}0LO2PYv=-bq4MP>=%zf-X zOk@4dktcG!Sl-S1m&p~xddykB_b1<7Pe$BM#NjUoPb99jkVGa(a(1lWP9*C%x#>N13r&ZN7+t8BtZu1NoAf8}f}mk#Z~0X;S8`L!U(k0YUPzj7v9sLbfbqPxuB} z!N%W?%l=bvf24s9J^pYaPnt% zw@hw}GtW1|8KEWiTCM!=hlb4RTjpbX= zlKqp;D#y(V4WxKw!p~qKz64|u9ty_;Qk23!H&NbHRh2=5&l{YZ1L%Za$P~WNE)%W* zc%1wX0G(#BOa*x`G05M3$W6i-$z5J{R@u#gFa(yPqa&sW1Gf->$KeYqun;*lmTx%p zwh8DV7QIeDOSShSPY0 zD+}VwIDn~XQWm9HeHjq`CDo)<7Y6wq>epGfDN$y}zXQ|*Ns$SfFjeer<F=tcI_Xp%3v%q4Ef-XA1Z;AN3rMoMuZ)lL98vIkG(khsB9KTcupw#?-F`}08{XV zNV4+Q*AzkVEMqwP3L?v`dQ~|B;?C9`*BK;(!7=E?5_=P}@Yaeks}oNRj+YL8&HZT9 zF4%Xg+;SHf$HF-oU~LA={!;Br!3NoRn-vB@Pqy?=CeLFm0f|HY0UE>lO{yf&e~GAI z-X^6H`Lo$vr!#;}Ml+8?laV&d2Eg%2Hr$QZ7Yo221-!$)*@k-~*jN9wp4v~)?lxtx2Yv2qDGT{cu zvD3!>k*bqC??N%Vx7U3IUy$eS3qIzqswV|q-f6?2qm@hnAx5L=o_(a{(?2{&8|-Zz z3dbm}^Wsmo70hM1RM45 zQXqfqUpW4@p1`XnY8sNMB-`qlh zuL``4%^&FXVF#u5Pc#n0aMB>dL=qRh`M+_ z=kV3`7XEy@ry;;1xO=g*J=jLmC4TqK$nz(@jZ00J4RoM<4NEp`_ zeRB$glJhNFxe1X=js1JwMGEFwClz`X<_9fLErwm1{}il6^)4*;dGgcHML{pCf7P3vtpfvW&@mV7PnzNdHpZ>4V*ffwH;Co!} z`q0nq5N8*yUL420A>?D}-CU{O&!yj9u4bb% zbSD}daPiA4?Ekq?*ru?)3YZlhWA<&$=H+c7ou;1U#Zgy>WD*0~umtD;2 z3wEBpJm4F4jlqrVQh@I+m{25Lc=`NC|9G@XdP1#Z4m6w$q}&Jtm*N4h20jaNhEeY3 zI@>vxuQ=2J6*cDdDXz<55MSi;h3LxzImT~_#c@mmx{X-&?6D0V%q(<=TTPv%c*CmC z8py)sg+iS!W_u6x>*yTTJaxE|PJut?b<(?ivE!+Zkrj+s<5n?^oS>F0Dt<2bIjw6o zlppY)aBpJnZ{oYZ(Ivqw5aMgEb1Frrm=un&XqJN8n@Yd%m(K&7 zOM3|ia33t}TP<>vroQ)(2WofbA(ee72o=w++eSlYVeOQe#!K4p5r&m7Rn^FA>I_q- za|vmA1EhC+IgAQtxx${r0!cWhD%XpavnioOJLsf-hl{v?_nj}K)1TOG z+|v~f5A-Cy0NCWF>P#k-(KY}RzisXLb4#ey^SiZzfJFtZjEBaqB4Uy8e#omX*J<}h z4TGcDZpF+qsM>4nuh-GIFY4w?kkXNHaTMGIZ839l?@yW=f#N+Fh;TnL48a~6vT&$P zFTONEWP1^(N%k*Gc>e4=IeMXKr+(jL&f}QMa?B^}5iju`*gReqm(1KieLnxrH+=?A zJ@;p(o}ci)Lw1q%8s+uBo4^g4y6m6fN!-hHL3y5ER!>K%@U?yC zsIpXnv;2K9*b|yFts4menf29qT!?FMjL7smS=2lVlNLJAJEON<3I=Xge_IeTuuc@y z5`yxjO)Ap|tA8!mY;)M>RG;DLG`?$VwKpgXl1|y_xKE`%=8-{pi5J-F_^ohqiU>CI zs8Z*GdpShJd^5|1xh!5}w+fH}*x|208ie(#iD#_V&z)(h(YVx&au zZ~YCv#?!0@pI*ggrkY*MrvG_Fks1vZI~7q&kbx+x+MYf$@_pvEhuM!FD~RGd@(DFV zQQ~A^PV__5ig;%9yFw7y);qqY-(q)Qjq);4;kF=aT&SgL_br5=I!ftR!wsejCF879 zWO0hYe)2$BP~F^su)`%4>HBI89!uGu;zFOgQ$O;~FHWP9#hel}@LQtel*kO!`^G0)Z3Zu|q6p}>at{}jHoyF}jUd)Q7#pU7p)nuf_x6NsjfE1CZ^J%i ztM9h)u$M$>qvKDpUPX8gm)Ns?J2^ZP&pGjpfvMcgITlOwS;~)kk5wsgD0RkSGcP-5 zcs^2cU$AXIwBF3npEJMu`&InaLRQcs4iz6H?pSk3)>#7Km&$ujp@zDR@x|PS_6%FA zSBCq-liW;%Og2ha1)q*wdo+YX%6>)SE0n|vR54i8`YUUG1S9QdW1lya!~$7)YM4hd zWPv)rPrJqYGWt3RsGYyBe?Faq{Jr<0peP{7$4NHk*(G&qW$0#t*slp2oD|B$qM!QY z>tjeroJ4NhDvu~HSK(EK ze%S>;_0ZkW+uUBPO}mnmG%Asu$fQ)L==e%R~N&Cen z4BuskUMvgLl})w@S29HW-u@&Q@XaRvmRLE&T3YK3eLPM{z5GemeRaPfh#TLk-(xHu zwccLj`F9DV$mqtkUC2`s6laqrNU7a5=Z)vtKux&i7*y^(%k8-2@ZfWrw2nS&<*j9I zqdzN>nOC!Hty1dlmq=VlwU{<;y1`{GSub_xX!<-Mrv7G$k!-`!pqXFHqno=%PFZ)@ z2#$0PANNZluPtU;ZD;C?*dN)-c2Bq1_Hf>t6IH<{7v*!U`fYGORIZr=qeDJcGiAvp z8b!l7w+Ga7)rwj5xK!a~xB8->8>Sm_T*%vmZ_(Kli2#3FBk*^8TmQp;6`md`w|m}89$Sw8~mbCB^g1bHSokP zNAVG72KYIfP_qn_pR6k&g}{Q7R%4&CcDUDvg5Bm44J%@rE-2BWF^#>NyDk~d|PDD25=1 zi1RgE#I;LC=9TKZET7n9QTRLgB_$-fTHu%e3BrXi0{qQ%uohX>;|}@CQ$ewN4@;;a z4$5pUh&M6j-A%l3Wf`d860ZtNv$CS!d%voz`QpqI{Om6?JxQg~=t6XzRF(h77F z0Xpoq%RN>t5tIIP{RvPIY|l5Nc;D=z-vL#UK5t_~c+R zYsA)J*s72G=J5&d^3~rYlE^P!p)`-4NR#;DJnRJXDY$dIBF=io#$uWCMlQ-oLR;3% zplF}+V6lePMDF4Q7KQZe~=AeC8c;~r#JK8T8x37>ortF2G6(7z@o6XPSD z82LbB7nzQf2~UyXQ}52|Oc83WOTStta8o8*?18P9O!TsTtScmo>w!drv{ZF>W@ood zNS$n%K5HEieknD{i%dL%r~8nTf*|2Xuq$TL%qxfK3EHVRw^UU>8S$kIHMi80*LzO2 zb{}0#F&;|!Ee?;zoh?ausJnryCV7 zOTY1c-}CH8U2?`=I>z2cat`kvJ<%R;vNGv7GI~*I+*Fxn<(&R$fvkQE*IYFTkIo1? zP7m+MxW;c9sXiDEq^bdfVQw%k3dsxs^NQ|&29|H`1cc(?_H`+eq|`7PS>X_8pp&ew z1$Uau*Aqn}5YK5tcLL621X1(Z5xGou9ZKjUrCdU%xnJkbRRp<6tIm>Sepfq(AqGREq%?=3Ji}X!3GxaQM$%gDe z&i&db1f@?CZkNd=Kb);KeABA(sVE{5S1BR=#WvLO1y%x0fd+HY%;Ud3skHd})5f_&x#=qN-|M0UpMQwe1J@uUt+Xu>MDZ&y=06t}t z4Zbr~98+ndofXz)+%N6TIWayI;=R_Yw%X}?EXkY*gkizkU zfo7S&@J?__PH?e+6+1{^3c$^Bfj43NFT*-`Vx*8do~hsd+bXE6v01VwdG5|qMvBBr%4 zYeKX10#nc-Q(_1nx;s%yfyc+$fjIM{mf(q6>3pguV6>ErS`WOB^@r7 zX83yY{15@OYdf0Ff)xi$oLN=#RMm>d-z`~_`B@Ubu8B~87A0MQKg~- z$96MDY+E7Evt>@G2iaQbOl!)poVDu7qC!j)8gEovIa(t^)TBYh9yXC(RDhv57Az{!%-K)Pg@!${7dBd3DBySoHa zIs{@;j?l*d*to`p=bE{3=Pd3z`M%B%+(1YDmm0qdkEf)25*?|(SweUJy>Y6;QpTk_ zn9w@-<(fC-n3*SLBVDZs)Dp*CPr%B`y-Sn$;x6!tyNU0 zvlfx%)T#u;dAE-D4vmX{-Y?~;K9m5SH@uns1NV}F%F~knTF-uJO;*E_cVDnvRyo1R zpB8xtzea+&m)O}cSb``S5Jik>?)hVl=i4~#N1wI9CGQXQp*3re=$ZGm{R)THZofiX ze#v&!_b;^%!{p~U9NNI1bs0%!E}@tOkz261lBJ|NxM!Ugi~r1ta~IYqs7wW@oknoee(K1}&%M3R#6Q97rU zXx1_J!>i+_=1<*^e|O*W#J1+zWh$;O=Xa8EL2RESSGl}acK@uT{)YQMo5)1yS4!Rj ze-Y8XhcNfRW?@Kzb92jCo~Cx`6|0&j{;tfvU@_BzoZR?e&#|Po0cj9kDe>*zgpY_Pt=Qcar`YwtFvdOIoKhG5jD#i^ zP416$nA8R!b-3oPMD|!*5Bux?m~;J&>S+E8gkNl{Y*a-+`g+{0z&Ee+UaTeucOV43 zCUZs8lYlf1ASnDV{32f<53s=jq$MqNMmaX#xc!y{6m- zgww--fL|<0=Yk?n1||Q7hu}6+Ygx$Yi1d38_r*wF?t!38)sh3d3j-Tvnm)mrIpY?~ zx1aM}hY^y988{)w$lR3XD{uoZ5EMy!E>@X z{31wt1_d-%b1o=(hn(024?BOkIzJOk+A5vYWKvjpshd*V4SBD&8V@e>?`#z<@lVxf z3LOOp$OhH^T}ukO+^@9Raqn}$qzo9B{A}#9|6<*2+s4cF?NIiRA~S?*TPA_=&}6Zw zFY)t0;^)EikeQa6*_LgYYoVVvK99A32@1Ob7PV*QAWrmf2uyPXJw116Hvck)pg3#b zmPh|AGI^Mv5n5h0#a;-Co@@~vd4I=RV#PxegI%+7ox63KV@MwVd5_Fm5^ za>vq2-p!7QDA+4mL%$ap$TYbF{0Ye z?WEW)*9kx@NfGDHef&N|_30N$Cj3#db9N>~iM8+j3(_56`W`> z(eWtQ6Llf_k{&#IjPHBt!?A3l^#{Hij?U3qp23B)dn~a6+8Ye842h!#a?+;}I~c9& zq}Us}TeSDx=I3R7J=T`4%>HMAKKe0^@C_4YhJtM@DL*=Nb7sHc$KijMO2;yle>Q!T z%sKxx#tVILLOP3`<8yW$(OHE%E-p4e4{o=V6KJ}Tgw4o6jPK1lj~i_Rj6ur;055f*CP+bTFtc zHhR6}4B{}{^jDcuTu<-VEpnz%WQXD=%b)aUr`rez5?l6HQgNafD`xzfo=EoRl1Bcc zdr6J=pMK!=yt<)un51=-_5e}w2OKb0bmajHemC6wL8jmM@8W~kwut!K0U{1&8OkaF z6(@k!E1{P^ey)*^7<` z*lV!Rjgm?pAq31&P*^Oovd480f$8}1RdTdMHE=RFe%6M=)dSn|ElDs4CWJ83!efWZ8~-(r>MtE^+xsRUgejTrRH`ti77rmx z67)(qjsPS1U`%Bpq*F`*QqKV0tWQX}vL=9x&#Kf5w`dCarMgZvR7pzK36m3l>{;?c zv5{b#-Vn9__FFIBxHXEgUt?Q%zp zkZuZ_y?O3Kl#*?OX5K;w(B(7GCp84kd@gmeCZU2N9Lf^E6Z<<#^%q-i%7$vb? zA%4$VtNBnY_haD|0TeV>(?Mq7Eigt3&s$2?JHYr76ehRD^WEryQp4-ym@Z*~Xx%aS=2BB|Z+3lW7-BNri{CS@wBqZWxunE9K?!TW3yQ zC}||)waryEV3t*@;2Ib45Wwa{J0h4O%h)zNFJCL;Yok>ldgrd}A}XUhJ*Z!wuKqhn zJV^HC9Hc;rVlai4g+iUPqfXYlRK|2T{;-r&@b;0ucMW;A!Ai|F_GVtSb$^fDg;4F{ z%3XzKqpAWvzigGi-+hNU9$4wqpVU0;=ZXr?yMq$W8H%dc@1%dLQ~G2-#R0P6pMK++ z{NB|92;r$tHW42fo-U)T2`DtPehqH$kD{H}uuq9=Be#5%T|w?R(?=M zOnJKG8sf-Qm^d6r3I5d6Y{awGa*2Ykrq$egYbFLB2M%k_J#^p=DM}a+Lx-1!9$82?!3}#r5cWY zuD4}7^Ks}&FYB4FxtK}2W^c1F7Sn<6Q(1%jG5#Eo>@A~;>RAtkV4=Pk%@V)em=n9X zZU=8axQ^Xav!~p>`${oxm;O%Wx3~?TbV={i4+r^Slu77ucE|FIS95^@c22om;sXgd zj*?*Czmo#|(SQGYE0L3U&7jYyhfBYXn-sbLEVCc!u#wTB8D(6^iC~e~nd}Z#Q+XxFB{z z&1)xi@Y&A@g6iIl+}(N~4e+}P{#y&4%zJS9#+Pn^_AL5B*n{lgOv!ZAs>hT9PJe%R zEQPi2^~UUAS8WU}(*ShxiZEQI9+v|YYu%jXku1n{p<<4|o%(JPo1$R9!uRsOa@htI zVen1M(+^*Lm-0#i`t~ms_DEnJ5@2$qd^|@Y-SD z6UKP^JpMw?J(RF!+=z~*MPGi`ewDGP3@E>F@*ze}o(@Piox-(`s{QKObT01E;-(Fs;1i@vY>9I#m<0FF zo{F`|2t*njc~-&a!-F|$Tp=i=OhJHX6$iTH@vgnp?-_MNm5jIHn1SSF_K^N*CX zpq)kWrW8Zj{xqAE+n4a-wHlDnUeg#@`hmJ+LgL0!OcU*niY!X z=Vl31)=Kn)@`Ft()mNTpF1`Li3Va1af^QNAQevtCnP7z_68X| zeaVV%Y2K#|lOFCxFYsN^di&y{W<-K7ND^>LsPNG-+iuW-5`p4XOC7siKc(~&g3t4YVfqUh{RgqO?|P7JQ_-zn|7?#Mg$>qIDc}0L%#AGi@0O|BIA4)X)3xBFDugyeYrxc-UC@`)^)O-SQq2nzW3r-I|xDm%n_6 z-E#Jh`)@C0;fW8~w-qAT`r)QrW(50n9)ssB?{&UD49xwU`~t1)a&FJ~!^n#K&Ua&T z4v^VmmC6vXErjn?IZ|Q&Y+A}cZ8oSw>Pgah52hF&PQ0H-%}$8|+JK>^pWz(uhmB^> z-;(#s)mbfvl39Ns#NG72H^b3G`s%w7Ei;JvM$dF9SqYP>?$)cd1d(y>-j#Ia2zn1{ zFO${k73KlY{o)h6-mMpR3S_o)bb;F9!dzlG#|sKtsy)_6AM?+tkl3#$3m^7m6NLLO zq^gH}*xxEa*s6RZSU=_c()$&C19mPkzr}Kp#`n91wjxHIT<36=3j4S9J*w|X z`1wC{V z2GsEo6y2JGWX}PdIEJXA@K)3Mi06F@UTaoqbb#1nNz`}fO0ye)N^7mzr31Q*KAE69 z%kM-99_bbyCc24$g{0(JO=}T#z=~*akppiX39EB)LjJr=J^z z+(~wtU)KXZg`Qhis9y8CCFvOXAnd>>B3&v{DW7nT9q094fMmFa|MX>aRgVZhL8@`q zT(k2C^if*(?}3I5^u^0b`5&w)Y)g?Yt=nI!wW^kW(I~Ci{$PUrREX8dgiCn|Jy0%a zV2FW~RnVG4k5t@ZAcPQrsPl(}_#;pcytRX@@Ef&RwP}3D!I6VH5+Y!u9?O8bbWL_K zY;E{o!w^B{x{uE%6c&^<))%k3p2f8p8VQk3leALbOic+$o2`p`w{Zn;P`n3d&lMG% zvosR}CvlL9xE=@jqnU<^lI^t5W z4RP}dHC6o_i-H8iDnB?l%@6m_q&f|%@sO(xsILu^dk`yE>nc~HnHuP`nJc*U75YZ# zx;uYv?+^X0i)pJ!D^kOlT;ptg!nVyzVP-1Q+zdky9GU^ZWJl#gZd zuiu=K;_uhJLVowys|~c{M(59eu^Pn_d!%wB_3!+JaPfq`7b|~r?(!nIe~!anbaV-h zXBwQ9F&qkz`8Wdg-VeTiRVJ6K);YF@6506Pr0MB-rTa_bQZgUyM!R*aQkN_g=fn(s zo9dj?@qs;Q_cbNOyaKYDg8EyOUUu$qy00ptu>b725=*J8y7h*MVVv*3z+{ze?8AOv zn4e++$!w&q{@UOs=XmjIx<0NZl_#ULS^Nf31+BplCrSO&Ghu{hCKJaOZ?sgGyFX%-tgJUxE{`g!nR z?bcom{@&}_eu^@^8oRxk|706cJU0*DYrd`3#c+6q;i;jpat(da5QyGC&C7`S<;wQjSBuGk8K8CPf`l!4C=Cnyu%H8YxVW@WqmdF)F zKY_BScMH?~|MWCZjzpOH8;TAseKP+jTAQLQoN5(UA(PsxHI$~DCMvjHCb)2l_j@ud zikL&+Kkpn#d<~H;OXi&e%tw4g9f<q8E8{ftI^Avx_O6_}p7k!h=ujk>W@ ztFfoLNnoo>I8Tj0j+W2MB9Z^8n)7Hw#piIr`zoGe%MHC-0NuAFlckQLb2Z& zRsiUiJ=&appLcu(O+2|7a7RC7R{nGe=tQ)X>a?GT^C!!V zKFgY_>aiDR+b@lSL*yTZeQS@(f&1zyh#hLUv~NUzZVPyHfRa%Pz2+Zz;`AN4*kHZW z@t!7oJ)!qg{Oz(O#UwWUZ?E-e`V+@Uewypn$b&3R`o~+RlLj+)iX?s6f|JmPzungC z&nYEKccdt5rJn9c)zeDuZB4V$B0F`EpFz`}jmw*Pn_lV2NYcto(t>!!rOS`W&*9@2 zNE)}}mdoO@A8X~D&C9v*G+hODzUl;m(*&hj25oWzH$)~q{4RJ{`J0n@mdD60 z?1DS+#66t3lcPYBqX3oPIajNtZ1%)}?gZC%dQMpOEYQQA&Vuf;2%;xCoG&_zu)-Rw zfgU)zPTT{fOL+%adQNnufYxM_;-{hiIh1ncOSCIl|AV_WZcMOgP2MCo)a2C)ddfC{ z)w1bL{_ZT)0i0S!s;fGT#JNnk!#CW+J$wVXi#xeLI=FuWx}X31Kajhtzxu1k`lHhX zHq`p9UwTdGx`}Rj2yC~sTP0*NWw8G{GMwnbnx((HsCH83imvD^v?xbGmcsAOzAx3h@1!^AGUy1K)=J1oPix4}QWJ1hKy9=!U>!#m8wydEsWOwfY8qW~@F z#8!uZoXX~I4m(!Psem%(k%j z4*=F4X<@>|cGK;WB0ggZepN!f;yeAJySd{(KC8dT+Eac_#Qog=gUwfZ=F_BLCg_vu zCSlIzR$BI0Lg`fwcc5|tBJ?FaaKqu>re-#2lA37iGpORH<#oO*W;FinV+Q1Zhn>&5 zq~knH^!~liM8T`&kh7>uHWJ!}JQKnS6l4VPmE??PrIa4E(4mSa9 zq=n)p6PiDP2G#gcXi=j_ktS7oGUif~_ilE`$&vq7RBTSMA|;xYYgeydjWz|l5fBqv zB55(1I+iWUt!?4PmCIG^T)TJOg2cO*Z{L!2{RY1KR&Zg%aRDDz?3M6h$B&UFhCJD5 zW6GB?r<9zTGfT^zL5JQPn)JxerBOp3otpK()2(3#ULBkCYudN%&c@Bz_HN%}bswIk z(F{f|L5sKKh9m?%PBSiIEZX~bb-FS!n;CGNV1wZUf_mQw-ed?f-x19+vv9gz>+gYM zzY9!dgF58@iO0{0%fNrb|Di`Z0Fg0+lZ?1AP`r$08DN&-hC>D!dS>AQzy@bQrVj4} zlsFTa6ic!--9H{>G6e~=jf2_zgO zZoA_Ks3@T&U(`+^BDvu2I2VV+&!rJd%<`w;zA8X~FI8kwBqSE{vAgg7d$Az!$jpyN zB=VE40c1j`_|v1h`bX#PV@XQ1Wtym0|`zV3_;a7^;|Gig78D60ac46572)Eg^`;=-9yyZpk}kf z(o2ag*4Sf_P1e{7v}k4{P8txDivbRtv5tpe?M@&%U*yJ07y)!O+i_tGamF+QMbf{Y z4E@zzlDPD0SOJ)Iwxb#BB*=`1X7tl`xP7}*a{x6%fb*X^B9e#`J@W(*zXlLFxYj?_ z%+*X>MeOz6jaQ1dD=+IM30r~;VrU?2p-nO)Gq}r@pcxvl2&03bTbG~>9~v3jXdA*d zB7NE8B4&eMYM0}q3G$dLJM2YzD2<(tx+A5f2FvKGf2A7huCCttP_4bjs_U>z1eLT=2mOFWm6M5l=kvyzNFh8yg^x fT=K~&uiWy>G0$A{%{lMf^Up!IA)CgJ4hR4{3uUAO diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-implement.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas-implement.gif deleted file mode 100644 index 5a90b2fb9763e929bc29a82ab94905f5edac6f32..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 37159 zcmV(~K+nHNNk%w1VJHHm0&oBTEC2ui04M^a0*3$q02CY~Bpd)792_JhBrGf}05F*( zFg!dk001Je>?cp*%c1FhEdHKmZU#p%6r+6hx&MM4=c& zr5H$|7)Yf=L_{1&p&U%ANJvOHOkp5QrD03}Bv7FwP^utRvQSV^ELEx~S+Xoys#R50 zFj=lFU9tdi!Yp03L|t_-U9L1;s&!oe1Zn>`U9vP`vN&O~JYlXpVX`!3x?y2q5N-cF zWwJnJsz7D3P-%r_Wo3nF07PlBIBmX2X{tPJzEx?JJZ-{2ZMqnB|441NJaNKIZLWc3 zOl@s#AbI~lb;eb3szi0dB!$XZb(JK2|8a3~P<6VMbpR}V|8;eBU3so~d3jlVzFB?3 zOo7f_eZFCVp*V&A44wa>fdGAdeLRuQ&SfxFh0>*YIL>J_X@$B#mC`_s|6z&Bg@uJg zk@jhgvUQ2FvW)P?i6Ejj~Xk){TvgagoY(k;ZwEzS?~#)_pW_nZ8+} z*4lwIzL@}Jo!*s|m2I8keVNXMnZkjY&S9bdVXE4hnVET^&f<+Ajh(jIiB)l>=FXu2 z@{J6Qq0*tDp>eAJ=9w6crP6h>-hr;#|Cs>Vt^j?q>XoY2d9wd~w%-4p2+E~#rLMZJ zuC9f;;-Rw2owC-Qvf7Ed=7qZQg}&m2y88d6AhNQu=DGm#vJ9cN+Ks~Ewzjs7zW;K$*h-zP`TZvYG$3OrggAp~~v6#^S!h&Y8~t zzQ)r3&H%>7#+lat|H5Ie&j0_yZNARt!p`Q-&d#>d|Gv`ds^0(q&V9bx?#kBc?#{aZ z(v8C2|JvHx#^UnQ-tNxg^8ebM&f@>_+Ro1A^8enY|K6_N=JM9+_TJ|9=H}+s>i^p6 z_V(i1-s=DV=DyzU_U7vL|LVr#?*I1c=H~MH=JNmQ^7iWT|MK$k?(+Zt^4{|H`ttVw z|Mu$g`v3O&|N8p>|Nr*?|NjX80RIUbNU)&6g9sBUT*$DY!-o(fN}RaR+OLZkGiuz( zv7^V2AVZ2A*)bi(lPFWFT*Ufw zUCOkn)2C3QJ~eZ!s@1DlvufSSwX4^!V8d#Cg;c89vuM+*UCS0NRk3j6%AHF$E7`Vq z^XlEpx3AQ({VjFGan&_UhKMbL-yCn;~u6z&qpaO}w~q)4zi&Cp`SP^XJh0CSOjy zaM|eCvujT~eXuTF)#XP2sye=F^X=%vabp0x^tnjE43dBR~iU2oOV6IOeFID+mM`!ZBkEX=8*jT(L=z2pBn^iB;(+K!Z#+ z7=ny~P>8@LKrm_KiRN9$;+SNn*WH$zgdoU}TONbJcp)C+3VjS#MdN$*jR7Q)2)u`Y zD?schCsqP5`JRAyy2s-fMIIA^0GqgZ40u)jX=9Wqidp8SoF3O*l2^zm--~e0SD$_} z>Ib2n`u%C2eDcZvp`##K2{1+^k$?xLjT7{W01$g3Fh&fK4CzV;55~DGYnpcI?6a|T zm*oTzP9R5vZkCGa1gL7bYO0RP0jnHFZgRy06g~+ercr+ArW`x|Dk`3DUTQCa%|fg1 zzL|ArBZXbktL>#%7#V|p6W}?4jAQh9%oVmCL+hjiMhWG;AqaX*q&PDP&wO}c7E%w+jIsNt7c4bZW+H9v}Hrj9>6L#Bl*S*l& zUO{b@AQN-{m8({$t`@jhbK7nB;s4;>RR|uJry*CHOsN&gpHco*;fQC>w&GB~9BHJw z2s>VWTh~(hOvtL#4_bpvqK~UE^61(8?JN7w{Uy8F)=+-2Nc+t;s-5Okd zxRtt1^v+%cv=ahYMxV#!=Ywt(mcXoa)x zfeTy-lM@h<7b!r2v3OXUq8ybL!8BE6O+5PC2+f73D=^Vf(VKt=a})z?9V3B76IO%# z2%kia@IBX>(t9SPBSS)Qj+lgC+&1~bOnS0Y5#%Iw8u-alW+#-QR1PUk$x7#-GL^tt zWh-ad8>gKsNw2F5-!=voLG&3sumD52Mr-z_UC*@-2A>W8U86aFs4`lR}#)q>R*TyY6FS^2tWwc)=aYaWhe%vh038Lw zAP-r-m*F4nwz&B%RW5pp)N?a(}DT)K7aaWJJV&OC7~`q?`fFimKvvQ zxz(*P2$IHJO4Yg&R4lFIs!pGJudiBVdz2e0(Tutk)Gf7qM189>MJ83dI(9VL>=ROD zR7jRaf}#2g0SiL_0I%vtvwxe@T#FXXHqB{vMJg7qhPYH&0rrAKJ)x|sh81G}KK8b4 zk?HoUeh7stOy7WJ_`{pw@Fp(|;u0HV!y-nn zhfU044W}4xByO>ZQT*aK%J{}^tMS=ljN=T`SjU&_v5+H@hCmqk$Vg7Il9$ZnCOf$g zeQ>grr%dH0`ymuV&ay+`@r^Ef`O9DqvzW(B<}!yu64ofQn%B%`GQ&gv%W!7QG&FIK zINSMIbFTB9_gtnt^ZCy#@-v_ZeIP*-`q1bxG@=(B9Yr(x(Z+E!q$j-_NmKgLu(33z zH%%H%bNbVm@ieGMjTnCbgBPsO#4dQj3{tzAF~HD-tYv+TSKAsf-I%qk^>OQ7^F<$^ zm^CkaO>Diyn%2cmHd}JNYh^ndEx^{qu%AtBsl>Y0)y}q4a?NXPds`{`0LHhurVm}4 z``qYGx4PHO?smKT-SCdLyys2tdfWTn_|CV!+0BYS-$T{Y2)MupPVj;o{NM;rxWX6C z@P@}47!8lO#3xSiiWfZ97SFiGH_q{Zv!dU8{`WKvl{AQLa9y=Re=ToWcY z5Xx1~@;kfSKqWtU%Ez>Fe`{joIET5;Y3_5NuP5g+-#LqV9`c{RJm%|}InQfu=bIm0 z=t(Df(~Yhkq(@!pD`I-fogQ?kt4Hcfr+S>N-gT^hUF&1#dV0KmcCf2R>^3L+)yq*~V?*UrDqtqcS)Ti4ju^5bOF3c?s1Vvldde-vi zk&T{pnA;ucxrVMm;g19fUe$MgJ>j==cugdJJBycf;}bOb$iw;Zm5kB4B9$&%n@q#)lyHFn%i%4)#Y&lTZT;*nkfBfDjmg z5;%bjSOgS!ff$&9H4p_0@dY;Ufgl)yA~=F1Sb`?_fkkkFD!76yXajqo5c3cOEjWWT zh=MhEgDcnx3gHYm*n=&|11ac(LTG}{04+6e29S`1O1Okf*o02_gisiTQaFWFsDuWv z5C-4~TDXN=*o9vBg%@Q2S*1A*v>yx5Dr z_=}AQi3uTzwOEYCn2MpOhNXCn%-D>Y$cl9ci_SQW)Yyr)2#CO#joP@4j3|rVXaqqvOXc#g6Njjkw-=-7_Uc#XNZi`+Pm^q7s_co5*|j{4Y%5EQD5Ky_5%{Y|=QI%%t zj957kTDg|`*p+1Rm0?+z-Dr|<>5OPO5Nes1#@Lnu@s@shj&eCBbjgsJzzB-Ti??tK zb~%;-_i+d>$eQAu8u$F-N4}!^zi!hm$SePtwnDux70dN4O2?vch1yk^tcv*`P zFaWX{0eMi2ix2_fSegHDnY6eC15f}3FaS+pm7Cd_zOV(sSpYxKiA^92lh_2qnFqhQ z1-R*n%jt;`@R`Oq0GcS8D?*y|cmO{CAc#I70mX0&jNk)|K!|?;2B>hJj#&(-00!%M zlaMJ8lBtTyIf-sC0B%5ulrRdGI0^#l3z=Do2a1UaYK*$co3c0x15lu&P@9vupq)sd z=UANVXo)FM0GT-o9-y6?SOD573(gq<|LF@N%8A_Ri6nZAEsBZWsUqMxkK!qaAE25( z@Buq|0P-oGKH#H1FrHu_o*!VIHhG`_ke{izpOc83zAy^FSpXg|i38vP!TAHg>7Tw3 z0b9BSDvFznFr{3|pcJW+7HOLU;GC5>rofp3zVHJc5SwF4i7z^(VoIe0aGl4fp_mAv z1zL%*Spfe@2_Ar)P4Jr$Knc+Q>6-UOmiRq(*IHbi80PlI8_W7E$ z=%iNKrNh~!U^)Pw*`ERmrEE$G1)!qSx(I7}oYQKi%IJ)-=>b1*pfBnR1uzO)TA&3` zo6_nF9+0euYONI7jDC8Fb!v$b0H#u^q5$v%iy#Z(`UA@ut}QwMwV4NQ5TH>Su#{M@ zQJSru>H!2g0GUalDFCO}ng`DLqHX}G!wI3?iHiy;k0N=a=NSN*00##k0TK`Z>xr5< zS`0(V2muh5O3I|DXso{fz?~5~iT--ClW46yJFR&zs@z$p^E$8Nc&0y@rkE+GdrAqa zs;SJnvrk&3hkCP`>ZSV1u<+W71i7J<%xbj#`mfr_olshdTcD-P%CiSM zw#8}wQqpoU+u!>a)~(vlKeC)taqfON$Mvw9MF_PHTx$Yo+{ZrGXl{(-^Oo z2)bWOqKmM*v}?CIi?+x518|zKAu6q(`MJ8wyOglInR&KOy9JAo2h&Okph^jHy1Upb zxE+g)BzXWXpqNwt5VHrMnqZ)^aL~B7Ai3iy0j-G&)ONrMCw=(LnAPKS#`2nbT03Yz4e}I}h znhAf9vIlUhtcjy1+nVqjiN_e5vq_;+3Y-v}zdZ}7zv%%(E2h!f88+b2`Uz8Ub$mnGX!7 zzUi;wYNvw#jHL&g0(3j3h@6>ND!km;p>Dgq@o1Nt{E$q1jt1+A7AlTjJdL58!WWvM zZcLPL{I&W@iKDOuc~GDW%DX0NpkE81TX3LT0Hz7byHN_urc4QpdcaZIw;#I8fy$^N zng_$VqJ(S1G>OBTJk5l7xuB`7<#^41naWwY%G&&n(43UgOwH76&EHI!0-Tlve9oq5 zyX-uTg?k`}OU{-Xzwc~{qkPY)=+63ljPYzB^W2EHFr);13rb9nneYL{aKt!i&!{L1 z%Y{jrlB#%e$}E*@?A`j{Mxu#rV(b5zveXvjpt}2F;MU>ay=!kLE0kL2JJ* z>de3YTcHqqju#z^iJAiMx`~5JiBb!lLdnf;>CKoZy*+J-vY^2~&CwcMot(JT2@B5L zJC86+h$(H*?%TLiAOSA$p6~kyjq9=t?E(_;zANpk4c*DK__~YG1PQtYO<=B{NeRq+ zw<(~}aXr@+%D;SFi#Z*OiJS*pAfZh_%%8i<2RgC)+R>wM*tfjP+Z>IjIHyo8uMFGN zoM^N(jftF1)tO9>FsqpBxzaFu)_>pvAHWDjs<`V}tHqEBLiz`cVAjQu)-6qsFD;8w z`>AuhufFY}z8e8}OWd-csXvehb;_@JE8J3y#YelXwfLe^ipc!CryY8%;tIHKaNL6b zoCiBAox+=~s+t0tT8tm<(;O?RQ*EkMDxAT2z{q)}qFSi~0H*HUrKL)xOKquLs;X65 zozknSer(?o?1>_+9wfbpi~s;TysNj(tG`Oxi|ebXi3(HjzC!E+F^k&`x!bWQwKE*2 z!%LmMONsp}wRI}IPny6fn#i&k*!uaIV5`9DI-IWh*tjXRA)KP?db4b**{GP_nYaZ3 ze!$vmw8H5N{mH)t;GB4Sv%}fsO77&(D$D}Pu~iPCpVcKCnr4P)VDn6}$9=hTG3gfXT z<4vlaQv9DWy0a}xw~Wl=o(t5MuHCdq^G)%go?yZ*Cw!w+V zp>E>Gn&_Q9=2gv&XfB9qK8Te|hyfr0sDKKn8QZ(w;X<0*^9bUq*uc`;1V4`GivXcP z-nky!>~$*ZfSt~Kxz4AU$gd2s5L?q~yT#LL={I|zk{;@{$ms(ro9r&2NuJrEuEyA# zneQI&o!X_vtGn>d;<4`NvtGlszKyqj=PNCUX04cV4%>>$s{sH8Lrm;=zShH7j5}+< z1+KZysp=#OsBy}j%K{Le&ROrrdi1b6iTWPu^UAT-{)q{m9t*CB1C7QN@6vj1ipa^|bUVBT?#G!)wgmv|nhMttJooB) zpdKLRr^x7){iv`!s0W+^)5+fIs;Wny_d@Lph=2Eruixp;^PK7PcAB95tEr%BrBSZE z;_9t)dg`8^=~Q~hf86Rf`}v~kt&%_W2u|j6Y3B6onrscypD6gakBREurnmc~V5*&? zun3tcqQ<|*J$uVhO8hGNwS^7*w!HkskK%nB{nj7*0bl!@jO@GrpNYEP{gv4J;7|3k zZMvfglegqj(>tPM$qy#`yyA)DWLVjUGi>@L)xzO`Sf4I`Lvjs#UFCEqM}R%A{Sr_N;j`=U1|2 zT>=$K)a+WeF%3qA8&~dJg;TNK#hX{8)`wi%{_Ps}Ax^-Bk)nM#)bQf9Z|OdU9ND2= zy_GHBsd_99wq($jl8lr%wI3VQAdAOE)~- zTe!>Bu8kkJh;jCE<|a`N&uw$?Sm>gEGYno`dvWC5z1LOVTzu@>3~y^UteYWk^oy@A z%-&u&_wV(O!yca>Z~2Ai<+oLDA@=_J>pg|yBM>$E>|;xd3kKruxXS7fn87hhaK1QcMTu|^vwOsGN-1CtIk>UJ!vLxesA zvM>=zL=viYnqjg@C!d5eN-3voh8Q$Lp)yM?x2y&wExrUZOfknKvrIG3L^Dk_!Gxm6 zhT2)c06FKRvraqj#4}Gl_vEurI@=Hm1V;uXv`|C;4@ERlMHgkXQAZzj1carMq_k3~ z?$Kl#OC7Ss5Klh^HB?bYCACyjPenCVP@CDb)ry?4Ay!#urL|UDZ^boNU3cZRS6Q8L zHCSO4!c@~?k3}|FWtU~PS!W$8_E~ACrM6mYuf_JCXtU+ETW`MwH(aK+6}Mb-&qX)g zR>@VjU3cGwH{OcamA77d@5Q%Udh_MCUw{9tbYFl6Cb(dO;}ZB_g%@U6;e;E8IAV$8 zeRyJvFUFYLiZkZ8V~>ReMiY@m2F0I`PewUqB*Ph5WMEW=IcAwz^9Pic!xaOw020QF~l>u68 zv#B=3Pqo)(yKT4Mh8u1}&ZZmOF6f9bZ@u>}hK?@k2Atcw`6j&Z<@^pjacc)Rym80x zLR@jlpJn`U%P$Wp^2s+>wsOor2VHZ{M;F%fjKKIn0v|FdCUvY_-^le$4v^p@Mi>d{ z4qQ7c-j;z0B_m7?r$%g;{aQ-gq zfd}A#jC7yk_`j8Bzf#YAC?Az#P^o=-MpB0(BUD@{{tu0aKS27%x4T;mFnz<5zyW-K ziYYwL2kFxuM;KAQ^R145aJa<l3dJRkglgTs3v{`B_&1wIfY$ZKB^?c=%c`EMi5dtUf55dZ}?&wtH3fc32R0RXrF zgc)ICF(d$h69&KsR4kwIxF>z(sNz_CkRJBhOZdki((l)0z@G;5;;T!0Pc<$fLj3aegFUiBc=cVAAkV>DrDXC zHmSn#W$}4az+ENBXvPn2WP;{1BLMQ(yjezakn`i-6fvnuP9D;HuPg=};>X0>Ns*G4 z1ZFXAIlW3YkC(PS71 zBoltPb0#u-dC2HVv3%Z4UlxJ+$~Jnle%rKV8J7uAMu1b9itGp@tGUp}cy5LVkRScZ z=}amfuo#)}Bq%}nhisPem&&AK?N%8%zl1v zmeD)vQhNu}Us8~YOf+UrBRSLZy|9<#+iD?wn$T$m)vj?dT`^FnI@Y-`BQC5Y10|q3 z`3*01>GLZNGm%&yf`NbkE-)f0b_c<57DIQuv#bv)30NH7VuByooe>i&Si+hyec3y$ z4=wvxFyQd7n$2ttZex4lKKZ?8Gr%goNA z!{s0CT6^5&R(B%5Wo~x!rcmp47a`cyZg|JTUGG{KydB{oKB?lp+Jz*&QLL&YWy6T1 zdQZL=^=9!3+Y$QqP6A2I4|&U*-1A=Vp5S|KNIWY%kaUxF%DiuEZh2CTbk%wLEotvE z!H7x*c(()guIGsNyaPlyo-^#-h>3a8|1$9p&b{jM@~4q_Y6NyCgu?+?_krh0AQL&( z@ByqiI~UB3#I2qGa3o6#%M+70f43x_@OaEbR1_~G{4*ltJ`7^>E_Zk?@WDe3yvHnl zIm|2#z!XsD*4{nzi{W&z@k;4OMobS5aG-J)XP8w?W&*U{TVs;%3(Q-5?~9vge9 z)ld3B0(D*^J@q1BF5lI3VDJGF4ZPFM(9v6Vt8<*rO!jh> z2EMPV+sM0G17MRJMW^}Tr#eFmx};3}zyWp5NkK;wi=B=%Nun?(Arw0!$3`|oi5R_S z8#t4jj2`#@`u#yZF4MTEn6X;3O}#SHQ<56?qZSd2Qm!sq$rVN@ApJ+hYIhrV&%@n| zTL-@OlB5G|;D8SYasKyQrS zGoB|Sea0l-&f6QiGbV*WyPMjkc`LKnYo^S@2zuc~uMskEVe7pPN z7Q*w>U6wgq;Tm#e!*-Ws@Hi6p!fv?3x6?=mQE_)=R?@TlW$;EYE#J8xUVpli3_ zk_sRqAFBuhH0%-f1dN~^X0L96#Vg(!lCvZgsKY<_VUJb30UP#!g#j2)hk1a$x1t}t zc6W#W;gO*J9NzfHD(uk<*W05L26%uWYH#~wdpY;d#|!G|fdxAt;T`>;hb`>j4dWwU z`OMe1^YOA^=w}!8@8HKWWbg)Wcmf*v=tUy9zX#-Bf*;_g=KG8;fh>=Nz2#>v-*bXl zK!RSt0xU>`f1rnV2!=#Z2YaBu3m69cYozz#qAvoUEMp_QvmM^MH2~xr)cXf{s011C z1b(PKJAei!_=kN6hDvxqD`0@-qd@ktzz^CaSZc8Vu%e>#BUDPN*&(Xifj4ym!Ms5| zY*>bWK!QYYf;aGlWxxU%06yUhhG3Wn17MXJv_UU3sCUz%0Kgqs136T{ty@~QIt!@( z13(=vI>HD+y?n3(EYJaUkcTkPfmt{Q9iYB2z=jsg!Y$;&UK~$bX93Bb+IkuZ0{&}NY8l#Hq z9e0bw=4b%}0G5Bi0%%CVf4~MA7{D;_1T3%xQ4~Z{$Ce!dMJ|lEX&v7=#Wm02A1Te}D#0@P;>#fh7zBJ8%MMP{(yVM)3;?M!>ND2s@uY zU<5piw|?ZCe+zv<4D4xg9`Y_fA9oK)B!43 z!jx1=#bHUSSi6|C96E4-fE)*eV1r(;15e<|o(!Cy6v`uPgBQ2}1Gs^9kcV>!$)wGO0a~!$l(V=cmS(x2bH_Uv;>^BWXs$Woq2#uIRSzD zv&*}b$h^cxAesk6Foe$wOu-~fu*A2;G#k8ZOznD1$P63FoJ{7bOv~gN&zZNl0nN~q zJx(ou;)CksGPO5p$*u>886wm3@i0TYa zToBLe)XsZT&hEU-<^<2^#03SQ&-x?--rRsuNKe@$&x|ln+f0G_oP*q~0{TSH{d~^# zY&rMzN%+LhQ5c0BPyh&h2Hu=d1np1Y6wcdJfE*YFN*I6vz0CorPy~fe1?5f#O`7i% z&jOvz03Cn}&4vI~fGWs_3mt_GDADW8(EqH>8kNl|u+eOo0|gj>6qr!}*Z?Fg(j%44 z6d;5Y*Z?9mQY6iW4Il#}6;VRi00l^a3f+JhC4}ruP8EGh2MtgE7nMy)kWE5RfNZFO z9B9)U9ffC*QS9u|4Yf@mwbKEm1O=$j9I(*=SW`gF20^`11)zivHB>|$fcqo_Lj6-@ zAW~e|fB{8@H_c5HZBH|`8Wv4cO_fbDkWfO+QZ|)MMa|Fj%v0Pn(l8y;6i5LfmC$S; z)ES-CIDJzYl~r1O(_6LG86DDWK!yPj(kd7L{lra9^;EA!Q|wezTdjgoDArL8QzWI& zWM$Rg^ikRb(j`q*GJw!gK+juM0C9y-^pw$a9oKT5O+rWEl-r*(Q;x*pm1zrXy z1nM*aZb-Ssjfn3QRO4GlQTYQf#=MHnIxU@JG8yps4rzY`zl`2Zf%<_O_snDgalfM$gdW`uA9Dt?B1{s#hZgJ&>fX8wnJ z&S!m&=8bq~W(j18_~Pa{pzQG_bP9m~83VKfn6YW&L37G6F)|+*vuFt@pg@{}*-;@I z`y`F%oz!tg2y(LFnI2*~DkfSi9n+!@fM|&(F6|v-9PDhyWoj<9ev)f5?V;2IzWN=1iVyvW7GU0<(v@g)LH@>`^kYrXZzrw0WxKURpcW zVLA!usZ86YGUA?b^B&`(illD7CRPY}E&(@q<7|lPf0$!8$bw~#fE-X}gdl({_~Fqm z?M{|v7-mlywzoFwh%)0I2Rdy3XPhciLn}J!=1~Ldbd#TG(z}hg>q+V`-QFVH`Lyu) z!jr=7dYY;)R4YQFAo!UvCwjzWnrtOosZ$mS%myk%W{79#XN0JSdQgaLAcQJL=1PWd zbEr^+aBui7XpJCmWa(;%_~Jy<2vvfm-1Z{g`RMzyqj`dY#L)H-6o)D z`|b~t?g6K6+_CO+azl*D?u&~jev)iH!yQ>1?=3#$r4HfPF5(!5i!UB)jLbB1lCfF5RdPjje<_lJmwct8ky$9EWq2z~JHedqU>Jap;j`@Igd6!4y5-0(eUx+No;}WQ3Y@hh2sQ84S_kWNAMJNL)z=VI$ z_hzN&iVE*QJ{^y?tCJ2S;r+(;% zexGTX$Nz_gt|G`Txmqvx3QN3?SSc?8gXXcKliK==QoFoEs9eWJNHBnW;D>T3{SH9= zVmNytTK(C_>Ujo;2+y8H`1gi4H7U&i9o@L8aHzMR|8V9ki|5N z>uB<%6mA-&7-ZSC-1GW+GCFJOF@EF-8Cm6!Q@Pz|u@j zj}{9cA*73^03>_}0H#=`08B+n0N^7essI5{`2f&$X;Zal868mTHK|bm0m4EJ-~-H4 zwNpg@5-x1`Fyh3D7b}Kjz+R$N_R5(s&|whCnwmFr?(F$9=+L4^lit{c4q+pwCYp=* zk5EB`6rcU87g09sgbV-WAe3#QK#c@^87x77cIc0UGnf9Ca^=gH+-PE=+1#K3!gRW9 zUbhpJvULVE5DjUR5vmVc|14!RW$RR=VvD^$!068h_E%j1_$u-#QXv7@mJ5uO<-;xf zou$?-x2RPW08=pH10!Ix=U@Qnf#Dxx9eVg7h{ZV8Pd?bNA=x$*7{CB5*SYv2j4{eM zqd}*ow%SCLL=Zt1v6V29FFO)Ii9r!yl*5m1U=%?PukFa>Mi=c!2|>SsrkqI3l_mxM zmt1n=l1t9PgoixJSaoFxmq<#DWt3Qhg?K5Zm^y}!LG(cLMlboKXh09m(0D4Usj7ONjUuVm zQ7b=ogxo|{8l(_MwsJ)4Xjq1%<*GEM8Pb}XxueXR9mQ!L04`7%(wze8c_^R7_$ktR z>bX$ZfoQ447FGI9MPYl4m@6q^=oW*D3w4>5DZKGEW&l2kEQ5_FCE5{cH3pDcO|StA zJTR)QhV<%0B|NFCXSfRN>qsS)HV6w9TYNFb8Lx5Ou*DQh+OpPCB~qg9!AI@?eD&S; zfq;6UQW$%Ffnn6PZAoa8 z!R+IVzg7TDFxOps-I>9~AUx4Pq}5Z;zz_rbHEA7xJX**SWLOwrdes@1d{-5dm0o(6 zrFUU)xEsK>aXDIev~&f=l;V0xCAVLL1HLrnnQm%}JiX|E#WGIFV-GfoSdFy-TC;sR z>Rg9CcIwH2l%>S2hvqhSrG=~*dL3r+a!6%yXc#I1CdP<*c!nf=q{COfJiMC*aasT)FF>f^nip$ zJYtO`crXg)ph*TXM+Y%jn+OmIgbW!DYtr_*U$GB~8ZjZrPzb{@lCg}7*_1shfdne> zgC9CTLM1AZ2s>aw2L|EC9*XG2J%(?5wW@ z&oR(~vQ$;u{6`6#$jyH&lp;hr$Z%{G9Ca?Ii+sE&Xfn#tp%OJDocO2#Okt2RQP zXyZFp+R~}c=%u{5ULdm9XYq>nd5&+;xv)1+1DR z`AfoZ0urA6ENDY3+R>7>w5B~RYD2qWFAldew=+OC;w#_z(zm|$y)S;1CNi2s zZ5kyOqXi(?E~-}9@q3FHzx+mq zuHPMBohv}cIPZ3|6<}|jrySk`@OhS1-tA|kfDG|X!5lXJX)}8~)F5}D$R9{@Wr-2j zT5dNb6d-1Q$M+!v@XY{LZfzhVd(!ru@&+az-<5BG?k(3b8PZ<&Ecblw2DiJsv%CSP zH@faCKeT;0?$fHf`0DM;x&yb)5tHNpxZU-RFBuf@3`OVQ&{-zL(P`dgn>QQuV%|X1 z=iB$otNzNUr*Gi1@%lz{``c3wH{+A+`0zo#eUgV$*B`wB#J8N+DY$g7|Ltf^i$33^ z$9%JuUiQ0Z0~rHQw2u3p@|klw_R>cN(vS?fuP z#Os~z_qJ<)|F-LUzEzm{@l{-~!P^F08Nsn!0m_%f30=I+n*d&%>;)U))tC95-^Y;} z>-5NPm_rWm3TMd1F8S5svDf@k!3Ql2v;ajp%;r&(M4NllL zf#5_a36;BQ!>%G)^NmR--juBQ{neKWN5FMZo(#Q9U>eLTQ9-*hVRi zBSonqHZkHq+|B~X8a&4T<8zHb2M|UfG=Mzj<91QkF}esMSilMdq(BZNK^CMz9wb60 zq(UwvLpG#CKBPig03vYXC6ePexq)$HgDn-I8(0uc<-j0P1R?PT26<#E_9JEyi)OXr zt@TzjtN?)3KsKF%5ujvq7=jlRmQLP}7Z?IX-pHwk6fQWlqW^VTK4@p2Y5f4_=~|AqXyR7Mh;n+SI&O(dOhlM$#B_)zD`Hey zY6O!=gfGBmXONRg$c7inh-^w)R<_bsy5)=9W?I%oNzgS!BWiB#i`Ig_Qb$+)NHf<)@PE=RW`v0Tdwz z;gpbsP>@W?LC8uFCd4ASMkWeLfj%c`9B6b%!AwX2CcuPslz}jy$#n)*c5Wg^glSU- z3EGUL8D>ETIZP)`C^=?CCWcTJB*}%c=80aVc}Avsy2x!3%Am~2(L{*ipu!Y53x6EI zE&L6F@W;)p1(EuI55y>8)JHL>Pz$w%T1bF}9DontjJiAsqhP696cv|_8gf#^Z2SW$ zW+K|4;g`~eZ7?OI7DS`+#zI7Z88)Zu)MjVUshBv2O2h+8RHq{Jsh?(+VC|)#ZbU*g zkwWzUh_ZI#j_5{_5E4eRpLk9yP1$P+m?&tVC?u%pBe5v%x#*`NPqj!3td<2*fI+Y7 z#keS}up(@!8pT*Z3tY4X#J0td8ij94%CG8)QsBvZ4pp&g#7lu`a+czkqN5n*E4}K5 z%WCVD$mwW!E0{>9o+?5uz=(rF=&gVivKGlv4n%wn$uk5=%nrvVqRn!aB0@0jKsfDa z0Ib0B5y9HvWWK1#{7%B=39Q0us=5V^Ml9Hd?JW!n;hZXA#7wO+!h=wY$RGvCLJF|H zOP&y`aU!Odsw}dCAOX0nK)@`cy1~rGDYtS4&PIor#KcVa?4OoZpepNekj{Q<&t6( z+N@|S?zc8Bbyx?-L@sen?mt{a4)|a}AR?1=VhOayL(Qu%gkmco6e0C1yAl%2>hHal z2I|u0re4Qw?u}MJZ0sgQU;s#2s0GCSL136m1CLD0K=8#LPhJGZo-hlYyvzneETaU5 zR1g*PCeg88t_oA{1^vdE4oQ(5Ns?^u`eKA}AZ`JNMwfU=&PoTF{DYaCt4gN-t7CG6 zFB~O93@8%E>u)&aGdQg;aGG8<f9oCtw!r>H-fKNXYS&aHRZ232#VJ z1W51*&xG)9VNAitl5x8DfEd3m%=9K%jO(rQCWg7 zXkfw`#Ih{UGA-BgAXM@YUovSvW~LIb>KgDTgR)}W0v>NvEWZqi`cV_9B?t@Chx$Il*;IT%nf4%ib}t+aQ2R0#M2;r^GOi& zitGV6U)@g0&O>)iL>Hyyl4Gtsk$)Bh!)&IN{O3soC`VwlXlV3Ffb>V#Gbi8kN!&wC zkhE49&lsl*^62wo?9TB3FYX}5dq6B<@H57G^-!4t4}ohlW%e1V{e^Dd0gFlz|i|XjKct4>yNMgN7!s!Zm0$M;x$)K#oZ84SduM z#42xJe1+T~g;OlZ0Z__<^o3W;4FkVL0QhEM)P?V8a9_YJs5%Al+(lS01z-fJ950U$ z+(2jKg8`@j3X^4WDop#*aB%z~k_=M&wr^i0?#Q99drdC0(zijhuQ_ByfYa3b*#>be zD*-fXLF`lnFeMhPFixS3j?inhKGbHEHfWr-YIig#oCy$j^hY!3b=3A}=mc)-wm}?l zS@aA5_@>I>M<(b691u^Qz=87WiJ$09089a{7Q?Rg^Ph{5V%dT42k7Y%$sh=foG ze-uc3hzoxJJwU?0(C)B`3;vY%KiI=Ip2R*t!!Q^?Nu(@t6s{Q3l+*qoEqRS$6AWT^ zldLENA$*e}Rm4sO?%y&};KI3a41^k%fNzK{h402hKXp6@>~&~(YNz&w|3ewng880A zH%tShN4lg-dMH%7rK3S8OuD9TdQY7AKd|S6SP08pi`gaxq?|{Nzf0`iZ3df%kk5r# zmvn#RN${9;e4Am3Pi8WI0D*!75n)tm4dz3$KjR zxLVlwgYbt0JZ!<|Eu+A-t1JA$lgv`UD%<`Hg;0DyQ%j(`(ot2%Z?*@?wbDijbkO>0q|V=W%VU^+YZ!mG|9P7)gp|x{32-~Nlj)B9Mq(=r z5Xwq6Jc*CICWSAF(3%8>f5w;WaJ!>+N8^D?d`cS$pX zK`>wk2=u@uM6Z{^rVthqZ&*nYGD$rQqIdFC+OanS8Qjgp+7dqeqDjMOqY<(xp#{3c2ym|C^IU>IljUHqd|}gI(ybG;#`NS+i$R z)_}y)C0e&{&l+G!rwd$y8d9+|V3)65iDxac+}L;C8pDSXCsw>>SYMTFU-mUv6KZA4 zmoaD7tXV3-U{+s_vUyWxNwZbTN__K zpMHJit01+QifyZBCzZJJYP!-eI*q;Gw0n=c16}*BnDFcx52NxJWH3F9e5}RD#iyNZn00r73brm0Rs$}|4N-ikXXeYg1iZkwCXf;Ex`_ZY|TLk;gYZz z3WMzKLXFl-(y^7cvkgQa0H_jx0DQnmf&+rO%m*x43{yoV9@xeTM6&V(3Fx8|kRa+z zv(8DreuQsMxQ47tyu8Reh!RS2`$r&i68eV{LLL%mAVm}U^Ui;k%Ef{7w1q1$>Q$U<9zA}F-ne+US-gc9zI zw8?1AsubG3rUW3%V&J&4m;(a1{}liU0_eBX0}g<-m`(!*fDumvX5`g`UGNv+0A2<4 zkAHj3ctTU85kne?mhnW{Hwi2T2P-Z~S>=^kZrSCRVUAhml|fi5BMbJJS?8U3?s?ih zYa@t|90vL;0z!(;VjxP`J@=n;3D6B)MU!+FUbN(u5>t$*ytkNu_wAPv01i0u>jN+X zyWwK~nAP55Pzm^!TLNy1>=WZg`vU-4)wtIN5IIMT!IPy(I+9sx0fZMAZ`|?6A&*@0 z$tkbg@dgTE$pRBB@7(jxLH{|zYL6^v+oHKO*O!5wiQs8-6C!{hr>o`-!*{Pv2}%XE zW~pn8;_jDUfA1ap%76nH{~PU0-&P)@f=7H?ON9ei-fv!?FaVK#k{Mi#b09i=AUF$@ zGxxM?=KXw_L@$zbB(p{R^?`Cg8X?!6hI)3YgS2{m-C0wdt(i!Ady_!eh$kzuW#kr_ zSRnJV1YbMjvcgR?sz3D9>};uqO=GQ0|Aq+lQLfeVBO z04qv>5mUHZCJN?)SD|f+8DW?PHO7e!f*>092;tzsHxOqSpc*JF9}+3@EIfwqh18Pa zKw43PEQsqLIiMO5{|TTpK}8^uhD4XQO7IXT9dVBZ$r=+gG6jMW3{)8TzyZP7NsPFF zUkCVrCri1L4-m{J9|)KPb`naK?Cq3j)EFd4U;qEN7&W-?ygbOt%WldvZGc_Rkrmm{@&+84M0=nGBKhBv1h75C^hGOLD&{7ZkvB#b7 zY~Ndqgrs+($97EG=s);*DS?i3q;z-@jA}3}I}+1;S%|=(a!@FiRlF^T% zM4y!msbu^~|5Bk|&kIQ~g!xulOmh%Gk^>{-!D~b&;!ug`)u}F(9bRuZT725Z zrpjcjSseS=gYRZhlVa=eouIe=3GpOo@sb=H7 zh1^yaWQQ%&4kVEixvCpL44l@EHM$smpKKwU){okjFPD|@jVnXpgI}r7@jpO>dgho%ZynK^h5JHZ|Rb$+KZ11#T2X3J~E& z8Kgbuveua(9Tt?W9Rgg1%$k1*UvHrd-j{E$FWhGtx3H@)0F7@z-IuOH6^5OI0VqHL z1HeT#INotzvl}Ds9v_bl!sLTE?JqKyIYhpi4STOJzkJa*MdA^Uf&4q*v4Np<=Skv+ zm?HvBC)y(!nFae&m9N^qYSRa@)rXR}=>#Abl8fl=$g0(+lnVj`z}ZXhkC$d(p*YN*rINFHOzF&sTA?Ts+uozw{{BJ^+z#02w4#z}vIo zcaoDK8{SWO3P?Txkn24gdfz|}N}dh$ll<=O|2w8r0Dui}9Q!0Um zukqB&zGldEJa2xMYaj+m0Rf8vL(6FFCy16xH+Ih15=$~rZy;3f=i;H?|A2Xjgd_!F zYXv`xspJO+eM}E$um)-B27Mv(Y_R!m4laD~YJd3&PXS~R(ZOaePGxD+XVBA^w3tA1FL0beq89!>&p2rUY+ zBhWDs6OrgJ0pL*Z9h=EoOlRpL@99RbhW=rxd`PP3C-SncP)eY$oQ_?tav z%np+tB<(Qn{$>%=r18?0unC{gBU8YTpb#Q2EeF;QE>i&H|IUyLWf2)MjS%=!{>aY> z&G00%0U4fw{iN_2=#DN?(i(XS8zGO85@M;Et^_8c6{yO`Mo-%|@AoLPTRzV!6XNRD zg(uC?=cFJt^(`HP5)TGK5fq^)!Q<#$?2oeX=@vzjWJhW`Le@MY6bq>a#ZJaH>L5KL zA$tuMHSG<%kL0}2`^e80$FKan59FGVl}GHwqds!ccz;=XKSCtIT+qs2Ho z0y$OABkQj)=MM2UZ96-S8Ziw+>kiY{FVpM}4jnVS{~%MDdJ-a3VKGotF#rKTA(6jU z(6b-{I9o$TMe!?(Gc2sgy_0txAQo!icnzO7v<1lp!8%Q65V{o8?I%!a=JvP1UqLLsU!Q4J8PHHz%b_ z;pIyYLdvos2MGW-%>vuG+OM`Af#-s3J&L< zNsRdO%4&Q zAQIxzf-F#+X2=3dP>4)J9<^B_wIE`P5VWlz{}PF+Jgn&!qA4$}p6oI5meseY5?!v! zp1hJcofJp=X=~2F1Pq~E&GlT-HC@$pUD>r=-Su7JHD2X)UNvA4ZdE1Ul&Y|W8yjU? za)4d3AY0<6ri|3JS~SX5Fyhd~ewJ@(__Sf)tA6N*Kno(8lJ6-Ev_`!(P{EbF9)vcR z6kdJ=0U`7Ez!4{RXuWh#CVQkICq+;Xg3mxUWSeDVaTVF_h-M3}0#gUWc=n|#&u7oWWgi7*2O?Ro)ed{FAUbg& zXzINvks$)M5~a3V)q_Ez%{7pAGNN>8|C#ntoEBfBR%}o9b&{*c{7-2+b#Lo&ax)BRO)lmx@o@ z7dMHvg;IA&7qv)3mC+8?(OwkN|LWH*?zeM4mlR_29~9wpLs#|)m~?MzHrscqw6-7+ z6tHw-wK}zJ4??(p>mfFfA>4OPwRaA=mqgL`$vPO;K6uKEmLNu0e@pmtp?LOcfheWd zg+*0;{SYFw1%UyeG^KU9rYZ-%n0CF6a&;G5w2F6cQ)<&Vaz%ECb9JL^*GX`9iD9gX zhmLcnIDeS9T*3uWF4tip?;#9S_i%Q-0?QXBQEZDZf8^IuZ9s7N$%J-BdT~i;(CEYk7JLI^Vg5_H*`nv1fOJs_pEMrc!mwa7c|T%@rh}uvcn8C z2ZoEOBv26B)?zcyzIfJT|Ks>xRkw&WxaW=(hL5sztalJQ!hz{GbM03(Q*)K2IDheA z-!?aH`C^d&p^&H6EY_Bq%9gNvnIT4xkxnwc!j7F^id}|zeJmOp zrj4^vXGu&>0c%-XG6E*KlGlrJW0EUbT8Nn$gZp`pJ~>E2nSH}WTYO=u5@Kyr>tAUK zuV^Y@h0AicN?W8!uLQ{{T|M{GtYBVoJGXVaURiOi-FJGk3*vZ;B!x@BFSE(cB;!*tbkl-hN&)(%Ho zx~bMSP}xb$8J)2gZ#Vhfb{da*x<`l`en=U3k>+oS`MEtSaAjw4saxUP_IAKBwRdf` zw;QM1?PjEnai0q`%<))ikAn09o>hR0qqS-xsQO{Ttn^N?$HLtBb%|{&f z@L0CAy+XL1NS3`1|6=l}if5VIvx?~5!M)&=X43`TzQP6Hua?NdPPyrEq>uaehW2Ty zo6^Jl@gUi~VcHHekQ_N2&Cdthm$cy-zezPk&nazOMmQeVENryULG=mnYe^`<;U@d4$=S?RIhzrCtFWl*k09f|(&KshmrXC_Z=nZbF1`?R*XTr^P8%sbp ze4!QaiX`c$cxxJnVn=Fk2=OhmHT+%7S1q0iV4kHm?5Uk#aXxpjeW|LBTY}oYEWf62 zP+M_%^)1B0^9;jP+jOsP>ak6v^VHa&r%s3lKGNy3Q=o=a9}N(U;6|XEq!FG8Y%1_sgnv+} zI%WCPY0$0znyvT}lhFdt} z#)cg~_I*7#_F>$07hinqm?%c01I-c0l7m2Hf!PSO(%kA_jvUW&0Juu1dJf(QM`H}j zoi1vOyVb7#-8j7Z^#x<+rM>s!ZT4Grr==g%cQN2Q9}fpih%Zb1Lr6UX|7DXy3DF6Z zg@OhCqg)n*;3trG7lB7%S!a=VA6e(^m)<~xl#m5UgK3pvc<#-XP;GpPlps}aN#O=rPd(YV0UCgO*oy)RF$AoD@Zly(7q-Mglce*Egg}oPz#i>YPI6% za8*)G453yQW41N25GqCGQb}F>@Jk|3O%S#SxhP+k%?(sf1PkUcApr(%otdyAk2p5P zBhQtMoAt010i|xNoixg`9^7<)!tKcRLsCy&HCznqS>-?V|3KU~*UAchF(uoHjg`a% zp)HVcC|2(FL2z$7kQ>zsPFdg}M_RC0HC=VrG0Tw6 zQpR+#r97h*1SlEoQ1+f|fl45h7!`!RH6X0)Zg9`S%#;E*Hoi5mAXQ<`uo{=Xpm3ug zBRt4HYC)Igndx~3FoX+V2*Vi4aE3Ijp$%_{Lm0MU1Rp7c2670*APNzORzM$()W;fv zgo{Kb^3#GCsistLh>4vs6Jh6L@%q9KpaJ)|KwHfAF(sY?B)X@h9JsW=7<2# zq9Q@Rfy-`b%-KJhlP(A?XgSXk%mkI^IEBqb3MCW>9uUHfGNjO7sbb+68*(|QWzIb7 zgA3~(X%_^t=xy3UW8qZ7keeAxAZ{ugbGGA#no$ZRiE~qfwo^ErN#|Q5n%V0PvOJv- zk{~4hxj?R5(lxov$u0*X z1%XHb517EiA%%&KG88gDjC9(6s96wZn#`HBf+jr0RK|jwky}C8W|jiUm2ZkuockE4 zF!8WXcG`1=PrGM@2zDWZ&2vLxLSmjAicd|d|1557>*gTW8P0!%RHXk%WEp@-mSf5! zU@QeT{F%c_Y;?jqbhHW|B%I0{AC7%uir~`rNLGnnTX{yJgGD#{o z?poB5hEteIEhbk~IuVu*gaDiB96`hwnA&wNu`NZ&C?iIa(UA;hph3wpYZ|AChVYq9 zMQe=IDiF5f&LIIbEO+QS5j>P(wPirZA^-7O*!}|@iV%n}YWvrAI`y4^av;TS7894e zL@+6lDxtVqf@8hJw;+4TTtwtsifv3(|8jjSLF9>3iq=VxLHW=bC{Vueig&!^Ew6YX zPzY;oQg)r}(xbL$vx3xPcrRPZh^9HBEX*`FLfr{Fr~%*r3wXc;21jleip-~OlUNL_ zmgxxc;EUm{C7UWp4l3+V$riAK4>K)x1y=D z0auVHS6DNC>>b7S%b;qp4$!$9|D8grTVb&ljI7#yoLP6u<`jYUAEMRWb2(gE%7Dyl zQ8W!|VFg%;2$o`n#oz`bMu=+F_*o*$!P>-_+?E)Y!Hs?$%(P-zgPhq~Y1YY_GfkmQ zce-bDR&4H`?6AO?PVc}b6Qje1Rk3q&?Bqz* zaS!6|gG6`S0|`1={}7ZAk5v;d>op_3r#5XqMIRsSt>)~~hZ|6)fN7VF8O!jt&P3#JhFa7)HT8#7otjrSRn}#4?2?qd-~M(k znXw(;aXZ&K!($l$8Xp0dq=bQnFZ@dg(Z+65O!AXiNeQ-7T$7C3DW8|>Tr#$%aR)2f zZF92%>%O$R%PH>;xwbE+lbDphrth5k`$Pf{C>zUHZJ3{9>omr-2$&;UQQ5YfnI+ve z9$$%igDRzRJv!r1(BG$XO5&nF7wJd-TCT??>`f+nG10yu*LDua`)S(5@Lo>7mk97- zR`!7iXeGY*)$kAp|8O(&e;^}9(dHS*;(sea5R3*PpbJv$ zQ(SVDF}4Fh(c%&S5Z)-|Ahy!YJ5XS(vcm5coc=0JW_F7bh9`N5`S>Z_)@9@7TLhGC zBGYc8hiydj7giQ5zV(dCsEo-7Va|nli#J+Wp?QlJ6H2Fa(^y5!bYVu*ZfN zGZoJO0B(SSqqIAGvo)!NKf7pfSZFP)Xb`O^Gl~^~ZDoNGkPSvNfVM+t&nADEbyFZ# zY22k|m^Kq(Rdy8@6#2Jy6loAUcp!79flilAU$-@UqkUN+kA@aHrsjcs7IUgLbK56+ z74(m-b0z6$6|eSe{=|z4ITq`*4+V7)wcwLv@rw=teDyY09jQ-G_bhV}l1%w&c*Z+d z7L$7R|8gIga0%vQe8Wa=G?l8yKyncsI#@@D5^AB*iwA*J1W^kpbP(zU7em<)MQN0$ zg_J*~lymbBMzehoB1I;_H+mUBJXaU#=Oy}B5UVDNJ~K**X<^-lDKB9=fAL8RVTX2@ zkYlwKX*m!*`42sb4y52$Zdp=e0hb9Omvf05beD;0QZsv*N|I77QzcwEgB%f%f`~zw zSYnt2v3JUJmIk4j0znF-@DHRgPM9DC)bI~(sR+2W6{U#~r}+>9f+BF`Ik&kwAcrM0 zn1Pr0daKzw=D;^%v@ZE_E_Xz0Qt}$Pi6px@5WR^>zez$PRh-003YZ`em_VHBbX!8% z|BzO*k_`be(b9NVW}w;l5aXDKGl-L0(V&L%CEjU%;CUIT#3mEbpj4TPFvnzAxo|Y6 zlbK1M!&#rgxu2MzNdAeB#s-ljmoF!ng0Hx52Ff}hvn+a3E^QScf>Adbr)wBR^yLeGdNYF286;Am24SUEcrff)BVhUu@JSXZ!YH^w|E2?h zRCje(Bub)bIznnnnr^Cboi&JlDT`5gD`;~`71Ni8HDT`76kT~`uQ*{MLRGh#4SXXp zmxLe_(iy*sOLe(cN*Q}znuS-nQes*co^h(X7otItPOOCoYxxi6dafv>2!4f7TmhX2 zv1SoCtirdKq*Eom`g|;rZhIoE-WPcndS#x$I@TqxP)R`-v#-m+Y@AB1p=GUCSd}W- zq1*aYqxdHT@(c|UB!ZG_&*CTrA}LuA9q*MC4-zO?#DmEdXf-+ z`w7Y!6z^&f$2LkZQ?ERze3{`K;F69Yqot14Gq%<@Ng-}Oh=+$GMn3pC+tEgC*o58^ zxGVv+mg~5hp|H=_omcyvAYlb7rn)Nz0*+G$s|&j)CaPR$LC9CMMCv}jlY-B{MHuvi z)1^AZsuL}XAAVa9$A(oY;S`LyI;O`aMl)sxkulw<5a6;B(J~=&Q37IQC{xl^1~EJn zB1$XU3Ph6w^^m-wSS_L$zR8QdvqW^HRHY5eY1+aGUVy*(tH1lp|G)j~zyAxs0ldFw zkP9C%2m*}239P^i>;>9_BMOHmN1+vAqZNl5E%t>$1auk9cYto26@(|e1B028M5~+y zr>JRf^gBBr!NM)TNF)YI~Ov5#7!#9k>FZ{qB8o@kRyIgZ&k}%*TCf#a-;RPG+$Sax|p|E-nLutCL(Q7jTW@ z$d6nuszVk`%pOiW5KwH#xQWMp%*mbX$({_zELpJzQHf-s|0~sDk0Ly2m@~&Z6`+}{ z$y01bQ2+_GY|FQd%ekz}yUfeI?90Cl%)u{Gqn`X_ZNvdN+$?IXsYXOmy$PzU+ zKwSqsGvm)s;f}!qhKfpK>*$m@Q!FcMcl6uPbNSGuwG{^KhViUf5j$_4#e6%FQb568F|5y)h)qqQ(+wC^2U-9q@jI4 zvK-kC-I6tyF9r!QpNAq?VH{?oEEn@w92SAO=0;qz!50kDeI3U$y`gk`!qYbp`TQ+~ zA}(A=jW{?T;}q158P@$=Q=&Rm zaj4nxBlg`DtBq!@T+`#-v|Mq@fhZFhn$pId-}Sa?Qgk?K5`}tMF$P57&8F25Qr%iX znYV+Tm-XF$P17Q_P(zm!&Ya2(VVTN=-yQBytM+-eQ!Ty#0N-*PsYDW=HyJ2#sPa}_PEFU=g8Jt`{a1@xaWB5Wqf(R&Zf+3b z2|-n2H_NI}zr8{zwn4(5*3vQaHSNZgYIz<$f;c9LeF2{^Q)b zWw_zq->S;+#>%ZNht(|UG7{;ZKIW9}|C@@Ab&SrUUM}k7h|R0cQ%F5EP8}XljmfSK zNTF`)l>_TgBkSBj>z9!|A{X?9V=}xDM_Dqbjj$?y{MEULG-t4VT?`&i2CWGv_ zq3n)+?_>no|IR7-elYv~8vRb;0$=ausPN=Y>hWpneuwHgyX@dT>ENuw@vY(U$lUNDFY@$pZRy6>RV7#Waq_1z@me?U|IYF)zaH(^YH2GdoM#8Q1;G#_NM6P7n(&bB-F=fuAS<_}r4XI8RGaypp%AW^Y zn!8!lV6zoFA=NP2)aWTAJ2i}R+R%`flXSX-^c7*Hn;alJax|EugqyPz|55VlkPv_z z1jhc006=bp5&-O$;OMoLTmk^RJ`)@m0Hu{?(Ne6aHd}-&Svro5fY>I_k#bv zaV`O`bqgM+L^y{)|G_?et5sX#HrX8CX<|O9dG&ep>D9LseUkM0^{7uSh2OdL$*G-V zo75Vz9)XQO%B`W@CJKuou!;jI8^NA=i?6yqVo0tDy`pd;0Nfy~BEs4d@IZsOt4P5K za{%$OlFC!5J{DVav8eV;dhf;3L{;P48rKbzMKm&!wvuGP^2Uq5|N{zIBHV7naDHAyd2wfGshTtD(xZ~Z7c>y zqqu2kpM6BCrO(ZFET+fJ_A918h6o|b7X?im?m92|Dv+asd}&3k9GrBnm1mwgj*wRD zaw7{#0mx!R|F4wG!40|0>GI2eN~n^+N-u4!u>(i^r#CcXQWK>W-xPLO_2QhdGeVjx zLBjg%#PcR@q-dy?T0|;C&p@NX@3lgIJT%COh>KuWM?uO$T*QPEE}IhY@+Db=vS{w1 z2te#AtX7C4Ad7$UtvA+O?<(lA<{k^noVgfc*Ijtw4HvRl4=Mqpnto-ISd267%vgua zp(Ma;2np~Xjf65;B7`ogr?QWjP3SylRVymmJ^SPn9a7LS=vsrYeM(y%xvk1jL^ZC8 zk`rCDI9Q{bc6ug`8OnE5zSshbug4;rY(g)gW0E39PhEKSrJ8?5|q%Py)F9bo7^Z<=@i#w8gRrDZz$>z`DG{qiX&k6yXU&5Sgi;o zB;??PYdrhLv~8l9ZMR9m#2`%EzE+sL^#*!Sp`9WcT*YhuXKCAW2b}R;q01thX9y@^ zc*#jTlIv$Y#GKiV1~e_^rbaiY?YG^o-fm3F$ksLe{H9%Zz;OqEe2jU2h*gAjE3@+C z5v(Y4hH{XMD6>vF5(>_YO}1eM4(<6af1~3MG5FQaaSOM*JDcX zlL$o6bM`X|I?8ayGT?z)|5zg%tEC8?{R0m^yGa1Mm&3>DWiS~sh(H8q5d?aPe$N;j zL+bGi4Jk|@0a_#w4?=)WaikuU_|CiNClO1AUENL}ipAwFVJil*`f0IHT9N|;I{U;)cugeRGb z^hRsU`UfEhpq6J2ua~C^BVFnhmq%4Gc^?^zV$xEPB1y1tz(Qp^Q>hd8z^82K|8b>F zU};Ny<`b7XdL7?n=RF+);4cIS6{?OjnJH1|IE8db@_^SCR?gFr$2$_mIzkA?wE{x3 zn&{?qNY36F5;#RHiYeWB($A=JiS?|V9dQVxfFjZ^T#^!C{&Ae(u?mZwYe>F^2gwn( z50bs4CRr#-7AX#|1YrT;$Iq2RJ( zrL`EdI8r1)(r880pjt>m6E$jGJCcJF5>>D9%PahlRKzMa35n~xm{twj6t03ME_lU= zaEiJauO<$xed8rv0PvAw^06+flFX5^1Eq~b#v$Wc3sBqAK1VUCs6(|Y|H%j-5p%q6 zuGH)bQ6l2kBh?C1nnKZ45Bpoh!c#`-K^k+ebkxp77IBmPXJs?>lXK1MT+lgCrV56a z2}Q6g5dcdzvT>mA8l*NR8XQ~rq9oyHRCvwF!B5)j5RFdpz3XaM3Em~$y!KW_z~!$^ z%=g{!6hu*!h^AR)<-lrE(HADFszrw9hI%;gqSqXf6SJ@=jX>BJSqKkIlnXfK4iKQ7 zF$Zt^D-x5QSj8gY9m1+}7H^)aH=H7EQ^}bFUsTZ{ks&KcgBM8-Z_+EQT2*g4r%QJ+fg>(BGrQ6 zEz0UivXbzq@=LOfIB-Y`84}X6fS8h5#KH^>$*46}>Y6k!8x#fMYD#fl1Hnj+ z3*v8$BKgFS-gZ{aSDoao+9f=Fk-am9Z<@RrVH5|Lt5$O)lgFDuXBkfX9fO5)UuE5@6nNdN~M#J>BMrnO!S>XtV8D^IkzmkkfR)f{)ggS*Y?+e z8}{*yeOP6WNuzsH?Wt#}EP|;EU*6L35kV&~{QB{Vy>9mk;vIZ?7Z%@Pa_VZfYatWK zYm!WuC=(jIF9Wg6Z%E1C$3vcclGh#O-(>lhV16@dk96u)5571#Km)tyeeZq$d*BCO z_`@fD@q2%P4(y~54={f7o&WseQ=kR9r0mT-vs6~w|Ni#5GgdRa|9$X>U;N`IfBDUS ze)NO?5+_i~2-5$4_{Sgpd%ywpn``~;x7xS)M=9%b=Xy7RJ(rL@{(}kaD?r5YKidJo zHW9#80o6#{7sYqAVK+eU!wNTb*X>oEvw zsGE?0BhDB|h5*7K9Kw=>4^^73rz#@#`np#vG7=BOff0SQ0cm02u{GJ%)+nn;i^ zLFxI2p|ln{0-%qqzK}GRb7Kg$_?MQb2dI3nC}YZ|ES8gOC$q#Kw5*$hU zYfPkxOk~6>;&7b!Nuhr*hg@5h&yx)3sFEhRuCVCM*mR4^AP#i_4977GYqE{xvPgQm->tqil__3@TKDrjJ)Uw?K|zc@G0ybKnUR9FsZ;%N(7Q3x z2@M+W{2LARE&+Mcy+Sp+|3C~ZC5}9rj>AZ%WqAuN{fJLlQ7^qxK7u>CkWnq+PgIkL zQ94k}RMQu^vTM?aHw_zrYXuW2hzN@aBgI5gxAfCH z^CpMz1+3gqx{?gLV9!hSh>qin$rOweJytI5(yRkhxu8-l(URbSR&tU!{Ub(D)y%$R z3xrsnm8p(?$(-5>p0i*SPWhuckyCq$rF@##St80hYRmik&W50qHr&@v;Z%i@Oag1w zhbSrnW0pnol2GEINOFinvJyHJoI}D0;5i5hX;?3DNt8)K{W6?yEyBJWp-O8iPVp2C z@elxc6BCRDdTrT#|GHPzbhCmq8We>Om*k8z{n*e5*|r#23865s8KJcx&Nc~17C}mb zP|7yRu_|1RA03ZR)mf+H**k-urWzTcjh`cO5u>dSr2Pk_UBR4{TBG0{k*zgdtB1d6 z*ONVn94IrJ00=3+=8U51?d>QeV~;nszR#4hTytx@(7!-QKP6_%Y~Z0 zL?z8#56Q;|^T_%d%5}ey-t6Nj+TnWK45em_By{UQWFhkNbF{!SKpqR(7 zoaB(-66+&PfuG(0&u~ezJG8IC?2sL`7M`2|viVP79^*7=9snPm~i;SwReVlB_-xO}1W2?1}WhVt@5zGag*;S9) zwLVAkjy$wrjtJd*oxHQ!z|Tk#;X4y1DWVMt(aNF9&~ka0 zp+cCXDk0Wo3D*T=mbl@kA!PJ0WM5^7{M9py013S<&zN{xhtTCyri(Nys$Mq0s8!{S zu|VB}K4ea2Wd=UvQ$FTfW@wIP-jhBE&bYhPT94pZ-3b%*NM&LUiS83aaUSRLTfg=r zXLOdoJrIIwe!6RZh+Re{evPwX{^p$(WWRLa<-%9S#J_a(W_w;7@Lef=1~GnKO@A&& zfDUMbU}dLq<@12$?@{P_W@s20=&ma0B|B)Dtt?D>!-H_wp9qRVq9i(@6A8(&pWs(I z|M_TCT4;tgA8MLsw`f|0i9?9R*e*+?&wyyw;Ap$8EGaUPa#|G_+l}TZE*)AGJG)+X zVQNE-VQ(VpQ-bM$Hrs@8nBmaDOxe#N^P1P{8l#4}(hcw8jv^%C_z$}9 zu6DVpk-13jIFJ!aA1bDcS$Wk8vTA$A>V3tCi%j)O=*wz>{)gc%jpBYBKAV+oaGwThIpb^#0x1R8|qe^00-m&cW%rv5x06Ou3_v6ULc0-io6;jyrSjH z=Hl`7;(pfGs-PeDoe9tV>x#B${|Z^4>J%BTwFB-K+jt~6ZisVP6oP^Xhb*8FRa?lp zsnu?XSPe>BElOQIQa-KFi8cy-nQxis?W%5aC#MPCc?{q+At@d>_WB7r|JTE$LW~qf z5OJxJdT2R0AGY5N&a)PBnmEf^1qq(n9wJ9*BmZYRzjK*z=%xu$TBQcUtd`Q8p2URN zOYi7}F2)zfVox`kApOkH9L-WcO*V&}J^{KAMeluqOW1W@?{#1Qbzl#6VIOv4FLq-; zc4SX>5ZH81hly7Q(h6^hvy7qrQJw7E&OOETLOg>9cmZ$!c5n}OaUXYbFL!f4cXUs8 zbzgUOZ-7Eb;AVGPj_g>|9PJDRp6;*#ro)DLsRR3KN8n3WJ zi!hBE@mIwt7(+L7bD|c1bZ`90j1P68teZbEh+O4PkpE(lH$#$t-G!WN!l*`kLD#R8 zW!ngjiqJK|YI@`)h$|-uYIMda6qzgUNl2H8dBB4;ID52Dd$nKtVaRrWD)Lxnb!Lxu z_MqA~Zl7^EvaQ83Y;y1O{?%;AG1T5`vETWk7)r!Xe8pe zuuE})T$G!8x?hQi2XdiejLqw%7#7-TOkzqt3oIgVsV;ob@yK>IyMhewK*EhO2Q|v9 zjobgNq_^D9zx(KrxF+m-xI+Cb8(imnwXM|}5Ux+I!XWNEgSNqmA z9TQoAi16>98#n(5Q1VrR06~KV2RTZ2A=^C zShYk=0F)+1AV7#x)K*K~WGUgZ>C+qp0dN&c$!v~iPrtS#SpyPEFNX304lH;u;lhRw z1J;lVr2&eq+z_fqXrSbQzOv+q?3in-oc{<#$U=GYKVPJM<^NQeg=*>4o>2$Bh>|1X z+Ja4@RB78K%#1Q8)-y`!C&-;dlO7)^l&DavNeLi5$nb4J=UBB4Ee$s)TsJ^V0BA+I zs%YtNiTZ*IK8sW5yZ83}yL&$U`u6XWRLmGZf0D8_($?R7xM`%@ZZE|&lSdI4^pSA` zMUY%l08I8w7S4qw5mOLZRn=8lomUiy615T*0A4AToQKLWR25OzDaBqvp4kSUMt%vH zqmDcBIFNoCHP)k!|78@QkcbhOk%6`$=$nF+Nfg0X*#Je+gUC%p$x>gfm?4A!y7k$ZMcEXhns8bsUQxB#nEw%uM*1RVAyYw+iJ@34HQ(qkN4bn{1DT7IUbwwJB=kvm`ybWNl4S`lMxU&`2dk z!94?1mH&)8kvWubYtBH~jEZh@<`9xoxNrGlR7K|a!tF$5Qlc)oZuHAxy%J_a2qDKw zNo;)6GTiWd%sT7vV9_!vF-X-$%H*V#T8yS`9*4x~VSN_!r^P3uJQBny3q~=^6=6Id zwj4{GZ*;ZUJW{!ak!O}04^vumX7wf0fQ?nf?vkqtwx7>5nUANtLl zzBdIYqItRCbRl8Y;K*s0yms5C^9XS>tFzv^ z>#xHeyX>>mUVH18AP(RNw)5V*@3rqCMB*|tUeV6uS}wMRAc_5Ws5>i9kx(U2LP@5n zs){^A=9FviK%sjSeMn8CUjDL+0cpNP7y(!@&{r>>b(;~;4^$5HN1$$~l;E#tru0AM zQWW7I{lr72;Y6SW*|~>HALLUX3;828^HuGACn=EP5HmAveeNG*8ORPJWDZUJFij0&&b@#rkWe{~G$;(> zKZ59n{82l{)kEuKnY#>=-3)@Ja7nU!E zKZBnQix;I&eJ6pL8deqwaH)kHq+B^12qFAMMY?X#-C1w1@9_w`qIX>~%0+{7)cRNZ{&V07|clt?Nb1_6~2 z^NbQ+d=W6i$P{HXC5%l6(*F~RnA4mhQEW&UOOdZJPmLdOtf~TY*0f^QBd2sL4;dsu zQbi>yg_P#17Stda>Cz2qVGw5v6WEgtb})s_Y>qBV+uLrIQxS*`Rv{RaiZGKhM%myp z8=4K$Mo46UWnYopH<*2pVj|R_#zz!^j@`soFtfcae{9QL%;xrchRjqp5ZEAG2KO^8 zZD0vGy43YZ8MuMn87irUthD2I`{UgLb2Pm94BuyQx!3O< z@sa$SNDj(#F5=L4HqI3ce)ap0>DB@dwHQc$2SSQ{945PgDJaS1sr6#rIasGgZHUcnNlLYkv9|2QLMMec`GnP$K-Z2~N_K<}`5- zCxeD zHykILG+y)6+U#aGp7L~0CP|b{yl7i*xeSR$5}2)3$1!J`%+hI&TU?Z$$ZhB;VS%M| zQgoqHp_)|!VKvlT{puFRx^1%_Nv#`wYj1D47PTltZBz`H!Uj9jOvy$VDajm$XekTn z5sfDW!jyuX5&y{eYGP5EInioo^xEKEYs64lUug{nzf)fLw;f$#MUZ>aG!(O?Az5bT zXlg@fx{&qIs5z$mm{Z_cidwR+ zWA415J3PwCPMyqyCZ9C$GXQ|8x{AK!d?`hOULiC1f`iYYvApG|d->F24ibLgVGUv* zJK4)__F?$E*8*NAf!`8BSScst?gr|KzTztO-0vWqaw&LJyY#N4oI0%zxYjqyb*OnA zB-)rR;~Vez$5SI7X{R*SDz4{c=fGbjh?4+8Q>7AFFdI3*l|eQyk^9-iASMst{irlj z_5PV@g#RzRH4p!^#6RojE!i&Z36u5SL(TR}!@aU}&l27P-?Fn$KDG(oLgFXO_#{C- z^IP)!>H|&qMuR@Gq(2hsV}B&q4?oMaKQ!()%KIY0RvRv`gZINf{_>wc{p)Z4`{O_V z`rkkQ`~QIDli%r>AJCv5qNra;V9ObpfFUqo13KUXLSO_+-~>`&1zO+*VqgYppau-W z!USOX4B*cc;Gi5JNPyo5dc^plpu~jW%Z#9)l;B64;0jKJ3eq6Mv>?m8V4%dHN6g?2 zst^DI;m|Nk0~o*&B4H9L;Sw@o6FT7&LSYmtAr7DfCrIHHVqq3uVH8ka{8-))nw1cO z;s47p3rd*b8KPkts^J>4VH>*P8^U26%HbRa7{z6aM@SY(j7tjD!_`rQIiwJqiQyOq z&05jnAtGWTD&itCq8s|!fQ?yC{gfX5PY4}^a(Dz(k%)3GAGrnR?wOs_n*hdgTo?+r8>Ja`=(N$p8MD(3uIh2Rs$=HD0SIn7mG1dPN zgibM4UkwX0(GN`3$RH*o3l0J#=;J=}V?X-iKLTVx3gkc%WI-C_K_X;AD&zyKo&PkB znN93bag^0`Y!7sZnn763&?U!mRK=}iVuQpPMCej_smsmek3s;|S2#}|qKyaMBg^PP z4anq7(qv8Ah*qZ8IFZFvydIXI1r?EtN!6oEs%2xEVqrzaKxBp}Rs=#|WnAV{ zbQ~8({!)7EVvGo$vRO%a%%xL|O_Z#Py7&Z9Af3PXRuj#l@7bec(&h)wmj64hBXHr5 zB~oN((N8x*NGSe8iI_@x)I@`X1wH!2rvTa{N(5*C5J5oX;|LIhCD1p%$86T-cCKaH ztqV(fgkymx9-8GaCYHI3=Qtgsc5-KX(%ui=AX>WTd}0=S(x80OXMSFjeXbyW>gRv9 z5r3kfe*$QMmXCmbAb}d_f=&&KbrMo=T4i03F@o9!RZm#y)sjWWarEII#tS$#(Q!~h zh8p9#Sg3FUih?reiVlrU`GhTnQA%awC9cYE2F06HXJ|YTY7C1{*iR^WQWlg7QCw#U z)Ps(Gqd)0gTEL}{s3?ma+TlCfs9jWxFsq=V7a49J?4a$?o z>7qW%ZGr}yLWC_YPhkEQCQjx=u*a}`3O!QPEE4&@xg9;K&_n5wd>>yFIUnI_ATp6f>_ zW{M)~y4q`_dS_n>iYGAzin7GK9!a|1>%i6rf(D?#5^TbH;r|^rCc-N0!xENv-lM}p zY{ded#3m!fTI|NIAI6%Z#&T@PR)oQlAIOUA$^HY$hM&ozY{;rC_OWcsZtTleU(CvE z#nLSE+3d|eY|bX%&hl)+`YiAPZO{(v(Dq)@8m+w|E$u1o(yD9I7T(iBZL-b`3TR-~ zYVFo?ZP$8j1A;)kR_)kI1h%At7oct0s_ojcZQHu-+rn+!%I)0JZQa@}+R_4JlI`9i z;G{g`-vaL6RukV6E=6EV;396~rsCihZsQ)V;zDlZ$|2)6F5y0|M%zZVc_(?(O0(?N)#&Z=E015#BMc`ljAIJUMd4#cm zxF;5i1?27nitzw02aD4I)N=s!d>-{sgjPOOCm*AekHi;Y@cBAAIv9Kr!nh2Fx5XHj z@fa5g{99&a!e;pxt6E{JGGVJ)Eh|qst7LJjGOTSG*0I*s))wj6g>|WybE(I<)VkOP z0lrLQ_gm`j_3EBgIL~GvavmAP^z`(!^-RV4)jX5|2E=FuwF}&0YK3;01vQuj zHJgQ22}d%4YNtpITQLpm2RXK+24+tEOn&`LeDi8d^KM4Nd~I#t!WRNFd38e-l_NAgOX6hI-XNcL=KGe{)nm@#B?V76UW7hYr7mYE?#+bE3%%j%i)}ht* zq1B=pX4Mq4evCOZG*mmqY#&=c=*n-HI;xsy*3U3or;cjpnSE314fD*Qsjc>zqoJ9l zzM0+Df9cHD%*;&R{BG+K^JuKTZ=N|ezcn;}G&aB6wZ!aOIvQI#>RV;bEbR`hGUu1p zr&f=K)|oS_NAs(@^Q#A|tE*H0(skzi`qBJ4b7}o(b^Ty|>xj8JwY0@t-8xv^I-1}8 z2bk+y2kTo$OaJih(dsU9>43Su%iP*M+TGpV`Ueh1292qwT}6*i+4wnZbj72JAgMICV%X8vQ7RLMLw0kwiuhtSMginvjNuz7uH?<2Vj zRc^iYW&K%7sTtbi&@M1U>*o4w?~A7-F5D0!=M}1aw8ZR@f_vY~%JHYHuLs*d!(v&U z=z03j^}T{l72t=Db8c}|eSG0RUgh4eQTamO(4KG~h-MXXZQH$Z5>fkn;oTCOcK?ZL z9wAX&Yq@_^h5x5+s+47c)yL&a5`1^s8KiOt+Jj^I`4?UNSpk#5|T-O?PPS9CnRFph)3y+te z8pdY3SnG(}i=>+>#joZn==S;TSJc($dT$ zv|h-)_W|*=;(&l!h{QO#5REfn*Bf89U$5(_y^YlPZPp%boe%DQW>mkVR$g<{ihZTF zDKkyLn(T1~b*eY>s`AxmiYLCj)?y_kHK2Nr9@d;uAq{)?GK#;qo=Y`&uR{&Bl$UhK z6pz=L7LJ~8LTVoOsWS4SyB)RKY}s1adix*o`4<*NSs&=ZK>#)@$$VPcdz1EDW3>2G$)-N8LUE0lO7PZ8VcN)}zMHXyRt_b}r_O$PyQi`=@{dtiBJ$4c z>zjNoeXpN(O%|GAr60>a0WrYg5rD0M$%?Cy-Yx(Eh?ZaSHu`_{V2;(;*05QFd;?a& zCGX4G{X?zm?tExfJH>F2f(Wk3aYcF(!Hq z64It$@lziNQ4Y(qEci0tAoC#4^MWWIdbYR@_rnEug_aH1X3z^+7>l>%B`MbS>Q4*;uh>1S&=4#e=8JG@an=S|*jY$d_Yb-aw6TzVd2!yH;g1VTx zhiF?9;xtF#iC43h-4H;zIe#PL5i%@Qrv?8a(5!@_lS@*(f{8_LE&{r?XqjmuD>9S; z+;u)L;CCjPkhz}8jh{M6TSU$)61B4wuuei}v^EApRVf0GSp17ncDLjKEIS>k+6f1e z)O6KwvauWhpiwQ852DBdY32%6J@sx)m^dkcWhN<+b1WWQ#4q*Sd9croTeXMUU${%; zxUmzTzh!J9U>gE(U?omp$fkpAsR)Pkn|a*2bWm4(JnO(s_*<(e)0;U$88?7D&hzKB zyK@lX#p0)RG4ht1g0Xoi<4;v5@|1x?F@OL}AVju^`bRZlLC?%So+0TH)d2c30N4_vB8!Vz z0(1eZg-UCOZxS^XxJt7>u0s*?ym>&QoCl1Z=(;pn5|HubjM_`KU}MtB!pVd;4h&eE zfw|KkL~P-`8xZp#M}2q4L}fXrC<2opWmBqsRa+JlYaFItAhLNCy_Aq(O!I{ATzjU? zO}eN-GoV#ao}L}9%FU^gDTwnusW9CXcVk{XUvqQg%*R6eTOLzyDzd=<2fgHqzd<3N zR<}*n9arMt60twdl;hmAq;tik?;iQ|NjJeCO&6CrvGcObQ*TY>#;WD?I&LAC5~3nn z9ow_>zk$T7-PikG(mpE5-hKUPsL}Oy`RVs3wYnocZY5-&TPjSe=?cw&9fQvA7F+RI zs=m!oS-DYlHJ(&-gCphvAk>Nb;PR6guZsocg`@BxAe`G?pk~vQZ*91)kh}aNt#W~I z99#Wkp{-o!d^O#=$d4yJ@PDT;MR-a+Xh*4(pZIp$%ZQj21Gof;pao$ zpTETC5b6ii+vb*RK6iY1yo;oD=@^}{;mg0(W|Y6SN8PL8l)#8rNCaqDJ~9xGy{z@FDChkpkN2wBYM7C(p* zZ!rJ+c&Y479{<^H^Ikj9-IL6c!!O{9UU9L~50;B@hsbTfRi~u7Ow#ZA6`=1~03 zSY9E*)r}*Bkp0CfO7X6sJ&)V|b8a(3G`Uu&w0|sHY4ewLfV^ET`bDO~W*bkV9;D>P zT!DV~NOQL)_3GlXFfAfR<1ejpZ01v|LaH#`)z1_(Bt^QjAn`;up!X^3c0@05$gy|2 z0i@w^O|Q#DL@sN0Om`?IdF07^C3Mq(QQ--XiLB+92;7j15(%%Y4!98_-12I}ipH}* z8`Pv~CFrWT9o9OSj*8pe`N{A0X7TTig3~&5t5U-BG@lFjNOEmnR`4x@6>+G<_BXv? zpMSOB>AOtbVBd+W9!yQ_hwseL`N-S_%`YDoOxo|x9%&o@0Y8+z(avtW1RllqQg8qM zUIXLMtOFtoQH`*BaR0OIR{*gcV5pG&Ea_gQC;JlNo<_Ok$Q7=!?%U6PUYUG~H<-G8 zDm`LKQ#Fa@LH4-LV%!<7pZ8BWU``^=jFcF;mYDp8|92__!KT$yp@Z&V=D z3sb!c_IPpi5kL41JfJ*U<3+Z{qjT_Nd}5AF;ZGy$IE;U|ld|1|HEHCEprwp3 zC`VeUJ!!ni=U5^`bb$s$eq8K&@~4`5)-wRJ&-O`)KhfNrJ= zu;b#TREo-|=sW2`ts@+>;(4*l1tRO1U2!RP2HVoFWT`uOy9D%zt)Y4$iyYg%chtx5 z5Qx%ILFZSDigroO4%<8p{oe>+Bf!-|Ez-La?<9b#1cTw?*&Lx9&zXC9=DDKnAw@TD zc#BJvIpm5q5uPkbL2KiAcDD6E0Xq~ko$z%>F7xUFdK|iK|qIZBb`Po zacyX6Z0$k?;v|tR#>`+m>Y3vKzNPB$m)lUs`eeIko?3xnL zacY$2x0cf`7dbD7330`@ z^dx>`+4`hn{=H%lwIH2G4v^6`0}?Q$5~8$OOM4iVh4lP z80hyp?pF%s$k_ociNEZ&uT`)_Ro>ub4JjD-Hc)QW|EfyJa-DVZxb?$v@<$!0pg0(h zgFd7W&R4TXUxHgP{n;m}Pj0etD_0M$=|GvbV-9YuJJ*0MYOn5j)NRF)BgJ>3bK}bA zk>I(uKPURFM%b42AaWSA=^f8ti^ol2Xs1Sq{Z?lX*hTPGzsvEc79CuZk(6*W|O&)s7Xx(a= zFrS^!MImYmCu!9fSn`nLHizrnNOM0|*G0C^xr)&t16Ft2Drlw6+bS+Jp=+B{i7n86 z44QD>PR}u7yp(jWOU;i_FOhvCp6kExmx;~_u7foCLK_>_GvPlf<>VC8f`pDKc zob&dh9dqs@>(0kS;hB=n{<0dbJUX3Y0C(%|Yu~s3h!FjY00hG75CVyPZTUdCzaC>e6x`-5~gLBU_ zr~;Wei=eG0t^_3(8{*KI$Yjd>Ug{joUHoJEVE;@$rmO|pQ1e+>@41uPq!ECy#LY`6 zk4Sl7=GkhE*-+3oqS2T(!6@j~pQTEPx+l*dr#%)bLl@?17W(@a5|Fbn64Y>>&6t@Y zA=Nx^<}-U6vEHI+I)KXYun?MrTA9elWV^veL)gxHEN0wa%$l3B2w@wwUGdl&5_y2B zKSs<9N+KPOwnHzKKr5(yr8Amf1-9>=PxB< zE#GqHRQ$@`#Y-mTw$%zv|tU_C+W78Hk!acxrcHU;XzVs!NC_TbC|pYs%X1U zoF!EEO_g1H(Qzx+f1d@nhCkxI8(;n)jJ}sefFcQid?DI*2+T!)uwb-bz0eb%VZjv0zyLA?6at;Ij316R}mN zIo9nEHcR?<|E=#YA8>grf^-8Ul;&ruB#>4|N-F(AuETqlA#4XUWTnLKa{LFccVB$2 ze{wH`7Cb*7akKNAJTK}{Q;fT1t%U}O<0=J4A+(k0I$2B=k0-_E%hI*E_ z4qK4F&OF&N8i5rNe(62z+%8x&+J@$DL%aX$IPk#0?vDfzj<)hvfgKyhI~fXG)HoX_ zAqs)#tr+s!Eg74r3+*zdIF>po?Mnu4JjL0&wczPxf@!6B zCvX?ael^q;1XoO26{|4?3)}3z+Lxct*LdqgCV|jpyCR8=3XfaQSr92bA*7fQygyRz zj!-BR87Lp8GxjApTi0D0iNoEH-}ET&#-3g-wcRGPGYJCYo)l`TCUt^` z1wt;q-=TU0N^)m-4G`NpUxa~Y6!+CeOU^4W_vob`n5zokorbS9WQVkUh#pqL6|T69 zC-AEU`{ZuS+2wIt7R=u3o7l`geSLNI%yMr@n2o~){ZMuJ%eyOC7G;6FC%Z4sH*$QG z@M3ZKC+gM)JvM-1q(f>%O8S-IeYod3Ap{&9{NRpvNMVN%kAGd4Ml`ae*W-=ii$QJ3 zsh6V)YD#CjTT5zReeilbST{pIE1`)FmqN9ZBFw1yj+qKWfI!Mkw#@78ZBb{^tPFeW ztihn+=2c1i<(Ct&V4D{3Q|vHhzxKv@#`S#zr3xpR7vJTNW2tmj)`JU6Joo>;=oUl? z7v4B^sS0GxE_nAY#*kI>M6uzza;RqRxrlibnZK53My@rizuv+FEu zsZ_#|?4pnuOCZXKE@$5H&5fW@%+0<~X211dgIu{XWK4W``nXaP)IOAJ*e;4)Ka7$V zzQ0`fz4~oeI^prnVk$94BGdNKlY4)0_zzDhIVBQ4%I6h_;Xg~MCU|b{Fr#54FKV=n z=YHDzbKHpz@69Wph2iG6mb<}_2)bXTB^RbRH{xDsAaCGOT}Q=+Q_PSVw(`xAp zu7n`Z_yWrkHvQQfyk5@I!I~CsR~o`0=vmgX#Cn5pg{*Mv)4%l6AL;r(W((J{_iM@6 zmClac9*M*i?D!l|B|rV+W! zdAEY|QnBy19q4AUgZtwiX+nH?qQp|Gl2^Q6{V=f@eZ zv|m?K>}#J1ee>|n;-Zwuzcw1=GW2}NoGEJeF0TNsd&RIdl$Em6ZNYm^pLJwJM#9EV z*c?|t;cVD7%y+<8sAW+%9-(|s+aIP~{7>)GfVn7mKlu$_)DkpZ=A9kkM{i|Oj~)H~ zlm9q-MO!m_xC|Qx70w4)%Idz6r{Q)287;v^r(>Lx4Uj7M)264ft~I67rHDkfJ~?E7yV2eerNJ9<$%` z7i)}6J5LdFmJF(YO=e+_&|!K-qOZ=+7HFDzn67%2<)uj%7Mh_emQLKD8d+j{69W-N z5|Ta39>uB|Ql&<$Mg$U+N_h7lPJCI8j#mDd3z=?RrM znD`^NSBf)16NM?~*ZKuZKdpSF7(&A(*U(kmeip)qIYJR&5holGqc|xpqh>Rp<#bI@|8H zEcf7NHq#bQR1%dtKPq~JtWb)%-UC(R`E2{wM5dVgK0d0!#1iGJuIfC}C8I+<&8k3l zxBQJXFPWjr?ZcCq3XY$xToX7>0kW{&?0|3TFs)B0)rxtCOU4#!w2LvB6%<`pH8)S9 zn6TqTJ98q)fsP6mN60&7d~wuYHU8uFCBIR6qBAa( ziS>0&V0Y*G3F5sU(Q!h7l)&?@jW^dURLrR^QGn^qA0tP0QzLo%%|g0k8qb{x$&3FF z2kEXqWX36mxRG7HHDXq_LnUVMOP?(+il27|)X6*Ug`O8hqDHb{ji1Dg1qhrA2;3F8 z*8Fb4YlBZXfU6;HCY$zC^84m_Ry{__1x3$n)tply7KDXP#%o-?8om7RZmzWA`il;B zC03V}g=@K)k0o_UQG(Zq&}kwUW=KFfiAZLD`W~*;Q5AcJtJ?DyXXjmz3HAu*tMI(7 zv&-aUn7&=SLWv}|qh9y(55(m!wIsn6V(=O2+gL;Fuf{>;a4|o-YrY?HJ7cIYqgx{MQRsEy&f)@GOH}forVk2B?)vmzEjv>r=CeCAsr7%Z1T4CB8SObl$04^@unp z$2|TMJ;HW|ZShQoT-H!Rh!%Z?YU|Mwi2Li*G*94xVqndTL9gaNOR#bR~~wdC=MR_V#Q>@sAj4J1pAY@sGyCnY5Wf)c?eOszg_%oU#0wj(`b2tQI_S*D}ocQ z#EGV|JWd&=~TJ zQRB;#)nvk1$BpWIB45NB`Kqg4thpN7y;ey>7_J96aVPEq0~VfE_3cyZ<{Qz4y;c!6 z{W1zx5>d=WAf~<1S*^-*jKa*H)ck!G;e&V^Io|f4Gau;KplY0daa?f82=V!>UfHk8 zrbnzxoHgb*TP?=v6fKnYQ4oDFbXZ9IkiI1wRz$t$-DZZGA$LcFnff2ING}@=3(dc-|n&CMTwkK7QYMD)o#hi)CGk}?!#)tK0<@MN;AytGpaFOYM$3`g_5IQ~j+RGO) z*xtfCE(;#r;Qz)$$--4OplOz#5Dxb^5O*~4^A2rXv2h<_pV%bbg+ zufy1Cj}8|~Ew+p_%Ws1LL}D)z^h%gm*JAaOOvDs|`2~nRL?S5L3SmpJLy)2cU}MIX zfUPCM46Z6b6wmGl2@q*ypehW6D2x&p0G?Y>n0AyV54)W90Pa6TX%<92ztsj3lm8d(L2X+13Z)gGN39z3C?Dj2NxZY_laCMHtY~K*CuU)*Yk=FK*d>?t+Y6SF$<&W|3 z9@*l=ip>HNyr6@CictO{LF30PQh(z9>J0x}?)zjFE9{6+$Q~9Fq3j3~F+_krVp#0f zU~ta>)5`ug60~F`z4V!dK_xSP;2xrbtaC=xc`@-XdpOTu8`TaPy+Y4LQ%3umSTynV zl`riSwk<}HBtsZb!DIgy33l@*4;xdo5m98!1Xg$WKLl9SacrkLdiLgC;K2a2&t ze}5;8AF$n@Jx`jR_|G4TsDMmjA;6EZY~du;OT_zY`H4P5onW&m$%mGBv9r8W-v(j= z{SoeskGk)n{0JI5Iux<*+!azp`b}ti}pKJ72ACgD@Mc>x{Vwvz^fS zz{s;&5Vj5FwVd1^0M|^I501c$F*4b31<&zfae05b-YwxNBFZ_Gme`fX>05*JEE%SEp^QOP-S4w`idIBk=RF1yqD5rQj(SNai~1)BW`j}?#J6Tq5Cjq8 zJhOhr74f)@g=%#2$Qu52{PWR;I_%`d{TK)i}L`#|3{}TFwAG zglKsL5f{Oxp+zjsca8U-d5R}NrXdbyP!2-$`i>jI(n4K#x@HsQcfTPT80;1Pc<5uv zIA&q0Ryeig+rJe_au%Ur{Gp_tL6x_oB(w9iI+sSF_M{Q#7&CaH(tPyx+_cYRoyi#P zmHw*}if<<}6f25CuQlNdXZv2wR+^B?HbE68BnpEl&-nKiL?9dBz{jv+W>_f{!HNZ7 zpX`W-$J|zx?OED=72w z(T|0~j2Sl9o?h#?ag4`l(R=gxtj8Lc5WWP{Nu2&Q5If@kEi zl@>6B0!lYY0ENJ_y@0hQ!@|8sO<;-~(GcgQgR&(Jzi2_qW!0gK&2K~H6FIdpwa;TZ zOo=YGd2tNilPiBbSZ78!1_h=Q}cfuT0J@mCdb`zxU!8AsC9TQX(!Z4Q238a(}Er z&cxLEogBL6XKHlz0>o^*JCzoD=uaDT%*`;7+D##URT{>BS(3tks{d?J4&ztGF^(9V*pxdOQn+>A=LAd%O5d#&d*m796d_Da4HAK756> z$J>Dp_1Rhx1-?p$uSoN4#1^FW1Rw_11p^N`<4Z{ zrocD;prTM@K!El*=QPRErwEcX>{yx|LODKBQ2HJL6G z4;<&n!GR8kUyBZA$sX>mDTt#C-_BXcs{#skjnu8|J2CjhPH%4fJz19#98deE+v8s@ z;L~qS7S&qUHN74`y(Ujv+DsvMS(CTtKmRa|`5t^dNnXxpLaa%23lewkc-_yH0o(i? ztX#Vu&sgjC@Ey)XtWRyRUSYGqgHOZ=#5&v{3~OIC3s6|eg%sF%4!Jf%0Ye)*jP(&rPD;HU>7F<;p~1aIy6*3nAVyKL^^BuB13Eo% zx2bUwssLLL*fL~S{~YW=&og_g_E_A$(YbwNn|%)FXaU>(b8-7-S^MTs_bp!UTXu(8 z+2Em^m+>}<8%-qJ9oVIaxX>P!tBssuALH}|6j>;;X&1<1G|)>#H?)xCwI9Y?&Z*{V zD)zWmiRGXYl9D_4<0%G&I*bdqwZ3pC?zXc*bZ;CXg4_8uBK;-kM!iymLbyUaJg}~U z!18l3CDd&$T*?cHr?6ai4tLm&xjn7q&=Ye#I}-zuwbXibzeouh2^japMKIuMvqTrg z+g)l-kcu02`#(Z1Mz}VEf&?O%sAWtvU=mdI$pX5FE*5T>5cl^T7TU2{k6aT;d!Sw9@hAMcaBfjHKy^ih)oICUA{z$ z;gA8#Y?z>N=#c(YPPid^CPj)2av9L{ymYKX0A#?r}PdRt>QIYM$+&oB3hH~ z6J3Hp9{T4BEoK`+Q(az_cO#-vrVz;YIh?>_FF$n@x8#i``KS4{VG>F$&I+8;8dydJ zLhxHxr}YUlgqz)gPO79hJxs+|=y*0>HadJ{k4}7d{zJ?YEwG)CW9LNE)#7UR`gVd< zPsjNTz6!44v$H;d#AhW=#)HD}(h&)dJCS#ko4+8#ITTBTLaW$DmbsU}5zE}xx)E+` z09V$b9~tD-c(bqihL87E-wUTJQpEWLLj1zU%gnw#@qI;z({A}zW&7gUC;`vCONLk~ z?}U^LGgY`&xUBU&+{{R#^A^}71-K5e%yMmgwoWM%xS*KoCHvGtrBmvFHh2}4S$JVNkOv1EklOLN@N?jx<#YeQ z&i2g?SJj^{#ua0~ikLsmdMv7WYo#u;{-F zqXs9}QniC$RT5d$&A>4iH9cF5MEr9IuybX}=J^IjKdCWIS{3g<(&@m>LQ_N>Em}ml z^sb)7!rAsB3}5s1*^Ltehy=N^AG-KBOF0xL<8=+HI^}fh#(NGfTMSgsQ0$mO5C<1w z1E5^`Z&4x{`jwaZZ+O@QLk&1OT`Vzk9gBlX7%HLoOX6Oz80Z!v^rs+L}6)wnV{kRuBm@0|!U5 z=+00wBC?;qO(4nt_l?H!`is&h^I>=1u2^uEir=C6Zd|LBOnDExsu!BygSW%GYhV{E zK!|8JG-ft_ExeK2Zu_#t;|YkSy(G_elpgS^L^Ob}B|PGsUIg<>WgE&*9>*zv*{3d+ z_r;;;=KVVJ`4bD6a4%NH9wKs^=Je4T#y-B*&0wY6ivApgz+aXw z{)8w2x1Y;URmhz6*;F+Uc;A;=sD4-F6{qLzgnAyu32AC}VZ!3j~WWkVNqTkl^48A6uHB<$aQ#(kOm|g&b&9x_wrej z;C8Bjork8g9?yOe;%)4c4$insBz&p&gb!OA3UG`>GuKsrzRrmqFYix#b339KrjPwm zVfA*E`)RYXLU3Jd1rAW48qe=ro2!a5z;BlCE~plPfvvaluAj7%2Nm@+X#~qMmlF>y06$j4=*EptN`{Ad>N`u`9fHCqQJ9@oUa-{zAhUa2O?uJUB#jex5T@cqj zEeLApKfV1?T->d~Nn57w@JBwE$TMWTrYgEJq+1Dj|Ks0 z2Jmf`#r=y}{VXGkN^$}W_#~#Q#@33Lk>2hcrA+$i@(@Z*Ho6a1x=2rxP!UsQ)2f=rsPUja*6el4|Xi?M! z;~I0`1oPdxOXdtC{**#NA-Yy!=Ltac;E&OtfCY|L!Y@`46nsuN+z5lmuiCWG0_6e*3p=ZUDt8=Hhvd7zMWVI!BPe-8WKmFybF0!r?;- z`yGU}sNGbuPS~hmu7s+?!jAwm5phw$5K$lry!gK8r^K9?{Two_Qw~?auH%kK0xM5E zVPBI}#zKxoq?Cod|HJ^w^ve=~tZk0jlBSkYe~mEaUSghJrs*W$UXi9flus{RVT|bO zX)IkWB~NVEb^d@W&CYKr$Nw&#{a>r|39=k3Y8$O60{R7J;Rzr%x1u?Gm^Z4n?F2 z4egxT?POMj6n!tKwi_f!C{!&q-;y?7w^FTM_Monqo6T7iJ~7WOd)hM%K2F*iECqF@ z+T0*Zv(creR!ln$_-w(p{{MP-RhDWYSg0RX+?T-N9FhNpQrF3OZ%RDR#! zW0pZJ4`I6!h>F$0*o0Xd3(5i46d3M9ejctxq9cA`52Cbk`0q$yuitnIx(6uemV%&H z*jjzu)eEX`_2}4=lrp<5b~>70_D5QGTF=k%^sQd&`@*vd*c8a#KWI}~i-nbDg=_cO zYe8It*du~_+5eg#@W7>7mN8a2LiL3HH)EXmaCC9IyWtnG>XjJnFFXo>N5Rvx4-DNx zn7owTa;%xXd?D##fxi`fMn4J6n=L(gUfvvEncg5bYG)u->aQ7cIm+5&G}S=lxFaj` zt3K99#11p>n5=;4NG^`LR`rD^9M1w&g2RYx^eZvVt6F!`K}4Ph8ebK(<*fi=a}MI@~i&AqpSu6<#3O$uzb;mK&hnCpT9i6{Q7h*&|^$Q6mS+@;hi6E3pAgq z`gbSCt6;H7fo37~>_(|oPeoR>ed%rm*;;}N0az=G$7+0uOc+-uQ%)~_DNScqA=0|v zfdIh)Biup2+F*wc*+Ua>dprLuUBiQ;;EAbdffC$1r^-i>gLtevXED@qET1phEZ&h~ znDAg3P&d>hdq_D~|NL514UgShb3mAo3GOqV458 zYOj3%p(x#TCC0VFBY|5hER~<=Z}_+E%p6f|A2NR6HEFPkw5Y*oGu`|Bf<|76e~@uk z)tM8{teN&uG^Ykn-?`kHOP)E9`~;utQoV-!8(p2Dv}y5mk@MtWeLBCxg##VAheLji z>-NH(AOQi;uH60oOneJ`8{5Qux)-`TLIb~6ojVwdjaU43YJ#h@NCaSZzW7oy)2 z{j1>AQSSBg1m)+=fq&#hep`F5HsNu1o~YQ@j7HY3MJeNE2-6LUAIp{BH+znq7KJ8N zZ^+=p`L-8FFKyWyU^;`$k@S9x&kgkxPAd!1tKY6|DSEAedcNMV7s9iw%LMDpTj&+!$NH=YGV{?)2&SYHZ6AX0!A=_D zqhjf;KQ862e`4bk<+ZJ2&n|tZv}5k0@-@fDRL^75P%-guG<*7v;KQ<3!2p7)kOrTM`jcy-lbfYN#0On>M9w6aa~>HYds%zE4*m>)qG7VbDD_Tn@lS~=RtJS6&`K)x4nVa%TXud+Z7&NSji zSYTT4?0{UBs@79-(%4VUz-Uj0Tge zG^=*%uwMBQS?TN(_2)})hwFl+-WrcKq66)}r}S&ay)b^%sb$m0pMO*PVy86iW=Wo> zM$tdx?4<6c4&4`BdSYF=KX2ffMmRI@Bg14tk9y8@5W~LHd_hJ7Z^kpw$zuJ|=7XTQ z+wk`-6>S@`qz?(zSzn?9AR|DMP$PXBM9aBDrG+PCHtgzQlu9(@?7k6BJc^%A{7<_N zK8@$|Kjriri~VNE>db1hH)j*Kr}gF>tNKu~m%kvsjSX3kPzH2ZAbQ&!4yU3|t?iIY zPlr@Tol=ZGO@!z(jBvQG{@QGiYJjVgiS&B-`Gilqb$a`y?ptmTZ)$$|80iWYz&~d@ zo4|r-6LT=qx4PwdiH(J&GFvX(`=`zPaByv)@E zI-xKGluqPJkJ6z*G>oGiAF}Q9ZK2fdm5m`9v}m35D884kKw3ZHZU>=$hGL!Y^ZQ|; zS-Vv}0)m z7W(eB8~>*M%hTBr-h%i9L?)463!-mD0u-ZoSF2G!MM>i%sk@*^v?;h62su@FC(-zB z$LW|Se)l%i^Zit~RBo%cW0e-y_*_g?p2<6ie(d%M@(T~fBLnY{^7*T~M^ zq)T>W%P3tdiezV{Yh-5>->h_rQb|`D2>086a31g9&g(p1&v$)hHKUI74&=O?-aD~R zwHvh$EpVh6FGE>!t^4DL{ew!xA?-qNvMMw5nDo2&evwCdagbX4WmU=H5pAB%DHkw@ z)HwtetW6wJ#H;7eJj`#Cd}y;#>n-(B0CJuR5mEMq5p>MsOci#LnBv8C`Ff(ARh<@m zM5U9E`V+)>its&%YWj>W_wKzvLO;EZz#}nr&iWroLu$t$Sa+AzdA4MJ-^$*jhH`!G zN)S(sDX(1Bt7wo4Sx;Hj$Iu0gd=UK|bnx^~MTS3voIV|*9(-$(oH=8{bl$N$$@I;3OXR=MM(rNZo~wx?H)32_{LJMta&&4EZb?aj`V8NOz83vb@ny;+bAhVb3ko zahb7OMczj3?|ZL~=@|{Da_#h{4M#a64c$r@#g#LvR{?plUM>7(*MypcP4^U9WBTc! zA{ipz*8sv(PzSXcC3lM^^~}3e##Rit2S{S=zrcmZ<8L)C>?EsMG8Wu32@ps>Kl{uo zUE}&iKkBM@cND`JpCPreoZEEDql@r!^@rphBk%>QTUy)Tc~h-8^6>?; zOfK5DD3>J6Vh{8oT~{K)9l;#5Uyx0Z2JOg@=kyV2!yxNx_mE_} zD&^zd-gU34$7b#yoArb=#UKQo5y{`$a-^b}=i6^#B7|3va2#p}pHt~hd?-5$<78@f&v9F0Yb~qypM#d1Bkwu{Ty%02N&q~ z)gXmF*46srF+3TPS2beHu!AKLg>*mrhD$AhXPcR3a|KO=KJOb&RWxOwrpJbQiY2Qg z2<9g04q+bm5NK{6H}314Bc_HtJW`dDS2O}Ov6<<%Rw&oe9447qp1jMwt?cZJU5uq? z2S<4I6kc&F2n(@DUTex6v6uv>^G<|c@i8}@*7Z+mU3m3b&es2iTi)-Do?*Lpqj}!% zn0+pSF;|6`+9G#aL8$3`+XxoBbdbawPvJg&$WyNHnIolR{^({cH%M5A2Yi8&KC`|j zYo}ik+Uo*Ikv9F;GV2n10l_eT1HC_TepwceR+E<~s?e!B2S)0nIYT7)m{m}1XERmi z63%XO27MVA68oSVps4?(%blLca7GFZN*A}7^X`f7^d+!xXDshZ>Nk482b2UzMk#(3 zF)z!6ND<9>sSf{s)C;aqg+{Xi6X`*yO5wtmmi5E0Dc;gGkHoe^C?aEh$p|LZSV{L z=f3WZj3+xVjXr?uOO0^_pGF%e%UxqPEV{pLeTU)KyGTRu( zsl%C=9C^S(g7bTHe@^T&r!g}?M_ZOyw?p?cc1Ev(R{8N z{0NX`dODU`PtK5ZOujNMAtYzP=(*YBZ=>(zb>DT2J1haWk(_W%dzXw6=7dKH;H=xS+0BuSA* z6^TZaRx!owDtR#$SZnQGuE;Tjd>0Iv2t!SWFLRh`_^d zS`B%uF~X^^6739gJ+>xe(mf%_9nkX>-qr)B+g>e27d?kAz+0eW(<+n&&RNpl23(-H z?G}Pc{wi+?D7g9&d;WhNlVl?Pc5Y4u@yI+1THV9OM`AWDtrT z6{S;kvQ-9Y*KaniV?)wYZ8z(0GQ_-8-l$BypsnD=b7+8<^S)I&Kg_jC8naVsNtH~M z%5>q?<$GN@sunXOKv)&~+QTT5P+}OciXLH0rGT0A*9GWS#D&@PbLW0|hQXwudrIKW z`g@|uh!zjdRBT$b=Le^5#*2Uo)7Z9-4K5}A;zL~wDhZja{)*+3==dWvgj~t4S3jsk z4bdvH(u-T)^xWjhza3UM4)9y)o7c3QL(#;F8m25{dzF#{Mn3Sbjn!Ou#@OTH<$brV z1rYh6gY@72z+u9Z#3)9DdfwafBgYagqaSAH9J7jC0Y>>1L(MZ-*D-rzA5e;Z^ucI} z;d>f4bniUeW4)3~yT8W&MdzcFWkw{9|MM8E*K6An=kCc#UF0*M-o?b<8`0}UzqQ{T zo!Hv3s~XHTbWqHk%ucPZc85q`g>7JOXzDT%(1{So9y9Leg_5S{Uu`fFGT4K@G7A>D zrfK0U+~d$0DS|G3we6y3$DFhFD_ipQ#Y>U7XO=sDMkZ~I`@)LzUfyBg>x(w?j9O+f zcjjuV5*+hdIzqjVoJn0Xfch?#!F;o#8u-?s%4Xop**jAJemlcSuuLGGUR?a_Ly>H7 zM4KAYNJKc=eoS_-5_Q2Syn7mnaf=CsHN|A(-rN9`9(QAQOze95zcob-^xEznop1kW z@ZDlza%~|&jC(9SC;(NZHvOxn@&V*^Le$FT_ov(x|BNcx;}(l7hC0DepJ2WmU759W zVtDT9=2Rq=HK4U)Xcbu#^TL1ZHLKfjv3yIErQ96H-_Ga!zI(TMMP6Kclv4S)z2!Fc zak6x|!)WnVNY2yO6BmE#3eVaZDXgt8dG^c?(52omaJsu8qCS?H0upJ@_~&Iky6asT zzem52bAIjYJoQz4KhrnVt64!m1BOnrEGxOXNoZ$T+fFwA+v}mQ!AqCz(Hqpzol61i z^Mlr!({RoN)JOH^S^ZcNKc*^O;!N3`brV?bP(4}3H1^&{c|WPvJXl5~Z@a}gMXjP{ z1d$jvRV;t@wyRm*Es>f+w6sBF@Fcs_*oLL!(o;6|^=$Fs<>|JEzw85klhg!SS@839 z8S&TQg3-Eym-oT>IfJOT$8K)0mSm%QE_iS6FC3G(ku@iWZgYX1ER&4TyNchgem3gVX zHs=dl0M9F`;Bq%-*ZDMQtDo$<(|Cqyb)j;nmO595KD;CRjN^e;*^@@4A}rLUd3aesUwut(aVEY!_u_gkMD><$6+iHMqcM#l#Yr%R9MbAt;4BBjOY|ni9Xu^N1hWVxD zt5w1`#Vd*Y7Pr7kHAiyPBPwzmo3ou|@vOLc`n+Xz1x==ER?Gz8>k$>nb*t{ll|<+6 zOj&%WX>6AWE|8%;(hXR#QDFTR$f{xf@_<$8cpC5lI32BME@Eq^ICim_HH39l39VQ) z2-C75pfC)S0U944v(eXCkW`e*deTSgZ!`mvuCbS+9a66w0_n}>(3<7A`iS+~E-Oy- z2&;=aMx!BnBZ1bRJLjH6^RP{P(LN4g%Q@U5x$TQ(F?6lSHkWOUB-%l zhZXh9UXM;-WIBvw>XbyThl)f4{Pfrq$w#jwYcWy=7_q;5ecHLKuaqvd4|pk%t(RYO zxk``5H$XQ-F$I;ZU$DI3YeHX0i-kkL09?0TALsLFweV&QKzOkDNw(^Ff*@BS=ecCT!ola zOrLXZ5w6=qnx<>m=ANOChn@o|-5UvGFH8dehZNOL#5nr=@&x^{abTDdf z*#^*v^5UUD4@fGtKr*$RHTexxmnytl!0bX$gA@&!5woDTy3w6(r52!$1z$jJ5SgH;Rv1Aw#@(9t=hsHC zV!x<|6b@fP5wuvJd)x?>!|AceoCmjI^?!kCb`5(29Q--W_dBp-9{BpiHxo#fd60qh zAS3lBHaX&Ca0Z!$<~*YA9RZxF=RAfi5$f3EQ@7*)sOOVdPx_v252B8Rz9SSOJ-w~n zi#oV&yYu_~a{W;BtbPHEK4*Os3|3;d?e5^8T96C|8Pf+`zLJ<{J7ipLaW%?%{GMwC#v6^(w)D_xEb``e0}{A&=!png7{}N-h9r`tjIHlg6=U{7 zom=hQjT-{kK|97e1b!E_hT}JhV)eV@-}@Wuo}%TF$ak8^?ZYYJKn*D8=9I$Ssj%l6 z#05$w1%7i7r8xw>r-~9m(MST%K8KWk@v$bitjW5Zm=33fihT5MshW0GJ*u}J5zr;5 z#fYflDA12M#`Xx4Y-NUgHW(%hHvB^p({sY#ULWn z0N>!VK(*@lnLnbdFM&?H+Q#)`W?VwfE%ripF`CNFFlokw--(Zs*oXgRf%R_8nK62f zxK3^n1QAL&NM{o9!|BHFSF`yHI$}UhiSB#gS`M*F?TAHEv2AH%Qg$d?z8nbQu#j;Z zj)3W8*UGYt{7KDaV{JaT{jF<2fwQ=?-jk^W2feE!gHSx%;I3X2KD58micY zV_fxOihb2CJOs&DyehQrwzexZy8S!vlSs+3GZVrSu)A#O;s=GN3wwMFLKkhBKQuPs$ z!|{?aXL~6TL5ND_E!+AGj;I1Rj)NE*75j2_JDtnjWZwBo4bCd$SJ1(_nHLsdr2=3= zElU+V7K;M|I8^}p5DTdH1TF$V&k-O&mRQ6#(NR@T-j_9TS2YTIG!ziAY>5r~5#U9v z=mAbagjecEj%qQKwTg018^GA8=x-*TN2cF@#i@2P_5pvmYHuZ}=#6UkFX8?o=HXvH z-0ek}aMiRhp~xtkN6S(&)=>yRIN0R87ZrfH!#132mw@WC&b2B%)k|2wunhb22!NG8 z`BjF6Y1CTdFtOyPaQEf{LQetEJy6ztHx7%BMR{R+pT~9KJYcH8Gwb!nkn$>TY`3)= zimZX?Do6g;i%sHhWUuTg<>#dRea_^LiUs|m zz$=+7)Vj`ZGh985y?-eiP6Sx#2RcH2L+Uij?RBV8jIK{yPu(rXo2PoIm>d;7Je(!n2S#6e|%%iN_8LG@&R{rhL=TcQc2Yh&}Ky{GbmI{; zB|z*z?p7e{<8{G`ElwdZX~U!&H{`-EFGI|9p$t0GTv%q+ch>1)93R!{edAxM^j5%$ z99bMAIY&NU2`2Qsu!u+0n@El_&Ut8XqH6W?j;p*?bRB85+i%v*PT8ZeH2yc$$G}4( zHkY4sGaj2y1cOOcGp?q~>Hzgdb4K~<=t^n|D&P7U}^m5fo+0^*zj5QG}_ipuV z&pQ>7apVmcVzsaCFYufAK5cdVm*B=9!c*}CFdzWk)v6X3;!GFdWCh;fgyxv8j6V^; z&F_Hx-bf(`=;HzY-;A8jBMv|Ocn>Q1;*;eMDjjTLx zhZBJ<`nc;FN(2+E!36$i&pDmgitoOwF>%tr0oVP$?)-jBbK=95SC}iJRq>P12NUD> zx-MMVz+HW}wbCbkWpey@?A47P#r`o+|E8(>u7UOz%KhGx=Q7SpkAZjzkhma{s8@Fg(-P)KSDHs`3K0Rzw58GdfS92|J*oc z0q<2lzu$P6%c80uZw5CZuF*oY>EJ{%T+zQ!L^iI9z_0c z-&T9$-m}ivp&`1>g4$2pM_2OV{;U2nS2k3U_Jc{dBsY8_5eQleH$+iw;;3mHiPz~+ z?4llwEq#z-SF3&0(PJI{UXRm|lW+_4@GW0lP(}m=@uLI2p5~FEdNoc!3|D0P=am7K zB>q~33tnP(aK#^Effu%2%!(R{;$KQ#(UHRwKtar(hjPT_)2mWL#;!ke(S0=_iU^;i z4b7a%Fd6skw7=)hP)e^ z`kDP3n?lh905&l(uXK}#NKs2-o5-t_W)wp)$^ox4tF48&rLWt21?#|`)7`%0+_gFW z;ajqtH*x)$w}dx43g$?;Q{Gi^JFw?V6aQD49Y-R7ssi`sHA8BH16n0DCmNymR5g5I zZBwm@?Rv)^s~tE*hb6*9v8bwXBYf6bvjZ-_bhOzQ;S+bl8t zMAJ8IZH&nmVQ|T;Z%pLCzroY*32>L5{;QundKpknMctJ{!GQc&4Q}n8$a(+M{=B^&7+S6+VA5; zBHHa;e_1(KID0#CN=OOJy78>di1F0y ztzTA_FUwMXUn*i?B~$!^m@hwWC&;v6hOu?32I`KVdIU=XuKIOxDK=xF9#o5{0yYrz zBSqu++>~lt988%H`}D*0VP0zzNB~?nm@SqgaZKVyPzLHCWYU@axlD)EK^PYf%APd9 z{AUqM`LPF&-{8N>Lkk1U7Hi=FjC#PwA+A5yuE)8?7`Z&8KA;a|L7{ev=7(ls`p+B< z(hfclIA0w|1S4j^b$YI2=pPL5RtwzG2K0OaE+yF)9~JqR5#Q5X&g`R;{Nk(y3wVGH zMZu;rI8}hOnQaQ9W;3+M7Hq=ngw6v}MmBGf$CIrllvzrLnC-(bRZ zRqd8Dlq@5)=!W*_?$>YL0y3iAug)u#KHBls8!mx71s4%=p5{{;%$I%Bed*!cKO%0q^o^fU!cyn^QNzVO+`jEe{~;;QOX zKPN?ztC7a-G|u^=Z?eKVRyjwDj?5C~LFwxC_EcW75-d(zxmnGqxI8Cz4F3-&4|E|lm#$xpr_0S&d> zq_~XmIoPMxKDm|%RY~6f@!T;#@#$ge^#C0`-}l?vxC- z>MDnOzPqk)M%{EyO$rgPDC7bryadWx73isRZk&~iMVvS8bfq~NoU=poyGGw`26rcd zN~m|PFq}h90wWB9ywA+3Z4Bi~RC5sb(3mab7u_zUH=4`d&Ovsh?yM#f;$$_tk z*Y8jpo!KpD6D+UEwkXDfiaz}uJh9E#2zEs*7fLAFW3^f1Bm_eW?*uKWh#A}0FKlHW*MZFpU#>h1L{RlPikeNXuzV; zD6Ri@ncu@)^c@hOjCq) z(xOl09Toa0q-2%_Ls?(rRW%6dM`XhbsoP05J)mh4a-{+;XLl(R?~NXQ_xq%%fdZ?4 zs-PN|!$ozMj9WU)`)=z=dBc#W4@+KuMR#^bz=92jv=i8S|C0E-0rdNegQervsEZ=` zt43g+j^mh?mtR6N7mm1#zvo5E@HJIr?7!`(w+y5K6Ht|SN<$3FVy|#>RIWK8%)9;z zh8KNCXBwLnK>hh5(hB-cJ12aX=Aj9r0m{*d6>l!5Wco2w>07T)o_4>l`ic`BQBV8O z*i4u2Zr^rv`b2Z$W!hT&MZRLf24tLj7X*WiiK9zYWoF0={7Cqv|jsB^Td zjzmN%bQtUAAeh%ikvRd%htbaO|E$q%geb6M}>Q@F-}^EBjpeY+eQ!*6nM_*?mvTyP&4 zvJ*__Fsn>jy~g8LDOA13u?rE=?@|a77m4n0h`?Opfts4QS*MP1jAAv%M}sHpLIp5j zJ3MYf8SzG2 zEB>kWP>$t2O_NUApj_H ziIEQk^2DR&xAR2~Q4!5|(X)3`yYG5Z!2lY(%42Cx1Rc#n55;X+85r*qnV#j|apsCb zQKMJEvAV6u>!olik%fQI<$-Ow8K#Jvsoczsg_;XDE&*3Ov&0&g(D5j69%3e)1u|Qn zjV%EyGQV9!4ycuY=aBP@_vn;-@LaiaX}PWwa(>ov!46tSLH*9Xrp*}zBgE_;;M0kz z?czvZA1-XG*|m@hEldw)ame>CWl?~+N?kdFB6Gx}d%6xUiDx?m5M~bTwwWQ+^T?`Sddwf@YXJL}hhjx(HA-ts28;IYzU@TUGj!8FF%w z*}oV!h}TfWaP_lgUN+1$C54+L)`qdF=2Dh^!ozER4=<+(jgnYzQfj&I73h)&{l*2O zrPW{^SgtgBV5vOOmn&Sn384H>}cl1Ph{vL8*md1^{3Eyw4k=Cs=hDO_%W6h zyzuDO-GBDn+GUfb<;T!BM6P};>tm9!KulJ!OoQ@3!!17ceVM1CObr6-jr!K0mJrzN z#R{3^pl&V%6?phwJ#>-exi!%Y!=iqvvW)_)1L(-UP>2h>;ZDiZ{DUA(0A5gb_U(lH zSZ*+k46Y@i=75&rQEtX`)^E$rTYOeViNpgdW@<`iR#!_)Pn*_Co5+fMn^miAD(f4o zSlA;|#;Qx&i&Z}sL8Tzga+7sG6WtqHJSMwE7#mioP%od>TFO74ZrP`ePJ2aYkf|`qUp8;A z=W-=icepk{;kxh9+u5KG5PNUsaUlnV&G$K>zMMd_Q1@^z94~C9C)>z!vuC~xXzl8I z-4zT#&aiv-DIpHX%;LR(HL3i5Z})xE{v?}D)DS8iXcHnsS4pgMq=!#8IvH(b_t!fE zhyP6-9lAo-Zu9SxW9zz%>GG}QS{s7h-%soOE7Euy4B#Vv4!m%~J$o?J6QWT}GA#n_ zbPhekz41rWiOUSMDR(VVgv?3^H#MKkpI0gZ65>n{TgHe$R-uPCBCXGfBbP{Ep`=hnf$O(gJgsw)6Iw*j1v zMJ)y+>X{`kx%63shArbc^>;xWoB*qGjo+%#cHLiY#sjRa&hiWozCKeNxP0V1El5xJwvnEURF-P2^K*c2q6 zgrX9V7d0d`0<=3dJVtKoTe-;235;)fyt-@6<7X`kj~~CXs{Oi;E7Vk(`}{x|!ob;V zKu5|&aP{#53#7YRVmY&=UEpb_S#>s{pgW+>Q0BhpEaU6?EERQT1wuA@78#>C3OT7x zk;$G@L%lH?rDOAh<^J`+ke$wRO6#MF$}HyC9tjQj0txjdcq}B}w5QN)#=rNgj%=sR zFfqjC&R%Cpn6}bMTCW{;`ZkC0W!VF39_GHjfB|Jk>)y`E0boONPZRxvLTBP!Q9RN_ zcTA1Q8AC68nfa$8=pw)%cDXF@zu8lgMCk)B5k4`MqFGVEN!~7ZrSg z@4k9S{){S+O{j_QyI#cHkWXdX^aGiZT9?tt=>W;tBF6eDjPK~8FctIILBLmYIa}l^8<;`BX)$*7fk;?E&@}IssqfkC73`V zQ~6MJw9Mz3xFuv@e0_)+yYP*$S~T>DU&~D^2;E*QpO`a;t`@Z*GU8nqqSH2%2oa=^;SJaOl;AWBPO&F!!xg@R5 zV+zx&SIshHXe}1CLqg6!S!evqyqb;N!J=x(P*wj$a|+W51$pJl+QjO{;k`A5rTmu@ zSuW-^lOp~yRiHPq)S-; zL0o@BKrXzhS}{ky!EXE@Z0J%~`+k6|NsMjBs2?OcYK-`$?#>rFHSZu`TN_jY(Se2> zFQ5dc1{yK@gc7jeY@gHIKztoTe;tPwn&-x7hzs1sd^=_Bi{b#PHW-Ev?q2Qz@Mvfl z8gW2Daa+7wGl}r@L*k}U2WUjttnOUX6Fe1a)xWd0zVUT;5Mj|jMuY1HXCnUscruhj z2muDME?Yc|{rC;X$_mCk_8~*B^0bLlTX5UEJ9j=Jzwgp^2gfK(-ocPf*CvPCupZiaoAv-V+b((7oCujo;6w(A3ZPpuYd| zo!*~JU~RM7gTL68S!;fyy?p)q@9HPN{jP!!5@7f6EDb`xUx0tdST1;c|Mdfpk0$cN zgE~Y7|D*}GRlj5C41qx)t?@JRYN$hvuYU?=Fr*9k((gN2Gl%zQ4k8~MLiU@AUnIv_ z9?7^I);&GiRXA)wB|iFo)N*s}$(g@<41YUv{`v(Rbz2@9P5*uI{)_i4L#5^M%b?@Y zoa6DQ$CES1uf8A8pibtV9$%sUr39VW$+rhRJz1GKdH4O~J?eD*%;^Wq)2*OWhw_oP zPfx$joPPU$`W;2zJ44^Mr2h({|H+}#51-Qi&d^W3)9ENQoq<)%ah9r+%*3hSxj4J7 zmyQuvM_}Bm^j#owS2h>tK3vSj8Qc+bdcA2}C~eOwfG2KUZ~?G=HBN6nn%`54*xfX4 zy*6NocDBJ7)rvDPdNTC*@QN&5P(puUe8&?GFqCR_1a2)ae7)3s{w8a{zsiRKH}GX1 zgeRFW0{SWE{lb3IWn#iIsw{9RgbZ7EEkrn#8fsUY0Yl0zHfpu^9>%5mDCj0fjlIbxTDu?|`&u8kc zzCShDIDBwwYM46p@n+9wuZs3UlRKH#J%`>x0Pnqvkm5w3Q_z;F&)Y-=cE%)Z z@S{olJMs3xh1q7yMJ{<|5&voUAoCqSAaK)vV(MTn;PQ2DKGM^~FC9`0+0*WS9-kx; zWR}oXd}RG}z2E_dL_Vg0OW>3wV%wd(FpKIFb;D=%o;ah<7Ekrah--D3x-yJO50&cq z(=9*Fq+q2^N1@pxCQ&iy*->h2Ne_SIX+T`F_? z8;7{-ohuH1Q(7U0Je73yT$c4kS6624hafSQL6K3eun3^`OA^y+sf%s%9ZxFq3oS93 z>+nGqB>u3eMDdPEYoJS!0PS)?$`ba`!N--L+nZZoAI*GcK6&73`O*KZ5|BoHGy#te zE^OjF`lsg}{>VV>x~*~=y;*SPGDw}3&Ef02AF1(2!AsBO7`7d&5+u0wpDnvTk1BuM znNoYk=-qx&?Xeu=wf?DE5TN-!Zc~ExVI9?dh?Txz_2hwsyO-?HOVb5%q$_@LpzC_ zwI81bj-Rk_%TKLOx~u5dg3vd4zu7aR8|(rL(7U36Q0% zU8@oVmRbI0u$+;Qwa<&^iUApG{s_G)DT6huIV>um!dTT!Cv7zlTODj{KuH@M0Wf#6 z2P#-2R7qC5BbRayx#p6=CRM;~W`nW3tw~JnXD~TL>HoB_d0)45*W_TPME>RsdjvGoo+J9k9nZ#C8y`P|KEYkVx?jz0b z=w=j5L%w+nxvuz-{&SxRjNNyla(vDfa(X>y#8xY<{@DaoZF9G*zE)8jVdi^OS-Pey zcYZ-SHFVkbDUG9^^XRkHGZDM$<+^&~Ehd{%^#`@u=OitPWTL8^?aQq=8wR?+I9#o= ze|q$=!Ofh>aXhxHrD8$MYs*-f|9sw+C8V^CXz}=+Yix6KMcTghvc`)&1wryVx$HXc zM}l=yCk^zk*fv};-i;9M|7|a3B%dZ{HkjpF_yM=v$C;Mtpg!Td)1+wjpAg))t+vI? zd*@3jy&KG-yzF*e)QCOvb?|@f_jO*0*i?}qg6+6iUJ zb4s-f3hvOK*2Lnw2E{v@%Q4k>wNKrz%g7Ru908qVgAHBH{qw1xr986v(3FPLh^M^Xx%)x@v!dl$xe9_fa!sFHlqmLJ(v`c*y9ETRMVnD? zPVtPX-Pt3t3}oHf`PM@-z4V)v$qL}?WR)?yYZbVyYg>_%?Kw3)t}bVE<^!$Du>HMU z2mS53go2~8%#}TTzUUlRwAx5f5j4LP$KvD@$sMhbc6%=#rT%?GIJ~n>E${o%Fct5Q z#mT&Y#m}nAf6;XCYsI-YLJG1~9GIad#o9QDo2iGbzXZZ0a${IR3G&0$<8mdVSA=Jh zy@~ diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md index f978413fdb..b5fdcb5aeb 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md @@ -46,7 +46,7 @@ To isolate Microsoft Store apps on your network, you need to use Group Policy to - The Remote Server Administration Tools (RSAT) are installed on your client device. When you perform the following steps from your client device, you can select your Microsoft Store app when you create Windows Defender Firewall rules. > [!NOTE] -> Information the user should notice even if skimmingYou can install the RSAT on your device running Windows from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). +> You can install the RSAT on your device running Windows from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). ## Step 1: Define your network diff --git a/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 7a662068f1..c80bf05cb7 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -1,40 +1,25 @@ --- -title: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012 -description: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012 +title: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server +description: Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/14/2023 --- # Securing End-to-End IPsec connections by using IKEv2 - IKEv2 offers the following: -- Supports IPsec end-to-end transport mode connections - -- Provides interoperability for Windows with other operating systems that use IKEv2 for end-to-end security - -- Supports Suite B (RFC 4869) requirements - -- Coexists with existing policies that deploy AuthIP/IKEv1 - -- Uses the Windows PowerShell interface exclusively for configuration. You cannot configure IKEv2 through the user interface. - -- Uses certificates for the authentication mechanism +- Supports IPsec end-to-end transport mode connections +- Provides interoperability for Windows with other operating systems that use IKEv2 for end-to-end security +- Supports Suite B (RFC 4869) requirements +- Coexists with existing policies that deploy AuthIP/IKEv1 +- Uses the Windows PowerShell interface exclusively for configuration. You cannot configure IKEv2 through the user interface. +- Uses certificates for the authentication mechanism You can use IKEv2 as a virtual private network (VPN) tunneling protocol that supports automatic VPN reconnection. IKEv2 allows the security association to remain unchanged despite changes in the underlying connection. -**In this document** - -- [Prerequisites](#prerequisites) - -- [Devices joined to a domain](#devices-joined-to-a-domain) - -- [Device not joined to a domain](#devices-not-joined-to-a-domain) - -- [Troubleshooting](#troubleshooting) - ->**Note:**  This topic includes sample Windows PowerShell cmdlets. For more info, see [How to Run a Windows PowerShell Cmdlet](/previous-versions//bb648607(v=vs.85)). +> [!NOTE] +> This topic includes sample Windows PowerShell cmdlets. For more info, see [How to Run a Windows PowerShell Cmdlet](/previous-versions//bb648607(v=vs.85)). ## Prerequisites @@ -42,27 +27,19 @@ These procedures assume that you already have a public key infrastructure (PKI) ## Devices joined to a domain -The following Windows PowerShell script establishes a connection security rule that uses IKEv2 for communication between two computers (CLIENT1 and SERVER1) that are joined to the corp.contoso.com domain as shown in Figure 1. +The following Windows PowerShell script establishes a connection security rule that uses IKEv2 for communication between two computers (CLIENT1 and SERVER1) that are joined to the corp.contoso.com domain as shown in Figure 1. ![the contoso corporate network.](images/corpnet.gif) -**Figure 1** The Contoso corporate network +The script does the following: -This script does the following: - -- Creates a security group called **IPsec client and servers** and adds CLIENT1 and SERVER1 as members. - -- Creates a Group Policy Object (GPO) called **IPsecRequireInRequestOut** and links it to the corp.contoso.com domain. - -- Sets the permissions to the GPO so that they apply only to the computers in **IPsec client and servers** and not to **Authenticated Users**. - -- Indicates the certificate to use for authentication. - - >**Important:**  The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. - -- Creates the IKEv2 connection security rule called **My IKEv2 Rule**. - -![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** +- Creates a security group called **IPsec client and servers** and adds CLIENT1 and SERVER1 as members. +- Creates a Group Policy Object (GPO) called **IPsecRequireInRequestOut** and links it to the corp.contoso.com domain. +- Sets the permissions to the GPO so that they apply only to the computers in **IPsec client and servers** and not to **Authenticated Users**. +- Indicates the certificate to use for authentication. + > [!IMPORTANT] + > The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. +- Creates the IKEv2 connection security rule called **My IKEv2 Rule**. Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. @@ -89,7 +66,7 @@ $gpo | Set-GPPermissions -TargetName "Authenticated Users" -TargetType Group -Pe #Set up the certificate for authentication $gponame = "corp.contoso.com\IPsecRequireInRequestOut" $certprop = New-NetIPsecAuthProposal -machine -cert -Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -$myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" -proposal $certprop –PolicyStore GPO:$gponame +$myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" -proposal $certprop -PolicyStore GPO:$gponame #Create the IKEv2 Connection Security rule New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -Phase1AuthSet $myauth.InstanceID ` @@ -100,9 +77,8 @@ New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -Phase1AuthSet Use a Windows PowerShell script similar to the following to create a local IPsec policy on the devices that you want to include in the secure connection. ->**Important:**  The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. - -![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** +> [!IMPORTANT] +> The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. @@ -118,52 +94,44 @@ New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -Phase1AuthSet Make sure that you install the required certificates on the participating computers. -> **Note:** -> - For local devices, you can import the certificates manually if you have administrator access to the computer. For more info, see [Import or export certificates and private keys](https://windows.microsoft.com/windows-vista/Import-or-export-certificates-and-private-keys). -> - You need a root certificate and a computer certificate on all devices that participate in the secure connection. Save the computer certificate in the **Personal/Certificates** folder. -> - For remote devices, you can create a secure website to facilitate access to the script and certificates. +> [!NOTE] +> - For local devices, you can import the certificates manually if you have administrator access to the computer. For more info, see [Import or export certificates and private keys](https://windows.microsoft.com/windows-vista/Import-or-export-certificates-and-private-keys). +> - You need a root certificate and a computer certificate on all devices that participate in the secure connection. Save the computer certificate in the **Personal/Certificates** folder. +> - For remote devices, you can create a secure website to facilitate access to the script and certificates. ## Troubleshooting Follow these procedures to verify and troubleshoot your IKEv2 IPsec connections: -**Use the Windows Defender Firewall with Advanced Security snap-in to verify that a connection security rule is enabled.** +Use the Windows Defender Firewall with Advanced Security snap-in to verify that a connection security rule is enabled: -1. Open the Windows Defender Firewall with Advanced Security console. +1. Open the Windows Defender Firewall with Advanced Security console. +1. In the left pane of the Windows Defender Firewall with Advanced Security snap-in, click **Connection Security Rules**, and then verify that there is an enabled connection security rule. +1. Expand **Monitoring**, and then click **Connection Security Rules** to verify that your IKEv2 rule is active for your currently active profile. -2. In the left pane of the Windows Defender Firewall with Advanced Security snap-in, click **Connection Security Rules**, and then verify that there is an enabled connection security rule. +Use Windows PowerShell cmdlets to display the security associations: -3. Expand **Monitoring**, and then click **Connection Security Rules** to verify that your IKEv2 rule is active for your currently active profile. - -**Use Windows PowerShell cmdlets to display the security associations.** - -1. Open a Windows PowerShell command prompt. - -2. Type **get-NetIPsecQuickModeSA** to display the Quick Mode security associations. - -3. Type **get-NetIPsecMainModeSA** to display the Main Mode security associations. +1. Open a Windows PowerShell command prompt. +1. Type **get-NetIPsecQuickModeSA** to display the Quick Mode security associations. +1. Type **get-NetIPsecMainModeSA** to display the Main Mode security associations. **Use netsh to capture IPsec events.** -1. Open an elevated command prompt. -2. At the command prompt, type **netsh wfp capture start**. -3. Reproduce the error event so that it can be captured. -4. At the command prompt, type **netsh wfp capture stop**. +1. Open an elevated command prompt. +1. At the command prompt, type **netsh wfp capture start**. +1. Reproduce the error event so that it can be captured. +1. At the command prompt, type **netsh wfp capture stop**. A wfpdiag.cab file is created in the current folder. -5. Open the cab file, and then extract the wfpdiag.xml file. -6. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last "errorFrequencyTable" at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: +1. Open the cab file, and then extract the wfpdiag.xml file. +1. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last "errorFrequencyTable" at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: - ```xml - - ERROR_IPSEC_IKE_NO_CERT - 32 - - ``` +```xml + + ERROR_IPSEC_IKE_NO_CERT + 32 + +``` - In this example, there are 32 instances of the **ERROR\_IPSEC\_IKE\_NO\_CERT** error. So now you can search for **ERROR\_IPSEC\_IKE\_NO\_CERT** to get more details regarding this error. +In this example, there are 32 instances of the **ERROR_IPSEC_IKE_NO_CERT** error. So now you can search for **ERROR_IPSEC_IKE_NO_CERT** to get more details regarding this error. You might not find the exact answer for the issue, but you can find good hints. For example, you might find that there seems to be an issue with the certificates, so you can look at your certificates and the related cmdlets for possible issues. - -## See also - -- [Windows Defender Firewall with Advanced Security](index.md) From ed8be10c56e566342fd218ad8c4a3388d13a8bfe Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 09:06:33 -0500 Subject: [PATCH 120/237] redirects --- .openpublishing.redirection.windows-security.json | 15 ++++++++++----- .../best-practices-configuring.md | 15 ++++++++++----- .../create-windows-firewall-rules-in-intune.md | 8 ++------ 3 files changed, 22 insertions(+), 16 deletions(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 467d5caba9..1ae3a73d17 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -6925,11 +6925,6 @@ "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/create-wmi-filters-for-the-gpo", "redirect_document_id": false }, - { - "source_path": "windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", - "redirect_document_id": false - }, { "source_path": "windows/security/threat-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/determining-the-trusted-state-of-your-devices", @@ -7994,6 +7989,16 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell", "redirect_document_id": false + }, + { + "source_path": "windows/security/threat-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", + "redirect_url": "/windows/security/operating-system-security/network-security/configure-with-powershell", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index e9d123de43..3936eb1b0e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -7,13 +7,17 @@ ms.topic: best-practice # Best practices for configuring Windows Firewall -Windows Firewall with Advanced Security provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. These recommendations cover a wide range of deployments including home networks and enterprise desktop/server systems. +Windows Firewall provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. -To open Windows Firewall, select **Start** > **Run**, type **wf.msc**, and then select **OK**. See also [Open Windows Firewall](open-windows-firewall-with-advanced-security.md). +## Access the Windows Firewall with Advanced Security console + +If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. + +If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. ## Keep default settings -When you open the Windows Firewall for the first time, you can see the default settings applicable to the local computer. The Overview panel displays security settings for each type of network to which the device can connect. +The *Overview* panel of the *Windows Firewall with Advanced Security* console displays security settings for each type of network to which the device can connect. ![Windows Firewall with Advanced Security first time opening.](images/fw01-profiles.png) @@ -23,12 +27,13 @@ When you open the Windows Firewall for the first time, you can see the default s To view detailed settings for each profile, right-click the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then select **Properties**. -Maintain the default settings in Windows Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. +> [!TIP] +> Maintain the default settings in Windows Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. :::image type="content" source="images/fw03-defaults.png" alt-text="Screenshot of the default inbound/outbound Firewall settings."::: > [!IMPORTANT] -> To maintain maximum security, do not change the default Block setting for inbound connections. +> To maintain maximum security, don't change the default Block setting for inbound connections. For more on configuring basic firewall settings, see [Turn on Windows Firewall and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md) and [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md index 2ee70cb742..c68bef4175 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -93,9 +93,9 @@ Default is Any address [Learn more](https://aka.ms/intunefirewallremotaddressrule) -## Edge traversal (UI coming soon) +## Edge traversal -Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. This setting can only be configured via Intune Graph at this time. +Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. [Learn more](/windows/client-management/mdm/firewall-csp#edgetraversal) @@ -104,7 +104,3 @@ Indicates whether edge traversal is enabled or disabled for this rule. The EdgeT Specifies the list of authorized local users for this rule. A list of authorized users can't be specified if the rule being authored is targeting a Windows service. Default is all users. [Learn more](/windows/client-management/mdm/firewall-csp#localuserauthorizedlist) - -## Configuring firewall rules programmatically - -Coming soon. From de4e4236047a9b0d85b2f3229b528d603f9c6eba Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 09:27:38 -0500 Subject: [PATCH 121/237] Acrolinx --- ...blishing.redirection.windows-security.json | 5 ++ .../windows-firewall/quarantine.md | 65 ++++++++----------- 2 files changed, 32 insertions(+), 38 deletions(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 1ae3a73d17..47d10ce050 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7995,6 +7995,11 @@ "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", "redirect_document_id": false }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false + }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", "redirect_url": "/windows/security/operating-system-security/network-security/configure-with-powershell", diff --git a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md index 7db925d52d..ea79641339 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md @@ -7,15 +7,13 @@ ms.date: 09/08/2021 # Quarantine behavior -One of the security challenges that network admins face is configuring a machine properly after a network change. +One of the security challenges that network admins face is configuring a device properly after a network change. -Network changes can happen frequently. Additionally, the operations required to recategorize the network after a change and apply the correct security policies on a machine are non-trivial and may require considerable CPU time. This requirement by operations is especially true for machines that are part of the domain. In the past, the delay in applying security policies during network recategorization has been successfully exploited for vulnerabilities. +Network changes can happen frequently. The operations required to recategorize the network after a change, and apply the correct security policies on a device, are nontrivial and might require considerable CPU time. This requirement by operations is especially true for devices that are part of a domain. The delay in applying security policies during network recategorization can be exploited for vulnerabilities. -To counter this potential exploitation, Windows Firewall will quarantine an interface until the system has successfully recategorized the network, and Windows Filtering Platform (WFP) has the correct filters applied for the updated interface configuration. During quarantine, all new inbound connections without exceptions are blocked to the machine. +To counter the potential exploitation, Windows Firewall quarantines an interface until the system successfully recategorizes the network, and Windows Filtering Platform (WFP) has the correct filters applied for the updated interface configuration. During quarantine, all new inbound connections without exceptions are blocked. -While the quarantine feature has long been a part of Windows Firewall, the feature behavior has often caused confusion for customers unaware of quarantine and its motivations. - -Ultimately, the goal of this document is to describe the quarantine feature at a high level and help network admins understand why the application traffic is sometimes blocked by quarantine. +This document describes the quarantine feature and explains why the application traffic could be blocked by quarantine. ## Quarantine filters @@ -25,28 +23,25 @@ The quarantine feature creates filters that can be split into three categories: - Quarantine default exception filters - Interface un-quarantine filters -These filters are added in the FWPM_SUBLAYER_MPSSVC_QUARANTINE sublayer and these layers are: +These filters are added in the `FWPM_SUBLAYER_MPSSVC_QUARANTINE` sublayer and these layers are: -1. FWPM_LAYER_ALE_AUTH_CONNECT_V4 - -2. FWPM_LAYER_ALE_AUTH_CONNECT_V6 - -3. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 - -4. FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 +1. `FWPM_LAYER_ALE_AUTH_CONNECT_V4` +1. `FWPM_LAYER_ALE_AUTH_CONNECT_V6` +1. `FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4` +1. `FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6` >[!NOTE] -> Any firewall rules added by the customers will not affect the filters in the quarantine sublayer as filters from Firewall rules are added in the FWPM_SUBLAYER_MPSSVC_WF sublayer. In other words, customers cannot add their own exception filters to prevent packets from being evaluated by quarantine filters. +> Any firewall rules added by policy settings don't affect the filters in the quarantine sublayer. Filters from firewall rules are added in the `FWPM_SUBLAYER_MPSSVC_WF` sublayer. In other words, you can't add your own exception filters to prevent packets from being evaluated by quarantine filters. For more information about WFP layers and sublayers, see [WFP Operation](/windows/win32/fwp/basic-operation). ### Quarantine default inbound block filter -The quarantine default inbound block filter effectively blocks any new non-loopback inbound connections if the packet isn't explicitly permitted by another filter in the quarantine sublayer. +The *quarantine default inbound block filter* blocks any new non-loopback inbound connections, unless the packet isn't explicitly permitted by another filter in the quarantine sublayer. ### Quarantine default exception filters -When the interface is in quarantine state, the quarantine default exception filters will permit new inbound connections given that they meet the conditions of an exception filter. One example of the exception filters is the quarantine default inbound loopback exception filter. This exception filter allows all loopback packets when the interface is in quarantine state. +When the interface is in quarantine state, the quarantine default exception filters permit new inbound connections given that they meet the conditions of an exception filter. One example of the exception filters is the quarantine default inbound loopback exception filter. This exception filter allows all loopback packets when the interface is in quarantine state. ### Interface un-quarantine filter @@ -54,25 +49,20 @@ The interface un-quarantine filters allow all non-loopback packets if the interf ## Quarantine flow -The following events describe the general flow of quarantine: +The following events describe the general flow of quarantine: -1. There's some change on the current network interface. - -2. The interface un-quarantine filters will no longer permit new inbound connections. The interface is now in quarantine state. - -3. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter. - -4. The WFP filters applicable to the old interface state are removed. - -5. The WFP filters applicable to the new interface state are added, which include the un-quarantine filters for this interface. These filters are updated to match the interface's current state. - -6. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets. +1. There's some change on the current network interface +1. The interface un-quarantine filters don't permit new inbound connections. The interface is now in quarantine state +1. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter +1. The WFP filters applicable to the old interface state are removed +1. The WFP filters applicable to the new interface state are added, which include the un-quarantine filters for this interface. These filters are updated to match the interface's current state +1. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets ## Quarantine diagnostics There are two methods of identifying packet drops from the quarantine default inbound block filter. -Given that the network connectivity issue is reproducible, diagnostic traces can be collected by running the following in an administrative command prompt: +Given that the network connectivity issue is reproducible, diagnostic traces can be collected by running the following in an administrative command prompt: ```console Netsh wfp cap start @@ -82,17 +72,17 @@ Netsh wfp cap stop These commands generate a wfpdiag.cab. Inside the .cab exists a wfpdiag.xml, which contains drop `netEvents` and filters that existed during that reproduction. -Inside the wfpdiag.xml, search for `netEvents` that have `FWPM_NET_EVENT_TYPE_CLASSIFY_DROP` as the `netEvent` type. To find the relevant drop events, search for the drop events with matching destination IP address, package SID, or application ID name. +Inside the wfpdiag.xml, search for `netEvents` that have `FWPM_NET_EVENT_TYPE_CLASSIFY_DROP` as the `netEvent` type. To find the relevant drop events, search for the drop events with matching destination IP address, package SID, or application ID name. -The characters in the application ID name will be separated by periods: +The characters in the application ID name are separated by periods: ```XML \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... ``` -The `netEvent` will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. +The `netEvent` contains more information about the dropped packet, including information about its capabilities, the filter that dropped the packet, and much more. -If the filter that dropped that packet was by the quarantine default inbound block filter, then the drop `netEvent` will have `filterOrigin` as `Quarantine Default`. +If the filter that dropped that packet was by the quarantine default inbound block filter, then the drop `netEvent` contains `filterOrigin` as `Quarantine Default`. The following code is a sample `netEvent` with `filterOrigin` as `Quarantine Default`. @@ -170,10 +160,9 @@ The following code is a sample `netEvent` with `filterOrigin` as `Quarantine Def 5 - ``` -Alternatively, If the Filtering Platform Connection failure auditing is enabled, the drop event will be logged in Windows Event Viewer. +Alternatively, If the Filtering Platform Connection failure auditing is enabled, the drop event is logged in Windows Event Viewer. To enable Filtering Platform Connection audits, run the following command in an administrative command prompt: @@ -194,8 +183,8 @@ Get-NetIPInterface –InterfaceIndex 5 ![Quarantine Interfaceindex.](images/quarantine-interfaceindex1.png) -With the help of the interface name, event viewer can be searched for any interface related changes. +With the help of the interface name, event viewer can be searched for any interface related changes. To enable more networking audit events, see [Enable IPsec and Windows Firewall Audit Events](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754714(v=ws.10)). -Packet drops from the quarantine default inbound block filter are often transient and don't signify anything more than a network change on the interface. \ No newline at end of file +Packet drops from the quarantine default inbound block filter are often transient and don't signify anything more than a network change on the interface. From c03403df5907a376e805790351631a0c8a0fedad Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 09:48:47 -0500 Subject: [PATCH 122/237] updates --- includes/configure/gpo-settings-1.md | 2 +- .../configure/intune-settings-catalog-1.md | 2 +- includes/configure/registry.md | 2 +- .../data-protection/bitlocker/configure.md | 2 - .../configure-with-powershell.md | 216 +++++++++++------- ...create-windows-firewall-rules-in-intune.md | 3 - .../windows-firewall/images/cmd.svg | 9 + .../windows-firewall/images/powershell.svg | 9 + 8 files changed, 158 insertions(+), 87 deletions(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/cmd.svg create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/powershell.svg diff --git a/includes/configure/gpo-settings-1.md b/includes/configure/gpo-settings-1.md index cb62ec67ec..4a7b56a8be 100644 --- a/includes/configure/gpo-settings-1.md +++ b/includes/configure/gpo-settings-1.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure a device using group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use the following settings: +To configure a device with group policy, use the [Local Group Policy Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc731745(v=ws.10)). To configure multiple devices joined to Active Directory, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and use the following settings: diff --git a/includes/configure/intune-settings-catalog-1.md b/includes/configure/intune-settings-catalog-1.md index d0b87a5b78..b27582fd32 100644 --- a/includes/configure/intune-settings-catalog-1.md +++ b/includes/configure/intune-settings-catalog-1.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure devices using Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use the following settings: \ No newline at end of file +To configure devices with Microsoft Intune, [create a Settings catalog policy](/mem/intune/configuration/settings-catalog) and use the following settings: \ No newline at end of file diff --git a/includes/configure/registry.md b/includes/configure/registry.md index 9f01c1e254..2c620f057a 100644 --- a/includes/configure/registry.md +++ b/includes/configure/registry.md @@ -6,4 +6,4 @@ ms.topic: include ms.prod: windows-client --- -To configure devices using the [Registry Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc755256(v=ws.11)), use the following settings: \ No newline at end of file +To configure devices with the [Registry Editor](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc755256(v=ws.11)), use the following settings: \ No newline at end of file diff --git a/windows/security/operating-system-security/data-protection/bitlocker/configure.md b/windows/security/operating-system-security/data-protection/bitlocker/configure.md index 2440fda840..12bf6e3613 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/configure.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/configure.md @@ -10,11 +10,9 @@ ms.date: 10/30/2023 To configure BitLocker, you can use one of the following options: - Configuration Service Provider (CSP): this option is commonly used for devices managed by a Mobile Device Management (MDM) solution, like Microsoft Intune. The [BitLocker CSP][WIN-1] is used to configure BitLocker, and to report the status of different BitLocker functions to the MDM solution. With Microsoft Intune, you can use the BitLocker status in [compliance policies][INT-1], combining them with [Conditional Access][ENTRA-1]. Conditional Access can prevent or grant access to services like Exchange Online and SharePoint Online, based on the status of BitLocker. To learn more about the Intune options to configure and monitor BitLocker, check the following articles: - - [Manage BitLocker policy for Windows devices with Intune][INT-2] - [Monitor device encryption with Intune][INT-3] - [Use compliance policies to set rules for devices you manage with Intune][INT-4] - - Group policy (GPO): this option can be used for devices that are joined to an Active Directory domain and aren't managed by a device management solution. Group policy can also be used for devices that aren't joined to an Active Directory domain, using the local group policy editor - Microsoft Configuration Manager: this option can be used for devices that are managed by Microsoft Configuration Manager using the BitLocker management agent. To learn more about options to configure BitLocker via Microsoft Configuration Manager, see [Deploy BitLocker management][MCM-1] diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md index 2028486959..c8fa26d55d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md @@ -1,45 +1,48 @@ --- -title: Windows Defender Firewall with Advanced Security Administration with Windows PowerShell -description: Windows Defender Firewall with Advanced Security Administration with +title: Manage Windows Firewall with PowerShell +description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/14/2023 --- # Manage Windows Firewall with PowerShell -The Windows Defender Firewall with Advanced Security Administration with Windows PowerShell Guide provides essential scriptlets for automating Windows Defender Firewall management. It's designed for IT pros, system administrators, IT managers, and others who use and need to automate Windows Defender Firewall management in Windows. -You can use Windows PowerShell to manage your firewall and IPsec deployments. This object-oriented scripting environment will make it easier for you to manage policies and monitor network conditions than was possible in netsh. Windows PowerShell allows network settings to be self-discoverable through the syntax and parameters in each of the cmdlets. This guide demonstrates how common tasks were performed in netsh and how you can use Windows PowerShell to accomplish them. -In future versions of Windows, Microsoft might remove the netsh functionality for Windows Defender Firewall. Microsoft recommends that you transition to Windows PowerShell if you currently use netsh to configure and manage Windows Defender Firewall. -Windows PowerShell and netsh command references are at the following locations. -- [Netsh Commands for Windows Defender Firewall](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc771920(v=ws.10)) -## Scope -This guide doesn't teach you the fundamentals of Windows Defender Firewall, which can be found in [Windows Firewall](index.md). It doesn't teach the fundamentals of Windows PowerShell, and it assumes that you're familiar with the Windows PowerShell language and the basic concepts of Windows PowerShell. For more info about Windows PowerShell concepts and usage, see the reference topics in the [Additional resources](#other-resources) section of this guide. -## Audience and user requirements -This guide is intended for IT pros, system administrators, and IT managers, and it assumes that you're familiar with Windows Defender Firewall, the Windows PowerShell language, and the basic concepts of Windows PowerShell. +This article provides examples how to manage Windows Firewall with PowerShell and `netsh.exe`, which can be used to automate the management of Windows Firewall. ## Set profile global defaults -Global defaults set the device behavior in a per-profile basis. Windows Defender Firewall supports Domain, Private, and Public profiles. +Global defaults set the device behavior in a per-profile basis. Windows Firewall supports Domain, Private, and Public profiles. -### Enable Windows Defender Firewall with Advanced Security +### Enable Windows Firewall + +Windows Firewall drops traffic that doesn't correspond to allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't enforced, you might need to enable Windows Firewall. Here's how to enable Windows Firewall on a local device: + +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) -Windows Defender Firewall drops traffic that doesn't correspond to - allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't being enforced, you may need to enable Windows Defender Firewall. Here's how to enable Windows Defender Firewall on a local domain device: -**Netsh** -``` cmd -netsh.exe advfirewall set allprofiles state on -``` -**Windows PowerShell** ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` -### Control Windows Defender Firewall with Advanced Security behavior +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) -The global default settings can be defined through the command-line interface. These modifications are also available through the Windows Defender Firewall with Advanced Security console. +``` cmd +netsh.exe advfirewall set allprofiles state on +``` + +--- + +### Control Windows Firewall behavior + +The global default settings can be defined through the command-line interface. These modifications are also available through the Windows Firewall console. The following scriptlets set the default inbound and outbound actions, specifies protected network connections, and allows notifications to be displayed to the user when a program is blocked from receiving inbound connections. It allows unicast response to multicast or broadcast network traffic, and it specifies logging settings for troubleshooting. -**Netsh** +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) + +```powershell +Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow -NotifyOnListen True -AllowUnicastResponseToMulticast True -LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log +``` + +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ```cmd netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound @@ -48,34 +51,47 @@ netsh advfirewall set allprofiles settings unicastresponsetomulticast enable netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log ``` -```powershell -Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow -NotifyOnListen True -AllowUnicastResponseToMulticast True -LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log -``` -### Disable Windows Defender Firewall with Advanced Security -Microsoft recommends that you don't disable Windows Defender Firewall because you lose other benefits provided by the service, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, [Windows Service Hardening](https://go.microsoft.com/fwlink/?linkid=104976), and [boot time filters](https://blogs.technet.microsoft.com/networking/2009/03/24/stopping-the-windows-authenticating-firewall-service-and-the-boot-time-policy/). -Disabling Windows Defender Firewall with Advanced Security can also cause problems, including: +--- + +### Disable Windows Firewall + +Microsoft recommends that you don't disable Windows Firewall because you lose other benefits provided by the service, such as the ability to use Internet Protocol security (IPsec) connection security rules, network protection from attacks that employ network fingerprinting, [Windows Service Hardening](https://go.microsoft.com/fwlink/?linkid=104976), and [boot time filters](https://blogs.technet.microsoft.com/networking/2009/03/24/stopping-the-windows-authenticating-firewall-service-and-the-boot-time-policy/). +Disabling Windows Firewall can also cause problems, including: + - Start menu can stop working - Modern applications can fail to install or update - Activation of Windows via phone fails -- Application or OS incompatibilities that depend on Windows Defender Firewall -Microsoft recommends disabling Windows Defender Firewall only when installing a third-party firewall, and resetting Windows Defender Firewall back to defaults when the third-party software is disabled or removed. -If disabling Windows Defender Firewall is required, don't disable it by stopping the Windows Defender Firewall service (in the **Services** snap-in, the display name is Windows Defender Firewall and the service name is MpsSvc). -Stopping the Windows Defender Firewall service isn't supported by Microsoft. -Non-Microsoft firewall software can programmatically disable only the parts of Windows Defender Firewall that need to be disabled for compatibility. +- Application or OS incompatibilities that depend on Windows Firewall + +Microsoft recommends disabling Windows Firewall only when installing a third-party firewall, and resetting Windows Firewall back to defaults when the third-party software is disabled or removed. +If disabling Windows Firewall is required, don't disable it by stopping the Windows Firewall service (in the **Services** snap-in, the display name is Windows Firewall and the service name is MpsSvc). +Stopping the Windows Firewall service isn't supported by Microsoft. +Non-Microsoft firewall software can programmatically disable only the parts of Windows Firewall that need to be disabled for compatibility. You shouldn't disable the firewall yourself for this purpose. -The proper method to disable the Windows Defender Firewall is to disable the Windows Defender Firewall Profiles and leave the service running. -Use the following procedure to turn off the firewall, or disable the Group Policy setting **Computer Configuration|Administrative Templates|Network|Network Connections|Windows Defender Firewall|Domain Prolfile|Windows Defender Firewall:Protect all network connections**. -For more information, see [Windows Defender Firewall with Advanced Security deployment guide](windows-firewall-with-advanced-security-deployment-guide.md). -The following example disables Windows Defender Firewall for all profiles. +The proper method to disable the Windows Firewall is to disable the Windows Firewall Profiles and leave the service running. +Use the following procedure to turn off the firewall, or disable the Group Policy setting **Computer Configuration|Administrative Templates|Network|Network Connections|Windows Firewall|Domain Prolfile|Windows Firewall:Protect all network connections**. +For more information, see [Windows Firewall deployment guide](windows-firewall-with-advanced-security-deployment-guide.md). +The following example disables Windows Firewall for all profiles. + +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) + ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False ``` + +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +--- + ## Deploy basic firewall rules + This section provides scriptlet examples for creating, modifying, and deleting firewall rules. + ### Create firewall rules + Adding a firewall rule in Windows PowerShell looks a lot like it did in Netsh, but the parameters and values are specified differently. Here's an example of how to allow the Telnet application to listen on the network. This firewall rule is scoped to the local subnet by using a keyword instead of an IP address. Just like in Netsh, the rule is created on the local device, and it becomes effective immediately. -**Netsh** + ```cmd netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= %SystemRoot%\System32\tlntsvr.exe remoteip=localsubnet action=allow ``` @@ -83,9 +99,10 @@ netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= ```powershell New-NetFirewallRule -DisplayName "Allow Inbound Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow ``` + The following scriptlet shows how to add a basic firewall rule that blocks outbound traffic from a specific application and local port to a Group Policy Object (GPO) in Active Directory. In Windows PowerShell, the policy store is specified as a parameter within the **New-NetFirewall** cmdlet. In Netsh, you must first specify the GPO that the commands in a Netsh session should modify. The commands you enter are run against the contents of the GPO, and the execution remains in effect until the Netsh session is ended or until another set store command is executed. Here, **domain.contoso.com** is the name of your Active Directory Domain Services (AD DS), and **gpo\_name** is the name of the GPO that you want to modify. Quotation marks are required if there are any spaces in the GPO name. -**Netsh** + ```cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program=%SystemRoot%\System32\telnet.exe protocol=tcp localport=23 action=block @@ -94,7 +111,9 @@ netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program ```powershell New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -LocalPort 23 -Action Block -PolicyStore domain.contoso.com\gpo_name ``` + ### GPO Caching + To reduce the burden on busy domain controllers, Windows PowerShell allows you to load a GPO to your local session, make all your changes in that session, and then save it back at all once. The following command performs the same actions as the previous example (by adding a Telnet rule to a GPO), but we do so by applying GPO caching in PowerShell. Changing the GPO by loading it onto your local session and using the *-GPOSession* parameter aren't supported in Netsh @@ -103,11 +122,14 @@ $gpo = Open-NetGPO -PolicyStore domain.contoso.com\gpo_name New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\telnet.exe -Protocol TCP -LocalPort 23 -Action Block -GPOSession $gpo Save-NetGPO -GPOSession $gpo ``` + This command doesn't batch your individual changes, it loads and saves the entire GPO at once. So if any other changes are made by other administrators, or in a different Windows PowerShell window, saving the GPO overwrites those changes. + ### Modify an existing firewall rule + When a rule is created, Netsh and Windows PowerShell allow you to change rule properties and influence, but the rule maintains its unique identifier (in Windows PowerShell, this identifier is specified with the *-Name* parameter). For example, you could have a rule **Allow Web 80** that enables TCP port 80 for inbound unsolicited traffic. You can change the rule to match a different remote IP address of a Web server whose traffic will be allowed by specifying the human-readable, localized name of the rule. -**Netsh** + ```cmd netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 ``` @@ -115,6 +137,7 @@ netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 ```powershell Set-NetFirewallRule -DisplayName "Allow Web 80" -RemoteAddress 192.168.0.2 ``` + Netsh requires you to provide the name of the rule for it to be changed and we don't have an alternate way of getting the firewall rule. In Windows PowerShell, you can query for the rule using its known properties. When you run `Get-NetFirewallRule`, you may notice that common conditions like addresses and ports don't appear. These conditions are represented in separate objects called Filters. As shown before, you can set all the conditions in New-NetFirewallRule and Set-NetFirewallRule. If you want to query for firewall rules based on these fields (ports, addresses, security, interfaces, services), you'll need to get the filter objects themselves. You can change the remote endpoint of the **Allow Web 80** rule (as done previously) using filter objects. Using Windows PowerShell, you query by port using the port filter, then assuming other rules exist affecting the local port, you build with further queries until your desired rule is retrieved. @@ -123,11 +146,13 @@ In the following example, we assume the query returns a single firewall rule, wh ```powershell Get-NetFirewallPortFilter | ?{$_.LocalPort -eq 80} | Get-NetFirewallRule | ?{ $_.Direction -eq "Inbound" -and $_.Action -eq "Allow"} | Set-NetFirewallRule -RemoteAddress 192.168.0.2 ``` + You can also query for rules using the wildcard character. The following example returns an array of firewall rules associated with a particular program. The elements of the array can be modified in subsequent `Set-NetFirewallRule` cmdlets. ```powershell Get-NetFirewallApplicationFilter -Program "*svchost*" | Get-NetFirewallRule ``` + Multiple rules in a group can be simultaneously modified when the associated group name is specified in a Set command. You can add firewall rules to specified management groups in order to manage multiple rules that share the same influences. In the following example, we add both inbound and outbound Telnet firewall rules to the group **Telnet Management**. In Windows PowerShell, group membership is specified when the rules are first created so we re-create the previous example rules. Adding rules to a custom rule group isn't possible in Netsh. @@ -135,6 +160,7 @@ In the following example, we add both inbound and outbound Telnet firewall rules New-NetFirewallRule -DisplayName "Allow Inbound Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow -Group "Telnet Management" New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow -Group "Telnet Management" ``` + If the group isn't specified at rule creation time, the rule can be added to the rule group using dot notation in Windows PowerShell. You can't specify the group using `Set-NetFirewallRule` since the command allows querying by rule group. ```powershell @@ -142,25 +168,29 @@ $rule = Get-NetFirewallRule -DisplayName "Allow Inbound Telnet" $rule.Group = "Telnet Management" $rule | Set-NetFirewallRule ``` + With the help of the `Set` command, if the rule group name is specified, the group membership isn't modified but rather all rules of the group receive the same modifications indicated by the given parameters. The following scriptlet enables all rules in a predefined group containing remote management influencing firewall rules. -**Netsh** + ```cmd -netsh advfirewall firewall set rule group="Windows Defender Firewall remote management" new enable=yes +netsh advfirewall firewall set rule group="Windows Firewall remote management" new enable=yes ``` ```powershell -Set-NetFirewallRule -DisplayGroup "Windows Defender Firewall Remote Management" -Enabled True +Set-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Enabled True ``` + There's also a separate `Enable-NetFirewallRule` cmdlet for enabling rules by group or by other properties of the rule. ```powershell -Enable-NetFirewallRule -DisplayGroup "Windows Defender Firewall Remote Management" -Verbose +Enable-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Verbose ``` + ### Delete a firewall rule + Rule objects can be disabled so that they're no longer active. In Windows PowerShell, the **Disable-NetFirewallRule** cmdlet will leave the rule on the system, but put it in a disabled state so the rule no longer is applied and impacts traffic. A disabled firewall rule can be re-enabled by **Enable-NetFirewallRule**. This cmdlet is different from the **Remove-NetFirewallRule**, which permanently removes the rule definition from the device. The following cmdlet deletes the specified existing firewall rule from the local policy store. -**Netsh** + ```cmd netsh advfirewall firewall delete rule name="Allow Web 80" ``` @@ -168,11 +198,13 @@ netsh advfirewall firewall delete rule name="Allow Web 80" ```powershell Remove-NetFirewallRule -DisplayName "Allow Web 80" ``` + Like with other cmdlets, you can also query for rules to be removed. Here, all blocking firewall rules are deleted from the device. ```powershell Remove-NetFirewallRule -Action Block ``` + It may be safer to query the rules with the **Get** command and save it in a variable, observe the rules to be affected, then pipe them to the **Remove** command, just as we did for the **Set** commands. The following example shows how you can view all the blocking firewall rules, and then delete the first four rules. ```powershell @@ -180,27 +212,34 @@ $x = Get-NetFirewallRule -Action Block $x $x[0-3] | Remove-NetFirewallRule ``` + ## Manage remotely + Remote management using WinRM is enabled by default. The cmdlets that support the *CimSession* parameter use WinRM and can be managed remotely by default. The following example returns all firewall rules of the persistent store on a device named **RemoteDevice**. ```powershell Get-NetFirewallRule -CimSession RemoteDevice ``` + We can perform any modifications or view rules on remote devices by using the *-CimSession* parameter. Here we remove a specific firewall rule from a remote device. ```powershell $RemoteSession = New-CimSession -ComputerName RemoteDevice Remove-NetFirewallRule -DisplayName "AllowWeb80" -CimSession $RemoteSession -Confirm ``` + ## Deploy basic IPsec rule settings + An Internet Protocol security (IPsec) policy consists of rules that determine IPsec behavior. IPsec supports network-level peer authentication, data origin authentication, data integrity, data confidentiality (encryption), and replay protection. -Windows PowerShell can create powerful, complex IPsec policies like in Netsh and the Windows Defender Firewall with Advanced Security console. However, because Windows PowerShell is object-based rather than string token-based, configuration in Windows PowerShell offers greater control and flexibility. +Windows PowerShell can create powerful, complex IPsec policies like in Netsh and the Windows Firewall console. However, because Windows PowerShell is object-based rather than string token-based, configuration in Windows PowerShell offers greater control and flexibility. In Netsh, the authentication and cryptographic sets were specified as a list of comma-separated tokens in a specific format. In Windows PowerShell, rather than using default settings, you first create your desired authentication or cryptographic proposal objects and bundle them into lists in your preferred order. Then, you create one or more IPsec rules that reference these sets. The benefit of this model is that programmatic access to the information in the rules is much easier. See the following sections for clarifying examples. ![object model for creating a single ipsec rule.](images/createipsecrule.gif) + ### Create IPsec rules + The following cmdlet creates basic IPsec transport mode rule in a Group Policy Object. An IPsec rule is simple to create; all that is required is the display name, and the remaining properties use default values. Inbound traffic is authenticated and integrity checked using the default quick mode and main mode settings. These default settings can be found in the console under Customize IPsec Defaults. -**Netsh** + ```cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout @@ -209,12 +248,14 @@ netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint ```powershell New-NetIPsecRule -DisplayName "Require Inbound Authentication" -PolicyStore domain.contoso.com\gpo_name ``` + ### Add custom authentication methods to an IPsec rule + If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](/previous-versions/windows/it-pro/windows-server-2003/cc757847(v=ws.10)) . You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object. ![crypto set object.](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. -**Netsh** + ```cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall consec add rule name="Require Outbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout qmsecmethods=ah:sha1+esp:sha1-3des @@ -225,15 +266,20 @@ $AHandESPQM = New-NetIPsecQuickModeCryptoProposal -Encapsulation AH,ESP -AHHash $QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "ah:sha1+esp:sha1-des3" -Proposal $AHandESPQM -PolicyStore domain.contoso.com\gpo_name New-NetIPsecRule -DisplayName "Require Inbound Authentication" -InboundSecurity Require -OutboundSecurity Request -QuickModeCryptoSet $QMCryptoSet.Name -PolicyStore domain.contoso.com\gpo_name ``` + ### IKEv2 IPsec transport rules + A corporate network may need to secure communications with another agency. But, you discover the agency runs non-Windows operating systems and requires the use of the Internet Key Exchange Version 2 (IKEv2) standard. You can apply IKEv2 capabilities in Windows Server 2012 by specifying IKEv2 as the key module in an IPsec rule. This capability specification can only be done using computer certificate authentication and can't be used with phase-2 authentication. ```powershell New-NetIPsecRule -DisplayName "Require Inbound Authentication" -InboundSecurity Require -OutboundSecurity Request -Phase1AuthSet MyCertAuthSet -KeyModule IKEv2 -RemoteAddress $nonWindowsGateway ``` + For more info about IKEv2, including scenarios, see [Securing End-to-End IPsec Connections by Using IKEv2](securing-end-to-end-ipsec-connections-by-using-ikev2.md). + ### Copy an IPsec rule from one policy to another + Firewall and IPsec rules with the same rule properties can be duplicated to simplify the task of re-creating them within different policy stores. To copy the previously created rule from one policy store to another, the associated objects must also be copied separately. There's no need to copy associated firewall filters. You can query rules to be copied in the same way as other cmdlets. Copying individual rules is a task that isn't possible through the Netsh interface. Here's how you can accomplish it with Windows PowerShell. @@ -243,36 +289,44 @@ $Rule = Get-NetIPsecRule -DisplayName "Require Inbound Authentication" $Rule | Copy-NetIPsecRule -NewPolicyStore domain.costoso.com\new_gpo_name $Rule | Copy-NetPhase1AuthSet -NewPolicyStore domain.costoso.com\new_gpo_name ``` + ### Handling Windows PowerShell errors + To handle errors in your Windows PowerShell scripts, you can use the *-ErrorAction* parameter. This parameter is especially useful with the **Remove** cmdlets. If you want to remove a particular rule, you'll notice that it fails if the rule isn't found. When rules are being removed, if the rule isn't already there, it's acceptable to ignore that error. In this case, you can do the following to suppress any "rule not found" errors during the remove operation. ```powershell Remove-NetFirewallRule -DisplayName "Contoso Messenger 98" -ErrorAction SilentlyContinue ``` + The use of wildcards can also suppress errors, but they could potentially match rules that you didn't intend to remove. These wildcards can be a useful shortcut, but should only be used if you know there aren't any extra rules that will be accidentally deleted. So the following cmdlet will also remove the rule, suppressing any "not found" errors. ```powershell Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" ``` + When using wildcards, if you want to double-check the set of rules that is matched, you can use the *-WhatIf* parameter. ```powershell Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -WhatIf ``` + If you only want to delete some of the matched rules, you can use the *-Confirm* parameter to get a rule-by-rule confirmation prompt. ```powershell Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -Confirm ``` + You can also just perform the whole operation, displaying the name of each rule as the operation is performed. ```powershell Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -Verbose ``` + ### Monitor + The following Windows PowerShell commands are useful in the update cycle of a deployment phase. To allow you to view all the IPsec rules in a particular store, you can use the following commands. In Netsh, this command doesn't show rules where profile=domain,public or profile=domain,private. It only shows rules that have the single entry domain that is included in the rule. The following command examples will show the IPsec rules in all profiles. -**Netsh** + ```cmd netsh advfirewall consec show rule name=all ``` @@ -280,9 +334,10 @@ netsh advfirewall consec show rule name=all ```powershell Show-NetIPsecRule -PolicyStore ActiveStore ``` + You can monitor main mode security associations for information such as which peers are currently connected to the device and which protection suite is used to form the security associations. Use the following cmdlet to view existing main mode rules and their security associations: -**Netsh** + ```cmd netsh advfirewall monitor show mmsa all ``` @@ -290,18 +345,23 @@ netsh advfirewall monitor show mmsa all ```powershell Get-NetIPsecMainModeSA ``` + ### Find the source GPO of a rule + To view the properties of a particular rule or group of rules, you query for the rule. When a query returns fields that are specified as **NotConfigured**, you can determine which policy store a rule originates from. For objects that come from a GPO (the *-PolicyStoreSourceType* parameter is specified as **GroupPolicy** in the **Show** command), if *-TracePolicyStore* is passed, the name of the GPO is found and returned in the **PolicyStoreSource** field. ```powershell Get-NetIPsecRule -DisplayName "Require Inbound Authentication" -TracePolicyStore ``` + It's important to note that the revealed sources don't contain a domain name. + ### Deploy a basic domain isolation policy + IPsec can be used to isolate domain members from non-domain members. Domain isolation uses IPsec authentication to require that the domain-joined devices positively establish the identities of the communicating devices to improve security of an organization. One or more features of IPsec can be used to secure traffic with an IPsec rule object. To implement domain isolation on your network, the devices in the domain receive IPsec rules that block unsolicited inbound network traffic that isn't protected by IPsec. Here we create an IPsec rule that requires authentication by domain members. Through this authentication, you can isolate domain-joined devices from devices that aren't joined to a domain. In the following examples, Kerberos authentication is required for inbound traffic and requested for outbound traffic. -**Netsh** + ```cmd netsh advfirewall set store gpo=domain.contoso.com\domain_isolation netsh advfirewall consec add rule name="Basic Domain Isolation Policy" profile=domain endpoint1="any" endpoint2="any" action=requireinrequestout auth1="computerkerb" @@ -312,9 +372,11 @@ $kerbprop = New-NetIPsecAuthProposal -Machine -Kerberos $Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" -Proposal $kerbprop -PolicyStore domain.contoso.com\domain_isolation New-NetIPsecRule -DisplayName "Basic Domain Isolation Policy" -Profile Domain -Phase1AuthSet $Phase1AuthSet.Name -InboundSecurity Require -OutboundSecurity Request -PolicyStore domain.contoso.com\domain_isolation ``` + ### Configure IPsec tunnel mode + The following command creates an IPsec tunnel that routes traffic from a private network (192.168.0.0/16) through an interface on the local device (1.1.1.1) attached to a public network to a second device through its public interface (2.2.2.2) to another private network (192.157.0.0/16). All traffic through the tunnel is checked for integrity by using ESP/SHA1, and it's encrypted by using ESP/DES3. -**Netsh** + ```cmd netsh advfirewall consec add rule name="Tunnel from 192.168.0.0/16 to 192.157.0.0/16" mode=tunnel endpoint1=192.168.0.0/16 endpoint2=192.157.0.0/16 localtunnelendpoint=1.1.1.1 remotetunnelendpoint=2.2.2.2 action=requireinrequireout qmsecmethods=esp:sha1-3des ``` @@ -324,12 +386,16 @@ $QMProposal = New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -ESPHash SH $QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "esp:sha1-des3" -Proposal $QMProposal New-NetIPSecRule -DisplayName "Tunnel from HQ to Dallas Branch" -Mode Tunnel -LocalAddress 192.168.0.0/16 -RemoteAddress 192.157.0.0/16 -LocalTunnelEndpoint 1.1.1.1 -RemoteTunnelEndpoint 2.2.2.2 -InboundSecurity Require -OutboundSecurity Require -QuickModeCryptoSet $QMCryptoSet.Name ``` + ## Deploy secure firewall rules with IPsec -In situations where only secure traffic can be allowed through the Windows Defender Firewall, a combination of manually configured firewall and IPsec rules are necessary. The firewall rules determine the level of security for allowed packets, and the underlying IPsec rules secure the traffic. The scenarios can be accomplished in Windows PowerShell and in Netsh, with many similarities in deployment. + +In situations where only secure traffic can be allowed through the Windows Firewall, a combination of manually configured firewall and IPsec rules are necessary. The firewall rules determine the level of security for allowed packets, and the underlying IPsec rules secure the traffic. The scenarios can be accomplished in Windows PowerShell and in Netsh, with many similarities in deployment. + ### Create a secure firewall rule (allow if secure) + Configuring firewalls rule to allow connections if they're secure requires the corresponding traffic to be authenticated and integrity protected, and then optionally encrypted by IPsec. The following example creates a firewall rule that requires traffic to be authenticated. The command permits inbound Telnet network traffic only if the connection from the remote device is authenticated by using a separate IPsec rule. -**Netsh** + ```cmd netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in program=%SystemRoot%\System32\tlntsvr.exe security=authenticate action=allow ``` @@ -337,8 +403,9 @@ netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in pro ```powershell New-NetFirewallRule -DisplayName "Allow Authenticated Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -Authentication Required -Action Allow ``` + The following command creates an IPsec rule that requires a first (computer) authentication and then attempts an optional second (user) authentication. Creating this rule secures and allows the traffic through the firewall rule requirements for the messenger program. -**Netsh** + ```cmd netsh advfirewall consec add rule name="Authenticate Both Computer and User" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb,computerntlm auth2=userkerb,userntlm,anonymous ``` @@ -353,14 +420,18 @@ $anonyauthprop = New-NetIPsecAuthProposal -Anonymous $P2Auth = New-NetIPsecPhase2AuthSet -DisplayName "User Auth" -Proposal $ukerbauthprop,$unentlmauthprop,$anonyauthprop New-NetIPSecRule -DisplayName "Authenticate Both Computer and User" -InboundSecurity Require -OutboundSecurity Require -Phase1AuthSet $P1Auth.Name -Phase2AuthSet $P2Auth.Name ``` + ### Isolate a server by requiring encryption and group membership + To improve the security of the devices in an organization, you can deploy domain isolation in which domain-members are restricted. They require authentication when communicating among each other and reject non-authenticated inbound connections. To improve the security of servers with sensitive data, this data must be protected by allowing access only to a subset of devices within the enterprise domain. IPsec can provide this extra layer of protection by isolating the server. In server isolation, sensitive data access is restricted to users and devices with legitimate business need, and the data is additionally encrypted to prevent eavesdropping. + ### Create a firewall rule that requires group membership and encryption + To deploy server isolation, we layer a firewall rule that restricts traffic to authorized users or devices on the IPsec rule that enforces authentication. The following firewall rule allows Telnet traffic from user accounts that are members of a custom group called "Authorized to Access Server." This access can additionally be restricted based on the device, user, or both by specifying the restriction parameters. A Security Descriptor Definition Language (SDDL) string is created by extending a user or group's security identifier (SID). For more information about finding a group's SID, see: [Finding the SID for a group account](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)#bkmk_FINDSID). -Restricting access to a group allows administrations to extend strong authentication support through Windows Defender Firewall and/or IPsec policies. +Restricting access to a group allows administrations to extend strong authentication support through Windows Firewall and/or IPsec policies. The following example shows you how to create an SDDL string that represents security groups. ```powershell @@ -368,15 +439,17 @@ $user = new-object System.Security.Principal.NTAccount ("corp.contoso.com\Admini $SIDofSecureUserGroup = $user.Translate([System.Security.Principal.SecurityIdentifier]).Value $secureUserGroup = "D:(A;;CC;;;$SIDofSecureUserGroup)" ``` + By using the previous scriptlet, you can also get the SDDL string for a secure computer group as shown here: ```powershell $secureMachineGroup = "D:(A;;CC;;;$SIDofSecureMachineGroup)" ``` + For more information about how to create security groups or how to determine the SDDL string, see [Working with SIDs](/previous-versions/windows/it-pro/windows-powershell-1.0/ff730940(v=technet.10)). Telnet is an application that doesn't provide encryption. This application can send data, such as names and passwords, over the network. This data can be intercepted by malicious users. If an administrator would like to allow the use of Telnet, but protect the traffic, a firewall rule that requires IPsec encryption can be created. This firewall rule is necessary so that the administrator can be certain that when this application is used, all of the traffic sent or received by this port is encrypted. If IPsec fails to authorize the connection, no traffic is allowed from this application. In this example, we allow only authenticated and encrypted inbound Telnet traffic from a specified secure user group through the creation of the following firewall rule. -**Netsh** + ```cmd netsh advfirewall set store gpo=domain.contoso.com\Server_Isolation netsh advfirewall firewall add rule name="Allow Encrypted Inbound Telnet to Group Members Only" program=%SystemRoot%\System32\tlntsvr.exe protocol=TCP dir=in action=allow localport=23 security=authenc rmtusrgrp ="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" @@ -385,17 +458,21 @@ netsh advfirewall firewall add rule name="Allow Encrypted Inbound Telnet to Grou ```powershell New-NetFirewallRule -DisplayName "Allow Encrypted Inbound Telnet to Group Members Only" -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -Direction Inbound -Action Allow -LocalPort 23 -Authentication Required -Encryption Required -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\Server_Isolation ``` + ### Endpoint security enforcement + The previous example showed end to end security for a particular application. In situations where endpoint security is required for many applications, having a firewall rule per application can be cumbersome and difficult to manage. Authorization can override the per-rule basis and be done at the IPsec layer. In this example, we set the global IPsec setting to only allow transport mode traffic to come from an authorized user group with the following cmdlet. Consult the previous examples for working with security groups. ```powershell Set-NetFirewallSetting -RemoteMachineTransportAuthorizationList $secureMachineGroup ``` + ### Create firewall rules that allow IPsec-protected network traffic (authenticated bypass) + Authenticated bypass allows traffic from a specified trusted device or user to override firewall block rules. This override is helpful when an administrator wants to use scanning servers to monitor and update devices without the need to use port-level exceptions. For more information, see [How to enable authenticated firewall bypass](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)). In this example, we assume that a blocking firewall rule exists. This example permits any network traffic on any port from any IP address to override the block rule, if the traffic is authenticated as originating from a device or user account that is a member of the specified device or user security group. -**Netsh** + ```cmd netsh advfirewall set store gpo=domain.contoso.com\domain_isolation netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in security=authenticate action="bypass" rmtcomputergrp="D:(A;;CC;;;S-1-5-21-2329867823-2610410949-1491576313-1114)" rmtusrgrp="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" @@ -404,22 +481,3 @@ netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in sec ```powershell New-NetFirewallRule -DisplayName "Inbound Secure Bypass Rule" -Direction Inbound -Authentication Required -OverrideBlockRules $true -RemoteMachine $secureMachineGroup -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\domain_isolation ``` - -## Other resources -For more information about Windows PowerShell concepts, see the following topics. -- [Windows PowerShell Getting Started Guide](/powershell/scripting/overview) -- [Windows PowerShell User Guide](/powershell/scripting/overview) -- [Windows PowerShell About Help Topics](https://go.microsoft.com/fwlink/p/?linkid=113206) -- [about\_Functions](/powershell/module/microsoft.powershell.core/about/about_functions) -- [about\_Functions\_Advanced](/powershell/module/microsoft.powershell.core/about/about_functions_advanced) -- [about\_Execution\_Policies](/powershell/module/microsoft.powershell.core/about/about_execution_policies) -- [about\_Foreach](/powershell/module/microsoft.powershell.core/about/about_foreach) -- [about\_Objects](/powershell/module/microsoft.powershell.core/about/about_objects) -- [about\_Properties](/powershell/module/microsoft.powershell.core/about/about_properties) -- [about\_While](/powershell/module/microsoft.powershell.core/about/about_while) -- [about\_Scripts](/powershell/module/microsoft.powershell.core/about/about_scripts) -- [about\_Signing](/powershell/module/microsoft.powershell.core/about/about_signing) -- [about\_Throw](/powershell/module/microsoft.powershell.core/about/about_throw) -- [about\_PSSessions](/powershell/module/microsoft.powershell.core/about/about_pssessions) -- [about\_Modules](/powershell/module/microsoft.powershell.core/about/about_modules) -- [about\_Command\_Precedence](/powershell/module/microsoft.powershell.core/about/about_command_precedence) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md index c68bef4175..927145f140 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -7,9 +7,6 @@ ms.date: 11/07/2023 # Create Windows Firewall rules in Intune ->[!IMPORTANT] ->This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - To get started, Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Devices** > **Windows** > **Configuration profiles** > **Create profile** > Choose **Windows 10 and later** as the platform, Choose **Templates**, then **Endpoint protection** as the profile type. Select Windows Defender Firewall. :::image type="content" source="images/windows-firewall-intune.png" alt-text="Example of a Windows Defender Firewall policy in Microsoft Intune and the Intune admin center."::: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/cmd.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/cmd.svg new file mode 100644 index 0000000000..0cddf31701 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/cmd.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/powershell.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/powershell.svg new file mode 100644 index 0000000000..f70257047f --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/powershell.svg @@ -0,0 +1,9 @@ + + + + + + + + + From aeb6d8b9f03cd03c334c59ee2cc508e06de9bc82 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 10:06:57 -0500 Subject: [PATCH 123/237] tabbed xp --- ...blishing.redirection.windows-security.json | 4 +- ...hell.md => configure-with-command-line.md} | 196 +++++++++++++----- .../network-security/windows-firewall/toc.yml | 12 +- 3 files changed, 151 insertions(+), 61 deletions(-) rename windows/security/operating-system-security/network-security/windows-firewall/{configure-with-powershell.md => configure-with-command-line.md} (91%) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 47d10ce050..fb0fdfdf27 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7987,7 +7987,7 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line", "redirect_document_id": false }, { @@ -8002,7 +8002,7 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", - "redirect_url": "/windows/security/operating-system-security/network-security/configure-with-powershell", + "redirect_url": "/windows/security/operating-system-security/network-security/configure-with-command-line", "redirect_document_id": false } ] diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md similarity index 91% rename from windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md rename to windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index c8fa26d55d..34935664f7 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-powershell.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -1,11 +1,11 @@ --- -title: Manage Windows Firewall with PowerShell +title: Manage Windows Firewall with the command line description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. ms.topic: conceptual ms.date: 11/14/2023 --- -# Manage Windows Firewall with PowerShell +# Manage Windows Firewall with the command line This article provides examples how to manage Windows Firewall with PowerShell and `netsh.exe`, which can be used to automate the management of Windows Firewall. @@ -92,25 +92,37 @@ This section provides scriptlet examples for creating, modifying, and deleting f Adding a firewall rule in Windows PowerShell looks a lot like it did in Netsh, but the parameters and values are specified differently. Here's an example of how to allow the Telnet application to listen on the network. This firewall rule is scoped to the local subnet by using a keyword instead of an IP address. Just like in Netsh, the rule is created on the local device, and it becomes effective immediately. -```cmd -netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= %SystemRoot%\System32\tlntsvr.exe remoteip=localsubnet action=allow -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Allow Inbound Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= %SystemRoot%\System32\tlntsvr.exe remoteip=localsubnet action=allow +``` + +--- + The following scriptlet shows how to add a basic firewall rule that blocks outbound traffic from a specific application and local port to a Group Policy Object (GPO) in Active Directory. In Windows PowerShell, the policy store is specified as a parameter within the **New-NetFirewall** cmdlet. In Netsh, you must first specify the GPO that the commands in a Netsh session should modify. The commands you enter are run against the contents of the GPO, and the execution remains in effect until the Netsh session is ended or until another set store command is executed. Here, **domain.contoso.com** is the name of your Active Directory Domain Services (AD DS), and **gpo\_name** is the name of the GPO that you want to modify. Quotation marks are required if there are any spaces in the GPO name. -```cmd +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) + +```powershell +New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -LocalPort 23 -Action Block -PolicyStore domain.contoso.com\gpo_name +``` + +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program=%SystemRoot%\System32\telnet.exe protocol=tcp localport=23 action=block ``` -```powershell -New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -LocalPort 23 -Action Block -PolicyStore domain.contoso.com\gpo_name -``` +--- ### GPO Caching @@ -130,14 +142,20 @@ This command doesn't batch your individual changes, it loads and saves the entir When a rule is created, Netsh and Windows PowerShell allow you to change rule properties and influence, but the rule maintains its unique identifier (in Windows PowerShell, this identifier is specified with the *-Name* parameter). For example, you could have a rule **Allow Web 80** that enables TCP port 80 for inbound unsolicited traffic. You can change the rule to match a different remote IP address of a Web server whose traffic will be allowed by specifying the human-readable, localized name of the rule. -```cmd -netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallRule -DisplayName "Allow Web 80" -RemoteAddress 192.168.0.2 ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 +``` + +--- + Netsh requires you to provide the name of the rule for it to be changed and we don't have an alternate way of getting the firewall rule. In Windows PowerShell, you can query for the rule using its known properties. When you run `Get-NetFirewallRule`, you may notice that common conditions like addresses and ports don't appear. These conditions are represented in separate objects called Filters. As shown before, you can set all the conditions in New-NetFirewallRule and Set-NetFirewallRule. If you want to query for firewall rules based on these fields (ports, addresses, security, interfaces, services), you'll need to get the filter objects themselves. You can change the remote endpoint of the **Allow Web 80** rule (as done previously) using filter objects. Using Windows PowerShell, you query by port using the port filter, then assuming other rules exist affecting the local port, you build with further queries until your desired rule is retrieved. @@ -172,14 +190,20 @@ $rule | Set-NetFirewallRule With the help of the `Set` command, if the rule group name is specified, the group membership isn't modified but rather all rules of the group receive the same modifications indicated by the given parameters. The following scriptlet enables all rules in a predefined group containing remote management influencing firewall rules. -```cmd -netsh advfirewall firewall set rule group="Windows Firewall remote management" new enable=yes -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Enabled True ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall firewall set rule group="Windows Firewall remote management" new enable=yes +``` + +--- + There's also a separate `Enable-NetFirewallRule` cmdlet for enabling rules by group or by other properties of the rule. ```powershell @@ -191,14 +215,20 @@ Enable-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Verbo Rule objects can be disabled so that they're no longer active. In Windows PowerShell, the **Disable-NetFirewallRule** cmdlet will leave the rule on the system, but put it in a disabled state so the rule no longer is applied and impacts traffic. A disabled firewall rule can be re-enabled by **Enable-NetFirewallRule**. This cmdlet is different from the **Remove-NetFirewallRule**, which permanently removes the rule definition from the device. The following cmdlet deletes the specified existing firewall rule from the local policy store. -```cmd -netsh advfirewall firewall delete rule name="Allow Web 80" -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Remove-NetFirewallRule -DisplayName "Allow Web 80" ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall firewall delete rule name="Allow Web 80" +``` + +--- + Like with other cmdlets, you can also query for rules to be removed. Here, all blocking firewall rules are deleted from the device. ```powershell @@ -240,15 +270,21 @@ In Netsh, the authentication and cryptographic sets were specified as a list of The following cmdlet creates basic IPsec transport mode rule in a Group Policy Object. An IPsec rule is simple to create; all that is required is the display name, and the remaining properties use default values. Inbound traffic is authenticated and integrity checked using the default quick mode and main mode settings. These default settings can be found in the console under Customize IPsec Defaults. -```cmd -netsh advfirewall set store gpo=domain.contoso.com\gpo_name -netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetIPsecRule -DisplayName "Require Inbound Authentication" -PolicyStore domain.contoso.com\gpo_name ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall set store gpo=domain.contoso.com\gpo_name +netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout +``` + +--- + ### Add custom authentication methods to an IPsec rule If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](/previous-versions/windows/it-pro/windows-server-2003/cc757847(v=ws.10)) . @@ -256,10 +292,7 @@ You can then use the newly created custom quick-mode policies when you create IP ![crypto set object.](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. -```cmd -netsh advfirewall set store gpo=domain.contoso.com\gpo_name -netsh advfirewall consec add rule name="Require Outbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout qmsecmethods=ah:sha1+esp:sha1-3des -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $AHandESPQM = New-NetIPsecQuickModeCryptoProposal -Encapsulation AH,ESP -AHHash SHA1 -ESPHash SHA1 -Encryption DES3 @@ -267,6 +300,15 @@ $QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "ah:sha1+esp:sha1-des New-NetIPsecRule -DisplayName "Require Inbound Authentication" -InboundSecurity Require -OutboundSecurity Request -QuickModeCryptoSet $QMCryptoSet.Name -PolicyStore domain.contoso.com\gpo_name ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall set store gpo=domain.contoso.com\gpo_name +netsh advfirewall consec add rule name="Require Outbound Authentication" endpoint1=any endpoint2=any action=requireinrequestout qmsecmethods=ah:sha1+esp:sha1-3des +``` + +--- + ### IKEv2 IPsec transport rules A corporate network may need to secure communications with another agency. But, you discover the agency runs non-Windows operating systems and requires the use of the Internet Key Exchange Version 2 (IKEv2) standard. @@ -327,25 +369,37 @@ Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -Verbose The following Windows PowerShell commands are useful in the update cycle of a deployment phase. To allow you to view all the IPsec rules in a particular store, you can use the following commands. In Netsh, this command doesn't show rules where profile=domain,public or profile=domain,private. It only shows rules that have the single entry domain that is included in the rule. The following command examples will show the IPsec rules in all profiles. -```cmd -netsh advfirewall consec show rule name=all -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Show-NetIPsecRule -PolicyStore ActiveStore ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall consec show rule name=all +``` + +--- + You can monitor main mode security associations for information such as which peers are currently connected to the device and which protection suite is used to form the security associations. Use the following cmdlet to view existing main mode rules and their security associations: -```cmd -netsh advfirewall monitor show mmsa all -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Get-NetIPsecMainModeSA ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall monitor show mmsa all +``` + +--- + ### Find the source GPO of a rule To view the properties of a particular rule or group of rules, you query for the rule. When a query returns fields that are specified as **NotConfigured**, you can determine which policy store a rule originates from. @@ -362,10 +416,7 @@ It's important to note that the revealed sources don't contain a domain name. IPsec can be used to isolate domain members from non-domain members. Domain isolation uses IPsec authentication to require that the domain-joined devices positively establish the identities of the communicating devices to improve security of an organization. One or more features of IPsec can be used to secure traffic with an IPsec rule object. To implement domain isolation on your network, the devices in the domain receive IPsec rules that block unsolicited inbound network traffic that isn't protected by IPsec. Here we create an IPsec rule that requires authentication by domain members. Through this authentication, you can isolate domain-joined devices from devices that aren't joined to a domain. In the following examples, Kerberos authentication is required for inbound traffic and requested for outbound traffic. -```cmd -netsh advfirewall set store gpo=domain.contoso.com\domain_isolation -netsh advfirewall consec add rule name="Basic Domain Isolation Policy" profile=domain endpoint1="any" endpoint2="any" action=requireinrequestout auth1="computerkerb" -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $kerbprop = New-NetIPsecAuthProposal -Machine -Kerberos @@ -373,13 +424,20 @@ $Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" - New-NetIPsecRule -DisplayName "Basic Domain Isolation Policy" -Profile Domain -Phase1AuthSet $Phase1AuthSet.Name -InboundSecurity Require -OutboundSecurity Request -PolicyStore domain.contoso.com\domain_isolation ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall set store gpo=domain.contoso.com\domain_isolation +netsh advfirewall consec add rule name="Basic Domain Isolation Policy" profile=domain endpoint1="any" endpoint2="any" action=requireinrequestout auth1="computerkerb" +``` + +--- + ### Configure IPsec tunnel mode The following command creates an IPsec tunnel that routes traffic from a private network (192.168.0.0/16) through an interface on the local device (1.1.1.1) attached to a public network to a second device through its public interface (2.2.2.2) to another private network (192.157.0.0/16). All traffic through the tunnel is checked for integrity by using ESP/SHA1, and it's encrypted by using ESP/DES3. -```cmd -netsh advfirewall consec add rule name="Tunnel from 192.168.0.0/16 to 192.157.0.0/16" mode=tunnel endpoint1=192.168.0.0/16 endpoint2=192.157.0.0/16 localtunnelendpoint=1.1.1.1 remotetunnelendpoint=2.2.2.2 action=requireinrequireout qmsecmethods=esp:sha1-3des -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $QMProposal = New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -ESPHash SHA1 -Encryption DES3 @@ -387,6 +445,14 @@ $QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "esp:sha1-des3" -Prop New-NetIPSecRule -DisplayName "Tunnel from HQ to Dallas Branch" -Mode Tunnel -LocalAddress 192.168.0.0/16 -RemoteAddress 192.157.0.0/16 -LocalTunnelEndpoint 1.1.1.1 -RemoteTunnelEndpoint 2.2.2.2 -InboundSecurity Require -OutboundSecurity Require -QuickModeCryptoSet $QMCryptoSet.Name ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall consec add rule name="Tunnel from 192.168.0.0/16 to 192.157.0.0/16" mode=tunnel endpoint1=192.168.0.0/16 endpoint2=192.157.0.0/16 localtunnelendpoint=1.1.1.1 remotetunnelendpoint=2.2.2.2 action=requireinrequireout qmsecmethods=esp:sha1-3des +``` + +--- + ## Deploy secure firewall rules with IPsec In situations where only secure traffic can be allowed through the Windows Firewall, a combination of manually configured firewall and IPsec rules are necessary. The firewall rules determine the level of security for allowed packets, and the underlying IPsec rules secure the traffic. The scenarios can be accomplished in Windows PowerShell and in Netsh, with many similarities in deployment. @@ -396,19 +462,23 @@ In situations where only secure traffic can be allowed through the Windows Firew Configuring firewalls rule to allow connections if they're secure requires the corresponding traffic to be authenticated and integrity protected, and then optionally encrypted by IPsec. The following example creates a firewall rule that requires traffic to be authenticated. The command permits inbound Telnet network traffic only if the connection from the remote device is authenticated by using a separate IPsec rule. -```cmd -netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in program=%SystemRoot%\System32\tlntsvr.exe security=authenticate action=allow -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Allow Authenticated Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -Authentication Required -Action Allow ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in program=%SystemRoot%\System32\tlntsvr.exe security=authenticate action=allow +``` + +--- + The following command creates an IPsec rule that requires a first (computer) authentication and then attempts an optional second (user) authentication. Creating this rule secures and allows the traffic through the firewall rule requirements for the messenger program. -```cmd -netsh advfirewall consec add rule name="Authenticate Both Computer and User" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb,computerntlm auth2=userkerb,userntlm,anonymous -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $mkerbauthprop = New-NetIPsecAuthProposal -Machine -Kerberos @@ -421,6 +491,14 @@ $P2Auth = New-NetIPsecPhase2AuthSet -DisplayName "User Auth" -Proposal $ukerbaut New-NetIPSecRule -DisplayName "Authenticate Both Computer and User" -InboundSecurity Require -OutboundSecurity Require -Phase1AuthSet $P1Auth.Name -Phase2AuthSet $P2Auth.Name ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall consec add rule name="Authenticate Both Computer and User" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb,computerntlm auth2=userkerb,userntlm,anonymous +``` + +--- + ### Isolate a server by requiring encryption and group membership To improve the security of the devices in an organization, you can deploy domain isolation in which domain-members are restricted. They require authentication when communicating among each other and reject non-authenticated inbound connections. To improve the security of servers with sensitive data, this data must be protected by allowing access only to a subset of devices within the enterprise domain. @@ -450,15 +528,21 @@ For more information about how to create security groups or how to determine the Telnet is an application that doesn't provide encryption. This application can send data, such as names and passwords, over the network. This data can be intercepted by malicious users. If an administrator would like to allow the use of Telnet, but protect the traffic, a firewall rule that requires IPsec encryption can be created. This firewall rule is necessary so that the administrator can be certain that when this application is used, all of the traffic sent or received by this port is encrypted. If IPsec fails to authorize the connection, no traffic is allowed from this application. In this example, we allow only authenticated and encrypted inbound Telnet traffic from a specified secure user group through the creation of the following firewall rule. -```cmd -netsh advfirewall set store gpo=domain.contoso.com\Server_Isolation -netsh advfirewall firewall add rule name="Allow Encrypted Inbound Telnet to Group Members Only" program=%SystemRoot%\System32\tlntsvr.exe protocol=TCP dir=in action=allow localport=23 security=authenc rmtusrgrp ="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Allow Encrypted Inbound Telnet to Group Members Only" -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -Direction Inbound -Action Allow -LocalPort 23 -Authentication Required -Encryption Required -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\Server_Isolation ``` +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall set store gpo=domain.contoso.com\Server_Isolation +netsh advfirewall firewall add rule name="Allow Encrypted Inbound Telnet to Group Members Only" program=%SystemRoot%\System32\tlntsvr.exe protocol=TCP dir=in action=allow localport=23 security=authenc rmtusrgrp ="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" +``` + +--- + ### Endpoint security enforcement The previous example showed end to end security for a particular application. In situations where endpoint security is required for many applications, having a firewall rule per application can be cumbersome and difficult to manage. Authorization can override the per-rule basis and be done at the IPsec layer. @@ -473,11 +557,17 @@ Set-NetFirewallSetting -RemoteMachineTransportAuthorizationList $secureMachineGr Authenticated bypass allows traffic from a specified trusted device or user to override firewall block rules. This override is helpful when an administrator wants to use scanning servers to monitor and update devices without the need to use port-level exceptions. For more information, see [How to enable authenticated firewall bypass](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)). In this example, we assume that a blocking firewall rule exists. This example permits any network traffic on any port from any IP address to override the block rule, if the traffic is authenticated as originating from a device or user account that is a member of the specified device or user security group. -```cmd -netsh advfirewall set store gpo=domain.contoso.com\domain_isolation -netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in security=authenticate action="bypass" rmtcomputergrp="D:(A;;CC;;;S-1-5-21-2329867823-2610410949-1491576313-1114)" rmtusrgrp="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" -``` +#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Inbound Secure Bypass Rule" -Direction Inbound -Authentication Required -OverrideBlockRules $true -RemoteMachine $secureMachineGroup -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\domain_isolation ``` + +#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) + +``` cmd +netsh advfirewall set store gpo=domain.contoso.com\domain_isolation +netsh advfirewall firewall add rule name="Inbound Secure Bypass Rule" dir=in security=authenticate action="bypass" rmtcomputergrp="D:(A;;CC;;;S-1-5-21-2329867823-2610410949-1491576313-1114)" rmtusrgrp="D:(A;;CC;;; S-1-5-21-2329867823-2610410949-1491576313-1735)" +``` + +--- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index f8b51fad54..a7c6498905 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -3,16 +3,16 @@ items: href: index.md - name: Configure and manage Windows Firewall items: - - name: Configure Windows firewall + - name: Recommendations for configuring Windows Firewall href: best-practices-configuring.md - - name: Configure Windows Firewall rules with group policy + - name: Configure with Microsoft Intune + href: create-windows-firewall-rules-in-intune.md + - name: Configure with group policy href: configure-rules-with-gpo.md + - name: Configure with the command line + href: configure-with-command-line.md - name: Configure the Windows Firewall log href: configure-the-windows-firewall-log.md - - name: Manage Windows Firewall with PowerShell - href: configure-with-powershell.md - - name: Configure firewall rules with Microsoft Intune - href: create-windows-firewall-rules-in-intune.md - name: Hyper-V firewall href: hyper-v-firewall.md - name: Secure connections with IPsec From 6f8b11e0e3ec0af1db24371cc5d2004f9852c4df Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 10:29:15 -0500 Subject: [PATCH 124/237] updates --- .../best-practices-configuring.md | 11 ++---- .../configure-the-windows-firewall-log.md | 38 ++++++++----------- ...create-windows-firewall-rules-in-intune.md | 3 +- .../windows-firewall/index.md | 37 +++++++++--------- .../isolating-apps-on-your-network.md | 8 +--- .../windows-firewall/quarantine.md | 2 +- 6 files changed, 40 insertions(+), 59 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 3936eb1b0e..e7ff80e46a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -1,11 +1,11 @@ --- -title: Best practices for configuring Windows Firewall -description: Learn about best practices for configuring Windows Firewall +title: Recommendations for configuring Windows Firewall +description: Learn about best practices for configuring Windows Firewall. ms.date: 11/10/2023 ms.topic: best-practice --- -# Best practices for configuring Windows Firewall +# Recommendations for configuring Windows Firewall Windows Firewall provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. @@ -45,9 +45,6 @@ The rule-adding task can be accomplished by right-clicking either **Inbound Rule ![Rule creation wizard.](images/fw02-createrule.png) -> [!NOTE] ->This article doesn't cover step-by-step rule configuration. See the [Windows Firewall with Advanced Security Deployment Guide](windows-firewall-with-advanced-security-deployment-guide.md) for general guidance on policy creation. - In many cases, allowing specific types of inbound traffic is required for applications to function in the network. Administrators should keep the following rule precedence behaviors in mind when allowing these inbound exceptions: 1. Explicitly defined allow rules take precedence over the default block setting @@ -195,7 +192,7 @@ When creating an inbound or outbound rule, you should specify details about the ## Configure Windows Firewall rules with WDAC tagging policies -Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: +Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: ### Step 1: Deploy WDAC AppId Tagging Policies diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md index 37cd6f17fb..e767c11866 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md @@ -1,8 +1,8 @@ --- title: Configure the Windows Defender Firewall Log -description: Learn how to configure Windows Defender Firewall with Advanced Security to log dropped packets or successful connections by using Group Policy Management MMC. -ms.topic: conceptual -ms.date: 09/07/2021 +description: Learn how to configure Windows Firewall to log dropped packets or successful connections with Microsoft Intune and group policy. +ms.topic: how-to +ms.date: 11/14/2023 --- # Configure Windows Firewall logging @@ -11,7 +11,6 @@ To configure Windows Firewall to log dropped packets or successful connections, - Microsoft Intune/MDM - Group policy with the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in -- PowerShell [!INCLUDE [tab-intro](../../../../../includes/configure/tab-intro.md)] @@ -54,25 +53,18 @@ Once the policy is applied, restart the device. Once the policy is applied, restart the device. 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -2. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. -3. For each network location type (Domain, Private, Public), perform the following steps. - - 1. Click the tab that corresponds to the network location type - 2. Under **Logging**, click **Customize** - 3. The default path for the log is **%windir%\system32\logfiles\firewall\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location - +1. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. +1. For each network location type (Domain, Private, Public), perform the following steps. + 1. Click the tab that corresponds to the network location type + 1. Under **Logging**, click **Customize** + 1. The default path for the log is **%windir%\system32\logfiles\firewall\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location > [!IMPORTANT] - > The location you specify must have permissions assigned that permit the Windows Defender Firewall service to write to the log file. - -5. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a ize. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. -6. No logging occurs until you set one of following two options: - - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** - - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** -7. Click **OK** twice - -#### [:::image type="icon" source="../../../images/icons/windows-os.svg" border="false"::: **Registry**](#tab/reg) - -### Configure Windows Firewall with PowerShell + > The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file. +1. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a ize. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. +1. No logging occurs until you set one of following two options: + - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** + - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** +1. Click **OK** twice --- @@ -84,7 +76,7 @@ If logs are slow to appear in Sentinel, you can turn down the log file size. Jus Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition might occur include: -- missing permissions for the Windows Defender Firewall Service (MpsSvc) on the folder or on the log files +- missing permissions for the *Windows Defender Firewall Service* (MpsSvc) on the folder or on the log files - you want to store the log files in a different folder and the permissions were removed, or haven't been set automatically - if firewall logging is configured via policy settings, it can happen that - the log folder in the default location `%windir%\System32\LogFiles\firewall` doesn't exist diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md index 927145f140..885c36c1c1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -1,7 +1,6 @@ --- title: Create Windows Firewall rules in Intune -description: Learn how to use Intune to create rules in Windows Defender Firewall with Advanced Security. Start by creating a profile in Device Configuration in Intune. -ms.topic: conceptual +description: Learn how to use Intune to create rules in Windows Defender Firewall with Advanced Security. ms.date: 11/07/2023 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 2c00e08478..1969151107 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -1,34 +1,31 @@ --- -title: Windows Defender Firewall with Advanced Security -description: Learn overview information about the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. +title: Windows Firewall overview +description: Learn overview information about the Windows Firewall security feature. ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/14/2023 --- -# Windows Firewall with Advanced Security +# Windows Firewall overview -This topic is an overview of the Windows Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features. +Windows Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Firewall supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a trusted device can't communicate with your device. You can use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by -## Overview of Windows Defender Firewall with Advanced Security - -Windows Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a trusted device can't communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. - -The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. - -[!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] - -## Feature description - -Windows Defender Firewall with Advanced Security is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network's isolation strategy. +Windows Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. ## Practical applications +To help address your organizational network security challenges, Windows Firewall offers the following benefits: -To help address your organizational network security challenges, Windows Defender Firewall offers the following benefits: +- **Reduces the risk of network security threats.** Windows Firewall reduces the attack surface of a device, providing an extra layer to the defense-in-depth model. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. +- **Safeguards sensitive data and intellectual property.** With its integration with IPsec, Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. +- **Extends the value of existing investments.** Because Windows Firewall is a host-based firewall that is included with the operating system, there's no other hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). -- **Reduces the risk of network security threats.**  Windows Defender Firewall reduces the attack surface of a device, providing an extra layer to the defense-in-depth model. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. +[!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] -- **Safeguards sensitive data and intellectual property.**  With its integration with IPsec, Windows Defender Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. +## Next steps -- **Extends the value of existing investments.**  Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there's no other hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). +The *Windows Firewall with Advanced Security* MMC snap-in provides more functionality than the Windows Firewall Control Panel applet. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Firewall Control Panel applet can protect a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. +> [!div class="nextstepaction"] +> Learn about the recommendations for configuring Windows Firewall: +> +> [Configure Windows Firewall >](best-practices-configuring.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md index b5fdcb5aeb..8c5fb738b8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md @@ -2,12 +2,12 @@ title: Isolating Microsoft Store Apps on Your Network description: Learn how to customize your firewall configuration to isolate the network access of the new Microsoft Store apps that run on devices added to your network. ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/14/2023 --- # Isolating Microsoft Store Apps on Your Network -When you add new devices to your network, you may want to customize your Windows Defender Firewall with Advanced Security configuration to isolate the network access of the new Microsoft Store apps that run on them. Developers who build Microsoft Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. +When you add new devices to your network, you may want to customize your Windows Firewall configuration to isolate the network access of the new Microsoft Store apps that run on them. Developers who build Microsoft Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. For example, a developer can decide that their app should only connect to trusted local networks (such as at home or work), and not to the Internet. In this way, developers can define the scope of network access for their app. This network isolation prevents an app from accessing a network and a connection type (inbound or outbound) if the connection has not been configured for the app. Then the network administrator can customize the firewall to further restrict the resources that the app can access. @@ -177,7 +177,3 @@ Use the following procedure if you want to block intranet access for a specific 1. Under **Security Filtering**, click **Add**. 1. Type **domain computers** in the text box and click **OK**. 1. Close Group Policy Management. - -## See also - -- [Windows Defender Firewall with Advanced Security Overview](index.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md index ea79641339..1217da01e1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md @@ -2,7 +2,7 @@ title: Quarantine behavior description: Quarantine behavior is explained in detail. ms.topic: conceptual -ms.date: 09/08/2021 +ms.date: 11/14/2023 --- # Quarantine behavior From bfff2e829c821b61fbf60fe0e7dc632233b95904 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 10:56:19 -0500 Subject: [PATCH 125/237] updates --- ...blishing.redirection.windows-security.json | 5 + .../windows-firewall/images/corpnet.gif | Bin 7184 -> 0 bytes ...to-end-ipsec-connections-by-using-ikev2.md | 137 ------------------ .../network-security/windows-firewall/toc.yml | 2 - 4 files changed, 5 insertions(+), 139 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/corpnet.gif delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index fb0fdfdf27..2d0a38c37e 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -8004,6 +8004,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", "redirect_url": "/windows/security/operating-system-security/network-security/configure-with-command-line", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831807(v=ws.11)", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/corpnet.gif b/windows/security/operating-system-security/network-security/windows-firewall/images/corpnet.gif deleted file mode 100644 index f76182ee25c7510ca9929611898fac5a56a9c194..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7184 zcmWmH`6JVhcpAF-I!NzMt>^@O=F6w6HSQ(e>U2R)AkT0FTFinCY~TlY7!u+xs#zGBteU)lfi$ z|4eJk_(;{%E9Umj)<}P;lYl^NO@3_NZ3zjX4-2#X-MLR%Qg;9RI3x+Ru7Bh(yBl z^t)H%_0w-!iwe^^+VaU{a&m&-(&Cuy#i+9ZE-^7NJ3rS-i*8m_RBUd1URi$A+|u0K z$!u(Gxa{aS|M_Fze?4~|mdw8Epk~$r0I>FBo=7D2_V#*3q%CrWNF>s|nkrpWoq~J0 zeq}vZlk=Jyk`?C<~k{B`O3*Xfk9WhK~B0=Blha>5YwzckY#O*B8ysnzG04 zH-&{2RL1V^?sh#d+}rz;5EmSu5bxn;l%JnlJ6xTR7dQQJDme05ZuX_B?Ch^AQ#Dn$ zLldc&FJBG|Ip=%HcX4s?*RNk=LwEao9}m2mJV!lS-+q65YD^o6^ziWb`t|G6-uB1~ z7ykU-T3lXWb+r%m7OsAq{kr<4_@M9Ya{hek@b12uAvuOn=21nT9=oX?Yz%F>3CAZ2>)+v?AI@DadEMu zm;K`hF%_lPSHFLtWkg3tM*iGhy>;`NvF;%|Kf6y0Bk$k8*U(X)oSvX~*;!gy_{2J$ zu|0V^D(dgwUn3(US(SIYUsiKB*XtkG7w26$qN{~Qz{>0M`?||y1H7~cz5~J`0D!it{zqih0@X4H8VXiHaa>qF_fB` z5)*Zv`M4-1EwAEEMs5W?$=Za@$heQkXSbz{k2c#3etvptz$4Dr zwbFKWaxy77X?URSV$^ktjm?ks)kV(as}JwJLnz@fVR<>RWo2c~uFh9tE?tceVUIt( zb-ynr>z4a%yXpG6%-rDP$F(J7#Zn5Ac|4x{A1DX_c!1{r`T_pm1c2lLJU$sqCZjtZ zDXi`>#H{R1#wl8tTQ*hor%Py`IeNU|UQ?V~09(hLUOkYf>iEE8xOtHXD5U306fgBK zHLa5V>ANUcjaHE2QL-b{V!K%JfIaEpSk9odc$Ux|>$V5Zspbf&zdsLK6~?YNvEng-WCh2mv&sx8}u5*0o_209$@9&trV2||X>CBjR-@$N<+mV5C zOdv}WL~Aj=%ip3r)hWeX_cFBj3uOQ{GoO=N{O}eQRh&&z~|>s8phB$%7bq z37cPQT#OXQw(a;LK!XbBKKirAE z{Z(-#26}-tPWpvk71NKUwtC+2j0-PJ6t_f>ynWT3l}k+JN~ZZ8Bz@f-!{?M$%1)t< zss@3_1B)t~XJ%?Eh?Dp{QvXnXLS^D^1m^T%WaLscOps>*2`0Q1DInzqnf1DcIVgXl zl)?+0vhGHIo4K+t2%RTg7LE68*$R7-cf(Pt_N}*4u<|1<t5_fYH<}v&Inzh?rh_TK>{sx-=-~L0QSw8{9lEM&) zL-;%8%!M8a3qK5hR{))b@+8nnvO-AI-F^Bp>yZFka<64xtcO6MI(oC#<&KBj%u2?wC%$83LfSv73%;Va%S zkOH@U{ktJ>6*oDcF4;GixS0O_eFRv9Z4AO6D?g$;Z@Ov#(@s*n3#?R*zK_u1!wDuz z+_#9f=C9z8tOd$%c_DtZ^}dfl`6iHK6?|6Dq)X6LoBKr+@WByCJ|Zn@bM5#V+%WiT zFGjG!R1kKsyGYgq7Tic4#Lvf11bq@p5X_Qfw$h_TM0EOpHb3cHvtmT=IJ$mP<|Y7i zh_rYLYb~z!>9784(NGcvJo&aG^aB|3Rp>io=`fR? z_3o8v2Ze(;mDpGvGxcY5;I9ru$J7$NaEFK_H^f7S>Ws8U>Vlz26U~<_^Z#OVUU)^@Sz@c_bj6?0OOw3W^W)^Ok=eI%Jwg2REk6{;Edy>76-pyugXDt4ew?t}B$A zvsW$ujtMtS+YFBRuq1={YUTXwe(>=+Fu{v2MWT2!$B^&|`hbPLJd>-NncgdLlyYkO zw(%{sawQN2NF+#X6+a8~IChj0C+0yySNw+VMIeXIR4pF2cx@kfsHmo^!_VI8L?t ziSO*P{0%Z|kEUJaG9T*-OF6aeDDgQ+4aFunKJ=c0TiTR8@ciYFah_t?2v);V zGjhaMpkfc=Gi`F4x!}I`+GduTrY*th%}`I`*+`|yhP2lO)gBnv@<*4?SUF}0Eja6$ ztRQXKZyJd_zVNntRt`QI?hT5feeLxAM*%5H^cS1MPd;>iuM0vuwT3%)j9d`|=mPA3I3-d86MOb(A|LGuzzI!@Sn>WaF1I-QRr z!PKuAi{3XTNWh2vO=NddGA@REl2X)lPh{fVDn-7wa;VC=rbF59&~d(%`I{cmVUJNA8 z^Sb09fi2QXh}x+W?-XQ>*ZcKMo!3@6R|r5Xz^WKk}3$=mO1KBUm~OG)-oA zEEfA@tMO@9wmr(K3iOyW!ygXVsQnw2v+-b-uw8^)bi&1>5%j29BGin(cRttWfsBXZ@7?~x+|AO|yc+MWh=xmI>gm)_ z1z0ZcxW;pfmZtMg-le(^BLbx0G<(z4WFi1im0oVL{Xl?9F|99J0^#LBdaU`Sc<>pn zS&yCp1k+fP&YyzQd72WZ#U+Q~TA+COD@P3tV@E}B+NEzBz9VdG-=->*yN1eNwtTGz z`9NusjvTm1W*Pz0J4c!a=e`EjDfv#xi4;C11(oaw1nS zbWAScxAd$JdG}#k<|WMl1K$7uglP4?7KM(MPC9?H=LZ{B_T^8b;rRrG=~!ejN1CUG z)VkH?OoHkXKSMpbisb3zH*N|W{+TF@Z`Kven*Q?QVnju*cQqcM=jm;{JF%q#b|gVn z5_G-~N|=xUBbL4h5L574&z)=5)B+Z!->&VBQC*0E;=w*ty&P>_;S`9Th@l-TI#>%T zOa!6GkmrhVxsH%y_>(nDx^|4%=U*a&7hg`(&X zo(cN3qrp328$Npc?x47|u(C{q(7r2wGY4%%LW3d^!(m0)@M4?+&}YiW>#(X~CtaJQ2@yfw zR8S5bMq`|EDz@5gO?I1>004wJ3pB_AZ2~YbE1tR#D}+Zq0nl|ge&YxeukBObZ%pFp z$lMh%{uGcf8MH$~Z81|etJlnCUI zAjX#HtcV!0pZ1F(8kCBD$%Te=z{)H^Q}G6Df=wzb9s{b*%-);MZUYc6D<$@y zfDduNcJve-e1guBg?@E9l$w=3Nt35w4-rv86fBKuqFkKxiC}2xls!ShDCp)A+;Wv8 zb5%=n)zxynxM(F7iYS?PL@lqEh_&LtGdQbCI{$SMbAV~^Bn1K#r!yO`$uZdV( zhvuXirE1{8AGy#e0J#{EuoXbUmVo7$Adi^>uRjG8$wD99LciexIS#U(i}=FPyfRZ5 zG>pt*A};6_g}N0{zJk<9fDjJ)gMvt9LBC6eEi#2)_!<~V>Ooqmj* zSej6P4J`A^DQ;q;pY!;Tdim+TM@xDGMMaJIvl!Sxrhowv+rUO_yH)H2Ry0uZzVeAY z?!f+`ASP6@S|Y8x-`rVI1%)w>J^#aJyKQPuuZGZ8@{D+XF+-ABc8n7H^mpi?OWD+544DWv$77Xfm2PB# z3?kN_4YDk)wl1v>B_j4}?nb(qs!B0*=#XJcM*MbFl;Azox2#%vem23@?P-N`4m5;_ zE+>KqDJVZOmSY5oVnEO&zR+{Eq1K2I3e=ig?JroPQd;FsOK8ro`KT+#zXCtl`FWvamU8DJ_I{R+?D#%^$<34{a|X=)UHAPP`&z*RVeGmT%FM@(;J!@K@4NUd-( z<5v0xT9^qR*+xOwNFf_LD8=q~sFZ9EqL%@!vxF-#z#$aq+4Qz@0AzC4hU&I9{VL4E-0E`T}?;%8HZ zqX5|Cu+T6Q;COoOe>x+gpJ+jAi zs$=zVa^eg~vpX0^f>21JnSVRrf)dSi;3E;9!$!8^AU@UTe?V(xx0WyQ=9(oE#X)79xWc6~aciV+8aQ1QFN8$i_@Tkf)0WuWln^xh{CxaVGbMLGc|dZrA1>HmEhM|yuHp0IA&=c#+oaB?*tc|FL|++a{=q%PSlWFDC(gkK zn&aU<3O!ADOAn!w$AxQo#*%s)8fVPK#hQoCZC?4QMR*?fBF1AFA|wQl!=o1cV4%TT zd$3Y-FX2eO5as-gJuGwNZ9tHSY@P6ezc3EN`niV(dAb@Q?2%tYeW8nP7V%NihF}) z!kP!6-tOKxqJ5{;+`69uMAaV+;#Y&m^>WlZe-31!rP~T7Xv@M6eS{u{1kFeJuXQUe zjo~VH6gzgXMY-cixvnb9m$DqrTkecM`5>4%HFT?y9O5apAxm6yrSocFR_UBAaBVkl}qK)sbPw}9A%%|(rfqc%eJ#IKRic` zugNAI{2=cdnkn6CMEwiDw!iGTo8tV{@it$2lXgkde{j&OUd!bIXLW&3%AE8WWaW&}Tluh%!K+E5 zp)R=Ae-Z6>25o|+aVK6u?V$Dm1|L{K!u+Ia5g97O>H5H$t=X4)Hwx_^-mWSsWB<|C}?>pwtQ zu!vpw%`Vmbkg2Og936WzmvMzB}*99FKJ!jPFr7b2ev9YG=kkMMlkOk_G2j-UcI z0Lbg%^N4-n;(dTcEUhhY;&z;C2?dcU-7(U*H-ONumHZ>8nLVJ{A$81Yp^R5L_-im(G0mSg6s9?;8pG zo&_x;feG9nMN9~SfjSCcl^AdY4R(zQMSfV5+*q5(|9B5TBPoC&9sX+{;!1>sFkmM+ z7=0$Bhygba;tIxcXQ?0$8r+q!LEu2J>nJz{Im3ad@*t4_R+hKEf!+AlP63sWAP1Oy zg)~?Z1qj5$67jGOE;4`vxk+CiWo;ad;r9P;1}V@ID)s;sTE-O^rNa}M0GftQq+tmZ zAe!?PLEN%EFJgD#=SeCOPx@)hcWA({8)<1px-^Ccr=Pn=-z`+kqKKBW*kA-+7JR1`HNUKs0g*N<@)w~|}|8ErRUs8|)$M0c4d5YD|>v9Go&xTLw0 zJ}+Qk=p;HFeo@Irv7!1u56-7oSrGXApT4cNSSfEH>EMO;Q$O504kXv$?ccp6*jy9) z2Q+P3+DPV!nR4^K%(Y8;a5>!<>x$%+DuKw<* zexZ^}Vl6<|7%c=1Z$VJJ%(16o>*KbNv>9ag>phY$p9K9tO&L<~bdPnTQp87~$w$fV zuEy(V&F{%&zix0BGG75yd_M@{5cj-!Gm9f26sY;zjq`2fxXm{6^z0-L!6&C+bWeW+ zb(G6Wi_&LQc=|J|a0jANI0#LD))ygVatZ}xKw~L%T{yJyDHpljVVW6fEsrx2bH_|P zkz`C?C{n`68>Jx?N#24doi^^#VHj3iIz*29DH$1+f`T3MB2Vgz-^+h>M55BtTimMM z+b0)E-HuJLX^*U>?Q3>ll!Pd#62L;x(&}NbOL@o{y#gu!6tcf6I8CzzP%u64B7;Sf z{is8c7AlM75i^w@k>l^0Ej3(sur_=Knt%k14NPdTN!mE%^*8Ye{$c^`|WGfM$X;T==yM3SG8-K|NG{kc5^FO<(!RraRO99&M!Dw&pV7NlsI z [!NOTE] -> This topic includes sample Windows PowerShell cmdlets. For more info, see [How to Run a Windows PowerShell Cmdlet](/previous-versions//bb648607(v=vs.85)). - -## Prerequisites - -These procedures assume that you already have a public key infrastructure (PKI) in place for device authentication. - -## Devices joined to a domain - -The following Windows PowerShell script establishes a connection security rule that uses IKEv2 for communication between two computers (CLIENT1 and SERVER1) that are joined to the corp.contoso.com domain as shown in Figure 1. - -![the contoso corporate network.](images/corpnet.gif) - -The script does the following: - -- Creates a security group called **IPsec client and servers** and adds CLIENT1 and SERVER1 as members. -- Creates a Group Policy Object (GPO) called **IPsecRequireInRequestOut** and links it to the corp.contoso.com domain. -- Sets the permissions to the GPO so that they apply only to the computers in **IPsec client and servers** and not to **Authenticated Users**. -- Indicates the certificate to use for authentication. - > [!IMPORTANT] - > The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. -- Creates the IKEv2 connection security rule called **My IKEv2 Rule**. - -Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. - -```powershell -# Create a Security Group for the computers that will get the policy -$pathname = (Get-ADDomain).distinguishedname -New-ADGroup -name "IPsec client and servers" -SamAccountName "IPsec client and servers" ` --GroupCategory security -GroupScope Global -path $pathname - -# Add test computers to the Security Group -$computer = Get-ADComputer -LDAPFilter "(name=client1)" -Add-ADGroupMember -Identity "IPsec client and servers" -Members $computer -$computer = Get-ADComputer -LDAPFilter "(name=server1)" -Add-ADGroupMember -Identity "IPsec client and servers" -Members $computer - -# Create and link the GPO to the domain -$gpo = New-gpo IPsecRequireInRequestOut -$gpo | new-gplink -target "dc=corp,dc=contoso,dc=com" -LinkEnabled Yes - -# Set permissions to security group for the GPO -$gpo | Set-GPPermissions -TargetName "IPsec client and servers" -TargetType Group -PermissionLevel GpoApply -Replace -$gpo | Set-GPPermissions -TargetName "Authenticated Users" -TargetType Group -PermissionLevel None -Replace - -#Set up the certificate for authentication -$gponame = "corp.contoso.com\IPsecRequireInRequestOut" -$certprop = New-NetIPsecAuthProposal -machine -cert -Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -$myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" -proposal $certprop -PolicyStore GPO:$gponame - -#Create the IKEv2 Connection Security rule -New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -Phase1AuthSet $myauth.InstanceID ` --InboundSecurity Require -OutboundSecurity Request -KeyModule IKEv2 -PolicyStore GPO:$gponame -``` - -## Devices not joined to a domain - -Use a Windows PowerShell script similar to the following to create a local IPsec policy on the devices that you want to include in the secure connection. - -> [!IMPORTANT] -> The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. - -Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. - -```powershell -#Set up the certificate -$certprop = New-NetIPsecAuthProposal -machine -cert -Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -$myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" -proposal $certprop - -#Create the IKEv2 Connection Security rule -New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -Phase1AuthSet $myauth.InstanceID ` --InboundSecurity Require -OutboundSecurity Request -KeyModule IKEv2 -``` - -Make sure that you install the required certificates on the participating computers. - -> [!NOTE] -> - For local devices, you can import the certificates manually if you have administrator access to the computer. For more info, see [Import or export certificates and private keys](https://windows.microsoft.com/windows-vista/Import-or-export-certificates-and-private-keys). -> - You need a root certificate and a computer certificate on all devices that participate in the secure connection. Save the computer certificate in the **Personal/Certificates** folder. -> - For remote devices, you can create a secure website to facilitate access to the script and certificates. - -## Troubleshooting - -Follow these procedures to verify and troubleshoot your IKEv2 IPsec connections: - -Use the Windows Defender Firewall with Advanced Security snap-in to verify that a connection security rule is enabled: - -1. Open the Windows Defender Firewall with Advanced Security console. -1. In the left pane of the Windows Defender Firewall with Advanced Security snap-in, click **Connection Security Rules**, and then verify that there is an enabled connection security rule. -1. Expand **Monitoring**, and then click **Connection Security Rules** to verify that your IKEv2 rule is active for your currently active profile. - -Use Windows PowerShell cmdlets to display the security associations: - -1. Open a Windows PowerShell command prompt. -1. Type **get-NetIPsecQuickModeSA** to display the Quick Mode security associations. -1. Type **get-NetIPsecMainModeSA** to display the Main Mode security associations. - -**Use netsh to capture IPsec events.** - -1. Open an elevated command prompt. -1. At the command prompt, type **netsh wfp capture start**. -1. Reproduce the error event so that it can be captured. -1. At the command prompt, type **netsh wfp capture stop**. - A wfpdiag.cab file is created in the current folder. -1. Open the cab file, and then extract the wfpdiag.xml file. -1. Open the wfpdiag.xml file with your an XML viewer program or Notepad, and then examine the contents. There will be a lot of data in this file. One way to narrow down where to start looking is to search the last "errorFrequencyTable" at the end of the file. There might be many instances of this table, so make sure that you look at the last table in the file. For example, if you have a certificate problem, you might see the following entry in the last table at the end of the file: - -```xml - - ERROR_IPSEC_IKE_NO_CERT - 32 - -``` - -In this example, there are 32 instances of the **ERROR_IPSEC_IKE_NO_CERT** error. So now you can search for **ERROR_IPSEC_IKE_NO_CERT** to get more details regarding this error. - -You might not find the exact answer for the issue, but you can find good hints. For example, you might find that there seems to be an issue with the certificates, so you can look at your certificates and the related cmdlets for possible issues. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index a7c6498905..4add3bf791 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -15,8 +15,6 @@ items: href: configure-the-windows-firewall-log.md - name: Hyper-V firewall href: hyper-v-firewall.md - - name: Secure connections with IPsec - href: securing-end-to-end-ipsec-connections-by-using-ikev2.md - name: Isolate Microsoft Store apps on your network href: isolating-apps-on-your-network.md - name: Troubleshoot From 9233c19bf30e7555a1c9ab97ea0585caa53bce93 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Tue, 14 Nov 2023 09:12:40 -0800 Subject: [PATCH 126/237] remove old broken links --- browsers/edge/microsoft-edge.yml | 8 ------- windows/deployment/windows-10-poc.md | 21 +------------------ .../whats-new-windows-10-version-1909.md | 2 +- 3 files changed, 2 insertions(+), 29 deletions(-) diff --git a/browsers/edge/microsoft-edge.yml b/browsers/edge/microsoft-edge.yml index e95c203c60..addd4468b1 100644 --- a/browsers/edge/microsoft-edge.yml +++ b/browsers/edge/microsoft-edge.yml @@ -40,14 +40,6 @@ landingContent: - text: Evaluate the impact url: ./microsoft-edge-forrester.md - # Card (optional) - - title: Test your site on Microsoft Edge - linkLists: - - linkListType: overview - links: - - text: Test your site on Microsoft Edge for free on BrowserStack - url: https://developer.microsoft.com/microsoft-edge/tools/remote/ - # Card (optional) - title: Improve compatibility with Enterprise Mode linkLists: diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 40769fc671..11b304e822 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -225,26 +225,7 @@ When you have completed installation of Hyper-V on the host computer, begin conf > [!IMPORTANT] > Don't attempt to use the VM resulting from the following procedure as a reference image. Also, to avoid conflicts with existing clients, don't start the VM outside the PoC network. -If you don't have a PC available to convert to VM, do the following steps to download an evaluation VM: - -1. Open the [Download virtual machines](https://developer.microsoft.com/microsoft-edge/tools/vms/) page. - - > [!NOTE] - > The above link may not be available in all locales. - -2. Under **Virtual machine**, choose **IE11 on Win7**. - -3. Under **Select platform**, choose **HyperV (Windows)**. - -4. Select **Download .zip**. The download is 3.31 GB. - -5. Extract the zip file. Three directories are created. - -6. Open the **Virtual Hard Disks** directory and then copy **IE11 - Win7.vhd** to the **C:\VHD** directory. - -7. Rename **IE11 - Win7.vhd** to **w7.vhd** (don't rename the file to w7.vhdx). - -8. In step 5 of the [Configure Hyper-V](#configure-hyper-v) section, replace the VHD file name **w7.vhdx** with **w7.vhd**. + If you have a PC available to convert to VM (computer 2): diff --git a/windows/whats-new/whats-new-windows-10-version-1909.md b/windows/whats-new/whats-new-windows-10-version-1909.md index d40de13c9d..5ab89168fd 100644 --- a/windows/whats-new/whats-new-windows-10-version-1909.md +++ b/windows/whats-new/whats-new-windows-10-version-1909.md @@ -55,7 +55,7 @@ Windows 10, version 1909 also includes two new features called **Key-rolling** a ### Transport Layer Security (TLS) -An experimental implementation of TLS 1.3 is included in Windows 10, version 1909. TLS 1.3 is disabled by default system wide. If you enable TLS 1.3 on a device for testing, then it can also be enabled in Internet Explorer 11.0 and Microsoft Edge by using Internet Options. For beta versions of Microsoft Edge on Chromium, TLS 1.3 isn't built on the Windows TLS stack, and is instead configured independently, using the **Edge://flags** dialog. Also see [Microsoft Edge platform status](https://developer.microsoft.com/microsoft-edge/status/tls13/) +An experimental implementation of TLS 1.3 is included in Windows 10, version 1909. TLS 1.3 is disabled by default system wide. If you enable TLS 1.3 on a device for testing, then it can also be enabled in Internet Explorer 11.0 and Microsoft Edge by using Internet Options. For beta versions of Microsoft Edge on Chromium, TLS 1.3 isn't built on the Windows TLS stack, and is instead configured independently, using the **Edge://flags** dialog. >[!NOTE] >The experiental implementation of TLS 1.3 isn't supported. TLS 1.3 is only supported on Windows 11 and Server 2022. For more information, see [Protocols in TLS/SSL (Schannel SSP)](/windows/win32/secauthn/protocols-in-tls-ssl--schannel-ssp-). From 0cbbc1a73108e256bd5a7a0a587f238e375de191 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Tue, 14 Nov 2023 09:44:27 -0800 Subject: [PATCH 127/237] fix MicrosoftDocs/windows-itpro-docs#11815 --- windows/whats-new/temporary-enterprise-feature-control.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/temporary-enterprise-feature-control.md b/windows/whats-new/temporary-enterprise-feature-control.md index 122c8a1f8f..ba0ca795c1 100644 --- a/windows/whats-new/temporary-enterprise-feature-control.md +++ b/windows/whats-new/temporary-enterprise-feature-control.md @@ -73,5 +73,5 @@ The following features introduced through the monthly cumulative updates allow p | The **Recommended** section of the **Start Menu** displays personalized website recommendations |[September 2023 - KB5030310](https://support.microsoft.com/kb/5030310)| No |**CSP**: ./Device/Vendor/MSFT/Policy/Config/Start/[HideRecoPersonalizedSites](/windows/client-management/mdm/policy-csp-start)

    **Group Policy**: Computer Configuration\Administrative Templates\Start Menu and Taskbar\\**Remove Personalized Website Recommendations from the Recommended section in the Start Menu**| | **Recommended** section added to File Explorer Home for users signed into Windows with an Azure AD account. | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes | **CSP**:./Device/Vendor/MSFT/Policy/Config/FileExplorer/[DisableGraphRecentItems](/windows/client-management/mdm/policy-csp-fileexplorer#disablegraphrecentitems)

    **Group Policy**: Computer Configuration\Administrative Templates\Windows Components\File Explorer\\**Turn off files from Office.com in Quick Access View**

    **Note**: This control disables additional items beyond the **Recommended** items. Review the policy before implementing this control. | | Transfer files to another PC using WiFi direct|[September 2023 - KB5030310](https://support.microsoft.com/kb/5030310)|Yes|**CSP**: ./Device/Vendor/MSFT/Policy/Config/Wifi/[AllowWiFiDirect](/windows/client-management/mdm/policy-csp-wifi#allowwifidirect)| -| Copilot in Windows | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes |**CSP**: ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot)

    **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot**| +| Copilot in Windows | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes |**CSP**: ./User/Vendor/MSFT/Policy/Config/WindowsAI/[TurnOffWindowsCopilot](/windows/client-management/mdm/policy-csp-windowsai#turnoffwindowscopilot)

    **Group Policy**: User Configuration\Administrative Templates\Windows Components\Windows Copilot\\**Turn off Windows Copilot**| |Dev Drive | [September 2023 - KB5030310](https://support.microsoft.com/kb/5030310) | Yes |**CSPs**:
    - ./Device/Vendor/MSFT/Policy/Config/FileSystem/[EnableDevDrive](/windows/client-management/mdm/policy-csp-filesystem#enableeeverive)
    - ./Device/Vendor/MSFT/Policy/Config/FileSystem/[DevDriveAttachPolicy](/windows/client-management/mdm/policy-csp-filesystem#devdriveattachpolicy)

    **Group Policies**:
    - Computer Configuration\Administrative Templates\System\FileSystem\\**Enable dev drive**
    - Computer Configuration\Administrative Templates\System\FileSystem\\**Dev drive filter attach policy**| From 0a673c76a1ff16db82d05c195731fd022f46d683 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 12:55:57 -0500 Subject: [PATCH 128/237] windowsdefender shortcut --- .../windows-firewall/images/feedback.svg | 3 +++ .../windows-firewall/index.md | 19 ++++++++++++++++++- 2 files changed, 21 insertions(+), 1 deletion(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/feedback.svg diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/feedback.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/feedback.svg new file mode 100644 index 0000000000..2ecd143695 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/feedback.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 1969151107..09708376a9 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -21,11 +21,28 @@ To help address your organizational network security challenges, Windows Firewal [!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] -## Next steps +## View and manage Windows Firewall + +You can use the Windows Sevurity app to view and manage Windows Firewall. Select START, type `windows security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: + +> [!div class="nextstepaction"] +> +> [Firewall & network protection][SEC-1] The *Windows Firewall with Advanced Security* MMC snap-in provides more functionality than the Windows Firewall Control Panel applet. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Firewall Control Panel applet can protect a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. +## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback + +To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WIN+F) and use the category **Security and Privacy** > **Network protection**. + +## Next steps + > [!div class="nextstepaction"] > Learn about the recommendations for configuring Windows Firewall: > > [Configure Windows Firewall >](best-practices-configuring.md) + + + +[SEC-1]: windowsdefender://network/ +[FHUB]: feedback-hub:?tabid=2&newFeedback=true \ No newline at end of file From 3a6ac689c995ae1573eff86fb2d2261cf28e77f1 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 13:08:22 -0500 Subject: [PATCH 129/237] updates --- .../windows-firewall/create-windows-firewall-rules-in-intune.md | 1 + .../network-security/windows-firewall/index.md | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md index 885c36c1c1..b83010e461 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -2,6 +2,7 @@ title: Create Windows Firewall rules in Intune description: Learn how to use Intune to create rules in Windows Defender Firewall with Advanced Security. ms.date: 11/07/2023 +ms.topic: how-to --- # Create Windows Firewall rules in Intune diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 09708376a9..a4b7fbcc16 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -23,7 +23,7 @@ To help address your organizational network security challenges, Windows Firewal ## View and manage Windows Firewall -You can use the Windows Sevurity app to view and manage Windows Firewall. Select START, type `windows security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: +You can use the *Windows Security* app to view and manage Windows Firewall. Select START, type **Windows Security**, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: > [!div class="nextstepaction"] > From 72da45ec3751e2c7b9893e68e6dfbd1e09ccbd60 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 13:26:05 -0500 Subject: [PATCH 130/237] test --- .../network-security/windows-firewall/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index a4b7fbcc16..1e0b6a5ec0 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -23,7 +23,7 @@ To help address your organizational network security challenges, Windows Firewal ## View and manage Windows Firewall -You can use the *Windows Security* app to view and manage Windows Firewall. Select START, type **Windows Security**, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: +You can use the *Windows Security* app to view and manage Windows Firewall. Select START, type **`Windows Security`**, `Windows Security` and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: > [!div class="nextstepaction"] > From 2fcadd13aa28f695da9b3a6f5b01a473941dcedd Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 13:49:10 -0500 Subject: [PATCH 131/237] updates --- .../network-security/windows-firewall/index.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 1e0b6a5ec0..e0a930efd2 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -21,15 +21,15 @@ To help address your organizational network security challenges, Windows Firewal [!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] -## View and manage Windows Firewall +## Open and configure Windows Firewall -You can use the *Windows Security* app to view and manage Windows Firewall. Select START, type **`Windows Security`**, `Windows Security` and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: +Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. -> [!div class="nextstepaction"] -> -> [Firewall & network protection][SEC-1] - -The *Windows Firewall with Advanced Security* MMC snap-in provides more functionality than the Windows Firewall Control Panel applet. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Firewall Control Panel applet can protect a single device in a home environment, it doesn't provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment. +- The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: + > [!div class="nextstepaction"] + > [Firewall & network protection][SEC-1] +- The Windows Firewall Control Panel applet +- The *Windows Firewall with Advanced Security* MMC snap-in provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments ## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback From 6abb05a5a5df108a3bfe11fdc44daca33dfadee8 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 14 Nov 2023 14:21:46 -0500 Subject: [PATCH 132/237] Remove bad links to PDF --- .../deployment/deploy-enterprise-licenses.md | 4 +- windows/deployment/mbr-to-gpt.md | 163 ++++++++++++------ .../deployment/vda-subscription-activation.md | 4 +- .../windows-10-subscription-activation.md | 4 +- 4 files changed, 116 insertions(+), 59 deletions(-) diff --git a/windows/deployment/deploy-enterprise-licenses.md b/windows/deployment/deploy-enterprise-licenses.md index 8ad4658ea1..f94f31723e 100644 --- a/windows/deployment/deploy-enterprise-licenses.md +++ b/windows/deployment/deploy-enterprise-licenses.md @@ -14,7 +14,7 @@ ms.collection: appliesto: - ✅ Windows 10 - ✅ Windows 11 -ms.date: 11/23/2022 +ms.date: 11/14/2023 --- # Deploy Windows Enterprise licenses @@ -306,6 +306,6 @@ If a device isn't able to connect to Windows Update, it can lose activation stat ## Virtual Desktop Access (VDA) -Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Azure or in another [qualified multitenant hoster](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf) (PDF download). +Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Azure or in another qualified multitenant hoster. Virtual machines (VMs) must be configured to enable Windows Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. For more information, see [Enable VDA for Enterprise subscription activation](vda-subscription-activation.md). diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 2ab8313425..9b709effc7 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -4,7 +4,7 @@ description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) ms.prod: windows-client author: frankroj ms.author: frankroj -ms.date: 11/23/2022 +ms.date: 10/17/2023 manager: aaroncz ms.localizationpriority: high ms.topic: how-to @@ -12,19 +12,18 @@ ms.collection: - highpri - tier2 ms.technology: itpro-deploy +appliesto: + - ✅     Windows 11 + - ✅ Windows 10 --- # MBR2GPT.EXE -*Applies to:* - -- Windows 10 - **MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **`/allowFullOS`** option. -MBR2GPT.EXE is located in the **`Windows\System32`** directory on a computer running Windows 10 version 1703 or later. +**MBR2GPT.EXE** is located in the **`Windows\System32`** directory on a computer running Windows. -The tool is available in both the full OS environment and Windows PE. To use this tool in a deployment task sequence with Configuration Manager or Microsoft Deployment Toolkit (MDT), you must first update the Windows PE image (winpe.wim, boot.wim) with the [Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) 1703, or a later version. +The tool is available in both the full OS environment and Windows PE. See the following video for a detailed description and demonstration of MBR2GPT. @@ -34,12 +33,12 @@ You can use MBR2GPT to: - Convert any attached MBR-formatted system disk to the GPT partition format. You can't use the tool to convert non-system disks from MBR to GPT. - Convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you'll need to delete the existing protectors and recreate them. -- Convert operating system disks that have earlier versions of Windows 10 installed, such as versions 1507, 1511, and 1607. However, you must run the tool while booted into Windows 10 version 1703 or later, and perform an offline conversion. -- Convert an operating system disk from MBR to GPT using Configuration Manager or MDT if your task sequence uses Windows PE version 1703 or later. +- Convert an operating system disk from MBR to GPT using Microsoft Configuration Manager or Microsoft Deployment Toolkit (MDT). -Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 aren't officially supported. The recommended method to convert these disks is to upgrade the operating system to Windows 10 first, then perform the MBR to GPT conversion. +Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 aren't officially supported. The recommended method to convert these disks is to upgrade the operating system to a currently supported version of Windows, then perform the MBR to GPT conversion. > [!IMPORTANT] +> > After the disk has been converted to GPT partition style, the firmware must be reconfigured to boot in UEFI mode. > > Make sure that your device supports UEFI before attempting to convert the disk. @@ -57,9 +56,9 @@ Before any change to the disk is made, MBR2GPT validates the layout and geometry - The disk doesn't have any extended/logical partition - The BCD store on the system partition contains a default OS entry pointing to an OS partition - The volume IDs can be retrieved for each volume that has a drive letter assigned -- All partitions on the disk are of MBR types recognized by Windows or has a mapping specified using the /map command-line option +- All partitions on the disk are of MBR types recognized by Windows or has a mapping specified using the `/map` command-line option -If any of these checks fails, the conversion won't proceed, and an error will be returned. +If any of these checks fails, the conversion doesn't proceed, and an error is returned. ## Syntax @@ -72,9 +71,9 @@ If any of these checks fails, the conversion won't proceed, and an error will be |**/validate**| Instructs `MBR2GPT.exe` to perform only the disk validation steps and report whether the disk is eligible for conversion. | |**/convert**| Instructs `MBR2GPT.exe` to perform the disk validation and to proceed with the conversion if all validation tests pass. | |**/disk:*\***| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| -|**/logs:*\***| Specifies the directory where `MBR2GPT.exe` logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it will not be automatically created or overwritten.| +|**/logs:*\***| Specifies the directory where `MBR2GPT.exe` logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it isn't automatically created or overwritten.| |**/map:*\*=*\***| Specifies other partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexadecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | -|**/allowFullOS**| By default, `MBR2GPT.exe` is blocked unless it's run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
    **Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new ESP is created by shrinking the OS partition.| +|**/allowFullOS**| By default, `MBR2GPT.exe` is blocked unless it's run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
    **Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new EFI system partition is created by shrinking the OS partition.| ## Examples @@ -83,7 +82,7 @@ If any of these checks fails, the conversion won't proceed, and an error will be In the following example, disk 0 is validated for conversion. Errors and warnings are logged to the default location of **`%windir%`**. ```cmd -X:\>mbr2gpt.exe /validate /disk:0 +X:\> mbr2gpt.exe /validate /disk:0 MBR2GPT: Attempting to validate disk 0 MBR2GPT: Retrieving layout of disk MBR2GPT: Validating layout, disk sector size is: 512 @@ -94,19 +93,24 @@ MBR2GPT: Validation completed successfully In the following example: -1. Using DiskPart, the current disk partition layout is displayed prior to conversion - three partitions are present on the MBR disk (disk 0): a system reserved partition, a Windows partition, and a recovery partition. A DVD-ROM is also present as volume 0. +1. The current disk partition layout is displayed prior to conversion using DiskPart - three partitions are present on the MBR disk (disk 0): -2. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](/windows/win32/fileio/disk-partition-types) is **07** corresponding to the installable file system (IFS) type. + - A system reserved partition. + - A Windows partition. + - A recovery partition. + - A DVD-ROM is also present as volume 0. -3. The MBR2GPT tool is used to convert disk 0. +1. The OS volume is selected, partitions are listed, and partition details are displayed for the OS partition. The [MBR partition type](/windows/win32/fileio/disk-partition-types) is **07** corresponding to the installable file system (IFS) type. -4. The DiskPart tool displays that disk 0 is now using the GPT format. +1. The MBR2GPT tool is used to convert disk 0. -5. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). +1. The DiskPart tool displays that disk 0 is now using the GPT format. -6. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. +1. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). -As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition will boot properly. +1. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. + +As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition boots properly.

    @@ -240,42 +244,44 @@ Offset in Bytes: 524288000 The following steps illustrate high-level phases of the MBR-to-GPT conversion process: 1. Disk validation is performed. -2. The disk is repartitioned to create an EFI system partition (ESP) if one doesn't already exist. -3. UEFI boot files are installed to the ESP. +2. The disk is repartitioned to create an EFI system partition if one doesn't already exist. +3. UEFI boot files are installed to the EFI system partition. 4. GPT metadata and layout information are applied. 5. The boot configuration data (BCD) store is updated. 6. Drive letter assignments are restored. ### Creating an EFI system partition -For Windows to remain bootable after the conversion, an EFI system partition (ESP) must be in place. MBR2GPT creates the ESP using the following rules: +For Windows to remain bootable after the conversion, an EFI system partition must be in place. MBR2GPT creates the EFI system partition using the following rules: 1. The existing MBR system partition is reused if it meets these requirements: - 1. It isn't also the OS or Windows Recovery Environment partition. - 1. It is at least 100 MB (or 260 MB for 4K sector size disks) in size. - 1. It's less than or equal to 1 GB in size. This size is a safety precaution to ensure it isn't a data partition. - 1. The conversion isn't being performed from the full OS. In this case, the existing MBR system partition is in use and can't be repurposed. -2. If the existing MBR system partition can't be reused, a new ESP is created by shrinking the OS partition. This new partition has a size of 100 MB (or 260 MB for 4K sector size disks) and is formatted FAT32. + - It isn't also the OS or Windows Recovery Environment partition. + - It is at least 100 MB (or 260 MB for 4K sector size disks) in size. + - It's less than or equal to 1 GB in size. This size is a safety precaution to ensure it isn't a data partition. + - The conversion isn't being performed from the full OS. In this case, the existing MBR system partition is in use and can't be repurposed. -If the existing MBR system partition isn't reused for the ESP, it's no longer used by the boot process after the conversion. Other partitions aren't modified. +2. If the existing MBR system partition can't be reused, a new EFI system partition is created by shrinking the OS partition. This new partition has a size of 100 MB (or 260 MB for 4K sector size disks) and is formatted FAT32. ->[!IMPORTANT] ->If the existing MBR system partition is not reused for the ESP, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter. +If the existing MBR system partition isn't reused for the EFI system partition, it's no longer used by the boot process after the conversion. Other partitions aren't modified. + +> [!IMPORTANT] +> +> If the existing MBR system partition is not reused for the EFI system partition, it might be assigned a drive letter. If you do not wish to use this small partition, you must manually hide the drive letter. ### Partition type mapping and partition attributes Since GPT partitions use a different set of type IDs than MBR partitions, each partition on the converted disk must be assigned a new type ID. The partition type mapping follows these rules: -1. The ESP is always set to partition type PARTITION_SYSTEM_GUID (c12a7328-f81f-11d2-ba4b-00a0c93ec93b). -2. If an MBR partition is of a type that matches one of the entries specified in the /map switch, the specified GPT partition type ID is used. -3. If the MBR partition is of type 0x27, the partition is converted to a GPT partition of type PARTITION_MSFT_RECOVERY_GUID (de94bba4-06d1-4d40-a16a-bfd50179d6ac). -4. All other MBR partitions recognized by Windows are converted to GPT partitions of type PARTITION_BASIC_DATA_GUID (ebd0a0a2-b9e5-4433-87c0-68b6b72699c7). +1. The EFI system partition is always set to partition type **PARTITION_SYSTEM_GUID** (**c12a7328-f81f-11d2-ba4b-00a0c93ec93b**). +2. If an MBR partition is of a type that matches one of the entries specified in the `/map` switch, the specified GPT partition type ID is used. +3. If the MBR partition is of type **0x27**, the partition is converted to a GPT partition of type **PARTITION_MSFT_RECOVERY_GUID** (**de94bba4-06d1-4d40-a16a-bfd50179d6ac**). +4. All other MBR partitions recognized by Windows are converted to GPT partitions of type **PARTITION_BASIC_DATA_GUID** (**ebd0a0a2-b9e5-4433-87c0-68b6b72699c7**). In addition to applying the correct partition types, partitions of type PARTITION_MSFT_RECOVERY_GUID also have the following GPT attributes set: -- GPT_ATTRIBUTE_PLATFORM_REQUIRED (0x0000000000000001) -- GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER (0x8000000000000000) +- **GPT_ATTRIBUTE_PLATFORM_REQUIRED** (**0x0000000000000001**) +- **GPT_BASIC_DATA_ATTRIBUTE_NO_DRIVE_LETTER** (**0x8000000000000000**) For more information about partition types, see: @@ -284,20 +290,21 @@ For more information about partition types, see: ### Persisting drive letter assignments -The conversion tool will attempt to remap all drive letter assignment information contained in the registry that corresponds to the volumes of the converted disk. If a drive letter assignment can't be restored, an error will be displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. +The conversion tool attempts to remap all drive letter assignment information contained in the registry that corresponds to the volumes of the converted disk. If a drive letter assignment can't be restored, an error is displayed at the console and in the log, so that you can manually perform the correct assignment of the drive letter. > [!IMPORTANT] +> > This code runs after the layout conversion has taken place, so the operation cannot be undone at this stage. -The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It will then iterate through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry do the following: +The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It then iterates through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry it does the following: 1. Check if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. 2. If found, set the value to be the new unique ID, obtained after the layout conversion. -3. If the new unique ID can't be set and the value name starts with \DosDevices, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. +3. If the new unique ID can't be set and the value name starts with **\DosDevices**, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. ## Troubleshooting -The tool will display status information in its output. Both validation and conversion are clear if any errors are encountered. For example, if one or more partitions don't translate properly, this is displayed and the conversion not performed. To view more detail about any errors that are encountered, see the associated [log files](#logs). +The tool displays status information in its output. Both validation and conversion are clear if any errors are encountered. For example, if one or more partitions don't translate properly, this information is displayed and the conversion not performed. To view more detail about any errors that are encountered, see the associated [log files](#logs). ### Logs @@ -308,16 +315,21 @@ Four log files are created by the MBR2GPT tool: - setupact.log - setuperr.log -These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The setupact.log and setuperr.log files will have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. +These files contain errors and warnings encountered during disk validation and conversion. Information in these files can be helpful in diagnosing problems with the tool. The `setupact.log` and `setuperr.log` files have the most detailed information about disk layouts, processes, and other information pertaining to disk validation and conversion. > [!NOTE] -> The setupact*.log files are different than the Windows Setup files that are found in the %Windir%\Panther directory. +> +> The **setupact*.log** files are different than the Windows Setup files that are found in the `%Windir%\Panther` directory. The default location for all these log files in Windows PE is **%windir%**. ### Interactive help -To view a list of options available when using the tool, enter **`mbr2gpt.exe /?`** +To view a list of options available when using the tool, enter the following command in an elevated command prompt: + +```cmd +mbr2gpt.exe /? +``` The following text is displayed: @@ -378,7 +390,21 @@ MBR2GPT has the following associated return codes: ### Determining the partition type -You can type the following command at a Windows PowerShell prompt to display the disk number and partition type. Example output is also shown: +The partition type can be determined in one of three ways: + +- Using Windows PowerShell +- Using the Disk Management tool +- Using the DiskPart tool + +#### Windows PowerShell + +You can enter the following command at a Windows PowerShell prompt to display the disk number and partition type: + +```powershell +Get-Disk | ft -Auto +`````` + +Example output: ```powershell PS C:\> Get-Disk | ft -Auto @@ -389,11 +415,43 @@ Number Friendly Name Serial Number HealthStatus OperationalStatus To 1 ST1000DM003-1ER162 Z4Y3GD8F Healthy Online 931.51 GB GPT ``` -You can also view the partition type of a disk by opening the Disk Management tool, right-clicking the disk number, clicking **Properties**, and then clicking the **Volumes** tab. See the following example: +#### Disk Management tool -:::image type="content" alt-text="Volumes." source="images/mbr2gpt-volume.png"::: +You can view the partition type of a disk by using the Disk Management tool: -If Windows PowerShell and Disk Management aren't available, such as when you're using Windows PE, you can determine the partition type at a command prompt with the DiskPart tool. To determine the partition style from a command line, type **diskpart** and then type **list disk**. See the following example: +1. Right-click on the Start Menu and select **Disk Management**. Alternatively, right-click on the Start Menu and select **Run**. In the **Run** dialog box that appears, enter `diskmgmt.msc` and then select **OK**. + +1. In the **Disk Management** window that appears: + + 1. On the bottom pane, select the disk number of interest. + + 1. Select the **Action** menu and then select **All Tasks > Properties**. Alternatively, right-click on the disk number of interest and select **Properties**. + + 1. In the **Properties** dialog box that appears for the disk, select the **Volumes** tab. + + 1. Under the **Volumes** tab, the partition type is displayed next to **Partition style:**. + +#### DiskPart tool + +The partition type can be determined with the DiskPart tool. The DiskPart tool is useful in scenarios where the Disk Management tool and PowerShell aren't available, such as in WinPE when the PowerShell optional component in WinPE isn't loaded. To use the DiskPart tool to determine the partition type: + +1. Open an elevated command prompt. + +1. In the elevated command prompt that opens enter the following command: + + ```cmd + DiskPart.exe + ``` + +1. The **DISKPART>** prompt is displayed in the command prompt windows. At the **DISKPART>** prompt, enter the following command: + + ```cmd + list disk + ``` + +1. The partition type is displayed in the **Gpt** column. If the partition is GPT, an asterisk (**\***) is displayed in the column. If the partition is MBR, the column will be blank. + +The following shows an example output of the DiskPart tool showing the partition type for two disks: ```cmd X:\>DiskPart.exe @@ -472,6 +530,5 @@ To fix this issue, mount the Windows PE image (WIM), copy the missing file from ## Related articles -[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
    [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) -
    [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +- [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index df89fc602d..aefcd10aa4 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -9,7 +9,7 @@ ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium ms.topic: how-to -ms.date: 11/23/2022 +ms.date: 11/14/2023 --- # Configure VDA for Windows subscription activation @@ -31,7 +31,7 @@ Deployment instructions are provided for the following scenarios: - VMs must be running a supported version of Windows Pro edition. - VMs must be joined to Active Directory or Microsoft Entra ID. -- VMs must be hosted by a Qualified Multitenant Hoster (QMTH). For more information, download the PDF that describes the [Qualified Multitenant Hoster Program](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf). +- VMs must be hosted by a Qualified Multitenant Hoster (QMTH). ## Activation diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 6b8718bf68..a5900a5a13 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -11,7 +11,7 @@ ms.collection: - highpri - tier2 ms.topic: conceptual -ms.date: 11/23/2022 +ms.date: 11/14/2023 appliesto: - ✅ Windows 10 - ✅ Windows 11 @@ -239,7 +239,7 @@ For more information, see [Deploy Windows Enterprise licenses](deploy-enterprise ## Virtual Desktop Access (VDA) -Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Microsoft Azure or in another [qualified multitenant hoster (QMTH)](https://download.microsoft.com/download/3/D/4/3D445779-2870-4E3D-AFCB-D35D2E1BC095/QMTH%20Authorized%20Partner%20List.pdf). +Subscriptions to Windows Enterprise are also available for virtualized clients. Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Microsoft Azure or in another qualified multitenant hoster (QMTH). Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Microsoft Entra joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). From 031c9b23dbe1011429c4fc8f5a3479f68a618033 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 14 Nov 2023 15:44:04 -0500 Subject: [PATCH 133/237] Add optional cloud app name It appears that the cloud app that needs to be excluded can have one of two names. Adding in the name of the second cloud app for clarify. --- .../deployment/windows-10-subscription-activation.md | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 6b8718bf68..ffa1ab5454 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -11,7 +11,7 @@ ms.collection: - highpri - tier2 ms.topic: conceptual -ms.date: 11/23/2022 +ms.date: 11/14/2023 appliesto: - ✅ Windows 10 - ✅ Windows 11 @@ -39,7 +39,15 @@ This article covers the following information: For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md). > [!NOTE] -> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude the [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications), from their Conditional Access policies using **Select Excluded Cloud Apps**. For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions). +> +> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps rom their Conditional Access policies using **Select Excluded Cloud Apps**. +> +> - [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). +> - [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). +> +> Although the app ID is the same in both instances, the name of the cloud app will depend on the tenant. +> +> For more information about configuring exclusions in Conditional Access policies, see [Application exclusions](/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa#application-exclusions). ## Subscription activation for Enterprise From a5788d4d3c67f852bcea08705092b426fc72c415 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 14 Nov 2023 15:50:16 -0500 Subject: [PATCH 134/237] Fix typo Fix typo --- windows/deployment/windows-10-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index ffa1ab5454..8c5131b40e 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -40,7 +40,7 @@ For more information on how to deploy Enterprise licenses, see [Deploy Windows E > [!NOTE] > -> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps rom their Conditional Access policies using **Select Excluded Cloud Apps**. +> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**. > > - [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). > - [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). From 42ccbc771847eb9271afc0e816a6cabb27391c0b Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik <123032460+American-Dipper@users.noreply.github.com> Date: Tue, 14 Nov 2023 13:14:30 -0800 Subject: [PATCH 135/237] fix indents/numbering --- windows/deployment/mbr-to-gpt.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 9b709effc7..1b24406aee 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -439,15 +439,15 @@ The partition type can be determined with the DiskPart tool. The DiskPart tool i 1. In the elevated command prompt that opens enter the following command: - ```cmd - DiskPart.exe - ``` + ```cmd + DiskPart.exe + ``` 1. The **DISKPART>** prompt is displayed in the command prompt windows. At the **DISKPART>** prompt, enter the following command: - ```cmd - list disk - ``` + ```cmd + list disk + ``` 1. The partition type is displayed in the **Gpt** column. If the partition is GPT, an asterisk (**\***) is displayed in the column. If the partition is MBR, the column will be blank. From 0c7cbb62589cb8000ca475ac648611d2e7e0e8c4 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 16:47:37 -0500 Subject: [PATCH 136/237] table --- .../windows-firewall/images/control-panel.png | Bin 0 -> 107617 bytes .../images/mmc-advanced-security.png | Bin 0 -> 79772 bytes .../images/windows-security.png | Bin 0 -> 94004 bytes .../windows-firewall/index.md | 31 ++++++++++++++++-- 4 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/control-panel.png create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/mmc-advanced-security.png create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/control-panel.png b/windows/security/operating-system-security/network-security/windows-firewall/images/control-panel.png new file mode 100644 index 0000000000000000000000000000000000000000..63a4c5b13b8a7f093168da2531595c9d4240ad19 GIT binary patch literal 107617 zcmcG#byOT}(>^$a;2zvv26uON8QdW_1PB&f5-bEC26vc2gCw{o5C|@V1_7MEC>AUKds_Uw%j?vas!a^rQ2LJ$AD$4R80N~~G*B3xk>Afq7z0DMWrxVJ_EAQWG! z$jj*YA^gcj3er=W?aS}CuTv5H)!c?l%g`)F0EE1NMG~R=aQXN?%r_~TJC%b>J~y|S zD$__uG`G2Z1qXQ@+RMEHhqT39RF<|xDndx!(``?E@5#j&ahMD-@_j+ijMPfiM z^7uaVsGjcI)Rea{DT4a$3;#!~!7iXW`)6xsPKV8WYm%t{*{XTf)rYNEb-&5GX;?ZE zO4n-9HSoP8{VF+~1}am~CmmgV#yEuO+VYy7<9_LkFL+`9)v@Jc5_mZ+W%V^F!Xri> zlIThoEl$Yx)MBiQcR%jnQw&G~duvwKoJ+2}gep4`RyZ^D5+*?QZ=e3%5BHWx*xkRb zlD_AvdLzEA^Ykl~><58UvXMnJ=%l4&^ko1(-v)vH_nuy=n`viZR`!1sc**tT@VA$@ zUQZ%OahXOEn+v;OdR(#bSw>-AKq)eB6y;dOvN^h4Tun# zUk~!Ti#O!)obuTbvMM-#7=Qm@)Mig;KiY}d*%`vZ#nwY!(-HB@cQL#-mWYmq8?|ZK z!y!8Vsk=_gy3e(V{;R2w8M^_y<)`Hki?F>t*4?)7V*I7xC&cDJzeaLS4i3Vzt_L!t zNF=|l7UI=y>ab8XPY_)imw6m>UI_M6RQ&$T+N72wL~?;8l|;gxqSYt1`_xWN{$@nh z$nPa5(G<&*$u&w*;CWbPCh6s$r5Kfz((Yfskp8~ z90>>r7`40>;jQCc5CGK2-MxN;G`@SjGt+@0`EX4yetV5S5(n`2_s@8GXsZ4CmFT8c z&f%>lqO^h!#|KvpypT6Y>b&>`lT$?&mN?mA+EZ`L*+^f!Y8s%`o&UZ#h)ig_dmez0 zVa&SX@u1EkS3DX}5?jgk?qHFY6i{}2b+i!MP-#%~6ea^kSUKOdoik#y<|OC|qz*zA z6jaT@`T07r=#4BIC)2O)SA16ER%Sx)a`b3j4644xWtXfxByJaKEr+;9Ewnn(i+2RQ zy~}A^`Lp&3qp-al^JhZu>M}Sv^F3a%qRpU2lkzeLAv(*C<>EvsG#H$S7@rpaEh+iN z^^MvmK!TSKuES>g-a4Z)wgk~5@b2{A^~*`v&_K3RFIrd`PaH7vtCgV&-KZ@fwYjEo z`Z)bG2O%&pP(4=^EAr;1Tj!C?!tX}lB{H&VUMT31gPomweP$t|c#1Uly9gGbQly`3j3!|-H81Uxtmni_V?_0S#fDm|r0 z8XD*+kDZ^MD16ese?OtDsvcI;CH04rVrAD2c8L&Ni!@GP$t7Evf#}WecD$O7`}PeVP7dJr zKMN)6iOV5rhnAx%i688qobJl@x+49v``%PJH3-1fG0^_^Fv z*?w15LdWC5zUzk~b@HNo$9rmHJv{@Ot%++@go+R!x-P!b<%rCtMF#VHdbrXq1JUCn zIo*c`=ssH-7qNv`_;f{cGs)GmPqep$_#AcUr@J!t<-lzY^^Vnm^8>1189y%_O$3*N zZbYbpk01LyORGpH@Mz;VJ*}QBoG$u0e3v*QWZ%`Gjfk0{hpZP6(9%K>%Jd#Ups8&quUL;lTt;q8M#R*XjH3h8#Plo2ps=k66f8xv zMI9q!W3UerBAE5um|aIWhLT%QGE9-(7lT>SMGSa=`0x> zKxQiF+TBz10`0VU(j7`N$@*bL?DE_EAQ{f0FR`Mf5RpL98>iUs3rE3W>C1jkLMu`1T`05-FCjq_-sLS#W8MWt z27HJEZ0-V+ruVh8ve zZh;-A`Nk&njUFsaaIm7UnzyM2lJz^*h8|HhH#aK>(weNTtb9bF3Lzk(Yi~+#;>I;X zW0X=6WvF$3LV!!iMa74ur>CEbtWKdV1`SokFQ6`(|AvKcRj{(cd}*nqh)_($#Nw#L zkO^U%A7e!5M%)Ijx!?RyZogmiIzGKru+paaGtX_$&qz;So3_U+r3VX&wzey8pY=8eXZ9IRZ6*}>|t!H6D zsr4$2v}v`@pIR-y39Uy71S-<5?Mms4j*2RFu@wS_LP{F3nS(YjnxF?5ijGLqx-695 zxC+)X2%er^$Ad!-*c9iuV+@7omnX?_LiMkUmBuWkK?!W5aK%*e;81VSD?Bo8~D zWL_en6xZz>GkJ@a#iyO``vf?VhvlU`?faC~ObWRn6jULcbNwzRo{dmk-mClkxhhh2 z5o3S0TGkT;wxy)o%**TYKVvdNALBWAIznY)Dp?zoSEbgmut>;?>Y*U$mQKn};h^MK zE{kkxS7#}BUj%qSyw?Glu(xlLend@_*Vj+wR(=zin4iCal+P+Yv!U^HpMv9&cpOBo zb?1(8I>+^RrgeTeX?Uy2hQGyitr39y@NhjuU9={f6wW()2ZJ11a(@1@-&+gibnW)13Fi2*8?TeE@A7>*$5-*IIo+<$YGA@7US^+cMxr>t zCoogJdfb_5Wfc*Q_J?(A&J^qYv=PvaivZa`(&_I+DK+boWkC!~FW?H}elFtC#lL9I zS%K?(dZuQdys^@fw2n;l;OS~PB-x-x>R}OMhu(WIklGKB*ZrmQ`ba@pT^-_mI9kx- zf;P;~ZVfU;(=9~J!Z;F%D9x8lS>w<(Qe%6u!><6+)EFLyN%3VWWRKP98KGl+3@|2Sdjz4XOJhz%^f+(i`dKepSlfY!quwJtP(O!0IT`F-})^Hdx|-g2%__KL)P- zpfIS_^5Jh(wA~j`EpxT$xA#_KlK()1C(<83`ld%H7b0}w%{iSw!c;;QcGd`3@1|6K zT+VbCdj^;Ild<2%7v@N~yHU%*-X2pqPP2zN}YL21XlLwKg%R*J>AXG z1ccJjV6z~WG;9)KN97&?FQ?tmu17=$yL1*@i^JNFsJp5DdMx!*`4;+0sU|fwa`_<- zu<%!oY~MyH7vvS%RMa+#+pchzcBKa}9{0zjRAvZF3c0UNm|+gas7Q^Ui_BO`Ek1ra ztY@y=r)|X_Xh6b{%wA~Hd>OO zU44F3I(lQ`$kUqP;~%2PuW;VxkAu)nK5wlrxb0ZvGqjhEao*IqA_bGqP=_Q>jY{Co z1p&l9pbfxLv)t%|@j8K`?*gA$MfF|HQZOC~L0o-3flB|bh@NykYZ$gO^wi0zoo2@h z&BSSSe|y<4-auB{#3>W4_rU6irs`8cYoTWmB6=c)Btx&v;EUW28e**I5FDaU9bF%z z^YCzS!&r1s^r*d=eq>Fv!A`S0C;5|orGTU8I#HcP6gvW+`h=aPpIK)*Ha`FI`toVw zKU{9hIh>*udgSUNY*W2yxmKat2Brr*>YAH#ocDFWot_>aA4fvy9avq{ zwFndRd{+VQJUzR+U=|MJJQ{z|Txnvt-Ca$H*y(5riwLQUUvIwl@k8WVZoNzT_cN}} z1$3M?GXjeQ7Il+C&7~D8FUzQ-{{3f8X9MMv7|DHLUx5dHH^t_?*lup(oBWCXKNC`b z)4O_V;zq||bO5S<&P42MZ(yiP`>?Re0buGrtC^j}sHrsoUGI}w+%N|dp_Lc{2G64& zo+2{MI63N`ZOcv5Z(}9MX=U)PD6GTjCWlQbH`UVM@vql?hE&q zaP2w-5K;e$24MD>RhqeNkEf#lZJ@=`yYKWVl-xZ~^{oTv)sZ@5Td^V_1>-*VU%K8R zXpQ(h@WelEObnk6Ko_wdbIXxrFE}^e_B5{XlOY(z{EIHFMacyL&$29K)O&SEj0HM$ zq`^Al_lZvz&whK2{SS9HB!2^V?t}K`S84hAL*wI1KHl&L;=x{{iEsaN$H9anfLp-& ziKvI0vY1b^;OGt4zr%^yQ{Q(ZZ2nm1j^KFRGy$-3VEn(wXP!7dO+|%j{6qBr<*&n` zRDT8f$2dLjhXnxt^yj}kjbw`~3=8nzi@VIk>Rffy^Ggs=D2GmmsIUKhVSya;%re?rnAb0t>$$TSYR|0DhL4Egn} zu?REtK7H0X*;ps`M-l61$t-N+Tx5JYiB;E1>E?6{^TO zHP9%jU4w9Pjbh8_OP>o{v-08(Q3f?i0UZY`Ba30$*r8y;vG#Q@ zdU!QNigZlca%Op(+b$C>!<>L^;BNzT@GLt%iP)UQ18>F%ft7LtsL zi3!<&z~_mk1aYXuSzt9<`I02UZ)wyuo^r9;t1g%E%COw$Y7vwYDBfF~7rwl(#KXe_ zV|liYu8yCF#>Ue7UhN&ddGm&Bd;NJ8 z9A91iOqG5Hn*24KtgPVM zw>2Q8I%sMpoGaOBdMaH60ndH|d6G}H@Re_Ue|*GiUerb`Mq?L%9v{CoI~b2R7%!9q zl}e*?`Bd{eWsCdsii?YL2K>}EGe+csp_yqOL~(K9Xkcw%k7~aWL(Lr~i1{*_ zWXz`H{u*7wIA%&F!=!&z?2@VffO5iEoB50Df}n~FtX+3oIX)UW6$}QS<^6!K)W7+~ zt3u0Atg6I(3I%*NZPMJMQR$0Yb#``UK>TLz`oMBa&Mrts6khWf2#H z&rHX_0G&+rB!iZ5q!bb0;?ndgq0yZ(2m_#5T zBJ-009J%k##-tc;(9qGr$iJab29<<3L`w%59|d%JtemNv(A(Wo5a|ST9YkhWma9!E zaXDuLdSGB+PVbsK?dw0_8Zj&-@O}f zl-X3-Wkft5&g6r6H$~hQ7b_*MZRdxkVNw%p$=;4M&W9=$2+CTQj}ClPvUYWKW%NHg zJ>BzeaY4J#(ZlAa_4V=TO_X~4NGlih*T!aGFo}tg2VVY3z7@$rOqP{vl`%8R;m?Dl zrCH!Tw~L~3!z_n%5e%`&veYFL3luNmE%b+EXPdSm1IPlK+&pLl=1q0%;^Yt9QmPi)rB0N}qVLSAZew^X5R%PH;F zU7YeOlO8~oPGQTM^JRiEkdoV~!9J343m`kwDcO69KAu-Q@1=I;#6HXi>Rm<6z ze=aHgLX`(lk91+mzY|9$fG)K7Hk^Nl)X?2qkYRsAg*mPgK{=s(@~H_w;r!gYJYlpn zk=|W|w4=;IMN%tAn3goKY{}`E)*T5J&4iWv+xH!jp45g$%Wg?F^f8<%XF2q#gTDa0 zT4?7FqEEGHHt``|;cF710gNj>}einw!(Rz)vxXfZB4D6>xt zec5=Oas+YUL_Tywo|ayGH+b76r+J1p9GCQmW1g%gafPMlF`Sxo)9GRZw(v2g%n&*md`9K20SJq^QJ~3Dk^tMG|O!T^f(*wCoB2e^5v={FLS}37Q(^ zejXkIa&k6cdwqMZC~&VY!tp zVvyQ})j2;H>8h$}35-nM`t;j(IaQR!`R&u)@)PuXG$u2_ayX78ODdQDl+!ECK?46n zVs;}MV6CkmE$oBnrk3Q5{GPItHa$`i{SvS96hk!s_&7DtfYSSmpZ!7uN9w*7LREbFn}F;`Sy#b5SSYWXgpk+9XirMnIB*x1&d_31XO9)~ zaAD~578Z~t87vxdy^1nGu5kd_J80R?>){&{r*AN3X=#uK$y_m%5Qr-ElT5HZo5?y5(UyZU#RyJW5DRNiVEbLBi{(g&y->{Vx6Cm|)o&v#p)xNP|yX)mL9udha z|4H6K_Ju-9$gA#|f&qqJjc%nBHfKOCg3lXh?YMj@O<@VLLVQw09_v@W0tfg;&KeyO zw469il+^hfbVUcT^Lbo6zPxQrws{TZni7#I8%rn0HiAk`v@F~rsZpz}3e|DnZxz&n zN6`w#wp`f}m|(G(WKeZ&W|^EJROwvgX#rB{IK}i5ZDx616`#kQ;zZS<7AM*JgQjKG z6yJGKY4jobL~%MFgL>jDQHRq25D70-ds`{@RTZ+|S`0G-4v$2N__eJ#HyLLCnIEU4 zG(#+v&qqDWDZC}$_^S zvZ{BhJ<+g6C4bR$yf93FEqlTDj}Ro#z4CX)OeSNfX4atd0GJV!&9s?<%%&=aRnQl# z0kI(KXBo21sD2r?MRko8f% z0xio8@&m_hN%*2*;wi}v!x=o_*P65CnAx(fnQNu>WO-FI5 zuv57Ug-zL0)f7a~p3|D#F7J#ODUb42KaIks))?$mh&6kPn6zpe;>P<@I};36dmsb8 zg*17Q>XlV8xa|60b!UVriJ5_Ow8%!L`y!9p908;a}(5$0t z?8JGhDx&h~>WR-%7Sanm{HPtyDMwh3|a=Wm?%A(CK(3Woryi)?7KZm6`UjF01+CyfRA z0mf;h0rJfhgFfwL#VcLO^1QC=wO9kYoWVG_^n<3Z9CqYg*VCQUK$)zMdLIHfab_dx z*1y8i#$@1F-eYnjiwVO2t0abM8f^e?nlTcl!bHk%vhVdA;W(031bIqMG*9WhFYb)E zr3W33PDfj?@LR$jv)7y|?(zAf#xrEifJ?8*xE%AO*SFy?HJD`H7L@;ToJfRB&8eL} zTsU5X-(cclsuWD8@xZg0f{A+0^`Lk)*(_^AHDc%JCOxanQ*t*@t8q1v6Pc%WMY=7- z?_LmSx*(`@##*72l?V??-OJuev!&n`6?Md9C#{9w01aJSiRk$I}Qu@7gR))82RZ`t#zfH^=uDra2_<5o#I*z3QqF3 zGV~N*HV`@&dyn{4PyFN8^;+~iAS;cK&<_!@FT3h!?UFvTObs+332@%#9`3W3>7?LJ z)~URQ#jpz4XZcM;G}om`=tlcLyFxXr)HUd61JL$O0c`7Fvx~1F2)U)~Z9NNd$?LBs zX=#`p8^4KFyM|xPR8z5Ns=P5G)lL*Wsp+Vpo|283sxT$CAH?yg)r*E+YnLkJwR#=g z6(Y+bYPh(|6pSW|GJ;-}Q?dN6G^|Mz_kqff)5vc#jRO>N@dns^n){Z^&Po&FkdgP4 z%jx+|Sb!7)+Mu_}cqPsA9|&+kML;bm0hmsPQevS0nSs&)-$UH9K9a8&!@fc6_i+37 zRS=PlpItpOX)*sZWT9tcjMM(9-UkGegTnexHN&L?)fSaWX<=#NP^e#$Ve-5%Ft|^S zc$aE#MWwv>D@`RoEPr0OSHVujzvyV{u)j^szpxdyeAK*-UH&k>B9D&m&otno{)tS( zN?EXMDbBskv6Uknx$&6?SPUWphx8Kok98J`MT>5Eq6Db6=q9H_N zMgxdyyU=r;-@5bh;ldKpYjm5bkaxv+pKQxJP8kx#syquX)tBP~yHpNYj?R^Q82GDxhQ0uhhBoNU40l6$Zm8%L%U?OE7+xS(0_(W+P5<4qO!r zjF`2PlmiMVzgJN#lPr^h@{jvC2R>Up-{PkCdr|WUq$Q4E1yA`0;sH!x*SQ&3hm|dB zMY~1YXkGdjmEINq4a_flkRnwG_ylnX5KNUYXSU0nr?1*7@GQ90ym9+QH4v+H!_b?3 zsuIi@?{7;{5Cs1L;~*{dWJJonZA`OMdG2x%RiXIgsnKVbJBXjEF;ovChw*C%PcWnn z4m3wV2E+DZZi{AaDW2ngV%lAD&!}TyL!aL*o&k~eLfC|`9`^-LI~2eh=!DdB|L5 z6qZ&rTvugljb1AX?7!0(qhA*rAvYOyFY79KY}o{d?yc|s;uqrEqvCG_uV(dOleMV~ zFezchQ`$mGx8X+8*71RR*(IrcsGnlv5cv(E9#MVrS+UQo8;A5q{6fxvlcEhNtgY%R z?XO~w>E;jbPi1zQm{CXtlnvr4F>46R{=~6qmAffRaf`}wU8WtDm?a^EMdYNlCgDzk z78@_EQfkfOdI}stTKG$i7B@PKIqKYEGT%)R4i3CkPW2PX`38az7 z3WAnVjcp!4M%@(juxN*gX=HCnFw8FQnUs!G~jX3d&$GeU$v5k zCv1CAVX<)8KD5&vT@srGmr4nES6>k5y5#1KR^NijjiR-qezHf5gDxV#8j{@zSKU-h z;aQKFu!R(DK5kSMJ$`uH3G4dL!jO^)W&#@6+QK|CZ*@VB{b(M*#s`w^^6daZVPMx3 zv85X#K*p&gBxTm zSfgDkJW%^4X8~+BF&KF{*eCor+0}OfE)bEb8hsxG`u z|7wGETy#ozn^Cf-el;-tyMJ??&xTAJHlP&u|^CO#Iotq#4KmrGz*wq%MZ zRaVgC;D{ogeZ?JFLU?RlTgjU8wH@oCKsR`V^W(zE}J4G%|(yYL*ko(F& z-Z86}S09%J!2!8Bp`AriRV$&hVSS!DR9P+l>V#8)SP{CHT~^F!!)TnJEoMNdcQ<~po7la9P>BuW*4U|Nen;k>C(A_{_ZlNco7BhE~FTarv=4fyLNUmbICYE0Q%;`Rl$Wz5oh?X-wWNZ|2GULcrH8rb~ z4Q&$9&IEBO*tC?u-!YoIEZNdu98bIeJ>R&o!rGxNDo^2 zZ8Y|C%0>4bSGa-St;(b?8d^#tiZ)77x+vM|O@nu2ceM`}Q!1&3N%^F3{-%@S5W7!M zy;43IfwB8;t>D)cxNSz7$K(uJfZ)LmY%~hux4v&4M~N#Snq@W_rZQCHlzFh&;swKA zG%B@~E_!IGr_K`<0x4UBKKQ8U6eQHz*$A*caoBwj)#oJ&e!STR)2Z&3UYjmy?G_*L ze`ikQ1RmD6-!;ryq_k&xmr(&1DNm$z#TaTNGytLj$_%g=h^?sHdt|QpN=<*EyhSyq zVsTv)v1l!s|##?@)MXxal`1Z_RkFbstN1`6p z`7LjSDToB<`V1{=399XkS~XFyz=rvG8kLZ^wEdC`*+KfvaN8IH_xab-=*0f&D!@|F z;(B-*%B^PK%lRSAO*#L-n_Q^EQNdpt9$7`E`Hl4J zlr<-&^JHJ6R`4}!(Ov6-aOA09TP2wOVpoGu>^2_r5ZVq`Eg8a!m*d~2-^Lp`aJ=WE z+S6F4i65zNh&`3jlqYi-Xx6g92Y%yE=N>iB3TRP5DdMy4U(q;2o!7J%FPk@_nlfx^ zWKHS=Rq*k?7$;G&!RXbnVT?c7I4{ySpR$}3|CpzBMT)~GD4D%RXI$_FLh+IyAx=(X zQuQkNdyatsoG&hcVtvrK7~%Uzof~%%0}?~+oXR(GtGi+Y=%l5NW<_6e`}}U*)bB#^ zvMk{_85AfG%dEulj3DFXEauP3;POLROC3e5Y-|-e+M>;Bl8N?KJ|qhb1W7IzHhlL#Ey$Y*l^mKP4$tq)ut&X0{U;D{ms~AR3e?yP2Oh{ zP=LzfN2NjB12!6_$^A+56GAimk(elynWbd3HXOhrOs^K6PPfJDz3owh$1$Zu`nbwm zF%2;$u2;sbad�!~{(z({@jcoB1@w$og-GQYN?vFR+G!&jaSSYm_>)Z!bi9*q+YM znI*F`cCpm*b{G*hF52V1e)Gmwtdy*(C~Q6W+~mZK9Ji^4thX)}^H2Gkb9b`WxsqZ2;L^>_4OJB-2RUS{ zd1lX+V>01ao~bF^FGvW2973h07DR<8N(^yaOe|O-Aq%+SJ}M>J-{6`^TYFKE5K+fC z?4QMUOX;48@CJZ!w9}I?hf^tRW83Q+&EJHi888VitPyF_8E~o!zfU5dp3jqCh$q=H z32&4fAN2DqARE(cezjB20T`YhxZ$MyH^ct7qTU_BDr4rR$rRuhEcoBlX3zgy-ueHL z-2FdEcUxg^WkoO1svH^F{hJ@osHDuB?Zp|_wATlg&Hc4z1Jf!s>DF58ks|X&F#p0Cb z^+}y3zK>)3Br3r=q>$&ys;w8RS*lsA;NhgvcCno4Ex*Lc$Z;ooNd9+LmU#UwAMk$R z3KW7vP1M)aTto$7k7p@%B$v9_8AFMBrLrw9_d_mfBJjep-C(#S)>Je1pjYhiXtvAS zF|JG&*Y&($sj43uu|wl{%0#C6-+ah6(r1cVf8kt|RaGlke35x)lkVD!HFnTD`XRLD zn?v;idRNQOWO3#M12W4mU` z-i_2jcg&9U^@*Z`SydA6D@$8+EiD&e<4p6UP3>IMum?u;bBwz86o#DTv4-^5fgHEd zx}uS?Z(hf6${hNwG+N2Gn#v-C%Mzw%ePG1k{ZeIwSQka5@3a?&B1!tugE&dXOAX`t zWo!3$C0d^;0>cXJ6<2e}Qw27tk?O~}l#k!e09A8UC0zSb_C~71huH0=f}%K|B-$65 z%&v*-&XA%z7G*Od(2$^ekz%4QmT>X&NVRk27pPunE1EkcuY!;ik}X`H@^gFeTQy5} z%%g39FYKlTMbR8Bx%(aTF zeu+jA2;tIH?XBw~d_73{n}^X1NJ=vry~6Eq?V_7x0hOtGTQR6$(jZ`xBMOf9YoIul z6DcFv!B9!BDp$16L#FMtK=rPZ_uBysQ^!6bs|Lp9z4~-?corG%UHFo%Grs3ZaxR)a z@uEAn$9&b+9~-R(PE*tO!hn^Oo#U;~>RxzF86}3C-5Hv+m%q(lJF(S;_FP4?^-7NF z*t~QwNnbN|z;0)L7Q;N(Hc4nwWKY||C@KQNI`s=9^>ZyQGy3^jE8{KBne;bf3ssY^ z=8?_oF!;mZDczs3B3K>K@zL7HC0gXjFRT*e`+Rmg>#(1X5vo&}3)aWn4s(VEv_RS# z+PH6{$U3x|AK&rGY{iIw{!|&^#~|pY+2>@aw8%e@6IvQIyKH%@^+Y?I?0bp+T!vowryTM7mKn0&LAl)A!zDVI9GWA2ogmWNXi?c| zc{DcS!J`u1K(pCNY$Df^RJs|u8!IMsb8*~V+H?X>lgr$ctY~=*X3Vp?h_vp~w4!eL z>rj_U54s_OMQ!3-*wd(3 zWKyqx&-4*EH?YL=TiIq%RwQiEb@mYlb0~bVh0qC(y>yfNyjtk2><~|>7&)(U0VYfd zlPA}DIlD!^mTLS>cWQHmsZz9zQz-wlJRzf6xvX|-r?F>!)ztd9Thv!4QfiMqZQiv= zu&6;lU;yI)t@M<~%S*04oJuKSV^yz{+wB|fa+zcluY}NLhM&8opRw!D&y37GJlzP0 z9UGuPaouXP+f? z!kGC%k_YB`pcdg7y_K-$L`=h|#yPXj_#1ITFEVD1-`v1{iWX9ZIWKi_)7AyqdO4v8 zfzQ?dIP$HvzrLp>BI#B0JGocy>}LwpZC*@vqrYL}@3qktpBSlj@|r4cF94i{3Magv z#*sI2N-`)>O3tuyXBl7X-3{4+594!T0`y@<*EfO`dvL;@s-a|1g_5xw*5@^It9OQm z=RRMhcVpz+uap=Su{@*|6*(Y+KB$Kdu~WZ+bG1_Vcjsv|4POgpUZQ}e{G7q$6&QoK z`DRhWvKW8FAn}-?B21`=(rMcL27iXXtvZtu2n1x98W$_O#gtE|_V@RHkwA;ZZ+L$5 zL&lAX;EYa9J$Bs2vP8SAg0C16#b4bpgT7REl8M2cbuu^(f%>cESGTKzg+By-q8FNfPV#Ig=_Rvl zM&B)G$5jn@FXk3Bhvacqm&^`1>3m<(KR}2~&BrG%Vx-FU;`LSE>WCiBc?i2IsNX5{ zQtcx6I4LysqhWkEh;sN~v7lLs0x|MbY48c$dopLDP~?Q2sX^#Db38ivb~rHqgoCGVOpcc`(Tth+%sP>48o zcAHlJ2Q&V>jhg}wU6DQ|KLFR$`)E6gvr^OAwSq`u@ws4I>zg|{oNU9Ceq(`1MPMsq zwMMaf7i9fLJJ!G?s)y$Wb=?AYyw4A<9`cfjh zZeA-BBgP9#_oY<~V(`hx9nW?FejbTyO!Lcv>=?#?m3vG8vj09CDWKozdRhw@Rw~iT zvY)K`CKA^gP)nrx;I5{%8m5R%o;-F6=hxws;F)N6iIJWYRbxp)1SyN(>NTr*N$t?H^>$?gz2U z7%dVe#t5nW*~p}dqEUfk2e6n}Q`2C)bQg`;+(lP!6CuO@K*&9&(ffxv!3uU<;Ir@X z&WoL`MkYaf(IR6B|M%|*hx50Xhd1~9GiW$1mQscCjYj2WY)l&>c4U~@zi?`<`?Z63 z5vZTCJ~Xs_S`iyHzutez=uFXc)#KaL+C5N2#aLeM7qW_`hePu5=;$&mR@;R)F{k@y ztnQb$HLrZ*KYruell@}~?1|M9VyEOB`X0DUE%!Zx_WIDCn1xO4i?xDy8b-KunI&Lv zhPvm2u$P%{AeTCN-G?fFtb{)t;qFp~@-tjL!znV?$Gvq;06(9LzH!%|U+AkzIwEAL ztmNG0CjIt5QszA^QKtPW&scUdshXgz5a{QtQ+(Q|=iX#jXc6%47tf5vigvcb-;L%T za{e<^6YXP2UiLN7bcn^v>;;t7pCUy4YQphaTa-N&xxLL3 zV~8VaatURf-945dWciQ+^)(LKLq!;dc?_ex>VF! z@9MBGX2ngFS!DR9pn1~M$TBQR(GHAy}@rZ}WQeqQPDi@jbC-``3 z8x|!;oPAD-v-k`DVNrpcz>fEBm)?lKn;0jBL)j9?Je6p#Ht*UaN@L-MorB;(53^Aj zSzgzOjglugDsjioL$@_k)8@lsGP;(OWtPc~~F zV>KdkH1jHRxc@RqFOR>Z$c%MR71y`*WvQ2Qt%tdIf?HuM8P8A7?~m8c1wVi3zGZU| zJ3rXu06s;yl*JzZfzff)DbD|_a$NOKTQDg$Jpy2!@KCsKtvDp2reppYu2y`1oX|S1 zV5&4swE|$|sG6B7QuTAOxft~eDvDn9&G^nXOxj`YS<44|k*Uv#HJhE3_Q6g?R6fdK zrPw_(QjX;li#Kom;KsTKlzWOM`Kr^XaMMcDFm!)93 zw_eS()Y#aUB;)$;o7XU;ID?1Zy>z%=^UiV-`X zQ_ezP0_^EMJ`Y^AUv7LwxhMwZvEW)|Ot>6SP}jlwq~V@hwC z(Vf?&(y7Ias%xN=9?zAf{SG{;jbknpArXoLb*r?L_sbE)9ZFF;o%;+oqm=}w8KrWe zO+?>MJ!{2fP}qKo2VJ`IV46M?XanPfIjG4wv2oLdx8hjdq3lg5Z-eZUWN_Eyxv?r>jrbFyd+(3Uf_(GuN8`W`#z~CH7~5FxJv3TcNz)@&l@2wT!?&L6R1uzcs3&7$`!+ zomDrc07u~Yl@#I1%i!{fqV_%l!D>O&V|~HHiOUWz8j2SthVoS$!`AMMVqP*qjY6|U z1z+eG)+Aqz#athx+GAOBypy+v4EQP-`B1b24`65QPhdT@6?5Zv7%$iX#u2=4A~!3pke z2X}WZzVE;HRyC?qje4HlUyZ%i+I!A1#yjm%abTk?qnsW zs8E!$Eh2+`DXVq1V=97Ysg*5gyxlBl}116s->4J%{>Y zun1?keQx54?C`n;n5QSx;n_c)^NZbB^2@g-iam{$~rXEi>yxBCpWJ_*0kYW+4uU823V}72tyd01j{t|zP0kz7HQ!lfLv1=y?q1x|O z%%R^)8z%-UnZezhobB_kdqn0|ZQ6naYN@OvqN`uZ-hID|U0nDDltqW9%Qx+lgCn-a zghAyJ;%CxDwONMz%Rvj-8P4BN9RJqZz{y&pDE`8~cUUECEJXdamKBbGVq7$^Dert< zneO(#frPy35TT=>bZU8a?dWa#3_MWa`zPJM2S*HD^t=1d`z!X6MESc1} z{iky7FhN&dZir|@PP0(dDjDHN6Z=wA)8OJ9_CB+wV+o^#KKm38ItkK2kpzz<0Wp*~ zD^16MgCu{84g#91dGh5?sMv#}c=Z;q?dM^vM}}7X!i53tlIy-~6|rT`$}?r%BLy&@ zj`G>E4e;0M^7>dk}A{8R28zk01=^|-OzL*u7 zct_&x1)S4D2*-kr2&fah^e%vkgz|8$jv9E@cA3M|HIeQ^MAhQ~L}LX&xAT7m?^<=d zjnchh9fhp6>$JIoqf;ko?yWldxDZ!h{4j(T@E{u_aBrge zku~~zNB#UOg7bGa?t<87rRWtct8K)rfluO%mfkFEhY+ISbXUS_?(=498Q zNBJxK1g73EgZ~g?*U(lZ)JYj=enXtXb-q10`gyx+>w5#BAkOP3Oq>%)(Uc28xcG7Zj!ay^ znq>8qknic`Vc~;2j=@d^Z~E%?xR>AgXm3O}l5uEUnqg8~*NCjEn;TUJYX#tlw=527 z&i^*XM8aCuj11==F~pC@f^6HToQq9rN(9`ZE14%!Z2L$Z?$c*$sKONR*y|G+_LTlZ zM|_$LUjuD&pYr|0Bo4kiz>2J?Uebewe_9wTtZpu}fx3Su(+*a~vYM1fldizqHUGJ( zHZkd+LitSm<|vr~&Ao{aG#3Iwa|q|5bDY?zzyqZLGHTK%*H-gu=(!*9*56y?bU&2-!H!v zC}p)!6dMker9i5`eI$t;a+k}mv%esbl5wQ@T@gh{9O750{Qx$0$G^x&K-W*R0%1L`eKlu9>2p_piOR=QZ;4R-o!u zWNnu-K+rOH6wCijo4JOJHb8xki|mjX^VxM_EIdnY%EIS&gEH*o!E|p?PcmM8$UxWI zk3>L24h_i9r^U$Le9ga{NDhA0pns_HyvlfC>m|sPAWi9N!fhq*WVN&Y@`q4sI;)@P zE%mGQKcuu>`wq?67B_)f|3uV$qYlV*W&;I5|VU~LtxQ&JcpPxi&(K)mIx5y!J}P(o0R<(dyZqdz~% z51RF^*$&@F4l*<*y#L_gskcY!Ife zz%dl3yn2@Y)&)4A@Nn!I3kx;w-4IWE{io}z>1D1IYO`4N=wxY=TQMah8$tGv{MF(T;w71@x%W>LZwte5)tHE*T`|Us! zXTi7VER6wTV%Fq#3d4k3e1;<=4u*IYO5w! z8)X!8+TlL8DQVBfB5PR7p%2}8*hD;M-)~3OQC5u^S)cc5UvGo(UP*`$H&r86H~$3I zrG8k)JHS8T-udZ~HRx92BFg(XLos&iM#*3)$vuqPF|k<*9^eaLj-^|%P_@2EhI>lOJ3hQryXq~u?hRh zMJ2qEtg=546HVS{pFf1VYK2PjRclU!3(4cYaj5G;cwlou?Q)qzXo`>fC*$jTKYIb( z{Xm6)Pfxv5j2$EC%{z>c#~WHb;b;!=3tr_w8OmMS*nBG94|oC{=Lg=R(O0m0)|*6;Fq*G|iXN;{-1X7_u>?z_UX`PudZvhI!(B z_L2~q$J5SnH(HkA!Ix^X??)jRo~`XxTs|0zPK6(Vw2YO3t%bGk$WM7KbFP+IiQ(%lmdktI7`Mj*j+SzY5y&V9n;;YLrJZl4Gdqx$YcQb+|(vaI4i}`4ebNI}~PQ zoh>VZarc(}g$M%xH?G`C$uapc;0=DDGOn{G_3_+Pf&8bVzHeS}!FnSqlAg#6Q{mj9 zBC37_!J=3xQVl7l1TKRb{Ch(Q-z;k+4!1zrfP23>cZ~6riAZtFVTRe5mgC!ANyML~ zMGsdA!&RFP2{kX9>dc0*;`~}>NB`?}?T=pC0`)W*2lf(&c=GTL^My1SyCycpQit8l zsQ+BMHx9I)iO2U&WJ)V;T>lOP|4F~V7g)mT*1tp_xI%M#$+S$3l6J+F*Epo~9tqSe zKH8f?h+(8_aRwYdTY~|$VQH=0tT>53y15x8H0jOiwQSS%M!*sQc55dze(cZg3dTS) z1g*uJWjuTObFHRyML^U74y6kb!((Hs(dHNDT&gFXf0K&Uh;~DJwC@w|FijI9_h<~G zqXQ`taDtZs_KtOIXCV#0d6H~i%%-k*e{axY$z6Z6Z<>rdS`jLu8ccA}*%gV6;KSlMyueYM>g^f-UtA}x{ z#WvsO4D$q~Zd~>Qxc>@n%t>+%5WJma0`)ID5rLI&v`J4%osWl=joM^Jj2*=D;eXzU z4YSu_x<;Tq`JFN3i+q5yb-b3?6D@ln0oILO_^u})lF7-~m4!dd`$M?MuTAYRELoE6 znYF8hK^;fKYb;VfO56cwCPwwDmX~onwt77NFJ82V4P5C{qStX}Ll;KOe^~$${04nj zBZ;%DUO9xD3LjWrU7AZIsi8A#P_z~uk&TnEJ*rwkeIKvETAQnJr~E|7zqtq=)(_?l zZE3N<9E5k7*4QaFA*nLvv>DObzPBsC7DkI+Fo($wBOfoCzRpg-%$~PEj~4N!3d>R=?_O)vZ4g3${EqQmT;F#=qDa3@h9 zWgBsL?Koh=n%07#yWc@*3q>X~07|D#gJWvBC#4;iq`dwM*w;H5k(T58om?I)$8|KL zt)nV4-bSZy!s*@E!d>~RGP$JR3c@XpYaGD-RPJP9t@b~o)UeNeZMh*RBp6EbaBe=C%mkq0X)*Dex1W#x;vgCk>>C9- z+IbNrLz!>?-cE}cyQKsB@@0>L`4Yt;Gn|(IFci1S2#AroQT+%)z3ax3K8Uk7@eTwL zM?yz!B>H0Q`46R)s=Q&`SUS;-+2cbPG;+K?X#J~XcObn?T#X38WgkyQEw>zsK^Lr$ z#l3Cx#UKVyd3hu-3nMM0Z&-Gbl7a_q=w{aO^rP#qb=!D1LlMAw>Yfdd<>}>gVgaGN zjGesP)2>HkwzC!2PDb*DM}<3CWu5g(8HS>L32MR~{!WFWNIGWZR`*BgsN-Sw9&g=z zjnbTjH6U)poSDho@&0Z=j^)|?(qC8jG>~Saqb-I{(J${Z^YMT0u%esRTUdxV+UW3& z5EQxX>63j&&l!KUT>Zrbb@6<}bpc z!bzCI=4+q_5&#(A-BM63m08K)eSZb`c*oWD<;Cqj838Q{5$VxO8M|NH$KI#*Eo>0a z%S32*GQcnR>2)ZrQ({B+Js8j9t>&OkYm2uw$&rYE>9wOYFM;F~e2 zQ^6xyyMNoKFo5)j*Cg!^dRWZqD83wA709>gZ>@l}%W)Nx@X#Y(_7ygph4N8~Cbf#J z{#c1ND?IAuHi2!ww8vjeHe&fdbcGwEq0@AWEUy@0ZJo?83a>!zHaKH#9-@8+zDTU} zr%$WiPdQ`OXFywz$X|>*Gnnug1yR{RDh_1h5)wz`#k^uO9lD=Vq*IHAG-}Y zPC7t^_6Ag*kEp2{MK9Ic#HoFEgvtVXEGw6?QX!QE!i+|;C-vdl``g!?DWA;dwsDeq zfr=bY9n)@#+c-)70n{W$P=?Qhzy}9#%`TGKe}39seXDUp`R-Z6vHRG3sGRgW);V*& zd$?FPL_yM8SD2otO4}!de6Er-BCH;4TM-r|1;ZX^E_QK_!c**Ba3;;K_K^Bj(FiXC zbxp}EDOi>PFF}fExY~QRI@jPwv3k!p_D84{P_Dl8xggY9)w6Rc^LWZgKl2=1B;r-8 z{UT=Ew+j+&qSqA*nc5TAx zWJ(?`EkXg`)r8rRSL_0_qb*EQHQeTWQP=4MMcG5*0HC=&TFrZu0_mXir}1rbe$&=PtQZW zVFET3@ealuCSH(az*}ta-h%QU;ZUq?BM%Xer4jyHS7Pl)23)4mAiob%JgdAasgbVD z%MH5=6Agb-MY7G{vvyRlL>6&RPnNPyW7gDh5WcPNgH=ZzIa#c*0lJeY>`z5bCE#FxXC`!M@rg){5p?s@nLCuFDj?t zO)+X&$@WK#?f^2RVm5K+9D{;L=O^@4B)jQCi%Si4=1S2sPmHeL?NB3ELdq_lG^o@k zTiB;aa8a7}EJEQ%T^n%akZ;V+FT8kS36VOnN}C^;qgZB_2u+g9?>n?A{NiS&kS?`GmuefnSD*I{$EUwo71=Xy0-R_M_#B&}+Q z0r!Pae&Wh1nxVhhNuU6?J@J>|7WRa`X%}>J|7Sj_c5HI<>BYybVl!k40BU(fj z*KALswq}pGS!KbSBV~R6NJn~ZRO_ej9naUnhkKY&XxWdXzuV8QrkK`Qz-7olX?=gF zV6tZ%7KPhh$;Qo0mW4okc8;1iANf7U6DLa2lfVyrni}JY)k7XzL8xl{sAvp49PdpT9vvpE1FtPbSc^&AZ(&EU%PIedC#7mUSSA~CQ6ctkG6Hj>~>B*u; z^#@lp%&dH*~pFJxK8xQ~z9sI5XmDTQj8(yQ1C9*LiIGdDf z-msyb8au=LZcA+<1bdf~-7@*CR4ZQq{wqk2zkvsVSgOK(_GwWW|AeZT0O$WQALVxI zrFPXa>CB~iP-JKw2sYI{QwD*vS}!U`G~(&h_-f`4c(c{_(mj!jJbgCjXNN(FOSi%B zC*;A3(<-O0t{VTJ7P`KGr^Z;K)L96RW&u+|J|!$Ts@wuZsyiZ6v`Lr9C1 zv2Pb>Qo^#G;vkg^zv|b!j=wqQEVioML@K3Ni3)lmkQU5DS=~r&Nhp>v%RjOX zO_Fzz52)dp8{a-b3Ybl#*9eXVH_%QBMW6&QVc6j~#t}yX`vfzRN6)k0d$`R41X-&X)VbiU z#w|`JWDgSF5QZ_jfSbb8j&vfCnRbn()MqUagO8!){i2?~Q%Sx{xshVJXy7{?@VaW~ z$OJnz#$Q!#4t?L4#3<$_`EKwX``I-Po%A|+iRH_X=%umIfgD{A9(dXL+#~i z_bb);hidx%($^pOOjp%n*Z0XxD**^i{_YUx9&5JoSD{VXYqGiwP~H^uYa~s12DZPO zkrwLB^V%ip-9MTjR$V0H$Y=O0$6~_mZR0BkXhw>B9mLb2xU2l}S;6L>c;^HAdoNB@ zLxk=`(DABnP(G@0xj+8#l+?74@#xu0NFA!B;a6}q#B_6PxkRzv>R^9m`-YTUB%B8` zWHSG3$7?`EN-T(2KXm&u+w@$=*?J=l03a`3j1Ua{D=J%k$^OwG)~^?Rt&zQj_X4;a zmPXO+Xn&Ir;1Gg0gKIJ^jK6WlU%4!SoW4~3wH7X{_(Rxghcv;T3syb=vuC**7)VRJ zqR6%7JuT8SXP9y8q$nQx*Yw4zwEM_fCDL#70H_94VvNCMiEJOu&C>v2b9cS40hx9; zEfniUb$!sH+KvG(qebIs2v^jbr0txY6*-ngk1!a2cSA<-|E>23X!)jvKhhwBr~Id; zF`2z^P(QL$WUQ}E{%@}?2snF?*R92bh>2#rKB5rwmZ8plXYsHjoNTch`onlP>FAQt zhBW0_ijF?M<1I#f`1?jGS>pY$E)M0 zCCe`Ny+&xwj^x2%VZk%rj#C`u;q1Hte&$3piEtsH*5^tEn@_h_9w+d`AvzR#Vo+vy zHs{X=*isl>ryj5ST{)ahZr?P|$roMf&)@&}+4V6l$$uid<3GXYd`4a6l#>{v(l%FiMRV`RhQ9?_I|rp5~Hq{Hrk=ZtCuQu^^=*J>&B;Wx>*@u zs{gZ}_>yx$bIL;EYOV2&N|HvDj?;+w*auJ;mxK<~M1fa){~ml+%#hKq6+$_x30$4{ zl62yT+F;_$c->}#68ob`6Yt02dTQZ9n+rn1n% zl$E)lu|$xHBtFGSE)ZZ$cE@*>H@W;LQWL|>#r-o|_{?AMRqWh3&i>afb1CLoBK`AV zazvgqsFuy1Z=Xd!c7BLKSuZ}E(uZfu(R_Ah7{_nOJwA$J`j*x&&pawYYt`cT380&0jPUKgnII`oNFf^;N z7h`9g!3v?4!A~jB3-S05PMds0(nv3Gu2N)+1B1G&qte+@x2TY}?vQe9Q)_P5L;R!3 z{a+sLo8HOWqmHv$N<><)fCPV(qy0+aJax0#*}tn@Va3 z`Ii+hn#ubf?e7VkBG_;>|8dmiOP1qJsI|0k6MXf=-(T2ik_xzn!70bl--s!sjL-W_ zw{!`jE6=;Z-`~}d$N7KufpS|;ZnW5xorueY--u5_v>-K(mY$XPeI2~un`2H8s@s0} zx-3#L3Xykcs06FrmtWGy!i$PpBg%JD#y32`$MO|^*Rw*!^I>W--_57ECKco=??G}^ zBnB2YfEtA{x<6VmSKa6zJuo&Bg77O0y@|FD6bHJxe*#_32hqbMY_&Tv%DG8E8tSZn z$}t^1+li{kR{G*64-wJ?gb=F=t9S(+lZOxRLkg(mo_x15v@p#4iErwK(beoly(m($ zaW)YI?;woLkHR++54PS(nHGb7i|4wAv^TQ|f)0jDaV%Ps6IsM0mUMv2OP6oi7R7E- zN?SRs3v+XMmV1hi!gEA4sb~FG7B&TBOg}%)dZDcg6Dx{JOLb^@e}`c~4@M%in!XHZ z>xJy--IM3iL#btD1otTL9JKM0GuW`mmP@P?%O+t%kU8myhOx%}0cpLY0M}DRfaB9U z(%Hl?Vdl#zedLz#=RPL1^bh0W+vDYqf<~St(ZmisvhFK7_aY^Lr$iLH8){z*Up?DeC$U^s2B@-lWO{QFUD!D&zHsA?_xTfS zI^?0p;#oB=X<~@c+i4w=w-eT$eFziw%Jt~g1FNpjgU@wst!~LlE3k&f(}#>0M=Rfb z;DlVa5*&FYvL!Kt;<=rWQS+9F-6H%cMgbl6d&Dw0M1eiRlPi;fRi~8r77Ii{LWt`3w+S+ThBD3Pf3u=XSzd*z4=BQ z2m>_v&!C=-w@I2!qW=-v>aIv-t%qSt#6 zPIP>z44#&p&tv+%LQ%6BAYwy|YGuXZA zPZva7CJ5IoksY80vrQnilA>++2tnyK`Q=7ikP0vt-Zkx2n}pPv>FNRWQa}~RT=srd zKuIOFIhbLaVPfKS`Tcud>WtU!0r$tXHyLGg3(gf+HIE8tI6L#5n>2}G0)3NCih=GoS5F_ z1F%#=Q8w+xRdw*spYOeHf8iMq_)Kn19f{MbzK9?1Ncgm!o%_Sndi0zdc8j}QSa+=C zV-BVG2FIn4e)pdL%W;VucTy9;% zPYZS4*lNDW@41{(C`Eg%=}cnF6ichnh;q}&c54_xnCdBu5l=0ogp1N&qQ0^(^$d)n z#r}XOsT3`oAW%f*R+her|L%%V(hCH)s(b;MD*uzURqzmVGyF0r@se}7OL|(x2FRrN zvH>(;^D861svW(&P87+T%p@~5zi4WLfG@j_&jdob82K!vYvs!xM4g+ylOD>G%vzA>6Y^)PE$BlvKKj2q2b^96)yC2brM+JiZ z1PixZoq?Bbhs}xU;H7+ZXze|43_nl=`Xv^TbH&5@3awcf&m8TK5Bt4Q7%K(07Sx|u zHo~6BNJBIxH^N!bg3J$Q1{-w$8DPjjp!+H&_`BnXLppLMJ(kD^_4 zRu6Y}tHPAERyMlDUnSf9NqCI^)BoMsc3>G;sbE&pTpya~#zs%CM>orwD=)CxtDhS@ zql(m6!qLfD?iN^_AsrpAwyEpe35A~Y%7IHN9Fw!1$$RJ}WO##4$3!PyXa)alB!UgR z#cxG<%?p7z)s&WP56(olEyP;Gxtl6!L~&{aL7^&U!CyLst~FtkYTik!+2o81s8y-# zL$b=PupEC!QqVz&EQ8uQal5Ay{*XZ4UZdV3=iw30D5*fNWFrpNl_~D5gjRRYBgN^I z$Y8hYREP*UVUYAnf9WyMO?N=zL1QQ>E09Pb?t~tVzL%YQrOy zB!^b@ZE{y7b&+UQCOzovLetFuy<5v<{V7KLK>Or>E;X7zmSb5}&PZFiIa@MSR^}si zV^psN5VOe{4n*ns8266XPj9y5_ckWiITf*^Ska>KF_OHZpQ=Td-T%1^2{6((x+Z8c zgQXB6$HcNf3woK8vc z#h}`CL-O47xP8l;WEJo1HAo_V+eS75mPS=p+Epl7D=BKKD+$Bnf(ty&8fzR~0_&S< zyj}{0Cq|T#>Y+>YIMGfiWMO}?6|q|}aaXZ`E~a|m8-#*7G*5Dph3^>Q8gmuA+QPpG z@Mb1tIs>OvCBIIIL#nkRqXv>+iX%aP*I;jAu_}}=cTUjQ0@W&@?OGmga$eePbT>}N zmHSQ(kIyndvzjfC9E#Xey9(SJFIy-9?V7DxJVt6lnIM>^Jd`y_o_At5kgn!KeFar( ziD}y8hbSl9c)#^7FbER%^2-6umK)DT_!JVYP93edL{s2TSBa(#){Pl%#6PB0Lf@DE zkpUx>oH*~iBpw4l)yl}=&ycaa#nw8KsZGF;fKjorYXA#d?XNy=&M%Dt%zvxdvfz=9 zw@O8didbDVd*tQ+@MP!oWzRbKZn{soE5kc<O35Y4NUl=MEhbv7X)gIJ!s^G?B`2FuFM;o18xF z(45N5=AZl&zI3h&YnNn}RS0%^OG;1Uut42MwybSZ(Wa^(*^SpJL7%fI181E?`$*|c z7Wc|h?zw3FBF_%nHcgP~F6Bqx1Wjq`cIL4)G{dfTzhDxbz2sDD8ATsC!3(&X=T#h7 zez9_KqUVFu5EW;$I7atG+EXxyaG`7l)n}uOAfb^r9r3^125bMaphz0CO5+gzG7r<@ z7_vt9hY2)YgjzO5gzS~UTafH6-T%Ji`cKUuqY2N6?hS)r;TrfPEiV*Pp`WXRP1;}8 zXMj%p1G>B@j-A7fQkX>|7FF!7w({|9R9!;h7?DRdxHvU_R9~GxhHXt?hZ-5l>3i`^ zgFe6~=g)`+KEHZbm1FaA{VzvcvqOfGDTw(3ZaN z?uY7VL)q4$CbO^>0rt{T-;$=?6sMh_&-Sxkk@0;?S50MfUu?+s{ixIt?TG8Qdy-JF zZ%Crkl1GJzSn#y)!aA#|HllyP1%UWS7)8AOF+X(`cp9lDj>iRIxF@sZ*9L(KO|v~g z^wK-6iZGjEpcnjS#ZoTgpH+hvoKgz**~p6Mt=2$TLe{q~t$x!FLxw{IU*IAJrLkN| z+^AvjI$XVSQBl<^nF>2=2mAe!VudNNfK4 zy>zp%PyGEX!7w!2r=v1LGnn-kbwg2apV>4?LT9Pf%>f~@bDJ#t^bA&9Wbq_B;{9<#iu`oUgvpX_wh_TdM+?tpbQsF5e-3G}&Js zZwK9i;(*7e9<{Qxf+V_-#@4~i!Em|F>?k5U{SU)5qX|cx5Q}^lLlz$Ly@xcKf7>{0 ziHqnTr6SmgzAy$H!isO4`w)#5DpV^t1xl_pZ$BiofODTN|J*=4XBHwY%fbQtUykL; zZIrguZ+W9JoM*?9zV3G1JzkSP9K~j>WGM*tyFz}S74e+Bv+k6TMaeH_}5s;lL# zX~Yu_**KB1kqFXX=Yg)_KRNdJUz7W43Y~GT_X&is6YUWOHbPxD9`2z|6K?TsN_=}+ zy(ZS-`LBdX{lS1!29&4CH$d#A8XPDqv(YS(9zX7D6yKS40Ap_@*Z;;Nt7qsy5HZ4#lGbQ z3%pnPGuTp)aY zZy)}2BDqHOd`;tCMozN9f~-+z-v>^;Wj0srf^&FHM76PSWxlo)^t3=<@V$qZipvi9 z!1;o&Nyb@N$=--KWOp$hVkO>=FW|(Eo5_Cb5d6Z&eX?mXqI)rvF)|*zt9*Mi+S7EA z-RqWUKOmP)lRMa}=K1NTPD{Y&1oI02;lN1j=G%y^;GPVkc;z0edq*7oQ*5e<=ViJn z?M4g2agzp?qRLEEXRK-caw$Xmb%W%U9<(+H)3qoP6V{dr7O?(EdRWc|9!)!!@Go!t z`;T>u_0y|ZQH&NF8~ZsrV>6#&Qq(+|t7FZM=wU$}uMknBEb21+m&MN%S2wECHsjL9jvNvNfmVExy%>DT#9>;PfpccK*~2O47D5svDu zGLC*d^=Z}@E!C_k!ErZ*Sy-#(hLH(G+~2x~wx>ihUj9$EJY5{$HVgDK3R-pa=Sif? z5$WZGoM)m?%q%zZ<1}Ub_@>uPD-MQp1+6mRFW30h48bm;ufJde_kgxvr>+9 z<$AttEy;hyEEGpTOOr6YjSjp_IV#|67bu;m5^uoGrj=t*6Za}T0UvMAHROh~b9D>^ zDYv$8$`I{c$!C??N!yk5(n4Ec>KN$GSmT2_8*3~YHLF6MM=+fIi%@L~_TI;PHAax_ z9`%m|Ei$ZsFBaLARq_k9ldg`M+8MUF_WIk@neObYEp`7v@R52)zFW^DmDJ_nIBK}Z zJu_OQ%9h2@0u7=|nOe4o#Eig{h4K*KU$09ob26xzez>`N9hS*S3NT0(N{VOl*o1{1 zU?->JKXcD6tQL+eoSrrI(5f_D$&-Ev5G6etTGuSA7 zX$JMUoX`@mq3E;mP|3%d3tDW{C zy*vB`4_#c%u|9C0v*AOaGQgUyK#v=t4YJA~)LnFD;Xf}T_mlV{9;{$YrzR=&dbI$)D;PR9a0Vu;@r)S=qg;FxCw(xM+LAzT4!CXBUw;m%nI-Ii`hN_1 zdH>V~7$Dda6P*Ox+y3F8L~^(!r052%v|0Zknfz{^+XnXQlBdK0@%nQ@wwpRDD;L82 z-|(J4QKRM%$`(UAVQ5`Ls{#FaC08UBFxoHECa<;h1fa$v?dNAPMwybpP!tG-sjoIW zh#gPoWS)LK2uXh&w7JXlp&}D%&fwW6@BB}q&>dzHB(UeQjPPYookiN%w#yJ zG7JA>a7imq7&UvRz~=_I3sCi^|!HZ|9Re|24G#pKPoJzl?iEom-o_>IrX0%CzQegLp$xfNt7J>=&@O2lC7v(U)6broIC?&x;YyfhRA(+Pr-7GHvi2V ze5&@c799zX9i5rB>yU|nU;7bX} zx;n(1OPuUvYpOGuz?EeZa>)Dm#a&~MUj(qOE>^xFZ3PerfE}kG>d}R!!xbTH10iF0 ziz0xtJ%P3LZOsX0L{IL0O+rQk>B0tq0p+Wtb|!oVWK7hzYsKBX8eJqJ40rt`=()XR z-Y!bCqK%Yc;dHc^5l9swag4(yF<>?B(c15z3R$MxZJYkf+;G>0d|pZ{ncAn4I&MJb z8bRlaPY-U=&<`p^ree-}_$H}#WAzs4V(R={+p(?Fv#|4RL&>OH)YHA7l|<|&{6c{T z(+KICn9g14wckiXxdvc|LJX(5cO)~f1kesi) zqyKyQQ7Y(jGbrOxo66*6t|t5}peJ)}v}ceYUFhnDh@uz6I4_jkOTa(n zRRyhvLIWO1#0_G2%;C&UcD6Nmx7Wy&)>qN&iyyY4D&NPEAtV%>gxT54LC$)hBwMVd zN!P*mZcU&cIbGYi@;=E>2hQH(VgB^t#o8K`N)k=4xdx@xDndbl^_F{kCAPal4D=_Y zJf}py_g;g~@%aZo6oZmU&+MoQhYKym7(;vtNmK}w%h+#BSS8R^1Zb(-5ywBWHmEuk z85f79mT3YTO>iDgGo4NQa?n0aks!2Zx+(MlH|nE&v|L%UNXpBM@0$M5I+ixWY{~c- z)x$tIdw`u}}xGWWQ+IM37XoV6N zKg-c+#)$Gr>aqGxrv0L8viKal^jj4UNdPI$g0!z0(%-WZubU`(>1|f(R7NQD8ip*d z#h7{{9rh@5I+;%Ia!+Yh#r`4!a&hu+{9j!vTcK#RQY-252FV8m%BenbG=?sti2hKI z613lM^it1OprObArLSJWH!$OY?tPG|ZE0ylK3zB<%>3Y>8Sp5L{EHm_k`TSU` zA3DK)H1#Sm#?ilpVEx{R^^Q2_dZ7c*X;2F&l~h2xyTrV%B%oUH4wV{f$*8&rDYIkT z*Ct~DXCSmzH)I;S0MzfaeBL?{NGn3UFKE|cUh;&D60_?rjF8riu!g3jJqB;Y$X5Sj z5<%Y=0eq2g6OX5dTx~k>eCTVOH#PGyqQq_+e_%*S7h46T9%osT{iS550eV}fLx#*exj3R=RUyzG_9=7 z8~L!EF}V=&$SCptobxfoZ)?~Ex$07p@DL?50#%md7$+ei!AXpxv&89ugw3-N4%x+B zGRF6F{%WGdD;(Nc>Ac^FB71;B>R~t+pW7B+jJO2VBX2klduWE3?Hn>Hl+#MZfPUoy z%_oBzl&14?;irJ9^ObD}Z z13cv6!ziqXRFBVqHm1RO(PBSn@NzZ=um=jo*qG^iYyFllQQfWY@j+s!Xw|U6->vBC zW^NJ;W-s&QAnaTH@;u++AERzbMyvT4Dxz%qGB6Pl3u-`vnMmAS_fh!eMR9xfcpLc0B?f1i5C(j0Qhbo!!TBh~OdU>ljf2`1* zeYU{f14UX4z9J%TFCUYwC6yMppGdaWsuIin2xj3^xi!4d0;t%%npU%nopd^45%})Z zr)yV`HEInGAGO!W{V^PHzz}6=j|$$<$2D22WT^ONY6=L{Gw zN3Zd7hjGAjP2V2<{@GK>+VpVL`t&SnW2i-1&%8(7Z>PrLf~8AQC9U9U-`nST4J4Hq z@W9-_o8Nu3Q@b)i&2#zW-lPG>-jnKa05VeyMxz>4v`xE5)^{@<*w`w)h;MpWR4{dR zx2n2y$c4$h_%pJy=hU{V$suBNr9QRK%82y321C_S-eca3kFR*Pa_F@M-yR*Xqlk+bdf1U}C)&cQ-46Cz`a>^l4RYEoVI_TSCHbeZr)uygqTa1cE)ID1 zK+$CmM}mKRRS$FG$f-s}<-&vO+la|lIG+boWDGM8x2IH&`?Si8{ft{owL4(^6e}*x zgn2Zv5+m8o^cQWFqcEHOp1D6S4NB#sy=Hq9Cj1{3o(-bok8#8bZE*{(T^X~Rli$4R z+@(<~k({URcBJku_5b0veLgE-_6i8z7_-g(t)vb_7U5bfH$tvom{DNc-{Be0-c6(h z6|%G~!o6||Mn7s?ZX`+;nbp$;DAdhj#@0M5DwF#7s0hX5v~pSHJe8CLfRDWM=@xTV z2^}J^<%dqs@nG}NrE5X~R=X-~W5R&OZ5^K*Fjna$$HO>|9 zs1jQW@efUkV_h>SGe+K0l#3$M{Swt9EW4O#%ui|uMudhH7Iuu_TTFPGpxn1I3Sd)d|=A2Yp=&ZN;FP*}^q@OgYFgrKF zjrJS&3WeX{rFN2b!_<5Q;lw(@v`U;jt#SsKj7`Rpqkc~FuPabc`>zarSgk^-K0 zX?dl~ZS*B|X(Ai4?B&b3Z_<($zGLizYq^)6jy{28Mg?4(gjX4hrZ?{tyk8<3G^n;N z?@2w4e^8z7RaOFduoP(UO&$Eu)r2rFC;lT3s>WoHriH&NY>U4u{l7?#QJ3zJeiE(n z0G35hVyx=}bT%j#GE(Tp5o24o4-~lTViU_})Ym#=rUnY%932d2=P1^?i%NWcTlAy` z7~?_wM=pc3U)@MisXD;pTrIY~R@~(myzLW^oFnfG9Y(NMB5#HV=$-UjS|J7l_9rK{ z#i}%H*uEapSnlOf#L>fAq^PD!3I2xws+oFz`#(|en^Ej_#vsprwXh>q)*ntnuFq8# zux}Z728zh);%TCjX;4W*RvVOUR~;dq>WLj4$E_qb!NFsut2Ga4NcMW~^is5=wWjZ@ zOP=18Gb4jPSBiYHWjwdfa~;)fQ&sC--s^b_h{M9NI*F#M{?~}XG|kUM!p}!P?Lveh zl6p$urIHQUApkQSCPJFtvJYa*7!D2m3G0V|g|kY?{vFj%tb}}}(px@(>ITZ8{6F2 zwl-;FJB@z(`RaGhp7+o9?7es1ndi>T^Ne@ly31~TH@dC?R`Prp%JSEc>{!{dlboI1 zjo)nypRy+#oQ{8>n{Es|B!gC*m;inU(bHc^<+G?$6!_%3yp8_`!dFOUT+UpKrp!Gb z-x;pt<%XqePU|#=h3Fw6k4Q10;(t0?{Sy8`LT}5$^wXS97)}NTjeKJ2Yov0Em!#IYVL?j-Rk+M%~;nX7?h!LS(@OHR$ zx}kN~Az2YHOi~0ly)1}UFSGK3%cLqo&|z0}*s_$w+*Z~Sop$y$>>Nc+5tLOpLppj< znb$;RHg;gF{g_+{i5-d}lQJ2e747t<6w_IG1Mm@**^K5$k%rLR0?{|U?&A7R)RYp+ z!+=-i&{>avN=GDto5(Bc`~+iC{dj#_WXj4kb{kS;a>_b}2wiNMtFX5+kd}r7d$o2d z{snZxj`%nd)~UyG^Poc;pt~*2%N6h&$b14fvhjl1@!B z+c*kxk0i^mFCqUbOKBb#u-0JGqYdZNJgJ2tnd-=Y&#$J8{2U`8y(N|%?KarUXOO?y zh7t9oxuPwt=CD9$xQwQycuNorow7+))vN{5iu3O6$Xige3_PhRl?J ze|cbn5(AbtsGXg;NyqGK==1JXa(EFF((90_%jIz1fo!JWUrnOiK+mJ^)t*l0C)zeu z5pi7@;gjuHey3pv`Uj{sRbif~e4Q`ZShgp@+xU5*%aSs@>)coBnHhb9%eYfIHdi}c z2*BzT%K8M;h&g!#cvbBf^KmI{ffXwS%$ea*unbCi&RQfsxe0Qhm_q715c zO_^J%`$d>$9x8+ZUow_38mXH>`&2u=gWN61AO#+beQ2Q-Dz&^5v)v7KWo;o12M|46M~?QNej8-Cz-jtyq?J#E`h z)h9GGzZi0BnGMs~hxQwurSTa3G4{{sY7UYZx#3trONTguU6}bJQpNKG6B#>Oj_lYS9v&2x<@6I9LdJ!g zC=G!~=^O*C$e)rj^|G$oYy$eaK^Ml_l2Fb{LzKcz2o|t~z;$`Xj~4?88O@JgQzV{b zkI+78`vsuZ);@A1=4-9kO$9VSwCF8T&G13Mv`p}|ru;Q2>M&G*$!JRo9f2UiY;#F} zpcQh(wGc1;-yr+kj7Xs(iE<{?bNec(e=f~`c9V$#(Dq)a?+p(Fgo_(E_hLYT158AhV%&*P%L>KT(VX9I=`Y93RDnW2 zs8YtR)UGOJ$QE|}<%k6y!+D9(PgT8uFG3t_1e%w1*wNoLcsA~Wc_udWiyh|Nz&r9IV;y-j^qm?!=QB|w9DSM+mHAp4WWoZ@HV~zZ-#nuf@XcIcWL$sE! zDNIAruf)B~7Q&8SMq;fWBi=%9t|j&15JsJbEVEFQgv~jP(ZoSA5>+_(7 z+L9u6P8f8K<>q-54}P55gvOK7M2st8GjM!9+jQJcVBIa*zPlv(5KYEQo>_W#!DqKY zb2D6^HL1nelZUA{c@;EM=(QTvkOzVml8*Pwx5E>8PVAS!Z~7*ZiFsJ*p( z4Q%by37@}%q`44zrdPr-$U332j(GhZzD#)i#*#$PGX~ex?4CEm`aZoFMBZD^c;n)1 zlXZGuI06MZBXZPuHeUKsB2~-k>Z&}0!;L%F$6GxfHPiVber7cg^2cfzb-tY72rhgK znB|!sggIv!5qcvd^XA8|5p>2Fa>od}zwtv%KSH8q)N4(M?!Do$?O)+Cpui7D-!7YN zy()qA<#OTe{>&5Pkx<_Hbk2Us?O^x4hxA2Uf_?1W-uEQ{W2cY01=wkTteV^yx%4j~ z5(v;F`WJ_uyF-BAeTI076U^x!V1ibU5I-1u6{Mi}fDa!STjl97W{;}>25oO<@FbE@ z-Hwy-RNSxn2U=wIN3`lV#f@`Bl^IHzv{e!rvQJo}q<$d}eqKtr*6!jW6|E3Lxar|< z$8V?-ebI@TMwBe$gRB%)0)zKq{(X63$$UX>T*M{uH9t_j*VWR_g%e05+L8D$E;IuuHY zL1E%-stTu-$fC@p`LoI?$XwT=)+e1lBReiT_>Q)%p^$dR6QhLgLH^J%xAJlq%KziQ z41&)`Qk2DEGF-lUi;dTYU+@z@H_XdK`ufmwPR?7F$ciPZ}Syf&AfRh0d0l6>PW|Kd7gs8fYEHLBh0-SXd#|ri-B$b~(Pk)IT=a z{nQt7@I}JOg3s&#ci*>wQ>&n}6K|*mpu57?tKk(dF-d1+zDPHpE^1|ire{O==C`;I z?W<|@+xPST{>DN7|A>n^;5p@>BB6{jCwEL_;HNqCi(a0K;eJ<9tw)c!tf46d_IM_v zgzdCHVylHuTdyS~PlxQjs$3*{9V0>Q$RvNC$$g(RNNoQ~^($E+8*E4mK0H|QYX303 znf6IK!w;tLA)HX)PYzdqaeQ!Cu{;kS!HkG8d!ZXDVf6=Pu`+}D4V+dQf%uwpa{G4b zm+sBM#g$E8!e%M{unBuT@Vq!^2zP?~cJ{2{2;Z2$QstpI4G55c&yj@_WBF|=|=lKBXAKR$6WJ)clcXl4(j8QII&dsTtW9vbMxHVUxmxGuuAw%SRt zsd5~JS^fUYu!T%imS=hTdHNa?Pgz%wd5q?R#XCXF;;Nz*w=saN-TjH&!e8u=bRS;J zoNsrjSfXlyf@2%`)jl@RPVs~L=?HX=pT)n^tNnY`VoO)9IM$Vzm`6~>USWtHL>4NP zh^|=3UK;<(#1E4?+~xBUrPWt*0= zt^`5wI!48iRzlRn=-WK9@>UIcU4-i;YF$K^LGcewiEJ+3zaAf$+O>Comz!vpkzg(~ zp|pEx1DYU(Xmt{WqDOfZ9X*c{=wB|i{^r4#t1x&=nupx^Jc25Lm6g!F->=K@o+iZW zHn9Fb1KbX$N9nRmIe?Rggm1R3dE{eq-N3VROI=aR)q+PBugONwmRb&%-DLni(TFef zxk<{=3NyX>8rk>|QQ?K;?(kJqvsg1-h-Ajb7BSeC(eW~mGyPe&F>|``89Oms4NVH4 zgFY|rM2-RVP6eI=E04VW0sli{Qb^H??+@(}Fy4LyCaWIzzhy-J`Dk4~r)>Zd8+l-! z%7TRVdELD#*mTOJz8d1WSBW5=RL=AM{5pJw5eJGD4qLegeI~hb3YRAjOe8jNa=s#Z zXC9}>U;{KTi26z7 zaEr_)W9LNnIVMmt2TlKnd;hn@h(W5U_F>*^9ZF-D{bJR=0ay4xdO(+$R(kv1Ag zcFMH?pJs`))2;Gb9K{cfeSTZwP*&8UmVT&DT2=^)HbtoOQsPD)Uo69ZnnH6OG!>e! z-Dwk14zP4c&sCIgs)Ej4O})(83qu||5J4KLtPEk0ijYj2enWfOcpoRi%0tJ)^FExc zS2-7e&h>FO?b900KiP&Uv?JM>{C^jju6U5ls@-!}=tS^sFDxss8%4?JfYP8M=z~~@ z4EXNBVTdk9wP?VyP+K>zI>N2yVj^}?{h)bIN;m6MJ|)j1m{vQ#j%0HtC&46b@8mA%US!eSk{94SQglgV*MlxPgu zS><#CSE4_Kt&U-EbhCWKsXja|t?-MVoNL*|XXreCUlGGjF2wdpgd}a%(5?;+<$cUB z%dG&!8u^6a(t5JBa94j3R#J)LPNC3upL_503xjBb;@u~1S+l$e$@_8=^$ZQljv`b- zuP5GiMwl(E>co^HphF#V_%=HNc{dk=Da;I%t+9h8@_e+X@6D=;dRrU85BquF-{XGl zPP$65M4UJtQ$)e`?oTU^)4+j0*1!|`bC!;bx^hJrN`ViVg!(_%k zYGmA^V+S!j?n&3H+T<5xoC61E6uaZSW0PL02I(D7yF(qcJ0)+1j)4Ca&E{A2p#+x9 z9UojJ)OkGUPVK-|oMBQa@VZ|)@WP?U^+pcWyONRB(|vlkBZ9S&WSUErr7Ki4Hm3^5 zA#(zVqP}4bsk4OW;RnESMlG|BU<3OU69v}gu8zmu(5`a(Dr^wzJ;)>!{h@5dg}`9@ z2ybj=bO)u7hB!3e4PAjYcBR_%1u&mRh76#6yBl*!-`K^zm7I)<*N|p&&D7( z3I3Rq4J`R64hVMqouFJJ`(rukT3H9wc1f_5JJY*B2`ypgN;knDol=^^Ca4N0bx7gs zXvz7@ow@%zD|2tNYopRvJVgus{^@1Z`dr(^gTJG5{acAjawsbT>%C2yXl`F2qir$BedzPXSo~FmnPcyu@Fjfx z4OM-4r09#=l~-5#Mh(&b7ytKn9q+P7S$??6Y+4P_imr9!L6RQX&iJ0~<3Kw`!HLfW zzH@!yd~lI!%Ri(0c~|Aza?UB)Fl_Z)*r{e*PyaEV>sojLvU8(a3vLn{XQ&By^+*; z2K3y?F!g->^T58U5~|i_+^Yb?-lzlRY5H>eWx)3ygKV=F$Kp0KWXrVf_K4e7#@T~D zuOndV<8>SImfvQ+UGj9A@KH2v)&RcKE9S=kgUWpqQ&nwkI=dNnSJ#1Js+$3)B8^et z!FjM~F`kzcjpL&Z;AozPT9phh*9OaC#=YQ%sU$ z%Kk|5g+E`WnM9?5amoyK#zq z|1)XO%L6+E<%947<-TJ1x9w^8IwuQ{gSU%m$vkVOy&PcvlN^QI2+}KZY%Jg)YRpW{ zXA_cQ1w{V_?D$z%%TJ)OV-W~-iJ)Y@Omt)kjHBPwyRAfW?=!6b$(9>sw0IzEhp|y{eMiaHe(sb1ElB? zkUj0fOeKC*52UpFY*dg?}S8t%+U*cbT!Q3(pro{pt%irZajC# zdiRKoD8hfQ6!NT25EmSuB)bA}?&OC5F!0(FUF6nj+w2iNUXZl@>avbbrpo3+? zf?o7&bc_q&@519tDd$aWfQq>0rfRz79kVV=(e7Pj00jM_L%r-K!>Sen=kItJ{YUX+ zqG`&U9k8H|XR>{4m&ga;R-8gSI}hF!dah+r46_mw<9%5svi+qZYJLGzgQZAk)Ql9< z{G)G7H31^{$UySk=lqOZ^l(39+BNQIyy$JqbTw#TSdGXW1=<$Csa4Sx%k?Gcc+eE9 zViDV4`ylDpZ-bg16B30~1!(nz4{Y}qY7__8$dLZxgiKmz7WF=&CmGp{B+ZBcnv~!J zPmCFAA`EN9r0>{^e&h^91rwlN<%HU^yn=1_;8TiW%u4W-wYB9A@cy$HRF^Zy3{AkH za_V>1A2_}3C1l-6%w6BzYLQM7o-L)RTK&oQrvxIePvC#X)Z?Y-jIOxmGoE8y4{m*j zaC2vWj#VNLmJk({?B}!4qqr;1Dwi=~Z3q!b6DmZ2fw@{OJ zjf@-~D{R;RhoguTEDJF{u6HRTzl6hXqa_!P6b3G65*PWv?TJzUR;Ec05YzDHe&a2X z$=j+vJhp}M&%gn(X`yJ15CYD2z9DFVH)~FWiIgz3xb!O}q;$DR#^3wLUN_miMag6P zkWTshp(F0FJZA>cn^)H_pHvuq8%>CO(LOdB#ITBD6K8jw-Z9w*1Qr$G&Phe zvDq3M<@*zbfdg+)&n|-M%h$f;@7JtvDVp#zd5<+)>Mt1!a$tsWhQS`UL)&Ym5|hwvDQ&s!I1iB$wh!Dlniae4fRM#e> z-=6UML!Y065orZ%z9}vDGOxf1kAN~4xoWSQgF*_S_wU3GYyQIAuciR7+8IrJv-IQ4{r7%+hx>bRKwxM4j_>T^H%Eqj&eSKke>6SP zZ%Pyk2ctlxS9ef^)>XD(zE$EN1*STw^3|0}4^Y*noq!pDPDys~x#KSV^Az#yJLM-W zqCNDKKJJCAxJ3xd-9;ZBMigI=Z5z9}TA_v>Yaswp-&?PDQy2Y@0k#SxM$_`WS|p6n zt6la43aZa(Wsta^%ckp&&Umb$hJui*&+!teQJ1Hk2GHywGyv??&uG0NO53pu3_y-r z&3+Xix}J=U_WJE0DQkMKm^s>JV;$n6O15!2N`K>bLztB%ZfMorySeLE4*0;K>7k1` zYrq~i0J~M&%hdZ3G*UG&u!}8Hph^IB{7nOJr~?lprk99swH>9}J5A1WSC4(q!PU$f zJzO}AvloP4$TquKzvyTXn9xg>>Uwg%QYy`Rc!A1|m#~aYLg85R~toW|a7=(Z#_VX|3og@Y< z<#p|?tpuftIpWI7nAzFcQ)~C7niX{p+rpvY;r)}7Xpo4BA2MzXsFe~evWu~C=Jo98 zD*$I%O2!n(fX}#i;TV-G4HH0L+3KXjFN&aW4pg*qqcyDwYww-mA>7ts!&ISJ5j zNz;drO!c(WQNnLsacJ7TZ$0LWk6|L}?!S3v!2`l%qu6ly;WG2>gn(fkPG0#@7X_}g zmq(NkBhb(u!P*+eHJw1IH8+PwhrJu9#nXd|{l-{P`#VCx)7~@%9Gt~L)=|N;fB)Td zo%Q+htzJEwZf37fMrp5@1^jr|R86olN1>-4_-EYYa;07z>1T8g}6EUNr5z+*=3`6da!);(Z-J|nnb7|E^1JTy-9V2)#xY)s~b5H+dcFGF$N)Kphbe%*25t8T8(sd84Nt!-NQp*rXh`H zZJzoNrGJR^1j1iVX+zB{5dunROc>Nz@uPk0_CEWo{@$#5NzzH0lW+5=yC13&f5LD* zjJ}9}!FXPPrhT5KRP1G3c@Hb)nt7bo3<4eJ&(= zjR@P_3L;`!*NX<5`cQnlqazcxiohsEpjv3AA6~V})j!q^bBUd5<=9;!-$c;N>3u{yH#= zO8n-)LAI_QU6~nj=plzJ{z{5ihV0R^5@_OXaz@r!SBT!Sz3yAj-^EEppWu}z zREK^!WXeHBoOXW@8Fgil#eB6}t1I~ILQ@|tbh*d6nfXVI-|Tq$HQnf(KCElC3vs&3 z8^EZxkeGWs52x3C2qglE^4WbGbLc#%P2!psAN;qoFdQtWE%cxe-K^l=o}8KSemnxV zS_%%~nUhUbuU6-@uWUY^=dEE}R7|kh>5!6j3E)tNobGIkKha7YIov$#9#F~n-inF1 zwp0x^-#t09FM@aa-8`+3*sfN=t$h+uaATL?aRCT{kSGo?%3fO6s2M`Lk2;u&z<7B8 zX;wX~`1tawjem=|7vA3Zff2tla2`}x_eT%qBT4LV$IoehkXDqElu>s31A*`xEq34X z!?0<8o0*>=dW%0&z{DCYLVuhSp^Hvw@swhDV2!dp(aHoCs^lyLLIdJfLtI% z+FPfG@1_J{_t^Fqdh9d|qStVZ)^|a_kPe-S~sK-BX)C_{>+q5q;KB3Md z5g5U&5C&8gG}eYRWeBMC^jF7}+>pbgZmIUilb1on%@pG0j+iyh~h| zjvp}#)NC?h6M4xS|DgtV!${V3M`w&*PQK97p!55FXG6g{bj zT}vaK5S5THyp8d(Lp}$sbBky_>Ag_Y63ldSJu1onn zH{f*D5wL5z-naWSUwcl7q0YRTP@0DOrH9sDC^VvnKWwKQge5oavksFbED%}@_c=De zDmgv>*UoAS{{0&t6mc&8chfGU_=|D7$O_o!d%WGtcJ<2m8p)tWc?y_u{Is2RvaPv+ zzb!m(1M63Y+Fzy(+2I0Ep_bm<0VpO6MYJ=9o4YFnsJfOB+xrT552%vcC4_X0eMSKg zl{Q~i-&=Ku4U+01r5p6ZkL|2@?nH;4 z2My`)vYs0OUjvW5qgMa)CKPqVqshGd@@T5SE;#HC+B7i0q!HRiVcobuS^Y`ylCymYi*JdV zNf3tsFA%-`%60(H)2gnqBk5#kx~(bTO3|Hr%-|0>$}P%PpC6E(Lxw~njZg)F>-^@2 zzR;lD$b4RDsol}Y54Ixm(wjIhFEWHfg8c9g?i#XS8FaJ(g9h;#so!$+*XE4Ze;_52 z;plnoTIqaqKzQNy3|6OP^5 z+SW&g>K!5zs_nuEo2$)sq=mSpYuhHhzX4SGxR3PWT5nsdgcAJ{`)pBe1H;{=Z0UGpX2(9?MsGQShh2^ z?Uoj5S0Sypw@$vcV2!rti2Ye|{N}R_JJ2?U8QonoGE%wsB2RySCW30FkzjpNpY67t z|6>k=sJn+xs|G&hQa`y8l2nhY14(zB%I1; z3-!4_8zQ$+o2BioUIltIWoYmMk3!yKtet1qpjq7S*uJVstSEz5wm>$GBT>v^(OCjy z$W~W+K-~D{c4ONgpDHtXN0|j}cWUJD{Di;F;_KTn?d-T(5O!5GaN)r5ji{gG+qH7{ zzE5<24(lf|6t}ARQX_63hMG}a{OIR_r|BRPT|%uJTFTaFFB12MDgfnqXXAHD%x&sk z&2rk_I!#(twnn;VI{>NFrpPz^?@zV-I{(K@@SIq8(Mv=`glT^$QspBDs>|1ZPu~q+ z1{iiq0Q}U&E>*&*s~yR2X%@q~-o!JEa#}Gp_ZcRlePKiVhU5^S-Ux2!-HUTn-iXuQ zK#qy|ZCgZz{n8*^|9H~^S(K|ITD_}=6vB~VEY4p%OPja=kF0RcF?ry5VW>dC zu40+4cBE+v|4bd!IJX6GB@$|Gm1Gf@Yh;?K@27~z-i-uN`cV@dvleB3T)k zaI%qp6h@Z5M*_Nd09V`2v~XH}=|jei^lxX5R!A0Awnkd43C?+Zyw1b}-JOJg)pz$$ z3ofp?7)l)7ffawHBUjv37YTl4saNW^Ur_`!c{PKKuM;j4h9y;706}}gXa#N8Kj}d+j9s31{BSp2C16=L*vWGJx=PM&66#8kpOApT z_zr=wpFQ_S*m3}98~8U|fh@8-w>P9gAU>Z&P0|=|?5?7jdD!0x5XKz>6#6w;oKd`g zRL)V>G|9cCuYf4X2KtW68TE!Z{@X>FivyIS8sJFa||gRXvhRkCDw? z7j&Y)GzmoE8arJ4G}Oqgn5+PFiqF+L$`5UUOC(4OlhpEn6(Fz}2b&`7kYC~Vxbx&b z*<$C`q4jlp`~jwSZlMv?d=oA0kN*^b1!+V8w>pJ&wkrQ= zQ*#kAEwTc|O=DQ;;V<*g9O>59Dsl)@KL?9uH&D^vnjHm_BjN;nv4r*MaSr%@q*>=T z)Jg}md>%NZ6ZH=L5Y(@1#q#%c-sc+g;y7s442}g92DFP}$#vt+PLEiTWNi&g+O3um zvu9?~aHfOll6*tot@-qcKoGQ**h2*T#s8X^_e$X@WAH(=V2LlS4OkB3ppQWSO@PnMI171`#@nYw9 zGex)*!o?*(2POrQ3Kf;Yv}QTF&<_dLn;9(t-c<@^d01u>wK|r09L0W$o&DoLO7P;B zsOiBiS3OwI%$AI$>j~$NI9Z~9?9f{7qm5`}9D5u)Jv$JbF=%!o;`m0YaOmf(l+`su ztQES<5VfC7=-Nr;`gR2&D7#VavX-TFT`w-=imS}(kWIs|JDq>PkN_uPw?%?)#hs26 zMe8H=)&gGF-?n}^0%_6>$)1ub@r^5zQ(nX97wgxIh)liS3OPW#z;R+NE0i2jF8h0p z8A+uwa88?5o0i6OFiPJx#a|$f{NWoGHy4h?nG;yMe5NLkwO={*EF!s1I+_|+gjGo< z^N;z;KKImX|$ELD@=oF-I&t|gWU}_DtgC5B8^bIbN|524;xkm={D;D&}l6g>c zFcCkyg#L8Uq{La|9|akym5MdfQ~+0dq8e*z74>TzJcaTNsY9{^0S|XQ7+7RjX|Cl! z&v#MnZWm~y)UnI+QnUj&ZSCHc7#J!Zn%(6vB;K=1F)!M8Cv=S`p(+>$C)S7NH#p$^6yNGDbuKeYGnP{ie`5}0n5k{qlqQ@3-PhH{*0M|2 zt?z@%s{YL}z`=OBPql0k$FUR_s?#ybhgXDfu`qbt)s8;yY~>c?2~)gXVIxPOIqLfx!zWOe8PG4=3SwmF(T0H z>9hBx9LmP-|6)QjR1UQVy#vd^dxzXFv4s56#;@_aL0R%ND9a&I)U2CcuxfH8Ylv+^ zBkU^>Sg^n-z|S8HNwQh4PsvZn`QaU{?X@Zk+6rDyH!hxSHJsd{zqG#FkW6g`>CVf7 z^{P2K;qtfgPl+*JD{6R7-)pePdI~2XcvS(k33CzHk;6Cz*X3`2RPcEv+#Bec{vlfP z{Og)GL7qkHPLqxyTX!Arg&A^co;vkMegNnt_T<>6_ACwb*sz9Hvxz^$>s7S;d(ciK zd>S3`y+b@INyWX4Zl;%ef)v|l4YWkSq5;zsBl6~v$9igQUFSAR_Oj)8Dx$DoVz_Kp zzZQyZ<6&B-fMZCskWab1Kyf!>#l)-%T!Y2%>2(9UZp>0n`Z9ay|Wr|x$k8L34N3z`}3sT$cc+&Na<-?YapQwqJL-StP?iY zHrm;_i24e8A)1%1p?IMwAyacel?+S)LYLz{3AEl*ES2|Pt+9cr7@7N)HcRVvLJ6hs zn9?Y0%$$`^-{g0;mM)@FfyiuP#8NACPL3-vo zq&Q@bss~`%(gWzuO>!VVp!;Gngi&key&#yoJ(cmy=X!1CP06=@ufjZ9Ayq3Z-5EN^ z-udYY{ofkgGRpxc;M?sTUHQ`P7k{p1bIl!PCsJgaAU!Ihh^Ybcwd9n3L`Uk0A6-BT zFcl5~3flx10x7h10QmV>VcOKeztMwJ@Kg{Jyo835z$7U@MY)i%D7y}&Zjno{We#g` zmlJPqh*g_vwDNWEzdd&PuZ=c`J+qx z^!u!kh~Kc&xfj>Za;lRLMW#Vm0~ z`wIMbF(ulV`6H7=VQiXy3ek8awHt3Be*XN($&9d+_TN!!<6Y`>_AT;US*Ndhao0q$ z3P>hSO{#H4LSL0P%^ofGPQx87|Ek9q9qXp+dKWqviNMZa9p=7Uu)0I))y_$j9^zHE z$<6|jcP*geVlT2qbEz*;3+SIj_h zuf~)uGYykRL!5|Zd!umdjN;4ASD-IH2SK$g2b0$uu(M0!<$O0Th@%8Ne{>(I*Mgv@ zMZ5Pyx$)t2I_SXd`_)yU1m+-J~A3%`#hWpFCa9Ej|WqWf8~w4G zDQm256L!FXrs&^GQYRXKviK-Q0YdyKnL~)p;oW z?O~LylJVWs@!@CjDW2~qcDyR^s9wM61-WLYjVaoZ*|@kuto&$6puhDyVE=c#%Kq+5 zHB_%W-QN;7??W!{(Lo*7E(_G;B?oavK?~nQ<Z4q#Z48J-6 zj!^R0c@Uasdwr*&r1Yn+%*_lFhDw}YEbaVY z{>d6V$~u(E(=(9QTzDB^MEt|lh8Dch;yP5RWz^StEIVMwALvJ{)OVc$OwTQsN~c1d zx3~>$kqGznXFqQIv8C;Mb1WPx_>3$ZN!LGnr+4{&x(R2DGyK+j}g z1t%KsSTwACyrN4rz|YO2P+CsTDY`>1SRyvG^+S*6TSFQk=qGdIi%~${gKBa|PEN*V zS6j~Z=@iS8C)v5u-GFvxakG*THhIoO0MTyx^&EWa;9v0G@$9Xwhbi1(N6Ytx6Y2d} z6lu%a!C4hJ^zOB>f?bN-cWW&9Gh5)GJ$ zee$B#71hNG#Xnh7N=IArKKH`?pHtbvkN$$bot3PQ9~-Qv#P`YL3MA}lY@89(WcU@&;boS7svq0P)u<|%23|426zAsoc%$2cmU8YDN=EH<<_LId^};j z9rSG$Fc0^B%p9|3{qt7(?QDNCv0=YVCM{Q56*n}S8*yi1=4$hBkp^>nN{HZo7j-US zAxP_!Przg5*X>fEp-PP07a8e_iK^NHA6oKif*Irh%PyjnDN4rTSk+%_~x_ZdNjgm6_jK)-fqw z((5pztm)Vs`3?~~sEnnSQO$U^`7FX>v;pC8qwlSC=Q1B3iYDcm&Tku%{St)h*-ofC zi;TPkwHU;_YJcyCx(IsFO5qZ&s{nD+y4 zb4jmxa?UM1kUSJ4xPIie=3~S=n70h|QKMBtGu5)8UbW1s6g0Ox%vuBPPnUbXmr!!5I7sW-G% z=2cc}tY{X$D!I58zSXRIbKHY{j#`{prhD$lyN~%(v}l?>O=OH4ro}sNcm2!YF?X*$ z?)3n+FEh`EGH%vn`zcv7dW&4!k2MOID=V&Wfq!Lc_+8IPty@c6C=90#+U?iB_n8XR zUk@idDvf%EOP8hnLLRAUqUKz?nHU{Ye-OfPULH(p_7Uk=ICP&_t#^7T*4krzdALE} zAXAZ)-9W$JQFLIm5rjE&TuJHACihS#0T%M-p+7!XsMsC2Y;+sjSjw)~az^3aWYae) znr*=&v~L~+l{R4cl)@v=sjeIniY+`%gkF&K?J#m*AF*~Io}EOer0|giS!XTlDIcpU z3=R2_Y^6(@LSH1m+JkiSUp);K)a6&>0&dMYvO zrDA@j`+!F7M?Mw6C|?y#j2J&8GNjxRhYmXOv$%?jUR`3Iit1MjeZ@3nX~q(wVH z=)UqkCN6IB2)`DoWJy~=0Z3)xR-9g_@Mt+SZuKyyZImFT0asNymazuP>a+8!6-*dT z=YtQMWh~1bG-3f>mH63yDH~+xjfOI?rC-sC)bM0WDqvaBwr-fh-{mWUsWN#fH*82J zUoJ{24@ML!G>AMT2(8YCEeyk^WbbZ0VjSJjiZv|8cz7uEsL<_xbte>1Q*WeTB3K^q zrW$rD)Jn%*a(k*wZ%F#1`xXXoLe;5|cFseu@q}05EAYYGD50(~G+5t->Tgr2T_m;} z96eJ`SMHxH4M`(`$RvXo$7a_7<&K=Eo-w{BkilzY<5Dh(^3Nr(xVnH5iL1i;FbluD z+x}VI0{nekagl@m*gScq>3Fqxr)j&>VlCntET5@P>fpv|mQJx!)(qVKS?qf~ zujyXW=Jcm2=O}-S4x=9XpICw^9w{>XjWhF&i;<3wZFA$|_}F_WjQH4wtz@z<{RK`_ zLCp_NXd(agG2SrtoG37*7%r`FE!yOM@;Q7tHT?Rwmew4+6Cc}talQRL z)xO!#<>ifEBZ}a^BNnE(zFAmUSV_RNO(vHM3ZtzAjWLi|bg)mUj8RwC*c9nCq^hmk z1F%Ug*!H6CvBvZG2QqiwU9)|Lf?lAVQfM_Kb&`r z{U6WdTFZ?_@)&5fG>z{B)g(B9LjQRgB}?&5JDez@lSR3VY*J5}k9C~!BIDb9y|;rb|Llv?uSRNfND#=QgaS~qKyz?#OiWBZHcWiXXZ`oKwMu>j zPz*>J+uPg!Z6i3r`p<#Mi9rLz^Fzj@tySCwMtio;#tSyDE# zlXka<7O2;%<1$6tD|9GqlA-<25x(1g0ATJ?v2kz=Z}bO?j8E*|wg46uG*nd7WbI73 zbpAxF=JmuCe-%;I{|+%51|SR?+RO}M97DMBrgFRr9PEv>!11^GoTs~mE1F@ z&#gOqI}u@RzAyjwJ&&|)`DCJQe$;=s?iR`n!%NLmiS8OTZ5%an$dA5625_H^y~a4h z^%B}cX=lHniJS+-{c3k6D$_#wwbd;p6!*6zKA`Zv(EIJ~xM6i=W#u;WZ_8|b_*ghe z^PktD{R#7h<%|mRNyoW&$KQ50&UP6KSs5tJiU1#)LCg$#Yic7Q3FAOn1 zQ?=m$2Ql333s$p$prkgeS?x6pnTywtsoYf>mIHwq&HN1_+ejaF-?K{i0BY3%@Wv(MmsSSa$a<9BI9iT|APbz;ZI1dT;9&H~a!k)F0gi&*>i%onYZh zz!bybs%x+B+Ijqa)zZ>XaMGYoUDD*$$;x`0V&Zuo&gLbG86N?O=6}zoLAmNFs;`Vr zzSgyl?=cCg%CSB;Wqv60o7cuCrI6?jG^k-#9?)W@ zRZBVkr67X~4KIF0fJ<4gDezZlQ~G*BZ$A)oU$a|#MH&b^3m9@EQ`njg>illhP|LkT zwxbkzGH4|{UOz`y?>Y<`gb%SwG5=^c25M8ItJXZ8Znu_=iB}Eg(oDfUHXs&!&8`!v zIX$5t8!4?+Oc?hnZF3x&^HqKL9S~v_S`O&TNeG{2xtc9oKZ&{e2WcMM6ZnL{y}E z$S467>F$;oHM&y)L8O$f5dx#TTXHlKBL<8dV}sG15BL4MpTBor+c$Py=Q`)SKj+ww z&xr^clc+5*FjT$=5z$NuO#wQbF5<&{522=`MKN950?(?84KkL$g;ab5s^Ue-!~%?Pm-mqb5Wse+_XZ4KY_rZ>8L6OEOaT48osZA5JmC~-N;?bMW! z%Un6}ZCKWrxp7Ec8NHW3G^(jX0Y4!ZVj`|vA2&zQ*Eb(1Xgrx}NQ00_2U)z(Y0;>t zt$pt2=jTK8>**@5+cdyQdQ}}6J5(@jBp1>|;E_~6m9C!xWZ5Vd$(bqQ52|@~#~frs z_vEnl+*JobRP(=JV~wMEuLXTP5>E_i!%vgUnO9_Ol!$ZRG?(E0?M*Ecw?~cntBd>! z@2l(01`dCWp!Yd!Cvm^rp?&kwVB%MLPwPjQ=e{5Q74tz@O>nduKJAc&Tn9)~3Ro_n z@uG_5!<^gW!tu_4Eg#&*(r2}K*oZ>(R5Rf}do!*XVxpd7$A*3{8#` zkM7@U;k_`0yV34n*nC==I)4T~41)Fg65)Y}@Crx$1Fj?R-dl86mEh4S-}`EzdryeT zPx;#37FtkeNF7y|$iTIbYf_>v9lF8!06VsLD*}08#k|tOt1*{m8o57<&h7iGe0t;1 zxCl`!YA#H<{=RW`fmk&^M5A>ZGiWllH}eoLRSloq3~II~%}Cy;fk;hJ=$J=#aQsp04*gb7++@C zFi{USl#!8n_2@+nqg;G~h8?IiZd3Vqe!cWMDTf zoi7Q!pw2Hf=U>ei2#O(FU5X6u`)VeANvO+n8^gyp67vTGc+6L^z33S0y;VA%reJUj z&3O&U(sjY&tr6Y}@p?hizJuh+dJN==d+UJ`$X5~X{iFSGtr{0c@g*(7!}BM`n>*gC zjNyFD7Y%yVtDmV9$#m2V7LUHK-SO3hZ|Ns@5oOZsw6C@FN_M=Y?>#(#N90FKg!tY` zdKV;7OiEVa`69UD8of-7CqPbr{JW5IkhHsMqVVrVvjl-HVP6E!?yJ3BM&tnHTBM}-oeMU2-JkOfXN@b1+KP->xL32wHupG&f^eB(B(U&detu<(+iq9PUnfoD%5Z_9SYSb9+C(tBU~ntg?f zD*}h<)9~@4p`@QCkNZ>7Bqq0t+05jc}ZbT%~R6V++(d%RRz<{TF8w2O=!wZrCV2AS3Xe zFvslg!SXY@mxLeJ6z|cW=q{tcs<@kX(~Mky8aF;PPu8$mJF9+THc>EA05mQ7@0W>n zRS0^<8JLuKe#B#S^01zv7Ms;n`*2=OSu1e#r$AM>1<+T+&lBrvgmM2!EP+U=0&TF| zDM4oGvXskGW0obaX(=r1i$SheJUXRA*^>X>7wL>;Z@f%kG{*$DZEGKw!osV_j=Ktk z5`~vusjXPZ-^~H8(hXhhl!~8r5ou_ox%YK4D6sZin2z4Pn8I{Yd~nI#sUtU$^J8BZ zw4+Y`RttvgoA|~lQ=Z>&%U2I_va~&57_{dwbidJ-jP|V?6%5eX8kmjms+b@8!88?N z=-af4JkWRslFDQ%yPo*$VMS{=1F~4+k2`TxcA|GXNG(vAdMUeLvkOnC^bUGy>d2Wp z?5=_OyIj(R$tG!dG!corJu!&$9PaK!HBBN?T!3X%^tjj%D}+g-_LBKEcQ@PJo{VEwLX^`?7i(FKc97_RN11{7j70F#n<}&9nE3C$zT~%=Th3% z{`Z&0z^lW?dwCtzwOnouiuW$XKoKNjg<)noY#6^6B8NTL80^2igN zy?@5)?rycOJca@#jWgt{YaW*2==!A$WMv@)_b%)PIkxyXi(W}I#C84jwWEkTcTj(0 zrQ+FWkfsR?ntk;Yd!Ni>{2!mvm^VCj1I5mkgcaxL(9h|zMk7>>Cp)YWlz7E8PS#i- zo6h_2^9s!Z`{ zl3^N@ct1eb(_D!aN$6*iX#rp3IJBEs_ghbklyocljOmrWU{fF4)_%gtU%dEEO&mCok#z zD{C71%S0<6Fui~IYq}w;wiSw|glP8Skgz^aSH0|5Tce)O&#RaHF-QMG1$gqgK*?0r z`GCVhyo#fKc~Pbl?`HtK#&VZR^6aGvI6n>Qds984rE1~XUX&@9zEy;3kjIf}2HMU0 zmjJ^N?RsY`_mkde9jF$J1o&(NzDixX0jH_z^-|}G#^R==p7klBh!XVI(XM>qXv%LjJ$eMj zxx1ooUvc26sSh?=Mf5bB;n_j{rqb8UCQiCL*t31B7#Vm`_s4dkb2Ws$RdVeSE%cnA zI<-U1DYWR81))fwfGgpl2pd5;eri%i1Ca-%Eg~2lutFDwnTz^)DFp?MLMWrZV1EKoR z^Q;}UV@_L+WMB^Ru9dK0L$aEqfeXLA7JcQboTy3gx7CnvAMmGU1a%s4f+B|RdeYdx zgC&c&Y*7vDc7=Vg0ZY`>gV!3HTna>dNEKRTr4tLXgso~}3rY*=w9>IwOg4JjBm zu7$-Yr6UH8+#-W$m;AG)uFiEq9Ps0WEikR8mDuEE>`A@#*0eb3`piH7Hg-&}_5%;F zh3_q9pT)g~!*b>13x{3Q_JVT?YJhKf@MOd%lp-M@lyU%ZzNEe}_UA~&g#b-WpIzp)k1Jsh04P9RbV)-pg+wLA znB7(rAi+dB>z!|E=Rc9gvrg)(e><*#9-Djz@6+tFes(npOPsLoDl`xXPZrfe<< zk5tMZoa~I{LOAr!M_iK_)gTc+pBlxGCC>e8uX*UStyNIRbg7S~94X7(DJA2u9)dCi zb8uGKpdz0X04jkDxd^w*5k}_Pq@l>Z*3}dpy|ecO7sdGM0YvRt$+@0(Uh1g zI^VQ_?adym&tk^VgOBk^NvAglNo$;McvednAD;+i^D0^H#@t-FDpId{G33p|@iCZ; z-eT<*{d!5p7C?KWwq@neX4gL^7N{?<4l{_ekSUb1l%9YX&SfnTIcbkM3^_XnTGEu! zpYXH#vCEGfPaVt~f#lQ*BL{iE=SRjkFFmgV9i6z-0De5im7cRrTJLtyxZ!2kGL{37 z@3sQi%Z3YnL&uC0u`lO}EigNzynFkj)U&^9ew*jaOt8I=z5;>GZgQC6Hl7#zum@>8 ztK-3V!bu+pYd?X?#R6FD?EA%vf&YB*RXkyzSc+#4wwR#1C4URc`Z-f(98aZA87N+h zUhT;~)5p#4@0PSaQr{X{^!i$05(&bY=_2w_)dhe57Rmwn5xO3;Zc}%Tmy(p@{fgD_ z+L{sl8{;LFXsxWcc;Nngi}3HPhQvu!n2FMkZEOgFiFW?P?KC_*WewdASxgIqVuwcd zwwVSf)ayZ9*1zfG$s8DagpG}rF9M*t~}lHsVTXBn+I5p#2&g zkKX%xWh5+PEr&!31sVq={G<03tc#@UY!zu&<;nJ-3GEK3tyx|G)}(ZPgP42(M$tF+yQynCsKUV7l5PQ29;Yxn`gqRIyq{N_bSM9n zRJ3D%x>jrPi8_MFH&X5RVDR*T#SC~;?w7UCu+MenXHTAJCnYDxCntlN(NcVT|LzVx zZ^XqJ?CtF}owM`u9#B(L|0jj`&K~c@#0Y6eaDd*7lUBgDjiIZ$%NY3Wj^vr$B=@}$ z76W4s(YA~&8uat7UXbk93QwO_z#q$)x#Z)Q<2%0w!Sv{hli&EyZ=-zi+|sS zQBe@uN#jq#@!>$r56aq+#ltRf&P^Zi$y*?PBtD)s{C^#_A2wrn%j`eIY6v z1F!Pw_&x22@ZLS}c7f{yZ|P3Wc$?+kF=TZvl|aZC6{f2cA*}ThW1RdUS_S^^y)`9) z_Kf%VGreyUdT)$IneaYKc8Np)j1EJm&u2{dWSzh-#IZ+)T~br?S~_B!WgqLUvh9ZK zI(S*M12#$os#6(FKO~HJu2S17iu}sb`KnH^Lzpz>f~}4AG-*E~ljxsleAeetmTy#- z3%(#+Rnr~VNzm}sWwh$(j8R8UH!?{K#}Uhw`}{3AuP4-2p{GZ9xLXel`=3w(9^!3p z-v#oho-z{HI%sco{`*wzR%b20q_PLNvJcj+!-y~6dgCK*mD^1-wTd)h>9OjE6V5cd zu2OKSn<^EULW`3ofD$LgjQ{Fvh`5NUW{W%j2;dIhz(3G)ja1c2R(+MOgES)uqY#M& zBNaZgS!d93$M_mSJ&gioB|}5id?K5cVz(9(V~KZ2>GsttUpO=A7gUG<^sjq#!4g zC}e&pqDt@KDTdQ|9jF(RXM zpBY_(ozkBNnEkE{;STo`RLdIM3DweA(8e%;U8>k$zRn4*wxM({L<~5kUu}9eTs*TU z&JNm|^XKz>n1ds9_VT`GpNz8%p;Kj8?0zER=O=#AOb$mpye`P9Tz+3pg!dpT=c$zg zq#+HQs&m9h@huW`-{e9du2hyroGb5q{41j8CwH9QR+USASJ%YPY)|7Rj)U3cqs~c? zdA=aLW@DL2do1RtL|zy!DDeiNrOMqALW1Pzh=DPG^wtQxb*A28$GgjLf7N^omhh|A zj6O)7wh}QW$d(K$>XmP;L)lV3@D3g)k3X|rO1^5nwLjoIP;tMCRV6LFDTA*#F@MVX zhn(FUb6$lu^vEAuM8?AhG^M%Az;#u6@FqtbtY?}-)#6z!)HzUzP5Y#WR2x94ov7=oCNuN;LeMlK(cH(!W|fAzbb|bJi>DX;8= zB)Fw5%2hT-Jw`VQC-e>LH!<^@&YxQ3o{xI@+E6FXyWkA#GEIu5vPXwG>;N&DZ=VNHwyb;ygXwn1ZpCkwdYy*kfq zr?E%Cmdt~|U6%xz)(9|I-3 zYd<4!g$C!GWD9wN0f*wnVX@0Z;0KFle9AHKUs@k6b(zJl7z!(D-|O0{WLI!+$gQ5A zvR1f_7-t>szhpG;@EbKDX_6Q7!FbjoA3Gfc{E=96WO%>(UU;>FYz1)%RObi1IbA&X z<9jRmCLqz>)fGZf*3$FTBDs%^>W< zUEn$x$DD@4ACj}Bq^AliKR7E0QenpXXNbj6&4%-Z$3PX&=&`X9w0Oc3L7}{B$dwNI z%yo2tX}oUI%u%2l-tuh5J%q)Bt&$_7d5rIsk^h(xt?-u#egpw%O}(B0sDPX+aZKYA z+_i!4cPI{(Xuqg9w|xPPFIM2fNo>;LWE~2iS(4+9p)G}DAw*hr8q$^Kc2nn7^e=x% z8uXM)d|aQ&VAT}PThESWqGU#Wc8r`EDjq1W>Qgs7B@p^J_ZqG>Rr`*fyL7!0dw%Jc zA;*~h8m+6QIU{bJF9DH;a4~61Q&qSb_hK9sQ><9FybjTYYp}kL1m44T&hBDWWp!CR z-vG0Q*Eh2h79w~xmxOhH!EBbvWb5?))?1e!_?0FY4_n}N*phqHQGA171gXgdPam1IsI zg?S&K=R_y+qbZuZi?4rJ*%5b#5Zv9up|&fE{@!r^gFi9+o-Ygh#}fG zSjkS?T0KBO&o#vFE2E5WMglc`gyGt+xePO;ztvIR+<4Obbk%RoFSIpD9%db0_?3Gg zI)m@={f<^~8$DO#g4^U6r=!{DOg^e3jTj&b<3*!xAw+n3Q(CKExXfh4sF~WT6Y1cR zONvQHjc2FJX`X5NHf!`w~XV z_T|TSfE<#&^hf5w3$ZuYeE{Xq{n)}$@dFh+VZ!8%-=9@47J->NBphvYs8-aWSdmW0 ze0sgYt1$;(4O9uT#-Vo;#+ZOT0L<$s@u@jBKzzit3?$qm^XtWz&!Bn64P)hLQR{Q9Q< zbwU-t$gfI)Z^3lJ51iCNzR$jTDyw|yl-3}MFDfsQz_@%>jwPN7_OKSxnG<+v$AzCu zXl5H&AKU)=+hTXhFO$B>-7?mSKM!x)C(uIi_tHwpE#>YrY^63FJYsG6_)h`y{JNSW zkz|g^sDOKwVszc)Vbd`V;vTcz_rS?sA@a#NScUw$VjucWH2I9k>5aQK_NL77e^#!{sTxK36-M4 zv!4C%QA$kYSOuUp*Vf;=C$J*z(hX45>Geez+Ix1j1EZbyW~v#l>c``dvcZpQ>pMSj zw**MvXGS%-jH!ubl%=1b76VqjwQxf#Ro6eXQBzn^H+iOw#TJ47#Ur%@LCwq3wO=P! z;Uf!|CmJSGBrBNF=pN=lwj9KyJF)x8ze9O_QQAJJ#T{YcLu5nQ_oU+8;nuKnRGVYa zVN(S5%Y5-+ryp>#IPu$x7cr|15(pI+NWN4^{}g+n!tl46{4Q3He|hstkrPOa>6f+M z7e7CD@;|Hh#00W-hBWiHHC)_RV>~rvVhV;Gc^ok}jkzO1TU(tZGhX?o*^Kyxpu=@J z#dA-cw^@>tzrPi?_BCwmAK|kv=oXFsVJM~b0CQcB9M|F~I?IZQD*PLN0G#yA$SJ!P zZ&V(v4>(-Q{J0GorN!gZWKE}5GWqN`(mzEue>+Ee*;v$8*yd0FzLzR1~E9@^+U2H&Rr2( z31-;({TW>M4-YmZZ74MZ$t`z2jzZqY;S9-8PmFNd?gAJE#2OffYQ4KpYAW8(%YW;;Pxq6n_Zt| z`m_imgdZe%))TjKLJfSia!h?^3LF`~@Akx3nXWJLT3Xm^3_{ z;t9PhFgUnqNXH1egR#70-O8GGBu^<6? zEz4ESbd`R(IoR2-I(V6EN-sH@k_RHjw`E{D2~-$MYO=cwTM!NQ@f@NNb`2{caXoTF z{p4)n3x2ZpjH<`@bZTz{G-9Pa-=hsFZ1+!3w{1fJAaqsLw&}id)i)tA-ZU8zKZGhj zdmzQ?>NU+71s6gfF8qanzR4IqQ?WGYr%JxW$whnCwX`8ypmcll!(Gy2K1ODA^SpG4 zJ**w)BOwR*bqgZ!3lA0OV$C}3Ku-A+>lImKGd8%p2>d5wI+Q3%db6X{?)Ru_rmm6W zbKUs~*8iV=IyKBd^=LEjPMNuiWp8W4?KkNd1^cG};gpJ7RA5`12Q^YeIVuEfbpYtr zI{DR?xm8~^Inagid?cVQ>8_2HL9sZH*l{dsr;Obxkgha8F_CB;fLd8b5Axj|XuRBHi3|H;5f#$;*ayXiB+he9&smb&YBooE5gdGQu_!MW#Yo9#J-Fk7hK& z+mKQ0h~&~l6()U-(6gZ4((LTNLZhp90GY{S?4Uruu`3B#LEGQM8PAtpuzM^w1Jk8r z%Zs%zQH_QysiFDNaGy1*47aA;hQMw^dz0LSYSBm85`=1g9C8+Sd3q9M#-O|6?BP;x z3$H3^P^e=k8oll=*o1H#`4`p!$ztgWhu<316m%<-u?sBU^`)4$(^}8H>kV!a@YT22hEEJ|u;h*j%B52m znQEEj^?w>m=J(4vR&hV{f812hE%h_W=c_OOIR^2!yp6ple*2=UF=p+NGwCvF$z;t; zo`LdtTIQg7#eF;~4?tteC12H{@WR3+uoW`u_S5J8;H#e7(he3pwNDe!qqTT9eVZD& zOW##nlTV&al$n8}Bk_C2M8`CWkpq$%(H5a>);{M6aNE^hs!V%Zgpe+L)JEZZ|GIs#BnG{{mADTX zW!tvs`S144Q5MeWdZk<_7dw!3Oh^kWc}&dgfc3NgB4xL0H(`#u(l=r&#-4R#y)Zgr zlXjzk0Ip2AlbYOxaF-d+rclT}k-#ZMc8{&02cdnP^9f@uBznnVzvZ&~E zW-^9<<|SQe(slgPVfsc&JmJGEB}J2u!*iDUA48!4SEoSo@?O5%kOp#^Qet9T!M{hW z|D)In+)|CsOk~x40T=?H%$Mzf#UvGV3j$gnKrQ3bPrt0lIjLW%g%Z@qNV;R~RIRKf z&+6X{H+_o6GUsIXeab)XY_IoRYA z_Tkp4FD8~~NjVrFO!3YBA+QCkcH^jeLX@k>$t#Xi)pwdB54^rNWYiJnA+xoB)eD7V? zO%T4u=_#12rz)VM8pTttM|AJ7%m2Rbo+hJu)qBoS*kKZpo~Ovh?_;2y*Pze5S4FuK zDJor^Ho!|?jb90}F{<3!NpLNLskp@7kyaW!qf9vdcY5SB>rdt>a_WkO$75ZG#(uPCrLtZ$VdHa>vH!xW1n<3z zM#i8UxBP}CMl4U*YKV@Ozm?fIL$C<>>(l!RX`@9EwdfmG9t!oNt_IAbbIol#+-y+g z)BoJ^4^3^Y>6dpA(tlomW&Pooes0}{6#VS3Wo+E$Asw;!fazlIbIRw!jnBx}%J1VT ze0aMU60pygwA${(JM=7|%H6j6g`pr;z_Vtx@->c7bj2XK2X;I6N&eQki&KkKG6Jm) z806FrL>@i1K?wOanEkn;QdcX#&hMUwN53%j6F%Gd+R-K|$6;4{))m36uOTgY@4-VM z?%mD&=I?>@S|Mf1BG%FA3TT@GG10L&BF)Sd7G+zNQO&C$J{~N`-7a2~_CL&ZXa==p z;o{W=t4?u{CFYG02cQG+t!zGDTTSM=>-_YCLOXrq6P3(FZ7S1Lf{yl_~B@>;R zCE1g(w6&xR8m6Y4q6O1jZ(26b+LQ5#cO2Yo;YP)e&)iC@%3!0SUuOq$e*pf{jhevZ zwA1)wj;FNeP4zPW@9ErO!=fpa&z}p~bu>2LXsaevK;Py*gCq-{z`DsiXcS8d9V`DX zXXoZz&F&H&Au?<{64y5pG~FCr=;f}Aj}oYpi|a6zlS#Qr2O4V;9V2&;GjZy ze_&>LTQq|)(02eFF7xAwj^3=h#KqFnJ7PE}^1*)%_I3XQAg{&(sqlXBTmIkryeo<@ zzrTZ-|NnB8`ucyi|NScm;r$1n{@=cRi+4vK|9`uidv{#)|2~kp!vB27uKmyM?BRcY z&vjG^&#W9a+Dqxjn5@Pww<=OR zI<9hHuM)r;P3bgd7CAk<$*@OsBy(HPmGnu|WGLw3mICixJ@_W>0I=(%OWh*X1R1jw zSwfzY+COPjTCdu_j7@EMbx%z0PIkn9SY%r|==$=X;pOEQcGSN#O3=H$|2mr+AX>b) zq{!)2Lupv=KyPaUYcl3BYFMeHci~K!L~f}su=CyJ0JU6pP7&+~gbn96|3lYbIbdpGRJ zj5)3}ZZ$m+m^;{N9$K3Pu(Oz}((agF)B0&U8Tiap`)M+QAI4Z7>`nLQy!p?DcqJUPs&HL8X<7u@MrHbArFO2q5z4BgS%07n6T3xW_3a}=J zM=gJ!8|R`ug)EfP<;d!?X~o(? zFwo}3FGksF@ug{}-IfDabst(Rjut`d!@9)UyPFFnvaTv0D2Cueb}v$HqxKxtbCeR% zFG(4N;~>dBVak5a%!ki;RbzVR&83`Mk)TkljaAQWU#lwFrafp&f~r8aCwpMQXZ{t!kHPTb zYw?oT?9%veRBVT89LLrVSjX~BI~z<~P(&FWqS|4tS$vTT(?T}eKfqmYkADgSEeifV zJrxFzJ&tYd4b3KA4ZO_MMH-eOqs^x9y<8UyUy!yQzRKbjdk@75@y8fQ3(vTW%Zxy*mQ%c-X@m$Je9!SyYU!$ zs|2^NKajePEwGhZAxEYy%Xg)rO6S3Hu>-jNn*-g|c+x8N`E(amubeZ8@VnS(%jg)QqI_x#wfm()f9%J1!;hnh>xk>j{)KB44g_sjiZSR+zv%je7#A-rAI%AD4`NmRl zZ+fxY(QrjVJ>!^h{M4h%QCk0|Z2AV(mY5LLK8k>OMkVJlOW2MQDdVu#VpK@auE{{! z!DmG8gMW=E-FlR9*>uf!kvDBJ$33U1RFJXX5PQ9oo#aLdvC!bD5eH?v?6r0ID4gzC zR722YbAIvR9$>zWjSok}{BtJguSP>jDxgUCBvbmqd41`7cFg|efag|Ou)pxD(wo%Y zBuyVTgwP-$urIgbsz;fXY57ALhq6y#O>2ybMfq}P%fi{kWGdIzbl5oLr`E+gBPD7g zxVnDa$BCE^U0Z6bWv?9;e}8BhplHP1n6=-Uy?G*g)#S4o5l0i5o^)DLuEV$mzuLo` zT6#1l+lsWL3^J~`x;E8S-x%RK=~bm-cmhOCJ5FCS8Z7xvfTmvmVYVnB6v(^a6ErpI zz1YD$+IO`W;`BOztd%LHZ$u`RQQWlK1#BhronCT^CY+1dgr4!l8UiTY*sJBLIrN z=%hDi15804K+>>i*&AufYgI>=bLvJWj$D}vjZW#SWwHxmob79Gio9z>mjxa`O?k9@ zw`IImVpON@9ta0%rWqt!bK7@Ze;)~f{&PO#3#VAL(WEawxh4W65(>CZIQtS%9#$cs zS&1e?Zg#h(sm;I0Oar6q7PERe9p6a#w z8)7u1vmvb#cBJN~;@u?bR8U+E{1#Y8)~#AYrtQ4mj()e9d(vGdJ;iVyJ;oFm43Lug zsVo1|<>52u&Ew|{N0G}Ps=vU`Z>gm$KMLHG^K(cs=9nYE!kp(Tko-ntiD>ywTI@SS z_tmb5po5LnMK9CenIcAthh(gJ1P#wbo_~?>n-IBq@-TT}#O|>lZrvl$UrUdEj})ZH#WQ+}=&C%H5RbPn2|X&AF8rnvQ|0 z-axJuHtn(19A1GkH(}va&hwjmuRY((Ph4cM8ixVj)&gWNHyL5|_RKpfN6hGPprOz4 z=eILUo)XgKgxddG>_hsOCCA4kQ-HJ*O%Fv%Je#QtB-Yep8u0_;g)j^JY$pSw5P{fv_|$vw`cw(r^@CMzSCY|qMod2<8N z>!o^K7c6T&&51BkyS1@@fu&R@sXJ!n4FUM~Y*tsa#%=@&*O-5p^ z?nt6Loe6FO^tdzjhi<`ACumMct<3`^@6Ll3!)yWQz&K7qmm%X^jBj5${QAzzvlH*` zya&gK$cr(v-t?EbJ646}aHZ}p1^gCGkJkc?>0Xyfex>C+KjHLy)1&ZwT4IavqP6qn;}4Mmx29S#>)bnq%) zn-D9)|3^0HSP$M0ZqD|y28>8KTFmr&22SR4L!e_ z5|EV~5Z`ZBXgLZINuQMbGjTJxMHVpBB2}SzE7{vaJrifBGuBMK3rOr_#R7nBwe;Xn zUfao+(8Uvqc_pjC_3&`X51Oz zGod8=#UXy^OpJz^VFp`>5k)R)+3Wj8tqt4?vQw$smE{XaFeG9Zub-1b-mk=(R( zx`mVey!+Vca(ac#?THlRHkSD{^2X9KAcuX^>Uvfw!2RHG$UKggH+jKiZ zy$ocM&BV&nGpGM3kh*7FRoTw#1R+93MZ{rOHAlB~{+z|zLCL%F^L-lOiK7h0ve)v8 zmQLqCTbLWruz|3n_7k?04>G`GK|yhwzmLnrZUm z1)K>4Ku99{SbPIJ6znV1GFYp;MbE{rJA|nf89vrCw1+`}gj?y;=JxNDOZC(50=+EL zrKXFsleyW0Z?xD$^^zFAkdX)+#?sWopV@Z=B6}G->o1Asktf1w#E%+yK z%xqk%-L1F8zAWNrK*UGP$ff_hQ6?Q-;Y2Ur@uH7|geRB37xTArHkrQ&klp0YIdm++ zY5ry;i+yNv7uHOtDFId~Mps$Xq0oPVSA!KM(SML$_n(k%qdm|KcZ%n=0r-D23>p9F zyprJ#KQmlkUQ7v#^#Mv!$?a8%2RB@Zv`u6k5t&Xzw_9pm{5IK9^wh@Fj^@cwbQv`< zq45&=-MzE{pD^)1F_T-MKhQhs^;PI9U!FuUSFRnZ#hs!xnzuzH-I)e5uLa*RoYFd( zPKHxkt865l;Geln3$}`Ns^l9g80iZMdJezhy;-U?kc!6)#jy(>GYjxDAMjlQj3d`# zqW#ZJ*vWX+wzB*r${;`W8tRTdbYf5Tr&$#r`(9{!vW>30UA{}QuMkQ4l|8{@y!$WV zq<~Y)03Yl~KNO&Qx>nV2+dX!>6Iswk5WwW~oiSa~>`u*s0f6qgRlg$x-|fPZ<*dI% zk^=i;!n@v8qo1~fOLeZ~WzCAO@q~rFxG{ChzHDT#Rc9%CO|KK5-L_7zg0A$I^a&La)ZDEz3 zwQl-dU8x)aG7Ogu;Me?KZx<1n+n$Eu*sHH{$lJu)Z4G!b&#MY#B2T>J@``!; zbB600&00_mt0SA=Dp_2;6*+xOl$n|;ypun45`4zw>8OsIzDe9I-W!A2$Ylv#G~ygX2t+LG3F9@&h(@uVG+cs@ZxKfUh;-;S|lTCk(KOGpIY zJeOwL>v2|V)e4sfunoJKo9E@4&oBBr!I*x|g=Uibk-?1>GQ@keoZWq|CU0VPRsDX` zIaCN(7f>r?PnM~w;-}y2o?GOP02rHklU-Y+*GKc%v(xL80C8z!v4?F{UQXfjyX9B` zvs_@qM_OAbxFB)25S+d?57S$GsgWniED@|zxn0l(z4GMF9F3jd5%pot9IRp0js9$n z8g7C~X@2)8u3=n{HQeXgxGo-Sa3V>c25BH?(>M2OW^@!m>6iGsZ5`)5k`11(-xmJD zmFQG?_O?@H%~MT*IJRt}F@ncC3H>!e&|pLg_PmCODgQMN0CyWfTEOgBJ7!QDfmy~bQ+e?@^)yw4-SfgKOz$T_ zI{58^2qR#Gz>My_x|9Bt4n@Amfs>O{n6syf$@tY}!Nbi!8mx(vP*7niK<9e(KhjOd1Ij)&w;M{Vp_#cp}k z_=rsWPWSU$S+)t0e)IS$sPAjMeI%?%)Wd8xG@^7tjKYr^{HDHMDRAv^eXL*bKyIx( zp0??7CbPa!lLTY4Wd9RQwz#X!%U0o+4}x}?j{asnWi}LNB>W;A0O&@vl>C;)W&c1S zy(&=k^k3jkfU|nK0mUV81y0v~SJ$qh@%AR-q((xYoQrICzcV%krj&jX)#Ss$Uu_F! z&BP0dOu5XcC9?X~=kw3#+0Yv>JUS%|&Yca5rt@!x9r&#IxijvHA9KbQFy}9Yn2y7` z;qIa*Be6)?y#zg~*^;#u*!wrl*eU^C)?AgG4+h+8YoPMA{VAx>qQy(?JCB&DOkv41 zq#EnzEmh7`lRU%JY5;GtooJ%YY|J`g3wV_qF&Y4w?G#fwOqss*g25b<1)vgHYa`Tdz!klAw_tadGXEDre5-sA4(-w3F!^2$| z+bTIEdyd93S8z>!bzK6-IQvI?_T=gqPka&WW2AnDyZq;=gI$L>@9=Z>Z0~ zfZ_!Tw75H=lmf+zyB8;TaA|ReLUDo=CqS^^Qrz7WT!I95=goaT&;7h#|6ej^CNs%Q zvd=ziuj{&gYbO*AWU@ayI_@5~8hu06>P(9&^Ygb@AOTnV{894kl+dNR-+sEEa`~cy znrLO!jb7=NXQ-NRf)d81VS3hRIub>r)cSS$cR`BK4xOseMg}$Ei9?U^{EgG2i-kNN zDZNlCm)9e$e6dCZReQNY8QzhN*92=7{M9ZquWo`h2B}02Pvz$QPSnl;*LcvSYe6L| z+;gwkDf@ZXTP6%(>xKQjd{A{`&;|7=E%W_prX-9`{)}QtmpRQ~%K62}@Z^qmr&PjX zQA6+&AiZDsrfQ1jf=_jFvz_=KgF!R!lWn;PkE8QcC_-VPFO3GegG%} zHzNgFi1s~6qq8-rOx{CQ$WvJx%{9u&Jh$wbJ)#U%$=PN#8@dVgYL%zG&9JDSa-}qE z@(ye>Tx`QgbMf`|`RD~&k@qNM&rVEW@!X(1?~L3iV}@M09oD+Q56Sqi)hgYN9xdJv z_MRCUDEZAyoaW=!9-dBMZ=WoG@C*?!{#E-G{H2@wd{g)tqA?vxtjo1p57Eh0SP2R7 zrGw0TE2E?ew?{teRvKQvKdYSp0GaJY>(XlumZTAp_}&i+fX4+3pOkLi0K6Osr2pJF z^$fWVX7FSNW80a@&YZqB!?)D&0*Mp1dLPr{I*ZhuFY3M}HU3$5TcVvQj`~0{zhL_! zY|sx~zK~rzoPj&6fFn!aah0&dVm2#-=GkB8>c3Y&Om09%Jl>m|3h=X;5dz&*9zPJW1+`B1D%XlgefxLB+h zfsrhAi$am7m0^5)*s@`=-267uTjRUAb(<-FfRy@*a;WjGO<0;NRClP0Mh8#lmMz79 z)l#L4TCS-`OSyie-@ki1-VjMgOr*6lS(v^5A>{o18mXB=sBEnpgse|{L(0yS7Bb$x zCD<<+m28pOJ2?Jm^PT1`9=X<;4aK!3@A!ArkJeV~`(X`*fjZBLK66gzM5^vea0dKN zc=9rK$3<5=ZCq!DQh**f)JIfY*!9*{VL$(lMNZ&vHZ2ejjmJOGcK|7wqZ;m*^l@w| zWgQ+C?rN~~<{@9BmPWdD{Qi_i%zEWMiiw@>)Y2&0D~TeM!&d!Yt*VpS^k^0h+JfAf zm^xn%=LG>j;0vfExc%rZ&e2NdHHs!>FId2Z@oH%%jdf)QH{M*nLcnoxoll&<7cD$I z|LH^fynM{qbn}ZD=w%*06&}T#Xs{=@9ZKAFU&+kA=qKjzoHv&Z3Jlu)%td?Gx84PZ{ zwU7cG(Fy$}{ZGaGtk=T!!P{~JP9=Bqq95pgl~gNsXX@<$oB7Y5g7$zRo*IgMx7+w3 zfl4Ed`A^HFxo?dn{qmpY8T$XMjrK}>395U>XV)iH5bvJ)&!@40;c&EvdUfPq9+dcq z-C|wi+`nq7V-b22`1#`VEh*RckNt97z<;7QF~gmpuh9ulq|L!+*SW4 z*S<*l=Rg$~UOWrdlxf+yJ?Mj)ON;YLZdp}VcTZ>kyx!TE%r7nIei2cxz&^;*T;Z}C zJ`6~8F5=ZF_p^UQ#AbYo2NUa1k)Eqse@47VYq@8(e4zf1yQioK^uz_fOJSr-J!NS8 zDQRHL*5~qh*?+lP=zn9CRv1Nr0U4L|uydxeKlo^-tw?$Gwvcy1dB!N%LxN6-2vE-V zwxU>D-gKX*Sam;_!4I%G`AtsJfT`8@nC{??LP=vPg?P~HysEWQBrm+xkVq!2hT|e_ zkD_dyu#m>t@Kxh#bJ)3GY7rr%I{9mNkpf1@aA7)c^i!fiFlFv>#)@Kxc2q zlz~=qQ9+B7M^I=f|6LZy1VuiDGgvU zZ7myG=M{IfW_Yyj1NYZAtB?_SEbv&#C}IqUsFh#*jN=HR|CZkBAK@Dc40NY;rieNM ziwve{ZJJ}Hh_PolxnvH9?kq{2iE&RHoA20j59h(P+V5Ed>ETX+t&d7eLrP-Qf992?O@9#=3Y@|H=&+OQzb~}WhTFVz>P^ri0-DNR zM988;LU#A})i(NV!9!u4q|P5QO=WK26g34FDwXbn>O$Q6lqD7u(l>|oX75(aw{33) zgM#1TuDWd)A0Fo^*)qbfwiFPXT7r~~lB-mPKYBoqEo~BdrnPNm^)PDe_D@NPjpxY36jnfUd*Zth$75RcAFO-h)>{(xd2E)yZ zOv`3Fa_Na{J$Y54+{1|z=C3@3AVKty%BC3BIdcJlx8=1}Jsk_AO6=G~hu^L|JeCh^ zgIpUsR%;V0Ah`slGB`_qO_AuCu*>$k9V@W36qry#6LPQWGtp-RAki!FBv{7|q5NS1 zmZ-^3u3&cP1XBn7-w!FUU$W3?P!=|Obst*4p?ns=H)%gUJKNj*9GX`4grhn4-c&;~ zL{5U0PTzAZrD|ZVDzm*N;CXFrej9=u60A_7MmM)7oLG5hB$}a*h9=HV&r-vT&PZB| z-eCPH+YdwC9Z@t4k@#rSlRgFDH7w#=aD5!^Gc(l_l5u>>Q)8uMRSK3hRrq$}s>e-} zo?f0)(%?+}{7U~&0r1%*n6)AX|9i61iKQ=EOtlyK8;dD=!WO8)tFnJXGon@?4#R#e%P^Cxs^L5)F7}n)xtgFQv5eygGH{7fzi+c4gg|R z8(Ts@**Y_6pJ|J$a#}~KnZL=h=PkRE#s0s0JP^H`(u(RGF@NoDu%q`3AUosNKe0D& zSbx|LfbuQ88Xc`JDQidvL{I6V$ol3ezjrq_&gG131P=-AsQ2))HvXznzv&A<&l-p0 z+baq0PJL|6TQL)fOvug4JcLxj zT7`Fs6*|g$jpmEh-SALk{VBQL+%XF`%s+a_g8l{mh!;b?*3%KCH9yogR~_%pyu$ycWauytAsMDNbv` zi6HRem~QVRq4TNk#Ek*Fi<$Ktout~0OO9bRtFvD*ZR0JAhwj|+Iw~9}L7V34Lf4>r zvW87*>sV2QGz!CSd-?K91K(1&kxK`i6{pSXV2){6poH*w6?)Q%WxZlET{dU*r3d1h z=lW~n_2NgTAi7@9#~4y4o)UzrR(QcYZnp7>%cN^XciNZt48otoRVN>t4^yucXzr6?So`{2RN4jp_@y zVK@*be|_=joT@0dY(7cYT&O79gL>b`iP{Zt`~;k#4m&-xm>tq|mI%bh1>A%k#UviV zMenvIA?XDMekr8F4BVS9ZH8qwJ7Cr~@@V>*uQ#?%)PWHkka{YZ$#LE4HEACmC|$cY z#^yx+pUW)t^&k!oj{Hn@V?)OMl{5UApN~2fJ%T!i#-1%&F>h-Uqy7#Z=|YFTZ2t>= z5!s!44h|0Azriq7rpgl{K|6vwsj7P(CB8**&giZcLJD$o<5Wypi9MN1Amn2nf)my5 zlxFpkZ%`CRZev0%_-dMJ-&Cw~$tZ=Kxl4ejZ*4(5zcrODOlQ)|QvXEuuc7I6iN!qX zmV_*mq_&PO)m=sgavoMs^EPA?!|*H#{uN)#U~J>|1uOqq)6i_1oz{A{l~8+O(< zrtE|rPMrVp5E|*z*9&e;@~|V9cl=A4q{I4iR9H8cjht8QReda#(Wtpn)s50W4Q+ou zE(O27(pK+2={&`Xby_i z&O-yv>3~dULhOe`LF$c+(oc+ z!IJosq?ov=z5Qd5wi>OxR?Z`C-mbd*O_ak@QvV#?18rMf_m@CP?F^3jK~n6E>;L;eE^Q0V5JV+-1WnPT~`<lc5V98vkxN0)h0D5b$)c_|Sp>do3kFHTbtA|~{9_Kjv%2}Rj_85`bVVPj8>^tsFm z3KnIm8q}auLL)!9D=E zil z&PZMUZv{az^b{-vmsadv=KtLex^VVM79@<>QHl+rT!pF(Un{k)m1bVVTBoAk1(W!- zgr5+$hPFoL5%?G}e@-ljogRI9)6th4@?_O!DJ8h+(T+}1m8+vD<& zln`d|M6!lFm{(1G%E%ZP6HlBx&L)T+(AQL#++N94lCHFUHIonr_Ly|(3QH)Zi)M;a zSKv$l>9F)aC!Y!^V`0k~9c~u4t$e2AA7I~zv{%PQA1=(4N#z!U1k=@hu z{D$=W48~(;HLH?Bt)IYx9qYcpN zNCr{toHD)dmut zX*$Y0CsGiec7dt*_)@_WA${_6u+gxZj9_9!okwG#d3{q!Fcw(+u1xIa#GuO%N)x}G z`5-kCl7Vco>+u&bmQOi<;#k`>k}va+4Hn|FDYj91ApQ6Fcp1RvzS}!KjXRPpc0{!b zwU9n2ax0|n+)xBH+4=~N*C26gz8gp~PYE(ZFYuOYCDzrulI>PY$}yl$tuKAx%Xxh69j`*1z-m+X69LF7l>~y zO|Zm*veu}lf_!zs)oWuHn;aEW+B+MFfLVf=N*CTp^4|lCDNx6y*Hr@Z%i^cyV|aMN z?fy`U@@8L#G5ueLRN*Xw_bcanJ%vG{$S_n!PJ4*=$C0c2N+a`{IRY(hd@819dossCzhX1hq1Ko@dEaJ1EB_9u}b_?D%)bA4*+4R7M~XLlbuhk9s}t3BSDQ510HnVJuFk0$d_{)K*SO*t$7UAnRGQU(Ef6Y!Jx#9l z{M~Vri45TvGa4=ldQY(5^V8lpuX=)R@CM0byJle2TQZs7BTweHmJs6RbXM6R@+M{E zo_^x$6q0n*41B{IRlh5i+#5R%UKb*+y#GW-=k)o5R?{QMUxPQ4>0R)`0&O9Crj`9o zuY#7+q6wAc>RA4JSj22?tGSMZh|O!9@*R)I7h=nuiW1aiEzSa^rPIgbpw?xc4Z+2z za_QDPe1lttFaTZgN41|3T%{R^gY}RYzwaC23g2A_zt8!#^mwjE4BnKHYuM}~Wqm}O z1?k1^UQX}J8lA_ zqPsQDop;UA__Auh5Oavtn9rr-kktMOFC9B;hW?r8vn8)5&~czzv9d0h%r1uN;!)<8 z0#&_=6n>K>i)lY8=c#(Wwd{n!(*1rEx7Z)K+*+&ewGLAV9_w0+LHm}cS#06LhAGk` z9gTCBXE^6T{>^(r!(5KDPF9S!e!RdWfW7a~i;kDCF6=GN`)M0ILtY^noPX-oceXZVb?qzKZfbx2UjRf0!MCbG&rpf;uzpk&2p}bFEY3YgY0sHQfpzNs(=tpY@n%=?4$lEs> z8*i40CQ=Sz+v^*477sd)?=qf$GJO3ha~$T)%O3e_ujwepHfCuqgGyUpRz{nrv^|@F zGfFh&X7;SDs$_f-cc(2Evp}!XFjmP`0l+Ng@e{1bXGu7Vm#St{T#)Id>uG&<+RrgH zVY8{s#J$%GLP?JdqvzIAc<@Rbcnwt-r_L{J@;8L=nH9jLe6#BsNflL>Ei=;Vi@PW= zByH!%k9`Q?U!L&hiRx=Zu^Ba~VGHL~oLyiQBEZ(FSr(HcH>whHh;!1jkpH{WW61#_ z9Z@kp6^Ak!emfjs$P+*gSPLN%uK3{C2~jXqY;gY6xMBL>1n@kOL*^2FOVU>wIWN$T zfj_`q=Z?mzY$xwspBta*b4F6R55EY!Y_zO3e?zhQRs7==XlKGW+*EXrizoQjZgo!@4H-?arlXn^jHnRKPi7EDn%`>Z{l}^ z9a4?Ft$j~Gsn>Jdt%!F<`1hj?CZVrtU%c3`Y4QmTmHor$)keW1$_u~A7=PY_Lnw(@ z)-H0-d$P3aW<#4rzb-*Sapq)zQGfPgkz`k7VdC@D{Y=e3`ADmgwdKj0SX5B%K0+!3 z5bA2|hx~}Q8s}iuQwL%401bOyyFI6e4@vouT2vZ$>z&W`aP+da`JET@NF?$|{paTVRUZy(RKKVtcJj1BD*z+m; zPRj!i7uuQ=O%`uwAztGtHIfZuQlYr>;`m*?osh0ddJ52#G4%^YVQ1{b)>_J1W`-5h zoPx_yYowiGPEE1sohgMwxfrP7P9?5}WktHcd;W}m*HESVhlSmj#@Q^cTyXz|MT^Ha zUE~6qlD7myAswBZ3ch0LTlJ7nSgdBOM~U12RBiM<1x(}|QuuEX+pfc?#R_&EY`k~) zQg`Mgn$6r&Zy%Ymt>P{Qu5k7mz(;2SqIOo#h^r{r!V;7FVPRB8u?sD7AT)Xs0omXKS$- z$uhn=krh!xuht@-SE45zK}{aa0s2w%&}x(qXS?>@S3q>tXG{W7^3E86G8oHT>z_h? z)sBlAV~P!@h$j!fqHLV2=t#vRjCrre`s?3=W@neh|A|GW0WVhD^C&;^>VLMg$r0Y5 zz@E0#jXfg1+zFU}?lFr4yeEI9kgkl~IoqcUZxTXLrWNnYFw}RBdI&5)^Mf$F?%pBn}5w z$9zgkke4#1k+iO7y5Mucb>tK^;3-jccNQ&mIK+7`z!F#ZOstscSWqW6M4?t$kCZ}I z4eI(t_zob(cwnUCQNK)1jqk-(t_EKL`zeW(Rr+XG!R}rb}!s4*&E) zT*PM@76J@CgKtr-dWid3w+e!QDnc6IBgYCZ)gItU1=(`A$g@wOer$W`9Ww|5up-$b zn$93jvZ#E&p?|s&nq&>z4 zwdxuj13m*-vDGZxTI@>c_&H$bG>y3VV0-wrzoIZ~%_M*Pf@IzH=D${O=h6l{A;zi4 zwU4WazJl^KgFz$e-2$LKU<`08gU&P#d@SNq(f8Z&(lLRs=COp$B5K;aGqrYRr z>Fp&ZQ~35KC}ecRw%}qhccyY!X$&`ds)WlFe&X9`eSy($5|T2U+w?Fk!G>ikdq*b? ze3;sAjc+Oj5GPn?cN=>A81oJ@(+71_aj|_$l8UB`oz&B_>0_`cwTN*@i=W-9olc84r1Bc?zfF<%p^)6r7uiXj*C}nXnw4i zXdUsk`mA=oYMqvzyRZ*fIdPpR9{?HPRh?9G9Gzdn?ePJHvzZu7;_^c2-3GLK`edCt3$ z2kdmBLkmss&2hua4G7u!(ZjkD=4WrBDf84-(ettKvL_1$-av+0$bFoO% z$;)sA`HB)55@N0@@F9@y#O+09hQe-#(gZsSJL85vo-9E4b!Joi^BS+@`suHYkRA@M zcK_nN6AzOz$_s!{sN#?~#$I^%1D;{%y^fe~S~GSN9jWuocPi?g&p@Q_qL(l6i5rQE z`d-(T=8e(aoHw!gch!?wU6!{zk!gb(aomSiR6FS-WnB=hazxO|1!1jsM`Tk$-r-(n?$eVtq$?ztvHq zeFr#L8qdGN`9X^;aa>zVcvuVi$^P3$R^ape}I&v|hCr-jucx~qsC1!j}LtU*ro_?b2f=S_YbSIAk z=4O=h7Nnfi83rtD8I~ZpgiU{T?y`iRW0%z5pV*`X;|VVEo0Rc5{2=ZM$qqdL^awnbx+VR@2@C zWa^TclWPICp>#c^o{lD1vD?zu9fRmoUR~icE|x)hwA_COHp%;5nJ_?oAyV_)=poh4 z+4>Ryv~#7xc7f{LLc@edzhi%R{l;s}Zgh=eMcM_#*`=-iJ5kGYb1f{B&;F;}8&TnH z4hSS$2oiW2{6VPNW+zVg3C!$U&*x*@5p_F~vgT53aV$y~>yA%0ghJJh8dDXV8z@6% zsftCg>ooCJ%=g&eu*^MrP8R}a`v%Ho0lD;DpSnM8KR%ZF{fPevw9=sOGNZTEZV4X| zQ#&(=mC%;NuhC$2Z61ClO``e8d3-KTr{wc1I~Ru;}X7E*K6hA`ydw&prmG-sl7(Dtf00>VQ#<_BB_Hr^N)@JsyfvO;gd$G8}?USstk zqDw4Ge+i!!xlg^Xtj{L7sKJt`;0Fr7)jm8S8*DG0gYjn`uVMZW!il@6uvDZB86=3e zB=1O0CLYP+o>`d_`Y~M=akU2_dJ_VqCFOnbK&k(rjWnj*Jv=Qn z9;h6u14Vp~-B}NLqRnA%&q;}m{o3pU@|zwhh(OW(S}@0rht4$%Ukq|R1h5QJKN45H z%axjMx3xz{jY`>8Zo?D(L?2>ansd}gnAn_ zlHv1lOBcAkf8R~W-~9BPYX6C(`*K!Q8~-5gK)(qNPPm{Bs_n4xdO{N9&dNIFbswEu zfc&Oo5v=s($>W^IYC=j0!vxfBqGuqY^#rX~+)a#k{*+@W!F`m^P;b7(LYP;^%HHH5 z<1~w)V-j1EnnD*tr)C> z!+rdru#(>VE8}&yd(oJquny=fkBK#4^3jxI&AG)X*vHBY_;a|Q05`m^ROQN}{^jVg z@1>M_0pIh^bu zfO@!C_WhR-AyZQ;>2Egn#VRqe>S|JsV3M^1>QCgT{5|KUbPf2Dr`~O|U&DvkX5~0k_A=GRg6i-*o{_JYm zFNrgtZo_6a!6G`RfVn2gP)jvbbsbG%u)p%yr%f!=?jSo;MUu2B}@-e-Th_~LDAp<}E z{aK{7;l4@7`1@x#O+QSRGmAqn1(^lZEQ1H0QuEg{?ODIF*>#-G z-sOLb>3wRiEL@uVcR6F0*E49SRhIHimpUlA%WP2V?~b62Kp~;&Zn>+w-lgP|)mPg8 zmDi(Oq50rY*43epMS8Fud11J-4JUSG+cjby?o z7mC&k`5**p8C8sb;TN*dH18r*`!)gX<@OqNKIq@Op$B?%UI`iA_g5OU!}*rptK6 zznv@9Ew)HhpBiT6(C7n>&=o?z^T+VVo+z4M(1Ioz9mubFr-MV>+l=|rao;cJSw-^# zS|i;DHEW`FEI!dAK`u@i&*xmf=;a=m{12at*MV`&4t+@Z$YR@Iud5R?V8Dyk&pF(> zvEp{yN!^;s=6(&g3Xn7luQZ3e8h)S!ea@%>Z-^De&uf7`@2^OQ82dgudWgVY=w2LN zcrCpAt@+1uSL&+0J#oBG>1n^{j>xqEt;9Ft#dMpi(o11U#rOhw&GoyFFl1QJqs_qG z)|eP<-zd9Rn_2GUpQZ=vD`Nh@<5S3#H2tRZ$A{exV>x#XX#$p;t2J+zC>7MrU{?P& zl#h7O;V?jdZNd`_HZOSItwHtvSkScZ&+0SSFYx(;Vi8$_cE=)Rh|IhBN74|Ie zT0Y`#6oe)zkp`AfJhRR`5g`14ZhsSktJ(+`ztIW4@l3#mWk2H#0Vktr;VdY(g+ zN7#|Tyh1Whd7lV!+a#w85eow^PY%0hj$xF7gJrXTTWJ)DmK$}-w4ISq z@%UsRK4MK(#??vJH8VK1Qeo7ShwjKJqH5Ki%dK<9VE=exksbuDO3}BThKceXcbm^I zHVeLPT(F4kv2w#O^GDRb^M=`2q}PDqmuF1TWRWHF4V&)d9DBtaysJ$K+Dc_vEf6A` z>D?~Q5^{-dy`@R4-}@G07gZ?*@E_JwSn@t7^9BK{B@d55pMAqZ27=ny7x2z%6X?!6 zHko4MB^1@XP_{7DQDdJou;Yg@QC!6FiS|*#MwlhAYW+W<4QD#g5`Eg z9Jw!PLqQ6H$riZA76B(y;u|cmv7I9h?dJFvtKKG|=;jWKrm3iH$XR6!ZkU}n*({Wl zRndhEjx_*_pip_MR!cjveZOEo+ok_au$38y`78bdI%4}-oF0@V$KK6IQhppn!DQZ) ziCVsJ1A#r|gk3dzzlvLI$Io5V6E>j8#qT?$ggaf%h)|PRY!D=7BnM7<6Z49)%=*0h zEp4zpGM3lMAwijQ^<>O+@A-X|IplI>n2M3l_AI59TuBu98G6I6MBR$_XR?~zPjtJ^ zYT|Ypv&G%>>6|3%MTp>rjB{G+(!3?PaN_fLPlxLWr&N^t#U36$L}ag`fn_Azz0s2@ zMI>W3bl`lPjHXkpbBPE0hkze)Ymeet_$gyAVujkWpDY#~fyxsw=;~?y6Rj z(T7^vZ5uUv@%r$|$@CvUR@_^DeK5-p|3B=vl$IxVxdOeB8rfWrT-+lXx^0j&&V*M(1}X zJ8cJThsKbE0DMA}YBgU#6o;{d=uggjtezOYjPhIaG@w2aP}cx9_&E3%QwcQPoxXyxZjxxhzg>+)lEOWbLRC z(!fl%FM(dB9LPA2&gcx)0*(*GKRd7F!q{DDO5&r{l>mL7CmDL2ChtU>;;*iQK(l&d z*dZlPy#;_+GQhI$*6f6$L`*(36)Q&R94So@M)rmd{yKMSn zPX!7T=<&8+QMR&V43rpJaNHqG$};YG=$b*r3j)0jhT}(>v*ZJmOI&x&yqA%w{pIHx z?^%|_!$I$8Fr#d}Hzr*>q8ifmZ4DEDia%{SAIyjWLesWL){2CHjBp0IfY-w<%GLHz zfbPRR{s1I+S*I{>fbOHLZQ_o~>6m7b*BBr$4kB}H<0yN&V+D6o;HeNsd)?^{vy2q8XNkm}l zWg%pvYP%)uDzJd>mFzQ_dA`WY;^U6Dq-!`b$=N)$Sp_S?&k~6EqsNG))ch0h5`Xt{ zSCe2xB5fGN;(JS~p^d+a46FD8r$i!>G*)^4U|*loH=Qg60sQ!Y zxN9oE`~Ysa5M9LLSs0u8kq0B??P5iw=@8uBl5+D;zU1|$kf4>-zV72l*^<3+;$i0*UwN5zfheWoTML0(vt9CzqjNBYNqinT8HnaE6pMu*vdxk0^xx4V?* zJ$)D{j@PtdwA8gn!{XENz=_z zR%mpylIAz^g#-*JPYZ<`HNtCg;BL+Io&D?9mfF{~M>8Cgt&x*)ID_e*p8)`v;<{u2rQP4|6T;Pw_jL`CYU($9>`44L#iG zlj%?t(iqs0Aa&ULfK_|mcCED7$nK1Wo!u9jI%D)2Rle|hPHqA}H}5QD4g+1RjfN}r zDSphJ=SH_VD+?}m(?Wr$scOqoGAr4^O$SMfeef$e#uID30m36)Yl^3NaI>;|Jg`7C z1iBw(6GeZw?-v{`p;*2Oo=fR@L4EkmNSoVFCWDhmnXYqn7Hu{e}Mo=2sp9eodb1$4*Wyx*+mw~YM zbqH6?)c1*hTN$e=gJJ28ZcvQk)X6|VZe9(o&w-9_dJEA1;b&qy}Z9fd-_u|JA*IZnPeQa9g1_l-4TjwDkev$WY9d)_4W~Z z;gv)7^GK$^$bt(Iulk|*tO!a4d@|&}Jgr#V5I=b*nB*w>+rs-Hx;OL1`rQ z+h~c!SNl|+!p5jp`tw}( z@`n2&UHb#FJA#Y(vY1yi&Q3j0s;;@8-xBBZEf;grg#z{SaMBg;;{v`HW2{XBA(xKZ zm@U?Jk1MgI9R0rGXL?h$>w9QsPGY^m!g{f;D<@rw?;vBVJROkFXY`kZPCacaoU<%ag4t`$$9r0Xl1~v3SYvC? zQd8*(CB^g!aoDKS@}KhM6z0)-%3@PjnYd=5E>z`70L>Ww&9AAdZ7UT+o@woAXhV)o zU_MI}5avK7KLZ8kp18G>%+L7v#GyF(&%H@`aaw(!X!Z9?m zbEGf6yKJYCzEU#VI%*w!)_AmTYIk`DtrR=461vWqO%iVvw$s@qlrDI^q#h-#Rc(g( zoN$k0=%X@nI+63@Y$g4*seqPgvlCXUo(KLx&oz~p#$((Cc@LpJt+W@bT>n4^?_UYw zdD@)i0GtwqPMMsbHiZQ(WzqfC!W2qAC8qkUyt6snKA+J91l{5#R3UWcUW0LzuO?Y# zcD69@bT)PP*e30vEIWH;@>ZP;_4*0{F|&ciE90I)VYtyljPzK{0Xn*SeKII@ZR^4E z@^Zix2JpQ6t4CRxq;_kn?4ju1n@B;YygP%#I6gz)E2AM`dLG@qfQ}#8WyR z{ddPBe{apDrOK1n5>kW2h@lJwd-=R-~%#o zC1z}YtV=|gEB2jzU|ry(MdxBv*77?F|C{lFGhf$&&$bbTsy+eqNFhi(0u%R)6e1|m zC|-2kxAs+;{n0?N-^>-G7a-;V^(@EmDx5}K{noulH$5p>NR|As@z#1|OmQ1u0r;aW zzX*SHzmJpE>koc;W%akr4mgr8E8hAs6%t)^Ctok0Qx#K*sVD>e+JHY+w4~)`(6AscN^{QbCmTd#fn#gzZiGD)-(bWeB8I;y87T2n3wzruNr)`J@&_ zD*Js$ieqDo=vB=XNxi{k)_;zJqeAJx|BMXnmu7E?ckx9Xozl*h$JMdUsab0Z(l>V` zIhUDz-PIn~+Ny9n%k5yzRStQ@1r@PP zkNdu>pXQj}k0b&8}XkXRI^Y?m5 zU2SSaF2zD-DaeE3;u6+f`D(#MJ7F-|1G;lLJ#O7oyM1W|Xkjhwa1@@9D7tSykZPwr z`~V&r-)q2yB;g3%)b6zvhP198VIpmndcUAUfc*b>Y~nbVv!v=>tVMd3*8}4RDsCiL zD;%A=7kQGA14FHYCR^h@&j|?fffx5p6DycFey&hDh%W@E9_X<95$~;A%NOXhHD$mIr`g>={y?#kZJOy#md6c6dSAfIIe%&E z1>J_8n2;W*scG_gX0skGJ=@DYXT9Ouf}U|UJ<5VRzm3EW@?;Y-7rx|Z)#iF!QD{pV zic#Pwlg2tlkx-e(_6c2s9|9@ z^i`q|mE!RsR$8*FW`RP{yWX+zG?wMw?`f>`BCya{H}6#6B$gK6LmB*sDR3q1wmsz* zK7n4TPMOmRz`xDh=$AWkjg>p^l5N=VW9c;bk671V=qdv)L&#H$*#l3v%jf%aF{d?g zOm`2qwtn0Io?PVF@M%JidHwqv;+dLw@ZeutgfFl%dEPxfsR3iV3-Y=ylc*!Xd0V@nv7kc;kts0YXRmOB&ir5&5H?XkIkCQTFE9qCKGhMNB>wR2}%P zMt7f~4n&>rTc0r7!!W@o9n~quF|Jm#UwcphhTmf{D$t8X0!&>GZ+rJ6?=3Gij3DUKI?$iv@X65_a%vPcvfDPaCx>-s@ z(qhj=-nl+#1c+IZ3@^3HjPm|be^k%fZ*h6&mT2|RnEZdYMNiB@QS^ZwUPkU_(v9c% zep?D-Dav*!s#OfB=*>@sNU{LfDYBwC3^Fb-`eM%QiZvflii-fojTzd79Y%!#>FP%R zT1^lVdBmA7GCl^!I*C^O~CJz4L^v z=2t5psIGRUKBKM9jz{Tx^(U>4F-s(95`diZyRV@W6T^ZHE~o9?QlBUP%MWPk5YpU_ zMSkxD($~L{joGz0pZ2*l;HPr?U)k)z2F*V16w|UgwJu2%9ru?ns%7~NGF{e3jbW(D)-o7#>!y) zpGo4sU~y6eTvlafWVv2*(F_S+f6aZFsZ1NOm@1>^$Qo3H(7wH*jT-@PDM45kP5a&a zNdNJ0T>5?am*w1PmaPFQSxb31nz0o*=m}x0*osQ&Oqx_qt^wy|veIs_Kf`z%aq<7L z_trsehEbm=6-x0IDNb4_Zp9tiQoLw@;1qW&?zC9(;zfhILxM|-6?b>n5Hv`TP1|q3 z{buLRox68-|J&z}@P3%hWXa-r{99C{6!XFSCE}-&R^oTbU(yw8g6E3Cbx`q) z*G}ux%@^zBpCSE+ULQBhC>mFs^Bbfi$x3fs=$(?_Su(d|oE8MYp6<`iT~0Q~tzb@A zTBbKkO~&kpvr|+r$akfMB?*)1$K1`f#Mavbo1g?};L~z2UxNO-a#F0RqoGsr=LTk- zZGIu+W~n6NA#k%HQzhti&iMJqCMe0f@}dE6hv!4Ux$5IGfDHc(_Xc!3dE{qWAg}cd zggX^${_`3??A`Kz#EL^yr?+N#<+9%537rYzfvRryYAA1`4-2x*Ru>NSO>yA1%YR2TN_y)c}L0%UgK|tjtE^ z5rU=jsuIX!W?O?t;nRRM2VW6`y0@*HXmhv zEql_XAlPA=1-a|c!5gt(Y(CWwu7+kteeFoSJYI*-=x=o>s}BXUv0Pf(a$Ox`dpLr* z^+FWiY)*HO{4Gm*{2BdErQ0!xS<%?KnI%iDNgqrJYSN*FKg4JBVrHzklr-H z&Z;>p3=B?%92>}CaT+nYguuvW79t(js9MLOmA5(43{RrM^U^&itO&rL6b#uT%jQ0v zN)UAMrVG^WzT_ml{$6Ls9lE5kVg6&>%pYBrg`e9ELCw0Jlv(kSfpg1HDrB~XtKbnx zR5WqM0z=hyefO;EdfC*ru+OaHW_Lg(=W6#jk+iQkb@}+y4rIMPyG=MjdO@)AoD5;I zAcs-vaJ<*P64OCOpc&bqF|_6_*F1Uo;YJ(kMmDtJxcFD}x?Z845Ktmnp{A#x9zcjd zXejtm+&n#FT9rB18YAjC9&#!PZM@^m51gzy$N*K=igi>&AQMwsIW<*1-I*;bQAu8+ zJX0!wk#H4WrE1>s^oUv(Qa>GYzLsYHK{CS)@j{a8QQlYgH2o?{c*v*i4`Gy&jws$G08wa3Cz$Td0b zAD&8=VTbo)ANx%OOV(Urf|JPdz=7me-~BU6Z`_L;_a7m2cz@snZY)1z|Ks52il2sshGX;Jq_%jD)`6)u(Nx0o z?y*PHDiOJi@~@r&ZMTW|uAf@VRVzHEA4`Ebm(+J3<`QCJ^Ngr^`s+)nuGuu8T(inqZ z_aG(F4HxliN%eMX$3)IL4?A{;@O-OUGvF5=7<@!}yK)<05AL81$e!G3k`uqu(_oM~x}L79z8#FopI)-3 z?0%g9m)%q|rCb_~g$zgKc1(g*HnRG*oDT*qXb7lZ31m}&L~gLD415#s@~<0>4758h zhH*ff&B>QgpB+F>U&FoiwVS=XdsD{8E3>Eg3oqkP@hFs83qV2Yyvsp^mz1!eOjO-} zcJsYM*^nZQQ;DA{hW+WQp?AXDJ7c5R6ci2NpueMeuodq6i2p0x ze<1!JZRdzNyS`jbd>9NgsOwzWP_V$TrrfYWxv41i_Zw9HM`+ly6c+>w#x3>TGCOus zC-DE;oABRk|Mh17`)3FIhs|9BwEwk5H>TtfK@;jks#+@fcU&FX6`*@QtG2NjnNzxXU5e-BCDt7_@A?+M$z9tySspiTlNm3FLw5~%LKeTp~QQscP z6hfM5v%bZ~R5s8Hsw#b!jzvJK`|v5*9VwLB@DCH--#q_Y5^q&Vf7(v3@3$^VDcw9s zn3FRKKJTWW4YKT-x$?@X7&M2~fsguMc;z>{ic_UshMT;(Z@`~XCGB?MSbT4dOoW$h z^{z}G=|aC_Ho#9W*D=V%Pkp33onm-xG14pe@kk&E%>NS;kCVomf>x&x%*BN3Z|Wvi zshq31|F>1iEC5h?Jv zR@(eDN%GO3gLNz}rC1VFAJ~WOBs-h_;UZNko8_bN{gRC*&XMiiih3Nl9vr`*TD+$o zB19kjmDfvI?-2sNpy+M<^tr3L2^D+C+~C(aZF$P(0EbDtd$#^hASuzMJAHS}4Z=F! zWYzQPGGoRV*sTDkMTOKDu!f0uN=2U7!$Z0XVJWHRPvLrvMKJZ+a2)c;H&}>Soq=}W z0X?cL70yx4Ld#&upO+_HC6bYE3PZth^Q1Mowd*avb@6x*f}mcp;GOY!Oh7cDs}aY= zO>CW)vcw$uLESX=0I{5gOLEmMc1&kD>e(>>I*ONPozR1iN^jLScTl z6DmswQD&pq2(eWeJN7Y@vrg?v;h|`BJCcZgMuN)Ik)=DmIhWilUbYWaY^pFoe@I>% zeg}#1BSstfvb#)fEJ*B9-1TNA+YSHcuf8XL4lb%E>(5c(f)H&{zuK*2ctj6ja51AN z3k_l1+Yb*hP2anzFx~)JoIpEm9hw|zeKGX)yI_;U!^f~AZVPor;d*Z2# z19I6s2T~axXHwS?A(f_I6Liciu8?0JrG)aU4^!)|%$5|#N?e>9eNnKX+E372k5+dq z;}u|oOL-Kd{2D7_TZCfG;!na4YzJ=O(gO=csEHl#aNG;=U9DeKbGqPP!9}FKfBJd! zyFUWB&GduTadT~N68Z1q`iKo$2L+}B2J|W)$uCn!AQlF6#(h8Os8B_oUp{VLkZpoxjT6ocMSfOvao1x20?t*i7VUu05 zymHOaShJbLbV<|M1=P|QP$8x)Re8Wv6YPognVWN(y3gsL+b=RX*^<3I_z7_{@Lf@G zF>{zYd30mSDV_`&wz@wHZ)EdHoI&0BvC4xA@`HJ(%1?22Wv%db!|){ammCaq3g|Ox zZ`gnDQ-WYbF+`vlqE2Cr(yr#ieo?ZUT>VWckm_v?rt$HAK956`cSImtSD;e}{!(YN2p17>ymCiWCr`orGpVka6cy}ndw;_0L)0lh3 zD0?{Cs8)+pf9b^MrsaxolzUw>bxUuY_NGU33LA=Ccx9BGZJJO+41cv57}=;Xffs$n z`|HlL_jk9bOIXZ?o8ieVOJ6YotcD*7VPsRuJsM4+Hd@yl)roE0ksO2ONFu<%_MrLI zly>8iK=R01BKUA-X4XZ$BHrbW?70y-* zlKz>aGd-N@JZsvA<1@Tc=AibrstLmw`Iz>!EIeERP96x%C3~@{J~2IA*d8A_wG0wx z@N9{kyH|Uh3C+(q>9b-T7<6#1?m2nLe$Sy0ZNB)m!A6d4V`ML2A`n9Rt0(Grl_+EL zDM-jhyY#D{ZYEXpb0pCskUuRADg+K3q>z0T_^#D_{~LwE&klU}%-dmuWe{v3^h`LZ zY^%_oB<;3kXv}hItl)dBT7Vk|+tVy`!8VhEEPT+i;7z=s{2jY_Va^}hPxc3gD(M4T zLLO4pC!In*`Gb z&o&b+Fl@q3e|N@w!{QwSWhFZ8{%$`4HkFn;!xq!=%5FyHg-4hte&1w!*6KtI4n#rAQKbhhRpB|3@&I+1d z(a7BM$G3g|(6LU~G_`h5x@|zcwD(voC-6Z;OEFu+yhhE^7#6qQ8_vVX1ODsvz3s@H zfW*v45}xMVw4izV7dxyHmSv0LnNpjzD^g28AqN+!?QFMR&sU4}s}DQbe4GU1MUwap z%CZK3BT1)yx!_PqRAr-X!Q2B1^Uu{>RlGB6Ca`aLL1bI`jA;2KXtmf6Y8f6+q)t1Y zSv>blN4I+-JuoorWkETN$Vo1~wQ#cfc=hez9k9W%bjnhHFb-eSL51vQ$E(9+lI!*z zGz+JV`%L7;1pQOJ9u5HUn?lB(KNfSC{?E*$AZ^+_%zaHDsUr9=pPGr!SEX}< zPWij*58CvHPZ7N@nFLddsaHvd$R0bq%1#xp@fG^L#z9y~#fQ!>EV}h#$i2`_N6$q( zI{ldQ0iDU#mWr-wnI|#EOv^GwTb9O-vmy#eRmEA2ZB6B!R`>JC2X%rO^c9SCOpzYd zOp(T3UJ3aJ7bVjubQHtT&85dG) zIEnB=OR$r4E_y1I-Ox!J<5y1hkrU_IrvwEJ#phBv+O4kQIcsI{xh0tpY2CP4$}xpXPSK(xn> zEJ>AfJQXr87o~Bt?Y&SFgD}UrY=>DY^6V`{F-z)V4b^^jJPZ@aL#}(KZ(J0u6Mm2jhF(wMOwohJ&2kkDHq71rsD1sD50Yp)L7t zu^nn16Km{!fS_PsIj7jtDtFwMe2&q%dhiS6!(GT9W`~xhcIaGvxnU4N^J25eg#XOB zkK9N`+ONMYq^b`Z@!g4B5PwrBDJRd2$G&|Ef*xzVduX;=cls%wmM;+xhibjEMM=@n zJ`ndsH$mw)p^SWHmm0a#kz<~?`Nu^(UcLre@(kG(JJJ`m9GBNoI+sg&N}ZXq5fm@1 zQ)=O*ta=vHZ4|Kew$;V0T4v7id<1PV@Igh3FF+Vyq!Zr_k$LOSxODF(0&DdOM61ws z-KSs@&>XBhen5&diPHk5S{?xR2LR2AfIi&1*P`74+6Ax9CqBX)@OJvzt&N$qc;nob z7&pT7muzM$718DT7>8}-d!Sa)bZje;$&1OTl%Zp2y@2q_&L_XIy!(P`wJ#4y3i4SV zD~h~6G7=cz;9gIj7!CMJeCi?G8{i5@)6btGPv#T_oPlzi1T|wJkOyoeGfqcy!-9#Vqciu9sI%6J}GnvLbB(&N|rYS zh(bH};kZ6v;TY@dvIM~_yyIpFdkFi_R(DM;=nwf1kN`zyhuvIgYRdx-CH^!URwkfj zon0SYUn4fm+V%9hpZVGBuH_T2{3BS0LEJ))_~^ArH6f_V*^h^xXPM!XR!ZN23+`DJ zPW!N(pcBc^mW;w<`0|Vt1Q(7PUHRNo$lh>>0bBM0@YZ@72f>jnVV5BYq!+yXB7}uH zX@26UNpOx#nsd*%&NvTMbF>)P!=~5AEqSKvC!Za{zk>HaA|`aLCYrR(XIF^2 zEB!qdqm;^S+ytI}ReTZ09 zV&z-wQno>b2WZ#mqd5r$MO&1Q(-@kZCJ`@Jx;2cZ>(a{e4z^=6by0WsX z%O015{@vhn+5I~DN(qi929wh0?B=I(U&W_=#gkPIrDgTOKl{3_%$ZVS_F8mgZ7!I{ zyFb*rUw^}+C{S*UJnUGaMaOCUObQbvkOg@(Tn2HUrR?v*iQ3DF#Vf^IVt<+mYgKwb zGTquD+GAlVDSG8*Fm#OOA7KBiG217enCSDTX67oYpeFXR6Do_ExLeb14MajGdF)`Fqr0yli~N@P_V&WBDs z+O=G|v~LIE$-meAkgMd*BD}s-7^y-K21koQ^*9|TKIj7~GLgLtLK8trg!$(UOM+T> zpaF8ctT!AlrzOP?KLH&- z>>8U$=jX3mVZHSOI%Mu*eUV~k2hF))b!nJ)_Vow&U$>CTTNm+?Kiv~bdl2WDGM6G- z{;Kvwgtu^KG=8f23qb(xR3x1msURKNihn^kA=E06npl&?$x0$ZJF8(z3qSJZw;JcD z+mPe4nwZ>!>qO!5`F9~bFHRlmY9_l9D>bq%8-+hv!h`FwV&+af8QHQHnhA3bGXjfD ztE<(&w7mdW)x8ngpHfY$OEIYP8uc}L9Kdf!%bybk$Ll%K)p_LNWc5b-$?Dda8UqJ_ zB8{1)sOaiHm_olTp8EZ7yocH8v?h9=Uz94d3y>81)4wb{W3P`KhdTY^MPpC*;~(rb z;dLjbxeWsqiR0|_e@Jp)LNfIbIY9x6)M2+tt}K4bh-q;7-&ZV*6(z#9i}j^gP!>@ zm2m*5cB50{vMdqz+?C49W2^6|1JONZsZuS}}^tUVO`cE2J0+zI;m;N~0WBjNGJ zVFBu^&QK;o9kH4Tbbk2TLibeJ^@{a$;v(~2H&Xnzsc^QqM!w0sX-4Wak4)1bOxP@D zEZa9rif^gpTlQ}1ptV-9fdoR~EdIKj1m=#;P|u}a zNJClqQ)Bta z1uD#r8p-uVFcT}Bh6xBk>aj8{wQS7>s;jNWS*U&I9%r$gzEL)q;}U1ndR641@a1t! zIJSl)G24lFUWDrl(tbHc_US46XzA}P1<-Qz*`oNIguy2zDSIzGc*_b<*h-d*E_o*A z7N=i%98Zpfufl?#l(lY7dUcO8>dl-$))R z+x5RPy!8Ln4^@6ZRn`+#nFF!T?_z2%YES?yGKN-sc`kgHf$mx2;AgrLyn;-Y@oWB| z?<9ELIIdK31*H7i=oG&fQlq`5@h-_OJNi!X;u5t&r1u>b&QZ_uOtfT8h#0$7*^+1W zX*N+l#Hj2OJ?{1))zH0D;aos{*`Td|dF)!Li7Qo6=TGjy9}XA&JMyg`C)qGl#b-4j zY9OtTiYlB>reEqR>`y?gna`K*+#6dmH{a`Yt13aXc)kO~iyw)iAcK>h zTS5ctU)K@_dWdjunNeSRKOi&h(I5VF=Tvb#SRve7A?9QS3uI+tud*a_`P$|*Dze2k zCu>j37rcwa$)J5 zec{H<{45!t$Gg8g3fJFm1-Ra1@hQ#&087V1f`}e4BmiGpX=SP>V{_IVyeSTE{Z(R6 z`dVz=CbCiJiElz`-2P?BkY4e;)$O$FmvS{qJL4c@>7^c(JP>+Wm2X9?yi5U=(SiV zB~(}C3W);wdMA~1T!FWVpD7v}vom4#PC&x*`Ho-ay{dF^!{VLPYgZmzeROrUKlu*g z7{FmjabXTw%Yc)7_S0lbkfd<8{KX=oG14AgVG!DHnFO-k!=@m+o8!_4zn3jcCCp@seQ_vejCpSo z3=7ti4phey*049WH=}8kY|Gl8O|0yrJh95m;)#0Hbxyh1`omN&fNW|iZBe{?RnS); z3yK@RMQL=AU-mlbYr6EyMbEA^W%A)*wx&0@?HGtpY9Jleq%z>X;QOHkt@<;VqJ4pp zYOK|f21B23V&3a6+gFEg6D=Q)3g-h_=ARfEC(GX~_-J14&NT3&qXx>}r3a7jPe3Ju zihGsjy7FNd0@`J!(~n9P6+Cv6hK(90Nz1M6<@=@@Y!oF}UVq`V4XqMtFTWJ+Oa>W| z?FJ36Km~a7Av1idI8EiE8q$c$mWd>Nzmr(dD|U?MkL>83*4;`)c6!-F-z)moK;zSL z7j5QJBCZA22^OL<^d8C>6#Hb1F@eAgA;GUcQhn-AoW-bu?R8~LHp%`L4eOs;K4Ls> zUmAEAeT29a{M1O~Yv;|I-XyhRTfnb(2hvI#$RK9Yd`u>@ocb}qiaR?yyHG~e!$f`U z*<2*GZO74Ad9+wjnJTzPR#b3mnfpb4Y(`9&f*Bj3u0^-%6rNS|)u~E)q zOU8N;V~kS`c;47-((kC2oy?^@&JXd^{R>x_T#xUN0Il5mp7Y{l%o0L-iN?y1FrO(j-dgBfO2amv(K?OznN-81+SC4^xMTkLs@~5pR|=Md<7uR>#tb%! zOxE+HEMZPz$5@sXQ2ChajL@EJCs4xFkn;`eoax}ovX8wpE#KGEoJA?OPogzR3_zco zdSTOKU~6~>hC+5hQ7mN7i+A_(q8K4~Fw(l|mVsy~M1&aY1iPHSv_98`ZU!Wz6Q*BB z(_~9NF5p?8fUkXjQFo6@aT-W#Q@>)TlgDVz_A*Ysdd{+S&<+bueD42|&-V%sY+FP7 zQaM_^*GvOexd9EKVU!uniD0gF!eZ1&zprm-tIQh-n$jC!WM|K+ul1)Khn)0&1m6%W z8i%Y+|LE%@L!~IRLYkT$m2XAm%ZJ-Chco?FMCD*2tM4nZPZ^}vQ_`%p{fxH^&plbR z6H1M{fpf$d93?fo9ydo<+B*&!KJ%oj^Y-DDuck}l z-dvvxM1kdrsZ4suf^5XpqME`VHCDbkI1N|uP&ctM9Z}@5RiFx-Z5Y_x8OxIZFnqt`Ho+k~2)NVVc!n7p5>6M?)+G*|}sMG-2aN_QOg+9xR7 zP7ylX7KB$s3{PN@MESNWA$8`J!!+?|NF2V3Wd*w~(woU`S!8KE^}Pt)DXaxBZuN7V zho_F>>I$7m+q7y;S4m=< z%{hKO)8Np*QtVX6{{-+$B!aS6W7v4;7gy|A653 z>vifL*YoIRuvaUAN1VD8%EZui20gTP06^=5U)tlN(ok6ntuA@ zYEzZqJjmzI}=9qu1#QiyZtKHAOfgtr4s$&Vx5sJ0bE5EoeSbHbz%l^$Ye&5Wj ze6V}CKS8R(wN`9?l58t+#@&nX0Q#Ml3^gx!sn)hy4ebN=7X6I+7<0*rdumEqD+Y5o zq2}c>hi1X)FFlaN=U^<`%L@td3+z?{6@Q(3ME$nyW`_Y+k?*dVR2^@%)Z{6$_UT;U zgi1zI_TKKmn@PIi8IRAtp^;_+k-U{_u%y|Ee1;f1*sizgmy%wQ`Y?L~;QUZIQ#+@3 zWjI!#w>07tq1?X`<2_VMt^4(H> z3x0PQ_;f66lo{=rN8g1M`kj)?_QD>g2DRCGF6928DF06hL>uyVA|sR-4_B1j!BC^;vdr z6q0x6!@VcR23RItg&5ehZ~V)lefmJiR|6w;o$<%v^nF;zTr3ka&ta`F-1H<*adAL}}1xgKuhyJM1I0Zx9ez<8na(eQy&&qIR7Ze_GZ#)Yt712v1K`ayAv_ga}hGdZiUP- zZE_djq~8Btu2!(6s;RDU(pOe*upAs9@Ah3MS$gh}@+*xVEN9-%TFx_D~yXvh?JemiU2}^DiIuTm;E)V~U(rjNZgF$=BA7=SOzJ zcuW_Q@+6i&DSW}YqgKHvhG4N;_UQSVvI{3t=PC@3``A;y&RY}V7Wa)%GTs|`YQr^I zwXjz52f5fk*^k4)3oaaxoA;XEhY3V>bJtWKxK+fA$_8-Ifl&TwFWJ%lScof9jKvZS z5M5bY&Qb4;?bosqOYn!JLub46GO6+jxS8&cU~Ma`Y60!V6jwI;%xQM(v@42ze9+o> zG4U(kkjcmx4m6# zs!PpnDxTH+g^J7^yxQj?Za&twiCQz+s$|TW~gO*Vfi9re$otCj#L?hLNQ0bpFQqE zrfibCMYkG@Amp(}VU`csUpb~+iSzF^%)_T*SLUxVTqwZX^f@SyJj${TE=wiHTfb~S7c zg`Uj)D9h$8nIsU?dm#?MB@@;Ss<55j`^7wXJC)p6vP4cmY;jXVmuraFEVVe~ORSNF zyaMtvXSKzAm5v0)^36?$*fv?{0B+~IWRR}MZwso#Xu7SWww?Nl2UNQnmD#*mfdKD) z2^c$|xCOVv<@VAfNK&`Jc%OfNumCWIESlb(6XaGD#C5w&8h0D7FhQ8GhZ!5jsuY6l~qd>ha~p>^ix4Rw%g0wZZcfY=q8uGo;^Ch zQ(p*PtAv?#xQ{^^`R-yH2ZAEcGDp6)wOog75*Kl6wZ@dxIIC7Bn7JIwdqJV2;f6iVu6T)XGL#HA9KKi%?{rG1nFnG>+m zaGbNvq(InCrows~ck?|`xE;Ug4m*>Wdd*K1FZxxNx9q-P({I*14bhpXguy+HWE06B z>%M=_udzH|_}O-~zmy3Z|Sh2fI>5i!*9#oL&6mD1H0EFoO8##bIz z|3;`s%=ZNI?AE#HK3Oc9Vdx`Qy%sSsRc>pny0&AbmOkdV^K7MSg3WB6#H%8?lM4}~ z8^0Q!`fcofv+InbQ4pc(n^lytUV-Qv7+>QK;C#yri+u3^W{ZZb((!ODkM^STSrV zarD9TgPDc4YWY-~pK@d`Fn+^Wb*7Rj#cj}AA>2hnMYbwxA_E3JU9_^EDdx4ekMn4R z;grYO#tEHY*FYoXmA}&rmQ_ckEsGC9oOsqtF#}$`nQ2V}976P{mkrytmRr-dPD|i5 z0_)9qfZ|;Dnqt?s9Ch^!EUe_rS>wH0@FHo$HG(UhDIz6f!xAE&8^n0HiPPHmx{hJ!^(3+$CU}nQig= z_$vIqIPo|{9&m7vgET_BeE1vZ2(2_-QcO8F_yrH4BkAum#>P-0$Sia>M$a&VdvY z%9ZLB6)YoH8CRG$=0{_d6oBbphUd)HqAm#Fzz@Oeu^FM;W9@Y(_b$5*&@~2n@>FgB-LTBq&^Er+S?TJD74zg=n@Hg-_TdEny)LV{ ze6CTB68xHK0^Vlzk>4q?y!raxB*m|;^$OyQj$@VDGd#+-WSHCtFUWzIe3}P092p}h zmIz_}S2Nik2UCQVDu~<>9NWoz$SM0FKfSaN?qTaH8ep7rX`%F8>x1gxAc|AYk6!ws zrK{@%u%>U^aQ-1B`w%THj)k&;{)*A)Bp7hQ#m(w+<)quZ4{>Mbb1Hp{T;mWg_Xpg` zf`U_tIL)9wZP$0%f{3fzZetFM8n$?DvzG#NP2>SZpG z2YVZ>5gS7aUGK>^r#yQ(nDs*w@sQ0=qDid=B;%OF!qn6>3KVmU31VUw#4Cmrr1U~I zc*P{36mE6A@jfP3HWz4&)d^*_l9U=<1q_S}!@x*rqfLQmV4kJXhv=w-#gb|~H)Le& zudg?zxVUjTz?c&}qM|Ng{awt}6Q?4;1YfLybG4BI8?(i!`rgRPsEieH%{aMg48JI( zI`u+cHhuV-EtsiJ(U_vrZ^g+%_3ek!Sb|>%(qpM|)sT|RpLZTy*C|4^HA9z_-Q-k9 z#c|;EJNZMGBbfAANXuP{+pV9a)IyPH6i~clv6zjy%HF)R%23K<{i!d)5GfMuYocT7 zO-;xZPt99MGHE++r$$jxOG}L`eQh}dXOJHcFrBGY{B<4C| zu$Pxpwv};{XRclh=X0#;v-@9Pe30}y$eGr8oN^A;MN{H{#M6z&N)Gc|-?A$E(%1J- zX(uf9U=`yYN3Nqgr1`mcHYBEPuD;V-1nBq!*7BxVVRBx?MjX@m*%DqD(9rHi1*Ix` zLZxy{ohF<#Vl!dAMS{7uJB5JxbN3c=JBoR|L!IJi3;0s?ox{ZEYhT)d)?2YnQP6x_ z8oQMLD&aE|gP~}}Ygwr)wMBn)YnwzsRFTDER&+AR*kE(K z?2(}K0X*p&A-pcmc5YVHBltFWIn+haeVNqLy9KAYNB)Fm(sWnd)^@+$cND>b1M5b% zyl30WB!t5sd10w9*$4}FNJ~TwS6p9|ctze8`{2&?hZNf09}fpNrQpF-^yR;G_taXI z+_tQtja{-HOdZ~59g|bUnQL^LTUfEh%#J^u3H{}J9 zo1SiPnWYhQG@DxWPB;E~t00dr#(9pIquGROmWWD6GCXih5wk2cDudm+%F!gIJYYf(&JwR5_GJl5VGVA?5~Z zlHx$90v_d5HO}Xz` zjt=q79hd2}OY!D!Gt~Ud)M6Oz1Uc0`Wda1__r!KqN}m<6?HpUQiZAm_z4WAQ!dx}0 zk_5MrQgUguQs(<#M%Q39qLLMvyyB*)wjbH(7k<*qewWg6W#0OL7q~cXH5NM?*3K22 zH;GkdF7bBimNh8e(gky)_ENv{l~;`Sof*C{KV?$pXtAn~9@vv2B{%bRUT)X#J22gc zU0Paa=Po&76ul|tAH{QW=-IXns5p8g>Gx5T*hiiU3(gK%nYPsF!tGdNq@}WhJ0ZV& z-IUXTTtr)zu{GB5Mh}^tbAOT^n8Z#BeK3|{_}xEI-u}`&nId&!=@lB9Ln!J6ZDsjO zO^xo?uO@p#aV{I)Y}78z#>+(=A$%6dIk(zz=Yagch^eHW)-qgp-Oka>mE1WwPb7jK z#vxXEOKp7Cc`iGrt5%xMAap|4C#;-xco?JF!Dl-NF6;+J{6uO`j_BrgKqc-H$%&~Q zRJ{x$zLug6ND}E^Ml62`m;GZSujt*_w0J%6S&;L+f7&T{+LoVm{O-i3df}qJ z9H$DGzqg@5asSS_fXiI3fFx{?-1SO5j2jybP1i`^5lXhOnKiI|Z+*^#Bzt>WNfgI# zOZ*D_mH9myC9St$%fQPGF36mIbs!@j-&;E|W0&=SSDzyzR08X2K6cnm)q#KHtvoL{ zA6xY1F&YD%l^u;1$4S13ll{WUiFGby)4Y>6BYVnA&#NhBr}{ovrESh-;*xpARAHiU zzb$LkE?p|2N-ABW^(BfCm`3+_Xzl2mIfZA20U0_8JnNTN2zrkYoJq~~<)Q&O%5G1pbep3 zS7Q0!2xBgKBKfETC2>LFVvr%)*tJmfvF#$9g(4Y>G1ds1ya3ITNuM~E{=j!`I6M0q($XP9jl~Hy-XU|e zQdT$a_?xZuS}o%h6A|V3XHAcewY@!xS?SGpHN(TI`59R%bUL9$dfwvDuMK24}d z4Pnh-8zii^H(&@ zU(Ly`Lb6Kl?*%CkRC~VEVr9z+k_^{!r2V?Ns9A8BP0KvDUFK?#Lt>8rTKI#FzLMA4 zUl>ZdA}^9I@HA{P&F|L_sn1guCMM@H_kQsaYw+}+pBda*m#E09hkN=2GtwPY&gn(< z&QI%QBt#0O8RW7@lW!(z5sC20WKjRzz)Gz1>LdRj77c9k`8M;$Zu3mH;|VXGGoq)) zkG4pA;cplHLTG==rqAuRUYq2eth1}At_hFKIX^u4#tFtj^L|f6Jf7X1<}>H@8+12X zRUNFkvA2;`x$*e?vR)n+BchtF`#1Z^2}Q9ArUtrebbQ(cleqzu6VP2xE6vEnEOU1M zS5T6Q!#@+g{d-&;3@O_%UxHdtjseO({SPPmf3rUH4<|&MNU|K?@?Kx|HQiP((K7g6 zF12aHuIv%Q{?&|%Yp)zeE>bG*l9xA^4lItnE{~4iVdQu-w?TP2Kc3&0%|$$2TT=5+ z#M0`p0cbpc(Rn3~abQLH6bnb$h`9c2{_Xj-5vfa=yGsa`j@RUpTDjgnhc2lys2VuD zfK)20AQP$8o=7oVET^?EX&IC5yOxdYt0n`S^vsvXonDN^x{y^CBrK-UsGYz`tW2bRV&F4#VG> zWI$NnaAT$b%ENyHV-`aaK+45A#yP~sj(Y&z7Md$(CQvS8Rqtb$F8rTf2j8 zyw;wdzy1>aCm)he(OAtIs901K?Mk@Dnl}hDSON16^P@0@S#7X-o~stG%TLnCh_e_i zwmvPWR6q9o=HYJMSp$f1u;{JUJ_Rwqed$`uoU_I0g9H~%9&c5D<|#@wEu8?Yl4hRs ze3^t>)3%%PX!YZo`2?3*ZFP=Y`9X95F&8;HQBmu*SQMB7ntFt|SQwNQM?|@*IOcfAjh!V}N)TCb%JIIi*cEqD9~oo2 zH#yZxeaR*I-US^Zq&b$kVt9Akf7xf}v5;PrYj9W-J+5z1mNsc!TmIX94NxjO&c!46 zu1~KOG&m{|&sVF|lrfwj9j3JpP5j-}QCeRFe{+&bv>-^QtEoS-Vuc19h0=kL>d3F=)^ zv-;~0=9c^Ygg#3VTWW2q_@owT3hZmRm@>q?iO-z4r2O_H_k#6=n=+u;q$$4r$8fXF zEexP@-9Ps=V7kuATDE4is(f^=tvT=FV#ZvKw*jLT&Z@9N#jo2TY6WS_EpHp@e$TeJ znl)eXO{ilADs+0#51LvsVO@5$?W+I*>r|F&?DzTML^C~B3pMIW;;CgP(ed_US!}a& z^<~*@wk#(w+xamqLyr6H^8~3l*J2Z-hUopCe!A!RyPB3(+-^Cm!=h2>bmIKJ^}(At zXk}Zg(Roo(wPwlEY;I%-hJn*39g_Ll*&owe)a$!3Hf)RP41WpQ<+wVGrX0AnB&y_S z?Pj^z&F1L}9yM$g)hp9NE4F9?J3VT z`Os_x(g$7G0n9TR_@jJh!mWZ%DrfRIp8 z@Y+7^*=7a7`Zq5xV2c$?ctpElM04b>S74Xb)})hj0`I%><@v%}NreLhk`xY!L+l2}mG8nm|I4goGM$k?-gIcc16} zKWECBne(1`&zYH+($CAVmpJ+zzGr83exTp2t52p8iu!KVuY2bYUHdVnlgQ z8OFa--C*BPVNSoch*78g z3|D}qjS(W-b+%M->?O%)T-<66%Uk*JnaOZrS7>{Y`6-O%R(JE<<#3GluVoPHI4FNg z?CEu|TWN28;cQSQO7z9E^3x%DbF`tyu?hWX+r+(k*E17~W#^;aW%(#2dFc9Y&Z{>H zItiwLo|>Q^|2ZRFb3V+f+@PWgvM(gzV9ibu4{%fN`?rz`90z7|GMiQMr_8r;-<# za!8t5_WQGQjKOa5Td(W6ER1NvQSkl@?AIDX>fSuKKRWjrdC8oug!tD?6&*xD(7`-W--32f-$ zt29nr%t5~_p@YV)VuGM<2{P@s-k+^B8Cp{<%rzeNmoHa_ zJfWq7N+I#>gjTZ!6(Jcg4KX?kS}Jg6?9h-o_exqE_NA1vA3D&}BcIFqMFSC=M)sq$s`m}pk#-+tD|rQ?jwvNjGB_8-Y1NaNDnO4 z0kKJ_?eC}K)W6wO!5tnu0zjoz5pXo<-l|<3w=IG8HifrxBe0~uD<(K|=3>gZcju|A z^?$v4@g2_Uon>JKl#vO-!+YqKypD@P6POf@+-puq?~VSH5LMFe5?i%b;*}0~axA!S z4g28yyNL+ynPO*^SBDE9g2t$MF|cQlCT#zQyrps;n7b_V4AL6`5D4X5nPy%XUwzv) z+^~QB0{$3ulV;c(k$L4wCsp-+9IvI515r-AT@~uO@gmY?W**;1bFo+QDKzX5C2!vj zcO9LYYlV)x`-FE{FKjUpaY0Ozh#I;{bR+9-Q2Va+(cbHV0hU*;C!N-RW@KUWRv2TAjOMWQ`XpX_+hE8&;lbvG3!*TUS?aggA&BkD zoQE|!SA#?AW14G$KX}LP^KihT&?C7b4hKarcosmM;bCdmyos;n*5(iA2yHs zbp7hc3EbHIjm@;_NQ0c-0e3Uf+wK|sAos`R0du$qM1x4f-#5@x*|Z+9OnKp;D7qU< z`p37p(3Ad+29sJ3VgmA6cPdEaa*Eo(DMaK;@)U=2rj8fPSy^k{|H~-e+6@g2g3cXB zv}Q>4EIcFnR%F}zn`V1(a)taf?7wVqd`-pyG5Kv(F?k=1pwb&}at8?_Wyb~oi<#Tn zjc6|*GZ4G2?NBan?)UB*TkOs9|0b3HPw}pIve-==3eM|=b9`l_l?E#;utS`%-i5w# z1D~7vo|~8^{={=rdK6o-4`16}87ClUG?3QoF^4J!WK`pUAg#Oa)>dny6_Oa(2!1LF zK$33QnA&J{t%kLrxXh+{G8mUBH~p8_>oyp&B*ARSx5~#=KK{(Er!hMX^7-fM`ENjc z1ZHNXe+?Hhu02xiK+kq5TdT%>;OAF*XP~0Lo|Q&yU~}d1y-tMBTy)u=r>^HAH}!mO0VM4o`oSJgl{_9Z1gcl-as0tmi3>|Qe$tuP)iNz1((_BM!yY|rPghya zK!|MtGzoMS%hoU-Rq9`&0jEL zij3FS*S$7^S?I6uQ1J#tG+(1X3(#MBylk7X`g~Xb`#tZE&U{B*;f2kO$i-dW;QJrVmsZ8Jjm!Ot zFMvWuAaN55x#$is*-i!wM^6;Xsa;~r$CXDVbwIa}<3Ww8&0B};6K^De8>3}y{LQ?^Wo$i^aukVRSmYXQIw5%= zFIQBN|A-U&Kw2@E=mL!49*##|?m!{zL{W(Zp?jx0I8aJ+z;4yN5;rE)O~*#03L6yB zOHQ{VMe0)7STId0z&?qfUsw*^<`ip(il7hG*h6PA0qu2YRd*tP{29i#~wbWUKQ=u?0Ny>cx!S zndRG38LbvW%uZWG21&BGr<>IN5j<0}RHe)QLPei5EA7l#q<0O-2dxAc32u)9s?**& zjn!hb6oLlAd^ev0twdL_1{jH7r|jo?bCBVlm4iR2^Bmo2!TeDnF|;pMgxt6B(Q&Zb zbdwmj-bHBOt;&(tVFf5>?o*hw{g4)D3pcp^PojV7yAX)mePguCYdrb77sJaXs>G>u zcyl^b-wt+wpQOy{pT%Ix*gts;Ehe7o1$#dI?~PO zqQ{&z^?e6=e0}j{VgrvnxM-U`XeY|j#Lyf+6ZQzid(eI#GSA_okXb0+7RiObt;t5j zrm#p*UE?M!e==+)XuI|dqiy~al8M|&2bS!cfcHK>Im>#J=Xq%}T5}uO!8Q)g|mcpxNn@av5u}X-M?j^9iXOb_}TFWyLukN z=Cua1WCk@<^1eHb8^#LN>O^^ElI@A7@to48C3?xDXS-)M-t5BXGh)J>+9ri^4(tNe z7o;NC(@z!23SpBCmXp4?2uw%eYYn-% z@|`Q>_i*;BMz<`D8D?qgW{L$H3I~4B=N$kq56x33j~`WA|2Wn9rQIie+7jJP0>aC6 z;a`JBfE()TkJXig-aJLd8%N((Q76At*>HBGY1>nz^8lz)gPZY!y+J&-!kYu2*PjRP;o`%}LvwE#cDvm=zKC9%B`XIN&f3G`; zpAIwk=$X=l+)DFrB+>h!7Fnvg*LYXXr}aP^-3$&uE+^A3MfjYSnK7UbXV5m4MaF5T z$23{onpeS=xwj5Ie2xgnK9oaKXDOZEd6*%n4;JOvZw%nCk{g#D;O)G^9QpV!5wXqP z#8TVamdt1Q%#iX*5OdC+NyRhF3}X?^l;dWXW4zmdAgI3a_}rbBfeR=yH}3vKm8cb^ z^U)#<@H3a~vohD*Mkyvb!KHnG)gCI-^pH!)6JrNU(cHccVQNDFs4P)8aYIX7`!l@} zvGW;C!1XBw=K6+@rvl29T;sF%X(WpG-Op+MX?d%t1*<<4*AD%>(yy}%h#g|`hGI{# zdy5~0+`U!BLLi^yo_?T|$NzhBHXH+Xe+fM?1ao~w|EeHYVMCGI_Zz%S&BQmhsz%9Q z`e`W%9E%9iLk(iGLZZxKw91_`XS7rH-=*A=9!P$tgk1CQD6(pt3tEK98l?{m9ZL_` z9wzjr;($NWhAQ_A$0aPd?Q2PMwY9BIY)@-#OSc$uK(c?r1_~QY;5QME&W|4JCA*I= z+s3d8pCV0;l?4dH-E(aCDR)O0BCmW4Pjc0OJSQ`dDkrv6Jgf}>+)rrxCy7fxj7-d^U^kvi=^CT5>FUSu8Fm;>naL1o4- zOcx)$z>rn{wekL;M6UP5bnvPd?h|Ha!e`ca)bduKdSJ-&BB*O?oSNDvtG8~M@e@b& zbiyC%Sf)~1>aE+N7eLXdXM&ZKke*MsUT$z3ZqGQm###k?K6V8#VG;+^XvvRiB>1}J zi$OU5qs7@d$JHD`zPGQ-P`8@~Lnb>UR2C%Yd>QYmBZ21{3>&(Kj}|o34z9PYz9!dL zfu9vB0T783Y)L+Q(JWm-1=b#T!apW56GOMkzh>kKFYtoxDO55%Yg=>CEw+9Y^CVqb zo6XVBA=({r24;Ofi7)wfp>kc@F7@@uEs6qx;&)%1FRho~EEhWjymO?s&e*E~^1zf^c7Oaq-2(D_b*_K=+A1*D$y0)LS!$P|>+HOfmxg@@~U%Y?$u`YWh zoI@HgKXt{T$X|9U@+x-dWZ#kAyFNx|ozy8+#_h1CMyae-X-QxS1$qPfUl3MoXlfb} z8PjRB6Lo-U&&tHfIT-W?%PV0(%k9tEwgfV;Yu~T+ZqA|&4l+a$Y4lSK>UV}yJ-tS& ze&jf)P+ku`48yB?{*t+8C%fmKMZ~ih>!(F=BXla~b^XO-`rEZZ9=ow~vrG7HmSHE$ zT|J2r`)36HOX>eHRe4iV>@ifPwXJP;24WXf$Yiph)4{=ExKZrp%LN-pNA&Ip-jo)T z$-=d+(3yab8JZ?$)g;n?Y2@$bxJvZc@NjU#{QS<_`N$hL`jjS@!_xorx4pf6@~*Df zR%#u80gBw()5%|5)rzPEye5%Wb-~`yWU;xOGSy5QRaMmpI9zsDdad_nTPJSeXu^oc zcB8mZ01@To>86Vnyq#OKZaiGj)U@h1IgZ>#SuxQZiZe06t*+#SAts_Wh?a*BLnQZx y-Vs-@d27Av&+dtiH~MaP1-6Ziy*VQ~x0S&CskFj*82t5DUpChqu2x;SnfN~=KZHC0 literal 0 HcmV?d00001 diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/mmc-advanced-security.png b/windows/security/operating-system-security/network-security/windows-firewall/images/mmc-advanced-security.png new file mode 100644 index 0000000000000000000000000000000000000000..f1ff86b5ad32d9739f4ae1856443fdd122bc97c7 GIT binary patch literal 79772 zcmbUIbyQp5^9GC-C{SFBOMwEVxVsf=iv)_hy9IY|aVfijvQsRmEZ48zVnM z;OG1xEve>-aI}hMlnBWZe}L}1Ucq;e#Xm)tAr$^^yg&&t?g&qSF5A^V zX7X77s=_`k2EA7QrFpEZ9y4Z_yEqe*0U}uam zJZ8}aA3x$cmT_hZx>z)OUKZ(bGBAV&@I-`%i=;Lc$YV`hhKGB{i2$tZ?L+RT--6aj zUy_pEn%;(HB94nUJ_&eyvo1sXB%(BkaZvszC3cuEh=?W_Ouj>|qN4I7``_Wm17&Jq z|2U49GSLh>_O;ERL<)8XEgI0D?^JwP*!+BKj0j~t}wt)q=fpvfBjikr+(Y8?9w#? zn58|gaeU>nNV_6_VY}c4d=Y87Wla7u;vB+#p3>nTO=L-`u@;a1PsUt%?S^1*vIhBy zzaxF9xF`= z?k^{h9)d$#TW^+ZEBeYB)*^uyh2n5DriRtf4+M;NevhMzH4E?unCH{%Dc$CmdZ(=7 zkxSc<@LTYhCpc8LwqIj=wTM&T_&J$O;BjPA-~uN#-Ijdb`8lU;=SFi*&NI~lg|1ew z%hr*HvoP_EbldWCHer|Fn30i@XJw9l@?L=Q$1m)@2;XnU9R2g`)~U_NGt$#rE5fiT zBP;wNCC&BlvmP9kPoIK0P5WQ5vSNwSi$A}ZN~nG~j|=EDsq!=|u?L^D@0aVhxHGwp zY`>%8zd&N4{{C&C`)IL7n8M}lV&Sr52W0|-;xF}NJ2^c)3Ls(ifsV9SE;(D zCd|IYJsUb#MG}2S3Q$rynG>Ub(r#{hUOxd>`MI1@#KUFwBZYfc9cJk|9JcNRqx5h^ zuQWF*YoE_}(ula`6`ri$#fwRvmmQ*IHqtR=m~ynTG^eK( zsF`GJA>3ZU72g;axj1IogxwAkt3f~b-&0yy)GU(c3`xkKXfBxtQHc3!&3nVg%(&dp zb5Tdy&+@UHeei$Cv$C=dZ-1f*i05)Y$cLAT>g^2i#7x`!s zXwT%fPL*LRA~Z}Hu7gh|&#)z{x#7rB-g@zoK1Z!M$W>7>#v={0*8JM8@>9sK2{Bmd zh>;`;FXkH*R8rSrQ}q+>+Z96wUyg5vL{{RCDIYuj#FqVwZE_=dzn5C_%^~1Rbw#TZ z$9K}US)M1DH@-Hll-C3`PBK@j;i4;_N5c{jlZ#Ql*;pK19ZY{DQbCzNlmGcV`2RYG-|$8oPyV#s(u7R!x!j&LRg6$`Oyk7*3E)6DSEe&)Q+LS%=% z?J!o2LvypK*O^#r^GT{o8t8t2!`hC&8J-ov77Y6h@~KK}R+nD!OrA4>LEM(H9>Q*z zJLhGh~5$44}+%au|wf_bVBA=AxXzRc0*#;(1s=A zTb)(SZ;9lex(waYDL>`OOy84y%1 zg%#@N*?y_Vtas65Orj)A%jsH;b>7qQIei}hgxzmorATIBTJ3yj7Ku-0oEnIu)=Vx& zG!WS@siaa{h82G`EiKHdcdZK7`)SIj#s1+>rtseULhM=weF|O# zJU9F3+hUh6%jAXv@cjhhE8GVa{6bEj?2zXKskswocPly<-k0N;6Ij z`idzwE3~z}ofIg=hGBkp-4{jN7W4!2&MYv;f^XLSHksH;^j0R&+m!u7#>l24YzMe}2}+?j{Yg8mm#7#~(Es{NerXE)~gg~{IZ z9LBMzqU0Q=&{t1Xi!@OeDrOXvUyPO`?D=n)DdvG2HKmI5oKMs@D&R(ZBIs zmgJAM+p_1KtyD0tMv$Pndbn_YE5J+w+Vc$G%qLYUsIW7tS7ixk&NsNH}oFxiwfM3y%-83sTJ z&|jSrCgggN3|ogrp{qZ66xH@&R`aaicO_#@*fD$HEc3!@n^YUfupV$iecKmwk6$Q$ zLUAHruZ=Qu(TKAvkN-DQ2k^6BdL-1W;eYq&3s4hQ-o_33!aWST{~<3@QQed+Om`0Q zeDHE3SX)VrBrhkgXt3J-p^w7CRg^sQN}@%9opiy<@mm4bq?vZLg1rP2((5{G(r31X zxFz#6Bc1Q$QDUpd^pTstVP={E3oWS4)11jXG_T4F=?mdD4O8`iV_id4Xcp!xcpGD( z>WGn!e=#lflK~4H3b8)H&7DJ3D&|wByLMgDATvthQ2K$A_I9f8$^*(M-AiG222Z>G z*7e;k!LIN+3cD`mp?{1z0H&H;IF5KuKQdo0vn{*6DP@LT(RU#FkCE>{_msA`F1kU3E@DkejcBf#z+>J8=d86Kuyk;E|HmKn z1`!F2W#LwCH(vfE@mse^(-qy}##1l8U=o^jejh6>o)(uHs~-wfL_x5*1_;Y&Cezn6 zELjg+)ais_=9*WQDPbie)MCDyA@DxN`fm1&YG2w=w_OjA(U(N3mUcU5!3a0+gp?E8 zkuQ3XQhYeX`c=C-H0o*iRrT{ONs;PO9Vwv6aMt#_`e6#`;SoYzO#A!?Fik^>WQ`68 zb7hy%D!{D8jC@yY&WExB^Wwfvo-N^Y$Pah_CSisYZ;8w7>jB!#UMVkLd>5^s*>%>1)Zh-ctFd<| zJ1Xxvj{Z?sQNW-J=dJKukiUaG%G_q^v&APYhEOwY6UaL6^%s(1CM6{ezj?x&DEdyv ztTj%W-GrIKJ}C6WSqRw^sXRm_=xYdgDvm0Sk#c_!0-?jqX#2^iThidi4n2SD@;SZ* zqZc==x9=#QAahja+X?ctKbTadaXPCB`$zqE z@UmSqk!dMj`?JHr9FPJ=M9vB4$6*dUE~# z+j*U&DCCZCSZb0$J6uNQD)?-@nI%rX*0z;V#gg zLG)@!n{p9I4{NXWYO?DsXo@GNHRSm|s@55jg!`xDd)>tcZIzC-UC9LD$^S}F@gCHV z_xR|^_%QHEiFrbm&IK08GvSp2;Cjzl6dK~^qUrSwfBn!3co=3|&aGU8HR$ZKZL&pcH~yAr(KLZS z$_Bq;YIA8e@hTXjy({5Ot$pwf@B~LB zXBu`^yZLFSy4O$s8BbnHT|MdIH0L4fe=z~rxsm?w(Jl%TV9osRZN~q-P2u?e5fm1i zTp0fs6gqSr+thF8pTwu>kq!Cp>Xof^srm!NqC5;MqBno|T+>>9T$GDH z-cG>TQb@rivR4Ml+R1byHFNIz{C`)$)4yYj8m-GjUt6ATF!x$bGZBM6bbP68=eBq) zw(7+FPqH_@Unuk*x2YdHyFyUoIE{1=tlltKd zRpkDx=gr%A%qq-@Z~*`9e}=XJodl&KkR)vBo3v^a593ea9Z_0RryA2yHXVDO()c@RVjNAxqd z<#>+xpm#Ex{*ooawSLrC^Bin8s$!#s`Q-8ec3lqgt1<%CTISMWqUaU5zw#KsJMw~> z>v2BlEM)coq20E)Q+G`16b;=QHnaNI5|DrSXWx0=90;G&b=-t@Jc?5Jo=Ikk`Vc)G zfQK)r?>A5p8nkPz;xArEXBkjMm+sx)UN%D4d|)}y z2lBsti_XNv1Z>g+3S|KWD4xnrGA=IMWaQ-Wsj1-|kML8;5L;5Mb(aZI0l&N2PZqAO zJfWDR!3zso`MxcyvGw(Q`771cTr7HxmGekPavcd&SAJnV#a9#a%Z}F^E?8mErdH#$ zu2(6&oiAVFxLhdfxtJ3g_<*0i9iKPKbb3Rp3z;A!DH8k7DNhhl=9fC}R+?PaI)!Ly z-=V!Q2eO8&hlYk?$5~GoNXFgWd7JxuNTv_DDkvzx1{Za;v^Fh1)o8qVJN-}LCYUcY zeSlyfX)iHa;Fz_Y_9 zEdcBkmTBb=2AkuogZ=z3>|TO~R)ezP19|!mP`fpZ{fPHcu-Y>X@=1nZ+m`*kV}9(e zF#5gtOFc0YIWjz-K8l52Ei%lz00rG;#sEY}P2v9pTakJ0ZMs-(K74foE^kp9(isWV zM470os~eWG0GTVZ)=XT`tS3AUKS|b9jyZ16mw|6KA~fUun)JsAbmm~wW5o#-9UVPU z!Q1g`5Dc2V8iV@a;}~XsnAdzu(SAN2j6JfGSBM!abefm1_FGaKGIK9=`5wp{qTfC6x1VF(Ln;EWn#b)MRtxSa z=8qfJ%UAUEl#ox$I(5F0F7qy5=jL*vFBgj5m>+EB~!+Tk#!t7B4f^QpE7p+C>PKB!-{;N?# z6jH?d=tFeUVv-TcG3(9Ub?y!T0g)%)x;!eM-G_RObqd+kxK&Z|KaGx^v8 zOk3CyZD%_kys6vMFP#c^O-&d#i7y|c+bvuKrYvgm`hIt^`v+imJgj#ZPxv_I)ioj7 z({8v&Lh0VUC>O@%yri3dK>aq-C69e9Q;+}+4XuqxOD>XRmd#}5jUwn_p8dYO zM@SP839e-!(Kh&jKojKz!o{oiv4N-I@VmAJ(cpU@SO*lrU;mS~{0pI;JlDqYh+TE9 zNgw(Z!?x9iv?y@)g-0O#%azmnka}IFX66=0D}TdKLft`RM_IGXM0j|F5PG-x+J9Kdn8h zG93v1A8t?$P>D)N|L-{S|Mz^-`+oqY)dS;kw}w49{5`lzow;=a107xBub7mq`ps&$ z^W=IJj{zl;(m$5YT$KvVeV`}Ee!S~%|I zYk(&^b`+w*cmeFUgobY)MIUw_VPya9lZ}yPl~oUAPF&w$hV>gUnK2}!$4%snEv%(Qfx!>!Wcb{IO)EJsN@147woKX zxx9P0R4TWnQXv=78iYfm9Zm((X`F1^xWP*_6(3#~jD5*m;6;>VIv(waG)-h8cZ>eH zL(p?;j1tIih{7556=+62oUKD*MqafxOzG*VD;QipcUtSGQbzI`)-}Lm-?Hm}`_jVo zFhhw}`BDA0$CIQ3AK|e3BndBehZvVR$bNTMYu^i=8(vQAzMa~7I#i}5g17M4oi_+m zW=ji;E?fV6&%B|}w<{)co7b1>=}zqbi3dUa?l(o|Duh4;GHksHQD{2-aQ|Ly#sFYw zdm5%ubPP(VdbysNXBVC=0ztoWB-J{N`I0Sm5`Ylr&qb`;QWfXj*BX7@%$$5xO1V^h zZ(l)`Qa#~~@=2fih0rxTpfr@h3MOJY=OAw2$%6yGj2|Is+%7kjTFH(wxF2;dr}Z?P z_4`3~!%0J%TfUE7zRvW3OBWZxeI8nTvl>x#W81BqnT@$XMj0+b8F5%7JF_qhd~HH# z!^{vV(Hm#Y%~5zCJ~+enIT{e#q5AnVBS_*FFYS|RvII-;tz`(Ww|02p8X;W!if@fT z#pR5|9NR+gt>hB@Nh2($x8YoXYTg%*=Lvc?Tu-DSI6C$ceIr{j7{=t|{GVc)4W)LQeP?(Q*f284%Sy%1u( zPbxLH@^PZWhMx()7q~-MYuQw^6Rx6yK0=mnCblr|VF2Q-AVsE|fPr7i21F5C^WT7* zSzf8e)TbSt)*ju_w5@px05{ZM+$WhqpD7)E3i7B1;^AnZoau?H4dU!8akx$zVkw*W zuPUW6pNsF~N5=v(tCmZpE3#gf0tUW~m-UiEV&jWJ4eOVh9hvUTV4Vm`T7pXJ_yX#z zIq;aj2g~UYBQ>@$I&cp@Y3w5o*(cYXP_uPgW`qFV&uO+dw{ClS6czT|Ag7NU-*)ef zTbsz@aFjHzG; zku}2|1dIwA4{oThES;`PEf&o@-aFU7drn9Fdvi*Tnle#4b-F?%PQSXvWwg;T^5Hnq zABQ2tliF=#I?l^wF9%kz@teHY$=6-{dc+hKnt|6%!||rbkSbGDb5sA?*g)L8Y&8k8 z^+5Kcmzcr=T1%~Xc1L4?mN2np-t=S%SM>CzcIDa6^>+-?wQ~`B}Q-YSVJ{18wR$A!LLdQ@VxP--*mU(Gf{VLG`); zG4$3-DTE?%(cn1ZOz6 zDQn)^bT;AwZb=>UD>}Hg$1a=|z#Qdbu^n{n*jzoLY47|6uNrTht-e@v+%BU|S8laz zVZ0cl$31OpL&6DY&>O-BU@V+Uz@7-eC}lIE?RF_)iJq@U3hg++M;99qRi>fz6Ur$Z@HG80lBC07}9a4sd< z2~+X3#o*@+rwPbhP;SXnLR!X{eRsw&oD`_n{ex5(1R>%Z)JR1AXLo>o8wy8_?v%=XC z-NWIm?3P*wL*dlo!ISD6na)aL2njN8%3kx0Yi!U#-zk8&kP}u9IMklAY^#c}b7_dj zTN^tewwX~S5_D2G(J|0xK!UFgA`a0C_C%YqFkf)>y1xW@J3g78|JAod>sAmG*xCDT z2a{B5ga9I!#6^YW6r1OxQz_7;S+SU8es7i{P^BMD9TA%8zsuwiuz`KIvWsfav26Oi zM4>Jl0nxVULBpwPb7#?fv)Nq-`^rE{|I|Dt+{;gmbo=4@#}!CPjo%-J*U(Z4Nju8!h9z(p2W`B zmzr7fqRKzOFToHoq9UBy?~2jiaz!E2v%E*Z6>@v|NQ!=Zii0u~W;v5Uz>qAWkcuj7vnLF-R2eIJErX_etz|{f#=QCX@^mBX z!oPLRJ3akNW)R&jZOFq+R%ZohzzHv-*7EHtf8V#Xj_2`C^KM97^tc~8Jyuh`V&ItS zHaW`9tP@(bfe&VvcfWj^s4X9;?-{E#v$%HJFR)#QghJ2m3*fZAZkF!L2TcY3H0|)- zibSUQ=`-fUjDX+RlRm#3JMN>v4>zl&xFd##x{&h5JPnPuv? zYGuAyXHlv*h~ZyC|O&ns*EPChTqtlGB6>SWoz=d1dh zcKygZ&&#F7K)knVQuBA=7KY06gXmM<9BWAdUsc2qJ59G-c}wP_9fSsYC)4%{p-}Ux$@GTqmYFv z)2XG&;7j6k<#iK`yOr6wU=`Hiv+W9sfu|BdR8C^26@f;iQD4Rn5JN@F+GoWzaGBJr zhSd(VHM6a#4x0&-Vd&)f-JapGGWX&Mi`mpR*I9hphudZfNAUpZgyJj08WYqtUz6Cq ze%r31>Cd8Fv4szYZb`RuEe7H62lYWxC@ylT+`xj3V?n+zO%U$>x`!yOrDizhS;p@1 z;{C-1|M_QcMZZeFXA>#1G85akxu35~T|DlNn_@er1yIQz*_LM4I*572C+KS)V5{76 zJ8It?&MYoQPY4X4w|dBl`TU+rLNIXi_B3@@)<$|XY-ebH5m0%lx{C;8Q88!%TqVBh zP6$=0b_J{zZj&uBQ3lhU*6q*=1gMQEArA$IHMdjwsaV7v&Imp@+dwt&fD*~)@7@PI zcb%W|p}aO5Xw&`xU;yT3lC915Q*R}}L2i3q!;6n-E1K_J12BEX0d0O1wG*vCRB!L$ z)60p*=JmbNKK$K_gfomK-+@;%e)pS=h2(?3#tNoSb<22|<$-<~E;TN2^~N<;QjXZrDEiyIsB$ zsXI14(mDWE0ZjfHy%@L zj=Ivn*L{xIKAo^vN(uJ2c*P;4Wrbu~6p3!C7eP*vQ`#(A+KvhUG~e%x6!Ny zz=W%5uB4-biYwZ#yU}_E1`C`uKUO3TkoU1{f15W}94F1MzU3W?jc_RWc;EqrFsNe^NrbY}Z*aNAc5<;b;5c|B$hu9D_BdMFcb{BPCFGN4et<_mfn23 zk2RK?F|jo=|A)bjqiLSq^!MMwJ)GHN#G(5nlFbGGxuM$SH>gl~3SeaBZ#Zmx4oG6Z zx?Gt6e*rW(BIfHy3_J?Mqv{&rREqP23(^p53Yq(k8^*m0_Z?$yLKr>CVR{|KFl3; zP(`w?1ys!{5aal_)dg_5Tz7viyD1ob%YN;piqiLWp1Qt+k(<$`S{kdCL1`t9);!J9 zhHZ&ker-M5-7!Xg0=04ItF!3E)-_~?T(yZjqR=1Fe0Yz)A@ZUX+#38W3*FvN)O2c$ z%jZXw5G1;zmB_0~t3Y8yoZNe|q%d}TjIH~jZ~e$uswQVCWE8+_{pob9Lpm_HF!+et z+&s-m|LB(G=)(8bwb{oshtvns=(_Iv_Dl@T``(qKs;3qjJK*!xkE&9UR+-T7J=?Vc zshAJnnXBugK4j6*i@F|w1zn^zc#4_(ZS_mS6zy=dYY)awlFzMieNLNf@9h}x;A7X` z2555)C(mn^I_%e45>VGIv!FxI?%_1F=&FCpN-4hh)YKI$e;5_$*ipqw2s^z39^hN)Znuxp0r$0(UWw z=Zv(upv6k#kPFAj(YjXVo04P{Ppyx`7+80Yp!X=&pERiLQ@@S z6y|?L9~(_|_5Ax~_AbbG%Ya~GD;fDHEaC}J-`*JCXd2(k9?=n-x8oauTJAmSsvM(J z!FT-{Y8q-AMyBKskh)cbkF4(szCW`r*GmnVW1C+N)J`@rBjtRCILn?=NDHWWoj3VK z&&6Ye?ofBR!SP@3t6Qz>!KdAIf3$L4JM7*%UeoXrte7&0fJaxv?+@6RbxkQUb$Zf$ z+NcWK$Kek4?-JXP@mSpi40k_IA4p60<_r1wA=DR1I;${X7N-fdv%De``2W_~n&3|z zr&nU9DI0e@xmBmFSoKRfy=t=?h_V|$Xo!5qHS)>|$T*Yg8aK#7x67?EMW!P)s#uzT zV)KR?rvQzPdon{Y?IfDiMa*T>yBFrlbpPqHvsksTbpl53%v(2W6q|=mm%9uEm+^1L z>lPR%m!Yd0lE+5HDfKlm?wKwm%;&m(Ah)4vLW~h_MX3|-z%u-hUQ~l3s4hghxJV1L z<#-dfV`n>{&a(La8VaiOYw|TCx=pl(K%1lPN|&04zgJ)&59)r6&F?Qiyq@|FPXqF= zM;@64{6}x(wog783)hD(R~PJb?Ms)wOabKKqf=r@_`U8)-~i%A#rQowu(J3eRmhY! zU8#Pvz|c^_)>QsQ-BDM1i1i=J>ZOIzMEcm9U+oPDo*&vR7ZFRf=crz1%o(|VA8E_- zta!~Ufm_nj9&6tI`5t>--Q#V~4q7mVw058N3s!4Z@UUES-}J*fqYyjaDT~rH{e6Sq zzg#H)<3}OV9SRtay5`Sy0CQW2q1&Hnh+1}C&kk)G+Xc|wYjeldqn7Gz7Id+`?&;?8yfnD@V{(%v79Vl3jKgGI)+lh|T1j(WyP*&s6zpuO!O5aal=Gui zSW@_JIU4U^mc8qV#C|v=C3jC$H-%P_=~=mKHgc22&`z!e++{CZ4gi3gH^_Q+WmhN* z^Q=uoD&S9(!bC>bk{(3!IeIu{4=YKeO~Y<;ATTHioH7fI9@NPW5`nZKrqRtwC2B9U zuX6nWuQ`-C3wqWMmVwKbSN%&ly&MfJzFHsVUXz!l&5ibZD`EZPG7kSQ7{|3=+yrf1+=sf&0}7FPn=eo|Ny(rK;rXTPtu5Za?MALmQwA=q0g=pXY)W2h?EF0B zTUPJXMr717-MV?YLc^0~r5AJ(JMZeVq$WA0V*|uFNFTqT^YG|NM-?NtJXPK8!|196 z4om(c7tk%?_<9|#l_*tvVBp%zu()yljqWD0T3$YrF7Z4S=8NCiYBM?c#iaaH5nTg@ z4n0h|$aajhPSaq{g|l zo}BNTR1JCrQNjv6c$8hI7=M-w)(E z39M?wQBu#+Ok9w;gWmilGNvTww8oD0<`1lmDu$@M5O87SHt_#f*-L?y1@3 zt5s}5%+sNG)36d5QV6bu#wvQg-9-DVFi4^QkY2+A1(1)=G`tN>8q}K7M#@C{9KoXtx@m7Skk*4ZD>)0vg})zC6{ZN&<0U0 zw2A}Ct2iweBAwFi=n(KSTMr`D_?E%c*G$lX`jJUP--p7GS~nt24$vts8`o9DNoQo` z-tF`gJAO(%)w4(V=9B>Nmv|}?hsXo{$fg$D)u%1>u-Iw^oqpj)%}*?y6;6~? z?MataA2l+Q2~X5+B}vWRyw7|yzn~}iv5wY93N*N7!(Ah5)>ezGRdf3bOKi+~Py%fj zwJ!xxdKFr;e%v)RQZ-8Frsxms!cz&@PucJeZ^N5<@&})Gl{D-VD?8atEuvYy zu*e#>8}KTf6O7fcd%eT?C9Mt^`28nZ%#)+=)jwzV>|#m1Z?8f{W$ohQp_^BK!_^5o zm|Me0m8ood%AZOd^@Er<)z_~UYf)-2L{)40eCUh43lpQba0uSOWVd@QiKBjKV-uA@Uy8S!eFjcQ7Y{5-?luxV|rhnj>w@N$BeL%m2}7Erct>puKn z&iHHCCqxmpB%M4o8+xZ9_;Lkd`#Jf^?WM~7_iOX$b|E6w^2|sL9}KYuzhL&!7NiRE zIirVG-Lt)5anv`n;iV8#T8xYc9>>XjkPYjvR?s}dsLsX^$B34iK?TdhB7SAQ&)3K1 zm)cxFh~9LY0n;0Vn(t^kWs3`68P`URl_+g4Wzu{;RW-elN3$whBzLuEdRZSTg^(I=X(G+wSDQ?tmFYIiS0=!9{{gN*?lFV3Q=^ zrL2q~2MZe!T`%3IdrGa^S31u}n1H_Lm^#a`UDi>ZQvoNzCHYitDs(_THmW2khFl>N z9x^-4oO*vkokM-A(%LQ#7W_I^B`qbjEubkudSL^N(u~ZXW6(^>Kk(&|T`a5X#%uD{ z7KlIxTp^8tGV9>MNANR8o(>9Sc-xGM5(#B^F!D&JX~oO4{_~EU{3>2x*KfT>^i_Tg z)uAKXDt_2clnoRpWR#RNy?EZ@hxrfMS+mac=y#2Y5?%-v)OrPGPP5gcAU79Q-LEW# z>OF01MDkU8ZANa->4sVC)*ZT%Sxs7e^_R<5s}Ty!7qxUU^J^UH;0z>l5|nQmf1&eq z;IVNpW0n@<$jF)uekGB{Aq}1@kj3NRr^zkD%07a>VA9kNnjR|)5090Mq67*aS1#)q zWpiL{hhob8C?U-=Jq9)gZrT%b9Bc{p@=+1)@@(8JlBrQH#yz(Ed@)wX3heLSYLF9` zSXIGmCbxJy@9-BqKzOCh&GRpOG@n{5_L;LEZ2;hZuiM+=-*cGmBtMr5?cbyPHudfN-#^j8$5+pKz~1wHL%(NDp_!H7qz zEyTJF4iL5$&-2{1t+T0#dDE*&t=hV}?oB%aQtS9S2b=Do(Dy$^8xbLHSWn+24IY_` zEci`yUV+t@3Xi5*qh;bt*LV1rp2F>42QM9B1!F?`Imw!plc43dkPb zBG>bHc?{|8LtM8jjaFD#dB=%2vn`K1Td~ab>dCwuNdGf=_WNFH+nP;-E23&yN7?QH zN0V91eUBY&7VqbtCu8a_%xk_53OV>9!dfwYoAyy>6ZoMSZ0l-AolQo;dYg~oC+_go zW7ER=s5!?w636nxnkkzK&H7uxjrg?%@$a!+y4oagWl}z5A<*4+BbrR*wH0*p{&t~O zUw=kRhMOlFb0H?~c1XCjwUxLBcWD615#&l&>N(X* zJ|E|+o#Us?%{Rzoo!|B~uX*v~SnJ+~cRauV1Ki}y)4-dvxQ3`(LTS%x|0=iZw9=O3 z8dTITKEbn56E^}ZUqO`97hTfHFv3M}tG%~oO_4Gy)URAT0`l=kNGwG((o}^ys^{dl!sI{HVqoh&$`qk>?GC4K$a_KcvQS zf$=6v=oTQ=(FDVj?SqkAue)D3<<{`_s)8f){|U2P4aM~+K5kB*%ZO^I<*xekXNOI)$=~!F?h_eBP>(&QF@#)dz&AI(^=`w$AH~|FU8z%x*rii;_ZqUs@1!F ziS{a2K4er0r>23Hp&Jdn?qTc=Q5lW-*;6|#mCDD4jW*4g!@xw!$dG1rPnvpmx3>@pmLO9*eRBSem?|dg?Od` z)F{4&9&rA#Q~!B)JB~+wi9O4fOOo*Gh>7wRoFzEHKKFLZ`u#oS%=voY(FXil{!@{V)?r@6m!Z z!&M?+3V+0@p!B@UNFNls(Z6ba8evwN4*|b&FEk3GF-Mqt$jN3-cu>7p1He8uGI5r zTQRjlVIWysHUR9Yl=$w%bi)}x(fQttH;KRm(mT2LdA?=UwDOL*W#pXTWSnSG&29J| z4ibC*y-)#FfA^feUgu~m8kuamrOK>N%<)>mp~P$=7{a_E z=JTGSm)eJ&vQsL~Gngj;#-i*aghiww3YB}E=-3~_-wa4z-5c&2hD^uyyigED+2I6p zpK#rzJ#HyEa#UaTz0}(B35*z&wGV^36tZdx*5CW`g~W*Bnq?y&w!}_2clzz=uCcMq zQ3dEz)gU}PxRM!qBG!%Nw)4YR8oCUryNwOkV~&&prknR23p->&ARP!@V#|{K8&&*C zPW=QK2)j-9PIy(3nS7#5~)!$1i6Qz{}z_P=YroF<# z6(yT^D&LFmWso0}{ChoaU?$=J!`fSg#kF-^!U>uaB)Cgb1PvD4A;FSB@Zj#DZ~}#E za1R8BA~?a_-5r7y?q0Y%y&>oQx}W~Pr~kg_eZf@~wfEX<%{A7TV~#ll7O?Nhf6cYT zJ9I>>f9dMcw-&hEca*VfNrZc@x1o1#U!BNh(b{*^Z}zcU;a$OF!eP8F7}NvWLl_&-=g8x z&OfY6*>foCzNE^5OtAs#Lp5Z7tA<&=UwefPvF}H@xn5y!yw>id3J<8oxeripqJ)9@ z&fmFfw;Ac=ot#wJA^RLZ&V-guk=@|4nkt>ALhM>2mkXXiRZpntL4b%bkK-cl{))&} z7v1HFsO!<8w(H4~<<9LQCEx_X?|8m%Tgl~>$tZg#7 zNT{rAG%hK(0w4Q0FlhhEF$#*y|Bg+whmh2=OaAAX?xLt-*qEDH@ z&&K?vbahs6uB`x#;kGJ~`R%LcT1}tPpzQl}KM1C+Z!Mw@4Ch00!s5f({S1==>oF!K zSelKi9tKu)*iSEX<88&!vrdY8qQG>|uaN~rydJOo+z%(Vz_>ODNAXNK%QK3453-A&l8jYxD1Jm_Qh`UF3LPT#?&&aUFN9JDvaAHg;tDEK z2*TXn8>2wmXm;noh`dKJY~-vq1$5qlO) zjQzrHv*4<`>l>b?SXvGI~U%#=T@$OF)dURuYrZnZpcEf6IA6ruLVa^uc61ue%U7E4Q}X}NpeVU>hcbK zOm4(9beKogbc)%=X=)IcNhRR}^%qT+c7FV|%7wpn1+o(C&%Rb+ROkq;(1u~(9P&cA z#`mjHrn`hP3!O1N@OZUOC+!IHEGcs|J$55*>DzEq;FaQOtRGZdyR=ZKY$vw#@4FIs zoLD>z%b`Qb4(14MT(_ZaUAre9K;)0%hfI1nC3n7>d`ns%o}8!YyU~8TJ%D% zyof(U?b+=qNyt6Mv$LtaL86zx@KY8Fr=D&I15_`DverYfv%Qh2clUl>`sDw9f&BT(Pm1~*Wkqi(2@%|HI zI?Lrml#r;dha0~&5o65L-h^34?vjvJtgH0ej0~GKq!Ga%u0E`^@I+FSTxMdNNss0=nYVpL%iR=%g!xI1(41k8wnKL4P?>K1LC zC|I5r5x$b{_GBfVO1XwM$NB23u%P&t-sfUHt;pVwQKQ?3H$pajWbeOecrp>lCZe%N z#3lq5PZ^DwNOQmbb?1lYio=UZ$yd~T$9~G=enY07m^h-WftuYGHo--#%OBlD{265J z5L9%Rz@nUf=!%@sEA{rQeIq~^f^Lui$6EN~Ia&MZa4iV~1CuadlkHeJrrTZcd+9Z$ zL9u=AN+V6$yEL6W0!u>L9{g-lEbLb@p2?@ydldScg{U#xK3$91}g-r}M z0<+F=!|A=7`e@3&@&*W^8MkCKQiQm1X9v1oqeKTknd=WZp&oF*c#>5!jYV%|%Vzw% zFv*EihS*qtJ7VcV@+&<^tXQD7hQMY7JK~pZ-snGxPfY{AwJfnUze?c_Xrgw&wyCP% z{MBKMJ7uLC@T}bcbiI3qEr!RuH>m8cK%YvScd(wAD)mm~I>8xLm|aY8g2g1mAu`ge zFjrDT3(>FcH|wl?s3I-1?g01i!=ikY_x^%(@uxpj zbzB6itnS4oT-{KPo==>}IuIGB$q2oWGznC-eGGX~>MzZuqZz3DLl zU5^Fv*?{I&>H_w8pGl>j=daOu(Ue&{WWEJ?Hs?f;e8GZN42n@w(YZbE78HBOkowM^^-U}PyL4z1H-hW zZkWz{4{(`Kf(i!5MESqH*`Y@-;tyvBVL|!e>PoUHVe2+3X&^pK>^6S`8grsG^T$-n zh{!e!4L|#H9Zq1G@$ziVrzByW+}ZN(Z=6^bML23XcEx18K7y3oZO;8(e{2bR!>e`C z@H9zdL2mCTo?p3bTS;7Fv}@k6{XrB%+F-FzOYI?hA;v$TT9+x-1JWqtPJQk6^&q7D z&pM8*vY?XtRraj;fNyMZ$Y^WZ@UVQkHC%<_{d(5D#9*R_=r)Uc=-1pWQ!)qS!3oXp z1z+wy#NrNs$}Di-RSqC?OnDlY$ZBY)i~H5#pDA{+*1tEbB>nxC^N-i$x&(Fzf3)Xg zy}IekQ?T`IV7K~0?Aa6L0%yGYGb`cEC9U?*y|3N5LhqtENvDn~fb9IQe;PZEFr2hB z)93JIJVuy3X<49PRI~G|gXQK?Lt81Dbe|@lOY=1N*<>X)f!K zg2b(v5G`V#h)PcUal68n06V?buDa(oOJ(72xg4I!1co>i zus;vKKOZUqL{ES7)Bf`55>8MkpZ#+i8=Kx^_qvX~02Kpk0?yuJz+g@K@;uD92Y3_Y zM^)fmhqb{)OqZx`?+H8*cPSW0L0xGRX`vu7|Zw!ZI&B?unL zEOsn@H{X_m4SrIhcodH^@9e54_lG3T;M|^6KSF9rEbD?k}bcaOv zFe9+BF-U-K*teUKVvRlv`HItG&%_{Gq2EaakfzNyd0s4mhW5SEQ?Cih1`E9bJDDK# z>Q`mm`*jmLhD7K+-IZzA`BNYEz7jX6Jw|jun~~}MyihA3fOT;@7gWg=z+oTkNVI)u zqelLTi8)D#WqC-k8T*jOY2IzOqHS+jeh-0>ZfcR%l&N){(`DG8lM&CwL;VxV@f>;t zf3)b|frw22^d4GR#Kw_EDFXD*Mg0Tv?MIQDoiH~TWL9*Y$eEL@-gRtoCFNQN`jcO= z!7R&65HE|a#p;11dSAB)%HKBu*e(@<3-32P?ojRR?H!i`X`^4NQSa|Gd>y3;A>+ka zxSl^pAY8Ns(a@kU6%-J0wg%RA((sUvm==ULZ^Wo$JBN!IfM5G{@`|n3KCRM%i)nyK zPvR;Z1a+rF((*Oqeo`wNTG6${#7?Z}YJa>AvNfyxiZSNuAn^;WrWb{cs^Mu_Wq)S^ zr&F&BTBWL7en!0DzM7a?mJ;250=jCH{Il5E>R>jbZ_rq7Qr|)jJi4{+9sA-dzDheF zO%~TcvrtAJ&^nkSpZ-@R!^aL|E1s{lf8&19Mp^5@fVS7H-Wb!jcC8f{63{$V1_E1H zzib@_vB5qUSBx)3R6LiI8Cz-3MIjR$2{}st`Dscf8|^ACG6qmko&EvC;oXvaF%Hip z#6{j9OicOiL9cApDpOy7;qP#HF+nD6*Q65XB?uNP-cyt;%#&;HMJw)Dwnd%b>tzH` zg`+ISRRzL0tfW6yO!nws8PAf8%DTF7J{%4|oLRV2cDjv%-XIBIjf6+T7A`uuqtAV8 z0{bg&whE%w2tDIWQ$Nex7IvVCn@y_iYpL9kIBfaaG*8+%ZiOP|6oN&SuVz!%5@D7t zenwNp31zxdjNYTC%tRGSB^6}UAP(&!Wt0EN<2G!)o+ZGX=Q*+iIk{6ck$Tp3r}W8< zvRE*bL_Duv_G%U*v&4^sU{nSJD1TRuyyGaoW?$~2@a>lD&keTJyG5TDx+SX7&FaiB z8T@m}_0&+9w0O^5t~Ie{%1#y9_0SWY8g_ZLjqVRjz zAkqH8TimyhdC9ilb1TYQ=+plIRMb42#C`LkbI<)zurE?fqdu zB@K2^aPV8_^=|@KXM{F$_&wEbe-JOu8^ZODiowPDokNFzBD+fJO(}jHBo*@MY6ml+ zc_KAI?%1ecrN})rh_g&FFd0IsavoLfndBg)0gM4>?JTGRfpK$$nVh$olV}c7S` zt%<)%OBHJDR9#&KuG#=UULWybf)+iic1cxB`tI64sp6Z>Sj)&F@dy?%c#J4oGK7QwCcM@{}EQ2=VZA_vagWKchcB?lYeM zN*w|!H}x_T+Qt6(6&{mU9gy>tyctHEFnOCbu6Dmwy z>$ZJjtt%j3pRn}bx$pC_Nfr>FJzlkA=%(ul0n9Jns1zbS1YLQanMw;%XKz4*d>Wi` zSMvC&?KcgP=nr;bx2l@!4Y3Sh^H9$cry{;vAB`<{Lm;9^$~^`ah363oviu6KL~ZDvPHPiI+*WR3FNJG|N5Fe{Y4GN^$7-PYvnX0#zecm(CW6S5Wmh(A(bjix`w2M$u8uU1jOcl zhdQm16&SKtXA)vn6DvDTv7y1IoFn(kd_se<#I} zSo!Bw@VD4+e4Xxoa&%;zKKv7{jFYq{i*qtPKk*kM?wemP2YfZl_Rp3xH9hPQf;tk# z^&6DzDV!xQa>D6pMnL7*q)C+safHpE@K3Jh=?qGmh=-| zqD7~yZ4Ba_30f{k&mh1HwCLy*N2XJI5?ya89urVlP_%(qrmgUaZKL+3feq)AA#Lz_ z#rU_6aJFjq75VnrYw#&P!A(8-zI#)+Fy4fTwaYT}KzFL{LI@~g0zu6oNtT+boC4+>LvtMEe#1AFS#ny@e z)TK|{wI}>40fk-67SH?2v`7I*W&@0Kfon14V1Swr0T1 zJBc+uy_5Xh{mvU#v1^i5Nd_5G-U?KCP4m$@LtPjgyLe{5e`9QePau&oe(ai_&207? zC=MWcw_0=fgHKQZUtc43aw2GF)#zpI81kSdWhcAvEobBLr#Fp|&>LGR<~o!Gm%FCJ zu6CW&O_!!t!N(B(+{%a9jw#!_$+^>y+-Q8#Egyw&T9aolq!W%`Ku1^9BAE@Bvw$o` zv*YZmOdZ_yphT;1|C;xjH9@b zhOWXJv8$~fyss(${z2~+O&Rhnb+;n=)?%-(fp6)ctZyhyYN=(7t2_vOZUDwN=Ksyg z_#5LR_iNB@ZD8CV_28|r;DFF_gXxnzR*!Ad6J~Z>CJj$cnxPZR!)``}`M15B&a#iz zX|Ibi+&)!1F;(hfNZTeFp}uu_8o+E-HRydGKSjBi`o*vWdcl?AVIK?GDpY}XRY5OO zx~=wGAw}1?6avHEF$9N>$df0+{tYt}ai{gFcaR&w#WVH0K6Te3;~A}@<>rEBXwa-Z z8S@n`Yp`AK!-Q$=iFhT-cQd1dvM|?5{yD&`CLpLxCXQwjYvfPBGYzz1h4AB_GSb8b zUBiH(>W+nV;2I%3nTUNhj7UQxLP0!rhYeCPJH*%dq{(Nuu71>6!VteM0^iIHsAhhF z$#70zoi$2YRcinP?{!q|yWrQkR}ck@W8G|f-FG(KePR?gZ+VI>ChReXbt5vjI&P?D8*Ofh3d;zb5$KdPgJNQmdCWx_qGLg(awn%LLL|oV3khb0x(Xk zkWM=B2ZHN=E2j=xoc428c`cNi^G-^UJ;?#vv1)pFGpKdSm_H%G{AHRKu66A|h|589 zfpBx4)y)e6rU^!2#_V7n|9fsxnQ^u6oQd2^{6nhZPa6M0rMTcUcFaC-B}E>%_vs+t zo?a^$)w1y1T{6>o@w695L%?%Cb=a(Z1C^pV;l2j7@Uw<)N$mmc;b4(Tj{O6G8W91Y z#BrS_%H+Vnz$Vy-`BA+M=t+Kn4;t>zE!s2PUg(^mRMs6dWK=Y-D_EtvgkC;fEJF32y@*qjpdGoX%dWFmulj4Q+vmk+EEm0%#J#mgr%x|y4JC@^ zo;>0g6mGzpbBv`H{r$c>N@(biY1Kizr6A(MEtskit}zj^zg!f$aGHzen006gWxKKP zfOMVS#H{^cJl6_We8geh7Q=J@ar&d1MX&8YZ9#-OLixpeySJ>H_pDn1?;(F&hdM0* zvg+HgIuWrYpV91xnY^jMMVIY66c52WtA6veOKJ9+W#zEp3%02lHVc(ka44p^RAz?&;9}h*oq04bI;1FWY{0AE70MLLb+dZ)m z1yeOoSCoTM5`FU6hNCb62hslx!hi*HNU=S4btQ;@>N}^401KhHS0)dd#P?TVt{2#Sxb*Ne zKJZsIG9dwAaeFuF1T!rI`@4EJF$#)n6aiThjw%7$$!LczcBA$7q`oP5)AJF0PHEyW(|G5U&`)>Z2Ns%9;Zsp`8r1kyF zarWD(NA+aD7k*>sx^W>4;)j9(&7R)Uxb z<+n55Ow?d&>xT6{%=n-4tZyzjZqpD}nLhYuDmL6{L&k+Y+z?NjyCbO{U;VdSl5b6R z7FAP`O)JhfMqTz7qha8~>wEHG6ZhGSdfI(ZO8KxK+$!-q?XjhpeZOnc+t(}7s}{wT z?oYW~BDR*N^DSsWtcuwo!JhL*Q{F$u0DIW+^K;#S7LIclU*gF!&?xLpmo~c%|pX>#@_R(5q?YJ>fK@ z5geQf|MVkH+hN6s?5p+3gWflBa5l3U>$!DOkeyh*^lq(4;r^N1L)|;Jnz~PKWQNc- zCNP2|oBw4`={8YEIFkzgJrxV)Z9ed>pVEX`v;RM_)I4SCnA`O z<)Dz#TjZ8~0B0=|Ky!aPSELo9*Dk7aT1@}^ki?0*G5BTq=JM0NR(tyH7tdWXM#(|l zp{{{q3cJ+uS>GcnAW4S|>&*P16XEY2K~UaxJO4jJ3`1XbA=p;Ov*Psaxo3N z6CPfakNzt1j>L+N3+unjt$sIK>-{-dX^|Mlxu!Lzcst1UL1s|osd1*=BA+gBzf(38?Xj;Kmp>~$`-*MS_NuC$y}E7wb?G=Ln2Bv- z&mWf~pnGeVTH`>0d9ySs#JtZk#|ApC{(S(bU!n%JGOlHBqMXeT*cD1$^46zpO-ib+ zCBwxQM5LpWMC>zQM9;y5+*bDST&Ofa~{y z()aS%s$(oy@tu$F73t^$MXReF8Y01N3n4^cTS<%!>X)+N^4VOO-Z8}1Bz(h-8!g-d z(~4oEHVR!8!+i)3IUeZKqzTAJXERm~)xnP99bfAYTG3Kl+K;1j3-u2aOw2Ygg)-0h zr!?fFqrCBa*0ukkr|+g$uo3|Tk>L5`!l=Oh=&&NYvCoDmYSBw|pFbI6*Jm0#$E;O* z91GHRc#sR$_0&Uc=bFL^%ZIk3t#VZjTQKN(ySIktpH!?FI`>L%3D5u!DmIoW1z;qA zCbq8*zJN4c3kqDWMggkjAs+Ug+l-S4oK1DR7^*LZ&cRV-@}@Q|3UQ&U`iGg)zjKd= zvgzS??*oT|k0VqVvyC+5;+EW#E2hY+*BN7B41{lBRBwa_)~B*m4f|su_!cxK0epkj1^bM2dqiYUda_`1XyKB6I{Ixx{wa;^7iMd8+JB8*ClPEUy9l53~ znYzyhQFfpa4bUO$2K|L#DfYR?{{6wwP#4J38ynZ3W0NJHPSH+fK4pGQ1r>mA7$C(l zv{-fq2=m?$`{G`C1L3t)tWOw>Dp5L@P8_8ajftEsw{v_(o(`dHb(t|E==5{$9z3S( zRU5qH^uebq_l*XVQf9 zbMo`Q_0R%k6h!8>P*<$4QeC=TeT0XTS>*F;L-|@E9aYLp4dMPv{K8IEaBss!6TW~` zpmtucsEkRid%G&?)1}=zpeXWBC^Y4Vg^mMOnY_0ei|?qc%4w=B9>M=9IFdfB_<&Y< z$dHO`GM{gCHP70mr%~bB$19ip2LEE+zd8sPkCz4>C=-GPZi4^ur-w_U{oNojzCT4P z)X>l(M?V{EuG2UqOG!8ZMuD! z0%Br_=FQ%4Uo^sHKT^x)Y^Xblt>^7EEhril9kagvSU}$(p`mZJ4POw!Gy&%eE0$87WBlX1iAiF0Y;^9ij0bjD@^ zHQB=MgrcF%1D6VMWT$Rb==f!qb$*d(Ii}PaX=moLnoxZYJZ(Ugy{_2c`i4pIs`{b$ z&#m12-N)Y~NN{*IuS!E%@uuWFN=bng)Rp_Wa<)qnkXJYkaY8xEpW3-oXtTP0Byj^! z<~`?!clPS`_mn-|&INOO4W=4I4=P+hk?vJ!5GJk_a35Qw>&*L%eu3|oFtV1`sqCLH zfExdjkK&y2WJWy()((%OY3Wuk|DTq#i*wrv4c+wMOxT z?8~hboW?QSZ=|oHU|=p6Z`)Bu#%`%`LpMZ5#jCid`=9+n)l{J+sHKUu*INz5nr7Jx z-KTFTp=aI)4yqaLHLNOHvq7-l-B_cYg^IfoqY4r|_8G5>{_Y-T)B=OrRJCO+) zwj8EQ+U#`8AMU?BR7cW-dW4Ctp*Dn5`M;og4H|a&+K2FYod?nP_Aar=IDbwd&9Dck zAd_3hNUaDeb{e3F9OtZ9kXNhsBZ&@n#|u7d{BE>6<>=Ap{7GhC#@8f-5la*Xxk~$Y zMl|R)`@pLf+)2ND`SJpmUPEOc2EnWFa<4>jaVNNdy`q=_?nV*)4GduWLWhu$DXfK-ZO2<`*M0qhW49E7I zwz*-P8k?VKD$dmmr0pPU=#HS=eX>qO9SE_-4ku^>f#!eM=G_~m2oabTHqA$D^e~|A zWc!^NTYt(T<>MpFkP%G0-uk=F0QR8u$q&UAqldm-wn5d}Y+$B}@^ZR&nWI~HFHo5$ zCYCoNsd5T`pA_;hrGUQ#}(gx?{GKMjsds{P&ef4fi*DOU*%x9XomgvK>7NaozJ``MOTVLd~CNzZ8 zTmuh881eUovwuTI{nP7Y@FlzEk>%1alnI5kI;o!?fMc|7*;IY}%*QC&H>2%&40-kN z&hSvl!|VMeaAFdX`Knem+8@UiW)h;Czg+@qHBUPCHD9Q%^Ko$z9B&M%?2%9~aN239 zK;$oB$u$mXm02jXvPsVX{vvEuY3m1*BR!#5ET_{{H_!r3PD`u6HIU0;M|Bp6bVOX{ zM1Lb;hbJNSOW&K6Eu46heE!gxM@A)$8m6Rf39&ZOO@Z;xB}+;h-D^2opEms9&;WX!zd>S@I7aE z=zGoDS>bZHmNwcxb*jCYgpr@s}}{rg=g+P+bRg8&Fi1%6}sSI`XfHr z!~a~o0=k@a0qY0#fyz(wVgsmx7ROr-?5*Rfrdy1vIfuj}JFuh~=E~+z|KW8r--1GX zrb^@J8L7il4|ja-Nz2Y~f;+kR3Q%?^`(p!zG%t=t;SO=J3~Kg2N5;OsB_1umzGfEJ znDeMX5G29jslQ85x>zXMO53d#@1i+wQV&o+VKF0`H>`#tR5V3e4t&HmGE8%m2kP?a zyZ+1QwqjOV3c(-Xw`O}5uQA4De_51_$Dc3di`z^ zFhmmjrUnRR#q=aEk)I?!r3K6CdaQL_)Nf<`-UiFhIbwel-O!)gy$`I*UI_gWMg8n2 z{afNp|1qq-pyW#tTU+{RLh|?YKUi_~NJ6Mhs_q*bjL31g6KbC+1j|Llet)k*baUic zxw~BA(lh8qZh$fi{Nh+Jz<$V2Myh=-msk{=`?$kfM+i;2MyKu)mb~pTUY$D?Amc*a zoBT#=He-g(u+sk;Z)5)iNr@o(6*>Hm*G+N?R-c03atKFUXkLlS`Sw9$Zt6(L_)MA6 z3L9JuS$pju|dm;lvsyq-WB z=vI4t_n~xwgKWoHH1&L+^r5tkc1pPZH*L!ghtj+%S>k!4Lu+HlgF|zQV}kaZ$!r!$ zfv+osg-+L1#iz0u@d!;?3{9;hyX*xl;Chq*@HW1Zsd&+B64Ee(%upA6C@P<2yzTS} zHoC|e4`=QY8WzIfuzYx1QxENR^o*9<1AC*F);kHxIi@2#V3_r1i+PUbOOV6UnuX>i zMacul!lLI!?5A|fkC0JHW5Z4bQSuiMMB~%yW$gVmrSG^d9MB4fW6x{8Gn1ecp?*@kUhDUyaqR)lr&^{U1Bp z*?llmgJ<+)=c5_P!+vt$9@$1RZ@nq)8iLx+?hA&}*rJ-7(&?E#Fwt2XK znqhniOiPEmD+RdE4}VwB#f9VKt^@V;1?NnY?!;?chZHybVC`zsB95DXXdPJuqb?NiyXl&n0%T=!B9j^6712v=^)kxm5qCOJ10 zH}UJi)g-MbMd@krT6!`0+!cOwQ;-T;FrmG&n*#=UCL35QViXS}yd!Y2=yL(6JN!`B zg#yH}AqIEjcGmii#GSHafj#N828UA|{SC&<^FVLOjI1osH(L_cS#D;<9@6AMO_OYR z0U{d%WSjXjC%q05Ba08M;*oHScjod-dG9iIya~aqe7Z@_#ABs3Q?}?369%Y*O<0 zsTBtJEs_MBWq}`7J1;9BhpS!1jb{RZ6f7M1P{RwjP~ti6SL!6&010+w%nz-AA%Z&-Y;+G7$@elk*dZ zi;Dwe`XZY2%jaZ1{DrHDDxMj?haJ52InY+@IrxY>KbA@3uStn@CuzbX`ozXQ#rnT* zI(7&Yw&BG9(sEN~cftb7UGW+0H|UuDs+(f%_=iNcqXOt^7t~_1iI|TM^VqMbRVFc$ z%$~(UH1QNmfAKw85~$jtm74ODaKw4cd!5?>wBAyr2e3Ae!UfY*psiV2F`zK~tz+(; zSNX~Cx7MW2j3<3YKK^Q@P+~%yS~@=;aO2I zAD)$T(9c=Z^{p(@#CU*hjhOka*uXe!IZ^oTtzTCc6$2kh!ROCBDh^LfQamuD3ZQML z8w)GPhf#0gUVr-qamdAOze+0}xw%`=6Lx)O&0}3sfx(=O2;tHaIq@0-)ICAue0VBz z0x#G-t`-8~;yqu1o>|=u*yRY=yw{D)Z=twGp3H!)JB?*@ycnD1n*s=U0&fPkFZ26R?v_1n!sF0o#=Q$dfpn`zS9 znYJ$uP5y3LM;>~AY^T(46pIO$q}D`h`yQxIN|Vzx8iKqB#wi;E<97&=Os zORxqe53Ov=hsgLa{QEGirl(9RG_NMs-uKz@=1d?>VpBERfyS0pR~FTnuaS>Ryd5H z2-|O&`!LdWk>t#SRvCxh+t?6D&%0Ncl-O5^J4ux>N+w2CIOMmLy>Pe!L*!``(8;?p zk1NRmhn|u%m_tLCWVVG*d5fYdptXCLdot!bA>w51ta6)nH9=7qs zV0vkC>-Qk$X@JeBqD<-#2w@k^-YNC)h)b@X^1^QX&T05i4QN_?^!PSJFPXspxFa^A z^)R5_4j1`~nCBdyJDdKFh3ViOi_-mCc&|$#PG=+6KJ@eFXKFU|y?-j(s4F4( zG{3&3(*|JmEvZ?4WD)<(&nAaJkzaPf_@d$_4Csm$yJ{j@Bf}7}r`=_whMK`lNPF{c z8Y_e4ZYCnUeV6(CXg9E1r;z!)0Fs`=Li)G6nX3PE4A3&|)B9fvmVBSexWEY1RLWN8 zxm0o<{WX)jN97tZWj3@i=I5}+K?`$AaPqZ6*PWdecx%=jYKsHgBiJ24DQ$OT7@D(y z!Lpxp`A~QBe6?p-7~(4pEhQW2G(^JPoE%ZhRu2a=VQ$fP?VDh0?R33d$uy@ygomc> z&2@8<`kZ_mGWiM6pyZE>3mfREZC%S+QbJ+D#5BKV!(P}@ot;AP^bD^(=v*V^64`8l z?)&X5FHbnd7x&UP&a0;18F|UU11WOd(VLJOn~!`yq+SGu?8>ZC)g2$n^_??GGVbH` z=fLyN%)x*!Pz7lob_NFD)t_G&9Ua|lPHgrx@zeudgK1Ar6NckC$139@;*$K8;+bZ7 zac7unSgG1e6t@TD*}~=>P~T7utHS4EozI|yE4qOrLv{^rr6^M@UY+#ON8=9h_R?oB zzU`>mPvlOdSCM%@#VF+ZDRTE!Wo7<<-DxX`KirF$5;0c3mUcT!`-cl#Np zZsyOY@e~USP~bRIi}x50v8xVbs{Js##InhmSk_zAG)9+hU$KY8MU>%VDkA8sYv|Iw z@qNmCQ`X}L-fu)}$g1v7d{?&DFKP2fnkZB%B8(9@Z>LW+y3+h8himkD$LhJlcp8;m8QAU}Z0Rw9%B;zcAW`ti zm>Piqkp0dN6(o{0VA=J-tldcAXsyIwG}d<>odw{0lD-!ye!T^{5Jk$iR)p!4$aYm)?T5 z5@lstO)l{WRgnnzJ%aK4rMN(h17(`N{=cXB$75vea_<|P>)&5IT_1I_zHjG;A6wW0 zLB#)m8twi6LJtTUZCddcZSAn5p*|bHC?|;@BBREo*NP+!6(au!M)UI3tEUf`Qf$fd z;Z~Ekx6O9kJ-EYyQk{E$ssP*pFF<3&9cddFPz|am>%j`SZE|j~6fC7${)>Hxc(`BH zNUu{;ajWJn+ZIRo&kMRUrd9s)rKDRtP0W`OsMh@M!z}w+n4g5+A_^ zUQx{hTw$MJD|XOQ2_{U3wkDn}tVHj!s#`Fbeg%6KOojbgF*wxU9U2iRP*78`d{m}$ zJpSfn1WXlB4y(lZEq{R(*-X2W4Jsq<3@}e>JTYNEILVJKWOWFvUHchjf|*CXT@(ct$}C+_hY9L`r^NcYJBnF}7* zs#Z%^cxac`M7UUtI?{M33Uy8;H^Lc;Zbv_(QA3leJFRw|E^eQYP@U|Qgyjt98(Xdz z(993CvXQdxYLYs%sECT1XJcrqj(ge|R1d?;{Gd*uGw+7Z{D2?}kGhha8S6@{n)j0* zBJ(7ISWCZ>?KLdDs=pb*Oak-yRMOCzhhmZy@%=JSzf)3?n@H|vk!h7)=pKp=Sgl9E zyEI1p35)O6Oz~Y_W(4{P{nWEF4uYsVMH=7s zOBNdODqxxB;N3I~_w7GZewd0I{Nozm$#yR;4FAO``E5!F;4VIaYu)T72XOX{ODBL* zrqd8ZDw-;<&9fmpL0B0W+i%zDX{ocj6|;XO)PR#i)RrcC?(N7A#XeKw$7D)Q`0Y%q|0;pHVI;H1*fe4b&U zlJ!&Lk5uG#7<#lPDx6WM&j)KQ+NswjaK~v&f;i(FqscX&2U8S017T~=UNgpCWZTwe znKA>z9sYd6&-Jw>Ogi~LKxN3pwcY|flL_D*etv(SIr}Zz*kS^yTq6Ih3~1l0tEl1|fUrL2!AI;7=xVb&I7EtvL ziBir!y3MDWq3gr8kd|Qe3L{Up|9x6Lu`DOsyER55d_7u?wAGWz^O~EEK_ulu$LmO5 z=)1z&zF6_lI~Axruy>L@?wxOeV6g_t@8ZpBo?mV+5?=7Wig6aG;2~XTT3L{HURET_ zxkbl3OlcU%MVe65FH)$CoY_{;LuiGp6Yc-PECt;`0A{gG1}ZFS>X?Mq zy7Qg0&zvXJcBdvxB?`gZ%2XdnZ^rTS{{=1%{}Z^}oD7hdX-I#N9uzeT>K58d3f#5b z7J5&{pQ#-$Fa6aDQp|=BS~2gIYjVFOfEhz{D*&6J1xMWCm?pia*RhCI>oU9-=?eQ| zl58d@$b{R^M3RZ7(BRC9}AL1J@^`Zx-~pI!cUQC3!>diihX`Yu=d0U>qmp z#s`GISM+8nIGWt$T%i3qGHGIV{B(aUFKE-HBDNg=VnjUnviK=?xK1jt_IH19DP~g3 zWCgST@kX_aO-6?hOkF?25<4e}OrB>d^MOaGR$|jcL31ay7~W@nG$esJu~ldptD*Wd z?kVa-?{7@Lb;ur^XP{-ZQ%CvqVl6dQ3F$P?1oRPUj@SQF5Ug<2#D9 zwm^`9^7(4`&-wO5j{X$6I!AT)+0J4hYtZe`k*$APH;^enw*1zj9o_ZowmuLDEns3# zs+d0-rmdbP?NLvp0SB(2{BiX%7w773^Sr6IdHuSV=~^ZxLP1f+t#pVGL%p)>#j`cO zz7wtySzfP+o@;UWeWJ1smU zE?+6X4U0qHPqEC=H;HO#kqvo;CCkBg3T($p5q5FyNPd)-$}zByFHcHI^-3zc$%qH;$Pn$)Y}5%%%X@)GndU_BcH?1sV+$1t8b^MN@P!gD7!i=+92 z9K6du!I=#J9pxnjzJZMgdAr4+(y_mU@cs|>-aD$PZG9WXiVfL{f`EW-6r@XyQgy4K zROuxYl};!MgbuNz(nOlnD7}S93!Ny4D7_{?fY3ro2uL85gd}%`bIy0q_`dsVcig}3 z*!;7|8mr7T=X~Gyna}giIrEBEe3PR_E|0FNX7lWb_4*IT+?WpNkNn?35j~dsd9=<2 z-;58p`+YO?0qSH@UeA5QG7_yYC2=d-F2bD;cUXXw747)c3tEkC2tW44!Qa{HK%$60 z<3YRMCr9xi)zFgj)ulJ+ruMNMKKWw+9YehY<<$c$^iyx)<_|Z3N~x3Iqf!z8BI}P+ zMgN&Bn_dPjDJfag?iYMqZ+lMD{m5j|$g6PIt*P5o`D;S5w%2DQyWok@a&}PewA&Aa zE*g3Rf%=8K~Bv&O8?mZ^Ur_Zul?WlL;QaPMKcpEZwv8ujX|f_Pfd9N z%y)by%MC=uLj0PR0{fhQ(R9^gHroQc|QA)Ka5*(p`5s#mjlK*Iq8vvH_l*4cpP2)73_`9ZKn3|8nNf18qM$6)sj@`E4<8 zyG3iT6zm6w$XzAd!#BRnd)~G$5BgwyrDHN?q9GJ^o*nG3Tw_}WGuoxJ+t4Cw{_Mup z(_DN_BjS42D{9m99MXCU!R@_T30{Dn3}0~-TXu%F2|DSz&U zwNuhyk*TTy*6@_GwFaqRzOF`wm)}J>)T{f~MlxAejzME?T2P}|B;~rn%YooO)iMtygk1O478rB1zD@{HRGE*G_Ll$aLyE_Z ztX_q{8^VSC8cU`Mv>9JwAAN5q@a!ru(Ubdbfz%$h6rmEe>0*fK@sEOsJJ~;Esrlk5v`udB! zFSr6DSDD^tzDDxpF(INAUH0hsy7|}{!3nB$)N|VsA(K?b@ZNJe53rw8m5Oaik6yWY zdHfBaM#aZV7wDuXejRYqg|h6c0{l*8NPR9`FdVmP0z1{TRRDP_9gxB{73;QNKYy-- zk^OzHmQBX~)xWP=)3lgwLtbuK!MZLlXzum;lmGYfDYtJIa~Um6vG+1X0(+T$30$@J zoTxwh*{06-GRh10Pug{8Vtv@O!0;k_(e$2wP46}42AXxxg#Sm*fj#AG?{DZ9;1Sq1 z^yW>-m1Dpj7p29;#~K32e?g(jwz7ObVuhjrJ(sWbHP=5DaIW3sHSQfA<~(`+E3ldC zRVdNyl9-reC&a_!Jscj#ujuk%b9wZfqRWZBhaMJS(>_wb2VXek&ShkuOos`>Wd z>eSuthv%Cpe~j58z6@7qw_&1vLnWG-y~vrvxbE%#77OzlwFYG+;q`ef%`C8#M_1ptdCS%>bYOKJUBFps=%?hr-%5p`EUm5=1j zG8)%lcqe8^-z?OB`|FBE?rSTHHu9ts}q3 z37A4^-|L$K?{YT9`jpIOu*u1Ymu6KV zfVGd+OVvWxD*_v5$;^W12Y}1L(Nh99@D`+tsMLRtUb&=Ubyfa z!an{_PlR78ak`TGo+Mi4RJ^E|nQgL03Haq1HU5DBoiVJBK?de8dr{u_jW zgjA@!azS23utJ^3fc@Z@ja&y93G#aIe0s;7ASstTKjf}IeolX@*cK=~_!UrPtmEQJ zm48&iWt~x1>nD$CNQXXbI$!qVwJ6cY+Bvxt=J;;ZyjP;B<&7c-M{VsXpjKX`6@>Gd zKEX=-)DvYExPpu{WYe72>Ln)EoOHjneDAJ^B<35WH|h(`RCmrk$*V{=ZPrQdkeKVb z5_BcYq@&$z>5=48?$VHGmgn_%<3oqr%(~4sbOoKjH8)jqd_6VF2&4B3y4E{Xs$N*) zZ0HrJG7D>Bhk2&2FxEw0ii#W8%ESl(jc^2L1V-;cQ=UPBG45CSOV!iqLmr1Yf*a9U}k{mZX-UJy-xx1Rd!px?# zhJd1fQe=1S_eUi~m2>jMzIL`fO0$)5D{mbM@eMFODm6w73JI`SPx>@+>~!lxo~g1V zWRAD>5teh!AoN$Kq|Y_^Ji?8^Uyy;)!_*{|-)aVG+0z|WD?5qzYo%ueI7At9K>%*!x_UQFId*=@PqwUnz-5_kOo+dm ztFEk;WroSw2l8=3<;K5OH@H+vt5vxX&f_S_ZJ*x1@+M(n?xVo1^%c@d4vs#4pv_XE zXSADlFNNqcTQ@RLa=f^AjkeDjC$--oPO&5uiyK{hEU!L8NjUc$>?vDs0iKKbxKOMZ z6I$=xaDi&@lfSXdquJ@ggT3P4c+B;{veU=OT-w|4fOm-2?08toEC~h4j|UH?Mk#}) zh&!v#h8LV;j`3CQD^o=34IZrGAt)JSH%G8SO$jv(O*+LSOMGMes9S3dUy}Pc0Zt$q z;KYd8qz)y2dZzIIYOa8bkb25rJM%V!qVH~NSIw2@L)Q^^31hC%fQf)0kJ09Si(ulD z@6G!xJ$-M!k~z0iwXU%5p|q<3`lN({NwY=h=O|JaXwcU5+X-dMffK0#X+5bbR=?Bp zkD7G9_v=cV@p8}+?%(*JKK5W;+a)Re-LSZMUAgs6+CqRA-2`S``7ZWd+;^ibGceB|_jb$7!Bv4jQ#0H~+$hVeAXY@H3{c6B0_MJ` zGm(YNy6&fa>(;GJKkfh0E&kVz^YB5A@MTV|?Pr=>b-hb#?IM;%W&=|8YsV(S*1PMM zD>@GXuiZEfw0ZciW5ufttD4~?Fn$1Hzb?SV&5i5q%~UJ!S49AO=@DHc=3O@^DQLD| z`f4Z&I6BMHr!*;top)IwLgZl3FpEPC^eh?PI)FM6;KUPmEf)Blg;0yTdgKolU zLj}uIG*{TBE0kP~1splYhy>fnI{2D@A8I1V_!wU~Gw@QubZACokxwD*O?rJ*uY7tmj)cWDkaimoj;5ox-W8yLT^`n}I~s-P zoE#js13*h`2uWGVYVZx*G78h#%3>5Zuf5=6Oz9Xct`%gNZCu7eHd8bUVgB7(16UDS zz3N&1SP8W8(eigT_w>rG?9-!E5-rWzhYG$~dEPu!5?-qF(4y5ZUgf5TMQUE5MK>+# zD7kd3BE5ZVv7-kizYhfTmW%9WYZn+EQViY56w%B@hc8z(Z%(kvkTAL+t^d|S^#)37 z@OW?2CkJL9nEJiasL*uU(U>qGWq8B9ul|R!nrxnB#vdhL%EsqDo}QLKAPgi*HF*u) zJc7STHU>U*3%CA5(BgKuTLCTzwCu>i@dX0J+(oGa2Mz>0W=x1=4p;VSAqC}FckDLj zIyc5ed!>|Vt5j3u_Py{qKaqYK_v&D$eMDVT_p<|>yRPrg4LW&Gyd2h6$;n%kzpQQG z-{dVPU+!jKK7F^ zmAx`I9oXT&{V_XnN}q_*g?oYd($(jF zbcyuR)DU4GEv{ylxq2^LDA^Pl03ec-^Xv*FbVwnq3QoXb#OJc=)QkZiy4FT&-~<8} zu~xIOLSpG?Jf6SFC>ci&OqS#hF!`XWqXpY}J`7nvIxbxY@7ont74s&Jr@LRrgEUg>&VhP}KbLK8mLp^3|(D1jOQ(FWz_7=k28K+7H|vkB%riKj{1I@--+S z(OL{|YdCmHJg8cy)FAViatSZEbkJQ0oU54j`=gs(U^ny@LlPI9XXlBH@YPP4O~?I0 zs(7u|8EK4h0T%dyZGlOk#%ZpQxpN@E9{0K?)|Ay?Fn6O3B+>CEVm_2i z$++Z#uEpS?*!k8pn@VjDSLH^{g1eWNeCFy`(ult(ix6sgeo=lDf>AoFgB(~(4XCxF zTboXGzu78PeCHW6LhnI#q5x-6coPWd$n&cHcYC#1jT*FVBRHM4$Q3DS6TIx*#DLLt zXe1Gs%_+qS2IcduwClgoi$C>{16dju?Vhxq6(T$Y5{>L^Dv&j0(d9P#wmw+TpKz{m zH890g&1b?}B+IU0MH^(0bB+Wx4Md~HKw6)b5@N~U%rQV|b@$*$Yt8D~(pO_@A44Tv z$V(mlqY|&k?t^+AW@UT<4Lm3~bQe>e;IG;*NlqrazD?_&{bGutp42YGRfU&?v(fhj zpbrI3Qp*CDjyr5WXRc9K2XI@vqKsV#axl=ozRc1txUQ^zMzU$PT;7gVPolQTMHq{U ziV`!FxvU6+DdtunRYk{411vc77%q_56L))AZoe3Y5S^Hu0x4@${~&DnnI>pO2+Qed zT>t*@=;55Cc*;u`-fUgm;Ac_YI5}KSwSfl`9NXm{j+)y2o}9E=tiPYIrT^?lis0%? zva1jpx_l|quu8YVj{eJC%M{~32}}0EH4kf2O+p8i*>-RwQzI1Rq*1ON#qnvTr@^G2 z{5`Z7shApV2-id;h#M7~w#SKJftB7=$L2+t(;^$Gymoxf|@9MduzHF&#pW z(S4MZlyZAv%yn9|16?^(;5rc0{C zZg!K@E&{W4pbexPDFyIdpC!BJ%18x8v`N{2_Eafh56?DZitX3au!|V5k24DB-W;@J z-;|#=yD(l;wdk%aec;Rut=ZQuz>$OF;O)okOE_-a0KzHz@BcjUeWGRGMjjt**D%N`dGB;KOv#4x42F%70%Svp2+IFlE_B)=tXyZF~*Inqn zEzLE@aK-B2$anf<%F##vp z-?}yv2g?=LDtFpXYFEB5nL0wdlNm}jBEe`NmbRRR|J?)h&85@=I3^IgI+z376t6Gd z=1O7?7Hq^=+U0?EX9L-YYDD4$m19wG0lncs-8~>Ua9nQjmur^!QXAg}rT~o$-(m!+ zeLujPgA#7AMLZ&yNCU(e&!NX#F zV6cyCctAF}k+O`EzDfF8evHHI1$%f~`?weHe&g~4tF>UGro9Xsg}h$O7qOk2wY}IV z%u3gvsOLN>Jmk!i5E9Y*GyG;fI%A zd}==g(xp>-U^{Zucd6DITkl%OwszM;h;hu!h~HS4bq(_?31;)z(!m`iv9yF%lkt4< zI}wA)Kf?=DfCn%hTojSBL8GY8?Hh@2WI>{XoLy+-c9R-(Iw=zR$!y@2*1e^*G>*_- zBipiPB`}jbKHZSrXPiT)LY=M_nJJXrzv3kPlHOJD2W$(_L`j!@)9IN2 zKYEsHa=VI@)+VW?o2i@OWxH{hRaY!3K&k=H?62~QQn^ z8&;LvS4HHd3{3&u-kj<6LJMYJS{pa!a#JC5}_1U6O<2 zB)dPhGG$17_Cw8|zY&!&FSMXB_U`+aUG1Ssn_8^W9=Tnx1~Ucr5N%oi*j_GzML(AM zm0nZ;w`lhbM#RaKIHBYa+DUM~=SM1SdnheI_M(KJUrz=pf!(Yo-D%V%>0WI+V8?a- z_#d65#AB5MKVM#-_A!3V3wyD$3%>u^`+NOhg_E+D z&~S0)N-bq@UHO@bm1!qeaL}-Ld13VjQ*Wuvy0bB|4N1tl=yWf#p95_KM({e`P4Kzv z8syTQ7~a)>5r- zlt-lqxGJS7^{iEIY9qGl^Jt~uoQOe_W{%xF6uQ2DE7JE$;dJ2-Lgh(pYX+EVa z6#(p3{@PJbpj`X7WvqMMm%^8-o@#3NM2#6MnZOdI#<8*0=8Z~L*yfA=FP(m9s3dAc z&YnDUkCxP)79&ABbOOM5s7rqWyQ?-~F>ztE+xPLWou~gEhMnl*}sDy)K zi0#urhwh%C8R zcCW`f{v|Hfne%fvQs<8eMHl~&Zh^BI!@p@6f1XN_X!c4y)&7S6VFpy&0~cGdau{q^ zfVhj#TYcH^tI|#te6e_x@SK+-$~8D!Lk|LwN;KQw$9#4OE76q;E-DLK3%1+-{=q(M z#&&}KLZ>wZO3bx?(`ZkJ*L~^>vA>w)-#gg5RKV)T4Jp=9iAQXnTt?V#d~BIEj)B;$ z_b8{Ocg9KBG(t`PGK>`dd2dLS zv|irHqXsgvkc-J!ZOfXL*tAn)UlJBVNbwLP>LjOI`{TIHo0%$5q7&LbA;Qkyi&klg zUs5tcFVzY~RlC;;C&-LRsd&CKZ$5ERYbNa5;7X7iv~)km{XPG8Zo3HU@f&WqxWi}P zC)ItA!9B^6qjsfWH)iVE5o(!58?z!({>;WrG{rn*dWWwX8+}z{XE|zYI~6{hu7fX{ z{3WGfob{)`y||JuZUzrz;qM``17FlXr@m@b%u_1c(Ql}d65k~Fi|H?)_Oo*}*VV~z zFZLTCR`3t6OWrCF7y!LG=YT3BQ-6YVsl2^6q?WHvW&A8(W zSlHYB=e^b{J5{_382IjiSYaGZ5>^AHjL0=>TWAdU)J2pqmxlvYy9bR_d21ZYRk&&x zi#bg#rZy_n^W_I<7VR&vLrfC+V!$TZ?&~7B1vB? zXRyGCH1{ikIJ7p~4h2>_fk~xbp!K(DB{OHV+}w=r_BNdZh8ATg5xFdl624}J%&V;3 z&zn}ys;#$r<+O6QA|6>sI)ugm&itvjzkjpMY*(tHfPg>+ocjm|?N^qDYS@fJ;csGz z|2#}BPt+)5_-l=@+0r-8<%Z|njlZ*d&{hMM@CfZK^qK(;zLFvO1zCI7Aq>`vej0Zh%+1NsTW-VyIY$f==0nu87s5f~L-tS$R0=6Y6iso8%Jom=X$`mb!oYHx zJOk?sdLhi`8#BR6WuV>FG$Ez~HS_o#M*FH9F%LQFvXln`;~A5mA>R{p&k`Ku z^Mcg#3{{RgHLT;fP{jtaDAZ&RZNn62-ce!aJag_4$2GQ7;UdjDW0Wy4^r~OTwzbq3 z*`-&<=N}%z8YOL{iP)DwkoATvW)vDJ!dP?t$Jm^p?AaHld|=IoIoR7rH8tnwx=}Di{>`Y*Jb$2Ks5Q0hElzlQaBsHG~`>SR-~B~e=xjK=7hTb4;WML^zSg{J_y<@fiE?wCJ$bH zM{bbb1S@wE^G}~4tv}xU_6}SJ%z#!S4>Wpt4G4RYEjC}1cTsj0G9CAq91T_1%rN&V zUEs8$1WVX&j{+Nmr3S3BHF;f@F`8qbA=mJ@vr-nG8?GLZ6f1~qK3BX99*pqr)rdPF z(td?w>I0khU2XjB|MOta!;`jSOM8d$l0i)o=-|EZF=V z=p~iXyR#L)K&SAPJ&mRHgx}<1DU854p(@07#dO_JF_Qdj2oyu3Q2{Ir3F`53l zE*t7vu7@PpAf`U4%f|J#fE?0PvP)N#XZ}0-4!`ZXhxzNO*C~+v9wW14(7c)}1>y$x z;8&B-vsfQAMvN`R0!)PiPv2{0LIt-iDFGlIeo53M^^CvMPMPSy+WzQ9ZPv+!FQX}_ zSMwB5uA+LSOGm>6gY?ZRcuMCA(omT3xi34@Lpg7?BGz16O33ubN1HXGn&x`xoM~FW z_Iv-dj=2i0)*OL2LiIzh_uX#4c2ml^30wp+ngS~>pulzW!x`$Yl{G&W;CrHc@o#tgB382 z_DOCq7qIst2RhJ3VVd-BZX<*`yy{u-G9NO4c!{A~cUn`79!ky3?p2rCIcT6GOCGE; zYEk9wb_XU1V}fO*rLXwh!M=j7-)SpsA;-S3*y}HQ)nMz_txTI76}h7N_=S)yYdf`| zYNIVNwsBXvex~9DEfCH+z;hq{iLW#sLR!n%@I%rL0rrnWdFT{-q$Vtl&smWktb9^R`yM&0DI(>3g(NkE&?3myUJd3q;wVMegcAV9UhZ zXo-L0#`8x)EnPWetY?=a`8sZLceD&7eYba)c12VEVqd#3PG`(yr zG)CwyjMyAUS}TBk@`*qfvewn$!|T0C%k9VK*G#pZn4xKDfg?C89LjZn?PwwY+lsOU zX*mfO(|2(njZ0E*2Zz-1kCsKpo<*FJ233ylbXHm!!YDdjfrLat=NztvpOrtt&9@9^MPbuX8%%v7wRwG=u z=|Ot@G~mRRo5+wmK+yBieb z2$CzLrmN8P$7XTr)Gw32eYi;rEQa7lBLA<5 z=}|s|2aN2ar49wNSOzMKHmSJRK`-%|TP4kB6lKNNL1XwNMIRmQmY&OW|MaBWHN#8) z#=}f~onnxBhm^*&CtTR_VZSC%4YEY}C`fwi?x5-Q%-y@!Gmr8#e7D8QC*9S_SlWY2 zMK3J*Rfpd+Q*{XYXrR{su^DlM1H1}I~24B<#|teN-^{V&3Z zu1D_B^Fcy6)gbKy9JU_+eU#)t(qwMW(mXdSL(0tt^tic+Xm!eU#)KoRWL2Fh)3p89 zJxkViBjN&g`$maYa6*>KGpewkZ>Z^vSko>+4p3t``eF=wEFqcy)Kk{kWK8*UCn+m? z`aoK9FurCZ%2IrzOc3wI8c%Mk4^D-~P*Z&}%5_R-ectj|0R-`bcJ}C5&Em^01jI^P zL9-$zSTS^JHF5&X5P|@a3e(*=xfWXk?6v|(XB?jL>>$>8EbHhe02X}_e0&Q~WP!i` zhA2JbJc zPo-NHn&Rmb;(J`prM-ZAtQ1c>j?Ol;#+`b={$O$T2MdO7Ee}uj2_wQ+(f9H`oT*^) z6|0;7+T}Zzgs;eY*_BWZ@$UaB%(AR?(u#;v@Ci%cMM|M%U9e|=o$!FJ6`tPw;HN7l zGW?q}QW=`J8@g=VmXb@raZ8oTJR+<;(@89mJvT7-HYZ>9g$$@OBFs*-pf?=~B27S< z6PWU%WfRY38^q4A~I>+`y?L2@!M`{9*!OQ&->#NLX`-Dc+ zK7}8^tW!t~dKamQ-qA~jZl-<>K{jPN#JAq+&2wF)%THQOrrY&;(urVe6KIDN);o|dDQ=gR{abxgO} zdKHbr-3i?N{B{o-)-ikxVB2o!>>(nx_bU6SpN^(+FDu@x3O;}CiWVS^0h7nq>j~AY z+{UhhW0;D4Jki`Iw&5>%G}Q~o@o>NWsp~e_o86Na^3d}K3*#~^SAM+EwGFm{fUh5$ zIBqFCG&E;!QmrXlDtA2gghaOHP@Gp7;Zrs@-0~*Q4YUCenSH!$qD+1<+6?@R`u^xA zPN}$XjN^?~%iB~=AKIIU+21n51k4eXatj#;(P^4^CipMX*(>`d#Nx##_FBFuncfeD&dV63)2({jvf%xFu~4O3T8 zcT(s|n&v|oe}BIIaJUCzu(r{Q{?R#!VS-@IUkMltAXfMQ9p0-=86d#4gX?RKmKyZ! zE|jDDmF2=SNg;ug+Yia~4&iX-TJOhr2#+ndKc&F)ZmW)Pb-^uy*aXT!1}V6-FFOlU|RY1XswGRh^t}X=n;dbDHwB`faJ(- z%14~9qNFfARO+!-p`#_-@<(nugLp_L+AeRy(%|W~w&J6RR`booscBJekGWW=!Q|tS zgKZH7N8xfQqX*OdTn?&jJquN`3-|dsv@|teY%$u1S*nVa8Q`bZe@laU`H?qVd9L)h zSH_UZT?$)O+%;ZWp+ne%1$x|YRngI zQQcC)0e9sozURc6W5)#QCecRR8jMf&>mPEmND*#i1}6FeSuqEL+4yZ}g|%Bid&HQf zJsmh1o$)l3nn3{x4`rjYTcSVoYItZ%^nMKM{<%UEa>=FqK6HmWOV@T&~oQjNHw8Lbw@2I@OH_H#4iZl@~&sY6wYTrD2M3S75C- z*J+=AlxY?$p+Px4n|6%|NF+8%p|ikSqj*p3DSwX0(>c>L8tr6nou!glWE)2c;PlWU zZ6h4Tm;AHM$7FE53T_TB>}5$i^>D^9TQOv~hjyB!B=(MFav)AK3kU57B*d>M$2q_O zUz^$;PgeHzVw6$u2cg&L7?Yp7_?ljyE9+Dvq8@j+1@fA2>ZaYwIEUA#K`mztv_leK zTiR0JpDOFN9fC$TsJr2d)R@oc%L+fd{qyzJIurCwJzhuR-EaaXY6U*m9?Z2RF};`K{K|iEInfdBxTNGi!)_ zpKtAd`c7?CcL~L_TGZU*q@Ws3t1`?|FESL;im)v(%=BoOlz~0Tne=UyBQXn_iPA?? zzt%f(2AnmDpf{d8uaq;Kl2Y)TwR_fQP@f*5NpnX}^JF!o94_$2S5yP#3&tBjK2P^Z8mo{6KL0=ID$tHGHaZ!($7Xvw z+E25rfnQ&}TaBLV;e|i`_y)uh;BOz`M%c$c{s4%N5nhZB=YHT9pA=wY;1ys;A@(m> z7yaXahWX!1uv_6h`Ji)6k)1HI7 z72pVD?g4o(p2zo+UmnW?EY%m8Jz(=#-qGe7`vQ)A^1i@*SA7A|>uD4}5CXmWRcd7; z%+N}^a@3k6Ec*9q6|)WY`AfZ1!Ipaygb_vKvlAbfs$3mprn82E*X$=4%l9U7$(z%#8KDIxCSJH^DNlg=};;RO6JBW-B)-z0IpPl;Ir}y8M${%?`ekkjb*T zEN_BT;tRS-)aJ~$7o6O}>OsG2zl&gkO~pxD`+-`{+?ofOArTQ%aS_%pUc8uJ>!jsy zmR^Pr`qmPqpXWG#EL|#$b=YMHo)2R<3b^L@f7~^D$zWxO|H%QHW*Dri0 zQ1g*VSuRV>Wv(%U311qVpPm;Ii=%Ip896{wR%0T9l39bi`#qEDz6R0VxQorgkSk3Xhf)Tn&B@SCS*6>kvA?`E&@U!O})T~a{!x+6? z#0lF%&;6q;IFCPi)+K=%E~!41%bMpdpXstX-a4V>#Pn z0!{zG*o8~^G2=F3>o+uO>I{n>rsrd2CQCwBl4HTCFg=(m%l*zOvy{0=E_Pr&(;5K7 z?D88I41z`aM4G5g=8(Rj zSVO$*cq^cfHm|jNYoZwKDa;=cdYkq8!$osFH^LfNr(0D=kdlcJnWQSdvw0Q1j;N=0 z+dI3-qAfMTlemHQRg?7JT(+ifEdLiCxyVenq2&Oq)PXVTv*@5jHEyy4?yfzfZ(y(l z_$=a3s-kQ0V1Fv_Ne*RA^l#*{`vj5)xME5K7*Kgenc#aKM%;((N@=wuNSc~{6T6GAXwIkYu3^?_S?JQNl|1014(cIn@K+^!O>l)xHanJX% znE4d*U;WdYvQ4^;km4ZAe(j^SpZ~kJ{Xg9Aznxe#YD=8?{QfVDXsY?uJ9#sNs{P`_ z&pazKT-D9bps)c|jGk3|<`OUx`6|R73?yd4Ey^g5+zm5-$f=#$R+>+>k}finboY`h zwZHga%T;YGLW(jXu~9<4sdnIN8#_*jbVyb@F$7JeT^Q-6A+HjQfnsjR0bjxpPdC1f z62?-NbDOS!G?3k?$nL?1QAI(}V|COpr+YmCrxbO~3cc%;X7rV7gx7LCTnBkg@3~5b zG}4&!9D^=dP;T*|dfGwtO1GA1>5#d99}DbOt~iyh*-qoW`3@Acm-rLGBM+ zLZ8e<+)KgA4xz8Q6+q3C;~+BK;k{$$M8MX=I0Z~Kv;dZ}dmb&jWAip})CkC@US1xp zybOpI)hpY5e=WTg&nnc^TzhMjXqa)$nD`?UPoF%Akxk@%B$=vZl=sWL2D{RE?6^F= zI^$4D0%6PX_^W#AS@0DEZx^Y4E4>CJktl}1zDw#T8OoPmO8eoFjvZFl=Rf8`AO1C_ z4jM$3I!KnP$biYU($|QfT(J=xEu#+OhJf`sul*#w(b|zN6uf z$;}adH%uC0(Mn^799Dv>d}1wvwov`+sWE)>$UD@kr-MH& z@1|$P?&bUGr|ZMkh79nV#ZgBmCEb;qH!}l#Vi6%~{gI3+s1MD#0kzZ!=it~~yz{sl zu#<3SAYE2Z;7Pukc77%}oiH#))I&lFuojeV1mBRFJeN-6WMzJZ*x5Kx%ID0U&WYml z5tH~BR6d!p&~FGR<0Up%Ti@HHVSrTTJ8IqraVwwjk#ToAjVOZ9!IzA!cpwcgR7f9N z{cWCPb?Y)CcY^K+S)hNh1P2yZqLvJR+Sm{Vj6<^`SX5Eb%@O~$j$&0U*Q6r8wGQ4% zztz1n7T5MNL|lB!&xJJB@kTq};J|H5^T!4^H9Qnim zvZ*Qkk)tE`qoRWnv~M*^aEFqxDDO4d-k6|y8nYPWHGvR3jzJ5HaABLg;hPrc!D{%( z30%FYU6lbh?I_2mEjDWqmnN7Rqmof1_Cu`GNFX9v3LS4={&6_WGADX?NZFCoL@Wq? zH%SMkpVq|Sn${JzIBSyMr3`ZN_<2E<*LY+IUuLO_o%OAe(qYgo(%L+Ac?{`>u~bUb z>&=h`Sm@{`Vtuh}LJ~Ae3_GX*f8y<8?%7q@&@3b@WT~8i@|Lc(Wz~m;(e8yx#Ue7v zt&?7Mm9fYOoEOd?&o-542+(UrnUFF&Z^>aIqvbEEm?ku?`}ma-(A5g>8%j&FX+14} zb*uC!=O+wTY}d+G$@U&fNmm#i54x9*)#p_?K4o9P8+>Lg8P|jWC%1;+hY+&eR;5*6 zY^)tikae=vqv%WrR`Xe})p{5h1*ZG*SqN@9&o&p~Gjf4dsMUa3~@!P{ZIf0+tC~Ax1GJm4ME*EDRL6-Wapij+|=Zk%jb!mFiX+3rX#u- zW?3HA6&=!dsy%4CkN&D1*_f3NE8-O5(__@AULdQ4Kew@MVdsZ`E=;Pb`l6o4mgWrI z%5PU0p9K`Uw17xm>+XBJ>O)n=nkuFI)7drYu@9dzkNHOf!H)5{HoNMFvOqv+FO65d zC|3ijQdAn88Eu&#D-O~@RVtfy+#*O2ir%^tdPCHXRg1bz>4` z2>K)$B>quwiGmU#9U%v6ee-;^LP^=Rn_l!N(pgd^PIoBA#Bvkhubm8bDlM9o4|RwM z=HCQ)t$xr6zhm3EY=fq#dC_0sN|*CDBnkewve|%WDd8s_PPBkxJHb(akjZf{r{69# z(KJ1bT~JPoy|}Z|x%Rfow>xG*6b7S~;|5$s(C6YFu0}MC%FRP!HC8pPJ!MTB!so2< zwmrT^}KzVzL1DTNXrg~k+cV5PFfB~^{vV7 zCmd>fbX>C3K*E#LQW$4pO^Uuddq_Of+SMau=jF{x0^!wKqqZb`KHrlRFxo{cF-|}x zzMHfsc&)G)_lN3)og7tuxX=iR2pSedxg=F zCktenv{S~ur~-3;F0VWMkR`s>un~6m#N;~`+Br;i`30+tHKy;*;rpNbDH6W>Nc}aK zO6rcd=-Pk@ub5tagbN=kZpJmly>`Vcqq%_0B@Zn*R;Jv-Qhhw`m+@q30t8 zR}G7DEFin4!2QQCw=}LL3ur0g$a06a$Ej;uIR*^@RM63pN5B|1Ao3&sFls&uEIMA7 zkuTZ<8r>{(u#xHkt^EoL^9yzqK%fwII>*yeeGR3SiX#nDVkXXj-D%P*r>d zb8i<&kl8gQ97(+hH&=MnECh!(|Jppi*En<;9~I(qPeSJAI3FKC;!>&^niSm}_?EHw*l>;=eT%s63W@!Oz!~i$lBHM(5AFvf z_T&MchpFEV8yMv#BAO!P&miHiJ&hhJiH0g;kNMa~@hamVr1YA-lOlEFKh=z*T!aiD z&GoUShp%^Lww$#b=(rPCG+R4fa>9OxSAAfyUOI_(NeRejJ_J!MRFzKX`W5KiM7wjh zUtpRdC7=Im_l-717>l(ejfipghA)|DA>};7s&n*0Fq%a&VCM$=Wt`#IPaiw|5Vn3t zj-Pq?5BaWpu-nTk_H#gRN0TOV9eJ-|qI|5(mTy>oImaPzKwL1vr#jANxCXu%4`GDw zA}HqES}@Cy-#fEOhS$F0$1l)}*ttUH8&{Cs0PG-QnD;oAiU{2>_V0SNeCDKWM>8?M7<#xvo?lKi?+JQywE_tpU+N*a-(gWmKf4U8w}3IQB2G z((gI4gWXNBpH+hAbvlC6h#}FEJKbn`azJ}=ub13A$65n4ijcI46Hkxrw4ncV4G#ZQZa;V4n~4PHo<7fv_g7ej?&nDAf|#``lYAkg>}cDF!M8bMzlc*w_CX z5qm`R#v0(oc&i~Wr*47Z)c48Q-NUCd>yL~b88HM$=ci4fMGG4fB zlV6{-LJxC%T>%vC2V2KabDTQk1JfiA#K{!i-_aOqsipX7c2+NhpaW5%X^`rnqme_m9dUdGu4;sOn6c`F0F_pVI?G$z$1LsDOmbPr4+0rWMu3sBI{jJKzi)@HB z_|RJe`j3*#M#}owsw_FJw8#==2dm(7sZzR*+4PC-b8*z(X6qIr zVvmIEWsR(5*cmEs1@_`)Ize&l>a*7_$CXKEl&Tv)eN>(p7A90aFZEZ>9H4v|;Ia6_ zQAQ;G$MK%T5o>p+o?Jp8t~)HnHAk4xs~2z`)F}dBTu+JFgC4*HSutGP6;+Z=PFzXS zQo|sZ=yNe7R2(_rF_bz9cIX+X_|;&iVz5-|He?x!Sx$LwjjvRX!Kvi0T8Q!7RmC3C z>5>(22*8kPMU=`MVH48>++xKyVe7PrEdy~z&zz-OlTk6b_+j_ZkkoXJ)>#nc9hZ*! zKmY{LklNoOMO))6k^FZAq1iHOR}6d-U(}A&YV$k{y(EJ;BqQF^ zO)@)Unb<=}jC!fml={U&U+IyLn)$B_pW94Y?hP)WlEOq=S8kR_Ea*FqwwR`6o=EL) zyrcNRO4xW~>z3XruJ&Z5)4dSiFpJJZQb%;%doIiI^m`_w^D~-j^MEmwf&L$;ItQD? zb_g!n+4pE;rn)MT)0=b#q)xxtXqRR#OaI}ih4n&1ieUx~D#Us%^ML@mNe(9!;JpCE zTYJtRS!cR9PTAlN$`Ks+w)~!qb47;>#pdIh;G37q)h;pTdOU){4dZ_rPQI-}kNGVG zlhesXkU&OJQYHdmbokhl3>l&|Wl0@`EGc(Fb~{mLq$NiHH0uUrv1Vlf9A~Y5H#BFn zx-`kFq_a}@^$c~;59b9=_Yo%;MY}6#WykLZL7gHLdnpEa#kjMWOi%_Tb?sMCo3qS! z%9vZ=LeXmg!&q?GdsPhMP3o+4)idzUdXh zLj_|5-*>_dx!!f095>Daz?%8ckcbt}Al)3CmHfZDd+)HO*7WZe`?kSYz%2-RGbt~uAauERgVGHYe!$y)dGto!@DKew#fi;hPOx{vCKV%N6aMa2DapKALM4c#Tl z@|a^tyD+p2#LnOOZf$K@@k1))M6$S)f_kD3+M`>B;jjtJB}6}}dFm}Wo^`cAf(ATj zdikUpfXvHiNAlZJW1b5WQh5e*J;OX4#iNXxN_TSR_sP@4S@Gp0j=vKd zRNWkVf=yoZAAo!ycHc$_VV3+@Y>srVk!DU$4MAU&PNMl zBIlWuaHrMEVG=oRbqHb1&cUqv#Aw?Zx1!=Z_yho}UJ; zjQ2K5I}9$UyxsWGiQ7#and@;wEbbjk_YLY(k7gHsA1qtDUbfHjdyI^<$91aLexT+h z^>;uS$kuyUScNM{G`($}Z(*<+%>Q}}iBr__Q>SvJa#|pVLx3`?yonur@{s@1^A<0- z|A&ug|NUJK1D4&-rLkKFpmR}8>kol9_-RuO0Bov`abIl*rF^w^`T?8gxBVIJioTHHI&JH64%3mC^hbnJXqTMu@W653^Bme9r2|fk42}V0t)#Q@qM{%BS|TK6+may*oWbTtp4Q&l*bvp_ z4riywtqL5Pc|X2`AyS^1>bgkva#6)I{J<=Wv1@i`I3%5S0+=$~Qhos}e z6y|`KP|p38CxFdgBJUoIKkqI7$Y=ZlV(aD>GhwrNmpExmfGepS1Q9|a_8R}L`}>zw z(~&)>jfSdQJLf(jy5GtO_yjIxb3P)TU_}07 zoW&a4>H5rWBM}Hmbi;AV?HVJ^A@jhbIA~47rbd2>nE3)=f&ic5GV)|$ohSBAL|$DU z2|nLNgs#X_9!t4T!BtTuBJ0(R0O! zoezCPD^37DopR^x5$YId0NsK-n9_rDVd#iix)Z5xxmCcIYRjHkhR3x&cS`>fnSCOz zLw@)^+P~2zpT3tc&<46^C#)Et6Rl5I7q^}z>d%hv6T}zDn?}m2=VD}xrd71p&LhfB zk2jk9Fo%u%%f*@1e#nbkzoqe-d+#JeClGNvOpA2H)*wzxmH>s3P7C<>FpDfo;nJ@Z zBYbWg6hB2AMA+2E5H%E+!;#ySDLa&f zV{TDhjyWx^9x9XZ->T6Yj9cq0(eZ&eM~S}HDTzU(WQe3c!srzZQ(Z5>QyeVIWYo3m zg1m!8@H87uz$&w_Yt_59_S+veou5$|v2QCHl|{#P-=B3!&VP9`ZqA182Kz;?=&4{d zQepSbR8+x2u8qbh+PaBZ?io;Ta54!k=%g^_-5(5^kQS6ymyGHZZi%xxndI`(*HizI zt%zQz72rD={47dG)_*Ne(fbVR0TS_S9t1?4e;z2{UtJuyVyag}s-G;Ht`&EPYJyVb zf0`2Ry3Wt`3m{L=m!E7I5>k>VPdqG9fZ91E=jlw)2D=ips~{dm^-I~;8zW8JJ(DBc zKDDVbh^af&vn)URRbD(R?lk9C!v!HLc0!{DH{Yyl0;A@54@lXq9G1C(D+m{0Xl19Z zkE6n3Ik4KN?uHUG{l7uBm zh*!ZG%mx}gB+*r?aC9g>10LeBi|4mtWJ1FYJklp;Nm=+1rCJOQPc{1q@q01qZ{UOx?(h-baS~= zHQBI?+JoAFUNgCUZ=Sjv>rW7_!TAg69v@%aXoRj!eWB_$<#dwtiWPKL>>Iv)_8^DV z1n;WiN7wL6KJNNuAs+eTy^gfN9}Z2Z=)vcA1PqgGrD{U5E{i8Ad#v3$5%xjeb7`CgN!b?TVdLeY46!(+ zEb*Sb;#)c2D%7;cpNRF`Gt4SCNEGmy_mPVGaciHe*&*lUS@tVQCNI)^o) zs15@y?(QTXh>_O?;0y6P06gOmH(#b-dBVS+PkNzVCZA$bU&zr+YM)t|9ng$m=4nDV zegtM{LQ5Et_>C4=B;jyV*?JbIr1CeQ@bQ&T9D?2+kVU#5?^(rRGOfO6HGP9Pv~v-g z-%=C~azE9s|ImPqbyop1M(@@}CPqzjdt&a`^&2p0&WI3U?QDuf-@4kaxw&5G8ubH- zfzPsQiigON@nP_W!<^3z0>~q)!R*gVHr#rkaN$zZ_O&Zd!MiFb!ttjfpKxoB+R7Za zD6%SP9WId#b8*Ej-s?3$Yn2=|2Xw6JPrPS(5u?S82PSu@1%Qo^r{!xs17s!FHM?(m zJY9Vl@sQ>|<+H3JWg&mfrV@`&+?MU-{9*a|pw8 z0Pg3}IQ`lsJL4{}lvk!P8X1Evz^bxO0^=6G{pj;d5z$P4(=Wr)cUH6HN2zMa+^!tU zDbK9jf*m#hqW|4@yeb`oqe%OwBRxU0g4WIS+lIl2;YeAxExKBTgYh}Ru!7SR%a;@F zbH9XhIq8%S#lh7l)0o`@ zQqiTM-z~*`YdKE`#%pG8U}2O3$7Y{JvdZP9WDBwN>?CGbl{jSqZ&HKM7#a-QFkTI4 zf?KFs&c&wyz7)TGz>+@ZoVKRCR(&^+sX1C!mgn&#=iQ#J-$wD3JCUDPUIld@pR@p5 zC)Jz-8GH-vef4W_>nBEb!)Y%w>l)Sr#QlCY{U%H`KVWCcvmgb-VaJ;6*v31DZ^|MiuWJOo|=z5VT>$IQcRkxIt$ZJ zXEj=*Tdq=o&y@9j5ZPY(D&#|E>zM9XB(aK1Rx$Lo)SR;JzZQDas5F}#wRyWiTO4qf@Y3v?M>8#0{q*O8H}9w}KL6g@YCzMKhz`zZ z_X%-2xhJgPwQa$h>3)ZI=sjpZA7`rb{&C5+!BcflRENS*cQ5Aj1$sRkJ22;C+$}GC zgx@!$n$1NryG+tn=>ukUnrV=aZgkCMY|tOouf0D9cYsfbGkV=(Cbh;EpjNTe^>^u! zp_Wr7Yhc3DjbqLD<`0Ge=r z(DS{Lv$|;1GIkaF;hF~uT)$*e5K{N7cp0#@j1*XF+0|l9=^;^t>g(@p*CD>)q`qjy za=+^%sIPPRVA$2OH1JoV$KFoB>60D6yHNF>o%HIc68zm-0cW$WujM5SDgNpvu=+^k zdV+gG%bcrY*qH!NXD^Yyr`9iKN)DKC9)$+iI@1OtPLaFRP~840_&0M4G6M4lM!!=EkW>9FT+`hZWNqy??7;Wlpey5$hP zhVfe)w%%zgva0KSc!=!Va{EH>{!G&_rJcy$saw%C(LDW2&cIwfV8Ih&DN7t3?OeWY zze&zn=7gm9ui`xQLYt_XNz~6N%dh##DF|waSDrB6J!jg#6of6NZH&%~$+bs*5;A<$ z8YW3tY!OnUO350h+(tm=4a!t%%<4RH?tDWc8N#kn7i5#qyJKgG+UITQ{qJ1K>7RVY z6{Z_BPx`)m?Ar>Wd^#@!>3dVS80zgPUUy%8;4Zl-W*s+fz{2cGrY^>=nD-Dp{Km!6 z9_)@b2?0H*Y?)f4Yu(}wzDpQrSfhiq&Pwl!=?Uj?b2(TP@MPEvmj=x>17 zQ5cbO-a3)?dz%P#Ac2@-`a}x1zAK>v*|c2Ty0@nw+1MkjEq1s>cR(P{pl=AUg)i@2 zQRPLO+}8;*uf&LcIe8ZC+9_W7FP}{%m3JRye7~Yp+G$}`dVZ_r^SQeZns1J_^3I6d&RDjQ6{^&NKPP%CsYRx{*zdC zaG@5WvE!UXH^)Rb-ExII8Gt%g^8C~5kkL$ageioar{*eyK?W?2HFm8QrK?J0BfXp- zQSflzBV1y$oSYtGQW8eyn&UszPL(of$~sXIp}`TK89}@0F>u21dK|=@ZKdQwjddY7 z_ZKgGEQqdTtyj9Ow1wFZuImmYyLgD#E*xxPq4JK|jxwqtX~ZceP~u-RwX-f2(?#96 zs`-h~=0Ab+Z!>RJ6gTzA;8u=c>Q`Z8c3pvcK|I$i>xI2g@!~!RVd%6rw(QZy({Jtj z^K(lb(huO<@m*9sjP7l49}(T=gi?!JbfS+1#2IiWp+`1Fmxo@+;pFVrai02WBfm2! zj79j}Vx9$1YmzA}=4ew4RI~>xY1ccYY3i1(JY4>e&MP^ycli}~JiV4nIGE5PWM!9b zG0cBR8;4DM$$U^53pRgd!W4k}Xs3`KBkX=ESh^z@;13O)2-EH*j^|uUo#bp+N*sCW z*{n}!CQyzqzUc;1#r9OGIF=7w0Me4*LQ}q#iiv^Oz=fgUK?Zz^`&(3v<61+1WeOZn z>IzLNX@nyO5M5R14x^~pJsdihf8_U`xztiY( zSv?7;M^_z-ZMlu#9jP6{mr9)5I z(>u#X+Ug6sbg@~fTbbB#b;c@oU2y^{?vQVJVGC5kjt`{;SuPkkB>3PoQ;E~m)3!V~ z!j@+QP`d4~*$`YB*2EQMC6QWwgmoHd;YQSyd|r$Jx?o~rXMbKR^87#qm-`_<0kAzS z{6#sJY;(&Uc6XXru}{53q5fKk{q|hUF*k9D1_M`-)$VTc=ss00<=s%GgPon(xF$ua zEWKyEkGcPH9TVGu7wrkUrgF-$|EcO+ZBXZ%-Bmxn zg4ety^=L~zCn`rPH(X||Q*5ty&l8RiRXj3skZNy!my9#&vj;tL9IOm<#L7o`)SPWb zdtl^O$(Ru#4|an>eMdiCcj9H{{+-gw)^qG@y&Pf+%Gv>;lpa|Z8%VR!E$k|ZI|yX{ z;G6agyi1#Tnde^9vOqP{^q7Gm#ff*~nudk(x)ZPBKAEmjmNbP>sd8j8%dX4_KSb3^ zja;Qr&GjOjljGVV%OT;0l}X(vP7qUnO>*DesJJrS@F1O`^SgFxRYkzoH-{ zJ)qSqBOqJHAaV?6{bY3DZyX^L-NF}AKDzamA`#c%_9uVHx&FnUrj&cdmzLgq7}Fzl zbiXDqFQR#hL3K+e7qdx?c4ta?DE;gh^$ME#Q_*DHBDc^#WTC)+yz5 zTqPMofi&Qk7iU7F*+2R)ZMS`Gv=q{2$eTyqANL9~cyl-)yeTB9>b$hTu^r0HqJtyR z4MLcG_o>B?}7KaBW=*UtN(exynRFTFp+|CSZ zDN!km@;merO=^Aew&w>2r}5CU8DTbho^eGf0V>~sg2#NnmycDinGL;+|MXfT=b25x z%ZTJ2b>H=RWt2R6?Kw5bo^mZCn#U+2!3Wi`aH&Zr4cLuHr$+@;!6irDK=?>Dfx`j7 z!4ak%Ri@!FE|?z19)m3lgE>mA?v%Ug+oPbv1Pw0qgtFKbf-wbWbV?zh(-q@Y7|pVP zJPNL|QFc4aT<{3MgDA#eHmlNNz2z5=UWBf%W_LBtPQ6|l6@c^?)Aza1nAIOrBr(wx zF1HkL4#@6Zqfq=E@qfLZpU1TcFE55V(i0E*vVUCAJGRgD->=Twaj#3b1_|hJ1)SxF z*e5iZpPA#iHu3k2RW9HBMf&3uAgdf$Sz)A)pDz6?WcCfuCwWh-!zPa0_WV`ahl}W; z-JxfeTkN*;$A|8#MvDN8+xMXdOu-NkSLW8*(L`U*JO?g@y1J`8>1ZO`l(Zw`*5v=j z#Ad%uuY0nZBqtl^f%L72i*+rOsB72&h1Oyg*zSAAD%lOnw6R#AiXJ*}Bzh$W4X3!U zdl(D!Q;zS^yn0kUE0YWLCbGD>hwd`{C{QJ3W&P{!(y8fsB_s27bwm0>`=Eao>oA-RNMO4B>^SW0e+SDf#>$lNW;ILjKZ`RI*G zMLTk~A*TykH|L9{`3H95E*2m;Z;f2iDXj$7QbT}qhusJ+kZYr=+AO%qO z_p@OYw9|G(UG(gv4b^9E*(Ii^So?4rL_Asz@F5OxXecS5J_9jV$( zxb959m9KafcH&J?7f=OHJ9fW-saEh65vTDB$xow;Hd5qJ>e}>sCg}!Ewr$XT7;P{S z5b?sd=1X$^BwH&B#ZI%$pd`C{c9j8D?maiz%R%Yki%)D~&gQhVGHvOaxiEA`-}}<0 z8uqy?3J2`f(@6FdcVw7%HNFXR`yiWkN|`ZG+Gs<7Y*pzNjIQ6l7GrNnm>A;xAmd$( zuUbl(uCugsQX*qyLoCKy8;|8NWKvWt_D5dtPv|z0QuJXrTeNDh%cRDVgpI=SBc9?x zGChwyh2f6WwglUTnD3gNT|pWIbxLhZBmF{*UYkuAx2;ru6F{;uRbv8)bY*l>#qJ-n z7_Dv{j#Bv*AXLsP0lH%6vy77{L-Z--`&opW*<28A8CI>z$>IOhs+x4yDXzBGmdExeDhtRsG_Bqt zdA2|-_gSXN+zPsqoSbX%oIH(K871e;~(%@3uBpV5phWj0Jbg$NTBO zk!s7awlSy|giUa;F?K%jFx1a43Aav6JQ;(UpT^O{$lVRPLYi^`?)J5i^%A5n8kOz! z>G|o$g(_M#dCvvUcqltmG?l#!OSk5jl`;n*;$Q5R2=vz|dlv{D&3O%XCo+cTDz>Uh zjVL|Ue?t`UWzn#0HFU2B_e23U!>!c)zCK-?$B{P8^x%Z6!i5SB1N*zwM=HDVld8EP z9|qqTlLg?%p1)X=TeP7yQL3x1R6A!48|rf?Hmo6&WP|j#rC3Q^!-B8N`V-xT;K*V2 zPoLHAJ3u@`&iUGIp13+YDSwC2F(A;^(c)hRZ*z%Bsf#)P%djHP26b}zzDRBD+5SO!Pmju z8FLrCHQW9Wbb}1Ks%DA|;Q}7kk%*_Z8ABc#+N<$dx_xh>?^ANSHt8Xh>=#{7KuxWnJy(C9A$X6T_>OF+R5-6-kfCm)=--BUtX0;lAMA;C;be_+> zwx0R)`uwtlaC_bJswmbODs6V@UH^U(Zs9GwW(n#C(cc0aHw^_+Uk7~f(s4-1C-emA z(S*u_d9(G2;M=!jE*WSC6eaa`UbX^93ES}?K92*6QLD6i@&2otu9e!0#^Q;-x)bVp zQRhH%7>8#mg_)o--{_ha)o3(WE$>KLk`1aNDj6?-7_)(*9qfQ7r>3{4Qs*5drNgr<}cK8qIHad`es??|PW5i#js=adbHO^Bi{>ME73&-R8^vboi-LDH{IT1tIB zagF$t^suUa>c|~7<=tRKy;i$VDPXW6kNpKw_&w~%J-mO9ZO<>l(nUbl2R_ z`{l74^N|bOi;i4-aplXNdj~Y@8u98Lmv$|m`zik#XYC~lvCrK@sh$QVdFS8WReN49 z8Pei$Wx=a6ZOrpRjI8fF?-`x^JEu*yUicWTl2RA9w{e%hz=CG&P?-D}DD3)Jcg2EL z)>8VWzjq>oNDuN4Yp5|=Vh=C4Kkd0c{wbTlUO zsz8%b2dKR)AFs&AQ#aaDYU!G+{{5ym#y`r$>TJcD$ z{S2Xd?izeIRrM$cJ!n{?bX)o8K?^ zj-h>wsSt6$6vauLUUXGd8)LR`JY%pqH+sZS$0;r~YOcA zfKWkc&T|aT>ZdRy=x+7IV`1-q;)N3e?%X+NYg6(;D zN}ESwh!dr{jyGtA%F7z%9$CApf7?zy^SCf&7R7lyq8%&i2m8ru&x3~-9SH_`OH8JP zn~iXqS&127HoccM@STYiI_BoZt%`7##x!XI58kXCyR1#7pOvVhhih1eivvKpwO!Yz zBfNfcVQ6Buv617lfsQsuh=YHUX!Il}keH}gVV*C?Qm4IB7UUz_=LG+nrkb?+Kt)G# zqz9xiWz)gB$uq|0(PhO^GM0(lz6#hWfSXh1j_5ONOI9qfsV6rKuvaV><>$T*75)Pl zrjGNN=Saep!;f=Ub||<&*_};eOHdcn?d zZ1mLYu4R!-2>m6C*u{P9Kt}*PLzt)lX@Vf5U5cNk`LcFp;0iUjPQ5?JlQp)U!hFx0 zZ-yUml;m53Ap>%4lZls?*AXcXKBE-0gp%splxeBipxdakv|8mP$v{SZFzYfosvJDBZBZgS~BWH<{PoDeFD z9Ekit2K_|EFseS*YS@daF8aHPOBKb4&s250tl_oBwJB|q_$JA*ypvTMu(k&d$sbC$ zpcMj@axe5TN*wt_cq8ep_;4GFIuRrTKclH6ML z$SSoWG^Qs&&pXV?pQSiyzE^i&^q1g!O@ZFqof1ByY@0yxXdVQH^2XBxv^)Snap|~{ zMcWix1(!;6abjv=mi@riN1BxD+L7tWPnq)GjaX{^Fe*AG#gPM}9ZWw~MOJdiJslfP zlPWCp9KGceXn&Bcavkq6_uMPCqPs)|-01gfd)V)1?InF0+Z6)rob1EExkBr?CwOES z&$ud|CoiC8@=f$87MT8M#Pp}NbnZ`UY4=K(+=7HN{SI|aW4!)FL{?i4g_@KN4z=8D zb=Q|;M@f>oa?8Po9&5=ZW;ISv1U$qv;vcpBC2LnSf00N=EdNj55quJndBJonA+OEa zu8e!V;nZ&cB=378HkyaSD|P^IctPA>u7(>D4o1L+#fuKpO@Ya9q}Hb7=)+WC;*+Nu zN~*Z`OPMMFlcq#gJ+rDm5!qrB3HXvgHO>A6pCnDstg5S*QP-8~nKC3dV6uu7VSMBK zUg{Ur;Yq%b5hj%c=k|d)a-;yPo&z@CsY5JpT$h;YxHihEYC#H>%w2H&NCx+HtaPCk zBp8F^r%MJjNu&nW($tWy*m^_pxPP3frm^x}-pzQolso>+CXV351XZ&VfjhBaacyp2 zEN9$C{7N+ccMY?;4x4D;gA4xqEPd|#+7FJ`-F+eGue-GEW4x~@kG|hGod4q#-{?OW zMeiA1Qv){!0(sl$$H%01|IvH)zG}JFk_Mk&@eaUzbokjdgkj=NKBu?9zPRK6FmrvV zq-aI4zb&-s)WjCh|v$*NS z4VNxW=8mF_fdf~+=4r3ue;>%($=_>F{qVu{@-78{=B1z@=$Zd=e?Bia`99L5nE>P_ z?exTwhc-g2O4+p&9i}~`-AisDIfZR7Dbw;wfiWHM{+F85rpvM^9mkja1#9-7!CE(1##j}o1h0O&?Q1juSfJ0CnCZs`ZGuJtetYwPj5ju$*1DP~LIXl0 zX5sNM2ibG;=93}vsAtdK1oc@XO7uEJ`tJJOlvt`i-{ysN@?MT=Q1!656J9B+k>vkd z-fWj3_VxpBU#__?>+M_?P)zydZR=;%dx>^dm4rQVlLl&q!HzsWmG|;r`BZwV9u?Xg z=a@3E^jTnpoZj-*kMPl2n>Xg;-wesmFN#x6S@XkvMxP(+u|=n&>s{?#YC_4#yJC9()k3!m6sY|Xie;K4efl|qx$Rfd=~)^V3GY;hveIpYI}UB zOZbo1qGbla{Z%Exd}BxY5tKelv$nZQWq9)t(j4oVZB?p0=gO1ae1c))h<=FVxMfU6 z`<)QZ3OGYM!XiU6cB9%PL-QQ)@@#SFKbW6^jsH&@-~hY+*OVaMvHrW~0a&B;_EJm))+oQUaARSj7L_l zn+swj!htw2qYiXC0?0+`<)q!jUBah^3jusJxM>>|#0Knk|C<%$N4?kJ_kQ=pu3f3E zs}HvwY~LdU0W-k8SRN8E;1KdX`9L}9edOoez43@PUAkiSSDCk*c=ed8O@TjB=7M~a z*WZuJKk)TEz!C*~c}vhouU22T)xKJ_8P~?Fbp%zK;5^d-xX+*hen2s|9Xg97q53g5 zB^yJ~ZgY72w}$CtJ*B*-wwZ@nrEJ*upB#A zxFP0$y2h+81K-atfNpV#dckyc-1h;Un|UAF!q8iN!coYw#~Pqk(;2n59}Jy5_Jxc- z733_|xS4%BF7CtgtFC4aw&0pT09vdUiq;ja)Sjw|=~5+m)+O)%L)mk;W?;TUB{Td- zeUNyy!NAa?D*&dy=rLTo=%p4>HKN%~F76LsJa8dK@)jV}a!fAn|6uzH>8>@2dY>s4 z+gHcTF7Vea?6vIy2Y%|=>zN$Y=V8TRtAjfZ4BGNoGu<&f5JU*C`f>%PzrNRVm**ts zp65aoetd0KeXhXNrSOv^h6Kv0ZLA%C(zFr9`4(0I@K`2Tv1r4@S5aS2YmlujZeT~&ZXE; z%T8dxzZmhNBwL_W3}~gmXBIf^EHxJTO=pOdW_-QSG>h1tBso+((FUgv7F$9{bu0HPK`T1} zcyHa9MFr@Unk9F*bmMPw)L1(=$S%xA84a)?J3T2m1IqlB_zfyr064ntz5mydbh&Fc z@g@9bsd#kKQJYJUeZ};aB^tByC{i^QKV$L;i!DHl`Pv2u&{t|#)4 z_m704%`YJFzJODW`L(0MG~IHN*In+gM!vY%;Jel%b23kkYsHw@`#$9GD>EIPsgd05 zS4Qv)tKTIOtf*R;H8@5lx!&N+axBi1yB(0jKm+xm{U+A^H__kSiPOGfDf-{bcu;IDj~$Ersg;xPZ3l=i)_^MI~Ms z(f-$ChrymfH`Y3;?jB2?b2}C?9&MHHxQ}s5g}D?wwf2X_`Cmv~q>>QlF6NO4<=HZ= zS-XLu33l>AyaN!Yk*%?K68roYQ(X&7e7r+ORl!5O5@P2sjr++@B&m589zGlW{}iTQ zoAVgb*`nJ<4(+ih%zpH0)Lx<>err^Gt|{7cNDMn3fLrcLQ*(|BEpnvC)994%FLlX3}1AO8YSQO-Wx@U-e;le zUX=#ldt|l|WX>1!5N$7feteD>u5ouxQa?px?yCs}3~cWe07%D-2pc*`{LI>niJY0; z=ZIdC&Ch;qbc!&WFp&42c=wnFPrJ0-8ebRnkT?jLo6?ty8Ct|n@B;XA zCtGpi;jz7{(7Fi!>rGF@W2{~Z3>rrOi^WSu+eT)9P*}M`IVk3m@@j+Q;>HR9E|A1n zeoG?J3rw9|ofn&3H+5o`wCqLeIZ9D6^hm!fjo}?LRe~xuXvM}=^A^2O{eu$w2m{Ss zPZtbn4Q<*52_*C~Hn_uC$NTzg&=<6UO57p<_62aKca02mox{wMh}a1rwm03mSZGW` z&dsTgOeY(oWjuB+7CXXyJ}?r00WO~E+uQT`o{n`;wja#NQLkF{_&BCRAi%!qBa5*t z(hj8l zMD=${9#Or!>;E*^It<_yE;QUBM%Z-^&d0NT{%$5%Ko%70Yi0b{w@^tJt9#c{_5J)6 zVO?g?{-*-C_JNKG@0zlc)^T(#zf{(nF*Rby((o|WVR?O>3Y>asH7^ay5Pz=ouj>cN z=rDroXc2z&JE3-~7^7))`Fy$jh`wh_5>*$oYhRZ)i$*K{q8Hafsd}|8!)=js<#o>J zJ=`>13hUm^f-)O|w|)5kEmRk9_&*WhDdTHcFpjl=Su*ZL~S?1d!EA2e9&)To- zQ&)k4t&YVu%WED<={2VNjT`CA0xtFBsV3zQ5p&}6OtTAZIO$#csu_7kH11_#_U zpPo%-P*A;K$0c=szEE*qR5)8!Jkrh_$k$NKF!cmvnygPMy23WM-{k?RN^Eg?dGXl( zh`+VZBnNOVPe6D+r#w_nMYy8pv@3kQt1y%SK&n2Gje%f=}Pz3>guI1HoRiR&U%KFW8Z#-ZaWeD_dc?D>&bEWUdVVbR_>E1!;;T8U@< z_#|m4Y4YX*bfRG~2D61Yc<|gYm(3VC>0%QH$?*1MW{GNXl`J*EUXmgH)=c7>O0eO zn4T7W-jSX4%9o5<&kGYl&=)5u-!4`XrOMRA6B%q!T~GuIze&b#0^%x^6*s@8!>{RU z#CJ(cGy_8npUHV*hmb#lv=PeLPD^3@AvPGdM!lV(+^<+=(5>qyrO6>_T6zO9(#&nivm zI_(|wfq$=v1>kUQ;M}qFt)3?>kh58hOXg^@!fkSNG0i?5GK^;|LtIHXZZ*hp_m~)8 zZ<@<)5|e_2zqaF0D# zEf-m@!xOtHK@f4bis2`^(yFk!ugu;NRdR8zI(D zG6oZISTr2w{fS)IXD#?<1)wNFF{xnx0bPDcpk%*5weIl2^Sx>s({^x$JbzJzg^7{ zmXkHM33&h8G?LoRsWXZgKUBo03t?BN&*eBY?*QW#{UH!B(! zM$om-nwUCVFFfD`xiL^>RQ5G;>5(-iO0=3GqDPaiYOr?#U77#f$Qm%E5V2qFobEE( z#vxxrVbJAwWBQIe`5fi|^6r^+v}fzTlYP?4(e4@%E>m4f4c#~p-zd}Lf8BBCCCuL^ zS$XI+KAdUjIRD$l`@OUV&o z>vxg@A6=IB7=eXmb8%y#q<54JZ5)NTX(QEaQ#F#`OOjX9YUr6!uKRe6mG;X|(D&K0 zzNObp5mupn3!>_{GwCYE+VWw$FKlx_U1_+j^o2i z?gR#I0)1Pi>3EG5xA_*lti z{jscPLYrc@QvpQXrLAA!K2BhiRbz=f`nBzZur(Jy(jNXf^Q};VBtkkRwdKl9gjbmd zA|%G;W@TvAN54hmu!E1j8G3ecUT!0NtZ=@c6&yhl#dka?$Y~xIXTY$h_=Xy|<3ve& zVbS2jB-4q{HxoDJ2y^|hpf#&;J5n^rzETzPHPg1sTR$I-r9nFJug8oFEdod(YLtc= zhViD$I<9!(Fk||T`HeKFkMQ~QkhInr;&p^l1Y^3D27|sbX!5fY%eo-w6rIYquM zN6vT7TAde=tMV2nZIUWt5l|=26QgwOJYAPyMrFg+Jn@s&G6g>4rh;0smQUIY0dx?9 z6E(n=j~KN5gzZGL28ismMu;Vb6PY|>s-w0ghA(atihU8jIN`5*Ok~p}k}JxLiFSw^ z_y&!$oDlQ4sn`kA1xW1Ka68N9{HkNl6w8lo23QSmNQQBqYQ57of2rBf^tFJi%mp~j zqvt}8XVsle!mwmGEnrl_WrVif3$zd`Y#r-=MfuS->nB+VVYW7T4d@A)!4qH+%DXBV zp$JvQTp=_Kl^pSDzVJcPVws9kj+OqnFr{0b@?33{jq)8EqbS_gGzFyB!%E6V zfIa93M8bL*9S{bmfgoRO*c>&NOqiO`^+YJQD<4)*ZZXYTE%B9+1_N|k)^q?LO6{+nr<7j1-JG(XJRbiv2SxOjw?X5p%P zRwB}Ci6m5~3+pc3S9k86N0tPN9XLU~AfELM21q`X(xeIHoOkU`V-foPL7h^GZC-oJ z<9Txp;;u$5AdeH?K|vS1V0V6+kgX`xB1eg_KW)d~p4STr2_@st!ahb`xjTMZ4W0II z+5b-UT1?brbWZIHYn)wd?#5RLP88+mt0Pdl7NIIir?7r_rqOahv2p~mbQTg)3dVJm z9z%pkFSDDc?vzy(6yHdM07DnKfDJgvv<=f*ImUsg}9yhu^19k^c)diANC@n8FMxZ z{Ces~l@CIv_Z(DyCKO}y{sj*#<62_boFVlUlr@w@3m7hitFA}Re;UqXib#1dJ=2Tb z6OaNMgV$a9+#71`>Kutxn#&AMnX*G~=~>e0UJF#C9l@d_ZkD?3DpS5 z@%nku{4rclm?de9`~+9Qpzs_|!m8=pozGr&Bo71ZAo}LG6h3y!x+wuQqs$#GaA84Z zg6nYfPc~xd4YB}`13_7?f6on&_?ZE-j|YHh^eNag|G>w-RL=TaB4 z(*H`|vE*n9?<0-PU6tSSgo|MC2d zQfI30en|c+6KK{&Qd@CiNIe@OX{`6U6Yl-nBD>{ze!Q9wcGPrajBF=*U~oEyU8gDP zH&Gay$;~xrv#G-cbn;q&Gy*L^Ot)Krlo!mEHY-6R%LaWYR2isW(i1Pe;9}PS{gDaX zfmO(yjVnHsS@eWXb=KoTOLYx4<|q6I*cZYi+q^U;rj{SL#CY=Q@XV!)!v%F z!3Ahg-m*!5+k8^ujj=A*2b0q;;c@{chL;b6BWWJ_Nnr)#7S$~CM5axLQ>E$I?H*`4 z-*2>8md4O=wYCvurw5QZGoc!n64jI>lj$JH;O!brMJnZ@o`s9QP?)0603<75NW4Cz z7M8_{V8LBZIm*wHunk6y&rlZ^-kPLeOBTZnqT-dHL1ikebsKKOyEiE2cOExPcz^-T znw?f-m0%px8hF>K_S_M0Qh=$h0h!^h%4q5a2q+kn7p7i`1*O(B43=dh1(KeiVV_e7n1{L-br=StXB5AX_hcLJhqxz>?G zB>WBrkf|!q1^P_@M{p89#QTGn0uY~nNdiib!q?Pgt^iFj(-+T8(5UT)?CHl74MD~- zsp&SKgi%-=YE$0R<|cmnF!+uy)7T;6dI2h{H^fe_+rMOX$=N0lG7%>`fZ4Oq0^tT?amJ%UW`tbvU>-0Ie74(p<^FwxOV>y zuj9D>-UlfeRlF8U`RX0|==R`22mgl8`KpR;%mj4F@lYw(a~V?8U3V`h=3kAls@@)= zDs+Lg%UVH0$4s5<--B)*kuUMYl2{&k`^0Nmc$tm3FEU{e^YYhpt5}JA%G^oN2#Zd2v&TM-=bf11vtdU75^=JY%0_vL~tT zwq)z^j7*!@=)s4H`(f7xkR}GIDR=vScmJ^5&FTY|ekU_@iQ1QaL1zTgZv{u_uN_G} zUHQrcD@#-z3(TKX=K9m;5CI<~U@toU+GME67{kjAZubt+kQsL7F~C50UTE-h_KNA` zKPxemo@zgkZY^4D^88v?qT;y{uE>F?6>dxf{&sF zRIqac6QqLEKLJ&hQ>pxm>P<&=mBb4={zGjJE>Z40c6!yZfBz-~UOr>+kGC1H@t3FD zd}F?Q_kdX%`1}7K8+dhplh#dfk2F~g)EJ(a_}3PG?>VTZ?=o}ASka$d0k;!$@4|Xq z7>5~sf)8P zzigFEflhw@mIwB z-gf^!v-v>L7ROc(cFJbE?}W$oX#d(4a#_o?&y zeDgh_g80>nU3x-g6X<7?6*#Vv+tHqHP<039DXvj8M1f1Y!BiA7)b-c)fU?v+R6kaU zxNVnco04h(HPNVyo#aOprr>W#`1IRV^j{1@97yVa=vYfqO>w_LOx+8bNB(WCimw?vD2p!JGM3$li>3p@=%s0~!#Cf}h^*0IUtASK* zQQ8qHNK>G`)Un>VDPQYaf3ueP+Oy(%g|8x91zdYMT|_K7zP~|0I(9Wz+Qfl!Xj>sU z2Oi;%bu3i$%U2BQ-c2^KAMI~g$hPt6FE4zl!0R#{vmFe1XY@ZJkK>raeNfZ!$ zTcIwGqI#s_SYM{R%b{E>y8pRgukcs8fWJ!?Zs- z<$~Q@4InV5MQY)b%-C|;Hbi7wO}-SrUi%ALwWv=--g{x;U_#?kHn7jV)7!$@f2JD) zN2>eSB5Y18EouY9f6oN=8XKod%LXdkF$#%;FucVZ6l;~A6k6MNqCF>f!d$s)kCLw zev16gWNH#k!$fB$k-qDaR~6_sgYAI^s2+gGYG3-z|3g&)=nJp|IM8U6HzC;2r(FfN*2*lpn68Sl$GP#R!uDs2B@0)BJnFw~%(3i+tw=Vs;X*w%zd^1%9 z$(u1xq!|DT;UziF)kRgD)PKZ`<{j<7@Fo6;BiE(p{^IsKU-M0GKK@b0C9TRma`#Pe zyN!mAR_&}`_R_r`(iUH*92Jvkd0OSWNi5&O@j&j8cnD?t!b;E04ep+PN*|yZ0VnjO zHt~gSDyO`SRUylZhSligS45~zD<*$&9j_@ir-XYCgtL1hRgkDdPtf%7)q`Egf{152 z-`?fv^enqjanFE@^F3x}a)t&*zRg{&B=!v`ro!Q^fqwK3XnnK^aLo5{kAI=p`fyJQ ztS$P%=AS&BcbGKAeiY}ma`?-)0LQ}Wy7~2|EV#m}A=TWmg5Rxy?R+<{nOsF*zV+aL E0m_@JSO5S3 literal 0 HcmV?d00001 diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png b/windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png new file mode 100644 index 0000000000000000000000000000000000000000..3a512d8458ec78bf7397c30984c86aebb3047b2a GIT binary patch literal 94004 zcmbrm1ys{*{5L#$^aco1av*|Aql7d}zycLix&{IYQUW7KGh~zjDvg1Gv~*+8voM3=JAk3F^Q8ytFYVa#% zJd_svp!f*g13&0pb&WkB5JqROsW#Ul(j%9U8p81`;Q5r8KE-Op$ zvaYwc_jc9(KBga|kP>W7Njtm!Q?Z9n+bK(#OJAPMlB^ z7JhTlmZL1$&WBUN%t)4PUv@Y2*yG2Kul{!oI=SIem(m{}@1UtCW>>2cCTb&TXc#!+ zcewtZHtAHx+NHHfWuNtwFp3EQ5|p3ezoV^aT=hMQ^7%qHA-_)j&xnv;*0zxZ$aUE~ z`v1P?62}DjyFZkKy4%s;H>AEClh0r8etT|xzd!d{S=H4SGPmzQwVQW&oh8%ByFg*SDb`)Tr%e$mG4;D6G3`|q@@iHM8 z`XK0@OXT_Qu9v6@=ws)*-;5DVKHqzDf}+HE_?NR~jla*^W;I(;nu+(>X@x5_`x09# ztZE0HX;_jEzm)pUxLXVFgG{R+#$#um<{ow%qdZJ*zsRv#9x3g^oU(gzQso-6wl#_*{O#VW7sp1qM3 z7IWhKS30&lwIeh{;5EfZLIg9nzl3I=P*q6mC!>M}Ip?97wjFK-3KVrdzQc$=l+qeL z=~7}`?*4{9beuk>HC?UNrP0bQh2hv4qp>RNpdz2|9CD%SRip}W0A0h!d2GUHGd!Tj zLV{%||H0@5wNth1oDJcPfyezzM$6n@9XosbTWO1HJyC3$+8PqXAGlLrnrBg6Q5xnyjlP1u5- z`T;v{`Ym)4k_r-2F`MS6jG~~3meTH&Fez?rJVwiW!nWVcBZiq@btHzuK0TnMdS@zH zB9Tkd!s&irP60YjrB5wg#_rM9?;mZau0FQ{C%DP@%59qPKx(chJC2!8d7wD}4BBF^ zf&SKELHm4m`f`iU?$4xAL@))Vq+c|rxU!&iUykuuqS8v0M>gyLEVMn+-Hx;+0!7mW z?Dj%`M-QtM!@2u?-y~{wY`B)H{kDnhbhwW zQaK$mgklvMnwB;0@IUO-kaL|-muGl5-z|KFS>(73BupDw7OGR_G21TZ*nM)_AB}it zkR2PnZUkG_S34|byw{{cOVxB?_+Wqhh`4$nl7?yM=aqAMo=pYIwJf@O&2N9HbZOY7 z_H!ev+DHV`@u`r#?DRnQR}=)QKH-tHbJWz>jx?3g5VmwI_KR@RfT>IM&z1&AX8~Gg zd;Mr7;fRnXST_&779c=t_`#bswT+MwdPc-N)R{S}jwPxMvSIuKlfj1yHG z?HeWN-a3rB1Km>6-{8a3I&qTo1zn4bo|j-Zh4`f~-`f}Q_Lvju4TtZkf(CS&yyiOV z8`)RCmOAzjn!S}HdA*)I}}GT)uXSr-mN2411(kHK`tBwYecI}mx%clQESJX1C$|Jdp zBJwU{BUl_>#5dK>SR;ZN0`*khh29Np@za}r7dQ?k$ipS7E41@enAND08E7;Czh-Bs zV2g!flot%`n$U4N{BC+iD&;WT13U|Y1~wkH$se%Um1a{Xx2VKP>>x>Tc0OQ&A%ybt zc|5*Jdo?o44@8Ni&1G_;D-r2=eLa8r+Owz3LQf7)O_|Z zGw@#ALp&{%BtP!oL!*@5;yYs;*%|~^a=XW&BHw3f+zIv8+SLX|i>iz%C;FMIjKkEaxNEIo`Vk1~E zt#R-~FKujap^$3xG>Z+jnu!v}sTpr3N)SXhaTviFS*^6z>X6YhO(!Bxoq?O{x=iC2tiu8@HS=f zS!Y(+uXbVAlOzmiAqC#9Q&Md4r|Rhi_5@JM|E2Xo4Jn9i8Ew#jU;dm_DwQnHbrFpz z%Re7C)o8;1OUF&)h>MW_wkwAohy2asIJ2PtEo;+4{^oN*E&-~bKZ6ZTVAPdEh7Cl% ze!bHqq$+-Q$Nb;DB^#_BEJl{utH|{BRI)tnag#PCh#)FgjbMdV-Jyk_vfQ>$p7m=3YaoMlI5Ib z{(e<+hNo}@B4yn`y+0Ak`Zsul!4xCK&O?}ZFZB9u{kG%1@KEZ1Z17k-dS`bw-MKD^ z!izX)Z(8lU^*=Yf$_U0dRt)hjP#?8JmX#XQja-e9S6rKSkf5ChUJJm_#nE-+!NE_YV> zY?y$Xc)Sa-)+<#Tv7ngy{@*Dlc(fKeLM~A$ zfGn!qdsIG~Ci_1Ir_kwyx+tg-Q+6$0l;1q&g}BBxD3Z&RreKXkZE&NT zf*V#R8$ao%t9q?}5gD$h<4?(ThAC@BFcpvv_lLpVaRK8^6pZv^r1S(Gb3u9zc9?2vR0-wUN~iYu)|&l2_M7uEG74S{G(+xshb^ zyovbuFO;g}1%nFFUSuvJHS)x?*6c~JtbIQts+pI;xSiy9ZsNVGjqeC9RLOc09A zPC>Up;^k@&)}vK6zR7ycBNx+r5w{`b4G!u^J}&m%|~p!KK}o34?4FruJzu-a%xUeX2q|HOn_*I#q2 z?31fN$!*M|-Th>jnt~QSzi*(}(28XFY*FnycujuP_WR58MOv&Xy`cV_$tnUvd%M8q z;;<=Bbz%oJBEw6*#ZTVfPCn;oBj`Nlzj2K}8+$O#{~kS5Xm`aFv^fD_0x1qb@*TPa z_dBp8G{}azOb|tgpbKnJNGG=V!>y0YTvT;M9jXgcstFX3M&u2NYsqrw!JM~o`LZq; zqzO%UvI}P1A0WyAFR`HV54jt90B@^zxM%>SjI<8I&*RMS4-~L6qq;0|u)e*!lqBPnyr^ zcpt{|`Yjgto#P{Sfl=hZnDDVKIc^s3ibW`6^0|hT7IKQJ9C(`Np)G`0%J+Ij<6r`J z_&a2fKiN-RT{VHcW`Sgu`6)dKYW0Hl|Iob_6tYcG;<3CLctOzoKqtIIS@7$y9#(gxtN}*8NQ| zkt?l*T&JQ$e7owOK7DE)+aZmRR9;+*zt9Exzux1_xSWhs?@`aB>`R^6P4b^P=jhss z7#XtQB{35%uVU%8!1$LA7TH&>of5)>7OdsjT2`6BzT{JK5xuDzMoeLAV?2zrT0k2HkMZ(5{IihPkx5lAREFDl}S6(W9gtR z?C;pNj^zD?&8FFs5jAW7D(0Q$?w4_%sjwSC9PJeR+9UUM9dq?L zaDRQHbRun8dpWIz|Jp@<$y}Xo3~s^)EV7YzT=(lh=d+PxUg=e%+AlU9 z_Pin%L=zSsLn?A$gFZWgFISzDjWHITX=ziMBtoaa@YrQ5wtv}*WBqa0$Lj>dtEDN5 zy;@zMi)n@?N%Teo7P9sTB8-2|<+Incf>3~odylw9^18Po$6W66VirD?R=MCW1_dIS z;JwhNJD}0IIa=Xajp1#eq^MtHn2`_~l8P6&fZdxH@tX*ytBRlukym;v@ro6CYR~`o z`)uD~*bRhEx6*gC;2hV~6J2=I&lvf!xd=8=;B<_|tgg;|R^X)Qrey!)}KA*|CaDT*F9OEX!E z?tWjdaz~vK+_5~`OX4muVtv(Ddvxf+)rvPico>Ml!s5RfY547?FP!Z1jFTemE##Ri zr1|`MQBylmFvz<}FT`TQF-<{WW^&?a5;}|sM7E-bBX2;oAhh&&3Ou)3opcA5!6G$Zt=v((`U}!`tY>E5-*RSS5PZ{;zvdM#HIGI zue6dlbl-qErmlQ%1$(scSxfiy6sckJDT2nKC6YgIZr}RC#oYJ%%atAb^-rIx^M;Im zSI|tBx;=(HIwVy$s@LtJsyy_;=PUk-+B~_H7^#X*k*1>?I=nw;gS^~$J;v*#GEUQl z!=_e(L5+$tqmdlN-JJNzLxIP!@+oyw!3v>MpgeiYxicO9oXbBaBX(&AGnBZ|%@dzsS88{=q^ zt8|38W->ewdKV=*_H*-_X{}8&gS?f%K&Va*^+q;al+=JqF}PIxah+#h(dFOtiXrR7suKaXHyK}Ot^jw>e(7nFuP$R2T$A+oTNsJg05+&3WT?@UjrVJWK{Ix>3?o{2*V^3RNdk^TpLGYF|o$B-W{`J z_eiY@6J*Z{CorlCu)xHt4puJZh)|*%Ud5^Ymi$?uhB<3oA`-Iw%$Ra2T#V1$Vh3)8 z*|%xtvEf7N9BCrtk-wqGPOL91v5}VJ;hTm}!Sx>; za5y8Lz=Ckq@s|rl5SDm`f)*%&Klft8AUv@kpUFkKW%?zdGfcfHIVMTj;_39{TUy%L z7?@}7hLMyzl4<)Sq&(0faM#YoBWuCk+f_vr=&Eka6i_ZICLG=qG9CmX-#V!{c%I+CVX`5&_-F8YI3h>BfZa?gNk9?`kv0~?B^o=tj!w7 zKcZwkTzT-6I5$Db9ey-qT!|3z;&kDOEP*oqHC}?zW6l(8ZU8};FUx?fe!x0qQVCS_ zAmZJGgu%)gl!GyJUs?!P+M<;=@(fT+d8$)ld<_I2deW@g(R|jUEhrTWr9xj@ipAwb zu@~>(SFQF6fBhLgG1|hN1`T7eNn7;_V+%O-nL<)DUFd=|OQ(xw3fvfqs%i~W>A_Zg zM9|v2;+Nusoz_s0?xKWVqNbk`QyKe#4{A9Pr)1qfbDK(&u8}r^!aeJYi%t%b2Yv;r zO;A(mtThtS5kn|X&Eo7A%WK$<%~CO)?mdNzc{{+1i9T+RzcBNRs+m{XN+3~My=t@j zio{+ypD3kH6U2vvc&u<|^Mwb`J z{hpA8RFVJ+J*-m;{TvtRStg;dg4pT~vBOJ8WNjiK1Cp~WS}3O*bw&sed<0&&pR%@x zH2QPZp0>u@YP&8?3%8AIWZK}SZfVIz^$NFL=^IQu4M8x|^v1)BPJ zx(82H9j;B_!D<*m8zDgaa!82Rgq|bNF`a}u1j62g7gE~-CVw^~>W@;m@vJG_u{vLM zq#y$K(9w!h;RLE`5v^lw?B7-5Ffq(|aghb6Fn4p?CIn|}>g|V`VrIhy&la_K<1n~A zD|2FHrChk({Q2tzma+Q2&CBi5+nl*rLWCdfH2+PS!k1Ef^W|?HwX$lK+g(9xKeZD6 zC(9mi5ME(;Gv}`kheyh)jNPbP&`Fauz|thV=uw9uuRk9XuMT076#cOde~gKjb`_9= z_aK?lrmUe?H8YOK8O4bYOFQ#Uj-w2l9?4K&_QJD+kxq|l*j414jTCg@kbiXzLB9%( ztY8_WKsT4g$Hw1+U1&!qZ!OUQoE)Tkg8@md976Rp+nXoFya{lSq>T>~v< z=(F`C!=OSn&?Mm|rR<27h|9km!$s*N?}};6Ob=!ks!SeXzFzWCpNa3eW=Jt+Pi!mP zc|ivgz;$5a#P+Xpc%>M_REvZ2SBslieb%7{OdL=Ll)Eprt#*fsyY?k6|<0A9xH=Qe}EyPsjc&~;PxBKdJ-ZtdDjDPm=SDU?KR%TJf6TYWD z3&MHM5-}*4^*fud^~D4=+3R;g`0r^n=^LD240!WBGyXkH6F2hj;-E`YZTRrMp;lh9 z5y#Ll41Zc+5c>1nbGFz{R|alEG)Gksw7x@i-zi)9;hy&7g(lVT#nlNmBENFV!L>c= zHkew0!3T=5+kL`J%D3@ooPbQwOL}8w8zy}*TKb`5mR7KW=5JK5ovzO@H?lVW)}?8c zXjfWMcA+a$JjsT}oom0cD8s~tH+OQY#H_COaN%W9IZd2xT2<~f@6W|$EA=VVeb#$- zf$u@L(Ys#$^o3Z5BY>!laO+ur-3*%&33&>;Cn0r(qGx64yMl+gJ0H2sN_}+3Ml5rj z<4F_rnA*pSCSm7b0*7G%E!yf~gK%>1*e|gi3Ztky!i!9ENDh=oNaeew%DzJR_fpa_ z{XU;B#?dY$NR6g$u`yosd?X!tA30{F>8rD-u*gzFmm*)2gqpYd7De}p!&63z^TvPy z6p32?w}7D+6clRys;TFvN9!Vxx%17eE@h%>GjfpO-MZd$1wrYt9gP768tc zKZ(1;9Va~xn^BcL1t`L_$PX>QzStkz+<19EckLWJ3=zQ=c6N$g{~Q5II8*Zb!cs;b zWdvJ0@ASpVi+FD2OUi_};2^=6tAm^iZ*&$5^?#eBxHiyN8g|d_%%)>&RMwiNT+Np8R??@2Ziw8XulzGa)M$&pu5+2;7q% zk~;NmIeu(@9bm4g-&T+bzo1pSluOqH)+2GSCWY~51M>$Cj9B(&4UH@9LXXLFM@kMp|F_TN(Wk+>r6K;A|zEw zJ7{^%wb8}_?cbOEyS_kL&=q=w6fX~_y&&n>61IRK>7Tik%R?@nS3n&z!$d}Naka;x zj9CyE3(g0{gq*-|!>@}8Jw{qUid2gP0X)RI{29;uOlNWWB0)4LBbp0-aBWhpsuRSm z8Ns`-FsR5-JTEQe9cY7RtL~i)+m$6E z1g5lh6undEn)u<=P)pQ#S~!6|^D2uPZ6@CLhzfeEN%RH;p#gg>54c9YY#Ljp0Tv{F z)y|Yj7x^@OcP{GsV6u&8j$ad8XXpHt80tOJWF&vZo%H*m4k1tUE_}&LHG0Jt0U<*#H?>SM`uY-f$2!Jp@__dnd~A63vYje1!>po!9eZ6FMHEDpzy4%72G&iNOI zivp7DD{YS=;jKW5XP+^jU7cYfB429HHMS=N7oMi#SFsjJ?A9L&Lxy>+@(LV=dy%8; z=!`Ld!t~?uZvcT%$X0c~Du~bF*ju7H{Q7qHN)W31?5{;g(EQo z<~4E__9#isGhs4CtWBCGyX_qGXzo}pwKm8sJH?4CktvmC=!rfJjDQ3@4SKohtl)Fi zB69^f3v<O&=%ux@6tahaiLq2CI(oh-E`)pIY!R#rO1ZWf3Cbd0e_ zw8d}4#cR2W3~`|&XA`%MGxnhm2SgbOX&x^f7I&4+L>#}fz}ta1!|?>pykycSO8IE< z3Gvj2^B&008vR~y%<;XkOZBuNKqG)3Nz40LBM z!W+h;0_+YH^mf`KS2VKxE+QIH`wXvVEdb>qI2+1NO`g}b+;krRT36sg4|480neuD( z4WUrK2>HXyfG+y~o$tvo1~n%@MJ;{iG9&%vD9LEMt>keDO5HccZ-319WOrCNd)L!& z?Hn|M1*CR{Qk494WD`l`%3X?ypJ|TK#E5~@8DTK2%U{OC=7^mM^5Qau)$-70I~r8B zDLECDI#&78U`z+v6#50BSkhfP~*Z{n8^yAV6uSEv{BFmGv z{Acq;B^f73>l2Z|@t!x(f&}c%XA?m-8v=@Du}fwA@rMUS@tN%WBOBQ91CJpi-@AZ}z#Ki_*6RZI8rPTrWv z>_!8l{#Od^RhhD36L>& zzrVB-zLHpc`PrElJB$RdLkl_o9anZbRc`qQ#d)=)p}?I(6xtWY3x%f<+3EkKY>11zbYn)2GEf1yKTkd1i_Aw0-EROuPXELUE|p zWcj@FP6M4^6U7&XyH8aS#m)k;N~s8Z(H_uMeSoVtO6DpBG?q!~1<$J5Nf#o;V%)S0 zEkfsv;kyY7(wi$udut9N!@NM1QNx0+W3C-^sP@OKL9~+mxht^VVr`bt(i#ivjssc>3~nVe$Px2$cYL7@V(Sq zW8D~Gyu1GMlXlDrl00Sd)-F@%O{e`w$Ikv*n)Xn>40HztdZ`!QSeyk6&lcK4Zy?r# zjgSG95o7I;*{2)rdz(>i_DqWMKI=0DfGgYGwdGIga5b|~RlKvf0BEEw>B$qh#zk-A zPVd|1G_E-)^;-bkGysoa&2{YiDLeGllRwu!wgcgsi>{?hu`jXbZkI=2J4rcOKI>Qv>(r-=}X}^#eMQ9G{I}UI11#c@Sn#M$49PLb3U5!k2drpLhrD z%#MvU1gw239b5O4Z)OG7rSnGL#A(#d3EJ{2CD%}snQd~+< zjX;<)(7V|D_Ie_s?}coRW=q6|ne^wHn^zHmfTvVrC*OZ_uB#95UtID9tMU979y)x8 z-#^?Q4+!Af!Q~`b1`ckwMbl(4W%|v(N!qJ{CoU$H2rb+69JA5Tt=aqikxWzg`6-UY zsgWF#%-o~6IabfDHq^H+nxK_{Eb~|6VRVZ`psshC}t^(Rj|A<`zFN>lMR~y$y#62407kwt zSr5gOa4WcG)TX$77YLhXhAf62hHo-e-7DU16^eT}eZ_%JFs=4DI#F6evT9ZH0|lhM zy#i`KbOBI1WP~;cFtdEm*jyk}$~9{QZm-@OI=fp9f%Ec`Pw}$oxYl2LlST)DgyZ%* zTP=!c?md7^E;VymE}}a;TReTYe%z_N5p+MQV8RdO2V2T%G4gOmvMF$xNt#9CMV4Z= zoC+4BC2L%%SZ%PY6ZH?opw81+GPSNqu^gROwf>0Lf3^Mrq^{K$h_p=a)_0C&Xi(|L zOda0^%z^Jo&h4Gm95z9ve*JKY{#|bp?g^1Kqop2*mkV#lZ zp{DQr*n>&U<(Vh?UN@TB8bG$5$cm~((}>xy<%zL+Q#*~<1eia!hCtgKxw8-&I@OfK zXap+0XbBm~Gv)mHfrcQ=5PDrx5q<-6d{s_}C=JO^pN>^(@Bc{?rn=q`9Q5iJg-v>a zl{sFp_?Y!JX@8|sBdh~93pzo{H5f9;?dJeGZfou0oI7BO0YQlMu@UnFeaQZsyr7H+ zBV`3EYQ;3j%StvHJjA)K#_BETj`x^P%P@ZKH{^5{l|#S(8dEj+%Rna^)dBzaO-a2iWg1K0hSS9R}X; z^>dSZ4HXE-rR;hN^)Y-o(KiGz>&Apx{IULH{b$kj2y;LQ2P!kszmBjHm@tFzi4Qd@ zvUEw|`4ec(lFif>xv3zv9()aoAaN*TVg+uNdvA<3$6xJ*bZ9J}9nsnu^EjHYs0%=7 zDUR<_P|=o6KHq2AF2E$T9mZ@))wp*E3obo1&~xibh2l#OTwQ+oG;KW56~;FqY@~gu zXziAzmDL7C{7JjBfpNCUK;p1plrkCOwfFyd4_LtF))`bpL$EC95h;LyM{|Q{18^nZV2q zNrE&nq}}0L#9c*6vRYfX!t#-}N_Ei?NkQoGFmXyKg|00m1RfkYp*2w`sj9O>Q2iDv zpOQplae1|Yc16KeIZS*ZJc&*@OQVjxB-lU zHZ@SvIfkKvAg54F0yi52H7lqjjW8d4q{HK9)hYV_?Y5e^du6uhx-QyExPnn>ttW~D7uJY@6vo}KedjL-N><MBx(nG^Ljz6I`7Z|6MTC>(zkoad_%8N z>LfK4WZRR810m%@>}e;{RzewNblq}kN+XfDl*a2P8uq0PZJ<^GOdZPH(sk?!;S{O+ z$DHfu^i2m?3GnVyI4dE|MW6^+^Jd7RMJUC#kfcM@rTkah)u}BOm4ab|e-K61r6baI z?eZsW|FwpYGMyX&t6h!FuufN~qK|(B*YWyRMu?>90k4%}NTl7GKn3)M&ciNR6njJ% z#DXqRVDZV}YU7&C2IaIR&Ib88IEjgxo9_;_n54jr9~uRfL=?-G#ARAmsTZh>d7*eU zQ@LJl22IQei+a`8wJ}Rt;FPMwq4%i$vuavOg!wEsS8F;&h|O&VkObbNbr5r_>MPl- zlnBRM0;NhIf-jSbfXrana(&fZZM{{9tX$r26Ow#Zb(O7N9iukfqFL!v(5RsGnnp6+ zsin=?UkQQTORzyPK0@z*&Y|}6mVv2n@*OfGr_f@vN)8v)!OP3UhZ!_YT5g~A*G8L6_=vppX zV1`tOM=F<=MYgD}VBRKJpgvKe6t^!BlhZWcqI#r1vd()UBzKejcoW=4k`+&Na1PbE zH5T!pMbkYbXLb?eoXcCAaV4uGZ_+3`i1C76fJZBvRqOSgEZ3Z&KAiIIeh-9*kIcJi z!&~*vF#?3}PH+%%kylcN)rW7O%2gmmD_3PKXfsGB^uWi0Iw-}Vstr1_b6wR!ZuRTq zqF4%n+pm{cEZAUCn6pOdazdItlyNi!S_{G)ouqgb2DXkc#fyt$G#E8Gk(_7OcT&@> zp5h|8M4BWtSz&%TZCBVEUUF$zoa#AaQzkOEof*mZTQUXLGq5%t9?R9yDTh*RX^OAE zV&QOQCxuJ3YCYwwg$caLpAWB4l`+|D%_ODl8e?^`!7pIcvw!!BsUSlB(a%YGhGwDz z)lo|cl_a8NsyPWQ`wOq)JnPHQZ+N%7wDIT}Af#D`y>#Z>l-9c}7Jt#UUpv@T`Y-E(F2$W69!# zboR+e!=eGhyoq}49Kk;L=!jBTB)mPgG})dff2vz?qb-)owdwRF3rZG-ATY<4WNE7UIY2%%b@&h~=KMe3NK(hcf=px!sBTugjK z3>VSLb9u{X3a?N8Cb3tH_dnp6ap!`#=i z8uvE2UO@tW3DddAPzJhKtV1(ZqvDisbRayn?h3E7 z)`UTC+}cl?#H4FP{mMD+)xrqTS-U6Fv(G1$Teu*2nn`?64WPmfSK`t7qNkVCQS5@z zFp-9kX`v8+e6nNd?S=}W0U^yb2^6MNwn#XgR#lAS617GChfO_iz~cmI3G^Huw) z;G9(>?j$KIw*cv}Dg`0Zd(--DM{g@={j~lPZ8t^hGvRJZjk$hB1>9y zo`Myu!g1zjC2pt1wPi!5?l7!Xw5D-{TWT&`RN(iZRoQ52-A_`e8)W*-MZ-(SbPer= zQMt|9l3j`U65F{uv-ftA_a!3C()0^DKGgvY`eKKBnh%OT{$@$#y`xO=f{S{gT>{lM zX>OCdVof!t=KFvEJ<^gb;5fiMWLK?z1t<524MX8#t5?xnXJR8ACwIi;#CYJ*x+q;5 zWP=vpBw=>OR4CDBJ~I#Z5|!z{n7#z}u96Z+Q}k-}VBKempb8UN5SUnN5F{zGwA8g- z-CrY$2x8{p@pu(V#)2<<^&4&F$O{5h6B7x|tHC0?3117|si<3s?4wPI$KDp9a~v$4 z94=@k1z0Jl53D_oc*jI@4E~ZQ$*bVObFYM?5|p#GKYEg<^ArJwjI|D1TAe7uZ=7iI zkh<;4MC4|;1%Fdlks`m>5G|7VHt1dU3Qzi>zz+Po89V0npk%sG#up^B&*EAqmXMB% zgg8$scd{^v7Do%36w|Fjx>y1g#?7=cU3iig1WO(O`iBvJANu1>fPX}0=t68@xZ5iS z;g%U$lzhKHnzU+m%;xD7dpsLYQa}$&?kz%OpcD~wk$ljWH{X#}YM&Nf)VNt3M-SD1 zzSzqQr%Cb1b+#CAl%z%ASqe^5Y2tFi_ZhWsF3TfEC<}HsP*1ACwBxIYTYJg@36t3t zPh2x^*5&=3YUT8c6jGnKFR}k~EZ8k>R@46kcLyyVcgNiGnHuW=*ETIvRsrE*VuEak z3d<{%eZilP_F>x4WlO{<>4S)AbZ4_@yGpcNq@UpSi|gFsb?`iTW$B(v*^lGJY*PUk5-pwC1)d(Qk z)={hh@-fZ7rT{K~JE&}W@@uFOZUmA*-OF6(mzMSvXo&~XtqvNm#N~^Wss?2yRq!A< zF9irv20-dkckSkW~!UhRblJf#~!U5m1hPu2m6FDfT#2mq=xfPg!v zRYuT0Z(XKi#SYg&!QiSmld5f~RhV*m_;C;1*QrR{d)W7j)T|4z)12K4K)SxkVWZ&1 z$sQ)#QrE+W<-fQi^vyVlSfHQ6?63WhD?wlEl{wBU3#xe%u}|RU&q`M~Max{ZmU&IA z#YnwUQEs@~UX?WgYkk#$e|Y)_Ym3l5iN)v=>D`1xH_QQbC&I z{?V~gLOg=`JbQ1v|DpaDEQJZr zAoiXDrhJ4u0%hmuY=doDJJ8s6y#@Xr4F~=9ML*{u|%>YO&b;-yieDWSs``>kSwI@>kU}i=Z(2BZmjW z+hqHJmaGbO>V0>E3_AMmU`@zCLJY({&F5{Z``6Qnsf)mk#wl)M%g7~BEN)t2G+1c& z31ER1p%5*Kc?N(1Zu-EkJUe3tB+u(M;V7AWiT8{sSu5L#4WJJ<24L4{{0*Q+ZUb2D ze`ij20-U)(3A_!ti1oIjZhdqC63r!95_q^b_*@!&;DRCn^;-_`IFYt-aG^!uM=Ese zd20+%x$2nFO7BuW6j#MKEFljkJmFpvc>WrC};z) zX9=h(??`L?g^uY?8ed=*Aa{m*$AfmX%}QOy#|qh$H(v9ReV?S5JN$ilmMdA+06rrE zWVYOBg=`q(QRsXr@3Oog@GA=S&aAvpWpD1)1F15g;LR~BclQEpR5M?md~zADF@69MK#|d%QsCR$8_$Fa zOwe%vMM(|YfMTdsSFuifSl}}?ND>wi*_R1Z zgHwp4KJ3<;XTJ6EHd%2DRuU;z%(8MYZP)c_OltYJ+ZSu^NZjf5Eq?z%Gxa8U#4@s;`x*p;zr^SUPs`W%!Ok5<>8 zY^3vv68qoX5F)z*J%9IpiD7unYjri_SMa}!5-XyuZ+f@?aMu2#NiJ^GU%PGYC`-<9 z`Lb#CgDW$(!-pmOEGfS=kGjq(Ef+d{`M@maId*T@RQsCgJrFQNfLkU^X6ohY&h@ak zPT#tZ0CBsJ_nOu4m&m57Y&=%~CkX>@w-;*+#gffw6cYd%zbX#Fw27DQh|v^_dzDZQ znN?xddTU?M1O<>~qze?v;NB2{u+kKG9sFN50-wf zm>KKk(Qc?R?_4dx1c=!BrE>YbJ_T(xl%LXiVY*LnVFBSa!C_nJ{8TY4))$U#^%}bwb9FNU%3Ra6* z){Go=7*a#h*2xNP?9_V@#JH&c*hOc|m$=f1QP=%Cj>3xdW@n?#eIoB^;*FC-0lSYq z<;r*NfqA>Zw{8APQ+lC$y~AdR`9o4H6Vry!t489(l_Hbkfd1RJKKXx9Qz4BG8y3wo z5^HinBKu1ext~8T6l__h{&`Y4=KU=(^QK&tErA8Khp_=lPO*7Kp2IAx<#{*O zI($vIcz$%g>^*ZooMF*ekE1mmle)Pqds?5bjaxRl|IztmF>Fm0xDdb1@9=+8r689< zt}Rk&14m0-Pnur(oF_8y^>cEy)p++0?rJE1@q_DQiMc~oyf1GT8nAwxP4mA=%fNMD zkdrrF_Jf$HvLq`NFnMp^ZAMv=v(^iJ7c?E zk7uX2boC0|6A)@!ofWsMbOS4Yy}m1F-N&G`8=L1m9Lu5fPS1G1*2BaPgDvg*Q3ad0 zadgnITwa#?*~LuSyk%rm75)BZ$vbAg($29t`7V2S+1zt&FaMSy@-@kv2i>{mBFp!G zI6B<7Ix$E!_W3<~z8m91a!>m$ad@`76xSL46bZmf!T6uwD?#YAd6m`7Zr(%>2LnInNqhN`an%@ya7GB-KfR@iW{;}h_hgYun~&dg9?7i$IS z^X{LcfGSvx%+DJ$)IL3JKp-YQJA0>MB3;2POB@)l$@CK-y-I-lq7pt)Iv!XAh{1sh z&xIV2iu&@cwH8Loi|CQ=bR%@@zrNq!-I)DD*fx=@0V74iz7>R!=|o_KEg|E^7qMhA z5BLHTB`sC2T)MPY8^vT*-P&mdjLQ#8jzfSS<1R3hxMtn}&kBfBhbg8n4VUh36$Bpo z#&Jvz{X2uf&}`X$g#>xWb&|;V`{O51Mtiu()bKHJlV0q--glFfhrlPBkC(Cg%CQfM zfhE9q6oY-g4Xgovd*E_uA=|(|lf6%5Vz1?_;k$Ud^W=i0a=D_75XbMreBxX_sM+1K zOBQ3lC(929QBXNGKRV_$<}>?ZhdnoQrS@p7B~cXqpBGTjuk|4_gnBrw!LLY=8ev_F zZeigDwwcdPgWb$5Qh*jBKdS)S2Tas$dgKQS=zHvt9YJ76HJ}>o_}!o9B7FI&ZW#&K zz3hOEwK!U$qIEwGZUwl}MDr#-Nu~P|0M1uhE>N3I@sN3#k{-DCMfK>w!w*nsIl2jg zUVtY7&bNO`RNSI)n>|IV1Z)u8Mb|Y2?`5-(w>~CfNx)JwM0WH7jNZ@cy&_kRZ7 z7E@5RRm*97c`R&TKxst#?RJoSnnN%k;D>?O{s2pTI&-eR4#qge4_5<^Dd1Yi-fp zJE}%paf%B)fr)T>xL+0U1Ff8FpI-rUP5FH2lHy&!z51KYGftz@jk5uH#`m(r_aG)A zl6YMt#E|8#PsTN1(At7RAF1d8@_FO(fD8GN5Wr7b!!pc16_=e(vVqn+$O8U64<1Yr zewb%mbZToPpFa`3iVO*J`&HFcB749OaOZ!=%4VBKiWXvJQV&$}cK9eG7 z`pE++&)ZQv*$h_G^ibhIp2#_l7NY);7lU+J-CUsWsK%J=q6s1HlXdHjP zXCc#Ear*!uoNkFyv&ic7r@qj9BCm4!0yj`sWJ|+d)G2hWfT?8+9xAc~1aDrFhcE2Y z9DxV!`iIPrO-3f#p10RL+^~Sd+;<~G*J>nS4qS-9f${B+fdE3?E%S){goo-)ayt|# ztA}7BKR?5TYl%gG1mD;m$JWLTf^fNj4x^yPrOb_0SNf6E4mSP0PGz*;3)WHLt6B~lp5|pO;@<>Mz!(k=Y7xj6(Hu}g?$>$YFzN#A zEc{HTp%1B*A{ZOi)-XwDZhdVDf*p|69MwO8-J~g-E{g+amT`(IVDiAt|0au+ssJgt zmr7OWXGkwSlRSs->uU(e6!J`v+YVq*mA?i<>3>sodJ&=nG<<)nyE0|LLnvN>XfmdM z_lW>Qu$OG=Ny86@Us^)k*aWLb04Pi{pB{UL^II-&VZIT?6#Q?X;%T)Vf&_^QZ}aH8 zo6t;ZmTfc3k668+Nw{2~#KbU@MA!8ax0CN$H4QZkb9hddF#i9r_Lfmmw|(^Q&<#U_ zG$@EPNJ%%Sh=9@^l0(Wcbju(m1}dqDg3{96CCG>f(v2W6bPq7+n)`m9=gm3)^Wv=Y z&gF7BF!P%$zI*S_-ZfdW|5O99aZ?|R>7#@Ss+uW9v(QH1(tU<)^Be|6Osc}mT?Nug zJb8*T=tv~w>5}~psU5o=yF}fN{KB>-S3WZ(*(NjelBbo+VG4B%F-bN>v-%QxQFVsA z&+8C%1+N0uEglu+;5|Q%40~h_nQR-6uNXc^;jOg0&r41mW5x?~LisW>^~Z)@E<1H` zV|iZkLRLGG-xZKU7hEo4`hQ$A?PyZO-MOCdEk zgsirENgE+QyE+*Cn_5hqXIClY=x*Sa?9{w9|L@%MpuLT#^2Z&0yX7x_M(P@L;Uwr0 zC>^l@A>=(4X?({1bh|so7f)iKC1&TI*smM!Wbmfwy;31MRgU?peM{|5o^Bz*sX7;g zysYCX2V|N7ylFA3TpInr_w;AslEsp=TV)}ZK2-h*(4z$IBFa9Us&%>f zvS0X>4lcsdSL8R%g?=s(3Hct}xim&s{YK9VsZ>QMtMoAmTY68`6qwyx>K5yr=no8q zVZ+gZ18&0R)$L=R;|`e2!_1nA;y4f3(w~15{Jz}J9)r~0Y^NA2Rp7M)4wM}48>?XT z_0uH$u-HiBXVeC4ag#?3DY-TXJ)O|!AMP2}Ll)nZ2ZuwmG)bWEfnDf2C$dlr>7b~( zGXhs1@3+(`bSRt`;9RHVwweQZT{b{5Nn8cHDr)3P$FJC3TIis1E-QWyY;4rNByV~^e>H#Ni7}O z8n2Qf^Un2;o&z-;M+0j_NBssP#i5@&Ov>E#?tIJa^&{WljcN}4&c88RlOg@tyvL8c zXbe^pp?LV>LfJlzW2EI1+Te-4g+ok_a5>+UN$sa<{~?xt<~&_7f1(xBb{_vW_B?@W zs}>uXQEW?o#%nsDKTB2pNZz{Vb}WVi7qDrGTjam`0>-j2QBMxi4}L|AoB9|8gT2i7 z!)-*cP|o6yFy z;rBTb`jjesPJ=hX_nF5&sRe~BVH+kcmrqf>lbzetwK`?%PT)#_`uB2jgU3Q;fKFjo z*%tT}J};~=RCjKq3Ydd=DV^pEXoY$#l=fQwF;qemMwN$e6LAqB>qNJpUIo#P-kk3m zs)mJMb={5#c|*l69VkH1hWfxfUg&lQ=DZvy_C{smi>dIVc#a3%H(p;<&aX8jTcXjI zFN&Rp@lC*8kc}>=>$kQI<_crtRDb-~F1m$F9>pYT=^aOL)e^(cSOV)LPZv8y4VKm4 z8Jj3`WFAi<^6=cKL7RLGHB_hyaxSt(qY6L!N~KQ)cCK2iu2srV4NT=RZlFJK6`bzn z#qCX$_b0->H;9;gv@%R}FEo^ZbuJdV4Q%$(?r+ZbFnV^c>&raqk;FD>W&4d)1YO(K zu-kn~HRjzXoZ0Fbv-16g!{|5W+R~CQ!L13O5Pt`JYY?NvT$v$rEDqpORK*+j9JW}@ z2uFVwDK=YB8IgM=V&OPP`4$#%<8^tbg-OMEzn(I`EmnEz+biK^jFa#qF&nmOSSeTP zug{Wc5}zJk>c&|JX)!{33^u{ zZZZ?yX|OL7j?LKe&;BNuxeZxZwP|aPT{H3Bn%f@}&0guAls=6;T8()${%ki9ow7ew z7pb+`3JrQE3!CtY*TH9IDx0<|JIr)_v0A#fQuNz9C5c2&#^IYJ<^)W==GYp{27*_3 zcU#9egSTne*b>gQNAFD3pcOVNZ69e8N5#QWacHZ-)a?4{oO9QFMr2Jdq@0_s4}0oV z^(r}KrcT>U$VRSJ#JqWU_T-Vn)s)v$9IG_}yIDv>=;aI6F1dfCoJT;b@_@N`|u(60Wb~dH3w=>~zp{cI{@g)|G6E)rjzV
    VX}c0*h7V!NAeQ-#qhVi``AycO6*X2%&-KTW5q z6WBR#$YM;IjQ7N?ZDS)Rwo~W9XjkD!llm@I$RYiJDLPgi;*^Z-?#p!(5msw~sTqjh z#IAne-_>4%f(h%g3oq+D8HT=s=#RKB_UH_}8-;J~6QHeE5wqA;r1}Y+_EG0%8^W!8faz0tSL_5G<*_R6p(`mGob5 z&lJa$x!t{^iB>7qNG?=*c#fz@N<1>q?8XfbmrMg*{zEd;Owj_oC8QOJ`t!VqSS-OT z_8I>DLRb3@DYQa}_r>d)x;~@Ka@SA#W>VeC+2_?^!Qa^6W~0>Uuf*fn?a#HauN&{N zM9k>cy%sTaEjaw9<4~)ImOQ%P@(;|ADSvP^lC~qtB8`??P%stCRd~OlT<6MpSz}Gm z20T+aqB`tygAxpw+dX*8+_H(#{I#Emuy$YYaA<8Hpaz!Muiw^ zmzT5Ae}wox^jpr|O-g61v>fteWfghg^bj|gkY~mXOzNpWCF3USN_3H-Sb&O~P_YHV zKz8uaXE>%W-g7_WyGhM`w}IEP6I&aPGsA8jdW3}b?c+2P;oRu(622&M76H<*xty<+ z#57mhAA8 zQpUqO%tC86C)X_L*se5GmwFvHOAnr1$_Pnb_pCfWeO?@tEjgyV_boN2VlcgA)^$I< zw2~sl{h)Q}tIB~c48FA0$#4KO`p}X9D?mCyRo;B6nF51I}+p&;Y(f_0> z`$6Ut4Mql4V1zaaT=GiTT;0eZ52o>~NBf(FlR9Ptd-^2~3x1+61w?Y0E^-~riR9P# zJ_+wG`k}8pEbp{@xQ`;!5TFVF6D^%qdr@|O?``53;<|$U#qv&Nn0A|`iu2HIOHNj~ zoW{%hVA33+wcjIBb)nZ?IQQ}CpIToj)A1SRSND?L!Ne{;ew#V5OQnYG{GH+kEIXN4u*h5nHGS1;R$cT6<2T#L{8q3PzeJVU z)b-)|mEYt3j9B$y<$IfE0~B=1vmvnsx2!_%I{tHq?MwKFuJfwcyt1b!iPaGRk!s8< zADLG;be|u~ZbwW#y;iC1>1{5@Db^biO-Z6OBE;Ws8bpH^pj zb`&!nb-!cH2?^hrC^4egK9sA|zG|{M;h6TOX?dJqxtpv0lwrW}N~2JU_u}a`D;U!s zL7i2rFMf7YXe|cBH2-vILK_rn`G9L!&K-lpOHq-_tWT*{p^C?*oO8e2b$C_e19?-dGl7C-W7XN0k`K^GA&Og=P z#)r}F2twi!L78HkZw2J+vi|1F{keau8Lo^9zbdUU6)_zQhL><9FY$+*eK0hscucGC zDeUMw`#;B-G(%j9Wcd~Vx2|zUJi;pkFvC^sYZ1#aU<0>5-CwRe3-U0>cDIgO$8Z9p zAscLVk|fck( z8ngi^O5poKrR^thy!?Z(BDy zw4;efu?*V`LR}kJba_2|7W;`U_IWq?xC+X1rJAg7;rM!t`l-mZRCCN4g89gG`7>>1 zO+M;}QAwy_<3>jfe3YI5J!Bfbk8&c!?OU4n_)uS+2NXY5-+ikTe~TQ*3gv*3I{iPs zZk$dgf;XA} zye{x+>zWWUav?)1%?`$SD6(^IBkX=veKfgAR~Nu1cFPU&pg*_LsRWjIWZQsHLs{mw z*j0-OJf3~61Dp3wY2UqG-g^*O(aU!$3e^cucvJ0~EMnEto}q1X?0^-5>$d(8vvd&} z^GrE19h`z_>WFL2H&ES8d_zZe8Oljyc*7!Ruqm7t8NhpeOb7PGtf72$Ug{Hr6uW}s z+lNTSolSZT2=s5cS0|HL5{vEo++7FuG3}|Z%DqL_^>y)k#!&GR_@^VGD*{PW3;rq9 zH`WQ#I4YK|;;ugxD&{TcsAEIiDmAs-Q zORFFM+?QhIegJawN1%@QF@nU2#6OQPj~^ea!Bxh8M>rr1h8F|YyMG4H;3E|M{~~Do zKL@Kci6<%?!O^z*8LKFnF zp8jFOdIB;VK;?ud^5e~_ z#c2Y{VDO8{mlFY+OoMWQ1Dm&B?DUWpX>KP*Bf#cx(LGXUre zhz}_YMh=RG6# zo)iub9d_SX>&L@dCO{Pn0plk{$;cM=i1S_e$wGYNn}TFb-SV>h{HqG!g_VdF0r4sj zr4qdQRH$^v88F=rl#6YeCpp6o44J3BTTVZ5)dHsu90V}xDE_KH%TtF&i20$z=oij z$j}53;6CNtNo&+?I2^OwUSMufeY*gx_0_;7V!km}axu`>Z4Eeet>!+)0OIpLA&Wv* z%qzo^CFk4$Ij`M#hkNl*UCv@fs6Ve_aggD>)|1!VTSd4v_>meR?^oJ)$UB!< zFzGGEP2m;EU;qahtprli@IP-|8s4yjunol~h)GO>@5y!#LF|n@b{Y(D=d7VV4~RAn zcB6rMw)hwS+~%v3o)Cavd&GgnawioY4ra(jB4GuRp5Swu`oX%n{rryTZWwnC?W(32 z)HjKx0LDVBYmdO8nMr*{ADV*W!}m>K#tP&~H4!u|&0?c~_8@~&^rm!@uQwvK7x6}v5&hx~yl!EM7U;#Qj>ZUsb*_+i3GcZuaH?7eNi zL#^v@2Z~}_8pplcw*YweIj%H{s#pGT_BzX)>RmeNS`a(mr!;);#fith6pM8&BQLMYW+jdd1E;+d?)pEoJhfx?o9OY$LEwwmaXfM4dNh zFNPznx~_k2R?LN_l7@5zLhO^@_4ucfWb6cvb?@IjgKYm@2s*^c7nc{?5smSUz})p2 zqpG3h`+_Nx&iU*YdnRSjDDh_EX>EMcD$6 z7xN+#X2g{fye>G$g|be0n5Rj`MUu1ySSpB6R~5$xfa$&+VPOT}dMzB=Q#i1qpz$X} zggmEq{14?k;S&WB3GiS-F%G6Y{!ZrMVz*}c@)=M+P}v!FJ?jV z*b_Nr#X1tc(iaED5L5jF)Re@Rg{W7OnlC;I0v4_eXnowsJ%#TY7zZBDG-!Jkxfqm% z6s+mU;wOOtU-pf;Q;#>mhyeGf! z<>L6(anhK6SDT3Ol$sBwa`)tHJTVC70vb29IrW>@hE&37hO{XK?Egf8EOy8P@68aU z)$3I;`+YTyQWhYPZT=~%LY($eqmPnFLiF)oP=*X_J-wXoRgus7sWL55X`$lqO{&|z~Gk~Ilmee^9kEuc;??M|13IhTPV>^%pI z0;&Dtos^F$Y@F%(9bwSjDhdi=$9s+CO+RIfB+AA8Dp$;6u|67~RARX*l$i8|kvM&| zmO{>Sn%g`#Y?vuUFNAb7FZ=w5cTckN0CV|0V8MMv~8X24);n(r^a*CNy;wA zvQ%kAi)rX;kY2kGO=#dr)&swIwH>vxTQt`#EIIvn*@+(rY!1@O!}{tM`C&!iPW|%FF(uW`A#}hCSXLgu{N^ zh`lv6%$!7XkbPkk8Qa7MoaM0$X+mA$eMAllJ@FvN`O#LBey3A1kHVF$*P)3tVev#2 zgNuN-8djczti--A^P*}zrVU7_tF8M={OV5@Z?QC-4Ed_qWf*HJ&T(}down?TjHh5A zx%(Z^r?fa%L~B84*(s-Q>Ox~o#ml8ls!*N!vR&S;z-J*G_AzSny`5pv+ro2(TYBuT zLrmYCAuoKn^0yBX&oz$(!6$hfMUrFnI95iTRvfYux}fy@X4C;xajGeGPjv98Y1_dr z)xdgXCToc{s<%-I)u*ZcW|c|X`>5Cd?W(XLc|zNpD95B@^I4A|&i!+KYdmpvyQF#6 zq_k)mTD)CA1wLt%n%cRmc_Kw!+`IqWao-%#;!ioLj#=VkgOl8PBC)6xi5};=S3fv( z8>}%q!p>6+5_~0fy8P_vNm6a|+{(AIg;U#i-XW#qeN!noqK>dNG8mafa@w zMX1pPNx4O-#guakdrm{Sf|hAj{s6znrYz;8cC5N0`|BOfbl=JaGjJl!Wj=(Y<17l{ zmCmimfb=E7{4i4Qv*?HEYXn|Qv4sA2&(yj4+5SAz9%k%$${aF8|Natjal&D6^;BaJ ztEWca6prUbx0#rEqX!Uzvc#WOJ+mcBLJJmTEnbA4@Al4+KA(+`265g;A`5tA%e*~* zZW8Yh??m=2wTBVC9}Glh=_>wRUiatXxfMBAud=(?mPj$>hvkul^0C#!LtocnX}|Om zoB#vHku%RXSMLSP_rM&tc)3TR4Ak2Aln54*>sK^Y%xOLdib+RT{ zb!QfM6Z))oyaqxz>W_Hxk^-G_Y@0%Q|7>kjYhHhUuIPa%-MPDLO|N5rUP;7HGnnki1cm4MhW zY98!4cPA1dZ56GW2>C+mck18OPwZTCwpQ-_0>083At!$Ei&v+|$93Ki1O(ba+Kl?B zqS1)A22PNK_$5a@N=Dh!=$fHUROT#s$;6p2c9 z3l(r&u!)L_Vy3bYb)^t{I8B2zBHc04#H_I$b8TI#uulNzP(KpI5z=0o&(&=T-i0dk zm@FOr#adqV>uqT7j^Qez7Yja(@Ml`mE*P%~x-nx2@{omF$TMinFT z34X;|=&;;A!gl3Ecxgsq@NxG(2Omj_2qgx5{mZd5rZ&R@)o*&1xbm!cyaPX05Gs7gKb-JvynbKU(`ON8RS<4BP&@sITT zp3lrld>Ed%$ghetjYxS7DneC8-}PDJTxzw6V&>&H(A1jOa`pyQPi`=8!D?sH&pJ|8 zlAx9y=_fylw=KD2S9TUTD75ixvK$u@nF%GuP-;Qei1T&%d8nMuqQ<-T1_xN!LuP(r&gNd13Aq8izi5~JP+~n1^eE}3|55i z!b((!9TZfA%gOwkAUtm#x2rr{sbFaNL%@wAH>^Vc9FAPmEHBe^Y(wyz5L9TLBXW9D zu5A-lNS(ZM6aTh!ziVd*gQtzujDsvqB~QD0c%kLV>aH+TjAYH6Gu@XU{xO<*^+Obg=!OYeMi>F9km@quQNuy*GKhh&1Rp=>tvK zktK;y9qoc_(uegGRdM8Fk-kyP4=2^{QRj&KBoHU`sZ)}WgnAuHIL$ia)XOUbu)LzdM~_Unx{sB`tkPcOz$%>(Kw>r+1@{U z3p)k~8Aup8f2zNN{J!27+Q+}ec^{P0P$FMRK48+E5 zci0yv8VYWX5s*D53?L`{y&7>d=FvRug#PvNw*tWn`(~(9Q-gC%radkz}xZJG+LI^my0q(lgYQkFj(-hk47->TW|MIKOy>LUfAt{sSyQ%GJWE73V0TPl)6NsG zTZgJlULV!uYJabt?gO5Abal%T`ga8d+`Pu&JAcSL+8!rZ@OMT1kG8e!HwK$tR}qVl z_bNcudQI8qp5Oe=By8)=CIhRS){XlahaSPCR(lvIU0?76>3>;oSsrS_=Yh52*RFL( zfDV8_kQeF&e^4j&o&Q;Gp|^p-2sf_hKQj4*P{VrOUp};H4o@5{v-pYCW-GR-?dC^W zI%mpwS3cLGz(o_zu@5(7rk3S}O3XkW#R1JP^hRvL-Bi&2W1`joZ~coP1MtNI3GEicgvE`rcbN7rzgsp8 zrR#8Be3Bk8GdhrmWy?gosxCGi`h>ED#pNxTh+1~lW`aRF+g)9naoP{BWwg*vY$>nA z1j|Mf&TK^|u^=}SN-5(x>s~z55FW&);vaPLUPP&mWsxRk4D+(ji|z`f#yeGXnM1({ zyk)#1i2Jy4V+3f$JDA5cAyMD|VtU zIJOlG?`=OpRimfinjP@wneobx+0*qY$vHKHrC1bd?4vWIWlQjjzcZrEPBXC>!W zcRc@aoHV*2J2AstU74aUwEb(#`^iwv@rSVA#rK6RTq;G(YG$e3O!`ZeKi6N#`Q?ZS zF{0T%Xup_r-mJ|1G!?1x$1EyTuO@s%W*|4~H)mZ{GZklR-`Tm$0B7^p52MJVLv*?P z5n`M6=#Z~>YCku%x`s-~?6_uh^Dvy=bFgY)3=x$RO)8SfkpUdRU927f))9iV5uvZq~kPpNUN76fy2V8bCV`)uHP zcx_*5VN){LG@y!ak^x!=Rjt>|7bFjEG6h-9;$s_^)%a5<8!?!)vSsK!@~(+-Fn4+2 z1)q1oQpQJg4h2n(sh2{>q|6uBm>$u)GcB&~Lq#9uHdZ7Cz|6lZUj$_&&U|yG07jYG zU06f)XD_}2(Q1*j+H;Jqut9Pcw$t=+xl5VKuSwa@uDZ`)X_1^VK?(YAntxt~UA7<1 zWl|@mSoX|bKJx2;dn3C7Q-N0_d8%6uNEl%yX;2Y+>*PV6Fzy%>yO`DDYkq9zHT27cx$L!FA+B0bq#Lu`qt4T zY-aQ4QpPxNeT7a`5qX5pW%Dj|78$B|%az2jaf{nQy!BSKmoVED)HTB+uO}8CvTfR~ zR@KCds&r9%J!q$*Rd#opFAuped-oYG|@HrB66N9B`>o1{Wf!HxA-kTb`hX*-n;~KNq zCtEa@o~AQ!6xk>LG*q~aK!hzs_qPaF`J$hQm{i%d^u4g1F(w25qnAKHDSgnTOK_L! zsGk<>*Dq(2=1{}b2XeP0Z*+YXU-vJ$-QARZ%G*AhZ{p^0zxt(^Ws^gU4p->Wz+E;) zue6e6N&?_AtN^~Z)4d+U#`On+ZhD4XlQ)IE=d>IV*s0DE!-Lbm@xS%;8^Os(&lL!$ z$fQU-ZcyEbv)CdDUif_^pWx9Knn<)wst$g5XVNeYBFYxV^rjh+d~rM?k@I`57;es7 zfBNEu(QCdVT5Lses^ShROtL4UcLW_kIEMWzJy)aDJ?1@~(XjRDyCp80gj&^Emn}8_ zCMx&EetmCIi~Oo*;M0qhwyvetB&$no90;A{It4jUk}Pl0=NOdWo3WCGO313j@-OzPaeq&^gC9yW9olK zzfYi-ot7s4X?Ll^KV11JEU&F7W?S8l^XBPPm9BTBFCs!RI3m@<9Y2YIE}Ji#IolJ% zM+_@5{L*(U=Xffc!`n8md7zhaT@b^{q;UJp|=Me_7K z5hMOyC7<})BF6nA+`P=_ZHIRGqQV96UAMF^F-;cPrq=sECDZ%cz@TJWfaYtIjO8Q|Rvt58F~F zd)oq+-@&5cVxemawqx)0v~oEh;LA8XbSp1PX>0=oa7PGA+|ZKnm4xqfHLb=@R%>ht zN0`|w>%5mk`;&FUk=X$!eniTc_j=F#tu+;hoH6mK!T$GT{uAx1>&S{wJX%8mZ! zDI9*hzudmfbQpFzsekknB<~gi<0mRO+$So~9%qt|G)_z(Pn)(}@h%bDKs%}ht2GvK zb(62|uSK?P(=!FVBtm=G6eRtYx2u8he9cq@!kWL7#aqdUKi#+{wN6AFl$Vd;#=-AS z4yW<#3xIaC)+1wyCU(?e`ZPEh*p! z>`dp=J(Wbu8~CdKO1TxbZ(8gEmdUtWq=gtOlQV0A}#=9ZnF5QpV zs5H2&y*y!{fbQQonQyawp5qyU}WSu^GAspKT8Id zLB%58cEhx^Y3lHcNs0S5z$TYi)&KmO!Jz;jKlnR>3xd>utXC#9!3=oj!hir(W8eAT zmS5zwuFU{9>1UkGi<3b?o~H^&3)D{KL`SnD$ytE<90ml!F;KMT0a$Lh>7^vWFtH9- zSXBThv&3=PRB+KYf;J#Iqj|k;cfn+9GU9Td3wwbJ{euvd#6mF8xT`^KWC~aFimR+b z13{r01hvdfDnSO$vhq=~Gc(RZjZ@-k#NMm0W~Vves)XTai>W%_4_N)a0no_i0p!~M zmdf=dJB>qBPp}}}w+W=J>NGwb9BCAnwclFd!l~FmUdMSU7PAhaZN;z60SnX-#1zum zm`~d4e&9%n3-43Z?nV0st-LaA`cC=-pNM??WOqrVsGWNk2f16jP$&n=aU&=*^&HBQ zPp8F+^Q~6Lc_;hlve?46L77r+C787g-3r{=ggIJ=kDCIysu-xb=~-Eu zj?y4b=4}d!6q{zdz@Idp?D7P$bRR#i4r)g*Gxcqzs)J}IHprT??l6LZ~@jjcy#KU^;)w&diiE)_3f@?29GAM2x z2S-dJBUMvB#Fbkym!ed#O%xg@z-`cMbc)kT7k5AfN_oV^hOOu`+83(ioz=f>8WXu^ zISx2FJ3PvoAAzrBCD4P%Q{_SSQOGDCNpS~AkqdW2Xe(H*Kx@ve!VX78FaHXF#-Uq} z*Y4xg^stbQ6?rCyoLnFhkMiLoRo6y~UWc@S*AC@M#nsvMlKUo0M8SPUBLFu;VJS&! zS{K)=dnyOq58cTMct<)_cu$BYIXxirb?h&~hh2KI!fZfH%qtQ(C!o!A_D%9kb-52< z8)gs;Kd;JhhH0EsivBhO5MG@ZS%7`v#qy3TD=<%Jjf9ueKGi-_#%|MokP9)7CkqiL z4m&&W)gTO`=@yo+O_Kjj)7!mOkUqR@W+{dFV-OpMltc;cW&l38uFk&g2cBLl-Nl(d z2o`$iLXx#&l8BAB;tBAd)B?B2KP8c^*vrO{36%UQyEmI-(n<+Cr6%aBEx$R>F%r z&t)jskFH zE*7SHN{0`)n0sDY(8sg;A^(FH>594y%6AdrwEjr`rZ1#7nrdVF`2IlQq$-yJggNFA zQhgMzWXS>9QKfpaq^8rvV-Ziq_NaC?xJay%;JdP`%3`YcK9n=ng=IKN_frj?ItOjS z^-tcR;W*rKaQl9e1fGF3TJ7EO){KHQMph*})&)Ns?J&s+u^y83;Ls4vDFAK)dtx?3Q_Cb04Q_ z{@|?nK&ATq$+LK_Rs+p5Kze;~Cfm(HdsHRDNeN}oz4W({PuR?Re_cGr2R7D0rw8b_7?fKS&h!xP5Kq$yX)U5?IKhyHLG(#Q3p z??mtP?(5$qTuj$}I)39ca+fcOW9f+;^^U@l1{DD>tF9nvhf+&&#VZV}!C8)LE{kU2 zC{%SY{<7B;yXu`JW@XId9PRP!fHaA3Q>fX;x|~W7|2<989TwxsH?HUZ`CS)P`8z8i z5KtMEv75BCOT{??iP)EaKN;&lPgO3~PJb7(bFvu6PswQ@89|T(*A%ax2a&KJ2+S^Z zWs-Q%)3yrA3f=e3&3I)h(HTt$BN8O9YPmxs_hIDH78RmtS964!Py$0?%=OcB@`~ad z!-%7jrjkuy(#?G3$D8BBadHl6NL|Bw`Q`>eb8ZYhEc)mnEJ!2Q+Y+7R>9Ty@lOLvVisRl5@{wD$2>r6IY`^r zXV4DS#QQDchM(n;WL)JB%93mh)c&)RUY1_P(aVo_?vPGwNx|!rb82VFudY^1HJDDI zdyvAh{3;bqr++eYIyty|*=es>Zi@1O$Ki{Ali9WuZw`tUQ%pdrF&R%AU5KYC7*kB-W;8{}DZ{QcaLZ6dws7B@;98Ac;yd_E23;q*{~NNcypiUe+8({j zy`1})L{r%j?AmPZ(D^tWCwf1F2#}>1=e`ly5nV;)n`-9LiuB;++&PJ_=v`A)SQGe6 ze~#Ll7ja>mMA1l7i^HFJK?wuTmG!*er6!4K^Y%nrkR&N!@-J9KPBLFo=23{7agWg+ zYkED?Zii>l{1k#7Wbu{C4oP=kt_dxvV&A4b-_1iO@nJsP!*`>yl1iA=QyI6lpk;G# zarj^?XOJ~87=HYpXNy%pGki56)|$LE*6q*b{)JUYKGw>^@?B$CaYERYj@S}JG|Hq*4V{!xCv}uOW3%bkyoO9Ep`hN-k z&vzLsC;orNQoto3_sfL_H$=hlTEp+_x2OL;MQO$p-4MW|x(dd*yc#~(e@@*%)42=x z{mpZ^zcR3DjJE}7Q2&h6>Rh1m`D?hD4tRY(8M38-&csl#bz*_EVc}Co+F|=YfQhIZ z|7K6ium8<-7u&Qe|I60^_W%ELgYy5obu?`QcK|{E$@H$lnaKb{!b|?`D-YQTka6<_ z=^Fkc5mbco*rfIDd)&R|pC9y+`YM1TEc4=!3mbszbhtS&0?zC(P?=ioQCi;vp!!P# zfN&4P8HB*;-!hd`sTkM`-)7KNZ*Ny_j!(6G?I3y~BJXW;C*krT7*eJv*FBj*Xx}Na zd2g06RchYay%ijW4BOqH3|afCu?ePKW+vrfI!{XgFr~(G#vTkmtFn52K4c4Pdde{9 zf_cH{Au}7h3&uWYN8F!CyzqV%SBH*)Dl5is0fOFCX*A9zo8wPa#X-GL>^M`<% z036W6q|{1YmO2a2pmE)|z!|-SXH2vwFwqZe+C2I<>ff+S1SB-8*ggGj(KHl1H`56K zIk)Sqjf^-I>gpR-yGx?JApi^ zOc01O(6i$E@wOURIq7@6{?~1sR{d{duNAm}9DxhR6d;6of+IPOr9rcgi+%$;xC0y* zSS|nlj3D0wsf($ivX=D?TR@p_Q53pvbUl}2_Uo5s3>YX&1SO0Xn+<|6n|ETmclno< zr<1=bXmbFurxk)uYfgK)9dH2IgENUm7 z+_UohP#{uCm04r)cai7=tjJ=-B7x|1tnUqUa$J!PP4T*{_Vd0;=8A*|ThK0zn}z)P zwry&LdE(gkI|&L{@UPy`{-6?@>gQvh&7F%Ld_qzsreHu|2!=Ug@a}B(rmW~0_PxU- zV)x;b$joOzPVz*aDNfzif^A=^F2kt+zWXv8QiyaeOss}`&~o>$prXy=-9*ox=+QJh zfwEUZ=Hrtx!rtHWYWzY^_I|&WaoN3s^*k?r6@EU_@N4E{S!S(gZOgEn!P6uG5Ik7f z_~%Q`uKVvtR0W$F!!cY8luz?H{0Aj2Dak$!`n>~~YzlkfCF>$Q#ZSl9UnMaK1-SAA+H z{d1El^3w1YzR+iW+@h#Be|&X$yS_a8yLHo$S9tidlH?`~7*_-ipPjyAJ-TzXA-BG? zGI8qRM(ubFhu|e<{V?+b7DyZE#gl6QZ?55@gTBtdN=!bPI=tJ;daIYSe(zbVcI1zq z*DdTWFkXA>uex|bHaAf3&-&~i($>ug%;mTw0oW? z8@BcinQ6WQI9-j6EOpFt*2}(V6flmC0Fv1V=V9KHG!3i zGF}3R<73^*+ckcN+C|16^8->TMJqgKpPuBxj+^CguDcK!p#E9T<$myt{nOb9Ohtg+%%};dIjPqIB-rLCjkUX1~mXU7$q%kp|>1Ce*`yQ z%X)Ke43|C$8OGa2B@L|FJAKj2?#%4m=UI1Tj5)< zxwiKyH`v|ZSlc7IfCb<~%i+ld5Wa zBJAk@+^vyzHXUE9rZ2Iq_e-bU;fzoSO^M$rON{*kUc>WGUiB7-KobWo1p=XEh9J zDWmlXqu<_)>j4wwS;e69?W5!y4f8qd)dA=y-(_4k@f8k#+!_;FMz)tYly9p;2$1=dV_YwB30S@DF0p7Ki+pm1_7^4Nn$AU>sT5 z4&NU~3g(ph^ajC-ZK#DZ{wXX=x^Hv_$DFjm8=2x-Ln^Ig$NoAH^m07X{JSc+DEE&^V>=lcRv zGvL?qwXOrbs3=EK>))6FDb2mdB>YaQO}V}ZC5+#X zBo!)(_|XdQCxaDWbuw@Ma&4ML^^0aqpK&fbeQE0OhwxFOEwpXxZW%A~u7X+Z?SAVn z741|P6%Ls6H|9zOUPtv0>wD+8ZDFzP+K6unF84BnSW5nD!K{|e2-u@N6ai^QKDetj zTpUoEP_)`Cc1~@PzM$>MayUcc&cVt6m87PiCXIl$IF z2~fAQ;TRYWtR!Mq-lhzo*SN+K#cZ-pTp+_+fjoaa@@uE3|KI;xloZn%emwP~sI|KJ zBVzfL_D;MxM3Nxr0?mgy{tYt5QVnCNv0Kr)2kGzy3i?N-<&NH%pUIT*GG&W`cq7ck zN30}AgtzJes^JKgBVs++OGoIZop1nOowE*l+0cAYV?PJ<@c# ze;mn>q|~mQF(wR?Vk)jEBSC%rnwEAgE$yGv|Dr1Q2yrBiQWEDE>$6XOTt1J})m2T`bbmERnXs)ewuv-d8;XWzWT-&?0(9;_X?85yb#=BIs;s$!o9 zxyWZq%qsf}uI7IU*X9X(Z?+IBBQuFz0a53Cmir`jOX)D6FJAsy>Sp75XAze-R%%Fu zSx5~UE52t=Gg@X_^0N9%>yXWc!tfc@TbQ82;H1_Qe7mD)aIy~mzleLwsHoaM{CDVv zp=6K-5v0+FX2>B7LQy0nN4iB|=o(<8K}D1f1r#Kur6r_Ax=Td5hK6&G&-45L&ztl5 zywSCkwO}@T-}@Wa^|`o|{s@>iL4F9d-!pUOjbz*wAEQUmrq1Rhj6zW5vxI{B*D_2{ z4|zC5|2vm~*cGDkdFww@ksr@3516qQw(L z^^rykcfS#>0=Za*5!7tBVRAs~Kp!v>ocgUsTfM*Yy8dfLl--blCy?q+HU$&lBDOZ& z-e=3M-Iq_~XwSW$qb}0$I|@2Z1#;;$>`Fzp)F+=fmiHRM`?ZS$>x*VOT?-yn^Y4wth?hyj`Pi^4CpW&a< z&j!h_Xks<-Z6DM*K0V`i1mw^`8^X+XJYC~Vhfns{anW0aem~>%FYlUUiV|ETBRdfO zMJ6)-HD{=^OK<(VlaN6Z*5M)j6 zTH)3^%`@3*6ijb%enZgWcRANAUt!9?4M8Pr2b#XgaL@Hh%~s$V&%Be!FxNpU7Rg+4 zXF}gMA|_AT%Bb$sV0KZsNvfdUhv=#}nfB3QGZ$PSHwzSJI$Rqs&*N|axH~M^9o53} z(qO{2lOP0skvJH*q-rud44QYKoiK=cEbFSjO8h0riZb;L_OwK0>f<4m6=_#lUmkb6 z)NM#|Fhz=4J_U}vU)oOU^|#bfh)?=Of3gN(d}4+Bz@vEDf}$PizW|>~c9Qlh;jKM_ zb}CB#!tOG#ugcH|S!z<;C8Cv9lw!oL4as;R0&9OwR1jn^ZI)SMz)T*_FNN-OK4LdV z+>Pq>t{nTtcpE#@qqFf@ISxS_6eH=ff#01W)o3!Yz}ihVcU!T{$-|dt*G~@>XBiZH zD=yzfl~1^|4sd6H&Y|=NFNF`xx6nW<@?!I6MIse@-N2?dGXGH|;qIiDXB;KP>-EZV z<2ud2vryVWuW2E(3XxOMhn((~OvM-9I{v{9oCN@p&*R44ijey$kqCAySeKWF9AEmd zrj393{B?Jjux@8u*%OiS(R18Q%Vfz*vHD#VNvnF)CE3Ytf^7T*ay;a+%^!9u41Ch<#+tTON#Z2-fa;CM~mYR#u#KsxujRcxj`riP#5Bn zxKSn%7T^jTL3SE;*)f8PX9g04>X-}SA`Hb}r3upPfIb5z&zgh~WLt! z41N;p(CW*J(`i)mSmI-?3Wy@Y5y1VXUeGm-?SS{qM$rQ*`fhXp^d&8t|Q zf6{i|{D#l+?VhMcvr@}>oMLX0jyqHLFrQ@kOSxgsVsA%&Iq#D=v+=H^&ofZ}h~B+F zWPy!4(J_N%jq)>T)F0PhZxvi*h?n-1M>sPj!(dw_Tj}O?$ zja7RCNK$LrE-%I8V;YW?Z$!vAkBx%foW;?7W>U-ftx2AoCIB|``>yot;x6rd-AYUz zY3^_zr2W;VIPsM~LQ{cuB*vvaIir^U^=#6aln~Nk5bWoDbPC2oYZ)K{vafZG_G3`8 z#yY;m8tQDv9tkn;b7>QrE3jss-`e5KB|Geh4pz+pw5 zNIED(-Zj!*f?&NZ^NKn5>?=6SB+a6i6nMx_7q7ak+im zBie9exy4gJf*N}95JE{yy6Nh7!b+2Xk3PL6xtlUD2w% z8Ft4oYw2r-2O(ZvUbY+ReacUvv~73!ehDus=`z`bv+9?k?+b9g7npF>k*$l zUv={}>*yD`nhqxazWamgJ%fTs*j*$S-hd$Q^Rv0v?TbCnluAejW8&2j5%&8q3ewjk zXz`jIdbcBHf3Ze0zXk@|wNWMs`sy zFFF7aOt~ODgiaKTcNmm9hin49cXLgYQ~cZLM&47c+W=^8Syavf3!{OaVJs(Fe9q#=Vk6Ex(4uybvsi-_7jAs$7{>M4`64rr3T$P# zWwArJ4p=iDq79&bVB+}%N(wi@XKFG-&4)FlVsDn?PYy|)?9N_ZjDAX5gxmPHY>HnQ z5P7z57~yxJ;D3U8NI*>8CaDJXBJn=12yLKih+|?8C73^1+T4@b$kODrqsIkMM{MK~ zg%d;*rV37cufc?ALZa!w{!1KRHv`g2UBLEJ=I>(y{zy3ZZw*56Z5(^0z82lRsC->M z@a$;E?joK(?nu?Zny^jS6s59^{3fMNL?|`C3FC%lpkD6;(QE6VVH8UwqrRzmbD2vR~vXh6I9}B&ouBM-ZvUA)ME!d zbOnLapsa^ov^-PU#=%FkVfVG_#`%cJD485JvXrxlZCO^Sv(h0F#M>peW?+Iaxo9Fs z78kTdWArNU;rsQ7u?|Q^)1c4eSfu)>SfWLV$*~>MKRB=*2I2~i8svl>V6E{FcrZ<& zNu@NL_QAhNKDb@m=TLZ&f|UFVut$PR?yeM+`0V?sOkV~h_A0BEbg1jXI`xMy z>hbrdyj?hn_CW$gCFsUn;)s0QZ%P*rz!077va+{VtUPaK+k^%abTBQdS!@Gg%+G^S z9PQJWppWrS*8KX~U{1uwUDxM79+SUXENOj#LAsdb?j$bs6x!nuxucS*5ew#b1SO2u z@8mBh6)->=)>EGc;C>|VG?P%nAe!HvhUXa&Ks?GZKd(Ld2TlyhmOmVUC^4)uK7KMk z_?hG;X&|@tTaRel={fY%GgH4EwTv*q9_cIOzQ8G$;0Yo|w<^;|He)rG2s@_U5JTD& zhmsb5E~gGsQ{p}0ImM5Dc&}LdxdgS@2SL7&Q{Nk(^Kb;90O;@gV!pZ{);~Xu^A4TJ|D(PdPMo@5WTj z;4}g@caS7bJgF!D)8wVF}Z}&v-6}{3w7< zROg+0f<%R{hd;w3!?;IrswSqS3t$9)pyy6@pwk8lMQ7Y-zA@)k9pjqb?{~6>KXe!Qe0YE}&^v%E(W)(+{cg%9GN7C-{n>-7 z>8J%Vn%=zWp7r4xcN<)Y>yxn=&q=45>(;a&M>LyzduFR(7M;bjze-T%sJ5;I zjZ|P>e%~+y3X=7MKA04_%dMnbo)XsN2WL27z(c|haK3j0_x*b%Mp0<5bs_7D7=QG0 z;y%^Fqc|rXq$}7$)}s0+(0j zP>s`WndVUDP%QQxXEhyNfN?BSl<&3OPg2!;9eLwxCt?yJV;gf$q=p?gvS*a-`pV% z>zsGV4nU_7<9aN?{-ynS=|11z&^}TMG+?q7E%ydGoW~;7s~XTjj5Asq|DE^;2y2GL zwYjsKSOgzur#PpseA)#7VIDZoVHhu)daPi0(Di%Du}lj0TD4hl4s)D#=PMQZ*DMIE z2~e=THH!c3=eQzwdZ{Jl+hyT(f@*AjL6F6@9>^geo)5*yS;%bE11d*79OjZwrG)1` zp-%fOGq7S&>9cS`8g7yB-=(J6kCB>5J_$W!-eGJ?iPN>#7j7B5U8Ppf?YP)Xpf%`J zUyW|a@c#971Vp;PEAfgYvzhPr_ZXnEch2Y*w9;ixRhN{L?IH~;#;A*Bow!BWxAAYK zTv3s&$aqdbC~j(DooVSiVsn|x6Q2>M%PwL6D#{FP?Q`0T#aNH1`YjyLlzWw4iiJsS z+!16uu3n7YL%KOqUPUOEC=!a;5g>TXl{jldF!-7J1bXpE)=Whqn~7)bQ30+ZV>Ahj z6)6|u*Gb(Ga`*8uP6~W2csxYmG}gLN5f`*YxBxxHj3<2Or-xq6+AOyn=8jOysyjB( zG%z;Ib)}LasrG9M&#nn$2AY&g^Hc(VnwV3CKk(=)44>xIgs%TVW7*Vt)3m7Dsx+&zYh48usX z(pw>e0pwdmV@x58J9m7^L^U*d0$zyNPS<`ZemN8Hk~l~+F9T!xK_l-ZP>j<2o^l~_ z3X@SFq%_-F(X~&trMQ8#cWviFgIB)%Z`f4~Yg2h#DK~2UIOAYk@}5_0iN?Oy+DI>j zVwo`4{{Blz%O_2whzf!YwWXH>qt^`DDa@_4}WGZX0` z7$UUNs6#1*a_zUJ{3CUc(7L`$f<4b>y@Z!jpq;Hwn5kP=Z! zy0aL!P;42M2aQ;^Zh25?6DgfTn+02}B5K=wi$p9u70E3RokZMqZ7_VZsOOk~M9UK9 zDsy6)RofI6)gBU_H#a4u|C0b&xw@s`!EP&Pj%p%R>cz`e_I%8$P{mV@`S*>@t;H`C zF?tMU49~JOZ6z%hUhIz3HuMlHxhbI8W!4Pg%WUj3y76&-E&(0L7(7TR8;#m3=?2Y) zhEk$NKf^-v-FqCjeKR#pNRhK9jXS0tAzXN+cb}`|3o6OcW|Qi*xhA(eyZjz2&53eo z*&rL_bIeHfssF?J((p=tq)vbWyI1{O?my-*$b&0lMgxx#x9spR))RMLDM1fW=d=qI zDFWwb9GrK80=PckDAY`cpL3BzLh-|?D4}53vAYmis8gyEEr5WV%V#}MM1rovHr^6b z5&V{5OzME+2gU14@jhr#&`#(+Q6F>rm1xJ84M4u(vA@mJbjooWt@UX(Yeq?^{ty>Zc)~G3-!2Vf8WUX` z3Os4AG5401MAA=$=+#&C%*p5$tB^EjEA_H)lRy4y;^!m+23x*OrT;Xe0cJG=*!mBJ?q2 zi{XO=$;$J92(nwi;cZ4IM<0#!31v`O5-7<;u2P3tlq?|OE5TZ*i3Ul?wvyV|%eamw z^#*0$K@ZINDp6E48tilO`z7yiyN9>D4aufLOWqwJ=Gw0s+0CY?S`}4p!RI$i*>{c> zzeTuqun>VyL?VRYVM4QoGjbQZENsodne=}`4KtU}# zXxJ~2taC@`!}k&HSt#1e#n%>crtw{(PRd`cA`MFV)qOQj4VV>%MT<^8z0 z^Le*HF50^>#R^;;48LwNn8uG2k4ELH=Fis72BkX z^)w@%$Y$OYmvMj*=O;(e2HV%+5)U|5lyGu;Cb^aYrK<#wJPImU$j2C)!xa7Tv&nEQ9{+Ey!4`O1T8`&{NdbNaw`ZI< zvDJ_=N}>BVq(zE{wr`E0?ZwC6+|^{u8k_|98LmDpTQ@w>By0&f5=JfOFJMi&P3{vN zN=n!8+VQjTwmXre(gys5noD>at|Ei)zR@nJTbgGY(5w>ghcV#Uvq9fOgDp5e-syRu zF!=8Kf3&<*zrO;F=W}6vW{xhLn4I@Mko$f>v$y^rIEh<>)M}zdEGRkl*>Bp@dUXjS zfphu`MW21!ILW5gSepx7a}#rcCGEF2zbPEe5t#K$V^hV{5#9To7s&poQJ(BWj8W5A zbAbHci`>=~feTY=3s7oSBwyyLB}?fj*T#brO0uKc;4>)sbr}BkW*mp&%-25%A}B4e za}YQTW`{9d$~~l!YxxQy0X@g9-WY;)l;1H+G&SwuGx$&D%vmKx4Eb2bLMTiaWAyI} zgpVc?=L0*>M0UioH^lwsg9l~%=F&m6lpaD%J;-;}YOv_>#YZ+VMi(|5f=~nLNDF>WI!}YIgJEWesJdVzprM@ z%g}0&T(QEHE>^&(f@vjVw`p^6S=!hzS^$Bo|L76kr7R?Ox8J0 z@W1U}$-9+)72?<*+6lqh$knf4oVg*;UkGX_k3;%3$L_X}oM47dHoV>k({14271r zKiN__kn7#w7XWLnI>zn^4&bs_aBz2-svZP-ww2)uool~Oaojy1Jh}OAH$|QFs<%MW z%{dW%*5_(m?f124yktC*?^h|sgnrql+Mgva${$axoZE~`m^h4;{;FIFDBV>3Wtif_ zyS~F>WLSz;6|}y{I8--C+TLpTbd`js<7rCO^RIA}(=EA&zeG%IMioxV4}2?A$lU5( zHHjetcgx#;f;IBo>%zl!kdL(i8cCUJ1Wla@JR2b2#hn0>odNQ&KPfD~(kpaZY&Z2j zRmyCU7_K+`6S=~7b>AP*6P+PVVk*PV0x2B7rT<<;OiwQe0hst&OkLS6`{;|{mZOVR zuZPJ^j@J|kz6Gms>1*KIF_+ee?$8L`Qd8Sj zeGgH#Y@3Sp8NM0Tf?U}H7O)ARI4m+650Uh6PJBeR^;#&k zW0pnU?FH{rzr}JC6X|4O>5KB0EuSWf?8gZ|JyK|X)^^#DDwIG(zfxFs@;b_3=E+Xw zi_XyTPc0WRMUI1h7c)!Vx0599UU7I>WGj8KB^#>XS||ZTg}?0t3!jvp>DT#LPAKSp zQVFS|qDU&Px2{z0$osL*fjj^WKk@YtV5IJdoP57UucFBE zP-NXnt$T~ytpfKOEhWxr0ZN;VH6MVQAEkoGbAXW5VsDdbR}0{ei_svD2Gh12BCvs3 zIgMq9PmH!*PYm+sUTg-wCMOUy+MsPY{P9r{$TPk0IgvDEk-HMj0s>kpKvLGJBv`Z` zI^iN+{acOuYiEFes*H~J&e7Gy{TBhQLX=kv7quP|o##?<)@FmPToRuSdy1Gvi0|=A z&)dZt6uFP$!<*@1L3&p~9zlGcYdf>e7>Gb!|M=6#4JgmRjx!G9ug12bW zu{c0#FwDQQS_peTgBd%kSV?MmbhzA3+p>jCw)gIfsv>?AS&cXMvf)@DKve zOKX<<)22-?10F~hABb$)h?qL8wP0;3_+8A-ZVm;o*EHp@0(P#|NWtKiyKgixX(0Qe zby3CO{1iuB)_bj##)*cjV%^V3cv?clOfwELEX>Z%FiK{(q=7to^knp8pHOdp@Bad+BT_=W}Ow6XmAIfb@^ z*_D>x$bA9k@5vlbPy{7&qW-5ja913Bf%0j+TPh|n-3Jd>2M+-q9o>^$p8Q+(FGrDC zF+eC+Tb;*_m!0lp>b=aUNLh5bSjL@`MDp z{tN~AzC=&Pkd8+HRymDP4iu*|f7+QQR|RsQy`1?Wm1}^`8W;NS*<0#J)lzFdv#!r6 zZ{FS_q5P8udv?I5$c((bCY9%8EP`5HBP^C`N$w18ewk$Od3}7!cs6jI+hrx=vDBB- zV*5YYXL+=H*gB5xM9JFG2CEG^&#mQ{BLDLrb@gTqsDRV8_c20VeU6@X9UrqeUSM0} zYxHkoHcvm>FAztAgSoI{z*}U&M%c(fD&3@motilKvsU-`n&Q2EEQyYRCEL|kyBk{# zxmk>&6%JH*l*Dh)Si3#N(Jv(~#64K?8)n>%CSK~ozMQGEfu9|m0Y-mP#&lk~G1~a) zG&s9Yi=FBE8ed2h-JhCm)!o_D(Q~vHV}Igia@7gv8Qu~P#sb^FAXeWUp45V{@dV}T*G&X>mzE3K;ls)M^p$JLAFk14~~I> zras_;l7jRki?^DIf;GE@)5OmhGLzcpI}DI)NWjIhjiL)T6()%v5Llh1|Gp_LrSuDL zlezb@UDP8i+2xA0)L5hgN&(P91ceRMS?o=K_t}%opWAIu@RX3f=0hkLLr?X7eWq^l ztpTiu?^S7~w!L`Xbu9YA_D*X_&s>hB2yDhVw2R*+S;y1j5=w}=N9wBCp@h;sre%FZ z{-xW$nJDQHlF*nEZql7s!josE{vFf~4|0-O=ui(uGfM8(eG$BdA`Pr8G@Rrdh z08xKUZZqo&R4-54<9-~BxPAdON>&^QNVrp>Iv7P2 z=2m4P((M$N2AQG^Qg?Df>z~)d(FVYm`6vAXjFkrgrq*iI#4F8rcjx4Co+eOpGB!ZO zu&iy8^O~Z-SckzT1tkTH7Ms_}K^zQHr`uzgSc^e!a$Q>Szt6@}&l{1%j+rfqZ}3CX z=__9%efv&--X}$en#ow2MO3=MB>AccdXv+69iI&oBJn2c3C)WmJ70 zk6)NSD{(rFtso5zv6x)z|7gYJRcOg^kZ#={C>~J7A7qfPp`LyoV>4RWrxidm-=6?a zIseDcd93Qyw7Z?Ei&O}bm!!EtA=S9;&%q7-+@`Jj5aUW`nyWS`R^17`@S|L|`1Eb< z{(|P}(w16DL5^6%?(4lKuPbTVF|V6-6Zve;MEtK&WjcL*FoHaicVKV-=MDvQ!N3jF zAoUZVOe_Ph`kKf7E}ZEuKp!HP>Uytb%8+_%%DvxXKKAinJ1|fpo@n6}d;6XBiE?M{ zqIUy|dmyaebrWe*B z5)?BBbYXiFodw;6#*^Rc){Q^dDsoiJVBj3r)SuPj>G>bROwL zAugUEX;0Qfydd7+{JI^;z-At8*lBafivL2}i%Q_56%EpGmSaBz0hYc2irgT%5dF_2 zcQVNATUvM%AJ}p>p6++CZ;rqrzTpw+vJi|P;mOQIbn;EBNDb(ml}7c;J57;9KWR8e zIgn&BN5D6H@DP7y(Swql)GKMLbz5nYfP{J zx`pb$LjEbDj&o_YJ}<|A%BJ@G;C(RrN7Ij*re^ju!Hs?%&x}0$l~8&Km#>K57b&H$ zZ!XCe*%>nZ1SP@^7~O*+{V>F2d_6B_Zx+6N{H&v{bVq= z=m~H;ObE_?##(wGJ{b{fZLoZfsXwv#^3m4#LDi)1*AHWNXQQiPV+<-eqlSxK{gye* zK<^y~46q6sUW;4VV$$hERz3e@<8mg}wdwB^KTPdk|IyupX-8MgMO#iHwIlOI)JDWM;^Y}G> zYN09?9DQ-_b$i(-SWB_k5+CL9?BmzuoUzP?z$~-syyzdcofk211oj^GRk}z1!JS_L z#CXG8>FG<=I1)DCeYazieZI{dM2oIFTpj9wAEO#*CvlYS5^usYu%|Hxz96qHdEI&% ziy5%?Vw%Lbe8lqfhzsC6!vV3r_P6lowcbG%IC7c`^3wlgr~D*|CjUvz4^m~*JSXg& zAj!$?%N1<*EyP|25*=YvM<3HL%NoZlYlIFRbRP*2=$37$= zCvUhoS@Q%a$?8E>Ob*rTjc6kc?(=_(LXh!`xO$RF1z9)>e@(1#afCEu#tVheQmL>y z{ST$TFh%!fqz!gY2u$#Ktsm?^z{MwdhN&i zC`E9tI)G$jtcJb)$1ecnY$j@2U;TefeG9)6tw7x(he}LNMk&cT&o)el({MQB0)L}U zaRn1TxMHGA``^;HDCC7%2>( z`R|IbvH%Cz@+C(Fo;he4vHL?hbw`T8OE6>#GeX$zw|OIx!fig z?f;2|VD$wzl(HaOn>715P^3*>suu!QK{rnR+OKfx7=DV&fAs_jfVdB{)R_Plig7h4 zL>ujGph_i@`>!8Q0;V_u`#An^kTdODf!`kof{Ui@aoB>tCHAXk+h;e$!PLqZyat_C zf4p~|nwu~IDSyn)-8Sn$Hom*oW3!@bSYjRwO!g*NK(0TP76pX~sQ-n)QrGzv3cO=C zKBPF8fq?9H|6S!&N7e_lO7i7k*0-~w8ctan!4WWqv;AMPgf;;lgyURO@FvlID3Q)w zmd|4#pI##-MzDqy0jN3_C?O{1nnO2~n*VLxf!e`!Oui?AJn3yl;KleUXx~N0yVQZL zya-6Wut2UkX=syX1-gkcB;Mi~u-#4oY{$L-4QmKUirPW!viYc~ZxO{gh;TM)3^*?Y zPDUI_V*;45oxtr;ii>o`oqOq1*p124%3Kmwk?nZgmUQzQ2iOARU?g#OIj(D`+Tsum zxa>=KJ&YerhO9v}__qHzJ4hp)MTZS}HJLZpKpAoKxj;4^jT1@1M;|MU1Er-ZHGbku zp|YOqwxIXj-L`2DwtTVw+8@YY>_Nv2a>UZbQ1uJZgJ?4Pb%2G~y8uylJB$9HcuF#S zd(&z?)xEEDce&e_V-~eYg@aM#JstQ3s&$~KmT=GN^&TRLh1(8r#>H2k?RI}vCvfry z%Y4)Ngy&Rk(&<~^HR)|cI6xCEKd1nEhKkwADh9Xz9)=nRkUxWe?!rkPaB<6G!lB~e zV9yVf{MDDXHn|xkKy3>OwPB`fwpvU%x;}P<4dx2b~i$WIV$`iC@nDdIq~H z2{QWkxBP7Y&8Zd3God6#*t!axG@Y{2yGUmmf!+{CTujVVbfo2p0Re?~TgmZgHHA9@iRoJM?d1I9zl?K^W z<7y(~j6;`PS9|XK#JwGwLlVwJsY;v65Py>{=2ke5IZJyAb}W29ivO|tfA_ieb81<9 z$kxqlNrBFe*`;MO;QRCh!&f7aWwOyHw{>r?mS<_s)mP7sX7I%dE8dID&5@#%C>w72 z?R_5UV-~I#u1mo%HHMcC9KrEw^pYe$KDg1*qM56`1+$@PqC8i)J2|1amoRy z-PN4ul+jG7EOu0==2gBGHGkqh+J5Oje1 z;^;0czCXb98NS#C+co5b6Yx-G9iZm#CJEJa9{~hWN5?MU{T#S8m+01cI?YCC5+b~P zY%}tMaTx{09{uTXr`@G4k#*WNn3}XALcX1mlBsm19hS&VXS^8f&?FJr{??Yr9)cL8 zcw*E3C&}3P_N{-jS;0L1MIRUM5)T8dCaTYyld@||U7E|9_A{voA$I~kW;C>5q)}>n zfSx-}ib**_Q|+2MXFTmLM)nUO^jRGAD>$jVKApsIf@9L#C=LIjgD3rd3L29av9S}& z)3)=IXJC~+-RfEIPNhZ(+l+^K9b7mD^M-@x&OWMipIN7?k57M zO@Gv*jL=uuibgb!?5CX>n{Ezl$50_ zMFWBVPMh1h+PI3n!gaY{u>>ChRZ+Eh-N~O%CXmD`?FQ)uj;+o4E0-8|ed4B}0FXLT zL(%}AxXo|8_;{p58b9$EXUPup%inqIKm<^4Sng0bN>dfGCVMoO%Y*Fmaym-RN7<3WO9kl&^nm=q#>4p4MD&GO~ zcCtnSo^QyG(vcoba3@|iAwPSk!Gl+EKk*+x#8T&$^WtC%mRz!E%}5;CCx@Xr;4IEy zrCjAH)sUn zaB2^#L)~!`g^@wP9IEI8VvaztPOk<1Wsoj!ZP52~(tGlIFb-*AQwzk?hf_4A+WG!q zT4=&q20tzLckGnwr~QSwL&zVJ_#6MCJyfUqBz+<}4BrFYLhs35q#HyV%-nZQn&%Zfuus7??<>_m&)+8qd+PNooTVu_j|l|ns{+>JubsN zM-tzkJ0jhahely?+v}(LLt9z`!bN(;C_4V6*}Ie`JlM8gny)>> zDf>C&$z7IulC!w`p>9wTlF_jK@E`x~KGD*ih}9Lt5ZK<)O0@g}2}O6O_>RUHoAyp% zeW+Bbz?ljr&Ac#*Tl>Evza!k%qnszZkM@7K2@ob4&?&!poYOQD*-OS1OXG96xj}UI z5WE|6#YzdSUR`-6?>cin?d0&s^K`zn99!Mn{;CN3W0Za!j4C&RKcyH=`p6Ag1u)lj zP7I4$Sw5cGkog8iR$Uj*+*IZAJk;a{Gh-<{EcwmvY9+yo1pXx|5j0t#>z{MA?eqds zyN;O$cjczKdI@(Y?nNG^Rgj{rto_69$7tmklOlDRgU#87Z+F@)P-?sz_CyErQmmBX z2AgS25+!BdsP7dP88(iOxJ=acZzM|PP5j7>sl0JU6Xz%P#+C z{O)P@TX@QHzrUj%Lh?iI1n~d28aS1=;(bxWp(I4hPJo;bMfDo|!-H%q!-8Qt|0{-; zuOC?(B!pR6-l+D;*X_63|2^orlIB%QyFOy1KJ7gp2BTaMcDqa=2-9{`U>ccjbhaNd*IMBIhCvKr^;O z^iQPu36!8mm`la9#~qh5F!`gyui|ZB=AQ^?q$BpPbxL@&-dHc6xz#H@ZE2IaJyLCS zU+!&_YX5_R!tj7Bo=B$gnl;OUKlR^{|3J0n@jcBh%6|FFQFYF>+`_n*X>Jngzs;Ay{jQ(tULd$5`d zMm}?D_c4z$HAO_qzi+_<+kK=a>Cz<&?t_^>`gbalzT7ovfTM@vlFNF)tjK(&s@U<- zoh`~`bu>+SbsKOmTHRigH11;^uTN_qjx#r|- z&hMxdKANVpI}f+I-8F(7dtzL1bG*!Y+yZR;s`RcVVcp*XkMq})X@qg*b(xBq7WM$& z6!RSuheWG^t>stC=+vyk2Ix14WMY{&gddMZ)RLvH<<{KRFL)YUaxQCJD=_X{$GNBp zeISK%Jes7uIrPN7A)~*JWAts*u6^FKdcd< zW(1Vw$8_(693r=^yGDRkcvkR8U7dJhPI|kY#pUQ`J}h578aCgdT;FkJ*~;6Lk`!~) zmnL`mhgC?t`#T(f==K{8J(Kd8l46OHnn9Lb4Gt?N37~am;+TuSKHxS44h=I#02P26SBHT*h2;1?r?G5FaASR@3wU_Xmt_Y@!=XRlexUbHmV~jpQuI@I0mx0M`f_7f zSzn$j&S|{1_e!CG%Pe)O(_^m!=f@re3G+MZgsQDM9I<6SucNB*f}m%IKH6XUPx?z9 zgzXv4b7sFB$r}qQ!SPNBYD8MXYJ~4gyu3R!nU0$&Fcv8dv!{n@}!_&v9 z`qNb@Y|-?N5o4b@2vOgY9-i7A`LRejyr1?pY#mtHFzp7T05*}H$LKw6q4@4dmtLpK zQ%6TzuDkE>%okE0VV|R%Cb4WI;xG*{i1`!LUc_yE+5OWVb0OGGy8`&ZD$Kb0S?I9P z8*?}13~E^8SOdFQ$7XGQfY`@ZUxW)Lr)-r<8^6z=RXL7ZdxvuUIw`l`@=RyAd)DvE z6I#k$WinOzk&P7R9c79^_-XW{!zWFF{Fdn#dJCBeww9qxZ|ebsu@H;}8m562cpbOw z+7Ks?U+c%>WJOiuje&tWTH^o|c@D^dNw;jYX$Eb^O&&Z11irbDK+sss^nsT42YAB` zfebzza%S4L$;KNLeOTZL@TS6x4Z{n;gy9-X@n9o@Tzt+G+$wE@tuLP#S7ou9;LbJ- zJc#Ka-FI_mWl10Bfc2D4u97FkDwl`mf459adF@W?r*tZ6;_}Ahqy3uY06)SD`&FXwHQjX7ao^+liB=|N7zi#}} zyoZx<{&N(|*c|7SLy}GjNwL$f@c8u|H~oT#cx!Uj!PD;JeJY+WL-5S?#5m2b8B|#2 zFbck!90^zGp$U)toc<&JTg!M$_IOMt`3HucnBe@n!X*4EUU1+Lgo0E020*j&LVjNc(<9>Oy`n z-+T!M2K7zXW<0YY&;!2)9N-A2&|ld{@;5p3OER2+*~#fTkSgq1`T+t`4$dfi=M{gc z@l$dlK|9~hcrNGqmc@)$ua;CeTJgULf!U1%PW;b8Ap(qCitOqyaQl`+`1$_OP&7#{ zt80&1)D@!Et}D1aP!$Y44EOh2^0q7ZjxM>5laA$;q9r%JFd6z~vFa<77J4{&$3{Hi zpiBvU(=gh3ylKH#*m#*7Cdo%?lk~fFGOij9h5oKeGn?IAo-rh9Fi_d#{Ma3V6eAR z&)&0ib}_G2S;1t!2n|T;m5CF(qk8j)$tyR=-CKMS91lf}JJs)**z@EGR|(2Jt~z-g z*r*WQ1y0@ZP#3B%U3-azkJ9Kae1ZoqZyCSZ3&D(+ZCw4{S30vQ!wVzYJ^E5`V9d}G z92BHc$an3`bQDJ&ZP+CY56;K1-@rq>=Iq(or4LuM>0>Rf)>-ziKUI2kY0E*V=)^hG zb($xsrf%*x=dR%X>z-L}$b!ERqcj*SGF`&T#fZ1r+e3b%5P0VInuhwxi4*XG{vqs( zz=XVd#UOkOH{9M(+s``;zj8jLO-5I6P%c$zEGTAMzBtq8htYS&%`%~v zM78cz$}-XyAyk~@pu2?48H%KPN3fk#!TL&XhmX82GuC$>yHtE(k(vZi2xVKu{o_uT zAFas8N1S|PQNO1uQsJlHr29vU>FT%k_uh#}$fEqaHI(ZO|2)>UbEvM+;!p61O=l& zMfYj<$mf#B>J1K)<&IS?HFQD>4w9#j*BZwk->RLwr1D(_22E5i?b)CJL<9fX3E6x< zZQ~ZclZb9B(rJujv27l0=|2zg^v?U}X%Qh%_cbG4G|zYb4G9lIU3V+<33R?O*4S~f zYHRy9naY9ju!!BcI!zVtZ5F3rEyE)X%65ml^ycxrXHnheylQ`Va-Anj&5((=e8I9Y znjb)&w)exzzU>+BsMPosQZu%lD_-o-FdZ$8(%=43?S^DpsXLIt?6xYuyslO6%A1{$ zjRu&U>$V^ZG-4Zx%2Y(qJpqOeyD(B7O9~iWR#WJ20!9b}t~ho4Tbv4zW`MO|$_5yb z9$F1UEfZ)VagN1V{*JqU3P#>*YdGjuR5JFPpl#h#YVEC$0wdVSIt}BZy06NQ8^dSe zmR$n%t92ADxgIytC81$`F4MKsQD@(XB%YK{HNZz18U@pnJA8<;TcvL9$A~JowR*Y>i3&6m~=4wa{dT+QKG`#-@;(_o9?%JyY6>(RDHH0F+akCkO)tl6dIsI3mnE4V64dgERKYI zCq~z%(cgRV_#XYqB^W@VEL8M4=U{-LuzPqsHN;L#5(!mbC1j1;M+-a(keVskg&g3C zU3tnNfoowf^dx_eRce*=OKer6A&3ft)3CVktB^KVT2IOf>euJ@n$-=66#67NO}%r} zp$u&PRb*`LbVsU+2hV$Z_&dXM<%@$L!;$y5WhPT=dsXM(5QFvR_JhmA&;(D5(>qCg zB$mGK&&5!&U-BPKway$8g&bF0xAHS=;!|L@D!)=(`lGo!_DC(cykcgC9B-2<=@{2- znYqo)ZpD;f5AOQbHl^}9I9dEY)Up|_jC@Z{7^3S@-qZZM z+sa#Zk`~xIb(=j#?Ct%bsb@N;+Eq_1>fep<|LXX}VwwZvyh~K}l-mPOvmDc&YjXZT zKj*BWgYXVhmkm?KgW()vg*B-m@(A(jiyk9S&UoY{xWjy7;oXOL8G`6r;ShvW*fB1n zQ0;=dvued%#%%%N3jh`VjChsrNjcTU3-KVIHy^YP z(TZ8`Q>#;DvyirSDA5KVHX5hg!5(SkY>a?@PtxPg$#)10V!)huJxY;tuSwURoG;zT9r5 z`O3+8e2Q^G%hIbWon-)tY$X8poB|@oS5u{>u71+k`ygSO<}y!IJ}zt_5XNU995ewQ z6h;CuON0lh7;C(`5+UTJz8ZwoZC8cs2iSrf!!cX3>P>puGT-b+3RmyOB&ui#BuGnF zk6N<+n(@zuL0sdv<)FqX;kLIa+jBd`Be;J=cisWJOxChOz;j0$y#>ij;QZwvYwLQk zBr#R#pVCV;b0O6pXuG9#GIhnpzE;FUm1*UuG>Vg{=I-7^ukO)nbz{P2em2s_V{Zj1JKR*D4Gf*CW8Ck^UWz{8e8W_Q zG;CHAlrs2H+iTJ2mlUsPbL5-TYfv)r=kbk&8BfibRQssbwcM+7F@5YAy+mRit(@`f z0(+u{uN}XHj>5@f`hOcVMUn{7R&%`-J7fz`Si&-qZ`pL$-kOG#DtJ35I!#p!6Di6Z zEiLSwM29)RuLeufZkL!J`=m5Fetj*FDCHz?+2I|43OsKYW;bct5lHIUI$+Y|9n(`B z>JyAs{bG)IVY>1KM$GpP&!)Xo7Cr zta~LaCJ@uJ(P&DU*YW$~DdScQCxr2xgnf6x?>BgG7mNT7pL0?!O__ zCU8Q{1hs{^xtZRtlIOr99zH9cRO|%or=n+lNnr+>uHMi}`^E(OV7 zAPHz$aO>d(j2rh=2=|CHwdJ#JVlzfg;}On@XN+Y}#-F`|o`yWS4(%2?_X5J&u@~gC zvpS0BKlKPV8%~|Us&4W&eWd{Uh%GuH_dGrl(MA{El&?;DiOhV3$LX$;V4y&c$iTBh zngtyHKg_-PKa_7D{y+Ay&xDLM(7#<<1Oz? zOvp`5QjNZ301Z0yj$@M^Fw{LHjFAcBK6l=$xU0siHqYoEnP$#_B6ugutM8+raz`C_ zLfhSbX&}gxB5T!dwB44PTD0jv=>7Z)_EvulMA|Z6Ju>Qf6`--)JA?a9Q1jx%qTe6{ zk^V_}R|i5pwYa&d1ae*5X2rn_cT@3{a~`*_bKLe65sIoO=vPmNwo*}}Yu(FXHZ@?@ zr-00meO^h>xbB0FafS%?e-AOuPzJl2bM5y!2K1B+B0USBTLJIR!K4h57a?y{x76P$ z`V!+KlvF$5ztExsrp~oPfP%Q(^y-L*@v_>Yp8FNC0DVJ9e|rGdX-^enb4Bfdt4izc z5x_2;N^p2kS$&VJSp zq(Kzc<*_#WcTLHD7})8o2yN~DPZD?3-wY-*n|n2qN$~f$lo09?nCEkEH$WP8jPUe~ z@^4cFY_xq0BQIQ)i_1Eevq=j`H!db`CRR`EIB4{=@WY42@z&G+yrJ3KXy%-A2Q>l) z?_DLl%atX)xhSvlHw5#YYl_u;8|fCBsRwha-?xfZpx|sd3;m*aVaS)5Q}c(&Jgu;B zPK*o@vzbdU^(44OtCLfI1{Zo=o7IZl%f)hJI_(`Vy>|AqKr8Hb0S@R}CVn-@0J0S- z%E#emtQ>alrggHi8sW*W-O^(04=n!N$+*Ae}D21xF2t? zDYh#&xSv347W?&^%V1@F9}I;{TAO}DPJpe=2L33RDD^81#=(Z;jVELw47TiL#!o6& zz3KrIvoE{Zsl5divc+q{$;sK6iyTG5>q=Y|V0249?g}-Mz|lLCc`8bZ zJSbD9eEt(um@Oe^js!Z?h{n2OQ5pVE3?)olK9T(NSv zW*nN`+~s=TX8=P?5ZT@3&$5JY&<48%HvNUyWBt**6Ky^(;0xuqR?g30L#m@ADUjvf z!;RHbBj^b41tNUhD9`+RFdq!4W3*|x8}}SZqV!N{wic%{5AQda=Y2tf*HMIxty-CB zUT)aYQ502iIYsrH;daj4L`GiQk?CuQ99h1xWMUnl78A?Fs%rcfzbtkQtM(hh0s5Yy zO{Zjf8dfNM$kyJ4A3CF_XF+%Jqx?v76ffjJRa>NxzBNO>p|5UjVG@&p?+}=mZa!t7 zOHEHtuN3tD3%yG!NzX;hCqSL5SN{o}{aR*E+dh`%s$j6^ zSsT1UK7b+=xsSlPA#L2?n*$E= zh|>o`6~N+RUILk73~ORYZK!@h)!=QD5~);lmjjj%Hy2z;T^Tce3HS`^)$xru4vQ>4 zA}WZr(d_t~w{2>>e2jP-Q(J_iG*25jT6W@c;q=7B-z8^zZA(l8B18|P5KZvQ5!FtBzhY-9b&FX2Cqt>U<#E6+22Y+)yAl{IDVEu4b|*-KM; z;&adG8NtH!bu_n0;ohPaJ8GkRP)?goFAz*Iz3UVzD4-MtN|TvrUKz|jI1s-mHz7wr z4p^=He!na5Vf9M6rWw(YXQD`)Y=5BVA4)>TP1a9uP}c6QdpqdVF+#=H>z8O|AALi7 zV@mwUIpA+^e!5O_x(WPGzIYa1s&%yr8j)F-$y&jYsJYqA!1He&fFou2?2RDlK5(Vf zwY$D0CvJrpUn8=iY$aQj@}MF_$Yf#Q%NMfNXnVLu-PI zI{j%gYI-@s=KI{&>G|16eNDP*a!9tMQ9qQd5gQ~CQF@u<;UX|j;nTUIv`P&+vKNzK zNR?N*Xf@J9^@t;7UbFCcMwPozRxWh-d0b^TvQ#W(-u&MtQ${W_`WkOw@X-!YRisyr?_xactIECh2&7Mk@Lsmk#}4scxrO$~_x2ZL+zZ(~i}ZE{e-jW4 z%X7So9c)_I*xB@)d>QDMIrZ?XcmMfWu!&46e_bzJIJ%u@xzH9f#qykEt$xAl%07Dp zNA?B_Q@yM{>@E8cE9(B6tA(yX(_EM4yp~+doL#+8i;NJJ;qTroz;$0zuVqBBc2D1c zm|lic`b5{h0Z_gIHQ^8eymEzh6fIKAmB0XJXCi@w35&$;ZqCeLP%L_c+$Z6uXwOvD zA!@jL3buV?Aagfhu8OJ$4i$5@kRRCwqj`u{;EStGX- zY|$bNM-fnEhr8M#Tr38wE!J(@tc+O=JF$P`_gBU5bjANj&l5)v-7pRhwb5(gx;V~@ zBco=!6=m6<6HjHO$(Gf0(Lo$6`*B8ZI>=80Ks3b9fiF{YRPjFgdcgqwk?u_h=k0Xn zS2xQX^c^rSskyF~%DGJ&{p523H7pF9`@p2LdhGU*E!zJ-({`1IPIO-f*m7Q~Ffi7= z@gkwmfkKZpPJktNq*)G@!|uPEU`UZa&)sRrro%TKQAU(YLd?=A?=q_-d_(ymF>zX9 z=+WOb-%Q0@=^Q!mRfGtbwVPV5kCuHikh%IIxSsNEq&^A3-x(+`FOU(;To0%$P6ls^ z2_~<7)!DmhuWW#uO1e&QNWwerk*1MvVp;BWo_3oPk&hxyghTIgYy4ny03mHu@)ZI- zFErs<(0NE&LBsd943t}y%zyX3o}u)gHI|g^87Tzmh!&W(ry^3n6TA&@9iM%(jJZO< z(Tx<6+ep}nsvKG>&wg%FV$|;%Kti9&Z4!)eT)|Mw?ITKg9$eNwya}-3D#>XtRlRw; ziJ&u5;P#A+feu_;k!?a+#b{*O%mA9tH-~nyOI~~4m*MR9HhKSYnxy3d{z;u2)bZ0t zUUkYg`dqTvY6_Z*@O17&ZS)5AD|3gaGy|~!E~uMjbY|@g`_XHXuh&9!Pwa`f=jk9{ zd6pyW2-iv|Pg--+hhi2!$#I`kb9!!rt)=fvI(5}qU$qt*kDFD2Y>p(58B>h>zA)}B zdf&2x&~!9#1kIyO;KFPfwwe)^6{xESTR9Pg(;qlSt4FWwU*^<4kmfv07-8wRD793M zqq0m@syuC1JhO^mNUD2dujsw&H4cU`s!}>^bX!H@{cWFh5}Lt0!S{=!$Q8>2OV-Ne z^hlLA9M%RyFZQ>7h^J~;-YL5w`5R)R7_f1>U{2MhfL49i~MjEP~ckt?kq z!j*&4APFh0rrn?Xy^2ROw*s3M>3O|cVdF)DT7?Q>=X4T3IFjDpemxF=h)w`v*HM~+ zoDR^Z=~!cza!U7IXpdvBzopy=GIrip3e&1T6OqcMXedm&;X)KRsEp@7Xv2e1$>;rP z-(LBb7*L{fY?2!E5{e@OKEP)-K~xZ`vOvp}W|wyPsApGyKZgmnJVndGTbrLEE=RJ> ze=~in%~D@aGy{6~F8}e*+i($n=sVu1)KO_*`Rm*F+E7V4(t#uqx^0e_$VY~U>%owjaDr`;)iMs9g22_QTZmfiHG3I!Cu& zLT)i`BNN?K*2cmqg(uYh(rl4$r&G#HpE2$?&%(nF+nXxO)u6)DewAu{+)a_>Z!FkC z(;$o*4}TF2KvIgt6EqC^czJ%MTf9^W8nvD8X-Tis`>Qxy)n97WT)vE>SWpR!L~+cA zoKBQK$^Bk~dc5U7>l*=4Fh>C9a^N|vsZ1L<6;<(~)A$Ehb0P~_ak$BEu zA^phU{mUsvpV!$F{d%l))xNBd@WZx72akW!cVKtP;5NPVt_|GWfKKwYd>KIvI;mb( zDypENWws(Z>iqVW2GO<5Xv?bElx#w+B+2rDs^(2D1o~_LU^*?~4;9jdCD|$W0bW_dZP7GL#F@bFE=;<#>A)zq zw^DLI!8e2U#?d^2&fw6fl7+)Knn0-2pQli8vS3gP8p%jQV)nVWMcLdGTXKmGyfag%gpWhFe8gq06=wfD1?p4sBV~hz zGe-6nJLR7t|NdXzs3JI!eq2AP#LzeG!%y=l?%c~V0H6mfRl^4z*LuE@OcCFj-$mq2 z=j*DX3i^}>iWh!SP`4h75Z`fl`SPkhF;)}X@VYmOeD_HU7Cx;JtA$nMPhO|q%YI8F z0eeaJkFD6%%|-JA0iZCALK+e&Ro%_HV)9m;I8G`gt?Bh{YCU|Xf51oY2CUQPLS1j= z;uOPN^PU`*27CQ@L0;n-15uC&uUilwshmlW8jiCLB2e8effo*8X2&+ zP=#jgW0pH&3q9gr4U_TD)&0q9`CaJh@#M+faDVQt`6d#o&NIA9-5fCv?)Cah1d4_i3u5Z{IE%CkAt$3-?SM^h* zE9nwZF8>4-K9K)s2bjv(at|c_Jl}DXfX26qKU3c(K&6bo@jA#xOvgU=*CR~XsMj{@M3RxI# zy;M*)F$IANLTa>f;WE{{ka>+){TGb`pk{67i9%e8KUOcL`G0)&OimQcYLCHNOumU! zbLa%jBWmN_NXg=WE9vq4*8lP+sfL*t5vSm)0@P!gCWP(;BB&gjB1jy=&1j!yH z3z{y0ee;7(d-3{{?dTGx9ReY(_E#RM9|#R2C6uhj2)KJHVEQMp{-!`_oB3kW9)Sh@ z4aj=(&sjH5z#rHdntSK7GI9}=EaWV~#NIzfu;_%UlxKnY*7$pAKrzP;JwMwmQ1lLv zJ+-8qCdgH^2*&0ZrkFCz(Km`qhnS{DlkEpSTGZMPnb;Xuh76CQcIF=*tfE0M={6 zF>gW~1MHv8`QL$1l_xlM{<)tRvtzTqN=?qv7B%E8RI{bRzDaPf(@J4_2YY}@>|9cJ z^xi_ME!tHEG{@9lWM~ZqD(s_8?vY~MEQLS*%O<6_7p*k>2KRvqbvPqnRr9FxqQzhA z&N2#tb*ex0tgqCwvYPd1`pY7&puvb-@-t3Lxsh1se|+R&^D2j0sH!2ZRazu`H~DEt z#iB`>E=W?W(+3`e5@>k$KR>?hT=IN#dKma+*p~|%@IZI{ee9M|aQpRA7G+P2bg3}37eo}kmh$ehSw(C$L4x?yTRxu%kWCs@gkwX1n8(JD5Q$J-)?HMWy2pQL}*zpBjzG9;>13K ze&qI7vUGPCw_fidG=>fVAayB0V$5d6~y>&P% zQ|7$ut#UHh3;zAyF!?N&r29+a%`*t{sx!o65raGJL3`EYEXw{-;ytKlr@F((C3o?_ zOj(VO97;l69612v*xg<{;nYjcs{cU5{)WS7-*IC_EB3|zf8tC{AuR6ajB&Z~Y$|Me zG074a(Tpk=T-z(L8l-FSoT_FkoPTm9VbO$Wr`LMWPiXZEJ#s-dt8SLYaS5J9va?7Xlk7RmAwl#D#&L9*;6t)z@8A+wX>1$3YNXS`w z;uKtCs?4$eI9)#^{BSqSmGdhxf&@p4;KHiU$%%g;QX;(V2+P((Yglzc^6O`imIH9- z)=hX~QD{~!<}zw%FVG+cTM;4DBt)5(+kN=!cOPZJ+*(+g#N@GRE!RR2W!MIsQWxhq z*C>yK#L#iDosRG25zqpco;49s1=?SJ4hjIpxX3fW|7TH`pG2 zNym_VJK^6?9Zd6-(8R2&YU*L+qL*A_Knud}30EBiebw7?R;IMYD(DW|+<9oQYgAiQ zuh4vE+44^FfqM}Y$J1a-u|TQLk8}uJ%}@SwG2sQvKdw}8A+XwX({luVCYdyG9Bh4; z<2TF@D)07vP_k}G6r@VIiBIFy#7gGHmoRlv+0xQr6Ul}MF~^tgzdiLNo= zB=o4fPNX$x7=I>r@U_mlgy?acUI-~8BR@>Hy3%x@>`zW3S0oZYcIUs^Oez~%sOf?p z+Q{2SSDa&Uluj?KP=oJ+ehi9yPkC{{qirW@>n)14b$?WtyI=DeB!?E{0k+D&2(M7I zkwxwI)63N_<}W{_pY|E zZ?)Ovag1c{iCSCkj@}JK(38q+pw+Rb4=%)Y5K~cD$8)L?!`jQkj5J0WXknmcF`T;X zMSxXR!z{#15yyq&Zo}X#O+Qk;qc>y!DA>+%8Z5a=-B0fqkn`&je%1zqZ41Hk{0{vY z){$FZA79sK`{E@n4GYfD0JI|H$dEJEUGcdhIetYv8~P9C34~Ooy#jS*H*N@PJ_m5y z$5pgVxD)%9ad1vv%QTRCp9kSMg8cvhR9COp_@AHUr-yM|wc8ligswilrIt_ueqMmxt9WX=bdJt2X!iEr0%JAJRU?b@Rt6;+4euISMc zNAYiu6EwgP5Z=50%|SOm@MAleZ!Y>Tk8jI>E0qVvNWR(?4N48aVdXKL*l{Y*wo73i zxHo3&Zzgi%PJdP!wb!p|r}Lwc`V)yZB9i9g&HBxLsv_djdY2fZ*5Fsrs$qn6Av|b~ zs7%+Mnv7A)CYzoS*@b&ZX)$?OZY&GN2t3=cs<8{dUnR6!5Y~$Mhosp^ri|ttZBj_4 zXHrWi-}3<7+1fUD9V2=3H5;vm4vlE{KJ^gS7K| zoxfvM`aybb^Ne$f>(nhN^>RMgu*D*768*FDhk-10KE#gcKQ{>oNHe%-UV{kaivTUL zqz9`OJbw{HL-Fa%asi9jJKhN@aDxPbo$BAcbJ<)x4MgBn6cC$Ofk#caLh0VEBxlPf zl*924SHpoJnvmo4lZGdGaj+Tv=PzMk8p;1bjCksGXt>?R}RmO*I}_dI)9 zuL-W`?)Mo74K(DbN+vFTt?LDQk*ZJL*jJAa?7H4V^Ij2~q_3>6h5uthT40DO&|A&8 z{u{N%XZD<{(J$0~v&<)aq>t}}UDoz-u}@F3iYq9$&t=AfPRWwXd?0na?-{qp7Lnrz zy87I@;rA9aSY1x{3?9bU<+SHeOaPqG;2uSixSYwob5LIIS|85)!CY>5t2$WKt$oL8 zmO6Af5bVG~Hzcaw)$I9{$CHVzIT=7t_1kDAl%4a7AqCcDfxxRPKC7(uL-om~i^|Jp zaQ{Axpzeu=M&VMV-QU*Y+gN%2y^7f?M?&tmNJl|VZUY@!zSxfR?Mj}BHUgDg1VigE z7!QtI3xXVhl=eD+SU`SkvrWa5~!uxG4kqrLn1SrA3_s=>dn*$mT z+O9T^H&_%h`5t^N_nj9dCDgQA*ks0fsqrlsHJio}1&sjk#6z&-#*>=M#&)(|qTdI;TR^DE&C$ZO7pXs4!oNf}jz(WN>DB zxvd8CFW$hJRSbN^gvjQ9Lewmx0ViIBvaa4CN_s^?Z~HrqD-e3LIPo{&_&Jlw-UF2* zo*HaVr-1cc>^8>*69o_-*e?PsUd3)@DZri0`Y=dmegx=_`C;qg7LNku2G~lpQ^k

    fo#!Yq|smhp)g#qDoH{go;km)Z?SMr%Y_HzgswNJkrl8pp@+d$B9 z2ie*Mn#4Abf@EyV4L{r$WM|eV2LPPe@C)N_r&*Q}!MqB&c&=9={;20{1=we?cfo<+ z+!y5A>*yy2$wz|E+#GNW)u5DBmVE9MBC>e%J=vxyCkDC35M= zB5dqli?)`1uTGTIL6c3qGZRpx$d*_apsslz1h`#s~b-=u~q3e${kpb%gK6Tb{0Diz|(Y0!Mw&-K?4qa^5>S@;{=)n zrp)G1 zS-d~EA%%XVFt>*=BdyxZlKr2=dCOSsqqa4P#j;jhBAek&^Pe`?n~N z)3ycuG(S@>`mDIz6#&Y-Tu7ih{z@F1Pij&^KMS^zPpd))=}s4%xfrprZO{;eMzY9b zhpajmnWJ!u1y*Q7o8 zJC_fgTq+q+GvU# zcC&;bHoXcpZOIUBk~Sizrb&!lvaq0qP+h#k`S{b4!mWgbkX#vk@nw7R=Sx;@?*Nl4nQf$r8Zis$4V}J?@~=A5#PtP@W!Gru2&ej zQ)cFw+OCDWQ;CpU3Rnij+@(!X6yI!_Yr*f`VAi2;dT}VYvxVykt(NtFs1U1U+tcZq zsw?iSF5;Hydp+;=47{}K13Vi=?wTVy^EQi7u031xTf%eX?N0^x9QqZ;8^lM@%T1yO zS%t)G9w)kiE8Let_fqTG|5QuS$(O_9*aHqY1s_2!H>bFnST`od^8MlolDHN^f1Dj|XKB@Zw>$ZT zFguwdSMQBsZc?F~toe&rkKZI)3UfS+4Go`Klhat?7Dfs`6PW1vFFU$5bG4Imc15Jo zi{_-c&n-1Fi&0r|v4siikRD1K4X#kYsc=N>cH4)!H;5FvCY9{s9LvH%BDC=se5Y&+ zF^|M5Eh+lx{FGN29IZ1*>dcIw)o@o;+Zwyjou#*-LkYsLB#9noLJX;&x;(-o&P4=A zwC)Q?ZG}{o(r-eomgc(7#naedaCNa=Ez?YH&f%MIN??1>HydSbHwRMA36U?hzDvzrf8n#h^0@PubjNou zu7{;N1g17PyArL^N2JGE%vSmZukz3a!r?A)NCHiR#r<-AaEMR%mA}U?$6j=p#p25iO88s<)B0$x1o~_fnRqwX3kg zBQH1pT^?OsE5u(KSpbrfTVt<;&3eE2Eqi%;LsIA&)I+f=w|XN| zgqz}be}Hg|7SNQMzP9Yrs2NK zCy*h%ni*x03y1A=6}!IWs-8P$dM}s9lPCpg=IM-W(-n(;l-wxJj}SN5EroGho#p z3m_Pdffc{ejelmtwnPO(#Ui>RI0t2}Cev$Ps-dAiW7f~CEvjP}0L z#Vs1sp#e)AXh=?^kUqnd#@|#LRZu6cn=I?3Q@6kvm7d^b=5)N4%9h|l?xi1S*QuTO z{3r=wyf4?cvDl;V>>y2AE>;vp(Zk7jZW}EDziXo8E}>laf}z13*Z(uPa!R3|pK3Sl zkxM!h+c7cM-F!IC;5CJ(S}<$&rsxvvr}uKj^N3rtX{i}p?~zPVFAJJw)lMh_DMab3f|zg6YAEeJV@v*2q`}x(7`&P*<8OXclor-rqr| zUbC|;sqK@po;ra=vuQ4utM1#;u|=huGA7`J#wT8^`;qrqrnC0;Td&~!gTs|ItZE|J z>cJ=wk*_b(gGlbP2h`dXD5Or)sH7uCnU8Dz@J_*(T^Co_`C#J13Ti-Mq3fO_Py?oZN{R^NWFt zz43U`DI!cB=hYNoZ&j5@W_`-Q> zb7D+Tm7Sg9dCm${|8(fRoIBD&IdrtaN;(#HF3ub+tK8E2jBVsOcKD+O>=l(+OAd!~ z!XQEh3{hPp?-PxVcoBW&Hi_hjy7?B#oB&UkS_l$SwiDlcj0||gpT0p&L$^y^b&*kX zk{KsoL4%?{!nrg0hXu@krde5BAZS5ngU0Ow%kb3gvl3vwBPOeRLK_cCR1`97dC+2+o)E z6))s0*huZwH(arZP=aAdJ;OM zic;bVE4w7zQ1-`XOVKTR{bKBB;&|TXZlX{ksaV|6cTxE2s^>maf(YaoRb(|zI8LJ%1HphL9Pc=y0J-C_v|F~byW5A{ z)Np^kWMY;mPw8r@(liudjCp;Fu=d zWBNnvn0q2!n<1e>k+t{Bo(%R&G*p3RJ=DsrrZd-3b&pFqGIsrcO(NC6*n<%;y z<;18cX4qk!M$4rpa9UWH^;RRU&cP_f%Ozny=^J+}J@kV&up^yxsxzY3ll8GAoJakm zcPsuWs!R8q?dQozns-D)I^gk#9K`7>_T{AH46f^qZ-^s`*14i#!?JFEc8Jak7SD>L zumL#gqj~moOWG?h7C<}MvtC6#>I?r?!&wJ5blzgTcB>ZN8r5!kNeR0Utr`n#?ab(B z=tCp43!k+r8x;Yo4x}*Vye{=8jdBLX@;gno!3M-b46+I+2RLMYG351)&cuI(3fDLB z^vGYB=&l$AigsSH@BhP}{U0>(|C8{B4Gqa(Gvd#D)u8jRFtpWetjLsIFxj)FS9t2tdd>Ho!d`WlerCyRvvUdpi<1YBD9QKHuTLg7i40rN_>fPcMU+ zfg5gg-OH1oaq5W5d-Kt8Dlqc8*9Kyn2rgH%s;}vJf&Z+#j zZ;udHuUuIl2DD?-@z7lx)fv0jBdhG@{znY~>87O19Y!KcyV533(v|+x&GE{tdRYfq zj@}P$?L0F7??qJcLLI5n%ReO4`7JkbD}WDR2b!i`=LjPkuW9LC)*E)SoCigM0pNHx z0ibFtIRU^=Oc=Q_=j7i?p3e85=6!h%9CxnSrf-yp2ouKw_N}8{#q;$iq}Vku^71UP z+JKs&rOp|wwg4;bD@7nc=M7gpH3afT&R>92`iENpQhs?E0DqRb+*{`Kb(M!7U>T$5 zLDX}AFn45b1thlWDMF3`O(>P1MTj)eGVDgyU2r5I*nLb15GSB!jDbqqxnpr1Fi0%} zZo2PIRdeAF(6asr1;45SgvjGp{Dym?O?QZ}=RnUJU+K?1O^>=L_}c~mbNlJRH@Z`1 zCHqko{Nlk%Z@Tm#xCU~H$v`&i9~8V_WHc8zsG)yFlj)5v!W>m1^x*5kSwg@1L!tj& zOqAD4yg5P1dXAq2q6qU>=sg@U)Da_QEq4FSLd9Dopigp61CJteJE7J-`tf)M$~8xk z5c_6+OHinypWrBizMO_o3vJbNTcyLH+km514d;|R$r{?V7)R?^54zAY6@ue6-Y}GHjntnF<wPzix;0e8QF&#sxfmW=iVW%R$)uOvnUbDme4uPIgGNcZ=9O zTYq!{L>HAn?A3~QS|}rL5jkGhI{ADKl(;2gHWD;=3~JdiTdF|4tUbqCR08oYb)R{w zlKaKAl!$osbs!maABS}4usa4N1O+enE2Y^;iRYmf$Z@osKT5lI&_91?o6 z%eja3qM^fG-q33)1>#M>S-I9C4GfNsD1iOJk&PIT2X#f#{AV5qr66LD99aph*~dP=oIX+u3zL)_~;u2-03DAl1L8Ho@4ztHy8L6O@uHiw-1=}fS z$Y5V!`=SlMGiBkB93w1!4DADsk;?|Zd|ISH0q!_+b_^#m zp6zKKmLo4K-rw!yiTE%FywRKUCFPiI{S}VoNal=5AFhii-WHi_4CSv9s+LYzm~j*^ zHEoFhRqK#n2rX_+XHw-+@oCV}z2zQVb5iEgg}ZM$%O>*p;SD-2_ZR%um}=ci`3uJeZ>>d8n&)LFq7KO6E$oWxAWT{1z6Ny=PZvBm zatF+j2@rdlgHx8-TzJ6#o8`{d7AUa7`;ea8E>qhh_z*Ti=@qti-UKqLT(J&bQ?V!V zho?pe%u&x#-`Q5X2^B((e-wyjJ){_`EEjY(j7K$+3^^-hbYHhe4V-|Wa0e%_1$7W{7I6Oq2IV~ z;__AF?=5lwrIRkGHE!2R^=taqX;(-1ZBxepM9FsRw&|br_N4+F{11S;GAp^6PqpqL z%i|Hq#&!1-AGX=ooWg#S*@IoIefX*~zP>=%$VN9%a=3lb2tOQ`2q25%d(~6h60g@=OL#{E6%kf5 z^qDrYP4x~MuGZ~&2l>uCqa_O$ZGZR1!{%G&$AsI)ZtMR2>$}0g9#h`loO?bR2Eu6{ zk=sSapNxK2IyP#?x5h3*f?iq{A|$=v37VC0ZdAB_zCV7j6?D0ACvIg1)MI2N!cxgV zPMK5e@}iF9FSb6-P$-Vo%%HN{eH1Fr)-Ji)erh#-<+bJeJq}+ zy1M(MLeQuV(6s~{m^1ZT?_RLx^q8v&W%`&AjA4xx7^~oANo$E?Vl5O8qq+qZu`D9p^Vd;Lc zq+%lLbch$@_&ce5@ntcRsljz_o1^qKrV{V851K_P$>aLoOT6A#a$h^}3b+s}@%+2Y zt&Xfg8HwwT#Q=`xSG};&vm97a;Ow~OSOjG#ughgN84@EaR({1*`MCLUR%y3cY1{jk zf_7se5%2UWtcU9YuFWW1OYh}o$I-IiGoZ1wPUL z^-V1mcOTVCw;tGNj+}3H=&Y%=o5NphSog2VO>{Dx&Lf{=6(1~V+H8xd6n_OTQ<6RbDedH z7Xb2ZY|X?#bG}wtxLYiLS*?+L6|z5Fq>EaLQ(ZEtikZ0f_ptWb6GG!m0Ojeg=XSqq zB$DJ2C-q3wg#O(xVKd!qo_Y~KB*i9sCn7dFBWAP%*xxaWJCDhj*7*zy)n_2k=I2%~ z1kKC(1AT`hW>)!iKFl5aGY538-nIX|C&J73#I};pIcz&4uTG7|MIwAn(1( z_mklYHM@_w|zWCggoPQQU#_)dLwtXIF&guN7QcKdeZ_BBtnQDef-NN+Pfx=ehCeK;n`>u zM3nca_`?0qew=NY&+uB*6(suPVbN zs{M!P^354%TPkMj)ElAi^QlK472K}?b;0LBZe?3C1 zPA4UqPHVsoo5tEhcHn=qvi#(}G{SeyK(o}Dq6tgOb< z^oviDBGid=n^t$v)md}o@h|^vQDFq-TS23Z>D|Ll$to!u7g)@f2c^E)xvbveH7-Wo z_O~Lb9QGVJj$1D+#;U_3jQ6Og@m5wU9#g3mo?}^B#`z*z*I+d?3{B{W$=fwI;^nom zUol!#oLfO(*!6rLcT#139+UCn6QX1IR3)O74ZV<9FiPz0)dp|zc55?@Ab;dX9A*^) z>l-wE`FTm%Xc^o4ctl}X)-elkBFBx3uan{*j4RNZGq&IrOYH5*RL@5Pj0e<@B@hox zFqC7{A3K@ryUNdcJwAg@j;V>bFY-xC61PZ&^TzLtJ`eF8xvGZwg0dB?8A zWHsb|`JF$rwbz!&kb|LyYoB6=iXJA&d3Fw-ZcGj{Z2%;*|r!pzgP2= zecr>6d&D$%rpws^9%LVk(e_fY+ISj|IlS(%uM2WPgJT2dUQ>nVIHx5bc*FEYf{o<>w<9iNnjFZud z>sQ95NFI-c-+mWx8~{j_GSH)#iH=TJnx-<7pD*DpAUamJ3Z*~@VVwCxUDIfy8`LKK& zvA#Zjm6P}R5w;rSs>I>;12C{(_|{owAK|;rJ@Tb=x$cs!vqzT0)VRT?TQc|l`fke$ z(|4L5W4EMJTlR%`;kJI?(<$plmE$4SOSXXb@-p&_XkpE<>Qrw$!>WyV4o5D3N z!;GD{9I}r3-o&T9ie#X|Wh}VKsN1M&TwdZ=lb0nd1xdq2dFbwCKoX~5wvF{Ov<{c38G_r}L|`!4msY z;RDCC&kr+LeQsS@s?>6SQF9Kb{lHijcQ!T_a7m#T&^af@e?E9hITW1+Yv=#x5oH1` zQcF2EE}SbV*lbWyBAfh|!&nSSdAiDM4_wdpzcm*-<+pHXkC5y7D9{(QbE}Bf?gykj zj%hw;-1%TwRw}>KiaOr(=zjh*`cXs*I$l@D?kor&EvOqyV#=NQ=Zxjd?VMr8AUS zK8y9vwYN8?AXLAZDAk|Wtd4jVJ4u8zrmye^Fl<(r_X{1K2PI_AJfZpfGmSGXX6vkY z!c(2~4s%3E$jRIEsrMlTA+N5dOCgq-!yI=^*S=mo`2zAh{zsgLvA^&AzF%Ix=z+*^ zbKkSpwa)9j&Y#4wcv}JxK2mR{nBJLB zzE!HkC_eU4nX-Ec6*m$4Q~pBzsM>|>JoqvD>YznUAkEg_pA}&($lmg2`i**ZJ&eB@ z2@~QMO;S&L$GsT?@|ZpHgU#NN-XGzLOyrCkY$aYQvpjm!EMx*|x#gr1EHKH&-5HRpBzS&o!IoCH{Qs|p=1$EJfsv)29h;M@JLtuUZ%gCDjP!- zlN0f72mSf6ib2tI)|^l#=^g1C@sLrD4SFBLYqs-;mn2kp;m?Zl-ICu6v~8>U`zbk6 z`m)nA7EQZ`dw(6?(Y-I7zZkclT+aFhxQqusiP60J%z3fo-aqwG;tTZzACxp5u>kRVIk7TrO(vD$| zBkl3k!L%m&?i1VZ52(7<*IjA42W@p&W}Xq&eyD$U;?H?6SfuIJs8d$FWE0`VDsg62 z9~9cPKA7x)uS?WjApYEqCJw6rPKTEBf|1i zPP~JrVo}T(Z&zNHFS*Cm99+m=6Cf4E6y}!bPl;Qe_c`*Y1lKGa(=G9J5Z)(DE>uDb z4p^(r5#PHQ2M}4%=~HRdNCH~F5B)3PNy7&@V-MKa*us|zk|gR178DYSj{T4^}>I#k1_}H%{p1ReuZ`7e3*6Ylku(VynEidE-<2bAN07KU1VO6Jut2x6=UVH=rysr)3MjZ|FCuH-3%}{& zhMeggSpsE?gK4zz)P2UZ?mC*qa5gg+9m4_0vM6O|qwJQS46YuV1kKD&%Nrwj&JS*? z*~RcIy!U3e zj5#M2O|P9Ec(?jrd(|NonqEIY`w)=Y_VFd4YX1x3V)-wvsWYPs0=VBKDtTKl_q%Sai7Q0sZCT=@@vaE!9!O^dIGL8!C{Ij{8Q9YQ4JfB7tjv_} zgMn;X-R+2v=a+MFrgOtbXpr0JArDf&bKRsV7GGwAW9@(JGa@&t+Wiohsmno z9ljX?l$q`-8`ljUIAvGrY>`;Qk6BMSGtM;LJO*U|VzqNkE-1gvW@8XRc==kdis7%X zLPYcuD6XA;c1UeKXQ6N2bU(jk# zwC;y8F*PcD3AB+&)9XjCP^yK6+F3J#mK_AXJAhl*iG2jQiS{0QuOt03&qqusQ?C;s zAFaw|=!*TNhS>XbSB9{2BbH0q$0Danx_h^vu!_<apj~3QAW? z)d2pUBsNHysY%@^1YW3?c>ikdMrMO%#u8@-n6dZ()A`l;V~kK5*pFO9t;=? ztl9oxmwJW<>P9InAZ@GoCN=Oz2Y_B?ojM|$+UItju+h-P&tkllqF-9rHI(7Qybv}o zYMAnm_uUjxseBr;mE_=FXnBgIn&q{9u2|)*{F@G=NTeajV7xTKpQ2-7HbdRuWFr4v zn}bMG1_<%hK6jtF-^&=q6cVHs@`QTP`ag2a(s{FM0ctIzO47TRrx+^cRK;yrGZZ6m zxMckb3(uMUiN%z|Li%5TsZA9Z>XvxaBHrn?)t7j$5yo$mqpCz|SwLg;`V2Th2%oj0 zTEwJJ8n0R(q?S4ry4&e>OB}z4T^0I@O^HAr|9~KX5GO>yrC-_{a{P0>H|YJK8Ku%H zY`^^g4lTAbxy;zMY^QL653*8wx&5KOw3-fGE<~TaE^P5dPDvyS5-irGwRc((A5T%v z?Eu!QZtpakC;7Ek_cdy1XuL%C$@xxc`BvPfo^}R(6QEBnmQ5Q_kChv$rkhQqtBv5i z)?Sp4lFXs1eSf`=u)1Ms+pk2d9&AtG-hK|0sO?s$2MI*L^MfRGN+niG4F|l{N`zWZ z1IW>>)_Z${BM=upTfaGI=<)I9b%qHF;rTU>s2*YWRe|UMC>ux(M*0H$_UY{m%fA4P zTdWZ3b&aa6&bqwp=@1l+8c}UUhCot71JWG;h8K-@izNoja>5dUGT4rzSv4)3ifN)KTZ z%ZH+8>Ed32usP%aJvL}}?_$m*l`08$~5?;L6MJS|P zv-#5>k;~(T1wpHI-N@cr^{dZ-Y)-4ixgj6Q)8FIEf6G7UY5V@EH`$XnKdcSK3Y}Ao zv9xcJPS0uF2%zOms3$6BR$MT@nsU9x3NMg|HkDf_B0!7y358o^b^0_)m&Y^{2<@^c@F{W~=c1@8+aqvC~p{ zud(Yu4lfA4Z{9tZn8i_xt>|oz0nE@rb z_adTU%wNfghikv9HrTBr-mhkn``D43u%grgj{f2bchH0V!g((&`V)-%-ydmi%dv?z zy~>HsJ6v_$&@Q5{njeL+B&B%rf$lZH_Xye9-q2!nh`uw z@`0Yk=+cNkW`($utspOQ>YB!XI4JtUkmkJf?QMJU>c6Mk^WK$`t0%+f=TnSm1~Q%R zyY2VyBuL=8y6mFoDYFL;6Ysx@8X+`#z3cb3o*(9sPsgqR-(Jl-^VZ(TZ259|S}$71 zb?Mf5aJyh4{4@y!qn^eK_avmv(=4-(9PG7s zJ@1$0ylG5p-h4LzZ_STY`(TId+FEmcKD!|4-AC84ooN!U-}H82wu6(_jNOZC-A($u zM-p8eAT`ur{t?^7rwKfE%`hfW@075l0g@$U?R8?Sv3=Js{8k#fX|MP9x~YrCP9dD| zslvx6z6UKQ^$6Fm#Pm&FRj5f503d-yioM(858;qxTrqQ7ZkKP@RcR zVPr3c2j%6b82}u3=FHXcWt=8+g%G59WA|S1`h+S-W)23K)YBuG(WL<5TS+AlSvQFc zkn&%!twRonCVk;ern6M0?%qTtk{G(~z!H_IE8Z?##jGI>by+VQ$_fxjupi`1z;=Bt zxVT~!n*UG-l7HES?nFz3@s^BNM%Jw{@dcC`4E_3wa5XwNF+G``zNZL#a8VU+HrQ}O zRTmHB&GH#)$QUVL1L|{$PmPS=vl&$=Uemqn>iW_N4(-(X_C`8!I5hPqYbwx!^}gbk_}yjF@k0GcKt{SrrNVKGdb$I zDBP^<*nsD8dC@ljd%rs;Zo6BbUv`mnS1cf)E zde|kC%&ZECLO)@97|{?$afKhCa0Wbb1{0vR+xIUs9ZB3#gbCsRXTKK##8ivG zMsZ&|v3$)R-!4}|KGa2PY|&hw*4H*_3c6GA;gQky?(2GG6Lh|^4^uH*q!>?a6*&El z;up$bzB-M%%l)}GqoFW5oo;~AEL3Zmgkl!j^i2HK*C&#d6>#34jt#9x-gTYkO*o*G zpOv*^s>up*$2XIH{V}=KYJFHm<8qQWL~;G^Zq4E|xaT2e=68fgK!X!QB!KJEKMXGM zw0}2^;zU;cS}q3cWWZNC-TtZot>V0f_x4crZWdGcD?FBNu5bS74fV8hyX0^n3RPnJ zN%v_GR!EkS7ltt2S!r#RsGO!m)s>ceWu*hZZ*z%L`>(OBen$1J(I!8N7gwUHvhx8S zhhTPmQ4@`;vO?eX;g!5flmnYhYOftHxY7XjoH1?ew`nzueHy4gMjc#LIM9npm4?mD zdHRPAP=aG$qANh15A{8MBZVx`LC;))4vEiD^JeCn9mL_Zr31Is%O@y|Oo8BEmz;Y$ zusy?X&lCD}gYhF?65&^h`cmqOe0p{=?}o)Eb}UQHU~$F@we4&V;`ruzLaso6U?vH8 z0Mwz+sEdz&caQZ_?F%F#NVCi3qD?*gcegO*Kk#@$?fm7r@eG6FC5M{Nb=iNAss@No z<3t;oI$k#VL{w%LC->YBe*;6wYQep8Mi8KSoxIOO-`6_rme! zk6fr5%vkey5J=$)!ikNWE{ZV?Lczh>W~}()PlHA&Uk8mOt>)Ca!EgFA)k_R=i4@TUWwf^y;NZEE1z_C7l{WqBLf=@5(vg{nG0LxGwd+};lH9t=3L1mD?@cGqJx2m$3@_hN0$cNHJrT~WW zuIX{!^@X^5&G9k_(ywNlEx|Tw!h#t|;Q%({xyPsQ=G(6|$GLdxy6VgD+pO=zt^p0+BY8l0E6SRz=JPZVyo3I%*IM}{>OUvkd|i4RTcYa6HAj4utG!mUW8jabugGnMDe zxXe0ZoY{~90tQ3!1Kvlq{f+zB9Vy}Ey{M=RW&swK%z71>a5F+RJDN8iHCsR3o3#re z`%iXu3T=H}I&E_0L{sM4>Dng_EkV0?-1T!m3(^rqWw}^t$rY0Ak8vD%C=s4mY9TK} zs462s>WI!(q>*K9a`I6WdE9p@H`~#_Av&fX=ouwresU*%nfTGCT9%tHSR3Y{N|tfe zG}z&##yU>jVNBM0U=&lX9ymec_>2Wm*J+*x&L|TII2(=%e&rW>#BDqO=H+ZvE9Wk& zl5%LkQ*X1GeVjejml7>*yKTAWvxa_E!ucAKLyYxRzbXmmu0PLjcl`Z;*MafpME&Js z)@mMKpV&>MySFAn-`y(eKhepzm+eWKx8N;#=5N+)J4k2YZ#ACfpjQ53`s#adpHA&S z4j~Rs5P2o(?r?GHb)8yEauWgLIaGhBEt;u-DLM-P&2knvTDBg=Nozf+p*QDEuL$^MmWvFk=eyFVh^b-LT#MEK67A3u3V z(yi!qT6vELmfA<5z+L%>Qu4V$B@DbdpgHKA`{V*tRZ_!2tct?}=B=+0e<)jAUrf~$ za(b&(DatXZzkY`A&Lq@S7do6_(=%F(ue)=V^LjEpB=gX;g*V z+M-L{f4;aeAh0#3h3h*Y*6}{Yq)da)AaU_Fb}_%JswaeFSU!0k=q>#Npi~4TYee{6RWa>{X`Sq`BKfD4`We{!$ zJ<&7Jl03GZAYc9{Ni+S!63a9d<5srJL)$LeNpIJ7cy=OPp@;C?objb~(np^>H|@^K_h%BmdU_Nx^xpq#5+`2F(}Ci~WeBkEk+AA&|HzRX#XaWT zUsr}(unYHK+Qh|FtYRn-3JRUbI`K|TL-wnUTYB}1UC250_%p+@lX;U6?NZ7F3%}$( zshxz)I1pjC6ReVK->n2VCGQNTmh_en;tF>Y^d<$upSB#{V>*+~T?pTAqLg_|9iv_+ z6NoYr^s+Z=McULE&uuXdBYvnnveU^6rlww|`Of)bdr#pdmcp)c96EEztvkZKHWEOcxj6#kF}{H0$dEigfOM-wFuALnrPykOFtTp7@ZB6 zB&Iyx^y`y;yMB*RT;_=Pm|-D=t8UGG)z3)STJ~se7ioOpyDEUavOt1OutEVEN!7R1 z@&303;i>i=p22w4DDuv3%B$6C$YwHn8i$5-cg~gP)WzapGgjIRc{W-z`{pgo)P$4a ztYriLE<7g*b7|Fod4>RabZx^5&F~`KF4o~0`W@oTfy|U7qkPk(WD?tA+()CFO`7e4 zlg2vn%QhuYQ^c<^B5ZFZEkC%aPLLDjeSXpJ?ZWkzwuh>Jb9--!tuSa%d2BeO#Y5-P z_06*=t(CVlKNbst5_+Y>eXYk$IL#q>x-~PXA z*f;D+Zslonc$FgzEIiz$&sFl@+;3XxV}$j3q*mFNGXcsXKr(qKc0Sew_D(U~0@XR& zNG(W3?n0b^9hHn)4kz7_)!f@bLeVqK*Sj(fxQe?4w3RL3- zHb@5K9dE|NJ@%{DX$kGY|-5A%eJ> znQy%D9v_@mgPRu1wWtCTj#pivE+96|WmMiRxh~dPw5>Z*BwY9v@@mRfSrbxW8segt zIYhV(1kSCMI?=5$j1m^_NIFq)q*(t#hY`R4n{2$WNOFf>a8WE;-~Vs-qJ^cR@jw2% zY+!iIV9WbH-HIXts5pv3)E7CA0C=+%Z&WnG1TJ$jU3`KIy}i(Z{cr0;=E7~i!} zt!kMVueI^13+nFS)MB{!aLjZfmA0vB2Ck z!)eDAGTQ-?S;m$0$fHPatdei#_O%E3*f)hBl`+vuaIkym`sr)ZN%^I#T*drf|Cu z^FNbZ!A@0<2op2Qf(pjgRlSCukV5kXaUN}{ZLtwip-0G!0}FRr&_OJOcfl&Ip zP&d^S_{L!5>Pb4WSqG5bq-{aJ{imFi!EO({q_%}x;V2204-H34=J~p{?+rX`HAp)L zGXZ2>-1Y;Z#~Njfgln^IFZs3a<*ncgN|SR^AJuZss}WATofMwG`N1B#<2)v81js4} z>3X4`Z`*$K8&P0+mbpVT2S%t3FC794bz$8%_$4{Nd{MSSfU#m+-v!Vmdw@2stCqE( zqlvnWLVsE81WwM72KpC1?Te?g-}aU{a<--hJ9VS?LkjeV>d_l83Wyxp(Pjc{(u^sl z;wX!EJ1{)+DKxQxVOpEokcr>qqyOOnf4+X%`>|i2j1eSX%$`vdlonxR z2C69NxA9ag*JPbJK&wu>NKLZ&@#mRGwtMrcDX{6B+jvVTO7ZJ{TdMNNKoe#bBN96u z&M{4FN58#beL+F5y-m%>_6-XCFdpf8t60RCmbV7kZk_<_h3dfJkWzBi3id>z8@+pFONXl&}PGhY;o7uHfgzwnv2hf_tdeP<#Y z+eK{Z`S`Srk20Vy=cha@kQ=yvFPuU=b` z)<(T5hi5D?Z2z-Ll0-byeOEGg)?adCfUPfgz?i&Nksa%kPUkq}{YLLnb zn8+c(Op_t`yirO3hXC8`c{;&I!T;E4WF`G%t_+f?U*Tu_O>LO>rgHj{t%`81*-05D zafwCWp<(Fr@Twd1e=_HFY6P|3F}Y&86qhJu*r2vQhV&ESnEpB0%#AJpNXbTCL;v9G ztGD-AV3kGcErzw_L3B8R5XDN+_To0$**c%0ZpB>3-JANH$Q{FYa}h7z?@G9k=6~i{ zqliz4^H!cn3Bgwb8oQ^jV@q11X04NCW-tRmYAY5*cenmC&sX05I#+S&n2kWbdwp>d zsg%5*IU$Q+tbTF+r)JeR4PLFTTGA9VAlH3t3Qevz&e*E5ZkN|<2>1}4QaS@*bVw6) zdg|w++FOyWzH$UBBu!!>+tWp3z!Qr_J?Axo!VeU0n8-lz?O%I0ytB4aIZ3^^I%}SP z{y~BWD{k-o&%nZk04a|S0##-02FZ5#pH$VoKOcZ67$spt_=2H+%)gBHQMILPga&7V zF%U%Ih!I%Tk#bGxQVnmXP6)^r@gC7s{jfG!(r0+gNf*HJEB$%a9};3Eos?Y|nL^P2 z3jSIiNQZ-Ka*F@@bpw-=hi4#$11wJ2?xb_!p!>Y9u)hk)KzLr$$rh*`nQHP|*5t4f zV~1$prdewJY14bN|M#X`cF`~!;w2>PHP;PS89vf0@ss`Xu)hL@+h4kf@7+>ETA6Kf zzax0zz#6=EJ(77FN51u;Ue3+GmMVr=48m3MWHJ!tly+~$A@c=Elr4@j($~?CG#)te zVJ#n>?{zRIbvGje=)o|_jg5m~wSPh5e8l%}dB|~jyG3Q<=39N?kt@0Fd~MK42jk~V zRe7~g(8d&>fXZ5@D&*L<%YfLgn>M}}%}Hbk!i(V0#LHSY=Sybmbabjj?YB2`X_|F1 z+1HFN!z)V5grSl38A;E-N>`SFWqHr9E(*VM`{CnvKZ; zh^FUB@7?}QoR6Qme>I9?{=$@@R}_RyFJD{f)VQpWWISL8XS5sN(A&3Mb|=jP8U6?p zCxrw}=v9jZ6=ZWq-z85oq=m6X$Zh{EY?IVI*W{$Hip4 zMg>mbst*2&?ma70YHbzPk#3-f5wuDJ_WqEb>p`~)wWOSe%SSc z?&3FV3$YaAUs;)<{l||x{ybGA2g5>6Ik?!F5!k8<%k3g>y4<&2h zyc9F2?GJurq0_FU9L{^Ncf-St=l@{5pLaZfd)?I6=#s5@Fqq?e*RWIGqQG^e3{0id zOW)MN;fOV-bFFdIl!Kt%kS-~OQ6*3NDzBbn?9AU5S&HlPD?Gh2m!$!}_7S`4u=5yd zoXHW;XaCylJLlMU-*;it*#iaEo||&y;QGv$=lP5#yW2W^%QW5Orq=0etBsr2+dvM`kD+?Cp z?VP(#s0Fu!O0?ss>Tf91Q*wV9fiE`z>&13=Dtywvn6wl$?K^F?Uhc9*Ys0>nwS$Kk zx5#FLCFb3`3@Y(;?ETe}XP~v;E2>#pXGCi*MUuXRGJ99OnSJJQ+mNT;!vvZuC_)QRcKoUYb3dU?VlznvO6Z?N8@T#+iP*P} zdps$&!kS$r{3;cJCJR43Ds+nz2O}$sf4(hBaT59M8z=9I#m%x-gY-g@o6R@nj>}H> zb(o7ZQG8JN%jhql$?Lj5ciH(X<6!bA!*P32{kJZxDzW}Ac{X~dmsU6BzPG`0d~ev_ znJ@KYKSHXy9n%=G)-JUK_GYdQ;2Kq{0+F~+#Ksz#gge3P(bgsvic}q0h!$^yU5yXH z&qhWrB{YnIP3MvmZxrC0VMs?ut8(gMLiw-&O~J#JB!?q?^K$v8y=*MTPZG`xNhlpp$LjO%F`ATG&4_Y(M>& zs^8Z6wx=v0VR!Sq~n=3(2^mwR7;&jN`_h3$?F@_%}O2#|3n4cQFA>+QOJYV01vjq$9 z|6@zL*^|u8sYxHQ+`T2OFKI9*f!PSoUpx=OUg>Vg9qi*4w+*r)!;qWYkMNqmS3b&6 zMcAGA-O#(KN4>6)*iX*w#^p5g76<5E#px)5-hc1Fz>a$u)%8^NoUkJ#hS(FGt6c8F zv!$S7u+vMe_F#RHMB@^gWC$jwHUzDQO@%N(gkt}@`z*19ZV_xl?8`mmR?UiLvg|yS z8k;mQt}G^BN4vf#O3lYnOQ+k9PZ3cZ@>m@i=#Ss6wJXDYm%QJceC+8f#ld(iQ_imr zw0uyo3!+Hdzp@V~?yq5G(|Nra^WG|;G>N74`1YxmESBb$yIm$$pdr${M+lyu-(AGP+ z^{hguG9eSLxq;7=1#X#S?wykjfD)#RZs7MyuZ+o?6O&!~I%JuAQY|Ev`XaJO@shbs z$79{N>t55jD$7J#qkKu@VHKn)meYpZKk$k5*6vClG)*fW7dJTd5R+m;-tZgW{ovtheE);J;x47$`=(+c( zU+iZZ>iUII;y*u|pUP{w7dZ%waAzv;w~iCVsKHzo2gt4#4jRs`0DIN`Z*co~f&3G= z(PZq(*Ov;+zfC$?DyuwNlhTzHL#|4eNBy+~DhHaGN3zFJj6M+*!`I=<{d(Ka=f9d6 zpLopM8{Kzl8(k6f>lv;%PA-_XMh2T*FGPK1Je9t@ePhiFUt+lFUbRUwA6|91+WMN* z=SebbXYIYK&GQLpoY@=yVW=33$&92|>pANTE>Gr38_dBRAYME=FtP+5!2`d-#kSUp zamV(z*jurA6JS4ADfRSKAuir3xk06~G31|}zgy+dScpO5PJ(V_gAwFy>NkJkOi!6q zP+IeNt(8wN303Z6`b!a|+qLHL98^YlPO3Nx+tExA%3KG{jfneTEWLbj^p_fI|3*Q- zu9s?o+o}Wc@5v0}A@=?z0v{<~DvP$(EdP?H^XXX1Zb)771mu-zbEd7vQ zSo9EI_GQpxxf$bsXHn<+1Pg#!mLybu^@<-XC28Nkf7c!dvXd`*DgQaG#;mJ(YKPzEZ z{@}45w#8XJd%Xe{2F}OArjQcXxlyS<>zf49n9e29LobW5oxG77RkqvgOdQ{&(x}bu-yHLu#moK) zj6hRtBVY0oz`!e&svj{cOXP{?72nrA&T@rxwXvZmdTANn5Cq-m0&RQG%`yIy;vIL3 zbNt6-p1+mPgBR`b*jpXtcD|+3|DJ6M%A039hUP!{K49CPq>%gHQ;q+RDwps78}@J$ z-}iq{ApOtFpnDd9BusKFY3EGXesfO*Qe$xOCbpspY|183fA4SohV|pul9kT)e2;h; zZqCL32{KmEFG~TD`cL1&ATZz>(LrxHYu3IryfJ796zPt-1UH$0C;&ZRGN}sLc3BBm zhCB8Ht&y82f2E%i1Knx}`j#)g>UcH$@bryq3V>i{B;CR@vXYlcj zbcpHg66^sc+|dkGJ_ZqNjw+P}I(_@dZiiD>E7(zL)pRZK!pVZaVK24e!8UBWWTn~Z z!!guV7+nPsLwm*0Q?p9zCvnYDPrt_RRMc$}p%+TiLfg-IxG4R8{WZb7HIEAx()^8# zdcbkxV$9)?M#wIavM2eOxQll4ZWq;nmF$`x*sbOSFT)8Lcr(6qp2I+IayLL&UO11d zxn3Vg&~V0q57$DDvzD7J+RozWM_`^{r7tV`!-GR6MmfmmOoq9q@sgM!}Eab*F>hLiSxvR3~igh9IA_o zBivfogHJ=}=oqmMl;Dm1fzr&$v)*d{cADkYvuE~DAsXiTiC~4qr`X%Y)It>-D+E*F zk9xO;Nad$HJ{LN03G*HzFRBu^(=!sb;U8SNtoU9sUlmK0C#4UUR2(tYJv=mdOLk0G z_-H_t6soyr0DMXb?GuZ^|F(4=T>r8L8$g5i77g>63tQ&mXf)FCa@B?K8r= zW4z^lO@KE)?HRN>`MCr#Ru*Ev`#l$U-nyB0%XRwqKYH|fAI&6O55hvH0it{s10#Gv zYiGmwAh0W7xiwDEe~4BYk8u}TFWJUpZ!}dTT=~_vYwzbVUHM;}D5J$rNA=?G5_gEO zGI3>PO((B_WM81My~wkc*Jl7ZZW0+SINU)Bc@5uDo-6A&Y(m~W?n8#h5;9&=N~gt^ zUmH%$z#FcQvc_H4^v`{TN#p~iq%I>bcTc7ouYsQy-iuHv!7aA2CH{TadFeUV3$Yns zz%l;(&}>3#sPo1==WhLGn)tp>P%ZRHnq7BWy`d1ZDX?$@Z{#gtJCm>SdtH{uTjU1D zpFxq36aCNl*?AmL&dnq_GFxFq}*}w+~{IiIOZpj9IGOG4#;MOi}2G;VOI4rMe*HFRm2iDZV7fGYD zBN!Vu3NBCusKF*)$;mzqygHMI*mg3Ru&I*2o{Z(m1xFs^_Ag6s=NjhT*93hy(v{Aa z``%6Ws$BZni*uiUmjTLP6D+fwvcNbB#yR&^$&QeozYD(*5^*sq?i zdcS=6{<+Jugqc266RhEGsr9|PU8e!#wVXo78NNFr92+hGqjW8WOMQ*5_2r)0e#XH% zF27SgV#dZM*|Rz)#Key@A{|1Z$>|SQD)n(|v#&EYRT3_ubIXh^N((i<6&~a7RJ%cy zpdKpG?wzzO3cqEoOWalHUrkV2yLIMlQek0@zj#9tWzQ?5CWGw@X_{5F3e2lqQGd)!oC@040OU(CBZ^%dhf!XYnm z@3knaR@sOtq(`=x2Y+1WTO_05LHgYAMD*~c=Yx&_MosHAHMN7mK!ZBEM%%b%+4ZlO zzdptZPC&J$0`_YBFTHnu-$o^Wo=|i%$E`tcW$cKtnx7Xv{&&rhBp4VOPp=a&@6Ae$ zP)!j2MdqAYbk(=RAuNrY?1!IxGcVr-JTptt=eyrYaP+=l*;=TFiOnK0U_CLNIm_XJ zzTQQqw^_Qr%Y@&0Lb^5KvOmN2o$Bk(9E<5b@zVs(&k0NSS9ZEvm&=@M-fF+)9LeZS z&|@@wI4joPON=~@L)A`jWR58RXeyDhtZ!%z3~!xHLP=-^Z+c7*ePg}!G!lE&LDW^k zJU_sZ^m642r`x&s`eL7DxE&jd0>`sVCHTN0l>=rd@J=56IytzSuVylRP(nSlHzdcU z5$$)lgQKOg^$2=m*BEu$tz2c<9Kz~q?&#gX&3`hU7qWkN;l5Kxw_S(&Dz1+KZvHmG zV@}TUYxUPkN_Q}XGcE#}xCyAKsMxKqX;byKi!gk`fBJSUxUSxQSn7oftX?itqZ%!_zqZ#RiD$nfU zWjfaeKgx8_n_C#M5k#bkgz~FhGqF|O5&gL?9pAX{2}t7Ii%N=r*~M3{@vX;GaVk2K zztz>@g?nfysw+pjMUf;g$HbM{+NIpx`W3&DdaP)p(Ll75!KG2OHv3i|46(3(#3PLB zTejA!?~FiD=C$WmE;`!A>B3NRQ}}lnhNK1WCMkz-3bM|Wx(#kvBiu_~hftOcK@#pT zJrYy;&DQWl_p$Beu#lLV?PjWZXNE04!SEtX?yTCss`8`#j1JFLhvmnQL}0y*8Qw7D za$%91h!Q^5#U zq^x0((^hACx{4zC1gXnkE=D<&1@cc)F6NwDbrDk^RxawThoj4md<%CG8k(FaZr=EU zWtx=JF_KiK5Ep;3d0q*^;=4xtY@XW+|z)K2CPG?NkEq;B9iA@Vbm4I2{cknJ(S!h{rr{Y(j2- zzKA~8pCmI+za?ZijF3qWGt_@1`~pH-(^&3kF2ZMhTfRu)P!Seq!yS`{5Feln?cQGuQvh%9}X&(VYD7$bQeopt{dgwNj_JZgSXl?yw#JM*U1SX^1ik&OBzwGK$ zGqkR>iE*+rCTo$!xl6jb;hiGMFlMff$W$Ql`R9MVzS&8YCsv1I#oPTFRi!%DW zju#6k^<6-th%4t=;n5d}XBJJ#u+r~+6f>~j`2)J(?+X2(>#vV*~i1B z2D3;ps0lQ>zi?a^(Hnv<>-%HUE@(EO^Kh_2&72sc;yL58VPq^m%m&BT&;2Q~wGjQ# zlXdTG_Il^y41+<3>2s=S&hm6e5#&_0noQOvwXUkwj>TVh@SV3*llC1m*4&))0ROv* z<6UL$zRP`C>EA&e7hK!P$rJqWQE|Bq@$6HvX(TCfv#2}EZCSFD5@AKu^Lc)rxw|_& zVd(Z#{jRqU5-YE6-+FJ@`;?mAdN+FnXY?U;l=Wmb3No!@qE2|lZJE^^P=#D7ArxfNjLWo2VKUbAJg ze|g};G^vSPM_P8kf9_Qoj5&Pvhed01w9D!0dB3NcawmQ*czkWFJBhoRxS4ib@^^5; za7<+9iCUJ?Nzrb}n{||YOYDnqvCtBdOjLPpbZpW!@e0?$KI{u3}i%U)m&Xj8r8DroG~<-eXFS) z8-HnSb8hwf@8qcI!3inP{E_a)VOUUcE~9E>o#k1E!;}!mf-=(kXYQu*@}Aa&_QPl2 z>_8_QYjj+wmT%$U5%#p4nvSn|Ga-0HeudwZ#a!HI-ps!S8+55N5BDrZ3blSyHiY=v zS(I=FR&E>S5n9JJm~S(7tHdVm-7dFx_w~nGkU#4Ebc8LLD*6q3%O0i*nQHQK zo8a|_#W-+u$amRl1(Q0lp42`!YT)$JBYFHbcJ$;!3MdoJwoh1RuX1uEjg+6~-FZdx znXRq|4X3?jMKlm^n108;=Y0{=Ct4;pPJO)W{4FEFqEv2@>a1@Uf6~rdPk-Cp`6dVB zdHIuH|8EsE9bR0_tJ|Pwc;=K(w4QR`W`_pz&})Pur?BpM9?RXDrp{hMm||g_q))ng zPvDOFpz8~Sn~lr4t=+jxejv~APeQf;1U9A4qbF6Cfl99D<0^sF)b@$C)LiwY=3#z* zU+SK(eZ{BU0;^mFE(?G^pTG0JLrKYo;Uq2~Bm@t1VPRo$c{+67x|!`>i;>2&MYR;s zBa}qd^=aqVc>ERYSg?EaTF+7)Q#7xAO2*YyYWgwk(xSA!rr-?^Z8~dmOn+sz0rlDW zc9caCGbE8y|I0V*qgLL+&xpDqH|`Fo?-b$Dxw;0MbJ@PzdVdmE#z z9QdI%%Z@X4oj*M>@kj|vzsVeXF6G|d^5mX(uP|y2Km7g>evGnO?f%NJ5}!hE=J}ZB zODY%q_}!FuhD1R*<(O{TW{cNgQ{B4q#Dj}(V;Ao4jPj_~0{u@@m4KY2v!A|TU_PJ# zUmoa`N+OlyOv-0Rf8HEezYM7(Ub8wZ!m9O}zd0*G2RSPQ?p0($hfnmW`(D&+QgcC5 z>ZXgzdEzI<#D;zlV(t8KnhUq5e*B`AFHbk%X!NZf-y1O|w-0g#&!kb3eAfvKPq(MU z^-@g=>TrC7FeR*rAwG3bNwYi6IbH? z``+6_Pc-Uvg?SBX-x>OD3(##l+S`BrNWn4fYhzt|Y*4uLpdP!V5_W`%K-2dMx^e-cWI!1}rAfpb< zAzdFp^Wx*;OmeP4(tWuxGY^l-O|1I*TtgkO>GS|7ruoiHjSC>u^$bmynuXPa81lt~ zQ!e}P@bFKM)PKB0%{7po-;?;UxM)iFAU+{sTY&rI=ovmf{^Id@ZdR7GuCDICL-2d_ z#uv=@KYp-30!MYEh=>T<^dtXt0qGbFbEUD-&TvEd44OrZ{3bBmizl*WYzDWmh-Mzsc>bnie32Mw+7wVLE z)RF)Oo&|z|g2Hv4=eF(|$b8>?YB$c+Jvf-$*Y^rsR2<-f|37`5e^k;}6u|jHO2c2B zo%v%nbf>m#>(JDGO^pdN)Rn2FOTj6&+7wY^39hLV)M-B~Eyc{G2$`wVU^B!dotUS& zY#C+Yk*27nqKw51L_lB<+~0eDzIWbv@4S28yZ7Ap-u=jTI$#}>+ou4cr3NImCnm58 z!$T1Cd~B|oBvmsSW3W1QR*Qi8Z5WOAb4T)>Bb-y8EEO z)E+1(=v8}ag4K>sba<_TV3WOH8GoXsc-AX@x*cPYhm#K-I$ExD_wXR`LIDJFn~d=? z<+(bfWX*q@Ax_q;%8)J9Jj0*md4W>iDN}&2sf3$D^23`X&b+7o;Sbidm}wWacd;_LCR>C zn>NQgy8~R5*x2MjYT@YCT)T$)H5^Mp;3A&J9X^~n5Q-`2dS+Q{7l^*J+Q^5oE7YP- za^|9X40Bg!(-(TpWI#u)s;x~k<%98Oe;M+*6}0-i`$R2(VDBq)^Uc0@$78{Je>$?* zLuoeYyD6xmHk489Q|ni|Nrn=l2i^4-}GMuT+rdbfJZ!A@5QZE)+@$W@Tz z(%!H9ALpSH#aZH9k^M`!HR^4DaKo0 zI34W^V~IvoMjKP|GN36%S6r_6X-p=Qx89jtjyZv8MMI<&>SK`dJF?FIXz_WkfV-lx z8FIN+a<@cm9;l!{V@}j^Dx=?*MxO>O$#M1i8b@Dmcsq(pCmG=GlbXq%_eTkaozBvE(oR*qsi~PD5?QEtK{AXaQK?t?eaoaI zO-z!BVfht!Vv1(yhulrdt$iXDQ!{`BPbf3+rF^3mC|n|qMjMhOJce5bkiJ5KBjZwN z^2J!h8_h!iEtg^9EG}jwtplz&u)x*#1121B3paJzBTNL+RT!kp^Mt9L6MIfJA4C8G z#Kuf|p;F32k`^n=3ZoNd#<=)b{@g4BiCu{fk)1o`0GTr>FJRT3lwem(ns^R zY79D_lVPE^5IdheAs&yx&PjGjkGZVRY-)TQ?damA?bVLJ_7AR`2-mluA+axZyZSJ! zw*vUYp!lVv<`u*eiFLZ)ROj?VCH(V(*VA2zV>DdS+;c>-3O85^(yWi?Wa-9=t$^m$ zN!S1t)Rlc@RKSznY!a57+yW>+M5o4hH{?hN){rfz*s^ac*qUis~uc1p!;7((UbjlY3;4G=;(wsMbsX?L(A@ zy+!)BeHs7Xc}a)Gw#LA_yKR9<7)%{@;6Sd+|l$0l<6@$xNaoZ#2R;vd&SnXI^a*)r*cb#OB{ z1Re0kj%$ET*w-T|g_Y>^8V&6%um)0TEW~P>)th!v*xvtBQ>b^eSHy^sHCYVp7E{dyn( literal 0 HcmV?d00001 diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index e0a930efd2..e2fb047db8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -28,8 +28,35 @@ Windows offers different tools to view the status and configure Windows Firewall - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: > [!div class="nextstepaction"] > [Firewall & network protection][SEC-1] -- The Windows Firewall Control Panel applet -- The *Windows Firewall with Advanced Security* MMC snap-in provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments +- The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall +- The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments + +:::row::: + :::column span="2"::: + - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: + > [!div class="nextstepaction"] + > [Firewall & network protection][SEC-1] + :::column-end::: + :::column span="2"::: + :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + - The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/control-panel.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/mmc-advanced-security.png" border="false"::: + :::column-end::: +:::row-end::: ## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback From 4a119ef7656b9f7290eca9db5176db2353c0deac Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 16:54:55 -0500 Subject: [PATCH 137/237] table --- .../network-security/windows-firewall/index.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index e2fb047db8..ac3b2933ba 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -25,16 +25,10 @@ To help address your organizational network security challenges, Windows Firewal Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. -- The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: - > [!div class="nextstepaction"] - > [Firewall & network protection][SEC-1] -- The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall -- The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments - :::row::: :::column span="2"::: - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: - > [!div class="nextstepaction"] +  > [!div class="nextstepaction"] > [Firewall & network protection][SEC-1] :::column-end::: :::column span="2"::: From c01f3b28c1c1f5849cdcbb0c7b1f34eccf4e954e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 16:55:13 -0500 Subject: [PATCH 138/237] table --- .../network-security/windows-firewall/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index ac3b2933ba..c2ddd64f5e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -26,12 +26,12 @@ To help address your organizational network security challenges, Windows Firewal Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. :::row::: - :::column span="2"::: + :::column span="3"::: - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut:  > [!div class="nextstepaction"] > [Firewall & network protection][SEC-1] :::column-end::: - :::column span="2"::: + :::column span="1"::: :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: :::column-end::: :::row-end::: From 49dee3db782ea2ec06562c6140fc040e5e758e21 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 14 Nov 2023 17:17:03 -0500 Subject: [PATCH 139/237] table --- .../best-practices-configuring.md | 29 +++++++++++++++ .../windows-firewall/index.md | 37 ++----------------- 2 files changed, 33 insertions(+), 33 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index e7ff80e46a..c2b8411e61 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -9,6 +9,35 @@ ms.topic: best-practice Windows Firewall provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. +## Open and configure Windows Firewall + +Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. + +:::row::: + :::column span="3"::: + - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the shortcut [Firewall & network protection][SEC-1] + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + - The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/control-panel.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/mmc-advanced-security.png" border="false"::: + :::column-end::: +:::row-end::: + ## Access the Windows Firewall with Advanced Security console If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index c2ddd64f5e..65d5e3d962 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -11,7 +11,7 @@ Windows Firewall is a stateful host firewall that helps secure the device by all Windows Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. -## Practical applications +## Benefits To help address your organizational network security challenges, Windows Firewall offers the following benefits: @@ -19,39 +19,10 @@ To help address your organizational network security challenges, Windows Firewal - **Safeguards sensitive data and intellectual property.** With its integration with IPsec, Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. - **Extends the value of existing investments.** Because Windows Firewall is a host-based firewall that is included with the operating system, there's no other hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). +:::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." border="false"::: + [!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] -## Open and configure Windows Firewall - -Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. - -:::row::: - :::column span="3"::: - - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: -  > [!div class="nextstepaction"] - > [Firewall & network protection][SEC-1] - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - - The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/control-panel.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/mmc-advanced-security.png" border="false"::: - :::column-end::: -:::row-end::: - ## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WIN+F) and use the category **Security and Privacy** > **Network protection**. @@ -59,7 +30,7 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI ## Next steps > [!div class="nextstepaction"] -> Learn about the recommendations for configuring Windows Firewall: +> Learn how to configure Windows Firewall: > > [Configure Windows Firewall >](best-practices-configuring.md) From 6e196830b1b82638575f0d0b9089ae0144a33879 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Tue, 14 Nov 2023 20:01:42 -0500 Subject: [PATCH 140/237] Add semicolon Add semicolon --- windows/deployment/windows-10-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 6c4ec1ff6a..b5fc8eb923 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -40,7 +40,7 @@ For more information on how to deploy Enterprise licenses, see [Deploy Windows E > [!NOTE] > -> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**. +> Organizations that use the Subscription Activation feature to enable users to upgrade from one version of Windows to another and use Conditional Access policies to control access need to exclude one of the following cloud apps from their Conditional Access policies using **Select Excluded Cloud Apps**: > > - [Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). > - [Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f](/troubleshoot/azure/active-directory/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications). From 3ef03d10e1b60552df1e523c63009d1d67a5d228 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 07:20:48 -0500 Subject: [PATCH 141/237] test --- .../best-practices-configuring.md | 15 ++++++++++++--- .../network-security/windows-firewall/index.md | 1 - 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index c2b8411e61..8f8b2b53b3 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -15,7 +15,10 @@ Windows offers different tools to view the status and configure Windows Firewall :::row::: :::column span="3"::: - - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the shortcut [Firewall & network protection][SEC-1] + ### Windows Security + The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the shortcut [Firewall & network protection][SEC-1] + > [!div class=nextstepaction "Configure Windows Firewall >"](best-practices-configuring.md) + > [!div class="nextstepaction"] [Configure Windows Firewall >](best-practices-configuring.md) :::column-end::: :::column span="1"::: :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: @@ -23,7 +26,8 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="3"::: - - The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall + ### Control Panel + The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall. :::column-end::: :::column span="1"::: :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/control-panel.png" border="false"::: @@ -31,7 +35,8 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="3"::: - - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments + ### Microsoft Management Console (MMC) + The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments. :::column-end::: :::column span="1"::: :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/mmc-advanced-security.png" border="false"::: @@ -237,3 +242,7 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR - **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported. + + + +[SEC-1]: windowsdefender://network/ \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 65d5e3d962..764b525eb6 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -36,5 +36,4 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI -[SEC-1]: windowsdefender://network/ [FHUB]: feedback-hub:?tabid=2&newFeedback=true \ No newline at end of file From 3b6307c5148fdf978ccfc70447682bef66c2dd9e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 08:26:39 -0500 Subject: [PATCH 142/237] test --- .../windows-firewall/best-practices-configuring.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 8f8b2b53b3..1b6f83a4c1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -16,9 +16,11 @@ Windows offers different tools to view the status and configure Windows Firewall :::row::: :::column span="3"::: ### Windows Security - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the shortcut [Firewall & network protection][SEC-1] - > [!div class=nextstepaction "Configure Windows Firewall >"](best-practices-configuring.md) - > [!div class="nextstepaction"] [Configure Windows Firewall >](best-practices-configuring.md) + The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: [Firewall & network protection][SEC-1] + + > [!div class="nextstepaction"] + > [Firewall & network protection][SEC-1] + :::column-end::: :::column span="1"::: :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: From fa2b73a6f35daee6b487c2e54494374149e8922b Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Wed, 15 Nov 2023 14:52:37 +0100 Subject: [PATCH 143/237] Update event-4738.md Actual meaning of Old UAC Value and New UAC Value as defined by SAM. --- .../threat-protection/auditing/event-4738.md | 35 ++----------------- 1 file changed, 3 insertions(+), 32 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index 61cd4e80e6..b35ea56a2e 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -192,39 +192,10 @@ Typical **Primary Group** values for user accounts: > [!NOTE] > **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the previous value of **userAccountControl** attribute of user object. +- **Old UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. If the value of **userAccountControl** attribute of user object was changed, you will see the new value here. - -To decode this value, you can go through the property value definitions in the [User’s or Computer’s account UAC flags.](/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties) from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. +For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn - **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: [User’s or Computer’s account UAC flags](/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties). In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event. From 8a7f8af7275deded025ab20d7d5a64c9e6e0979f Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Wed, 15 Nov 2023 14:52:57 +0100 Subject: [PATCH 144/237] Update event-4742.md Actual meaning of Old UAC Value and New UAC Value as defined by SAM. --- .../threat-protection/auditing/event-4742.md | 39 ++----------------- 1 file changed, 3 insertions(+), 36 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index 6d58542822..cffaebcf0d 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -197,43 +197,10 @@ Typical **Primary Group** values for computer accounts: > [!NOTE] > **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of **userAccountControl** attribute of computer object. +- **Old UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. If the value of **userAccountControl** attribute of computer object was changed, you will see the new value here. - -To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT - -- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: “Table 7. User’s or Computer’s account UAC flags.”. In the “User Account Control field text” column, you can see text that will be displayed in the **User Account Control** field in 4742 event. - - +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. +For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of computer’s account properties, then you will see `` in this field. From 10f15ed997d30352cb1a3558f7ead341abad55b7 Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Wed, 15 Nov 2023 14:53:07 +0100 Subject: [PATCH 145/237] Update event-4720.md Actual meaning of Old UAC Value and New UAC Value as defined by SAM. --- .../threat-protection/auditing/event-4720.md | 79 +------------------ 1 file changed, 3 insertions(+), 76 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index 726f71bbbd..56548894f7 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -166,83 +166,10 @@ Typically, **Primary Group** field for new user accounts has the following value > **Note**  **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. **Old UAC value** always **“0x0”** for new user accounts. This parameter contains the previous value of **userAccountControl** attribute of user object. +- **Old UAC Value** [Type = UnicodeString]: is always “0x0” for new accounts. -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user account. This parameter contains the value of **userAccountControl** attribute of new user object. - -To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT - -- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. For new user accounts, when the object for this account was created, the **userAccountControl** value was considered to be **“0x0”**, and then it was changed from **“0x0”** to the real value for the account's **userAccountControl** attribute. See possible values in the table below. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4720 event. - -| Flag Name | userAccountControl in hexadecimal | userAccountControl in decimal | Description | User Account Control field text | -|------------------------------------|-----------------------------------|-------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------| -| SCRIPT | 0x0001 | 1 | The logon script will be run. | Changes of this flag do not show in 4720 events. | -| ACCOUNTDISABLE | 0x0002 | 2 | The user account is disabled. | Account Disabled
    Account Enabled | -| Undeclared | 0x0004 | 4 | This flag is undeclared. | Changes of this flag do not show in 4720 events. | -| HOMEDIR\_REQUIRED | 0x0008 | 8 | The home folder is required. | 'Home Directory Required' - Enabled
    'Home Directory Required' - Disabled | -| LOCKOUT | 0x0010 | 16 | | Changes of this flag do not show in 4720 events. | -| PASSWD\_NOTREQD | 0x0020 | 32 | No password is required. | 'Password Not Required' - Enabled
    'Password Not Required' - Disabled | -| PASSWD\_CANT\_CHANGE | 0x0040 | 64 | The user cannot change the password. This is a permission on the user's object. | Changes of this flag do not show in 4720 events. | -| ENCRYPTED\_TEXT\_PWD\_ALLOWED | 0x0080 | 128 | The user can send an encrypted password.
    Can be set using “Store password using reversible encryption” checkbox. | 'Encrypted Text Password Allowed' - Disabled
    'Encrypted Text Password Allowed' - Enabled | -| TEMP\_DUPLICATE\_ACCOUNT | 0x0100 | 256 | This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. This is sometimes referred to as a local user account. | Cannot be set for computer account. | -| NORMAL\_ACCOUNT | 0x0200 | 512 | This is a default account type that represents a typical user. | 'Normal Account' - Disabled
    'Normal Account' - Enabled | -| INTERDOMAIN\_TRUST\_ACCOUNT | 0x0800 | 2048 | This is a permit to trust an account for a system domain that trusts other domains. | Cannot be set for computer account. | -| WORKSTATION\_TRUST\_ACCOUNT | 0x1000 | 4096 | This is a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain. | 'Workstation Trust Account' - Disabled
    'Workstation Trust Account' - Enabled | -| SERVER\_TRUST\_ACCOUNT | 0x2000 | 8192 | This is a computer account for a domain controller that is a member of this domain. | 'Server Trust Account' - Enabled
    'Server Trust Account' - Disabled | -| DONT\_EXPIRE\_PASSWORD | 0x10000 | 65536 | Represents the password, which should never expire on the account.
    Can be set using “Password never expires” checkbox. | 'Don't Expire Password' - Disabled
    'Don't Expire Password' - Enabled | -| MNS\_LOGON\_ACCOUNT | 0x20000 | 131072 | This is an MNS logon account. | 'MNS Logon Account' - Disabled
    'MNS Logon Account' - Enabled | -| SMARTCARD\_REQUIRED | 0x40000 | 262144 | When this flag is set, it forces the user to log on by using a smart card. | 'Smartcard Required' - Disabled
    'Smartcard Required' - Enabled | -| TRUSTED\_FOR\_DELEGATION | 0x80000 | 524288 | When this flag is set, the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for Kerberos delegation, you must set this flag on the userAccountControl property of the service account.
    If you enable Kerberos constraint or unconstraint delegation or disable these types of delegation in Delegation tab you will get this flag changed. | 'Trusted For Delegation' - Enabled
    'Trusted For Delegation' - Disabled | -| NOT\_DELEGATED | 0x100000 | 1048576 | When this flag is set, the security context of the user is not delegated to a service even if the service account is set as trusted for Kerberos delegation.
    Can be set using “Account is sensitive and cannot be delegated” checkbox. | 'Not Delegated' - Disabled
    'Not Delegated' - Enabled | -| USE\_DES\_KEY\_ONLY | 0x200000 | 2097152 | Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.
    Can be set using “Use Kerberos DES encryption types for this account” checkbox. | 'Use DES Key Only' - Disabled
    'Use DES Key Only' - Enabled | -| DONT\_REQ\_PREAUTH | 0x400000 | 4194304 | This account does not require Kerberos pre-authentication for logging on.
    Can be set using “Do not require Kerberos preauthentication” checkbox. | 'Don't Require Preauth' - Disabled
    'Don't Require Preauth' - Enabled | -| PASSWORD\_EXPIRED | 0x800000 | 8388608 | The user's password has expired. | Changes of this flag do not show in 4720 events. | -| TRUSTED\_TO\_AUTH\_FOR\_DELEGATION | 0x1000000 | 16777216 | The account is enabled for delegation. This is a security-sensitive setting. Accounts that have this option enabled should be tightly controlled. This setting lets a service that runs under the account assume a client's identity and authenticate as that user to other remote servers on the network.
    If you enable Kerberos protocol transition delegation or disable this type of delegation in Delegation tab you will get this flag changed. | 'Trusted To Authenticate For Delegation' - Disabled
    'Trusted To Authenticate For Delegation' - Enabled | -| PARTIAL\_SECRETS\_ACCOUNT | 0x04000000 | 67108864 | The account is a read-only domain controller (RODC). This is a security-sensitive setting. Removing this setting from an RODC compromises security on that server. | No information. | - -For new, manually created, domain or local user accounts typical flags are: - -- Account Disabled - -- 'Password Not Required' - Enabled - -- 'Normal Account' – Enabled - - After new user creation event you will typically see couple of “[4738](event-4738.md): A user account was changed.” events with new flags: - -- 'Password Not Required' – Disabled - -- Account Enabled - - +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). +For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see **<value changed, but not displayed>** in this field in “[4738](event-4738.md): A user account was changed.” This parameter might not be captured in the event, and in that case appears as “-”. For new local accounts this field typically has value “**<value not set>**”. From bcb06b366e0974864272f5e86b26190abba03ad6 Mon Sep 17 00:00:00 2001 From: Herbert Mauerer <41573578+HerbertMauerer@users.noreply.github.com> Date: Wed, 15 Nov 2023 14:53:15 +0100 Subject: [PATCH 146/237] Update event-4741.md Actual meaning of Old UAC Value and New UAC Value as defined by SAM. --- .../threat-protection/auditing/event-4741.md | 65 +------------------ 1 file changed, 3 insertions(+), 62 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md index a245d7e5ce..e188466a86 100644 --- a/windows/security/threat-protection/auditing/event-4741.md +++ b/windows/security/threat-protection/auditing/event-4741.md @@ -170,69 +170,10 @@ Typically, **Primary Group** field for new computer accounts has the following v > [!NOTE] > **Service Principal Name (SPN)** is the name by which a client uniquely identifies an instance of a service. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. -- **Old UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. **Old UAC value** always `0x0` for new computer accounts. This parameter contains the previous value of **userAccountControl** attribute of computer object. +- **Old UAC Value** [Type = UnicodeString]: is always “0x0” for new accounts. -- **New UAC Value** \[Type = UnicodeString\]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of **userAccountControl** attribute of new computer object. - -To decode this value, you can go through the property value definitions in the “Table 7. User’s or Computer’s account UAC flags.” from largest to smallest. Compare each property value to the flags value in the event. If the flags value in the event is greater than or equal to the property value, then the property is "set" and applies to that event. Subtract the property value from the flags value in the event and note that the flag applies and then go on to the next flag. - -Here's an example: Flags value from event: 0x15 - -Decoding: - -• PASSWD\_NOTREQD 0x0020 - -• LOCKOUT 0x0010 - -• HOMEDIR\_REQUIRED 0x0008 - -• (undeclared) 0x0004 - -• ACCOUNTDISABLE 0x0002 - -• SCRIPT 0x0001 - -0x0020 > 0x15, so PASSWD\_NOTREQD does not apply to this event - -0x10 < 0x15, so LOCKOUT applies to this event. 0x15 - 0x10 = 0x5 - -0x4 < 0x5, so the undeclared value is set. We'll pretend it doesn't mean anything. 0x5 - 0x4 = 0x1 - -0x2 > 0x1, so ACCOUNTDISABLE does not apply to this event - -0x1 = 0x1, so SCRIPT applies to this event. 0x1 - 0x1 = 0x0, we're done. - -So this UAC flags value decodes to: LOCKOUT and SCRIPT - -- **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. For new computer accounts, when the object for this account was created, the **userAccountControl** value was considered to be `0x0`, and then it was changed from `0x0` to the real value for the account's **userAccountControl** attribute. See possible values in the table below. In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4741 event. - -| Flag Name | userAccountControl in hexadecimal | userAccountControl in decimal | Description | User Account Control field text | -|---|---|---|---|---| -| SCRIPT | 0x0001 | 1 | The logon script will be run. | Changes of this flag do not show in 4741 events. | -| ACCOUNTDISABLE | 0x0002 | 2 | The user account is disabled. | Account Disabled
    Account Enabled | -| Undeclared | 0x0004 | 4 | This flag is undeclared. | Changes of this flag do not show in 4741 events. | -| HOMEDIR\_REQUIRED | 0x0008 | 8 | The home folder is required. | 'Home Directory Required' - Enabled
    'Home Directory Required' - Disabled | -| LOCKOUT | 0x0010 | 16 | | Changes of this flag do not show in 4741 events. | -| PASSWD\_NOTREQD | 0x0020 | 32 | No password is required. | 'Password Not Required' - Enabled
    'Password Not Required' - Disabled | -| PASSWD\_CANT\_CHANGE | 0x0040 | 64 | The user cannot change the password. This is a permission on the user's object. | Changes of this flag do not show in 4741 events. | -| ENCRYPTED\_TEXT\_PWD\_ALLOWED | 0x0080 | 128 | The user can send an encrypted password.
    Can be set using “Store password using reversible encryption” checkbox. | 'Encrypted Text Password Allowed' - Disabled
    'Encrypted Text Password Allowed' - Enabled | -| TEMP\_DUPLICATE\_ACCOUNT | 0x0100 | 256 | This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. This is sometimes referred to as a local user account. | Cannot be set for computer account. | -| NORMAL\_ACCOUNT | 0x0200 | 512 | This is a default account type that represents a typical user. | 'Normal Account' - Disabled
    'Normal Account' - Enabled | -| INTERDOMAIN\_TRUST\_ACCOUNT | 0x0800 | 2048 | This is a permit to trust an account for a system domain that trusts other domains. | Cannot be set for computer account. | -| WORKSTATION\_TRUST\_ACCOUNT | 0x1000 | 4096 | This is a computer account for a computer that is running Microsoft Windows NT 4.0 Workstation, Microsoft Windows NT 4.0 Server, Microsoft Windows 2000 Professional, or Windows 2000 Server and is a member of this domain. | 'Workstation Trust Account' - Disabled
    'Workstation Trust Account' - Enabled | -| SERVER\_TRUST\_ACCOUNT | 0x2000 | 8192 | This is a computer account for a domain controller that is a member of this domain. | 'Server Trust Account' - Enabled
    'Server Trust Account' - Disabled | -| DONT\_EXPIRE\_PASSWORD | 0x10000 | 65536 | Represents the password, which should never expire on the account.
    Can be set using “Password never expires” checkbox. | 'Don't Expire Password' - Disabled
    'Don't Expire Password' - Enabled | -| MNS\_LOGON\_ACCOUNT | 0x20000 | 131072 | This is an MNS logon account. | 'MNS Logon Account' - Disabled
    'MNS Logon Account' - Enabled | -| SMARTCARD\_REQUIRED | 0x40000 | 262144 | When this flag is set, it forces the user to log on by using a smart card. | 'Smartcard Required' - Disabled
    'Smartcard Required' - Enabled | -| TRUSTED\_FOR\_DELEGATION | 0x80000 | 524288 | When this flag is set, the service account (the user or computer account) under which a service runs is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. To enable a service for Kerberos delegation, you must set this flag on the userAccountControl property of the service account.
    If you enable Kerberos constraint or unconstraint delegation or disable these types of delegation in Delegation tab you will get this flag changed. | 'Trusted For Delegation' - Enabled
    'Trusted For Delegation' - Disabled | -| NOT\_DELEGATED | 0x100000 | 1048576 | When this flag is set, the security context of the user is not delegated to a service even if the service account is set as trusted for Kerberos delegation.
    Can be set using “Account is sensitive and cannot be delegated” checkbox. | 'Not Delegated' - Disabled
    'Not Delegated' - Enabled | -| USE\_DES\_KEY\_ONLY | 0x200000 | 2097152 | Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys.
    Can be set using “Use Kerberos DES encryption types for this account” checkbox. | 'Use DES Key Only' - Disabled
    'Use DES Key Only' - Enabled | -| DONT\_REQ\_PREAUTH | 0x400000 | 4194304 | This account does not require Kerberos pre-authentication for logging on.
    Can be set using “Do not require Kerberos preauthentication” checkbox. | 'Don't Require Preauth' - Disabled
    'Don't Require Preauth' - Enabled | -| PASSWORD\_EXPIRED | 0x800000 | 8388608 | The user's password has expired. | Changes of this flag do not show in 4741 events. | -| TRUSTED\_TO\_AUTH\_FOR\_DELEGATION | 0x1000000 | 16777216 | The account is enabled for delegation. This is a security-sensitive setting. Accounts that have this option enabled should be tightly controlled. This setting lets a service that runs under the account assume a client's identity and authenticate as that user to other remote servers on the network.
    If you enable Kerberos protocol transition delegation or disable this type of delegation in Delegation tab you will get this flag changed. | 'Trusted To Authenticate For Delegation' - Disabled
    'Trusted To Authenticate For Delegation' - Enabled | -| PARTIAL\_SECRETS\_ACCOUNT | 0x04000000 | 67108864 | The account is a read-only domain controller (RODC). This is a security-sensitive setting. Removing this setting from an RODC compromises security on that server. | No information. | - -> Table 7. User’s or Computer’s account UAC flags. +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). +For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of computer’s account properties, then you will see `` in this field in “[4742](event-4742.md)(S): A computer account was changed.” This parameter might not be captured in the event, and in that case appears as `-`. From c8c42180750ed6207750d6b47e854f6035fd97c4 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 09:08:15 -0500 Subject: [PATCH 147/237] test --- .../best-practices-configuring.md | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 1b6f83a4c1..9fe7225f69 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -14,21 +14,31 @@ Windows Firewall provides host-based, two-way network traffic filtering and bloc Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. :::row::: - :::column span="3"::: + :::column span="4"::: ### Windows Security - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: [Firewall & network protection][SEC-1] - + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: > [!div class="nextstepaction"] > [Firewall & network protection][SEC-1] :::column-end::: :::column span="1"::: :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: + + > [!div class="nextstepaction"] + > [Firewall & network protection][SEC-1] + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + ### Control Panel :::column-end::: :::row-end::: :::row::: :::column span="3"::: - ### Control Panel The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall. :::column-end::: :::column span="1"::: @@ -36,8 +46,12 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::row-end::: :::row::: - :::column span="3"::: + :::column span="4"::: ### Microsoft Management Console (MMC) + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments. :::column-end::: :::column span="1"::: From b421c105ad724978810144c7e57099806eaec6d5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 10:21:10 -0500 Subject: [PATCH 148/237] updates --- .../best-practices-configuring.md | 18 +++++++++++------- .../windows-firewall/images/domain-network.svg | 3 +++ .../images/private-network.svg | 3 +++ .../windows-firewall/images/public-network.svg | 3 +++ 4 files changed, 20 insertions(+), 7 deletions(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 9fe7225f69..3cf2628a6e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -22,14 +22,12 @@ Windows offers different tools to view the status and configure Windows Firewall :::column span="3"::: The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: > [!div class="nextstepaction"] - > [Firewall & network protection][SEC-1] + > [Open Firewall & network protection][SEC-1] :::column-end::: :::column span="1"::: :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: - > [!div class="nextstepaction"] - > [Firewall & network protection][SEC-1] :::column-end::: :::row-end::: :::row::: @@ -69,11 +67,17 @@ If you are configuring a single device, you must have administrative rights on t The *Overview* panel of the *Windows Firewall with Advanced Security* console displays security settings for each type of network to which the device can connect. -![Windows Firewall with Advanced Security first time opening.](images/fw01-profiles.png) +### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network -1. **Domain profile**: Used for networks where there's a system of account authentication against an Active Directory domain controller -1. **Private profile**: Designed for and best used in private networks such as a home network -1. **Public profile**: Designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, or stores +Used for networks where there's a system of account authentication against an Active Directory domain controller + +### :::image type="icon" source="images/domain-network.svg" border="false"::: Private network + +Designed for and best used in private networks such as a home network + +### :::image type="icon" source="images/domain-network.svg" border="false"::: Public network + +Designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, or stores To view detailed settings for each profile, right-click the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then select **Properties**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg new file mode 100644 index 0000000000..83a88e6703 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg new file mode 100644 index 0000000000..75dffe9ea7 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg @@ -0,0 +1,3 @@ + + + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg new file mode 100644 index 0000000000..fb0da7408a --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg @@ -0,0 +1,3 @@ + + + From c293044f362171d85a50fe9694c30fb25d91ab52 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 15 Nov 2023 07:22:54 -0800 Subject: [PATCH 149/237] fix syntax error --- windows/whats-new/deprecated-features.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index cad07d84d8..1f4ad7580a 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -37,7 +37,6 @@ The features in this article are no longer being actively developed, and might b |Feature | Details and mitigation | Deprecation announced | | ----------- | --------------------- | ---- | | Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp. | November 2023 | -| --- | --- | --- | | Tips | The Tips app is deprecated and will be removed in a future release of Windows. Content in the app will continue to be updated with information about new Windows features until the app is removed. | November 2023 | | Computer Browser | The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see [MS-BRWS Common Internet File System](/openspecs/windows_protocols/ms-brws/3cfbad92-09b3-4abc-808f-c6f6347d5677). | November 2023 | | Webclient (WebDAV) Service | The Webclient (WebDAV) service is deprecated. The Webclient service isn't started by default in Windows. For more information on WebDAV, see [WebDAV - Win32 apps](/windows/win32/webdav/webdav-portal). | November 2023 | From 93d7c25edf45f397dd0ebee185070ac34bf0695b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 10:32:54 -0500 Subject: [PATCH 150/237] updates --- .../windows-firewall/best-practices-configuring.md | 4 ++-- .../windows-firewall/images/domain-network.svg | 2 +- .../windows-firewall/images/private-network.svg | 2 +- .../windows-firewall/images/public-network.svg | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 3cf2628a6e..c41f809d6c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -71,11 +71,11 @@ The *Overview* panel of the *Windows Firewall with Advanced Security* console di Used for networks where there's a system of account authentication against an Active Directory domain controller -### :::image type="icon" source="images/domain-network.svg" border="false"::: Private network +### :::image type="icon" source="images/private-network.svg" border="false"::: Private network Designed for and best used in private networks such as a home network -### :::image type="icon" source="images/domain-network.svg" border="false"::: Public network +### :::image type="icon" source="images/public-network.svg" border="false"::: Public network Designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, or stores diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg index 83a88e6703..e1daf3c62b 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg @@ -1,3 +1,3 @@ - + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg index 75dffe9ea7..60a669c499 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg @@ -1,3 +1,3 @@ - + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg index fb0da7408a..b969cb7b64 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg @@ -1,3 +1,3 @@ - + From 0b673fbd0166438ef95dd9f7b9d16c99a85b6af0 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 15 Nov 2023 10:36:54 -0500 Subject: [PATCH 151/237] Update event-4742.md --- windows/security/threat-protection/auditing/event-4742.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4742.md b/windows/security/threat-protection/auditing/event-4742.md index cffaebcf0d..4a82933448 100644 --- a/windows/security/threat-protection/auditing/event-4742.md +++ b/windows/security/threat-protection/auditing/event-4742.md @@ -199,8 +199,7 @@ Typical **Primary Group** values for computer accounts: - **Old UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. -For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of computer’s account properties, then you will see `` in this field. From 354b374b65bb27681316eb29af6a1574767f6adf Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 15 Nov 2023 10:48:03 -0500 Subject: [PATCH 152/237] Update event-4720.md --- windows/security/threat-protection/auditing/event-4720.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4720.md b/windows/security/threat-protection/auditing/event-4720.md index 56548894f7..5ca11d5d60 100644 --- a/windows/security/threat-protection/auditing/event-4720.md +++ b/windows/security/threat-protection/auditing/event-4720.md @@ -168,8 +168,7 @@ Typically, **Primary Group** field for new user accounts has the following value - **Old UAC Value** [Type = UnicodeString]: is always “0x0” for new accounts. -- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of user’s account properties, then you will see **<value changed, but not displayed>** in this field in “[4738](event-4738.md): A user account was changed.” This parameter might not be captured in the event, and in that case appears as “-”. For new local accounts this field typically has value “**<value not set>**”. From 3c37dc9f80223d624434e123ef3fdb6f39cc4ae0 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 15 Nov 2023 10:56:39 -0500 Subject: [PATCH 153/237] Update event-4741.md --- windows/security/threat-protection/auditing/event-4741.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4741.md b/windows/security/threat-protection/auditing/event-4741.md index e188466a86..e26b0c96b3 100644 --- a/windows/security/threat-protection/auditing/event-4741.md +++ b/windows/security/threat-protection/auditing/event-4741.md @@ -172,8 +172,7 @@ Typically, **Primary Group** field for new computer accounts has the following v - **Old UAC Value** [Type = UnicodeString]: is always “0x0” for new accounts. -- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Parameters** \[Type = UnicodeString\]: if you change any setting using Active Directory Users and Computers management console in Dial-in tab of computer’s account properties, then you will see `` in this field in “[4742](event-4742.md)(S): A computer account was changed.” This parameter might not be captured in the event, and in that case appears as `-`. From 6f95ab612d7eb8663cea036701389f5416ef590b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Wed, 15 Nov 2023 10:58:07 -0500 Subject: [PATCH 154/237] Update event-4738.md --- windows/security/threat-protection/auditing/event-4738.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4738.md b/windows/security/threat-protection/auditing/event-4738.md index b35ea56a2e..be3bf1a1e5 100644 --- a/windows/security/threat-protection/auditing/event-4738.md +++ b/windows/security/threat-protection/auditing/event-4738.md @@ -194,8 +194,7 @@ Typical **Primary Group** values for user accounts: - **Old UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the previous value of the SAM implementation of account flags (definition differs from userAccountControl in AD). -- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. -For a list of account flags you may see here, please refer to [MS-SAMR]: USER_ACCOUNT Codes | Microsoft Learn +- **New UAC Value** [Type = UnicodeString]: specifies flags that control password, lockout, disable/enable, script, and other behavior for the user or computer account. This parameter contains the value of the SAM implementation of account flags (definition differs from userAccountControl in AD). If the value was changed, you will see the new value here. For a list of account flags you may see here, refer to [[MS-SAMR]: USER_ACCOUNT Codes](/openspecs/windows_protocols/ms-samr/b10cfda1-f24f-441b-8f43-80cb93e786ec). - **User Account Control** \[Type = UnicodeString\]**:** shows the list of changes in **userAccountControl** attribute. You will see a line of text for each change. See possible values in here: [User’s or Computer’s account UAC flags](/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties). In the “User Account Control field text” column, you can see the text that will be displayed in the **User Account Control** field in 4738 event. From 3d50a21583bbb8689dfa32fbfe7ba5e47b1fc9db Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 13:40:15 -0500 Subject: [PATCH 155/237] updates --- .../network-security/windows-firewall/images/domain-network.svg | 2 +- .../windows-firewall/images/private-network.svg | 2 +- .../network-security/windows-firewall/images/public-network.svg | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg index e1daf3c62b..913bf739dd 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/domain-network.svg @@ -1,3 +1,3 @@ - + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg index 60a669c499..93648081fa 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/private-network.svg @@ -1,3 +1,3 @@ - + diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg b/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg index b969cb7b64..4206f50489 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg +++ b/windows/security/operating-system-security/network-security/windows-firewall/images/public-network.svg @@ -1,3 +1,3 @@ - + From e074d2d98376e50bbc60742194a62dcbef3a3bc5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 17:16:35 -0500 Subject: [PATCH 156/237] test zone pivots --- .../windows-firewall/best-practices-configuring.md | 8 ++++---- .../windows-firewall/configure-with-command-line.md | 3 ++- .../network-security/windows-firewall/index.md | 8 ++++---- .../windows-firewall/zone_pivot_groups.yml | 10 ++++++++++ 4 files changed, 20 insertions(+), 9 deletions(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/zone_pivot_groups.yml diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index c41f809d6c..8e4bd28346 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -1,7 +1,7 @@ --- title: Recommendations for configuring Windows Firewall description: Learn about best practices for configuring Windows Firewall. -ms.date: 11/10/2023 +ms.date: 11/15/2023 ms.topic: best-practice --- @@ -69,15 +69,15 @@ The *Overview* panel of the *Windows Firewall with Advanced Security* console di ### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network -Used for networks where there's a system of account authentication against an Active Directory domain controller +The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. ### :::image type="icon" source="images/private-network.svg" border="false"::: Private network -Designed for and best used in private networks such as a home network +The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. ### :::image type="icon" source="images/public-network.svg" border="false"::: Public network -Designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, or stores +The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. To view detailed settings for each profile, right-click the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then select **Properties**. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index 34935664f7..e84df49265 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -2,7 +2,8 @@ title: Manage Windows Firewall with the command line description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. ms.topic: conceptual -ms.date: 11/14/2023 +ms.date: 11/15/2023 +zone_pivot_groups: windows-cmds --- # Manage Windows Firewall with the command line diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 764b525eb6..802e8c5fda 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -13,11 +13,11 @@ Windows Firewall also works with Network Awareness so that it can apply security ## Benefits -To help address your organizational network security challenges, Windows Firewall offers the following benefits: +Windows Firewall offers several benefits to address your organization's network security challenges: -- **Reduces the risk of network security threats.** Windows Firewall reduces the attack surface of a device, providing an extra layer to the defense-in-depth model. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack. -- **Safeguards sensitive data and intellectual property.** With its integration with IPsec, Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. -- **Extends the value of existing investments.** Because Windows Firewall is a host-based firewall that is included with the operating system, there's no other hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). +- Reduced risk of network security threats: By reducing the attack surface of a device, Windows Firewall provides an additional layer of defense to the defense-in-depth model. This increases manageability and decreases the likelihood of a successful attack +- Protection of sensitive data and intellectual property: Windows Firewall integrates with IPsec to provide a simple way to enforce authenticated, end-to-end network communications. This allows for scalable, tiered access to trusted network resources, helping to enforce data integrity and, if necessary, protect data confidentiality +- Extended value of existing investments: Windows Firewall is a host-based firewall included with the operating system, so no additional hardware or software is required. It's also designed to complement existing non-Microsoft network security solutions through a documented API :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." border="false"::: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/zone_pivot_groups.yml b/windows/security/operating-system-security/network-security/windows-firewall/zone_pivot_groups.yml new file mode 100644 index 0000000000..75443e99b0 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/zone_pivot_groups.yml @@ -0,0 +1,10 @@ +### YamlMime:ZonePivotGroups +groups: +- id: windows-cmds + title: Command line tools + prompt: "Choose the command line tool:" + pivots: + - id: windows-cmd + title: Command Prompt + - id: windows-powershell + title: PowerShell \ No newline at end of file From 71c4716fb1f35583f156cffbb3c6bc13c7fa1844 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 15 Nov 2023 17:33:34 -0500 Subject: [PATCH 157/237] updates --- .openpublishing.publish.config.json | 3 ++- .../windows-firewall/configure-with-command-line.md | 1 + .../{zone_pivot_groups.yml => windows-zone-pivot-groups.yml} | 0 3 files changed, 3 insertions(+), 1 deletion(-) rename windows/security/operating-system-security/network-security/windows-firewall/{zone_pivot_groups.yml => windows-zone-pivot-groups.yml} (100%) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 075a516838..c6f6954b04 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -172,7 +172,8 @@ "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", - "RestApi": "Content" + "RestApi": "Content", + "ZonePivotGroups": "Toc" }, "build_entry_point": "docs", "template_folder": "_themes" diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index e84df49265..105e9c6cb6 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -4,6 +4,7 @@ description: Learn how to manage Windows Firewall from the command line. This gu ms.topic: conceptual ms.date: 11/15/2023 zone_pivot_groups: windows-cmds +zone_pivot_group_filename: windows-zone-pivot-groups.json --- # Manage Windows Firewall with the command line diff --git a/windows/security/operating-system-security/network-security/windows-firewall/zone_pivot_groups.yml b/windows/security/operating-system-security/network-security/windows-firewall/windows-zone-pivot-groups.yml similarity index 100% rename from windows/security/operating-system-security/network-security/windows-firewall/zone_pivot_groups.yml rename to windows/security/operating-system-security/network-security/windows-firewall/windows-zone-pivot-groups.yml From 8f651c730b5fe2fa3b45a802b913abb5f4d6f558 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Wed, 15 Nov 2023 15:12:23 -0800 Subject: [PATCH 158/237] meta update --- windows/client-management/manage-windows-copilot.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index e8c129e081..9851b09748 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -4,6 +4,8 @@ description: Learn how to manage Copilot in Windows for commercial environments ms.topic: article ms.technology: itpro-windows-copilot ms.date: 11/06/2023 +ms.author: mstewart +author: mestew appliesto: - ✅ Windows 11, version 22H2 or later --- From 75abc2a3c88899bea5ba1a986030d3d9023f7b43 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 06:34:30 -0500 Subject: [PATCH 159/237] updates --- .../images/windows-security.png | Bin 94004 -> 287077 bytes .../windows-firewall/index.md | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png b/windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png index 3a512d8458ec78bf7397c30984c86aebb3047b2a..9f4b9699f7a47f3050d1173301aa0e9c051ea22b 100644 GIT binary patch literal 287077 zcmeEtXIN9))-G-oY>0}Ah=6Vtq^cmW=_*#bAiZj&M4HqXLWqjWRuoj4v;ZPSIs^z1 zNDu`CgisS8KoATOLWm?JA*9{lKHvGy^WFR7{<;6|dLF{6bIm!&JKyonF~@ptXLC(z z=aHRaVq#J^u3xqn6O)`26BEa6mk^z)-kpLL{o8T>x@&}(*e;pPzb#@}Ifq3jw?x=q zyChaMaCA|0u+{&f^+hqU+T>ll+uOvp`fS{|eDT(UEz5jJg;zJ2n22@z@P+I6;jmkM z+q~KhbKQ^b$Q$B^Rc@V8^*C9pFsilep&=Z~zb^BIL&hs#IllkO+Xc4moU+vG{D-73 zwYJOf$*YgnXX~FYDi$uDdVEmwE#=*PWbnkxlP{)PUmR#AMlBdY;NKB`)l4+4_-k+& zgRuqYg>= z@qX0TbJ%+OU=gzA5fB9uyNp-}uQ^6DTVrVs0erhfF=VSDIH! ztnAO$R~m`7LHw246-VeAo?3{Zy((`zQ3Bz6Itz<{?609ZVzG!?(;r`HL7X;4N}`%I zuMGltw+bQ0$;i^yXu9oJ?;L;6yz{}Z%Cx7pl{?zbdHO~p)s5)PcZd0gnitK>f{g0N9Uer5EExzffUhHLx6|7ee4e3yo;JI^mcR|e-YidE5uWA8<$+uoWBYUoU+XlYLE1BL~hy#lG=(-O6?0%A*Wv2~~ zvGo`Ow5rU}Bb3))0!?L|wx;Q-+{v0Zc(rjC=Y*|wg7Za=4p)$_1 zI^eaWgqNJJd!1%svX*UBygpV^tI6W~|JSsRePj~rg z>*w*6(n6!(8X&v4+^jp(99z#vKUk^V>?$#~v1<=}tu2gmH)>_`s<5H-01V)P)-B;Y zv^-(S?k+pOlx(^(Y`idh8jC50Qc^_KQ+B7YW z4FC(DuS3+zpFT~F{c&O!Ee4M|r1_oCCJGU^NlLj-lxeG(Ur&X(-29=z|CuZZ*xz#b z6WRXOuUNys)a}F`GTSQ@=R=1J{r1Tn)U|(|P57R2yC}Zu{BKkD_q^wapjQf0@z>G1S8JCB=cZr>S zvT-Q!_7x8QvWFLKK%tLfYuFcARM}>CTDo~5R%17#u~m@Y=YPCvG=n4X(AqS`6rt2s zwfaWh-=3W+Wf4oZal z_R-iTVR=M9F&EkJ)+pB^d#$jgZd}hE%v32--iD0P^!0Cr;y`j7UV6IWvI74C8@Wj&7{5t#1)NhC`!eE0H?)HJ{%`CddML9yeA2M~-CbbMI}$unL0U`84oR<3nm!4 zm#M_=o_`?t*lNS1WBSARTjH{}%sO^m^1{DpTysAJL!qO7zCWt?!^LG)?@mf?5dG$= zwmtZ$>vpkUFTPqtB_cvzL{N6!_!JWC0Iin3+sU;v&AL$Pdu}%PH{tmeh7k#eHgwEk zdex9RgQr(tBu2{77fR244+F(qPs(@+{P6DD&>m5nUnWYn9?sD3;wPh;-tB*PeTeZy z#*bw;d3rbhp~j{86@QKD2g|j~;fi8Dp7(o0T^nF$1tE)UOA&!>dcRPI_2ZUG*c&$y zww6=;C#j>Wyoz-Sa@v!3*smWxef-Rl3!yQd)OQ6zBqQa-R;~us4ep%~?^&&x^IaSg z!R=BKN$XKj^P0!ElKMD^OXh2SPj@Tm?K+BcOYEWhpF6dapB_BLy(FSmS@pH1%JJpA z!E?dn&(U!Oz1QZys&rT=Ef1-6DgSQpX@jFfka>DZn87}FawijRC-?b>U{R(STejAX zkOvop0ZeKk7r{Rb4^YL#YLq|taDFA2@i6ln5q@p(8-$56M3Zy+w!6m4Tgcc+Fjd{! zL#Yp+4hy=O@2dT>x729GOHSk*wZLC7S1?=@2J$VboA?ovr7z1c+yN@IUwDTy?mVbV zO6ok9OhHc4?((Kn>4w2XU}yhpUDVf=*R~5AW`5oCEJAGC=l&gk2#{dashqntdp8x5 z2P&F+cgCZJNHOkVRC3l;G=i6_<9w`oRz|uaXtm<(X%LY>U${fMswlQ_(mg->6c^I= z)+7(6p(S)rzp_%pG&|&J2;TLU08U-r?2Q`bJKpvo^T~a6CR)H;m3S>zjCKjwJ?bOV zz*;{{yW;SN2a3DYd$~0RqMIwWbTVJvB|eD9oreqpC2;IecGgPh17IsUF*t~ z7_25)q-5j|j<~!iZHhx}&As{8#+PF2?2}InlrILjWGeVw8t#0za95-cB|lhk1`|vp zFJT;3L5m{4u$bc76Q`k-xVnC$C=uhUG6(MTg&7xvq0x>(3iSC6nY0VGUx?SNwcG}2 zALu*P&s`~cX%?n(P#=I>-s3t~ve8Wpoz7c=eJe?R!M6PZxyA1bjj$5(4XE!O!ncT3 z7;Q+s!dTPrCkJ>CsCLEapNHn^4s*+FPv;t+ZYF*{_4JFKlG7I|_ABHDFId>nl)LeM zb*g*Jwjpp0q9EqefA>2{2J8%lv+s67CX+8&H^0Q6lvN!hrl(PlNV;W7FT^VD(gy(4 z^1P$I>*l@S@H{p`cHEh+a)7I`|ACP&so+(x{!y8ZLk5~J4_RcInop*8J1Vd1+7jYQ(+a&$_s%o>u zs^`}&3W@DJ`QpGs;a)Ewg187vSjl08pZ*Mg1qAz(IDe;!!_8gtCIYP3B`iYDND%7ka@WO>EIQKj0$@50Z)VvprLRm;O1`rSLluL1Ret!%_igPBeyd5(Sq zPuxAhc-xhpHvk+EDe;9uN7J`O{ChTq&)%Rd^h>v7l*z|Y*+K{;#6*)zB^=Clp9lu-nknjc4 zab)7?%FR37(BlF<7yho8Q?|vtysx2@SQl zwcn2+6Q9;xU2#oh)o72ij&eoZJtdlsHdXRE&hRcl|0cSNjqjbJVnTVQ;_X+T67?TC zON&#(4nbrO9SW%4EaATM;1fvdI8Ye*6D9WGURc;__3r}y5A|I--q;-x)&P>q(CB2f zocaC!sV#n1OCF5zRj+6T;Y(v+_`TM=1 zpNB@5ow6{nfgiMMJ-_WjJb4ITc31ZF zLbm)Tpt`?WMD93aCg-#@^LTZG@U(?U1c)eG1zyHVdF#2b{Qc0et45or{(B1wICSXH z%wcCGyq|}uOh$Kz<3CmS?>p|>?oFdY=Ica`?Ei27H$C8WD$)}luu6y{mSm@4?OJLn zOLcxl3hDrOjMNx#d3>kx9k z4d+8}(EgSgJYnf9H8UucWrl4osIM1(Z{2)z5(~3n>{nEYuNOMQpRq88(v!ki&Y&QH z@t!{-Fq#x*G2W#$dW{IY!AB;AOU4UOW%(jL@t!GVLa+(^S;gCK{;&#hgY$dk3{6w< z;|&P9ygKZ(5G+|W@($p0j@@2ps)x<@gJPH6yWBH zuBtwdbtMYyOc5-8t-;b+cKZXTO!Fuul-~@?ES2aogKXwwxxB8!D4|~$X9!R)Ts0gL z)v<^#ok6QE;A5pXdtKdo684y7%Prw2dzg!UjRJ&^SZ3*drTpXul3{W!J%O&I9_R)~ z^txCoBH(hHI0-u2WynG#;d6;#qk<8`mXY2ZJ+Vx{-gEf&$b7AS^Rt-pT5im&WH_PMfT!5~yVGfIPO;)L}3Idc{6 zs6%QQnnz5+JXwRf0K)XkPmJL8IH0h4nbRMoAgZ)dfKZ1PFRFB&lOh$y1WyX@9}!{5 zY)}9cS?AS^0K&m{)0iwwdgud`d$J%HgwNyh42@V0ETG&DO5*Y*isIQ$N)`&G_D zKl028unnZEKlKs2tghIk@QuI8T7TPnw$Yjbwion)pPa5sGE%Cb4Ynnv8Ql;1MaXpY zgD&ee3O^DxHv3)E+Ec|_@t?-TlakXMNd}QgzwJp}6l0CT7_9jFk--D8S4VK-Qb+}fVXHm}?m~s%PXm3#u(kYw0ft65J<~n` zcPT~uhc-NLU z41|Ok@_c*w(&3Jv;~nRh9t~*}Ts3LWGAupXRK4L^aisO>-UYBC0H1Kybgw(5y&^Mw zdKTJW+BXWx(*3&YbNo7x3GbZcTZ8ojdjcnQRJjgl=1}Za5!oOe$&R7by@;5BLQ=w5 zlm;i6U;L_#VIcW!1dVKHE!m`>@)13Us%(~N*U}|!HER=mk75P|<@5EzIQ}M4yrG!q zi^iao=$!H9)iNyr-Ws9=h-wa;6t<(>Xrh4{R}*JWCaabRx+LhqI68bOunT9-wm;)Q z&vP{WjoOp3{&g!FHu4v&EFH*l3;s@$CPkSg=0>*74iYo*@kw&xh_m-&$1a?n+ISfA zYyIUXW_=(u*D1KVR%=9}oT=^Xxo|h&fOIl@>KBFhDqxNrrf)C9%vva`i$^uUucA z$bQlh9}4-BqNeE93m3mJ+NvzBar02SMQliVNy5OXuzun<&EcsI)*#XV$)g=Sjdo5$ zIk_$v%WVA}!3feQ?jK)M=mqMuc1t`sfgd1zSI`VS$+t5#M-V=z#&%0QKNakVaTVtS z+0);^u>sRo24|KmVb^UQB-^RGR*nb2zs!~A>Rmd_fnQ>JEu4nI zT{(yunq6DTSOkvot`R-fn$Rm}sn3F6BM!Z6eTIIzl?rp*C?EkLwOE;j*lRlUBO8bI*9#pN6VR1lbUb)? zSRmP(&rgPjcI40ku6mghFFj^q)cAu)T`cIV?W9*rRDcjr*RYXQ8_`CNQm127gHf4( zcGuG(;3Sg%+LT|aLNV#Lkdl8Wmpj&6r9|2843>&+DoN9^ok=SA)IZpM+X`r!9#_BO zurz38Alvclp>L@Gz_B5OUZpQd9hQ{1fLPM5Tmf`vt438;%cGL_`t1&fnwpEV9$oxZ zR+pq?HnZobv`*t^yIhIhT>WGqhqYv+U8B@nSiB=5)>3D(dobpDlO6>+;8DEYpm^H+ zU09r-XGxCq?RCyTj13|Q>n?0C#(H_x3-@*{UF9l4{rXdR300X5PYj07p8!8IpqJAk zekqCu2MjYPxR&Rtb4pkc=%;x*>3sin`0XU#68C89H4&8%&xq*HA7|AA`B(nQVaDva*pX{etYJCq z+0pQOUgo|@!M}+`0^mlD&_w)YemM8IX}YPECF*MN80?-3OezZ4vHq|oBgCghQ9=S0 zB{xzf*9Quy(WXoVOd9_TD%Nz^dd{4E!0(6b!s$SqQEQs9=;ej9dQ%!a%}iDBfl~+#b$H*370M6Ce}9d3EY1m6 z|L7_-E}*gj}N--GkJJuqQK z$Evx?PXl{4U8w$A_zEs>AB*QA%l0b0eV+97#^zx0IdLZ!Q)~16diSq`QHMecK2LlD z$2pPXPE*GP#z0C0B8k}B-a{T+08|tc*1(nUBg{^8dcNNcEyn)v6;su#`e2ercO+UpWICQgPH% zo_PCjth*&S&)V}E0U1hw=Nb{$LAT7zg+U&1B$1YM1|skI3*-n!N{|6_?1R#&jjZ_- z#4yh@u)GtT-RRG}wp4aRtFT{+vZ=fy9iSNl|?0-Jb}`QoW-|Owz0zb(jPS22laj4aUfC4nVy_)WM4s z9*}wf4@i~63k;2%scbqZcR|@IuX6HM)ZuUXWZ>e-tu+JHQhT8Z`r}~AuRs;)ojf0H zsXdWXht!EuF6aMp(H(bilgbHtI4^Ou2yGbZi`ruQcYI}CWyF!lX8!DOgBAu?M2S^I zSIn0`Ro@}?M7KSHZ0~jCfq#Jo06dPUZRn+A+oc1N{VzU}stZ2mI95`-;e^#Up&5$> zdo+_wHI+!^fis)|Q2Lga)zwQs*nC8z;bfTnT}6!Q_S5mVOd?>?9EA*W0muj6Ql~jx z7U~q`=w<>l2{ciWzf0h|xvxe=V#^uKdjDeHCB=M76V;hk!#4RjQ*jg~-Hj0Y)K+p8 z>)O5C<{kqXh%yjB@#75U&q4%yp7=&+YF)ZNBu=NuDo-zC+9igFqa!DGn}`Q`N1LT5 z_o04J2$gB`1Pp8jowUML1;!G_<|d;YkT4@zkvfC@d&;o6w<%{p*jJlO^C>KLz8=OM zcs2NSW>TOWNKNtpv~Q7pT)nIB%L@(LT{ccmE5{wr7bE=h4cB9SPIl*B zw8YuFXTHjqn20D>^7S?GNlUoD|>A&M@ z^3UM!p;r@XqHjC-z1g4`k$cr|>0B?LC@xrZZvcsRLtU%h#R<=Yx(LSS@>7d!P_*@D z+4E1|dw>qDsCp_^q`4vu$;b%!l|>UfjQtt@NB<1Mu^AS_YE63_5dqF0BL!Lw+AZa< zQOR*@g(>rCd(FkwipKIMR?d*+Vka6+qnBMMk{wRCRSl1!_uP@mCCWBw@ZKDWre4aA zo|G$`ygdJMMmkQyKRx3YnD90)B1TJK&;?@i#7LzE+cf5n5A!yEy&*bql;>jR&?#`c6X~uJtIDmlku5ZfnlTx- zFXXh|9vYHu#X}f)?YKLI%#WfeMoq!pb>%U&ARuY?4%TiN`**L4V{AxZGHdXiSjUX@ zA&CPQb5JF>B&Si3Lq)kUTW$!@BN4-my``GwcMI}^h5cFW=PGy-Omu?GiF6sSbyD8Q zb?zB_6N}iqY3tu8*tGp7xo%4I3;)^!8<|$)8icpZ{Bvglh3N@GIM2YuA&~5(?@+`nu0*AJL-{89TaMkn${)9DvO?M5Bx z*9t!{1C8{pA9f{uUrJQWK@lzQE+HwB853=4+khE-J9l+IxG4v~E z7Bf#zmzePvpL=CWiM4T2#)GuTZ}`tkB!<%w6pgnWL#F0#1askYx{EW2S(Q=j6x}&f zO*q$?*e}f=l-5Ln>{qUF*2&Zv@U)jby5%Z?WlBYrQa(Z<&sd5}=S{tZ8vV>XVdFGt z#P|4!9QP)BHZ^5$fynC9CgVn%*6$NVM*a%}80Sf$ zS}Yeymz)&IK>!sa(Btv%X(!yhdr!DJ{zY}HZ-0o}7@mqb-IeStV?5PXbl%!5@=o=% zA}EBaRNe7cOZbuMuUK-z-Nf>{&yGK7_RX69yN?~x-pOkPM>f6rZF;-&)7L$sutyA^ zp3)ntr+jXD4|OAtYK%A+g&|xL=Xk3}8O9mj!_0C=<--A8q2xKcgRf9(A@Q@u=COCg zoo|bGgPP<79ny`lZt@p^53?l0+CBjlD~i_i?3m*B3CX@ipAw|%=npa5cRi8%L;aI^ ziX`ik#E|mt`-J1tlSb+zy+}h2)LS-~A_{Ks=^2=*mC1(kKHp-1Ti~xia=3{K*bnlt zP@>S*l=DGDrX^_N^;Rv8Af_Y3t!ZC|-mbm3q5-~>$DB!%jK&7fJmQV7>^s=IcjAAX zy>JM3o+Vg*mzGPk_NVogApA3*D!zi*Sg;+;m=4p`yx!{im_sf4q|Chj%Y^7QY;~M) zk{#7U?nT`v8-c7-u$eW-+7eG6U4)jiG&!J~Lg}Be(UYGdCzwkUGikrv#RN- z2@U&%Cfh{j#|WiZGygFEzeYc75@vesHv!P*STus?Pgr~#+iX-&IZe3xEauM_E1vAi zo}I^S+h6BcX`k&ogGW4Ys%iA?<*h9s0tY@G== ziC!lBCHAgKuHJW{42zAaFFvYY1X2{!!~jmMxVFqTC2lFc_;+4&aD0Y-+oH9e*wPM- zpw}+aKUh=(9&Q8*(LUx80Pwmf4wS#V@hIS1;SgB8KOEYGx!8n4gB%jloACI{CP^E~;(g3Zwi^qC4FG**tZtwTzmnx}`F zdd)QW*-~QCLbb4T#ux%vDR8p&EQdHvC_33eKWrfl}PYpWb9i9buE zbE!lDbzpdLLhaR#19W?IC|3~*rT7D}(;0xpW%-&=XAYNqhfE2@H!^d(xx>hVaF~FD zgX*{W-)4>(;TaBcdHiL62h-K8=b_F5uSlWm^|QD=5bU2AidG)2qEa-}VGxlp;ChAU zpnZjLS0`aKsN}z7!6rDwe+vZU#wI}sTsH+F$bsvu7){*^pb~9goITZ=_t!ijKQGcJ zfS_zw%7d}6f{By1dumysv=1d;%odbi1O%s?3Fj=%On-T&Tyle)Oss#)_FXf!jpNG{qu^Tn+7L57wesX z3vf+0va{=Z$gVZ79F_j2{zV5@ubwzwF-k2rd%V$T#j{-{$Pc7gpWZ^4wF`JwoA(AT z=>yzbb`iZp>)!Wx33Hf$41?2SSrh*HxrR{|@r>s?B(+Q1I@>Ub=`X$ooHux`5 zz0QQN*~81NCbqet$1fK&L&27ewCdQRkqftWq#|)GHc@qSo+X%(O`N*&-Lm(D^kd!Y zQqj4+f58N?D1R(`ZsQw`VtNY{%zaefd}>rA4!MRT9x6d8uBlBZ;2NP!iJ>i+oNp3K zK$ShS!?Ob{M!r#zqi3b5-eD|ryBR0N>?2nLtD)qKZVR1Qxrn{8IEMn7F+bWyIl;#W zbVokVWSjvJr6I~gcTF}LQw6&rAl4LgdU-m4*w#HTOy;IMykiiT5sYp$R^b*eQKob( zLpV$Rz$iu(oi>#=J+9Lb>Hwq~3TKuDOe-{%fY$se-(cwb=t3ZAork#4PL`WPgsfFS zr+NDG=xOa5HnwXQmm-JMXg!+p)EaFPK&X=X z9~$G)zjcS%6ol$sS5y!k#D)fSM%=mCOW>68OL~-9%Lolis{S}izf1Yk`VPs3Q|%pp z9F3Sc@I;kp?#qV*K9z9K`o_cz*-Wfd;?*-&fzVdk0Ge&Ao@FqQVeEHU;UE@1lDaI2 zN&QD(Ci+z>w7N}ry1&OO4662WfQU=oOGhe#ZtrB|fJ^6%Gqp|JTh(ESo@0qaep+)m ziLKf)6aDpj^ag7#7RX**-%=uB?F5u6<>e1a1iE!^asC?bOW33L+ClMJ(ox`?SgV6# zy8odgAJ(F$s^^>a7S7eKrI)Zmr<#U>W?BtMp@is4maMF-kvBT62%46`7`agUacP=# zzD+ymEO6cM`O~LQZx#0$efb1iAI?DE3RfubXdFg*k_k6b5tr z0e>9x2C;2aHlFbqk$*hz!h}wj(ErAlEDSo2^?~OG_Q?`Cd89)`XpPW7L_>;y|cZb00`fOKfOVrmM(Qqhee(}t_@VMSv;_Ts=DTc1c=wvefo()0O-Kl$j9QY%5sg7Vj1 z{IU11@M-=SzBwY1y2=3blfTub?Lc%{D;c?N2>LyV<6_CKFo^3N_b5!_M{9 z2GK8>ytzyY*#9W+^!;8}O7`~`(xJ1S(?%JLT-9OgXC?CyUxhE;LXSB?IPl!}t)|2j z$AR!IX3-(v3d!}nf3hrsc4x&n`5Hb5L})lioi52alRJIZH1YiC;&jmHsHLv#>dfQm z{)g72%np;`dt&Mtv=<0PBR25iopWEpjWr@ZX7qkV#6ZNMpPz_@h~dU(hoxW4T{tHN zr_ZXmWW{P-{(j;0{dRI7`Oc(`cvP-gXCN+ zg=)jdBin_mO2RMzSY4Xr|Fh{UShvM1iUlsO=(#&wA58H5ekJSS?2_Hp(`pXn&%GB6 zOp+=1>OKWRxMFFE_MO~eez|FMC5cKY3opFjvp=~gxX8gv?`%UI^$02y;?#%>GeNG= z=b-_b1qtx#9cjzW>-0)5))ZQlM29kfu$C{gKg2E{QAig5Twfg?n|o@|4lYn|pK+3` zq{1Vo1HBkoK9Bbn%-6nTG4h1GFYs(q2`C>>HUec&>rY@{nBgea(QpOp?I~y(_KX9R zk7}UYN|-t{Y*Y)WW#>?QgPUuOBTRdpJ92J$C!hJeRD7P(Toh~laGo}@RKB(Tn?L3u+D^c{%i~GQGZQpV@HrbxO*60HR|M#osBdILZ|Oe5 z0LR~GRFHO+G`u+ z<@RjC>IP+Gx7v9BV1VNz@tqrTRX;a{@T?X<3%_bwHK@M0-N~0TKrQ=FTR62a5PoBR zzAlhDeU&3u(G0KbtL~{Cwv3yw<|!wBR!08X)O6Xs{m!8{@KFuDBZE8T_qIH8w*BQp zekS3m_uxRZ)}E&G6fg1W^Y0LWeDmi(lApTN%G?FjA9YlN#xOgasO|BXF1ECvbFC#0ju}SCzEu78| zuBGo!`0@sjt9H%z-d^rp;+e9QMY+XsacSd0Vg`?vXZ%nZe)r7;_pYR zF&?Rz^Q)@mj_sFhR@KVsEhlD9W8ftoH41;-&o_x!_;#6QPg=|^)u4*}2dz2o*~Zmd z-l#6P`#1fDGbq^;7&B@wu$1G8C7s=L0A3CvU?+FKf#JZ z@h7IOd}@3}TTh||6y7gnLpMTCN znK#Iv)WNce*(dE_T#lkqcF=7Z$DsH9uQPTs{Co=3K0MS1t#jO+0;a**)titRt*DU89~C?9b+#zzWSzZp_I&bKi*%)2h+BWP{h%%4+3$1@loCa% zD$9{$F}GdnOBhX}m+Chb__uN37(FPbvn6%;1*Yl&#k28#Xsl~31AQYG)NItZijz;= z;lJA7%08HBB8g?0o?*3k^Afv zEvo0^YKmeV<6Pv{f%)&?x%APCB=tG8ZT1p(HeNc~R5`0z%0badHmw>`8(6saY6z+K zSPwjH=>ykVQgX!={BcjSjc1iZvr4XWrXY7Bq7tu2jIQ{$Ay?)x)<2zLlF|i#B~hc4D_3$1ki{$BC97pMrGIOQ zoaZ{z=*s2VGKm&mS_+nu%&VUOi2MZgm{}odE zC(Yz{h~*#35iW%aJCt|0War=n43knt-~CCAd_LH>aj7u+I0>mNHU8r;%8W!(?n&+0 zA5wQC>vj0bRI~OLW!tsw6Lm9?xaC+4NM*#!^?|A0z-#F%W!VQPFTPiu>g8AooL4;Q zn9?AcYcrRu9r^91`b_p4=F%>F{^@HUH&fB>hYmW_OP@NN*ap|zc=3R^uhOWlB?y^e<`uXuE#(Y0E!`ER_Nj=%M%kT9f1RSv7o9b_i% z9w_h9^yu2*BMh&H3`dg-w=$XZQ*MV~Y21JrCwy7K9=AsHJ;$jC*aJTUek1?QOQ?B4W5 z{$KY4mt)FPikL27)@~lVgjbVm1M>JA3j8{Ve^MWiRU(biwOwW)ZY5h^xRpNcEj6U!Ud|4w)hyUIc{(Q{EG z@YUnbBv>Rb>cj+lf3P?HUT&hk&476qv@@c5x>>j)v&A1$Lw*kO_P)Sp=z27GfSUYDv9Aj8W<~t8{i`>DOdUWP#i3S!`UjD zsaa9mHbQ%MDOUtR%ml8S*4PO_+_L=hj`vj|!rl>#*}pZ+eGU{F47sCb&(;d@Lk-fT;ah#Kfa(tdTELz-=b$(nPcH9T**BDoDk%2#Q1bGk+m0*s3bLKFrDwfkCSCKMQ?^(K zAa8b*o(%q|RsLjGv{_l9#2qyqS_$tKdKj4h(f{_PZKRTzF*bl)xrb#{v0_ouNoUe7 z`3BgPQ3{;QqyGQyXaO=mce#z#mxjz1dT&Z}}zXlSIF zcRQ*;1gzX~{rpI^?l$3C>~bb4;^WSHlF_tiSXs)_LSCN9F8m&gW`pVhJRrc+yE*f(U+0han_^GuczY zst*19MD~AkRR01J@h>Vd>Ep}^Du!)(M5TI|f9+{ZATe15hV|9H6mmv27yXF=e*8G^ z%dEo@Z%*&_`LtDicQO1Cri0?(13?)Iur3U9QjGi*-7qo2m5Ug36|vTBQyzOS^o zzfki+Ilp6v=u}IRQay<${By7AytburbX|K)!}k;!ikPQeq9{}EY;cxeO}yc2KX`bM zpa1sTX`LG$rLD_H;_jTA7;8>{?71@6fcxg8I#G1r3{1ak7Zi;$-Lu=R(+hiUTvM>2 ztdwAr*n3VN=+ymJ&1uAx?)JJZ@BxnN@DZ`jN8lsd7d?)yo%WO)54iuqc%Bn!69`E^ za=kOq+>|&0_Dqp<0utf53V55NyRFaL^#NnZ9tLG45_d?MS1&%EDd_x32}gfyX|CwX zIO8#W%U^1@!;u}Qv^-lzNrBl-O7ytxW1zcuLgN{%7szGb_-Rdz7iU6fEBRxJ-x8?lnL)hSJhPOFVc&?7{zP&dR%Jk2%gY{v@L3&ygltMUL~d?s^nBLpySXPU<6p zTQ($|ovLj(MwD2&sw!3+XeCn;gjsw?w{wGGR|LykRca3uFx?(e+mcS}HIwnI4qrC) z$gcBunsF2~9%08(8u88kRDx)g53^O(b4&nPT;gU93Hl;F{Id}7pTbz-H=4{^)d;XM zf-#i{i%)lsi>`#4M|;LecquzhR`!%d`x>OHvfC}58@VQhZW5$Mb-VkQECuQ;i2t4=z~FZ)ew z%SKLf65E1fSoKzQd>U=|z0$QdTVB1nLfd)uOxv2hp|W~(bIC|_v}>Bi_`z!y=V-C9 zx~^5(bYtwYHECk^kJ2FG585YquFM}#j9rkAqW#4U@E2_nS^Q%)F-at_nv&EMy(N*N zefX?;Y;fQ)B%pf_hWO)CNH4`5O>*z>=5>012u#CX2S=Y-+!&O77rDBj=UpE2BuA9q zpSk2O9$Xn!Ic83dvSR+tRAs+qXyF&pk;Xft45w3Y0@raqnLi7^@zvLDGOf3pT(Jcb zceP*uyJSk@aO?U^CczNdb3`9JDMpg3$UEkZ|H7aSihWCShP!H&qyjU>5lm(s`D5_d zr{2L@4Xc19NI3SxDrbStM`>dFpx5H=-(#*ttwyatWd&#ocM=VSoB)N7A!upyG%U$M zh>m0;5L{%;hW`r14`?3Zo#}`PRCE91I!ccQVtuP@OIYHD$A@u)gDFHO2u7Uh9m4tJ z-)<>>tc0E9uX_nsE46W5aJm)gmP zmtSd26n3;VsU*IL4lY>_F8)hj*6YY$UoPGb6yK+S*itEbe*Mu~sk)r@LSu1-WUi-& zyVoMUmFVgwe|J)6loLBZ-!2}>nf$~+FB{M1WZ6PJw-=_UJnP+|H@J3-Q_(x(t?mq% z>rGQPXQ~ksOf1bW9cfD};3kq|<5crJym~|*7W75*vj-v30w@m1gF4e%GjJJ2k>>1K zWI6Y6tiI_h8Mn2i>iL}+`4c2_=8>2L$6U#6m+wi}E?4y;MvtT3>@vp|c1&LUgb)1* zeKtl6G4O)Q6a{l)MtwJDUe7V7NP=6%Ffa6SjzgS!c;J6n z^&bgxN|dc7N_~7KitDYAOe?3|6_jFsUF^J$Yz@8>KVZ3X>Pn;a0adKW&h;(Lw{ODz zefgKu>8@L!0k!UCy+Siqb;+~_he_ZwYn%4T#*#>T$xpZ8XUUx59 z8+|deXxBNpZ@ts@U*8y1*8=Gq>;hJfz`N;v@y1N;cWoP166L*Sb z9QaWS$lEGzu!pOh>%3e;B9W~7t=SR1g{wN9y1%yTO9Ff!R&9BeURpyN8lU6W1kj{ZFI_dFGtQ`^gT-=EXspXUfmkloD7MW+{TEC z$^-tE?DAHgiED09SL4d@1%L5ck|s@1HP{CY%>Bj*Npy85e|>b2}8 z3C~v0v6XBi`?EvYLzS!xcJy9fQ1deU%2QY|6M|j6AdM^2doY;5ITZ*-OwK! z7Et5YU123$nSzc(RDFx2XBT$!Qq!Q-;@FM>eP$eA!D9S1;qMu6FOgOGa;dGjbqeVu zvB5gJob@QQX)0MZd>xcZ2-*;=dB!{{2$jS&Qcc$V132FZ0t#z+rDqZb_G*EdB=Agm zARI*NKlFyA@b+d(mniG;UzmZ-H^5Ag(G`3`8(BL=9?G_=Z0$k{sp@o9r9%Zir18e= z)Io;@caui{>H`zgZM$95^PsGWROeguXDk(wO-%tinIHbn*!S|liYVeP%Cx$1s~%K* z7uj;!_^y`o@ssh+O{jO&k6x_%R^Jt$sbVyvQ7aGbcl-64_z$L34?F;g;30NDqjo~C z%m&`9uhzY^C!ccIrq3)&SzceK-aT`h;piL9MUjtpjXsyYv+f?UtS^f9dv$+K8<>>@}{ zC>k+9Aqx!G{V`z1LeC)N2xO&^1$N0yM^2mHr;Xr0uS{c3v>BnUK@sF;>WSiD^EqSSf$PBE&KN;2><8?Gge%Hu$*{C}k zX;O`*)M8JE&Zc%lU|MS~j?Ei+N}+Q_J>h#RB00<2)Jehm3Rr+ldGyaP%InvcpGR#- zn<=KW>*ZP2br3_gWx|(bI)JdQjYTF!FTXplDabfeQ0Z#_#m?dE`qt93%bx#b!IO)- z9aOxwl6l4Wxv~sv+{>@p>oaM;pSt%>e4$0~XG8A-jzz8Rr~6!?3lWcboGmW2NA+{? ztmb&?E%_PsJ@JLd`cZ%v;LN*qL|9q9@h5rby3y^IhN?Y(dHMFmNMn(n|GH=ro7u!~ zu~ObNqgEc&FR;HTurD#bRXV<KdopLM&UNj|TU^%w~JvTnaTC&YosyWx*YOJVTe zn*u}0Fg)iueYXK6%JwA6K)#H$*_N>)S@@PknUWfxo`UVu{_gEow&E)|#KF8rRt4p_ z!Klit0P$y|GMiNZ;GVW94V3uMa}0@;JAAvMEUvQBT_FD+;oa`$Y?gnXqb`EgPO5SB z2*Y*t4U~*{WQD4?+#__59ye&Cd5&U9^XvP&&HL-)%NKOPpGA$m*73(ofbrHU@Mn8) zz44Wl?RMVUnbqCj2i-9wHa~=KD(z421Hy_nurk|&HdinB_^rXj-pHdKYElSx!gsX3 zI;Cp??5XU_iEVM>>|95}i92mmVTP`T>z6Lb`*Bx>@$6xatW-V0{1lh2dcWRb)BT2l z1Y)AP1oW-};(|k6L&lxgpkdV(qs|^)?y_`Pqz3Q_^Hb%ss(EK2qeAfzR5p$Tn?*!Y zy0#J5@`lWkBcY=vs7R@sln_@n-JSQkJKFmj68lr(%k=#%=Wy?@lL5a^G~b2qmhZ3b z$I#XU!gi)4_7_0UhVf=yNXPUoCmO0$s8XACh8IQOYrhcxXQ5*j>nay}L9uPB3y4Kc zxoGT#trjL>XPK z5r5`^4yNmm{#swJ@^hzeNTK}1z-AIfM#KXW@+C*YCTy)jVh7|A2MN(1zo@ zw@jeaHcTr(B*>|KTOVKQaex2rC`(z#j+CX1L0NJ-<)pXE7PiV3f*(1C{qpbZ-iS|O znr1O$uRg|xv;B8V>721fN|IzuT-LQmw<^YQ0WoeNzzQ2EH_F+TU1Y$mNE*`nxWg1j znvv<5BPT*KvPVbSm`mp|odF|}tPC9+jLLKd+^uXL_w8tluLL&n+5A=hU?bC2Kzd7# zmG~_9j27F_Cb7=WHyo#|eRzJl=(~B5`!+oFE=wjtL@BR+i7%XqVq`9dFH>bSTOI@- zu`qwJW8RgsQ2fRI9-o=vC@0DM9<#~n!RY0`Ql4kRYCWS*LC2c>J zOnrgpHgBdkLl%-_S)q)}Z6^Z%uq>k^XxG&jMX?@Ri^<5s&JZYMK+GTSwrr(oBc`+o z`bdGVc*T?5J>FhI^9qQ5=8lfDuf{|KD=MW3NIOtc3+7U4gwkQca~3rn@CIlO391pUqZ2Ll_{-;uIb8!~vA8vk3fwiyW zxu?R*QYWE0C+ecjqJj&aXtV_XH|g8(+coxL*Z7eYDABE|x$^1zK=I~GhxG&xzh`rw z{E`fJF0f0|#0p+bF{6tvx^>OLbs78OzU9zu1?7h4%I|o8zkN#bTOf%TTV@N0{)l93$PjUA6tndA4yKQU zvQ9*2d>hvOcl&Mn2?#wvOaKh^71)59L@aDh$*Ez;^Eq+zmoeFBQ$xS6+*pm7 z9ifiPhg2tmE^7R83LD6?f7Y{&ygJ-UL z>UIq#HvMSW_gwJjmy>?5R^=I@1q~Hc_UZhE^h^8Rap$y$+h4(ErNmU%m+HqxIwOVr zQ{YUhXgcjs;ZoU*{zy0di(57?g=%(mxh`&VbU7igL;RB6|_uI;cHPs4&Z|G2iXRJCoKna(xy+072;J%m`TCWKMz%aqQ;6jegUx~)Sh z{l}Z!0XR*Cg_x44uMV8l!Gqs}Jy+JGo?%|18?=}Sk1NvS^Br? zWSuad#l%)wMPW-{kz1cj>U3J*BUjbQ?n2S$SFF&6(GF6OA=ue)0-LociCq zhXQuzimr0q8%}RUtp$!c*IZAAK*rg!av9?4WmfNNK7_UL5%iJ!m-_gwqxH-2l$ z4mE81D6vw%40SSJWEvK9`^2?4;W^#eqmEaRq`+K`xf@-+j$c@e_0?>MzL+z%R{2{$=Z;+kQ{KFvl`bcPd|2A= zZHQ!|Dw2Mh`Pr~gZ*NAUnY^8&yOqPbKF{#TvgYKk0c$rOQvmfkQUZFLLD_Xi)N`6M zQ44?Oi~l%_x2* z^(0o04QpZlidxlCWg-eMFs!1@3Qj%1l`SP55tSffmLxJX9W;3y- z^t;_om7YN7?P0n-vPwas3t_Fl745u}?NVKfa@Iui@KTuhH~LbPQ^<66-)zg{|IF!i z++&SYf|9c-6Rfvmd`(F+Ag7Z9v24fL%+l z{&b~VZFZyPk1Z75yupCU!M6cRgKOY% z7?mxrXSP<^2EF3b;S&>)5`Gs&w1U4BzB4*CqjY?YBUMSYVQ0@CYeGpbxKz=X-(8Vg zOTyX3*>{LGULWChVuQ_623X3{Ohqrci!JquL_nZZ*t+-?U7WhKlvy7rk8gViA4 zQ%3SMOI~8YLtfu(uf~ys`k<7k1?2UCmrVgvw^l;O*F)#d0qZxIhShc`E!K15O@PRj zDwO0>S?q|UxduaP{(0_0?7yhz*11d>_7~RkzC<@Pc1}S_sn#BNf;3h*cGfN%lwL{O z)udZffD^kwlgqC$>Gt%Nl%lY(HGh6YyZVn^Ltc_lRHph=`?Zy1hH3j!nhv0Zp+i-! zOMm={hAhB3;!EDYS$!);D*n#Fp^BX%58CTotaMvI%+__@S|xf^)YT0UK>!CUsGh9c zuAe=_E&48Ot}jm-HEgn(MSGL|f17tVvCq+P4a9Lm)0K{G-WXswr-wieL=ka%EEy5a zSE^D#=(_HfDD2dC-Sk$F3xPg%`w|F?D#~^noNnU2FFqN|X%JUA9HMm5{oymC3HP0~ z%z)GU{zZoliA836qWmTs5usn+B{B%b(5$g8EZGxLk!W$0jto4_NNZf;W%|s_i-CAj z8uf;y+xOaV-e-qLR4>==uZ^E#N6hcN6$rb$vsJzy{A!)gXgw_G zeYDBXvi{jEPbkmFH)6;CJH8}7eg$csW-I59VKVb+ubLJklyX&TQ>AG$SozDcG?QC& z&InmW9G9&v{+BWhC>1o!dlfgcuItklrGvlQ&6ffSZtS+L!`;VEMfhYH6DjC zQ;zCLl1pt0M{jdT-b&oE?J6pR65`8O`pT`}sc_ZardX2cL>wR zbW4&}@1Vr|L)i}fp;}))>IDya{fY$d$~qWd?_$VOwDVcV zz1jVpEJ#;zlJnlQ^C^%w>8cg_5R7jl6!XY>K2b&mcjCv`Gq%lJ))65-IT>a~S0DcU z>o&-|^FAh;GsdWkGr$Vjbgs>ODzYT9p6SP*;|9HpiCQ-`Dm?MDL8~w3_Xg5vgCA65 zsk)>pAYc?TyBntd>w}QLObPrhx*+pju}9Ly-?+2t%$xzacrGK+<5F{FM0t z2@<-N`W|Byivhbq`2l`@TJ#-Jv!4q41R9gEuFFm%7yo_>gbt62`s+akU~0(iASijy zWn;DNs{Kdnt;JWE%9t+;yN%5R`Jt1Lzw$1x(dPEQWbIjQP{P+2^0`@?sacR?aJ|#t zJ~;kZQz!pk?IS&Umy3OqP58iyei%#tool?d&AeYslBUA=75T<+#o(SEooyff!}G5? zu@rZ!AEzxR20Hn|*=OO~{`*{6I0eE$ntJ)k_%e?KrN>0axUd>Y&uMFJTm|yq6YnF_ z!6$4_xh2ds=q^Y|6uxeOcza3W#PVZN_%mq@ybG)VCq)VB?7S&`xXvwsQR&{!gyp#@ z(XX0i6;GCFiY#l(daqhXAxjtsr4hp11ZMV2(=2qTpr33XM&-JmZkRbpSOhvxC@dvp zgW?{!%yO-mLB53t+7U-VTQ>IUlm zY;_XSiR>h>+1p0VUyP)ji_4qo!OnjDfw4ydUggZ6UpQ3nv|jKCnlCy&tjPDZzaSNqC&;mv(0Y71B2LhPB$u08 z1LV$hk)T}ak6p11aKEKtlOsi3pF=E#VKJHJFNi+tReHtCsTt`phjM`kHs8!ViG4dG zS$lKv`>O8yp*j*`2=OdDTfMm7JcT>)0AJ(_%P|IIoU+ zO*xxh)MdD4qNt7$Nvh*^6E*Yx^jFhVw>k}ao~0%E2y@0)w8wFRqx)OH?B&Xp8hyVf*Ssv3=cKoO0e#N`!ESOJ*juY@)+Y8>F9h{q`mQ7uZ_Q`W zJ~ho(3FE^9bmwEhSTE(6QXYc)hJ-yQ_v1|TBGt#yuS`)Mg zbL%|^kL)lvt(^mITq97Pw&->l*PZUO4Dv004yZ|vi?8Bu5%k95ebMpUKV}3kzE03b_vtb+jkQ>54^sv{J-wTO!=)&5c&%1{k^F?nnagEsz4{E-y`qaeM z<7R8vrZ13Zj$-hGn_rHhcg;IhKimqujRY0b~E;{^7GV?og9OwR|wk#{3m=_H3J7vFeE zI0@$A*BVHK)G8?H`F%!q_ZdPIq$ne$9kGq>V#h5vik)aoJpEPi5o3!KcD*Fs9a?si z7G{TMhYtPc(DcMqf%h*Zfx5f>y5fUT^OuhgIN-ju$~SRKPzL?O4lea0mp(cZjm@Q- zT?CIv zY)^?fR+8xh_=MjvZzD@mk-}gs$UEHzcx$111`NNB^sz7b`Len#PEpY#AJ9>6FQS*` z??iK;vMoM+x2&KV0S4l9klfNh=~!)Xf2K4f2%{usYn1_zEHeGv zrKflV|k>F+9NBXeT!`manyVoZS}gqwAQ^?RvqIg7+;iY+nL{pS5h&IoQVP?h+{19KZ!=B<3oplQWWQWk!h6hb)M za3@ok0=u19{u_ZtK#b29uS6AY1m=BZ=#ab77{^%J>}?HP3^ z8!k`?MVE%{Zmm{jjozxZccToFx21G z`;!Kt97f4M!#z!ok6&&Rvn_K>?)Sn~><-fT8}K=J1GOjo*4W#e<& zI_t3IY&N#>(YdplkfF-HQJ1<77nmW6j3rFOFQ1K?b<#q+8?Cp-T|=)lvNKK$h+W>i zll=YH)`wzG``!Y|ZaSpKP@)PY@Se6bw!}d}xZ6XVpjOYQSSxb0Z9%P1$0)AFlP+&9 zj$=NC_~pE-)eiie;Mk^d^we2TmW8ZrUq9;`$Y3R=(4-=#2{N8D$OT_rqoZ+$Ili}s zZu$LVu}$wOxs;^FBca}_|JOaUTrq6MBWz{^n7gG!1&5m3y*i9~BpZR(RrIiBTa+ku zSiej(RmJ9ycW0*gh*fYU4Em_8UV3@1MajVoWN{e5uD|UbSE?4=D7b)Wo zg$nd9C~nG+@q>s9S+$l>g7fpYyqKpy*XF9)QGt<&6r5kV#OS(QSi~yk-|?YHzojbW z?#xqhokyWoa{VV;Wg-nqGO)h zKnEuo`G*f`VQloK=shUE1nPq6wg^?js3BzO~WjM+6mrt)N>(N=vY=Wr!Q^ZhU6 zXM{hRPrXcSSDdmH7XbCulJMXw?(clHzj?N!iaG$ ziLLF8D)-SijERf2g65c4j9oKY`zZ@nX<6M4SexFoh%He4fT~a#eW1<;5MxQ$V1?;= zcK0UmD3qc5gpLhVN3uemDNTm|{0G;YddZvQ6L5fJQ#o zw;1jreGnbwyp^o}AZK2+BO6Bi43Pi46{Uv7>-K=#Y{rA~HTAUJpOZMHBgWK| zNy#I>`?F2?@9pbVB7p5V>~UDJc&)D8Q`)Xtzn)XAEU%y-#h8Bk^k_7iHk*l26z#oj z^B4q?3%7ITrTb^0SY&W$SnJuc1;pn%qn6jim#C zJ?9I~VJPveLGav~GepN5u*P6D$Z)L>1KVdb@qfF0{H(DlVH#!9>Xu+Y4qKXRVV$&G zZohQgM?f4}CC^@~Gez8jFwC-aV3Vb`xvsN4S^hZ<6_@6Ox)Gk5Vkf1FQ4l7vq_XBu zjq(?gB{d1nMWH>y948)h5+cZdJG|@Io0Li?iTODs`KhA7*`!Vu=PVi=$*h~yX%lACVmR^VTT%LgQ# zo7t+9y}j&}IF_u=RS^@C=QsdEYe98%f+o*c{D5QRzo!l9UnIvml$uLSL|as`%!sD- zP8&%{J(NWGRqiB!1c-n;SZlp{{P=O0Q{?4ews9lo{6eGB6XB!~(xrDfeT{WEdi~l+ zYWzvNZVWtlmiMwQxm@qjL7>?B0wu0%RKzP~a5F|AY6G0^#V`G41$Vg!aQk_6y-(x> ziL_C>nyx=!Y#{vm4`g^CD2zv*4GCF$2rLT^BtvPvX;5axN@+JrM03gj*aeQ^uv25O zb+mgsEv?Z~CiAKRe;NlDJK7Clu0zl=ec-H2IoqU6U3Chc%QKafjL>r70aTAvRdul^ zS-C#-EJ$Uka`2ebUZ*5a;l0RbkNEUr;~lSh>6SmW ztCS-ST9AwwW!;ZBR|{0lC(1(l*Txz#4g=9@?1co%tc2`byjPMnsic5O(f+yJ}!35Y2$OQZ|f8#2eoMbxYKjdXd=9%QOMY zb6~7Y&!~0zqsAa=4Q+5u%IJ4X8`vB}c1P^Uve)d3bS}6Z7{rm5D)sk$;w$3sl)vkj zI9_%-RcMje#j9duZsoWlC>P-raSVX>*;g0fzQ+~;x1Ge{Hb6T-e!$)sNld8EX!?-*99^IZdHNF&w{!es( z>T%20AUOB}&6vMfK)ZDq!_g{!KN9`+oaSI@$-ro+DquSNYW&ADYmmmoRd0IPD)eoj z&p+|(p+O09Y&>mEa4Z1$lc@g8Qpah6nPiv2^IVt*`IhZ0M$#>{sP*QA@IEq7Pos}u)0X{o^gt#gYgOML}x z3g6$e2}or@!@RtTPBOlAj#>wVNT4|*Q@Kl+n=V)YL`!W7bzfMTvwxrxr zz6BPXv^1Sbe&lf)9)ugEpux&oZZ=@n;Cy;@5=pSOKU98*LbNDG=AC#;RRyPy&?LpE z7v4V*os~WOxYRQoh_x8?Rn^wpvgl=}8hff8|CQbQ?&ENYp+}2T`>`+9ieub{S{H!< z`F@V#*lpr%@FJsleJ?wYt@8lj$?LKJxDJANr$oxGQg`vqcMxKWhpiU+f?TfyyGk|_ z=h)V^ZJ4|bsAzLX>8_N4O{mTRe{?XJ5`j`ypt%#^XA`EXBhTh&Q}+R038|C-R5YTu zDRlc?s*1<3NxHfeoZ|K;>4AW0jc2RoUJ5JTg5>RR4E;Xlcd)Q*`e;wu7mh=Qb=NB5 zgCcekgtk3H)*52bCSZ^!CvTXm3w(GW^0e|=|8pVq5_~Ox=NE>&S->*OK;lqiKwCew z=j=dz#a)BsK^KU)PRP}P1wio3HB2hrJlrJDjApL$S)5X}VkA%|_?9_fHkaY)H||V= zC*T#j$mn#1wIKg>=WjF)tL%Bf&sHMYgBSO4y~d}$w_}BiC_3I2;fzvhnLzD`UFEYW zNiWUXD~6Abk{#L&6C1sSd(y8f8%Y$vUS7_7C}KCmSecpoY~z@_Z{H472F>LW0)5k6wSX%=*dZo$-v3Hu?mCkIQ5#1H zF@1LB*yfpdh_Rbo@tQH#MD|2(j1Q;+Oyg_N_`0Ft8nwgdsDaERPQH&4eY;xAm6kRt zKdfL%ky8IoQsk87Aou1>k*=~9%@FB)YwEgp8TMtcS@xMd{wnY}JNym25-sU(!yBva zmCd8X6}>Nt^N8zmau0F0HEI-n88uK=H<$0Tu3|W??!+#16ew$O>pHhpc|CeNk8|qP zC%Y>dEEmJ243}%TA@hYvtSRlJb=>Z!-im)6{lmMpp8r(9XQS@9n#&I##j~>u-jpeI^QMeuue3o7>C>i#gL5I7 zKiWGgQ{f?~{!ie99=Zg;Yy@*s3xkp$#6OztR*ULzTm2HX!dHfgSVGTf&NVi`|Gz^C z##ON~-5qnJm&QFGXZrGt_&NsK6{US}7=oaS#W55y7&zRh?G1Sc`C}-YZrV+X8;<1J zb7eTa`loB+!~&KS;p0*LgFofbv$MgYxdMyx(v?5R z>)(brBf<=0Bk^*f`KQD;Ato}#D9b7jf?+H)U&buc*pTZpkh%QP$DD9e?l2|YdRSgw zUJ$;$yo@MUkwxDT&|3U;V^X9!1^P<32ZAE;$q3boDPmlUXE7sH&0Z6LfSzcL6*DOO-;^IJVPS1DcK7l9kg92tmW83a2%Ty) z4c;4am=%7S`XzhE4Dkj9PO<9X)4%VY@>K!uHUJplL-Q)7@a?HPRa!+)JW1!`6<OdJs&}<2Eq(sqJK(9Y$jf`%3k#E1uh~@@nWFc0f_!E2F!(vOWl))x+2?&$ zoRpy~%aq~k)UHyil*$Ppk_@PEY&$B`j}I|tmplXxv*&%jCCQtTe418QxFXEKqM>%4 zRJjhr#_-3ixbNmnUnV#V8k3-|5Tv` z%B2hoO}(v32o0SkIBrK8EU55wNooNfnSb>8MTs)s2TsH+$E zJ8o&*%nSmdueBc&4qA0tMDf5P!DTM4%Pny;W7<9QTJCgjM>br3nj^2vCAHn5 z)Z7EMQTOYu#Ui@~$zmzibFOKT5Bp89T|@HXH@aqGj2?O=pbG@3I>qw{Y{Q- z^!7$e$Lh4_vT#h?=tcJW4EUCxN(LVCMy?@WJJ>ekoq2^F2vzZpE5o>(URI=;^fr9HMGsGmbRzL|T6&;ayf0bp6>-lIb?Z27D4nPX9- zrs=<7rn)t%N51Neg^N|Y%BE&re-NVUBTi%>1`Mx0+XNS-1<-$g9XfesBfKVHg)(5Im~K$6aqWthXM3D8#d}#4p1mb>be_4aee8S667$(P*8|j z6AIGoQo&?pHz|z8YdJUgsr#wQfR4g*ub4sTxVH)56E24ibtb^`fI7{5m;ycOL3LVw zrLe#s?QfoYQuZivBgF9~DXWyx5z__G&4$2Wwf=sWDvE1SWe{hm0o{Q+ z-Q$vuu?u;uUmh*U~wtB?{AR18bxoc9E0kG&N zn$JrZd2VQxk^fEbm-EqU^2J8S=B_?7HJmGTsD0+6g*(y@n3Tn3-4@S<>}4&{u?%gD z4G7AeE~Wl`T&dy3V{X@6e}QFiL>~So#j(vH%z~8O8_&X7)ObHXwuT4LSM}A+d~$+D z{R3EEgke!;Y{YAKeoiy=;-bkTA(?h{wjH4w9-MQRtLTK8Q*AZ%H4kfxdqBH@w#hr> zZ_H?V{rck!5;2uK#A!mz3#La$qKR-!fOvUs znyA=9CO;H)u9dJtwo(rk_87~@RgFVU#uPv?r{hrOe$DO53-XLtJZhmr?^)|Z~44KIu< z?x8CcZ2@Z4kz0mJ&t+s*sMs$@69)ntyG|uBAL}Wm3rZOHrL$V8aY{-`>on-&#e4P^ z(=MSxS)(=8HZsh4#o8s(F9X;fk@fXqf{`qQS?=82^y=)PCrpE#*x&wf;g|maN|}By z1u4v_-4wSVXGRZzM*~njaTW4#=X%-Sslzn;(Lzr*a$W9;iDOML@9n$&Q5>8 z{jX;^`tc7&A1LJdgl|klYSI}=n1ZU88=PU=5R@HNj)y(v+4{=lhrh(xi>u|~jpi|H zKrleq;F2CR2d_TpIT^+&DR{w|Z|Kk#s=WQrRys5&LR~F$ZuUd8UCgrFP*X4uBghX{ z-o&_o;CMo5Z&HcHASIzY3h$aJ>nuQZW(VAYT>h&uopy6i=BY#}@Sh#h>BHHh3ELZx z)rD7=16Mg6zJ@N!Uso>Fz31-{m(2e_QrN%H5I^QyVqM zV*jYg=F`sa^Na{kyQ`O*A&WFD{i8-TrFSv0VW2N@@XTyztEJ30BNd`Vt&t zMXKFiU&yMfBC?*EGs=+I-wektUBrC3Aqt;zsTOgS6g>u!SQ&!2p7$T+{igtyQg+u_ z$j@?_{>?%*|5H6AUju$kH=U*GX^&{HZ zRm*h&4#0>E)OtL@oLwMXq-O5|nVbpd2AY8kaV7TowV2^RWa89By^@|*=;mMM)R?wB zOoAI#bjKU60WrC6i`jvkgg^3=RXt^GPz-)gKu(#WPFwIR$#{^Q(Ck+soSDf1eI`DHO?b-7ZoHju}oy0s-{V0*-o6t{W}@;x|?Khjv~pZ8gyGoO%v6 z^rsAXNWTVLi56J!s}kJ6$Ih;azenF3$xaC@R=G=7T2@if``jjIKcI(yHws~h6}XwP zuIi78TN)O3my&&fz(N`w)-`PzRdG>@QZo>sUb_VBx>xC`n!m(-$k9rM`-N@`ZoOq2 zrt~tP`D;BDGW@ZG@hnr3KPmq8rvChti0Hf9HR}Ls!E`(n?N${&rA&$U&+b$L%J6+0 z`!Vjmq0XhJ86aFGG=ToLLvm~oV%0D%1?FjaKhRe;IPRM|oung85#%Tznzt*_KinXY z!?+MF+E`K{c8u{{O_M)N>;1~En!vJ2?`I?Gd8rvqmR^HgGu_?5)QM{^9&D=s$zD*orL87LV~7Ux$F_5=q=x7pWS`y^z`J?;^-3x7xn!PxMGml{*m6LyDcuG^hml{89K31@ph}D;#uIAU#!r0gX zw@Ba?Alt&l+L49EE$-_}#jGrgI^C5{6?d|e7SbIw^*jFr&k4|lX}<9EKeA>^j;TG6 zu^kfoqXs3mu-KOV8f-uJhiUH`sfHl!20f_MlmPZDXtY*ea#jW6>)lV6qg%1}1Q(=qe0JQ%Pv_v!QhfDo%vveX0KYSI4QCZ1vF|(b*TuC{mx6zuD z7E0f|i9X1_^gpdq`l?4e(j4jINg*UcGX^&W$(Ht%3=Lc3)g`}`8LOmQ0XWkv9b$K} zWl491q&I4A-SsFGM!~H6&296AQlGY~pkiUfm7#zF z*ZYwD7u@&)Ig1qpRU|B7zc)191awRdfQd%| z8B>+}#e8DyMv#jLJO+lpGAKM7)vqYBOideO;g{cug6~xVCnzwx3JdFEGj&yIR--dk_HPh9H2 z7#wM##I4(~i{*R0Lkg5j0#*BwX>&!P?3h+0z*;|f4ai%Q-LWKXisw&W(nT&+0EzRP znm(daCRXXmCm~Mv2ZA@779{JvW-$xWQfM*h0pBbvi~&P2$i7=1iQOfH%@N*#)7E+X z<^J{3@M2!9vGi=a^-P7a;--vG{1(=#jyReH5BXkZAGc(3y5AVtlKI|3_##?0*A0!J zURM`>(D~$2$p?49tcRnGT+N@!(cId!uyzkPb*J zi{0Jp17VyeG;E_|LEJ0(Vb`PA@?wdM*4g6jvV+-NB`iT=TRffZ?G07Te1!|UTp9!C zumA_EFx|Mpo4m=%Eif%X4hv=NnzndqNNx83Mm*AaBf|N=|IFpk!_#(E&L9|f=Mt}L zyVuKi7_kBRAw*y+m;4yjdoGE4A6R_*w8Ga}w{23q5E-b59OLB=fKW?nSe21u!gnsj zr~h_D`)x}Ap(4R8r8`XJgzSdS4v?((=Bo!x-7+wSa!;n<`498NS`iH83@gT7NnNEBDj=$ql%#etxpAX zJn4b5`T-f8C&L`2qgF0@2OEXUlnk4b{)tHs8OyY(DjD)heCQ|&yhB*@2ofB3o+Mx4 zF|emFzN~Q5t~3D)Y#GBHJ<}=L;%Rn7i{ao7u{fe*e?9pcEgLqb@)Y-*A@$sJte3M5 zS6H^+c2u2ox9V&>sdtdb-o~{>9Ux13lM2J3B`>;rY6894H%v`4uJ(FXOd$wXNS)~8 zTOiO=pD)w_PGHY*s3GW)M?fOqaKu3rDQmtnUYXAyz%_!@ivhbYqU2;u_f%&mtcG$D zn8tUJL-1ZFTJkhTo?U}P{D1T6l&1Y6!(h5$=>~ox8S+a&;O3<(%MgPwTc$e*@b9zS zQk?=6M3#Yt;DQ3qh)kdszTFBa$_dk3+MvqO4t^83kYZCOw6b8-a%&YheWJgH9M|(w zr61M5F1FC4Ry_cpsOqGP**)7FLcr6$Wg!z)tT=R!8y!`K08H3KHTG;?3ZoV;)eLd-+Z%0O4ZvTEcrh z+N9&e#hgDH6FFx0A)x>%nuJ*1(z>}<>(!rMCB9;6qhWp|bqzicHvg$;ILG635{D>1 zJY~N$)+l18B;$*?8R=KiF>8Ks&Zo~kb%(YAXec<8_MXgThjMh;h13!Th}^xhIt9N_ z;SDVh2qbOPJuz_F@HgaG`Uwk>3y`zWz)PO_MaaLvLtGjM(5^7|dO(WBL`7M}(?&0l zPsEPAHF~b7VQw)a7e@hO_q9jtfCvJYzR5|Oulb%6IGWgW3|d0dW8Q;p9$Z(1)F*T|22-oU!u zD}P!SZ+Ot`G2o{-sclrK+1uoSTj#JX=zxYX$JPq6!sdpmYj!w@2nzH2u-1%%z*c#e** zRb7W~NRL{>q=LcAQfQ`bxX!@Mvh0$EyR$!0AgJ~(DJzRQhYT5*nC3F9&Lj#&jwbv8 zQ+$>CkRYV}?+i~|Am@m__jE8^EA%n*o0{r#m)gE4%fRiJUK!Slo6DRIkLqz^J;aLe zn6>4-*;+ZIQ9NgE%aE6nz)6&p(H@W6-K|JOw2c3+rySf$5A zCcI?s%)yDUpg7b#1EVo-T~O{*yplqvo^TR3g3t%3p8}9tLKNUhz0E3h!TMAr!~j#9 zeC9SNkNZiJ(sX*bIC4arZ~u_VptNW7E-ddJDEq%nN+B>eGQzMu+uwhaCR$uQsh!vT z7$rVFTGp*_P#$?O#V6I0#VA}4^)@K^ne7MYuND9SjtP0uP`G_0j+*Q7Lv9FI?S$@# zran!s$NG|FmeC;R+AR$Ad}On{S5@3G3{!DTM@p>JFRwOhx}@mTB|1M%S63`9sn?(U z&*rH-a?AoO-Q!WRX(7MRPa7E`l%oqF zQ4$Ge_@%*zgqQ+ySbEu9y-7u-A`sGTE>Cv_G;T`ly$|15<9EW_o1IW!0v+8CYb+nS zQ}=M*KTtS5PDzxxK zvkvHhJRg`QRp{7uoa|m3`~bjCPJ|P#k($UiH?2r=WtNNWz74`%cwgSHvxAhxa5`n| z|LSUAnBjY*d?_s+8W(#y(y8fi{Axr4Kmx8C$lk(W42aSJTLXCDz7qpO_cK47 z3Oud(Nop+7wkmSu8@?3Auspb>JD8x!fz|ja(Y78Qy$s(58t&nLZOEZe09K8C$iq3B z(NL04Q|m6NZ?ix!W8xTCM}4NQ9hCX5nmg90c^2?-?d#o{+UbLeF%F3a?(t~`$>h4a zGm|7k;WSvg3@Joq+E=;9r|Vp2zehh>Wc-A$L)sCMW&TKFaf8sH6{iHvNMbZ~EMh=0 zNia(rQq{AGM1jJgSHIY$ZP^t&ToD%Tx9CZw?ONGlcuK< z)G(Zw0(K>{P~D-LeOF9~H#Y*>fuQw0;td&l4xroQzZl#ho8H?x1b85pAthD+?pIp- zt%)-^G5&XWXQuz?0)#kL-=xK1on!)ZCXe+Mr}UgRi3yIqEG)yffhr%#N-v%-(T&&L ztAjAww9vxdYnOizKG2}QdG*{?zgZc^*N5VY$(97Td>4Ejon| z0}am{Jbs_MBae1iA8A|v>HYy2`}+QnkC?SgkGtK2fl*_NHH^6a!YwEE+3$)f?6N?Y zv`=77bX5dgO&{?QmKKIIn_L{7YkiL1@ED>kUmNj1iP3!|+hxT<|` z2a+rAxY19APyHluh)sk^3&;GQ1^5Jc>zT5-x=cKd%4WriX$0Q2;dU@o;2!7XVhit? zE%gA=4R+9+T6Xi6j+6;r3S|NEMo=n$Sp=cBki-R=00dRCSdv6G3s^4| z-7yPm&-{ZPY<$%+9rr4zlT$8UV7XHT2Y8Op4RYi1^{y~2GldIA{~uTH9o1y8br0K6 zY$zg4iUKN9M3LSV1*EHVX-Y?$^b(2`rGxaICwc&u*TxxHK=LK+iq}|!_8K7>3JPm+O zw$$|YtQ!_#^-4MT49g0!@8REw+bq%-g?0M)mR_kt|<5zwAW7G@7t&*Rb z;S4{wrS|)H zW_&jS6VX6viP+f;8)>D=DxaZ@Yfg7Rs+4X6-X9-$sT&ljZ<&*tLIxaHYRh@y9NfWz zx861fCiAzj4|*GK;M{OH#q-|+m0V41Zy)~Tn_Xczo2a1nozvQvffd`6 zs9CKC-wfB*ht6kXce4allHpz4#>pkUklyvSYi$F#A~~Z9n5?f`%8mMSu^RhQaL_Z_ z22K*F|0)KqYa(H)M%_gvqs_%U;Mbp*$P=NLf#xi}ziDAxxgw1B)LwfN%m>i-Sef1_Kr^+d*5$4o7z~5drTEbAxDLCYrPo&w4~vpB2HY z_2XPPl|eI|>&8Yp|DIhF?X}uZ_aCWoC;#Be!n&UGP|J`;=MqpN8hL81;QG1rV!XPK z^(V>{YkF~*m$olu*2*G9IpTB1d!(D1Z1QZXRvxURc@gm`J`oR60T;Ffo& zpP>v1r!5xV$1weOkzND{AHP}?dO_l$oOt4fDcDg)RVp|$HOr-`8< zRW!WezV1Br6h%Fyj_j=#6~#Xct|ASI_QQ3Lf5m9=fo2*K0KLtR{mIUNAUQXw>fq_+ z9z%B15`un*aW~#)a+XwbWw0bSFY*sLPe)jeJYpr;jMl6Fe65n z^W?0I@@nGKc6$IMq@K@uRLRJ^wp9@CX#!Y*b@d<%lm-p|EiGl~)u@agPi|UWy#9mJ z$u^oS6kbm79ZBZZDzj4XBBaN6JHHf#FcEoD38~@Uyp8-?|D^&(>NpQfESby=G=#FO zdObx6C_jbv+UN9omX*VIE$RTLti^ut%HaRAF67UZ_?ll2Yom)rsdWRG+*cHB+*d@|&Kis70 zf>ERQ5|fj~8xFgZ^%4InLyh^i?TnN^1r})iucu_3bDG&YBDkXu{ssO3ES0y^6j zUTWmzH0f$zWqVp@GQ0$r6M`0|XoHrf8KcfvseAcMKUbO09kyZRS?+ z|MQl)mP#i#WlJH%Qgyiww*mEHk2(kpCG_sm>ZCoF2+{!C+He2ZIWsP!3*p5auk^1I z@)2c6@rfqeO!z1c5C(c>K_e92BApAg@G2ZbpI_YZtz}WAn&`qs_=h3Zi|H+9iP5)Q zfneVmyxUpv27@@je$O;bB|Jl5Jb;anu5;G^9^*woVeG$2)AGwmA z###k}Fh+WtC|U!JahpEcx7yA`l%wO2{+<323ofWcSr5SVJ>$Z9dGeW=WM!KOJehDt z(|+)|iC6pmVoBn|)OoW3LzB_Y%~3X5>e2t!`r^j5M0ZnNK3Kr1uihp@=d?WUn(~SO zd|Auh5`YgmdNnT*ta(&kNZKG5|7ag-M3QFkG?=cS5%pzyF?X>dF6Xako?dCLka@$1 zX^mSxXr&pO9*lWu7@&|%|7$4%x~cos@d4*aMu;iXA^-$6TO|{>RLQ(JGx2KHC||Si z4+Pes^pDym@Tr@5msguI8yKq5xdlmr+w6_-buO28#2oOxLVPl?5?_+ zCQE-2`17tKFjC;tCLy!E&}s2CNDjd?#!rhD@QS{3KQ-WV3xzuHUye@=l+!GE@{RJN z+5xO;+QkD}7;1Ae7{I~TF8$zm@^kl#ZVtz8@$)@JrlnI!Y)to$4AF0Yq!Wf;_*j7 zv)61o`QD|(#Z5u%@8@ci$(6oo7~lvn>l=UFk&PbqNrE4qkJj7_w|X{U1N2hAK|&9o zs9cVB&n7G9=yacm&FR0%Kb#fpwpV@$^A|KgV=t2m?8fW7U5exEy=ZPklV5{&!9J=_NReQD9aL4j|N_Ovq9_e`@QkIbwL!;e$de) z6LcR~H&?0z|MQgJGy^Aj11Ap-b{Y?M4!Ao0rh?k^l69=ad>y;?TRa3r6Pl_JU``>b78JfuwrOKf3mf z)+!_AD^WwrxV>i0BF*vLcmLhS>{jd zB+}ueV_Pc0rXP@)CQAQj5%wYg+>rH}W;JdtCHRM_qmdPHtLS78uz!J2@@v9(S(DcM zB>%e|C;P5@$G6ydyEP(u)X1OCrTO0zij{p`>lPi}!_K4wm92ApqWdcw5YTLEIQ7}C zr>r;sV}(>#4B(1KFc)g%R(DPVxq&RuXWT#=A=OWp?m70FnegHSdxfEprJ9OV#?M9} z0J6FB1--cWe)dF(M=5|jFPEv#0M(0;SJ98_UcdXa%!(~Rv*}-}>~Nh1GTN zq<0jkHs*&w2&e@LGY_NvG{Ke``9Q$`P<76D_*k4OYloZ^QzpmZW|mWFYGSJ-i59M| z!f&gSOYR8_>&V}`az^5Z1-avH)ryop_2uF6c7_y(2_2_&whbl6V zRCB+hgPbT{_f*X}Wm;%V8ty7%$}6G41m6QJVRX+c!m<~WgsNwvUfmP_{1GlqPsibb z5#jtzg1!ML3{Vaxmtg_i#a^S9gwJVo5JEjXuBMb%nHp3N|GsTo+@m6rZfKw(-HA=3 zq0UP*p>m9Ut2LD6K}MTw4N16D%R-E0U8W+Yw-r0cx8l#$u=5SEm04j22ueMC)`wp5 z&%9ED#mD}BHli;XI74|rl=&~Z<)B8Et#iAj>C##tGmx$XF?78O(;9j{2lJiHn0DsF z*xq5zQZFcZt?isu5wyK-&)3*jF1uKv`IOa^?X(=wp1AIkYEWj@|Et}z z{+umA8r(haN}BUb$~#~3CDrS=sqhVZE&*4m6ceh3xb?~Bu4nL)wleG~TOX^LaDLM= zdA;hxifriqfAY8QVI5{_SLHR z9>CN6Y?2ltw>hNj#+VPRN}%K%0Y1QxjrQWhsjC`Do#H0>IO)_)A(QI&zo>lkHdbu5RNjsDivYbGAV|L~ow|`0bH=-! zPczlNbgGUZFAq+~z1EUpotFU@K2~aM%$^=;JxnDfqY7{q6%cP_-!FPow{hY3+=Qm& z3K_C*<8LcNq`3e+;2Pt?wEkc^1nvwB!e**1gxUlA3HRa0GtsqxIC?uLc}~s2IsYVNNjAg!ZT#s~@W%qDqdU$dWX8w>r(x&wq~Upw1oK?T#)vFyNK;6igG^oA9TC|Xv-Zg=8A^4R zm&(^NlZjDSXC`97>ni@w435@0pasMpe}=4DU!Z5J*WuM|2AE;D7hYrHyyr$H()?@& zb%6M7Jb*%DeEi5abmV^c?oQAFDe1rZ3KaN;Rw9(W4caK%*Te6(smNcNSPB`J00*F&?JmwVxmQy|nfD>9@27fD zQ$4bzk7PewOaO4yn2V$4oo(Djc4vSbDH;LBS?ne9F)g~ev%xGYygmKNlAH^xwXUvs zhBHa5Da4%1OH9%t>$e9Tu8g!$S9yf(x>B8|+NhxV_)CpBZO~QR+N4)*r+Mw*W$k zx3Aj#0cNc32+lLbyTJkGY>asBay^XuLPX@LP&rF&(=3(8N1I+et77?f=j~lag%56+ z)A7L>L#)S6yktAhoW*+YMM&(AA5gWX%?EFS`5o_SeLiy1gZCy+D62Jhj9e>^(kr7^ za*i7~@4W`Iao}@BnXj@c+&j>7BDs^@a{_9IVGRe{`{ukArnk*PM}Xf7^6E?@`aR+exmyO3ZK5>Zfmzuh7$Tow;}^V5jf=3D4JX zmT*!^0Ier7*w!Dz;XQrY^LpndXOA3Z#K_#3U24;J8Ft=v_hX|A_@*$)xDOX^GIzeO zvSg!6*>|~YB7pAUojFi*<(TUf!u)!LIPXVg)BNyXaQz*l2+1j#0w!ZlLWKo$>B&{1 zJ3eL3r|#UfFz*V|-c-Teo`OPccFIYzygI~rUS?VW}VV`x@ z{l|Czz z{M}Yx(*HzNbGDW&$*g-!8lqZW1iabTQaWN@s8V-Pv5W4JSCM&P1XL)ZRQG8Ru%x;` zHG8)eJn0(LJOYBc`I%151f#C=24=q2Ogo#UN5Aha6qnIaomVxFBo7HSkLXlDevM0T zfnUwOXhn}N#&tSXyq)$edUZj!^0?D=ORc*G$-t%<9!N&QIH<;xel1aq)ZV{bi(Iim zS*si}j=N6A0WV*KKXvLBn*g&jU*< zzCf+AsP8CDvWGSMg*hwN>_p``cDc_U>D{cye?}dtkXl2Yw%7qGyH+P{3rN;$7m-J4 zw~c4_CY>57_O@&bkaJC^XunOBkJ6lFx>gE__Zn8dL$OlL|E5pNWpk9fD4HO`*e;dk zaIGT{jF{{UA!yvM$VW6>%@>oVm{vLGjA{>bxL;6U6Lgj%DO~j*)abbnrcx_Fo!Ynj zbpzJc@?amgFy-5O+s)j8Roha*^^2w?#NPJKP4JQ;EHiX>6|*o;o@2txqrBYwK5a=0 zY4pK4$^nr_`HyDTX)j+6rIlB}^%eKheWoL&QpRd&s5~#OrqxmG>cOa8*{Emn>yZlL zv`CJkRT(|*VS>8g>c^T|d3K>kMaEGX3)ee}GflzUxoE*DJVd*+P2(q(9uxctJ4Pr^ zJZ0nU#%=+*71GJ_$uEd!(Kl?U+rj4jJ%|SpU&$z!_}Rub)!yV-KcQIv%b8JUiJv<5 zpc$0I^2j?qUv2VhMVOi#-XX+UF#lJ;ak-q$7<=UsnkB;r^v%QfI}>57Zaq?SVJe)y z*Sk(Uq9%a6)QwClS5N;$z0-$3lUQPL2z1uQiJX8P=qdW-PPO} zqBI`tJz!_8Pees&9=~f_BRjo!&ldXrxmjc~Q4Ft+2vZ z=zr*w^h z|79Fn1tKOZoBbu{S4p2g-2-t48`Pz*H_Op;?so+SY}=KeHY_5oZOzk z;-n7^S4v|`{?8xckJf=l<+|L3mpS}T!}O~}mG3r52l59Dw5$Yc-*-U1qc|Zdn5d`W z;^e$$$AQt(`+CzNySee?0Ub2XJBOPsPRUB;g*n1X6+5F}V)%0Ffm>t*5u7|Bf$n+i zn0tNWHG{~ZF&0jxht5}FYx&fs@SM8)o>oWvK!Cit(dj!0|8^7frMzZDU&ANj-u4%s z&vTq}^<&kpc{DLye>E71HeXH%q55RxjL5a$;)Xau>7HEHS@P@@Ffepp3!CW!H+*?) z6~*~>jHa%8{nOu7JM5CLzm457{Q8YDEF3{Jdpe$Ocn$2?C~7C{o36G$u41Mi9Ou_x>kd@sluWwcOVFfmnKi1Z((nY zB&o6q_HA+ccm+b^R}902MFw!YBU@t7C|JrYcF_Yvn$so+q$n^X?Qvq?Wdx?KO5JVE z+cMq6qT?Yqu?1UlXQ&IVkz(UXiR6Xak;-FjiEl++ooZA{rXP0PRu&#ZDG86cK`Jse z&^V%;R13hP3{)LST(dVYPHQYNLGbH4n@~<-r1XqZ-?BhwtTVo%@HT9rfAP}bTWaW< z6%Gv$j8-eo;~eHGv(p|fiQ*`i!`(_5k`iXAT+2GWq1){Y&US`g<~A~(P32sioE=>u z>6sLdC`F$Ct$WC8=3y?H#T*7L$&a!s-%CLtKl11kbNvL(7W%CE`jl5aMcSccx}5&h zBTxPz`o&QTsFUsw_nc^<+FR`Q7sFWC7>+lr<&f41JHUMZ%WII);KGi!Hn|FMR&vD0 ziX@%OJjQr1KINONHwsAD1soWp9ddBa2u-dms~lXvh^=0r0iA;JSkZ^`B<6A1`1WJ| zDl^UW-j=uim@v%&tMRK%7=?Y;o$TFn)XBaM=sV-?YuLiAJ~QMJwb{LMnSuAoNWoaIowb-Cr_zC&HDFDZEbEjVavzmwnuG? z#$A#EDSwcw8asOgSJ_6My+D^emy4TNKPmkn&Tr*o(s^5QRo{hUYR0io8eJt0yifsN zm|3EF~&5zXIZY5S?xFd); zTJY!qf4s{VzAT?V7eealoR6(QVk+G^lP9^t{P^)YW#p(R@^#d(Zv;U}feejj@hiq1 z?uusFPdZV3Z}St-=l8zE5?HF@v{9-!HNI}9+dHfqx^vgQB7KfwzhqtEuG_E+XB5z% zb~=Hjoi=1hW8B=A`V7?;G0iwCqxGJ&=1bka$M*};7(Va1`1389f~1@*u>;T}QQ?A$ zciN|8cE=8aUYF=q@aS_r5-xm0(~CM$p7a*mK7CYPfLjEHQCeGdM_f&}`l-z4$5kNl zN4^2=KQMBN3n@i6k%2g{lQ%vg9`=ek%!sFTOY-80IX6Wb{f+&Str7n~=<#KDgERRz zVp)YJPSljC`zKih3Lgm>mP zrcA76yq&r0`;RaC*60I+-t)}*!6et47W~+LlBvA=RRi4f-1E?@LFRA9)uE6zsTK4V z>E_PPD0~;4zCal!$m3} z<`uTrj`!UhS7;qzhcrfBJB*-ozV*K+%L~vva(JC_Po7AEq&`aewU80wld{#Ew5!uF zJuX@nK6BJE&TRx8X^`0FjLC89;NueN_R73`;i=&?cU@(tN5ZIkZonh5|G}&+-QmYt zm?a3{Pm_Ie20jjn|Dow%sHZ%AI%?(uCZC(X`2gg@Ur;$yCr_PP6YSOPhlV~W6_b{J zH9)q%`RZNR^`oAM7z7pYE(>h~`tiV<7fux6`UnQaR`F+%mZ!qsy>r9DYbLVYd)m=< z@UxMs8}`hKU8hVg3$$>exJI7Z`+{6HeP~*d6T`76SIa8$Bw@tHJ#M0{$@Zfg`f`IQ z?X(Dz%L)S}Qf7mJ(R7{uCJijJ9~#>IGMJ>i@2iDlfL z)KNvwNk`+#4afVE(-}|ZP2_dTa%XGGMM;a;lf5uo9q3|8T?wlM=JkaGA#_vvT4vJ8 z>iC10wH$HE4y8@lBs8CIa$9&N9XH$5XfT{+IV){o9#9#%PMecGjLn73{VK}@`IaP> zBKb5cB5>2Y*UJTV`H$jlg@=2sW8?st>`p`6AbD@o-9vbo<9NaLp7gH&R=~||wr@U} zr6=~0gJj5AleBRoSoRv#t8oiDGY1ng8En}JRCp-w4AtDKDhQj}L_14gNe*%!`F{T} zUn&B1^xz3fSmj$_G4s+$R3|Eh75>2$OKGWch9V>S z^b_LlhkXux(Xx_nxRC_g{iJflkzoOTw&~(A?cvG(vcB(1s6fRV+$^s(bTr)RyqKS< z2anJU*`x?yo_<;4b~0|XDsvMeVceBIJ0LSDYG&yr(w;&u2|{hs8u#uCIx>uH5{6!+ z=@0bQi2F+nXSF^?+L`MJAX`!)9FKk;{cEm4rVfkY9gq`-za}51Sa(PqrYq^~!?tt*1k%>MgOI6-|boD!iF#cc|`~HCF=CBi3A$4Vw z#L!hS2TC1UE-0smG)EE6cm7!A%tqUAes0EllpfIgR83Kt{ZH@rHFHP4(|+3Gz0~xMIJ3p><9 zMlZiG{%Q)%wyFO$$mgOSfG_5L&kVB7<6j+w-ddFD-l1uyCdNjNf;2qL&`wTL;FrK$ zvhMw#t`CZ9DvTtwPg>5~=EvTh<92F%We~=H5F@mT=vJyMSYA|Q$9BcrM^)@M*e7+f zY@c>hK}yI}-xkBdOPZL3oeQjNMjijDeFXM*hYS-Y zYg;*BNrv`33Z}a{=vpg5x`?>wBrWN7rVqL3dgZS3_?=sb!5=?<%m@v0x<{k5i2Q3c zU|M?>aH%oG^j(FffAN_8q$0DWNtlXWB-74A*>1Bx=oC+ts>)m~_FQ>>xI$gWPj*VQ z5IPF_6Hfmg;$CU}lCV1=8j2J$GggxMev5ktNIe9!Yw4>wr9D2wGjrSrON{!s{sP;V zI+xRax5*TPSGNShEkcP7-D1H(Wk1l}=fGQo8yT__ON zzJGEPtHD>XLy_y9lf0Bnq`kSrYT>wFRr{qfI7r(`)HvesEmzRH2d3t!Thz_5)PeD2 zAjjY5@&qDj{#i=x^p+iSWLAFk?{#@#g;&aiipL2!5%_dhgV+WTao~V(g{7OXuY=@y`}x;!-4?CaZQDh~ zrT4z0Kf6)Z1RjxJSF1ocS}8XcGJ^5*9*)MBM;uOgo$wx?wTxDTuyAsMD;>eJHO z0f-v%Z9tI?3HS_sRab(XOJ55MxrGqXL1|IWfiEhEKTFi5sat+$Ef&IVv7jk2`rD7Q z{p=&Y6Lrr%JvgGsk`?Re-vUQJ!N;Y&vi z`-O2Od(}PNC-`S+<8K?i%5#KM_o~nf5OIdv1rPc5H;NH1zix_ag~?o5M*FEBxkWq( z2syK38bg7-{k8XvL>kQLKyw5t4?`Dqg9b-(-kjz}GUDKV<_Dt!yeb+SSN5|DR!z4& zZB}KbB8TQd5=8Q>7`@5qJ56s4avRO)3%}y5~EV`7YTbU%`ksvoG0l;#OXJuZUY^|FGLX&I^IBlt!Wd74& z0Px=uK5n(SK|@UVid5e-IqcwBv=(%x;o5)d#=r!czxRF$*cikyw4J8Y5rfF5s8N(* zxj$F&Ap=0cj3-<5>WYLWp8(TG=F^f(vK4(vqHHOg#4(AnV|t1Hx~DDJ-oEKUvG`|A z1WtTADx(lZ^l~n;D~rY?D7`~c@4%i8v2#@vW z+pSsdsKKzwh89Nb`1c14(0nZa-w`< zvfiWGyp+_cyV<#iT<4_}PLOleM(FZ0 z<<1bq=u%v{G7NNjwE|xQf^OAb`oujDZ}`XbJKDQPHmWO`!a0}ccCzk$Y= zzc0f|FAB=YGhRwjdZhWWUghxx^wNi^Wee`pONS}v+Hq$5?I#|=XnI2I;+F=%^M7Vo z#>PmL`?OE6skt1ge^w2B;hFu_Mla&?W-`D6boy->hwI5_xuB&_zVG7)8^ldOX<_sN7Da0iMQ|328}hFx zmYEC5(Cpd%ZEV;x+9itV>edjZ`OR!~ zoK54xD(lLcq#oPG{AACGF@aIyZh#`qvc@h;^JX9e|1M4=f4g>9$VMRj9(}MYav8l+ zC!a;K=Vv%M(h+de(z|ZIa0C;d5t(!h`(}JN(yxNT2Kylrz<*On!#c!n%iXIYn~J~D zuB=~=Bu?`bKF7YjC#n1E%%z>p%?5@+(~_yFkZa?yTi-I-KN@4)gKwb*1@ue4hHxaXwNg2h5)xIxs?gV4tAQXN5xhn?$gS7FzgGF!@>XdZ7}xis{z#AlxE z6D?2)|Ct_apQTtf+FLzEd&}~@sy6waPuByUV0-%PD<=@KoWz0nfbL8&xdF8<`P(0I zM-y{ZCCg}wrfOyG-3z%POMdEQUWA*nfZaLyR|qjIW^u%Ygg%uFc2h?1{jj?chG9-y z9)Czu{oR2%Q>U4sndnM*RP^USc?&>LZK0uwGu9 zYbfM0&Yt&m#l)Bs8X4alP=7Cnv>Ye1^mQ=*?qbjJeGW?2lRqS1R8jzZU!=DJ2Aj8i z?TYr$PUlO?F%E3Vpsf##(>6?}J=ps(8B{>YSQ>xhrua+aAh7H5RiySN_y_t$Ns%)( zP&X$W3(g5izpKBSv?Bu=Ha|J|(FS!hS6q=+k-qmk5Aqe+I~llZk=>9AcV~cyRJSz* z?)lZdGeB6fVbAj8jo?imqq1$w>4Xr+-#(Ua)eZZdWT?3{VAH8ZO}l7?FcA!lDT76%{58!b*w5028*HKEPE z?PFuJsLGr3NDR`_k#8J;>jPl^C<@Z|kF3Ik~uu;wM;gFsp4H z^gd#oiYRbu%8f40)>e{UEYPctUZ6D-YCy@&f!Sdh8X@VY^RG!{v_(!BM0Mvc2UINE zwy$OUW$hWD|Mu3|`|gC4Sc^;9Yg@tH`mc>f^IalqwxUJ?N5;+dd$8|nE)V+-RAm1R zk4F=wG-+HEz9GruS>h~>+KQyvnAqm-RP3E!hRFq@3U=7{Y+u}Du&WOUJs6!= zsR_D?Ri<9U7PU{#B{@zBoUvvSGe&8;>R<1CK#018>j|f*m^XCa>|f{`-Qt@AI@aRFs~rGiab?;><2@~|nJ`Ry zN#}5u2Z7p&sRa1-_6?lqpe4ErJKVDQP!Q!s>a*gto>1;g$H6y0j zB%R@ECb-HhXFwsc`s(*=nAgAVIWt(&uYB#tm^FTRg;#pQ%rSi8cHDz?xAJ;TpLJVO z|F0WY4>mEjdI7SgyBW(F{>L6LgsFr*KNykEc;lpk+=i-hk7Uh-A{E!9gqa!?$fm9> zj8i=n*l>GM;+~BA(@Lq2$41cKg5vNe+?M8gF6{efRjY?pT}oF^J5nlPU?F4avXk>? zuD=TVdnRO#h)pMz5#{$qXd}j)8V!;H8g*(ej5F+HVmpkjmjlYnG(XRo?0bpA%HtjQ zdrmsR3b$nNpLU&D^RC{ZZerK4(d%~NbQF33wb4!wD+v*dJQEN^t&vak8vuX}Ch zW6hL-J5>q&us0F^7VVFU4H`f~_4ZcN8oMyOALU?dp{~)M8AliQaxQM+P|Y)TvF~ zKb%9vwb7Ll!%eNfmfg0mA;iECF>H$EW(hmS*Po;re$xBqGIo@JrZfApq#&}#Uqf$) z#t$jk_sopVtj#=^)a=@D_W;eG7Y!0F$M5Q~lxfr63bNf~-LP$*%htTHL9IwzES7$( zt z4#PHMyL4~ziUz54!amMo_dFVn539rZ#BF4_)m0Zc+>dlS;v~ctv{puMq2@-e6M268 zfi8;4;pvC$CFb{VmO}Jt8Y6dbD#G#Oh$vSrZx4?O#Wo5mwNL?~P5-pZVSq9Qagi@8 zd3B0;xF!&0MjZ3gNg@1O>GTIMRn;fY@okj(L9GeHlM%kNd@gD-`7ANwcfOV9T&_pO z=AW5zT5u?{^L}=$hE2%}~0jZ;Kk3mt=A9arXS;O@8I$UIk+ zxdvVH^_T5_Wm;CW5#=@^ReQH%+b)tAQ6p=>KR_=rsy6cS*Rdw6VM7*$shPSvklZzq zpSz{iblieF!-1Sbacvze)q{`F?E$jj@G)X#Az`yT8@ncNW*~07A@iUjx|h}{0SH01 zYA=1oEvGqm2@(}cP6}tDF zMBN7WOl?tXt}<37vUArByp-mm&xmN}Q20Qqu!@l{%u4|!^%(2vr}g`-XKJ#B(~gPf z+H#4ssAPe6akJtQBviS3}2No$_=yj(EuMYWC^w-@g01vpRRy*~) z&s_bLg1oBY=Jui(1wPyH{*ido?|-g9QxdMQ1C@jP6&a6wATF16a#uv@W5BhO(>W}k zE;LVMPs#9RzizsJZs=5AoBT!d3udps)69+guXP7q1Z^VPZwi}iUY^=ApHm-oZS{CJ zFwDwWS9&!rtnr+t%pM@G$5kIZvLN<06{+4r_mTivGn9VlVP2Kr<6x_E&t%%=IfF;Z!p0Sn ztpn@!m@81ID&JAYaZa`5*yXkHT59Js?^y93ty3x6VPhh zkQ{bFOX+fTE;9r7-|LRnE$%=#MG$p<2yrgYd_nN?5$b-THGKxQPB&(_#5Ka zZ0(@M?4PLUSMzSOUj?(*ikyg0G-XQmeQE6iKQqqVoO|D$gr>~CNTCQJm_-!nM;!R^ zQ;Ef4_1Zg`Vh*oPP;~p9F*@CJz)cnD0Os5d3*gs$0AOa@Bpd9_l2s^u@ybyl3&^=i zr;?$rG^FZb@=LwYz;dfVwcw${)@c?jZXUG6hC7jj4KQD~Yb#Mafoo<{Sy@@*31;Tf z_Z*^O6NIkMJtBf6*>$6QG@?f3Ou(yw>?&aPKjGVC6HgXDa|&DAn>1>FW?ioBp4nk~ zv)`N1B>cs~BeQ%y*jnMi*ckj3Yn2ruiVXBbT!_KK#KMByoEK>l0Icbt0&e&%*Bsts zFKAM>pUgr)uIqJ%6Ut#WiR$%A*5z`oXd&tCotkX9zH%S0-vE7FyO0KDK@aO?qCra zA`_6^1Z>1l|E{ywFS!%0kZqH2*v6#3Ebt_{-@7jb%bg)YqebCrj#HNMWl`$dJwmfP zf@Li3fx4B0!dD+d+J$a=at7_Xu7-~O{2L1$xrZ4Y9%g=eB>55fSFDKRSUv7SC4j&R zGdXrPvnd|o*x%1Y!ct$6nV6r>aQ`cN=yTlktYI=jp>}eszf&FjYBgGXa}0xe6rwZ1fD05MyvKj$FoW#&#Dma ziMa3H@N7P{8+8?Qu>@zl=O z^!P0W8K%X}TVEksNb)3C$rP|3vp?&c5h$}Cnq_ktH{S;76Eb>n9$5<)ozT`xn^I`qVQd*VJY9>0$aI^@LGd?5 z%wdt`!##%IJC%JfH0i}aiIF8EQR^Jk{mqs3ehP$4cwkp0jB&sCSD<9-bamg*0!xI* zaq&;z>iHpZFV$&|A3vU{#Q!e~^leu+vvAP1J6yX6xWwC`mB zDu~iB#JB)T#HqY4en2FUv^BnrD|}TI0BYmU@4~|&j;UYYo7el4>mmEH_@W4UMK)y? z7tLCZ4Esst2WrVjS7`0woO;haqi(_oo(qaQbz>W)uK@##=5SkbejMd!!TCOrFaXPGAkfaLrwM&|{as^SH^uU*c5#Qw)qvm3V1lV} zr^!VRygj_X+D+MY)D7x<^`LQo@L)j{6W3-2zg}2od@DL_cSw!#-x97xYjvXTT_a|s z%nz)}yZ1rpeZ?R~y;|QouS9!a&?{g%`k=2Rv`^uc7%Q%u@QUWmy2O#Y9!a(G3dz;5T=bST5cXZgt5HysOAV6nQ(XP=?V05~z6Hj)NtsKT+ z#I`Wfl^q^}ylVZ=o>K?{1Gs^Px#O5AJscHIq7@FhRost8pjl7o@AdFir3|c?_0!QV z*^7U61x*WGz>q~y8sd&RD=Eo{sPAo`_@P?~r<~|y`d~rB7&;PncB{)w6Zzm&BD$V~ zIu{~%vz8%rH5h1-5Tj$rIE$SZCjbA$VR>^ZeyvLI|DC_PX(n#%Dvg`K?vHQwFI`Jj zo-nV}l@^c{ZE-Xy%FnLSwPbTT6j>?fwT;DMJkYceVskIpuFgN}<#c~nGYEN37@uDE zjQ7PzGj1hIVWrojrarDnm&uWgrWMv2tj=D&GMBd14>eglv6TCtGidpBJnr&3uJflr zsl<4=g$>+^vQN07i-h9}4O_G1bS@7$@c+imG7{G{bLadn;Y18E45ILFQk&-ta&ZX> z30jC)?9?)+7Q3PnWMNGgFVYM9*S-1AQ^j$%OOK5YnDuIzd#xr^glNd&>r{2i3LP=M z_ew`we)0Dd3nQGY0si>6lXERv%!$7|{=)60oEC_AJi|A>TTzpKqjUajcbvpskK8Vs z5AkzLqYNTq{}st9K4LynNeHKtwioymOGc%kFOb4neS{Rljx{hP@|7I^DCFjLh2`KQ zvAWPUGZT2O0>th_?Ndim!9)cT_zuv?;ZJ`qkI_c01aoQ$Uz=ms>6>3m9`MQm({}H* zNgrN}|H5NLo_a^SQ9QZ2^^*J?;nFn4E%0vCqQ2F`{R_h&Bp>hx)8e$OYN7M;fGGsXz(VhAVTxBJHY&Z#nI4pKI0`A zSm+G7I;eLpxA=DwU-1m+zhS9emF%QuufMCTD$2_IA)8cQ%QL0JrrqI*3cIL%TKBVY za5tDW^ODUF^5>kAsB5{&)wg0}tBL*}s*+b|%(ejvr%~%;zS=PA}!_C4MQ7^R`%CK;v##$3~mNIElhZF;&rm8e3!}uYen3YBe~&jqdU)^%m~=qo7;PQw`tcErkNA zr3*6CyVyse@f9K2v;HvIlWhtk1HR@>P8Pon$ns$R1ZQhV_q_;$w;ZY4j0c6uS0k^i zYgW0BjJ1yg(sgmv17s|N`e&ee9I!86OlHz}SpwHtx&ia6(CO|GcPuPgm%5HRq{93= zCa%d+f5I622m^&Syg_MEHj3ap82!aAVOC(jlSUn>1Q7wO;L^yR_k2bsb5y=E{?HTM73c3s(?fw)me*J;{~EZ9j6AqH6(p zbs;V$=1ISnfa+?fRMni+kJpm0A??4;WW6d#^R9J&o4LMlqy6CbmOgjb$NamegXJO# zGl4T4hi4Re(xXE{{0m!e z>s7GnA~A2})w}NxguL>ruw(<*t^Tt>63BEv9U1KbgPL;yukl|{24_cd;oP}%zpafi zx-2^R78!0I6Xky9y{Ri_nc9<%VVw%}aC1w}sT1=+7ig1>6F3BBUgegm{ zvN|9rcATjjYQ^+@jkEnT?kpyh<{FzKd$8}!ME7=8?5!Li*2Vc^++Z_zT}PV(MA%VT za1NWt;;W;%dN!Jz6)&%jcfrJmT~U>b|GskVL@`0=1i6-ex!>L#mo_>+>?(wiC>?h3 zvOzLG!Y%YQTzSwgR!x8$*2KijC&YU-rkYkbE6;Y{UaYQ?w9NBsc zAnIqR#Kg0}j6fSJ9=7mrqAm^_IDq7E#o8W>2ksE5^U3Kj+`4KbZk-@Hv3J6r%A$L* z1&13zl4*ID=L<)nWBjCajm&Dmz_CQs`*mB&lxul&H=^wzqi^OBD`iF)mEbUWA}TUq-PZi;i=*FbIl_maen^9bUJ#*?p$7&}_Dn;* z^{j${w+94V+_i%kTUnln_CH1`sbLm@c_ib*TSAtDZ|!}xHsTrzo(};TrZi*kx^5Um zOoqFT`P|cPEmyjqfxmF&mZysSuQq!%>Ix^<9|WJ`y#KRos8Jct_3j@MkDa9Ts6PQDzXxsTj?VjKKBGvXVw~}@_A6{Rn1`nvh9AFJ*u&+u^$>m| zR3O-`hMUXRS>h}pXkc(8d)xy+uH6mF9LF4vITqbwHD2f&W4H@{MMfCZ(X`~mJ+C|q zP;4pSuBWN19TXHx?H~M^PSWNy=#5*BGxbaYBYlGiQjIn7*8HzyBTL0_`;p}CcaclO zE>}tLd#RBcMmEZ($*||w>ig+q_Kd2*=NXCZe}44{tc5+b;*GZ}oA1-2 zztI1;T?%Pd=k;ZjXFto+L~jeU(VcP#lYnrxngyNGSkE3-v2$Tuy@5EqvAYybst<3< zW0FxTW)GZ;!EncM!q?k0DNMTsP$jQ810+MbMO|~ulSkec%yL-%>JLe5b^QtsK3eke z;;_s|`fvBtJ*mPvL|)s=UDSEf}oZ#IHbM@cugZ1p-ZyuLC zSW(zlsVg-f#%z-IM;nop@trYBNz(z?J^a|LnV2uuyNhwW9C1$@a_dwa(}_+T*He0P%B*FXD*uoHG;z}Tgd6elbX z6s}~BiU5_EV8{ylCN#@(Dq~fu!#$f)KPN{PQFJ&e*c~tuli|8CY_>YSKOBU#ogEJi zVwP1vRqn~U=B(O&+Rd1dMD4YMl68MfTW&+Q?k23PUfWj|n`oJc)C%O>57?qKxgQuD zESTe1@C`2VcN7HVIph9#$1Wb%6ZKaBE-Lo>TQmobySrPY=Tcs%Eo{M$wHb&_31No$AV`Ht1cI{s}FxV-c!)8lCAp4_AU86RQs(Z{lCZcmbbHzf#f#LWAH;?4UE-EudSVif%d?LE35Z(` z10@d}tMaS8wI<=Ny3S`eN^Iqd|39wYJD%$Q{U0x>NQI1)70L`r*&~%yMA@>k$tH*6 zn4zplvd1YU9AtLvkuBpS8OO2LN#`8LJO{`4Jx=v{e?Pb1KmO`Q=XoB_>v3K8b+JVF z@TMFcHP#ddCPoYG_pCn(o|2;>w;|8%H`UJo`gQe9N_|_Kak#}<4`#Xpv?|3xP(i@H zd@+zd=R=GiT`paPL;yc&b?m5hzlQKat!oai_2Tsrvqbg4IPrETQVNp0JiK6$gA5`qCm<$Z|fPWX`YB!}MTp zyXLj2p%_Kk{7}$>m}MHAlk9akbwqa3??d2AS5y-5LTy>zGwY?fLF`-?SH0`$v-b_#`*4rUPa}opL01aNLTe0W7xwbYuFj#{HH<}`uG(ul*3BD)kx*{ zQGUeg5|eDddj1}8Yoql>Mn4946__%XMUM^6q%`g38qC^oMg%Gu5H8LX*fZKxSl$Bv z^035V#Zbk)alnGGf@0r$I^2#p7$^7Zd2P&(kV8{NtU~fL{5<^mM)DMSiRc~We8i{O zD*6$Rgali9^3ySkiYa15KK>rtvOzYnQ+vattb>dScf8-yS<+d%n_1#NRQQ;vm?Wh` zi^{+y<&;e2)qf6dyc(sSjlKEV=t;^J2YQN2U}O`qvbaZi^$J(L9%`B>u)KpheL%bu z3-KH&F>=GEyS7MTwrbYljGz0qwrZYoijg;?F6iZMr;Xi^^G$s?gJO7JSCo7_$Zcn0 z%Jk|XoOHjO0KDhMmQ}@KQ;3Dn-u=B3X775m z&7DY?Jza83MRJi`^jeT@iYd=f>Np2G=#_1_n?L|LhG#vTZ;_!;xHN?y zl4jZq)iArBQRarQud=aLseoX%W?%2_fLRw+(*5$2^+&^*%(9DojS}sCZ2NzTMlUZ= zMLyu%F6b|P_FlQ~Hy}S)UoSRGMd6cBtmaKY%7J6@g0lDXjC7s&EN=#rW@fDH5fISJ zL$CCu0s;En%ciASv|$Rz=FpHySY;kLa*cLvsJS`B{xzWOFJDmmI%OWNC~D2TbBOQt zQ>U}W8AE8-r0!;)G1>>nO`KF;AQN|n!MbbpFNTZGJFh;R!q>_3tR@~^O+v-xcSAm# z$2HVLpq9MeB01W}KM(3`_{4ZMrs!`<*^J+*-!?P92=5;?!yl9!Y&MZx$j&5%jXh4LsjB)5+Rxs-p&e(<5f0RZ#3Aj|CI+iizU(RKcPf2_LY+{2|2t6v7DF$nFElAEN z!xh@kk%UQxf_e#lMFw}e7dB7Km^p0r!U-%)H&iKTREK0^*r>M0gV$MzHN@L-r1M7$ z?d!>_w7+?}KB3F4o;}kKEe5X@4ebp?U%_+rhh(1b7GE`!R-aw2-R7J$oajR$_m?aJ zagY(ZW!EI)-tth>8tIZ#}qgFaD6( zZKNzSNQX+T1&n1ElFxxJW|x9Z+pIVscXL$Fl~xb=V@QH3WnplZs!lSFM1fk*h6iV_ zVV@|_?CMYN?2cD&Qf#+~tg1FjzD4Vy#AMVQf!>dBn&DDFa`)va=ASh@nj)VBe%H0q zl1RH+ReO{4e~?!x)2@L8ID^d|8m({evZt{x_v#7khK+`cP=9-SIm^h00)%o50f5L~ z#urysN-ZZ#Z1x159@PM!wS>HeSE!sbARQ+`#0v)(S7rUj7=nJKM%jc{aPj&ABs-})$47?Vdcazl7t>G;e~LV3ouh_$8BP?#mOYU$Wc zz7FJc62+onndYiNvt2MLD)n0`20z{-bs@YiB=*XI5xa;} z?k+0KGdRlwf0TTXnaH?z=2YDjNv6~-?@ZmUMdUfA+6+~l4P`R1u(I@JchIp<3@z82 zc)_Cc{oXHMiEkBIwm9UQTw14PcDb-C=?>S>D1Ow-Zn^-YeV1>_?c2u2jLS@{&(dE?1RdlnvCSekm zdB;v+mW9>;<3 zfBu&_quSb~G2boNPqV4t8Uj&sE}Zgristk(zA1Ff89XM>(~k)IXy#VBDZgkxO7=2s z8tGPP1Wg23O2AFCESG%PC5H)1Up@z;^>z7(;D}}Hu)7eAM*^brh?FsJq;uT4$k5#z zTBDYJgAZi))Z}P(=Y>?uXyv4xRW}QCBCx6l+iE})`n*YxYI(M{e>?O=Pkxy4Q77f6 zzikH=^){*lZ%El*td9}!BpH0 zq7q-MbZo6IF!L1g>pg*y%Na7Rh>V({7h#SM|KjIuyYHVyF0t@r#FY%Lq7^1x=dy%L zjhv8qeY+obGELq|Jvk+1jI^n8n^4f!k3TFaqit{^1pQM)!nuTb?40*wg?nZtOk;EY z7mm$jJyV{N4Y?5C9QQpN`KWuU2844+ZuL5-tn;>Tg>~&Cs~W@uwpw{*-e--R!9@7& z@Vz&W{BRt(8ZJCJ_>Wch#J>qADb8w!Z@95yn8z5)Bo|jstH00M$K$=Nvdrdxfdtsm zJ7V`(UE-EL1=0~DGBbR3!CAWb%jb9Hr6{~B<$gNG-y$!-F$-uO<_ePm6!m8y$<5P% zVQ}9~%_qeX=s@JBqsd^xYg14OpA_}QCo!Q3n@1Rxo^U31xv{TxU#-&SuREH1&$gsg z+`P;>qD0*Im72FfY>7jreiXB@jY#_oTRzLqLla>b7mWy?03TYVOf%c2nHQWbFi>1pKjeEuP-V((CRYD<1w^@|Zf0&i}ehG_Hhg$h^*m7oE`bQ*>~2 z?1}?>LF2iBY5zk=mpVjX(+Ne^;-^%Xy(Rm4;9O>h@Dk;)N4j(8`!a2YhHLfyymVYs zCzC_-G3Ty_4Sp~6Z2FBTyy=u!33d?pS72FmufrBA2ek{$Y*km=SiDziz>+@IHg!^V z2#8$H+Hi7k9bN@w$GQapa=OA0#0p^U9Y%(3KHY}O^~01rU3Qcd? zx+scS>WsEFGqJVMw;PLDzn8x6a<=D&nz>Fp8xr{To;gW5*kIzLr+5HK(^puyXR-BCbyy!6V5!55hq z2_2+mDhnZu-7%Jh4*wAJ4|=p8*sGEHF<9a6NA8J^_QX_oWs8o%@j zAxg9%XJTqlviqx-d^Da^+dezl5pBSVTotJSdlpzR_V&$d`@p;HkpQ@%5eW}cl4 z)GkAKJCyhSdY3>v;4hOUEiKd&CQt>|76YWgPd|tmw;@OJ`l?48`7KQndT38X1&A=j zo`()N(f>j`{Y(8>K1**vXWWDc-(I=;dgCccuy<`EqQ{D}3G4*+RJ-`q1!`I}2VyZy zK^{f(q6m0KGcz+vNMQa?Rc2*nBgoXTQMNdYu?&)6ew)-D?L1Dz@*G)TbjV^$jKcSq zSqtbSDfZZQUYnvw!@D=B7}-BgIwWT+_e6uM*!m8LR|`GbCB8HN7=Z>*yUWlL{my5j z`O`hltfbZA?Ixg{K|{`B8tz7#*`L9{*3#~|lrZ47JUch)EaCh@e}125=AdWY7Bb7} z&SLenqydtGGwarFh5`-IaITM1sK~J9qhH8(+i&%>%MJ~@&S_|9Fps90-;aO}{mQUq zBRI(*j^_40%q5>;G8QNY2Fs1u!6U06h$B@PB~vt4maYnTC6`rPg!~gx{<=A93RrQ- z6(;Sl2>8EyvtJZ>$!LuxII(NTT&b1&x+O1Uwcpzj8lykwcn~A>ZP9n(ZgS@2gpr_U|zBQwj))NC&JK^~|Rp=wJcHuyH*rdkGuHoqr zqFgjP;6uzd)RYygI4_hqon1WFZO4yvA1&p>YGTZk8j2TZ*a>s1$mDET(m&FwiDM(} z?LzIS#z5$*Hs;*BTNU;a{Wp)JH$=pqb06nuQ zpvx``rzSKQY&dtSd_zzJBTjZ~E8+3C6S#3(3McS}1N#7mgy=Hn%OCcHf(O%D7Vx5m z_G`U}*TM90RXQM+?IAL^g5WD%(-59zVi38m739{~BpoyodMx+L8yt9ZDB@M)*2>d0 z*_L5@k!zCv12HX%ldGo{0sc_(#g%uvOXKo z^xk`OP*`BEqdeBlLdqX!#l6-XFSB{Mu$R+p;Xc(kL8-(B2=)M`!eTs zr1Q0P_;#ZKLjQi$&_kXujfXm) zGzRmm>GW^PmJTbrkmKj@hDJ_~vV^gQffR@RqEjQ2a&qyBKjPZ?636X&9}Q7ua)xj8EAyUbT`n&%sp#;EJJsvTGSWBSA|D6zV1;Sq zqKqVhdPX180whNam4E+#-cj*t%@$bJb5)s|h6EyUX<%8+?t~2PCtUgXN9y`oZc7aQ z`%iKgQgwHwbyRwDBQ*Z-N;UdDFh%+(WH;An-}KOV@-24wby4bhbcHrCM+71_$L`8r!cfshh4EStWu;~vb$6tgWsF9!NdnPk)6SR z{+n;IWWWqVG5Pamhyoyo4BEffMK5Fa8dVsQ zTp!t1q2Us1pMZYPshr?s7}ED_A@F2Zpr8xSafrUtCp`11r_3e10V`^-SEE6fzYnWs zxl)(Dv}$et%u~6p9s75z|5Gq?cymW%!TO&ul{c-LG>Y0ug5|`irlwEkwq6yL^_I|6 zV_F>s57c3-7{ZsT9IfP4HfzPsj@=LP&bqrt@-n@mi#=y!ODcpd;(Wj)qD*X%h54H! zCpN~NOilYe;eUw{u7hXilhqe+KV%vuX_Fs4L8}N?{ z+DP%uH_Nlmj)uIXXL7X$nEZbi0n_QH@~+&i#&FVWJVx9|m4R)^|FvyGIq0 zTVv!KPE*AuVE6M$@L6`@rkz4Yy$UrJ>EaYHB#Qc1YFIUXN)H4%wvZ$Kl_|xd3>ZJf zlmkCI80REEi|*07OFA)6A$gsTCnFBZyF}!@?)&|{-G%0-KU+k7uErLv+`T|j*W+@dYLjD$3|GPFsQ=x&2EEm0fk2{vTEG# zv(j>blHraAu`L9H7^QEtVNzj=Ujkt{hb~Q6RJ1kkg#)S24`h2v*jWp|87O?a*J1xw z>ZL!|A24W)3mDs+wS3%3aenuk0yeyzrjnI@q8_lz2QS-QW_YgyXHp@KUdpmr{rS0# z|D6oEUb_@?(m>O0PgDKe!;7)>3m-iDZocnzEPqAp;F@ymCHm+nEPa$Vc%TrOMk3qg`6)_j>bbj!>F1ObJ{1X$l-;tqMa2iT0Vk$EnLvWaFDl|{PZ3&Q(Z zvliR_yDy(Y)-o!)!8#Ei0zo<^M*s%*Dp)|)?$%3`Yr6bv1UK~K$@Clkw>MNUy$U>U zd;%(({69a<%TYd7MmirOSmGETDxn711j3nZ=nx3DFJ$G)*i6KT0otF9;Ash_i2VD3 zX~%S5_gg37rLI&F>Vs#ago@rw6pjUhkU`vTO}-;QEM)ZmF{Q!Pi|NjP2bc7b`cDoN z2UUuR_qIP)aq3)~9}^lZ(HMEb>0a+SUXejBS7{DiNP?IPCajNRXKQape(1?fvDi7- zZ@1iSPqEJKFB~m!k^QQ?NbsA;MJO9oCWhhfyw92|QV6uQZ4;fmb><7mT6=-9=3akk z+@&|fqiX){k-+lB zc`N9h+!(t}@`45KEagcT4%+)AH^l5#=V;W? zZQ4?2vbnMv(*FJpcf#H!N$9;)hRKajvgj|=kfd<1L;3q{GLooH=jn3m3+P4~B0D2~ z#gQEuZ43y>g90OGJ5GNaek xEw8KNyD!Q6!hO$cpP%VrDy;Ian@A3nbwN83KT3nB)(D0OCqw;t>D+|{ z93Mw6yHF#G0#7E<{IMWWF9PpVEs}}f;(tPe#`S6K<1)I9KY0aVIG764G5K=7QoU*4 z99--6;RoArQ#QpBSdZx>$P!Z+C`T{;SPPyf%k%T=H=7cE}D z&V(roy|4Ldv>$K4K3e6@8|v!~$w%LN)XkF;ZBhoDFVA1aZ<=j_ci`W}7jgoZ(tx*{ zncB?=wsAh2jZ#|gT>%tx6V@0BWxF)I!KKqKgTuHtHEiza$Jn&@Z^}0n@kq{Oo5k4d zr5CC0uf}8c#XeW_H$mh&I*qf5@b(DLVf;GoDn#`FSZ3*{vH-4Z$~blr)$FV~Qi7Ya z;_Xz7jd3sz>hMxc+~n>EUarB$v8+ZgbsiVWdZx>E6w))7P_<5A?Q6@m0AVv(K(M~w%G90eI|_GRAP${kI7%9Ib&D%u-@@k=9%s&an1`nQ)8c?i}1o>aZ(k`IRA%HaANFO%1TGeuhn*`8>B=seyH)(`?hP zrYzSz7#B~011t@ynj?Q;)-k*bkmTB^X09-%*gkozV&wP84z0V`O>^G~J8YR52;LO5 zs4{RC2-h3x+cXilS;gJCJt{f{(w!j>@R*qW*2I?W*jMW{DVRzMN43m|-2sEe3Jqo% zvaFwZ(5kw7tNK??%;SW3MzE>n%lmg_*a zvn-;T#}V1?ot!J+(Cf^KwvI;@u7D+E~+^Tk4G&KF|?a9eu8Er#Z#fE5IIZ36{>c-KM5C`Hj>+?M9%f%VYV2;-{hL| zlR9beyE1Tt|J+Vx=eULJ!WI)|;`twuARhqLEpnSQ(Jxd!1_(wd6{L19CqxI_bd>XR zo2VUXg9szg1=e}b8%pGs>GcdF0s~CrDxlf4zSIvC32k{IUF~elF=Ue=%6J}we}%|N zpFl}{ZD7KP?LXo4~0YCA+k<9bD5h1y8J#Bo-*Y= z$K3L)b0s{L!;ysUAjBM8=-8^UUias}Fg0LK-oC%tAR?MVbHy4(Re@mgwV zu=`982PV&*KVN?DBhXFtE*TeMxRna!H(5&rRA6(Io z^QB?r{e_UxxFJQh@xIB~$RUY(a@c*h+oX~}f-~eZImmr>#K#IFGUctcTjhg-O4w7j z^|4h^lg;5r*gxM>^-BX9wl^}(Ze3hlDmo7HcdcmwTKTeDDkYA` z(TVGGs`qRi${)6e^W7#roZkklXM|nAT}`xT1*!YiJ~V%QDu$#+-VDF0mk#*ImDtcg{ok+y-;yy0%R&D}sQE$B z1_EAmzA@Y(_LnM~rzM>y{-(NO5`M`i>9KaYYki&m51um#)PU`|wcu*=j;5$Dicfw( z%HLrbFSaX>cAO=s{HChH88T(dVzE9V$j}&x|Bp9 zsT}J!^hBwCvhf(VT6`Ly%0x}HZ3KnnaM2u^y#t?q%=)29NEZ(g6NL+{=Fwtb3j=hA z60w8ReV0*WaBQwv4;<5tx?=Jyb zuIy`j{aL>spx2x1&xf(x9n@m>RJf-3ltE61mOt)V#i7&E(7H9`M81)JY1*CR~=U&LyRlfcjfH z$AmeTfqL8i24oih<7963UZ-mwWJ8B~fAU&>_8C>iLjNPtyr=V8mbZ|CgF>fPI4I?d zr+j*cYHaMdy&<94RbzarkjlCQkZE`YFyo*QF#|KM~GwKVY4TH0L`1H*r7| zwO7h|1W%A!un6wrdU z;gf5?z4wrH>t~P|xckHX zUeOat3)!Qa_1w|#evlm~7a3Jp*bIOb*uhY^&Bq5=>9(K{H`dW&fIdUaX{M`xg5PtT z^8FSgdKEZ3m*|a``rabYFq#qJa?>YqT|8kvCfEL|QuxCC#-6{v*yF?3CUv_3q$w56 zJ*d_Os)Sw&y5AP0Eyqid9g+wDQ!)7^IHHmL-TaFAFKq+DoxH)-FM~(O-35E`!rLD14IA_HS1|yM8uc4rkB=kMiH0?_0ILjc2xL78!oPGQ_`ie3 zLPBOx`sh1I!&a>*g_ExwY__@1u(>OsdIB#|JrapGR%p-VXOeI;1;cPJ&=0ep$PmWo zScmjoz2D5;u_J3G4nRJkgocx&gvZ8u{~Vit3U%9~ON+b429M-q!D1KDpJlJ|90he@ zrgz6~cVt?s$3q@#{6Hzw<2M|HEK|KBKz!wfvpgF}RrS=Fa4}EwdTa5(o#l-%M^5}Kf1DK`airEobx^3 zBkxVt2yLES@CUFk9$hmkUG|+N3jMM7@}(7EQgy*{5Ca{|37Kop8x0FT9AgW;q#PwT?D|%TY4a(G zwa5@)9M=s9QmJ-j41$=g6@UbxF-?_X-@_Q@7%E zcjxRh5XS|a9KwT%ux!0v74~?9Hh;8Jpt9oQx&qL;Ka6qJ8xZJz{`2B!#!8cQ`-uwc zwPtzxd6^f0=skG_V&6=4KG`oWfgnmnK9j4D0OtXz%bU8e8T9*O(8K>uXxqmN;lV4z zeO7+Nuk{3Z)Z;VDjmtjBY&zPVlKnoU$Evfo>%@T(S+zwqq*YO3>#UW+m1I-mPMW!I zxfCegWjD|Cd1e>Y_svl^#qV+GN|c$YFF3{+zM41e7jSEQUMrAva$NMKJBuY%I3t%2w8Q^h>DKpu`J(>>WUlHc9S&e zoYRgP1puW5qoQxoT;Kbviw8{eXakT zK08umlU+JnUH$CVhx`}yR^KGYfSlj==ST1&y!`rA4b&XD2QJ4STh;mmq+#dFHyq=0 zU|HV?uH)*t{w8g#WBBEsoPRolfWf(}lDvPM9Q~$F zvgLG7BL9mIr53AmWcLXxTsLB%WGj*QLQHj2ndJ-b&O-J|&QwEd(S$ECu!a3brDQQy z^H)V26C*tK`8Lta*L||{i`#Zb7{vARFUhfuSHsR1DlJ!+hzmH6qWD{&{l26d*KbMI z4;D(ux|x3Y9Slx2rkb(dR#(IT?Ff&qI_wMedU}0!^*cN(*U=PgGrpDmX7+*w$g=4$ zwRv%|^kt5Q;?cX4@P>SS6ufo4kPc@te(}FVO)2C0```F@O zg}@Qw0fpP1J9s^*By+{WHyFQ(w2-O15U{2h>`+pmr4fFBE(E61X({53L0SK3p z@zNg*K2*bEt@jUjLo~G0A83gnnrwRy@%><@bjEfQ1b+>U;us8Mm%M-K(&)f;wNK{R_m={0|>KaMS$0cE|MB$WOuY zJRY41j(T5ZKL_&ysW<=Hh{$^$m`zGm9R2cWW3b?f-|nghr5*$jOA~CBk)kpvKKmt9!pmsuR3`0xGF8eZX{7*{vZZ28~YmCwd$?em{xggCJP9sP56(NncZrO zz?B5}W)v?42X(t=o}XO7;X1itd#0A>m-k0;F5Bqf?U9+CoIHxlbas$=lS~r9^)jdE z?VXDo-hk-lih05rZ@NHD38+!n`3xu#3@tvDu`<9?xXl}ZHktL@KF^B%n4&CyM{+S# zc+s~3ku}Tf4#EX0gr1&w`2%oHfMZ%v>5fV!t-i1FD=2PJ#&o2}P}A)|+RRqoptZ@* zA~#+kq@~Z0fj;u30#thYa=+l{Wj>_rds)SX*Glg$b*ancS?WT0LA=`TRwr-pcti}2r@2bavg?ejIpJ%;hFsyJ+I9+i<2F2{Lb7Q)l^Ncj&ThoU#TicKfrmEi#y!QA zg6V*Ph>6c2)OUR=(|g0ab<0dN;^u#87cXsbTX#xF?4fU~pbxh*nzl0_LFw%#Ajqcm zh_2|^go=uJ>kecw}`7#|>A zt1P%IW3IcFoBOB#mbW{msg(|0%WR8MtsYH4kC>ja%?>y_te`d0+w)ZH4rZuw2M zJ1k^lhsnE~stl5@d_HLu@VidtSjR1cKqpObXX{+gPFz8Sf3z;R7|ssA7$kY=DE^Zim_ zYoI{ra9K5B{1|vd>IrY;;oTc2rxlANYk%c1xYsUyQl+by|EZ^Qig$nIWor#K8)IWS zbWCPV>A2_wklcK|Vyd#;t+S@o0zjp!Zc{H+Huwq=@u+WYfwTvpC`AaIf)9voSprRM zcznRTzzh(01f@!tg{?NuaTDpRcdp!DOi#Zbk*+C{&b4}FwN~+5xH)&ynYnSenWwF1#&PI@e z8*99uh(iOJ0y0~tKi#L+?HI)`JjkMR+&t^Cb!|pov51T)#%axe@Y4gsvTVnmGD92p z&IPl-h1C=2VW#js7X5AbGPSjk@`1c8lN|fpHcq1D+oCyhTU6Wh7wx^*YcgQ(3md@z zpcrIx0G)yp@fCKi9Wdt&Rm?bT;pZbB)xn7b@)LPQr}`XF54khE)E$Zw%Tx5`2P)%=hkc-} zyVbf`!B=k7hxuTxgNPkeSZZ=G_b(X#FlN#K47LHV!{2_#>EKiJ={z=ON=q!0i7 z%CJMh-0&*s!i!TM>`+Hzn7>f2=tIW*)|C|xKXCha9qN+@0kaipMQ)s^Mq8mFdB2r+ zt}(cW0WZt~IrCQ@Av*-< zHSFJ}?7T`M^Z|IV(bW=jU62!Z8}%7l95mtpYr;wotdnp_Hq#1y&YP6UysP_5yDtBO z5N>L*d3pU2Oc5WMyFnFD8n4#@5-u-)y9Y;@YEs1>fVe(L-H`$~tobmDTw^^7$lS;L z5rh3dhQY3027m#4!AgXh*^6@VkD%w4&z(p?RW5^#U50~ttVjOfOOeoycQJi#75ey! z>DMM{-DCOK+xpvupKB3g<#w8<*};jiWIilnt@u?0q6sil%kZa=VY)>pL8pvgu9&n} zCqOt4t@`C0M0?EH5o(m&>KPB|)*)03Kg`Be!2&( zX9yN4R*iebpa+lShzyOn8R$gFcLptKT9$jeSI-=)Xp$_(dlIb=imN7{9yGtdKcQ|m zX>)6e@$&

    j29gR*4I`a<92?^4#&+dP{g&MLcZKor@FNlpTCpMG+NRwzFEza7DZ7 zGgcXnrAkwA6crW9ZL;LdISc=#T#`#QFE(lJ>+eZbMvqff19@Iqlq9T2mg;V+YA<=A zV#{GVQ`fe0e}bFE4|%yBn@Z*PAmUAu@I=F7R7e}vNRH~Dfp4`5;m@tZP-T5s@jr-G zxE$$EcR@wZeY({6%QcKgq})?nF-rs5Gg_>pCS98Y@P;_3s-lmr?MKe_P=hmAX0(&6 zQ_=zuVA^w9miuo$1x(Q%TAUH^Y?-L>TAxDKcxdnE7<_kfBZvUJMX1rvdlbTIW`^C* zHK;E^3u64Jg)DNr``vMvtD>@;OW6$sNdBvkEqjOdtRL>((B6~bGqEfU@QTVUe&o2 z`F`U`=O=C^-O#7xpbH(zvxM8@zEgoFT_iF~Xmh_`^>O8S=76se(_S}2nlw(jMehZj zCadp4)VRtpoqNUZfnou__2A!_i7q*E0v3FydgnhxW z_d>S*Yd;yKA9t1sX@2A78doD6a0lo(k%+*mN%G_do{Vai7VkWybzbgZcm07dc1P>- z3M{D#kw-|ZkzosWV^?;e%_ub)9K>Mext{ zAfWp65v}Eu)rA_sGG0G`-Cv8XER2PA4u4yF`{Co83AaeQ054o`u@q1-dYi?Qt_Xf4 z2UL1lu0nC;qyLF+LzAAtLX1u<-wTtVWMW`QmUHYCvdn02b=WV0hOILKy;mNz$IccV`sQOj%2{#-+cT4`5=otMwO;a2IO6-v@9F*qH8Fvbl+lZ+@w8+-E(!W=$9#4`l zizEMDDtO)%3bM8Ec~|S|*)iwNmhc8`&0OJ5?VUye#e}{5>bpuD zRwcF|bER1&+?kdjTov#x;^n=0XCoJdFm{&r|jV=;#*Y4rdD>s zzd;4SLARgP8OFx>)MIxMV6HE|048hlF1G<;{t$Ctft)W`XyvjT337?QqH-M_!0=@k zH~6j?M4-u1wuC=p_WdS2TWbanJxcJXBSo731SFIXw-pwAAuQ}cX6 z=dR3M17>4;v5O^+4#N&D;&U0wKh{tF_{mbBZ4H~$R)?7(Y{|CR+#pT1&})Z%m@~(M z?5mbRwTx#g6bUAf^n&7l9yn<~H+8Ab6SyGokv|T_wi}ki>dx#7Rb|#=Lmyt{h*>|_ zg&$NHWC?sC9~nqK;oW8>nzzJ8>|C#D@TKUdxn$bqejy9z(TtxJJiaAG*Qf7Tk>%O< z@i-LY_YL=UPVJ&^S#3D6(9#mpWVn6K?~_V*$ewh81fV&QWp9&+gWEO#dvf8ar{=M< zZ`OT{y9CPD)9WW&A{aUs4)UK$MtH1+F9cnHR|8f;Vbie$>^7}af3NcbB!|hGK;t1L zPjyOQYcDLG=x;cnWY!|4EzaVUBv1|g27mdLa5)(c7tH7{A^l@7>Sa6|nf1q<3N&D^ z#Pt;7RPM_QzfyB11dgRiecS)Z5@kWCDW@(G*tCgP9zLnGR5fp1HxAf>f zwTu-Om2qlZao1*_<|3uAO+^w$tMoR_4Pm_W)etAoDO%h!!NXhC4U&{+j?wD@7J`pA zI2kGOd90=AVbnmg>XA9TkUz@ydB{|W>*c+U{~=U#p0ouqO5FS~XW z8_8*|+uyGUHj-JlSjks>AO6?+!k>M+P{Nem*+(lrnex?InDB;9&gRhl_)V@Z|0mI# zy1xg3{(%-^|H^P9U!v6eO_zl=7-MfRWg9djh2R|q; zDtZztX+B&m#d@A?fu%`{PpHBCs|$1fsAa8#2AoFQDI|qTqly%YW`Z)=G5)aQ1Ev#? z%*cC5rnS~Y;W(x7B+cRn6Omv^I}|8h2N?*=vx7_&~c+){?R-8Pla&Y z9$a^UQl$2Ty8PN&W{QRW3;qMpLQQGplyiP%WuPpLRkQ*P@1zIe%gESPzOiJx5n=${ z??pm8WIVyR=Nw8J)l!(2a~Z2)2g@dvWn{7+sa8vn-(3y+4CO>3K;7Cu|3ilR}Stzj>{Pi6FfdU+Fs=T=mDY1{IsT05FAsO-1 zyCht=NKaocKFckMkc_%)YW>-`EC*WX4?0mfhsW0`Ad{7C?_En zDSc0VpMq;qX#65s2e%Azi~3Io+WKv$jif%As7&S_1My>lLk33BhfB!Sh3o5IVpIrr z@64=t;YD+WV0xdF##}S#Fe)f-U}^szcl@K%Qro-QFrVG7F1pYvlNr4Mo`}6rV6b|Y z^Gn5JW%{f3$>HO(tN6Uwz-i#l;PM;Hn0)pX1lw;Mw~E`^#j3g|O-H`(6SWe3$!w37 zO^jauaCqpuKEh^T%HFhJ_2v#CWBJRDR2EDN!tE$0IPZDAN@ro8?k62?x7E28?kY$o zkk5U?T}P$iRrHj>;;w4pqQ_rE|956*|6gY4it?iKyWh;|f>W*$0R=LXbp$ZY4HE#TLJ z@Xz=uwBT(=(qmw~^9tUp=N#71_Fhv_9Y2Wvdgm}&O`Ly6TWVWaLrd9exjE?-UqJSM zr=ytp?8m*_M7v2|Z&y+f&@r+V3zo%cJR#3nPsZQm5gqGOP+8zHRR=1p+2RSwMH#U* zp-KKk{ttsXsttKMb*FYpZ#k~-JW$+z3>FN7_Nr~yI!AE9Zi-~q*MGUMTvD-mbeXth z#d_osj7VB_bMHGj@ZCB0tz}-&J;T06o6ggsYOv>KCAJP7{~uTH9Z&WD|Npm*ibPRX zC@Lak9wSkbl@PMB_s%hnLrP^!%H|Zwj5zi&%HBt0oOA4T!a25M9Gu_dRIm5vd-?s} z#pyX7&&U07zu#`x+x1}K^Ez2qDn~ zJ!S6Qx3#voVxfP|%0HLpQTkm{A)LU{H1i;l*JmiKs#aJ=!5@i&%YjtGHqWpbE?u7B z*%N?Bwtogz4?L`{9Zr^lhLNQ@}9bA(*V{_gTke!LaT2;RS;FxX>d;5wA9|+lG z(hOSk9{_XDqW4C`#aisTbLTBVeF@u(|QeONf__J{Db^xNyeR`*34 zcH!xu!xwwC!Y5#;+DexJ88&Br*g8?I{EcJiye~2&{?ZocQEz-7929-a2vD4=&gbWk zvzk1ONK~wJ`2*bidxS`onc-^h&f+3UYd@)rRv=QBoA3>u>D@EDkY))T=^|b7ed7kh zgCYk52R~J8B@qOBXS{vWkbb#zsM}-$s8{_9W1pB`WI1~!wl=ybzw%jyGsd!fm1p*z zF09*RfNR|6>f`I4`DH<7n7{6{E=5nY*H~#+PU_X|{F;(cGD|UOsB3Q~5%`z=?!xH6 z$er79_p)Da3J)6zwiA)1p70nH&K?%0&!Ja~@$}w#n55N^YvV$#AmAiURQWVo znC3jaF0;Dr4mwk)$0g|{aM4hM+aPSI>|*h#&!uH`Ekq8+E*1w9OWpA0-jKxZ!cfTEr#ih`1Hq6o}DoahCD;6Sn&A zB0Qd5l2R4bVCjX7rHtYfc+1~hu0it5(Yh$^)a$t`tE;Vr{1_Ff&8ua>Sf#(qBZaL6 zg%aeK`>WS@GfJ%i4^hbr(p^HE`!PGC*5N|Ye;h>RLVFR|@pDDp!s$b5ape>f(5{#H z7{X>hXY|G4iygz&d7Jmn@n>)@wE(Vpot`j;kpFBpfBtss#86Yv5sT|stLLe(BHdN9 zNMQFusj{WqeEMSx)b)!`isd6`X;BVQFSCqWa8R>2JfBD~n58!fNLHmlepU6wEhc5bX0Yb!?PSZ2Fy zo!ytYiHWD_u}?PaDqw(Tqou!E9t5W8-X??^Yj$p+uE4hriRP4B0lkP`761aAieCjE zgG;Hm(=HS%2ud31Cb|D#oeoBH{=Qnm=NhcZzVx;ulIihpd1h%c+1&0*&QLPi(!CNx z33_EPDyh28ap1b(%r%_e>tC6iD8Ha(hSW-rBfR8ySJVkyp^I6sYWm+Xx{w^U_VQG` z|Fk^(H2P%&Q}tn;P{ET$>Xhx9wmj(M32}}>*X7~|{u9A81kDAs>k%2Cf~h1{4FPa7 z-Rt~5S%q-ohZqT?I~bVlH$ZqDb{Yf-*@FPR@}s;kmJt~L>6u-5%6Paj=du# zu$<1i4$Zd~p;;t~Ghx}wS8W(d^-b(j{~KCnrXUJ;`oFkYof2&8yA0U z3wzZ1*b3XXcqM`JYdl76c9Urm@mjg&C{A>w-jP|G&UmAV8jx=g;7ni88tX4};dJb1 zuJynl#na#adDBmtR(0n|WzWpdiLW`h=pgiVmaZb)>@kbQP@gs?|3Hy*^M<)pDu#2t zacj0*<~j1`420uk!zLtY$}x}zMyC-653n~GQX!Q&4Pm{fWN`yl z^D1{?R|(Tbs{TJo4wpl>+uHN_0M8J!)VPyxzz!v|6ga~H;6l1Uoo*Nd4G(IVTv$KDU|fgueWWFhzXrtU z8_6{SCyC;<$!U3;8K^nw!)bDkM(tb|nGgT@$)?pPI-){jNpaEF?1$PhUN1V>o?<-; zk_N)QzB3l|yFvy-ph3_`Y$0!cbDr|9z?D6Z1HzDNS%D9#EIEw@fM~L703aS;x}a|A z6OT>mm5{p(Y#YVI%Q+xO8@j^3fz*FDl&PFM60lY5T99avYL;vYKpCqR*8&QwQ5Rnc zZk1(x;)@!P0x^?j1oyqcHU?)IK6+fiux)+p>$EaY0V{sUl@krS4x+7GYGxmrS_3G* z+I_}XSpl@QJHJYNbKNL^^p><90hUUZ3#Z>pNjgWBWWm@@3VCs7$ZBFV^ogIO$3oo4 zCk6<#OB?banuYew(TB#U4{_)X72j+{NQ$9Ar!QgJ#rRa-dVwx0*6NJQ0AaW*dl4kJ zyqbij2dt?vItt{?{m=GAedA;ve8PG9h7v-FJo=?a?@9#LfWG@ffvs&I6`%21SIWi0 z0VPHL4uBjpVTf>(p&5Y)j;u*uGDs^C!u#S}DyoL53drku7_TK{TLg)m`sanVnUe(NkB$Tu+9(0*|>*~ju> zY7waDO0<%57vc^B$8UuKk&lm$7M})^j&qSuf4t~fSy{QwG6MmeZ;tziNw-h^qS2C` zJk~@C-aZKV|D(Rg^Je}{!oa15HvO^i0vFqUbYdoZvv)~eo0_hg3Qv*6TyujhQ8dqa)6e~pSKL_-)8qZq83eF+E60#`R%(qzg zF?9Ed61>!x^l{eHvhZN14}%g&)f6euSk5z;`TQAu;vS8~80;cb;#tFf1Rct+yf|h| z(@-5mWRQIez;UY8?D~lnTh+T~#^-Z#KsRFU1(lFK*(HuXg@!MAk%dKIm`>-l;D03% zNJ|+NzUZIx4is^xJTk2sV__}l?C|Ip>>_yhndMX2K&tg(qBbhOsWq*D^`T!JnHqR4m_2c!4)BfkH zx&s=8(;c5dT8SSX6_Gl=PV>+&K?6+i;Ut!s#~T^|vF}QZ?$*^_33HKCx`n?Rn-)&$ z0sLH9klXa_Bcv~@4-UpGK=)se#P-&<8SDFQm}@}+Ne`Z;MvPNo6+hKCH%axQE(V_E z1|}r$%6$^9(Rgev{y)XUosdR9S!3O+%oPKo2-Wl=h@2cj9-E&?X*`b9f@5pFZ8pK1 z{;TrIy=w4WJwMfkS2YC6{{(0apLWgN6IfIKyTA`**ha1rt)KrYP8{HX&--hnOw=}1lR9k1G-GtzIDB~w*Csf85?)=ZM&JG*m-mo&?C8<{TY|UZ zRG_H0TdH@gV=Q4&@PJd{>jeWK%~7Se#WwHk{dE8(5c=FOnUrz<+oN`_m!8PDDd{{c z2xXViqEb>xo}as+}Cnvqz*N6w3wndc4OO5PN;&$3=mjVwobE3TrlSVfwqR z$d!FgO`SbBgK3|=8!OM+G4aTcI>#+Fwt-zQydaQjbwOK)0h9)_F2;_^4nSm7_;Wn& zWs_rFWr(TxSjE)%*BQ}TZP?K~u=?d$lVN4Jltw^f8cddF{V$B5h;4(lIr0I*w0*9a z^7*=tt<&x)O*3jiIS_xt80%k+8aNxAO9WzZOBe`2z&cMyghScSlC;1>Zd1B;Zh=Y! zkx(g4)fOVX)j zd3#0izqckdn+w3#uE1h^wGN`k2rTH&BkB6(fMtR3raH*++qaT%Yw=V!8WS$p-Uq}W zy`1<6#xKV{N)mZ4P$Lyl<6T{Hk(jN z8$*}gaTO96J&KPl0b_!vN@t|Opy*YBn_Fa~-n3mL?krdbUDv1#?nbJEubtr?YYo-( z$QsQroD;a#Q-2aoCMrUft~a7J8f2M|#h*@Ni>3+aYiwZ*;QLnvHt7K;g{FIUhTP|d zwD+AS0r{acfU6vQ5TsN)K^jbef}hgh%t@=lZ>{H;i_=CdtNHy@J5Rm~(ikpd8aB0l zbGamLXrsmgI-&s|7BnZz#2K~Vx*vJG#kJD>sn$eA+T^h*$ZNU-{sXk<*V&ivzBk(n zC4BQ+pW{fhtaxu5@?>Sf5-5W#pBu~X{?61x;>x~xUC+bjvt2TvC2Ho_`lypDpINS$ z0N&&-5_#jqbY%U@0hUzXsW5OJv2r#MOCF}aib&7I(J+yFh27H+X`uCXjdV{9}ogv@7`PxS3ewEI}+2@lfpLf#67IC zr=V}UZh8xp24HZ!)hsqeC21io`lSCA-_j;g50si ztK~rTxEV^L0v(abY+J$)iK30J7@z~R*D{1oFK%;%Pkrg|$^(OF>H=U-23nAkNc3{Q zhijDHxjS=QW%_%kU+DT@vpD)eC~0k#RxDTQkxYImKG_UVgS<+jLDca?vM89Q zq)i1F>;7B{79%HJN!cwOqIZ1-6dpSSJ4N=T%IWA8e9!@&bfD?xuUiRle$>6?JS-+k zj=Tdo0LhT+q4cYv4a=3_nYjx=j3EVI^@AhJ6OA?%n@U?OG94ORC2QVj<6sP4jMyoaws#n|RkUzi-pYL#OG zM&94%lti#w?Psd@EHM2<@9!6d)E}&7l7wh^eYI8^war;}f1qg;X-wV}uLyx#Prd)D zps~uQR~qL=;Qgk2J^2S{w*z`90RC`SsXwuJG?0$7XbG@b%GdhAu+s^c`S}5$u!8ka zbY>bifjQMrwFx?Iz(SW4XPam5!-`Jl;FbBQnIh>8PL#YT{4L}+Gi(d)@IwFJOar$z zfP{fNokLB_hlVF53s)wbBYvRC=$Y$IX~pncpr8Hjo0NG{VJ?9L8Z8M z35rV7yWuviwx8tqVyRM(py)pFoKxFepe3R$1}>)rIj{F8w?UO5N8}6Knu7C6-a_Hl0`$xP{l5*)OKs z47wHeaLIY^yXj7uf%QSSwd|f`8Z|ddRzUP z6t1N5;H6?!Z%emC;K8sNJ56iqYQ7+mW4Dt+szRTn)&sA|l)5bnetc(jxT(5N^Uz-9 zP^-tGp&2u%Mh$5(a9`%}CoR~aV>{p(Q_4MVaUOE5CEHn@+uo>(v6_Lo(QmH&*d959 z38rKI7ZMsGE&G&{(Ul!>$;WO-p~?N2gBu+k7~fb8Q0rtMih}^ehoyfPYjULmh-L<{ zNrJfQYz3kWcT#wOr`B6i{419LIA{}M>J8c<{>B<;KYv_TpKP5@_ZVm;mCibsFTVdr zi_>N!AZuL`Q}ci+)#ruE^#Zw%#Aq+e>qcXxIVbfXrpmKuZ-0#gmjn7@OVrds(NaP|?EdRVnIut-ZVr|b@` z*Y!P4-vmf}=IC2lhZglQ6)M4lcS+m_?RRaJmwM5h7M0gzk6Ma+=rc>&|4_d}!(40H zTT8YoLbs;*uOe_4m4=($LQFy?AAMK7l%23=kojC*|I@y=2wbajr^6r`HI$(HYTJ4k zUpYevP;8;pL{PfQ#r-DU-BL(D{C?oKUJqW4>SNVF?zSoLSC;g^DYSm!605d(u zF*nv8BZ{;OcGJ|o@lsd&~1Zf3BhS$+C)74C+S#=_g z{@HUupgf3YsgiE>^0DaB8Y6!*=8CQ1_G<6hwScEn4!{(_0lXft~v*5;~Lt1ny~bRd0k*)k&@ zOV)8l^U4QbyUG4Ok8}?~TC1+ohOyKWy-&SB4xA+?h?tLYFe44<3SAVDPjv61h#Qw6 zC+4$~qiq7t<4k`coT&0<_tj?BH%PPsB-MW*m#S4wabX6k9|nEGI7pUWhaD`zU~lK@ zvcrw*S3iEurF9F>H;jE5QK$J}vYe%?NLv#BoNcc}d=R@>@-7AN(=o+`74$2YITA>l zajR}3(wTTO+U1pAE7+H33i$U8x2D$~1R)}yv-LPdyMzze?JeYaAii?T@fH5Sll?A^ zCs1rtz6Oz{4lu*yW!KIv4hVh)xxTtL|DlMGwDCPLH=c%~kg}C_-`Y+{A@;c%4KwGz zuCuh|Tk_(&e0Aa_RHe=rxD4gZtAIRPMsS4n*7<3M2v}=>ypz6L2I?OMFz}GqNV+u|pR zc1&!8N-mXNDzBJ8stMY@KVk{TuZ{`22uPEybizEWglC4y^_INd-abdSaJ7fOaqwmHn@-Z;ne_>sS8$E zx9hmr$v{h>;tLuq5*{UN=)HoUGN> zAntuywK5(Xh6W{DKfkSo-t_!*hx6M<#Hn3*|_OhN+NgdzZU zf_Mix?kOMHFAsKV!}p$=2vP7(p;b)*N>B72{Y+nrIyXQVtLrOLg{h;BOTN5)6JV=U zM{=ncjW>rey@SACn?3Q0UO@ldnCfp%Vvfq~(qHiu`4o25)-@XUruLDVPPc2*r9s!= zHm$dvXU(OKcKd@~%9wesKM-Ly0Ow^fU-@(&VZigPJW|!_wyXF9-5}ChWw-)yl6Gau zryf!R6u#eVfQPZ%1d6eFJkX;cT0hC{m;8_?y{Grhe)VD@a!8ME1xqeTAWwwF0iFQG zmIc>(JtF8}yK$14vaj9PLLosc3M*&X6+4U2&Y@+UPnuTv+9LwDqE|qTB1}IW(f#5; z+`yT3h%#36%IZRh=XDA$UUC%`MXiioT+S`%u&5daVUnD_UQbgy;(8_K5MvQ}bF(~s zp(!|NW$p4DU}&yilRf;eRGvHU>BZ6*QY`slX1SW>*IQ#H>#g{=OJ+&8bM9qTa6Dxp zKq|A9y10|Q1G=uv(XWHtI$T{zMw*Frm-^hFXyVxbUS5=2t7JN>Xe%a8cSFuT?S7H+ z%jy`XoIg)7Q5EzG5t45`If@V);vI16 zH7q#?)OU{`iiXY|0J;2CcnJ3T;MVeZOxAk@9%=5v?@ZqW$)y4Di5U}^wU^v`m#AvK zixvAXP72dXjkqgIzoR0t>8QCQ8Z+4$W*l$@pdx-_>{@kY4~WuE-I3!|GV!tC>=^2X z!_4}~0^2g`+U2jV`!sDOAmkuS7nO$ciEXJ^n6BM-(zL3J^ zq^Dwu6BDFuR+rs-+LV97{HC8gbNCWXIfr}U*6yEGp2kGbEu;@AJB!f2k_F$OH*HMS zzqKs1f@d!Ri>LnbaB*W3Gz3Z?V7XKrUDf9PyY~|p$|wApulDR7fI;7eXn-ulRt`JN zuGmT9U9(bG7D2zmx^;E+k0t&M$axJ)nR|E7(vvSA^h+-Gy=*T@<}6OjQc63IG?$%y zue%ogi@7~!71Te)(IN%uYZ6>QnTNfR{-Bc#CzFiK1kco>u0d9d}Y0c zOns8>2H>V7*W6cTiWQq#>nC`bhusvmtR4?A1Z}Q#!K(P;seVvfMut#a(6d#HU;W8) z%4{JbD&MwlF1~vw)!sVTZOh&r&7KJT|*RD`Y_@Qc49Cyw~uYwe?cuG*l` z>#O$2jt|r{sJ!U@{xHR>I{oCz^XE%(oP`b-UK)I_pWX}N`f}3B-GeiDoD9;k{*=kl z!s(gnJ0OnEOy{X?D87m|bkF?kP;qp{$fZ{@4nahKi@nBMLas7w%|3z%ud(d7VM|Rr zo&J~sxZl7>G8k9;*~R#GS(AbO-y1L2B3KV3nDov_%}3Y^cZzPHYTt-`)c9dHTfPcR zNM}ACxg!-USR3;#nwx_|=s4-re%vA4_T_Tp=MSE1uGBo6?+ZKTavl4UX0+?M%My@` z8tHO|9ojlB;v1|lA+^(&P{(4nzhLl&kM0Pti5x&t1`Ae-3?bWrgLBSq5HzuuZ0dEr zG!3oj_(gW-shB$HSAx@sJg#RleSZn^6YtEfyv}V4{L4s0aQUK^?KMT5olsNpk*{}d zo}xn0l|9+pi#o@X91Gm#3d~8`4MfU<_@vL$!M;#wk-5KTB7+U1hd;vHt20JpILkol zMVmz-cGUAb?>`W128YUFweQwE-FFhNQ`^;64gh_xyT#iRZC{<+*@A7+lEIE z@4{Ir<|J%uM>0O-_`!0}0!n^hTOs(nA~(8p##`;S>aW02bwpeR`7_OO|5)mX`}zlV zXU)x>b>RbXRDDda zA+aMDpExZT@uFkIn$zp0sR&p2PD8oX9e?e`4q4#?1(w0ps;gHE1+Qb{+Li{_calYE zo{+2%SF;T(B9;Hc6ufmV9xEw2^)LnCASi&4Sz`6*tq}-c13Yj8*RLwiA4s5-m-)^+ zC)59Ijs|07&1-AMF;GL0!5l_7hSs@UW;KtS8C(sF0?qRFmdGeQw#9z4z<&MiA*X2RvUx%-0bw^ z<2EFuyJ`GdKu_ky)I4a9!=gFbd$@HwkX#XjEBsMOWy8-}`D%O1PS=4*2p9JAyUuom z!04dIOO0&4W+u2+w9LV&?HZeA7|v_O13BlljsH@eX2n_9IowhFe%cOVwSw;{yO46G z72?W_t_ESL+x0Q~ZnMeDl^fw6*dL91`!-*A)BLRNWV(zy!gkyzJw@|f0-!F0F(p=4}GnhRY9J?LV_+4rTO7MW!%__ zJ8!-Y!_7e`V@sFj%a5L*zgndVOP+VA?B#l?zv#viPQPpEQk0~>a9&IFP+?_Ho__u} zzr65i!Z1+3oK^Ap78)Kb@q+xF+KHzg?}FZ73PowTLxX|i`u9=Mo7|x|n#2q2EdbGT z5OQ@dHRw-rM55Ih6DCb2i`*L3L#ofSu{-yJpTZ7y@F~5~?wz$%Hf;@eaKiqE8%>i{ z%j+|da7gR!Hk)D*VD$#V(0=87wCm|yD+IiBJ^v-?aiCq?3E-w#_Uo1o+Q{U_)G}o; zedzRvcUNrD{7^Uka+>K!70u97#ekho^YSf)PZNFWB4x+j*(w3@c1=c(J9-*&O_6na z0yQO$pwe*1746n#wvpEnkoSo8BHidLnZO>rzd~S3iztD$RdMgsiVtD_yBC5y;yxWE zl|0?X=`&)1*asjvukC5Y11sEIk(%Sf(Vols<3ZyeCjEx$di_fvp@gCO0Nu*%(x^%M z+xn<2M{|TwPfW{xbW82r*_N(h0rm>TPSA{&!^@-hF&?9Q9`Jt$w4c+|#0&ebPa`0N zSsMyMqS7N}P_lJgQ7A+AT#l$6c^Icx!06RdA5f~8w_2gV{ymrg<|B#Yd4M0<(onCw z2xy+H!#C>N>)QdoTY9X?$1`SiJZmhz&+DUU9)<~<`8}OnI{hmtJgmctD6#YK{B`*7 z!^+_JszKXm{lCpK@e?~S=+DlEY*8l-GidOU#(V>k3;YC zqE7RH7y;hRNA%#-NV{RU7EZb~mW;^<@`%OW%rHk1+bNtx07)>|zgk4eyVYen=>~iB znb2?hP1Agb@7&-mKiL{ut>=Qe)TI!z`RI(#B0R5|DXvrPP|dx|PV{xos(SY{=2CMX znxza0zt;6u)Hi85v7|lg?{_-&$lm&jQ5E7O&K+Zukkt4cSdxYu$I&vOL7~BBQE0>B zDLj`8+TyyqX`xZ{t5v?eY3T_>#J)mc`G>;8cQ`~=AkTJY0cI=H0ETl~?mr;-_KdO~ z46PV22BDjP`~DboP&J~&d^@0K+{9z9Nb74uP+n_y$n+-WAEXAW7QgDv($hZq6Okro z7Ahm(iOG8L@wSp?$JQ%fp#g$-2hHOd-QH@Do1m$^B|CdYUc@NQ*aYZ&A_(!?&Y^^d zeleu(6e&BM)Fa$x{k-Dmn5$j|EOnbjT_d>MRsXbo%DaB+&%QFXZQFaaW`6iQ)Auh) z$!}j8n6*wYclz2shd$EI{I1cv7Ql+(IZ?%B5-&;eQrkL= zn*+Z$rsk)26;0#E&oL&%EB{z@6nx)5K2&$s-rV>{-q&+u<@7D@8*v672VXph zpgey0)vYu4>7utJ}_qYsME@{40e=yZHi*X6jkasi4% zWus&api6__3w2sruCAAAxFV((+1_+s za7A%9Q!&{c?h=CCs;BJ#nNsQ=Zn!b7?h4#n)1ix@b7_uPJ|Vt?!BwB!hz{!j?G|iJ zpyG5Fq2|lyn7z?$tK76ROA$2KAM(!LWPcTCMd~=W)RB=RSom_)M|1A_Gpg6A+fl>8 zT4!r*i{#&>7IFs7{Rj?KfBWf{wd{$r_9L?CZ07xOPTzuKGO7}yN{63@Z|SKih{hY* z7B_h|zCJx5uC}ez)+(zos{1HYzWI8-v_*P17s4p5wHvuGY;dIXk*|rElR>lDI{aS` zRIXN`nBDG$0ot<&&9knb@?#PCX7w77*0~(%Y?9RSBn~fLv0?GB94WcTqQvs4PgV^> z)Mx=H_-6W{6OxZS5F#8`4Ns@UT+^J1$ju8=0pZ!>%;&6_jEY$(z~{{QzZ)Pqt7A!!S@AiQmz7|44WUA`JHR{5Y889B^6Lo zyeXWW+24lz>4HDBLq`|J_^}SJ@=e3zY*8)r!_sOMBoA}`PTxhhJpS_Ouu3AE2+F_Y zsW!uKwiRTF{Rl)+pyHA0<(?burng%jq@CI{NhNLlP>@Hz!^>sV8Gqshmw5c*ElzwV?zc9Nm=%BZ<5)8#!U1Dz-=DCWV}40crPDBf!o0 zK@@RvG4z9n&}sf*2j@`YU0Yo@NnHmM!>)va=%~1@6OZ*Yrm`J9BhExrLUhiQ3p|+) zFn^Yp5Y46;4>=;*YVFidiWKkp=DbU-`>;G>A^>^Sa!7FV(U zz!qskSD(kE1h(d@_bhYluXD5v3a`rrxwS;4)r~i9rHy+H8rkU=9x<6tj|tq!oa9{g zRrQV;3f@`{-dzfiG6A}t{(Prl3I)WyhNTsqTsf#E8xEhr`o$Bb{v*-RuF7SXxWyD# z%YS;T^$rc-?;cpE(xaOg-Th~aFSk#+%%KtHUqU$F`Oq&Q-wa;n#kER*=7b$NBV<-n z=@@636h9Ey%IP!ghqguY@F$mG^Jk#kJ_pfOqqBd0LZ#xNO^Htq(=A*6L=2CG&i7Ikv`+rEx(omSy#E?8$aREpLFYcm(sQNiD-G| z3pn5X@TFJH0;}UC{}VTa)(RPy6O?^oZ2d2NTUN41NV;I}vw44P8iZ?)czsRkS*@ya z8WPUO_u#Kq#$jB;ly~B<5Z{}b!vSe~K;~?q^lu{ZE2;8nOQogS5k~U+0oRB_a+ztB zc9AdRxlVpvR)&3&x6T^rBp?ZYgQTjTkL}I~lSdx0*WUAvZnsW#=PfbDUH!&du&q%R zN#J1Cs~2F#5M`5y0R1Mq$X|k`f>&JP+R_z^RP3qh@v1R*op}8Mj~Axa(^;=|pEe7& zrVm6PKev339}?$@l}hQpdG2jels@E$Y^$|@+$PaV<)$sUfwk@_yU`^2RU5-JU2R(7 zD%W(_Z<^~|+A|06D2tMP=z?3&Qc~OSmTQNe~>R(tH;jj{Q<<#!F=?vJs4<5FB{XIYLaMn2T2x=6R0L4+-?Pt6{ zp>X_0)e&QR$}SQ%@N-{=STFXgfq#7x z1XncsA&osDTS6(dFWOyF3D`Mr?BNIjQi_xtNtPHd(bWXlR(Dx2N8?vK%v;)_NeevZ z9A@)vP}Eqng08+ydBhL7e-4d)yt`)f)bm z-^rnPpyayJ-UL??61mdD2147R`jW7F=a7-2%8)Veod`_-oIVG{Tj6Y8w~9xYc`W5h z?v|pLdE(XXL0r>92?VvPYkf&(5BdkZSjUt#pE4RfdPpPiFMcGXKSg^ZK;On?ZRk;u zybj{_+@(TR9gXsfARpe9o%=3H^un5k`}9owhpZbHHhwvxzfQw5Ple&#*W7|T?E?piaj8w%rlg>eDF5ykdLjQWLhwYWhsaD8D~Ff=CX(Q7--Z!C!m- zZ-t9HG(|S=qj6);KX#uNNPxOMev{)k#S2l1ttDReba(G1Ddb*Bp(>LG?MB{QElDuL zvBjnpkfiBcyHcdkDp3AD56iS6$JVn7U8yq6i@qt}#jeG$3tAR`TyuuPY5~ODNP=^& z3E?3P@@D=YiQ#YIXxW9UomXRy$a3dPn??#gIdYm80<(lqtkz#GNol-7cd_ZX)m{#; z!$&LZ{uaBkXcz=s>oJFuSBRUKb*E55y3kDJrd%r^eqKWoHs2OVj9Q3?kiyh#!c8BS zua?C8k^cSWx=3^^C0h&@CLiMcUIbiN_v6%yevb8B9hvGQ8)PKu2Ks-6e)Q;@Sdc7K{DLf&`OTMWC7x89dX_nS+4>!>)J@ux%e zZ#q2HYw4jl<^RiJ%L}M|?D=EmPcbqYcqj8BU+pFHAKuK@I~R_-cb_mT0>z z8nH+x4KgK!`|HkPGAGPF``X?QQ<3cPKLHa>&eF4Pf8eJf5t9{PHpAb1`R~FDxt=Ls z5rtNKGw6T!9MJ15TMM{Vc0aHA=U5sx!?y+D1 zp-TmdcGk}D?pHUjuHCEgTQ5*tu7GOPLZ{wB2^WZ9;BE8QG53tIcE_>9#JOm|u899Ruy;sQMAc76Luxe5(6!CN z*NV_wcS)9`)!tVuVYZWI4@IsGXq5os{n&l)4|lLRKclbc<>16XWJ-laiAR%~Ut7!V zG?L>hA(*D~|F%=0%q?XpOa1_d!{q^P(%G{HIF>B^oxO)1V50)r%3`w-UvMpW;++)2 z+P%!50U$9$=w9Mf><2dOdk{-h!gp$B2h(wqSaeos>lN2@qkAwVp;C@Ay3KW)eZP4L z^=9tBk0asUzKUxF%M*b&H_C9P*4i*g(qrHA4(4!%GUu(!VEMlRAc@iqZh_kPpXrX5 zk}8+Bn!~)*Z}9P>cr>5L=gUV0b$yl%C){Nj%J=aHzQ%~{g8yxJ8WPgQqoDPxL}0JW zzZ!U)r)m9U2jncm3VeIySM`+kgw<1lwSuv1+q}&(ic5gX7%1a&c+(F|Nl-XYfM3A@ zd&x_?((E8F`l&eKlDO`kDsUp`f=;FA7#2OS^G_o=f4yyL?Z!0Zwdh;*7i#~E^~M9Q zly)=I%SF*ncTlEQuLNjv17n9AMUp1P5;mT+;5KpY%c7w?WF^DvL6blZYW#AC&`@aPw6 zKyiaIqr4t`E^#-A__Uz(&$7)~kBteijR`C~jmZR=HHYn66vQIVr~&?ls~dhuHm< z-2fs>n*Y2sI&bPfrBvN0mgd+C#{Gw~#3~T{QkW#BleFaz`rKol zOGml4Z*LRF4~XuSAh2`6pk7uEWQk3JQIPb+E0#NQ5f<;GmDr!B#iu3hG9VzS z?%?@kz@at#nsuB;!F19Dc-d&#vlo($Tg7Ff*~_)Fh9oSx1^Ogy9i?CCq4(#r5p%LI zG2DKYO=^xY!ov+60G1OGDF$%QQ{R;yDw2k+ZsfO0y|_r_el(K7u>EbxaR!($iXg`R z_c?Ml=^vYtLj?c=5`PF^Ib_d89fHM2+C?o5EhH^&L?ostqr!wOM+|V#A#BvqL68(o z3dk;wkvf6>Qt*?$u65UEaQW+G`9E0DR4*~7z7Y^*ME524pn}R zGLU?93Vq!5tYd)^3x>TE185*tU|4#d5<%HNhqOZ%9{JG3pf)(UtTPp+6?wsvyC>c% zWci``wgd8EUKV_B>zg4pAF#aSF`{;~R=?z}^S`nzX3V5U3ojju6Vi`s(6BCgdd`l& z#F)H|A?aA7o1yitrx+M4xy?7V(=LZVB`acR5FBopl2-${uVNCyZjq&{T<;avDoMgV z3q&E4&YxkKPnA!Q1<3-&qG0B4Nq<|9ir{QbT?RTxhrlk;*3y92dn48|y$TCk7V7tJ z+%|bsBKzDW>ArD`RBRn}TlCnTWUk! zm41WVdq24KtgMCVDubPBUMh2250lAAMUW**IFOZlQ(SEL+@p`xYSp7xad|!S~BX! zTCI216)Ed0n?*sR(evxOi$xV4XAQfLqGaUWd>3-@t*6p;Zn(^&TW8?|L>uZ3>0$l+ zt@?S$r5wI*>2MNez-~g8=y|5De(gii@N3^iufwDuFeGvEqA9dc?HR|q=4(-er}`9w zX!>853-6V`3}ou9)lLsfT<&GHnvvxd%Q!p4RI{J1t1Vx4HsepP-0u7#K)dQTp%YCm z4qEa;Amtk>f*7lsWrvbP4x^`KXa_f%Js`i|*zIn$tdCTukGrk|O%ZS9#M1R9;3!;d7X@PZfB^LzW}te%5~ zddFA%05yDHv_Wj?YdUO%{vGtJ^i#kwjTOV@2Z_r`Rslm`d@)leH4(EcDg(xMg~f;< z9yUK14cD}HyB3u+mCav{57YWznX2JXIAn+Sf)b(F2@VhDUbKx{_NpK0ky50lMyHcI%K(kAkd&@=86bU?}TN26ddTee=jZyKDvj( zv|63}P=7h!0`uq|?1!Tf|GG_`B`{nz1+H^bR=N4FlLzTS*0w+@n(Z}4+Ft7hbI|B4 z-`_)10(_~iI|_H(8K2m6a@#Sy%yUzD-^Wac8JAyvd?3#zYjm*6P5J3Oa{&)v0W4ae z$x%+EwO$Xpa?F|nM%KOQ<`f1t$aH4WR_!tzdc*uCb%P4!I~roe3d5k)^KcziwVZ!{ovltvFrZ7L%Tw; zRi-5|nQ_m%rR~w)Zmo7rcIZ3k@f4>6xMoN|Wct^oarWhgJ4b_p>gso=UdslKlBdY4 z%V{1vu;?u_@cpP%%`uQfouRq+;I$|Zwo`6RCj9s8#(clLumfgs56(v6zkI@ewVsX9 znny?8NxtZ(8N5XnWNNLBu_bhGFW(+`ooKV`^Q|DE;c{_k{e0?(a3HWe>kGxL8|4&h z^nA3kjOqAmlK9Ov;^?p}Ak@)3!3f>6*y2bRsg3b(nuP_2dkh}ZdCgOyaXX~ zu7qy?@O87yv@p4p$8YI*ntnaM6zxke7C6&4n!#C|`jjqMYspUenQG`gz3dxC55IF2 zSn_rr4J!OPpyJg~!AalmfhYDmCHbT9TL9((BU6G2n{TElu)mMDPJ#Foj;d!cz_dqJ zok@h^4_UB)x+_PN_T1|4Q=*wWg{JCJX6KP=1#vUH<(DfH)bvEC&Bm}L>(Xp@2OZes zhu|dum!#s;2afp*88G{9>n$wt2Iu9J%cykz)W?~exNW`8oa$gY!8;IKTU)5hJmc1p zSor?#rlibhrH7U1&704AUE}7jJ}_L9v5E{TO|UM@{;nM69nkT;_0Cwy2%r`ee-O*R zcK-;h->H%eaX1cy`x>W@*_p2=4-t^2W;CGBv8X6Cw$C>XJ&`2@S6qt(LkL+Ji=pT%QCf4;Oc!QURt zNkNyp6irfXV@4rKgC>Zpp%t5_d|AtJVU@#$$e*wAv2fF(X@+0Q=t(#HYEw|tH5Cen z`NQ6M1@x)<)fVwh=xgR(XZsT4&RZNTo$fbrzn$kGv(hLKb&CV zsW!k}Hd_oYis3#pvUrmA@)v4LZj|mwzVTOx@OQ5f4g=`>2@* z7u@qAc~SeHE;kCD!MC|o)3mqw~lfSKM$Pv_X6ygL5omxHc~!h9#cp9^tnT|fEipqjOa z9B}L-`{H&9GKRvl`_(se*-VwNkFu%9P}@b7$EXUQMPICH>}U_O;YTjr5tGu2cE1kZ zQpw?#H??sjM;ph-neeWr^B!sXNYG5B`mKfqq`f{XZof?ApjPafZ@=)Prq8cE-_`;> zM{weKpwjw!pNh1+KFRs$Yu&=ZNI5*H-Q^L}9&VCE+BqVgj`oF&>e2`XVA`n9M3o^l z-;A#|kZa*QVOr_5XA>A_A8Zb^q^^N;(D%f0+S|h|Fw|a>_nDsYwfG7>mkYXPBDD-t zQg_5$jB0)t-udN#9%q~!Df%g})jNi0WZU1*HSe)h!+J%nO1q+ZWK@XlcgkflYPX_l z$=0dIS~5prqGQ!8A(=jGIa1Rp*22AGT(olcu2DeWfvFJ+dV?3H)X)oj-fh;5?O%}_^<+o7 zdp6+-a~|loa8eiPE$2UG=Wkwq*{byq2?NJO!-zMaYG#=rNcJL8LxX2P(i4|;{%0CR zt!$hicZX_g{T3~f^K*%qQ#=#*)0)RkBC!o>r(V8lT`JWlBQ_{A#4LcfF2mXJFQrDr z?WC`x6)7*Y1E!cMf&Vq&Ncu*WFO7YaBdG7&>7FS^{=}G4{ z|9YytL^r33Edg`*XWDbxA7;xZe_piM|B~Wbf(8qMyB=6z^SbK~7VDo3p5v7plDEHe zPxg)^=6B@b!s>ZW*5TH!fJhJU=A9PmOhT zAg2PCTu;lpg+1ydd&=*=E3!@`-`o7uaPGaGa|R|BLuc9@Ah8OI`##mJuV#14;G>O$ zt~F%wy50TTy4{2%K1Agd3YpOXC8tWsS(syv$sFczRdUEFDQ8m@IW-J(R?Im@a+qPU znApK_!yJB3)%)}P{Q=#y?e%;;ACLP{yuz3bIhbWxYP^4&s{3<-$ZDS-kfY@ndTeQ? zeue%92eUe!Gd$Tc5akSLcV@sI{2~yGw!9Z)1BA1jo=X!%I38OP>r z$&f{w>4!^d~^FtA6B$p)qImyQOp40CaI#r4li_K&!#s7$6iWSoG`N&$-eY3 z`K+cn`|Lp~_B;rK<{k~Pg|+7%$h|VSx!Pv-C*UTE2CF|sl`B$=x!~~l@H!|zse`^6 zbmB~lyOSAi%8gSIM>zI`cl2r+JvvOu5H$+&P}9pi2XG0P`O_XJbQy>ko*Aq0l|%2A zIy;7iH4R46=jR=a2#w%7a?m2PkF3*higbv*qRmpJt?H$JCc!kmhwUL89H+I%F= zA|v&u(aKI=&m0?a*u?E)){7)iTLbJayXSAdm!{szhhEG@)P_oNcnZg-tk=~B zipB|X$>wK!d`Jan%g$< zw_$8B@qf^KzmBLH9d&}0xMy_=e+IYrdj*~0e=;YgY|ScmK&%vT1eNyb#BCVyS%auwamPsLOFwM5%qA3c^D}CnPqC^4$_ARs=mnb>IG! zKKZ|}pV>pD8ljDEkAQAQ_fv5Z>=bw5{KIEY>WwAv+1z}4c1&IK{iDQRzBfEd+%1h_ zB}})toPU}hBPE<(yslu!UrzDWhBE-NP)^+qv7WQ&a#Ap%pf?0ZBTp`e>Kl9KjB9EK z?v5=W&(L1EN293WsLob3Qjf-Mc%w+8$AZ0H7t)S2Zv-KD59vkM)4)ioU{!rAvEldv z`b|EAKO^5=7CuHK+GfSz$`H<9Q~P75LY0j=(q5y_4Si~lhR`2Y-K8WMzS*5v|3^0* zyPfwVCx&uX#r*xqWU9sN>o}P4(>@TCX!sfA$zSrPSrM0LC6bO~FZi4#lg7*O4x44C zw|{+*dqRFC$iv1EA9NN`p1G?&Afze7{AzLbl7OXDX-emn3qSGHKX${%Y)3IKnCu=S zGI?a~Q8=D@X)xsWV~jgo1@J!kp#Q}$So#=&^giWH9(7LOIdHk20QpM+7q3i@_4U1s zgBX=w(`*CSL-CBS3<9;xqcp$fWNe%u`|~$={^xV3h5s!00juPmkFi%}zi8I%Tl-=M z3Mg~4CROkNJCX;sPJ`(ZG9Fddavn@EZWWdpuRoi}TUD3RCd|t`$JHSiIMpI1tXBC( z>_bzML_r64OlEPWlUbQP+Y~}yucuhn`Cz44;oSeR50$l)6Zl|^P0{!%<-`@e(@8zB z46IM5TYvD?LuLwMwaRvej742j-cD=~CNAFyvgHlxq~qYWS+zjMEsjo5O?Ag*UK(gq zb7(ulaBR%sNfaWSm7*g1h5!CCzkj1h9xExmh<8|r8$Q?PD!4Je-2um4HQLBb>R1i> z^Y}OA(WKLL5IfVMH@9I5bAF@BE<^x2ba(Qgi*Gt?tn(~aoT6ecLxm3klE;5C%uBR# zP^3lmrA|(%OSd z4~Jx9b_Pj--(8p^lfV^E83QR@*47C*jg<*L*9jv2V?IMF=Iy*T*+Qzl0ah<%!}US1 zcjwi{7Yac+w^#SvzHBTWbfT`;hslrp#b;(L60Wa9e8;;v}WkOQioiuH@ zZCuyS@1FMe&TtO{^SDXwc%9r3%GNfoN89(U5v20$f;{QBH5AS)s(FlFNa(+3 z{!4gA!ib;rObUKI%F$v|!Tc-fKl5k`mP>E+N-EPGJ{3z5h|>jSLgT?>yk~P84D_zt zvwCe1_$o5WXR2CH08~FXSFmmo>MgHJ8xH;tC^)5AQ#8n-R9;KHx4#a9QyzsFo;QY2 zFQ8*MbJHj)K4AOx(7(1@_Xx_pVkX#1Z^mi`%ymzV}|>ine8lbBea&rY#+D$B**3G~}RO3_P0 zDyJ9!v$kytg-***)rzPSugtVf5j-O@io0#t3n7(`K7EQR%R`g1Bj;3mf*vL9BJ$ub z)ka2$yw|hUZ(w}g_?Uhn$naf^eC@}?7>XwTtKGD7mkR~~O#(SO@6)kLWsVNz^W@Ta zXJhDTj#N=)^BKN(Sq&YU7|*1AmBX>FQUJ5BpH54{`rK%we)`WLDM zgb!YgB6Akh=hhfS@PuWmc%-+UGx1=&jE`PVd#*7p;UHUjBaJ%Jmat#JLBkuk29k@f zeKVR%kVIM?L?M;c)Mm@Nlv-tq)Wn7s-`&%|JVXw1oE5hC{wl$Ow#fGonT9L-zwb|1 zsxT$DZs}Pf05hoen~MYd%Dud zq8(NU>W^vOSrgf5QK}>^Bbl+CBQwfV5{S`$BrESw_&m3fn%J&$Yp_jOjmZf>z$&df zmp|%6{SIkp1b}bqgKqLO_8e6$4Eb>5KMv=rSBES;d;xU$n3Y9h{?Y42dHyVBhN=ke z3^j4861V6MpT?Pke(*SzoHxcH+x^~DDrZC_;DX~7v^EF4Sz8Iar09!tHPWX$0%S{f zUu)67B)^r4m2>Zq1gFIu3`#E{81C*9T!ilGi{zdR-d!P;U%aK$*j!mt^TUc~(t8~p z&k#}aZ*Q}#Y|HrFvWrfN(IlDgByXz-y)~H(i?t+W9M-0+|klbAFxwQLC-Xj`hw7(zs)) z;t`i+k1@Ne@9|SF8!}-++3h>veU03w9sCL_isGVoUae>?;09dAlA4Q#{GEUcuwl8O zbbNaxT;-1zI0rJ@;}H`)l@d?w6Ucj$ItY77`l{a86^x^h^i4xI-oHL|oukUY=eXth zg6A*++qRI#pg}1tnCZs=_2^u|Ypl5rOJaYlK|I(wCrmgKe<||K-SU)kcTDR_UKsLI zRXPom*3Oo>i9`78_&VCQvC^7$?Z{sl&S^;(dytICuH##8P{AJ@BPGmO%AG%EIFBnO zaH(F(j(M9&ZcxKDd|tKP8nmrsE;FZ>Begc|AbB40ufAOm`SL~ktrsSR%z_nfXT=|I z5X(qMY$nLH&EzO-O`iMA{9N~7GHm+I{VEu2*?Mt#GHqr0@R?u@O%7Zw866fzJNF}G zAR$a)JL_3kHV2iTmr8ge^1vWAiL40Um_#SUA=Z1x%*8~w5j*nrI~%M=G~=BW<078` z#KzA{+sZ#73(kE*O^}_2$&se)4SHNcE8UTz8M+f{g(V|ac5MERSXP&QO<#{x2=j07 zAlJkDdJ_}3Ncr$^)y#@B;H7qJFnO67>R~-{QYTP*Mzxi3aCM{`wYix)IX2uNJI0Gb zA>8V$o7O1(O?IX4nx<)Cm}OrFmVfq6jGVZp>HNypH{M=$eNsRNPuP9;YeetmabgTv zrLtkThF+vq&Pr}r3|~koYe?vC|EwH!ynf|5n!483ZToO**-G=;1k$;8KI5c(s6$ZX zhzQxrYUen~dc-T_CwTN{`zPXbcmnXpjum{6&suzZ%t&!q;+GF=F`Vh}=&T zN^fuC2VoLIIHe+0)SNoj!Ax>#Bv2 zI3#6QW~mr%`fLVBuEaQj=+dftYkLeNDvM_F;;|#B`>Q`mlA~=PtJVk|4|2;|+G9I< z&y7@^dlQlkL=ZtUZhF~tAmq2uF5r^5dijq zSXJCNxX%Qe0}4&Ms?uD<^bs9e(|D#?rb5Qo91ZlmJ;5=$989}%hB>;B>72N?88Ylb z64!hxe^r^jwOdE)%u89O$1+#5`G;MS!oo(zmK(|kAC@j#dp9P5s>5+3n16r@iLo7s z+GMu#22}TD?HJS~FyUnx%v>SjS$cOJ3mOGtAbuuq1=H&jnC*2-+rbPSHt+fJ--jJJu&(coX$S&lf+ocwO`%yAT_SDjsDbgOs&0UD=m(5zk^y_<9ELj7EMUEz@p z@Xsn2AZ665ch1fJ!=8tDLl#2k9};?{ZTnk%=$YR;PJq{qx4%MM2+APbJv9L$bcHeuV6Fxwbn*ESZ3jA@Vh;7O(8 z`(qOvcr)=5*qN(!hl@Ndaa+jSw5yvi;=fO_8a2>kO_m#k`z3JPD+aSz;rIfuhq;sO zgE+*?!&H$ckTG=RqLBbEN(gzIcWym&{$jUpVu&rCP@l5Xc;2&-ZnVYnPiFqo$~L0U zGtYbOKo^*MLq(P-@YD`EDlBrftj~WN(&a3oMH0k~{!Zxzr~bLG4O5BxeG{uCJMC>K zxcegec8>-?InV9@y5b*bKpuYO<@BR=isrQDx5MS*+SC0%U&^A^5(P4_d0{rRv5A#DMjO zl$w>+X0}Mm+Lkib>REi3AOMs&Mea6@o-{y8|Wx#~q_Vb78-M)g!dt-Lf*xZBREg{lj-L`{oZ^ zWCdi4nzjQyB_(gICdg6e4nirBk`is^5 z+wQ*LcLnX~K;NTIT0ONAl~+GJZ@Uvzcc6bLyZxe48&n`9jQ98&bBf3xBC4A-{Z)CB zm2q%=*;?aMlXL#|TKq_WR7R8Ywy&=Mv-UsQ@FSURxJU4nW^LJT^TgBH%iHtxQC9=f zpkw3)lSCgaz=ibxV!qwpGFZ*w{7x}N#57%u zJ8`UQt5%CpGWErSIIP1JYOaAZ#Y`{;&GHw*} ziwQ?PbIdtd5G$#86BBbC)~>19dZdJPrs{rtnqse67W34uz~sZQYeIXqR~44sK^7fk z)8&SlKPzQ{@3PEoxH9OLnfA=(bnWm>_)QRT0hYYkJ?GvvRBe3ISqY9Xv(`^uYz0AL zSnUCAf31{ZM;t3=DroQFGkpB~XTKHp&+!)+)m_m=948b-dIH&a`yiN4_D`+%_1ywG zgBJD14^=E6^$VU7`X0f8?y^5<*c8k(N(3l+~< z`x2p8F7_6~4H*v=DueP8$Kg;E4mr$+vdl2%(WV9qB0J+oIJgT2Cpc{XIiJSbg7R}S z=2pHS7NOOb>7M&nvoXUDMK~wohU=&tidEY zJUaMKg!NTHn&{1@)nZbMoPU@?z2qS(%xw6IcjNBdkl`P$aIC}JZy>`$bD4waF%Vx2KeR`5Y4^X5lBd;o$vq&yl^TmkI;@F!akE;0YAq1nVQ=$FCV(LH}iN3 zQdGMEj&q@32<9Cly#6VBr~Hn77Q@OaOE3bD^m=v<_Dc|TFN<@>MC03K?S zP-m0hn547b=#5y0<9{5mm+l?m@}Kwn;yV|jd=hilUu?ALFz@IVtNUU5a;63$Ohdz@ z38`lzy|W&$wFF=7gT!@qvp??o;m`YY^HQK;5G_}0$7<)3`j!>P3hPhYK9eXj@hpJIQ8m19xn8 zF=8WUTixN4@N>55xWUB>IFYqdE7-K9BW5b;oxY&NLi;CtnWcUE~*9fK=1)Fimm~ z{jfjV+9248Za#1}fCVEAecK>-cNh9IA4KxSE#KaUh0F0Pbccmg^cvBxm$0*&TbnFj znE={isI-!NsDHJVf^r{6BR9Qi+&;b@2iG#`T~FO)A(k_U?(}ZonqJ&X#DDZC<`3)j z5YY@`n7oz4*h&kt1$}IZ;5dU3ILxFaoM`w1hDQoS)tXvrY&VP<-O_!mE8F%>@Jnj3 z|6DQs@J0|hu!*mAjy{@9crT%1LfG_BE%yAyWWd^cSBvFpcS71wz1dIy7&&1{Ynd=KdR zesoVc6Ygzv$LLXutd;u#`&bY~c|<_PUDVr5@_Ns%@4`N*(+BM^#o3!>hC|sj)IRE# z#7AKzFfll*%gcOjp1!s-C;v3j<{(Cf_u;7VZ3b$}0`JEj6?~*84ZaGosShZlmc<*J zQvq7&o-y@)_>%hC=Zq`RGZu;?0cunoVMwE~*| zxshzTzpaBCvyn7Ta&WnS%FfmSGD1xFdpeX^GP)9c81A@&Em~z)+1=}~uz7qtCWNM) zZCKZN@O#p)I&KXw+Yp1tRud^ee-(eGP${7^q`adS`20LseWwWMHIc=enHQp0d$J(I zG>~X5BMxaFY0LO5&n_w>HzHd zqU!q?_mQj3-fwT1@%%-!6$eE>IS}K=A<4h!8uX^;8R{du>iWe02<w#7ptqy9i!T7e$y3M{7^+Yfi+Fbx0keD8%d!ye7v}++x9hvS(7m=+(~fJ8 z4g`kf+wNp59FSoRCLsqAU)Xpv?_=VLl@IS9oAL%qNtWfZjbPAUVZrW^qGW(<{E%4y z;np2KytY;rTLy6_jjJPlCBIVmg@rvqzjLpu!`P?T#m~@RzP}iYyOaKWK>6sk<82PX zWqNV&olHNm(UER)NO;H(Kf)jKSZzwt2ZEM!ldi{n zw*&8;!OGYDHiiaV<0Q!nV5q62n$#(A<2~+l!A{Nx$hSp%eu1UPNyhj$DRjGF^ppjX z`p^6%ynhT@o=5NGb{^27NYn%qpFdSIK|#np*t2`0FkCo6h!i)CSGl zUGAvSEZ_=%vsG`|0RfOwyt!ez3ilKc8C=Lyfp9yz$**J67GEmTNus&q_n+mR0`(wt zQ<9{E@-5*Er&P_M8Np2Q46-)z(XH1Ua91iQ1!V{sfZ99dMNIcq^ zpf~lLfbsIW16LY!VIrPkJXA7tx|}c%0e4WefAX}vm?JvrGRz(lt-Y!k+3+cQHT-?O zVN6d*Xql7ppAeS#2eJTXm>b2S(vK+b9dI~444VkCFglf0x(1y<|BYp1zKLH=73OsvtM?D!!;7k0v%$iM|~LUK#v#*^IImsJQITz)9fIL#<;a8~a`M{aLPlV~p5$ z5;2|T!3w8aAH!z8rcn+h?9Bu7re;w;(xg>9TG?}~x~#^fUz{cAkT_U*ru_a>4bRN= zE%|cpd4p*sePfj=zIV{)x|T@Z(P0-a0pCBiwCgHyR+o+2{q$Ei!uwWNOF{W{vYx$X zJ}5}0s?nD9WRe#dKpPF#6TfPZG%VF<2Ej{?c#zEF(%oduL*R45zMOtP{ApvZ?cZGr z<7&DrfM@trk$txsKjvO}CG-Dhe!D6teo#ISmilxlUeR;7_~O|+t{uk{p^lZ7f_YyPbH9X!nD?`ZfJ>#aDJ zB*EX-4FTmjvI80F)B;U}o|R%7>qfa)ZUfM;E4A&FOHO;`)8V3El8KV^aenaN?c;yJ z&skwsbNx$$jpjg^ni$TW4z^DX(kK4%_sA6vN5yzfjTEZ~sMD;E??3FG4(*g%Oe6Y* zPMPxPcOD}W>sH6-*I@5pA?LY1B;V#M$-TR_?*!1ycT0XR$taB{hnC}aML6VC!KD7) z!tWs6=eB>RRM&TBriFpeD=N1g=G7xY0C-pc58~3U-gqO4$xtX%*ZcpU6!)lp^CP%! zP2HQ?jMr-15s{HGJoASo@qH%~g;Kg-PNjll&W=4&(9Z#@Xs@=P9?=Vd(_(zu#oI(7 z=3noZ>HE(XCk%2%Mca#IYcn+L3aqc*u6vdBH}17|A37d|D*UQRzL-GK?wR}e;8Eu< z5K*AxtwpUExapp9jIag#b@NO2a;bNzd*%bY=m%gxf(3;o-;%0gNxr#PQtWMLdZ#$3 zL}~`ex0P7|C>+PxT}`9u)w*N$VZdnp|M=BZKKb%Uo}CzbNT-ryZ^glHXNQ~ty(x0) zRP*#VO^|;}Y;2HpI#_M5F1dKj;l07>Y+x+ECB<6Hv|pTRZNw?}K-dmOKR*e)ul&Zc zA`%lAtJf{RZB^RCw;U_TMdwV8zJsgi%2(HY_AFAv0|jSh{mHG zw4W3f?tWL~HA%eOyN?6H<uG--8pwGz8ypII7Zk2ujm0C1Ig`!FB( zY_28?Bt%3_1p#T2h5oD_D>-(Bha{^fYagR{>*4$&X!G9RczS=jwCcK#+@#*`^CS3W zW#dX+w5>}?t|#KvXLJxvH{HylL>x6>xQ&&>DQ*4RhI2>q{IBBD?h~-`n z$7mOe@bR6`kT!ZCq~$fCVOp>hjD8sjW`{NaTX4^>0iD{+6hhIVEmq1NlHKW)kTK|D zTsc-^ig39G)M~N;QtLp53VyMEc7+dLn)of=O8hxsK*7y1<@-9ofFqd^=_gfXN#U4Z z%g+w2mF$#i+p+pA#i3W+H(x=3inZ=9=%+cJy(SfY{Yir)2R|n0&MkuM3J*aR1Y2-$ z6L!mB*yp2YXN^vcu3VI&rPe(DOEtb5mJURYk2^IF-|_l50ztr5o!;Pu8Aei;+RK~U zpnxZW+gKwpy0qkmj&}mL6?cX2yp+-?DCk+Wnv+!w%mUL3*K@dOQF4!ya{a<{1+09R z^u)+_)noX;h+*F)$|g+2woOlC7;)`@)gM6U&#-vaKu$PJ8zya(;{G#wJWa+imiqim zMbZri#cqfAOL^yb0We{FsZ%$W%Oc_kV=-JNnm0ny+gZF08o&JAC1DRFTYoC?S1L^O z73iixW8VynPW5$$aB8kSI3c}So@R6$Pq_573X&o%zZi$fhhcQ{X_a`emn2Q%Uz z@k}W#hEhCbu!=892o_Htx6NZOil%&iukwN-=V8sK1rowaJjMvh!0B}E9?*X9od;r- zWTRrYxT|$q`Cx4sGg?qc{oEeM^!$HOCcw2IcDi-7@Mq>vUDw4cSRk^rIsPhO`jd4X zrK+*9@tDJZtuDNddx1fVa5uEPb$c8Iq#;_8iQ^krU}Uv6S-oS0o}yK0mhF(mkqw(N zdz}~;qv8tP#5d&Pbhh7T0T{O0YD~k+xCgpS3tU$9X zyM|dCcfQ0GDV!Us(hssGuEon1D5Kb^D4$wDk&K2oAbHu~^UwGs@f3H-e{auxqfSBL z{7gnB4`D@}x;kko(B&4Pg1XP5JVg|!|DmDAb>0kSmE;v$cHAeUtE!x*of?CbjWmh| zb6k&GtR1>#%XP@W9u#t0+$feR;bvpb1&(M|qANiRYpuaM!x@c}Cf|JynXA+##Kkg1 z-~CZ1{<+P`hhq9asAXL#H}F$z-IE=<@k{)YnZ+wZ;TCQ8>o6urZpr8QP$>jFdA@?+ z)Gw?_;3>CZ?Mf4`p4_>5E73k>dRK-dql(vkz}zlWl(%iHr}Q})6yHgs{J!hPuRCPw z*;qgDN92CH@8OixnQWoM4~H5>6lsE8!My!`((P;t7^eD17gH~Yfiiiv)s%0AgCGdk zT=tf|$eRu2Ct2!7V1h@p2Xr~%i1}&71^;_*?S6vDmriJNb{w^Q%Hqs;_605tjU^{BDM|NZ~#csW`ABtIgoZK5x}6*8wpQ9y*+N2zj~qBD*;mRSt2 z0rhQk%$=I%Hmgh6pp2;0^fh`W4tx^RI945$OK;C=638o&EWDSN5lkom3m0~YxR6sZP|C54OH zzZu#;AAoZ+E;C5*2(qe(?q~!Yv6APuT0%kc@&4cXC1lvj#@uaF>kVw_P+rOS?N48m zdT3V>W8g!=By5{dd?1Xp)M*dK^-&opI7-{s&hDM2G%8^5639@TLqPh&o*rZwlgYG9 zhLVCee&u_76Vidt%eqN+q}8jw>M%O`G3RS?`tMue_w#p9j6)Mv!DKKZK(5A3 z&1CHSv0hRc`=s!I#FGdHmL-l*i?>JUX}p99Vm$=q^m?PGLTZ2~CgysZ!_+2m&3}gxS4&E!Ba?cXWsJ>UF@0w6*GoIp}elB$-qF>KDN*u9^YfjDPCR8yj zF`ktww;w1FM#gz}L$@??p>gjXT(uGL=NV~W0Nx6Gj};4~qmX8TXMpI~BOLRon$kLr zGwftQKD>^=)ykY2JGy*ZmZ-peH+DJI=wpM>QZ_fsAh zxbrH(u_bAfq%aPrfre!u2j|*~d0u>3F-H`yP`?&m27a-;y}% z=G18W9^DC}N>@uQ&rTa~jjhHmEz3~>2rKGX#ai9-E(AQCHJ`oOm&rHv3KIn1thU7#F~0MJSMZEt!=x8=m6ZQGqy+Z_~Ob`SiU zsrpK}eK}%{{-_!xfwu5AF0lEE)U15dZ#kV}b(}-WHgqlDLuW84l$Kh$Lf*g2S8^y= zt0Ba#(*S(Dm4IKwcs2BG9J_vUo!&yb=f(MFLXK)l_`T%QZfFQbE2@{{GQbEbz@B@O zg0MI6GUg#<2)3))f&n>gY{>n>Da4%&5PsG{10Fh>OXAAwi^%fPFWLwNlid}KcdQ$v zarEk&j9$XRmF5c$;K+PovJURbB9GE81&xNJL0q!nY4cR=fZunYPq=d4jllGOX1MS0 z)>AW4y#^=sk~@t;#6Kxc!t}Xs*A1gbeUFVG5C|C`O(Rcgnwf?pE)V(2!{@1iZe3P_ zxRK5BM}yVOu3dwlv(yBT$$PWb+{QYCx95oI7TjuYPLt{f2cEd;-{|ioz6idouXcLLV)$l z5smR_g!R{rUk?QND6bG5F3$Smb(Pm1aOR#|8ruGHK;*rAo%FFwH65O$Be`jFt3Pv+ ztDTZNZCa%Xaeu-m1#4otMhOOM7N#~*4<#`-l#*r5?LDT#2j))N3DB7v*bC+gCtUXk z)bBsu?(^uOM|w}5p=R1X!Vlf&{_S&e(^ZV`ASszvmU*+tv>V*4Mg25-$GKrOS1|8f zbJuUk1CN*e+~vzVTA*tt9QdOzT6uqAo7`N+apvkBLe#9!WEj3AR(V+NCfcfhuxB}B zZyORiV2#ul1I_i@zb4y_?G7{rU1c`SZzeTIAml4GtC7WVwt@|@LJ)vMHo z;h=K-dEyTGh>Cv7H_K`T<)5D9e8Y^kPcL>pxHHb#=*2P4AT7l?j2^jHe4t2ns;fEJ z3mIE>nE=5w4e2Tll>FE=Nqfj*mpCRN!BUtAj2s$@XNmrgR*Mx*{&|yIN1W{un%hV1 zR?_^PRK^$#e*_#GgZqZ&(dbj(=`l(7Ghl6cC0UjgE?hGDhfPyw&YzvA5A&_ zGY=fvCUJ~cYocLZ<jOsgUnp)8J>q!{69nWgdTOdWB{n0 zJiV1-?Ha``twC~VIbI~-$G>%L>t4Ym0jY8XSG3em`Z@TQ-o9wU)o4s*GJ?h9}_|6enEm>S6q>pzjjFi!=pb(O{`uudT zd}$Mqg|)<`G)QGG*QVgf=m~`F+LHh9{b8KZDpo<0wYCr~V=N-%#S@RRUVl)%PNP?@ zpeYpYX28S3=Z}VfPgv zHRss>0fM`_k*ejiImDFn_vn~pq6m#Onoyj5Z;{;kzcD?)bHNODGG93{OAgq&)4iWMDEX>|HrMW);fIr((xbh$km;rFo$%74tPs*O*BKWevjN<%!_Q#L6(Nv0< zk$0!NLK-D#NAq7s(9Hr}NRo5+XPk5&Q2BE^xmDzMR#|r!lVqk~t-EQnyVPy4@aEloBgA&i0Mw)>LG=h;lh;*<7he-`Y>cC~uA0_d zPO2QNA?m=fv+dcZ4$(Dsn$ix&2E_Y8?JGl!w2L+Ljz5Se1 ziXj7>TOI;IZQ3h-x-`{*`NBB-Q6nCrL zv{Aks0-8|l*S48WB6-KPEwwEIOa#QT=8@48?BSLaG8d-6n1&zrW|6P68r2W6m+(Y)Ea7ng>_I{qe^}JU>OE zh`-|3LK-W&8ZrJ_zjUgOO`>mSHl1zAR*=0srqT}$o!ROs)C!fZC+cbW$5z%XJj=$Y zXhaqVggK8k%q`Wqhb=>QY(j?D{q={oTg^{~2sPp!euGTFrxpGhM~+RM|1VY0Q7FkH znCm$W3VRdT%m3qboS@i#K2n5mojZ8*i55YE5w2Q4#0J4o9ZS6F2+bJmh|)Lg`@yzb@v z>fqMS9?Vh0;)&|RYf%${5mj1|iU#k6FEM8h@2w^(f9s4tfc4^SSgu;gdwqNR1N(Ql z|MmasC$>U>hJs4mXv@YlIM*S1tVy>%TqUbt7wd=_mm~AIh{*1Z&g7XFis{mSXb35{TbqF zGtPa;h_(fRjh-i5@sk!l{W`pX9*kFdA5j~RJ52XcQtMG5T|y~)42WOS*Ye8DM8HUo z@v#%3!*3moFlg>HB7?d-6cSXl+Jkt&5u-p`*F9c1#$f(|F3!+}XA7VF8y+@OT_ODx zX6I#<*;ZcL;9DCsY`*4dfp;6fb2u-89I^;S4NM6ys3cR^F7% z^c&7-SxKmu6x_j}j@}Or)ETKou-J_Mw|r?EX#q1!3HFaS>%cglN1pj|3spm1ecWfxntV39P68 z@;0qE&fy-#Y(&c*`@!;o1n+nTcr`+l7QZw>Fo{~ySxoZt|Ndf;9Ak0?J;GnEPL%u@SJHfs<(E0Cw~2EIRouQ`9;k(V2et{5uYeNX zmjp)*-jmNalYdH1WxvG2^^H;LM9X}rma1;} zZUze&CAEPZ5w4SVuU>iLJ?_(VWz=pDp^}kG0m{bkOo1a08*?M%-q1Qg-U~?^d&eeR zmuGsavQ@ooqLOCB4^f8>m{Sd$SQ{Is)?shb4GpS+ck*_RADBl?-=8uTD@i^IqU7xg zl}7)4w_daV-wXpErIgN6t&s&;WFU)*$vCQcl?8IuI`!n#kFg@2a|h#I3mnU_Tt{t} zOcHG><-?_i@MICMF!8a?o$aue7J=dLd%T;Za8@8?pve`XJ!7<5%Z&6#GKpX9g%FQr zhoSSEnZrj+J&qMYV}uVsrhKrsV62Qt9bDHKWAM(8&E1vpASC)q!3r;66xH8rP# z5WYm$(brNkAWz@Bp}3a|BB>|c%AT>C{x_k2cc~t{^>a#~P>xKH&{!E8q?w=UlxE(R z(P6Zi&;yI5dJsG`W?nofEZB-M~p_^%^ik$VfC|l7iDF;(>?n`ST`t0ac6u!12e)(i=##-uoi>F* zk!t1&Y1KgUu$rC6BReVG^5xhJ*9Z{=MLplyYTCg>kFSdeTsrs@tfqMS{3_h$;WlsR zByY2En0n3Ep6J-qC`a7QX^>-U>=K;ChvIBX)|>mPjM(bR6^U zg)XRPdO3^PmI%syEAA6m+sFL`%1&bg-Pd=|estwY=-y>4K1W2yMavFR#WJFF6B|C* z+&PXvj6vAzxSfw{k_C=sEPDVyL8a5)xmhUNfv%$qF*SjqS%?4?NIRv@^$r3DWrp9c zpE|L-WvYHbfY>~_;WGd0|3H`^jyZ4hY<}i(&zkAvId%N3yBW?Gn0k#lo0y0u)lVlh za96Y?NE^Gzh{uuL6qVG2QJ(8&r58~N&lLyu^Br(-u(IlI$1S^NFng{>j9ty1H`{bT z(QzM88D5PwZr8#lw5Wm7k=vW<<}9k{e7!X>HnI#INCYvug3FC#_jmB#+s4~JjVacA z&zPNxAqyH>?REW_og-UW&(&TpAUc{3H?8P5VViL9uWdVynIO=0ki5ZYS(1kD)U-GB z?_(He`XxD5wxr~YY+IopFaBqqE3x0!m*r2ff=UqNhHN*QFAZJ_C(*abxHc+b{sV;k zesmTyw$-3mIpXE%OS`-{?c69~(x4(JV$A%z^Akv>ges=hB?d*j;wrTnfx zw28B{8E*2zjUCUDt+ShvOgXGV8epK!Za~uHFLw&^SAxy z*Ffa-MN(sah7=}h7OWRYAqRnk*|=Hcvj7CWfoZ`&A0Dsp%Lv3;VV;l^c=iz%i+`*O z{jeDY>annmfqPCDnbrWq5K?a9&(`X0Uy^BBlJRKY1M07`R#!jo<*bO!Ze=?d6g!M2 z)}*L>f0C~iuJyp~9|uRp{}c``Jl_`^N$+FjbDlgEyclC!Jn`@K=XBt56(UMw`f)4< zK!dKgwOnc&poMJVV;6DT6kK7p^ssN^Vw_jSrbZ1piyrK}>PvS1?7QTDZ0dn>f2)e0 z<|-~59Ym29^0yCQe%?9K)G)^>^De}@*JslEN9J(D*YYB;wWza#S6lNdto-L6b9ZEq z+NJ%9!V=&b165k#F5y3AJhv>?fCT-N4Wk)9nMK~pG0#leqMEKmeP3}*TjAXKu1zWE z`l|b1UOZHsby23tp^Ek$DsrMa%zcjrX(fmODq${}cWySKk8eDY&LF3D2c6pIH4 z*r28a=suIf3b{{Pd+YS+jI@p7uk`sPrs^D8NpkiZzJiSl%QS1dNL?b^*=h-|P;vGN z$Kv{^qHkG#+K z^|8~)X*JdmrbMAcH96)4p9~Rt_+LRyRzvI?pU34fxTb3&T6FBz`qT@3g@y_XZ&B>K zsZ8Hq#p{uso;@f^1q-#_7TJ=vv$<2C%?KPI8;q!IKX~R%NgFoRYH)IlzicEBZnw{R zA2SB0DOUf>Pr-vAGKGq!-hQ1=ZP5G7ly%>jN@qU55%*6B`2dkG?^RJsmVL9b!$X` zI6CR_5Au&G^}~mxlK!vCDJb1g=1V;5eY;3ewUA;xQ1L7_{j_mym&9WO-d1{$nqA0T z_-o19JZ|P>o2l4p7!SVWC`V>xqtye2JFx?z+rL)vAo~x=A2vk#IJo?G34biofG>;w zj(?A`juShRcB8Fi0V)m6g&JKgxn1QIpk-hY^1)?HIjv;F3V6)%6gF-T(+rLyM|jLt z5TCct8ii-v9ywhk^aYxI>o?1g<}Oj?Adqe7U9cF=cF*srUOluzUum?{O85Vx>b!%R z-1e`3>>WXrB2uJ^Gyw@66cI(5$dMvd2)!ARP(rbwfCP{togj!HozPoAA@mZF8mbU9 z3JIYmKq&8ydVlx6|C|};%;+S~&VKg(uC+ePtiPl-Pw=~8symb|i+Ikk<|&Gm@wGMK}X zeWgb7y!3PEb*GfG-Ua9i^;8!GN7eL<@%>fDIq1uZiD}u9dlG>?B=$}G+Ah=Ba!t@W?X&}^U?V1zc+DN$++_AKg0&Tfg z!ZDNQCC$pR^UV+H-e%#9dl?WjUqS!QU&K)~*52t67B_iku0-!u3!q52Wyl0}3+l2# zD}gY1yJ~ruS1xTwIOFpinauP?r3kVLND#cDT;+tNy(bf_<3~Q z!1}+0{7C`5(cTh2EePn3ul+~ekU5>DaeM}s7lGeYRml+d$HH+|#0&h&vx?7^9;w4g zPrvo~qK#=MH|r*Y>S0gnjD47wR>|`dBTe+3i@XN8M4t!$@L^{TXKm%5*p&|W6<(4$ z+DD8qXy~BcIv+N-jwI{z@$WtE)e4ju$xX2!WxR&dTcC~VfBZApm}B7(!Di<7I+bIJ zmO1CiYy&r-8PayIJ~YOe-iSTLk2pK77eb*>Ze@F(34NTIs>y8|1_%yM(15cdT$~KJ z%eGHNcR8{;q6j(ZI?wAxj=kh)IVqZoDU0@rQ602UFZbHql=jA}9u|G}N64!$B|Wm% zOBN2gQ0LviO_b*=qbpih`hi>W#YXnR#V4j@&YRSEFBPqyl8?oN%iiICO6iyC`9`yT ztE$qs0BTWjWOsQ6Aw((ra{{m>B5vU=LXW~-9 z$KqRb&B%Ul3hrE35f?HrevR&bWnEJ51dk~AL$-GMAoLz%>3|q@^_h#iJzfM#2U7UJ zGRGDZImuI}h%ELOfuRMz3}RclPDOhlnmo!pt2sU zafyyoAe^k9F5lujFs(j)L|tspLmjj#>njXQ+zi-KV6c@DB{!M^ZjD$6V~&wjGIn{ST934%{sW-&4XUQ5$AR*xYQSY6I503WSdyx!hjz2x3_5}1MuoydaQ6x7 za3WeDuS2|IxDOvW5+PV&5|u7^{DVSH1WBtbN=h4In=$pd`_Y5c__TjtVVE){C|tj{ zHq8-3>ll3h*rkf&WQbjlD_FF)0sT397H-uLn2c)%%NV=FgMY8!TN}fBsF&*4D;wR^ zfpOITaAVO~J)-~DS{~sU*vcfA$oI%!1G%&-iqRlK)BGHzAWDgh+h{w)Zt-Xe)Fo4I z&HQuypPLij{cvl(lzXSQGj@MvG-vML$FVOh<3Pl@kCb%tXrQR z2%Xcv@{oCZJkma&lB~;nWNgouMxoH+r`2O%+&{grgP)&=&Q<-{HNb}n!+uD#+R9X> zG^`e1nb*f7VRbP;b0>$lBLI=pPG*EAcpanLUX>foAs{{Odjr& zF&*ULwO2$jPlTjdL$-mNZ0k+em>SLr#~L%={$9S-*ZIsudlA>4XH*wqrQRVNqObaX z(!lss?3cyLv51Pga+eeztw;gQDZtzb1y+QD;Ikr?!>^8coEcxx!05f^90xmg1H8e~ zaew5yk><>io3=>WE4o1Nf%q) zB3(2G7T)ap%2?_J;YuI|CX!OSpugtK-U-RQolpt_=Io)l_;Uq)z`*a`Gw7ya%7_?I{H1R5YkK34xFrL|nLjU*P{dY)$#=kyMV<@+7|D z<%j=Xle)B%lqM?SaVwH~FkE&RwPEFE?(g>7weu@A8?;J?#!uM2d3QxY!D%NNiTu|i z#qfzdQCIV~=|;aTF!^m)1?)r8$H=@JW?d=|oprYj*Z(h8hC4&Kn=z^O%B?cTK-l$p zy&khHdQ!~}U18TAl_0(jmPwVa+xtORGLVZJx=R-^w)9-loWRBx=&W- zW@g6*!WMKduQFxTcz~XGoEzbkctTc~xzq0l~@HQTLi1I10S{q-EtkeKxCHj*_#!75ha`6$oJClTxJlXd4pdsO;v z2f{7nHZ59(K*b&lC_$V`SCmMdlpXub8gcKdVRE}VCfgxjVA{~ehsBEj&rH>)f9ZvV z1-Ku8hKdN1E}!$K*S&(J<9@;@0Fh6TbHGtM1ft{3gyrH)l*8ii&pX8de+v>s`gT6@ zOub0qH{eh*!4{QONAE|#0JkQk=xlfVj(-M|8Y=Rp zGP<{=mD~tMMR2v0e+*>wkf&mYta?)9y2si!rg@Yvbzd&l7LNnhwcaoDeP*ry0K4kj zyJrcpnIN2g(}o5YJb?CVLbY0XCi3RiAu>Ky-N? z(b4F?KF^j)Rq&JeI#+4GqMc3^tYQa}=tr5cayT4RFr~eUmWIX+U#gOyh1TC@C22jt z&u1Wv+;dS1hLmuA1fy+%gpjKF_I%Z&o?N94&}J}Z8~dG4pRWD=K)^L>C5c)4dYVzd z;?v#|QzQ5OThukR*jQ+aG(<6$+ACNn|9;epy1q` zGI{tA`p%gb%^!bSee3x(qM>(}hQ6mI+onEwISBc55jNN(GlkRnJ7AI-d(ckLdn5eD zUHBQK-yR@_0gx5=zN1gWI&R8e>8)so0{uoS_siy5MKzUt3oB-@a zSgd6_)Y~=f>9{mMqAapxDrU>Tv|XJ}DlhZ+pFGVh^9^Kib@d1qX6rrZXz=E0ocv8_ z^@b&K&rdx1UaU|hz7~`VJqERQekc2*SbhK^CcYhPXr*OdpgX)m0{NPJk-WN+X#d)C z3=_71Rlx(B&b?OMf+y4`1{{%zQA{eW+zb2b&jkNo_yA#Mu&5N)w|Tj*pY{Fft!`VI zD?lL|Vc@KzMn%-;h16R-e%bR^N)Z1dqVNj#IOw7LA*WCULx=tD-eZJ=b)#szTi#w> z_k7&mirFfYe@W>NrwSUaQMR>UI(y*pQ?Fp3*{W{PkDBa62R4Q!e_bOI*P{OCenl z$()?eYbQMJO_6JCF29W@4UYhH^5xIzZgAmJn6+T$q;LvM!>!#Ed@N7krzNEW$JNmN z*U#%Cqj5{1rFbk*H-B|mD`s-O_?F?+ynL;@3Z6tlM`XykCXiqJZk2iSxoOqeaLB6} z7ep;zip$s*Yyg*R=&ry zZ371FXjRJ;g$NS{;=dOpzEb&ksju-uu+JPO6*bn9RjfY9te^qHn{5NOf(kl1ib(l9 zXmX!T_H8d#ZR&!m(WeR{H+0>wB*K#Oul@N(3Gbk=Ut?FSWo@-~f7x+aayPJ~>N&BC zn?5zQD%wKE4JO>rVzNb)Im>{Wh)R2Yq`Qjw8Qg)Y<)d1qw-*>9Cnb1~o*|3o&fMu!rWA(2qZn5W zTSU4+;JgtW&}RO#4ivzBmy_Ju(Q!1l!^I~vT`(nq>YVum6gL(N!*nMk^9IzeUY*ms z<5IzT0|{%jI9g56dT+RhFAsI2%IuOKSc-UreTs4qIE&YbeR=8SFMj1En#UP@!G_54 zm!4(WTz9{|zrbM|M%r7tELYJham2PirnR-hrV5}aq^egbFVnbeN~0ks>`qZmXrcR3)L%Z!_? zpBI^f#DFt}wD%k7s5gtYkW$mvHXUA~Wd;e|lJz~Z9RGPaUJ$f(>zhRyJ`yp<+%_X$ zY+Dh3cK9qR%X0;VbncpomqQ%t-T6$d0oFW((%xx zg6o@%cC)Gq&I=a`QRTqjS&noB^f8sxN%h8A+zH_pU1LyO zU|zNw=iN}bexCegVBo!W5s1B9WMJ4OxF+PQ9ex)8S?yV<%bPJ(oE9f|>1=N7Ne%PT z1EpiCSjjqn*LvMst@qcF#m@*(Cp|10Nd@m?f`ih=*5&P4_IeoGO2} zE!YkmyDN*}NNgK$&r=*!Xs1(?~|H*R?QqL$@nq`K8 zYVAD9qgmxG8N`b; zj%Eemrse&_w%qjOO?<{G_&vdK;jkd{eY`JjR@e+E* zCyc{vxhXU-&eH|3wzfM13Y^7TIt7NwA@WHItnt^Nj>tk=d%1$>bd33(o1iIU1Jr^* ztH%9Y)F0}6I1lzZ=}NvU0*n%ygU;B;n(&RKP<6LvFuWVb?QP>ikMQ_@+W+w=5wtMy zHY?)xk>)=iD1vhM@{SJI*I=5qLDT*F@bAb~K%zemO-T zOM5ATm6eT|)Ui!@(>Lw)#<7yHZ6?f%;2lXi0?n!eS$?nqg)KJEXE?GpWKsQ2S{>*V ziF1D3`C6ZqIpEBBk?gA2xK8IFxH1g%LhhA zOu&UY5oTR<)Lvdi#iH_|ZPcfzQ7{NdPKrza7|z%lB#zF8wKsb2znD&fUlSK`(lCx0 zZxpB#&=klYpw5KyR#lN$>M@@C-&!2O!WRjWnvi*C$u(I=Whr}tNQe>J&vn+xRTsd`E+y^SXxT+syP@}p z9a~Cv4+tME`SUFwB$aATvrCq}a1^$oqX_$z@M;J7Sc;FmvSHnuqBV{zUhkk1ze6Yo zAJ#51iO^4+=-B;lVT}77OYxG7+&~XI>(B+pY2>H=#MA}(s_;=PJ*!b4{&NimfOb9s z`a!&bk+g~B;_3y@GRnPRV-6xlUv+)(5fEN0)963so1Dq`dW^Eyb=%`p2KBpbSw~dd%YX zsx~M`+x4V8lWUbn%SA(fiQEg<6-z(HbK2WrW4rN-i-0x0vm5do8keQ)yz$KOh2sc_ zx%;JOzKPPwFwHrCb4V3hd4Ns7aR2%i$@#+*X$1w-j1Xg+?{k9JCxtuIj(tDfRQLT1 z!nm?+wO7#MtYLihD(ta`*h58!`)+A9vVKyr5&*;=MofxNw&90VEi_s_?i7N9k`2D2 zW(3K`j3-~Uh0E+N;=HeY^hxzuRDHvj*YfDOhrq zP3F@o6)Dh!ie6~iqwRTQ1YVF-iksAjt4&rT=W7US64isc+`7V#}*Pi4MY4M#)lIDUK1HLbI&x{^+;TKD*s zq2Av9r7w1}b-Cf-KCfYmE4U^vs-O8(I%TqC6PLeBN0(5-X&sd14E5>AYC_;V+pb@R z#)V6QgUlH^yagN3%kjyUL3l|U>6;2WUz2$!~VI4SFF_>0R0d%Ue(>|2p66I;H;IAvrZK)7tP ztLuxycl%c*Je8+KQz!etp{Zk@9iJVK*?ZQB>U8z=^sMZPJLX|5kf)@6<;t6qYZ9fw zwr;T5iT>B31rofoA!*=riElMGMu5)T4j0Et@i>3*m*XVpceSF8XUzYYo zYDq;c4ueCVSb|m$+!Faxw?diq+@pFH`20wsv;^~P&i>PQV;*Y_3>HJUr*@4xW71I* zV<_08DPmYdQ*;C+g80Qi#1%1>m?4jw;|xe#zqv2|(vr{Tv2;pr1~AkR?b1)~s!sY6 zA|;4>6kz6pNN&;lql3=wemlMU?!mzrDUNUSG?MH~j_9-R#kLjN$oUFF;j-any;HU^ z(uYSGS6}VCPM~GoM}IzRP&gaPCGUY%9hePWZW4;P`NLj9(W)L^G#R|oDMD|&BiQ`w zq@w{9dwmiw`y?v$hZ*TZ!~zcjI0=4VU}<;3{5sFTW`TIB3?G#;UmS8{*eitC0H&=;5P35Adrt|GscXxiRy@9^W{7^O6IO z=+FK5NX)Qo!1h>B~a|?n#?yPrbX*n_PJ@)g%eIfNraq~6 zhmrOmd+i4Hi|_~R&|WqQ6K1b+#!Lhs-YtK4Qv9;BN%OU^0~e2zpr1{Jk>>5IipR*t z=VO!Xt4hz0`?}7-RAV3C`*na$k{e@XGqC{Zm6>ogkgP|03GO$XlJWSk=My0-!ms>6 z6!W6uV;$e&I!4ga96Bi}iz!qe=l-#J@FL?JbF`m(ZAHD-+fXmy2Xv{9bg|rZ_QI?` z=mQW_d4{Aah!%+_JneKjTYth@`uyJQ^4$$PiQR`zVt3H6l`RrdXvh&1U(Jf$k0@j_ zll?j{J&ij!ZXDK^rdZA*0Dql1HjP?*_X7nb98NuGS?0|iuRgbVRFVlA=(1C`>caDzZ

    o^t?+E_1EbCrzDqi&NIx60?e zr&tmf2!wLS2!WN@T7BgZ$3+~yM`9#%z~|{B-Hf#tHKg@!MT+gJFFzuX^zFnd%Tya{ z7N;2JlK1w7X@L`mnH!xKvQ$qTV@_M8gt@`R@qV6*1g~62FVwUEWO0V}y<~5zgsg}) zS;^qVg~HXNK@IZPJKM<4Mv?K!m%BT8C#0|n@c>u@O^SKb%DtH$ZHoY)1Wp0$Wx}-S z&22>Y!Oi$bcJ0`Iw0oB63U5c8PMf)XVGV512NEf&R{pG^TeX4!G0d}Z`@56~)fuL1 zA<~A(kQSk~J-DCxM~Xfnor!tj9iyjjgaKtq7QVS^^&=u0Vc(*!Lr4VY1mmYNik0JE zLn=)hd|}CY(Bx5m)Oh~AzFTO_6Et^OC#;jV6SylrM8(<9mOp=+qN`iV($6rBG#Bjv zpc5MD$+u+3jr);68*Oh7_XQ6XwsDueL*&FPTts^N?pkdVE@NJrF_oCD{apTZVR$0_ z(e=?~x1TSrW2nmbPRZF}n6#V(^7Q7$wwDKe5kI|&Ioi(3VsEK=%gqNpg%emg6U>2w z1gV7a4o)lY^=vS-3TfK1*D@N>raC(YdIa`y@v<#?cu^jqd=9hY#&>v@wzm;8MDq6| zKVKlX;AVu0@{*eze$(r;Dc)_zmiiU$CuLZ6+h9K7L<&wmFuWHB5A(G)mhiN|Cx>?xw65cd&k*m%!5`N?&H%OLP z(Cpf3OORCkD@+Fi_M-3zEj3?>4HY`dt^~J8_(sGk^Edk?C{u{;+eFgzedTA<(}$|F zw;lT^5sqK#(*t(X2d3J)eA4$M{UUu1`nP@OtewbcB0hUMq}G(U7F^2qEQ~19`{QGy zo{H3>xT0`2hv2dbBkzpXu6_)BFap1F1eaf}F4HD8;nA#pK-%jmw{2iKqQ`Wi4F7&q z|Eodr1f&JvrSQjhxn84n4bIENq^~4NF9PzofDk7OtDO0lH}>B``-BwS-Tng`*Z1Ff z=fG?2NsRlP09qeV;&bL6OKx!X@d3dhkR^9x8NUJ9w~mAxr@g|&4J7Q7eilV=D}8(} zYjlc_>xzDzo^Etjzzf=KF`K+)%_3?;2Ap&IKSM`s(2GkES2njsnx?P@2MrGX)Yp*S zFDqB~xz*CG?(|_N4V^^EBGM$051)M)O}=M|#QB`js?HZTsTC z1gM8~tOsrAa2^F^!qpvR`)s;!=U-1hQK&#J1xg>hPd+Z)G{Rj)4gn~w~T1{DD& ze!QE3N54-+q5CPP@y=SH996Wp{H|CiG=fXEjQE>1kU zBz;`^{+oV%{*&LUo1LEP-j0fYdpG@p7z2fdHEzt7Xbu49w7{6-d%fsStruZOLVLs) zO~@=jQ}xqA8jJ;jrb!`NgullCAt_H>7-mpNFxOl^CuaQQ%*g606+bC=F7!`YOYL<} z)SAykWhN~jEHy>2=cgeb=q zz%;1~TMKHnKuCHF1Q3{q-6L$3M>-rRpOsMl`mpI#@i|1Z6I-xBS`Uqp#U)O|$K8X^ zf*ptN6ED5S>-UT-jK~|7eH4{W8elo7Ns0jwH@CL0vr|4I&KmDt5>(|xcaJ67-LVn_jYXN)U5Sg__vb|$g<%SPkjKa34 z!rn6>WVz+-wml4xM3^q*&5)BwtuPSa2ASx-wsCr~kKm-yeoZGvESS?SY_#2+U*G>< z?+Z74ivYx>ez;uXz0wrU59JC}GqD`v*SZXfJ{3|!M@Ej5N zm0ctz^53{gk%%e-4TM}O^n*wSNU}z>JA_wlU*7|QV@2T^y>>!nlT>Avs@ z^QJ))+pG(xC5$lrPMSrSa3_y-d>~1;4x>f~g)_4HU4BikMtp6(#od7jmC2a-{5}j^ zWI7zjqI~)-Ge+HZ^O^WRzQu>&j{KA>=j_sd`c#&{>2*`ig-7a4-%sv9%j3AEVk~v# zc;eoxDN8Fwf$ZMRGeZ&r6Rx=j_?3s3u}q>;oWbg<`oQTU5}u2d_5wk?A+Nmtseu93 z35Z&oXaQm~P3YwP$}z7*eS@nHK=t~s*?RMk96L{?HjOF$9FG4hv`@ASz_-cpxMd}2 zQnxK)7-Vh$R)(?%;MOk{ChFd0nZOuxWZ%!q1R9la*(hY$4@@J&rs0y|q@kxtm&%pi z!eaY*MEZsJmE#rzuK&{xn7<*Ih<&67X@!YygAVO3cm9|5)%N_;F15O8vTzY*36@nq zf7xpC4glsA2=bkA0l9461sV`A4sBN9XY#~_*6|TFEC%BDw3Go8=?6+M-+Y3#x(_~R zn>~z5a(P`aOvrs(Q>^=UY-C4~>2@m{ahNqJnkyW7B;_)^Jah<@7p)rxM#TYtd9@cn zmbziJONwOd0m|}gNKKv8adOqfxlHa<-zaocw6aTueAd&&{q^`3J1$lO%>zi6f&NLUSv<5&E)Sm!t))){GA9=RbOrkiNT!qJd=gU}MOtid;u-~2_ zEiAa!xd+@n1`#AMw}W;Vb6Ice*xp6l>*ZGAWi2ecNk0&N$2_NpDqT5&FOBrc?fdco zfw`&cX~%8tIpBZ&`Jdax2tcN<7d}$grFSh}$|FfoZ%I}WiRdVwG91YKJ)MbBIP z^Usj%lu3l{yt1e!A_~#$J!0uNOV+$L5x7U6=4AxXubi_8-dUev@DJ9L)t?7{Hwh9- z^O^FSxt2LSy%9Nmls1L%Gzlj&j`=MT)e~oU0@wOM2=w<)CG`Bko*S)<(J&ttYO}9n z#&$=lF3w>-evVd!j0EQ9?(JPCb7nbK@l3Q z^Db!JXSAZvX@~qEvL0e+qE{Ye(5VjCF9oP{A@T(aewJ`X?W8YB^f<2mdaj z_h-gd&tFeY54c?*6XE9VFn;V}!m?HBrIz`8yNelW@)HmqM9$T`%B|a#i2P&AjGnM; znOlW--Luc-KctfIkW7cN9vdK+x$9}tl*qr*Upu1wa`JH~VT!5ITO)h!;MHFFRA$wF z5<{i=ie2ywrjI|oeC=c~uwED*qXjtVx>ZjH(f8TA4^Y&12GqSRwdjDfVH?46LDMG) zH?>~u^9SMdds~4meLU7D1Ot3bQMv-K2P!M7s9dl`mRz$@|B+-zLR~6jm-795BJ2R0 zG{iI~NPL+6CN;mQ;$p;EHEe(ZQm5Q}$gLoo{{`2t@JLQ8oa z-|0jI^zD*YZ-hTn3xQZ*Lag?joY{=K4(@J3HQ`utGUm~6F)hK<4Sa^cw` zW8}RfdB!J1q3ws_X1BLNrzaUa9k%3u%)y2?E*Fr6GH$Zv^ zh~J1*z|08=%J(lvX#d6cgdKRLnRHo;2&?B95Wu&|j)}4BNAKAer`<%JdvJk;)-C=X zV+(kUuVKQs^v(o7!izr|L#A5l;MeZ|(kWwLRN^|Ua!%6Tw0)HE?&O; z`^O&T=I<4wS|B;CP zx}xQnkF;Bn@V4vjR3HKI7eOUVXS(i~L=n~x%cVPY*D9D%!ZWz=2OE<>ol~fo2d$4+ z#O>%jv^p*`>QT^QE%B8JX8!(6VR_$iMzG7Vxk1Y2np+za_{Km$N5#fnH8n$Z76Msa z-^D-vnfkU9w;7^TBfUdfBnpuf>q-`AZQ->c7m zFBzhv(beTq)nKAzviL{#2~lX~G;r=KZ!8!}+61<3dnPeu!ok7wgC;@4*8%pcN8N4{#I#ZYG={MN1MZ*u-Cf2DVvkHNH zj|J*hNsMgDef2oBKXJEn(Asf%AI^)TMHzgN|JnG#cf^E@-_}TOpHFM2%wCjMjdgPZ zB>MRZaE0bOd^_L`Hua6|OKB}|&PI*da#{O}-myh4o81?`(w5$(!V^x&u_gqs_&Nxe zC5DkMMhH1b8yej0Vtv`Ad$)v|?(%2*3KK}28k;K~&@4#-D7Xw`4>s>iRWp&d+HN#) zALHl#fdU17XImFt4v7}rV)$$C3WU4Cjg#9X-t?+nxx$>%>+mk;E7&N`!_G|FyuGa9 zmU4{?#9BMExpeZ@Ca&p;Oi34oof-^iKHMd;+&Pu!y7~EZkWH4{^Q&2M8g=8JLCH>> zT-1;felqL_^vMWp-=ysKg^{uKY5kM8unsEFk6yg%b1dk*xISab3u2@RE|6cBs&+64 z6|sTCge}Ig%>NBLgRcu)Ggq}t5>E&N*u!bLPN!T!sFF1}G5>lc7 zt5=2a-zSNXpG^J>-p|GgYus3REg25Iw;L$hxkEnlmE-wFlx|n|UVPu%A78)a>%ToJt zOEXD#{J;#bqd*lH?(Zb&*bj?vvbSXITx{v%?{`?cS$?Wh(b194gsg!2=?t9R$4^zE`t_p|uk$}%?IW=Nx^lSo3?C^$zGqLKw?55@+pP=lU!ps>_! zCG8s?yw=!_9BwHP|2Q*MzLH{P>(xX5{#~JEwa3zkam=6He0ppwY@zYPYWjQ;ySA>> z_C{8OWSO?Kn39oJy_wiP>YXt1pnf!~vA*9aL6-_(M2^X~Hh!x#s)Y7Q6%o()0s8(X zASiM7+YmzuLS$B>s-v&(sG6+wY5Z}sGQ8^h#>Nht;Lm+&W3wV@kD5auA>Uuv--u$? zV}lSje;EWnFe?&Z^WtHd?2O*j@BG#XhQIBD|Ki3UMfT9P{XXGnjQFZDHRFYo749xE zS|o%vaZio%0-lZ{%gusOY&uGnXDWk0c=%bP{$%iJRL1s%`&m-Mg6Z0Qish7+%&F~@@t8$0Z z6yXLBmdyk+G5q%Bz=Ee-a0j?*0s{gsz#fz0e!Q6n%Qbc5lvL7Yn&|MdZc>9k}(RPL2Zp2gSEtS@#MJ=_xaUIW_$A=$iHR zEW5H=s9Gsp{d>GoAxdd+KcmA`@8BM0nvQ|deLju{bxTx_ddvLeEEsX#1I!bb9b({; z?({(LE(xScM~cypW{|RdrL^p+ZD=`;WysGbWSxeg1m4H^QPWnJ|IVNeYHU?jt8-K_ zk&F8<4DwJu*A%optl86aE9+6;f)yJRdr-r}&|@T#oeAj~P!2KXoBNvHSl8DW!HD3g zG*BH4p9G5sfCOgCzsny&Gmr${CAYe;jJW-lV+m&zn4;f`q|F54&gv|@yG{b!_jeav7Rr@MPu+hFMU{B z%nqf@bA6|c5icdMg?%ua-fVoQMF#-V*NoXk{=dRKk~!_#PY&$!0aUF>06{%WBsjpA zU@}v{U7)o!5x4kDkK#%km1H<%J%2l7kNh)R?0CBt)FY8<+iK9r5yb;dNhhz3JaZy4&3EtWxTPOCtE7Tnplg&`RU5Iz1F40 zn$LB)a8qM?{a44bRwC8l1f!3#( zAA;(K(7f3~+LWUP17Ze1RX>@)3!a)8yb&5)LkI2a=finZ!+rt+-ni`5s{k4zo6Z%! zi~+a`+0;Qt;NLSI0Bidr1r{@Dsl&KDwBBzkQ$1%h{-w(2%-jpu`@bdL|fz- zS&^#PrqnIo`EkwH$%*%dyI2`f`j6!hC=$b(R2guFp1}xgp6ZMe#d%19BbdHL1aQlb z`Hihpsm2AGM#c!aV;`hShET>?##h2~v=C*;vR%+^J@hF{O}~L<^Z=gZyk1~m7TWKx zi!qEpZAEjw>?;|va^U;5gYYA;2BV_2aH_gh{c^FlKh@VR<>)%y>>3P&?@e?5av?O{ zoQvuRS_XZZsb!>j(BwJEZw2~j4e7`)K@_mF^aW0Ki^pAHZfH7N4U(bvD!)%mjIzz3 z8s}|pM1Qe3wh6l+roQK73a1`RNbVyxHP8_c$G>M?@=^At z<%8u-j1I`t06L=fV{=n(D`3F&NWseko2wmBlr_srt^r@%8pYAREYp)F`7}wLgEGSn z9zG~QDbhkTcWLw`Nei%db^`$Oz4sVUd|HH}gX25;jVDX>k;8}Y#QMm@sOH}0ueXdq z-zgxVCKQTJp9u|9T}k5@zdFN{XiyzRBM4T7ez{y2E$aPiMDXuLie2(w6YrQ<2PjVkkBXsGP=uYzJep@YXPy@SgSx6~VeZ1Z*=6`i3FQj>NQjT`D}egAU909?Y_q?w zoFJ$S-0B5(Y-(|9HFyOUeBQt!g(Jl2Kr#tj%!|#w8VtYsQ$=^QKV78(9!DMzZ&HLl z5y)wRK5XKirdN6oRnmgMhTT0~*%aJsyW15VI9WE$l5Opcw-mlRQY$qTZHc+jrm|BU z;qHtJoQSrG{KvYasZq#k)oc6}>e#}r>sk`s2^W~LGq2R`TfJ+PA%5oDn4B2zNzi$? zJAa<+gsUmp*ccg)+HC%wae8|*`tA0(hbgy5t>cqz_P}quOCLf}g{V%iiRZl4|7NnRU|WX$++W$c9yb0VJNZrDIYyAWavYewukY7OKRYeP zcx{53Tu)+F2TES_l1cLPEKUbc`jFUwMC&T^wt9CxWCQk;TG=@e=Z)>K%9f5_Z=^Am zoLt8;D1_j*UiW+oA|~qfdGe62b&*-o*va=A-pM0(Y;l4WyKkVp86*Cl)n(=Spw{Z{ z)zn_*L$rJe!eypovTmeavZ(f$-?>e62gjX~wzBjD)odCFq z@S%YJa9@2lLeR{JO~gw=gj+EiD!8w)9Kg9OLD19?FeJ2At&kywVV- z<&H~bi2$2g6aqqu@mRL^Kdn4~+g_>tGeEov{S(t0HL4%D5zqH;Wu}&LCH{tMmH#Bu zluLzU)VrG)OCF!eM6Zv(???(|KYP_H^7>H*Oc8>mN2;|}+WhqRt9AL`r*~fBN2DEP zZzC;yITHKWYa;y(0B!{wwU!n3!ya9|6G;SYg?T>^ZJ~a?ju}b+%~vRZvgwL9|YmF%GrHMnf;JY*K zA*0~*t?w%3M&vc60uO(qZbuY_-?!d%@P4kx)H`dmrwf-FV74V@W`U4T>4jM7yRz6C*akcN#mZ*{xS1XC`RQNrl} z#FSt`u$9wRxH{SxSYK-mfS<+)hAaCAu+VAb4|%{^0F0;^OAQGp0T_v7>^FV!fxbA+ z_(dsn)M-1roLYaYb@m78Dyy#7|1ZOI?|tC@ta?2rBS^htiAnO})csJq)QT-X@swF( zJ-57meM~k0?aj*;X@Lizc2Od5$OR-o3DEj3EH4jFRk-`v@#HiU+J+0hCRyTdSr`!a zSvuz0P~6v3Pd+~A3<;s>0}Cm$K$!ruT_uxe*sRisTI%9Wr$*J+%ju|y+r3_$yN#QR z!Jf5!epvr9;=}Q%$%ocy^t#VaD0cT96e-O~9hYw%bab=0u}yUy?eL0xc?kKkZr;jH zl{hxO*E=Q+arxRLs)oDygi2kswlt|EDyG%X4wv9*YXtG~sak)0r!j4}`E*dDyQME^ zBsw5n8{fN#zU}kj$%1e6MM$SZ?lGpf(uYmUJ|JFSDl;GFkiEL#%NG|2#zg+c!eu7t zwo6s1ph@ul*beZ}p9&)}s86aikYK1%4c9b;@|GNQFe`t7v&*;B^lmHsE1^ujI6-dQ zU!MO0RVjMI{c%me=1PFKgITwe=e~L&$nDA~H~tf&?Xu{XAcJwStokT572;lY|Klb{ z9tOKn8u~i!Cn~;^2V8Mqx(6)pIZ_PXk@M#RtOJSznFN1i%S&s$$nm&%X>;#0t+eR; z13n1h6xaF8F8`8i`BoTL>-j_7Oj0-df8KS=|8#gg?Cl_LV-30zHn(L=V@=?52t!^Xne^}5$_ z7TY2YGy11i&p8HOoH*aQfe3DLomeL}tsP{|VxbvqPw#eO9gck7T;Upir6^U~H8?_Q2UtI0;|UB+A=TwevQ3?O$arP~I{2_T|=@ z!dT}xwSnB~w4J?j$6S57ocvz%*yLSk+p1b);JTQ^%BP*0VTtu_FORMI#N@ldiyx-l z&TW9Lj9uGJWcU^YnHVI9a&#pT-hZ0P6c=vO(WZwLuk z-t@A<4<{DG$ZmoQz6&=l*=8~5o*v!Zj%*e74Yd5Fn^|#xUK3lL`w{2o^FQB2rTrAj&a@@`4{xw zbw!6Ccp^Rrx{xT@b}eAVy*{v+sZK9fS0`tv|uymY*8=eh{_ zHQ-Fl3k=y>X$YdFxNsf$DyadfT4Lo+{TZ~=2Yc2qt(@9d4ouffj9bX*sesj9>&Vng zWYZSbvBayB*Gq zx$kLMfkZ8ZHDX?YdAtC2*O=!t6IU0jv+$_I@DFPP5FZDo-p_ zfIs#%0tY2EY+gLRAVfdc2xOViXD2${ZaGy4hLMBZ8G&r5$l=#-8>%x{;~y429S?*&SW0G#C7^?}q}IklIv6&VCw<5-4kb=A}0&;0X!<CMbY*SNbw?rDdkntddk}8W_e)#QMc2Q2j^~c?8G|PlP)FtC zr2A*^vSFmc?m2$jccMHl8g-&1yJ1>mi3+4o$qId&aSaapoHgJWd|u@Ihroc_>!T8< z8qFfY%+mXubJN*66xuyRL4#8y{BUs)6GX29$5+kqlRDZZ1^oAm_1+7^E})T9jjsr` zffd=Z8S1;`6s^+;VQM4SVGy(*y8&o<#BP)eTs+1H;v%*uaK z$2~nEpK7@em)z7sl<(x|1zHX|%9q+kz4*BZ5?F|WmcDQPP$(Abg{8KuF2Yo9If4Z9 zpi@bQlY#LH{4_5%Zm4+d_V4TXpZ{E7d)#ySgs%)9_FganoKS|>K>~!Nz?6X94cn)M z=C0O>xR|4mDS?%H-!T=5)~pwPO`d8nYbWIRO$XAxr?ztl6{p^RZA4XYPw*`qu*(9M zE}=t4sdt8# z|M#Qtgbl zQ{H3ZHrN+NVvha`=3F?ecQ?wUcviYGP1u!K-p5;LQ`H{zP~R~9GCmHh6%PTfJaJg> zpQ0b0Us@jj!|_ufGF|ut)7D$&>Hn+vz;57u6=d{D2052rJP4cibIk|tj1>Rq-rbcS zoPONc_8=2)!=jj}CeI3=dE+?uf8uHWgI~T!_kgDb!SHfc-@hQj2$^l7DC}Tgz zdUd1~9tGpW(bR%N=PKS@{4<+km;A9~ayn;BMvvl+R6?{kDO9ZsWCxUVIP+m=G(I9! zES^l%Bkowfuuutzq5v7qz~NWonxoPvhUZEH;?^l4+U8rktaH9ta%s@; z*}uv{yOrODQyF&^a9^kUzn5i;d1c3M#AU`mEWZchRdpPS$I8MZVazpwVFzj)TlO}B zqL?Ku?tL_W_nA&OV4n>PxLy~Bzk}3FKsg4;O1I|2frIQ;EcSoCz)Q9DkNla{CU(N2 ze!lS@fM;VL68FrEuP41F zKQAk7CgaTUOc>7f1eP!!>SZW~qS+zHpVa<-3iC^m_u5Cd)9zlIx$27(aDZK}`Pge0 zdwFj}wH$I!Q-08;xFZtglx`id-E00N<-|9G;Jp{A z04?YjnR%X&Ot_Vf0Byo1mYVlB1+}Xkqig)GZbvhnw6xAw zj(N=F8#Liq5?o<Z>A9NBXRB>w@q{3T>Xp)oDojjM(xgab$;y`)T(0{*EMw%rAf$mqRf$PIc3XQ0cHlT?&#~gSp!jbA8HTi zPm`t1uXgd12**fg3ba2GHbNZ(EeercKP#7NAvN-UcNq4A!lJ(`gaq$tN}IRTR6%-p z^HZi$m2jty8WSy_(#UV5@k5zNSuVh7l3Kr7?FK&3L3l{ z*y)s~(tn9l`}SV^1IS7hvb8vucN^3096JOA_2<$q{+&<%tvUAIeOuv)4K?8k?92;a zt=B#~Uf_tjo1S?q7I5U$#5P90LNtA`++Cn6VK((5^>_O}t&pr+iNGDO-i*Y`xS3CV zW0lH$a*S1X0|XPDn*)iZdnj3|F_Ltc=zAn?``atUPHic5nVdgQ$gbpfIpHkJ$AI%L zEO8a!UDflTbRe;vU=yeF4U0xqbi{jNgn_eza;0lye> z5XOwphiFn(K~^5lkbS7mY7zR0a(40J|LIx5A;h6>{wVjCz2#sN_m&}XL)~ZYt)YFp za)!ZVaJ6I-lZ4GP!oq%vj#a1FT1LI z_TE`-y$1>!B&I%^Y4i=)ACjKZ*h9gIku4yL-*@8dXSFtB)msc<@PgnIX*olo5;Bn3 zC>^iV^u7Tp_aj+T@XkXw-9@99ra-2{JYmn(9t`M7cD%r=!NN%TuTX|C|AI|!b27Pp z{ZnxZ|5*K|_l1@-`Z*)xQ3_~;SzD{wcs+l=y-`w^%W-VYYDSUNehD^8-)-wMPCDGIQAahZEra-%Ni1j~!^_wk^&`hqq z>*(S$YL=Gj&H**!A~3vc=PEEi$d5%SI+ovC6{&I@O2}`5K+3E9c(Xgx7Pa5r06gArn2n){ z+ckCiW_}m7t2=3^J<~Aw0OrFOW_jmZsP0L^sVFYD%4p{jY)ZE)<+|*w@6vEF=(9c3 z=JCaqx{0R)BA`4j|1(D9B-5BQ%CCR290@M<9LhL>8}C&Cn>X$Mn91 zCZGnny!HL#DEW6+f1PwZ9(j`J9VHPMjg<%^&2HKrA3oO}x+#iUy=f~&6PD^esak#O z`*@k70qC(Kj7wWsWgb=}ODJ<=J70n_yP?xH3y8~>yUgDZws4AWW0i=X|1wdSF1E7x zbqgfQq-$GLtHyjvO@q0fwA_B+<^|4x0jIp8SYpjmQB7@~mcQ@PWjGjC0YV^@$a?B8b4AIf0L+BmqOyd?%}`RM@{za zdrwxC7_GH1qAf98=}cc!vmN5hkbk?u^mFT5if@Rh7J6J+{J7_FEE)C~Q+RFtfqBKl z6EvT$ShY`5%=>}%TI7CxpgL+**_*!XSl0X2QMyN<-< zx&sMRXWTXM8n5{Vw_~FQ1!pYmg-J~f1;b924IY+-h==8^``sZisdu*n7Er=UOXqzCH-Fx->EeDok0YgPrZo?~3 zhtktP+%Hv><=gSl3z_Cu;E%36RAlEJR@z`k^_(}jSuin!Esnx^MND0}WL%+n!cW4Kfne~-pe;R-+lDvP4Q zJpad@kEhjo{R7`Czq%zWSk(XQ2r05+{;VwjF zoJCsk8~+bCn*_CEKi>!O)(B$>xwDrkpbcKpqJaEl1T?aog{9HOEf2l!y4vK`>Z2cL z9vl6;CA{`dB{a_mh1A!g`7Ln}<_w@xgx4oMy)tr6K?fvZd7xrrn6M9lPRkLVv=@t8 zAdQ=+yUPNxgm?~J#w6gnFF+{cN^ggRKPTT1a`5}Skih&U(;s6j^p^9}(reI1j@THu zaeVakkCfi=a9vtyFvU3-MsbGHu;`=xle;t$=X`c>kUu~p3yrTORi5V-8wCuRsWDQJ zpW1we4--vb27G@UCs>sm$zYBF3mt5^i zBj@;&ek0Y^?wd*c5kgU=HJ*`UQ7tLsE|IJ6nqq*iCB1C8^a&|CGV&3mp;OK{S)u4A z{94zZK=tnOSh?J}UrRwWV~vH68qM;Tyd$gZk`+@&TJtv43jAXtR0@9;yemum^BOXl z_n44= z=`#Ghnk~x5${`O8ZllH7D=(#Tq7>`86@6qttrf52lGY>mDrnPZk&O z5xd7J;u@xX+Eql}k7dfZRla=^a~< zaxEG`Y3SESNtkxH6tl5yX$%^E0h*kPDsaos$N`}?+`BYzYq|o&Oo<5-n&z#7uFpJ& zr8+l_Q%Qi zkpUCEN12Cljz7Q0X7%;>l${T6$UG=waK8El`bQ0^9$(KmeXXsf;d#5*e|K6C3wt}+ zQP|YZFfq=taT>f|~Z9Hq(1w)sX`8w_R7l)`|wtl#Wo$~WpahJOn57x-G)qWR@Bnv)Y zyWK-DWa<^EIa5|+3Lo6wSn8yZ_xa3rB>I{w$#6uLMi#g4`7F{M%jNHvOAo6$&pkYj zP3?Y|bTi+H2h<$i9aPD9?e0jBzWzK=+f*6H?bpfv5OVsF$=#4lx01vx8Lr0mH0O&= zjAcKx8`Xu!a$)BAK$sVjcYa%idxC0GL2vKz+g~SYntJuTx!`C`0Ar49G=K>r*?noH zZFrR}3GGI!VXSzp*W!|edZ|kYwG@(Vncot9iCPI6bpA`s**gp;&ueI0kBolFA7ONC z__Sv$WxNia-{&cp7$`Z!*GxI7+PPVJ#T|H_ARpj*9}F6cBtok|#3X(XOFP-FRpoLE zrTEdz@%p|pH)-!wT#0>^4=~~88QWzfbQp@mql0;M;o3uV5qhoj2OaZ*x+lEKlF z3C%5M?IrUmKvS_-1IYwGDu%7yXr)`8PC{fMxu5p>%XZQpTN^@o+QC6M=U^mV#U(y6 z2ne1t6@N^)P0(Hle}l4Mw=HK{wcr!@ji6*qXFxYQql`1qM#x^2z8itwjBx)!qHL9$ z;(qsw_N@B#?L>D{s!>F*XNdBtR^j@XAfn0?iKvbVh<1!7TRl43!)*H8d2U>`wqQ;3 zESiawjfMtG1=UXcIu_k0IdO=@RP*%p?lwG&m3ruuQwV8dt7auGf?=RW`sro7uw%1R z$wCa|b;d8(O?@!g?M?Eip)e~Tba#Znd^T0T;zhc2};{#qxW3Sx+BgjtW%ip6m_1VK$&tbK&ED*OTn_f?gqgdr9$L ztoU3Fjz}N0X)uV8!+ssPRvKa773jz;yOB8(K9cnic~9w1PG*<)Wn&$+gH3l{Hs9i( z6KcB7XE+vzQ1Pzu!}wph(b};)WZ_kD$Xnn+68rBmv<}hp<+h|XoCcquS$jq}=O7M_ zqbRiJo%=~KZe}ic+Oy5;HA2o)<{j;9>zoRy_UrM=wwa)$MM8z3Gm%Oyj+^}~(aD&O z2`H_K60Ny>m=r{4{7$zvCn==;kzv{{{`I*T-P;ccJDo6G5qdPwE{VcxLg>uvzd?$oN0 zMIUf+CYlp1XRrjGgn`lEklVSY|I*At^ik3BEKi$Zm~UN9UIJH#Jo6Gz9#TxE#TXGi z7}8t*VL8>3r^? zEuzD8Tz=<^^Wkj?CR2I_;Ai>Qx@pu%bE-Ab>yZ*s?(Ll>@@ zD0=h#R+>*r+T>{6o%7n29L}WrxMag{I1&plm1AB!x1WQqL(og`b$jgIwZtefh?cgo;hzOr}k&eV15$#Fd)t+g)X$bKnkB(kF6JXvgaA<>c~ap)g}dPZbVOn z6nYhrS&uh-0Hmqn($3s6b__RVS1Ya_Er9AHqauf<~!2 zNJL`iGFBQ*vyMkQq)6+`(OH96vpJSDHIG&AtaTdM27~0#lXt(~ zKjFl*OPqyx*wx2;s-n7&F+iR3Cpyr8=Cuj97M6c&Xgd|qxh}fps(+UJo0j@kxWz7s z_w^axP0+cvcyUyK*go~M=OINl8>>gAW7gCYP%oUd!mQkOy&a+u$mSmRv^W$ zrYZ8qfo6!m@3c;3V|}}G5+IH}IQnX2oHc5{Eb=zD572l`G%c(!*fs!G4`+)2XB z%=cRH0^!d5Gi4TN^`3q8a<{0QyqJ%kYq;V1AwtjdLTjCjGqkN6&!szRbhY%@ue7;4 zJ*lZOV7_ob0HH^aJ7m}T>NY09OT^6$ZB*zrj$i$DfBi)1d+gnSiE!M8O4|HpjZW=~ zy@#D1w)n%)a23Wghh*n(A-q;bU&EDg8f}iZEnoQ!3p{p-XStg?XFe4eT(y7S#Hknc z5lSBAh~!=ONrBC7@>WrM*1XlKU-y;=Jw0q~i*xa%kMXk18}f(Xxr@AkSRweYBg(TOrb~6TXf@2cLrs!nEiD~JY!{bYFUsmisBxP zaX^utHYt+yO>|b)5j~RB8Jvt2&ey+! z{uE%-r3R5pQK854PJ@>H@}yj%HDh%8<%2>9d>EQ{FvC*_dAG_o$-_@0Q={dCfd%y; zp!=w&I)fH3jIcQqQygv@cf2WWQ^K5hc)7~AMa>x-+N$Lvd!bqHY)ooW3||Y|^0B|r zV&=#xnXcTf#%e?u?!swH6kF_=8en3N>W(|X74gTtGwmJP#Wx@9*MoP7oI_Rsq+hXF z>4DO*r0H=LHs8*qbEh_P9$S2tf~?$4qs27nYXfA;wGQ<;Sz+DhNSxmT;- zH`bD04v8~p;A4Ay@Oo2kZkv|i+d-q;^HpMtAA)%#nQa417+g=GtKlY*nys|RD*W;A ztw=KrQdG9Q6Fvheq;2^A(|ZN!ROK9oxh*NC`!WJQxzU%0Lk9^=mS3aP;n5}sF~4{Y z@7(9ZgWV8Cx7{7uIav?N-~9t`=ewxvJCj_EzY4*+5>S!-1O0_JG4=mLtBC!KJ$mD+5x?nBOG7 z@jCQ`Bc8=4J9XMNE7^^=8w%?n1xj9g!d!;M+iLx2M7Q!7c^=puo3k9sfQ#u;Kypa@ zST?3OXrtgOuU0%87my|FJ?@mFBH$wQzI;o%RKxQ8rBjion|S6=%kj5#T*d`W2ZO%O za?8k}cC`u%WQ~UwXu*`lckcpg(8%s_zrs#`2PJ{F&I_?x35wV{2=Lmpc8i zTOSFRD%iYnM*R@B^^Z}Gop&xX>++&^P9qA@JXuP)_$h*zf0x^w$bJ>s#&OUmBJBhF zLvrbboB=lp?4;VDiz-kre*M4;OebCw^>w<3cfh;gmAW}{<$C3qv4n^mtS2dy#FM9O)$ubR+{D&LRJs`s<8wVEDegY zb;KaUCzxXT%0wgUJR@&Z(sy<%a+ZGCAFkR&mfQWs`Bi?rlDxZ|KC}Jud(il&i86B4 z>xtLb4)++yZKn}^Tq58*8?Wp6imJD4Jkk*oe!G?3)$)#3PqX@|$(G(TxRPmtyy13j z`JH;DV12&e>DTW?4RcrAx z8IRv&&g0FRLxzL>MslsUL4u-tHh0|?VSdv&DL3Z`b~kMVy(vlL%v~V2wOs|%#iJY={;L3V^aQdmf^m0m&vYa0 zJr}l`g-t9a{;1JcZ?x#NGQD9@h&%C}hOSKNQV<6Z6W4DVb}AV|Ep*oIRQ$m@7YzC} z7jE*NT@A;9)i;noABdBgFiA}$wx*Wf7~04>ynV?@)}xn`FElUSd*Wq%FN6*A)9Zz< zpjLk?bk{q5oeN%S;-K=msnK$CkWyLlc?Au*+d>!smq16VY&UwHrlYjrDAe@>&6(9CPf)b}K|Z4-4Kx zOL?5OMkD4=Ya_OCjEYkkJFgjD{u5hybL1@YcCbiiBjZQw>wEORhdjlMPR?K+xi^g) zA7briHl#vLqeamUU-AqAb1(dYe?aW}bYM&-$I)8))KYk34f^R=rosgAe$ z?DLTF{w^&)?@UO5C%aSCAC+^&|K3JBetD6+Cgr~dqSlcy$J_?VO>Xb(rJp##Vxq&P5)UmvX` z=tr6yD`?WK7r)r*R?cS@sMM^9|132!e0nEOxZ>r%7qNzyFwymj5kBQ5E^NJGM4fs3 z;nGYW5bFKB%o>h*;XL^UKpo$9z__vIo8N8KI3mw7x0pd6&m)`Q2!+$*sGwNTy%t`>2&YU$Ze}VS#qr zjjnRW`wa&gH+>)>NO0|Wm5HPAytx|Ty6h?rWj5Z;Cj#Qy%5mSwe&!<(cJ zz2ivePAIg4#+BcGSl?Z)c|QO9mRy<5;|Ao@mk*YeXYVhsGG>=|r?WxZ0fJt&puPkm zLO;*=Lcb>WZT-xrP^uea82t+Ds1{Rc=?oj5yy9p~OF-6OQ2zwFa6WY;cY<+jV(HLo z;H0qqtZ|DL&%yD>Jt;SKE2O7?6l9?_s14`{uV%n^(Z0g~a zc$504jealMmU&o;gi>n?`WnA$YR|Vm9vX;pV zPY|D%jlyJ=_RNRx2A7xn&s%@$jrQm8^fjsR493vwtR9xck42A=B!Yx`9*7PbJH7tf zk!^ae8yUT6$q&Y!MPG2)6c4$?n`(I?ns%C{5KCE2Z|$@)9CD;*B*lLY$b@PGyjmBH zZhd$R+FVw4(M<=uhawNayU&oOrXEBXd>b*o0wRpgIfYv|-z*qAx&D;!s?%91M|;>? zo-*%q=5H7rJFj|r?WwYw#6Z(0m1Kb%xtLFrp4s{LnvSu&lPjTi5ezqyK4Zo|8EewC zCJiLv$A5nfIwn?T`np{Y236(AC{TOn^uTs3N?g-GPG~{i4Jwi_w^{YIT3Wp5{r9qAsX|egFeMca2DzN(?T?4S8~7wA+G$XGNid zxaMzT`1jpwB3WC;p>P>+=lBW#bzgBbeJ7iwhG_KD&8-{Eiy^J$qT$&6b?E#_a8tl? z?|RZFR1U&ky2cz;tZt*$taMNKrV2yGf-A?SGil%Gn)HoAf4=Rp?JUeJeZ)!ecmgkZ zk`_@0{o5k#;-AZh@D`BWVR)ioWcrv!mc$!^FBsJV0Z%Ejs0~l6B^YnH3VIRq`0a(8 zeSLb@BPj{{5{93REQ`ZONJ9c|E`JcYWmqm?Q+R*KcR?JO!~gu|kV{2<<63VIG|%p4 zrKY&*SoVw-YNu8st~dT!43yuG~s%$rW=)<8ktxq9(w zJ6~(v^sH4Qm5t|*oR5co9g{L9F+@QrjG8AeCQ-P)PZbx}YY(4yet-8{hzHFfBh_-h zB|EkKK=F1C^su~Iz$ez((Fi}xb^_EgDI4=Dm@tvPUfXIkGjZB{kzTcmr;c1cfD^L_ z{zgI`(@2)_J?aNwzEqhvWDhMjS zA#dz~)}kuYNWg{b{l&rEwa9O5%v z2<)-ify#686{8hjzAr_fvEDXSbBrzMk4(-&wuzvP&KTZSJF2rSYnI{8;4qjTQ!KA$otir`a|qeU+NtpCg5rpTV6Nf|qD zCa+*?q+5B^mJL|+TG>q(B_Av$9Q3P173Yj(c`Vz*tH=95{rP&EAPZ!b-N#xM)fH}t z9?^5EA4VKGg})vCLkF#c<^pX)Javy`p0qb?;mI;kp(zhr@}TNMgX5@dbtYC-9Z94K z>P*#+bnT7{Q+%j&$?slVLG*e16E^kU52 z`ICz*Y^h6Qz#=2}ju}2VHMsxPg z&8nTyZ0zM1WK;TP>IZX^v5TWu)bfnC2k+TrQdPeW8597a7bITnb3fm5r*5bQRp*Hp zgo)N!Z+zJt`qz{fX5KjcxM?vCq2*m`eE*(Ik@MZ982ISS7sXwD^>*npo-Bf*oP37* z*KX;K*NO$gc3pi!>H;%K*Psh&8d0+aWnSkJ0Lkh$atwIRJ(Ygcaa)|@N&fpl_Vt?P z)Ol!rB&?N>c{r8Pz8}MHItWhyz%_~{dxI0AA3MhU&Y?VSUs3lz8~eRZ?z?B!3ViKN z!;(dNm(Q-tqy=Z8C-{B51~Rbog9T|_= zOHxQWk`&wZiJUi-d7yy;fRi zafl`YJt<-DLADOyJPc5S^TNrbrsC6V^;?0eLFDC96^?1`MvESG_1Y~$DeJ+*%S!a! zG|E!6#n-(l7U{GZmFN`=AKidd6V^KAN!$di=aEg8Bk}yM*}%aN5Cfm`G>gGv`^8J<1zq)jR|Fh(nBr@PFlmTj@l~MK>C&s z-v2cAA4fZ`sx`4?02@wc$#%Q~EJ<+Y46|0y5kBFIV|7x38O_{FulNQuHpVAy19kn^I4_i#B?pup_Dl7%D60(DFtwmBFKG54H^*Ze1F<9tQ* zf#gCF+M-_TEA&?OF7?s!Fe65`yx3ZeEI!fB@N_*ssCuPz)A?q?m^*5LG5Z>wIsl=k zr3XI{S2XW;KnFtyrJ*UZ-ii&}uZyFmRZ~Y)1DBRp8sqQH!6y6~kWO99nY&|~U*WR- zI}&`1*o$qsuK7PNP7=|RkiLLkoJ;6=RmnlZCTuNbf~J3N!o zN$xF*p!Mu^ie3gqYtuGV%{6ODYueWI(0on43tKCKj5f*Zy%0L;DeSe)+&Csui_u9+t0iFg> zbJ2zDiELWpqdI(tPjF8j!!o3I8S&_5=J(TxN#x(V$YF)_GtcYfI_}Dnr#P|i_T%E1CE=So!VgM1zZFHqIL!#A3et{Sksg^?!&JnX7w#+ zm&W*&1iTTi@u)N#wXn(Wyo{izjmY6keOQkH+TDQv7#Q4PnsqD)l-g-+99}_l49}&`;GMn|0%INR5Q|vNc*Wu%2)zTL zMfW2Q8-yy0uiIRHP$k2W{0P#hYNtGZnnPYBm8W?Ms^OvuYkGjY;70vmMd&Sc$(G^j z;m$H@i=kFi=7K9;!AnUNH! z!A0v&#MCXuFvJXBr|&L1Zdql)7gUj78BZ?0q(rVN3JNI*;{9vT zNw~*?@9EE3MA~Rz#$T;^fku3)_2tNos}zyjTT{;wRasSpq(`2ttw(!HE0GP*RENN9Af zN5|b|`?@{hW|VjtbZ6zq20-bk?Fl~olAF@`$p!Y7Tx?sOZ{+7>DJ3?AqEfhInw3k8 zLdUnZhsE6Zy5mlr6<4Mx>T+=H3x3B-hlBo;rL=z2NU_Q-({VvL>?cKS$-n5wT~;7S zH!PTmf!5zg2O+|iO2EP9E{Fy^ne@hv$XiW&MhB|wL3lB@&AI#KhhsC}JvkB5OSl9) zVUZLLB@1rcj8bZ^$RX-`HR<`<_aND1=peLM7}m+V@`2G&cF#l@QgjC;i>t z{Y~p2BzK@`gCDJ=ARLPTSzkE{^{w8DxEi1>w-Xhe3C=l8%mCyzjYJ#8slfI)38zaY ziWuN}_o-Eq*zjkrYxww6x(DQ7j;gzX@ixA&PHPT?z}?FmaW-L3tojYoH*sALy^{kA%JP~hTVd#0hRQ{&zs}sIN!u4NpJ&NV_ns0dPEOSk_*3Nr-ty_;Os0ZW zz!Gr?CRnwtu=~1;qV~C2F6-$vU&{jm#4fdSNS*xBCT*@^ZY*{jc;q$!5oJtyXf^*z z&C&0vbsg$}bj;*a!)K?-M5#LOUo6nZdGx5OEx@qrhF!ZD*mAwjRTz5pe89772W9`> zV}%ZIVZ(>9uchBv?8vvQXf&;lMB8a3X24Z5EoHRvCGo#d=74x^nUlaYah;zSR_8nw-elZyG zXHk3q>LuP^dm7!zjUjIe!&X2f%%Dh1;W*M3SkpXBxXQK(j%zm}MdSLcTlmk)&g8U3 z$2(!@0@MQ)SOcojbn+-mvhl<3v|YRxy6#+h-IML|Tj_d_e^#+?Lp(qH`Tv`i&NU5k zNevLV-kCG)KfZF3=nl_>F=vMnJu40Z!7k}-U(Y_23k2V%#8xp%3Ng-p)d6wJQxua( z7cL1GPp5mwz=Z^e0k)ln!{?opW|bcJ{1~~ZynOD@_xbye+T{d0rJndg8CshLD?#l} z+6^NW%~|nw7pdL(;q5fV_`-G$H0u`1@1*4%S>TDHefekmgJEM|nXWm#jmxhG zI0GK~UdZ@^rP~e#^UAukI_kK=m6~v(N#HaOH~uT6hI)#lc1!DcajVmp>mfeTM+4Hs zhz=Dje|MEXU!dvKt4aGWnB}2W?EZLuac}4`my);o7h>!*XHOSMXIT8Bg`HE7yeiw* z)125I^9fcc>v(J=Ts1AiDH1xj`D<~o;0Mrx6-bv@7{-<*2SxsR|7*ZJc=oK#g7?h& z?_#ji7ji!T}N7bG&}{SvKmP0vzajBs`dZp zDKpb?=ajkFYUi(zJABHU`OhZVu!Q7c_yA{23cjL!<7b8f036@HnWKG#tjv*`uIhyn zypdBUd&hjF1z)ja0>sD71`aPG77m(3xWn?KPSXLlmw+Lx6amp(j-`ztQ^y9RonopqFcSYo;zd+6fWOu)0= z=yZu|DrZKI-v(izwnmSmn>Rm-YyHUn!~@F7B%#0<)r4{_CY}O^m3Lq{NWZ%s@64r2do&8eR;|<6f)Z4a4 zcI1>(lO5EzOQH2V*x24Fef~fHJ$RLbG_)vT9)bJ@2gR?dUf+>xA&wM*^v!DDz^ma( zB22)wb`RKTUHU$}Eu1NRTbW{aeDvJ=)>92&o&lg(QNDqeTJd$p67ro6A2Pa^mop_q z^433|DI1%a7T7kw?G;h?$H^GhVC(+|rAIFt_MvR1DZ9DrEGTIkSV;63gxm>v?%v^| zS|gclbe*ydARUF>M(HXFVk%4iEnnG_)L%bW0yvv2AZrAUyDE-P=3qf~Bd^Xp%Xn&h zN9dz7+ZX>ry#JrTwZ9MTRMV*!whqU!J}*q(n7~8=e#Q1xfmb9t!Z9)4F?vJU!gCvoStVt-teozQ?r z#`dx<+~mV8nG#i~!Qaeces&F(^CbnBiY01}ibdQfR_AIWwE%wj%{HO>>&DXX{7EAF zlYZT?GZs5q%q{G3@pRJ@EIkfocoo#@19$hHcSC`bW4dpMYGTf|#**;v#`@dYV@2^+ ze<1*W->BETmXh8X>@q{Y%?YljyhEE&-k%&Y?NYGTkdGtd0OO$%!F%qZ0sErC@!_*E zM!E}4=0mR3%i`B9%V7E@)9*!ig!}PIvxtJX(@8*rH!nPVoft|EJeR>4+`q}8S7U%vuh z4EF#1{xxAA(lQ`x-H`n!2qvRRE%^(!A@4^08E*aiL^!k+LiJr+)A%!MZXN*cgh3k< zWt>m#V^Cr{eO|&;|qj_omHK77I><;(7 z-gnFv`1P%=hapz>n(mAH3W0k=3GWIgK)|8ok@ITK>H9U7E-Y2pG0TdTNi}Gnar^S_ zzhv{hcjYO-?IgeYeY;>R&LIP|t{4TiS2S0_#Ba_V6gmgbeXaywtSzO1U*xB zC}Rslc1De{equ$;2L3Vcr_NbSY$pvKgYdseYlw065AGMRcud?&UJ+YYm56575(qW) z?SMRuGmKpDwR0~{w+jT-NyE6XfWXx8=@-v8#Tar;W)D#BIc2i0iJM%XD}{eNlg)K< zXbq^xR7-_H)9AW==&w=i8y3U5EAT#8wP%g-i$Cr4rf0q0=^Krn2+J#)A$rVF?Z@)3 z>8aGngC>}UA}+qI2j@OB^9;)zXV!9Q=Q$oH!azP*_{o7K7roUuE|fv#S{kEhAaNKD12`!S~siX6WFT*LhXAneudXx>Yz0{b6qGG zu-C6@Gj%>0T|6G!y}WcgXROEhJ+3;?wL={+0L^uLPh;Xy{7=s(JPEG z_d4hKUMA*{-=EbKw@Is178HIT=iTex=(PyEXhp3*{cmjUA@a$otg&HJM*BscXRiJN z^m#YZw9BE`Ow#IJ_ez@u6QI^anFmtasY{~UH+Iu?{h^j0(EfyD_C9}%c&Nm{GeOB5 z_wr>ww(gWfsg^zkdx|yN&uHLzE%CssXa<9OWEcTf$b~nOov8A*=dHPR@Qoc@uU0WK zv9_FiRp`KwOue}TTYzT0Q}@a1E>0}HFTRZ2!*$%7z5i$TV&?!Rd^~&Sg>%SOSi2G~ zULx-3KURU%lf=VB$YDojX{HD6$SFbnNj7t1ImY|IHLjY73;h-lT+(X%b?&$+0Qj-0tnaMG+H>pAq~2_8bjJ* zpRH$d{N{0?_=jCq+OwTt_UD=5DIL}8UjKOPIb5fIAG!!J7r-kDESL9tbzK&eM=Ti7 z#`9{UQIg+Cms{~T&0c5M@w0|2mKemc&krbr45bokW}-C-fkR;p&-kOn2*mP=;UOx@ zS#6}=_*MA!B-J(mv`v$#r%l+%2_yQtbTGF1@fzdXfFHT>VD)krw2W z58ojj^|v{G+69V`?bF?1duv9Zvdepqd!jO?L9W>Gn`NA9Tv<7P?cxb4>@|!0D}gxs zyh{Y7#6BUn^V8YdPK)Nt&9H#_;uGJCIk}WkupPu{ny2K|9 zV)Z%s>Vq3T zlEe$IZiNbZ{?3o;LBBr;9l=z5Up0`cK2u94dSPBb_CjNESANUk)oxs*ofh4?>c30Q z_F|(l2J#?|^ikm7^zVzX9!Mibe-E08QpG974ltm`jtEMsoa^e_H z+1Q|V1M8phM~z`?pc%{&B=y>6cP&|R?y(m%+nWVJp7Da?@sH8g$8~?B^Z8t=8M~s??7|ljxbi&NP%l5i8lN0T+{ZvMuSD$me<%MHlK z2#a*xu7eKceE1U*QaO`jz;1&8$8u0i^F)9zxl)*6mFI9OU0N60-pGy2(~@l0&NR;3 z@yl<~5GjeFlE+lWi;dbZCz&UCdd9X}-vSJZgf7acJ`}*2JKm%g z0F2U&9BmHNlG^X(<4Ts~7b880)XX>EdnPj-U0hsRn5*tt`6kkP>A)x8?6$~lK%b=b$l)%DgYI~pw^wAT1n04Qs&Thu!{#d46@A`J(2Q@(D`*qs188c}N}EounL zYDG_a7Bb4`J^bnsUl`q5ZrbOZeMXs07&;6kxAWBK312_moD1cWOs;B?;`sKAO^b>6 z?MAdt6!6WtxF);(76jTU$Z6S{&2IIu?>u!pmr-k0V*Wl5Vi~bf6Z0MJ&5egLW^HyI zgYJpaMp_B#t}#I?nKXs%i`i8@+1ad|yY*F}boyeJkIgtMn4CR2N0pX3bmPPKiR$2( zj7|hyc-yaKi$!-Us{=j5*vV!fwN+_F_1h2et@KTi0N(8L-)RGvZz{y!$Pu2uX6LJR zH%a2$rR$^bmo>cW_(@Am6ZSa?G2j-%r;M|z?OAQSBB_a59l9II@U; zS`T)39B|%aNWKC8ykN<$;TK*PzRb(izlIv7@1vj$xOcU^I3|$T$Kj8oH*R z^Z90T1MCFLm~V#z0mP@bI@R~2Dz)}Rh}VQKdkV)$3>pqy`L;EeZggAfx6WMSUS3&e zqtJ0cFL6aOGWUeODALu*d%)<)-OqPQWJyfyv^4E!OrAE;)!ac}c7DS1K&U0=#ik*z z+6U$NanK-z$+#qr7iN7Z`=QvJXG|CORrMr34D zq(sO(Hj%7KgRBycE#Vl)F`|%hGO{^QkrHw2nZmJ8w&U1GRL;RM&cQK$57q1a`+WcD z-<)%v<9b}z{kq*)rCB}lwZ#2|hx+0ea|^9lU~PWBp=r|kvLe}7dzc)yuZ~`Gw0L@3 zCOUKeoIyJ6$)!Z*x}lorJ-6>39*J_;nL~BZ5jGRYjQ3M@U}JUBUrLSst!mt>V<9+u2uPX|QlL z&To(?fEwrLi%*Gx_GtUfZIyOARQNRde%XkZcZ!fkL5t9nEpt&i6o<*CVC187s_`sF zHfiT4o2g{}w96sO-PMxdoqC|DI#ACpJ+T_=YWhZrGjAmRE#;C$Qr83USfPIEYiFb@V%%b4zFgiTR}VH z_j8{>&>28)JFwZ8|BJ(}g?%r}@@Qt(3c4a=aAoZ{ zRbH^=c(xDkS{zR-M;Nfa{1Pa~iST)R#FLm_4L=5e9IwwQrCzC|4#9D74qxpy)1|rC z(C)MKvBJ4$O^bJkXlxIrB)$<0!QE)U_R;Zl-Eivevv+=z91^Ka1DX4=WL_o(m4#Z6 zm46KKS+fXN0mm;IM?GglrVJep3BxQ}6}2EuhNZ1mftV+J@qCP%rD|}eRpXbXs6pE8 zhgt{r8sKn4#oR?WdT)wCVG^!w_TDc(OP)aw*6vX3u829p<=0$8Snk}qKcOK0X)xnZ zU9hCvqyeLUBgeGgh1|mEpOGZVAzF}*bx=jEDlJs&xyx#GCw8sa+udu!x^5}k6Zwu7 zyp7!J-HLctiywm!=hK>6Rx29mD!=(|G$3YF++N%wN(fZT1x^Vw4coY3c(H0+q=jgd3P9>J zUwvv4XJ9J;_&Luz+z3$?HEr3><@fmK?Ycd_R{2T9)6A_XT7JdRHy&|J8F>CTT6xeb zuCvY`T5oiNig2oMxWkL3=u4K0T__zbz%Jf(^t9p&-X;fSSw*+?gn$w1X}YN@GX$j+ z4HQttS;#i)F#-H}&MN_;CvJR;3RRj>lN*J4U0$dl+ueKQvi(*}wLmXMJb1Q8mqQV^ zu-!&|SH}<<7F9Tyfyt03hdiE?I_h=#dys|3que0>$@GJCTZ4i5yC>LGeeqt#>-UA4 zyF39SAWhK72!^>ddyt$J9QL^PF)JSr%sHlJnQ413gmK-{Vzfd)!u~Q_Q{&0XN)tKS z%FZv3Mwj&e$&i0yT!8)M>w+^CZKU^B68o-)>T2$lBEPh)Ce=a~mCS{=Dt|XoOQ8@V zzm|0_<=+A^Xui@Mf94&HYkH}YvcsLD2YFLoq6b<4);@szv@)U9tARmr!PwoR(ZfN(9HP&YCzXPw)NW3YW;=a*HYe^)_-t0{*dSKuc2=qw zhf}ahe4j_>ml7yYms62`hNhTFQ!`A)`7Bq$MI`1dZG$&Brg2jO4LB2Lqeq&zBH0pB z2`HuKki7n1-gS2NuTCMJ+L$0Hx~M0v(k~WaU2IX2@aNCH98fOs(lOO+<-~Ime+Px} zO`oH&KOPjfSr$i|r)+M3VPc1?k%L?M&mIj~+I~X;}Jj&R}G9jP)vzu zuI{O1<3Q^QS96o0!0i%eH)+4Q2od?4zyh=MiOIum;1eOyUPZWe(EJ76qVXv_BH6Vf zFJ1q$3-n;&3~Id)ibLMi@uQ%EcQ+|vm1!rHEXIJ0a5`%#Fn`B!UhjBQ$bQcS7L&fR z#u}O)a?q#em>wRhvU?eq&Q%!tW7Q^>fm^+K-?f5p-FXvTtg^UY4FO~t5L9(;T}gv~^ymzPd$Ih1)sZa>oGC4X?ZbORk9g+-G$#nd;W za1)6+CK}&@>o&dm)EmSmxQ7$kFBk*}IiNtRgyeuV9#YZ@tkD-ZcX z`B*-;OH#jxTy8(M;MXIxaqGo01LKZRs{TuQp+=j_>4gEi<4t`N*dLR51%G_YJI0|r zf9i{Of*rz!4f}holQr87w%gxL&g(wN(^aUdiZ-IUepw1^z2UwTca^5o^S};j6G(1R z#ePMRZef|Z!^?iDaJ$7N z?&*<+6hxQ|JZq^Slf6l9J6mG%4o=sf?~#EzvY~e|LTxQ4dp8+la1pU}-`H%*_aim5 zk!PYhdhv&s@sZK#fQi%86lfu%PrvRBy~&F_#aGpbEQhue?i{gC{C0a>H zOwE8-ex}`vUo29@gu$L*_;&J%dM)2U66_n0JQQ|2{OVwTQ)nuW$l9&XIpJWHgej|d z(LU(&BC6utT3HLvrG^66e_H|H2G^bpK^K&MsR$60XTV=_ryA9CURI58pj`XXJ4Fp2 zi@cuaCwYEXRbb7oY`XR-E`OT&GAuJ{}%J@SB zB(sPQpk_uo(B3nz0~KEowZY6IOBSoLnu!I_)1?#r2c|g>R?Pw&Nt%5{?S@MKU9u6_ zvJ2i2(F&f2OiFu>Lov0Hv28Jr+(^^w-fH(Ei$u@Q z+&}D9l+SDko2pjqp?;HR#IVebUq}~l)6?P$@bvyV$$8hu_P5_%U#F%ZLBY?fdvpx& z9UZrtmL0<^d>s?h?3q7T6izTf*pGrX(QAf%TyF2lk~~^@^xe^GlA!G~<_|Op@kMOi!2T+~ATb1Y)9W z5+UkbLc4LHY%7=Qgi{*8=wZoNE>szb3q{;|n_atD1DbY{*KOxk$1hBfX7qKPZ|4y& z=9!!d{s&(W;=`Irxy8I70%gS;`a7payVKjBtHTHq~t=qm4;eL#aGmaM2) z?2xMq$(8)NHSRl^#kn<9_F`Uk#=F`NMllQ#>^2OxInXpBi*8q@x-pP(SN$q}5uR~c zry@oAOzsZH3XDenwu^wPw`qBN%!z30-no7-n???*!-lXdO-jwL@*18=J$@AIfn%@k zv2?Reb*k0A?2%7o+^*kvOP75REE{+_Y6_y_uEpI@O%#UX=5FgO(K%BqYfVGmC*YpEMgHs{_%ox>eubKKg5TxL_ic^;V zEaKfr+^fK&m(a3=0|P3knFB-gsCMfpO>wzc*Ux7_0~fq5Mr59?WbZuC$kf^EQ{$Ju zVllA4luG1&o44xXI#-hVf^PLisPd4h_3ANc5%*y;J)@K$twM{I#Ms#7PGsM$7_o2l zX~)$0#&pLyH7rH(87CfxFSqNgMrA{VH+o50^1^aoeJmhd;l2m!nq{$_ST;V?QJL=< z!?F)wXFm8&kt8dsciDUXBn9 zcv+en)YZZ|yNqjmk2E+go|T4z1Im!-d}8+^lUF1O2msqKVCVb}e1%yWd}$*l2{)e1 zmOYZ3)n*^|a`o;`ms9oZpIzbp8l>5fkBS{7e(3*uiq-&)n1?oY0zC6~E-mom--7W5 z&PP14{<;e~21z$~JSXd%)v!5mT=zJdR2WrXv_u_-v+brxm}?~?mP5TxwS8i~X~vhk z)D?mNv!~AqAHX)>wDGm|AMMUa&~DxFqbE0YX!?Bh7Q&xtsx$ZHo6dMAaJ11achyj< zv14mK5`#X7TejZIgxeA(o?A32I5jX9XDr^h$5ayd;mT6ee1WxzdSLD$>{rM|xBoO` zwxX{o>p2~#V0b?OEeG08=Zo0Z$=Fg{i|b1ruS~H|x{xlEI_mx}p_Y{oCH<{4Nnpd4 z|Lb)%TohW)yI?M5(@+QFG-9CAkI8GZ63)8&|1QWs)ma8_rC?gr z8Si1I+OM(Ml@GU|M;&e^oBnM=AIN%g*Z$1L=7Zi#vv3gq6XO5)wm9&|#q1q`NfKg5 zUl~^hQaz-UUZNZwzEu9!&n%o1eqUIT_NpU9Y4?llM>u`|h)zqB9OAcbe0{DpTeD_) zxgKDPpyQ|wzR?tD^M_-hd=_4%t-sh{%SO=~d3WlDwZ-}o^5iY&kdZC~lo9p#fc>Y9 zQxXK$ZUY|bLUCizm>h9cz#tPzs>gSW3@JR@I3=nu_W0XLbJuyxt*gm9x6fY<$kzY! z3Bc5aE=WY+g2noNH~*AD%fY6}yj}NZ*BNO&u+K~3s{NSgqq3M3Ndjvk*zA|T(H6W& zML}WsTVeC3TtdP5W%ED@%&Ooq;R^V4#1^-U35fKw^WEveDdKX!=0%&vBR#P4cLsk9^2)OcJGScUohfI*-Ih8JLH5iP|u z`9-+GoXf;$eoGgh(q7W0Oc>}_E61J~RPA?g4pY)eM(`(xm-gviqD64}ZCA$XvFKw5 z*2wxM0SWfmSdIY|sIX?EE9|v^U9^qQ;2qJtRpX7D-k@l0sKef;zHDW|N{IP<;Q=}U6q6$jdRw|TLSbOFe*YN0{{jT8phxkyXQV;EFLRp> zpg7`?o@uj(oBxS=s4-z7ppUUCkctqezV(@?c4+a-kXVAL?^!I5fOkg zLns{I3A>f*&S%rAQn^{-dbQPE0rsey6^#z5=`51c=x`K4Rin-;W3I-Xqqqk~9Sy5PmAo?jU6 zqSLwI?PsjnjQ@Q};Vh5#_1^;9eJKszUNOC~t;jbcUoqo`Q+?{P)8VoR);wmATdlP~c~+TtB$rNB_<GP5#0l)E83lT{phO#9I}@R=85+Z9`&dKaTUx%@fu{Jm0| zy_K_Gx)MPD+ix~rug#&j-Fd!@Yn~_8vw=wqP+29aENlf(GWd%Mg=-0^XBWb?*5b&m zASU5PhDqI+qQD-})RH!A|W^g;S~= z-91%iLfr)fUig7r&%@wMnI*BFYfnt-pwE0%^wpb12)F!WP7M{?*brJb!^Ko`#AF$o zRL`A`_qIC(Y1iX5@a&ThtivtaNxGP`M_t%3(u&Ya-(VD0XX{L9eBh{N0iZxx5+kLIoU znj7E$NHux{5$DULd9PB9dFz<8jvf0D$>g+!BGQDfFhRb{hB3X@66JKv{_7X&+zc9DZ~R6F)q*>manAXSoaO^$m|3Ueyw@o( zy1( z{ShbBkPFpb@qZqJtOj??Fcw6ndmUU$XcDlrNMOe=mc*Kn0eQXzDJHAhdTfDBFhc*De2k5|vV)z(=2l z9sHB1o3B?)_SQ^DTXHT#BQaR;s^17nih)%kP29|OL>yvD4}@73Cx(xJv|_9>=|s90 zPh`o7_YZ*&0LU@VzV^UZe41!Lzy;p`15uWis|m-7E^qUrdw=t%|2|Fx6SCbu3l`}K zDIEn!j+chomc43%rTH5Iwt*F)n9T%)L9#@9NjDhcf6lEtSE7rzX%%23-Us?;v*uT_ z?Cq-HE*H;nLg_1BV0-!1>^aSDX!*aIEW|rq7=A{iB5IL9ITt#*1-l`EHK33u zo@2SnyI{q=Jr7a>^gRpu4Exh#C|Bsp^99VbS`JFBr#ct6voqk;Zj@^(8u(lBzMnr> z%sh2R;J?>C`1>QZ4ZuaS{}?q&Fy!iVTw=xTbLF`~(jd#rjjuJ~vDp(>53n2rUjA0i zY@g(7J;X}J4a}48k~b$JNzF3iQSD&tt1r27_|5q$yxig2QBkK1F3F7Jf0y3dHUAfX ze$eYQV9(r*jpFAyTdX-y*lRp4QhYC|@Re3+oRmu$4@Mw3F!prdnUOQ@d?=YwfFZ4P z#o1D=>ihu9pXC4g40fscAncVIdhu=0kduwoT2>cq!J-tI^8bQ-xsd8=z{4f_n5|#i z)g*dYu5!eh9s6cCHB4tZpfqjA$!ae|}DDh2_Z1*}M8(GOf}soH*8%YR+~Y>x^-yvx4T_#>kw! z5ohFitlBx+-=9nL8{0`r;Nub7(A!pE(M=7`#`vz|Qc|BMPilbdw#hf;22r#slbw+r zRa4Ry5@sVaS`zCK7V7oklO5Y(Ae^+P!uMlzRl}|;%EmtkmqScs9o$%?{(8**RVz%F zu6~Y}NR@<<0mr+XgtV=-DD?^)AOrzUmro4CDByZ#4^B9A8~b0MiAnkx!a+;ma zu`>QC2n#t>JO@A%vKdCC^wGuBx8&gs9=re%=zjB!6YoUQv_v- zwyUpY*JYqwxSmu0kPqd-6L7>gY~$m95y!9Ll)0D=yT&Ajnj9`(8H2>ImM=2HPpE*u zju7Q~d)Ev@`_WQU7&SXY_E!gfjDme-P_e;!@&)?76Yry&3izO~g>TI2nY7<`O<&S4 zZ1NZECel~_xnutR!%N?B3K{ZDMHqr_UY`R?OOm^Kcj4mUY+@2fI&$-m&XnN-UAU@> z%9z_l3w`rWu8hJu-CAgQJ}J8@M~v(AIu0EhC{&eVf61#+h4SI8!2T}*#5v{H{NH5X zPwh4_j#j)V@L1;M`fA%{D%;F!IS<)K>|kX?_@-F9d5P`Sj05iL$=BPQeLtRG zjBev!N}+Kx%#Bxt-=1$@40EeP6*qnQ-?<>1CE}U#E8j9^GYq;_KD!(mVk(+&u7&K} zajgfXuKxB6DS5B~L8D}w&42>^ad(%N0#QIdCT`v0)AP?L) zP6DM-S(@D}^|J4c%D8)d$UldV2hx^ID=$c%Y4fpIf2+}R(o->X-!I@A@ty*yw)II4 z&*rv>yf)>|cdC{eXm!Vmeu1!5dj$Z$-aid98M0=_bE`zyF%EKbbN{-W=mQvV)h1>b zjE{mEmW4uAxp(HWtY5w^WPKD8|9_p)}2=9|*BMb1ro}18z zJgZs+FijQ_(sOI*jm|u&-@Ob`|9A>l^My)jyESH8_7y2OVzn-uH)P0(I9nrhsUm%ZhP{A(5uIbS-BD;2}1o4=d%+ zOE)?XP${L6?>}83G8vHcf?c$TbBgmIaI_xJ2%)s-S*Krr!McCWQoEQLMfecH|6Xahd_Z$VO% zW>t?L^6SXHjvMxy^m?w0BX;>24cpVii>b|f5BSuTl|LLT`uF&b6ej~HvPdAccG69? z)ngjISdGzHxL91b^8VCif6=X=*ZZxvrUg;vGXOQ2|8+lrd%10S2N2YKG$X%hvW8vB z;pwe^ox2b8`_d?DQQ_)j4LznPZT!=1WV$7qbDp5@TC57=0+RDqp$z*=s@3^W^(gJL ztp0(r?!#x#oPH-u+TKsjQ6$bqmfR{`#h7DK%5nAr|NG4kI(KRmi`8avr?*ISXZ9M4 z))Me1u4!w(2O1(dZ`>)$2ldN~(?i&Vo)r;jMMcg3+>O_rM!Dr$=3QB_=}m7;`eK04stoPUbcNC7-3Os6+5>dl z(^|Q*fc4)%<84<4v|o*W;6AIC8Zf_K=6KU--Y)DXFb(+BjbBMr!*^j;y-=UCSD?{h z8_pn`_`iLz)C*Yn#Hs|kG;Id~ERxUJj1`5V7xbHd9h45ra~l$K@yaDIIL9u^6WmBf zcA9Ews++fqR7apHsjKx;fhkGvGooPmE4*x;mjQhGXx9~kGs`hW}T!f&Wd|;Zisx2JUR9u1`1Bh-j=pT)4AqyyB31nZRxG?iLrJ9 zHu)QQZg3*H&5@a(^U|r&tn3(yOvX6u!e4-&?E|j4;B>kM4vCC$hB#LnP%T#&A#y<& z9nj7gTp>)l1%vK*HMS&8FZL0yH-`niXXvES82fyS&7MyNVgCT$%uKk40XMCr;5-rJ#CaFkJd z-RA50wvc`nYQ9^azz^o(_l@UkG%#BXxrDm9E_TX3$)tI@Z#JlH^&;mglzQN9Vbr$O zS{}{SEX&}XbxK3vp(E6dHa#`lrB}O;QOv;`-^~5?0N#UVpI-M2EGDRIZ(!7WCXeiV z>HX5ksF6hA-78XTMQ8cVL~ZVBRBVD=mn~Hyr|?#8ZB(;(yL0hO zjm;QZ^3kgtmiCfp=Bu!pXySmA4cfs7wq-bf1wHDua;sk^==guj?nw`{zzVbn_j2_Y zYcZqIU0}SdR)aK$I`I3+Gvo}&T$eX6lfr@9Xz&jE$g1n_+ZV^_b3B(_%qb_r+Z~Z~ zvzG9BJn4C^4c}qPWqC)^Te;+0e1~BYc{5r@V(3@^$`1-CtNEsp&5i!wO{I8%#gX;H z_~6Oj)9Hr_!ZzBZIrUhLSoMI4-J4B>Rg_hR)!$qsPWVAUts9Q~CrQpYx*z+s$J46I zZu0Aam^O;Fm{p54E|gZYF-k8i^OYl4Mhi_HekgEvbJsPp@@QqqZ_#p3P{y8!K3nl&G6lRX&6WsItGYtY-3 ztoBg4`K9<#_vFD`xRU-zIIwSBf{aM2)6R^Cm$w|~ zEL>H-(!9cjEh|m6D>wb9T4d!{spuGwo2VqQ+wl4RZv`!_NM5#fUC!WOtFLr>9juqTgfPsdmquI$l%~_GeiH+u@sUvgFX^{hk0BI<`S5x?Vm? z;&rIj1)QJh69b6567zY5Ft)}2-T4JGwiS#~NAr%BxCthUSPDO>eJ3w0mg}6x$9yzD zd-`PLkDbvUD$Vyri@lg-RIO4OioBXeNKLA5vT2vizvQUzGzV%p{s`o}ouPHbHlUi6 z_BK;by}DT4w7;gVjzee!*{>J(ihALQH}>f~Z*Z|)q{-PuVU85+7vGsB{tn-va0&8? z<>J0@9*=0>X2?Y`7r!Bz_k%-` zrp6l@c2bk904&a?)~~nq?5KKts?=dWL&yNu!Z{>E?6X1Qm@DB z5fvdXJF41n;pShwM~KsX40S+5s%L?ApSQ z%*jDjGHr2b$TNhueCZ=537*tl0LZ=3pdi=QgD%MB2Jm=$DKU%oQE`#Tl6M<|VO7SbV)_N6etMFxO1^1X#&Jh3{*EDsI#=WrIb4@co&< zpIro|_y0}56qSV%&t$k`6_>;`gkyv)cO&+e1@0qjfgE(v?I9$ts(q=w0>%nw^}lZ6 z!>KLy?HMU=2i~Ym3Q~JY*3t6j+1AzFSl=3t{Ayax<_o8usx+hqm8`*w-LBvvFQK{W zc6ABkSfA|maf(%vInC`ZEpG25Sz$_U4nK9ja%SE-a>Q(K)!o2l1NS`W%ARpLs$Sh~ zXj`i+lyI(MS*ZGEf}!>aWC&lBtaL>RHg;Za;Wbb5QPqZ&1aFBuLExwY8~a2s&6Iv? zC(!ALg7~_p*a_~^VEBM$SY<4g3tA&(f2CG@*9oC-P9n_21~sG*x)^T%a}Q4a)c<8% zK9W(Pt12raRljx%^-jrM7n&aGmVEsv(XLGPvJr)x(_0ip1e@t)uo-3Oz@uMfKn=)G z^BcNp#|(BX%SH_{c^IZfT4??!dPo=;@A(Kj*+Kgo{0yB#lVAjJgU&gxkZ>%dSq;bB zz7GIBu|mQ~$#$Ag?Cnw`=2hmErngtIm0pT}d%j?3+k0$As8N-*oi=zl0!(ZqQS()U zN>vCIjMe4!(TN>bLdJ~f)0_PX^#Wr^SV^rfOEb-CX}(_|pS@1(>1u}r1+rKrVt88T zr_J^Z=cZ~eNBIxF3D%`1u{t{8T^)q>St>zAD(*0Y@U2Iuv2tViWpz?H<4^kNo~q3F zZSww*T^=_b4$5uJdGb`l-v%2lg-l`N-dG$Jy|I>YTbg?;!}lk3HJxOyzLSa{VU%WV z7GTASFGV6$(uimKS!zY{?wPf*&428hOlrBL#O&g$14EX?XA+E3sQN?X&DEbj-}C9s z`eM4PDrR5LHk)(WU-q()o-+sPx1!(kYQ2FfOBZu%prt8T{y)dmW{t}#O(oe|S04r= za<u85kJ-`#MT>#C~>g)DTO zByk!TufJ!B9TBXMeQ7jAmJhLqId_Z-KnkS4XE8$IE!t1`CLz}Q@=*-pksV$xU$;q+1BlG^36yjh5oh{dn zb18L!jr*q}Q&qjP3$b^n_JR21yW#iHul0?!rN|^E!8n=TNfulAV1XdjU`U7@1my&2 zxn1bd-6%4_JSj9^wTx{(=6fdf!rCkS!@Ckw6lzEtHki52bnENRt8Pir+{pGHX4%kJ zAkQGv^9?L2N*Jgrg|qB^jH1gcTy~FP4R~T~%sb;TU~p5pnOFR#(v>R%KN=Ylg8S-K z88O8Q@hUA>yjVOz_@}(q|CU<+Fh5j+@a_k~VEFsM{I>a@M-T7LY}4f7imUdYa)w-C zV!Jm!%^>9=91L$?K}$_1-?NO80xDyrMnBvwG`k5Tyt?dTkf2FL7JjX>_78`giCz&k zhMpng4>Qi0>-zwT{6JKgYZ2e^M`^Tgb`=<}=Lj3(k`g&$1@i5R61ka;6mgN_cJAG~ z!1mgSbxE03OjhvcWo;^0+O^+}i3~i8A4pu^1L1hdu_v9E9_BUGps0AtL}(P#VV-?} z7`>1K&+ey{n#X@yK{F*rX(R}npqfY-zbkwV^N9pq4PppD1ySv64`{(n1+zQgS3m1b z=~{Y;)rI}S-riE`CC?#Po7xkgGhc6ydMr?H$GzG~@1gd(CQgp8HEtW{;T!yjEPEN- zQ{C}ZO6ke&F$QX9u2Lj%zdh?cK%dEqIL@P->{scNs%HcNso@JK=2_SiiMm)E-%0Ont_N5bzi=D>AiF-5U?$gZzs2b>d;~nis zf*sOtp|Y$B6YcAw2KL1f{9m?^iuC5rt4BHqA>**J`LCcm^zccZ4s1$c*?W{QO2?|rOaWiN0E1>_otQA(VvZVGchAEk z@9I?hgi#|c`5awdUywy({*yvGWh^ps(QRc%uq<&<&6E_4IcrZ})v_E}0@!C1w#l&E zS#I5VM%57+t=* zfv4mUS#9~MojL&RU-*p<8@5lE1fe1<)6c-ItMuEx4Xb<~$JN*#SnQ3>s|{DMj-z&n z(2QrwG`?bsJNJiZb|DTF$fSXVZkIt_YsvD^nnGlpl+1cu=qu!QX$M-;M{SkNs zO*Oc2HG}#LO@d%P*OeC5W*iHHFr*yj#H%{A9g#LRV+#{% zXgfpmJLPjrLOKjCI?NJ$7^x|mZzR%s>Ek{*V~Z$WVJcE;`s5(M$g$z0-@dDfOq{FA z7r02134Qba&-bl(oSSmcx%JwLU@2~&XOKLTTGWyKxzR5i!ogJebtUtam} z4HHI<=^VbfWmnnoo~6YAl|8eQmIgbX4rHOb^-9KN$bfl53sI4TP5N1%W?0-WUPBM6 zAg9B&z8y>(9B@X7(>6|VHksaSw8wchdIZz($>gBvXPnRX7xJb%E*6(Pc*gi`Aa-7M z2T12-YL7h@oJlOlYT+Zh%e3KNpb~iVetMVeZrO#BUt#-tJed}y-B9MhFO>0rfq$rr zO~``|pkj1G%uQsjMwtZWLQiS3ZFR2(z$+&LK3YX59w2>JTP|E{!Q1PqQN5(=19zh) z(i)+q>y2Q$*(})q-Wod7P!nI5!U^)%|D9=@{aCz;t7eX~`Gy9}_P0;?;x|N&I2VZA z63|DapJ+(jZzymihW-i?)AFvpduH6$N9f!JFPvC{JEYcHX872b(YP6w$$sl;9LXR` z(C30|8lMtal}vf^=GaW^Q6jmqRw5jbV0=MuYH)e^@t0$=QKYj>KfG9QkLqOK`sK?S zpOSIAfyf$XGXQ1Qx74!} zds9E7cV<2Qt640_Quw;~x@HH2`{~%x_gbdNj6y&OxS#_Le&g|y9OM(Ntm)<=17djb z1!iv2iCKf_{IDbB(>K>OJf#EVHKu;3J{(+HexL2Xlv~Bv77`NkGv<4YUzca``r`2S zBF4@@wbd?JBOQn7`x9X(BulJc?B}?u?Okf4`sBxO*ym&^+EbP#gy&}r6}$GTrDdf; zzFJ{MS-k>SOC{JwJXy~--8@idRarUjg%Wpq9p_3&-a` zbmHi+|F4bbl3@{@L$i9(LYb-285B zG*Ruc{ar_Y0?;gJTMGbW$P1DWJMp3`!PG|UL%;iF?bGBd_T?fK{k|yj{fMMr09(VG zw2I4X)6G$>WMx=_O&HphiIh?3O3KYE5fvKC`BFy*B5Uo^Q-*%np&)jaB9!E>3QuL0 z%AHoNtqF%fwKFAqNb!)&*P7_Q%XjeJhnEZ1-m$kU`R3{$ckf=p8y>#)gT6Hjqw43o z*61c2LNNcm%T$L_f#W!P$k2S|vL)QoZsGqwszKV{GVHMpZdY!I6NVcnHN8tHeF?%{ za@39_OIc$@q%@}vY*ag`5@Cmi*nMGhS;IC9Mi)}XM3dJ+)I_@87*5yejufuNXnpLv z(7=N0+?e<4yzyV^yXCV7yX*x7>|8BoSIoXz)}kNkSn3JlTz5cx z#92st-@Aw#cU!L!`!F7-VfCUywwJl`Jf^5l+&cxu8kAA7&@L|6h!?fgMrE)uIw}|i z9%ayO^i{ZNqbSd6N@84E0G`;&sGlmFU#l&q6{a^ccHRmQFD_K43B07^tl>4)8=u8d?^`!QpE?@y z!IIm<9g0gP!V$Z1_#z=5o}4PnDuKxesGGp~y0D6dGW*w9`Za-%zQh^UvGIxesNu&_ zImk6cZcV_zq2}D|LjUHC3jHJh=X#R6g@Cb*wV!7e_Y`Yc`8rnZbtyXnKzwlBz54*8 z&48Jwg;Dk`Be#(kMQ!09dfjP{#(HO-HVd!~$sYnY)Jq-MOgg_pS6oH`6a0ruqk~MR zU#7xGykZw!9*q1-E1f?F{Atm>P3 z2%GFR8{if-Ly+lM)0I+Ou76zDK89!j;@^Nm96)2-XA8C3_Bh@NR4SG)W+bnBot*D~ z-p`Ju)e8_uS#vWGnsunQ4ut4y|GOwp3ZxMss0B#tX{1pto2E9~{FTy049=ko(mxrLQ6XxRp zNUD4|k~GG7(G!((rcY3Af)0Nkor+OYi#hpq6;YD@!j@LGbg-`uX3j|Q-h9lB0JwCmBj6QPO{*#}~_|E30 z_0A^lUNU1U5i*~~GLkl;k@5FxjC_OIpZRf&eahbKf30u?SrzD{cJDK43SmY?}7>H z?f;N8WDOf#_=n$pPvMFqyZknXEn@)jyISpM5!jSU|dObt04Iq>H8*4DntR7mr*Q z(OOu=ui?rt|6TdIqMh4fwvkPt!8{3fvi{cTEc}7XnlvllefY+Wt|wPk3rr9f>V968 z`t8pYw0b#h*QXe6g=EFjo4JB-k9UwY{_#X0z3o z^1em!48i-2G?UU9!tf2N%17KF#}_EvB|AWQjCR|#YVJ)mbF{p-Plc(ybO;`o zSOZR0t@%6u#XSXQV<>CYa?#`DGdeAXMzxYBWp=J~I+&o44-7jxg*apR8U%H6kHhGzODw|S9ak0GcU<2BBB_2Y~37v*0NW$(V> zQ+bnN=p)l$LmM4V|G6knv{QcsF+TaYG@bcs1?6_ywE^90?re!-HF=XI1(EX+F3%B- zH2$tth3Q(%8I-`*)T}Z@LJxV zfxPcZ(Dl=O0PQ|>lxQeC<-afZVjHEA0e5FqRFt<1?PaqI+ltyiA51)&Co7~Ci9595 zx2#M$X6wtb^eyL$XqgFe>$~4o-ZNZ4OKAe$>)TqnrP&j!%96g>KC3 z#_?|Bj`pfwt}-+y`F}AtyJ#*CzmI<)N5W(u^BgaVb}7bYd-RExR)$z5l{ZPiOXt$e z`2o)E8B85ZLiHV($nIoVmpy0;38mNZmKg%(95C_)tGpb5xa`^@%*R71aL|f=!y}^- zIMXtHf$d+bJ=L5gfF&PK5g8K|dViV|#{B#iml{`Huo24x)>MNrj!7%b6u7WISuGv% zQqS?v^}URvrFB3ukF%9G`BLlVRk1-CkY+YNeu~kLN}lQDq`9 zo31(!hlwi6TAWN{VbFTf`(u_DIsRrL^Wt6)aD`7^fAwMfbAeuqNQ z>KW3VQCQPBF==L$LVLg-THoeexnP>1I5T$yGN>UwS#OL>=?`R39x_b3Sn6n?MhBZqpHu zr}}E_?N5&H^VsFBx=sW~$dAf&K!rOqeV_IpTuP^fS@e5#O^Pgio#dNTkEW(A4br~K zt)U2pOb^tti?q?AX+`|@$#_+4^U_M~*4A(%|9%6;oOp;q{uJH*Yi1PQuvoJIuwhFv zFaryOki)SVzj5}D3(diL{4KEw*oVOmeyU(+K*jU0=Xj#KVg*R^1b`9!T?d)gqwNj? zzHEgA{Y9b0qfWv%-M_h%(KgSnyu92D>u|=J|9tN|7VqC z`gYQ@o_$D+clmVrs2iRk-E%qph>t_CvU~l&m&I~`H?O6qi3+R*K*$W)<}LljijH}J zSN*y=?x6RG)ChDMT40JSp@tSXoxO6f;V=3d@K#1A-m zex>o;Xw|R0jDVttD4YIp-`^E`YUG2CbfM#7wk(t6GZd{ZdhyNwkE{2Nr}}^Y#|uSN z2+59Q78#+etTaTjciCiw9OF1nMv)n^!XdKv9>*xz>m+-RV-)8&<~caV@1c6VKi}KW zA8u~-2j}^GjO)5z_mQdA?Dx3_^Ei{^rAG2Ymquen(N+l!v_BFou&Ur@Mm%(G>9H1GeIw98xp zQ-ozhMY^c7AH7VToxdNR)zNoVf;)=MFXg&ZWO=U5^W+slofGDHFfba#LQM182YWtx zy^-};=#h`V-%PRB1zZtmFo5OM z&N=!_DU>p0b;L4po50uNpx_{6Rh%J5*R(os{QgZuhn!6xt8}qu(RXG12lF@F%TJ4F zfk{CD8V&a_SnvgRF-G5@C|ch#?D10AiT-QB)7-VY;&9N;=31K+)I5ZpypYaLT0DnJ zukYvQe`-#e?+1~nEQdtRF)@pZ(bR!iFq#cVjeNO_<=oEIP!5M&VP@`f1P1kQ-F?nV z@1CK$JX-5Q<0z&BVz_=@ODOc=J^Il8tgCoytT=8CadtjMn^a)%X2$dXs&MnXs~Cxw zRgx-wRiD@N_kKEgK*qFDX@6M)za5G35ygyU!GoLMI7+_~`WUw&_I_fpTC*{zGtifZ^XjV^ z7-7nbBe5o?vVXGuw$%l~`?bgK?ryM%V!h4^yPU!Z;(Ez0a9YP)N$nn630 zWQBNgpvI9+yjkyia1f8q6?GW=A6W2|w2G8;xQYE|#B~ z&d*(Ta|kkO4;bOI|3Kb53WA!{D+gn322Yi$xyd+)Fu|IoB>?5v+_u@yCHo~ltgAtoZcJH#J!Et6n#Ax47 z>s;S23Qe97qDn9U@tNyRq*}ex%Q8oewgKnPIXO}vc2R*`7SAxDb3aUg^=Tc~w=Ah} zskEVck#OV`&_hf}B!Z+bU;?aYE2%jNq6D;*EvbJS3hOZ8+b=_dOCL=DnJ*v*-07+M zgt_iWY(Dyuf!Itg3;)Mhl-ZKDsmMNUR`u`^xzZIgy$(!N*Eh>9+u}(Hxgsp{*_<~& zdcV4Z!$SAi*3+}5AoSzIoftJsu;U}NQm4ws0ZqT--ra4#F#HGW3a%uHLnmvEcW?w} z`fS~y$$qRbg&nnXOW()PDX`o)-f21-sgES+s8jqRT=e2yyi?BsFQ)iqSxG0kPFSp3 zp2hE|Uh=74BqK%my=Taj{-%u?Pr^mxY`Kh%FFB_+u2-WE=b*yJeV!iWI%w12=#MlO z6CzHdoC-Ez%HsYgE!RA(_|XQy%(m{fokb#K=+SQ-mjkyGf5y5SAGq;>9@a3%4TmjK`Lgt@x0S~JIRbRNGOWI^o!3^nbgHZlQ`YU!dzJ2+?9s2vZ#HGx zUHFajPi2$X>hYQfB9j|+_R~ke>w3khI*GhAx9AzLYjAmhU+=Lmq#4hh2;9*!URH2A z@H5D~^ib(VfjY9<5qpBkZhyD#hTQ!>9tG5@ChfVT`~{jtmpzw6MqCb}9}AVDv>1$&u2yjEXPw(-VhqT(xTc=9oh`S+PuJ%6 zki=@~_1?uq2b2Wirr1ye$C1w(_fveRN1#4th7{X(UqTv(48++A;8Gez4c_=}s(Z?{ zI5bKZD;+QJ%8x}n8FY@OIw0bS8fQ@E1b`0~*wim0}5mM0DbIET4I*`tZu zeMv1hOT!3ws?}Wy*ZF?n&|^sGv@IrLwXFX-2haX6x|idTrUx)(X6416Cjs9U>fBdd z!|~z+1MAH9T}liyzu9NI%-nb*mM;!;BlD+f(o?Lu<6dlO8+J|9f}y^$8V)mATOL9R z=4zjJuhA1dBRmqY%;Ymlz!Bkhi^Bd>)`V+y)FNUMVMDgdTOzsa*r8xp?NexfZ_#BPog~dgIM}y;gS+CX=Y~Bs4h`r_^c*OJ0*s&XusH z!Hu+}ee`*_yUfLeU@T}|-2A5IlMZ+|n3?B&T444SVocfU z@8#J^vC+K|R5pNMnF2|^EBl^LyzKXsD0^lqTd!zx_{;IYKd!wLBB%6$hyIa6PZq1> zDK#!6M>mM>aLY3oWYso=Wjv+8yR3IP^xr4}7Keo_K!p^p{h0rTK^gZ`i}wm*uqTIw zi4Dvuke49+r#KpGP!(pAhFE*KGchHB7%Tg4IB{Zpdp-M_T6C}PW+yMf(Lz*V$2O-> z)_^0Mc+n;=eC$ghoP1#Ux6HEg2>WlG#`(*gqKy&FwL_X3LLWKXw!3^lU>l$C&CKIKdb%7KKYo2ZAA4uxhOfzqHCp$`LM@tSOQq>PYelPt zd#d{g(_7s{H$~mvknd7m8?Ssxzq8vod{I}dA=!Y*TV-?8?J~0aTvDdVr51&31A)`! z@&z9c=7ZcuY&zBmcAlvWny9uJh3Y?o!uStVE@ZGegD;j{Uu>#b{dO-U{h zcLDuN9Q|>$$ITINj4#h*+?RgY^+clY!rQNo8}gCzJT^~6C$>sA%Rr-RXw-81y<40C z=E;i4?S|e%x8$^<|NNXX+V9F05{K+iTtusQlepFL?9BGf6z2P*f+EBigEV8H-8w^< zT+7qR-~1}-Gy)7(N>GDp&1WgA9LAnGPu1PF>4|Ult|y26zV%fdrsPmendDuaSZ34w zEM%kA#3qW!=5;-C=JwjI;wsCJhVh6+_v_Zt@KLKq+>0xf8 z_k+uuOfC4i7gW@`F1@f-K>1f8i5!TDRadKcjlW@@p_BTu-fYaI{QA+~PZaU&T~YvY z-c7@C`>Yp7K<8GUGy+VQTE0h|S2zu%1%Zh0>2>ClxIT zTdOCuJkS9Nw@b@?u)e$sun(Q>cxH7!reX)EuJmPX8J0whrb9K9KHwk1@aG}6e9rI& zuTCj!NOMi(3wPpL^IIz9i5_BV5RIEt8p< zdF7H35Eq!Bcg9M?n}C*1@rpCk%qIv!bgVF(yG)P&G(Rr~15xH^%)-DdcvWHT)8C6p zMFUI#n|>l1^ha9npqU>UU?5j1F|uN6rAC`$X>TuR@mz3HVqK5!MG!1DTACru+(AI2 z0cJwnQ4JwnK&B1@V-I&$hxp4|1`0Dsk7BFx_Uq4?aKM)S%ir+mzbA&vm0*`Tr%R}B z(U$tbi&0W&r&uYywynCB?fdudck#I1_>jQqFjW_ui6=t?}A&<%hN25cy8g?M9hEDf~*^XIO<#Et+ z^WN-%TxCed0}$}jZt{ILZtRN+(t>UEwY_}>(dKLyFrkNqgLEJ3g7HJ24_I?(y^Rgf zOD(2>(ZTt)n;9u6;EDE0;qQV7q%j{q0CiNlnnA)vu=b+?hGe?Dxo+n3B@aZqk_n}Rt=6T_LvptIr z+?Vz{2P|r$QpSpJ=+3-1e0+ZTP?Lb2;Qjp92I>HgX>bfP8H!zMLKSYlj5YCnGBi2Bd z2SkN0^!R+W<#}h9ta+E+@ATt!$jy{WC4CLJgn4!RO&_H{ICfA3+C z+nU#y&CJW78^h%z<-k=GR&F=IlV9W0WWil6#TmG(`t2jXmKwJPiFa&vsF#Xh+UG|p zvbA#S2QvT(zhgY_`Ox&%5(R%(DHO=M^`cd`H=^AECb>9bD0Z z@bzmeh?zsd@ zaTEr9^8-rxZyg0*=)8Y3T(8&!c~T_GbKStHnnucDeb?6KzV~vM1p%(R0IJ=eM;YQ8 z9}o}#X|!%NWtDpM#^(iMs~lZ#V%0(U3W%i)vtZZDRKGR6BJOHGu-pPzG%q<*{bTyA>9!DzeOyAD$jNjFq@Iqi~uc5E>O&R)QipW7uD(uHR|Q}y35JWVxP zpV}paShcY@BM(11_;6T_wVQFPLQ`?Jv?|BN2-1%I9#NlY->qeG^Oe$;CFw5J7;jj2MCaBNnwv|v-_7?jU-P2cfRegIM(LmfePtf+W%o)3$ zd4z$ms^HU$i;I;VP&X#2_OEA7Kg9dcPqJ+5DB5Zmz5k)E0-cKE=izo`;Ym_G-=!o$ zzF(myXgMZW^4E0_*cnS)bvhn7-Z#rfon(F(7F`QD2KLI85_aG?7IXPEbBKi7EFZ5F z9|=r)%)nyP`t*~L#5H8E1bgYB*)hnZ9Qj2&`k_RvV^Q+p5cu0v+ms~QME+VpZxzre z`sn8nBylS%D*)%QclFs_f8pxw;6CzbjfHs2`Wi~=Np(01N9CB;%@TfJ>gAnib3Ja}P33ikp^&OilTy ziJNbSXG=0Yz#Q7nnRkE^#f8mBeb&VyPOKMh-Mu?5>U-Y1FkN=%o~X-IYN(&vW8rK5 zQy=_wHMGC%MN;JfT9mR&!@fGNdNSWU(*M7T)+Os|*|nk>poOZk3jKP4v7L7C_&a=; z`bBF915em-4180gS^hBlSo|RMcnh8f{WElY0Sp$<0%NrOOys9iL_8y_9ngt_MK#TR zizmw`=)$;kbgBi13clYn?uo?A!^e z?de$t?2UKxrkgQBWm>&`wZIOe3$mGXRoqx+G^{L7J_v-)4$SEF<5La zR?k%A+p^hVK3pe-$ap+&Rxzn`egA}v-!;z0DRb^F)tL!rcGL~OvnC7H&7m;e z?3V6J)6%|O3Ou%rQ8AdB3K5eeYV{})zhi%;Jjh1gqU}7A+=eE^jiwY?SC?m=tQ2%H zwo^_H=Vy9uN@T>geSss_R^!;IGMTIOUgz6#HQ8}23{(_XQFcQZ1Wwt3+T!wN)|a4| zHH5lmlG4<5?bv@iD@4!itA$^-s^HHGjT0# z*gjGPZZjhJJT3TF&$gY<-OVMNtt7w5dWA6|3-;b|5EygN_H|!*EopIY@~i!{-q-u3 zDa22jA8;LoXq~@FbSI~xn!;#bt8+(we}m2bF<2?(iwLmu2k|FAyX8Mny`jjuJhtz- zeta}@T%NZB!3CZC1fAG;OEdpHaQT;F*O_Nml}gn*3PymD0tc4+$!FeU#>j5T8J~f1 zwdjE`bL8SVi;Ml6?}-Fl_6M6u=)?_m`_2HavTO^Kp6*&=FlO71+%+S&uEB)8vh~|Q z)IX>H+F!5z8gzT7g&q_rL*$paq~qsZ+&M$me4L(_(+3Q!>=kH08D5#QHGz&VZ=AL( z6nG|#-L8({mAYtArBS6XK0WZfDCi=aK#pxBmvrcvk|f+chsf8gvfdxN@Q;Ec{p!M* z2zWO2WGT%{J^AT>?_scI6BRXHGa^$C#75>$JO(EazbRI=^NyD!n@X1(0mrWbMvdah zUvR<65A7;aY;d-2MTaLKSiEsyn7A5 z>hWu@_oIfmdEbw~&FN`VI?PL)6aOusz}BhKbL*DBS|$w4*|yEE?Uy5CeULZ?Q9-Yr zmwy1l1RwEnGOxE(gP$)uSaU(o#9}_XXXb{kjovtev-@Zw8F$0LA6EY!lbo$_sU@x2 z>Oi|+y%^6`To>tA0b^%o7M0%RE|dHz(`zUIi@yjLh9QjqMWTX3s_$%G5AD}dh)0R5 z2hGn?chv_TIi{#q&wZo?6Y3onDqRy~y0+&QCf2`en$n4I0WaRX-Gt|N|C(1_LUlKG z^yZ8z=Y$5jAaxMsq8gM&BF^38NY7w3;7G{Muj6 zOcf>jGK0y!-HYAbxK#5t(~jNW4=OHhAGh&AuX-flTOOFI0?02~_H6pl;YN)b1J*rc zFeByYffwpao~m@QLCJH!;s=$eZ6kB(*S|iT8JL=y;&j@!Z3muP{mQQ*zj;`AdXD;U zUinfUo2vm0?GXAuGZ!05MS^4Xl(ixeeuO$6tD3yao+B{>B&@q&lx;I|a;M~}9NaHZ zrBS_AET1%^R4I)TZDaG8d=a-LcLemFlcI9ETW>NC04s_f>>_jW_)fkuJ=yV2jd|tH zIdCS~k}~C3FT2rCQ0-@xm+&o}x_K=5a=5^{hg#xU1kG}H-mkV$NOJ;d)|PqkR}hMblNI?au~sd zOql?Y>Qx&O8s0)X1Og*jzet+XYj<}BXF!mqC4^Ua$FA(qkiPP+@K8&VD5NFbinx;F z)=1k50sqo+4}oHX?`OlkyFn&#IULwy&6B=?>$Sq;|4|$F(#Bb((eGPa$vE?7G~7`{ zFO)JGx(L8QAvqt|qVEJ?~Rr_yR`bd?w_A95FSf>7B4}@SQ!0qLjYH`nK zN~suv2NMv-lAq!`w!+Vz8-v3$`;{PHOa6(}KKPq>x(v|SU5GxXq@=_~u{Qdk^=tjL zvx_Q|zc!SG3HL9d9g(*;L0@uY1^Nc+Q|JC3&yJ#8Z@)z7@$ z5M8=bm?vw=88%TX$Lm+YddIq?m>GPGtpZE!O_>JHdz#U4+QH6$%BJ|21|22C{ zkP)v>Z_pi^hGg0}G2ysFxshM<)Nw|Ejy|^7AWK-psmDCj*15KkNuij_K9^4My5xN+ zenvl$Ka^JR^ogJj_U`b;w$1z%BHu+|N{RJ#$hvBv0W8+kGD!e{vpf5X(>R5`*JxkHk7x zb&~;ebcf;g;_@FILkoAB{WD+6{@RYUQrT`{ljj;$8<1pO_Xw6#N!N?YnZ?f*7hI}* zJ`CjoX{ELYkI_EqUrh`5WjxoPE5Pvx1Upq4HHRFlQ0+qWiuWg8*(8bLlN-sssZ9R+D?3Iv8(t3#J#KbG5`v)fGw*E>$XoCwm@`M!jO+7XHL#_GnSY8k zm!l44Te?!MsPm2-E?MURxFeX}(RbOF|2Jy(d1oUMDcysROS#oeRuJU^yepj z7xvouN+#~)jgGY+e8F}a02_gd2Y1v2ucqI$CW&g;PPQqOgql1+weD=vFaLcX+-U=( z^*wcb)uF}y@?`GSid|6Zx4NZMdfrvDvg34ThA?(RIfYjP(?1*}dhfDN zc&-5!ul(a#hfq?$gl_H9sk*-+Z=RPhTDRj#_%ncpYmb&mfoDh{E~08tHGm-}?t; zZ$!r2&rskz9~74qN+P}2NZW)k7I++D_o|3{MpZ|;_OXPk|1>e$6f5=ozQVLCyv9P& z{;|O#DS%R5;@rSG(5R!zUR25$jqo&U@v+`12*p&AWQZ<4&PUnJ%;!9;L@qyz4gC|7 zmSFsPU!f|!YzmQ9nnxmBet*r5!RC4uuo1jangXk&6hE6aJ<%ZtrRnz6u53S5o##Ye z9Wm1chr36xKW-c!B31y!Ljn4Qt!)RHr@;6CE3k~eenZd#dzVDI<+-Wg18~cd`r9wx znHp%0! z5#Rj`34C%!bRtV!(nA<^`Z333?I9=GxXnAtQ4Q-TvN0DQ65PIrZB_{WvN?^0 z3ew*Y9EfkeG9R?%3ybw%);uWXc1^t)xPY2IDtZ4!c1r6z9ST2YLuSozDPMGWTM!tsj)1=tiihyJ0)iarf%$>XR9IR909u0@yZZ^F|1hCMrR{GW}+IE zrKBQl@oXq!blO3JMbp8#OfmLN($Qm3JCgNSoi91poaD0F(L@bPDv4a4-Q7Sh4(4hZ z-Pm9lrQ~d>C6A&L*~ywHmWVnO95JEwt=(bBFI(EmtwFa>C~1rgt`D}cV5gD8K0L;? zOCy@xhp^GjLl(^Bfb|@D50h&<&7?9fZ(3?QnILK6R;!bJ-v{^UZl$i!Rx(U-3;O29GDYzYRZui9Gi zZ0aMdG%PO9F>2;4PuEby@&Z)*`k;Z z7EF&{cYC73<8m9UHB&XPZcdbj){fHuZv4;Xy1AxRzlYcrtC$Cf6+zmah!nvU0?FwW z9X%7B-L4;*kK@Y(K~Xs6%JHp;@F?VTLGQH?jLvNs{a8MfcFd;t)6fIK`|XAFZ0zj$ zOW#2}BKVKm>yHJ_RDw?M^qlV8sBby;eL5crpX>y!g2ow!X~DR@;uZ^hx4axmpv6yM z@0d+RCs0>;3F>@oT(ia7RM>WG$^x!Q6}~Eaf~y*LG1ZY%{B&QJEJsk6ZN8!gy5*Q) zU)%0D1e-2yk{#WQIJk>rw$-`=7dY6vZU?^wJ!<1q)N^~HvmjLVy|P>0-u!mecDBFG zn64!iElvHZBC&ET{oTOLG$}S8;bSM5-P%ltz{1{^m0M6CC_)~mE~|Wlhumz`FLRDN z%&Pjqc{KL)TOSE^q-C72j>aD#oPtwG^oAjroKa#B-?tvQ8!AL_l?91JjfXh8e*Pr4 zf&o_XvPB8jz#q+OI$D&Hs3NfD;_(Ct2gB8^RFxjHxZDRFMYWCxC-$pyF3u|VPsIMQ zp=yUC-^sL_y?JW>h`NIxD%;4?q@?LVHRbzS-37)i(hS~jjds|`h5-}cqRcl#2)Bt{ zHOp$9^le*me{+%-W`4{#+=GU()h+%NH?@Ybt>XJ7>NwujNw`@Xxusey|GJA|ZNG@FxZdhrpaQ?`7_%2DMt$ikoe!VNZLZ!+I@FJiY!8Vz^6V9%Y?$ zgt?<~SY!Hd&5!4c4#K*SZ2NYz1j3^DhFRU~+$mhX>N!{1iQn<`D)>iVQM!n68wW&L z?Wl`~hljgRV>=>64(2TuLhQZrf$n3uz;Mw(k}S880KPNp5h&X4kaW9}Jyrgx=exIP z|2>Osb#35W)o83+>O{Z*Y09IW%FeZeEbU6i^uy)2gmrK1rV2jMo&Z@_5AXpB|YM{GB zARz_rSzWfl5jn6jC-U)tJU-!S7<9p$}Y}y6h)@_+IN4+V8mMo)+N4~WU7#&Hq%1sxdc}YrT&o&f@ zJC4loophq30GMD%b9H+4>c_19lUC=-Ofe~zP>J!Bw4i>+$iUqN(6-p=eF<0a@DO#yGO3 zIwcK$clQZHMQy6?qwXU#Tdfn8QypbH2v-RU03+7nIYpqTiK_Thu^iaxd zUHZ^rY8guu^H^#pTzQ~QUcHKw$;+_*v7w>C zozNH3*eEAm4J9~r!%qlW5V@t>`Fon$3vX4_htxvBdLM?*K#UrGD_E695G?Y3(oRq@j&rgN;P?hH=+K_B+`Fka7DBJEYI#kk zsX{>+YQl2mitY1jDzj_>i}&e&6+VNtg)w1Ra-He&$?qzzC;?nO;!4THd5G?y0Yh5jxxR7zL?pt}$#gYREHt<=c^On?gy}r^8V#xQO*Rvm{B#j&_dL z)XducSpBNQ9PEcv@<4BEv3z3#$~&v6Y_B^u{CICx+f9C8c?O5${kxo{2>(DA^9Uzy zN^C~wMMQ6;Y9yQVaIze1|JVBZx@`}&`8j8TvdDD7f|iK7l^$44B3+2B(e`XPEKda# zj(4CuGQQrNoot1ma^#muSC!^)wb3Z<(V!w*lpY%BE%ezHILq z<&hko>Qznc>~w?*nRaxlMwD#edZUW#KgFn`@gO}YI6t>q1RyZEI~j{B=IW?%h2}6O zu?}hpfG03b#)_e=$~xEp*NmE7=79>*QN4?itHy%U>_m6@kScpE>hEKSey#|emh6zvMhmQeC*gPUEqai;l?Q=} zpIbXJ))_(+#6Q9fG=f!$Yy{wSQ}rA!T|*l7QQ!U1^W-JH_gMa%s=S>@pM`7IY#aeg z7n^|TB5RgLDmyU7kNnZiR>~F)^U)ms#CMWF&J~!Q@dI=VZTr=z-=8kW!Ocx~$5QhD zn-V1}(V%E2Xvbt#^>lKOhj+acScNSbiyzAU*ov1j=|jjOPsTQ;3+N9vmNT~E0#R&1 zy_PIyJj+jB`88~FaTS{b$tnJXU$yyJZs?Zj)6|k0)&C6v(|O8_o+l6-H3V-7Mj@*N z1_Z~y1H?>w$CeNZ940q)QrTa9N@xU%j6jGq2dNP*mTKqeM>KRMx&Le%p3^!EwR+*pr_G*NqEMy&vuB*o@T5RPLIqyRO=09KCCAuh>FY}_uYWS@Oa!CjK z^kwev3K{gB;d;>-s-(Y*Ac0<7RI`C~qO!#stk*ayO>Kf47L7sgkq==&9>J4!b;!oH ze3{$>2f8ToW`6xDG+0ZAQKPAShEIeBk8iP=$*xdF~d=;r6 zlW%tO`7q_PzxB(XPa{O3RMkFlu0X zKFjdpUm~0u32;rOGq^q!nSZp@=pO@r&VtLA2A(LTKl*d4C}e0nUoyWn3gLK0oPOZLYUpzJZch#)>S~Dvn}!e#p}R(h z0eeq_FxYhyb*v*h-arw2!2MQX`r35p+nNz##j>O5mW-{8&@*pw%aNNSD|=lSPY04b z>%ZdL!(~e0+0d!c)jwg_z{rI2QKJ?XkRe z+;M+iR-jaqcv3Hon`iIBGrKR7DLcm5k7Sn!hTflfS3RXqqF;h)iZ`LA{Sh#kS`~O) zGdn&Q^FA*5d6&^;daAd&L8zaC<8$DF3T(o9nLf(ciB&9V7%4+^%KudKYC_CdhtN%( zc+N9HUbDaEy$h+MQo4x@UOLkG3R@wN>JLG{@wQq9hcf{Vyi5UWTst~l#d?Pe7Ec|w z0AW^iH3v+seELS)$|)rZA6c1wIntoC|9}4cntNX!LFlsh!#*!sxMnzXPPF=@F7DO4 za~Ee2Pr9!P-Q1u}~UR2e~YSZ3JHSy14N6(RM~J6(r*o ztGD-e_J*O&sr4URivIx;V>SHB2v2jMw6Q#P{WvOm;@FnEVDPcB%}_h+oP}ebrXNAmh0N z_j(Q4!KP&0s6XTIf32|T?_a-44ov9BSvp}qDJ>OUb6R>`!T8F%;#zXh$H!kr-?3vk zSG_KdwtxQ?K;E68af5IAA*zC*lK%iWd*QtRu@*7|Isk{rS@y^&IXU4QoAntCSEG0x z`g;#f_GxgZ()EfF3_9Oe*$y|n;lw1b{w9dKY~qlgrqF*-Vt9iA3_@<2 zI0OM+6mPW$Wv(jnq^v3Na61M!F^m!~=f7Sv=JB9POJ!V9!uh20{onRawwWvx1&b)U zAdiP)wKKNiZ*3{TBIQz29yw&bFxr)wdr_S z4&k$fJdiCAINFc zq3v>u=pkpwpnTCnnv39?WKIK$*1d2ia~d?%qZp6Kv6 zY5h0X(KZps=fCiuj^B+=k|V1z7TuAb`v(f#rj3yzxwkg1J;qG;W7)JRT&Ss z@wLC$qkpZ%0w1oaDbdDYh5R!`1()27c-pM5^Bd*a790Jn23qs;X*WG1+*DpUPn7d3 z!g)#D{3jwl=qz6=YyWCY@?X?QFrnAoLx%QbCgHGpIFI_y@Y0uo9geR&hdb8L3^oOG zn;-I?-kL||{wici2%lQ3>Ewy}oyC!Mt=TjL zAGF{-^B(4Rd|2fD-QS0pyh;Rwh%ry?Ce^4Edk9{|wYvauosh8kVS(qS-W9jlSR}7g zvP(I%G@KBW8v;-r^ulJM)^56AMfl5?2FKI?+kmgVov%`Fju+-}o2m(l3v&8^TBNte z>x03LHR|(9GR&F1w(K&VG@qxiY5u6{{QS`G)(yv( z2$w!0GwJ<^KYq|asXVph`TkqD^RjLOw;wmRIh(TWPs_13y5OqT!^1U#Uh4UX_xwgk ztWA^Sj2TR4BuDY%tvzV?2xHSo)%uDN6CDSBXPOV7cz*HiUYkz$#CarRy3p->g+oi@M&aQngS9Gt;}zG+a_ z;u@2yK@5B=FXhoD5&}3zI)!}v66xzXtdH}Sgwnh&R$d`W#d$0yll={-?NrSs&!*EZ zXXL-)#_nOonNc+Jj%!Grv^@(W_VW{)Z2+$gF=gneR~@$A{iu|q+*(lqb* znReOw)uPH&CduU|E^@{;7+l*OF%S5=m&wPkS;=Wr+%#G|zEPu-qgt%i2>AaD@l=>Y<8+l0N>>(!XA$J?YmSbU~tMX@e$T^Z)2_7ZrTYwh)#fI7z{slkos# zMb>0MZFh-P|I9&KwxBem>0O!+K^T%?+q;4AoZ*-{`fzUg%_-Pa9dC2rRPYb2C&|k& zdGBo%x@|VHbuflwlWd31??ENP8_1)e1H*b48FMMLD9>_}FHRzfbZeDE#))t%z7a0P zTFg;>p+Fv1zr5oazDLMp$M(2QY52a}dc)C*3j2*(FEW$c3u(ZuNu^42>^hEa4~`n^ z7u@0*tnSmK5XsFMm*M%=(9tIeh@ARsqA0AvQKZlHGg1rt^|!K{nm8oYB1*$0OQn~X zL*IfHyvDS*Po9sYi+8?N;f0SC^mhc}#SMZ%Ep&fJyU=vFaiqqgI$Y1{uO4aPv)J*6 ziH?zi`I~7^6uz9pusO?*BVL0vKe>30rW_5%0L- z+9S&RUl&o4CfQvn7dDTu+BGLYV{;#0pGB>Dm^Em6OXKIiznJwp$9zlyRr492jC$3i6Xr4x&fCP9L z&TuR7)#4{JJ%Vf#v?-++1zy1&7oz9YNJjon9A_0OK_ug=I=jcCrXbc?KuGxH8#XEj zig}Lj4_#QI8VYpEM)F5w^$c_h(S7e@th*emCUJ#gTa!6cgNEHP@-ceVdb*o`D`+)J zLxJ&^5}P-x9&o-N@S;f+7&p4HSgK{N!VgRo>^ew>^NZ^8yd@|xUXghFApsq%2u0D_ z_q*&R@DK$tzw$GgC&dUbMs#ZhP>;Qt6$Z&2CCe)BTmRf5wg3expZ}_lX<=!Prk7l| zbyjDL%75-xF8}!6z&72^M&&8cTxw$mono-CxG$0%f}1w-bz<0<)j>PR7%d~Kg{q;G zqKML|cd|B)^aHe=#o%JZumx|*2`Ne~k3o*+?$OuJT)+h}Jk|grp9JX6k(ixt)m6^s zjm=1u^qqE=wi~NkcPKe|s23JW0wPI}m7eDluRiHlbIq-2P6B)|SHFc@6HCXVfcwO@ zbhT_CV~S0j@uuPHJbnXH(Ip`&!{;ChHrT5-?s6h0-K3UpMapy2cjv%FIPkGf#oscT zy&!#xw7wujmY15RkOS((X_jv*{Ijdi_)B%#$9wLe^kYwx_?22=*?B47KGM&LK~42^ zL)4k%MKCA9Tp{wNQVnmETla!;nr}t&7mB|6N`|C#4Lj*8-TF@*>SnxcTXG;1yZG|O z|F;CH-T2hqrW2paKhwAvW4))2g0w8L#PGo<2&v}<<>ch+>-SKY1ArQiZzfMvEnjUE zjznFZv=D@&hvF+?ys~q-+#dP+L#x&A3R#YKMtz(PE$Qcr&o5Knz@k1LeMaL={HE7O zgpO^yS>c2j;WL0MdlJUyIH&pysk-^vltD=asZ;qK5CvSSDh^WRIo$jgC;%C3?Pj$U zusZmFLDP=qADDyYt{d4J+TaZ7U`BoaxlIa+9QX^BOHCUxCz>$zkYn?8NxlZB-jMZOgKn{4rWXh?drl z)NAs%gKEy<-o0b|%~VPckkm&I;q@gCLTvA`HdQaBo~$;`?oI<=VTM+<4gdp=G9bv+ zP_a&}>d4OVYdS*FGUyZMo7bzm384i=Dp3uW7PjKzU#K}$le(t3l)ITaw1_A|AB9)d z3s>k?GCKCjLFUmvgo3Xt_P*V5@e??G<4bIkuLe`=&e_Ar^mS8eu6z*+!${UU zKOYFHuKL-y!zuk)D6k;nG+^m|`IrN%oX?e2PozA%2aTmxKYPGhggAVLuF``is*yGT zAHi2;5s%u5xWYQ~{{Y8QuYWz&FL|!;w>X<`coY1jRf>d=XsTMGn&t~GkE+A5Rg^h) zO=sI?)3gnhdS{ANL-k1J@K^4N2g{LGuO`LD+!7$VuE6)4kFia%%x>-(fM{;pHaUGR zZycT3pWwf>9!7<8z9^Br_c*r<7^0`0l} zGbCDzr!AW`LoYGDq67olS{qwOCUwf0FoO@s$;y{{Fq>CL`=hz>&SoA z?8Eyuh0p5C%<`u6Qn~|LfM(6838L%HRn$H^u(o9nkpp|CRjVw*gKBRd*;csSGZV8f zIJOK%f~IOu+*jC*>Ks)J z4rOt5t$E@NZ68c+xRjpJ!Tt=6kFGcGA;gN{R8^pEwzfH8d-uAn%D&1fsz4JreR#@% zMSNNh+3saQLIadAJYjP;j(5QX(~vI9K!5uL+JckkD^t>ay8R>E!j{ZdIjiE`g(98?w-2(ty?$9 z6oKtCvwg4}@T5}LkBzj; zEXo@kR$$Kv6@ztZK6@%g8^tmAo_QWgvv}0OxYFF6V zg`O1&Kehbc5R4Jw)qlTOZiBkGaQ=7y#TtvYdh@w665BS*wFw?Ka;%GcKNn!X12jVs zS-XGwj^>Spm<|NvjY>g2`;juOe^H~{pA|~<%ybOO!wCpg2-m8tHN_gh zo&`Lxo-0v|A|tKE9xRh30>kkFGSa_}Yu&sP>yp+DGm&w+3?R;RGwl~us+fowg$ zJwWvsdxS$>%uP2r$v8^3C_GdPDf@1;GeYh*Z|ohhxxBo)#m#KCh$5r^shu0Xgi;A~;NXC`otbKprH zy(SFe?LiJs^aN+H@ZwkgjSTQal&_6wLefLH%ONo~HPMan0M#fI)txX}T z<-*N>|IBPe3HI^|{N!Xb1Oea}?K`b5^RRA}I}U#p8O(VhcpshX?M~I&$eA-9jH3Yr zyU6r9li+VJt=Oo+aJfa|=%Yd&K_%pLF)S-xwmrbII`IFa>&*k9?*8}xO4?KsqHLu? zmLzwUY!PXt>|2z*Y%v+jU`okODkRI4vTu!DgF*Ifk}PAH!C;CRgE2E0%=b+0`~Ca; z^ZTRzRbJ;j&pFTMbv>?3Lso3zRPBA!BwqQRqXMQOcA|B(p=$aHbxK0ZtmNN^^VJ-&a;^;>H!dWzZI$W%=d9p+_6)M=(UfuFMN8?$%&ouZ`IOImncy^w;EO z=Fr%anU_>f9L3b!1dj&dy}$B40zh)_|;e}WzQx;?bqY2O6 zvO)P#>)R?B6)|1DvkhKtUc<|b8oJ+1>ni$eeGc4f%dY`JCYsAevD8rN>=PCUZ63bb z5S9~t`yy**ry_FP$IqfoOe3)TOS{A@%cens`$q8(X8EY%shK^%qTq4vs>DnE=XGbe zk5>iWyE`hq@@`ZXxVi1^*#+I$U^JU;v`ml4ng-O&ve?8hcSbW@;2XmIvvq$6xpt4>9{e(N)o3d1`nFZ%xHys?GK`nQPAx~*~1cpYg-^=aCDmXq)c3gJmNb>n{uc_fl<-HfSKV+F6C7iQ@9C8_q!^F2(iVG9wL7_d(tBng|NFgP!q z_+3eib!Q}&dm|)*5Ys~WgOAqASw}(E2?2ipe4VGez=lI4Tj3;%E!RI!CO@EGtf^DS ztn&=#-Q*z9jA(dejKb@>c>G(uGK)M~bMB-kB$m-Ij9_#PAb8Ls__ra*04vhgD$_fb z(y6G4=-&)RNp59>Wr4dv`-X`{E~ANb<`?`Fa)lAYG>608x)`l`&+x9`^xg)FHHY&H zr14d?JzM;)KgY0Y)b-GfdUkU9KpD6ol)o*XIsq;bh(ba^nxjOiIq^?lMpW?4 z<%HfhXK#_#*($K{=&O=?x@#xPdsYThUhC2$ee!sNUH-GKiI13-yZkcun}w3)WRxsh zI`R$7{Feg&YE90}KoeJdA4L*O5V3zYPszhgR?>h?(d_|)kKxSZdojDK5nRv(I1e5^ z{9&;-e^4+;*$AKA3TWL4x==B^G;aTds)0S|SwwJ0P{zKE={m_y!x;_9R>c8!OK4Vy zhgnu!`!K8vbH`+SwaBgTr}7r!w*O+U{P3o-ZE#BDd!QPelhUD^nvSaLS1_XtWxqm( z#+Urry}FEV6bV?|ym|3jMP$3?G5cAWRP>lp@S%uI@Mspw81W}myFD2i!I-p}h@4(n z_7s>273#y;OO{r`WBv@P1kJ{Yd3gnd!}nV49edg{GwBW&+a1{aNP5;h$UdYic;A3qFu8$p?B(pXG0XZ(F3g3@w!hL%4i8s+d4XatmjfwxYh`96ek|=dXV#Zj5i(% zUk{6|wd;4nSHs~Ktk;e!IuGNB0iuz?uqbIC)aMdyrYAmA>0N z9|Ex%E_~4ttrGcqt-Duh8Mmd%dy>bS$BX6P@?P=46sW|CiT62 zX-ISx)XAd$X~?MRNvKgzx7r%~YBOC}`gO2P^U%6q9lc+&V7g6q0b}Ee;dH16PguOe zP_M?m#Va#@AzDLocrBK?q$w;_ZeziZtWwe&UcYK>BZO0{acJn3QW|32R++^xZ%dqus78jV(voUU?xU z7RGoza(jeb8U_T%UU1EVBfa)XcxZa9e{Kr>Z1D#X5fSK4rvHeI_%iI_T~II}vGyo| zW5J~z9q6y=)O)AerNh1&AF*HlftC2$#r$eceB9>CGp-BWWvB^Q5k(ye zGMYT&#)$#^h1s^`;Z_GM-^B!x(bcJRKU|)*x@9~xAL}-(egxYe`wrf{PLbQGo!@r(k^jmmkV04M#;hC{{+n^MQfikgGx5WfdV-d+P_ld`LG z{W#C{l}F0Sn04CSf@}u!>^9`$_WAt$g+eWu>hpG-ec0|5R}8cKbRkpm+&;M=&fI9y zl_R$(><}MB5Z{mFQ8v&3^0AFU;5M`+HQz^z{^vEyN({ z-((Eb49h6z+ji5S{B8TPyQ6C^Eac^PLN-u1R(rIPp%p~S{744c4x z200>Afag-SD{H22sMai|vs4H08cQ384gI<8m4=YM7&tUN+ccgC-`cwZ>}O zK?}s=8B1!XONTrNhFc;h3f>VZ!suwO$&K_H(wl`RL+0iggO?ieSixm(D2C?1Bk-v;-eaD~SKF!G}veeTjgGb2rot(g}R{mbW z;Z^zpOJD!yX8JG0xTZcbJqn6SKCt>a>M1Zo`EMm`k?uLlcib^L*nAB1i^!m9KYe=8 zvoyA0fnW-;L5FPW7OAw&NS6itt*+o+Mc~u6z5k#JQ*+7a*lnwlOr>F(;6ZbTFB1c1 zvCaEbXc~EZelyHDiP2XO`9zKPgiE=PT$ac-Zt10^YF3>YSCqIp zYqqpfd~Kt7DqVqsE&nc!s#9LiyCN98*lQ{gX!P8Us8$v7bN9fbq0L``?TAM$m+&;0 zo0(POKM;G*eP4+OX2XWNhPyY5D`dWl$)lS?)Mmd0ZVn>BNNFcRO=ICWSC{Wrn$62% zG^)2}2@`{lBrf2}Kak;`AB@&s6!h5j z#SG-u5<OlFXzk%|&dl-ap=-?>I&diyHQQ zu9H3z6`(yzCt(Sy_3A_B*-7vCBgo*Zp4*5NN5ul=qH3ok&EsCC$_kVB2Z zU^Yeuk8_f7JiUoocDkH*kxr+-0;cU#r2-1Sv$bFk&PqdK5JDC@SvURT_WKJdw0p9f zuJ#kLzvE1UPg}P6iK;xl&BP8PpnM20CHo1(dl#xg@x1R#O(nEGTShUT?s%S!8AfgwEWdFxp26xD&W zv5`%8R*Zo%!+3KKk$^Gy``(C%j%8=DYWe^E6fPPWe%jluwRYOIdo;E+ZCuKJrTkI< zH3Hn&*i!QZHMr;fyqnR0DC6@DcaXuGrU9!oMYO@{evT>mL@MMA+f+aKR7U|dA4xsO zvM|k(2gbYG^rb}Kpj>Qy_}hR!32|nrQMfmq{3&DptYQwo`={Uq@F2*O?W>D0{<)$o~)P&NH|^NqUm z=RU!fzS5kWaDww3#$czR;w)c4;>=|j3|3<+kuaW@b{SADoIT_rdodTg0?dYt)q0YY zQgPuLzjiaeHJoqU7E&%h5U;v;kC%)nN!TF^5`MJ3R-UYo0r@_aAY8K8&beubHQ~mXW@6VXJ+FE@@p)8@qprWQK zWXxVpj1#(ke1>Sf0Q3$V(xYYbi5@{p#Uhw=wW@q)V6dRsf?%M-2<3q}ld}Hr=Q1AO z?Ga^&*tWzufuxIqD7qH2ObcZShF%fe2mT!nv6m>}Q|4yEb#>uL)yvYusV0@-CN**F zB+wos&DphXr3_f^14G6;(4n9U50Gr8g{|`+@8u=uImfSE8!`JfVGAU#D(nVFO;{~0 z%5Z?X5+eWBI>$I0nleybAx%$$T@^I1!5O^VKGMZ}F3(Gj?0zOEqyN?;D23)EZx{II zY+0P-#7o)V&DZL0XTmslscF2{$jFe9w6(m1x*UOn4tevWT>Vw;zt@zAYOoQ zt-Y@5DTl{YMR}#XFfYwv{>s^2W=DVKB3vE1aN@NvFM6#$dk>N_1fN*p#oY;;mIBzf zG$ZXDTnf*MbQcB3Ml^by`}2qQhkE$LUW;}L<{PngCxhpIBBrXrN4m&LE<8M(L%Rm9 zZ&qWFaE8Ss!tR^^UYWzM4{tCRzRqxc1~Fgw@IlBQ~D!d2|VF%0MMTxJy)>EvO9W#p*bQki&N${WM7o= zB@~hk&N3e8%?RMNaS+e~?K~i$R89bJl|Rqmv2) zA3cRDTjyu^>kLu*7x;!=v%v0=2KD{T#>q`Ac3FC<`*O$_N~hqrN5Ji7DEM7Ec0U|3 zla#;QnNj5pG4HXeN2V`sR~d=@vBnn1W|EfHe5+np9e~pFGRGHODqId;lX zwa0n;0NnnEr)jARq|E%e?Pxeaf_jXUKax{gP+*y#T?RFhYx#w5LY;_7MUE($b}NZ` z#x7uE)jKN8>ilfc1p>0FuMn5WMd=W&Z%13x4{!grZ#?o}RDSLhYFv1K|BcvePk=eVgOn6=VB&GB4dw!N2lAP>E}}poMiq z&~!TwX`&#&83^zcEUKQV@1bxGnpo-mM?eGr{^qqX^)qWVulYN4k*H=(%~^^pD_MG^ zM;z#L(&Rzwv3vX{ByhNu`{2Ry>3=j3!-o%q3>$9{YC5d+U^H3!QqFrgHoK`VUCnh< z^?x0W%WL{(1GX<6{oa|`&)Nf`%C-E&4+^>E9|f5H>t$t5!*@_na=tW5xvRSZsH{Tntk^C4*^A*5KgLO@k}FH!W$d z|7ZD6ZRi-pRmK4cYlIF%%5>)8)PW}>*WzAt!~|T$+*kVi!@v~Qr8v#YGisdiI_UF# zNyhtlG03|Jat5m0jgM;$sRlK=UG6ce1n>6wWIDCtc=VFMoFrd=2RftazRBOE8Pt9u zs|F|ogL^r?C(Y4q99?M6r3sRYg$tH7K2D<{y2A=P8w;)YA)?hkw64_=^%g#1JX21QXqy zIykX_@`@=IaLUHL5cUAZ9w05+uC3Rh_s4s|i^!LHA)7jlekegWi~RP%$nwT06zR| zqGLYh#^^prtFy4-;^xt1H#TBjn(W*N4J zLP`x`A)aabN*@2$^#9JG5!z_=(J%iarg)|TWc!pzWG!drfXC$j;90xo^-| z>wcUk%=aBua4ilU01`T=uWyCyk&iCCL@)-mt#h0Em8W-f^lIss1Aq#w{jVbe z>{6UO+vr=n+$A4gB;-}jvfpfN&5`8$DF#eZtK){AT##=$0F|<;A1BbV8#B5yOfexp zUxViA)xpXdJ6)VS00FD;xX?fR6j?B8(1b`i!ayXJa*c5k zPol#W_ux4HARrq#WEMM1U%C2e?RUMujTB)QRGhrVedF&=b!G0%-XcV46itJ<#{)*f4mI@**@%W9X*1P!_AIA6 zGpkXC-O6gz|ET~sH?k$|4kPTA`o0GJ+4u@L0!`GC1#XRd?^ts*^H(!V$B8K_tq!Bi zrYn3aHSiY6Vkl#AB$+_v^mQoH(|+hSEX@-Rlz0GoZkjuj}6G z?FsU7G2Y0iO;#<6gk=0qr_HZ1Ce!h;=+E(LeV2|YE($HD=UEUj&++IjQGm<4(T(A^ zL;wt1DNyYS3Jd>(9H+vjm#4f{;afrTt4>nnL3m^w@G3 z>J7lNg0!Iy$(ToU&kg8Y#(>TH$*#;GDH29 zU{A)@6ZQb1l4khIB?Bgtk?P!}O#Db8f0rAegdE~oTd*Tt;0lamG&8q;)5C8++0#5T zKd8Y2UAVRn@pwv|!eoyjK2pZ&{xI0HtF|7VQ|o0_TEZFrm6!}WMuQhQ4Z`{^Z$i0N zXuG*tG=K`AIQ;oQ)4*&M1X7JlhTnt1=l3DX_^|~8eE+21#LmL$8aCZvJ-h$A21_%h z(IrHnQZ1x*JcE#KL$I9C*s%3e|Ei%*_bb8Ltct476LnQsn6Q5Md^0s}jN_&9}nR$Of&&ax`raJr`bC)YFk zjGsQ?x027F^|Fj4O@!&G_+ONiKi}E5pVxR05}&_)MggwJa(uUD{eh#9TWhahGR6+) zdB(mYy(L+m2hxA4sQy`PxB8pEfF%T4Y&H-VVXGnZ!liJb2&jw2OZ#*33JSP{R`>9e zE!x^3Jpd{hhb?pI@83U~b9k3;C|GAHiY`io`m2p#yu5vjVsy+l}nVok0)$4`WCeIFv9O$*KgPw=ddgF3uYwEOqSt;s=sBJH^4a6 zqIVqmW*48y^7Fj!$@nERQ*ysP_XDrSykGsuoKY1}6UubgY*}p70|}V1#4ANQP!l>1 zz2~l5puksJo(z3RoTR`5tuO6KVyf(!o?1(j%GC<P-s_a51FW=UZvDRB4>+F8IBz!11|f zS`Pb|-0UJ_Wk_tr%4TWm%JDcJ#RiAvaDE;m@RNg1y2d_-B$!13)&7tac!oA#QCU@^ z^5+&BXn^LyC9%THARG|6ROAN$x~8-!PeH8%*%<`x~dIz)6l)By*w%85v8Qx_}E=4jA|!! zhmxAf&LwK>u4=CJhKwlxwt}Vr1~^dfr4uz@E-}ThkA`w(F|a=3v1N-X2DhkJfR`sB z1Wa4#8XKt6Cnw?D4mEe<{o^iZk-s5c!IUb@Iz}zJ4CA85>#(ailvb~=AQMf-I_!wR zYv=xvPXx_BYi-hA`iJEK(O^ry#(YFUPf0<{m65HJCaf0UE?O#{dAHzlj+WZ%+ zo4`L=dbk&n3{0A8{|m~l(bbKqB|@9^`dOal(OdtART%6;xRe|Q?Bz}cwb`9Q-i+I8 zK;Km^{Zx7|V4?L)C!W43`8`c41P!!_?xf2cmw1GZU_jTbem^4>5u`fiPjm9X-#|bF zY6_NK8N`LRYxbe?%5$vJ0*vbn2i8*FL@(Fk;ga;tt8HyPM2CA9T>5tKlZ4P~HBU%+ z=zWaV%~gt`?^u}}MdSp_djF~OvX**k{BstqR35GXt9wa6(Q+P0>VNlTM9=7%n`coa!N`r{CItzk9WFo4pHM&S7efHhi!qYm$Iaq{&}PS zTsklGDpIO#BQb@|h2~*bj}CqZBxS0t?hJUFwqj+9Y-)a%^q1AeG)fm3k?YIt%TFXf zV8{PjT*lI@E(jkMRd-TDFw{DU#*#&TaK!Dt*3=8aT#*~FJbP4Ase{U zs2}ib2NhVgRb~*6YY8;+Eb$Nms%Q@}Uv0@t=xH=H%P@BTG!~LW$mn4yTlS&dsZ>2q zlQgFNiy%#e-PXN%2W|)Z4TX6QxU^Z2ed92tCZJGR&0$Fm{9@1Nx-xVGeV#^ww`f(G zXyxLhqbX|U2r@R_UX6U_>R3DLQV0KKTuv~qHh}K#({oT0_%81`ws|W$dZt3tMak2O z;AzXXkfj#z>chNCyY$lc-NB>AAr<+L%{7hKl^4uv+Rcqh85yK=i)Dn3on~(9s&^nX*XfPekEne6=sO{$qs&c`@t$Lpy<|2P#fN@&{g zEMF$TOYjAvSE-A!FhucgufRq~Oz=8!bhwMD5wY&K;g8b5S9yJHp>M+6wo)P|YfS0|uO({*GAsJ2w>#2U8YhTjwrIUN+<668rAnl}AUK;1c(O8S^yDjQ-P6MAYw5dflZGxMHM7qk&rO=C4=gW%{4$6fRsi@-;q+>iWg@_HJaXKimN*?Gk2( zc{rA?eM2kKTqqItFbBZb6A=c!GHB3JwB5!}c2Ah)#Ga_{FdN9xyRv=ard`@MJN(h` z3||#0PB5-vW8#~s2eWJl5e_wDKdgC74LRN;Q@(?)1y*#f?-r z)obfk_i4=&-1>%TDhi=zgSzKqn}u<%K6%1`jIr)2D3klptL4%X8o61ve_^=WxS852 zM=+%*=@GumI5nCjHcp`-|C_5SI2^}r2BzhiP%CSQVS zL8Wo>Mo(;jq99e^*gca9-WXs?eb%F>=-mBa!0mYpUx6Jm#&FPB?;s8t=LI~>eD%xQ zPiC+ss)w(bXeQnTvPi+;ZCT_$^FtvL1j92nh`I4Jc**u}g*^LD-x^~X+@8ZEF{*EJ zqQzk;`6Gvx146j@$>q^thUy%!^1Dx(6+vL*45OqzC_{o31md0|}D--DpE+9Cy)y zPjEio{25P%iqjso z-NaGTGaS03-yFc?9Fw#TYQOlm@jNBQbBKFY{bbLshDd3w2d7KEt9*Y=DVQtoQhuH% zh8kWt@+T^y^N2tY>VZXKQ}A632#aL45;6$M4gba z2k>D~H0{-_K`Hm{{q!ckzOmOFUtyaf5Ov4e?(n?mux-!GJY!3uc8fl_sI6#bNoUUa zJ!`8%A2WlqZp>dASy*Rg!G8~{icw#@(h>`7WNVa;l-$eb;45_7bqVkHm|kfV75 z%iG4%W_CLi_bx}=yCUz(@+S==Z+2(v!$O;mqYxXmwNt=TS>jg$BtZ>o>{1gd~{^5wNB_0+(t+lVKghZ^TB z!~#|1{Xi{If>7V7)tZ(ia=O%5{dR zXekQ-=s(pR&F1-~Sm6JioERHM2ugF+(dy31eF*OzG=#|v3Wg=Y&Bj(&d1_9(5c&VC=z5ayJz{X={gco|zQT9}g$WphrKc6x(5=_Jfe zv)^Z-Q4M{h9x}iDb%U4s-O+hGzA80>#r8xZyy|C{7g30@V`g6{n;Q$r&M1mAnp4BX zyfz-snQ-D^F!_+ffEzIWHQ)j)z5J>L0a6Wf)cs}Zl-K0l9#-8YFe;z;bV&JS#zNk| zE&_$MQw%`}MA&LFHkw2-PE@(k>D)~L5SRPz@t8Nf!jS<@N84_V+yZfECk}Pd0P8l@ zBPcLY1MP*^q+o1k&KkSjlE&T=z}9^jmlp)+|W&Ec$ zp3dy&_VFHXq4RA3e}DbWw>x|`*J(2#tH6gVVBS)fa(XwteC{pbC{hF4YEAhpSbMbF z2pe(}nYwi&g1q}ncleGE{Q1H_iTL}^pGWoJUUo?K^D=+Yr%E3_Z#s*V`EKkX4I-5&tge=vm~^9raA-I4A3%B6IcKnz?&)WNi zmO(ylYI6M~@OQ@De^!;D7eO*muY}bq19tyI+4mJLtNK>=9uq;_o`pYx4lwirxX++D zgeYopJ{PqRD^;BeVkta$CtSMU-{YKmv@r#Gsix0FIiR7dk@X-FAOf-@w3OkZ|BUnH z-TY#5AfJh9J>fZd5{ZWOY7JLyrt`r;)vTSXc@m}Z2x$l2XmxyJG1tVt^ z?_xLo14RL7SBcjVv#07ls|pl%VPWAo48`Mkc);D*ItU}ApyAr}S;gqR>jcIW3ab*t z@b7K=p1t+p+g^GzHJJ6Jdgk&NZ2aV`@t=`)RV$6zoz{SME12!&f;p*LEsojZGV97C$Wd-te zQ1R0bHkcE21ajbIoG`+-Yg2JkaYD0srNnE@Z1Yu23MN5yjrng2SzzyqD;U)gbUK`m zE$8XOCRIBD`Q;7esv|ew=#$u8X<*&YFzmN}WZbG;I$tT&aT!N_E!WBTE7ZJ&yjvP8 zPpDti$$Vc>xNyVcp912!Yd1YVG*XsS*Zf{P{l%U&Pk$*35$9T$MtyeYcjnxA_MT(@ zWBE6+Z$>3kCJY{YDA|2S>9(e4f|A)gGsYKD^1!ZVuQ^)+vNRx3jlKZ>ceY7=bExc3 zqQ$MhL*gN!t@}r2HpgkW6>wJd9$FD$g#0#9*Q!`*-A~zMB5=;IX5*Lr=1OpE{+m2q zrN)&3zasIqWW!j~(9_@SmE(R#<#xL4Htn6MT-mn)bhzWYx7^$YXf92DUTY>6knf3; z#g`EKLC>J}#9r;>$BS}!bmPKjoz#GD_cs*P@KJ5yJ<@RZddaYm`u_PLu}YXy$oyQs zc-;rchUUI8ppeWA#9>P(*Yl-E;X?U!c~jX@8Tbywq+hq{c-nJ(FDuPo6uD9FWjlWH zFcF(8n=_SubLBNi>sSb>S}$`jFfUw7?0H0}Dn4GY9Pj-S6Te1XNS#6y#4m+x9X#@T zNaJg;dmPh>D7D>atX{p|`7}`|rbewmGhPR#I7@8}ydsfv$BX9%h9*_1Jhj&Mv@QiW zPO2GmwAU4%rc>-$TbmETLp6gUTh>VrwP8E=4pWZ}R$ib$XBaPVo zxS$I^J_oz;d0>?Wn@7@8-&|6!o`~5I)M6gu#NT~|f3@eH32n|rdXUGKC!Gh|);y%( z!dFaH&m<+nx90QhnRSauM?!{m9O_5y27y{exhye-y1&VM=u(>Q<>H6AR6h#bl2)5a zE=?)DsubeFF}kk`i!2pl?2GZLU3iW+qwHXnIdI!%v1}hPTqe%%Tw`=FM;)RuI$`U= z|Lqv=>ED;t)b0pNngc(?Zau}dq6ktF8f=fGx1b2f<~b7s|3d0A)Wcod_EGOS`pK-7 zR#gp!ZTfV)Ia?W~fYkUBoHBEv>m9z_g=eTEpi~Zo4s@o>W|1Zx>z}$$S(?J`KjHrG zBKD^dw>uM39|a*b4?pe}FS{WP7*vBxAwq*UE!wK`9&_{7g+Eg+x=`VLSXkvQ%{BhH zk17Z>d9UbVPy^=5)+e8Ns8{>eViHY@BgiXI9rw0C=?t$2LSipgua(9nw}Y95*b#DI zc@>8cRe1M6&VpM}NDf?$SOi~vD{pN_krVQa(3w}CpRc2GQ(nbZ#Ye7H6~QmcMp8lo zs0i%lz9QmLgcs|_lF|?k&izD;Mf-3iwmK$utIBKB1h7}R{(K8P=k=y{ zI&$F<8j&QZhNXg~DHCYZ-Bq@b{!8|1y&SfSQP5CFC9~XX2^#Fa*~7s?OIpiL=6`l_XF7$p1D5-cM?(Nimat&J!tG>_ug@~ z%sSby-hQCRwoh|#DCqXPHiL~#lk%z;-X*crRj0JQ{IkRTC?{1V;*b7IO88o>&6FmF z^Y;_!OUGZ}pHW);9%6(uu2*iX)iw~Hep7`R!VpyK;%9xkeaZKKiY%1R(?H*?is+CZLKwCd|D_D>khj15DZsWg245x(LnEJNekP=W>P`}YzoRB|K zWUeL-$a>txi5_~70?Yf2-Vl^={@)>~P|8>hgo{K##+2Lx%dVzfT0ezOj`AtIMX7tR|BK)4A4vOi?3(Ew@jA%u^KZ1Y3WN^noIdiHYBz-)QR z{Z%DVbmYm4O)Wlx;vS9B@zV4;_j+qPzFf$v+-k9U8StoK0()H!pjm9Rbn63$+sCf2 zBE~oWoS^oyNWXL9?r0DhUuulKdlCE$1UWQ!|aF7(VwB^`1CoHEx5k&QV+?b{z&373f7f?W_2fnkyIjP=>AWt!T>47pR z+&AN+V$@9i+}o2C4S^jpBRnIv1ki==F;syNgW) z(8u~Cb_VDlY^^DI0fqsC*BQ`jeRV(7X{@gTIc?Ha;c@0k zOBC7~w~nJ$KO-$#wK_OR^A*=m-p%vskbFGZW>bkg3;m{A4rBb8g-K8+0`iH-K^7Cd zTat1@$T=VWraFQ5aZ@RjJR-KygWu>mZJd4kc&s(#%uz$-crh)_6OcftFz2Jd>au$p znjfs}O1%P0pzGz_hYwqoFr>Pb&;8PNH7x1i^5_JBGOV}0zWyIQEq4VkOKhvYcU^P3 zVnvhtxnHO7H30n6c}&x-z*3-h^uQn63um^o;y~jvAPRRyZWC+lMOVKoH>SA-2wVp& z;m~<(M*hfEXQWBsSs35gX0_f|J0L~j;apDw>?qUm)1?d$_px$cJR*eJqgc zOLnK`KpgIuKuo4yboWIZnXsv@U5XZyky~C zwH~w5W7KNIb{9X{_USb91R=0Cy!=_idFN2rc0GK%tLg!U`4uR>sW+Ey-oo(gza=B}U%ifv%7;7s?YBxEV*(4! z$>)Hw4Xbn6r4EY)JYZCVC*oY^CzWs_`{?IC)YmEJS^iP>HzorOUz%#c4VJDvhAt-= z%wgiJU7}yO*gkuA?-#=|q@vKeb;zgW?+s(>>g~^>V>3$ECRgmA*0^IYaviNJ75R-Z zxDw@|UT_6#^wsLC4&S^#JOl)UJB^IGD4BgYx{vAq=#sRy|BHs>^Q%%*)(<+R&CJTy z$FQg@6Fw|5PWgFyKD`>dCfF=6Y;^8_R4-6;rZ!%*17E2R;!KWmc73wb-Y`YBN7Kg- zO#51TF2ZX|{oj!_q)Qp(`05R?nJr|wklQ8JlQ;b%`2;Pl$F*^vyB@~gH3af`MR zVlc!|wSc3ZcIkGG``_WQY(rT?Uke?|{l%7yLyR-dYK-hxLBb8SbBi=-6TifWW9{wj z)yVx&%ZE4h)Ed2%!~!e&KWng05p|xCPvAx&m}(RmTq}QA%98vclAIMyel~3IK+~Z$ z=HvfzfZ3mpOJ{N_;4#wz#7wax3zM`~#%zy{%GsqXNM6EzadLVr_lTcd{m=&wv`w9xH)C(?MR3y7oQze*N+YRMU60y@iX=slZ#XKCIq$dNpChc$XfsXq zZTv)qkX1izOd2uxvCrgFs;gYDoTln97)GNQ@%6)F= zH)z?xU0_kpQ)ZThZNdmuKt~CdJ$D=f8eV+{up5Gcf>P&xe#!?{x=$w~nnXpd%Uu&< z%fQ_Tm89zVf!D={P!0iI!cJJ(D6*<|CGGd_L{cIxm>yt*_;(^B!Ffn)@$n+bDuqnl zq40%p(>?yVb4utP?rUWAo$>?VMWGQ%Ub!Oun3CI`kJUI*xdZ#+ZsEtdq+29FJ-G2@ zE1x*f$b1OaI43)6LP7bFp32H2z}g(M!j%CE zSpIt{nzNV7ethwIU1v^U?@yY)0M>N%H2ViC1my0*201yYoGTpSq)!kvu7CM3j?sHw z*S;=bdAC!uXkUd!qZ`nARdl}Hp*){pl5PiZ5%s$&8nz;9S{edu3S(UbC%D)FTLmeH6=fdTU~uqc7~`7LPUD`6$D(B18n0n zg@rF%?X(Q!>U=rF4`l3I@+-$hL@FSBy8u*$)5>P5spFNRq_|qqx!`BhQ>YCi zTrN&=#dSS@{v5awa#r|1)`wo=94=HkWN8Y_XU?a?8pHs^uyUyZ;JyBbr}5VU4%9b` zo$_emO3&Ip$0X4Gy1c?&S>g!?E}=<3tr~J@6e%^cA+EiCDb+kYI6kCj7BXbsy2ae2 zRdI*21ymU@U)J&13UDR=KAsAF8GY#3QTNVcM?spx`Sy;<%P9vQKFKV!y808L!4_m( zFilQYbm=YM5DWVU&@r%OZ9xxB&xHVo>6}P;)=RJ%%sP4sgR{8E12CzhO_w!i6tSq^ zo(K(A3e8Ra`|1IDPnL!T-ZJzLeHfT4`6=D@)}dX-RiU7(y~|B@(&1|lEx&C8SVq2k zWUuO%#w*YJ7iPx^s~TDAvFX!)e;Oq*qd0G}6lYl(47l)NzTEEIF#4g9{|^c%9#yZb zubsit30_~TYGNw_|8fBf=KQ1y${K4vs~b`AuV%m-5JWy5&4>^6Gvu2A^Xo)8{#g@u zt;#z2gSy%XCa?i()6S#gVg5t+-L(2I+BH921njWc?@ai6cQWEDGJcdXxiMQ*^0K~) z8*5W9gju>T7Egg~4fuU;_^~8a$->QQbE=vy0QP|%3f^(H?0c2h+Lta-d zx#~`&f3mxhQO!RDDDF1eY3vnKXzt$F$B zue>h>R$L6VRmItL9m}})QRd$-H*IyUcK6O ze6`d$KeV&`5}*dY{*M}X*C{-%{r12bU^3tHBdJDXd%cBZs_OA?eBsg&QyOKnQ^l91uZuo|6;LFXk!L}gg@hD-sR3H%m}8_~@-bU_0|@F;O=F37C*xG=6eFqe`aG#oPcrJ*jjNmm zR7ZYao%p!k1{ei2;u>iH0~kvVnEg-q_fO7uiPDm~g(z?8jEI(XRp(Z8${bUse!1Z0 zM4N%AAU+;3;_omFt|Y{5X0k6`|-o zhCV%3;hfcz>J|hqWUSTBFo#BI^=C%#BE%K4eDKd=1&%aY8wrCz5-~K$@ z&LWh}(2e)O=j*Q?JR@}Oy*u*WO;fVzvj|^x1kWfk+ORI>=DIMjuSJ^zL%jeV+=PvyY`ufu;jdVXkT&gf=M|l>ldhdihE{)(0eME z(#|{}+J^eO=l%NpcfR`f3px=O{Jv{=Q7(8hVE1&dSzxrUd+rTY9wb^coECQ&+B&&Q z#o=0?;ADmdA=ESmd`t4kC7HHZ#<+EIn}V(KLm}h`Bw(}vE!F8aWv6hbD~*qbfLIiX z%Av;D%_SA(*7W{MgVtLUyET5-O^p@c(l@sFZ?zp8fFai1lHuhuWpH?dktkPi!(mPI z-c#d~L9E@7qdGQ0{sxB=(uGCZOv-bFGa`TS0P|2Oa89`ZlgN|m^07(q^v-i(?cY0KOalAk?S;Ifv+f3W7at;FQ`qS*&N5f5ys6G`tJ@Vh3)9QEZN6(}>`+{|df=a;DxRIv1qLAcxysRgK#D0i ztz>cUCIVU&7cUO`e^i}&Jd^ML$2&<;DUwd86ro5ZIZX%B2|3L9lylB3bC^*&iC7ZK zX`+%jj5#->1I;0p7kZ5Z3{T7ABs@Av27;m_T6U-x}o@5Af;e9583?w;(X z*J;Pmw=Sz5Y$g8ezc=mu>RhCg;n~{VAI7gnvu{6X_IJhnSEa^jOX#)tNa>mpT26Ca zGVWG)nM=6xyn(?rc_=B1mUX1Ac*3LlL-hQ@JC0Le+o#irp4+F(Qu155w`Zv{jhY9Z zx(Y?x1Wbh}jqDgM@XyC(aVHN&NH;EnH>+%Hf4oqghK}WI{%0ZnO!1N@R19&j@pYbo z8|@VLR@YmbTJ75Uqoo;PMupAG<)&^Nd*|}OpRx2(&`mCUg3=@&l1T$kR}~R(`OVC_ zvq!+Fol~VZ)PIkYXBti4OT%NBZWp+1xLBmid^ctt#j<2VUwkrZKt2+q{=&=0=6Nt(BPVPd|c8nlZ zG``Gy_QWuEwApO`5ajqcN`6+in25lAGR!2}@_j#iM{5EVpKY)m`+M<-gr&8F5d2J> zw+NV7g;hMe-M_ilqCCIqdFssVq%5BrpF=p*lP48EDK_mb4_5k@Fex5v-VHp~9a0I; z`Ww%Pn}+ApK03nfSrQ@&ei@T@J!R}IT}Odl;3;Q{nkStkJryQf*y+_*ek^cXaWpRH0Jmjx4k|3Afd}eYJEw-!n zM555@DvDllm5uZ2ek#BbrcM7p9HDq)Sut&Q(lS#SqV>`4nnZEIbbb4h6)h3E=+~ZX1a^h#gett0PtrN0HFDt7P-Oeq8IC~dKHjlJE#00?A+Nt)Ab)c6G z94^2K$1NviXpnq=l_jFVc&soi-UXosOpP}xU$aTlI(zo=4EqZRh4z{1hqi@hm&-8J z&d$W%jWApp*l~|@Dcz7Lu<(eS_$Vy9(gq65vTNq_*cXFof1}9ZqVt(=Rm1W16A}&p zUiji|FIRsRfGOA7aUz;Dd*_)fQhvrGbjI(Oip4>j zNOrg2ui)5O+Higuj6{3_c9IWC7KJg!tN-aOefG&f%2E zbY7627J}^yK^?*YvhQd8#iJD(KsDBS-Cov+`@I_2ib(X(+B2j;74L*`Ajh=`yxmz@ zS$#cL=oY7*X}zqzD0%dee^9g+-YsrhQfj+h54Ob>AbyFf<8LQswoNPiKK%2mRq*={ zj?#ungNY;cSx;qgG!bBqb;I5$4t=3f zFKCIBdxEX|cS;cQ{087cax+VA3DkKCAZD7one*fj0&1V!IDK+_L1b6SXYiou2JA88 zsba-dT}nz@2o>qR!n*x};rCCG7!TFtkUH9t;&%6)EN0ysXeDCpj?s09@yUtgTT8~3 ziWW;I(5gRJit7+9=1&#TEp{7bZ&UA`$E%7k!b1>I_PSF2=7%X^5_OyX!EinKtj+eX znbdGvR%E7k9T@7!aD<#aYki|T(P3xrMDP6?nJ*Yd*%Q^8G?+E9Ye-S_r|5t8VzoUV zvIRCyJ3tBYqW+N!hOhR$A~ch3?jxy%6J9Vy)%c!bAt5125=Hwpfvd266c8GUg8Gmm zts`q6khAoe4J6xIq*8GwCFj2NJoAP(hBQ=)lgkol8wliNq>hWW!DaXUqD{AQ;TaS5 z;pwnHo96Jvj)Ldo178TZYpv^vb)TfI+b4SFs3fmL+rgOZ)PXACzS6KD!`S1ow!5n< znS}b#zm5*NJN>!~w@f%^Y}Us28JEgv00+%*zF?poa$xyUB6Rh%3Guyf)uVPG5R%fC za>>pZ<_i1+{v&rzeqga;mJJ+zwP;KDu*=5S>%|9;>j6cmsfe#g@SRa%bL}f_l9x>D zE=w{}l`}O094EHD9Nj&F#{jEmgVb=yNlpKLbzTzf)TtzbzMGhhidx&_h`VO-*SzH4 zS#cvsf2)Rbzw%8*r{zT!lsdIHK6@}TbwRsOTOi93k6mshJ++L{5=h)w+bo}c7v4N2 zpOa1?`|b+b!o42g8lj~21#Fw|9IKB;0`P@E%)b|haQQZPatLe+JNmog`c440FaFYY zQmXGLc;zD36!B0d>BtFS;+)B*{_$?s<6GABY4$QBc?K)UmG+foMp8E7D?dLCb2aYR;om-{kPJ98|*l zG{$i*cKVi(cjwTMla2P9J2eq+3k%y4%aRT`zlkgGe)v6jSr*si zJOeOLM6u!TaRpW0RhDQ|$W- zx887VRA5IvHB@(;NvBRv`_D(W+mw4$ZUJeseVf>`Yp(+zx#T>x=_CS-{%X{@l9Q@i zt{$ktBO_B(1*J6FwZi4B=d#BY7Nf$C)an0I8M>sv_bN}vHEmOLQ&weOg(sS$a-T_N zP1N8lgMo)$bI~>fx9T+-EH5z-o0WWVhZYFe^=Sol_+^(yUbxL!lNtw4EPH&l(7NzW z8U}7zw@plpQVXKJvAcekyXis~5PmoBf(;(F0Xnp>c@XFcjLyEj%I%kwEiRF3 zYC!!xVlQNxOfFppr2-(xrHbAfu8$3`m$#gsd%2^-)KBICFv>mth}_j>?$%BBmqz)> zGZgKp`>&nQp|UPt3b!rHLOLzZ6qduYki&a}?Aia-9L;ZfsNCrf=Imof_tXgU>)M%zNj{ z(29j%0VeU%j&M)bp7VQNEd%8C13>|E78|u8INOO3RXBL+MA!gziIqU1>!53U{igQt z!T6$Y_edR#HoeN`A6N?i;-(@nSRUK+*0|R@iz%GPR?g|@_so#N}Tgk2_QrlO78%1I5 zIf&sub+WTVuY&{Ix`EsIr+F9=C97%%Maac5!g*rbOEMIf@*MBfm_cEt+#$qdCuCarq2;f?$>{Y9TAPg>0*#6A z-L^vPh``^-e!tIW6yxX{ayCu5<2-O&%M$xrgoH@CY~nj`l9X?OVI__~=Q!8vhhz)L5ER3H38!Q(NsK z66CqRfL_>{xbSFbX);Rt($8rDst{BtpvBubcF@JS*&hUretR$*RKJ<=q~%nd>=e92 zji%hQf?yINrAfGgtZfn;{P6&jhtgI3{j^!d7kev$_ zurM$cS!J+A!wFgYn6_zd00h#oRmtvvSr#JN6+lZDK~8SvzxJP9E9l?>RGO`hZDL~N zVPrpnzYO@-$DH;s5l3q47pzk<4lC?7fVYXsml1qV?`)fT>_hP= zfnzG7#W;BgFR{LNQiuPWPA_u21V!*$!;fw}_?)NMr%DNU?Yc&|S2`e>*OS!0zm{o2=np#A!GA^zJue~ z0l`>BV==H0t_^-u`T6yoqXdcrWH7MvgwKx||j z-Q=o)3cLQ`%pnaIO-Z^KwYIgZi3x94+1W6!vY|nUCSC=a+7o)qe53U8R zuzD?tm3gtx2F>mw*ny23;cUJ$a0fAZS5u(A1E`R;WlHl!xl^z&=&Rf@7i^PJTtHU-ybpta3+ql0X|{T!O( zo#mLf&;9&KCS3ea$60dcC;h8&H_yg~;|Ct&p494U3y61q=L`^#OJBEI9zuYzo2Zr! z;y^9~D9Cj)mdowb5j!cxdOCip=F#x=Nm(l%@}-oz3#lUu1702n(bZ)|!G($qwjRVk z52cIvw`M&z%Q<72{qK*PO}OASZkr$<+a61r%IVfJ;p7V`Rr2p%z7B*C;SJRw|WzZT?Gh|Vf$VxnU= zkf+})tTFsnf+7tNth55R&SlJn=i5vY8Nk8eA&J-Y`Iqm{&>=v!CcCWVC;F7&bKMhx z>o6q<_D4?uLMf)v*QM~p4x!LCJ+n>-NYLB(P2jwIJeoJgtIH(-l(s_q)9OaI8HNHO z&=ZJ-m!i+6_YuP8hEJS4X*Q;(__f9UEW!ER8$<4fFi8ad(A&Bj1+CSs4(5V&bqQ80 zF}&di9XqScKIt=FfAjN0AX*iX(6P#NaT=`l>dbWkU3P2D9ljv=xX~%Iepp~XD}+pi zu**=LJ}v9J9?rPtH~>g5{54GG1HAE0-Hv-O3{V)+Yz?>c?NfU?6HCmh9)wehqgQ*Q zSJOa{4_UKKTB~t#=|KOzQk_7Nxrjsdcd#5gy^PQvH2U`nxjrBlL4vQq=A@S#${rau z>#=`0WhR&X^KK8@&sJiQ3}G?dg>Q0mfv5fD)ViDNTXw<1+g~({>_@lV-kO9wO>Tyj zkiAZyB}F4fqHbv#MO2uV!hU|Z+lqw!`t)EY`-CO*R$?Cyj0uHxhhMq5J%$UQC>UB@ z>`{mlFe8<>W@M4SaCJxe1O6heTUu&l7*AOud!_b^pFLDUOT8SPg78ws?b}eipgSB1 zB=R=r_pY~_>P&2QoJxC+y>#6C2%d9B30S=wh2Y7Tq&0&Z$F*I*Y>}7+jee4>wntTs zJ1$!ZS?RmG@P(l3tg>YjVa9;2Yj=}(of?j*&1~n&zvuW8qp?Ffrg%pzn)0*ReLteL z$&C#||GgLIjT2YwzjlQiMBK}im1I;Z&3SxfnRYvVKXcMwz8*+GqGmzHl**4^`l!_M zNZUh+T1Eo3*!`|4+{02={BgjhlMd=RxW*)jGUQlm3S6&ej$D4+^>A>KE}EmC8;QRF z+WjCJo;%o7JYq+W_x|X($9wfr57r4SI$PTe*+x$t2yXFvF`!kC#gf+9fuZdkpn0#Z zyEcems7*+FAewSOI1=fzeqaLBo3GNa^^+GbIa zAz98j6L(&H=GHdgDzN+ZBR5$CvHX*)TLEqW19?6gzRm1_z_a%HUYRQf21RuVG~hJds_L1 zxdB)~+#^uvvZ}DMG+(*roYjp}yOVE)c-8&-&yD;0$9{WV4Keuk&X%Xw++>;IM*SDq z98TJ_a|=WoAEMKAHkI;O3qlI&!H`Ac5MDMDz`xd~4HOMdfyB+;EfjbI_S(Cd5VOT9 zU9y9Vdzn=Wxh0WHbN&4w(&b5CxM2dBmh)%#;vb(Y%fhj z)#}@yY+n^8etqHs#E3grc8(q<6uVE7sAl>*nd!$nvcfwgnjb%t^GlOul|5T5x%y8* z;d(yy_2HxKexnM%dyTih6prm~HHVDCuYw1zQ0xO?YfNuZE&&oX__lr_4lYbt+^w%M z6vg%H(AZQ0imKOj41Lich+u{6m67qko^hraSO82hEyA{&K=HmA|8(8|JZ}dqG#g&z z`Ixn27mX-ps);UvLM%S<-jQ0p;5!Rm`SV#sv+QqY=F?5x0>0Si>Y7(45{;Mw*`A}Z zPuq*UV|6C@Av^SInwG9Yx;~s@cCvDiqcr6jPOa?u^5-bL5E-ksR!gE6_6o1^4ki8k zc#t!2RB%2ecGb=@%H<$QGsdbBPJih=Vl`7ze1^rl>aj=m8Ou!PEg&Yor0bfxi`u)4Kt1QBfFjB?o4d%GJkZkZZy7m= z12#Och*a(fU|E$|)@{I-&cbc%AFh{tpn)%?+#c z*?=SKR)JD`Il1D4hG;6x2QfvHSx=jEP&?) zV#EAFq5sN$!0sI6I6+LVp}9_hzSBroJ*-E6$#y<_$hzZ_d=axN0+Y z;P0ESkhPL$**QIWh+EVBvfkyCs0y;lQ?h8DY{0G&o5(EQCB0{l;_$8kTnnOt!)B*$ znzpDk?4(ZTH;6AREcERLXgK-TayV^ZMd@(wgZ2|>Y3P01JMn!o_rfxi&oKW%8T~zL zhF89Ooxbo@^o-)egNAAQ6%!8Q(tugZxc!xk=BL4tAQ6*)N6gIGJe^4tr@~%jU(}BT z!b5S&RwdB9Co}i^XJjipiQ(RQ5J(@n*cx6n(dOuo@jLuK7SE8qo`EKIYW>B-=FXZ) z2LjN^tY?GCp#264n6dOXc4tgGjZ51e9WAwUUjaH)`ce&c*E(n5eHO_p0YA?mMpxX# z7Cbo|;yJ={;zD??p>~yp#ox;Oe*$$qMMKZ&WI$9h2iEi^28bkR`vY)#vEtKiV8Jwe^q8Yh@C;*zB9Fq$zv;?SF?(V2Sk+MOJ zjEn&CpMupUwJTm=*x;L0_0_$GlU>G7$<2&s7xu*;jwsLfhKo5e>VM=Bnw9%){Nh3) zfoOh9qMw0RbhMu3jpNFC!otFSsE`!^lD!71tf=pwC%`1{hROB{r7Eh%|Ih}&i=XKk zSg!Akx`3x0YA+C{EWRKq5BEGPk6(hcDSydCvu>f5&h=kAGtnLe$}scy+HXuHWDlGq z60{{(t=HZVC&M&4N?nQD8oE2=s=z-6@DX+S+L3Ql(+^e@cm#|b!q~qSEO_JL+$1dK z`uQQn^?Lg7>V$mN9SE_bU6aPz)nGry>j5z1EHEqX?6_nAav3|NUm(whR=CdGXC*hJ zNfuZW0X?#h1`4y#sv8TAp~^?sO#`Qj`IKA>9GH~p5A9U?U$^%TxzUB~`AAc`3<8T^q_6Ckfrv%H!Lv1z3R@H*b={qxO@U0sT*xR&>yNm{~^iSr(O#EC`O}PXf}Wz7{SpG-pWD z0xknMy^>=d3P<>rBuq&^KQ`iEFY6iqym+=qssEr*K3sL}v8wCVL=KA;{_R%b)v^SW zPnyW*z`)A~M(a2ZEUfK(Q%j%DOix#N!y`_C$on-YO&jba$M1HwQ_cTDYOzX6EzraJ z*`EJ@u+TT1Ue3}(3p&yS^2oywowUN0q1o9|mPbDHFaSS^UDkt7k&K<-8c4_;gNd*q5NZ}!n8S z4796E0Ozpm&gqSx4fZFuFPFo%0YhAEmM739#IZ3N5+C2AuJQ9vN1fL@`p@bA=kX5D z7tg%4v^(@jxIUx{fdmNGon6*JTRG1J?AcsBfuDegVJ&cvT{<892n-(rh+Vueg^Qy17s33-zO~wogP1InAb;rqS>(H*r=;Yz~S+QKJz1|_8PD~ z>hdQH&b7oKPgkb-nsv&+9zwC43UYLESFbd1fF4bz=`d4YvY5vaB!tHjX>zXt!*2se zr=kCukM0BfyFU-<;?qve&Idae$Tz(td#BJBt8iT%h-mhH@JdWt92;rRRurKhk(|r~ z;q0Cc91C(dqsm^?9ygY_1tkF{9zbC`k@Wc9x z0%h@>SpM#(%qImC3*lE0`)G}iCC>lXXjZV5JDC}G00oI|>MXQF<$M&jRqRsGV4QC= z|K>h`_{IzceLohI+$KZ^dj?3TS)D5R7K8B3h-RhbQ;^=VjgjG`_s0C;a7sul6_8qr0TK^6x?pTsmJYlO1xUA z-adcNd;z71_p zoKs-NLOV0MBKr2x+{eS3TwqN~37@|knF3y6K(MJ<`#5iG>) zh<%`#>qie6edE*F91qnUlo89r0G#}ma>{>Z6b*b$tQ&L4(okd)A zvoMYTcK{|mGC!wcE)QM&JK+A$i%)y0X#TdMuh_iZn5QDyejmIGxK8xo%!q7(0-pRu zJ9ggwla@^Wb-{4bT?jz)B4kcRV`mh_uO?=8S3ak0sVCV0+V5xcc$<{M+KE+uIVbcy{Ebbx z0&hCm<_Of|s-pX~;$6q3()S2$RobT_GIBy2HIJd2CnJXu7+ z$~VKP!Zm`Q56LKwSG9e%w#nYkdYMX&n?XkzU$B#Y3MAvX10gP8d^Oy)>hAO z>c2gl0kNp3ukvv#3l02%2R9$H8s=N{7VGr;NgD^Ju&W=MaCM8fmqeWq?;+goc@$*D zY%r?0P9k!?)wA_c^mM3SID_g_Rpf`>8ex=9Rie^Qc{zV@DmujNUM8;=V0CQj7jz%B z(ppuc=ew1ro&2T(SU&3n_wf$lV$a;>wo{m#x4sl&p&7x%;57URre8`*%5K^W*`H^K z51b0i8<*gAvO)t{lTdtp(FiG9m!cf4*cMiuAeR4?N^yILtUGRKT;VIFAYf(PZn;`d z;(S%fRFf23qEG5N^_*LEdmil2J70?2&*yz5wN~YJ&Jj!V?m`9k?o@5WA)oApqTsK1 zbX?H;ppi>+5Qfo<1|+wt7+YLSE|byExZ!wjmNz&P#i`gxA?UAa6@;3L+PWWfT7O&g z2}lE;q#k)Ev?eTLQIyY^n8)k!^q!-+9|KDH&-j(HD`TYELn|7EIfdT83wt@2yc#BB zczpI`&7Kj|F&` z=fSxD%_Yt11T@C_OO_(nLf?GXu3c||C?ule0sjlp97vd>ua_qByL_`gsqaLJ09=X_pa z{p-ljz1dZa3!e%w&(o%stNFE@r7DK^v{)}v)vA-d8XbkeV@C5n+4P1t$f}-q+BGt? zIK;E6av~ji#R=kUy*-1T^Wl|8B=C94CaGOBn!cRn?-JMGbtT1P-OCYf@w|I{W-st8 zSt)O@gDfF57-W80gdTx?maY23^Kq}joDE50%Fsd+>p3{a(n(xNzuh4AgL8>l)le_R z|H|lz9@D_S6pGqJjVP8a_L5EN3P%^vu>xhXF7cC_(=cSiH4Y!*ECZL z6ij8v6Df@F`(CkhI7101<~uRcn5vaqsW`wR>xA z*ZU-RK%Z-|vW+laRzY|ZktIxy6gC%xt;gSg>0nm;K2{#xW}I)B0`1@$rz z`7Z9YYKl}njYjX2U2YCYZD7gCRx`wJ9{EBoVU|8gyMbVdRj2XC_4rV26Uu!|hI&(w zIGazDU3oKK77d^Te0>yt=4bfSs^x0BI4h)hs3y34>(0KYjv)+(U!&_Y!_P2pTC92( z)!fnbzU0U+YvM-S>)y&?N84WA!?>xMu{ZgYsij}2`XIgem2|fty+V&+_t16UR-=Z} z_@@T* z=8CPZenUvkB*c>DG$u96vlSDUR&|551owK)o$AEm;^Sk#Ew;PXUKwLOukM-$C5hs& zODZY0RwdXt24UdXl(#B3jQq7XoOTHBaDjjH5nvn+)P_5Hfu(sD)j$Z3Ax~9Z zdEcwA+wZOinEva-m&@0$sWV#nisjX_ywc7V$IYXcv-JWf(PTt1fBF$$c&fKJ&O;(H z8qjZt)FqHaD0xu$up9sUQc1v)E4=PL^l?9bO1S?0O2AAsHL-I}++A;$R$r9Gh4NYW zR$+b*x@v5Om*k{w%I@VaRojj+tyVQ=PQG&JZRMD`*XsXrT58ujs<)WsLz0W1CdR){dm5#`N2cc|{0 z=R4XD-3D+Ho@DUvlP8Il3%u3xXqFutSkDbAEBzWl#`iA$TIPMBEqZhk7C5Z@`bjsu z>Yv5e(bV7eUDU*jBYiVt_N~4zh!X=X z^8lhjDHA6%VLs17>Mm7dOb`oR*cgPYob!J$3k;}|59;%(QNc=G%qA#QGr{WIC+Ey`d!cRO?$Nwx{=<)Rn226DG_y@26HSADE_z)>=dzDk&ENyDO>zbJiC|)~^9erS`$&qg*Nucn@ zQIP{14@ORYrgT%C_=9?@Z>Nhn)+xid1iqmj@7d#?y*aaF@lT6M4ph{NBg){m?uY>q9}dE#l8|qoqMEmXk1yrFcwJA&cSeXbc^L`SEE}fIDdtp+Y*s9JMJ#) zw4SN5tO>BWbbFy$x$`n>)=*t66pvE^SsT*sD4AMcC{`M*MwB&ptSfKqNAtS*zTMx3 ztea@|2{Mu-EvI20>mvSVvFK07Xw}7|(Ug+>tIU_AxfDt&6BmTydM~wGBsA=B8iR5o zj3O+J=F*3C7w6D}B^JFO?gdyt5ymk1xPj1n}@4~wHB9e zdBC!KI@&XrrAlfotS6tz5L{z+!>K(i4|J0=n$o&&l9X-eUqAav6ka5pYXB^k#4RKl z;*`%DTMbcXFwN99El2KT@HCc+Eh<`=&^-2`YWv<=%2ZdJ8;@oPBZJB_|d5#^j>{Vj=koUx~VY4kN+|{ zx;s%q+*y6KGJ=QZPV<38geTnavC&>ywJmt_$H{~B8G$ABGn0Et92r4FPP_!YqX9y5 z=~2r=d|EI_i`R6yd{q!luFZ9v1Hc!hW-T8Ea?}++l zRq6zw5>cn6bo-sc$0RcvYj$5=x;A$5NL5>Hd6<9MxDJB~2}q&0CU?B^79)0apeAyA z9@!rTSNg!q6^g7nDL!C6lVg*2;TMtHulPYZJ2VHN&j&GX(q(GBH0h^hJ=DPb}gvRcXXd~ zpmjiBMVD+GXR6;pN48ai->BJpvMUs!H9!4+c4TRL-!*ks5Jx}>GVIBK3Wv+qG68(# zj3Up2TckI=93WJlJ=ZQyVw2fVqRVOR5mlt|?0|)S2*rm1AMj+#M3v0!`E%Fm$|HZS zmtD*k*d;@3r8ImJjZ+xu76tWCSoj(2QeAQSP;wt6<(nfD*$*j>S-OoxIw1RxRG65f z;F43<0|wu}v0GTyEvb9!J2FzQV3JLzjgLo2^&90_sUvCv!Ia{-9A(jQ9X_I>jRAXD z3MssEYak7Ipx#wZa4?nXfqu`3^Gy3jT<=A57GuP4c)3O_ ziP0vffwW0s5H7*5`ldaoqYycHQwyEUqY($krmnj6zIGS-tbU@(oeY5{4Q{hsJ_KOeG1+E)`aOk42aC_Am+6fS+}r<5H+s0^>ZM-&5Ee< zv8g==Ew{Qm*h8by{8Y*u7%J|2oSxa`r{)>FeVXSP40KE5X{l8S%v@{YpJ3n=uvEjH z6wl(g$i`3adVSS`<1VU%#IcmB#Ey-&o%nE!>T}ENUjGEJ_dBf`;!jAbd*-m3{C=N? z|IrhveU1b3E#J!21E<~g%&aE7g~Wx3bK-b(nYvbwDBJZ5OS=`7lLqgF|5+))pT3LB zjMt8|6uKYm*kzsQ*`IfVBa2To7mw^y`cyy}iO3Rx9j-|81J56_-zTy2&zb5W+*6n9 zKoY&P{K6-LLac_ryeTW-GSv}&UErQ=c)`qF-?nJ~dxPNfx$6tP(CX>m*LS~^WVqYK zq9)m!_7^*uzVv(fLq%CMoczV7Hg2lc@LATrL-^E-ZopHVj{cFS+X2pwl8ACne0==i zr%#_=8^etfd=n5&Q?QZaH%_%R9RVBAII2Rh6#&&Ur}+|RI*N(EK-ADd0VY1 zp_SZSI;@vh@=MM=ALB(V*(|uA;Kw=OrLkR5gao;ArQZk30vzB_V(TI9A}MnGl*1_B z8&aCqH8zM3^>gT+aRJj^-^6qW+vcO8firdA3{x0Y$Ag~(Dvlyh)cMgOuxuWvsk7~a ziUZkSr*3HuXk=Xb?M0B25?rpd;f4O4GSo(!k!c3b6=K>vyPb*>_?0EJm=auIjM4{2jeZ1Qu*dAM5cr&s5|*+ z1ktWn7CnCuDSP~wA#EY}*D;i>=k%qtMmB_IFg1T#Qr=Hi=WC&h^q+l?r$k9LhRtXob(k1@B(3zA)afoV&a9P(q&5zu%xw^m$%+ovSxzx8H#brbjTP z0=7#^ictgDL;Y$PFImz4o6@RvIr)R99@FnJmU!oJi2?eOc%{C|Op)+;^)H%+81kP& z>_MjHcIXF+kQag_Xq3Lla8(3s|C4`Z^K2s?=jLY^L`FezJ=)%VxoB0F1rdBS7j;GC((%A7)8pCP?KU~@01+l>JDHG+yyH94tv$%y zpR%`NTW%|W424vqG~AdL25`F$(r-M&raSEx5=kih2(M3+R-QVVaOXHhH~Ye9Zy8(5 zOz-Hw|90Pc%wqA&`P&C$#cVI9CT%Yn82<9*A+$VyAV-=%S%_u(_<&kplAMDic_g!B zT+)xvn(DPv`ECHeXq*v(Ln=Cv!$q$vAC6O$+MO_;i%z*?4Almo{(yVWf6HIe);lY$e-23(+wpzdMh!*yScwhdourzD!{;nVm)#Y7JCz zW!~&JZ;liihyDm9m`|T@k|PsIU-=G%i0-OKeKH0YTHW9GL7F|^_fZw57Nv=Fc!NV+ zrr>`3-0Ue1pDTwi$9|Rmh_w!yBSjVPDvHfSAbL*;rOR*)>M3?p4 zD2VXy5w`~M(5j-kE>o(dq7|-b0i<)^0P4i*W`c-kunKlu2pZeftMh8P#Exguq@}E^ zyb2o4!O*(-goESNe$Y(xQN4*6M0ui>in)sbiELYcJ2l?3qC4_OE>fYh=VUN;^w6K@ zUy7;r>?Em+=iBrnm4MUr9d#XY9=#<=(H6Td%*6uJA(avgyS=>~FqxJ5D~*uJlgo!o z#&r8fY_x<(xchp*KPzpyvJKLTA?Fz)wtitnRKUy(;5I}K)VVs2-Rl&M9M;Vd+`>OU z&NHTo#!Ff(Z}g9`qcAHpTsgO3iIACW!NXdq<2hbd*?~F1h1Q0(jTssNwp6SLeKld9 zMy?5>&C@#_jjr~Ih-SlOAJY#>icjnvS@FaN&{D2uTOVI~Vbf%E)>m-*=(1IhP>Jj6 zcKhvt4GpArU2c~~4lv!loxSh+Y_-NKmD>H>%Uv*$B;)t~U{9i6$Fa3qv@nGqOD|j2^wRn>`AKY@ya3(a(CDTd8RHj~=h|2Hbp z6(^@)%Tttc?0DGmS^3t96hCg*M4!22&ruGIA;+-RbW;kofjw9SVRPj(3j@3q{dCeQ z=r*Uq_TTi+2p+sG)gi6JUtx~adFqw;n)sdZWO>VuTEJeJ3)bom@}rw&Ang-k<|F#d z1A-}C7W7VYzTa!7a?7jlEXCwKu zW`$pI<>|WGNZZ18i_D6=m?$X?Q^8fjVqT7>?2%IyM)r5{&ZF4CrH}kRqC!*%4YEe> zD@Db{Mi!mZNK}l6A=dO=IATMVnh2C~S_`_i07HHNo)fe@w4(ZhrJO@sRlCKL`+icX z(%rwQ|9*i|L$@-Uj^uO%iaopzpQ&W@&QcxUZ-B{lSZX+{G46e;pjN3ro_5S#R(0Sc zwUPa79;L+F0c68v1>bv@w%LWveG*l*K7z0)Cn-UcJ`YS34bT#Mw+cSr1j5Ygd>+1J z1VtbM$%$6q3U=fbppu^U>7IJ}W0M&a+?s5s8C$U)$U0@l~=1^49?O3|Clio zPC^{6vWsSiJ=`1SgDlBb%_!)&2V-Q!`&{+4f+GIiz3%85v>48iWP0Y>*P3hUkF8pq zlM@YpJP!4>;x?Cv&@4r;-pq6f3zg2qVi&|?WR$eewTX53`GoOY8zu^jUkg$UAcQLs zp{JT#P}=(PhYyBM(w!pbn(prN+_^Vg9TCeQkVZll$VxJIrNP&7jy}03;4&d*`84AI ziu&W08tzm~yIPv6Q&oX4YP(-AYsYJ&g~X({k3EPLRaG8&7Lw<#`Eugmh0fUF_d>X8 z|3RG3(mSgRH(ltxgW)jOhOtmqm88SAZgJbYQgn>E z=^t|rL9D2TbExqJufGWhy(e$b!~GHzAF(z3#H}gQPL;dh#O~nkx;2_F4FgB{nKwS$ zVkpDsf8W-sVShrMXyl#bKD1SC( zG0X3|+h*;fv-cdmdcSuklALw-!80Wa3 zjVX+>ja+l*_nJPRKHuN_kN))Tz4z<=dOe?y>lr0SebSZhUh*cFT|&$DGrIDCXjYNd zZynw*sGhS00k0TG7Z(-XyFGh`nU{YVU<>lo1MFAsuL~RgR*LbCaq3o6INK-DuN3nn zX|3DX5Sp{8-Z%{R5+Hj2T%6cuXzRs#cm6GsI)t26L_5u;1~h+Qk$u?Xbb6;ha0A_c zN~)`~8c?=AI+JW%^nl1Ww+-?$LWr%PNC9lUfl&(`-PUGxy&Fq;N0L7r&?=#OvkIM& zrO^;EQQ=*}y$|T_Llf|tM0g2dVtPCi-La+h*pC;;q@|W0dC;yoK)e<>D0CWBhjCM#IUyK`Eix@n&qo z2cH_Gg@l7b$Asb+bWwjUoC7Z^4J0 zv2WiCf}BUM66QHt^`2&`p2wU1;m730=E=?ujH1SS2j4GygWgPL`A7{iC`F3u_SCiS ziP5Wx;K~{>8-fk0ckN^jmq!Ooobl`(LAf$S51@QvOyFP?Kq#fZzf@3wf$bY9(NV9Z zd}RLe5cIrX_s`zK{qJw;N4xGfEEYsFzQ2vRneUwIzwSHLNuNn#GMT7o2sJ|%JMf{k zH8K)Kt%?;^^Jp@8RcH3g3(&u2vgda(7o*3|=?!#AQP2!n&w1me8%RAqR?T)NF%H50 z;O}09zanugq%vKT18b)7-TFKDX8K`1Hd$>wC|zpBUqxF)i?2CT*|)WqZ}jhGTquxr zYX?({)zGyV)=O3mDQj>CkHn?E@-6q;gS*}G4wY)02J;X<6c_M7sejHDP9~`3#IB-C zP*Tr!W1DfSHUK6}TDQD)t8~?-eYeHUsmVd&ML?Ov`o<69(16HlJ3a;jT)%K4rtsJ` z<5B4fkv#X2!fIG)_z+TwTGiyLoD2UkQnb;wuAhAq*qt4$t;YEtV7+}_XHIR#w|yC$ z?V6hCX(9HV;xqAUAiDg^z=KwSBI+Xp3=CRr$m2arT7gvi-4?V_l_ z&m8OWx2*V^I7`NX`ECcp9->}hQSg^?a&im4LVWD8{cQoJwEP}PQ zaM4Q*HS?6ahC$D0QV~~3P1qz1eQ5GVHf`}J6jD03)|+>2IPeomo0xF|ug7Cy|1e(` z2rA{Zy-e>97GXe(Rfip{2E4(E7>n?Umf_(nnW2WzP>W}x#&h?+yf!N1`8*=POFOQ< zfzEJmRJzbTFi;uEHnzbh$F&YEO?J>Uv^os&(_*G2B_-N&*J$HCtei*|imRm;EvMBh zlb6~-YVLr|qsw64`eb5>G)+d1eJO&a;Y0RBdHm(Mfz}Z$Q~1aB``uHzqreC<`y(cQFABlgyi}20a0TL)+Z0)N*&uHGP2soX>0&Im z;${FG5IN_>N83sIN*a2$<@@(wleekoZb!E)Qt=esOWw*bOb6K^+gf$`s0zldw5 zES6FwP4m}JfRuW=q!Gd^Puh&GRu;LUyZ~^LPH+#Xrx85k29;?wc?KCbVPC{vVL4oR zO)X&$yO=LGRtr zzN{p5x$@9UIxRnjCkFlT9M4^alG7_iMj7Eq5DD-@K^Km?q43;PSS-eF(93gbs2dFq zC43tUwyc_j>?HmBKi||y&yM6sJc*xuO-R2$^JmPMbmBO`ZNp6j5?ME!eE|9RBPAsT zi9m`U4o}aDL_3@i-a?%8S)OyTd>ULQJyInd59Kh0`3?uD$0OS`h@We(a#)*`Lv}E% zjBy(pEY2ZNAJ(he?+I9Ol6XtYogF6=kcUiM{U-V{x0*10UjO*?LLQa*fU?Wkw+KRE zUI?j&6^)D>x3AgJbZ4!;y82Rq9g%H1A5`m?)}1$4oTp(+fU$jie705pc?@(k2$UOe zAA!Rsi54M-!F^RXK5$w9C~V+=dZHzV6L{pCTvun#=pKkn975g{cNNc)V#B!Vbd{HZulR8vUXWhQ0 z-;+%e>XVU?(Q%i{6qj!0!(yRVm#Qb*(-ieGmVew+ZeDLe7;izh>u?klU6SX^gqw*s$X-O8`0*oK_XN-1TT5K0!0V@VKh_~1yFWiXJZy3rJ?H)`xK94qzCxpN zpyjRN{rU%~U;%Y2nB74{g6x`U>}QXfDCsgjwaCfu{CdcdU~um)A8ET zX#>?>S2~`{?3B0so;Z3an-N6s?qskxDy=icxQ_-tcQvGxHYMLSR+Cii3`0!X!&WHK>x zL5|fvc%*{ir2?SIITR>VR^uq77E&i1^0|1csp*S)u+Erj+=Ac@!19a)|nokKy&;Ky<+rMj5p=g;=8NOZs( ze7D#6mNOxna0$y52Oj=Ru?eBXa+P7HY=K^}gBP)^sLt8^cyk3A<1cScOpwg=ryO zdnG?71_x!hzs}qF5=E*VVEoeJrEu|~hk^5&*ew8PCtXFEEB6!_pGx-tJGWdKBB)=Z zMNAiEq|n$~nG;5IU+{cZm3Wmy*W{cmrBylT!~cBNwuS{tYVEa<^fcd~X&zt7$3o}a zFWQ#Zsv?S%8VsP+9_5>B0|;BQP!wa2CGKZ$v87k>OTg2~P5x*qmV#;@@0l~D;2!)1 z$7`cM4F_~O{3XnpuHXs0!#II#+_e2N_eLuRqFkGTDGBXH(Y4XP*dGYycLmgQmJcTx zJt9IVRYhMfEGSaJk>%q^eyszIzmRGoqQ|$W>yXlqv(GYI0fimH4T+RdL$CiZ45ez7 zVY5gEhvAil<u_^@lsX|suCK&~;G^MgCMRkRm3#^F9(@9hdd~qJ@Z975g5~xKk-oQY zzk)vBG6haSEj95yrEV{UO5SO;xPG~Ii>n^`=VC!y$pE%ANIDG&7ks}gL6@;8?PoUY zZ|r&8g~{!0+C7%k0D?bR^X_jRf7Pb`ne<7lCA={Cp-T$HRuEe-D z(p>3t>Pj@j3peM5pAogv{HJ#mlWcVBVPzxD-Q!OG6jZ;x?{cxSb@G%WQIUu+=wX#x zf@vWiIKMz|Qtk*@$|SxD>(^XA+TZ)Nrfz{WmGS-@7jD_1?s{vm?T+78m2I*) z?rDDrm>q|o>Mk%2KC&*MUGU%((k%W)`)&OAuD@(R*TT>mq*NdbhtaA|$N6L^>hB<^ z$Pn&*z~NYGki@FkQty#c^U4)velCfv%Q?2>l9JRcyW(Gb&0S9DVQZ=+F2Oy`E_4@1 zY!#R}x=~lZ27yGtOJ-}&iy$^4wqTEHa(nN_*T3?;%UWpPv9omxUGG=a|5W#lLf^7# z(#0+7JzQK0luWR9wU(emJ)qtqyWIBjGHL@Ob(~Wg=`|81C++wHu2$uDLq}7O%ciRH z(b|y}uY+FABy-!1(L+f-1M%z9w70eJio#<$d^+{eexshu9lP$`E916v{WjNU@>>Ve zpu4BScYT(L-$6TKRlhhK_17JcKqD!czn8fPYM#+kRc5wKyuM0D1OpUB3j#?Nnw(!C z&Ebx3iLJ#&Bfv%X<$)4+P@b%6FWwVI1=2lEIZ{xV43o*Wp84~7O8u^OOc&&3-c*nF z_9Iy~wPoD21F*ysttA*=pEDw$G4(*V-2xD9_IbZhFmvwP!}Mny@}$=RbEx&PBloiH zgx_T-g6`Eq|6>_Mh{u&)@w#f`FnWqcf9TIJp2 zExsND4G8dS_vAs%n+mmw2tzo#q;94)_VJf%U7RoliC$+DnYR7bZ@|bZn!H=3+rDzZ z-P`u(3f!Rm5{Nc5q2L(Z<2uisg2-oY{`){-&?ZY&SDd-juY%J=^Cq+bIo4=uE+%H* z{5@{>Wp;rp?iVYSGQ5@dV`9QpSV{d=-7EJIrbAybh^PT%W}7Bfk%*U6Jl;D!`QAkW z695uTV0?!^$R~gAq(falXBtP>kQla5WD|^wi`Zh${xmq?6`azUB=a??c@lpOnU;S) zcV0TOUQtuF3SFg9qzjE-~< zlF)s4u9FeWo+p%-+wtEFG0ImXibb&Q(>|VPHO5}L)@JU`-zi|+=X;+t@9ei{>EPf< zB1idjL#ovky(5bM$oxO$F(z>Cgx zD1_?PNGq^;hNbZB0^@Le#^jrot<_yJ+6?IUmW!_T_Sq>(i8P%g^Vf&6CpL>7YWVl% zfJ*t*Fh3y%!2Baseb&YbL>{NacWK?KL#FMsE%82jeC*Uw56KmOcvVXGf+~+Mr~!K( z`nS8)mlXyy!Q4lHN+dC^G8lgMzUC#y)hFH%)p+f@r>nH>~53Pxoi}G(5 zEq@FGAgZ)6qRdX~@uM$2kVyR_H&*1SuS4`JxE5ec@7G{~H^i});r~G{H_3(kcz4nI z;*6o%+T3e{JI70OQ4vgqDaC-FU)7(CB{zZ3CXXR+W@cs|{I#(_H9Haw_J-c+R_)$` zsFOK2h;5KkKj4la?o3kR9U$dj)6^C#eH>gjuH&?u74Gy-c4Mi9p5NV;Wz@)z*FJO* z-*_YYqQcE?ZRGwZfMg-e_K+otM&vtp>TE6sL*7HC+NnBlHWxU~Wb!04rxUoP4@dH> z>4%{5Bu_rJ!ZFW2?3)0ir?L*hCAyr|y?@@(&yG_x{~CBbhw7GGSh!RVeu4IF?(+zs zzdkc<)x%1i@L~%@pV= zIg#(baUN_uO22WfgP3~^slL)*+Mw4?epH7vd3r)bR}|mm++~D8 zZEt4_2vlLiETm;+fd+PXORW|WS6rL~DQ7M@KpnH~1~usU>UFG%{~?S7;}gKgo;AkK zRd~$5MtKzJ5@}YM);zhS7BStvgS+c*bo!Pa#`|A55=lAUF?i^>@L?3roon^6oVXw{ zdC23$P`WDoZsMM&_v$R0)%Gv{*5O_evyUINe{Y_(5{r~A)gD5{97Kx1X1#c6d_~C@ zT8;VGSa%?J;6e4s6&Pg1U0}mICq-`TBpYpY-rhaY)U9opE8wpE(p9}0sA6V8XLI6o zSQGZor(x>}ps6eyD=QX>oeiPxJiP*HpQ0>~%jjFw-iA69o108CX0|}^H1Ae%3s251 zR2kI5e9U^1O$Wm7wxC~2<46RY4Uvu9k`1Y*De2}z#3y7f`dxaETW4PptL?BsPS`jw z7rksa(i#WcpJu78ze=|@(by*|38JGwqBpp+t62B=N5O3VGzA7f60uiEg@XwzT?;B_8ju?SrHw@(Gh z&*4@CogP*vh7@h3=D25S?@Zp0n&s6x?rlm#o9RE+^53dFcqgcCJE=X|hR1~&XRE+_ zCbMBHChZ=xkWx3J;AFAef+g{<%RK;953HwPXj52i5e}COzVDjtpOu~L?d`FQ(wIIN zAt6;YXz?>1Bv_Taiiw27RruKdKF%g|l(%;$1~HpDWE??c{1~;9Oq^8#1*`Xy_z|(e&7vH6W?>dv#iM4)VptX%kTrD zow8u;9ka7iZ>&Ug90xCKMQ@7H;sYNyip1rPI`crmtABMNjF@4j$!P(Dn%ptVs(k$Y z3KqTAs{aeV9$}mkEjPO`zB(^8fT>b+WPf{TeIzTx>MR2| z1)R7ra-VU0+{{x8oKj0N*#vh}sV%jMb;Tj&X$iXExkO;a&g?B`+}<5mG9ef5zZ!td z?*H91pI@)Gm3#2+_|a>FT&M0_u5@B;>5ZASqt8D&&XJpy>&+a|`yBKg;!c^_5g*vV zE88xH9OX$T5uWWkSnW5JIp}F`|BjA_0TfUdZ^McAlfMP+P z$N7O)#X+3vZMs~dp=!vg{}hzEvb41HqX?hm>SpeffB@0~ zEXqb`bYFI(#JrQ|#TlKuWF#1(p*fk9B@F&@*xH9rVvOt%4JBZxgg%#cIpV~>Id2Q) zk^$eC*X4Z{v~sOzU5B{LYZD1a(l2@0C2#UrOFoZvJy0kyXm%P+vO#wUJU3*T)R7Yg zweizls&8ce{r@(qXiTvMk(!{`23G#r{7q(Q*Yq=+m_1tFpl$JwLlwFL-tWXHFVNtM z_I(n&*LD#$E)+Gc0%jj%4>$-f?9UR-jf_woI?l%y-NR-WW!|%LII?io?{jHv-oKy` zCcLh)E_)`Zl0HU})!FQ{@3IOZl(2T_d23*c_9Of+7BzIDy8y@}O5Tg!>lg)aFutz5 z{EH}2oM_EQ<5T4)JW2(}pTUJ^8y#^%(Filh!iJpA8kw(EwKe^T6Jk&F!3ux_@}H~U z@?#P!33gHv=&Y6LK0#}stLcK5A$q5iXS>cR@Lw{UeV%54TheHA0WmlqMJ+RLY*&xp z8m;P(;pa=2Qj;tL6-g8(do{Nm!0s((EF@a4p_@b0RBcR8N{;Nonnn=>e^4t8e9m3 zM=3N5sk-fZ-;`_=48BK?~Aj8Ap%J69v0BocGVmOpOycboby%R~ z`C;7&L3cbNK(Kq~bg>DAZqpDlNHqne7h7Vv1qg!b6$li~kP21rDQU-B>50W7P8`R$ z*;(et+lRqlw_QIg`y*3SRlBi2wnw7gFw`EcV<*) zPoO<%M=6^QR86<59Qrt}C>qGW0nS~4K`cX=aOm~K$ZOy2KT=IT2mysNb+`MU{+Dx* zv6z?!W~1Y4BH8ilOn{^MGquf|qEdIVOnPuguw{E!u)r`gyQK!uky>T~uKuDLiuF9h z*e66taV2AnhyAeEhs6!GjWX{>5{JZU7Q@hf1nh zraNs$?JFwA27{_~%M8$?nKxP5h);FOG8aRXGya1m`q2);80pdM^Mkx7FeJbvq@?=n zVBA6j=nj*GgO(U6NHpJoD1M=J&%|QtLIN_#D5?$c%|~in0)Kh!1gF;Vs8N!4T6uJw z^%QS^(w>-;&ZC;}rjaVuZ{13THt51yIqqvO_4H5wOqXV~q2xHX$jQ@xmk=%+segZU z<*_?-8<1^ktWnycFB?mIm!XjoS^);FFmvzV=-+~gT1CA~e)Fr2dSIZVlr7Z%r|q;W zYR_BW^q-w&cFQ|TxNG(IMHe$^$31wi?3r{{(oeCVhE(7U1~wd6@h>YawXM0z5K0o3 z&P=$zMnSFtY_BUnwgE^d*iW#WOIlzch`c7VEtQ;ToLAMfcTd1>*2qcc7fAjg?2LWr zq&0~71NQ(d(6g0eE-)U>TLdYh*TS!p1Si#>Ev2o?lqL~BmnS$Xjp1Y1y}4zG;!K~pZ) z8w1{v^CTpF&%nUIUiE<|y(t=xu6kJ`@TXs=E<~TqWoRYwx1SEIq+d^B1{aBx{)5;n zeNH>{6Ke3pqj&oDi^OF$Kcmh}qd3%5RJYqzmuT62NA@<6?7o3BO6G~_ zWdu3G$&+sad#CS-nOX_OP_sdNO@z4!T&r8G{(U21&@+rv`rnhkXMXR-fIUh>Qvoz$ z0vM<5mlO<-^_30+cFAQ0;XWnecWe6sZtSlnq)c|TQz_!n70Btx)jNnuxO1X~6Lor= zjG4;T)#z|Q)C*d;ov|F>XXSWM}1#-Z=~urvh?`Is;6ph|Z*U}wJB<@oM-UK(lK zNZc(~;FCpZAlQb_7ix1&$;5_b>EhzzdGJcg<^`_%@#Lo@C+C7=9Jt5?poAFN;N>5A z=y~V9@BO<5Kz;W=Uq1aWRl~l3$&Q(aaN8+_gV|sD<9zHjAW_FHsWB9Rycn|L-=>1~ z*G`}syEb5{g;DgSlZw8aWAWUfSo7t;;?5-b` z?rp`2;-TOE1d-@8UJr{HknvPePJU^xBcu>*kwCa7mpj=Tp)$=e4u^DbX@nXwCp zmn(NLdJCbMHtWs~MGyReU*NsF(4~J@7f_god;38CF4(dRQq{C++7avzkNlANN*c7O zV5$tp?1L|3w_ddkh&n$?am&03XUDaz>o^D(t<*)GK8;Cj#=+Q~2J-xWiSFQI+qd~c zHUtcu1I1a;1s>hDJNzY%eXqepQ-0aXu$$eND`L*i$7jmCG?5b_m_O_HnC;3l^n=?1 zGVB97$8r-Q+~)8)->$+e(vIfhg<1%`%LnAjOd8>L?!EOh7!2Hu*oHE{-lGG}_;fME z#ihl@Le1!uTp8)l(==wDe{sDi3!zjC$+RRk9i+9PV((7)DBb$ou@2c+J`>cs2eilL z3M;_)8A$o4=gbeG8(ACmPS0CcfSKUf*$axUur8|I-)>GBeg(B8!z4D*nl@Xg68kD^ z<3L|Odpr(%z3r%NE*oqXpDYZTC`vq9gUTUiZ~BCU)W=-YU!$-y!OA8<=p3NCB$gy( zjN_*nq^V%flS6$ksj-M#x4zez5d}rs79r)92XU7XB6jvBMV7`d?s8T6zb~}*=xE)+ zTuM`+tr(Dq^OpOEltxaQI%I=JkYc&t_%snq%}#|rZ4Lpt52?`>BqR#p#e+dbkGJLx zTzYhsbLH`V3iJ%lY0r|a7VO?Y9(1Pg$prUruRJgFUEN>EIZi8 z#>`3uJ_g4ucX~(9NKa!i&DzFn^{7fu0{&u~c zU1iVo+UmA&S?O)_R6u-eQY*kGyEp*S8$Vv$-xL*63*ZL>_+Fq(E-g;!7s5}+kIb!L zW5&8?F&t^x%Bg0>kJFv873_XWIk&LdlzDfD=pa2RSartxMp6ivcU77+bS|q)+c!1m z**4HkNS*avSv+5hi(mm0TP3qQprSA(Cjmm$1GI5nB#Qw~jb5})Q|~4#)U;Rn1D}|? zG72|jJ>(VOAQ8n8ZB2+(?B2@5+@y z1wK!&f)NL{Y&>af7dsHr5urD}QtcaLIYgzFukkJodKq`5nVuXqNDp=mr{Lf|nQLHl zLT$ctXm$!eS-CJ0Ue3s)s{^(U;BHmVTg@i zi~9(T^z+#OgFF1?833JkvazutsJ_IMoV=rs zAQ%}O7)YOYHk&pKFbTG96>0NB3z1#$stg}8v`=cPK!+`#or-`n3y5R;HzNYNty-+L zwr$pK4nsX(McL%IS@wRK_ZI!@Txx5Z>MaIx54ic<{_p0e2buO zWCH2cv(n6tsdviOOss<(4L_ZHWnVmWxq|rA`dLnpkZ+dteBjajPfeHo@;w3x;lj^dv~BA3$+IW9! z0#G{CK$;DOU_qD0H*>7^b&qETPDne@IkmfB&4>dk?dL0Vb zovq!Z$P!?n8_c?Q8ta-uGTHaF zJyutJ)j`8(WA$+F)o6V_L-&eY2Cd1mbLMSesb+WwK@uf16N;8p8B4j4+|JsQ@@~J#R%c0u=t|t)H^JVc&GG41Scy_a#+ax; zI~%@!8N~p=@;Afrk*Fy$ebNi~iJUWB5*D1vd~8Ph>tor^G9rI#GQxpC{pZc6PFwtr z4rLRJOiJ^KlrfTQcl2jK4eB$>YNmOJG+T>j#nc{Wm>c%4le+ZI(Eu>D8bDQO;Su=2*sUTYe zjH8#e`Ywy8y-=8kz9l1hwrWj)4^lR$9f7IvEMy5|52Ic4%*$9?(Cmr~PZ}g351yOTCk03P_F=MK=oCu|@UYeryY9NiO;b;;RS1Y53WhrFQL^T*AZ zCHysCI;Te%my(4xAnTPUEz-2pGU%Q_oHsBs$70=q*Zb?t2Yws(@fMimPhFIXIF^cV z_w0ki(HX4(KSX-RlZ+dD`6=uz<-yO^60V|N#bY&2uYCFPjPk+L-M#XOsfe{giF(bJ z*=o%8K{{qI_rLXqj$Lq4e1qU)eAwfsnqmg>6P%Y+K^ABH;7OUjzCPMg>mFBJ(Cv1< z{Z{8h@lu5EeJ1qInFpckD&Af4q@3m)}r{nf<9n&NdjgUeGzkH11r5- zO(&t(ElgE@5x54f0@f&SU*^uEGYZEDed2|Zgct%F{xmLa)2^qQmSq7 z*eeUwYsCvsk%{J?+FDLluVeeeeewDpYlt)qREI#8X11Q9gb zOgKDa20bT;iqZ zZEK~L94hDe#P{j&z@PQSf?}OZ5+XjgcIw#r#ShK|+_!9UD=SeVd8Ds*)xaG*gL~km z6#y?41iH9Blbe}FnlQN46xitE`-N6+#y?eZ3DhLk_%Hhkv_@nC1sOjiY4y6J<*li# zYRM?pkzd@G!V<(n@G!iIq8JGNeosSKIp|fEzz*fHv{TDhH2sg7DP3?#~ zt9c%@0VkmDWM^i99a=5JK-^l!lRUEa!a+2rpz9Z~c=k_EFkg?uOY$JqmY=P|{r^X< zRJRqd|5q_6?HZM~1s(U4QyJSA!1>vp3y7Oe1MizY5AKNA%sw(bQ3-6O-2N(J5agjS zL`cnfjBSo5rjWAmW8H-}u00^m#JWZl*qIVVrW7oz3l%Y1CqKA@6%Sh#!^ z9#1;(3K|=QMIHFc_SL-cKW*FN@$VL12BVX$XKh>p-aGTxR9E){pLxm3T%H;N+bm0H zd!qm#4&_^BdadC2B&g;>sPf)}d&|H%O@>mL-YRAfh`FWFQ?>V}okBKn_@9~@Ok-GP zTyoQWyQyqNBzn%(tknDiN9@bvX4(6I&di3fmuia*(R>X^ip&dT%ra1)M`Lud&19;3 z%eAV&+hr%V*X64R?(aZTZc08)QAk?;A0bj^_P~%yjWQt|(;D+-p=xyq*o(4L2j9<| zbkZ@v!vGl~*$}HRCw)df#=!U&{7gN`>fIJ*gnVO!q9XLci{snf6$jO0>4~{OO2|N z!FqK+eYsMKEIv((1MZ-VnQ-6oRhv(m?V|WSSj`*=6*|-pm>a6u$N6sh`I+R@!l&9x zpRN*7)q#-`8j+@Hj?JIaN2H~GYYM#2eN)<^I?v~AA@`~&Udv;$UmTrt9eYR7^`IN! zX*2GWnK6QX+gMJ@f2yRLv^vw~h(s2jga!4-&UO|q{k1b&+wHQ4h%QMD4Z|5@IDbCX zP3TxI)FMekLXsNNurIZ?0A)7FA@2A3X8q$@ezLBoQX{0_5J-gVRa}34E*f!@ErUNF zs`h%vVML-Br`@c};gvR|z$(UJ(eftLyi1=(yVrj2ND#RoXd^4KjIg@G-LGwh&y|GQ zU0_5XN;-GiNA-L~(wnAQ+DC#xd6$>fo&{n)g>cpC$j1v;BkhMnPzduT@xnY*jG1*n&Vi^r_kf17vfIHK zm8)OhY((`&(V z&SnNir_t$BOnl2DKJ6e zKC(h*CL?Drl7d8xhJ6Vq%K~B8K!;HnvlR38N}bK%X0(XE|k9zFGjhLbLcgS6>(U+ zyx9{<{Qy9;>kei=f$&jK#WXnWtuhQuf0HNo%eQG^-4|TQB{`~Vb6u#qElVv9e>8QQ zY^R!)l+2s;Y|T1w1_=_WyJ?HyOqc`Pm?Iz+Ywo%Vz#Ev$`Ycm*G6-3BM_0S`);XAg z2o+!glJ+bZe%Y2HM+*T+=b+KIcs}6_wa^ek`UH+9vC3Wj{c3v?$By5pU$*UQZm%=m zoU^43xSC!(Eso>>e}K6r@Cio=6j_9dY{xO;zk`{F2xAewC`%=!iJb1qs@htMBNy6~ zCjipIrh1%4Id9Rh@t89W{){@FSMBs8HUYk7|1gsD26aSAw-JjxQj1A;PZ z>@@KpttYeGKR$j#_$d`vko6ZsG5fg$F3l(V+l={aL78OKWO)5#fN;|9GWK!6+TkrL z5}#>@<^mXjtTreW325rJYwt}%v!5+XW+?e+WubSmP|*uI`}mf?9Oj zOG2n?0q7X(;`>zyZD^`V`=kcCBHAo$asj?gZ8yz7CixEq3^I(W9qaf$C$fLBT1S#n zyDHK%Wg4pWHikhB_wu~TvrC9j5%TqJ2zrn?wMFDymNHB$Y+8F17p zSxOf)7{UI!iZTkf+FrZ1sC+-LQqSQ)HwKz%HY;F7L&e+xVCpWTAr2JqI=$0uYio+f z8YXh#`376I@p?-0u7((NRVz3E{frk#9-23e&v5_BEX#P$kvLiFGakE}{bBoLs@};X zye&|9o*fA%jw))PNZsbI)}Z8qy_Gk{i%i=y z`eC7JU<3pviHk-o(@kapzOOvvW&72jGfbf7_ z)3N{|=*SRKzSleh2IJytsQR(7G6jtvXF}sc?>Xu7ZK?`hx&RuMs>D8%OnI}ixF3X` zIrB-3$~NDBf?tHUG8Zr0yl`wzs(hcq-MYKqG??Vcu9p*5&}fH}*PR%F?N}cm)_Frh zEC9K;OleWu8rY)T5zqvOt)f8mnG>IneCTqtmkBL;fY^*zOMB0erF1`TPb7(%>$==? z-$xfOY4}yUeP$cs&%;dZiZ^7r;XDeXm($!xk!&#o?Ttuky4oP_)x`wmvG3r(;AiFg z=NX4`&P$&z4`{za^**vG0;s7g?Nw7;;B0_sWg+8SInmx();;t{+DOf;+exKxZaL5h zvx8|Fj|EVNV#c)gosszoO!8cKRe5{5&^-${FoTLlu_n-G^m4h!*mkmS&F*>N2T)uQ zo3~mBt6r>^EgFV~;f=EC2`W!+=?x9tNNC1*Jc3PXy`X1zf#XJXd?g^X8>o=No(7GCS&R_{9&Qu<+PoFrH6S1iDic-Sa+Udjj<8Xi!C1|)e^ zDDVABtuk3zS=5h!s4ZSG{yp9%Rc#M+OZ1ai0Kr4Q{(t82$@xATIR&#kRNRLshg^_Z zmr1YjY4Y}Kot89|+#Cel5%5OlXzGc*KxDqR4XC%OUKSYx;j|*$ql|}zGMIA$qAsbD zx|^*AZHq4)$E{mD`tHV)X1BaH4NAmo{_?Rk$Go3^K;)7HAP48hm*Pe_T18#}CKdoA zC3XZsxUF#X*`&dn(L3}nUf*}XLvNoyyq%738`eokhF+5ekvkKe)>aNv*k)^!PLL!+ z@3U30{G_;@Th^MkTj!l_TRcc%K5YGi=KS1$WA>ggKlu?~i}Ouc!$(Ivzx9-o68N8e6Hb<0s3T(DO`r>piooJFIJpL6ubY!?}7zY>^vl6I!FJ` zBg-BbNRimD1P5(viR6n@`h>q8W>__jwLr+hmV5bkhM0s2I+Vb7)j|g zOcqgDF4Uwtjhb@I^K(Vu&FvV^q%viEK=I- zo^G=@P@9T{NX{=%3newv;qi!UOPR}XTegS|d+}sZZ4WR%-*iO(-FWn$R{%oYbd+j< za&Eb*kZq5^^rmA@Lc{?Y)h~OdT-%Wt)!XI#`1l$n4rqq@qL{JCJtc^MYnHK*94Ry0 zJs4pt@LmllkC>C7x$p|E;3PKm+arF9*skr1g78_?m*@%Ke^1NVfD4XCX~F1if6Hu2 z>@i~Pp)CSN>s+kMeTU-|(ST5tCGIquYx=UbLzmy3>XvIki&K{1cQN@T&mN*MfxFot z*Nk=^UIwL|rTBEetb6Tr1H-wfVd}HxKPe!|abPIO%gf6HOk=|`Kp+StFVBT#Q80ox z!y`w1GeB1K_(*H?#7v9B`CvwpnY8xzrDm~@z;9rOu57IHpSCmG&Z&p#nWdm>0)Sc4 zpyqQ3P3!`GVPs{gjn$&YJ!e=pVk7$~9tC^D->FZ52-#qd6TuIi#%J-?T0N7pT&l*> z(lVUc_p%Q{CGC6`!Su4;m%ft}eS~%NfJHWT5EH6>1EI;mMKak6q+iQS1j+2rN&@5} zTQCXJ1&B#YU*o)01SI_&Fv@8yH9YfpD%ItQK<4~~%HmmOn2w?HOstJ@( z>{|?RkW{EZ#5*$m;drSA^GEZ&%JR#Vd1YJdb!Yxy8gxLr0}`l!K0e}ltm1Ls>IaVk zHUd(<(7FB{;H7x*rgiYTOWe?~)E!x9)j~3wqNVfP1}F%C1>r25EH>};W!Ej??S&(` zyrWyqn~eX58CbZAZW^w+Eceuf$%uc7Txv+2GN!fs`10kZjpo7+@IyGVJ&B|YAc`8e~+m+AXX!X zroyDIvGA4$px&?h1n%5mHX_$b@L{vMkt8ZaZjh#m&Tgi zwGyYm<~#eY%?ezj$rnC0o(`D=aeRFt?Qn|F0^98+*sy(w<9D zj|oUH*tvYAD;eTWZGvz8j`OWn2d{pm%(QYTZSJ02ReW;Z3FGS_b@c6Tox%FK-P6iQ zX4cKRXf128c+$5dRzPL$RlhVnprqAuY48GedrFgE9}ZCg90JeomXTh4y#aC;JE~jKg>ChHvu&`#{**JBN=?T4BZHN;RGp|3h%L z!uLvDj=&TA2-6$GNjkq^)|uzAp;%^t|9xB1(u~|f?34^+5BTa<0{#_D7U5_&toj zdOQOrn)|pKw{*=}xboxNYC!~>l5==v!)&t_F48hH{4#5eMX6vb3n*X@y|(VO{xZ+52S9r7^e{+J9IPP2EW7<$FqF(Sz&#EQ z58D+w_w6z>*JSXUZ=E*)at+_$m}L0bq47goF+0`fuBe&7=3X6mfv9sI4rMik6s^WI zOe<1X9g->_k(4q5Yp;h`8$}uiVkMV**p@8gc)=NF%)V`3Ex?;@zwG@PJ(O2jTv4y=paU8rX)4$zO zSa@ffW5t*#?OdyQEiwpWaa#Z){j6DNv~`{v{a}@g&oi-~>UgQ*9rsV5zA!5K<@Mlx zzp6`ABtqROdM4dBdW$I+Ylm*JxI&^Tl)PQJDxwdPU&e!zly|ewZMvKdcRM=>zi)0w z+&!t#pIMloh3{yQwf;Y*&OM&#|NZ~Hbv}}koRd(5O2~1^u_T?4oGOJ9%V`e7LMr8u zh(cCW&W9Z4Ff$})mK=t$VHjrSv<b2MNbv>`=bv>^8L*H+2 zD+Tn}`+;gJZL$rvm6wWCI!N+aGv|A3@MRd&smlnu{ zEV*zmuf|EO#x1HjE~!l{8R6He3fWbQq5MI$eU@s4Y}Y^;E|J8BPsH*TAPzIOU8skr zo^IQ|9tl~HA9Op&&{f$qKiTES0SN5Bhat&p-nV$mnTWMa$nCAm_}me_`~b9h*^4~y zfjVff0qT(+G!Uq!^MT};deAZtdeOB|vs`H>?LsdN95Ae;JAFW@w{Z0bfLx09(yRo& z{1s=dEOG`@_ibBe!f+6BWTTRYe1MJ}|m{ObGC9#cpw5B%aOBIZsvzF5ugl~%hi*d0*4GoI| zeX>{FR$m}iUf4#gvO?&rL6krZV_i#rb{rzLtY^9->6G$|P3D3fO-I=tO#0oVcdHh> zX~^C_*&>|afRxJ#o-u3*49e^N_q5guOI`cwV8m>mwrK;qi{ZpFU`|Oo{r$fTUvKIO zpraOORm#P-3s*!}^a_ILmg@)l7G&av(>_n0lEDtVdIQ`vPLjXAf6?tya38vx5YRli zPiyecA&C97@5}n>bnm2?@0HITpV!X8E}~{LwEXO9Y2*&jF)kF9eN^}OWi{v=37dH;KXj@h&AsVmw3K~9j%$lC_h5d?7_#1FOi8Nz3a%` zf@PNa%6E0&6cyl^X4qvjtLXwtht-0X)je3jQC`rSmxYoG=+A7LvWwOYvl&GY%7arZm#A7cXYn=A^+srEtN*|R z)lNd#)h3=v{hyY1WlTEqm)t#gT)W|w_pK9P*hP0xO#;|A3GHmDyS@Yj=0e4{(h9*j zqC+w%QTv;{UjlXZ9U_kp?S4ZDNE#pyy(dnB*@|wX-Is*~vXz|eZbTTxEr~OnrFKu- z*wLj*_HNuL=0EW}=8b!a0UpQnb&Ve!bWh zbaoA0b<}pVP{@KXqDz6wYk{oFPuxJRCG6xSQ!AINZxi?KmHg%QOUW zN!7wGX=A%P+2uSYY0!@H5IgthA~!D7QRlK;{8X36%}{&5|KNXa_Vv}naXVn9BzM#8 zwxeTgz1T$KNs{%}0Q0^K`{U(Ps0HH=NOJBsuehTV@*NR3e(I~ecz6%qk>U%wxF?f+ zXaWN!TaB+h?O9Ckypv*$<`*~G*qZMkPUWTt_t^pBVhpWZ#&GwZ;Dau^pXqMuwF`Y1 zwS`t)9!J~lCil4&Doh}tfWvw1tt^v`!kJu2Ow!dnm%bfV9UAKDmktfcJbBk&&{ec> zTeb+FU0Anns~&bU!-}CZ00veLyE@9z;fgDhP_FX<6qbsvY0JTRM^qZZX#B4OBF98G z&94rk5KVqTCbrxX1QUm%22UAComtS^wtuRuwNLL?RnDr~rt@^O<vvqTXtrtxlcUX9Rl$WyIw9ysyL*5k}# z{3Flo>aV}-wi+ZGM;KQA%Cs!aOibQPT`kpf?Y?NVArJx<1UqS}#y9sV5SBuAwzbH$ ztnClL9o4?cYrfZ_IG|)|d0t#U_vN(=!GZXQpxx>lbN+20l||Kn)-6SEQSh~sy*_H~ zY%lzB>#6teeAmzY>U}v7xrJ4JwBlXu$rPW+0claQTihnziWEUFvZdGqA0oZ~c717Q zfFeA>tl!Eg@MgA4uAgO`o35Nh%J!{6%7zw!(hE9kcP|XLe5?%V`k01-x0zO>l%&YS)fijDQ(OIIRp-sIw~y0=;>fD+IDDXCbL)?$r%G z3}fC~l~uu#SR7mS9CfICv%NM^Dv~J3wOmM(*Igon&S?~k@bB0A_4H}c$D|R-ME0Nc z0p5yu*_FB-RU74vMQ<V)J;y2|w$eg|hV$kh<8zrVpn>#ET%29}>WgCAHU8pxn2bS1A|Y;#4J4R zPcs*yd3Gp_1C+~BFjKU6Z+zIiRv85rr<*eXmr`OUMoC%i8szov z#y|4~GB-qswn^9$<+Vbew-M^;S^^ypf+1k?xst~}@vO@mIk3{+FZ(V$XM$nQ(_ zoi>vk*#{yM+#b~R8_FvKLqm@#8;sy^w=a@3W{`9Rs5(6Sh0uK!@BC}=9XIMvQo?u>&$wHwb&SWO#7!wrAXMplZM;-F+3>baH~pdxcv`zZ^ixMdQQl%Pxr9vHOT_ zjo=%ro%Hq2MQspM^V8WTA>$^={YrONIdlZ#K$)yEVi+Gh?4;BO5xXfOl{mi^`uP!q z&g0TS?QFHoyq7Up;L?L(3|(j|_DVVjOjTIH%yy}j+U>0yxkYk5I)?-itKm|y#AiXn zDj^lk>W~JGBfHG8ggRqGwwdbwTk4$u8Sdp}c}HUd&|Y9S+(R$|Rd1j~0>y)dnVY@D z6L_m7hj5V6%b?iekdUD{%ca)}i_@~D0QQ}Dz!GgHw5zh;Azk9z{8&2C8|jXDynC9Q zlvtQTxKk5%{NI}Nk^EPj)0|M4;Zw=Oov-$|`%pk#yZ%y0dX4d}n`I^2T4vxqNYEr( z(*GH>7pA=xb5}x&Wp86M{pjiAHcMBesjG$1N?%g;D}2r)B%#0mO%^0GcvmAem@;#E zNpO^kkq3N+QYHMRkeY3a-lXfRBikV>bw$x;4;xq5E8xbgI4)V;xr_91p)_BI%5O(zYy< zwn-WN)t6l9hzsUftT$K$l}=8nQ)d!iQ*6}`<(A$?H#(eb`y27qNWu4&S`30Y}VY0gzL0Ky6o#@zYj4 zhxkCHj&r2W-j}~Y?E;i~4iDYXO(?b7Oj%rPQ{fN0YST>BbbG3MSV@7fB5GIe@|&8= zLhUb3&ZXZN)&YJ{aI>)6J7)zuGtSs96-5f?48_dAEWO&!aPtqn_tlLYMBB4G*-nm= zp7=nSv+s`-fb-ghWEGKH@b|0PWT8BF=3zjk>%y&{4C3&S?E%d|D`=Z`eXDv+haof2 z&e}VIu)U9?=I6Tl18BuvFFstwCb+fV>b!asJ*lwg_vyP*j@~Isi0t&E<^yN+p20dW zn8{BX+#SpXyM3vEiWH10c*ImW1oyFNXp?j7TMm@!QE_0-LyaJTe}j_$;71fRUblDrAi zE8hjnHxu`B`$`PIpB=I+R=RKg>R>+j$$^IC zE@y6NOSVp^nIduc{JH?^aPO_-@u1%PF6$8se^v>4Am<6Mze&%k=5SmsH_{^L0$2|I<+sf1E=;(sUnLK&GfYR@nW?VA`7F4)|4O?<6172z1yl_&D-Vg7JwP^x^(b@u?#BWtYy=)uhn-^+2m+qwxAu(}EWI}zB zFgqqy@#w$lP2IC;Px_~`#l>4giq9|Zg6&oh#zc?xyzDGis%Sa^>&UvF#CXekM8|+> zp7@*rf~Mtty1`@XCwbQj0#*bkM2?MO1^D>8+}0tEw1U+ z5R)V}2|#DS;lZt0w?ybbM9H_;z=`GH>m8A^g8dl~bWVS;Bz2;ak|uVuEa|hDD^dNx z-}3gb>HYHBQ!IDZ{`cm4q@r7AjYGfkbzBrj0OiqPhGte2D=yvYT|q6(+q)ZuKkxTT zUJqo6rPbAW`*Q_}=J%~tzJZg9?v!EQHMMidZl=N%4wUZ+6wZ();-k0aI1+CF%O<=l|7`LXyPC2)I{m-Q^r=Y@yBxu0@ftut+Yr%rRB17GG4hkk30hA^ zp6(mCDFvg&*DC*GN3~2K0&X#exv>-x3f85XxvWi>DEM)EHPosgRl;H%dT(p-vE}eTN!~&p| z{0FZ8AFcBIz7d+lgjTlA^273KB1j5sBY?XNP*9O_*X%h1ZpuYM`yM`pSJ(iiz0z?& zP~A#JHJ^^THfr%z8_s;}xbzMs&K_^Ic|KM}GrNL(&~sfiMr2$>rb+atd1X=d#ue4p z+<9xr2!X4=WWf5Xwr>neAPr$D0P4fNriS*P{+blX(D=RTA?$e8`aD&i=6}%j8ulxo zqwVFp$+-1<9Z>C+flf5ERAEr)j;$J)9&@YJ%?~X%t^@#XYlytL;P?Z5%b(1ePPH{( z@l$`7B7pXe1ejXpDe^S(HPQVA?wpPMxVuLO{NpxNeribTbX}mV$ZTb`Xw^*a@LgX9 z6|#@7e8WJ^-Pnk|X`pF4BiZWNu{vGUiKOg+arGa1dP0Y{VqVk3-I=lIXN^amE;b)R z*8jm61UK9-)iZmV_8{Z_S9&sN0RVHHG^4Jztl#!EL6sI6`n2k)@MAi)w3(p5v4)*H zr!}9@&WbWXBYqe(cVphw>b+A-2$XwAJ8wBwsb&XcQ-O5^nH&=~z3+=2?#iN!@P&$bmo)IxF}9BpvkW=I^3P1Pf=1cn^QwZ z{1q_>$J?NcYIIJzllF;Asksya$jteBZ~+;}Pcwj=>fCE4x3%m--+~^!z!9t5w&IX+ zMMwZ&+wUPRL}MI|zAABZv`rn*H!m<3cGUwXK=+0$zGZ=-+*%Kc!W)&1CGzK0lzBO` z+kw+J?ECvozk|0w0PDB;E9NXzPZ(B0fIBep`jw;{S79%7lpE;8bSNg;b%cO9el&nR z_Nzl6Bs+B#fKu75h7dv9N~$Uh{saZ`ZJOP2s#%L)y1Tfc%~#a^jg9xtw4sj2R-Kd- zpRDaNVim>U`sn%T_J)>d<8Yuj^#q+{tKm83g2(}!Me4b`p(T9euA1jzkK93{D@`~3 zdCV}7WkvPAT=rB2$Zkvw#m$` ziGK|2tmm$(FM8EQc~>U~kK_f=2Fohk545_46u-Xr>B*Q5AosQj_qp5K(*f5ehd?`L zSpwjgA#Vvf!c|7kZ|CB+;NP4IfnjetECuuujo^~B6LaA4{iq99 zcf?<{WN*v>0FxNCi}!){{pGBlXj%N;9#9BYR6NdbRRKjIIG|)o0G{ksW1QGOfsduO zltvx>-v#yCg8tM=3+tb-4d}U-zgJeC=J^T1d=oYrAWvXvhOn}?%SV$F3Ec~0V5r`! zrQPFW96|ggOJN;gO-rKvC(y&8LK z{Y5}^b_YX$$?nz`fSENdLReMXLEk7T;(>nWlL8?h8_x<%4m__dTl9Y}sovZh*zkp| zE>CA76BQpEsCRR)sI19;1s%Wh;pO@RKfu=_EDR?>vBLcy-ie$s1>tO7j zd|$sRkF2I(1)38C3exD7q6D zVXS){NqAB&{?|SNR|Dq6?W{-5UUoYicG{|{kO0(U;tINj8WQENqCh!po9vxj2zoLnq;Lah zXm;PPyd75H6`S^=)GBe%VJS?BAC!IUG!^X&T&=NwDkmSkqh&+b{Su}3yMiyH-fryP zPvw!TQ+t;yY9_K(;4&<^xBU)VnU6<3mPA*Q-_Z4QMl%dk`sYGvBV)zjmYp9c0Ahmt z;_7OhYesNm%m;;C1(Y?~-3*xS&LzMKXJv&}rDexUSlS~)*1D10aO7Gxa*a{AmQ%Qv z42lvn=l{>uMJQxJ)?1M4Ej$Wjqb{WVb9d0&=7Jz%AJCInb|{y(p6l45mFZNKDEv{w|!1kY~o0O$f`g+Y)diEDW4|MCZ3IK{(9OC&Px$$;6e z*rl&0UJSkyeBslDlla$g1$nw9blUX3Mx7QPFtOvSAA-9YBaQ;6I*8l(!A<}!|Mpm{ z@Yl_&CDmyu9hZE!^JrZ!o9gwkc+oX5+WKk7JbGi!U@<8UVzL;$N zJ$OwFyC8;Gfn!;4EaNqH#nTi96m8c` zj-t0PilP8a4LoQitAPA`%y9|q@@YB4b26g$rB_Fc4dTJ4n{c%l5-fT*0iFSKVTTgJ$&fLGISZ`5{V#f z2hPi5MU>4EVdh(r#gnI`5xmc-a?~27 zopTOHN^Gh}GA9=R)dwFm?BnU#wZ-4P+cWJ|>SXKut;Amrl0p+N^-@(WhYk>yV<|G; z|5#|3Ppajsz&kuAQ(apqxZ-FFw#!HB_3D^cf0PKE9|bbU{dTS&EAj(`kk~uLW|p+u zbHKO0XSl*s=HxJNN^ch+Y&0G0E4{vo>AudF|Bks~3EbQDXs5@#wLV@s`^XYASe8fb z;Rj5H>}SoA>F~Wov_diPiowfo-zUB!GXjE2 z6|Dnv7>SGc6Ni3UWHR@}w-~lnmjBM{%KC`xR_|GAU8!DoppeOu(B;)}_RJcW+o0O? zUAvP-ygJeGCN`h-GIZ~EOmGdEF`TBUTPVKgl34FTR;;B67WL#tvyA?4)dbx01x;0l z?h$`Pr$;$_b%_O?3@}EvtYA`BQ^~7hm^2#-1wP5@bhPGGcsC(EtNKQW)7zcbKh3T! z-yu8s!I5K}D@|oCAsOCex>KLq2Vaf`+b+WiHsqA#B4S7FSa+XgibE$~tmNV33L$d? z#Hp$v-YU0=>7!J`iw&jo1ZsF2A1rZVeK&q{sbeAO5E8E`ghxJ)E~LCmekn%x98bCK zkhQYVs`N8pHNoq^QMeVEpI~H_OaSH9|2K=BqGxosE=#9BAj0Z(}} z0=FQ}`G;bB2IqDGL5|UM5spBiP|Hpau2V2LZH|9-Q;PY!KHs6K z)PAe=m5M8erZTzW99KtivE2B#di;nOW@Q6AwZM&aLyEn;M>dhXrX@f3fk{B!iuJzV z?MQNQr+0t14@?|m^>RHLRhbzsQ^q)*4!TVs|7?i}#$=UVj>Ekz)C}Y&_bc0DUsL<= z&MY%llv^oFCZ+}7O1B6^>2Zx0U63T)a$3XEatIjv*K4AS6&AMp$2L+LTn2H09PVu` z#AKaIJn2OR&eaB|-BCDxf0-Gbyt{x~QKnsRn0)^*3GsK; zvD_9p6t)yzC5T6Gc~4Z__jNT-a@Pf7?^ekyKbVR59E#VM#B@1u!c z&alh!z;Xyb+ z-*;1h{b69GZ;sJql%0!q=k7O)HFd1L*Zy!O5Z$tI!T3+mV-4lrPSVz8Ny{?FZJPb2 z#o2M6U%}k_0i>(?Bzq$3IR1Ioqr%I_N^=7pma25O@%Qt$E1)c@(}xuZ!E8Iu=TFqj zGyHLyTbXM8$XtEimrh#pL|j?Wj#<=jl7TC7h55FR5Npf(=iXS*a>y&Gj==&cxsdi_ zoLiFX{tWN2rom$&c{5tmChs|?%vxei?MkJ>Wo7r5&SHvQSu^-UKCQ*pC!RHhY-8J} z70%YjNJT$b*{s5Q*-p1WC-F8(%BL;z-@?p!EE}M{EG@$Op}L~;znZ8gPiTVJl7y63 z4U`BD#AcGW*l_Do1m(2f3VY&KF25T;%xPAV4JH}mMURQM&O@^;BEP3j4a7b9@b0OI zENLx2A+N1z0-IEdFge;-sA($jZOcWr?FYu~w$3d#k`Cxh59t)$Pn}YDu*^zfMH6vn zsF)U<>ZOo(HWyJov2`Vrto$!uE(Z>WH%vv*5lBHpbTF@Ns%&H3;8@uCKR-5N)}J-i zt+o-%C~RKDDu=YNCxllG;VG4|90R^3(?zSx$yi4I$NE6e&pITHoC>F+sGWF)dvPz* zV#->*aS;#UxrT+SYC@>vq;KvwRJ=aqj2IQ#_AO+41?TFqZsJu47lPVpnvXniF*o9( zZ<{KssJw^>BGF2tRWd4-(D2C^nx!l5DEx6b{^ah}WV|?*9&5GMG}uHTH{OF=w_YCI z0L5%dJ5?nq_q1nJi01p?paq5Hx3gr9xNU(x_dZ~=L%bf_r=ywh2WT+F zWQz9%N0RDqRttL6;MS(KEaF9!(QBy`?&c!S8^s?|%z*oWY-tHd>Jq;Wr#2gMRZcY| z&)gVtp1uA#Fx#QCi{PH~4Y7h~Q2ZAx%$ldek9^fQw?#u{GO1X zQHbi90Au_|#%8>OQ&os_YETR0X=6)jaal=Ddb>YvR`f*OsjOS3O=YZ;5~`+ezq+J$ zx?5jZCR3Q??J^t_WgZ9@m6q?tflIGXW8e*2wphd@T73-P3VDqxihsp2^x zcU?(4ztT_rD|Dd-F9$_`&0F5I!8rzGZk>At3e z=`_PY;Q@CWKK9z$TF>^7silv7xGQYN=dn(oBkfhN9dNToc zWHAOn;V;qmrL30q>r{H~Ln$_$cvN$vZFEv|j@8eVGp6`uTVD8+g5PoM>KL5-=MFNa zrS4ugo>KwayEP>lUi+bt6m#v@?X8O!ce$cPaNVn>-I1&t#Ztjtnf8fS0gdhZL}30L z$P$ZRzm4cgh1}V(e67v{pHN%iK)V=)oZ6mk{EEGnx_iX@Wvt8F`MG<60h1qGE(y^o z)ycy#ky6L*svvVlXzz<&#Zo(TMTLgHwzAfLRAVSwDxC9*AtAZ9Eg)&+?Oh|mI7k>r zvr(qqMfTueY}ZQYAtY}o<5C2%Pz2Jq4f1$NbJ{m)zb7tTDv+V&>*-c(R{S|Ct+y|@ z0mkmCWMmZ|k-yWr^5Rh-eGz``H~Spb#vRE$bRU@*Z{>M;NIqn?^Bm-T;sB(b(9C|T zN3Jvx;t!`geOQnf7PYe8Be-`O`cR8Z&-ubOH$fU9)8wUWVXN$xozmJQQqsjWu_$Vz z_hiHQ3cbtDL-2Xl2th7`B?IxhNUD>dn~BI>t?CN8YCej9#xJ;~iCNk2;r8i1?E319 zb~z@);UqIiLv<`wOl&|=#|qo=w{IhfXIlIJ;}Ea@-xTWKAAh0}_Dv11`^;L+I}-$< zM2{Y_thKFh7`x<&dpMp|&(+O;F$^F7KE~FFCjW5OZCLh)VH54OpDkqB0sO<*yDASQ zG0Qp!yPNp&qi923cFw$88Z>uub{jD7!MH0aD-WXnG%H*Sm#!Q|$3#{lP&Wn|;mY4J zCgev?U1; z?r(l-UCD~NEmNvrscsZ!x#){Q-qKi;9*PaQm9)%NPbphz{~Z{jB#Tk`jtiMGxgam! z)Cg%Lf6;jqbXKeS%Tnv{)7Kki*d{x}lreql#K|qq?OP1i1!5^8@^{Bx_!p;(Rr4OK zeBdW8^;2-CxG8N&N2&1Jt({xORzA33Of**$9Q}?xzvP8Hj8&nDPHUCCJrsUyXliJI zCFgKM@}?8=2G{mAEpF%~&Tsj#EJj#UT0Kj0k{D7cC*BVCa5p24l==^@1J72&a!FlXY*p(oj zY)GaHz1y#hp;L$x-~;<1CbnjF@DN~kIe3QJt7J}2E!RL-y$_X#kp}zwr(7aufyQtS z;OV=q?-J*%y~EWDHGkB+nw!CS;N-vCQ@O0Z4Y%Nhp#TSCsyd51yQ(_tl3D_sc=QU) z0(vAU8)f_2cwDol*yjk_uS<74ap0F#z1aF^*ZN<@rbwzwPZ6ToNkQ6BO&^9yf zi*=!c5^z78Ik=Lh6HttX(QaEyZY|l+t;iBBjulfI?0S{ORx9oZ4a!znJQ5(b?5Y74 z6M>j*!(VqX1P4&6#~Se{*gnQ z_rv>7N*;(=*0NH5Tw1yQoEadyo8cslSSRA@5m$fmhp?q{q#lOkpObs5eA}HEF$~JCy%#7nY={yZDfx^j?gs61|JrM0@r7ALvZ|Y)9Tw6sNzH7qHZvT@T`x3%tZ{-}>Go^-;;hGQo}E+B^l_4!Eb)c^^TbWp#+0 zDJrdnxU@jBt+u{&=_f{#RkiL-b=EOsU;d#l!_jSU(T&_<7>Fa&(VYA*R1|i!%jF<1 zf7%bu-$-AYQd{7FTzq4t3IF?JV}txJy;>Mt;UemSdE5EuQ*0#fQ1Trt$jKwgvYg5< zc*!>NPqFxsv9(VSc#T8qjiq}wIx1aBx=5L>A$V~)qZIOZgdK>R-tcK5fD*P!97ucJ z914@%gMubM+BV_W?_g0VIkdmfc*0{bx~5?yO|}6HvE!E%x7)Pt>k4jSpB?OD2FD7E ztp)`-NDiHOviIXV=tkZ5seH>FheF- zw3nV@aJptED?=*AUWEI!mF~uk6M2D1gB!w`Pf^p`uo?NdCj!nY+Zlz2P>=m zM63v8eml~<%5Q;HZ;Wp;1@f*bWECPAk-&ya>@2SH8$i@rbTjKn#^RJhxHI4JkJgJ` zT=8H>*n`8z0vAc&_1tvbh;vP4UmVviUm~hg15*qL+S(z@MAo!gtfNV_OE~M1@o%p; zPhVltX9A&(NW_&V(@V>jVwK-&EM7Iq)XG3zB7fmM zd@;j`b%{CFw{U63eFkf(7VFZtFtbolnRdD}x3XHG$FjqNlKawx4b(;fH%tA9DZ{Vb zjujJNJ89Dc+Y4nn+*g5K-pEK_4KdJmre@EyixL9II_rmHlH$6)6XcJ1>hfQ@@Z?X` zO{!GtAh{L?+ZSH5z)ywM{F%=8&8RVwwP~inqbU=BK-kVNa2PMVwS5V-xK@}VT6FC`<@bd59_v2IIi){8Dh$c|F?;%5?!rw;&dQ+qLE$Qv&ob8#S@7Kz%2t1YS}YOVPUDt@ z7$%zROq@O*`R0J?2N-ANvt(1|qcA=Br(qp8Wv@wcKDFaC50~j(d7d!JPu9P8%pDrs z5d=RL@AX@bRBn;MLN7b@rWrt18tD(#=Z7YAi*XGH?7BVqoQ#1HuM|@jgSEd@^Xwhr zeiE5Hkg564*-QJzSqQ_@Dw>)&50~|@> zEpy7@U-9^)QIZ|kgPBI1>1GdSGEf$zy%WFR)+&D=W}_sUGPg^nt2V6KD0&1$8s~c;l zn^G&Oq}Cn0=sO5|=DQJhIA*MhkE(oibLMHJYz_48S=u>34J){oE~+%swz?g5(uM7> zjRjT=d1D(!=XiBTjqey>SDMNP6>ft^(gqKO!G-Eef~#Yo!F~2`klj-*!UJmMQo}Wm zSv~ME)Iuc!JsF>MpCxtV8ckAY?zTst*MsHoGM%;4ebFIb=2k{U+E!nn_klY4U2Re` zWY1D;dxuFz*^+9)wd;3H#+*XnhCXPAD~G>GJ)*6WhgR+;6{H})+B>BlzEtQwpP|B> z*kUTeo$sXIZGqei_JCY!o0VD!Z+)>+S4Hq#4PNe0@{B)lIb-~ldn_f@lXNBo^7}hY z1a>iuwz3~`rRJ+k3!QpI^8i66?(7xUuk0qcgz{dp)RMN~Rn3d1LhQ+`6N3EHP<4bx zW6PHh2*Rb*3e|>{5ZU1pWL#+*UVR$MnFC&k+>`6G}>L%0$Jbd<}Ni8KT0Ry{pD+Kq1Dv z6cJ|!zdd4thVT_Pu7#00%&ueSpzg71ypH2Ve91(z^(^M4JXS-nAFjfjZelxwvw#gB zT3EDr*6+YuE7*}r2&qQyzSWA`Xg zQ;Rv_?cY{ukG6iyb+m%z@m3<8#zZkv+R?rU?AUuH5P+y7LTYzV8hy<~qQd6LdJ9fh=mtZ0gihm912rcCR%EIyT6b2P44h>}U3wZl4d;X{{@6z9M>B2SJT#GTTz zT`h~^5obuQ)s7el0*>om`l)Ff60L;5lKWG4h^%88smmGWr1)a(-GD3t8A=VAl6LBZB1`EgF^oQsm|YR?0>nB<9ibC;TpFbr-UgC$2CCO z@-BWdv0VbH%UJon2u|^p z`YnAWMKF`9cjo22BV{#F?!e5iyXWgtua>GIv&KFM)lB@#*}xU}rGhoL3Fr-nQ^d_H zRUe5D%GiW|2Fx5oEYqWLbyyisZESk>Yr}nT4#;$qleFl-?~dhL{00}kdF*KSw9oZ$ z`dqKIW0@XJlyRG~+F$erzhe{M{aod8&AUCrT?pbaIkDg#AD|;{nkIDlb~lxlc-`e*dv_j9Tt`KdebxsO zXi|;jnU})~eA|#;nN&J~{r#s4>F4TEPH+Qd0J<+%vEHE=Ln4NJ{(^(umK+!;!=2QN z@1ls)fAH``H0{ybA*=d!`^*9u`oT^mvAw%D-#t?M)OT8V-fSx17$ydJL1n~D9QWTlHF7`w$ z+@*0R&yOg;d(AUnSK(r}FJM<3!7sw#gP*)H!~zeW!mCSi8{>IJ-#OX9)41I|tQf3% zzg%A2)Kqw@K_J>mcllPn3hNe&dU$l9X1bYp%syTFTdDd;=@^80oAqnW;mE$Wr-$;n z&*>@VCN6j9p${d`5Tj{BF_1W3G&JZ3m&N0f+zt;xJzTM9^wN&^3#JsuwF1fc{J9H_>FVwtG;EHyKO(SW3t#96=9!Fv_HKQ% zh4C}hEr$Ioc4-mhL&ijdX1LaH7m+Pj2%F2rK*grEO0LXJa5wtu6$JHu$qSOt854e3 zw#1$}Nv#mix)FZFiotI3!~^xw`X5a!_2H>GpLzD6%(3L3y0#sgEJnu{3|Cg(&3S4Z zCTyl?f03375Yy{8XEAYV`)-kGg6_Ps&fS>#y-)O;o5tu@Up<`^czN;Zvys6Fw;gT* zzmeBnH8wrd;I00%wdtQ%TLkBY>s_Xr-loeaMrB>Lc)eL5v0jMDSXdkF(RK~W2q7dG zXK`g&Hpl%xy%}UA9puYPnBs%hD{YR=Uoy-)a9laC@)Oi5=ayiPeao*OvfogZv*+<& zRus1CB;(LusznmyUFAIWi>7* zPB!|owD>WH)AiK{-Pg`)6rf}BStkB@o=3(TN5}5oVySzou)pD{Yp3`nu+u!N!~J5? z<<%QbpwVte@g2=`en6Rm3}%WH(n8*hZWuvQLd}IMxj!K525=q)!KH*g_xIb3-W>57 z8W8_xVW?4XA{i+tHY9Yx;lJg=34LTz(ctWfx!z~`a!?&fn@+Jnunr*iJ7?E92SMos zxjwt&Uf~Q>w#4AVsVmr(pDO+5NHYzQJ|i+p!7{F4;p^Zc!)_ZNz!4(c8!PZ&H=yS{Jqe$9Tp;ObDt zeab_o-|P6ite<}3KOSg$%F#(;&$ZpD`z*RIa!t!G?Bx3ziTP%5KnEzr8k?rIx3*EY zTRaO9_~D9~(Cm1nnZEUjAz~HrGzp{q#UBx}_lrsS@>y(( zL~!M22|8(gQo~j&YW7qCyDUD1`>Q_VMW8Yk|lN7r- zr$Qu@Bjuty3Vt@?_s*e2hHN$YrRgdJWAx7Rr%HKic&vwC8B~ngmk2LqA67R&BS;*e zjmU@2jdJ!Gu!m6rEP+MtwDh>`tpJT;cBHe#lAp%l3m101Kl%k4GW;giPkv|h;EDF? z?_I;l9g0$o0Zb1Qz4~7zp&t!?`P~(tKAy6rLoQ1e=RZ=M;W-LW7JjhB5SMprs(e#^8v#0RP+(v$qTtQ*Y}O|XfdKo z(LRIX%V(As0+%bM=*P{@i7LL=+1vWm&?)@azR|UZTJ8GFb1yDbSd4^mud>tvw!Qg9 zdf2{eOWJ{5r^|m;4-I6Q-U_R^8a01-P%DD(MBiv@&}OZLrOxG~^eI3`N3jf>Ly4M8%+ucejNI*gOH)bs&grud@ZIAHXO?hjDfIE&>?#s|_6p)cbw~8UMrKCGgWT~<1M+}IukzDXXMFeFCw@*A^MyWuS-RF@Dvto1#BiQt`6glPG_u;kAZ|n*UKFzFbSEdawq0Yp--fb7- z{X^ynI${%V(82}kUZcO76%PA_k6z=GfJz&x*;S{J*Jt$h3@AP8w!$}EtjN#ih)s<= zAhYCVO4YC79~#h>k@%f~zTyU-ySgQk-1G94O83(X7l?+r zC-4JHoacCj)=+4;dbOm-=}e8}B_Zku%2WS>6UbWZ*-RRojK;ePJ4jd0EnHqFP2vJn zT`OMwn`!-xfd3_4*cF}|j;Apu6okF2BdB{0`ZdIQUU)F7vX=L@#yC5V7ZlR>%SKJY zs)y>W?^jd~ohsMqh@MT`_E98iF2y6in?Q1MC%Q(%EBy05zgzQBfni0xe03cU4}iaA zCO-583gdAAZUK80diB=ZI83Oc?KIxnV;c?7Tg7 zp1`guu&TX^h>QDQ#>MBK1!Y%%h3BN$5I+?-8?0pPyOx=`>fCJ+_*<9e47Y$ib6VW% zv0Ew@KDfWN#h@7*u;g5~^X3clxx?YJA9Es4x9F*P43^kgLFs%GVd-wqDfl%CD}@0x~4t35OnJ`j_I(=Bs2PjPEW8A z@sPg7z80hfm$Dd?oQi=2+AO!NbonO|)8k=B4f<`XYO-QWdyDU5w${ZVxKkm@2| z^7)IK$I6Ca^pwGEQcRybzw>D?+Ev;~TY3ES1zj>v!v5b3{b0jJqW=GvPiV#pse#AL zq#zvdyYt`q*7IsT&E2+E_pi1vuFPLAKjmt${ZLizWvrTy{Ys6|Z60s`+L@8As6~%k z<)^?nchJ4HIYL^juOMPi1nEF8rCeig%wlqSre-X7%mZIaTihQ$e$4x+ z64LcsCup4pqi)}f+Uv7hntxp;s2Yx9o#hv!OB08G&296OEEGd=;Diy9zJKH!N68B{ z@AS_FXf(4w(heEJ5Pk+BhkN1ZgIa9@mx%0r`u9!P^G~t6?`8%UviuzPN>6q)3M}f# z3%uFA)s)}O;=&!_U%$2+NE^BsT@oJK5t}B76&r2awLN#sYVCy+O>za-`&6cJyk71 z)J|j^ZCVZzJeomNftyhhRjix>@-Cb3j?qr?jd7_a> z3WbcGoByYq*ZZSP;N6)L9Hdd$ox-^Db4c<;^P~uI?_mIcLP$@^ps;OkDlrn5gx2lvjbEQP9zF77o;c46;uofmeothhzYgkNC$OmI zS1W#gw9?q6Mw<6l@q-K0q-+}ZHF$3$fo~=kdF+_({k{H$p8G<;EC1vc#S!5!X z_u6}4nVTC|XQfjet)HG!n$`c1uywB2IHKitRCt?Bsc+la^CC^UGkc_mT=SwF`Jpe0 zyT-)|!ZoFd-u*wi-aH!W{`~{4lqGvAJ4w+dLPiEt2vM}$t+w2@@(TR(3gnwE73{rn38CJq`A7HU- zY#^5FGIc=21Im|FzN^&^0fx~K`k(3nCCUZtX{m#a70fP~Hvf+F1WJ}TG zImlr?mWZCuM0whu0t5&KPw~bH7PtK;CO-uyAC{x?qLWv|$NH(cq*}p9gr$e7r#rK= zLVA=#rLn2hoy78knbOd;LdQ{S)mSvg3z{hX%|UUr-AH1C5r2I-tAS64Uw5qc&KO>Z z#+b%#ti9mpqRxAIo9?!s@(|D%H0VS>70sfmd;{i}8KJT+Tae(D z#bJ?90A>jLJkliWzH0%$T(Io}v5xVQ9sGjlUwoxU-&IP!ipcfsN!WmeR5NRKZA0(9 zVvHy6k}B0Kd1l+)#QHvzUdp-tUgbq-KQR%{ z)VdSU$U-8UEtKqyXjzL4ukl8|he-NED5W+*Z`D=L2m`J~MZAJ2R!phL*w^K~fLFFk zj8)bLqTnHsaWUnx4qI!bVfcmGTzsYv8(2^BQIgnPSij<8)a7nZlGXh(lJy09m?hExw~fT|5%Nv9G=N5xUg&Eb0 z#Xzs7jww@Jm@vp?GlePmePLOeWh8=GhjsPOg9C+YV>X**L-G8ET>+1j=SJn?;}$r8 zJZ9G%LJ8X*3ZqE-H|tT3?Sg9u^4_K|+i59$)l!%cN`C~ZA?bfn`vRH{$MZ|U-bNoZ z>u4TkRVH6@35ZO~9wT@8^elzHzTB-OQ=2nwu%9m#O^1utWbLa84Xcl$n;MAYZl4Uh zcMkUpefsbZe>zQ}G4TvpO8Ij?+%Ga=Z4^YUzS)}4}TXzFnSENGPECI;FSgR zC0VAghtjftRolg&pUK#Q>3{Tuy|lw;E+_<6m3}_Me~uUNQ;_l<;F0D!Yr}%na#x$1 zXo_^S|5z`z8`uQMgpc4WLq^XamqQ;6cwfHv$qo<|Y!b!`tS1Jr9$lk0^Vl0O#o&N9 zNG%ZqLR5$LHGW07ITL27sB4qvVhrO5Ie_P$h!+G|jnZ9Uyozv*nwSZU^sjAU%%HdY zVf-5Q*a-8nBg;#=Ha4f=R!vpKl@=umpyJn@S%x z+9xC@sS0zM=k{uM$Q{&`ZID>8xw97=L@!D!ZozNn`v+z^l|Fl>6s7(c_@OnS5rYR# zS9%&XG&Ahtn|}Cz$Z1CgH{ncjb^(QmCaVsaD}KDIf%Tc%of$GpTPRXARz2t&CRO3qBK#(?Rg^I#S%A} zyPY&N;$`X2q0=|AXqqb=4fj}+U+WFqqYWOgO8AJAHqE2CC!VdpF(n2p9bZ5>bU9~- z3=%-w6O%aqs#k@l@QJdn_U=#`-6SIgCGgN0#Ks6i~6MBfeMmb=aamK?hOFv{}8RUSL9)?@V zY_?ezZpOsCc%tk5ZeZo;hrjq`5rSZgW@Cv{VI}*h&BjBc+koc8xoqAKAcn8x=u0+@$Xny*!R9D9!V1CCcrc zkMg3R@@!*AwKHcMSwhF}v)))^A9^|eq7X2PtfG~N4ik{s9eK2of)y%7s-mQ z`a{=I-fyM56-xC^w51W#x*Ofnq_bc@&Mh@PRUOO+KB@m>rTh;c5oOt}TPCC9+0QtJ z@>TC`Ci!16mIx!4O#Ne50wqY>v#?UAPGuLTqMG_W9?Sxyy35J4D(hOVSDsGAUk=e%QLLOrZ*UU-<^UG|Zt zMV%6v()q!7#Tvew6w%!K0q^-JChI(|3Y_%lkBGT9oXMRMk(h)|L}tt@>mcQ|UQ=Ak z8(R4+38ppv551V3r=uJnjQx_Eco!sp&;T34y7E_8U2e#zE)qQ=Y7nY{Vj0&@le!o? zI{nh?o1;n@-f39UYIy@d)55OvZa9hws0)743K@g>?nkA@n6N&?0my*#^T`eWeCAj5 z#H)i+XF^DtK0-9mkCQ`i_QPMaK>x7)I;7X+B0JrHnbJsShWkAY+g>{ypM&))EtEii zS@t-R=dwtc>gCL5S&`xe=dK0G=Ll}%v=4M1KEO_0JpOu4J8})q_G%B#sUN1&&7-Xw z+8s*cFt|HXAd+rR>MW?&FW+BB$U1sZ2WfLTxKSbTcxHPy`T5YR-g~D;9%ZN?_#O9; zs8ljFKS~M<_|7$rfiUaq#2Vqkh<~PS03Dk$o!ebMi*m<5IwF+nJfGrPE!F?XOFS*L?;4TygzZzt>&x>}_1&RC!tI-p5IHiSP5;X O-XB=3$QkW_vnQWq zXrNBA+h4vH{4A4YuK?r^a;uS$TXK)S8)yzG+Xvr`acvKW>}9+cKngz_bty72i!$@> znTKB%y=V|BXHft@U(%KaTS-set<{w`{ORFCjQ>k9Im`DZ`f6{Mif4*S5tR%Sz7atV zH;$+{MzUx5*{+w0e(ar8INX}^A=;=)lvWsJ^jU=XJU9K%cKCNGC z9qgNEksH!s)M#*h~bNySni3Wh9TStu93^HFnO$DqZ{w^Ky%n{xqwMBi}c{t;t+Vn>#N%r)|c zPaNusuOWyX!**}C5DDkRD;JFQ!ym|$biK?vM9ZMemB-9M< zYZHO2rtY1(bTP~VhIY13*atr_sonkN_1mbyOD8^Vt$nidgj73xIOfu5;QOrEtZBLj zy6?XC>w~)`co42Gr8nJw90X~dvajgdyZ^=Ulip^I_XmWLm#b_OZ#on_&#CeEu{v=s z+V2obko0%{-rfpC^W%Kmf@g6nBeU6u_;O|vpENoRSPrIj$qpXMVV8M)}JK~a+u!F|0k$67(V!~1aFUC-Qp0xa!yaLxd`#N zo$I#;@etx;s)S|5-~}Xfy|OSP*CUCzYON;&wki0lc;Woyk~BdQ6f7^#cw*GdaDSXG8>Trtm6 zyGBXZ8x_@OgNYmQ#C|NUGI><1N5vfz7Fk}O-|8eyglTy`7H0=)f6-QXrODsT*k?br zZ5jCnX2{Bv#!pO8(9=Gv*_P*Ee93&O)op^k;UbhcxnkD}9g@OimptlxJp6c+>CGd>_wVn< zD4Vqj3~bF-fcJgqt#j1jBC5{V9&Fych-Q=#iXL>oMVu+_{*ukLZ&-+DiF1#zqidd0 z1S+YZ4|8#>zH-1%V{|&3AH+rI4qMqycg8#K z7lW?i^@e;h7u)3OYJl=N_3l|ne@AgocgWUKtKs*6Zj)aDATubALEs=8wkd0=4O_<% zVVSyd0#rRjEV*8PHF?R}+vX#&KMOOm0xxj0zi8)G3NGmAIs2!y(%HM3J|VBk=?-(1 z-N^9RijK?6Uc73|uqVw=q{xImfj*+Gh4{P@EP+>(unYjHBiY#i=Ca6j`X#W4if9A< zDz2xyfP|GDqrB=p2Jbi0<3d_nEcX7OvNW0}Oc$W02&C};JTZn-ZUiU*v z!#6R5m)UZj+^gDr7#vKvW7;oacI`$=-vi0eH}t6M_LM8MA_c zdBtfi!i3rm)+O`FBZjr}?IlR}IY~au93f zO7>WiA$iwIXS;4*P;C0~pnE?uMfC!UXT0|SdwFjKA=4aevjc5a`j0MfiIcE@7w?|6 z`k{RAnBfH}`GwnC`*p0OR-S^3Z~y$$N0ojX#2kCM{}gVZ)rxV#GS@lA>-Tz!syl;I zHnP{uT>ATSTFod(3{Z_Nhai_!Qx*hWMa{6)ws1FXaz=*k(^ER6iLK^jI#vGe90QLb6r#RD}4X z8v-sMpcqt#ZO#{T06WneX0)V^L~c2`+ttJcpbPP>>*>TToFJuRN5Ep89MN&HY|XrD~(w4wH-`dF8zes(|K+U&uX!jz9% zh0ti33eWR8l2r1``X$M`qotpB$E;%2uVwYm2kftGP}hH|d$`Kncg|4)YA3I7uTs3p z!X9|LVl}?ethS6C7EY_$o`si+eiY1}q?Cd9Vh6f23qt7w1+lG=shS23Mu-mmmZf)zwbPKE`IPx zr{v1P-V-a9a+a;=oQVG~G~VgIzflxtYAd_-?pUFI&zbe~jZl^K?4>X3Px9+jB7-IR z0%HR`2cI*35$5$74B4#3(*wxWEMX&ojh$8E0|Nam^^05<-XPY(4ONhAu1S;oTe(AG zwu@?It%s6p8*=ReDh$K!k9A|CmqJt)?z)8#dpB-p{)>HK0x2d*R{fQ`qb@GMs#-t# zya2~OxF1jjUbitRe!-`wXu&Qyfkl zq7pq_5bEYq@>p?*{mxeZ&|Hj@3v*WKOjQN1LN?V4~ zd=pET^j}$?{Hg}I?e+Q@vshQM7{>uFUT#4ZSmUL~#8rC0XP6*|D$# z_r#l`mTdVrUl1j8rVc+ejY1-=+#J8GiiB?nRh2|OoOnBXB-MHA&5`;8`k9BVRo9xm zKFW-ogqfDv-6TeYD-};4KgsvhS>8d4wkYj8>1SO+`DPWn04kLSIM|90cjDVI@_qXeJ=#yYwvCa85MFU~p%(P@ZNg!U8P z56p-C_7UvMT;nrfAR(xP3%$_;h?W_QDz~b_=-iY+psRp}UjS1Bv1L zPu(rY283k3SK_nHGagn4Fuj&lWb~0PlO(b!cYVcJ_ZS2y+ z@nBF13m)0_;D8|ah-cFa;(XS8y^(D}Ddb9y!&eRd_c%v>h0NqVHhlE=+P6cGcsb_= zTnk|?VI?g8cK&*leUPX4G}q!srG>HyK0{+EJtqWlx-HY(MJW+lCy8DtN(>AKA%2^!I$@D6uWKUvR{B zy6bJC5<7cfM<)&1Kb~w@7n4O?wV}F%JA;aR z?!$~;(C74~^r#LnMRWm&&1|4$LXG`}WwTknT&#uO6N(;jZVH01%9Z-Xbng(n09hrh zU#x_hMv|k*DG~a$6wzd{yUUMCam0Rr)aZ$aJ(#3S-FuV(tBeR#?YlZb`d8I}xJYAU z>Rc+8M){@$MD<-qc%Et%^Ut=P?2E#Tq^eag)kQa5uTYwP5$M2nE2cY;nL&Mj~OLh@aF?fE#jlYNU9`TG0! z=cf(Z=Ki%5_W4*)`Q0DtL_yt?zp18)%+;-i4lz#Zk>7u9;ZXj$n(LgxY0mEFwkhQB z5?9JB*FJPPDyFW$khZr~m`5FD<@i@?$fAr=*5){Ng!R$V3Ka6d!Vbb-C#~&ZqVYC4 zW5!N{EIs)s7#`CX0VZ-PV@{s3#trkGz$6*(E=Dd89v%Lhuc!5thD6 z+y#}MNC5_qe8vhiM={7-MWM>KKBykl|ME||r zkQUV`%x5L;eQn!KjY>OTjf_@nrXf$Xh7jpggIgH~J&Cy|=DSrmGqh0zdF)8Q&HCIp z5rN*WxX7y?h`g!Nq$%2`80HD+*xm83FLTagq1N#u%j#pP=i)VI&bs$8&9?KhNOypCQU=I>(quQT0+aeLH={LUEtH2;)A-H|I> z=X*{q-8?TRr{Oi{7C+?K%PDgb;}Bi2EgY8L(SJ^N2L|1e{6D6DgT)qPwX^CyQ@S^y zwKu!O@_lxG&BR>qN={-p`{nAr0Qr&UpW;iz+#~~nzOMtc#?zQ#41?J&(XMslFk^jV zzt}(+m&;=m)Ua_a4~y#NmebN-4HIOq>HifR{gEqDnFYKIl^`6U`7{B)_C_?s=L%rI z!3Mo+gc#nWm9Gi0cP$hD%Y|%5)JW=T->3yA{8*E?$-D6-E=5k+NIXNL8txF*!4%7v zi{Fo9P=-gFTz}F+nSlI03kQ(S?^r<$@1$J87XgbZRqvNI`IUFU$=(X~e8S9R-LYY` z9<*UBwNBGMP>j z+=ST$3(GBS`uDK-EWzJW0%vc*mfR7xs@K6kQUgcQc9NsFQ*aaYzj4lQ4X-qir*pX4 zDd?=$H83X-Y6_YQcK@l^xxBf)-sSiH5@@e7)Gx1!eT`Y}Q@gb&M-e?0dZIz{*JyvK ze~|$WNcS`x=yP4}uwy@IJO>d~XU{@77nnCB(Ka*`aKsGRpti+l)cMZ2EX;6vIe=WO zz90`0uM)FT@?P%$ZB+r;MGqI83vtXouhkNiCH62P4TL&W)p>&I%GAM1`YED;zPF)$ z?xp`x_rw-Gig9kH)Hm0^R^lo-B2w*Nn=fAo;0@#vmIwY*cL`OV(yJ4ZMKK5j7HZpN zcy|K{W!vz2MS$Z*n_CS{U0!&b4b_hh87W?r9#x91x`hr_mnaC^mW6;aVu0O^3FX1Z zgMkNp45_nVLb7z&`i>j#v^u3ncxD=s zIK++6px00PalLaWK46i81C4VBX{flc>xTGxn^3x?enByNrg0SURT*4Xha>iQ%Yi`? zTPv=xLtBs{`#<@M-yg>ROBv=2g>!1Rb1qXWw=H?`2@{#~Z9(~yu)I3A_;yq7wJc+l z)Pz=*bk^c`Xq^W0A>zs6k3KB^I~Mp1y8BOTKI%Y#hqt9nR|*wCHg?Qt=BJb;cfmSO zx_HC-zQKzT&tvC@Zq$S-K6WA#*Fr-5^6|jv1+`bMR}0NnmmVI1PtOH;**N7ZPy6xN zxCzS&kNhz)fiENE-ukiQfi){i+SxM1%sv4qgK%*G!D(a4UgiyCwONKvMl)IjDfV8o ziP^)_nM-6#_X=6thR_gkg{hd$P$~b>PsG~tZD11#a?E&Xk%pCIP5^tOZ)bALhptad z7QnZMd8-GS@prtT@Me|Bl=jgO9b54P!Ynmu5G)WVs?k)rv=%`AGNX2{In?W zyKI8%G?vQAmf3!2Z=ddE_#yI%^$qOMG<@VJrR2R;R$?0Kd>kk{gV+nI_BO4&nz&zn zO5B6~V2+&kxX`TBEAx`=&@u((J&e(({Yv)f%@txeV-Ne83 zc_$km<~e(At9w&=Cd?Cxh|7~&@+i6Cs zNDzmc^UtREE2Cpx0eA}Bm|?SYPY*;2g4c<&K60$y!k{HUQXK^lZ*iL74&038LWst~F+h6VUhHS2m7`dPe+ zP~zqwvTpZSc6x7!T8YnzKu^`CR$VDuUBll zydCZF*&1KZlQMG-ek}BV^ECaCM8xEt>9bYv+ec*EkK2bTYu=^gE64n#Ih;&78q=Qi zg5J3<&{Qu<%Q*2`Xku6Pr38iqM)IyjW!u&x$HO?^OE)TRF)nZBoSD*GNObKmYcxD= z+XTOdPOkXy#aa2Kfmz|4OG=Wqso|)JZlh*ll8JJF{IeaY9{4x@m-^jF8bHV~eLF~a zM{%H7c5ul1*fegxLDfU^5eaFAUrDk-X9mTa8slM)^N_Pa8qBAq1}*TkfKy~q<)Lfx zNYCz;Y+gyIFqv^UsDAfs568Qq1Z=H$VCJK_yQ}DNA3tZgr_vmJZ_L;FVPuuNyUF^x zJzl|A*Cz8V+3$PZV8m(ge~z#AnMwg2k74~=nQNaslVikk0MBpYtrpk%%j?&$!*O2M z4oegBU0MwxwXH$s0KQG{#fP%J?BIayvf__c0q&OCvfSgB^asH!)H088@c<+=9gq%J zp~j4w4Ll*WEg)r5j`_u!72l6F&tTw_^T7nTT&BA1{@tI=PU}r5yar!ff0@`0M!XQX z640gm$@yi}7lch6lA<}I&SMsS>72-#8ZN6l#3}azqVVRKVZ~>g%~$As9Y;?eu6V=a z`+W80v&Q+cQk%ch4r|W)a3mD!jG`L{V*kzV|+G9ia8l8CZbNtBX^@{+%MD78|CFe`YI(tRoBDr(OR~OBVSExo^tz~af5ZCG(W-NdCS0aL2-$nvQ4!g)JvSR zJjS^_lZVS$AV!#Z!Y2d|JCWm>b&UR1?^6z z9kiuzt#hvd`Pt9XfEaLYA(!O+?jX+pF^wkx zuQ1(_YIQ7}zC{nCPPF|LV)|_C;^6|{yXq((j``Ru_O+V2#IV8-_wcK?!=^=6zCV0+ zR(iBq8=+(B=BRi^LU(2Z|K@J}<-lO!CN(~X{PKqIgYVqiC}LfXkfi7e3Bv+$Qo^C* zx*uOUB@jl>M)o>tm3-;^@?&>K-?B^S7yn)23jzhhfg!&X4+={*K&Yj9;}!Lkt7u6< zFJ)`n7)hapk!Kap45w5~rq6T^7%2?3@(?aa4&@DYiPqnQHwW!h!xj!a_*vr4b^G1x z!WypthXmo;G17UzaqJ{H8r#3t$(F+NVdA7Y()stds#DtBLIh(F?P?ec!YIr-@7D-_ zrg*CCLLCoSCP3R7Gu!JIAMuqCNAUbhSk|_K7)yCou+h5n5~c>RjXFJ+xcy2MJN`V) zO=1w9`#i^0)TUCNkmGhX#{Yuv7BJ7%eEu^yu>Mi-50@@#X#glH?%yhDIdPUK771iC=dc%wNPUVgnh8U)Vkfe@=@M8u}5?a{VWhwdM$= z#9sYznF8nZUceOFM2s#&LN~RtGGo(vi1BqyophI*OmL&nLaY^P+Mq^>IBK8!I!L%1_o^Jifu?Ed$D#+2HtfpMJl! z@>&8}m9wl0&8?jDhU<*@yqBRqg3;BMvZ7rQm#p=q^6fYh4(@V`qp*HTtumU- z{@(U+VCnS|dosw7;bdvdNa?aC*@(|`!=%5KqTILp@r$8?Ge17_YD&nsp)7TMBsPlN z4*dgZFlaBRq%zcB3*)S)JJ2TGc3|u03?gic6ctCYR@EJ`vf{-@s%yJSO`DfO&4?b4 z`!gx^vY;9;>Tdn8gmKnLkyaaJ-WXP3E-_~HfLDwnD@XP2gTYF{x?`d@31Wr;Uy=L} zeroHJPfZAUe7s=X}4hc`f?FE?-b{J!l&?=?rVW+z^K-c{j=cu2)pJ&Ww4(#mI7a6YHf#r`F){4) zxs~YV-N)2Q_)05eG4PE>3U2-8Ur)C@B2_UeXVx6{v7zq;GX^~iaF>*OW)X1J7rRwA z@h%u+UlM~`mA4LHg~2(YKm4GI6As@I7->>`FmCs>;oHC8M#n~+=208G%F~)@QA?Y9 z6>9KRtw=#fx8fsKhJ$6Nb>%*nnAz*gx9`fleS+7b$4qt70&!33`N3s1XkeU?H0Yg! zEpsvM;W-n~$HalHo}t%6CK4AX!;&1JJ5~E%vQi%XTczj7{X1^J8KFbwy}7L+80JmT zAXo1Lm(35~(NPH@Cd3{~{AB$Azq4r4{blP&5FGBTh~{_;`?I^W!Ja!9as;YTAzY_2 z)a$YN^=tVzLmX5GI}m2NMTIqV&>Epp%4ieZx9+cNu`)UY!9`K~N+e0=N~jL74vD7r z8hnQ3l0_c&%P6w6dGwzHQ6B)8HkhMkog+|{c%k+)yeH+A{kP$Q zP^NMAHQw4+tim%?f4io2{hkC2!HP9C5nnZ+q)bV44kpW+?Pt7HcJc6L#|Yalp%c3$ zzXTbj`}KKRnKX)_Hep@n9zk&PlJrq0>$lt|?#AZ#Cyu`Dace|2mcQ>f(B!$#ZEE(3 zo-9R@ujWv^M#ifrKjf#kLQoJsB6$|;VBu*ri~YFBUJbt6b;!@>!A96IQX^_tfJH#C zv5(b2C0D2cJLcpUqkS6hZj+x5u{a(`M;;nOpD5 zw@cXzrGq&vY0OW0r#(pW(j7Er$9XL&S}Gkv2O}?~lZi z4Ox8A&AW;!Gm@fgeN;xi2ld75iCWtJaYXgslnOKFrQc7%#q!8e1$j297#;!bt9S~hu$J=W;De?ni%Za}_I zW81~{&RH?Dr`1xhePaa4lFMKMr!zj;jO#i$o}`}6Wqa#J=#Yhl;ugB*%VnGOWpFi+FL%@{iz4%;Gq&UuU`Xc3HsgepvG}=Vm6a-4+`D zC1ktm98e02*l=>O+Y<7BENu)VsA34k6BBpAb@to9+YTM;)!&mWvvlWC=y<3`&FIG! zE79RMzTx2J`j|N8xt{vPLb4n_51$!279raOQOhy;) zuE(%ff0F;1+PFyfY|7mgf9(h`?OG8Ry-cvc7M#G04n>5Pd~`Of$-ZL)2=xZ-aO1JI zs)K74^!aph6!qzYFUvcXVXUW%K#Aeu(`TS8wba|LJf-;w&uOKHp!r*-I)B9t%xM{Y&_0+;~3pL?r{h--CCq0eyfX-sIY;UnqS zfw@HUJCTdHkYl{FT0%*Wim&#bovS{)dS5w2qYKTf^txY5Lz{eEf)hR=|o*cT{$$r0Nu+G;)y+CC4cEcns*WJJ8ndc#z(!ciynnUdE zN^fi`tRE4eX+;CG1q6ScLn9qMtgC6Zz#GK!RY7!5X5yz^0o9z2hAs2adn_cx`^|uh zSl9Z|SWLr?IUQ;VZ%D*j_8#rFMAm`OVe8uz_UbKEdU-t}o$3jt$w|41X-0Qe#3Z-Y zQ+Ehd*X4+yr*>o>ZNXaOT_k)+?_Grg98-|K(cs}Ro2WwXJ^|zzz&4w;j zcl0A4G`tdky%F?%QO9L-oyUiN-)@)qiVq@lq*j@5Lacc2JkD2Pq!@KNj(or(r<*F* z@OPKzU!d+5HCrjm?1+4nvRc0o$#G0#Xe+BVX-K&Juut!-Y>0+lpU} zVB7x$=UJ;5LaNipPX3&y`O5IDa>;r3z$t->ePpJ zBs~49&X3>|(F#Cx7fUwDG!AfrGTfj41C&HC=(1y_YimVKFJP>jNyz;8Qq2r%4V(*o zgSX&L4Cp(D#@TK_@2ET2?I~r*JkQ?XTNGnhDdHNkxkiB&g4460zybF~8Q`eLGP(%T zSE*h|5%sNOG_R51J`0Zjvl+k~@))JJUYUGWaxzxjpi4N5DxZI=Q=oF0aOX?qM_?8v zbkz&7^=?4{dTo2U3S+UXG3z*%8Y?|}sqv%ls$JIEF71#i#F<8in)ll$i+drPd#P7% zRZf(BQ`2wq$l>W$SkSiB4Mk_C+G9V}>uUv@Y*$wIyS^Rljm2`=e#Sqh4&9fHO(rkj z-tVe16_nYfo05Z9D83aG+D(S1<++3nMjs+JhNOw%6!TRyp}L@rcQ4NOU)lP-U%+l6 zsec9ie-7^WZ$)0~$IiVijphLEa_qxTdH~~b>1}^AROg8BdkT&_a#JyOfqL&i?nE#3 zx+-uCb7vV}JaDbFM<8KIS~R1l+mGihuw}j^^!yZ$e6ZK3Z*T~~bQT$Xwyb*JYzE+q z%{^{^toN68O5lZ{f@_0RzSZUZ3jg#!dgxcYL+ql^{3Ey8wvW2*##W&^3L~J8p)hm- zDfHMbAXfk(8nJvvjga~zzI)!PiPFQ{RfQas9Fyo0(?w8~%%2|QI+uuOl z*##aDNavWY($3q*WjQ~%NJ!;a9D#wC`^DvB7WYSggtVJi;T)#PDmPRwxX zJxlU+c=s^4)-Lv>OWB*FpYv~oB8)C-TRmG*nH$A@+vEL1c5d&O^J<-Fmmud;W%S=s zvy}*qIY^JR&yQ6ei~Bd;xV*qv^(6O8+^zJk$4fLw*rgK@#=>G*%@)#kPCR9&Ddw#; z`?!4QG1c~;erREm9WOQ)d;U${)m;JBDeI74_0;BfJSu4jR>pEr( z0P_Lp$vxMJ$z1cIM%iEkliIS9H(mx-$+YW!*PEP(-Y4Ft#>fr+W5evF?OTnLl^*3+ zWlrk{+9(xh^U!L=+cB zT$ZC6HhAAn&fa4?chKv;mWA*N>p-}eF2VerxT|$ZJ;yQQ0lT9YOxRbsj~FJY@a?^I zL*D7sS%2>XIwKUh4TU*xb`ym=)Xh^KwFjYlSgQ4AZ0m`Jp;yiP=ujmG^}2L-m(iJ3 zNJNF)-npFACEcm=Lp1Uui&P`h{cJr>5%dFBfbA2V5GF@fB*59N=Z8P3fZKPwkohUBQnu8M1a(^))-?SYs(n4&45nqiFdL zOzQlj=!#|jzR&Q-6Oa_-k&%>i;nXv2&6ykOsgiWje>I3~y2P{G15|BQ ze*b!*rq)?7qDi9R>WB+Wd82Je4draD``1r=N2=-?Fdh{_7cKq40}otNN4Dl+C`n>1MuI{hILEKdh?&*=2oWH;wT6gWoyt1*O)Qy-(=|MFSpesV5d>b3YN^z6`LXBM7>?4-*M zEya}+2dKvWb%h~IaaEA*sV~qX#mFt720$?(TvTcA(s5-w`$vfW@@5DsJf^BwarD04IG2@h+cAKKNt zDxcCqS!Xrezi^7!YSI2Qc`)Ode=kRnbn#Q2rns>$J}#4WWMnLWK##B9bvc8SFyBO4 z_Dc@1zqbD^mOFK6A@*en@&^Y~vJ7^4#;DahEA8t+de1&nivDK#Tl=-!f=t^35(1>) z_KL#)OE=_s7b3e3F~GpKg;x#OMi=^|{iH6=0*x8GdS{}T(6@!pyt>s|#RjO{08V~L zjiJkY*ebiozH01m346B&AaY6C-HT0y_^)}lbx<%gdDAQE(cB)ZpXQLo$=pdjeEqNH z8_v&6z>TG4zBGSC(>%ls8oNu_Uzg8`NBB&>rQZjOJeey$|5ts-ZWo+*B`6OCe%KA$ z+_Ay%ksy(a=fN^M=P3zt{x-K5@KoWSTAeC5Kx_=#1n)+ z51XN7owon$7h>LF;+?q8-F^nI-3{*Xx+1l=1-`mBwvsPO2-y1<@74aWu|lO%ouYP` zgl`F%96rN^JdYH7Chdp1%Kq5n60v8uLl>zLyg=X0BM+Jr9NRL{jLCt-iZ`k9vvSVu zh4c2fo(awgUm{b=`o6k!9SP%zK$>EZ`#|*S; z)+b9Se)Zgv)Y0Rna)zbi`#;yzC<@5U4Ypo!!w_SfTQ*zt{Jtr2d0=G6CuvuDxpmh3 zpYqSV9qslpo4)iaSG9mY;En6f75|@H{AV(AM~)aA72!1WZ*}wV1$4!P%7$^ix;pfq zuioP2YIwpMP&K{zNv(*fInEQ3O)i_<{5JDeZnO3oXRF1}85q{*_CG6@aLnp~Hb#Kk zk0&^6eFAtc&|4KPJurIDfYaKu41lyQorCIF>F@Iv{&H?y@!0vt=0ld7$kPUI&-z;? z#l$!B5sVGDbdH!XE5Vr$-AjGT|4V|3Q5}vPVph(oJJlQxG-lS6YI&Z;gSU-Cyyo&f zGl*K~j+%`qBwVPzs`)EJ*(f~*o&ERax%Izet)Uyh5=106bh|Eul}L4i7Cg?@4V)}+ z9fj-ok#k9@YFOm!bsCj5YDa zU#(*lCSEb)9jfD>&lo~l)>+_gd0Zw=t6sQkCU}2*~e~h4iiohRg%=e8$+r?qQZPPW@ zPuE%LEffdW+e>s>$**F$`W*enYN{N~-MUWX3Tt3?lGzkF$-d0H>vH}v>$c7FQLX93 z0-}sMVeP5&8h~UsYm2uifVbw_4>^h`shUz-GTz{irGDNX=8VS}2$Rp~n}j@OAO5%J zqRYx&Kl^ryQY330{?OeNS|e`Zk7Eb`zN(-a7B51Rb`VwsX2$D1-HYJ;{?KtK>PT#` zF1!|18q!iv34QDjuQ}%~&A!tG+AiN9;wR$EmLqnkzeJijf@?9udysfAEW%T}-6yf7M13tO1 zHjhV+CYv*i$~`#;j938~++&;%TTjWCYU9C3{s)_2i|1gxED!JPt5!W3blOT3TcgK% zk6Dlr7^$1;N(~}@5YdjDlXv@48uM3JTEXAf1jA3wiIG4_!u!5;Hdy8BU5j3euKj!L zM18kp_sM>)wK8s9J=xIDo9BAex>ZxFzm1NGZzA7uhT33lZijZb(3rBz!{0|2_OfuD z=md1;eXl(vM^w1V^qu3B&~0=LOAu8$nACg78Dd zU-;`ER8`LS>uF-Zji~r8Ag8}lcqEKbnT;PS6EY<%HgghCsr6CuF=uDuKF813#c>TM`& zp|B#lfn>C>6Dac+Pb^6IT0ex>nhQn1p%H>q-|qgKv3U{v`-BuEG@su>)i+!#qxaVt za|d`f*N+Gq!@`)izKTA^?$#v$b2FA>f{6Z>vm(_7OaoE=L6P`72j1(@+Z@HY4N=m| zIjH9%O#Z%lOo8Eey!xHpa8f~HAAhf(BW9OvcXP)%b}VzRzuSjK?~{9P9KOj~FT~!P zNOXl6MTle#okAQkJ!CNk60%w!o4o+HGBx{B{TMNed*=FA(c4^GIlF<-6UPU~W+S!G zI+6{stwr*%FH1(CRw5GP? z?dZT0`5aLwdzu7H1&@NMk2t`)j3`X-#uGo;BY_pLdI_?CY*QnFFp(^GL-X#!X>!l_ z8O_t6yg*f?u}k1!UPZj$TNAPW+_t>ygkHerzO=5OlKQIiC}whq^*56-ZkuzmIVetkyF;C@RcL(WqCp~y?O{4#6G|5MwWheP>)f54Sw z&6*_JM~W;V$~KrHNn(&CvL=RPU&cOVNvWuib;wd=7qXiolx-~84TczuF~&L=?&qG* zr}{p>>w5lu{J}NGW$ycZzu)J)&g-1>I*Yi^Gi*geJz`c^aOA^Gb3TivlB{r`6jQDG zg-C-5_NlOBOpR#MEW_dcsFE6;rbI8?FtXM@2Ul4R41(z65O%` zFid^n!&fsR?1d=&F6j()?KMMZE4MWkKxLJMQBtDMgah`GLF3dlU~5+XC%okuxOHx^ z9~xr!Jad|DpCc?ZJ-^c@YAXdAa$Kj8e{B^lhk=#H_9o3$9UJo&oK9+QrG%rC4RR|x zT>g)p{ePWRB!YrOt)kBbu{Pi~m<0RYNqM8V!YCiY_#@q!cR#)rKIRv8dc_7*$|N*f z0f``Qe>^8Cx+P{d{^c^8yB&gktGBg^s_!wJQBuDiJZf*pP!lHmV)-T8-2*!gc)Nh& zr(g}WksU#E^AbYGzR9so$2E8DQRBGO%|iK4EdODv23ybQq~%tFvRpVan&b9E4hE5X z<6kDVh1+0y{M7T~>k}>N@2h;LuI$a9&dPelM)GG+s+;9KwmskHp7ZLb+Bm4d${#Ye zP~R8Y8n@@4Q$Hm!C+t=I^Fkc|69o19>SS2h=@E9eZy%@Ml8(I0%MwgKvo+8<6?6Oh z!>8hOjZ$=0r}&Rb0@^j45lb%Ab5=@ziN-G~%6;RrHc(?|9#L%{yW> zqc)GC5@3ge?x$xgc}=XF=&RYNS8T;C`-R- zvwjJ!R@qo|qm0qNY(yI_uo8ZD_6F?Ao)Ea>5jY{JByjJrV4224D-xFOkgFuFvxCJf ze8W2#-o>!{q3IDzM>rcwXd3c@ozQ+m_df0E)2zVuJ}t<)r1;;f8DwvG2JJ1*{Z;@7 zrFvWsao<+^Bz7=WtkTY~{c-k3#!{B+5;P>wSC4d^q~tAUG3u(GZWPj3>`R|>HR%{> zvw+?I(ay|s*=a*iFE-W}*vceqQI@^~J5T^_3t#E(IkrU;Bk-JAbnx0g)7)0?C5WNT z^6Z{d9kn?{a_DS^bdx&Pb!+?`Igfe^!CwT6Pv^L0a~`T3W7^^`<~5sq z?`7G>GuI%5xsZ6#n3+sPOn%ut>!@EEKmR#S&|wYH_A>LU7LAtPDqrbO=L0)`oYxbE zhL{hImV5(lRr5FgA5Z-|WkgHY0)$QglyN>R+Z&5--Mnrkdnncp=Q^@D_89hI&YosgA!g6yOtB>^ux-hi}~4jNQbP2w2LQ- zkH`5g_9#u3KxS7Pm)Wx5%eyyY-!bV`gIdbO1K)`H!7o5dP)e>i(cwqzjpf0fjO8`w z{{`AVb5M%mt_IsWV*=i_Yby!@T-wQEQ$O2|ol2uPB?EcL-MqWZ7fJkhd!OT3{jk!u z&|7X=O^ti|x7==LG)y4)?{9lYKNb{shEi8s(t@j7TChwD?0N@;e_8b}AAl@32=U8`m!4!Xnz>MpVb_wB{c zpSYR0wKu5cyyw24b2pvcV~@l5xU#u;4!H*h)`GMjt_fN5l(RcW-5Xf{N3QOQ_Kx&B z->5_VVcPb4wT&U({Eh+YdysjNF`*N%@$}<)t4JOrriMvSapuIODEgzm7#3X9b{v^O zy}nm_W5o|OgwB>?2(U`l+UTrQ7?*+u6iuH4YhW=E{!hXIVxxT8#4x8 zh^noo>bf0wN+T>^C};t1SQ2c-4#_t^gA-Kz}Bh<9$v;j34f zhvBs)lGyUe3`QnlBf+$RAJ2JZE%#QPqqUd^?_$5Ns8(JmB`~x+Zydn-c~4Q=l-yNJ z8X%ZRjnem8)%ZG%iS`xMFT&Jm2C0ToP|jpd7c=7Jt$vnu+5JwmS7=U(eo0OGlNj5# zp(i0{${8RT8cNI9-(9x<1jId33fn;`KI$y8Nrds=YHG)-kC4tJsI9G>DTRLQ;#S)U z9lrv-dK&GKM$8*m05W!D*D~g&K7T|Ckq$zd_=apL9>Jwy!qe4E+_Fmc_LRvCIGSDQ z>zr1YI~x6TDw_I&iXJ)o?m){TY;$~i zD2@%Q-O4_EJvzXt*&_X$g`T9EY|Nz(qa#qsj*x_f9bRn!qWVkahGT%nliC~WN#i59 zSNIf{^l^r!^q%#vmr57jknh#at5qiA%aciQV*4vY+8@?AQ888IzK0pckZ3|<@>Ic! z?R^1uPeDr7%;2TBaYCH{Pw5~2>|eMC@D=|rlAb~C4Xgn#@W8z-qUzafvTZKjfOihl z>rjQDQu!CJ?-muUdxxI#y;sEFQcW0Kz0_YA#kQi7k@k2$1z2_0jpl_7@2J1uzRG(F zy1JDPET@=I#!U8-LKlwI96)YGJakjvW?Z;wGlCl4N|Zd^vx7g~O1_7tR`a zO7V;Nu^k+LTR_5vqciT`@oJ2g7KbWo?Hc#WId08CD;tl%ot2noO_9R=HU55atH0zc z*0{5LbV>`luHBfD5RvI+uLL|5b$I7zTGBHY&0dx(PhS*_?jG*3JrR@Af@rIjj86!U zMpwvR8^>C9hME!VKf70Oz1}&GJHYW!OG_3=m@C-*r~Vs0a%h=i83t zZ!0@?VD_Rh8o#XywsxTO$JSp_QEY=0pRmXLo@GDVd~a=FJFW?9L2l&KV+ufNLsK7} z$_M-REpxY`FW)(Y0pv7R>fe2JC;r;Wtxevnrt6ZOk8Z0r0gn&579A@x%-432pRSZ4 zfn|)i+7eI$4Zf43aG?GGQ9bz(Hm;}a?f=6qJ`I_8yN+SU5Z{EY-t{?_oGyIAE#15)&5^LK-ZPY)~p0s}Mg8$oxZ`>o!rrmt#dw^Q_bQ@d3`*ox30jAiMjQ-~pln|0^b<@qFll zy>k>OA>!CrcbEm~o2rDKYT?ZAhNVRF>^r*I{8vR)q;8Uh`f8%FZXt7MW&&wE5w7fxlX_F zjZ(053z6Pi14DRJySnql(RI%bl{GSUcQUfUpKJF=y!hmGh`#j|%ya4l zbarrTHt4ZlTjGHE^kQJf3dJ)m)^)n!+Ft$CbqxQSoY)7^v31`U!+Xuih8YZz4VPjC zCv6r+E8x{?VL#t*OrC6G6mWjgGO!imRGS&zCN&^2WD09nTCz8grX+${gM2OD4u?fI zAB}EDA-Zj}!F);L*E^5tO0{6KYYRu+xHST0UJ~$CF^DeqQugd(ull$16T?zNMb+F5 zU6q!-C1?mBFPJTa(LTuXc#*O=Hu)PG2s``{Ne8jxf2R$7n>zKl{a4*Nen5$Jr}rwZ zT~$JsW48d*kQs1cB`yjrmCWw0wy=Ac^fZo|FSMyip4EBgi%KO7aV_mb)JDv=?GTOW zd9T?@7uVJ9o$H@&?b$^?4SI&qBT4zbXk7QZymdd0$~=@$sxvlFcu;t$p@J8(@t)e_ z_?MzT++|=szrB><4|$RkpGia+yk6*Go6Nw>{D+7Yq(<-)=T>M{EZt1TuL9Y{lpZ>e;Msc_Pe8J!Y8} zvYPVVL*{)NC$|tYzT4ks!9!}BvVb%A3p;o`tj|uHZpL;Du(H#p%avj^B_4a zH9Q^`PI1gI*=H)BI1!y#eL{26_>M$QcQ7@>ZkAmO5>;9dh7m==eeti>%@{>gHbQt} zG$uuUmU-T0zO@njHE>E@?#sAMZ|Y#6uI9eU9ld6oQMOqNrs&$26&g*A8F|B%479+g zP>*Qx2>^+x-ttx!H6Dj_tSt z_}*1)g}$@jP2X*;yQ4YSds@qjt!+UgcH=b?Q+!j4O>gdA6si#o#Vj>d2r+4k!54^^nOM{+wrSyv{$BcZB?$bTHHPpD^SegV~|A>_R zPV3hi_z^FS>9QPl6t!f5623sb*YClz|1P(_n@3kxQteLQ?QZy>c}aT*eFkRc{vN}k z=Z(urj>wexhR^+ryIEZ+@`cIf?(lXciyyDXpv|Gq+je13HoAmsJxY>>*=A8~Ml&>? zAG2UT17uCzdjYSZ`Qf=bnk)D(pvWZmmVN%sMB3SA01E8gVS->k&i=EY`!_OG-vn6p z`0N!td;yl{2g=;^ zuuRU2;DetQKXg_a4@S3p$o1aktZU-YXmSvtJIXFJF4UKo>#=)ar>CFM4SFoz+!disBUd>BznQt&+GxbnX{Pva%6aLjSy$CNsI7`rXwSbfjoQ8!9v_ z>bH^216?U}MjTvN7zJoe!XXti__a;WrXJrh3oeApuE7n&;jt2l+q)~M4eyHY2?)75 zt*Q3cGR3_-V-dW2CK%^E4szZTQfafYOx)j-e9AkY@*MZldq?VeKp19{(D0QgZs?*g zq10+R5?~O4!@kj}=K=dC)W?HIBo&+Q)(v2{CP~q_dACblP&nQGw@$%Ln|HU^Iui+E zj|qWUM}OFCM3hAZP2{~iGGXwv$AzQU7`2pei6x>Iix+RkJ>q5hK&LNuGh8t2z(#_R z3#Iy!ErHE+U!vPh_5`%FEl^H4&RFcwwgn_%J3SG)lTa^s&Hj9wO(QzF7h1ik)=hL* z?@lnjl!=L(fA0+cP`T8>V3WqzehAO^J8|Q z-aVr#iw$!g4B|aE27^E9BtHJ5LazR#(xt(-dF?FlfU=|G7ElOg@uFWWVeWCG>oKTx zm4=Y5kUU#x7JndSa%LDTC%CA1dNQtICeyT8qyL{%rr~diQRq<*@$*h!m-DgGU4n@! z9q_}uH-iHwbU977Y$f!(_jGY4{Y9#bUpLg6=j_<-sF0TjOQbO1Esqc5j`jYSu<&_3U3KgTh9N!P! zB40Lo!b*6c2xnLis4U6gS)AMLtW^IVY?d&$DYt>5IO^m*&^K|EYFM-U?#444n&Fiu z5o26O6Vw0LK>PmN6aUxVMr(5epymhos@KEx19QSR+9TzQN^j0?3G4Vsx1h)KMT5Op z>(d&bD)I$+o~saR;YIP%gRTecTXO|{``@z`VlG-AL;UF;WE84D9P-VnY^-u#u|VA5 z-MnIKn98M}Ww_6w`8(qAuS`NCVAr>CCHeOgbiNl_CkIMt_KZi!4IE!}a-bAz=8x`E ze#%9D(EKtPY913^VS6spl)`iK(I{!h2wKrFad7{I0xrb-vtdZrYGBymcG1Tvixq`Q zUMYQ$Jp2|VSkateeQUYn^bHbBd@h4azvDBDRVKb1MgG#K<_U0X|6I>~6c|>fks;ho zH>TH-jXIKJD0bZSi!;g=hdi*Qm3TY{5bNi`odz<}rCs9{Qm+4iq@+GIbKc~4byjIl zpM6@o_yMp+wbiz{rFK^xj`&DoUHkzFeQ-a{J0kx1>vfhD+v?ik-Fxd#-&%-|918l< z+=*RIHLnv)l<-ZBpd08@U#`pfdpINMV4HJpn(e|5Pj_->i6iPWQL03KqU5a;!Byr$ zD?4H0pi$#uvkL*6zOd&ubLF~(v3i$}7dwhje^r`za3mDe&lGw);XxJ3&gO~Nav@wA z!1;!QeGxRM!8Ob|;Usc#e0OpbovpAeM%!3)w9fzr)86%W7Y;o3o zsY@Eg3vy`#4<=>+2TRNvXvhE-x90%+Sn_5PndT|2JoOO?_+d{H+G40KzBi;w;P=~kAWt><&>y6_hBe2m0C*8grB7(~ zdy*&?|9ag}=C-N?N}Kg>qApsFg~wJM?iZ&RD=vc1MNFPQ%T+lD419%os6qBQ+r_ z(R(tHBiMlWe^86fn)|Q0-en_Aoy_w%VtsZ8Qr<*#8hEN%u{=}MI&su&?N0eI=GJbR zGg^IZy$7%DFb*>+FjqH2j$a5p<`^}+4&mM#8%ayH`6|mK9zd=0QV%s{GBc%n2iY85 z6rf_cJqV+EKqh~OEdZAe4b2h!X!%f*v;Ds(7CK-`^{^EL%v~XP@q>2Kk3O~Oq%%ry zcS}U+RM8dfL5d}?bcYcaCxlzBU~qvj-;nU$q+K>zt>0x#H}rqAzLe}*D0e5MD%G-= zOL{Es#x*#&Y&p;ck3Z$*-=ubGYPxvhZ`VIe&D`#8o%Vj(A^55XM_AFxN`DvK z1#DCU)HrtJF~{35n54+wmEN=&%&Z#M2|m)h9|}Kz5O0sJ{d4W))&(XqgEDE%F3RvS zZ^cDAos6kM*O~lAg|YdAe5|)y&rtRt!7V8%`^xf=ebly5nxe|LH^WzF(0o{fM3V}# zgH=VK+N^NB^6<|U1u}4jn~dz6ZSHQqT*M~Gn7V2)uvS?@&6 zP~|84y!{Jx<8bGxd-Tazb>CBpKjv{Mv5GDA-3pohRoo8sgW`6DtG68&3PL}fRl<-F*Jz#lUYrFE`Kn%J%ACVACH>A| ze2y%KGOoqm>HZ*c5KT5a0{;--O-~R+#dw*xv1|GyY8Y{J_d7WtQx{R=sf?64wbin7CSKZ^^5$GAQ{gc7;iP|qPcr}mGiH=a z)vxh`f35wW_6~5Npu@ZXI+zOO*Sd@utot5Pdlxz=i}$+Q8)uZ_ZiulVY*;C~%@^CK zV6A$A(O>o9j%$+xPFYh@H)8dekN+w8#X}Vh`Qr)-O zq|nB@4b?}BihfsLOBd)dFM8*_-j|u~;L?yVTC3FgE3q7TFLsVVs-w_@~gQf>V zi2?Fz^!LC$)muVALd9ttXApjwL|d1nKN2T4!2mrK+Uxsf2rNN3e$R$MJIG(=hq*M{ z6FFu9HiGBX+T*qL!}RuEHmNeA9o_zi#I% zK2J>AO$;7)^Drq@{5&{+$wLu-ef!+tkF+JpQnk%ggYR1nAszlFXF9~To5V#N7(ukq z^$bDfXw%>)8VM24UCl$oj#e*{u6&g{FU1_f9;G6K!F?;4PTafIj9-zX!^v@9NpZ?+ z79WtEHDbb=VxNU)acz)Jp(}PeW}Q+qy0tDRz55~U@mXW7qV9TDw%_}+`D6Gkwxx}H z?!+0~tD%7_3vflcpw|=ksSX ziTnNCUm%*`1~5Zg*oVaXI`MR~0j5m@34ZrX;CWCzHtE|sr-lZ#1uF=<=oEuD_5~j4 zKT&)m?8os6Ee$V-zX2ENVp(5^lQXnHM{fL*jmlhLC6i5&;&+VV@EqyaOQw+Nb7y2GiDkOe;GIHSR0Hmm#ZwJv5N6sSg}hQ6$! zJxAwW=xE1jrc~U`+j*t?0eF2TPxYO##H;?X;@wc=T=VsKmwKtYRq+Xd2zo3@(xyD< z_}iO_T_ke~`rnB~{|XEK#;E@*9|Qy_K+hy7mm?5&0XNWT@M4K#YH(g1<>$q_VucBG z@(~SwQut)~wzbpT3ty*)$ot8Ge-ama$8;u%JNx-Bee?P`)A@#ong*Ndx+#1^J-^#R9*!I%UO!ztJx8y=oD zE*4%l`p)xwqFSQdotNM!o7h;h^P#b0rSs}><)>kN9zuk8Np+SsdUsgC<(3@_KBM#9 zY+mVo9`Y-CXu7Cw*60TZ(VLmW9h~~!yOB+>f=dvyeyl08idm6K!y3;z5I=gF6Ce#m z{6(DTHm~c@zkD1m+y;uN=oS}E?s=q4y})!$`b&N{!<|BCMJ;DzKhDCaXE_|#@O_G} zf5(Mka+xPRutu0~`LEuHoSKsl!dupezB8(FE|+RCJ}9=?8cmZ(QB`gxpZ!&Yi6_A!=L?e3f`y8$0(%ERP^oWug5%e=J4v zM673V!YNY}_ZT$g?=+DFA?C;4TP@9t|Bi(^*)g9+azT#uklc&)yeMh4e6PkY&&4aMTh8# z)pP9GcrRb_r$Qyqvy!tRD9>sEw#j~p>cKd?2khevEB0U9xer3zpAj_Vw0**WUAtFftHEd3_2DO0i^)TEVi&x&ujq^aFEE z{%weYyPG~oP5J9dqJkg)Oh{5cJhr+`O82Pr(w~E;eVaQ=yqMN0g=j ztdvR{o;SWcMKE^W{kvoEJ#Ww4Ric9WFQmSvx+*4w=_>qJ^i_5?}!P*{R?;j#7?msU|jEi3H@|{31dxv zyI%MSZupi-?ZRfFU+@J~$5vgfMt^?TGd*{`KRF3F+sHp={H>MbUu%K!AujP255r~W ztRv?%Z8oiB=8>jo6xUgn8tEdZ!{SVK_5P()v70Yi6e~RaeK#Bz1TwBGvroy~qIN0*H9ciL@+nEtVM!!zjSbH0}BsKsRj$7+9MN zqGd1@z#d{QTQcxtcSoLz)a+D99nn?E$rDT{&n{9wgK4_fD4)47(8*I7d?I}?aNPf| z%{a7rJx(c11y#_c_{0%X(Zps~%?DioF7j`RHo!F_EiRnBpLK@ijG~K&WRUi;biFaw^V)u!oikuuGRwp}9?Un1!R)uvsb7C-q5R__V71c>P^jFb9~MQM`HH+QO9m?AVm^QX1psSBH;`umTM3`{4WZ8zUu5t| z@9baLKnBWmtf>Iy*GY8$+x!@wl83Butn(EOI?V=hDbxO+b#3L{Yp>Wd+Afbh0b+XP z8hD$r7LYhj6Q>`O$?jr8qgP7&#mD|zjOmkG z@WE~Es0bd4&El+_EYpr{D+TQfN%Y2RW}17}K)x2^L;2p%&{LguW`H^?DXD`gT=4t2 z7Bw;w8%qK7;>eYyI+f!cF#zJ<{{W-fR*N10{eM1h1`upA-&OA728KcVfZjL-+Y7o@ zU%Z^j2c!vN{Mv@aTy)%I7=r31+y~=$98dRJr3_N^$7|mKX`9tjX&LXijR&s}3eBF& z`8%eO+5F`%9Y?1?ohLi81J~X2oPBEhufNWWddeKDxNW*WI>6Qs4@locMQNTCs_lBy zd4edd`+anW7o>qX0XS|R`DZRYA?st zh^uF8baVe4GUZs(-t-!%Q9Dqrznd`=D6)UPTMQI6&OtoM*>3H}C=RjJx@8goV2B z+`l|uT2a~$NK0RkE0hel0REiSg@ms~8FAhZ!KaPZAL{;v!Z|lqWm14jWc}0e!A(0e zjE)LeAV--JBRH+~cveo1!KlbFwDmXQQjlCBK1X0&`#`CpWi$9G=`rWza`H*1_5kY- zkBRu=mdImo#|WgjK>)SL8Mg*^(K)s$xgV2Z`ag4E&bm?C_4@VxyJBw#6d`Xz9y+J5 zv_UTut=W87fcb{MjEUfT>%|s>T?ltZ(f86Z)d%n)CxgtMXu(;VO}M|zMz^POfrlcm zWOPt`3%^dN5H9!$z>_YO+~-tISbxAf=DvE$erVpcd3kIi6X$;o5Vcf07CUrn)6HM4 zy;F2Izr)%>*c8&Kd)IvEhj(v}(Lqt1l!G^(mduk>?7Niz@y<}kZ8pN{p6<^Ovjwn|#+w6%&I{{QnM8cUgg@n3s4cPe(! z%y24H!50P~)vg2Pi~kUh4p(1(irM|aa74%<|8IjcgJ&f<&CNS*31%RiG)Lzj-a0zJ z({b!_5-R;?Mr=xF`eut8h86JFcc#jh-Rh^9C#q-v7`3u)B^W-smA70f5TtD7z`Lpv z^_)3-&Ms8_SadblJ)fYA>WC_}yX@v|4;kFd+-x7;wh|K`DP8NAC*bXh@fsgqsk@1_ zmaGBeC2nNEFT~&~6*vU4HXK0a%((+-+g0!|Dop=#06qHu^)9Y(9x0k$5Ol7D@Yrag z$4iAOyv9f=?FIDJM@mo4#VvqY5p+z>U)TG%kiVsn|0}n>pHmmoWIXOmMG}OQVb$zm%W2FU`dEvD+fEqO!nU2x9^1JnWvhHvP#Hq_TF3u#Vw+gYAP}W{U$_ zBCVFmgM~|(#iWAbf-ctRxkAH8t2-o}+4JPoTw5HVW%axXP8v+bUTp=m`Bh3E;-~LY zZ7aKJg~h;CVFeE0b{);Ux{kBav?yq9h4xAmpGXu40ddD?6@75HMl)D~IG6iUN^TZl z6Q?4dwf9hJZ>9}?T#Fsc#Kn81z3{P|66!1cdy5gHPpZb8%^bnRgyT+qP)}s11$xV0 zjz_@Bvv-(t-ykZU#cgGhp8~=i z|5Z{|dw@OtT6bwTnrlr41md{90RtMXfDiasH$)DQ=Ru~@at%mSk=eVl|3Cxo&^_Bx ziNo`G2)qPdZ}tp*ak15L-Md)B^gB&G$(amJVvQ_`-|)U2V&ZY;VLCI5DSw3``%#G} zDP=}(O>v&exke(+>3tgg^gHRsS6lcfq_YLII|0up{kwmoWyZ;i%3Q2XG5RyF}m5#KqiXuwt1hgJeNLo(^<7SVnFg-7mrZQ z837@t1o~TK6+-(%q0^)@(zcg@v{8p0!UpiwNJR$e*wnLd?qCZ49N6A0452|8O@7*Q z>LsyeR)pQ6LKAp_scKp*Z3`Z`tKcsB2CzGVt)(6Z$gX5Sih^v*G1;!1Fq$&o0hXvj zn|>Pyj?U-*NM+8ryGV>CkF3AyI)*Z7a+Wg-3+&&>DKIH2vTXZr!czi{_REc%|!Gv<;PW5VzW~ zI0N{kmxNOQ0T5mTIZfXH{J*!RvoDNG9B2jb%GUH`0F)bQ1$099YuC_!&OGK+38T7s zWL7oLgA&GbaIh2lSNV}1hsZe#i21HYOT_~cV^YOdp{mZJc~qAq>0!4OPexBRL2=5QT-OorUk>hUuf_`Sa%iM4oG946m-Lku{Xid}3w#n}z-@uwo=Bpg z-D$tftU_EO*&Y+7?V|ksf*vE9J*+8voM3=JAk3F^Q8ytFYVa#% zJd_svp!f*g13&0pb&WkB5JqROsW#Ul(j%9U8p81`;Q5r8KE-Op$ zvaYwc_jc9(KBga|kP>W7Njtm!Q?Z9n+bK(#OJAPMlB^ z7JhTlmZL1$&WBUN%t)4PUv@Y2*yG2Kul{!oI=SIem(m{}@1UtCW>>2cCTb&TXc#!+ zcewtZHtAHx+NHHfWuNtwFp3EQ5|p3ezoV^aT=hMQ^7%qHA-_)j&xnv;*0zxZ$aUE~ z`v1P?62}DjyFZkKy4%s;H>AEClh0r8etT|xzd!d{S=H4SGPmzQwVQW&oh8%ByFg*SDb`)Tr%e$mG4;D6G3`|q@@iHM8 z`XK0@OXT_Qu9v6@=ws)*-;5DVKHqzDf}+HE_?NR~jla*^W;I(;nu+(>X@x5_`x09# ztZE0HX;_jEzm)pUxLXVFgG{R+#$#um<{ow%qdZJ*zsRv#9x3g^oU(gzQso-6wl#_*{O#VW7sp1qM3 z7IWhKS30&lwIeh{;5EfZLIg9nzl3I=P*q6mC!>M}Ip?97wjFK-3KVrdzQc$=l+qeL z=~7}`?*4{9beuk>HC?UNrP0bQh2hv4qp>RNpdz2|9CD%SRip}W0A0h!d2GUHGd!Tj zLV{%||H0@5wNth1oDJcPfyezzM$6n@9XosbTWO1HJyC3$+8PqXAGlLrnrBg6Q5xnyjlP1u5- z`T;v{`Ym)4k_r-2F`MS6jG~~3meTH&Fez?rJVwiW!nWVcBZiq@btHzuK0TnMdS@zH zB9Tkd!s&irP60YjrB5wg#_rM9?;mZau0FQ{C%DP@%59qPKx(chJC2!8d7wD}4BBF^ zf&SKELHm4m`f`iU?$4xAL@))Vq+c|rxU!&iUykuuqS8v0M>gyLEVMn+-Hx;+0!7mW z?Dj%`M-QtM!@2u?-y~{wY`B)H{kDnhbhwW zQaK$mgklvMnwB;0@IUO-kaL|-muGl5-z|KFS>(73BupDw7OGR_G21TZ*nM)_AB}it zkR2PnZUkG_S34|byw{{cOVxB?_+Wqhh`4$nl7?yM=aqAMo=pYIwJf@O&2N9HbZOY7 z_H!ev+DHV`@u`r#?DRnQR}=)QKH-tHbJWz>jx?3g5VmwI_KR@RfT>IM&z1&AX8~Gg zd;Mr7;fRnXST_&779c=t_`#bswT+MwdPc-N)R{S}jwPxMvSIuKlfj1yHG z?HeWN-a3rB1Km>6-{8a3I&qTo1zn4bo|j-Zh4`f~-`f}Q_Lvju4TtZkf(CS&yyiOV z8`)RCmOAzjn!S}HdA*)I}}GT)uXSr-mN2411(kHK`tBwYecI}mx%clQESJX1C$|Jdp zBJwU{BUl_>#5dK>SR;ZN0`*khh29Np@za}r7dQ?k$ipS7E41@enAND08E7;Czh-Bs zV2g!flot%`n$U4N{BC+iD&;WT13U|Y1~wkH$se%Um1a{Xx2VKP>>x>Tc0OQ&A%ybt zc|5*Jdo?o44@8Ni&1G_;D-r2=eLa8r+Owz3LQf7)O_|Z zGw@#ALp&{%BtP!oL!*@5;yYs;*%|~^a=XW&BHw3f+zIv8+SLX|i>iz%C;FMIjKkEaxNEIo`Vk1~E zt#R-~FKujap^$3xG>Z+jnu!v}sTpr3N)SXhaTviFS*^6z>X6YhO(!Bxoq?O{x=iC2tiu8@HS=f zS!Y(+uXbVAlOzmiAqC#9Q&Md4r|Rhi_5@JM|E2Xo4Jn9i8Ew#jU;dm_DwQnHbrFpz z%Re7C)o8;1OUF&)h>MW_wkwAohy2asIJ2PtEo;+4{^oN*E&-~bKZ6ZTVAPdEh7Cl% ze!bHqq$+-Q$Nb;DB^#_BEJl{utH|{BRI)tnag#PCh#)FgjbMdV-Jyk_vfQ>$p7m=3YaoMlI5Ib z{(e<+hNo}@B4yn`y+0Ak`Zsul!4xCK&O?}ZFZB9u{kG%1@KEZ1Z17k-dS`bw-MKD^ z!izX)Z(8lU^*=Yf$_U0dRt)hjP#?8JmX#XQja-e9S6rKSkf5ChUJJm_#nE-+!NE_YV> zY?y$Xc)Sa-)+<#Tv7ngy{@*Dlc(fKeLM~A$ zfGn!qdsIG~Ci_1Ir_kwyx+tg-Q+6$0l;1q&g}BBxD3Z&RreKXkZE&NT zf*V#R8$ao%t9q?}5gD$h<4?(ThAC@BFcpvv_lLpVaRK8^6pZv^r1S(Gb3u9zc9?2vR0-wUN~iYu)|&l2_M7uEG74S{G(+xshb^ zyovbuFO;g}1%nFFUSuvJHS)x?*6c~JtbIQts+pI;xSiy9ZsNVGjqeC9RLOc09A zPC>Up;^k@&)}vK6zR7ycBNx+r5w{`b4G!u^J}&m%|~p!KK}o34?4FruJzu-a%xUeX2q|HOn_*I#q2 z?31fN$!*M|-Th>jnt~QSzi*(}(28XFY*FnycujuP_WR58MOv&Xy`cV_$tnUvd%M8q z;;<=Bbz%oJBEw6*#ZTVfPCn;oBj`Nlzj2K}8+$O#{~kS5Xm`aFv^fD_0x1qb@*TPa z_dBp8G{}azOb|tgpbKnJNGG=V!>y0YTvT;M9jXgcstFX3M&u2NYsqrw!JM~o`LZq; zqzO%UvI}P1A0WyAFR`HV54jt90B@^zxM%>SjI<8I&*RMS4-~L6qq;0|u)e*!lqBPnyr^ zcpt{|`Yjgto#P{Sfl=hZnDDVKIc^s3ibW`6^0|hT7IKQJ9C(`Np)G`0%J+Ij<6r`J z_&a2fKiN-RT{VHcW`Sgu`6)dKYW0Hl|Iob_6tYcG;<3CLctOzoKqtIIS@7$y9#(gxtN}*8NQ| zkt?l*T&JQ$e7owOK7DE)+aZmRR9;+*zt9Exzux1_xSWhs?@`aB>`R^6P4b^P=jhss z7#XtQB{35%uVU%8!1$LA7TH&>of5)>7OdsjT2`6BzT{JK5xuDzMoeLAV?2zrT0k2HkMZ(5{IihPkx5lAREFDl}S6(W9gtR z?C;pNj^zD?&8FFs5jAW7D(0Q$?w4_%sjwSC9PJeR+9UUM9dq?L zaDRQHbRun8dpWIz|Jp@<$y}Xo3~s^)EV7YzT=(lh=d+PxUg=e%+AlU9 z_Pin%L=zSsLn?A$gFZWgFISzDjWHITX=ziMBtoaa@YrQ5wtv}*WBqa0$Lj>dtEDN5 zy;@zMi)n@?N%Teo7P9sTB8-2|<+Incf>3~odylw9^18Po$6W66VirD?R=MCW1_dIS z;JwhNJD}0IIa=Xajp1#eq^MtHn2`_~l8P6&fZdxH@tX*ytBRlukym;v@ro6CYR~`o z`)uD~*bRhEx6*gC;2hV~6J2=I&lvf!xd=8=;B<_|tgg;|R^X)Qrey!)}KA*|CaDT*F9OEX!E z?tWjdaz~vK+_5~`OX4muVtv(Ddvxf+)rvPico>Ml!s5RfY547?FP!Z1jFTemE##Ri zr1|`MQBylmFvz<}FT`TQF-<{WW^&?a5;}|sM7E-bBX2;oAhh&&3Ou)3opcA5!6G$Zt=v((`U}!`tY>E5-*RSS5PZ{;zvdM#HIGI zue6dlbl-qErmlQ%1$(scSxfiy6sckJDT2nKC6YgIZr}RC#oYJ%%atAb^-rIx^M;Im zSI|tBx;=(HIwVy$s@LtJsyy_;=PUk-+B~_H7^#X*k*1>?I=nw;gS^~$J;v*#GEUQl z!=_e(L5+$tqmdlN-JJNzLxIP!@+oyw!3v>MpgeiYxicO9oXbBaBX(&AGnBZ|%@dzsS88{=q^ zt8|38W->ewdKV=*_H*-_X{}8&gS?f%K&Va*^+q;al+=JqF}PIxah+#h(dFOtiXrR7suKaXHyK}Ot^jw>e(7nFuP$R2T$A+oTNsJg05+&3WT?@UjrVJWK{Ix>3?o{2*V^3RNdk^TpLGYF|o$B-W{`J z_eiY@6J*Z{CorlCu)xHt4puJZh)|*%Ud5^Ymi$?uhB<3oA`-Iw%$Ra2T#V1$Vh3)8 z*|%xtvEf7N9BCrtk-wqGPOL91v5}VJ;hTm}!Sx>; za5y8Lz=Ckq@s|rl5SDm`f)*%&Klft8AUv@kpUFkKW%?zdGfcfHIVMTj;_39{TUy%L z7?@}7hLMyzl4<)Sq&(0faM#YoBWuCk+f_vr=&Eka6i_ZICLG=qG9CmX-#V!{c%I+CVX`5&_-F8YI3h>BfZa?gNk9?`kv0~?B^o=tj!w7 zKcZwkTzT-6I5$Db9ey-qT!|3z;&kDOEP*oqHC}?zW6l(8ZU8};FUx?fe!x0qQVCS_ zAmZJGgu%)gl!GyJUs?!P+M<;=@(fT+d8$)ld<_I2deW@g(R|jUEhrTWr9xj@ipAwb zu@~>(SFQF6fBhLgG1|hN1`T7eNn7;_V+%O-nL<)DUFd=|OQ(xw3fvfqs%i~W>A_Zg zM9|v2;+Nusoz_s0?xKWVqNbk`QyKe#4{A9Pr)1qfbDK(&u8}r^!aeJYi%t%b2Yv;r zO;A(mtThtS5kn|X&Eo7A%WK$<%~CO)?mdNzc{{+1i9T+RzcBNRs+m{XN+3~My=t@j zio{+ypD3kH6U2vvc&u<|^Mwb`J z{hpA8RFVJ+J*-m;{TvtRStg;dg4pT~vBOJ8WNjiK1Cp~WS}3O*bw&sed<0&&pR%@x zH2QPZp0>u@YP&8?3%8AIWZK}SZfVIz^$NFL=^IQu4M8x|^v1)BPJ zx(82H9j;B_!D<*m8zDgaa!82Rgq|bNF`a}u1j62g7gE~-CVw^~>W@;m@vJG_u{vLM zq#y$K(9w!h;RLE`5v^lw?B7-5Ffq(|aghb6Fn4p?CIn|}>g|V`VrIhy&la_K<1n~A zD|2FHrChk({Q2tzma+Q2&CBi5+nl*rLWCdfH2+PS!k1Ef^W|?HwX$lK+g(9xKeZD6 zC(9mi5ME(;Gv}`kheyh)jNPbP&`Fauz|thV=uw9uuRk9XuMT076#cOde~gKjb`_9= z_aK?lrmUe?H8YOK8O4bYOFQ#Uj-w2l9?4K&_QJD+kxq|l*j414jTCg@kbiXzLB9%( ztY8_WKsT4g$Hw1+U1&!qZ!OUQoE)Tkg8@md976Rp+nXoFya{lSq>T>~v< z=(F`C!=OSn&?Mm|rR<27h|9km!$s*N?}};6Ob=!ks!SeXzFzWCpNa3eW=Jt+Pi!mP zc|ivgz;$5a#P+Xpc%>M_REvZ2SBslieb%7{OdL=Ll)Eprt#*fsyY?k6|<0A9xH=Qe}EyPsjc&~;PxBKdJ-ZtdDjDPm=SDU?KR%TJf6TYWD z3&MHM5-}*4^*fud^~D4=+3R;g`0r^n=^LD240!WBGyXkH6F2hj;-E`YZTRrMp;lh9 z5y#Ll41Zc+5c>1nbGFz{R|alEG)Gksw7x@i-zi)9;hy&7g(lVT#nlNmBENFV!L>c= zHkew0!3T=5+kL`J%D3@ooPbQwOL}8w8zy}*TKb`5mR7KW=5JK5ovzO@H?lVW)}?8c zXjfWMcA+a$JjsT}oom0cD8s~tH+OQY#H_COaN%W9IZd2xT2<~f@6W|$EA=VVeb#$- zf$u@L(Ys#$^o3Z5BY>!laO+ur-3*%&33&>;Cn0r(qGx64yMl+gJ0H2sN_}+3Ml5rj z<4F_rnA*pSCSm7b0*7G%E!yf~gK%>1*e|gi3Ztky!i!9ENDh=oNaeew%DzJR_fpa_ z{XU;B#?dY$NR6g$u`yosd?X!tA30{F>8rD-u*gzFmm*)2gqpYd7De}p!&63z^TvPy z6p32?w}7D+6clRys;TFvN9!Vxx%17eE@h%>GjfpO-MZd$1wrYt9gP768tc zKZ(1;9Va~xn^BcL1t`L_$PX>QzStkz+<19EckLWJ3=zQ=c6N$g{~Q5II8*Zb!cs;b zWdvJ0@ASpVi+FD2OUi_};2^=6tAm^iZ*&$5^?#eBxHiyN8g|d_%%)>&RMwiNT+Np8R??@2Ziw8XulzGa)M$&pu5+2;7q% zk~;NmIeu(@9bm4g-&T+bzo1pSluOqH)+2GSCWY~51M>$Cj9B(&4UH@9LXXLFM@kMp|F_TN(Wk+>r6K;A|zEw zJ7{^%wb8}_?cbOEyS_kL&=q=w6fX~_y&&n>61IRK>7Tik%R?@nS3n&z!$d}Naka;x zj9CyE3(g0{gq*-|!>@}8Jw{qUid2gP0X)RI{29;uOlNWWB0)4LBbp0-aBWhpsuRSm z8Ns`-FsR5-JTEQe9cY7RtL~i)+m$6E z1g5lh6undEn)u<=P)pQ#S~!6|^D2uPZ6@CLhzfeEN%RH;p#gg>54c9YY#Ljp0Tv{F z)y|Yj7x^@OcP{GsV6u&8j$ad8XXpHt80tOJWF&vZo%H*m4k1tUE_}&LHG0Jt0U<*#H?>SM`uY-f$2!Jp@__dnd~A63vYje1!>po!9eZ6FMHEDpzy4%72G&iNOI zivp7DD{YS=;jKW5XP+^jU7cYfB429HHMS=N7oMi#SFsjJ?A9L&Lxy>+@(LV=dy%8; z=!`Ld!t~?uZvcT%$X0c~Du~bF*ju7H{Q7qHN)W31?5{;g(EQo z<~4E__9#isGhs4CtWBCGyX_qGXzo}pwKm8sJH?4CktvmC=!rfJjDQ3@4SKohtl)Fi zB69^f3v<O&=%ux@6tahaiLq2CI(oh-E`)pIY!R#rO1ZWf3Cbd0e_ zw8d}4#cR2W3~`|&XA`%MGxnhm2SgbOX&x^f7I&4+L>#}fz}ta1!|?>pykycSO8IE< z3Gvj2^B&008vR~y%<;XkOZBuNKqG)3Nz40LBM z!W+h;0_+YH^mf`KS2VKxE+QIH`wXvVEdb>qI2+1NO`g}b+;krRT36sg4|480neuD( z4WUrK2>HXyfG+y~o$tvo1~n%@MJ;{iG9&%vD9LEMt>keDO5HccZ-319WOrCNd)L!& z?Hn|M1*CR{Qk494WD`l`%3X?ypJ|TK#E5~@8DTK2%U{OC=7^mM^5Qau)$-70I~r8B zDLECDI#&78U`z+v6#50BSkhfP~*Z{n8^yAV6uSEv{BFmGv z{Acq;B^f73>l2Z|@t!x(f&}c%XA?m-8v=@Du}fwA@rMUS@tN%WBOBQ91CJpi-@AZ}z#Ki_*6RZI8rPTrWv z>_!8l{#Od^RhhD36L>& zzrVB-zLHpc`PrElJB$RdLkl_o9anZbRc`qQ#d)=)p}?I(6xtWY3x%f<+3EkKY>11zbYn)2GEf1yKTkd1i_Aw0-EROuPXELUE|p zWcj@FP6M4^6U7&XyH8aS#m)k;N~s8Z(H_uMeSoVtO6DpBG?q!~1<$J5Nf#o;V%)S0 zEkfsv;kyY7(wi$udut9N!@NM1QNx0+W3C-^sP@OKL9~+mxht^VVr`bt(i#ivjssc>3~nVe$Px2$cYL7@V(Sq zW8D~Gyu1GMlXlDrl00Sd)-F@%O{e`w$Ikv*n)Xn>40HztdZ`!QSeyk6&lcK4Zy?r# zjgSG95o7I;*{2)rdz(>i_DqWMKI=0DfGgYGwdGIga5b|~RlKvf0BEEw>B$qh#zk-A zPVd|1G_E-)^;-bkGysoa&2{YiDLeGllRwu!wgcgsi>{?hu`jXbZkI=2J4rcOKI>Qv>(r-=}X}^#eMQ9G{I}UI11#c@Sn#M$49PLb3U5!k2drpLhrD z%#MvU1gw239b5O4Z)OG7rSnGL#A(#d3EJ{2CD%}snQd~+< zjX;<)(7V|D_Ie_s?}coRW=q6|ne^wHn^zHmfTvVrC*OZ_uB#95UtID9tMU979y)x8 z-#^?Q4+!Af!Q~`b1`ckwMbl(4W%|v(N!qJ{CoU$H2rb+69JA5Tt=aqikxWzg`6-UY zsgWF#%-o~6IabfDHq^H+nxK_{Eb~|6VRVZ`psshC}t^(Rj|A<`zFN>lMR~y$y#62407kwt zSr5gOa4WcG)TX$77YLhXhAf62hHo-e-7DU16^eT}eZ_%JFs=4DI#F6evT9ZH0|lhM zy#i`KbOBI1WP~;cFtdEm*jyk}$~9{QZm-@OI=fp9f%Ec`Pw}$oxYl2LlST)DgyZ%* zTP=!c?md7^E;VymE}}a;TReTYe%z_N5p+MQV8RdO2V2T%G4gOmvMF$xNt#9CMV4Z= zoC+4BC2L%%SZ%PY6ZH?opw81+GPSNqu^gROwf>0Lf3^Mrq^{K$h_p=a)_0C&Xi(|L zOda0^%z^Jo&h4Gm95z9ve*JKY{#|bp?g^1Kqop2*mkV#lZ zp{DQr*n>&U<(Vh?UN@TB8bG$5$cm~((}>xy<%zL+Q#*~<1eia!hCtgKxw8-&I@OfK zXap+0XbBm~Gv)mHfrcQ=5PDrx5q<-6d{s_}C=JO^pN>^(@Bc{?rn=q`9Q5iJg-v>a zl{sFp_?Y!JX@8|sBdh~93pzo{H5f9;?dJeGZfou0oI7BO0YQlMu@UnFeaQZsyr7H+ zBV`3EYQ;3j%StvHJjA)K#_BETj`x^P%P@ZKH{^5{l|#S(8dEj+%Rna^)dBzaO-a2iWg1K0hSS9R}X; z^>dSZ4HXE-rR;hN^)Y-o(KiGz>&Apx{IULH{b$kj2y;LQ2P!kszmBjHm@tFzi4Qd@ zvUEw|`4ec(lFif>xv3zv9()aoAaN*TVg+uNdvA<3$6xJ*bZ9J}9nsnu^EjHYs0%=7 zDUR<_P|=o6KHq2AF2E$T9mZ@))wp*E3obo1&~xibh2l#OTwQ+oG;KW56~;FqY@~gu zXziAzmDL7C{7JjBfpNCUK;p1plrkCOwfFyd4_LtF))`bpL$EC95h;LyM{|Q{18^nZV2q zNrE&nq}}0L#9c*6vRYfX!t#-}N_Ei?NkQoGFmXyKg|00m1RfkYp*2w`sj9O>Q2iDv zpOQplae1|Yc16KeIZS*ZJc&*@OQVjxB-lU zHZ@SvIfkKvAg54F0yi52H7lqjjW8d4q{HK9)hYV_?Y5e^du6uhx-QyExPnn>ttW~D7uJY@6vo}KedjL-N><MBx(nG^Ljz6I`7Z|6MTC>(zkoad_%8N z>LfK4WZRR810m%@>}e;{RzewNblq}kN+XfDl*a2P8uq0PZJ<^GOdZPH(sk?!;S{O+ z$DHfu^i2m?3GnVyI4dE|MW6^+^Jd7RMJUC#kfcM@rTkah)u}BOm4ab|e-K61r6baI z?eZsW|FwpYGMyX&t6h!FuufN~qK|(B*YWyRMu?>90k4%}NTl7GKn3)M&ciNR6njJ% z#DXqRVDZV}YU7&C2IaIR&Ib88IEjgxo9_;_n54jr9~uRfL=?-G#ARAmsTZh>d7*eU zQ@LJl22IQei+a`8wJ}Rt;FPMwq4%i$vuavOg!wEsS8F;&h|O&VkObbNbr5r_>MPl- zlnBRM0;NhIf-jSbfXrana(&fZZM{{9tX$r26Ow#Zb(O7N9iukfqFL!v(5RsGnnp6+ zsin=?UkQQTORzyPK0@z*&Y|}6mVv2n@*OfGr_f@vN)8v)!OP3UhZ!_YT5g~A*G8L6_=vppX zV1`tOM=F<=MYgD}VBRKJpgvKe6t^!BlhZWcqI#r1vd()UBzKejcoW=4k`+&Na1PbE zH5T!pMbkYbXLb?eoXcCAaV4uGZ_+3`i1C76fJZBvRqOSgEZ3Z&KAiIIeh-9*kIcJi z!&~*vF#?3}PH+%%kylcN)rW7O%2gmmD_3PKXfsGB^uWi0Iw-}Vstr1_b6wR!ZuRTq zqF4%n+pm{cEZAUCn6pOdazdItlyNi!S_{G)ouqgb2DXkc#fyt$G#E8Gk(_7OcT&@> zp5h|8M4BWtSz&%TZCBVEUUF$zoa#AaQzkOEof*mZTQUXLGq5%t9?R9yDTh*RX^OAE zV&QOQCxuJ3YCYwwg$caLpAWB4l`+|D%_ODl8e?^`!7pIcvw!!BsUSlB(a%YGhGwDz z)lo|cl_a8NsyPWQ`wOq)JnPHQZ+N%7wDIT}Af#D`y>#Z>l-9c}7Jt#UUpv@T`Y-E(F2$W69!# zboR+e!=eGhyoq}49Kk;L=!jBTB)mPgG})dff2vz?qb-)owdwRF3rZG-ATY<4WNE7UIY2%%b@&h~=KMe3NK(hcf=px!sBTugjK z3>VSLb9u{X3a?N8Cb3tH_dnp6ap!`#=i z8uvE2UO@tW3DddAPzJhKtV1(ZqvDisbRayn?h3E7 z)`UTC+}cl?#H4FP{mMD+)xrqTS-U6Fv(G1$Teu*2nn`?64WPmfSK`t7qNkVCQS5@z zFp-9kX`v8+e6nNd?S=}W0U^yb2^6MNwn#XgR#lAS617GChfO_iz~cmI3G^Huw) z;G9(>?j$KIw*cv}Dg`0Zd(--DM{g@={j~lPZ8t^hGvRJZjk$hB1>9y zo`Myu!g1zjC2pt1wPi!5?l7!Xw5D-{TWT&`RN(iZRoQ52-A_`e8)W*-MZ-(SbPer= zQMt|9l3j`U65F{uv-ftA_a!3C()0^DKGgvY`eKKBnh%OT{$@$#y`xO=f{S{gT>{lM zX>OCdVof!t=KFvEJ<^gb;5fiMWLK?z1t<524MX8#t5?xnXJR8ACwIi;#CYJ*x+q;5 zWP=vpBw=>OR4CDBJ~I#Z5|!z{n7#z}u96Z+Q}k-}VBKempb8UN5SUnN5F{zGwA8g- z-CrY$2x8{p@pu(V#)2<<^&4&F$O{5h6B7x|tHC0?3117|si<3s?4wPI$KDp9a~v$4 z94=@k1z0Jl53D_oc*jI@4E~ZQ$*bVObFYM?5|p#GKYEg<^ArJwjI|D1TAe7uZ=7iI zkh<;4MC4|;1%Fdlks`m>5G|7VHt1dU3Qzi>zz+Po89V0npk%sG#up^B&*EAqmXMB% zgg8$scd{^v7Do%36w|Fjx>y1g#?7=cU3iig1WO(O`iBvJANu1>fPX}0=t68@xZ5iS z;g%U$lzhKHnzU+m%;xD7dpsLYQa}$&?kz%OpcD~wk$ljWH{X#}YM&Nf)VNt3M-SD1 zzSzqQr%Cb1b+#CAl%z%ASqe^5Y2tFi_ZhWsF3TfEC<}HsP*1ACwBxIYTYJg@36t3t zPh2x^*5&=3YUT8c6jGnKFR}k~EZ8k>R@46kcLyyVcgNiGnHuW=*ETIvRsrE*VuEak z3d<{%eZilP_F>x4WlO{<>4S)AbZ4_@yGpcNq@UpSi|gFsb?`iTW$B(v*^lGJY*PUk5-pwC1)d(Qk z)={hh@-fZ7rT{K~JE&}W@@uFOZUmA*-OF6(mzMSvXo&~XtqvNm#N~^Wss?2yRq!A< zF9irv20-dkckSkW~!UhRblJf#~!U5m1hPu2m6FDfT#2mq=xfPg!v zRYuT0Z(XKi#SYg&!QiSmld5f~RhV*m_;C;1*QrR{d)W7j)T|4z)12K4K)SxkVWZ&1 z$sQ)#QrE+W<-fQi^vyVlSfHQ6?63WhD?wlEl{wBU3#xe%u}|RU&q`M~Max{ZmU&IA z#YnwUQEs@~UX?WgYkk#$e|Y)_Ym3l5iN)v=>D`1xH_QQbC&I z{?V~gLOg=`JbQ1v|DpaDEQJZr zAoiXDrhJ4u0%hmuY=doDJJ8s6y#@Xr4F~=9ML*{u|%>YO&b;-yieDWSs``>kSwI@>kU}i=Z(2BZmjW z+hqHJmaGbO>V0>E3_AMmU`@zCLJY({&F5{Z``6Qnsf)mk#wl)M%g7~BEN)t2G+1c& z31ER1p%5*Kc?N(1Zu-EkJUe3tB+u(M;V7AWiT8{sSu5L#4WJJ<24L4{{0*Q+ZUb2D ze`ij20-U)(3A_!ti1oIjZhdqC63r!95_q^b_*@!&;DRCn^;-_`IFYt-aG^!uM=Ese zd20+%x$2nFO7BuW6j#MKEFljkJmFpvc>WrC};z) zX9=h(??`L?g^uY?8ed=*Aa{m*$AfmX%}QOy#|qh$H(v9ReV?S5JN$ilmMdA+06rrE zWVYOBg=`q(QRsXr@3Oog@GA=S&aAvpWpD1)1F15g;LR~BclQEpR5M?md~zADF@69MK#|d%QsCR$8_$Fa zOwe%vMM(|YfMTdsSFuifSl}}?ND>wi*_R1Z zgHwp4KJ3<;XTJ6EHd%2DRuU;z%(8MYZP)c_OltYJ+ZSu^NZjf5Eq?z%Gxa8U#4@s;`x*p;zr^SUPs`W%!Ok5<>8 zY^3vv68qoX5F)z*J%9IpiD7unYjri_SMa}!5-XyuZ+f@?aMu2#NiJ^GU%PGYC`-<9 z`Lb#CgDW$(!-pmOEGfS=kGjq(Ef+d{`M@maId*T@RQsCgJrFQNfLkU^X6ohY&h@ak zPT#tZ0CBsJ_nOu4m&m57Y&=%~CkX>@w-;*+#gffw6cYd%zbX#Fw27DQh|v^_dzDZQ znN?xddTU?M1O<>~qze?v;NB2{u+kKG9sFN50-wf zm>KKk(Qc?R?_4dx1c=!BrE>YbJ_T(xl%LXiVY*LnVFBSa!C_nJ{8TY4))$U#^%}bwb9FNU%3Ra6* z){Go=7*a#h*2xNP?9_V@#JH&c*hOc|m$=f1QP=%Cj>3xdW@n?#eIoB^;*FC-0lSYq z<;r*NfqA>Zw{8APQ+lC$y~AdR`9o4H6Vry!t489(l_Hbkfd1RJKKXx9Qz4BG8y3wo z5^HinBKu1ext~8T6l__h{&`Y4=KU=(^QK&tErA8Khp_=lPO*7Kp2IAx<#{*O zI($vIcz$%g>^*ZooMF*ekE1mmle)Pqds?5bjaxRl|IztmF>Fm0xDdb1@9=+8r689< zt}Rk&14m0-Pnur(oF_8y^>cEy)p++0?rJE1@q_DQiMc~oyf1GT8nAwxP4mA=%fNMD zkdrrF_Jf$HvLq`NFnMp^ZAMv=v(^iJ7c?E zk7uX2boC0|6A)@!ofWsMbOS4Yy}m1F-N&G`8=L1m9Lu5fPS1G1*2BaPgDvg*Q3ad0 zadgnITwa#?*~LuSyk%rm75)BZ$vbAg($29t`7V2S+1zt&FaMSy@-@kv2i>{mBFp!G zI6B<7Ix$E!_W3<~z8m91a!>m$ad@`76xSL46bZmf!T6uwD?#YAd6m`7Zr(%>2LnInNqhN`an%@ya7GB-KfR@iW{;}h_hgYun~&dg9?7i$IS z^X{LcfGSvx%+DJ$)IL3JKp-YQJA0>MB3;2POB@)l$@CK-y-I-lq7pt)Iv!XAh{1sh z&xIV2iu&@cwH8Loi|CQ=bR%@@zrNq!-I)DD*fx=@0V74iz7>R!=|o_KEg|E^7qMhA z5BLHTB`sC2T)MPY8^vT*-P&mdjLQ#8jzfSS<1R3hxMtn}&kBfBhbg8n4VUh36$Bpo z#&Jvz{X2uf&}`X$g#>xWb&|;V`{O51Mtiu()bKHJlV0q--glFfhrlPBkC(Cg%CQfM zfhE9q6oY-g4Xgovd*E_uA=|(|lf6%5Vz1?_;k$Ud^W=i0a=D_75XbMreBxX_sM+1K zOBQ3lC(929QBXNGKRV_$<}>?ZhdnoQrS@p7B~cXqpBGTjuk|4_gnBrw!LLY=8ev_F zZeigDwwcdPgWb$5Qh*jBKdS)S2Tas$dgKQS=zHvt9YJ76HJ}>o_}!o9B7FI&ZW#&K zz3hOEwK!U$qIEwGZUwl}MDr#-Nu~P|0M1uhE>N3I@sN3#k{-DCMfK>w!w*nsIl2jg zUVtY7&bNO`RNSI)n>|IV1Z)u8Mb|Y2?`5-(w>~CfNx)JwM0WH7jNZ@cy&_kRZ7 z7E@5RRm*97c`R&TKxst#?RJoSnnN%k;D>?O{s2pTI&-eR4#qge4_5<^Dd1Yi-fp zJE}%paf%B)fr)T>xL+0U1Ff8FpI-rUP5FH2lHy&!z51KYGftz@jk5uH#`m(r_aG)A zl6YMt#E|8#PsTN1(At7RAF1d8@_FO(fD8GN5Wr7b!!pc16_=e(vVqn+$O8U64<1Yr zewb%mbZToPpFa`3iVO*J`&HFcB749OaOZ!=%4VBKiWXvJQV&$}cK9eG7 z`pE++&)ZQv*$h_G^ibhIp2#_l7NY);7lU+J-CUsWsK%J=q6s1HlXdHjP zXCc#Ear*!uoNkFyv&ic7r@qj9BCm4!0yj`sWJ|+d)G2hWfT?8+9xAc~1aDrFhcE2Y z9DxV!`iIPrO-3f#p10RL+^~Sd+;<~G*J>nS4qS-9f${B+fdE3?E%S){goo-)ayt|# ztA}7BKR?5TYl%gG1mD;m$JWLTf^fNj4x^yPrOb_0SNf6E4mSP0PGz*;3)WHLt6B~lp5|pO;@<>Mz!(k=Y7xj6(Hu}g?$>$YFzN#A zEc{HTp%1B*A{ZOi)-XwDZhdVDf*p|69MwO8-J~g-E{g+amT`(IVDiAt|0au+ssJgt zmr7OWXGkwSlRSs->uU(e6!J`v+YVq*mA?i<>3>sodJ&=nG<<)nyE0|LLnvN>XfmdM z_lW>Qu$OG=Ny86@Us^)k*aWLb04Pi{pB{UL^II-&VZIT?6#Q?X;%T)Vf&_^QZ}aH8 zo6t;ZmTfc3k668+Nw{2~#KbU@MA!8ax0CN$H4QZkb9hddF#i9r_Lfmmw|(^Q&<#U_ zG$@EPNJ%%Sh=9@^l0(Wcbju(m1}dqDg3{96CCG>f(v2W6bPq7+n)`m9=gm3)^Wv=Y z&gF7BF!P%$zI*S_-ZfdW|5O99aZ?|R>7#@Ss+uW9v(QH1(tU<)^Be|6Osc}mT?Nug zJb8*T=tv~w>5}~psU5o=yF}fN{KB>-S3WZ(*(NjelBbo+VG4B%F-bN>v-%QxQFVsA z&+8C%1+N0uEglu+;5|Q%40~h_nQR-6uNXc^;jOg0&r41mW5x?~LisW>^~Z)@E<1H` zV|iZkLRLGG-xZKU7hEo4`hQ$A?PyZO-MOCdEk zgsirENgE+QyE+*Cn_5hqXIClY=x*Sa?9{w9|L@%MpuLT#^2Z&0yX7x_M(P@L;Uwr0 zC>^l@A>=(4X?({1bh|so7f)iKC1&TI*smM!Wbmfwy;31MRgU?peM{|5o^Bz*sX7;g zysYCX2V|N7ylFA3TpInr_w;AslEsp=TV)}ZK2-h*(4z$IBFa9Us&%>f zvS0X>4lcsdSL8R%g?=s(3Hct}xim&s{YK9VsZ>QMtMoAmTY68`6qwyx>K5yr=no8q zVZ+gZ18&0R)$L=R;|`e2!_1nA;y4f3(w~15{Jz}J9)r~0Y^NA2Rp7M)4wM}48>?XT z_0uH$u-HiBXVeC4ag#?3DY-TXJ)O|!AMP2}Ll)nZ2ZuwmG)bWEfnDf2C$dlr>7b~( zGXhs1@3+(`bSRt`;9RHVwweQZT{b{5Nn8cHDr)3P$FJC3TIis1E-QWyY;4rNByV~^e>H#Ni7}O z8n2Qf^Un2;o&z-;M+0j_NBssP#i5@&Ov>E#?tIJa^&{WljcN}4&c88RlOg@tyvL8c zXbe^pp?LV>LfJlzW2EI1+Te-4g+ok_a5>+UN$sa<{~?xt<~&_7f1(xBb{_vW_B?@W zs}>uXQEW?o#%nsDKTB2pNZz{Vb}WVi7qDrGTjam`0>-j2QBMxi4}L|AoB9|8gT2i7 z!)-*cP|o6yFy z;rBTb`jjesPJ=hX_nF5&sRe~BVH+kcmrqf>lbzetwK`?%PT)#_`uB2jgU3Q;fKFjo z*%tT}J};~=RCjKq3Ydd=DV^pEXoY$#l=fQwF;qemMwN$e6LAqB>qNJpUIo#P-kk3m zs)mJMb={5#c|*l69VkH1hWfxfUg&lQ=DZvy_C{smi>dIVc#a3%H(p;<&aX8jTcXjI zFN&Rp@lC*8kc}>=>$kQI<_crtRDb-~F1m$F9>pYT=^aOL)e^(cSOV)LPZv8y4VKm4 z8Jj3`WFAi<^6=cKL7RLGHB_hyaxSt(qY6L!N~KQ)cCK2iu2srV4NT=RZlFJK6`bzn z#qCX$_b0->H;9;gv@%R}FEo^ZbuJdV4Q%$(?r+ZbFnV^c>&raqk;FD>W&4d)1YO(K zu-kn~HRjzXoZ0Fbv-16g!{|5W+R~CQ!L13O5Pt`JYY?NvT$v$rEDqpORK*+j9JW}@ z2uFVwDK=YB8IgM=V&OPP`4$#%<8^tbg-OMEzn(I`EmnEz+biK^jFa#qF&nmOSSeTP zug{Wc5}zJk>c&|JX)!{33^u{ zZZZ?yX|OL7j?LKe&;BNuxeZxZwP|aPT{H3Bn%f@}&0guAls=6;T8()${%ki9ow7ew z7pb+`3JrQE3!CtY*TH9IDx0<|JIr)_v0A#fQuNz9C5c2&#^IYJ<^)W==GYp{27*_3 zcU#9egSTne*b>gQNAFD3pcOVNZ69e8N5#QWacHZ-)a?4{oO9QFMr2Jdq@0_s4}0oV z^(r}KrcT>U$VRSJ#JqWU_T-Vn)s)v$9IG_}yIDv>=;aI6F1dfCoJT;b@_@N`|u(60Wb~dH3w=>~zp{cI{@g)|G6E)rjzV
    VX}c0*h7V!NAeQ-#qhVi``AycO6*X2%&-KTW5q z6WBR#$YM;IjQ7N?ZDS)Rwo~W9XjkD!llm@I$RYiJDLPgi;*^Z-?#p!(5msw~sTqjh z#IAne-_>4%f(h%g3oq+D8HT=s=#RKB_UH_}8-;J~6QHeE5wqA;r1}Y+_EG0%8^W!8faz0tSL_5G<*_R6p(`mGob5 z&lJa$x!t{^iB>7qNG?=*c#fz@N<1>q?8XfbmrMg*{zEd;Owj_oC8QOJ`t!VqSS-OT z_8I>DLRb3@DYQa}_r>d)x;~@Ka@SA#W>VeC+2_?^!Qa^6W~0>Uuf*fn?a#HauN&{N zM9k>cy%sTaEjaw9<4~)ImOQ%P@(;|ADSvP^lC~qtB8`??P%stCRd~OlT<6MpSz}Gm z20T+aqB`tygAxpw+dX*8+_H(#{I#Emuy$YYaA<8Hpaz!Muiw^ zmzT5Ae}wox^jpr|O-g61v>fteWfghg^bj|gkY~mXOzNpWCF3USN_3H-Sb&O~P_YHV zKz8uaXE>%W-g7_WyGhM`w}IEP6I&aPGsA8jdW3}b?c+2P;oRu(622&M76H<*xty<+ z#57mhAA8 zQpUqO%tC86C)X_L*se5GmwFvHOAnr1$_Pnb_pCfWeO?@tEjgyV_boN2VlcgA)^$I< zw2~sl{h)Q}tIB~c48FA0$#4KO`p}X9D?mCyRo;B6nF51I}+p&;Y(f_0> z`$6Ut4Mql4V1zaaT=GiTT;0eZ52o>~NBf(FlR9Ptd-^2~3x1+61w?Y0E^-~riR9P# zJ_+wG`k}8pEbp{@xQ`;!5TFVF6D^%qdr@|O?``53;<|$U#qv&Nn0A|`iu2HIOHNj~ zoW{%hVA33+wcjIBb)nZ?IQQ}CpIToj)A1SRSND?L!Ne{;ew#V5OQnYG{GH+kEIXN4u*h5nHGS1;R$cT6<2T#L{8q3PzeJVU z)b-)|mEYt3j9B$y<$IfE0~B=1vmvnsx2!_%I{tHq?MwKFuJfwcyt1b!iPaGRk!s8< zADLG;be|u~ZbwW#y;iC1>1{5@Db^biO-Z6OBE;Ws8bpH^pj zb`&!nb-!cH2?^hrC^4egK9sA|zG|{M;h6TOX?dJqxtpv0lwrW}N~2JU_u}a`D;U!s zL7i2rFMf7YXe|cBH2-vILK_rn`G9L!&K-lpOHq-_tWT*{p^C?*oO8e2b$C_e19?-dGl7C-W7XN0k`K^GA&Og=P z#)r}F2twi!L78HkZw2J+vi|1F{keau8Lo^9zbdUU6)_zQhL><9FY$+*eK0hscucGC zDeUMw`#;B-G(%j9Wcd~Vx2|zUJi;pkFvC^sYZ1#aU<0>5-CwRe3-U0>cDIgO$8Z9p zAscLVk|fck( z8ngi^O5poKrR^thy!?Z(BDy zw4;efu?*V`LR}kJba_2|7W;`U_IWq?xC+X1rJAg7;rM!t`l-mZRCCN4g89gG`7>>1 zO+M;}QAwy_<3>jfe3YI5J!Bfbk8&c!?OU4n_)uS+2NXY5-+ikTe~TQ*3gv*3I{iPs zZk$dgf;XA} zye{x+>zWWUav?)1%?`$SD6(^IBkX=veKfgAR~Nu1cFPU&pg*_LsRWjIWZQsHLs{mw z*j0-OJf3~61Dp3wY2UqG-g^*O(aU!$3e^cucvJ0~EMnEto}q1X?0^-5>$d(8vvd&} z^GrE19h`z_>WFL2H&ES8d_zZe8Oljyc*7!Ruqm7t8NhpeOb7PGtf72$Ug{Hr6uW}s z+lNTSolSZT2=s5cS0|HL5{vEo++7FuG3}|Z%DqL_^>y)k#!&GR_@^VGD*{PW3;rq9 zH`WQ#I4YK|;;ugxD&{TcsAEIiDmAs-Q zORFFM+?QhIegJawN1%@QF@nU2#6OQPj~^ea!Bxh8M>rr1h8F|YyMG4H;3E|M{~~Do zKL@Kci6<%?!O^z*8LKFnF zp8jFOdIB;VK;?ud^5e~_ z#c2Y{VDO8{mlFY+OoMWQ1Dm&B?DUWpX>KP*Bf#cx(LGXUre zhz}_YMh=RG6# zo)iub9d_SX>&L@dCO{Pn0plk{$;cM=i1S_e$wGYNn}TFb-SV>h{HqG!g_VdF0r4sj zr4qdQRH$^v88F=rl#6YeCpp6o44J3BTTVZ5)dHsu90V}xDE_KH%TtF&i20$z=oij z$j}53;6CNtNo&+?I2^OwUSMufeY*gx_0_;7V!km}axu`>Z4Eeet>!+)0OIpLA&Wv* z%qzo^CFk4$Ij`M#hkNl*UCv@fs6Ve_aggD>)|1!VTSd4v_>meR?^oJ)$UB!< zFzGGEP2m;EU;qahtprli@IP-|8s4yjunol~h)GO>@5y!#LF|n@b{Y(D=d7VV4~RAn zcB6rMw)hwS+~%v3o)Cavd&GgnawioY4ra(jB4GuRp5Swu`oX%n{rryTZWwnC?W(32 z)HjKx0LDVBYmdO8nMr*{ADV*W!}m>K#tP&~H4!u|&0?c~_8@~&^rm!@uQwvK7x6}v5&hx~yl!EM7U;#Qj>ZUsb*_+i3GcZuaH?7eNi zL#^v@2Z~}_8pplcw*YweIj%H{s#pGT_BzX)>RmeNS`a(mr!;);#fith6pM8&BQLMYW+jdd1E;+d?)pEoJhfx?o9OY$LEwwmaXfM4dNh zFNPznx~_k2R?LN_l7@5zLhO^@_4ucfWb6cvb?@IjgKYm@2s*^c7nc{?5smSUz})p2 zqpG3h`+_Nx&iU*YdnRSjDDh_EX>EMcD$6 z7xN+#X2g{fye>G$g|be0n5Rj`MUu1ySSpB6R~5$xfa$&+VPOT}dMzB=Q#i1qpz$X} zggmEq{14?k;S&WB3GiS-F%G6Y{!ZrMVz*}c@)=M+P}v!FJ?jV z*b_Nr#X1tc(iaED5L5jF)Re@Rg{W7OnlC;I0v4_eXnowsJ%#TY7zZBDG-!Jkxfqm% z6s+mU;wOOtU-pf;Q;#>mhyeGf! z<>L6(anhK6SDT3Ol$sBwa`)tHJTVC70vb29IrW>@hE&37hO{XK?Egf8EOy8P@68aU z)$3I;`+YTyQWhYPZT=~%LY($eqmPnFLiF)oP=*X_J-wXoRgus7sWL55X`$lqO{&|z~Gk~Ilmee^9kEuc;??M|13IhTPV>^%pI z0;&Dtos^F$Y@F%(9bwSjDhdi=$9s+CO+RIfB+AA8Dp$;6u|67~RARX*l$i8|kvM&| zmO{>Sn%g`#Y?vuUFNAb7FZ=w5cTckN0CV|0V8MMv~8X24);n(r^a*CNy;wA zvQ%kAi)rX;kY2kGO=#dr)&swIwH>vxTQt`#EIIvn*@+(rY!1@O!}{tM`C&!iPW|%FF(uW`A#}hCSXLgu{N^ zh`lv6%$!7XkbPkk8Qa7MoaM0$X+mA$eMAllJ@FvN`O#LBey3A1kHVF$*P)3tVev#2 zgNuN-8djczti--A^P*}zrVU7_tF8M={OV5@Z?QC-4Ed_qWf*HJ&T(}down?TjHh5A zx%(Z^r?fa%L~B84*(s-Q>Ox~o#ml8ls!*N!vR&S;z-J*G_AzSny`5pv+ro2(TYBuT zLrmYCAuoKn^0yBX&oz$(!6$hfMUrFnI95iTRvfYux}fy@X4C;xajGeGPjv98Y1_dr z)xdgXCToc{s<%-I)u*ZcW|c|X`>5Cd?W(XLc|zNpD95B@^I4A|&i!+KYdmpvyQF#6 zq_k)mTD)CA1wLt%n%cRmc_Kw!+`IqWao-%#;!ioLj#=VkgOl8PBC)6xi5};=S3fv( z8>}%q!p>6+5_~0fy8P_vNm6a|+{(AIg;U#i-XW#qeN!noqK>dNG8mafa@w zMX1pPNx4O-#guakdrm{Sf|hAj{s6znrYz;8cC5N0`|BOfbl=JaGjJl!Wj=(Y<17l{ zmCmimfb=E7{4i4Qv*?HEYXn|Qv4sA2&(yj4+5SAz9%k%$${aF8|Natjal&D6^;BaJ ztEWca6prUbx0#rEqX!Uzvc#WOJ+mcBLJJmTEnbA4@Al4+KA(+`265g;A`5tA%e*~* zZW8Yh??m=2wTBVC9}Glh=_>wRUiatXxfMBAud=(?mPj$>hvkul^0C#!LtocnX}|Om zoB#vHku%RXSMLSP_rM&tc)3TR4Ak2Aln54*>sK^Y%xOLdib+RT{ zb!QfM6Z))oyaqxz>W_Hxk^-G_Y@0%Q|7>kjYhHhUuIPa%-MPDLO|N5rUP;7HGnnki1cm4MhW zY98!4cPA1dZ56GW2>C+mck18OPwZTCwpQ-_0>083At!$Ei&v+|$93Ki1O(ba+Kl?B zqS1)A22PNK_$5a@N=Dh!=$fHUROT#s$;6p2c9 z3l(r&u!)L_Vy3bYb)^t{I8B2zBHc04#H_I$b8TI#uulNzP(KpI5z=0o&(&=T-i0dk zm@FOr#adqV>uqT7j^Qez7Yja(@Ml`mE*P%~x-nx2@{omF$TMinFT z34X;|=&;;A!gl3Ecxgsq@NxG(2Omj_2qgx5{mZd5rZ&R@)o*&1xbm!cyaPX05Gs7gKb-JvynbKU(`ON8RS<4BP&@sITT zp3lrld>Ed%$ghetjYxS7DneC8-}PDJTxzw6V&>&H(A1jOa`pyQPi`=8!D?sH&pJ|8 zlAx9y=_fylw=KD2S9TUTD75ixvK$u@nF%GuP-;Qei1T&%d8nMuqQ<-T1_xN!LuP(r&gNd13Aq8izi5~JP+~n1^eE}3|55i z!b((!9TZfA%gOwkAUtm#x2rr{sbFaNL%@wAH>^Vc9FAPmEHBe^Y(wyz5L9TLBXW9D zu5A-lNS(ZM6aTh!ziVd*gQtzujDsvqB~QD0c%kLV>aH+TjAYH6Gu@XU{xO<*^+Obg=!OYeMi>F9km@quQNuy*GKhh&1Rp=>tvK zktK;y9qoc_(uegGRdM8Fk-kyP4=2^{QRj&KBoHU`sZ)}WgnAuHIL$ia)XOUbu)LzdM~_Unx{sB`tkPcOz$%>(Kw>r+1@{U z3p)k~8Aup8f2zNN{J!27+Q+}ec^{P0P$FMRK48+E5 zci0yv8VYWX5s*D53?L`{y&7>d=FvRug#PvNw*tWn`(~(9Q-gC%radkz}xZJG+LI^my0q(lgYQkFj(-hk47->TW|MIKOy>LUfAt{sSyQ%GJWE73V0TPl)6NsG zTZgJlULV!uYJabt?gO5Abal%T`ga8d+`Pu&JAcSL+8!rZ@OMT1kG8e!HwK$tR}qVl z_bNcudQI8qp5Oe=By8)=CIhRS){XlahaSPCR(lvIU0?76>3>;oSsrS_=Yh52*RFL( zfDV8_kQeF&e^4j&o&Q;Gp|^p-2sf_hKQj4*P{VrOUp};H4o@5{v-pYCW-GR-?dC^W zI%mpwS3cLGz(o_zu@5(7rk3S}O3XkW#R1JP^hRvL-Bi&2W1`joZ~coP1MtNI3GEicgvE`rcbN7rzgsp8 zrR#8Be3Bk8GdhrmWy?gosxCGi`h>ED#pNxTh+1~lW`aRF+g)9naoP{BWwg*vY$>nA z1j|Mf&TK^|u^=}SN-5(x>s~z55FW&);vaPLUPP&mWsxRk4D+(ji|z`f#yeGXnM1({ zyk)#1i2Jy4V+3f$JDA5cAyMD|VtU zIJOlG?`=OpRimfinjP@wneobx+0*qY$vHKHrC1bd?4vWIWlQjjzcZrEPBXC>!W zcRc@aoHV*2J2AstU74aUwEb(#`^iwv@rSVA#rK6RTq;G(YG$e3O!`ZeKi6N#`Q?ZS zF{0T%Xup_r-mJ|1G!?1x$1EyTuO@s%W*|4~H)mZ{GZklR-`Tm$0B7^p52MJVLv*?P z5n`M6=#Z~>YCku%x`s-~?6_uh^Dvy=bFgY)3=x$RO)8SfkpUdRU927f))9iV5uvZq~kPpNUN76fy2V8bCV`)uHP zcx_*5VN){LG@y!ak^x!=Rjt>|7bFjEG6h-9;$s_^)%a5<8!?!)vSsK!@~(+-Fn4+2 z1)q1oQpQJg4h2n(sh2{>q|6uBm>$u)GcB&~Lq#9uHdZ7Cz|6lZUj$_&&U|yG07jYG zU06f)XD_}2(Q1*j+H;Jqut9Pcw$t=+xl5VKuSwa@uDZ`)X_1^VK?(YAntxt~UA7<1 zWl|@mSoX|bKJx2;dn3C7Q-N0_d8%6uNEl%yX;2Y+>*PV6Fzy%>yO`DDYkq9zHT27cx$L!FA+B0bq#Lu`qt4T zY-aQ4QpPxNeT7a`5qX5pW%Dj|78$B|%az2jaf{nQy!BSKmoVED)HTB+uO}8CvTfR~ zR@KCds&r9%J!q$*Rd#opFAuped-oYG|@HrB66N9B`>o1{Wf!HxA-kTb`hX*-n;~KNq zCtEa@o~AQ!6xk>LG*q~aK!hzs_qPaF`J$hQm{i%d^u4g1F(w25qnAKHDSgnTOK_L! zsGk<>*Dq(2=1{}b2XeP0Z*+YXU-vJ$-QARZ%G*AhZ{p^0zxt(^Ws^gU4p->Wz+E;) zue6e6N&?_AtN^~Z)4d+U#`On+ZhD4XlQ)IE=d>IV*s0DE!-Lbm@xS%;8^Os(&lL!$ z$fQU-ZcyEbv)CdDUif_^pWx9Knn<)wst$g5XVNeYBFYxV^rjh+d~rM?k@I`57;es7 zfBNEu(QCdVT5Lses^ShROtL4UcLW_kIEMWzJy)aDJ?1@~(XjRDyCp80gj&^Emn}8_ zCMx&EetmCIi~Oo*;M0qhwyvetB&$no90;A{It4jUk}Pl0=NOdWo3WCGO313j@-OzPaeq&^gC9yW9olK zzfYi-ot7s4X?Ll^KV11JEU&F7W?S8l^XBPPm9BTBFCs!RI3m@<9Y2YIE}Ji#IolJ% zM+_@5{L*(U=Xffc!`n8md7zhaT@b^{q;UJp|=Me_7K z5hMOyC7<})BF6nA+`P=_ZHIRGqQV96UAMF^F-;cPrq=sECDZ%cz@TJWfaYtIjO8Q|Rvt58F~F zd)oq+-@&5cVxemawqx)0v~oEh;LA8XbSp1PX>0=oa7PGA+|ZKnm4xqfHLb=@R%>ht zN0`|w>%5mk`;&FUk=X$!eniTc_j=F#tu+;hoH6mK!T$GT{uAx1>&S{wJX%8mZ! zDI9*hzudmfbQpFzsekknB<~gi<0mRO+$So~9%qt|G)_z(Pn)(}@h%bDKs%}ht2GvK zb(62|uSK?P(=!FVBtm=G6eRtYx2u8he9cq@!kWL7#aqdUKi#+{wN6AFl$Vd;#=-AS z4yW<#3xIaC)+1wyCU(?e`ZPEh*p! z>`dp=J(Wbu8~CdKO1TxbZ(8gEmdUtWq=gtOlQV0A}#=9ZnF5QpV zs5H2&y*y!{fbQQonQyawp5qyU}WSu^GAspKT8Id zLB%58cEhx^Y3lHcNs0S5z$TYi)&KmO!Jz;jKlnR>3xd>utXC#9!3=oj!hir(W8eAT zmS5zwuFU{9>1UkGi<3b?o~H^&3)D{KL`SnD$ytE<90ml!F;KMT0a$Lh>7^vWFtH9- zSXBThv&3=PRB+KYf;J#Iqj|k;cfn+9GU9Td3wwbJ{euvd#6mF8xT`^KWC~aFimR+b z13{r01hvdfDnSO$vhq=~Gc(RZjZ@-k#NMm0W~Vves)XTai>W%_4_N)a0no_i0p!~M zmdf=dJB>qBPp}}}w+W=J>NGwb9BCAnwclFd!l~FmUdMSU7PAhaZN;z60SnX-#1zum zm`~d4e&9%n3-43Z?nV0st-LaA`cC=-pNM??WOqrVsGWNk2f16jP$&n=aU&=*^&HBQ zPp8F+^Q~6Lc_;hlve?46L77r+C787g-3r{=ggIJ=kDCIysu-xb=~-Eu zj?y4b=4}d!6q{zdz@Idp?D7P$bRR#i4r)g*Gxcqzs)J}IHprT??l6LZ~@jjcy#KU^;)w&diiE)_3f@?29GAM2x z2S-dJBUMvB#Fbkym!ed#O%xg@z-`cMbc)kT7k5AfN_oV^hOOu`+83(ioz=f>8WXu^ zISx2FJ3PvoAAzrBCD4P%Q{_SSQOGDCNpS~AkqdW2Xe(H*Kx@ve!VX78FaHXF#-Uq} z*Y4xg^stbQ6?rCyoLnFhkMiLoRo6y~UWc@S*AC@M#nsvMlKUo0M8SPUBLFu;VJS&! zS{K)=dnyOq58cTMct<)_cu$BYIXxirb?h&~hh2KI!fZfH%qtQ(C!o!A_D%9kb-52< z8)gs;Kd;JhhH0EsivBhO5MG@ZS%7`v#qy3TD=<%Jjf9ueKGi-_#%|MokP9)7CkqiL z4m&&W)gTO`=@yo+O_Kjj)7!mOkUqR@W+{dFV-OpMltc;cW&l38uFk&g2cBLl-Nl(d z2o`$iLXx#&l8BAB;tBAd)B?B2KP8c^*vrO{36%UQyEmI-(n<+Cr6%aBEx$R>F%r z&t)jskFH zE*7SHN{0`)n0sDY(8sg;A^(FH>594y%6AdrwEjr`rZ1#7nrdVF`2IlQq$-yJggNFA zQhgMzWXS>9QKfpaq^8rvV-Ziq_NaC?xJay%;JdP`%3`YcK9n=ng=IKN_frj?ItOjS z^-tcR;W*rKaQl9e1fGF3TJ7EO){KHQMph*})&)Ns?J&s+u^y83;Ls4vDFAK)dtx?3Q_Cb04Q_ z{@|?nK&ATq$+LK_Rs+p5Kze;~Cfm(HdsHRDNeN}oz4W({PuR?Re_cGr2R7D0rw8b_7?fKS&h!xP5Kq$yX)U5?IKhyHLG(#Q3p z??mtP?(5$qTuj$}I)39ca+fcOW9f+;^^U@l1{DD>tF9nvhf+&&#VZV}!C8)LE{kU2 zC{%SY{<7B;yXu`JW@XId9PRP!fHaA3Q>fX;x|~W7|2<989TwxsH?HUZ`CS)P`8z8i z5KtMEv75BCOT{??iP)EaKN;&lPgO3~PJb7(bFvu6PswQ@89|T(*A%ax2a&KJ2+S^Z zWs-Q%)3yrA3f=e3&3I)h(HTt$BN8O9YPmxs_hIDH78RmtS964!Py$0?%=OcB@`~ad z!-%7jrjkuy(#?G3$D8BBadHl6NL|Bw`Q`>eb8ZYhEc)mnEJ!2Q+Y+7R>9Ty@lOLvVisRl5@{wD$2>r6IY`^r zXV4DS#QQDchM(n;WL)JB%93mh)c&)RUY1_P(aVo_?vPGwNx|!rb82VFudY^1HJDDI zdyvAh{3;bqr++eYIyty|*=es>Zi@1O$Ki{Ali9WuZw`tUQ%pdrF&R%AU5KYC7*kB-W;8{}DZ{QcaLZ6dws7B@;98Ac;yd_E23;q*{~NNcypiUe+8({j zy`1})L{r%j?AmPZ(D^tWCwf1F2#}>1=e`ly5nV;)n`-9LiuB;++&PJ_=v`A)SQGe6 ze~#Ll7ja>mMA1l7i^HFJK?wuTmG!*er6!4K^Y%nrkR&N!@-J9KPBLFo=23{7agWg+ zYkED?Zii>l{1k#7Wbu{C4oP=kt_dxvV&A4b-_1iO@nJsP!*`>yl1iA=QyI6lpk;G# zarj^?XOJ~87=HYpXNy%pGki56)|$LE*6q*b{)JUYKGw>^@?B$CaYERYj@S}JG|Hq*4V{!xCv}uOW3%bkyoO9Ep`hN-k z&vzLsC;orNQoto3_sfL_H$=hlTEp+_x2OL;MQO$p-4MW|x(dd*yc#~(e@@*%)42=x z{mpZ^zcR3DjJE}7Q2&h6>Rh1m`D?hD4tRY(8M38-&csl#bz*_EVc}Co+F|=YfQhIZ z|7K6ium8<-7u&Qe|I60^_W%ELgYy5obu?`QcK|{E$@H$lnaKb{!b|?`D-YQTka6<_ z=^Fkc5mbco*rfIDd)&R|pC9y+`YM1TEc4=!3mbszbhtS&0?zC(P?=ioQCi;vp!!P# zfN&4P8HB*;-!hd`sTkM`-)7KNZ*Ny_j!(6G?I3y~BJXW;C*krT7*eJv*FBj*Xx}Na zd2g06RchYay%ijW4BOqH3|afCu?ePKW+vrfI!{XgFr~(G#vTkmtFn52K4c4Pdde{9 zf_cH{Au}7h3&uWYN8F!CyzqV%SBH*)Dl5is0fOFCX*A9zo8wPa#X-GL>^M`<% z036W6q|{1YmO2a2pmE)|z!|-SXH2vwFwqZe+C2I<>ff+S1SB-8*ggGj(KHl1H`56K zIk)Sqjf^-I>gpR-yGx?JApi^ zOc01O(6i$E@wOURIq7@6{?~1sR{d{duNAm}9DxhR6d;6of+IPOr9rcgi+%$;xC0y* zSS|nlj3D0wsf($ivX=D?TR@p_Q53pvbUl}2_Uo5s3>YX&1SO0Xn+<|6n|ETmclno< zr<1=bXmbFurxk)uYfgK)9dH2IgENUm7 z+_UohP#{uCm04r)cai7=tjJ=-B7x|1tnUqUa$J!PP4T*{_Vd0;=8A*|ThK0zn}z)P zwry&LdE(gkI|&L{@UPy`{-6?@>gQvh&7F%Ld_qzsreHu|2!=Ug@a}B(rmW~0_PxU- zV)x;b$joOzPVz*aDNfzif^A=^F2kt+zWXv8QiyaeOss}`&~o>$prXy=-9*ox=+QJh zfwEUZ=Hrtx!rtHWYWzY^_I|&WaoN3s^*k?r6@EU_@N4E{S!S(gZOgEn!P6uG5Ik7f z_~%Q`uKVvtR0W$F!!cY8luz?H{0Aj2Dak$!`n>~~YzlkfCF>$Q#ZSl9UnMaK1-SAA+H z{d1El^3w1YzR+iW+@h#Be|&X$yS_a8yLHo$S9tidlH?`~7*_-ipPjyAJ-TzXA-BG? zGI8qRM(ubFhu|e<{V?+b7DyZE#gl6QZ?55@gTBtdN=!bPI=tJ;daIYSe(zbVcI1zq z*DdTWFkXA>uex|bHaAf3&-&~i($>ug%;mTw0oW? z8@BcinQ6WQI9-j6EOpFt*2}(V6flmC0Fv1V=V9KHG!3i zGF}3R<73^*+ckcN+C|16^8->TMJqgKpPuBxj+^CguDcK!p#E9T<$myt{nOb9Ohtg+%%};dIjPqIB-rLCjkUX1~mXU7$q%kp|>1Ce*`yQ z%X)Ke43|C$8OGa2B@L|FJAKj2?#%4m=UI1Tj5)< zxwiKyH`v|ZSlc7IfCb<~%i+ld5Wa zBJAk@+^vyzHXUE9rZ2Iq_e-bU;fzoSO^M$rON{*kUc>WGUiB7-KobWo1p=XEh9J zDWmlXqu<_)>j4wwS;e69?W5!y4f8qd)dA=y-(_4k@f8k#+!_;FMz)tYly9p;2$1=dV_YwB30S@DF0p7Ki+pm1_7^4Nn$AU>sT5 z4&NU~3g(ph^ajC-ZK#DZ{wXX=x^Hv_$DFjm8=2x-Ln^Ig$NoAH^m07X{JSc+DEE&^V>=lcRv zGvL?qwXOrbs3=EK>))6FDb2mdB>YaQO}V}ZC5+#X zBo!)(_|XdQCxaDWbuw@Ma&4ML^^0aqpK&fbeQE0OhwxFOEwpXxZW%A~u7X+Z?SAVn z741|P6%Ls6H|9zOUPtv0>wD+8ZDFzP+K6unF84BnSW5nD!K{|e2-u@N6ai^QKDetj zTpUoEP_)`Cc1~@PzM$>MayUcc&cVt6m87PiCXIl$IF z2~fAQ;TRYWtR!Mq-lhzo*SN+K#cZ-pTp+_+fjoaa@@uE3|KI;xloZn%emwP~sI|KJ zBVzfL_D;MxM3Nxr0?mgy{tYt5QVnCNv0Kr)2kGzy3i?N-<&NH%pUIT*GG&W`cq7ck zN30}AgtzJes^JKgBVs++OGoIZop1nOowE*l+0cAYV?PJ<@c# ze;mn>q|~mQF(wR?Vk)jEBSC%rnwEAgE$yGv|Dr1Q2yrBiQWEDE>$6XOTt1J})m2T`bbmERnXs)ewuv-d8;XWzWT-&?0(9;_X?85yb#=BIs;s$!o9 zxyWZq%qsf}uI7IU*X9X(Z?+IBBQuFz0a53Cmir`jOX)D6FJAsy>Sp75XAze-R%%Fu zSx5~UE52t=Gg@X_^0N9%>yXWc!tfc@TbQ82;H1_Qe7mD)aIy~mzleLwsHoaM{CDVv zp=6K-5v0+FX2>B7LQy0nN4iB|=o(<8K}D1f1r#Kur6r_Ax=Td5hK6&G&-45L&ztl5 zywSCkwO}@T-}@Wa^|`o|{s@>iL4F9d-!pUOjbz*wAEQUmrq1Rhj6zW5vxI{B*D_2{ z4|zC5|2vm~*cGDkdFww@ksr@3516qQw(L z^^rykcfS#>0=Za*5!7tBVRAs~Kp!v>ocgUsTfM*Yy8dfLl--blCy?q+HU$&lBDOZ& z-e=3M-Iq_~XwSW$qb}0$I|@2Z1#;;$>`Fzp)F+=fmiHRM`?ZS$>x*VOT?-yn^Y4wth?hyj`Pi^4CpW&a< z&j!h_Xks<-Z6DM*K0V`i1mw^`8^X+XJYC~Vhfns{anW0aem~>%FYlUUiV|ETBRdfO zMJ6)-HD{=^OK<(VlaN6Z*5M)j6 zTH)3^%`@3*6ijb%enZgWcRANAUt!9?4M8Pr2b#XgaL@Hh%~s$V&%Be!FxNpU7Rg+4 zXF}gMA|_AT%Bb$sV0KZsNvfdUhv=#}nfB3QGZ$PSHwzSJI$Rqs&*N|axH~M^9o53} z(qO{2lOP0skvJH*q-rud44QYKoiK=cEbFSjO8h0riZb;L_OwK0>f<4m6=_#lUmkb6 z)NM#|Fhz=4J_U}vU)oOU^|#bfh)?=Of3gN(d}4+Bz@vEDf}$PizW|>~c9Qlh;jKM_ zb}CB#!tOG#ugcH|S!z<;C8Cv9lw!oL4as;R0&9OwR1jn^ZI)SMz)T*_FNN-OK4LdV z+>Pq>t{nTtcpE#@qqFf@ISxS_6eH=ff#01W)o3!Yz}ihVcU!T{$-|dt*G~@>XBiZH zD=yzfl~1^|4sd6H&Y|=NFNF`xx6nW<@?!I6MIse@-N2?dGXGH|;qIiDXB;KP>-EZV z<2ud2vryVWuW2E(3XxOMhn((~OvM-9I{v{9oCN@p&*R44ijey$kqCAySeKWF9AEmd zrj393{B?Jjux@8u*%OiS(R18Q%Vfz*vHD#VNvnF)CE3Ytf^7T*ay;a+%^!9u41Ch<#+tTON#Z2-fa;CM~mYR#u#KsxujRcxj`riP#5Bn zxKSn%7T^jTL3SE;*)f8PX9g04>X-}SA`Hb}r3upPfIb5z&zgh~WLt! z41N;p(CW*J(`i)mSmI-?3Wy@Y5y1VXUeGm-?SS{qM$rQ*`fhXp^d&8t|Q zf6{i|{D#l+?VhMcvr@}>oMLX0jyqHLFrQ@kOSxgsVsA%&Iq#D=v+=H^&ofZ}h~B+F zWPy!4(J_N%jq)>T)F0PhZxvi*h?n-1M>sPj!(dw_Tj}O?$ zja7RCNK$LrE-%I8V;YW?Z$!vAkBx%foW;?7W>U-ftx2AoCIB|``>yot;x6rd-AYUz zY3^_zr2W;VIPsM~LQ{cuB*vvaIir^U^=#6aln~Nk5bWoDbPC2oYZ)K{vafZG_G3`8 z#yY;m8tQDv9tkn;b7>QrE3jss-`e5KB|Geh4pz+pw5 zNIED(-Zj!*f?&NZ^NKn5>?=6SB+a6i6nMx_7q7ak+im zBie9exy4gJf*N}95JE{yy6Nh7!b+2Xk3PL6xtlUD2w% z8Ft4oYw2r-2O(ZvUbY+ReacUvv~73!ehDus=`z`bv+9?k?+b9g7npF>k*$l zUv={}>*yD`nhqxazWamgJ%fTs*j*$S-hd$Q^Rv0v?TbCnluAejW8&2j5%&8q3ewjk zXz`jIdbcBHf3Ze0zXk@|wNWMs`sy zFFF7aOt~ODgiaKTcNmm9hin49cXLgYQ~cZLM&47c+W=^8Syavf3!{OaVJs(Fe9q#=Vk6Ex(4uybvsi-_7jAs$7{>M4`64rr3T$P# zWwArJ4p=iDq79&bVB+}%N(wi@XKFG-&4)FlVsDn?PYy|)?9N_ZjDAX5gxmPHY>HnQ z5P7z57~yxJ;D3U8NI*>8CaDJXBJn=12yLKih+|?8C73^1+T4@b$kODrqsIkMM{MK~ zg%d;*rV37cufc?ALZa!w{!1KRHv`g2UBLEJ=I>(y{zy3ZZw*56Z5(^0z82lRsC->M z@a$;E?joK(?nu?Zny^jS6s59^{3fMNL?|`C3FC%lpkD6;(QE6VVH8UwqrRzmbD2vR~vXh6I9}B&ouBM-ZvUA)ME!d zbOnLapsa^ov^-PU#=%FkVfVG_#`%cJD485JvXrxlZCO^Sv(h0F#M>peW?+Iaxo9Fs z78kTdWArNU;rsQ7u?|Q^)1c4eSfu)>SfWLV$*~>MKRB=*2I2~i8svl>V6E{FcrZ<& zNu@NL_QAhNKDb@m=TLZ&f|UFVut$PR?yeM+`0V?sOkV~h_A0BEbg1jXI`xMy z>hbrdyj?hn_CW$gCFsUn;)s0QZ%P*rz!077va+{VtUPaK+k^%abTBQdS!@Gg%+G^S z9PQJWppWrS*8KX~U{1uwUDxM79+SUXENOj#LAsdb?j$bs6x!nuxucS*5ew#b1SO2u z@8mBh6)->=)>EGc;C>|VG?P%nAe!HvhUXa&Ks?GZKd(Ld2TlyhmOmVUC^4)uK7KMk z_?hG;X&|@tTaRel={fY%GgH4EwTv*q9_cIOzQ8G$;0Yo|w<^;|He)rG2s@_U5JTD& zhmsb5E~gGsQ{p}0ImM5Dc&}LdxdgS@2SL7&Q{Nk(^Kb;90O;@gV!pZ{);~Xu^A4TJ|D(PdPMo@5WTj z;4}g@caS7bJgF!D)8wVF}Z}&v-6}{3w7< zROg+0f<%R{hd;w3!?;IrswSqS3t$9)pyy6@pwk8lMQ7Y-zA@)k9pjqb?{~6>KXe!Qe0YE}&^v%E(W)(+{cg%9GN7C-{n>-7 z>8J%Vn%=zWp7r4xcN<)Y>yxn=&q=45>(;a&M>LyzduFR(7M;bjze-T%sJ5;I zjZ|P>e%~+y3X=7MKA04_%dMnbo)XsN2WL27z(c|haK3j0_x*b%Mp0<5bs_7D7=QG0 z;y%^Fqc|rXq$}7$)}s0+(0j zP>s`WndVUDP%QQxXEhyNfN?BSl<&3OPg2!;9eLwxCt?yJV;gf$q=p?gvS*a-`pV% z>zsGV4nU_7<9aN?{-ynS=|11z&^}TMG+?q7E%ydGoW~;7s~XTjj5Asq|DE^;2y2GL zwYjsKSOgzur#PpseA)#7VIDZoVHhu)daPi0(Di%Du}lj0TD4hl4s)D#=PMQZ*DMIE z2~e=THH!c3=eQzwdZ{Jl+hyT(f@*AjL6F6@9>^geo)5*yS;%bE11d*79OjZwrG)1` zp-%fOGq7S&>9cS`8g7yB-=(J6kCB>5J_$W!-eGJ?iPN>#7j7B5U8Ppf?YP)Xpf%`J zUyW|a@c#971Vp;PEAfgYvzhPr_ZXnEch2Y*w9;ixRhN{L?IH~;#;A*Bow!BWxAAYK zTv3s&$aqdbC~j(DooVSiVsn|x6Q2>M%PwL6D#{FP?Q`0T#aNH1`YjyLlzWw4iiJsS z+!16uu3n7YL%KOqUPUOEC=!a;5g>TXl{jldF!-7J1bXpE)=Whqn~7)bQ30+ZV>Ahj z6)6|u*Gb(Ga`*8uP6~W2csxYmG}gLN5f`*YxBxxHj3<2Or-xq6+AOyn=8jOysyjB( zG%z;Ib)}LasrG9M&#nn$2AY&g^Hc(VnwV3CKk(=)44>xIgs%TVW7*Vt)3m7Dsx+&zYh48usX z(pw>e0pwdmV@x58J9m7^L^U*d0$zyNPS<`ZemN8Hk~l~+F9T!xK_l-ZP>j<2o^l~_ z3X@SFq%_-F(X~&trMQ8#cWviFgIB)%Z`f4~Yg2h#DK~2UIOAYk@}5_0iN?Oy+DI>j zVwo`4{{Blz%O_2whzf!YwWXH>qt^`DDa@_4}WGZX0` z7$UUNs6#1*a_zUJ{3CUc(7L`$f<4b>y@Z!jpq;Hwn5kP=Z! zy0aL!P;42M2aQ;^Zh25?6DgfTn+02}B5K=wi$p9u70E3RokZMqZ7_VZsOOk~M9UK9 zDsy6)RofI6)gBU_H#a4u|C0b&xw@s`!EP&Pj%p%R>cz`e_I%8$P{mV@`S*>@t;H`C zF?tMU49~JOZ6z%hUhIz3HuMlHxhbI8W!4Pg%WUj3y76&-E&(0L7(7TR8;#m3=?2Y) zhEk$NKf^-v-FqCjeKR#pNRhK9jXS0tAzXN+cb}`|3o6OcW|Qi*xhA(eyZjz2&53eo z*&rL_bIeHfssF?J((p=tq)vbWyI1{O?my-*$b&0lMgxx#x9spR))RMLDM1fW=d=qI zDFWwb9GrK80=PckDAY`cpL3BzLh-|?D4}53vAYmis8gyEEr5WV%V#}MM1rovHr^6b z5&V{5OzME+2gU14@jhr#&`#(+Q6F>rm1xJ84M4u(vA@mJbjooWt@UX(Yeq?^{ty>Zc)~G3-!2Vf8WUX` z3Os4AG5401MAA=$=+#&C%*p5$tB^EjEA_H)lRy4y;^!m+23x*OrT;Xe0cJG=*!mBJ?q2 zi{XO=$;$J92(nwi;cZ4IM<0#!31v`O5-7<;u2P3tlq?|OE5TZ*i3Ul?wvyV|%eamw z^#*0$K@ZINDp6E48tilO`z7yiyN9>D4aufLOWqwJ=Gw0s+0CY?S`}4p!RI$i*>{c> zzeTuqun>VyL?VRYVM4QoGjbQZENsodne=}`4KtU}# zXxJ~2taC@`!}k&HSt#1e#n%>crtw{(PRd`cA`MFV)qOQj4VV>%MT<^8z0 z^Le*HF50^>#R^;;48LwNn8uG2k4ELH=Fis72BkX z^)w@%$Y$OYmvMj*=O;(e2HV%+5)U|5lyGu;Cb^aYrK<#wJPImU$j2C)!xa7Tv&nEQ9{+Ey!4`O1T8`&{NdbNaw`ZI< zvDJ_=N}>BVq(zE{wr`E0?ZwC6+|^{u8k_|98LmDpTQ@w>By0&f5=JfOFJMi&P3{vN zN=n!8+VQjTwmXre(gys5noD>at|Ei)zR@nJTbgGY(5w>ghcV#Uvq9fOgDp5e-syRu zF!=8Kf3&<*zrO;F=W}6vW{xhLn4I@Mko$f>v$y^rIEh<>)M}zdEGRkl*>Bp@dUXjS zfphu`MW21!ILW5gSepx7a}#rcCGEF2zbPEe5t#K$V^hV{5#9To7s&poQJ(BWj8W5A zbAbHci`>=~feTY=3s7oSBwyyLB}?fj*T#brO0uKc;4>)sbr}BkW*mp&%-25%A}B4e za}YQTW`{9d$~~l!YxxQy0X@g9-WY;)l;1H+G&SwuGx$&D%vmKx4Eb2bLMTiaWAyI} zgpVc?=L0*>M0UioH^lwsg9l~%=F&m6lpaD%J;-;}YOv_>#YZ+VMi(|5f=~nLNDF>WI!}YIgJEWesJdVzprM@ z%g}0&T(QEHE>^&(f@vjVw`p^6S=!hzS^$Bo|L76kr7R?Ox8J0 z@W1U}$-9+)72?<*+6lqh$knf4oVg*;UkGX_k3;%3$L_X}oM47dHoV>k({14271r zKiN__kn7#w7XWLnI>zn^4&bs_aBz2-svZP-ww2)uool~Oaojy1Jh}OAH$|QFs<%MW z%{dW%*5_(m?f124yktC*?^h|sgnrql+Mgva${$axoZE~`m^h4;{;FIFDBV>3Wtif_ zyS~F>WLSz;6|}y{I8--C+TLpTbd`js<7rCO^RIA}(=EA&zeG%IMioxV4}2?A$lU5( zHHjetcgx#;f;IBo>%zl!kdL(i8cCUJ1Wla@JR2b2#hn0>odNQ&KPfD~(kpaZY&Z2j zRmyCU7_K+`6S=~7b>AP*6P+PVVk*PV0x2B7rT<<;OiwQe0hst&OkLS6`{;|{mZOVR zuZPJ^j@J|kz6Gms>1*KIF_+ee?$8L`Qd8Sj zeGgH#Y@3Sp8NM0Tf?U}H7O)ARI4m+650Uh6PJBeR^;#&k zW0pnU?FH{rzr}JC6X|4O>5KB0EuSWf?8gZ|JyK|X)^^#DDwIG(zfxFs@;b_3=E+Xw zi_XyTPc0WRMUI1h7c)!Vx0599UU7I>WGj8KB^#>XS||ZTg}?0t3!jvp>DT#LPAKSp zQVFS|qDU&Px2{z0$osL*fjj^WKk@YtV5IJdoP57UucFBE zP-NXnt$T~ytpfKOEhWxr0ZN;VH6MVQAEkoGbAXW5VsDdbR}0{ei_svD2Gh12BCvs3 zIgMq9PmH!*PYm+sUTg-wCMOUy+MsPY{P9r{$TPk0IgvDEk-HMj0s>kpKvLGJBv`Z` zI^iN+{acOuYiEFes*H~J&e7Gy{TBhQLX=kv7quP|o##?<)@FmPToRuSdy1Gvi0|=A z&)dZt6uFP$!<*@1L3&p~9zlGcYdf>e7>Gb!|M=6#4JgmRjx!G9ug12bW zu{c0#FwDQQS_peTgBd%kSV?MmbhzA3+p>jCw)gIfsv>?AS&cXMvf)@DKve zOKX<<)22-?10F~hABb$)h?qL8wP0;3_+8A-ZVm;o*EHp@0(P#|NWtKiyKgixX(0Qe zby3CO{1iuB)_bj##)*cjV%^V3cv?clOfwELEX>Z%FiK{(q=7to^knp8pHOdp@Bad+BT_=W}Ow6XmAIfb@^ z*_D>x$bA9k@5vlbPy{7&qW-5ja913Bf%0j+TPh|n-3Jd>2M+-q9o>^$p8Q+(FGrDC zF+eC+Tb;*_m!0lp>b=aUNLh5bSjL@`MDp z{tN~AzC=&Pkd8+HRymDP4iu*|f7+QQR|RsQy`1?Wm1}^`8W;NS*<0#J)lzFdv#!r6 zZ{FS_q5P8udv?I5$c((bCY9%8EP`5HBP^C`N$w18ewk$Od3}7!cs6jI+hrx=vDBB- zV*5YYXL+=H*gB5xM9JFG2CEG^&#mQ{BLDLrb@gTqsDRV8_c20VeU6@X9UrqeUSM0} zYxHkoHcvm>FAztAgSoI{z*}U&M%c(fD&3@motilKvsU-`n&Q2EEQyYRCEL|kyBk{# zxmk>&6%JH*l*Dh)Si3#N(Jv(~#64K?8)n>%CSK~ozMQGEfu9|m0Y-mP#&lk~G1~a) zG&s9Yi=FBE8ed2h-JhCm)!o_D(Q~vHV}Igia@7gv8Qu~P#sb^FAXeWUp45V{@dV}T*G&X>mzE3K;ls)M^p$JLAFk14~~I> zras_;l7jRki?^DIf;GE@)5OmhGLzcpI}DI)NWjIhjiL)T6()%v5Llh1|Gp_LrSuDL zlezb@UDP8i+2xA0)L5hgN&(P91ceRMS?o=K_t}%opWAIu@RX3f=0hkLLr?X7eWq^l ztpTiu?^S7~w!L`Xbu9YA_D*X_&s>hB2yDhVw2R*+S;y1j5=w}=N9wBCp@h;sre%FZ z{-xW$nJDQHlF*nEZql7s!josE{vFf~4|0-O=ui(uGfM8(eG$BdA`Pr8G@Rrdh z08xKUZZqo&R4-54<9-~BxPAdON>&^QNVrp>Iv7P2 z=2m4P((M$N2AQG^Qg?Df>z~)d(FVYm`6vAXjFkrgrq*iI#4F8rcjx4Co+eOpGB!ZO zu&iy8^O~Z-SckzT1tkTH7Ms_}K^zQHr`uzgSc^e!a$Q>Szt6@}&l{1%j+rfqZ}3CX z=__9%efv&--X}$en#ow2MO3=MB>AccdXv+69iI&oBJn2c3C)WmJ70 zk6)NSD{(rFtso5zv6x)z|7gYJRcOg^kZ#={C>~J7A7qfPp`LyoV>4RWrxidm-=6?a zIseDcd93Qyw7Z?Ei&O}bm!!EtA=S9;&%q7-+@`Jj5aUW`nyWS`R^17`@S|L|`1Eb< z{(|P}(w16DL5^6%?(4lKuPbTVF|V6-6Zve;MEtK&WjcL*FoHaicVKV-=MDvQ!N3jF zAoUZVOe_Ph`kKf7E}ZEuKp!HP>Uytb%8+_%%DvxXKKAinJ1|fpo@n6}d;6XBiE?M{ zqIUy|dmyaebrWe*B z5)?BBbYXiFodw;6#*^Rc){Q^dDsoiJVBj3r)SuPj>G>bROwL zAugUEX;0Qfydd7+{JI^;z-At8*lBafivL2}i%Q_56%EpGmSaBz0hYc2irgT%5dF_2 zcQVNATUvM%AJ}p>p6++CZ;rqrzTpw+vJi|P;mOQIbn;EBNDb(ml}7c;J57;9KWR8e zIgn&BN5D6H@DP7y(Swql)GKMLbz5nYfP{J zx`pb$LjEbDj&o_YJ}<|A%BJ@G;C(RrN7Ij*re^ju!Hs?%&x}0$l~8&Km#>K57b&H$ zZ!XCe*%>nZ1SP@^7~O*+{V>F2d_6B_Zx+6N{H&v{bVq= z=m~H;ObE_?##(wGJ{b{fZLoZfsXwv#^3m4#LDi)1*AHWNXQQiPV+<-eqlSxK{gye* zK<^y~46q6sUW;4VV$$hERz3e@<8mg}wdwB^KTPdk|IyupX-8MgMO#iHwIlOI)JDWM;^Y}G> zYN09?9DQ-_b$i(-SWB_k5+CL9?BmzuoUzP?z$~-syyzdcofk211oj^GRk}z1!JS_L z#CXG8>FG<=I1)DCeYazieZI{dM2oIFTpj9wAEO#*CvlYS5^usYu%|Hxz96qHdEI&% ziy5%?Vw%Lbe8lqfhzsC6!vV3r_P6lowcbG%IC7c`^3wlgr~D*|CjUvz4^m~*JSXg& zAj!$?%N1<*EyP|25*=YvM<3HL%NoZlYlIFRbRP*2=$37$= zCvUhoS@Q%a$?8E>Ob*rTjc6kc?(=_(LXh!`xO$RF1z9)>e@(1#afCEu#tVheQmL>y z{ST$TFh%!fqz!gY2u$#Ktsm?^z{MwdhN&i zC`E9tI)G$jtcJb)$1ecnY$j@2U;TefeG9)6tw7x(he}LNMk&cT&o)el({MQB0)L}U zaRn1TxMHGA``^;HDCC7%2>( z`R|IbvH%Cz@+C(Fo;he4vHL?hbw`T8OE6>#GeX$zw|OIx!fig z?f;2|VD$wzl(HaOn>715P^3*>suu!QK{rnR+OKfx7=DV&fAs_jfVdB{)R_Plig7h4 zL>ujGph_i@`>!8Q0;V_u`#An^kTdODf!`kof{Ui@aoB>tCHAXk+h;e$!PLqZyat_C zf4p~|nwu~IDSyn)-8Sn$Hom*oW3!@bSYjRwO!g*NK(0TP76pX~sQ-n)QrGzv3cO=C zKBPF8fq?9H|6S!&N7e_lO7i7k*0-~w8ctan!4WWqv;AMPgf;;lgyURO@FvlID3Q)w zmd|4#pI##-MzDqy0jN3_C?O{1nnO2~n*VLxf!e`!Oui?AJn3yl;KleUXx~N0yVQZL zya-6Wut2UkX=syX1-gkcB;Mi~u-#4oY{$L-4QmKUirPW!viYc~ZxO{gh;TM)3^*?Y zPDUI_V*;45oxtr;ii>o`oqOq1*p124%3Kmwk?nZgmUQzQ2iOARU?g#OIj(D`+Tsum zxa>=KJ&YerhO9v}__qHzJ4hp)MTZS}HJLZpKpAoKxj;4^jT1@1M;|MU1Er-ZHGbku zp|YOqwxIXj-L`2DwtTVw+8@YY>_Nv2a>UZbQ1uJZgJ?4Pb%2G~y8uylJB$9HcuF#S zd(&z?)xEEDce&e_V-~eYg@aM#JstQ3s&$~KmT=GN^&TRLh1(8r#>H2k?RI}vCvfry z%Y4)Ngy&Rk(&<~^HR)|cI6xCEKd1nEhKkwADh9Xz9)=nRkUxWe?!rkPaB<6G!lB~e zV9yVf{MDDXHn|xkKy3>OwPB`fwpvU%x;}P<4dx2b~i$WIV$`iC@nDdIq~H z2{QWkxBP7Y&8Zd3God6#*t!axG@Y{2yGUmmf!+{CTujVVbfo2p0Re?~TgmZgHHA9@iRoJM?d1I9zl?K^W z<7y(~j6;`PS9|XK#JwGwLlVwJsY;v65Py>{=2ke5IZJyAb}W29ivO|tfA_ieb81<9 z$kxqlNrBFe*`;MO;QRCh!&f7aWwOyHw{>r?mS<_s)mP7sX7I%dE8dID&5@#%C>w72 z?R_5UV-~I#u1mo%HHMcC9KrEw^pYe$KDg1*qM56`1+$@PqC8i)J2|1amoRy z-PN4ul+jG7EOu0==2gBGHGkqh+J5Oje1 z;^;0czCXb98NS#C+co5b6Yx-G9iZm#CJEJa9{~hWN5?MU{T#S8m+01cI?YCC5+b~P zY%}tMaTx{09{uTXr`@G4k#*WNn3}XALcX1mlBsm19hS&VXS^8f&?FJr{??Yr9)cL8 zcw*E3C&}3P_N{-jS;0L1MIRUM5)T8dCaTYyld@||U7E|9_A{voA$I~kW;C>5q)}>n zfSx-}ib**_Q|+2MXFTmLM)nUO^jRGAD>$jVKApsIf@9L#C=LIjgD3rd3L29av9S}& z)3)=IXJC~+-RfEIPNhZ(+l+^K9b7mD^M-@x&OWMipIN7?k57M zO@Gv*jL=uuibgb!?5CX>n{Ezl$50_ zMFWBVPMh1h+PI3n!gaY{u>>ChRZ+Eh-N~O%CXmD`?FQ)uj;+o4E0-8|ed4B}0FXLT zL(%}AxXo|8_;{p58b9$EXUPup%inqIKm<^4Sng0bN>dfGCVMoO%Y*Fmaym-RN7<3WO9kl&^nm=q#>4p4MD&GO~ zcCtnSo^QyG(vcoba3@|iAwPSk!Gl+EKk*+x#8T&$^WtC%mRz!E%}5;CCx@Xr;4IEy zrCjAH)sUn zaB2^#L)~!`g^@wP9IEI8VvaztPOk<1Wsoj!ZP52~(tGlIFb-*AQwzk?hf_4A+WG!q zT4=&q20tzLckGnwr~QSwL&zVJ_#6MCJyfUqBz+<}4BrFYLhs35q#HyV%-nZQn&%Zfuus7??<>_m&)+8qd+PNooTVu_j|l|ns{+>JubsN zM-tzkJ0jhahely?+v}(LLt9z`!bN(;C_4V6*}Ie`JlM8gny)>> zDf>C&$z7IulC!w`p>9wTlF_jK@E`x~KGD*ih}9Lt5ZK<)O0@g}2}O6O_>RUHoAyp% zeW+Bbz?ljr&Ac#*Tl>Evza!k%qnszZkM@7K2@ob4&?&!poYOQD*-OS1OXG96xj}UI z5WE|6#YzdSUR`-6?>cin?d0&s^K`zn99!Mn{;CN3W0Za!j4C&RKcyH=`p6Ag1u)lj zP7I4$Sw5cGkog8iR$Uj*+*IZAJk;a{Gh-<{EcwmvY9+yo1pXx|5j0t#>z{MA?eqds zyN;O$cjczKdI@(Y?nNG^Rgj{rto_69$7tmklOlDRgU#87Z+F@)P-?sz_CyErQmmBX z2AgS25+!BdsP7dP88(iOxJ=acZzM|PP5j7>sl0JU6Xz%P#+C z{O)P@TX@QHzrUj%Lh?iI1n~d28aS1=;(bxWp(I4hPJo;bMfDo|!-H%q!-8Qt|0{-; zuOC?(B!pR6-l+D;*X_63|2^orlIB%QyFOy1KJ7gp2BTaMcDqa=2-9{`U>ccjbhaNd*IMBIhCvKr^;O z^iQPu36!8mm`la9#~qh5F!`gyui|ZB=AQ^?q$BpPbxL@&-dHc6xz#H@ZE2IaJyLCS zU+!&_YX5_R!tj7Bo=B$gnl;OUKlR^{|3J0n@jcBh%6|FFQFYF>+`_n*X>Jngzs;Ay{jQ(tULd$5`d zMm}?D_c4z$HAO_qzi+_<+kK=a>Cz<&?t_^>`gbalzT7ovfTM@vlFNF)tjK(&s@U<- zoh`~`bu>+SbsKOmTHRigH11;^uTN_qjx#r|- z&hMxdKANVpI}f+I-8F(7dtzL1bG*!Y+yZR;s`RcVVcp*XkMq})X@qg*b(xBq7WM$& z6!RSuheWG^t>stC=+vyk2Ix14WMY{&gddMZ)RLvH<<{KRFL)YUaxQCJD=_X{$GNBp zeISK%Jes7uIrPN7A)~*JWAts*u6^FKdcd< zW(1Vw$8_(693r=^yGDRkcvkR8U7dJhPI|kY#pUQ`J}h578aCgdT;FkJ*~;6Lk`!~) zmnL`mhgC?t`#T(f==K{8J(Kd8l46OHnn9Lb4Gt?N37~am;+TuSKHxS44h=I#02P26SBHT*h2;1?r?G5FaASR@3wU_Xmt_Y@!=XRlexUbHmV~jpQuI@I0mx0M`f_7f zSzn$j&S|{1_e!CG%Pe)O(_^m!=f@re3G+MZgsQDM9I<6SucNB*f}m%IKH6XUPx?z9 zgzXv4b7sFB$r}qQ!SPNBYD8MXYJ~4gyu3R!nU0$&Fcv8dv!{n@}!_&v9 z`qNb@Y|-?N5o4b@2vOgY9-i7A`LRejyr1?pY#mtHFzp7T05*}H$LKw6q4@4dmtLpK zQ%6TzuDkE>%okE0VV|R%Cb4WI;xG*{i1`!LUc_yE+5OWVb0OGGy8`&ZD$Kb0S?I9P z8*?}13~E^8SOdFQ$7XGQfY`@ZUxW)Lr)-r<8^6z=RXL7ZdxvuUIw`l`@=RyAd)DvE z6I#k$WinOzk&P7R9c79^_-XW{!zWFF{Fdn#dJCBeww9qxZ|ebsu@H;}8m562cpbOw z+7Ks?U+c%>WJOiuje&tWTH^o|c@D^dNw;jYX$Eb^O&&Z11irbDK+sss^nsT42YAB` zfebzza%S4L$;KNLeOTZL@TS6x4Z{n;gy9-X@n9o@Tzt+G+$wE@tuLP#S7ou9;LbJ- zJc#Ka-FI_mWl10Bfc2D4u97FkDwl`mf459adF@W?r*tZ6;_}Ahqy3uY06)SD`&FXwHQjX7ao^+liB=|N7zi#}} zyoZx<{&N(|*c|7SLy}GjNwL$f@c8u|H~oT#cx!Uj!PD;JeJY+WL-5S?#5m2b8B|#2 zFbck!90^zGp$U)toc<&JTg!M$_IOMt`3HucnBe@n!X*4EUU1+Lgo0E020*j&LVjNc(<9>Oy`n z-+T!M2K7zXW<0YY&;!2)9N-A2&|ld{@;5p3OER2+*~#fTkSgq1`T+t`4$dfi=M{gc z@l$dlK|9~hcrNGqmc@)$ua;CeTJgULf!U1%PW;b8Ap(qCitOqyaQl`+`1$_OP&7#{ zt80&1)D@!Et}D1aP!$Y44EOh2^0q7ZjxM>5laA$;q9r%JFd6z~vFa<77J4{&$3{Hi zpiBvU(=gh3ylKH#*m#*7Cdo%?lk~fFGOij9h5oKeGn?IAo-rh9Fi_d#{Ma3V6eAR z&)&0ib}_G2S;1t!2n|T;m5CF(qk8j)$tyR=-CKMS91lf}JJs)**z@EGR|(2Jt~z-g z*r*WQ1y0@ZP#3B%U3-azkJ9Kae1ZoqZyCSZ3&D(+ZCw4{S30vQ!wVzYJ^E5`V9d}G z92BHc$an3`bQDJ&ZP+CY56;K1-@rq>=Iq(or4LuM>0>Rf)>-ziKUI2kY0E*V=)^hG zb($xsrf%*x=dR%X>z-L}$b!ERqcj*SGF`&T#fZ1r+e3b%5P0VInuhwxi4*XG{vqs( zz=XVd#UOkOH{9M(+s``;zj8jLO-5I6P%c$zEGTAMzBtq8htYS&%`%~v zM78cz$}-XyAyk~@pu2?48H%KPN3fk#!TL&XhmX82GuC$>yHtE(k(vZi2xVKu{o_uT zAFas8N1S|PQNO1uQsJlHr29vU>FT%k_uh#}$fEqaHI(ZO|2)>UbEvM+;!p61O=l& zMfYj<$mf#B>J1K)<&IS?HFQD>4w9#j*BZwk->RLwr1D(_22E5i?b)CJL<9fX3E6x< zZQ~ZclZb9B(rJujv27l0=|2zg^v?U}X%Qh%_cbG4G|zYb4G9lIU3V+<33R?O*4S~f zYHRy9naY9ju!!BcI!zVtZ5F3rEyE)X%65ml^ycxrXHnheylQ`Va-Anj&5((=e8I9Y znjb)&w)exzzU>+BsMPosQZu%lD_-o-FdZ$8(%=43?S^DpsXLIt?6xYuyslO6%A1{$ zjRu&U>$V^ZG-4Zx%2Y(qJpqOeyD(B7O9~iWR#WJ20!9b}t~ho4Tbv4zW`MO|$_5yb z9$F1UEfZ)VagN1V{*JqU3P#>*YdGjuR5JFPpl#h#YVEC$0wdVSIt}BZy06NQ8^dSe zmR$n%t92ADxgIytC81$`F4MKsQD@(XB%YK{HNZz18U@pnJA8<;TcvL9$A~JowR*Y>i3&6m~=4wa{dT+QKG`#-@;(_o9?%JyY6>(RDHH0F+akCkO)tl6dIsI3mnE4V64dgERKYI zCq~z%(cgRV_#XYqB^W@VEL8M4=U{-LuzPqsHN;L#5(!mbC1j1;M+-a(keVskg&g3C zU3tnNfoowf^dx_eRce*=OKer6A&3ft)3CVktB^KVT2IOf>euJ@n$-=66#67NO}%r} zp$u&PRb*`LbVsU+2hV$Z_&dXM<%@$L!;$y5WhPT=dsXM(5QFvR_JhmA&;(D5(>qCg zB$mGK&&5!&U-BPKway$8g&bF0xAHS=;!|L@D!)=(`lGo!_DC(cykcgC9B-2<=@{2- znYqo)ZpD;f5AOQbHl^}9I9dEY)Up|_jC@Z{7^3S@-qZZM z+sa#Zk`~xIb(=j#?Ct%bsb@N;+Eq_1>fep<|LXX}VwwZvyh~K}l-mPOvmDc&YjXZT zKj*BWgYXVhmkm?KgW()vg*B-m@(A(jiyk9S&UoY{xWjy7;oXOL8G`6r;ShvW*fB1n zQ0;=dvued%#%%%N3jh`VjChsrNjcTU3-KVIHy^YP z(TZ8`Q>#;DvyirSDA5KVHX5hg!5(SkY>a?@PtxPg$#)10V!)huJxY;tuSwURoG;zT9r5 z`O3+8e2Q^G%hIbWon-)tY$X8poB|@oS5u{>u71+k`ygSO<}y!IJ}zt_5XNU995ewQ z6h;CuON0lh7;C(`5+UTJz8ZwoZC8cs2iSrf!!cX3>P>puGT-b+3RmyOB&ui#BuGnF zk6N<+n(@zuL0sdv<)FqX;kLIa+jBd`Be;J=cisWJOxChOz;j0$y#>ij;QZwvYwLQk zBr#R#pVCV;b0O6pXuG9#GIhnpzE;FUm1*UuG>Vg{=I-7^ukO)nbz{P2em2s_V{Zj1JKR*D4Gf*CW8Ck^UWz{8e8W_Q zG;CHAlrs2H+iTJ2mlUsPbL5-TYfv)r=kbk&8BfibRQssbwcM+7F@5YAy+mRit(@`f z0(+u{uN}XHj>5@f`hOcVMUn{7R&%`-J7fz`Si&-qZ`pL$-kOG#DtJ35I!#p!6Di6Z zEiLSwM29)RuLeufZkL!J`=m5Fetj*FDCHz?+2I|43OsKYW;bct5lHIUI$+Y|9n(`B z>JyAs{bG)IVY>1KM$GpP&!)Xo7Cr zta~LaCJ@uJ(P&DU*YW$~DdScQCxr2xgnf6x?>BgG7mNT7pL0?!O__ zCU8Q{1hs{^xtZRtlIOr99zH9cRO|%or=n+lNnr+>uHMi}`^E(OV7 zAPHz$aO>d(j2rh=2=|CHwdJ#JVlzfg;}On@XN+Y}#-F`|o`yWS4(%2?_X5J&u@~gC zvpS0BKlKPV8%~|Us&4W&eWd{Uh%GuH_dGrl(MA{El&?;DiOhV3$LX$;V4y&c$iTBh zngtyHKg_-PKa_7D{y+Ay&xDLM(7#<<1Oz? zOvp`5QjNZ301Z0yj$@M^Fw{LHjFAcBK6l=$xU0siHqYoEnP$#_B6ugutM8+raz`C_ zLfhSbX&}gxB5T!dwB44PTD0jv=>7Z)_EvulMA|Z6Ju>Qf6`--)JA?a9Q1jx%qTe6{ zk^V_}R|i5pwYa&d1ae*5X2rn_cT@3{a~`*_bKLe65sIoO=vPmNwo*}}Yu(FXHZ@?@ zr-00meO^h>xbB0FafS%?e-AOuPzJl2bM5y!2K1B+B0USBTLJIR!K4h57a?y{x76P$ z`V!+KlvF$5ztExsrp~oPfP%Q(^y-L*@v_>Yp8FNC0DVJ9e|rGdX-^enb4Bfdt4izc z5x_2;N^p2kS$&VJSp zq(Kzc<*_#WcTLHD7})8o2yN~DPZD?3-wY-*n|n2qN$~f$lo09?nCEkEH$WP8jPUe~ z@^4cFY_xq0BQIQ)i_1Eevq=j`H!db`CRR`EIB4{=@WY42@z&G+yrJ3KXy%-A2Q>l) z?_DLl%atX)xhSvlHw5#YYl_u;8|fCBsRwha-?xfZpx|sd3;m*aVaS)5Q}c(&Jgu;B zPK*o@vzbdU^(44OtCLfI1{Zo=o7IZl%f)hJI_(`Vy>|AqKr8Hb0S@R}CVn-@0J0S- z%E#emtQ>alrggHi8sW*W-O^(04=n!N$+*Ae}D21xF2t? zDYh#&xSv347W?&^%V1@F9}I;{TAO}DPJpe=2L33RDD^81#=(Z;jVELw47TiL#!o6& zz3KrIvoE{Zsl5divc+q{$;sK6iyTG5>q=Y|V0249?g}-Mz|lLCc`8bZ zJSbD9eEt(um@Oe^js!Z?h{n2OQ5pVE3?)olK9T(NSv zW*nN`+~s=TX8=P?5ZT@3&$5JY&<48%HvNUyWBt**6Ky^(;0xuqR?g30L#m@ADUjvf z!;RHbBj^b41tNUhD9`+RFdq!4W3*|x8}}SZqV!N{wic%{5AQda=Y2tf*HMIxty-CB zUT)aYQ502iIYsrH;daj4L`GiQk?CuQ99h1xWMUnl78A?Fs%rcfzbtkQtM(hh0s5Yy zO{Zjf8dfNM$kyJ4A3CF_XF+%Jqx?v76ffjJRa>NxzBNO>p|5UjVG@&p?+}=mZa!t7 zOHEHtuN3tD3%yG!NzX;hCqSL5SN{o}{aR*E+dh`%s$j6^ zSsT1UK7b+=xsSlPA#L2?n*$E= zh|>o`6~N+RUILk73~ORYZK!@h)!=QD5~);lmjjj%Hy2z;T^Tce3HS`^)$xru4vQ>4 zA}WZr(d_t~w{2>>e2jP-Q(J_iG*25jT6W@c;q=7B-z8^zZA(l8B18|P5KZvQ5!FtBzhY-9b&FX2Cqt>U<#E6+22Y+)yAl{IDVEu4b|*-KM; z;&adG8NtH!bu_n0;ohPaJ8GkRP)?goFAz*Iz3UVzD4-MtN|TvrUKz|jI1s-mHz7wr z4p^=He!na5Vf9M6rWw(YXQD`)Y=5BVA4)>TP1a9uP}c6QdpqdVF+#=H>z8O|AALi7 zV@mwUIpA+^e!5O_x(WPGzIYa1s&%yr8j)F-$y&jYsJYqA!1He&fFou2?2RDlK5(Vf zwY$D0CvJrpUn8=iY$aQj@}MF_$Yf#Q%NMfNXnVLu-PI zI{j%gYI-@s=KI{&>G|16eNDP*a!9tMQ9qQd5gQ~CQF@u<;UX|j;nTUIv`P&+vKNzK zNR?N*Xf@J9^@t;7UbFCcMwPozRxWh-d0b^TvQ#W(-u&MtQ${W_`WkOw@X-!YRisyr?_xactIECh2&7Mk@Lsmk#}4scxrO$~_x2ZL+zZ(~i}ZE{e-jW4 z%X7So9c)_I*xB@)d>QDMIrZ?XcmMfWu!&46e_bzJIJ%u@xzH9f#qykEt$xAl%07Dp zNA?B_Q@yM{>@E8cE9(B6tA(yX(_EM4yp~+doL#+8i;NJJ;qTroz;$0zuVqBBc2D1c zm|lic`b5{h0Z_gIHQ^8eymEzh6fIKAmB0XJXCi@w35&$;ZqCeLP%L_c+$Z6uXwOvD zA!@jL3buV?Aagfhu8OJ$4i$5@kRRCwqj`u{;EStGX- zY|$bNM-fnEhr8M#Tr38wE!J(@tc+O=JF$P`_gBU5bjANj&l5)v-7pRhwb5(gx;V~@ zBco=!6=m6<6HjHO$(Gf0(Lo$6`*B8ZI>=80Ks3b9fiF{YRPjFgdcgqwk?u_h=k0Xn zS2xQX^c^rSskyF~%DGJ&{p523H7pF9`@p2LdhGU*E!zJ-({`1IPIO-f*m7Q~Ffi7= z@gkwmfkKZpPJktNq*)G@!|uPEU`UZa&)sRrro%TKQAU(YLd?=A?=q_-d_(ymF>zX9 z=+WOb-%Q0@=^Q!mRfGtbwVPV5kCuHikh%IIxSsNEq&^A3-x(+`FOU(;To0%$P6ls^ z2_~<7)!DmhuWW#uO1e&QNWwerk*1MvVp;BWo_3oPk&hxyghTIgYy4ny03mHu@)ZI- zFErs<(0NE&LBsd943t}y%zyX3o}u)gHI|g^87Tzmh!&W(ry^3n6TA&@9iM%(jJZO< z(Tx<6+ep}nsvKG>&wg%FV$|;%Kti9&Z4!)eT)|Mw?ITKg9$eNwya}-3D#>XtRlRw; ziJ&u5;P#A+feu_;k!?a+#b{*O%mA9tH-~nyOI~~4m*MR9HhKSYnxy3d{z;u2)bZ0t zUUkYg`dqTvY6_Z*@O17&ZS)5AD|3gaGy|~!E~uMjbY|@g`_XHXuh&9!Pwa`f=jk9{ zd6pyW2-iv|Pg--+hhi2!$#I`kb9!!rt)=fvI(5}qU$qt*kDFD2Y>p(58B>h>zA)}B zdf&2x&~!9#1kIyO;KFPfwwe)^6{xESTR9Pg(;qlSt4FWwU*^<4kmfv07-8wRD793M zqq0m@syuC1JhO^mNUD2dujsw&H4cU`s!}>^bX!H@{cWFh5}Lt0!S{=!$Q8>2OV-Ne z^hlLA9M%RyFZQ>7h^J~;-YL5w`5R)R7_f1>U{2MhfL49i~MjEP~ckt?kq z!j*&4APFh0rrn?Xy^2ROw*s3M>3O|cVdF)DT7?Q>=X4T3IFjDpemxF=h)w`v*HM~+ zoDR^Z=~!cza!U7IXpdvBzopy=GIrip3e&1T6OqcMXedm&;X)KRsEp@7Xv2e1$>;rP z-(LBb7*L{fY?2!E5{e@OKEP)-K~xZ`vOvp}W|wyPsApGyKZgmnJVndGTbrLEE=RJ> ze=~in%~D@aGy{6~F8}e*+i($n=sVu1)KO_*`Rm*F+E7V4(t#uqx^0e_$VY~U>%owjaDr`;)iMs9g22_QTZmfiHG3I!Cu& zLT)i`BNN?K*2cmqg(uYh(rl4$r&G#HpE2$?&%(nF+nXxO)u6)DewAu{+)a_>Z!FkC z(;$o*4}TF2KvIgt6EqC^czJ%MTf9^W8nvD8X-Tis`>Qxy)n97WT)vE>SWpR!L~+cA zoKBQK$^Bk~dc5U7>l*=4Fh>C9a^N|vsZ1L<6;<(~)A$Ehb0P~_ak$BEu zA^phU{mUsvpV!$F{d%l))xNBd@WZx72akW!cVKtP;5NPVt_|GWfKKwYd>KIvI;mb( zDypENWws(Z>iqVW2GO<5Xv?bElx#w+B+2rDs^(2D1o~_LU^*?~4;9jdCD|$W0bW_dZP7GL#F@bFE=;<#>A)zq zw^DLI!8e2U#?d^2&fw6fl7+)Knn0-2pQli8vS3gP8p%jQV)nVWMcLdGTXKmGyfag%gpWhFe8gq06=wfD1?p4sBV~hz zGe-6nJLR7t|NdXzs3JI!eq2AP#LzeG!%y=l?%c~V0H6mfRl^4z*LuE@OcCFj-$mq2 z=j*DX3i^}>iWh!SP`4h75Z`fl`SPkhF;)}X@VYmOeD_HU7Cx;JtA$nMPhO|q%YI8F z0eeaJkFD6%%|-JA0iZCALK+e&Ro%_HV)9m;I8G`gt?Bh{YCU|Xf51oY2CUQPLS1j= z;uOPN^PU`*27CQ@L0;n-15uC&uUilwshmlW8jiCLB2e8effo*8X2&+ zP=#jgW0pH&3q9gr4U_TD)&0q9`CaJh@#M+faDVQt`6d#o&NIA9-5fCv?)Cah1d4_i3u5Z{IE%CkAt$3-?SM^h* zE9nwZF8>4-K9K)s2bjv(at|c_Jl}DXfX26qKU3c(K&6bo@jA#xOvgU=*CR~XsMj{@M3RxI# zy;M*)F$IANLTa>f;WE{{ka>+){TGb`pk{67i9%e8KUOcL`G0)&OimQcYLCHNOumU! zbLa%jBWmN_NXg=WE9vq4*8lP+sfL*t5vSm)0@P!gCWP(;BB&gjB1jy=&1j!yH z3z{y0ee;7(d-3{{?dTGx9ReY(_E#RM9|#R2C6uhj2)KJHVEQMp{-!`_oB3kW9)Sh@ z4aj=(&sjH5z#rHdntSK7GI9}=EaWV~#NIzfu;_%UlxKnY*7$pAKrzP;JwMwmQ1lLv zJ+-8qCdgH^2*&0ZrkFCz(Km`qhnS{DlkEpSTGZMPnb;Xuh76CQcIF=*tfE0M={6 zF>gW~1MHv8`QL$1l_xlM{<)tRvtzTqN=?qv7B%E8RI{bRzDaPf(@J4_2YY}@>|9cJ z^xi_ME!tHEG{@9lWM~ZqD(s_8?vY~MEQLS*%O<6_7p*k>2KRvqbvPqnRr9FxqQzhA z&N2#tb*ex0tgqCwvYPd1`pY7&puvb-@-t3Lxsh1se|+R&^D2j0sH!2ZRazu`H~DEt z#iB`>E=W?W(+3`e5@>k$KR>?hT=IN#dKma+*p~|%@IZI{ee9M|aQpRA7G+P2bg3}37eo}kmh$ehSw(C$L4x?yTRxu%kWCs@gkwX1n8(JD5Q$J-)?HMWy2pQL}*zpBjzG9;>13K ze&qI7vUGPCw_fidG=>fVAayB0V$5d6~y>&P% zQ|7$ut#UHh3;zAyF!?N&r29+a%`*t{sx!o65raGJL3`EYEXw{-;ytKlr@F((C3o?_ zOj(VO97;l69612v*xg<{;nYjcs{cU5{)WS7-*IC_EB3|zf8tC{AuR6ajB&Z~Y$|Me zG074a(Tpk=T-z(L8l-FSoT_FkoPTm9VbO$Wr`LMWPiXZEJ#s-dt8SLYaS5J9va?7Xlk7RmAwl#D#&L9*;6t)z@8A+wX>1$3YNXS`w z;uKtCs?4$eI9)#^{BSqSmGdhxf&@p4;KHiU$%%g;QX;(V2+P((Yglzc^6O`imIH9- z)=hX~QD{~!<}zw%FVG+cTM;4DBt)5(+kN=!cOPZJ+*(+g#N@GRE!RR2W!MIsQWxhq z*C>yK#L#iDosRG25zqpco;49s1=?SJ4hjIpxX3fW|7TH`pG2 zNym_VJK^6?9Zd6-(8R2&YU*L+qL*A_Knud}30EBiebw7?R;IMYD(DW|+<9oQYgAiQ zuh4vE+44^FfqM}Y$J1a-u|TQLk8}uJ%}@SwG2sQvKdw}8A+XwX({luVCYdyG9Bh4; z<2TF@D)07vP_k}G6r@VIiBIFy#7gGHmoRlv+0xQr6Ul}MF~^tgzdiLNo= zB=o4fPNX$x7=I>r@U_mlgy?acUI-~8BR@>Hy3%x@>`zW3S0oZYcIUs^Oez~%sOf?p z+Q{2SSDa&Uluj?KP=oJ+ehi9yPkC{{qirW@>n)14b$?WtyI=DeB!?E{0k+D&2(M7I zkwxwI)63N_<}W{_pY|E zZ?)Ovag1c{iCSCkj@}JK(38q+pw+Rb4=%)Y5K~cD$8)L?!`jQkj5J0WXknmcF`T;X zMSxXR!z{#15yyq&Zo}X#O+Qk;qc>y!DA>+%8Z5a=-B0fqkn`&je%1zqZ41Hk{0{vY z){$FZA79sK`{E@n4GYfD0JI|H$dEJEUGcdhIetYv8~P9C34~Ooy#jS*H*N@PJ_m5y z$5pgVxD)%9ad1vv%QTRCp9kSMg8cvhR9COp_@AHUr-yM|wc8ligswilrIt_ueqMmxt9WX=bdJt2X!iEr0%JAJRU?b@Rt6;+4euISMc zNAYiu6EwgP5Z=50%|SOm@MAleZ!Y>Tk8jI>E0qVvNWR(?4N48aVdXKL*l{Y*wo73i zxHo3&Zzgi%PJdP!wb!p|r}Lwc`V)yZB9i9g&HBxLsv_djdY2fZ*5Fsrs$qn6Av|b~ zs7%+Mnv7A)CYzoS*@b&ZX)$?OZY&GN2t3=cs<8{dUnR6!5Y~$Mhosp^ri|ttZBj_4 zXHrWi-}3<7+1fUD9V2=3H5;vm4vlE{KJ^gS7K| zoxfvM`aybb^Ne$f>(nhN^>RMgu*D*768*FDhk-10KE#gcKQ{>oNHe%-UV{kaivTUL zqz9`OJbw{HL-Fa%asi9jJKhN@aDxPbo$BAcbJ<)x4MgBn6cC$Ofk#caLh0VEBxlPf zl*924SHpoJnvmo4lZGdGaj+Tv=PzMk8p;1bjCksGXt>?R}RmO*I}_dI)9 zuL-W`?)Mo74K(DbN+vFTt?LDQk*ZJL*jJAa?7H4V^Ij2~q_3>6h5uthT40DO&|A&8 z{u{N%XZD<{(J$0~v&<)aq>t}}UDoz-u}@F3iYq9$&t=AfPRWwXd?0na?-{qp7Lnrz zy87I@;rA9aSY1x{3?9bU<+SHeOaPqG;2uSixSYwob5LIIS|85)!CY>5t2$WKt$oL8 zmO6Af5bVG~Hzcaw)$I9{$CHVzIT=7t_1kDAl%4a7AqCcDfxxRPKC7(uL-om~i^|Jp zaQ{Axpzeu=M&VMV-QU*Y+gN%2y^7f?M?&tmNJl|VZUY@!zSxfR?Mj}BHUgDg1VigE z7!QtI3xXVhl=eD+SU`SkvrWa5~!uxG4kqrLn1SrA3_s=>dn*$mT z+O9T^H&_%h`5t^N_nj9dCDgQA*ks0fsqrlsHJio}1&sjk#6z&-#*>=M#&)(|qTdI;TR^DE&C$ZO7pXs4!oNf}jz(WN>DB zxvd8CFW$hJRSbN^gvjQ9Lewmx0ViIBvaa4CN_s^?Z~HrqD-e3LIPo{&_&Jlw-UF2* zo*HaVr-1cc>^8>*69o_-*e?PsUd3)@DZri0`Y=dmegx=_`C;qg7LNku2G~lpQ^k

    fo#!Yq|smhp)g#qDoH{go;km)Z?SMr%Y_HzgswNJkrl8pp@+d$B9 z2ie*Mn#4Abf@EyV4L{r$WM|eV2LPPe@C)N_r&*Q}!MqB&c&=9={;20{1=we?cfo<+ z+!y5A>*yy2$wz|E+#GNW)u5DBmVE9MBC>e%J=vxyCkDC35M= zB5dqli?)`1uTGTIL6c3qGZRpx$d*_apsslz1h`#s~b-=u~q3e${kpb%gK6Tb{0Diz|(Y0!Mw&-K?4qa^5>S@;{=)n zrp)G1 zS-d~EA%%XVFt>*=BdyxZlKr2=dCOSsqqa4P#j;jhBAek&^Pe`?n~N z)3ycuG(S@>`mDIz6#&Y-Tu7ih{z@F1Pij&^KMS^zPpd))=}s4%xfrprZO{;eMzY9b zhpajmnWJ!u1y*Q7o8 zJC_fgTq+q+GvU# zcC&;bHoXcpZOIUBk~Sizrb&!lvaq0qP+h#k`S{b4!mWgbkX#vk@nw7R=Sx;@?*Nl4nQf$r8Zis$4V}J?@~=A5#PtP@W!Gru2&ej zQ)cFw+OCDWQ;CpU3Rnij+@(!X6yI!_Yr*f`VAi2;dT}VYvxVykt(NtFs1U1U+tcZq zsw?iSF5;Hydp+;=47{}K13Vi=?wTVy^EQi7u031xTf%eX?N0^x9QqZ;8^lM@%T1yO zS%t)G9w)kiE8Let_fqTG|5QuS$(O_9*aHqY1s_2!H>bFnST`od^8MlolDHN^f1Dj|XKB@Zw>$ZT zFguwdSMQBsZc?F~toe&rkKZI)3UfS+4Go`Klhat?7Dfs`6PW1vFFU$5bG4Imc15Jo zi{_-c&n-1Fi&0r|v4siikRD1K4X#kYsc=N>cH4)!H;5FvCY9{s9LvH%BDC=se5Y&+ zF^|M5Eh+lx{FGN29IZ1*>dcIw)o@o;+Zwyjou#*-LkYsLB#9noLJX;&x;(-o&P4=A zwC)Q?ZG}{o(r-eomgc(7#naedaCNa=Ez?YH&f%MIN??1>HydSbHwRMA36U?hzDvzrf8n#h^0@PubjNou zu7{;N1g17PyArL^N2JGE%vSmZukz3a!r?A)NCHiR#r<-AaEMR%mA}U?$6j=p#p25iO88s<)B0$x1o~_fnRqwX3kg zBQH1pT^?OsE5u(KSpbrfTVt<;&3eE2Eqi%;LsIA&)I+f=w|XN| zgqz}be}Hg|7SNQMzP9Yrs2NK zCy*h%ni*x03y1A=6}!IWs-8P$dM}s9lPCpg=IM-W(-n(;l-wxJj}SN5EroGho#p z3m_Pdffc{ejelmtwnPO(#Ui>RI0t2}Cev$Ps-dAiW7f~CEvjP}0L z#Vs1sp#e)AXh=?^kUqnd#@|#LRZu6cn=I?3Q@6kvm7d^b=5)N4%9h|l?xi1S*QuTO z{3r=wyf4?cvDl;V>>y2AE>;vp(Zk7jZW}EDziXo8E}>laf}z13*Z(uPa!R3|pK3Sl zkxM!h+c7cM-F!IC;5CJ(S}<$&rsxvvr}uKj^N3rtX{i}p?~zPVFAJJw)lMh_DMab3f|zg6YAEeJV@v*2q`}x(7`&P*<8OXclor-rqr| zUbC|;sqK@po;ra=vuQ4utM1#;u|=huGA7`J#wT8^`;qrqrnC0;Td&~!gTs|ItZE|J z>cJ=wk*_b(gGlbP2h`dXD5Or)sH7uCnU8Dz@J_*(T^Co_`C#J13Ti-Mq3fO_Py?oZN{R^NWFt zz43U`DI!cB=hYNoZ&j5@W_`-Q> zb7D+Tm7Sg9dCm${|8(fRoIBD&IdrtaN;(#HF3ub+tK8E2jBVsOcKD+O>=l(+OAd!~ z!XQEh3{hPp?-PxVcoBW&Hi_hjy7?B#oB&UkS_l$SwiDlcj0||gpT0p&L$^y^b&*kX zk{KsoL4%?{!nrg0hXu@krde5BAZS5ngU0Ow%kb3gvl3vwBPOeRLK_cCR1`97dC+2+o)E z6))s0*huZwH(arZP=aAdJ;OM zic;bVE4w7zQ1-`XOVKTR{bKBB;&|TXZlX{ksaV|6cTxE2s^>maf(YaoRb(|zI8LJ%1HphL9Pc=y0J-C_v|F~byW5A{ z)Np^kWMY;mPw8r@(liudjCp;Fu=d zWBNnvn0q2!n<1e>k+t{Bo(%R&G*p3RJ=DsrrZd-3b&pFqGIsrcO(NC6*n<%;y z<;18cX4qk!M$4rpa9UWH^;RRU&cP_f%Ozny=^J+}J@kV&up^yxsxzY3ll8GAoJakm zcPsuWs!R8q?dQozns-D)I^gk#9K`7>_T{AH46f^qZ-^s`*14i#!?JFEc8Jak7SD>L zumL#gqj~moOWG?h7C<}MvtC6#>I?r?!&wJ5blzgTcB>ZN8r5!kNeR0Utr`n#?ab(B z=tCp43!k+r8x;Yo4x}*Vye{=8jdBLX@;gno!3M-b46+I+2RLMYG351)&cuI(3fDLB z^vGYB=&l$AigsSH@BhP}{U0>(|C8{B4Gqa(Gvd#D)u8jRFtpWetjLsIFxj)FS9t2tdd>Ho!d`WlerCyRvvUdpi<1YBD9QKHuTLg7i40rN_>fPcMU+ zfg5gg-OH1oaq5W5d-Kt8Dlqc8*9Kyn2rgH%s;}vJf&Z+#j zZ;udHuUuIl2DD?-@z7lx)fv0jBdhG@{znY~>87O19Y!KcyV533(v|+x&GE{tdRYfq zj@}P$?L0F7??qJcLLI5n%ReO4`7JkbD}WDR2b!i`=LjPkuW9LC)*E)SoCigM0pNHx z0ibFtIRU^=Oc=Q_=j7i?p3e85=6!h%9CxnSrf-yp2ouKw_N}8{#q;$iq}Vku^71UP z+JKs&rOp|wwg4;bD@7nc=M7gpH3afT&R>92`iENpQhs?E0DqRb+*{`Kb(M!7U>T$5 zLDX}AFn45b1thlWDMF3`O(>P1MTj)eGVDgyU2r5I*nLb15GSB!jDbqqxnpr1Fi0%} zZo2PIRdeAF(6asr1;45SgvjGp{Dym?O?QZ}=RnUJU+K?1O^>=L_}c~mbNlJRH@Z`1 zCHqko{Nlk%Z@Tm#xCU~H$v`&i9~8V_WHc8zsG)yFlj)5v!W>m1^x*5kSwg@1L!tj& zOqAD4yg5P1dXAq2q6qU>=sg@U)Da_QEq4FSLd9Dopigp61CJteJE7J-`tf)M$~8xk z5c_6+OHinypWrBizMO_o3vJbNTcyLH+km514d;|R$r{?V7)R?^54zAY6@ue6-Y}GHjntnF<wPzix;0e8QF&#sxfmW=iVW%R$)uOvnUbDme4uPIgGNcZ=9O zTYq!{L>HAn?A3~QS|}rL5jkGhI{ADKl(;2gHWD;=3~JdiTdF|4tUbqCR08oYb)R{w zlKaKAl!$osbs!maABS}4usa4N1O+enE2Y^;iRYmf$Z@osKT5lI&_91?o6 z%eja3qM^fG-q33)1>#M>S-I9C4GfNsD1iOJk&PIT2X#f#{AV5qr66LD99aph*~dP=oIX+u3zL)_~;u2-03DAl1L8Ho@4ztHy8L6O@uHiw-1=}fS z$Y5V!`=SlMGiBkB93w1!4DADsk;?|Zd|ISH0q!_+b_^#m zp6zKKmLo4K-rw!yiTE%FywRKUCFPiI{S}VoNal=5AFhii-WHi_4CSv9s+LYzm~j*^ zHEoFhRqK#n2rX_+XHw-+@oCV}z2zQVb5iEgg}ZM$%O>*p;SD-2_ZR%um}=ci`3uJeZ>>d8n&)LFq7KO6E$oWxAWT{1z6Ny=PZvBm zatF+j2@rdlgHx8-TzJ6#o8`{d7AUa7`;ea8E>qhh_z*Ti=@qti-UKqLT(J&bQ?V!V zho?pe%u&x#-`Q5X2^B((e-wyjJ){_`EEjY(j7K$+3^^-hbYHhe4V-|Wa0e%_1$7W{7I6Oq2IV~ z;__AF?=5lwrIRkGHE!2R^=taqX;(-1ZBxepM9FsRw&|br_N4+F{11S;GAp^6PqpqL z%i|Hq#&!1-AGX=ooWg#S*@IoIefX*~zP>=%$VN9%a=3lb2tOQ`2q25%d(~6h60g@=OL#{E6%kf5 z^qDrYP4x~MuGZ~&2l>uCqa_O$ZGZR1!{%G&$AsI)ZtMR2>$}0g9#h`loO?bR2Eu6{ zk=sSapNxK2IyP#?x5h3*f?iq{A|$=v37VC0ZdAB_zCV7j6?D0ACvIg1)MI2N!cxgV zPMK5e@}iF9FSb6-P$-Vo%%HN{eH1Fr)-Ji)erh#-<+bJeJq}+ zy1M(MLeQuV(6s~{m^1ZT?_RLx^q8v&W%`&AjA4xx7^~oANo$E?Vl5O8qq+qZu`D9p^Vd;Lc zq+%lLbch$@_&ce5@ntcRsljz_o1^qKrV{V851K_P$>aLoOT6A#a$h^}3b+s}@%+2Y zt&Xfg8HwwT#Q=`xSG};&vm97a;Ow~OSOjG#ughgN84@EaR({1*`MCLUR%y3cY1{jk zf_7se5%2UWtcU9YuFWW1OYh}o$I-IiGoZ1wPUL z^-V1mcOTVCw;tGNj+}3H=&Y%=o5NphSog2VO>{Dx&Lf{=6(1~V+H8xd6n_OTQ<6RbDedH z7Xb2ZY|X?#bG}wtxLYiLS*?+L6|z5Fq>EaLQ(ZEtikZ0f_ptWb6GG!m0Ojeg=XSqq zB$DJ2C-q3wg#O(xVKd!qo_Y~KB*i9sCn7dFBWAP%*xxaWJCDhj*7*zy)n_2k=I2%~ z1kKC(1AT`hW>)!iKFl5aGY538-nIX|C&J73#I};pIcz&4uTG7|MIwAn(1( z_mklYHM@_w|zWCggoPQQU#_)dLwtXIF&guN7QcKdeZ_BBtnQDef-NN+Pfx=ehCeK;n`>u zM3nca_`?0qew=NY&+uB*6(suPVbN zs{M!P^354%TPkMj)ElAi^QlK472K}?b;0LBZe?3C1 zPA4UqPHVsoo5tEhcHn=qvi#(}G{SeyK(o}Dq6tgOb< z^oviDBGid=n^t$v)md}o@h|^vQDFq-TS23Z>D|Ll$to!u7g)@f2c^E)xvbveH7-Wo z_O~Lb9QGVJj$1D+#;U_3jQ6Og@m5wU9#g3mo?}^B#`z*z*I+d?3{B{W$=fwI;^nom zUol!#oLfO(*!6rLcT#139+UCn6QX1IR3)O74ZV<9FiPz0)dp|zc55?@Ab;dX9A*^) z>l-wE`FTm%Xc^o4ctl}X)-elkBFBx3uan{*j4RNZGq&IrOYH5*RL@5Pj0e<@B@hox zFqC7{A3K@ryUNdcJwAg@j;V>bFY-xC61PZ&^TzLtJ`eF8xvGZwg0dB?8A zWHsb|`JF$rwbz!&kb|LyYoB6=iXJA&d3Fw-ZcGj{Z2%;*|r!pzgP2= zecr>6d&D$%rpws^9%LVk(e_fY+ISj|IlS(%uM2WPgJT2dUQ>nVIHx5bc*FEYf{o<>w<9iNnjFZud z>sQ95NFI-c-+mWx8~{j_GSH)#iH=TJnx-<7pD*DpAUamJ3Z*~@VVwCxUDIfy8`LKK& zvA#Zjm6P}R5w;rSs>I>;12C{(_|{owAK|;rJ@Tb=x$cs!vqzT0)VRT?TQc|l`fke$ z(|4L5W4EMJTlR%`;kJI?(<$plmE$4SOSXXb@-p&_XkpE<>Qrw$!>WyV4o5D3N z!;GD{9I}r3-o&T9ie#X|Wh}VKsN1M&TwdZ=lb0nd1xdq2dFbwCKoX~5wvF{Ov<{c38G_r}L|`!4msY z;RDCC&kr+LeQsS@s?>6SQF9Kb{lHijcQ!T_a7m#T&^af@e?E9hITW1+Yv=#x5oH1` zQcF2EE}SbV*lbWyBAfh|!&nSSdAiDM4_wdpzcm*-<+pHXkC5y7D9{(QbE}Bf?gykj zj%hw;-1%TwRw}>KiaOr(=zjh*`cXs*I$l@D?kor&EvOqyV#=NQ=Zxjd?VMr8AUS zK8y9vwYN8?AXLAZDAk|Wtd4jVJ4u8zrmye^Fl<(r_X{1K2PI_AJfZpfGmSGXX6vkY z!c(2~4s%3E$jRIEsrMlTA+N5dOCgq-!yI=^*S=mo`2zAh{zsgLvA^&AzF%Ix=z+*^ zbKkSpwa)9j&Y#4wcv}JxK2mR{nBJLB zzE!HkC_eU4nX-Ec6*m$4Q~pBzsM>|>JoqvD>YznUAkEg_pA}&($lmg2`i**ZJ&eB@ z2@~QMO;S&L$GsT?@|ZpHgU#NN-XGzLOyrCkY$aYQvpjm!EMx*|x#gr1EHKH&-5HRpBzS&o!IoCH{Qs|p=1$EJfsv)29h;M@JLtuUZ%gCDjP!- zlN0f72mSf6ib2tI)|^l#=^g1C@sLrD4SFBLYqs-;mn2kp;m?Zl-ICu6v~8>U`zbk6 z`m)nA7EQZ`dw(6?(Y-I7zZkclT+aFhxQqusiP60J%z3fo-aqwG;tTZzACxp5u>kRVIk7TrO(vD$| zBkl3k!L%m&?i1VZ52(7<*IjA42W@p&W}Xq&eyD$U;?H?6SfuIJs8d$FWE0`VDsg62 z9~9cPKA7x)uS?WjApYEqCJw6rPKTEBf|1i zPP~JrVo}T(Z&zNHFS*Cm99+m=6Cf4E6y}!bPl;Qe_c`*Y1lKGa(=G9J5Z)(DE>uDb z4p^(r5#PHQ2M}4%=~HRdNCH~F5B)3PNy7&@V-MKa*us|zk|gR178DYSj{T4^}>I#k1_}H%{p1ReuZ`7e3*6Ylku(VynEidE-<2bAN07KU1VO6Jut2x6=UVH=rysr)3MjZ|FCuH-3%}{& zhMeggSpsE?gK4zz)P2UZ?mC*qa5gg+9m4_0vM6O|qwJQS46YuV1kKD&%Nrwj&JS*? z*~RcIy!U3e zj5#M2O|P9Ec(?jrd(|NonqEIY`w)=Y_VFd4YX1x3V)-wvsWYPs0=VBKDtTKl_q%Sai7Q0sZCT=@@vaE!9!O^dIGL8!C{Ij{8Q9YQ4JfB7tjv_} zgMn;X-R+2v=a+MFrgOtbXpr0JArDf&bKRsV7GGwAW9@(JGa@&t+Wiohsmno z9ljX?l$q`-8`ljUIAvGrY>`;Qk6BMSGtM;LJO*U|VzqNkE-1gvW@8XRc==kdis7%X zLPYcuD6XA;c1UeKXQ6N2bU(jk# zwC;y8F*PcD3AB+&)9XjCP^yK6+F3J#mK_AXJAhl*iG2jQiS{0QuOt03&qqusQ?C;s zAFaw|=!*TNhS>XbSB9{2BbH0q$0Danx_h^vu!_<apj~3QAW? z)d2pUBsNHysY%@^1YW3?c>ikdMrMO%#u8@-n6dZ()A`l;V~kK5*pFO9t;=? ztl9oxmwJW<>P9InAZ@GoCN=Oz2Y_B?ojM|$+UItju+h-P&tkllqF-9rHI(7Qybv}o zYMAnm_uUjxseBr;mE_=FXnBgIn&q{9u2|)*{F@G=NTeajV7xTKpQ2-7HbdRuWFr4v zn}bMG1_<%hK6jtF-^&=q6cVHs@`QTP`ag2a(s{FM0ctIzO47TRrx+^cRK;yrGZZ6m zxMckb3(uMUiN%z|Li%5TsZA9Z>XvxaBHrn?)t7j$5yo$mqpCz|SwLg;`V2Th2%oj0 zTEwJJ8n0R(q?S4ry4&e>OB}z4T^0I@O^HAr|9~KX5GO>yrC-_{a{P0>H|YJK8Ku%H zY`^^g4lTAbxy;zMY^QL653*8wx&5KOw3-fGE<~TaE^P5dPDvyS5-irGwRc((A5T%v z?Eu!QZtpakC;7Ek_cdy1XuL%C$@xxc`BvPfo^}R(6QEBnmQ5Q_kChv$rkhQqtBv5i z)?Sp4lFXs1eSf`=u)1Ms+pk2d9&AtG-hK|0sO?s$2MI*L^MfRGN+niG4F|l{N`zWZ z1IW>>)_Z${BM=upTfaGI=<)I9b%qHF;rTU>s2*YWRe|UMC>ux(M*0H$_UY{m%fA4P zTdWZ3b&aa6&bqwp=@1l+8c}UUhCot71JWG;h8K-@izNoja>5dUGT4rzSv4)3ifN)KTZ z%ZH+8>Ed32usP%aJvL}}?_$m*l`08$~5?;L6MJS|P zv-#5>k;~(T1wpHI-N@cr^{dZ-Y)-4ixgj6Q)8FIEf6G7UY5V@EH`$XnKdcSK3Y}Ao zv9xcJPS0uF2%zOms3$6BR$MT@nsU9x3NMg|HkDf_B0!7y358o^b^0_)m&Y^{2<@^c@F{W~=c1@8+aqvC~p{ zud(Yu4lfA4Z{9tZn8i_xt>|oz0nE@rb z_adTU%wNfghikv9HrTBr-mhkn``D43u%grgj{f2bchH0V!g((&`V)-%-ydmi%dv?z zy~>HsJ6v_$&@Q5{njeL+B&B%rf$lZH_Xye9-q2!nh`uw z@`0Yk=+cNkW`($utspOQ>YB!XI4JtUkmkJf?QMJU>c6Mk^WK$`t0%+f=TnSm1~Q%R zyY2VyBuL=8y6mFoDYFL;6Ysx@8X+`#z3cb3o*(9sPsgqR-(Jl-^VZ(TZ259|S}$71 zb?Mf5aJyh4{4@y!qn^eK_avmv(=4-(9PG7s zJ@1$0ylG5p-h4LzZ_STY`(TId+FEmcKD!|4-AC84ooN!U-}H82wu6(_jNOZC-A($u zM-p8eAT`ur{t?^7rwKfE%`hfW@075l0g@$U?R8?Sv3=Js{8k#fX|MP9x~YrCP9dD| zslvx6z6UKQ^$6Fm#Pm&FRj5f503d-yioM(858;qxTrqQ7ZkKP@RcR zVPr3c2j%6b82}u3=FHXcWt=8+g%G59WA|S1`h+S-W)23K)YBuG(WL<5TS+AlSvQFc zkn&%!twRonCVk;ern6M0?%qTtk{G(~z!H_IE8Z?##jGI>by+VQ$_fxjupi`1z;=Bt zxVT~!n*UG-l7HES?nFz3@s^BNM%Jw{@dcC`4E_3wa5XwNF+G``zNZL#a8VU+HrQ}O zRTmHB&GH#)$QUVL1L|{$PmPS=vl&$=Uemqn>iW_N4(-(X_C`8!I5hPqYbwx!^}gbk_}yjF@k0GcKt{SrrNVKGdb$I zDBP^<*nsD8dC@ljd%rs;Zo6BbUv`mnS1cf)E zde|kC%&ZECLO)@97|{?$afKhCa0Wbb1{0vR+xIUs9ZB3#gbCsRXTKK##8ivG zMsZ&|v3$)R-!4}|KGa2PY|&hw*4H*_3c6GA;gQky?(2GG6Lh|^4^uH*q!>?a6*&El z;up$bzB-M%%l)}GqoFW5oo;~AEL3Zmgkl!j^i2HK*C&#d6>#34jt#9x-gTYkO*o*G zpOv*^s>up*$2XIH{V}=KYJFHm<8qQWL~;G^Zq4E|xaT2e=68fgK!X!QB!KJEKMXGM zw0}2^;zU;cS}q3cWWZNC-TtZot>V0f_x4crZWdGcD?FBNu5bS74fV8hyX0^n3RPnJ zN%v_GR!EkS7ltt2S!r#RsGO!m)s>ceWu*hZZ*z%L`>(OBen$1J(I!8N7gwUHvhx8S zhhTPmQ4@`;vO?eX;g!5flmnYhYOftHxY7XjoH1?ew`nzueHy4gMjc#LIM9npm4?mD zdHRPAP=aG$qANh15A{8MBZVx`LC;))4vEiD^JeCn9mL_Zr31Is%O@y|Oo8BEmz;Y$ zusy?X&lCD}gYhF?65&^h`cmqOe0p{=?}o)Eb}UQHU~$F@we4&V;`ruzLaso6U?vH8 z0Mwz+sEdz&caQZ_?F%F#NVCi3qD?*gcegO*Kk#@$?fm7r@eG6FC5M{Nb=iNAss@No z<3t;oI$k#VL{w%LC->YBe*;6wYQep8Mi8KSoxIOO-`6_rme! zk6fr5%vkey5J=$)!ikNWE{ZV?Lczh>W~}()PlHA&Uk8mOt>)Ca!EgFA)k_R=i4@TUWwf^y;NZEE1z_C7l{WqBLf=@5(vg{nG0LxGwd+};lH9t=3L1mD?@cGqJx2m$3@_hN0$cNHJrT~WW zuIX{!^@X^5&G9k_(ywNlEx|Tw!h#t|;Q%({xyPsQ=G(6|$GLdxy6VgD+pO=zt^p0+BY8l0E6SRz=JPZVyo3I%*IM}{>OUvkd|i4RTcYa6HAj4utG!mUW8jabugGnMDe zxXe0ZoY{~90tQ3!1Kvlq{f+zB9Vy}Ey{M=RW&swK%z71>a5F+RJDN8iHCsR3o3#re z`%iXu3T=H}I&E_0L{sM4>Dng_EkV0?-1T!m3(^rqWw}^t$rY0Ak8vD%C=s4mY9TK} zs462s>WI!(q>*K9a`I6WdE9p@H`~#_Av&fX=ouwresU*%nfTGCT9%tHSR3Y{N|tfe zG}z&##yU>jVNBM0U=&lX9ymec_>2Wm*J+*x&L|TII2(=%e&rW>#BDqO=H+ZvE9Wk& zl5%LkQ*X1GeVjejml7>*yKTAWvxa_E!ucAKLyYxRzbXmmu0PLjcl`Z;*MafpME&Js z)@mMKpV&>MySFAn-`y(eKhepzm+eWKx8N;#=5N+)J4k2YZ#ACfpjQ53`s#adpHA&S z4j~Rs5P2o(?r?GHb)8yEauWgLIaGhBEt;u-DLM-P&2knvTDBg=Nozf+p*QDEuL$^MmWvFk=eyFVh^b-LT#MEK67A3u3V z(yi!qT6vELmfA<5z+L%>Qu4V$B@DbdpgHKA`{V*tRZ_!2tct?}=B=+0e<)jAUrf~$ za(b&(DatXZzkY`A&Lq@S7do6_(=%F(ue)=V^LjEpB=gX;g*V z+M-L{f4;aeAh0#3h3h*Y*6}{Yq)da)AaU_Fb}_%JswaeFSU!0k=q>#Npi~4TYee{6RWa>{X`Sq`BKfD4`We{!$ zJ<&7Jl03GZAYc9{Ni+S!63a9d<5srJL)$LeNpIJ7cy=OPp@;C?objb~(np^>H|@^K_h%BmdU_Nx^xpq#5+`2F(}Ci~WeBkEk+AA&|HzRX#XaWT zUsr}(unYHK+Qh|FtYRn-3JRUbI`K|TL-wnUTYB}1UC250_%p+@lX;U6?NZ7F3%}$( zshxz)I1pjC6ReVK->n2VCGQNTmh_en;tF>Y^d<$upSB#{V>*+~T?pTAqLg_|9iv_+ z6NoYr^s+Z=McULE&uuXdBYvnnveU^6rlww|`Of)bdr#pdmcp)c96EEztvkZKHWEOcxj6#kF}{H0$dEigfOM-wFuALnrPykOFtTp7@ZB6 zB&Iyx^y`y;yMB*RT;_=Pm|-D=t8UGG)z3)STJ~se7ioOpyDEUavOt1OutEVEN!7R1 z@&303;i>i=p22w4DDuv3%B$6C$YwHn8i$5-cg~gP)WzapGgjIRc{W-z`{pgo)P$4a ztYriLE<7g*b7|Fod4>RabZx^5&F~`KF4o~0`W@oTfy|U7qkPk(WD?tA+()CFO`7e4 zlg2vn%QhuYQ^c<^B5ZFZEkC%aPLLDjeSXpJ?ZWkzwuh>Jb9--!tuSa%d2BeO#Y5-P z_06*=t(CVlKNbst5_+Y>eXYk$IL#q>x-~PXA z*f;D+Zslonc$FgzEIiz$&sFl@+;3XxV}$j3q*mFNGXcsXKr(qKc0Sew_D(U~0@XR& zNG(W3?n0b^9hHn)4kz7_)!f@bLeVqK*Sj(fxQe?4w3RL3- zHb@5K9dE|NJ@%{DX$kGY|-5A%eJ> znQy%D9v_@mgPRu1wWtCTj#pivE+96|WmMiRxh~dPw5>Z*BwY9v@@mRfSrbxW8segt zIYhV(1kSCMI?=5$j1m^_NIFq)q*(t#hY`R4n{2$WNOFf>a8WE;-~Vs-qJ^cR@jw2% zY+!iIV9WbH-HIXts5pv3)E7CA0C=+%Z&WnG1TJ$jU3`KIy}i(Z{cr0;=E7~i!} zt!kMVueI^13+nFS)MB{!aLjZfmA0vB2Ck z!)eDAGTQ-?S;m$0$fHPatdei#_O%E3*f)hBl`+vuaIkym`sr)ZN%^I#T*drf|Cu z^FNbZ!A@0<2op2Qf(pjgRlSCukV5kXaUN}{ZLtwip-0G!0}FRr&_OJOcfl&Ip zP&d^S_{L!5>Pb4WSqG5bq-{aJ{imFi!EO({q_%}x;V2204-H34=J~p{?+rX`HAp)L zGXZ2>-1Y;Z#~Njfgln^IFZs3a<*ncgN|SR^AJuZss}WATofMwG`N1B#<2)v81js4} z>3X4`Z`*$K8&P0+mbpVT2S%t3FC794bz$8%_$4{Nd{MSSfU#m+-v!Vmdw@2stCqE( zqlvnWLVsE81WwM72KpC1?Te?g-}aU{a<--hJ9VS?LkjeV>d_l83Wyxp(Pjc{(u^sl z;wX!EJ1{)+DKxQxVOpEokcr>qqyOOnf4+X%`>|i2j1eSX%$`vdlonxR z2C69NxA9ag*JPbJK&wu>NKLZ&@#mRGwtMrcDX{6B+jvVTO7ZJ{TdMNNKoe#bBN96u z&M{4FN58#beL+F5y-m%>_6-XCFdpf8t60RCmbV7kZk_<_h3dfJkWzBi3id>z8@+pFONXl&}PGhY;o7uHfgzwnv2hf_tdeP<#Y z+eK{Z`S`Srk20Vy=cha@kQ=yvFPuU=b` z)<(T5hi5D?Z2z-Ll0-byeOEGg)?adCfUPfgz?i&Nksa%kPUkq}{YLLnb zn8+c(Op_t`yirO3hXC8`c{;&I!T;E4WF`G%t_+f?U*Tu_O>LO>rgHj{t%`81*-05D zafwCWp<(Fr@Twd1e=_HFY6P|3F}Y&86qhJu*r2vQhV&ESnEpB0%#AJpNXbTCL;v9G ztGD-AV3kGcErzw_L3B8R5XDN+_To0$**c%0ZpB>3-JANH$Q{FYa}h7z?@G9k=6~i{ zqliz4^H!cn3Bgwb8oQ^jV@q11X04NCW-tRmYAY5*cenmC&sX05I#+S&n2kWbdwp>d zsg%5*IU$Q+tbTF+r)JeR4PLFTTGA9VAlH3t3Qevz&e*E5ZkN|<2>1}4QaS@*bVw6) zdg|w++FOyWzH$UBBu!!>+tWp3z!Qr_J?Axo!VeU0n8-lz?O%I0ytB4aIZ3^^I%}SP z{y~BWD{k-o&%nZk04a|S0##-02FZ5#pH$VoKOcZ67$spt_=2H+%)gBHQMILPga&7V zF%U%Ih!I%Tk#bGxQVnmXP6)^r@gC7s{jfG!(r0+gNf*HJEB$%a9};3Eos?Y|nL^P2 z3jSIiNQZ-Ka*F@@bpw-=hi4#$11wJ2?xb_!p!>Y9u)hk)KzLr$$rh*`nQHP|*5t4f zV~1$prdewJY14bN|M#X`cF`~!;w2>PHP;PS89vf0@ss`Xu)hL@+h4kf@7+>ETA6Kf zzax0zz#6=EJ(77FN51u;Ue3+GmMVr=48m3MWHJ!tly+~$A@c=Elr4@j($~?CG#)te zVJ#n>?{zRIbvGje=)o|_jg5m~wSPh5e8l%}dB|~jyG3Q<=39N?kt@0Fd~MK42jk~V zRe7~g(8d&>fXZ5@D&*L<%YfLgn>M}}%}Hbk!i(V0#LHSY=Sybmbabjj?YB2`X_|F1 z+1HFN!z)V5grSl38A;E-N>`SFWqHr9E(*VM`{CnvKZ; zh^FUB@7?}QoR6Qme>I9?{=$@@R}_RyFJD{f)VQpWWISL8XS5sN(A&3Mb|=jP8U6?p zCxrw}=v9jZ6=ZWq-z85oq=m6X$Zh{EY?IVI*W{$Hip4 zMg>mbst*2&?ma70YHbzPk#3-f5wuDJ_WqEb>p`~)wWOSe%SSc z?&3FV3$YaAUs;)<{l||x{ybGA2g5>6Ik?!F5!k8<%k3g>y4<&2h zyc9F2?GJurq0_FU9L{^Ncf-St=l@{5pLaZfd)?I6=#s5@Fqq?e*RWIGqQG^e3{0id zOW)MN;fOV-bFFdIl!Kt%kS-~OQ6*3NDzBbn?9AU5S&HlPD?Gh2m!$!}_7S`4u=5yd zoXHW;XaCylJLlMU-*;it*#iaEo||&y;QGv$=lP5#yW2W^%QW5Orq=0etBsr2+dvM`kD+?Cp z?VP(#s0Fu!O0?ss>Tf91Q*wV9fiE`z>&13=Dtywvn6wl$?K^F?Uhc9*Ys0>nwS$Kk zx5#FLCFb3`3@Y(;?ETe}XP~v;E2>#pXGCi*MUuXRGJ99OnSJJQ+mNT;!vvZuC_)QRcKoUYb3dU?VlznvO6Z?N8@T#+iP*P} zdps$&!kS$r{3;cJCJR43Ds+nz2O}$sf4(hBaT59M8z=9I#m%x-gY-g@o6R@nj>}H> zb(o7ZQG8JN%jhql$?Lj5ciH(X<6!bA!*P32{kJZxDzW}Ac{X~dmsU6BzPG`0d~ev_ znJ@KYKSHXy9n%=G)-JUK_GYdQ;2Kq{0+F~+#Ksz#gge3P(bgsvic}q0h!$^yU5yXH z&qhWrB{YnIP3MvmZxrC0VMs?ut8(gMLiw-&O~J#JB!?q?^K$v8y=*MTPZG`xNhlpp$LjO%F`ATG&4_Y(M>& zs^8Z6wx=v0VR!Sq~n=3(2^mwR7;&jN`_h3$?F@_%}O2#|3n4cQFA>+QOJYV01vjq$9 z|6@zL*^|u8sYxHQ+`T2OFKI9*f!PSoUpx=OUg>Vg9qi*4w+*r)!;qWYkMNqmS3b&6 zMcAGA-O#(KN4>6)*iX*w#^p5g76<5E#px)5-hc1Fz>a$u)%8^NoUkJ#hS(FGt6c8F zv!$S7u+vMe_F#RHMB@^gWC$jwHUzDQO@%N(gkt}@`z*19ZV_xl?8`mmR?UiLvg|yS z8k;mQt}G^BN4vf#O3lYnOQ+k9PZ3cZ@>m@i=#Ss6wJXDYm%QJceC+8f#ld(iQ_imr zw0uyo3!+Hdzp@V~?yq5G(|Nra^WG|;G>N74`1YxmESBb$yIm$$pdr${M+lyu-(AGP+ z^{hguG9eSLxq;7=1#X#S?wykjfD)#RZs7MyuZ+o?6O&!~I%JuAQY|Ev`XaJO@shbs z$79{N>t55jD$7J#qkKu@VHKn)meYpZKk$k5*6vClG)*fW7dJTd5R+m;-tZgW{ovtheE);J;x47$`=(+c( zU+iZZ>iUII;y*u|pUP{w7dZ%waAzv;w~iCVsKHzo2gt4#4jRs`0DIN`Z*co~f&3G= z(PZq(*Ov;+zfC$?DyuwNlhTzHL#|4eNBy+~DhHaGN3zFJj6M+*!`I=<{d(Ka=f9d6 zpLopM8{Kzl8(k6f>lv;%PA-_XMh2T*FGPK1Je9t@ePhiFUt+lFUbRUwA6|91+WMN* z=SebbXYIYK&GQLpoY@=yVW=33$&92|>pANTE>Gr38_dBRAYME=FtP+5!2`d-#kSUp zamV(z*jurA6JS4ADfRSKAuir3xk06~G31|}zgy+dScpO5PJ(V_gAwFy>NkJkOi!6q zP+IeNt(8wN303Z6`b!a|+qLHL98^YlPO3Nx+tExA%3KG{jfneTEWLbj^p_fI|3*Q- zu9s?o+o}Wc@5v0}A@=?z0v{<~DvP$(EdP?H^XXX1Zb)771mu-zbEd7vQ zSo9EI_GQpxxf$bsXHn<+1Pg#!mLybu^@<-XC28Nkf7c!dvXd`*DgQaG#;mJ(YKPzEZ z{@}45w#8XJd%Xe{2F}OArjQcXxlyS<>zf49n9e29LobW5oxG77RkqvgOdQ{&(x}bu-yHLu#moK) zj6hRtBVY0oz`!e&svj{cOXP{?72nrA&T@rxwXvZmdTANn5Cq-m0&RQG%`yIy;vIL3 zbNt6-p1+mPgBR`b*jpXtcD|+3|DJ6M%A039hUP!{K49CPq>%gHQ;q+RDwps78}@J$ z-}iq{ApOtFpnDd9BusKFY3EGXesfO*Qe$xOCbpspY|183fA4SohV|pul9kT)e2;h; zZqCL32{KmEFG~TD`cL1&ATZz>(LrxHYu3IryfJ796zPt-1UH$0C;&ZRGN}sLc3BBm zhCB8Ht&y82f2E%i1Knx}`j#)g>UcH$@bryq3V>i{B;CR@vXYlcj zbcpHg66^sc+|dkGJ_ZqNjw+P}I(_@dZiiD>E7(zL)pRZK!pVZaVK24e!8UBWWTn~Z z!!guV7+nPsLwm*0Q?p9zCvnYDPrt_RRMc$}p%+TiLfg-IxG4R8{WZb7HIEAx()^8# zdcbkxV$9)?M#wIavM2eOxQll4ZWq;nmF$`x*sbOSFT)8Lcr(6qp2I+IayLL&UO11d zxn3Vg&~V0q57$DDvzD7J+RozWM_`^{r7tV`!-GR6MmfmmOoq9q@sgM!}Eab*F>hLiSxvR3~igh9IA_o zBivfogHJ=}=oqmMl;Dm1fzr&$v)*d{cADkYvuE~DAsXiTiC~4qr`X%Y)It>-D+E*F zk9xO;Nad$HJ{LN03G*HzFRBu^(=!sb;U8SNtoU9sUlmK0C#4UUR2(tYJv=mdOLk0G z_-H_t6soyr0DMXb?GuZ^|F(4=T>r8L8$g5i77g>63tQ&mXf)FCa@B?K8r= zW4z^lO@KE)?HRN>`MCr#Ru*Ev`#l$U-nyB0%XRwqKYH|fAI&6O55hvH0it{s10#Gv zYiGmwAh0W7xiwDEe~4BYk8u}TFWJUpZ!}dTT=~_vYwzbVUHM;}D5J$rNA=?G5_gEO zGI3>PO((B_WM81My~wkc*Jl7ZZW0+SINU)Bc@5uDo-6A&Y(m~W?n8#h5;9&=N~gt^ zUmH%$z#FcQvc_H4^v`{TN#p~iq%I>bcTc7ouYsQy-iuHv!7aA2CH{TadFeUV3$Yns zz%l;(&}>3#sPo1==WhLGn)tp>P%ZRHnq7BWy`d1ZDX?$@Z{#gtJCm>SdtH{uTjU1D zpFxq36aCNl*?AmL&dnq_GFxFq}*}w+~{IiIOZpj9IGOG4#;MOi}2G;VOI4rMe*HFRm2iDZV7fGYD zBN!Vu3NBCusKF*)$;mzqygHMI*mg3Ru&I*2o{Z(m1xFs^_Ag6s=NjhT*93hy(v{Aa z``%6Ws$BZni*uiUmjTLP6D+fwvcNbB#yR&^$&QeozYD(*5^*sq?i zdcS=6{<+Jugqc266RhEGsr9|PU8e!#wVXo78NNFr92+hGqjW8WOMQ*5_2r)0e#XH% zF27SgV#dZM*|Rz)#Key@A{|1Z$>|SQD)n(|v#&EYRT3_ubIXh^N((i<6&~a7RJ%cy zpdKpG?wzzO3cqEoOWalHUrkV2yLIMlQek0@zj#9tWzQ?5CWGw@X_{5F3e2lqQGd)!oC@040OU(CBZ^%dhf!XYnm z@3knaR@sOtq(`=x2Y+1WTO_05LHgYAMD*~c=Yx&_MosHAHMN7mK!ZBEM%%b%+4ZlO zzdptZPC&J$0`_YBFTHnu-$o^Wo=|i%$E`tcW$cKtnx7Xv{&&rhBp4VOPp=a&@6Ae$ zP)!j2MdqAYbk(=RAuNrY?1!IxGcVr-JTptt=eyrYaP+=l*;=TFiOnK0U_CLNIm_XJ zzTQQqw^_Qr%Y@&0Lb^5KvOmN2o$Bk(9E<5b@zVs(&k0NSS9ZEvm&=@M-fF+)9LeZS z&|@@wI4joPON=~@L)A`jWR58RXeyDhtZ!%z3~!xHLP=-^Z+c7*ePg}!G!lE&LDW^k zJU_sZ^m642r`x&s`eL7DxE&jd0>`sVCHTN0l>=rd@J=56IytzSuVylRP(nSlHzdcU z5$$)lgQKOg^$2=m*BEu$tz2c<9Kz~q?&#gX&3`hU7qWkN;l5Kxw_S(&Dz1+KZvHmG zV@}TUYxUPkN_Q}XGcE#}xCyAKsMxKqX;byKi!gk`fBJSUxUSxQSn7oftX?itqZ%!_zqZ#RiD$nfU zWjfaeKgx8_n_C#M5k#bkgz~FhGqF|O5&gL?9pAX{2}t7Ii%N=r*~M3{@vX;GaVk2K zztz>@g?nfysw+pjMUf;g$HbM{+NIpx`W3&DdaP)p(Ll75!KG2OHv3i|46(3(#3PLB zTejA!?~FiD=C$WmE;`!A>B3NRQ}}lnhNK1WCMkz-3bM|Wx(#kvBiu_~hftOcK@#pT zJrYy;&DQWl_p$Beu#lLV?PjWZXNE04!SEtX?yTCss`8`#j1JFLhvmnQL}0y*8Qw7D za$%91h!Q^5#U zq^x0((^hACx{4zC1gXnkE=D<&1@cc)F6NwDbrDk^RxawThoj4md<%CG8k(FaZr=EU zWtx=JF_KiK5Ep;3d0q*^;=4xtY@XW+|z)K2CPG?NkEq;B9iA@Vbm4I2{cknJ(S!h{rr{Y(j2- zzKA~8pCmI+za?ZijF3qWGt_@1`~pH-(^&3kF2ZMhTfRu)P!Seq!yS`{5Feln?cQGuQvh%9}X&(VYD7$bQeopt{dgwNj_JZgSXl?yw#JM*U1SX^1ik&OBzwGK$ zGqkR>iE*+rCTo$!xl6jb;hiGMFlMff$W$Ql`R9MVzS&8YCsv1I#oPTFRi!%DW zju#6k^<6-th%4t=;n5d}XBJJ#u+r~+6f>~j`2)J(?+X2(>#vV*~i1B z2D3;ps0lQ>zi?a^(Hnv<>-%HUE@(EO^Kh_2&72sc;yL58VPq^m%m&BT&;2Q~wGjQ# zlXdTG_Il^y41+<3>2s=S&hm6e5#&_0noQOvwXUkwj>TVh@SV3*llC1m*4&))0ROv* z<6UL$zRP`C>EA&e7hK!P$rJqWQE|Bq@$6HvX(TCfv#2}EZCSFD5@AKu^Lc)rxw|_& zVd(Z#{jRqU5-YE6-+FJ@`;?mAdN+FnXY?U;l=Wmb3No!@qE2|lZJE^^P=#D7ArxfNjLWo2VKUbAJg ze|g};G^vSPM_P8kf9_Qoj5&Pvhed01w9D!0dB3NcawmQ*czkWFJBhoRxS4ib@^^5; za7<+9iCUJ?Nzrb}n{||YOYDnqvCtBdOjLPpbZpW!@e0?$KI{u3}i%U)m&Xj8r8DroG~<-eXFS) z8-HnSb8hwf@8qcI!3inP{E_a)VOUUcE~9E>o#k1E!;}!mf-=(kXYQu*@}Aa&_QPl2 z>_8_QYjj+wmT%$U5%#p4nvSn|Ga-0HeudwZ#a!HI-ps!S8+55N5BDrZ3blSyHiY=v zS(I=FR&E>S5n9JJm~S(7tHdVm-7dFx_w~nGkU#4Ebc8LLD*6q3%O0i*nQHQK zo8a|_#W-+u$amRl1(Q0lp42`!YT)$JBYFHbcJ$;!3MdoJwoh1RuX1uEjg+6~-FZdx znXRq|4X3?jMKlm^n108;=Y0{=Ct4;pPJO)W{4FEFqEv2@>a1@Uf6~rdPk-Cp`6dVB zdHIuH|8EsE9bR0_tJ|Pwc;=K(w4QR`W`_pz&})Pur?BpM9?RXDrp{hMm||g_q))ng zPvDOFpz8~Sn~lr4t=+jxejv~APeQf;1U9A4qbF6Cfl99D<0^sF)b@$C)LiwY=3#z* zU+SK(eZ{BU0;^mFE(?G^pTG0JLrKYo;Uq2~Bm@t1VPRo$c{+67x|!`>i;>2&MYR;s zBa}qd^=aqVc>ERYSg?EaTF+7)Q#7xAO2*YyYWgwk(xSA!rr-?^Z8~dmOn+sz0rlDW zc9caCGbE8y|I0V*qgLL+&xpDqH|`Fo?-b$Dxw;0MbJ@PzdVdmE#z z9QdI%%Z@X4oj*M>@kj|vzsVeXF6G|d^5mX(uP|y2Km7g>evGnO?f%NJ5}!hE=J}ZB zODY%q_}!FuhD1R*<(O{TW{cNgQ{B4q#Dj}(V;Ao4jPj_~0{u@@m4KY2v!A|TU_PJ# zUmoa`N+OlyOv-0Rf8HEezYM7(Ub8wZ!m9O}zd0*G2RSPQ?p0($hfnmW`(D&+QgcC5 z>ZXgzdEzI<#D;zlV(t8KnhUq5e*B`AFHbk%X!NZf-y1O|w-0g#&!kb3eAfvKPq(MU z^-@g=>TrC7FeR*rAwG3bNwYi6IbH? z``+6_Pc-Uvg?SBX-x>OD3(##l+S`BrNWn4fYhzt|Y*4uLpdP!V5_W`%K-2dMx^e-cWI!1}rAfpb< zAzdFp^Wx*;OmeP4(tWuxGY^l-O|1I*TtgkO>GS|7ruoiHjSC>u^$bmynuXPa81lt~ zQ!e}P@bFKM)PKB0%{7po-;?;UxM)iFAU+{sTY&rI=ovmf{^Id@ZdR7GuCDICL-2d_ z#uv=@KYp-30!MYEh=>T<^dtXt0qGbFbEUD-&TvEd44OrZ{3bBmizl*WYzDWmh-Mzsc>bnie32Mw+7wVLE z)RF)Oo&|z|g2Hv4=eF(|$b8>?YB$c+Jvf-$*Y^rsR2<-f|37`5e^k;}6u|jHO2c2B zo%v%nbf>m#>(JDGO^pdN)Rn2FOTj6&+7wY^39hLV)M-B~Eyc{G2$`wVU^B!dotUS& zY#C+Yk*27nqKw51L_lB<+~0eDzIWbv@4S28yZ7Ap-u=jTI$#}>+ou4cr3NImCnm58 z!$T1Cd~B|oBvmsSW3W1QR*Qi8Z5WOAb4T)>Bb-y8EEO z)E+1(=v8}ag4K>sba<_TV3WOH8GoXsc-AX@x*cPYhm#K-I$ExD_wXR`LIDJFn~d=? z<+(bfWX*q@Ax_q;%8)J9Jj0*md4W>iDN}&2sf3$D^23`X&b+7o;Sbidm}wWacd;_LCR>C zn>NQgy8~R5*x2MjYT@YCT)T$)H5^Mp;3A&J9X^~n5Q-`2dS+Q{7l^*J+Q^5oE7YP- za^|9X40Bg!(-(TpWI#u)s;x~k<%98Oe;M+*6}0-i`$R2(VDBq)^Uc0@$78{Je>$?* zLuoeYyD6xmHk489Q|ni|Nrn=l2i^4-}GMuT+rdbfJZ!A@5QZE)+@$W@Tz z(%!H9ALpSH#aZH9k^M`!HR^4DaKo0 zI34W^V~IvoMjKP|GN36%S6r_6X-p=Qx89jtjyZv8MMI<&>SK`dJF?FIXz_WkfV-lx z8FIN+a<@cm9;l!{V@}j^Dx=?*MxO>O$#M1i8b@Dmcsq(pCmG=GlbXq%_eTkaozBvE(oR*qsi~PD5?QEtK{AXaQK?t?eaoaI zO-z!BVfht!Vv1(yhulrdt$iXDQ!{`BPbf3+rF^3mC|n|qMjMhOJce5bkiJ5KBjZwN z^2J!h8_h!iEtg^9EG}jwtplz&u)x*#1121B3paJzBTNL+RT!kp^Mt9L6MIfJA4C8G z#Kuf|p;F32k`^n=3ZoNd#<=)b{@g4BiCu{fk)1o`0GTr>FJRT3lwem(ns^R zY79D_lVPE^5IdheAs&yx&PjGjkGZVRY-)TQ?damA?bVLJ_7AR`2-mluA+axZyZSJ! zw*vUYp!lVv<`u*eiFLZ)ROj?VCH(V(*VA2zV>DdS+;c>-3O85^(yWi?Wa-9=t$^m$ zN!S1t)Rlc@RKSznY!a57+yW>+M5o4hH{?hN){rfz*s^ac*qUis~uc1p!;7((UbjlY3;4G=;(wsMbsX?L(A@ zy+!)BeHs7Xc}a)Gw#LA_yKR9<7)%{@;6Sd+|l$0l<6@$xNaoZ#2R;vd&SnXI^a*)r*cb#OB{ z1Re0kj%$ET*w-T|g_Y>^8V&6%um)0TEW~P>)th!v*xvtBQ>b^eSHy^sHCYVp7E{dyn( diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 802e8c5fda..fff04f6151 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -11,7 +11,7 @@ Windows Firewall is a stateful host firewall that helps secure the device by all Windows Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. -## Benefits +## Practical applications Windows Firewall offers several benefits to address your organization's network security challenges: From ccb3ba971faa61f6cd26de24825e23b20091e11c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 07:12:20 -0500 Subject: [PATCH 160/237] updates --- .../configure-with-command-line.md | 16 ++++++++++++++++ .../images/windows-security.png | Bin 287077 -> 533667 bytes 2 files changed, 16 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index 105e9c6cb6..7b19376cd4 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -15,8 +15,24 @@ This article provides examples how to manage Windows Firewall with PowerShell an Global defaults set the device behavior in a per-profile basis. Windows Firewall supports Domain, Private, and Public profiles. +::: zone pivot="windows-powershell" + +Before you can connect to your devices and apps from Windows, you need: + +- Internet access. + +::: zone-end + ### Enable Windows Firewall +::: zone pivot="windows-cmd" + +Before you can connect to your devices and apps from Windows, you need: + +- Internet access. + +::: zone-end + Windows Firewall drops traffic that doesn't correspond to allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't enforced, you might need to enable Windows Firewall. Here's how to enable Windows Firewall on a local device: #### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png b/windows/security/operating-system-security/network-security/windows-firewall/images/windows-security.png index 9f4b9699f7a47f3050d1173301aa0e9c051ea22b..7270e7e4e7c43117b74fcd48ff59520a6dc7bbb0 100644 GIT binary patch literal 533667 zcmb@tXIN8f*Dea8paP-`=_M)xDo8|1=mAkc5m8Y(M2QF(dgv`60xC_U_YNXWdhbe* z-b{edTj(_e2qg1_wbr}8@7w$AALqKx55hA`GUqeL827lxJ)ZgL=@WJ4^W5iYXlR%p zYTSQLLvxm$hUSd@S$gW8o!KWT)PLvfH4Kn6G#8Uj{%D1I@6i`aSo1`PHVI)`4-(x3FaMX ze#0y9^of}#leKW5MVgzP>{kIJqcrO=$zQ4ASwBI~7IAecW{P`-MOEMHU@Pd-J%#2Y zXIFB8;mZnL*GR;kVQ<5erK8C?$e$ccrHf6t`JukSYOU_%ti`)--Nct;y)7f-@8DtE z1Gf-84G&z!fC@@Qi5_2-C=U*cIe_ol?pbY%|8ZqYwr9O@m?BVyH1}ewsei^jh+0O; z62H$q0NKcR$H2`(DSc)cq-@>hc$sjusa`6yverj7C^=_wb ziCiIrW=yExO>MKwZz7=T3kgk6kOe*$Hc#fCU*JnXeQ;d{aO!}Or&7=qdon}^&}-%W zm8bP4?CWEjN!}Dgg|OtQ4*mRb&i2#r#}S6D21G! zhq<_AoTu0L3|~I#cBfb7T;B}dLK#T(D8H2j9C@?>w38nA;#w z6-Los-Z8olBocDpxEGLl@_@`pg!qqli8YKb=U%f3CavIROVki-4^l+>rIggDH%Wne zbz5Qo`d)MN#xAE&+)iWbR(VcT{(QP}w3>OtF_U4;qNwbW4>sejpo56$v(oa$p6`>IKMtT zf@F8JE^N2`!8V2jy)A2xkAvB0>((y!T`JlUs`+fM-D45W(;9cL>J8HD__tyiq;AX@ zZMy`wT-$pD`7T}yxn@+HOX>TCFbQJU(zFOGDEbZvCS$(=@KrfoAu^cs@MK!lQ0Mh{ zLV`ZhAvGCex&JX@@r4tQv-MmC{(@=M4g$<_Cr^cL5V({u2rSfM^iL*BKsjpwK|4~& z+dh*7l%Q!Y(KcER;+H4oUPx-{Oz0UM`kET^xcDA2YP*DX@$s7rIYI;PU@6)I{0Ipl zeYm;KardPpS?~7K6$377^bpdOA2x=bN|hH1dC=cipUza(K7o9HlO-$2Bj9Zkn#w*= zGZ%IIa!d;A@?r5&DMV05U`wLirguhb7{E++M-N0hyMI>KbAJ{$h(b;nQ={CnhR{@f z;(N&iR9?fsXckV5A5EYOadP|LPcV?`hl7Cm39Ou)dSd6iN@y|3Zj7R^ii+ICssQRZ z3^C(RmDHvz7I}F4&}v&+$Q4eK&H;3GtzxR!ZNuyf??zyp8Fl9R7V31N7}wtRsk658 zi#nO&mCL;^+ejfrL5YE`Z9%P^EScx6mR^ElqAOCpl>Z#ey88!3W4+dDMR{~Q^v0|8 z2K+ESbq-Oh^Y~tiUVZqwsXrxl=b1@ap7*zbWKUGwLp!nWJ3a!EOv&ta#V-LgLF?rH zk+_Edq+P0Ep3K`;*4XA1WRNO8eOt2OvPjO=Vzy3Q@o{ZN^ z8UQ2J{4jsQRDU#uMI7m4mqlT5i@&-VlSZmn;c;Dh18;T~<#eHN z#YfqqhmA8eQO<(ibTD29f~mh($Rv$LQFQU~_=s^QPjO;Ui_haNNllK=yN+Osb*lkX zza3MwRNU7@1IX|Aa$|AghdOLTP!QF|urOgVD1dA`j8g%~|Q@yv@{}IEa1O?pmw` z=y9*AZAQQq{&XUo3wLGV-OE!+M#1T0*B7m`Y~=O6 zjc*Y$DR`7RB>Qo+Y`v}xuhBJL|%mN;DDmj-W z9{M6ShR#1~l3Wa7C_wD-SV45rJF*D5TXabA>@*4drh0F_b0|5!0mIBRU;Z4zSvP=X zTQ?*m5P0C-+{i3)QsU@W)5lxSTmRS4*_!O^sgjM zKxD5_TzyOvfE1m8AJ%d;ml^`zTl|2=Y>q)O^FZ?m{moVe)vy)Sf0^Y;+1656t_ zFts&wWpj`cTArV*t^qJ$V^RpHkz7$K>&s7lPnar?rr>vV6H9#ZLj=e$u|zF+0O_U% zpk=g-QnIVyTCM7oq2`0qQAyoz|9_o6O!SVSU>66Lrn2O90QF?Gw`0=zHkwB3QIiIx@vhl`8SNqyL8=jDcAa&jYd357LCP2q1N9g zjL#Isuqphpy+CEkbG&1dq0l>q1oWL?bPY1T`YMTQ?oX$Y_k_lwe&U#64_8-Dns}N- zhJSu<9maKS{3Yqhx(ah)2}6D8l1g-{&!j&xdasm_J66Nx{Wdv#Ef3@_n=FVceg+t= z8ks$&>^!4p(y~0)K|l^V2(*m+srW(x@9|{H2PQC85xq9Xw0@6$HPrxO$Et|PwQ=q8 z)S=#^%-eHpmXlQa1cSf!FY2Dl#f9;s>AE@XrA-QDrA-5LZ$5TWUDl?;0~HP%;x zgbw&Tk%wf46Q+2xflSFn4`FigE*0!TOiUP;f#*%)weWAh?Gb(WqKT-2+sjnw%kxG+ z(Y@sRN3!eVAxdSKYSivJs!-bJgAXekzh?I!@Nx}1e)ODPH+>*OuS~q}XOw7IXu}I) zEe=4i8vaUCk~(;-O16xmt>R8NZy5G621l%@jApPiX#DPbAnT>qiGbABK)P- z7;FlSMYUEt`HL^Wn`pIvd0>|+JChK74N|G%CR@?)(3s-ixYMEBsM|HXiM!9^4Vv;Q zthPt2jaD=tB4JbPnv30uaRLfFi7kE@c6g}dC)5h@Q0Tb5>WO@Lv|arRAVh*L$?&A zAdu%xlAvW^dc>MacmKJe|Jx;Xq1ZI3TXc55l)4C)+Xg@OY%{d-08Pnv$b>Y5m8NXC z6;rQfO+nO4wDow?V%qm&*43GJ&cs^GR1x~8LhKlJ>B+YKZSbd^+V*44cKRwv(b#oE z!s6racPs7wgh%1w4v~d}mgj72Sb6jxT*+5>v845<@cZcs3exsN4^LZ1sK>^k{*Gw|l6@-Ba=< zEE#tnSmdu>memB*4^AfaHjGK8io4i0qu?dXtY4P|9m{!ujdz!W*oEh;}CLQtWG3z-PTz)&~DA8V2=v*X%MRmp~ytYdYHUKq-r_Uzcd01wS=1({2bnGEE z?08J1k(+E>!RN~R&E6JF4QDNe7#KW;=GxhG&kE`Dpv@k}bJuI1d!Jv2dTw;|{;9j4en8Vpl*qvMhVcTKFscKoxyARu7haDh_!|Wjr7K!A;S1Ux zHI+CQE7~s-Z7RI^h=*#6-l_;41OHoEWt+w3##Ls?5(`CtbV*a9uus(Vao2kp7;J2c zahUk*+#6L#6&FxtUV>C{p^K0WXdY1v+nq%)vN{`vR9T^CCz>iNfQMo!;PoQ}7q(Cz z|F{N0EsY>udb7_+O^;!urt<&K7l}M-?5ws`OBU%go~!Q!J|xw|OHOnQytE9h=)xkc zYglc(^X-CrHOPOFZ+cc#%=9^*{mM9+-Bv;H{b;#F(HMn$UA|QI6%7FZ+Z0sJDywOY~Y?EvbOieNN1`i>yK7XcK@!dr+AguhJs#n>Nlvw zzTMZ2TSr3~@;Vkt3#d2b+K5{09KL<=HW?Hh8I8Y5PEE=sG&Q6Q0yAS;y;>xwr3e`o z8e0R!W?UtsOi+V>$4P;S%7j9s?UsRWNd*ep%fP%sHn6@IMPb3(I@%5bC&2NpzMEXb z&b$n)lBm_$YBo?DPO0lWij0R&@Eg zblpcn3r)TE z96ApI?_kS-28ha{o2ZUV)xacJPR4POgek4!;z-I-9u?s6*oQ#AcQzp4eNw7Z{hC_3 z_bMzdq1+YWHhS+M6@e1C>Ui@?+busge;CBkx@F_n^CLr(bhs3^ri~F{;xsC{#L&i3 zzU+y=^lk3KN{RNQa=`98o5$vnF2k^&Wnm~^fwe`S0h%aSh~bRB>$wrU+PH*W*$gJe ztK+c7x$jbsGDQbm&p>&YgQbn#}#`2+_f|H2l+u5ack zfX};C1;53OH9Yi;Kx+qsaKe><-J1%opR`=N!jmM`XvG z1z4<#OZDR$x)AT&pLo;n<``$~*{iiPAc7isg_j?QGLq-2tynr6@U0eyCG}re%1o7h zUo~%^6!|7Eczcp=Cm}Z#g05Fe0z21T6VbhC1GOLsZ^|!~h_O~TUJxtP=IxtgEa;68 zS`8H&L2N`!;JV=@;SI?_3&Eat8?0Qq7uMWt4S+JwoKI$<%0Q zYB7>Kk(>V(C8(MhwW3nsKPfa%b_tV(Sxyd|2&35mbeCj@m(T-}2XbXeeclg`nJ_zQ z>!@?%>U!lS1Rf$(M1aq#Bz$?Z2I~FVq8wh$JdqYMLhiZ?$F^Xq5|FIp*!HGS?H2_Ty zI`Wr)hP%&5uua$d)bpuTwmg7%IUE zxn4j!ITjIqx$=3Ko=Vpfg@8$}pew3f7+eiWT!5_MJ;bj_J7$e=VsO@}|MTNBxoPf` z;u!scJM6xoWrb^dTjnp{z5Ck_B!wjtC3;b z>A{J0M(zFCT_&h=x3JS19%;DMF@;aX-s=cHT%-c%r>{4ymXlesw?U~w?A$Ags730| zuZ!M8bhkYpWN2~9H_^oMmkVk@6pa~>^vw0szI_Dy&qux>+!x6E-G^ZHLxnxQ`unqT zf3{=MRi3&yk-GNE6pzHE3z*ua&7O-B5eppAj}yIc+fV5mX1dC~Yi?otSD+*Zlh1qA z&&c8Uzs>%)SSpzHcees&3cW`)G4vYQ_2gJXQBUNF{j&jeQD!PYpR|tp_Nd&AN=jA> zfQ3u?FM&wo@RcUAY-TPiv8g(z90-_d-H9AKXm#N^8ghy66yQS~%{x1CU+wb$#+cnO zRuoFUQakw8!HKgW+ljrS{J3Adb>;n^^+~}@@6gx`yGH22HOD5EO=GfvD-ld`AF{hx z(h?&3Z8tjnSbYufd3l7=^SC1^lyEMz;vwC@r?dq&@rxm!kRCNLKn%;J6J_DFyhUaX9Jy-fYP@Mf`!Ay+K?=j`==(E+-k7Q+ex0nF7vvrtO2X*VTJ9(KshQ z*rfdhCH1Jsfl4j4M}Mq-2s*s9`=!hiZbi@anZ;$xPYS)0Y4c0q>l0B;ulO2+_)0JxUBgXS zQI~8CnApd1ZO6IEv0$hJtXKDrSk%A-h|m?gkfks5JTij!-}}fW{ET>gI>2%+Q=&WKjez3U zB*wv!(Sa*H$p{WB&e7hT@Yz9w8x^61Z^4$4)?MzlK67oGlSL1^q?1-WR%M=ESPijB zk_@rI#VU;Lw(6S7(GRzmKD%1b(+Eay2au=!xThk3aCEQUj-*>tl&0D5y4JhTm`aCp z-wcXb%F5~mxvI9WhDz@gS6@0P^`@2{%-R<*Mmc4wG^_8G#X{14fdYnWLdRt*VKaV_ z4d&f+Hq$fcM)eT&zGsm~ADo7IMC5sBmeZ%h6L>YezRlKpDQ9PTYnb!bFk$?^tlQI- zO@7YuW60+7hiH0m2`Q~Hs!oDdKXvewHJl6Fom6-gbNUpE#CUZV$8}Hm_5KS@3?MK2 zbyX0l-|%z!mj;HR;O9Ox{%Ty@=&<0L=@zTDt!cNF;k>nqKmpuqg?nUCcyRTI$qxa)n5qL3v7KC~u^-^3Vv-1$RSA+V&jys5!`f6{aQhc^5TEwHVd|8vLRuGK3m_JaWJ zdfAfyH~IivSX7ufp-D}oSS1h8Ee`Mf0gNIsJc(~9GF<8_mD%v*ch8#&igj7es%dLf z;sleG94C~Nx8in3Zg9;NK1(G(tOKcC)#&-Ic1#=I`0?J9o>Gx^ z<+e%|ZBtTM8n;dJ(eeuhsUy^?R}LBQIQsgDTa~OK7BGlQSId1+_Nwu1f2wgDeRW>a z)EmMn4ByR=-G*~{+i|}S2Ua$<-kdq>(g`X1Hc;{8oVv~j->eTM2j3j7+;J{ZP<+AO zuK5wN=H*W-pbojlGS9>2Tj|z6L+j!sFyC=y#V=WS#r~(3yyEHEp6324QymAhbfp-H zd9Cl^^>K;k`6-I9H=RKx-iOl%(>#+-3JHmPnCn5-vveZk1>V(u;KAA}-CB00-%9D| z@hKQ-rJuK9Zf8HhQkV9OhsuR+gzsg2B2M@9#zTh#h>Y@BN!U^AUsj2ZsqJ0I{v3m} zGD7?93Qut?56_m0b}1aDv)W>up|_==?>+ePL!ZM_*jTXl+ulP# z>_#GA>`~OpfQ#Suqr+y8l7doV?^j?<;qQgX}$K?M_SpPVgL5fadb&PI1f(XsW3J{xQ zs#+rrd1-~ubWn6c}_C#3=m=!(h*Wg!369aS56u+Y?o#%s^p*g#3^)G_zh z;n@_UIUlY+jpd$r?^irka$apIiZ{S$F}_oaBkML(FV_L{j{yqRJn?ZN?88q)_h5Gy zIk1^bSoTa_&od!%f5p|Vy-=oo7d8+;j^;>si zUF=Di^ST-!JlnS15s25zigk1FQqDh)iP{g+&6f5iVBj3iItw2d{QZdvW^nyWM4( zbn8(pJ!-E|ff+|$z+CGQ?=8b%8$WFOS-~#IG884d>;ICXnc|J~Y(sQ2E5yYHw@6_V z>LXdgTDCQnMnPcLt+08YSJp+h_uJxQFElDESS#4bnjSv4ggvckXHnSlMeY0+_UsfS zGLt9C8?HxtdwXZFAg?S2M)N<}v2&tbY0mg$S20l*V)oAs^BM-1@Sfnjxycgdh4GcI z6UEOjxIIbGg?**$KP-mJ7wP2zUez%qJ9GK%cMHCyE3E4VB;a_r&lMn~QidMn0a-Ku za^HUz#r(&Ws8Ex-f3o1@KLAx0dy?ct%(Y2CSsoCT{TwJPFdR#Q^-wIF%D)2=Ybf`r zP;#+0Lfs;9?X2TZ&Q*6&rL+y3;pia9wMX-JH_#Eab1Ib{bEE00y#mzN@T;jmiYVH~x!>rEPVw zENhfEx1`|>v_qh+*lxS(ubR-ar!zl9saZ#;?tkQWRdJw?INMKu z{%t6M*nV(k?lwBH)&F9!9(k|E;_h`y}rm0$hpU%C#kT*#`W-znsPeQXOc}Y0Ez}8#j88eq9R%G^ z2jZponeoG@B9X%xpMP*?8G7{h5({9}>7*XEn}11yM(O+yu=!uy2rw8x)xFg2bIoqVC9}^fK&{av!@# zo6MZXm$1>`c8}Q~U@I~`?^QiR-^s(WH5&|eshV)XU7LuSK64hFTajqjSfkA{?Unf$Qp(RlKYl+_FSQJ; zfLZ+lhPwIgUWMC!j{tVAwsPE1vKNCjuC;(bNoidT9Sx(!dG4AsoKi^xnmEY9h7t08s$?<-o10p%Y?p&Ip z-F@v+*;8uUt%k@LFgmKJV3B9lN@w3r8;(y1#c}Kvx@78$)A=sskD@MU!8B{`py|>V zE7tEWzJcys4qldV3?D4GKrgCQG8&dSmT^I% zhuIyTpGISIMrIM)L~&Lc zUkiTw_>&)l($dTsMnqdfCHP{r_Zcd&x}VEc=VGau@*BF3-cW2o5PnIaXWf2zxQVD* z>vUdT_`1qydU)zngECzg2zvnxcY!ejj2N!I-}U=x4BW(kaE0i**4V&1j(q!rD~~eT zb{eb;?`Sj`UugBHM6keU{r)a#Fq=1FlG8}Mz4ioP)OXa0=p)bK3R;{7ky!ij&a3b!MSP&kvR`uT&cN~WTmE;MRq|7f zTx>a~)z$$x?dhHCx!34Nq!(xeTh4nS?o|YQzt7&`v^E=dU-X;JTZ4_yyCH+Wn^}f< z-)OUYWb4n|YJ0~kJ|kz%$rAO9_A6Fnj&ops} zscK}yVwDIsDESN6(1mo6Y59a+6X{PiG242lqv4^`9DkPguLRNVajHXgM|ib`0sfz@)kFs2D;=|e8Z|>-2&L06fB({|uF%HWqr*i4!#G;t^W}-Q8^Qfu#4o*9nXVEwx2-#^dgDBk1VYhbL z=2_RAl)eS|AjF7GLkjMzX>mTYsDD$cbE?f#c_drpI%<;Hr+b#cHLUSKW$BS?W52dVoTy~9K zvi9==dozswj4Z!3rkFwJ8@y@YOaygkSX)iWg&zyh!{6G+l{Pqb<48CUzBH9rDyIv*pg?U^m^#|(2W@(9diEB;QlOxOYH1{Q z{pA-JMnugtCvVU$7`sAEi7xs<&-uGGeX9_UNBx;94$MJYOzuAqUV~<3&6}cvXU~Z2 zqoo$t&ny1e(c-_s632=e?qo2JF8xGS=MjOsG;|b8Odqc&u!A|H{)jTTc)LBJl5P}>Z7@%db_2ZBNe8c`E4omdB59}uW-{>`%Ty;!cI~zmyFE&+q zo%9rv5(y~PDmM!KN|WZ1(F$r(RRk$`p1iqfWkc-_|eLm0JyYg}Z!-@sU2mDbJp5Q@uLZE}|(?!%cA=FexnAd-BS?2cCZ2 zcoo`~M}zkHJ@?veod@p{>E&)ZSF(gI`7MGDQ&;2HFsC!TsK#@zP3~&HmG8jWD_b(^ zZlRYa1u$)8LN`^NuJ~5Lp1xmNj?7^F`BdQJJ>^Y)9-)8~P3@c?ioYYf+w@t?1NSeD z&E(K#YoC9zS?8u&?X>)y!?p-fedtSXTVCh7N#Db%bOw@z2BCPbKEK9H*|MM23O28H z$l-a)OIPj?#&Bb7G*Qfcu{&OhAnUaB1!#vfmZ-^9J0L>{%@$2Erj}FLyZR}%-yMpU zbNYDRE;1rQYO)X8-N(p3d(N3JXSX_ZGjfO(2qr{uD7~;pwmUDu?bb>z9GlcQW~&;7 z#V)pR1V|N}bJs>1s^T`i@bdid_v|3{5$MKM*x=LDUICaN5Qd0d#FRiy|B`{Zam=2j z$oPEmmytf0Zi``oY^ZoBt8rU)1^u-cVfw<+b4|D%UHghxN#Pj-MMHQ!bFR^0vbtUF zY5UV4=QgP&vq>T?i;sO+EG*2=pWeZ5}#CYcr<$$LXPDG|i#7<3uFK3R|BF!|GZ0SyN>FbvjGz z_JdOjX}6uvcsh37uA1k#PEfhUR<~~jl`CQ+rSl%y&I@e{zxl9FlMj3gvb`77NM5&d zO)Gi-zv&A98(I4wn^Uu-O>PnhZ?gw2oQk8kK3tTOxp|qSeFQ6C_p^vGB7@gaKQv>A zP`TIk>*tSPPS(EO;APRpsAO}?uAi4cP=Ud78Om4Qy$|I+g}W&rlhv^r(y{T}+sPwC z$=Y&v4=Kmm-~L%(us=77UXkxSY4w%i2R|KJ>*n7V)(V+rxE348cak+gsh(K+6%Tw& z2KR_187V#%Q|U3*YU31;VQqedD&#w|Xr(Sm%KO4lL3(*lYWGw)r~%!Op5^Pp$> zAOv31;=QDgk~aUXcm_L8X|i<((^*FbZ7ySpWBTNCG&gSPa5sxEyq2GSLnC}@ar^9E zaKCL&;3M&?k4v#EpvPkFyQ60`Ably2n8Be-%3Q01bXj=+=^xu+KefK#*Zh&=uXJ#3 zVVQi4cyu@jt@<+n-aY3peSZK1sigHDylSIbhNffME3V&pR8?7tDPyv^!$NGS@4rA` z;a6CyvK}qfn47&i0;_ZBNtJOh^J`2~F>NiWg3p|#s0fs+%kQvb( ztFL;}Zv8Jg{{NNqxfHJd^NK?(1(4jMHWJ=sq-D;C9~< zs+{L5<^vgAX%0LGYLsR=Jh4~aeb5|`O1YU~ddKjC7VZ1hHw-3s7U~|d{*}o|6Rt$E zOjVk7NhPmYz~7xVo}=4v;@=y%FUy&w;hT)jDYf7ujkwU*pnu?Y=ytCOzPIC@2-(es z3y%4&>(%j(EV81!4e+5T$*I-WjJGEK^o>|{r=hvOe9F?s1 zHzpV@KAizcr?Fi|ti`wdZDncm{&$tLP`l@HmE zcCsb6=Wehr1{7<0$#q^noUV?NE&pX`X7?A1L*os3NT8tE5=W%~BuFk*Ceafn6OVo7w*BO?<>u|bwVUv7$ zPS9M;k1ls|#$tr}(vVRLH>u4?o8))n<22?-*ujSdA&Ni9K1&vUvI zZ|yY=M<*ORY}WMt4;1`ANaKGy3WzSF;*5-g#K~1VzZA=)C0Cguhhgve{%M*iJ4B|)4=#0KafG&s4vJm zb5k8k8lY&xNMG@2+>OjKTEEr#I~T)$Q*cJ=@8^~8e6;SfB(@XfHA0`tvFls-e&&uGu`X&KS?s^MBe83R{07ZELYWlh!SKk?n`X_%FAFT zf1ZQy;&X4iGr`KZYqwO^f)gQK(>(z^9H*1bnaG!-t_2>v;=K5Q;dLYD;;+|X-1FkE zdj;N4J|?E46E7>02I+b#_`T{EdoE(BYU|q&p8IL6u*=GQ7}{mQ4-gN~*w3K5EBd-? z=lD-=yRHo19H%+f(N<)$WB0oG3RK?W#z}|u6SE}pGB~4Vz{deHc41cgJT}i*YGbso zMK4tH202fMd)ZqTxK@uA2JkFhQzXp#4-{#697O01!VEpb+5{|fh;B3ltJ~KUlOmN? zWPu<1$qSLI9~d|>0bcR3m#JCmuz$hOUbL~hw7YWVc#U_>)Id&#TPc&*mwiRlTb>_p zgN<764vxb&j+Qv2%zv*!pea$XI^b>Uu4#-7qd~~Jey{USg;9=j**-__kreDO!(bV* z4BYKfSj~{_^M&3y*wX|j(0TDq_)*lNgg%QYl2;R%Lt(+h%LNFydG&ctvKGs_R*LLR z5$O)DiT+#B{?maxc?0ObDv?3J5w>3O?+#?@-@Fq@%m;?Ip99a-xhlg>|8}=X+g$L_ zCl{{^7ZpmJUUuwZp>~h5rMP8!uH(O~F?~%~a2Q|@yD0osfSFfe`k<91Q|AR;-$%YR z24OlMduBA<{o5KK_?+Gfbgh~(%QwhI`oYJ|~4&x3-+PHN0v9byS>`eQCbZWU@}5eVzU4 zl>IHY{kp03<=b@4c{IJJ4_fkB9=*Dpp?PSmkaYgJQc7GR{iEoe=>sUR3k|PA%{ceNjeg>+$=Y8UvxGuwl zN9aUWTYf4H4RdOhDYG z!Xo68cz@t=8b2b${e#1CqxTV}9|Y~98_Nk2!bdKgf$q@AZH2Yc{e`%U@d-t$CjK;9 zJ4+E)!Z6R}RD{(}tF-LZ?O}`r?5t3=`D^ zMf8fS$7+!Hgb9Di;%<52o{EKf_a_W7cb=ddXlz0leg0~4nCf7}eUO@yLx$_KP-c@l z)W=rCJX`j(JlW0J$agFXgcsW~vwu5lJHd^jf`XXMuXTyR67H~Luauj#Nnzt1e|poP z;yAFE_B@Ge+iLh7S@-GMG-%O~;ja>h9v5SlC>}l&P2}n~7S6I^R)UJVTOMbK9r_M3 zWFJw)e1Na@6~p$&AKk`qIU)!k_k?NY;8<+j>h}yF#iPgJkcD#?Y4Qy?_(Mnq>wIe~ z9!7P1`0vhrQjh;PU;m$*(A#8f`hx=C3%n@x4{A%3jOM==_@hb}7@B-jlU*Q5nA%Oa z8&CA?q{JrwRX_%Z2D_s_GFAtc(I|ZjtbYo68VC}&cIEl06)thVyqg#IXsp=d7HQ27 z`nmBM$oVl_3YARrzoj4K2pANai zlwrd`oQfJ#QXguL2xG8hkuR+wF8U1AwO%msHJ6-4mp=OG?K!E}x#O1BVtG{AE5kCs zngN840kKI;kI?V0#^$9f#z4c2G@tc>`4#3aoVR_@l@l?eVPEXqWDx} zZHtSm_PtxzUOb&-I#8bOp)s#sem1jQ5Ec1z+LCYEt6 z8Fj^@AJBz6QNJj!pE&UEk0Z5xzRU)OFvzttLw-sP=f-~Tz=rY3@AO2G2N)1795?$l z5v;Iw`(6e<{`-q(e&xFVthC&3Wds*Ekb6@UdDo&-q5S$ihQk-E`310(%L* zV}bd0G!X7{nxDQ@nX5(LQX738qZ01G&!1KT4y%6RsamX)YU%<9nk`I^nj^~`FQnY` zOoG0CBeKef8*y9{CPLkr7I~1|;4qcLW-0Tpo-qd>;SS_#{?{N6LQD8@nj+?Ep-Jq# z&~9g}Oc~6d!=qyosjb9?R(V4=@@)H=^jdxhjQL!t z!or`9tK!BFET0##&mY^{i~2ro^Q51Y+zLs*62u^G+s}AkP`QXBOHx^O_wWwreE3;a zGu5jq@m#VrESvM`uF0Q%FjU8@EYnVoSSx}?mUFn50}`+DpB6Vh57L#kX0(lw8RS9O z*f6JC*6MQdD0M5df^W_UUQZD=6k9NM`1Dqku9YsG1u^8O9TmXyMH}zXcd9Q&X>lU6 zXR^T)?%8=254XC1_3YlXB4Iy|AFZSiLMD+sOf!E9w;S8{&L?YfEwxuJdCs&3oPqT! zPbt}-nwadRn@hhy{$ZLHzw|a?KC!&Jx@6p-MIuFQDcoJ3yYlwR9i_vc{O_R~%we1? z>rcb>7VGIJA3l_RG}?N6W$0$=g?*<>MCiuL43-*$k&5XtGleop1V~<*^g-HPE6oVs zo6OTc-DtLXLm;iIrZ%gNvyQi|Q(M+`r>ntHwOF$L+xu8Vzerut4VHcX`u3>UJKFWi zuR?BYeyS3!GG^?A;H~zW#^L=csC*+S`$;u5lbfEp79BiYh^xf~*1mR?44czIt05&{ zLuBNqu8TxcS1u$soI4@Dn*Y(^|BI`{{^#9uHMRdijRC?QNTH64#8T@H`jML!9z`oQ zI<@A*b(DlZUaNiP>fZQm1bAwT{jQKPk+%wBfHRHAM_?4kt{KD*a{a7)EOF`zpInB} zh!f+@2@PYrEZrY@e?6r)nw@Z+S~qo@2@qv?ED=sPE6t{;v~%HZnR1l-h?V=iY;$;f zWO5Z)=~3T~KWYA{vcV5fuij=TyEo3I$K4HL1KJN{-%oqgwie#xb0|lBZ|t;9?%3gA zcj%pH|0w^y^tl)gM1i&A5chPC(B#=>P60L=f^Lf}-`NAW(uHAxiI!B#a;oW3e~{A8 zJCa-M1PwoBFjv3&$b}DE${iOL=^x^^GPaq>5gC8=M_dWimwmN!TQGa>cz3*Th=yr> zI#ZIEm}uqIG40pFQkEC@0)yFKX~36q(?BIlSpO$)+R2XF-XWom-RJOrri-^t@UquU z@Af4LtY{=6+A2@u{VJ!KSwMOr{90YXiIJQrelYdNcH61-twWhioUSXpUEvc*rgtb$XYL2{akKBGnbxjY`<0 z%$_biKnD?-1P`51iUt>Za5R_Ptv?6EA+SeD;ot{UWtMI#djJVPLr;O)@^7t6P@$ znox69WjgLbHErjc4Gt#x-ZU2mqA7f1|8<`JAlDll7{>i)9=@`MVtVYdxjoKPjrgd_ zuk&%lO~qylU2a-hY__PhgD#&6$Wthn-WlY1>1G%MS4}^C-Siy)**ggd!CEv9S@TS( zwxw8^WF2rf{X1N|hU=9GR%!9vBF=?bo+eNXebX#20k1pmens7fwijpJ^nP*S^ug9` zZwt50i%O175zojkH`Mrf+AyczFE>}u;x=deQOayp`^K;N`dz=VGL(F!teSFuF*rAI zJw+Cd&~NBdGwh63X5VvFD_*`Ucdt@g8G2_oOxDk;&&ey=xp`!bn5?8Ye+$&4rG%jA z_s+xFC$xytYerVAH3VZ?ObIAX+L?KM<5;LTlM$~RHTo;M^_4VFyL}H&*mn!B8LgMF z%ZEWT-v`FbMz{GK0_G>_@2h}B_k!Gq+%8C;HZ+&eRUzEmIUJ`3^rY4oRk}h$`6LNJ zNr|LtHyb}>h?+{hGe7sagfJh&1FoHLCreDf7J4)E6M&xAUCg>i>x7Ig{NT#{=ZbC( zhBc_pxd5W0kl{@Wtnx~gX#Y9KesXe}?6=>m_gUR2U8_Vihs^)9gPxzu^*HM(I*sRd{wC*ER4mrzN*=CzIIeb)2qlRYysM~&t+ zC&NBi?mwRPRCR-+o5a=oZ#=iw!Rwi%*wdxpcsZ2UW#q0NA$nn9s`9{7xa*6A_L- z=!q9nx0b%+YQ+sWOQ|!4V`R&ZYh}LjQ_%fBp+&+zY5dEu^2TWRR#vV12)+Ke!*Bl_ns+_AFRVZ4FOj-Z?%Y@e!29 z=5r zg(;lK|Fx}7Ndm4eh>uL(SNXe@JY!OJn%x{Kl-y>!&iCH5FKgexr~aR*xbMSHGhO zJ7#X37?be=iWudS+FAg}B>A%C$7}KEEt~-6**in~yFX2fY1;p&{S7fY(JE$yMG!>d$vgd0e<^wdKK zM4w=v{A&u~xUx@>OQI<3TIMJELI_dC>P#DMpvi)FIonxMZ;^{6pyKsPVZzp^4M*xx z+0>6Jh?_pID}#sG-RnoSs+Eq@n>zPgftGHHyi{FkDW$Ov5WgV-qmQ9ecw7I%SY6c3 z%)T-0H-3QI5$V6I`Z^<#tgqq#D(zp$mtf; z^P#x9Tt(iMS4NWcAFNDW}Hz)U)5KCwDAott5bqEbKvV|7|%BMV`p+Ke$ddXc(o*AF?sM& zTziCDnQzMQTy+-zFh*+almFpP2SYc@vA#%oWO-Z+w|qGY5x0BQr_3cRjU0A<<*L{1Jmx23ue-Lwmfmbci1b?IaliSk%4>fZ z<5`!>bP%t4z<9hHKAy4YFqhH(X{g@3@g-&MSaN7xem-#aL_h$NMjY4vTR8gb$>FD*r#_|n@K;pf1m>>9}^u;Bg6VUS_D5ODXp@D5Oc=uA}a z=nF{_%sofH2&p3ZLhXqf+|SChiaw6u zL$NODPhiN8XB3`2lu;$qD>_%MgT5$DC*XoFAKJCY zs^ApLGGK+28qa%q1O`3gXV1l5V;heFmrN#Ge^W?{0)fl>N6vz&?r|eH3 zVzj8~{7wZFo0R_?JV5RG*JPnx`b+=+1+(aZnTCI7QUc2aPNoe{f^*c=T(}ZI4x<=#_)JM%dbJwRa?PfbQYq)=88#K=7Df^CwGMx7fYgzzOk3C3ia<6{n2 zJR3=Yfa?1FNVr~gsm}RI))_3F2v5+jLEVK23y>HsqTWSv9w))R#M|Z%bFZ1k+`^V@ zU0A$S|4^#7VayC@^Lv5Q`OV%*@O)9sSf$&At>-=AAK^3FU5^}7E}VbsM1Sm>5Zr|Q zTK$-TMv>+?JW1D~M~;h)HeO6raNYU`1j?akBI6KA51|(t?@u z(cZcY{Kz+S8{;05Fex;6nX2b{eoX>*&1Uo5dUA8cT0vSp#7RPhalaX#s<9D{Fuyz! zv4?-Ypp)_p9#LNWSPz$@V$NZ#Og)8_&8} zgb(GHb$yE~)F)p2=F;_TuOF4*`&Y5OeYANQx83QK%GYWOL~fy##>>8r+nGKyug6}6 zzhU~;m~K<;bS|o!#ddHu_R{Y+=`^>0yF8BCpt}j+VCAEK_DWPRzxqKV_}@~itoOe= zCE$ehBvMR&A^NBz3VqHab5|%LZ#?CFMno@AM|w<$0SLUj7vv%sluNsK7$7RCi<;e* z5qW4_>zpZ4QakCza+@UGXm4-NgoKk36+?hrr%vG7dx!ebwt;brzG8&~;xfL6fVGwL zpIn-?sz{fpD;Uj%y9`znIGI2_PbXF6X>g<3c60|_gR{7v0j=5Q z+m_%GGuVp8sS1@$lDz9Th3(lf<=wYSR7b4q2d&4a74KM9Tp(2zSKpqFKH9yS3O*3w z2zx*bJ_8mxE%#kxK_8UWZ7~pk4r<9A`l}@_h?Nd0atsbtF!O|d0~bOH&_RkUMuN_w z6L&#jP5TE2s03*B-7K?@WbvW4;=d-~p0Me7c{yb?Qx$(!uKW^b?T!8vEahW#CsEtm1#^_W%Fn9M$wH)n2zhi;}eI zeht`K`E=%UFV)s^iep*nak_gvP26*Xm&^4orPmyDTAJFjTWGv@@^is<6L0O{$^HCx zr}4^5IT4S7Hr?jB+kPiVBZ<6U8z|dcI#1{gYl!L6@if2RFbVO zL&TPgm(=HOIwU=x>{5$NzII2&L%#P}DxS{^LzH5`TpqBe&u`|bX8f!`1nRHM;fErK zi-RC*|5-V;zHX)a(b{qq9XGb@CD=-vm<^kbc--N7cC3kBpy>YWAYp3b&X*El9}OoF zZg-gK)~l0TZCdm#b$l5}GiFVD;adRmOl$AeyP;W+>?OEQxyHCZ7C&uvSwH5saTklQ z;it-k+k1cGjB6&4YPK#J8%bL`Iw>z4RQBlY(>rr%AO|47eK|!E@k*~QUk{&L=SvrQ zU(B@Rs{hxdWuw7$;RK5=vnF3)Mn`IiDTznfS3JLh->IWx^Uhis?Fa5Q6PtkMi^Zo% zycrMC<@S9NTQdDtth~MQoBT^*=2Yzu?@cTCEuFu*4G*amnJ3VE%+Frzx>5EfOy#_t zOJnC@gd+^~Bz+IFwPZ8Qx+5R0nw;zZqQ%=}HUIg$j$us65(=9H*kwLmUGk4|6&G)H zR~ruTd%yqweI+|C{D73G%v`Iy#AB9E4>}b~iV(Fw zw;EA`#YO)*LF2|Z{(WrzCl~%-#!ny}Q1SvDS1Qa7EdR9x4|9k5wdBKMpobiUg;YVD zYDlp8%w4y&!|Olsj_nbH{UE1flID2QjGEGmprqwC2E4mR72s!Zxo7FQzHxjVMlr2n zQszPz>s+TzY>ET1j}HwE#ffB#Nh1|6`ZNJup$JRCRXsuf!vtQdbvzBM)u$jVD0&-k zgQ6Vc&wz8dTNMVIg0_)wJLuL?zp~8VMm(46@ST;sG$gAl`!0LQX}h2YSU*&krnUknwP~#_86?aN$pup)zQtGRoZwT&@-uz(Z%r1Yh69-gt zX(s8=lk|4paq;tGOnO>7Ghynr^2{HVe5t4X6!3n5_ zg>oR}2%?!O0>@`(F*R0MI7=cuR}ijYOLd1UwJ>@CC&ugL=Mc)`y&p;%co($d$Wd$o z&X^82W=A$2D`3g46LjaiRgY86LP5sXsa{sM2PWU7w6kOUuX}6oADBLvgp-xm7M`jL zmVd4@t$uWz-1YFL%Vyb8uG+`g8;iIvnzcNZP6Tinjb zg;0x$nmGC$BtOHU?%Q{;8K&-BM9taWA?M_3#LJ62K^Ol##;3~)0isQz=5@RcJ zRB9ka8#&ML<@POnv&+*Tmd$)M3g>GdUN*n>f%&o3fJmMmeVG7+BUGsXp%+6N(~L{q z&cBgV14MIYT;OHoz4fUK>ysqU*gGP##`duyNfCDm2!-3@!$;Dqf-ryqnFOPm?kdZ5@uv2w? z@D*3z)naeXW3n8cHw`WpA(W*3!I^a#u-A4G;mBBc@CUrfC{=; zL?KnDd|8`$OMEUdG&J8cxjh(o!A3qsZ{CPR%#69@5nI&`hb%W;@M3JdJlB&MIEy|m zq;4T3;{>dFGE|vb0+$F0(hM+xE{Eh*pwkH&Tj5Xov=Ie@83>p?kYwHXwUlHjuRW#JD5fjxjIIr>^4q~t_JKfU_~6M zKP``c)-#`T9~ zAVcWD#O~6sGo*)3l6rrZwYDMH#cCT)%eHHgkxyDm?0$=O_@Sd z;(?6tp^dCr)mot6id*I(+H-lBbGcJbQP82tS*YVSGZ5V`50d8EcD{skCI`VPM%v1( z2?#W;E-lt3!<+u5j~|lKe?zvZ48(rQhZr`1o4qKn`SQs)pG^oD^GMBS%huqT(qj+bVoGf?JKcgqD|pwy*YpB z)*If>aC-Wi_n8Cz^#r5^qpv-Vjs4;Al?KcgWj#D?2E##o(oU)!+v&VJl|wO^(>m=05c zv@uQ5WOOOx%e$u@C0NT!-xci-&V*aDsfnB(kI-j}jC{qx6Lk-Cb~PS~JdLjoY7X6; z%M5JL%7Z}pI?0$IQCju|W}&o+h*I9sCM-i7p=Fg+S)%NJP|l>QJ5gZNRBT>5V!3}I za0WBKNewm9KvFH!{&d$u$P`lGp%b-{x+X|z$vk<~RH~ET6rY%kSyiv7Jj9`6adEM9 z!s5p5sYB-&K<$Krl%>_^W7(NjfQF9ZJAP=9hl91VN2~SLa>)RU%6d8kb3vyy!~s?q zuW{~alhB>UFThA#itXW>fW*X1mr?E}$lr0Nc;8i+{-lh*$)L9$`eI8LUGXc(fB>@I z+ojvYhE)dBciyF^>xhiLOXhh4l8d2LxDz}zo0xIFD`kDZCr}`U&RYn0Fz?9#KQpTX zV2K~Wc&D3%q3H(j&7ea2)xBTdVVesaGWXO-9{u&%=CcuaI1L>*22`$PL1y>eI_mK% zHTldR?w1CeNWjeffEjDg5f?&+XZ@mi;C64eR;uR`vF}&O0(&*+{k%)e*47eke#2Q3 zkDEAwCTkArT!wFV{?uf{;mYD#_WnsSlgMB|R|?zAb(^{?w|8rlMRWt^(96;*qn0R; zJvdg~>@DQqwQ4pB?5VIOl_YXI{tYa`h@vanqATHyR$(doyRSW^!ss^R!}{pEAUPYl z&Xl2?S^Zl)-|`VWzp6o+n_o)&zxOHAh0qp;0Ar|11)6#pQgJXOSKUVEh0)<*lf3QU zA4)v*1553PidVW)E-O979{W#=3Re44DaV3GV$|u(BYI6ADOoKP$Bww zfx6lj$=$fG8@Q!Aerjik&Y|Qe%tt$RmHmql(abkb+Y5*TyYoapK19a<)Zyde+(}xRiUR zHM{H*eIbjkF_WR}nZ>(op-+G&UR%_KWqTToazHL4Cww@gMd%I5rJH><|PM zx9x@8)fFH$Enqb8@z$+xDQTp%)1j#9M9b9*> z`MLY~AVsDeuB>I?s~dV%*pl*!8#xBF$^ww;hK3cV`t5r-4ydx{N|XWJ$yk-s{z-wR z4v7KdS+S%3yQ5T?*q;zoNNNJO@IYp6k_spFL zcBM9rQ+!QXcg719My_PeZ?$9d2G8qC=#8D&Zv^o27&U0IkQ;)%;PUc=l?cEsb*Tz$N0vt;px4 z>yuL(uz)pepG-9H{ufd1-uEEEOq#FRLZrChL?iH0f4Oy1-+ml#Q*_p2s)v>h*mO41 zhjf0B1Uhwji8^M%*KjGWSc?37;mxfI>w1>>TX{z0EdM@5L$#}FSrd)c>CvvYZoI(z z7;!7UA7PW@P^hh}mVws?Z3#02d@id5dNnElU&p(4=Tu|HZAL(}3Qt3@hU|4-C~*f^ zrgjD^%GS%PCGQnqz)-Py#9g))7h16Asuw|-?X@+mm?nMn|M?t#7B8Mmn^qQxP+J5k za>I_RRa30mv9S{DK!84edB}HnC0fBsI|B_c5rXbi>3Yt}Izce@dBmN}CA?a`W`qPg zXgF@d;g!Qzfo__?6!Jo0=FUPL&b&s?6XUoz=#6=QGmb86xcz53^MQ$b@RfUZ%AOyF zsg9)L!FOD3_|ugFEM}=WMbFQdM#e4bd#8E56z}D(+dkiq$M=DBQK#h$!%W+aX~WEL zW;`l544Gjfn7l+R%MF~4)8&dV3GxXgKsCARAFvgHmP6!p#6pe_cL@yOYB!%A0b{eTSD0E9j@dM!f7 znT!Yf39T4rsQkiNGw?Z;&a}fiCvIUxxtu>1W(L&Y+yJ8UiWQ7b%Z*{BKffJ(T*}|E zV{e28W{ekk9oxwl2>t9?vP)F##%oL)CDWhI;jmj_cHj6qjeVo+9iAV_IhUkZgnFU3aCo#aHrV5Tf?bK2PzRgNu`B0n=p&EK|+v)pwv=Vdq(pE+04HfxgS`;a{ z)jor@I544X3(T|E584%GuDz zh-;NYy#CITMKA&-B4h_hp#m==5G2UG2<*l1az`VfSQ(p6ikWF(#yUFkZA~Gl4%ySJTldu#7>=6E_ZA}Ek44eGbY9q zQ*H-ZzF)LSu(V8zmZJU0mxtDyg5_}jxN}~LJ5P?`T$xg79PB)XpYiFO!{=#d&}@u= z>RZLIi#$)Ua4~E|b80AL!bm)_t~%Rq9as&cI}u#i30N4+hHv0pG2r>utMoyqJN(x<+%zCGsBm6cspSTB>5Sj zL($nej@CS12MTiutYX@W#aAw7Zw(R0xTk>v+tAqLFmd#q@>+g*g@NX<^2I%1SpG0P zrB++MzwrVB%3E>Z;8qC3C#W`ddEng+ulmb-h7>7c=lqyO4WN(D0x#}Z_Lfe}2P zX{CBj^)WWf7C&H{RDp#~R{`zALBF@wKbo|YQ(}u z`I}cpYt4Z)4GTA6Ph)?5iU9PjNBy$L{Sc4wli`Kc4DZ<#BCBBP6t_eBMNUW>)2m6! zNh3`b_4ccJCh~jEHH`=x1D|OMVm+mFtl^}|p?{MkP5QA+*vI~0=qAn&lmY8hBzFSm z7)cGwEt}n_GsYn)&92^CM;H@q2-s=k^49rSY&ypKnV2Kt<|AJu=N>`8_oHl`f&($) z9LilPXcK?DJ1$7Lku8qsVXuL((y=i@Pc4!$K->qmM|xIURJ+-&EP7L0B51A?XeilE zw*UoDyeGI?=}vJ>9Xq#-**q5H865CYSC2JMTb)0^yios-d;;p`0^A$8s({CRBzLcc zKY`zK3!o)iK+o~(NhHTkH?d%SeeaB+%7oSK)$5^vs3}{Z4XiKt+vW!ZB$zX`2N03n z^DLS@ThLPZ)GJVbR|RJU*Wi7&v4D501KG@-J(L;3LQw?Of8CUkUi~2K`HMnhfAM-iGunV0SRpAoNn;gTJ+`$xe2?L_@cQUaGLcpb-h~u%&o0X zmwu%;wO48MTF;r%9WC7~23QB5jL0|9<|E*69A~Kd{_W0|O*t89k1%!ynwWi{yC~Le zg$#~+j{E--VAh2s<#4XGJSV>W7O`KY^CM*XmfRjZW3Kp_@@~|u(?NegtKtMO=wWvg$h&SdopzLqkw^7y_%-B_KsTVA{fmyjk{ge0pz;Frg0T4Ja$ z<1qK-Hk0ua1dR#%o-g0mAi-aSYW|-xFMn#nfRnE`vG7Cv>~a+qj-OzHOrFx-AQWhH zbaAzี(D={P4HkT~>{Kqhl3ObGhK&uoV>EI0`dQi64LVGargwC$C+YZ-iT5Ga zYz^=*jH6=_I^f7FN*iRw9Kz8vajaPgDTi&bg|uj8RXUOqTU?L6H|{Hre+Kx@?!USR zwdFtdnW5(?>u3srx&-{64gL4OSqA(DdagY-M57w<;UOk6dag-_&vCdZ(U-;FIp*D_ z;;8$;mos7p+J|yRW1^hRC+i1VnuLfh+zJ3nFnT>h-}4MJ(qR9RRi0Y8G*@hR&#z(% zw_P56e`)%!OGef_Hels@#hIm4Sn2!0_peW9Kl=Dc;dyPh@xu38R(V}?x5Liei@ERR z!ThRU@UGqJcw-=W1fU7p5_>=nfX_%+UGKH?-pLKzLHq4Fch|Fb9|AhDFr6mu3RKK6 zBWg?nnhQ4M*1kaeVt+r@tykRwhU5gk-BGt_VD%A#0j9b1=jY&pe-fofQ~pKd*srvy z9ZJ8~o2sx3%;>i!Yy;|^MP9%$;9k^lIn+i1L4~V_GHHw<-xY^5Tqs?ad#V@&yo6%g zV*4_I^kIfzp_sC()QOYqi{k8U0`+Y_XfJ2bi^j~c{kAR#pY&m1Q7#U8YP%$J8n>7E zA-=IoK~Ap-vqaUJ4Aa7Xq28A!DHLg-oV@S+aJ@w2IEB5&p(ONl4EDG-BZ_3kG3%oq z)J>~W;KzMq>l7561`Scyo`WESIW%k^l0MuoX;0&IJ{$DP0@x+c5?3D5J9CA_SqiXZ z(ttfH_szJG+@-9LbXULDE6^>EYLDgNywn$eQe~P+{E=-r}% z?=8M!1V3&%&*wO~XA7hsrUV)>)NNoxM|+uW&A+hmv{hcnw+W{}_=4W)@rvO1Fpp@(^ zgI_qwQpm4%zGM4iBd*D3J~R_S2dFKCQBV#y{(NKyT~&pLiJwr+6p*lbvpf)CralKb zIw_pCiUi$xAU-Jgk|0heo_q6`G^s`u6K?>>bjF|P2HL-m16$4=^8!}GSwZfX;Jw~U zWrWTSn)0u)N=#C}jz@J&LYw^VxQ9f?WM?$ql#-(v(&dX)cr`cAYsICHwoHvU_5Rgm zL5@DgNhO6ApJ!}qYvMV)_+LW(1y~K+_;eUq1w$(Y>869a1PlIVp{iY#4B}?0d!XX# zg1>NHi18PI@1mpI+s~nJF2zJqmXI5_nL?bCx;b2B{zxK{UtqR8zwY(?*o-g(wK#G+ zd`2E5S@=j4XhC;~ZNMyG$OF&daJ?`#$HoW~^6PZo_iWB8ffT<=@6Fj{E^v_f!TwyP zrv#m5O!%s#!s;X3ieWk`Y)a(k?pKe|fp+r+<*fK&sW)@&d>&i*2~d4g%(s^-TG+r( z)YO1;%T3<*6+Q}GzFq!VXM@-6m-s60nG*eG9aMz>w*&?#_wB9k8HldiaUvW-X`z)? z;`6rniv#VtVh|KZp1t;!d7};{uaB)9P%(qFc_6bh((*n?n>_LQl!ak18#fZ_=s<&m z9Npp$Rc1u00Qvqw@%cY~{moE}Q$4V;sPg&Zpo4FN*ZMj>nOu2JVR>#L{v#qt9ayYdK*z$Gcj$ZKEc1fV>AbPXwa$h#6 zo9-QK?ig^^4t~fo8X%XO;c@rankj>(PUc!MtmV4hF#z1{aXe{Zu+rfTO&%8w>zc1{ z_|*^WsQME;gvha?Sn*02V3$LLNhz_yk?(_5l6mRE4cYqgpi!S&6$)l*Fw)ix}3B4`L$p} zOU!rJ)M&fzw!0jht$e7|_i`J!`z8lgpYW5PAu$IoCI5~@JuFkF{YZMG92KSnkGUW1 zDz_G(K2IBNA}7q<38lYbC32@xFP6#J>)F=%(csVSS?dHfRA9y z7bX@~)3LzDDxd;yxgT1_)`aKYj69*$$@JhpM%469(5=FEbb2p>t}wcZDE)~>2-PhI zN2~$y^X_zIZX=PZN7#14SQXU6WcY2Zvo`QB`zc!s1Eavq7I&dRx@*%|E!4vTF>yC& ze*3uK=Fs=qJ*~o!laWsyX*_!j&3R7EkA`-zhY1iQH~yYu?gDAE*#)y;`@5)UR26th zg8xJ)InsK?y7TjL4Kt$GRj70)P)A(6gyB8g`8y(2&HGu8YD!pCE@{}DpZ@q60jwK}Z2UCL(bZ%3{P$QrVx5Pf^n}A@2e8to1Gwc~V}J zhCKkAwHA9BoCZ13R_EEVccEtbUiHax>;iF&aAsRM(B!g%02N-p~&<7P|UA58AZ7-#1A=gHbyb13)MM`@g zKY}1n=Y5};MR|o|&Q!;_pM^TI7l9@&u*tMsj-u-q!k-Gx5byZl0uFyWF)*Pz2?MgWElz-ovAaytdQDw1?ZxK)qN zP;LK_nO~kJw0R(Zi$Nw|)>#Gp{P$f3F!S6f0Q@xoBWRarnsSGJX73&nuhS^4O;{Dx zQTLk9#!>FDOguTMQL}87?`r+fsSrK7X5tF^_ZAB&2l zodXWG76b%SOG-)zi?_xE(E*4;CM3O3h(;;9Y)Da6OP_XqrC^9jtL9iyXarVZ zn~=%?D5VTk7iP%em4{ICgU2yW!dJa}d{uHdomGJy&-?=-Y0925#Tr$@&)58}0X~4x zJkS9Q(t%}i(Plkbea}~-+XX2Tg6*lzt4H0dQa}BH@8HFD<2qj>JIfK*{H7D-d!vis zeuwUeC3P`y)PKoZFmlH7`1k$M#jtV8^0-Iiern@>qK6b7MV{UJ?i6s@qQ!f9C}4SL zQg-Q!?**_g?HpvO&oo-`AG%biB46odZ@?!;wcYBTYV>|QdcWFJCg^xE^Z0Wh*U%}2 zTBSWKdJk)>b+lE8=I56i)5llT0JOn&y1{jZ@#UI};!>Hw4iQKKpRIKhT>4^OI@(+f zilK2<57N>oUl6%;oO0QQEq_c9===*b)m0t8mvRp5#ZCc1msr>ULtQfL*QV~WiU>;0 zfDspR&S{HS}(N(So(D}_SxA|4X-u`+9#!7?z{_qY!Z6u zWw2H0o605<85Tu7#VIynFMVcTUy3i$W)H`*dw?tWIKj}eY7Rj)nbKO z<5>HJ@|+R3djmJ(GlgIsd>M@3vHO7Gy-o-`BJ|l(EGgdtAN-9S0RJYR1>@Jr%RA>( z2A9rc?rEEeA<_6v#*G8t#$Df^@`rXbtU^Sw#k(Nc&n12{7yc=ZO)S$Bz4mU;0<$2> zi@1u?65-CK9%V8dgo7X%@m3f{cS-e3Mbi7AlLSPrG_M3}#j{afqcMh52mPD>s^z(1 z{%3A8VQSkf`srh0PY{a%2MIV%H#&tEKrA)?y2lK(Z1O=YJl1kgHTq&%>9L>ix(-Zy z9-pjjd=+Ag_r&WPpWW>-fJBW@iPo`guEQfm%k{LP?8yT+vZJR3ITv(Q&K8j!0!Em(^rBZT5MtM!mB&_Md`e8iG3u|Pz)FwaPpPKESs> z46SaTYzxz>I#p3t9@U}_BmxX!I#P1p(tcqjaDf&c1{&z~>%nX!hU}M+uuZ_Os0DQA zW>Om<3wXCMi=guKpkrN3)hco^mcZ$M3~U#BN&58oTk7dDkj`Ux(~UW>Uo;g>oufu= zzq_D?&tiV=rr~4c_|&?7u;K%Tv&IYn(X5%fptr_Y6ZZ(d87s!DZJ(03e{#~b9Wa8f zU4*-iGmR0Hr)g|zn(NPdd(waJYU(l|93w=(TGn}89CoxCXuvgPN-9{!C?Jkzbj z_j1G7)<|d#rNsS6ZK*kxB~m~{;-N-S1MP;@-bueutc4ubqZ62r(exjoMZ(ii&!3hx zG&HD3Fi(?9n{{!Ko^@0F7t3|tirx`+2U^kX!6H*-Xr*ub`eGwx@kR_?9VLByKi#W5 z``GGZdr!bjOaf@{AYFYv8E_lLDh}6hXhdMgZLGDOvCVbxkBPl+jYr=ue%E9X*R6Lv zd~fJ4Inc^J_0TU;SJ3}QJrGZ@d@Jf5x?VpGCS1%_QR#oBgXz2tx)MO$4Mg`(^BQNI z%1gr3&ty-3k!OGmRe6ifvDms;I-gaoMH?HXf-eXW>%hfZ2w9dNw$%Cy2dkej1JRlm$-nh1UzikK18i^|Q|X)mvA65k4M2jK zkpVp5-JDUl9s8OUDiBy_uYSaiBoLORmSUSd1o1K_M1&~~ zn4#OjwSZ@VyYLLk*ZkOh@3wg0(UjnB<%sJIUBW5FsKH)Q1jB&n-o1>7A)bHL-#MU6 zYH$Etl#FP1JGwf(DOO-7 z>S>wD^N|TGRTrBg=Tpazo?OYwRXvCwzl4H#%gjZr_X?CZMb3a5%M$3x;JPWCTk-uD z(^{Fuf%G{I| zOm*54SghbhnT|JnG6zX3w9a%GC}VLPY9p-Dm?|wzh8?S9wDf^?oDesCXosth^{B2N zFP+nruh(#J$l>6SI89Hy%M~?qvy@rxK-0vF^}6+b|Fk4?dw|5UhQa{=bMjR!@3Y`& zWe($v=5{G>ySy!ii;}^$E80PRaDP;LDX04BP{i2e+C&RmjTcKH;M|dq02hCuJ54D* zB^V^~H#qd7v}Wcyhyx{t(w0* zs1LFAP3g5_!a%8kfY%sg-f#PZWi%@!iV;L{o|-lz!_~2M<_v4?@91nJDR4nI;n_7g z`Wqi;`Q^NxrE8O`f>ky1=ur21FVYx@|D!$~Ie>OzP38}jf{ud((-|SRQQUQJ066ud zZFu~RD^Fb=*mRy#zdxJGlip}pVN7(esx=1!7VjDXa&KvBT3Z1mJAgc4yl9Ugkl4+@ zS$hH+;ZfOw(Tz~<0cwFc%)*i_XTJ;&KeOMlX z6YznuGl|p-MMU0ARoDh3BIm9$cG}{T9Ye9b@ML>eNoODqyNbyR%W9^X1&(Qq-{n}{ zGJ%yh_bnD^9Cx1t(?37_3%!?L#?wBXbxVmc==gUaW4`d)aM$paxuo^{c+G2q^uV$n z?&EX4i81Vm_yyi2_?}D5yB5FXZt!zB4SfJoyo+ux+=v#z4A4d~2vW(}VS~2pDu3Wd z8*RuM9hR~fHjMgCw}%fP*`6}i>T;3_!TzK6IZ5L$l7HD`)@Ns?F@|zElrJetfDWbH z&66Al095_z;ixU;JmmOUKrj#|7(JPO&HE&Kq|Do~ep@N|&YI8g6L+O#qp?bkVZb(jiQxN;ksm&%o+NI&EJWJE{(UUM8mu}dhOKa@*j@I!b z`x3{ypSy;sDL;e8TS*|=!9XEpE)MTA9ceeC$x=;MBJ43_3|@};E4I1+CE!jwx3wDU z^f23`Fc6V26U7P(z8u~!~yPJAmuBUIiFh zr4=Sf9(=VBF+w>Yg7vJgi-)8h;qT}n?Sa^1>@kYeHKB)5OS5bS^br={N<)PW#C9et zEi!N5s1JR3?~Y_b9OXkC^Yub@o%7Bt4iEQ2M7A}YppRi;t!uAwAs@6ay?etQ|1vW8 z>NR16m%(tEn$#t(;mb=j3oh%}vT?Bz)=UIr4!KwBY`TrWorsqm_t~NZy6M=UP~kMD z`Ma3C3OkO6zW|qTqd5bJW-x`DXkRqO?lK{ms>lGRL0p*GpVtFoH)B%d3xV*#iMzLS z&SHQs;CES1RYmruB@+fzxbFWqfA3Q!YqdR*wKlcA$Dywmm=J_X> zW}hDC=+fk}_mXm;*jL=Gq0Sv=fK_kR7rPg3u|?IDnG?yZd>xq+7X&8E@XgZ`ldSwG zj!m27Tij8uy+Gc!hfcUwU?qEzOU}bul3Ugy%0im$PPuM!G+_S28q{IEqpOsDPw&GlYa9 zp(r5TqJkhu3p0RpqjU@?Fh~p1@$5Ozi~oIo=kS6LyxrfuuUOYw>(Y6H`io-26d4#X z@|H?j7|TV_rr5kEiaD2lN{EZFDOTeW6Rqz2_(}vdOo{@{M&n%q-mJ+PE7j=uYb&XxBvbNu9LxCwol{N2148nCd{zIaT zd?M;4n4Y0G*?&QA5j&EXn5sRJIrLB|(qXz!fi+*Apqm}aBd&zu;hB=RrTv>Lo|^dR2~ATNC-PsD|AIJ zO#nKaL2S*p-usQzLkOh-X)@-L-8OmLQIArMiU1aP3FOYa2+Jn_VbZ+*aa%p|1lp*k z0?CM=ml$uD>XDB;4-2+8@Y|q4q!?)|f&h?KrdzUFes?lmkCb!Md)sEvU87|qOKqOL zAVtt1HfBLeSWV=*SG!@W7$Zr<&W1w|>5Zb!a}L}2XSOcRw{$qtLzs+Rhm zAxXQ%*ZSNwd6rfsm-0L1mTHyMI$=k@!5mw=A+XlAx1)1$a{sy6!RzHx(~?iuh zc_6-vOqIZK0&JN4Xn?gjCJalw@DRVUU6{9_M zt?947Nm#N(3g>q#EEwQo`#6;paAYQ$0_e{r2QYL6JpnNh8rqhJ1!Mw}XmvIG~cl}PWBFdIi5yi=dVKvd42#pN|W5J;gCRvAa zhTl&@J@_iTG#;dS^Rar)1hG#B~RQtE7Ey`{RuDUlLEi>KV_=D${y4No;oGxA;ef>jm zVk@7LaR7?hTtgB?d#P1WwuQ2)sK!J>l9crl_xHfWSey3@kS42?GC1q_S-orS#;mDH zL0H2%#}82)zOMEse8)&4(T$az#^8*7lys0R^F%E4bpq?u$FfK?dM9^Zyy*`+Q{j!b z*E3gd5dxVrtp(+kxLR5+v;sbiY z-#$mbA5>caAOU2Yd{P53sf!UXUI`OqnoX>$CBs^xSY=;5es>L3Q$*YDykz@VgKjD+ z1{S|%-_)i{y;WH1YpNK$n=zkRSP4fnE*mG1Dl4DwBzAVepPK(GfVB>?BIl1LI+bfu zJ_W%mO7OYpwEjYjcDQb*ay`W~oP?cxd*Pb0b%^8+Xrh000Z_8}jPv40*eNGwt^xLN z$r-$_IPEu7EsZIQRKwDFTT<}ysp z)sx!w3!-_*;4`wAh!^JRZ*rF$lRAH1&m?Bb=Qfxr@^okt1%O2rmFm5y>I!K+HANPq zMDtX2L#}U8vwgT*5&a!B2_&+u^;}C`+klI^7i&h4NcWAqq@x?yAy@&5GFcSGEpm1C z-)@>KgoVm=U=nI+39_Iej9uN`WwwFdR#qBQj|8)uS(_8*unop}w*-<_3vz#Bt~VI4 zI_0l_BLUmHFj>ZLCf>Dx->MlBs-PLvF@=r1Qz&giVr~>%ef;p_u>1M4yRt7BBbK!M ze)Ta}VZwq&3wzH~#2k(0e1o3M#j||aV0Pak0K#8S9mK*8$C{&JNiYMfu3tex6>G`4 z22@CNiQUp{Cowq}Xi{Zt^Uibk3EgwWKzSyDF}~-C^QKaf;oO|yx{nsKH;IlgPc$5A z+`qUlQ!DK^9(x;k#>m70CWj^O^2BEGg9yhVY=?Kmusfw zvEhuJc;ecLZE`E2Uzen<6U1A{A21j{NkR}&k;&wB;gvbFGj!#x;&u=dZZ-wq57f~Y z9OHWcL%X~J0h%{JGJx58&jaxqO{;QX3`jDMyJ>%df^jD;6W*YjaVoEN=mhw1+v*yD z(0^m@Id{;9N(auTwX7A=@8#(UWJXs0pl(DWL?3I)2Ts^US}_3pkcGIgtc0C)csbIw zCi3hM&lf+kF338;H?%n+`*#5!y%}eW+JgbYkEyp9YD0D+p53LhJHh4d&S{d8R(Fh* z>~vh)b;pTnqG30K62c$IB$d`$&e_pql#gNwk-Ee;hlW=lAXx@kL-!1OEt1dClh;@7 z`6`NYpL_L=&|;{JW$EvChQqV2H1J8NSw>Ybky|)0c32H63};sV`GstTgPxE+W?p%+8WHJe}CUlqTRh+pghE;96N|NC(Ha6t}TG} zE&3qls3It+nE}8a3I>&`8GtnG|5aAaUoxCcVu5cJ$gPapE2LG*SX=(};3K#`z^C3u z&R*B1harCjY9{+(41slaaK-d8-2vc=bS}nFvHyxJ!!u$;M&Qy|$D1|2?wX%dlOiJa2q!O{~;sb@#N3Sm^54A7Ke-!yV`hckD{5+>I#Ia$;PDge&+hFs__3}caArwPXzSA8|kibyG)H(CUv0Z zxc4|PITc3%2~yjfivATRV4n-k7h@pvGbFLKPaP3O&Z%|TwL>+paT&nw9|lB?p-j~f zbA6;d^u&-Y6LTtRTb&E8G(*Ik3)c#zTg1QHz=-Xti1IaLK>~E_zTb1-2@h2v;)$mx zDepLFmYvoTIAcf^+@xOTsDyENGXTDs??R07ES_-Y3kVa3$pNz3)9w|FD~}V|fqlSj z>Q3`i9>#VsOlR0&zQMWDoz5lCG}MjOTu6jTZ?RS85-9g|cJ9wj4PX>Mo^_<2kBKAW z5-g|~u&zYT7bTLA8>s^%s?r^!ak&fnSeKqCI+JkiKWt^W9Yc6x(&b252W z2F7Q%$UQV=VZyQlZ4Z;&1N|l}>Hk6p5p(dWPVIH|0tJFyA)$X(?q+)&ZL)}>DPW;+ zlE4D416n{MN+aCr8F(Q)ld7BW6-p(sM+5RqSR+rq*kL$RDavOI!<9*`T+RRDd6PpF;VIHf#vuRs z+|)#`H>}*Q*6(>NiM|h@;Z2^qhQOr1x3YZ8q>z3?!A{*r@Vc@o&sJT!RwI)upYd>E z-A=)9PFs+xu3~$x;-yHFLSV5PT1(dVbuFl-0$u#!x73t@UKzbcOa<+(%$;xabMJH{ zMMQ(*ROg-=da*+Tcj>tsVCwIjE`EK+p#pokliWMtL`GY*j4NmxjRcxC={DBJ-KZKM>KZ@O; zozSq!A%zf7{;s3ml2DL^^C~G;&>Su_O(bEW7K~L(2wmhu0ly^y1c_PDSJ)|N${p?` zhRtkDR*^1<1;d{uGcv0CuZ~=)>qM94QnyaVtO-OpMsBkLK~$uNf~Ig+{F8k|=zrcD zTQ)rDs8uvuk|abnFc`NH?|QtP;T}CJ&0?3_qdehN;1zze#y(gzfx6B1IWgk$34z}7S3Rr1gua?*?{KU+~TWFWAp#Q_;a;zCD zu_3^FmG@90Sj8}sQYIT~|Jbsi|DfgK%;n>QLP9J!iOR6tfDNEDtz_e@ZOe|2C8@af zVEaAPw@R=_ERi0G z^$3tmh!txPRHPqrt3#5cgE7urFd{{xK>tEC>kL&Am4ZX&(1I{v!x;!CD27AGN-r`ZHtzy2KfvGrb4095mV+ zq}`PL5WOeBTT5>0abr38!vzu^E^iN!Tq`y(U>&p~ulXS|`8-IoSu`MgBVD!q6q&Q1 zCp`V6tc+#6!l{wRgh08l#0!FUJl9OV#O*+=+cH^?vnQ>F)K3nQh72m}!$tgDCWDy?e@<%j+9Sz8_53i<>aY;aym(Yb1(M1x;jkN=(Bb^m>|2Qf_mRV zmQk~WkZqE&6cI5i!}=|Gkwa%HEpoO_#T#dQN|2SjW%cRkcbku_>`*;QXQJ??f{%Ja zC~$=(1NOkI{+|+gdBUrP&lc_@U6;Lubc3m(6&sekMG=(5=!R;(o2%44yP5Djn%6Bd z9PpbyWzGt*K8DzOQALI%^47rHxx&{>q^4rN_HLv@AxlmRUe!QdI<(9CB&|#P0v~Dp zpAtyxL3WW`cc2M)Rt%zta21j7fmV0`u89cDG+~{9JF?<&c2_56_hzaHrF6V{d>~Bb zivyubrP?L+|2zv@Voc5SU5o0+B3%!3@8*=-9|y`Zavdw4aPyo!A!lR*L1CYDy?q={ zzEP3J)1eB(ar*#`b|e84gxCQRP#bzKtT@>io(eN>)6}D78L^5r;p_^hcC1rPkp{ut zw=DsteT{tu6oZ$Vv#+BETB_HkamQbdo@?=W#6^Gn_J{qdGY3rijT#L!Tz|s;gCWs9 zoyg!1n!>SQjG^wo93du16Ihii9iawB`Yyz5aGV)x`%*_KmyQ(56r!lrI-D`XD9#8? z01EKL#p@subz@6QvY&<|>kx4W6}E{{Bcub}XFPkaRk}>qxDKz8=#-N+*?9oq+@GV( z3(5Wp{@+LQ;HT6chAQJDO(puuwA)iDP8B+xy(2&d?&hX%1?0!7{*&)_Y@XAc?^Fg< z(05V~-r{iSNPhSyTuZ2Hf1k%w zg`L7KY&W_2YO>4Dq=;|G+tsFLKlVbYG?oX0~k zp{wjbg?bjYO&Yd+@!!57>a<`-7w%#OY=sCuZaD}1w+(PnTRon8lZ+c50EH_yv*q;3 zIl!eDbt4h$=)<>7VStcTe+UK*I8YjWM)k`~xZ7U<9)-;h*$R5zM`|deGX{Js4sI8d zEc|kYmyw0k`Uu8twuE|t7qDmnX6M)|y}uFug?#`j_%!@%XpS^HiGw?pWV*g~{57LY zb*Cu2G1M?btn=Ik#Fmgd(oFvB6jcmAGwF-JxEfn`o_E}gFeE<54HwjB?Nn?(ytSBY z&0=1ca-3@<$8Xn8D6DKdI84Qw+G?cfK&X9{z&N4b!9tb}Jxxpl->mzQK$3t+1B31c z0G=OiuayyX01_~9c$8PTgHRM#(zf@isXt}8j-`!%_holxdC&Ii*1`<`<|W~;Tv`nN zSr=xYS!N_(*MBd+`#nu^{&dxQWEms@eGZw#|^wz3z{-OiC{p1)G4R zTCb;MGmpJ*P0yr-QDP*tuX=3nRkZQgK@>GDe=}ebRny>sDXIiqh^|D)g02%yQgJR= z71rm|(aHlRB_g71`P4x0OGHDS1jh`Q5`fHXo|H*`3>NE5)B^|18kaaPJt{W6C;!ov z!Xm^VQ?~(c_-3)HuG6YjMgKm?P>~qW?|uqlmA2y20=A|3Etc}o_s+X zB#xpU2Bdp>*REJ^l*CIoW-2@6sU@Nl!&#`NDhJjZ5d{=$p|TVvzXbg-CLoP)x$2-9 z#?}iXIZc|Mm`rsU$SZ%iC7O8C_t%@Vd2LbLjN<(^|Dq=O3X(JjL#Rc^?oX$165K*K zBoQ&q@a&DEbTCainuJ$bnm0NHE$&LkL#KJ%jo}K42eaZXe)ku$zA2mj6{s2hPFM}(`i&I&+>Og5bh_IX{;0Q`FljQkcxNEJN%fF%4-T%L!4 zKsVfD8;fB&;&8adzyCnRS^unLNOH?l6Zm3?7iG-OqDvt^4NMLywp55&)O3Gw^G(i02 zy#nLJZ$PBwrHy;A-G_Rq#(WOp=E3$SCs@IGlM5K@=qd@g`Aw9`*90YET~Kr|MAT)v z;S=HrLQ=1A+?b{1%YzEf}M!?As$eHu3fn%ql-|xQL{-O5}$7 z>GPJyVN5HGDuB>&`tiRXo8zKs&hfX4{U5-#X7%DU=VJE)CVhwL<3|ACfpYtqhvj9R zNN3D#@`Av4ZBCb(kf(|*s()i_0pV}=bVFLePKa8dFw4HRE#3iiwA(v!h6`pD$cWY=siKQQ}*4zkxP+*?Co*he{M}FeLwv9?IGP5V=tkuKl)Elyu5V4 zxWHDZ71|L9gGeWyAXIw(r}|K_dQ+*>4xWtID z+k)ZAe-+R1Z4>Wz#QmxvtO_ot9&Duu<4|Ct)fufHV?5RRm~w@1BK+|{;#MT3UnQ_o znt*Z^xA_JGzc9s3AiAQ-;+o207Uvw^y=lE*iG86oCCmI1cZw&NCzumV`|Bkl2AvdY zO^sB-F3t`lDb<_KPghi0ba#b-mFg-7eYo|+r(^#VWBUHMK&4<_1}+&l~6MezuMD;zSr0s<(4G6TF=dLGK|hd) zY0MmzLeQtror%ZkaBeMO^G_Qw(rlejdI5~%dB}~nsp?c71~Zo9{FnWeSPI@Rf>kf$ zzam)xjssZ<=LuA^szcB>A-%8H(^!%n`@mhb z5I|2YAq;i_RuTgGoC^-mr3u~3DOg?T+FYZ zS;bqg1Y}cw{L`n)BX`Q^^t1vi6i(2>u$#w9JVjVWGp>3scTUfgXv5H$l_c{y!A3M- z&J8+`dLKi!4)|CF39Bnj+cT)J&`D2e7W7~CbdECBwp=NG#8ID%hEfDP4<&hDEGn*j zNpvn>TmHOxcd$<*u26SX5%u+R_MetbpFxj@1G~x}ed)e*Dz}sPX6BYQBA`)CMwjXK zc2FO7o=7Bp|~xeR;1FAiB7yO#0Nd^>$GxcIfYY~UWQ z@1yOM8%xTZq;VEx4O<)$=*EegJ860r6+!_`(d4Q`(VY*_QlKz%Wxg%l_%xkMaIXSk{ z7Gg4hk$=`AkkyrtKDZ+3&d<{KT1HwLmm--j1t7~7^%oJTD##pqeG;Ixnfc(o$y}cP z$?cV^&FLcJ1?M18@Ldf%j0rmo^Zq}l1pa0CZPD__;-VZ^$N2Q&>7At?w})*S@yZVC zJ#(lZwN}Aw1CX0GIo9k?jxN_eeSPz8lpIk<2-hKksP$Q{is-$H)%L1Mm(5ZVBBEj5 zzfDhS@POX49x@6FZ&CT`B8Cs;UP2e(X1MyqRVeb!!4q9sVr(ge}1)w`se+@AC$Q&#cKyKKieYQ=e(6S#TI*a zZ%QH&vXSjdkog)$gVf*q8kr^2WA4`~l@o_leAmsx7Td{g){E{c7crPU9kA>rYcI1E zLPA0s#OawR;tz;JF2U{UUl@?wqRKN6>5>oXqbc-~fDm0Y#_18&GxP6Vu*+Yhs32>m zI|kMSs~?k+i%9r5C{e{74vht2xeJ5|cP)9sJDd%m!(DZ<`ITM<@EK0)s(ft&kHjWj zeG;sf9v4=masocX_pQ5Y(0^m@C*i2?6$(rEQi7#tuvD5@J2O z=Qqj=y1aXY@KOEO3sM*6bNViw#yU%{#HciO{qCrfQYpIHO3G5%#l^+UDpTzz81mMH zud{`n9seoU-$l%%i!tVM7Vt6})H*!%%9rd!?lW8>U*xcdD4jf)nPU=&LrnMl{4 zM2YbM!d%w#XKdLvmA1p02fBi~2!S$z6}?;x<}O2*o637wq}mmEdw30}IB(tN`1j+8 zqIKE^PO=maa0)VvW|++1dzH@0RP27PuKm!2mwJQEGHx?C;9PY-@LGdJWWV4OL?_*B z9d9Lp5{nn4!E-qEea$I=aQC0r=XRQ*v3^FAA0N;@&Cc@qLqqXaG|+!Gn{@7_CH7w6 zRzt(a%DtczEu4MOOJgzpK7J*F*^slAa`yxKlMhzuG9AB$*nK7GHIcF|L zF}Yqp&lJmYdrK*IkAjQ5o9N}O)8KZTi&7H~0Cg%b^alCs*NYt!7<&<-VKs&HA7S zrgF>r5m4vPWbXpG=fh@MpdH;Bpufq1WMvl{r~(;_ei^Um)cdx9^;$(=t+U4s4Jx0k zf0*H=dNaw`a`^R5cG&rm%~6}mY1@T6|G!?69XE)uEq}J276;|UZpACl|89>67%mg1 z(d<(xXe5P3FoyVEt;zF~bUX!wpg&da_7z8}JdkBV6Y_HFFFokJ1rW_Xw+Fr0;w8HP zp*6sxF`ay*<s*!;DquftD5_L?Y72Vk=2AUxA#C2jkQ_NuuqehJxZ)fqumD|KaC{n z=+7=hyrQD7n*Af5`e&xJ7!6vk*X%*geK%Hj3cCgq+2ri-tXJv>zXa`#n2DjUQ`^7; zDkX`ersKqOl_t4%U%h%&22$X@mP~fb+5U9Z@A`9bJW%d?3WhJoVvNRAm=&TWx>ie7 zJBSm>O~4=aqai=>#Z>q(RqiCE~}ewBfo{?054ur(~KyYsxmo^l!cO8Wo)VAnyBq< z>kd^4ttPtV6!qA&I5$g`0{7J3XC=E@c4`-sgP}ET0j=`#lqc*;f#2i>PG;&Jw=EY{ z^*2@W?$`qVre@}>)?U63-Us$PvJby1@WqjwNe(Jj{eIta{N4e-c~SD>Z$A?w{3TKh zM{)_M`1^n*^HqcI-@ljcX8On7T70}a4TyOc<*~;qXLu=0%P$kV@YMXj9Y|kmgHkIr zo+SDHkQNZJd6McwSy@?k^AC9JrJ$xu zwdnl6bOeblwpjKNMfB#%V2$z68~E?~L((j^rw^_F92J&r1%9AD=j5w-P|%uk-ePe* z(l%KTxd5SUJm~M&cYVK|3+#&~l1+v09-uG8kiL2u>|Vt1w0!1cdHH}igE2fjCGhod;+@;Kqd&Ro-ushM zXC#3!-X!a9bn`O+^-i4(bd_50bMB*^db-wjf{Sh;k|@HuBWfNw6i4YFZCd7T!NVnBGk4N|sB%lR`K>;#oj5Nd@-B*; z3KO{{{9!^aWg(A4@9ObKYgf^}n%fv7r6tpRti$G}cY` z$}fYpYj0e?*BWKY4%cTpPq`gs_-)}4$0!8>1Xow`$G@|SU?!}TK*q{8&Ly_I1(;m2v@Bca-6M6r;w)l0rE zE`w`layo0f^Jmj9V3Wp(=t${a|Cpiqgt;7Kr}#`%2H7!SogaXV)k{Mu{_eIT4O`1N*n1DuW;RaC%sIU_9a%1@lIr{WS^IrZ;iP-E) z=G{*&B;>mUkL{S4n0UKEJBV={aEwR`;xG0xh1%+z#T(*}Cqnnn+w}`H2ut{X|KFwZ zzoeRRP2QC=n$Sb3=HLM(rzuiOp2W&$bEr2kgJ zf%jOgDQ`-u8UEE)KaA9wB+=t;AK>7>)lX7-8vgxr?3w@MV~#~3(Aks9Ywl)B>(TCF z@V>R@z~X=fv})5zmFSskOmKm4)e|k9qFKa)Q)`FSY=^Cui{{ThDc1Ot$R_p(`mHez z;@Rk{i`{>=WQ#ZQ4!HMm)oH}$e}G+rg#2c9ss?h1?cTKqh;^n*D>s(@{LnvC0TPY_ zz)fr&(|QzAo27~@y3|D1ibi>Z{Inz(gUTZ)tJnW)cOSD+Lw!M47PuY04VsdJ_XF16 zTkir)FNMpIkxQOVUhL+-&xRoSR=sUKE zSL%*;G*i?P){J^JIP&HVG)1bBB7kEQDwZ=*U67*A1b6&!N>B<42)SQMb#1(v9JWGl zrv<}?TpKkXd8#!(Ok<8k=XwDOoXc&#n<}~2+-B;;kwOBEeN*3{^1|%NhUN+ExWWf- zPP{()3lb|p$MrQm=`h83goyN)3%(a?r&UkcUWgI;-@AlZykRe$arcvA>Av+Ph^wz| z5#j>{VI<}T|3phz*kE;iy`1Kh+7WAAI=LN+eGQM0PUP<9(`JOSg6cLLmj-{DJyQZ% z=cSZ?v6rsX5SpT?yB9Fj6jrnLAWM-SW?&)G9Qw1y^$P*kgOT;4dBx=Z%u#PiZ?U$q7G}#l(v6}8HGyb2 z^7$I2+eu@ay@1#BxG8zVeX*{C>6mAi(Z)&rbb!)O&^AG?;`y^Ho(Z=${&BQ&T`@(i z4$No^5$1Mk5*An#_h)3+AUibDtj5;3x*DM#%TG1}*ZsCYDssko<$qooIGM;6`+_xz z*v8;>=5JPe<8!^k7L$;DAP-%6s8#i)QzDK;RWM3|HSJ=Nu_br!OVJjmQlR&HN6Z=M zrX?jARAIkTG?9jnAjJ{hR~-j590x8l93uUCxF>v#t}!vOg#ky5P#+&3m{msDP;;9Z zV&!L!i_kXaFeF6_7NSI3OqdfR-R$UblC-~?e~dOGiA-@ct{uO1ShmLHs}~(1d&^K1 z_vYCit<0U3IzCS}4JL{v5ltm!9i{eWH-Xsdh(H7D=o0#NAN_4=e%%I{>A5=Hb!NdE z9!ov+Ai)seWEF!}b=wx&Vifea{F#X_!5?ybq{&J$lv|%~$uXx4qOugXhGXQV#znFM zi}VZW(;Q9971Dp>7bjmZePhi z;sWt7V!6rcGJVuoHYG{FCnw8!{!^makgVXnNjIc9Tb<2KZYd{Xz|UK8TDH==%v5&3 zn&rY3R)H~ve}J?;prM1zvs6f3K47H0aU)8Mal(OuWOE%EkQ)p+Nlm@K*xVv(5o21I zA+WFwJjo|A6T;V`+9PnnDQdWxV6_m+#I}mv0Lp|JZHAJ^fKwvd+@L1LltQI+bK~3K z%I@7f+P|Za7y~lU^j`S?o(( z8QajVJ>!eVTXLFk{1j*(>hW;Gdfk+<%KS1Z10 zJh2tRR2tvADa@SqJx60mFSx9P&e zwiAZWev4js&T4CtL`P)ExKHit3U5<6JfK5*d5sQ)o$R|_BF9w>2iy>eHGydeJwbU? zX<5eLKmO&4&!4|50RyG1|2+=aPGKu9tdBTFWBZ$b+n>8H$lo~{k_GL}gY9C}kQV+* zV9?iJ^QxYb#UXt!5STvXSha*^VQ@7@g(vnR+g|$=_ozYDn0*2`2|oI1@I`B$&jezO zQe>wT`JCzp%X4;0$Ns`Wp5a!K`XtSv(e)@jNTt&CK@R|n-eQh)a}mImB&_;!$3v^z zJ{Sl(W|2AtH5-@r5Ao5bonY23Q>0ON5^Jmz*$N0yTW2ALbwN>Z{aRVBb1WmGn2_g+ zznt(1c^iquw#2ho70<-`0+DDh>o0-V<>Blx4WZb?GA>YGKat~t>3ocKL-5MdFRPd< z^|>XPXTX+2MQrQEe&%(LYNQOK`3>SdJ8#Eo`|%`FP7me7kclS8L8WEF*Ua0^pFjUK zcmcLTd_PHOCp5ZN5u%tEwhj3Mjoh#a`SX{>!%dcB*d>Y=o5~|w!%M8DYK=yUZ57Cz z9X*-bVwINkQHX|&7cjX1LEnTrq-^%Sjig$ziM zSVmkq%`~2AIovG!7mn!`Kar_g)4IpopT69csJ9e+T=@}9ls#OEU@t+HSzDXDj9a>k z06GobW&Dq{^LJ|>q`{&XN38We>j>pG+Mu!W5M9g95LJ&J*|{M^P;K>sT=yz=7aT6> zrL}o5>#Wl>vV-h`*>9h^LI(wal=NkcA}3=MD`sDk>zCkt#-y3!_q_Xv^?`4Ko{D%~ z^XAEtXqcQnK^ez<5XgyRH-R*$MQMND-7SrRcjEIe6sODsH0~j}_JD(=TF}?vU4_jK z_h9o1C5}(-`_H0FMdE*7I-%RC_;Ehx|Kqt9<=w61)DCi&fR!x2caM1<*+tb8kmCJR zp(E63$;ns zAP>y-9_QCnSyOR4kJqdh(Wobu6(L&hdjP|*bI|i^`Qe7RGq9j=Yy+fIgGiCxjl+vc z7Z0lj=a0#9V2Q*l4b>dOlWX}LMtW*!Ori>L@=aV<2?7FP-}x^e5yTFVAf= z7E889th^by@SCw;<4x0wQtNBXijD}ybo2ESg%&6phYanBX%x~~)_GvczqZAs6Y!Mg zHmS1lC}d09aW~u#)xCAewY3#@DE%4L_4I8VrixR+H=c!gjLQ4AZt*!wAbI^xHTRTah$bTLxT-=E?ArGwnA0A#K6E9W+{kQvHYKbC|M@ z2I%gYGFh6u^+}{WzGcI1-??M)Qp2c^7)xdQi-m}oDlzjmy6WX^;Mw-w>T77exWE(R zWsTL~8c`>b%oaAA>6o8{x9udhJz-VlPF4F4{!!ik9Xlt;h-$NxS3k%V<*scye-<8O zq8n(yFBEZmcE)TR3I_1ZZ}y(E$}~vawNo1#EMQZ|^{@p2%|~*_GX{gFp&5mPSpQ25 zx;=wZ_iC>NnS?v_<0b--&CaVemSgscxWi0ZaxuDgbl9?BJyM7HN%`<`8-G$s4O>K! zOnZ!DW|~(XA10TNvHk6ddFlw6P~>P)JE0wOkH%Q^K9q^412YQ$kf--U{G-p6{4wIX zm%J>^q038kd0d_PKeh9hwea3`!)GRh5Dm!YOJMcj13s8EjUUE0Q^;Gu@+tra+JJsh zjM1zUS{wsl8B=&(GYa_s9HgiVbW(w$V^Q|E59|2Tela_017R%G7GYn*|3Z2YE4_x!bzKwS&7yGYMLfZY2A;j!gloa?ykq#dHya!)2~= zFQ^HuSkt6cP$kC`2Aj5cFnT+sxD#o7KBqKa>u!_sj?>N}+krB35X@1?pQpCGVq69m zgH_c*vZ1Gkc$dM^@@LI1>cNxq2|0r+mnr)A-D(X0@*lWblzsU;--kN+8|Ur>sa2*_ z*z1?RZt}-K>~yW3>kbTkAHZo=vM!*o9j#=a5bMe#H4Swr(SEy``l z)8Mfmunz!IGb+9waQC5tIOAmoP1YGOLS4Q=RRy#v3bo@4=smABXSyX8*=az5FJGH*)2a=}Vl%|iV((kjRO)(T*`n75@(~9d* z^5tg1?C-pQeM!}vcpR7**|o&%Pg6h&xHvC-a%JX&N5|~hutgHL2=gr4e18_{*g=XA zdL_73t`v<}U#>DPdHM$kkN3c$ZSqK*-rr1n3(UvZCF2>3MnC1G(`?RtnGTR6mJdk8 zpben^xHx|&qy1c5v$S6pegAh&&v84!aCD&eR472_|7z!FZs~IXIL{Y9a4A6-^?GAa zMT?Pd6;*iBjQg6!3Xj(PqGRL>9k1S)Ii)Q^h%t$|y1IVf0NUz8Hp0?Vir2Lgu)Z6s zgDc2fC8Ev9J2oNL$EeSltJHF?`z9E$1m{pdr&$@-jth{e3HNtqxY zi3NP;i|3l5#G4;F3r6A{JtobEZ0bDnw6AS%E6dbsY044HO3b{nt@E2NQ1g4QM20E#ReIb+K zh=SNYo!z^z`m^>uR)mRtA*WzrWIwPV4IUg4`Z#Oco{XzE9a=Q_)qSe7&e(;nZr>X^gsQ3!5@tq>D1 z>~wq>`TY6wVY$_)B8_`e(8nw&*68+#F-t@_vk5t0kN&^2P#PE1jj`;z-cXQ9@b@$@ zdHQxMdrqZbbl@44{;#H25&~Y&6w#JR-kWmWe{iFYZF%7@@1b==_iSJHeqKqA9X!_U z29#gA>1f?yKQ9Q;gh89gy&9)gfG+d8GMzQfyth*6;Sok>Gn=YqGj4pbR}FLA8HVl; z?n_p$I8l--)Lc0WYZBMvF8odMvOH=zUryfEq(TMk%X}E6EBUrK0<0`H|3b=fDMpit zQj9)jiTjlbj<<;G(G6n@o(wpl4E;A)oLeJt1p5yf+N0%@-*#1McApk_%CO*d?=zc* z50=*24l@ayR%Ehd&)Vnq#5#wJV)2wgqF;>ET3%<}Y{>aNO)(BNid{iM% zmu)??G(}@D6M2iphfZ)IIzr@?dWF{_R8UluQ(@aKpc|5KX#}q4P(h_u77x%8>NNOF zvfVIa-{W`qTO*Q&XZ3V8PT*=I%iBBqo}b*qSi@Cwb4_g0P_PDVzi-x8%ffc4~yCvzd!ApG$0V@7D^M}tR@ zd*V4a1PCagpjhOLs?Y6n4ZF0DXEkE3yIR~)o>o?_n5$m$OuPl>mhvQ`oE^O=lTc0S z<@5*&PB0-3&Emepj4SSyAr7J9j(tFVN$lm5D-7*1P4+IC@=mpq;7-U;+^Vu&wDl~D z5#eZxJuT>hD#!3%&Sa{SJk)0+{>-OGbTB;86ji6{8{8hE&HgNyn&zh3j8?$vLm{-K zY6;pWLM^Y)HD?5JO`^?|{DYP9pHicKarz-cS&K9ih5M2n!ezDIgz;qFo|aNolYMsL z4g9E_vvr4AV7K{k;_|<$ej}DV+k#rc$akg*k?Z^b5Rit+Urp}X0EweQ7`u* zg!w~sU8-8eu6Rr6S;LiSNr9|Ous(=Ey4sq4CV6Cdju$LaEqxk$kbhT_KVaVbhbLz- z>xt^o0PS&*(b~tr%C*IU@Iym(ea>Yn%D5le%a+8NcBIl}>^bq2Ug2*rBI>~$*Nh$wymyjl6HcqTz zlJvX0UMCX#Qukp8Oa3C$J?pCl95(VPpK0A*0ViBm#+$DEY$A15`3AowiV&x=3XDZ` zgnHLgoXkuX3J6RwDo6Ymg(o%_Yhizl$Nj6$Q@kPOp=mIm)>+GJ!YV}+}; zaf;FBZoIgSZG2%a7RAuF0&2$TCdaQSYG_Mjpg7TY=4!)xYU^uW)0;Prq4FN7QK#R( ze;1_j?JADI7kgo6f5r_M6Wb$ng<`z|uA_ooM_2Hmt=?(k#?419|5Vqkg4{iXXyLU5xy;Ke^e=mlkSQ6*c8&YKQ3gz5|DX8hH3Sg z{a$$A`Do3a6~n?@4f!nTk>4)Y+aO>ulxlxML`p@GMsDH~y`hr=ed#xre3j4Vq5M(B zO`&#s-V8Y2Ow2p%d?jp-?Ei+G_Lm*Op)DhdfzIiaU=-}a=;ghYKYIIl4X!2tOk2He zE|KfL*{ZoYm4Pt22Pr1pvoP6|W9%U0`ivs;Qj<}V6>@N23^%Sx@Ac32bMGndP!B4K;V)fvp&*K~mMw`q&4EV~}#I=BPyzab(4xEGfw} zP3uYtqGKyiBWfRfJN~SVKQ1;Sh3<}2dVHE_0Lu~jZmv{$!Z-?U+32l)sB%*S0vf3& ziBe_A9SoUDKjUO0xz9&>ECKP>wi2T*a zMdL(R_}ap5`7H z6m^rlpCvZ95yhR;K5k?!MnUoz+^QTIR-#>h;}NnKrMcN{Rt$g4+LbC$8j(w}5xHZ; zyN(_`Ty>2FC5Bpe%MY;8gwyWIIR{%!yHrbvXo-&piB*>^`8XcX3_LpmZNqJkk~-6` z+n&(R;xFrSt!urh{o4o49g#WrYqr`!tUe&ji^BYZ|5T%-6 zYr*4nrJ7W^$gUt62Jiaz5XVie-7I=a|M&Ve$T<^5u<@C$JAW2Iff{bv5tn_Qb3Jf$7CfXjsmqa=r2UL< zyIGbZc{zGhiGu-WkJyIX9LF|fE1q0}f%ifgC;_2<;Xd;M-V?d$5A(abH*CIc^hnLu z5jz$8EkZUM7AHnm!6sVb{eiid&>9O|*w>GjSklM?Wf;?bwA)|(V7lFBO_<03i!erQ zRaJVcMj^!tAOLBlT-oE!-hI90-#;w;QCvT|E0Q%cHrid)`{OZ>=|3P^e5teORDf%) zj8#^+I_1pXWpFRtxr&0IgiYO`Dh%*11Rfhnga9x4LBFl$6OpxHpA%3!VfsmKQ$dEF z3C0-nz2-fe^IiZKn4<7UYCYL+$6*TJn4v|o&84FxoW|-V zgqzVtP>%#D#c*%YCR1cviZ$G25q_n{bgfZWg{O#)>HNj9M^u#86Q5)=fW2N9(m-T| zJAfsyI8-UN<2h@{s-pgF5yDhB$mWzB$+qRMH=BR(zP?t*Wdi5fKpCEb6%&c^tclZ> zT>l?kZ{ZcyyY>&01Hu494-JZv!Vn4!9a177@Kr!!5D7(c=o}bQN(2Q&x(z~*jzLf) zq?C|0V219l_vV~u{hoCm&-)L!oXy_%eO;gYZ_lT|vFW6{n<}8~ z?kz7gRGLEerhMM~#1tIn&DpQ~+|RlD+Ha_kmNb z_FIsIB&qNHHmEVNNOzA_t|H>R((ub}Mn7J}9Xbeir!}H>Y#owtD9rB@48c%G1_&)V z1RGQV8~Lx7>Cg51n$9TBW_e!u0R~lR@4Uq6Y*-QUKp5Oll^kRmQ2Xj zx3fcVpG9bk2)S8$cGV{~-~H!3bUK zCBJd0b}J{9b!9S++>ubgT=0zYgDw&2A;5xKS~VM8*W}>~XRB;!MthEpw->p; z`hw=39;Dk~OA`oK^rnSEDyMq*;&#>5 zU5t;^1+?UqL1yv7uo5aHho1xh2m>?f0j{cziMph!2MSKFnd7$4Mob2Z*2?FHD1_>B z8t7RH*g7IElH-bgw#4UNV;_qzP9c$($rds&WdFn-?j^17B>aVr=}!mAB)5i+r&U#$ z?*%0dMd}fBrdwP}f|_20a}Fs;Oa7XL?fYp@HAFRExP=nS$x zRvnQq{@$$EPdXxCGAAm8&cmsn%*#IwZv|BC{stUc*Qf2-3JSL}>9DG12`OO>%@g{< zaGKskXBWYez2C?^h08k=?gh*bGAF&zy=2g#HN_9OUh)FAI(J-IJJFe76fBZtWbQ~X z8{cB^=Jx0_2Cs;o(;p%gkF*Y>9`I5osD(8A=Y-<>kW1#Z8w@KPcK8yKaJb@wW8 zIqP>rcJBVYc_=)(KYP95P4TC_UOH|CS%GGvX8DB=HR9Nw11KCScwxDStydd^o3+1`m!80i!txTO>VhawIJL#K zds4J1r9vOB)jvC*2t6oq+8Jv_Zy3M#|InVDV_GfVFesp(R36t_lX)Yc^`qD^{INpG zZD{W|(ytebh~3Qo$Z51c|IBI0V@y1|{ACNl{M1xMi0swnG@x`aoDT{vg;S-uCGVqm zwGudEI!Huf4UzG~-zf93%D*`&Vzul{Mj>6~8jb^ULRd^G#?OT`$JoaOVQOY3QPrMb zB;>I1{nfp{-XfBYW6AW>#RieXH-%qjngdb`!Ui0jJ_ZiD1wc~s@z3tS@M?@!_wI23 zgy2hO(pW-pmbB;4+E8yap?in(*clf@7SNXeDzSO&17tDbes%=76_E` zDmx5y+U5j5eosXVCQpOQU$#r7Ra5)F`CU{WP{X`U@B@Yw|0}4u z*aE`GSjY=B4>tV({aSLJZj#G~k}P%C-?{G-M-GQ-BXXc&*0!gU=>B&p`badIIMZEo zJhaozgs|;-szp;sr+t<89VVPu$(TX)uZNVyG7toc(H^H4klcBG!MKg{>h*<6D47FC z%+|ddJvUOOHmgtl27PYfr^d$8-o1PG)vOb<#cJi-X0()S|CkfV?>s$w$;)yx{P?8t z3OGfa#cYGu$mE-@S&&!((uFz0QXfXI)U*~eZxJ9m}Txrgdw+Y)= zsO#&|hl<22_+`Gd2vWWq?A4cPS%Uf&$PP3cnv|6FM7L&p+YMnoFijF&UZR9JCgQ;W zHZrtZ3Z%C5YA8$$NRqX$Qo635LS@HHE^VV$9u~8eLe^e(GRwUr!9tMP^Xh z*V*a{6kMt;CBH-U)19B?ffVs&`i~F(LwofvEX;t>ah&jupLxFteRV_+La5H9-oH_v z*|_V36eH~%43c2pUs#4iVx)@s!vx@-I#S#N&jz0eMIk-`WZ!>?>KDu4>sWnfog;VJ z(-{6!V14^1p6x5gRq$6<6WMbpnS+5Y;mjoaY-wL3=pp=1Vh+~?3#i+KbE%#6Z_4&fc?OQ+sO=c!TYA7EOzFGy$#RGfn~0PhN_L=pq#sp3Lb)|% zQ2R6NvmxmCw~li8Sq#~8LsmYFE+fm5@-sWpY!YtDV4Ff8y^4eIvzfkBmAS=@;3*}~ z>|er{8d2tpo^sm3db+w`9}h~H0M2z9dIj00@AmU!#A7I2k%$IUPh=e0cy;mX^Zp-6 zHnrP;8~)mjbefgDD=W`CTtXP?xx`MQ9_oClGDmNZr#qV!O$_=n>coxjA`^q`^&K`n zC_SZbipB%y zB!;zyCC*zljpYs$ijn^+5i=f}-GKGQLiE_kZdPjTt|$R8z+aainq&&w^9BrmQc-rc za=F1_2X^Vn;?f(gsDLe$F9M%VC=W^`wGf-ta6Kt+@Ukv_a zw;@7k7F4sPQKmt7h=LPspSZ{ac8ez)FP7FX!GZws+8k-!aynvgm#GH3kN$&Cz;e+G ztN~S4E=Li&P^gE1PIgCF-sQdCsgeP1*29{swumpKX{9PMqiJ)}ipB`dI}Rs)lD&iyguqFT0vCy(_>lkdQ2 zxIPFXm}m841Y;fu!!tX3c*jn-L3Z6ta9nU*@ClNhMV+6eW6NJLUM{<|JhT#1>UkZU zDV{Ix5M|v#bQ1qA3OhWmd(bqZ^?iT;i=oGV*SyL)qWT|##?Ze8U)4DFY|XGcfi3{|dDSrJ8& zbn|LFQuWi3XWs@IQLp-@b&zuAcq4`0~pj+$}i#IEjq6`Ln6m;pdOj;mmydLhbVGQMJK!|OfwcDy2W?RV@ljYh|P*Y zd<8s^lp7UCzCc>?cmlvxT1S9XikGDP;jVUo&Gmd4s^94kg-p(jkDDt9lri2E&DnaM zVA}t45Z>XOR+^(DR$+&fcaD2ApZ}oy?^79Oz%DpNcmwvJdu-pohKq3=?dPn)nOwqT z7q-C4C6(z7;^d(h*A#NI$d3HZr4u=Xc0w~$t@v1#>$1L3IN-_}L0J0dG$5L)kheDGn0Vhz9=r_8na)?xmLB4w`5? zAyFzXJ)53a*Q<(_F#V`!*x!sg*(a)1FNli%Ly~cX9fjEZxXJr{E1;JYLYe{WG#wfU zYfH;_N3CGXs|oRYsG*0tQo+vRelv{i;qf)x`>ZmhcC zxpQz6{|fYOMRkPrB?`FMvSiBmxVdI0R&%O7{Yoy^{Wss2#RU7H6HeFsydw-?wY}X< zj~bN-6ED&STtH`!j4&Uj@1`8ti%ah?s`wk!_UnGjBdj!j(z>rSj`O5!1*6|n1`XyP zAz1k>8x}{bXxsWyc_LDRuNbj-7!miBrQh3BOHorX5Fcf0;#5*ADjicCkQi&e)8QWF*V7Kmlfo{Wy2!L7{4-BW#jY znnfRKB^*h@j>r=MB1A;AZTk=6Cb$*cOXOL7j*Gase{=_l4C{9AS&&NgV4zPh<3Hb`8bn3%_ zVX69;D$xhM&qhMd=4(fH7SMrj_qdmAvt>sgnO9zdcNBJsqMsmQGp7zr!H{VYq^4cO`yO8BQ5+YpH*Po@T@fH#lLwAq}wrVkk|BJJR z!x}NWdM}$(B@kaf5GuCvIwgOIO`Q~kHS~k%4g^i_pwAQ(hjEj47z}aN4+CT4FY^?2 z6$&MwQ+7K!^txvt6z(Brw0RYLb^WA=Xp3YIO8&+CyGP9$9-+?SJv(LyCQPbEMG!&- zB}Vy`6HR=D)Oz)ODUM=GYAxL$f>iGxQAf`c9pg|}$HWzfAI=rjK~K7@rH5J!WCoJ0 z5OGyI67+FK)RQKLi2xUQ++u@%kkSP}9QUPzp7)BJ@gbno`xK<`EFYs2f!a%SA~hAi z)n_dX!FDy!7pfbIv?DL*klTHXzkiuVfduRn}*x%>EHnA1-Vb;uHUsw;ax-tJjw~BIZ9GoKY%V;e;MJIf+Fhsg4Ug;%QsJmP;i{&c|mT3IlLTzRSmC;2Neesgg1IhzY#M4)3Zm^qlKA0_pL3pZ_*rADK z!N3vapOD5ng@i)D@tIvDh*dEQKLt%Am68B^zK;i7Uwr7n4w|3UGs~Q)7oKS%|U~w5cX@|vtZntQ20eBQ5iLOn5hi#+K2mmD-=(B^#9JQ~W4Zllx| z!3-S;VxRVNU6c3s`2=eYz4v)_!kBt7s29KWpJtwO=CfnfH~m2Ac{ZIYCkRLs+V(=# zWl$llwRFhlrK+d%&R$+=sjq*CU*|tkdbXl2CEl-q<7b z9~Qzhv0E?OG={@0<0;q5c9U5##+z5y z`;0i)WiBj`0~c_FImckveZZuzn9h^?SIJo`NPScaV2g4a_OO1aQMYe4 z#FH*XnTUb+1o2>`G35NLh$QLOni_kslk>livI4@ppTs9{ zXW8vPf%26q_f-e;CsYq>CTZi=hEONkqNu0M8B~uI{rwtU4>?VR)l)QZDDdJFHcL6x z@Yzw|1My8fCSJeYQ*Kye?@`C^oDr=h5Pu@>PW7 zfQnvMsOlf=)s9I^jt^}YOL^x(f9)e0a_>xl>C@T>Q-Xoz(b3Qa1Z#yJg^011z|V7S zvwLCM;W>2MKYHaICgCm;wPyUCKxo>!vqhd+>FI*ppZ!eYL~)trug|Ar$OH}O5X8Rx zw%M~eGaM%l<<`yTIf4BI;K9%LC_)=gW3MOxE`-3IWDfIhNL3^BO!md>_NHua(*spu z!l%~~S{FmosLo#wI?KQUujI|_(dYe+tKRPlnv*RMIXwnxRO8*`mhBae0k7Q*;~`Z| z5?rqs$-OOd8(mc@)ThFqia((9T%D8)pftD&038pZ@ZHbJr1>uGxj*wy!n4jMmk(+AVIe|C~dJJ$6#E4&dq9jIQ;q0r7gnyA*azgiWD7c zS>>sDFR>nHDeC>Wey!f;&t%PDu(7kqU++hr4KOg71C@Z0SvVE8OGk`gk$kxnBlpsE z&|95?=gICwr~mHNP8z7%-tR*ITD;r@m-6zlU0;s3yuhKNkyKO}fv?BymJ5F?v^pbkJIMN13!Wmt4MJktrt?f(4AxlU0;A|o*7zWONrr&}%;Esqjs zUur0ldzo=-sI=WsQVju*M&o2wv&T|#-j%`fd!dStJyne+G4ny z6)*4B>@Wld>0csb#Kr@!r(pE(q~`J_(M%Kv0_39br>Z=8ZDzpD4|MVAEwBE7nB`-B;j$i(4Xt+ILmJVnX zL8rB`%IN)qZ^rDQ#CVX8Rz%NwGLq2h{#($JsK_DGc ziDc){=8lUPToKqsc-)kSdSmsK3WyIK7u5+%F-fJo!juI&gx&T$+ajf?J4)kx4Ak$_ zvShAPEJv$5PSVKLqqMuoYvMg9^)yrw8?%;oGnscu(CsOy(Hz)6VTS`9swgo*8W;TB zWt1>#^)`cdHX!6y(|kj3Lx|nts@EsqP4E|ApVjZOX!d{pCoH;)GAi~qQV;@`#>sJ( z)i}1{L&406amyI;zgC_~nX-41X^n{mB z>2pjcJ|rx-2v#f-L1%%G;(-aYf@|<+dH@UuLk1huwn-oSA$BAse{GHX%49ixJvO3R zJzmq%Nx-wq0;d?>*tXWGAAEXzVBXF*><$-i3Re5z zc{cYZf7;+d%7GFC_3Zfu&pTU0G9hl|(eY1sOrB@TzCvtC?3fkOL=k^_a`c7|o1Q^k zG8|fu(_=qZ(>T8Y&`V##ksT~=q%)`E@4;=1WAu&$v&kn8|yni~&sN53zGLNZiDWACQ#d}wll1m|goJDBD zt0R~L4P$lWq_S){Sj0qAgt`HmRq$I03mM*4|CRdpIA74$bXX!pT)>P_eMDG9Zd8+? zLsMAomwI}rzjdfM$Cl|>;>_N+w7B#XumDD!Qi?bevPYRMXKir&Y1h_8W)f%@9ab4E zt`0^PF#8sKe%iw~kTj(YyQU->mhXAo;vW6i1r(k}T`Y%%!slf;ZzN zDIaG?xnt}MLIaS-PC#kA1 z=~FK1SQp-lEQj8W=SpNT%2YDnF6`|~pC&m<1S&y7$u!(~uOloJ;=r{95=IBT*Q>!e zi($j0zR=|x+i(#Zb3g02o6-juDCC7fmNY8ut2vj-0K1bGaDY7pOt&J}d4F0ylJ%ge z@b@!wR9RZ|FC5AcS+ZhaqBSF3_LpicIy1+%*k~(=|C81;h4Ez&+I3&<8FgNDP=6Dl zne?Ujd}tnVV#iisW*$$n35wmLB?>gL?*iAV(^p6VK6yOx&J^p^%L~}h=PIb;f$DpK zIYG^u{71-Q1(br~56 zNN>-EXWe8QA^P?kY+d}c{2MRxwE6cjh9^58uCqUX}h!%)ze;gpU=h&9meKU5Gk>93WRKwR)UC~V?@VruFewOUneOokn| z?PT(cY*I*3FJvm*At$!Ks!3f*Fo?V1kG?i5M?+@*PE?(Q%Zp74V8F)Hy~^j*EQGsR zp#)KEwO^LXTV0lVnx;AINy>mH*NRB|G6OY0KoQK_S*D2dt9w<^$}8I# zk|pR>qCdNPs~()xtx`h+0=NcvJV=@TzWZSHngW!8jxc$fC3iwG_^$(*FB}VL1akq1 zc({{!ZK3jd9fvKk5V`80yX}#}whQEGKzHD9D`4I*TaS3tzSGZ5RbPM zw@WQR*#n$EHU%Z0qvosmS$cJ@Po_`#uRGqLVsk->yPSjLGZ>; z8_lmx*4rZAW^q#TL%j)0yGGa$@yTJrRPz?F^*leF)Hu66>+lD=WNvtNCUF8oJugi;0TKait+z z*tbu9*K-(hkHw~%Pkq zb8VOCsyjGlL<%o?7h>PL6ng6ay5{z=ck)5SkaOxQ(_E&HAmu>4IdORNm-606YVl*& zkZrAy?bdV4LWdUA4%2;xzW$%0Q3LjW_0Tuos0%p(8Ph?{j%Cp&_uh(+zquMw2YC(LLr&i0>y0Ku|_)KO7+4>17Kf|e2;G0>=vnsH)qt7mW_|E!p58^ ze864248S{344kKlg59L2XTD8!jyNb@hUFzqCaHBUC~n>doz-t>PJka{&N0rvywJ9< z^ap)kYVY-eJALSR`asxmuY5($-2H6q=rh#}Of#(I zY6z^5CNN0aXvV_Ro4uK&Y5*h&FF6jGU&kd%>OoVSvGfJV3F1AKPv+|Y%9wP*-e@=?CGmL6j<0#7Bu z_4g_BqVwiRA|x!}SzwBCMY!M0bO2lUfY%Z#z`kH#5_b%uZA=LBFHGDB1G(HQ`{23f zhwe&XrYfCK=A=M(j>D}Pj@2v!tQ17S5v|jR;S(mjX2`>esVyHFZ)bxemn|Oc$-U`j- zg+gp3*CDUP=-Ai61zv&&wzJe_^XXa3CZeLvXOHszPpIxCjI*5U&Kp7$M!`(#%uz~C z?+0W?UUo_zElo$Ojh5+;j@1{U)fdC1kitB`{&X*~?J}c2n}rl2d(?>Y?+3C=baDt9 z(JWJPT(1LKgy#yWw51Y=I#llPlwt-D`MA4l>q(7stKU}9Ednl$db6-GCh4?HeNRZW zb&;U-v^g8O3mR{^yGiZkM->+$ISPnz|vuu<}jfI*6@dmm0a| zC2;>FjxxqA7$wa6fw$u*#njLm$o6j}_ zKR}+!(F=XYJ)Vc;o_cxLCYhyL!M;MZv@n*UjApa&^h8++Uz&yfg_O5otK{Qk znhKJMP()n2XnFvWthehVo|W=u_xCYFu%_8oPb{O-F0hYS&%#`iWFzrF8tbSiPzuI| z(7yW=&w~)mAYE{5>z8>hm##xqG!1~nw`jNv2XC0GT2P=>(|b*DlIZM)>&U-fnT}Ny z6^hpfI`1t7@;%;~Wk4*q@4dJhF}-8SQJpZo1ie952BLRjB$%p4J4|pbKTKwI4!miv zR6o1|!3h|*o$t8g`VxBqmptULO#%n4ld12-dq^Wm=AnNQfz+D1+hHUk z9oILQM)mqd=JpxA@lsd~lN#3t5Q9H`Rm)3S<5nb7RfVmxI1q*9Sfz$I!Y*=I0iOf= z#?#!}F%h#0K;xq=I;&8pd>p9$7MO*a+p%GIfyagka5vCCU?e` zqPRP4MWX}e6bh>}4oG7)eL>vG{Ggm!qEw`ih2-P)?_u0BxBkmkZScg@HD>2_Sk^x- zVg$?B4;P$AuHD<7=%a|8z`6F4+wEZFavfW1LIzXcX%O}BlX^}F@D<{=ALxPGq~c`< z3C_fD``4?!nfmLBPs_5Csip(BzH%F@rqkuR7prc60HHLiY?%Iof!=mKqBQDb?st+z zfHm?S{S!q#e$3Rkc=k@2_pV~vhcfK4zV-!3e$wgJhEnQ;KF|VjB9Sr1e`r9WNsU!R3Ip<*KgN5C% zB>V4Uf{a`VF@5(lv0vgQuXql)b@=Lpk7yt?(jk8hy0AuU%gcy0hb%w)EIr5z3!)Z- z6te}2rl(UYDO7n#|F>$|)iE?pi$trI;HhXB;SR?b64GMTdZtOR#TqVORY5{GP z{QLGe3s@4<>H8Hwkj=EEIIEGnwJobt@=2A$*~Nu+)x6SHf_3(BE~yb!sQ1N zg@7BL;(CNij{njqs44J5rCmQfW&o3Dou+f1!Vv;?42ZhjddG$&Z6YXdc9k+|caH-H z&1xi|j1e%>q+OLz`^N3H2D0h&n6g2^ zA!vcT&Ty)A6j7sZPHacF+2EgNL+Hy^o&h~tV%29t@eNrr5uo_MD_?cWl|}w)Nj~C< zt9H+@-A~QXzMF!cewNo+!UHb8=po&WKB+8I2yDJCK?gt_BkCronwQJK?Cq#9*4rb^@b zOYPQ6p`B{HXTRS6w@fv9?n}&iS#w@no_jyrGFRckpi|>Y0f`h`MJ#mSK=35*h!&tv ziWhd>twsRb#E1@EF_!*Q=J=)N6zC-mykD1|;~dw4glg93*-mV*<%cx{b9l|lw&TnV zifmn0O5--B-8d5nP#E!!ZRB=IDTkak6~gQ2^JZ2QEOosJMjX{WFH8|OR~!vwpLh{o z7KGKAB?^zZmjTWqo}BU|MS0yER{8kD#b;Z2R+r)+PkYI|jyhuDKgH2?Km%}%A%)d- zuc4(SAs6>c1i?BW*OY?wVxKRR`mq59e3oP&X^EKvyYnrN&~ygVzLj|{-{Bs4*K;042welQhdDY^D^%xcM+`s`Y2I>LT=kII+IRAgm^NI z=s6^ZC;jG}qeMC?!HN)2v;pQB;5qoZS50!S(@$Gi7Gz>ric~KH^Or(N2<2CKy0WOd zR(^%zhx^(-;z;B}h^)xK$ci6Z9nUZcaP3c+`JuFoS2uq=V;ip~NxSO7x!)83yI494 zqP2(PV084ip%^TQF>xfx+2hokebi1w&!~9k-9T{1Bky%{CP+^c=Oj;^%8=i3?(fT= z^EGwChuHid*#fqf;CNn_VAf&frl%`HXb&|)CYagEYAvLBnoNqL%YP1PQ9wAQ+{^lG zW&h^dVLg&VrV_+Vw`vk_;xAXI3YUcFgYKgV#+^u!%UE?V zr(G0T|SruF`zx(AGO;US-qXQ2dCHClq@kmrG}!H9MgBt(|UsEgq16;ZNAoJ>U|d@_3Ow!l^xl; zgD)wbZ76bOcN{0xQW2|wl@Dzci=#mUQ-eQ& zo5{Gp-J#>OL>5zu>*1SJcAIcS2nP*J_nVj#XW!k5sy1F@ed6UFnk(l%^9sRnp@EuJ zY&**Yh2Ng@j~fk+M#5^uy7^KbN_O9WWLdzBX;gZwY#>x3p3KSt!Pd#$#m-NPAj+&J z(dA=`)NTP`(rFLzY1I3i7xo+ni1D_(O(C2YD|vl4KCuqgXf2%w=}xp-IIOb!rFc5h zknchti#NzKlO7`I$$-zT9O;Y}uS#x9 zOa~nBJfbCY6%Ni6y1WIFlr?K06F+L+G$X(~^qqDgEbds+_G~CrbJV3rC7iUt^CP!9 zF{9V@`#wm{qi1(8J)h)Drbf~IiZX^Iq2I$kUu}0lHpo5D#jpK+o-EU1YtjRGYaf2L zOTRUY!YFaf(FsQ3B<-LBo)XLz{UBM%`kKo#>Sx?8_{){Nx_l`@8fWJxYl=ETJv4(# z(_g9xJem~0;qq^OK+p^l#m7IKm!(KhzVhM@ie2uGc zh+%(f^+6jcndUInMMvEAxScZ>VfXBlbWQd7y(jbdk3!A7{a3H^4Lc&1)Pkc+Hekl1 z($XLJ8onD=W=c|aSs2zf1EuZ;F1L>^%NzyL6j;}P>A#Y-!Mmf|0O5N$6uNxcJy|nT z=Wd%*KoW0+yt%d&icUffOvxB+|M=tqyu(>un#FPYFISZ_#2=?8SRrc|{ypG#XhB?@ zj9TxT+bjDxQg6iA{3vJqe6s)P;!$U((*$`W(YJ0$E{6 z;nQaAT52rGemY6tlXATxk^~AF^sP+N+|lID#ImXibXPLCPoCG%0qk$)Vlk^Bq>Tph z{d0vfrwv0+J{btuJ0LueCH5_CR=)I*+};J?^t+-+N0%M|@|*h;8?NQwj3oUxoBAsm zqU?Hd6mquK2)yq;A!}M%!%;tJMs`%wF8+R)*WM}>K!E)Am>Gt2k8@Rt;3546WB z;|oYa1Y@0XIvXGlFRdyJBD@4~Ws;w^yi~w4rjS9Uo9`puylvzIEmcb@j zoCWS003>@p^xFu3+4BXBLUJ+W=SXorCyBEma+Inkjf!A8$x%eI=x#_w?AGKfuoC@a z{V4r;-$cDr(X?%C0NcNCzd*hH%$bAC)sW-Fv%w%x^Y!DW?g@g|mk)aO+4Wd+Z@4`8 zLx9OTnq}`yb=HqwUefw-D0Q*lg>uCBDB9o(|MQbi*2fV$wS-F@Uk9~a z_*+hQ$|v^p2F{BAy~ITuP~B*%rQgnNteFS7l)^YBoQj7oUqu$#VIE%6a55pE>0{$s zOKd&n!irBY2;eFswC|V`+K-)uW4F_&!vTsZZVk=ikKDCrOwK+$h~BPf1JezZW%!SZZhJk)e(M&oJw;BUMzUAzF@ zM>{0{Yfe}C47kJxvg=#D?b0l~Egt$;f^k76c_PZ|^Yo2$Bt=o89vW|b=atX!XQF(6 z81)NGJ4SV>gB0SV;htBz3oh_=2qYkw$^Q5K*2#(9!wRrKyDU`X!sRY(5-OikV3TFn zz_dUSdrvoLFrjw*8RaXEOn5W=R^9PcFw#C(7c}=E5cpZb=Rp#p1DjMR-D??%bTX{0 z`~=*AcJLN3p5&&d}RB51Zt zuX<1R^!iLI{jLjEJDqG`(xmI(2u@a)@mBC$AYMd5$y_8$mb58yY&P4kg-Cbkp>)X8 zsIIK$f7bm@YBUvPL6X}v%N4K9>5Aw2ye9BSw--df+7>!3+7BGu*IkMkO*@jbgS|#y z0pEeczdY$18xhLuQHHvCIORjFvyy#38~TanSzedVFi+B36yz$3l|G~?e( z#@t;&H1sdKL+TG`04aF=8NxkeFfL%x5DFhslIkV*EE}pc&yOf%?m$|IN4%5Fj=1!B zLSXc;B2^~4U;g~32P&u%#UJh*^X|vH2IdEh@d|4Akp~AKo%x>Q~oJr&=4o zOJ94hkQ&Zwr@FD5{dgbQrMzYP@u15fc<5xmQ@JK)Zsufa<{b%p(20}vk+}eiI!Dqv z=4W(0%s?tT<+Qh-2F@VlTJhFz@o45O_~guF?*9J_4cYvgAT5Jpkd(A(&_PGc%~+L7 z)?i5Ch{-Zl<1pbN&_t(E^`a^&D{b(ChY0`UUSsOzy=!HiL|zQ*iQJ0gAo}jD74UCh zxL4jRHs7Yob=vmYUI7)4rMBHq$9Ym_sKN4BJIoey28UV&?F=hP@4UB2rbe(;&`PQD zGy9r_Pv5*4w_3`vv_h>&GWhw{J)bu#Pv#%AhwZpC#)>%_cIGO4S?*1jQXr!1+U0aYhGd%(9+Ttu|)eulk?r%L8aYHfIe7tSR z^1DNfW7H5If(0nWdnrya^!QvRlAUX&y9xGa17RGWN^v|b(l+5j$4x#{inygg)hUa0 zQzPor<^I#a8x)A(R*$4}&x^F;FN zgyM1AC0e4vdmysR@G@7OGMOzO5#Lqbh~MW)AByALc1i^FHhR`+$$fjL__=t{!p$9g zNHB5m*h3*T1%0IpC+YYjP-bPVEbauuH5H#3MErXR$bNue@SJ!Epu09DDe-Z!9zx}o zpaW2=IyMqMUO#MfY%UUV1xPI(aPi~rWoF4P1_z|y($cjaVy;y37SHd2)Sb7NVMapX zeA184xLDC`>mVzT4kSRtk_AqrYDCDgL9hlvi^dzAY1GRW?tOh;-b$z|g6vH(LvShu z7)pjK zPW$(qI&J`($MZbQZJG17EvYThQA9nF0~IZEo-`rtaXWdtoT3Xh!MTz}sl0zf7W|!N z=}vK3_}l9X1|jC3&lL=Lq1gr(M-<5hy#puzjO&x&oF5*kfK`BL8|s}vb2FANU6M&XxxE)AAAi2 zFqi@hsn_aq$+;NPKga$PNLxCZgr}%cc53U2=3I$fiE6{>w_RHA^ykJFkkkNA=Z|Yf zKcd~@O@+vi7e{C5^5IZI9XNS8eR`?-;7Ex=*yff}LPr?S2|?>$hz>VTbRi};hbxF{ z=TAFly(nMHCYt^--8d7OroVC@5CC&Sewg4!+pVk_AJf^YD&6^Cb~EsOozEJ#6bIoe z&c%p&pt#xOivjSj{z3;u zS_*S^94sqTHEn@dk;AF}S}xD0E{>jo3Y0}8+_I093QpdX&VpPRKgERjB&UnligKKvA2G{{QVJlp7mu6fPOlPjYi6uCtC^A9c7#!@lCpvNY(UxB^my0)bNQ zPLcU|i(~sgsbV46JkBs0LxHxe^Pu#%S$jal;gu7hF9Hl}_d}gV9migL<|zupcu-dA znP0`*osK(|e_G_8n(X0)JFZCho`Iv56d;M1v%L0+>(---OX@O;vmwu<3Dc&{Jdy)+ z&i<;xQ3$V(fj`aaxB%3sJf58)@T4tuiBtxp0OsUcRLszKVbEB}l@DNj5`lN$gs*VK zkY|ooM%!MhDQRRkOAc2%<;U;%47kH-gAZh57tK?Rs&{^ zveIeC3&ImQs?i;UEmAq<$7`3RtHhlM`B*)>Xsh-f8l=VQU~OD!+zAo!4%Y7O|o*vHMZw*J=K6$_$v}04<`0rEv zS8~tD$cqIW2v$rXHi$2`qYE7U2|(dAsx)IN8{T;CTO7@!-ecDp&;9$Ra+qH2c`2H*8rdeDds8-!It2h&>5}i$@fbhvzDIoKiNDgr1|KBZqpX;w}b8L zT~tL{uU*03eoh?HXS$kv+8X`3xi**Vjb*KDC2!F5Z3aH>x*yl2cQ}f;-}+#Qy{`EC zm_nyzS>`Y$+3au8msCful~Gx6aeLVmRENoiOvwNXq&U*bzgi?&fY~$qbh~&(X+aMl zo?Bq{j$@qf28j$9KT3j|9hCzS*ASF)TFwFd()W~}kCEXV&`6K|C+A5bd`gkN7XrnvCDbG*9T9Xxo_Q^kPR*2N*Y{cd zVqcrRX?5Q`kredBe!tJ^a33!D}_-wEyhjV|ecIG`6(-gWZ{OP}*K|wDn=3 z_3NJF1^O?G?%WG;xY`2=oqudt= zGy%|CvXGhnSbas%_C9jwpxJKL$99Mc1H!gN)-8{?ib&Q0prv=8_^CO--(HrpOGJ`D zhEuzYsD@^|j`EU5(NZv_7tI${g8K66>2Ac

    !FVn|Mc_HaOFS6~==<01LAlpN=+ zsmNY~Ve>E9Q86b1PO83t)UGkFV+vSM!n2{xd`KDQ0aJV7Xl3{dKSgW$xd146CFiA# z<4?qEJ3R!916{~ud# z85U*Ru76WQ#~@M?Ly4d?(m8ZWs&q<;gwoOs64HV+3?+h!fC3WIC=$}rEnPzoFvNTE zJomHKyZ&o^5jQ``HrHI|aUQk*c9E0ZDdq;Pvo1DYF^V3;il~#^nzX$z|BN%aC-jcP zr9SeO881@>F1L=Vu>;II8n>%a?IHeu{hE%e%eP<3?8G<}yQE!A1|~YhdjyaCl$%8O z2Mu5@S>z0qEN4E>_=!UXj|G5h{8Or}Aw9qveZ;vhbh=&q;%y*nNSYt*rrk5HsS0ejY}RTfnFw7tc`{~Y&jg5J- z8U7Q9PsfF_+S854%}*5wR~4k6szN<> z7%6hcRxu~F%J13Tl^EDu2OpjH9uFfgM^)msHyJG8&Bea z)v0C9Kb%Q%d{>9k4lC@DZ_cgO9vQ*zWQ^${&)#<(p&}pmxjk3PjG&Wtn2CQC`%^zR z!fKfET>Rj+e3ot0eA@RY`S-ycQlyo!tK)IUjVhKTxOyEm4z|Q|43lc7Q7sfNEN!M- z+e8DSlBS^-j^AXHZI^J*Fs@zLb(Z$*iuQNCSSKZ7O$@eMpI2QW2v4Tng3|V6G7f|# zF^Cq4gA0%Txzj!$<`1PTXAc8({x-2c4c3!e@@H}R`mBv$o1V=L6X?Cc6sbEyyt0j+ zoY^Vcc7qkmeXBx`25rA^J#+B44A|cB&dHvvT+5)%kN#o1i9pBE z)bSEiWIksT!IB~4aVN_z%SF^G@!tpjWV5QSv{rN6!~Y3cTlmFcfHTS!2%Y@o)RRs+ zV5NRfZFz&9YnC?7XU7iOD<8u5y{3kS{m@0uGFO@%AsgW<2e} zq|04GE>UD7%wuKtaG5%a$%tE-CL|(vS+hunghUuWorlWxLO1!$YOOF|WPb?LF>i*{ z<)JN2HUq;oK@{>cr6c_i+M>xe{-wEU0oWE5(T>Mx6^G@Lhk#x@Tg8wzWYFA&qapTfd@ z38ry5la6Hz`hV~T^-^ZhDhKdmELc@mRbh4#BuF!M%R6aec{9Zt<#^UMQL>72GiCis zes7L1y@hF(E@ixS)FudPVUxatV}2MBP1E621H1dhEgU#8v&)DZ(RW%4g<3ksjtfu@ z*vtA~j6pd!k&>{Me3&uQtBc*Ab2T1X8&B^#Aw*!^(uFy&*l!3kSLr57y<6SWWPn0=sJ?-q!q7Bh{l)Ol8O^Be;~+V%vQjHO|BkB|y{q5W#6{bhOn@Gs~2a6Qn~UCGAHHg9M)d z?Gg##FZAZ-SjL0ds0)J~w0qSrBkM$GNqJrCYXD5#*uCn+FH(({D`)trx2N_b?zX<< z*KNf(ie4~t^JP3gcDp)e7x|Y6Yf*NO0L?up7j(iSm$EZX!@fuvk{;X#7;D1C&_}9GcE|Rc-i)6Tdc==1 zxHf2dv%q`VDEwRPSR*N!4slY&VEoGRlOWxcCc8bh)T(7P{-IFn=Slv zep9c%vSX|*+k>Et@>g~(YE%)SjYA>@!K+P;rbMqq<7_|3yf9TNjhRtV@o>TGV;qbp z?DpVc|G6(ib1>Qt6>MKh)YeM4`;c7=;-3Q>q*1uJlC%9*341WLCzE&$aq1j@S^GFE zf}15+ZuzS5{NmVp;FizvOU|0eTC&6U%J>BVvyDyOtfYwS;0ekr3I?U~bFbRR{<~&} z?78)3R%%RL-W0QyETgn<1%Gl5LEN|j$+PBxRs$2bOeY{DPzJ4j*0#M% zH}h<;-2c$I26ToDNa%FkfJG~94CX^Wl<104ksEL5iq&b`TlToW3$nJ~$beP99eO2& z0~u;eID9shE{)3zUa-!6F{uPb`k7iDg=H}DSIm&~k@M^VxTTt4X~U;jQh66;*G{iCt90d53ei!$^I94IUGEBy}Y})SCLgY?}5Z*M++E; zq@LpX$8yFFR-Fe7|9qiZbiWEmSr%0oOV!6V@5)ldBct^WbO< z-YEh7pPX{0E~@8!$~Hct>{WVu(+n5v@iUrM4$V9P&v%p;k5$RGyBbxHZVSeKxpuLX z+a-IEET)A7fBrmdpaAwVhEX2H9brw5 z8-;%r+#F0rZ{oS~RV;;7$!=~*4UxQ%h?-`uJ8KncUzt*2GD!=2Pwn~phl&_Q9D;4m zFa=I$K6WL~TpY&N3lSGj53w8q2r(5}a#}+E#7G%{j?Kx^C!9GZK|N0fyLQ8rpM>Q* z%5At>^5&OWS3L86|JL^S;M*8K8R9A5&072SRR_*fpTpTuWAZeu;Q1Epm<2ATj-A3r zx9g-_dZq)`q4=yPyhQk6VYbVNIr$zoc4b^-1RYa1?8r2Ut8ZfT{bg;%v+V;>K`Y}> z2~-*xBQ|Gfsq+(YKBYIKgq4nlK7@78n`1iUYIqMUrUG+E-q5pl+Z(_MEm%#o|KM3h zs3r~UvJ`qEPG$fW2huc}cJcBze$up?EKk`UM}k8CQc(Yxrf4hAS*9bh`ZmLJ$4CM} z&G01ld1vno(R^g!I4a3yE`YH(j9~p<0NE1C*dU^YJ9T@tOu~NRZ`kN~5~elsmFz%f zPip=}aP{`EwASaLasDF+)zQ6r%rXVOMKS-B@NOIEV*mx)BU(hX94Am=m7pho z;2sID8G=QfbR4i>2ncohgn}a5wn?{k!b>;BBk$0R*AF?p@V_1uE!yG~*hFP+!{#V? z7AdyQ)?qZk1%1BuE#t$B zd>MQCTpIT5f6A<`u#Pa$lI=5CR807x+hT>Hr|MBIXJRwX9SH->iSjM*$L>g|2{G6x z<@l3j(I@ZG&2saZRS*Xao~u&H*%7!N8ifAzllt;Y9?6?vn}}q3acnDM`~j19_;k^y z=I%*hhU#Rnya<-(@i;&Jk&fYw3J+D~P*;PHHHqSI4&@Yg)=86R+k$J%BNJK?N>#t2qBD079aWKraVMT>Q4q9rx4l%<;U^As3 zbM=67JRo>dhV)<0kxY!A@hIi@cAL;9o4suKw0E->%>{FZ?iU^kA^iZc$(y)J&33BE-wLMMZ!Wyx zI5jLgSaXK{EIt>ZybzEJ&iXl6V~v@Hb=*9H_tL$YcQ#cSaHD_@)KC@FOgBrG3?6IVxuzAwm(J!)lfV>Lm zzkn$}{m%**-rDyRdC+Ak-m?+13i-DAMXMO|^7Q43+PLYKW~R*9=gmf%;Q93J~hlYYwRsCt!E5QTQxRxJ>$}IPdD$Us|h$dCF7k%-yozT+FHDnZ_f~Rs9$h4-$4mqPZn4Hr;0H#^8?33Z-uUYdwhm2Dc#$D0a2BFF? zYU_Z#`pgX%-hXvyNPBV4v4cK5l2Eu`z%(UD%wsCYOev)zVSCr{2h!~QIf9r#M~H$= z|H)qDvYqmj-A-st9J&SL5(lXyYvrD$>{J@UV|yW*T*Y34e(7VD>`^7Sq(e3B!xtPf zVXu+r{2P+=qT-iXqUy5j>+;aZ+bPu-d)DzImjYHiQD=Jw)qU?t1x}sW;*D?Kmb1%r zilc-nWg|7b{RV8A!$qBJ#lH5mue4{<9t#zKV{i3@Sa$7Tb=5DOGh>=S+>OH}ApM{U zi7bAScP`VJOb?@*eRytpB%sam&zAijT)xFJ900}Ovujl;%JL2GKFOH4lhXN^Pu(}c zPi@GJrN;^c&KmZd@&tVmVMj+tgGV4Gkl`KjS1hc--q+o601^xV2l>FkCjUcsWPcCJ zBM|sVM(nH>_O?OQA@V;$Mhz1cu%8L8Jk!9$#olPLypVopTON_0Cqm5wZ3N^q6)pEI zP>HlJKq;&bd=t+FqJQ|_1XAXUob&-fgyq$d<-gY4o+G2kR0iaAT~#ly2dve4 zhh^(lVkdP`l!&Vn*wx>zmxHWka=ao)>dWcn%P+Hz=3z3(@L|vXcC%at>M{h>NA2x`;R?r~INl_Df{*t6zxT>Z!9$ zQl-_0fS&dn$uI|`n`)W!lVbwfkHQqgM!O}8hoxnwRfR~3e`-V+)mc%w3jLYnB(pF! zg8==>uai?SHi|5O^aEPs*N0ULm;dH<$VLUMAi7oSYd3!!H^>#^RV{@m1w@5zL4kNn zVRyMNEwaE8JtKZQ?`fCpuciacXUviiq1|j+zjs1@tG^eP=_&&Awa*P7Ycz5NbzpYO z+EY&Nj3t&BWhwzrW!ESw`SFNvG}_x3iFvogLesn1#ao>3*_U!i@lcK zchCimE1f$W@+%00nb1s)$JfonqGqJeg%{$Q=^_PGeB>zxLQ4eb7hrN?CWeRy@`0(h^-Dhh+mr$-y3#yLV`KWEIRX5!Iu9GT2<^?X07t6J zb|4P%?uLyY6qYqy$_i2A?Lg`DZ@^8@SXLy8tpK~ig~v}6@bccin!B+G@9$fQ%)eFL03o9$0ykgai zwQ-1>=-{?MS!lOC3|IAJJ1*H*h<^;$~&JHk#?GE$sw1&8oC?Y`sL zof)&?W7V^bI0w-WxT76sj5BqkHBk^bp z5LpCDrnIm=ca2^QxJZrJ0w5r8ZABdcXM&!}1J2Ss{!Dk?!1-n!GCGp<6H{9uIwg&! z_3k7iEQ#to^~v&1A$Qpx~0LEVzbL1yE*Nr%@gTir=V*xZ)=mMS0c9wsVv+hf@}Z{S39{7X_QAR(xvc!Ok@v zEyz|lhJ6k+6wihC=n5TnU(yw>@&zwtzm2E54fQ>yccm^6=)M^DdtN!f`Hp?ZQB2aU z)<)naMi!sZoyUyidg+E(%GejPB34%cBbRysTF z51y5I_M$f^wn?6a&s82(}#)^f&i?0LeY$fu2!@b_Z4e;;kS!`kg7 ztug5^6Z4EPG}5X5*D7)0AH+ULzN`3>!_gIvaS)0gyhP-wbuL;jdFn45qnkMQr%)92 zPlenelvi%U>Hgb`*=djTkh2V=qx~{yMukuB`uz2;i5~E~es0tCUOnJ;LIN@G)dPi% z#tgD)!^BsC2>7-^wxrjGJC%9ouA;YUfs4#^gHJh#Bb!<61XoPYBE5B0jV-uES z>%bJyJ5SIIMV|PrAfoIW_At#?7_a*)?XO>6iYF>Rz$=gBJ+@1hkKO3QnH^c%Qj-i3 zxXF|J2+O$2l=HzQf><>nhUbM{<i8*C)v_iGBim147D;y1QKO5m=8DY=sh|KZlf2DF%v@WT9+2pB?$r0 zNe34)8dyq=+j0|{BYBP*wGO}1d6rfM^bB3dW4xewrRs!b>fqnlqP`sxq|Wq+0O-ZC;9l}*lr-D4{Yk-(k(8gJg` z&|^WI&qyk;1(ZY3dhmvA zy)lB)&RP?yiP_@g&|Lp#eS}wL==Up#ERwb-E%muS7br+))!q)3RR2`U?wnyvGD?*C zDKCL%!`ZFLXzsJ<_latN9&D~hmI+O~1k0M$_tQ(t;5OHw+PGi4fBnU%jou&Bc^M&} zM*c9I_maK-+eW?; zG3b?X^P0@+5uv&9q3NR%W6rQMb=rn6;%GRY`eb@}X=)_5mh96Pmh-2uA~NQx#*>^C zxZ|+Mmy+5Nxq9W7SaP(VRt=uScF9Wi_j|BW^vSxsV$;wwvu71|#2^ZA8<(T;cKU zEAfBdi{ZXziI3#(et%D0ao2gw>vSMrQ4}gYDy)_b9PD3(ILO9s9%Eb4&RoV}uv{6-cf0^*yS;Ce1Y{Ql{XnS! z`|~P2ER(z`L0R}j@nHApr&HdLc<*Lidwx;@ivSg{VTU&Nf`zI2RMi&jwiGZRCRO$u ztTD5A348FyG3BS>pqPlI1DF_lBRz#=hu0m;K^?BTg~gN-6~|Y6jnOHjAy}r+Z!o6E zd#i9AR%I_)T9k~#BZ=gqE@x2}xi--ZlX`!mxO$@G^h_2(m3N+taR@yEYbzE^ehpa_ z89&mqtt!)WlQF+7*i$7?2s&SSX52_PmQ{w3F*8Kyo_I(4K(ane6$B1f{o=IY5 zyMREP?KG_1Uwu?}6K7ID{Rq^A)_D>tVSc3I4izenoum&UkB+>uEE``|H+yequJ_r! zUOImXQ${j_9J8qGpn>(47-Dq}cu;4KQh;wM*g=WkAs)^af2Vq$K<)(YTm*ijJ&68I zvWt8@fnyx!tKP;-^y$@7JNteq#EEX{MPZEjz^5vD)|T$2rK{U$swRSTr>Ua<+?vD( zKaQSk(j`r<;-C{2=SK-hXty39WtpB+{UN%6{-t>&M99RS#XWzUbF6Ev>3K0U5N?D0 znR;@m5k1RLljV@UjCp?(M?{PbIIhmqGo^P)eUstuNrCHf<6R$zs7M{=!M=W08g1p~Z=0t3j*mMg#jh+1Kgpr%`v2JFTI-eK?)=qLt&}5mL`ZAM zkTUtxv-!#%+jiraizcyz$&jst)sXqVAG|6igiGK#Pri0ASCTTp!11(qc+quHNp7m4 z->TZ|D#q6AKd1fZwmVbYN^Yic>`%B`_b(&eU-Lg2MU^Li&p8ep|0&w? zE2&=-IlVnw0JAM3O69hGgJHk$qaS2y*T6J}Zt~TCtC_1r8NS3{{T&!sUT!|0qaBFq z<}sjIYELHc&Vj>)lr3Uc{e-_>xC>GoEbKU^$u_bY-wi16Xcua1jKJ0|VU;?hkmdpXQ^Z9X65>KCb_tPNRKw6E+CYvVE5gl-;)c!djkvl;A?HziGpAB zOn9vT(e8n5luW>^v!Otnmgxtpa$6`0S`^~UYQwtI5j9QskeQ9HZR|^-p4?quPPT); z4j1P^P{+R)^Q5b^-?#;n=CBuK>{|Ko(02l#@Vc}}#R%P+mScZs>nYgZDcpQCYRc)o zvO4GNDI0kA%$Uv@I_vat?LZF5dVFMLckX>|cr5o$$G%m3$0I|D`iuunUEqp2(!jw* z_r2WtNFCrr(zmDA+IYQb1taQBD1hx>Aj%<=(a|;eCJPlC4*@}|Lm8RqETISr^fB|9egJ`S*SZC?Enw{-hIx62#%GOwK; znXUuU6F%5CqfRULH!B&12eVCq{(0Yl)2QS+Bvo|x+NoB6HpR9<03YOiAD=FgYOSK# ztNseXoaR4^2v-EEN?_~Uv+B$9Wne@#tLl^I15Yhr#DNTWLAQW=1GMA(9g8g)RuS8=YzVPY*@7xF|ky>NyAPE)M9~#8d_XY^kyhT$C0p-X;{3 zbV1;r_$az+nsp__#8)6Yf0Tw#PMgr5p4L}4xznRiYs+FI@h?9vK%({x-_2At+gHT6 z7WfmI_rwOcYUA{b`1Io#TYMW6oZ!G_ovn7Kh*H(5uVhhbb_>Q#6&^=*MA6-DCY)qf zU5l(et;!&wTkmUJ8Nw#aHei2;J1f|^Z65$1(Qb}1X{aiYyKqRFm$thx{;>!f-QM_0 z;1;@`rzn=?m+Y^xdjoTF8U}D^;F;dBVz_yem~!yK=96#b)L;qEFJ++L*L6t$3*5Qf zztD|kfd8N|^)g+vPwU8`$$k>`E*ldG%5`$87FQ>_q`XQ~d4-Ax7+uF@4w!&=jvan( zWSteIdP5CHX_yZ!llTZQN81TT7=SL8E*#m5CnzshwfPi}>!p8|u2n(v=3&m}A$y}- z2HF1ir++09S^Np@*GXf{2m|Yr2IFd`4AjG03u(3@3Tto=gdO@wUHQ^)Y?Ddi#L>Ki zPHrk+M7w**Yw(OO7@9!2*lOXDv?-K*T? zn300(H}gmpIGC06u}f}-{j2p*2=TyXH}+`U=2p;B2saUZ&`4dGT53JJlib6;h2I~_ zQoS}SPJpwBJnuq!>X1wex3S^OSQL0|^-G-r<;WNIFq!ZsX-TlTfqdeN-=Q?SZNVlz z<)<>cClnZQKT>(Ser(VB2BG6zBdNf^&OsjgGHhw{ZQwXs9SENceilWV=dz#mSlDsb zCaAjHB|NGB>wjl#Y7=t@{qtft0aoPs!{Wm4+YQ`9swST;Z<)T-C$@Sq8w>A`v(!wPYLp->wB}42=NUy)8Nok^t&Oyr5Fe4 zoQVyF)9?9Tx-;n}kT(WjUCt(m+2Xu|j>lHcul&yXy5EqPLAl82*!B6{m?w@F#IY}a zd$Wr`W$?3qFQiiD4Y58q-l3~heCV;`U+Ygk!%Es13P7Mxlj5)U@4u;nV}@1v8yDL< zMJmdnB6w%>%H=hj*5wfy!Gzzy_U~VH^W?8;cX?)%P+|;XE)>f8a1DVH@B{k*7~aJR zr9`|AJS)Wjd}IlS!s#=N0eNV8^#1;*RAotmog}_)mZc-lD8)$fh5PI3JXR8<*u9O1 za0{`RzcQ6pulhlXG)*c-no|{Eanz?J@oEBtYL@d~$#8ho{hh!6M5C_1|Kk1CA@UM= zy?nn%*$(^IL!l=coj|S#edES-9~d=Az#<@qVAq0_2T{WwcUAp zEel;n(X?J3U0u#yVRU*r%L?lHz+y}d*Q)^+=aGYgp1v4a&7lA~QfSq;04dx~^?NN= zR#S9&7KcxUh(FMW-XK!uXWmDtF8h>>TfBNXmJ_Mg$3KahraDqxrp#QH>@;!*#P+0J zSTk?vC^+X*2~+n(fzRo zVo-(rzUK2~{(b?fj?>yxpjuCF&69RVQOI??xcf?=zPz|t=?aKr3~sRYLV64Z3E3160_see9snW5Tn4l1xYR`8@?=C3>fqV2u<|-H^?^N#_8|5 z^WRsSZkH==K_)?ND&jwRtZc5n_RGf9wZ!7sO^`wWyFwe%+inEN&K#6h53Vh?6zJ%} zEmlmIQB}pTwC4PTH&F4FYaVDOY6VY|r=-74Z_;5y``R`c6pZ0BO0?g z?N+)}B;uS>`ZZlHR=5xc)g$_z#;R@2^Mw(g(e3xAj&L>E!>eo0RYexyIsY|NTn+yTkJw z`Ih?Ui?I>^D%TstAA+`TQ`WEM`uBCS`0jsq0p2&3sNyj1#2GbqIbdwEiuCtCz+fti3B`m< z=-uGBVRbjJSS4diT=K`t3MbkgO?kvSJ)=PI4lgVRaf5Ki8(6^2ECByQvBFTT{{vuq zUrJ@#;5GBbTm7Sy_xxv{ovHzAFfaTfq&4K`OHK{OJXFC^0mR@Ei!7rmtbm{}3oT1H z^I!+JWh-;6+!Dq{*31yI_pm`Fjq_d07}~Bb0Tk#5j-8g@eFsFl&F}UKpQn}H zq6%=oFpS12bX+0r{kB|!1I0c4%Qz!W$Z~^h!*50_k&Lim{mNYOF)u<_lXZzKXrJ}1 za#W1r-ZYv)#%fv@wUqTcTf)PBmmoo9tx(Y2LO{8y{Ti=uoAOO*O93mul8y;4Y~?Kg zn<7JG70;B&bHqGxsBgyf92oAq0DAodfD~=}X*$rY(H)#-iwYXR?;@-^fd-J=ZX>!g z%7G*@#%DlQ(vcCkSAjg%YMyBZM2YL<;s1F+}v+Ys@_-K3EIWWmoyZ zSeTto5u4w=$*U|=Wm`no%agDfT~|CCM#*yeg+X%MXo!-m?qfE9qKNps+WBW8&fJz`|EMrtIq37p z$K^l2CrHvMJx(d@Axp7kGHL|PL6TadHOJmYytaA1w6bS+SzHk>2q%~nSILvHOa70K z&Z9FJsqOI_@cinO)5?-5h>@!5{`}A9o=!jfw(QG~5QxzybO)UMDP-#goOHlvrtZLl zob;swTPYAN;V!DrB*6Cp@1*l*%geE*%|I}!+4XZ=F((~b6(1rtb4CT^1qa68-<8u~ z1Jsv;ZR5>ybk69}@A{l~P|ozpI^?A6kCC_)TQy*X#&k2u0!n7Esf-m3>9qv-GNvwq zbm9`lg?G@Wu}aepe%3Pl*Y->ofc+2=z4~!8o>5{5Ch6(uNw&xbtScQi0i~vlj0Zk z<8tD{l=@VM-2`ve@;!?_Ru(P>oUXz{3YhG)jyYz$(w6o35mP!GCA%A#-oHv33yTwK z_T94~L_fk=08HK2`h*CI8dc$M2g@l}(ni4V6RCceCG@&g)0*OHi8?($JurSRdOCai zyhfq5=n_e=Tz)yXbwO5P;ovtHH@i8}Q1h(o>`N@qmj1hk*rsHj@l%NjtmT5~z2V{I z;aVOm`BOC7>w4o{Lt zGCts`{-QZkcys$P#u#&#+~X{>X$(WxkMTPBUtOWEi2t?- zbX)gbZY|PnceKV8aD-)$xx=^Sn&=0H-Y)n5%8QE$&~Aa0AZ*w+ zJa?RkA2Beg0roD5Pp(PWHOMLe)S{!i^B~)?GgsR0i`NKCtJUFikOL-;9#xTB;1AAG4@8)w()Q74;+16j>TWAcJ$Vws%YF zE125PGMzsQ2G(x;e7DhAgN)vA?4GJ|`RehZ?>n2eob2PkmoL@^SU)50{Om09oZ@^7 z`z@u9xt=6N*|uF%Vs~3`DLiFEn~VH?5MCtMYpI)Ty^a^`x4dNSA70dJXZ5#9Of9t0 z-RFrpl=zd!;nN=bwUrF=16Ghh{CX@PDjwL>%&-rUtbtX&lX~-;XchCV^jEK5$#%0O znnA1YZjgNK2LhTP>^x1it>Iq&x54z5CCUK!LRMD#5e~g=s41-P0ufPe5B_px4I|p!LN1a}0)gD2{E5eedI1UVrmH@P-rsM1biH_Pmc?wRu5HH|EB==JndhKDF z`h^_Mye-+ZdUf=d(Q^l&^wsgisI3GlYzKM*6@t>JNCw7?xuRQ+r0ZDHBm}@5U#u{x z;Q`F#$_S{cXWaKMI7sn$4u(h~PM&YGr85Q4k9tHAJmYr)I+?Oi=?Wjfx3K@rz?81R zT19IpHI=Er9qyPqR$>%X(e;GW*t#>G>0N9(TS%+CNoy*v>9fR&Y-zt2-B|UPXPa3W z1>`)=n1_$e|5R4+_Y#q6SxWLFA(ihjSkK)J>IYwG^*e}+eg zeyOb;_p=Fg`U2=wHjCc^EywI{mP|eRc?l$+qJy({Vi@R1K}@lU!1dgF+2m3f`gq2- z?JR=9HR=lX%|9^+IaLWzGRJir1ELFoAj_>uh(-ZBwKChVfQTv_*X>PuZK=aOEV7*F zv(KesaWa#wqLTrJWLR4Gd{f`7u*8_3lu0}Pxi^H7;3uH0$bIr2v^+>3Yz@^T9i-RN zOhu{Qw;-%ITX+|cU)8aOTYDuWM)O?_aPkAcIrK9#GI}#Vh(BWkmI`J9wrU}uj8Y~e z86xRkXpbyRjw-2G6$cC_dR#Rg@#l+5{>RRr>xw_}&vw&Y+b34Gssxgm-Sf(u5K)uO zBPS4%*vQL15!%>j5uwry^8U}u^WXQPGu1oj2NpM~dRu+5Xo%omgODALL_P0MoKeU6 zhg7b&cB;oLraA(&h<;R?cC$R2{hkrMW^TSkhs>Ux)GZ&*7xC8!T1}oBeAnA+{?ae0ZT6@jO@`dNT1e>~G4z=?g` z5mt%V51oikBsXWxQ*9TZs_n9RrO38>gODl5EOk@K)5{W-MDBf2Khw>O~sUFtebo%cr%A%TdO2)pO+T6h{f`DZ>1`Lv)ekvcSmRE+0b^yremaFEFD(3d{+4#jH@xhXP5>Ac?G)yp70%3!VK>60E5VS1 zEe3Cz%NlPg2+JEX1v+v$PRX`joySMr+f8T}BD(D~`q5A*T@Y4bWYaoMgt(Y6A0(5F zjLZ|^Ndub_KLm|_6EL5L5-?Z9|JYlIz?pgw4dLBkeX5B!I4CX^74>A>mEz;W1t$oo zShkF&*}Pa&3t~fuJO1*pF}LT&$@*?pc5dN{h^q0FY_5Y-W#49{T*g*y82Yi^n zS)a6kZJF(f|2kIx^*}x)yn>K`g%TUFDaWr=oc;trEOcaCnE=Zb>sp~k$xz9TgT-r`G8Cd;q;@zm0)E5(+ffe}D87b9{ zuvRa+=BS89mx$#9c3xLQeqO&5gc1uFw*_Tn9H$u1GYQGcU@)X>6UMU|R#&xE?LK;}Wx zy62<~_eP6TKfQ<`TV+TT3G9B^Op3z%Ee;xx&($A@P97NGv&P#d3b{Z3G2)drE$F>X zH}5rI`tJer|Gc3-B1Rdq&Lg8|E+?wC1Zb^piTfXKb!bjb$@W4X&XFmGGCdNp6uzB@ z`?zt^^Pt|o0qx@XBr9*{<%{6}MUNFZ$6taIz`Ndx&oTMPHtf94W7S^cHtC%)07kog z?(qEvmZbkG)!E=enNUmC>|wFD_Sj0+16VIUUCO5!iewTK5k#d`n7X8ZWW9$lJWZb@ z!scREq5VFt)K7+3)3y!CTIT|y{eaq?`c0m)mbCqG+XU^W?~fLK<#DRiig=@DXKou{ zQ&I+w6t);b!>OJmJ__;gm}~^W?)v&3X{kW5*R$OqVGcah+aw^R*lH?XKz{4r=IzI@7jZ8C9~ zc>IAAWV^{)AW9uG4dxz)P0c=qaG>cIxcS5uE-|;G#%3g_C-;i1*Y1tfkIye=Lj|;W z*6_tL9K@rfU#*0L&j{?U_4K5_U^^(w!T^W2eqj`FU;KetnDG4~NopDXyK*=9C^t+y z$Qd~}XaGi_H#ecRC9@+;QgoEmHz` zY|D<(I0`YXYxBQ>sGrCt?5aDa|8)DrNutxt<;L ze+5^YoV@Zcz6#&hKXdcu63q>(@kRwcY!}hXj$Rb3WHP`$W4PxsTBr|U|w(5imtd!43V-7|L;)bEw>Hzd%;w_*W?5~;U2KG9}* z;I{KHS2S>`0${KyHGQ~q?E9NWrW;l+>ZG#14*IuBrr?H=|7W=12&}$MEf44}nzY3@ zW3G2fdBTX6@()J0)wg1*aK^v;dE7$?MBJfy!rKu0j3JVoso*@6w~}8A;)R?M*8YH! zscebY2HIu@aMK}4rslb2^?H2ofbP2U`PS% zoQo92>s;?1MAuB1@1DaI!)KkTCXk#jot!WmU;{hqYV(!EU425PcTjM{RpF$noe_M% zs{K5Bh)y3#a0(d-Gjc24zpci{Q3)r>Ic{F z`Xd#Z>}C~?o8uBGaDb^6pdC5V(hv1fvy}RT?t9%ALr|pH{$tRe?6o~!o{F+$YDbv; zBTyqpZuf}rZRBOG+@dR@9%&tXh5Krg(oZjK^to5aQJsvPL^aEf)DK;GNo>ShrgY*q zR;qaVY2iV>w~GI}N8>f%B}y=#KhEJI`DZv3J8gwHoYp00fXS)Qb3;;(G# zEpdTME2oq4REEH@thrc-uxY#3hu^>V!qV3%EJu_cbcDH=YtegR;|kf_2X00O$`Y1S z?E1u#u%(q^y?-xL{EyehDC@q{)ZruKI8*8V-aDt7hYiafsL}%tyejo2j*-WMv+>Hf zebJC@z|O~*);x0pX1U+MwQlW)%|1kokHK&Sy94h&XTTVroA&1pw>A#LSHF7Lumkg* z$DXpRK29})p44o=e=WauXk3ndjVnxz6M<&9_bL%%Ekt7{z+&l}yU?NqxgYf;jIt8} zVvd9!?0b1wFlx&FF4!M(ki7F$WxhA>CJsKXE z>9g`9YjlU<|K-b8jwHix45IO-Iy=0MlU~Z31ZladCLik)iW244d@--ybnFjT3eqPr@^Gm_eemn& zAjyj(ppZSuyM0mk{{5;k+>p$j9X`AvNM9t&wHy%DlIYr3<3|WC@LE7DB6Y2rbkH&2 zvetJLVf;SmZ6+Nnmsci8?d$M~D-KJK9J^CxM%00bDObXG*Q&u4SWptRk!U7S&15@# z4G*>LjGsWKD3##0{nPL}cmbC>tOeSkgn4U!Mc(q6Wq?`U=d%{?9rH)klt zKLF0%g1k%~*gtW0QR;(kRI?u+Xio+ul(u+1Tgwnfdbw&rjt*`L!yOktWrQc>huk0p z{?7|~jjbt$vV{@qg^;OLUJ>%8CY;C4MEfw7+>) zX$ZVcU&?_yKCVe3@a%qZSVqu(J!3j$F);GkHsHpS+5tS$(RD9*RbxCUHzy~j>Pwpc z@g%M<+l3wA^RE8h{2Aa)WmbCZC3HWi6oz;lPgv(B7=oH2cHVskZjDTuRFRUg|~3j#J% zW!0O@1}8H*V0IKGT)Ot_i03-3#4e3*J%2@n?Ls?NMZTUi9@uZlrMxA=I=%osnaq#Y ziI1#uZoY#W{Vi^>qom!fhkEZQQpk*a*3rji>UJm>)Z1^o9@qh$WKzpT(#E3{Yi>Ny z&S{ug1##BJlIf=T3v*9kb?@4L?N4*#Ih|Ktwd{NY8G~s0-&c_LB%jkt{$P`~OzV*9 zGv1#F_}`9^HnMv5LC>F80=rfxh@g6a3FHh|qzZ}Gm#tTNx!mCl6y$!TFADtTF*8whIO9Qxef z%{EG03w#mu5l=U5U>b9QLHoGgbsX!a#(QM_iqhIw9;k22sJ@ouj_HZz7iC~R&PX#- zCh5-e5p7nK{B6PYc%UQ}-eBYIrcYeL3wM}21yz>QTqPxcNIwY)N#Sj#jUL8Z?7i?d z5{KZC_7*jF;1OJVmEwZ0BW}3SlBp7G%~uk`6w~l3w9ChfVO7%-*@M4L{n!l7OM&ke zDa?s4w(02e&+PsG7iKH(a?s=vA*Fo&KeFCBD$0LdAErS%1cpulkr)K&20=;?5CMsy zmG16FNj6tHEBe$_msJg+$8lcQ_jlVA`p=nFu`F|UYx(VVX>^Ok1?LP^gYK@e>% zZ<&t}WsTBNbaeEY1o)ykLITg|K(_0PITxr%tM#@YD`iZwY^v9A>b1IN&?oYk%`3lT zamd!)rHgHkHz{GXHX&0!K{$J<$Ut`Y12WV;jOGlyL0F(o@alEYReQ*YEjYK=1lJ3c zU}o!%&Mx!jUkILZ+LrJ(?Xs7&4PhSIX7w0MyFCn(4#m`957EU_WMu%QHU0IScsOJERkNmS-;jaJdfcbV4ytLbNW?sK1|(TlD7#~mI?Rau=$1!oXy=ZQhi&3Eh$ZDJzI zlrs<#-b5=Kb(KO9rR&yxc1|HO_(qMkhU%soDHd9&-=9Qo|3A)S zX|&XJrxaJt<)Br+5Ssk^8{lJVe~Fa(9H|}wBjbs^q@gdek#PF!h0EBZ^H2X7cn)I& z*}F1I7*(-+6>=~I?05}F3LWL$6XCmJ>czZoT3&uN{GwlZZ!)J!^Tep>Ezex`^D|1yyBo z)#|xpe!6sHyO&+-2k*#!%*|9Vn*?%A$JK5*9{5*2b(FGNKw&iQckEbs8|9$w*PVzlU%Hg_O zU%I9tD~BHrv|bOa0VbQ_G4-L#uux)EV9s~XTNM+oWyyfclmNX@;t@l0uKzqgrfe}T zZfHYFD>Rm|gIEciW z8@C2(&!TpKn>mfz4;GmKfbfP{fE<`&RG^iJDg-{QOw(4%Oeot>^5jB>2>09N5TaRX zyJqX%Gx0Zjs%MHJ=jLcEuE1V95)-S4B)x%gi9d}%nUD=8LA4h{NG&Gf9?MlAFM<&l z74fX+H9V{u?bA~~rQ`C6S&Co8TnXCH{mjTrh`josfdjY>tYPwcqMqAdL8+FXnJoWn zAad8l3Yu|Q4k=r*(UVBoHc_s$a_&*xpW670iaZZQ!r87J-*Mc23P5}+ zSnBae#aw|$Gxh))OB%>&tn+| z3*zgvvUwS<8DAKsUddg~9aM7-h3)dM31E?VLk6IN+miike~)m^F4Y{owcu6w%^nJU zMZ}K!_@;FDykV6cj>K6lz(Aeci3HS=ED>3dT=0N$n(ws8L;j@(dI;PSI$pF864V_% zTk}?H=Np3hdW8#%Y8@?;8$@&UDcqyUO~u~|+}&;~>Q)rAa|LmEZqf1Y8<0XMPx~W4 zS00}{j=}W0o8}wL?a@9!n%VKJY?FoRkg_L-GiDFG$^6GFbwyLQ+1bCoNL1y9mgHKGA%oR^zZsWN z=Bk`KW?&mhN!D53#4L__Rn}zo=L(zN6Sks+sXAV#jABFp`<%hw&Oqn?czP)j7p6;L z5_bz^IVG-b-aiSB+B*$HMiyWa)k_P+e-b%nL{M)J%4lU-DKUf}*AGIEm_$>aSG4wS zQBqK>T#QrUJ2!FULEW~CxxeMQ@uZx8yJR3WTgh6h=o%h0wh_xmLfpl2FSjeVYK zUsmhJ2pJFdswPDmG#t+V0n~`^n7{0Hmi#R*6iC~3=K}_B{r=z?>;C8c`d2rtQJNEs z%1B1zeHveaGSv7Kk)#VojbehvhFqVODE1xxHN3#3g>UkvK{ubaT2-YLAAO>gRUNj9 z?atf)qezG*PV!R}0c#LMvp__Or<_($Cw0`zVi~i1HQMX9xdkr{>cQ||vZrhpkS0eJ z@FGIhJ}OEfqBYMD6UNj0dNTJLWuYzs-Jkj5si5Pf{{AwzhHbyJV#V_-F}irJU^b))~et z<-_~oCQ=Coj(>X-(gYP_35QG2-8HeL_nl}!oUHhpDM!UvWO2$ac&{(5=Aeo;!zfLP zdUcT&x!-ya##<^Zq=~;yg$HHP;0(%n3WYYUKdGoXh1}h=-gz_{UC+zncGUUJ)eTAb zm)U5n2U)FBQ)NdB-Ym3UdF)~z-yIp>Mh}^G-&~a~A<7=bG5CC}Kl3Iaf5CrKJ7-U0 zhc`uKwCxda?y)-)vHK^0adOPE{02lvD((vV6RzDhNHr*)2;Fpx{2Dgb&cd_%WE}2C zdY)VMD|}+{-V`kAhL0Xj*Gj!jh2CDt`}SPL=!leth6)iTSQXbo>vLyjX1=pXD@W5X z*|d7ZSM%srd@$s8W#;Xbu3qANj~D)5!Om&nsI!CXrDKUDeuQ}E{u?|yQ{(y7io4U+ zmX#4{%bm>cw|kL%-G{$k&9fi^_q{xhyG53qb`G*ewkx~>EDLN0_03pwM%)^t?Ea>` zx@zQ!8`#y`_aytz7}8b5elqd%=hN2(t=`_(<8^7*3qH;=DodZ5{BD{v{mwMcn?H@K zk2xhvrh?ORVklZhU<&~1#BvgG+ydl(o!^QjNRr~Y?@R;UKof8>h3lTEK3ys5!!Tda*TNxEd9jLW8p)* z1KIk3t!Dc)A3s*uXdh*#Ndn=PR;dh?fqC(c3>B)PynrA*vqbOoLwDQpP|xKcY|BjI zodzZ4YvR0L)hS{a1aTP2Ixh)lb4yDvU%d42mfWBd-&$m~P zY-@uohYaR(3))UYO%71k?$7W325DH6s+eonjKJ%b3ww_W>$`}xInTddzQ)ihloz%f z$*5P~D${>f+#O2YMnr{~1w-My(0 z+u%P)d;2%q97BI?9Bm7s2dV}kKI>);f>Khy=`lp&;%&qc8wG1fk=-kCJUC(zr+2@mT~D(xL;l@NPvTWhOO&XC z0ShUIXZb`7=KOgIXzjZf8~Yn%UHY>_eDWjJ^etrB=y{&gMDt0f1VZz$D-pr2(+P}C zFS~bF1XtLe=dFh{ttN92Rbk1{*?Gkisyheb{p^;%={t9A*pj1&C@c6pq|<5tkLQYh z=D>Ghp*S-!g>soH@>VBVd?pP+#j*{7E}DA(wHo-)yy+z^}Qzo6kSVECjs<6d^#>- z;Q>;kmV13q>J{m?56_7LusZPD8_m)bVOoNqU(ufpccpPV=|LzWn^;EfQwL1m}Y;1(9 zZ|nmDbekR%4%owiB9hXt^SZ>keWBW*#xwOg-Bih=bgdJs%i-Lee3CM3xoT`}T!?ocvqS{0ng!6d z(sv_x%ZE;h#rThvRUHZB`?(0m6b;x%Hsa1ZTIP-7hHmbvrLL+cg~WR_o*BgwySUu_ zlz5DDCTG^$dOLMDi?}7P@cjACLwRlyC?smn)&wgoxKM5*Y!)H8Qb%rbJL?yDGc0jt z8OLv>de+X441L$VJhA0S(p;$23mF~N@L6ge3{s-P!%JX`e1q%8+)ON*1o@>(_K!ve zAO%FGQpLF0CaM>f;s+9T`s&U>2?PEq_E)eRQI8Bj_S9*m@!$Ou3G+i3!R*# zlPp%;(+5FdpMGfyX{FNA%Zei3<}By+!8AgNl>In*31!WoB63IW+niP&!wG*Mwk)4? zi65800Rw&4gQgUntqksrbL}4-MJV~JdFU3fP2Co%%3B!#IWB1odAUJz+E`>gD|iT4 z?XE|K3CC%yVYZx5IT^@3U(*1o4ffaUWbFsX(30F3U!#N#se3Fkx6GD@@tIJaWTsDa zFve6R&Pcys5Fzp!PfQ{5EwrHXQcFlGP(dB`KH5FQ6q&akomnQxGs|eI6DQ^vng4 zjtdheqa${R2)2`qJM4q!J)_N`k|QQO{UhNbH7sT+T;Pwt*f*V%0->n@+k+jQ)3u3Y zpQG{Z4sfgZG;okrj@@nV?>`)WKax>OuEqaa&v0ak#>uWXz`sKvjEOad`mzzC)ux+Y zW)`pr<*Rfs5}P#RTt>)g$&72$7Sj%@#Qy`8bX9l${;dg5YIseB-p`b*XOdZiv_$h& z7<;-@gfC00=!Kz*$~whAli3H)5VVu+txLZ8v%d^pq}dZ2e9RYYzxVClA~wd`fS|`_ zvL?+hS&lKGm1kERA4{Z}Axm7n30`fpdB`QlAGF|;J2DsC&d5pdH|o6nEutC1jVWl2gvlh)B_-*wE(hPm-kK=|-mHx`0UZc;CPbhZe8Y zT-bS}aq#6VDIV7DMxvZ~@lBT&^42S<)yY zQU~adH1WQbu<%cQ`uZUXM}{7iBEgv>QIfoa)`{u+d;tMTHG>_^~0 z-{q%0&pVIEqL^3BT_xmS@C% zXP@Vv{XVIuzP%SJ(&>#6Mzrb z5DX=dMv_s`qnfYJ_4{TWnr`cKBCDd242fIq$lK`8ehA?~bS6n=#&8@Fw)qO32#L;1kO!C( zwcX}Yc0T_-(xWy#k4YM$NISIuS9Z>csV9EH0l$TT-`;#>q2e^tiMQLBl?*@1YFXla zqV&Uiv;Cxfw1+Lne1~_eoo4Ip4XIA`_Q`TMe7?e~5_L8^qVva_#jo4EyZf}5vY8MY zo6X5^( z$XU%S?la>=vRS+>0?*y8_Ajo|%~SOI5a{7J7aYwR!nuUX-&5O8X}Q zo|lq1>1oU&FGVYSWSmip(Y{u{2;ft&Zm+pD?bp1AoV<$!v7M;h=K5L27sl9ge4SU; z(OjZo(1R{CEN{5ozpzrzJyL#{nY%~il3wah`M}5&tFv;C?puC>4r+dnw?x6PK}6h- zE%g+y>NQ?-3W=2mHxa^A%nx2{wpq1AC*pj4AX6Fv@^+fpo--@2Q=KC{j;%;pvT>Or z!*Rso)dLV?mM4*k_n2C`8-GkY8X^u%*(d*}5{Ng}w^$<{ zDIJ4MR;ox=ud8qVKzZY%JbT6JHRgPI=c~*NO=}vY2B=){{&scvFsmC-%D|j`a@;nw zaZM~qeGggvg(wG;?L0T~B7QvEw`$~(AUn|Wee8b@h`J})I?CK` z+EL^rT8vkZac}$+d8QlYa$`n6d{78X>keIIDvOBCDcRLvsL9GPqXnwC(y!1ZGd2`; z?%rJ(beeyh(gc3|E%GB^@J@VNu1A=1hfiq{luCe9YLXD9_@jTG2C)* zR?mG$&UHm)AdKB{dD;rJ{9H~@EO?hN`efv4gH*o6adxaz$Hicg49{dvN%T{3x#T>^ z>&dxwXx?ZmpZzN0#OkC6T4Yh?Ke*dCdfRwBEVgU(g4BfGAVUfcdEvQ#tjYh+sCc*o zoE5jfG}LOID`l)zZ}x1|A|rO~3budL4(w;9PpX-s;whl9WuWUj5Q{!OXC!as$;*f+ z0RpZ!zga1g3rpanI0?GM<~KCYxR>>fu-a8I7b(u1ZWd2ZC4WOAN|HL2ZUIQk5{%m4 z9~wOIrYF45^l|9}66~;FFh^4%_oN^ylWu8Z`LYP@Q}l|OP*yd-kwaw&a(Tk%*Bl&B zWA~(rzg+0-d79ph>bGpZw))ljiP>+HjYJpxZH=pv+kE!;bChdL&Uf*2=-YmZ$qTtd z;tY1w#k2>6UM&~?&zk0ZjcQD$DQ#lETD|kc3O%WEa%XzWYybzOWyq7WF3}Q23pcSANlx*;lwW_eA#ve3<6Y`1|hg#&KAGi!;n8oS+hptZ%3JT zxco{!q7gn~#-M49e#0L{_W}!Gxbj_{slfEd?_(cOi<8%nAi=W?VI|)H z94Gm>fDJi@ZzF?SMgwic{3|2~k({ucH660hDZF#+{0*0@$f*(jA5(HC47=}=g9C5l zX1dkc?*Sq8&AZW|(~UU}Z0Omrb5!s~<3z3j%e-?X zP*4x^#F~`}_;q%TzcY~UUBjnLkKco7iH```|CYx*h<@#bOQyuujbkR(jWdTgk}FVBb2F2~g{4fS`1k}974Y;! zFe*QsyZk~>gy?t3x|`6xi?gt9h|4_M^GLvqLjQfwo@Y6T{Q(uld>BarQ5hY$Aa6e7 zT~7U>rs#2~!g2TWxwx-U3Q(iF%D*^Ju_ncHwni-?>3AEwjo~8WCnBtc02lD*f_Ag! zHiMYsn~@v%!Y=Fh=ga(j)b$3CKD5JhjJNz5G=I3eyt0GzS8@E+vAZVfT29N@NY~GP@yLsJ zHJ*|_B*F=js}kC3f>ZCQlXpFnzkS2&r)111OK6pHOxMAFbC-SI)N@AiwMC!ClNW*k zdDIX<#lZJ9+vdmx;CpzZRxwrc@s!aJbYxP3U67Xkz~;;B#AD z0_!^KeKufaFo3q##Mj}JT-b|szg)`KAMqgGCC+#|bt3ZYmr-^=4Bm}P4}Z5XRoqu- zrGd3479%Qa>*~h2$z{YJ;eX+6ae1v50j+$;C?mr;8C9*6@YsZUHor^P{%2jf1TJ_1 zd-?M}r>6;6lK)$Sh`y}<&^VoRc~jxmEISuxeyNX(oV&SB@*rA`z?7{qq<(sCO?dPj02c}*0TtZC-p02*GTofv4MfDT@i+C zD(MN)5d+{Iv<2)i9cX{u9O+Pf3u6K*SxMPs>G{L2TA&17FY){pN~0Cp%1 z8@h_$=MeWiE*g9`x4D+%pcajsyJFE)d&B`SiQw(GKxwUM1XABpqQ#4Dp^tUVyLLb$ z)g?p-*`CkR>vAFTZ~0@D=H<3Ih33RRWzag^#RZ4z8tlmA=Ih8Ysw1Y+or(*=_jq}!%Hcbh=3dw*}=@N+ghLu4F66V&W>pD z9lJJEqU5|~wB&jAo&E<0u%8V48{D++v(Gpwfz~qB1)Wl;7uv#0{cC(NzRM#~^TIgO z&ZXkl>f`dwb!;EZ@^lVJg9c+C4(^x>O{j1R_XLhUa^(q4|(s9HB zK=6?cjK~{xR~&}%HA9DQnqOkq`X$pJ+;ErW-V#cX;@TQdMB5oYS(SW1F@64mFz6)Mu+jYk z5S`g__2&DxBG>49rx3g*eAz>#iz0kd%rD)N1VdT!J%z13tamzUjGL#IsXUn2rCawP z{ypB0d$dPCh+Od9WbT_Td`LEczNySo!Di=|$y1P@pA!4pV<4@Gs(?lzDmaMw{djXj za_F{-GHFXkS6{|E>N0Imt%KiT=37|GL_ViucI81PfO^b#^z7BszxaBvFs?7sv8i7&EAq>~BhO50sy9_^H_J2Pk4sQCpxt86z zcmGt1(E5|Y$H$LqtW_~n@kTBErjj+!jL_Q8CU#e-dG#H}iq*5lqnad&Tv4OWcFZ0d z@t_A58|b9t>bfb#*GBDw5<$&R4%KThEZCYa_Cf}3*Mu2hwZoYGJBF{Odn6}ckTY_k zgD}g7@UH}19&s7C&QF4VNF1KNYsoO<-1zOW&Z3*?0&DGmx?V(48manhjo32ov?iGL z4{VJH_?JHUNazcemRT=XuDKTu`Tp5n!q!@jIfxFn@vqBahezV}9py5M!qno8s?@09FAMoKk0$BpV{FFCVOH3FSNdKJll4AE z)sRQ-Uu4WDxWC5Y4(}uQTdDBu8+U7ufID&Jf5}UcDkH9<1b*MmG(9F@F1`U{r4klP zY@xvbE9s=a9UW*8NTO9La?O)J8(_k{l(Wja1@R(36WT3RtuV^LQ2jrNg_% zQoxFWakHiVc^uD>yyqb1o2f?kUF)R;)i!FapzZlHI*PMGLVH} z9=o81S%fcu_>9c)X^|Yn>eHyq=ahK}KMmM#T%6*c$|*#Doh;X~KkZISGaP<=F1ED( zd8y4C5b^m5{suW|YLEtvjE6-Mwi{@O^~IIZeV`E=V{#Rq8a!2Y@|d9>$muPN1Xm$?F{fa0uGQD)3uSi>yZH)qvP~z zDVzUPLg2|y8d8GdH=&04rc&oe+v%&`*|Yl#wOlD;&=-QFn`!dF!zyoKyg@MdOFvKN zqrXax#VJy$X`XRdF~A-3%`l*weDkq4Q=T$rTI?zGngjz$+OJlYDipuWu)Yg7iKlX( z&`|KmQTu7P_RE~DgI-dA2vdmJ=evq}|1&~Yv*KVG&34s$K}`G?@ zG30<*URMJaWMPdh>9p|?+G-8#8H}lSH29*bnD!c}w$qg+!FhoY0+3eG06PRID9#ur zoXfM3t;NU_gw6ZA_+1M5fo!f@$~DsJk0p#`-N8_5aT?@(P*7}#z`--*gLP^ToyWXM zcQ6v0cm$p!55B+jN(2YRf5ygtJ=zuLRc;5bfst1?=YK~0&#JE$3>@QbfNOSSJ#!%LA_Vp4OYKJODeX!qsl9Fc_OqT7P+bnDtj>sEeddlJYP^bN)XWPl>qqCy#T4_{+mRp#0*RR_GsXA@M$w?pxU~-> zD#4G<-A@q08^|?5IciOj-Prn3z=L(O`G7Mv8h=h@cH&p1^4nux52|^S0^|^aCTsSejmO*FOpD3I?3)^idk6%LkjANP=F(Om6L% zz^W}Lz|H1kl-dX|yW6x!Ur?YnH{p8%4Tx2F!V@nx1aK?zQ0R>RhI3dom`*`W!U4r$ z+(-d!l{f7DbKMtvu+Tr~rS)$G#OX~Bq}>VVMU|Px<2Hf*y0qCn)X*7Ffa&OHvS^S> zR}hO_Uy|!4>u0jtz!8Q5=!yH+n6rHKO8tzBK{M&uI-_1YPg{XXN)y{;&-QCWyWl!n zA}%DH(A* zRRdm@dnhjpYB53p*FT}u!T91kZZTSoU2OrYtZ5ieywP(i41trFS7^{@kC4-5&q|J5 z%1C!eUhPusfNBX?wQmLMf3U}M(gkd9pO?s6AloUS7qC*U428w5B$$pEwtXzbVX1J(`|ykDx)U&n=Nje zd7IUks(0wQ)p(fl{&}4SDpg;#DEI zG}$%M^|%0XqX{i!@>S#r3t^ah)okj+bu{V^`S%fdS0)-~x#z$bld~S!02a7xRF=CN z?7tx5KaY0C5f+`Fcp?6nSrae)s({t%nX85+SOYBa8Ov7yr&?Zjy4sWzXRCH%6eeXs z0_-q>K|vvntE(|~p_{4FJz{*ANB4ceKGVQ-xM2E-^`@H{H5foY9Z;e{k+35UTM@#rRjd4i{=_Z-MKr(#AFJw_Mp?(d~Oi zP+31Xx7%?bUJpZU%p} zZhiSWs4e~5mz4sAZ2Ie@?Ns>>SVro85i!DUu9loay_+|Jh`~PgbGqw((o*A>*CQK$ zUl8WSBs1qWzoe|Y5m%h(FY|M!rLiz)+Y?&&L|4^w=E1j?IsJz-{JIUky-wyKt4 zp}~jbT1vKwxIFZ__!D7wR02$23?7#IvfMN7-1Hx?ylTFyrVFS8%xdX%l%-2Nm_?pb_LA73+erdffHXWX-+-ujEM=1ed9lrS zkij=pcwhXmi|h<|B0Z{TN|X^P>rr#QdqJAVHFd_pSLrl5K9a=D0}1t!zwrtUVwTfH z4M!nGgHo773mqi}(Gui|p*+s%?E^+<-*gZtF4E6wmxb|hTTfrNPH55!Q&hJfOxF{x zqp4DhFvuia*JLKdIw)9=<<*Gp`k27N*m82Vw|b^{iD zHL^1SAJV;78_PzxK*i}7v92mA34bZ!U8*XREVn^HLD4O6W)E71-|to{O~{2WAd08< z<(4-l8^D$lv{5z=@_P1{T3dl8dgIiOGmKc@-~aZB)>(A`?D2jeAEm6dtr5}Y`R?3Q z430c+7iGgA@lqg_7p+_Lwz-OXuD>lauMItRcJy0DNmFGzRu+HD4(MdTw*di%7||26&RX$-MzrSOp|PN> z2j-Qaq~UDxoY{V3w2gXRxO!M z6{ebgR1==wdzcmmBSaF7IUWXQ*n_MTU{Ur>FunHKFZ2>JesP52C_V2sWw`4pnR4ue z=MKWq%sCj#VC(6>lt7DaDKLu)T$Wp4Ylj67git2VJy;{Ep17g!ez;S(z?- zT{r7SMVyM)a#F;5`cgH!UV7dT*#E5k?Mqra>|w~U2SbW8;^eI=7AqN7@-Ycjl6FeL zBl|bcN-%5L{5yv*1$!HKU(ltXi}P0R@^_sRg`HYuylUQhxwhB1pM5248EJNO6Mnuo zCd1#2em9SgO;Xhc2fCU$J|L`tgYn6X&WTV)klay~j&&E+uy=n!n^^U;-;0k6Y!ZNp z59?=UbqO+D1?|p{4g;|KR~|tjfA!$0xVljCgG=BPv&RR#WMrsZ#UGHE&c$E=i(f=7 zp>-nO4^YUC$ryMk;{vb2SfzUxxt0g9*CTHe8GioN`>A)sbioST<>ErM3Nc(YKMNdKSfmGT__F7Lz`gYF#$`V$8SDM z#n3S*VZQ&3i>R?%vPx=aY-r0ZSk*P^N&x~a_XWha;!}$>bPTw1z5M)>-$nw(Xjn25 zIUF$txb4|N^>`k|?=^{|Fi9?nu_F9|@y?L8bXMG>^7{MIXYXO_MRcof%i=xsw#q>nHhl7j`hW8muRi&2ed6hj{J%9IG&Np*BQE&@sdb|R zAqcWC!&Ch+3zn)}`+T_O)}nyvq|$b6GWwLW8d-Ow#_7|sV86s~YMK>Sb_~EKRPPji zd+?{zu2||VqGiE^2gZOE0vuGBXaNXPh}JKnft#0=Fat1-o zI8oyBpdH#8V%`uElN>J++bg_$f#8Mclyjg^5&9H4^`mk)_ZAcR0Oi&H3WHz(*PmoG z{iSl|Mk~@%(|d^}xmNEfo%)vj{0HiMqd$nITJbE4C8G1xUIdJ(3C$q>L@@CD?_m@` zY|-zE?z4u-L}_BR6*}fXo-1LfG>-J0xGkJ4#nK3+(;J<3+=9}QhwkxGZs&QXFkccg z%9~-gsG92+Hz|Gl*-cBlTwEs!x@}gjdy4d4g;`>$D0Wwx{Q()dBbs&Gd5pl{bTkv% ztuaTxbw|Pc{`Ag-xZS`E)zp*Asp`Z~kAOb#Gv-pQ-;3Ke23OVOeMch{n|!)0?;QpH z=kHEPEz7B1kiA!Cgeb<-+nKhCsq9=rAoe^P5Mier(3odXl;2`P7-mn0GexujHvGEd zaK(a{%}s(EPJktd@-U3}1?@^297Ow8KX`#ZAOREb1eDsj-_+SrSEf3iJz|Sh`GXji zSjuYu_ZP=BIb!Z?wCFA;L)Htdw*Z~Kd|~$CMjI=IIaq%bLR|gFg3LM|Q?CLs4A)Jz zjV+*KSSE_RyB3+d!kt3s zeb3!+|GV28L+{baUIUPVKv_k|vskx!zB8kx85@=6(q_mIK2^F=(YPn7!j1E9jgjYN zD*mhokWcL8({=zm1hz%&qfZOA<6tt!0!&nC{N}4?CfW2~g#K(Hjf@aD=bsZ8Z<&4SA||BF1mn0sB9v1_o2P3{4|8+2IaAGqd#^g!m#3`RLi?sE zFAE>jXF;_>n6?D|dSW>E!ogJ++bn<_@p@L;Z&`;BHALo}D|Dmg`Vs(->+`*8u2vCM zK%is7>uO@2ODhYMcYv2?-DAc9gPOm>ntLeOD&@AN%~XZ*d8|EMMwfCsy4q^wtYw<- zPvjvg?Ts*550Du1-|?Z$`(N#TrH_z-arrIpIt2J2JHi+~1_X>AATnsT@pN(9g4ZX_ zFGa-?19?8cEkG#_SNB~ZD^t71JVC;4z6T);T;RzY|HCZ&&$4L%G4hv;K5e%7R;*qy zmOuA#?J>@-xa)!eZk}~(F&ybCcl;Q)81+itbqwQcxb0P~?TqO;%}4CO!hjK9kB!kh zj-b)AS7md1o$1avs$b5(;V5jZZmf$Gp>WgLNl5y94@^rAeTFJsu@6sS)Gae@yX-;@ z7^c;zOdZ0QF^AUoPGeq;_f`s?w9q{u{)S%gK@Np}9;j}2BQ2r5^S;MJSsvL`xFExC zlt}dRr?G8+W#$tS2IPay)P-RyTB8n=02)-VKTviVSoOm`=YONZ*EQp8OOOp1e{w1S zF&OWM!jHRimK6B9s* zsnSPl16+6wZNU0u-hBy`I!?mya+fw2LZVasSs3u9Nnvv&=-Jce5*i!6^;_|bjav9DAK-diO`F0_KXnk^MN zs&D;GK4tTp6W#Kkw!Z%hi$r#qdTlN)u2h{&(iJ6+RBg4%etPi#gU0KehHvyrOJF~h z%jmliKNE;hvetaE{B|NBLlOu)`R>baHGhx>o}*(|f8EA{It@@%-7Bb1V@iT*cY$3Z z8&mGqEHI2rP^7Oi<0A*ncWcF6{Lbs39lH^5R2vq^=p@)Sflf|hjreSDVGe9FQm?2Z zAAsIFYhm#r*gX{+=dVCy@z(-3-tKN_t;vB1&$uMq?4jFoIdCSZw==@io_GN?^VNTkeUt`*cOj*nSut|jC5C#)tI;7GuV zJ=#2yBS4zff5HB|Q`_-$;+6X6#up#S@BnNF#bN4sBTZN1E|G{geb!F*T@q1L^nhQ& zfOD_qYVWB3Rm(Tu!)RlJLpp_E4l=_*vI@`O(_BPZZ>iMo@}usuH7PL6F~B)TN&`hV<)C*Jz?* zIed^%9)|70U83)2lf&(N{1dpQVwdR3DqOwm!Kr_8&e_@J_UYz$zP($`6JhrJ{3H8l zS=``eUW>+by6=?1M&74|Uki0T_~I5+-v-*?-JV}BjJy6Ww}&+MC=0mANM8mcGQBCN=@WN2#nlMJ<`7KtvV{H{pgPxlIeGYEg{uEf;=#wf;0E8MP)YaAH zNJ*b_XkGYt`aTxxe@;bCBJI2z$S}gn>y7x^HiBb0e|z1DFIT{GP2%=q z^(S!6WbYqgMb%yqV?Tpm(I7R+-&?KM`LAZ!=uiz@gcc+okY`pHzUL%NK1TSdu=W1% zFV}&IDRRq=T!h5nqwcjzRyBIK$f$5V>rs`f`w3fCI?*9y+H79)8u2mm0tS2twG6>L zY+k;5S&wnvbfyjib?l8V^#fwyyr~aPtq1oGxZ8934%eFE77AP%yN7B&JYAL^B!0>6 zASy<7vS2X!`Mk0w*nltyJXAy5Mmfd|TuX#~rBoA|m(MsEta@Kg+QEuQvL}Sd9_rn0 z&e~gy#zOyCit7QfHTIyvS9eWy#kEk8R;PJ zfBGt5LRk-AX8tZM=Q8bx=L z=UJMn>MYwY$=|!&Zf)$I)ppdiDWz7L^$&pXl6Y+wy~~Ak8+oqG0eN+RSFsZGX;z3J zZQN(_c19KLkggA-^kKyE`x=Lys~?+_*FKtVyTecRfYInQ7O&rEdQSi_=wn66DIFo5 zvP1j;*(|e!1?`Z9%-vMir6M{*BlZ5BUxx2QAWsPKyH5Y`nXqj*&&zUknnhWmsB`re zqilcPXfuay%s2nqW4QZF#?rnrl~*ng;PZJJC$zl;a5v#GE+tF_h`?*#r^38Y%w_33 ze6)~t#CApeZz72o5NUCROm#!TTBSz^2wKbMk!P1}+ur~-*Sk$k(u~um3@z2 z#%KwoP0N+FY#zV#+5gtZ_>3*&W8wQ&q8q8-S7yenG&PzymxUs-9yqrm2w0d;5T0Td z7PaCG`j$u`Rz9^S(%!Vm(v_}gnY<-s6m#qjmZ>HnFzqvKO2s7rmJ6pP)OVis)L$3L?!+e*t zBdXV2M*PRO$o8X$H@tf7%X99xbhTI~dtkJG384NZhkW6sU&Hmox^u65$|uUz1J=$C zue|%Q&3{QToDHnA<^74~?AC?m>TS#(;)cx}zgEo1e+Z%JH zg&d^|U!l?8C0MYe^JZBT1vHSTnod_mI9j)TtbXhQ_xW_25#*NuBc4lo9APpp)ABsc zO~kw|IBH);kWAh%!WZv0Ne$D8w4G;N%Codys*2cY>7+A|E@HKS@N;D9Mp8-J-Um~T zSuaT(aMnFwQ1(oISd1nKO`U#)ok9mc6||*l!XYKvk)x|AyKDNWxX(wc^9Ws0t={^- zH5Pm_p!Ns-YE<5=%OVDy>-rl5zf9M0MB1{D|EiEqCIkOrweStdk(e7+T)rKRkTjo? zr&Yv-n7 zrE&`I8Q**juvlW*8WWV3HpvM44VbnHaq(6dh)93>4zYZRrUR|msTY^= zXhv*(ef>`S?yxYp*d<92L}eE3s&J|hZ=Sqq1)hr+U$9d^(ic=DYdkoypTY4K7$w+d zbOrkc)ND@2CE|eawxl(dv>dmIW}g~|kGB10q_<#v?kHZsb^$(l(=PQTZLn`r+cNh; zi>n&n=bR5c3LBM#<6_OYRzk#_LpvFVO+4GZsz~7lc$~ryexrA}+c?&9PM^g^>PGQ= zkjy2Ui!P^|mjK%M-6CLoZ+H$oIo<7y2&X`nWR=xtUhuapPW^vmy=7RGYv1-wcMKq% zN+Z$;(g+etC@KOD-5}jDbP56j3P_3wf>P4mAl=;{4BZUPyvMBjey`_R&+}z%t`BRi zZJl$T$MKJS|Lut~R`#Fi?W>JfN~x0hyv3+Xq){>ttjTT^3U)F-xab)U(Tr%}U`exw zrp$%e{yK)RLv=oAPya)pMtxK(o5!h57pZnQ*EF|Rs|ea*dMCQl6p_HCgv@I*ugzzM zHuuDHF{naLK$y$oKzG?h4QI#&+DAHLA8`tqMz|zmF!f@<&!SUUK{jT2j$u)DADR)X zdo9K4bW2-w_+_#_SBi1vvJDHpNImsD=HXF_sjdJ;$cuoRcU_VZGA%^S7i~F#<1=#1 zH$BDIJ$)X~RLj3tDpr5s!=JA+1f?8(>*1w7#ykN6_fS8cZ&qJ`!%WUzPTfFXJ7+!% zBlUL(5I3mgWnPw!g5i*!vpm&M1B1ps-S1slziZDrYJlF1i^lF;jg=i}KZ~ibolu&$ zue}0J?LKI;MEVR+0ha7WVk>?5;V}6_qCP#UB_K302oTo3j%sQ-1KzCJaYyo=>`t4z z1_Dx&ype9pR{oQ1@=0Ul{=TyP!_j~SpEHtP7D(HWsrXWhZQlB}`vSK+6qe%7=R}$D zJYYI&kZ~s$i`>@OJM-#LC z6{L{tG@PB{JbH*J+l7WWxkHu>3$ZL3*2R)cI!o8;5p&B-F1+8>^I%A3=E5~%JC+vB zgn6AX0%3YW^ZCA~gb`gp=?U7NYLiQou>|HK@uKi!;$76zPI;fQn?Q&X)J1Ff-y!u3 zt$n|IM0B5y3Ln<-a#BuFmnxlsG*I?EyEo(B{m`X^{#j8$$~e6x)id?U`AR$bu30#M zjg(*cnE1i1u`T$FFnslEhYIf^>$F52QlA?_F$WX&R+-qS;tKjEKH`3~v$S*t+q5VtvVO)nsl7H(Fr0F>`k%D~EQ`V_x#Fp6U zpji05)0wb{UN!LPK-3@_+cJRB6!iwyy&j~&ypEN9FQ|MdzYrrO~_#WME<;Ez^Q{tZVO=|^QAJY`aoZLA?q;H#o zM%cE5Gy%&3D+NR$tQ?t1q$Bdju5)aPpQ&w;FixE6N(T5pldj3q#K-xl#w<~iLI~2? zC=>e2l-|v_jK|wKOVm26ChW(8HOB15An5cH9!kA#((DXM7GU;%NU;U>n1)9VQ!K-> zQOJ)PL*=JXg1a#ase?)wGQbhmeKk^6RT*tP0mzSt2THyzj?z+IaW(>a9O$eqS$+!m zFXg3J2Jk(eE8c|D8q2!9+Exs?1Vh;NM$6qp2qMcZHKyxum{H2J|$ur6ux0tDVw;x3IksG{2xfgyqB#u_t0y*k>R)EMh8q0O%+)Cb z(6-EVAL7a`nXc0>9!7%h<-$Py7^V@r@q;qQDs*77Qnrr6B-IUe5JPgXfpd?s_7#6? z5t%ABdTvlhM~6)1ywQ*sZHP?I-7#AY$FQMNDMQ#-#!if8wYYuxXlzW3m*}z#fQ)7M zZID)uVvZZY2!vb$l#QndkK`?>?^dwbxEwUp89R0?#ibZUH$Mjq$$tlLtdIu{eaK$| zsm@jLc)BIGsJ`Hrc*gWL4WYmtmLk^Aq!i@7tuqDP_&*OPsv5^9GH-S)E!#baAlsr; zA>77)Y|QUWD4dY4;Y`>PvGm_1XZ)wr7{OAJYK9)Xnk~^=QSd!;?Wddzk0*c82!7-C zwMg5E+%k*)@!qjinciBPM*XJ`SOObUNTKyr#|0#FUf$9P19_+QjTx4gp4XDz*XM_* zSslmNH{mz^DeXb-#Cdk#UcQm`*|G?-;Q4{nKFxp{S!3Jtmh30{GFwPrm-F0`%&ZF87oz``|k=kICv`8*>ftByN!fWrewBss-LkLl<0?# z1=SjHv9z{k6y7ck`Pc;0;%zmj{B9!2ouKwAiBU9P@-7`D(ur{iSF0=DXC;%j{#SOA z6F&Y|rZ%~UlzkLMs&q@@eb`QW0x1EnFhjxxDbObMe-dE`|8=O{%%yBS_g2F`^l|MG zjh3$q4-U*E(uB->Bhx z_hEH#hQIkR!4W^{#!S&R?2*D{kQ5n(U>7kSAux%5L@^-9I_KC%4Ab8ccQrdPs|2v; z@wDAz5G~PlvOog+k^=+d4I<);#Wpjr?cA{pDoCmd@z0ENIAh6YVWyvv{Dip@H3Ubk z@#|_>IJwIa(@!i;k+hwU@pUwnNRqju1f=fH57CitVwn=J$m6h+&7hM?9W=kE!BfMo z=G!QTJ_|yR%VZxQR1R+n`K;GmIa#z+-wpgjebvt=cm3);ZH$)$jF)jK3>}M46!oF7 z)A0lWa>dNC7D|A+D3n0!_mztdQ?_0TvK~lwmhlTlXR;;*%-w$%v=Wa+27)A;s4bLk zq>>9W6G*~v0+Q1QMSmMLyQ#9Gj{Zg)XEeKe_;;Dx)cg^JPwz zW|@%)nZA1@5k<65+@oIvw~C?&~&^1|N}+Kt5E*u~_5+ z6oOCO0&70uK{5B8MS}$s9$dgb^=? zYD)MeRiG7-|8T?P$cE$3#5HofeujW==3vzd^^a^ca~wyPXfbMDG9U7G4y>`*LffC0 z{wDOVnWIyrd`|9PdAzlMT3#aUs3tgr8g|5t;u`7l+4PRGm9mcVl2SAt*)CpL3~Mgdr9g(@9tA$3uU~;V zSJ(j)8fN5EP_4F`6I0Zsur1VurBV>JzA_5K7+D8U>qge^OCYagw1AQSb)g429LPRC zQ|#_as42o1Q^CxkY7B$p=dt-i$}D+VFl%$)1@rfqS2wL#o|A=dgTbBmTLvT?H`IZJ zZ`LP;AD14sb()=-UQ6=$SZ_@Qrs_N#rh!J$*BqYLgCYFIb>gVE*-_xL7UXL6c*Rj! z;_m*SApWC{EPCHbfNs@kecrs%jh#$V`-8Z}d+3F`zQjk8?>j9kE7=vp>e#TGz-$2P z<`0jP1R}dIl8>|s7<=&&Tr_xyHax;~f=NSv*dZMq`y9_9V=9r{+=F(Du|Vs5TsL)` zuAs?-l6V3(>hsN5F$J#Y6!VJ>ym%f6_$ zu@v47gREl}3A;<}c6VWhVP}Y)$xdFN@JEAW+&Bzk6Sz%B_nWl-sSk>}Jd8Ea7Hl(0 z@#mso(A3by(b1-IpPlrB>*Gs1aSkD9tY1<-pvUoP4!zkPakY+L4-~@5V2IVAul@Du zF)AFQe5(dVgL$uX2`uB?)ugM`%axHJZR3}8MZk8c-K52cL~hXTY}MJXlqn4xzXm3p z;0bL+QqIe+rtOb^{Fj;o-G6BoIH=-I1KlJ{j8Y_BvH+{y>=v{WMag4KbTDX{^wO^y zz~6ro{53o)U6j{HAY72OMas0LBtroV4$VrkGZc1dfb?<256Gs5oIV=?W;D2Aj1iW!esZ;-kGA{I zrmx)vv)yNeO6F>Mu*ljGRUY$s?A0F+WP&imp|;GcIXDwvF9*h3DSak8PatLHrf6v( z3bM6B#i2H8%*#;bf>?K6R;wpD7fj%tB)AXfFlE|Z@4()H#m&SIlNF>?+T5$AGJycSbu zE8fvr!m>PHK~*)<_w(R{181>T(pN%i#izVW^1J8ncz_G!@^59yHtSMZX9bNQWN)EF zgOpQQ@#&KbjHfI_GZdwFvG~A3RA|tLVHcP|Cq4p zVm;OJ?HI1Q6X#<1^{1``lVM2B4?_wVs0c3!SrEQ+(doh(ocs*Ar_+K4r z0)pyqTdUtFHikzRPjbc99!Ap<1Pxu)P1oYy^t5T^2Or}T&kq?j!@C{Bi_7T0GV2aP zt*iw85T6L)DLy#4bwpr*72vyIPRc|9%I4-*Mw4y%@^B^E5P3-n1CsBMt!Kh5NbqHR z%MF$G)Q4Mgfi$5qP}o%t3X1n!ki28m#)V+^7J-g_AJxCmVl`%_J#q;n$7|phH&l@* z*;cZVXPoNjWg(jVe`MJZ6Jm~pHLv3iH$%-R;K9C=dHq4V7jVD7a)N(dvN%)Lnf8tN zQ&y~8OhcD`QG_vQWQ8}e*L(%=lKXG4S z8wvUQHUVw=(8jkQIk9R7TIl^EX&VC?M6g}8!2n!Uh$1RAQ}B`Hp@5ZhHy*y<8CtO9h(*qwsHvstG^ldt+7kzFNgcFzYYF}V*1Y;0aY^qK>$f- z4f`-eodfEwsA+bU5N)7Tkk>E!S!{dX7BCCU$>yNV9&7`%wbd=nFSmvrI8m8kDZ`CF zmFBcawi-CVA<{!}D#=k~%B3PQ?*U-q@iJ$xi-Fbz1BnX1V4&E@dwpf_Vua!%XRg-nzcMU{Kr-=$n5e(5csvUnVir>8OoKwH$%+i9h%=fsQ*zLay55%xUrbjVX_*m4!EL> zzLRY=GO!xY#!4Nj#HO%(7ESgF@XE!Q0i#)vE-T#ns#*97tyKP1(j2ursT%e$t^xVi zL=l>69V#2=khi%}<)H0-vV8{j*Pj&spCcy1ZDr=?_YUezLY!x(`ci8}BE60`dQ4SV6U9#Ad!o=+kG8_r z<7DJ2eRg7;*VCdJSf}cfnwW>3{2i}Z~+Y!@7 za>`8;#}7WEKF@|ptQLBIU@DUb6tQ*hvR-AkY$1bQZp_mhL^ z#l$hH3Eh^i`vvr-JjvOI_S3&R5OyHQ$CK_h+M*Fi3*w99FG6C#Ok5h=jEC`f6Bz}t z1T6?0_=oKyF^ay6)sxH30yXt~G4ir_l$wgaIfg5E2`Bh#Dho)t^_b=dF1Kd3eYI2a zFJu8eq=+?o_p-Ci)-{1>$K?DoNS88xh%2;iA(&KVitIFQpvsmB=o_(uX}`4=>DTQn z&r3o0ZPy=>Fw4B#231xP*x6Mg##_dOvqs=Wjad^MP@Z>VfuS{7{(wt60~<_xGz!u& zevH1T*T4-<8W%|u?AZ1h>zH|RL;62gGU_J!|NmtB^7M6T{Vqj|U62?dK91U@jMvfM za+`8>2c@d-cOIuP)$+l^12isS-)GCM6JX(S%z92%aI0?A+0SlVTV^|isNvQ09!wZj z<)aa$;pO97$MV-AcyGI^Ki+Lh?w85AuKXw@aNT}Aux_vRr|Eo+&fr4{e;T4Nwzg&g zPovObmP;Fj>AnrgF6%~es{!I__Jew*JP1M)Y&tJq?4+R z5P+5>sg1Es&RqfBJ}AG-`ObH$|2%^K|6#PxWEE=Jprj56+M9~4>dFr?+rSz%y^yf( zQXBB8s*4B`_i*s9bEB-+k=ah=@ncWUQzpg~XS~G65y901U||pN3o{<0<-1D8piS;vTDEKWcLYFB2 zIFNrj&1lk%Q!$BwY+BTqwD$DBv zWdVE+^XCKTFVP3cp&UdJ5(2+o{zxI?T-Jyj3%Zyk#*Dt2`wiYp@CL^vlYb%wmo z7)fel=Z=%n9nM@8D0cLJy%gYyOyJmkBF6@)e%#VbYNH)S0T$bl$6pm@bDTKh$~^U? zB}yJxwPNbem9HkJX%O5Fe^Z|Q0Mz0ml^}EW9sJeq>`VYirx6J`4$8OTq^=ttM7N0=DNyQJ_eD*m&jyX;ng&;k+NgNc{-x`tV-_|qYh(Ns1Fpj?( z#aX0SR$W~o9$JLH3xArYRt6EIL%C$_(Og9P@)4waq}+Z^Jmm^iRFzVSiM( zSne9-$|&ys7?^a|*q!1_B~ZEVXe#ge{*g>X+>dQaen=ADdQh#sorL?2P7|-dnJ3&u;#E+p9>}O zgS#NhuFspU+K$Awj^~iK`wzf-)h;F>_?3QsoYOs3>8)(4#oLN$?k*6ahIObqZ@^Q; z-Gy~ja1quB1jLpHZ-Z{S6F7H|foQNf#I=r-`&y^PhL~sLmD2!)o%IWn|Bnf^X8oOJMENV59=OEC;6+qjq z;bAQSGmLMbP8~UX?!0-=;ccX;D;i%(BL4fMi^%IlN}N<2?fC#%DQs&{si|pooS$dE z_V{xi?}@37xZhE?Te{|3zK1mI8Ijur;FC2hPLuSo2T`#qHi7tU_5#T%CozClK0&em zp#Z)v0)jphbzTyDO^#Vm|EckAHfQe5{8Xdz%TB03mi5BxOr_LH#T(!i(R<4k9uU_5 z*Ikp3r8Fy6_2l%?y~3=-Kq^hW!0nA27C>4*)&l4&qf1|3Y6LGAs`*jMi5N@l9TKHQ?cuuSpvIhDrc+!%6YF zX3AU4qK4yBW^UvsThxKK@*53?0LOhYK8G<6UV3WeVg^TSe%2?srSbxJy!LY_e0R(J z3gum3*CK!_I&@=z9HY{Xl#Bcz)!oL23i1pJAZL#VM?qa&WUqEFAwNrCT88St%>NnE zQe6vO&#iF+@ElVg-5clMFg-$M&B$%Ho_N`BhO3?Ix9^XwogQSh5W6_b#dwP^+BkTM zcrPVJz$(!g$;e1v+z(pi4qQ5A-|=glR}NS3qopALg1^`G_8mGtZ-8T?THP`IFHm6$ zL~I$EaJ!Xy(<_=Oswr)ShoutGRKKi@TsYt&dG_E(@D2AZ*Zu!K%QLYI79_ty?Ahbm4k7O@MGcG<>Fc}h+|P;=&+Wqskrdap8AF+HKTX5QCBrwqbWry6A2LoG^6;FS!7o^|55j}=2&x31w#zhO) z6f~4}j&VA2Z#`9aeg;QK&>^%0C>@Czcu(oX-`3tqF%A}4lqJIX)y4+gU7O?_nE$#l zsY%vILDPH#p6QEYv@1Yq5FozZH1w@tko2moKXK51YjDN5IM&!!4w($&hppu>Ho1*{ zT4O(*I+eo@UA#atmDmy&XD(kYUd#m!yZ>_E<(E2oJ$pNlB;!AShC=+~@bUy!Et9&=R(+`NM(=Vl{utFewFE zvE~LXhxpGjQ=Ioc6%H^*tKM4#6=-n^Q4deT;p(|>?6P1K!=3e@cS1CejC0GI>j#a) zmQ0KVRAM53oDPu_G)uPctuZR~DZpc*?T2u#(t7Ten`$)>NGAWmH!$McT;gX4mUk*$ ze98qv96BUYgz$hxBG*7EZ88DcoRlcPgoShe1uYF>HZKMlP2!X0(^fQ^N@`!nGXwa) zjGFB)mq;5+(m3R%g9%mH($RpC;RG6U-S+sY z0n%;V-~vRr0B9=t>%Ud(>>XtUF5tp38rMf5N(KOdGH23-fueKxx5A>imRCR{gEhjJ z^oOxRB4h;3ovSV~&M3g+Xa z7Pu=LvnFfL^GCwF&VPJ`Gtv1V5?RC0dXScKJaX3Y0iV4dv+z!9vzh>F>lI>1PN3en zJF`u$`N_8v`J(-}xqr;EwNq#Bx=tM}i1t?je5iZ_&wz-KFAmKGorJ8i%3*O~ykqaJ zVeJ#`_A;MGSXb9T^Q=YHvZs$r3KNNJ1R_dNv8Qz6>pI-M!6G=k!4;YnQY&6u9|Gz^ zTVDP5iSqatII>lMFQ&?WG&D`m?>gyrNDUkBtm&5D(2o5MCAYM`fs!dysud`{zIp$MCKCD=;8mIRloOFY7SGjxI$%=zmPtF*u?v)vsr4 zlhl2!ngQ>&d^^t7@#b_g;oaiv!l`m+5wnqf-Jzt_jG{-WUI3OL*BWR$EhH(9+y2DoT)L_MQk)AII@Qshg$R{?P6(;)07~*f_ zw3GEHGhCEf$w^o~N;L}=PFpp28pw%S-t|eV@MW>ubh&bOG^f$L8*&08bzM!p$NOaD zh*q2~*S$N|V@cA|&VM6lae&23{t@;>G9e9bqC!bB5l&W@`I7ji6h`p2W;PLq=%XIz z4>1F_?gB%_Emt2M3!$e^W32=$Ms8%04)q&*==i##kYeE$Dr!iUbAz!UO(a!G^sZy! zc5zc9Dn4lQr*^bEv=M~JrG`a!FP$H*I@x{O>ibm-cu|``;AEd0So`opt<8k?5eur_ zoc8N4Ret-?otYgn2Mvg^r$7vkwy89S_(fxxSBA)UB4Tr>qKEsh8ri87@v$TeijLh= zT#n15=ZE^RK0*WXS(tvvY`8k6lQT9G(ix1tBqU0s+nd!7z@-i0 z4Trmgz%Cwfn>GhD>wtfZmPddx`PmvUpLV7V!S}gf&!rw>3Q&%r+uTH^u;ft+R3FQA zz4+GtKlG#jy)&u>ey1#*cXL`cmWc!_7^do)AY@IXP}!=?8AQ9GbIUbY&D=bvhx0&Bri}%GxR~sVc{K}P$uA< z*>n*Pl$~6+G-lih{w>Ab2!tr!2(TQZrCiC_EUkTOUt^x@j24E0M|^`yHrmg{;K54H zZzjfZ*F5n;)Mz+-$M5m&j3->*MD`kL-}u;@$j3Z%q;Bi$unFdPv1Rl(m#kR8Rkhp) zCBa?)6_JQBAqMXK5O1;<_glA>lfMQC;ei;d?Tv#=ug(JqW<+_=rSp#$^130aHnHD{ z8DxBK!v*V%r$tY?M~?3VG_^U zT^bH@MFJFg^bi`NI{Vf5+q}0P`c-nj-5La~feI!GY;YN`o_`iy@B?lK8loPs(h;E4 ziS&{DQ{fbi?Q0e!q30ady_2DXre4(u7|;TAuCMbduX5Tk-U5=Bk-a&Z7QW6KSX%d4 z13iJtvl2_7S|O?0-kq;!aG>{w|;vVN@H9RH~vg&Ot=>8bdN1j8U&x+zZtdQ43-gGka#lNM&=A#;+? zUQOOVsVTrKb04gs75=jaL*0eF#O}C|dNK04)t8+k2)`-`mkmMYugxP0m_Gc#;v&;$0ck?Kp8?^A- z+PXR(L?Sj;UvezJd615~%j|m~KSC(MvF4ISPxMZb2k%@0LFs`*ROgV4kQHGnFGmK} z7+v(%&gb^!rJS>8id4Vw6)SV#RlQ42=sW+N3y0N478sp~)Noy&*UI2y=TM(4l)Ce- zL3%EzM+er}86{jn!f++2i#%=d{b2wK{51Ofg+u*q=c!?CdzR2*4l!3Ohr4SZ$(ys@oUN+|4 z2^vk%4lsyzSJMmRzXA2T&P=Gs&Qwc?t1xwd?FfjPb;kQ@oY1JL*MgFtS7*`^#OF7= zzME_pB-3%0A0K{`$eDHLaZ09yQJ0UNyf9Ps=gfqQH_#;0&H{Qf4(m?8%zkWET=@Pv zEQ5YgPCXp$C3+_C`hTd>BlAK}qy5F~z43M6B_W+XUqm~GFOyTbg_wt*IMI+(xxkMev&8UF}k)w;78i&i(c1nmM z4mp7U1&XdxwTtqyuTf;4hkU0jxjBsWpCiJNJz|yBlDXN`r2gLn`k%JE8tOTj?mrlh zyEK1xt6Fo@g?w29uewEYlrLWS_-o%@G+jB|?_sM)NV=ywElqWoX$LJ4`X9cY9lY$? zK2!*PoJ`bsK&`x^*S0PF+TgOvJ#pW+`}fd+|Ac$Uqk!$vFlMBOfAyYi$3^cZF|te= zvoq?MaXjij%_l1J(T5{{A%XBqX+T9PVQp{N;$9`divN#xW}9kiPFLxmZ_6AZIN- zPN!r}o$-)10nAK3N#K3c%ynDD*p^VC-pXQ64;Wm}FwROcr@+X^nRk^)zcS(DFlKAU zK1PKz0Tst!WaJXyszuphZdWzk?4po2rWb#dWlVB0$cd+rzmpn%)t`6pKMe1?Z+Ox3 zukFwv)manLryt_Dn0Gq|j4?Z~soKLHZEdu#=`M}_i~FBIpN0NbDDjQwEd8wp#ouYA zA5HM8Mx)-@h4cP3OqZuzP%h@%$T!KfEB>%G+e)U&i@g1F|6jc{2Vxmj)*Tl=KcUo0 zper**_yb+3k9oS~PU^#5b4V_j5kz7Ivy&651(ILeYm4Pqq z7)01Plv(U=VACR|C+k8g_;~tXy7$eefz*Drx3v|+9P%_#zWIlobx2FjWeip@n4@rM z5qfj1lqqTYgA}eEC=s?BJ*xsUN3a<$m$~*}EL)I!tkBO{%bO;~Bw`%l?_@o`wXSXU z?JdtI#3wa6bV~e@w|pu1j+!S1$gi}78v(xh`#)&&u+leA*?T};BOylp_b-}(wtGOI zFI<$b7R(IYXb3@;u?cT2YI2Go7o-J3e~I5D49{4NfJF7>!k8(U^Bgng0$rgUB)~EW ztD}~GYtA?cxM8Hx%!4`Bt55j7UjU5N1=X|fAcToaKL~#VCE1kCd<^Bf)_?0C@f%QR z|EFy^_r`F#UC_KqVJD4K3SdD7ZHs-H^t%$%eH8FjZtyUf;1+zy=3Ot{mns$;>%a%z zXx&kvDqCG_kZS7-f0k*uaNFs?WQRF5)? zi=K~F)Df%i^Mt&0s$q7(T(fy@pBfjpGS%#?Rpq_BY_+Gmq+382;3T@T{xVQH^9H9rA)#YS7e-3PMK0mn8?55i9VBPy_lWlL{t*P4+b z0k{T5gVD)o7-E;m-MAup(I$wVB33=~F(0Jyr=OX-^m#hBlxblsYu^6VoVWw;Y7T&K zVBNCZG&G%^^?Y9u^FJ2rZ8%$a>$eG5Os`v{pGwv*6FYEuEW$i4K;G&z3cdX%GKIRDIuTUNSXt!wbYiVB7|I;Ehew2&L6KM@)KqB_9EZ$D64D5S< zd|(?GCtFPH(Rlg9Wl(qfGKW;LJ3Mbz>7P<1ebe>*)S$&^k#tQ!I(%zH->HK#cUQac zVT|CYTn;5_w^Hez&;rmA1;l4+62*Flu&XK0;zWF9ZcCMJ|h z)FXb8?G$cKs9+AMF{%SP4K)RZw}u*UKEfy$ym|(VFhKSi`j|uM*$|mg4r+Y^kiW-o zoD3bxz)ivW^+B^aPzrPkP7WPgNk*tnPW}R;WE%G6o1Dvx->#z6HLp( z77t@Q67w*+$!TP(5tFQjvAdRO4dA-vPkQfl#+n|yFLT~P`hPLuBH;Iu33(_c4PAEp z_h)`tS7qox1dQhpV7>CJq`20>YDEw|6aVkaa#Ie>ve;17t=DfV2S2`#UEirKQ@4-J z394pBMrz@$`I-d6rphce_qQkHh{!fpzvz7ZdvKOD zI+v_GteA));&zK;S?W($m!+ZdO!G#%^d}Yz#H{tQIL(-I@?D@L*C?$*g5VCt?3U=m z04vWT+DPmgX^`{um8Gb=_p5z}nUHlDIuZJ`vIMePD|>y6ux5SmVH;&Y=eD4$YrF)n1D+pbyd-7VT+a65*@x$yj31CS<>9hV1cYJz?Dim9qAe4-jf zK!SO>o))1=s`J@K?MA!Xru1eb>M5sY8JwDrhN|9gh6XIf;(+3SfDTl1*+h@;76!Pe z{3V@21v3o(li;`CC;Vo$Jg)VVm&AKZ;sph?G5f!9JMvIjU{zD)kXmU5p z9q~Q}@f)unpPXNyv5N+>M+TOqfJUYG+=#2hMSuzrXi9%RYpKw}eFJwByHvT)RhB;Q zqb2V{mJAWNBk*H;B%!>dy!=)BC0-jEPLLn~5u)Ff!-EY+8HkuFMZnJHTwrF^*Lv?z!M&o*(?9Hb3 zh;hR~TKPvUjAoa^6nA2j_iFcQ&i;}$;fggw_>w0p{X*hh856_rCk$ZaXy zLK-0xHi+${zehRvsSAHM_Bee1p)7r7jdsM|yRP$|=X)m7yBHaF7n4MHSDB9Ys8@v$ z#QT}W^!qGDfVOy6B>r$g^F$%7?Th7qb+Uteix(sCBydHKqfV+7dVKz1w8ZTF0(V=9 z2b^8Km4of9!1A<&6O%s2Y{{ivJ^NCMAf8rq&O4QxA8U4n4gG6H|#^kLIVgbv(m052JM_vAiA&U~~}H<1^jE`L~a+*auoSk4^W z0z3tR4( zELij!7g5efsOVJfl4}S!4kj?8%Ph9XeTbOf=mF=E&HZQF>1)ibJE+@yrh+@u@oQNr z*>^HsL1`llmKW%&n8GbCR};nj`5NhEsISQ813f6LX`!++h)7M} z)`dg*#d9TFNe=W*_A|^q<{{>YORqG?^iubZQdA(}?$nP81;f!!uQQjVS*Wf*dx521}>XJ1gJxDdqWN( z-7dNz3luwf8?6C2f4$A9TfIkmSph_h(fWdhQ0u+SWcue%*)Ud4>Q@iaA`!wS{)w_Q zKv+*so=p^#M_F#ln%{hSdHpLll$3{Nkfb04E9&&ZQkTlmew zFdU$gxC-c`415Gw$cT5%Mi6tz4@NSuX_ZL4$)N(-9~%dd@q*_T?2v5T9I7RpuNm0Y zrtOWK6)fb;Di5Y=-E0jf5$Sarmo!ptEV|Of11L}N?u@3?Ar?;XN+kCBj>>mZ3I5RL zM}>Wu8YvPbs(f4^#npwCw_QA)=Awk>4k#Cw_l zd(-95rr&n$K3JQOLg79Y<&c3hI`USRldj#WMVU)qJUCtt1L0i4IhCT>rMngHk~j19 z60YS43!40w?L|-n7B)bmwpq`FVe3Dd3$C4 zPZa0>S&+1sg>4rm0JhSpOsOQ{Wnd&+ji~sGJ;f3TDssl_#eJ~-m!c2g1VfY;zcU0e z8dhxZv6Coj$xAZ7M9)%Xy-Zqr6$r!;Uw@JoRd5K>HWdldCnjnDOFSwH7bmQCF(Y#e zedAcQnDm=`T2e4pPuebR*<%Em+R*@jF#eU}F1(|VNf)n0tq=?o=&2aZwO76+`^8Wn?72!VZjK=YjT&D{@G=U6Cg|z}Dbjua>q@lGQKFEZLzO|<=^^YVJ9B+a3UPn!>>&+V;vmS{3Q zxO8?ZN6V{GY~Q^^O%9&X+Vbz-TgJ$~qd;}UkCV)@lzE-t|9hoQMJ2YlKezn<{A$(7o|_leIh4=inba#sQ079QpG+_QQUrS=I`fd5p$JIXQ0jdPj*xI| zhVGe!?i>%snj9BNj^7G^*a*SCXhYw5I1k!umwh1A z&X)b+V|DmZbXLW)X z#_?Gt)#&=b5@C`I6*|6@CL$_-B-=aX66(d8B=koBXEX2gi3%b^sMOYZ zH|hq?b6Y=f<&ybK&aAVKrTMsB^#3|>GuS0GqcX|5VXa~mtrz0?UkX#OxXd-Vu{bJ) zouo!Kf8xB`#A3HzWutoa!K|ltOLr8=car(~%ua{8V!?*IZsFaTg|kn_&VZR`CKmIg z-Q;3}kB6oZ81ziVupw2re$48ISM5Tv(Ha_f>G4t0Z*p9vn}v8HEv{xRU1Tf)cB6kM z;Zj(zQ0}{8@jv_zse%PY$%(Ke;qw<~fj6!}bv)U3m|$GeN*DlP@&9yr8Q7r_l5Zq8`v&)kW??kX$rDM7jMzpaG_qJHfNouvx54~K zjPspzY^8{1Hg+^LP`x2`B{(55)GbF5dgrn0hx6M!g@~Tx_DRe5WO>H2y3D7vAyH2f z(X$4mF?jDu4&NrC>yR=46*6IWpLW-CFtk?j!&~-~E;B1&-Jox` z?YuWwz2H}?^NZ7%b%a7&I3KE_)n#*|C_AL-)DUG?{s+3{O7_1KmjC^rA}rqn8m-p_ zX6mQdTfL-B$~RClbBMN8>qn{m{3FI(43WjrJk9VQ_NwT*b?h}P8~_14vnf02V&?E;b2=%n& zg=loHoFQ`A);Fw|{=$^e7g$u`Z+b{VzET)3y-IcxA96$%Emk>XrZaVdjbjdF;u;+( zf|0b(-TAc+=j*`2W0LaKHlu$c`GC2Iqk(1XO<(f8d-+))eE|riw8&d3Bfp7*O)U(_ zrYk)+`=wrVw5w9e^h4$7!P-S{@)3F4md%*F1v8DWJrAA&i291t9-0Xg4!f!@4QR2S zJSHa@6c?Oj{^(7E^!p0AiOpZq;-o?wgxr(4C#8yB&T64A`?4=;8@`atr~~OwNr~YO za4-4{g_N~*VeLe;Dtjuwv*5U@x4N~Avg$?6Jw=I0>+eUi?EAtcGZ9lhJc_l=-sBG^ zSdWCMCa(CZIVWpDLd~SxwXiW?7IArsZS1N1+{^WU%U2#l_l$UwHS%&_=Lz9Gthwsu z%v2oJe;UYXGO(v?hY21t!2#X#`)gJT!Pbl#wkvNpw%CH_YCH4L$~_(USdf+WLgy=p zC?BA^&Upo;uw-zCJd^?Pf<9m_n<$WM!lg1e?=V&JHR=n4uZ82Mk3!^5*W+&t=U20g zue3hN<3aLLmYK`0GYKNvBUZ-D{VSIqS+yz4UcQJjizUalYZVIWE>hgaIiGTi-!Dr0F1?T({o4ZrC$QfAX?+wHR z(b&1T3EF6&A`3|&0RHegKB#Z$_G{^xy*2K$#Hu~;vRX_k@`KF|=Q>#LY2mrQ)8LKR z7N^0l1=!%Pk(SwP7?H?id@Y-nXsZ6dw^L%g;c>CO%jm&3?nRtuRfFHtGSf1pu_$Cq zqWEzKf*Je;Trl^`CzAK-`|lbUB;)JdQSg>?d6o11C*#__(96;`g^CX+V!S*P&e?KL zL2`9oj^?3rrn6e2H_g$jS=kAy%g@`ts$SvjhaQR`46Ke(J<1efXoIX9tIgw%zlP_; z^06bS8o~CXhg#G}H{ur3ra|y!&kW8*(hcFy#+xX0=KqXm{+ZE4^nL`wg@<1BH=-P_ zWgPO2d>?sYm2B5Gfm6yTQwM z4M>UGWqM7zcdtd}>D|PSs#~fQVz6n>l`2!#L*{hpa`y<;8+PmE(<>DLE4|x;e?b5=e&$l{@lLis{%v!K`{#JLEjRDUNA5{mVV@j zbZB@g8-fheg$av@{3*_=iNl@l_!1+QyPnV~ce#_h2=`nCFW$NH;Elj>7C!$SI{(kt z+o)VinKc7~6yqqYlaDXzTa;Ds2F=+YFvAbP#2_PVgya^G9Hj zJ%xSOq8qxD{iLq!HXbP7XGyA@Ja-n7Fif!xW)ek}h@}i>>DIcbgF<9wu|Va?H8<=T zB5dp2z?#l~%E9z>CPw}KiqVIQ9et0(GKB3Md!=jo*}(M0PVd!TIYQ2~X)k3J|L|a6EREgY_l9CEfKy5XiL{9r+j;xrM<<9Td_x#rKBR3SP?XnU!dr)J& z9OX5f*^k?sFr!X9?mY78r7%EHe>K=`;AV?1-5M9^{{7|N%km8eyWf)TL5seNiI$ZO z!?;02CvS8bzC7Vkz1(QJL|-KlU4&J>62=ntL@(>+No((4c}#j*U*Vn=P-MEN<iHP;shx{0 z|0~ueuoI_pm;0uss4!B_UpWIrJKs2;%KEdI^UQefW6nM0tRV)db~YF%)$UeHgIxnN zD)2@?*P7M5!M#UfqOsTnZ}@9s^@=Telia{`u+Z__Vg!;pAHjq&-mhqUl}AVQ?t49X@MlWWpRCy3-$k zylhX~s^1D#$dv#GIeS*RwRi;{vIAM5TH~nB6VL3wGG@ z6u8h&Ao}=u=33`rYt94BL+8hZ_F+juua<&M{VFlUEP(8sU(M#WLZF zsESi;hJm@PUinKk_BK_wEK;bd^jc3&tS-*0_K!Es(F1cA;eE*o{gE{Rwp=yN8+mzo zj{SK{C4LvDwTHIC4jPbT)N5~Af(B`um1p*kUI@e<+1_rFle==%Ram(rbVFGeJC2Gd zWf-sN5sI7MrW>Ib@*lx=c^eP+a`7p zTt;t2B@=`&UeuS_0|4Vogxk0^__HM2?qRO3v|(}_c9HL2)MH~(k9Bian=S|`?N+>w zPP(iZZtt2MmLr{C%B)YG@86(=ty>e>$%<>Z4a!bTH$&BO?WD>Y1gW(BCwuYulz+$S zZ2$8u(ck*F_|N}yy*&=(TXdJD>#YzPU~-1%?(252I4kg)!qWDpzytX8hMt0Ip*z6A8Mpl3In1#k4!`E5C`*S)_>tB=scJT;+9rze$0vPn{V z<>B-879sn;hJxv#2|2vuT4H$6J)6`l57m^R#@ZoIAaQt2d7_PXN}Pl9Rt3i8;Bl)y zOPf5s@=Fp;ZmQSa3f@O07a-`QSacr#_cLvroYnQh0<$IX!>AiE4U*bid`wDThjm(M zoV@3K-<$*|0sJ>iggvUSPt!-@G4X0W0#M>tKtrZ>O^V=8p8=%UiVg0m|In%b^Y|jM z7p;FT7spX;qpnlsPex)F!6Xj@Bjp({*1CNp>?cN_5Q;c>>MW2Jo55_kQLb6Oh?D!pP`+Wl>pk-G zq6ThYlkHL@p!SK;?XwIP>h?e?S%VZ*?|-)-(7>-&_V|4AzGFTxBtF^HZK&=(?rR#! zw|Z*q+mlvfrEl`q%gh~0=M~U#sQlcI>CLiB*y~&&dC~#7ABP~i*!aN%65!agV9~a$ zzXE=V4UXVy(|?3-A3ev1QZ0Cy6hqG_`qVQJX6Ld0UP2Q(<~!`P(>2`*KdgFVyUb{i z{8%WJp9CLwBmu|gd6O-|V>WCq|8L}rLL-R|`e@f#T3z`|<6}NUhY=qMR1C?vtie4N z5U1EJY#phR$69`AvE}qA0ejjO!(L9?&6NrE|0ZY*Z4b z`d8>l^5BsU+i0U(T+3HYd2lr#%9+TAq$N3(%5IiWA_Cd!3yEjx-~|2c-z98705w4t3UJh^JKyaYlM`Q*IgM#-x6;1ix8`IVp!b8hL9wE78sH>8<>)m?yj=1XI}))YNu5kH`B1c05D!R#lJ z(Yw&QDCu!9!wH2apmk3eIA}&iRPXXEQ07RF%>+|x(l02;`u2f0G5sHDb|>+Fv9lfd zoVz&V>+h@~tKRsYRGvE~yS}h+j4C^n>`Ph~w<#;j=EIS!$ffI{W%e;T#E7o!pB(+2 z1J#ei%1$QB!S}eTHBSu{ErLOccQIZgvA!c7FR6Anl)xu+>ZQV8yw{C)A}k{_X*X40 z6NWxm6C9A`IB{=Wa}Dyne-lUYEKoLT3Ya; z^|X_z4zyW>!>{9FVj_D*GXgV0Dk@nDT5&JIC3Ti!6Z@7(&OA0h zi-;f#VFuok|7{Vb#U8)Qutvn4+`ssKmmr6rj107{y_Rkxa!5SkpL$r?VvyPe?Z_UoFae!WVbD1-3L!-N~lqG)Gh2*OSlX;$K6Z z;uZ40^cQ`jJaomoni?079c`wsXjaOVaE5Q(14WC882EzA9!m9lx)_

    V zFUH+{t-*_6zR3#iqyCC-|2taJUGuIV_?qM!+~!UbE;cDl%A>ckWiv zWm4(ze#`j7zuELz#8XZ5+RlUiXaFN6TgFM>QE%8Rc#o}5*MgfFp`T`j$gmnwMW8^! z+UyEhqy`raDcVvO;dey?M0tKVNMCwutbU6`jU2_Tx8GiJ5zvy&gwyxx45t`N8XoLy z;EJr#{$x|~$vtXGg>V=zCg7qN#(gU_i%vGHFoSYB!y-JhAcJb74!j)q+T6E~OB)qt zjoyN!#MAyO%WSW(SJE`9*xx+-^yoJlB(=D5uFg|>qA zlCD|0i(4@z48yN89UDN(vgaomP#4B5bo>eVIfK&j*@#Y+6cnL*+)+L zq%Mh$n~u|tv-)`wlsE&O>s582E2%pCkVGy2`)P-%QKdDYqv&ajY;9f{tl{Y*StVhN zKcE@NHj`Y4RY3+uXUclm{G#As&Ws>~8e|5iKZA*{h#`Y7 zec<$iNkFHNcojwT!cJzqUwEDPB`QQpMJ1sSvfIskU#5hmGs?QmMc#@^;C(mIM8K}0 z5m{kv&nWc;Mn3)TQr_;7yMOmJ|K|&qmtaICu-U%wE%0l)W`;mhLF&z^=)&;Wg#i5S zlwFbmNMAjvO21t-P9*paL~h!CI;&2mLO&BvQZAj?W!J3=oJxYCYBhV*wM*QiR8N== zg#-m(Uu;?H3+8y)gk}&hTl!i$M`q9>_WexcC=Op**wO?aqvAIua_o2T@ieCCT1_5H59o58Wy^&)3zx#z?n>5{FHlNpuE#7_(@AXXt!CIsvUC$dQkRLapSv%T`v0{-Mwuz6s(<@r^V{A_;Wbgz<1t7a zfHDz{1&nx$c;-)Dr8ApW&xFi-i8F7PmX>nfzX7qaRh$ISw|A)olUZO5O+bu=MNaE0 zGbqg(%)8_)8#Aara}(V*i6~>0{G&SCm3$6zpL4U@=K7>pn&nHOdE3s3 zqoAmix9JPuc>}a&-~z6j`~;_Esx%NGi6&&;>o6j_dtFxE_+%WO7}@JPO<@f3PO4{2h`0|2z!3`0wApzXq+`2$Ba9`81Cm zmwbgIhZFSH(xg7Jb=^jIQuUZYXnXbF^8J_q+gX+OJ=&Oe$V2A`F91Trn5xkEnPck` zh>Sh9ei0zWPPKYf05KuF$Nb&;CQ6iy>S>DEuoy1<2B{y_Oyk2w`D=g{=pW?Sz~Ze@ zX%hZ~w}eL1WLCP@L!tK0e{{cp|EjxFGC;|>yWU`0`8APX02`;oD}<7;UAt}18-ZRT zABaRiej&G}{=xlJP5-sRXtMq^vFw1u5$#WRVZkR}lcUa0+JyL0DN(*I6U8RF66!5( z7phmp{fubvV~aQ^W3vllvmXr}DWewF?}>doZK-Q>+?D-6phuvthxXd#$(|vE zIC4#Sjh98@3A%@?L3|)OUqcmw{kr98)NYsa7` z*R@!VluN*hNGrm%r5xUI=PTe$braZjn8L%q-9vq5HdKh{Fu_JdtiLSdaJiQz$^p5K z@D`4SY=WdzG=!1U0`%+*a^#hK{^#=Y&#NN}?SKp)ce@%d@`asw9-7?)pLH&MvPVo2 zub3$GS(38+S$AfFVed7BnFpQ<<`&VXFWt4@D-tPdT5Nrge2_g0VLuT5F{2Xr zDTsMIqLO<1V_#7bn@I$!f2N-ACyy54=367k)y}1zs=`!&U3AQ9LMiC zhzAj4sUi?@rAjb$;3bdIjWH#`V~ZGl&S1z^?kLZ32m;G-w8{V>fldw^Z7Lp`#SJ0N zt0xpGbdu(IsFoQh7%8mw@^?sedi&lOwLS)88Rw$p2GRfX$pjG@8-;WliSY7v7Fbj% z{T&wmYiMcN5BL8neK-;?czD7?Ap?XETr1a$jjq$$h-k5MinvisZIJ`Z?Z*m;Zh5r{ zJO{)o&vT1R?BnfO(D+f;(^;UmL}q8@UG~cOqS7u-;5HPYr$0fN>q)6eF*bXL1+-Cun2gmSqjgbxe@t7um~623y91yMJLH}aRrFw_z3u&o~0-mo#7 z9qj_}N)hlRXK6e&9!3`th`?ubFp_x=OMqtaNo~yua=as}i7+=firTNibj2*zYpmf` z>F8&SdDG_TZVCLZ@?0w$AipJNs@v^vMekg!mZStBgcN9Co_B8;W1#Ck)pyPPUHc7a zwveoW&H1@#J_8<#$QF1e&vM(P3Q+PX!Qmmeuzkn*KdzaKZl`L?s%hk_r|jtQMI%?G z7S&);XD+?klqhA$*o*|84LPS9*iuXLtplto|6Y5-Hv^XJ`R?TS1NcI<)!WqPn}W#8 ztv}|TH=OpdX8uJ`6XVK1HN;GDQCRCWG~C0ab88!ZobMM)P%H#HXoT5#Nr`_T`q`q- zI#JnUNW^j)jfVQr#6K0;)b#*PUe#ioA+Ef!@D8T~j(;7o&5wood9X6$T%oo zt1a-~_n$^44i5j=NdA3lBkD?yK%i{VA7nEh%CgrRquC~_KTp7?M>dG|0ma>8HJml1 z(G^BlCmU6dv<6KM8tytxaU)cEV*o-pK~|?M-xjE7XQ=cVnD*w)Y5=}jG<!TgKQ*zBN1%%{D2nx(W~SetJZ80 zD*{EU?m{-}$jwk?Mt=UEMx7xwqIIrPYw7+c0o}Q@bZ#riPs53n(8=&CKoJ$vZT0Ho zVnemK#ZryuDn>gg%I!0YWneM=__%C;7A$KmMp7}Q2ihnILQlh!ail2GMDFf)u_xn1 z(SJrZ2@;=4QqyPofIvQd9OOVK<#vx3uiOJ)51PmKj|1`Ms8I~Kkw@`Um5+uqlV;{`4;GumN|Np? zJTWu@Nx9bA2xh8&#&XD)49{%$LY4m3wUl~loHo`YPn|Wh)5~w%jeTvf#W)AGdD;x; zVR1tCZ?v@2mCMmgXZ0UL?OshA|Q7^noL1GG`;YgT5=IuIjH|Qh@{$>CG0KP5<9^Vw$6X@u2@s4Rq zE?{gB<%oo|@3WvLmC>MZrz3Mag7}v(>EOG>_;}j?zM1YX?p1B&sZeFd$Z&M?dhNs# z#pH+Lr?KbxUEXikN~Jiq5}#qAg8A3|nw)mzy>lQIhkc&mKs;~%G zIA$(t8$Js^dx0q3|MkvYXR0)rH8XF-J&*KZiP+ch+cTk#E?@5OmCXRnmgslB)~++t zPUl0M!K2d4?aIq=@6+de86bf?#aYeG!{1e@gdCZPti0v!7P0khFA3+HH1I(Grogr} z^D)BbwmI9K90IeHxs0tJhy-qfr8JPN`WVh|U<}TK8e2=tPYqOWaI(FWZ}4TPbh#$O z06+LxlJ=q8AdQ)vX$Z6>NqCwj(BHqEJMjLQpa$PX$Ef=iN#4=_w|(gT(mK)&P*~KD zr4#$Au-x)~aSF{74{aXAY^F6xTgUyZO7Pl z(m(lBpQWX?^G{6p(c{WN5azVn(fn2N-nW)0Wj^rUlh3hHU+FSB?u>`@5Cq^6W8EGS z-j%D?mRTfvALgT4w0`cjkKh(+rrqqw85ar;K|ve%WSjd4twpKPq=Gq!cWwV>Y?ux*5Gwpm780W7mpT+Hp_PiVbQ8U-wF+&Wd$htF1ZzxRG}7;O(2$;R#XG3D{t z*X#?8JH=L5lDr~ob~1agv2SZUC%e(%?O$=kTH7BE4D#Crs@~{&~n*H^}c_=Q)8DKh~EdLbZ*bc&NEiENELP7rC_xAgvEBs8GoG#{# zADvP^0FZ?G`Fzf9n+1Oor^SN+(Yb2h%rc!3=$4Cyf1(WFJ>X%u;CZ+w$1Hbsp`1FC zy?kWX9IHz-KtnOD@3|i)tMBA7eT8_*=w#6l2g9^sFr-Y>AI+zE%N;PA&9Ue~aO-!* zY&}z+%^!owMf(S|V|yN$ApqHezA;==000Q7uPrqP#b*p5vBl*cXS?wpN)Or$8A|S* z;{5VjF0duB_ekju{p^!UUoaD@Z@|%Mr8Tp)iH2dSouZE6pA^YbJa5RgEvxu{pTWO} zEd?PnhP;O@7;#$soS2wUx~_qp%zZ|2pYNZ6%~tlZ%q8}%VqgSt5|wI2oA8Tv*$cVv_M%_tr`;zDv^=_519!U?**u| zS&q-x?;kw}`-arkOFuA>SWvm6K?+y58&UP~x7Q;Iu&pKvnKloibc`|GQK1U#J(skj ztaR&H`7{*5fMldvnM)dFlq3S#;qVFq_f%r6v&OT%>9v*e6FY}>a;O9HX21h!6w&L$ zPW{e+(|{`Ld43qvqbGlb?(e4_Bw}1T@6)lXzpQC?QgH@NUwQ7koR8(N3{aKj_GIM02vGFbyz%mb4aQ_YylOL`9|2`B6$!8Rr)QmzyTN0R|$}b}4m# z?wDzOmFVqr!OQiyl7}es`7|A2$=Sb~!c4IP*&@d6rTgja27mw76yC{;BL*%P@NtOr z?%9JBt=gdod_Pe^>gZ{tRsOJ5EDLl}`g@)A|I;{Z_6`h%f&-bL{rN&lUi7)*s%WO` z!Gd=6yHg{U_+0Fh2ekL~;665M+GwoSN^dtM;yywZvA*{?>=2Actvb=*!q|%%=bq)~ zJmE_cx&EO{zB-BOSd&O!oKH)$vuqNvZxOC;y3orR&bXKWQ!!QMzy~MD5zJ(#>7%ps zi=@h1m7Z9ZoyP2FHPSSJlU^(B_s+6CEgJf6HN$xzTk8>Xv&QZfp)$ifW78t94W0bX z2COk)=TTAj;#i8~#V%^0LU`q&8=fcs)r#jbBEuUfgTeuFTlAoAjiUs~u71TW8xMsA z^{TYXn&N|@CwtJ<$N&G6AnWZ43LX~tU@S0iUWv-$DU$If=FA{f{vfVfY%-$?dAQF5 zhNJ<-AsHVFQK&WZ1W%=a5;j*oz`fsht~{2uf3-cjJ^qmwIfI$Tfb~~g7i^lL#INt{ z0n371Qj)>kRO~xRW~4F@3BuL+NYd2>r2z0zNMdJJg-$T3eyX}~-v^KV?z<9)`T)w?<9y zZW_RnN9NRhbr9TOf#ITL0kOgUv8Sd>@;YX#6J&>Rlw@)2fd77p!S&r<6rQDVosP+3 zgR?S(l<2{jhZv3$dXxxM*aE#yu6Pj$ZY=@78H$gGSjv4WTCviONnhpDcGyOc_9Tz= zRJ2x%o`L*4EOE_I1az4>d3|-dg#(G2WxtL4h#$EOg4C)F1boDtf7|;Ug6PTZ9D}lI_pPS#DLOux-uua?geuBVL#OHZt?vI2T zcJ2VkC|XWUb`COF+5YDe;GYwP48!_s-@FaWuR08?xXCe71x`V*UD}gzL*y!bhd+aF zH!TA?3=avP4MeNKX$QjnniUjHCJIjtcg%MaVn=?0>$}uPzuNM2@0rjN-h=xkn>EP} zx($~kF1H2x`Hi+&`Xu5SWKzSo2)TpX=xv_duYc#Gin8czsVgV(uA77=@hl$;lM-r0 zD<#7+AY7XaL(eJmhTS*0!XjG$845yW$g-WFUalb(iS@Wu4Ke(f{^GIgLE1YK@a+4y z%(=`Jo*wd(Z^?5k8wO_MVxVHE(y4WdCdpzL!0mw{mh%-=@sCS?2ds~fwv#re&Jgdi z|7DOX$gs)O%WEV`T2e1kK_~y@aGy29Er)Z1sQ5E-{0Zn;4He)Srz1?xRU5!{%crCt z9UqIOBK^HZS_mzZM)e(3f9{?nYR2;0gpF-ZfXZ#H2#hc4>Q@#VN2~|th;ekSdNo%* zJh=AJ$3S+3?mQMB9;=tO2zuZMomNtdvi25ZD-9B2y{NE=_c&U8pM;7i+8O;!W@Qct zkE0-pTDOrM8>9M-%mGA%rFFFB80T>{3tMno2d>b5)xkSEkqR>q~|r20}{_ zQwIn25C6-E>PuGH&-fs>2|ej|q9iS$KsJT=8Df%&a;hkVHa!IVo`2$Q z6d(FOr)d_CR7tV*m}=f2Z1{s}Q%-S8OEHLUvd8xM3S;+$wXYqt3)Au%S(+oT@kxUM zdd1X>W|f1{2PVM&9~Qon1Op3iWggO%TY0ctkhdmNA<+jH&gF;N+YTNI!zaH2+e-%+ zjBdcn0>7CFr3f7mg6CypaV$+Yb%;;Z{L2PWDh2a#Q3P{;u?ZF@I5^J^>nI$EnOZ@IL3mY z?+EG)JRWLC9+ZlEoDvrDWw=0ACfxoo^kui!s9W#Bd~NhF3o!OB3&&8A9yNjfCocu< zO_~0pAxGGAuH!7~dj_t3piFqxVY|`vQ)Z%+*sjrMZ4mN2h*sDT+kB^}AnSN>eVZ&_ z0Se7CnoyB~cxm&K22N}F`%1;__PDytdx*?OQta;fWCD!&QZm9B4o7;EfqEjn-pASF zPakVuXZyU*$*|MBp3X-^kIo&7_ep~9mw!|NM@p-T@N4NspUIx;|G<>d*n`Ppo6LcC zOWZn2f-x6_mfxx+kBn&$ZF|Yxx`8Y1mqI-_wOb8_00yt-p(jfQ=*z2bhRMW)%ar{J z!M8Vk(g4WjOzZQ_quD&9@iN}i{y*I4S^GVKt$H`Q@5V6}t;q>BpJ@CeGt%^o21hWG z%@eeUIeE%KAb>=N za@c%&V5jZGK8)w+TOKKIu*&fF+W1MiP8>(M%l$P+#UexSdIU? zo9zqPn`PtaQauW+5GJxT&}8johtg54`@b-TKG_T~qH~%gZSxyMb(B;`?n9Tcdf185 zt2S?5)<5=?}qe;l@eTav|U z`0)ld*lP+S=GAYr7J)FS`Vxd_o1ehKQu%5*pf^h65~iVmk2Z0h7>=-3;$WMvX;r!w zpcPHQ|KzoNzL0A(@)pPc10?f=LAMxj=*@+0Mbw98{Vi@qW=qEBkRSKfdX`@UnScmJ zQ%32}8`y=Sgie9;vNt8JbCJd`yG`-&`u@f7+$x?$)5DG^T9G*wxkx`xWXs-%AvbnNN!E!y3^wpgu)pk?k%3`^mo!72{B$tl7^A_#dg22Niv7jt1q0fMZUBs5i> z+2OhBTC>ANm``m!9*R|I`Bc~%qZUh0G>S_aQGMF;jwYQKBWb4SHEGJoKRS-^SVE<9;5?xsI zC#VBF^ti+QNP@`899mi?|+C!Pvtkjgix(*Ix*+>@PLXtK)tOWY!;pFWn#-Q3c%)LBy!X8ufD05@2>r-ITd?KmA7#V*^;< z^9O5i-#a+xEEuueM+gY-Zjf*Zd+IenxQA=$eK-~!5VarooAyjx^WR!uLlq%{6u{x@ zzT;}sEU-U!^S1+V6bk291l|%DLjm%8yNQD2wq*+yYUj&wmg$OAbrhqt zCcvza2BiQ616%PRjZ$I?u?dDx zy_%45)p+Pil3t?=KG0Z2RAe0?cfrAUW@?8yB-h@g9gz0CZaBfA5Vpm(e9_mbBdt7>OPuZx9O}eMvRKUPMflvZ6&*7TPxmb+;rBoL0e#8zKQDMBK)9KkOazX6?77({g4kB@9CaTRPNW(06X+Ctrz;t^9EsR3)-b z=hyYj^_dF08JcZ?_UZNxnw)1a4Zv(N0Xdzn&RbJE@P~tAQ#V=sR5%OLE1BejtFWm! zc}A|BN^U(6ZaXG+j>Y zJI;Hk#%gxg3tvP2KME`QW=j}P-tl@2wJwLwD z!mW7SdFDnpqc)?1ZOgEAeF^+}zs6|4~#}+p+m&up10(1hF4VN9~z8 zLznT@N^RAs#gh}`3cktxS2cJ>^QG*CH!$W+Rf)pcZ>n|zCQ97P&9+1pDzgfSvT4;QJ@7?^K=`N>h%LC)gfL}T4|JHfg*`v4vv+s4v>_qrK z!_WKpc@JijIj%CimeI78e);aS^Lb*%S2Ah1$J2u2%2tc(r2jV31QDHp_4icJyf@-} z@)%ud+tj~!=nd_xGP(~x%gglf`=NH^*hL%oqou6kDhYc2xyGHZJ>^( z0^ii6n*)?;(pN`-{DSGSuTNoa!HpfQpJCnGda9+@0ycFUd%KJw=H0Tkw|*C+IeMD5 zcI7)Ud6%2rHbL#R{Js`VN)STI3ndY+HL;-IN@ zK0VFV2KJLD;pk^|6r^djMQ@D|zz6fEAu}()nCsAmFs!gmp~LxJX<+E5#+oZyrWaa; zoW=w=qv|IhK`Ofa!|+#8`N2skC0V*4Q=b{IIfW38V$*OZVb3H^yDa?v{oBsNgNg(* zpNN7_BIdq$I%--cEprP_#uPtE9?3fy7U6CNv`&aLGBdtBubpFCAfdQ<0kRL7$G(+8 zs?VB$j|l+&v!D~>fgBWKMLxg630(+11#ZqPQugKd=;hZEk5@cakpu2HYkdc59{B5p zZKmzn)Hh}XLbFx1Fk~!cY{GIbhIg8G8d703=T6z)VPl#7@D|`uiV8cbQ2sK1ZvZc} z;#f(!CnC8lwsQmJ4YXJ>nt&#_bxqtd{o?LY}Ej8M(6qw;`JAE z^PclqweO8?J_*=ViQC^^`CC7RyVl7z5lD##c!{2m09VMkts21EaY0?0o z5dNXrrI&-Jw9G`pF53QPabIK3XR^1|as>97+Sc1?{#ohWzv`H-)$D~PYHW4(a6@YC zLY5+My>@FN#sBQpG|Umt)ELbj3$8r3LWl*6mr=81C7Lw0##u)Uf1IYk!;l7Km|Otm z1o;_BT+N{RXh@&uVQ6Nsnqwl<41^|Y8I+B{ym-XjgwW2vT*Ed4fU>^jm(|4TK+V2% zBKK>Iaey^YE>m@+q<*sEh z)bPfY6Y!$^GwaIgI?S|c0eObWMJpgSPm%uaqSsTA38~kSE*v8XH|OZs zyz&PVahq4=p#oc20gBdV!};``+u7JC2>dGgwFdG>;X5atxTHf8+q>KcN9iul;?leS z2%>G+>~{EfTmsBh{R8`Cgs#(h!`l|yoqP3<2-mRd}W_PQ#M{>NG#$N+Qd)24)e zts?MDP8t#Xn)SS#&iO*ctJzceqn8-JGI&JD-hkaA20CpPmH2?Nf4W(jb2kP%R_~CoONpT4&>}b_=Ac3lfVW} zRIjAkUi_rTI3d`ka#25anuxA9jCzb?TbAzPUJb*n2Q zgxrt=pd5B`o^H184py5)pE+O;>b62~X9o2RYQr3m=*(bnoBsao+-uJdq{H-zt%xf*W0QfH}GGG{=E|#udzFc_I z|3pwXnwbi+>bW1qJ@`N*up(Fnh5N$_yy;?&`?t$6N7ARPA@)@zDE}DVF@%&? z-S5&1V&AQVUw7u%&ToNr;QSF2+~gD6oZDoyo=7VwfaJa->v|n^bEb&QiEJXX+!O+b zKusMMjnhre{W+G-Cp?!<=pwAi zz`NF!{f8YbUeb*}@Y~JQ9*kzzbts>k-cuCiu>DgBY|z-A4{R~a>X?65gV*fOt717V z-^m_&CE%CimFtp=@!g{KsrqzdKv21DQWWy*xT%ag9pGzb5A-yU4K>ThkuTl1NnUa~ zX;6~kT3>Vyl~G$f-oPdL-5i7pUlsSk^Cq95hA05puR)+X;nG%~48zapJ;I=imfIDY zRtyWYia})SW7zg%0TV-}unhuZ6iGh$g*3$MNV0cS<<{xi{XFR(#FW0nj&BJ@5Vg%s zs(U0l4Lp(lZnnz)W_5smw2&t_giaEu!&tFykia2SH=_ z)9A-+!&giW=3{;ePbHU`OOV9AE-yZ#6tmSaMozhpL(w6|1!~9Ggv?s8`nGC|i8NL5 z%lAs?uc`#rq^24`HKT^&kB0i07_g!AZ9q&m2#Pb`;)iBN7XPR{Omz7RT|n?S&8POlPO&=l_>&W+FdtCMhqOcNi(!LqcT_GFTyA_p>ZN8UMP`oCG_ zQn$}He9~3{d}ON(5OTXgAYn*ZwL22T2f;;dIxiXAGTlC-VW8t-q}f#sqW?DU(e!(; z7D#`cHDoS2v!}LqIqiEhZGFC8sfTvIa_jPUoPS&UTYDL>=ak^0hc`mZs1SUo7pGVq zC*YMS{%i>?ffnPMvf8V6u17aV_F4OyK1Lf)LZ1Bdqe| zaT42t7E%+h#KDMgK024Tp0B2a_qO%5L*e^&W5z#i_|#3g=5}Er{!edbqw{}=+rM3u zFy>&hUTHG-3zH?zFwv!V(C3T#%v&JHWJ&X_$ZtJpCSlnVUjLtCLpqS`Y)XPN1IhlX zu&A9#YpORjjx!TV**4PtKBnWZmlAexLcIU%Vr5(p4>@Fv9^3;eQ!#Qu@K~*w1xT%=(ncBQ^Z63HLEU! z@(G(zptT%Q(YKkxTRr_4=Qr=Eq@%~OJlhK@>D(!zh1hxmH0i$4Y0|Z%APdtPN8v3{ zbZe?b=Q_^1u*wxli;jn^q7?;!ROr&*E#^Q{q)kE@R^I0P^M0fpn1`2CfXBd#X^4YW z&6+a$$K@9Mu_0h5mj4ljnP@O+WtgH(C{Tz|*gOiub-_NAne_SqL?beOSm>7ttM7`X?z)kn3)P>lY2DhgeqLr!CvW_ZK!`D^Vpv%MtIgZL%oJ@@YQc61k^_C!T9NMV@RRnOk4X7^{B2lyj2LZeDM> z=B&8>&#BX5;X%!s_}lZ*`Dc#TDG-ov~{pA!3)5dCH>esZ+6-MW%jUVznliSikFyM`n9NnYH;HnhDQ zN?uTB>oz%V4L^Xk>K20JIv8O44WfHj-Xcz2@IWm#C@DaX0!<5rMfmVoEKzel@-8bG4djP%A=TNy z!R8&lP%$|wsVOsO%OzP?4a*?`cyFQ?&`5|T=Tv>fr9ffpyvVyJyTJo0 ziqlQ2iR1ZZx@l2pUCRc?4fOnsE@?6Jvlr5swj6%bX7++qxU0n{f}Y-K?fw_OT^rI0 zOj=>K5>3lYeh~WZOM9BW^V5o_3(?}A0}z4)`H^Ep4yxOPu~bN%NK)55^zU8|NRQek zv8*1EH#;oOoDU|-B7dI5!icjk7Wr_rqbsmi2 zN_X=$@1l5vV1Pfab|pe!o;t45Q+O3R-*Hal^iQlJ z^WE+?NY0E2@^^t$d96lj{ZQHjFmLO+a6Y+@24zqnbx^VTu3F_b-5z3x)YGkX*t)ut&a)ea~Jwn-I! zdFZAwCZF4M88R}xjv@@Ij+ve%f$EeMp<+G(UyAYV*-pY)nUD4nXg-T_&DZm!SB72t z-u!T4YdVRPNGbJN>-plnX6i-Hu0P2h+BWF93Tym8q(5omP`A70nq1MAy>Djv=ZZf4 zCtrz(g?7W%-A8J6T023>LH(A~B=l%c;o$A=nj^KakeHDT*K@G3sHwur+<;*tlc%5L zT+u0HwQ1SSzr8KhXKk6*Ya~?dkfFyMr?&~Q^I?syNY%uE{`c3tT0Ty8#Gk+`U#W21 zVh#GZWa9Jf`t3Rj^dvzW#K~oR8GS4;0^M% zC;l=y_dij?G1?|ssdUjp_nfX^Wn~phZaq`S+DPH_xS%vk8!P832sl9VogRyPmfgBo zZWKrh{9>S|lPxcO(t{Fuqs$gQT6h=jCImBG#duj~+>5quM(ImbJoFFNy`DPJWHQ_I z1U5}aJ*Q6oT6e9t(|143vS|et>^gbhWEG;J>$-1zHGP6aOs|ian@%a`$Y?!We%|vF zWIn5iyYAj`rb0tBm$ z5sd^(k)wBonZURRbsW#F7Ji#Kn+JLMqzgXh-3#Z4!5dR%6Vx@KtVE57?$fckD`2M6 zZI;v~`uF>MF+oN#>R(hu%Qs#D#Tc@RUWfS&NCtvU*H z1hIH2#Wyud!rT_;+nc;hg&Lb_)tz}~UXfR`icjLh51h|i6G7Tqi1SpHPHFf0DVR1S zOa5&T2){A!2f8m|_t9UMpNA=w(UsZ5S0a{0&f`h~!?O_eshTk!;v)*DnNB3o>l_Na ze$#oh-1aow0>fwK#w;BR-Yzy^Bfv~LEC$!*4s7FpbrdNlOmqSvbkWmC0Vx3J?U#Rw zFela2^ta_7Nf!lwdHMMTEk#&c5*~;c4`l!1({>Infx)4Utfw|f?^1IYQrA(y=>VZX zbM)u5aIu@eGG`^zydP)RKkL-4_&qGb2&qCi0a|x@U9X^=iT{YdC$Qxw zeq#aQ2%eidQPXvMvu~rA7)f}}mGR5xG*3X6V2E}(E~bxR#2<_TA*@6GqX_?40wd=V zMFcyRHrnTvZTS+ElK&B-c zp@s(9aCrNZ;Fb$&TGG9)cmA!F#WM}YkkXk5KUhp>&y~`Ys8by zkCh_mMp?j|!AIgC$=~;t&3K42wd&`{{g0lzGNJ{M)ihEHK|NLyhHMP?EnP@}`I9#H zFE7_o)9iaF^>_mpf$1#1nwiXLZVWB-mpmf8aHig|(7WI>l#hBH*?7KAeH-@?B&>ts zvTe`S&YIq-PFIkNP{p&xBuc2~s=Di=+e@gcnt+^0#Y(+jqPS#|Yi>}Y?6y>&f9CB@ zCcjZnt#<3}Sy>t4@qL<8v2NEim_eO_65$!pX1lu-XL@FZ;0zMBRnwHV^WLYB(BfdJ zar<5lSRrO)-FBrKwTUXc=7%U(yeFE;_GTo~q?esuaNnBr`$WN3Z^$ym&e`GFOhFNr zC$!Vv{Bu3tLd(mf@YO|5v|h)d1Gnu0`O&Bu?zJdX7%FUQ=3LOm>+_{})c$#9ZG_dO zV>eIBj4Ml!+h)gzz%~3+x9`*+Gs@+yh`ThBX!_dgvr@$FnXjQv91C6QjXjn|d!g@U zfm5f!UE$SDbM!)D1};S7<~22Z!3Bm-{$ibT9nj;%3)v0wsV&VGoT$Vi`b;e|%*arg# zjhyO#^l;Ht#vqFQ)J3X=;L7$wlw1~JCcAR zonPSbpt60_j5CjX%)JoQT`Ud2@c;?i^cfK*fw6E$QKFOKxgf7#qp>SF+S@@afn~2s z?@hNLy>s95%FJ|L+;|vKqr^o!;X5h}l(IxUL(_}Op=|hyiAL2IE_r&)5_Du%7 zsW63r0Ans%P(`9?m9z|EpE+VrNNZ z{q>u{&{nw&f7edLSxpyTfWghA!E+KM>wH>!nx-{cm^?jVrg!r*>YS8>BY}4~!!L?s zM8#a(C*|DT@vPE9~whx?r#6{MEb< z;<7cS)NPhK@5k*&$A;TUn4$#YvbMmJzP^=C(X!nUUB;5Uz$847BA;GcyxKtKc0q5M zKYR9t;iKcStC_bGwe%hwoIxW6m|gbcB-d0=`^AX%>-ph+5zDTP;lqjg zHdZ1CTfoBJF*iQCp`M-+mq7~^?9AX_x=3!Vn1wT;s&N^K^DLF2SNPH@A-(nXIv3AO z?S&kEkCf0-RQLK`T>r+PA1$BQrs>RfSHyk(%r~Lsq zS-)c^y*w%>VSh57<% z&2I5yA+D(SS8K5FX-5Uq2p2;VduorM!dn7j@ODF@MM_{<0Bf-4`IV{Q+pBKbuYLkp z5UJ6WT4x%LASK&I6c>&wEG;#mFo zFi$A+j)LLv8A+4QqX5So!3eD(p+N#UCjH_Hr0hkrwa3>Ev_V&;+XKa(8TlhbqnIOC ztiH#rk2fBg)8{-x5gj3c{W1M~;CRg8B_|=1i#ok3@y!Kkz!6sP$t@Gh`j1cAgjf`e=&o_3$J+<)>N|~g9=t+zdkevkG1jRgG%1-kv!@|4 zS~BAZ^X@xJO4ybw-BO_T8mXYb9hSJeUiwKPI_(Af>w6u2$77sx=-Q*TOFbbKW=0pG zpd~~UHCuDn%lwkISkOh=V;XmfzgH89ditaM2r1W42hRo(k)2*!s1=vDJM5@T!b~sy z>xfXH!7=9R(R0d6o;SWUJj0nYp2XNL`#$694~f1a`(I9^8YKE$?`M|6J@-OkgE?1k z_vx?}Du#41$C|k<{>VE_G>$0VuRi9;2GL=y-~)JU9p&B5Z!96@6Xb*edy95G!F_|O z7<4h***MWztIzMi;l1wtw?ibKaE3mce#zzLZwi(x^{~;o-?-*(XBh>tW5vimq>{&vt51PDPtNk;bQpE7Pr1XaGm`8!+lo3 ze1gJp!G`*7Ml6;Ri)t>B_8>HTf(5B>judtxyCa!%*i{NpWe#sm!jpsZU28z@c&Q%CVQ=5{n37txyX{+SjP2c{eU!|tZFrzv zdqEw(I-zok6&i)bXA!!NhWQIEVt>q%tzHUDObz5cjzQq<%*rF{a)D6%r96%(KXKQV zQ3Sz^ow)0D*T(F=D@7Pnbi}wbhwVgAB49&2hpzVo8u5^8QKIQ`7U4c0sRY>L&kr5hyAMuNp;^^RDScpb7fs%LWEom4Oi}kv8`yPb54HchtcMUn> zq3~JvTu3$w2_(F*GxsbW`AJljtNPg`o7%rs(Lf3XMcCMN+4XNPq>YDQWTg+SVqg4+ zcnZNxv~~x&Crni}a=UZw79nG=DzuGbAGR04L)x`x0GgW!6i*ckxu9z!Y{%|3x0+c9y9p z3SLd}=8J$+UF0uhUnBxv8KxNyy1q5=nEE9iWJlIzppIJV))}22eDO|=~&ffdA5U6?G zRA+Mlax`$V6oAk^pny)1!Ohs8lg2PFMh(av$*d2-}k=}SUJnIf!LdYHMUK?M`$xq>WI28mWFjVOsPQbK|8Ix9f{ zI3e|p&9Tm3B?d%ZKWb7ze?Vdi0WLQk6Q7wD??ydL0c>1^Jg1=~k%+%tC`HQjnNK{l zO;@ePT3JRGB$uT&v}K+7>r4q^u}Cw8f&}I6HDmX;GEpdQuKXg0;s_bH=u8;NsR@%$ zS6QdQRg0Bu(pXf|-#!$sa^5wXrZiMj)S#>2N7v*NEn2Ht^9MGb_1uH51})N}TOMiA z;ix8ltR!`Per9VPgE`UD(b&X^dM?Syg4^V1&zEwkiD}4plbx5lGm8){J!dcIbu(RC zMun=<&FJA#%_A3tUQJVVYlwat4jG^ug^zgcZ;4(BCFBEQ|HMM~Q39;kl zEwRmXZbb0u?u33aK|EW``HL}b3^WUJH}VDyUbr5EzIlkiqdT+KV^@oc{rfzl{i}aS zx+AE|wX=WC?)99*3*y5sh~QhauC{ongW|q-oW8GPF%6m1U>uW5068ff4(ZKZzdE|XB5z+EM0}l^kajnjFnP;hodl5l+mMrL^cN?{p zQWj~Wa*?hBQ-+Hl-ptWcm#A*0U@RRsB(7WS+x8Zy(LL%&3TGznVI~t?Y{^jmIn%t| zqOWA|g6zt(T`S@Puiw!m?Y#y2zv|u9Hnw~sfM`ov(Nka38=%XvHS-R^-u23W!dZed z92GKIE3%SsKjygioURlv&hf-Io6%E^0JOW3;_%*=SloQ}*X6zc%v--Ar^IR+B1Rh( zcTgMYQb>g9_nuw03}vRqsR&ynIXk818Js#d+VDMmzrRR~m&0#hNq+iO#vEj_)e&Po z#t15PHGGx=eB^#^hD|eGTp=F100PcK`B1|@pLAWN`~9d(`oonmf+*Mbgx0(E-fmqo z_Q8V|+#@yM(r3w_H(}l0)=&}pptj1D0vf|YurNSaBw;T2MfJ|cV&+WlWYGjXe^O^` zR|E7elneZ$m&NxlDeq#Dhy;OYit7Y+27x_k1(tnnD#u|qq4zIwIY5vnB?~ARbUkTmi z6<9Nv9m#udb+G-U>**ey)>)laut)50gyMcCk8tOX5F-F%+0$M*E(x<&y<9cXgzsr& z2+oBF^2!W(dg*@Ek^lS8;%c0}p0JD9w8XyHuGp@m{kc2VgG;9W}B8LgP*S?qXs<{%|QZ68%4V8N7 zsEj^TH?qK?>(!+xX#(62rUBP&>`Ay77OjoB?V6(|EMU^NwuA1T8f9~_AsW9OX2YsA ze=mav<8}5R;6(YBNk^>4;zt)3=OkvlZS96MNJlZmm1`(Pz$`;l`orkbgv=z(U}rtO|uO zqgD4Lt~HH6-QNBx{SF~f2>J%@5>R7Z$qncmZV(c%+$S*o+m2>fydQFYv{!-{)mMB6 z%{zO4$(Q=X_Tl|L`Q=h-)aUcm=j%pbJPEW@SEUt7jr8l@Heh=qbrAE&+5QQDtgnij9kLY)ke7Tid7M4*8zi&DB4 zj(&+g$CIv(<+3cAguz4}??bZ*)iI#?LZgq-zW4u;b>8t*|9}5CkG=P%kjl*7qq0Tx zDVr!{%O1x%G9nV$Ta=QKnRN~sA&!;JG0Gw1*aye>y?n0E_xgRV>-xv-)_-|>zhAHC zcs%Y8s8F@7*HL*Wkz>?x8}Z|5DpI;Twn?v(cvq8dsxLqyNqe4ib^dx$v~M+5q6{6H zH^`PT<6s4`ml5JyP1d4z)!hWsYZ}2UC&@UUSDclB11{x;&lGzCMk2GR#hHhw4R2*& z&fULk!{PH=ZRe_-!iOidbNO%@*@ppZamB=&=-go}G$Gg#Xn=UcEDt01lONe+Zyilt z3F{+r0v=^gu6C(Z*1zSGr*pHm4&p~4zdD&>_j&?keqLU!T_pSquf7uwp{b!=4wn9VO2!6BUdDr)Fw zkB-Q;TkXCvnJvF>gsPo6{&mQ8{Z$$=B9PvzqM1Ncwx1qM3i%x?SaB9P|2X&4PkRkz z2t3)%63A!Wj#Vzb=3Q*b4KCM=>G4010q^va_8<2IKO+W+?=d%V8AZp4js1?6GKZy z_U9J0i8I953TdXh6^q^I=HI51?L7GRcLu&VpsX(acJjns%2H}>EK@08dZs>m9LfJ& z@O6!qk4GnV{1us*x5QjJ^b%eB_)CDa&{3!Fo83LTvSY6=&FQyoBY-&Nuzt=A6jNsj zGFvABg#bohTFCNhPVefN%L|?J1McdPaGOt@ir0))g9w_=m|j6rLKg6BVo3h@-rP^s zjYSe2xN4!|xCs)ty$+t7N7owvkz>M*#Ur&Lnxf z6a*MHN-J^?&%Zc$aWoX8k}BG|Z!9Tp>$jj{Nw`PuQZXPAf)Wfs8-gU-b8>2{V%sH0F|*%# zeuJetMl^sMTN1{G-oJ+Yg`o^^)M~y10tWv5ckUeKP0h?Ne#8S*$*W(S+VUQX-)Xoc zx;q-m6G>T1G8Y`Ay$jNvkp(aa{U+g4S+gkTk*Jo<1MGT@Jus^Hg)ZK`L zKB6Q(kQ}DUdqArgOD&vCv-j4)sR_47!C_QM0K*qUx|na14AO=53R4mollSS>y1}^} zNPq-}KBB8(&Qk4xCU*h@<&YAq7saF(E5$Be97n{N88J% z%RDx><(as98akRiFV&NQXhviHgkZ?;vlEg)(Qdy2d)_|S4&4gAHk;(Q$uMtk)3^xp z|B21nZ%r3oFr}m({)GtpA@5MAvJP7}sc1L2xjgS-quBk5aGn^2Wiwo5=r+MBo^&wC zG?v1Py?V3)9IX>0{kxn01oNmkh(kI5prAXmG4Mw{JYg;WlXTT7`3l@2XAa{~_|9)I zI_EG{J{Y4+Y1(t|Jm)JTHcJ<{)i%KXnPTZset`U!{f2pkCSxeVz0+JwN`Fvf;I2@(a?3a+IhoH`=h{F}Xpx2UpKp9`V= zM#-n2TauU1QvLu!Rz{K+Z|`i6MULo{#bntUDYU2)iHHJmQpSm8n_%b_nlH)wg!B}r zfl&1a?WRV~gZ5VtrfNL~V1!^X?kAGevn@a~(i`#$I0zT^cxhI3azudag1?7IfbQ}w zp$ar=-7n2{S6J#M$fJhR8 ziuqkZU8N1Y4GL&+e`=D=hlYCw%EP0#nD9i~j_hg=g4Cp#f4OC^Vwi{{AEE@XHfW8Ljl6Yjl)I8b-rcFfaq#ZpnOz@d3ZK~cZ9#Db=DwMq@6c|l3kb2 zb?Qr3#eGZ8J6dCVeR|c%F0wbf{k2DAVP%b4+QJK&x0MqZ4TuB7X+4HlkerhD-;hP; znIhC~4l<08164|bri!DfK5+_A(#p_W)^MhAQA;^&Q6Cbo-jlUEH(CIh8bH|dKTa=@ z8^$3uUfw`m1IgAU3u5SL)d!k{`e9d{9AuNo46G#&AcSuy_~-~P%<`2I=tC|kvpV~% zn%&4i1YbD}I33Xq=etW!R zX(1y4VaEA>doIbd8=DHww2SvFRp_<_k{81Z4NsO1|Ic$3~ zQpFbvS_b;+C0H3hr;{zaG0p;`u!D9Ua{YlmWc5RAqiE!ew9tzMpdu$Qi6Cp$cS!1K z2gr!5cH3}Gw=Azr{-m-?7bPk-0Hp(lvXRjsW8in$ZJo8siP$Uw_+lD%33FaiMZWL}K+`d@^FZ zdT+ea2GyBJRd)?ET2X$r$1kX~uM6e6pch!l>_W3`jsv#QMy>ySE&knbNOhg=y1WUgmGAi@-!m4>rJV^f7RLZs=1%HuZ8Hk)CsYBkU&95~JDk1|8gEKm z_Y~HImGh)nqS9`W-skY&nUZ$iM~$0M6r^fs0|92K+oo9WX|jBiQqb{Nbl%Jg4)-MF zTmKcca%O~d#+Z%Z;l!C)zK4PUT~-_J)gA=c1nNm#k7BmS+Elqs+#jURzE+o;&!J=` zy+jfCang@_8eU&0oO|$Ek+7$0@<|k!Vc8D)mwd|x{uLLJGUAO(>J5i1(`$1?))AR5 z%l4I4nj?DvlsX7XRp+e>M?cY2fhLnAKpkk`X0czrPuFM!#5!-pnNroC9mtC_q&B{q z4*RVr%Ve6*wK*1v=6Gc3_2R9Ysqo*%M-tT|^*7>g{`ZHul=;GNR(p=CNSSV$( zMA=2kc8?`jB0v7tv|gQ|K&?uZ~Yv7~a9^^m=i?cc9jr(_Zky|Eh#3zbI7++#%5I2u}vpbg&tmc&Ug8MSe1-$Xn>5c%o$ z)uigI8R)cX8P*41I^pL706WN6(PiYbVJNccAl3=^`CBUM%QgXzV|E8uw3rltXNgSuP0uOI)tMT(O2>MX=&2^feuS=A1M!=# z`HEb91DZsB3lSZGARw%bYnIt3hwJwH`-(-u+yZpqe?+<<*$=g{TF563%5okFfp=yw_5V(R`|s|) z+NpeB8L&7<8dul_Lmr)_pP4n3aB7$sQ%r*Z$VFD1lC<;-?jJ;lX-|UN{0CS~BG$hH z?^e|TP(T;^&4b}snBV7V!ESq@?O%~&nIVZ=R)RAPza`BBUzX4WtqL-C`VgQ5i4f^$ z*XrF`x?6tJ26d1*ydt*hQGdUoj%pHPFI3>PBLoKgqZa|z(E9>k3q)2TgXTt_aUa;? z)+|wibqmd?vkEb&1ns4EQm?$+ysmGAyf5Bk?kNHIx@!oZ{xaY1+28kR(XzO53na1m z{930R{cs(o?uwFZWSe~YjBWK_3gCZ^oKCxEfM@ASc=mI`sV0NsC9nqg#~)_=J&OnUS$NI>|9| z5_~v;bjeHst@z!8wt2nE!0d zZv`ZnPjr_H_PXlo#ov!D3`OOzv)=3eB`GT+ENaf`=nUow66)9Ownln#J~NlI#!lnG z&zD0m-Rnf&MX4$XVKufW$b0f+R(B!Wp|_opFqXZLv|2G}mUcTwC=HXBNRq>mhm4&I8Jt+hc|BIE&5z}!QnVKJnS zZ<6YZUxGS#7W#HHK{apHwbicz2VKnPa)O!F3H?+oQK&7!*~!7Wh2T%LG{dHa;7mFh z_Mj=xlD3cUf%Xl&O3sCpGsUNLC;K52H8Wm4cf-_X^M2iyqU+3JC`sv_3%S=zh&ZbP z*HKW2*X_;^#Fh-#S;>W7h(9;L@GDeys!sa*2-DGqAlj1~NE(#__^L&|Emrl40UOn; zRkGj;)8&pNt7^L!R_XW=Ul)Kz`Cc%HtDxo%*;ZFvNj14w9mEc}DBnGuot?MA-EM!2 zb!FY)-5DJl4CGwsbPdrOQ?v+b?!Jp$DtH$6=l?u1Qb3hLz}gF@fZ`s4A1^AjLIA+c zO&hdUY40Liq=4X>%YiGP3TU#~q~-uRr=xbA!B8oAmsE6oI?B6`Pc1XVJ^LNEEu~P? zt~MBE$j&r)G;~J({PgI3xt0YR80~`0S+bpD_P@T1F|2Y>Ld-DSnp8?}>UIUwbcLFN zlq)hQKGtJOXs557yg&9*#q039(bKGI`;I?yeIAxrhDh2W%o?nh9YnHyRm`{l43VYx z6dk50kGCkwGtnoeDxp=7puSp4kk|`*S1Ry}Wgwidq=3rJ`2#efFg*Q58Gc42AOp7lRUm?Y z235z+6cV+rRq!L<7hN=!6@+jX&86)JW^>-VqO3O_B5^}Mbvu_Q3WJVJ08@?hxq>ab@IDLV5?)VfR$*9Li z>kWirjxU>yb?w@}OKt&7;dlo5B-|e}FLOvEnt4wL@^4$oKj-TbudRl^S&cKu-vfZH z66PnZXXJZ?-e< z06M~M(;v8riAiZpdK|ifP!^!|Z!nB%2`&?6d0VsZqsNL<2%mCj-&nu_OlQ4*Y6Eh0 z7HBNdeu7goZOxdr=1@@qTG!qg=|a3Of~a@*se(DJ+?qdKGzerCgrYK)ROd|>Dv10A zI~kea>O##D-Dt5Gq``z43N>xpl*C|g@XaT-@i4*vi9 zi^n^NPl|c4+*W7$UL&)vv*$MKzRBogOHXmdY+broo!wwtmg@*4+|(f7&4EH}b_Daa z8{Di~f|=>Hr&&*EC%`m%i~#rJ&hag?Hg1qr(zJ5POQ{i6v6+U#3VGL84pNo3gy zdL@V9PJ81Ow)Cuz6V6p{4YyVDcN7HMVZ9p{&tFYJ4>Y^T9!C>02D5LVs||<w8EY;S^81 zX*8qunF`>v*qgEiXgUPNy&R;d;ahHVYidIyXO@RwU9ECWy^5ScIf9F z+Z*z=zswoU%4-H!N@?nSajJ~CRkac5_-i-Rr70nFZWoVsACrvX204ym5k^?Y&of)! zvYrDdm!28Xw*xPqy$s{;?;w_42qRcth6wQU0jse)jLuQcT&{R zSD-Aex3A7k52d+@MTjR%c=ix&FC5pj&d$>Pw54rNzOR6!B(|t`eWu7YHnJ9|DnMtR zlyuqJpaGN-oC@{b@*NWIn2hKP8+D^8qro}eP6;Uo05a`D)m`>wd&AGoUaH$_+uvRG+NcWX66Dx?WCUys!hx0Ud>ZlegDB}uhwhq(gh~X)&}P4L)F7|ZU*M~ zE^o-inV-0Q^|d-JuNnM;`Ql)eU+lE@Dx2cvpfwd$Ns*e!i_41RL|@=z7=Iaj^wEI= z7e;N)F^>2t`n&$w^G@ye{teA6uPS0jY;iYSlR$*P>Golfmzk}2EcScuBULcGa_edG zU7!AvpPme0i_XC>%Xp9b_v)jCULNrdfcT^VwbwR6)y#*pofbnZfT+^>)b>UJBY|j| zpxAi3bv(?N6#Sv<&_V)q&Y%ns7AOhF--1Ek{a4kNhYPvDp$t(c;|<-SgJ{)@vEifyzu?^Cr6yy<29*?w0Ql>pue~ z%)2wQiNjigW=JW4E+3=S?BN_BxTU(kysGbL*ACmV&DKFWD-G8m)^;KccBPv;~|# z94}1pwndPQot-Ta4jd?S7FR^QS`(~XAh%aONgntE` zNU>;|*xzC2=&*U*91!1SR5WiX%(S8Nf;Z6Fm-_=lfg9_ABxg}&;h_Z{|J^cyuQ;-I z<-WgxI_EW=JTjCM%3b`sxv0RVo1J`2nnJCgustW0}@oZe% zmI;4o{5sr7A7UWEIvLkSJstYUrE+tFQ_}b|q5-DLYmmm}CdG0@dC{mU$2L7ueQ;$@ zj=Ov(1bO@S!D|xq;x0OEns)A<3dpUd-8>%D2d%>?4)hUS&q?d^Gh$D#K)^8AO|SgU z1X)M_uabx8?;t2PaPh#*GmF+fnPpvwQ;3pvNg&`H43-&U+GXO1R{|a*y6%CMMF=xQ zgs>iTVIb8)8LSMiT#~Psj>%Lhj%h0Iot_>xz~>xJ;Ja@t^^uQ4*V03K6PO(H0v-O{ zhsLV?46K2;2vAR&_05<(L|l8((@DVKH(Yo<#`AQiXGWft;-v(l>!2Oba~viYb+C8! z?&+I~VH-dj;*1eoas1rGMIAG6HA(5s%R=6_al3A={^PCoc3~}WuW>U+GhB^>%9nh% z5xN4Wt@%>W!JCFU4DIcsqyK>^6Qr=$PR1GH# zC@@NcJ#}t=$X%_wdg`qs>@*0{zv~;NgZn zFbye7k&nqkmJ$@uq(1mJ5NWkN3U#Zx8Fa>3rnHG{P44mSys5WYA+55xJ|jAp^jPa= zpEcwCg-l}zeo3o99bgL#A!F{k2ui>YY6%jEj06!AL}7wG@6Qzc;s>py-0L|6hrM|n zV#`w=<>r!|bXgkpVu80E_}ehcrIFnY@wa)i$Td$YYEZ2NUdwlx?lwMs{S6&%dp zeJHpcc(6+ezVX~r5f-3*PLg1G)8AN6D;IbW4jM<2Gsv?>ru>qYwyQ9GLGJ{k;CI5x zTAcEdIwJx3&Rc>>TwI(HtgZN&GCp`dw7^fw3kOtT61m)*Hw2s>k>%QLpJL$dPs<6N&f^8M6iEp;s8+B{s4 zWkGVxo00^&kscZ^#t$W%NfVg@xV3JTV$k>K%aS}Sp%sb-7E)ItQ>Cy!)NDrrXLN?_F&OS-GzWs@sb42>PyL*Fh)ZU)kWH9dmB*g@k3l>H!@*pwHU%^7FHAbs+gZ7+FI+&mKGXd`?ftRxZS<6*zsJI# z?Xwn6W@|I>cXey>1&s*KvnPV@!R-Mg# zv6@M`5J)2es~Y5-vm}oHD|mTXjTNmW8s$dhOHzGdc>c?9F&+$$K+b{S5SC50 z1?JnyE+=UBKKz*rT-XI>|C{RRw}aq2ho|3sPbMx-Y-XTNB&sZYM?AezL<`)s7%H)V zb_!;t^w1-ki$&Fh97CQR*AT6XgPl0TkPb=)&UL76*x6eC`LlmcZKYOQh_z5}0!qYt zwtd%I73;nBKJ?G~k;N6&3-m?Kc^CYM#ZZrY)*F8w%-GPR?-<0SRF2dJk;vI>S3M`CdmK#W6aYH z6K#>IyV?>qITXgE*2hq^${CN9^pxHGhAo#qF;i%I4)ztR$kIgNg{Bb0j+Qadf>F+W zfDPWRFP`}9{-WCeLQ6$#JyAF_blGW&3{x2Z9C%dZ)&R`DnCxQtV;OOvT43j$__6|4 z$_;D2=%PF=c_K&9CLI!L1*Y;5#?o|JS0Tg9tpB)8c6e1&-LXeV^l+NsD#v!6^eAI~ z_8~qmRj^++1xj$WRjnV1{dV@p7w4D@m9t&3i|0WgzSzuhE#(SALjhm)!S3xFf&|7y zw1W~?@o*VWQD;4>EBJ;Sv899_4A|X0x{0r<*cHw;0MFcWCX2rMBAt)dig#YIR3QPj zw@R2;d=?tIQ7jg^6W@vnUtTpye7f_FK-T4-acCa*5tc+_TP~#v7Jjtl4_8zkRU7k3 ze#j};VlsarxB95#@y`AK*4B}X_XgWi1bqlLf`9LCrU&HdG6jKrA`^u5z#I@ z#Yck_v5|V^>!?aA!ImClQt7V+r(3B{LKP!?$6GCGJ<^=q`%mOk_NHoawxU9D#D|>x z(+c{Bj&s)|jHC~*{OW-&gFG1IqM4RHiS!#)ZrVPs{ksPZWhhT^ivT_bc9k!QRDz}L zl{N|;&JVY_08RbYOUdH-czRL+=8iUG@vlEM+(XMJ%E8@|>UDCxuLor=5FIxqf**7$Z%moMsR^lX#)etjEadKC7f= zL9?%NuD@?(b4)-b(YG}NkDyU)`dm{bbbeT< zfxs%^B5OAkvqUu!VFN%7wb&i8i{Eg4J4V?Zyye4woAc)loG-};+WeoI1i|<&i$C< zkD`h5dTY23`5-{x(>#SiW^JUXS+>JcbMEpp+|!xLxz|6Ezz*s&rG}Zgp)g*(&XIpe zQJW1c&M413yf-|R0EoH?p>0G22^nGvKA%_<_*w7J;LoJ^X?{pHs=Vba`hkTUmp$fj zs|tEYq|u^?mBKlWi0ERrY-iS-AVRuGS?p~iIVby9NeTAa;WEHFFplYXLm|%GxD1n) zU|5`vrm5#r^y>_s2%@8mZOQnGhwTMZs?7{gy-I%27Ip%XP6M+jg;i5AvoB8?!Te4K zB0xAc0IAKdjoh6YAcl$=Tz(YDtIU%9p`1`OU+vX^;IS~Qq9ua34M{@IJ_K_DkgS>|}^0MI#2i?I{saUI#xP&3IP@WOalzRu>={@!bQFyfzvrJy0rasw%pQc~D`J3hyp%S?meujYC9P68V5vk`uLo4Qc0%&I= zQ1XqdUGTSSiYK&lrIktfWkZKHxH_Bc8Xn0$0Fui9|7BO97vO?R_|b%=Cl!9zXL5q* z=dIGD02r52KzqD*KF2-0D-);Wi~=M{5j8~sr@tIF#hBUGZvuU*EJzpl7UHD!21 zQGOeUL7g=M-Y;~sE;I?v)bVRr&vZ$!r?Oqtas9sgpaxGYewwM8Q6sd>;DZ+kg?9jG z2Ja>Aqx_g`^6)11P}PeUl7ME)UMI&I>*cx9zJ8y>kJ_D0pSVlfej*nL0UN~ro;94T zN-_udJj&NggJuv~;-S%k^>j0IzmEkdA{8fmMA6?e!=z?`vR1qsQ;hB1<7#aPeW1Ulyg0xwsJUzqTW*S zW&Or-bJsjZZ3bPWl|MXPNo=KlVI(&s6O_*jNs*!T`lclL=eiq0V(v+-N60eA8bAf! zRiJHowcj5i=);QL>Ta*L#HkI+vr@09s4UiCTKCEJNxUlqHtbHYYCF{jt`e%GeBF|q z)H6oTp|9&EGRxcRE50#9$Egv#;qKYb`lq)a1i|@dz`()jTm4n1PGChA`TF#^Leq2d znu|RQy&K0Fo4305h-_|_y^@#ez`azS%%P;RaAVSt-Y}QtFvmT#)0L{t@`gul%4r(g z%R?(5>P$x>qZk$ASn0MlT5j(gf#C=UQFl~+PZ>E;q`fz06)Vl5+o-|9T>W ztm&1jhStw}o%#!?6l;X$ma9djMMK3U1s=m1u~iS3 z`-!oGNQG2+JW2>FIl_R1^blHeO1C3H*Me5Y=)h0=;W_iCE3(=0k1gpD$>F%xvrP{} zp5yOY8!WeL(JR>=d00+a>PGxxie5_3#xSqTdl?)Az)OtDE2G2sF6(I9&)nTR-rj43 zpt*lYS2X?kxL?H5>hx$pJp2DfU#HIyC)aB)zSc{3uy*tMS|T#Ubi^CJ5!O zD0fYe@pRnd?BOQN9qu#pJ?s1F7Bph&ObHHGtd}3x6Y^i2KEKzD?!^9bTboZoJHpd% z#0CW0&nz|m2@ZoE!Qb}0eY>i`aT#HO3@r7++J(8MdtjBrc$Uvak5zb(we3`tAw7yo z=#=M+s4kTQmxET1)x#PP*{%VGXpcS_*+@+a%{IHcFnr789|Roi1#Hx}Q^lX^=dF)# zUnd#_@K|hY8Di8_oC(C*x6Cjma-`N7x+f`|#6q~KAYLG|CFHqsL43*s1bu})DuxW# ztH)=gUf_iJY`E<~;a6jKL#PQlv)Lfkz}UfAl&8G9wd%z$^*Brs^&-B%P-b>wSbA}$ zd=J*M8ZF~v+)9$G^Il;rCnG1Pc3JO?ELaER&*HYf(KK}G2Aq)_Uk2^E0nG8!YACmT z@&wf|^VpA!ygUcIDXeQcJ3S!=W?WH7tyVdZ>~K}a6?TghKz3EtPNM~wQ;kV)#9bcE zvERr$RLXSSA*QjH9gN@UBlyW*3@c~pD((shQ^b-EgqlDpzj+Oh6X&y?HPO-?+P+9e zvAm7un7DWG``fUT_J4{h6-yyaVcz-Npq;VAn2G{$L;4axz|WzPDWZnPt4om5r-| z-8gTWin(hVDcpFqGc%K|6>yU2w%4yWyYci{=mv{7PlM?qx?e#OvzeK*8`U`MRrA8m zkNpgFCGMG#7cKPln%JB2j|G_X(n5rJDNA9w}hVMWCQccGVBwVJv@*XZEF;68VptDON72 zmJ-+$*QC>vK9olw_jXA@;=$n;62H)EWxOR{OCwX6hbnd$_TOqaIlw>pGW_v-pB9O# zasjN3WnF`qe41N9Y!BYxS{0yEVlHY@2JC;A`Sg$Inbr2W>Me!if2at9u`uvMiG+K$}?3)-t z3u9+{xDHIEI4STS_f2duiJi3MtDeQ-gJh>0v8d_+f6`dexxI*?@C8=;BdZ^pO266X zV$Zt}zI4~Ee(XD{?Q7wk@20~oXMUWWqMppLV>cYT&m(G+TzEG$8>s_sU;+KN$A+tDT= z!=Z&!dsbzl@%&_6Yq|%{W2J-*Eo!yggP%2A$UJXTHGIU6MZdRM_WojE5h#=RSa`SG zT{vzCX>B}B#k6p7FKLC=RzE;>o9nFJXpJnfm@0uyHrbOJIx8a4Zfd*65v=qH%Vz&G zsf20{?!k%T8YLmbxEI3vtwuGmnMZkkL+|I{k~!ZLF?m;`}BDH=wzi%xy^}uJn zeE3!}r?>h#!?)pv>mK=RskM;`WlCXri?hHq*6VPTa?2Yi2&U_RgrL3t9n&NhR5$3hZ7d0jHqwso_UqsyO01R=;dIXqr~Y zL%l5Rd|D|9e$)Nf>3HK{CH|8w#bH@?!`ph|IeqHi*$`23oJXp5bkmh>Cx7;blR~AS zOAPrRW^7KEShNy*oVG7V25D*tg$^;Tqrey!U&rlcUd)8!+2!KllJl{q4Z{!TNxk$= zw9eVsab{Zd?Ivn!gUj= z$8%*RXblpB+nLIL<(9Y>EU4n0TM;|oHGn^CI>I#8iV0CgcKAM9wu=*_iScVLrL9C= zvm5Q+O7NRrM4}w?7V>h?XMKvr0}{~o{H_-#M_e;`lMCn`KLv_Ra=Tz91H=G(24z!; zbfXyd4~O3QRx8!HD>N+0ZiePXo4uPL9Sj*h%L!7^xh695Fot7rsr;h|_3 z!y5}p<&T@^mESN|g`S-R>7RPoyyxs7z04YEzl`&k;HwVz9bOB**33c$tZTHNIQJ!{ z?Af*LN60kUt=q7>ByD2j&Q(?d(e2D(Rl5aLgD=%AESX>VXI(6W+ZX#d19QuyU>M&W zoiP%C6@7x2XAe>#8co@)Z@FP_k#;`(6)^-Z?%BM|FQkD8so!@SO42k_!rI-jy|B+& zgxWVvzdRwE=;^)HyU<6NIu`i=D8uN#E>>j9j2>NS%9>`EE8v_0+3!EXO^$dS-Yd z5OKQgB#R&T84ww_=`oI-B%ScHIkv;ubRK75x&*5?z#eh&)fo>YMgEZ5fMIC9pThcK9k_5-p^QbM+?j zxZ@DU?a^bGQ7LBSWBwt(3Db)UYr6wEAJDrJgN?v`QoZR?(I5H-uZRwYX`v+G{WEHq z_iz#NnlSSjCWYP9i9vwUi3dVx*i=BZ-`nWVJ^{|LJtAYCYmVds$YWM(NklD^j#m{$nu_<$@}`ih;_l<(Rdh14%3U?o4^ZFj?I?*eEnZx(QB z04rj?`H*jH0xP{|`Y-i%wWp9D*^#4s#xiXsj*@_`b4wO}Jg{aoGa?c()Y@YKDB1G3 zuocHphhN?{<-a2C7#!AN)bc86eh{*fF`HD_ww)h`P2zA)t$io+9IY#@%&#BqX*eYW z@Yi!DKjAo(Z>)RUu2;9fqkI%OBDwLJ5j#9LuCXpjuH1HCzxt0+P-5`yy1()s#uX>t zXQD_*+#&s}xYYizLCLWFnh{$g6(d#hYZh${jhd~%3Z#b>JQJ1UGVk)ah2%7}JL5+n zGPuohFY8f9-$`gCrV__BvANFhU#&)G9K{l^?;K8U_UPb>Hs_<#;OP6C*;_fVW9mh= z<>>TV+nIAv2yGN<%^?K2FIu$FU)N|T%Y~pKIX#~rr7C6Er-_+Lp=L9nSF9%)NVibJUylMyE~=V5i)INRS*>@UbME=& zogH_$in1n;@RfM&rCh%`t#97*pvq@$BukoMMrQyy@y&Lq_U+mA)v7&kl#E=j7raJ!l5yN(QBE#6RQD~Wp(5Y|xMi~nw0r7q3{;&-bH z=HX!%32y)1Qj&W4*vepsKgJL0ZxqW@1k32BXLyQldbbBE&}9VQEu6Q<(IMoK{i1iO zr!Yv&`Fp*b3^GH0wb{fg!BJkW=f!?)qVRZ4MumkgAKn`AZPZ}a?rXBe5H&)ATS^Y>jjz` z71s$NGHfZd+0QzG?6z2(5j}-|(tMNerxK<+_Uf5<9!8MIdn*HVhDBm2XpZ(gdg`ZN z&KO~8nMA17c{4*TN3bWA!WK0L|Hhm6rIMNzuSmrj%SNW4PT1SEyTV%! z^@C=yN4#F@9UXi6VV0PVo?=7Y1nApiJVbeBnf;);R8=csQQU<0XE~%@{GT6PgtUa< z3(zWT?wFF_d=U9GrJ8U0)rnUY%p#FJAB;fffm&uZAY--j;jFS#~%uX2VT_$}LPZ z8i0m843XWP*Hh^{Iw!?B-c+!sUkq?~-6Nyu&daAB;nGcyuSG6P9>CG$gG1(rjRoxS zhgXnA*4Lm0*xid3SY^3}SfJNwhi4IIR;N4%)Gb`83W%to9>dUG1`FJtx6R;MvxC3> zNp;P!q-<{c)22fn9agPcn8ZNv;Vnju*ky=Aq^2b@t9-3e;Qsu+yI@oe&6y07NIHMe zL_2n43U<%E$$vaNd;J7hFKrF}DC=Q^FIqs#@MtQiB1B_Tb#|mn3C_0$ru~?}VxMfI z@zme!w|T(1VqFQ`U+>DVU>}oH`$%=+$F}TH?PbFW7-@;OMF~p>%~ff! zn36ksQexvaR|b>6GzLa?;(v-C-pqMH!7@U#rC)vT9VdaWY##J*Dr<~Dmgz^PWY4rU zLs+vwY7;3% zj3mW{wio|&jHhn?@U^*f4O-1|G|v45MzNGZ-soW?b>2LGP_e>3x4z2_R$}M;13>+{ zeGfN6TC~cYr23|DRiCFzMT_*BPJzpt1=BnpswjVYV(y=}8T)+o_e4^r-0Yeg@V(oC_$%8l zO=kzPhRZ?gfIpw-nc@Y!?+|?bV0bQ!Wt0s8~;Iyt=gHT zK5^iyOaw+5k5~H*$Jru`zxk(>&30=caLpvjIm}Td zvC+EWv%BB|ZmVX5MzqC$fPk}KxoJ7#JfqhXf$LgD;Ly;MGqWa4oXc4|&uIkL#90l# zQcC=e5{G^A`g7rY<*rEYqncIV{ci(XcW+M{jD=XUS7YNM=^pGNcl+-=vOTqp<=Y}W zpz9BTzL8Wzwotjr$MD2@79M3X(f8BSLeVluX z^tJS_he7HJuis!wXtSXDK1jDudi3Y15AY9P)JA?>ov*vbMC2CI_r$kH53KG!J*uoX zCSBb&sy%A*&ULpqsZj3vu>c}}@Y8l|1wS;^F(~*lnjdhS2zime+H2>D45DtEduF+A zen-CXD{tjGU~6&<`3i_LJ+LNttl$YVY9_di4|EB2!51Gh$XkdaFKCKHf73eqml{#G z&j5Y6WS)b^oc7_LzqsT*NRM)Oog4J0to*Yu0in3$!y+m0*;DV@)@5)1Elj64P2=nJ-E);s+PnXqj(x-?4-Zd6Xnsb9kq*&6TZ#YNnG8AiO9a95 z%PVRX6jM*?j?XO6Ke_iFM25cBS$xOzgvtT*LT*{!hI#OTPa2-x$^?}Q!1>w{hE?pMWGEW^$Yd|iE@#EMyy#)y0SC z(37?I1GKb7Zsl|HvXsJ<#DK29*`$+|e&0^&#(3ZYea&OSX`FPvM>Qu7i>cH*qxqlD zh182cLl^%tWBB3A2xG2MGMGkevEKNj*3*_}bpq9RXFvN!Q*I=+7pykl?&AZm@u=WS zH1aPq4o(Kalm;J6IfwlX)}kFz^V;u+BGxT(Z>3Jt9NK`}nz2H?Ec#_)WYTaS7)vK&3nS^--P@ko+VBPIu z1-z8T?+Hl~K7+`_=&b~u6j<I`(6JRJ7!29)Qqa@KV%?p2 zK!>}&l_Xp<--ti$J9oyU?Vs&K-5xLfruXtmi6wQ$`~!5uV3TZWN#37U3w}a$9%lwa zZQD&&vkh{FZ}~lQ!q!}h773UrcYJ$ET=&(LSMk2l1CaLX*vDjNT<)0L>+|We$w@sy zmN>n@hU{`-MG>)_4nwdjP=n9b+C@7J;7MLcDTl!qIQvX}kW7QPq?4VhK_K-bQ9!l^ zr4^uHCrif7YQgM-CE>e`|52;1lTR3W7>a)s8=hwCJch($T^uWBxVh%3b2l(!F~;y% zeM?OBh^Dx$v8pT^Oa-Q_$kU06?1fX7y$|EGjalPgPc?5ZG`a7p{WMr;^jIxE2LcRv zWx#8OaZUosPr|DTU?F-{J^J+6853AXS1%})D~-ClfN2OrY2dClO3w8!4I+77iZR0$ z+G8Xol!=un?)|k$>FBmCj!1$wnS-2@kkZli#prVHGq+fqMK{``5aD%W*Wo8dciCcd z>I@5=m=j;wg92Tc@<=HzdEBqljXM&ZaTZsF_{c6l}Zwzky_YVshXJjRE6-Ymp~3_SSim@~F)RP^Jr)~L=tqf{zCTa@YMRX^lQ zRfj|n5#~<=c;lJ?J$ujsMp7#A&NsS%8>ch;UUk)+{yauKU&t;<8U>spT3nwOHVGPbGA=MhYeVyuUvfd8BN zN@=O+7=hT&x=-6}svL~hwf<2&HG{~XkiIk+zNUS~j5+oXSDbA<*~j?^EMI6n?gIn^ ze~CqjaPHfOe+;bt=S2=BFs;Q!M`d;PQImYc>h@aI`%K`niJ2@g1@csEm8AN$I<;d) zlB&DU*^bHg46IF-N_fo?2l2LQ`##`@FV=I~jJORKn0@y*j6Z+C+6TsVfMLz8J%aP< z{KOfvBqSv}2*pcd?f^{ z)7}nE#riyyDe}vb$oul*$qudvF$p=keRS_K11~8s9xvu2zfdsc1Q+L%PZJu>a>bD* z!^AAXU#xZf4^QJ+)L%t2c`rTT@qPvXdome}{1#lO2(YzOCuTX>jo+e`>rv9#g+*9~t5g3ttr@Y3zM3A&bDnqZI93yp{DBw#a-W}54 z4~M?3jSbVfO&Rps%a_TI7_S} zr}|@GofED*^k^k%?3RjF!U2CdH;+y#GqV4w>Y#(`2?#9_uQvwicz{ht{WyJa!Z^SW z7#xe_GrYYkK2hC2%TCZ9>Sj-no$oIV4-py1!e3k^NR4R(kI|ME9;5Kgp88CPvP@p_ zuGLwB@WQoYa9$62vOEXc*6ZpI#73xQ>jN3@(m&y3Xv*9QT0}5bEsE78$`t{xc_OA6 zk^U5c!cWp#xac(#d)Z~m#hWH>(i97w&I?aD+=ODpG4~wn0i`qg$Kzs0cC9lczIpPg z;9vLs4*sL@sI3=2c~W`(N~Rd`GNO1|J>PpFnZ?FF|BpAHv2ka%5mz%gL zXV?Zjd;PU;b8{^|!)~|r9BY9P9I{D|jWw&zyy*nzEH|_G?Lu{~3ZY1dZ8k_DY;87O zbQ!O(3jjF`zDJTaY7A(vyrqD(g`x_}WflvaGSHV`x0gi;8x!F+r^-^vZA;T;$(FOh z6|m9$9kUu36sh~(a9goQr*GAdfeDD1l3=wu6s&!n%m$v~FZ&Yn-KjoTH7(J;%4x_PF&W}2sjCCj4T-CGt0X~C$*mBH-`cs&?vl(LZ-D@ zvOMD1YSOD!awEIx+ETBlTQIPXiYRF?Q>w#~I$I^*73G@n0L}RXygj}=s45@(BW1DT zTfuXW5M&#X$eq7cYz;lKH2RXSWV$w)#+lTP?Pcx`V+*SWrKellF4xlfRb(k4tv=hY z=Ti}3hs0lvk5ebA%eKF`i8RVAotyamdHymV!JVwC>|8GoxZN&J{9{!UA01+~8QkvIDC_ou?sj`#xY1+dzFm+0?=o6pZpk@er|-Xqk;?5mfHQP6?b}QGTuGQzF^m> zJCt$YaP5Z@kop$A0ypr>^-IJvK->H9L;8pP?rtB~Sju$<5pp079mFafLCKYFq705| zXlD>*wN1lt1KA>Yl|G;FnAUPQV?KNxMZc!$Wfbi8EPWrZ2m46e4A&dUX?Da#FMfCX zLf&Nf%aidQ%q0E3JfrZemkFTa2Kn-6=#QRJQs6Xmp%79eK7pThAZ^r=_b$}3L^8!h z4LhyLR4ow}w&hP!J$OxWO|0nt`gsuVKFXDO zlHvFjw?FGJOn8?vtPn-fO!lR2A+0^^*fg}2B*TcQ7cikB`m$u8}%R1ZsL3>H=i^qzyB`u!(?Y#Nl! zQ=0Bjr)t{?j}+a#Y#yIfsVr5Fje=`SzXrTD6u>BhLeKs5)5?x&Y^fhKg1jgZhgv`V z<+GmCXx7+vINL&D4_XK(NF!jJk6o4dsY~E?vUaB*MX%MH1HFk|C1_l)9>AF|G=-|{ z(ORi7y7r+xCTz9!cz`xbU2yUD0h+;>I(_FAUb~b@mg=KlQGSE9#`u;>=h8rem&7U_ zO#UMnr?cH4P$6_TUp?uCSLO9ulKn^0yPbTRV84N27IVU#Ij@5uWz>BfTuAAz43a)5axXnC=sU#cuPtNR4G0eR{l@RvRURx* zf#}>iDP|n#1YK(uURLG2oh2GFU0L%{FUS0)3!?EZHB-eBr8<$?&M{zWePmg?uk_!n zxPR6 zOkt!w%J{}Ke)n4mY1)gJaOjm3&eiw%DysntI=I0?oTFCtR_ZQz6fRyC5DPd-C(7}P zbKHG~1^OF7A+KAjHMy3DFf5RXNbZ1YYYd89ouGg7tl7f_rTb)-X{np8R2yaXJ5dC7K0V&* z?0+o&J91zS2!f_juhWx|dk#0@%$HOGa>Mp~B+xu9BiPQ_W$0ZiJGPj59QB*CFlQNR5>|6#J2(Mx8>@HUOmK(f=vhPXlqdK``Z2x0$C* z_H>_HsZ&$n2_Rkd0(BLG*1asD8P!v6*5>mV3TmN}lZ|c;Zm{1POQ-NklI~+rv)P0e z&5CujUZf}T!DL}va9sji(q!zue13;H$v!N%o0t)d;!X>sf?!G6QW;<#2ihnPnhnvn ziF%H2oIc(>aPSN%y~Sr;a+weQxPYJ?3kRK%o{CYQ}+S|c~)q< zGE>okxb?rnVv}*g6DxV*Udi&eP~&C~C#X|~D(x#wnDGlx@n?|(h_2ghpz7pipf!~w zL{N-F+RGH#`|RSPo|5z?bFuO(aKNs6E{3FlTp#X#xtcTq8pbdr0aB8Xpjl$SOur|E zbt7ojf_^=a+>`qro~k=3{z?WVY7%mVZPNxhR35h>7oFIb8;#7VJ_uxBt>hpPWgLhA zsI+)GY@Q@u5n8Zk<96KLUOy6-46vu9^F{jjBF-33h?6~v7jw6=I;iw@o$z`hKRP-g znHLD8tB`gdm7|k=&dI{)Sege@QOO55Fb}@GOG^c@3-UTI%&d*~-SI*#KW2$bTCBcl z&^@y32Pp%&hBR!)FM;&|qZ%SL78O3hfrDFFSecP#gxd)FS7CD$i&VmWKdMoDB}00U z=%wY)?kJNP5#|Gcg#8-J!d)X_BA^D^3r#4eUCjOK@d5k+(}?1uk2;!%;?vb|`s?Lx1dg zBStf~R%ewb$R&XI{%ugx+M)S{=h@UmaqeMk1kWor*V;m6axil%O=~26$fZ*@{5TSR z?y9|B1wcDMM>I-8Qwl!HC?uU+zZv;@grdU{#>;~JaO@pS%d;PsSf7tFPWJ$q()N{g z3-2ZQmLeCRTt#@(_|wK%2F8FRgw$;S!%H>$q~{1;(CH8EOXv7?bW&d=`~*h(uFSCZ zqbwDG;s1iXjLlSU-`U^q?z^wjAcJCwG|Bxt{%!c(nruTpp)!$}5oTN)bJRJv=l=WW zTsiIikm|7S*aDv(!hPE-6G@Xb(p17W-d|>tI8}=!dNBR-k_Xq0%I5IngyL_OTr$-? zPrxhN8Htoo`@7SQSij{47=;MxsZnK*TG)+$K#^vop`~z<8)_{jL78$$O@AZ(YaI`~ z3bLtES30|@kiZ58olnk~(yFs;b!=HPMk6@3ZJOZ`$uDHR!kqPA=Y}YxSj9?9zajD; zAMqNx0vIY&OSY-DbT?^8kev@C==+&pu_$We?1aYkJ{5jy^?ghO?C5v%EHnjQ;7~`h z*oEo7tfrhtwVfEJw-NgpZuo?MHi`UJGTuhEqaP74O(;_Do~i@}gcwFp7j7PFfHHxc zt7~5Jyt_uCQy@A0O5U>ZWE@{Qm&OHoa1eg^chKMB90nq}Eka6|Nd+fVSpHh%`eS_ioOqZpBUg0bTG3bO-QH(x zIMTsS9)G7^H^Tl+HX@|@Zrf;z8S3>B(2(4{a7I3lBFagZZ~kR{9t>F3-^y zzHU2Ic)izfUszlI`{%?=%H8O`uaMM1Zs7`6WF{4T zuHR=6CuAgof!lE|luv*yluGZ-H$`m?F)vQy((f2C@C2GlsEUXSGKt0%Yr76!yO8b3 zx#}Z!^O@4e8*@PWDegYp$w#Q?EH^$}n8*e`8dZiktUIYXxXV+k`X;$gX0?%K^yMrA zKb^(S#IV7Ti{tVucDx8r+nbp*PFanJ1Nd1(GWJb+ugw!tSE>PA@xyiu`gGH8aDzDG zU^cSJ^L&dZoIHK$jEQm^USy~dSS$p*6p3=CHT>_Aexd$CC!vk}!6Ln!F6OcXvmqPk z52<~=oPAQ7F^H5k^ZZXpJM7KO&yV3Ln|1U4KHky-YMmA@q&xhLxumNu2}k*`c^_r@ zFG!gw2EJ@P`c!&saKq*-^Z9vlsz<&Gab*P6)d{QoxTt;t@`3%zH!=MWF27BfzPsLg>w9*1gxUlpP#%5uN;# z+`qtpgchswj@y3Lw}vu1w|DQ=2h=7?r6w$P=kIe%EkpzF-KSAEKidQdwG2&G+8BFZ zE4O~6^IJ-(_PpcR40d^u_lVp7iTJo=qj^#b^%U{+_^e0Cfsah%lg$V6n1{Z3&=n;Y zbAFLm+i@!>PzVX`)me`}R#nNY81U>T06mFL6g~5Sm@~+DFVW9vzGX z&8aQ`Z{J3ZQC79j(vVySS?{a#wy2miY@+8%r1+NaNp^mvP8q^!&)rY+5z@p=)xc9{ z88BVPx-ZtHJ$Q>^6a*i|5&wk!YRcbOO)lwhFUA@##vIK%gP@*H@1_jsO#Vn^V$hg# zs}!qpRoHo0by7Fv0EKN^@>ib>B9Y-vP0tpbbmq(a>C{?&_8A(&UWWSOY^Ta}FcJl( z$J%`8EA66_m1fGOyq~Y}j$8T0z2ah4<$edQRW(??2f41G!4jguQ*KRWg2*>VjVn{3 z9h>plq@M?Q&O)3h8PnZApzu*S(GX@4q1n^PWq08Yy{rwSyiXTVt5-r=pUWgz@ZC_L z{|>mP$gChkdhvmK*5(v(EcJ7x_I9)(zt8x-3#g?&NViMpa(U}|xF{!Pbsr$C$Ynm~ zvmPSWnD){O=@-5<+vjT(q4x(#Z?{uta73Qd`^|gJ$Em=DX446;L;d_)|79!S$@5{M zz1yf*BiGbePxsnd@$j0L!ne&7BpORdm>#&yH{bkP*UAZQjMB~X`9{_j0>)DK^|DXE zVXbRd6iXfsxD@Vw?A*h+VdUGQX7kmX+UO>~(2nC_ymF?ZWKd=5{~q93mw2Hasaf$bqQ(M*;YpyEI}khSZYLaF0o_dySaDsG~^G^OGhxR z1)tZOOl0tmLaz(>C~$=BXY?Qf$mWDw+V?qpWJAb@jrqA>>thGFPFY4kb@UCGgf(y; z{r)OX89MHf-}R&h5PPuAkXPDeKRh`F(EVR^#UZW&lQBx+gDDhZ6 zh$VTq4UVu#0zo%65jF2`-n|$PF+4^itAqQt8->LG@e=PmjTxZ!e zJMu_7a+BT#Uk@o%Bu-RBsUh9{r4Bv73$x<%5W=#m9 zg>FxVPtWslj`ZrUyVMi@;hFQ&$ZM6YO7DKC<$O+E@KVtzc}2sty&_RA`B!Sm?(fu6 zO>E1KI$Cu#xrRiXO=9zY523YS#O&E`X&Y3D%fr3L`$G}QxF93dGm4Wl}6yIs0?{ z15>E9S8eqBG?O#TjpW|ixLX51bEn&FgazHGdqV`3f|oLj_^4K%?sh${&L-CP;RrS5 zE>d}nse5TYCaQY``x@1d&B;?L_HHFO`PD)`eNj|U1AP0{%B~3=4Fc?)dWweL%~bD6 z`(DgtZPHC&fcc#PO#aqYSbk^eulkU$=372nrF zTHa~C&-cvj+=m10nmcNLc978Go;at?vz^1bpC@CgvFmoV$>r!yB;))@kXXWfUmaia zDACS%h)?{&uhDKH{dC^5zF|o!zDGR;V6@n-sjz)k9SlZo1gGQya78Tw(@k-}C*e%Sc{RbXJLh&NYsk9Zt$O7SO&KyyN(`PN#@Rwe z@i(m1!Ef2cUnRI2P+hiX-$=&T%2Wx>w0U`WA$Oc(h@JCy)=6v9-Cyi^q~n3z^~eOs z{;aJRG$<(-v736chJxnXhjz)LoBuS7jeN|@5x`_~g!x>-El?U3W-?ED7`IBoDgW0a zU)&~in34fk8LEsub=3aH6Yu(%*Uk;IY~pNXJA&%6%w}l#w(2*hkn2{YTfUrF zCrPv(FS}lzdi*_$I2JMo|H(UI@;*okG6w{_mlDu~{wc2c6!2D}xK7Ipm^5!R7pzNP z?^F>3s*%X-WHdS;y$I?cPm!3Dh<;Yxsz9(0bq>|V(0&N5@NUiuzU2vv!(%3!j1U-< zOyI}-RCtPN#~lgD+;W(P=bgp9fQ9y4yN#_3@82F{hRAY-@rGr>k@w5rE(H5X&dDUz z7&o7zvwVVEo=sctiEfNJTY>43bNA%*JP1E$qf%TBnlSOuk@KB=?~Dmbt<+|ktrxiH zAzk`Q;Yi{W#&3Pcfoflnc4hm%X7Y-xAoUd` zqpxvVuEdp^K7^TB9Ca^PH*K2ouWN=k=m{`I;AzF zXB2zsm`{t3Bs7N3`#myi$l>9kQDFpuDJL-3)j;I&_GukVO|%Ll$YcMF+%76U^BN9L zcs+0Ee=Cye>9^i>-daXD(-cQ=FwC{YB*^r($uU5gtZi{*BE!U{)$)a8=LnAC{k+T1 zq+Nq4p|rnO0*9pmVp^Gt{rM$Gk*F`*cAt-Cc0=z#7xZK1Ov8HkCSkWKgd$dJ@c8E& z^muF)y9)>7Yq`d)(sJ>lb%Xopo=)V>o7ZKxf7VjT@4A!n?oT9)Y5zW*A}iPM3aL7( z;d6$)$d2|sZ)x*=GhbA z<3|sL?9m~MkRqX?s-cCYU{AvJ;xKf626oiMW4wI6Wj~hrA`TDc2T++*xxiw8a)pTV zSiA#Znu`3pl!l9?sL@X^jW~4vCE+qzUXYkqLfX_CUEeka=UOQ!u)oj!VjNY&)u~Yc zXL5n>YMxVIld$ox5?qAveojNf=WbQ`_2@^KIpNIy;DiE_@6ulO2x7~!xb~mq+D=T*PRl=`vibIy1 zDjB=FC|Id}%d_HG8F|5Ds*jU_@nh|`WUYkDqG$^a9;QAaXL;J1r zq!1wPA5jsvvQ{!ARf>zQWCX z|0@dEV1IE=!tTqEsM}lsRsq82g=q40i6!3v`E{oJNpx)U2h#2jv@*iNpa171BhEC9 z__OLg>^+bBziFwvFPo1YELeWEZ8j&RsXP@!vncnWMB8&QQRO`t!PyBIjHVtL4yC;A zyi3RnWDE=|y8p)W+6)Udq9gZ7T-&mQOs)BfQ$kE)gpzlH{%mY#jM-7nB!5!cI9kX_z z@qoaPf<5SSrVK0&i< z$Zj`B0)}u8#M;-lxz6a{>{;La4WalD_rW^Q>gMl&Ev*~&Ak214d z=Pr1axE%wtgBpL8DN%a`&o%3^<379L3x~+ig;Q_gaQsTTnADL2c{Ci zt+;fdeKOt-IPMBy zF9ouZ3a*=RA_-b6-V3I1^8T9EaXlTVvFK!5UKg?mAsNB4J-XZa^Q|8qcRqcrBZcHA zy>V(UcyMeQCred1%l}A`zMWwYIy#z2qw@1_9Nw7OLB?D~ulmD4YFx=u2A=029`9+S zd{YZaF9T?3)3h-~h29rui-C*{pmiCq1-9NV!R-f9CU*&mb7)Y?KJE#;h$80^E`-$Z z^&U?K{(u62^RxVd#8qUwk~8w&XWh3hyzCNwPx{d9L?UowDElDA6vY32N~AGY;5#l* zhp1?zcscg^SbgM|f>%dV<~_%|EH9M^j{g&L*qW%ph9 zcF~bb9S3xDw|~pVz2=Orh7vF>mKtl;r~Fh55yfwEt!_A?E{)Lk_TK=!nLOo$eq8{Z z>{>(e1}rruT7Og732@LnmDsIb1U}ENi8~A*`42}Kz4;B}EsBas?`R+;{@bnt+_AIl zds#YUZv_1AQI$JW^y9ORIQsuj*!=EouU{} z^q+o<>-duS*|AGoytTG}O(z%;MKsW?j-&Aa7G|lth5<7WyTlHf4eq0MdVH!z`Sxv5 zf{$cH?j=M-eU*g}Oo&lGk)T2$qUOGgHG%tJ99Go+@!vm`c;AKx;Z^wSwk+<}wWn!| zG4;MSWcl|8Rr4v&DMLM_7N{@>FfXNj=y)l4t7r*ReHuguq~7hcAqv6W(_GQJ;nVx3 zjKQO`SYNZ=N`nNSdaYKo^VVvYq)*ctQFwff_vh-pLDYPGLlr*SA7Texcn2>BqS*TJ z==*OqQINVXP78ia!)wIWXS1e;5?@^0*0p{;O=lMJeBBVh)xNOX0_(?~_CE(V=~a{e zWc6}5VK^}^q4Di6YC8>T3vUm^!$pybHOm2w;UR8KA&9Y`PR3+6*Ce_HTsm9lCQXz< zssn~FW)xse0O)*KfX;aWppWN3E5eLCKQI_Y8$S2ptS=akmaR#EQo2UyeC-Os16N(^ zHdp|f=p$vOh-O2N!RY5m$(@73UC69w5kweDcm8^rEE>vV_gMHFhYv2CHtzp;&I>Kc z`3LDqJk)UGr^q8oOnvZ4`B7rT*Chq7S&W!mV#ntz7=oXq+SqBxG&s=OCQ>XjQ+O#> z+%hJH|2(ssYi_WPO~Xcf=q!aD#VnIAf0Hnj`~cw`pMoNv_PMKhqMZN<0<*Io%#_;0 zhB3SfMh%G%dVl;AgBydSQ2kp0ItNabO5{K5&VN*(e5fAtp2d;<+xy;=p)0MF+fnOT z@h=7*Zrug*6VLZ!I(X0iE~GjBI#qV?#IiUdF28!n07W=yLZ$@ z0GzCz6X#AM%d5;h7*v;Of+_|xUUYkl9oOw0$9@;@T{MQe-?bAp+|JR9C`JF3W)ryI z=jynp_g|B!MVdI&CT;Qi*tTu+BVwYpkGv@nmR-?#Y-6K3o_$YDFpC|VjCXEG~jGISfzKRpC+DoAs z2zA1RU{(W_4+Zvni`PCo0e?kKur@On20Z}P+se9?c@5+f7cy^8Fz=#XovIsOjih27 z1AczpS#)gdgmlB44o+|9HF%`*_*G?qME!4z8WNQ+rz*thP?}v1iAe{?`{cfhe&`fy z(y~o{Uhd;}88_}JU(Fv;mGGGdEG=-VHm7AJ^+zznw=%jvp;}=BMKfWGm3TXk&{2Jo z0i6jCRJ1F0HX7%HJm{cgioiiLlQWw536rIHQUf%T+j)QzrOQ$oNQ8Mt@MF5kvA_G8OH`4T;oyrx~%o_)%^w(tM18{eGpWTIHL}ep_O1q^^L>0 zo&=<34|n_dzyBaLvw$tIBpPzef8RDh_Rof7=@L8ms8pXu3DdGb>dX0Wqh@#?vf`?8 z<^0bbk*xD0B^8goUrSfF=Habu6eqLWul0A7PS%Vt$JTF_zPtXUHs<@LjhV;6@Wy2a zVq+9v=0E+7izUeBr!eD*PW)n!a%L*mpSW`!GFXAn5JviMrAg>F^N}oduOLT5*xF?!5=D5Ih|u{BL~q+gNox}HYX;m9hNQ0c|HQv zynGqJuHJ6leAer`ARGn?fD=oilPupO)oE@jH#H2!TMG>}WMIMG#5r}I7>eTRGSx2p z%3F{kuh;@voo9oUJP)Ff>DQh4WyI{xIj^y@otOK^B7d zHo<U?CRrH+V^|s(+75yWNfYbe71+v)!?;xV8W=Rhm6~bfUG{%Q zk()iNV8{7-nGs0F=?iqcyIe2t zMTK@Df_T}`{v&cw^rJrD`Lk7>T_fPqYnUqMr11z2!Hxcm9Z-h8yvIM}#yhs-R~)Y8O@sWD6e6@p;p|}QPjs}MIr!XC>hcLM0kqCRa$IFYl`EMj zfPjf`=8YCEWR?i4w*N;7$Qd!`WXGqY?;OGQHJ+>WNvy~Ck$|m687jWx@TYJA0xr$J z(uz7k^axG=N)MzpHZPc;ms9Ow1rPq0c93ynG7reJzV$xm_PEFtG`7Zco^zUcB*_h5 zlCi&nyo3~I%&~on73A0JHqR3keuYd8^rJRY;YIu_RP$fwrn8S>1Rp(N@rVK&TWI=8 zoe-_qcGYvEzBjy<12m(K>eknsblpArKQusyWfoxa8){!^NN`(2+^fK6D~$gzuf;kh za@DBmkMHex3k=l+NkiI6m}CV>9k)w9)>V6toT>6SX0+&HT8$rib>!U_Ov#F}j=Utw zDRv%uxd>Y@?xe!9<}}O&5tl^RsYwKHMFbDB6?qQ=@8b5#er-<~lJCLcy0Y4G9AU5t zHoPTJURDbe5X-$no^HleV|3IMAne)K73{xuKH(z@gj;n(1ngW@^h0^>pLMMkfv#7hDTARjH}gtp&q) zy44fy-U`0lXI9W#)@Dq&jhF3C0z}2WC*)UR&(WfbnIIe<=XS(#926C7wwvOSm;#kQJY%Uwh?k;sn|}es&j`RbiLxS&FdAlC2IBeQcCS|n{;k+VaJ@|3 zp-`x9Vuoc?$#4RPkL+a#32Pvm2u9RB43ZDOON zAA~%W3PX^kZRV9w&#O^zfjSK78o*kR7LJDdo!zX9<%05_ufEKJ6jj^b=~voI@WI?uGivyDryf`OHE z%*f?O4qb$CL=a_W>5*LDIZONx>1)}+kZss+&Ho_(0S?X}?X2L17D~==DDcRpYUe0S z=Z6~vW^QL6Yag|4v{|+PxIA8edFirCJb)-IqKff>q%V14&9P<=dHT*c^on$ur94OZFBR%z%_?Y+4U<#u(3W#{$K=icH2YR z z1h==UFi!ZJ1?~iND5T*>X+hYJ-wQ0C^dcu2$Eu3hBjP4PChx!qL67EZ4op!Y3}-r$0Fm|M~ZB?H}va*GXbW zN-J#hJ(?S8DyN!SE@hobgh_$=UU(`zU4T z>19ZX+_W@nn`KL*g&{8F;}qL~4p|UC=3xUbCF0hoHf@`+|6pC5@ky#Gzmv@9v?3v}| zQouE#+b8M&Omvp0;J78?y=lIXd3Qp;yA1d}K3g4Bz=eQ-xq6LPvG}WqG~r+RX1ok7 z3xL8!oe~IGq8!mf)ueWrcpT5s3qsLDvjbV*FkB#|5(Kwi3-#7E@rhdmk4HajVARn) zdV95fCgB$2 z0LHa~NSVU_K3!G>8~3;K_p`qTML4eY6YLb-H6Jg?Bq}1vA3~szfkF~n=}j4aK}l%q zO}~pZIvP!jK^56*kY**ff4Rq&Fx8=Xo>&?;QD}0Y$pC{R?Q;=_xfu$^p@yhELobd{ zfb`~_(pat9^D>me-JRxeJXhLd)yTW}ZLxW+1+z;`iu z^r=MY(Il3^!;;^>qs_^=&Vmc#UУ3a~FIg4&3Xq4v1`PkoN5eK8yEFHcFyc=hG zvl1|dwNt&;E($_wnuH0ne3}l5Zl^uO-ue~dd(#XY03_-zcLx3TTmlji8*3T2=F8Fj zy6wM?&H>yYh@g{eT1Z{wl<)wde>}+`*Ph9^QG|X1t%aTYm&7Nsg`n$Ydygm0b#0gC zdUbPsu$U?3Q-5+m?!QQ`J!d~)Chv`{iUHLg^!`3bRcHuPu%3i<^trmi zdbHq0aIkS~OrbD=HiLyus`T! zn;Vm{hk_o7kOEC}BuLnZmm=b3CJDcmWCQuH!^Dz%Z^OEs6>oL~#^MuhDN(TUek&~;Vm7#=d= z#d`yFz^93AOrTE0gVQEp)J>ch`7Qu5(SIyaGF?`E^jhyaV0@?rOA@#0H-y`yKEAR` z;j;G@P3RUw*Fm;Eg@z7_^Ck?aauli5SVmjyoP)r5?A9cCgbcd|z<<5OINz1*dQKUO z8N%}Xn6{_-KOAR!6edp%zVUH&K5;&%Q4m7<$MR75rf<+E;M^GS#1fqSk-EBnqY(V; zp+DV)(l=@OX)CRKRJ@oC+l>MWPt+y1W`BkE&u~^vcD-}B6~Fa$fYgrH%j}zq(w-R8 zmG$D1;vMRYE94gD1V`ClNaS}{31FKe`J@9M$CjHJYLFbWLM=sBv)UE?9xUak--P*T zen(*;X!i4RoN`lr3~PrHp!1s(l#FB8oN-jj{`2OTI{1hnB z&Q|5DQ4@roQ5T=^gitET@qs*UtySa~kN%G}!FxZYgEM3d1eVs2TBX5Lti_Gmu+O~e zYEpo!3g>{9SjJxh@wEnZ0J!<=TFkm*)_kB4=9OHDgydLsTDC?B{U-a94TRS1@oai^ zFyMs$$$Sw=w#SO<>dX@qcg1#f&Fr6sn^oiH@)~5pXf+tnW8+;^#qg7yyb!V?!b!~) zUnQ`R`|UZ@piis*kf2@mrUQ&4TDlarFF=ZLxhglqE5wZTGQR*Y!q-wMa2?&_bhY{* z7LEs=STu}zWa;ix)|G~UE}1lNCrQ9n8n`|f@}re$D!BDmhy_LFgNgS)%@W^z5Ckuf zsetDg5DT?+4v|MbuR=Sg5RqdG(AoTg|dGRDLeqbIt zH~6Yvqu#jYEooze^{Q9XQO~9S4}Fs)j% z)8HN+`9C2aBO!-hHf2fVkKvnvzZo-M##+(f>wSC$$Jmld)C*tpjmOzw23UUBa3fyK zgLG;x9=}cXM@x*8^TnDb55AC~2yr<^C`SAOo!-v1DJO4HL^}+ydoh&X=QHw(t;oF@ z)TBY5V54K=8HPUFpKY4BifyON;?QU`x8*JDVaL25XgzgAds3T1^dsgZgattofF- z4MI)yv|`Mwxf)GMcE;Vhe%d<<`e-&Xkr0;rHtsAwqRBTtL^zY=tc%kihZ&CMug-<} z2?f{n0>)k8BHnllI_{$TYxhESInL{;d;(EXalGCKW=}%C`uWdBYpCQ0RaVyG>mcKA z;P)sb;jsddC^m?%B_UTN*Tz8%4847QXMW!9jhe7qoqO_L~2TW>T&I68LV31F<|tk+nWxOvR~ zc?%PmvQkyv<|RCR>pC8!juCj>407MM5h)U&6{=f`X`XT*`4RzujCW3_rRwT z?!{!bcR!_J7g5CZq6L68;^LK(2w)}2mf)Lf%bIFnd>3eUKa(hbKzsOGWwY5c#6Gy4 z{jDZDyBnSMWSJj5Yshy&Cwy1E70?csG?yvvt&EG$4T?Ah9dtN`AKOCnExUyI)7 zz|RPSkjMTaJ>*y6X5S;b>h6Q&KaHp<7d1;o3-{$VCw#Y3;rC;)Vs9Mz-%CBj!tjw! zl<*O~K`)yv_(FeO5&){S#!@!2o!O>3bKHd+kkH9EDNK9-4iIefi~{?p@n|f#hy`T0 zefQ@htah~>!BGpAwuTfVLJ3=HlH`$iB4m#Ou%|qMC-ZnR#?W#UtEM;d zRom?P)pq&*=xOeqjQ06H4kZQj+#LIqWJf{Scb^U#(&R=iS%cIJ@QEz?k}gAJK#?}4 zjmO?-?lq*u`$&+Cvth+!7&p;>`d!PI97E;k9ah}v?Fvo64!p(C7~*q9Ew>^gv9<#LkMQ78;u?Kcm!>^6 zXW!vB%V>@g+}m}Tdb|hwDT>kocfRD~h)bnva>X^P2BdcMY#KhGtaX?-N=Tenc=G?) zddsjV-*)YrZUv;JK}wO3t|27^B>xCV2~yJ1Ih2H?f}}8%gp$(Tpma%hBb@^bFz-3{ zv+jGX^*rx4wv7*L%v{%b9@j6oFFLa*7j^u=k^J$OAkg(TgwBM6byTWZwr(9dbIROeXxa(=wBoGYa`hsPU^ z7&W>Mi~CLaF`gk0TF9kOZ?hT&0%lw-R3C93gmEo>IkeLzu<;5=QPe+d;J9g*s%UEu z(n4j*RcGbvuu>D9sM;{}-NOclWwI>aNq-dm7vT5o2e0gB;)n;9qecS6Sq)oPINl=_ zZfnoLuZEH*#lSyjVWt0qIbM&?Sml2R+WuY7eu&3$V%wgP34h8)^8MM>TtAa@`A!Ac zPrdnE$1z^XQUOewzHY}THclOo$BDn}KqosGx5`t#kv~yACKU87^)0VRso(Hy2RQCbJV$!6 zD*O?$y4=!}lQk6!)wIZNPvQey4&481D#BeH?4r4f^BG3akrg&M#%w_h8E|MoOa9&k| zIYfJt_vy5BPdi(6;0KTfX}bs3@5Oa*_GnJg7$g8lvxj;fK%(s+uR!wE-FL~hp_YxL z*LR%%ha{)%dkLlcZ;~A9Y;nn{Kr!P$g7ro=paQ|OZ(LY*OXXjTTKoI3&@1DWJFtgZ zXLvxoz(6#>AEy*07CoV_! z&SRpV=Js)#(7jhVyhm5_E4v2-2Upq*%v;pcNneAp@HibVcqob@hRou@w1qdHVxpUV zTys@a`6-`LOt1U@(*=a4Wab#mt$ri=$=(l;W-GrrVD^T>JJ^X8TZC2fpY=6;>k*%q zoeZyr1105lkX?W zq_A9U`Df~BCWj&+Ix-6-8r?)x?DQGjn(-o-odOx z{iAzJskEjA9t$|Ck5Rd5k+wGTlx~^^_KcP!`sOsKxkndITq+tc%b33WhX}h)Ce1hI zooB%DCU-la(=A)_`WlS)NZL@#Tm)5NTu|u9Vph-uJOwIZ?Jsvf{k@m9`#Wp6J^@){i`c&Blc7rC*&8Wj_hvTeB1WB!lri1 z)+zTw)qUI_m_hArWlA7lfVVvMWF13%Qld6drm&~Ccelx*g0w00M$Su1-FMy$ZKBFd zo$f>JaBHVA2GK`Jk~A#b&jcr{^dgV0JJzyKABw2<+oSSDX}j_$kLpD&njXnL#!TtL zcnutLEddn&{dxS?PoyXixXyQmg=)3GFD-x8?o_EU4W~Jr3@6G2*1K+{IS)4^DmgpQ z4f_3h>ncL-#+CNI+Us~#(OS_LJRFzvezkxrC_+8$Z8Hma1XLM~-zo)WT8bT5Bz(NV z=LECcstf;-)s`)K{i%a&t~w%Hzrn4jURg3fr%sg{ zq(P6-bLUZ(uLr$N?$AA&(9z&ON(&8tknxE+%Y-0X)ZE@VvF_djLZAMBCBXgfkAeE$ zx6M=Y4oPqlZ(ZAQYB^ookJ>+t48-3|A#944oAg%s?!?|Rr{XSUmQyb;7OKtD9_ym+ z-5X2a;uK%K^*vF(T-e!fvM@dLmXB+(g`)^9MHA+JkYpQ(56`^ zGfv>s$2=`Gx@P$f-nrCo;$J?0!HiozwLH z*02%xx62>(Cy$-xH(T8k{^F3n=MP@p-mc&@{LREV`0v&2?gEgcW<123UTwyn^2(^_D!?n^4=9;A(i>z~Vg~SZ?gw6wC-H zwGYMl@2BAB8@1|KceIv)zz(gPM_>$bb24Dmrpi4^=3&CXJ?KjE3J~HMNce+5>~tIJ zx}C03RJ-l~_9M!a84OQVhKM{$v$4Vs8HYZ`yx;Hf)YJQyUjkKMuVno)Dty^zJ3Cza zPCjs)z4@ZLOufu+Fx%q97nn+L2$R5soU!+qZ)r8VtViw{dVg72zI+?ZPeN2H-K$Zlt+)2CbEg4 zeOwDlzTV$^0Mn!3X{Rb;Ed6&T-u+PTGx}DEVfACwEue3668+p+CRZkuX@&Jz8fu@VYXY+qXPDDp&Q?|_lI!mb178;Kw7ttf0b)Lr#SL>-PX zdt;^JX9A+{^|SKpT;)uuRv-l&FoDs8C)Q zHpa|ll01|%e$&oJL4v83!}ND-#lt>;rllt2_PO`|$Cti8KxwCBio0-AT=5+BJ9P?ii!%ouU(^|6G5m@jGDVP zTu6KiASV_u-W`SS0PC;SHHd0}MvR?(L7e|KuDHXw0u)IFT-TN?;iG}HXRR$qjs%neR1zhZtW$@2-Fn9I!SW&BA4 z+SrDYWLf1zSs5ioo!BL%!PG7c*q%urv)SW9|Mz|-k3oy~c0uCZbj$@q!fk5w@aj@- zCBmPs>Z-W@727u^ZCqAaB2pWAotE92T#wuNR%@ENx_x(+)i2_fM60t4ge9G8;)*<8 ztehe7j9%NlUb^x{gj(G%-@gh2)4?Qt>)C;<=Ra1wN$&e;f@5#w z;tCuAV8vMgI;aADoa`<;U~rlm!u$**Zzg*ws~;;I;+B7f_y)EI%D&Xa4MEz3pxyYk z!hMr|IV1LK3xG5Gr?;>+E>Gj$&#Hi1pSkcif!%RzscpDd;N*0GiBXD{rtrn$M@%nl zc%{;!u$Da$$EUx*VX=6ILWlIA&8<$i!^C>-s9GA^-{I{PLT6%StGgSOzj<`EP zp>aQ=PkFyE0zH2>Ue zufhhe-wL6Xu;}baz`+!57@it2^&`%4XYM*MR2|d}yxRCu=4W~By$axO4fwMt=GT|W zQsW=%A1xw~VrGLd`9lP;|F--E&;NDxnQSLU&N*^2Ib@C6!F&(I#yvn%H3Hl({y+yu z*XeV2bCvHT(Eiomz>|&#B{3wz5GU%v5PS=cfw@@C2jf1GJV2lxdgyjqTrXv_#+lj?is~> zNFDEea6mJNc@vcX7E?~d;SC~$@y1Mi)^Ae)RzWkFLKCoPCK&{G6{&enCpB;6x?574 zk78pA->F1jj!WO_AY4~e9`Rx+W4Dt($N!JM^1rIH@W{F6i9lgf++3rE%`<_SA6$&B zGZaYfqfJP1VE1{4^hkv>s|v#w8;q%0#Ae3`8!R#VgzVENf{RIC0SIfChs1pyS;zEh z=G{MFbv{yJtl=tvp0I5U=kfWu4-#@~j9)NK3w?}r1XDF%Y#rGt&E<)4KPsWU19!u% zIt{d^{!Mldx5bG&;QtIi*Qv9yU~ju^^N27k><>UN;9}=U6UWvw7FzVGyMbWblEBVAraH|E)& zNR}J#Sq!@Y?50-8ymHXY>VJ@$tTPO)Q}%ri==P+<0vfDS4j2TapzyC+`|!IxyUHcI zd~50HtRSDGy^B{Yl-A4b1!lB+On+U;yB$$+}XQ+g)CkZcJJ`9{YFDYXVb|ifP^HbGO3&( z9}0IaAT@=5xEFyUQEj@WoG(=sB+73$!w!Kt4aPw%{5m|@ctaM{luZ+C9l;m+*XZ9! ze(L{8^jVg`(f4M=#CgL{1r*s?U?jvxB`CyCz3i>2=g2eN3YCscd)$(ki*4=;a|tYT zp(1f=*vaRzBx%Z&5I99VAm)^C2Hki88FuvjiBu%2sByU+*z>U2?S))a=t(OGVBkbf zwced41&$_n$UKs$?5G#M4Wd~?F+Q(1MOtSb^UK0WRW)qG@Yv`$Var+L*l#K zs;SE~wy(&8XOP*%{x&bTA@H1qr!46isr5pw_l@n3a!ms(wY;5tShQ|Rx7r_GIt<-J~f?bh1cqaOVV z@3sFLD3>}7Wk14b5Cf_N0UHuO_IjrCf$g}tJc?)_sZ+%d<=S`o`EvdljpXHWNCkQD ze%x6xDHsI7QM#14AdqFx~8<^IZ7x06acik;6+H}#CNj$VSIdA<1qIf zl-6k#W@I- zf73Vf3glBq;cxpXnKC{0M4*#oteqo{5as!0+q7|IN}TSaLN(#SN2cf}XdM+t8!Sp}IXh6D6H{Dgdho@Xo1U21xRUSekX>H_ zTAsYce7oEDQ(3vjZPV-K!&H!L^*5Ejs4ntDjSIwUpE>+k@pXLxGIjI1iDR+b9-$kt z_FD=*pU`q%;`EIbU7GfIYuDy|XUP)m0^$1e(q|~OKehp_btlq#ObU*is3G1mITrVC z+VpHmV(>Q~tE;*@2p@+-5H(c*nW55DjxsGw)=jqnxDe!MM*})Lc{6_oL!Lrk4pUv? zo=7Yn$8HKp%cF98WW^W#03E<#6@O>=V7Tz#&o0O`;B#rTSCkL>BxDdebz5XJXM=6< zgI>EQGjesi-e8UX`bv%6I;0E3Sv^H%3rr(CDQ-;6fVJME88AVdwywR$8LBS8-e#)( zwo%-U?rDY;axwdA&yqy>aCpw0pFAslZrzi8195Jw8vZPDY0~D*a>3?Q_VSRBbQ|&2 zhrO#&Ec=Zl!EVNS@OQ*AtK)2NRA^YOHqNDn3cK<|>d^%7pDp`7Aoy4xSe=Uhonl)@T~|D!O0mERku_mFcMFD)%rxMjQKkAPRSe&_uaJMbk3Kbs<-Zx+Nh%OW2|-8< zeO9ztC-(p95=#=PsUi)EXVY?Pl-*igCcnm4kka|7f||&i=#Cg_7o1iyY1X=-d?|q- zues*rsGFunn|PUsgQ12v_#V5Ym#K$!gllX%R>SbGy|b3o+p0+ZO%=3=G15|@j5-GE zbJwS_N&_Cu^B{7X`)N3Hyc47bpV!!dlJIe@B%ajR=9 z>s~baqN?dqT(IznhU3@lrG`qRx3p2^aMx%!Evq@LXmS_cp>>2+o+yu(2NBv0{VEg| z{nzuLJ7r^dnp5X9t-N9k*j-0NG9NcHsKE$an!L_NmG+SmN)G~f8bB`T*yw8R?qT{L zmw^MTBslg~(<3R~+h{1~12d=F4BHiNZS_4Fmmo#Nm8)KdFiAlceTSWhWg~xC{AkP%F-F z;Q|$Yi%s4&Wr;E}yX6X)j=k=cv67F@Awa&8dY&T(OZ`VX~(>;*v zWAQS^ceSsxV+AoX0mo|sFTBJOdCerc)T)-*sB~m7LxQj?%DN2oyPngCivAPP-c~R7 zQ7&V+*Jvd185mM@*$Pf|{gLa#*xD3whrCM~aY{0Du99VX^iq-s@`FJucI$bleAOAJ z8x_cRI_YCKVbH4Zr7!hoSvy}KecYIjc5zkggdE_<%OOPu9Q@A1J8IbD=TUHf5%ss^13lI&x7XYOYJ?S!(2x2L zTi{{@$WzAb67C9zyMybV59wG3K%Q!4YTD}MM||s9cNSyKh*;of>WYj&wr=*&IteoG zJ5vQP_2`Ef1bu+jTG{c5k4d87c_@_LziiE?Uj$5=%D;rQUGyjMDoZ=fyBx-iGX`8p z>`)xuq@R`8j?s4=hdjV=eC#zhx9HK4_+S}%K5*T-5=J|AwFO&32vFUe@FL&uoacXODC@6C+8-1n0(w51Tf6yM21 zFT$SKWjY6$w=DF8Brh7}UcX9I)IXcRfKdz$m{XaNhKUs%igP?zgv32LA7)Tm!qyUo zkeR#Ja$^NQ9u~_8j7ICPwz{?~B&<%sRjjtIkvlE)y^?S__Q;1s^eQ$8tQ2(aHbskv z!$&E;Tf4$q4sRAba*x-5%Qw;U*QqNsv-(Mo(shp;yutBqJD=X|*fhsN&N){pc_w1{ z>o82?j=NDMB#|N-+bQ5Q{WTY%BNx&VRM@3-RuCg8(ouml`$=>NU*Kc8hL-1(%PE_dS7AhBH=Tj?=9D)R5jCE- zSxS4>BMRMbPXioLyJ_?=w3^ejb&Scg@NO%xa``S1a_*57vzpjXcG_Ok-? zl_kv5>Ano5vg^tOJxUK28LbGe(O7XR=SlNO8ybI;hj+9${pj5B)gX*udnQ?d4j7}` z0twavCf4#QjtU15iE^ZIQ>k*@%RzO<#0nD#aSv3jF@Q} z#;HO`8bHZXji!Sxt$KHEiaf{H%Ky)UK!VF&YQbp+n9_+5nS$pDnKHEtwN9o2Vi}RE z#iL#zb=FX@!HJ)2S_mb2)-N}cJ)IE}o(j3~EdB~R-^|u{yXAGZ4QeY$qsia}2x8j{ zKylNTw$_){rUOLC$}g~>?DmPj;Ynv8n5S5s7Kq%72u8m1kRW>C$q#T%?lWIxYfQ#n zL+u8G7WTP%f?vLn{VQx9TGU3nPfGZOgSw6|yN;>w*o=)N$Ct%3m|k8Et@anaLYF*T zk-~-K8=YK27)e0n=6#aJvShhsZ^>i&~@bfMj#Mm{!uPiYyo`qIEL+ zMc6kh5g6tCO?*(E;n>4aZ(ZMamUPs-A3q92&000A;mD*rJ0v(elSn~`+N8!mL^JCZKd z>cPVDRq)furT&Ly&G{JN>+{5S@5ejgOIvQp%%e*~Z1iS#TD zU?YGrw%}>*7?zPf2kDCQ^MHdt;Zd6byhPYdovbdyT6M=5@`|v+eM>aIJ^Clg?Axk8 zL{pAO!dsn0vZBrN1H@7gF%MrmlKAw$UNncrDHzH!n)sLruSH0Q``;e034naS`vX|O zj-R}D7-{i_JIko;%1$p&qP6ljq<0L@e(5@fQ5ZI5@;>PshT9H<=ecEB+CMbGuMe-Y z7vOhFnJ=O!zuIpVH?LFdpm49@7(l#(R&3P5XMEf|mOo=uvW?xjPW6EP822dkJas@?w@m8!PX6FU5MPP&YE)(;)C6MUa?!tGN|pq^ z#~A-cacPfO^{Dly(|ATFcV++iejTIbKXn{a%S-pTAF*{Id_T%f`Tf4VwWc0A{fx^q zEs<>W9)!hA+-dn;kHZ{mY>8Eq8xI=#lMVymjg<$OP(=}{BR>x9dYu2f6I*mt2kO+l zZ{zRV4A@l43%+I#El|mAC(%JC>j91A?pDyw%66MghsR3J5|A6Y#?M}Rb$6ZrEE}z~ z$Q}7s2{GOfD#HGUGje$c3tWbXCL%eN*MaZ;~9P|m+Yo7D!*3$*@9?(K+3(`c_rKA(&{5t%N#ZX`dTM!Cr&+@C8z^I8T z$~w6W(~5aigvLjic;CuF0IB*`;Z(a%_2e_&BJ)3K?|jPhFeZTs{o@8hT2MHvC1_C+ zW!p+V=d@?h2>|a3pA8@9pn~SA&_matrP?~H$GjnY9TUzIG?qLvp|M|o}y2X-6pO z!LY#Mr9|u4lLq)PZ=Ah@6!MRg?>`MU*Nuibkg49l!09;UyOk$H`^|bzONqBehnsT& zd>ekDh;vUV$qmB=|F5-NtxtIUWsw(Btib_(4A&M8y?ZViqG7vrsVo7=16mP5#W+W4 z&`7X19=KnLT}MA!5a!DV%$cFd^U{FbA7l1ehpY7{I!Ozh%1O2NA=Z1`l}6$K2IfCZ z1ZVe=0Ug|Jo++`4ksC&9VYH5XvdzS$L7WQiyLt zu3ce>`Cr0acA$@x+(pe^dLl^SzKrpgeBTGq^KoV|Ql7j8tjhnY7-MTGvpLQHX?Vf1 z!`0ec)dSp+NY(E*-? zF2hb6Z_?#+?E|&Or&IhQQ^V)-kCV}GWy zH+H7kw{{;U;>6%C`u%~+n_k~&9Ks^(VpK`+f=L&EQ|8-t{qxoaI9-EWS<(nd1`QgR z7RQDlD`_>2mwl&9!KbP(u&m73JtTS4Nbf5WwVw1np*>DCEqu?YFlz3n0)=}*t$W{K zEiYC`ecfu^^ZTu8^6ZCi%gQ|`zBg&zWh(+_-pQX(^V(XP{oI4!*04_jh0zVT4(3Lq z`K(VphOrJ8`?0#<2ZwOyvcdDZ`)g6wr|>~Ut~44e8eIBoi_%2F!u;-e8Pq>Pk+j>l z#bWRJlws#?bJpk-#r;ncF6WJvKuUa&CZuM*U$C^Gc8r>&m&(FEv$KSXdNKI!Rk-!g zSm#-E4?PQ^zppnSO`h|sAH-V6E*~B(%#|S(uNk2(Z|&+lv8@W`a9UcCP_TNd$WjG> zhW!)_^ntThv%!yCzp?!>F4Ig6-?87bxpXyw4PJ7K%=;`Q!fQ^tD`|gF3$4~$ z8G0X&GHw~?cuBuwmp1oNBV66mLe4N{#<>LAxnXPh}uzGNxivMSMaER9Ui7AwyiwmI1YrpLa1S$-RpIQM&sqq{`>p~(jIxv4`vPa zCY2#r-jo8ki4KBuZzdhn0J~gXIpGgF5dY4}3!W6?6Q|k?p#lkd-f0lT2Ts_t}?w`(}h6$P^E|H=LH}`%5k?6HoyFSH?`W zbE4*&Ik>|vnvr98&Uwy6A=Y5o{SWXi+L#rgqI%DN;^`&lD%kRQ_4e_ zs?lt7VC4>AbEFjo3U|*e#t!4bcsjm#`T#-2+$mGXX+S-Lz!0en!b+ZX{rw_m(2}*i zC$#7iY+(vX6|OAV*wKm5=B*npy4I{DB<4OW@&+77=^XrN#_82Q3=oE|&luMoSWLik z4}xX_O^H0`*8S(;2RHukbEum6cJL7$eEcO5{TV5SXshx?C~j<2Ys8ks!OT>q*3xlH zJ?>%pF1*>P=Xd*AKWBqQKa5yMuIau-Fv83uh3j6>9l@EoABEd^BSfKv;Ou7eb}Xq)5WwwFfM#Y z?P)YNP$mXJvTyCghbMc5V7D)y+y=E60$uSIz3nBk3`tvrK>qnv06FI(`y&>%zk}ro zC>lK&M7X26f!jmH0Z4-=SJL$>gAUb__{Yl_Hy~7a?ki%07wWCYM#aL<)ds6C>q3XW zS5}YcvR=Pi@VNO6yHRl^)+QEhMF_CN#Cj3IyF1qR{{0@U){WuOa%8xDt|tN;&k36b zuI*_s5_PJK?aw<-YB7GXIHks^1mEzalZ`6h%}LO?50t+WUfR-(N$>IU#d4)i{{YJu zClqKE`jdGXlid8Dd2~CIRtgb;{73Bx#a_ukMou><@eK0sz9xh{W*(xn@tQM1|ED7jTwKX&vyd zvC#%anb(IB#sIHpr3?b--&E^}ZLz6??~7C~Cq^NE&M3xbs2kmO?m{a`E3fWWnRJ)F zd^jMKF!x$=A%^aVyk>EErP~X>=!Fj+U_aA38L^0W7_pmMT6uV|!Yg4C&&7WR|RynHzlSvnK5_SFuKs|e(Cp2kEL6}wWegs zd!g~E&d}0ayja9bhzF zQ(ZuQ*>(BTv2?5VllHPD30U4+B7i46COd0;gX>(EN;%;lOf^s5T`qjA7LO2_a1&`6 zQ>Gv&Lsy1C3W4H6mI2k2`~p~h663Usz1e!h6Y-5?-X`8Oe*x1I7}Q@%40Nx6wFcX# zsY3l0KX3cw+S(4bvAtizk@ZX_WLqE83BW^^MkNn~w{%as4C(+w`~v%q6D^H-efq`DBS!Hnub zS8(3fcl2}El%_GBo51b0fyrf5!Qtqc+e7K7` z#KsIyCs-ajq!W!jRg%KB#Y_xwZgHFHv=uLXqJmwCy(T9};T7C<%)(AEnCQ38f0x_h z>ZjKlvcq&z>e>8+o|vcQa@C49L{~(eD@nHPEolrU9b=imV}9mE3tg3PFUQ)l|M3K5 zpUGsiv)uuYBgpgC{4jP_?R1J5Bd@a8-Ucp$`)8}gOOvJ8)?pi-JbF0j3!-KF671iB z(=X%Ok59CZb`X#Ur#dNEfPp*tniPzkj+R4+^-OTGQ}ENOO`q8PEgcn^a=izs=9uyA zlQYf~P?uj2L$*=1OPB!#t5Ut0)GA9Z5l%_^NDWw-3&Ftr!VrLe)g|R6fe9oJGsCPm zv=CPUtyj^-!EOA(_e(+s&%i`4eBa0_R63};ccg;ONF0y?E8kiEW8BAFWg`6Yi=b^s z;Y$#`CqQlH#|ez~?Ug`lLObZKej7`!j>8s)smy27d_;ymfPEvoLgm3fX@siql_;sM z8>PeP2#i83fhodvFips|x20ellMI9 ze5O)7o+ca4gZtTb2DwfZ+k9iDBhIOV^a+l9NWHyD|M=kfO=IMKsWM|E8%aa(ZAEAv z)(dhO;Cj->2~r4AzJW7yxg|Pmv!>zSfxDpuo-#dbr26l1I7x4usO{Xjo*Fin+Fib6 zvr{t2&jo{T6ZWVCeNBqnWcWdvj=*pShJiWD@{9AJ5|B-Xmy||^{jLs0V_4mmI}-*|HYo+q zZ=EYaxD4gz5=&P@RqG-qX^xj$NT<6h&V6OXxY8lA>glWE21#T1ERrqbI476mK2Ij} zh0hi(vWy+g)QhBJf2G{!?)P{=tCuVSkzw#wqksGj8TM83Q|ap>B7Zgb9x)ck)k8~4 zZ3}efG@FpI_tZkZzA{PFm6?WnH0`|76Sl>QxZ|H$ex2>$GQYQ1WxYX!k7>e8wf&ED#_)3qo%f115#><6vl2D@xbDbbH{rFM!YO2to#z zktDsBBTqF*kjz6BqoI5sweo{(xJ9*91peLYhKdUMZAz0hL}jCmn4}(oNTQ%rLb+KB z<1>(u%1$ZZJ>NP98b+sAS8&Yju0&m%Gl!`$ehM#^fXVP?BaFx^4}U@1v-KvYI?H}a z#1KbU!rMbQ;lo-DU^JOO^MhV zoFZLPB)0$tGCxzZBq2GGQ`iK-o-?Q|J5~Mh!aOJ=Bpc;)Do*zxd)>|(F>j=)Vb1Fh z98ne%V@!7)u(=rQ`4G&lfm8t|;gG~&w=66<0ULfAl1_A@cX4afnVjws;=o!O04@>zzpj`%`Pg!h(QA*&HF~o@Zty5fW=jav#TP8(|N1 z{*(!0?r(*SfmMfT0a=DBPkkOgW!DK#1rf%u5WOVAevDr6OHxD+kx1@;*dwc#%NYLr z6lx%X(XPV6AbA1C&JijQ*#sCKqh9J;_dwpADf^cxwhEAw(%jfLdldhB>k5w5SuFIr z$QP^=mhh*qfOFX)rfIR^&jSSq#yFMsqUN~M!xC@x&qE1pF!&v zNZ{sB=-soT*3{)VhNWgJ;tHeSS0Xm_yRfx87wK%obL*u`&CwtL3CD|Of?_jRQ2lQR$#}Ll@Q@wf zY<>Sx`hxLxTgjpRxQBK;`)E5iF8_RYY6~W~m4|C`_Uo({a_iNwgS<2ycW=FE&FjRj zxKMsdc+ zyL~6RWtVT)S@0VA{>20~<*fQUSv97tw{lcSICB%&t-tu! zel+_5!aMQmzo9CqeUZUrdQ6G))^03c4a7(_Bk*?*xe*IfVa^`22XFJHCU=7zq-@vlc21Z5b}2 z-({RqbgY|lF6^6i(hon32m*kSlZH7>SJT9oIW5mYMn`q-L-R4&-DJgO-pFL?(m8Pd zlPoPyJ+9^}wzzz52wajI?VZoekf2Q6)BpP9>cgy%t!cf-k9Bn3O!R*1X#Bv`ENTK& z5p?W2^yign#*pY*v>S-VH^8#hsWAzI16?B9!T#S>wPE~&C?vub%i zuw}XV(x2CVfo9MJ(3JbEXtNZH?b(xTGz1j{`3c3wTgY>B>QAE8?2Oj!&V`bRp=}x8D=N;D(1jNrLj$ zM6l6G9xrQp15;O;!?&>iSh9Pm*psMS(aGu!L=x7xJ_JIdUPjdi9==$W%*T*Oau=lF zEAj(_kf-XYC`ceAN*W2t`p6Y_1^ikR4X!2wx`E54>`haPFZ-CzsEKkm9UPvJ?WPNN zslc~4X@%`=qH(tOGL_@uzS=?RcX8-w_L^Ft8tk?haZt*8eC^%OF>+2w)bJ`&3wOS_ z_uI&m*kqhPj+{q;;Y@PziN(w@GTvyJSi>-ggHrd3N`bek{EE@wznq&n2dwMVAlW4XZiPUMg@Kf z$&0hrZ)>t5eF2G@djd<={Yq2F!)C-`9lZCcRR+x=@&ochPOJKiy$~ zVmxwr)Q_KD!kY65={>B0zn(mJ{?7@52+yj152B@@nZvFjeI%l$4ZAB`_~iEyQuyel zbzmo@EcY6vYEAN9-DkY&`E^0(kW(&|A=XA?Nsv-Xgt39Udc}XctSM?_At$Ja5^L3n z=7GySyQ4jV1Sz}7md|)bYW?Wfe(R zR?v$Mr{8UcY3w8hd#8j))HgBX(nb znHxBA(sSZ^m{($0OWN!toYCAF%{#@)khw17hUQHce6I*9-$!x^>w_Dm+dgXY` z#rs0UB0n&1s>qM-0_XQrV@qcygyeFdeq{@Oj z0^{2B_K)c|yRzmQ%eOMo&|ZnfH;6{JZclBT)mvgpHHyg=~7UM+j)qIf#_)8wsuf z16H-0nMMxBOs4zYt=xzDK#LUaq-6GPhLRLZ(3LeeTx|}fzcv&-@=Yjqt-TmsEanm^ z!b+6;)!N8ESg$rvdl9eM1_uFcYU_s=>Ol}28sfm=4ete`krx`AIH8*c=1Xl}-2Nng zAL*`id5uo<9X=9Z(#7RjzGt_P66W!h%ss$)j^}`&v6O={ugEbn$;&QC6?Xm9+^dYXzT@P^Rejw7TKVF5arJPLg-%mM5!vpUr^;G_N~DAyhJ z6a`3}zZ!c)m546E8C7fQ_%DS3bqXd=-7l3b!UJ5hEALerv-)%+ohC?dfbo z?{G6MT_|_Te83j0B3PIy*!1p`3MmCC9T__5U82jftDx+NX9~o;A&^$~#{W&`<>ak& z#X83IXPTQ&AY|`Z^H$Gq2j~T)vn~D9#gX%PZSm~M6CK8?tv8pWXbw?fg)?%`f})U)&L~Ns z@H5#!ge#*6#QFXvhKSXX*h4lO*4tU3`(1*VssFm1QFGLYwK%&r+c8Z|{%qO=^n{-N z09Bq};`^bDuaedix=$a5pj#3FrUhrX^Q>(_Hpmn6P^ob$jUpO4w92;Wmj`||gwVqa zpa{&(cU%Gz2d$UcUpkP#SmRPCU(#TyVOs`EiC>j(uX`A&Tr!%o|62M~XPWyXx5D=e znwgw*!i_P^Qz~=#d9TLCX?eOm$y}OvKE@E?T@Yp@wu_XvJ#<3W3%vpW=U&N)AC0Ba zQpwBGtNwp%y>(R7-x~H!ccX;F(4h!}gmj6Lih>FfQc@DqJq#rwB_Z7@iXeh?3?Ycb z5YpW!F?0>Xyqj}==bYzx*Ygj{e^{=y+26hIeP7r8xggFI)LT1b!(;{{oO4h7iwRWf zDxPQpfC3mEg))7006|us$%YIyK>oYII51qK1xSSk)wWOQ?G_z7o+5~f@dRj@BtK?@ z90#d7sR5$v*1_U0DmrF(=Ojg<9uJf8Irp0d|4WtxWsBHw2eo3R0`?4fAf{p18USlp zOSkWHKQcrs z+RuBBT?=9}pSbT7O+0S3=viaNQ@7^@FFNb%`g7zyLV zfX!hq)CAF-%ZYRYDjg*%TPA(*+g&_QUX*q**6(iG(4qmo*7d_5r`*|UdGm3Wi}SK1 z8)A{@3(FG}_7YV>a+1Bv5Vwpf70x;TT~a)ga{%RMef?TF#egf1x&_`F6qJ6!b!QO?pS+Omwg6!KKQ!5 zyem@;Qp?|Jk`fMBwx`VJXl(f~Lrdi)h3$V|m-%i#%4*6dr9ISGzXJp<(d&i715*zP zH&(Q}PFC=a^NP@~U}IUG!7|14kBQnI5@lTrPNwBLI&|dkQ9LIe_P!Y8m0?=CckEv- zOG^A@+57A0XZ@0;q_0GNw@K!Ociv5zCL?qA=t!srVrF^(+Vvxem$#Wfpl(U<`HkbH zeey32RbC_#02A#Z?O@@?ntl48d>)3nAPXsQ!B_5Q;@@Qi*6i_f4r*Oi=m+ZO z74wT=6l5)%nS~{){KnOXb&**G;?j-O`8kRLU5Nwt0^btgW9xZckFeX=4`Ygl*Tt?! zH9&$+!TjOXB#<(S=+0I}Hs zRNS`D5(e3WcNb3_58Jj2K^l+wUUo>w`sG}uKGg1D?LN2KOeUxCl(o6G=3Iyyx^bEg(Hz+<0MGvn)`8C`w(}8Q(k3(_@@X@7cTkr9nG?{RB~? zh|SI)XuW60S9O5C7ESm_9owx3_@taq{kyk&Spuf{67WZ<|`=)QCg^R_Q zqh&;PHVYZF&$5Z9>s+{1;LoB79;zj63l>pdFlrZx#efD%OjO4SVToE5pA%jP?#aQj zcN^%b*(=cNFS2!|n?7GP6{oxqyTVra_&sKj^&H5QwmcjMZ!V(M$?jjg-TMoykBK;` z=i0#Ff43)UPF|p#dF=U(#ft-^>4#~r<8_6TdPPmJB%Ll{SnT59D_W!?JM4UZ_=hPP zewi*{g*Xe4N}ZRP zG#)3u_zK^c^FzS|9=_XE?X(nTvUaRFGmgd;N+mlM6O=<`2%v9&Hv`V4vds%w7g>eP zdf@f{F{f}v35s!Qu^q~v>g5yycsA>OU$UNan0@(&=_$-WjVK_u2WlJ@-abtFQhf{t z6(g}R<+1gF9->UuhcIoT?B`G})m%HZbiyyXBqoe1(RWi9-SiUM6)S+_LepKvSzVl# zB1vgMj50YttJQPWr<&Z>MmS$YS1KU9r?}SC4~rCM8*|CD1&H;VG`g@9AqV+ z!vM*aVYAs+XQxd#yPkjfKvY1RS*XtJW4N+~GP{2Vh`w#PwUhR)8jqLZs-wH4?%Wl1 zDe`C03&sz-TvF6}bN)lCY^&|MjcK-1)57^-^Zdp9tD7`SghU#+g$#iu3=!PK*p|aP zB!$;MQvCaJ0XK|GyBSET2C75LwcBH%-h6Ob^zk-}uwnJbp)`#g8+orCW5v$H*|K#$ z(*jC2ZH5DuS(e+(Y-y^KEs^Ki4#;z_kq39Ldk?q3hXiHq#!If@8P?e^TWyn)C#l(f zu-V=8d5zm`5&-7dS;!1d9ZU~1$o@L9Eb;i8qUm&4cXtc=@L_^PSqa2n4nB_4v}9B( zyWdEMe6v`@7bN^0V%Eq+@k#eqyD?X3NzJ`du_4&*^I=?(ch$i=E>{+p{ixMd$#rPz z$Ioqn3op_tBk|uxXaf&tinQLo?h~7WzLjdm7gHOgL|-~X@7Qhvqyn`Hgz6U}+wsoT ztC6#_>_y|>{lgDhZ#2AGF>gk|S(x@gBNr^s(%Wtbb`NrQ`tFSLJvue21hRKNvk7D} z*bT=2?8VN#4)L+F+Vr$sq4FV%8(&>XlFCF@H*fJp>5&B;0je5coDzQ9iMq`AmJJ5u zM#3-(+UiKHf_q}-&0>2qKha@U-~3|Q0`HL6eIvkIrP0Q>*=~Ik0WHn`!9Ue_X{^aP zp`araVGI`Ui$~@bXsYMwoTAKsb^6@p2-T&jnLQ$H%1nny#l`7R5E9y(C`Jf)jxzSIdmjNZjA#}_9LKR$~gYO*d?!i^P^@A z`AY{AU2;RV(0V}cee9MK{V*x^mP0|DjJe= zxSNw4e>!=wakUX$-m>aPU#BU&0^FDfCMDv*-M772@A)X1>dTMYvGaIcE06#6)<+=A zzPrr0{@VbX=}~oumasS)1po9T8}Vk2{56gyq+p1?QoHdZT9}haDB`+5+UjcvLcI_` za3rpKIsD2eveLC#l!AyK{FcEV9Xj%^t4s_};DyY}BA)m^Bbn}5P?yT_rm2B#cmM>P z#T58iN}`k;)NU86`WQ}jb%kFoEk6Um=3!RA;5d83$($cVJCS#TfA|$?sLW<1{SRYk zU;3Bvf*dp5I!H&lYGB#Hl;hpOTOjGt3#`+jH(#Q6JG?I7!}nF+jxfspfNIY}R1^HCD!h+yON0o2 z9IfZmvXUdaN}HZQUYhmFc_DCt`C~EqP9ekLsA0t29T}z9cbPifW}ec-X(c|PdL|gT zP)SwF!&Lo?{Jp^f<4h~O^~e2PJb!snQRPAc387EB?KilU)oCipbva1lAwcrD!BK(IeOReH$>59&!SNo_lB9fR6XWIIsujAkeX3$ePVhahi#ItuL*^ z%UT$rgdo^|8coQOyXV4bl%nK-SM-9jE%ui1Fj!K!w2H2H0Qq7SNUXof!6Bc0wji;!&){&5t3ah;lY< z!Y`@>SGgWnS(%o(2)l1r_m@ra>7EY5@O{%r2-`@EZa=EUA@$;gtxnRr1Ot=qaXMI;{A zoG^IYhGfrVxm9FL>pok_Y}2S`_-f*K7!JR4wTmjIQE=xGpot7fqlM5uy%EtUP$J_6efB%ZT98E5YB#Nc^(8~wU-!akU1Ug0SGG-vE#Hy9|RzR}IvON^N1aZc13@EA%H>9r?*twQx{R zx&fG%eL4B2Km68P8X1WmLcf!pEK$7oKarJ%hknwbX{dWFB~L92uO}6j>Tkn7($TlrPJ%)1F&#>v4|B8Z35$#_xIJ}<56Z=407gvktH@Is%gFg}LG33=fihenR?sU%xj4fu3Jf+b% z6Rn4VdX}xhed9M}@qJ5O0e*UN0XVcED!erJl;;Ap6o4Xd`FgDtTeQ2X%^Kfatsr@3bs?+1$fw2&<3X6Dqvft6z*m#;>m z^Ngm?!6nTyItfOdM%7-!$2upe`ZGf@K)FjNr-O|x(_V5DAXd-opAm$yRXw9f<`pD} zav6-MN4(}MB)^88>EfmMe*FsQIW#zPiby2yd#a>;FTfT>qa~DE@OSt-8xx-V4y7@x zl5wc4EQKcLZ``+~x!t4*eS~9c=Ls4@Uk5%-7d)cicpl97qv2(THXenh=8dNe2UU7% zA#IFD(h;M%PT|ysW7ap#IL7Ql>&@B`BL6A5{`Y~5Q6#nwMQYpc5YjC&GBBhb&Z?c^4=)XYaW+*$ z+y-F{LZKr|IQS?@izp`Ip7)*Un|OR+iwZE3Fry!)hA7NbIY$C+O?q~Q9xBaw#~y8b zw5}Xwop%lI{c{=(bW6?he&`vf9XwOX+RbR5I{K@hwSqFl@mqlQ1hP2zsUU){r=aJq z#bsaj#3R071vW9un-L1pyvI7(WMmuY_u3Mb1?^Q&??bs)gyuK}BT21yCT`cj7GXI!p}S*Ts4NJg`2n=WpI;Ju2K! zmvS4+8$;QJrWSN^rG$aWY~>>Ab(QiG1MHA?>XQxXG6%TQB3I?PyT0CwedG0g0|fP<$`v?`?&A zwtdIh$ARkecTYI^@;$uz*-0XF5Wu4|+(BM{&p1 zo)Se8dMKs0ca<7K1w=)3U9KVX_3z0elI1F0St%u_BXZXH(T~7iOKj%n$0hu-#1@oVyoCJv*m(V(IvEJWf1#5YsHw zURoX0Wem0Rs^MP=H!q0P_-aTQpsoLCG<(B{pFor%9_%;5x?7-~@A>;vgl)L%&F>sC zt{-0nh2UGTtXa#8jU?;>&_^(7XMT;Ogfs--QmL6;lyL+EH5j-*kjpvI z8xOEna*Y8Lyo4Z`n9Bp@>7sP@ADiw1pZ=$d|7S(UV(rScH;xNW4XWTb=vzNqN441V zZl!Usug9w+SN8ndKFv~{i}*^&ycvyp*lVRLb1qtpr=Sl@8-09(!`ZE^Pr-c?AVRe` zl6a2QEZWLV8r6?cf+3G3_7)MJGERif+#K}#n@>FIv6tu+W|A49uT!s1^4wKl)=mdB zJ4J{xxj_ok$+jt{WXKslEOciWVxwA5qY?qsxXN;UAeFp}9cP_TL{g^Q)1u8l=}Tld zyKh7xp6p3yBz;zEL}ofP;`m=OXaRqiawV8PiH#uZBb3tmo10pVe3{^aAbu+Ce+n(4 zWmxhP35RliSpX?d zSftMTVQ^OS05|;1f4@flSvMCAm)_g87jr-&XbnJPFLJPMaEw&U+sLJ7iQC{4`ns}) zr=athNE^KVC(;v0SflFA?xYE^$@^A+?iC;2{LJ7`j0+m(1V{YY-WIc1I644DXSm=N8lIj$^Q&37>-{2trcP zxKWj&vH|5YyBR@np_()GJKo^&(Z5sz?0F1{lNT;qA^W}N=#+1DolbJ3S zgqQmzkXtN)0{GPCme2c7RDG$m4wgLcIgYE|4Eu|+MoV)TGg|o+-a|1)hNYGU-tx5! zJExQ*n0~SxG_nJdV6BLPpw|jzXp^75AAf0MvGFw`CgKR}jJt`!fwG|zB8fj{xsR8i zj5x)3L^Z6eOF*Rdtwny?z3kpBC z4efUSYe@RfR~Tx5D`NS^0+yuw@y<~vzpq-UuNX0ud4_(yx4~nxj6!A9o4CK$X*zWO z6KSI7Aldf4*UB5KMl}wVDD`d|lkXelf019p6topUN@hcL(VpVEG_n$OCBG{zg! z*4Mk729WZvs1n!ZQ9ca#+xV|sfs9V=xFq$9lZF~NcBG$$ck~gizKWr0@9ne=60SR%cb+-3mJ;@44*EUqdIg5uJV}bK{pGOw({W9C zg=l?Dx!-0JB{Pv?@c&9fdLFJZz43XY+(|&mi}E1@Y%De^>FigMhVTeKML zv2oO!+1ZswG180NBt7wT)W&rZ-q0g{$V7uhVKIuIzq{QQH=Bq2ejM9DlQ|&+!grg0iHA-EzGvokM z@pfUmD{dh>&i~#>n!tSlINdUK*u;*g*<`Mj5_YtJhl-^z=&yj_9T$6?={WgggU^xE zq26>S+(9|IBu>H+_sSk>*TENph>0*VEj*REum5(ee=0r6t5{!;iy^_aEe~;;N6Ol4 zxiJY^Q$=(JL$62IQ$Md$9$vHhHVO_Aq%Ab)p9?k!8c z1+jBSZ3>%jQa8jQgMQ1WU`eRQ_Y+R6mb+qLCR+i-)a*Q%mO@t&+pZ^6oQJlJrrLoO zh8}UH2$AV0ba}6*KzHWINtZlqA%JczZ)6jj-ZJd9D5}2$7(Rl`L4I$){@`x7V~SVLK!OgRhkHk z1x}1IcRfM|v^Bw;g3Ml0u(Q=ycBe-c%2Bd%TZYt%7hfZ>d+lc6&YXN|Hocb+`I!X& z?fB0Kn+&KeKssmX6F>F*s;%37Y%Yv=ia@M1-YT!N5a6e^qU9L9*!b{2L(zY4rq6oc zpN$yLJ~cBGDh^J1{#aL<;Fg}L$IKVET>E~Yef)EiOwem z#Fc{Q1-=;l9ydrQ1UzuQ)@}v9E)gN2)Gp&%VpygwiQsp$G=>~4j+MwWW$gvxLoack zYVXEB8g~)zb>H{ny1?ga%l;~rJJVnin(+>jwim6cMTuQPy7Hh7eum1a6^I{2e#yo|4{PT_Ts!iw7-e!kx>KBPCDFJ4OC z`HWT0d+<2kP)RTp)EdFcmQV0Ja9*eq?lJO14qol!#54J$LIyRtL#KJ~+f4+wacDvc z4PpiHTU{cqR%Xd=fI46|WM2n+sN`T+Oc6z2idt-a5<+Gxfb@efzaLzXBj5Bp&Sl%?bs6YEj6hcu- zSZ|bm6JN|Rt0VP6vrrz#8|osOt)JJhrn*~gsZn{&cCQ_T!yjKLxATf--qTdJlMx)7 zQ&v@Y{}_4z<6#(F+$taSO8$2N5M-_1(>S)}wtZ;l z;JVDGQfC$F@BlgY%sxcZ`o!f$48M;;lkgB`kBL9Bp`NhaYJPlmyvg+|3AG*!$f{jY z4(z3NSmsZ|FmXF4zyYzZ%^QGQX!`A+_i@((_Bu^4t&~0oiJl72jap{*~uKuJC8-dJ2eG>5sopPU`^PBm7Lv<`j1VvQ+BbC^@w!*BGe@Bj;3nFwQ!dCB)Jk$tveq5a;?|Jj{N}Meo?crdJ^#o1ZRC-7#qQ*_$R@-c7|z2;$<(6WTB{EUyajg>+4 z55^O>T-`X?(z~dBIW%|g^GZq&%HU=vz&|t3}7ga^tP0|2|~e-^x+{J~3)88AThS<<1D&~vXLC-P4~mhp{T(ABrk(d0Bp zQ0N}_h?9&Ni}o~u2Rv{M!U)B@3OIBsXQba`sjF}_gVupUV0&Uro2G~G4ciyw*WKX5$Y*!lkw8qoVVZayG9c8#R(` z4EQ?ErnCv;lUp69C9CbUZl`MVc>*O8%DAFSQtmiyqqAY7+iX(tdgYk;OQvH^v}yZO znum_)j((yLg&aO?c$XsUW)ES9#0|JoN{;+Iw}Q^M&D@7;NJe`RMEM0wRbZuSkHZ}L zGc4E}VP9U~#r{)^+o0P_z^u`8OnXbEPU5f9AIpAIoFl@+#X}M>S-Wh-vQ>AUzukDg z)aZQ)Bsq9x+fyvw*38>r`d1r>kNvbc1zCIA{$4;_dc<6&JljP%!k^MdA@%y*)mPEU z4ERVFh-3!3&J2Bb!0 z?;WDEbxEF8fsBL%qM26+)x9)VoHMTyZJPBaaJA>sC)(pQLq18L zq>=>|;*ANufLmM0HAqHYlskIG8{=F=7h&$sc^8=Avo$!S7#M3o#E%mAu-z+{6fsov z%Hub1hR^!-9Ve9RdbxzoHA3n+QXU96vD<1Bnlw!A;>}>7Tl?f;x46`9Qc(XP3W=Sf z`K|}@rU#XI@E$AX^LT~IO7^uqk@a)V7KaZBHR^`}Nt0R}1*#2C2MoEDA$Ey{j=Xr} zj|xS)KYXlCKR?cP89W$WUv-AM{Wbeuji*iYge(ZvOwn#8j(DOc46R0u@Q}^}3>9h(%`Q>0( z$l^0lQbecW(0R9)muh?Vz<#!$KHg-#b|Z=Tv=V}@Tx5y`LpfNF>29wyYWQi#^9MI~ z4nVEYZ|%9_H%RsCZf0*9+Ym7XaG}Ft5$9fDxG1^~*_b_Q+jxk*01#X4(jWnwlbARDmXl&`!tv)x^`)u$6;+bivvc@qINTPQk|W(( zP!nSuCs`9LQ-!X7#84^isqG!NzRvc2jd&n0Zb|;W(Z;y{?JiNQqE^PVD}gAL1=e7C zzcH0~JU3_kLzeC0`3!#o)$>Mu){N=5h_0NF<1=ubV0|Xf4lad;tdB+4mXLIqZrBFP zluE|Z#lls|NjRHBptt5La)C!2%KZ3pVSciNy+o#ih=I9ujuOu z5hSdPsYmdSQyYRY$HBfV=(Pz^4;IJS@+?hmrugRz)5*_iWE3BSJf+J^TKz!!P7!sd z74hD{%!c`ydxycp?nx#Em%JA9Pwa!=KI$53 zqqfIJiLDuS95&t~QQYPlf=YPe< zrwEfQU$9V`%VI4EDzUdr&)#9;MAq;r@Gew{#cUZdKep{ zP}JITK3eflenRJ}#_#BLul5T#Ua;BkXKIBez0r1^8kh6ISjBhtG~~#7<7I6dH8*xH z$*S!FldXIH)`}{wGjWzGsSv*|pY7$z?x}D@?~2$?q%AwwoqVr|s;zZHV|sIlvci0h zpK88}Rzz()4~=8bc+82?w7%AT5=$jC){Qgp0P9Nf+gzMPrPDM@ovK>&Wcjlx=5^!x zRk4C(RWseq-bj%vx7E4zZGF8&K4Rvq*%fnVf9H7HUU! zE%%?DD0Xk;4E(zy1bhaoX>~d+jPq7?eCTO~<@)uQk&z&K=%YHm-c-@R^<~*E^7-z{ zXe)#qa07&G#4(MiM3A>f8=!7D*j4L~G?-LKY-2mLd7mOaW?gfBUhxc)XY|^@H#;%`C!?-TI+r!vyS10TqR;4GV*AFmu4&VQ^E9! z_P~iNNg=koS!R63&lLF-?<-bZ25x!NpxCVzJzU@6BNj>c2cdvk?=(o+Qw{u}i`R|; zv)XQWAh8!ReOvk^Kf$@bh|JvP!0J>bIpYgYXTONAXtUC+CbNQrb+ciw>QU zx)mYyW|M9v9;46b|2pkPxn?`#9DeZ->p% zDAE@4hp1YSpHdYv3r2!hyTLJ>@;%3IMXEAYxuwq^p8&k6%~bdwxz2+P{;6IGLCW`$>vs3|y)QEp zXu3z9XUAA_HFHMuGM}ee7DOvON{z5rP90cC7G>&0`sk9kYcC}3PrC;x+{E9_ zfl@*z=MzaalWtB_+32LSpmYj-(nY&R7H1Lm&UO{Bv5Wb@U>bvy4H~msRiL$+n275MDIyw$2i6^`|&BbWj$AY zL+Yj^nOq(0duXz?{-RFU(fHQn3hm%dYFTQ9BA>-bm*)f7?TB@Vn2xi~KvckL*3epJ z3k{M^1$G&`t?m$U;3gX~s!dogAJ0c)O{qE+e1E7znrm4%L5x8BMcFrZV(WErf`$&`B1M1X0EM1@#y@r6)5OhLZHYb)-ogpfnciWdb6$c$N`THVcreuZbd+qJvL!ZE7TDTb>JhBmrGIkIBhlH7H?}d z4u;xK%x?bNl#=AX{@an@uL2s^U!FDbAyMVACh@F=zpWm*tDMTGf8?PBP;cxJZEi-CTu(xekf*r7EIoJrvYE1*D) zH>6pG$Pj6<2|Twfpc44SN#VjoQ6umcQJMXG(8o}DPnV>*(V`g8*H-Yxt<3-#D9c>9 zZt!sqIei-w6Zs{8Z+cG#oG%^ZV4EB*H97YGSnOVX>~5_E4;c$g4%esWFFn!W9aouM z=2-HVyLg*OBuFh<{evUOi1O~1{dK!`=8ozkptVTJshUAQyLQs-sC3DkbW(QKh4 z17&2o(SmBU_Zqbu@=W05^d(mC!MMv@J`Rqf! zL?~l*>e!Zbu<&+9TA*pIW4|h9Dw(PysDzthl}4RYKw$`I#3*XEfL{SqY=VTnH=w3i zQ%_?i3WkiQ!HcaBEMH3zc6nG+EJ)PsU3R?yjS+o5>Ginv=%Np(y2B^V1uWQA@S4C~^r&g&NPYdB( z*l#4q9d4OyLpCSqSEQ5h0y^>y^^xGW$YqtFQw5#eb&mCo5UuCe2DNY(VOD`9vr@<~PKiI579^L_d_0AtQeFh6ylGs

    c_knXSkmI6UeA(~2S3IF<`48BXdmxmR!&a@KO*8m%^6OY7eOK@Zv;C9v zAe&qa$@Gxd9vhNrDL|6a8FGnD3y7d25ISTl4jf@SxNr*Erx8`=WKpsR!^%C^oUD7= zqrn=l8B`iBL#lVuiMm^|f)G}we-n5M_XD~G>sRb>9QGOT61$R?MvH1Ovznk3aF|BI8e zP%OyEG)x91e!S1Y&j=ik?N|JGn^-u~Z_W}+a+PYgEw*%dHMcuty_ARtO|EmU%n##Q zUG$f^DZ&FeMG*IS?}G$P7i-00%1&+!z6J@Wu*pZkF2&&K*52-gd9e%Ql0IBBD9M3R zDizIEJ>SZU%L_U@dgY8dgoJQtB@XnSswOTrU=jWo)vzfn#@NRljeiE0y2B%e7+FQR z|JxGN`4^gj_8+}((?0g&5*zh_j{Z>zj8m$D2hXiS=(n1KBA(Rx{mHjNlHHiItYyte z`p>kH1QF9OULn8cNOIJ5J7B9M;`+GhD7ubqmb|`5|HP@k;vEIY&_P$Y?M*XQpj+Zva5nDg(ry2AI zM5@SD20rx{W2`IXC^_g>J*gX0!lVt2=J>%(PV!u;>W<|BHUm_=yD#*BY&8}#00S}O zhK;AxA8?_Ja>o;v0Gbjjso3={ao$ZJ=)?+w=KJCjh~y?E5);GdHwx+_b1>A+Hok=v9y#=5x(xtN}Pf5<6ybj#{ph=hc#ulH;tI@b@p8|mm>~oVeb@D&!HD$*@ z2rl!w0LdVL0azyQL|`vudAYFq%U5}-Y}l**OEezOb+Buo3}00flml^)>ym7NmLfz~ z@l4x{wDDh|ao#OH+tH@4`fh!=D&Iht#rvGb!oFNB$IgBb8G?;tqQ5VlGhb=4HP4*= z`S{D2DJ}8*z+<(KYYL*bT4I{w5~!tH6gw`zzZXbKX%rfnx;9(~}VE80Zsc?Nq9bsLCGiGq2Ve#ZIgbiepN-6knUf^1VCx z-o;FcTUYsHY>$-ZZTQ;rJ9TBhFWpF&BRrwSKFB9w!0K+UY}#MCi}W3<5_k*s*Kx%? z73KV;H$2Cepz0q@Ak&GmALYtbJRn9S2IQAELMA^TqRmx(F< zGe13ZqDgu?T^rq+C&?lS8JYnM?p?QdXh;4w)91IeaKXXK?*;v4G;G<(wm)s@2Bc$? zq$(xfx{L$;czzH}A3$mTnyQBs5b%@1_I5j{sbeX0ZbB_`7aYuS!n8WFM2^2{2$JXp zHCp?64H%1`M#Wa+E^WD}+?md9Jq5fbuc=GP;SlDtLS|5 zAFT)&)ntBEfKwcDnuDQP!H-=&KV!GY@FGC-(hjHQEGKXjP*0VYz`HWRg!>+LS1U+> z(1p)zcwxSpN#dVpVu~cmC()4R>sqDE{~B1Wc}f1pr`O2(5`Ih7Knif=*5A1eDTL~s zM=RK&qp*ysW$S233@3q$HsOqy&<*UB_z`AbJ-#Y`aiu=>8b)BdSF>V^XkQJ) zHFqEBts~;`b*Y{47P!Izb|jT8pG}mi&Q$i;yQG>kTSAv^$}(s#8O@s=zW1BmtD%(m zfMYZr{X^b}{$7%IZrq>5iy6?9Ag1qU`O@(D++P2?!7y1FtBMOIC2|4SnmOBYGly%w ztTgkFCcXr<_aeK(nZL@f=J{T2Jm6pC`@(Uzq_@Z}Z3|4)^`Jcb20s+AsxVRLTC}B( zJ^F*+m{W3*GHknl!A|#)3L&ZWxi=9PVS~g=wYih3!TWR5Jxf@H)PSLz>PEfUxC6Cn zf0(ff=U+(>phK@bwIf%WdlJsyhA5BkBRFP*{|WEl$z*Z&R$blYVp2~fhvJKGqtw+S zY$B%Wo4o1Bm(u>4;$&q|Y`L*1HCJro#I=7-^QZkuQ_1|nZuaFa?k|@_8E5_>638Gh z10z>0+DzTA06PvnW_M1n+7Z)*I89*U`ukhekO;Ld@7>^&DWb%7ki#wfsX) zh2+?sfvR>go_=TdC)6I8SDeAyUq{I%~noUUM~$84sP~ctGN@c9@r5klmz5$#PuDG9%au;yiJKywy+zI==`*BhZzG4>>itySSIaX!<1EZ(E>1o~(SQ_+DI`*0aG?$c-egK%+O!qnES@ zg&Nut4O6q8L6L}Q^JFDs>O9C3_B@Cf&UmE4QbVV3#fLhP@gl|P%Z|P_KLZefyvLm# z(iwRg-cPJ}syvOXvx1X{;S4PL4=h3qG7sDoPu%zd2id!Dx_6^5M2nGT-`(GB(4U7? zb{uh&hA4E>4Aw-#ss;O)&e-nPQ|7kTDR42NrG)2FvXem(4v@Wl4V-^!X-r?K`!`a`A{!g1>{Y3G)qyD})R zlgyJ6_<4yKDrjD#+;g^ab9YAy{&K$CFKawmN(2tU+(G$TqT)6=0>U>Q=7a}Xl*Q4m zO7nx~a)r55n%A37?^wqi302sDJ#rNwXR2e+W;F{6pO3_r3Eh;F%py)YCA#P6!$^;7 zPb^HQ%QwWzS*&E1CXUZ+@w->|w9(y~52CXmedvR0u(l&RvF>Ul!%5^d3eL{AB^vX! zCcO90{48)4`HO9Jla!3k_vKZWgQk1`H=xGaezX}v>X z^iCo-C4;gwP+%yg!#J=s5Qu^VTgx)3WWXYBenNKJ59rX=x^UY$4Xor}B$F=2#{J|| zL85iw8Ls1Oc1k2#`&7gUierkj-L^ETZ(nayA37&#@QDp+Vy~YxxYvGW*3dL=8Ud@1 z{o(9?hp~G6`*QQh7O}gOgy+u8q>s4jcnvofkGDAp6OPTh);>HuT-Y*^N2#j!8_9%M zCJ7S1ncP*4>d39=FiV?+^V!e|=(Sz))rMw3E!2>I6XgC@MqT6fSC~-dX8)_^T@X;b z^>*A8j)}V5LSAmQemGE%XtnI5ILra`X>oH|>sfBH11y~BW8;+ObaLjm{z}I27mE-D@80OE8s)q&^xLk@4VkHb8QTU=!|OP~II_=8PtZSE;yCRBGV4|a=} zl!S92T3{ro-cso8JrbA8`m?nRc*SeP{5d$&jjW4wV9J9Ei{V0N3S#7DH#xosx{_>F zOaa@E^8g@oNA)0d$s`>npfHeui2gKd_<|r|`*Vv#5{_B0@9VDjh6vTGp{64zp$$C? zWt5@E-Z7K8Fh`nV`DmHV@&CuxS%yWq_G_OU8iwxf9zeQ7LP~+9h{Vt!f*{>p(xHH~ zgrHK=-JsH-fOIGW!q6~;z_|z)^)k&iy?^gZ%hjiC$>9jx_;U!?kq-9A-GR-aXK$2mB^~qO#h+tL z#|oeDmQD|`5zcV6vwV)lwswAzK~G91rO;yp7fx_mh2a@0e`^84x;dOMdCVw`JZ9EA z{Z;cJ(xA@vKHi*I!p`80!bloose!`;Q3dju8l&k=GqWe|*>lD5XF{sW zhfIex2TbLZ|1CcF@88Sx*~Y6kP!&@tuC!Rk4}U$+y;FjS{<6JUn~DE|7E9Rqx$Q1` zZibp+qQ=c#oTX|@RX0QBgT63jRbXkGD%g5h(L8v6W$Vn2Z~yqug5IUeU?QV{nNDIf zsiAV*)=vQ%{8_hUfVdyA2_(cW?FE}s|0d#m(#xW?uFUck8`qmdyg#;mM#-H&kF2hf ziGTl5uMu_`Z{cd$2>YRVf4B4I+EsH_JkVci&`Hsw!};@iG$C^~q z8ya&iVTpHC)wlk~#F1(T972fcm^SMyYI~-tQTYUDF$$`}M<#LPD!L$+j5%KIz;KuL z5LTBaihm;aJ76|&+t25L=lxd%%KUkaaJjA!=$fopzv`d6na`b;2StYY><4Zlt)6)W z5Y%pywu{Kagi@7lXsuH&EURhavP_(gr)PaLX*5F$6AJ?%{cZQB~O*uxmoC6*PogfK;TKod|A4jXrizqJYf*WtPC9^6=C3<%QW zODQl*WFGR32u4VC8X+a`Jk{pp;pX<#aP+S;o#!eH@i=d3kMMeOva+O$T|A*b;axP$ z%Si~M?vvMqD2=Jwy9-uupEET)`(ZUF4ZIkJ5cKf^%*sJEpPSiMFZuhyQ3cLpJM#dQ zz-X~2=9wUOPo^#k!ynR7)#6{SP0bYsAIp;u*IOKUc~$yjjNcvR9)4_Q8iwo-u#zbw zL8&ZJb4Q*R#K&CeE=Do5jx)7Bb;h~JTD=;J-GH=(!c+HDO_W`MEB6(J@B_McF=p?G z3wFWu@tup;`-RYoUUUN-Ry^DW-CQE?Dm8;{U^T0ut=k4;rJY{nM3b%SxK94bNBbXM zjDLOwgeSL}d_t>FL9a!Fb12P5mia2G>k%|jG@VR80rkPzuu7Xk4=Pi{N_?6xr0Ny) zt0QwMkq&muk^N*t{fo+c*4k7{%$^9h(hck-`V#iDLArHODl)QB`}}{p=(>LPFP|kW zSBu|oxSR<>&b)-Kt#ubWQ*pg0YMwTeZ*f{=B7}gAW#rZZ4gPyOCpzIbus1Fa3p3{a z$Zz5n+CrLsQiJ**2JF5Z{k2C|=U_k}SHdD@r~phJzo5TcK5T!qn0KSW2X~00EGX^% zVhY$-o=>cIT9;4T&x#KQBN?xBRX7s0wT&RI4Xt`7vZeS+@$*~&2i33<|7VlnqMI>Y zet3JPcV%~OGP6Pzy98?@?E=X;`t3PcHId>utan0q^hp&Lhjkluk!+VTs63L*y&yk* zvECh<5@UdCDKraUBhfWoxolU!K*bvuQr;!=u`;$w2@UBMQ(YO}uS1|_?kca(7(*?A zM@=vmurpgzN&Gby44PSVkz?Us8n#!s-mHglQn6TBqs7o}9CevOA>s91I>(u>f_OtV z;~j1Quf@C0rmG)PgsF0KyBKp~cK#Lk5s<}uSdyoRMN^E%gBnxM#-#0!uA9J~ce``+ zN`VmD-kszEM-@VV47{9QcKOBLBlSOWHE^f&^{+GrZ8v@`87^5;U=^a)caAP! z0p1b5>mQ?4s3HaoN=zVe#{=SM*(6VV2v76K^>7haSo&G;S7X?zZOh7dp{*Wmm`8V8 zr`lD75uK%A3DG9cd{-=KF13XnLcIeb9HyLZ&AHYF%%~^e!m4M{cmOaugb){@0%oqq z$sqB&YGy{+E-HMkvb$ONsq$hDldRV>Ac^Y$APR1O2*&-rB97kfNKFByK6Q`asq7^i zv98)?v=rHydgkyBXG4NaaJDbC9XEXbClXz`#J)$+)CJkrLrsPfxA)CyVt`?fz zP9xkPW?eKM!PA($+AcOQrhbfg;|&h&=E*vfYvnL^{FA&Z#yy|tb|(~%1DC9hxki4!vFo2RH!*x8U7wcVn;;L9%VCZ~ zAV{7gBgr(q-mzC~9s30h(Q0_?!F__}Op7PSP5rmkicNq&Q z>jl%vdS^|SrrdYlhzGgKK`w;2?6h9o?-l72+h5tOtR`mr8d~rD`V~EV{g(ahDM9&7 zPZ$KIx3Zh#4*{{&jCcvu&tiTkp`p1P4l(7HQgTiCxfw0f#O28gPP{Y1xpuFeDS9=9 zj&NZ?(dvFQ+wUPr$@(I8W_=&n*A-OXW!$9W33WQ2TKX zqfRf@wdPameQAKJL&zPvG&E2D*B+9+zTkH!V`*4#G|AWkK_HDTh&%*b4bTwIdpV3I zDPA{iO-*fmtF!pZ;wrOs@cU!D7*zvvoy)06 z%d`756{g9A6yb?Tg-}{~*?X*n;uJmbaSocF#?ftNZ>~zD?Mq*)N^!!-p<~HItUiG; zSp;<;n_NK3ZB0!hKn?kGRGXDhtynD+KPD$+kjejJTpb1jdvise$$hq(E_T6tyPsu} zd7|NouQt^tDPRiUlxYCi!vIggScE3iZT%&GB^)}qA|x^^OfgKyT>;Mi-$Cqso44Z@ z{=7KX_%7{ObkO-(j}|@aF&4P#$2eeI%{^u9Kzzd7X{A_+CJ{qgzrHcKi-JYNQ+*b< z&FvANNDAfe8N_E%G+h%|oTz(!F6!dOoW%9wyFItK2Y690kFoQLbW8sA`~3Hr(hq*`v+QrBoIiYP%Eda*++j@X z4m1mR+qBivZ}|IzSKGJOYAbUOFwk|+E|+f0nRW9P ztAPC|a9Ag~YLTpltQYSKLy9)bH|ltQn*l<%{S{@|{`}S>W$V!d;HVK!eHc>1vY0Q5 z+m8d+sw5)Aj~O+Fdo%W>xsKWxDl_W*QXx}u4cYH_owfW!E~J27?7J|>LeeLK5ueOZ z`);{VXhPG-Wfx)SD%xQ)znQSzRnp1Gh~#qHvzuAZS;?_GA@`G%I;KT&l`~a4u1~76 zEinoir_fL)S`LU@Yuwl$H^(?ACjJK@q#+%JJ1Rkgas((xa?+;T35D|vBFlk1D$I8a z?|6BZq_Aes=V2xN*gb!j_LFICKF+^YaR1e)|1G#QH8#B&Nn0JUxlhgS8PdFRy9RqJ zZ!NUKz!g&zF6PD{{~KV33puI2MSj^*eW`#j(tY}+QP2@B_a)x%9L3bAWlNTQyxmOv zdvzavPa`?5SVdUqiP)MIxfXCT@&3qV*D;fymg7Uo&$Rg97Mb`fU>}TVa^!oSJc8?- z-1Q|oQ&(W~(}2P{^Jll4U&osdFNK=fq5^?AiGfm1P94+x3E|-PvGlvR-s;(TU2%2d zjGe&tH(x3InGAEzdV8qOGq7+d9uJIScY$cuH8C#J4#IM11$>(ip7fm7oE{bJan%I= zIXl3s%xE!>x2|kj!zYAf5>YLPSZ{+a)mG9JTo1w*KY=|s`xl#%G^X8Y@GpLgEGLQ; z5}jdljZI2>lB?19po^<5S7z3}DV*!;UbVr0yUD>DZ~AlrFe^J7z4w-$|K)uCP>199!%Q%)tur*y*ZePKo_+IKs$m_W1BUss4oihllqJl$puD zY4vCrE(4?xqlPqAJb+yNF%ORoF~F^_5c`5gL#er8e_0sK#8#0H{ONNRGws`J@@WSm zvT~O{#_}#Au7pZ%NKmf1xp%@p0ZfX*BeMOIrx!O1dxkH&yEyJK$1^C7NmUQ`!;%2| zVez+&&pL9|hetRTPBPMK#kcPfGW#6Zz$3~-XmDj-?cJ7i6XXH`=ElZdC!~<@LbH>| zlXTV3V~7)>DEnAF<@@Mw1tnY-q^7vjRd6xY17kU>hQ6TFyHNXcP4_vc8(FdKKElpk zZK0N_XX)MX$jkbCUS^ixZM469Js(`Vmw7Hc%5)+6mF2%=zyGzu{QKiEN|?IF8+%_; z)-U?_67Eoa5_Uo<@rwKtI%+L_G zLet=@lV2$sOf^nw2}JSe438{6W)W!0NdfHCcLa-iZyEtxMOP&vyg8|xaZDsvZ>S%` zE!*c(@p@gcp~=?@89R-WN*J?%ql0Z-b8dx%PlkB6tusng!aV=uDe5uLI2P4~Yz+f7 zPVrWCCjNUS4PLA%mpFa0cWqbTVMAkf~U(S*6e&5P)kMJNb)G)SvJle)R02h#>R+D4-HtNhQwCrBSO`0zc z>0x8rbUpPYdbxTAHg?7%FM*oLt68kAAriTA7w1-<5P|u3v~z18-efp#lg`__r4j803b*y^Y16y*bk7@^!pOzi99wPb?G! z4I~57?Hr1AQZLKc+;ipZnJpPeiA4bSm``PH{qcM8M!J@g&FC7I4CS&p@wD}5Ypo3p zMCBV){BBM;DtBTO2v{~S>P~$l6q3qx(Uh(h5;F1Ej`j)N-_z&Fbob&>9d+~P)P0ig zzKim>7M)R56N2-tgr=3VBqm)NFUA0=!SklkO0!m(-}j26?`ZOeXbS98iye_oYVUk% zW|8vQXAz;Ivh0>94O5LKzUv5i>X<3gt&6St2h)WLqD!a-;V#91C&YH)JfDvaci*t$ zqQZ(~{a;ML|EZGY%=TmFOB=0te14a|0|Iij=dVR& z-4wq5(0`xj^aUHR=}D0OT**}yok4zJ!Y)Sp%~>0!L@&f`NPO>m!idod-kBFt@JYjQ z@!F9kKuqPnqw@GGiOIuD2LQ_M-=@gjV-*k(IF5^p>*pS$2YsV~{DNyQ(ZlP4O4*q& z$e_&)b4a(6Q|DG`_6{vTbB>6Lt#&>uJP8psr&|4qUV9PzSdLP3{KVN$ znJ*gV)g7>|)x>y9taF!3NNOQoEdWN|2v7X+2L~$J)_PsdDKeRLVb{`QzN5o6fJC4- zT|+ZUWT>oWh?QczGB2M(MQR_~95U9-n63zhV-lW14%@d5{-Z-oMumVTlmYHln!ZAo z#dtCC8*R24rJP{c`{Zla!oqI=PxjCEN}v1n>(@Fs08cJw+hw>O{RtmlO9p__n*@C?hqiW0EDCLlMgv#H2GZt?>cV4&5UgQygwzU}HcYh{dLhUZf?tqdm1mfZ8EB{xs6A2lp9!ScWInJF=fHWo0(*vEK&DdIHJ+gjxIMB6tZ$Ysn_q?C%C-}KPULI= zwp&|LnpvhI%fUQwpw=`f|M@s>+hAKYhX#H56N)&;+GiQX?AAO0EJXOuibrYLmQ7|x z+V8k*Yi_eo0ll-zq-LvMM-x%3$q&AlN>lMJS>puE&V#k||hfqtbAvsKb-7Mx0^~s7T z_Q9m-u$a%0K3%t*l1xH@2J~?BLAYp_k$dp% zNdnAjN9NS5(DSwUS@NugUJLdr6UKm}cVfu{KK_?(MLr9Wq2*n<{0+~+kJ!vLm`;Z4 z!k4*4E_3-gh5Z2{{0Q(hK0d7a|K5|^2Scc{v-`nI`$g!;8A;%4gOdjx9Rf3rTE&eX z{(VP&9Z1v{6bEI&ww_jF6Nk6;++igzD7RnQv zy!%{6@(VV{$>2GO+&)_Ql~>T_x=v4(c6451BGdfljtdW5C778K6O1Dz={2Blu8W5u zkodnyXfoefj?oYp*w;~S_ben=Wyw~>XA`}p=yBCu-ZgxT)e2!GEyd91-+UW^mP{XMF;0eFq#?dnz_*V6IOK(ETZ>{mdT<@oPcdPeAXw;nX z3mAI9h!`m)964@{&r**DEGwEH14*Bx5aBl6kHTzmp%bE1ShETR%rnoLQZ5b0cuL;- zE(78Kc((t5QxL`Qzxd1l^C8A%ord5YI8<^v)^1ikeqyK6`ut6`9=<&J;Dq0{3N04- z6uakA5^{Y3yoi(*5APK;?t!PU*b(Tjn5E-KM(|!?gyXCRZ$m8Y?8E7zHBXF}h6y^1 zHb3_KTp?s&wEd<2W)iSbPy^wa+g$xc7E7q;(sdRBWKZ4aIiLwIa3^xE zDa$6(LEwa8%_s58Oq^!SnNEaiht~_6S^Im;KP5=Xl>z**qfqZ|;NzhjYCz%LPAx~% z(CYL(veOobu`eaW;KF!nkCsAR{zv(iGec)Q@7i=9V-++Z@zximNj*B_cN0kNvHr(r zBSK10poT>OwmQ%4o6SW33mPCI*tnZ-#k1lgNeu#>40$T|TxP2aKWJNyc-~g2X?|le z@76L5W3jpZ4D_Kir%B!i$vf=aa)v@q!bubyW^i@o=5SK>$AWnxp=y7HY({%A)5%+* zkd4bsbALW5g-%A`QRut!BiK< znIYKBQg&?nGW64rt__f;!jZ7H5Tjaa5JzuI>L*D_Q%qU>hVDPV6C26gF8;KB*$hl3 z0ypLJy;!ba=hBRBiff7onuTNM1f7fq$`uE||hE0%e@@u7eMU ze*GeeBEu6=4zBsA=ka@7IZp>>Iy;3Q^#Vt*M))4fomtN|!k+lpzZ2+iKysTc)EJd# zsuUKQg%2)3J0>RTm_eQU*9GjvVIElbSa;?dlc*KkB)`PdhfBqU^kGyznV4~g{5t;q zp(>9--p_-Km@4mwHk*fK155J?n1xiM56e_)=qC9oxMaDwO|-N>pBMb!)A8T`WhLD_ zEJxn5XbO+TcHzmqXh0qToN;|HzP0ijn7P$qV4kafYT)Y4IC{*W7pzI##ygt=Ctw@h7AFl(JK#e%fY+vBaT=Zp8C)feC zCXwOF895v^&naaI#*Q}vE&jB_^0O&LOM%RIHChk${93f-7Rot~unzB6xmO^F_+hmmZSJp9_xN$KB>skV3!hMN_53vbO_`jAP;smCfmd&3M zw(XB(OU^3*;2Vu`Ol?_sB)T=qwtC_LSPt!hjH(HmRU1pki$OAifED7)CWxnkTv)jB z)WH8nCjRRk$^>x`V8Yx##1g?YFV=kt9&BcHweC5lz6eh-6+p8*vjo;G@PwS1{hpV6 zm=o4IDa}Z`txX^{E^&8pK}6c{<{n_r+{24ltwtLU-4p|aiz4k7lIU&>EK zonsBLF~=LF7w9tnj`vvV9I+qhvhWe5yIlqQ)QP^mvF5{71u%>aE~;WOJZn-sGxuj| z%ER9>KM!7p{|NWvjS!NTVD<;T)erTZlA*0&&Lb)k32jaej;4M`SeahU8Gv96zBs(P=WRi02 zn%p$ot5-w+3a+#eUNqe%?8T<11A$_Xm+LkMnS&RGv1ypjg1{>>UD`5A*IJP!kbe+y zz4}JFA_VX3#C;ECQQDeO+&tLvOh|LE(Gs0uCMiI&sAfJf=;6S|In|SQ-I`&_+SwfA z;v)DBd%&k!w79@rw%qRTtyLN0YBcL00n`r2_se$Yo z#%hpyN{oupFsj~lExk`2UKa)+0$Cau;oYEth7lO=fR|uGAJlH1d%vI`Rg)NHC1MpU zL##B*!aY*&v1ZmrqVJ|KG>}M+&|R4P$K%O6U|AW%R0Y=3A9@px+oE?{%^F>D9lJ#= z7d)M(9I}je{Y351jxE2kW@e!=O3~vJGf2VQ6?L$eN`3wI?mrE|JG?(H#`%i*Ed>Vo zZ*UtGMqm0}bYYTsq!>ZzS}dyWQv#t+$V>E!a+XMpWAjNCuam7N+9I`dg_tpGnbZ6D zh2oUMr0uok1w+p6Q(aK$Zq>7JLR(Ud;MvuS30BEPk16;=mfdc4<|zNE?s~DUaUq#N zkfbhFiOB4d?5T-@_dtMkZJ|Jft?$UYXM$#LFwxBD&Nqq1}Q!qwrlcCjZeLyG+q{$v^TeY}< zFZB1=Y>_aV12c7CGvO=KM&%&nxCu7fw-=;q;Afwn{%Vd7yWP_NK)i1x83=#>LF0w; z4AXO2ek?Q&WQSnj{kfx!2q+;0ll*h9TXmGfbTYpA^TIqkj)CNF^s7}QM`zp-d%4q43 zP=|xv;hcLd7qG`*CE-dh=NUXUg|BqKjB>y9z+=MtTe7O%V zm=_hv@pLmo-A2Aub7ghhA^$xQwSG~&Fk=g&el}OD^oBrf2w)u09b>A2h_sAzXrRnBWuO!I=qVk^Jde9lSo<`AN+calZqso6MOK7qzGb=*Nl#4Tml|SIZgW>@N3P99Q_WO5q*Lm0K%NF?iF!JS_?F$S8q!h*)ah2Wd3 zQ!_7}1rV?(om+qkJT3Gxkl^u<5_|e??rPIipD$)li{8PE2}zJ(fC~ZRsHe{RmY@TB z$c%~5((>f^UC<5hIt3~p=3g>RkA{uFI?R)WY8V@M=0~aHesp~&bGCJz;Y=m?+S8+= zC9d=z<%`NkrQx^237Y2hkEenr92QNJ$?;_Fn2jbFpeirDG!hwVj^0YIG~}pQsDWAX-nU73VFTd10w^o8ZC4$E@OI&=Rz^6{S9cI%QW=6}-9M-6x3`Yf zNb*A^zBVv^xEE%(Zb@ ze5^d*f4>^ER< zCh-ma3duTZKUSXpjk6f6Cmr!%u`}~Hn6HAR4J#n;%i42xV!9UJeALd5wC8d!XFO=$ z(*7y*Ju6)GxR1Ms~;{#ID&%dwQhxsaiuRR*~K@x`d| z0x7pz7arg3c>hw=K|{0xJnUrM)_cUj6hIrs28=h?X!7Ehrw5Z<>`0nvPgv%5gb6K}C+%nocBQP1 z-O(D;pnyb$X*E6m-4WT8_}qIps0Jw$BHj5R+`Eu?cXYnTJMDIFBiypvvTc40vW*TU z@x1q;icd^4N^i#+zH`TKW# zPxad)uIiq48%{F}iD#;T4|@{IbHrYZqPp{US8v3@MNO577%#-^YSGu?#Cn=Rl70O7 zd_%>%h3=l7o^OT(n$waAAS!m|y%zswTIr$&Z-l7Ob#@ffM%eAVcEA*xhPo1K@zKW) z-H-`K?-u{_FvCIw#-jgu%sf=f zDJ{cZVuGs+;S8GuTM6Z?_6x&q2U%7Pqgw==l>kq4R}Bq;@w!@U=+8j7r^HzRvVP{2 zDMdscpp?wwUf@0;Lq`#K${El`tOn(o!t?(xNS@Q6_LzQP_Lo%}e5ko@xThg{EOzP9 zTSVoP#zgU0%-0etwmpj%C)=&y{99Vd%z%G}&OIfEk=v#o#_RL41L-b?zTNS3 zwv?c?yz48gk_4sNQ{{AJ9^NfxL-Z2p>{e+Q?IOKlwQDQD3BxXY}*;A?BJK-~kN-pE`?aB4exzAZqiOn=~=E<8y=`mfD_^Y@!Us zN5BBJ9L8=)G@)!#KCI`Bgu>vWA~XT;S@=PagY5T2S-)ck6yVN{PpjGa1VBbJ9=yY` zB`rJZCaYl({Xa<QyBhvk!>Tk@df;xt9FTG0A>uW#&gTcTM5T+@menHV3qa*T!Al z4($ObFkREla_s))GAoPVpzXtY2dfHE`rA_ zrp!TghIJ*8+j++kdxMULTilO7>ApH2<{dnU^kRV%Cf+CWj?Bt&1kwmnm~hWwh=!25 zR}Jch?;=nQvF0ixvE5#5^`37w$F$mzUN=dnW2xxUX020?5|X(F;N)KI6KddidrXGm zLX?!xbCBxzj-Kb4u9fnW3-m|$yA%y>A6%c`V*$k7(=``2_wF*o5ECYINTE9_9+bS! z{|BF6MrWy#uEse{BB?M$Ye|o~1Zst2y94eQxqjmiVg}AVey|O6yaq*KlHB2E8^D*; z2E<>wJBOgZh_2E)H3ex$wigffgNZ%sl~flH~88dbl}c zmO>%MI2@GK&@HsvaczZqWQGdOB=MTLM_V?2l!QTcSOSG`Xkk}FuMu>G?FZ-xEzxS= zd~l_2wwoUTGb^fF>=+YM?6;oSEKrR}0&N+>h`4)N!G|{*PD*ErX^1{bo7X?{k1xsJ zH}rIujp&xungs6wxV`Qs0UVRXg^g%+Dy~4f68x>tbl(S`<(Z=j!Z3ZBG&--POB+?VUEr&vl_~X%u|W~&rq8Wah%iA7i# zPG4EZsWb7v9!8rzZ0RP#{)S-Dv!>x;s<(8u-&a3Y2LNLyZOQx6SpQg&-98%Q+%1ne zVL`zfM>;|B)(^z8pv?~4!Q_vI=JUEi5!SHJV7+GAbq)ZhOm;{`P`c@;RzjPx!HyFJ(=94kT;Y>e~G5&|SQY zh}{MqzJjde2 z7P~}Fu!+Dc4FgxL_wEakaEu$Jgcf@9WhMwq^kL|$$z(bP{ELdcH$HuGSx}f41NIzTV9qWtS81DC-D94 zQ*5X+5ue+}x_Xt4@%7uIz?r%^FbMbL7zO)ps!4)z@E9k;0M8wES5*OwhAd9t+TT!G zn_g~QC4=%HS7Y{3g0y~D(jEj!XLg$_5_iQI3nsVKn7Z>*XCgGS7u`6_bw`@K1;v<7 zqdkm{AR5DTKED*^gGtVNwY2A)^C&?RXpoyxiC=)irt8<3O+~`@7;C1r*Un z@s>L7?Roo#jMuN(VwWe+CYlVjB1XAqysgLZ(v=JTpsP`aY#_{^q_B_?MQyiavCu;w zPTpv@JfvOJn?h#&k_X*c6O<4}LZpQ?p`zGC7lLc-|)b+{)o|y+^l;CxYmk%gv zD>zg{DUI)d`;uGcb=lp&y}9}(jmW$vW!FfhHl4Xf&+UivWlsJLw`A|5>F#kcSm_jR zpcM!Ofpm{5f`Y;#Bhe?`r@^)93=L@>_TWrN)az2vHa(`ufi`g_Ky(&S2269opg0 z#jCHZ$;PgrGMhW-!V*<`a*F51+bfmu)2=4x)xE-Gn>D{t!iyu}zF%V?^%g|Spzs#C zn%+7;GV>a*&LY&CYtx4&)%{Tj5^^P~vuKd-4&p**;VMR4roJ3olM&m_;Q)~d;5G!R zj>M%Ix7frNxB@!G2y=&}60LI*6)_T3^gfPj2dC?Jg?w_n9vdi%NlTh$E;rBfM+Yu1 zjf_l{evo3C>G(TNA*qWH{++$GP?wf1E~opuSXK-#XX5uAq5+7Njk%1Uv;_K8gJfp# z`)aOypXSd?4aT@XrfR0=Epak5YLC8^{3QNbL%aiyRgCkBm1RNADH$Nbn7;m09?}G! zkBv8BxU3GO;Ke^$88mwZ#}e%OOzwaE@=@E{kCc_sk1aVT4g=h{P#fn`c_+;s zr%zEo{XW!8`wzG|HFLSP*E4laD?F_lc_ERbr`UhsBAzw0WZsqi*5-5OJJ7e!jYvzp&f#(}i%Cp>uPHCE&^fnX{^w zT-x{W%!0iZ_XDR>9Y1^4a-el5U(;Gl(mDj&RK!4^-%Llemr+F<%F|(klWWVJ$q~D< zo;rV1QBLE{88atokLmqCmmg0^kb0LbcFXa09mWG$(o&oh0_1yx1%(3b`8lIC&Xf4Y z>jec|YN9lRCv0HjF%7n|N_|R%aJ~ZK+giqoV~yz~(z8wK&FuhJ!qT#IO2T>Wo0Cs?2Zu2&rD8teg_LPT$UNA5z=RIHXnOd>WEEfqoP9w6z4iPbmHfTst6gsr zJlqgmzj^1z9||2q3vPpq67CluR3bP_VU?jziF2jiHL znEbyf1ZPxp!zV}ezLithMUa^|#U~uqC@!nS)b|$e@@OSx zg=j4+e|OehK8anGc)*Yrs?Ww84{_-EW%H(;bFNirX;9z_h?^4inwCG=4%ysXUp)@r zwVsrnpV~@~J(#)>a~>~a_S-CMqMB>eEwC^(?XwxbwDBLt@{;3(_LwGfZ(H-Nh{?2a zLj^wENmktZQENY-22~H0zPS1H6wBA(+RFW~E9dHbZAeJ&MG;Uk*@a&N8D`@VjN%)o zMfT_x7$Zo~q^DITbW1@;0ajTSG>E)NoZy2`p+|QXZS* zt~;x}(b0)d$q3b%GeW79r*>*9KZY zI5=8qCJi99Z{2#=#Oz$iIN_Z$B<@Rm@wy=pA-gQ1s)D;K z$S}5du`WB;@4vw?N4bB!RRkS$-0KLu+-a)G+LR+0oZ_yNUBX1dzx=xMFnoJI=Wh%` z-WDeFnbP^<^3|fPis)5W=G$Cn3&=wDk z6`#s4C(xhGOOHA)zT2V_jgo6b=1%eIkgM%K5i3#`EK83W2Cp||`+SzjksGwuZBq{$ zd=)OT-N=GZ4+A$yqaq~Rw{%tMn@5fFCz!6EA!<~Z5AB;d2Yj!8s4O4mfr82k+1KYh zV~#WO2Faz>(d6PZpNZc!#5y~c)B+WJo-aZPRH%uTfg|EGnF_GkBM}23S7}d@?*bYk~%}lp*Iw>vy4db9%@ZW1U(^=6+?Y=ol zwpl?(6EnGqQE%UH4P~ui;Uph^CP_r^zn@A*aW8{FGAI5qjY2JeLG?Q+tSof>wOWeN znk*|KBU4QrmI&sAF`6+Tnrlwn&GS|aX0H0-=z@ZZ|AB?^x4KNn#%%l@Af(9_Y7#-K+DNIh@JaLpJU+DY2JfP0W8ewz8)){2h~c3mTJPf3fpYqSmmb730n zJMaEa5p-K@_WcMii{^>r$;AExO(NBPgt?luKL2ASCU#gsefH-ZtI&&Q3dAYn!H=As zV9NERwY)=JLhHZTsI5{p{$ zeda|!Sit=wcr1o;N)yP8ytzf#PA55uQ^|F{Tx?DdnPN)u)5&?KKX)gb>LRB`r*pj1 zdf>H#wop4|{m?xj3UjZKfzREx2W zgucV!1?mF1a+Z7JD2FcrmG|FwRQXjo4rLO&Pn7*u$_?giPo^%s@nnR<1j&cF|C-5t zo0KLRV#km+!G6FbPkXwz%$!kcK+qx2_qoXI66;)f%&zt6BBu^^VQ_0XTDbC~#>>oz zq^QI!u)Y1WfF3kG4p9K>)A`+$d+g~zx-1`T=Wmel%xiP#t9qE`A#)fm7wLMJsBn8h ze-b?*rVn0#_mH?K5T7B%b$2 zIQUlt_-h%(Z#~yxGAw>i?W!3-#d>d{|76BOk%s3tiNBL9$m2b=)I$>vg`ddKRPXfa zBu^7=+LjXjqa(J*v2u#ZqwVYbjx}~VTl07ZHzX#Pv>j-7uh)m37PAww!=koWa3?&) zNl97Vb&Twm+e}c-_!xsxP&&0I19@@lq+K%@GkBIhf?^*B4cOM?lj+8pWRq&_naN-J za-TCsCXXD|BXL7Juxr{W%h%6*5Kguqhp}w=1_pS?C7ras$0*pe*|Pm$L;V7gk4+j( ztq+1M#W9H;>5iRtaV|2Cw(?&M+zrrZMI_kI^`TN)l4B3#5gbo>hgup!CXlTn zhFuUhbL31<)b@LTe7g9?$0T$y{P=Pq5#&V@=YJp`DMsCHsN~*X?aO-rN-- zPcHq`r-%dPlvD?eR^D6`)M&`gs%Iy?M^~Z@{fy!2j`kPC?yE%l;|jmWeu{|5XqF4d zQVJCiANG~)=UyA@P=uQzOE4HqeRSiX!nDkgnFVCvT^*=B1?H?)CwA z+#SdHPe7S(nN7VVF8GlV%ssYZ-rZ`hOQ^<0z;-XZvU%f8*VmQ$oLuZJ&G`;usPKdKg+#zA*Gj~LhH#8`O- z>PhKHaoMv%czo0zG-MG*pV5lplUkCR&8QTUyD~Q*@Ty_@5vMH^y$EP1qQ47}DU0)F z8eUaSsl4x+Z67Gu%ZyEQXrFT*Yt?HNt`y;_9BYN3>^{aPg!)|9U`5uOGjC?pAf9aR zcqXd;u~QGoyleFlAqqtwyxS={P+Q1SfHi3HH4@g5)tpbxJy#szt0qk{%FP+>RP*!b zZBp~~ys!hf;hCz=7lnduFYHQqIFNgR)Hx{ZHLD=%<2 zYp=M|b-jAQ>)1v09>1xkp!jHQ_Tx>y47_-<+e(k`GmbdeZ0~*j{PEI(X1P5I-=A3at^7j|?dAoe zXRtL(=6R1mx>3~Xnwv!FhSkTW;b5-(4PrL0o`V*T_(M=;}CGHrm7M-$V#e zSUcz7AUC9a?T;E$2fzg$y{qBkg#-< z`;%AC=*6t_J~PLnAJm9Y_IW<~U;|rVKR)iSi3pQoLFQA(twf(bz_yHe&~$Y=kJOIG zb`h!``$&3Gj@^ym22ptivKXqN-(w1j4&~>YaAFcSg!{@KQw}0bD8X=mWL*W6pG@qN z5W4~)$dz_`yp06Rd*Bw63JI6#l7VPk5saF0^x43Lx_*Tfc8y>)S#s^hhy=jbbF$7( zv2_K`dZ;_@D;%aI34GX6{ettGGVp5KLQ;c`z!Wr7zwQeAJ-CJC+Y&rr{cVb*7!=)e7BS>|Z* zJTYi&3&Kwtwri4P!T%@mP0-W+U+&_vflB~gaS-rvMieqi5k%7Yx-a}ymq!@O*etxw zvdcl6cOQX4WyE7gide|D}cOj{c}K%w71Up8px-f zqkl75qT|3Pcoa|fz%D%U`nr!>!7?zUP#sXEKjub8Vm~zdZiW;iZ`FETm7k%KpHLU} ze%*>fX^gYJAo;1qjA7l{g_!-C;-xOimi^dm5;>9ZnECeVGeI|b;a1q5w`?h-S&l7% z&P*itmDQ)EBa297tdh=q&kmz*H?OYb86UhSaC%^3v=<)oT8|S=!RI_Y?+{GoZ9oEG z02W$KK(PV_R@7;RQD6bbk&+&7jQgh~cq%!;Kq^6ig_p5_wxA~U&eVBsHvT8;9;Q1B z6hN(GsBur3vPpzOjW&#_TOpDAf^|{2Rr2*}Y1o5_yf?aEjFhA!R;7!$)H$f0Ei~1j zl*Q_@`!Fh%t(32{3y&m-K^}<|gqIh)$?A8D_AX6p1Ib|rvEK*u7p(Atjn0+XAmA)E z3OeKto+QMPL+M|A(|>h~iEn^&!IyCq_R%kKzWOg6#=C)HbL z#M~y79QR4h)w6urIoZAQfhG6&(E8C8i`bg&+9aoZq)i8nb(>+OR`$G2qR;NbYNqW+ zbG6eo%;o6u;hDoerEjHbPki+)pTY@Uk+p%SEO+M!yoYrBPUm7hwNbGS6^ejb-Cwsf z`%{ruaH(!bGj-4bc$E+E>@b9*;abOkbXH^~MNdw~s6W<@xauVp}S0 z0*z@)95D8x5ZmUcmcxqYfkQf2H@DEa7pO(=j9bg>FS9+r48do$Nx>8=cQ_7K5J9_$ z*Zu7OPEY77QKP|A*|%ByW`bw=dO5tIwvqJOq=r0{GE+LyCqMEa^ZUprD)(MF(m!B| zF!`9Eh!so2HwsNT{l}UUr(NGvsRSeHS;R`_NglSzFrB>d zFnA3=JtM5UYNSI-S;+S=}4Mmmi@9AFNdO{}F!dR#|5H8NX2Fh_`NwG|L4?fC{R z;h$E?bj6q(J4-xjKE3rYwF-^BS~Z?i;QET?YmvTtqfLapV7 z6;)!sm(RV|U9uD79GLf3_%UB5gG_a5h^Y}{lL0Tt&Z@oM_mJo>z`8#RfG7xneLjIv zH&x0x^rx#nF6RIY#J@V3607FTuCwSayq`r&n5PPX=xHO2Li@F#x^R4Smphwa)fN@@ zOn`^CoCV}xtK!pV4t+Af1#G2Z(`4D;Z>~z=23F|1v8$E_S2%3+EgN+0vLbes^e#le z@Zrh#8__+kbdD)WeJrI6qw4c+QhVWlt{v5fF^p|af@!EcC=mD+ZAA?vzg819$P~yx z49xVm(VoP-ppbfOrL^jG;JhG0;8qngUxqoKM;;#foSvGmhUE+t-`3hZEV*b$T~8}D zJAwgO`jJcXuh)mCjh*ecldRV^A*{;(-Vq9kXG$k%(&AyfBbOdKNEcJ0XhSy4?}&Bc zsAH}8;g(6WDcU8lzifm+PNOrMsjSgwRQ?}XZygnN`>yR%Lkj~)h@`Y4A>Ap`An+(6 z-62RfLkfc+ARr;#qNH?(2$Dl7DJcv{Hw+B??%Dg@`+dIe?>`sIrEAS+n7QxkI?v;n zRPp_@kcrr(qjAV`E5@>-cx4Wog?m~c#43{hA*?B-Xg7EeBlX!#a-j?4qhBj z%%mv7w~n--%YCywY2cs@>t#V448Mj=pz1_OV&9?dg|2pirA_lM{uIgk;BpQUdoHVl ztv|3g+-#IP>xM(jSAOvJx7VxlnF-KM7HK=<2kpogt0wM@6+x0boDURcan^6o{y?+& zg?iW5jfAS@Nb~P38!8Wr?-|#r!R>JDzi2M>YC_kL-^@F$y+l3Gkz|vvkWps+~^8$4r_DL|IxSmOe2g6&dI(sV7p3dHD%$n z03B{``7&JDk{}b0qp?I>Hzu4wbc~<4Er=uh#wfK;b5N5dv)^`%k`+~LNSiV4Qkfh! zuaKZd5m%UQ!@VpgvUp4?o+m_ve*+x)@60v=ThjxxPP>tkSOrG*XYQEnvx)lMs?gq$ zZ_#0bOQ5fV2KfiBVGpFu*TzQsGmByKQ`K8iC8kb#1jJr4ugv|G2@nl!WW75#%W_vy zsUMDp7H`mt8u^7|Z?Z7xR(Dm3zMRr`#9b5Hf>DWu1 z#Y2t=&4)210^Trs+_h7{U zCM@5TN6WKKJACmwwkZ|6cHw7_U$!*(uQlOYyaLq z6qJ1xU2WV_8E>Ybtc^^Y5GPhjY^Wrh_j(MN`VN_IR)cGAo+Fu@=cQ{hC2V6)rDT!F zm5*1j%IlGZcIK9AI>DD&s}w4m%=H&RYaN$9H!k9FTOKm)ciDo^Uf=9=)FIdXYu_!( z9nEiBIcTUUzwCoWQS|lsWIpLwN7|}zugK<;Q!&oDbzktFoT0x-2;%>;%#^q9W#}rD zskj8QSj4Hv;>~f+wf+qFavC~lb?RMG=MY*y;h^HRDr-Odika>oIp3b&Cv%*HY1|6r)SEk7w#s;1CNkt3N?7bhyc78dH5HwEmI6tBZ zq6ixJGcF+9b72*H-G{O%+FL>J?iA)UiJ}#lqe5A(uaI^thOQL0$l9hgXcp z`LWkb=eKzOzyV+jJD*wpe}*(p=aJx(7?u)C^}r{JH)-0pw$zd-QU$Aq-6Ba}J9` z7t)nmS8m4rvSEB=#I%Y@<^rp&Kg5m=!p6H{^b^f2f039G@Lr~KI&5WMgT*hn;v&?e5t zzWosszq!^aUU>S}h{btDxo5&zO?IuBa2XP8xDX{V{4y5xr6`&Qk|&mi8n2SnNu5wGsE6oq(EyOb0% zcY@5nD({BMES(yG3S-*0n1e1y=bo8F*_Q!yRpNGho;-NA=+(}_!OclJT;;$8pQ zv#{n-=GY06pEv)yRKZKchUiL!afE&#ib|K#6_Y<1Y7BfAq8Mk8N3-=baczD9oN!7F zEFtWVuS|H;nT%WBMK9yi`);(#rq7>(vaPSUEr@A6!?!TKJDNJ^?xE1)3=$@~os^fB zD}lf5&NOYH{+wX94xUtw7DQ;)FN1y}>-PRj3ORL-T2!#hYh(#OaHvn!p=0`$6JASt zgk{`%72Lwd^PPnO>UMw^-DKaf{l`np^*;M;=Usdp z+qnXLUH7m%XO_;&fpSGmhH0erdZq76q+*!|7_#S1>U(dAU=#bF&G`EBj) zxDaSxu`!bj1p_(y@}S~lthH!v$dCmf;DMZwzbEsW+Gw3j(}L$kI03o#=WDfm1sw^z zW2=f~l#i4`Fz2n#6NfpZ10-|t4Ve2=Crrwn)M-`N?R-230pY^nxng3hML&)Z*$;{W z6Cov3bWAw9?r%bCf7dyam$x>KFkgqf5;hMI6tx6dQc^CYm1P^?@2I6G*(VGD`du1v zH-us&x_Ni&+ejMyCyM1P3i5yE)5jiT%Ee)1TzM>#i?LXfpMD^Jri!LfWBld7kel^3 zm#mq`h9bW};I{8hu55)52ChG&pO2Ke#drTtP+Yr++xttuch1y7Hj)EZxG zH@$hc?be!N2+K`{Pumy3IXB$DKm;$;^K&-LyT{b6fur}Kv6TXR+=`QUKoWX0OpdQf zY^P)#b6I9PovSs*mq<54ohH+b7m981us2>D`Ra1XGrOZrE~u-?$@z$`NoUGG>qBqk zzY;GihmoqNG?ScVAGAI7+XFMHV=F>KMDX>|!}XhVQcfJr`)Pzm0@Och@AdcN*lDX8L8ZdblWPc)Ml{;CHS1}j3DHzRBHWVkD?U~gO$!~g{?#ap$sjh&zzSaK z#Lj3mosubqWGB2nQ;gD1T2LZj>baDDDoY85`f^-n{2G+|o{({pZ9`AbscDUmL$7@| zap%0V+W%}7Jt8V<)7iLjR_q$;I%)YHXuc)QJ@^jS#BqL74tWm$q%>AXP8o^Al$ab= zFSz?P&0?y;WVt)HJtF#;iNFF0f}t*2$vq&;QYOCLZ#aFPUgkPi z9>`)Gj|t-qJwoJLXm0vH!PV~|W7$KPYy2UwzjY1ZV-OJ4-uHxq4`R$1;<{q@OLc+< zly|V)(*2G8Yensm%uaYHhX)1$d!%!iISWRIY-{_|iYE7!@&iM*C4H5AE%w|p-1T_l zkCxl8+9;1B^pyMWc`{Pg97_R%fiPBCr;&(dgHEv2u@G$2O2zIKJI=Ck9TtuyqJPua>jGu@pKEN-mS{C7ga zm}$R7ww4IboRjHUs4aIe)N;IO9ph<^{zpe_LkJeHe&fJ--G4h46cy2;^}dUyHNQ{g zl9CuA#1{+I0I~rU;Uc_Ps&i#}pKrb3_pcM8+Bp!3KjA&GlPiT>rE@feY)#{N=v3xV zpjJKXk^kuQ8g%xYDEKY{kL>dsSUQgm7HFS(lg*i4=gPUQMAThG-gVjdLbLE;&4wrv zk*wUg?FvwTv#^{-xg>y0s9)r|&LGPk#xJE*2#B``DAFTLF%;<2)m;~cy(m;_t`dP; z7qK{;nPe3s|W+jQ~njuS`o4X-GHGhL}Zw&yRrdZWEe(XMrC^+Yk;{BX=Ll#*``N;&p)Y74Rcs=ifvglWWl29{kHSa~p0f+ypvQ_WkaZTps==jo*b_~MK=B(%z{8XCi z5~(n^!FBD1aLd%V3oO~!U9*yvH%Be8*LFA4H52XCcF}h6)m`V&e`0(l000NhDTeY!V7($h zv@mg+PG@G^k{x(+xrlJK43la00d&1&xm@-z#y=bsk;hk$@||%drDt0*2qTT~OQjW! z?ZD6a?9G{5g>mL$9?%i1H;*~ye0w60{PYJIq1oAiz;#G{uK~1$woP zjn}UV|CF=5Cp(m4(`!N?`qra@yx>w9Oz)sBD@= z_W}+Gd6T!O404<^kx13fe$b*8O=U|#GeBQvGvxZtJ4G%Uua@XNjKfOdYG$M#|H4nF z;RY!qwH~gTM<~EtYfDmrsF_Ih3#PMw=Kp^Tk^ggdBXoo1waVMi(Gjb@J%hA)|0UtX z9bidI*jo%|5vJj^qXxP~=fXb(w2w^cl-bK=$|4#`a87cRy=0I$Y*i zDIxw`lz9Mg;>TgUvUE6tJy4xRKyZ;<%=shHm6ivpY%m~0v5!d;-$o+O3{l9TOdNby zv$I|+9qB*wTM*gp*K+rgPegLcneMdX;N9z5D>qH$&2UxTA0PyVoCzO|KG5}C0Wg}B zpDE_WUU$@VKk38NV4wIzodA7futOQ;v7K^SAlzl3Tpvrw4)CS~$V$KRv ze3yY;iT8%_;X@ahK?g?ix0QIa01fZMhvk!tNYWmYo}D^H;~-P0CqFf`MUB|Z+(5u{@iLQQ)e_|g?PNX%d|b}L zf|F+^evPt{LJp8MYyb8-0O6@8$5oa{PZ(YEmN_0(5|Ru+&p$`ESS2=Zt)v(N7`S0U z(Iq?Dg0YBPmED!G{b$yt`MiFW=F9kS)GKa6a)m%s-Y*H{E-sTImt}a0qBMmZdc^8R z`lseA6l5HK6_b;y$-@P7^c0d6_uUDF&aOcx@paC(gV4+HNt}C}ESaoeA_^~FY62Bp z`59c`qJJE<)l=y__ukkQ1H{+pHeB*@&llnXXda`*uHy%$Cp+Fj)| zes&f!$|=ZuckrNz0S6ru8k$J-uQM*@$*inU*sRmi(n@JUFp8Lzw0V<;@??dd)+MF9 zie@6l6INUPdM9&5Dmfw^U0`f;35GpBUcY~yB#ZQhkN)_waJ%MQ@V2Jf19%V4YaKJM zjmC=dv9d4TziTS|ZQ`@vx%B&kmaw;=Cgi|a4fi$I&1v@a;&;)hN~0E;MNr>ge6!2M z#qJC%`V1M2CEUS2xRS{1jD@^&GxyzCsfYkl4th$PHyIP7nYv5b(Xtt&f0ca1@84@? zou}TEe6J_K!xM(xr?NAh7j%Gg-da^9FcD`CK59+;(<7x+x21=03u#ysnIt{!KRtcg zz~!~CtCxq--8?6t(WY%7TF0q~D#h}NX|M}*2FVu>tuML2VZ~QWh|eEh{Rj5$GWBRk z`l;V`qv-u$4(K_5ZFR`Zb;E-H7w3TPp0|DRLBV{tC@kog{H@LgcyQddn<7X|O~NM0zc!rhNncp?Tv|x3g1dz+V<$iRkN7)iUb(SW=Q?(y zL8>xP4J1!p8`Z#rz+?=WDm~Ectu`8xNBmMDaf^y!o%ehpg8~udoi7c zHBwZ?ScC&b@w2zy9b)ITyZ^Q_WeKW?HX0&uBjv%v@U~P^1)P)vrV^RlBqLng$1m5? z??o@`h0C%REdi<}A24D*=MBP20u_+Rl#PiG*;&`JS=E$kkf&tJAn%qApfCT==aaD^ zw-__n%sn3%tpT*;6#&Fbmibt**|?TGB2Bn%-ijtWcRV9!mBB7O=;&gFn!{RhNKvT;AhV%^F#pJg`0{PS2gHC0Z`_W(bbTw zuwP|Zm7aUoyl&_|uCiK$F}=m3`WhJthFcPUJLTr?i`2%bMBcRokg8L8rthOA1T}xc z9ue?I>E>rEyF2kpaoyV!#IC9u9z3F@JD`%Opcr7O^1xuOvcS#KDB|&7ZmRp0?I_2s z3{V}=VG25aItSc4Un-j4_TW5-mgk8WZzUC@>shKB{B^>P?&q3_Il0r2tmI=q9xrn`UG*Ao zfbH0nIByWimFD}p2#TSZrhB|@J?LElrV_Rxych8~5?u%KA^KwCMLTCO<7CN=aX|^V zIcKiDk$cLkN0OwFYx$?ht`VL0x4bnh84m3v`F_5qV?qY zZpwVW*OE4T&ea1OceedYxIcWIn-+*-35zg9Wr_5M2ob0W|I~~5p|~gv33w0{P8itp z2eVKusF|O0$Dt!pj3^EkO2bL>V|HaAnL^5@`$bc3o84O21Eox9f0OJz;OkD38Qe^6 zYSis99Eeb`7K-af2Be8Qo8Y za+ly8GKGhhkfk+YwKX`}r#xH2#{~@-I%3c_+XMX##96kZJOCi>+$#^U;vOUW$E?0i z$9hk7glnzcah#C|g(;9*+0;ij8jb9e`xz*&zb}*It8j)H5 zpR+rDqx0$8@%VfFcq$vmpi4yJo7Ndyoi}z)I1wW4aVgt^iD z(jH&|ho;H)v#w{Z^^N@@=Wmx+j$g>6Zds^T*}3;=?oDlc!gkMNNzB0xPlMG18022n zNfEa}B?Qk2g}Z!CUFrLVXiu7Ij&O{QbJmV69ovm5FWpLlYsmW|KKp$UJ?vK#N^>H@=HA{EC948FF5?#*o@+`ee$tql0RwH>tp$~Frc<9OY^*3qzn z;bXx)?hX?dshLs;!SgO{|+R6;#y^xQ0Vqh|)ZPNj>h8Oy=J|ntj(<%-cY2KPan>wa=q}pL#pAE}07}!hV)^uLe?0$C|B-olS6% zh1h1!$Qtq5ZNGF8B6sEO7SraK{T|c~YG=uqv5}}p_TJ5K$AuWD%S|``Rk!A$LICg7 zkG_gE7(1WxMR?#9CX1ZD<<4s(fZ2)KY?2tqUo!};_xLz%I)T{9iQwX6q7S)kE-pd{ zHK{vRP5jTc;wLtP;b$$0JUn``+%XhH|B6Mej7J%aRR--i)ekFI%bkbIaa+o!2^dzi zof^IDWqFvk7;`fnkDlH*3+xkgd&eKNsj&t+T#;xO_Yc4^i5K}EV@ZYGoR6or*BV!h z+6}n}fq_k+%A(y0<52inXHJwIPOKe_O!}+|@$j|px4Xb*ut`v~KG+|DBdTd%-u!?E zGVyuvYuwkf@O6{AIo4TbXK}8Hq-VkIXZ>ocn$k~F$vqT|OB|nk69JVAoq>j+e=&8j|-k$q*2_I5P$P+A}pD2v}inLI4c%Wc}_90@z86=X9G9kdPtVy)M`pwJD$`=iH z`IG(48?90OCD>ua!ysa;^B(uC6L?n_{W&CW)W%$hED{=7`hAiFAm`Odp6@Ei+WP@$ zl9NF&}zhuwXFX26aD}5rPeb+LJA>#%l_gk z3w0^4oZH7qPX{8>TQ_nbU&u`zY)lj;MuLDg2xb z;D6Iucs)8lES&I}phreKg=0g-2K`eS3!V1dygFKfjuhgd2|3au!EYVQdUF3y&}ps( zpMAv?N9vp9I8rC2$>h%RWyV*?-T9`8S;`xE(r^XuFsx{Z^3w!MOg$&B4YO>)bQ-a} zL^*dQtBYK81n`q*dP1=iNnG=-^Hm6tlc7?67}G)g8~{T`6MPeyf9j#o1%*;v5|&_Q zkj{(J;n>0UX+N0-(acv%1R~)trFTI2Na$8S!~Z?&tsJtbGqWTN3U`S9cY*KtH%O_z z2ha?28u(#B`o@{6@Y30h@tM0el{mAtl0vevY}Vcsj!HzeHIZX<4o@15Ecor2*;D5y z@W4@nV44fZLh|qu!MsX7zHHL9C&3&%z$^S(X!CAXN+p3{&f)2aU3k!`-dS78q|Suf z#wY#p?Jq9Uj~@VAPEuBUQ|@j&H)=s-rOQD65Y+qwzqV{nN|duuo(FXY>O7MB*pNY@ z`5?X)BJ4iZyDIcxqAchhIyMrq*p}CyWTbm?E<3=qJyXNQEJsJC{s@{pgBP(pJCgvF zyttQ@`1t5bBCBfK(k3pci;+S}Pr?5a-&BAqX*9%mLZ8G|IZzX#;Qd+}+@`%VJ4i2? z^c9T7Oqu3p44{0Jf6bNYyYiHx1ZX|eNdBI1l739$;3i&!a)PiYlK=QqgT)vPJGH=h zh&wSwksHSBK%J}~4!T~|3^KSMC7FRQoNgT_{{Zu@e(B!@_PvmoY3W)f7XoxFpJ71g zQU3@#1UpoZnD*;cD3lggPvX3$%dn*IUjzNd)`Z+f?~N~*&WkOX{E!R4L4Y=u>wH=@ z%f0iOw0Gyc`d#kVAh0o_N4W7CRiZ`Lsk{Fi)U!@yI^wx5mOYncGPl~}tKB53Qw}MB z+AVeA`<(GeE?*jv<(wwuI-T-#qbWr=WOv8*0p%u-ncSM4@z0P;;J{8$M)Y`);?WUB z>XC%p3F-gK;V_*imYS3_$@2xAo*gtpDrZkvrlaE8K$2nSsyoA$>MTvw~s2fcma<1lJbHS-6h8*QA6C$*A z2)0|bv_rD53)4xYKUx$$A{6A76r-N@S!lxLDebIybA;Q)^jBkROJmD7T3mUaJv2R+ z{t}|QJ?TKQzy*dx*9bcm=Z)R=n**;lv!}nfr2ZT`MmFx5OOx)5GF7(B+x&a$y&41Ai zbokvLqUwHS#oxI^TGfj>6DiyTCOa?967s{jkFu!+>2a}pL!TvI_XS@)$-o}j>-2aT zuKED}Cw#(zcIxGz$HWcq@r}`9*TwGCsjQR3T?d?Fs=n`O1Lm{2H^`vicDSA4R!)?l zcusnYQ`?B+>Y-=vllBG2y(Q0CKR(oBFx!()vRU!|IOLo!ZS?A=weus1r1meSQsvF% zS&BRX*LCGmZqzNAYZpU%kSYSUb;AzS0^gJwlkJKYn`rMJK4CmO*y6pee zuRIEKNg^KjfwYOfjqBZQ_Su!7jKKX8fUmmp{mj>?Fm!!Cv>O#gq9dk&(}vU z?%f*?O^c$g+B&2>Uyf^Hk&wH0VlHs|oFq%l+B|5fGjv6e=3A${YM=E|DTK6G5rsVm zvN$yz`*fbWk=2*VM%YqxWhaKD_(|4$RYjQ$^Y!g?(U3cM2C=xjiqc8Ti0kr(1xF`J z8SCQz`?wmV&1uAi+QJ*!cAV=uXEDO#a_1u{YuF}}qHjpTWu#cEg^GBr|H&Tgti?G+ zBFDnC?UX$D{2S-cO&2KjeZuksrN#86{u7+pIh6$uQs@4fa*8wwIXR6>#;}tNP!hDc z6u@(3-aP;nXRnI$`09|=jf_{kOVZg7D!zMXXzzn?l}DorbZ-^(9dB5Udu35rxVVVy zoD6h1xAf_VZ{!C}Qm4)56+Xx;AEV&t7gZ|P)pmG;)sQ;MWL>txP~2vsb4 zR;NI}J|z&Qo?IyBa68$s5M6-xk0Z3wuh1b@ay+7Y!g`%N%$9y5$+{=u3A^y75`Cw9 zn3VvmVU;c?KyJ$;Ys<(qASZ}z zlGv(dP$Tg&BSjm350a2W#Swj?yU*P>grG-{MDUY7#76g@m*2uaAlrOB%Pe~sc~8L&}#G`i5Lc$K6>?PVo__I9eG{kYnZf=LXkUvk(7 zd6uv)=ECS%aysG-W2SjPw*ypDpx;6l8QByMTZ|(#@t!Cv#o1i|yRNm3 z`Q<(%(!K4C<0M&{}@^_ zS9#D{+XmyG7gCoyp18Xr!KM`wa4=+?*+qjbDf(_xnUvaeWAWfc)ivm zul;MffYu3nyVe?3T%sVT3e$)U^I2)%C+N!eaJ9LOCfVo!Wp@SBhHPVjk!Ie0h<)8g zJ0okodLF;OuQU6KZ>_~Ru>e&Sph|O=3cZjS&RLcl`RI{!6MOgUbS~n&%w)6Fwyi{evTRN4StC_XAR7wuy1izgcVgtS8KGs%$Pqv;zRJCWY?SI*30o&z3X) z)ZOK|XfS#?PntP7)PXSmDmS-m3s<4+a$WoIT;&3HZi@fSQZ(d^0PScd+<$*$`?us{ zqKL@Z+b=%tr4d-p4YDTJ2Pi+TvHVU7^wl{NNZH`DS`fhi&OjK`fqfG|q?&)%CH?P3^0wPs2f5k4T2hksfB6>+`DApCqzi zk8|T-zri6cdi+Gj0e3F;14@FeiFLu5j<0(kdM5F^T{iXVo7`2n%=25$+gw8Xq-hS_ z(C&{gl}_>_)!4c7rnisC6xbn?(RbWB1a@5)Q4AH-JP@Vahd);fTxeI5Je+)Wlp@1r z4@MeaqlZqUVvx%cYO0@dqWX)_IpnN8F;6sSPkX{dIlW7gsD=corv*)kvD4^e2ay0{ za9|h2mA5!Storr!SH4(nX+<{9-;z%4HY-8DJ`5XIxv#0$uDipsj5{OFM4Wyl7>!O% zz0_GkB62w^`#_w$mOn5oXsqjt@=bof)%|^;*F!~b0o}Oe%RrIBH>PE9nmI< zI5d);hH?6s-m&SrhlkxqVUj%LeMm2$^P-<_p%0fF(0NE(3#`=>l2F zlhS`eFWG!tl!ov?^n&i4%0vE4yC3`=!{NCc)hyX9_ldeL-c3z(8jPOHJyLy0_auX_ zaS6xKQBk<)OxLJKmUhRX>q&rJhTWeQ|6pmm4m>5f<>ex*peS)OekF&y zg?`8SoGTtOk+k=xPuBuLS*hwa*DcC{`?(7KCUoh#BQ zIc7yTE$!5Et>B_$aADRwtcZ`U#YtSRiIeh9Qc!XXO>O2X&s|1nkLwwN_r4}ANEV#c z!A972?RYrR>-B9TKolN{n|^io=dfzl^#ZP75J#B^W{ne&aLKw_v^`zIz#8v9k zs#0vEy2>xDUF2)Z!)xo@Rt!j^=h5wi2j1gD`+4mFsLc|cFJ^ufs)BHLLTQqGN(7Y+ zzi+Cv+|)Pu&gwCyIOOHcf!y^I45Y>8lA_VfexPS2G#|%OmMhfzlu#Xz6{Lv8m-`(kVWE?t=Je3RlN%QT~S3v2rTN5J{#0 zHMp{pYnJMRPJ=4%9iurlJ&R zhxT9~{CjAeh;$aXQwni3#Ni4|+|~ct>b%98NJcc~wE$G1neROFlwj*)( zOp4mhpImuukguhToiYOclB5#-VuOJS2R*~yGbiMSKO&K|y6VT~m8;DGwT_HJ&r29^H&?2{hwY@KE=B~$nJ5M^amtx`0 z8Z~!3#pLR)XU-GwELM^l`&@YK&y99Xr;V&b>S9k`cV1B>Z|bSdACn z7)+MCjqVC3&=QO5-}L*<)3l_;Gb>SyGgTM`Ky!ey8MN`+6xBKM-2ln~O$!9tv|yL7 zaoQqSbBG9ZTCLe#;;*MJmySX0Sux!9R^!1U7aa%3Vb?;1*GJP)_v=Eh)8iQ19$}q? z4i}QCnhdxt>?ayS$@QAJU0(@j8zrEWYn9}msBA06YY!*@DS2I|3G319V9n0&mWHHe z-S650j^jnCrjm!BVtQBkw+*f-2hhSJxMcc~KUd75iMmVSLO(0$G9S7;0wk$*9Aja+ zTSk~u)&C|VSbLgSBl_M@Vx_^oCEfm(gx%S?s<`|9}tzBbF0x3EYSK-SEG0e zckq5K!@ua0r0|<9L`>jK5$#gNVzX0&R(#`&uhwdUw7Mk)qGo@(p3n1=4oS20`I*di zv#iq}1f~(QfWsy4zY>j#a1SNIMdfpH3Y?4do(r9@JHt=4u|m^#+V@B7l!swE7g!3+ z`7#!OIL2s61C%NEzPeoZ|bDURv&`M)xP##>7+7nMyUAEiEB~JF6qZJ`@ z$=u*o3ED@xEQ(R-ovT%56reAtCifB%l_xkHU~@Bbe&?32U3Qs?x@6C^cn0R#G*}ON z-B(8-z3!?VYNMNm4!!lU{VP7SKB-0SZC&}yO>04lA6nfv-)VLmdjr;pf!p?L@T=-Y zEr|EPM-eApH#z>|TRJ*Av}j3nmdPn4<~{@HRFO6ACQ%`cIg6`_%o;+_FW9sw6eD+B zm|AcjeE8m2AX#^mh}uc@ z4V?*Plb&JW5<#>k(>sUVR(hg)O&Cwi#Iu^APjOh=Nt6^AY5?l(GGwBM_A=8t#Q$0WQu|b){G1g+NE1&dF|zAMD^!Z#wQs;=j=B>q~{7bbZ9@= zkG`&+T!v(MaE_*1=je$go6pAE=id$s9{Y6}@ce1vy`xW}ID?0+q(@FSnZ7_ANY4w0E97obEynaYlXW%uEeN8;`_vDGfDx^&?6c{}n zF9tb+RD}I%*;s#;X#I;LJ68k3{T=N)5hy0UtFte+4PE7vA9I@-WCO(m)|{9K0HqQ< zvg!mOf2s0~AQ$}hn4T~_VvLyP)x3qp6e8y#_EMq-U-bt5k6-~Y3}P-oZqPShoi0e?M|q?Fg^(% z4L&moF0qFa`z@^9RAHohwG-0gNli^n!RF>>q?hR{IeZ-am!=;}OL-W03R;Cz&0rVb zn|5f;fKYIX9g~N89NB^UdpZ4ozAE9VY^kRHo2|aEYq_&or%DkEC@bsVMmFy2%ix&gxJ6PF~}|hE78h;N>LC*MmSVFewkjSGS}3HX?F3o zVKRVr1z8OGa<79IHxs{81$fV%%}%v@@6$z4Rsi_m^Ac4oroRNUx;JsGrze-5pE_32 z5qT`xM4_3Y_s%iduD$t=#meI;MKt|cG;${%x947V60BlwD9E1VEV_Q|m;KzP`{y%H z&b{j0Z+S(F&q+*D_wt9Zl@lLJKUi#A7pbh?YqT9Y4qi{UD?>E#p)Ux6_X&;`P6{vY zq1YB~z{1I)iPkDhd>@lR2rq``2?}gV_(mPT?%b`7k)uL6$0DQMp4_GJX9D-nZyx9kE~YAVk1hBRXP=OQn%`**#0 zCB+;F>=!Q(cZIm5Q5yxrUrbN#PYk5PL1oBYNb%QP1}Ihu+ppX2*zfXgBXdW8o1BZ4 z%bi+qn@h<~9iy>+$~d7rb|&9!NI^NDme3Sdn41O1sc`D>axWfqPQu^_WwA*$h?~sy zimOt$V$q$C*Vpq01)4D=5vfQric8s!4NlWX8rOqNQ$!rpWir`@=8LPUM5{O)6o!@= z!TXQh6_`}@=_n4(GY5dwJ&kHa?&gYzlxXrom23Ex_Ygp?*9ejqn*oZJ?3tY!IF{40cI89w;??k?A<=uCVAKTo+uDz>rB3;4b}tbaJnA_D z>_iZDJZ}=#6Y+Wr$*fIMegG|(Wqo^)wnr&`O*_+N^LOY{5mb{6fjTTJnYEIx`gm%J z&suI+-5m#bz8#Dp)S>b#dr-vCss~`9nFVOKXX_pe;W=w&$A2X}@q53Hh$>T>6J3LT ztv3}8oSMEx>Ivn+r!EcvdD)GY$p_I;RL65}`>0mjg1?=5*SRQ|t5n?gnbEezey4yx zid!Jz`3;*qwkZSz!C>dhQ5sR^eAA$U&iL}@`%h+(3Q-=z&2jq5YEZ$@(vUqt>ZN^n zF@}82@~6nFFS3J{9I?Zr(q-J2t;;l!M_i6Mb1aUjFT%zm9WOo^zh#nqWo1 z@D0!1bAdYw6X2BM-}+VnQjT*XGl+=R(MTm7vuevXL8m?Fl>S|>y9K0*ALU-Orx6*x z23{;+9$%JqT7L!!dDDOHC!?YiUl>~Er$b8gqZwq@yY7>arV*o#Pj39CD%)@iAes=K zEKgq2V!U~9tjUVe$H{yCEl)Z`ic`{sc!1&02po}Ow3KCitM7vXS8v^4da8v3XOk!Q z=b51V&L@9=+VZie<8;eVYR8CYhbkCh7l+vlrp%y^kYE;~i6^_%Z6L4wkA^Y+CD=OHa{86%SL$x21Ks(5eC?UG`|>P+tsnV};`TL3DFJBgDZ<|na$%9}K6<0-Y)WSsgxJW(F7ptY zK}8~5vVpm>S9gJmyN!Jev4$>@=n4Y!n^RDNE)yhCaa2fu#WV$yVBmue^V)8_E4(t; z+@v)N6r>s&`=li_VpLzw6YdJmuyJWOf0A@kwt(eNIC!EUJtW>V+h4$~qg|yOEPyd{ zS8w6K#W=>3CN$8?ysErXkn)Lc3MyD2IvQXk6-ag*ZE_HnX39U4_rAp>sm}T*&Y{}? ztIX+1FX%GTONvU0IqG1hIm94gT|{+A@&NJJ2z!a{fY!cmNmZ@Qmq3q1^}&y=UMv1t z4vmyTX~L}$GA@nqrX^rn5G7od^mCnc6EqKUzJxCWQCTTOt@J;9dk2Sa7Igsa|6$Pi zH)ic%R7vp12&i3e#=HAo5#0tiv3`|$Q#Z54gfZ|4|msNkLw z{o!%y0#7B4vs{caMg=c`G>N^G1nxg2d^89z6e%K!TQ z!{58lQ{`1FND6eG+=&1fWaZ4PtQ}43D4^7;#!ocwr8hCCioYTTV^0_?>r_jAUM`18R%+@nFX&FS&0&L(daKV$hEFl!7P|0 z=~mec(lF4TKHlYSfj^P)Wa^em{Y3a6yi+zl7Csraa;^G7$QlmjYIWl3bjm%?m!Kf} zY`ZyLWXsJ`9rBeBWGNYuUM;={E55J*8hq=|1KjeHd*%o2ch^E?&b$AALRiI2dNFD| zj`B_|h_lSoEAXDQZz|I&SrfVxq)refe{a}{cM9Ouz=qCQl%XA$l1bZw9Qg2H@Ewqk z=-1b9{_g#AR`$|IIbeYGPf(FoyVQVa?F-t5RX;LK$cq?0#B;3?eyWWx;~KBT>NsCZ znbi8+>R81llxm|j!-#ppzrXDM`-3S{G`YP&kI>IS(W9I*kQSYa ze$i0GptxEJDbFC*^NJ11PES`Lx5Ww2_$sp)WgA<{;`s+Gc4jaq={oO)#!?p9sAtYp zs{kA1uJBh&_Q~04|7m%!%7cbSge0Rnyq_kBKvv*5z)U-Py8c9jhBrz8sx4s0yCFs9 zZ$lpWOKFVo`?9VWR6n$je-inDcC8=$$0P$@Z4>wYcAZW%Rciq`h>i^Ppe`vM2b4ZI z`VDvoyf6ywI2SeM1aS&sFU&77pp&&+{IGAcW0jTm6;K~ zKjptZhW~r0<b^eO{Kg6uHSEvgewH;UTYE!FRi?z!d@E96aiVnn7x6z`0-plfa&$DAXEN}%|hIj$-O|3 z2H_4LT{2*$WFv);O6u_1v!U*Jtv-ld?Tc>!ckEk9*vhw{|C;0dpZ7qL!pp~nIoa8w zZFS=&1-HXE`div%24-KYrJs$TvW`58p070n$O8$N`vT=+IdiVEYtU`{7gD{sAj!*F z{oKFigM#V@mDYeWmj_=!T2zE;jV+WpO}+zYIa1V4{Dze;Q~FP3m)niS5=lP06G9S+ zS?&|`Sl^hwh+vhGJKpvlcdL`jUC3Tna=!P;N!yo8tNEfeks##K0%RA~e0`KApOQ3k z>e&F9uOjl}n3`vHpWL*MCocswu(RuZ!;?m7UskV|y{m3XX3sLr=*Or|jlJH*hJP^FJ82sHZIgc;u7D4K5iv9r8^Qm_sf=5%CQzh_-^)l&b#+M-#>KdaCkq@Gv~aoc|}JaurD9T-ITi8sV+1ydN=wwK@qcZk}X{u zAKCk;(Js!@pRdDZRYMPIDB=a*tL+Z__4Q>@iQ+3tv`B~vcNo^;1=Zv4aI6zN^q>;A z7#qA6Hk(y-gZrH>r*G5Ka6Z)01Ehr-fKeOUN@hU%s4E% zx93qt^KoO@FG2;BAy&_T+Gf@t;3-;iydQ~h+DOJ0Wh01-OZ;dgh#CT8CwTVKx4FsSXa>+`^ccQ51Cjn)$vP1$f$bo}9dstZbWH zjw<;?j+Z{1^Yx`(v(Gv!(bH%5Fh|>y47JA9$qvSdTssYgf({5B)ubcZX`B4BCK@|N z23we6R! zt6TXT)XDIDJ;uGTi4=toq;xnI20!Q_!4VsF2eDGG0A6|PJS;gii3n0Hd>IEV{Fll9 zUkBk%$D0G2DoF*TFkn=#%JtooE5aw#HEoKkfRL9|>u90v`=wpRpZ!a2n=w3&h>q?P zr3y{Zb$LjZRofbHrFk1nsnsfjw~J@M}7&vwWGlEoT3*bs-VqcewY2l)wmBH1qpiA~O}6BT|X`JMDZ-SjF%Slb)NO7FFk7&(Et(O}|tLPbQC2 zoNe4KBaq}mD1U;s7w=C+rJDF~6E}Zi_khv4Ljo0fl-kJ`_wD~*YKEzS5|(cP51mtm z(w}`0=Hy|ge6GgSr;p@eaI%<^LOK4;XW3(;V-S3;z1=56uf1iQhg5@Z($U|&&9+5V zhImU03H`d1_qd82+6_SwuNUcGIFr0S__kV|BvZlakQ9vaJ=HtDiRz5ya@G~#y^<-} z-iv7x(la`QWx{gB(@PgYXkcFxMeAxwJ=~8wxJ#g1=NZ^aXO+ zI*hDMK&;>69ry;0mlS$P8sHgd%&mjLTi72E(QYtBa6mHa!{44cfK=K*ZJsc-@@~x7 z7?qd6R)G2r3HrOqtfv!rFQINa+^jhO!Fc)2R{7W+;rs5k8Rpz)`R?h0s~nW*d$lmN z@^Pt6y(_jDZ#YCqcUveAy2W;$hVQ*G!g!@NivS247b4T9M8C00pnq=sNHq@H%GL-% z2X_QWR(-0xAK3$Aq`}@OYFJ4GPlD^BF~|2Nk4J1{myBxYmPcwQZgvZ^&r{IE)JAT_ zNp?e3nA8-5q3Jq)(WzL^*(bswZziP_P)y0@9F5uE=lBaP0&$F)`e}AS?C*-tITk_3DoK#jse0Z2{mPgW zo;``qod}*QE~>VK16?pH8FPl9b&b?VK5}`z03YBP@JaR`XC)hEMC^N#M_&L8DZA<} zB&(7p?tzo+)-{))W7p*5Z55idtXj|VYoiUc-?oAXW2GxE<6k803pG}IBh$?IX;*ykx# zvIXlC8_4A=Z ztAxqV_TLaij`WQVZYQABysJ4q-}!|i#)%b+;%~U9!40j@>hX^cN4-gRk?DMA$M#tr zy)^>YprVwDax!GHJ`YWHw}WGq&>zDM<8i!rE(NYN$N-;qUr)&~2C7cG@*q7i$^9Z0 zS?WU~aMLa(!P!{?>2r^|_%dINl<8CkZbwq$swQy@1tHt0K}4T!#IzJWnnx7(c5u_-Ci?=D`AH-tC!pU!&6=)NL?QvJ~mJm%h(D zNVog>#wn;Hx!YUwb5_(uU`xhzI-5<`F4$7BlpBcyA5wo1| z*P!)unJl-Vr8a;~f*_g&pw|zo1a{RUJs^(DcJa+%lSHV^rg}1tz6DPRdd*G$s_g`beIwU$jokarLmW!_C!v>xw8tW8VSJqt{HAiz|E79mv@A`Xl{vm8)xA4IpQ58XDGo;`rbzer^w%vpK_eo|>L#9eXWx zZ6IJ7(}^+}JFKFsXN)kWlkZ6cbGcLNwDUu~8q9d8)q^1a9&K!jCBA9#|C4js!pk8i zqa4Vg>L}KC9N`;naixD$4cKl8c2|$<6v2tQKjIe>dV}KeiBMA(%K1_gSd(%oL)6gO z3;a(|rd;IKS#x|zfp{ZEU?%+(EWWA9z_jnM$nPQ9C`!+H(eWBy@iPt^>?#>U@(hWZi_fA##ZtQTO_#jtXtVb|<$R7@enaqC$>&UmAL_7Ne<8_$WEs z&39_HnAuSShoIxE`psl_|fTzSdh7ByyHSHqV z;uv$Uk$X}6bY1Za10@<1Cgzo#!y&lcq-%j<3aCffwcD}!9d!hIpHD}JhKBV1&p^$C zD}M!cdS97m?*_ijyVZ~T(Cu~BtpEakd$TBxasxn%!jnC>cGwR}$5H_Qw5!~nE#AOR zKmbtl@zA<2f#iu+)1B9$;oY*RlrvQ8n@fY{yl~kqtQ`T%*v|YSdDmQ&glAeN4YXOK z<5`A-9cuP@DPD6W#hnRP(io6;O2utnh$pq1`NTDCuIe(=l|+wP#~P3w#;YkV=CK)Uld{i%u)q$j62yd5+n<#$icI7Xp z(NoM-|Kj4}f1|kXgOHJ&k!2-Wu?VpV5i`==epe2+gYwrv!}au11T0Xq>X*IulLrpt7&mjg^{k7yzVBeW&@wZdC3HOGTc@muG&QI0=BB=o z$aFAVx-C^*OO0)fkPgJua6ORe3EG^dIIr5=-xu;E?oo%vL7!vi++8wLZ#pwyXo>Mz zD|TCeJK$Z-ZF&{NkLfB2GLT6FX;)4;cj)r($rpKAOj`rt9;jGH>!Wwn2XS>`152z(C7Fj`kSqrVCSa{v{ssT zU}84LuqP#2!dc=3iW=mTuas+PO82!eAg>bpYx?tG-Ka%tvb*e%Wx#~&>!{gAof*u- zO5({gGO#Y~xjFuL>F5Oj^#3ZjI6K_V4RfL}P-F4*Ec9je0^JGP^v)IG$j_P9;lrg? zYFxt#e&UHj6lS_AUmX>OKlmH^58R%rD%t@9WSVu_@Z#*lp*pXIZ{OOEU5eP`Te{tg zTP!nUx>11mq7j6dQveYx4G{aRS%*t)o<`WML#NLfSTuqi;U% ztO8UiHR`!O`LI`8{+b8oFhN@$-Qj#kRc;`={{h1YTW6W1m-MWW1WpD(9NmqoS<6Gk zUkoonRHvXVi^pNS}jJyT}DgiYo;4|GXTN|TPh$>IX))<31VnV@u#}WO^=P- z)Z0qyzFG3h3z&$r&5QhsE;Q6E+8cE#4Ti4B81OUVO_(0^4hh_wARzAZqyA91IF5062M*#nX1a%%%ou5Lwo1Q1qWAm*~4eTt+= z+%^rQ&z+7V>x$Bsv8Bpb#>Kzk?Wd{RU=qLiQb0i{f}0Gv0Un?|#KaoExQ*Y=$);;~ zH57rN;ZTJg=b{b_aNVLdWiHshgB#b!!vygGKJAvHx#;o8#gHc-FbBnN#Tkd{-(#&O z8Mx|Ros4VdQO3U*;eRyGEk+f!f_^vU)fSN@VC~Jt2$$(rqYpN1O!dd(w9o|pRz@UF z10xfla@9`5IShFBkf8Wc&vW1brbY1=O20DGqzbja%;2O#2rO= zrC6LRmg9?DyJ6HPk&xDePESo%DKit)l=zL%ZPCZA+T+-~Ii!eeTDTBJjB8KVCDR8V zj$Rf$J^a(;_hV=>_SRcWp_T*p&F+`a3bE0ZNw6RuNJ1day0h5yHp~pLYzH77oOT1K zW9V;OBEm{JumB?QJ*c(k$++70tbb1Im`?Uk9fsd^hPl^JJM{BYqg$7&dB=Qo`7Wfs z4E&<|CLQ~!Ig5$PyLWmL!(w?;s93QPxlht_mLH)DyR18Tkv?CZ;_S3s!<#od1q1}J z)RT|9o@p(L*z~O|`0RS!l$EJLdVv`rHSjHXXDn!Y+uV{xW}F2s5OLB?qMJ8P^iyNZ zjU8W*gJ<}jgFwws#o7MeS#Xy~veT*Ow=M_a=NS`$n}Pwe??>7-w%G1X*h8AX0Y<^D zv)%o$Cj4U9@4;^b(sQ2gP=y$0m3YE}18)YMY#V~|u=*@$*2@T(*mfY#fw^^grdjvU z@mtI@lbNbFxRLG&hd|d>nD|gPF0A!?kX5%d-9?}I1h8~=xjzfY1O=pbn_GSgUh+Qy zbDqj*Uq1!BV$~PAYu*1nzD)XjV&D$OZhj4q!SLnuyFW@#c&1F;p(PWDTtLq8#PN&s ziqtioSB{z48VeR?(Ky}RUmo}*eNf{r)f?<^1yskqs*Hk$vr@q`!eg6=MXUt*&p={9 zo7}$%39C)W2=w7j)n+dm z{$R*&OtLQ^+^Pu#6wU#3wUD;T?>K4@53fi*M)cHMv+~20WnEt8X-Qt<{4X)Bbr{8v zZs&jBt9jC|#SI>?^S)*Zdl!&;-pap%$5DH^KQ)2&LoFZTFVXIU6s06>}xhG)UhL3%_*28;Fh7^Y8ahKmjx+ z^h@tIAsZ4#Jrddh(#E<|Vol)-a+_$+6jjSSDCi(6)t`CrQBC!Jee_1$}=i8(Bzh5};Q~EvGKeu;l$LL1? zMe2CL5%w{3CA!Z~o$w-2!RR^C;;clnGz-{cjlIPT^GkO+$X(C5uYOtn@@NA%G(lD- zIcEomJ66GfP5oar5{&VN_&EaGbijFu?+^yi-N}u%Og$~Mo08KwW5W3FKZU>=MQdLf z{&>ou@$H)g5+yL+altK2#n$6qfE1%-q^u;icQ&7YQZ+U*u+6yvG%E(Am*y4MoA5f? zwbo$BL6dPtmRqYjL{%8O+nTbzV56>j?1mU1+83rw#Kfu>9%-TEkRYRyhd@vyyUOvVPyeyhG}3b z)Vr?Vy>d9>m^Uh1!=VC-T3#tq{oM89 z2UARIYikE-5d3}m;3tb-;5hn_*1rlB6P}E7ZXn3y<6ZV!z*I^h;F1RIT8VI@8ib3I zTweHw-Ra%&D|7uhm+D~l0^{FCd@gr?Cp-9TzaoiQp`*apxf{jG1(hCb6zrvmX4X#C z-K5_a2q+>0Bx_^8m+>z?P8AY(aR!qa0M@E&MhWFBYrv@h*wa)2VccTg#)#M1&L++o zZ7FR~K+@w4%WpY;eTN&%hYsONmofWav937Bh*|>u)sG0G+DHAdg6UL+gF=E`+FcH#p+9@3#lub?0Jk?~^!yr5pDHe{oTJ2%QN0#n)bFos=KXjS;7Ts>r(}J8!?{)Q9me<~+ z=pHStU_Z7`SF>ldkKVrCS!ZqcJu-vcd+=h~NlkA!)pVfdRpR=6lKU zSM2$eg1@4)Z?C86qsp~$7}OxG$0den89jALP$ffRlgv>DH>paZC)kXSt&!nH_V4@D zx*w_g?19y;otFe%%rfOye5xLSKl|TU2>XI5zYYDg%V4TxI9r82`hn^y&qWXeOa2mt zZpEEwwpH)DT`%0W^}PI2h!O`JObhA9f2$d~Ra1bABjU}Z-=NON)5$}R^^8zUDc2yR z5R?-G0gOL(XNMk>r*;C^09VF!?i8)rFF8$p^c&oC82K!L&EoH~s-N5flGmF>S@xXo zJB0i87u(yJH?H!}OgR9dgxiz8Q$hu4z)Hm<1`4B_qnQ5 z`N0nL<8935_Ul0NSX?B!1|dpX(O7mgBZFR34}y!4^n)BE3OdT}069#g4YihXC%hIj zhR^KF1bkGyc==eHXc;&?@129T(mw55wM@Bi2+?}31%^zZ%-w6Np<5jpvC4dEj6sYF zE%NM}q@CMz=XtL++h{(R>I#@uXA;TSy(^WUa0JWf(rn+2g#yp_d`oi>p>>`X)BGa81Ta{txnW0Gf2Z8$px&! ztXa1^#?fWXu3~*zN^0uXGeQ7bwq}q3&fkqe*?#zT{{4Irff4q_Xn-j)n{NZ~Fv+?Ll?*7DqF8 zhEnLA$Fv^lWbgIN9(4hsXml!RYcyblw8`Zc*E=OWd{r0u2gNy~LcR#FZVNaGsKlk_ z?mrK$$Ca7m@{s(2I{uWPMWc^21Vx3(k)|K=L?Hkfd3S2tzaxPSKTT^9QI^(D1ul(lX>-&|EV8EhLG-oN(w`(-z!IQi8=Y9OYD z3@$#gG%*^~O}1$+uhbwbCF@VeI^uSiD~<0mHq@l*fvI#mA1SEZ;40}TS+_f@rq}nZ z!ur>jL?IGb%2H-|XlHiKCq(gB@n}tTrUCH^=$S8Q(VD8b;NQ`L}=KDCPE!5a^Bf9~*pXzK`tMCmEcGT#;NX9+~dOmYD zhFS(UHIBVx{E`(V9+}U5#{OPG(L>vBxzr#Rtb%*jmSf)Ez6Dm|c`(!SNLx~%gqdNwD|x$STo5eHbh)Jd600)pOqow`I*`eaDt9~XkdAIuS_ z4-2(P?K$0A-O%~9Q zq{PKgnr*N6K?fh*hv(=&1x1EXC0sd%a(BRZ!D*3%7W%wJ0*C@~I%`lWd1IF=yp`dL zqgm%MFWLVwPK~9fWV<*c7i>~@duS$z?81IBuit5eMa_a^QlonAE=uCVZjRN83xs0}!UzkRuAlTqJf9-#xsSGr093L; z*pO{~>W|ln_BB^$#{-NL7sP}rN3zIaYtb#ibFt(s9j$WhRf*4aX+J(0H+*A!ZjT`@ zwS)W1srI-t`kQ*dw`Gu>;qbs2N>V_m#Q7NyqSYglVB@t8t9A0KfX)PO`Kq^ce|Cvo zGrhml81^;$+ZHi~cl*1|r;{tZE$W%T;Z{?u0_xM!it8l@# z<;7nN#O?>_&3j&5lT(JZ!dzLp2~roU4n}uAroKP*KZfBmW8n}U$*Y$Y6MFx zN?-obw}Y!+G>fqYr0!$3AP`R$+uGX+;McSDzWRHJHE*M#;&3m0-_55ai;ZVfM^#dO zg&9Q;zB^|)NH!MDZC~0<4vV{uwX)F~NweSPM)>9vl+RXNCfKc9E4IO_JGb#pVY0(R zK73h7i%t&^XPEo-k@LZR=Ym8qYAWnx)yYGc%%8eE!$V) z{I@{pZrkYOjd)2`s1F5^yJp4iZux!<^MX;kAGznA^1iL*?dD1A-_xC__(v_r1&?*1 zwmKg`{c#RpCyQjZThO$5S*AbJoA0E;q@}{R-JVynIuuf;{>3L58+`dW4BNddxCzhD z%4$JzveZb%QHv>K@3_i$4?6LgB_&xKZ8eL!p`CR%6w`ATD=wWX3{>Jsw&381I#NNc zwPJ7~xkXgOU;6FdbNmLiduCaJdJ{RnO2^f?;Vx zM+ELopE}x(G$s%q{0STiy86kP5ieeUNE%Y(d1`I_CZP^YN?D!p0P?Xw4eb2Q!+&W^ zx{2q3RLer~Cji*0fMxIULY@TDl>#n$@gq}-TK|9yZ+|$93)H5tm%Kz*ZKrnS^?nS- z4`uSbb5;rW&d2J*mko~_U?Fcu&!+QH(gD! zgMw&=*Zlb=#<*gA>u4Eu%T;3e^dbGga3F;Na1tH}xi!95NsoBD9`$OhukFB5@t}~P z-F+KIZu=^oem8O$zG~s=%xZjV3Ah3t zpr@yJ(Xx`pxvNxAdWbLWH=a00P`)ogFx9%AlW|59nZZl8)37hzNJ}ty^@zi+*cbf< zZn0pnU=``|d0&yfS~?Th2=C6iEaS){l3uvu-yd{-0|Y}gPcfe;chsKyy34e4$xZF;KR}S)ASW_qPOTCy|2!{i zdeWMS5oHh9*oTA@&K>Xk&2p{hS`?<9;HQZ=>`A<95LRM#)b0#iLNCr^1Ii|CKf9?r zYLX1EGt^M;2jer;ZWTuPS7bbfwm$dl$tJrkE9ac$4)xwEwnl7DnOdvZNp{o3EK1y6_Sa?U=eB zaG7Z>El?Hk?!EHEtVfG`oi4ZAr49m&k^^X9CLDzxUd3PNT4~nAyB=OJf8v!?5*IPc zu!!_}?-->Ng(CE{cHyh^KKvWxnrr#m$M4gjbw|8(#9`5+Q8Mc zO&AeSY|LoiylvuT7#$;3$mJ8z9&+;~3WJ4z0?|My-gYT}`Md1f*&Mz1RC|?=NyAd6 ze&`|8%bmWaKts;obIuPDYw+u=AA!h1F7sI$accIBgwFoFnbl|dpSuF+VMF*UhtnsM z9MV}iEGYItAvGvG5yq^9)1jRVjSG>T9ok!VaTl@7iaKJmBH>rQ5^$?S6a$lkW}&+$2vj?|M)X*$f4FGS=A|k({9vIMa&hkUp(T ze<2`4fT=L(zl%j2@rlJkMNPGujtgoS3G~zXwQnkMw>G{3$r&Z?e+m+qQfXgJ$x3!{ zR5xGj<>3tM8HS1LE46vRsKuvbJ|hMRt~0QD25{NKmo9A#%>>%$5qtfV$6>v(iCX&v zm8X{?rCII{Lsz{PzUA?C{#Gc^L@!h04aFfd1!GsY^dKD#`UyB)V9N30%pu0{-h0YG zXOC!KWi0u;B}57W_05}XTJl!q*MBV?H|!$HFz zVb1WgdbcwZv<8uS1PQ2w)mg%mSj7I1Sj~UF`q5e7%p@gnmRHl;SM}Yfh%cQR$Ka}z zzOk=&kcBti_H+WNcRtna#sXF-ZF=TM-^=vVF7vyi0oevSEiBYks&a)umHIcr?}DIi zjW+S7-Fk>droCII8`GGREas-+WLJ{FTiW2X=~tq@<34b}oO<0}d%881AnY9FiK~|? z=WDn?zJ~ru{vXw+*g!zM=dn-U-InSn~q})j_ zILlR2rKjY?*&3I?WqePK%3|4bG9{ugv(}Ops$L**}|q+1NkfK6?}pP3|wHNS69TU!xXp;WYP+<|(Su6Q;!`C43PL{}S9C2HmhvVH?9PEGjBp zw6L&9`-_qGk_9uGap0!ES@;uzF@F}0T79JnSr4YTj$Tl6ke}KvYxCY~P+Tvgt?tab zM!7b#CpQmOFE@B|l}qb1#KI?8(H+1%oKi6~Z~*tarvD)7Wo+Dg>7whthf`fKvUB!+ z@ATVzD0^nicm2hP-Hmv~_GXKv^RfzqA{FmlkCv>QvkCoLnRillyVR^*>4EM>5nBiB zz7G+O_v3pBVMhzbKO;f-Wdp_$UYZHenw0#c@o7sxlGQT!mjF;YNy z?YJ?`u>QvwV;2KbjIV=3qfy84XuEz|LR1r4_mBlX>)&IpldIFN&|@r5LBk*8X7~Lc zN03Dwn_59whOexSpRV$>9CQWKMP^c`I##^f9D8Ef7VF>scJ;>{ySPvwPrUg|pKVn! zRch_-fzJRF%gNGL7JV0sF(KH`cY@2hn`dN+^^HBshW~*>2wbj*mSwlVc zW?yTas?LA&Lj%RAk zw*L-%^wS;=m^t$*bGyyi9>?{#1C!GymQ}7hwOdO94$)f^0<nFk@$B0NtvMjd-5{#wm-Klmu7a#P-ZV!7VT0pS&FzI`@f zdMSH452w$(QWQ2V>AAA_E!b^Q2EE^T^RR=d!k3GO#)1_eU4Bif{!PHGnYcz`!}8_8 zY}RX19X@AYxHIc@7PkDH_?If=BH{{iYp;`j)laLfzF%feW+TRAcf|4H6|#8s^xMpp z#p3H)C{D6&F+OGA_VeH+1%@3`grk~tOkYGI+WiZNfy4JOl5}~pooL}rO5|G{lQvy& z)8;Zd8r!1&?{f?@BCBenT3uHcl-_SSe&~WEnRs;KL3x)~CR{%1XTcfT(IxLRWJbHX zH|k&Q`qMl`f)3uVcgSJWYbLl*!U}5x2xNkwxAZ{G-W?HJ((8=0)m?(lj2CRJlR6x< zh)wRY2Q64gk50t;FDUXRFkq~CfQFM11f9tl{2GzvP=BVrMgXZvwSL~?9tmxx%s z&S6GQ(im@%II79ngqGqQUG+~EKLu_0_um1Op#m>3zswhAn*)v>lz73 zQk0&}SY$Lj4YQhh4!;0_fJ2}sAN!DCCL_@l!0*RxBRSj8rk+;2uS4FxLU z6ZQMDO;i_$;^KgUrXk20%itc`*EG%za^zku#Ni$h^XmGYHs-e3LEUxU4-yy8;wolb-u)_tb%`)aiqzpCS|;x)ye?b9LERTad%IwA z0ya#(70ob3akpVVX~sB3%7|1ix^rJo&Tj&tPDtaB;YFjZDv~MtqqmqbLkL{?573g$ zAP%1=w~_NJE1RtjUOt=U^gAyuQ2+ioosnnn7pwu!mr2&BQFXKpY@^!be)hva_5nAx z9syk%0U4RumLjs6P=chzq#2LeVkFuWQg5*C17RX(^47@fuXmd*XE%N&K#c>vAG&a& z4WP;BA-kJGvzn-6-o`_zLs0z6INXd=y$zltMfr6+BP>R-LdjUkqu1g2YzvP zV$4;v0a;g*%N!^k6qq``+h5{~(FXn~C@FqiZ_y6l{Asb)t&jF{ufN1Yg*m+#y8JGT z^7OP-Nk`{z<<7;W4>4gLz0dc<{dR;eZ1~VYYLNe)t3BD*;rB}e z4==(F{WN{a7L0063pJ%*_wlAlHT;Oe^wv~)Oyl+Hc@q=nH|5*eL{lgHh4q=Wp#AHY zbq-DT{W~N+qll0H{NWWt~P@SK&VgLDx6t|(hkd|>;X zA!QzjnoZmVRe1VQ<_qKaB`~=+xkiQ9^+SB@sCTJ@pmyA0e*!;5qZhHC7T)5?X5+L>= zx)*31Bvnwc?v}Q}?yLUaaib$!z7AC znsN`z9zQpK8}BVc%}bg70p5l<-NZ5S>Du$TTMg_AjQWnxR&y&be=&2}im|305Z_ztVvfrs)#bW2Wzwv~ z?Yad!pH|-i9dD`FrHxF?@6Db7Y{D|4R;c~hH*0h#?YJ=+f6GQ7q+uwZn2zV3RMT!$ z;(&i~$HMQv=0!imD`|~a$Lcb3RGqSosbcZ~%gP-13#q4_K`m{dl$-gK-+u9c|z%XsLwnX@Bi6oo^ zUT4Q@$;iqSNy#T;ZEy?$?YSI@6Jat4$i;Mqis@!`<+2<#B|HMbMfyzgT7O)uw0#eE z!RAmrDzB^u(8y<7mSn<%QPItlk!}4~kwvzo`YqE5=;d%J8H-t#PZ>Y0wT2Crz7X=wz$3r5JR zBbSc(>{VJMI59GrR&Ou0+A5mlHGc>IP1MjBSnDQ%D(`nVoeHUpO#5*!7hB>uPtAU- z147zX5{>E5~5G$m3}XHj16R~6ZLAX%^1)$?`C zKvyQ_DXGNp>C1NWh0{EBKg6n{`gNgtdi%}TZ$a!{h+VW3>3+P|DU8&Po+-1Qt~s89 zYCXP;&k7gfwouc9iyGtY5F=ThVtM3zR6QjU=ZN6-neYh+XZm4u;%6>>Ql_3b1~TU0 z2RVyBSIo@I{&ai#E&fbOH_Ci)_G?&gpXBe-6CaK>zfmSt2@{;Xo)LtV3`Rc!jH&Fn zn4>e>x9X3!TU@;-z2z3^isA*%xjJtSet$c=0E<>L*`|3CZDf+k(d2ROPCD(*?2lQe zfF=~3QNJyE<*^3&tjgr>={q|5APD-36%OM|#-{Vysmy(Ud;#hYB{tq?w-ce;KR)~| zw49LEn!p_D8k{-7=TWvw><6{G%z>S>B$s%aa=}TCK8AyHsdrB zLpo0RU4ToE#&6mok0i>zr5I?8%+dZd*nw;|6)`| z^2+OH4?VXn?0k&KelL2Hk)ZqPy2H7Q`1oi?5kqMUaeo6a!J<=u486;f<*}A>3kR7I zy(_x!q<@n%^HD__toO?BvQ_$rFM(~{`o4K}rcJ@_@qP!)dry?7(8q!{*?H^xE#a-* zneWYfEca-HifNF;TnBjYxQD{ktsd)k9Qn)OsSD5WdDXzd@x3N}1R6 zbHE66RWxfrn#ZK`D;A3gQa)W!IPTEW%>hy5RuiTi#;Lud%AA_x7qeG%f;_I8V$3{2 zg&}?Pel07h8!6a3tQGY2eeM!susX74lq&g@N_t{kUz7rXmP zYIQM?xo5_kwR7X4H0R>d!> ze<2w;`C5I(lk9=l@E=Ep0J>dR6r==Ja%Fno5;$Na+xk9z?>6WSn3!iCK=&`K>jPMh zLA$fn7MjhTr(3;0NfNfRb>r)XrN*!WOFZg9+yIZ~6%fb0VuQsmXOWM`$_Wg^xeI_T zjs5yLn(tQ@Lb#1a6Q+t4+JTvZQ~6f%rStZ%#AlOZ+Ml1f11f;LTp9Pn8AzFNU@~PS z#?6(GrKtw?DQ~&MA;0U8_Br&a>bm95T}|ejToR-#C2Knj)eKdN4v!q|E8IDQ+1d}x z?;>)j3^BfibwZya^Mv0VKwsk&qLkNn3YDOO0K9eMk1r6T;Lj!^(`acx|L3(5`)M(x zIc2YBvt2HIWcEsl*LX2Q#9oXj?e z=2VHU8MVz+S*`M6n*lNLG7a0Wc&)p|&dSQ=?1BQ@I-DH=b5&c?JRU?!L|!7fNqc4A zSb&e6EK0fPgM!0Gq2{cWjAI=SO*N9s(bh8_Tj!N?tORycdl`6REq+?R3u+!gwy!9qi$ z{N0O(x(Rnnj#U9H^rUiK;2-keCgIKp+=J_$DIb;$yq2LvlL8On&N_f?LK{Ee#4{SK zhxJ@Hn$_+Tj3hA+W)A0*o{S@^+i3KhXNLcr-N6K<;x^;zZHaby&?{HqUUl{+N*qvK z)aint2~tYVSm^2*`XAf3DNyI0jfkL3^XW#=Kly=dN0-rdKNP5MoefW0tv1rh7eI_f zjs@FB*g@O82;qrC^472k!&2^(%j~j!tw#180V{|{<^D|c_V0m>#XeQW6V6eh7K%j2 z0Hn1*$FLH;+AsYP^W=(HvG)#l4Dmaqq!B0M044NV@06pD%H;vU+k;Wh@X{Sic$LgL z_;p}k5)~x~3W%uCedyHww~V3k-}~#$`_Jn~PEzx$q`FGk+MDPX(OAlP>+AlwTn|8e zd$|j&xCVgj^PwI|`$lerZ4~;B6-0gV{WvfdRjKlcuQeV2G5Rry$7qPB9As01a1*dex)GJ5>jq2I*5o*k3pW<7Pdm_=;F~oWn z01>vG9(h(6=;4H48BP98b&Gaj#5YJo9rQv7@DjYY|PjvhBOccYLnDPvx(l9;$tMF=EQ=7>|5KXkb$f zjR0Pe5OWD*`c;V11DzIkzF8jDok3fFvH>_SfV1)hPHDE{Hhoym$W;8~5&)PhO$%L{ zQ&U%uYGslA77Pavo=DmAI|n1FFgAO0nhiYZt?Reb&9(wY$xj}>A+(a2~XsKgDzUQsVlW4xv+@w1t$lBM@k z0b_A#!m(aK`xCTcxHYLm)%wobNJO^gH;suAA|06R8-LURMec|GD4mq|wElf^LwClt z;92*8Z#}a+=%~1m7v(`VaZk01?(tS^2Sn#7g#XK+=dXt6_bx0fz+vcsakvYQ4)D$?qpWvdenl?i7u<$GqURQ*LffHYc@0?}CLCCs}!(78? znX=*&5hh|BUQ+O%e<*KQ4{(?R6L-F&DPqcp(o=IHq1Dz66lyobm%w&H@DzM zWBsBDuSdar=%`O|xSMyX4#zd6?G^?2B=_i7315`y_p`Xd+QC>bsmhqJeMrytt+^QJ zb`xs?ft8@~!ws5He0*IThhx|HsTJU$V0P_n0pg|L6P|vs2Yy<9i)sxTB#an*MD1sU z9iN+^^$oJ{r8>AlyHl|yFnuk~{$R>`?YvUUAOnIVn>6kD3uT&UCxkwI2B1WT?9~?mB0#dL8dGCEpzq2)BasR;>9HM^d3*>;WMp|va z+TDP}VdRH0_jj?&mLs$TS*3Vwj2(B)2Qo!5XeiANs~E{{2GPY)Xg=D=YEuOS*3O+B zojvz{+{JcpPF!U>H7C?HYYbP*>$x#!i<1#ZRx? z%mmfj{^fYILY_9O^#3Wx;Fn6yAh9`g*oMtHuQpnlCyXCc4ap*^vEwJB&QqwN+P3{# zu-&8?+b3;e#_f(`elnJJd%z$B%bLF6cjFz(_rsoI-m$;D=bMU=lF=O2r{Y&0?1<^! zvemY05N%lQM3D2?@3-IjHv4A0AWZd|oKfC$xS%1q8P|UvkjPqRS5!p)>=X9WEvu{e zr`XmC2wEJPIiktXwwQM)DY`G6RrCfy*foUQ!U}>S#HE0aOZKq)m82SR+nX z#SBpxJ+9@8-H0@ZCxKN0DUnxf3$CnFu{o% zV;#vj5BoD&*>a8{;gE9Q)2~0*0YNrJqXl>i`92CDGe~{kzwc4Gl1JJFVC`l=!xo*4 z#NL?K#i(bU?GC;IS1gIg)&aol)u+mL8|J#tdrzi4PUcsc?`ic12;EB}9Ny=7EY-}?SdcQ;Cdlt@TPr*w-- zr;<|Av1tXR1*N-{lI^!&bjp%SY4`Ijh>|67(l@gFho;l8xeo7GGL*o1>WxhVeNq0=X!`f9teD-g?J-mu zOo`sxM4hFrtBo6{UNyghm>vaF1aH4)PC14E{izt!0zM&ax#Ui_Js9<^(XiL{6?lyv ztMXVdmv^3SzozF4iT@0R4P{D5G@t&xS;@sdAIC)fZFT-IrrNu1+U*Lu zFJx2k(*;0Z+C|P=4uS|mo;s$EGAa%n_~#$EVXJ6n{BO}l@s55q?0{%z>H|Gu21&c3 zP;gKCE?eVI9^!@^?o~{k@`2Qg84FES%(yW-&iqBUyM*|VyZ1;`cylI{|9@CmMlZVN z2QW*?zP0h7Nt6r8PuPsuJLxs@?Ygj*FM>Htov@$lwq`95Q3@|7Xe%~AbQyrKJ}X+L z_9f&y2j)OdGpv5+j z)C3PD>mg(DN8FW)TG>P@Xbq`pzTlco0G3O{O(LcrCmE<*mW%ci1@(^NWK~m{}W_JJj?*(kLOg*EGNRg>03a16$98eYZ%MZ z`%#h<7u_c&oPu2PI!?p()01Ld)j(IY>6jj3M25f2q|K*tiWpa?E#Xs~!;+bNhPnaugE5 zx@<_rKWYZ^RPFnA0LN~)m)-yq)6?ET0!@wqC6vhFXOaTIOX?6URrfKZKZoRGUGLWs z<{8PEA2ZHYw4u9cp2ciuDqugIIek1cU;mh^3JIkBPEQJybdCJXRj}Ciu7^T$SV;_prqI4H+Y?<>*Z(Tw{FDD>>^zWSeS%guQT=$LC)+Bw!AG{Afw zwVn3*kHusMZl3V1cVL=Hy9biF$4k2QCAViv17pOy1!Vt8yIuCnr8js(Lj-(bC=Z$) zC!F)yAe%KsgCBU1=I&|^N+De`)VUc=Opz|>opxNp3s93hNOLW?Z0YKZh0f%E#?^RD zToam#Z{U9f8JQHI9&bdLAeMpfqHwhRm$$a`sR~B&B zItcC&B>An=!X2!2I8ExMseNBX*P3O5jY@w#bd=pYa7u(P{>+-+0CY7K%A-oWt3fuC z9=?&uy_5TWq_#_wRtG|gW|GGPf|`x`7Kh8<3&Y~*C7$hp@MB3%Ls2t4OYw@wF>$RL zP1e1!*=cEN|8wCTk~*IY%q&mk3Ysw`E>`Y1ui*)hNvrUi`&ZXrX7H60vNG0T3%QJSG(&n)BRA0f94Acs z1WMB(H27dOf;E@MOWv!%Rtcz0;yc~e9+o*6-N0RBpgbD%pdx)f!*k=4uqtM7H51=G zTIRuf_XgC-a3sq+e;7R?he=okCCO}BzC|M=13(>_a;6V>CY6=hziSV;Npg~mRh}Bj z-)XjAqv!NwzAD8ex5MUrCejujDx9aq9U0@QaWK48P(nvlR!%q`+o^++g14zd223j` zBTI_PRj%2Qi5C8YX~N|lvaEEh!`csApM*e&CRGWtB;yAPKP10~*=9o~L{xZwsDBI1 zMV>kCZ3AC4L!P|tifOX&^Yg1R`yc9PWDW6K6sn%x+nYb$>79hY;d5L&)Nwsp=;fTj zktOr5UG@0;=`$hIF|#M$p#c_tJmlX-UR&FmVs#NYyxO~tRNdI@)}2Ry1bGM9u?QYF%b>-C3`vC;PrA8`X=!ws4g2 z>dw@q_yzfkNQev!o-1!X-2QdEIJKGACF^~ZA#*-VR1$rT&%=3fNW64H@P_u$~1VR;Ok71wNuJZsB@XDFs-lTjtF+dsFCAv zvIIqx&F35uq>yELGXo&9jj@p?9Vdbu5Zz3hVAL6E$V{v_)0d;sMg)cN64CaHS@15p z(~$p9QG31Iw731sss4sl8!;fA_~IbTc)tcF;WBNtFn9WKzhI}*Fx&aI^S1~bk+6^8 zaq^#`{NxJ$P{#+TSQh5d=~mc&fWpRflF`L9tBe-V?XyUnW490&g3(mNSR3(ft5)PAyHzk;5+5lGu|LU5aEI1gBe`m+g#m^}c4ez>DhR3%odN zRJAntoT_oW>RcETz-ZSDmIe5dZ4$rNC`GLstI?VS9DcVZLjg_lZK0qq4OOrHJcLJ| z?TUYez&1n*sH(!oLF^31W!j2aBCNGI%ddZ^kRVh$PZ{5K&hLGPsi4qn?F(By>5nM= zFK)`38qAn;^1nwUES?A5o)A#KS$V+DD z$M6W(vYu%^q;%D+fVx$-zj#-N`J}UN&#!R|Yx?osP4d{KhE0h*xRwBph05ZcvK^>f z(1grE;C7Jc`Ax;prRS|x2EVnubkO$!7UQu`+JQ|o(3`+3;LR8`2w{G)Cq>WGH-AwY zAr4i@K9V%Qorp_BPM01Ck*D1 zn~gw3(StRgo>P8VrfB#1g^e?FW7GZl2rsRGER z;1g60yo|8;I9yb@ERV2__N%^6lELxX65AMV9C}>v!@QPh?*<=#=b~C|$Z!OWS^!x^VwSB~S528f<{A0boR-DV*98 za}rwiD|Wh3Jo5K-JFRI0cORYde2>%pO^y7QfSwgNID$-;3WC6gwud{ z9eq0hp2MR9+nndb$?!+tk#m$m0DIg?qXL@N2s?gvUasBU;0SUn+MR6B$nabJWbZZy z6hdbLiP2J0jQDeIse@z}I660cpR7A#%RdN+s4_FHbvH|rTD;E}rW1`JY0}Y)4$njH zek#X7FYZxtNEBUyEy3&kss*gHUWvvPY1ANr%ppU-KfJpa53tSOeH&HN5XZcx%^oL! zm@{);+x3e%+W)*-OTzD@1mY?hmANvMjP(T7@dF+j0hV-Uc}$O673sZy3=F|j$&euF zG9>w7y)Kn^?m1bO?af1a6FC$hV}Ex0^zJk0;5szm0scal6fvR`>ENp0ojE(3^j3To zwFlk!7UD1wgtG`HX-)0{kxQ;OAl2lQx|I!0@@P)VeLbvypo%03FY+Oli9gU#^m~K+ z)o=w#i5*VEgF59Q7*CLzc2AA_0_RAlAeKb?!%1x#w(Y>H&3e%^=DZ>i&G1XK7XZl^ znauIm8f;(V%&DUL9&vHFVk3m(j+*9_Hs+?RK_ug~Yhe1d{dDyFlS6!^*hkN$;RskG zsNUap<-D}=d&w>9?R-pD6w3L9a80pP0a$SQld%kZz1fK614tN=x>rW|z z^=S$2Xkb!4)6JP!|8f)794Kyx$eFmkD@tDAvlsYUPL+p7g^rui-3wdW6wmn zseJ%13}|G0RLJmDNF#@EyfLfE%<%JY6#(1Fx8)u)64dzMC+6k%xX*VedLDb|;b&+m zVz^Q0u5|xmN)q8S{2I;~#ZQ@p_yLFc0TXKhk;OwAQ=g?bBky3C)F%Az)93=s>R+Wk zcGSpOGZCdOAwUXV{&PdR4xQ4)JyhH^2c}v2!`5|=$F_=rHe(C$PAx%nS)5~VtZJ@3 z>cWE^&|r%Gt-6?HT^P zO-T`P0o!uMk6euR`uHD!f343Y7#?`MCi9b`ZObPV#JvWuaW{MLs$7%Zyw&G$N`20n zziR(0(W{M@rc+cM&x}AUc#0lQ!7Sq=R}^6H&T&Q&`S{oI4*U(s(d?1tm>Is~?ptWXl?32R@lJyv5R2q*H8#2C8?4;7!t zX|`Ojut@hvODE7vGiT|l_f5H9+4`03j-sBNqDW8OX3kV{1B`*;+(NO>k2bu1dO?8v zAawRp7kHGMzOIG>S)G>#4p2Hc(9(dWiX#Zh#U9yAwau#D2a{hx>DQ}2C}t9#1xI~{ zqa{bB-dEv{tPO1?PVC|&o)R(tl1m2${;ord0so)KRH<`ceHo?DUz0qkDT*jSjFYW} zt%v}{|02lL-cxuck7|kdJXy{wxba6@9xYD_?Yu54JQ#I}L6kY;=Z*b2W83Nblb?J+ zElCQIsTbgN;!K~!Xy2M$O~twt`7>UG)Y z?Wkqt_zZGNKAB#c&uiKhYRJ-mANk&VgH;$48&spbdBob&D6}2q5|jT3iR#V@neaI+ zjQ6>{o^VY}$KQ2lqsj?#mz+KXj9v0l%qpwz@BPSHy27tK^g5hXd1Q+#P8PkuWdA22 z*6}hr_mhyi2ac=sa-0y%t@}wIl zdJ8d>8>aW0^t8Pwmc7J;h@oNF-Xuw(Mqz5ZE_^ z&ZwL+lv6IrCMNNG1=9sIWn6mlUOWvG6R!&@!5tGWhXgAU+B{*V9L!r91jCxyiQV60i%Z{Eix-(FGx>drM9HEe*! zT)6$>>>RB8+3+;@4^!kc1@yCUqf!GDm38L_m5Y@xq#y#2WG$d!pCvVBkVJ?@B21K6g zjJ(sYMQowk4x&K$GUIC+8$*UezNx)fd7hsM*eh6AlN054Pzs4m{Q1P&b`BG)`1yV^ z6BbB#IBy;W@kN952rJf1F@=qk#aMXm=@m{7uc8>n#ICz2rVX0JTVU23j`HMJ2vOFb zA}c~`XJtow0!GT)aE?mjgygHjPa=s1An~{#i{mF4%(*2~c;h)@sWY&7@dJc6X1oZ= z8gX7nNyk#ASP=!94cfN5D>2r6b;$@9!A@o0;5hb^%zy5Dk;$Ztb7xA%Gdvf{L9b@& zm>6xs?x?XU_R9t@GTMa3y;y3=`UpJ~Hepmi?~9j40Urdj!_p1?WGlOqAM7VaD8E`K zy*c8n)!nz3nTVhOBWXWY1F?5`WIW$Xe-0@=mPDc=G9Ti|bqIAw%nRGH8*tWvowr9l zam4P$JIoZ^lwsIKzL!$*_%t%`;O^-dzPNLQ5MT*at$glnP!!N7PVt-MN+4yQ?!{^}57*O_Nx82>qT{%+~=YA9&J%fj+9 zYosKV=pV=;7nPHOZu|Bd9ufe)PAdd)JM%lqmIjv4)y12j!!-;&SM9~?*TtB z{kQJZ$=2QvWbKF_CWeb+s??3J3YVg|wR)4F!K>P>I_f{sK^2y;Ss`y}CERIOD7wTL zrSYwZ6J&?d{x)IdQ!KC}5$zEcudGK|nHFy2aA4|S$pNxNtl zb&a?`+{Figz>L`6+S&+E<^0VcsB?90_L*0zeLy~N?BD^Y;!F`%Q*ft& zki|gaXu9GJ2+Qz>eeJORC1y8Wdd`Pr%-0*D^JV+nBTmDwtw>~DfXP3c$cg;=c*6%Y zuEh$PQ9_>6mtbxW^;}KICtyY2$f@&jkq#=R zVIfZXMA25hWxjnK)zYpu=pEgoC#hV7s$+x!~*NZLhJ9q zNhiTw0a_F9Q$In#e>VvC|A1d6DMxkgJu7M}zsbSq8W?#35&Xtx)@H*?8L~47zg~=7Tk8Ai(8sw*Py`w zZFXs5$34>!;dmLmllZJE;PS|AbMy4Z)Yb+~ObM+etC+GD6bvhB#aVrzMgB{?ex#Ez z=-SPZ?=6_+qWJkvj7H5zS1{Owf+h}#JBu4o)WJlfF=NS1Oe2}x^hFnk4%S}+i9~m9 zb$o7)mx|DQjtWh%Z1Byp5|b*807DK!ekYzH`rX93mjvawXMFZ?4YtVbcl-uEg>dcQa4dIas5;ZCv?c52&m(oG!>7v(}rswT5 zl{GKI$JR)-pQm`h5N@@}1#eVgu`6%0VEWKQdEcI2bc%4~t&isoD!F1(Y4GOl6R9X< zoh~v{?*#t^_Q2a?bO5q~8oJyovX`EA76B&B&`?)2YMi!YcNGgm3Gqi-!g7ECw@$GPg%Z4A2W`N!j+S#L3LRZ3<2! z+k42>SQ?y0^%966T!Vee6pI!3DKGHpf5R3)a$nt2X9)V)Es2>w7?z&C>L43#3U@s~&*4^+TM3dFtxSW7g_m)!i@8%GESp_35Jk zIV_QT2rZspZGxVxAx1ybICPC1CLqQ~-KyrU%H59%vPV_-lrF6PSFd$@CUHC>oe$Kz^wF6$l1D=yY~l{NfYF%1pq1 zAwZ!Id%2jpgp!D=m3%xT;lh1oEA$yc^pBelIEh~{-0VR|ffv=NOeSFb7fV|@qCAceApfXxU*wpnTA)Jolot?HJhf`&k{EhlrF7U`QvQsQ)aoL;Pe)DoQ#VArK~ zim>wM9HAzWgyzC2UrNlc)|k7G0iSL3MSA#K*_ATaXk2w{zEAPc;W1-_7qmBT`A;q z=Fc#dI)8fzA2W7oourD!+U@WfoA!WXS7?Es4Q!IjDZUO#$5rc>zPFtiwF{coL7a{q zLAQu?kjPdwiU~v_4Ax9P2AYXx`Tx+FKB|P#vF9Zk1v_VXzGzXNNRU92ymBv7hz9Zk zIt2&RQaH$N8EY~lz$-RDFRA5uFbu7foz+ZEU-h3ayd+KX#Qz%3$PqVA9= z##+svpJJ8z!|axBY!gWANRQ0yyw^Q#?riGSWyNR54X*k?k!TO}10W5vnC{#8_yqF6 zO~1&P73$29@Y(b_!oEEDOABlo>^N(JLiV5^ zK$UyQl6bqPez`AZ+{1?zxJA0m)Nw-ddH>?ylh7@25!7Pzo4h;9$C|ip-mc%Y9EX@t zT!${y-UA)`Rr5v5q>CLsDTkTF`AVNH_vZb(7x&gd{WS5H2$gkuRlRX__4jQq7ZTqR zUjna7ElkwK?`d;8_4%zD%K)ZC&})ABM*)(ir_;afK?6sBPZqpDkh%w-KTkF!Mr@Sv z-MS-G^dxH<`wac*Z8g0z>i!t=MFndOdcT4;6G@-l)N6`E5Ri)t(2+Fp3;202xuDf_ z$Xed-^9Q1of~?ck6yf;^+{>&q^OIA~2$BsrhOfHORFk_cha7W7pCWv?7rt=X+$Eh~ zmuR4~|K-GY0Bca^U3iG&gH^)K3mheKUVi%p`Sq~z0ZL=e88?C=P{1ZB_zv?RCbgp2 zD`)sA$NR``NMZ>qrAF+D`Ou$)D639UBbo8AH>>_2J;l@!Xx=r)+ar$!DEVpfo`59# zX&~P8*?mdEX$j)OBpb?UUwIU8P%ZiiY^XC->AG~s-Yd;P4BWvcd`XgIfQ$-keZ54@ zBmoFVpJu$SWy1P)2Rb;H-~e!xn#GqwF5NvqI9PT2rkn42`G(=qYe^|{pCHAI`Qyd& zv0v|Ql-F%0J8oBQU8gr%O|nlvs$Ks%l1BvmYdUL-^>$4=VDXNz+0P=hMljjhQs_9x z+KB?U$0(;?`rt3`xXvlhtIqPC_jNKOOLLrengKym(`AhFKn5+|mSrc?3>KlWC}j@1 zs3o_n0_rihlv^ZEP`_|#B+>kHd8vOwvJfs`*f3~v);2z-(MZ9k(aDmORaBBvnYQkW z71piH=Z?@3NAcERnAKg#e;0xbP{ncUOJ)#G*n9PjfQW@z=CaU*@b3-t;xQ?C!-&b{?s{l1`D*IHAh(do*sBpB z(Q4dU(qP!2(ZDSDEl4W8)2SiOQJBO08_9s4rFKWs&PAI2cYurV}b39b0%(U_|{s>nMQkFrbtjc%9 zEIt+c{Ws|d635xWe?Kf98(1x;IU`WOsqf$#TY$QOS&A79FYxnvf}qtHpJZZ~Ug6vI z|3JwZLIV30HddkTfQoMu>cI2_tIGjWWs^9;@E8S2uQcxjvnHOlxDnH^&`OKaXT~;B%+4^{MuQn$F-4rR$AKE zdgLIZz0ZV%3m&LZKuG~Ob|Z>La(A+3&7}p!vI*INo2reuI{3!!ARrdTPj#Y+`QyCp zD-Pr)NG^}DXonu+E_YgW+^#*>6FS<6!&8z$(rX&C>$!U(y8S7&@4A;~R8SE+ZYO-ex$wiJS4_UChJ`5}&#} zKoT*FK);(=Mc1@4AYA$CC1a03zi}K%`BLp1 z2QbFoCVID7&Py#{w#U!hoxG6&y(qt2ojbvZjiyh0VloXY*}Js-DX)GxHTv$Dv>LWX zaavZde9@igsor6MjYOu%{Uvw@_$BiwmALD5@ z;fdI!k z&YmH>a|oozci2mi7UuRoeOYrO2gl4f71 zfsWzH-|j`;Ry54KxB&SC(E=j9QiEK=IvU6K`a}S7FP~&ril5 z%=(^n|IUV!7#?!>v}EFC{lwy+N49kJg^zDNSalW*fHkkfG%MRUqr5iKnJy+;15VF& zcCVGQW}jeKMe5-r-Bm1%*`&6P)~I<5p}Zh0U_s^p(()|wEzXhTSFE{7b@t6_=Ytv~SADpw;1C@;blf zkr&R+Ux>)skATwgb|2#}?ZoYV-C=Fj;|+GKOfh_Mo=4CLh@w-1`vciKM>GM9FkJpP zrlZ%=`yT^~gE|nKvyUQe%PPrdXz&*k_V>8pji1_*y|id-Bp*u4Z10mTS&W@3s9z=Z!99G>FtPe#u<3- zgJ|oa+o4z)PML<{D={h8RiBNG4upH*iM6zMpP;+-c2qgV&NS8S3NFzUystyA(!|$DMllX$TpvgjUT$5>X;irY zxMZX=!%XdOkCR6vQa4CSB;;X-=60p$MZbv-8tO%R@-vc~7phpgz&l-$U3f;6G+()V z3#Ts6C(-lF?ft^w!63Q)=wuP~t{(nH@bEs^nFBrmn~2YAx!dMv=2l=T#zs+#wCi@i z82+MdNeGBf!aST|I?3_|ZGLr-xKgGZ2COjDVpRsZQeMK4QYK;+|G-haMrl5NK2IJ+ ze-InFBZFmoqhUYvVC>3*{XMH5!StU$f0X`3M@EgzVm|mju&c^M_4dLWfV2vcLZRZy zz~!qC9wZCZ`|s$342JxH!7U{VzRg%1=j?BtD(sBb5LNOjq7dv{yr5Yp^EAgx?&IfE6%S&fw5L-OtxQ%$z5i5=9DGv4kV#aO{PZ>N=vui z5aOtuZb*HsD2#sh&~NiH#SK#5|CFg&$(-p&pN6~582bLZbIN5g$gd5OYJsN~7>oWx z4Ytrp`PO3CfZo1Bb^!mmL>~mv`{1~Jh2gMFKuOxrl*6Wmm8wt5&tXIkqWtNUp&SIYDINwdj+r8j8PqK{(OcRul)Qv3-(z>MGYPey|_N%&%9uKOR z%~-(hdo1%%q-p5qcx1yA99KF!`wi6FFAv*VP($!^N+=BV9j!T{*cS>Caik45p~yS; zzjoNjvhp;nU*UTiEB7|tcR9u#18w+nRH${O$5z=@V*@UIKU?u zwc@S9-+&r&I3pF=*)_4Vr0XLI)(<6KIEf26z|-_^f+^sic|z;5d(hZN{O>x2N)@58 z&nR2T&F^gvIdiM%G6UBF#qiR7>yXT`G1vwzBM5z}H@)2_kq*^`EX$UL)r&W6Wi6ap zlYbDcaxMcp*-rFcg`?s5E;dR7BUJUzdU)&!5`V~$Y%hh`eHr?rV%hel`6Hc6_SX z&j)W-s8NM%WP{w`GcY5L?4_8;B^_VL9-*@g32;o6?T1`k%)FX7I*0kEy9I4sUz|%L zA+*Vk0>83?3cuT09m1K6dOZ!zy-(NbO^YQIKcfkr?ucYKr@kKx2_(u_N|Fl>%}qm zK5%+**HSzy>I^df9nQ!Tujkr4zW-}lH|BIYX_RAHv?IveWh26kWAV7{_vySObKC0i z@0!;z{-W^1dt|D?*<)9bNvDp!zMtl|a~UDwf#u}fn|<0ohM{AZHJE#@f@-%L#R$RA z&}V#u{9FH6Q8>ksFkpi+8!=Snv@kd8Ygb8UjKIngo~!5fb?Hld7WZivo(|d{x&_zn zeC&mNHz{R9XaK0|^!cndA#0y}enw@gPbc0JW&ijy^@Jm_)>(sMLotXmIDJ>R!9YSDHo{)}4EM5|`lw>(hxB%rv zlrvWt7>cPG3v#+0LV@H1az*0Y$sxS_;#YGjy)Q&m>L##p3x&k z468L9lGW?lO2I=(I3mhg`I$XPE;VR3oWHOh2)l~(jQAo_winPR@jm5-TJ5&o_Rg(V zt>i3_3A3zvb!0E}elcqh*K~${c*1ZO0@z71G<5!v)67TN_bXa#ARF$H;|kW*f#wp& zubuo51Rpuxjo!tkQmKwSBfM#SiyJ(OPlJ;(0zFj;v{=fDyi$PHx1S$Z=ZOY-HG^Ho zU~@xgek;E{mW(!YqiiUsClQB=C7Mh$a6LCx_5CP5|BEcclGXplE%cxyP-$~rt==iq zygGY`Q{-rSGg0dRAeb-rq*CWC$Zo*3&1f=5LO$FLVw4=@k`#W3`>7(Zfgt=#PbjDRuob@LR&qTuJJUjm0h7cKS-R-F@3|DGMGqjYmALW<7f55kv*7f7r{J z27`3p2s=)sq+=jOX5Md-dXTDvBfY`guK!=r7{*6Vl$j6i*bSlfQz&(5nR>NoTmHEOO&H?6={4V*%lK)~-z|Fe4_=Xhy5X$}zEx{&u@sVh{pSHd6;4x|3B%cM9f!mU*?ExR}{X`xD>UOh25T=#b@haKr4>WxN7C4Jla-ohDMQo%ewsRE~EAD z69nh*m#W=_GaJntuXGccSi@UgB4&>n6`n^x{L@F%d5QGehB~EYf@uPodPARn{G?_9 z)wt0SpvhRblmXnC_JlXNoN^y~TPOKRdcR40Yuk5y6kVc_)mwf0m9|2GH6Vu6*x!6SQ3U0bYcbVz&89=sDWrYDCCt=$$(mcc-`#WThfJjx3$%iQc!? zH)2U6O{DCNE!Dw8>D~|)Wc2grz;dM?mELRp>X013!%`p&E<+JIs3eHMY+xu^=VqlQ`2~ zhk4%H$m2?v8$Nb!qQS<7)a$stuaB-u>=6MLR1ZU$Ynn)TNikSIGK~`O)ANU={n<%i zA^|mg&6su3^^qV&umEorKYDiB$*j9wk>_CFURpY#=DW~lq8rU@Urs4=hbQvm#eCVv zHJLHBp*5&z{5RUI2)@tkQp@~MZ3o$&m5wQ%?9{uq3N?#6=f4@%A^CEd`fknFiyZEy zr1-Rkd60AwlNW1JRH500KG~8`xJ$d#9d4+x zS&olGY7i8vEVCSHk~*)KuFSgs^Ui@OCU?Rn2x%cw(0}6uIETxpFZREu!yY&~}or9qR2H?s%N^x~8^z@RS0t$q;RExDk z32^;aE;akU?+F#MrKu_i1r8K$tfU=%5YJY^=~Pk?#C_B8WH6_~Z#eZKqxp%=es%yJ zUl57BZzX98-Y&1F8Xyvs=pobJG@p{^xogwWRv*y6Bwec{>;>ro71C0BB(1m zH)ACJ5;Pd;1u@alHdF)aHxoq&FoDF&YxWJbncZX#1{!)S1Z?Z-)i$ypOi02e=J-7s zV^}_f>EZnAU1R6XZny;0H~}d7b=s+}R`8>%_8&K%l^fEE=00_iCzBOlVaTpyeXM?{ zC_H+(198-Fla-u&+#L^coJf8$3Ty@)4GB`WXhxp&y!BqV`uODi#Y-&6y|lNg%a@^@ zcc9Pv8o$L>25__)?8=N%c3acwU|G#S@;T|-G9g)6!9SOBQ?lOISWvz-q-OabY6s=$ zn0|JjX@9w8NIp8I0?< zF1uTdHaBV)&J2j_j$`?5#!S**FZ{-eQB}n{+~}t_&oa-;4|4i%y(q{$x+p-_xNZbO z!o1V#4DUmRC!19>IjWJq3%k}`hd4U1(HF4EScT_APvkPfNMap^5ndGKqT!{9pqQ0!s`#qn?) zhQJHU9kz+ZYGPgEJh~06Fg*t*0?Z@@5FYS4^x!BmlQUD176VwT{IM{2N%MH7`-SDK z;H>Ow8YMK0S2~Hc4Q%f@K9qd^ z>SpFBpmytx8C-)|B(M(>vD?HM79u+&al2VRxHXUM{V5PHA9X+4D`;89EK~YIa)2Jc zOXG^(nR_t{2nIiXd>-i^xM`ZsBZcOGdgUaFXt?(MNUKbhHU||mX}K-K@0wZ_6QB$L zB<-S(AdBL-sKk}Sd}Gn%l~lQ)G28X|rCGs@fCl_7LBu*X!g=1{)?zR5O>gr(w+ra~ z^A$w8nZNF(?^^1mZ(%LwLPTzG^#Ht11l}S=K6J9-QIc6;HQtBBzj^P4gaogs(k`X= zn1h;la^NH9VRkl6dO#5)^!wC*QpbAkhjA0ms}0wL5d9J%ZwCa>A=G-Aow^ztys36j z$EUE(Tkrr-DEM*()kmd(_G9C4>05-cD0PZf;GdVtsQ|nrMurcx`_Dx=^o|8+Qrh>f zJj&96O-qj|H^1%)8fvD5Tk?pb&hbBfk}_D>X3B+Mbiz0R&bM+I9RN zi@k3d2=i#{Ht4-13kt@op&0IYrqlEDvr~Hf6zpE1M;e$qsdyS?P~uk!gu6fJ$Hrr$ zRM3M1txz}oRl~Jl?~sBc+VEx!Gys7e&5EJE1JYOlla(#5nyES`g{veJHAxYqTt_+~ z(@PmKNlP)SHMuZ$KtK@eeYLYP8N)wi75!&SkFvNlHthCjPSC|wBxtb z&Nfn`at(#{GtjeiS*||OtqqaB=zgBXZwc4f=|5k(%wt@+G+-@jA9l>m?)Sm<&f zRP!22bw#g0g7x0-72+WEn~2xY|E#FE&lpl%NB1=6)h8OV^vw0pc^el)s~v|wnZ%zi z=zcU>;0MXxXX$k-4@o=PZ9f{I(BCv=on%$Mbc%d;Sa5)yFqB=l-#f`Qm_4x2SZXn^ z=qXB>^c6>L^9W2#r-g5FDQAl1dD!C!JgOAM`z=}+bIG< zUd|?^&zqn({}*(|iJf$N_#(>ZG8hH^!#l{Po2{mngO+sp(RMzckoEOtr)LwQsqrke z7L{r{Y(rtL1DXDDVs#{pv4p#S>CxBqXVoOO?M>FHe#V|pK>PmLo9Mbm4h@HeCck9x zQvBHaI>vj8{;#_LhLXO2KxCb{H1Ou#?uQXeUqCNcUQL*)M%ku**NLzDL(Vo@!#Ajj z!{HVv;@DCHD5M)?RKD>t4Nw1siR^SdU`Ibo0Pkg4zz>u@`$NW)37Q<{AZBsrC#Izl zzoeXubbZ#d_!Jsq-yU_y%K}{L}zt8p#Ga^Vq<-{2$1Kpi z^#i-8_<@YfK_|N6Jk(~c4rJA&2?Ja^z6JY_tB3Fbi$!)Y)@icVzyx^KvO=mV8LG*j zeH9-Y3aCI-R2d;G!*e3R$^ZA~r!ZiPl?avG!bCD4YM#wa;KFIZEd_vQo6msY>OpSD zxsOww^V(eL&!*(HM}+-&7AQrjAdB*AbZ%kAOH3WRodl_XqcF%M+gJMc^@P^EvO5U{5B9n5BB)9lvMa@2obZCGkL5JC#gO-fV7oK zJ>P^PG}4o@gtxibJHdYvc9ACRxQk7`E%6Rhn0!x_EArjBMt7fz4jV$$DW)e>FN`ny z2|HB}!ndD=zMC=gKK~fB__L495mZj%_z*Gv(gjOuvH5D*@h9 z2B!MVSpr!?!Vmb3qUc=2{4+LHqzRJ14TfLQo8We>Ws)A|E^HXmsWCv7{@@7R+z#QYZd^IKU1*fdP6Yn^?mb9gEoBl z2dJp6CYAA|>BK#Luz#(Ay~Cs-*cM#~7!z`<-M)dJKi7D_VFA$5qmoA6Vx{e~^8gwl z*tMX}G@K<~>(L1E7qO=z{3 ztu|F|mCtxyKq=&5MaNH0FejtN?2%>eYZS7iOQvZhhw!oCU1aq;2{%o~RzGIwc^a=5 zkFA*6Ih>@hNO>g1z4zVXwL4HU*wlB#Ku1p4ml=`2H9Y|QSm$)_X;~eJzeX?)P z*$V4ob zbCm8#4YGM&?i+GU2G)p}SaU|=9wy00+A86JBvF<7oVbMIA5K!M7>qnOC-2$KVLsKU zAO>-h-=ElXBUL?{%amIfY*hRS3z}F(Bl+L0`470!3VX9bR=GZ7RkoYfQ5gzc_xoox z`VLu#kMf&E6coa&4l>Wgsor87+EF-WQLT~Wv7t@sV1bUR4q2DktOVP~^TL|VT07gl zAMa^!;zCQ>zQJa}YVDiWidA`6Vme~)QU@fq&su0v*5J$1OV^_FK4A-OoNxFA1T4>g zqL;m_0CL)G zqTwb5F95Ca9+i&+s!XboS=;G^am+iy-zDczA$B><|MKcX+*K-Rv=rteid-jgU{( z-0urVnF%Ll`YYf6$JSfMMg6U9-*h(;f^;J(DP2lSsg$&|lynU#p#mZ(C0(L)_kfgu zG}18ifW$}+FvPw1@B7(%U-$LA^OYYyYkuooYn|tDe2;q#-Qi>nE#(ob=!&PB$gtu4EAgto&=miU;j!dAH4-E6P2@ieGF&v=Qykl`rbWNld?9 z{PRlsAM3HYd)B=tbmv&Ms-t!;iA%>s9ZQ08My}QrR$m*QDl;5lZT-Ww7wf2$ka7UV zHI(%Lul#O}nXuww2{@{Gvwyla;<)sU7QO37h^eDMl1^4!QKn2CxbVx#x$cy*%}Y5i zPxY26N+6VtalE`FsAfbKbOG8%%1ayT+0%P5r+46!nMbCdh|@DOEyHVg=j~&5++vTv z(BR`fI*-_IBKA_SZ=pH}rSFpd0P_jHcG>wV+ld?Ai~T3F51Kl(u#E}pYcaI2lN(7_veehv@8ryWeBN;m0ulEB znVFq4zgVedlMz@b9lF6XoW5X?@e`{0!2V(0&Lw6Nqh6TC4+3-bO6!XFM~ARqy-)HPV=dU4m36U{@% z0GeW(kw==16o{9_BG^|M4m+wE3AM0O31@ViK(n67{Wkz^=qD?=!wEOTt9@`I8U%1v z7?+c*1|KERgH-(jSct5Y5gG{*$8sD%?W;`L>x}`xNbhNd9oA>67z0!=kN1Ph? z(N4!2UFv`%<%RyuX#-Tu0Gxp5jM_YrjnsQ--QmFQI%S+t9#q{j#K+|*?>z03rSrK# zldX=~878KF#iuycm*H}JDEf-%t7ej7Se?A{Ut0~ud}y?*#Zs}SOH;)sbKL;kbifg_ z@6!?*s1o{^r}#{-g{AHCaPXON7dq}6dV<{sX#o>_+;%|?=BGWOl}GNc&s1q=i$L2g z*_BL=o2kYW`NLAdk~c=`u8Qe;g3E~2-#b^DREb`qN&1JMD8yy9xZVD~zT!RMAnxyB;C}&`MK4&mc%%_RoCn}%@z$9=S zeLC590;e@UajTJtI`sR91Y9^w-X|)J+4(Omh+__U#)w$pq8H7$6$%JT^BV&C;{EUO# z=dTTlpR9Z>8P>J?-&bB0KvfETecZFY|M^LrU4~)Y0VvOvsl&Hgi2F9TM;akG7Ee~B zI1AWHlU{sy{A)|FLH+(M(I&3M@@ZgrDW$|FnikIO3r+Mdxc!4EN@i?nNygHXZR{yN zTe?mF^SduW^Gl*Lc(O_lPU1M*79+%+NAykfh0cnW$PSxQ=M-`&(CyOo3HJcYWP`B)epbfrxpuBH?6!e|~%mICfvTF*e3&xHa}z^c^$zS@4d%jt@;Thx9(a>4h* zS%in7OkyJ8!Rc0$amaq(i5BOGCU|vl0LGI;Pu6o)DMKyQ{Fwm1GB2!hvHIuPk@0~^N@T&oq$^sED zS69j+jQjS>du$K7;!z#dkY9UsHbf3{S<@O^|88}FWr;~(nW*6!ryRNA)E@bwmaSqg z?JnvP@`oz04;cYBzsy|BK543dv#~Y&`%07?mjAAv zwb7Ss0jExs-Lgn-5a_E@#e!TGOXKR7_?r<+t-!S8y@g0i)a(2Jz`BbdT)np=d3x|blGE>@leD{m zRAZ9)C@|^2hCgfP#K`k_6`G=0S#JjX-#l_rTr`uDrQFt>CSdkzj9LYu1NABe*c{|W zBJSKFLekQvA~{<$`hKq+i{N2Sn7={s{^C_osHS zWMh3gQ9-l^_4@tsxQ;km+Yr9-;(VY?UbCXjLv*pxQ9EF_eP@Cz&i>}yce`cY#{{;} zxb3;!7KNx>+cqp4$$qE_ofxUbZa+n|rxkJ16eUoS%3tdTxFWB;kehLiS2O}@U|%oM zfY|u!E~e`agq$tWOo#3Vu_a#4ux!b()Jd%_&QDqR>kb_+`XD-dcp_mO*DbF1n*9f{ zM#Z=-c|(CG>SXL|8X9cpWH-IkRASni8ytfUivSTKM!ewtx9FRK!-g@NTWr4`HnSE^ z;tQZ-Z%9XT#Kvrrvl3eN`*dyFrxqO@3EyoF>0Ht0p+MM=VU3Vi0!_CLH$r}ppU zu$Jz6x|~Qw^!}TcEAtWt7ak!Fdc}7uZ^@YMpVJa0B;W+d<5b;?sMzMZ$4^Mj_m%ry zXvuQx(eO^9i9#ERKA<9P-WnhNeVvLyMh6?`JpRSlgDLG(DD7&VUB7tx+v~|06i+b2 z=)>)gcCezGth8mrtq^#kzWA(w%2Mbjog0HXwib~f=Px8%VpcGCGt$*AU(Txpi7ttb zCa`TUjU&gZDh#@~tH~0B0;<$1v?0*2uXBdQx$Z|{ za4s2;baJld7uIBo?WVhM9^vLfQ&eojga|BoxsNYD>fgAfaWzBBZd#-@*c8Y5wY8L{ z!}QEG@@0l{W>Z3Zi#H5c^6>IxFf#S_`*b@#N)JnY264a+J(?he*AG9EcPd$lo23lx zYzqKIPUVOq)p#s(9+|evo(6)%O?U~3>KVBZdyzXTs6%nryQX=IwnL=< zUas4PLon&MwRC>Ifxx^Sui&^fKbaswzH`E?W0rSD&g$k}TX=6J+^fp@V;_a@0N>>4 zIBqIo04))8EM!PZNB{vqXY_M^36ushWFzXpx_u{n(ZLSxcTdT^&&60yqM0DUaG zrSsq3GK++qS4mC6$Py!F1zX zzK9Rfo%QN?%c;J)NJT0SvP_yX0s}=!h217Sf-vMteswYj*`cb0CwgXR6CUjRqO?ECfH{-gzU~#*%isDC|w9m-98d7tRt}0XsFzLGbPT)6h?UOS4ky2?0D;J zbaH6vyf}#KU{D;bk%WzKA8GFY@Bz;t!PmYmI_Fzr^zKW+9|+``vi4p|a3)PH;uba|Rl z{%SGf0pUpdSxfB-Ax8N=w5k#w_VsU$gx*E z5g%|KM_eDQ^`SuJV@;DQ$DHUI3mc2v>n(=?i&10B+=X9H_sL{dGHg6xtguGTYy(uJ zXL=MY{_k19H++zb`_0qdC+g@daIJ$Ly z2dhq?AQja=b`<*SNgGK^Amkv#J*2XHKo{4D#w`YE85eQFmY{+1+mWP{buPU{R&(Wg75jVSqcCa)pY|>XZh4|}2 zVpT%?8Ag^IEO|`Lh_Kx7BLQQvG?@RJ6Z9Xl2&zq-`kU3MZ1F1!_#!lT`U86C^(uq% z$Cb?dd)Pl9DQDEj*n7*fsT3q5S+7o{LCfgNU|`zpikpSn4L{*c?I%cXSxWE@*O0&c z1*72gh2;e7K)Xrx*bQlVbsBfqIa(h?p08fzPt*T`7h#2S^(2{)%?UVS);ZTG01$+w zrVwDRtu{Pj{1S3~?x8KXv*@|i0SX1xoV!-3MfFSdJ<8qt`-$0$f)ocC$(Nt*8;Yk( z^@gV&$3M}=#~LTF3<_#3j0UfvI-PPso;Zp`OUvn$B8nri~)?H_b#Qav3eGj0&chKcq_+&nWky&uP)iua+n|+eJLDbLY#egMF{} z1hu|y&N100$_}f(CtYD;`Lc7Z>Kfw6=XXeh+6>MPt&b{MKFz3jl{I(;eLX)CH4M|z zP`Xap9h$b7irHwrA1<{+HYY6BeV(v%k}@O0#KNgvm8QMt zyL7uF!mWe?Dfc^-y4`y($1LLMo3N5l1oc%^RY&(tE949gt+qFTE%^_%!Xi{+985b} ztUol`4{l${h-hJNh#+9sn)J7Z*(Ij8`glcyn_|*xAMAxaL*4RcPivOuwRq(rmy#*z zjMu}`h{^UvRko3I_w3lsFCP$~DNy?tfN|0p;}UaX&Kr(^x!dY7?sS&($K!XR!J1ER zWr=lw(@f{tSz=IZf+4RC!k)5@W{dV5)^Zb7|H$WL=T{i`usHwO+G88Su*K_;DZxJ4 zzKKg@t#C^%nL1Z zt&VN?nh`nb8tPKY&N=o}g+Ivm>^~-82 z=0uEBlFvYn`}?t+Xv_@|U!envpmi0Tys#5ZJHn56OC)q{&W{swaR>6B@8kA}MLQdg zxS61iw963A#;N(`HdAZ2wIE%+6|eiMW*wdu+-|iuz}dDuyNJpF%Cx`fWfe=Kmx11M zudg=v$>*()j!xYD>~u|N#$>uZBKHn2A80T4YG>D+B($+(2-Ph8!hMrwb!X&aH*kqZ z3)|yn-tA(1^!$r&pG5hqi%_qyYJR~0o`|j*u5_5*Qs~j+Lgvw4{l=SSq&z|g>eXpU zj?874Z(aPtG{UNlCM2GG_1H1ot!d1<&!9pSr5c=|DQF@!16lj|Q(QGIQcWZV<(=(6 z@>y`+6Oc<=-9(eRN2C$0kb-V|r)e*GhPwvn7yMB`0$*S2qOsJ{l*3t;g}}W4-k3sVcQaF0BsNT1 z8uyN}jimm538vIm?3GXK<2>1X z-KjD&r?p$ox!*K(#C(md7P(Y5UBG6NBgJDC5~3B-W;l3=OZ`7@{nn7(pGq=>H6yW;s$`s}kYtaXJ8wr+ zVlH*$pcS(;B8Z#K&66QHEPuNy%1-E?qL9iH(icReO6<|Zu2QtvdqqQdJLD74tCFz( z98rPhzSbi0KS~A2kMvH4(I^ zYYF_q(e8)q{fw0DHsca-|Lp*2c{gMbG>xG34o0&d>6Q4$9d#K?C7GnrMUdpu5ueK= z;+Xj+@YD9GmC(;Rw@JEq_p%aLD9zw7U!txR$skhsZV2qb*fs{&eLS9L7sniM6qgRE3SaOP(OuD&>c zd<9Nu6F98sQb$Y6NE`p&egCS!O>}!CS6$AQygorMcUXs<2J^B&e*}5oFWPBfki^mL z_WmDx+3$wAoRMrp&`j*18wEOFhKz(2ZQ{+asyQt?&dZhb83@)5v4zoW404x?B}@gK zf~5SE9g7H0rxAZ;Q6}3*gfROM9rULLn3L_IL^@H~gxyym$j(f=?nbMLLdPz6MQ!~f z{FqSR!WW%a(vY;Qplh+fX$H5}k3C3OVMxF_z5VV^jYpBQoGbgHa~T>=E@fV>cYoUk(SV@UYNSFfb}pNe@%;dM5;EncB{u2S~eDb)hb6h zI`&?@83YNY+Y~H=AI@_ek703;d8WM-yttuX1?Ai|h zpbjRp$iL){G$e^5P z=uystg}_m9>vpuOa2v@JwH8~@OQy=X42_*RKObpqLO185AjtXB#AHjn8F7eCO9-IF zC*P-L&I{A5(ua0*Cu+4knjw^Cjt(<_x47zTdwYQLq|8N_XQ@Paf-^G&_;})QpkRK> z9U(-aBP0YI?zdq^`W@)UXQe$7a9ALst)Cd1KSH@mcEEA8;Et%^W-NA9h2cH0m(Ak* zX4IUOT^$xnrboR91Zn#~FRYO(b9_MrO3L9Bih8W7CBU??KG5Xc*sY|U>S zX?|x17IhH$%B!1dv0y4Ya*BJq3zsCe(gVo1zA$9(SfUF8l2AjAm=5N=szI5h-vQUX zFVezCFfK2NyrvtlwMGkQRII~xR*JR(kRWs&oEN%}(u19J6dLTUd1F*Ay#js&u?ovO zj}MhXo+p;Vc-~kdy$r(k?Db{4BLiXe&hK91(K7rQ0UB_-NN&#kjNH&~=Qv}Ry-napt{|sd4O>ZWcC4?_^+W(r|b{tKj-q1?~4}YY{3iJ@7JpALS_VO&C9Y;}a0A0vgeqWw z{la;dViT_2>dje+VaDu5C+2)e+WrXQ=halmHHIesvXmA!{qV;;cX38YP=jm+qz2W@ zvYIti?5uM$G-PPvh_7|8)o|9WHp#c${wSp_`?={HWIT?980l_J^G}tVnbH)Jr8~b6 zsZf@%uWrx4H`&H?*ndi7=@FrLNPwY?yr*a^!19g0b~p~Uac%xWx0&SeE`4()p+HPE zxr$)rC`J7F!Fm-@{~)Uyi*^e5ggY%(TX)+#hLzUBPpl8$kl z)e9L~_s=SA@0JqTRAcJCvi@Nu&EW(b$et$^ZR8QXL>T79`8;VKWSW-O`;(qE+67r2 z1-8fhHxD6_jERygF-@3B>2UMOu6+2-qChyp?}AF??t=SoIuT~Cl@~-P}Ocq?;8YCb0(r*33| zA7ou#BhD8*U8aLxwe0Z*%I%4cL9BE4?rVztC0g2v`YzydLJ!00%(fXL`9;+L6ZM;} z2~H3hyLv9;hFoeWbxE`X#bdRt7%x&nTb$Duld^px2gJ-QBtGvD$3MQznUqcH9h?Li z0+pU=?j*+d#TQdQ;_cdpUmPFTGMECLXy&{9FDc)&hU~`!4{NUk%Iyt7-V#+2#zeN|10Z{;*PvJ@UAhm7Y#XoBOBE(R9xM@j5IBR`Uk@ZIFBqhKe$^iZ^UkH<+9Xut zL9)%;+u^`XGdvyNBXWqwgaWPi(LqFuK*Pbi1i6c?kXsUKcQjG2l*V=Czc=n`8+Ib9 z#{z0wvt7(NV$O(G6#xs%chuHn&GnXHLV>YB4N5Na%~3@r7(({H%c^u2*z+IDze-yS zDe_#)I;uO@SuxhZkTj*w%O3G@Jw`M^5|ID2i>|%uU(Fs`P6Z<`*W|C)7k5#OlcIU+}2KHtW`Wr5=?(WE|tjtWYvLKM50su(Ts`A6lz(C9S zo5@pgDm{Ze5=>g=?VP=w#!qJLtYzR-JeM2*?@}5vor#ZBhUXS4PfcXlI3SYcnM;@< zT+_eIzLQ=-CsBhai3@19$e-C_1L6TD$5f~8I0HH>0dB_UL!JrGtrbh(9c7r1Co67w znQvs8d{&~hb>Hf#Im9J0=nQgs8!W5AOlCvg8xDcWKMt`JNd5Aq)Y{?&WiQ5OP#I_E zhOljtRXWhYOmseC3{3=de;EO7CPUoiV-=tYb*tjs{dY8EOakeAHiRR1I`1;2z%b-; zh#j0KL3C$e+fbstRHQrE_5Os1PnRRv0RP)ZkfyV%IYE(SVlfW7Q zS7?p7IjTGG7nar>S6RpYUeYn~IH8g!Q0H)*bf5|4(HKbR<_MIRY>Lo?Zahlf#@YzT z@{9EANc%?eh(EeWPm*=DM>5xdAlFndPe79y?FsP|Xi+~&usM&IX**Nvkh;eb)~EYa zMZa=I7_@rtXko|j@)7YZF&UsI(%Ak|ensil*)fPIR9N4V|Kr6687DSi|5{E}*MqZh z|3A;87?Eml-74hDx`}&q)+L)E!Fk)#H;8nsPR`OPH%xl5Y`d*Z?_&`5sWjoJ#>Z3; zG-w{rpQx`TKVU9tFT}KWnVHIZl>m8RyEo%?TvAe!oMQK*72N-ENrBNm0|A3V3*TUF zhVQTY&t-^hJYFU>K%cheRZuRLO?<-f1Xf?K-#FreZ0eW^NAqv)taK?NJT$7zkmOo%3 zt48yc@**Mz+FDvqUF)}mf2#5SmAa>W zjv10w2C#Y$@caYcgYOVeho2Un#ZC>RaTo7E#zII%HwIV}CaM2Qk(8SwJGy-N6XD?&O#{uY>5x!V~E%u~!-EPfQfQ z&^UwWORgCk)-4(-e?YWm;Ea&7!>Dy0zcc##TsuQ^F;o3I%S0C#SYVm!;jZ4{<+zsI zZ8_ZeAGFrvnQT?h`|}UUqd;7d_Ri{M?jbH?=P1R+JDT37mhiw<6|biQ3?_OQxvelD zUi~pN79^yFZJwXU0)uI=RBjf^M*X!tiW7_2Bco(ro1@D z<^er5#YB^_R`$ElR$kv2nhdK9^-lT1>rnVyI?q_`E@BLYPU#azbU4Ufna2cM#~ z9jc~0;fdVjn1~S#CqJQ1_x!;hX22TnuchpqaY07TPhLp2kUO>@@rB-;06iu8io^ij zoA*#Z@F5nEwv-Mg{6S0=P=kqSvT~?Q;{|BXiV;RsIyx|l5{b&O?>J0@u0F7xe|RpZ zmZbW;_WfPPu1*CV|D43qe@!K~*XuA<;bvszYhRoZK@S#R!wkelHr9H(5}?Tfs41Os zU&hPqAvsp**}lNwr@4zE9y>Z^WgI~%ru)HCWf$_-ol9Y2unlR_{o12g_N$y&;U9+{ z_t+2|(piw6c1@KZ1mN2RPa$<1r`J{iTlL!YKW|}Rs}pJ!)8F$ZgOcTeS&7tz+D6g% zIocKV-e>&Ht)^50eU=;>fz;GghkZoz!+`+kX!zl_^+L3249v!<0W`&5Y zGI~#|3YnWfWt53n$uZr`;fvKxAbCjJ$nGcng%aCyN^ za|Ko9R01Q_pvdX(m8WD9E33ht7EWfZKn<--{9c0uXu&pu1K4RstCAH#u8}R-YLEuA zrBFxbk9uFf5FkmlNiS7dxIJ5C}*nJlzrvkWM)U>W-AV1eT*D|)Zm_p8BH4@s++ zKhX%-?|~7YnzhK^bd9ASdtl@ST7EXt-<5ud2n?Ye{j6#DX-_(FKWH6${H?kW=<$I0fo^hgnava`#kRK(yanuh}M7gO|avjcS^Aifn8+@?u}o7 zK;Ick>1F|Xm9p*nJB{jJo8`8(*`4SO8--}@eOeEPOxY!I4P<=I6q{H3BHy#_E~qmTkYU4nhk+TY**l$IbJDFu4i5rxkr*rq_@8F3P>o0zopydaJbLkTuf z00;H$WeOvaF1PW;Xa80?)`Q(VP`Yg%5NP6TY@GzGT z(FvprCiSh|nea_xXLPQ$8t%7-{LrUv#5W_i{rk;->{(nCO7mA%*QfIA=H&#=|*rm|07YaO%Y@k z|DdG>>YyM|*O6l$L65(hTR7X{vyt*jB|wL#5@jQlW5YTZCK`J9W|dB=;b>LwbH3 z{U*$rYT2pZ3+J@01j5MvM;4WM8ZOV2UcEaxEYv(1Rag7Chr~XK&D9Hj@&u z`j{y%Cfhf2p^%$5yEI6~d&Ymz*t)q~-v7-y`t*sJg_VM?`GY{Nq|ra+=U@M&Xi=42 zTiyNm=+Dxsc|pmg#X-SSZYU5lc#ku_@6lE(z_X$$yU z#{+8i@74700BtW>+1xOoE$HLBG?Wqclv1sWNc&5IZvs-_60M9Z{NPZaFt?+@R6_7Q&JeM~ohXdqvM2M5f7Vav z7s&O@CtA_^K|SxV4J*l!904tQ5c+poVO�$Hde?3iU;pw`2o((VB{eC9fK$r=m>P zoOT=`$OavE3TZ_E@mlGz;)+}qOb;h4yYVToHOWM&zBJM%86Jul7ci}~ME8~vqA@yt zyu{e2yBzT)_>}0A(rufqJB@ii7`YVI5pWVUQ8T7&WOnn0a2M*7b!LGYPv`UT9kF^W z!MYa}WX{uQ;vdde%BC?dJABxx2lo^hiL1u37=))xx6*V6T2~s0H|6-7BZD;@raf;i zTY{E;{q#*hwV&OziXGouit}CAyXy56X6#1c-m7ReyNAevx#-kp1WsgCXXlN;QO`Ys z=Ir-HBIM`jk=ymq$oi|JrHG*;bxGRay@xGFfnbJV61X(v%MTOlUE^MR{9b$O6nBq5 z32&wdv2Ch_-Ky#Ddd{#(U%b)sX=HP8-~i^bR^uNlXLA{M(c)2${I6Ic1pn4|W5Ipf zw$GD(Uei(!OMbmaVHRE}d~W98`F&6D&;`;0ySj_wCniJ$OX zwi?bVOGZz0Der7`L{o5_LqZye2)|=X{*61L!)L11S%QWr4UIbjE$dP~GJ~+0gKR(@ zmB_AZJ~h54t%ym^DD+Z1)B`s5n*Ppa_*DO!u^fNyC(*7=n4i_|FH3HQ$JlT$Qci}d z*{8N8utkjH?ekWl0$899x~SK1g-D;gGsT&zf> zd+y)3wTzQOu0O_>RP3H5#Hj_}oSHfI0ePAR*2|S-=cbT{5m~`9YuSwFy&oE{`X~_o zNHA(T()0+KtdWF+NxQIUO}1x90PG|#<{lEed+Y4VYoDom6WWaAnIA!Ye4%h2#-Ib8 zd!c+|(sJqdmS+8lB}@&e&HKYK55^*p%VefKw0NR1fd z8N*dr4rH)RhjeJac+YpCb!p(CDDv3eU1tEl8->2N#^66KB5VPZ_knrG>9JlkU&ia! zb6q@W2t)>S+|9w z+qOop!jZ3VHp&nw`|{P6tWM=I!MUtlH#l4 ztNhPw>Bu_MVk zw2t-F-ssh|s(Qd-?H_I%y!c}lP^Tfw> zm}yesi>5_PVX?feuCE>bWKbS9_x^AFUdRUVq7!Gq$|J-;-h=RiF8P~h&2T=}x~NHjkPib|7d|hCQ^2r#g2|q zafZZp=km*W$D4e*M<{3e)U@l4Qwwocakxd>bxj2A&B8T(dvot;2A&0JwZNP5p zsQtb6d#dBHpb;Wr##J+i`*sn2g6~PJcyq2`1HnJ8{4D0Wj?O;Q(x+aH)P-8vIaw=S z_*xjHjh_@eC>1>#Y=T4|F4n_+nIH{j+osdzQ>~_{1dmTlY03)|{QI_;=C0~a{_D*d z=_jvX!9Y*%Jo#GVZg-?>_E*=MW?{mY45+7H8XU%0=lA64%`%uka1PIHQ4!|M%BP~) zAp2pdJN&0%?^gPOYQ#-iQs)Eu?N58`ogEwG-$xVPoL_%vr`z-~Y-X^oFH3O5#VSZRD zflNtGlLal2eoNBF3-sfS&?6%p^dCbo)gH;wjV9)4zcc z;f{McnN{NSGk=Cen)9{`T6}JQg}adsA=h82_Nj4LoxccX8HJ`$3wrppV)-`K<$02IN};ZxomXPNPFxhKLC{pt3?XMNwSYFk}`za2d-4Ok2#Ie%=w3 z@JLVFX$c9IqP_`~3uLHzI9vytw)ousdS_%;wmloQ31lQrb`3UsMxP%!L$dMh7HYnT zQ@?;b7S4byUjI^v;dIH}O^|N)2=I{^d88(Y`q?iggScUqwzBb+klPExR2e&RP`YTkEeKtoRx)zi43}xL#()OcGqI+;6xl zJ@I9}hP?mNKxa{rC&sXB!l|i z7aglmWmvr^MAVIQQY5xLP&NsnehjOzPuROZ$oz7z?es0086B}K$iH)MigJj~w1~v3 z{YWtI7UvOjnAs%WSs`Yw7C-lN$=*8mj$i@nL1^z>0?;`=C7ZtRnf-g{TR=V2)HJah zI{isVrm91V&M-QIkWVR`8y}BGtsgLPX1o^OQr+hc8@=px1d(l;0!`gc&i7;klEWry z2T|-e8HLP|HdvmD=C8<-Omt;FZxLVgI(Z5;<|Am2HU80ZV~OOGKN;M3(bU2w1l>A; zllzsBCipQD;$v2hOpvD*5|0FEbk+!bT{2@wOGdT^bp4rd=}i_2{4w15^KT~ZjXm`^ zu9CY1!A)C^X-#_?w!CMxza8E|#yfqiu_=0)A@qqZTyz)wsw)y5c(lukNh+>7J7IzI8PP!M88y*Afx3Oe|9qcJJ}n?{y>bxNXpqVcdPT1y=5R zC}AIrCH^_bJ)@TD*?8Y~P|Vr`tt;veS!e|UAG|_y*R-x~JD~siomrMB>2AjtA9tFv zOaNs{DxIIQ$K}VvLY&rx(9FU0*Io;wed>5Wn?2<@m-3Z?d#H{Ro-YP}<9!~aK`AOF z){hPFI1c!z;wPEaaBE&#CMLJL1kAMuU}z1<%bE$m8I#)}F`ZIKHtrZKT{yOlm46&E zFQARRAwKBW%e5VKwXN8gU_fV=vC}oS_LlkKa;|gls|K5 zeBJ?~<8k##az*t35veaQwUha#oc0wF-Bh=^P^$Ykvf|EV4fAVe(&jDFal#9B>SdFD z%(`L1zJUFBp80vt2*nAx+iyE4fW`IdmB=XEMqBkVXsqW2mdT%i1Xe6Wg^Q7k2=r#` zkwc_Kx1pUq?4-*gb!I47si6Jf+eElXO@G=6qtf3NVdYk)dp;59d`#ri&|I=)dAw69 zk+YGf)o2G-75jmIj^E$JzKKI$*IB82H*b(c7!^O3rB=A56wt+liDdT=9Y<>=>?h$X zK)c);c3y~iaP}BTj_6GvH=x#yHDxZV-Ul?e%6Feu_j~T(j^D`&vdT8=gW*#X;m^BX zISuCgXOprl(N`O}@tgt?En_S;OKo1)@FQzQu96N>6P;X%I7!ZU`%Id>X$_XY8Ij>? zv_GYU13W}_vUj-OD6m3an?3w^n6?m4(gq-b6AQ}4`<9&H(-t9%<;VwkWhx;1n>{-+ z!45JcHeD&&k9}!pwzU_BvlkU^Hy?r4y!qzA9(0xo62{tN`4ml&PVk9T2Jo?z8c0QS zFzN7HU?8ys2k819t4R29)dIRq^Mkkcs*CvdqsfLzP6K(cuuV9E4*Y$_a3s__|*J;A89)DYqrUlZv0io%Kc(4)wJmA`6&U+wDA2XCtP4G)D zd*s(&#RpDPfq1=$6o)I|UJM01KoJ`5ep!&6@Yv95j#d%7Sg!1lp?0`$gY5ie+rKy1 z?Nsv$0%fG9*DP)+mNTGTZ2cTtx8vUg{GcsRC zPxQ(nm5?CsvU6E=p5w!~yLu#xXD2shCwK2!0XayM`kG57j2magOh*U5^<;goUg6j! zG(Z<7J~&(!gt1ev7yj|FY}7p6Uo>rc*QJHst%H@U^b>PH?un#^kdR;B^1Z5VjI2)$ zravHQ)(WLqOmDs0qtme5OLfPYMaZOb{?bq%x*VW*PuntwKQO(V^L zb^R3{Vr4s*hy#n4hDmU^5`A;yC&`PjRTZiafw2Wh8Fh#bV*)G=d z6^`k9-{nH2yUsR)jrM0RH@wa_Z=hy_zL#Iyi~s#|cK0!GhU8P)57m+PwGm-VCUPS# zTxbdTnnIn!k^^c@MVFsym8v2ibDaXPro^| zVo7G7cbj$J2ZP)_maPDS^rKz77YGhgC%U0=vAbS7vg@!inm!Nmd0GNmG;q(_dVyG; z5hTthsZoe(S=6y@63nDav6R3xLZ8qNIy*bdxET%%BH97y5g(iH zISMIcpqlQ62Qb=!s2>7l#6Jp=1M|>OhMM+@wxj-{VOb>}R>2KIjUTjs*NQD%%9(a8 zY@Dr^_K?q?S0N9jv)4KfaD8^^{6{p~cCo{~XOa2LRLt+G-(!jh zpB+KhN+`Z~Za+epDWQ$TB2%+u6Xzw*LcZl?L-%cXm&UqLL5$G+xSxTCEM@}c%OdQS7HJg>lj#|@qb`}j2UgPe$n^4m7YcFhz4F3{Tmm@6dH_*R`L+Wstt#X?nIvGwaT z#G&mT!y7`jtVHRL=vJH2c{cY2-;Dm_{NTi9>Rn?m^#T4hph;kR{2D#+4nRZBF;G)Q zVf>6J;E8nyk&Y_7A6Kg3b;W>lZSi!N#sD32y@3 zTK2x%b>zOs)D&_GLiqjpq__%ZEDj@qj&uLs^O0njYLTkbwo1O&>ec|k;RF~gqDG=7 z12gcUhr_0|4tm+O;miYzz#Ck0;_=mb{Ndv_Gm0i*8HB7oP&p9a#vtwY*D}fS!^zg% z$=03zi$s%U$_--Cy;9HYLH6TYP?OkZxE~-UTOM9h8NRTZYjNH$?6g`Uz}#rtTc5bN z2~x-A&+k0rHc<3Pnry0cO0gBfRHOm{AU2XQ<9Lcz+(H9%Wd0fP>Hy`J;H|7kX{;wx zyiZ5eJd%(=Q^y~Z%dLg&=;ZY6*_74xc;RVAcesqhtL0G|U}#q~BXMF$rDrB>EFw|? ze}N^xadko7Jq#Y~CA%F94Q7=%QXIeA%H3U@F74Vrj&&u{Q^@vYX^~tjt%?ElS(}fx z*$(&*h4jvib;y_RF4%X$4U2A7@o#_qOUJ_HBEDtWL+{2#aYyR-z@nh zpnNaKBQMEn))rMy)N6}T3zE=RTu9|JSXK{w-}h{)E+Xw+@;cAtT)) z9!tjUQ$d(62ibpJu;r_t4}QBHoGU8?@^iJ=i2l5AfpJ9}5QKR<|7dY;I{}0(r&`N_ zIdEBnD}Ac7_Oj7zE)GJ6){rb{{nU9A%OdJ<>;SW{;oZu@Eq9bay^TF7l19wd6pyG} z`jK99*B;GjiXJcO>RJgY1d_6a?VMWiepRi@%_%V_YYy4QVemL2lg-El-^(j6#1kdap5D~~5=jurXRp;+u?g*?V zDONW(3^}zAu|p)7uIIfI_yc$ff8}H*w5a^=c6BPrMEQQJg9F2wtPbz8FDZCSCGZE9o^ABS~KWr9oNa+Fkg?{ofYwF zjo3a;B^byw4yhO{z?j~dxSKldH;PZ^AcM7L`vpB&ATsY*vB~u=5i4USF;3h{XaGsp z%TcENYp$OHr4blp-$CFlrAC-q7H3<^BiJeIEyJ8vEL#wO^TXb^b9gobtu1>Pf` z$Rd%mE$}iCFmCp8OgN1`iVXZ96AGf;bog?Lq82m!h+=-eFCWA<2uo4yAdfIDigxa0 z5bLe7!gQ;m4G4a~P`n!*NO9|=Dp;HM70YOTTP*S=Z zq)X{;M22R7A)ag8d;j*@|KoYH4vysuW#+!G>l^3!Ih)@~;zoEw7`-OWKx&@G~wJ3%=*w)uZ{=o2`eFRy?ZzecBkLz2BZH41C2K=7w~P@mmO0OZxl<2(HS=j*XfL3P#tE`2IC05!^Wq2P`#EQJhOR0=p(1nXn0dcoW4#ABpk37h)q8{A#uaD53v z*X_9CF?x^Kc>1#Q{I@t->*`S>O?yeFdX!ufuY+Rpd1(k)9b@#Jv9bZOD!Trv^ZoODPB;-a-lJ%jq^+DaQ1Cw0|zQ z$dk2ra*j|%A@0J+(VrWg?!bdncz5F!_~EJKN%rJ7nOiII!xJa)zq;CP%2 zPFmlzrhfrA56YXO;X)++#!W(eQ-kvv$Q^1+8IJGH?I`MlvdZ_|N|y)2&PwPq8qD6j z;q2-5m}1^^<4BsXBG3FxD$iMM^MoDyy#Qs8hO#iyLi&Sm{V|q(&*lF)Ta%TJG z!~c8GSX0XkEUZxf`}!S?2dU2QeA_8=WS8~A(;$aTjl4^~RL^#pcFo8SeVL{;vf)~* zS}Egu%8rA9D!^vODXSc}5ds(>eUN<^81AL5IQCy&Tdg%MQxDHQ?KUEuewEo|b==Tw2J!>{Qp0|Gm_*`d>ojf1ok)ZrkL|phuht=Z>p{~PSbV4K ziVWd3f&Q6NJG^=QNA8!;%ZJ3lVIeabc}&!wZC*{vnxv${p4u#mcyYG{_cb8b2vNSg%xd|$8@k>X zZ#yQhK8G%D!hj}XTv3af`-|ISw?+$ zu`^|7_cos6Bhz>T29*0jT5;gUj|7!RHs>_r?pSWfcJr|Fc_%~EnShgFk*4%|jVLx3 z8R83$aPY4a1(e1xIGEH4UU@uVuB5m7J$z77Je^yfdO$}_gfiAZ&2gn%O^Hm6c%m zExrI9R0h{CEsOcSBuKKf0O4yanNPV?jQ!14grh|xQ>ZPitO^AAwb=4T>GSY0C74Qs zWR8QX#c6z2gi#|mLimLMcZqgk>foOnkbhU^QB|R}zg3SkbdbGWB?TM#txy8;mV3LM zS>NT!ouIaejASEJNt-MOlM`Rm_L^r-@Ig?~6@+tuA%{v?ENm=q--i!b+U}Q70ZN<0 zW7V({Td<>>Zc=?@lL%j5IL`c-6Q2b*4d3wF(QXl_Flg+pNtqN@4n9pAAU6o^b)t^p zk=nSsisv5 zhu$H4`L1=F1ATSCY*F%4cL+E1u)+_7|1NjmU6>)F>?ich=8qDhzhR+D5t@zmuB18Fh3f`Pw2O75pLx^A=p*+Ata<#%HsUD?qSNQdi<25RTQbX#nhlMk_{YE|8lAgauxJ{AlL5OeU{>!O%e7r*m&yj3?JSO?` zfVEsX$zu4GS0WCO@HobLI`knVCMi?2KpgEi-6M71B@i@r8eipYdD$6ia{i<|{Sf@z zaN9gtNh(=O%TeSD;h!PKTN$!S%seC9#YpnlM}rK^feFs4g3|y^DV|AccRE(VIJGEe1BO6EtQqHyfJ#)Y+1Sbxb3&rP1Wac9 zlr3o!e1=$W%=uKzvM=Nt9`VU204<1FlzE^{V||tL-|PH8KTXK?ajOk0>-aPGBh8REmdYTBtuBL)>RyHiyDym@3HmK53@#MypDuI8G&vHuiYM_wmd`tgW1=bONUPS)iFW0ZP|m^je1VZWe%=1mWm;A_i?)cd?=AXkFJEgWfgVKLhM+I%QKW@@Lz$S|Gl2TPZj~} zkAlvBtL?ugM47ZveHfL9HJI|q?$oH-cmgR+HqI);!%Wan@tBrmWIQsSR%&hmcOSgj zhykv=-%c0!vTSN_G}7JVGnAURpD?^PG6O@Ft>q>!Cp!xWCTq802Bb4U55p$z1hcWJ zkRr^=3FouSUfQ~e&E@O%cJ?Z{`>RwcM@=uXv`qA_g3) z>+nJL$mbjwpC|xsiMkG}7#*aQ%mdPgxHJ+S3o%anBsMRZUe-%3gzLT`GH~Z@8urq= zj`x^PfP2sL=|a5k{l_H3ltJ%U82RgAK#TfFsY{JsFfN6%LUs)~RAPYff3GCOb0g{n z@H$_Qj*gUI!@l;h$cbnEHtp*^Em4jf zGocfAkLnU4nPqwu2S8~d*}hZ{vyP+>~HY*jd^ zfg`dbN077|ClL!^HI*vjI<(q7p(W4%$kz)U%NAS47SjhJO_kOrynL^e>QHfV99e65 z*(IWihai2;c}=SV&aj@S+yzlT`jNyO)j@Y@O|x}!M)K?Ih{Z@ydPL19SiJXgeJo zR#sMDpZV%nr#oXkAM0t~yMoV-v63z`z5l>Im1KRqMs>r>q3P`gO1p|I9Hi;lz+@vw z<~hixC#W@~$dc|XT?6mM;*-ez5<()K_QLn*!qBPXlHZg4Xhg_|Pl+yG5Tacc<@ib- zyH0+)QLl9a5pViuFjHr>Ima!C68pDuGR&hd0xxA@cJV2ts~(}yYBc(=%O@u7TXSFE z#sYjL6J5GIKK)bp4PPylAT!l_rS>2L5Y0LYCeIE=)i&dlPg5mjXGN6WfY<)Gaho-? z(*O3Q35-1)5e)v!M=DF^n&L&N!C8+o9ptp_uUuXsLPz#8aNGX>q+ZhZBw=d@6X%7d zRC9s5Us-nTsHHQ?Mg|*PXScHRrZ-e(_#~S z)-Po!JZFIT=!<~D4vY|-|Bevu5{0H4n%{-Ho~B`KeHW%C>4BFy!K$nV#coP=Kl_Yc zmJYeEkQ@N93IHa^3^17S|Cn=edn(yBy?3U{^~2X~pJaA0EYQ&UrtVzzP@(^h5~ouO z7!Q_c#WCIFfR%l4bHsxw>=;b88Arm5v_MoX_@Ufoyl& zeFXQbKYcZ8R})5t_}n+!#j@#i&v(W2c!EouCJWD>Rg9w#c)jDf_+6RDHb6oR5 zPS%uL9bGA(3=M<|Ke3t0HLOyaJkJjw0L0Yvw3h@XC>n2i=U1U*hP>!LBbB=Uy23&AnX3>{QY67^G9QMO~)L6#P2W?yu*_RpHi*E01mc z*xqXv=nhJmu5#gA;#uOP$Y&fEDnGxO#ZoiJ0T`(B&aFR)O6hjOP{t*+;Fe6c*l8J& zxw~FMr!X>`_aS^PO^AoVI?eU6qW!m5#nY}dvEVfP|G6g)Wc~-1b=L|%TyN6QlA*{t zva18F^i_R`?aD1pXf!0Fyh*aJ~Fu@d`B@aK&{9WoqrSO~-e zUIp;Fy9ssLY{kFoPOrLs!7gy<0H;LB^!GQmQ?DC*HPbW$nn5~p?p}&28W~5cI`7?( zwKPd%15F_=${ZqCc7XW~I~D)}$nISw%NMC|$yUX=jb(BKugukcP>8Da8wjDom8WB? zp&vq%<_KiZZ5Q&Az?_s-KZOxv^{bHywhda++{gqFJmX@Apz`L?q%4^cK|i zo4pd3qr`qo5lxJ>RZzc`Zg=17akK>ApQZ8OqXi&;d}$%)?(L6sd-yV%vo?PGkPn^j#SIZ;;V{N|$c<==9s~n5N684b{Mn!<%~(O>zG5M}TmNQTt=M1AgRW zS?^)=TZcMG4Ih!BE#g&JTSsc#2aFRP?T~<1R6#RQ{O9_UHNZo<4(3~@%ODzW8qCSo ztAE4V?xe1q#eLlm+dk-vl<`sIKP?W$e>Ro7SEBHuOu6pVJ^P2W>l&yddi(mQ1v)@n zfrD|1{Ezv?>N}Hk#^dWOH81c)A3Gu?F@J zZ1L>x#^$soi(ZQ#V$1^wf^%6Dy8(XuPd={q&$TFV>`e=yihmA>7>Gs)KuS1yn71i2 zxgedxS=x+0FvvtbtEjgQguW7Yo9juxriz_zG ztOx5$o9(^-3mIPPS_P8G8vQLEXifAhD}J*GX&`+P@{EasQ;U=Wr-B5X4?{~@_$9z> zSt*49TZ@IFjd%p6{RUf2W2_%`pfCY3EZAqE)XK!>qdB{ z7BzL(u@1O4soTd!Gf;tbRW0^aqY2~{;KsL8M`d~arhRobiD?ws;>KrsvdwGmDlVg3 zUBsluYDsv>Wir(@5Hd2taxbJ-i3)wBP%}?+pq2B$O`-J;obATxua zheO$pElVS>O&hXL!)?@NmHi{>wmlD9#0Zl57cUorCh!t|AI?neP29|T2>~VGYE`L| zQqurG(QAo@I`C4#A^|((zTDETHQv+{y7xh&VMi9nFe8&U)rN5b+LEj>)-83}XC`Ik z;Ji)L6nDx3L&@owJp@!IF6(Rqs2KosPZvi%(rP&0%WTbW>gzW!lidp8E)Z(^n8SJg zf#h(uR){rZAq6`rxR6P3lTb3eo%N~>SkH62V6&P{`d$O{xU|A;w=(V~l(@c`dLdiP z%hUBlZ&`VeQLKVufXjiL1o@ieCh5h^ zO*URCw(QE*OoTr^>;kx0?Vey8wFGz=2v@epRke{85d9%49JKChfa4F%9M~|a-P@0X zoKRu#s&?~bgHmEmxwMRXs1XtyDFL#zA zg~w~XpI=@dNCEVl8GKhiqdKA1?8=M-Hkoova>uFe7OP&h8XMM}+;EuB2kV z#;5&&qBGLRY{QXOVqg*$r;w=V@;*%OmDS14bUrE7MtQTr9_5 zKbw4Ep2ZH|8EJ!blx;UXZfd~Xo`@^cMxFAvQuW>JyBmk9>Bv!PHP& zAD9xo?|xXcuuM_B-tlwfE;4#ogYF>A8kY2OC8@_@O=K&ixvBTl`x;XTnY}@qmV(tp z-1itF3}4z$U#X*m1eA*=(r&ckP(6T@hBG#AoK(I&zNPGpa%i zY%lAU@q^R)R1q)5O1^Vaa3+OS$PTX&)#^~Yp7ZaY9Ph$*lI1Eql#8s9Uee&ihq4bc z2u_3PUy%>p6lnL@=$w-kfIn|%GyKJGZA&H|Tv2k2cX;@W0t3?KK@m*7YK#E$?vZT! z&prkSK;@fda2S1u#Fc-xnop+Zx8j!9ZO!`me%_r^{Q6Gx!*%{}PFbU)!0OWrnPM;b!k`E%*@ONcCn6T%z9aI^f7 zrur#od~CccO}CG&qFCsf)#lNb*CnrsMfbaxg@+Sd&F+Oq!#Br$2b=gc)_#5I9XY%d zg3~LfW*Q}Eu+DqLW5sDyycCMe;eqyk*#PeO9Zyu7Qj+W`@f(*hWyI!gvBqNBg1ddT z6Dgk*E(y*gUIw?ry*`$0@%0BTHw}w$ z4K(G`2o?E@46YT-WYG(7H9tXA?=)Fbvu`g624-&mGOrlLF_56a3`oHcxNfM|!(m)& z6uBF~-I-Xri(c@AMqWJCM;ao2k-d4d4!P|+X;TI2=}F)0T{kXN!h^voK#8sY)LjHO z(xD_YIH>yC68OedZqG}&H!r-5#oD6_ckCS*782L4pkkCTJQajeGYykFr9(HE;YmpC>x+rP_o_g zgp|=&UPI{loUbw)iO%yLpkRbH8^@=~W)Hxkqc5mM9Am=nrhIZslb*}YhPs-%Mol)LY0*pm_ye`kwN8D%?XTeGKc{mP0mc)Y zit9;&yMeWRqN!~)rk7Jh1=~zkH-;8SRckG{oq#;5zSqW^CO3LpzHlW#vJco;A069v z)yT8yzK|~MpV*$%H8031-Y8RrO$<46JM&DCvhxr^jx5Zb(+IkKmaI8(_Lm!>ca{fk zaE%uQG7)Oh0=73g+^B9{4Ii0D!Xe?6Iq;IRY*X{m`NPW(p!Dum&gLgts(AraFi`2F zmOMczUx)k5WN95p1E5{7-nCw=%SuZtQmKfCf4|!q&jW#GpGp`COBm*F6(aFJ4BH~w zS^QfsG&kg=W!0(CD~~)#WHEiUL!mr;MEs)29mr2(I+qd#kZiS3I?4z%vJmdlM?LMa zgugyQlit3H)H{{)nkU9lO1sx6V&5a4|5Qg#a4HWw0!sFp@QEd|yv!y+Gr6L@VQEyS z&$uL042D)3PWn2Nv?9)3+8IcVqGpo2J)D{XmnbeexoI#^ny!9%U_Vwd653yuotasa zh8u&<^~v-4!X*)BD7oEp)=4_3ujN4qgph8dch0B%%odeZ8fd{4f4Ay7O=|1W}2o`-KN2!W-qKW z65@R<5J(jW5U^NQ1?v57pUvv8f?o7~_-h4*CE?j=!Uio3%d@Ao7{TA0rzsLG(@^jL zu9|GE(cnk?n0&i99Y=@mTrTvMEbKnXJ2h@^>hK|of=n3OShn6-q zFiN(|h5{?FNw)=c^>MgJG?9nS)@ zzx-axp?0_cU7q#Sf07fkO2E!S$bpJn2@0qS0I;ea#2KpX34q4u2D?F*kJRR00EkuS zDH?P!_NH*Zk{}diC^el|N`ReajBLA3=H`hwN#srA3Zg?2iU7 z;%Owv(;Xn=k11T9^4Rrg7$Eb?L41AhgGh;Qqr<~zWAB(skpRC!)*^6{EAgC<>=5JEra|BgXpg*-VsK0m%X*nbn=kn{6yQjC8hO3U{i2;6X{iE*Zj zQD@xwQ{`4PDXTDeMSO(PuZzs~g%sd*ta-vED-63l}c%qWWeMQYmkKOD++@6pN z$ttgEr~!pGe#eL!$P zNADXj=PpnkUu(0_ndVRClHtJ2fHHb~06Twi7 zKWiV~BgyNN)IaxQa1dMiMnI+7Z&@>TI-DT9E-0tH+WU69bBt~5J=!F4=hJwSV45FE zx9qUL08_P3w;2wfHMoJ!smm{g(U|h+_{(T1-Z(f0fjI9z2)gpuPWy5|X02 z!ljOl`DEUb%M6({(Yj^YsxS}!eWcMj^UO?ebpvFNM9}WSu15^qbWs@ah))c+P@D=g z_oC6Kws>SxAuno3-o&-aNE^;mv>Trp4b#+q=2x04)d}PV6&pcojZ4WQ4TjCc$p2ro(pvNa$ z;D-8F#{Ve@QKSm*R0kW3ohr$q|L6Tdk0_G;^C34&OafqAzTTNK}qL_~us zPchOX8&sq@(E)&bgVVU`SO{Ph!BL}~Ra(5CtHhs1V4Vm8)4{oyDQ_sFjzT?8?B|aD zKyR3q+3rw%tI7uz0$YlG=%9ed4Y!xszbRC1O+awSBqC;m!-W~HmJfdk?Y3;hWlR^+ zE&9aPgj925osupMNk6w1Po==kZcv4jsM6Nyu$*s{U--=~g$*$6cO}_EqV- zXCLUhlvmYkwlFT;7|jQ8f7`#=F;`=^*Ww4OUE;A@_ehq*8U{IId3FZCw7g1s0v4ze;bfm zD>?zxxx9UUXpCjOe#t=`os7w*oY)p@Z!?&xH-z{8dlTM>kL{yWOj%5Ue?0!Jm-PEf zv-02h@$#<>AMxe*`_J5hGq36STQk+aojPdfy9Sp9k$gwd_v1*`(&+fyLpoWsM| znQ$}tzJ%sI-ONX6Mp~50V=4`@jTl(p&wDJ4#-h8q1d342oT)1oGRvF5#uH~p^Uw4s z@4YQB=j8Q~1f#MNTVRmR_U*z&%A9pcRnpYf{aNm&As?(9YtU+ zfo<7ARUYs5RtL*}W=hQcO<#j~-$|qjP}2Y^RI}HuH%LE~tjTFes}7Mw`eTHln1;=` zgrdTA2>%75!SjSi@H8LoB)yasL-X?`YP<3Leda3^eHD}tv~9+F=%9{X>jV&> z8u}PII5V<$R-dH`Py+lK0|$`^i_z;AT-9Pfg0-2o86B&T%b^CYMdwnF=0;6b!_(WXJ#Nj6@-|5XwkezZySG#HF@P=)p%;%8 zfW8ykc`;?jnmUU(VB77pCQS+1;F>~ zG_s*Ec)^W{_iA{-horKDtD4S8@oGfQ6J}7HfiR3v5u^yU%-lezog2`9*gq&G8lRb6)H8rUrlaTmwkZ719idE zru%GfsEffsUuia+E)?q*s)GfE^75j}g1M<_hrFT6L!<{xuO(bkv@no?VIH-Vv63Ex z0FqEws)&XT-{_5yHgseP~?G`tkW*XrFRv_^d_qQIt>;IjOe>Vw>&hTN=@0(zh ztp@5A4TR`VTI1DGD=@?=(X&+sEraD%RR2l|vc~iQ%Ozu9PUhz1LgW_ee^yP>$F`0CsshMp@mLE)t}`vk zd0u8~MY*c2Y&?$+W}{UIXHCuZR12efjwl<-Jp-k%qvWT3)X6URnckrjyL_Yx?PuWn z>5z9JoB6*< zQiyHMh2Z*?lNfRq&=XfY{~g49iP)r%XF+u8StxQs1za9Hx&UDy(f2mhpE~KBHn8q> zxwSf|qN=O2ftOD?fAs|=7B9#9oI8MNEUk_Y+kTeS1+}1}@QG!qW6Obd$zxo&+Lfg4;aC zjn!{iz_uPFKT(Xiv|I;3Fs8wc+mz`DO_|v)OKoU|e%K@suaW+va0dUE-}cDla1LM| z;kxBB$F@vMH__XHNz(Z0qgfX-)zAJOPyafj;_rVM%Y0gRGLPnTs-KAS{rNoeaA9zS z-SjKt>4C*6M8X5v9MAnjFvVYF+UpuxI=Do07eG3cWG&LgFbDO(+isLYSF8e6cv*o% zvb+inga+aV-T>y)x~1r!xAc4K31(wVM|7bbBbgH4#(ti7?z4v8PeO+ClGJn40UpX{ z=FayKG8RqD6WEQA%-$vmaglG^vvjd(2f@9duQS}H*fj=n=4K?GKF{pb=slmySZa}T zNtzrVD`>v6wICm1GWiV9wP=WiLEz^?4%F1t>s=PyMSz35T>UVxqR4tY*>eR|S@5xI zUpN6)3*uuDJZ5^SR4Gy+$`YL*VKm$BOqGmP@pkQbX+)XIMt5uEkeL=&s+W@ z8~Eq;@Ce$W@*V?F+2nV0)1~nyHu5%Fh8Mt-4kB3D!`s7L@e>W&#lYyTYB?z>$urY# zikbW;kp2k7e)LGD5(U}4-)J7cX$9!szY2eGL3>Tkb|bBF-FBWN+N0M^>O4_6ky-pR zfxVH)Wmxy2WmxllgAK*)Q5z^;2HlWBiZ{QXnDK&7xtt~^DeoN3P96OZj~c@YiWpE? z9{;!pFH+P8@MqGHCRJY2pC%M}KId(>du?-9z`5}@I8_oq5BNHaWTo&i=z0u&Y5)hIs< z$}+pU-A|Xr4I^+@4l`smKr}|3eva%!suq% zRByQ-nTD-Ku*Vs`#7Cc^f`L!HZ(MsS$7Zh5_w3F52wh2Wc?aCb0Y?HzIqFqY9vMaq zGMjTpouUxqh$`tI??p%7OYsG1cAI{NH25MEGf#E!qh=0+2k&poZsJqD@ykD6{I_oR z^R<_^0rDBYDvucvodfOdteVvW%Cl0$?w;%MYV%Fcr z5g{pdjQA!XE3dX&T6*aA20j?K#WeM^=CC{DXLvUXFeXrv+HWII)W2{pxWEx+MGw&R zS_j8^<-T*>2J)Nj@7x$pzpI;EM%e$Q1s`qXg`7o<7Mx|%i5lPa;lL9wUb*f*Rx4RR zXZ`0aySu52%`s!?Z7wi{BN=7W5RX@R&cD0aX)?h8`rtrNQ>Uh~cF@~(#c~h7I!()w zmXdOS#pwa*5h%qiO`=F4?Rpg;m0+O8PS9TGVpxyR799*>XMmDtmEm$SjK8vx{4XdNugHqOzBT~!jjq=dY&`%TWTvpe-ovNja zi+bXJ9e;#{1cqfTTpFWU>VSBZ9dLd6Z8z7)s#-uH>*8jyEnqNU+4)zx`}(ug+7W;f zT;71+4%E^$9W?Eu1|HtAa=*(Zni*boZtZ})MGzWQ~0LyW_@P$ zT5A2}=@|lFd3m8e=eqcMDuDiSrN^HR7gJ=*>n@9pp?iZDJw=^hk8#(!Qq;-?5S9%fPE-syzAAz_JS7Z93NRsS3~nP6&Bdj)_N*F!HGg z{hiMNQ|C32WB?N`hKFO-XKciYY%cFaiKfB@0B`MzX5DsSug^cw18%bhGFS=i`wy^7 z&Z>&aV%99-}%vJVFtR)YyP!)o|K!k%_({~I#cmy=r8E{#SdCPrbTO2HRaim|Al%Wu{R4EbB2RMfm!`8jY^Fn}Hn3ld=7i zBSD!*UF}iJc_ZuKmBs6!v^Nv(Ul!732@5Iu zt=%9TSHno{u$B4o^B_yfy{35#`MbXktQR|8Is}aUIX;f9rv5xvTp%;6!T%vH9Sf>u z=Zeu1+fvebKZ0xfpCd!Mm$wq6>;4jaaXJeI*mK02dy`m@jGri{7R0~D1NbQFtqcL( znixl=PC2xIRNh4X6~XY#E!MCYZFkre!c_*$y;QWkq-I*|S@9#o%%=lvQ}cZ8&R~nk zimC~>P7H{Ri;EcX1lGQa9*+xl$osFJ59D^vQ--uomAw`%r16?Q^qBrs-AQ4LihC1% zp4kY*@8n1PE}F|_@4jPs5+veu>JieAv7jyJ@jA=L#7~>}bxQAGy%}Iw!Js-?(>`Df zFGebg?Z}Bbag+ExY0U4fJVin_ij`#ro$T+VWMbXsky-jvg>xYoB z&3@BARZcjDuQ>njivsLzOJ1^9AfzRDx3+9Jy*8!;32%xm1jJ^lqCciWo45LymWCx& zKOQz|CV%xFx(JLs(CnJ+Eis#)2_{JTqmH|~I}1CD{WadW=;oX&VT=tqstMxUUj5Z?nQq8ny^9*e&FG(k2jQ3P*J0@X33tqRpSXVhP!TH8K58 zQ)qYDYa}x+U?2F?9X|0%>)Gm(nN-9(bn-_AuK?1?qx-(-<2T5Wy_7ScmfGpZqp5z3 z_@c6(BJvGmwavQbKE!&*kZ*~*C^JCpOs9iW`--TM^vj?h z{YnxRp}>XOxzBIe{`8TPeG}SE0?>ulJQa&fB)mAdUgb$wM8OhJSYX4&$s3?`pBJWU zz5{5;hfUjH0HiCT=r6oj^*V1cG~n%af-orhag?g9SzEG`S#WbQNReatUfnpidA6ZW zTS~WY9JK(w4S8=*${x4fN8kglHk^EpPJ=fk7+MbhB|(6-h>jYawYh*T23&fo@uuD4(w0#7#}yR^g;;{o%? zUSK}n0~#v<@@@%TjE+6)88JnZ_e$^I62vC;;9*V)Kj2Q5{ShiKQY-<{gPWB#FDYwq zpds2Je_v2|O{Y7AK?hsUNDOD$el0%c1<}-<4YUA+xX-PBy^Bgna-~m0*Y{Dt)as zE)5ObC!+NA%2d%^0&JsmS!bp%6Qnsm?TO|Xp)9+BxZW+2UPQ_FG2rkd^`EO6I$f?x z`T*Y5`AHo0_*hr0*0hui7z|j&HVHx7E4&r5aRuGjc=aK*I~~pi<{ck=M;q09Gz&>^ z)Gwr*SAuThUfs~|O~>}OS`DWwzCpI*iPQ>brQHuzx!5Ln!hohtMt_ytL=a0`319L% zz;g&-*UFih&L>wC!xB8Xe8LdZ*D>*OOsv7s@AL7ikd$x1y_+lzaE1@sI0+{0o}w%} zNCR};QoEnP@G>1A_XX(C-MPwQf4bXJ%%8#Dg_D7y%2v zE=EFIE{;=?%zO-8yc;!SMG;Vdfcn_RYO62iED?gKgmY=ST-}Sd!Di|`T;>PTMVkns z(dD}D?qH?UH52G*HFtgA&G&cF(3e(!`{>{>YOlsQ8QDgoSX%-;6YU&qF4#?k&y3sq zw5&~iw=6kpc>n5d306&wYvS-BDMwIoR+;Xx$pb!olZ?JGxm{H9xFp<;891UIs#|vd zr;m7TU0%#(esHWRFP^o@tRn=dhIi(YYuJjB_Q~Cl=Y1B{aWym1kZVC!m3@d$viyo< z^()qIZVzHFLBw*Y>X!b=K83IQ@y`$|d4HQuyQvae+pbHm&DTU@og9;6)rBftMc)gS z8o5tB<9a;xQ96dvw}{!#Q^nz0zQKMN1I7t+%ajjCUeEd0>F$-OF-%~K6W9sSisOSo zZ*7d+Gb1nSuwwe~1|&>O95c?ej0`&|Q6qYPS(Ecl9G+@FP-5XpdxvMd^7Ty*HVZ`t zsznQ&2ozjw6WY(CNaCJDLde|Hy#T1&|x1vH*roen98c&1RNQ(oV#7Nav<5jdMwy~sL2fcs#2lMX!J+1smZr#hjC9c>!=-QhQ(NaB#meqAa8gKcM5~NliXOg?Bs)D zbUgJ1FDAJY|5Gncteif-CvtALSb4G~hPf!a)wiY;zwmYH0(+Gesoa@}8lT28h~r~@ z!qIT;_`BFraEQF_w6c=@Gdjxh7exE%QK(629^PNqlk zqy#6=%@7+{vC$r1wMn`4U}p$EYXQLq=Nb17^uLv(B?}F1Op8pm@-F^3naoB@b-q|+WR9t%+*DB>bhOy{N;|WQi+Puv`?LbNe7Bg z@l0UbqXZmXA4`|^?}22zkl+`TMdDuw44g+K`yyC-lr7{=Iw^4n(juK{F8Y5(35Fg= zMpJ*wa2=|FZw04{}HpUmi}w>wJ0dX%^-^oMg~&wOIg zE#+>1414_S`Vm@W0Pr=o~{_V>ug{-<&emb_Mq zhGPgSZ!|X_Q}l>js9(c~p|O>#>ie6b+vbdB5qJJo@O6{wlXz7m(bQVm)1&N(EZDk) zM>gJgt6du`?BjFCHt<4fnLiMnZvAgo29V4R0T#plUAoXp;ALOnbzh)rX#awneqd?U z?cAvNfzf@NPKXHA5Fgb8-45U}e^g4p*XWi{cH!euKAmA1;&aVfi3FMH@t@e=1IEIS z!kGu-{Mh-EB=cQ4X2s}vBXVsRiKG@N5SOR<6hF(}8O}z48guRla3^X`uSz=V0tEWo z)VV6Cl^NUVJ#zH>S_SR7iq@KcmQjvL_d7`s*z&!d&>LHLzt?iw@m@FYgz-aL1r@&J z*Icobz-cg%it56Q0@y%~N0vN*Fv+{?6G{L}PWu?t zjS_>dpH#D~|Lrw~6bd9;2jP*>hSqezK#ONWG%3QC89C`wA_01}FH_aI%v&^64=Z}YzAeCIvC@B7C!tR*gIKl|DH zzOVa=QiVpgSjg(#Fnm>Bm3+oBS1S-=MA7Per)&4mWFPzFhEO+GNP}#oA$@cP3}iOn z+vM4Pe9T>(8&}ri6;>C5@SByeWWZQsm~80w@QU_emHvhl+$D)q>~tNiSNHJvomxN2 z_Lal`Mjq{JkNWtBf$jcN8zz$pTTX*BrGksBsDCZkt|ss1w-0vGHfw;%H|_O^FQjX| zVBC-b-$VJbeSI}Z!jctrI9&TdPfrj2D}GMPw08{n53zvR(yIXS44)Pdc&>_pT!8D^ z+^#%8g+j4sXaOL2VWZH^nTy|E2?HM9reXfTcpIdQB^HMKI(KOH3{`#7P5cw$Xg{6_3OcZQ^ebH5I`A?3< zNxtF6WO5nj*4K?T16b~~gm|WxyTvh>AUKSjPL+gMeW32bXr6*7D5oCc3;q2%;*pOY zaQCVV1c_`^1ck(IePB;I{WA63H1*sb(g8(OK_Y6Z>PF>}hM)jHs^$_lP$F1Gd=Sxn zm0_7$YvUeVT{k*WHEJ!%(r=zha_vXVz)k9ryNlglBI=74#a?|R3Zr9B8eiU)Rdl_a zO8!imS?V|7d1aa`g!|^J4p-|5$9_eiYUY4ETJ}={T^L9knLlVu@;$yF`}E>ny&Uf0 zT0X!Jg32#%NPoQ9#;77lT9T+zYy0I;Tw40!;fsHi>|^!Gcae z7FvlM`&M+`3UoH91$@l^@*nzZYbh4ymcD&3pYDj@_etV)xd!367X)O#_X-r>QoPV% zqOG?H1zms+N&%Sre;NiO>*O3j_LZ^*_K=s3TKQ{fFJhWswTJl)QE1ebQh2n!p3r|3 zA@xK8{+Y?dR9R@faxhmgUa2bd*~I+;iR%oPj}7pYiRhEjFKi53S$l}RcrUg08ht*; zyGQX7yfHD$%PCgX)}O4y(rF9n%OT_>bxB&`cV0?f_4%rh*msy8CZji{G`>8D$p!92 zEedb-eA2TPy~KO`7SPW_mXyO=Tb{X|V~^phinR}Wj3Js7eq4M#AfbG|k2!X-W%QDh zjqB>Qx0FK@6RGc1{@zXtv#wxRGz7FK`n0pvf(pQ{y#Sc3f9mG^_dMXDzatipRrFHb zE9y-@idEZO36pq}duMogO27+Me-SI>IBsK61E_r<9({t?enrQ5l|^=MWW;zzQrN0l zp2HC?+PKrE2GXzQl`3r8{0psD(UZ5pLZURTD^dC=%uLj}69_Gb1QA2LI3Ye8D2y)KMc|zKKCgs>c%`Q; z&9C}eHRiKMUdvS#iqjptNvrcRB@^a>h-Pv6k?$J&DObucR0Jf1D+HPRe&v|jdmrDE zP*&a45R&oUGFkSLz7B78HwvYewVDn&{KQ(8N+HI4A+P_(seQ31t5g7pYV$Y6Z_q;4 zPg;I|8ly{;h|#&kUyK(hz1bLj^lr2HW(=W@1b=9@=HlA&>5Gh1RMHTe6SGPyK*=L3 z=OF08f_=je_dP5C--7&{_uw-yfN*9d8UCU0sim7+wL5sM_eLp^0pM*L6Wd#$KGA9w zHxFV~1*60akM;R5IeIt9MDgKfkIrYK!)ZnX;5E*(ri#A2mct)nYd>y95oT=wE{qd=a32J-$RRal3?60OtpY2L#>yfJ#~sn@@{=E*co zPCjz{JU+c9zP45h3~to7@CZjXeA?YXf_gJQ$7|yOEq~bjHwHk`{?GRK>r1K z;1)n?_0w~;QPn+YIH5>?9K^z#1x$2X zi@^Y;wDz1d)A25{dsehMi&SjzxGZ5 z!vv6#2lt+#;7=7!t-c?1FQMw7=YME1U^K3ZG|J}d$2O;wq3ncf`_nz@NRxgd0NYEp z^wcSm;K+`>Hcc!$cw6|iVAiz8l!$S_;uJ7x-qziy;0>LY=Rg7~Ycs}g6R^{Vj)zHJ~mGw4HtIzT!6 zviX@OT>cIr`>&nUUbhHF^Ub|Wu2jTir3J0^g`grD_8atI7B+29Z^zeW+aX`MIWF_J|s>qdB52F!v zZi6i+PVqLu*Pk%(B!pgu%yz1FDS2|(Kx)UXay_$}_8a*C12s9Y5voowWvo^1zQAZ; zEy?Y$ozTbO9q13!h2C?(q4X;t^mmP^+WH2N^rgJfqXqceYWTG$xBm;D|9df_eY#Fg zeDB^SsvIx+k?xCHrqxL1f85Nx0!X4?1Z+Y|{DE@7>)))PCTc|&Ym z>9YO70}k%^FH{473OG#t)tO7VFeQ=M=gV&-=qshKe=zIJtz+d2i#Bq#4!y}DsT?F| zW(DX=-o@h~_Dyy(v4({CjKFrgRf_5oes1@Xxb` zs@a<-d>`@T@wh$>juO?M1z*13n|nZgptY)eoWEDlTpHlY-WE_^%J>eJc?3|!w`jJ(CILXPNKDu+Aec_6ae}7HMG}nNy%QR9l2sXY z?-OmC4#erU@Oh#bbJ_OYIOUp93$;;Gmd8@jG}TcT`uqF5%rKD_##Y6k{XI8Fo@5n&@mGds9Qy|DPSpU*~L}9vo4+y0S7M z75_eF_E8iP#M8DbmbrtFkV~X)3MAo|bcjM{TXW|v0O|J`Dw9-um{!IpO#aIm z$D79m1kYR<0tp}F<*i9iqdq|{V|SvUBdHX|6#wN+^Y>E3mzRq__|Wmu>sU}16$PZ# zZz%-AU*DWnv*U~B2xKmne!G$NUTr&RK$lcaU5%0t)0|mLbI}AiUR8hsRd1F3n797L zLiihozPl4rEex&8$&uy%h zpWE_OQC^#WK*8-LkVGz9#S`f~;b$@l;bAuY>Q_TW@QF_LxbyM7iZbL!kcIiYMxj;? zcDON`x4>I;g}{Nh@nJrb0ZHf*fg%=^kVedlK>b+7&ot1lphFD$yLS!dJ-H!{*EXDe z17pE3nIjiC^3|&6Gcbg=l$?V2aF`ll+F#_2|9W2*GS{Dt+LtOEJT#;bFv>Z!7=8wH zS%z<9I6py5G(?pUcQ@}+W@lz@<#7WWGhWMO~C5E-w_ee&Gj^}DNUyz5HrO; zz!|CLfjWVZ$~*grd88ag6_|cLRluOSwb>Cm*~GOIBwgi zE3e*g8J$KrPe<{wt-dyHQL~(;k+NU{rZ%DSO+W{Z0km{W`=wM$F^&^nPrd@_nB$hG zhk$zhSJ{>cD*ZcVdD{Npn=!WjfNk;iL^z%^zCj?y;B@Ki*@!=Z4MZRq?;bH1-(Hu3 zp&S|4CF*o^J)rV)WoqK|JDR@k&;Xx}Zo;7bdVyF7twXy9wDd4+Ft=Nf&CI=n@!<$| zVUYa3CrKaW`)KbA_U1cP;LOfM?Y1#e`0CoTds`qT+i$qhslS~%>;}<-^-wd237r66 zqCpo}uA*034J5_RFp7as3c^4QY!SRQQ7$XWxXZHZ{Ks_{-?RfSep5pT=mJ=%0&>}s z|J@|vY*4r-2i<*=P)}s(tLJa;KP{iQTkdelsgFurk*CYhHPypyghkg5Z~EZ_v7-ZX zqI;YcGBRDQzRp7EZW3LYhgc7fD{-W+-01{=cG$zN?!80C4tVntCUJ|s|8dKpTb!qL(oT@|3*|afaCNfu0`*c;Ye8sr2K)RSzEJRH}tZNkbab zhT(>7IVNu6;=KJAsAFY!<(&7me|nhZmwcH;56(7A&BERJA&Ul$wh`)b2Y{h>s$>x( z@X|o8ewOoLl#h4po1guOvP`E<9Et%fn<5)9h{e5>w{ikqvaY_4j=yiYmWvIT_>)J> zS%@@D8Y|6^EJMD_MYgi@5gOe7YbN}U?+r9iZeJCjr#tEiDg7?4e{L3Fcp{}WY5Q^%nUdMM@;eTx{0)GHJqW1$~J4J_bia9 z;&OT^fV{SD3-B~?$rg;p;sGBf_~Dot`Yo*(qd`=gHg_dUjJ+KO#?I+%WAn+(!UAd6 zXeC!&Svis=@8`ZlwIIU8%#569Ya{TwS;P>A)4@>p5Y?Ke({XomjfBd&srM+_soSI| zmsI`(4*S>1cG3qk^hwU|(rL*@nS6D23{xN>99qRs3f1Sa8$U3kA}*mc`xrPHC-`!p zO9%tZ)V(UQn;ILhJaHKgO*`18N1)d|yW3A%h4veKP?4?x{}8bNya&jOoac$Q&d0w6 zaem(w3kZ%huXBaY->^FE7Mg9YI_->Sd-VC%>D;w*x0hjQXTjOYP|nU!x8xuAT@|s` zw)_bk4AK_aMn-X-8aauiRZ2SniGzjy=Ddwq@2(2_z_4r? z|6D?hkFM2U*WG{pA)k_3i=1*CE}G=H_KSJk$tmN&53u?3najA&rWFgqzEV!#F1nyr zpSh04YmX)(W#~r-lT%Vskm+9~QQE_an6LW!9P+*`nEm#X)MV%B{JlIs^=Ht(!YB2B za_17I^IYTPDG~N<_H6u^Fj4OGw^*@(Gduf{(@d4a&09{2l&jC9D6L1zgoaj)!{5$O z6WWEdQM`hyN-{E(ox8eSUq=fsR^AAulQj+AMTSv zDD!j!&xP|{Yg0pm*?%p{UoVb4ry(BjsyD=s(&^WY3={dpm|8bKQEn}KlPg6<#$%;t z2@D(Fn^<}MA$K5NYt5%B1J?CxT`Uw~RaH05x+%%_K*G9zlS>0hmK*?lFSY6d*ZHk0 z2ktqq5zFla2VP8CJg!iEk)Jj+ahv0%v{LTl>nfW$_bDFhNM{E?$qDg)E3XqR8HwUvwUi-`rUH&PLZvssuP z|1uX#_?LrFN=%`w^^7z*R2}yVq zEob^4Jc~w4mudU?`_kEE&8~m$BdSJ%1l72oKz(b& zao)6$uy ztx4>yJF@6|cHm&e%!cRX>P=UQ-|htIcr!$CS^VT5?C5_1Usv>!GxU?{^RC>nuNBth zM5eU+9gUBVXFP~i?1^xfdh9(I%FN7+2Jh(+FH^gpUnh2G=&i!%IXkYl(vp%RhcN$) z2o6ECWZ98;jN;K?i_u$naTCKGNhM?Uz~=(?(~7OQ$Nr2zfT|$IL#@>(xu$Vh4GJqrpx*emYEv z#{NSjwFMhZ^g6`XbT!o3_-3<_9UXUv<2V&wFw`VGMfcsbYkJOmuSyS z`0CD;n_&ztudiae3W+B}Ue8j$H=iG*K+5nDCOV3RS4u=mHyHFh1Ne{8^vha%e8$vB;M* zXVC3demzYW#AmPF7%j*czd7CHl6Q5Q$ZI?)V}&hUGI-#%_4kGpl@@czWw&IN+z6Gi z_+#CY<4OYUlYZZ8c%EQHc98eO%q9fLlk;YWt4<4sNq^vlzpX;MxhpeISA>!Ct+%hO z_4N{2XbH2#9xk$ZIn2tAu*I3RZOGO-ek9-9%2e%=J4M4)+|nHH^GO zI%tX{3Pc%@dUv(CaV|yvEjIb@KJ+xVSi(=Phv?k^%;~%Alu#kDXw!jV2ANB6fMH;A zo%$-~s0I$S&6MG-3kwUCBD(xQNaq1~DXb0~@89;juk@sq2hCMJJ8;ao;u0AR@>{BJ zy|IL>5LCMA-zY->(cGJTFXrYFAHLdHQ@*T7}*uf8oW z#B72BT9w5~ZQ#Fh<4Pobl${Td(>3CkVSFqphGp7@@nm^H254a(&J!a!AFE>WpAN*$ zIlaUR4#b1DJ_$>E)VEkVVPdeI5&WCQ;SORaou!*3;d6OXCer(a%a93J$apAgBsJP1 z=70B@yKg2^t^i}m1=D@sCko)ao<_lOK`3CYABTT(*rCmBG8D**kqFP3?d~W<5{x$wwlru6a}@$f^@Xw?<)|${R?KdsoP0NW z6_A>Hi09O|wukGC93n#NV9)t>JkTckGw;e!VKOyT4$?mSKNMy3bfcV2ias;|C0k-0 z%oEi|Pi0yhJ@wdI50hKbeS_+mt^q~pOIml(PAi&odd+4j_B<|{T{d=%pz7+R;FYTANYxr#dZ5xIU-vz@ENil-vi{tZLyRYlJhc-C_An8^!Icl>oJ_r3=W_?d>XQnZ=B)+{8}`N;|L$ijf(FWIcT78i^7BqEQj z=+D}rjf_KcMtSxlEbNLRge3M?5q(nKe2XlF3PP!&kX>IS`uvVXBkYw8*~1Q*Lay<8 z`{P1(Suvo+3QZ;Js{^qVs|5rzoXbGV>e$=n&_;T#I5%iZQBj73P>0w{Y$A}Aw}=xO zBp?5l3>bSoX|0XtWvuM<)e5cpL^Jlj9h9oChm>Y%KFa=I*j2Xv&_gpre1O;2dp^GI ziu8Wl&6BFcA?q@m-CnM7BLq|!RT5+sKrdHhlfpXP39R!4f??WMfQ7MwZNE;^hQB`W zDmJXmzB>pT2^IbxO894k>lV)!!or*9z+Uq7QDD0X zk?MVz*q2T3xRV%rGj=g59`w9_>9h~HIm+`1c!cda->}|`{XtL3Qpw(zV*fVf&QIq= zP4~Y4b#p}cDux@M444nPi8Cp&PzgM?x;d?=%YXuzLoYo%fDFpoBFAQ-Px%|BN(AR)x6-oF`mNOx{n4cxV7fKEaUejS0x1*5<_! z-p4b4=yK+-v(Y7`^h{YuYA77<@|$M{+3RDvaJA!O8&GevQ5P|^o#d*s=6lr7JSrY` zo~bQ|exILI;Q7!}@`36iz@#p>gjADwjyn)pHYayOR@Cw}4K=em>ZU+CUC3p|b@NM< z>5m@U*mNW;UuO0i(Dk6E8lu>kUuz3(!$dcJ(cY|;Z8@9C{+?nA>Cbv1z?Bu!+KsP6 z{O2`!7u9x}eM&d?|5}@N%0d4p`1Exdx$!i=BX(t?Y^<$;DaV2>!C1lOlj~f|*l7gT zyJ3B7?7c&)j{I>IyIq*vnfNr=`3o;Bjy0{T{Uux3jY9c1K(-LXJHV_jvP0SWb z`%?4}b@Ck;h!z>2&=z@#_e;iLV7F_XI8XvFE=N)%P)tu`XR|@`{B;)T`qJ)QU4zp2 zi~?&n6*Irt$ktex0NJW4awOpzf+eLRb*Tq%Q@Do4XiOcNEPodmD3*sP<2@GOBFAU$2DM><7oMShUTJvYKCqiA)nWC-CzN<1r6EGLf7kE9 z^i@L&Sep_g;`qEtrg3q&kvuE>y#kQQIA z!kjcO$L>~~f4X|ACHo-|oR-O_6dKDW$v*q?+9tQwNdqv-@7rkE4O za65E;MmZvk+_!&VU^U13`cLWG&!GWCe@yIeUTGQslfY6dD8>kxc5R`2ClD24o#&iU z5s@0LbL*0-CXwQpr!3NNN!6#N;ZYQ5FsD(;s$U3y$bvB}G)h@&H+0m0OLeAyschhe@;MiYr~@&})dj_Sn<{@*0qwN6phx>~>0$GoAElW>F4&XAWUI5Ss=ZlWTU?H% zZ(#s@@0(S<4S}SS>Um(*QLi-iM@`1sIrO|0egl45k#jwGIQ4LLabju(=T%5GvtK&= zC2Z1K)L~vOn2&@qj%l|Sie3z^38;}NY6_;uqW|$Ul*13s2C6l0a0$*aA50aB>X?dV z-$MA^CX!?{R`A`>Bz|w&f=Z>(8iH$9b7oLh%l4YN_az zf63NlP!u@xm01^Q3f6jUzJI3#d(xc4u?#tKIDC|He5*?H_}5c0J~k#TS*UY)seD*( z8K?T~EAEREB9ccHX)r56BHzV$Y1vGA8NM|WDq^8~Bp?(ql}sRX06mqh%MX&?Zg(k9 zcnDg!0#A{^&d{^+=g^Hu;PO3V8nn&ir9&u@3JVLT(Q!Ys9Z9U*TqhD<`131?Kb3;- z^melH7eco^FftJ&1eMe0r1}B{@42xtCJ|P)0k04vidK>r`8O`k*acFy2n45Mjr}wt zpv>XpMrqJG!gz2$e2)!^#)%-P=W4O&#5OLhJw5588;rsr9yZiM9C<8&Zf(28f>#54=P|U?@;D56 zt1l>xI%~c{6i+#x!_FK>ZJjbC$nMuvA;g%C18cu+7G_WgwK9V?scrb{`g_ne@?~Uv z;UEbIXa*L1E1?eluV%N2hA1XVWDnZM2dg;=2ayluM1 z1iKz$qLN;OxK3zHJ;$MRH&o(!!#qi-#I%uE#g(u$s=ZTd+SYt|QaEhjH7jieLNF9E z4Pr?o5N(f6s1P*f8<9_Q(bv32ghbY)h{RWc%G; z+8IuJ$S>TEG}QVx9LI@^-AmKA_`V1~ltYNoVH#R87t`{`1?(9?qj zZNB%zR)`yaPSNZ{XQ*QoTE002apck#%=w=y0UG_9j20kV7NchT*$*H|?Vs=Gf)pgf z75^Nngak)szQ9|2@216ji0)Hnk9a*YF|kh<-~7tjrRv33GQA5#V^8G37{)*jwT*x$ zdOH;oGmBbQBGQCt!DRCLQrO!AAE}*8lh6@u~0qhsy+fmY}542%uFu3GA1=^yviP42V{SFTde>_VI>FX@It1;Y;~)OamU!$ zgNLL{go7LlD+H2^^Uk|RJ>|Vz9iw}IE_?eeg=;EkENR-_qHkvZjTK*Fp>94qY^cT* zlVMai7~g73SZ9t7{HFs(b6qfqi9iPcA{XqTpn zx`)ql=QimN8-Hx?{`!3boqb4+W2Z|+G#{Y-$q8M+ixIGND-nfuK^4&)ost^M^J{Sr ztgPkCy#LgZchocNg-IL7j`dW>Az~2CZmZMPn00;ZKyxz-6qUPAyMaa}C%VJ!hov`t zh?_ks1IOe#0!2p^7mpJSZ*gZIsvj!4VfOo=&#&xY?Dd^FmlT8Fh~M6n&nOa;8Udd&7HPdeweM?ow|j~fXF`KIl>r>CcWQ!{r3iNILGI{%O}zsU@( zfPw43ID5QW^9v{Fmz&|HyM~)J!SzQ1eo3_Tz8ja%s~m$Foq=dpgmjIM#&TZlDtJC>c?HQo{5^0_fZVa})!$1S4)=5ltnR zc`)uh2L>y}#Cdao9zxQw$R$Z4M4unqn2S4;6+VOgbVb z`p?gLAKc+mdX5{1V}|+8ane>nOgV?&tgzCb0{rwnu|E(ezX)^ak587*GW!ecPjYap zRuw;evvH%)CdWIHJkMDu?Ylrtpif!>x2y8gnUS_4H2+ZrJvv2HV4z=|u%sgPxW!Gl zOWTg#Sh;&1c!qIhnTET~o!H+I#mNKU^0ipva zwgxwtV1^h41qbf;o)zYd6PdBD2giJ~I*mbTq$+Ni*$&G8M3s#nHB`3@L(g$j>52=@ z+%0xN+n*J8?<`B#lJ@_yj_?lL3-JkfQ_hAE{fY3cYu@Z1-?ytejfL;LU`v{TmR!YL zJ-!zw7$-;iF3R@}PVqnEg!W^m?%t?3xfinBFS0i^iIbIGjqr88MaCAks0JQs59JNM z{C4Enb@gR)iD0nUu7`I1OxMj4$!P_?q+iKE6~0zs*ZP9>196W<@^ zE6-)63V0IO0R03JQ_PnD{GfU;tzacWe<;z7J$90d6hYl5=>~EDol;TsZ82l6bG(W+ zk`-DFt_dG;X^>@k#H3OI+zITzNDuYZy*T`eNhsv9?6WHRUB%UDK!fjrpA}WtGJ9F~ zpkLJ;pD)Dz7ANfn=~f;ULCKqi@TCi&;S+>I;e~3%-B|d14PdP$8H=^1eJ?8$JKkt(m+!_&gqGg4##vzFwJIoLslU{s^|>P{6jRPDhu~ z;mqOA?gT=odN8!<%h<`BlQ-AfOGmu1r*n$O#r+u4{xn7x)RA1UGfs9fU4P8K zC8cM6$17u9-)s%&{wr#F4_fw;s-Ssrzhm$tdQ5s}v^2P47M=K2jNK_=@m@W!7spOE z5cI1Wt25xfv>og>FAJ^tOZo+1N)(tSRVqcvRFn>g*J*YG1>vn&QO+l4KaX>rpvQ?p zBPFLzrBF%nr`gip!6!2x<12E$!QZGsP%M#zowmH9=fgQ?{$4ZZ2Ah;qR}iRN#Zv)! z6rA=y(Ah2qf0_0bFS$-__Bo0zl4eoyKTdJej33hz99(e7V4Wns9gS*m{Q?Sa33 z5NN-!)}>=uIwhf9Q(b*aqrlGHfAo{TG~<>01|yEvpdZGsOZ5*v#3q(Dc_U4Cmk8uS z>hQkOSbZgNc@e-u+1M+YBQ9~tv(8;PQ|?ANS89&e>!d|B2Y8&7b3hL}MEFUl7Yisq zHbt6}>u&5>&pHftbH~Y+WNmu!YsuVp2fvnbg*)Dupf#Iw)#dqfgYmE`FJpG0R5EYY zr^z=3ED1vKnQRy*Ryc|_@iIr0S&u6(v#BR?bSS~XnT(X#2Ocb5!0~|tAs2~W?X)b> zd*X8Nj?;(S`>{E}O2ofP;_Bac+O00y?P_I_<97-`>wbheaoP_^HoJ7 zXzVW8oDkXf8CvC|-ee_6|DRK^y?je7D~wMI_;E`0XhdO zc3$0<{m$)_XTeeBAwd+@%FfbD3^8kz&Fse;TP$U>wi}6# z{Bfdv#~I~4?Y%@};=7mD0~|eNZn&Dt2c4hf`d3vyzMlKzk;ZkI2t`B6CkmTEwc3_} zhxfB*6T~&5>tOSZplKfK69~t%^vMHL;izvfPhNR@oE2IA#uWTXAomDG|5b>S zAKf>g-c5V7^620tr2KT1-VIrI9)emC^J_o6dO&>;x_Q5+&uLvq;}v##qTz_% zzYUY)JH6&pa+l#Vbb+mWfcC&g#0|1);2oMAmU9}Pfs~FoNNlq@H0$HJL=5TgLd3ez zyqVZ(^zS)asfgq0XKSeF92QzL>svP6oVLPQO(|fV{3HLTnTR-n%iV8uDI^5c_BVW- zF?%`!i7|gl!tLDNYcA=o&P`2yw_a-i+NE&Io~NGGnnEGV%Qk3gBmCoQ!fjc`u_DPK_^ z7(Hgz0HzlrMqgHYnk%k?3$FH1>Igp#*u}re;9eK*D(WdY_DNn_{O2;=md(dzmBu2t zuVcQP@DVGe{N7`Pn{1P}lwM+Vg8g`of`9c7^0uh(WJ?%mA?7;Jd!ejUUh5y#NC@K* zF%7N{wbY473PM<(rc%n-`TI9`M8&e(g*=gHp;jS}Sfj_ujGX3fM;(6a`3q#{n#1&R z;({yfgW8QgP6P{f3`U)t*(7#x(uYY_bmDqSa31s_Dnxx%TeMdrrZ}_dFhRfWF3Irk zZ>*g|5UpDD=QkyoYARfNsZJk7OyZZH!_VRs#N{cs9&~;<5|^C3djARPu|{(n$9A!)x|<<_|haQvVn_n^G4+IONlf ze-sk5B+2Qb{^Z2ZQwOvR14eB=-%kM?)`Vs9We{!d;2k7!?I53uL6khCFeGMmZ4bD~ zp^d5QW(h%*X+&X&A(?&a{iN;wEV+kw^7LYekFH>SpMd;Sn9vurLJYC}!hKPf^xDto z({dlb`2$ZVe#f(0t%$0VN1te)Pxq4ci%gZ`QUeoy9Qj% zLN}KN^VI1{VrWzQNMENBiV^!hQ?&|seX4*wLn4u&AJ-SmP$DOiaJw z2qA!I#uVZ5`vbbnm5`_U!3zQOzf_buB6iaBF~usV;|$#4=WcM&bI#J|!Lcd+%am%z za%IBU%tvi|j|sNdRa93HCzJZrwuh^B7_SgK_H&<{;6Q{BdWLE2fIcv?aQ>SWT3hlF zq#^M!o^>lu=W94lTQWFSjPZPU>NxrSyycb=#UJn>_k``rJvDMxQF6ac_OkZwb#5yM zU~_PVX%ve4h1$!~&vI1J*zMp`=&%3SD3k3HM(9u7LZ&8%EqtuiKbqSO1Tx#U+bdyT z|9HPq)juVO!(RiggQ(SXZyiIW(O0pKojUe8Jj|t~rL;tWaDAW~l8G*C=_RhP#q$S)$OMNMN|a@9|ayfctC=* zFf)riq1dOX-E3zfi95av{U)j*!qW9zj4N>XnePa&(kus6-BmER@Nrj z@F3d|npzyZx1{MIk}2!;>{VJw%yN-9GjG!bm=`;B$)D!heU}3!#Kl}(p*dco6;AP; zfvbJ&+QK`lHI>9tdtc*MM{t0G;tXS18)KmYRB=Y4fsNbVz-w3jHWco7gYaG?{mJz0 zH=Z!kS$(mz`&h0t>Uvh`jH=n6;uOD(4GaY%#D&X4OzBQdlyqZS#>Uqy6?x*#FX62yK=A7|H-K&vF>968)j8xH03@tfpGClH zr^?$<55Gp+Vr#LXFqb;)g>diBRH_4vQfN|yZ&E8p3%=t4Sn+$1NC&a6UTN->5& zDAQVU*#c&Rk%R|Tbo6`Zk$tUbe`34rq07r~ZqDeuIEm{`ahVJ}$wJ!y&VU~I{Epq3 z+$+R1j8sW$(?_d?&J1~C3XmObBB6?sJmwq4FS zX-P?9GhekFiY}vCj-ewfRMgKbkXwJ!#j>i=uuX;Pq4VU48f!A zT{Myd#N62MhcUA^h~7zMt<7c#7q67lVTYoSG1c+$B%()+4dMUYuDzejTTVNVpW9eo z?bVr|*1=Y*o~A+)(sG^k>sA0vvL)#^6GxEGC?q7L`bvSE*uF#lvu>YVq3nUl>zc~2 zw}v#}l`$10ss&*E@Eec`M86WtzppMx1P3K6M`T#N!Z&&49R7_Y^N_;%jnQv`YdeRj zvz$%Xv%^jF5ZT7AkRB%subAST7WYy_m_V?rl46S97!*qV zsHM8okRU-;bovE&93UD!*epptoOEru2Kf>JHWn7#)%gsbfaKKFaJ_zcd0D`20E}HF zK6i9>Mk0+=u4czHyxa%%{+8DUw$gb&!%IF~{H%;d>!Z{ZX-ufLDL&BH)s`a9?Z5r? zLWjWE-OiKmp8V3cxPAfMBtyUP2)1qY_v1Vt(Vi0R-JA?yKv&=*$H@2z3`bOYjbq&_haj0G0^T~voSRnxB|7=M@|h<7B>2z^$MK6T#CzORF_{S^!JHa>{Z?XMPfDQHAano(SE6YMJ?_Tudei^ z!0r3fQgxo|Z^_#~_$N&y7R2%Oh3REWxgTj7t|h&n^V5s~Dd%-L&$9^e)zHPo>#NS4 zfh6^~fK;;1Wr%sSi*0zgv&q|ExxdrM(20{(GJK6k;kSh^(&PJP8J}m+w{NO>-Xr*f zx78d#L`9NHIde+KPG>{4Wsb}3RiZ=H0X|13L3F6HDLx+|31k&^oeL9!938#yQ6aY0 z$Z+Rd@1K6Yx)5157An49<}mF^wwdY&Pk^wWY&V?p$@Ml=k$|r%Rt5k z1Y_rL8{@d|0gHV#$cb;ILQ`>PwWMyRR%e)CJIUfYX~|mXY0bm05Ct7pr33ZncPm#E za}IpbC&=FG(KuZ2F&n8OztTMRfZOe;lJ)VNY9O4MK=c^;{DJ&yf*oxU_e8t3epwF8 zX->Wmx$idaNEEvp8c1I;6OP;7$F;;=Nik$4KEaI~D*z9r#kUY%U9KMWoS+q>ly3bo z)Zvd+rsFxg$0*rsHe{l8#oXat__B~a8%Y@C^fYKD+ z>eSDdb;SiAB`QAVfp&q~eBW>Tv9-^PG^o!QgHPvpDAADCDx@P|Nx`yyi8_^Rr z(kf}(@$NeF7V|$k_t_|3|C}C$!{o5{<_3l%U>nixY3KL4xVRjbpuSfpT{!IJaf=EG zP29ZCmi^XTX+8YwBYi;&2>tM5C#PbCAHTVY3KSkHq{X1#m-R=Se6>hQc5zyfJ?cU> zg1TMF-zQ6cd-5~p(s+Ci(LHQ#q80&nzq$Y(ygVzxXE8VQ9Id=66*|lLU9@mM1o1rt zq=bmT4Mv&!Y3JHJSWRiH8RbIf+pm@p+%(@|IxKJlg)} zj7M&K1qKX&9xam>*!SP}sAeGG`)X~x^E9xBxT1%sx*5E8@6>+&B7Q8vRh9c}InW|6 zYr1@3IIRp7LtMvhd!5W0zrDJ&OOyE16?1|=N_^IfN+YiXigS+MsZH?jG<=4cX1}Yp zk3W1%`T)xXWAg~*XEq@%i&*68A@)qqpeT~GgB_P}UeltCqX+MzJ6Ro4)fjeNCh)8> z2E)rVFUxvc^o3{)pjjwxIF7X1049mhV;Puk97!MZk+?>3(-&&(8!)Z~PwvQYde_1K z6fyt))_i7s{gjh_gWtYs4X*R^8)ZS5 zp_h%E3nAr;L0Iw{Vk)LEgdBa3IQL4+ zPaVi7T9U{})#FUe+i!Sf**#)3Pf0tABJUE`-&1iKQ*@&^f6vwz)*8~;@Bubc>vk66 z267f2&|Xb=ELQ8eZYW7Hf^>aR2?U|gXRF@rI(W;JVZWXZb&*$BA|64>P;r(YV9Jy%D}N0w*2HfgEbk}Ok5&)ctN_|NO~?@#?*hxdoA z1Z|YaUjRFc+u4dR8;FK5$Z~vGHM8((Tk|^X&h5)(!T{4KphUOthX(cWdb!5eDcIWB zn7n^?AqeX>Kvy3EA(|Lt8OPdI{*g7GtBP`0gnx8Iupy-wLnAN&K?VWy0D5#@dW)|E z@)#CU4nP=u`F>vmzV*m^Jh?qEtI5y+kIVG&+M92!KJr$C!tEQf69n@*pInFO8s7!7 zP@?wvmzzpuK3_P&_5fO3Lgm?lnXs&`CyZ% zwWi&3T$Of7rUuh0k6vDKAeNVlBN~hX-sL5i|GfbJzN;c2fLK^s(ECF0#c*BHt?BOB zyy@nHA?1lf)9hZqvPv1~_0O4cRtpsfH+WlMd2`d7 z6KIGrMZtik54c3gSNXUprW-N9wRUqe(3pbdor*x7JDL6d7!xf?bagf2_a7=P<+AL2 z)-yNP2bvLz3NVCc8F6e)s7}3mK{BHWQCIjU;hC9MexzCz;`zoM!_iaDcIyPW-7rUB6x{$-x=^*(5!L)DkF9ChI=y z=TzH}AZNa69_xf8b|v(!TYvOd+$JHs5z{h7PYHyu)~>L(ipXE1cpK%ZJ&34ZTq(*s zmx!xhn?imO&oMt*MLhfjYoD(VG+Igezy-Irl&(={r9j&Tt+Bh>+w^=?~Zk-g>juH_PdSBrTh(oB&N~TVIgqXCW~l5shWN7*H;@?NNBFD#U(Ct{<6bWjt^RQ@PR%{N zIhTq?L5Kgx)?3C!xxVY)KN;81}i}mdN?ETv=U+Js$Su=BA_jw)XaeR+{hX?&-F(;aA9gp?^EN#8HS;2HH zhyNkPY@yS1<$AMq>$_l6Wg`g-!i7rhzzU6P(>y5d60-C3_pe_c)5T()CG$&e4XPBp z#R#K=>86zi!RSUVVboh+?l_{4w~-n1VA6kQ4CBo}MCZ>vAZ$MmAmXIwp6t|tMM`sv z+zfO=2>a6q=%qm3nEohZQa-tT^A`eOnxjgwir9s$Z$^?xGKh5mk+$RGc$h(y*<3Mb zg4lmTPq@IOM}(0ZE?5qrZYHXX>EAi0I=Wdwp=IB`9{w+KB>b6zGxB6{gk9`YyNVk2 zRH6PqQ`&zX5xyKbnrmRYB)~zZ`KeR}#yZ7?3jHvB=ZUK^j*lMk#)Kv=lhrp*lLcCU zQ|H>B;av9N2~G{)Tu;?>tT?<#-{{i%;t%K*+6z}xQ^_)m;A^}!`ryRA+AD#${aic` zx8&`I)E*p^8v4bjfc@~R0xV<_ZrABYY9IeQHPa3-EH} zK~sR>!=k6#PRdzfAz_xqAh#eUucRJr2#mZ@-o+p3f0a1_^9K)zj8bQ{2Ep~uP&^1X zx4Xx9yUn3ikA=s|*M$A=w%|MN^ zn>(A^X*MqY*F=ynhi2&8&ME6k>uQTTUiCKRi&_4hQIj~%<(Y?=tHDCZU=06-@u49~ zqS&@1I4fsiY@BI4DYK-udz3T2E+w)x=&>Cc2#t*#54I~pJ{yM7$!(@NGL%{ND~M>t<+h8iMC=51Gt`> zzExJL+Q2s(C0Ppe8D1(qU-B76cFrZAqTMJ;bjSSEdDmKG0M-8Ce;=FwJxY)(NT(TC z`llKCfjGG9W6I@4G4=5iT`VNFTTNyAs$=jF)e$%w1W&#NoFvt0Z ztnfd*Ixs@g@tU(An$f8Y4T(_*9lC|UH^=j<6P9Y(c*^KO)i29)B}B)Jf*RYQ<6PCC z3>1**PcpG(e$N*V5l^3bULxF#wY+6-K>Ou#E+btyWQB=PfpJ(7gj?U4Pg=IfQK2#T zd?jy_LNHYf+JXCIC2aUJilQPgCA1`+G)Q8I_Va;mYMb7;L=o`Ny_Zaoy$TWZou_+q zeZP@;6~LjZ{rVqb^8f#aJ@x;`$ySyRXw_*KooN?sp-}(I?&mw+2?R^}5tt9+Zwb!? zdym!GHEi7?-#Yi+u+=Cy(Zl!A{S(_MAbGm7!Wn)dDm2~A5(gyENr}zPO?O#9fBl(y z(CVwf*Z8QBbR`JvfGSEossuUMY^cy5)^o2i2$2wHxc0ihg1=3PlK1 zIxoLYN!n1|(ojopsj?D4k?T?_X@c7N9dfmOs%N*sBj{EFS5$yAGZpx`$#HQXb{Y(T zikRC7G>FK#lP;417{7kW-qNiDA4~Q zU;SVuvV9`61dd}=(k!4VF}|0z7L2x$rB5KrU(+^F+EB0wL&9vFI;C>l5Q9;QKa)K%3NQfz&*GBdA9!hZ=R&qUmrN62$v*L9=07#a_egw zAssw~c$n(wOg!xDdha|%I|-JgzZta4{WmO)u>thDONLV;SL7ae)zrIm-R3aE3J-^you z#{`||-D<7wcMl@*Sx!+-8y-%)AYZUf7v#I?Q)k;o4z& zd)5(Z7dsZ@wMpkMm{koo(nfXhf#-#cmZ$0Kr$ka`;G%maDZhK~BWyP{GTji2FO{Wh?7D+dIaeNPd3kQXx z&u%`B##{?D;DMJ-Hi#G`k3F#t)1AHc)S#@MwnKi7<$z2(o5gDaZ^ypo3#c{ z5I7`kI)E)7WAxWMr?cP7k&$ov-cC>*DIUftIO@YUgU_2LeBK#ih$~-UPe_RCb#c!i zN3ehey!v4LjlYvq$p}0_N-CL;c_nCj+m12VDNRy*yOzGVzTCXk5pjEOBs?aQa1oL)!zE1oMB;#Ds@%gyg*Kd%|-o=;3W%He92dkF` z8eez6_)l5xbhI7`Q?GBIi#&RzcW>W z%9>N0dFh4TobIuPI>(xrh7hE|S+zC+I%nC^B*E32GX^xkvyr;V{*u097DM7a1Td4u zbs&Czi+?&bUW0{tEMzb@lUN~vFoC!{9fO!+s$1pjy>$`Y@n4=PTl!c&q7b4h)g6UgkqmY zTnV%ZCQEw_5#w^u>d;<$TZgN60KfOCf>S9h% zdNvKf=k`;zRa8_AIzLXj-!0oAL=%074A{|ej)A#HpOlp|JL!Jp2V**)mEXUeefBms zY$gjoxVe1ODnd(~rrsoC7`~f#W;hI34gz zN&XBH32PI-PMIJ^p)ggr|=`Ksk%HF39`Y63hIT+Fqe0KrkSJa1~#{I28@vh%G!`gq&DA&J& z);B}DJ3AAQbK9?jmf-9ZW&G$7b^OH5SZ`~RM4BW$`ykeEZt{brsoO$dFD^EBh~xR; zI_cX)++K+ZgQGQMA9Kf<%hko1J^1sXedgV$+@j|sC}}m?Ka%B79>LNUSo4bs2mn`} zf%Tft;?W?0^&xHcPu253jZ5iNmR01==G{$Xn?)dT7l9APd%L&2Bq#CP>{W9|W2O!b zUR=yZ0)ZnzgAy`@WK1lvomuZ4=_|GYCO4$5$SxefiE62XBy?-ZU_?5QjFvnF4rO{m zde_uP11g927}_7wLw)z)X+1c83B)Wmf&ceA2be7S(g#ZCz^FO=BzEUUHaVXffR3vD z^ncP-8(&U#ZHmab#9F~Bbkaw@s5_d7+~f&GkbRyIg5avN!op?NdkrBO9B)s-mc`Hz zX?JML*`k%zOKTK`Dn#C5uJeM zj6d2=YW4lYrzPGu04QO`_1Uv$fKW)K2^scosQS&vW*)QQ?Ak^`!c)d#V-}}++YwJo z+u(m(=>Pq>fr2Q#CoK`}#;Bm~R9eU4VO_Qb6in{H?rnfoU+R=03nn1w)86oz}_a z$*kD+IRJF#NGpVuiOz#6yVw!z2+TrWvg=oz&*@&qE!t~RLB7fp2Al|7U|1m7 zKf0;) z;iIjb6C}=ce@%IEu(Hx}&-K`);1!J0k$;fr>oor$_y*xBJi)pVEsX|^5^m9@rNQSJ z46rQf!#pkKGC>&iUI~n*mFPgoMgQzO*mc-mAEXGFqdpQ~WpVW}(ZKJtCPWu^IbQR# zsguP{IcP*MPH`>P+%kvfe>sT%>lfCl`EtSiHr%0_xAUOwXck6udPTiGI=pJ$bZb8LHvpX1C0c_y8nPfJF!b5vImI4eH%*}!HX#?_QvaPeVQO#&8R-nd- zz+rN7X|pRb9cwmbuP;9Ut74YVW7?j%#vsE;1ayA==JyNXxG0aQnVE9Xd>ttV^y&Ufl!m22 z4E%qihyUwjJtajbR1`gSd-CK7V6W;CYLK1vKA3DfYr-)Yc1sGwq0?7)z0Qtq##Kf-JLDT;_@bvJ==8mmY-^UT`N}m(^cy(69?XYe| z?Q-<3f~kp+!kvlp^kB@`E5(4KT@f{^KWNyEh#k3MrAGHHl{NW%cf@McTU-&fW>0}A zn5sCvX)H5&ZN!)deVm@^E%J{oY{xRMn!}cYCI%P7@F!2m25Zo$A^c-LS+TxY>{^9pdc72Hv>w=FJ-v(%==dY&TPJzr6gRvN058{MP}~>OuTs{{#Il zAgN^&H^#1P*H)Kv_;S887YMAjKi_R`4qBg=-IsO+dP4}2rY2Og9q-O+wd-2H#jE?I zads?ufwKV5=AFjvfL@!j=PtHYiQU>B2R^xp`gr-`Z2O8}tj`~PAHKSA438+=F1ecZ z5r(7v?s#1x%;A-k&56;1O!4ycEkwcCY{ZcHxIMa*$M;#1>Ar@$f8Kmd)|E1x9R;hj zQql?x7-^rFFrq@soHx%zA?H_uB9T=6zknSK6A%gxRVp7NfRk#@J3|?7tdh}EZ*2H? z4+4Q*O!`uU@n4j7!Jg;8HD}xv;Z#4qh%%}j)Y(?J6G+0saTD{8J`Sc6Q(b7`0gqnE zcC33tY3cLzlPPmAFE3c<)bQ^oG4Q9c#&dbN<^4)tX?(MNHDER1vE22(eq$jtd)kAZ zFyDTrFTB(rKNj<&G}Wa^Qic1i*v3HY!#_<*=*PDxI2VaJ(Cf&4(c{Q6yeg_@Vm$8S zJK}}rN%)YbuiH#ZO_I7 z|0-6JDYV)=ue0RDgzHFOwroX@6{MFh(<7QB2;9-z4A?xO9 zx!=KxRzB9DJ-4+5`2bK0)-FRi>3W2jmdwpt;A<qcP#Wm9Y?L?D7VP7xpM`8urL zX3PPN40Yd3YKq&qp{(qIDj!DCFa>JhJm{RMeq3TctO=nr#M0@+^w*5V`jkmfF3oEE zq_Fc4OWBgvBRm}-rl}$?gU7Wk}J!4z0D6$gZH8{RZM^kL+#Ja zi{rT_6c~LX9~MlewtRHPcU!OH3!*p|ulBmnBd?+IB+5^WnplsrStsymKv>mW@oP*8 zYnFJ`aS?^*B5+ZL2z%kpSAI6nA2E8*MpEJr`$joxVhBDx* zRt#TLjZc2nbq}z1+tu2fdntY$lx1647DLWMC!7cnQrigk-ZJkXH;>m+E zotfu&YL}VyHYW^TcoRYze0wNV;<>U9jV#pao z*}+6)5}}dQwQ`Ael2!gSJ#DuQ-l^eHbaq<0)Mxjq!A?eme1uH>Ye=2gKJ6h$8PPg1 zT(=nqzRCXb#_gJ?N8Jntgl(Bx4h36YRA8GvA^n`tINn|P{~j*>=ka0c0lG245)W%? za1gl(55K%R@)iw@Avq3fh{$-1BqcuhTn$94W&57Hi~>6o^BXSOrH&KLr-A}~D(bSZ zUv)MkCTk;ufc!azb7p!qeY!a*8brGJV|~&L zVhxc;nmAB4S)DBE=e54b`92Et-2Q!Wt#QsSwod>P(W;@NZEkD(Mx5A34gd?nA{@*2 zIy6|8^zhy58HtV5;jn+zt9>~XL~@w?hNIM&@a;yqLMD}*03?D5bfSckFH^y2({abL zbBPsxhJiTfX>aV#6B|sb(Zt%FWpYUD1SV((ZYfCCp??+o zto3(Kh@*}~Fv=QACIY`5GB8{3=VQ9+Z3IW3>Pmr8q$It@d08FGtRaol0LawYE5%|yMlax_`g1U%!rNEL6EZY0=M_&yxU#2pG}cI&d8q&pHWVF zc&j*y$PSxv2Ov0>ov8lH=8Lu7Mf23cOiXRxUcfpWcRl&VT6qGIo<#7AA)oFJ+2fMm zAjBg)&m`kH*3FWTaNh=G3H3(%a|`drCd{fBHG%2K%2s>KfofTZI?hVcJ*sc}hS(%? z?3%WlnXv6M^jsI_q|ifxGS6@cGTt4ohTpa67ohkWh3F3ZXEnkOmE_$uR%M`rN* zya{DcL0Rv{9!5@fxF`+%e$1H#4^l@8;aD`GCd2FoCII(T500FmKB>vndGMi#nUclO zEU>q$EGr)PcXxNEfPJiyCN42CG4Q=+w7l1gALYvQFWHvFmx2bjzJQ7M)-^XCiE3^H z-aMQZuap0u!{)#K*4m`W$!QmB4PD;if85CB`8|bdIg#4F6Zb(ki9Q^AKe_cBOzMYV zoMq0zq9l|4S^we($ISQ0$5+e0A_BT*Cc#UIR1NK3UzB7IYUuNAJqn#-N1@&o^Pm>z z;1pGb!H#+Q-0uVY8)hZvZ0>OybB%g4l`aV6CT6+GUYIL@HwpX&exxE?N@zVE93Qz+AnG{W;(qDowMgk&>jo1m>vIAnE&H9e9Vs?KVM2|7m8)160Cy31?GZ@ zCnhR-o|PtMA_n+n{MJ-cUJy$ZFdONfr>~E>g{%GEzL`2Qo2!Sf{Id;jH#m`{$P}2* zN(^TY&+_X$emy7Wh=ptD{b&fig05dW@x_oVOyji&8St{oz1&NuJ{ai1&`oO+<1<5k z!wXFyj41M5=1m!UwI);6ST024nfvQ)tYXV?OC9nHd*p%Bqf;GF0B=mnx_Bh`GU@d7 z)U(zntt@%ipEGkHWp`77PzGUG392p?9mV{GPG>58U-?#*yU{?NNrib!Ci3G>;KkqU zF7p1c)}Y^-4ShkL8gXQGlN#eH4Coj=qOI!u%a1oBsxY(?Hm|SQlthqb-=C4WnV@Ty zW0^}Ixeq3nzHZh#%=9El)K}l+_#2Of=vtM0T%Cq47bOa_Rh*Fzu){jh7X1c+q7Iv1 z9u|F*v6lMnCqw&!6cv8896f}`v^bG$1mnSjMM~1wJ(sI>aN%`*CLH*ZJFJ>?@zqSV z+n1BIR|1Jd%|L-YYgK4hzOdy;>Ao|sXsJA7%SaEXirHR?0fya#f|{lRM8|PPhQg)C^hI@v#2)dv}4@%g0gbEO*{chg|q>rR(9_ z$vuSq$U)I|rfI7>k$(SlPWJl!IB%_v8VU5P3rZ%ZX=j(2qJ)weP`HGr5(iTsNL6Y$ zk=IE{IeH!fORT3e@}8!WO;csvk@@72+w`@Seuz-OxDp`{N9bq%j?V3w&ubwh(j9CG zo&YD!$2cp?H!u9~eAySdPQMRJW23K-nQiFBu7oI7rL?<p|pioV2@Gl$c)w zVoC=dxyZX+5~1;*J~LONXpnk!h+{~ zDzOe2GuiCf&naCnv&sME*r0o*hyRrH8Eo^WR=I%Ceo__|nss!oK7kM@^rJXe`A3xe z(AXc7GC)=~no~Q`8Z&wNG}0LhWCm7!%=}kh;93eGuzXFb2MSm@dq6{pS@UJ10eL@5 zNnq(87=2~=%mgX}K&!0xpFTzaxo+XnPOfeU5_R~;_oY0@P;ebYyc=Zs|05~029KLdrX1&uT(p*rajSrnc?*XaYpvp?_cXB%}>H>=^XhYuh28b`+*CSvppt6~GTvXes(F2L?c0Y8nO2(^J$9l=#$ zfk(ZGvTLU*c{T-K8%x?!4$5yH>-(KeupRB-WKEA6MT2je|FyH~bcpeH)=#t>Z{Fz* zv=O~>`Bdmb46ztdmb~r0ro?n3)d@+= ziIEQxD(9g&BSV|gIZCG7o+Q!taX6LBgx^f@@V+?R?+mBn0=r4aX~2q0Al!Ni#(Hr3 z^@Oej;jC);PCpaiR%G@|N9HaCAw@MAf)k9%))qj6Ko)v@S982*qPifH8jA+U7|bL= zf%n!y1(X7&vKnqxT6;G6@w=lf`(hCv$R*MA9jcrlPb8|a=>Z%MA>3%8E0w2l#8%BP z=Kjtwu&HrVyELj*CEWQs&PEjhz`A>pM<{oCBIz=OuY*g{2vUf3qIvV4CZIk_gL^I> zC910j_ZLDJk9q7q_>H&kS5?M4OiF-Vb|QKXMP>#7cwXCOW3v8W8_H{Xu|OA4ay@R$ znxCrZU8=s9>_ z9v)J3XQJwITlrOx{cf^V2OgcYRD}kaz~W~2_oX0k&voWgOdwPqOTEIFwMtDTIv#og=r-MhaLg*-S)KpFDc{w0wKrRWjT|lle}#$LEGnwe)P!Q%O() zc@02t)49J9n4;6&vM9RpZ7_YS&AI3Dvf3H>NUI)Em z0RDue<$HtUJka4l=i#*)HKL9MNIf8Dl{S(Zi=jSKIN@emwpkJwFn1QZ4QdT9l=Uzt zYKl7E<9iFfaZL9L)Il+v2V9Ky5^^LgQ7QM^+`_UP(Xn1Zs&df}o)Nia#^7(`2%=!t zI+X%2YOuDF&+6Z$91F>8vDI@;HAHNK{v?7k;3VMO7<2QvX-{eM3~+03;cf9dz>FxP zOZUJyF<9}|c^2vC1vOk<2=X_+At385%39|wKI?D0)#7g=hQiJ!|NBktdk0kAHs@;* zS~Yu^XvUHhl-pF4=kNu^!`Hwi1H=KH@wXi8?0#LUR)C@}J^ZHgb8mm&w3y#&18IrI zb08sFo5nR*aR59OQ+)(>Ov>O!6r6`)jM|mXZrpJJF(rHqdd=GYN{B3sd@20&dqNM4 zBo1sgA!4r?#~{n0WwS4&-I&$$*I~kRAgwZ2xR-sx9U6K6AP!6F9X-C}PbpE4z4S#u zakX8oa#=lp|DMJNs);+iJ_0)9jgTq8^Z$!CWB@(4#sKrZ#)FlffVdUGKAj2k%ksE7 zJ^bmX9&X}~B@2tNhkI@iKZWq?GRoUUNj9Pl7XRe{QbC1J$7QLY?q0e9b~Nm93c)-* z;l>1KSgd@%Q_SX|C$I~s!V+M4O!=f!;A(zy;*7rxw65|(Bj*|qQJVC74Zz@gJPAa? z!Q5@}YBx)8)ak(I01DJyD^BtAxkpWdc01HKjTaMqOw%&)GTepm4xzDqE1R=rjO|%} z@y3@hC|;REC5v>IA+Ykv zhPNJGPWDaDlt>96wJXg@#}Ivrz{0MrS4q_5{Fg1@0o=4eV>r8o8c3Yvo%?I08QsSZ zD%uQS1>OR;NccKsDTxdpKHN_BwiBUB4>0Ejl|Z)I{B!;vuk%(pM{>^&xR*M;9?h{&Z6`a1KmpkNzp!rlHc%~`d&Bp zlpt96jnh3;Nhl&FfWD3Kko`McloHUZHRs-1^WgqsrRWQHNf&nf}Q(77XfG?}%YJcAdZ$9{HB~}d+u{32rLzIo!9X>B z#5ZxUui)#GNFV}9jHXuS7(&pab7u#cfl(Jvu%1ETV+L;kOQe(I)*u+qVHVAEU#wbC z!(v7$6T5m)73cT^DB%e>rp8Zl*yJ@=1bwK^3YOrShf$lVynEnfUr;8ONC=t7`lSlX z_Z$#_nZw-~IZ#bsf8*`Xh3Sfa7Eq*X4~lz)5bSbzc6%@0p+ejK4f)=-v^tv-ad3^8 z_b6z{1-L)A+urId5fkRDrb zm<4eJf)fNgRpAtM z>%>ep^=+!~FL_K+0_0wV&oMo4p$8_ifUX>#;`4XAAEnUz4U&4U0XBQ?(^~1{}WlS5vQs*(a^ibfz9omxU z`zQ>&3em=akr51m!i4_NVP8Mt8m*U6q6h(Tj~!#%TCn#S4l}+^(__O6KAN~~TmhLse=|<-H{5&dBk19feqwkz&iOHSGKrMQVmJQ7 z2go|^@?&-X)PWh!>ezg!+G)5btL%GumW=fE+33=Jzu2GH`B+K>I9JAX-gobu3k!tk z#AKMceob@wju;6!#G7%?BH+s+ta`*WAC^80ub#S zx5kAwTuKjQ3RudY$W>P%R%(d;dJ@DF)?ID9c|nkKMaOi^a1_uly4Wf~A*E_^g_{!! znLCm>d%qkw&ma>XKf|7M!Tm;`gP@=G$ZkSqWCqKiE0A-i)h2eoJe>xeWmi)*9)g?$ z+Fy?Ain8F~F^N#UItf3wOhpLGbpycgwzR9K>lwJRq2R$-OJ>+dkKzL9(HLe!bp_uu zSjxG6Y3f*lLOZAEHyKXgtqeCpGF}tAIbBswzHVgfC&BV`Jz;NC+;i)P08FZ}E>B%iGLP3+RL0XYat? zN;>8eKPASsaL^%Bzthv(+llxWe^pp6bzmY9n_D2Yww5uiOK`y~%HpjLsG31>Yf-c(zf2_z9YI~{mM|+tHI5BUz zJy(vz@>5^UZr#@7e^ZJdLj zZ2Q;Ont2jL!UpqU1xjdfv^*s7K+io>0Xg{1vZn2SShy*>@i*{m%(N%V{ zG7^2G$S6Bp=}mHfddcmS*2m5iF`|a5xZbwLe`19|1I5F?(eVyWY(tCFG&u|EvS=E? zcnICCD=B&Q3WFF@H9aUs%twq16hvsQXlc~^k)-4(#rLMbNdJPdCw$k@gxw>#zlT!k z(EK80;J3N%l2XvaJpb}Ox2PKjh1{&s?_veUksq9|$1eNEAgfuOOW4yj8|_rucNz^4 z9rwY7W-Pd#X|)KLMO?|cxLi3lSJ7`NPe}yB2lUWF)Jjs)60`m;{B`r4xZ4R_bgqAX zn_g+0H>=Y)vVfZECd3x!k6r0gel)H#15UycD(|U+2-e=#V97?%McnjtvGv;n?KS!1Hz7`ae9aESz1*)Ut z;MR7{+0Dw#j}nN!QY)zGGK?%-??ji$>1)5{%t!D%on`N0)%o);GwDIzdA`=narm5Q zQ&I>HHm9Eh=;-*OJb7s8I$0eoAWdQtzo{tCby+{eFCZ}CfPa=j6Y3uMp%zRR8qKa& zW9h&@uI1eyJFF&<@B)^Qmex;jWr)>OwqLlhBt+2APjxUj`V0DE$MWX2qo||Wr6kqP z^$JEG(U}cZmfIG&p=7Gnj;9|H!21@~!bgrqabU|ey!nRTNiit!TJ=@+;gMpmrfOK^ z@6Vy0NWjc*RgSBws(Psoq|nFP%pR(tHA_Dqn)1(!=AoR_d2j?n5vvpd6n=5NxNZZ# z{5Dy(d=W8*A zubJ2tm+HXx6&=Ln(W3oJ&i=DgQxPrhCiuHqGnwrAq<|dkM0w%`mLm80<J0jS4ji5%`es>}EERUYtyS4xr?_>vBtftJ3A_RId8te{R)(KzK^+# zON{Rs4$nNI4Cu3{i%m=grl_#3?im|NH9ZZq4)rWdB5qb42z5b~27Q)l!uw1l5aqW$ zzX(bQ;=@v)&}$AotrM~eqyDJC;V~ALA7B^&U+S4(m+bxc>eBlM)wBr&pZwzV6PElB zkrV1#AkNao8pl9D{P(;?YAKuudpBw6;KPG6Y;1z!2RibvByzc1ZmHYPiPvB>l~ox0 z3BrUXLtQ89l^Hxy)~g-C9(qK+l(m;DooMBspK1oGS~M{Vkz}cfU967?f`vd`nQ*`t z;Xux`7<|YjY~tqTpKbbT_hTF-3H%Rd;^bU6_X35_{dBxpWUMVw?IgGA((9jdP)C!) zK9lK6@E14R{Oi#m~0aMQil} z;yP^efk*~R3`PVvGt(kwc{W@S+=v?ChsU2px3VM?e4yigYCL3r|IeptYpyAK9EDHk z437E%RJEwoGLv9PAd76?WKG-Mz zR9yFo*Ufk)p;SWYfVlraw% ztp@?cVT7#T>*{1wGX>eHFn~0@zQ){n9OCMuxAVnb)A<@}D?tB_tG2=!f3+`V^U-+G zjdJFbr62*${wRH-t{>0AZ}W*moyB&mPBhr)NDGFLqfHFR=Nc=k8^fAhlx2~Lse$-B z2}{-Zcqs;{4g%Jm>}ekM{clFwQrA<2hNpC-Ue0|CE5#a}dxgat3QM_v^3+C{p`rqq z*lv|Hx&wANm0jxtJ-{FPSr@y3*5gGr>ERKgvJc?FXsi~6D4&pOMt79=SJLKGxT+pf z%Je0(5F-bzqvMzbL6AwYwZTu|ROLTpU|QinA;>c{g@?n+fDWz=vbooZ$o#kl~k& z&(V(>V=wtH)9z9owbYV>8N4i!UGFjol!av4U>6V#Um>%h!h;P|0ebOci?PaN$?y60 zwm3q!txIdz9o0)+>Q+#8!xR+r)&F*^y}2kFbP@5i$}n8kl45ORBngU8WC4I(X=31b=(BSt%b7 zi86bD$ffqVt>$q%apRH$<;vr)TQadN&wP9)hw!HWNIeUTp&y=tiY}|$wYDqo+_k+i zV}AnMwpF<;7=TS5KVGkuhS!jNJi0#6$FFNf&mJ7?fa>~@!(%XJ9cq^65(ni{-|4ND zt$DAomyglLwWo3m$-N$}h1F|3x2hCzHLer=mOw;9L@A({Se;cmm!p}_^7XNp{nQ$p z87n0*j7BLD$Mf=NY_bfPRwl7(GaX-mrBu_zdv!K?Fwt#obgTiUCNxJt!nrw_kx%@d zxS^cq3Fy#tCo4idYn=l=z$m4FQJ5TPoH}onl#KD&g4%XgUGvRXKf)~ zzXF&4;o7^DfZZ7x5q>b?kXW9o7}Yz7y}JTNsB)*P3$G;V-AR5{*1~6c0DA+>c(Ss+ zC&!|~5&_cdv*qSk0lyp|#l#qCd$YhHBZG&_B+fAFhZV|6|A;3To06!VE`m|U8sYsp zk)ZMgJyDD~n~h9qFxKpj{dBd3;JvTd8r!Xp3&TbsU96SgGgB6iZclVlNW9aK93it$ z3CavE4XRFnv#{}Tqa5d(Lu5?=ofPsQ0gL`C`1PkQkBN|&+%ZGT>nx()r0K>ad2I6YwHB|6;!`6dvzT+1 zlE%AMB4m|Sjh}BgTK|-peD`Q>dmDhKp6D^)V58uW6sAii&>Q)ib$tyRP#xd)aUFl( z$)|OAfK!{_*vPH(Y65*QL^L6JfgQWAR;B3YvsEj;$4YLAB{zG+4}ENhc03BbbR$;fotV72^wQwtXQ!%}F4cfQ!;2)hAm8W^eUKJ8K0cnFtN?u8)pn?m zS$b(=`31qSX4OI(p9*f&oIv~s!$54#bDnrOeFd}2HJs-EJTWb5fR6#e7GrQE9=w}G zqRP8AWsGRYj?{gcE}+R)k#%03@C(ctv!-6l?|=76?T)+uj3ipYy7S!r6s*p_CWWqC zn;5m~I21a9Prx19weZ0cBP18?xJ>0L=9WgyN$Vd~K6w>~6|4xH1pM)KRTz5{i#T@~ zi{RN*qHN$E*%ogI?DiWNZz5t81tB}6#CPYE0KAvLd+?G)-2c%|#3V3k zDMpXrF7{@gij50OHf(I{!)8`_`){2~ZR69^ci&dnR2X7mPM2+z*bRwKY=KwvwOuPA zNBB4;UIB(eLT$Z&FD!gAi83T!Yu8j)QMCL6hCcV1HA#(rDD$S85VtIkEN6SB6)>!d zWhyXa|%TL=Ae z<%ckXXVF9uL$)o;;IY^@2GG0ZV1+0A5`P`n-JgTDxE`cbr(+{O*((9VJ~!ADKMJef ziOp-=!+c&Cb?)?ax)Kf=R^b#caOW(DiP`w35Cc}3_n75Plq~0rcsiqXYWYAvAp+#{ zrchZ}rq!zapHY(&oz>-!|HU!2j|F=nRr+$w-p;Ioi&9fD?OxFl!Fj{@Dsjc;?kv~qodKtJBiF6RRciQ5cD6G6@bwFbdAl_G?!n=W;ab3M5-r^TdMK3zbW znOau_`y}+J7c5&juUqU=`axJ2Nc&uFjUk;ZQ6#pilGc(5HaK)Arx(Ay>%OKkeDy8t$(qM?S}gNr}KRPh_{tI$mZpSb%LxHsoWWY2W7Y6{Uu8(kmm>tN?@*B~M! zlL}oX2fB4)t9{2qLql)Dkb#{JC}&GeUSMfZ>a}vu9D$2E7--6{nfIIC+3@~Y>MYf9 zf){&g<*Gf3M(duTE_^&1{i^XL!op8~DPqJP20n8NneV(@t8iNEN&vO?`ta9gFyDp) zBXX3Lz98FlLoPc|q=$SuCaM5avtL%T=0j94QELjzs~W{~;TB{GFm9$ux^jE5vL(+hgGnU zGGb?#$J6mH-`*i!-VQu7K4(cHvP_;brr2@(vAS}ZSVs4GJ^JbRF$kZGx$5$=r4Iuq z%|G3|FKH5p!d^R8gkJ94<$WCh)8PFK{hqWh&<@H4B(z}krz|B#46Pa?n9s3aM@~&l zbU_JJG;Y4Mn>W(tGxC!0()w8)mzC9~|lnqZhP zz9xp%+p5NH)<=496V1(?<6yf{ea`p#lo=b1w-|_C&sG3|28>S66{=s%anLC71OqZk z-&kD|VW8TcyI(3(S~1$-GHK*0nGH5D4%FS5*;=pRowQ*>1(za8sm@Cow9tIR)&rWg z$7YkH-rn$h1D!6_NjdIp77+%h_|g)xSa$P7mCKPr1_UUQ`-y-im?Bi)fXrY45jI8k zH2POT1_8~o#2Pf4lYXF9bN@8laF;EaRZg!QF*=zaxL-B-s|I=bT7iwlEcE^N4A8xUc zP23YWS6yg=TG`A-3ei1^kSTIjBGav(Pkq4AGPhVzMmrSf+cC z$W+mWYI*pmw8q8N7|QnK(;3vfPIb)c6pr1&v1=?odIb z&X7MqWlkf3=HK-`mEgpBsgz0|vsyw@GWJM_Ix8Ig%K%~ItIq!;_@$h<;j3(NBdMw2 zf!^EUh!+>@t?+{It)~g^%m#K%es4KWkm|!H3k660mzFQ@`4nLaRoWA${GddGC*~D> z%BV@L=b#?ZM#qLzkR#u{`}7=idq^SbXuvkApAN-DRs}{?14%U}2n?Ma^53nfko!Od zb}SsfjAE9uWc}XR)IYZFR`?5oXGXa16o@C<14=VZe;67kaJymj*8ujrCgwc2kUuhPM4Iior z7W)8iW{zU4LG*p-6t=$7&(@BLtxPNo+q6mty90ttLtPAh*$7;LIgb}Uv?7zBd9VxK zqhb}&gYD-mxW#L+w>4uTE0;vQl~XJ4ta5l}u~?6PIudey?J=M9kGShZmi(qF-CpG} zmN6481u{C|&(&qUf5fTyC^s7?TO9%l|-bC{=1X_)RitX|}hrlAs1xfs1yQ0StgTG3IO?ZP?g77Fkjh08%?rcqn)&N^YkI zyo&sP*@NtjCa#mVEa?ke-QR)7p{#*@Z=*iWz8`h$4;PoJnOfM;PN4#kCcS8LD+y;lF2&m(4Ey@Xv|I%?rzHa} zaA%G~i?yfLVxR04_c?H{mXy!0dLW^h3ln9wv8QkQ2vC^uDpQIHM89P|Eq24SGCB+# z!7t?+I({4kP!jxi1DAp@#MJUpO^wA!7hr;@iHcWX`OTI($z`svD)3c+aAnuYei&L!$_k)-*&djx6^nxG^Tv4n&-%94nHSra((ZNaT)awf!%7_u*0A8qM~ z_$VKD51%{qn)T$jy4v|CV;-&j_yD>Iiby=iWYyupRc1x_A-iC%wJ1&Lra#QId!vV_ z^1t+UQBjfz7Vp=>FW-)Q?fCdG)5nYxhI!ND|FQMu(NI8b+!@9;Vr)aQ49b?ZC_95f zWREG^AjwYF?8crwD$1TL6`Ab&3?i~6vS-b{XUqCs@A=;Ie&4D8oKBsSJ9nP@Jiq6+ zkV;%$P_g8k_PWiP>p8p&>>A!sVUOV)q5*Bp@HJXsG7PNfRCGXhZ!d}fwzTdZ{8ffa zlR2h8jDU|?c>1`n9;(<}jG%+hD%Q~MYXUC+e*-F;ejo*Wd!hJlZS1q{?4DQGquVFJ zko?L=55;tuwzpm`^`|E3-94d4c))^}d*!0p)P{l253Z`)L6XMaY(sv*9ah`-?wGfk zB)A?|+jamW`Ae&{$DROlvrSfX0RSK{seMMyOnK&^VL<+fH(WU0Z2citUfi#VNRJLA zA&I86D0sW9zA<63xGE1+7X{xEPAC1!>aZ%piB5lAfR8Y|d1OqMw z1Nd2p@ajJO&nf@@>@OlwzuyE1+H-Iu3{jlrjl0F;x3)f+G8IDW=385DX=oILv|a!C zWIjFk>kM%6?IPgn>rMS|^Mk12+m|rmk-rNz33yFi*5fhI82wdYHmAMy2>rYs>sOSu zYwBK8Xx4fN-Pm4FVgC6eg%W7dO;7hXt@>b^*V@z)wjYRJ*6r?+AE9N;GW6*<4|snDK9lKM zd!|WRTAc1$TA^;$bexbxX~}K&?4=fI2x1frzD+vkn5h#71{KyWFQ^m-H4q0TZP0R(SO%D1;4;322>{anLs4q&D`XD~=F> z=Wm{DH33TFz{$41e|NEqgT~+7Wip545cARNqb)9FW0DI|&>pR&6qyNawNh24hp%Un zmB0`#8iE=~lF@F8&&7Iz@Y~6x@uKq{zE|Im-~BFc(856v;`tm0?-td&nb!M)_d$jZ z_HOQ{(zzxyu#i;xs2z@VRciY1j67ub$*Js>FgV%QsadAj-3K-vVwLcA)`W59wjw}I-Pj+U^fMsbf3m)s zx?Rlu(tQ%c_n* zaNNQMZfT!H)${U0-{f`O)_+t;s!PdbE(++9u`Vph#3pnWmm=LBUZ6cw_C4_r&sddQ z6R{|!xZW3S%-egx^;{Cs8cYv%)O$&f@*y|?U<9}3c6#EkNjgPkG5%W@FpXC;s?^RX z;DYN8 z`umb>HkDC~U%nH!M=_yEu3G8H19>*Do?{M(pY5w+6m@p^q%DWm29)L5D#-DUC7}{* zhvH^^dEUGEo34m&KP+oUt~p_XEB>DbwMTI&!6`S zLA{^BKl$_4MW>~HfyC?XQ2kQGlB>B2*)3my4lVy^aPb&x3~XeB>4V3HMp_;@2eG>o zT8L4RF(kXCoqUsx`CA;}@JYlS;PeTa`Vh%TX?U{^d`J3et>ucO78C0=-Sv=}T){fU z+kfx9BRd{kUF>_{B#y4g2ZF5h1O7wtsT9_=aBN)r%%cXtpQ6wm?}Xl~yd8S{KS!G6yF~(ljMNk@P z!sy-y%tRe!(wNx~bpTKKJ2-Uy4$hTp*IQKi+nHU#AIXn#va4D&3WRg zKq|26HGg#o(A%A0S%6J2? zCb{$ajy2rjm_WvXK2S_nQ7jemm0k;NpE8?nSgg(MAN<@&v6JC;mx?Yce5YD|OaDi8LX-~mtn;ihNvkaq0i z_mGkEP7@8|w~;Lx(>chSNNMgd#+KXOAU8f70vh`3afuYg=byorA~Hb%pLeBA&qs8| zB=fPWPW^%d<1_o;)6-nK2n&Hn$GY*O#|XeJWy3!Zm2#a{akmUy8NyLWNG*-*YNtyN zs9F-Je2P8Xf;*6Zml_yd9(K!t&L<;AzBfFTPLl7$2Ga0_<-6+nnCha&wR?Avzupw;%tw^IG0_*Fn>>@;D6*G?Igw&?7+ZdE|8o zk$WkS_>2kV{qcb)vm{B%7i~+T(V55Oe@q6~+Wad%ZWCg9gM%Y50ckq$P0}}Hapy@Z z)bp!B`uRn=(Ynro_eRD!C@_ArMOHDfF|;jJ$Z=1zBc*qNYCHruXCTMhL-nu_EeLt^9~^ZZbO^6O!`X#96Y!wxL|m#Z*{p|8juSHpP_Zg0{&5T{NRgLTi0zj<1V-5t8eBa+&zYceCa>mX?|Pg-$!`; z(?ntnq#cfeJjZS4ZdI8)21p_F%*sYKY8<2F|0K_R?-C+QpI5Fbp8&? zBD-1QqKvZRGp1m6Y1@O7WRuQQ+c*i>CknK>7zft z=WbExqf&JhLdqb|VCPiTk2g%2uK+_5MJ}mqY8IJz8trW;@e;6&H#MbfC;o<$XLd9w zY1L6|34iG>dV`Ai8BtgHPim&iD^vzkWW>vs(&G1Fh3qVQpIIUgnFvKP(Mk{9#hiq@0Kq5NEDiIJ*Y4%_kgZ{qJTKgJ}+4X zZEnu{7B4RxBC$t%xUIp~pTw;ir`fU6K>t@WCl=EFz!Idvw_Gc{sEjhL)Z2D7)0zwf zW>N9s8i48Ft+EXq&puLEq5NBgeZ*ds@Scx(v+&wUQ||=mqA0eKmA_cS{gjRr+q6bC zbHHvHP}COR3(E`7!|AtHYu@E+&s5v=WH{c1Otaj$prRhir!OjMlAIl!ow*}#9mp8+ z@M;Q;J}NH2#SJf6kC`}cGu2Hd6Cdt7BUFg2pR6Ku+3L#hwaFm+Mz52GfL>;$mR%pD zd$Mux{&X~f1lJ(y%q7udz;qF_k#W}H9qRHDlTnH>sob8_iW*^IrrPqq-~y_3>ZE)7 zy7Hfpk+sxrI*!STqQ~Ta9mb~R%G#P|a=Ojv;6i({T-FgvogS}|LMc$2aUVasDVX+J z*sPM)(b&@8^bSzJ#29Mc2GC^9yUR4sjsY@z05&o9s-~m$qRcH7uPH|)&Y& zb@eJENU>qbj$wXH^^kq$p}3u&7%8#Y)eg=U2{UTWi&PHH^i-sI*fHE28{-&~IS4{q zFw*V5u?ucek)We<3#(8}A2;BZ!B|^x3?wReeOQx0uL7X$jlZG3UE4t2d$fWhdZWGb z|3ozY_rm5jvOGDR&>y|q6l8nZguMx!E zw~zb=Q&Sb=67g%Q*mHXsuV26BN%!FZIx4&6pywA5XS*!61Zdp3`XP^n=McVt0)iQ0IhTQ74uV|O&_f;BvGpMJR_(9@y!U+W`GA~ z$QkH!@s53B=p1td6O)@BibLWCWXZL~pE+f5yoR~uXf2Vof`ho8x;XxRz+cybGhmWA zpO8;Seuuu*1a3k9;V~#R!x7vcvbjnGt|RWvq#SV zK>RBb$L>a`ioLX4Ta7RN-G7`xastRxBT_i6q$OatxU;n@ulYq)!{(yUF(4v#v5LJz z^tx{XD)d|0);*5Z_^;Pid^2~0M)H4qzJSeGh(?lxtY|X7Wl6sJfiRg*HO+8;#vex> zzW>dXo|!z)`T@jyxu~+>a&Y0fBvh3qOA4i3gz=r|pm>7n7CLH-v%eJN4C@Rgjhz6m z3VUTX=H0cOW}O?rstvR<-hOc$sf2m6!LSz+W-z*j-+qd70!Egl(JngEVw1%tIJJYXL z11W`CyN!~}FPe9xj%_JNW;;t6%oPWO|4k5w%C0!^a{d06gJ1W;? zpmVF3+)KMGg>-$T0l4YAp?t!}FEXjF?*ANTwGdqZ4(a#@K^mdHzfn(K7I+X;=d8$> zVSp-N-@()tz1vnq-}30uRUbn~`Q*pccL0;OKY<@HVe99bZd*kok|Mj(CW^ zYJQ&V+A6o4yi3;$x?SKJvpQ1jkzOU^I^7~%<2>-pORAx&>d_n|?yjld0q9`z!i_*k;*8WFk-7!2t4sK+RJCA1TNAxNk4vTgcSxkia!R4 zNopchz)T{TVjm>o*oOWvEPEo|@}6o1c3urdB=i9J=iGgA!iRYYYnd@-?rVfeRO(2A z|GRyZE%Y0?34`@1Z03XL%bW1av^n7|&#xGX(xDF*(At7oN5SLqsi(jafjauZ)rI}6 z2Jw0Ir|(Mi$OWskz$z*qC=<5{$%JMQbDChUr@0(a7T-)3yFkS%Qe{3yMDK``Z@R3! zgatr&%#8GZ>&pKcJ60;lF)#yW{xxsh5is!J^%wR+=u!41;5p>u1-R#$(By_pOJu=H z4fUAVFso@*@hS^XPSX7#Co_)+zPAPv$sn=^ZXc9m@)?xUl>V!vEC%g8lW$qSQJz_6h-uFt=1{er2Sy0g6@Pcc=?pM zb!W(p-drIOru}i^>NX6GuFon2d`Chs@!N@^p_KmM@7+^gOAcw0t~t@i(|JUs?x|>o%{@e|JIqbTgGEX|#7B08P>iWXN=V~dgADiolh&c$eK^IxwS44lK7I&Wt zm90vW=?BYP9x1GQ#CTfzJ?H&0IPgCvIUG&6sd8S@)hR1r*vdz7I0YQ|N@?^m!BX1u zBVY*%+nKlQq);+bed7lf6Dv1v+{ia04W=W_MYQ;iz9QUG^|2%>W^!xjC%U-9vtk0$ zE9C82#gkDw|L|^?;C;++ylVh{{h8UWa@q3%yI9x0p+AnSP$_eo(* zsMFcLJQso(&1Y3|t!L6FvWBCr1iq9Wh%uHFzw-D#ka|h`G1xYmtXKGkk;WAUweK=h zag8hdNW8z%deM2CnetO1vXfYIdp+Yh(?T)elBR5Pumr5Im(;J1$^8iwX~)nBhnQTk zFdPp}lr-zxogC|*Bq+P}Lqtq>JE5MP`mlqV|8Rf4QMsZUj#kP@E8{rPbZX$Pn#Xd#ZB`pz}L4n+J~)> zRcZO$n3#u)s(-vNX~W-hXLD54=%eBlfEWEHdBWpYN_l=z+<4nKQ_#srGO0}p#Ae&> zXoh~27ES6_=U-4Ow~2ko+Vj~&kuo4z$s5p&D{E>-Zd#%S3WTcVFEb`5mpL1l)^V|53rC2p!% zQqw1MlV7^SU7w=FkrTX2HcojkURIDaW!k$a zKE1m-3M^pmF9+EV77u^L?LH=#%aJRl>W=D%RLHU9?0a%VLC*?bPqU8V5lJBw?7EvI z^lovGyi{jnHQiRO^JSCu6b`WkQj=$g?O!F(6FQ{9Kw&(Be{iS&*5-+|s1+Z`;4Xxk zvSI4~#em`drfNrYa77&oG`jZNV<7#_X_+eYp578L=^_)hwUkTh1h>$3WFI7{6%7s! zj;@2P{1;U(9x;yd(%SAc?>xu17owR&sNLQAD9_ddz}NS_cM4T+`x_FaRJm^oJe#8r z_TLq~9_7-6MhVXz7`PyR?jV&3o$pA6a9QaR0udV!su;325j)kFAhc91B4=tSJ6Wpk zMvrAf4PoScuCsb&rVrsp)$)=Or?FiEENDCxHLXZ6cW6HrK#+5u5^h8s=`$Wk^nIdr zbFzrzTV+sxU9v9m`isSk(QO-%F^|EEV|mScfPc_RRLvSr6+_Yx=c)Oo`ybAq^Vc%U zOeKu2SY+zW-VvusBBF1y!g^c3;)#2+cV8;Bs7UD0ANaFtHMvagEm~SiC-r|zma3?z z2=8{_|C6k|;mc8gt9>C?Kt8#6ofN3_W7RT#RaIXwkV}qUNm!Q51x$nrxco4I%U)bo9uZDfS_ENc_SRu=`4g)?c znf|~HbhxKnJJg+yhuF)4YAwWyc%Jkt*nP`Pb4tp;)3!LD!vK*GbcuKn@dZq9$7^|z z5FchL(oU#{OR@%aEio$i9o$wJfjGt>4? z=!#K#)t%cPrMEDi3et~ncc{LmjvWc;EP%2WyVNQtUg{+5oDQ)wUgisMKvM=MmCoQfQm(MLH!mN$Iw)>M`$M3<*ms!P%!rOpT3jA1B zO%a3q*XsUF)GBaAu$6w#%i!+8*7iYDalkP@JJ{$>rS|3ZRlmNaZ_kc_td@uWSEG%d zk8FJVlHdklz@{k%U1v*LUPWJ8vEoA(O#+B71-6pGOqrtC^WdOL$`)F_nz(HaKG(|^ z(5hPsgGTlBFnuCM;-}ghsu9|)kng3-^4aHRqBb`VPrC1*NF3S%&Q=Or@fX(Xj)GjV z1k`q-&ZGzX?UA(^W*%bm`(wmxFRB3)!Q^q-j+f@gpC`CrSSU^Sl{2|qegzbk2RZGn zZ!;K@prSP4Z2&;$Sy4>m4>*RBT4uCfSs^Rn5hLSDwKi?0JTEs0=@ zd%!qOUTeSd>rh)3p1S?u%&lYh*X;3-7K_*S)^AOK4Xi^QT)sSiN83vom09Mc!CwWq zWY^*1j;C3-i39Y?vUB%1NN8h@&m}1bi1QM&$<6GeW~FH)xk-0ey@%1$X)fr=y2#5D z5!AWd!#qVl%ctJ8`o?@1RE3eGmuxJSYzwK4=Kv~3>$aQs{06}OKed9MDb^7GD2 z$_{wllqzFefaU#auvpNtcA8``W|U`AL|FKKjU13&u5pzk?c0IvR|v(g593*w_5&v_ z=7phLCT}dbt)DeG8JwMg;R?_;BpjJPyDoqGN{PfA(YE*Cth$KeY3000V}SpQ;>?{> zVvo~%oWx1Z0fL1Y*wvVpz0G!UZxb(0Js9}6Ejv4(ea0AFKu#HW>wBM=R$YaF;1#Cc zZ@M*E#iPgXbS7$vb3roG-c~>MG^su?YG7Hq=ZH|==ypk0Ho{0Z?*fdJ7S8yZwd3vu z5~5^{9dUl*clTIne3HNBlK$Z>4sJr3476vFR#OR_7|r)BL=hW77jC@~h2bk&BqLXEK9yyl;n$lUt{q<d(b|9jv5LH?kadR8YXUtvj3l08x464Zqdb zOEU&pdIx9g@t>L;t^iu~&H0qOV`0#wd?n^SEcP=iOwX5!oN6KM?D4ejeZtKK!L(0x zq}n<=$IBxBVGYpSj=RU>raHzr?;YPhM=|MX7CRAcMG%O)7UgGee+9Dq9Y{aW4v&30 zM^p{)v)l6FR6vrQ=F(w~!Q-+n5r|IVJv?kppwi!GlVfbMoK&!!8{W*U@^P)iibplh zUWH#!@d^FJF)v~*mv{PQ|I~t?_M!fq+x^f_+YE;{ETLLkyGKv6jdL=YcNL5@*t0g*6zv~!)-Vs!ClcOqJ)Z+wv>LwUONR&I*}2T2jRxS&Jp&g&8maRQA5MHM&3cJp{G|5 zKbw7<{!!zE(Uwiz$Ak1glTEQ*iTHu@_H9S|p&CStA8Ecrmg{}E*kxH^5C-N9YJ$rk zHtJRvQnWxMTh4%-QkG3A7bUv%_3Qb&T<0NQff_T4ddd({)HxEI7dCG^pw-qlYOTUT zk}Ohc52vfLe7J2uUd1RY`1bD-Mb2AIFsAgm9@*?e8A{*{RAnL2s_(W^nd(EaBEju#v{RMTfuc%mq z`{uSrCu_wO;wN^Jz;Yw8X zqTKR5tduYMICEKH#|?fnoa64ePqHQjyd4et*g`%XqyBK58z4>HvLn$$QhoE*uqNWC zMK_)tEO#kc0}FPkmKxPDO1qUO?*PGoGlm?- zbyJCsNmCMm6jns*3_2qvcdAy zyw<5t5LW^LtY`V@k2{bAn5@wF1YrOr1QH6Gl(!Y)QsRe&_>p2R{7 zkgH}91GNp_`Y(_IiY6Q1;seSCaGosE3I6z^Ab(+jN0`^N)>D9EK^XnII}oQKOf$;E zh?PN1nv|qG{NLsH?@ujP*&`&#AbJ-V;;%&%1Vv4J;OrZksP%IG{J^zBJ!}J*angNt za@_)N;tMNIlT}xtNw-{-o?q;nEA!RqI= zCHX5i@|C~rc~6Bgy~;w~S<0;0#d$=+^u7cj-mg!eUW>p!df8{Kkist{9gLb2)g`Rd z-6wpoW6o)6P}q{z%s3=$DI!H9w_Jo=_8|5JF2Y$BZ(QY|O&~v9YQV8HcJgvRQ&Y6v z4n;6g!gs8MCxdRIWOxn90z)~sI2lN67=$qz?u(A16|Iv|4 zW^-%hQ%^%=kxeDGX1tb@N`7%-x4JjT-{NgxK?)|ApTl_PI@vFm@UWc^7KIPUDNPJ8 zhOj?V@C*GBX762$JSi?xeu;yAY&`KXPNL*wh4Dq3FiJ9d|9tu^W2mDkd>V9ed0Z5) zDUDvHSP`+kT^FoEl=R0vxXCGS=Cilx-8Drhx<<(+uE$x$)hZn^>NtrmNpbq`ZTMdy zZkbB3YY;}H@IvJdxlUf`^&9*Bu&S6-!IQYPKof6ew?1)w=S)Adnqzxk?3*l-4V$k~ z;>ML%S6WJcXehBO>n%<4o_Kzc*~4u}J861VQVWU?Jz$y7h$2mKiGLrcSqC=cN)Rt0 zzUtyB!;%DQLdPX`4&1>|W(#R*d5VX#3V!}k#6VxyLm3nA-r-ABu=(c(I5>jpW5dCc z%VOW#7nFo?%5W1c#{`FY%d51MB0#e208|N12nzJEvO$90ZK|J9i(|wZ#Ydcr zm;ZMl|NY4w9`X6!PyHU_mGV|hwDahLb>2+Bt1<{pO;O&@{+bA0v!l*yJ!n^52jKos z@IxB<0XiOnJ8(YTYvsU&5RpusU1dcC30VZ(Lj*mq;T-`Ip3iQgdPq^*3^YjW&aC8y zLViu5@hpSb$hXbWA`Ozi+{q)}s(6#%)5JAealS`!w9Wl~_;dJ|Cc1|2y}$wT$$Q0- zj3zVAZVe}BY7~%dO(~Kxdc~G3D4C%UXSq-xEOdE9LK262%)8ERGc`{Zp^iwCY zG2fRaVb6Xcrh`at{|uExqzpkkG*%<45Xe4eJypj=nvMYJP(z#bF>7aM?e2eQ#>v&f z6jxYmp0q%%70%ax_O>_qF-FmJ_oOgC<5QK0tFdLZL)$9@a>;(;&56i}Ggg1H1;G!r zD!1EK&qY4r7REE4f-Q`GMrT|Vp0~!>)W_?XwI`fqFGK2r%Q%>!ON|M$O^`QEuQ5a@ zqC&VCC?<57sgpe_r;?TI9Ik?VZhP39-+~qP?!N%U#8VSx{QTWU?hjOteL_pZ_)I6| zilU85Od9-#DI*=zU`xcZapg*UBA?!dtmbph5c9)j=R*hP&t!(N#zYwYMDu=N@w6f- zaxD$^csN@)+p7Pw0iPhp$wowxoKAlK)z(iZoskqg{X*_dBZWND4_6DU>PQ&GbhUdn zX@gUjZNdb#0Jc&ZoccXQ?pz zVG(YM0)^6yD)*yT!O`^B+t zf6&KRIr4&QI9t51B$FoZ?_=mJtr%d|&zp7{>+BcO^Ik2iq`chvS3mW2dZS5nkYl*9 z&7@(;oRXp{&v{6?%u*=`W-Lwm3mYZJbxOvyc&K{ui|T@}#p8sUpS#=w8x)gs=*eQJ z--EvWjone_%1Pf?=sK<#H^o{RD^4CJPTrCj#XmnIH5X$QtnDe1K~1DfP&s08C8Gbu z&8DO?^HVB(+;V+*IJ13Uo^v9O-X{K#q-D;&)1RC^NaX=y=;OwTC&x_Y5!yVSe|p|^ z4179O?x$?0W*Gj@3TFx$<2HqD@s|7-dS5)D+3_~fWxH!n1!Trka@w+p`SYHZ7Z5d zhDP<)PTr(NTe}lAt)Jnb zy;7NB&%X-tvK;&V0QJ0a%*D3Db8SG%Sq{Q-&FD#5JT(IX!RJMmwoA+8F1%}a0+?kE zY`FEBiXNa|F-c3&(o9DmmiEZo_ke4kyF#RYW3y2(^87;&zI0?WyQTD)OW+(j;o?;Z z{3|6+(o;fk2vp~|rlpIOr)Cqnu$ zpG`;b?~o|if2-{OHdnGNnN@69>^C-;py46NM7VdGgo%Dg-mI`O%%7(jx9X5)oua@o2>@C>?^{!*PCq z$*%1{oP6vzpwbkb6llqBCB~Q4V03k5`gLTI{BM;vJ>m3|^jJzR(q|zt5OGKQPN5yZ zqwSbkZ)NSqxay;hv+p2x5klUIsmf~2h*%!{$b?8Eu^azDJ#`;{eH!95>1+w% z`KCH{ky9ltZJbgTihVwn0|{{_kECqEWeK)Sr7v=}eZpgwc6TmN@1{fTV*E^FJuC}{^JvT0uQj5W4z7^UfyUO!QVmpeqw1La%kQSI_qxVl zpFFdq5VPs&DHwHJiQ2o~gvU3Mjm-T$zDTj^=u~ClR$~Y>vYT>X6`j*DI*0UWiOzO`(HZlW&h6g#Ki?!5ed8i6VDK?Cd1{5;*OpS zpGVhH3Zo_DMUeg8?rw+D(m!m(*{TTiZkG+03*isfj#`qEtWdD68G~~z?#rLHlK03d zdHRrb;B{VQVTB322UAY5T8JXmF*qE)9Bib14^Qcg;p8DN390-aHeFOSlj_(77ojti z4J{*;#7{YsI&W75v9>+W;@;*TPj>o!E1O6PJ1TZgeDW^MA8#YA62!;u3+Erp`g*9n z3n?%#s1T_$5?1+)ApUj6S~=vNP&Vz^Qub~RJ!q0vLCfaeJ6&bbj&Ml{3rP>D!hh!+ zk}5A9mabpP_JoW|x=xeCL0^cx`O!8;Q($z(MIoZ)DK#Pv`i)}v)}|5*2?;5mMb1xm zGsOB>#VKIb^4Wz)~*5w&>wrmWG zexGh;T7k_7-`mJkA@cfxxc&Ft#{jh14 zHFRin)Yzk~!>vc|hNFW+ndByb+D1HcQTX~yi9-02CH+=Z>L9a^CtnHl3pIQ>Wir$1 zH~YSb>HW~R2RHnl`6K8x>kk9m1j$`dsW8ghskIQnarcUNrGhG>fQ6n|GM*liV(6Lt zKbHQyRUA~DVcCT=iQo zRr{u|uWvIri^u6?@g6=_C$l7$j`rDV^(1&=1_dP*D=y&_v4Y&T+&+ z)hS#$xNdt9zF+s0rtq6`qK;m+zS$wpkVxRy;VXT7S$v`Vw1sz-_al}nHxcqm2t8we z>l*^s$58(3O660w@RfibxjmDpmxQl{8o4MwjR%9+Nf3fjfw3j%nIrgVdDbNh4Dv>@ zHOsO3sCsr+)Usc$3SJ8ob^_QnRSUW}nkLO#S*ou-EdIO4=VX8VT%-jfM17HeiIxHW zdgr&Al{0S4CCdg<&6bikCp;MkRUUB`n~}$}=K>FT(d-Ox10=gi_9O2#{+W9%be$E8 zjr1_Dav}U^!OLC7vc;pHEShX`!-CpI^Ie4TMqm+^P52PV^4x&@9$IJ4mL@#x@ce8U zW(L&l(!*>`3jnr)h438%0?TFcc|bd*QFp-+4#46mu^IEr2^zu?efZIi*Yrug=|GLM z>}Cu76%$z1?qYuC&;1r&`OVGs!-n<4{r_-2&V-LGl^0lj;k|z&YzN;nPs&*e0$0xf zHhWO@R-WG*tLX3DX16CH1^ziR`r2}g*XpENcatkilN1j98mkd5X0aUFYwq!f$L`BN zgk<&rz0|dx76Jb0FXWDzG@X1aU9)mD;; z^%14uBe^RiXu`dD@8V_vdQB16wyCBS&>l(--45@f>(Q_{^h%ujL;~? z8BP}=qIdeqluc7MOkGkzwBAXOF;VevS0OPolg07W1}Ov{bj$)1+$vB>Cj6O3qZ$}4 z-sx+*dY#+j@QV|)oc5tG(N9JDZek0v#JKb72AD%xXcI#rfNaeKU^x)8tNkyXrXegu76jmA z@F9d%#`DAT`towd^p1xvIR=IH8MZNTM!Tl46~k|0Za=BzKgAjo4%ZudUQz20A^z&| zHy?3z)wSJ=Na(4De(a{M@1Ig^P2*pefPwA_dQUU-YvxzF*9~7mXGH1 zmk&+qj^8W}8#ZH|RmeEQP*G4^@chK1K_9YolRtX05vp1jgYEJtq^^U^7V*D{(VXmB zEulixUrE;8JEw6i_Vz2+Nl0gaV5xOQlVgzXN&{F23L17FfXa4Ea!gbSnaHRqcU>Kk z0Oe4k7+S40rG?pP%~t3`mT**tP2)B{WxPPLQVCwc!$j&5tk!-3&p=08Y7izSemR?9 z!B748DDb|dC*NxeQ_0bdCF5@38XtJTXwd$R+)8;hFX z!FWPJ2}k6*Erz;(>H73B07pHy%VIwbG3ug91fiL>|G=0e-wyBJ5ZB?rTA>=J$BjS?eDH#?^`B}K zZtV&{i5OkTEr=nS?$1@k7o7v4e>R&NvuM#jvj>{g2N5B`rtwulJ&}}neXdRw2>VBK zf%nPQV!_YT0X%zOAXIWcA@#7iFBW`{%)N^p5R43!kC>+|nk%w}i(HrFYd?<4A^B21 z6(Fk~|LO>JQ~_Ay$A(;G({oGF={57x24PdS7hL#C+`u4gW`uv;BI?vt{z>T;sd$#x~Kc1Qe zS%8f5dg0?CR)8^7X+U1-G~S_gO1f#O0zETkRniQ4-C*UqaAU&HP0{2W4ZCd0=R8+I z7hG_9ATazuT#WaqIw?Juv^S2!xS&uBgVB^c6Y_%WKif`M>%#T}M>F0keOU@g=E4Yk z^@Q06yM9c$C!~X>Lu}~i%ci{N<9U1s$#)LB@6jmn^hWaY%symUL~-n^bvdL!kT-vT zFeHStUN)qRT$r-ts!sBxp`r~Y+pWK52+I}rsqS}g_Sukw&Q>Jw%zyv^K~IIszN{M& zLahrqklO2O>Z*Hn9DkJ!PWE`jLcnwsZ>vkxM@{zcj;^yT>*>p|6f|`05O~9Z#(H`gCDlb zsUJDThi~`Zj1`=hRk0fMcz;9Wauh5^Ct|jBgUQj8scwISvjne*QB=L4_FiZ32TwV1 zoI95ur;1G>o7MK%MLuI5X{(yHcdX%d1B<^;^e00s!}F`E1nUOp7=dN2VERLst_`*;#ZhlK+}* zde|qs&g#!y${4`l&R4|9-CXf;cJAp`#+;k#HJ_QdoR9jV1&xqv%$E~w!$#I}3t)0i zOEPOY$0+ZAn1Di>Ijy^Q=iSMt7T|4$i@Diu!st)8(9%DCm=OxUj$+y#XGHj==c7t` zM1Wxj92;_=x5{2{O{p+3o3MPQluRU(}%j>r_=)ubRxx@qx_bH=ZO>xY0=;1TxV)3tg0pfNh;}WeB#BmT<1eO zD(@FgK@{`W!GZ$bfI;gbAnHma423WAef^H?`~iwWb z3xw)i(7|{Ld!sq6@JsFhL1wrQvWwGR9wT`OdGaa7`={jy8eUi&nC9P})>4(*s* z2F$Y4l?;Nu%89x2ye$RmL{^v>hUx85_YFKsRD8Of@`K71?t z5B&|gr86+IcO0^Rav>iwU3SL=9tUNosZ1%B`A#O;qbfiWN}^`p^*I$atM(jgufJ7RToCm?-3x3i6lgl;fYT3r4r(5<2o=j~{-Yjr)2={N_qDVb#yFVc6o(SZLRjW+hLS{ACJWG6^2uEdKcj1!^ADhfYovqdHY)*-^b-#B#Y=6#Kr*j2{B7g+) zHv}q&D`;-vg3-_VNPJa&eLdI9){{5qe=IIIG@$2Y9?wRat_wpGAr`moldmQ&zZrIo z=?MATP&_`2Y$3XqA!dqs-F4`E=26$|Mv4l1)4AyJ>09e@+nPL;Gm?lZdxDNtGx!$e zvDjCjg%{zGoWzB2a7DK+9W8>+Rnxul6KHl?pH27DHuAg}SNIAD7X zmf;L3jyG3HNDhshY%PkRIx-3O5C(=*hLeSGIAbqv0eQu!F6L*RMRhP&o`=hNKk+nn zYvU#VUubNTdiVw+vj{g>Ka@B|=@46$Rdr2{pVrRgCBFsNgurntH1b3XbN9)XRh;~L#4kS95`zcabi|wn) z1I*r&vyJgJ2+os)Osslh?+$xNrR4VPA2@Xjz8L#zPHQ92ky4k9D+#xHZ@^uOoA#~V*kO@k`L;o=uH&CRY z*QT+YeH=p(EMJQNLx%yLf8OYcSDLB;X8u!m4ut19$hzsW?2yos<>HG>J&-_*v%<2> z;;S&oH4`R!M)(GZr_=BM4K`33kdV|j3a9%m2Zj-{iy2jazKS%Cg_5=mo66!(Tm(wm zPlwM1#R5dBGKRcZY+*U^!efEZ6~oEF(UWom^5Jg0{zc9BD&68<1}qjmxNKz0Aq>fT zq1FxE+;~AvV1tF90aPp&k!f`0x@5^06Dc{>aIGJ^EWDjfFgpbxPk3XE6p>7cGW z_7j-~yMiw=@6+>P`RnU}_?P#00mvwaD|FF(j@1wLg42_39086A7@`NmD`M-RaZq=B zUp=`|Bc|NqQ0EJhXW=Haz4#ya^Hdqb_UD;_H5T)uYdP3Nn5=)xW5@x732n9m3vElCM!{lrDp^|F{hKc*UsIRQ$h5Bv2H!Px)Ut= zPQ@g-N(HWuqood8{NB@0Ls`8NQLn#DRK_Y_>nWts z%Lp~YmAo)SPLLBdB~bD$-zFPfGo@S#84c)XtYQQ#tTf7+t3Q&tk82tt0S~W7e#X#c zXKCO>T0f@$<;Ci24!mp_;0hG?T`EV;8&&=rJ)4vr=$vy}U_f&FkFWNDqA{FkO=!4^1iCbRh;2p737 zF27T#eSANbsB!nLi2q_apeT)(V?InR)_>wKeyAiBd{CdC;Ugd)FDzJM#SY`JPxE?r zs^AA+#kj*AH+gEnS7HIS(05%LKiZGRcRNuTi;EVg)iFgfYq?Jnmcx9?1wv{~-L{-5DX> z@>HDMU5^!}^HOD8R!FJ9X4g)2qG0F$k8AtS*|A3>@^=}w=UC#SWfxbQ?_@BLx7aU_ zOxKeW%cje@nrTE#f|C0ChX<@d_1pxdbV`;&O%{H-QPa`}L@9{P?f(X(utSQ&BpBt3 zs}L$M79r=xEjxq-N+hM$C}|b;tXA)9M8%1s(r4}|x8EfdocSDvDB0zJ!K&I?8C)-g@lE^u>^GZSa;M>J;CiuBL*4rb zGPbT?pQeg7J4!Ary!8}MWBiB7Zba$*qHr|{jzt<1lM=4$(IrR_aUP(t@`7Tn#f_FR znL$z21gxe9I`*oh5_iPfdR-f7$ox(U#pa@*O#bpSuXD8M%VXQnN%hr z^M4hRMrU#Vy3~-7`UZxNmwdbSjRlc9*324I+|YWjhix4R923pL`V4lAGY2) zD(bBb`=2amy?v_H_v3Rj8kuHcic&?uNX zi1RD&dIH$F!u9^``wb`|WN2ro>D{B#;-VPDs*QUiuUX z8;B?+zjRCQhbF`@p*f${8D@hqZdVKrceav2W4TmCrhv&(P@Y8ajc=Ko2=>s~)%ERV zfyZ5501++!P1yBD9?(Xxe)b-l1k4B9#esX^Qd*cb{1Aa3lp#E-#YO}ki$_*~ z<|9@BS&%PbZd0et5qnR#?%U-JW5!E!A6PqFQLZ*^#Q0kgMc3rcn6l(95EQ3Puau4w z(9;{=6xB^x+58XOedz;ACEfjynyew9EF zv|sGHeTPLPhiS91qkzX!Ltc980rsQ5e$hJVTTCm}Bxn!hvAdBAz$)1vkAzdDW!X<$ zpEUZB=5u_oP1-`1Sn<45^C7J~fQ$g{@4EZVHY=8oI=Ly2|M~|1i@Dx=Q{Ggr0x?tN zn=RFX>3J@+HW2YS?f*Sn|IaCld){R1Skp_SsMCCj_!%PCJ}tVoutdcdm2e)t4R{A( zX6S590jbqHN990=1%V(g#T<%r)ryMHeGl7qnX1&^jaD8ERJYQz?RApp8+vjyxQ+ z_G&QTE;|l45sdgS7=CQ2wQFB4I4Tv>x%b1xJD+&HM@_?>xe# z@bwl(Qo&h@CXUutPbJ~Z0Vi8&S~tbBn4p!k&%HQ9D$%MhPRkv)q)g0ih-a6HD0w8D(E@|tO56{Hz1C$l)jMl7a;LcB1<4n zyLTgvYu>ia*o}t-mjcC4!dgA(`2JyBHDi0%MSMeV{ns{YO^`^=S`1|6GG9jteA=GW zWHdw&j4?&A1u)UUd0^Cje$?M!v=iG0H zNx{Or@%Jug_E1&oRihA0uPYDG?R0JKgq`Xn8+w;dv|2nw%%yU7OIZPv)>+@m6rZ_{cV%nf9hpeUC5OYQ|<^b>eH=68m4kV{{!R=)Hc0+X=tXE$N&mVS1RjwXM}5vwdyQBSA+Y(!O4e?m3$%hD1$ zAU;N%uRx@K*ihuuNK5#CioE~IR<2es!x=?W$ugRq&1&8ZmnhlB_SD?B)zQjE{v(F;4UQrmFakg+hm1~$Xa)#&t)t5~mU zTY_l_r#=B_1&5DIa?+c}=%d7BNL6JKufvV~<;1C5?J4EHsO4pgbG3e^x@#QA3>_>* z7Jf6I6c-uAHlT#8lCMEe;#P)khU+2RbzhTHkt@8t1`RRb!QLpK<%oflbsC*t;FSWC z=E0pFAh6!>8c8yRw=7AX<2N)dyp@5=HI5X`*0>Ky(3QQ=$pq zBByTzusIyE`f!X626NM$QAF9q%8flNjOPy%-lsR^qC|n;YEc^+!lN=j)!lXZpj(bo z)9L6;n&1NAZR&AcuC+UdEyL0paPC!=wx}9PP0yORbZQE~D6(f>Gx zu@Uz|x5*RAQCR-57mlP)ek;*p2$`;K*%tc`uO1W@1;hYVtZf>Sn zMn&I1sU*u!jpSle4*llpI9DOUUy3ArX(ZI@OzMM=$;!oB=@}N! z^=(W{3~OA|i@Sf(i;!i--4a%f&~{<@xi|@igJ^Ow+WR->&guoRJs@T+IR;7fMRp67 zzg1^?@RXs~pvxY-cg{u8MiyWTgww$+fZL2 zPKFBu#Puq=N`Hno3A`g&Vx^PB(|b7zbjR#`ho+<8*X4KIF{q<^d@$o24W4NwG~K-Szkr;sW|Dn z+i`{o#Zb&MM5q*hxRs=iDV)W)Gt5wRqpQ|J{aZdD(axe@%(YXknp=G&b7I}p@DBz0 za@zZEGhFe|AD_lln@9()R}?oQnblW7KZ@@)@|L-kSAp2Y7Ba`Ys@fbPi4(7{exBn+ zzVqq#UUjDzze`I|Wc93T?Ly~MK2xaqRV=Mf%8pB9n8Gl#*Z<$w;eY?+>y&hK_rry9 z%oNH=HHdKA`bY!NK~kzXLz z1AzU9FlnuMlOzu%2A1dTr)8fXMyXL;HzTd4$mAbC5c`)sLZY=79Zky@s2hJmQtmrd zjy(q^I~Afj5aI3VuO%fQcb@bxlG)=JoU6|B=j-z&tYDd7P^cr!ggV+oMa|py`}2J` z98&Jz^N6}$5=TwyCIrn6v>bl+tO3Y5=czOyT;kBDPBoQBXE1ST6BWK?2cRitvPzhV zZ1W);4YmyEaAU5dNHQ{OUTQvn_`t-uNVUWX`T*nZs~2$d4V#--QulT92wOF9Bjf?U zo2BKYr*GEuFS%=GsD(afrkDrHdk-Ni6bfC7T)ylkNMgXfS9RrjQD&OjfKDU~$ zn@jvwO5_;Mjqb_vaWSw=keS15xaDFX+E-&efQmN4jhX}qCt1Wzl%^IlH9}Z}T{cit zKUXs?ZO$teKvabl5S>jaX<01Ho;0#7NKv;IGEGW8Ze(B3LO1Uh9^CFLzTvGd18;QQ z^3~YWt`F2U?=1ADN56D}xEsh)7U#fan!_*09#5OxQ(s(+XXUyX1G%9Sp;w+=v3+_bFo_ zr5f+?>E72If8QLP*iKRGkH}I>5B-;Ai2W}6UY`{AKobHiaBZU%%%EdE^MoM@{;)f9 zeK5=?c1y=+ZLD-Uv$PQPP^hN)#W2yco24ias8T-AAGqHprblWW7PRpb3h%D&CV59O zW=C$%T~N(aOmP{$;;sDb1ts4WW2oizWu>VNhVtF6Uk2>%`;#}|s9@bFw+ZPVkuam< z&J)a$xRa;!xx_Dou8ZwztC6`6)U6ufE|5vXkgAW;&z-djUKDu?P!&La#)&vUsOhj? znHpy~wKX~C!9tdm;`&1NkB`PTKzOb_%*E$Ltkhvk(w>EF8PP{1T#1o5Ezh>_PB9gh zhZ{zm@;=R$9w0K8X>eh*#xm4bRpCF5UzdUB3HRDykGE4it+3HqcoV(y3ncrK& zN%t{nu0Icg_r*?U7lHEcsJm1WMd&6^ubF7N(b#)K7z%5Z+BjG$oHn%TSN2`ET4w>_ zfFN)PSSAq_+nP&E0P)INl%r}MQk?1i!u#%dlWUV9J~@Cud*^9bwCw5v+^B*XWW2gI zD$FgOc?nY+$@NL;AeVCNWR1Sr_)kX!{f-El00TxAmEFp&WA(Fgw(k4-G;|{wHu1L> zoq+Q3g6`>JfBngJ;n9BD>He4P=?gH%CP!`Wp|P7OLIa2w14kgIF)Xvo_L$TgTu=t5EP&|Sn!=s+dl>&@OF64NH$dr zv>dr-P9SYVFthu%Hd?J!<)1w9@GbK&milI>p25q(dt5Y7MmTdAd63O*FV?eK=XcXf z5>dfc#+~79Ep|ZE37&aEa zj6Gg9^P(DR!;-6e>Gz4S^NC#+wE0MO`%nAVBU(j@;rMCvw}(Odvr=ePD78T<)I+e< zu}ktNtFRM~P2kS*ASh%P;e9pQhzGF)Q5xnXSnA*Kkd*5ykMdTkfEzHwTTw`I(~+XI z}%Fh?lK&<$;#Ngl1~3s2H2q9rh({_n8}!~s^*Uotih|cznwSb z7T^ZY=9*7OJh}!qW(=)5k2&Z$+XHNZ+GcCl8(?P>KAg{0$b_jLLKC9V@112UzbxA| z3Zp$>A`vN7s~R+D$C&&@!9+J2y^Mb7x4`QU^%22FT-XfVVeX=S>AN9t?V}_Kg25|e z(n0P@Q6kp48)+qn0&g;|b2Rp1u@1^WgL_3=`QT^ld)lu)alH{LN0UbUoxt0^^P>Xs zIus~uMFkG!14(>1C6Ppn`0 zqDaX^L3gDro>i9Y_jXmhW34bOuYV60c{YkRv6+&0{IFU1x@|=YVF3olw{T}Vmy!<( zJ~2sUy|EQLb944lgu_g~>gT={U`UyS9hYM;Uc~n~BzBNHJ}UR@d>6@uU|Ez@ zooOnTh{ZnT2uD(HMz6^Er+>x&q4@=9!R#%#beFC?o}yNPTZV*Z6^P5Ih8d%aU(R&v zS27K9QeN9p>r*6NGB;C@O3SZxbQrf4Y5A7}`I}!NYeapsy45cE7!~ zti?U~mzuD)fP=f-aK*rQU0^Z0r0%=pEd_>_}LkUbVtabVcb5Fuulx|tqGXG>!9 zCpYQc7j;uzhTX1>Q(!@*mEP)9w#2M;l~HNz{`Ke!lKxwxKTk({ ze)P5dD$Pc;%xWGRzS0WVz_BchVuFy>d?!s(pw2NM&;Jc~t=V`!J2ViSX`f-;awTMh z)icj@?k`VgH_+oO>AtxDf1eZb70T6@9{Q_NLv1T%%6NUSE2s=`$}FMTkULZxZMs3l z0dtaR|4gLVNFhP>v%02aapDR1d%fi*yF{lzb>9tH7b14WG)>h7OsdJjVA5nn!G7^< z7&mG9V`sGH86%3+aoA_Nnf43GFi10BvYnFV;sEJz6a37WDA*L!7ZBlM35XAf`j}8z zL{F06p}FniJ!1dXR?Cef6342fdHp%B=y^NsJGYC0tKY&4tfi_CyYeJxVpJ2-h}mTfe~>y1oS}N zCye#{YHZV`&nZN_W3~11k%3)oO_1nrYi%TSx(Q9B4RML+YOPe{PfwV~S%59j)9Ji& zk}_euJ}VYnd9=EA;<8WRJR)p*sO)-_1sqLtmIqqyw?FvjAR(Zdt87tc<9ja2h#ZHh z`9%rRw8-&hq8ncnW9S_D#+Ym{NVI&z%!mW(8|B`nRUc3$jjY|d9iiGG+s&n^IJC;b zIN_M*r*1gWM3gDywqvHaH*?F;ly>02jWigc>=6gen8S*o*9% za@yEk7vLi0xYSGt3Z=DaVQV?&&?f*!MAYe~t}KFBdn+72vpdj2JbTteN%XHEIDrq+ zUBo!5X`TuC%q9rVxQE_Tka%XZ;r%O6O4Z{^>r_ZZ{hHY~`8Y{7&FV+_c;k%=bz=CpzI8Q1pA-kIL zV@SM5wC#2yf`StCF$djWdLHR;ZHiFgG;^FV^?OnEMcXaPJGip7Gd4w*#&335VgbwF z+hSN(DXFjW2gDVGE$_)9&YaJmah#po-i!{ILY2H-AhRIlk0L~5)oi-a`{jivwJjVj z5LFtv`-Dz8uSG-7*ZhcRM-`l%`A($8Fb-JoI&4Q6JN^V2MPt1h@Nfgw`8hTdI~uyYeww!{u!q^aYGY~X?tNJXX|8q zG8}y9T6WZyc64js;dD7IKSftQ>~xRw)K($ZF=$3Bh*)r1JAPQZxq_)$7Z&b09_IDj z8%#SM+)Pl}PdIP--#)>A_vQwvDw{&~d;07>w^uEd_+KOR@l_o0YMEsY7SpvA%mZQW zK6x_kNOlSJXij<#nbal^z*UnQ0VFW`4tk&*Z7EGNmePUD8R3b(X>69FROpibPRMnJ6~L@_Q1{X@$KQ2 z8`fEH=5J5nRj;8L>Ax>k2YR<)fILSUexYY2QHNxkvXT$ZtmwNQV$M_(cQf3|4k?O% zig7otu1Fu$-y2GW3{%T%Vqx6u>axfQu!L`B`zri*MH@nJ59{6I)pE>#V{J#95j^sL z^+wWl+_4P=V|P-=m?6U5AMpw&<>$NEj}8h?tIk2)c#yKOk4g5}a_O%wALgbVTrnfb zXyRAdzvUsDp2vBJ<1BGh5vV(w6*Ci8F_3w5(p10464kYyALgxUsCs&Ic8va`eYw}C z{uJ#NRVegfZHgG_mRx>ZLE6J>GbXgdz*C4CQ5so}JY`@hZCDE8 z`|K|#Cxt(wp#w*>IRCLRV=`Z#_VPjHd@5|7jFBZwQf0%XJt}gWT|?XDhSmD!H?iT$ z+9c!$n4+0#^7?7_9kIJ_#VlPsM(zm*+l%YX-5_Zi&grLly;sxDKNHnGUliGz7Lj%7 zS$Hxx<`2~sW_3m5GWVn`n{;b+y%5u|bdesfFPFgBu?04f6_!IXl8=m{{tVhh<&N!IN;^6QrKZr8hwuaYX-~=EHuCh$sJk@Dt8C6(4H$R@8KFiHCmc5A9I36 z!$an|_c}M5#DadBQyHHCPK%p95?>cEmUgm`me>U@>)G<4rE+ZnbSQxeVuOLp9wi5F zxpw4+g!^#`?nOY^1m?AZ|7fv5U{LW2*UYHaqm#AMp#AUTM|UHs|6Vojg#Z)QB_QcG zqmgd0je^14u0Rz_m0mKe72w9^uDY_&HiE-W=Foj&QRUgPFL+2mzv=>?)J#z%b%V$$ z=#&yai-^{m=I5E4!{974hER^-vaZ!1U73DDh0U!ik~sIWz^g&PNN!l_O3!lX>t4Y7 zBTk7E?*avuuUF**@o{NN<2=fR#f#}ab6w%vkRl;YdRVx*9LHq}N)tUey>aONj%q3^ zft6B?bhs2}Uk1zQ%VD>BA@vb+K=xVB57^dU&(<(_KMefoomaQ_xh$P66}*kcE~TMU1nve><^)Zti7WGK*a7`0CtwuhSTb8>pQYmsZ z^Tpl<=jp~jH?>s``cRrdX__n)%&n#Dqwb)atSuhlH8%z`{XQ&`^I<&zT2>l06<;v} zVoU`2KKCbCGxCa~lyW5I&*_sY9xj)7*U#jsBwx^VV$=$Xb*7&*CxM>JIo;|~akYa- z6b$nsVzbJV{B9+j+PVinza4?K`VApjI9SzlmDW4>3QZ2uXJnb_fi^Xfr{q}OlyMZp z_tHDRWx4Pd)+zS~M>m9$yprqbCz_0!bhH}!$|3mF<`>kmdGF^Z@Q9K6OboE$-SUr>; zJS8Z;H;R6WI9Az`RFQZ-ubp<^6w!*y)#PxO=+`e$v3Fm3`t?^ zm*~nnk{mAWXQ&W3D`fd>+3!Z>pWfKOW!t}#t*~pPlv7`%`sD53`m!(^PrTU^Mwt*H zIQo7vn<`mGrdThnp+kX2cCaTWDpW=*Jz5HQMHipI!JFBZbYm{5H3&?{*|gH!`sx8< zZtX}{(VzM)W`J*OC1HsN;XH-GzSDXK>MV~%X`GjkLe>rOhJ1Ya_k85k5tP>8Hib~R za8V}9V=!2`f1W-ppZxI19;AIbu@u{BdP_cLnKh@sbzgs^Hrk z>%#L9Q`8S#qU|dU)nX0flJ`psnld9LBORf3H4v1v?t1@@qz8JF^T{X7C4WE^UC#=(@p1bjzC%`P;e{oHmjIYj0 z?6&onXp`*dvdph(LL5=6L6%iz7BU{fH~Dp*sjxIxb+D5br&~Q4?u=xkn?=%MOr+P> zaif+|*OkJyHQvcIt2X*`P!Hb;WQ#yM_t~^GNhoR<1d!@`5t*EO_8H2V9_h*y{gu0oY$P936@SGZ z55x{C7dTidsyt!3nZMo=eAI$S($d6N$L@AXq^2zSj=46!L#L~Jgblq>ZVJ2-an-#V zWl6kL!F06Tb&|JjXO2`~E;1B#8~GJ7;2n_hcl-9nC|xeu)4Zg+QQy!1qGNe>QVB#X zU@(aI!b?jgFTPg9VvIdo_aK5_NNYVbTaJ*B&D4&9Gz` zsMHt5armW?sA3((hm>;p|#UDmiupZoF?1x zl_M}23=J7%vE4tT0OjHY`&)x~qZah|bk$-V13HyBCFb}9@lR6QCZ#?raEl@#WUGIO z1O{d#-^57yn4jaL?n;F?Mj4JscK*)=0Sbl98QH869Euz%v0MVJUhnVT1mikP3JY$% zFlhVBT|+qCsaLhnq3iDUt)pLAciz6wK^9JrEF0>ToB2h!jCQthhZ;wy5$pqgTfmBy z)Z0Jl$=fS*N85iSFDzOCJfZoj7u-~P4!3FhDwr=@qgONxN#cDPb_>DCh#gckr6G<- zyqyn+{(l9x4sgzf&NpHI(37)&ru55a?4>Im0@2*@q}~_C2zi|!mi|I)dJY`_PBL~3 z6Qo3wIua=|HLNb7)Z|9KPmuFq2I+a6l7;-P*1dVc=9fWfDUW4zZzo%f(IeT=IOXs~EWUtpH$Fp+%1o#KUDHMMA+Km~ zbyhc zJsNV;m%m&A4IDOx{KooY2(X!#UBxBD zBK;`*v97*Ne=w56uMQ7sygRM5lYx+ISn zT<~j0oojh1U6o*-f_K`#d24+Ildc5*ASK4)eP_AaX#XX zFyvU_`aO@Ry@3|xGUFS;%4xUSLP9B4sTAqg$m0KjFB%uBIb5xlWoAn2h)%L{*V<=m zl$P;hgAL4oB%^>xKl$KWC@IlaBf5i@MbS=`w{0+lXc_9!8E_4tK5TxXLD>AFI0+;R z08?Ru4;pz%S10M2VbaVE4g|t2*s>fHSj3#zD^@u%954B}k!psQG&COJNqDbiRQvJyiA5H55DV(+l?&jdF zs6#6paB_BqCz6q{gy;q?-ZL_yn+sMz`ktEAZ<`slBsGn5uCa7pH{M9OHmovh_v~_} z+l0~v0HLZYGT2c6?eyTPGb7|%v9(NzLJ(a$1553;IEjqfigaW*l8Ns{D2!Sg2=MB? zgQCTzAGvN=d?3wBXC2Q+DMrC~1hGk1V;~c#d6Sxc+h0%`dmRYKYvC$W>fL6NSiKfm zm!)Rat%P%T>5?Z>gjC>{9={_6SGDVI($QCVvWjr$>5skOLi$z{dZXG!QEHGi*KfUE}PI72A7K7*amKK9jM+`OJ#zn_e7`_CD?8L1o4fCwXB=5ZU}Dm>k; zmqw{&^6Yst#!!19hvY~2a`>;DPfQd}1b?-?D%WuzUA09My#F@%$rEP{wAY2 z)g!Op{11<)MY-8XMRT6Bh3#-z>;)N|3u0;vRVyZ<^ZjxFi(CgA6`YA=ifn3md+SFO zb)o^Ma1r8kSDUINVH5YAw^!}MgT7xE*}Q84J7uQ15FA9-kO=$9jOzCC&Bbq);p&Z- z`pjXkD$*@NyF;f1?h7n^ml=0zd2C1oj@gD+Q_azrHn=Iv3m$t-@cw-E^x{2>Wa?>9 zpJkXzsGWI~oAkMv$vPo94`r!Pq)+I7s+sxT`v;UZJsS@`J-#2^6cae|#@M+6(PO;2d;#?kGb9ysN6vql zhmWnrvBq;7h+1Dt#SGcBf~xJqLArmm0zCjTC5$q#z`xW1In!@1VkN#EbdAbe!q5Fd zE9q7osGJ^c)i%~M;JiktZ~DjWmSR5V0=!#g4KRi9mOe147(Z!bPonGS^vY0EaAoFa zf2C!Oa1*1l!F(=u%TV25qUK%u)_~E|C3**{x@&)Z(Hr5q+dM}KoPLg^7)({FdZk*Z z76D6lwHJ9KOa)V^&%fo zIpY{s9w_{oNM!3v3=mEA{umGy$wXrOTMM45D#wjkmQ_tpHl(8XqG4F%$zgZa#@|!D zM|}iVIukN^=t)JK7w4n2#fo&?M3cYCJ9w1@9n{U~D~cT`GiMmPS>mq#7+*PQ9Jhpzg2ofhZ`%#Y zXK73{4SRqSJB~3_s$_S8ExsMi##;7SLq8jEHIv|HH9d!3v70GS4D4ZBsXVG#K$I1qi!7W3K&89OdY0-!2`mlYtmQz)W818-oCJ`k z0`>N_TY^jq5uQ-5b6OD$y|*ov<<02_EERMz@1@&*d?>LUC1mp(pD!{}YIQ4bLnIve zr|Wp6%fyXcpOnutcOzz71M< z+kPg>E$D^FKz2No*I!N!{eY1V=!S4^kR2;!>rRZl4uzwy!a2f_(+O!unWayj%WofY zc)#3qSE^JQUT*ZtD4b`h-)r&~NxAE+;%G`Q>br7X9MTsb6YfI1R%JKpwu7PPAb6(hCjcn zW)2kdSUbRgjlR~VtUN3QrNU(AVS&$E2>KH!@=j`I3uiYa9~ zXA(FuTvn;K-ZPGU!8?!1P+7eKAJTDGsmMtWb5vt%tPOelew2Ezg&k&Z_h~&x%yuOR zO4I$VL`tl@ZlTm+s&fi9sb@w0Q67+V}UHWEmKp0c_OHGF{xRg$&sGe=QZ(j}_eM zU?aySP(i7=Q&YQmSAl9PYfv*-p@MUw{Au<|Kuu;~)L)^H+7M^g=5wIcwyvIiS+vy# z^R7fy@KcsDHgM2|a2+CIyjID{O|QA}yrCKW8d@vJ9mQ-~i38l#hQd3AbntsYv(MEa{$5q=0xm@rqdj zjpu4a7<8K4_7)tU_sqUll3dyTWZH@3+0Kb|e^hXQFAJ9XVCU~+qbdJ43swim7Y@gQ zPXmoI%lPwao8lsS{c5})SxgfW6c9A=bm*_U>j1id{R$Pq>nMJ0e!&k|-gyH%5^5>K z3DoETxhb-p2z$PwlvO{AxUW)$! zdnz2nM|ai|KsVwQ2V4tiBC_O?Mv?4M+yj7=ag+b937X+hRwiY<8gT)7&X>fpJP_9Z zr+_l+P%)m2D@(1&Hr3IFmJK$=n`H=n{zb!nc71Ak-~AG?7A0mCdPalqv70TC&HuUJ zX0A04#!g3U15e!4bF7L+&fpF9cKw~s?eB`mQ#p<0!x~kMNivo9wk=P$%kTyT^c%4) zu1C$T#(t570kc9o7u8_7eBh`LYFBnB|NHsNRrl5;-^k9^mWR*1%iyO!jW<&H&WFTl zZJI)q`3R*GyAGsFaZCG7@L9CkyGE5SNlt+v`Zj~|(D@PyfM^$OVjyj$>4ZlA_!fbDw)j-=3s5*YhXtu}zVUoS=?%wKpmYoVkzG6_s_5(h$Xr9h#6U zCn}lJNrZjj*uGEne{gf+qast%>kIaTB^JX4RLPN@s1^i!*)WDg%X`IWbK_lGCNd zjc{<19a1b!XMesA`r57z1a zecdV#bkIN6mY6T>PrdV3HSu9F9+IhE<4W7|T47@ieIEINK|o^Q#^Z?w4C(BRYnx~4 z)-E-PxLC3!s5$JT;%g)nmM*;<0%>|D>A=m5fgGRB0zvulEaNTKT0WGRN%9&;mf5cXf2_>IMC&2T!%qUuL+t`d<8UP{RVWK=i>!<-v#L zr?K314qPjwA20SnO>Szb1wR-%$3>)~ZIJ))Y$QeNe>Ub`%v5&pLH4QZ_+GP2ow;p$ zp%NgI`D3XU{Vvy8Oc(iYzy8TSs}%;3a`~pr_ijz1?Zb2`we?@8Vj~5%?)wqSe=-)p zD}YZNnxWRw&Cia}HAusXfO%7Rf9)U+vkWLzi@3p)#hasj<7d`~km!A6raMI<9H?OexZC|fj zXzae2$Nq&r{2l>5{6Pbl?cu^w1Im?)4fu;8QXk1W^P`6-&Yf-Bu!;##IZT@W0IqYw zn)M+A^JSD;205`Lq6qWhqAUU++7eFEYX?B0Q%OQjiZin7hJ~Ams-B*k5K!k9^;zA` z-j)WK5gkabMLUn7$do@oQwaZKmfmND0Ysxqx_LfId=N-VdMQYFD$iRIp(GA zUz|@BYnrmQG>=lTr7SE$U|RS9b0!h50)agU3K|Q+uk6r%O9F{Jz3*!&nUUfJl*g8^6QwX}fI#(a+0H7L{G4 zbyJVq`-6A{*%Xn1CullaW|?FG?k0pR2mqhpkySnAEX&QwB<*pu}hstv2YkX6$k3JBr8$Rnm%RbhSei#GE! zOwbHu8&XiK?Uq!3pFh>FD>y)}mgxZ*J(j{l$~(7-R$xi^|&lsRI~4Tr7E_x%uv5C1`$!7{{n#d zu8}9r_kl;?0stTDKvu800tz6hjNizD$r-9({TftuaQGP@As{@p4BfyDxDYKfhJR*7 zJO-d;Sws=>7{t{&(`^$!eG70uaRai^Wil(T%XQI`_0?PD2bGR!xjC)dVO6fz+1Syf z1*aVM9Q!(tY@izf3nME2!8E1Pc3aaS>MD8DtDw(#aWhgMvTi}V%)WY!b~nakS|gLgHR zMp+vTxG(Qwj&Ju!t2$#q%>}gNt5#O?an$IT>n5HBLqD|%7+Z99bdfD+UGo@lSJYC< zjA8wI9q&Gx*nRV_5O>-dKEg%5JKvLKhBg26K5f$6McmsR_zJv3%NG)6ZbiU#Aflqa z1GeXR(!c>uUka|g^9gGuB(kdzDN0vKK;86(9>n90%#AjLAx*=+w=|00zlj@xO*NEO z`@(D4UY+ME)7Q}3aH_>?@an70U{uZF(KveuLn8fvY8W#S(7&IzD(PEl&SVJ;8ccyE zoxP0yTTsQWnycQXxD!6{^gIPbm{*=s;gg~{Ts;GPRw-zRKB?6kv>B=6gGz1B4mgV* zf}N#xn$&aMO?bjilLP+Wp3nb1f$1YIT)r+>=$nm-9 zE*`b{)l4K6LyTe%dzXf5jU^>gO0(4ki0=vfCFNHYr7gg0w$Zjr!|ImQ*+ zsbl!mb5<4C{t4rWgl#i#629%XvxZQOcP*QT7XqX&V0);3Sz|DG11{k#jrFMK+oL5G zCAatf1RfTxlWc?>7i1k?8(Ae#)6O=7tfoKUGaasjlTxIfC!NO#zq+7U9xl}$eM#p1 z`x#KP=V%udK3YFqJFBwEeNm~xjwo+)7vEwRl%e^Y5YS476Zv+VDUX5?@JU5-BATC ze0gI>+1KKps-377jQdP0gHTk=q6_4XoRI18%V`1Ye@qJ072iLxZM^!!>}4;%7yXms z^1ztsRr`=uB-tLHxZ6CYxU^JiWp#DR)Kv$aEC5W>3#_Cn|<@Zl%_I>1EBS7R+QhR{-L@T zP0$^@2spBbb;^j*Y}E@KLjx&tgt@vl)g;*Vt?O}YH2d~n_Q2a^b`ZC0KH*KX zgV(utEB&i#p#G&7Z{=QZM@Y<47C>BJY8=!=$oJ2rR3QhL_hxEF&wE(z$WuIApDAPV zri+1~=oa8li^i8lo>G}qekaBu*r;y<4d^_q1!Hol*Wuzq=GP1#d)9Z-7C+mb*lxP~ zPlflN%gFZ{pahrg_zE?kuTVhZ5d>>@S=2~v74RQa{AB#ZJGL}H;R{H8xb)`8Y}R=t z0pcj_nJuBe%8cL%6jSK7l}Z=lXALWGTTIX$F*aZX5`(dU5$VXq&>Rv8QVEZB-_i}B zn9|iAE5vyZ_h+l*cmbvgl7b}5c6~3{l~r7!WtYD83gNvi;T1le%_X*I&M-ufn>~37 zZM+qSrIw9|xSP3Y&iid0>1VclzBM%I>#2(LF*h-DcSRfOx) zfO%mfaI|Tp(mZ^{J~le)`~uObR@orUE=mChKU=guxFWU80Y0R0py}Aov?QC|{M0#mxJIGNYy?qG1_-FvROMuui8wgC#~9ZX^)9Y6 zXoT9h+E(pL^V3pO041sPm>&vagS|RDSwFjwx87;fGf)*SAynw}Nh^5je`c$#-#V5U zRN<>E{|a5`G4dW7m6o4BNfi8;^4qyi)=oJJ*8SZNMX;uR9uVXqa+AJwo)oQ?BM9)j zFxotvvAMap=k4geA9xtP6mQx79{y2!XTtIDr5OR7A$sv&uilJM&Bk{&j8bc((X34n zO3EpcAxJ-I%st9>ggh5J<2;%CU-QeYF9#kM=_~99(YZzx}x=& z1l_A`{xA2OSiV>!FW+_QA6>Z>ZZ*F*bI9NmsLUvKR;)D~D<^WbbbWexM%D7};3t^L z0UINtgScOnbT4>)$gz-tzI>pnrA0(1#zQSSH+iex)yzHwTPT@3UOqf?8qNd_{GgId z(a}M9;MJuKavyk>Ii@~EUAn4~_P{#h)#ul4)&yZ%bw8^wzBA8rminw#q43+$M&2{2 zt$)P?jL)a~yJ(Wy(91rE8ju!bD$f-!DgbJo=k9xhITOous3v0hjv` zs{Wcy70zWgo|0f&R#M>{%`Ve_I1u58)_s@;>2zGKOwo8LKLW%5LVk5T*pp^lUOG>A z@=K_&rn?;gb|#N>*-IQrQNFrS_!DM{eNiQh(i~Ts!_s5&v_~q!<`0Y(te&;f9ONn> z=DT!nPm!CSGuDcs8h5~ubsfj8ur8aku>7#PHlcbuOqPqaxA&5y*Eum{?Q6n4ZsT|0 zEmq~d^1c!QSj^O~&~!ym4*K*8{fZ}oPEl=l{WLak$fv`tw>Z+YaOyvFdu}BNONNvVI~(mSc|RcVYg}VUd~Jx?Iu~ zo(tVJs_d``fi$Z?qene->TW@OdoIlJOPZOqSt|(whr`;xcp0O5k``;P z=?AopGq-8k_&N$Jz<~R&gJj0-`@bEEi^_od=dklov4vy_2&gmP# zzw8bKa7uRBU=#<(c3Q%Yit$euCSEBJ@}3_uuCVMz_#*r2MmtfZM8MKnv2LYBhldJD zbd;vM3`>A6TVrSUxz~?a;w^8;vZPZI?77YEJ}S!1Aq09j4h#-TG@TnR^%!`6bwN=$ z!#a4qq(pbU`tD0tq#`~!&wQd=O5*ATgSJ5N)#&-!GQELY?9-0sl`-iTB6tv)$HSs8J z$;Dgzp`GdxCMMrw^S5a@0(GKk02>Njy|WvuPzy}I&gyk7J$DX9R=<0@3;lm|opn@{ zZM*iRLHa=ni2+oU27{0oN3Hs!KPAmM>UMiO@C0v4X?nWsa0DYFM5z3;O@w5SokpKc`EIV$`T)F|T2cG72 z#E;M5J}LXkPA!gVI2KK3jLY;_Y$iOQU(f>rB}tgJr2E@|3?Aa7<2tDH^`NofE-Vmi z@%b91u!tF*#YNfSh}*y)7sq@#qh_JQ=6B8A5QDQBBi^MasipB(_7!ru4a^XJ!0flF z^#dmfy;)VFC6Nj`#7$A3#m-8F%s^#uPw4oA%0+M>S;ezaMjpkxDgfri-_)CS#fZ~c zBsbY&uYL5+B>~wol-dAo2oRIQbFa8Gy93<4b+Ly)W9R;-KD8rT8SZuoBnRVhC<1O4 z_%clhAOaeOb@+c#CYRq^NhiP`#Ew7gcpt|4J4Z3}tfHplGP6np&qv$x0$q_oP3!y( zgo2*Vj$M*F?X=Z8-hgbra634=Gyf9ycC6Ob6QCSotLM|<=H0@axEh>>^;n#h$0Og9t$c0ontCfCflgRpE_Y7QUJRwD z>ry}WG7%?#N}Xph->=Z;EVSLVp3mFJGN@^?rB>cDKt!jufI)y6;SfwXY`jc~#3TNf zd-y((DT9R(Hj3~Y@4`t4oc(*G=!8+)Hppzr6?gz3|6gnjrP){wytJH3odPqdCu(A6 zOD>ibhTm%ElE__Wq$tOORH!TO=QVUB>+hs##?IALIasS-0UW|7$X4xN6X3KQq1nvbOwBy2jWFbI)d)Bkv;q< z!z;9RkMd(g8!VX-NsKo;2Wb652*A`{zzfb2|Gs+AHycAUZPXRs}cGcp$Lrh#bnfJ-Rbd?A)&?5Mrvf$DrLj zdfmz+Y>T3V`)+PeyaUTH$@C*)>>Ri9yHKLrPl`H#O|JwWZQ|kcB^FyB0ppj0IudCN zpWI|QgE&=RURi1nl>qoK`NEy)-%{CtZTrCd8PM{v3b6c1+5~>E^PXCOVOdMRf8xjG z*^z&d{D2w$QugABIBOThYyam@)*O4OWe1H_?-c;5nMR+i-aENk-#*T1-R867XJEKi z>`bFgByMg|0j&Qen`(g!;|v5%>l+Ks5xG|s1Cf2(Kb(;fZb%mnhHEMUArqI*+K2lJ z;bzlOe0`FDX-aLzS6D<#AY{7AY5H86Q>pqIgU#;Z-nKswfXQ(++til9VIG;iqyza# z%HJAjet)B{wuzIv8_g8xTlQ-2GYw!U6%?HoslE+Ba`SnNUx?NEDpvYY+I{9(juqqG z4WXv_v(Xo3srd4RnN{`mrRU<`P(d-2058L~kk&nNO~_+5i57?uCHDtJ3E06;b9aiQ>Tk)&j8XHWForuq=0iRDHz_*znp(@ z=CUPEsOH`?s1dF(y+0mw!^x@Spw_9I38T&;x=J*B4&(zpEAHUoBh`dJ0IdoK$D)py z@1Sz!G$PYIo?qpH$>g>85QE6w&Q*=jtM`^-o5*>)-4zveGe=qOl|}8%T-VDsdJ%6F z7)DKFdU2`g95;i>#qi}m&!3rc;d|5%xbRz_Wl)K|vr)Dx{@M4Af}^D*pq#QW;O(*d z!!I6hs>X^B>}-%b9vBX&x*iV&zjHvc(qcxagPrc;2PEgb(YybPhcZGNo$Z9Z zT=od(6tF!C*ei5R5un1rP1SNo~cp;7@G67bHw947$&Ao=cHe>jH5>0YC;sMKnNH8#OrEIuCU-tM@Kx zA7W&=@|M9_V9(}8?E^|mDm@=n*IS_j?M2C&7ozk$8YJIoC|mM)7T13J&GP_ZHIhb+ zMV;j@_7e^kfJlgB6Zq$!7<+4Etxy1M2tY)azAJ06_+ii0wP8a&X*qWd$Rb$*_LVeI zf3>FsC*5!_?kr>c{5?Z8qCa2!XP});1vK-?U4D8peuj5&$v~pzu>nhyY%p#F3@xY} zO1(5goL|_0F_Yl40@OtT0fWK;6YGC7BYGa{y>of3Le{3Y`JQ{l@HAqF+bn)5+$a$FMm3evkz0iO zPv6qMYvh5ve&EwpX7-LDgvg4k85>~kV9|9fF*ByF#eJ*;G@TqMiDq_3Q;=tTZ^K^N2%*8f7iSL(! zd6bY4`J=1b3P{BSVt{;sSe^tDSxtOw*nzBw`J-Ydu^Rn*>=$6BgS7wP;CwwFC_^d` zHL~PaND`IszbWET8h3u4kTJ> zXq$56%+!h+Kb*3R4L)Mm6}W%ebJx=FeIbGK!0kz075i@0cFc9TAyaJ%eaZIyiUYWa z%hQ-HPh-$>EY4+mBWlCIHFbUlZ;JCa^ZpK(H_~67JQRw3g_X$^EfW_h%6++L_V zKyx(u8@}&vO)}u}g86qKdb1vR4O~OJmY`(m#3kIo-OF0^{KdOv`y9A^_$W%xL0RQms%gyAl>{>W1oN#jfZJxqd4|G(YYYE-X3VWgf3mHAZ`Y ze0Eq5;U>`?ln(c@U9&&miWYRruK8g=L*?c`OpD3hZM!^BA53;+5)v zhvG|AtG@jO`}3c?#Ufk*A2XE=u=`uZItz7fOYjH*E&a1;FMxtrT2u2jbv7B*9|k1N zG8Y5W9zbxDIzDl+RC3JYuwl%bfTAZ~<-m2js%JZyAn8Hj;(G?sJG`)`r%3ub&%CVG$n|}T-ObpC zN%>$!XTd0&39StI{NWJePNMUu6t^{%>)LcOBXUT;=K{WbrlFhJxHAw`xF1AES3vdf zO%U0X%>)b0HPM?Fwz8Ndq-Ny&a`-vx>L1+h*#6PnCD+F8p<`Xo#4nsr#KRzB zTy7nncwfcv=8whPA@ucPe8KS6fNk*mquftS&Y7oOXg-D9{kio^I!xZ~X*P-Z(-`Y% zacNF-Mdl{}$a}WCXn!V&JiX#oxVDXU@TaRvnZRIE4K|;u3BX^tHJegHla;NAo6@;8 z=TfPNfq{fhlkyUVt3|ouijT%Jv~~DXYiV)Xt9*Aw6o8V-^FC-V{89|eiGn78(7YHE z_EOG6@+TT%-mTLmw?tTLYbyi5qOshPH6oWxb<74e2rzfdu-4F8gx|Z}Jux>&x85g! z3LZ!bOH1<-fD+_)d?D8ce~kE*pHea+~B&_d1@N zj@qnJxz_XG@Q^<7b>l|iGWM1J8%pY*_06Y!h&>F>?@8BaG8344iar}5vOd{S+pw`A z=doH2lDV7hmuRiwaU%o2{yMv`f1e^hyaAgLeEa3=q-oq*Cpe||uaCI$*wcpBiRWdf zr@am`7)3>yK`&fG8z|{y&ebU9{1mwb*L6gN-(u#^8(7)=KIi6DuaaDcQJE|&-FUym zhLyjst-g^Oo!SaY@!MHSEvUD(B*>nx{y{+r47(znJ(fR@9N2cjrx|P1_#Jis@wqC! zp#dGEuXBV$nPldU%~3*t5Ct06eVR?5=^N)S(=GVcUKpF3GJLjM6m}1e*hnY}`@(W%b`6APRuO-aQ_?T$>*Qp9J2s!xDl!2>FG1J2ibD9kEqjzMW^H zP}DQc2Oc<>;f*kBC|2v7^ZG6e7oq30@-S5YPxWHVX7?02zKw74&Fqfq)^HWF5bBU8 zJ|qPbJ>lWw)-xRU&1WQvd^bl%?k9Pjg=y>C)j)t{6WNkhsQFkMT~0~U;VjJE0R4;B zK-v!h#Z-6Som>B|6Uei_ zw;=%fG`7Uu#AQ6_JL^^0-Q*L`nJP6woOw z1_Av+Sx4@wgG%eii8RmtyS||_oE2!t!34oCFJ$P`6_ZvA$tvZxa~?x{mluhrK|h15 z=@*GW^`0{n*1mJ)jhSv?)b!74v)e!)XC!2!Va=0qwgeadEn>y8?5613Nneec4g9svodTJ!xM+>fw=|e^O@Yzw*8 zVO`si8z7ueBMJ-p%TpHY^=or08Ckm-w$F9w7SnJJySucH@(;;b9Y6d3U0_=?VEz8* zB49-n|1NF9eg|xQ`r%ZGtRHq@>i*QNsYam)f{?){@rNsz_ZrR`9(S$h2Ha9B(A46K z;tkVXmf^aNphcKebzNH8Cz_vgrf_~vr{z61^FV5~1VtT~B&!B?^dQ?PY3BIgX24Cy$HKgXkQ0i5 zPLw=+4-c>8q>v$Mc6K&#(}=&YeCzwvU@)$t+-W~($#Af#<}&V;J<7EeP#s*E)#2e5 zf+Q-wFq=p}^#zzN+7WG_^}hgb7kf*8KOMj-WnTkg*_~BiGSC{zbU6b<>M>vkxm`c? zG(%IL=4T9mVYyS>FVPajaBa`}b5QT5r3iVxT@6i)TDXF*(-~y3{`y;1R?1_pnH~;G zCD|rOK1Pp+D|FRHOgD9c9Mrb08YaWpJLS+d#tofZ6|KfDC&b$9FB?4@_rlKjH3H2I zKFR^?jYVjNPZG}5G;q>c`GTacjkm2}w*pV22*t=%Ec{;H=mp5(Ji;4ubLli3tOCbV zuKQ0^fXhu1kGHKiWC}G0B;8>X*++TqY5V1n;c0;7Q@?0uu(O-<#Uy1{8tzslUfT!zrY!}Ex|bV92U-Nn=q zEBNHVqrfqDrxtNP6K|^IaRc|T3Ob|0733v(Xuzq{S{Sn(XLQ9cqmEl!v> zX05`(ijS5+N(BWVo#&V#cJTMw!|!v+9gY87jnx0QRR2}7grC4t`~O}9#jgY*8e5Ow zE-m7GlyT>0qNe&Y{UxWO)#OVEGqe}!@VE+KN{w!9irGnRg#Ed=x!Sh0ba#LRuk3m! z-dF>2d~9GPYS1}d!d2!*#BTb0-&I460r`$*R30FAWU23!$eerqOy1DRe{Rz1^nI z;9^U`5eqNHVva>q^`1ZbG>By^#Sweo2zkp7Ktz~}3q>8%_KjZ@zoc)y&KbO#RgAl< z0E}w3{05xFg<^&Plc>TrheUiyb?4_VYCa6(Z6#CtN-r4#51T)b-L7GdR{$cJi=A$E zYj}i;p1qP{iR2B0+SdgHCh^j|Q6USaFRb1bkh$hvBfgjDp%qI1vv8K>Nv6)-E=HaZ z3cDSOaw0P>Kei{+d$&WpTga#dMKe4M3Cb+r?`=o8o+68eVB$G$HemZ&w=ZY=?Vf%_ zaiwp%9%Q*@-y;l-`4>NyT!V#VLDgZAfAC`4w=39Av*mCRO)-S|rHd@g>vKGO#@=+1 zGwTqJ;JjGnp9Pg1p^ImW2pk@#&@xfhZmM>hQ|0UmZO8GWoi`qaXN;qBPf;f|nuj$w z`jegHHk=JOa@g(rj%v%+51l{$+^h0~OT= znxQnF1QI(1)f+zxd_lL%1SO>8NsJtCbDq)f@#EHhxYmgt<)vf9%SP$WXAty#9roo} z9k5N7vQ_@eCgAIT)huiXSbP6#llHIn;9viq|M;hLVNDqwFkjKEUKJMH{V&wViQ%x+ zNPCBQX!h~!C_)!yGkg|t@!Th$u`z@Gaj&FBApa{xH&7=qF^=aLM;wd`=gPyx1S!G8TC^TaAC1qDh+R|ZQwcpoPH=#r#*)~=P0LkGL{X|vj2r0?j z$$V|z)i6J3SNFMmhAxz<*m4i5tUt*olpFpq^GRYX8Hi+K2iu59v1P>pADY0M&cbQ; z@0hm;WGRce1QHm_A1(&gHhfDJW(FBoqCQaQQIH$S{XvKW+K5kAyYcjauV~(Y@60s| zP|d8E z&!x>QVAyZ=X4u>|rS;g&*R^1)b!1cZ5mIaoZ`*OKd+|-To-VrTG5+AKwKvYlwBW2H z+Mh=AoZES1*WJpQHOQd$ttK}FU4HwaF z4@Sk&n>n&~7mR_E*A>%w5i-k6>5`6FFM(n=IWl6jgDBW2yvr~V2yQ(YJKGCwRR}-i z6@Zx3*NamO+2wn`2Q(A*4P|Bb+cS>}f zq%CoTgy*JhNp`;+;M7UT@?GOuPANtMIE~bj-wH41MMcMxS!98=c+&0Xy~`h(0Dx-v zD%EyB+hf`@hX@Uv*Ke~f5(_i2wZ(P45)LIc`*^Vy1R{_gq!|G+40e zG-giQu4ji6yoLNTieq>?pi$zBsWiDg_O{c*&|CE!XLZ{Fp-N~KNRc5Z7-5FK@90WA z8rx`r1*rJaJ>{&aY{cx3Oo8Q`Vq~%{&*6qxwFv+F9^jC&MVFJA*|Vxji!ZeX?+&~M zFB1Oen*0CjcrRZ+b+{Z_95jC+bfJ1!2ROE;!UCtXABmPr{%`J9)CSe77SdGyS} zy1Fw9B-|N}b8%`@0xUb_s{kcT$=h6UzgF{0Rfk7nQ-CjQ=_ZKZ3^O&J&*95W|I@~t z=n_(91y@hv zm190UqM2RA*LwOrl_`E;@Uivkqqc(iK}CJgyASc)@^{jkBM%kYS}_P?QNcPdkv(H3 z9ubIK$=6L|gF%EWBkTOLChBlEV?~Sc(dXuzx56kNDJqsX3vAy9L`|-lYL`H=^{WRD zJ>~n!0B_mrELVxM#aonIt1jVn*R95b8JNo#FSnG4S;SZW-Gz>ot1k^!^t-LxlM* zFs~cupN&|Q3BHvJZ2B{~`@Mg{?F&$f<;9TXF)p(gb-JZGp@R`l(!Y>Tg6(BVyalgZ z?0?%x9xJQ?9fMB}=}Xh=JU@eW@`RD2AJxI5J?7g{J2IIBHCuFzJ9vYRjgSR`EvFTH z{--8KRsU;f0Pfx#JkuKR?kuT>|I^t1^Pw4KG-3YrLwwlZFA#2az+Ougg(w6Z>ih`e zFcU;L9h~fNwzZ?SC%~Sd!1nZ|7|>c7 zuLDNat%(w~z5w3_X>I_8#Fvh$^{}IHQ51%4Oo0@eRj`w@hliP7G60U6fnmZXQ($Ve7BBR;%x(yA9E!5^x0_mjwtFG+ z>O|tyLH|Umk;9K)(?8$A?fIm>MaAL9NlL2Ic1?{_+`V?s@|zxewG;k3Y-ZOSHCyEW zY>DEz?7?Qkrh0Z1{fA%`&xqVRtNV`!{<79J+d<0z(RM7)NsZf-IR`zi`?JY_L>pis zrONSyP z9GkY_4bJW5@d^;tT#?PG7T7A^F$rXy2^{PX!DKc3L4whTevJ)A9a;!UVB|GCT@>4j z!^R({do!b0a0Ly&ZBHjo5GPH$k{7rskT4ilB!o@>?D-YJI-Y%ULl*?n1t;lXD)7w9 zEBm_xYy;D&mdmPyPXJxL6Z#Qk{H5;9rLjtDbn;rG_)fiWSk=fxIN`5dshw1$%BXn5 z2>yJL!s`oD-5n1NODkZ!du%B>rS=~qvwt6<{r7W1@D0L#isY%Ki4Qiyw2?o;I%TLw z;9LgchDwGUc_fWo2zof1E3^?hMppo*3ZdO=XlcKZf_fiZmjdOQ=7_$_*YRqr>b=U< zUMJoZ2aM zo<6J!f^<~`*x0~ObRuG`?{aR)Ms)05_VxQy3m<`Fe52X*fQrL{ckn7#yH#Vr1LjNg zmT|4qgVT|MruTXtqnhyifGL*RFLp%mrGznr!J{;W($5o4EW?aBxR0z9418v+OHmK) zP&6MYu*a%%%dnNlP)yd^+<*O-!%mL2)E0-JlUrfR4N3ZZw~tooBU3W|tktiyM}Oz> zoA6xs)be99dd*I;Q77I_*YmTl@AbyVIdZ<2`no7O|L6VS)(8&7o+Osqv(wsimGSw-S!+OYG?d4&f6Po=K6?v0?-0Ljo84EV;}BaJC*=I*-6$eif_~Iq_r2NV zYhJ>Yz7t*L_j5dgC@%LJ&-$cS@7R5-@@T(b=x%{58_jH>^UX7kzr4CxYdu*TlDYoS z^`-pQC%?eC5xTaEmuN~?2V^#HCc42RayJEVB`L#Y66*Yom4qD!^si0P+jDUd;Rux0 zTVPbXWvw}Twu^B}D(l|89s7{IjDAHxclu->9CF+62BD^Lxg;J5yPG5I@Hv8T+uEkw z>+k*F|J>`{AY}RS{oCZ?a(+S3xjfPf>mYz3So*g@v7>qkS^KDqMILmcXat3?{DpcpM3Z+5$Ct8SKYHTEusDmkZmgeOi-k&(M_+#yM{>Z{a3 zRQi5YSCn&n$BY2K>-GFqVyK???J=9k=Xm263LMw8o4HC1NvSyix_?X1(47b-_?@xl zIl#uE|8PfUQIBB;Sn993T#BEs{shPw%yV5aV5YciGm{$Ec6qdcf)QgY9iVO)cic|x zS?9n`LuKD^O|R%h>hid+f~K69Pw3ZwWIft815jpJF&@iA6vI?ul4epVf{8Z!MYHHQ z6aH^p)rywI0MUCYfP^+)h0HVJg;Vt}O8~39jgN4soDTSUYUFTd-RPU%oFp|)jTkHH;>_?J3;U3xNy({*4$*Q*#h}Ac)mti?HeTT zFJm=Gb*`bdp zxV^eh9y6Os?LXF#lTGcx2X7gTtN5JLFD`+jK4OvRW<+rs&ZQf+w@96euIRImx>iE(=gvM^A|6sS91$2b)zD~$N`byUr&oHq`%5l*m%SF#=byF&CN}ZG zf%?x%^e^y?FuxJ{1_XBUz5|DW;xgF&K6}3V^R83(_Jv58v4=x6Y$k?cllaG<@e%qt zJ*1!iYrImppZyQS_YHsJBeUN9R*z@k!9OWEFejIpM#&3M?6y3;&u$in->$~& z*#Out8=Ju`ziP9aQnVz|1*Yk_I7_wI$^^E7rFZX!7gT`VXV08=r)D7^v8^JfPXAV^ zf6v&={yBX9yIyH7i}#=T1tH=-{(gaI4x;p^uuLtz;Y;eU1eOnBGat)N*@Zcx29*4e9$PI`g%U4!V zFdA(ln9`ml>dFqR3`kw9t|!=}EO2RD%&8x@)264sbfP2G;8o3UqT|?leSdO>%iGNT z1#bg!stYp0wa}!F+4^sP{6Zw|-1L;!qxtDFUGuhF=n9mb!;*SIfn9S1%M+Km8ZWeO16nb-Q`YN3V6 zeL_OSFYhi5bcU-@{HCTO({uoYFPx7~86<8LR=)-QH!sMOAHBS7VU(SuwXzpw-@~4%jt`L?Ka_=yCdsl?sWX?ZNIN{5_B3l%FtF6N!_8 zU{|ncUh4MpDF^i7&bLCgI?z?i9j`6*ZALKhw85UgWR`sS_;ECX(~Z!xs##;UgjWEC zyKF-@&C%e~^qHzf=s<_FY_QQ^$LPlJWLbO$=kS?mUat<99KL|Q!+UQZe0i3Ad9nOk z@&9u&@<0C)oN#AO>PHm~F+X?;HPPUcWqb^h0O%xTfct@^|E{>_Pp3=?R*dJ2pEtH> zY-A+7{G~`6)6>R&aZ+NDzicgAPAhCqs0MUHX#u9Z%b$!9B}O-u7cr1Z*W;&nQ%-ycFm>O)fM3m^^w~ zdZH`67h=L9Bbue0wqR6a4*Ir>1EQ^`JawWU7lsAK?JN?P6*hJ7UaBi8heU=--rXtt zy28(pkDqumYEA!5(OCHrX}&~@C&}8(Q1kj0kHns$Imw7FkwGB?In6R)PqzoNzTmJK zY@hF|dD_%Y>g(ZP79^rn3^tTEP+oX&#*$*PN*r>=n|v@ekXj3(Jf~Ogg3VWRBY=>j zi7oX!4y=oy|LmHX1&@v`Y_KQLmZuP<4pW;3&0|&H47e$0fmq5tMzfYcPI%=s+>qcb zsKRv*`LjYDzrbQvI2-4UDPe_$_B6BjViZ?)xe0-t%f0?$*&v~FdSi^`A;EIj#7np) zTxemwP^XJa{rfXZBL)cTM;^$P%^b5dRDS;Wx(`)j0PI=Qm5)PWGr8;Eo@9khJF0s` znH5TvRI}Vnz{L0^(9hBlW32e1$GKU$f(_UhT|_emnAv$oJlUdCI-KndV?OjH-jGa? z?a;6s8tA8$4Zq*Rd0ZmIU@yh@?K?d18%v{<_t_I63J!GhT~1?Zk?$*AQX$<*+HCH} zXv=YuR=(r69R8@abfuM<$eV}V-si?6F8cXd!P`>vF8*bG>(1R$BhsSV>pIBD*Bsu> z54L&ZG&k-i#QB}-An$d#&!<9{z;}k9f2~*q9XDRXGKmhw=wc5O;LiPM(=$;l3!a+r zfzZ-;{a=4!3#j}(v;Te_w$S+ZQ-a(cIK1ZTI2Had{`nGXf6XXg`zRZp4P1QZaKanp zu=Qx*w%n&{iPdak*){|YPsa5Pm#XK0n!_xRjP*Xia%lRB8_2N zq3Gg0`_N82UiGn#Z0&t|oCl|{|Jhv*>xB&GFEaAis$L`eF0d4Kl$4^T^|tTwAdM(U z0c2blbkv#d#kGJ0<6V%*-7|)i?^n;1P0S0L4nOwSby1w8d<4zIr%AM0BaRrA#&>WE zXKNV|KM-YtUED@Lx-x@h-w31*@r|WcDTl;M8N|zVGET0I0 z;6N^GVxTWqm+SBTg9QE{sdZ2gq%&2y~0 zF^|EOE#h&C=AE}hmD=RE=&jx4sV9<@eiSTM%Pk;Xnkv;!YqGZ7edx)YL9sZiQ|i9u z<=9vcKs8?pF((RM+ec4c`wNXu`6Bvfc|CImf3T654Nid`J&<)Ht9293DI{jNnVO)j~f{ za6w2&FD>Jb+YL6~|4h`1#`8if2R6T+2ETd#(zKFNfTaD8<^ISm=&2nC-;Yk+9yXj& zUj?^(xXXx7Z6xicHVwc0Cj!;DJ(Hi@)5P~tk2@M?n_!OcN)KM-WsSzec{>2e5x9U7R zVw71nsO!Uh7`~4s8YnlC213do8?(DJ(af{$Q>KS)xj2<~a)ET~dUG*WN!9XKN}8VD z=DrqS)#P>S`h1GYw_@%H!D&krX702eQT(WJKV#oyw{FOgD1Yp}oDj1t^x_(6u(;kY zNz`#?j1BxNn`B*zbi{5o{tOB3@S9jt_8EClJ{+Oo8d$Bo=f1Cq=uf88ArfN6x{kN+ zf{jSE2tBXOz;g{jco>_ps{i8sz-$JM*j4R3Jy$(3_O&Dz{6QJ>L8*{vQUzefI^0oPoruAX&MT= zYW}xxV4+*lqqDqC{yoT|@Br|9u{!cv+;#jRDBffK|vu!MGs z(HAkc47JTn+UQpH6&lIl`cLZYdN{5`t{zP|S?sp^-5AudCC&78ku-8cryDpYVx%p+hi zPj*5But3JiC&uXhXFZn90k!zA1(XG^ng|ppOb}Rc35YXLDRa%k_DN#GEn1C`&^2Xs z*D3psMt_?6<(dMAHwlBsCB}xl3?}K{cfo$u_DXsXwodl_@7waobo%L)G4kas=2ZvIPLPrec7UvC# zKq1HqF!W*+kY?}yM5EmegqjX>QvI*$1cJjVg7P@em@d{uTm;k`DN3&BQ7@w3-@fks z!^CXoTu~^kJ!tDMbHeLiX#B#j)T+nvV%OG%hrMK|m`W6wbj=;ibyAKGr}=6!A*}I)Lx?4SEC>S~EKh!q65DhBv=*DXyBsugYNlS zaPg!Dojemp%u4N0k!99um?uNDW8VG{MA06nPoCawjQI&~ruwa&!{u5XsAKAtCpWU7 zvXn~yT_CuGvZzDGsBinWt(gyZS2 zdUi*C?@k{<`_bIHGV+_l7_W3qtZuQfN41Abk$S@q1iD%0C_YnZ8Nms|mIA>~#uH;cDV@$)MtqBFb-s(@>0cW(PLY!_2FJ$qJi zREYl2gW+P{d|NW_AD}#b4$RA%aDg9WLU?*iQn%WOPsUe{U82a2M!A`{YB#%Rl?+6s zBCkFWJwp4=+>OwqRuDcPc~ zF@6jm?s9)QwVxMd%Hzh$+TNU8VD7ydbv64Q{{zM~Z;=0;+8+@NpzG2{r*pmoI_Ebb zKZiJpMYB*@cx-DqT()C8xx zE=%Cqb0gNzU*k{xoC|~&CG5`FCMU!ST`CZHWcsT=op3w_Xu*Z zV*BPa4+4pA8dtCpDmQs|l?altnz)oTg2Wj6ux8)}!9pZqjd0YkN+y0~d4cVbMocSK zQNY=?8DH0moKn2IhuE!sQ4co?;&PF^xu4IFb{0F<3&J4Iu;Cc{93YhoTSh7e*5kRrEoVR>SrM#eP<*f;mdh2M$0mu6*wh<=Bgqx(& z<_6w-7!5vy*Mcvi3DoN3g4WRJuMfp;4YJ+idqBJB&+o{%M#r-QS0{~!DZC&;#$ht$km5SUM zRves8HnPmP8R!!piF!;PY(csTQzt2O}3UA7q3B@EZ<_f9I`Fcy= zzxy!XAZ6D69{Ypt&eIa__frrWSCXuV+&sq_coDN>srm}Pq<>$|?)KF=zQlskKec_? z*;vl$mb`SGoN~ z`k}aD)+~JAaBSc8P2D@Q9~=`M)t@=;ZMqk0q8}}ZY(G#h4Z{Y%y6d`i$EVXaX(il* z@N~#WZlZEub|ciEgSFu;UOeT1&GP)JRP9~IVefUR=g{#z?>Fbqp_wyoktZ6ZmyLkF z$7R9(_x5Yw)apN0-G6P-qPMORVAt_TDK&6;5tL{A4f5g7)cMo_chvwN_1UD=>(nIq zVIZceS2u>(>Fh}Tw0cOY;g8+x!9&8Bhw`5#4EZ2_)zC)jI12gxHPL*=`33_(l)iZ; zmAHTFse#{wrc(3Ah(=|}>2>^-HsYC99U^&V7#=Gv&wU!vr6@$1ToiYDGVR1JFH4a= zU)6{!s8fIhY?Ay%4PgW=L~F_KpR^&j?;0UJO7$RaYxnx`bnl%Rgwj~x{<0hEzMSv& z!ItkoB)>8l9Qs{F6mio<0lCYp)nss4ER zb%3{)E72?u7I2XFLx@{5nk_C{WG~jcSE%hHH3T{x^eu=`mOn$(Nnl@}jri(|AQNFw@-N+w|w$p=*lNwxdsAy%NciohHUKVPII1 zJEh8ft%rTGoNArN+#~)QUTZmRcOpQKq7<8iQhaiYDE)cG`;teYZTBxeD6hYv&i{xt zoQmO36+v6NsBO)tOwx5FN?JtYH#rif9LJ@{SxQ;qP3`rDoF8*YbfZqKI@B=2+fF); z9l>1jrCq;T7hZIvhvm~FhDT+i@X7~LGv6j;bM)aT9^a1S%)Wb&#NH?;$?c-0?Z5X- zjeDt9CV%&^tDc)u*YGzlTUV#Q-!j9P=b80*{rwpBD+6d5svf8Qz11Rs$??7$abG{c z&Zuvn(PB3Z#ocXR?&zAS>o2|dDJoCNb-WPKp=yZG$3`3l!N18L!PKbjh<~BoSjcrg ze&8yl{sxg%j(ECBGAaZAP13#Lcv~`(elgg-C`^wcv1rp& zebzC_g>kjw1j>iY&lcDy`Ij4C**qC!34X!t^R^x7q>S5h9y2zO}P^+xAt$U;<8i*O4cZbrei`1kABzQQZ+(RaK*vi&80 zn6ukzLYyks7BtP9T;g{x5%R3PFtNqCkzs$1PlVK-V0Y@sknh~_!lix*)-dMW_o;=7E?adM!cyh?!?D@_-oQK4BL{n-*he`R}&#vhYwbglw zTgQl)N29msBxQf}v3bZMe*9jXc>>$vGV9yeOL0rn)%!Luox5D`>2x(G3_C$! zgxh?1ebn_*qPNG>|0d$SRS8O|P~f*FhTtkOWbJxaS9;B2?eM`0*=(fPfJtZ2N_j`p zXT)mw?;ei5%8VJ@GhOTK(k8bXg8kx%T|>vCbkzg|qi%;bG6eR$HFzBTJ5PWMk}YjN z?(-gb?jVsE_qo1TRoBRCs89wPQ60H$8#hBgqQ#tD=uKJmAoa1l$<)1$__H{1!-Z6j zzm#kF*5dzfC-Bd%?C<3ljLiPeHkjbMfZCG4^CPJU>GwIjTj(!3$9HD0*$>%l5d5}O z0_QyBr@z3u?JSf1=uA+_2o@Y_Es;TF=O?YH{BWQcL#bN(#$lB}{9UVnjsl z+k!NB7V&t`Vv6IU3+T_BWNqx7^bdzLq$FR=Bbi0GnO+ofUvDB-So@HUKK80BoH#Bc zTxJ6{o3t1?H7th^mq*+pu7`X0&g@=5?p(8$q~yMy+b?}Im;xPtRfjO_psIB+Rh>bC zU^B4&Ff)ziH*(VQgErFK*SFq#uFcBPyYHOwQ076(-!eWxbnW7;7pX#d0_FYvd{#Cf ziegfBy@BSLoX<3D~lxnV#t zJ%rjK5c%N~HH?n$X>iTw2LH&bh6ciW_XxWLT%$wkgB?}n8J?!cK|QyCNf+=2-tTx! zpCx`Qpdtu_TT|V>v~-gMH5dEs0Rz3Ep0s7+E8KjI(F_VgO~M-cP4Aik+Nt;kZB#Ra z;bR4H2Jm(yGo6}k8tiMa!C;$(A{yhpY8^xqSgrCP;b20xD_dd`r-Z%|7XF9VvGeYt zs1BDf*WfS_bEIlXe0YhUu+Z&J#rEYJiSrQCE@MPz5cHd0FikVr6zGjQ)o&Z2XA#~I zUUr&Ypu#o3J-6yt7r_RKa?=(XhvuB1@|!@EJ1A& zipZ3;J3iq`#N)d>o_(+Dv|3VZJoUkc+RHi?3sA5rJIO5PA3$(h5itX;sK9nrws&0L zit_v>L?BU?Y`w^#IOP3S#&eNJj$5FFsHb$vQ0wX8dUrlYj!}^Z3rx`e!`55JHQl%G z!}LZDK?X<+1OcT%X&9k|q@og%0s_+AY=qZDK#-D9LJ&lW(J71u=}@}6yJ7o%xZ=LA z`+2_q4ESs>{yKNQkM|Mhxqr$n_fFaWplDGt!)>t!Qe#p5ndqsW@ zi_nwh+F#|_!o#O>3%!9fyc&c)_i@=}Vf&oDVcvTG%T73{dH&t>fnNS6NrCwOSFit@ z@1@*@9~kv}#_+#E98s?7>-C->HcjBIF8i($)+QPvLdNSzrNqi$Y>>vP13-8JPMeyQPRL%H#slqnd zC*E;J7@~%psAoKZk5LtdDrUB|EyL>tQ0HCu*E_(hPY?fefra3bbub(KOtLXM(u~b_ zOR4VqFm5#s+hGhi){(ZC4RqB<5V;c!eD9dznC1A~^pEq9!0o-6Jh@mA7=^>D)!Jyo zC+;?u-?BytJ)+I1>)%5Z-}Dqm%#yGdP|Dq+o*`4vQ1p&o&fcPKCkO)uz))u#21AJm zx#{i4e~)-gY{xbY#)N%#4N3_HwnKGp=N{xphX%xm#dXxpN>(Y!@2uCYM06)V-3V{L z<$vxib>>D2;QrNg;;{5s4f#`0uGy=SN;tz_$s6q`dmCew}+=9%&43pQ**5kQ&f3>x}++#pR3ia%)Bw zh-(kk#nQw3Rrh@a$d~5v6~|kPd>lMy6&TS@T&q0mz^FM^R<+Ps^XKCZo}W^5P3fL* zq_A$)RVBlcEmP2ql_B;UzN#|~YoBp>JXlxUmwafzhFI_AHSN*;G@^!3s|z^Q%a_a% z9wy6@iER&d3sH9J0UkbAZTkO2!m@t>W;-4LJ?H=3vvE=v;;ZNU7rf>(6gW>poP|H9 z0}U<|u{LP)K7DnfY<;5r zZ3&31KX-=N`{}k_4V?BT^dwl5c9A0KQ|Zq%CJxG*w81VWCylNR#a$Xg(O%z)N75|h zFH!}rJsxwZhXjVS1f!qy0ptg;iPKhC!N1Ape6wO)E(!CPF#&XcbgMTJ=~Q>RM2sw_Tv{p@BXK4|7FD&_Fa(!=#}3uvENpp5AEy-4i79dBXnsjIdWn&5RMve#(PB+PxYAK|!Jp6F-FU9Nss4>${o{Q)IA#J~;HX=g*>W}aQ z9Asx&w1?hJVY>_~df`NhURr>U6Y{m95`pLB5htBM3SHnBN7Pm`a>L6FroVI_TR_%hkVuLe^8rJQl zzp7II%#vWO!!5}@60ZX6eXPFAO5M9TT4H_K1c7r_$qye0YiFfxW=(>kK$YJfpUJbO zlY-?QzW&}JBc);o>c8gX?k*o76LE0!jne#6n;lVw)<1r0+7a{7Za{9)^}WDXM5}PY z8QJJ|0sx9RxJL2hV!u~Bnrw)(^~tEfeM9~?9iu)ikZ0sOXzd;B6+PRT#~}36M(p*r zJQsQ$KN$Pqg4GtUdPlUerDc*G&v}=Fho$uVGJA#&E$w`~EUo_xoW_F{XeXxi-enC} zORU{(Q6G8tJZ^clih+ZYzGbBES6g^zOXEeXG5srng%oCA<UsPQ!W~GDrp?yXjO9LhPU2P0*wr7*G#y2y+20r=!4;V#+*fvaMyNi>+E1@)GwR-1@?zcKE@|TQ5*J}RMsiM)fRD9P& zS;TfSi*G)7dVL?YSl!E$r_jz3AS~&8a94~F=YPDnHgA8BGXDdEOVn$S|1l_;f#Q+P zTV+U{F&$=ds41@kdY$+cWk8PmX#Mxe4gZP$m%Q*Nko`w(!13?YhfRdhsxMOda9@m* zV#CU6oC@xf&6zHjzE~7UtuQ{_vQRj!g*KBsO-Es)7N`36-5-8=!RCkWCX*=xowly+O#h^RsrZC>KO%$O(Cus}#v!$bVQSDNzq2cj%$#9-6F z)5RlToaE`{cHptJQ=4^Kz><&IWNH?HVI2;rS|b#N-N}iqH^3`61>~n&1%zJK1wBEE zA$5>2zCDf^)+~axy5sN9k5rI>{==W7>r}b$9^v_Vu8oQ2;@R#p!*E`WfUWg!!koDFrgLpY3b*!N@4$&bn9x7Wr8f(smG8f920EaykE@-vO?)%i{a&8fo{&}NS-tR&T$ z{MMo>*hj*vcUSOd`05=KHafXbD%;xjfwa#(Tq;W@yxw;YL4NABy4}+gv$d1EyX0;W zk(r;uYU2_3B_t-7Lc2BKz<4>h-R38))ec$>&`cQPquO8GfJn1GJ1{G-(i#cIu`Puw z1@*YZF57O+V?Hb?XHxjc7ad-(*pcHNz42qwJ#vY7KLhWL;%9;Com33H6TK+mm+dqj zd-7kziQ}ob;tc-3)r#Z!3Ot7RK!K`mJpy#G7Z-MhpXM2H;}sZ$UTr6XM?UTB)jl+Q z+z{>>?!ru8E_7=*qo@t2*yBD%v3>~EINUtj2Rue7o}qtl1Fr_Yj^$3bEU$G|KCd~|G71>0)&BkKpD?m>96 z!h91P?_l4yr7VYqLu%2u(#^p5sEN~EKdKX*sZI)41?m&4EYkry8PQQRBvw)T0Qn= zjz2%2(Fzx76zIzx5TctsrKw8CVUO!!r^kL3hG-n-*($R$HHBF*K`cIgEK%%DeV$a3 zSTLN@65YH|VzX`2S&uufhwNZzkXj}e@|GAS|NLz}ro`$QyjcS)GB&kC^phDtu4QWE zd_xsTs89Gc)*jyy$&UdPX`=66zpv7Wrf4M3Fmm0GGn$DfO$mcf%6k-r!4h?zU%2=G zcJ)J(`AP9a)Hz!O@Fza?oE)kWit3(aGS~Y_&=qMtrjx~g+Sk_o?s$T4Z%#Z?WvKhW zg5wRP#hB_wYL(>A8FsceJi09ULW^d@PX)$?okBOcL2m`}G}T>~8H)Ih+?ZQ;=1&#~ zzeJ339cQD$WF1>{ei06ES(MoZuC{q+%Ul}~ObVH}uTu4q_al=C);_9rb=EbeqBSRE zFp+RT(BiWBN6*tw%cpD{DAhr1df_UbqrKam5DTS0UKAiMOj2;dj202RVh)lTwpH0U zY98!j;9Kbi9FOQMZpUQD$>-g;jG*7&hx~sJ`@dT#Vy*BmH%zYfU-;nC@Xu1lWuHuM zyg^+3pODSxGt+GXza;k*aMq+a^8o*g1&jGqz7!>#N(J#(UAkV?ny{zAj|54HJzL;l z@N<15@qS&c_2zFBC=?`8v=j z#3&v1%gc~Y9+0>~*%+DE)O?RRXz*)EHIjn;&DO;#+NX6>vw!mo@X`c5OV(rs&nxf_ zJrwMMb%iPGQsla&+R(p^p-Epsse!l|Fun@l9igfrjnL7JWc)z$p)R7mAR}ilFYy8M zz7R8^pBJXMb%cl3TjSH|zjy+EX^Ku_=g1i@VWHI-Cqg(lmP=O1+}t5ZgQ{9l=L5~j zTUfaI#e_Ymorv9{QW;NGEcp`8JJ@I@HqMMZoFtN58Tm_%_&}Qmb7)$ro}PP+hJp|J zx@f1hdCU9Cq}es?Bbv!u&es@i8|~kwSUoBxfVQAt$QL=;USkeFwiDG=Z^%W( zXo}wwDD84;>vnuGyjh|kQ!!%> zRO;c|?y=f8dSpX2{uEEn#$5kY?uB`no|d$~WcN`7%n zjQwHUcdPLm-fnLca#v)ljoG4h<@DKEeNClx{SCO5@{c}#McfCuXP)$1(?CxWH#Ao9 zU*UOPI@s9+8tijYma45^F$%7`F7+r2RTsBF&=U~tl5TD3OHKAQmbeJdrSI2VMFr?= z{2invmlc+j;FTxK@5o9z*lxF+bQJ+hq#BO zGxut~SMDg2QxC|;HYW^nWvtFEQKnl3Um*bv0W)j4lbMhL0#b#07d$ea)WMXqjgSZ2 zRe1PvcjS36m-B5=<}W{YO4rK)0|5DG*r;m(Iaf;vX-c8bJHo9tziG&&6AJUIhW? z5|&vkp4qSB>J$FamEQYv$~x=BL^D_>tgfomo0d6&0xkKOxzI{|qW}{#g|{s(2i*lJ zPMKEFH?B!wzR}e9rcU)q!c)y^Vuo4#xNrMP{b%t>rx9P0eL+7Tujm^ zsY99GDsjlpx38~Qlghz$$L366F1z~?m5zncmk9o`?=KVexeXkps5WqSxvFy?z*;lj zGktX2dI@TsG&@&I{!ksJJnA(KmTcYpk-Mj@+MRy{ONH^J=#Rm>oBY!k7foMlvZ9B8dY zW)|NkRw=nd|6Y00CAjL4f%j8v?bL(w?E~izOAL_ZJGe&$7larI^%F0Ov>8*}dvoJv z`1r?Nz{T|^)cxn@|8TbdTkE)r6PU-S!-cj*t8nlhvqP4hYdn*?^M!Y!Z*^a%EutC_ zaaVvb7;Cul$~o6I$QvcxvaLJ`m?k)ieCrxFOfo9)kM)pikW10QS&l8^qV1EME!t|G zKyUs~0-os~1p!+W0UHH&hhm|ugM@MiK>eO0{8;Za;ehpKzw)7>(tbmv#R?%0POijJ zN?432Tuw}d)$q>9VT%cs+(Xo&U)eJxWEjvO7zF)ir~(ecn27WzP>$pIv`8arB0|mJ zW!tVkI>R#*6^qoNF=8s$!c?EvX7piDLWOgrkPM^cFo;(US)(`;PPdPFN$ms5av1!B zQ;%w_J;d)8)c>Ggg%a)%k?6({tC7e^Eu`^OL-Cm&AmKW&U7x|&$1K4bBs@--5-3&(=MBxq%{`5sbVexJUQ#DX|ms&#>=#!7GP+zpTkUFB)` z9w$yjyCCUkgD5`qo1TG4gM(6zz|{CUaYZ4#sh?&Ezmx3BXhekG3+5lY2hGB(40{>^ zd~xXrlkd*HEP#TXX*X_J%d1V4nnhP#5C13{j$wOY;NAK{?GGAp6LqFRJH2OL1ZD!g z`zSS`9!vd7$pSy0$KA7R>{g<>9n#Pul9|^UDSsw)D7`1{<7GV@66KgTzk?ort-1J) ziTb?jlp}>^G-)tMo{AOv>}Gc4GqEXlNPNnqQx;ZE%wzJRru2h|NDn2Qa%sw;m!ugZ zgirs(w8lEjB#Tl@Ane|2ku2uR=ypQ;b_IxPobdFa1e(GpN2##FVcOl0*`%w02|FpL za@*n{WWSubs-87;&vn#XyBV6W5G-XxCM6zX<(y?7wf0t5n`$LF8$_1_P zg-#N4`sZo;l8%O0c=lkGU2X)nJDxumb-apq3v|SvSnP}UOET|dP8rsy|Oa3x#{a%LplMf&TD(8R~mHbFRoq&sc z(&u0hxYqdaJW=n(r%!GSFthVoF#TRCh=}k)D2n~L1NoSW9=N@J-AwQsH7J+upb`qR zIR=K{j_)g0)J!v-SFIyZbt#+#WoNK6OQXvskL(QWD9y_q1sVA71RMXmQP{E-UOpO2 z#h^b}ZEvU&uieH|2qUgV9BmkAr;>V)$E=gZ()+@H=<<^Eu5ul}Hx`FB0(=Uq8OK8Y9RQ)9)r{gaJA?w7> zDR@WV>CVvP(006pPPz92iK=E8HfI8k&8utQqhYySl}T?DAxS$(T2%l~C2q4$sl8cY zhI3rusQpDIxgCk-c@ZIWm%p7b@0bADS<*I2H-ry42k*DptY8w4Xttelon9k@vYae6*R%YKnYaO=L|N%TYL#Id7k< z$-EriJ>OmJDrt}E!FLGBp=?dzABfP@TH6z*{LYDzv7OSg>Igb%bV2+0M_fi-3>y7( zi$sAW!T0jp-r1$~q^+jP#Y#B228;$1u9W ze--M#fXJ1p+>S}c0jTIJq2V9HIS!0azi`U~@<4Z|cq#Nq-XoG>pQD%-X@OY(_N_d! zg}@U);puJfgdpSZV<2zKC=5m94J)rBYdlKA><5Q}r95Ijr!e0q^k-&)sp;md?zM=@ zt+d|byY9`Ra0gEzb2oFt`7q<{_HKrZJNg98^n3pFT^4~%Gia`0nz#tL1t?A64`B2Q zp`T5tW%t)?u&@-PUG^GTV2~i-f@mi`|25qL+77H=FEqBk+)u;RwzchLZW}@mrXC6) z9WV6i&whoXjNrk(WYN}|v29&@HB4uS`sH&40d&0pdghVVO(>c}lYwSX{UjI}^(M9$ z*eO`fWP6bsLc|45jqM2Yd=@BEBTXb@KfV-k-DtN~`=&%Ap|THcD4Bdei5TS++jgIiUPQ=BrSaNH*cytknUM`K6F1qH}hS<&YTL$?p>C z;n6DKzImZVCgM3L(`yiFotqhFhK93 zqEw6SZ<*k)Tb{VB#h)ED>IyV>1~{txyTAVF%_YYbB5_Sd#q$@ilc*{U*%6&1H{&;F z{I{{Ib(jtj2BsLwxk=2&wef?bJxE1l;qnZY!3Jf8OTHiM~ znUJc~wzV3Do*!zR1)UV+oP$-UNh2I5ft-IHFQ)P0t&#jq1!>_+ZFM3*$Hfp_0(+|l zZ1XXkNTVHKBwF2imbrnc8nMH$o|ix7UDW)%k|$)2puq}EP69(*>_UBa9vv0HfvAK3 z$7%C?WGY^xYtS*{nb%a|!TxQHc`o+0dxnxar_pB4vr1S3#G{oplQg}^BM_RSk%b`b zlMd1^n#`<7J|Bw7BK#Rb&B&%TzKTl-4eP;sjZ1G<25w*`v zCCL)8tuM$AGLvrMYn=(qK82!KIYVscW*FfjNz@(0LmO*R51`E2yyW9t;lK2$6PG(Q zuBV?93D_jRY>D~Yksx4Ogz-hpvn{6ZSiXBr?|Q0yF*I{pHX2H~E#0=7vY-q0xS3Y2 z()mUtfCG5%j*GC$jbtkySF2b}1uDOZyR~^=X)hT!!$fK>B3z;^4n{i_YHaWcj*E74 znX7hvSRG$((6>E4%h?k0#;^p;y?n@+Ev3v@BzeY+*1xE)@=6mHJ{m#U#HMV8DT#Fx z=E|V_Qzuerlc|V(TbN0G(9?wCdD51}s~L*RgL2t&2&HFC(;TV$qGKZ6B|H{gbiXac zgk^J%W+Z>xwK1JfzN8n6YdgtNq?#~Zl7l$Q_O?YoA69acl7}RfGAy1I<;^0b9?hH5l zRIN!=juWvv*Yfoo(5PG~(Mlejz6!i6PTjEQmVt>}cDH^YH_AeLXSJpNF{s zsc*oVlW(hz>a0XZ0j(?Hew-#ffmBkiGPN zY|ey(Ux)BoZBsxgL0Hxu-84uIo>T`hb*Ldfc%KSO)yUDn#=xxmywN@MIZ(7^!IjHq zzWx;7P%zv{o5>#{>PHPQ@~lZO<$O8{J#eB;aZpVXg+3QvCvlzRj0#a~oa+py1?$O7 z`XNDf5GmaRCIa<4>fHJD%<;kP#=6)JrBea%cP8q{wToF4oua zvlrmE43BKTY-?X?Jxj0`ktM2wc8Rl!oD6D$!f&*_w{p|Sq)JYFQN=_>;i@{JFEB0u z5|mZdNI??Myk~_M4~%#&EORwA1+!{=`4KW{GpuP9*CJKbUjmt^9n~vWA8(Y~zGQic zK0qIJYfvRo-Sh1Yp@oom%EoEWw^*0!Quz$d@{QH5etZ$|7|Y;PuDu-CH7SgkLrN`) zQ^otf>67H%WhOsV`h95D9Jr$JZu7S!yPLn%gjzt83{8iGD-Wx~&36ZBAq?lMFyfwk zf1MYfJ__z?W10&}*Q-U=hO0W$e%i(V;TAvte`F;(FK+)SZ~RA+L$qiC-8pSp7kI^0 zG{f5>FU<`bUPc|ioeom_lmjdQ?uR(}wcDP76K$0QQI#3;OUaEMudQBVoh;53KaAuG za%Qlpk}!ploV*t3C!A7J3A58TN*jYgDbkw`WM=0uq=Xm!vNCWCl`H;1j^h_R2TSJ3 z@R=sZ>h!jAW6=6yQ?X27-}noeRN=%gOR)aKrs9?INMgc3&R*U;=nS{d1Ra6LVtuutz)tariyZLCB5-B+ zn)2uK^IX$7lyL{)px`Qwd#{P-KA6~(cUDcgTC(qxcxtuRhR0VYTa3Yw|c2Bd=AU0OC(RjG?LS6G&k?|P;32`~!g9_2dsZ9*YF@-d)PeWg z21!OB0aSyWKkt4vpw*l|<|FLQOC$f09Yy@en6)pa;j1atgQolMjjB$y?A1v%p*`1b zhjS`MiA8v`b3}9-Q;GY2WjGGMJ8Iu`pmipGxV-)yapTql4NzXJOlSFmn2b&@&-!}O zuO#|+sbgk0o4UYd4{Qut@6fZ5uQn+_`+tZ3>{vRr9Q(jWxY|~XxZz%)_WaqNA%Ah_ zu0gxjd11h^j9gcn|BeZBGk21;PtIvkW1n~7W?5#0GSj~I{hHDVs7SvjORMa%U$JM@ zz`n$?r>?*?--3{BfaLxApug&oTZmcQn5SUdUuH(0e=!V*4!iKbsI{xUi@0@BC^WVC z#LE-;ev?RzI(EhoL^rPtUO%Iw5fL6USq|#RplHh zd|nWe6@ot6a^XBcQ#FV25^-e6yO(I)(P{Cn1Lfi+kTJ+hA)osF4uhlLV!SG^XsB8x zys8->^zx&1l}_MVL;-a(WiV)^%8QXrVA)|cN$RkPVcsGza3pQtM*7(>?In)w`oY2` zCQST$dx=KaXgW(tta6OeO#b;!6Xf~YNB*C?drd6Cmuq_Ud+i!``bu3KUX{srj)TfN z(#04T9ti>ttzk$+!GgqJ)2$xf!OK!=+i2l8g>%T2)+|nZV^g|-KM5E!ES985P!FfQPFq@%_3On z+`3tsdUUX=TkivafcrwoMS^lcF86a_Fq8~GKa}mAee!+2KHucTvzy39dyCLqW6!U@yEy?OiLtl_xq!wP+&)73e}em3rPKJNeapuyR7`n(VFy`%v87$r$XQs}inC$CaKu_HN5_O}Jz5D@_+vFg-UWom(qr>+NQXNnC z0|Tt^#y(^DAnK^_U-+I<-mm3I&_G7F@ z#0t4V{!d+zpqg==PyA!9A@V{$<114wMcSL5x|BIkN3~pmoR2w8Kv-MP5FqJ0zEY=Z5yMSFv4t(e)q=Syo2r~`J z6@p%`qFN`Kqf(fLjTN!o&{!OOI)i=O^?S;eSnu) zF~pXF?5Lzy&Mmkh6}#6$Z|cpo`kheVnm$*zQ=;)C15(F1^RlYDiH;zQc(0a^`y$?G zZj7O=wA2O(@3^JNMOCVQ*U-@2&=8qCVK-VD*g(94HfSwbt}1FMq@v$!CCLr1b5u^& z5YP7iDp?!ux&m8ydA@+o%F~t|VtE6xwn}Cu!3~5=-PC+3P`u57eP$e9)ECmpu#P(O z$_&W-#KpAq&G>fyXvfLNp&uU!A3@r-H=NO97ay2@d^yynVyjjY)bq>#a0<1^vKoyH zx!3tfgXg)=!Ffh8^f-y`n_C3xd3VW;@!T!GkQO+-C+`*2fs>!S>K0!B*nV}4)EhsW z#nlGsb2f^eapwfnx8nAz5LCS!G&rd!*%Cbq<|k&`*o%mm>IibeP8tcPKubANir}^1)Yc9mGUDVb(~B?9#O*X!A`y|>a@U~0 zNl&!s8eggt2bk7w_m2jeYILs3+|NN7fNncI1ts2ayh)HnKtrLm=TWUZ;}K6qSdXhd zYfi7HNUQ?V-;ER7g)<#88?E~k5>nVO?Mb0xC*=FleCIs4GsB?H|;u;9aq z)3>aLiVC?*TLf+F$qh^XXj5dYPZ(G(*4Vd^8D~c&3OI;NIvZrimDtMmLp3u4Mi=Bo z&LZqg4xA1wUcshz1LPQ1q~9M738n-t39VrSO49IpV1QNn+7@A*6MS>CfNkAI-!dQORH4W@5bk*ljkOr&5b5&Wq$JMPCgKwTzP>K zU@V|+{3erk{p-7`5FI4QU#7=<4FODn*R53CIjBkXE+v<;peCc1zk@Vk49X&iCY8T~ zA)H{JIZK(oXjLNyW?W|l_tUe}9+(2KWF=&n{Bc8pAWX__Wdwe=jL0Cgj9_!V zxcBQku*hvo*gQw9@0EfEjf@4G;4Hc2)89OVX2F1@;@QW_e!cHS(6W+|Yk0bqc##Pp ztX!KLT~~Lc^4%hw<_#eYfd28AW1Td})~Art*VVBIv#!ZBW**%6IX9xb;ceV`So$94 zDO1c|Yc2My{mBsF&_b`;n3R}>58RSz(Qb;6od0z}K<#_a(%C#_>Ee4e2{q9zaaN@5sT_W=53|E^=Y^KDwsy6a zmF|dk&atV>>i7pVRvO2Dv9J!8ERk4Qs-_^X)Iv48(s(Fla%ua2sBt}J^+z#o4+-!vL}dIJCB>f!uf#fG?j!RzUJ zhkiRpa6XMQoZi|E^}9hgDKl!VKtA<0NWGxfuX;_T`I9BVPz73N2H#hehT{JA%63b> zblT-DBeoqz0VZdd0Clz)ago_uAb&1pXLv_mW|B>ah3_YarhXy}|2NrJP+Qx)hPK@y z8j6hSKIWB^@=|Ol;5a%+(w7HLq_gzR>Q(ICVke0!zMMCxO8(&2SnDG%&mbgqua7@B zIdK(p_-@o)+Lxsi>I_=I-gNp@%H%quq`T<-XkOV(aDXIIgH4Wg>~l%xN7@Q7N(^bX zvu=v3UX;40O)X7&u2q2zHR4-M# zOIqz_e#KNHXWfo*;*$IrG*CVf(rawY3HDAtaso}ZE5!uqi`pm%tN>=@P5OO~&4sBn zJ%MX9tH>+@fjgSe+jUNllzX&ec?bPi(w??6dHO2HG;zg7dusZjMU8cjjw4fc3OI4v*s4g|BconODjjk?J|zucwGaTYq5qtayF(tOTC1f`Ye4XLH*lOMm;y-t&Tbi?o$?`_ry@LOIQsn}Y zly!9bw)w9fwfZpcHJjLQ0>c|l?hes!h!XfCMYXvYW=zyb*3OuFlb*2s?myiiZ4wDu zW3~N)*^W12n@yL<0c2A*lvW&+ToLun=i-L%@6^t*!y?BbHaR>mWob(CWQeMj@Uv!jk1d*iuCXc4qh-IUT@SJ1px-RsD zAu0^0P;Qv98is|SNzUa5zqwBd;H+^)t+kS(?K0wrpi^D@iKo$k!0o0 z-*x^h*`Cl#29M5cTbHLKu=$$OV;ya*E#kc?Re<4goWRdys@5~DGy|`gs-Lf(cL;TK zxKrI{k$MN+ThC>Y{j%<}m3!eM=xPZcQw-#YJb1L6WP5%O5%ZnDm1w&nu6{Xi*(Kp< z-bZ~Nn5`Zr4t^1lV71L&;` zXAv>*|GmuP*p1_!0te#NEe&S_L=?|UH?wVt;STo_)Rvdvzw&dj{BTjHfyqZ7Dh6LsP+eD0Xl@_=(xWJD6~1{%v?Pg-tGU z(I1FB!xlrHr0=!REfB~xJ^t|pPn~#gWZG~0hpjAL($)Hr@wg{Q?-A30`0HQ$Zb*;yPjxRzA;PHp9nF+V9Q_^GoVyue&|S1?`G>Ik9t1T=0>rT=ZyCS zRcdZP!B5tl_hNa`>*bV}X8Nnan6(wpe>(Ao^|e`oM7&tL-|`MoIMvwj;LV_5FnW;OWkn zh)hS#WfXbj2eEh6X%k`~%f}!1$HeA}?MI&F@8`jCDKmR-PUn6y*s5LTy5S(z)%jqo z{FOE9@z9dex!Z*z)Uf{e){>jFU$1ADZ$xo|Wa_ep<9GP?6xwcHTP}lz;s@Ck3ooiD zBu6Z3_tGuC`zZNDv>Gqo>!|&^^CT7Qzz43d)BKf>`d>G(e=rl!tAIiS_@1G8R5*de9-1=PbNBwRqun(sAUC&FI=ih2@KAy&@gAu+%QVJ{3HjhU~#Xaa^ zsyTUx9>}Cl#&2w44=>2^rmuh8=CONF^xC?)a9}A*0$F3SOzPxg{Kjy4!I>k>Am;I9 z!SrTV$$GG~N5dRJ#t*=Eba}eJoGDNgx_vstLO@FF9E7LXkW@zCe;4=N^z!HWPbm2g z_j6vf50$pSUFWEtYUikL$4wV1Mvn&zfA0^@_&jAl=bwbF?32k@N4oFH>kICvCOYd> zfGo}Z0Sex6&-_vLu+p=(tFcyy9^l$%M9sy0gOP(1+8hwxF|*yQr`*{bypx}CX}?{& z|L#_B!;p!-Ah?s5vMWij{$gNmZFS0jzZ(jCSpegIaOC_hex5S2KR5{4|9Fx^%ZM|g za)C8t+5fJA;^!ciri`9p7#m@2>IB=0g5m&0$sJpE`!kclQGaiVTfBLV>*8Qa8M7Vd z_viE(g;cTwp6cWmPsGOxQkd6gG9K?Qy1Je(u)WHKTaSGFDYKr&(#GQ?(d0nVlorM1 z^UT4pJEbVsR`PrFVupxCZTqh_1FI}1FVp-@L|r`$tc(N)D|1I_-qI*r)nc3emO3 z2hmJMWhh|0j(y-={$t%6hPQR>h`Y$w583GYE*lCgHv7sR);tvp3^+Tu&EI|Qw&E(w zPfC&&cm{9;$9^_$`nMB*LV<%YDW|qiZN7T_i!}TlYB6A?WcT7KXAxrJjW}|zF_|dL z;C1qbvQ(`Dm*_?ta=8&xZ!!t;cg7lbc@+M%B|*`?r(N?i{~Zk9_%R`ISqrm2Da)1o{YW zWc%qcR^QAqF2_MPCb)yWu`}vyPhk~ZnHD$h2KT84^QPNftW6e24AU~jZNB$(AGL%O zR|&KFut=1uEaq74raH85+y5}1lA_kM$n*L9u3W-Be=Kg|gPg#Mxe z|4L+B5z5bJO{eLw)&_Lgggd(B9-^ z2rUbKB(`|1+Q5jZ;PDg>y}&jwp}~&0)NFg(8FCClYq32e%_0CBwWjcOqu(skiVSS01_p5vELUcp)yeU}Td42M825MtxHa#K?{Y>aRsdw*j zN0$;8!&mBTsSq>tt2R~j7Y%?{(yvktBic^1dDW=wqsiqtkyYf; zz7T_;Eucg*uu*o9L};hjnVkHx3@ZTh|#JChP z@>N^>#i)(<*LGJU2Q*6R%cik-^i#%-8v8rdyN8_O>Zo`noT(}LZj#)WqSA~4Dr)Np zO_mfs_@JC{r13J+R@NG{z&WiXmlDECqB7}UA%S#Hfza@?R40f;OBSFiY(Hs$l0zaM zPw$!gC(~DHo}xJ`83W9!#5$LBsG43CJh%u=@vrp3!&R~Hv-I`uq(K5ImYe_}43E?V zUjLh>g=cBo{!cOd(_ny4;f81HbE>KKdM{&+eOSy>+)Xq+it0UE5T?Iqp&*%0D>&bQ zeUCa?aqz22|F|?&V(iDoY+oyV?l-`0Lq`txj~d~S{M}TTaVKho1C~$srl8F32PfSd z`}C&GRSOqx{X8Q!d2atIBj1&Xdmp>u`ocE2Jwe=@RUHm{PT3rc*6Fj!HG4{8#D1}Z zf^Q53q3nndph>BNW%I){msUGhdNlL#PK>-bsq7ECUB{#kwp7i*A6=gIy)83SK^7uq zZeV9oFjg>exX{mxLxKsV^co@U$(vUgyZ()2n9>cZn{y$z=eA>82Tvai{-p`F7F zcDUWEL{+R0@PW)@%o?|%q}6Li(j#_PvCi#9?$HCzG1kAdBG+%%t1-#01OXEfnrG3L zt})I>7=QVdorh)7M!t>TkTa?)IowshKWkUt-GWvoh#ty`>eE}0GwK_>)AR8HAM z^<*mf*uMMj|6C5ubqZS&o_{>1lnmNIh&k=!rj!y^KW`JC-VzWMRpOWMy?Z}< z|8#XQ=LBzJd-sthp7cpEH>&V71r1e#=PzSn72s@Xxb`=~aDQvKph zCKFK}OV@XRr0F9_hFXpNcK zj#zG4e-osH(AJ~!BEC?8Lq}thmI=A@%ifn^LlODXX6~bf}`82+NB45HfFN+uN z|F%+%x;AQe7ls$6iYHd^oS-U)qn~ZcS%ed>ayGhZT zOG%Bq=9?o{nH#qA4BPh$lmm=nj&VpXg4 zlEvfIzKp}ZXcY#x11#zz9B@+ib zO(NnfDJPL)S!ZIB{tiA{=xyc@CW|s=>*o|aaK|V%peEIAlp9WMa2+Y-J|@MjH*Nh@t=G$z{@;IrNh?zmlqtpVq~sh zEsz$RX867+k@8oT1$b&YekHr(LguESC-6=?z?wAYVXwD1_M+AZ;zfvqO4ab!NP!V&iNAK`ES{egNYM%m)kKEmO$9v2c7h zsMyBOwDN(CB!50@b3pk^xsb$$JOY`$FfyF z#5>hi4=>+XoDEy=t9N2;3}oJ9RVz!8@iQ@^t zI(!Mc8E?QWQ3@Mfh&i%om-|(6%$)WPQ14ltXINMrK0V!m#e8 z6ssYQkz;`G&;w8!#zovp>g7aLO6<8Lg`-%+F-reTsp%l$e&w1v%E){%#pS~~pMej4Sm5z${jv}nWV>e=RU$OOK*=z@e@3YZ= zj8_9JMUVjWbQ@^(d%2yTO1hTsqbN|n)v>qdFbF+Xj}wa_`pTq74`#b@u@A?U#NJ9b ziGrMeSnnGe$s{J!gzptju;$e=8!_A#RK`EsQf?0q@cT*#ZusV$Kum1G9WI>6$ObI- z2vxWv5B`mU5arRa)yI%gtKLCM6X^@$#S%r(iA2jeH+oW& zu?@2^tZ=S3ehvB(+|PQ8VMc{U;e>{9Nxqp6oX=R<5{#FdL#fzsx2iuCZ6lQUpg|=0 z4C7S{j&u#~&LY<_HA;G^FVJ`Jrs?J%#L*kAbcfzNmPQ_u6KQiQ0 z#v*;bOpg`hI>r1xFiuq}UX6kcq62PrK6=+vb2sf|s#MU`ENMV3z?h0B?}LRDUqJx4_pvbER#dH z_?~y$ihAvk=#m&jBiucFNQo>L;}MUprV6mqH$5(PhE#wuwhs>eA6;)9RCOD*;nEG8 zP&zgtC~O)5=?(=^Kw3h&ySv;d4N}rlBHi6ecXxMfx?!Im@9X=0-tBsYl>wtFPPVbEI0);fodkGf6MJKnson zwtr^_l=`I`kFN8HI7MEfd%JJf2$yU(ELe!jp;lhecpOK7PR)zJH!}eW!{hJ7str7DNYTJ=23LlO^Jd_KrAj%rwUG*O zOZkY6(}gRFNUAYSUR<rga(tyse z(m4GatAcr0`Gf~zv0W&_brS$_&2i!NTkT_S=`UoxA|~U4J_{_>N8r#MFZn~wR;h(x z*Lkn1TN)Tfj1#3^NTg7Xo%;%p%}r^{%o5!?vP8xF}cK9*O<<+93QsZOy?hvRBZA{aCvzJ zFPo9W_br*Z12u|s1d0Qr(VYFD*3pv&TY_94x#U{^8lkk3q5a|fgKrhx-E%D#6k}WV zgoR<%@(&$Cv=8s!+Rz)nu-57^-`$(>e^qn;Ve?`&JuTN6?9{ptM){r}2%R5hPz^`sAqwE(i*@whHDhHo& z9k7I`jBx}lM&7i%kJREb70`JZQ9K)rpz|gLvz~!;N*Sv^kQIB+s>=ruh-l5x^36;4_3Uuf?|;K#29n!?6v6ls8TQ15eKIhiN*CfYuBBl*v3tRp$XBb6RLT*7=sp9K8MY zJAshCa+PLr%6GJ8nk&?81HxWMZRl)b^RfE)mxsiN;`3n2_95SgQEU z?CtR?IcuSKT&Jz(#$k8Vu+H2%x!_uc$b?(f0?Wm??lh;{R zRHO5DI&3WPOM!aa#t)Fn(t(dva;|pbRGAaT_enzPLShG#hxh19>8R9{qb7UFw!CED zZhso~m7n;BY*?g8FKJbu&{}sjSaZS>Rs>6Ax|580d3RF=0X)qcQ)h-cO1$T$iKCTt z6mQVCDw;R$bId&^@BM`E?EfA<>2tj&Sn$371|RX&vV-&Nem!? zV$-(*jPNJ>0!9fetSf+b_MPc=2Iv%5z=Dv+=YCJm^%=3>kysO7;C8#GP|a}clDZqa z(R?+x=Ff9v!QL=;(4LJbIf;I%BGD|%lUlEI4Q#`9W+J+mia7yaJ1nV#{^HJR+e;#V9UHiA!G^tc^;P>Gq`lE8Qaq=n}p^CHTot2nd~*yDRU24 zllMrvn;K7no0uPkEvUTBLEMOtZ91NKpo5XozMgDn#i+E&YH|JKvrz%hXj;DRWF7OC zpt>I4nD|a-+ph(S(B2hMlXU+0lY(;$Mc3-uE5R8fN4SRtJzqh-w>dX&_!#b6;~!Al z-gkR9k?SmSbE&;4>-wi{s(psv=O>SKJ2P^)sv_=uERtDy;eT#9^NbH8&UQEibH-eD z61kUtfQXG19c8!XTuqh~3XXL*yv^8?W?7(P)mP}7e%9tw%(xqpGhrRx*^lSO02Vy! z(YXQtVe@wyE3esd4tO^hzUSy8S_M3-Ybo^o{U40}@vFNZS468CfRF;JyXvANcseqi zzVwjCmB}5;3q-NIu{vr3xIc#Mr?3;6mc{ zYPZ&9)O@j}+a{bwBCI3iTa-zxBSS3(W*}dxLm;S>0njsTcJ>9RM_uAHR1W7tJWbJa zWlA^Z1Ri@uHMu?rQb^e^B79^K#QZ>@m1LuDWlOeBk$#r*N(h7%&kR@ebs#ud2O3hP z(-;tiEzz5APLggicIcY( z3qOc_%Zh(?Fp~|Bg*=z6=G)yYc{5if%y>?R+b5c=#LS)B=hK-RNU(*l!EEd@DBo~1 zNNycdw#PYG9g`5BV8mObX|ABSn`V^n@O4XZj@FxUje&n!nS%F)=Xau=jPfsDx$Y$8 z^Obt$KI+nYJbh~aT~@z)>K%BDBVMzkDYFJLD(3{-q90s{rEaWv#WZ4Vbv`{$egr zwKcM;V?)TPxKd5*eoqzDjWWE^*`&8};YSq^?156IHJncq!L^K+DeQAs+i~N)9W5+Y z6K3f(U+k?Cit63s+Qe4$borG?O8PwQk)h|Jif!|7s;dVo&{#@pkk-&(Aw7`4xp$#C z@73|^m?y7FNqU*6#SshYk0A1$*p~Eih#Xesr^_G?(2kq4nP3eZkE#12vl+5U)Q8G? zXB<}k38{=`P-7-N??#NP)j2)PrVc<@sx;`gEsrUQrk)%inBA`1+KXbKNwAsmociPI zw|^)i=A zXnHV&iC+t1mruJ2d;J!C_I%yF7#-5AN4?(cXngG6{L|D~qsQ4b8N@`L(Dx9@LiPjR zWmRq#L&VoPPHfy+)%bq)eA!{rcdR;xC%*43I&?%dqn>;6W5f3zlB-#B9`8Dk0~_%3pX>)P^ZXN9 zEnlquUm=!vkrwxO6mi3R?e9Q!?^~Sdv|$bXwkoe!b)qjrYz-9WRh3B0o4kAI+A_nQ zUkzfqx1gMHxqPoe3 z9w(``f<5NaZf4Hc9JE-#Ul8gIG?+7-k>Z=WRRNc5*Md5>#h5xt($;f=q_x z>BnKGB=ebyUUAUcKr8YrJA)2#ik@n$@c^v-^oo z8-fNV6T8!%*Dlw|V0?oI6B84=wwMr`^ApAX)K)3p>G^T~n|M_UABF?J#R|7cqc)_x zKvBMr+{ct>fYlPKetOQ{a2(gI4l%^bqdQN&4qeDN3BsG-A+E$KrD64Y-*mAudojLu za$pnOR^guaS1O6NPsw|Vs~?Y!*8aqzjc z$Zu=jwFh85A?>ris=Pp^vHUQt7|BJR+)FOBK2Bm+rudCt?#~pQE%es!%}UCdt<&ZT zyy^3LHum^0#%VT(tpDm?{~3S&M^SJ2rVT_1$-|b=-_-k21%cOew0t%>r5pvBq0=rm z$fgpP&5*3c^dOSKwTk!PVtDUDQ6RD(v$rC{qp1z!L=@6)(C=wSf6ER)orYC@l)UB& ziOi}<$t{-zVcq|Hc8T6`?yvPiqbhs|{6vS1L<>S{E>%-tSq*)ZlCDUbpoh~7v_kGD z*-&Y(+`S!o*X@G)kE41tyIDC8XN8Ha-jSdS7)t~CSa+<*re1I(-@@xYfwxUml?u#9 z-Bn3}9WrsOByv6#e*#jF1>SJu7F6ysBEl;CR4DQU45Q4-{QB|nvB+@?e)Cw96SYOuz(E3m@x;wtm#A8>|Py=k+ zm-BR2o_<&c=){NKI6+d&YPc9`9D(?<`dg+bQP_4*6EG7(^2lP%JHlO^(wAXo8)9S% zpt@vqb9BdE~A|l zyhZCCEcZnNyW)47TrGmhORpMl$ND1#tITNKg%%{eYbUB}e+VDM3lTIs8tp~6y*i>K z_0y4b)U1zqc%cI=+-&=yXXvxZ>%*ss7JX^>U@7P*oZtAiG5b0}kwMXs){vcQlQnol zl#l%FW_{kr9+wdyrPBFN#L!+@vZ;F9kMnPUIQ|wf0qd-+x2{ zy@^X^>szI-z6tO3D}1%@Dw-*-Xbu7f@o3Ln*Cbcg5A{dazSs<}&J+=5yKOe){LCGU zA)XRsEvY%n6bwOO+zY7F;n`aWkx7n@FO_nHZcEVKLFV@l>1>WA*Vb=K>D>^hAJK3AhgF9odDG)gBQ(yZ zspE!TdG{;1jMgK~=9&w|6d|3OyV!H%Rq4vM)Sx~G!x=Me=Dg5GufWl2`DXhT@?`z3 zq{<0ZnJ0LAlU$W}y@s^0oF>=5?l*KsIX(1k$mZDYd3J~uya4;9V=KHG#@Jke}k49U*~Xg#Zhdu+bgcsLb^s1f9W`f zt!D5QNk%EPw-gy^UWxWT#!G_B-wOSo5u1PF2l}^p`1knnt@!6Pd}?_~7ZGl#W7J>A z7*=k{y;)!s!Jk(C&wtrg%Qt#t=RcE_oL zJyzZy7Rz3gi*tl5p8(5f?7R`~EA}$tRQ)0sq+P865`j6mZ-MnmlpI1+trlb%dZ~OV ze)%?4SaN$J!8|7=%yt(p47wzX{xdABr@Vo_QQ65U5{;f4FeDH&%2O*G!Xu1e$dE2}M01AvYn4}x!Tsq#q4CB+tVCZIL+a4nrS~9R1u0Y}v z`3AjcU{i6|PVBXNr42RRiAgTS{kZFboiR5bu(<$q(6Zw=-mug5e4^x@a;VO#y64ci zIJx3kQn*8mRcGgO^lEGS=OYhqlNtA-s-0%u<$0W0oX#g2#m@CSe8GXvEBk(6^tjRq z56vAq;7Uqhv}e3-==P3zFQTg4ta)Ldx(Q$hsR*-ZpuPyBZST9xzDw?i$<`UoC^&Q* zILj%W+j{VGkufES3UnzP*@gnZ!GC=`kGap|)alZH@$?t8`S%JdG5nWg2WJ5 zoVy%za?f$UsE}sgq19==ELC3K*smW#HkS}-wW)1CM_e31Z7-HgofO~JGnal?dN^2W zyay94qwgKNp|ycAP#*|h9opv%k|25*?0zP2@wSho!9W|Q@ocidT^c1vXnJ{rw@_6t zAvS&9spz~w$M?qJ%yhdqQvo;inv}jut<}@#C%X-SOhe3|Pn|B)J$!}Ass8GtTL+0s z&#Iumd63!gA1%KGjEF{vAD!4LasW$OuIe3Ol=e#wZ#Nwlv zA}?7*$BIQPu4Er&Xnn4du|TXM9um6y<_(XnNWVNy|K@;$)$IH`f>DF~Jg>1Pn|JvN zYo5t`J!MI3vpu(r8=8wKn#H}}yc4e291ULNK_XLpsxtdl^k1R`O8S4Xoi8qW6yH$;)`4%ABXuOd6i1 zi1cF%qih6&N$a;=2{`C<3mrLnIet1m6O@e)U|2I7U3B`X?bNCVx{DSou zcIj`~cN%k*8NoVFwtn1&-V*M?S0&@;^}e&!cl-2Cw;N^rHXIb;j$5;rT&qKKTsw*? z*f--GsjFTsgD;?F0tI(UAbd@Dev~o?w ztC4ED44>6^yo;2KNnA?tL#}^@)Ube=no9;pY|V9-bT%7JlhGPR^uUgr%wq0o*dNl! zvwivvX2ZhMpIc=W=UzhJx-K@#Lw|M(%DQD9+3{UI1denQVV2*P}Y&5elf~jks z32DvjJC(+2PGCDrG^u5UdIy{brfOoU@i;;DSkf`5X!krWw|IoF`oF5W3!CfxJ7*Z1jNq!<#Sv&#>tVaA64$l%!`ayQa2{5`1ltL(C% zS1nGHrOv`Z+iMu9y)HYXY%Oc&$z7HO%C@LH!!r7GEs$7c2eZXpRubBFxo;0$;Zv$_ zTdz!t>^bcqAqwbKDdXGY(xk1?p8Zy#YVes!|8w4kkqJ#(U48&N&03`oQq;`C+t6u- znf;H+E-e;BKS)bAu}UQHFq)q(fHeOLl@w70+dI#2^5k9@T@I$WM~Wk8zX}9fB%=krL(u2X@Ty zau`(V*2=cNOyp+m=^YDjCTb-Ge06f!Naz%+E*#Yeh9XX8HxsAdhzscmv4}&VTiOsv z7K9Lw7<)>t222)qS@!(m&*}I>Y)8ApLyycj!;q>8o9+9DN=-K2=obs0I`#_!69<5e z2vWRp9Y1i%;mZxrhiobx*QY9PbZ5u2mFn2u80JDpCvs~ohQ7(}ayHnUjZJfQuh_+` z><;H0bETP{w%@WlZ?D|i9U0uJonCg%mq|C35Y~|E*;W)y1$sRn@fFMEd~3LJxg%EB zYm3<>$vYeQfeia@>APVy20Eo3o+glxSN@~rx5Le^|6XwarRUU-Eu=?IPWnGyX>3h} zgU2W;I%=^P66Jb0y{ZYenua#F#^hY2OpK`QNHA@|>}u1k1Y%O5EX<}6lqNj z(@zo;@w>pMk&fhALDF?f%M!xJ8voEZ?zkPR1;MvORS_8(^N>RcluR0iw_7xM*@@)D zf+joxmuokw1hXC4SD*SWPq@BF&Dh&c)+soaK@}56*!kvfjaEfAzvc#x_BT)I{7t}; z;)|&-0p8MjO=getY~l|RdUiRK5F*~sT-<11{9072q2Bt*9FiWt^DR;Mq}#t_?1(WV zWQxh5X4xcma_kU!+u2F9e?wzpQLq`_N1LbrjY4xi9486r9mP-VXnZ8az}qWIQgb^i zq3q3xt8F(cf_@*ypyvUI682CrWq)=$j)Sb7QvKgQBr2GQ&7myFkk@WXr_b|KfgE17 zJG=eEA(TC#vNpn}8>w&ah(1VKjhAA{$VhSze(;)S*mTj+aP)#ktovm7#@}AchVnv2 zbN)y}cNQhLd0SlWrqlJ+{aL?{<;Pi(&NoyF$$V33efsH@p#7|BY2MTPk91@40RAH+ z--5kzt>bS&b~J0Vsl>%uNBq3 z2XCZrT=)7Ssa6XRf9Kn@8$vH@ZHYkL@~bxf9(%JGA->`DTyiT@-?TTmPosyfm;9O^ z`nVNZsrq?(O`e zriirg5^jA?<~xl2W3cedkI)4~X`c>HAf7|%af^tih2S#D*Lc|h!;1CI%7*}=Xz#14 zpQr@0K9wOPLoz4X9c5c9(-Ajycl`ljXn5>|>M&R};~@P=sSgz>zlUVuSM~x(qH0~x zz0we%e~pQT@tV0*Q>JuM$-9*B>)k?cu>a-;`sK~aJ#z@P?>F|Fhml+<>g^<=sPvbS zL^z!TET#BrJA@SmznK0g8U+~n_z$rPaC*rM=SeYlRYGtpKOKp}x8PRoXqp=|mmJyz zg)zqw{jrxzzAbGMh(#nExZXCurTW&9lmdIc&(nu_)=K*Ai`<`$6&DkjHPaW{v?1)c zi23Ube=8!|PtDiyBP7OI-Gv3c8=i(aH17X>B@|Iwd6 zM7XtKmOSwXrH>x3N@r*6b$oM=MGkEVw~WD%!#9_=T;HlA>K$%Xe6nz|K<@o{LZiHW zCvUw|dDVLN{OkCt1QW6x`c9%fAQKJD>V1=vEj>cXMp9(EnM!!CRVb+>9Y{0lqP;6P;639K* z*lxQnT&ww(*CKc0B3KM1=PNGx2~S_VJwN*sU>3znkrFgP*KBb%Zm@IZmJpmjqwu|iNzLY~Q!1kFK5f#lY{juOWA(VyEuz^6Z>BkNUAzA9Eni zOHRm^TMIqL-C*-7Fl6x*`P^J5KyFx!YkKKi4*d<aeDyYm-B8>0Z@bF_13> z_~!+)>4c!M&>=3p+=0DTUm`h%oQmJW<+2DY-1Wuz^$k6H9o2dU!bc*g7&J4|&;6dK?iCpJV-R4s+ z$D0pxIq9a@T?5tAar0$Dcd1nT%>&$g8easL;hrE49OKxu!y%)iCJHD_dL~T|kFd|f z@nfic&-Gl9X?{(5w^x6lkSQ0M#^n!6;bGP-Dg!>|C$HCeV!uB2!#jn z9qj&h#BWUUdKsq-g5hJ;8bAQhSU*-lFBii9?HdD?PRWVRm7eJT$Pz$OGOK*0^k|_5 zJg=DtqeH;Kz^yL8JV9(*~Ny`%z{ zXmR`O3o3o*$08Dew_wbaDaQIlYzb3y*?lU~rELFDefLM8hTYFoU zP=u5zA7SWImHz9<$i7SvS{VXOE_zZ1y1Q7xnHR&;=h6C8dXe?gkpr&9=!;{vH?&Q< zIbNTkM?j8r}=3`|j)5*~_2{2cO{0rP0)Q>LL%Uwc3o4P92siXfv`{m=Q@ zFMC4mGC@w-jgEDHJ_#4c=<+4(2=^MyOfLuZY=%})>Qq1PC~4%wtk0xn?`{9U$2$qF zeeS!yv6&0YW}BQMxhEY8ZC0|53bat#2(Pcwsg68&4;Knc7;vS0a^SH%3n0v%Ih=5Q zD@*P4c?p`G044S&uT@EZFJ{bA?R1#v5ZBFe3QXVi>wm7avo&5q3an1abC%$B_rZs6 zGj#=ck6dS}kH_J;QpU1gDuJZv(BqdjGTft}L5f`(Ht^|eDjO*}88yFk%zADU&?Cx)Y0mP7qeqqfwL(nOfbNjH!G|*U!1nR#eQU>{s5VAu2! zr_kyMlNN1;^TR$?ThJ5m(1YI@?@&XBq!&Kwln}prOGq}fu&}&K!O&Zd0%|^Yl zTu7Yh5?7eGR-zZbp?P>l^NaP5AXiL!DhxDIE6(@!T8zkdrYOekJ!II7RY zytw&?7Yzi?09U-&kaU*Wc2Dzy^&&M+6z4bd{dSO{rjI@~r&!Y;))hy~!ZFvj>HFz9 zkte+Xy^h;56=ACrB)>iDeTT1xNsfsMpz-W4(dAg`mkHW&kzn~MBFPOO z*Ca#_F0X1IfZobU8TQ8u9yWRQ;tc@s{nX6CHk4xkqz%m z7&(<`*=@5Fk?0c|20&2*qj@!64sIenKckxF_d+Y>L7AouyYgQN)N9Y5kOmEu+Ch8jmB!Ea&a476EzN2rIm8(Y<1wH$Yr z+6^m{sU(#RyS_r;SaM^cKmrM8vF>n;4dC^&tJHBe+8c)%$1lXE<+1FIR&NNbHdP0< zVEX3UXm=ZrSIt&39O$>MkU+nV$Xa($d z8Y(O?U!q&$uk3Er93&AO#O!6VH43!$D8lJPTzlz z|FvhVM~WYV2`Jegqb|An0Ok)DviSwlZkqe)*Z~>}fM>${vXSQ3pq>*WE5c)(xO+e1 zkhYKIn1`#E^8n;iAu-lZN2yvJw&e8&TdVD_Ymz$v>0DdHiV}!{i$(kvaQr$%vf|;DQZ<4I{2+5F?1OkG0i+A z|DDl%NaM-%N8A z_vnph`KRCepN$Jp5fC(Z?S-Rw1Cp|EQeTKlmU_zgTrv2gB5QHC@)ImG8GJv&;4o}I z0`O8i^@<^X{)~0Cula|@*S;rJV9F+>rH;f&mpfD3OW)v-!c0Sq{^@&Z*q zGD`5y>9PaG-W;UwHh)<9fj6&53=Mt{3wNk!WQ#9N?h;F{ns>^uD)6DhokWarNo2#z zRY_Lo>M@Mj(>Xu=(B*kv=sn=TpG=bT~upTYxl| zv$euV<(>V&ekl7rn|{BC%5%+8NA}tv6Fen63z#tKn(TmGhHC_}R2CY~`OgB412sxp zpuqvuH?t{|u*|7H(6t6?w{4HL1sOwQ~qJs&2m$5L3Se{{X(_pZ^`+h5sRJOZ{h`MaR*W}Frfs`+9{7` zgacx*w(}$;qp%n|<>oT+Mkv+6T##k-a1Ge)uXbZGK69M+&)%B4P;HPePdnGN+ z1`=y|=Lq;m*a1*53FVDKAL^$zKLh5_2U$`kVw`#D_TH~35b_|;pmOphMQ^*g2_2Bdon?tNC*U~}@t4~4dCM(~VwBJYl@x{u= z4J4R6yr);R*4MIO*2;yfYEJ5^efqK?qUiWMOW@uEWhP%Bt2R) z0Kbn^Jn#rt{fm}*Y!m-mkHM?1U;*&>&2w=)fX$@JbZ+aF&w#X!d#7|Q{siL$K@J)H zj$UjDSQ)q93qA{^r(Q>_6>9a?P;l+r*=7=PhybOgsv?|-)w-A_Q2;(f{j&pLPrSW@ z|GK%8FMf6a!E!*_rRe>R65p=gF>URI|KUFCS+Nt;4}a=CNe@b`&t=0>PVw{-tlnt1 zF`*pi%?;E|gB5?Fy2gKKIIv6h{QKw0n~&Di#27ydOs^Gt$8PU@&J@q@u>1EW%3mV4 z)vzj3ZCCK*rq@c5wnp*9Q&?4iuf57Fb0r0yQ9ufxx@mQG4UPR8!ivEiw-C>^zX&Op z<9M-6F208eC*ueo5ragz@Yc(KJEUi2e5nQoC9}-&G&tQZ7hDnXqi}^lg(N{kQD4j@ zu+bX3p2p)mc8J$hO*PoMPedz?31risd!3cHy?gDWiWmFTC*BQ?FH28+*~@85 z?pm(ehr;8}yW4xh-8d?Zvh>Mr=GFR3_(&d1ohpFBI7M^bbaQUnujM-{cNA&cMMU|M zPU&bOe4tP~fmw%k}oZbh@s@=ee> zw)Qh#%oGi)b7}U_E)f-gI3YRdS&iIx*^;+L_rFcZD>nS=R5aU04KVy}%R^s+N^d=S?k?cvcXz#&&XVTPj7EoO zb0mHm&QmPN*ycy05&FTU1O^qoGXTyZFp*om^&B|{nwE_QJ%?_Ux1Fb7WYcwFG3b$I zSuZN)_XlZ_i3FqIAz7o12GJ-W+xPHCLhc7|U%Zo6Ro=K=`Kbfzj6*MjDsT+@|;|I-kDYl{{$3HkBZ;DEGIToSA#sVEIR9f;L&zl<#;%d`vhX#w0Imhlo9 zi@f>8RYZ1xl?dH5ok|J-=C#G~208?CO6B5FSWe}2AUp**+Nb;gdKgugrr+i$Z-WQ{ z0W%HYXU1Z;7j~g3BO*#$q6z3C(5Ack;mHu*#U6c^LsiL04vNAqA_?P<$kXCpmI#z) z>d*M;`!ts}Uw@rQ<_Rm=73lI{u~A_P8K3W!c{=BSI=5gbg@RJ@*U&e-ZL)jOSZ_kGs9(UMB#)-keo^v%c&2xagfiokOl9ySidcYC8c>}f36LoheJ(>w=G zpN~-A4#xkvIK1Tl4mfv4)M`ca>E>ZDJ}(Shs%L8sv!3q+~((@i;o4U8|&HXxJ3DWYA2V~yk&_?@(k}RZ!tdE zw{%s+VxDxJGd!KXzXB^h(s#M#A(2&iO3W9Ma@qbJIvE6rBk;>*Y#pN2g)hMYlJ6{0 zzsnw0NvfD;t0;COu|;t&5nvpPB+Mz3$KZYE5|hh>ZvTZvWueXFAez+*iq3tMGQ&i54o1; z^-}&^zArGg>mPC19Vt?{DEsij+d@5|dfT9LPK=1B;6xK|mJ-&K8uje9!*m{IZ%s=Q zCvWI37h3ZR!jTOP-(mv1l&zVQ`iyF0azCKM&%o-A@+8v#ERWi7m`S zqq@IBh?ntPfi_RGKX{}CLL_e+S{=cu_Uf@D14dU}Dw_Yf%36x|GXER=>1!r=kbRUe zx^DmZ%vbM`F#d0`Uvhtg-Y#mR-43@9g4(bQ5Da>{YM1JvFP@WO#){bd3cL~8z5sx4 zm_l!z{A+D%yFNVW1GYRntqkfv>+`=H){Nk<>hu|XE8;mH@J?T|+UCMra5zS z-J+*KPd(VN5Am8GZY;Ha@oAMzi5%&k_b?Fdug&{hRHWm!<2Vf)wCV4r*9zN7w28t` zMQt-7uGnZpX~L%hbZmXnl0?@(Q3EFG?T;kvh^a^6TU&k1h=Yf0#cwcv$8A8eupEzMBE zL!0BpwV_9qQELx`@s$7~{$-YuQ*163o5cokN$YJoXl*Nnb~iX9SfoS z>Et<=y!As(NygsdedK0`b%E{*!%#Y@HGn-=X+VzSqk?`sr1rqV>FzL zd*bi)x_B9lE;*$4vo*K*)V3&R-u(oyc1x<6*vD0Xk0ZM0c`O%JUCh(Gdo{ARCyM1$ zRe!o-tXHO$FKl(m3JndcE=6LeJHw6l=0kmU8_CqTq)ZCjT|-Q-8&B-2cN@;^>!&=N z70%PK;)kj^QhPNwIhVq(>AiX5xHrsCXHAs5Fa$OoGBzm5VbMyU*9tWyqFH#o!t2hh zv8zef8+j-CJ}^R%1+$95-2Y73{~J*MJ9Yo~I$Z*Yvmt;1JN4KdXaRt)fc|mYcT|!n zJH0LvnMZ`SYVqw=v4sHwEJIIHYkO^4bTj;Hd}K%HSj?MxZ(_?SGBOH%1YsSqUg%u` zN~Z5V0nE5_0u%K$bH;}YDQ42^V}mN8v5#I^*zP@JhlhuqcTk_Fz?Pezw}GXq9FT#~ z+dyF3g9eM+$+|pxCc;pq?hwKhdhH=BIR-1kvGX(y*ei}?AIt$5ZvnR~MbY6Jmhgp$ zi-OX}Us8&WXCkW>oEdpuYr4ifHnY*HM_+H?#g_mLpxBPt>q9H*7G?@j-hd z(v;IxjOIx$1f(UpEEuG~rJ=!{I4d464@m1q0iGzXUs_p^$XITrELUAS`Y@{desZVX zQzdd?aJ4C+>qwT`lNS*meZ?on5nv^Q7`Z(s^2@zN{cP0JdWyCthq$6Y_@GkS4V0d_ zA5PkSd}Ls96M?uT+LCVWk4bYEJPoQ9?Jx0uZ=<7NA884x7arwa2VEIvn@T-{rlUZvevGv{a^RDsiL z%lWyldfHx>{MPmbWV4M2?%*kvhF&*!?l)_5c0LR`{wq_om>m9EC?smSjtOBoG3yAb;!P-gy|&PHZ%fRpGz60n{2_A{t1(-Aev zuU;cNr&#SHwHd~zHXfz+PyQ|F`F{1Ew4o~(`k9WCE=sg#(-z@Nza8LmhD#!a7wECI z+Cvv#VM4WkkN|g?>D&6d!|&@U-;Tr#ljqYn3D7=^vgCuYg)mzzQyGY!=Of?{>WDJ{ zi)(a2q>OC>$B0WzQ3+Y=0ky8m{=5Q=rg<-LKPRy3@!lM_t}{w9%Ap}+7?gL6eW^n7 z1rfGVKkm)j)-H7uLaA$ot?drkAtKTNXx+vK(vp5UPD6=Yg2U7o!P2PMN?2KxQ6NIj zKgO^1SS17!Z+=(WE^rro4n|G}2|(SB5xK3AFpNTa+V}3Gt{68?yx+n^2R&b{mlY3I zo23T{yFX92j^`h05ByP$X>Ww=?OwI3pFi|*<7}h-Ch%gX&xlpxW|+i*_n>3Z<@}Nx z=tLj@tG*Rx+!`u9nX%7zNh=C#4$0i1;m#k@V^p(CL}-3^QC|p-h4d%Z?9nQ9>1?^4 z8N6|{jR}u0IYr@$-8#7C)*iVn=7cE;hiXzpwh|I)nYIj{H}^{U7b*@rr{BAKBL3 z5#34VCU+aw4!7#e>|LA{sypdEM4S)PA)cAu$uA2{XZQwA_?HTCoGb%L>G0OeIF>Wt zN)d28=4YV{M~3%ed%+@Hi(8<~JcI>C-~MEIR0v7^*vE8%NotK3%d+!YEm|>r=6hW< zzCt4SdD1r_Q`NUHCEuIaKExaS?XUJ5=sOq=unozn!ti%*u7A{|txLILuuxsn-7}y4 ziMuq-jx|my`2`o%;9o{=A-)6>X`=$v0)BJ5nmMba>h1pW6_;nU{5`-N&qKsI5-W+6 z|D$xG0m1()r&n2IfTSN2D^2Lb-YVx`@`TSY(}(MuPSh=f51*PsM7+^x>kry2nMK?s zaO2@J8O*E&a@j05c_v({1R? zzM%QUAVhMYR zb^-o7UL5QHO}ih*#ws$};lLkfx}vu`b_QB*VG$8(d-Z^B4({^yQ6eTiXDnFF@_r3& z_1?ZLZ-nf?JG}z5oxQFgG_;njvIDI16g=D7nF%q~|tcOY%N%StaDuDaZR2`CYldrgPk`cUtROME3Pv$PgWbK8Q>dc6j(i;?i zeIP_RNhR2e*4h|}ANCax*7{MK=$JBgLcJ8j-MfX`19681o>2*M{n&p_I>5KMg(z>Y zz+ETH|002rMN1)`z}8XwN@%uS9-XnT_gm-VSYf#(iUwz^u!7UFuD7qBd4(vSwKg3o z&L*B$XwXyS8ncW;LI)b65GYv;Li2_7nPv#un2B{wAe)Jg5*Om86vPcGwudh9&g{fS z!Na#~h=naiCuk{+6;s zzh{dXH|V*FNVi~J_0i4cWw^D@A4i?_qZ+G>xpf2D3dbwi?F|Lv!k`4Bm0FWf#_ggUGKcFDfecmu3Wu5s!eD z3Ff5Bjb_W^a>s7` zUx{yO4}W?zB*d&2wlH^MU=x-kKR@n5i(l(?9R>>`jG} zCST}QpQ?nB@PKbse2~N~d|!jaPl^T$SURk2G_XWnKwZE+E~`8WK$H;EBtj z(ks>5a<(zr>Hmmck(k6T0aOz*^PMqdA`wPmITZ8?D*c%dOOz-KgxdEs@~8-OV(7|< zt8uFM@i?8N0a9Wlm{+m=QML1J&qsMMz*N9?!WhKE^RJbSBz#y8IF2tEu$HOOksxMw zoK#853}7i8^;diIsx9mUN{(zQUXW&Lf0hMqyA|VZ6pJ{!1pSd;03f}xf^EG)`+`{C!9l3dzzu0KRK&V5g=TfQDn8a;u zwEdW&-gGeXVN!9ym=HHV|K{7{Vz+t)f^+R?hO1cOkl;shQyvi zIt>yDKP7!*JylkFk)FdF?(jUTf>Ty&(2~kC0(p+vU9EiY|KaMp!_m4JsC)NC3zt+(B?o*6Jkt$2`Ruh)IH- z%vTHlf1Lt454a`=Pz!$re8hpv)i3{_BmI34kR>xqxR5+>1-yddLgM;<^Rt_uH-AoA zZTvDR-}tpSHTtUj*XZk9_qR!)PqCV>j}W-{LnrpAIqc{tJ!Zj|Xlj&^noQ(n^}MB_ zyy084oc2VP<0^!QB@MSqLkY2uHjEbHIkCoTcI%f32lI=sTUzMRP#p^Le7e%mg*}(T zeo`Z<(w|4GB4SbMIS09p-`(Ujno)?POKJ(=T6YtWy{6w;iI=|rDk4e_iN||dR2J?8 z2c&uN+?XPmusO0$wYI6^DzKWeRZgZYAAyZcu@4gFu|zQr`Z%g{KNgOXuD7JyO0sz$ z8X{u-fqQPn2cz(tcj&5$PYl=KsP$Gd6C+hX#<+AM-*Gg|RM6zGDf(*yZjO+`fVajx zk>R>AB`2pxs*-1WJ4}<7|JjxOmz;#1#Lo*oj?23atRE`S_+Gl)Bf8-qP~#^$B7b#& zlG;4u^t*3tddGkvxzwQf;OKI)`jWwHVe@3l;O;WjsKN8=RV7cK42({VlQ>9?1BTyc zowFX*nf?@vICTw+`z<_MWL*7~e&SI7Q)I88$aX~$yb|X;!}wz78+Pn|Pg#Oq@>Je( zgtH9Z_2BdAp6#~!a_WeDj!@XLWP<9Ms@snjeBD^viPLuj^@0!*4iQT7)4RQstRh~t ziVD>N>7G$ot96UN={Bst`@i)ZaG|no)&Ge@U_3IvSnnC33Ql{y-$h`}FSN@m4D`hs zq4Bcp91l9T*g=7vf_Q9JIXzOo37>$m`o&RBBe-+UI>;0E`{dP~qid+j21U!Z6+-Xa zG5G7p5i4dXf>(6Bqf*1ckxZsjv_sc=HjDNd-i~j5nHs);RZWd!<02S7I0GB}j{MM{h88C6e6fMpB_O-vQ18>Qr@JHF=-i#b0v{G`H z!in5?FDZpCJ`NY8g{M7r40O&s9@c>RD~J*PMv~6i49V>JMQVlj6`smsb~0 zA5Pu793qe7#LMq0mUC7EkSa^jMX;e!{79g!A;O#LbwUp*Lob|*o#6X7I_^?}=l-!c z&KP1Qit5C0Y0>_x-ERl3kVI@fRL<0u_!uq#|B48Tk8^9DVY+XX;k|UvbL~0vy!wW5 zQAhXph}36FF*LISl-m6GjvymOXRTCtn{ z)=I0YdZJwsbUP{HrJej_tR?OKrcLJ#M7}VmIX%E4UNB+X_U!AF>05YB@uplqoBwm> zL_fQLe24@6PdacXF(PorDsshRIDp!DZZIk>$lRMOY% zdhf4GMIt;TrPgaN^8u2tp~8!*8nP?bO2PFGRKV9!*KBk0sQQ#?;9m-1tOvAfZvU_;cfNpKW_2G$bSXN}CslEPNMg2 zMG;^%`!uXD&)9({D61_<#WI7>p7z^NSh^W?FDTcHG_Qi~DJ=T?tApB&5@0uVR`#ze>t^IhtnS3~unycZy^cUyE zZ;3B#nQGbA6^3jHRWe{MH=q4Rz8K8#{Bwmd3zzFa71Ljo%jx3Z%WOn9M_C2uUc6b|hvc(TDD}s>KK2az-Jit2#JLmtJyH|wT38RBuZ{a{>v1Nh3f9o3rJn`z zpdWsy$L4-xdBzF;k*l5Y=5eWM=MtK*Q-uK?j8(i{n)`oNdH*-$z*3u{U^N$W=U{Kx z#}60okRE(t@fR}}B1Y(+*>fg5xVqRukZeaHNv%@b8RxIg7U5dK5FQ;*TB<*g_Z(r2 zRH7Qmaz2oJ_@UA)@9fu@z=)esufo}j2bY#yt8_%M$|nbV^3xoRlP;g07eb>4yjd%X z7+&KW1j4MZ3A|=B+J`J5gwQjBOYL`@>pwG?Tk#Tw*R_wB6j#Oqby(n@BkS(~OH)2+ zt(jiisBQ_d*`cC6TwLO(%ZE`*Pg6$QMl_4UlU^H9awDsPI+K+`1>h8YIF@KGyiCF14 zYX~qUs0s}jYqF)L?1(A~mp8H_j6Qq7*-K(m8(MxvJzIQD!kVzTYJP9l{*+7dm)Pmo zu*zl=YpEiboZ&qFOQ3Cp7{}COox#o4o325Fl0|pn)#Zu7V`|PLPHuyQ#EnVLLA_-z zvaZao$riyx{&GwD5?GC=^wVTVrK;iNXPsUTK|aCE4A<$p!2`Tu3;P3+NarPGBl~NM zOghag3-838WVD{Wa~#-?5ieHNJcP$y+gJ`fCe=~G^1hYjcYP2)4b9|dcsx8}qqWMg zu}En5d~HWo_<7=d#?h;wnw(_8hjO$p?2{a|2Yu~>`Q+ztt1s7?+8w^1avpfuWlobN zxi7%>ui%SoKu>{<{QV=YjHorctK|-9BPbifZ_c{_rXLy!ED? z#t6iU_mo469Iy&>PyDF$%sftg?(z7e@wfbtK~dHrCA+{i8t1E)3C$enp4$)_ia|dN zleK0rusG58siT8I`H%5<-B>V%eQ>6|C^L2UHPfgDUQUs4iPd!y_utQAmxlOqiFw}s zY}|fKM9P2jO=zRvl7i3!0%0%SAJS;p^5b6TAaN@qBEagsmu9YOTTf1awo>{bw2cab{KH%e zvMu;^z4V2eFuUQ%dm=gYtV_A5GvaEGqT;u~Bi_HrChoGWpW9{zD0CHWDjf!z*1r|f zJzJM$(3(!y?l&6NjW{&3(LJJZcoXzO(KWH4Eihryyw4WL26Q9$+%FFB+*tS$4E&%l zQuyQ$@CvMdbmk7;TO1z;q{RXcK8S)RRX;0efZvX*zDgGCBFkZR699p2g?l_sUym}N7P)iK|JsVtYY|+?{m(9;3 zr#*a0NIFlP>op$K2Y{P)jp_BF`B(1c)IFusowgBd5@}k=={f(n@p+C4FBU>)`PQeR zdIw;tr)(B;6CCl73zJ@)&m%*v$wo+Z3D)eohwm&xP{adik;dG-L1*U-Ii^Vbe0#)( z9+f1u^Xkb6&%=4`myT*o(rnH$C3y#o#ymGNBW2&v7PxYHPoE$F-0Bjwpx@XgKg;1s znwb|QH0A6Z<2J9Dz+n@Ni;_6M^eU}5{;=t&w-R1`O*Hu5D0G2g|Jlxx~02fM?G( zimSp-REMi_>RNNMdZ4PV1XZ2hI$SPqw?xMc7g0GF@EXt1 zLD-(y5UZj<8zVMZffr|>=}{{#eW1Mq#qr3)0q`VMFq3osai2XdLa-Y!0!{yqKm0u) zuvfa_{O6CmfI_Ifl`85DY>wv1Q*YMx!t(>js|unOfEaph=4{-k_$ejPCDFvZ;hO-8 z4J#EGzPSJm!a_|DrxQ>|gz;dZPD1POIC*;ZMt=mO^pNg{RROwyCo4bxOhfbPxxz<9 zaO&7CH~H2qq^U*N5Ch3&>LXilt2?>iP5J}bP^}e<)3phBHvoi_@J`;1MW5e_2pLzt zLRqdrL46Ce{zZ`^|7K=_!ICQU)P@(k^$vxN;o+rfqDMwN7a#^jhS1FwWdVBMpqJ?(zQdN(;vN=TqdcJ7i`j$-3sjyR9Yp z_&)*sEu=?<^|#j>>U~GdCwX#-EvvSVXZ(1ePYwdygTv1%LR_(ESsA9Pr_CiW+WpST7J@LIJY;08 z2(4O{vEGmyVwcwCe@)BIHZE)>GqM?x)A|59$vB5?@b>>Hn?7Xi+aOvMXX$Oq$IkPM zv|kJRRrk)i-PAU@GgO=f=ms(;xsoo=BaNa;*oPci8S@_HpC<@E&*mw z_KwkTsN4;G*t^s?mlJWxY>Gv2m*R%B%N!Tj5#)b_8@H6p$ve-T7=q0W^Pl;`Pka+l zA*3pD!L6sBk3*=q*7OR|{LD4`jxWxqiKT}Xm88#LSwG{YPy`Ow0pdA z>7|r%#D4Sn01`KFPcAc*EpqenT<0B1ix2mH&HZ9=72TDs(DS1&W~2@Z@S@(`qL+ls zIT`-Q-#AXD#)_CnhhhVV5bfm5QF+}gr&cQptkJr{%>Ay`RY42Ib)XxH9K*lVOJmh3uMSj$2GaS3@!S})H)<;rd)J6RnI4rziwz1BKX0KB4Qs9+HL6UYFWO9d*ZR1o;$4sa z&+i{X+1--Pg8O*3Y~~M64w6(A`m62on~jQ&&O755z4z11KG3-tN;2Ts9XMXv zTe%S$Q@;;~#IAbQ5bAcA6Dax$Lp}jCIH3IjwW^^?YQh65Q(m=S>cyMItTj#CKLg0e zko$LK{5b#oj!t|(7Cuk#DhwXI-RDJcA=9OUhud~+l zBVXaCgR9XSQYk>zZM2lrocpeee+zpq>bUuM24NZR5O;h~6sXWk>=IyEtZY_Rococp z5Bs?N>}^Xh@wvO!hlK}TlfnbU+qkrYhTybJ{{qe~X6j(3U{(L(s{DZTcuiw@M)_QM z$7-v?kNvMDFE&kI!b*%D+D|{ev=WR5cyLRN^nQgxuSwJ$I7(;Yzj6 z%=BCD6@0m)&icRFp@`wtg$zR2+fhdf?e1XAD+Bl?f+1k#VDX zfg#9EFiRPTIOpm4AeR*VYRcPHjRzF-adb128V5D8;!JuQ9q z2S^Vx(qOxxUO=qT{$fM_q3&nRz8bG*9qJ^8z6kJUoc@Mg|{wwq|%Z<@9n2DTf-p#}F|^fTB(ivuh=_ z8eQ^D-7?RI-R?&}WAff!S8;zm#&@l|Yd&zXl<~->U46Q>>P=i1f6{e}l3P!p-oHm_xdDU?59YQwhBn zG_2k8SM61txq!x-@?!(;LQP@dB`Ej-4(5TgEr_euF}m~z+U__tSnpIdclSrI*$^1U z=b^3+81ez9sb!~5*vlQ%_Im4gJjWO4!M<;<;&3jEgdrPpW(GZ7jtGuyCta(*+WNcw zgv|=y5Ohgg`g~-BMXEv4Mw+aE0~R*HJzq=dVNS{^ApSn2LS2rikRxdr zbwLC8uS6Vp4%-mhJT*p{!Pa-Uwr=kS zfvKQ-VTUjKmt;MA@#@w)R zkNBQvkRqn^Cyakr41bdaQ2qMP07UK~4nLm^UW`p3rg#r_!N>nIPTN9;oAzLvKQV}v z^*#(@dx>TmQGP?il<;23Xngt(B02aeYV{6j3r^z})ZV2==;$eA_f5ngS_AG*SuX4M z)R?7atl~BS(*D3*F(eh8Jn977DBSuYawNTJ=`dTYJuwJ5SEwk5V_adQ&DSOT?x^q$ zu$jN`$TsF}zN-kQo#2*d4*E*F(6|v=F0bi-)1P}{w#H}vh+=+1!_uN$bx13x+1lo8 z8)DSTi@gbamhuQO=I3DFoq5%m`z!yYrO-Pg@a3IloC z@;Et9;=DxbyyotXw9Bo1Oua)Vl~_O4rYBzTooNV55{^D+;wzKPv}AZd#lFTyu{_R6 zeajhDQ%UW4*hRoV2CXT+KeR1_UiZiOOdkge6GTu8pa1M+@I!7|0a4(;ZxUFt8c8@_RKT%Keu& zEAz;@nDqSNCQk+N04Hf70IL>Y_z)Yi+`iF3tShyaz#Ks<4bVw!G&QC#KEIj`PYUe`*=^xQAPz&`;&&hL@C%`W z_od$!wVdpS=tMVYFEFr2eCx@dPrA9${|c>Y-ZXRo&s#Fi+uA$aWMZ9#cyz`D0Ltuy z2OWOy-`gJVbspO)3jYbb&eJQ?mpi7H@R|NFsOZN~y;}T7cR-Z0IKnMxLn3H7&RJ?) zVf6vRz!J8$6d*oJGvQgH=$o7Bs&cHSy*kPC9;qE)=2qRIXNtO;qxU;fyT`oS^GICM(f9--s9w9HRJleET0TRp$ zHt?Ye&Lx<;L7xLoqkj~907%~hC{O9|6~5K=dKfOZz}-v4H;|z9Q2aRf1hHZ#B%8k< zQ|8k=M^F)HY|KtQ@y%)C$4B4&3PoI<5Trsr6cvd$IXqJA-z$sQAy$N289~fNJS=<( zTD_ZTZFXG@6prB<&VWo>YAdGS7~TUUNMP{c?Ih>2Bv<2<;>-h>9HtgaZNp; zHj3=LwH(gzQRf@qR*6Rslc~+dk^&-~q7(~o`P79O0f)(No?toDT1m4lhc>fUpfcgN zyzIvxt@=6{jzj25$C0XPPrct+rmq_+BtrCz+j=X7vp&ttoO9fLUnOs-w})kpp^$ic z5;z`NV8t$$zHb~P3mMn_)mkDlpcy$Hu^(c8ZX4WQQJtB8P9sx?jrPge#f7}D|H)s- z6HDWB(vhyI`#y4Ik}4<2YRZ&X^6SXcZieTv|I&Xx4Hylqz>?CSTQ_*@0qx&`L5+_t ziGh)#2!4_0+2D##LE;bri321P6ehun44)pb8ALKWpU~l-w;CqDR$wdcD=>s#lvtSAnw}6Al`%3|FU`H|7pX&v*v9H2Zkozi_xHAz_25R^&C-xo5RqI3rdhUi$_p5m*&9%Cb`vBb1WnAf@layYn zlXt4hiaTsdiH45W*2gnUwkwqSHTqXWtjJpi>HsgDHcGM}Ph|q@`DG&S@GxrWc>|h& zxm%ZS*fuPwsb5t%JM6n@O(cgrC3(59(8mI<=frSZw@iXwk3m2vWx`!j%xPN$1BoFP zF{|+l(q2xcN}A6U+R4n;K^)!Nh&)pXSd3Haw~8eeNsQq17krt!Z1TukobA%IAce)F zfU}IX<>boZe0cQEGA8E7&`Xv(M!%6=$#MDYO>>U>h^XouY9KQQEMXwLoNz#hlWV!} z63i&!FRV7Wn4r>&G}&rWSCTd&_J1T)fzT3glDrcOpwO{Dj-KIqHo#E=##g-YUWF^g zDMXoQ4ZgI0(9S@HJ(-Xn)mo?XsN7f8<*zw`m3Q;M)Vl(RvIQ3}j)fZ^c0AN?_mU-) z$C0nDtdkJJYdGzc+Pys$gJEaZi_QHSu<@z9riUv)Iyu9kj(57s^SABb=2c~Zzl&sU zAOn_1CS z)Z|VYqvtmr8)+lvYgp)irAU7)FDqvA&T#xgw3Gq8r)nap1a{K`%GnjW+Fb7_Z%$G>+{@U-c*u>LY^QZZ za}!%Qq<5l;XDsWgwzdT&vx(6<6;rQip>-Agj8*04Kqj$$!vNjJ|Xs8<3@BWZFU`{di- z0q@DVF<<<{kOzvGo-6ou2>7-(Sui|m7=27wp{DW92?sYFBKQ-5c;4_U2as+A9!LQ6 z-az*z?QQ^Z^A6V^*nD|;1yr}dxR_xVn!^N-{fT$Lb@+G(5Ry|Fo?^0A?yj*B3OC-m z5xUNV2Lg+sTwlrxE~!LC*-62?td*~7=Ixh_QuZfPEyl7c2S|iI6XmvDd8H>jubJNE zP04&G;x#PWq%Dt@m>$@(i6QdZ*vf?yGKx$UyCDAemFe}Zo>^A9RVBieTD3#yy^qBXi9~x71%E?5 zew*s)@VCN78axAyVWa@$Q^hCuhABHa?yn!JY#!S*@lHc(u05oZbQf0S%`&W&!6f!Y zVwY($p9m!1`Nj6mrm*K+QEHDx@%o@GgN$pM{^0j}v1c0N<)EP=_YnQJHb98~oqYmc zx`VcWfFCKmfes6BoAyF7TnvJLVnZ4{q*tN>Rq5=}S8j~A@UoMR=}A&Vah8QcFuWuIa2=hX z&qVh%q2i4P3kDD});l(DUa1Lv>ab<8rC%ZyU&yRIt17Tim?}sc-s65azSO1ZR;SjI zQ1+}Huxr<-9SnYF|8Pkwt2Qih8uI{Zk9YvC>q${nrG=GuCGxZTu*?{ME!onZ{4niG z+nn+_Q4sp(MQw(ZG|-x}Wl(KOppdl2&rrnkXCmcV*X$_3I=4r2JH zf<<;u|6adm+2jW5FSum44GvBxD-K5Ne+&`_AT4qCK3!+tK%*#UjO#qlhj&enIWY4W zu$ehyaH6yjfCNR2pX`$V)Kavx$|Jfoci=*z95TYJcRge7HcW6CV$9xl^KdzrfnEG;aVVqpxxPRBRoP zkTj`dH7I|)CbKO!a>ue0-INY;HT61>1-*mVU34!&sr4ylO!8VRT)lfk5wO8%!}_@e;}2 z=klA@Nbf7B=G})(_g7+2KUDFV095Z5v#yK@yMLZQutk4Ln7;;}#+bIk8z)f$#ZoTM zh!S0)`5R2svKc#j6pgp?VH{To+rpkQ)J4$#TvZ6$Rp3;(d{9d%O&`SM@l83KUj3GB z^m;fSE44}6=GDZyakRfJHyfYE4IputL=gMrVOJj~pYt7;kFV|vnLzWbo`~ru%L+@# zKX5wzo$hLr%g9q3-4XX7(8~1|<{kAoLg%N8jz95TJK1%%fv!coMHFf61W!{AhVMK{ zvU|zMjXIT5zhO$qjcg}6hve^RpGcplC?x1QryGBZ$s;;Ub(|Q27;_y4VeIw>U@>qd zVf>JM)1@%LFQ-C05x@53r(tUYp%S+HbmL_|LN5fDst3pbz|R(nuB&7Z*B+fm703JN zNAMgZKV|3-C2nLQKBXqRUar$yV7i+U&eY7E51TCs)F&jnV$B(9BTL5nrZ<<)H&L|m z%gGC(cCCoQ_}6{cySXB+g@!R5R){(HTg zQ)I_dqk2_@%cPG;y@QO`D$F`Z8npoa%$PcGOl%}dMNTnWBm58E1oU-(7@CUwgvOQI zcQh-;b7C+oE{*HpVJ$;;bka z+p+jjcLB)KWut>P<920oo247(6@Uj`CxN%%*GUNG?~ogC5t1_u-60=MJ<6|8V#bHc z_nr(WljH-U=TrQW`=<&8$2l76^)GVTX#n8Y)k|*|96P@~q-#~VR%3h1;r0*09)lYJ zSN(QJkk>?&SO%^b(k+riXzna3+0jTpi{O6BNj67JX-m@W5unUi%g}eu;{l^2gK#0P zm2iC}UI~7P=SYPVbL|HDptXn8G_qnpW}}}|ij|80`1z-(K1XQBG&q)mO8WTKnW~qG zk5GnOOwfC_cGcOZg}!UeOnnxn#5HQ$Co>#R~flIz`r z2OR`1GzCEqdxjSKeGel(Ot23l2{jMg}|a{N z)*Cmosf9BV{!#d)ln^SmoZY^fi02TYL2#@y~$zdW-ZrzbFp>4+iLCkQ0WLuf4Ah7B}a#i$Zrd;gM)e+ znN~I?{=x9?gaz0`5RE$fZlnnZ;e}0p1o3wAu>*aZz8g0B=D8@|sfE_3^2zO__6tV& zm%n=?=iodzi0mJEe8l3x)E@ANAJSZ$JR#%EC1-Q~XpD`Ba`&B|e5MjcZ?t&gUO099 zP#F0-GpY%b0f1qeal zeJ*z9q0M70&Eby>G`86<4Or)o=I>L%Wuo_09~h#IgUlY^V4AQH^cz)w;#<&j{0JIO zB%Tp}#$})7C)zSu>AFsR^l<&2s|4S9*r&(UN~dzJksHCreUVghC#2B2z;O+8ujdC> z5B@A#d~koVWFff4zfXfcb8XH?b(CIj(CU|5Z|Ljt#3{NNJ)3Tfza{fPDhs3M@-J@2 zZbyp$hC}z*ANEKPa!@z!S;bz+l?yEyxi^RSr-OS6ybuU#UXP}OVauTN3oKQv^a$rNmVB<60Ht}IumRJ~Bm~qRG z0QIqi_HG6B^4*m}`o-rguAh>aB@kvq5%g;M-v}Bq+V7CEM?JkNy6+^L6UtAVEm~$k z!=0(b{bxx(N<;FLChU@a_k?sW_Q_kwyN1BC4b60B{%xD2$8J|tL`;ZbbLKX?sw3*P zlx$vwjMH>f$S0{CWJg$qHhraSL`I;B@{N7uu(-Iy}gg2um7t%MJDDl~eS;VK1G^re;%CZ}U zm!I)n5|uWpi8(f`{C2JX3t@aOxuxQ)bpWh4v|^q}Vp{MCSp*%4v#|c55;48tt~Nhs z2?LGg`jwaKH4$41`&vr6;-b+s#XO=4%X$p(*yP7qKdG5?q!JmBP(zeTR{tn?Qjw7P7M66^&8uEgeiE=}kUUCt z^HBZSM^*}dvbRj5-x#Jm*Jmq#SUf2Ksmq?^NVsXMa(r(pI0)G7d>I&}LQns0LWZW7 z-%(bj=sXXFor$`1wg(NmLdTedum~O-yFvwDR)YUZhwJ<(ZWulBs#QMuTxLL(!PhG? zz(4vid4s2Wlx+9qSxIm&eIR~qD`5|^_fz*=!h>KPb?nXnYW;+`Pu#3Nr*0IM>W)zq zv7bXhN+e|tLyEz=9re!7Odh01{^`m-dxnfzykj;8vxflGn`WT zg|yvTw!;C+i(Qy>$%{M{(Q?s{3X;#o2Y^m?$AZkyka^KVmK=b7(}PLy!ufA4zhDA- z6AlIgDx~>Tb_{cMn_jdiN5RZqH;PYkb!w5Ubx=3*Dc(rr>UCm0B%eDc@uTIYYc3C1 zlNsSR!-Qo%Tb(w_piOY?AscYxR=oQPU}a=7Tbg&};Vdydef{*M&$yDcH$Fbp z_L0w|cZjAD)Rz;6*U;>DUa(>x%u>Epo73qDyJ0PkNnTY>Cgrr34+yzjwEHI6pe{pF4)I(olmA*-9J^{=3?@u;}DD`HJ@AOhxTr-6ny#e{Bm`3^-sU5 z7?GIu&2H&lNn^G(qjE->DjVx}6Rvy3LEhStZ;w)$_H-&zTd6FJmh!r>sa|1hgE=${ zceC6KpV_LVp*msiFJIG)6g->OSOOsRhZkU{x^~0QnSlXC-E%Sg02m?T;OtNTR$2b7 zuON2{_khU90T(m4+LBAikXXP0T8zhO?^$icoj+y4KLYN~ef0a_BdQtt2l^qCh^&FV z!q2!yGtz(Sq^Mav-6D(&itE_fK|JEW+_{zz+^@m@f=;>9l1t@^{{*^!Sg-YzM*vXA z168`-50$P;RCdYN6|&zVW$&w^`-mM!*X3Ie5iws=6w!%1R4UxrHX)-gIr;M0_|4c? zXMzS1`3Jo8%FT>Zo7 zd$P~hygj~~-F>)%g;$pxHcqD;C8pF`-=K}3vGqhbII$?Dr3iCdtO-nsa}*zDBd0qZ z8>8&^23^VhU7u<0q_ps%r_}dZzjXe2E%tcLUPiq@C|6aOHEreTuE>^qTlnA64^P|% z9TS$23Vw5!?}n$;x!|Z|^ASQb;&`Af;DV}`VEL;-pc$$;K(tq@E}E$0K))T4jDsul zAAWIo+zl}0gt=Lsz69ER`gW|SaJMZ_gHJskFJ|Hrw(HNt?oN5I5?T@uPO#12Br#zM zF7i@oX`beii{lzV`fmikJih%A^*IGIo;sMD`~>aS4ImlJ>86IsKi+uV1vb5B>GHR>mm6K~7T=mE02ktlEd{d`~@Q#vn^4 z<-QxQ7FpWqB67N@Y)^&l8tYfnK1p>IJ?)=klB(9??Qln?%N2c?zPf+a2#6@cfo2I- zTk*G#^n#fMV*iyV_s(elx-|F<3Io((M0%*)Ub^h&xxFvc1eg0Lu(B(kx%*m7lk|70=m%0m=>*Mci4 z+chtqysy<4LrU;<0xgeqM-Vvg_v$LnM>|qD&-dNP8nfB6^%tJDUu5H(!3Q2MSP1f& zSUP7w{#*|ZN!O`EtDP$wRW+F7#yao2QODfprE=m!_9E=*JzL*Mj*4j=N(;8xs@4^D zgtg9#?cI|UbWK*}oO-_n9q7+;-KjA7jdD1S*sl6MuKuxYV6*>^sd1OIUiB9py+zDYVk&&0o{0B=AI;%al=?gct&E}uF@ZVVA9w&(Bza_v6Xpsr@4Y*zzDgLP;vW|jB-4^ZOq%!yTe#DuMXDOA>|?9!Y*oE~^JC4S z!$$)mTY74b$a2{$^G*i<%s`7HM+y0u{_+D2Q|q_Nq<0Cv9qGC`5KEH~&UerYaED(n zpfHQlL~k>PhWd+<3+jXsQcP=x(;1y4L{VytXYEKu2VF~IVB0s2sR&q&F4vQGBYGcI z?D_2~1LkS%{4Lh1A&0Eo8kAtdTl%xS>E&1V1-;f6!EK@MpN_T)uyhufKhv+K(HsB3 zIuonjmp**pNPU3qz}J z{OGp8#GseqdilZfkMG>9B1@kczu)5axPA~**_8gIFiXMJ?%HmTY+FF)&o6aVmLouV z0ZMh&pxkK>G5yaxSvPV6cGCV=_9DD;!E(_*JpzBzXZZUb6-N+BM0fK>)*fQU@V(Su zTql+~&L!~x-!7mc`TE@NLC{ogrLM^4DHkgA!3TzbY|h0~ip$a~wup6oa=n|@aF_3` zkA&s&e)PlG40B~qRnKAu=EHK0aW=t!7@%vZdibZhy!zYlRKQB+EJlvqo};URf?Hoh z{P)gbvR0oFOGnkgZYp_xTmX@hlxOTv`%{MSP|d-%djxJJ8p%II*9j&qJ3Dzd)p|o; zE<`2gX=&fjQ;YDn8kf^`OcK1s+wp{6pP}^K&=*n~DFVN{YE0d)-Q{Pi zYUdm4)^ZcPWt!?{qcGXvB;H?jDGnH*ZLp}dX^wz@x+nl`D1co0Pgcydh4#!By zxVm~)b8$N%TeIhTiVphWTbU2gzlX(GkQ97MTox!3G8A!T;2FV=fQgdeWzWmKoCR{u z%1MVT?!tDBidEOC^ry?sq$BvgZDmQRft$gtRB@^yio1A!F*Gj^QaLYEt>pC-pp)5~ z#kgDMrFCLHPiNE9h;;W_)#YyqvI&@#q@Gg;(}PP-HuGj}xqM+dDEQ02jJsw!oFe{(D$11_H{gEWWVrNUHF(cF@wU8PCNM;N=Nsp@dT&2#GxX_mI~_H z8RDU|a^irElGn8M{LSyx(MQ2nyh(oWnTXOSoH_t+j0Fz5*D_ug=2_fy5rDtHlIW0l zvk+MrTSW6rL|~8_LU=j+&-J&V#J6TB4d)xFTW^-FxwXE#_SjjvS9xTw^Xg`FG=FXi zUuQvYP1&}hj1X2zXJ^XMrVv^2CU@ER-2byzWuft};z^2T`)W_c0T$b9YE#uA#@L_T zWs`Y*aiy%ut#o_c0S;1EVsF=GxxVDLxGwv!+NtpmzO`KR?OMsFLTssM9a#H7wyECi zn3%V6eTP2uzXiI}1u_@Gq}V48fEj`H$-nNGzJDR}?->2-ix*uxI`*fa%Q`>)h`b3~nLmOYBa1iNq#4U-NtkN~0 zYx|boN-f#203ZzhM4_TeGWHv8%Uzms)u8z`K}K_R`7H5 zNkxqpM0-{Rv9y%kle}H?*zJ-LTgwf}*T3C=^FBK7Y#h%Jl>D?Jw^|zF=reLQyO-Si zyd-W&7mEF(oAZoY@~Osnx~8OSrlLx$%j(x}@VfPxS}2ImY9lBOIaq;HOdi;Wf!F|N zg5bYS#xr~_CW{8WE)Y7MMAuw|k8VJ|{9oYGY2$#PAbpq(PR~0I09$F=fk>=Eb!*$? zf!`Juc>R@phNsCEx_-zTGQuQmb!wYT5V~>_Z`YztW#!kU(f38@-U=dNb!B!DmTi<* zKxY^l7GQN(?$ZYUdY+YxsHy9fXCQ(oJ&B$ zJvPcEcqJu>ZqNVKw7w|1$L8{>?Fr2d?{$E|!9o1CU?X5V1fD8gcL`G1m5CIJ>kk64~p@BGwAH*l;7zpJZM9^F&&(N*MCQ~af70*UKkqRMAN(nnD6{4c(`O%0acV{0 zC=|I&+ObsCkoRgY^MmMa-{YAozV`MmFTd%f@UsPNB3J#}0F z-jx^mTaxZT#_)1c124A;6B0!p&Um;wxzSz^IVK_wes z>HY5>wt<9dHv;NjE(oa)_#cH-lTTgs;9W9?0eT~#3xVprfJtoup#Pq)$xd89LD{;D z_!uO~NV?$__&kS6Lzaa-m9AF6@(Owx+!o zkP_iC=lwiU5wXvBf2a*36PIw!KGz6Uu6ot*iin=CP`N_G7_L(7p7xsfye;7l8$$_`IEv-pUJzlCHEU@9g=l@j&^^dzaR@R-peTMvZ-~P`9 z=xha6`FjLICLT_vOhBZ-&gRL;oCE{GwffOeoz1_Q9dk5S-I$ur9^iU;I6YM-Z;C1D2xb7nD_p^5Vix$uAL&LO5db|-S5 zZ<%R!*BdbE25pGBn%^H(%#>e1_`_qaHF%16lA7%eF+pJDD5QoK8z#C+jFY*goxYE$ zJiQn7#m?;$--BHDXW_XyU6|hZWZpF?+GK4!-h+WWngy|oeR(sXcAK9mUqJ5(rd+lD z^%NGh+m7~|e<~CU0)E#5H7|GJ-|`|I(FDu%)6ox#S1kEe#dy!qr1~6*KVXh(2lsYz{uY#4 zUaWO8GUDaDHfZ(rSV-!&n55)RsfE*b4u1_mI7MW>=1Rm~x39mKBvyVZ>H_mb2kI#g zo^%pHD1|E;rTmzFwts6Yd6r|wTi5$ zHqy%KvYYdI)zU1M##cu0uf#Q%kH9??V$!Fh-3GdZMQW1N5p#3;Ck+2dRd?P`2ES#H zym@7QkDjveMJGYAU`K?RL;qwr-Wg49I|96c^_6`TpqCU6yiZ6tCGbsyqV#uN&Vt+V z2Cq#HsLu8M1HaJ_8VG(A@v@~ z(MUaO{4?3YZ_b6GJS_FnVtGYz%Un(x?DavnYd%yAVu!xMYWK>YSRB+Dx}x%1j4ON!;0NCW-)#zL_3b=$xl^^7D!aM?%&LMQ}yyu z>thdj!PvW$2FXMvM#(UBm^PVOj}iUYDkDqCTVy$fb}4}`Lo@tiEz{zYC#HvbxivuO z?Rn`U(S z;oGC%Yx^&~DfAq{(4U_0f%{O89=}_gWFd%Mv{ z6i093M+b1d73>u1eHaL?2NeXx@aEa96$+L(v1LcdRymg%?1O?xp$x!a%oka1>%+6~ z{zkz=WCuKD1cVqi{IMw+tbuMCxF0zBM)$|yH+xHKN%LAm+3YBp*hcaz)+ zZ+x(Tc&r7cp5}(uYZt|4X5xDHKx6}=ij#2OtkAKg!zj1&WOr;4$ zd{C5x`Jz>Nl6GBN&skek4J=`zQ$+ff56hS5{H^#S)O}H8M`t|@nNfid%U~$E z2fjaZvD3;bbRMyiMvBtk;Jygqt_1R9$bA{ z^QHPV;rwkPFAlhvuHN9?uG^iX~OLFS}`IBE`N( zT~;TjldWu^J5sz!l2a(IR9aCNU%>><&JBKVdn7@Z2AIJzfGivhk;u1C5%i42dGUXU z=1`G2VcVao#DkYu5(wiUpQ5sOk`vUJe2n46!_T$EDD;^@%KnrMbW-r4bs{y=zCo<-ZsBF@@%Lb5Ge0GXU%PfA{&iolIs-h}( z>M~(YUWO%JF=!d_AdrLRxbJT8i24|1HzZ>o5>x0FubuA;X97+Rmc`@T$RdHuf77v3mCft0pK~Ki4i-o(KrTUeZnz zuUZpJ?-cdg{NnkOs#VU9y7^MNaX{)zzly|fJ8-YX^%bjE3X_Gew1;roo}qFdm(IeQ zHrKAy7nxU72%=aFEqVkp8Dx%h!?zAfw8c17;k#MgKEK1d9cZYhpUahOz6zc=FiC&W zzu1MwbO#Y<9Ui#Xjh1xUM6pyUaN)4zjJJ~e`BwtmjU<8%M`cs)yu6tdaJ<5!>K)(0 z$0Dg)n?AqufX8P1(_3ljNJ-u;|2*7z{wBgH=u(&gQW%J|p~mt?9I`suH>8n0acHP^BADvWINvnc-RRJ!Zyw zd~D|l=`?MJs&9L0y}Ez>!>I1yn%#!*Fp-CdO0JXn9ve}ds@>Cej2ZbIBo%x75uJw( zsXX!q*)f4wMw8UTDt{hidAaB@7y4<`E5(#&-u5A}bhnlQ9YLDwZb3>N+UTUs$>~=_ zdJ!*B2d^RvIEyjxVR}$CsT&j>J|)P1{%XRD$AW4|J;MSfbp+6XmDdib+3`duA$=Gi z;yS9iX9P2xF&?OXcMalz4Zg1wFtjBm$X6d}#XF$hC#nP*XDiFLs|0mYdNN!G@oFsv zteVv=hp@SbxFY|;kjcVf+ck$p>NEdN-TcX}vZu~|CJanRQqTPjWmWBt4m(+G&bYU4 zo8zxpOYKd251tJcc`a2!ZQ41BCJxuOtV9it+b^cGNaPf~RNqpt#5*^xl9~obEo?~|n6-x9Hd+KwERf$Cd!;Lw2NO07RE!Qd zTg>XQSqDcdv%??Ub$B#Byo*~l0@YQhQXx>*6Zx0R4YeYb5y)Ah`J#r5CLgF2E?*Ub zv}OuVd?MZy=iu77fI5#gX@-mjsNb@ylvebZHWxN7u?(B^n4O3^D+iMis$K)J`dr39 z$8afgT$9cQ;1MOi6p7gyI(U!nHyM=uJnn-yuaSR6n5=Z^Y;}nZ5i=#<5uDCFf4GCZ zYahvPpX+j03g#4j!YF1v=f&%o2{#5|#h-F+j<3qmJ=&%$-wR(O7fGgOf}C^& z55qt+({#s(;lZQnK&D3ino$RrUX*cyftrC(Y0>|88=yx4gql2;bJ<*FF1@Ebung?d zns6tiqN12@DR^>CsK&kGl)`kG`(uA3m;AlqGlP?6OlVR=9M3AZfZ>yEA!KkEiC0m2afgP{i|g1#VzyopfRq*(bgL>)gS0^po9gM0<4Mww)3$?L3Lq49%kCA@ z8y>s}Nhupn)ipv0qJ2TW0K}aU4*`2AS$T!Sym2Q$)uMlqnaYxf0j+u+y4!@ZeU0x# z?`Olf7CCJ`3P)<`k8ba?c+=l6W>B8kR|VTl2nW)F4~ zf5_)MJW;7?>uSyJC#1Tn@y&-{ytF6A?O16_pD{mk2IP3tg%0s=8lZ|IjM9|8#^R47 zkHiuzAGvq?pi{tu|viXjdQCg;3E%0~?gU6Rhezme|6-Xq3WU zp!{sgKr<--#M1*?uNK}XPt8zJJq-9)#!U8i)FlewxDOwX*DO2_P9EPQ2Y5BIbCPtfHW4YfC&Owbf<-DWq1kl zTh2oZ^0;?&QJ&iiiq*3ER8-sqE@Ht+_3=*?RN!_G@P|YUSXy#xJ1eo$0SZ< zye|nHm&dV7gnm0yb$&kz}>YYd2o1LaYgSbF!HcjtPwM1#GQc*0|ZN^ z@A7QwpZkC6^w!HJqd~ zhk8eJ7e~E(E$G;^r2~)lE*XVq`X$V>sq6NRRiZH^9a(Ch&^_dJ5!NF0ubPE|T_P z>;Y%Y^&U~XRC(zgJ=Qep)!bah86{sY ze5hfD-uS#b?FIXb&=Y#4KTEDNL94>Vo&%p8b#hEdJF-k(V2K^XgtjL;I$p~1U7lA< z)6EXlxuy|Zcg*hZ19v8fOb74cK;u_4g~~-u$~;#4?p3w1kJjn@A}(|eOxE=wfmIG2 zAh-ro`P<1QRNqg(p}Wl!hQ+GDsTG5M*7w6UzcoS>$P6gWD|f89C)r52akBU3GY9 zu8&Ai*Hlg{xxk;H06xw`{TDN66M$utDbF|lOu8(9(GlozmQu@-LBoRaLxALJZP29P zAObtyk^-2I6F6wdcN4pWO4z7r7?AA^b!JHfjdeTOt`Ra&SgoueeoH(dbyaXYAAI5R!zX4$!dZGv88phP!^|nv*AX6XM_qv ziNo44t>)6{jzRWI##Zej^j`StZ&sb`ag4S8aoK$up1*-=naBF8@Fu! zPzM*=4|&Mf+Jbpdg-(+pLF*3HjG+mNvOsJQIJ(5s6g(jgcyUV)s^(ILRg;N!#~FBA zh#i+i;g+Sav3(25peEAXW6kRB-jz+nf??fxzVDAF%K(`D4ks%u@Qtnqa1@QZMa&lY zH>C&E^8vZ=Er$)GM+1B82Hb`T(cW(&Od;8hUu(Z(}hwX2D9bK(@y=<=qkrI=DhS9B2{` zph!Mt_nbqB`Y;TX{mB+iS^wj%OnUB*Bw5-W&XBe>x-j`fig(*R4MOo`(E-1->WRv1 z2Zn^rYtO~Wgp*`9{7f*0ay5APU1g`6S#UrvIW~HNpALrpoe|&w62CwoOg4ASoks^v z@Tw2bmot(C1=iejA;D2RLHYemW}`r`o6Ylg2c-@ST0%0}Ah=6Vtq^cmW=_*#bAiZj&M4HqXLWqjWRuoj4v;ZPSIs^z1 zNDu`CgisS8KoATOLWm?JA*9{lKHvGy^WFR7{<;6|dLF{6bIm!&JKyonF~@ptXLC(z z=aHRaVq#J^u3xqn6O)`26BEa6mk^z)-kpLL{o8T>x@&}(*e;pPzb#@}Ifq3jw?x=q zyChaMaCA|0u+{&f^+hqU+T>ll+uOvp`fS{|eDT(UEz5jJg;zJ2n22@z@P+I6;jmkM z+q~KhbKQ^b$Q$B^Rc@V8^*C9pFsilep&=Z~zb^BIL&hs#IllkO+Xc4moU+vG{D-73 zwYJOf$*YgnXX~FYDi$uDdVEmwE#=*PWbnkxlP{)PUmR#AMlBdY;NKB`)l4+4_-k+& zgRuqYg>= z@qX0TbJ%+OU=gzA5fB9uyNp-}uQ^6DTVrVs0erhfF=VSDIH! ztnAO$R~m`7LHw246-VeAo?3{Zy((`zQ3Bz6Itz<{?609ZVzG!?(;r`HL7X;4N}`%I zuMGltw+bQ0$;i^yXu9oJ?;L;6yz{}Z%Cx7pl{?zbdHO~p)s5)PcZd0gnitK>f{g0N9Uer5EExzffUhHLx6|7ee4e3yo;JI^mcR|e-YidE5uWA8<$+uoWBYUoU+XlYLE1BL~hy#lG=(-O6?0%A*Wv2~~ zvGo`Ow5rU}Bb3))0!?L|wx;Q-+{v0Zc(rjC=Y*|wg7Za=4p)$_1 zI^eaWgqNJJd!1%svX*UBygpV^tI6W~|JSsRePj~rg z>*w*6(n6!(8X&v4+^jp(99z#vKUk^V>?$#~v1<=}tu2gmH)>_`s<5H-01V)P)-B;Y zv^-(S?k+pOlx(^(Y`idh8jC50Qc^_KQ+B7YW z4FC(DuS3+zpFT~F{c&O!Ee4M|r1_oCCJGU^NlLj-lxeG(Ur&X(-29=z|CuZZ*xz#b z6WRXOuUNys)a}F`GTSQ@=R=1J{r1Tn)U|(|P57R2yC}Zu{BKkD_q^wapjQf0@z>G1S8JCB=cZr>S zvT-Q!_7x8QvWFLKK%tLfYuFcARM}>CTDo~5R%17#u~m@Y=YPCvG=n4X(AqS`6rt2s zwfaWh-=3W+Wf4oZal z_R-iTVR=M9F&EkJ)+pB^d#$jgZd}hE%v32--iD0P^!0Cr;y`j7UV6IWvI74C8@Wj&7{5t#1)NhC`!eE0H?)HJ{%`CddML9yeA2M~-CbbMI}$unL0U`84oR<3nm!4 zm#M_=o_`?t*lNS1WBSARTjH{}%sO^m^1{DpTysAJL!qO7zCWt?!^LG)?@mf?5dG$= zwmtZ$>vpkUFTPqtB_cvzL{N6!_!JWC0Iin3+sU;v&AL$Pdu}%PH{tmeh7k#eHgwEk zdex9RgQr(tBu2{77fR244+F(qPs(@+{P6DD&>m5nUnWYn9?sD3;wPh;-tB*PeTeZy z#*bw;d3rbhp~j{86@QKD2g|j~;fi8Dp7(o0T^nF$1tE)UOA&!>dcRPI_2ZUG*c&$y zww6=;C#j>Wyoz-Sa@v!3*smWxef-Rl3!yQd)OQ6zBqQa-R;~us4ep%~?^&&x^IaSg z!R=BKN$XKj^P0!ElKMD^OXh2SPj@Tm?K+BcOYEWhpF6dapB_BLy(FSmS@pH1%JJpA z!E?dn&(U!Oz1QZys&rT=Ef1-6DgSQpX@jFfka>DZn87}FawijRC-?b>U{R(STejAX zkOvop0ZeKk7r{Rb4^YL#YLq|taDFA2@i6ln5q@p(8-$56M3Zy+w!6m4Tgcc+Fjd{! zL#Yp+4hy=O@2dT>x729GOHSk*wZLC7S1?=@2J$VboA?ovr7z1c+yN@IUwDTy?mVbV zO6ok9OhHc4?((Kn>4w2XU}yhpUDVf=*R~5AW`5oCEJAGC=l&gk2#{dashqntdp8x5 z2P&F+cgCZJNHOkVRC3l;G=i6_<9w`oRz|uaXtm<(X%LY>U${fMswlQ_(mg->6c^I= z)+7(6p(S)rzp_%pG&|&J2;TLU08U-r?2Q`bJKpvo^T~a6CR)H;m3S>zjCKjwJ?bOV zz*;{{yW;SN2a3DYd$~0RqMIwWbTVJvB|eD9oreqpC2;IecGgPh17IsUF*t~ z7_25)q-5j|j<~!iZHhx}&As{8#+PF2?2}InlrILjWGeVw8t#0za95-cB|lhk1`|vp zFJT;3L5m{4u$bc76Q`k-xVnC$C=uhUG6(MTg&7xvq0x>(3iSC6nY0VGUx?SNwcG}2 zALu*P&s`~cX%?n(P#=I>-s3t~ve8Wpoz7c=eJe?R!M6PZxyA1bjj$5(4XE!O!ncT3 z7;Q+s!dTPrCkJ>CsCLEapNHn^4s*+FPv;t+ZYF*{_4JFKlG7I|_ABHDFId>nl)LeM zb*g*Jwjpp0q9EqefA>2{2J8%lv+s67CX+8&H^0Q6lvN!hrl(PlNV;W7FT^VD(gy(4 z^1P$I>*l@S@H{p`cHEh+a)7I`|ACP&so+(x{!y8ZLk5~J4_RcInop*8J1Vd1+7jYQ(+a&$_s%o>u zs^`}&3W@DJ`QpGs;a)Ewg187vSjl08pZ*Mg1qAz(IDe;!!_8gtCIYP3B`iYDND%7ka@WO>EIQKj0$@50Z)VvprLRm;O1`rSLluL1Ret!%_igPBeyd5(Sq zPuxAhc-xhpHvk+EDe;9uN7J`O{ChTq&)%Rd^h>v7l*z|Y*+K{;#6*)zB^=Clp9lu-nknjc4 zab)7?%FR37(BlF<7yho8Q?|vtysx2@SQl zwcn2+6Q9;xU2#oh)o72ij&eoZJtdlsHdXRE&hRcl|0cSNjqjbJVnTVQ;_X+T67?TC zON&#(4nbrO9SW%4EaATM;1fvdI8Ye*6D9WGURc;__3r}y5A|I--q;-x)&P>q(CB2f zocaC!sV#n1OCF5zRj+6T;Y(v+_`TM=1 zpNB@5ow6{nfgiMMJ-_WjJb4ITc31ZF zLbm)Tpt`?WMD93aCg-#@^LTZG@U(?U1c)eG1zyHVdF#2b{Qc0et45or{(B1wICSXH z%wcCGyq|}uOh$Kz<3CmS?>p|>?oFdY=Ica`?Ei27H$C8WD$)}luu6y{mSm@4?OJLn zOLcxl3hDrOjMNx#d3>kx9k z4d+8}(EgSgJYnf9H8UucWrl4osIM1(Z{2)z5(~3n>{nEYuNOMQpRq88(v!ki&Y&QH z@t!{-Fq#x*G2W#$dW{IY!AB;AOU4UOW%(jL@t!GVLa+(^S;gCK{;&#hgY$dk3{6w< z;|&P9ygKZ(5G+|W@($p0j@@2ps)x<@gJPH6yWBH zuBtwdbtMYyOc5-8t-;b+cKZXTO!Fuul-~@?ES2aogKXwwxxB8!D4|~$X9!R)Ts0gL z)v<^#ok6QE;A5pXdtKdo684y7%Prw2dzg!UjRJ&^SZ3*drTpXul3{W!J%O&I9_R)~ z^txCoBH(hHI0-u2WynG#;d6;#qk<8`mXY2ZJ+Vx{-gEf&$b7AS^Rt-pT5im&WH_PMfT!5~yVGfIPO;)L}3Idc{6 zs6%QQnnz5+JXwRf0K)XkPmJL8IH0h4nbRMoAgZ)dfKZ1PFRFB&lOh$y1WyX@9}!{5 zY)}9cS?AS^0K&m{)0iwwdgud`d$J%HgwNyh42@V0ETG&DO5*Y*isIQ$N)`&G_D zKl028unnZEKlKs2tghIk@QuI8T7TPnw$Yjbwion)pPa5sGE%Cb4Ynnv8Ql;1MaXpY zgD&ee3O^DxHv3)E+Ec|_@t?-TlakXMNd}QgzwJp}6l0CT7_9jFk--D8S4VK-Qb+}fVXHm}?m~s%PXm3#u(kYw0ft65J<~n` zcPT~uhc-NLU z41|Ok@_c*w(&3Jv;~nRh9t~*}Ts3LWGAupXRK4L^aisO>-UYBC0H1Kybgw(5y&^Mw zdKTJW+BXWx(*3&YbNo7x3GbZcTZ8ojdjcnQRJjgl=1}Za5!oOe$&R7by@;5BLQ=w5 zlm;i6U;L_#VIcW!1dVKHE!m`>@)13Us%(~N*U}|!HER=mk75P|<@5EzIQ}M4yrG!q zi^iao=$!H9)iNyr-Ws9=h-wa;6t<(>Xrh4{R}*JWCaabRx+LhqI68bOunT9-wm;)Q z&vP{WjoOp3{&g!FHu4v&EFH*l3;s@$CPkSg=0>*74iYo*@kw&xh_m-&$1a?n+ISfA zYyIUXW_=(u*D1KVR%=9}oT=^Xxo|h&fOIl@>KBFhDqxNrrf)C9%vva`i$^uUucA z$bQlh9}4-BqNeE93m3mJ+NvzBar02SMQliVNy5OXuzun<&EcsI)*#XV$)g=Sjdo5$ zIk_$v%WVA}!3feQ?jK)M=mqMuc1t`sfgd1zSI`VS$+t5#M-V=z#&%0QKNakVaTVtS z+0);^u>sRo24|KmVb^UQB-^RGR*nb2zs!~A>Rmd_fnQ>JEu4nI zT{(yunq6DTSOkvot`R-fn$Rm}sn3F6BM!Z6eTIIzl?rp*C?EkLwOE;j*lRlUBO8bI*9#pN6VR1lbUb)? zSRmP(&rgPjcI40ku6mghFFj^q)cAu)T`cIV?W9*rRDcjr*RYXQ8_`CNQm127gHf4( zcGuG(;3Sg%+LT|aLNV#Lkdl8Wmpj&6r9|2843>&+DoN9^ok=SA)IZpM+X`r!9#_BO zurz38Alvclp>L@Gz_B5OUZpQd9hQ{1fLPM5Tmf`vt438;%cGL_`t1&fnwpEV9$oxZ zR+pq?HnZobv`*t^yIhIhT>WGqhqYv+U8B@nSiB=5)>3D(dobpDlO6>+;8DEYpm^H+ zU09r-XGxCq?RCyTj13|Q>n?0C#(H_x3-@*{UF9l4{rXdR300X5PYj07p8!8IpqJAk zekqCu2MjYPxR&Rtb4pkc=%;x*>3sin`0XU#68C89H4&8%&xq*HA7|AA`B(nQVaDva*pX{etYJCq z+0pQOUgo|@!M}+`0^mlD&_w)YemM8IX}YPECF*MN80?-3OezZ4vHq|oBgCghQ9=S0 zB{xzf*9Quy(WXoVOd9_TD%Nz^dd{4E!0(6b!s$SqQEQs9=;ej9dQ%!a%}iDBfl~+#b$H*370M6Ce}9d3EY1m6 z|L7_-E}*gj}N--GkJJuqQK z$Evx?PXl{4U8w$A_zEs>AB*QA%l0b0eV+97#^zx0IdLZ!Q)~16diSq`QHMecK2LlD z$2pPXPE*GP#z0C0B8k}B-a{T+08|tc*1(nUBg{^8dcNNcEyn)v6;su#`e2ercO+UpWICQgPH% zo_PCjth*&S&)V}E0U1hw=Nb{$LAT7zg+U&1B$1YM1|skI3*-n!N{|6_?1R#&jjZ_- z#4yh@u)GtT-RRG}wp4aRtFT{+vZ=fy9iSNl|?0-Jb}`QoW-|Owz0zb(jPS22laj4aUfC4nVy_)WM4s z9*}wf4@i~63k;2%scbqZcR|@IuX6HM)ZuUXWZ>e-tu+JHQhT8Z`r}~AuRs;)ojf0H zsXdWXht!EuF6aMp(H(bilgbHtI4^Ou2yGbZi`ruQcYI}CWyF!lX8!DOgBAu?M2S^I zSIn0`Ro@}?M7KSHZ0~jCfq#Jo06dPUZRn+A+oc1N{VzU}stZ2mI95`-;e^#Up&5$> zdo+_wHI+!^fis)|Q2Lga)zwQs*nC8z;bfTnT}6!Q_S5mVOd?>?9EA*W0muj6Ql~jx z7U~q`=w<>l2{ciWzf0h|xvxe=V#^uKdjDeHCB=M76V;hk!#4RjQ*jg~-Hj0Y)K+p8 z>)O5C<{kqXh%yjB@#75U&q4%yp7=&+YF)ZNBu=NuDo-zC+9igFqa!DGn}`Q`N1LT5 z_o04J2$gB`1Pp8jowUML1;!G_<|d;YkT4@zkvfC@d&;o6w<%{p*jJlO^C>KLz8=OM zcs2NSW>TOWNKNtpv~Q7pT)nIB%L@(LT{ccmE5{wr7bE=h4cB9SPIl*B zw8YuFXTHjqn20D>^7S?GNlUoD|>A&M@ z^3UM!p;r@XqHjC-z1g4`k$cr|>0B?LC@xrZZvcsRLtU%h#R<=Yx(LSS@>7d!P_*@D z+4E1|dw>qDsCp_^q`4vu$;b%!l|>UfjQtt@NB<1Mu^AS_YE63_5dqF0BL!Lw+AZa< zQOR*@g(>rCd(FkwipKIMR?d*+Vka6+qnBMMk{wRCRSl1!_uP@mCCWBw@ZKDWre4aA zo|G$`ygdJMMmkQyKRx3YnD90)B1TJK&;?@i#7LzE+cf5n5A!yEy&*bql;>jR&?#`c6X~uJtIDmlku5ZfnlTx- zFXXh|9vYHu#X}f)?YKLI%#WfeMoq!pb>%U&ARuY?4%TiN`**L4V{AxZGHdXiSjUX@ zA&CPQb5JF>B&Si3Lq)kUTW$!@BN4-my``GwcMI}^h5cFW=PGy-Omu?GiF6sSbyD8Q zb?zB_6N}iqY3tu8*tGp7xo%4I3;)^!8<|$)8icpZ{Bvglh3N@GIM2YuA&~5(?@+`nu0*AJL-{89TaMkn${)9DvO?M5Bx z*9t!{1C8{pA9f{uUrJQWK@lzQE+HwB853=4+khE-J9l+IxG4v~E z7Bf#zmzePvpL=CWiM4T2#)GuTZ}`tkB!<%w6pgnWL#F0#1askYx{EW2S(Q=j6x}&f zO*q$?*e}f=l-5Ln>{qUF*2&Zv@U)jby5%Z?WlBYrQa(Z<&sd5}=S{tZ8vV>XVdFGt z#P|4!9QP)BHZ^5$fynC9CgVn%*6$NVM*a%}80Sf$ zS}Yeymz)&IK>!sa(Btv%X(!yhdr!DJ{zY}HZ-0o}7@mqb-IeStV?5PXbl%!5@=o=% zA}EBaRNe7cOZbuMuUK-z-Nf>{&yGK7_RX69yN?~x-pOkPM>f6rZF;-&)7L$sutyA^ zp3)ntr+jXD4|OAtYK%A+g&|xL=Xk3}8O9mj!_0C=<--A8q2xKcgRf9(A@Q@u=COCg zoo|bGgPP<79ny`lZt@p^53?l0+CBjlD~i_i?3m*B3CX@ipAw|%=npa5cRi8%L;aI^ ziX`ik#E|mt`-J1tlSb+zy+}h2)LS-~A_{Ks=^2=*mC1(kKHp-1Ti~xia=3{K*bnlt zP@>S*l=DGDrX^_N^;Rv8Af_Y3t!ZC|-mbm3q5-~>$DB!%jK&7fJmQV7>^s=IcjAAX zy>JM3o+Vg*mzGPk_NVogApA3*D!zi*Sg;+;m=4p`yx!{im_sf4q|Chj%Y^7QY;~M) zk{#7U?nT`v8-c7-u$eW-+7eG6U4)jiG&!J~Lg}Be(UYGdCzwkUGikrv#RN- z2@U&%Cfh{j#|WiZGygFEzeYc75@vesHv!P*STus?Pgr~#+iX-&IZe3xEauM_E1vAi zo}I^S+h6BcX`k&ogGW4Ys%iA?<*h9s0tY@G== ziC!lBCHAgKuHJW{42zAaFFvYY1X2{!!~jmMxVFqTC2lFc_;+4&aD0Y-+oH9e*wPM- zpw}+aKUh=(9&Q8*(LUx80Pwmf4wS#V@hIS1;SgB8KOEYGx!8n4gB%jloACI{CP^E~;(g3Zwi^qC4FG**tZtwTzmnx}`F zdd)QW*-~QCLbb4T#ux%vDR8p&EQdHvC_33eKWrfl}PYpWb9i9buE zbE!lDbzpdLLhaR#19W?IC|3~*rT7D}(;0xpW%-&=XAYNqhfE2@H!^d(xx>hVaF~FD zgX*{W-)4>(;TaBcdHiL62h-K8=b_F5uSlWm^|QD=5bU2AidG)2qEa-}VGxlp;ChAU zpnZjLS0`aKsN}z7!6rDwe+vZU#wI}sTsH+F$bsvu7){*^pb~9goITZ=_t!ijKQGcJ zfS_zw%7d}6f{By1dumysv=1d;%odbi1O%s?3Fj=%On-T&Tyle)Oss#)_FXf!jpNG{qu^Tn+7L57wesX z3vf+0va{=Z$gVZ79F_j2{zV5@ubwzwF-k2rd%V$T#j{-{$Pc7gpWZ^4wF`JwoA(AT z=>yzbb`iZp>)!Wx33Hf$41?2SSrh*HxrR{|@r>s?B(+Q1I@>Ub=`X$ooHux`5 zz0QQN*~81NCbqet$1fK&L&27ewCdQRkqftWq#|)GHc@qSo+X%(O`N*&-Lm(D^kd!Y zQqj4+f58N?D1R(`ZsQw`VtNY{%zaefd}>rA4!MRT9x6d8uBlBZ;2NP!iJ>i+oNp3K zK$ShS!?Ob{M!r#zqi3b5-eD|ryBR0N>?2nLtD)qKZVR1Qxrn{8IEMn7F+bWyIl;#W zbVokVWSjvJr6I~gcTF}LQw6&rAl4LgdU-m4*w#HTOy;IMykiiT5sYp$R^b*eQKob( zLpV$Rz$iu(oi>#=J+9Lb>Hwq~3TKuDOe-{%fY$se-(cwb=t3ZAork#4PL`WPgsfFS zr+NDG=xOa5HnwXQmm-JMXg!+p)EaFPK&X=X z9~$G)zjcS%6ol$sS5y!k#D)fSM%=mCOW>68OL~-9%Lolis{S}izf1Yk`VPs3Q|%pp z9F3Sc@I;kp?#qV*K9z9K`o_cz*-Wfd;?*-&fzVdk0Ge&Ao@FqQVeEHU;UE@1lDaI2 zN&QD(Ci+z>w7N}ry1&OO4662WfQU=oOGhe#ZtrB|fJ^6%Gqp|JTh(ESo@0qaep+)m ziLKf)6aDpj^ag7#7RX**-%=uB?F5u6<>e1a1iE!^asC?bOW33L+ClMJ(ox`?SgV6# zy8odgAJ(F$s^^>a7S7eKrI)Zmr<#U>W?BtMp@is4maMF-kvBT62%46`7`agUacP=# zzD+ymEO6cM`O~LQZx#0$efb1iAI?DE3RfubXdFg*k_k6b5tr z0e>9x2C;2aHlFbqk$*hz!h}wj(ErAlEDSo2^?~OG_Q?`Cd89)`XpPW7L_>;y|cZb00`fOKfOVrmM(Qqhee(}t_@VMSv;_Ts=DTc1c=wvefo()0O-Kl$j9QY%5sg7Vj1 z{IU11@M-=SzBwY1y2=3blfTub?Lc%{D;c?N2>LyV<6_CKFo^3N_b5!_M{9 z2GK8>ytzyY*#9W+^!;8}O7`~`(xJ1S(?%JLT-9OgXC?CyUxhE;LXSB?IPl!}t)|2j z$AR!IX3-(v3d!}nf3hrsc4x&n`5Hb5L})lioi52alRJIZH1YiC;&jmHsHLv#>dfQm z{)g72%np;`dt&Mtv=<0PBR25iopWEpjWr@ZX7qkV#6ZNMpPz_@h~dU(hoxW4T{tHN zr_ZXmWW{P-{(j;0{dRI7`Oc(`cvP-gXCN+ zg=)jdBin_mO2RMzSY4Xr|Fh{UShvM1iUlsO=(#&wA58H5ekJSS?2_Hp(`pXn&%GB6 zOp+=1>OKWRxMFFE_MO~eez|FMC5cKY3opFjvp=~gxX8gv?`%UI^$02y;?#%>GeNG= z=b-_b1qtx#9cjzW>-0)5))ZQlM29kfu$C{gKg2E{QAig5Twfg?n|o@|4lYn|pK+3` zq{1Vo1HBkoK9Bbn%-6nTG4h1GFYs(q2`C>>HUec&>rY@{nBgea(QpOp?I~y(_KX9R zk7}UYN|-t{Y*Y)WW#>?QgPUuOBTRdpJ92J$C!hJeRD7P(Toh~laGo}@RKB(Tn?L3u+D^c{%i~GQGZQpV@HrbxO*60HR|M#osBdILZ|Oe5 z0LR~GRFHO+G`u+ z<@RjC>IP+Gx7v9BV1VNz@tqrTRX;a{@T?X<3%_bwHK@M0-N~0TKrQ=FTR62a5PoBR zzAlhDeU&3u(G0KbtL~{Cwv3yw<|!wBR!08X)O6Xs{m!8{@KFuDBZE8T_qIH8w*BQp zekS3m_uxRZ)}E&G6fg1W^Y0LWeDmi(lApTN%G?FjA9YlN#xOgasO|BXF1ECvbFC#0ju}SCzEu78| zuBGo!`0@sjt9H%z-d^rp;+e9QMY+XsacSd0Vg`?vXZ%nZe)r7;_pYR zF&?Rz^Q)@mj_sFhR@KVsEhlD9W8ftoH41;-&o_x!_;#6QPg=|^)u4*}2dz2o*~Zmd z-l#6P`#1fDGbq^;7&B@wu$1G8C7s=L0A3CvU?+FKf#JZ z@h7IOd}@3}TTh||6y7gnLpMTCN znK#Iv)WNce*(dE_T#lkqcF=7Z$DsH9uQPTs{Co=3K0MS1t#jO+0;a**)titRt*DU89~C?9b+#zzWSzZp_I&bKi*%)2h+BWP{h%%4+3$1@loCa% zD$9{$F}GdnOBhX}m+Chb__uN37(FPbvn6%;1*Yl&#k28#Xsl~31AQYG)NItZijz;= z;lJA7%08HBB8g?0o?*3k^Afv zEvo0^YKmeV<6Pv{f%)&?x%APCB=tG8ZT1p(HeNc~R5`0z%0badHmw>`8(6saY6z+K zSPwjH=>ykVQgX!={BcjSjc1iZvr4XWrXY7Bq7tu2jIQ{$Ay?)x)<2zLlF|i#B~hc4D_3$1ki{$BC97pMrGIOQ zoaZ{z=*s2VGKm&mS_+nu%&VUOi2MZgm{}odE zC(Yz{h~*#35iW%aJCt|0War=n43knt-~CCAd_LH>aj7u+I0>mNHU8r;%8W!(?n&+0 zA5wQC>vj0bRI~OLW!tsw6Lm9?xaC+4NM*#!^?|A0z-#F%W!VQPFTPiu>g8AooL4;Q zn9?AcYcrRu9r^91`b_p4=F%>F{^@HUH&fB>hYmW_OP@NN*ap|zc=3R^uhOWlB?y^e<`uXuE#(Y0E!`ER_Nj=%M%kT9f1RSv7o9b_i% z9w_h9^yu2*BMh&H3`dg-w=$XZQ*MV~Y21JrCwy7K9=AsHJ;$jC*aJTUek1?QOQ?B4W5 z{$KY4mt)FPikL27)@~lVgjbVm1M>JA3j8{Ve^MWiRU(biwOwW)ZY5h^xRpNcEj6U!Ud|4w)hyUIc{(Q{EG z@YUnbBv>Rb>cj+lf3P?HUT&hk&476qv@@c5x>>j)v&A1$Lw*kO_P)Sp=z27GfSUYDv9Aj8W<~t8{i`>DOdUWP#i3S!`UjD zsaa9mHbQ%MDOUtR%ml8S*4PO_+_L=hj`vj|!rl>#*}pZ+eGU{F47sCb&(;d@Lk-fT;ah#Kfa(tdTELz-=b$(nPcH9T**BDoDk%2#Q1bGk+m0*s3bLKFrDwfkCSCKMQ?^(K zAa8b*o(%q|RsLjGv{_l9#2qyqS_$tKdKj4h(f{_PZKRTzF*bl)xrb#{v0_ouNoUe7 z`3BgPQ3{;QqyGQyXaO=mce#z#mxjz1dT&Z}}zXlSIF zcRQ*;1gzX~{rpI^?l$3C>~bb4;^WSHlF_tiSXs)_LSCN9F8m&gW`pVhJRrc+yE*f(U+0han_^GuczY zst*19MD~AkRR01J@h>Vd>Ep}^Du!)(M5TI|f9+{ZATe15hV|9H6mmv27yXF=e*8G^ z%dEo@Z%*&_`LtDicQO1Cri0?(13?)Iur3U9QjGi*-7qo2m5Ug36|vTBQyzOS^o zzfki+Ilp6v=u}IRQay<${By7AytburbX|K)!}k;!ikPQeq9{}EY;cxeO}yc2KX`bM zpa1sTX`LG$rLD_H;_jTA7;8>{?71@6fcxg8I#G1r3{1ak7Zi;$-Lu=R(+hiUTvM>2 ztdwAr*n3VN=+ymJ&1uAx?)JJZ@BxnN@DZ`jN8lsd7d?)yo%WO)54iuqc%Bn!69`E^ za=kOq+>|&0_Dqp<0utf53V55NyRFaL^#NnZ9tLG45_d?MS1&%EDd_x32}gfyX|CwX zIO8#W%U^1@!;u}Qv^-lzNrBl-O7ytxW1zcuLgN{%7szGb_-Rdz7iU6fEBRxJ-x8?lnL)hSJhPOFVc&?7{zP&dR%Jk2%gY{v@L3&ygltMUL~d?s^nBLpySXPU<6p zTQ($|ovLj(MwD2&sw!3+XeCn;gjsw?w{wGGR|LykRca3uFx?(e+mcS}HIwnI4qrC) z$gcBunsF2~9%08(8u88kRDx)g53^O(b4&nPT;gU93Hl;F{Id}7pTbz-H=4{^)d;XM zf-#i{i%)lsi>`#4M|;LecquzhR`!%d`x>OHvfC}58@VQhZW5$Mb-VkQECuQ;i2t4=z~FZ)ew z%SKLf65E1fSoKzQd>U=|z0$QdTVB1nLfd)uOxv2hp|W~(bIC|_v}>Bi_`z!y=V-C9 zx~^5(bYtwYHECk^kJ2FG585YquFM}#j9rkAqW#4U@E2_nS^Q%)F-at_nv&EMy(N*N zefX?;Y;fQ)B%pf_hWO)CNH4`5O>*z>=5>012u#CX2S=Y-+!&O77rDBj=UpE2BuA9q zpSk2O9$Xn!Ic83dvSR+tRAs+qXyF&pk;Xft45w3Y0@raqnLi7^@zvLDGOf3pT(Jcb zceP*uyJSk@aO?U^CczNdb3`9JDMpg3$UEkZ|H7aSihWCShP!H&qyjU>5lm(s`D5_d zr{2L@4Xc19NI3SxDrbStM`>dFpx5H=-(#*ttwyatWd&#ocM=VSoB)N7A!upyG%U$M zh>m0;5L{%;hW`r14`?3Zo#}`PRCE91I!ccQVtuP@OIYHD$A@u)gDFHO2u7Uh9m4tJ z-)<>>tc0E9uX_nsE46W5aJm)gmP zmtSd26n3;VsU*IL4lY>_F8)hj*6YY$UoPGb6yK+S*itEbe*Mu~sk)r@LSu1-WUi-& zyVoMUmFVgwe|J)6loLBZ-!2}>nf$~+FB{M1WZ6PJw-=_UJnP+|H@J3-Q_(x(t?mq% z>rGQPXQ~ksOf1bW9cfD};3kq|<5crJym~|*7W75*vj-v30w@m1gF4e%GjJJ2k>>1K zWI6Y6tiI_h8Mn2i>iL}+`4c2_=8>2L$6U#6m+wi}E?4y;MvtT3>@vp|c1&LUgb)1* zeKtl6G4O)Q6a{l)MtwJDUe7V7NP=6%Ffa6SjzgS!c;J6n z^&bgxN|dc7N_~7KitDYAOe?3|6_jFsUF^J$Yz@8>KVZ3X>Pn;a0adKW&h;(Lw{ODz zefgKu>8@L!0k!UCy+Siqb;+~_he_ZwYn%4T#*#>T$xpZ8XUUx59 z8+|deXxBNpZ@ts@U*8y1*8=Gq>;hJfz`N;v@y1N;cWoP166L*Sb z9QaWS$lEGzu!pOh>%3e;B9W~7t=SR1g{wN9y1%yTO9Ff!R&9BeURpyN8lU6W1kj{ZFI_dFGtQ`^gT-=EXspXUfmkloD7MW+{TEC z$^-tE?DAHgiED09SL4d@1%L5ck|s@1HP{CY%>Bj*Npy85e|>b2}8 z3C~v0v6XBi`?EvYLzS!xcJy9fQ1deU%2QY|6M|j6AdM^2doY;5ITZ*-OwK! z7Et5YU123$nSzc(RDFx2XBT$!Qq!Q-;@FM>eP$eA!D9S1;qMu6FOgOGa;dGjbqeVu zvB5gJob@QQX)0MZd>xcZ2-*;=dB!{{2$jS&Qcc$V132FZ0t#z+rDqZb_G*EdB=Agm zARI*NKlFyA@b+d(mniG;UzmZ-H^5Ag(G`3`8(BL=9?G_=Z0$k{sp@o9r9%Zir18e= z)Io;@caui{>H`zgZM$95^PsGWROeguXDk(wO-%tinIHbn*!S|liYVeP%Cx$1s~%K* z7uj;!_^y`o@ssh+O{jO&k6x_%R^Jt$sbVyvQ7aGbcl-64_z$L34?F;g;30NDqjo~C z%m&`9uhzY^C!ccIrq3)&SzceK-aT`h;piL9MUjtpjXsyYv+f?UtS^f9dv$+K8<>>@}{ zC>k+9Aqx!G{V`z1LeC)N2xO&^1$N0yM^2mHr;Xr0uS{c3v>BnUK@sF;>WSiD^EqSSf$PBE&KN;2><8?Gge%Hu$*{C}k zX;O`*)M8JE&Zc%lU|MS~j?Ei+N}+Q_J>h#RB00<2)Jehm3Rr+ldGyaP%InvcpGR#- zn<=KW>*ZP2br3_gWx|(bI)JdQjYTF!FTXplDabfeQ0Z#_#m?dE`qt93%bx#b!IO)- z9aOxwl6l4Wxv~sv+{>@p>oaM;pSt%>e4$0~XG8A-jzz8Rr~6!?3lWcboGmW2NA+{? ztmb&?E%_PsJ@JLd`cZ%v;LN*qL|9q9@h5rby3y^IhN?Y(dHMFmNMn(n|GH=ro7u!~ zu~ObNqgEc&FR;HTurD#bRXV<KdopLM&UNj|TU^%w~JvTnaTC&YosyWx*YOJVTe zn*u}0Fg)iueYXK6%JwA6K)#H$*_N>)S@@PknUWfxo`UVu{_gEow&E)|#KF8rRt4p_ z!Klit0P$y|GMiNZ;GVW94V3uMa}0@;JAAvMEUvQBT_FD+;oa`$Y?gnXqb`EgPO5SB z2*Y*t4U~*{WQD4?+#__59ye&Cd5&U9^XvP&&HL-)%NKOPpGA$m*73(ofbrHU@Mn8) zz44Wl?RMVUnbqCj2i-9wHa~=KD(z421Hy_nurk|&HdinB_^rXj-pHdKYElSx!gsX3 zI;Cp??5XU_iEVM>>|95}i92mmVTP`T>z6Lb`*Bx>@$6xatW-V0{1lh2dcWRb)BT2l z1Y)AP1oW-};(|k6L&lxgpkdV(qs|^)?y_`Pqz3Q_^Hb%ss(EK2qeAfzR5p$Tn?*!Y zy0#J5@`lWkBcY=vs7R@sln_@n-JSQkJKFmj68lr(%k=#%=Wy?@lL5a^G~b2qmhZ3b z$I#XU!gi)4_7_0UhVf=yNXPUoCmO0$s8XACh8IQOYrhcxXQ5*j>nay}L9uPB3y4Kc zxoGT#trjL>XPK z5r5`^4yNmm{#swJ@^hzeNTK}1z-AIfM#KXW@+C*YCTy)jVh7|A2MN(1zo@ zw@jeaHcTr(B*>|KTOVKQaex2rC`(z#j+CX1L0NJ-<)pXE7PiV3f*(1C{qpbZ-iS|O znr1O$uRg|xv;B8V>721fN|IzuT-LQmw<^YQ0WoeNzzQ2EH_F+TU1Y$mNE*`nxWg1j znvv<5BPT*KvPVbSm`mp|odF|}tPC9+jLLKd+^uXL_w8tluLL&n+5A=hU?bC2Kzd7# zmG~_9j27F_Cb7=WHyo#|eRzJl=(~B5`!+oFE=wjtL@BR+i7%XqVq`9dFH>bSTOI@- zu`qwJW8RgsQ2fRI9-o=vC@0DM9<#~n!RY0`Ql4kRYCWS*LC2c>J zOnrgpHgBdkLl%-_S)q)}Z6^Z%uq>k^XxG&jMX?@Ri^<5s&JZYMK+GTSwrr(oBc`+o z`bdGVc*T?5J>FhI^9qQ5=8lfDuf{|KD=MW3NIOtc3+7U4gwkQca~3rn@CIlO391pUqZ2Ll_{-;uIb8!~vA8vk3fwiyW zxu?R*QYWE0C+ecjqJj&aXtV_XH|g8(+coxL*Z7eYDABE|x$^1zK=I~GhxG&xzh`rw z{E`fJF0f0|#0p+bF{6tvx^>OLbs78OzU9zu1?7h4%I|o8zkN#bTOf%TTV@N0{)l93$PjUA6tndA4yKQU zvQ9*2d>hvOcl&Mn2?#wvOaKh^71)59L@aDh$*Ez;^Eq+zmoeFBQ$xS6+*pm7 z9ifiPhg2tmE^7R83LD6?f7Y{&ygJ-UL z>UIq#HvMSW_gwJjmy>?5R^=I@1q~Hc_UZhE^h^8Rap$y$+h4(ErNmU%m+HqxIwOVr zQ{YUhXgcjs;ZoU*{zy0di(57?g=%(mxh`&VbU7igL;RB6|_uI;cHPs4&Z|G2iXRJCoKna(xy+072;J%m`TCWKMz%aqQ;6jegUx~)Sh z{l}Z!0XR*Cg_x44uMV8l!Gqs}Jy+JGo?%|18?=}Sk1NvS^Br? zWSuad#l%)wMPW-{kz1cj>U3J*BUjbQ?n2S$SFF&6(GF6OA=ue)0-LociCq zhXQuzimr0q8%}RUtp$!c*IZAAK*rg!av9?4WmfNNK7_UL5%iJ!m-_gwqxH-2l$ z4mE81D6vw%40SSJWEvK9`^2?4;W^#eqmEaRq`+K`xf@-+j$c@e_0?>MzL+z%R{2{$=Z;+kQ{KFvl`bcPd|2A= zZHQ!|Dw2Mh`Pr~gZ*NAUnY^8&yOqPbKF{#TvgYKk0c$rOQvmfkQUZFLLD_Xi)N`6M zQ44?Oi~l%_x2* z^(0o04QpZlidxlCWg-eMFs!1@3Qj%1l`SP55tSffmLxJX9W;3y- z^t;_om7YN7?P0n-vPwas3t_Fl745u}?NVKfa@Iui@KTuhH~LbPQ^<66-)zg{|IF!i z++&SYf|9c-6Rfvmd`(F+Ag7Z9v24fL%+l z{&b~VZFZyPk1Z75yupCU!M6cRgKOY% z7?mxrXSP<^2EF3b;S&>)5`Gs&w1U4BzB4*CqjY?YBUMSYVQ0@CYeGpbxKz=X-(8Vg zOTyX3*>{LGULWChVuQ_623X3{Ohqrci!JquL_nZZ*t+-?U7WhKlvy7rk8gViA4 zQ%3SMOI~8YLtfu(uf~ys`k<7k1?2UCmrVgvw^l;O*F)#d0qZxIhShc`E!K15O@PRj zDwO0>S?q|UxduaP{(0_0?7yhz*11d>_7~RkzC<@Pc1}S_sn#BNf;3h*cGfN%lwL{O z)udZffD^kwlgqC$>Gt%Nl%lY(HGh6YyZVn^Ltc_lRHph=`?Zy1hH3j!nhv0Zp+i-! zOMm={hAhB3;!EDYS$!);D*n#Fp^BX%58CTotaMvI%+__@S|xf^)YT0UK>!CUsGh9c zuAe=_E&48Ot}jm-HEgn(MSGL|f17tVvCq+P4a9Lm)0K{G-WXswr-wieL=ka%EEy5a zSE^D#=(_HfDD2dC-Sk$F3xPg%`w|F?D#~^noNnU2FFqN|X%JUA9HMm5{oymC3HP0~ z%z)GU{zZoliA836qWmTs5usn+B{B%b(5$g8EZGxLk!W$0jto4_NNZf;W%|s_i-CAj z8uf;y+xOaV-e-qLR4>==uZ^E#N6hcN6$rb$vsJzy{A!)gXgw_G zeYDBXvi{jEPbkmFH)6;CJH8}7eg$csW-I59VKVb+ubLJklyX&TQ>AG$SozDcG?QC& z&InmW9G9&v{+BWhC>1o!dlfgcuItklrGvlQ&6ffSZtS+L!`;VEMfhYH6DjC zQ;zCLl1pt0M{jdT-b&oE?J6pR65`8O`pT`}sc_ZardX2cL>wR zbW4&}@1Vr|L)i}fp;}))>IDya{fY$d$~qWd?_$VOwDVcV zz1jVpEJ#;zlJnlQ^C^%w>8cg_5R7jl6!XY>K2b&mcjCv`Gq%lJ))65-IT>a~S0DcU z>o&-|^FAh;GsdWkGr$Vjbgs>ODzYT9p6SP*;|9HpiCQ-`Dm?MDL8~w3_Xg5vgCA65 zsk)>pAYc?TyBntd>w}QLObPrhx*+pju}9Ly-?+2t%$xzacrGK+<5F{FM0t z2@<-N`W|Byivhbq`2l`@TJ#-Jv!4q41R9gEuFFm%7yo_>gbt62`s+akU~0(iASijy zWn;DNs{Kdnt;JWE%9t+;yN%5R`Jt1Lzw$1x(dPEQWbIjQP{P+2^0`@?sacR?aJ|#t zJ~;kZQz!pk?IS&Umy3OqP58iyei%#tool?d&AeYslBUA=75T<+#o(SEooyff!}G5? zu@rZ!AEzxR20Hn|*=OO~{`*{6I0eE$ntJ)k_%e?KrN>0axUd>Y&uMFJTm|yq6YnF_ z!6$4_xh2ds=q^Y|6uxeOcza3W#PVZN_%mq@ybG)VCq)VB?7S&`xXvwsQR&{!gyp#@ z(XX0i6;GCFiY#l(daqhXAxjtsr4hp11ZMV2(=2qTpr33XM&-JmZkRbpSOhvxC@dvp zgW?{!%yO-mLB53t+7U-VTQ>IUlm zY;_XSiR>h>+1p0VUyP)ji_4qo!OnjDfw4ydUggZ6UpQ3nv|jKCnlCy&tjPDZzaSNqC&;mv(0Y71B2LhPB$u08 z1LV$hk)T}ak6p11aKEKtlOsi3pF=E#VKJHJFNi+tReHtCsTt`phjM`kHs8!ViG4dG zS$lKv`>O8yp*j*`2=OdDTfMm7JcT>)0AJ(_%P|IIoU+ zO*xxh)MdD4qNt7$Nvh*^6E*Yx^jFhVw>k}ao~0%E2y@0)w8wFRqx)OH?B&Xp8hyVf*Ssv3=cKoO0e#N`!ESOJ*juY@)+Y8>F9h{q`mQ7uZ_Q`W zJ~ho(3FE^9bmwEhSTE(6QXYc)hJ-yQ_v1|TBGt#yuS`)Mg zbL%|^kL)lvt(^mITq97Pw&->l*PZUO4Dv004yZ|vi?8Bu5%k95ebMpUKV}3kzE03b_vtb+jkQ>54^sv{J-wTO!=)&5c&%1{k^F?nnagEsz4{E-y`qaeM z<7R8vrZ13Zj$-hGn_rHhcg;IhKimqujRY0b~E;{^7GV?og9OwR|wk#{3m=_H3J7vFeE zI0@$A*BVHK)G8?H`F%!q_ZdPIq$ne$9kGq>V#h5vik)aoJpEPi5o3!KcD*Fs9a?si z7G{TMhYtPc(DcMqf%h*Zfx5f>y5fUT^OuhgIN-ju$~SRKPzL?O4lea0mp(cZjm@Q- zT?CIv zY)^?fR+8xh_=MjvZzD@mk-}gs$UEHzcx$111`NNB^sz7b`Len#PEpY#AJ9>6FQS*` z??iK;vMoM+x2&KV0S4l9klfNh=~!)Xf2K4f2%{usYn1_zEHeGv zrKflV|k>F+9NBXeT!`manyVoZS}gqwAQ^?RvqIg7+;iY+nL{pS5h&IoQVP?h+{19KZ!=B<3oplQWWQWk!h6hb)M za3@ok0=u19{u_ZtK#b29uS6AY1m=BZ=#ab77{^%J>}?HP3^ z8!k`?MVE%{Zmm{jjozxZccToFx21G z`;!Kt97f4M!#z!ok6&&Rvn_K>?)Sn~><-fT8}K=J1GOjo*4W#e<& zI_t3IY&N#>(YdplkfF-HQJ1<77nmW6j3rFOFQ1K?b<#q+8?Cp-T|=)lvNKK$h+W>i zll=YH)`wzG``!Y|ZaSpKP@)PY@Se6bw!}d}xZ6XVpjOYQSSxb0Z9%P1$0)AFlP+&9 zj$=NC_~pE-)eiie;Mk^d^we2TmW8ZrUq9;`$Y3R=(4-=#2{N8D$OT_rqoZ+$Ili}s zZu$LVu}$wOxs;^FBca}_|JOaUTrq6MBWz{^n7gG!1&5m3y*i9~BpZR(RrIiBTa+ku zSiej(RmJ9ycW0*gh*fYU4Em_8UV3@1MajVoWN{e5uD|UbSE?4=D7b)Wo zg$nd9C~nG+@q>s9S+$l>g7fpYyqKpy*XF9)QGt<&6r5kV#OS(QSi~yk-|?YHzojbW z?#xqhokyWoa{VV;Wg-nqGO)h zKnEuo`G*f`VQloK=shUE1nPq6wg^?js3BzO~WjM+6mrt)N>(N=vY=Wr!Q^ZhU6 zXM{hRPrXcSSDdmH7XbCulJMXw?(clHzj?N!iaG$ ziLLF8D)-SijERf2g65c4j9oKY`zZ@nX<6M4SexFoh%He4fT~a#eW1<;5MxQ$V1?;= zcK0UmD3qc5gpLhVN3uemDNTm|{0G;YddZvQ6L5fJQ#o zw;1jreGnbwyp^o}AZK2+BO6Bi43Pi46{Uv7>-K=#Y{rA~HTAUJpOZMHBgWK| zNy#I>`?F2?@9pbVB7p5V>~UDJc&)D8Q`)Xtzn)XAEU%y-#h8Bk^k_7iHk*l26z#oj z^B4q?3%7ITrTb^0SY&W$SnJuc1;pn%qn6jim#C zJ?9I~VJPveLGav~GepN5u*P6D$Z)L>1KVdb@qfF0{H(DlVH#!9>Xu+Y4qKXRVV$&G zZohQgM?f4}CC^@~Gez8jFwC-aV3Vb`xvsN4S^hZ<6_@6Ox)Gk5Vkf1FQ4l7vq_XBu zjq(?gB{d1nMWH>y948)h5+cZdJG|@Io0Li?iTODs`KhA7*`!Vu=PVi=$*h~yX%lACVmR^VTT%LgQ# zo7t+9y}j&}IF_u=RS^@C=QsdEYe98%f+o*c{D5QRzo!l9UnIvml$uLSL|as`%!sD- zP8&%{J(NWGRqiB!1c-n;SZlp{{P=O0Q{?4ews9lo{6eGB6XB!~(xrDfeT{WEdi~l+ zYWzvNZVWtlmiMwQxm@qjL7>?B0wu0%RKzP~a5F|AY6G0^#V`G41$Vg!aQk_6y-(x> ziL_C>nyx=!Y#{vm4`g^CD2zv*4GCF$2rLT^BtvPvX;5axN@+JrM03gj*aeQ^uv25O zb+mgsEv?Z~CiAKRe;NlDJK7Clu0zl=ec-H2IoqU6U3Chc%QKafjL>r70aTAvRdul^ zS-C#-EJ$Uka`2ebUZ*5a;l0RbkNEUr;~lSh>6SmW ztCS-ST9AwwW!;ZBR|{0lC(1(l*Txz#4g=9@?1co%tc2`byjPMnsic5O(f+yJ}!35Y2$OQZ|f8#2eoMbxYKjdXd=9%QOMY zb6~7Y&!~0zqsAa=4Q+5u%IJ4X8`vB}c1P^Uve)d3bS}6Z7{rm5D)sk$;w$3sl)vkj zI9_%-RcMje#j9duZsoWlC>P-raSVX>*;g0fzQ+~;x1Ge{Hb6T-e!$)sNld8EX!?-*99^IZdHNF&w{!es( z>T%20AUOB}&6vMfK)ZDq!_g{!KN9`+oaSI@$-ro+DquSNYW&ADYmmmoRd0IPD)eoj z&p+|(p+O09Y&>mEa4Z1$lc@g8Qpah6nPiv2^IVt*`IhZ0M$#>{sP*QA@IEq7Pos}u)0X{o^gt#gYgOML}x z3g6$e2}or@!@RtTPBOlAj#>wVNT4|*Q@Kl+n=V)YL`!W7bzfMTvwxrxr zz6BPXv^1Sbe&lf)9)ugEpux&oZZ=@n;Cy;@5=pSOKU98*LbNDG=AC#;RRyPy&?LpE z7v4V*os~WOxYRQoh_x8?Rn^wpvgl=}8hff8|CQbQ?&ENYp+}2T`>`+9ieub{S{H!< z`F@V#*lpr%@FJsleJ?wYt@8lj$?LKJxDJANr$oxGQg`vqcMxKWhpiU+f?TfyyGk|_ z=h)V^ZJ4|bsAzLX>8_N4O{mTRe{?XJ5`j`ypt%#^XA`EXBhTh&Q}+R038|C-R5YTu zDRlc?s*1<3NxHfeoZ|K;>4AW0jc2RoUJ5JTg5>RR4E;Xlcd)Q*`e;wu7mh=Qb=NB5 zgCcekgtk3H)*52bCSZ^!CvTXm3w(GW^0e|=|8pVq5_~Ox=NE>&S->*OK;lqiKwCew z=j=dz#a)BsK^KU)PRP}P1wio3HB2hrJlrJDjApL$S)5X}VkA%|_?9_fHkaY)H||V= zC*T#j$mn#1wIKg>=WjF)tL%Bf&sHMYgBSO4y~d}$w_}BiC_3I2;fzvhnLzD`UFEYW zNiWUXD~6Abk{#L&6C1sSd(y8f8%Y$vUS7_7C}KCmSecpoY~z@_Z{H472F>LW0)5k6wSX%=*dZo$-v3Hu?mCkIQ5#1H zF@1LB*yfpdh_Rbo@tQH#MD|2(j1Q;+Oyg_N_`0Ft8nwgdsDaERPQH&4eY;xAm6kRt zKdfL%ky8IoQsk87Aou1>k*=~9%@FB)YwEgp8TMtcS@xMd{wnY}JNym25-sU(!yBva zmCd8X6}>Nt^N8zmau0F0HEI-n88uK=H<$0Tu3|W??!+#16ew$O>pHhpc|CeNk8|qP zC%Y>dEEmJ243}%TA@hYvtSRlJb=>Z!-im)6{lmMpp8r(9XQS@9n#&I##j~>u-jpeI^QMeuue3o7>C>i#gL5I7 zKiWGgQ{f?~{!ie99=Zg;Yy@*s3xkp$#6OztR*ULzTm2HX!dHfgSVGTf&NVi`|Gz^C z##ON~-5qnJm&QFGXZrGt_&NsK6{US}7=oaS#W55y7&zRh?G1Sc`C}-YZrV+X8;<1J zb7eTa`loB+!~&KS;p0*LgFofbv$MgYxdMyx(v?5R z>)(brBf<=0Bk^*f`KQD;Ato}#D9b7jf?+H)U&buc*pTZpkh%QP$DD9e?l2|YdRSgw zUJ$;$yo@MUkwxDT&|3U;V^X9!1^P<32ZAE;$q3boDPmlUXE7sH&0Z6LfSzcL6*DOO-;^IJVPS1DcK7l9kg92tmW83a2%Ty) z4c;4am=%7S`XzhE4Dkj9PO<9X)4%VY@>K!uHUJplL-Q)7@a?HPRa!+)JW1!`6<OdJs&}<2Eq(sqJK(9Y$jf`%3k#E1uh~@@nWFc0f_!E2F!(vOWl))x+2?&$ zoRpy~%aq~k)UHyil*$Ppk_@PEY&$B`j}I|tmplXxv*&%jCCQtTe418QxFXEKqM>%4 zRJjhr#_-3ixbNmnUnV#V8k3-|5Tv` z%B2hoO}(v32o0SkIBrK8EU55wNooNfnSb>8MTs)s2TsH+$E zJ8o&*%nSmdueBc&4qA0tMDf5P!DTM4%Pny;W7<9QTJCgjM>br3nj^2vCAHn5 z)Z7EMQTOYu#Ui@~$zmzibFOKT5Bp89T|@HXH@aqGj2?O=pbG@3I>qw{Y{Q- z^!7$e$Lh4_vT#h?=tcJW4EUCxN(LVCMy?@WJJ>ekoq2^F2vzZpE5o>(URI=;^fr9HMGsGmbRzL|T6&;ayf0bp6>-lIb?Z27D4nPX9- zrs=<7rn)t%N51Neg^N|Y%BE&re-NVUBTi%>1`Mx0+XNS-1<-$g9XfesBfKVHg)(5Im~K$6aqWthXM3D8#d}#4p1mb>be_4aee8S667$(P*8|j z6AIGoQo&?pHz|z8YdJUgsr#wQfR4g*ub4sTxVH)56E24ibtb^`fI7{5m;ycOL3LVw zrLe#s?QfoYQuZivBgF9~DXWyx5z__G&4$2Wwf=sWDvE1SWe{hm0o{Q+ z-Q$vuu?u;uUmh*U~wtB?{AR18bxoc9E0kG&N zn$JrZd2VQxk^fEbm-EqU^2J8S=B_?7HJmGTsD0+6g*(y@n3Tn3-4@S<>}4&{u?%gD z4G7AeE~Wl`T&dy3V{X@6e}QFiL>~So#j(vH%z~8O8_&X7)ObHXwuT4LSM}A+d~$+D z{R3EEgke!;Y{YAKeoiy=;-bkTA(?h{wjH4w9-MQRtLTK8Q*AZ%H4kfxdqBH@w#hr> zZ_H?V{rck!5;2uK#A!mz3#La$qKR-!fOvUs znyA=9CO;H)u9dJtwo(rk_87~@RgFVU#uPv?r{hrOe$DO53-XLtJZhmr?^)|Z~44KIu< z?x8CcZ2@Z4kz0mJ&t+s*sMs$@69)ntyG|uBAL}Wm3rZOHrL$V8aY{-`>on-&#e4P^ z(=MSxS)(=8HZsh4#o8s(F9X;fk@fXqf{`qQS?=82^y=)PCrpE#*x&wf;g|maN|}By z1u4v_-4wSVXGRZzM*~njaTW4#=X%-Sslzn;(Lzr*a$W9;iDOML@9n$&Q5>8 z{jX;^`tc7&A1LJdgl|klYSI}=n1ZU88=PU=5R@HNj)y(v+4{=lhrh(xi>u|~jpi|H zKrleq;F2CR2d_TpIT^+&DR{w|Z|Kk#s=WQrRys5&LR~F$ZuUd8UCgrFP*X4uBghX{ z-o&_o;CMo5Z&HcHASIzY3h$aJ>nuQZW(VAYT>h&uopy6i=BY#}@Sh#h>BHHh3ELZx z)rD7=16Mg6zJ@N!Uso>Fz31-{m(2e_QrN%H5I^QyVqM zV*jYg=F`sa^Na{kyQ`O*A&WFD{i8-TrFSv0VW2N@@XTyztEJ30BNd`Vt&t zMXKFiU&yMfBC?*EGs=+I-wektUBrC3Aqt;zsTOgS6g>u!SQ&!2p7$T+{igtyQg+u_ z$j@?_{>?%*|5H6AUju$kH=U*GX^&{HZ zRm*h&4#0>E)OtL@oLwMXq-O5|nVbpd2AY8kaV7TowV2^RWa89By^@|*=;mMM)R?wB zOoAI#bjKU60WrC6i`jvkgg^3=RXt^GPz-)gKu(#WPFwIR$#{^Q(Ck+soSDf1eI`DHO?b-7ZoHju}oy0s-{V0*-o6t{W}@;x|?Khjv~pZ8gyGoO%v6 z^rsAXNWTVLi56J!s}kJ6$Ih;azenF3$xaC@R=G=7T2@if``jjIKcI(yHws~h6}XwP zuIi78TN)O3my&&fz(N`w)-`PzRdG>@QZo>sUb_VBx>xC`n!m(-$k9rM`-N@`ZoOq2 zrt~tP`D;BDGW@ZG@hnr3KPmq8rvChti0Hf9HR}Ls!E`(n?N${&rA&$U&+b$L%J6+0 z`!Vjmq0XhJ86aFGG=ToLLvm~oV%0D%1?FjaKhRe;IPRM|oung85#%Tznzt*_KinXY z!?+MF+E`K{c8u{{O_M)N>;1~En!vJ2?`I?Gd8rvqmR^HgGu_?5)QM{^9&D=s$zD*orL87LV~7Ux$F_5=q=x7pWS`y^z`J?;^-3x7xn!PxMGml{*m6LyDcuG^hml{89K31@ph}D;#uIAU#!r0gX zw@Ba?Alt&l+L49EE$-_}#jGrgI^C5{6?d|e7SbIw^*jFr&k4|lX}<9EKeA>^j;TG6 zu^kfoqXs3mu-KOV8f-uJhiUH`sfHl!20f_MlmPZDXtY*ea#jW6>)lV6qg%1}1Q(=qe0JQ%Pv_v!QhfDo%vveX0KYSI4QCZ1vF|(b*TuC{mx6zuD z7E0f|i9X1_^gpdq`l?4e(j4jINg*UcGX^&W$(Ht%3=Lc3)g`}`8LOmQ0XWkv9b$K} zWl491q&I4A-SsFGM!~H6&296AQlGY~pkiUfm7#zF z*ZYwD7u@&)Ig1qpRU|B7zc)191awRdfQd%| z8B>+}#e8DyMv#jLJO+lpGAKM7)vqYBOideO;g{cug6~xVCnzwx3JdFEGj&yIR--dk_HPh9H2 z7#wM##I4(~i{*R0Lkg5j0#*BwX>&!P?3h+0z*;|f4ai%Q-LWKXisw&W(nT&+0EzRP znm(daCRXXmCm~Mv2ZA@779{JvW-$xWQfM*h0pBbvi~&P2$i7=1iQOfH%@N*#)7E+X z<^J{3@M2!9vGi=a^-P7a;--vG{1(=#jyReH5BXkZAGc(3y5AVtlKI|3_##?0*A0!J zURM`>(D~$2$p?49tcRnGT+N@!(cId!uyzkPb*J zi{0Jp17VyeG;E_|LEJ0(Vb`PA@?wdM*4g6jvV+-NB`iT=TRffZ?G07Te1!|UTp9!C zumA_EFx|Mpo4m=%Eif%X4hv=NnzndqNNx83Mm*AaBf|N=|IFpk!_#(E&L9|f=Mt}L zyVuKi7_kBRAw*y+m;4yjdoGE4A6R_*w8Ga}w{23q5E-b59OLB=fKW?nSe21u!gnsj zr~h_D`)x}Ap(4R8r8`XJgzSdS4v?((=Bo!x-7+wSa!;n<`498NS`iH83@gT7NnNEBDj=$ql%#etxpAX zJn4b5`T-f8C&L`2qgF0@2OEXUlnk4b{)tHs8OyY(DjD)heCQ|&yhB*@2ofB3o+Mx4 zF|emFzN~Q5t~3D)Y#GBHJ<}=L;%Rn7i{ao7u{fe*e?9pcEgLqb@)Y-*A@$sJte3M5 zS6H^+c2u2ox9V&>sdtdb-o~{>9Ux13lM2J3B`>;rY6894H%v`4uJ(FXOd$wXNS)~8 zTOiO=pD)w_PGHY*s3GW)M?fOqaKu3rDQmtnUYXAyz%_!@ivhbYqU2;u_f%&mtcG$D zn8tUJL-1ZFTJkhTo?U}P{D1T6l&1Y6!(h5$=>~ox8S+a&;O3<(%MgPwTc$e*@b9zS zQk?=6M3#Yt;DQ3qh)kdszTFBa$_dk3+MvqO4t^83kYZCOw6b8-a%&YheWJgH9M|(w zr61M5F1FC4Ry_cpsOqGP**)7FLcr6$Wg!z)tT=R!8y!`K08H3KHTG;?3ZoV;)eLd-+Z%0O4ZvTEcrh z+N9&e#hgDH6FFx0A)x>%nuJ*1(z>}<>(!rMCB9;6qhWp|bqzicHvg$;ILG635{D>1 zJY~N$)+l18B;$*?8R=KiF>8Ks&Zo~kb%(YAXec<8_MXgThjMh;h13!Th}^xhIt9N_ z;SDVh2qbOPJuz_F@HgaG`Uwk>3y`zWz)PO_MaaLvLtGjM(5^7|dO(WBL`7M}(?&0l zPsEPAHF~b7VQw)a7e@hO_q9jtfCvJYzR5|Oulb%6IGWgW3|d0dW8Q;p9$Z(1)F*T|22-oU!u zD}P!SZ+Ot`G2o{-sclrK+1uoSTj#JX=zxYX$JPq6!sdpmYj!w@2nzH2u-1%%z*c#e** zRb7W~NRL{>q=LcAQfQ`bxX!@Mvh0$EyR$!0AgJ~(DJzRQhYT5*nC3F9&Lj#&jwbv8 zQ+$>CkRYV}?+i~|Am@m__jE8^EA%n*o0{r#m)gE4%fRiJUK!Slo6DRIkLqz^J;aLe zn6>4-*;+ZIQ9NgE%aE6nz)6&p(H@W6-K|JOw2c3+rySf$5A zCcI?s%)yDUpg7b#1EVo-T~O{*yplqvo^TR3g3t%3p8}9tLKNUhz0E3h!TMAr!~j#9 zeC9SNkNZiJ(sX*bIC4arZ~u_VptNW7E-ddJDEq%nN+B>eGQzMu+uwhaCR$uQsh!vT z7$rVFTGp*_P#$?O#V6I0#VA}4^)@K^ne7MYuND9SjtP0uP`G_0j+*Q7Lv9FI?S$@# zran!s$NG|FmeC;R+AR$Ad}On{S5@3G3{!DTM@p>JFRwOhx}@mTB|1M%S63`9sn?(U z&*rH-a?AoO-Q!WRX(7MRPa7E`l%oqF zQ4$Ge_@%*zgqQ+ySbEu9y-7u-A`sGTE>Cv_G;T`ly$|15<9EW_o1IW!0v+8CYb+nS zQ}=M*KTtS5PDzxxK zvkvHhJRg`QRp{7uoa|m3`~bjCPJ|P#k($UiH?2r=WtNNWz74`%cwgSHvxAhxa5`n| z|LSUAnBjY*d?_s+8W(#y(y8fi{Axr4Kmx8C$lk(W42aSJTLXCDz7qpO_cK47 z3Oud(Nop+7wkmSu8@?3Auspb>JD8x!fz|ja(Y78Qy$s(58t&nLZOEZe09K8C$iq3B z(NL04Q|m6NZ?ix!W8xTCM}4NQ9hCX5nmg90c^2?-?d#o{+UbLeF%F3a?(t~`$>h4a zGm|7k;WSvg3@Joq+E=;9r|Vp2zehh>Wc-A$L)sCMW&TKFaf8sH6{iHvNMbZ~EMh=0 zNia(rQq{AGM1jJgSHIY$ZP^t&ToD%Tx9CZw?ONGlcuK< z)G(Zw0(K>{P~D-LeOF9~H#Y*>fuQw0;td&l4xroQzZl#ho8H?x1b85pAthD+?pIp- zt%)-^G5&XWXQuz?0)#kL-=xK1on!)ZCXe+Mr}UgRi3yIqEG)yffhr%#N-v%-(T&&L ztAjAww9vxdYnOizKG2}QdG*{?zgZc^*N5VY$(97Td>4Ejon| z0}am{Jbs_MBae1iA8A|v>HYy2`}+QnkC?SgkGtK2fl*_NHH^6a!YwEE+3$)f?6N?Y zv`=77bX5dgO&{?QmKKIIn_L{7YkiL1@ED>kUmNj1iP3!|+hxT<|` z2a+rAxY19APyHluh)sk^3&;GQ1^5Jc>zT5-x=cKd%4WriX$0Q2;dU@o;2!7XVhit? zE%gA=4R+9+T6Xi6j+6;r3S|NEMo=n$Sp=cBki-R=00dRCSdv6G3s^4| z-7yPm&-{ZPY<$%+9rr4zlT$8UV7XHT2Y8Op4RYi1^{y~2GldIA{~uTH9o1y8br0K6 zY$zg4iUKN9M3LSV1*EHVX-Y?$^b(2`rGxaICwc&u*TxxHK=LK+iq}|!_8K7>3JPm+O zw$$|YtQ!_#^-4MT49g0!@8REw+bq%-g?0M)mR_kt|<5zwAW7G@7t&*Rb z;S4{wrS|)H zW_&jS6VX6viP+f;8)>D=DxaZ@Yfg7Rs+4X6-X9-$sT&ljZ<&*tLIxaHYRh@y9NfWz zx861fCiAzj4|*GK;M{OH#q-|+m0V41Zy)~Tn_Xczo2a1nozvQvffd`6 zs9CKC-wfB*ht6kXce4allHpz4#>pkUklyvSYi$F#A~~Z9n5?f`%8mMSu^RhQaL_Z_ z22K*F|0)KqYa(H)M%_gvqs_%U;Mbp*$P=NLf#xi}ziDAxxgw1B)LwfN%m>i-Sef1_Kr^+d*5$4o7z~5drTEbAxDLCYrPo&w4~vpB2HY z_2XPPl|eI|>&8Yp|DIhF?X}uZ_aCWoC;#Be!n&UGP|J`;=MqpN8hL81;QG1rV!XPK z^(V>{YkF~*m$olu*2*G9IpTB1d!(D1Z1QZXRvxURc@gm`J`oR60T;Ffo& zpP>v1r!5xV$1weOkzND{AHP}?dO_l$oOt4fDcDg)RVp|$HOr-`8< zRW!WezV1Br6h%Fyj_j=#6~#Xct|ASI_QQ3Lf5m9=fo2*K0KLtR{mIUNAUQXw>fq_+ z9z%B15`un*aW~#)a+XwbWw0bSFY*sLPe)jeJYpr;jMl6Fe65n z^W?0I@@nGKc6$IMq@K@uRLRJ^wp9@CX#!Y*b@d<%lm-p|EiGl~)u@agPi|UWy#9mJ z$u^oS6kbm79ZBZZDzj4XBBaN6JHHf#FcEoD38~@Uyp8-?|D^&(>NpQfESby=G=#FO zdObx6C_jbv+UN9omX*VIE$RTLti^ut%HaRAF67UZ_?ll2Yom)rsdWRG+*cHB+*d@|&Kis70 zf>ERQ5|fj~8xFgZ^%4InLyh^i?TnN^1r})iucu_3bDG&YBDkXu{ssO3ES0y^6j zUTWmzH0f$zWqVp@GQ0$r6M`0|XoHrf8KcfvseAcMKUbO09kyZRS?+ z|MQl)mP#i#WlJH%Qgyiww*mEHk2(kpCG_sm>ZCoF2+{!C+He2ZIWsP!3*p5auk^1I z@)2c6@rfqeO!z1c5C(c>K_e92BApAg@G2ZbpI_YZtz}WAn&`qs_=h3Zi|H+9iP5)Q zfneVmyxUpv27@@je$O;bB|Jl5Jb;anu5;G^9^*woVeG$2)AGwmA z###k}Fh+WtC|U!JahpEcx7yA`l%wO2{+<323ofWcSr5SVJ>$Z9dGeW=WM!KOJehDt z(|+)|iC6pmVoBn|)OoW3LzB_Y%~3X5>e2t!`r^j5M0ZnNK3Kr1uihp@=d?WUn(~SO zd|Auh5`YgmdNnT*ta(&kNZKG5|7ag-M3QFkG?=cS5%pzyF?X>dF6Xako?dCLka@$1 zX^mSxXr&pO9*lWu7@&|%|7$4%x~cos@d4*aMu;iXA^-$6TO|{>RLQ(JGx2KHC||Si z4+Pes^pDym@Tr@5msguI8yKq5xdlmr+w6_-buO28#2oOxLVPl?5?_+ zCQE-2`17tKFjC;tCLy!E&}s2CNDjd?#!rhD@QS{3KQ-WV3xzuHUye@=l+!GE@{RJN z+5xO;+QkD}7;1Ae7{I~TF8$zm@^kl#ZVtz8@$)@JrlnI!Y)to$4AF0Yq!Wf;_*j7 zv)61o`QD|(#Z5u%@8@ci$(6oo7~lvn>l=UFk&PbqNrE4qkJj7_w|X{U1N2hAK|&9o zs9cVB&n7G9=yacm&FR0%Kb#fpwpV@$^A|KgV=t2m?8fW7U5exEy=ZPklV5{&!9J=_NReQD9aL4j|N_Ovq9_e`@QkIbwL!;e$de) z6LcR~H&?0z|MQgJGy^Aj11Ap-b{Y?M4!Ao0rh?k^l69=ad>y;?TRa3r6Pl_JU``>b78JfuwrOKf3mf z)+!_AD^WwrxV>i0BF*vLcmLhS>{jd zB+}ueV_Pc0rXP@)CQAQj5%wYg+>rH}W;JdtCHRM_qmdPHtLS78uz!J2@@v9(S(DcM zB>%e|C;P5@$G6ydyEP(u)X1OCrTO0zij{p`>lPi}!_K4wm92ApqWdcw5YTLEIQ7}C zr>r;sV}(>#4B(1KFc)g%R(DPVxq&RuXWT#=A=OWp?m70FnegHSdxfEprJ9OV#?M9} z0J6FB1--cWe)dF(M=5|jFPEv#0M(0;SJ98_UcdXa%!(~Rv*}-}>~Nh1GTN zq<0jkHs*&w2&e@LGY_NvG{Ke``9Q$`P<76D_*k4OYloZ^QzpmZW|mWFYGSJ-i59M| z!f&gSOYR8_>&V}`az^5Z1-avH)ryop_2uF6c7_y(2_2_&whbl6V zRCB+hgPbT{_f*X}Wm;%V8ty7%$}6G41m6QJVRX+c!m<~WgsNwvUfmP_{1GlqPsibb z5#jtzg1!ML3{Vaxmtg_i#a^S9gwJVo5JEjXuBMb%nHp3N|GsTo+@m6rZfKw(-HA=3 zq0UP*p>m9Ut2LD6K}MTw4N16D%R-E0U8W+Yw-r0cx8l#$u=5SEm04j22ueMC)`wp5 z&%9ED#mD}BHli;XI74|rl=&~Z<)B8Et#iAj>C##tGmx$XF?78O(;9j{2lJiHn0DsF z*xq5zQZFcZt?isu5wyK-&)3*jF1uKv`IOa^?X(=wp1AIkYEWj@|Et}z z{+umA8r(haN}BUb$~#~3CDrS=sqhVZE&*4m6ceh3xb?~Bu4nL)wleG~TOX^LaDLM= zdA;hxifriqfAY8QVI5{_SLHR z9>CN6Y?2ltw>hNj#+VPRN}%K%0Y1QxjrQWhsjC`Do#H0>IO)_)A(QI&zo>lkHdbu5RNjsDivYbGAV|L~ow|`0bH=-! zPczlNbgGUZFAq+~z1EUpotFU@K2~aM%$^=;JxnDfqY7{q6%cP_-!FPow{hY3+=Qm& z3K_C*<8LcNq`3e+;2Pt?wEkc^1nvwB!e**1gxUlA3HRa0GtsqxIC?uLc}~s2IsYVNNjAg!ZT#s~@W%qDqdU$dWX8w>r(x&wq~Upw1oK?T#)vFyNK;6igG^oA9TC|Xv-Zg=8A^4R zm&(^NlZjDSXC`97>ni@w435@0pasMpe}=4DU!Z5J*WuM|2AE;D7hYrHyyr$H()?@& zb%6M7Jb*%DeEi5abmV^c?oQAFDe1rZ3KaN;Rw9(W4caK%*Te6(smNcNSPB`J00*F&?JmwVxmQy|nfD>9@27fD zQ$4bzk7PewOaO4yn2V$4oo(Djc4vSbDH;LBS?ne9F)g~ev%xGYygmKNlAH^xwXUvs zhBHa5Da4%1OH9%t>$e9Tu8g!$S9yf(x>B8|+NhxV_)CpBZO~QR+N4)*r+Mw*W$k zx3Aj#0cNc32+lLbyTJkGY>asBay^XuLPX@LP&rF&(=3(8N1I+et77?f=j~lag%56+ z)A7L>L#)S6yktAhoW*+YMM&(AA5gWX%?EFS`5o_SeLiy1gZCy+D62Jhj9e>^(kr7^ za*i7~@4W`Iao}@BnXj@c+&j>7BDs^@a{_9IVGRe{`{ukArnk*PM}Xf7^6E?@`aR+exmyO3ZK5>Zfmzuh7$Tow;}^V5jf=3D4JX zmT*!^0Ier7*w!Dz;XQrY^LpndXOA3Z#K_#3U24;J8Ft=v_hX|A_@*$)xDOX^GIzeO zvSg!6*>|~YB7pAUojFi*<(TUf!u)!LIPXVg)BNyXaQz*l2+1j#0w!ZlLWKo$>B&{1 zJ3eL3r|#UfFz*V|-c-Teo`OPccFIYzygI~rUS?VW}VV`x@ z{l|Czz z{M}Yx(*HzNbGDW&$*g-!8lqZW1iabTQaWN@s8V-Pv5W4JSCM&P1XL)ZRQG8Ru%x;` zHG8)eJn0(LJOYBc`I%151f#C=24=q2Ogo#UN5Aha6qnIaomVxFBo7HSkLXlDevM0T zfnUwOXhn}N#&tSXyq)$edUZj!^0?D=ORc*G$-t%<9!N&QIH<;xel1aq)ZV{bi(Iim zS*si}j=N6A0WV*KKXvLBn*g&jU*< zzCf+AsP8CDvWGSMg*hwN>_p``cDc_U>D{cye?}dtkXl2Yw%7qGyH+P{3rN;$7m-J4 zw~c4_CY>57_O@&bkaJC^XunOBkJ6lFx>gE__Zn8dL$OlL|E5pNWpk9fD4HO`*e;dk zaIGT{jF{{UA!yvM$VW6>%@>oVm{vLGjA{>bxL;6U6Lgj%DO~j*)abbnrcx_Fo!Ynj zbpzJc@?amgFy-5O+s)j8Roha*^^2w?#NPJKP4JQ;EHiX>6|*o;o@2txqrBYwK5a=0 zY4pK4$^nr_`HyDTX)j+6rIlB}^%eKheWoL&QpRd&s5~#OrqxmG>cOa8*{Emn>yZlL zv`CJkRT(|*VS>8g>c^T|d3K>kMaEGX3)ee}GflzUxoE*DJVd*+P2(q(9uxctJ4Pr^ zJZ0nU#%=+*71GJ_$uEd!(Kl?U+rj4jJ%|SpU&$z!_}Rub)!yV-KcQIv%b8JUiJv<5 zpc$0I^2j?qUv2VhMVOi#-XX+UF#lJ;ak-q$7<=UsnkB;r^v%QfI}>57Zaq?SVJe)y z*Sk(Uq9%a6)QwClS5N;$z0-$3lUQPL2z1uQiJX8P=qdW-PPO} zqBI`tJz!_8Pees&9=~f_BRjo!&ldXrxmjc~Q4Ft+2vZ z=zr*w^h z|79Fn1tKOZoBbu{S4p2g-2-t48`Pz*H_Op;?so+SY}=KeHY_5oZOzk z;-n7^S4v|`{?8xckJf=l<+|L3mpS}T!}O~}mG3r52l59Dw5$Yc-*-U1qc|Zdn5d`W z;^e$$$AQt(`+CzNySee?0Ub2XJBOPsPRUB;g*n1X6+5F}V)%0Ffm>t*5u7|Bf$n+i zn0tNWHG{~ZF&0jxht5}FYx&fs@SM8)o>oWvK!Cit(dj!0|8^7frMzZDU&ANj-u4%s z&vTq}^<&kpc{DLye>E71HeXH%q55RxjL5a$;)Xau>7HEHS@P@@Ffepp3!CW!H+*?) z6~*~>jHa%8{nOu7JM5CLzm457{Q8YDEF3{Jdpe$Ocn$2?C~7C{o36G$u41Mi9Ou_x>kd@sluWwcOVFfmnKi1Z((nY zB&o6q_HA+ccm+b^R}902MFw!YBU@t7C|JrYcF_Yvn$so+q$n^X?Qvq?Wdx?KO5JVE z+cMq6qT?Yqu?1UlXQ&IVkz(UXiR6Xak;-FjiEl++ooZA{rXP0PRu&#ZDG86cK`Jse z&^V%;R13hP3{)LST(dVYPHQYNLGbH4n@~<-r1XqZ-?BhwtTVo%@HT9rfAP}bTWaW< z6%Gv$j8-eo;~eHGv(p|fiQ*`i!`(_5k`iXAT+2GWq1){Y&US`g<~A~(P32sioE=>u z>6sLdC`F$Ct$WC8=3y?H#T*7L$&a!s-%CLtKl11kbNvL(7W%CE`jl5aMcSccx}5&h zBTxPz`o&QTsFUsw_nc^<+FR`Q7sFWC7>+lr<&f41JHUMZ%WII);KGi!Hn|FMR&vD0 ziX@%OJjQr1KINONHwsAD1soWp9ddBa2u-dms~lXvh^=0r0iA;JSkZ^`B<6A1`1WJ| zDl^UW-j=uim@v%&tMRK%7=?Y;o$TFn)XBaM=sV-?YuLiAJ~QMJwb{LMnSuAoNWoaIowb-Cr_zC&HDFDZEbEjVavzmwnuG? z#$A#EDSwcw8asOgSJ_6My+D^emy4TNKPmkn&Tr*o(s^5QRo{hUYR0io8eJt0yifsN zm|3EF~&5zXIZY5S?xFd); zTJY!qf4s{VzAT?V7eealoR6(QVk+G^lP9^t{P^)YW#p(R@^#d(Zv;U}feejj@hiq1 z?uusFPdZV3Z}St-=l8zE5?HF@v{9-!HNI}9+dHfqx^vgQB7KfwzhqtEuG_E+XB5z% zb~=Hjoi=1hW8B=A`V7?;G0iwCqxGJ&=1bka$M*};7(Va1`1389f~1@*u>;T}QQ?A$ zciN|8cE=8aUYF=q@aS_r5-xm0(~CM$p7a*mK7CYPfLjEHQCeGdM_f&}`l-z4$5kNl zN4^2=KQMBN3n@i6k%2g{lQ%vg9`=ek%!sFTOY-80IX6Wb{f+&Str7n~=<#KDgERRz zVp)YJPSljC`zKih3Lgm>mP zrcA76yq&r0`;RaC*60I+-t)}*!6et47W~+LlBvA=RRi4f-1E?@LFRA9)uE6zsTK4V z>E_PPD0~;4zCal!$m3} z<`uTrj`!UhS7;qzhcrfBJB*-ozV*K+%L~vva(JC_Po7AEq&`aewU80wld{#Ew5!uF zJuX@nK6BJE&TRx8X^`0FjLC89;NueN_R73`;i=&?cU@(tN5ZIkZonh5|G}&+-QmYt zm?a3{Pm_Ie20jjn|Dow%sHZ%AI%?(uCZC(X`2gg@Ur;$yCr_PP6YSOPhlV~W6_b{J zH9)q%`RZNR^`oAM7z7pYE(>h~`tiV<7fux6`UnQaR`F+%mZ!qsy>r9DYbLVYd)m=< z@UxMs8}`hKU8hVg3$$>exJI7Z`+{6HeP~*d6T`76SIa8$Bw@tHJ#M0{$@Zfg`f`IQ z?X(Dz%L)S}Qf7mJ(R7{uCJijJ9~#>IGMJ>i@2iDlfL z)KNvwNk`+#4afVE(-}|ZP2_dTa%XGGMM;a;lf5uo9q3|8T?wlM=JkaGA#_vvT4vJ8 z>iC10wH$HE4y8@lBs8CIa$9&N9XH$5XfT{+IV){o9#9#%PMecGjLn73{VK}@`IaP> zBKb5cB5>2Y*UJTV`H$jlg@=2sW8?st>`p`6AbD@o-9vbo<9NaLp7gH&R=~||wr@U} zr6=~0gJj5AleBRoSoRv#t8oiDGY1ng8En}JRCp-w4AtDKDhQj}L_14gNe*%!`F{T} zUn&B1^xz3fSmj$_G4s+$R3|Eh75>2$OKGWch9V>S z^b_LlhkXux(Xx_nxRC_g{iJflkzoOTw&~(A?cvG(vcB(1s6fRV+$^s(bTr)RyqKS< z2anJU*`x?yo_<;4b~0|XDsvMeVceBIJ0LSDYG&yr(w;&u2|{hs8u#uCIx>uH5{6!+ z=@0bQi2F+nXSF^?+L`MJAX`!)9FKk;{cEm4rVfkY9gq`-za}51Sa(PqrYq^~!?tt*1k%>MgOI6-|boD!iF#cc|`~HCF=CBi3A$4Vw z#L!hS2TC1UE-0smG)EE6cm7!A%tqUAes0EllpfIgR83Kt{ZH@rHFHP4(|+3Gz0~xMIJ3p><9 zMlZiG{%Q)%wyFO$$mgOSfG_5L&kVB7<6j+w-ddFD-l1uyCdNjNf;2qL&`wTL;FrK$ zvhMw#t`CZ9DvTtwPg>5~=EvTh<92F%We~=H5F@mT=vJyMSYA|Q$9BcrM^)@M*e7+f zY@c>hK}yI}-xkBdOPZL3oeQjNMjijDeFXM*hYS-Y zYg;*BNrv`33Z}a{=vpg5x`?>wBrWN7rVqL3dgZS3_?=sb!5=?<%m@v0x<{k5i2Q3c zU|M?>aH%oG^j(FffAN_8q$0DWNtlXWB-74A*>1Bx=oC+ts>)m~_FQ>>xI$gWPj*VQ z5IPF_6Hfmg;$CU}lCV1=8j2J$GggxMev5ktNIe9!Yw4>wr9D2wGjrSrON{!s{sP;V zI+xRax5*TPSGNShEkcP7-D1H(Wk1l}=fGQo8yT__ON zzJGEPtHD>XLy_y9lf0Bnq`kSrYT>wFRr{qfI7r(`)HvesEmzRH2d3t!Thz_5)PeD2 zAjjY5@&qDj{#i=x^p+iSWLAFk?{#@#g;&aiipL2!5%_dhgV+WTao~V(g{7OXuY=@y`}x;!-4?CaZQDh~ zrT4z0Kf6)Z1RjxJSF1ocS}8XcGJ^5*9*)MBM;uOgo$wx?wTxDTuyAsMD;>eJHO z0f-v%Z9tI?3HS_sRab(XOJ55MxrGqXL1|IWfiEhEKTFi5sat+$Ef&IVv7jk2`rD7Q z{p=&Y6Lrr%JvgGsk`?Re-vUQJ!N;Y&vi z`-O2Od(}PNC-`S+<8K?i%5#KM_o~nf5OIdv1rPc5H;NH1zix_ag~?o5M*FEBxkWq( z2syK38bg7-{k8XvL>kQLKyw5t4?`Dqg9b-(-kjz}GUDKV<_Dt!yeb+SSN5|DR!z4& zZB}KbB8TQd5=8Q>7`@5qJ56s4avRO)3%}y5~EV`7YTbU%`ksvoG0l;#OXJuZUY^|FGLX&I^IBlt!Wd74& z0Px=uK5n(SK|@UVid5e-IqcwBv=(%x;o5)d#=r!czxRF$*cikyw4J8Y5rfF5s8N(* zxj$F&Ap=0cj3-<5>WYLWp8(TG=F^f(vK4(vqHHOg#4(AnV|t1Hx~DDJ-oEKUvG`|A z1WtTADx(lZ^l~n;D~rY?D7`~c@4%i8v2#@vW z+pSsdsKKzwh89Nb`1c14(0nZa-w`< zvfiWGyp+_cyV<#iT<4_}PLOleM(FZ0 z<<1bq=u%v{G7NNjwE|xQf^OAb`oujDZ}`XbJKDQPHmWO`!a0}ccCzk$Y= zzc0f|FAB=YGhRwjdZhWWUghxx^wNi^Wee`pONS}v+Hq$5?I#|=XnI2I;+F=%^M7Vo z#>PmL`?OE6skt1ge^w2B;hFu_Mla&?W-`D6boy->hwI5_xuB&_zVG7)8^ldOX<_sN7Da0iMQ|328}hFx zmYEC5(Cpd%ZEV;x+9itV>edjZ`OR!~ zoK54xD(lLcq#oPG{AACGF@aIyZh#`qvc@h;^JX9e|1M4=f4g>9$VMRj9(}MYav8l+ zC!a;K=Vv%M(h+de(z|ZIa0C;d5t(!h`(}JN(yxNT2Kylrz<*On!#c!n%iXIYn~J~D zuB=~=Bu?`bKF7YjC#n1E%%z>p%?5@+(~_yFkZa?yTi-I-KN@4)gKwb*1@ue4hHxaXwNg2h5)xIxs?gV4tAQXN5xhn?$gS7FzgGF!@>XdZ7}xis{z#AlxE z6D?2)|Ct_apQTtf+FLzEd&}~@sy6waPuByUV0-%PD<=@KoWz0nfbL8&xdF8<`P(0I zM-y{ZCCg}wrfOyG-3z%POMdEQUWA*nfZaLyR|qjIW^u%Ygg%uFc2h?1{jj?chG9-y z9)Czu{oR2%Q>U4sndnM*RP^USc?&>LZK0uwGu9 zYbfM0&Yt&m#l)Bs8X4alP=7Cnv>Ye1^mQ=*?qbjJeGW?2lRqS1R8jzZU!=DJ2Aj8i z?TYr$PUlO?F%E3Vpsf##(>6?}J=ps(8B{>YSQ>xhrua+aAh7H5RiySN_y_t$Ns%)( zP&X$W3(g5izpKBSv?Bu=Ha|J|(FS!hS6q=+k-qmk5Aqe+I~llZk=>9AcV~cyRJSz* z?)lZdGeB6fVbAj8jo?imqq1$w>4Xr+-#(Ua)eZZdWT?3{VAH8ZO}l7?FcA!lDT76%{58!b*w5028*HKEPE z?PFuJsLGr3NDR`_k#8J;>jPl^C<@Z|kF3Ik~uu;wM;gFsp4H z^gd#oiYRbu%8f40)>e{UEYPctUZ6D-YCy@&f!Sdh8X@VY^RG!{v_(!BM0Mvc2UINE zwy$OUW$hWD|Mu3|`|gC4Sc^;9Yg@tH`mc>f^IalqwxUJ?N5;+dd$8|nE)V+-RAm1R zk4F=wG-+HEz9GruS>h~>+KQyvnAqm-RP3E!hRFq@3U=7{Y+u}Du&WOUJs6!= zsR_D?Ri<9U7PU{#B{@zBoUvvSGe&8;>R<1CK#018>j|f*m^XCa>|f{`-Qt@AI@aRFs~rGiab?;><2@~|nJ`Ry zN#}5u2Z7p&sRa1-_6?lqpe4ErJKVDQP!Q!s>a*gto>1;g$H6y0j zB%R@ECb-HhXFwsc`s(*=nAgAVIWt(&uYB#tm^FTRg;#pQ%rSi8cHDz?xAJ;TpLJVO z|F0WY4>mEjdI7SgyBW(F{>L6LgsFr*KNykEc;lpk+=i-hk7Uh-A{E!9gqa!?$fm9> zj8i=n*l>GM;+~BA(@Lq2$41cKg5vNe+?M8gF6{efRjY?pT}oF^J5nlPU?F4avXk>? zuD=TVdnRO#h)pMz5#{$qXd}j)8V!;H8g*(ej5F+HVmpkjmjlYnG(XRo?0bpA%HtjQ zdrmsR3b$nNpLU&D^RC{ZZerK4(d%~NbQF33wb4!wD+v*dJQEN^t&vak8vuX}Ch zW6hL-J5>q&us0F^7VVFU4H`f~_4ZcN8oMyOALU?dp{~)M8AliQaxQM+P|Y)TvF~ zKb%9vwb7Ll!%eNfmfg0mA;iECF>H$EW(hmS*Po;re$xBqGIo@JrZfApq#&}#Uqf$) z#t$jk_sopVtj#=^)a=@D_W;eG7Y!0F$M5Q~lxfr63bNf~-LP$*%htTHL9IwzES7$( zt z4#PHMyL4~ziUz54!amMo_dFVn539rZ#BF4_)m0Zc+>dlS;v~ctv{puMq2@-e6M268 zfi8;4;pvC$CFb{VmO}Jt8Y6dbD#G#Oh$vSrZx4?O#Wo5mwNL?~P5-pZVSq9Qagi@8 zd3B0;xF!&0MjZ3gNg@1O>GTIMRn;fY@okj(L9GeHlM%kNd@gD-`7ANwcfOV9T&_pO z=AW5zT5u?{^L}=$hE2%}~0jZ;Kk3mt=A9arXS;O@8I$UIk+ zxdvVH^_T5_Wm;CW5#=@^ReQH%+b)tAQ6p=>KR_=rsy6cS*Rdw6VM7*$shPSvklZzq zpSz{iblieF!-1Sbacvze)q{`F?E$jj@G)X#Az`yT8@ncNW*~07A@iUjx|h}{0SH01 zYA=1oEvGqm2@(}cP6}tDF zMBN7WOl?tXt}<37vUArByp-mm&xmN}Q20Qqu!@l{%u4|!^%(2vr}g`-XKJ#B(~gPf z+H#4ssAPe6akJtQBviS3}2No$_=yj(EuMYWC^w-@g01vpRRy*~) z&s_bLg1oBY=Jui(1wPyH{*ido?|-g9QxdMQ1C@jP6&a6wATF16a#uv@W5BhO(>W}k zE;LVMPs#9RzizsJZs=5AoBT!d3udps)69+guXP7q1Z^VPZwi}iUY^=ApHm-oZS{CJ zFwDwWS9&!rtnr+t%pM@G$5kIZvLN<06{+4r_mTivGn9VlVP2Kr<6x_E&t%%=IfF;Z!p0Sn ztpn@!m@81ID&JAYaZa`5*yXkHT59Js?^y93ty3x6VPhh zkQ{bFOX+fTE;9r7-|LRnE$%=#MG$p<2yrgYd_nN?5$b-THGKxQPB&(_#5Ka zZ0(@M?4PLUSMzSOUj?(*ikyg0G-XQmeQE6iKQqqVoO|D$gr>~CNTCQJm_-!nM;!R^ zQ;Ef4_1Zg`Vh*oPP;~p9F*@CJz)cnD0Os5d3*gs$0AOa@Bpd9_l2s^u@ybyl3&^=i zr;?$rG^FZb@=LwYz;dfVwcw${)@c?jZXUG6hC7jj4KQD~Yb#Mafoo<{Sy@@*31;Tf z_Z*^O6NIkMJtBf6*>$6QG@?f3Ou(yw>?&aPKjGVC6HgXDa|&DAn>1>FW?ioBp4nk~ zv)`N1B>cs~BeQ%y*jnMi*ckj3Yn2ruiVXBbT!_KK#KMByoEK>l0Icbt0&e&%*Bsts zFKAM>pUgr)uIqJ%6Ut#WiR$%A*5z`oXd&tCotkX9zH%S0-vE7FyO0KDK@aO?qCra zA`_6^1Z>1l|E{ywFS!%0kZqH2*v6#3Ebt_{-@7jb%bg)YqebCrj#HNMWl`$dJwmfP zf@Li3fx4B0!dD+d+J$a=at7_Xu7-~O{2L1$xrZ4Y9%g=eB>55fSFDKRSUv7SC4j&R zGdXrPvnd|o*x%1Y!ct$6nV6r>aQ`cN=yTlktYI=jp>}eszf&FjYBgGXa}0xe6rwZ1fD05MyvKj$FoW#&#Dma ziMa3H@N7P{8+8?Qu>@zl=O z^!P0W8K%X}TVEksNb)3C$rP|3vp?&c5h$}Cnq_ktH{S;76Eb>n9$5<)ozT`xn^I`qVQd*VJY9>0$aI^@LGd?5 z%wdt`!##%IJC%JfH0i}aiIF8EQR^Jk{mqs3ehP$4cwkp0jB&sCSD<9-bamg*0!xI* zaq&;z>iHpZFV$&|A3vU{#Q!e~^leu+vvAP1J6yX6xWwC`mB zDu~iB#JB)T#HqY4en2FUv^BnrD|}TI0BYmU@4~|&j;UYYo7el4>mmEH_@W4UMK)y? z7tLCZ4Esst2WrVjS7`0woO;haqi(_oo(qaQbz>W)uK@##=5SkbejMd!!TCOrFaXPGAkfaLrwM&|{as^SH^uU*c5#Qw)qvm3V1lV} zr^!VRygj_X+D+MY)D7x<^`LQo@L)j{6W3-2zg}2od@DL_cSw!#-x97xYjvXTT_a|s z%nz)}yZ1rpeZ?R~y;|QouS9!a&?{g%`k=2Rv`^uc7%Q%u@QUWmy2O#Y9!a(G3dz;5T=bST5cXZgt5HysOAV6nQ(XP=?V05~z6Hj)NtsKT+ z#I`Wfl^q^}ylVZ=o>K?{1Gs^Px#O5AJscHIq7@FhRost8pjl7o@AdFir3|c?_0!QV z*^7U61x*WGz>q~y8sd&RD=Eo{sPAo`_@P?~r<~|y`d~rB7&;PncB{)w6Zzm&BD$V~ zIu{~%vz8%rH5h1-5Tj$rIE$SZCjbA$VR>^ZeyvLI|DC_PX(n#%Dvg`K?vHQwFI`Jj zo-nV}l@^c{ZE-Xy%FnLSwPbTT6j>?fwT;DMJkYceVskIpuFgN}<#c~nGYEN37@uDE zjQ7PzGj1hIVWrojrarDnm&uWgrWMv2tj=D&GMBd14>eglv6TCtGidpBJnr&3uJflr zsl<4=g$>+^vQN07i-h9}4O_G1bS@7$@c+imG7{G{bLadn;Y18E45ILFQk&-ta&ZX> z30jC)?9?)+7Q3PnWMNGgFVYM9*S-1AQ^j$%OOK5YnDuIzd#xr^glNd&>r{2i3LP=M z_ew`we)0Dd3nQGY0si>6lXERv%!$7|{=)60oEC_AJi|A>TTzpKqjUajcbvpskK8Vs z5AkzLqYNTq{}st9K4LynNeHKtwioymOGc%kFOb4neS{Rljx{hP@|7I^DCFjLh2`KQ zvAWPUGZT2O0>th_?Ndim!9)cT_zuv?;ZJ`qkI_c01aoQ$Uz=ms>6>3m9`MQm({}H* zNgrN}|H5NLo_a^SQ9QZ2^^*J?;nFn4E%0vCqQ2F`{R_h&Bp>hx)8e$OYN7M;fGGsXz(VhAVTxBJHY&Z#nI4pKI0`A zSm+G7I;eLpxA=DwU-1m+zhS9emF%QuufMCTD$2_IA)8cQ%QL0JrrqI*3cIL%TKBVY za5tDW^ODUF^5>kAsB5{&)wg0}tBL*}s*+b|%(ejvr%~%;zS=PA}!_C4MQ7^R`%CK;v##$3~mNIElhZF;&rm8e3!}uYen3YBe~&jqdU)^%m~=qo7;PQw`tcErkNA zr3*6CyVyse@f9K2v;HvIlWhtk1HR@>P8Pon$ns$R1ZQhV_q_;$w;ZY4j0c6uS0k^i zYgW0BjJ1yg(sgmv17s|N`e&ee9I!86OlHz}SpwHtx&ia6(CO|GcPuPgm%5HRq{93= zCa%d+f5I622m^&Syg_MEHj3ap82!aAVOC(jlSUn>1Q7wO;L^yR_k2bsb5y=E{?HTM73c3s(?fw)me*J;{~EZ9j6AqH6(p zbs;V$=1ISnfa+?fRMni+kJpm0A??4;WW6d#^R9J&o4LMlqy6CbmOgjb$NamegXJO# zGl4T4hi4Re(xXE{{0m!e z>s7GnA~A2})w}NxguL>ruw(<*t^Tt>63BEv9U1KbgPL;yukl|{24_cd;oP}%zpafi zx-2^R78!0I6Xky9y{Ri_nc9<%VVw%}aC1w}sT1=+7ig1>6F3BBUgegm{ zvN|9rcATjjYQ^+@jkEnT?kpyh<{FzKd$8}!ME7=8?5!Li*2Vc^++Z_zT}PV(MA%VT za1NWt;;W;%dN!Jz6)&%jcfrJmT~U>b|GskVL@`0=1i6-ex!>L#mo_>+>?(wiC>?h3 zvOzLG!Y%YQTzSwgR!x8$*2KijC&YU-rkYkbE6;Y{UaYQ?w9NBsc zAnIqR#Kg0}j6fSJ9=7mrqAm^_IDq7E#o8W>2ksE5^U3Kj+`4KbZk-@Hv3J6r%A$L* z1&13zl4*ID=L<)nWBjCajm&Dmz_CQs`*mB&lxul&H=^wzqi^OBD`iF)mEbUWA}TUq-PZi;i=*FbIl_maen^9bUJ#*?p$7&}_Dn;* z^{j${w+94V+_i%kTUnln_CH1`sbLm@c_ib*TSAtDZ|!}xHsTrzo(};TrZi*kx^5Um zOoqFT`P|cPEmyjqfxmF&mZysSuQq!%>Ix^<9|WJ`y#KRos8Jct_3j@MkDa9Ts6PQDzXxsTj?VjKKBGvXVw~}@_A6{Rn1`nvh9AFJ*u&+u^$>m| zR3O-`hMUXRS>h}pXkc(8d)xy+uH6mF9LF4vITqbwHD2f&W4H@{MMfCZ(X`~mJ+C|q zP;4pSuBWN19TXHx?H~M^PSWNy=#5*BGxbaYBYlGiQjIn7*8HzyBTL0_`;p}CcaclO zE>}tLd#RBcMmEZ($*||w>ig+q_Kd2*=NXCZe}44{tc5+b;*GZ}oA1-2 zztI1;T?%Pd=k;ZjXFto+L~jeU(VcP#lYnrxngyNGSkE3-v2$Tuy@5EqvAYybst<3< zW0FxTW)GZ;!EncM!q?k0DNMTsP$jQ810+MbMO|~ulSkec%yL-%>JLe5b^QtsK3eke z;;_s|`fvBtJ*mPvL|)s=UDSEf}oZ#IHbM@cugZ1p-ZyuLC zSW(zlsVg-f#%z-IM;nop@trYBNz(z?J^a|LnV2uuyNhwW9C1$@a_dwa(}_+T*He0P%B*FXD*uoHG;z}Tgd6elbX z6s}~BiU5_EV8{ylCN#@(Dq~fu!#$f)KPN{PQFJ&e*c~tuli|8CY_>YSKOBU#ogEJi zVwP1vRqn~U=B(O&+Rd1dMD4YMl68MfTW&+Q?k23PUfWj|n`oJc)C%O>57?qKxgQuD zESTe1@C`2VcN7HVIph9#$1Wb%6ZKaBE-Lo>TQmobySrPY=Tcs%Eo{M$wHb&_31No$AV`Ht1cI{s}FxV-c!)8lCAp4_AU86RQs(Z{lCZcmbbHzf#f#LWAH;?4UE-EudSVif%d?LE35Z(` z10@d}tMaS8wI<=Ny3S`eN^Iqd|39wYJD%$Q{U0x>NQI1)70L`r*&~%yMA@>k$tH*6 zn4zplvd1YU9AtLvkuBpS8OO2LN#`8LJO{`4Jx=v{e?Pb1KmO`Q=XoB_>v3K8b+JVF z@TMFcHP#ddCPoYG_pCn(o|2;>w;|8%H`UJo`gQe9N_|_Kak#}<4`#Xpv?|3xP(i@H zd@+zd=R=GiT`paPL;yc&b?m5hzlQKat!oai_2Tsrvqbg4IPrETQVNp0JiK6$gA5`qCm<$Z|fPWX`YB!}MTp zyXLj2p%_Kk{7}$>m}MHAlk9akbwqa3??d2AS5y-5LTy>zGwY?fLF`-?SH0`$v-b_#`*4rUPa}opL01aNLTe0W7xwbYuFj#{HH<}`uG(ul*3BD)kx*{ zQGUeg5|eDddj1}8Yoql>Mn4946__%XMUM^6q%`g38qC^oMg%Gu5H8LX*fZKxSl$Bv z^035V#Zbk)alnGGf@0r$I^2#p7$^7Zd2P&(kV8{NtU~fL{5<^mM)DMSiRc~We8i{O zD*6$Rgali9^3ySkiYa15KK>rtvOzYnQ+vattb>dScf8-yS<+d%n_1#NRQQ;vm?Wh` zi^{+y<&;e2)qf6dyc(sSjlKEV=t;^J2YQN2U}O`qvbaZi^$J(L9%`B>u)KpheL%bu z3-KH&F>=GEyS7MTwrbYljGz0qwrZYoijg;?F6iZMr;Xi^^G$s?gJO7JSCo7_$Zcn0 z%Jk|XoOHjO0KDhMmQ}@KQ;3Dn-u=B3X775m z&7DY?Jza83MRJi`^jeT@iYd=f>Np2G=#_1_n?L|LhG#vTZ;_!;xHN?y zl4jZq)iArBQRarQud=aLseoX%W?%2_fLRw+(*5$2^+&^*%(9DojS}sCZ2NzTMlUZ= zMLyu%F6b|P_FlQ~Hy}S)UoSRGMd6cBtmaKY%7J6@g0lDXjC7s&EN=#rW@fDH5fISJ zL$CCu0s;En%ciASv|$Rz=FpHySY;kLa*cLvsJS`B{xzWOFJDmmI%OWNC~D2TbBOQt zQ>U}W8AE8-r0!;)G1>>nO`KF;AQN|n!MbbpFNTZGJFh;R!q>_3tR@~^O+v-xcSAm# z$2HVLpq9MeB01W}KM(3`_{4ZMrs!`<*^J+*-!?P92=5;?!yl9!Y&MZx$j&5%jXh4LsjB)5+Rxs-p&e(<5f0RZ#3Aj|CI+iizU(RKcPf2_LY+{2|2t6v7DF$nFElAEN z!xh@kk%UQxf_e#lMFw}e7dB7Km^p0r!U-%)H&iKTREK0^*r>M0gV$MzHN@L-r1M7$ z?d!>_w7+?}KB3F4o;}kKEe5X@4ebp?U%_+rhh(1b7GE`!R-aw2-R7J$oajR$_m?aJ zagY(ZW!EI)-tth>8tIZ#}qgFaD6( zZKNzSNQX+T1&n1ElFxxJW|x9Z+pIVscXL$Fl~xb=V@QH3WnplZs!lSFM1fk*h6iV_ zVV@|_?CMYN?2cD&Qf#+~tg1FjzD4Vy#AMVQf!>dBn&DDFa`)va=ASh@nj)VBe%H0q zl1RH+ReO{4e~?!x)2@L8ID^d|8m({evZt{x_v#7khK+`cP=9-SIm^h00)%o50f5L~ z#urysN-ZZ#Z1x159@PM!wS>HeSE!sbARQ+`#0v)(S7rUj7=nJKM%jc{aPj&ABs-})$47?Vdcazl7t>G;e~LV3ouh_$8BP?#mOYU$Wc zz7FJc62+onndYiNvt2MLD)n0`20z{-bs@YiB=*XI5xa;} z?k+0KGdRlwf0TTXnaH?z=2YDjNv6~-?@ZmUMdUfA+6+~l4P`R1u(I@JchIp<3@z82 zc)_Cc{oXHMiEkBIwm9UQTw14PcDb-C=?>S>D1Ow-Zn^-YeV1>_?c2u2jLS@{&(dE?1RdlnvCSekm zdB;v+mW9>;<3 zfBu&_quSb~G2boNPqV4t8Uj&sE}Zgristk(zA1Ff89XM>(~k)IXy#VBDZgkxO7=2s z8tGPP1Wg23O2AFCESG%PC5H)1Up@z;^>z7(;D}}Hu)7eAM*^brh?FsJq;uT4$k5#z zTBDYJgAZi))Z}P(=Y>?uXyv4xRW}QCBCx6l+iE})`n*YxYI(M{e>?O=Pkxy4Q77f6 zzikH=^){*lZ%El*td9}!BpH0 zq7q-MbZo6IF!L1g>pg*y%Na7Rh>V({7h#SM|KjIuyYHVyF0t@r#FY%Lq7^1x=dy%L zjhv8qeY+obGELq|Jvk+1jI^n8n^4f!k3TFaqit{^1pQM)!nuTb?40*wg?nZtOk;EY z7mm$jJyV{N4Y?5C9QQpN`KWuU2844+ZuL5-tn;>Tg>~&Cs~W@uwpw{*-e--R!9@7& z@Vz&W{BRt(8ZJCJ_>Wch#J>qADb8w!Z@95yn8z5)Bo|jstH00M$K$=Nvdrdxfdtsm zJ7V`(UE-EL1=0~DGBbR3!CAWb%jb9Hr6{~B<$gNG-y$!-F$-uO<_ePm6!m8y$<5P% zVQ}9~%_qeX=s@JBqsd^xYg14OpA_}QCo!Q3n@1Rxo^U31xv{TxU#-&SuREH1&$gsg z+`P;>qD0*Im72FfY>7jreiXB@jY#_oTRzLqLla>b7mWy?03TYVOf%c2nHQWbFi>1pKjeEuP-V((CRYD<1w^@|Zf0&i}ehG_Hhg$h^*m7oE`bQ*>~2 z?1}?>LF2iBY5zk=mpVjX(+Ne^;-^%Xy(Rm4;9O>h@Dk;)N4j(8`!a2YhHLfyymVYs zCzC_-G3Ty_4Sp~6Z2FBTyy=u!33d?pS72FmufrBA2ek{$Y*km=SiDziz>+@IHg!^V z2#8$H+Hi7k9bN@w$GQapa=OA0#0p^U9Y%(3KHY}O^~01rU3Qcd? zx+scS>WsEFGqJVMw;PLDzn8x6a<=D&nz>Fp8xr{To;gW5*kIzLr+5HK(^puyXR-BCbyy!6V5!55hq z2_2+mDhnZu-7%Jh4*wAJ4|=p8*sGEHF<9a6NA8J^_QX_oWs8o%@j zAxg9%XJTqlviqx-d^Da^+dezl5pBSVTotJSdlpzR_V&$d`@p;HkpQ@%5eW}cl4 z)GkAKJCyhSdY3>v;4hOUEiKd&CQt>|76YWgPd|tmw;@OJ`l?48`7KQndT38X1&A=j zo`()N(f>j`{Y(8>K1**vXWWDc-(I=;dgCccuy<`EqQ{D}3G4*+RJ-`q1!`I}2VyZy zK^{f(q6m0KGcz+vNMQa?Rc2*nBgoXTQMNdYu?&)6ew)-D?L1Dz@*G)TbjV^$jKcSq zSqtbSDfZZQUYnvw!@D=B7}-BgIwWT+_e6uM*!m8LR|`GbCB8HN7=Z>*yUWlL{my5j z`O`hltfbZA?Ixg{K|{`B8tz7#*`L9{*3#~|lrZ47JUch)EaCh@e}125=AdWY7Bb7} z&SLenqydtGGwarFh5`-IaITM1sK~J9qhH8(+i&%>%MJ~@&S_|9Fps90-;aO}{mQUq zBRI(*j^_40%q5>;G8QNY2Fs1u!6U06h$B@PB~vt4maYnTC6`rPg!~gx{<=A93RrQ- z6(;Sl2>8EyvtJZ>$!LuxII(NTT&b1&x+O1Uwcpzj8lykwcn~A>ZP9n(ZgS@2gpr_U|zBQwj))NC&JK^~|Rp=wJcHuyH*rdkGuHoqr zqFgjP;6uzd)RYygI4_hqon1WFZO4yvA1&p>YGTZk8j2TZ*a>s1$mDET(m&FwiDM(} z?LzIS#z5$*Hs;*BTNU;a{Wp)JH$=pqb06nuQ zpvx``rzSKQY&dtSd_zzJBTjZ~E8+3C6S#3(3McS}1N#7mgy=Hn%OCcHf(O%D7Vx5m z_G`U}*TM90RXQM+?IAL^g5WD%(-59zVi38m739{~BpoyodMx+L8yt9ZDB@M)*2>d0 z*_L5@k!zCv12HX%ldGo{0sc_(#g%uvOXKo z^xk`OP*`BEqdeBlLdqX!#l6-XFSB{Mu$R+p;Xc(kL8-(B2=)M`!eTs zr1Q0P_;#ZKLjQi$&_kXujfXm) zGzRmm>GW^PmJTbrkmKj@hDJ_~vV^gQffR@RqEjQ2a&qyBKjPZ?636X&9}Q7ua)xj8EAyUbT`n&%sp#;EJJsvTGSWBSA|D6zV1;Sq zqKqVhdPX180whNam4E+#-cj*t%@$bJb5)s|h6EyUX<%8+?t~2PCtUgXN9y`oZc7aQ z`%iKgQgwHwbyRwDBQ*Z-N;UdDFh%+(WH;An-}KOV@-24wby4bhbcHrCM+71_$L`8r!cfshh4EStWu;~vb$6tgWsF9!NdnPk)6SR z{+n;IWWWqVG5Pamhyoyo4BEffMK5Fa8dVsQ zTp!t1q2Us1pMZYPshr?s7}ED_A@F2Zpr8xSafrUtCp`11r_3e10V`^-SEE6fzYnWs zxl)(Dv}$et%u~6p9s75z|5Gq?cymW%!TO&ul{c-LG>Y0ug5|`irlwEkwq6yL^_I|6 zV_F>s57c3-7{ZsT9IfP4HfzPsj@=LP&bqrt@-n@mi#=y!ODcpd;(Wj)qD*X%h54H! zCpN~NOilYe;eUw{u7hXilhqe+KV%vuX_Fs4L8}N?{ z+DP%uH_Nlmj)uIXXL7X$nEZbi0n_QH@~+&i#&FVWJVx9|m4R)^|FvyGIq0 zTVv!KPE*AuVE6M$@L6`@rkz4Yy$UrJ>EaYHB#Qc1YFIUXN)H4%wvZ$Kl_|xd3>ZJf zlmkCI80REEi|*07OFA)6A$gsTCnFBZyF}!@?)&|{-G%0-KU+k7uErLv+`T|j*W+@dYLjD$3|GPFsQ=x&2EEm0fk2{vTEG# zv(j>blHraAu`L9H7^QEtVNzj=Ujkt{hb~Q6RJ1kkg#)S24`h2v*jWp|87O?a*J1xw z>ZL!|A24W)3mDs+wS3%3aenuk0yeyzrjnI@q8_lz2QS-QW_YgyXHp@KUdpmr{rS0# z|D6oEUb_@?(m>O0PgDKe!;7)>3m-iDZocnzEPqAp;F@ymCHm+nEPa$Vc%TrOMk3qg`6)_j>bbj!>F1ObJ{1X$l-;tqMa2iT0Vk$EnLvWaFDl|{PZ3&Q(Z zvliR_yDy(Y)-o!)!8#Ei0zo<^M*s%*Dp)|)?$%3`Yr6bv1UK~K$@Clkw>MNUy$U>U zd;%(({69a<%TYd7MmirOSmGETDxn711j3nZ=nx3DFJ$G)*i6KT0otF9;Ash_i2VD3 zX~%S5_gg37rLI&F>Vs#ago@rw6pjUhkU`vTO}-;QEM)ZmF{Q!Pi|NjP2bc7b`cDoN z2UUuR_qIP)aq3)~9}^lZ(HMEb>0a+SUXejBS7{DiNP?IPCajNRXKQape(1?fvDi7- zZ@1iSPqEJKFB~m!k^QQ?NbsA;MJO9oCWhhfyw92|QV6uQZ4;fmb><7mT6=-9=3akk z+@&|fqiX){k-+lB zc`N9h+!(t}@`45KEagcT4%+)AH^l5#=V;W? zZQ4?2vbnMv(*FJpcf#H!N$9;)hRKajvgj|=kfd<1L;3q{GLooH=jn3m3+P4~B0D2~ z#gQEuZ43y>g90OGJ5GNaek xEw8KNyD!Q6!hO$cpP%VrDy;Ian@A3nbwN83KT3nB)(D0OCqw;t>D+|{ z93Mw6yHF#G0#7E<{IMWWF9PpVEs}}f;(tPe#`S6K<1)I9KY0aVIG764G5K=7QoU*4 z99--6;RoArQ#QpBSdZx>$P!Z+C`T{;SPPyf%k%T=H=7cE}D z&V(roy|4Ldv>$K4K3e6@8|v!~$w%LN)XkF;ZBhoDFVA1aZ<=j_ci`W}7jgoZ(tx*{ zncB?=wsAh2jZ#|gT>%tx6V@0BWxF)I!KKqKgTuHtHEiza$Jn&@Z^}0n@kq{Oo5k4d zr5CC0uf}8c#XeW_H$mh&I*qf5@b(DLVf;GoDn#`FSZ3*{vH-4Z$~blr)$FV~Qi7Ya z;_Xz7jd3sz>hMxc+~n>EUarB$v8+ZgbsiVWdZx>E6w))7P_<5A?Q6@m0AVv(K(M~w%G90eI|_GRAP${kI7%9Ib&D%u-@@k=9%s&an1`nQ)8c?i}1o>aZ(k`IRA%HaANFO%1TGeuhn*`8>B=seyH)(`?hP zrYzSz7#B~011t@ynj?Q;)-k*bkmTB^X09-%*gkozV&wP84z0V`O>^G~J8YR52;LO5 zs4{RC2-h3x+cXilS;gJCJt{f{(w!j>@R*qW*2I?W*jMW{DVRzMN43m|-2sEe3Jqo% zvaFwZ(5kw7tNK??%;SW3MzE>n%lmg_*a zvn-;T#}V1?ot!J+(Cf^KwvI;@u7D+E~+^Tk4G&KF|?a9eu8Er#Z#fE5IIZ36{>c-KM5C`Hj>+?M9%f%VYV2;-{hL| zlR9beyE1Tt|J+Vx=eULJ!WI)|;`twuARhqLEpnSQ(Jxd!1_(wd6{L19CqxI_bd>XR zo2VUXg9szg1=e}b8%pGs>GcdF0s~CrDxlf4zSIvC32k{IUF~elF=Ue=%6J}we}%|N zpFl}{ZD7KP?LXo4~0YCA+k<9bD5h1y8J#Bo-*Y= z$K3L)b0s{L!;ysUAjBM8=-8^UUias}Fg0LK-oC%tAR?MVbHy4(Re@mgwV zu=`982PV&*KVN?DBhXFtE*TeMxRna!H(5&rRA6(Io z^QB?r{e_UxxFJQh@xIB~$RUY(a@c*h+oX~}f-~eZImmr>#K#IFGUctcTjhg-O4w7j z^|4h^lg;5r*gxM>^-BX9wl^}(Ze3hlDmo7HcdcmwTKTeDDkYA` z(TVGGs`qRi${)6e^W7#roZkklXM|nAT}`xT1*!YiJ~V%QDu$#+-VDF0mk#*ImDtcg{ok+y-;yy0%R&D}sQE$B z1_EAmzA@Y(_LnM~rzM>y{-(NO5`M`i>9KaYYki&m51um#)PU`|wcu*=j;5$Dicfw( z%HLrbFSaX>cAO=s{HChH88T(dVzE9V$j}&x|Bp9 zsT}J!^hBwCvhf(VT6`Ly%0x}HZ3KnnaM2u^y#t?q%=)29NEZ(g6NL+{=Fwtb3j=hA z60w8ReV0*WaBQwv4;<5tx?=Jyb zuIy`j{aL>spx2x1&xf(x9n@m>RJf-3ltE61mOt)V#i7&E(7H9`M81)JY1*CR~=U&LyRlfcjfH z$AmeTfqL8i24oih<7963UZ-mwWJ8B~fAU&>_8C>iLjNPtyr=V8mbZ|CgF>fPI4I?d zr+j*cYHaMdy&<94RbzarkjlCQkZE`YFyo*QF#|KM~GwKVY4TH0L`1H*r7| zwO7h|1W%A!un6wrdU z;gf5?z4wrH>t~P|xckHX zUeOat3)!Qa_1w|#evlm~7a3Jp*bIOb*uhY^&Bq5=>9(K{H`dW&fIdUaX{M`xg5PtT z^8FSgdKEZ3m*|a``rabYFq#qJa?>YqT|8kvCfEL|QuxCC#-6{v*yF?3CUv_3q$w56 zJ*d_Os)Sw&y5AP0Eyqid9g+wDQ!)7^IHHmL-TaFAFKq+DoxH)-FM~(O-35E`!rLD14IA_HS1|yM8uc4rkB=kMiH0?_0ILjc2xL78!oPGQ_`ie3 zLPBOx`sh1I!&a>*g_ExwY__@1u(>OsdIB#|JrapGR%p-VXOeI;1;cPJ&=0ep$PmWo zScmjoz2D5;u_J3G4nRJkgocx&gvZ8u{~Vit3U%9~ON+b429M-q!D1KDpJlJ|90he@ zrgz6~cVt?s$3q@#{6Hzw<2M|HEK|KBKz!wfvpgF}RrS=Fa4}EwdTa5(o#l-%M^5}Kf1DK`airEobx^3 zBkxVt2yLES@CUFk9$hmkUG|+N3jMM7@}(7EQgy*{5Ca{|37Kop8x0FT9AgW;q#PwT?D|%TY4a(G zwa5@)9M=s9QmJ-j41$=g6@UbxF-?_X-@_Q@7%E zcjxRh5XS|a9KwT%ux!0v74~?9Hh;8Jpt9oQx&qL;Ka6qJ8xZJz{`2B!#!8cQ`-uwc zwPtzxd6^f0=skG_V&6=4KG`oWfgnmnK9j4D0OtXz%bU8e8T9*O(8K>uXxqmN;lV4z zeO7+Nuk{3Z)Z;VDjmtjBY&zPVlKnoU$Evfo>%@T(S+zwqq*YO3>#UW+m1I-mPMW!I zxfCegWjD|Cd1e>Y_svl^#qV+GN|c$YFF3{+zM41e7jSEQUMrAva$NMKJBuY%I3t%2w8Q^h>DKpu`J(>>WUlHc9S&e zoYRgP1puW5qoQxoT;Kbviw8{eXakT zK08umlU+JnUH$CVhx`}yR^KGYfSlj==ST1&y!`rA4b&XD2QJ4STh;mmq+#dFHyq=0 zU|HV?uH)*t{w8g#WBBEsoPRolfWf(}lDvPM9Q~$F zvgLG7BL9mIr53AmWcLXxTsLB%WGj*QLQHj2ndJ-b&O-J|&QwEd(S$ECu!a3brDQQy z^H)V26C*tK`8Lta*L||{i`#Zb7{vARFUhfuSHsR1DlJ!+hzmH6qWD{&{l26d*KbMI z4;D(ux|x3Y9Slx2rkb(dR#(IT?Ff&qI_wMedU}0!^*cN(*U=PgGrpDmX7+*w$g=4$ zwRv%|^kt5Q;?cX4@P>SS6ufo4kPc@te(}FVO)2C0```F@O zg}@Qw0fpP1J9s^*By+{WHyFQ(w2-O15U{2h>`+pmr4fFBE(E61X({53L0SK3p z@zNg*K2*bEt@jUjLo~G0A83gnnrwRy@%><@bjEfQ1b+>U;us8Mm%M-K(&)f;wNK{R_m={0|>KaMS$0cE|MB$WOuY zJRY41j(T5ZKL_&ysW<=Hh{$^$m`zGm9R2cWW3b?f-|nghr5*$jOA~CBk)kpvKKmt9!pmsuR3`0xGF8eZX{7*{vZZ28~YmCwd$?em{xggCJP9sP56(NncZrO zz?B5}W)v?42X(t=o}XO7;X1itd#0A>m-k0;F5Bqf?U9+CoIHxlbas$=lS~r9^)jdE z?VXDo-hk-lih05rZ@NHD38+!n`3xu#3@tvDu`<9?xXl}ZHktL@KF^B%n4&CyM{+S# zc+s~3ku}Tf4#EX0gr1&w`2%oHfMZ%v>5fV!t-i1FD=2PJ#&o2}P}A)|+RRqoptZ@* zA~#+kq@~Z0fj;u30#thYa=+l{Wj>_rds)SX*Glg$b*ancS?WT0LA=`TRwr-pcti}2r@2bavg?ejIpJ%;hFsyJ+I9+i<2F2{Lb7Q)l^Ncj&ThoU#TicKfrmEi#y!QA zg6V*Ph>6c2)OUR=(|g0ab<0dN;^u#87cXsbTX#xF?4fU~pbxh*nzl0_LFw%#Ajqcm zh_2|^go=uJ>kecw}`7#|>A zt1P%IW3IcFoBOB#mbW{msg(|0%WR8MtsYH4kC>ja%?>y_te`d0+w)ZH4rZuw2M zJ1k^lhsnE~stl5@d_HLu@VidtSjR1cKqpObXX{+gPFz8Sf3z;R7|ssA7$kY=DE^Zim_ zYoI{ra9K5B{1|vd>IrY;;oTc2rxlANYk%c1xYsUyQl+by|EZ^Qig$nIWor#K8)IWS zbWCPV>A2_wklcK|Vyd#;t+S@o0zjp!Zc{H+Huwq=@u+WYfwTvpC`AaIf)9voSprRM zcznRTzzh(01f@!tg{?NuaTDpRcdp!DOi#Zbk*+C{&b4}FwN~+5xH)&ynYnSenWwF1#&PI@e z8*99uh(iOJ0y0~tKi#L+?HI)`JjkMR+&t^Cb!|pov51T)#%axe@Y4gsvTVnmGD92p z&IPl-h1C=2VW#js7X5AbGPSjk@`1c8lN|fpHcq1D+oCyhTU6Wh7wx^*YcgQ(3md@z zpcrIx0G)yp@fCKi9Wdt&Rm?bT;pZbB)xn7b@)LPQr}`XF54khE)E$Zw%Tx5`2P)%=hkc-} zyVbf`!B=k7hxuTxgNPkeSZZ=G_b(X#FlN#K47LHV!{2_#>EKiJ={z=ON=q!0i7 z%CJMh-0&*s!i!TM>`+Hzn7>f2=tIW*)|C|xKXCha9qN+@0kaipMQ)s^Mq8mFdB2r+ zt}(cW0WZt~IrCQ@Av*-< zHSFJ}?7T`M^Z|IV(bW=jU62!Z8}%7l95mtpYr;wotdnp_Hq#1y&YP6UysP_5yDtBO z5N>L*d3pU2Oc5WMyFnFD8n4#@5-u-)y9Y;@YEs1>fVe(L-H`$~tobmDTw^^7$lS;L z5rh3dhQY3027m#4!AgXh*^6@VkD%w4&z(p?RW5^#U50~ttVjOfOOeoycQJi#75ey! z>DMM{-DCOK+xpvupKB3g<#w8<*};jiWIilnt@u?0q6sil%kZa=VY)>pL8pvgu9&n} zCqOt4t@`C0M0?EH5o(m&>KPB|)*)03Kg`Be!2&( zX9yN4R*iebpa+lShzyOn8R$gFcLptKT9$jeSI-=)Xp$_(dlIb=imN7{9yGtdKcQ|m zX>)6e@$&

    j29gR*4I`a<92?^4#&+dP{g&MLcZKor@FNlpTCpMG+NRwzFEza7DZ7 zGgcXnrAkwA6crW9ZL;LdISc=#T#`#QFE(lJ>+eZbMvqff19@Iqlq9T2mg;V+YA<=A zV#{GVQ`fe0e}bFE4|%yBn@Z*PAmUAu@I=F7R7e}vNRH~Dfp4`5;m@tZP-T5s@jr-G zxE$$EcR@wZeY({6%QcKgq})?nF-rs5Gg_>pCS98Y@P;_3s-lmr?MKe_P=hmAX0(&6 zQ_=zuVA^w9miuo$1x(Q%TAUH^Y?-L>TAxDKcxdnE7<_kfBZvUJMX1rvdlbTIW`^C* zHK;E^3u64Jg)DNr``vMvtD>@;OW6$sNdBvkEqjOdtRL>((B6~bGqEfU@QTVUe&o2 z`F`U`=O=C^-O#7xpbH(zvxM8@zEgoFT_iF~Xmh_`^>O8S=76se(_S}2nlw(jMehZj zCadp4)VRtpoqNUZfnou__2A!_i7q*E0v3FydgnhxW z_d>S*Yd;yKA9t1sX@2A78doD6a0lo(k%+*mN%G_do{Vai7VkWybzbgZcm07dc1P>- z3M{D#kw-|ZkzosWV^?;e%_ub)9K>Mext{ zAfWp65v}Eu)rA_sGG0G`-Cv8XER2PA4u4yF`{Co83AaeQ054o`u@q1-dYi?Qt_Xf4 z2UL1lu0nC;qyLF+LzAAtLX1u<-wTtVWMW`QmUHYCvdn02b=WV0hOILKy;mNz$IccV`sQOj%2{#-+cT4`5=otMwO;a2IO6-v@9F*qH8Fvbl+lZ+@w8+-E(!W=$9#4`l zizEMDDtO)%3bM8Ec~|S|*)iwNmhc8`&0OJ5?VUye#e}{5>bpuD zRwcF|bER1&+?kdjTov#x;^n=0XCoJdFm{&r|jV=;#*Y4rdD>s zzd;4SLARgP8OFx>)MIxMV6HE|048hlF1G<;{t$Ctft)W`XyvjT337?QqH-M_!0=@k zH~6j?M4-u1wuC=p_WdS2TWbanJxcJXBSo731SFIXw-pwAAuQ}cX6 z=dR3M17>4;v5O^+4#N&D;&U0wKh{tF_{mbBZ4H~$R)?7(Y{|CR+#pT1&})Z%m@~(M z?5mbRwTx#g6bUAf^n&7l9yn<~H+8Ab6SyGokv|T_wi}ki>dx#7Rb|#=Lmyt{h*>|_ zg&$NHWC?sC9~nqK;oW8>nzzJ8>|C#D@TKUdxn$bqejy9z(TtxJJiaAG*Qf7Tk>%O< z@i-LY_YL=UPVJ&^S#3D6(9#mpWVn6K?~_V*$ewh81fV&QWp9&+gWEO#dvf8ar{=M< zZ`OT{y9CPD)9WW&A{aUs4)UK$MtH1+F9cnHR|8f;Vbie$>^7}af3NcbB!|hGK;t1L zPjyOQYcDLG=x;cnWY!|4EzaVUBv1|g27mdLa5)(c7tH7{A^l@7>Sa6|nf1q<3N&D^ z#Pt;7RPM_QzfyB11dgRiecS)Z5@kWCDW@(G*tCgP9zLnGR5fp1HxAf>f zwTu-Om2qlZao1*_<|3uAO+^w$tMoR_4Pm_W)etAoDO%h!!NXhC4U&{+j?wD@7J`pA zI2kGOd90=AVbnmg>XA9TkUz@ydB{|W>*c+U{~=U#p0ouqO5FS~XW z8_8*|+uyGUHj-JlSjks>AO6?+!k>M+P{Nem*+(lrnex?InDB;9&gRhl_)V@Z|0mI# zy1xg3{(%-^|H^P9U!v6eO_zl=7-MfRWg9djh2R|q; zDtZztX+B&m#d@A?fu%`{PpHBCs|$1fsAa8#2AoFQDI|qTqly%YW`Z)=G5)aQ1Ev#? z%*cC5rnS~Y;W(x7B+cRn6Omv^I}|8h2N?*=vx7_&~c+){?R-8Pla&Y z9$a^UQl$2Ty8PN&W{QRW3;qMpLQQGplyiP%WuPpLRkQ*P@1zIe%gESPzOiJx5n=${ z??pm8WIVyR=Nw8J)l!(2a~Z2)2g@dvWn{7+sa8vn-(3y+4CO>3K;7Cu|3ilR}Stzj>{Pi6FfdU+Fs=T=mDY1{IsT05FAsO-1 zyCht=NKaocKFckMkc_%)YW>-`EC*WX4?0mfhsW0`Ad{7C?_En zDSc0VpMq;qX#65s2e%Azi~3Io+WKv$jif%As7&S_1My>lLk33BhfB!Sh3o5IVpIrr z@64=t;YD+WV0xdF##}S#Fe)f-U}^szcl@K%Qro-QFrVG7F1pYvlNr4Mo`}6rV6b|Y z^Gn5JW%{f3$>HO(tN6Uwz-i#l;PM;Hn0)pX1lw;Mw~E`^#j3g|O-H`(6SWe3$!w37 zO^jauaCqpuKEh^T%HFhJ_2v#CWBJRDR2EDN!tE$0IPZDAN@ro8?k62?x7E28?kY$o zkk5U?T}P$iRrHj>;;w4pqQ_rE|956*|6gY4it?iKyWh;|f>W*$0R=LXbp$ZY4HE#TLJ z@Xz=uwBT(=(qmw~^9tUp=N#71_Fhv_9Y2Wvdgm}&O`Ly6TWVWaLrd9exjE?-UqJSM zr=ytp?8m*_M7v2|Z&y+f&@r+V3zo%cJR#3nPsZQm5gqGOP+8zHRR=1p+2RSwMH#U* zp-KKk{ttsXsttKMb*FYpZ#k~-JW$+z3>FN7_Nr~yI!AE9Zi-~q*MGUMTvD-mbeXth z#d_osj7VB_bMHGj@ZCB0tz}-&J;T06o6ggsYOv>KCAJP7{~uTH9Z&WD|Npm*ibPRX zC@Lak9wSkbl@PMB_s%hnLrP^!%H|Zwj5zi&%HBt0oOA4T!a25M9Gu_dRIm5vd-?s} z#pyX7&&U07zu#`x+x1}K^Ez2qDn~ zJ!S6Qx3#voVxfP|%0HLpQTkm{A)LU{H1i;l*JmiKs#aJ=!5@i&%YjtGHqWpbE?u7B z*%N?Bwtogz4?L`{9Zr^lhLNQ@}9bA(*V{_gTke!LaT2;RS;FxX>d;5wA9|+lG z(hOSk9{_XDqW4C`#aisTbLTBVeF@u(|QeONf__J{Db^xNyeR`*34 zcH!xu!xwwC!Y5#;+DexJ88&Br*g8?I{EcJiye~2&{?ZocQEz-7929-a2vD4=&gbWk zvzk1ONK~wJ`2*bidxS`onc-^h&f+3UYd@)rRv=QBoA3>u>D@EDkY))T=^|b7ed7kh zgCYk52R~J8B@qOBXS{vWkbb#zsM}-$s8{_9W1pB`WI1~!wl=ybzw%jyGsd!fm1p*z zF09*RfNR|6>f`I4`DH<7n7{6{E=5nY*H~#+PU_X|{F;(cGD|UOsB3Q~5%`z=?!xH6 z$er79_p)Da3J)6zwiA)1p70nH&K?%0&!Ja~@$}w#n55N^YvV$#AmAiURQWVo znC3jaF0;Dr4mwk)$0g|{aM4hM+aPSI>|*h#&!uH`Ekq8+E*1w9OWpA0-jKxZ!cfTEr#ih`1Hq6o}DoahCD;6Sn&A zB0Qd5l2R4bVCjX7rHtYfc+1~hu0it5(Yh$^)a$t`tE;Vr{1_Ff&8ua>Sf#(qBZaL6 zg%aeK`>WS@GfJ%i4^hbr(p^HE`!PGC*5N|Ye;h>RLVFR|@pDDp!s$b5ape>f(5{#H z7{X>hXY|G4iygz&d7Jmn@n>)@wE(Vpot`j;kpFBpfBtss#86Yv5sT|stLLe(BHdN9 zNMQFusj{WqeEMSx)b)!`isd6`X;BVQFSCqWa8R>2JfBD~n58!fNLHmlepU6wEhc5bX0Yb!?PSZ2Fy zo!ytYiHWD_u}?PaDqw(Tqou!E9t5W8-X??^Yj$p+uE4hriRP4B0lkP`761aAieCjE zgG;Hm(=HS%2ud31Cb|D#oeoBH{=Qnm=NhcZzVx;ulIihpd1h%c+1&0*&QLPi(!CNx z33_EPDyh28ap1b(%r%_e>tC6iD8Ha(hSW-rBfR8ySJVkyp^I6sYWm+Xx{w^U_VQG` z|Fk^(H2P%&Q}tn;P{ET$>Xhx9wmj(M32}}>*X7~|{u9A81kDAs>k%2Cf~h1{4FPa7 z-Rt~5S%q-ohZqT?I~bVlH$ZqDb{Yf-*@FPR@}s;kmJt~L>6u-5%6Paj=du# zu$<1i4$Zd~p;;t~Ghx}wS8W(d^-b(j{~KCnrXUJ;`oFkYof2&8yA0U z3wzZ1*b3XXcqM`JYdl76c9Urm@mjg&C{A>w-jP|G&UmAV8jx=g;7ni88tX4};dJb1 zuJynl#na#adDBmtR(0n|WzWpdiLW`h=pgiVmaZb)>@kbQP@gs?|3Hy*^M<)pDu#2t zacj0*<~j1`420uk!zLtY$}x}zMyC-653n~GQX!Q&4Pm{fWN`yl z^D1{?R|(Tbs{TJo4wpl>+uHN_0M8J!)VPyxzz!v|6ga~H;6l1Uoo*Nd4G(IVTv$KDU|fgueWWFhzXrtU z8_6{SCyC;<$!U3;8K^nw!)bDkM(tb|nGgT@$)?pPI-){jNpaEF?1$PhUN1V>o?<-; zk_N)QzB3l|yFvy-ph3_`Y$0!cbDr|9z?D6Z1HzDNS%D9#EIEw@fM~L703aS;x}a|A z6OT>mm5{p(Y#YVI%Q+xO8@j^3fz*FDl&PFM60lY5T99avYL;vYKpCqR*8&QwQ5Rnc zZk1(x;)@!P0x^?j1oyqcHU?)IK6+fiux)+p>$EaY0V{sUl@krS4x+7GYGxmrS_3G* z+I_}XSpl@QJHJYNbKNL^^p><90hUUZ3#Z>pNjgWBWWm@@3VCs7$ZBFV^ogIO$3oo4 zCk6<#OB?banuYew(TB#U4{_)X72j+{NQ$9Ar!QgJ#rRa-dVwx0*6NJQ0AaW*dl4kJ zyqbij2dt?vItt{?{m=GAedA;ve8PG9h7v-FJo=?a?@9#LfWG@ffvs&I6`%21SIWi0 z0VPHL4uBjpVTf>(p&5Y)j;u*uGDs^C!u#S}DyoL53drku7_TK{TLg)m`sanVnUe(NkB$Tu+9(0*|>*~ju> zY7waDO0<%57vc^B$8UuKk&lm$7M})^j&qSuf4t~fSy{QwG6MmeZ;tziNw-h^qS2C` zJk~@C-aZKV|D(Rg^Je}{!oa15HvO^i0vFqUbYdoZvv)~eo0_hg3Qv*6TyujhQ8dqa)6e~pSKL_-)8qZq83eF+E60#`R%(qzg zF?9Ed61>!x^l{eHvhZN14}%g&)f6euSk5z;`TQAu;vS8~80;cb;#tFf1Rct+yf|h| z(@-5mWRQIez;UY8?D~lnTh+T~#^-Z#KsRFU1(lFK*(HuXg@!MAk%dKIm`>-l;D03% zNJ|+NzUZIx4is^xJTk2sV__}l?C|Ip>>_yhndMX2K&tg(qBbhOsWq*D^`T!JnHqR4m_2c!4)BfkH zx&s=8(;c5dT8SSX6_Gl=PV>+&K?6+i;Ut!s#~T^|vF}QZ?$*^_33HKCx`n?Rn-)&$ z0sLH9klXa_Bcv~@4-UpGK=)se#P-&<8SDFQm}@}+Ne`Z;MvPNo6+hKCH%axQE(V_E z1|}r$%6$^9(Rgev{y)XUosdR9S!3O+%oPKo2-Wl=h@2cj9-E&?X*`b9f@5pFZ8pK1 z{;TrIy=w4WJwMfkS2YC6{{(0apLWgN6IfIKyTA`**ha1rt)KrYP8{HX&--hnOw=}1lR9k1G-GtzIDB~w*Csf85?)=ZM&JG*m-mo&?C8<{TY|UZ zRG_H0TdH@gV=Q4&@PJd{>jeWK%~7Se#WwHk{dE8(5c=FOnUrz<+oN`_m!8PDDd{{c z2xXViqEb>xo}as+}Cnvqz*N6w3wndc4OO5PN;&$3=mjVwobE3TrlSVfwqR z$d!FgO`SbBgK3|=8!OM+G4aTcI>#+Fwt-zQydaQjbwOK)0h9)_F2;_^4nSm7_;Wn& zWs_rFWr(TxSjE)%*BQ}TZP?K~u=?d$lVN4Jltw^f8cddF{V$B5h;4(lIr0I*w0*9a z^7*=tt<&x)O*3jiIS_xt80%k+8aNxAO9WzZOBe`2z&cMyghScSlC;1>Zd1B;Zh=Y! zkx(g4)fOVX)j zd3#0izqckdn+w3#uE1h^wGN`k2rTH&BkB6(fMtR3raH*++qaT%Yw=V!8WS$p-Uq}W zy`1<6#xKV{N)mZ4P$Lyl<6T{Hk(jN z8$*}gaTO96J&KPl0b_!vN@t|Opy*YBn_Fa~-n3mL?krdbUDv1#?nbJEubtr?YYo-( z$QsQroD;a#Q-2aoCMrUft~a7J8f2M|#h*@Ni>3+aYiwZ*;QLnvHt7K;g{FIUhTP|d zwD+AS0r{acfU6vQ5TsN)K^jbef}hgh%t@=lZ>{H;i_=CdtNHy@J5Rm~(ikpd8aB0l zbGamLXrsmgI-&s|7BnZz#2K~Vx*vJG#kJD>sn$eA+T^h*$ZNU-{sXk<*V&ivzBk(n zC4BQ+pW{fhtaxu5@?>Sf5-5W#pBu~X{?61x;>x~xUC+bjvt2TvC2Ho_`lypDpINS$ z0N&&-5_#jqbY%U@0hUzXsW5OJv2r#MOCF}aib&7I(J+yFh27H+X`uCXjdV{9}ogv@7`PxS3ewEI}+2@lfpLf#67IC zr=V}UZh8xp24HZ!)hsqeC21io`lSCA-_j;g50si ztK~rTxEV^L0v(abY+J$)iK30J7@z~R*D{1oFK%;%Pkrg|$^(OF>H=U-23nAkNc3{Q zhijDHxjS=QW%_%kU+DT@vpD)eC~0k#RxDTQkxYImKG_UVgS<+jLDca?vM89Q zq)i1F>;7B{79%HJN!cwOqIZ1-6dpSSJ4N=T%IWA8e9!@&bfD?xuUiRle$>6?JS-+k zj=Tdo0LhT+q4cYv4a=3_nYjx=j3EVI^@AhJ6OA?%n@U?OG94ORC2QVj<6sP4jMyoaws#n|RkUzi-pYL#OG zM&94%lti#w?Psd@EHM2<@9!6d)E}&7l7wh^eYI8^war;}f1qg;X-wV}uLyx#Prd)D zps~uQR~qL=;Qgk2J^2S{w*z`90RC`SsXwuJG?0$7XbG@b%GdhAu+s^c`S}5$u!8ka zbY>bifjQMrwFx?Iz(SW4XPam5!-`Jl;FbBQnIh>8PL#YT{4L}+Gi(d)@IwFJOar$z zfP{fNokLB_hlVF53s)wbBYvRC=$Y$IX~pncpr8Hjo0NG{VJ?9L8Z8M z35rV7yWuviwx8tqVyRM(py)pFoKxFepe3R$1}>)rIj{F8w?UO5N8}6Knu7C6-a_Hl0`$xP{l5*)OKs z47wHeaLIY^yXj7uf%QSSwd|f`8Z|ddRzUP z6t1N5;H6?!Z%emC;K8sNJ56iqYQ7+mW4Dt+szRTn)&sA|l)5bnetc(jxT(5N^Uz-9 zP^-tGp&2u%Mh$5(a9`%}CoR~aV>{p(Q_4MVaUOE5CEHn@+uo>(v6_Lo(QmH&*d959 z38rKI7ZMsGE&G&{(Ul!>$;WO-p~?N2gBu+k7~fb8Q0rtMih}^ehoyfPYjULmh-L<{ zNrJfQYz3kWcT#wOr`B6i{419LIA{}M>J8c<{>B<;KYv_TpKP5@_ZVm;mCibsFTVdr zi_>N!AZuL`Q}ci+)#ruE^#Zw%#Aq+e>qcXxIVbfXrpmKuZ-0#gmjn7@OVrds(NaP|?EdRVnIut-ZVr|b@` z*Y!P4-vmf}=IC2lhZglQ6)M4lcS+m_?RRaJmwM5h7M0gzk6Ma+=rc>&|4_d}!(40H zTT8YoLbs;*uOe_4m4=($LQFy?AAMK7l%23=kojC*|I@y=2wbajr^6r`HI$(HYTJ4k zUpYevP;8;pL{PfQ#r-DU-BL(D{C?oKUJqW4>SNVF?zSoLSC;g^DYSm!605d(u zF*nv8BZ{;OcGJ|o@lsd&~1Zf3BhS$+C)74C+S#=_g z{@HUupgf3YsgiE>^0DaB8Y6!*=8CQ1_G<6hwScEn4!{(_0lXft~v*5;~Lt1ny~bRd0k*)k&@ zOV)8l^U4QbyUG4Ok8}?~TC1+ohOyKWy-&SB4xA+?h?tLYFe44<3SAVDPjv61h#Qw6 zC+4$~qiq7t<4k`coT&0<_tj?BH%PPsB-MW*m#S4wabX6k9|nEGI7pUWhaD`zU~lK@ zvcrw*S3iEurF9F>H;jE5QK$J}vYe%?NLv#BoNcc}d=R@>@-7AN(=o+`74$2YITA>l zajR}3(wTTO+U1pAE7+H33i$U8x2D$~1R)}yv-LPdyMzze?JeYaAii?T@fH5Sll?A^ zCs1rtz6Oz{4lu*yW!KIv4hVh)xxTtL|DlMGwDCPLH=c%~kg}C_-`Y+{A@;c%4KwGz zuCuh|Tk_(&e0Aa_RHe=rxD4gZtAIRPMsS4n*7<3M2v}=>ypz6L2I?OMFz}GqNV+u|pR zc1&!8N-mXNDzBJ8stMY@KVk{TuZ{`22uPEybizEWglC4y^_INd-abdSaJ7fOaqwmHn@-Z;ne_>sS8$E zx9hmr$v{h>;tLuq5*{UN=)HoUGN> zAntuywK5(Xh6W{DKfkSo-t_!*hx6M<#Hn3*|_OhN+NgdzZU zf_Mix?kOMHFAsKV!}p$=2vP7(p;b)*N>B72{Y+nrIyXQVtLrOLg{h;BOTN5)6JV=U zM{=ncjW>rey@SACn?3Q0UO@ldnCfp%Vvfq~(qHiu`4o25)-@XUruLDVPPc2*r9s!= zHm$dvXU(OKcKd@~%9wesKM-Ly0Ow^fU-@(&VZigPJW|!_wyXF9-5}ChWw-)yl6Gau zryf!R6u#eVfQPZ%1d6eFJkX;cT0hC{m;8_?y{Grhe)VD@a!8ME1xqeTAWwwF0iFQG zmIc>(JtF8}yK$14vaj9PLLosc3M*&X6+4U2&Y@+UPnuTv+9LwDqE|qTB1}IW(f#5; z+`yT3h%#36%IZRh=XDA$UUC%`MXiioT+S`%u&5daVUnD_UQbgy;(8_K5MvQ}bF(~s zp(!|NW$p4DU}&yilRf;eRGvHU>BZ6*QY`slX1SW>*IQ#H>#g{=OJ+&8bM9qTa6Dxp zKq|A9y10|Q1G=uv(XWHtI$T{zMw*Frm-^hFXyVxbUS5=2t7JN>Xe%a8cSFuT?S7H+ z%jy`XoIg)7Q5EzG5t45`If@V);vI16 zH7q#?)OU{`iiXY|0J;2CcnJ3T;MVeZOxAk@9%=5v?@ZqW$)y4Di5U}^wU^v`m#AvK zixvAXP72dXjkqgIzoR0t>8QCQ8Z+4$W*l$@pdx-_>{@kY4~WuE-I3!|GV!tC>=^2X z!_4}~0^2g`+U2jV`!sDOAmkuS7nO$ciEXJ^n6BM-(zL3J^ zq^Dwu6BDFuR+rs-+LV97{HC8gbNCWXIfr}U*6yEGp2kGbEu;@AJB!f2k_F$OH*HMS zzqKs1f@d!Ri>LnbaB*W3Gz3Z?V7XKrUDf9PyY~|p$|wApulDR7fI;7eXn-ulRt`JN zuGmT9U9(bG7D2zmx^;E+k0t&M$axJ)nR|E7(vvSA^h+-Gy=*T@<}6OjQc63IG?$%y zue%ogi@7~!71Te)(IN%uYZ6>QnTNfR{-Bc#CzFiK1kco>u0d9d}Y0c zOns8>2H>V7*W6cTiWQq#>nC`bhusvmtR4?A1Z}Q#!K(P;seVvfMut#a(6d#HU;W8) z%4{JbD&MwlF1~vw)!sVTZOh&r&7KJT|*RD`Y_@Qc49Cyw~uYwe?cuG*l` z>#O$2jt|r{sJ!U@{xHR>I{oCz^XE%(oP`b-UK)I_pWX}N`f}3B-GeiDoD9;k{*=kl z!s(gnJ0OnEOy{X?D87m|bkF?kP;qp{$fZ{@4nahKi@nBMLas7w%|3z%ud(d7VM|Rr zo&J~sxZl7>G8k9;*~R#GS(AbO-y1L2B3KV3nDov_%}3Y^cZzPHYTt-`)c9dHTfPcR zNM}ACxg!-USR3;#nwx_|=s4-re%vA4_T_Tp=MSE1uGBo6?+ZKTavl4UX0+?M%My@` z8tHO|9ojlB;v1|lA+^(&P{(4nzhLl&kM0Pti5x&t1`Ae-3?bWrgLBSq5HzuuZ0dEr zG!3oj_(gW-shB$HSAx@sJg#RleSZn^6YtEfyv}V4{L4s0aQUK^?KMT5olsNpk*{}d zo}xn0l|9+pi#o@X91Gm#3d~8`4MfU<_@vL$!M;#wk-5KTB7+U1hd;vHt20JpILkol zMVmz-cGUAb?>`W128YUFweQwE-FFhNQ`^;64gh_xyT#iRZC{<+*@A7+lEIE z@4{Ir<|J%uM>0O-_`!0}0!n^hTOs(nA~(8p##`;S>aW02bwpeR`7_OO|5)mX`}zlV zXU)x>b>RbXRDDda zA+aMDpExZT@uFkIn$zp0sR&p2PD8oX9e?e`4q4#?1(w0ps;gHE1+Qb{+Li{_calYE zo{+2%SF;T(B9;Hc6ufmV9xEw2^)LnCASi&4Sz`6*tq}-c13Yj8*RLwiA4s5-m-)^+ zC)59Ijs|07&1-AMF;GL0!5l_7hSs@UW;KtS8C(sF0?qRFmdGeQw#9z4z<&MiA*X2RvUx%-0bw^ z<2EFuyJ`GdKu_ky)I4a9!=gFbd$@HwkX#XjEBsMOWy8-}`D%O1PS=4*2p9JAyUuom z!04dIOO0&4W+u2+w9LV&?HZeA7|v_O13BlljsH@eX2n_9IowhFe%cOVwSw;{yO46G z72?W_t_ESL+x0Q~ZnMeDl^fw6*dL91`!-*A)BLRNWV(zy!gkyzJw@|f0-!F0F(p=4}GnhRY9J?LV_+4rTO7MW!%__ zJ8!-Y!_7e`V@sFj%a5L*zgndVOP+VA?B#l?zv#viPQPpEQk0~>a9&IFP+?_Ho__u} zzr65i!Z1+3oK^Ap78)Kb@q+xF+KHzg?}FZ73PowTLxX|i`u9=Mo7|x|n#2q2EdbGT z5OQ@dHRw-rM55Ih6DCb2i`*L3L#ofSu{-yJpTZ7y@F~5~?wz$%Hf;@eaKiqE8%>i{ z%j+|da7gR!Hk)D*VD$#V(0=87wCm|yD+IiBJ^v-?aiCq?3E-w#_Uo1o+Q{U_)G}o; zedzRvcUNrD{7^Uka+>K!70u97#ekho^YSf)PZNFWB4x+j*(w3@c1=c(J9-*&O_6na z0yQO$pwe*1746n#wvpEnkoSo8BHidLnZO>rzd~S3iztD$RdMgsiVtD_yBC5y;yxWE zl|0?X=`&)1*asjvukC5Y11sEIk(%Sf(Vols<3ZyeCjEx$di_fvp@gCO0Nu*%(x^%M z+xn<2M{|TwPfW{xbW82r*_N(h0rm>TPSA{&!^@-hF&?9Q9`Jt$w4c+|#0&ebPa`0N zSsMyMqS7N}P_lJgQ7A+AT#l$6c^Icx!06RdA5f~8w_2gV{ymrg<|B#Yd4M0<(onCw z2xy+H!#C>N>)QdoTY9X?$1`SiJZmhz&+DUU9)<~<`8}OnI{hmtJgmctD6#YK{B`*7 z!^+_JszKXm{lCpK@e?~S=+DlEY*8l-GidOU#(V>k3;YC zqE7RH7y;hRNA%#-NV{RU7EZb~mW;^<@`%OW%rHk1+bNtx07)>|zgk4eyVYen=>~iB znb2?hP1Agb@7&-mKiL{ut>=Qe)TI!z`RI(#B0R5|DXvrPP|dx|PV{xos(SY{=2CMX znxza0zt;6u)Hi85v7|lg?{_-&$lm&jQ5E7O&K+Zukkt4cSdxYu$I&vOL7~BBQE0>B zDLj`8+TyyqX`xZ{t5v?eY3T_>#J)mc`G>;8cQ`~=AkTJY0cI=H0ETl~?mr;-_KdO~ z46PV22BDjP`~DboP&J~&d^@0K+{9z9Nb74uP+n_y$n+-WAEXAW7QgDv($hZq6Okro z7Ahm(iOG8L@wSp?$JQ%fp#g$-2hHOd-QH@Do1m$^B|CdYUc@NQ*aYZ&A_(!?&Y^^d zeleu(6e&BM)Fa$x{k-Dmn5$j|EOnbjT_d>MRsXbo%DaB+&%QFXZQFaaW`6iQ)Auh) z$!}j8n6*wYclz2shd$EI{I1cv7Ql+(IZ?%B5-&;eQrkL= zn*+Z$rsk)26;0#E&oL&%EB{z@6nx)5K2&$s-rV>{-q&+u<@7D@8*v672VXph zpgey0)vYu4>7utJ}_qYsME@{40e=yZHi*X6jkasi4% zWus&api6__3w2sruCAAAxFV((+1_+s za7A%9Q!&{c?h=CCs;BJ#nNsQ=Zn!b7?h4#n)1ix@b7_uPJ|Vt?!BwB!hz{!j?G|iJ zpyG5Fq2|lyn7z?$tK76ROA$2KAM(!LWPcTCMd~=W)RB=RSom_)M|1A_Gpg6A+fl>8 zT4!r*i{#&>7IFs7{Rj?KfBWf{wd{$r_9L?CZ07xOPTzuKGO7}yN{63@Z|SKih{hY* z7B_h|zCJx5uC}ez)+(zos{1HYzWI8-v_*P17s4p5wHvuGY;dIXk*|rElR>lDI{aS` zRIXN`nBDG$0ot<&&9knb@?#PCX7w77*0~(%Y?9RSBn~fLv0?GB94WcTqQvs4PgV^> z)Mx=H_-6W{6OxZS5F#8`4Ns@UT+^J1$ju8=0pZ!>%;&6_jEY$(z~{{QzZ)Pqt7A!!S@AiQmz7|44WUA`JHR{5Y889B^6Lo zyeXWW+24lz>4HDBLq`|J_^}SJ@=e3zY*8)r!_sOMBoA}`PTxhhJpS_Ouu3AE2+F_Y zsW!uKwiRTF{Rl)+pyHA0<(?burng%jq@CI{NhNLlP>@Hz!^>sV8Gqshmw5c*ElzwV?zc9Nm=%BZ<5)8#!U1Dz-=DCWV}40crPDBf!o0 zK@@RvG4z9n&}sf*2j@`YU0Yo@NnHmM!>)va=%~1@6OZ*Yrm`J9BhExrLUhiQ3p|+) zFn^Yp5Y46;4>=;*YVFidiWKkp=DbU-`>;G>A^>^Sa!7FV(U zz!qskSD(kE1h(d@_bhYluXD5v3a`rrxwS;4)r~i9rHy+H8rkU=9x<6tj|tq!oa9{g zRrQV;3f@`{-dzfiG6A}t{(Prl3I)WyhNTsqTsf#E8xEhr`o$Bb{v*-RuF7SXxWyD# z%YS;T^$rc-?;cpE(xaOg-Th~aFSk#+%%KtHUqU$F`Oq&Q-wa;n#kER*=7b$NBV<-n z=@@636h9Ey%IP!ghqguY@F$mG^Jk#kJ_pfOqqBd0LZ#xNO^Htq(=A*6L=2CG&i7Ikv`+rEx(omSy#E?8$aREpLFYcm(sQNiD-G| z3pn5X@TFJH0;}UC{}VTa)(RPy6O?^oZ2d2NTUN41NV;I}vw44P8iZ?)czsRkS*@ya z8WPUO_u#Kq#$jB;ly~B<5Z{}b!vSe~K;~?q^lu{ZE2;8nOQogS5k~U+0oRB_a+ztB zc9AdRxlVpvR)&3&x6T^rBp?ZYgQTjTkL}I~lSdx0*WUAvZnsW#=PfbDUH!&du&q%R zN#J1Cs~2F#5M`5y0R1Mq$X|k`f>&JP+R_z^RP3qh@v1R*op}8Mj~Axa(^;=|pEe7& zrVm6PKev339}?$@l}hQpdG2jels@E$Y^$|@+$PaV<)$sUfwk@_yU`^2RU5-JU2R(7 zD%W(_Z<^~|+A|06D2tMP=z?3&Qc~OSmTQNe~>R(tH;jj{Q<<#!F=?vJs4<5FB{XIYLaMn2T2x=6R0L4+-?Pt6{ zp>X_0)e&QR$}SQ%@N-{=STFXgfq#7x z1XncsA&osDTS6(dFWOyF3D`Mr?BNIjQi_xtNtPHd(bWXlR(Dx2N8?vK%v;)_NeevZ z9A@)vP}Eqng08+ydBhL7e-4d)yt`)f)bm z-^rnPpyayJ-UL??61mdD2147R`jW7F=a7-2%8)Veod`_-oIVG{Tj6Y8w~9xYc`W5h z?v|pLdE(XXL0r>92?VvPYkf&(5BdkZSjUt#pE4RfdPpPiFMcGXKSg^ZK;On?ZRk;u zybj{_+@(TR9gXsfARpe9o%=3H^un5k`}9owhpZbHHhwvxzfQw5Ple&#*W7|T?E?piaj8w%rlg>eDF5ykdLjQWLhwYWhsaD8D~Ff=CX(Q7--Z!C!m- zZ-t9HG(|S=qj6);KX#uNNPxOMev{)k#S2l1ttDReba(G1Ddb*Bp(>LG?MB{QElDuL zvBjnpkfiBcyHcdkDp3AD56iS6$JVn7U8yq6i@qt}#jeG$3tAR`TyuuPY5~ODNP=^& z3E?3P@@D=YiQ#YIXxW9UomXRy$a3dPn??#gIdYm80<(lqtkz#GNol-7cd_ZX)m{#; z!$&LZ{uaBkXcz=s>oJFuSBRUKb*E55y3kDJrd%r^eqKWoHs2OVj9Q3?kiyh#!c8BS zua?C8k^cSWx=3^^C0h&@CLiMcUIbiN_v6%yevb8B9hvGQ8)PKu2Ks-6e)Q;@Sdc7K{DLf&`OTMWC7x89dX_nS+4>!>)J@ux%e zZ#q2HYw4jl<^RiJ%L}M|?D=EmPcbqYcqj8BU+pFHAKuK@I~R_-cb_mT0>z z8nH+x4KgK!`|HkPGAGPF``X?QQ<3cPKLHa>&eF4Pf8eJf5t9{PHpAb1`R~FDxt=Ls z5rtNKGw6T!9MJ15TMM{Vc0aHA=U5sx!?y+D1 zp-TmdcGk}D?pHUjuHCEgTQ5*tu7GOPLZ{wB2^WZ9;BE8QG53tIcE_>9#JOm|u899Ruy;sQMAc76Luxe5(6!CN z*NV_wcS)9`)!tVuVYZWI4@IsGXq5os{n&l)4|lLRKclbc<>16XWJ-laiAR%~Ut7!V zG?L>hA(*D~|F%=0%q?XpOa1_d!{q^P(%G{HIF>B^oxO)1V50)r%3`w-UvMpW;++)2 z+P%!50U$9$=w9Mf><2dOdk{-h!gp$B2h(wqSaeos>lN2@qkAwVp;C@Ay3KW)eZP4L z^=9tBk0asUzKUxF%M*b&H_C9P*4i*g(qrHA4(4!%GUu(!VEMlRAc@iqZh_kPpXrX5 zk}8+Bn!~)*Z}9P>cr>5L=gUV0b$yl%C){Nj%J=aHzQ%~{g8yxJ8WPgQqoDPxL}0JW zzZ!U)r)m9U2jncm3VeIySM`+kgw<1lwSuv1+q}&(ic5gX7%1a&c+(F|Nl-XYfM3A@ zd&x_?((E8F`l&eKlDO`kDsUp`f=;FA7#2OS^G_o=f4yyL?Z!0Zwdh;*7i#~E^~M9Q zly)=I%SF*ncTlEQuLNjv17n9AMUp1P5;mT+;5KpY%c7w?WF^DvL6blZYW#AC&`@aPw6 zKyiaIqr4t`E^#-A__Uz(&$7)~kBteijR`C~jmZR=HHYn66vQIVr~&?ls~dhuHm< z-2fs>n*Y2sI&bPfrBvN0mgd+C#{Gw~#3~T{QkW#BleFaz`rKol zOGml4Z*LRF4~XuSAh2`6pk7uEWQk3JQIPb+E0#NQ5f<;GmDr!B#iu3hG9VzS z?%?@kz@at#nsuB;!F19Dc-d&#vlo($Tg7Ff*~_)Fh9oSx1^Ogy9i?CCq4(#r5p%LI zG2DKYO=^xY!ov+60G1OGDF$%QQ{R;yDw2k+ZsfO0y|_r_el(K7u>EbxaR!($iXg`R z_c?Ml=^vYtLj?c=5`PF^Ib_d89fHM2+C?o5EhH^&L?ostqr!wOM+|V#A#BvqL68(o z3dk;wkvf6>Qt*?$u65UEaQW+G`9E0DR4*~7z7Y^*ME524pn}R zGLU?93Vq!5tYd)^3x>TE185*tU|4#d5<%HNhqOZ%9{JG3pf)(UtTPp+6?wsvyC>c% zWci``wgd8EUKV_B>zg4pAF#aSF`{;~R=?z}^S`nzX3V5U3ojju6Vi`s(6BCgdd`l& z#F)H|A?aA7o1yitrx+M4xy?7V(=LZVB`acR5FBopl2-${uVNCyZjq&{T<;avDoMgV z3q&E4&YxkKPnA!Q1<3-&qG0B4Nq<|9ir{QbT?RTxhrlk;*3y92dn48|y$TCk7V7tJ z+%|bsBKzDW>ArD`RBRn}TlCnTWUk! zm41WVdq24KtgMCVDubPBUMh2250lAAMUW**IFOZlQ(SEL+@p`xYSp7xad|!S~BX! zTCI216)Ed0n?*sR(evxOi$xV4XAQfLqGaUWd>3-@t*6p;Zn(^&TW8?|L>uZ3>0$l+ zt@?S$r5wI*>2MNez-~g8=y|5De(gii@N3^iufwDuFeGvEqA9dc?HR|q=4(-er}`9w zX!>853-6V`3}ou9)lLsfT<&GHnvvxd%Q!p4RI{J1t1Vx4HsepP-0u7#K)dQTp%YCm z4qEa;Amtk>f*7lsWrvbP4x^`KXa_f%Js`i|*zIn$tdCTukGrk|O%ZS9#M1R9;3!;d7X@PZfB^LzW}te%5~ zddFA%05yDHv_Wj?YdUO%{vGtJ^i#kwjTOV@2Z_r`Rslm`d@)leH4(EcDg(xMg~f;< z9yUK14cD}HyB3u+mCav{57YWznX2JXIAn+Sf)b(F2@VhDUbKx{_NpK0ky50lMyHcI%K(kAkd&@=86bU?}TN26ddTee=jZyKDvj( zv|63}P=7h!0`uq|?1!Tf|GG_`B`{nz1+H^bR=N4FlLzTS*0w+@n(Z}4+Ft7hbI|B4 z-`_)10(_~iI|_H(8K2m6a@#Sy%yUzD-^Wac8JAyvd?3#zYjm*6P5J3Oa{&)v0W4ae z$x%+EwO$Xpa?F|nM%KOQ<`f1t$aH4WR_!tzdc*uCb%P4!I~roe3d5k)^KcziwVZ!{ovltvFrZ7L%Tw; zRi-5|nQ_m%rR~w)Zmo7rcIZ3k@f4>6xMoN|Wct^oarWhgJ4b_p>gso=UdslKlBdY4 z%V{1vu;?u_@cpP%%`uQfouRq+;I$|Zwo`6RCj9s8#(clLumfgs56(v6zkI@ewVsX9 znny?8NxtZ(8N5XnWNNLBu_bhGFW(+`ooKV`^Q|DE;c{_k{e0?(a3HWe>kGxL8|4&h z^nA3kjOqAmlK9Ov;^?p}Ak@)3!3f>6*y2bRsg3b(nuP_2dkh}ZdCgOyaXX~ zu7qy?@O87yv@p4p$8YI*ntnaM6zxke7C6&4n!#C|`jjqMYspUenQG`gz3dxC55IF2 zSn_rr4J!OPpyJg~!AalmfhYDmCHbT9TL9((BU6G2n{TElu)mMDPJ#Foj;d!cz_dqJ zok@h^4_UB)x+_PN_T1|4Q=*wWg{JCJX6KP=1#vUH<(DfH)bvEC&Bm}L>(Xp@2OZes zhu|dum!#s;2afp*88G{9>n$wt2Iu9J%cykz)W?~exNW`8oa$gY!8;IKTU)5hJmc1p zSor?#rlibhrH7U1&704AUE}7jJ}_L9v5E{TO|UM@{;nM69nkT;_0Cwy2%r`ee-O*R zcK-;h->H%eaX1cy`x>W@*_p2=4-t^2W;CGBv8X6Cw$C>XJ&`2@S6qt(LkL+Ji=pT%QCf4;Oc!QURt zNkNyp6irfXV@4rKgC>Zpp%t5_d|AtJVU@#$$e*wAv2fF(X@+0Q=t(#HYEw|tH5Cen z`NQ6M1@x)<)fVwh=xgR(XZsT4&RZNTo$fbrzn$kGv(hLKb&CV zsW!k}Hd_oYis3#pvUrmA@)v4LZj|mwzVTOx@OQ5f4g=`>2@* z7u@qAc~SeHE;kCD!MC|o)3mqw~lfSKM$Pv_X6ygL5omxHc~!h9#cp9^tnT|fEipqjOa z9B}L-`{H&9GKRvl`_(se*-VwNkFu%9P}@b7$EXUQMPICH>}U_O;YTjr5tGu2cE1kZ zQpw?#H??sjM;ph-neeWr^B!sXNYG5B`mKfqq`f{XZof?ApjPafZ@=)Prq8cE-_`;> zM{weKpwjw!pNh1+KFRs$Yu&=ZNI5*H-Q^L}9&VCE+BqVgj`oF&>e2`XVA`n9M3o^l z-;A#|kZa*QVOr_5XA>A_A8Zb^q^^N;(D%f0+S|h|Fw|a>_nDsYwfG7>mkYXPBDD-t zQg_5$jB0)t-udN#9%q~!Df%g})jNi0WZU1*HSe)h!+J%nO1q+ZWK@XlcgkflYPX_l z$=0dIS~5prqGQ!8A(=jGIa1Rp*22AGT(olcu2DeWfvFJ+dV?3H)X)oj-fh;5?O%}_^<+o7 zdp6+-a~|loa8eiPE$2UG=Wkwq*{byq2?NJO!-zMaYG#=rNcJL8LxX2P(i4|;{%0CR zt!$hicZX_g{T3~f^K*%qQ#=#*)0)RkBC!o>r(V8lT`JWlBQ_{A#4LcfF2mXJFQrDr z?WC`x6)7*Y1E!cMf&Vq&Ncu*WFO7YaBdG7&>7FS^{=}G4{ z|9YytL^r33Edg`*XWDbxA7;xZe_piM|B~Wbf(8qMyB=6z^SbK~7VDo3p5v7plDEHe zPxg)^=6B@b!s>ZW*5TH!fJhJU=A9PmOhT zAg2PCTu;lpg+1ydd&=*=E3!@`-`o7uaPGaGa|R|BLuc9@Ah8OI`##mJuV#14;G>O$ zt~F%wy50TTy4{2%K1Agd3YpOXC8tWsS(syv$sFczRdUEFDQ8m@IW-J(R?Im@a+qPU znApK_!yJB3)%)}P{Q=#y?e%;;ACLP{yuz3bIhbWxYP^4&s{3<-$ZDS-kfY@ndTeQ? zeue%92eUe!Gd$Tc5akSLcV@sI{2~yGw!9Z)1BA1jo=X!%I38OP>r z$&f{w>4!^d~^FtA6B$p)qImyQOp40CaI#r4li_K&!#s7$6iWSoG`N&$-eY3 z`K+cn`|Lp~_B;rK<{k~Pg|+7%$h|VSx!Pv-C*UTE2CF|sl`B$=x!~~l@H!|zse`^6 zbmB~lyOSAi%8gSIM>zI`cl2r+JvvOu5H$+&P}9pi2XG0P`O_XJbQy>ko*Aq0l|%2A zIy;7iH4R46=jR=a2#w%7a?m2PkF3*higbv*qRmpJt?H$JCc!kmhwUL89H+I%F= zA|v&u(aKI=&m0?a*u?E)){7)iTLbJayXSAdm!{szhhEG@)P_oNcnZg-tk=~B zipB|X$>wK!d`Jan%g$< zw_$8B@qf^KzmBLH9d&}0xMy_=e+IYrdj*~0e=;YgY|ScmK&%vT1eNyb#BCVyS%auwamPsLOFwM5%qA3c^D}CnPqC^4$_ARs=mnb>IG! zKKZ|}pV>pD8ljDEkAQAQ_fv5Z>=bw5{KIEY>WwAv+1z}4c1&IK{iDQRzBfEd+%1h_ zB}})toPU}hBPE<(yslu!UrzDWhBE-NP)^+qv7WQ&a#Ap%pf?0ZBTp`e>Kl9KjB9EK z?v5=W&(L1EN293WsLob3Qjf-Mc%w+8$AZ0H7t)S2Zv-KD59vkM)4)ioU{!rAvEldv z`b|EAKO^5=7CuHK+GfSz$`H<9Q~P75LY0j=(q5y_4Si~lhR`2Y-K8WMzS*5v|3^0* zyPfwVCx&uX#r*xqWU9sN>o}P4(>@TCX!sfA$zSrPSrM0LC6bO~FZi4#lg7*O4x44C zw|{+*dqRFC$iv1EA9NN`p1G?&Afze7{AzLbl7OXDX-emn3qSGHKX${%Y)3IKnCu=S zGI?a~Q8=D@X)xsWV~jgo1@J!kp#Q}$So#=&^giWH9(7LOIdHk20QpM+7q3i@_4U1s zgBX=w(`*CSL-CBS3<9;xqcp$fWNe%u`|~$={^xV3h5s!00juPmkFi%}zi8I%Tl-=M z3Mg~4CROkNJCX;sPJ`(ZG9Fddavn@EZWWdpuRoi}TUD3RCd|t`$JHSiIMpI1tXBC( z>_bzML_r64OlEPWlUbQP+Y~}yucuhn`Cz44;oSeR50$l)6Zl|^P0{!%<-`@e(@8zB z46IM5TYvD?LuLwMwaRvej742j-cD=~CNAFyvgHlxq~qYWS+zjMEsjo5O?Ag*UK(gq zb7(ulaBR%sNfaWSm7*g1h5!CCzkj1h9xExmh<8|r8$Q?PD!4Je-2um4HQLBb>R1i> z^Y}OA(WKLL5IfVMH@9I5bAF@BE<^x2ba(Qgi*Gt?tn(~aoT6ecLxm3klE;5C%uBR# zP^3lmrA|(%OSd z4~Jx9b_Pj--(8p^lfV^E83QR@*47C*jg<*L*9jv2V?IMF=Iy*T*+Qzl0ah<%!}US1 zcjwi{7Yac+w^#SvzHBTWbfT`;hslrp#b;(L60Wa9e8;;v}WkOQioiuH@ zZCuyS@1FMe&TtO{^SDXwc%9r3%GNfoN89(U5v20$f;{QBH5AS)s(FlFNa(+3 z{!4gA!ib;rObUKI%F$v|!Tc-fKl5k`mP>E+N-EPGJ{3z5h|>jSLgT?>yk~P84D_zt zvwCe1_$o5WXR2CH08~FXSFmmo>MgHJ8xH;tC^)5AQ#8n-R9;KHx4#a9QyzsFo;QY2 zFQ8*MbJHj)K4AOx(7(1@_Xx_pVkX#1Z^mi`%ymzV}|>ine8lbBea&rY#+D$B**3G~}RO3_P0 zDyJ9!v$kytg-***)rzPSugtVf5j-O@io0#t3n7(`K7EQR%R`g1Bj;3mf*vL9BJ$ub z)ka2$yw|hUZ(w}g_?Uhn$naf^eC@}?7>XwTtKGD7mkR~~O#(SO@6)kLWsVNz^W@Ta zXJhDTj#N=)^BKN(Sq&YU7|*1AmBX>FQUJ5BpH54{`rK%we)`WLDM zgb!YgB6Akh=hhfS@PuWmc%-+UGx1=&jE`PVd#*7p;UHUjBaJ%Jmat#JLBkuk29k@f zeKVR%kVIM?L?M;c)Mm@Nlv-tq)Wn7s-`&%|JVXw1oE5hC{wl$Ow#fGonT9L-zwb|1 zsxT$DZs}Pf05hoen~MYd%Dud zq8(NU>W^vOSrgf5QK}>^Bbl+CBQwfV5{S`$BrESw_&m3fn%J&$Yp_jOjmZf>z$&df zmp|%6{SIkp1b}bqgKqLO_8e6$4Eb>5KMv=rSBES;d;xU$n3Y9h{?Y42dHyVBhN=ke z3^j4861V6MpT?Pke(*SzoHxcH+x^~DDrZC_;DX~7v^EF4Sz8Iar09!tHPWX$0%S{f zUu)67B)^r4m2>Zq1gFIu3`#E{81C*9T!ilGi{zdR-d!P;U%aK$*j!mt^TUc~(t8~p z&k#}aZ*Q}#Y|HrFvWrfN(IlDgByXz-y)~H(i?t+W9M-0+|klbAFxwQLC-Xj`hw7(zs)) z;t`i+k1@Ne@9|SF8!}-++3h>veU03w9sCL_isGVoUae>?;09dAlA4Q#{GEUcuwl8O zbbNaxT;-1zI0rJ@;}H`)l@d?w6Ucj$ItY77`l{a86^x^h^i4xI-oHL|oukUY=eXth zg6A*++qRI#pg}1tnCZs=_2^u|Ypl5rOJaYlK|I(wCrmgKe<||K-SU)kcTDR_UKsLI zRXPom*3Oo>i9`78_&VCQvC^7$?Z{sl&S^;(dytICuH##8P{AJ@BPGmO%AG%EIFBnO zaH(F(j(M9&ZcxKDd|tKP8nmrsE;FZ>Begc|AbB40ufAOm`SL~ktrsSR%z_nfXT=|I z5X(qMY$nLH&EzO-O`iMA{9N~7GHm+I{VEu2*?Mt#GHqr0@R?u@O%7Zw866fzJNF}G zAR$a)JL_3kHV2iTmr8ge^1vWAiL40Um_#SUA=Z1x%*8~w5j*nrI~%M=G~=BW<078` z#KzA{+sZ#73(kE*O^}_2$&se)4SHNcE8UTz8M+f{g(V|ac5MERSXP&QO<#{x2=j07 zAlJkDdJ_}3Ncr$^)y#@B;H7qJFnO67>R~-{QYTP*Mzxi3aCM{`wYix)IX2uNJI0Gb zA>8V$o7O1(O?IX4nx<)Cm}OrFmVfq6jGVZp>HNypH{M=$eNsRNPuP9;YeetmabgTv zrLtkThF+vq&Pr}r3|~koYe?vC|EwH!ynf|5n!483ZToO**-G=;1k$;8KI5c(s6$ZX zhzQxrYUen~dc-T_CwTN{`zPXbcmnXpjum{6&suzZ%t&!q;+GF=F`Vh}=&T zN^fuC2VoLIIHe+0)SNoj!Ax>#Bv2 zI3#6QW~mr%`fLVBuEaQj=+dftYkLeNDvM_F;;|#B`>Q`mlA~=PtJVk|4|2;|+G9I< z&y7@^dlQlkL=ZtUZhF~tAmq2uF5r^5dijq zSXJCNxX%Qe0}4&Ms?uD<^bs9e(|D#?rb5Qo91ZlmJ;5=$989}%hB>;B>72N?88Ylb z64!hxe^r^jwOdE)%u89O$1+#5`G;MS!oo(zmK(|kAC@j#dp9P5s>5+3n16r@iLo7s z+GMu#22}TD?HJS~FyUnx%v>SjS$cOJ3mOGtAbuuq1=H&jnC*2-+rbPSHt+fJ--jJJu&(coX$S&lf+ocwO`%yAT_SDjsDbgOs&0UD=m(5zk^y_<9ELj7EMUEz@p z@Xsn2AZ665ch1fJ!=8tDLl#2k9};?{ZTnk%=$YR;PJq{qx4%MM2+APbJv9L$bcHeuV6Fxwbn*ESZ3jA@Vh;7O(8 z`(qOvcr)=5*qN(!hl@Ndaa+jSw5yvi;=fO_8a2>kO_m#k`z3JPD+aSz;rIfuhq;sO zgE+*?!&H$ckTG=RqLBbEN(gzIcWym&{$jUpVu&rCP@l5Xc;2&-ZnVYnPiFqo$~L0U zGtYbOKo^*MLq(P-@YD`EDlBrftj~WN(&a3oMH0k~{!Zxzr~bLG4O5BxeG{uCJMC>K zxcegec8>-?InV9@y5b*bKpuYO<@BR=isrQDx5MS*+SC0%U&^A^5(P4_d0{rRv5A#DMjO zl$w>+X0}Mm+Lkib>REi3AOMs&Mea6@o-{y8|Wx#~q_Vb78-M)g!dt-Lf*xZBREg{lj-L`{oZ^ zWCdi4nzjQyB_(gICdg6e4nirBk`is^5 z+wQ*LcLnX~K;NTIT0ONAl~+GJZ@Uvzcc6bLyZxe48&n`9jQ98&bBf3xBC4A-{Z)CB zm2q%=*;?aMlXL#|TKq_WR7R8Ywy&=Mv-UsQ@FSURxJU4nW^LJT^TgBH%iHtxQC9=f zpkw3)lSCgaz=ibxV!qwpGFZ*w{7x}N#57%u zJ8`UQt5%CpGWErSIIP1JYOaAZ#Y`{;&GHw*} ziwQ?PbIdtd5G$#86BBbC)~>19dZdJPrs{rtnqse67W34uz~sZQYeIXqR~44sK^7fk z)8&SlKPzQ{@3PEoxH9OLnfA=(bnWm>_)QRT0hYYkJ?GvvRBe3ISqY9Xv(`^uYz0AL zSnUCAf31{ZM;t3=DroQFGkpB~XTKHp&+!)+)m_m=948b-dIH&a`yiN4_D`+%_1ywG zgBJD14^=E6^$VU7`X0f8?y^5<*c8k(N(3l+~< z`x2p8F7_6~4H*v=DueP8$Kg;E4mr$+vdl2%(WV9qB0J+oIJgT2Cpc{XIiJSbg7R}S z=2pHS7NOOb>7M&nvoXUDMK~wohU=&tidEY zJUaMKg!NTHn&{1@)nZbMoPU@?z2qS(%xw6IcjNBdkl`P$aIC}JZy>`$bD4waF%Vx2KeR`5Y4^X5lBd;o$vq&yl^TmkI;@F!akE;0YAq1nVQ=$FCV(LH}iN3 zQdGMEj&q@32<9Cly#6VBr~Hn77Q@OaOE3bD^m=v<_Dc|TFN<@>MC03K?S zP-m0hn547b=#5y0<9{5mm+l?m@}Kwn;yV|jd=hilUu?ALFz@IVtNUU5a;63$Ohdz@ z38`lzy|W&$wFF=7gT!@qvp??o;m`YY^HQK;5G_}0$7<)3`j!>P3hPhYK9eXj@hpJIQ8m19xn8 zF=8WUTixN4@N>55xWUB>IFYqdE7-K9BW5b;oxY&NLi;CtnWcUE~*9fK=1)Fimm~ z{jfjV+9248Za#1}fCVEAecK>-cNh9IA4KxSE#KaUh0F0Pbccmg^cvBxm$0*&TbnFj znE={isI-!NsDHJVf^r{6BR9Qi+&;b@2iG#`T~FO)A(k_U?(}ZonqJ&X#DDZC<`3)j z5YY@`n7oz4*h&kt1$}IZ;5dU3ILxFaoM`w1hDQoS)tXvrY&VP<-O_!mE8F%>@Jnj3 z|6DQs@J0|hu!*mAjy{@9crT%1LfG_BE%yAyWWd^cSBvFpcS71wz1dIy7&&1{Ynd=KdR zesoVc6Ygzv$LLXutd;u#`&bY~c|<_PUDVr5@_Ns%@4`N*(+BM^#o3!>hC|sj)IRE# z#7AKzFfll*%gcOjp1!s-C;v3j<{(Cf_u;7VZ3b$}0`JEj6?~*84ZaGosShZlmc<*J zQvq7&o-y@)_>%hC=Zq`RGZu;?0cunoVMwE~*| zxshzTzpaBCvyn7Ta&WnS%FfmSGD1xFdpeX^GP)9c81A@&Em~z)+1=}~uz7qtCWNM) zZCKZN@O#p)I&KXw+Yp1tRud^ee-(eGP${7^q`adS`20LseWwWMHIc=enHQp0d$J(I zG>~X5BMxaFY0LO5&n_w>HzHd zqU!q?_mQj3-fwT1@%%-!6$eE>IS}K=A<4h!8uX^;8R{du>iWe02<w#7ptqy9i!T7e$y3M{7^+Yfi+Fbx0keD8%d!ye7v}++x9hvS(7m=+(~fJ8 z4g`kf+wNp59FSoRCLsqAU)Xpv?_=VLl@IS9oAL%qNtWfZjbPAUVZrW^qGW(<{E%4y z;np2KytY;rTLy6_jjJPlCBIVmg@rvqzjLpu!`P?T#m~@RzP}iYyOaKWK>6sk<82PX zWqNV&olHNm(UER)NO;H(Kf)jKSZzwt2ZEM!ldi{n zw*&8;!OGYDHiiaV<0Q!nV5q62n$#(A<2~+l!A{Nx$hSp%eu1UPNyhj$DRjGF^ppjX z`p^6%ynhT@o=5NGb{^27NYn%qpFdSIK|#np*t2`0FkCo6h!i)CSGl zUGAvSEZ_=%vsG`|0RfOwyt!ez3ilKc8C=Lyfp9yz$**J67GEmTNus&q_n+mR0`(wt zQ<9{E@-5*Er&P_M8Np2Q46-)z(XH1Ua91iQ1!V{sfZ99dMNIcq^ zpf~lLfbsIW16LY!VIrPkJXA7tx|}c%0e4WefAX}vm?JvrGRz(lt-Y!k+3+cQHT-?O zVN6d*Xql7ppAeS#2eJTXm>b2S(vK+b9dI~444VkCFglf0x(1y<|BYp1zKLH=73OsvtM?D!!;7k0v%$iM|~LUK#v#*^IImsJQITz)9fIL#<;a8~a`M{aLPlV~p5$ z5;2|T!3w8aAH!z8rcn+h?9Bu7re;w;(xg>9TG?}~x~#^fUz{cAkT_U*ru_a>4bRN= zE%|cpd4p*sePfj=zIV{)x|T@Z(P0-a0pCBiwCgHyR+o+2{q$Ei!uwWNOF{W{vYx$X zJ}5}0s?nD9WRe#dKpPF#6TfPZG%VF<2Ej{?c#zEF(%oduL*R45zMOtP{ApvZ?cZGr z<7&DrfM@trk$txsKjvO}CG-Dhe!D6teo#ISmilxlUeR;7_~O|+t{uk{p^lZ7f_YyPbH9X!nD?`ZfJ>#aDJ zB*EX-4FTmjvI80F)B;U}o|R%7>qfa)ZUfM;E4A&FOHO;`)8V3El8KV^aenaN?c;yJ z&skwsbNx$$jpjg^ni$TW4z^DX(kK4%_sA6vN5yzfjTEZ~sMD;E??3FG4(*g%Oe6Y* zPMPxPcOD}W>sH6-*I@5pA?LY1B;V#M$-TR_?*!1ycT0XR$taB{hnC}aML6VC!KD7) z!tWs6=eB>RRM&TBriFpeD=N1g=G7xY0C-pc58~3U-gqO4$xtX%*ZcpU6!)lp^CP%! zP2HQ?jMr-15s{HGJoASo@qH%~g;Kg-PNjll&W=4&(9Z#@Xs@=P9?=Vd(_(zu#oI(7 z=3noZ>HE(XCk%2%Mca#IYcn+L3aqc*u6vdBH}17|A37d|D*UQRzL-GK?wR}e;8Eu< z5K*AxtwpUExapp9jIag#b@NO2a;bNzd*%bY=m%gxf(3;o-;%0gNxr#PQtWMLdZ#$3 zL}~`ex0P7|C>+PxT}`9u)w*N$VZdnp|M=BZKKb%Uo}CzbNT-ryZ^glHXNQ~ty(x0) zRP*#VO^|;}Y;2HpI#_M5F1dKj;l07>Y+x+ECB<6Hv|pTRZNw?}K-dmOKR*e)ul&Zc zA`%lAtJf{RZB^RCw;U_TMdwV8zJsgi%2(HY_AFAv0|jSh{mHG zw4W3f?tWL~HA%eOyN?6H<uG--8pwGz8ypII7Zk2ujm0C1Ig`!FB( zY_28?Bt%3_1p#T2h5oD_D>-(Bha{^fYagR{>*4$&X!G9RczS=jwCcK#+@#*`^CS3W zW#dX+w5>}?t|#KvXLJxvH{HylL>x6>xQ&&>DQ*4RhI2>q{IBBD?h~-`n z$7mOe@bR6`kT!ZCq~$fCVOp>hjD8sjW`{NaTX4^>0iD{+6hhIVEmq1NlHKW)kTK|D zTsc-^ig39G)M~N;QtLp53VyMEc7+dLn)of=O8hxsK*7y1<@-9ofFqd^=_gfXN#U4Z z%g+w2mF$#i+p+pA#i3W+H(x=3inZ=9=%+cJy(SfY{Yir)2R|n0&MkuM3J*aR1Y2-$ z6L!mB*yp2YXN^vcu3VI&rPe(DOEtb5mJURYk2^IF-|_l50ztr5o!;Pu8Aei;+RK~U zpnxZW+gKwpy0qkmj&}mL6?cX2yp+-?DCk+Wnv+!w%mUL3*K@dOQF4!ya{a<{1+09R z^u)+_)noX;h+*F)$|g+2woOlC7;)`@)gM6U&#-vaKu$PJ8zya(;{G#wJWa+imiqim zMbZri#cqfAOL^yb0We{FsZ%$W%Oc_kV=-JNnm0ny+gZF08o&JAC1DRFTYoC?S1L^O z73iixW8VynPW5$$aB8kSI3c}So@R6$Pq_573X&o%zZi$fhhcQ{X_a`emn2Q%Uz z@k}W#hEhCbu!=892o_Htx6NZOil%&iukwN-=V8sK1rowaJjMvh!0B}E9?*X9od;r- zWTRrYxT|$q`Cx4sGg?qc{oEeM^!$HOCcw2IcDi-7@Mq>vUDw4cSRk^rIsPhO`jd4X zrK+*9@tDJZtuDNddx1fVa5uEPb$c8Iq#;_8iQ^krU}Uv6S-oS0o}yK0mhF(mkqw(N zdz}~;qv8tP#5d&Pbhh7T0T{O0YD~k+xCgpS3tU$9X zyM|dCcfQ0GDV!Us(hssGuEon1D5Kb^D4$wDk&K2oAbHu~^UwGs@f3H-e{auxqfSBL z{7gnB4`D@}x;kko(B&4Pg1XP5JVg|!|DmDAb>0kSmE;v$cHAeUtE!x*of?CbjWmh| zb6k&GtR1>#%XP@W9u#t0+$feR;bvpb1&(M|qANiRYpuaM!x@c}Cf|JynXA+##Kkg1 z-~CZ1{<+P`hhq9asAXL#H}F$z-IE=<@k{)YnZ+wZ;TCQ8>o6urZpr8QP$>jFdA@?+ z)Gw?_;3>CZ?Mf4`p4_>5E73k>dRK-dql(vkz}zlWl(%iHr}Q})6yHgs{J!hPuRCPw z*;qgDN92CH@8OixnQWoM4~H5>6lsE8!My!`((P;t7^eD17gH~Yfiiiv)s%0AgCGdk zT=tf|$eRu2Ct2!7V1h@p2Xr~%i1}&71^;_*?S6vDmriJNb{w^Q%Hqs;_605tjU^{BDM|NZ~#csW`ABtIgoZK5x}6*8wpQ9y*+N2zj~qBD*;mRSt2 z0rhQk%$=I%Hmgh6pp2;0^fh`W4tx^RI945$OK;C=638o&EWDSN5lkom3m0~YxR6sZP|C54OH zzZu#;AAoZ+E;C5*2(qe(?q~!Yv6APuT0%kc@&4cXC1lvj#@uaF>kVw_P+rOS?N48m zdT3V>W8g!=By5{dd?1Xp)M*dK^-&opI7-{s&hDM2G%8^5639@TLqPh&o*rZwlgYG9 zhLVCee&u_76Vidt%eqN+q}8jw>M%O`G3RS?`tMue_w#p9j6)Mv!DKKZK(5A3 z&1CHSv0hRc`=s!I#FGdHmL-l*i?>JUX}p99Vm$=q^m?PGLTZ2~CgysZ!_+2m&3}gxS4&E!Ba?cXWsJ>UF@0w6*GoIp}elB$-qF>KDN*u9^YfjDPCR8yj zF`ktww;w1FM#gz}L$@??p>gjXT(uGL=NV~W0Nx6Gj};4~qmX8TXMpI~BOLRon$kLr zGwftQKD>^=)ykY2JGy*ZmZ-peH+DJI=wpM>QZ_fsAh zxbrH(u_bAfq%aPrfre!u2j|*~d0u>3F-H`yP`?&m27a-;y}% z=G18W9^DC}N>@uQ&rTa~jjhHmEz3~>2rKGX#ai9-E(AQCHJ`oOm&rHv3KIn1thU7#F~0MJSMZEt!=x8=m6ZQGqy+Z_~Ob`SiU zsrpK}eK}%{{-_!xfwu5AF0lEE)U15dZ#kV}b(}-WHgqlDLuW84l$Kh$Lf*g2S8^y= zt0Ba#(*S(Dm4IKwcs2BG9J_vUo!&yb=f(MFLXK)l_`T%QZfFQbE2@{{GQbEbz@B@O zg0MI6GUg#<2)3))f&n>gY{>n>Da4%&5PsG{10Fh>OXAAwi^%fPFWLwNlid}KcdQ$v zarEk&j9$XRmF5c$;K+PovJURbB9GE81&xNJL0q!nY4cR=fZunYPq=d4jllGOX1MS0 z)>AW4y#^=sk~@t;#6Kxc!t}Xs*A1gbeUFVG5C|C`O(Rcgnwf?pE)V(2!{@1iZe3P_ zxRK5BM}yVOu3dwlv(yBT$$PWb+{QYCx95oI7TjuYPLt{f2cEd;-{|ioz6idouXcLLV)$l z5smR_g!R{rUk?QND6bG5F3$Smb(Pm1aOR#|8ruGHK;*rAo%FFwH65O$Be`jFt3Pv+ ztDTZNZCa%Xaeu-m1#4otMhOOM7N#~*4<#`-l#*r5?LDT#2j))N3DB7v*bC+gCtUXk z)bBsu?(^uOM|w}5p=R1X!Vlf&{_S&e(^ZV`ASszvmU*+tv>V*4Mg25-$GKrOS1|8f zbJuUk1CN*e+~vzVTA*tt9QdOzT6uqAo7`N+apvkBLe#9!WEj3AR(V+NCfcfhuxB}B zZyORiV2#ul1I_i@zb4y_?G7{rU1c`SZzeTIAml4GtC7WVwt@|@LJ)vMHo z;h=K-dEyTGh>Cv7H_K`T<)5D9e8Y^kPcL>pxHHb#=*2P4AT7l?j2^jHe4t2ns;fEJ z3mIE>nE=5w4e2Tll>FE=Nqfj*mpCRN!BUtAj2s$@XNmrgR*Mx*{&|yIN1W{un%hV1 zR?_^PRK^$#e*_#GgZqZ&(dbj(=`l(7Ghl6cC0UjgE?hGDhfPyw&YzvA5A&_ zGY=fvCUJ~cYocLZ<jOsgUnp)8J>q!{69nWgdTOdWB{n0 zJiV1-?Ha``twC~VIbI~-$G>%L>t4Ym0jY8XSG3em`Z@TQ-o9wU)o4s*GJ?h9}_|6enEm>S6q>pzjjFi!=pb(O{`uudT zd}$Mqg|)<`G)QGG*QVgf=m~`F+LHh9{b8KZDpo<0wYCr~V=N-%#S@RRUVl)%PNP?@ zpeYpYX28S3=Z}VfPgv zHRss>0fM`_k*ejiImDFn_vn~pq6m#Onoyj5Z;{;kzcD?)bHNODGG93{OAgq&)4iWMDEX>|HrMW);fIr((xbh$km;rFo$%74tPs*O*BKWevjN<%!_Q#L6(Nv0< zk$0!NLK-D#NAq7s(9Hr}NRo5+XPk5&Q2BE^xmDzMR#|r!lVqk~t-EQnyVPy4@aEloBgA&i0Mw)>LG=h;lh;*<7he-`Y>cC~uA0_d zPO2QNA?m=fv+dcZ4$(Dsn$ix&2E_Y8?JGl!w2L+Ljz5Se1 ziXj7>TOI;IZQ3h-x-`{*`NBB-Q6nCrL zv{Aks0-8|l*S48WB6-KPEwwEIOa#QT=8@48?BSLaG8d-6n1&zrW|6P68r2W6m+(Y)Ea7ng>_I{qe^}JU>OE zh`-|3LK-W&8ZrJ_zjUgOO`>mSHl1zAR*=0srqT}$o!ROs)C!fZC+cbW$5z%XJj=$Y zXhaqVggK8k%q`Wqhb=>QY(j?D{q={oTg^{~2sPp!euGTFrxpGhM~+RM|1VY0Q7FkH znCm$W3VRdT%m3qboS@i#K2n5mojZ8*i55YE5w2Q4#0J4o9ZS6F2+bJmh|)Lg`@yzb@v z>fqMS9?Vh0;)&|RYf%${5mj1|iU#k6FEM8h@2w^(f9s4tfc4^SSgu;gdwqNR1N(Ql z|MmasC$>U>hJs4mXv@YlIM*S1tVy>%TqUbt7wd=_mm~AIh{*1Z&g7XFis{mSXb35{TbqF zGtPa;h_(fRjh-i5@sk!l{W`pX9*kFdA5j~RJ52XcQtMG5T|y~)42WOS*Ye8DM8HUo z@v#%3!*3moFlg>HB7?d-6cSXl+Jkt&5u-p`*F9c1#$f(|F3!+}XA7VF8y+@OT_ODx zX6I#<*;ZcL;9DCsY`*4dfp;6fb2u-89I^;S4NM6ys3cR^F7% z^c&7-SxKmu6x_j}j@}Or)ETKou-J_Mw|r?EX#q1!3HFaS>%cglN1pj|3spm1ecWfxntV39P68 z@;0qE&fy-#Y(&c*`@!;o1n+nTcr`+l7QZw>Fo{~ySxoZt|Ndf;9Ak0?J;GnEPL%u@SJHfs<(E0Cw~2EIRouQ`9;k(V2et{5uYeNX zmjp)*-jmNalYdH1WxvG2^^H;LM9X}rma1;} zZUze&CAEPZ5w4SVuU>iLJ?_(VWz=pDp^}kG0m{bkOo1a08*?M%-q1Qg-U~?^d&eeR zmuGsavQ@ooqLOCB4^f8>m{Sd$SQ{Is)?shb4GpS+ck*_RADBl?-=8uTD@i^IqU7xg zl}7)4w_daV-wXpErIgN6t&s&;WFU)*$vCQcl?8IuI`!n#kFg@2a|h#I3mnU_Tt{t} zOcHG><-?_i@MICMF!8a?o$aue7J=dLd%T;Za8@8?pve`XJ!7<5%Z&6#GKpX9g%FQr zhoSSEnZrj+J&qMYV}uVsrhKrsV62Qt9bDHKWAM(8&E1vpASC)q!3r;66xH8rP# z5WYm$(brNkAWz@Bp}3a|BB>|c%AT>C{x_k2cc~t{^>a#~P>xKH&{!E8q?w=UlxE(R z(P6Zi&;yI5dJsG`W?nofEZB-M~p_^%^ik$VfC|l7iDF;(>?n`ST`t0ac6u!12e)(i=##-uoi>F* zk!t1&Y1KgUu$rC6BReVG^5xhJ*9Z{=MLplyYTCg>kFSdeTsrs@tfqMS{3_h$;WlsR zByY2En0n3Ep6J-qC`a7QX^>-U>=K;ChvIBX)|>mPjM(bR6^U zg)XRPdO3^PmI%syEAA6m+sFL`%1&bg-Pd=|estwY=-y>4K1W2yMavFR#WJFF6B|C* z+&PXvj6vAzxSfw{k_C=sEPDVyL8a5)xmhUNfv%$qF*SjqS%?4?NIRv@^$r3DWrp9c zpE|L-WvYHbfY>~_;WGd0|3H`^jyZ4hY<}i(&zkAvId%N3yBW?Gn0k#lo0y0u)lVlh za96Y?NE^Gzh{uuL6qVG2QJ(8&r58~N&lLyu^Br(-u(IlI$1S^NFng{>j9ty1H`{bT z(QzM88D5PwZr8#lw5Wm7k=vW<<}9k{e7!X>HnI#INCYvug3FC#_jmB#+s4~JjVacA z&zPNxAqyH>?REW_og-UW&(&TpAUc{3H?8P5VViL9uWdVynIO=0ki5ZYS(1kD)U-GB z?_(He`XxD5wxr~YY+IopFaBqqE3x0!m*r2ff=UqNhHN*QFAZJ_C(*abxHc+b{sV;k zesmTyw$-3mIpXE%OS`-{?c69~(x4(JV$A%z^Akv>ges=hB?d*j;wrTnfx zw28B{8E*2zjUCUDt+ShvOgXGV8epK!Za~uHFLw&^SAxy z*Ffa-MN(sah7=}h7OWRYAqRnk*|=Hcvj7CWfoZ`&A0Dsp%Lv3;VV;l^c=iz%i+`*O z{jeDY>annmfqPCDnbrWq5K?a9&(`X0Uy^BBlJRKY1M07`R#!jo<*bO!Ze=?d6g!M2 z)}*L>f0C~iuJyp~9|uRp{}c``Jl_`^N$+FjbDlgEyclC!Jn`@K=XBt56(UMw`f)4< zK!dKgwOnc&poMJVV;6DT6kK7p^ssN^Vw_jSrbZ1piyrK}>PvS1?7QTDZ0dn>f2)e0 z<|-~59Ym29^0yCQe%?9K)G)^>^De}@*JslEN9J(D*YYB;wWza#S6lNdto-L6b9ZEq z+NJ%9!V=&b165k#F5y3AJhv>?fCT-N4Wk)9nMK~pG0#leqMEKmeP3}*TjAXKu1zWE z`l|b1UOZHsby23tp^Ek$DsrMa%zcjrX(fmODq${}cWySKk8eDY&LF3D2c6pIH4 z*r28a=suIf3b{{Pd+YS+jI@p7uk`sPrs^D8NpkiZzJiSl%QS1dNL?b^*=h-|P;vGN z$Kv{^qHkG#+K z^|8~)X*JdmrbMAcH96)4p9~Rt_+LRyRzvI?pU34fxTb3&T6FBz`qT@3g@y_XZ&B>K zsZ8Hq#p{uso;@f^1q-#_7TJ=vv$<2C%?KPI8;q!IKX~R%NgFoRYH)IlzicEBZnw{R zA2SB0DOUf>Pr-vAGKGq!-hQ1=ZP5G7ly%>jN@qU55%*6B`2dkG?^RJsmVL9b!$X` zI6CR_5Au&G^}~mxlK!vCDJb1g=1V;5eY;3ewUA;xQ1L7_{j_mym&9WO-d1{$nqA0T z_-o19JZ|P>o2l4p7!SVWC`V>xqtye2JFx?z+rL)vAo~x=A2vk#IJo?G34biofG>;w zj(?A`juShRcB8Fi0V)m6g&JKgxn1QIpk-hY^1)?HIjv;F3V6)%6gF-T(+rLyM|jLt z5TCct8ii-v9ywhk^aYxI>o?1g<}Oj?Adqe7U9cF=cF*srUOluzUum?{O85Vx>b!%R z-1e`3>>WXrB2uJ^Gyw@66cI(5$dMvd2)!ARP(rbwfCP{togj!HozPoAA@mZF8mbU9 z3JIYmKq&8ydVlx6|C|};%;+S~&VKg(uC+ePtiPl-Pw=~8symb|i+Ikk<|&Gm@wGMK}X zeWgb7y!3PEb*GfG-Ua9i^;8!GN7eL<@%>fDIq1uZiD}u9dlG>?B=$}G+Ah=Ba!t@W?X&}^U?V1zc+DN$++_AKg0&Tfg z!ZDNQCC$pR^UV+H-e%#9dl?WjUqS!QU&K)~*52t67B_iku0-!u3!q52Wyl0}3+l2# zD}gY1yJ~ruS1xTwIOFpinauP?r3kVLND#cDT;+tNy(bf_<3~Q z!1}+0{7C`5(cTh2EePn3ul+~ekU5>DaeM}s7lGeYRml+d$HH+|#0&h&vx?7^9;w4g zPrvo~qK#=MH|r*Y>S0gnjD47wR>|`dBTe+3i@XN8M4t!$@L^{TXKm%5*p&|W6<(4$ z+DD8qXy~BcIv+N-jwI{z@$WtE)e4ju$xX2!WxR&dTcC~VfBZApm}B7(!Di<7I+bIJ zmO1CiYy&r-8PayIJ~YOe-iSTLk2pK77eb*>Ze@F(34NTIs>y8|1_%yM(15cdT$~KJ z%eGHNcR8{;q6j(ZI?wAxj=kh)IVqZoDU0@rQ602UFZbHql=jA}9u|G}N64!$B|Wm% zOBN2gQ0LviO_b*=qbpih`hi>W#YXnR#V4j@&YRSEFBPqyl8?oN%iiICO6iyC`9`yT ztE$qs0BTWjWOsQ6Aw((ra{{m>B5vU=LXW~-9 z$KqRb&B%Ul3hrE35f?HrevR&bWnEJ51dk~AL$-GMAoLz%>3|q@^_h#iJzfM#2U7UJ zGRGDZImuI}h%ELOfuRMz3}RclPDOhlnmo!pt2sU zafyyoAe^k9F5lujFs(j)L|tspLmjj#>njXQ+zi-KV6c@DB{!M^ZjD$6V~&wjGIn{ST934%{sW-&4XUQ5$AR*xYQSY6I503WSdyx!hjz2x3_5}1MuoydaQ6x7 za3WeDuS2|IxDOvW5+PV&5|u7^{DVSH1WBtbN=h4In=$pd`_Y5c__TjtVVE){C|tj{ zHq8-3>ll3h*rkf&WQbjlD_FF)0sT397H-uLn2c)%%NV=FgMY8!TN}fBsF&*4D;wR^ zfpOITaAVO~J)-~DS{~sU*vcfA$oI%!1G%&-iqRlK)BGHzAWDgh+h{w)Zt-Xe)Fo4I z&HQuypPLij{cvl(lzXSQGj@MvG-vML$FVOh<3Pl@kCb%tXrQR z2%Xcv@{oCZJkma&lB~;nWNgouMxoH+r`2O%+&{grgP)&=&Q<-{HNb}n!+uD#+R9X> zG^`e1nb*f7VRbP;b0>$lBLI=pPG*EAcpanLUX>foAs{{Odjr& zF&*ULwO2$jPlTjdL$-mNZ0k+em>SLr#~L%={$9S-*ZIsudlA>4XH*wqrQRVNqObaX z(!lss?3cyLv51Pga+eeztw;gQDZtzb1y+QD;Ikr?!>^8coEcxx!05f^90xmg1H8e~ zaew5yk><>io3=>WE4o1Nf%q) zB3(2G7T)ap%2?_J;YuI|CX!OSpugtK-U-RQolpt_=Io)l_;Uq)z`*a`Gw7ya%7_?I{H1R5YkK34xFrL|nLjU*P{dY)$#=kyMV<@+7|D z<%j=Xle)B%lqM?SaVwH~FkE&RwPEFE?(g>7weu@A8?;J?#!uM2d3QxY!D%NNiTu|i z#qfzdQCIV~=|;aTF!^m)1?)r8$H=@JW?d=|oprYj*Z(h8hC4&Kn=z^O%B?cTK-l$p zy&khHdQ!~}U18TAl_0(jmPwVa+xtORGLVZJx=R-^w)9-loWRBx=&W- zW@g6*!WMKduQFxTcz~XGoEzbkctTc~xzq0l~@HQTLi1I10S{q-EtkeKxCHj*_#!75ha`6$oJClTxJlXd4pdsO;v z2f{7nHZ59(K*b&lC_$V`SCmMdlpXub8gcKdVRE}VCfgxjVA{~ehsBEj&rH>)f9ZvV z1-Ku8hKdN1E}!$K*S&(J<9@;@0Fh6TbHGtM1ft{3gyrH)l*8ii&pX8de+v>s`gT6@ zOub0qH{eh*!4{QONAE|#0JkQk=xlfVj(-M|8Y=Rp zGP<{=mD~tMMR2v0e+*>wkf&mYta?)9y2si!rg@Yvbzd&l7LNnhwcaoDeP*ry0K4kj zyJrcpnIN2g(}o5YJb?CVLbY0XCi3RiAu>Ky-N? z(b4F?KF^j)Rq&JeI#+4GqMc3^tYQa}=tr5cayT4RFr~eUmWIX+U#gOyh1TC@C22jt z&u1Wv+;dS1hLmuA1fy+%gpjKF_I%Z&o?N94&}J}Z8~dG4pRWD=K)^L>C5c)4dYVzd z;?v#|QzQ5OThukR*jQ+aG(<6$+ACNn|9;epy1q` zGI{tA`p%gb%^!bSee3x(qM>(}hQ6mI+onEwISBc55jNN(GlkRnJ7AI-d(ckLdn5eD zUHBQK-yR@_0gx5=zN1gWI&R8e>8)so0{uoS_siy5MKzUt3oB-@a zSgd6_)Y~=f>9{mMqAapxDrU>Tv|XJ}DlhZ+pFGVh^9^Kib@d1qX6rrZXz=E0ocv8_ z^@b&K&rdx1UaU|hz7~`VJqERQekc2*SbhK^CcYhPXr*OdpgX)m0{NPJk-WN+X#d)C z3=_71Rlx(B&b?OMf+y4`1{{%zQA{eW+zb2b&jkNo_yA#Mu&5N)w|Tj*pY{Fft!`VI zD?lL|Vc@KzMn%-;h16R-e%bR^N)Z1dqVNj#IOw7LA*WCULx=tD-eZJ=b)#szTi#w> z_k7&mirFfYe@W>NrwSUaQMR>UI(y*pQ?Fp3*{W{PkDBa62R4Q!e_bOI*P{OCenl z$()?eYbQMJO_6JCF29W@4UYhH^5xIzZgAmJn6+T$q;LvM!>!#Ed@N7krzNEW$JNmN z*U#%Cqj5{1rFbk*H-B|mD`s-O_?F?+ynL;@3Z6tlM`XykCXiqJZk2iSxoOqeaLB6} z7ep;zip$s*Yyg*R=&ry zZ371FXjRJ;g$NS{;=dOpzEb&ksju-uu+JPO6*bn9RjfY9te^qHn{5NOf(kl1ib(l9 zXmX!T_H8d#ZR&!m(WeR{H+0>wB*K#Oul@N(3Gbk=Ut?FSWo@-~f7x+aayPJ~>N&BC zn?5zQD%wKE4JO>rVzNb)Im>{Wh)R2Yq`Qjw8Qg)Y<)d1qw-*>9Cnb1~o*|3o&fMu!rWA(2qZn5W zTSU4+;JgtW&}RO#4ivzBmy_Ju(Q!1l!^I~vT`(nq>YVum6gL(N!*nMk^9IzeUY*ms z<5IzT0|{%jI9g56dT+RhFAsI2%IuOKSc-UreTs4qIE&YbeR=8SFMj1En#UP@!G_54 zm!4(WTz9{|zrbM|M%r7tELYJham2PirnR-hrV5}aq^egbFVnbeN~0ks>`qZmXrcR3)L%Z!_? zpBI^f#DFt}wD%k7s5gtYkW$mvHXUA~Wd;e|lJz~Z9RGPaUJ$f(>zhRyJ`yp<+%_X$ zY+Dh3cK9qR%X0;VbncpomqQ%t-T6$d0oFW((%xx zg6o@%cC)Gq&I=a`QRTqjS&noB^f8sxN%h8A+zH_pU1LyO zU|zNw=iN}bexCegVBo!W5s1B9WMJ4OxF+PQ9ex)8S?yV<%bPJ(oE9f|>1=N7Ne%PT z1EpiCSjjqn*LvMst@qcF#m@*(Cp|10Nd@m?f`ih=*5&P4_IeoGO2} zE!YkmyDN*}NNgK$&r=*!Xs1(?~|H*R?QqL$@nq`K8 zYVAD9qgmxG8N`b; zj%Eemrse&_w%qjOO?<{G_&vdK;jkd{eY`JjR@e+E* zCyc{vxhXU-&eH|3wzfM13Y^7TIt7NwA@WHItnt^Nj>tk=d%1$>bd33(o1iIU1Jr^* ztH%9Y)F0}6I1lzZ=}NvU0*n%ygU;B;n(&RKP<6LvFuWVb?QP>ikMQ_@+W+w=5wtMy zHY?)xk>)=iD1vhM@{SJI*I=5qLDT*F@bAb~K%zemO-T zOM5ATm6eT|)Ui!@(>Lw)#<7yHZ6?f%;2lXi0?n!eS$?nqg)KJEXE?GpWKsQ2S{>*V ziF1D3`C6ZqIpEBBk?gA2xK8IFxH1g%LhhA zOu&UY5oTR<)Lvdi#iH_|ZPcfzQ7{NdPKrza7|z%lB#zF8wKsb2znD&fUlSK`(lCx0 zZxpB#&=klYpw5KyR#lN$>M@@C-&!2O!WRjWnvi*C$u(I=Whr}tNQe>J&vn+xRTsd`E+y^SXxT+syP@}p z9a~Cv4+tME`SUFwB$aATvrCq}a1^$oqX_$z@M;J7Sc;FmvSHnuqBV{zUhkk1ze6Yo zAJ#51iO^4+=-B;lVT}77OYxG7+&~XI>(B+pY2>H=#MA}(s_;=PJ*!b4{&NimfOb9s z`a!&bk+g~B;_3y@GRnPRV-6xlUv+)(5fEN0)963so1Dq`dW^Eyb=%`p2KBpbSw~dd%YX zsx~M`+x4V8lWUbn%SA(fiQEg<6-z(HbK2WrW4rN-i-0x0vm5do8keQ)yz$KOh2sc_ zx%;JOzKPPwFwHrCb4V3hd4Ns7aR2%i$@#+*X$1w-j1Xg+?{k9JCxtuIj(tDfRQLT1 z!nm?+wO7#MtYLihD(ta`*h58!`)+A9vVKyr5&*;=MofxNw&90VEi_s_?i7N9k`2D2 zW(3K`j3-~Uh0E+N;=HeY^hxzuRDHvj*YfDOhrq zP3F@o6)Dh!ie6~iqwRTQ1YVF-iksAjt4&rT=W7US64isc+`7V#}*Pi4MY4M#)lIDUK1HLbI&x{^+;TKD*s zq2Av9r7w1}b-Cf-KCfYmE4U^vs-O8(I%TqC6PLeBN0(5-X&sd14E5>AYC_;V+pb@R z#)V6QgUlH^yagN3%kjyUL3l|U>6;2WUz2$!~VI4SFF_>0R0d%Ue(>|2p66I;H;IAvrZK)7tP ztLuxycl%c*Je8+KQz!etp{Zk@9iJVK*?ZQB>U8z=^sMZPJLX|5kf)@6<;t6qYZ9fw zwr;T5iT>B31rofoA!*=riElMGMu5)T4j0Et@i>3*m*XVpceSF8XUzYYo zYDq;c4ueCVSb|m$+!Faxw?diq+@pFH`20wsv;^~P&i>PQV;*Y_3>HJUr*@4xW71I* zV<_08DPmYdQ*;C+g80Qi#1%1>m?4jw;|xe#zqv2|(vr{Tv2;pr1~AkR?b1)~s!sY6 zA|;4>6kz6pNN&;lql3=wemlMU?!mzrDUNUSG?MH~j_9-R#kLjN$oUFF;j-any;HU^ z(uYSGS6}VCPM~GoM}IzRP&gaPCGUY%9hePWZW4;P`NLj9(W)L^G#R|oDMD|&BiQ`w zq@w{9dwmiw`y?v$hZ*TZ!~zcjI0=4VU}<;3{5sFTW`TIB3?G#;UmS8{*eitC0H&=;5P35Adrt|GscXxiRy@9^W{7^O6IO z=+FK5NX)Qo!1h>B~a|?n#?yPrbX*n_PJ@)g%eIfNraq~6 zhmrOmd+i4Hi|_~R&|WqQ6K1b+#!Lhs-YtK4Qv9;BN%OU^0~e2zpr1{Jk>>5IipR*t z=VO!Xt4hz0`?}7-RAV3C`*na$k{e@XGqC{Zm6>ogkgP|03GO$XlJWSk=My0-!ms>6 z6!W6uV;$e&I!4ga96Bi}iz!qe=l-#J@FL?JbF`m(ZAHD-+fXmy2Xv{9bg|rZ_QI?` z=mQW_d4{Aah!%+_JneKjTYth@`uyJQ^4$$PiQR`zVt3H6l`RrdXvh&1U(Jf$k0@j_ zll?j{J&ij!ZXDK^rdZA*0Dql1HjP?*_X7nb98NuGS?0|iuRgbVRFVlA=(1C`>caDzZ

    o^t?+E_1EbCrzDqi&NIx60?e zr&tmf2!wLS2!WN@T7BgZ$3+~yM`9#%z~|{B-Hf#tHKg@!MT+gJFFzuX^zFnd%Tya{ z7N;2JlK1w7X@L`mnH!xKvQ$qTV@_M8gt@`R@qV6*1g~62FVwUEWO0V}y<~5zgsg}) zS;^qVg~HXNK@IZPJKM<4Mv?K!m%BT8C#0|n@c>u@O^SKb%DtH$ZHoY)1Wp0$Wx}-S z&22>Y!Oi$bcJ0`Iw0oB63U5c8PMf)XVGV512NEf&R{pG^TeX4!G0d}Z`@56~)fuL1 zA<~A(kQSk~J-DCxM~Xfnor!tj9iyjjgaKtq7QVS^^&=u0Vc(*!Lr4VY1mmYNik0JE zLn=)hd|}CY(Bx5m)Oh~AzFTO_6Et^OC#;jV6SylrM8(<9mOp=+qN`iV($6rBG#Bjv zpc5MD$+u+3jr);68*Oh7_XQ6XwsDueL*&FPTts^N?pkdVE@NJrF_oCD{apTZVR$0_ z(e=?~x1TSrW2nmbPRZF}n6#V(^7Q7$wwDKe5kI|&Ioi(3VsEK=%gqNpg%emg6U>2w z1gV7a4o)lY^=vS-3TfK1*D@N>raC(YdIa`y@v<#?cu^jqd=9hY#&>v@wzm;8MDq6| zKVKlX;AVu0@{*eze$(r;Dc)_zmiiU$CuLZ6+h9K7L<&wmFuWHB5A(G)mhiN|Cx>?xw65cd&k*m%!5`N?&H%OLP z(Cpf3OORCkD@+Fi_M-3zEj3?>4HY`dt^~J8_(sGk^Edk?C{u{;+eFgzedTA<(}$|F zw;lT^5sqK#(*t(X2d3J)eA4$M{UUu1`nP@OtewbcB0hUMq}G(U7F^2qEQ~19`{QGy zo{H3>xT0`2hv2dbBkzpXu6_)BFap1F1eaf}F4HD8;nA#pK-%jmw{2iKqQ`Wi4F7&q z|Eodr1f&JvrSQjhxn84n4bIENq^~4NF9PzofDk7OtDO0lH}>B``-BwS-Tng`*Z1Ff z=fG?2NsRlP09qeV;&bL6OKx!X@d3dhkR^9x8NUJ9w~mAxr@g|&4J7Q7eilV=D}8(} zYjlc_>xzDzo^Etjzzf=KF`K+)%_3?;2Ap&IKSM`s(2GkES2njsnx?P@2MrGX)Yp*S zFDqB~xz*CG?(|_N4V^^EBGM$051)M)O}=M|#QB`js?HZTsTC z1gM8~tOsrAa2^F^!qpvR`)s;!=U-1hQK&#J1xg>hPd+Z)G{Rj)4gn~w~T1{DD& ze!QE3N54-+q5CPP@y=SH996Wp{H|CiG=fXEjQE>1kU zBz;`^{+oV%{*&LUo1LEP-j0fYdpG@p7z2fdHEzt7Xbu49w7{6-d%fsStruZOLVLs) zO~@=jQ}xqA8jJ;jrb!`NgullCAt_H>7-mpNFxOl^CuaQQ%*g606+bC=F7!`YOYL<} z)SAykWhN~jEHy>2=cgeb=q zz%;1~TMKHnKuCHF1Q3{q-6L$3M>-rRpOsMl`mpI#@i|1Z6I-xBS`Uqp#U)O|$K8X^ zf*ptN6ED5S>-UT-jK~|7eH4{W8elo7Ns0jwH@CL0vr|4I&KmDt5>(|xcaJ67-LVn_jYXN)U5Sg__vb|$g<%SPkjKa34 z!rn6>WVz+-wml4xM3^q*&5)BwtuPSa2ASx-wsCr~kKm-yeoZGvESS?SY_#2+U*G>< z?+Z74ivYx>ez;uXz0wrU59JC}GqD`v*SZXfJ{3|!M@Ej5N zm0ctz^53{gk%%e-4TM}O^n*wSNU}z>JA_wlU*7|QV@2T^y>>!nlT>Avs@ z^QJ))+pG(xC5$lrPMSrSa3_y-d>~1;4x>f~g)_4HU4BikMtp6(#od7jmC2a-{5}j^ zWI7zjqI~)-Ge+HZ^O^WRzQu>&j{KA>=j_sd`c#&{>2*`ig-7a4-%sv9%j3AEVk~v# zc;eoxDN8Fwf$ZMRGeZ&r6Rx=j_?3s3u}q>;oWbg<`oQTU5}u2d_5wk?A+Nmtseu93 z35Z&oXaQm~P3YwP$}z7*eS@nHK=t~s*?RMk96L{?HjOF$9FG4hv`@ASz_-cpxMd}2 zQnxK)7-Vh$R)(?%;MOk{ChFd0nZOuxWZ%!q1R9la*(hY$4@@J&rs0y|q@kxtm&%pi z!eaY*MEZsJmE#rzuK&{xn7<*Ih<&67X@!YygAVO3cm9|5)%N_;F15O8vTzY*36@nq zf7xpC4glsA2=bkA0l9461sV`A4sBN9XY#~_*6|TFEC%BDw3Go8=?6+M-+Y3#x(_~R zn>~z5a(P`aOvrs(Q>^=UY-C4~>2@m{ahNqJnkyW7B;_)^Jah<@7p)rxM#TYtd9@cn zmbziJONwOd0m|}gNKKv8adOqfxlHa<-zaocw6aTueAd&&{q^`3J1$lO%>zi6f&NLUSv<5&E)Sm!t))){GA9=RbOrkiNT!qJd=gU}MOtid;u-~2_ zEiAa!xd+@n1`#AMw}W;Vb6Ice*xp6l>*ZGAWi2ecNk0&N$2_NpDqT5&FOBrc?fdco zfw`&cX~%8tIpBZ&`Jdax2tcN<7d}$grFSh}$|FfoZ%I}WiRdVwG91YKJ)MbBIP z^Usj%lu3l{yt1e!A_~#$J!0uNOV+$L5x7U6=4AxXubi_8-dUev@DJ9L)t?7{Hwh9- z^O^FSxt2LSy%9Nmls1L%Gzlj&j`=MT)e~oU0@wOM2=w<)CG`Bko*S)<(J&ttYO}9n z#&$=lF3w>-evVd!j0EQ9?(JPCb7nbK@l3Q z^Db!JXSAZvX@~qEvL0e+qE{Ye(5VjCF9oP{A@T(aewJ`X?W8YB^f<2mdaj z_h-gd&tFeY54c?*6XE9VFn;V}!m?HBrIz`8yNelW@)HmqM9$T`%B|a#i2P&AjGnM; znOlW--Luc-KctfIkW7cN9vdK+x$9}tl*qr*Upu1wa`JH~VT!5ITO)h!;MHFFRA$wF z5<{i=ie2ywrjI|oeC=c~uwED*qXjtVx>ZjH(f8TA4^Y&12GqSRwdjDfVH?46LDMG) zH?>~u^9SMdds~4meLU7D1Ot3bQMv-K2P!M7s9dl`mRz$@|B+-zLR~6jm-795BJ2R0 zG{iI~NPL+6CN;mQ;$p;EHEe(ZQm5Q}$gLoo{{`2t@JLQ8oa z-|0jI^zD*YZ-hTn3xQZ*Lag?joY{=K4(@J3HQ`utGUm~6F)hK<4Sa^cw` zW8}RfdB!J1q3ws_X1BLNrzaUa9k%3u%)y2?E*Fr6GH$Zv^ zh~J1*z|08=%J(lvX#d6cgdKRLnRHo;2&?B95Wu&|j)}4BNAKAer`<%JdvJk;)-C=X zV+(kUuVKQs^v(o7!izr|L#A5l;MeZ|(kWwLRN^|Ua!%6Tw0)HE?&O; z`^O&T=I<4wS|B;CP zx}xQnkF;Bn@V4vjR3HKI7eOUVXS(i~L=n~x%cVPY*D9D%!ZWz=2OE<>ol~fo2d$4+ z#O>%jv^p*`>QT^QE%B8JX8!(6VR_$iMzG7Vxk1Y2np+za_{Km$N5#fnH8n$Z76Msa z-^D-vnfkU9w;7^TBfUdfBnpuf>q-`AZQ->c7m zFBzhv(beTq)nKAzviL{#2~lX~G;r=KZ!8!}+61<3dnPeu!ok7wgC;@4*8%pcN8N4{#I#ZYG={MN1MZ*u-Cf2DVvkHNH zj|J*hNsMgDef2oBKXJEn(Asf%AI^)TMHzgN|JnG#cf^E@-_}TOpHFM2%wCjMjdgPZ zB>MRZaE0bOd^_L`Hua6|OKB}|&PI*da#{O}-myh4o81?`(w5$(!V^x&u_gqs_&Nxe zC5DkMMhH1b8yej0Vtv`Ad$)v|?(%2*3KK}28k;K~&@4#-D7Xw`4>s>iRWp&d+HN#) zALHl#fdU17XImFt4v7}rV)$$C3WU4Cjg#9X-t?+nxx$>%>+mk;E7&N`!_G|FyuGa9 zmU4{?#9BMExpeZ@Ca&p;Oi34oof-^iKHMd;+&Pu!y7~EZkWH4{^Q&2M8g=8JLCH>> zT-1;felqL_^vMWp-=ysKg^{uKY5kM8unsEFk6yg%b1dk*xISab3u2@RE|6cBs&+64 z6|sTCge}Ig%>NBLgRcu)Ggq}t5>E&N*u!bLPN!T!sFF1}G5>lc7 zt5=2a-zSNXpG^J>-p|GgYus3REg25Iw;L$hxkEnlmE-wFlx|n|UVPu%A78)a>%ToJt zOEXD#{J;#bqd*lH?(Zb&*bj?vvbSXITx{v%?{`?cS$?Wh(b194gsg!2=?t9R$4^zE`t_p|uk$}%?IW=Nx^lSo3?C^$zGqLKw?55@+pP=lU!ps>_! zCG8s?yw=!_9BwHP|2Q*MzLH{P>(xX5{#~JEwa3zkam=6He0ppwY@zYPYWjQ;ySA>> z_C{8OWSO?Kn39oJy_wiP>YXt1pnf!~vA*9aL6-_(M2^X~Hh!x#s)Y7Q6%o()0s8(X zASiM7+YmzuLS$B>s-v&(sG6+wY5Z}sGQ8^h#>Nht;Lm+&W3wV@kD5auA>Uuv--u$? zV}lSje;EWnFe?&Z^WtHd?2O*j@BG#XhQIBD|Ki3UMfT9P{XXGnjQFZDHRFYo749xE zS|o%vaZio%0-lZ{%gusOY&uGnXDWk0c=%bP{$%iJRL1s%`&m-Mg6Z0Qish7+%&F~@@t8$0Z z6yXLBmdyk+G5q%Bz=Ee-a0j?*0s{gsz#fz0e!Q6n%Qbc5lvL7Yn&|MdZc>9k}(RPL2Zp2gSEtS@#MJ=_xaUIW_$A=$iHR zEW5H=s9Gsp{d>GoAxdd+KcmA`@8BM0nvQ|deLju{bxTx_ddvLeEEsX#1I!bb9b({; z?({(LE(xScM~cypW{|RdrL^p+ZD=`;WysGbWSxeg1m4H^QPWnJ|IVNeYHU?jt8-K_ zk&F8<4DwJu*A%optl86aE9+6;f)yJRdr-r}&|@T#oeAj~P!2KXoBNvHSl8DW!HD3g zG*BH4p9G5sfCOgCzsny&Gmr${CAYe;jJW-lV+m&zn4;f`q|F54&gv|@yG{b!_jeav7Rr@MPu+hFMU{B z%nqf@bA6|c5icdMg?%ua-fVoQMF#-V*NoXk{=dRKk~!_#PY&$!0aUF>06{%WBsjpA zU@}v{U7)o!5x4kDkK#%km1H<%J%2l7kNh)R?0CBt)FY8<+iK9r5yb;dNhhz3JaZy4&3EtWxTPOCtE7Tnplg&`RU5Iz1F40 zn$LB)a8qM?{a44bRwC8l1f!3#( zAA;(K(7f3~+LWUP17Ze1RX>@)3!a)8yb&5)LkI2a=finZ!+rt+-ni`5s{k4zo6Z%! zi~+a`+0;Qt;NLSI0Bidr1r{@Dsl&KDwBBzkQ$1%h{-w(2%-jpu`@bdL|fz- zS&^#PrqnIo`EkwH$%*%dyI2`f`j6!hC=$b(R2guFp1}xgp6ZMe#d%19BbdHL1aQlb z`Hihpsm2AGM#c!aV;`hShET>?##h2~v=C*;vR%+^J@hF{O}~L<^Z=gZyk1~m7TWKx zi!qEpZAEjw>?;|va^U;5gYYA;2BV_2aH_gh{c^FlKh@VR<>)%y>>3P&?@e?5av?O{ zoQvuRS_XZZsb!>j(BwJEZw2~j4e7`)K@_mF^aW0Ki^pAHZfH7N4U(bvD!)%mjIzz3 z8s}|pM1Qe3wh6l+roQK73a1`RNbVyxHP8_c$G>M?@=^At z<%8u-j1I`t06L=fV{=n(D`3F&NWseko2wmBlr_srt^r@%8pYAREYp)F`7}wLgEGSn z9zG~QDbhkTcWLw`Nei%db^`$Oz4sVUd|HH}gX25;jVDX>k;8}Y#QMm@sOH}0ueXdq z-zgxVCKQTJp9u|9T}k5@zdFN{XiyzRBM4T7ez{y2E$aPiMDXuLie2(w6YrQ<2PjVkkBXsGP=uYzJep@YXPy@SgSx6~VeZ1Z*=6`i3FQj>NQjT`D}egAU909?Y_q?w zoFJ$S-0B5(Y-(|9HFyOUeBQt!g(Jl2Kr#tj%!|#w8VtYsQ$=^QKV78(9!DMzZ&HLl z5y)wRK5XKirdN6oRnmgMhTT0~*%aJsyW15VI9WE$l5Opcw-mlRQY$qTZHc+jrm|BU z;qHtJoQSrG{KvYasZq#k)oc6}>e#}r>sk`s2^W~LGq2R`TfJ+PA%5oDn4B2zNzi$? zJAa<+gsUmp*ccg)+HC%wae8|*`tA0(hbgy5t>cqz_P}quOCLf}g{V%iiRZl4|7NnRU|WX$++W$c9yb0VJNZrDIYyAWavYewukY7OKRYeP zcx{53Tu)+F2TES_l1cLPEKUbc`jFUwMC&T^wt9CxWCQk;TG=@e=Z)>K%9f5_Z=^Am zoLt8;D1_j*UiW+oA|~qfdGe62b&*-o*va=A-pM0(Y;l4WyKkVp86*Cl)n(=Spw{Z{ z)zn_*L$rJe!eypovTmeavZ(f$-?>e62gjX~wzBjD)odCFq z@S%YJa9@2lLeR{JO~gw=gj+EiD!8w)9Kg9OLD19?FeJ2At&kywVV- z<&H~bi2$2g6aqqu@mRL^Kdn4~+g_>tGeEov{S(t0HL4%D5zqH;Wu}&LCH{tMmH#Bu zluLzU)VrG)OCF!eM6Zv(???(|KYP_H^7>H*Oc8>mN2;|}+WhqRt9AL`r*~fBN2DEP zZzC;yITHKWYa;y(0B!{wwU!n3!ya9|6G;SYg?T>^ZJ~a?ju}b+%~vRZvgwL9|YmF%GrHMnf;JY*K zA*0~*t?w%3M&vc60uO(qZbuY_-?!d%@P4kx)H`dmrwf-FV74V@W`U4T>4jM7yRz6C*akcN#mZ*{xS1XC`RQNrl} z#FSt`u$9wRxH{SxSYK-mfS<+)hAaCAu+VAb4|%{^0F0;^OAQGp0T_v7>^FV!fxbA+ z_(dsn)M-1roLYaYb@m78Dyy#7|1ZOI?|tC@ta?2rBS^htiAnO})csJq)QT-X@swF( zJ-57meM~k0?aj*;X@Lizc2Od5$OR-o3DEj3EH4jFRk-`v@#HiU+J+0hCRyTdSr`!a zSvuz0P~6v3Pd+~A3<;s>0}Cm$K$!ruT_uxe*sRisTI%9Wr$*J+%ju|y+r3_$yN#QR z!Jf5!epvr9;=}Q%$%ocy^t#VaD0cT96e-O~9hYw%bab=0u}yUy?eL0xc?kKkZr;jH zl{hxO*E=Q+arxRLs)oDygi2kswlt|EDyG%X4wv9*YXtG~sak)0r!j4}`E*dDyQME^ zBsw5n8{fN#zU}kj$%1e6MM$SZ?lGpf(uYmUJ|JFSDl;GFkiEL#%NG|2#zg+c!eu7t zwo6s1ph@ul*beZ}p9&)}s86aikYK1%4c9b;@|GNQFe`t7v&*;B^lmHsE1^ujI6-dQ zU!MO0RVjMI{c%me=1PFKgITwe=e~L&$nDA~H~tf&?Xu{XAcJwStokT572;lY|Klb{ z9tOKn8u~i!Cn~;^2V8Mqx(6)pIZ_PXk@M#RtOJSznFN1i%S&s$$nm&%X>;#0t+eR; z13n1h6xaF8F8`8i`BoTL>-j_7Oj0-df8KS=|8#gg?Cl_LV-30zHn(L=V@=?52t!^Xne^}5$_ z7TY2YGy11i&p8HOoH*aQfe3DLomeL}tsP{|VxbvqPw#eO9gck7T;Upir6^U~H8?_Q2UtI0;|UB+A=TwevQ3?O$arP~I{2_T|=@ z!dT}xwSnB~w4J?j$6S57ocvz%*yLSk+p1b);JTQ^%BP*0VTtu_FORMI#N@ldiyx-l z&TW9Lj9uGJWcU^YnHVI9a&#pT-hZ0P6c=vO(WZwLuk z-t@A<4<{DG$ZmoQz6&=l*=8~5o*v!Zj%*e74Yd5Fn^|#xUK3lL`w{2o^FQB2rTrAj&a@@`4{xw zbw!6Ccp^Rrx{xT@b}eAVy*{v+sZK9fS0`tv|uymY*8=eh{_ zHQ-Fl3k=y>X$YdFxNsf$DyadfT4Lo+{TZ~=2Yc2qt(@9d4ouffj9bX*sesj9>&Vng zWYZSbvBayB*Gq zx$kLMfkZ8ZHDX?YdAtC2*O=!t6IU0jv+$_I@DFPP5FZDo-p_ zfIs#%0tY2EY+gLRAVfdc2xOViXD2${ZaGy4hLMBZ8G&r5$l=#-8>%x{;~y429S?*&SW0G#C7^?}q}IklIv6&VCw<5-4kb=A}0&;0X!<CMbY*SNbw?rDdkntddk}8W_e)#QMc2Q2j^~c?8G|PlP)FtC zr2A*^vSFmc?m2$jccMHl8g-&1yJ1>mi3+4o$qId&aSaapoHgJWd|u@Ihroc_>!T8< z8qFfY%+mXubJN*66xuyRL4#8y{BUs)6GX29$5+kqlRDZZ1^oAm_1+7^E})T9jjsr` zffd=Z8S1;`6s^+;VQM4SVGy(*y8&o<#BP)eTs+1H;v%*uaK z$2~nEpK7@em)z7sl<(x|1zHX|%9q+kz4*BZ5?F|WmcDQPP$(Abg{8KuF2Yo9If4Z9 zpi@bQlY#LH{4_5%Zm4+d_V4TXpZ{E7d)#ySgs%)9_FganoKS|>K>~!Nz?6X94cn)M z=C0O>xR|4mDS?%H-!T=5)~pwPO`d8nYbWIRO$XAxr?ztl6{p^RZA4XYPw*`qu*(9M zE}=t4sdt8# z|M#Qtgbl zQ{H3ZHrN+NVvha`=3F?ecQ?wUcviYGP1u!K-p5;LQ`H{zP~R~9GCmHh6%PTfJaJg> zpQ0b0Us@jj!|_ufGF|ut)7D$&>Hn+vz;57u6=d{D2052rJP4cibIk|tj1>Rq-rbcS zoPONc_8=2)!=jj}CeI3=dE+?uf8uHWgI~T!_kgDb!SHfc-@hQj2$^l7DC}Tgz zdUd1~9tGpW(bR%N=PKS@{4<+km;A9~ayn;BMvvl+R6?{kDO9ZsWCxUVIP+m=G(I9! zES^l%Bkowfuuutzq5v7qz~NWonxoPvhUZEH;?^l4+U8rktaH9ta%s@; z*}uv{yOrODQyF&^a9^kUzn5i;d1c3M#AU`mEWZchRdpPS$I8MZVazpwVFzj)TlO}B zqL?Ku?tL_W_nA&OV4n>PxLy~Bzk}3FKsg4;O1I|2frIQ;EcSoCz)Q9DkNla{CU(N2 ze!lS@fM;VL68FrEuP41F zKQAk7CgaTUOc>7f1eP!!>SZW~qS+zHpVa<-3iC^m_u5Cd)9zlIx$27(aDZK}`Pge0 zdwFj}wH$I!Q-08;xFZtglx`id-E00N<-|9G;Jp{A z04?YjnR%X&Ot_Vf0Byo1mYVlB1+}Xkqig)GZbvhnw6xAw zj(N=F8#Liq5?o<Z>A9NBXRB>w@q{3T>Xp)oDojjM(xgab$;y`)T(0{*EMw%rAf$mqRf$PIc3XQ0cHlT?&#~gSp!jbA8HTi zPm`t1uXgd12**fg3ba2GHbNZ(EeercKP#7NAvN-UcNq4A!lJ(`gaq$tN}IRTR6%-p z^HZi$m2jty8WSy_(#UV5@k5zNSuVh7l3Kr7?FK&3L3l{ z*y)s~(tn9l`}SV^1IS7hvb8vucN^3096JOA_2<$q{+&<%tvUAIeOuv)4K?8k?92;a zt=B#~Uf_tjo1S?q7I5U$#5P90LNtA`++Cn6VK((5^>_O}t&pr+iNGDO-i*Y`xS3CV zW0lH$a*S1X0|XPDn*)iZdnj3|F_Ltc=zAn?``atUPHic5nVdgQ$gbpfIpHkJ$AI%L zEO8a!UDflTbRe;vU=yeF4U0xqbi{jNgn_eza;0lye> z5XOwphiFn(K~^5lkbS7mY7zR0a(40J|LIx5A;h6>{wVjCz2#sN_m&}XL)~ZYt)YFp za)!ZVaJ6I-lZ4GP!oq%vj#a1FT1LI z_TE`-y$1>!B&I%^Y4i=)ACjKZ*h9gIku4yL-*@8dXSFtB)msc<@PgnIX*olo5;Bn3 zC>^iV^u7Tp_aj+T@XkXw-9@99ra-2{JYmn(9t`M7cD%r=!NN%TuTX|C|AI|!b27Pp z{ZnxZ|5*K|_l1@-`Z*)xQ3_~;SzD{wcs+l=y-`w^%W-VYYDSUNehD^8-)-wMPCDGIQAahZEra-%Ni1j~!^_wk^&`hqq z>*(S$YL=Gj&H**!A~3vc=PEEi$d5%SI+ovC6{&I@O2}`5K+3E9c(Xgx7Pa5r06gArn2n){ z+ckCiW_}m7t2=3^J<~Aw0OrFOW_jmZsP0L^sVFYD%4p{jY)ZE)<+|*w@6vEF=(9c3 z=JCaqx{0R)BA`4j|1(D9B-5BQ%CCR290@M<9LhL>8}C&Cn>X$Mn91 zCZGnny!HL#DEW6+f1PwZ9(j`J9VHPMjg<%^&2HKrA3oO}x+#iUy=f~&6PD^esak#O z`*@k70qC(Kj7wWsWgb=}ODJ<=J70n_yP?xH3y8~>yUgDZws4AWW0i=X|1wdSF1E7x zbqgfQq-$GLtHyjvO@q0fwA_B+<^|4x0jIp8SYpjmQB7@~mcQ@PWjGjC0YV^@$a?B8b4AIf0L+BmqOyd?%}`RM@{za zdrwxC7_GH1qAf98=}cc!vmN5hkbk?u^mFT5if@Rh7J6J+{J7_FEE)C~Q+RFtfqBKl z6EvT$ShY`5%=>}%TI7CxpgL+**_*!XSl0X2QMyN<-< zx&sMRXWTXM8n5{Vw_~FQ1!pYmg-J~f1;b924IY+-h==8^``sZisdu*n7Er=UOXqzCH-Fx->EeDok0YgPrZo?~3 zhtktP+%Hv><=gSl3z_Cu;E%36RAlEJR@z`k^_(}jSuin!Esnx^MND0}WL%+n!cW4Kfne~-pe;R-+lDvP4Q zJpad@kEhjo{R7`Czq%zWSk(XQ2r05+{;VwjF zoJCsk8~+bCn*_CEKi>!O)(B$>xwDrkpbcKpqJaEl1T?aog{9HOEf2l!y4vK`>Z2cL z9vl6;CA{`dB{a_mh1A!g`7Ln}<_w@xgx4oMy)tr6K?fvZd7xrrn6M9lPRkLVv=@t8 zAdQ=+yUPNxgm?~J#w6gnFF+{cN^ggRKPTT1a`5}Skih&U(;s6j^p^9}(reI1j@THu zaeVakkCfi=a9vtyFvU3-MsbGHu;`=xle;t$=X`c>kUu~p3yrTORi5V-8wCuRsWDQJ zpW1we4--vb27G@UCs>sm$zYBF3mt5^i zBj@;&ek0Y^?wd*c5kgU=HJ*`UQ7tLsE|IJ6nqq*iCB1C8^a&|CGV&3mp;OK{S)u4A z{94zZK=tnOSh?J}UrRwWV~vH68qM;Tyd$gZk`+@&TJtv43jAXtR0@9;yemum^BOXl z_n44= z=`#Ghnk~x5${`O8ZllH7D=(#Tq7>`86@6qttrf52lGY>mDrnPZk&O z5xd7J;u@xX+Eql}k7dfZRla=^a~< zaxEG`Y3SESNtkxH6tl5yX$%^E0h*kPDsaos$N`}?+`BYzYq|o&Oo<5-n&z#7uFpJ& zr8+l_Q%Qi zkpUCEN12Cljz7Q0X7%;>l${T6$UG=waK8El`bQ0^9$(KmeXXsf;d#5*e|K6C3wt}+ zQP|YZFfq=taT>f|~Z9Hq(1w)sX`8w_R7l)`|wtl#Wo$~WpahJOn57x-G)qWR@Bnv)Y zyWK-DWa<^EIa5|+3Lo6wSn8yZ_xa3rB>I{w$#6uLMi#g4`7F{M%jNHvOAo6$&pkYj zP3?Y|bTi+H2h<$i9aPD9?e0jBzWzK=+f*6H?bpfv5OVsF$=#4lx01vx8Lr0mH0O&= zjAcKx8`Xu!a$)BAK$sVjcYa%idxC0GL2vKz+g~SYntJuTx!`C`0Ar49G=K>r*?noH zZFrR}3GGI!VXSzp*W!|edZ|kYwG@(Vncot9iCPI6bpA`s**gp;&ueI0kBolFA7ONC z__Sv$WxNia-{&cp7$`Z!*GxI7+PPVJ#T|H_ARpj*9}F6cBtok|#3X(XOFP-FRpoLE zrTEdz@%p|pH)-!wT#0>^4=~~88QWzfbQp@mql0;M;o3uV5qhoj2OaZ*x+lEKlF z3C%5M?IrUmKvS_-1IYwGDu%7yXr)`8PC{fMxu5p>%XZQpTN^@o+QC6M=U^mV#U(y6 z2ne1t6@N^)P0(Hle}l4Mw=HK{wcr!@ji6*qXFxYQql`1qM#x^2z8itwjBx)!qHL9$ z;(qsw_N@B#?L>D{s!>F*XNdBtR^j@XAfn0?iKvbVh<1!7TRl43!)*H8d2U>`wqQ;3 zESiawjfMtG1=UXcIu_k0IdO=@RP*%p?lwG&m3ruuQwV8dt7auGf?=RW`sro7uw%1R z$wCa|b;d8(O?@!g?M?Eip)e~Tba#Znd^T0T;zhc2};{#qxW3Sx+BgjtW%ip6m_1VK$&tbK&ED*OTn_f?gqgdr9$L ztoU3Fjz}N0X)uV8!+ssPRvKa773jz;yOB8(K9cnic~9w1PG*<)Wn&$+gH3l{Hs9i( z6KcB7XE+vzQ1Pzu!}wph(b};)WZ_kD$Xnn+68rBmv<}hp<+h|XoCcquS$jq}=O7M_ zqbRiJo%=~KZe}ic+Oy5;HA2o)<{j;9>zoRy_UrM=wwa)$MM8z3Gm%Oyj+^}~(aD&O z2`H_K60Ny>m=r{4{7$zvCn==;kzv{{{`I*T-P;ccJDo6G5qdPwE{VcxLg>uvzd?$oN0 zMIUf+CYlp1XRrjGgn`lEklVSY|I*At^ik3BEKi$Zm~UN9UIJH#Jo6Gz9#TxE#TXGi z7}8t*VL8>3r^? zEuzD8Tz=<^^Wkj?CR2I_;Ai>Qx@pu%bE-Ab>yZ*s?(Ll>@@ zD0=h#R+>*r+T>{6o%7n29L}WrxMag{I1&plm1AB!x1WQqL(og`b$jgIwZtefh?cgo;hzOr}k&eV15$#Fd)t+g)X$bKnkB(kF6JXvgaA<>c~ap)g}dPZbVOn z6nYhrS&uh-0Hmqn($3s6b__RVS1Ya_Er9AHqauf<~!2 zNJL`iGFBQ*vyMkQq)6+`(OH96vpJSDHIG&AtaTdM27~0#lXt(~ zKjFl*OPqyx*wx2;s-n7&F+iR3Cpyr8=Cuj97M6c&Xgd|qxh}fps(+UJo0j@kxWz7s z_w^axP0+cvcyUyK*go~M=OINl8>>gAW7gCYP%oUd!mQkOy&a+u$mSmRv^W$ zrYZ8qfo6!m@3c;3V|}}G5+IH}IQnX2oHc5{Eb=zD572l`G%c(!*fs!G4`+)2XB z%=cRH0^!d5Gi4TN^`3q8a<{0QyqJ%kYq;V1AwtjdLTjCjGqkN6&!szRbhY%@ue7;4 zJ*lZOV7_ob0HH^aJ7m}T>NY09OT^6$ZB*zrj$i$DfBi)1d+gnSiE!M8O4|HpjZW=~ zy@#D1w)n%)a23Wghh*n(A-q;bU&EDg8f}iZEnoQ!3p{p-XStg?XFe4eT(y7S#Hknc z5lSBAh~!=ONrBC7@>WrM*1XlKU-y;=Jw0q~i*xa%kMXk18}f(Xxr@AkSRweYBg(TOrb~6TXf@2cLrs!nEiD~JY!{bYFUsmisBxP zaX^utHYt+yO>|b)5j~RB8Jvt2&ey+! z{uE%-r3R5pQK854PJ@>H@}yj%HDh%8<%2>9d>EQ{FvC*_dAG_o$-_@0Q={dCfd%y; zp!=w&I)fH3jIcQqQygv@cf2WWQ^K5hc)7~AMa>x-+N$Lvd!bqHY)ooW3||Y|^0B|r zV&=#xnXcTf#%e?u?!swH6kF_=8en3N>W(|X74gTtGwmJP#Wx@9*MoP7oI_Rsq+hXF z>4DO*r0H=LHs8*qbEh_P9$S2tf~?$4qs27nYXfA;wGQ<;Sz+DhNSxmT;- zH`bD04v8~p;A4Ay@Oo2kZkv|i+d-q;^HpMtAA)%#nQa417+g=GtKlY*nys|RD*W;A ztw=KrQdG9Q6Fvheq;2^A(|ZN!ROK9oxh*NC`!WJQxzU%0Lk9^=mS3aP;n5}sF~4{Y z@7(9ZgWV8Cx7{7uIav?N-~9t`=ewxvJCj_EzY4*+5>S!-1O0_JG4=mLtBC!KJ$mD+5x?nBOG7 z@jCQ`Bc8=4J9XMNE7^^=8w%?n1xj9g!d!;M+iLx2M7Q!7c^=puo3k9sfQ#u;Kypa@ zST?3OXrtgOuU0%87my|FJ?@mFBH$wQzI;o%RKxQ8rBjion|S6=%kj5#T*d`W2ZO%O za?8k}cC`u%WQ~UwXu*`lckcpg(8%s_zrs#`2PJ{F&I_?x35wV{2=Lmpc8i zTOSFRD%iYnM*R@B^^Z}Gop&xX>++&^P9qA@JXuP)_$h*zf0x^w$bJ>s#&OUmBJBhF zLvrbboB=lp?4;VDiz-kre*M4;OebCw^>w<3cfh;gmAW}{<$C3qv4n^mtS2dy#FM9O)$ubR+{D&LRJs`s<8wVEDegY zb;KaUCzxXT%0wgUJR@&Z(sy<%a+ZGCAFkR&mfQWs`Bi?rlDxZ|KC}Jud(il&i86B4 z>xtLb4)++yZKn}^Tq58*8?Wp6imJD4Jkk*oe!G?3)$)#3PqX@|$(G(TxRPmtyy13j z`JH;DV12&e>DTW?4RcrAx z8IRv&&g0FRLxzL>MslsUL4u-tHh0|?VSdv&DL3Z`b~kMVy(vlL%v~V2wOs|%#iJY={;L3V^aQdmf^m0m&vYa0 zJr}l`g-t9a{;1JcZ?x#NGQD9@h&%C}hOSKNQV<6Z6W4DVb}AV|Ep*oIRQ$m@7YzC} z7jE*NT@A;9)i;noABdBgFiA}$wx*Wf7~04>ynV?@)}xn`FElUSd*Wq%FN6*A)9Zz< zpjLk?bk{q5oeN%S;-K=msnK$CkWyLlc?Au*+d>!smq16VY&UwHrlYjrDAe@>&6(9CPf)b}K|Z4-4Kx zOL?5OMkD4=Ya_OCjEYkkJFgjD{u5hybL1@YcCbiiBjZQw>wEORhdjlMPR?K+xi^g) zA7briHl#vLqeamUU-AqAb1(dYe?aW}bYM&-$I)8))KYk34f^R=rosgAe$ z?DLTF{w^&)?@UO5C%aSCAC+^&|K3JBetD6+Cgr~dqSlcy$J_?VO>Xb(rJp##Vxq&P5)UmvX` z=tr6yD`?WK7r)r*R?cS@sMM^9|132!e0nEOxZ>r%7qNzyFwymj5kBQ5E^NJGM4fs3 z;nGYW5bFKB%o>h*;XL^UKpo$9z__vIo8N8KI3mw7x0pd6&m)`Q2!+$*sGwNTy%t`>2&YU$Ze}VS#qr zjjnRW`wa&gH+>)>NO0|Wm5HPAytx|Ty6h?rWj5Z;Cj#Qy%5mSwe&!<(cJ zz2ivePAIg4#+BcGSl?Z)c|QO9mRy<5;|Ao@mk*YeXYVhsGG>=|r?WxZ0fJt&puPkm zLO;*=Lcb>WZT-xrP^uea82t+Ds1{Rc=?oj5yy9p~OF-6OQ2zwFa6WY;cY<+jV(HLo z;H0qqtZ|DL&%yD>Jt;SKE2O7?6l9?_s14`{uV%n^(Z0g~a zc$504jealMmU&o;gi>n?`WnA$YR|Vm9vX;pV zPY|D%jlyJ=_RNRx2A7xn&s%@$jrQm8^fjsR493vwtR9xck42A=B!Yx`9*7PbJH7tf zk!^ae8yUT6$q&Y!MPG2)6c4$?n`(I?ns%C{5KCE2Z|$@)9CD;*B*lLY$b@PGyjmBH zZhd$R+FVw4(M<=uhawNayU&oOrXEBXd>b*o0wRpgIfYv|-z*qAx&D;!s?%91M|;>? zo-*%q=5H7rJFj|r?WwYw#6Z(0m1Kb%xtLFrp4s{LnvSu&lPjTi5ezqyK4Zo|8EewC zCJiLv$A5nfIwn?T`np{Y236(AC{TOn^uTs3N?g-GPG~{i4Jwi_w^{YIT3Wp5{r9qAsX|egFeMca2DzN(?T?4S8~7wA+G$XGNid zxaMzT`1jpwB3WC;p>P>+=lBW#bzgBbeJ7iwhG_KD&8-{Eiy^J$qT$&6b?E#_a8tl? z?|RZFR1U&ky2cz;tZt*$taMNKrV2yGf-A?SGil%Gn)HoAf4=Rp?JUeJeZ)!ecmgkZ zk`_@0{o5k#;-AZh@D`BWVR)ioWcrv!mc$!^FBsJV0Z%Ejs0~l6B^YnH3VIRq`0a(8 zeSLb@BPj{{5{93REQ`ZONJ9c|E`JcYWmqm?Q+R*KcR?JO!~gu|kV{2<<63VIG|%p4 zrKY&*SoVw-YNu8st~dT!43yuG~s%$rW=)<8ktxq9(w zJ6~(v^sH4Qm5t|*oR5co9g{L9F+@QrjG8AeCQ-P)PZbx}YY(4yet-8{hzHFfBh_-h zB|EkKK=F1C^su~Iz$ez((Fi}xb^_EgDI4=Dm@tvPUfXIkGjZB{kzTcmr;c1cfD^L_ z{zgI`(@2)_J?aNwzEqhvWDhMjS zA#dz~)}kuYNWg{b{l&rEwa9O5%v z2<)-ify#686{8hjzAr_fvEDXSbBrzMk4(-&wuzvP&KTZSJF2rSYnI{8;4qjTQ!KA$otir`a|qeU+NtpCg5rpTV6Nf|qD zCa+*?q+5B^mJL|+TG>q(B_Av$9Q3P173Yj(c`Vz*tH=95{rP&EAPZ!b-N#xM)fH}t z9?^5EA4VKGg})vCLkF#c<^pX)Javy`p0qb?;mI;kp(zhr@}TNMgX5@dbtYC-9Z94K z>P*#+bnT7{Q+%j&$?slVLG*e16E^kU52 z`ICz*Y^h6Qz#=2}ju}2VHMsxPg z&8nTyZ0zM1WK;TP>IZX^v5TWu)bfnC2k+TrQdPeW8597a7bITnb3fm5r*5bQRp*Hp zgo)N!Z+zJt`qz{fX5KjcxM?vCq2*m`eE*(Ik@MZ982ISS7sXwD^>*npo-Bf*oP37* z*KX;K*NO$gc3pi!>H;%K*Psh&8d0+aWnSkJ0Lkh$atwIRJ(Ygcaa)|@N&fpl_Vt?P z)Ol!rB&?N>c{r8Pz8}MHItWhyz%_~{dxI0AA3MhU&Y?VSUs3lz8~eRZ?z?B!3ViKN z!;(dNm(Q-tqy=Z8C-{B51~Rbog9T|_= zOHxQWk`&wZiJUi-d7yy;fRi zafl`YJt<-DLADOyJPc5S^TNrbrsC6V^;?0eLFDC96^?1`MvESG_1Y~$DeJ+*%S!a! zG|E!6#n-(l7U{GZmFN`=AKidd6V^KAN!$di=aEg8Bk}yM*}%aN5Cfm`G>gGv`^8J<1zq)jR|Fh(nBr@PFlmTj@l~MK>C&s z-v2cAA4fZ`sx`4?02@wc$#%Q~EJ<+Y46|0y5kBFIV|7x38O_{FulNQuHpVAy19kn^I4_i#B?pup_Dl7%D60(DFtwmBFKG54H^*Ze1F<9tQ* zf#gCF+M-_TEA&?OF7?s!Fe65`yx3ZeEI!fB@N_*ssCuPz)A?q?m^*5LG5Z>wIsl=k zr3XI{S2XW;KnFtyrJ*UZ-ii&}uZyFmRZ~Y)1DBRp8sqQH!6y6~kWO99nY&|~U*WR- zI}&`1*o$qsuK7PNP7=|RkiLLkoJ;6=RmnlZCTuNbf~J3N!o zN$xF*p!Mu^ie3gqYtuGV%{6ODYueWI(0on43tKCKj5f*Zy%0L;DeSe)+&Csui_u9+t0iFg> zbJ2zDiELWpqdI(tPjF8j!!o3I8S&_5=J(TxN#x(V$YF)_GtcYfI_}Dnr#P|i_T%E1CE=So!VgM1zZFHqIL!#A3et{Sksg^?!&JnX7w#+ zm&W*&1iTTi@u)N#wXn(Wyo{izjmY6keOQkH+TDQv7#Q4PnsqD)l-g-+99}_l49}&`;GMn|0%INR5Q|vNc*Wu%2)zTL zMfW2Q8-yy0uiIRHP$k2W{0P#hYNtGZnnPYBm8W?Ms^OvuYkGjY;70vmMd&Sc$(G^j z;m$H@i=kFi=7K9;!AnUNH! z!A0v&#MCXuFvJXBr|&L1Zdql)7gUj78BZ?0q(rVN3JNI*;{9vT zNw~*?@9EE3MA~Rz#$T;^fku3)_2tNos}zyjTT{;wRasSpq(`2ttw(!HE0GP*RENN9Af zN5|b|`?@{hW|VjtbZ6zq20-bk?Fl~olAF@`$p!Y7Tx?sOZ{+7>DJ3?AqEfhInw3k8 zLdUnZhsE6Zy5mlr6<4Mx>T+=H3x3B-hlBo;rL=z2NU_Q-({VvL>?cKS$-n5wT~;7S zH!PTmf!5zg2O+|iO2EP9E{Fy^ne@hv$XiW&MhB|wL3lB@&AI#KhhsC}JvkB5OSl9) zVUZLLB@1rcj8bZ^$RX-`HR<`<_aND1=peLM7}m+V@`2G&cF#l@QgjC;i>t z{Y~p2BzK@`gCDJ=ARLPTSzkE{^{w8DxEi1>w-Xhe3C=l8%mCyzjYJ#8slfI)38zaY ziWuN}_o-Eq*zjkrYxww6x(DQ7j;gzX@ixA&PHPT?z}?FmaW-L3tojYoH*sALy^{kA%JP~hTVd#0hRQ{&zs}sIN!u4NpJ&NV_ns0dPEOSk_*3Nr-ty_;Os0ZW zz!Gr?CRnwtu=~1;qV~C2F6-$vU&{jm#4fdSNS*xBCT*@^ZY*{jc;q$!5oJtyXf^*z z&C&0vbsg$}bj;*a!)K?-M5#LOUo6nZdGx5OEx@qrhF!ZD*mAwjRTz5pe89772W9`> zV}%ZIVZ(>9uchBv?8vvQXf&;lMB8a3X24Z5EoHRvCGo#d=74x^nUlaYah;zSR_8nw-elZyG zXHk3q>LuP^dm7!zjUjIe!&X2f%%Dh1;W*M3SkpXBxXQK(j%zm}MdSLcTlmk)&g8U3 z$2(!@0@MQ)SOcojbn+-mvhl<3v|YRxy6#+h-IML|Tj_d_e^#+?Lp(qH`Tv`i&NU5k zNevLV-kCG)KfZF3=nl_>F=vMnJu40Z!7k}-U(Y_23k2V%#8xp%3Ng-p)d6wJQxua( z7cL1GPp5mwz=Z^e0k)ln!{?opW|bcJ{1~~ZynOD@_xbye+T{d0rJndg8CshLD?#l} z+6^NW%~|nw7pdL(;q5fV_`-G$H0u`1@1*4%S>TDHefekmgJEM|nXWm#jmxhG zI0GK~UdZ@^rP~e#^UAukI_kK=m6~v(N#HaOH~uT6hI)#lc1!DcajVmp>mfeTM+4Hs zhz=Dje|MEXU!dvKt4aGWnB}2W?EZLuac}4`my);o7h>!*XHOSMXIT8Bg`HE7yeiw* z)125I^9fcc>v(J=Ts1AiDH1xj`D<~o;0Mrx6-bv@7{-<*2SxsR|7*ZJc=oK#g7?h& z?_#ji7ji!T}N7bG&}{SvKmP0vzajBs`dZp zDKpb?=ajkFYUi(zJABHU`OhZVu!Q7c_yA{23cjL!<7b8f036@HnWKG#tjv*`uIhyn zypdBUd&hjF1z)ja0>sD71`aPG77m(3xWn?KPSXLlmw+Lx6amp(j-`ztQ^y9RonopqFcSYo;zd+6fWOu)0= z=yZu|DrZKI-v(izwnmSmn>Rm-YyHUn!~@F7B%#0<)r4{_CY}O^m3Lq{NWZ%s@64r2do&8eR;|<6f)Z4a4 zcI1>(lO5EzOQH2V*x24Fef~fHJ$RLbG_)vT9)bJ@2gR?dUf+>xA&wM*^v!DDz^ma( zB22)wb`RKTUHU$}Eu1NRTbW{aeDvJ=)>92&o&lg(QNDqeTJd$p67ro6A2Pa^mop_q z^433|DI1%a7T7kw?G;h?$H^GhVC(+|rAIFt_MvR1DZ9DrEGTIkSV;63gxm>v?%v^| zS|gclbe*ydARUF>M(HXFVk%4iEnnG_)L%bW0yvv2AZrAUyDE-P=3qf~Bd^Xp%Xn&h zN9dz7+ZX>ry#JrTwZ9MTRMV*!whqU!J}*q(n7~8=e#Q1xfmb9t!Z9)4F?vJU!gCvoStVt-teozQ?r z#`dx<+~mV8nG#i~!Qaeces&F(^CbnBiY01}ibdQfR_AIWwE%wj%{HO>>&DXX{7EAF zlYZT?GZs5q%q{G3@pRJ@EIkfocoo#@19$hHcSC`bW4dpMYGTf|#**;v#`@dYV@2^+ ze<1*W->BETmXh8X>@q{Y%?YljyhEE&-k%&Y?NYGTkdGtd0OO$%!F%qZ0sErC@!_*E zM!E}4=0mR3%i`B9%V7E@)9*!ig!}PIvxtJX(@8*rH!nPVoft|EJeR>4+`q}8S7U%vuh z4EF#1{xxAA(lQ`x-H`n!2qvRRE%^(!A@4^08E*aiL^!k+LiJr+)A%!MZXN*cgh3k< zWt>m#V^Cr{eO|&;|qj_omHK77I><;(7 z-gnFv`1P%=hapz>n(mAH3W0k=3GWIgK)|8ok@ITK>H9U7E-Y2pG0TdTNi}Gnar^S_ zzhv{hcjYO-?IgeYeY;>R&LIP|t{4TiS2S0_#Ba_V6gmgbeXaywtSzO1U*xB zC}Rslc1De{equ$;2L3Vcr_NbSY$pvKgYdseYlw065AGMRcud?&UJ+YYm56575(qW) z?SMRuGmKpDwR0~{w+jT-NyE6XfWXx8=@-v8#Tar;W)D#BIc2i0iJM%XD}{eNlg)K< zXbq^xR7-_H)9AW==&w=i8y3U5EAT#8wP%g-i$Cr4rf0q0=^Krn2+J#)A$rVF?Z@)3 z>8aGngC>}UA}+qI2j@OB^9;)zXV!9Q=Q$oH!azP*_{o7K7roUuE|fv#S{kEhAaNKD12`!S~siX6WFT*LhXAneudXx>Yz0{b6qGG zu-C6@Gj%>0T|6G!y}WcgXROEhJ+3;?wL={+0L^uLPh;Xy{7=s(JPEG z_d4hKUMA*{-=EbKw@Is178HIT=iTex=(PyEXhp3*{cmjUA@a$otg&HJM*BscXRiJN z^m#YZw9BE`Ow#IJ_ez@u6QI^anFmtasY{~UH+Iu?{h^j0(EfyD_C9}%c&Nm{GeOB5 z_wr>ww(gWfsg^zkdx|yN&uHLzE%CssXa<9OWEcTf$b~nOov8A*=dHPR@Qoc@uU0WK zv9_FiRp`KwOue}TTYzT0Q}@a1E>0}HFTRZ2!*$%7z5i$TV&?!Rd^~&Sg>%SOSi2G~ zULx-3KURU%lf=VB$YDojX{HD6$SFbnNj7t1ImY|IHLjY73;h-lT+(X%b?&$+0Qj-0tnaMG+H>pAq~2_8bjJ* zpRH$d{N{0?_=jCq+OwTt_UD=5DIL}8UjKOPIb5fIAG!!J7r-kDESL9tbzK&eM=Ti7 z#`9{UQIg+Cms{~T&0c5M@w0|2mKemc&krbr45bokW}-C-fkR;p&-kOn2*mP=;UOx@ zS#6}=_*MA!B-J(mv`v$#r%l+%2_yQtbTGF1@fzdXfFHT>VD)krw2W z58ojj^|v{G+69V`?bF?1duv9Zvdepqd!jO?L9W>Gn`NA9Tv<7P?cxb4>@|!0D}gxs zyh{Y7#6BUn^V8YdPK)Nt&9H#_;uGJCIk}WkupPu{ny2K|9 zV)Z%s>Vq3T zlEe$IZiNbZ{?3o;LBBr;9l=z5Up0`cK2u94dSPBb_CjNESANUk)oxs*ofh4?>c30Q z_F|(l2J#?|^ikm7^zVzX9!Mibe-E08QpG974ltm`jtEMsoa^e_H z+1Q|V1M8phM~z`?pc%{&B=y>6cP&|R?y(m%+nWVJp7Da?@sH8g$8~?B^Z8t=8M~s??7|ljxbi&NP%l5i8lN0T+{ZvMuSD$me<%MHlK z2#a*xu7eKceE1U*QaO`jz;1&8$8u0i^F)9zxl)*6mFI9OU0N60-pGy2(~@l0&NR;3 z@yl<~5GjeFlE+lWi;dbZCz&UCdd9X}-vSJZgf7acJ`}*2JKm%g z0F2U&9BmHNlG^X(<4Ts~7b880)XX>EdnPj-U0hsRn5*tt`6kkP>A)x8?6$~lK%b=b$l)%DgYI~pw^wAT1n04Qs&Thu!{#d46@A`J(2Q@(D`*qs188c}N}EounL zYDG_a7Bb4`J^bnsUl`q5ZrbOZeMXs07&;6kxAWBK312_moD1cWOs;B?;`sKAO^b>6 z?MAdt6!6WtxF);(76jTU$Z6S{&2IIu?>u!pmr-k0V*Wl5Vi~bf6Z0MJ&5egLW^HyI zgYJpaMp_B#t}#I?nKXs%i`i8@+1ad|yY*F}boyeJkIgtMn4CR2N0pX3bmPPKiR$2( zj7|hyc-yaKi$!-Us{=j5*vV!fwN+_F_1h2et@KTi0N(8L-)RGvZz{y!$Pu2uX6LJR zH%a2$rR$^bmo>cW_(@Am6ZSa?G2j-%r;M|z?OAQSBB_a59l9II@U; zS`T)39B|%aNWKC8ykN<$;TK*PzRb(izlIv7@1vj$xOcU^I3|$T$Kj8oH*R z^Z90T1MCFLm~V#z0mP@bI@R~2Dz)}Rh}VQKdkV)$3>pqy`L;EeZggAfx6WMSUS3&e zqtJ0cFL6aOGWUeODALu*d%)<)-OqPQWJyfyv^4E!OrAE;)!ac}c7DS1K&U0=#ik*z z+6U$NanK-z$+#qr7iN7Z`=QvJXG|CORrMr34D zq(sO(Hj%7KgRBycE#Vl)F`|%hGO{^QkrHw2nZmJ8w&U1GRL;RM&cQK$57q1a`+WcD z-<)%v<9b}z{kq*)rCB}lwZ#2|hx+0ea|^9lU~PWBp=r|kvLe}7dzc)yuZ~`Gw0L@3 zCOUKeoIyJ6$)!Z*x}lorJ-6>39*J_;nL~BZ5jGRYjQ3M@U}JUBUrLSst!mt>V<9+u2uPX|QlL z&To(?fEwrLi%*Gx_GtUfZIyOARQNRde%XkZcZ!fkL5t9nEpt&i6o<*CVC187s_`sF zHfiT4o2g{}w96sO-PMxdoqC|DI#ACpJ+T_=YWhZrGjAmRE#;C$Qr83USfPIEYiFb@V%%b4zFgiTR}VH z_j8{>&>28)JFwZ8|BJ(}g?%r}@@Qt(3c4a=aAoZ{ zRbH^=c(xDkS{zR-M;Nfa{1Pa~iST)R#FLm_4L=5e9IwwQrCzC|4#9D74qxpy)1|rC z(C)MKvBJ4$O^bJkXlxIrB)$<0!QE)U_R;Zl-Eivevv+=z91^Ka1DX4=WL_o(m4#Z6 zm46KKS+fXN0mm;IM?GglrVJep3BxQ}6}2EuhNZ1mftV+J@qCP%rD|}eRpXbXs6pE8 zhgt{r8sKn4#oR?WdT)wCVG^!w_TDc(OP)aw*6vX3u829p<=0$8Snk}qKcOK0X)xnZ zU9hCvqyeLUBgeGgh1|mEpOGZVAzF}*bx=jEDlJs&xyx#GCw8sa+udu!x^5}k6Zwu7 zyp7!J-HLctiywm!=hK>6Rx29mD!=(|G$3YF++N%wN(fZT1x^Vw4coY3c(H0+q=jgd3P9>J zUwvv4XJ9J;_&Luz+z3$?HEr3><@fmK?Ycd_R{2T9)6A_XT7JdRHy&|J8F>CTT6xeb zuCvY`T5oiNig2oMxWkL3=u4K0T__zbz%Jf(^t9p&-X;fSSw*+?gn$w1X}YN@GX$j+ z4HQttS;#i)F#-H}&MN_;CvJR;3RRj>lN*J4U0$dl+ueKQvi(*}wLmXMJb1Q8mqQV^ zu-!&|SH}<<7F9Tyfyt03hdiE?I_h=#dys|3que0>$@GJCTZ4i5yC>LGeeqt#>-UA4 zyF39SAWhK72!^>ddyt$J9QL^PF)JSr%sHlJnQ413gmK-{Vzfd)!u~Q_Q{&0XN)tKS z%FZv3Mwj&e$&i0yT!8)M>w+^CZKU^B68o-)>T2$lBEPh)Ce=a~mCS{=Dt|XoOQ8@V zzm|0_<=+A^Xui@Mf94&HYkH}YvcsLD2YFLoq6b<4);@szv@)U9tARmr!PwoR(ZfN(9HP&YCzXPw)NW3YW;=a*HYe^)_-t0{*dSKuc2=qw zhf}ahe4j_>ml7yYms62`hNhTFQ!`A)`7Bq$MI`1dZG$&Brg2jO4LB2Lqeq&zBH0pB z2`HuKki7n1-gS2NuTCMJ+L$0Hx~M0v(k~WaU2IX2@aNCH98fOs(lOO+<-~Ime+Px} zO`oH&KOPjfSr$i|r)+M3VPc1?k%L?M&mIj~+I~X;}Jj&R}G9jP)vzu zuI{O1<3Q^QS96o0!0i%eH)+4Q2od?4zyh=MiOIum;1eOyUPZWe(EJ76qVXv_BH6Vf zFJ1q$3-n;&3~Id)ibLMi@uQ%EcQ+|vm1!rHEXIJ0a5`%#Fn`B!UhjBQ$bQcS7L&fR z#u}O)a?q#em>wRhvU?eq&Q%!tW7Q^>fm^+K-?f5p-FXvTtg^UY4FO~t5L9(;T}gv~^ymzPd$Ih1)sZa>oGC4X?ZbORk9g+-G$#nd;W za1)6+CK}&@>o&dm)EmSmxQ7$kFBk*}IiNtRgyeuV9#YZ@tkD-ZcX z`B*-;OH#jxTy8(M;MXIxaqGo01LKZRs{TuQp+=j_>4gEi<4t`N*dLR51%G_YJI0|r zf9i{Of*rz!4f}holQr87w%gxL&g(wN(^aUdiZ-IUepw1^z2UwTca^5o^S};j6G(1R z#ePMRZef|Z!^?iDaJ$7N z?&*<+6hxQ|JZq^Slf6l9J6mG%4o=sf?~#EzvY~e|LTxQ4dp8+la1pU}-`H%*_aim5 zk!PYhdhv&s@sZK#fQi%86lfu%PrvRBy~&F_#aGpbEQhue?i{gC{C0a>H zOwE8-ex}`vUo29@gu$L*_;&J%dM)2U66_n0JQQ|2{OVwTQ)nuW$l9&XIpJWHgej|d z(LU(&BC6utT3HLvrG^66e_H|H2G^bpK^K&MsR$60XTV=_ryA9CURI58pj`XXJ4Fp2 zi@cuaCwYEXRbb7oY`XR-E`OT&GAuJ{}%J@SB zB(sPQpk_uo(B3nz0~KEowZY6IOBSoLnu!I_)1?#r2c|g>R?Pw&Nt%5{?S@MKU9u6_ zvJ2i2(F&f2OiFu>Lov0Hv28Jr+(^^w-fH(Ei$u@Q z+&}D9l+SDko2pjqp?;HR#IVebUq}~l)6?P$@bvyV$$8hu_P5_%U#F%ZLBY?fdvpx& z9UZrtmL0<^d>s?h?3q7T6izTf*pGrX(QAf%TyF2lk~~^@^xe^GlA!G~<_|Op@kMOi!2T+~ATb1Y)9W z5+UkbLc4LHY%7=Qgi{*8=wZoNE>szb3q{;|n_atD1DbY{*KOxk$1hBfX7qKPZ|4y& z=9!!d{s&(W;=`Irxy8I70%gS;`a7payVKjBtHTHq~t=qm4;eL#aGmaM2) z?2xMq$(8)NHSRl^#kn<9_F`Uk#=F`NMllQ#>^2OxInXpBi*8q@x-pP(SN$q}5uR~c zry@oAOzsZH3XDenwu^wPw`qBN%!z30-no7-n???*!-lXdO-jwL@*18=J$@AIfn%@k zv2?Reb*k0A?2%7o+^*kvOP75REE{+_Y6_y_uEpI@O%#UX=5FgO(K%BqYfVGmC*YpEMgHs{_%ox>eubKKg5TxL_ic^;V zEaKfr+^fK&m(a3=0|P3knFB-gsCMfpO>wzc*Ux7_0~fq5Mr59?WbZuC$kf^EQ{$Ju zVllA4luG1&o44xXI#-hVf^PLisPd4h_3ANc5%*y;J)@K$twM{I#Ms#7PGsM$7_o2l zX~)$0#&pLyH7rH(87CfxFSqNgMrA{VH+o50^1^aoeJmhd;l2m!nq{$_ST;V?QJL=< z!?F)wXFm8&kt8dsciDUXBn9 zcv+en)YZZ|yNqjmk2E+go|T4z1Im!-d}8+^lUF1O2msqKVCVb}e1%yWd}$*l2{)e1 zmOYZ3)n*^|a`o;`ms9oZpIzbp8l>5fkBS{7e(3*uiq-&)n1?oY0zC6~E-mom--7W5 z&PP14{<;e~21z$~JSXd%)v!5mT=zJdR2WrXv_u_-v+brxm}?~?mP5TxwS8i~X~vhk z)D?mNv!~AqAHX)>wDGm|AMMUa&~DxFqbE0YX!?Bh7Q&xtsx$ZHo6dMAaJ11achyj< zv14mK5`#X7TejZIgxeA(o?A32I5jX9XDr^h$5ayd;mT6ee1WxzdSLD$>{rM|xBoO` zwxX{o>p2~#V0b?OEeG08=Zo0Z$=Fg{i|b1ruS~H|x{xlEI_mx}p_Y{oCH<{4Nnpd4 z|Lb)%TohW)yI?M5(@+QFG-9CAkI8GZ63)8&|1QWs)ma8_rC?gr z8Si1I+OM(Ml@GU|M;&e^oBnM=AIN%g*Z$1L=7Zi#vv3gq6XO5)wm9&|#q1q`NfKg5 zUl~^hQaz-UUZNZwzEu9!&n%o1eqUIT_NpU9Y4?llM>u`|h)zqB9OAcbe0{DpTeD_) zxgKDPpyQ|wzR?tD^M_-hd=_4%t-sh{%SO=~d3WlDwZ-}o^5iY&kdZC~lo9p#fc>Y9 zQxXK$ZUY|bLUCizm>h9cz#tPzs>gSW3@JR@I3=nu_W0XLbJuyxt*gm9x6fY<$kzY! z3Bc5aE=WY+g2noNH~*AD%fY6}yj}NZ*BNO&u+K~3s{NSgqq3M3Ndjvk*zA|T(H6W& zML}WsTVeC3TtdP5W%ED@%&Ooq;R^V4#1^-U35fKw^WEveDdKX!=0%&vBR#P4cLsk9^2)OcJGScUohfI*-Ih8JLH5iP|u z`9-+GoXf;$eoGgh(q7W0Oc>}_E61J~RPA?g4pY)eM(`(xm-gviqD64}ZCA$XvFKw5 z*2wxM0SWfmSdIY|sIX?EE9|v^U9^qQ;2qJtRpX7D-k@l0sKef;zHDW|N{IP<;Q=}U6q6$jdRw|TLSbOFe*YN0{{jT8phxkyXQV;EFLRp> zpg7`?o@uj(oBxS=s4-z7ppUUCkctqezV(@?c4+a-kXVAL?^!I5fOkg zLns{I3A>f*&S%rAQn^{-dbQPE0rsey6^#z5=`51c=x`K4Rin-;W3I-Xqqqk~9Sy5PmAo?jU6 zqSLwI?PsjnjQ@Q};Vh5#_1^;9eJKszUNOC~t;jbcUoqo`Q+?{P)8VoR);wmATdlP~c~+TtB$rNB_<GP5#0l)E83lT{phO#9I}@R=85+Z9`&dKaTUx%@fu{Jm0| zy_K_Gx)MPD+ix~rug#&j-Fd!@Yn~_8vw=wqP+29aENlf(GWd%Mg=-0^XBWb?*5b&m zASU5PhDqI+qQD-})RH!A|W^g;S~= z-91%iLfr)fUig7r&%@wMnI*BFYfnt-pwE0%^wpb12)F!WP7M{?*brJb!^Ko`#AF$o zRL`A`_qIC(Y1iX5@a&ThtivtaNxGP`M_t%3(u&Ya-(VD0XX{L9eBh{N0iZxx5+kLIoU znj7E$NHux{5$DULd9PB9dFz<8jvf0D$>g+!BGQDfFhRb{hB3X@66JKv{_7X&+zc9DZ~R6F)q*>manAXSoaO^$m|3Ueyw@o( zy1( z{ShbBkPFpb@qZqJtOj??Fcw6ndmUU$XcDlrNMOe=mc*Kn0eQXzDJHAhdTfDBFhc*De2k5|vV)z(=2l z9sHB1o3B?)_SQ^DTXHT#BQaR;s^17nih)%kP29|OL>yvD4}@73Cx(xJv|_9>=|s90 zPh`o7_YZ*&0LU@VzV^UZe41!Lzy;p`15uWis|m-7E^qUrdw=t%|2|Fx6SCbu3l`}K zDIEn!j+chomc43%rTH5Iwt*F)n9T%)L9#@9NjDhcf6lEtSE7rzX%%23-Us?;v*uT_ z?Cq-HE*H;nLg_1BV0-!1>^aSDX!*aIEW|rq7=A{iB5IL9ITt#*1-l`EHK33u zo@2SnyI{q=Jr7a>^gRpu4Exh#C|Bsp^99VbS`JFBr#ct6voqk;Zj@^(8u(lBzMnr> z%sh2R;J?>C`1>QZ4ZuaS{}?q&Fy!iVTw=xTbLF`~(jd#rjjuJ~vDp(>53n2rUjA0i zY@g(7J;X}J4a}48k~b$JNzF3iQSD&tt1r27_|5q$yxig2QBkK1F3F7Jf0y3dHUAfX ze$eYQV9(r*jpFAyTdX-y*lRp4QhYC|@Re3+oRmu$4@Mw3F!prdnUOQ@d?=YwfFZ4P z#o1D=>ihu9pXC4g40fscAncVIdhu=0kduwoT2>cq!J-tI^8bQ-xsd8=z{4f_n5|#i z)g*dYu5!eh9s6cCHB4tZpfqjA$!ae|}DDh2_Z1*}M8(GOf}soH*8%YR+~Y>x^-yvx4T_#>kw! z5ohFitlBx+-=9nL8{0`r;Nub7(A!pE(M=7`#`vz|Qc|BMPilbdw#hf;22r#slbw+r zRa4Ry5@sVaS`zCK7V7oklO5Y(Ae^+P!uMlzRl}|;%EmtkmqScs9o$%?{(8**RVz%F zu6~Y}NR@<<0mr+XgtV=-DD?^)AOrzUmro4CDByZ#4^B9A8~b0MiAnkx!a+;ma zu`>QC2n#t>JO@A%vKdCC^wGuBx8&gs9=re%=zjB!6YoUQv_v- zwyUpY*JYqwxSmu0kPqd-6L7>gY~$m95y!9Ll)0D=yT&Ajnj9`(8H2>ImM=2HPpE*u zju7Q~d)Ev@`_WQU7&SXY_E!gfjDme-P_e;!@&)?76Yry&3izO~g>TI2nY7<`O<&S4 zZ1NZECel~_xnutR!%N?B3K{ZDMHqr_UY`R?OOm^Kcj4mUY+@2fI&$-m&XnN-UAU@> z%9z_l3w`rWu8hJu-CAgQJ}J8@M~v(AIu0EhC{&eVf61#+h4SI8!2T}*#5v{H{NH5X zPwh4_j#j)V@L1;M`fA%{D%;F!IS<)K>|kX?_@-F9d5P`Sj05iL$=BPQeLtRG zjBev!N}+Kx%#Bxt-=1$@40EeP6*qnQ-?<>1CE}U#E8j9^GYq;_KD!(mVk(+&u7&K} zajgfXuKxB6DS5B~L8D}w&42>^ad(%N0#QIdCT`v0)AP?L) zP6DM-S(@D}^|J4c%D8)d$UldV2hx^ID=$c%Y4fpIf2+}R(o->X-!I@A@ty*yw)II4 z&*rv>yf)>|cdC{eXm!Vmeu1!5dj$Z$-aid98M0=_bE`zyF%EKbbN{-W=mQvV)h1>b zjE{mEmW4uAxp(HWtY5w^WPKD8|9_p)}2=9|*BMb1ro}18z zJgZs+FijQ_(sOI*jm|u&-@Ob`|9A>l^My)jyESH8_7y2OVzn-uH)P0(I9nrhsUm%ZhP{A(5uIbS-BD;2}1o4=d%+ zOE)?XP${L6?>}83G8vHcf?c$TbBgmIaI_xJ2%)s-S*Krr!McCWQoEQLMfecH|6Xahd_Z$VO% zW>t?L^6SXHjvMxy^m?w0BX;>24cpVii>b|f5BSuTl|LLT`uF&b6ej~HvPdAccG69? z)ngjISdGzHxL91b^8VCif6=X=*ZZxvrUg;vGXOQ2|8+lrd%10S2N2YKG$X%hvW8vB z;pwe^ox2b8`_d?DQQ_)j4LznPZT!=1WV$7qbDp5@TC57=0+RDqp$z*=s@3^W^(gJL ztp0(r?!#x#oPH-u+TKsjQ6$bqmfR{`#h7DK%5nAr|NG4kI(KRmi`8avr?*ISXZ9M4 z))Me1u4!w(2O1(dZ`>)$2ldN~(?i&Vo)r;jMMcg3+>O_rM!Dr$=3QB_=}m7;`eK04stoPUbcNC7-3Os6+5>dl z(^|Q*fc4)%<84<4v|o*W;6AIC8Zf_K=6KU--Y)DXFb(+BjbBMr!*^j;y-=UCSD?{h z8_pn`_`iLz)C*Yn#Hs|kG;Id~ERxUJj1`5V7xbHd9h45ra~l$K@yaDIIL9u^6WmBf zcA9Ews++fqR7apHsjKx;fhkGvGooPmE4*x;mjQhGXx9~kGs`hW}T!f&Wd|;Zisx2JUR9u1`1Bh-j=pT)4AqyyB31nZRxG?iLrJ9 zHu)QQZg3*H&5@a(^U|r&tn3(yOvX6u!e4-&?E|j4;B>kM4vCC$hB#LnP%T#&A#y<& z9nj7gTp>)l1%vK*HMS&8FZL0yH-`niXXvES82fyS&7MyNVgCT$%uKk40XMCr;5-rJ#CaFkJd z-RA50wvc`nYQ9^azz^o(_l@UkG%#BXxrDm9E_TX3$)tI@Z#JlH^&;mglzQN9Vbr$O zS{}{SEX&}XbxK3vp(E6dHa#`lrB}O;QOv;`-^~5?0N#UVpI-M2EGDRIZ(!7WCXeiV z>HX5ksF6hA-78XTMQ8cVL~ZVBRBVD=mn~Hyr|?#8ZB(;(yL0hO zjm;QZ^3kgtmiCfp=Bu!pXySmA4cfs7wq-bf1wHDua;sk^==guj?nw`{zzVbn_j2_Y zYcZqIU0}SdR)aK$I`I3+Gvo}&T$eX6lfr@9Xz&jE$g1n_+ZV^_b3B(_%qb_r+Z~Z~ zvzG9BJn4C^4c}qPWqC)^Te;+0e1~BYc{5r@V(3@^$`1-CtNEsp&5i!wO{I8%#gX;H z_~6Oj)9Hr_!ZzBZIrUhLSoMI4-J4B>Rg_hR)!$qsPWVAUts9Q~CrQpYx*z+s$J46I zZu0Aam^O;Fm{p54E|gZYF-k8i^OYl4Mhi_HekgEvbJsPp@@QqqZ_#p3P{y8!K3nl&G6lRX&6WsItGYtY-3 ztoBg4`K9<#_vFD`xRU-zIIwSBf{aM2)6R^Cm$w|~ zEL>H-(!9cjEh|m6D>wb9T4d!{spuGwo2VqQ+wl4RZv`!_NM5#fUC!WOtFLr>9juqTgfPsdmquI$l%~_GeiH+u@sUvgFX^{hk0BI<`S5x?Vm? z;&rIj1)QJh69b6567zY5Ft)}2-T4JGwiS#~NAr%BxCthUSPDO>eJ3w0mg}6x$9yzD zd-`PLkDbvUD$Vyri@lg-RIO4OioBXeNKLA5vT2vizvQUzGzV%p{s`o}ouPHbHlUi6 z_BK;by}DT4w7;gVjzee!*{>J(ihALQH}>f~Z*Z|)q{-PuVU85+7vGsB{tn-va0&8? z<>J0@9*=0>X2?Y`7r!Bz_k%-` zrp6l@c2bk904&a?)~~nq?5KKts?=dWL&yNu!Z{>E?6X1Qm@DB z5fvdXJF41n;pShwM~KsX40S+5s%L?ApSQ z%*jDjGHr2b$TNhueCZ=537*tl0LZ=3pdi=QgD%MB2Jm=$DKU%oQE`#Tl6M<|VO7SbV)_N6etMFxO1^1X#&Jh3{*EDsI#=WrIb4@co&< zpIro|_y0}56qSV%&t$k`6_>;`gkyv)cO&+e1@0qjfgE(v?I9$ts(q=w0>%nw^}lZ6 z!>KLy?HMU=2i~Ym3Q~JY*3t6j+1AzFSl=3t{Ayax<_o8usx+hqm8`*w-LBvvFQK{W zc6ABkSfA|maf(%vInC`ZEpG25Sz$_U4nK9ja%SE-a>Q(K)!o2l1NS`W%ARpLs$Sh~ zXj`i+lyI(MS*ZGEf}!>aWC&lBtaL>RHg;Za;Wbb5QPqZ&1aFBuLExwY8~a2s&6Iv? zC(!ALg7~_p*a_~^VEBM$SY<4g3tA&(f2CG@*9oC-P9n_21~sG*x)^T%a}Q4a)c<8% zK9W(Pt12raRljx%^-jrM7n&aGmVEsv(XLGPvJr)x(_0ip1e@t)uo-3Oz@uMfKn=)G z^BcNp#|(BX%SH_{c^IZfT4??!dPo=;@A(Kj*+Kgo{0yB#lVAjJgU&gxkZ>%dSq;bB zz7GIBu|mQ~$#$Ag?Cnw`=2hmErngtIm0pT}d%j?3+k0$As8N-*oi=zl0!(ZqQS()U zN>vCIjMe4!(TN>bLdJ~f)0_PX^#Wr^SV^rfOEb-CX}(_|pS@1(>1u}r1+rKrVt88T zr_J^Z=cZ~eNBIxF3D%`1u{t{8T^)q>St>zAD(*0Y@U2Iuv2tViWpz?H<4^kNo~q3F zZSww*T^=_b4$5uJdGb`l-v%2lg-l`N-dG$Jy|I>YTbg?;!}lk3HJxOyzLSa{VU%WV z7GTASFGV6$(uimKS!zY{?wPf*&428hOlrBL#O&g$14EX?XA+E3sQN?X&DEbj-}C9s z`eM4PDrR5LHk)(WU-q()o-+sPx1!(kYQ2FfOBZu%prt8T{y)dmW{t}#O(oe|S04r= za<u85kJ-`#MT>#C~>g)DTO zByk!TufJ!B9TBXMeQ7jAmJhLqId_Z-KnkS4XE8$IE!t1`CLz}Q@=*-pksV$xU$;q+1BlG^36yjh5oh{dn zb18L!jr*q}Q&qjP3$b^n_JR21yW#iHul0?!rN|^E!8n=TNfulAV1XdjU`U7@1my&2 zxn1bd-6%4_JSj9^wTx{(=6fdf!rCkS!@Ckw6lzEtHki52bnENRt8Pir+{pGHX4%kJ zAkQGv^9?L2N*Jgrg|qB^jH1gcTy~FP4R~T~%sb;TU~p5pnOFR#(v>R%KN=Ylg8S-K z88O8Q@hUA>yjVOz_@}(q|CU<+Fh5j+@a_k~VEFsM{I>a@M-T7LY}4f7imUdYa)w-C zV!Jm!%^>9=91L$?K}$_1-?NO80xDyrMnBvwG`k5Tyt?dTkf2FL7JjX>_78`giCz&k zhMpng4>Qi0>-zwT{6JKgYZ2e^M`^Tgb`=<}=Lj3(k`g&$1@i5R61ka;6mgN_cJAG~ z!1mgSbxE03OjhvcWo;^0+O^+}i3~i8A4pu^1L1hdu_v9E9_BUGps0AtL}(P#VV-?} z7`>1K&+ey{n#X@yK{F*rX(R}npqfY-zbkwV^N9pq4PppD1ySv64`{(n1+zQgS3m1b z=~{Y;)rI}S-riE`CC?#Po7xkgGhc6ydMr?H$GzG~@1gd(CQgp8HEtW{;T!yjEPEN- zQ{C}ZO6ke&F$QX9u2Lj%zdh?cK%dEqIL@P->{scNs%HcNso@JK=2_SiiMm)E-%0Ont_N5bzi=D>AiF-5U?$gZzs2b>d;~nis zf*sOtp|Y$B6YcAw2KL1f{9m?^iuC5rt4BHqA>**J`LCcm^zccZ4s1$c*?W{QO2?|rOaWiN0E1>_otQA(VvZVGchAEk z@9I?hgi#|c`5awdUywy({*yvGWh^ps(QRc%uq<&<&6E_4IcrZ})v_E}0@!C1w#l&E zS#I5VM%57+t=* zfv4mUS#9~MojL&RU-*p<8@5lE1fe1<)6c-ItMuEx4Xb<~$JN*#SnQ3>s|{DMj-z&n z(2QrwG`?bsJNJiZb|DTF$fSXVZkIt_YsvD^nnGlpl+1cu=qu!QX$M-;M{SkNs zO*Oc2HG}#LO@d%P*OeC5W*iHHFr*yj#H%{A9g#LRV+#{% zXgfpmJLPjrLOKjCI?NJ$7^x|mZzR%s>Ek{*V~Z$WVJcE;`s5(M$g$z0-@dDfOq{FA z7r02134Qba&-bl(oSSmcx%JwLU@2~&XOKLTTGWyKxzR5i!ogJebtUtam} z4HHI<=^VbfWmnnoo~6YAl|8eQmIgbX4rHOb^-9KN$bfl53sI4TP5N1%W?0-WUPBM6 zAg9B&z8y>(9B@X7(>6|VHksaSw8wchdIZz($>gBvXPnRX7xJb%E*6(Pc*gi`Aa-7M z2T12-YL7h@oJlOlYT+Zh%e3KNpb~iVetMVeZrO#BUt#-tJed}y-B9MhFO>0rfq$rr zO~``|pkj1G%uQsjMwtZWLQiS3ZFR2(z$+&LK3YX59w2>JTP|E{!Q1PqQN5(=19zh) z(i)+q>y2Q$*(})q-Wod7P!nI5!U^)%|D9=@{aCz;t7eX~`Gy9}_P0;?;x|N&I2VZA z63|DapJ+(jZzymihW-i?)AFvpduH6$N9f!JFPvC{JEYcHX872b(YP6w$$sl;9LXR` z(C30|8lMtal}vf^=GaW^Q6jmqRw5jbV0=MuYH)e^@t0$=QKYj>KfG9QkLqOK`sK?S zpOSIAfyf$XGXQ1Qx74!} zds9E7cV<2Qt640_Quw;~x@HH2`{~%x_gbdNj6y&OxS#_Le&g|y9OM(Ntm)<=17djb z1!iv2iCKf_{IDbB(>K>OJf#EVHKu;3J{(+HexL2Xlv~Bv77`NkGv<4YUzca``r`2S zBF4@@wbd?JBOQn7`x9X(BulJc?B}?u?Okf4`sBxO*ym&^+EbP#gy&}r6}$GTrDdf; zzFJ{MS-k>SOC{JwJXy~--8@idRarUjg%Wpq9p_3&-a` zbmHi+|F4bbl3@{@L$i9(LYb-285B zG*Ruc{ar_Y0?;gJTMGbW$P1DWJMp3`!PG|UL%;iF?bGBd_T?fK{k|yj{fMMr09(VG zw2I4X)6G$>WMx=_O&HphiIh?3O3KYE5fvKC`BFy*B5Uo^Q-*%np&)jaB9!E>3QuL0 z%AHoNtqF%fwKFAqNb!)&*P7_Q%XjeJhnEZ1-m$kU`R3{$ckf=p8y>#)gT6Hjqw43o z*61c2LNNcm%T$L_f#W!P$k2S|vL)QoZsGqwszKV{GVHMpZdY!I6NVcnHN8tHeF?%{ za@39_OIc$@q%@}vY*ag`5@Cmi*nMGhS;IC9Mi)}XM3dJ+)I_@87*5yejufuNXnpLv z(7=N0+?e<4yzyV^yXCV7yX*x7>|8BoSIoXz)}kNkSn3JlTz5cx z#92st-@Aw#cU!L!`!F7-VfCUywwJl`Jf^5l+&cxu8kAA7&@L|6h!?fgMrE)uIw}|i z9%ayO^i{ZNqbSd6N@84E0G`;&sGlmFU#l&q6{a^ccHRmQFD_K43B07^tl>4)8=u8d?^`!QpE?@y z!IIm<9g0gP!V$Z1_#z=5o}4PnDuKxesGGp~y0D6dGW*w9`Za-%zQh^UvGIxesNu&_ zImk6cZcV_zq2}D|LjUHC3jHJh=X#R6g@Cb*wV!7e_Y`Yc`8rnZbtyXnKzwlBz54*8 z&48Jwg;Dk`Be#(kMQ!09dfjP{#(HO-HVd!~$sYnY)Jq-MOgg_pS6oH`6a0ruqk~MR zU#7xGykZw!9*q1-E1f?F{Atm>P3 z2%GFR8{if-Ly+lM)0I+Ou76zDK89!j;@^Nm96)2-XA8C3_Bh@NR4SG)W+bnBot*D~ z-p`Ju)e8_uS#vWGnsunQ4ut4y|GOwp3ZxMss0B#tX{1pto2E9~{FTy049=ko(mxrLQ6XxRp zNUD4|k~GG7(G!((rcY3Af)0Nkor+OYi#hpq6;YD@!j@LGbg-`uX3j|Q-h9lB0JwCmBj6QPO{*#}~_|E30 z_0A^lUNU1U5i*~~GLkl;k@5FxjC_OIpZRf&eahbKf30u?SrzD{cJDK43SmY?}7>H z?f;N8WDOf#_=n$pPvMFqyZknXEn@)jyISpM5!jSU|dObt04Iq>H8*4DntR7mr*Q z(OOu=ui?rt|6TdIqMh4fwvkPt!8{3fvi{cTEc}7XnlvllefY+Wt|wPk3rr9f>V968 z`t8pYw0b#h*QXe6g=EFjo4JB-k9UwY{_#X0z3o z^1em!48i-2G?UU9!tf2N%17KF#}_EvB|AWQjCR|#YVJ)mbF{p-Plc(ybO;`o zSOZR0t@%6u#XSXQV<>CYa?#`DGdeAXMzxYBWp=J~I+&o44-7jxg*apR8U%H6kHhGzODw|S9ak0GcU<2BBB_2Y~37v*0NW$(V> zQ+bnN=p)l$LmM4V|G6knv{QcsF+TaYG@bcs1?6_ywE^90?re!-HF=XI1(EX+F3%B- zH2$tth3Q(%8I-`*)T}Z@LJxV zfxPcZ(Dl=O0PQ|>lxQeC<-afZVjHEA0e5FqRFt<1?PaqI+ltyiA51)&Co7~Ci9595 zx2#M$X6wtb^eyL$XqgFe>$~4o-ZNZ4OKAe$>)TqnrP&j!%96g>KC3 z#_?|Bj`pfwt}-+y`F}AtyJ#*CzmI<)N5W(u^BgaVb}7bYd-RExR)$z5l{ZPiOXt$e z`2o)E8B85ZLiHV($nIoVmpy0;38mNZmKg%(95C_)tGpb5xa`^@%*R71aL|f=!y}^- zIMXtHf$d+bJ=L5gfF&PK5g8K|dViV|#{B#iml{`Huo24x)>MNrj!7%b6u7WISuGv% zQqS?v^}URvrFB3ukF%9G`BLlVRk1-CkY+YNeu~kLN}lQDq`9 zo31(!hlwi6TAWN{VbFTf`(u_DIsRrL^Wt6)aD`7^fAwMfbAeuqNQ z>KW3VQCQPBF==L$LVLg-THoeexnP>1I5T$yGN>UwS#OL>=?`R39x_b3Sn6n?MhBZqpHu zr}}E_?N5&H^VsFBx=sW~$dAf&K!rOqeV_IpTuP^fS@e5#O^Pgio#dNTkEW(A4br~K zt)U2pOb^tti?q?AX+`|@$#_+4^U_M~*4A(%|9%6;oOp;q{uJH*Yi1PQuvoJIuwhFv zFaryOki)SVzj5}D3(diL{4KEw*oVOmeyU(+K*jU0=Xj#KVg*R^1b`9!T?d)gqwNj? zzHEgA{Y9b0qfWv%-M_h%(KgSnyu92D>u|=J|9tN|7VqC z`gYQ@o_$D+clmVrs2iRk-E%qph>t_CvU~l&m&I~`H?O6qi3+R*K*$W)<}LljijH}J zSN*y=?x6RG)ChDMT40JSp@tSXoxO6f;V=3d@K#1A-m zex>o;Xw|R0jDVttD4YIp-`^E`YUG2CbfM#7wk(t6GZd{ZdhyNwkE{2Nr}}^Y#|uSN z2+59Q78#+etTaTjciCiw9OF1nMv)n^!XdKv9>*xz>m+-RV-)8&<~caV@1c6VKi}KW zA8u~-2j}^GjO)5z_mQdA?Dx3_^Ei{^rAG2Ymquen(N+l!v_BFou&Ur@Mm%(G>9H1GeIw98xp zQ-ozhMY^c7AH7VToxdNR)zNoVf;)=MFXg&ZWO=U5^W+slofGDHFfba#LQM182YWtx zy^-};=#h`V-%PRB1zZtmFo5OM z&N=!_DU>p0b;L4po50uNpx_{6Rh%J5*R(os{QgZuhn!6xt8}qu(RXG12lF@F%TJ4F zfk{CD8V&a_SnvgRF-G5@C|ch#?D10AiT-QB)7-VY;&9N;=31K+)I5ZpypYaLT0DnJ zukYvQe`-#e?+1~nEQdtRF)@pZ(bR!iFq#cVjeNO_<=oEIP!5M&VP@`f1P1kQ-F?nV z@1CK$JX-5Q<0z&BVz_=@ODOc=J^Il8tgCoytT=8CadtjMn^a)%X2$dXs&MnXs~Cxw zRgx-wRiD@N_kKEgK*qFDX@6M)za5G35ygyU!GoLMI7+_~`WUw&_I_fpTC*{zGtifZ^XjV^ z7-7nbBe5o?vVXGuw$%l~`?bgK?ryM%V!h4^yPU!Z;(Ez0a9YP)N$nn630 zWQBNgpvI9+yjkyia1f8q6?GW=A6W2|w2G8;xQYE|#B~ z&d*(Ta|kkO4;bOI|3Kb53WA!{D+gn322Yi$xyd+)Fu|IoB>?5v+_u@yCHo~ltgAtoZcJH#J!Et6n#Ax47 z>s;S23Qe97qDn9U@tNyRq*}ex%Q8oewgKnPIXO}vc2R*`7SAxDb3aUg^=Tc~w=Ah} zskEVck#OV`&_hf}B!Z+bU;?aYE2%jNq6D;*EvbJS3hOZ8+b=_dOCL=DnJ*v*-07+M zgt_iWY(Dyuf!Itg3;)Mhl-ZKDsmMNUR`u`^xzZIgy$(!N*Eh>9+u}(Hxgsp{*_<~& zdcV4Z!$SAi*3+}5AoSzIoftJsu;U}NQm4ws0ZqT--ra4#F#HGW3a%uHLnmvEcW?w} z`fS~y$$qRbg&nnXOW()PDX`o)-f21-sgES+s8jqRT=e2yyi?BsFQ)iqSxG0kPFSp3 zp2hE|Uh=74BqK%my=Taj{-%u?Pr^mxY`Kh%FFB_+u2-WE=b*yJeV!iWI%w12=#MlO z6CzHdoC-Ez%HsYgE!RA(_|XQy%(m{fokb#K=+SQ-mjkyGf5y5SAGq;>9@a3%4TmjK`Lgt@x0S~JIRbRNGOWI^o!3^nbgHZlQ`YU!dzJ2+?9s2vZ#HGx zUHFajPi2$X>hYQfB9j|+_R~ke>w3khI*GhAx9AzLYjAmhU+=Lmq#4hh2;9*!URH2A z@H5D~^ib(VfjY9<5qpBkZhyD#hTQ!>9tG5@ChfVT`~{jtmpzw6MqCb}9}AVDv>1$&u2yjEXPw(-VhqT(xTc=9oh`S+PuJ%6 zki=@~_1?uq2b2Wirr1ye$C1w(_fveRN1#4th7{X(UqTv(48++A;8Gez4c_=}s(Z?{ zI5bKZD;+QJ%8x}n8FY@OIw0bS8fQ@E1b`0~*wim0}5mM0DbIET4I*`tZu zeMv1hOT!3ws?}Wy*ZF?n&|^sGv@IrLwXFX-2haX6x|idTrUx)(X6416Cjs9U>fBdd z!|~z+1MAH9T}liyzu9NI%-nb*mM;!;BlD+f(o?Lu<6dlO8+J|9f}y^$8V)mATOL9R z=4zjJuhA1dBRmqY%;Ymlz!Bkhi^Bd>)`V+y)FNUMVMDgdTOzsa*r8xp?NexfZ_#BPog~dgIM}y;gS+CX=Y~Bs4h`r_^c*OJ0*s&XusH z!Hu+}ee`*_yUfLeU@T}|-2A5IlMZ+|n3?B&T444SVocfU z@8#J^vC+K|R5pNMnF2|^EBl^LyzKXsD0^lqTd!zx_{;IYKd!wLBB%6$hyIa6PZq1> zDK#!6M>mM>aLY3oWYso=Wjv+8yR3IP^xr4}7Keo_K!p^p{h0rTK^gZ`i}wm*uqTIw zi4Dvuke49+r#KpGP!(pAhFE*KGchHB7%Tg4IB{Zpdp-M_T6C}PW+yMf(Lz*V$2O-> z)_^0Mc+n;=eC$ghoP1#Ux6HEg2>WlG#`(*gqKy&FwL_X3LLWKXw!3^lU>l$C&CKIKdb%7KKYo2ZAA4uxhOfzqHCp$`LM@tSOQq>PYelPt zd#d{g(_7s{H$~mvknd7m8?Ssxzq8vod{I}dA=!Y*TV-?8?J~0aTvDdVr51&31A)`! z@&z9c=7ZcuY&zBmcAlvWny9uJh3Y?o!uStVE@ZGegD;j{Uu>#b{dO-U{h zcLDuN9Q|>$$ITINj4#h*+?RgY^+clY!rQNo8}gCzJT^~6C$>sA%Rr-RXw-81y<40C z=E;i4?S|e%x8$^<|NNXX+V9F05{K+iTtusQlepFL?9BGf6z2P*f+EBigEV8H-8w^< zT+7qR-~1}-Gy)7(N>GDp&1WgA9LAnGPu1PF>4|Ult|y26zV%fdrsPmendDuaSZ34w zEM%kA#3qW!=5;-C=JwjI;wsCJhVh6+_v_Zt@KLKq+>0xf8 z_k+uuOfC4i7gW@`F1@f-K>1f8i5!TDRadKcjlW@@p_BTu-fYaI{QA+~PZaU&T~YvY z-c7@C`>Yp7K<8GUGy+VQTE0h|S2zu%1%Zh0>2>ClxIT zTdOCuJkS9Nw@b@?u)e$sun(Q>cxH7!reX)EuJmPX8J0whrb9K9KHwk1@aG}6e9rI& zuTCj!NOMi(3wPpL^IIz9i5_BV5RIEt8p< zdF7H35Eq!Bcg9M?n}C*1@rpCk%qIv!bgVF(yG)P&G(Rr~15xH^%)-DdcvWHT)8C6p zMFUI#n|>l1^ha9npqU>UU?5j1F|uN6rAC`$X>TuR@mz3HVqK5!MG!1DTACru+(AI2 z0cJwnQ4JwnK&B1@V-I&$hxp4|1`0Dsk7BFx_Uq4?aKM)S%ir+mzbA&vm0*`Tr%R}B z(U$tbi&0W&r&uYywynCB?fdudck#I1_>jQqFjW_ui6=t?}A&<%hN25cy8g?M9hEDf~*^XIO<#Et+ z^WN-%TxCed0}$}jZt{ILZtRN+(t>UEwY_}>(dKLyFrkNqgLEJ3g7HJ24_I?(y^Rgf zOD(2>(ZTt)n;9u6;EDE0;qQV7q%j{q0CiNlnnA)vu=b+?hGe?Dxo+n3B@aZqk_n}Rt=6T_LvptIr z+?Vz{2P|r$QpSpJ=+3-1e0+ZTP?Lb2;Qjp92I>HgX>bfP8H!zMLKSYlj5YCnGBi2Bd z2SkN0^!R+W<#}h9ta+E+@ATt!$jy{WC4CLJgn4!RO&_H{ICfA3+C z+nU#y&CJW78^h%z<-k=GR&F=IlV9W0WWil6#TmG(`t2jXmKwJPiFa&vsF#Xh+UG|p zvbA#S2QvT(zhgY_`Ox&%5(R%(DHO=M^`cd`H=^AECb>9bD0Z z@bzmeh?zsd@ zaTEr9^8-rxZyg0*=)8Y3T(8&!c~T_GbKStHnnucDeb?6KzV~vM1p%(R0IJ=eM;YQ8 z9}o}#X|!%NWtDpM#^(iMs~lZ#V%0(U3W%i)vtZZDRKGR6BJOHGu-pPzG%q<*{bTyA>9!DzeOyAD$jNjFq@Iqi~uc5E>O&R)QipW7uD(uHR|Q}y35JWVxP zpV}paShcY@BM(11_;6T_wVQFPLQ`?Jv?|BN2-1%I9#NlY->qeG^Oe$;CFw5J7;jj2MCaBNnwv|v-_7?jU-P2cfRegIM(LmfePtf+W%o)3$ zd4z$ms^HU$i;I;VP&X#2_OEA7Kg9dcPqJ+5DB5Zmz5k)E0-cKE=izo`;Ym_G-=!o$ zzF(myXgMZW^4E0_*cnS)bvhn7-Z#rfon(F(7F`QD2KLI85_aG?7IXPEbBKi7EFZ5F z9|=r)%)nyP`t*~L#5H8E1bgYB*)hnZ9Qj2&`k_RvV^Q+p5cu0v+ms~QME+VpZxzre z`sn8nBylS%D*)%QclFs_f8pxw;6CzbjfHs2`Wi~=Np(01N9CB;%@TfJ>gAnib3Ja}P33ikp^&OilTy ziJNbSXG=0Yz#Q7nnRkE^#f8mBeb&VyPOKMh-Mu?5>U-Y1FkN=%o~X-IYN(&vW8rK5 zQy=_wHMGC%MN;JfT9mR&!@fGNdNSWU(*M7T)+Os|*|nk>poOZk3jKP4v7L7C_&a=; z`bBF915em-4180gS^hBlSo|RMcnh8f{WElY0Sp$<0%NrOOys9iL_8y_9ngt_MK#TR zizmw`=)$;kbgBi13clYn?uo?A!^e z?de$t?2UKxrkgQBWm>&`wZIOe3$mGXRoqx+G^{L7J_v-)4$SEF<5La zR?k%A+p^hVK3pe-$ap+&Rxzn`egA}v-!;z0DRb^F)tL!rcGL~OvnC7H&7m;e z?3V6J)6%|O3Ou%rQ8AdB3K5eeYV{})zhi%;Jjh1gqU}7A+=eE^jiwY?SC?m=tQ2%H zwo^_H=Vy9uN@T>geSss_R^!;IGMTIOUgz6#HQ8}23{(_XQFcQZ1Wwt3+T!wN)|a4| zHH5lmlG4<5?bv@iD@4!itA$^-s^HHGjT0# z*gjGPZZjhJJT3TF&$gY<-OVMNtt7w5dWA6|3-;b|5EygN_H|!*EopIY@~i!{-q-u3 zDa22jA8;LoXq~@FbSI~xn!;#bt8+(we}m2bF<2?(iwLmu2k|FAyX8Mny`jjuJhtz- zeta}@T%NZB!3CZC1fAG;OEdpHaQT;F*O_Nml}gn*3PymD0tc4+$!FeU#>j5T8J~f1 zwdjE`bL8SVi;Ml6?}-Fl_6M6u=)?_m`_2HavTO^Kp6*&=FlO71+%+S&uEB)8vh~|Q z)IX>H+F!5z8gzT7g&q_rL*$paq~qsZ+&M$me4L(_(+3Q!>=kH08D5#QHGz&VZ=AL( z6nG|#-L8({mAYtArBS6XK0WZfDCi=aK#pxBmvrcvk|f+chsf8gvfdxN@Q;Ec{p!M* z2zWO2WGT%{J^AT>?_scI6BRXHGa^$C#75>$JO(EazbRI=^NyD!n@X1(0mrWbMvdah zUvR<65A7;aY;d-2MTaLKSiEsyn7A5 z>hWu@_oIfmdEbw~&FN`VI?PL)6aOusz}BhKbL*DBS|$w4*|yEE?Uy5CeULZ?Q9-Yr zmwy1l1RwEnGOxE(gP$)uSaU(o#9}_XXXb{kjovtev-@Zw8F$0LA6EY!lbo$_sU@x2 z>Oi|+y%^6`To>tA0b^%o7M0%RE|dHz(`zUIi@yjLh9QjqMWTX3s_$%G5AD}dh)0R5 z2hGn?chv_TIi{#q&wZo?6Y3onDqRy~y0+&QCf2`en$n4I0WaRX-Gt|N|C(1_LUlKG z^yZ8z=Y$5jAaxMsq8gM&BF^38NY7w3;7G{Muj6 zOcf>jGK0y!-HYAbxK#5t(~jNW4=OHhAGh&AuX-flTOOFI0?02~_H6pl;YN)b1J*rc zFeByYffwpao~m@QLCJH!;s=$eZ6kB(*S|iT8JL=y;&j@!Z3muP{mQQ*zj;`AdXD;U zUinfUo2vm0?GXAuGZ!05MS^4Xl(ixeeuO$6tD3yao+B{>B&@q&lx;I|a;M~}9NaHZ zrBS_AET1%^R4I)TZDaG8d=a-LcLemFlcI9ETW>NC04s_f>>_jW_)fkuJ=yV2jd|tH zIdCS~k}~C3FT2rCQ0-@xm+&o}x_K=5a=5^{hg#xU1kG}H-mkV$NOJ;d)|PqkR}hMblNI?au~sd zOql?Y>Qx&O8s0)X1Og*jzet+XYj<}BXF!mqC4^Ua$FA(qkiPP+@K8&VD5NFbinx;F z)=1k50sqo+4}oHX?`OlkyFn&#IULwy&6B=?>$Sq;|4|$F(#Bb((eGPa$vE?7G~7`{ zFO)JGx(L8QAvqt|qVEJ?~Rr_yR`bd?w_A95FSf>7B4}@SQ!0qLjYH`nK zN~suv2NMv-lAq!`w!+Vz8-v3$`;{PHOa6(}KKPq>x(v|SU5GxXq@=_~u{Qdk^=tjL zvx_Q|zc!SG3HL9d9g(*;L0@uY1^Nc+Q|JC3&yJ#8Z@)z7@$ z5M8=bm?vw=88%TX$Lm+YddIq?m>GPGtpZE!O_>JHdz#U4+QH6$%BJ|21|22C{ zkP)v>Z_pi^hGg0}G2ysFxshM<)Nw|Ejy|^7AWK-psmDCj*15KkNuij_K9^4My5xN+ zenvl$Ka^JR^ogJj_U`b;w$1z%BHu+|N{RJ#$hvBv0W8+kGD!e{vpf5X(>R5`*JxkHk7x zb&~;ebcf;g;_@FILkoAB{WD+6{@RYUQrT`{ljj;$8<1pO_Xw6#N!N?YnZ?f*7hI}* zJ`CjoX{ELYkI_EqUrh`5WjxoPE5Pvx1Upq4HHRFlQ0+qWiuWg8*(8bLlN-sssZ9R+D?3Iv8(t3#J#KbG5`v)fGw*E>$XoCwm@`M!jO+7XHL#_GnSY8k zm!l44Te?!MsPm2-E?MURxFeX}(RbOF|2Jy(d1oUMDcysROS#oeRuJU^yepj z7xvouN+#~)jgGY+e8F}a02_gd2Y1v2ucqI$CW&g;PPQqOgql1+weD=vFaLcX+-U=( z^*wcb)uF}y@?`GSid|6Zx4NZMdfrvDvg34ThA?(RIfYjP(?1*}dhfDN zc&-5!ul(a#hfq?$gl_H9sk*-+Z=RPhTDRj#_%ncpYmb&mfoDh{E~08tHGm-}?t; zZ$!r2&rskz9~74qN+P}2NZW)k7I++D_o|3{MpZ|;_OXPk|1>e$6f5=ozQVLCyv9P& z{;|O#DS%R5;@rSG(5R!zUR25$jqo&U@v+`12*p&AWQZ<4&PUnJ%;!9;L@qyz4gC|7 zmSFsPU!f|!YzmQ9nnxmBet*r5!RC4uuo1jangXk&6hE6aJ<%ZtrRnz6u53S5o##Ye z9Wm1chr36xKW-c!B31y!Ljn4Qt!)RHr@;6CE3k~eenZd#dzVDI<+-Wg18~cd`r9wx znHp%0! z5#Rj`34C%!bRtV!(nA<^`Z333?I9=GxXnAtQ4Q-TvN0DQ65PIrZB_{WvN?^0 z3ew*Y9EfkeG9R?%3ybw%);uWXc1^t)xPY2IDtZ4!c1r6z9ST2YLuSozDPMGWTM!tsj)1=tiihyJ0)iarf%$>XR9IR909u0@yZZ^F|1hCMrR{GW}+IE zrKBQl@oXq!blO3JMbp8#OfmLN($Qm3JCgNSoi91poaD0F(L@bPDv4a4-Q7Sh4(4hZ z-Pm9lrQ~d>C6A&L*~ywHmWVnO95JEwt=(bBFI(EmtwFa>C~1rgt`D}cV5gD8K0L;? zOCy@xhp^GjLl(^Bfb|@D50h&<&7?9fZ(3?QnILK6R;!bJ-v{^UZl$i!Rx(U-3;O29GDYzYRZui9Gi zZ0aMdG%PO9F>2;4PuEby@&Z)*`k;Z z7EF&{cYC73<8m9UHB&XPZcdbj){fHuZv4;Xy1AxRzlYcrtC$Cf6+zmah!nvU0?FwW z9X%7B-L4;*kK@Y(K~Xs6%JHp;@F?VTLGQH?jLvNs{a8MfcFd;t)6fIK`|XAFZ0zj$ zOW#2}BKVKm>yHJ_RDw?M^qlV8sBby;eL5crpX>y!g2ow!X~DR@;uZ^hx4axmpv6yM z@0d+RCs0>;3F>@oT(ia7RM>WG$^x!Q6}~Eaf~y*LG1ZY%{B&QJEJsk6ZN8!gy5*Q) zU)%0D1e-2yk{#WQIJk>rw$-`=7dY6vZU?^wJ!<1q)N^~HvmjLVy|P>0-u!mecDBFG zn64!iElvHZBC&ET{oTOLG$}S8;bSM5-P%ltz{1{^m0M6CC_)~mE~|Wlhumz`FLRDN z%&Pjqc{KL)TOSE^q-C72j>aD#oPtwG^oAjroKa#B-?tvQ8!AL_l?91JjfXh8e*Pr4 zf&o_XvPB8jz#q+OI$D&Hs3NfD;_(Ct2gB8^RFxjHxZDRFMYWCxC-$pyF3u|VPsIMQ zp=yUC-^sL_y?JW>h`NIxD%;4?q@?LVHRbzS-37)i(hS~jjds|`h5-}cqRcl#2)Bt{ zHOp$9^le*me{+%-W`4{#+=GU()h+%NH?@Ybt>XJ7>NwujNw`@Xxusey|GJA|ZNG@FxZdhrpaQ?`7_%2DMt$ikoe!VNZLZ!+I@FJiY!8Vz^6V9%Y?$ zgt?<~SY!Hd&5!4c4#K*SZ2NYz1j3^DhFRU~+$mhX>N!{1iQn<`D)>iVQM!n68wW&L z?Wl`~hljgRV>=>64(2TuLhQZrf$n3uz;Mw(k}S880KPNp5h&X4kaW9}Jyrgx=exIP z|2>Osb#35W)o83+>O{Z*Y09IW%FeZeEbU6i^uy)2gmrK1rV2jMo&Z@_5AXpB|YM{GB zARz_rSzWfl5jn6jC-U)tJU-!S7<9p$}Y}y6h)@_+IN4+V8mMo)+N4~WU7#&Hq%1sxdc}YrT&o&f@ zJC4loophq30GMD%b9H+4>c_19lUC=-Ofe~zP>J!Bw4i>+$iUqN(6-p=eF<0a@DO#yGO3 zIwcK$clQZHMQy6?qwXU#Tdfn8QypbH2v-RU03+7nIYpqTiK_Thu^iaxd zUHZ^rY8guu^H^#pTzQ~QUcHKw$;+_*v7w>C zozNH3*eEAm4J9~r!%qlW5V@t>`Fon$3vX4_htxvBdLM?*K#UrGD_E695G?Y3(oRq@j&rgN;P?hH=+K_B+`Fka7DBJEYI#kk zsX{>+YQl2mitY1jDzj_>i}&e&6+VNtg)w1Ra-He&$?qzzC;?nO;!4THd5G?y0Yh5jxxR7zL?pt}$#gYREHt<=c^On?gy}r^8V#xQO*Rvm{B#j&_dL z)XducSpBNQ9PEcv@<4BEv3z3#$~&v6Y_B^u{CICx+f9C8c?O5${kxo{2>(DA^9Uzy zN^C~wMMQ6;Y9yQVaIze1|JVBZx@`}&`8j8TvdDD7f|iK7l^$44B3+2B(e`XPEKda# zj(4CuGQQrNoot1ma^#muSC!^)wb3Z<(V!w*lpY%BE%ezHILq z<&hko>Qznc>~w?*nRaxlMwD#edZUW#KgFn`@gO}YI6t>q1RyZEI~j{B=IW?%h2}6O zu?}hpfG03b#)_e=$~xEp*NmE7=79>*QN4?itHy%U>_m6@kScpE>hEKSey#|emh6zvMhmQeC*gPUEqai;l?Q=} zpIbXJ))_(+#6Q9fG=f!$Yy{wSQ}rA!T|*l7QQ!U1^W-JH_gMa%s=S>@pM`7IY#aeg z7n^|TB5RgLDmyU7kNnZiR>~F)^U)ms#CMWF&J~!Q@dI=VZTr=z-=8kW!Ocx~$5QhD zn-V1}(V%E2Xvbt#^>lKOhj+acScNSbiyzAU*ov1j=|jjOPsTQ;3+N9vmNT~E0#R&1 zy_PIyJj+jB`88~FaTS{b$tnJXU$yyJZs?Zj)6|k0)&C6v(|O8_o+l6-H3V-7Mj@*N z1_Z~y1H?>w$CeNZ940q)QrTa9N@xU%j6jGq2dNP*mTKqeM>KRMx&Le%p3^!EwR+*pr_G*NqEMy&vuB*o@T5RPLIqyRO=09KCCAuh>FY}_uYWS@Oa!CjK z^kwev3K{gB;d;>-s-(Y*Ac0<7RI`C~qO!#stk*ayO>Kf47L7sgkq==&9>J4!b;!oH ze3{$>2f8ToW`6xDG+0ZAQKPAShEIeBk8iP=$*xdF~d=;r6 zlW%tO`7q_PzxB(XPa{O3RMkFlu0X zKFjdpUm~0u32;rOGq^q!nSZp@=pO@r&VtLA2A(LTKl*d4C}e0nUoyWn3gLK0oPOZLYUpzJZch#)>S~Dvn}!e#p}R(h z0eeq_FxYhyb*v*h-arw2!2MQX`r35p+nNz##j>O5mW-{8&@*pw%aNNSD|=lSPY04b z>%ZdL!(~e0+0d!c)jwg_z{rI2QKJ?XkRe z+;M+iR-jaqcv3Hon`iIBGrKR7DLcm5k7Sn!hTflfS3RXqqF;h)iZ`LA{Sh#kS`~O) zGdn&Q^FA*5d6&^;daAd&L8zaC<8$DF3T(o9nLf(ciB&9V7%4+^%KudKYC_CdhtN%( zc+N9HUbDaEy$h+MQo4x@UOLkG3R@wN>JLG{@wQq9hcf{Vyi5UWTst~l#d?Pe7Ec|w z0AW^iH3v+seELS)$|)rZA6c1wIntoC|9}4cntNX!LFlsh!#*!sxMnzXPPF=@F7DO4 za~Ee2Pr9!P-Q1u}~UR2e~YSZ3JHSy14N6(RM~J6(r*o ztGD-e_J*O&sr4URivIx;V>SHB2v2jMw6Q#P{WvOm;@FnEVDPcB%}_h+oP}ebrXNAmh0N z_j(Q4!KP&0s6XTIf32|T?_a-44ov9BSvp}qDJ>OUb6R>`!T8F%;#zXh$H!kr-?3vk zSG_KdwtxQ?K;E68af5IAA*zC*lK%iWd*QtRu@*7|Isk{rS@y^&IXU4QoAntCSEG0x z`g;#f_GxgZ()EfF3_9Oe*$y|n;lw1b{w9dKY~qlgrqF*-Vt9iA3_@<2 zI0OM+6mPW$Wv(jnq^v3Na61M!F^m!~=f7Sv=JB9POJ!V9!uh20{onRawwWvx1&b)U zAdiP)wKKNiZ*3{TBIQz29yw&bFxr)wdr_S z4&k$fJdiCAINFc zq3v>u=pkpwpnTCnnv39?WKIK$*1d2ia~d?%qZp6Kv6 zY5h0X(KZps=fCiuj^B+=k|V1z7TuAb`v(f#rj3yzxwkg1J;qG;W7)JRT&Ss z@wLC$qkpZ%0w1oaDbdDYh5R!`1()27c-pM5^Bd*a790Jn23qs;X*WG1+*DpUPn7d3 z!g)#D{3jwl=qz6=YyWCY@?X?QFrnAoLx%QbCgHGpIFI_y@Y0uo9geR&hdb8L3^oOG zn;-I?-kL||{wici2%lQ3>Ewy}oyC!Mt=TjL zAGF{-^B(4Rd|2fD-QS0pyh;Rwh%ry?Ce^4Edk9{|wYvauosh8kVS(qS-W9jlSR}7g zvP(I%G@KBW8v;-r^ulJM)^56AMfl5?2FKI?+kmgVov%`Fju+-}o2m(l3v&8^TBNte z>x03LHR|(9GR&F1w(K&VG@qxiY5u6{{QS`G)(yv( z2$w!0GwJ<^KYq|asXVph`TkqD^RjLOw;wmRIh(TWPs_13y5OqT!^1U#Uh4UX_xwgk ztWA^Sj2TR4BuDY%tvzV?2xHSo)%uDN6CDSBXPOV7cz*HiUYkz$#CarRy3p->g+oi@M&aQngS9Gt;}zG+a_ z;u@2yK@5B=FXhoD5&}3zI)!}v66xzXtdH}Sgwnh&R$d`W#d$0yll={-?NrSs&!*EZ zXXL-)#_nOonNc+Jj%!Grv^@(W_VW{)Z2+$gF=gneR~@$A{iu|q+*(lqb* znReOw)uPH&CduU|E^@{;7+l*OF%S5=m&wPkS;=Wr+%#G|zEPu-qgt%i2>AaD@l=>Y<8+l0N>>(!XA$J?YmSbU~tMX@e$T^Z)2_7ZrTYwh)#fI7z{slkos# zMb>0MZFh-P|I9&KwxBem>0O!+K^T%?+q;4AoZ*-{`fzUg%_-Pa9dC2rRPYb2C&|k& zdGBo%x@|VHbuflwlWd31??ENP8_1)e1H*b48FMMLD9>_}FHRzfbZeDE#))t%z7a0P zTFg;>p+Fv1zr5oazDLMp$M(2QY52a}dc)C*3j2*(FEW$c3u(ZuNu^42>^hEa4~`n^ z7u@0*tnSmK5XsFMm*M%=(9tIeh@ARsqA0AvQKZlHGg1rt^|!K{nm8oYB1*$0OQn~X zL*IfHyvDS*Po9sYi+8?N;f0SC^mhc}#SMZ%Ep&fJyU=vFaiqqgI$Y1{uO4aPv)J*6 ziH?zi`I~7^6uz9pusO?*BVL0vKe>30rW_5%0L- z+9S&RUl&o4CfQvn7dDTu+BGLYV{;#0pGB>Dm^Em6OXKIiznJwp$9zlyRr492jC$3i6Xr4x&fCP9L z&TuR7)#4{JJ%Vf#v?-++1zy1&7oz9YNJjon9A_0OK_ug=I=jcCrXbc?KuGxH8#XEj zig}Lj4_#QI8VYpEM)F5w^$c_h(S7e@th*emCUJ#gTa!6cgNEHP@-ceVdb*o`D`+)J zLxJ&^5}P-x9&o-N@S;f+7&p4HSgK{N!VgRo>^ew>^NZ^8yd@|xUXghFApsq%2u0D_ z_q*&R@DK$tzw$GgC&dUbMs#ZhP>;Qt6$Z&2CCe)BTmRf5wg3expZ}_lX<=!Prk7l| zbyjDL%75-xF8}!6z&72^M&&8cTxw$mono-CxG$0%f}1w-bz<0<)j>PR7%d~Kg{q;G zqKML|cd|B)^aHe=#o%JZumx|*2`Ne~k3o*+?$OuJT)+h}Jk|grp9JX6k(ixt)m6^s zjm=1u^qqE=wi~NkcPKe|s23JW0wPI}m7eDluRiHlbIq-2P6B)|SHFc@6HCXVfcwO@ zbhT_CV~S0j@uuPHJbnXH(Ip`&!{;ChHrT5-?s6h0-K3UpMapy2cjv%FIPkGf#oscT zy&!#xw7wujmY15RkOS((X_jv*{Ijdi_)B%#$9wLe^kYwx_?22=*?B47KGM&LK~42^ zL)4k%MKCA9Tp{wNQVnmETla!;nr}t&7mB|6N`|C#4Lj*8-TF@*>SnxcTXG;1yZG|O z|F;CH-T2hqrW2paKhwAvW4))2g0w8L#PGo<2&v}<<>ch+>-SKY1ArQiZzfMvEnjUE zjznFZv=D@&hvF+?ys~q-+#dP+L#x&A3R#YKMtz(PE$Qcr&o5Knz@k1LeMaL={HE7O zgpO^yS>c2j;WL0MdlJUyIH&pysk-^vltD=asZ;qK5CvSSDh^WRIo$jgC;%C3?Pj$U zusZmFLDP=qADDyYt{d4J+TaZ7U`BoaxlIa+9QX^BOHCUxCz>$zkYn?8NxlZB-jMZOgKn{4rWXh?drl z)NAs%gKEy<-o0b|%~VPckkm&I;q@gCLTvA`HdQaBo~$;`?oI<=VTM+<4gdp=G9bv+ zP_a&}>d4OVYdS*FGUyZMo7bzm384i=Dp3uW7PjKzU#K}$le(t3l)ITaw1_A|AB9)d z3s>k?GCKCjLFUmvgo3Xt_P*V5@e??G<4bIkuLe`=&e_Ar^mS8eu6z*+!${UU zKOYFHuKL-y!zuk)D6k;nG+^m|`IrN%oX?e2PozA%2aTmxKYPGhggAVLuF``is*yGT zAHi2;5s%u5xWYQ~{{Y8QuYWz&FL|!;w>X<`coY1jRf>d=XsTMGn&t~GkE+A5Rg^h) zO=sI?)3gnhdS{ANL-k1J@K^4N2g{LGuO`LD+!7$VuE6)4kFia%%x>-(fM{;pHaUGR zZycT3pWwf>9!7<8z9^Br_c*r<7^0`0l} zGbCDzr!AW`LoYGDq67olS{qwOCUwf0FoO@s$;y{{Fq>CL`=hz>&SoA z?8Eyuh0p5C%<`u6Qn~|LfM(6838L%HRn$H^u(o9nkpp|CRjVw*gKBRd*;csSGZV8f zIJOK%f~IOu+*jC*>Ks)J z4rOt5t$E@NZ68c+xRjpJ!Tt=6kFGcGA;gN{R8^pEwzfH8d-uAn%D&1fsz4JreR#@% zMSNNh+3saQLIadAJYjP;j(5QX(~vI9K!5uL+JckkD^t>ay8R>E!j{ZdIjiE`g(98?w-2(ty?$9 z6oKtCvwg4}@T5}LkBzj; zEXo@kR$$Kv6@ztZK6@%g8^tmAo_QWgvv}0OxYFF6V zg`O1&Kehbc5R4Jw)qlTOZiBkGaQ=7y#TtvYdh@w665BS*wFw?Ka;%GcKNn!X12jVs zS-XGwj^>Spm<|NvjY>g2`;juOe^H~{pA|~<%ybOO!wCpg2-m8tHN_gh zo&`Lxo-0v|A|tKE9xRh30>kkFGSa_}Yu&sP>yp+DGm&w+3?R;RGwl~us+fowg$ zJwWvsdxS$>%uP2r$v8^3C_GdPDf@1;GeYh*Z|ohhxxBo)#m#KCh$5r^shu0Xgi;A~;NXC`otbKprH zy(SFe?LiJs^aN+H@ZwkgjSTQal&_6wLefLH%ONo~HPMan0M#fI)txX}T z<-*N>|IBPe3HI^|{N!Xb1Oea}?K`b5^RRA}I}U#p8O(VhcpshX?M~I&$eA-9jH3Yr zyU6r9li+VJt=Oo+aJfa|=%Yd&K_%pLF)S-xwmrbII`IFa>&*k9?*8}xO4?KsqHLu? zmLzwUY!PXt>|2z*Y%v+jU`okODkRI4vTu!DgF*Ifk}PAH!C;CRgE2E0%=b+0`~Ca; z^ZTRzRbJ;j&pFTMbv>?3Lso3zRPBA!BwqQRqXMQOcA|B(p=$aHbxK0ZtmNN^^VJ-&a;^;>H!dWzZI$W%=d9p+_6)M=(UfuFMN8?$%&ouZ`IOImncy^w;EO z=Fr%anU_>f9L3b!1dj&dy}$B40zh)_|;e}WzQx;?bqY2O6 zvO)P#>)R?B6)|1DvkhKtUc<|b8oJ+1>ni$eeGc4f%dY`JCYsAevD8rN>=PCUZ63bb z5S9~t`yy**ry_FP$IqfoOe3)TOS{A@%cens`$q8(X8EY%shK^%qTq4vs>DnE=XGbe zk5>iWyE`hq@@`ZXxVi1^*#+I$U^JU;v`ml4ng-O&ve?8hcSbW@;2XmIvvq$6xpt4>9{e(N)o3d1`nFZ%xHys?GK`nQPAx~*~1cpYg-^=aCDmXq)c3gJmNb>n{uc_fl<-HfSKV+F6C7iQ@9C8_q!^F2(iVG9wL7_d(tBng|NFgP!q z_+3eib!Q}&dm|)*5Ys~WgOAqASw}(E2?2ipe4VGez=lI4Tj3;%E!RI!CO@EGtf^DS ztn&=#-Q*z9jA(dejKb@>c>G(uGK)M~bMB-kB$m-Ij9_#PAb8Ls__ra*04vhgD$_fb z(y6G4=-&)RNp59>Wr4dv`-X`{E~ANb<`?`Fa)lAYG>608x)`l`&+x9`^xg)FHHY&H zr14d?JzM;)KgY0Y)b-GfdUkU9KpD6ol)o*XIsq;bh(ba^nxjOiIq^?lMpW?4 z<%HfhXK#_#*($K{=&O=?x@#xPdsYThUhC2$ee!sNUH-GKiI13-yZkcun}w3)WRxsh zI`R$7{Feg&YE90}KoeJdA4L*O5V3zYPszhgR?>h?(d_|)kKxSZdojDK5nRv(I1e5^ z{9&;-e^4+;*$AKA3TWL4x==B^G;aTds)0S|SwwJ0P{zKE={m_y!x;_9R>c8!OK4Vy zhgnu!`!K8vbH`+SwaBgTr}7r!w*O+U{P3o-ZE#BDd!QPelhUD^nvSaLS1_XtWxqm( z#+Urry}FEV6bV?|ym|3jMP$3?G5cAWRP>lp@S%uI@Mspw81W}myFD2i!I-p}h@4(n z_7s>273#y;OO{r`WBv@P1kJ{Yd3gnd!}nV49edg{GwBW&+a1{aNP5;h$UdYic;A3qFu8$p?B(pXG0XZ(F3g3@w!hL%4i8s+d4XatmjfwxYh`96ek|=dXV#Zj5i(% zUk{6|wd;4nSHs~Ktk;e!IuGNB0iuz?uqbIC)aMdyrYAmA>0N z9|Ex%E_~4ttrGcqt-Duh8Mmd%dy>bS$BX6P@?P=46sW|CiT62 zX-ISx)XAd$X~?MRNvKgzx7r%~YBOC}`gO2P^U%6q9lc+&V7g6q0b}Ee;dH16PguOe zP_M?m#Va#@AzDLocrBK?q$w;_ZeziZtWwe&UcYK>BZO0{acJn3QW|32R++^xZ%dqus78jV(voUU?xU z7RGoza(jeb8U_T%UU1EVBfa)XcxZa9e{Kr>Z1D#X5fSK4rvHeI_%iI_T~II}vGyo| zW5J~z9q6y=)O)AerNh1&AF*HlftC2$#r$eceB9>CGp-BWWvB^Q5k(ye zGMYT&#)$#^h1s^`;Z_GM-^B!x(bcJRKU|)*x@9~xAL}-(egxYe`wrf{PLbQGo!@r(k^jmmkV04M#;hC{{+n^MQfikgGx5WfdV-d+P_ld`LG z{W#C{l}F0Sn04CSf@}u!>^9`$_WAt$g+eWu>hpG-ec0|5R}8cKbRkpm+&;M=&fI9y zl_R$(><}MB5Z{mFQ8v&3^0AFU;5M`+HQz^z{^vEyN({ z-((Eb49h6z+ji5S{B8TPyQ6C^Eac^PLN-u1R(rIPp%p~S{744c4x z200>Afag-SD{H22sMai|vs4H08cQ384gI<8m4=YM7&tUN+ccgC-`cwZ>}O zK?}s=8B1!XONTrNhFc;h3f>VZ!suwO$&K_H(wl`RL+0iggO?ieSixm(D2C?1Bk-v;-eaD~SKF!G}veeTjgGb2rot(g}R{mbW z;Z^zpOJD!yX8JG0xTZcbJqn6SKCt>a>M1Zo`EMm`k?uLlcib^L*nAB1i^!m9KYe=8 zvoyA0fnW-;L5FPW7OAw&NS6itt*+o+Mc~u6z5k#JQ*+7a*lnwlOr>F(;6ZbTFB1c1 zvCaEbXc~EZelyHDiP2XO`9zKPgiE=PT$ac-Zt10^YF3>YSCqIp zYqqpfd~Kt7DqVqsE&nc!s#9LiyCN98*lQ{gX!P8Us8$v7bN9fbq0L``?TAM$m+&;0 zo0(POKM;G*eP4+OX2XWNhPyY5D`dWl$)lS?)Mmd0ZVn>BNNFcRO=ICWSC{Wrn$62% zG^)2}2@`{lBrf2}Kak;`AB@&s6!h5j z#SG-u5<OlFXzk%|&dl-ap=-?>I&diyHQQ zu9H3z6`(yzCt(Sy_3A_B*-7vCBgo*Zp4*5NN5ul=qH3ok&EsCC$_kVB2Z zU^Yeuk8_f7JiUoocDkH*kxr+-0;cU#r2-1Sv$bFk&PqdK5JDC@SvURT_WKJdw0p9f zuJ#kLzvE1UPg}P6iK;xl&BP8PpnM20CHo1(dl#xg@x1R#O(nEGTShUT?s%S!8AfgwEWdFxp26xD&W zv5`%8R*Zo%!+3KKk$^Gy``(C%j%8=DYWe^E6fPPWe%jluwRYOIdo;E+ZCuKJrTkI< zH3Hn&*i!QZHMr;fyqnR0DC6@DcaXuGrU9!oMYO@{evT>mL@MMA+f+aKR7U|dA4xsO zvM|k(2gbYG^rb}Kpj>Qy_}hR!32|nrQMfmq{3&DptYQwo`={Uq@F2*O?W>D0{<)$o~)P&NH|^NqUm z=RU!fzS5kWaDww3#$czR;w)c4;>=|j3|3<+kuaW@b{SADoIT_rdodTg0?dYt)q0YY zQgPuLzjiaeHJoqU7E&%h5U;v;kC%)nN!TF^5`MJ3R-UYo0r@_aAY8K8&beubHQ~mXW@6VXJ+FE@@p)8@qprWQK zWXxVpj1#(ke1>Sf0Q3$V(xYYbi5@{p#Uhw=wW@q)V6dRsf?%M-2<3q}ld}Hr=Q1AO z?Ga^&*tWzufuxIqD7qH2ObcZShF%fe2mT!nv6m>}Q|4yEb#>uL)yvYusV0@-CN**F zB+wos&DphXr3_f^14G6;(4n9U50Gr8g{|`+@8u=uImfSE8!`JfVGAU#D(nVFO;{~0 z%5Z?X5+eWBI>$I0nleybAx%$$T@^I1!5O^VKGMZ}F3(Gj?0zOEqyN?;D23)EZx{II zY+0P-#7o)V&DZL0XTmslscF2{$jFe9w6(m1x*UOn4tevWT>Vw;zt@zAYOoQ zt-Y@5DTl{YMR}#XFfYwv{>s^2W=DVKB3vE1aN@NvFM6#$dk>N_1fN*p#oY;;mIBzf zG$ZXDTnf*MbQcB3Ml^by`}2qQhkE$LUW;}L<{PngCxhpIBBrXrN4m&LE<8M(L%Rm9 zZ&qWFaE8Ss!tR^^UYWzM4{tCRzRqxc1~Fgw@IlBQ~D!d2|VF%0MMTxJy)>EvO9W#p*bQki&N${WM7o= zB@~hk&N3e8%?RMNaS+e~?K~i$R89bJl|Rqmv2) zA3cRDTjyu^>kLu*7x;!=v%v0=2KD{T#>q`Ac3FC<`*O$_N~hqrN5Ji7DEM7Ec0U|3 zla#;QnNj5pG4HXeN2V`sR~d=@vBnn1W|EfHe5+np9e~pFGRGHODqId;lX zwa0n;0NnnEr)jARq|E%e?Pxeaf_jXUKax{gP+*y#T?RFhYx#w5LY;_7MUE($b}NZ` z#x7uE)jKN8>ilfc1p>0FuMn5WMd=W&Z%13x4{!grZ#?o}RDSLhYFv1K|BcvePk=eVgOn6=VB&GB4dw!N2lAP>E}}poMiq z&~!TwX`&#&83^zcEUKQV@1bxGnpo-mM?eGr{^qqX^)qWVulYN4k*H=(%~^^pD_MG^ zM;z#L(&Rzwv3vX{ByhNu`{2Ry>3=j3!-o%q3>$9{YC5d+U^H3!QqFrgHoK`VUCnh< z^?x0W%WL{(1GX<6{oa|`&)Nf`%C-E&4+^>E9|f5H>t$t5!*@_na=tW5xvRSZsH{Tntk^C4*^A*5KgLO@k}FH!W$d z|7ZD6ZRi-pRmK4cYlIF%%5>)8)PW}>*WzAt!~|T$+*kVi!@v~Qr8v#YGisdiI_UF# zNyhtlG03|Jat5m0jgM;$sRlK=UG6ce1n>6wWIDCtc=VFMoFrd=2RftazRBOE8Pt9u zs|F|ogL^r?C(Y4q99?M6r3sRYg$tH7K2D<{y2A=P8w;)YA)?hkw64_=^%g#1JX21QXqy zIykX_@`@=IaLUHL5cUAZ9w05+uC3Rh_s4s|i^!LHA)7jlekegWi~RP%$nwT06zR| zqGLYh#^^prtFy4-;^xt1H#TBjn(W*N4J zLP`x`A)aabN*@2$^#9JG5!z_=(J%iarg)|TWc!pzWG!drfXC$j;90xo^-| z>wcUk%=aBua4ilU01`T=uWyCyk&iCCL@)-mt#h0Em8W-f^lIss1Aq#w{jVbe z>{6UO+vr=n+$A4gB;-}jvfpfN&5`8$DF#eZtK){AT##=$0F|<;A1BbV8#B5yOfexp zUxViA)xpXdJ6)VS00FD;xX?fR6j?B8(1b`i!ayXJa*c5k zPol#W_ux4HARrq#WEMM1U%C2e?RUMujTB)QRGhrVedF&=b!G0%-XcV46itJ<#{)*f4mI@**@%W9X*1P!_AIA6 zGpkXC-O6gz|ET~sH?k$|4kPTA`o0GJ+4u@L0!`GC1#XRd?^ts*^H(!V$B8K_tq!Bi zrYn3aHSiY6Vkl#AB$+_v^mQoH(|+hSEX@-Rlz0GoZkjuj}6G z?FsU7G2Y0iO;#<6gk=0qr_HZ1Ce!h;=+E(LeV2|YE($HD=UEUj&++IjQGm<4(T(A^ zL;wt1DNyYS3Jd>(9H+vjm#4f{;afrTt4>nnL3m^w@G3 z>J7lNg0!Iy$(ToU&kg8Y#(>TH$*#;GDH29 zU{A)@6ZQb1l4khIB?Bgtk?P!}O#Db8f0rAegdE~oTd*Tt;0lamG&8q;)5C8++0#5T zKd8Y2UAVRn@pwv|!eoyjK2pZ&{xI0HtF|7VQ|o0_TEZFrm6!}WMuQhQ4Z`{^Z$i0N zXuG*tG=K`AIQ;oQ)4*&M1X7JlhTnt1=l3DX_^|~8eE+21#LmL$8aCZvJ-h$A21_%h z(IrHnQZ1x*JcE#KL$I9C*s%3e|Ei%*_bb8Ltct476LnQsn6Q5Md^0s}jN_&9}nR$Of&&ax`raJr`bC)YFk zjGsQ?x027F^|Fj4O@!&G_+ONiKi}E5pVxR05}&_)MggwJa(uUD{eh#9TWhahGR6+) zdB(mYy(L+m2hxA4sQy`PxB8pEfF%T4Y&H-VVXGnZ!liJb2&jw2OZ#*33JSP{R`>9e zE!x^3Jpd{hhb?pI@83U~b9k3;C|GAHiY`io`m2p#yu5vjVsy+l}nVok0)$4`WCeIFv9O$*KgPw=ddgF3uYwEOqSt;s=sBJH^4a6 zqIVqmW*48y^7Fj!$@nERQ*ysP_XDrSykGsuoKY1}6UubgY*}p70|}V1#4ANQP!l>1 zz2~l5puksJo(z3RoTR`5tuO6KVyf(!o?1(j%GC<P-s_a51FW=UZvDRB4>+F8IBz!11|f zS`Pb|-0UJ_Wk_tr%4TWm%JDcJ#RiAvaDE;m@RNg1y2d_-B$!13)&7tac!oA#QCU@^ z^5+&BXn^LyC9%THARG|6ROAN$x~8-!PeH8%*%<`x~dIz)6l)By*w%85v8Qx_}E=4jA|!! zhmxAf&LwK>u4=CJhKwlxwt}Vr1~^dfr4uz@E-}ThkA`w(F|a=3v1N-X2DhkJfR`sB z1Wa4#8XKt6Cnw?D4mEe<{o^iZk-s5c!IUb@Iz}zJ4CA85>#(ailvb~=AQMf-I_!wR zYv=xvPXx_BYi-hA`iJEK(O^ry#(YFUPf0<{m65HJCaf0UE?O#{dAHzlj+WZ%+ zo4`L=dbk&n3{0A8{|m~l(bbKqB|@9^`dOal(OdtART%6;xRe|Q?Bz}cwb`9Q-i+I8 zK;Km^{Zx7|V4?L)C!W43`8`c41P!!_?xf2cmw1GZU_jTbem^4>5u`fiPjm9X-#|bF zY6_NK8N`LRYxbe?%5$vJ0*vbn2i8*FL@(Fk;ga;tt8HyPM2CA9T>5tKlZ4P~HBU%+ z=zWaV%~gt`?^u}}MdSp_djF~OvX**k{BstqR35GXt9wa6(Q+P0>VNlTM9=7%n`coa!N`r{CItzk9WFo4pHM&S7efHhi!qYm$Iaq{&}PS zTsklGDpIO#BQb@|h2~*bj}CqZBxS0t?hJUFwqj+9Y-)a%^q1AeG)fm3k?YIt%TFXf zV8{PjT*lI@E(jkMRd-TDFw{DU#*#&TaK!Dt*3=8aT#*~FJbP4Ase{U zs2}ib2NhVgRb~*6YY8;+Eb$Nms%Q@}Uv0@t=xH=H%P@BTG!~LW$mn4yTlS&dsZ>2q zlQgFNiy%#e-PXN%2W|)Z4TX6QxU^Z2ed92tCZJGR&0$Fm{9@1Nx-xVGeV#^ww`f(G zXyxLhqbX|U2r@R_UX6U_>R3DLQV0KKTuv~qHh}K#({oT0_%81`ws|W$dZt3tMak2O z;AzXXkfj#z>chNCyY$lc-NB>AAr<+L%{7hKl^4uv+Rcqh85yK=i)Dn3on~(9s&^nX*XfPekEne6=sO{$qs&c`@t$Lpy<|2P#fN@&{g zEMF$TOYjAvSE-A!FhucgufRq~Oz=8!bhwMD5wY&K;g8b5S9yJHp>M+6wo)P|YfS0|uO({*GAsJ2w>#2U8YhTjwrIUN+<668rAnl}AUK;1c(O8S^yDjQ-P6MAYw5dflZGxMHM7qk&rO=C4=gW%{4$6fRsi@-;q+>iWg@_HJaXKimN*?Gk2( zc{rA?eM2kKTqqItFbBZb6A=c!GHB3JwB5!}c2Ah)#Ga_{FdN9xyRv=ard`@MJN(h` z3||#0PB5-vW8#~s2eWJl5e_wDKdgC74LRN;Q@(?)1y*#f?-r z)obfk_i4=&-1>%TDhi=zgSzKqn}u<%K6%1`jIr)2D3klptL4%X8o61ve_^=WxS852 zM=+%*=@GumI5nCjHcp`-|C_5SI2^}r2BzhiP%CSQVS zL8Wo>Mo(;jq99e^*gca9-WXs?eb%F>=-mBa!0mYpUx6Jm#&FPB?;s8t=LI~>eD%xQ zPiC+ss)w(bXeQnTvPi+;ZCT_$^FtvL1j92nh`I4Jc**u}g*^LD-x^~X+@8ZEF{*EJ zqQzk;`6Gvx146j@$>q^thUy%!^1Dx(6+vL*45OqzC_{o31md0|}D--DpE+9Cy)y zPjEio{25P%iqjso z-NaGTGaS03-yFc?9Fw#TYQOlm@jNBQbBKFY{bbLshDd3w2d7KEt9*Y=DVQtoQhuH% zh8kWt@+T^y^N2tY>VZXKQ}A632#aL45;6$M4gba z2k>D~H0{-_K`Hm{{q!ckzOmOFUtyaf5Ov4e?(n?mux-!GJY!3uc8fl_sI6#bNoUUa zJ!`8%A2WlqZp>dASy*Rg!G8~{icw#@(h>`7WNVa;l-$eb;45_7bqVkHm|kfV75 z%iG4%W_CLi_bx}=yCUz(@+S==Z+2(v!$O;mqYxXmwNt=TS>jg$BtZ>o>{1gd~{^5wNB_0+(t+lVKghZ^TB z!~#|1{Xi{If>7V7)tZ(ia=O%5{dR zXekQ-=s(pR&F1-~Sm6JioERHM2ugF+(dy31eF*OzG=#|v3Wg=Y&Bj(&d1_9(5c&VC=z5ayJz{X={gco|zQT9}g$WphrKc6x(5=_Jfe zv)^Z-Q4M{h9x}iDb%U4s-O+hGzA80>#r8xZyy|C{7g30@V`g6{n;Q$r&M1mAnp4BX zyfz-snQ-D^F!_+ffEzIWHQ)j)z5J>L0a6Wf)cs}Zl-K0l9#-8YFe;z;bV&JS#zNk| zE&_$MQw%`}MA&LFHkw2-PE@(k>D)~L5SRPz@t8Nf!jS<@N84_V+yZfECk}Pd0P8l@ zBPcLY1MP*^q+o1k&KkSjlE&T=z}9^jmlp)+|W&Ec$ zp3dy&_VFHXq4RA3e}DbWw>x|`*J(2#tH6gVVBS)fa(XwteC{pbC{hF4YEAhpSbMbF z2pe(}nYwi&g1q}ncleGE{Q1H_iTL}^pGWoJUUo?K^D=+Yr%E3_Z#s*V`EKkX4I-5&tge=vm~^9raA-I4A3%B6IcKnz?&)WNi zmO(ylYI6M~@OQ@De^!;D7eO*muY}bq19tyI+4mJLtNK>=9uq;_o`pYx4lwirxX++D zgeYopJ{PqRD^;BeVkta$CtSMU-{YKmv@r#Gsix0FIiR7dk@X-FAOf-@w3OkZ|BUnH z-TY#5AfJh9J>fZd5{ZWOY7JLyrt`r;)vTSXc@m}Z2x$l2XmxyJG1tVt^ z?_xLo14RL7SBcjVv#07ls|pl%VPWAo48`Mkc);D*ItU}ApyAr}S;gqR>jcIW3ab*t z@b7K=p1t+p+g^GzHJJ6Jdgk&NZ2aV`@t=`)RV$6zoz{SME12!&f;p*LEsojZGV97C$Wd-te zQ1R0bHkcE21ajbIoG`+-Yg2JkaYD0srNnE@Z1Yu23MN5yjrng2SzzyqD;U)gbUK`m zE$8XOCRIBD`Q;7esv|ew=#$u8X<*&YFzmN}WZbG;I$tT&aT!N_E!WBTE7ZJ&yjvP8 zPpDti$$Vc>xNyVcp912!Yd1YVG*XsS*Zf{P{l%U&Pk$*35$9T$MtyeYcjnxA_MT(@ zWBE6+Z$>3kCJY{YDA|2S>9(e4f|A)gGsYKD^1!ZVuQ^)+vNRx3jlKZ>ceY7=bExc3 zqQ$MhL*gN!t@}r2HpgkW6>wJd9$FD$g#0#9*Q!`*-A~zMB5=;IX5*Lr=1OpE{+m2q zrN)&3zasIqWW!j~(9_@SmE(R#<#xL4Htn6MT-mn)bhzWYx7^$YXf92DUTY>6knf3; z#g`EKLC>J}#9r;>$BS}!bmPKjoz#GD_cs*P@KJ5yJ<@RZddaYm`u_PLu}YXy$oyQs zc-;rchUUI8ppeWA#9>P(*Yl-E;X?U!c~jX@8Tbywq+hq{c-nJ(FDuPo6uD9FWjlWH zFcF(8n=_SubLBNi>sSb>S}$`jFfUw7?0H0}Dn4GY9Pj-S6Te1XNS#6y#4m+x9X#@T zNaJg;dmPh>D7D>atX{p|`7}`|rbewmGhPR#I7@8}ydsfv$BX9%h9*_1Jhj&Mv@QiW zPO2GmwAU4%rc>-$TbmETLp6gUTh>VrwP8E=4pWZ}R$ib$XBaPVo zxS$I^J_oz;d0>?Wn@7@8-&|6!o`~5I)M6gu#NT~|f3@eH32n|rdXUGKC!Gh|);y%( z!dFaH&m<+nx90QhnRSauM?!{m9O_5y27y{exhye-y1&VM=u(>Q<>H6AR6h#bl2)5a zE=?)DsubeFF}kk`i!2pl?2GZLU3iW+qwHXnIdI!%v1}hPTqe%%Tw`=FM;)RuI$`U= z|Lqv=>ED;t)b0pNngc(?Zau}dq6ktF8f=fGx1b2f<~b7s|3d0A)Wcod_EGOS`pK-7 zR#gp!ZTfV)Ia?W~fYkUBoHBEv>m9z_g=eTEpi~Zo4s@o>W|1Zx>z}$$S(?J`KjHrG zBKD^dw>uM39|a*b4?pe}FS{WP7*vBxAwq*UE!wK`9&_{7g+Eg+x=`VLSXkvQ%{BhH zk17Z>d9UbVPy^=5)+e8Ns8{>eViHY@BgiXI9rw0C=?t$2LSipgua(9nw}Y95*b#DI zc@>8cRe1M6&VpM}NDf?$SOi~vD{pN_krVQa(3w}CpRc2GQ(nbZ#Ye7H6~QmcMp8lo zs0i%lz9QmLgcs|_lF|?k&izD;Mf-3iwmK$utIBKB1h7}R{(K8P=k=y{ zI&$F<8j&QZhNXg~DHCYZ-Bq@b{!8|1y&SfSQP5CFC9~XX2^#Fa*~7s?OIpiL=6`l_XF7$p1D5-cM?(Nimat&J!tG>_ug@~ z%sSby-hQCRwoh|#DCqXPHiL~#lk%z;-X*crRj0JQ{IkRTC?{1V;*b7IO88o>&6FmF z^Y;_!OUGZ}pHW);9%6(uu2*iX)iw~Hep7`R!VpyK;%9xkeaZKKiY%1R(?H*?is+CZLKwCd|D_D>khj15DZsWg245x(LnEJNekP=W>P`}YzoRB|K zWUeL-$a>txi5_~70?Yf2-Vl^={@)>~P|8>hgo{K##+2Lx%dVzfT0ezOj`AtIMX7tR|BK)4A4vOi?3(Ew@jA%u^KZ1Y3WN^noIdiHYBz-)QR z{Z%DVbmYm4O)Wlx;vS9B@zV4;_j+qPzFf$v+-k9U8StoK0()H!pjm9Rbn63$+sCf2 zBE~oWoS^oyNWXL9?r0DhUuulKdlCE$1UWQ!|aF7(VwB^`1CoHEx5k&QV+?b{z&373f7f?W_2fnkyIjP=>AWt!T>47pR z+&AN+V$@9i+}o2C4S^jpBRnIv1ki==F;syNgW) z(8u~Cb_VDlY^^DI0fqsC*BQ`jeRV(7X{@gTIc?Ha;c@0k zOBC7~w~nJ$KO-$#wK_OR^A*=m-p%vskbFGZW>bkg3;m{A4rBb8g-K8+0`iH-K^7Cd zTat1@$T=VWraFQ5aZ@RjJR-KygWu>mZJd4kc&s(#%uz$-crh)_6OcftFz2Jd>au$p znjfs}O1%P0pzGz_hYwqoFr>Pb&;8PNH7x1i^5_JBGOV}0zWyIQEq4VkOKhvYcU^P3 zVnvhtxnHO7H30n6c}&x-z*3-h^uQn63um^o;y~jvAPRRyZWC+lMOVKoH>SA-2wVp& z;m~<(M*hfEXQWBsSs35gX0_f|J0L~j;apDw>?qUm)1?d$_px$cJR*eJqgc zOLnK`KpgIuKuo4yboWIZnXsv@U5XZyky~C zwH~w5W7KNIb{9X{_USb91R=0Cy!=_idFN2rc0GK%tLg!U`4uR>sW+Ey-oo(gza=B}U%ifv%7;7s?YBxEV*(4! z$>)Hw4Xbn6r4EY)JYZCVC*oY^CzWs_`{?IC)YmEJS^iP>HzorOUz%#c4VJDvhAt-= z%wgiJU7}yO*gkuA?-#=|q@vKeb;zgW?+s(>>g~^>V>3$ECRgmA*0^IYaviNJ75R-Z zxDw@|UT_6#^wsLC4&S^#JOl)UJB^IGD4BgYx{vAq=#sRy|BHs>^Q%%*)(<+R&CJTy z$FQg@6Fw|5PWgFyKD`>dCfF=6Y;^8_R4-6;rZ!%*17E2R;!KWmc73wb-Y`YBN7Kg- zO#51TF2ZX|{oj!_q)Qp(`05R?nJr|wklQ8JlQ;b%`2;Pl$F*^vyB@~gH3af`MR zVlc!|wSc3ZcIkGG``_WQY(rT?Uke?|{l%7yLyR-dYK-hxLBb8SbBi=-6TifWW9{wj z)yVx&%ZE4h)Ed2%!~!e&KWng05p|xCPvAx&m}(RmTq}QA%98vclAIMyel~3IK+~Z$ z=HvfzfZ3mpOJ{N_;4#wz#7wax3zM`~#%zy{%GsqXNM6EzadLVr_lTcd{m=&wv`w9xH)C(?MR3y7oQze*N+YRMU60y@iX=slZ#XKCIq$dNpChc$XfsXq zZTv)qkX1izOd2uxvCrgFs;gYDoTln97)GNQ@%6)F= zH)z?xU0_kpQ)ZThZNdmuKt~CdJ$D=f8eV+{up5Gcf>P&xe#!?{x=$w~nnXpd%Uu&< z%fQ_Tm89zVf!D={P!0iI!cJJ(D6*<|CGGd_L{cIxm>yt*_;(^B!Ffn)@$n+bDuqnl zq40%p(>?yVb4utP?rUWAo$>?VMWGQ%Ub!Oun3CI`kJUI*xdZ#+ZsEtdq+29FJ-G2@ zE1x*f$b1OaI43)6LP7bFp32H2z}g(M!j%CE zSpIt{nzNV7ethwIU1v^U?@yY)0M>N%H2ViC1my0*201yYoGTpSq)!kvu7CM3j?sHw z*S;=bdAC!uXkUd!qZ`nARdl}Hp*){pl5PiZ5%s$&8nz;9S{edu3S(UbC%D)FTLmeH6=fdTU~uqc7~`7LPUD`6$D(B18n0n zg@rF%?X(Q!>U=rF4`l3I@+-$hL@FSBy8u*$)5>P5spFNRq_|qqx!`BhQ>YCi zTrN&=#dSS@{v5awa#r|1)`wo=94=HkWN8Y_XU?a?8pHs^uyUyZ;JyBbr}5VU4%9b` zo$_emO3&Ip$0X4Gy1c?&S>g!?E}=<3tr~J@6e%^cA+EiCDb+kYI6kCj7BXbsy2ae2 zRdI*21ymU@U)J&13UDR=KAsAF8GY#3QTNVcM?spx`Sy;<%P9vQKFKV!y808L!4_m( zFilQYbm=YM5DWVU&@r%OZ9xxB&xHVo>6}P;)=RJ%%sP4sgR{8E12CzhO_w!i6tSq^ zo(K(A3e8Ra`|1IDPnL!T-ZJzLeHfT4`6=D@)}dX-RiU7(y~|B@(&1|lEx&C8SVq2k zWUuO%#w*YJ7iPx^s~TDAvFX!)e;Oq*qd0G}6lYl(47l)NzTEEIF#4g9{|^c%9#yZb zubsit30_~TYGNw_|8fBf=KQ1y${K4vs~b`AuV%m-5JWy5&4>^6Gvu2A^Xo)8{#g@u zt;#z2gSy%XCa?i()6S#gVg5t+-L(2I+BH921njWc?@ai6cQWEDGJcdXxiMQ*^0K~) z8*5W9gju>T7Egg~4fuU;_^~8a$->QQbE=vy0QP|%3f^(H?0c2h+Lta-d zx#~`&f3mxhQO!RDDDF1eY3vnKXzt$F$B zue>h>R$L6VRmItL9m}})QRd$-H*IyUcK6O ze6`d$KeV&`5}*dY{*M}X*C{-%{r12bU^3tHBdJDXd%cBZs_OA?eBsg&QyOKnQ^l91uZuo|6;LFXk!L}gg@hD-sR3H%m}8_~@-bU_0|@F;O=F37C*xG=6eFqe`aG#oPcrJ*jjNmm zR7ZYao%p!k1{ei2;u>iH0~kvVnEg-q_fO7uiPDm~g(z?8jEI(XRp(Z8${bUse!1Z0 zM4N%AAU+;3;_omFt|Y{5X0k6`|-o zhCV%3;hfcz>J|hqWUSTBFo#BI^=C%#BE%K4eDKd=1&%aY8wrCz5-~K$@ z&LWh}(2e)O=j*Q?JR@}Oy*u*WO;fVzvj|^x1kWfk+ORI>=DIMjuSJ^zL%jeV+=PvyY`ufu;jdVXkT&gf=M|l>ldhdihE{)(0eME z(#|{}+J^eO=l%NpcfR`f3px=O{Jv{=Q7(8hVE1&dSzxrUd+rTY9wb^coECQ&+B&&Q z#o=0?;ADmdA=ESmd`t4kC7HHZ#<+EIn}V(KLm}h`Bw(}vE!F8aWv6hbD~*qbfLIiX z%Av;D%_SA(*7W{MgVtLUyET5-O^p@c(l@sFZ?zp8fFai1lHuhuWpH?dktkPi!(mPI z-c#d~L9E@7qdGQ0{sxB=(uGCZOv-bFGa`TS0P|2Oa89`ZlgN|m^07(q^v-i(?cY0KOalAk?S;Ifv+f3W7at;FQ`qS*&N5f5ys6G`tJ@Vh3)9QEZN6(}>`+{|df=a;DxRIv1qLAcxysRgK#D0i ztz>cUCIVU&7cUO`e^i}&Jd^ML$2&<;DUwd86ro5ZIZX%B2|3L9lylB3bC^*&iC7ZK zX`+%jj5#->1I;0p7kZ5Z3{T7ABs@Av27;m_T6U-x}o@5Af;e9583?w;(X z*J;Pmw=Sz5Y$g8ezc=mu>RhCg;n~{VAI7gnvu{6X_IJhnSEa^jOX#)tNa>mpT26Ca zGVWG)nM=6xyn(?rc_=B1mUX1Ac*3LlL-hQ@JC0Le+o#irp4+F(Qu155w`Zv{jhY9Z zx(Y?x1Wbh}jqDgM@XyC(aVHN&NH;EnH>+%Hf4oqghK}WI{%0ZnO!1N@R19&j@pYbo z8|@VLR@YmbTJ75Uqoo;PMupAG<)&^Nd*|}OpRx2(&`mCUg3=@&l1T$kR}~R(`OVC_ zvq!+Fol~VZ)PIkYXBti4OT%NBZWp+1xLBmid^ctt#j<2VUwkrZKt2+q{=&=0=6Nt(BPVPd|c8nlZ zG``Gy_QWuEwApO`5ajqcN`6+in25lAGR!2}@_j#iM{5EVpKY)m`+M<-gr&8F5d2J> zw+NV7g;hMe-M_ilqCCIqdFssVq%5BrpF=p*lP48EDK_mb4_5k@Fex5v-VHp~9a0I; z`Ww%Pn}+ApK03nfSrQ@&ei@T@J!R}IT}Odl;3;Q{nkStkJryQf*y+_*ek^cXaWpRH0Jmjx4k|3Afd}eYJEw-!n zM555@DvDllm5uZ2ek#BbrcM7p9HDq)Sut&Q(lS#SqV>`4nnZEIbbb4h6)h3E=+~ZX1a^h#gett0PtrN0HFDt7P-Oeq8IC~dKHjlJE#00?A+Nt)Ab)c6G z94^2K$1NviXpnq=l_jFVc&soi-UXosOpP}xU$aTlI(zo=4EqZRh4z{1hqi@hm&-8J z&d$W%jWApp*l~|@Dcz7Lu<(eS_$Vy9(gq65vTNq_*cXFof1}9ZqVt(=Rm1W16A}&p zUiji|FIRsRfGOA7aUz;Dd*_)fQhvrGbjI(Oip4>j zNOrg2ui)5O+Higuj6{3_c9IWC7KJg!tN-aOefG&f%2E zbY7627J}^yK^?*YvhQd8#iJD(KsDBS-Cov+`@I_2ib(X(+B2j;74L*`Ajh=`yxmz@ zS$#cL=oY7*X}zqzD0%dee^9g+-YsrhQfj+h54Ob>AbyFf<8LQswoNPiKK%2mRq*={ zj?#ungNY;cSx;qgG!bBqb;I5$4t=3f zFKCIBdxEX|cS;cQ{087cax+VA3DkKCAZD7one*fj0&1V!IDK+_L1b6SXYiou2JA88 zsba-dT}nz@2o>qR!n*x};rCCG7!TFtkUH9t;&%6)EN0ysXeDCpj?s09@yUtgTT8~3 ziWW;I(5gRJit7+9=1&#TEp{7bZ&UA`$E%7k!b1>I_PSF2=7%X^5_OyX!EinKtj+eX znbdGvR%E7k9T@7!aD<#aYki|T(P3xrMDP6?nJ*Yd*%Q^8G?+E9Ye-S_r|5t8VzoUV zvIRCyJ3tBYqW+N!hOhR$A~ch3?jxy%6J9Vy)%c!bAt5125=Hwpfvd266c8GUg8Gmm zts`q6khAoe4J6xIq*8GwCFj2NJoAP(hBQ=)lgkol8wliNq>hWW!DaXUqD{AQ;TaS5 z;pwnHo96Jvj)Ldo178TZYpv^vb)TfI+b4SFs3fmL+rgOZ)PXACzS6KD!`S1ow!5n< znS}b#zm5*NJN>!~w@f%^Y}Us28JEgv00+%*zF?poa$xyUB6Rh%3Guyf)uVPG5R%fC za>>pZ<_i1+{v&rzeqga;mJJ+zwP;KDu*=5S>%|9;>j6cmsfe#g@SRa%bL}f_l9x>D zE=w{}l`}O094EHD9Nj&F#{jEmgVb=yNlpKLbzTzf)TtzbzMGhhidx&_h`VO-*SzH4 zS#cvsf2)Rbzw%8*r{zT!lsdIHK6@}TbwRsOTOi93k6mshJ++L{5=h)w+bo}c7v4N2 zpOa1?`|b+b!o42g8lj~21#Fw|9IKB;0`P@E%)b|haQQZPatLe+JNmog`c440FaFYY zQmXGLc;zD36!B0d>BtFS;+)B*{_$?s<6GABY4$QBc?K)UmG+foMp8E7D?dLCb2aYR;om-{kPJ98|*l zG{$i*cKVi(cjwTMla2P9J2eq+3k%y4%aRT`zlkgGe)v6jSr*si zJOeOLM6u!TaRpW0RhDQ|$W- zx887VRA5IvHB@(;NvBRv`_D(W+mw4$ZUJeseVf>`Yp(+zx#T>x=_CS-{%X{@l9Q@i zt{$ktBO_B(1*J6FwZi4B=d#BY7Nf$C)an0I8M>sv_bN}vHEmOLQ&weOg(sS$a-T_N zP1N8lgMo)$bI~>fx9T+-EH5z-o0WWVhZYFe^=Sol_+^(yUbxL!lNtw4EPH&l(7NzW z8U}7zw@plpQVXKJvAcekyXis~5PmoBf(;(F0Xnp>c@XFcjLyEj%I%kwEiRF3 zYC!!xVlQNxOfFppr2-(xrHbAfu8$3`m$#gsd%2^-)KBICFv>mth}_j>?$%BBmqz)> zGZgKp`>&nQp|UPt3b!rHLOLzZ6qduYki&a}?Aia-9L;ZfsNCrf=Imof_tXgU>)M%zNj{ z(29j%0VeU%j&M)bp7VQNEd%8C13>|E78|u8INOO3RXBL+MA!gziIqU1>!53U{igQt z!T6$Y_edR#HoeN`A6N?i;-(@nSRUK+*0|R@iz%GPR?g|@_so#N}Tgk2_QrlO78%1I5 zIf&sub+WTVuY&{Ix`EsIr+F9=C97%%Maac5!g*rbOEMIf@*MBfm_cEt+#$qdCuCarq2;f?$>{Y9TAPg>0*#6A z-L^vPh``^-e!tIW6yxX{ayCu5<2-O&%M$xrgoH@CY~nj`l9X?OVI__~=Q!8vhhz)L5ER3H38!Q(NsK z66CqRfL_>{xbSFbX);Rt($8rDst{BtpvBubcF@JS*&hUretR$*RKJ<=q~%nd>=e92 zji%hQf?yINrAfGgtZfn;{P6&jhtgI3{j^!d7kev$_ zurM$cS!J+A!wFgYn6_zd00h#oRmtvvSr#JN6+lZDK~8SvzxJP9E9l?>RGO`hZDL~N zVPrpnzYO@-$DH;s5l3q47pzk<4lC?7fVYXsml1qV?`)fT>_hP= zfnzG7#W;BgFR{LNQiuPWPA_u21V!*$!;fw}_?)NMr%DNU?Yc&|S2`e>*OS!0zm{o2=np#A!GA^zJue~ z0l`>BV==H0t_^-u`T6yoqXdcrWH7MvgwKx||j z-Q=o)3cLQ`%pnaIO-Z^KwYIgZi3x94+1W6!vY|nUCSC=a+7o)qe53U8R zuzD?tm3gtx2F>mw*ny23;cUJ$a0fAZS5u(A1E`R;WlHl!xl^z&=&Rf@7i^PJTtHU-ybpta3+ql0X|{T!O( zo#mLf&;9&KCS3ea$60dcC;h8&H_yg~;|Ct&p494U3y61q=L`^#OJBEI9zuYzo2Zr! z;y^9~D9Cj)mdowb5j!cxdOCip=F#x=Nm(l%@}-oz3#lUu1702n(bZ)|!G($qwjRVk z52cIvw`M&z%Q<72{qK*PO}OASZkr$<+a61r%IVfJ;p7V`Rr2p%z7B*C;SJRw|WzZT?Gh|Vf$VxnU= zkf+})tTFsnf+7tNth55R&SlJn=i5vY8Nk8eA&J-Y`Iqm{&>=v!CcCWVC;F7&bKMhx z>o6q<_D4?uLMf)v*QM~p4x!LCJ+n>-NYLB(P2jwIJeoJgtIH(-l(s_q)9OaI8HNHO z&=ZJ-m!i+6_YuP8hEJS4X*Q;(__f9UEW!ER8$<4fFi8ad(A&Bj1+CSs4(5V&bqQ80 zF}&di9XqScKIt=FfAjN0AX*iX(6P#NaT=`l>dbWkU3P2D9ljv=xX~%Iepp~XD}+pi zu**=LJ}v9J9?rPtH~>g5{54GG1HAE0-Hv-O3{V)+Yz?>c?NfU?6HCmh9)wehqgQ*Q zSJOa{4_UKKTB~t#=|KOzQk_7Nxrjsdcd#5gy^PQvH2U`nxjrBlL4vQq=A@S#${rau z>#=`0WhR&X^KK8@&sJiQ3}G?dg>Q0mfv5fD)ViDNTXw<1+g~({>_@lV-kO9wO>Tyj zkiAZyB}F4fqHbv#MO2uV!hU|Z+lqw!`t)EY`-CO*R$?Cyj0uHxhhMq5J%$UQC>UB@ z>`{mlFe8<>W@M4SaCJxe1O6heTUu&l7*AOud!_b^pFLDUOT8SPg78ws?b}eipgSB1 zB=R=r_pY~_>P&2QoJxC+y>#6C2%d9B30S=wh2Y7Tq&0&Z$F*I*Y>}7+jee4>wntTs zJ1$!ZS?RmG@P(l3tg>YjVa9;2Yj=}(of?j*&1~n&zvuW8qp?Ffrg%pzn)0*ReLteL z$&C#||GgLIjT2YwzjlQiMBK}im1I;Z&3SxfnRYvVKXcMwz8*+GqGmzHl**4^`l!_M zNZUh+T1Eo3*!`|4+{02={BgjhlMd=RxW*)jGUQlm3S6&ej$D4+^>A>KE}EmC8;QRF z+WjCJo;%o7JYq+W_x|X($9wfr57r4SI$PTe*+x$t2yXFvF`!kC#gf+9fuZdkpn0#Z zyEcems7*+FAewSOI1=fzeqaLBo3GNa^^+GbIa zAz98j6L(&H=GHdgDzN+ZBR5$CvHX*)TLEqW19?6gzRm1_z_a%HUYRQf21RuVG~hJds_L1 zxdB)~+#^uvvZ}DMG+(*roYjp}yOVE)c-8&-&yD;0$9{WV4Keuk&X%Xw++>;IM*SDq z98TJ_a|=WoAEMKAHkI;O3qlI&!H`Ac5MDMDz`xd~4HOMdfyB+;EfjbI_S(Cd5VOT9 zU9y9Vdzn=Wxh0WHbN&4w(&b5CxM2dBmh)%#;vb(Y%fhj z)#}@yY+n^8etqHs#E3grc8(q<6uVE7sAl>*nd!$nvcfwgnjb%t^GlOul|5T5x%y8* z;d(yy_2HxKexnM%dyTih6prm~HHVDCuYw1zQ0xO?YfNuZE&&oX__lr_4lYbt+^w%M z6vg%H(AZQ0imKOj41Lich+u{6m67qko^hraSO82hEyA{&K=HmA|8(8|JZ}dqG#g&z z`Ixn27mX-ps);UvLM%S<-jQ0p;5!Rm`SV#sv+QqY=F?5x0>0Si>Y7(45{;Mw*`A}Z zPuq*UV|6C@Av^SInwG9Yx;~s@cCvDiqcr6jPOa?u^5-bL5E-ksR!gE6_6o1^4ki8k zc#t!2RB%2ecGb=@%H<$QGsdbBPJih=Vl`7ze1^rl>aj=m8Ou!PEg&Yor0bfxi`u)4Kt1QBfFjB?o4d%GJkZkZZy7m= z12#Och*a(fU|E$|)@{I-&cbc%AFh{tpn)%?+#c z*?=SKR)JD`Il1D4hG;6x2QfvHSx=jEP&?) zV#EAFq5sN$!0sI6I6+LVp}9_hzSBroJ*-E6$#y<_$hzZ_d=axN0+Y z;P0ESkhPL$**QIWh+EVBvfkyCs0y;lQ?h8DY{0G&o5(EQCB0{l;_$8kTnnOt!)B*$ znzpDk?4(ZTH;6AREcERLXgK-TayV^ZMd@(wgZ2|>Y3P01JMn!o_rfxi&oKW%8T~zL zhF89Ooxbo@^o-)egNAAQ6%!8Q(tugZxc!xk=BL4tAQ6*)N6gIGJe^4tr@~%jU(}BT z!b5S&RwdB9Co}i^XJjipiQ(RQ5J(@n*cx6n(dOuo@jLuK7SE8qo`EKIYW>B-=FXZ) z2LjN^tY?GCp#264n6dOXc4tgGjZ51e9WAwUUjaH)`ce&c*E(n5eHO_p0YA?mMpxX# z7Cbo|;yJ={;zD??p>~yp#ox;Oe*$$qMMKZ&WI$9h2iEi^28bkR`vY)#vEtKiV8Jwe^q8Yh@C;*zB9Fq$zv;?SF?(V2Sk+MOJ zjEn&CpMupUwJTm=*x;L0_0_$GlU>G7$<2&s7xu*;jwsLfhKo5e>VM=Bnw9%){Nh3) zfoOh9qMw0RbhMu3jpNFC!otFSsE`!^lD!71tf=pwC%`1{hROB{r7Eh%|Ih}&i=XKk zSg!Akx`3x0YA+C{EWRKq5BEGPk6(hcDSydCvu>f5&h=kAGtnLe$}scy+HXuHWDlGq z60{{(t=HZVC&M&4N?nQD8oE2=s=z-6@DX+S+L3Ql(+^e@cm#|b!q~qSEO_JL+$1dK z`uQQn^?Lg7>V$mN9SE_bU6aPz)nGry>j5z1EHEqX?6_nAav3|NUm(whR=CdGXC*hJ zNfuZW0X?#h1`4y#sv8TAp~^?sO#`Qj`IKA>9GH~p5A9U?U$^%TxzUB~`AAc`3<8T^q_6Ckfrv%H!Lv1z3R@H*b={qxO@U0sT*xR&>yNm{~^iSr(O#EC`O}PXf}Wz7{SpG-pWD z0xknMy^>=d3P<>rBuq&^KQ`iEFY6iqym+=qssEr*K3sL}v8wCVL=KA;{_R%b)v^SW zPnyW*z`)A~M(a2ZEUfK(Q%j%DOix#N!y`_C$on-YO&jba$M1HwQ_cTDYOzX6EzraJ z*`EJ@u+TT1Ue3}(3p&yS^2oywowUN0q1o9|mPbDHFaSS^UDkt7k&K<-8c4_;gNd*q5NZ}!n8S z4796E0Ozpm&gqSx4fZFuFPFo%0YhAEmM739#IZ3N5+C2AuJQ9vN1fL@`p@bA=kX5D z7tg%4v^(@jxIUx{fdmNGon6*JTRG1J?AcsBfuDegVJ&cvT{<892n-(rh+Vueg^Qy17s33-zO~wogP1InAb;rqS>(H*r=;Yz~S+QKJz1|_8PD~ z>hdQH&b7oKPgkb-nsv&+9zwC43UYLESFbd1fF4bz=`d4YvY5vaB!tHjX>zXt!*2se zr=kCukM0BfyFU-<;?qve&Idae$Tz(td#BJBt8iT%h-mhH@JdWt92;rRRurKhk(|r~ z;q0Cc91C(dqsm^?9ygY_1tkF{9zbC`k@Wc9x z0%h@>SpM#(%qImC3*lE0`)G}iCC>lXXjZV5JDC}G00oI|>MXQF<$M&jRqRsGV4QC= z|K>h`_{IzceLohI+$KZ^dj?3TS)D5R7K8B3h-RhbQ;^=VjgjG`_s0C;a7sul6_8qr0TK^6x?pTsmJYlO1xUA z-adcNd;z71_p zoKs-NLOV0MBKr2x+{eS3TwqN~37@|knF3y6K(MJ<`#5iG>) zh<%`#>qie6edE*F91qnUlo89r0G#}ma>{>Z6b*b$tQ&L4(okd)A zvoMYTcK{|mGC!wcE)QM&JK+A$i%)y0X#TdMuh_iZn5QDyejmIGxK8xo%!q7(0-pRu zJ9ggwla@^Wb-{4bT?jz)B4kcRV`mh_uO?=8S3ak0sVCV0+V5xcc$<{M+KE+uIVbcy{Ebbx z0&hCm<_Of|s-pX~;$6q3()S2$RobT_GIBy2HIJd2CnJXu7+ z$~VKP!Zm`Q56LKwSG9e%w#nYkdYMX&n?XkzU$B#Y3MAvX10gP8d^Oy)>hAO z>c2gl0kNp3ukvv#3l02%2R9$H8s=N{7VGr;NgD^Ju&W=MaCM8fmqeWq?;+goc@$*D zY%r?0P9k!?)wA_c^mM3SID_g_Rpf`>8ex=9Rie^Qc{zV@DmujNUM8;=V0CQj7jz%B z(ppuc=ew1ro&2T(SU&3n_wf$lV$a;>wo{m#x4sl&p&7x%;57URre8`*%5K^W*`H^K z51b0i8<*gAvO)t{lTdtp(FiG9m!cf4*cMiuAeR4?N^yILtUGRKT;VIFAYf(PZn;`d z;(S%fRFf23qEG5N^_*LEdmil2J70?2&*yz5wN~YJ&Jj!V?m`9k?o@5WA)oApqTsK1 zbX?H;ppi>+5Qfo<1|+wt7+YLSE|byExZ!wjmNz&P#i`gxA?UAa6@;3L+PWWfT7O&g z2}lE;q#k)Ev?eTLQIyY^n8)k!^q!-+9|KDH&-j(HD`TYELn|7EIfdT83wt@2yc#BB zczpI`&7Kj|F&` z=fSxD%_Yt11T@C_OO_(nLf?GXu3c||C?ule0sjlp97vd>ua_qByL_`gsqaLJ09=X_pa z{p-ljz1dZa3!e%w&(o%stNFE@r7DK^v{)}v)vA-d8XbkeV@C5n+4P1t$f}-q+BGt? zIK;E6av~ji#R=kUy*-1T^Wl|8B=C94CaGOBn!cRn?-JMGbtT1P-OCYf@w|I{W-st8 zSt)O@gDfF57-W80gdTx?maY23^Kq}joDE50%Fsd+>p3{a(n(xNzuh4AgL8>l)le_R z|H|lz9@D_S6pGqJjVP8a_L5EN3P%^vu>xhXF7cC_(=cSiH4Y!*ECZL z6ij8v6Df@F`(CkhI7101<~uRcn5vaqsW`wR>xA z*ZU-RK%Z-|vW+laRzY|ZktIxy6gC%xt;gSg>0nm;K2{#xW}I)B0`1@$rz z`7Z9YYKl}njYjX2U2YCYZD7gCRx`wJ9{EBoVU|8gyMbVdRj2XC_4rV26Uu!|hI&(w zIGazDU3oKK77d^Te0>yt=4bfSs^x0BI4h)hs3y34>(0KYjv)+(U!&_Y!_P2pTC92( z)!fnbzU0U+YvM-S>)y&?N84WA!?>xMu{ZgYsij}2`XIgem2|fty+V&+_t16UR-=Z} z_@@T* z=8CPZenUvkB*c>DG$u96vlSDUR&|551owK)o$AEm;^Sk#Ew;PXUKwLOukM-$C5hs& zODZY0RwdXt24UdXl(#B3jQq7XoOTHBaDjjH5nvn+)P_5Hfu(sD)j$Z3Ax~9Z zdEcwA+wZOinEva-m&@0$sWV#nisjX_ywc7V$IYXcv-JWf(PTt1fBF$$c&fKJ&O;(H z8qjZt)FqHaD0xu$up9sUQc1v)E4=PL^l?9bO1S?0O2AAsHL-I}++A;$R$r9Gh4NYW zR$+b*x@v5Om*k{w%I@VaRojj+tyVQ=PQG&JZRMD`*XsXrT58ujs<)WsLz0W1CdR){dm5#`N2cc|{0 z=R4XD-3D+Ho@DUvlP8Il3%u3xXqFutSkDbAEBzWl#`iA$TIPMBEqZhk7C5Z@`bjsu z>Yv5e(bV7eUDU*jBYiVt_N~4zh!X=X z^8lhjDHA6%VLs17>Mm7dOb`oR*cgPYob!J$3k;}|59;%(QNc=G%qA#QGr{WIC+Ey`d!cRO?$Nwx{=<)Rn226DG_y@26HSADE_z)>=dzDk&ENyDO>zbJiC|)~^9erS`$&qg*Nucn@ zQIP{14@ORYrgT%C_=9?@Z>Nhn)+xid1iqmj@7d#?y*aaF@lT6M4ph{NBg){m?uY>q9}dE#l8|qoqMEmXk1yrFcwJA&cSeXbc^L`SEE}fIDdtp+Y*s9JMJ#) zw4SN5tO>BWbbFy$x$`n>)=*t66pvE^SsT*sD4AMcC{`M*MwB&ptSfKqNAtS*zTMx3 ztea@|2{Mu-EvI20>mvSVvFK07Xw}7|(Ug+>tIU_AxfDt&6BmTydM~wGBsA=B8iR5o zj3O+J=F*3C7w6D}B^JFO?gdyt5ymk1xPj1n}@4~wHB9e zdBC!KI@&XrrAlfotS6tz5L{z+!>K(i4|J0=n$o&&l9X-eUqAav6ka5pYXB^k#4RKl z;*`%DTMbcXFwN99El2KT@HCc+Eh<`=&^-2`YWv<=%2ZdJ8;@oPBZJB_|d5#^j>{Vj=koUx~VY4kN+|{ zx;s%q+*y6KGJ=QZPV<38geTnavC&>ywJmt_$H{~B8G$ABGn0Et92r4FPP_!YqX9y5 z=~2r=d|EI_i`R6yd{q!luFZ9v1Hc!hW-T8Ea?}++l zRq6zw5>cn6bo-sc$0RcvYj$5=x;A$5NL5>Hd6<9MxDJB~2}q&0CU?B^79)0apeAyA z9@!rTSNg!q6^g7nDL!C6lVg*2;TMtHulPYZJ2VHN&j&GX(q(GBH0h^hJ=DPb}gvRcXXd~ zpmjiBMVD+GXR6;pN48ai->BJpvMUs!H9!4+c4TRL-!*ks5Jx}>GVIBK3Wv+qG68(# zj3Up2TckI=93WJlJ=ZQyVw2fVqRVOR5mlt|?0|)S2*rm1AMj+#M3v0!`E%Fm$|HZS zmtD*k*d;@3r8ImJjZ+xu76tWCSoj(2QeAQSP;wt6<(nfD*$*j>S-OoxIw1RxRG65f z;F43<0|wu}v0GTyEvb9!J2FzQV3JLzjgLo2^&90_sUvCv!Ia{-9A(jQ9X_I>jRAXD z3MssEYak7Ipx#wZa4?nXfqu`3^Gy3jT<=A57GuP4c)3O_ ziP0vffwW0s5H7*5`ldaoqYycHQwyEUqY($krmnj6zIGS-tbU@(oeY5{4Q{hsJ_KOeG1+E)`aOk42aC_Am+6fS+}r<5H+s0^>ZM-&5Ee< zv8g==Ew{Qm*h8by{8Y*u7%J|2oSxa`r{)>FeVXSP40KE5X{l8S%v@{YpJ3n=uvEjH z6wl(g$i`3adVSS`<1VU%#IcmB#Ey-&o%nE!>T}ENUjGEJ_dBf`;!jAbd*-m3{C=N? z|IrhveU1b3E#J!21E<~g%&aE7g~Wx3bK-b(nYvbwDBJZ5OS=`7lLqgF|5+))pT3LB zjMt8|6uKYm*kzsQ*`IfVBa2To7mw^y`cyy}iO3Rx9j-|81J56_-zTy2&zb5W+*6n9 zKoY&P{K6-LLac_ryeTW-GSv}&UErQ=c)`qF-?nJ~dxPNfx$6tP(CX>m*LS~^WVqYK zq9)m!_7^*uzVv(fLq%CMoczV7Hg2lc@LATrL-^E-ZopHVj{cFS+X2pwl8ACne0==i zr%#_=8^etfd=n5&Q?QZaH%_%R9RVBAII2Rh6#&&Ur}+|RI*N(EK-ADd0VY1 zp_SZSI;@vh@=MM=ALB(V*(|uA;Kw=OrLkR5gao;ArQZk30vzB_V(TI9A}MnGl*1_B z8&aCqH8zM3^>gT+aRJj^-^6qW+vcO8firdA3{x0Y$Ag~(Dvlyh)cMgOuxuWvsk7~a ziUZkSr*3HuXk=Xb?M0B25?rpd;f4O4GSo(!k!c3b6=K>vyPb*>_?0EJm=auIjM4{2jeZ1Qu*dAM5cr&s5|*+ z1ktWn7CnCuDSP~wA#EY}*D;i>=k%qtMmB_IFg1T#Qr=Hi=WC&h^q+l?r$k9LhRtXob(k1@B(3zA)afoV&a9P(q&5zu%xw^m$%+ovSxzx8H#brbjTP z0=7#^ictgDL;Y$PFImz4o6@RvIr)R99@FnJmU!oJi2?eOc%{C|Op)+;^)H%+81kP& z>_MjHcIXF+kQag_Xq3Lla8(3s|C4`Z^K2s?=jLY^L`FezJ=)%VxoB0F1rdBS7j;GC((%A7)8pCP?KU~@01+l>JDHG+yyH94tv$%y zpR%`NTW%|W424vqG~AdL25`F$(r-M&raSEx5=kih2(M3+R-QVVaOXHhH~Ye9Zy8(5 zOz-Hw|90Pc%wqA&`P&C$#cVI9CT%Yn82<9*A+$VyAV-=%S%_u(_<&kplAMDic_g!B zT+)xvn(DPv`ECHeXq*v(Ln=Cv!$q$vAC6O$+MO_;i%z*?4Almo{(yVWf6HIe);lY$e-23(+wpzdMh!*yScwhdourzD!{;nVm)#Y7JCz zW!~&JZ;liihyDm9m`|T@k|PsIU-=G%i0-OKeKH0YTHW9GL7F|^_fZw57Nv=Fc!NV+ zrr>`3-0Ue1pDTwi$9|Rmh_w!yBSjVPDvHfSAbL*;rOR*)>M3?p4 zD2VXy5w`~M(5j-kE>o(dq7|-b0i<)^0P4i*W`c-kunKlu2pZeftMh8P#Exguq@}E^ zyb2o4!O*(-goESNe$Y(xQN4*6M0ui>in)sbiELYcJ2l?3qC4_OE>fYh=VUN;^w6K@ zUy7;r>?Em+=iBrnm4MUr9d#XY9=#<=(H6Td%*6uJA(avgyS=>~FqxJ5D~*uJlgo!o z#&r8fY_x<(xchp*KPzpyvJKLTA?Fz)wtitnRKUy(;5I}K)VVs2-Rl&M9M;Vd+`>OU z&NHTo#!Ff(Z}g9`qcAHpTsgO3iIACW!NXdq<2hbd*?~F1h1Q0(jTssNwp6SLeKld9 zMy?5>&C@#_jjr~Ih-SlOAJY#>icjnvS@FaN&{D2uTOVI~Vbf%E)>m-*=(1IhP>Jj6 zcKhvt4GpArU2c~~4lv!loxSh+Y_-NKmD>H>%Uv*$B;)t~U{9i6$Fa3qv@nGqOD|j2^wRn>`AKY@ya3(a(CDTd8RHj~=h|2Hbp z6(^@)%Tttc?0DGmS^3t96hCg*M4!22&ruGIA;+-RbW;kofjw9SVRPj(3j@3q{dCeQ z=r*Uq_TTi+2p+sG)gi6JUtx~adFqw;n)sdZWO>VuTEJeJ3)bom@}rw&Ang-k<|F#d z1A-}C7W7VYzTa!7a?7jlEXCwKu zW`$pI<>|WGNZZ18i_D6=m?$X?Q^8fjVqT7>?2%IyM)r5{&ZF4CrH}kRqC!*%4YEe> zD@Db{Mi!mZNK}l6A=dO=IATMVnh2C~S_`_i07HHNo)fe@w4(ZhrJO@sRlCKL`+icX z(%rwQ|9*i|L$@-Uj^uO%iaopzpQ&W@&QcxUZ-B{lSZX+{G46e;pjN3ro_5S#R(0Sc zwUPa79;L+F0c68v1>bv@w%LWveG*l*K7z0)Cn-UcJ`YS34bT#Mw+cSr1j5Ygd>+1J z1VtbM$%$6q3U=fbppu^U>7IJ}W0M&a+?s5s8C$U)$U0@l~=1^49?O3|Clio zPC^{6vWsSiJ=`1SgDlBb%_!)&2V-Q!`&{+4f+GIiz3%85v>48iWP0Y>*P3hUkF8pq zlM@YpJP!4>;x?Cv&@4r;-pq6f3zg2qVi&|?WR$eewTX53`GoOY8zu^jUkg$UAcQLs zp{JT#P}=(PhYyBM(w!pbn(prN+_^Vg9TCeQkVZll$VxJIrNP&7jy}03;4&d*`84AI ziu&W08tzm~yIPv6Q&oX4YP(-AYsYJ&g~X({k3EPLRaG8&7Lw<#`Eugmh0fUF_d>X8 z|3RG3(mSgRH(ltxgW)jOhOtmqm88SAZgJbYQgn>E z=^t|rL9D2TbExqJufGWhy(e$b!~GHzAF(z3#H}gQPL;dh#O~nkx;2_F4FgB{nKwS$ zVkpDsf8W-sVShrMXyl#bKD1SC( zG0X3|+h*;fv-cdmdcSuklALw-!80Wa3 zjVX+>ja+l*_nJPRKHuN_kN))Tz4z<=dOe?y>lr0SebSZhUh*cFT|&$DGrIDCXjYNd zZynw*sGhS00k0TG7Z(-XyFGh`nU{YVU<>lo1MFAsuL~RgR*LbCaq3o6INK-DuN3nn zX|3DX5Sp{8-Z%{R5+Hj2T%6cuXzRs#cm6GsI)t26L_5u;1~h+Qk$u?Xbb6;ha0A_c zN~)`~8c?=AI+JW%^nl1Ww+-?$LWr%PNC9lUfl&(`-PUGxy&Fq;N0L7r&?=#OvkIM& zrO^;EQQ=*}y$|T_Llf|tM0g2dVtPCi-La+h*pC;;q@|W0dC;yoK)e<>D0CWBhjCM#IUyK`Eix@n&qo z2cH_Gg@l7b$Asb+bWwjUoC7Z^4J0 zv2WiCf}BUM66QHt^`2&`p2wU1;m730=E=?ujH1SS2j4GygWgPL`A7{iC`F3u_SCiS ziP5Wx;K~{>8-fk0ckN^jmq!Ooobl`(LAf$S51@QvOyFP?Kq#fZzf@3wf$bY9(NV9Z zd}RLe5cIrX_s`zK{qJw;N4xGfEEYsFzQ2vRneUwIzwSHLNuNn#GMT7o2sJ|%JMf{k zH8K)Kt%?;^^Jp@8RcH3g3(&u2vgda(7o*3|=?!#AQP2!n&w1me8%RAqR?T)NF%H50 z;O}09zanugq%vKT18b)7-TFKDX8K`1Hd$>wC|zpBUqxF)i?2CT*|)WqZ}jhGTquxr zYX?({)zGyV)=O3mDQj>CkHn?E@-6q;gS*}G4wY)02J;X<6c_M7sejHDP9~`3#IB-C zP*Tr!W1DfSHUK6}TDQD)t8~?-eYeHUsmVd&ML?Ov`o<69(16HlJ3a;jT)%K4rtsJ` z<5B4fkv#X2!fIG)_z+TwTGiyLoD2UkQnb;wuAhAq*qt4$t;YEtV7+}_XHIR#w|yC$ z?V6hCX(9HV;xqAUAiDg^z=KwSBI+Xp3=CRr$m2arT7gvi-4?V_l_ z&m8OWx2*V^I7`NX`ECcp9->}hQSg^?a&im4LVWD8{cQoJwEP}PQ zaM4Q*HS?6ahC$D0QV~~3P1qz1eQ5GVHf`}J6jD03)|+>2IPeomo0xF|ug7Cy|1e(` z2rA{Zy-e>97GXe(Rfip{2E4(E7>n?Umf_(nnW2WzP>W}x#&h?+yf!N1`8*=POFOQ< zfzEJmRJzbTFi;uEHnzbh$F&YEO?J>Uv^os&(_*G2B_-N&*J$HCtei*|imRm;EvMBh zlb6~-YVLr|qsw64`eb5>G)+d1eJO&a;Y0RBdHm(Mfz}Z$Q~1aB``uHzqreC<`y(cQFABlgyi}20a0TL)+Z0)N*&uHGP2soX>0&Im z;${FG5IN_>N83sIN*a2$<@@(wleekoZb!E)Qt=esOWw*bOb6K^+gf$`s0zldw5 zES6FwP4m}JfRuW=q!Gd^Puh&GRu;LUyZ~^LPH+#Xrx85k29;?wc?KCbVPC{vVL4oR zO)X&$yO=LGRtr zzN{p5x$@9UIxRnjCkFlT9M4^alG7_iMj7Eq5DD-@K^Km?q43;PSS-eF(93gbs2dFq zC43tUwyc_j>?HmBKi||y&yM6sJc*xuO-R2$^JmPMbmBO`ZNp6j5?ME!eE|9RBPAsT zi9m`U4o}aDL_3@i-a?%8S)OyTd>ULQJyInd59Kh0`3?uD$0OS`h@We(a#)*`Lv}E% zjBy(pEY2ZNAJ(he?+I9Ol6XtYogF6=kcUiM{U-V{x0*10UjO*?LLQa*fU?Wkw+KRE zUI?j&6^)D>x3AgJbZ4!;y82Rq9g%H1A5`m?)}1$4oTp(+fU$jie705pc?@(k2$UOe zAA!Rsi54M-!F^RXK5$w9C~V+=dZHzV6L{pCTvun#=pKkn975g{cNNc)V#B!Vbd{HZulR8vUXWhQ0 z-;+%e>XVU?(Q%i{6qj!0!(yRVm#Qb*(-ieGmVew+ZeDLe7;izh>u?klU6SX^gqw*s$X-O8`0*oK_XN-1TT5K0!0V@VKh_~1yFWiXJZy3rJ?H)`xK94qzCxpN zpyjRN{rU%~U;%Y2nB74{g6x`U>}QXfDCsgjwaCfu{CdcdU~um)A8ET zX#>?>S2~`{?3B0so;Z3an-N6s?qskxDy=icxQ_-tcQvGxHYMLSR+Cii3`0!X!&WHK>x zL5|fvc%*{ir2?SIITR>VR^uq77E&i1^0|1csp*S)u+Erj+=Ac@!19a)|nokKy&;Ky<+rMj5p=g;=8NOZs( ze7D#6mNOxna0$y52Oj=Ru?eBXa+P7HY=K^}gBP)^sLt8^cyk3A<1cScOpwg=ryO zdnG?71_x!hzs}qF5=E*VVEoeJrEu|~hk^5&*ew8PCtXFEEB6!_pGx-tJGWdKBB)=Z zMNAiEq|n$~nG;5IU+{cZm3Wmy*W{cmrBylT!~cBNwuS{tYVEa<^fcd~X&zt7$3o}a zFWQ#Zsv?S%8VsP+9_5>B0|;BQP!wa2CGKZ$v87k>OTg2~P5x*qmV#;@@0l~D;2!)1 z$7`cM4F_~O{3XnpuHXs0!#II#+_e2N_eLuRqFkGTDGBXH(Y4XP*dGYycLmgQmJcTx zJt9IVRYhMfEGSaJk>%q^eyszIzmRGoqQ|$W>yXlqv(GYI0fimH4T+RdL$CiZ45ez7 zVY5gEhvAil<u_^@lsX|suCK&~;G^MgCMRkRm3#^F9(@9hdd~qJ@Z975g5~xKk-oQY zzk)vBG6haSEj95yrEV{UO5SO;xPG~Ii>n^`=VC!y$pE%ANIDG&7ks}gL6@;8?PoUY zZ|r&8g~{!0+C7%k0D?bR^X_jRf7Pb`ne<7lCA={Cp-T$HRuEe-D z(p>3t>Pj@j3peM5pAogv{HJ#mlWcVBVPzxD-Q!OG6jZ;x?{cxSb@G%WQIUu+=wX#x zf@vWiIKMz|Qtk*@$|SxD>(^XA+TZ)Nrfz{WmGS-@7jD_1?s{vm?T+78m2I*) z?rDDrm>q|o>Mk%2KC&*MUGU%((k%W)`)&OAuD@(R*TT>mq*NdbhtaA|$N6L^>hB<^ z$Pn&*z~NYGki@FkQty#c^U4)velCfv%Q?2>l9JRcyW(Gb&0S9DVQZ=+F2Oy`E_4@1 zY!#R}x=~lZ27yGtOJ-}&iy$^4wqTEHa(nN_*T3?;%UWpPv9omxUGG=a|5W#lLf^7# z(#0+7JzQK0luWR9wU(emJ)qtqyWIBjGHL@Ob(~Wg=`|81C++wHu2$uDLq}7O%ciRH z(b|y}uY+FABy-!1(L+f-1M%z9w70eJio#<$d^+{eexshu9lP$`E916v{WjNU@>>Ve zpu4BScYT(L-$6TKRlhhK_17JcKqD!czn8fPYM#+kRc5wKyuM0D1OpUB3j#?Nnw(!C z&Ebx3iLJ#&Bfv%X<$)4+P@b%6FWwVI1=2lEIZ{xV43o*Wp84~7O8u^OOc&&3-c*nF z_9Iy~wPoD21F*ysttA*=pEDw$G4(*V-2xD9_IbZhFmvwP!}Mny@}$=RbEx&PBloiH zgx_T-g6`Eq|6>_Mh{u&)@w#f`FnWqcf9TIJp2 zExsND4G8dS_vAs%n+mmw2tzo#q;94)_VJf%U7RoliC$+DnYR7bZ@|bZn!H=3+rDzZ z-P`u(3f!Rm5{Nc5q2L(Z<2uisg2-oY{`){-&?ZY&SDd-juY%J=^Cq+bIo4=uE+%H* z{5@{>Wp;rp?iVYSGQ5@dV`9QpSV{d=-7EJIrbAybh^PT%W}7Bfk%*U6Jl;D!`QAkW z695uTV0?!^$R~gAq(falXBtP>kQla5WD|^wi`Zh${xmq?6`azUB=a??c@lpOnU;S) zcV0TOUQtuF3SFg9qzjE-~< zlF)s4u9FeWo+p%-+wtEFG0ImXibb&Q(>|VPHO5}L)@JU`-zi|+=X;+t@9ei{>EPf< zB1idjL#ovky(5bM$oxO$F(z>Cgx zD1_?PNGq^;hNbZB0^@Le#^jrot<_yJ+6?IUmW!_T_Sq>(i8P%g^Vf&6CpL>7YWVl% zfJ*t*Fh3y%!2Baseb&YbL>{NacWK?KL#FMsE%82jeC*Uw56KmOcvVXGf+~+Mr~!K( z`nS8)mlXyy!Q4lHN+dC^G8lgMzUC#y)hFH%)p+f@r>nH>~53Pxoi}G(5 zEq@FGAgZ)6qRdX~@uM$2kVyR_H&*1SuS4`JxE5ec@7G{~H^i});r~G{H_3(kcz4nI z;*6o%+T3e{JI70OQ4vgqDaC-FU)7(CB{zZ3CXXR+W@cs|{I#(_H9Haw_J-c+R_)$` zsFOK2h;5KkKj4la?o3kR9U$dj)6^C#eH>gjuH&?u74Gy-c4Mi9p5NV;Wz@)z*FJO* z-*_YYqQcE?ZRGwZfMg-e_K+otM&vtp>TE6sL*7HC+NnBlHWxU~Wb!04rxUoP4@dH> z>4%{5Bu_rJ!ZFW2?3)0ir?L*hCAyr|y?@@(&yG_x{~CBbhw7GGSh!RVeu4IF?(+zs zzdkc<)x%1i@L~%@pV= zIg#(baUN_uO22WfgP3~^slL)*+Mw4?epH7vd3r)bR}|mm++~D8 zZEt4_2vlLiETm;+fd+PXORW|WS6rL~DQ7M@KpnH~1~usU>UFG%{~?S7;}gKgo;AkK zRd~$5MtKzJ5@}YM);zhS7BStvgS+c*bo!Pa#`|A55=lAUF?i^>@L?3roon^6oVXw{ zdC23$P`WDoZsMM&_v$R0)%Gv{*5O_evyUINe{Y_(5{r~A)gD5{97Kx1X1#c6d_~C@ zT8;VGSa%?J;6e4s6&Pg1U0}mICq-`TBpYpY-rhaY)U9opE8wpE(p9}0sA6V8XLI6o zSQGZor(x>}ps6eyD=QX>oeiPxJiP*HpQ0>~%jjFw-iA69o108CX0|}^H1Ae%3s251 zR2kI5e9U^1O$Wm7wxC~2<46RY4Uvu9k`1Y*De2}z#3y7f`dxaETW4PptL?BsPS`jw z7rksa(i#WcpJu78ze=|@(by*|38JGwqBpp+t62B=N5O3VGzA7f60uiEg@XwzT?;B_8ju?SrHw@(Gh z&*4@CogP*vh7@h3=D25S?@Zp0n&s6x?rlm#o9RE+^53dFcqgcCJE=X|hR1~&XRE+_ zCbMBHChZ=xkWx3J;AFAef+g{<%RK;953HwPXj52i5e}COzVDjtpOu~L?d`FQ(wIIN zAt6;YXz?>1Bv_Taiiw27RruKdKF%g|l(%;$1~HpDWE??c{1~;9Oq^8#1*`Xy_z|(e&7vH6W?>dv#iM4)VptX%kTrD zow8u;9ka7iZ>&Ug90xCKMQ@7H;sYNyip1rPI`crmtABMNjF@4j$!P(Dn%ptVs(k$Y z3KqTAs{aeV9$}mkEjPO`zB(^8fT>b+WPf{TeIzTx>MR2| z1)R7ra-VU0+{{x8oKj0N*#vh}sV%jMb;Tj&X$iXExkO;a&g?B`+}<5mG9ef5zZ!td z?*H91pI@)Gm3#2+_|a>FT&M0_u5@B;>5ZASqt8D&&XJpy>&+a|`yBKg;!c^_5g*vV zE88xH9OX$T5uWWkSnW5JIp}F`|BjA_0TfUdZ^McAlfMP+P z$N7O)#X+3vZMs~dp=!vg{}hzEvb41HqX?hm>SpeffB@0~ zEXqb`bYFI(#JrQ|#TlKuWF#1(p*fk9B@F&@*xH9rVvOt%4JBZxgg%#cIpV~>Id2Q) zk^$eC*X4Z{v~sOzU5B{LYZD1a(l2@0C2#UrOFoZvJy0kyXm%P+vO#wUJU3*T)R7Yg zweizls&8ce{r@(qXiTvMk(!{`23G#r{7q(Q*Yq=+m_1tFpl$JwLlwFL-tWXHFVNtM z_I(n&*LD#$E)+Gc0%jj%4>$-f?9UR-jf_woI?l%y-NR-WW!|%LII?io?{jHv-oKy` zCcLh)E_)`Zl0HU})!FQ{@3IOZl(2T_d23*c_9Of+7BzIDy8y@}O5Tg!>lg)aFutz5 z{EH}2oM_EQ<5T4)JW2(}pTUJ^8y#^%(Filh!iJpA8kw(EwKe^T6Jk&F!3ux_@}H~U z@?#P!33gHv=&Y6LK0#}stLcK5A$q5iXS>cR@Lw{UeV%54TheHA0WmlqMJ+RLY*&xp z8m;P(;pa=2Qj;tL6-g8(do{Nm!0s((EF@a4p_@b0RBcR8N{;Nonnn=>e^4t8e9m3 zM=3N5sk-fZ-;`_=48BK?~Aj8Ap%J69v0BocGVmOpOycboby%R~ z`C;7&L3cbNK(Kq~bg>DAZqpDlNHqne7h7Vv1qg!b6$li~kP21rDQU-B>50W7P8`R$ z*;(et+lRqlw_QIg`y*3SRlBi2wnw7gFw`EcV<*) zPoO<%M=6^QR86<59Qrt}C>qGW0nS~4K`cX=aOm~K$ZOy2KT=IT2mysNb+`MU{+Dx* zv6z?!W~1Y4BH8ilOn{^MGquf|qEdIVOnPuguw{E!u)r`gyQK!uky>T~uKuDLiuF9h z*e66taV2AnhyAeEhs6!GjWX{>5{JZU7Q@hf1nh zraNs$?JFwA27{_~%M8$?nKxP5h);FOG8aRXGya1m`q2);80pdM^Mkx7FeJbvq@?=n zVBA6j=nj*GgO(U6NHpJoD1M=J&%|QtLIN_#D5?$c%|~in0)Kh!1gF;Vs8N!4T6uJw z^%QS^(w>-;&ZC;}rjaVuZ{13THt51yIqqvO_4H5wOqXV~q2xHX$jQ@xmk=%+segZU z<*_?-8<1^ktWnycFB?mIm!XjoS^);FFmvzV=-+~gT1CA~e)Fr2dSIZVlr7Z%r|q;W zYR_BW^q-w&cFQ|TxNG(IMHe$^$31wi?3r{{(oeCVhE(7U1~wd6@h>YawXM0z5K0o3 z&P=$zMnSFtY_BUnwgE^d*iW#WOIlzch`c7VEtQ;ToLAMfcTd1>*2qcc7fAjg?2LWr zq&0~71NQ(d(6g0eE-)U>TLdYh*TS!p1Si#>Ev2o?lqL~BmnS$Xjp1Y1y}4zG;!K~pZ) z8w1{v^CTpF&%nUIUiE<|y(t=xu6kJ`@TXs=E<~TqWoRYwx1SEIq+d^B1{aBx{)5;n zeNH>{6Ke3pqj&oDi^OF$Kcmh}qd3%5RJYqzmuT62NA@<6?7o3BO6G~_ zWdu3G$&+sad#CS-nOX_OP_sdNO@z4!T&r8G{(U21&@+rv`rnhkXMXR-fIUh>Qvoz$ z0vM<5mlO<-^_30+cFAQ0;XWnecWe6sZtSlnq)c|TQz_!n70Btx)jNnuxO1X~6Lor= zjG4;T)#z|Q)C*d;ov|F>XXSWM}1#-Z=~urvh?`Is;6ph|Z*U}wJB<@oM-UK(lK zNZc(~;FCpZAlQb_7ix1&$;5_b>EhzzdGJcg<^`_%@#Lo@C+C7=9Jt5?poAFN;N>5A z=y~V9@BO<5Kz;W=Uq1aWRl~l3$&Q(aaN8+_gV|sD<9zHjAW_FHsWB9Rycn|L-=>1~ z*G`}syEb5{g;DgSlZw8aWAWUfSo7t;;?5-b` z?rp`2;-TOE1d-@8UJr{HknvPePJU^xBcu>*kwCa7mpj=Tp)$=e4u^DbX@nXwCp zmn(NLdJCbMHtWs~MGyReU*NsF(4~J@7f_god;38CF4(dRQq{C++7avzkNlANN*c7O zV5$tp?1L|3w_ddkh&n$?am&03XUDaz>o^D(t<*)GK8;Cj#=+Q~2J-xWiSFQI+qd~c zHUtcu1I1a;1s>hDJNzY%eXqepQ-0aXu$$eND`L*i$7jmCG?5b_m_O_HnC;3l^n=?1 zGVB97$8r-Q+~)8)->$+e(vIfhg<1%`%LnAjOd8>L?!EOh7!2Hu*oHE{-lGG}_;fME z#ihl@Le1!uTp8)l(==wDe{sDi3!zjC$+RRk9i+9PV((7)DBb$ou@2c+J`>cs2eilL z3M;_)8A$o4=gbeG8(ACmPS0CcfSKUf*$axUur8|I-)>GBeg(B8!z4D*nl@Xg68kD^ z<3L|Odpr(%z3r%NE*oqXpDYZTC`vq9gUTUiZ~BCU)W=-YU!$-y!OA8<=p3NCB$gy( zjN_*nq^V%flS6$ksj-M#x4zez5d}rs79r)92XU7XB6jvBMV7`d?s8T6zb~}*=xE)+ zTuM`+tr(Dq^OpOEltxaQI%I=JkYc&t_%snq%}#|rZ4Lpt52?`>BqR#p#e+dbkGJLx zTzYhsbLH`V3iJ%lY0r|a7VO?Y9(1Pg$prUruRJgFUEN>EIZi8 z#>`3uJ_g4ucX~(9NKa!i&DzFn^{7fu0{&u~c zU1iVo+UmA&S?O)_R6u-eQY*kGyEp*S8$Vv$-xL*63*ZL>_+Fq(E-g;!7s5}+kIb!L zW5&8?F&t^x%Bg0>kJFv873_XWIk&LdlzDfD=pa2RSartxMp6ivcU77+bS|q)+c!1m z**4HkNS*avSv+5hi(mm0TP3qQprSA(Cjmm$1GI5nB#Qw~jb5})Q|~4#)U;Rn1D}|? zG72|jJ>(VOAQ8n8ZB2+(?B2@5+@y z1wK!&f)NL{Y&>af7dsHr5urD}QtcaLIYgzFukkJodKq`5nVuXqNDp=mr{Lf|nQLHl zLT$ctXm$!eS-CJ0Ue3s)s{^(U;BHmVTg@i zi~9(T^z+#OgFF1?833JkvazutsJ_IMoV=rs zAQ%}O7)YOYHk&pKFbTG96>0NB3z1#$stg}8v`=cPK!+`#or-`n3y5R;HzNYNty-+L zwr$pK4nsX(McL%IS@wRK_ZI!@Txx5Z>MaIx54ic<{_p0e2buO zWCH2cv(n6tsdviOOss<(4L_ZHWnVmWxq|rA`dLnpkZ+dteBjajPfeHo@;w3x;lj^dv~BA3$+IW9! z0#G{CK$;DOU_qD0H*>7^b&qETPDne@IkmfB&4>dk?dL0Vb zovq!Z$P!?n8_c?Q8ta-uGTHaF zJyutJ)j`8(WA$+F)o6V_L-&eY2Cd1mbLMSesb+WwK@uf16N;8p8B4j4+|JsQ@@~J#R%c0u=t|t)H^JVc&GG41Scy_a#+ax; zI~%@!8N~p=@;Afrk*Fy$ebNi~iJUWB5*D1vd~8Ph>tor^G9rI#GQxpC{pZc6PFwtr z4rLRJOiJ^KlrfTQcl2jK4eB$>YNmOJG+T>j#nc{Wm>c%4le+ZI(Eu>D8bDQO;Su=2*sUTYe zjH8#e`Ywy8y-=8kz9l1hwrWj)4^lR$9f7IvEMy5|52Ic4%*$9?(Cmr~PZ}g351yOTCk03P_F=MK=oCu|@UYeryY9NiO;b;;RS1Y53WhrFQL^T*AZ zCHysCI;Te%my(4xAnTPUEz-2pGU%Q_oHsBs$70=q*Zb?t2Yws(@fMimPhFIXIF^cV z_w0ki(HX4(KSX-RlZ+dD`6=uz<-yO^60V|N#bY&2uYCFPjPk+L-M#XOsfe{giF(bJ z*=o%8K{{qI_rLXqj$Lq4e1qU)eAwfsnqmg>6P%Y+K^ABH;7OUjzCPMg>mFBJ(Cv1< z{Z{8h@lu5EeJ1qInFpckD&Af4q@3m)}r{nf<9n&NdjgUeGzkH11r5- zO(&t(ElgE@5x54f0@f&SU*^uEGYZEDed2|Zgct%F{xmLa)2^qQmSq7 z*eeUwYsCvsk%{J?+FDLluVeeeeewDpYlt)qREI#8X11Q9gb zOgKDa20bT;iqZ zZEK~L94hDe#P{j&z@PQSf?}OZ5+XjgcIw#r#ShK|+_!9UD=SeVd8Ds*)xaG*gL~km z6#y?41iH9Blbe}FnlQN46xitE`-N6+#y?eZ3DhLk_%Hhkv_@nC1sOjiY4y6J<*li# zYRM?pkzd@G!V<(n@G!iIq8JGNeosSKIp|fEzz*fHv{TDhH2sg7DP3?#~ zt9c%@0VkmDWM^i99a=5JK-^l!lRUEa!a+2rpz9Z~c=k_EFkg?uOY$JqmY=P|{r^X< zRJRqd|5q_6?HZM~1s(U4QyJSA!1>vp3y7Oe1MizY5AKNA%sw(bQ3-6O-2N(J5agjS zL`cnfjBSo5rjWAmW8H-}u00^m#JWZl*qIVVrW7oz3l%Y1CqKA@6%Sh#!^ z9#1;(3K|=QMIHFc_SL-cKW*FN@$VL12BVX$XKh>p-aGTxR9E){pLxm3T%H;N+bm0H zd!qm#4&_^BdadC2B&g;>sPf)}d&|H%O@>mL-YRAfh`FWFQ?>V}okBKn_@9~@Ok-GP zTyoQWyQyqNBzn%(tknDiN9@bvX4(6I&di3fmuia*(R>X^ip&dT%ra1)M`Lud&19;3 z%eAV&+hr%V*X64R?(aZTZc08)QAk?;A0bj^_P~%yjWQt|(;D+-p=xyq*o(4L2j9<| zbkZ@v!vGl~*$}HRCw)df#=!U&{7gN`>fIJ*gnVO!q9XLci{snf6$jO0>4~{OO2|N z!FqK+eYsMKEIv((1MZ-VnQ-6oRhv(m?V|WSSj`*=6*|-pm>a6u$N6sh`I+R@!l&9x zpRN*7)q#-`8j+@Hj?JIaN2H~GYYM#2eN)<^I?v~AA@`~&Udv;$UmTrt9eYR7^`IN! zX*2GWnK6QX+gMJ@f2yRLv^vw~h(s2jga!4-&UO|q{k1b&+wHQ4h%QMD4Z|5@IDbCX zP3TxI)FMekLXsNNurIZ?0A)7FA@2A3X8q$@ezLBoQX{0_5J-gVRa}34E*f!@ErUNF zs`h%vVML-Br`@c};gvR|z$(UJ(eftLyi1=(yVrj2ND#RoXd^4KjIg@G-LGwh&y|GQ zU0_5XN;-GiNA-L~(wnAQ+DC#xd6$>fo&{n)g>cpC$j1v;BkhMnPzduT@xnY*jG1*n&Vi^r_kf17vfIHK zm8)OhY((`&(V z&SnNir_t$BOnl2DKJ6e zKC(h*CL?Drl7d8xhJ6Vq%K~B8K!;HnvlR38N}bK%X0(XE|k9zFGjhLbLcgS6>(U+ zyx9{<{Qy9;>kei=f$&jK#WXnWtuhQuf0HNo%eQG^-4|TQB{`~Vb6u#qElVv9e>8QQ zY^R!)l+2s;Y|T1w1_=_WyJ?HyOqc`Pm?Iz+Ywo%Vz#Ev$`Ycm*G6-3BM_0S`);XAg z2o+!glJ+bZe%Y2HM+*T+=b+KIcs}6_wa^ek`UH+9vC3Wj{c3v?$By5pU$*UQZm%=m zoU^43xSC!(Eso>>e}K6r@Cio=6j_9dY{xO;zk`{F2xAewC`%=!iJb1qs@htMBNy6~ zCjipIrh1%4Id9Rh@t89W{){@FSMBs8HUYk7|1gsD26aSAw-JjxQj1A;PZ z>@@KpttYeGKR$j#_$d`vko6ZsG5fg$F3l(V+l={aL78OKWO)5#fN;|9GWK!6+TkrL z5}#>@<^mXjtTreW325rJYwt}%v!5+XW+?e+WubSmP|*uI`}mf?9Oj zOG2n?0q7X(;`>zyZD^`V`=kcCBHAo$asj?gZ8yz7CixEq3^I(W9qaf$C$fLBT1S#n zyDHK%Wg4pWHikhB_wu~TvrC9j5%TqJ2zrn?wMFDymNHB$Y+8F17p zSxOf)7{UI!iZTkf+FrZ1sC+-LQqSQ)HwKz%HY;F7L&e+xVCpWTAr2JqI=$0uYio+f z8YXh#`376I@p?-0u7((NRVz3E{frk#9-23e&v5_BEX#P$kvLiFGakE}{bBoLs@};X zye&|9o*fA%jw))PNZsbI)}Z8qy_Gk{i%i=y z`eC7JU<3pviHk-o(@kapzOOvvW&72jGfbf7_ z)3N{|=*SRKzSleh2IJytsQR(7G6jtvXF}sc?>Xu7ZK?`hx&RuMs>D8%OnI}ixF3X` zIrB-3$~NDBf?tHUG8Zr0yl`wzs(hcq-MYKqG??Vcu9p*5&}fH}*PR%F?N}cm)_Frh zEC9K;OleWu8rY)T5zqvOt)f8mnG>IneCTqtmkBL;fY^*zOMB0erF1`TPb7(%>$==? z-$xfOY4}yUeP$cs&%;dZiZ^7r;XDeXm($!xk!&#o?Ttuky4oP_)x`wmvG3r(;AiFg z=NX4`&P$&z4`{za^**vG0;s7g?Nw7;;B0_sWg+8SInmx();;t{+DOf;+exKxZaL5h zvx8|Fj|EVNV#c)gosszoO!8cKRe5{5&^-${FoTLlu_n-G^m4h!*mkmS&F*>N2T)uQ zo3~mBt6r>^EgFV~;f=EC2`W!+=?x9tNNC1*Jc3PXy`X1zf#XJXd?g^X8>o=No(7GCS&R_{9&Qu<+PoFrH6S1iDic-Sa+Udjj<8Xi!C1|)e^ zDDVABtuk3zS=5h!s4ZSG{yp9%Rc#M+OZ1ai0Kr4Q{(t82$@xATIR&#kRNRLshg^_Z zmr1YjY4Y}Kot89|+#Cel5%5OlXzGc*KxDqR4XC%OUKSYx;j|*$ql|}zGMIA$qAsbD zx|^*AZHq4)$E{mD`tHV)X1BaH4NAmo{_?Rk$Go3^K;)7HAP48hm*Pe_T18#}CKdoA zC3XZsxUF#X*`&dn(L3}nUf*}XLvNoyyq%738`eokhF+5ekvkKe)>aNv*k)^!PLL!+ z@3U30{G_;@Th^MkTj!l_TRcc%K5YGi=KS1$WA>ggKlu?~i}Ouc!$(Ivzx9-o68N8e6Hb<0s3T(DO`r>piooJFIJpL6ubY!?}7zY>^vl6I!FJ` zBg-BbNRimD1P5(viR6n@`h>q8W>__jwLr+hmV5bkhM0s2I+Vb7)j|g zOcqgDF4Uwtjhb@I^K(Vu&FvV^q%viEK=I- zo^G=@P@9T{NX{=%3newv;qi!UOPR}XTegS|d+}sZZ4WR%-*iO(-FWn$R{%oYbd+j< za&Eb*kZq5^^rmA@Lc{?Y)h~OdT-%Wt)!XI#`1l$n4rqq@qL{JCJtc^MYnHK*94Ry0 zJs4pt@LmllkC>C7x$p|E;3PKm+arF9*skr1g78_?m*@%Ke^1NVfD4XCX~F1if6Hu2 z>@i~Pp)CSN>s+kMeTU-|(ST5tCGIquYx=UbLzmy3>XvIki&K{1cQN@T&mN*MfxFot z*Nk=^UIwL|rTBEetb6Tr1H-wfVd}HxKPe!|abPIO%gf6HOk=|`Kp+StFVBT#Q80ox z!y`w1GeB1K_(*H?#7v9B`CvwpnY8xzrDm~@z;9rOu57IHpSCmG&Z&p#nWdm>0)Sc4 zpyqQ3P3!`GVPs{gjn$&YJ!e=pVk7$~9tC^D->FZ52-#qd6TuIi#%J-?T0N7pT&l*> z(lVUc_p%Q{CGC6`!Su4;m%ft}eS~%NfJHWT5EH6>1EI;mMKak6q+iQS1j+2rN&@5} zTQCXJ1&B#YU*o)01SI_&Fv@8yH9YfpD%ItQK<4~~%HmmOn2w?HOstJ@( z>{|?RkW{EZ#5*$m;drSA^GEZ&%JR#Vd1YJdb!Yxy8gxLr0}`l!K0e}ltm1Ls>IaVk zHUd(<(7FB{;H7x*rgiYTOWe?~)E!x9)j~3wqNVfP1}F%C1>r25EH>};W!Ej??S&(` zyrWyqn~eX58CbZAZW^w+Eceuf$%uc7Txv+2GN!fs`10kZjpo7+@IyGVJ&B|YAc`8e~+m+AXX!X zroyDIvGA4$px&?h1n%5mHX_$b@L{vMkt8ZaZjh#m&Tgi zwGyYm<~#eY%?ezj$rnC0o(`D=aeRFt?Qn|F0^98+*sy(w<9D zj|oUH*tvYAD;eTWZGvz8j`OWn2d{pm%(QYTZSJ02ReW;Z3FGS_b@c6Tox%FK-P6iQ zX4cKRXf128c+$5dRzPL$RlhVnprqAuY48GedrFgE9}ZCg90JeomXTh4y#aC;JE~jKg>ChHvu&`#{**JBN=?T4BZHN;RGp|3h%L z!uLvDj=&TA2-6$GNjkq^)|uzAp;%^t|9xB1(u~|f?34^+5BTa<0{#_D7U5_&toj zdOQOrn)|pKw{*=}xboxNYC!~>l5==v!)&t_F48hH{4#5eMX6vb3n*X@y|(VO{xZ+52S9r7^e{+J9IPP2EW7<$FqF(Sz&#EQ z58D+w_w6z>*JSXUZ=E*)at+_$m}L0bq47goF+0`fuBe&7=3X6mfv9sI4rMik6s^WI zOe<1X9g->_k(4q5Yp;h`8$}uiVkMV**p@8gc)=NF%)V`3Ex?;@zwG@PJ(O2jTv4y=paU8rX)4$zO zSa@ffW5t*#?OdyQEiwpWaa#Z){j6DNv~`{v{a}@g&oi-~>UgQ*9rsV5zA!5K<@Mlx zzp6`ABtqROdM4dBdW$I+Ylm*JxI&^Tl)PQJDxwdPU&e!zly|ewZMvKdcRM=>zi)0w z+&!t#pIMloh3{yQwf;Y*&OM&#|NZ~Hbv}}koRd(5O2~1^u_T?4oGOJ9%V`e7LMr8u zh(cCW&W9Z4Ff$})mK=t$VHjrSv<b2MNbv>`=bv>^8L*H+2 zD+Tn}`+;gJZL$rvm6wWCI!N+aGv|A3@MRd&smlnu{ zEV*zmuf|EO#x1HjE~!l{8R6He3fWbQq5MI$eU@s4Y}Y^;E|J8BPsH*TAPzIOU8skr zo^IQ|9tl~HA9Op&&{f$qKiTES0SN5Bhat&p-nV$mnTWMa$nCAm_}me_`~b9h*^4~y zfjVff0qT(+G!Uq!^MT};deAZtdeOB|vs`H>?LsdN95Ae;JAFW@w{Z0bfLx09(yRo& z{1s=dEOG`@_ibBe!f+6BWTTRYe1MJ}|m{ObGC9#cpw5B%aOBIZsvzF5ugl~%hi*d0*4GoI| zeX>{FR$m}iUf4#gvO?&rL6krZV_i#rb{rzLtY^9->6G$|P3D3fO-I=tO#0oVcdHh> zX~^C_*&>|afRxJ#o-u3*49e^N_q5guOI`cwV8m>mwrK;qi{ZpFU`|Oo{r$fTUvKIO zpraOORm#P-3s*!}^a_ILmg@)l7G&av(>_n0lEDtVdIQ`vPLjXAf6?tya38vx5YRli zPiyecA&C97@5}n>bnm2?@0HITpV!X8E}~{LwEXO9Y2*&jF)kF9eN^}OWi{v=37dH;KXj@h&AsVmw3K~9j%$lC_h5d?7_#1FOi8Nz3a%` zf@PNa%6E0&6cyl^X4qvjtLXwtht-0X)je3jQC`rSmxYoG=+A7LvWwOYvl&GY%7arZm#A7cXYn=A^+srEtN*|R z)lNd#)h3=v{hyY1WlTEqm)t#gT)W|w_pK9P*hP0xO#;|A3GHmDyS@Yj=0e4{(h9*j zqC+w%QTv;{UjlXZ9U_kp?S4ZDNE#pyy(dnB*@|wX-Is*~vXz|eZbTTxEr~OnrFKu- z*wLj*_HNuL=0EW}=8b!a0UpQnb&Ve!bWh zbaoA0b<}pVP{@KXqDz6wYk{oFPuxJRCG6xSQ!AINZxi?KmHg%QOUW zN!7wGX=A%P+2uSYY0!@H5IgthA~!D7QRlK;{8X36%}{&5|KNXa_Vv}naXVn9BzM#8 zwxeTgz1T$KNs{%}0Q0^K`{U(Ps0HH=NOJBsuehTV@*NR3e(I~ecz6%qk>U%wxF?f+ zXaWN!TaB+h?O9Ckypv*$<`*~G*qZMkPUWTt_t^pBVhpWZ#&GwZ;Dau^pXqMuwF`Y1 zwS`t)9!J~lCil4&Doh}tfWvw1tt^v`!kJu2Ow!dnm%bfV9UAKDmktfcJbBk&&{ec> zTeb+FU0Anns~&bU!-}CZ00veLyE@9z;fgDhP_FX<6qbsvY0JTRM^qZZX#B4OBF98G z&94rk5KVqTCbrxX1QUm%22UAComtS^wtuRuwNLL?RnDr~rt@^O<vvqTXtrtxlcUX9Rl$WyIw9ysyL*5k}# z{3Flo>aV}-wi+ZGM;KQA%Cs!aOibQPT`kpf?Y?NVArJx<1UqS}#y9sV5SBuAwzbH$ ztnClL9o4?cYrfZ_IG|)|d0t#U_vN(=!GZXQpxx>lbN+20l||Kn)-6SEQSh~sy*_H~ zY%lzB>#6teeAmzY>U}v7xrJ4JwBlXu$rPW+0claQTihnziWEUFvZdGqA0oZ~c717Q zfFeA>tl!Eg@MgA4uAgO`o35Nh%J!{6%7zw!(hE9kcP|XLe5?%V`k01-x0zO>l%&YS)fijDQ(OIIRp-sIw~y0=;>fD+IDDXCbL)?$r%G z3}fC~l~uu#SR7mS9CfICv%NM^Dv~J3wOmM(*Igon&S?~k@bB0A_4H}c$D|R-ME0Nc z0p5yu*_FB-RU74vMQ<V)J;y2|w$eg|hV$kh<8zrVpn>#ET%29}>WgCAHU8pxn2bS1A|Y;#4J4R zPcs*yd3Gp_1C+~BFjKU6Z+zIiRv85rr<*eXmr`OUMoC%i8szov z#y|4~GB-qswn^9$<+Vbew-M^;S^^ypf+1k?xst~}@vO@mIk3{+FZ(V$XM$nQ(_ zoi>vk*#{yM+#b~R8_FvKLqm@#8;sy^w=a@3W{`9Rs5(6Sh0uK!@BC}=9XIMvQo?u>&$wHwb&SWO#7!wrAXMplZM;-F+3>baH~pdxcv`zZ^ixMdQQl%Pxr9vHOT_ zjo=%ro%Hq2MQspM^V8WTA>$^={YrONIdlZ#K$)yEVi+Gh?4;BO5xXfOl{mi^`uP!q z&g0TS?QFHoyq7Up;L?L(3|(j|_DVVjOjTIH%yy}j+U>0yxkYk5I)?-itKm|y#AiXn zDj^lk>W~JGBfHG8ggRqGwwdbwTk4$u8Sdp}c}HUd&|Y9S+(R$|Rd1j~0>y)dnVY@D z6L_m7hj5V6%b?iekdUD{%ca)}i_@~D0QQ}Dz!GgHw5zh;Azk9z{8&2C8|jXDynC9Q zlvtQTxKk5%{NI}Nk^EPj)0|M4;Zw=Oov-$|`%pk#yZ%y0dX4d}n`I^2T4vxqNYEr( z(*GH>7pA=xb5}x&Wp86M{pjiAHcMBesjG$1N?%g;D}2r)B%#0mO%^0GcvmAem@;#E zNpO^kkq3N+QYHMRkeY3a-lXfRBikV>bw$x;4;xq5E8xbgI4)V;xr_91p)_BI%5O(zYy< zwn-WN)t6l9hzsUftT$K$l}=8nQ)d!iQ*6}`<(A$?H#(eb`y27qNWu4&S`30Y}VY0gzL0Ky6o#@zYj4 zhxkCHj&r2W-j}~Y?E;i~4iDYXO(?b7Oj%rPQ{fN0YST>BbbG3MSV@7fB5GIe@|&8= zLhUb3&ZXZN)&YJ{aI>)6J7)zuGtSs96-5f?48_dAEWO&!aPtqn_tlLYMBB4G*-nm= zp7=nSv+s`-fb-ghWEGKH@b|0PWT8BF=3zjk>%y&{4C3&S?E%d|D`=Z`eXDv+haof2 z&e}VIu)U9?=I6Tl18BuvFFstwCb+fV>b!asJ*lwg_vyP*j@~Isi0t&E<^yN+p20dW zn8{BX+#SpXyM3vEiWH10c*ImW1oyFNXp?j7TMm@!QE_0-LyaJTe}j_$;71fRUblDrAi zE8hjnHxu`B`$`PIpB=I+R=RKg>R>+j$$^IC zE@y6NOSVp^nIduc{JH?^aPO_-@u1%PF6$8se^v>4Am<6Mze&%k=5SmsH_{^L0$2|I<+sf1E=;(sUnLK&GfYR@nW?VA`7F4)|4O?<6172z1yl_&D-Vg7JwP^x^(b@u?#BWtYy=)uhn-^+2m+qwxAu(}EWI}zB zFgqqy@#w$lP2IC;Px_~`#l>4giq9|Zg6&oh#zc?xyzDGis%Sa^>&UvF#CXekM8|+> zp7@*rf~Mtty1`@XCwbQj0#*bkM2?MO1^D>8+}0tEw1U+ z5R)V}2|#DS;lZt0w?ybbM9H_;z=`GH>m8A^g8dl~bWVS;Bz2;ak|uVuEa|hDD^dNx z-}3gb>HYHBQ!IDZ{`cm4q@r7AjYGfkbzBrj0OiqPhGte2D=yvYT|q6(+q)ZuKkxTT zUJqo6rPbAW`*Q_}=J%~tzJZg9?v!EQHMMidZl=N%4wUZ+6wZ();-k0aI1+CF%O<=l|7`LXyPC2)I{m-Q^r=Y@yBxu0@ftut+Yr%rRB17GG4hkk30hA^ zp6(mCDFvg&*DC*GN3~2K0&X#exv>-x3f85XxvWi>DEM)EHPosgRl;H%dT(p-vE}eTN!~&p| z{0FZ8AFcBIz7d+lgjTlA^273KB1j5sBY?XNP*9O_*X%h1ZpuYM`yM`pSJ(iiz0z?& zP~A#JHJ^^THfr%z8_s;}xbzMs&K_^Ic|KM}GrNL(&~sfiMr2$>rb+atd1X=d#ue4p z+<9xr2!X4=WWf5Xwr>neAPr$D0P4fNriS*P{+blX(D=RTA?$e8`aD&i=6}%j8ulxo zqwVFp$+-1<9Z>C+flf5ERAEr)j;$J)9&@YJ%?~X%t^@#XYlytL;P?Z5%b(1ePPH{( z@l$`7B7pXe1ejXpDe^S(HPQVA?wpPMxVuLO{NpxNeribTbX}mV$ZTb`Xw^*a@LgX9 z6|#@7e8WJ^-Pnk|X`pF4BiZWNu{vGUiKOg+arGa1dP0Y{VqVk3-I=lIXN^amE;b)R z*8jm61UK9-)iZmV_8{Z_S9&sN0RVHHG^4Jztl#!EL6sI6`n2k)@MAi)w3(p5v4)*H zr!}9@&WbWXBYqe(cVphw>b+A-2$XwAJ8wBwsb&XcQ-O5^nH&=~z3+=2?#iN!@P&$bmo)IxF}9BpvkW=I^3P1Pf=1cn^QwZ z{1q_>$J?NcYIIJzllF;Asksya$jteBZ~+;}Pcwj=>fCE4x3%m--+~^!z!9t5w&IX+ zMMwZ&+wUPRL}MI|zAABZv`rn*H!m<3cGUwXK=+0$zGZ=-+*%Kc!W)&1CGzK0lzBO` z+kw+J?ECvozk|0w0PDB;E9NXzPZ(B0fIBep`jw;{S79%7lpE;8bSNg;b%cO9el&nR z_Nzl6Bs+B#fKu75h7dv9N~$Uh{saZ`ZJOP2s#%L)y1Tfc%~#a^jg9xtw4sj2R-Kd- zpRDaNVim>U`sn%T_J)>d<8Yuj^#q+{tKm83g2(}!Me4b`p(T9euA1jzkK93{D@`~3 zdCV}7WkvPAT=rB2$Zkvw#m$` ziGK|2tmm$(FM8EQc~>U~kK_f=2Fohk545_46u-Xr>B*Q5AosQj_qp5K(*f5ehd?`L zSpwjgA#Vvf!c|7kZ|CB+;NP4IfnjetECuuujo^~B6LaA4{iq99 zcf?<{WN*v>0FxNCi}!){{pGBlXj%N;9#9BYR6NdbRRKjIIG|)o0G{ksW1QGOfsduO zltvx>-v#yCg8tM=3+tb-4d}U-zgJeC=J^T1d=oYrAWvXvhOn}?%SV$F3Ec~0V5r`! zrQPFW96|ggOJN;gO-rKvC(y&8LK z{Y5}^b_YX$$?nz`fSENdLReMXLEk7T;(>nWlL8?h8_x<%4m__dTl9Y}sovZh*zkp| zE>CA76BQpEsCRR)sI19;1s%Wh;pO@RKfu=_EDR?>vBLcy-ie$s1>tO7j zd|$sRkF2I(1)38C3exD7q6D zVXS){NqAB&{?|SNR|Dq6?W{-5UUoYicG{|{kO0(U;tINj8WQENqCh!po9vxj2zoLnq;Lah zXm;PPyd75H6`S^=)GBe%VJS?BAC!IUG!^X&T&=NwDkmSkqh&+b{Su}3yMiyH-fryP zPvw!TQ+t;yY9_K(;4&<^xBU)VnU6<3mPA*Q-_Z4QMl%dk`sYGvBV)zjmYp9c0Ahmt z;_7OhYesNm%m;;C1(Y?~-3*xS&LzMKXJv&}rDexUSlS~)*1D10aO7Gxa*a{AmQ%Qv z42lvn=l{>uMJQxJ)?1M4Ej$Wjqb{WVb9d0&=7Jz%AJCInb|{y(p6l45mFZNKDEv{w|!1kY~o0O$f`g+Y)diEDW4|MCZ3IK{(9OC&Px$$;6e z*rl&0UJSkyeBslDlla$g1$nw9blUX3Mx7QPFtOvSAA-9YBaQ;6I*8l(!A<}!|Mpm{ z@Yl_&CDmyu9hZE!^JrZ!o9gwkc+oX5+WKk7JbGi!U@<8UVzL;$N zJ$OwFyC8;Gfn!;4EaNqH#nTi96m8c` zj-t0PilP8a4LoQitAPA`%y9|q@@YB4b26g$rB_Fc4dTJ4n{c%l5-fT*0iFSKVTTgJ$&fLGISZ`5{V#f z2hPi5MU>4EVdh(r#gnI`5xmc-a?~27 zopTOHN^Gh}GA9=R)dwFm?BnU#wZ-4P+cWJ|>SXKut;Amrl0p+N^-@(WhYk>yV<|G; z|5#|3Ppajsz&kuAQ(apqxZ-FFw#!HB_3D^cf0PKE9|bbU{dTS&EAj(`kk~uLW|p+u zbHKO0XSl*s=HxJNN^ch+Y&0G0E4{vo>AudF|Bks~3EbQDXs5@#wLV@s`^XYASe8fb z;Rj5H>}SoA>F~Wov_diPiowfo-zUB!GXjE2 z6|Dnv7>SGc6Ni3UWHR@}w-~lnmjBM{%KC`xR_|GAU8!DoppeOu(B;)}_RJcW+o0O? zUAvP-ygJeGCN`h-GIZ~EOmGdEF`TBUTPVKgl34FTR;;B67WL#tvyA?4)dbx01x;0l z?h$`Pr$;$_b%_O?3@}EvtYA`BQ^~7hm^2#-1wP5@bhPGGcsC(EtNKQW)7zcbKh3T! z-yu8s!I5K}D@|oCAsOCex>KLq2Vaf`+b+WiHsqA#B4S7FSa+XgibE$~tmNV33L$d? z#Hp$v-YU0=>7!J`iw&jo1ZsF2A1rZVeK&q{sbeAO5E8E`ghxJ)E~LCmekn%x98bCK zkhQYVs`N8pHNoq^QMeVEpI~H_OaSH9|2K=BqGxosE=#9BAj0Z(}} z0=FQ}`G;bB2IqDGL5|UM5spBiP|Hpau2V2LZH|9-Q;PY!KHs6K z)PAe=m5M8erZTzW99KtivE2B#di;nOW@Q6AwZM&aLyEn;M>dhXrX@f3fk{B!iuJzV z?MQNQr+0t14@?|m^>RHLRhbzsQ^q)*4!TVs|7?i}#$=UVj>Ekz)C}Y&_bc0DUsL<= z&MY%llv^oFCZ+}7O1B6^>2Zx0U63T)a$3XEatIjv*K4AS6&AMp$2L+LTn2H09PVu` z#AKaIJn2OR&eaB|-BCDxf0-Gbyt{x~QKnsRn0)^*3GsK; zvD_9p6t)yzC5T6Gc~4Z__jNT-a@Pf7?^ekyKbVR59E#VM#B@1u!c z&alh!z;Xyb+ z-*;1h{b69GZ;sJql%0!q=k7O)HFd1L*Zy!O5Z$tI!T3+mV-4lrPSVz8Ny{?FZJPb2 z#o2M6U%}k_0i>(?Bzq$3IR1Ioqr%I_N^=7pma25O@%Qt$E1)c@(}xuZ!E8Iu=TFqj zGyHLyTbXM8$XtEimrh#pL|j?Wj#<=jl7TC7h55FR5Npf(=iXS*a>y&Gj==&cxsdi_ zoLiFX{tWN2rom$&c{5tmChs|?%vxei?MkJ>Wo7r5&SHvQSu^-UKCQ*pC!RHhY-8J} z70%YjNJT$b*{s5Q*-p1WC-F8(%BL;z-@?p!EE}M{EG@$Op}L~;znZ8gPiTVJl7y63 z4U`BD#AcGW*l_Do1m(2f3VY&KF25T;%xPAV4JH}mMURQM&O@^;BEP3j4a7b9@b0OI zENLx2A+N1z0-IEdFge;-sA($jZOcWr?FYu~w$3d#k`Cxh59t)$Pn}YDu*^zfMH6vn zsF)U<>ZOo(HWyJov2`Vrto$!uE(Z>WH%vv*5lBHpbTF@Ns%&H3;8@uCKR-5N)}J-i zt+o-%C~RKDDu=YNCxllG;VG4|90R^3(?zSx$yi4I$NE6e&pITHoC>F+sGWF)dvPz* zV#->*aS;#UxrT+SYC@>vq;KvwRJ=aqj2IQ#_AO+41?TFqZsJu47lPVpnvXniF*o9( zZ<{KssJw^>BGF2tRWd4-(D2C^nx!l5DEx6b{^ah}WV|?*9&5GMG}uHTH{OF=w_YCI z0L5%dJ5?nq_q1nJi01p?paq5Hx3gr9xNU(x_dZ~=L%bf_r=ywh2WT+F zWQz9%N0RDqRttL6;MS(KEaF9!(QBy`?&c!S8^s?|%z*oWY-tHd>Jq;Wr#2gMRZcY| z&)gVtp1uA#Fx#QCi{PH~4Y7h~Q2ZAx%$ldek9^fQw?#u{GO1X zQHbi90Au_|#%8>OQ&os_YETR0X=6)jaal=Ddb>YvR`f*OsjOS3O=YZ;5~`+ezq+J$ zx?5jZCR3Q??J^t_WgZ9@m6q?tflIGXW8e*2wphd@T73-P3VDqxihsp2^x zcU?(4ztT_rD|Dd-F9$_`&0F5I!8rzGZk>At3e z=`_PY;Q@CWKK9z$TF>^7silv7xGQYN=dn(oBkfhN9dNToc zWHAOn;V;qmrL30q>r{H~Ln$_$cvN$vZFEv|j@8eVGp6`uTVD8+g5PoM>KL5-=MFNa zrS4ugo>KwayEP>lUi+bt6m#v@?X8O!ce$cPaNVn>-I1&t#Ztjtnf8fS0gdhZL}30L z$P$ZRzm4cgh1}V(e67v{pHN%iK)V=)oZ6mk{EEGnx_iX@Wvt8F`MG<60h1qGE(y^o z)ycy#ky6L*svvVlXzz<&#Zo(TMTLgHwzAfLRAVSwDxC9*AtAZ9Eg)&+?Oh|mI7k>r zvr(qqMfTueY}ZQYAtY}o<5C2%Pz2Jq4f1$NbJ{m)zb7tTDv+V&>*-c(R{S|Ct+y|@ z0mkmCWMmZ|k-yWr^5Rh-eGz``H~Spb#vRE$bRU@*Z{>M;NIqn?^Bm-T;sB(b(9C|T zN3Jvx;t!`geOQnf7PYe8Be-`O`cR8Z&-ubOH$fU9)8wUWVXN$xozmJQQqsjWu_$Vz z_hiHQ3cbtDL-2Xl2th7`B?IxhNUD>dn~BI>t?CN8YCej9#xJ;~iCNk2;r8i1?E319 zb~z@);UqIiLv<`wOl&|=#|qo=w{IhfXIlIJ;}Ea@-xTWKAAh0}_Dv11`^;L+I}-$< zM2{Y_thKFh7`x<&dpMp|&(+O;F$^F7KE~FFCjW5OZCLh)VH54OpDkqB0sO<*yDASQ zG0Qp!yPNp&qi923cFw$88Z>uub{jD7!MH0aD-WXnG%H*Sm#!Q|$3#{lP&Wn|;mY4J zCgev?U1; z?r(l-UCD~NEmNvrscsZ!x#){Q-qKi;9*PaQm9)%NPbphz{~Z{jB#Tk`jtiMGxgam! z)Cg%Lf6;jqbXKeS%Tnv{)7Kki*d{x}lreql#K|qq?OP1i1!5^8@^{Bx_!p;(Rr4OK zeBdW8^;2-CxG8N&N2&1Jt({xORzA33Of**$9Q}?xzvP8Hj8&nDPHUCCJrsUyXliJI zCFgKM@}?8=2G{mAEpF%~&Tsj#EJj#UT0Kj0k{D7cC*BVCa5p24l==^@1J72&a!FlXY*p(oj zY)GaHz1y#hp;L$x-~;<1CbnjF@DN~kIe3QJt7J}2E!RL-y$_X#kp}zwr(7aufyQtS z;OV=q?-J*%y~EWDHGkB+nw!CS;N-vCQ@O0Z4Y%Nhp#TSCsyd51yQ(_tl3D_sc=QU) z0(vAU8)f_2cwDol*yjk_uS<74ap0F#z1aF^*ZN<@rbwzwPZ6ToNkQ6BO&^9yf zi*=!c5^z78Ik=Lh6HttX(QaEyZY|l+t;iBBjulfI?0S{ORx9oZ4a!znJQ5(b?5Y74 z6M>j*!(VqX1P4&6#~Se{*gnQ z_rv>7N*;(=*0NH5Tw1yQoEadyo8cslSSRA@5m$fmhp?q{q#lOkpObs5eA}HEF$~JCy%#7nY={yZDfx^j?gs61|JrM0@r7ALvZ|Y)9Tw6sNzH7qHZvT@T`x3%tZ{-}>Go^-;;hGQo}E+B^l_4!Eb)c^^TbWp#+0 zDJrdnxU@jBt+u{&=_f{#RkiL-b=EOsU;d#l!_jSU(T&_<7>Fa&(VYA*R1|i!%jF<1 zf7%bu-$-AYQd{7FTzq4t3IF?JV}txJy;>Mt;UemSdE5EuQ*0#fQ1Trt$jKwgvYg5< zc*!>NPqFxsv9(VSc#T8qjiq}wIx1aBx=5L>A$V~)qZIOZgdK>R-tcK5fD*P!97ucJ z914@%gMubM+BV_W?_g0VIkdmfc*0{bx~5?yO|}6HvE!E%x7)Pt>k4jSpB?OD2FD7E ztp)`-NDiHOviIXV=tkZ5seH>FheF- zw3nV@aJptED?=*AUWEI!mF~uk6M2D1gB!w`Pf^p`uo?NdCj!nY+Zlz2P>=m zM63v8eml~<%5Q;HZ;Wp;1@f*bWECPAk-&ya>@2SH8$i@rbTjKn#^RJhxHI4JkJgJ` zT=8H>*n`8z0vAc&_1tvbh;vP4UmVviUm~hg15*qL+S(z@MAo!gtfNV_OE~M1@o%p; zPhVltX9A&(NW_&V(@V>jVwK-&EM7Iq)XG3zB7fmM zd@;j`b%{CFw{U63eFkf(7VFZtFtbolnRdD}x3XHG$FjqNlKawx4b(;fH%tA9DZ{Vb zjujJNJ89Dc+Y4nn+*g5K-pEK_4KdJmre@EyixL9II_rmHlH$6)6XcJ1>hfQ@@Z?X` zO{!GtAh{L?+ZSH5z)ywM{F%=8&8RVwwP~inqbU=BK-kVNa2PMVwS5V-xK@}VT6FC`<@bd59_v2IIi){8Dh$c|F?;%5?!rw;&dQ+qLE$Qv&ob8#S@7Kz%2t1YS}YOVPUDt@ z7$%zROq@O*`R0J?2N-ANvt(1|qcA=Br(qp8Wv@wcKDFaC50~j(d7d!JPu9P8%pDrs z5d=RL@AX@bRBn;MLN7b@rWrt18tD(#=Z7YAi*XGH?7BVqoQ#1HuM|@jgSEd@^Xwhr zeiE5Hkg564*-QJzSqQ_@Dw>)&50~|@> zEpy7@U-9^)QIZ|kgPBI1>1GdSGEf$zy%WFR)+&D=W}_sUGPg^nt2V6KD0&1$8s~c;l zn^G&Oq}Cn0=sO5|=DQJhIA*MhkE(oibLMHJYz_48S=u>34J){oE~+%swz?g5(uM7> zjRjT=d1D(!=XiBTjqey>SDMNP6>ft^(gqKO!G-Eef~#Yo!F~2`klj-*!UJmMQo}Wm zSv~ME)Iuc!JsF>MpCxtV8ckAY?zTst*MsHoGM%;4ebFIb=2k{U+E!nn_klY4U2Re` zWY1D;dxuFz*^+9)wd;3H#+*XnhCXPAD~G>GJ)*6WhgR+;6{H})+B>BlzEtQwpP|B> z*kUTeo$sXIZGqei_JCY!o0VD!Z+)>+S4Hq#4PNe0@{B)lIb-~ldn_f@lXNBo^7}hY z1a>iuwz3~`rRJ+k3!QpI^8i66?(7xUuk0qcgz{dp)RMN~Rn3d1LhQ+`6N3EHP<4bx zW6PHh2*Rb*3e|>{5ZU1pWL#+*UVR$MnFC&k+>`6G}>L%0$Jbd<}Ni8KT0Ry{pD+Kq1Dv z6cJ|!zdd4thVT_Pu7#00%&ueSpzg71ypH2Ve91(z^(^M4JXS-nAFjfjZelxwvw#gB zT3EDr*6+YuE7*}r2&qQyzSWA`Xg zQ;Rv_?cY{ukG6iyb+m%z@m3<8#zZkv+R?rU?AUuH5P+y7LTYzV8hy<~qQd6LdJ9fh=mtZ0gihm912rcCR%EIyT6b2P44h>}U3wZl4d;X{{@6z9M>B2SJT#GTTz zT`h~^5obuQ)s7el0*>om`l)Ff60L;5lKWG4h^%88smmGWr1)a(-GD3t8A=VAl6LBZB1`EgF^oQsm|YR?0>nB<9ibC;TpFbr-UgC$2CCO z@-BWdv0VbH%UJon2u|^p z`YnAWMKF`9cjo22BV{#F?!e5iyXWgtua>GIv&KFM)lB@#*}xU}rGhoL3Fr-nQ^d_H zRUe5D%GiW|2Fx5oEYqWLbyyisZESk>Yr}nT4#;$qleFl-?~dhL{00}kdF*KSw9oZ$ z`dqKIW0@XJlyRG~+F$erzhe{M{aod8&AUCrT?pbaIkDg#AD|;{nkIDlb~lxlc-`e*dv_j9Tt`KdebxsO zXi|;jnU})~eA|#;nN&J~{r#s4>F4TEPH+Qd0J<+%vEHE=Ln4NJ{(^(umK+!;!=2QN z@1ls)fAH``H0{ybA*=d!`^*9u`oT^mvAw%D-#t?M)OT8V-fSx17$ydJL1n~D9QWTlHF7`w$ z+@*0R&yOg;d(AUnSK(r}FJM<3!7sw#gP*)H!~zeW!mCSi8{>IJ-#OX9)41I|tQf3% zzg%A2)Kqw@K_J>mcllPn3hNe&dU$l9X1bYp%syTFTdDd;=@^80oAqnW;mE$Wr-$;n z&*>@VCN6j9p${d`5Tj{BF_1W3G&JZ3m&N0f+zt;xJzTM9^wN&^3#JsuwF1fc{J9H_>FVwtG;EHyKO(SW3t#96=9!Fv_HKQ% zh4C}hEr$Ioc4-mhL&ijdX1LaH7m+Pj2%F2rK*grEO0LXJa5wtu6$JHu$qSOt854e3 zw#1$}Nv#mix)FZFiotI3!~^xw`X5a!_2H>GpLzD6%(3L3y0#sgEJnu{3|Cg(&3S4Z zCTyl?f03375Yy{8XEAYV`)-kGg6_Ps&fS>#y-)O;o5tu@Up<`^czN;Zvys6Fw;gT* zzmeBnH8wrd;I00%wdtQ%TLkBY>s_Xr-loeaMrB>Lc)eL5v0jMDSXdkF(RK~W2q7dG zXK`g&Hpl%xy%}UA9puYPnBs%hD{YR=Uoy-)a9laC@)Oi5=ayiPeao*OvfogZv*+<& zRus1CB;(LusznmyUFAIWi>7* zPB!|owD>WH)AiK{-Pg`)6rf}BStkB@o=3(TN5}5oVySzou)pD{Yp3`nu+u!N!~J5? z<<%QbpwVte@g2=`en6Rm3}%WH(n8*hZWuvQLd}IMxj!K525=q)!KH*g_xIb3-W>57 z8W8_xVW?4XA{i+tHY9Yx;lJg=34LTz(ctWfx!z~`a!?&fn@+Jnunr*iJ7?E92SMos zxjwt&Uf~Q>w#4AVsVmr(pDO+5NHYzQJ|i+p!7{F4;p^Zc!)_ZNz!4(c8!PZ&H=yS{Jqe$9Tp;ObDt zeab_o-|P6ite<}3KOSg$%F#(;&$ZpD`z*RIa!t!G?Bx3ziTP%5KnEzr8k?rIx3*EY zTRaO9_~D9~(Cm1nnZEUjAz~HrGzp{q#UBx}_lrsS@>y(( zL~!M22|8(gQo~j&YW7qCyDUD1`>Q_VMW8Yk|lN7r- zr$Qu@Bjuty3Vt@?_s*e2hHN$YrRgdJWAx7Rr%HKic&vwC8B~ngmk2LqA67R&BS;*e zjmU@2jdJ!Gu!m6rEP+MtwDh>`tpJT;cBHe#lAp%l3m101Kl%k4GW;giPkv|h;EDF? z?_I;l9g0$o0Zb1Qz4~7zp&t!?`P~(tKAy6rLoQ1e=RZ=M;W-LW7JjhB5SMprs(e#^8v#0RP+(v$qTtQ*Y}O|XfdKo z(LRIX%V(As0+%bM=*P{@i7LL=+1vWm&?)@azR|UZTJ8GFb1yDbSd4^mud>tvw!Qg9 zdf2{eOWJ{5r^|m;4-I6Q-U_R^8a01-P%DD(MBiv@&}OZLrOxG~^eI3`N3jf>Ly4M8%+ucejNI*gOH)bs&grud@ZIAHXO?hjDfIE&>?#s|_6p)cbw~8UMrKCGgWT~<1M+}IukzDXXMFeFCw@*A^MyWuS-RF@Dvto1#BiQt`6glPG_u;kAZ|n*UKFzFbSEdawq0Yp--fb7- z{X^ynI${%V(82}kUZcO76%PA_k6z=GfJz&x*;S{J*Jt$h3@AP8w!$}EtjN#ih)s<= zAhYCVO4YC79~#h>k@%f~zTyU-ySgQk-1G94O83(X7l?+r zC-4JHoacCj)=+4;dbOm-=}e8}B_Zku%2WS>6UbWZ*-RRojK;ePJ4jd0EnHqFP2vJn zT`OMwn`!-xfd3_4*cF}|j;Apu6okF2BdB{0`ZdIQUU)F7vX=L@#yC5V7ZlR>%SKJY zs)y>W?^jd~ohsMqh@MT`_E98iF2y6in?Q1MC%Q(%EBy05zgzQBfni0xe03cU4}iaA zCO-583gdAAZUK80diB=ZI83Oc?KIxnV;c?7Tg7 zp1`guu&TX^h>QDQ#>MBK1!Y%%h3BN$5I+?-8?0pPyOx=`>fCJ+_*<9e47Y$ib6VW% zv0Ew@KDfWN#h@7*u;g5~^X3clxx?YJA9Es4x9F*P43^kgLFs%GVd-wqDfl%CD}@0x~4t35OnJ`j_I(=Bs2PjPEW8A z@sPg7z80hfm$Dd?oQi=2+AO!NbonO|)8k=B4f<`XYO-QWdyDU5w${ZVxKkm@2| z^7)IK$I6Ca^pwGEQcRybzw>D?+Ev;~TY3ES1zj>v!v5b3{b0jJqW=GvPiV#pse#AL zq#zvdyYt`q*7IsT&E2+E_pi1vuFPLAKjmt${ZLizWvrTy{Ys6|Z60s`+L@8As6~%k z<)^?nchJ4HIYL^juOMPi1nEF8rCeig%wlqSre-X7%mZIaTihQ$e$4x+ z64LcsCup4pqi)}f+Uv7hntxp;s2Yx9o#hv!OB08G&296OEEGd=;Diy9zJKH!N68B{ z@AS_FXf(4w(heEJ5Pk+BhkN1ZgIa9@mx%0r`u9!P^G~t6?`8%UviuzPN>6q)3M}f# z3%uFA)s)}O;=&!_U%$2+NE^BsT@oJK5t}B76&r2awLN#sYVCy+O>za-`&6cJyk71 z)J|j^ZCVZzJeomNftyhhRjix>@-Cb3j?qr?jd7_a> z3WbcGoByYq*ZZSP;N6)L9Hdd$ox-^Db4c<;^P~uI?_mIcLP$@^ps;OkDlrn5gx2lvjbEQP9zF77o;c46;uofmeothhzYgkNC$OmI zS1W#gw9?q6Mw<6l@q-K0q-+}ZHF$3$fo~=kdF+_({k{H$p8G<;EC1vc#S!5!X z_u6}4nVTC|XQfjet)HG!n$`c1uywB2IHKitRCt?Bsc+la^CC^UGkc_mT=SwF`Jpe0 zyT-)|!ZoFd-u*wi-aH!W{`~{4lqGvAJ4w+dLPiEt2vM}$t+w2@@(TR(3gnwE73{rn38CJq`A7HU- zY#^5FGIc=21Im|FzN^&^0fx~K`k(3nCCUZtX{m#a70fP~Hvf+F1WJ}TG zImlr?mWZCuM0whu0t5&KPw~bH7PtK;CO-uyAC{x?qLWv|$NH(cq*}p9gr$e7r#rK= zLVA=#rLn2hoy78knbOd;LdQ{S)mSvg3z{hX%|UUr-AH1C5r2I-tAS64Uw5qc&KO>Z z#+b%#ti9mpqRxAIo9?!s@(|D%H0VS>70sfmd;{i}8KJT+Tae(D z#bJ?90A>jLJkliWzH0%$T(Io}v5xVQ9sGjlUwoxU-&IP!ipcfsN!WmeR5NRKZA0(9 zVvHy6k}B0Kd1l+)#QHvzUdp-tUgbq-KQR%{ z)VdSU$U-8UEtKqyXjzL4ukl8|he-NED5W+*Z`D=L2m`J~MZAJ2R!phL*w^K~fLFFk zj8)bLqTnHsaWUnx4qI!bVfcmGTzsYv8(2^BQIgnPSij<8)a7nZlGXh(lJy09m?hExw~fT|5%Nv9G=N5xUg&Eb0 z#Xzs7jww@Jm@vp?GlePmePLOeWh8=GhjsPOg9C+YV>X**L-G8ET>+1j=SJn?;}$r8 zJZ9G%LJ8X*3ZqE-H|tT3?Sg9u^4_K|+i59$)l!%cN`C~ZA?bfn`vRH{$MZ|U-bNoZ z>u4TkRVH6@35ZO~9wT@8^elzHzTB-OQ=2nwu%9m#O^1utWbLa84Xcl$n;MAYZl4Uh zcMkUpefsbZe>zQ}G4TvpO8Ij?+%Ga=Z4^YUzS)}4}TXzFnSENGPECI;FSgR zC0VAghtjftRolg&pUK#Q>3{Tuy|lw;E+_<6m3}_Me~uUNQ;_l<;F0D!Yr}%na#x$1 zXo_^S|5z`z8`uQMgpc4WLq^XamqQ;6cwfHv$qo<|Y!b!`tS1Jr9$lk0^Vl0O#o&N9 zNG%ZqLR5$LHGW07ITL27sB4qvVhrO5Ie_P$h!+G|jnZ9Uyozv*nwSZU^sjAU%%HdY zVf-5Q*a-8nBg;#=Ha4f=R!vpKl@=umpyJn@S%x z+9xC@sS0zM=k{uM$Q{&`ZID>8xw97=L@!D!ZozNn`v+z^l|Fl>6s7(c_@OnS5rYR# zS9%&XG&Ahtn|}Cz$Z1CgH{ncjb^(QmCaVsaD}KDIf%Tc%of$GpTPRXARz2t&CRO3qBK#(?Rg^I#S%A} zyPY&N;$`X2q0=|AXqqb=4fj}+U+WFqqYWOgO8AJAHqE2CC!VdpF(n2p9bZ5>bU9~- z3=%-w6O%aqs#k@l@QJdn_U=#`-6SIgCGgN0#Ks6i~6MBfeMmb=aamK?hOFv{}8RUSL9)?@V zY_?ezZpOsCc%tk5ZeZo;hrjq`5rSZgW@Cv{VI}*h&BjBc+koc8xoqAKAcn8x=u0+@$Xny*!R9D9!V1CCcrc zkMg3R@@!*AwKHcMSwhF}v)))^A9^|eq7X2PtfG~N4ik{s9eK2of)y%7s-mQ z`a{=I-fyM56-xC^w51W#x*Ofnq_bc@&Mh@PRUOO+KB@m>rTh;c5oOt}TPCC9+0QtJ z@>TC`Ci!16mIx!4O#Ne50wqY>v#?UAPGuLTqMG_W9?Sxyy35J4D(hOVSDsGAUk=e%QLLOrZ*UU-<^UG|Zt zMV%6v()q!7#Tvew6w%!K0q^-JChI(|3Y_%lkBGT9oXMRMk(h)|L}tt@>mcQ|UQ=Ak z8(R4+38ppv551V3r=uJnjQx_Eco!sp&;T34y7E_8U2e#zE)qQ=Y7nY{Vj0&@le!o? zI{nh?o1;n@-f39UYIy@d)55OvZa9hws0)743K@g>?nkA@n6N&?0my*#^T`eWeCAj5 z#H)i+XF^DtK0-9mkCQ`i_QPMaK>x7)I;7X+B0JrHnbJsShWkAY+g>{ypM&))EtEii zS@t-R=dwtc>gCL5S&`xe=dK0G=Ll}%v=4M1KEO_0JpOu4J8})q_G%B#sUN1&&7-Xw z+8s*cFt|HXAd+rR>MW?&FW+BB$U1sZ2WfLTxKSbTcxHPy`T5YR-g~D;9%ZN?_#O9; zs8ljFKS~M<_|7$rfiUaq#2Vqkh<~PS03Dk$o!ebMi*m<5IwF+nJfGrPE!F?XOFS*L?;4TygzZzt>&x>}_1&RC!tI-p5IHiSP5;X O-XB=3$QkW_vnQWq zXrNBA+h4vH{4A4YuK?r^a;uS$TXK)S8)yzG+Xvr`acvKW>}9+cKngz_bty72i!$@> znTKB%y=V|BXHft@U(%KaTS-set<{w`{ORFCjQ>k9Im`DZ`f6{Mif4*S5tR%Sz7atV zH;$+{MzUx5*{+w0e(ar8INX}^A=;=)lvWsJ^jU=XJU9K%cKCNGC z9qgNEksH!s)M#*h~bNySni3Wh9TStu93^HFnO$DqZ{w^Ky%n{xqwMBi}c{t;t+Vn>#N%r)|c zPaNusuOWyX!**}C5DDkRD;JFQ!ym|$biK?vM9ZMemB-9M< zYZHO2rtY1(bTP~VhIY13*atr_sonkN_1mbyOD8^Vt$nidgj73xIOfu5;QOrEtZBLj zy6?XC>w~)`co42Gr8nJw90X~dvajgdyZ^=Ulip^I_XmWLm#b_OZ#on_&#CeEu{v=s z+V2obko0%{-rfpC^W%Kmf@g6nBeU6u_;O|vpENoRSPrIj$qpXMVV8M)}JK~a+u!F|0k$67(V!~1aFUC-Qp0xa!yaLxd`#N zo$I#;@etx;s)S|5-~}Xfy|OSP*CUCzYON;&wki0lc;Woyk~BdQ6f7^#cw*GdaDSXG8>Trtm6 zyGBXZ8x_@OgNYmQ#C|NUGI><1N5vfz7Fk}O-|8eyglTy`7H0=)f6-QXrODsT*k?br zZ5jCnX2{Bv#!pO8(9=Gv*_P*Ee93&O)op^k;UbhcxnkD}9g@OimptlxJp6c+>CGd>_wVn< zD4Vqj3~bF-fcJgqt#j1jBC5{V9&Fych-Q=#iXL>oMVu+_{*ukLZ&-+DiF1#zqidd0 z1S+YZ4|8#>zH-1%V{|&3AH+rI4qMqycg8#K z7lW?i^@e;h7u)3OYJl=N_3l|ne@AgocgWUKtKs*6Zj)aDATubALEs=8wkd0=4O_<% zVVSyd0#rRjEV*8PHF?R}+vX#&KMOOm0xxj0zi8)G3NGmAIs2!y(%HM3J|VBk=?-(1 z-N^9RijK?6Uc73|uqVw=q{xImfj*+Gh4{P@EP+>(unYjHBiY#i=Ca6j`X#W4if9A< zDz2xyfP|GDqrB=p2Jbi0<3d_nEcX7OvNW0}Oc$W02&C};JTZn-ZUiU*v z!#6R5m)UZj+^gDr7#vKvW7;oacI`$=-vi0eH}t6M_LM8MA_c zdBtfi!i3rm)+O`FBZjr}?IlR}IY~au93f zO7>WiA$iwIXS;4*P;C0~pnE?uMfC!UXT0|SdwFjKA=4aevjc5a`j0MfiIcE@7w?|6 z`k{RAnBfH}`GwnC`*p0OR-S^3Z~y$$N0ojX#2kCM{}gVZ)rxV#GS@lA>-Tz!syl;I zHnP{uT>ATSTFod(3{Z_Nhai_!Qx*hWMa{6)ws1FXaz=*k(^ER6iLK^jI#vGe90QLb6r#RD}4X z8v-sMpcqt#ZO#{T06WneX0)V^L~c2`+ttJcpbPP>>*>TToFJuRN5Ep89MN&HY|XrD~(w4wH-`dF8zes(|K+U&uX!jz9% zh0ti33eWR8l2r1``X$M`qotpB$E;%2uVwYm2kftGP}hH|d$`Kncg|4)YA3I7uTs3p z!X9|LVl}?ethS6C7EY_$o`si+eiY1}q?Cd9Vh6f23qt7w1+lG=shS23Mu-mmmZf)zwbPKE`IPx zr{v1P-V-a9a+a;=oQVG~G~VgIzflxtYAd_-?pUFI&zbe~jZl^K?4>X3Px9+jB7-IR z0%HR`2cI*35$5$74B4#3(*wxWEMX&ojh$8E0|Nam^^05<-XPY(4ONhAu1S;oTe(AG zwu@?It%s6p8*=ReDh$K!k9A|CmqJt)?z)8#dpB-p{)>HK0x2d*R{fQ`qb@GMs#-t# zya2~OxF1jjUbitRe!-`wXu&Qyfkl zq7pq_5bEYq@>p?*{mxeZ&|Hj@3v*WKOjQN1LN?V4~ zd=pET^j}$?{Hg}I?e+Q@vshQM7{>uFUT#4ZSmUL~#8rC0XP6*|D$# z_r#l`mTdVrUl1j8rVc+ejY1-=+#J8GiiB?nRh2|OoOnBXB-MHA&5`;8`k9BVRo9xm zKFW-ogqfDv-6TeYD-};4KgsvhS>8d4wkYj8>1SO+`DPWn04kLSIM|90cjDVI@_qXeJ=#yYwvCa85MFU~p%(P@ZNg!U8P z56p-C_7UvMT;nrfAR(xP3%$_;h?W_QDz~b_=-iY+psRp}UjS1Bv1L zPu(rY283k3SK_nHGagn4Fuj&lWb~0PlO(b!cYVcJ_ZS2y+ z@nBF13m)0_;D8|ah-cFa;(XS8y^(D}Ddb9y!&eRd_c%v>h0NqVHhlE=+P6cGcsb_= zTnk|?VI?g8cK&*leUPX4G}q!srG>HyK0{+EJtqWlx-HY(MJW+lCy8DtN(>AKA%2^!I$@D6uWKUvR{B zy6bJC5<7cfM<)&1Kb~w@7n4O?wV}F%JA;aR z?!$~;(C74~^r#LnMRWm&&1|4$LXG`}WwTknT&#uO6N(;jZVH01%9Z-Xbng(n09hrh zU#x_hMv|k*DG~a$6wzd{yUUMCam0Rr)aZ$aJ(#3S-FuV(tBeR#?YlZb`d8I}xJYAU z>Rc+8M){@$MD<-qc%Et%^Ut=P?2E#Tq^eag)kQa5uTYwP5$M2nE2cY;nL&Mj~OLh@aF?fE#jlYNU9`TG0! z=cf(Z=Ki%5_W4*)`Q0DtL_yt?zp18)%+;-i4lz#Zk>7u9;ZXj$n(LgxY0mEFwkhQB z5?9JB*FJPPDyFW$khZr~m`5FD<@i@?$fAr=*5){Ng!R$V3Ka6d!Vbb-C#~&ZqVYC4 zW5!N{EIs)s7#`CX0VZ-PV@{s3#trkGz$6*(E=Dd89v%Lhuc!5thD6 z+y#}MNC5_qe8vhiM={7-MWM>KKBykl|ME||r zkQUV`%x5L;eQn!KjY>OTjf_@nrXf$Xh7jpggIgH~J&Cy|=DSrmGqh0zdF)8Q&HCIp z5rN*WxX7y?h`g!Nq$%2`80HD+*xm83FLTagq1N#u%j#pP=i)VI&bs$8&9?KhNOypCQU=I>(quQT0+aeLH={LUEtH2;)A-H|I> z=X*{q-8?TRr{Oi{7C+?K%PDgb;}Bi2EgY8L(SJ^N2L|1e{6D6DgT)qPwX^CyQ@S^y zwKu!O@_lxG&BR>qN={-p`{nAr0Qr&UpW;iz+#~~nzOMtc#?zQ#41?J&(XMslFk^jV zzt}(+m&;=m)Ua_a4~y#NmebN-4HIOq>HifR{gEqDnFYKIl^`6U`7{B)_C_?s=L%rI z!3Mo+gc#nWm9Gi0cP$hD%Y|%5)JW=T->3yA{8*E?$-D6-E=5k+NIXNL8txF*!4%7v zi{Fo9P=-gFTz}F+nSlI03kQ(S?^r<$@1$J87XgbZRqvNI`IUFU$=(X~e8S9R-LYY` z9<*UBwNBGMP>j z+=ST$3(GBS`uDK-EWzJW0%vc*mfR7xs@K6kQUgcQc9NsFQ*aaYzj4lQ4X-qir*pX4 zDd?=$H83X-Y6_YQcK@l^xxBf)-sSiH5@@e7)Gx1!eT`Y}Q@gb&M-e?0dZIz{*JyvK ze~|$WNcS`x=yP4}uwy@IJO>d~XU{@77nnCB(Ka*`aKsGRpti+l)cMZ2EX;6vIe=WO zz90`0uM)FT@?P%$ZB+r;MGqI83vtXouhkNiCH62P4TL&W)p>&I%GAM1`YED;zPF)$ z?xp`x_rw-Gig9kH)Hm0^R^lo-B2w*Nn=fAo;0@#vmIwY*cL`OV(yJ4ZMKK5j7HZpN zcy|K{W!vz2MS$Z*n_CS{U0!&b4b_hh87W?r9#x91x`hr_mnaC^mW6;aVu0O^3FX1Z zgMkNp45_nVLb7z&`i>j#v^u3ncxD=s zIK++6px00PalLaWK46i81C4VBX{flc>xTGxn^3x?enByNrg0SURT*4Xha>iQ%Yi`? zTPv=xLtBs{`#<@M-yg>ROBv=2g>!1Rb1qXWw=H?`2@{#~Z9(~yu)I3A_;yq7wJc+l z)Pz=*bk^c`Xq^W0A>zs6k3KB^I~Mp1y8BOTKI%Y#hqt9nR|*wCHg?Qt=BJb;cfmSO zx_HC-zQKzT&tvC@Zq$S-K6WA#*Fr-5^6|jv1+`bMR}0NnmmVI1PtOH;**N7ZPy6xN zxCzS&kNhz)fiENE-ukiQfi){i+SxM1%sv4qgK%*G!D(a4UgiyCwONKvMl)IjDfV8o ziP^)_nM-6#_X=6thR_gkg{hd$P$~b>PsG~tZD11#a?E&Xk%pCIP5^tOZ)bALhptad z7QnZMd8-GS@prtT@Me|Bl=jgO9b54P!Ynmu5G)WVs?k)rv=%`AGNX2{In?W zyKI8%G?vQAmf3!2Z=ddE_#yI%^$qOMG<@VJrR2R;R$?0Kd>kk{gV+nI_BO4&nz&zn zO5B6~V2+&kxX`TBEAx`=&@u((J&e(({Yv)f%@txeV-Ne83 zc_$km<~e(At9w&=Cd?Cxh|7~&@+i6Cs zNDzmc^UtREE2Cpx0eA}Bm|?SYPY*;2g4c<&K60$y!k{HUQXK^lZ*iL74&038LWst~F+h6VUhHS2m7`dPe+ zP~zqwvTpZSc6x7!T8YnzKu^`CR$VDuUBll zydCZF*&1KZlQMG-ek}BV^ECaCM8xEt>9bYv+ec*EkK2bTYu=^gE64n#Ih;&78q=Qi zg5J3<&{Qu<%Q*2`Xku6Pr38iqM)IyjW!u&x$HO?^OE)TRF)nZBoSD*GNObKmYcxD= z+XTOdPOkXy#aa2Kfmz|4OG=Wqso|)JZlh*ll8JJF{IeaY9{4x@m-^jF8bHV~eLF~a zM{%H7c5ul1*fegxLDfU^5eaFAUrDk-X9mTa8slM)^N_Pa8qBAq1}*TkfKy~q<)Lfx zNYCz;Y+gyIFqv^UsDAfs568Qq1Z=H$VCJK_yQ}DNA3tZgr_vmJZ_L;FVPuuNyUF^x zJzl|A*Cz8V+3$PZV8m(ge~z#AnMwg2k74~=nQNaslVikk0MBpYtrpk%%j?&$!*O2M z4oegBU0MwxwXH$s0KQG{#fP%J?BIayvf__c0q&OCvfSgB^asH!)H088@c<+=9gq%J zp~j4w4Ll*WEg)r5j`_u!72l6F&tTw_^T7nTT&BA1{@tI=PU}r5yar!ff0@`0M!XQX z640gm$@yi}7lch6lA<}I&SMsS>72-#8ZN6l#3}azqVVRKVZ~>g%~$As9Y;?eu6V=a z`+W80v&Q+cQk%ch4r|W)a3mD!jG`L{V*kzV|+G9ia8l8CZbNtBX^@{+%MD78|CFe`YI(tRoBDr(OR~OBVSExo^tz~af5ZCG(W-NdCS0aL2-$nvQ4!g)JvSR zJjS^_lZVS$AV!#Z!Y2d|JCWm>b&UR1?^6z z9kiuzt#hvd`Pt9XfEaLYA(!O+?jX+pF^wkx zuQ1(_YIQ7}zC{nCPPF|LV)|_C;^6|{yXq((j``Ru_O+V2#IV8-_wcK?!=^=6zCV0+ zR(iBq8=+(B=BRi^LU(2Z|K@J}<-lO!CN(~X{PKqIgYVqiC}LfXkfi7e3Bv+$Qo^C* zx*uOUB@jl>M)o>tm3-;^@?&>K-?B^S7yn)23jzhhfg!&X4+={*K&Yj9;}!Lkt7u6< zFJ)`n7)hapk!Kap45w5~rq6T^7%2?3@(?aa4&@DYiPqnQHwW!h!xj!a_*vr4b^G1x z!WypthXmo;G17UzaqJ{H8r#3t$(F+NVdA7Y()stds#DtBLIh(F?P?ec!YIr-@7D-_ zrg*CCLLCoSCP3R7Gu!JIAMuqCNAUbhSk|_K7)yCou+h5n5~c>RjXFJ+xcy2MJN`V) zO=1w9`#i^0)TUCNkmGhX#{Yuv7BJ7%eEu^yu>Mi-50@@#X#glH?%yhDIdPUK771iC=dc%wNPUVgnh8U)Vkfe@=@M8u}5?a{VWhwdM$= z#9sYznF8nZUceOFM2s#&LN~RtGGo(vi1BqyophI*OmL&nLaY^P+Mq^>IBK8!I!L%1_o^Jifu?Ed$D#+2HtfpMJl! z@>&8}m9wl0&8?jDhU<*@yqBRqg3;BMvZ7rQm#p=q^6fYh4(@V`qp*HTtumU- z{@(U+VCnS|dosw7;bdvdNa?aC*@(|`!=%5KqTILp@r$8?Ge17_YD&nsp)7TMBsPlN z4*dgZFlaBRq%zcB3*)S)JJ2TGc3|u03?gic6ctCYR@EJ`vf{-@s%yJSO`DfO&4?b4 z`!gx^vY;9;>Tdn8gmKnLkyaaJ-WXP3E-_~HfLDwnD@XP2gTYF{x?`d@31Wr;Uy=L} zeroHJPfZAUe7s=X}4hc`f?FE?-b{J!l&?=?rVW+z^K-c{j=cu2)pJ&Ww4(#mI7a6YHf#r`F){4) zxs~YV-N)2Q_)05eG4PE>3U2-8Ur)C@B2_UeXVx6{v7zq;GX^~iaF>*OW)X1J7rRwA z@h%u+UlM~`mA4LHg~2(YKm4GI6As@I7->>`FmCs>;oHC8M#n~+=208G%F~)@QA?Y9 z6>9KRtw=#fx8fsKhJ$6Nb>%*nnAz*gx9`fleS+7b$4qt70&!33`N3s1XkeU?H0Yg! zEpsvM;W-n~$HalHo}t%6CK4AX!;&1JJ5~E%vQi%XTczj7{X1^J8KFbwy}7L+80JmT zAXo1Lm(35~(NPH@Cd3{~{AB$Azq4r4{blP&5FGBTh~{_;`?I^W!Ja!9as;YTAzY_2 z)a$YN^=tVzLmX5GI}m2NMTIqV&>Epp%4ieZx9+cNu`)UY!9`K~N+e0=N~jL74vD7r z8hnQ3l0_c&%P6w6dGwzHQ6B)8HkhMkog+|{c%k+)yeH+A{kP$Q zP^NMAHQw4+tim%?f4io2{hkC2!HP9C5nnZ+q)bV44kpW+?Pt7HcJc6L#|Yalp%c3$ zzXTbj`}KKRnKX)_Hep@n9zk&PlJrq0>$lt|?#AZ#Cyu`Dace|2mcQ>f(B!$#ZEE(3 zo-9R@ujWv^M#ifrKjf#kLQoJsB6$|;VBu*ri~YFBUJbt6b;!@>!A96IQX^_tfJH#C zv5(b2C0D2cJLcpUqkS6hZj+x5u{a(`M;;nOpD5 zw@cXzrGq&vY0OW0r#(pW(j7Er$9XL&S}Gkv2O}?~lZi z4Ox8A&AW;!Gm@fgeN;xi2ld75iCWtJaYXgslnOKFrQc7%#q!8e1$j297#;!bt9S~hu$J=W;De?ni%Za}_I zW81~{&RH?Dr`1xhePaa4lFMKMr!zj;jO#i$o}`}6Wqa#J=#Yhl;ugB*%VnGOWpFi+FL%@{iz4%;Gq&UuU`Xc3HsgepvG}=Vm6a-4+`D zC1ktm98e02*l=>O+Y<7BENu)VsA34k6BBpAb@to9+YTM;)!&mWvvlWC=y<3`&FIG! zE79RMzTx2J`j|N8xt{vPLb4n_51$!279raOQOhy;) zuE(%ff0F;1+PFyfY|7mgf9(h`?OG8Ry-cvc7M#G04n>5Pd~`Of$-ZL)2=xZ-aO1JI zs)K74^!aph6!qzYFUvcXVXUW%K#Aeu(`TS8wba|LJf-;w&uOKHp!r*-I)B9t%xM{Y&_0+;~3pL?r{h--CCq0eyfX-sIY;UnqS zfw@HUJCTdHkYl{FT0%*Wim&#bovS{)dS5w2qYKTf^txY5Lz{eEf)hR=|o*cT{$$r0Nu+G;)y+CC4cEcns*WJJ8ndc#z(!ciynnUdE zN^fi`tRE4eX+;CG1q6ScLn9qMtgC6Zz#GK!RY7!5X5yz^0o9z2hAs2adn_cx`^|uh zSl9Z|SWLr?IUQ;VZ%D*j_8#rFMAm`OVe8uz_UbKEdU-t}o$3jt$w|41X-0Qe#3Z-Y zQ+Ehd*X4+yr*>o>ZNXaOT_k)+?_Grg98-|K(cs}Ro2WwXJ^|zzz&4w;j zcl0A4G`tdky%F?%QO9L-oyUiN-)@)qiVq@lq*j@5Lacc2JkD2Pq!@KNj(or(r<*F* z@OPKzU!d+5HCrjm?1+4nvRc0o$#G0#Xe+BVX-K&Juut!-Y>0+lpU} zVB7x$=UJ;5LaNipPX3&y`O5IDa>;r3z$t->ePpJ zBs~49&X3>|(F#Cx7fUwDG!AfrGTfj41C&HC=(1y_YimVKFJP>jNyz;8Qq2r%4V(*o zgSX&L4Cp(D#@TK_@2ET2?I~r*JkQ?XTNGnhDdHNkxkiB&g4460zybF~8Q`eLGP(%T zSE*h|5%sNOG_R51J`0Zjvl+k~@))JJUYUGWaxzxjpi4N5DxZI=Q=oF0aOX?qM_?8v zbkz&7^=?4{dTo2U3S+UXG3z*%8Y?|}sqv%ls$JIEF71#i#F<8in)ll$i+drPd#P7% zRZf(BQ`2wq$l>W$SkSiB4Mk_C+G9V}>uUv@Y*$wIyS^Rljm2`=e#Sqh4&9fHO(rkj z-tVe16_nYfo05Z9D83aG+D(S1<++3nMjs+JhNOw%6!TRyp}L@rcQ4NOU)lP-U%+l6 zsec9ie-7^WZ$)0~$IiVijphLEa_qxTdH~~b>1}^AROg8BdkT&_a#JyOfqL&i?nE#3 zx+-uCb7vV}JaDbFM<8KIS~R1l+mGihuw}j^^!yZ$e6ZK3Z*T~~bQT$Xwyb*JYzE+q z%{^{^toN68O5lZ{f@_0RzSZUZ3jg#!dgxcYL+ql^{3Ey8wvW2*##W&^3L~J8p)hm- zDfHMbAXfk(8nJvvjga~zzI)!PiPFQ{RfQas9Fyo0(?w8~%%2|QI+uuOl z*##aDNavWY($3q*WjQ~%NJ!;a9D#wC`^DvB7WYSggtVJi;T)#PDmPRwxX zJxlU+c=s^4)-Lv>OWB*FpYv~oB8)C-TRmG*nH$A@+vEL1c5d&O^J<-Fmmud;W%S=s zvy}*qIY^JR&yQ6ei~Bd;xV*qv^(6O8+^zJk$4fLw*rgK@#=>G*%@)#kPCR9&Ddw#; z`?!4QG1c~;erREm9WOQ)d;U${)m;JBDeI74_0;BfJSu4jR>pEr( z0P_Lp$vxMJ$z1cIM%iEkliIS9H(mx-$+YW!*PEP(-Y4Ft#>fr+W5evF?OTnLl^*3+ zWlrk{+9(xh^U!L=+cB zT$ZC6HhAAn&fa4?chKv;mWA*N>p-}eF2VerxT|$ZJ;yQQ0lT9YOxRbsj~FJY@a?^I zL*D7sS%2>XIwKUh4TU*xb`ym=)Xh^KwFjYlSgQ4AZ0m`Jp;yiP=ujmG^}2L-m(iJ3 zNJNF)-npFACEcm=Lp1Uui&P`h{cJr>5%dFBfbA2V5GF@fB*59N=Z8P3fZKPwkohUBQnu8M1a(^))-?SYs(n4&45nqiFdL zOzQlj=!#|jzR&Q-6Oa_-k&%>i;nXv2&6ykOsgiWje>I3~y2P{G15|BQ ze*b!*rq)?7qDi9R>WB+Wd82Je4draD``1r=N2=-?Fdh{_7cKq40}otNN4Dl+C`n>1MuI{hILEKdh?&*=2oWH;wT6gWoyt1*O)Qy-(=|MFSpesV5d>b3YN^z6`LXBM7>?4-*M zEya}+2dKvWb%h~IaaEA*sV~qX#mFt720$?(TvTcA(s5-w`$vfW@@5DsJf^BwarD04IG2@h+cAKKNt zDxcCqS!Xrezi^7!YSI2Qc`)Ode=kRnbn#Q2rns>$J}#4WWMnLWK##B9bvc8SFyBO4 z_Dc@1zqbD^mOFK6A@*en@&^Y~vJ7^4#;DahEA8t+de1&nivDK#Tl=-!f=t^35(1>) z_KL#)OE=_s7b3e3F~GpKg;x#OMi=^|{iH6=0*x8GdS{}T(6@!pyt>s|#RjO{08V~L zjiJkY*ebiozH01m346B&AaY6C-HT0y_^)}lbx<%gdDAQE(cB)ZpXQLo$=pdjeEqNH z8_v&6z>TG4zBGSC(>%ls8oNu_Uzg8`NBB&>rQZjOJeey$|5ts-ZWo+*B`6OCe%KA$ z+_Ay%ksy(a=fN^M=P3zt{x-K5@KoWSTAeC5Kx_=#1n)+ z51XN7owon$7h>LF;+?q8-F^nI-3{*Xx+1l=1-`mBwvsPO2-y1<@74aWu|lO%ouYP` zgl`F%96rN^JdYH7Chdp1%Kq5n60v8uLl>zLyg=X0BM+Jr9NRL{jLCt-iZ`k9vvSVu zh4c2fo(awgUm{b=`o6k!9SP%zK$>EZ`#|*S; z)+b9Se)Zgv)Y0Rna)zbi`#;yzC<@5U4Ypo!!w_SfTQ*zt{Jtr2d0=G6CuvuDxpmh3 zpYqSV9qslpo4)iaSG9mY;En6f75|@H{AV(AM~)aA72!1WZ*}wV1$4!P%7$^ix;pfq zuioP2YIwpMP&K{zNv(*fInEQ3O)i_<{5JDeZnO3oXRF1}85q{*_CG6@aLnp~Hb#Kk zk0&^6eFAtc&|4KPJurIDfYaKu41lyQorCIF>F@Iv{&H?y@!0vt=0ld7$kPUI&-z;? z#l$!B5sVGDbdH!XE5Vr$-AjGT|4V|3Q5}vPVph(oJJlQxG-lS6YI&Z;gSU-Cyyo&f zGl*K~j+%`qBwVPzs`)EJ*(f~*o&ERax%Izet)Uyh5=106bh|Eul}L4i7Cg?@4V)}+ z9fj-ok#k9@YFOm!bsCj5YDa zU#(*lCSEb)9jfD>&lo~l)>+_gd0Zw=t6sQkCU}2*~e~h4iiohRg%=e8$+r?qQZPPW@ zPuE%LEffdW+e>s>$**F$`W*enYN{N~-MUWX3Tt3?lGzkF$-d0H>vH}v>$c7FQLX93 z0-}sMVeP5&8h~UsYm2uifVbw_4>^h`shUz-GTz{irGDNX=8VS}2$Rp~n}j@OAO5%J zqRYx&Kl^ryQY330{?OeNS|e`Zk7Eb`zN(-a7B51Rb`VwsX2$D1-HYJ;{?KtK>PT#` zF1!|18q!iv34QDjuQ}%~&A!tG+AiN9;wR$EmLqnkzeJijf@?9udysfAEW%T}-6yf7M13tO1 zHjhV+CYv*i$~`#;j938~++&;%TTjWCYU9C3{s)_2i|1gxED!JPt5!W3blOT3TcgK% zk6Dlr7^$1;N(~}@5YdjDlXv@48uM3JTEXAf1jA3wiIG4_!u!5;Hdy8BU5j3euKj!L zM18kp_sM>)wK8s9J=xIDo9BAex>ZxFzm1NGZzA7uhT33lZijZb(3rBz!{0|2_OfuD z=md1;eXl(vM^w1V^qu3B&~0=LOAu8$nACg78Dd zU-;`ER8`LS>uF-Zji~r8Ag8}lcqEKbnT;PS6EY<%HgghCsr6CuF=uDuKF813#c>TM`& zp|B#lfn>C>6Dac+Pb^6IT0ex>nhQn1p%H>q-|qgKv3U{v`-BuEG@su>)i+!#qxaVt za|d`f*N+Gq!@`)izKTA^?$#v$b2FA>f{6Z>vm(_7OaoE=L6P`72j1(@+Z@HY4N=m| zIjH9%O#Z%lOo8Eey!xHpa8f~HAAhf(BW9OvcXP)%b}VzRzuSjK?~{9P9KOj~FT~!P zNOXl6MTle#okAQkJ!CNk60%w!o4o+HGBx{B{TMNed*=FA(c4^GIlF<-6UPU~W+S!G zI+6{stwr*%FH1(CRw5GP? z?dZT0`5aLwdzu7H1&@NMk2t`)j3`X-#uGo;BY_pLdI_?CY*QnFFp(^GL-X#!X>!l_ z8O_t6yg*f?u}k1!UPZj$TNAPW+_t>ygkHerzO=5OlKQIiC}whq^*56-ZkuzmIVetkyF;C@RcL(WqCp~y?O{4#6G|5MwWheP>)f54Sw z&6*_JM~W;V$~KrHNn(&CvL=RPU&cOVNvWuib;wd=7qXiolx-~84TczuF~&L=?&qG* zr}{p>>w5lu{J}NGW$ycZzu)J)&g-1>I*Yi^Gi*geJz`c^aOA^Gb3TivlB{r`6jQDG zg-C-5_NlOBOpR#MEW_dcsFE6;rbI8?FtXM@2Ul4R41(z65O%` zFid^n!&fsR?1d=&F6j()?KMMZE4MWkKxLJMQBtDMgah`GLF3dlU~5+XC%okuxOHx^ z9~xr!Jad|DpCc?ZJ-^c@YAXdAa$Kj8e{B^lhk=#H_9o3$9UJo&oK9+QrG%rC4RR|x zT>g)p{ePWRB!YrOt)kBbu{Pi~m<0RYNqM8V!YCiY_#@q!cR#)rKIRv8dc_7*$|N*f z0f``Qe>^8Cx+P{d{^c^8yB&gktGBg^s_!wJQBuDiJZf*pP!lHmV)-T8-2*!gc)Nh& zr(g}WksU#E^AbYGzR9so$2E8DQRBGO%|iK4EdODv23ybQq~%tFvRpVan&b9E4hE5X z<6kDVh1+0y{M7T~>k}>N@2h;LuI$a9&dPelM)GG+s+;9KwmskHp7ZLb+Bm4d${#Ye zP~R8Y8n@@4Q$Hm!C+t=I^Fkc|69o19>SS2h=@E9eZy%@Ml8(I0%MwgKvo+8<6?6Oh z!>8hOjZ$=0r}&Rb0@^j45lb%Ab5=@ziN-G~%6;RrHc(?|9#L%{yW> zqc)GC5@3ge?x$xgc}=XF=&RYNS8T;C`-R- zvwjJ!R@qo|qm0qNY(yI_uo8ZD_6F?Ao)Ea>5jY{JByjJrV4224D-xFOkgFuFvxCJf ze8W2#-o>!{q3IDzM>rcwXd3c@ozQ+m_df0E)2zVuJ}t<)r1;;f8DwvG2JJ1*{Z;@7 zrFvWsao<+^Bz7=WtkTY~{c-k3#!{B+5;P>wSC4d^q~tAUG3u(GZWPj3>`R|>HR%{> zvw+?I(ay|s*=a*iFE-W}*vceqQI@^~J5T^_3t#E(IkrU;Bk-JAbnx0g)7)0?C5WNT z^6Z{d9kn?{a_DS^bdx&Pb!+?`Igfe^!CwT6Pv^L0a~`T3W7^^`<~5sq z?`7G>GuI%5xsZ6#n3+sPOn%ut>!@EEKmR#S&|wYH_A>LU7LAtPDqrbO=L0)`oYxbE zhL{hImV5(lRr5FgA5Z-|WkgHY0)$QglyN>R+Z&5--Mnrkdnncp=Q^@D_89hI&YosgA!g6yOtB>^ux-hi}~4jNQbP2w2LQ- zkH`5g_9#u3KxS7Pm)Wx5%eyyY-!bV`gIdbO1K)`H!7o5dP)e>i(cwqzjpf0fjO8`w z{{`AVb5M%mt_IsWV*=i_Yby!@T-wQEQ$O2|ol2uPB?EcL-MqWZ7fJkhd!OT3{jk!u z&|7X=O^ti|x7==LG)y4)?{9lYKNb{shEi8s(t@j7TChwD?0N@;e_8b}AAl@32=U8`m!4!Xnz>MpVb_wB{c zpSYR0wKu5cyyw24b2pvcV~@l5xU#u;4!H*h)`GMjt_fN5l(RcW-5Xf{N3QOQ_Kx&B z->5_VVcPb4wT&U({Eh+YdysjNF`*N%@$}<)t4JOrriMvSapuIODEgzm7#3X9b{v^O zy}nm_W5o|OgwB>?2(U`l+UTrQ7?*+u6iuH4YhW=E{!hXIVxxT8#4x8 zh^noo>bf0wN+T>^C};t1SQ2c-4#_t^gA-Kz}Bh<9$v;j34f zhvBs)lGyUe3`QnlBf+$RAJ2JZE%#QPqqUd^?_$5Ns8(JmB`~x+Zydn-c~4Q=l-yNJ z8X%ZRjnem8)%ZG%iS`xMFT&Jm2C0ToP|jpd7c=7Jt$vnu+5JwmS7=U(eo0OGlNj5# zp(i0{${8RT8cNI9-(9x<1jId33fn;`KI$y8Nrds=YHG)-kC4tJsI9G>DTRLQ;#S)U z9lrv-dK&GKM$8*m05W!D*D~g&K7T|Ckq$zd_=apL9>Jwy!qe4E+_Fmc_LRvCIGSDQ z>zr1YI~x6TDw_I&iXJ)o?m){TY;$~i zD2@%Q-O4_EJvzXt*&_X$g`T9EY|Nz(qa#qsj*x_f9bRn!qWVkahGT%nliC~WN#i59 zSNIf{^l^r!^q%#vmr57jknh#at5qiA%aciQV*4vY+8@?AQ888IzK0pckZ3|<@>Ic! z?R^1uPeDr7%;2TBaYCH{Pw5~2>|eMC@D=|rlAb~C4Xgn#@W8z-qUzafvTZKjfOihl z>rjQDQu!CJ?-muUdxxI#y;sEFQcW0Kz0_YA#kQi7k@k2$1z2_0jpl_7@2J1uzRG(F zy1JDPET@=I#!U8-LKlwI96)YGJakjvW?Z;wGlCl4N|Zd^vx7g~O1_7tR`a zO7V;Nu^k+LTR_5vqciT`@oJ2g7KbWo?Hc#WId08CD;tl%ot2noO_9R=HU55atH0zc z*0{5LbV>`luHBfD5RvI+uLL|5b$I7zTGBHY&0dx(PhS*_?jG*3JrR@Af@rIjj86!U zMpwvR8^>C9hME!VKf70Oz1}&GJHYW!OG_3=m@C-*r~Vs0a%h=i83t zZ!0@?VD_Rh8o#XywsxTO$JSp_QEY=0pRmXLo@GDVd~a=FJFW?9L2l&KV+ufNLsK7} z$_M-REpxY`FW)(Y0pv7R>fe2JC;r;Wtxevnrt6ZOk8Z0r0gn&579A@x%-432pRSZ4 zfn|)i+7eI$4Zf43aG?GGQ9bz(Hm;}a?f=6qJ`I_8yN+SU5Z{EY-t{?_oGyIAE#15)&5^LK-ZPY)~p0s}Mg8$oxZ`>o!rrmt#dw^Q_bQ@d3`*ox30jAiMjQ-~pln|0^b<@qFll zy>k>OA>!CrcbEm~o2rDKYT?ZAhNVRF>^r*I{8vR)q;8Uh`f8%FZXt7MW&&wE5w7fxlX_F zjZ(053z6Pi14DRJySnql(RI%bl{GSUcQUfUpKJF=y!hmGh`#j|%ya4l zbarrTHt4ZlTjGHE^kQJf3dJ)m)^)n!+Ft$CbqxQSoY)7^v31`U!+Xuih8YZz4VPjC zCv6r+E8x{?VL#t*OrC6G6mWjgGO!imRGS&zCN&^2WD09nTCz8grX+${gM2OD4u?fI zAB}EDA-Zj}!F);L*E^5tO0{6KYYRu+xHST0UJ~$CF^DeqQugd(ull$16T?zNMb+F5 zU6q!-C1?mBFPJTa(LTuXc#*O=Hu)PG2s``{Ne8jxf2R$7n>zKl{a4*Nen5$Jr}rwZ zT~$JsW48d*kQs1cB`yjrmCWw0wy=Ac^fZo|FSMyip4EBgi%KO7aV_mb)JDv=?GTOW zd9T?@7uVJ9o$H@&?b$^?4SI&qBT4zbXk7QZymdd0$~=@$sxvlFcu;t$p@J8(@t)e_ z_?MzT++|=szrB><4|$RkpGia+yk6*Go6Nw>{D+7Yq(<-)=T>M{EZt1TuL9Y{lpZ>e;Msc_Pe8J!Y8} zvYPVVL*{)NC$|tYzT4ks!9!}BvVb%A3p;o`tj|uHZpL;Du(H#p%avj^B_4a zH9Q^`PI1gI*=H)BI1!y#eL{26_>M$QcQ7@>ZkAmO5>;9dh7m==eeti>%@{>gHbQt} zG$uuUmU-T0zO@njHE>E@?#sAMZ|Y#6uI9eU9ld6oQMOqNrs&$26&g*A8F|B%479+g zP>*Qx2>^+x-ttx!H6Dj_tSt z_}*1)g}$@jP2X*;yQ4YSds@qjt!+UgcH=b?Q+!j4O>gdA6si#o#Vj>d2r+4k!54^^nOM{+wrSyv{$BcZB?$bTHHPpD^SegV~|A>_R zPV3hi_z^FS>9QPl6t!f5623sb*YClz|1P(_n@3kxQteLQ?QZy>c}aT*eFkRc{vN}k z=Z(urj>wexhR^+ryIEZ+@`cIf?(lXciyyDXpv|Gq+je13HoAmsJxY>>*=A8~Ml&>? zAG2UT17uCzdjYSZ`Qf=bnk)D(pvWZmmVN%sMB3SA01E8gVS->k&i=EY`!_OG-vn6p z`0N!td;yl{2g=;^ zuuRU2;DetQKXg_a4@S3p$o1aktZU-YXmSvtJIXFJF4UKo>#=)ar>CFM4SFoz+!disBUd>BznQt&+GxbnX{Pva%6aLjSy$CNsI7`rXwSbfjoQ8!9v_ z>bH^216?U}MjTvN7zJoe!XXti__a;WrXJrh3oeApuE7n&;jt2l+q)~M4eyHY2?)75 zt*Q3cGR3_-V-dW2CK%^E4szZTQfafYOx)j-e9AkY@*MZldq?VeKp19{(D0QgZs?*g zq10+R5?~O4!@kj}=K=dC)W?HIBo&+Q)(v2{CP~q_dACblP&nQGw@$%Ln|HU^Iui+E zj|qWUM}OFCM3hAZP2{~iGGXwv$AzQU7`2pei6x>Iix+RkJ>q5hK&LNuGh8t2z(#_R z3#Iy!ErHE+U!vPh_5`%FEl^H4&RFcwwgn_%J3SG)lTa^s&Hj9wO(QzF7h1ik)=hL* z?@lnjl!=L(fA0+cP`T8>V3WqzehAO^J8|Q z-aVr#iw$!g4B|aE27^E9BtHJ5LazR#(xt(-dF?FlfU=|G7ElOg@uFWWVeWCG>oKTx zm4=Y5kUU#x7JndSa%LDTC%CA1dNQtICeyT8qyL{%rr~diQRq<*@$*h!m-DgGU4n@! z9q_}uH-iHwbU977Y$f!(_jGY4{Y9#bUpLg6=j_<-sF0TjOQbO1Esqc5j`jYSu<&_3U3KgTh9N!P! zB40Lo!b*6c2xnLis4U6gS)AMLtW^IVY?d&$DYt>5IO^m*&^K|EYFM-U?#444n&Fiu z5o26O6Vw0LK>PmN6aUxVMr(5epymhos@KEx19QSR+9TzQN^j0?3G4Vsx1h)KMT5Op z>(d&bD)I$+o~saR;YIP%gRTecTXO|{``@z`VlG-AL;UF;WE84D9P-VnY^-u#u|VA5 z-MnIKn98M}Ww_6w`8(qAuS`NCVAr>CCHeOgbiNl_CkIMt_KZi!4IE!}a-bAz=8x`E ze#%9D(EKtPY913^VS6spl)`iK(I{!h2wKrFad7{I0xrb-vtdZrYGBymcG1Tvixq`Q zUMYQ$Jp2|VSkateeQUYn^bHbBd@h4azvDBDRVKb1MgG#K<_U0X|6I>~6c|>fks;ho zH>TH-jXIKJD0bZSi!;g=hdi*Qm3TY{5bNi`odz<}rCs9{Qm+4iq@+GIbKc~4byjIl zpM6@o_yMp+wbiz{rFK^xj`&DoUHkzFeQ-a{J0kx1>vfhD+v?ik-Fxd#-&%-|918l< z+=*RIHLnv)l<-ZBpd08@U#`pfdpINMV4HJpn(e|5Pj_->i6iPWQL03KqU5a;!Byr$ zD?4H0pi$#uvkL*6zOd&ubLF~(v3i$}7dwhje^r`za3mDe&lGw);XxJ3&gO~Nav@wA z!1;!QeGxRM!8Ob|;Usc#e0OpbovpAeM%!3)w9fzr)86%W7Y;o3o zsY@Eg3vy`#4<=>+2TRNvXvhE-x90%+Sn_5PndT|2JoOO?_+d{H+G40KzBi;w;P=~kAWt><&>y6_hBe2m0C*8grB7(~ zdy*&?|9ag}=C-N?N}Kg>qApsFg~wJM?iZ&RD=vc1MNFPQ%T+lD419%os6qBQ+r_ z(R(tHBiMlWe^86fn)|Q0-en_Aoy_w%VtsZ8Qr<*#8hEN%u{=}MI&su&?N0eI=GJbR zGg^IZy$7%DFb*>+FjqH2j$a5p<`^}+4&mM#8%ayH`6|mK9zd=0QV%s{GBc%n2iY85 z6rf_cJqV+EKqh~OEdZAe4b2h!X!%f*v;Ds(7CK-`^{^EL%v~XP@q>2Kk3O~Oq%%ry zcS}U+RM8dfL5d}?bcYcaCxlzBU~qvj-;nU$q+K>zt>0x#H}rqAzLe}*D0e5MD%G-= zOL{Es#x*#&Y&p;ck3Z$*-=ubGYPxvhZ`VIe&D`#8o%Vj(A^55XM_AFxN`DvK z1#DCU)HrtJF~{35n54+wmEN=&%&Z#M2|m)h9|}Kz5O0sJ{d4W))&(XqgEDE%F3RvS zZ^cDAos6kM*O~lAg|YdAe5|)y&rtRt!7V8%`^xf=ebly5nxe|LH^WzF(0o{fM3V}# zgH=VK+N^NB^6<|U1u}4jn~dz6ZSHQqT*M~Gn7V2)uvS?@&6 zP~|84y!{Jx<8bGxd-Tazb>CBpKjv{Mv5GDA-3pohRoo8sgW`6DtG68&3PL}fRl<-F*Jz#lUYrFE`Kn%J%ACVACH>A| ze2y%KGOoqm>HZ*c5KT5a0{;--O-~R+#dw*xv1|GyY8Y{J_d7WtQx{R=sf?64wbin7CSKZ^^5$GAQ{gc7;iP|qPcr}mGiH=a z)vxh`f35wW_6~5Npu@ZXI+zOO*Sd@utot5Pdlxz=i}$+Q8)uZ_ZiulVY*;C~%@^CK zV6A$A(O>o9j%$+xPFYh@H)8dekN+w8#X}Vh`Qr)-O zq|nB@4b?}BihfsLOBd)dFM8*_-j|u~;L?yVTC3FgE3q7TFLsVVs-w_@~gQf>V zi2?Fz^!LC$)muVALd9ttXApjwL|d1nKN2T4!2mrK+Uxsf2rNN3e$R$MJIG(=hq*M{ z6FFu9HiGBX+T*qL!}RuEHmNeA9o_zi#I% zK2J>AO$;7)^Drq@{5&{+$wLu-ef!+tkF+JpQnk%ggYR1nAszlFXF9~To5V#N7(ukq z^$bDfXw%>)8VM24UCl$oj#e*{u6&g{FU1_f9;G6K!F?;4PTafIj9-zX!^v@9NpZ?+ z79WtEHDbb=VxNU)acz)Jp(}PeW}Q+qy0tDRz55~U@mXW7qV9TDw%_}+`D6Gkwxx}H z?!+0~tD%7_3vflcpw|=ksSX ziTnNCUm%*`1~5Zg*oVaXI`MR~0j5m@34ZrX;CWCzHtE|sr-lZ#1uF=<=oEuD_5~j4 zKT&)m?8os6Ee$V-zX2ENVp(5^lQXnHM{fL*jmlhLC6i5&;&+VV@EqyaOQw+Nb7y2GiDkOe;GIHSR0Hmm#ZwJv5N6sSg}hQ6$! zJxAwW=xE1jrc~U`+j*t?0eF2TPxYO##H;?X;@wc=T=VsKmwKtYRq+Xd2zo3@(xyD< z_}iO_T_ke~`rnB~{|XEK#;E@*9|Qy_K+hy7mm?5&0XNWT@M4K#YH(g1<>$q_VucBG z@(~SwQut)~wzbpT3ty*)$ot8Ge-ama$8;u%JNx-Bee?P`)A@#ong*Ndx+#1^J-^#R9*!I%UO!ztJx8y=oD zE*4%l`p)xwqFSQdotNM!o7h;h^P#b0rSs}><)>kN9zuk8Np+SsdUsgC<(3@_KBM#9 zY+mVo9`Y-CXu7Cw*60TZ(VLmW9h~~!yOB+>f=dvyeyl08idm6K!y3;z5I=gF6Ce#m z{6(DTHm~c@zkD1m+y;uN=oS}E?s=q4y})!$`b&N{!<|BCMJ;DzKhDCaXE_|#@O_G} zf5(Mka+xPRutu0~`LEuHoSKsl!dupezB8(FE|+RCJ}9=?8cmZ(QB`gxpZ!&Yi6_A!=L?e3f`y8$0(%ERP^oWug5%e=J4v zM673V!YNY}_ZT$g?=+DFA?C;4TP@9t|Bi(^*)g9+azT#uklc&)yeMh4e6PkY&&4aMTh8# z)pP9GcrRb_r$Qyqvy!tRD9>sEw#j~p>cKd?2khevEB0U9xer3zpAj_Vw0**WUAtFftHEd3_2DO0i^)TEVi&x&ujq^aFEE z{%weYyPG~oP5J9dqJkg)Oh{5cJhr+`O82Pr(w~E;eVaQ=yqMN0g=j ztdvR{o;SWcMKE^W{kvoEJ#Ww4Ric9WFQmSvx+*4w=_>qJ^i_5?}!P*{R?;j#7?msU|jEi3H@|{31dxv zyI%MSZupi-?ZRfFU+@J~$5vgfMt^?TGd*{`KRF3F+sHp={H>MbUu%K!AujP255r~W ztRv?%Z8oiB=8>jo6xUgn8tEdZ!{SVK_5P()v70Yi6e~RaeK#Bz1TwBGvroy~qIN0*H9ciL@+nEtVM!!zjSbH0}BsKsRj$7+9MN zqGd1@z#d{QTQcxtcSoLz)a+D99nn?E$rDT{&n{9wgK4_fD4)47(8*I7d?I}?aNPf| z%{a7rJx(c11y#_c_{0%X(Zps~%?DioF7j`RHo!F_EiRnBpLK@ijG~K&WRUi;biFaw^V)u!oikuuGRwp}9?Un1!R)uvsb7C-q5R__V71c>P^jFb9~MQM`HH+QO9m?AVm^QX1psSBH;`umTM3`{4WZ8zUu5t| z@9baLKnBWmtf>Iy*GY8$+x!@wl83Butn(EOI?V=hDbxO+b#3L{Yp>Wd+Afbh0b+XP z8hD$r7LYhj6Q>`O$?jr8qgP7&#mD|zjOmkG z@WE~Es0bd4&El+_EYpr{D+TQfN%Y2RW}17}K)x2^L;2p%&{LguW`H^?DXD`gT=4t2 z7Bw;w8%qK7;>eYyI+f!cF#zJ<{{W-fR*N10{eM1h1`upA-&OA728KcVfZjL-+Y7o@ zU%Z^j2c!vN{Mv@aTy)%I7=r31+y~=$98dRJr3_N^$7|mKX`9tjX&LXijR&s}3eBF& z`8%eO+5F`%9Y?1?ohLi81J~X2oPBEhufNWWddeKDxNW*WI>6Qs4@locMQNTCs_lBy zd4edd`+anW7o>qX0XS|R`DZRYA?st zh^uF8baVe4GUZs(-t-!%Q9Dqrznd`=D6)UPTMQI6&OtoM*>3H}C=RjJx@8goV2B z+`l|uT2a~$NK0RkE0hel0REiSg@ms~8FAhZ!KaPZAL{;v!Z|lqWm14jWc}0e!A(0e zjE)LeAV--JBRH+~cveo1!KlbFwDmXQQjlCBK1X0&`#`CpWi$9G=`rWza`H*1_5kY- zkBRu=mdImo#|WgjK>)SL8Mg*^(K)s$xgV2Z`ag4E&bm?C_4@VxyJBw#6d`Xz9y+J5 zv_UTut=W87fcb{MjEUfT>%|s>T?ltZ(f86Z)d%n)CxgtMXu(;VO}M|zMz^POfrlcm zWOPt`3%^dN5H9!$z>_YO+~-tISbxAf=DvE$erVpcd3kIi6X$;o5Vcf07CUrn)6HM4 zy;F2Izr)%>*c8&Kd)IvEhj(v}(Lqt1l!G^(mduk>?7Niz@y<}kZ8pN{p6<^Ovjwn|#+w6%&I{{QnM8cUgg@n3s4cPe(! z%y24H!50P~)vg2Pi~kUh4p(1(irM|aa74%<|8IjcgJ&f<&CNS*31%RiG)Lzj-a0zJ z({b!_5-R;?Mr=xF`eut8h86JFcc#jh-Rh^9C#q-v7`3u)B^W-smA70f5TtD7z`Lpv z^_)3-&Ms8_SadblJ)fYA>WC_}yX@v|4;kFd+-x7;wh|K`DP8NAC*bXh@fsgqsk@1_ zmaGBeC2nNEFT~&~6*vU4HXK0a%((+-+g0!|Dop=#06qHu^)9Y(9x0k$5Ol7D@Yrag z$4iAOyv9f=?FIDJM@mo4#VvqY5p+z>U)TG%kiVsn|0}n>pHmmoWIXOmMG}OQVb$zm%W2FU`dEvD+fEqO!nU2x9^1JnWvhHvP#Hq_TF3u#Vw+gYAP}W{U$_ zBCVFmgM~|(#iWAbf-ctRxkAH8t2-o}+4JPoTw5HVW%axXP8v+bUTp=m`Bh3E;-~LY zZ7aKJg~h;CVFeE0b{);Ux{kBav?yq9h4xAmpGXu40ddD?6@75HMl)D~IG6iUN^TZl z6Q?4dwf9hJZ>9}?T#Fsc#Kn81z3{P|66!1cdy5gHPpZb8%^bnRgyT+qP)}s11$xV0 zjz_@Bvv-(t-ykZU#cgGhp8~=i z|5Z{|dw@OtT6bwTnrlr41md{90RtMXfDiasH$)DQ=Ru~@at%mSk=eVl|3Cxo&^_Bx ziNo`G2)qPdZ}tp*ak15L-Md)B^gB&G$(amJVvQ_`-|)U2V&ZY;VLCI5DSw3``%#G} zDP=}(O>v&exke(+>3tgg^gHRsS6lcfq_YLII|0up{kwmoWyZ;i%3Q2XG5RyF}m5#KqiXuwt1hgJeNLo(^<7SVnFg-7mrZQ z837@t1o~TK6+-(%q0^)@(zcg@v{8p0!UpiwNJR$e*wnLd?qCZ49N6A0452|8O@7*Q z>LsyeR)pQ6LKAp_scKp*Z3`Z`tKcsB2CzGVt)(6Z$gX5Sih^v*G1;!1Fq$&o0hXvj zn|>Pyj?U-*NM+8ryGV>CkF3AyI)*Z7a+Wg-3+&&>DKIH2vTXZr!czi{_REc%|!Gv<;PW5VzW~ zI0N{kmxNOQ0T5mTIZfXH{J*!RvoDNG9B2jb%GUH`0F)bQ1$099YuC_!&OGK+38T7s zWL7oLgA&GbaIh2lSNV}1hsZe#i21HYOT_~cV^YOdp{mZJc~qAq>0!4OPexBRL2=5QT-OorUk>hUuf_`Sa%iM4oG946m-Lku{Xid}3w#n}z-@uwo=Bpg z-D$tftU_EO*&Y+7?V|ksf*vE9J Date: Thu, 16 Nov 2023 07:50:10 -0500 Subject: [PATCH 161/237] index --- .openpublishing.publish.config.json | 3 +-- .../best-practices-configuring.md | 2 +- .../configure-with-command-line.md | 20 ------------------- .../windows-firewall/index.md | 13 ++++++++---- .../windows-zone-pivot-groups.yml | 10 ---------- 5 files changed, 11 insertions(+), 37 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/windows-zone-pivot-groups.yml diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index c6f6954b04..075a516838 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -172,8 +172,7 @@ "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", - "RestApi": "Content", - "ZonePivotGroups": "Toc" + "RestApi": "Content" }, "build_entry_point": "docs", "template_folder": "_themes" diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 8e4bd28346..10420d6e38 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -9,7 +9,7 @@ ms.topic: best-practice Windows Firewall provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. -## Open and configure Windows Firewall +## Windows Firewall tools Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index 7b19376cd4..a8d3366082 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -3,8 +3,6 @@ title: Manage Windows Firewall with the command line description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. ms.topic: conceptual ms.date: 11/15/2023 -zone_pivot_groups: windows-cmds -zone_pivot_group_filename: windows-zone-pivot-groups.json --- # Manage Windows Firewall with the command line @@ -15,24 +13,6 @@ This article provides examples how to manage Windows Firewall with PowerShell an Global defaults set the device behavior in a per-profile basis. Windows Firewall supports Domain, Private, and Public profiles. -::: zone pivot="windows-powershell" - -Before you can connect to your devices and apps from Windows, you need: - -- Internet access. - -::: zone-end - -### Enable Windows Firewall - -::: zone pivot="windows-cmd" - -Before you can connect to your devices and apps from Windows, you need: - -- Internet access. - -::: zone-end - Windows Firewall drops traffic that doesn't correspond to allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't enforced, you might need to enable Windows Firewall. Here's how to enable Windows Firewall on a local device: #### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index fff04f6151..026ddbbaee 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -7,9 +7,13 @@ ms.date: 11/14/2023 # Windows Firewall overview -Windows Firewall is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Firewall supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a trusted device can't communicate with your device. You can use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by +Windows Firewall is a security feature that helps to protect your device by filtering network traffic that enters and exits your device. This traffic can be filtered based on several criteria, including source and destination IP address, IP protocol, or source and destination port number. Windows Firewall can be configured to block or allow network traffic based on the services and applications that are installed on your device. This allows you to restrict network traffic to only those applications and services that are explicitly allowed to communicate on the network. -Windows Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. +Windows Firewall is a host-based firewall that is included with the operating system and enabled by default on all Windows editions. + +Windows Firewall supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a *trusted device* can't communicate with your device. You can use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. + +Windows Firewall also works with [Network Location Awareness][NLA] so that it can apply security settings appropriate to the types of networks to which the device is connected. For example, Windows Firewall can apply the *public network* profile when the device is connected a coffee shop wi-fi, and the *private network* profile when the device is connected to the home network. This allows you to apply more restrictive settings to public networks to help keep your device secure. ## Practical applications @@ -30,10 +34,11 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI ## Next steps > [!div class="nextstepaction"] -> Learn how to configure Windows Firewall: +> Learn about the tools to configure Windows Firewall and some recommended practices: > > [Configure Windows Firewall >](best-practices-configuring.md) -[FHUB]: feedback-hub:?tabid=2&newFeedback=true \ No newline at end of file +[FHUB]: feedback-hub:?tabid=2&newFeedback=true +[NLA]: /windows/win32/winsock/network-location-awareness-service-provider-nla--2 \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/windows-zone-pivot-groups.yml b/windows/security/operating-system-security/network-security/windows-firewall/windows-zone-pivot-groups.yml deleted file mode 100644 index 75443e99b0..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/windows-zone-pivot-groups.yml +++ /dev/null @@ -1,10 +0,0 @@ -### YamlMime:ZonePivotGroups -groups: -- id: windows-cmds - title: Command line tools - prompt: "Choose the command line tool:" - pivots: - - id: windows-cmd - title: Command Prompt - - id: windows-powershell - title: PowerShell \ No newline at end of file From 25335407ca87c7708224d40bc3c12c4fafb9f18f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 07:58:02 -0500 Subject: [PATCH 162/237] index --- .../network-security/windows-firewall/index.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 026ddbbaee..6808d7a2dc 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -13,7 +13,15 @@ Windows Firewall is a host-based firewall that is included with the operating sy Windows Firewall supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that can't be authenticated as a *trusted device* can't communicate with your device. You can use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user. -Windows Firewall also works with [Network Location Awareness][NLA] so that it can apply security settings appropriate to the types of networks to which the device is connected. For example, Windows Firewall can apply the *public network* profile when the device is connected a coffee shop wi-fi, and the *private network* profile when the device is connected to the home network. This allows you to apply more restrictive settings to public networks to help keep your device secure. +:::row::: + :::column span="2"::: + Windows Firewall also works with [Network Location Awareness][NLA] so that it can apply security settings appropriate to the types of networks to which the device is connected. For example, Windows Firewall can apply the *public network* profile when the device is connected a coffee shop wi-fi, and the *private network* profile when the device is connected to the home network. This allows you to apply more restrictive settings to public networks to help keep your device secure. + + :::column-end::: + :::column span="2"::: + :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." border="false"::: + :::column-end::: +:::row-end::: ## Practical applications @@ -23,8 +31,6 @@ Windows Firewall offers several benefits to address your organization's network - Protection of sensitive data and intellectual property: Windows Firewall integrates with IPsec to provide a simple way to enforce authenticated, end-to-end network communications. This allows for scalable, tiered access to trusted network resources, helping to enforce data integrity and, if necessary, protect data confidentiality - Extended value of existing investments: Windows Firewall is a host-based firewall included with the operating system, so no additional hardware or software is required. It's also designed to complement existing non-Microsoft network security solutions through a documented API -:::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." border="false"::: - [!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] ## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback From 87ed1cbfb0c7be095db32783b1c80f44a58e32c2 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 16 Nov 2023 11:40:20 -0500 Subject: [PATCH 163/237] Update update-csp.md --- windows/client-management/mdm/update-csp.md | 118 +++++++++++--------- 1 file changed, 67 insertions(+), 51 deletions(-) diff --git a/windows/client-management/mdm/update-csp.md b/windows/client-management/mdm/update-csp.md index 9a3988642d..e825289b3c 100644 --- a/windows/client-management/mdm/update-csp.md +++ b/windows/client-management/mdm/update-csp.md @@ -8,7 +8,7 @@ ms.topic: reference ms.prod: windows-client ms.technology: itpro-manage author: vinaypamnani-msft -ms.date: 02/23/2018 +ms.date: 11/16/2023 --- # Update CSP @@ -40,7 +40,7 @@ The following example shows the Update configuration service provider in tree fo ----FailedUpdates --------Failed Update Guid ------------HResult -------------Status +------------State ------------RevisionNumber ----InstalledUpdates --------Installed Update Guid @@ -63,136 +63,152 @@ The following example shows the Update configuration service provider in tree fo ``` **./Vendor/MSFT/Update** -

    The root node. +The root node. -

    Supported operation is Get. +Supported operation is Get. **ApprovedUpdates** -

    Node for update approvals and EULA acceptance on behalf of the end-user. +Node for update approvals and EULA acceptance on behalf of the end-user. > [!NOTE] > When the RequireUpdateApproval policy is set, the MDM uses the ApprovedUpdates list to pass the approved GUIDs. These GUIDs should be a subset of the InstallableUpdates list. -

    The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to do this is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It is only necessary to approve the EULA once per EULA ID, not one per update. +The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to do this is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It is only necessary to approve the EULA once per EULA ID, not one per update. -

    The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (that is, updates to the virus and spyware definitions on devices) and Security Updates (that is, product-specific updates for security-related vulnerability). The update approval list doesn't support the uninstallation of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs due to changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. +The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (that is, updates to the virus and spyware definitions on devices) and Security Updates (that is, product-specific updates for security-related vulnerability). The update approval list doesn't support the uninstallation of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs due to changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. > [!NOTE] > For the Windows 10 build, the client may need to reboot after additional updates are added. -

    Supported operations are Get and Add. +Supported operations are Get and Add. **ApprovedUpdates/_Approved Update Guid_** -

    Specifies the update GUID. +Specifies the update GUID. -

    To auto-approve a class of updates, you can specify the Update Classifications GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. These GUIDs are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. +To auto-approve a class of updates, you can specify the Update Classifications GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. These GUIDs are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. -

    Supported operations are Get and Add. +Supported operations are Get and Add. -

    Sample syncml: +Sample syncml: ``` ./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d ``` **ApprovedUpdates/*Approved Update Guid*/ApprovedTime** -

    Specifies the time the update gets approved. +Specifies the time the update gets approved. -

    Supported operations are Get and Add. +Supported operations are Get and Add. **FailedUpdates** -

    Specifies the approved updates that failed to install on a device. +Specifies the approved updates that failed to install on a device. -

    Supported operation is Get. +Supported operation is Get. **FailedUpdates/_Failed Update Guid_** -

    Update identifier field of the UpdateIdentity GUID that represents an update that failed to download or install. +Update identifier field of the UpdateIdentity GUID that represents an update that failed to download or install. -

    Supported operation is Get. +Supported operation is Get. **FailedUpdates/*Failed Update Guid*/HResult** -

    The update failure error code. +The update failure error code. -

    Supported operation is Get. +Supported operation is Get. -**FailedUpdates/*Failed Update Guid*/Status** -

    Specifies the failed update status (for example, download, install). +**FailedUpdates/*Failed Update Guid*/State** +Specifies the failed update state. -

    Supported operation is Get. +| Update Status | Integer Value | +| -------------------------- | ------------- | +| UpdateStatusNewUpdate | 1 | +| UpdateStatusReadyToDownload| 2 | +| UpdateStatusDownloading | 4 | +| UpdateStatusDownloadBlocked| 8 | +| UpdateStatusDownloadFailed | 16 | +| UpdateStatusReadyToInstall | 32 | +| UpdateStatusInstalling | 64 | +| UpdateStatusInstallBlocked | 128 | +| UpdateStatusInstallFailed | 256 | +| UpdateStatusRebootRequired | 512 | +| UpdateStatusUpdateCompleted| 1024 | +| UpdateStatusCommitFailed | 2048 | +| UpdateStatusPostReboot | 4096 | + +Supported operation is Get. **FailedUpdates/*Failed Update Guid*/RevisionNumber** -

    Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

    Supported operation is Get. +Supported operation is Get. **InstalledUpdates** -

    The updates that are installed on the device. +The updates that are installed on the device. -

    Supported operation is Get. +Supported operation is Get. **InstalledUpdates/_Installed Update Guid_** -

    UpdateIDs that represent the updates installed on a device. +UpdateIDs that represent the updates installed on a device. -

    Supported operation is Get. +Supported operation is Get. **InstalledUpdates/*Installed Update Guid*/RevisionNumber** -

    Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

    Supported operation is Get. +Supported operation is Get. **InstallableUpdates** -

    The updates that are applicable and not yet installed on the device. These updates include updates that aren't yet approved. +The updates that are applicable and not yet installed on the device. These updates include updates that aren't yet approved. -

    Supported operation is Get. +Supported operation is Get. **InstallableUpdates/_Installable Update Guid_** -

    Update identifiers that represent the updates applicable and not installed on a device. +Update identifiers that represent the updates applicable and not installed on a device. -

    Supported operation is Get. +Supported operation is Get. **InstallableUpdates/*Installable Update Guid*/Type** -

    The UpdateClassification value of the update. Valid values are: +The UpdateClassification value of the update. Valid values are: - 0 - None - 1 - Security - 2 - Critical -

    Supported operation is Get. +Supported operation is Get. **InstallableUpdates/*Installable Update Guid*/RevisionNumber** -

    The revision number for the update that must be passed in server to server sync to get the metadata for the update. +The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

    Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates** -

    The updates that require a reboot to complete the update session. +The updates that require a reboot to complete the update session. -

    Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates/_Pending Reboot Update Guid_** -

    Update identifiers for the pending reboot state. +Update identifiers for the pending reboot state. -

    Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates/*Pending Reboot Update Guid*/InstalledTime** -

    The time the update is installed. +The time the update is installed. -

    Supported operation is Get. +Supported operation is Get. **PendingRebootUpdates/*Pending Reboot Update Guid*/RevisionNumber** -

    Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. +Added in Windows 10, version 1703. The revision number for the update that must be passed in server to server sync to get the metadata for the update. -

    Supported operation is Get. +Supported operation is Get. **LastSuccessfulScanTime** -

    The last successful scan time. +The last successful scan time. -

    Supported operation is Get. +Supported operation is Get. **DeferUpgrade** -

    Upgrades deferred until the next period. +Upgrades deferred until the next period. -

    Supported operation is Get. +Supported operation is Get. **Rollback** Added in Windows 10, version 1803. Node for the rollback operations. From 70fbbcd4b6d1595e427b199a3194d44521b79d99 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 12:09:22 -0500 Subject: [PATCH 164/237] updates --- ...blishing.redirection.windows-security.json | 7 +- ...s-firewall-log.md => configure-logging.md} | 0 ...-practices-configuring.md => configure.md} | 62 ++++++++++-------- .../windows-firewall/images/fw03-defaults.png | Bin 28751 -> 0 bytes .../windows-firewall/index.md | 2 +- .../network-security/windows-firewall/toc.yml | 8 +-- 6 files changed, 44 insertions(+), 35 deletions(-) rename windows/security/operating-system-security/network-security/windows-firewall/{configure-the-windows-firewall-log.md => configure-logging.md} (100%) rename windows/security/operating-system-security/network-security/windows-firewall/{best-practices-configuring.md => configure.md} (85%) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/fw03-defaults.png diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 2d0a38c37e..8b6383e09d 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -6842,7 +6842,7 @@ }, { "source_path": "windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-logging", "redirect_document_id": false }, { @@ -8009,6 +8009,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831807(v=ws.11)", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md", + "redirect_url": "/windows/security/operating-system-security/network-security/configure", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md similarity index 100% rename from windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md rename to windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md similarity index 85% rename from windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md rename to windows/security/operating-system-security/network-security/windows-firewall/configure.md index 10420d6e38..7fffb1630e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -1,17 +1,18 @@ --- -title: Recommendations for configuring Windows Firewall -description: Learn about best practices for configuring Windows Firewall. +title: Configure Windows Firewall +description: Learn about the available tools to configure Windows Firewall. ms.date: 11/15/2023 ms.topic: best-practice --- -# Recommendations for configuring Windows Firewall +# Configure Windows Firewall -Windows Firewall provides host-based, two-way network traffic filtering and blocks unauthorized network traffic flowing into or out of the local device. Configuring your Windows Firewall based on the following best practices can help you optimize protection for devices in your network. +Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services: -## Windows Firewall tools - -Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services. +- [Windows Security](#windows-security) +- [Control Panel](#control-panel) +- Microsoft Management Console (MMC) +- Command line tools :::row::: :::column span="4"::: @@ -27,7 +28,6 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::column span="1"::: :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: - :::column-end::: :::row-end::: :::row::: @@ -50,22 +50,29 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="3"::: - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized management solutions to secure complex network traffic found in a typical organization environments. + The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized group policy (GPO) management solutions to secure complex network traffic found in typical organization environments. :::column-end::: :::column span="1"::: :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/mmc-advanced-security.png" border="false"::: :::column-end::: :::row-end::: +:::row::: + :::column span="4"::: + ### Command line tools + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + The `NetSecurity` PowerShell module and `Network Command Shell (netsh.exe)` are command line utilities that can be used to query the status and configure Windows Firewall. + :::column-end::: +:::row-end::: -## Access the Windows Firewall with Advanced Security console +> [!NOTE] +> To change the configuration of Windows Firewall, you must have administative rights on the device. -If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. +## Network profiles -If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. - -## Keep default settings - -The *Overview* panel of the *Windows Firewall with Advanced Security* console displays security settings for each type of network to which the device can connect. +Windows Firewall offers three network profiles: domain, private and public. ### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network @@ -81,23 +88,20 @@ The *public network* profile is designed with higher security in mind for public To view detailed settings for each profile, right-click the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then select **Properties**. +## Firewall rules + +It's recommended to maintain the default Windows Firewall settings whenever possible. The settings are designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. + +In many cases, a first step for administrators is to customize the firewall profiles using *rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. + > [!TIP] -> Maintain the default settings in Windows Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. +> Create your rules in all three profiles, but only enable the firewall rule group on the profiles that suit your scenarios. For example, if you are installing a sharing application that is only used on a private network, then it would be best to create firewall rules in all three profiles, but only enable the firewall rule group containing your rules on the private profile. -:::image type="content" source="images/fw03-defaults.png" alt-text="Screenshot of the default inbound/outbound Firewall settings."::: +### Restrictions per Profile -> [!IMPORTANT] -> To maintain maximum security, don't change the default Block setting for inbound connections. +You may also wish to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it is best to modify the remote address restriction to specify **Local Subnet** only. The same application or service would not have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction should not apply to applications or services that require global Internet connectivity. -For more on configuring basic firewall settings, see [Turn on Windows Firewall and Configure Default Behavior](turn-on-windows-firewall-and-configure-default-behavior.md) and [Checklist: Configuring Basic Firewall Settings](checklist-configuring-basic-firewall-settings.md). - -## Rule precedence for inbound rules - -In many cases, a next step for administrators is to customize the firewall profiles using *rules* (sometimes called *filters*), so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. - -The rule-adding task can be accomplished by right-clicking either **Inbound Rules** or **Outbound Rules**, and selecting **New Rule**. The interface for adding a new rule looks like this: - -![Rule creation wizard.](images/fw02-createrule.png) +### Rule precedence for inbound rules In many cases, allowing specific types of inbound traffic is required for applications to function in the network. Administrators should keep the following rule precedence behaviors in mind when allowing these inbound exceptions: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/fw03-defaults.png b/windows/security/operating-system-security/network-security/windows-firewall/images/fw03-defaults.png deleted file mode 100644 index cfc1daea372601c412d15d30c5406f659f8b0d3a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 28751 zcmb??V{m0r({7xTWMbRa#I|kQnb@``wmrebwl%Rmv2Ani$@^B_`}clT-;Z6V_CCG# z>b=z6&(r-=QCrhrYCqycqblwD>Hdj|yGkhniAG<6%F&bE&a=oXXHeW8eEDon)xO|?! z_rW6zLLdb?2oga7Dr#%LWrzp^I zZH(HDBSvjgNzmHHPHYV?QqOMn5=p)qkq@}pSsM>)23;&91TKr2zOF4^ZHypb*8a!c`o9yW1 z_)V7Jo9D7h=!q9moZ=HEOboQoNPHHBzp-n&CK)goYryg{It}}Re*L=>c-nB^YWy)T zTF|TRP@A7G=%u(?)Mw~$U{q|)%q^QE++^p>(Y83dIN8(R!sVqeNXPZJ^d_ z6C0zOqORgLG-(Zy|0E?YFAs(6U)PCoP!oBm(=sTZ+hr=%-t!lRqiw@Nfqim`uR$7u z45Bx|DOJJ-a=QZ-MoRiNqF~hrGbC^$uX{ct@fWdumS(ia;`QUTUR-~yuOW)}LDRBj zviTi%RkfwX`2}@ahYChrgz|2l)0Q5Jx3rHom76)Ij)FRaImR`aj(PQK+s9ktsRc9B4xeiD* zgi$leIiuW-J1XR5oYk)?$iiN^AZ)^A<^&w zyPz9V5jytf1GeG}UKNs1NCt?r2v>9FntZ(P2-V0LmX7Z*KadN^L#dA250k~V8V_BI zTq;_>g$8m7+sUndw z$5qTPBorvUhizE37aQGZ{i!O!ICOQ(tt>vDdY_3!0Hs^&vw%%=J^Nv39L2{Yx8WR; z=lEKI;HP8}MFbY|`*juK1s|JNbs^!fp{zoXSlEOWqhoB!=}D>UPVz$ypG&tNVDM?&*+T#C;CIFMX8hz zo!QZpexmg_@eEU<46=Js8;V1#*Pz{=G`08Gjswa=h#M>mH`S&3L<&lBm1K?KN%xA} zdp=qnIl^S4y4&~8oM51u0y+n=c{a;ebl=SrAM9dLjN@5r3RT+9i(Kof&|7Gi3eO7$i9c5^r-C+a64EaWq@=Mqcp0np$TW)iLA!Og| zZwC(8jciO(Auay#Doyt|w%XaPAD4%CBGBhm3~L~6wEAYCJEd8-YTDek12%7JrNIv9 z1!)!YmE4WO9Z8Nf8lZDSPnc>Y41~`7VSY_6Zv%8Pov?pE^ zeA-cdW_J(7VsbOBEW{JThI@3zG5}>3#)9Zct$$0r5ATtRzl&ze-M$S)U0Bs7Uz~i< zsw;w<%#m_~E_&}&PI4(F>Sgp|Vfi619;Smh4w=r5pHKMU6;CxRQB8h8TR<5S^)nV) z<*3{x90|sD-T+Zwx9adZsi?zMus4+k^7i24xJay^U_ocsIb1O>Hf&WICQ|+QVIrJr zbOfm$Bi36vQj?pvJdx)Ogjb>us?sT7G`yvwk2u!UO^VLZBZi7tnS;jC$v*ZWa&I|% zetae;m!H#reYKiD7R;e~xU3 zr~u)RtFZ!pr~)2e>jO&(D*}N8>Q537a-iU%#7+_bct!&yqs#06*^dM&+M5S#`GTsK z90MQ%;}-*g883Ax{0{Uqt|`GJH9ti$%}Bu_0u+!V@UgLP$^_BEfMO8=JxKW~&bN1W zALIlFBw!IBB-^AAI5;@p$?lO;si1(4%zGRNO6otRKNw$KNPKkxkVFdxw*8ab*ko^{3iqlJ@c0QBuM4}50A9kE+^0ER(eMMO#*=PK}`FPI}fJCx@S&WDAzO% zDA932qCi_BFs0al@DNB#zV|zJxV682F8>r7O2(jQV1|~CRR}*8*g)|GytZj;bm$hf zB-NDon`hqvqP@=jC_*DXo%d-1l;Lr5qyD3Ge9k4TDtxsWe``A5q_U!JFaE?4bPK@2 zdeE#E$jXW`1a|i3=aZiGpuZa{F6D_ys!{G-5fp9LCkHJ&eQ6^={9Ft9`{mbw9 zM62y|{{6*sbuU?*d6`cP``aUdpA~-G{UAO9?So5t9AtGo+HrW^E=mA6{x;)b?UX7U zC|N}4?L};+`ck;@#1+b4-{maMrJ|ZrJRyG?85u3kROt^2U+TATJ61tMfd<|pBXa47 z65pYoqm?CJ$EK&fR^Br@%3K_DIlYGx7_XQJ_DXhdR36_|}&<0bmHG!Inv zEg{w{?Td2~*uo!$(m@E#-)H|~OW(^*#mrSw6Rka6&Sw=h|CK`O=x$WS1IJ@vk1XOF z8;)y=a`lnbB9%`wAGfk<>#X2hUbkk5Ok>fNoa%nD4ORsnnL#(^5XNmmQ~di_>tC$X>dOo^8z~~g;SWb6 z)&4`(HI^Q)hkwQB76n&h+?gQKZ7fF@?nc#+9)*GX<6@W?<$Wwpnx(Ib zL|}cAz%jpiLZgu(>DYi+>)z+BPT`!F?kZk&mDTkf0q-C%f9x%>kl*-L%z#=n010qx zQljagFZj2nPputU!KO*Nd3=SBzS&)3R4=SCn!!yNP_HB&PrBwf@dF79XqS zRxhB^MqA56s}IAx6&$}c438+Ldag1eHP|w9zIsBlwXy_BH;1FXT!+S0`u_ehdhR&a ztVfQ%DXJMaTbNcQ`-rdU7>1UR91=KR`ZGiSw|dQ z$=koNi@nN|f1V2ypkVOQ62VlKdoKM{N{yE}>Pvl=3^X2Azn;K`Lpy{liX);TlyLAJ zbe(61tX%bDf;()8HH%iWIiRI+LmtgvF!TDgI5kk1D<#K=2%)yAyC;3?0weQn*5F1= zD>msve_TVjPkC=0l-0En_GpMy8b2fip@wMmtPPUux@1+=*bC)4k;sr|OB}6hZ;mRp zuF;%v=MTj`M`=(G1T+bVT}|#2VpZ!!umjCDu~BH!kHGm9gl3Aqo}h0SG00k*6|I-N zzq07^aWjd+v!oWAmYl1E#br}66>r4qqhO2O=W;gVZne9WVQP1I$2U(Nm!d4Dm(d#} zmje+JONiGr#v6RCntQV-tRUGLjQJp;0{f-!b+O60B<`{%j6)&n&TLJ3u_@5P??P?X z&$*}lj!aL>Kv{0bx6jPZUpaRT7*YG~%t`;SUMo7EF1LHgk{HuHBpW#1Hk3vfd5ZQL z03r|-19~XdyKXd8jOZ{$`oCZDs`4cwArXc#MLqo@9pxol4GK9RB~tqKWzY#hCyYj& zH9v>(bbufNs0M)3dzh@-5p5VA_-_aX7=xWp8A)YsZte^-pb2Pg0|8=&OO;yHFmTSA z$bauFF-VYp0*$noaZRCIgkT8JS3obok1{6)ONanLQ73z(`5OWdr2;wx$bakp*MtM! zTG%|8(ylLBwqivqXDEP%Uoo`zR~&zNd3Is^T3bjrC7oeKll75DDZ`TRm(qgy-JhxM z*$1h$K6of3I%2(+BB)4#)FdDbQF;Azgs4ks7lWrj$07jGDoFGSsQBQB8>EY?^CR#) zamFKz2zUbYI(Y4KT)fvlXaz$)JnOKTGP zT(1`V^QhS!TK;E#X7t>P;1e3`Csg*qF%(xzbd#VrTmbso(O%K|oRN<8h>p;CFB|;; zec^F)Ys`6?AGs*g^1|;X48g^U=3A0JT!2E%c;is`p(lh&<^1kk@{^@bb#1rQfZO@7 zxKhH;S+}eJjM^$RY3ZU$|8qpMu;Ey+)(N%^hq$J+J78iM)J&%O3fk}URf zoQyc21L1k02cpyL{g1wDHL1Ux?F-XdkVkuO>^`@yKU3rg{UYRmjCV*W7w}X%%5?T$`$ywW3;Anq2OT5J)irrA4i{R8`qG^ zyj-pAw~csS@AY&XNSWueu7qAJ|0tY)c{w++OpIWw^WbxH zM~$%O8ev|#q?BsCN$jc;ePK=Ac5&WqHs=S2V#u_n{`C7Zq+LgT+(C-kIQGJ$gA|>Y z&l(SJVJQx?FlPSd%&DpxWOKAa$_K-&^g^CzeKQ4GlTA6-xk|x1?KCabkt~l9(RE-c zmU*n#zh?&Gk1_vI)gNXl&SBR#=D0^HUGYJR0*wH;k>AzT2Zxi-SAI{^|8~8%bQ;Vj z=Za;Voty}~&+8r_YpcS)1}@ud+{o5D`_qR{j ztYlcZ=g)aPv5c>w^q3KRlRF4M_Xw#f3d&J@XU23^eu=t)CL@^j8Q&vjfay~^89y0E#(;aCdUym`CRJC6yvmlAB$0!-oStGi`E*H)Oge!QV7fA zk|!a4xP_@CERWV&p>0vx#^D8Qv#Qzg($XjNxo(D}a_eL2J2&?p&z2_*Ev@z6#vc#% zdYw;MJ@N*=mOego?Cg)RZSMPL-CW$$g9G6DVk22gT^jp|f&WYiL z6YZsaPg_x02t6aSE8U$Dm3{5Q+((f}=p>bzTAnKPbNq+#-3JE;L8|xmP&c|rIlRTi z#fQZWadCe}Md>utVMe~t<%vlQ$aHAcmvnvZXFy*%^NtYydu1W~H;GEfvMi!Se%B2> zrMoRs-gOa_gnVP?IKjf05S~}@>3DGasD3-5G9E|JMA2Yb9T|lld);p}sI8M^bu0)j zc4k#sA}|cgXWPG_RrEO*FDMNGauK?wSDir?^-6c~fO%do%%JKTP}T02ma*;CNQEAs zk|u>Z9L;%+=f0bk>&<_6J>L-<^;3SfX&+1tLDJ0ml!wYxIt^T4%KcOD^wfeVG`jI;)#hU1z2d0$YBOvmnlaha0)^Z39cS$S@T(p zhypJlTAvG~(NoE41Pm267B?F#9dX?AaAT$fC1$zY?+bBx;}FFEWD(}wOme%g7iiPg8|LSU`O)U$ z@(e9IXQnJADRlo*8GUE)f32N3b0{cB(Lw*X6trD#!h0+;T%Ly_L4=Wd+bJz0P7I_x z6TMlsT%(;%!t?;!IT0}Jv4e*Ry*q{4zjX`lbJ(oO!J>{k2QG=p z9G<<`hqG<*n^wfn*w`3KGKwKeGEg=0!C^{rayc2PKt#0Qeo!po6^JkY0}YH=R1*$k z{qv<*#`og`OeZEbIyRP)f?|M@0FT~~cBMo?A%h)0QpkwWu`%o2#&<%Sg4Ts1!Se^1 zx(EabY9JCx<++%EOE02|{;C^p_UYMKhtta#u05+DDAghA{olBMJ9`Ik#}HWIEZVk=Vs%+b=Prrm z3NFILU)Tp;An-Kfxysg3jCX#!FoB1s)Sk)>-REAX?p)mXn3W*R@wuCPeKm1Dj1~r^ zVlU=zlJ^VaIX?d>x15x5aA$soId&+lAca{O4MbH=kpcAmU|oUH>^9G*E#0pFqJMy2 zyBzy}91;K5pK!1$w}G^c;G*+`-nfWXU+r8S-k4%lj}u501^SDKNC2+>-FA^ktAVF( z*y;Lzce$n8;5^rh9Gh)s5ttRUMh7*u0<+v?Bo!;DJb)?|9$ty6oodlT^Ew0JJ1v1tEg_ z3VsOWje4g+NvZ=S6^gTxA|N8d)7}d;NveDr(AGp?v%vvzFlWG_fYkWzwJjn8q{9S% z2Dsnk4Ecpe-Q>d-31L zcEs<1jeBdpfGBi*v{>Mfb&CRls5Hw$x-Yzm7ULE$Jm$K+bN~h96Tw~Z2MqRwRu+6q8xDh6YLnD{9lM<>@HHfZAN**CyuEbb0_FICj zXyH*Z!?JdkRM1Ch#Xh81OHXj@>2f)1kTa&KNslQS&z{g3MpJ7c>vXzbCef1wp){D?Di-OPEmMEQ!hfRV2XcOCofow*q=3H==32rM6O1`3S zfi^U97Cic`OAcNJQErvMdoQ-LxbfvtfJe3^6APD^7l5!X(SI?=~P*xeCw+Y)#;t8qa z(padn)9bs$OeR9xEA1bcVE_eNE7DGn4um+UpvyI}m7XaQ6eg)PC$*F9%VDjV8*pRr z4Z{lx3;RJRT(Mx{3e2Qwl$i{8POdp+_Pv9gx>cvJ}<2`XBw#yLSQo8(ZP zvx_C4eox;Z^gGFq?{LwO%h7DmM|lLGBHu3F&fp;{ILyok^gD=o=C!IPs)!3CW9e?= zJ{gM3RnyHmCe_R)P@f)~qjAqvt@?{SR993q!3`^A$(MusHZ|3LXe-D)`g-~!W5~=# zXqCO<cgrS%&loPj#oiVai7Jcfje6=PfKIrF|4WXWLRV9M?auda$@QT^8&{eG5zSmrwih*AGZb>fC#$fWA>Wy)H#?1yeB&WqnqFo)3xl{z1usTmjd#+=bg~6Yjp{@(0 zB~!*EAat=I-1$$J*&%ik=xTuERwVyfN38_O2$ZOogy{MjPH&ZbsKbo!E6oTvT$TjT zmI)9c2_lXo{{1BhJlG@1AV{VLB8#SkbiRlP5s3E`mzFZ*&-pao5VWYT)4m7kTEIw7 z&$+0x%p?K@DKJ8i2oC^9nIJx>C_;)9SVp?d(O)mm-86~g%1yZ9mrK7wmepD_Mh;{{1V>1bc$k@Yp~+Jk#Q8ET&TL+*olffsRV9Gv2?=dqP7tv+zjf-MctItbvqDKpxUHqS2^%NYEw0 z1ajz{yt&OQ3^-a8&~h0C1^5G^1U ztd&7PSwA6=(!*y+b+ky}jgU~U0zO`rHzVoCp3`p7kc_#IN9*)%ZtxGoakg_Fpmrz$zWhI8Fd*Ngvi4#IY5iPV{XzR<812vV*YzKbt0a02RY5A!I&2%te62cd00dda(vMkK$chA|=py|u{u zm^coH7`WuqiGdKIIeyqF3D|5j5F%uK;{O{92*CzZlF}^sczJKqwHe>KdWPrNyeE@{ za(u7hc&I}F_T4H>lnt<+Gv=E2Y`9Uc_%xmmH}JWg`>_XCW3Y_tJxoE#ce&pQ`)SOu zf}@@Xpz3MOZ;-TT&yBM0dWBun_dU~%8XOxP*z}s z$}f1u7eHgJ?{juceLIt+FmEenwXD>l!IiS+d6II0g6(hC14c+t((=R>O zqz&o}1h*>hAC?XkId8q4`=j>j!)+Ez!CTrHUXLOzn}3E7r%OsUFm;D~|GxT0&9|>- zUCdMPA+dk|o=N-EokFD*`LaZQ2et+k>4e(sjqGIvEkUBZ|hz6z`Nb zRsH&Nu~|h>|B+j9z$InpJ#(r0azVAMl$F-i&0<*$hqlXAJ_5}kWmpEYgL{7d(!^}D z&}=j4)>x}gCE-s7rdBpJwFvgC`bUb!w4UihK>c@9H$7eBPWE$+ zH+af7A00d$CZ8_RJ}1_rdn}22ly6~ldnQcOb(quBan^eC_y1CD-$t{_zEre5Si+Q?b@d#hm@T3Adglu;$phv(an< z+q!JT`7aIGXs;ISJdXR(z9hKB^5Oxv?CNhrxZ~y?*}#}q@rHSfJ3+_PUPA=5oSbHm zv3uR)(@TEu9C+>6W0c842bOs)F#qgL~crLRr+#mAr^X7WPCq);N{yz;u8kSZc)1k zeu=5tHLcF*K)F<08*V>e+=H~iC>~w2@3{S{$CdU?b?PwEb5qcWR>7f;V@0rnW|GJU zsfMhE_9jlxI=|!D?Y?5(3gKeUj~-S>+xp8NABnD@1z;i6y2uX zNQK>D(2}V&-jjX`6ASC;uFxgGC=yzSP&>->S zGNPRnbGplG>|1QSwH}dGqx1Oh@rBhPXN`9uP)^|~KPtSoXAH7308f8rfqb0rrfkZ| zn0oS}M~5-3VsD1s9J4F}QWK_h+1$EBD5piJDjAhF#>D7!j)h;^cXm$yO?*eDy*egS zA0Hc=T7OP{v)*;S_4y=b-@iN-c5WqXu01W~u1g;#h}zX9zVr`M`#(nOm{5~a3yj9A zgvMj~GB{q1s}UbvVy9<)8ZV)H+E#d8X7h{1-`e9|5r$-8Kv(xIM&k1L7p0Qg8|Kq0 zpP?S&0^H@3(AU)xFX1M^pk0gkGF}6#qSZp=f<%wU(C^vF$a)m=iYF)ZZ^alj)D1BEEx+-K?IM{MMi5nc9^j|-#;ILH5NV;^Z=JuxoOR`0 z$x`fn4E#z>Pj4+6k4#In(x%}z`{9*`GS+9dw| z(83n-@jwrbK#+4G4QJ6!(nnsI9~N@sI67ZCDc@!5C2X_1V%RTu)h56$=eOi~GT@v; zeZpU#=DquxNHEZzRod;mqp@YP+IBl=(o#MA zEhF5!hT^0AF3$h_{Jf1Hj@e*S&rp+g0V(}qTSOE9CL+hicz?pREJgrpay15*mGS&xATQ8k_h`MP5E1vpBu~X) z30QxE$KVkkWIyY(C(@HEqYReP#5aBQ#b{j=p?Je0-SvZ(!2o#bm>OhGO9n1H&bBoFILMg%>2fxJDvX0{fl7IiP!K;^QFwP zaX8dY+sx<<(}=}TFZ&PdmiQYiW}^(O(ttmIwCQg4P#s5uZ(w@0e$}-+Y^A1NcLfy} zM6#cT0=;?_VWM=Yrxx1g$sDc^FMETt$R0Jz`?=>8W#llaI-}G~QlpOUn|yCu z|BM!siTcL6ML@PrE_vugB$bg267XdEx$pXyc#fvJeLlo3wgyGqr?S(FrUMY}@5$t1 zyO$Q9Fl8F5H(Rk;d=F=4B>i{qvrLjS!o)|P_YK|M-;X11ZWnJ(=Gj_`C%U~p5fT3x zi|-l=>#ld+H|F`gb#t{8hbV3p(nJWVk{|^}DdN4XMg`|(gfSRU+#T}q`XBxd{f3Ab z7o(sV1{G(3OaFe0KagbV;^5)nL1o^bh{ki{mG+VacXfe{htm+hbh%lPlSBOzrX|M3 zJryr6fz#2#{IR~zeW~hI+{T73B#r<+G2zO0?bod)7BH$Y1(1CV+ZRi`i)!{w7)|2g z&X}65cfJ0+57&6FWBmNkK_%3G-o0C@{>jgMWo~R~X>5pe2nY7|EjH#cMiyZJf2i-X z&d*ua|0;&jE;<2A#wOdWzwqT0+@0>__CrHoF3RSd`U6KQ|I5A*A)AO1d1|&x5R_) z&%r|M=3;|p2Pq#Nd;j#1ha2(ny8e7wkT4750ZVH}MtpLYTfn#r3@bW@p&%9rAL07eFDmnQkZ8R@v(a)^&wYc<_Ae{r3akX#SBwb< z)^}gK`8m|1kB#%T+kcc=H#=I9M|r>A>9}@b(8K3Q$6)7x*5AQ2q5vNY+z(P?KTq1Y zIAIm^`hFFG|JvKDyGeV6f`W!Fp`_eM&Az{L=T9eDKQ@v>?v1bVyWJm+U!?az*J&Di z+*b_Xt29JeDm(f&-8h;c!!dEl_2ffMec7-w*t(CM=YOv>F(P?t=q@c>2^rKhI(o;% zf-wyL5F0I$*yZnlwdu#k&HuQ%eLOO9Y%2wGXP5P0E0x%p=hwj&IMOJW!*e5Z;z_?Jfeq3-t*tjx=wggw??x@Y)s4AU|_-!C4Q z5}x};)3Y?}zX50T{#$gc{QbASV68nQ{@Ca^oq#DXiF^)EHGK_fAWf^yru^EP^)&UUoKO1Ol_?_q*wxA5d_-;BmNLfhGf3A6ezq<-fQ#>u%Jn z2SM+ngUzf%Vu#jOXsxN#NigE!Fz?-7EZiV-_r4)p`Wj9UO0;m)>*X zSDjBz!qVr_*l?pOm7_{Yqb?7pi&-4@$|M6{^)e)wfxww))N1H%?yha!wP0lHd>PF3 z*SQ{40iQq8y|~22#SRXyB)Z1MZRr)c2sSYtF~-Iwz{bMH{#WVzN|mGoc>WK+8|*1iiLm{4uHT0_LaJD-@(G1_bhZH@P2qa zz4_+xpzuUD>c2Z?D*SJIhOAT9+}Oq#jN*JyFc+5M63L@|gPDmHs>U(EbA~K;Fu>mR z-^Y_RYpX{?OR&`b*a*dBb?_OcX3N6?bO#`i^z5YPlH-Y7A%!KO|FHAD%&A=Lh5E^s zX5oxmv${MNc6LXbOcfv#xs_PsZ?bkbeZ}|iDA2WdKWWQjXYe{=*8aI|%3Iew0aL z*uymGyQ2ah-k2{kB>g0YzMj_1l-GGKQ>Au>#0)8tP%G+yl9cGGfWg~y)$8y7_r<-2 z?fu~2DsQKtx3%GSHy;!Nx40ZXozdy1kF%bC#*a1vH80{HvC3bjlSd6$_@x3DO%mTJem&evsGd+jz$2 z6VvYYVsL@YBITWRLm5-@inE|o<`bb_)*tJ8QvLBK?ExaA6Iy&8Hj;+;mHa*o%G^W9-$H{z- zg0({fLk~;o6;a`K?}}-nGMo%N!hlveTr2~vgUT(h%8ca%Nqzvc#<`8%W?PU%h%sEJ z+7GlJYxWhJW95JXYwh+&#bAG|ik_Z-8a=OSA|k_~gcfwLS~r6}{b#V7DQ~o);#0 zbI)ypOc_@tW{S_}v~zE+-1tD`{)Z~6E4%4Pa%hZ|+El$|l)_@#oL_!>q^^>W4zK|( zWNC48g5TE0BYzj+U^awIkSAOrPuf+v%U3yuEVOoCscTZ2Ea>Zo-x~$)cD_=ud?q#( zg#Qc+y^}nhnUR@aOIBHyffw3zq0yB#o0R4u*gkGkP4l0)QW23wmfad*d`vc4ZIf5r z4UGjs+S>;I0NgJ`MfC4jB%B1hFxs+@&Dm0+2uf~J7F`N>XFoYhc%0fdOt{UgO2oxm7(!NTVttsti# zRJgfED#|`Keu|`6IIh-x(5G%2(2t+PfQENWamk{op!pqMCZ3{5GmtUbK$hxumpjkX z3VqmTUMzVk&9sZk4nT}Evo+tuY}F$G+}kT9Gzd?&?3$Ard2W1!wWDOZgdH4dNkT-8 zYs7E#2i>0oDn;!B*iMK=x?482Xd6=t;xTBLP&(q{VJpdPLf;m$H;S6AlEha-a1K%` zHfhPum;>>gmBl2a!P9OaAE|T+Q^(a0pLa<|WI)1bn(x463Dps|KP`4-LJn$Y#)I!Id z0PHVPgIKQ$5{NQMV4^q8+!mU2{r+>L$=P5LN&}i?6)_>R$`XYW$3Ds)H^nLqrTaiE zA3E;OCb865%)b+pwqYTw$X|`{8n<_F z*GH!%H5-o-YJ)gFKh~UjHvVJ1Hy-e>` z2g92>fA6CGmrleJ<3&;;g zH|(wB`r?-fKxNxa<~H7DQD50^axOoQe-U+)V8g({j1!9Bn2E!IDK!Gbj$No3)CjqK z12aRY!4i5@ebe2(m4B6G^a+C`UG@nRtcd~njX309ywu@%qpvy%hbTb^2DPgtbGiVa zSVRCC=zXmNuP8Ivvu3b>m&U7RFw2YIZEbw*`)mOfiz*UeW&cQ#Y2}~S2!#N2dhPd< z%YOv_A0-;=Ak=z&3Yz}YV(|Wz+2@EE{5X8TDi6SSAZyM5x}0{1b~^-R6pCewuV=lW z^dfnX9HHA!uxbA7%JRziVpH=asswJiEd zY@AjE*qBrjOPDtmcySMtSElZjU`BS`qD@Sy@|3`k13YS@HU=rsb`Q%g{cb4VA7!lz zJoHgAE8({&kF|$o>^&q~?$PMPQ44oUu`-JlBC_ktU4Q>f;ToBxV4UZ%o=NR@eM_e;Ukr|4_1lSk}I3bU_ z2p3>3lcsNMF+9;RV%A1K7bI5;ZDG9IWlsx8*4l6M=3-SDG^f+pFCe;^`^yW(4e2zu zTsBO8j9nuB6FW`G4wYF9-!Q9QRZZ2)RT*2#3qRO>I>N-EX+8!(gfT4T50jsZxWRaz z8Z6Ef@4VbzZ=1B~l>3=|LYW-(LG85UP%U7YA02R%-_9lj@z~r`00PlAo91nnoRIs;&@eA?vpp^0_>W`CLrp^lJQY zxmuA=1xd0)ZkFsyZg41j{Z2-w$~A!;56nris9veRS5JDbzpZ8OswL_C1$nmGes7y~ zLUOa~bpIGHI!p4fe!VU4_Xh|=yrBO)?GPmbvA2%M6+0CPti9%<>)b^Sq$UoCT2O%D zN2CRwa{w$135b2bHpxREE@~YqDQTcJybdr-0u?oc{STQYSHP|QwHHK*8~}!Md=8o> zGJz6b(JA7@*X|NTHv=+gf-^|h^CW2LE{NK3#sgo$2sLoM=8}XRd~HulU@8bCyqC>a zw8#5Z_M|dc%M0{bA>e`hSH4gj{1-V`3Ka5;#7YJ7ih=pW0n`6!!5M@cv3=CDz#9U| zcUC%#1LVk_%Z28H!URD!QIOHrRJ(Ql_=ki7iMCgK+%GNdfehCz6kFw2`I8VZM~0TF z*5uchKJY+&HuJ+=zdnQt*i~ByK89xroZ>Zok1F9ce_}N=e!w5_bzKlT*gA^AVr|Sy z0|UQu+QCLRaM$?SbypO+6B~0KnLwi_zvkVvq{&|u8^8K5T^f0=1V#zUm{R%+VUP`@ zAfVgxhw3UPOIMjqyxEfqtDrZOF&4D0x|8u&^i?yYEg+j2P*SZrSDixK;DjowBO$v) z1slo&Ybr5daCK~5r~jn4kgSshZY!kV9X>Y&(cNCz#UTB#PCGH-3>7=Lm?%h3 zMK{og(+w`DYddSzq<6mMlw5;0E-uqWe8&GSgITIy+x@;>7OdmW&T*yNmqW*t8)BL0 z8(Lf6nT?^3NPdC<$5Q2F2+Dj$k!)d>VMxP3$3aHtz5#_dC`oO>LH*mf=P?HA;xA2u zr;N807xk|j5{RhKV*IRfnp+~jA_CA_@f?iEUiIQC+CVr!ELtKMhHi6mLjOk5gsYK| zlbTkuZVxcCq}h&r*}MTsZE5M}Vj)iEBBW=STdT*z16xrE0T3CL=Sovgu$tnG!Ch2N zpqv@DvsDu*mOot|kp-#18?V!dlXfeswRUKIu)_JGQK}Del)BS0iYiz&PS;)Sk8=dn zx{|6Ce7$lUEks^(@!M*hNFLJL13CdwlsmG>zli2+CTRGDG3z#8mp@ffLr;h6AFnN0&(b3eS?}WuaDYeh875Qsq9Qc}r6**?jx>ADZ_-)^zOEuM zb0pI~>QigST=15P%aC03!v{78Vm6zx+UB#$?`hcu#otIaZecxsk%^2~n~CW(|5gJS z_pw#}KlUR=WU@^ux$RV18rHggd_MuJhMX;sQ&_Ns0N_$l3+DjQtvruJq^1JU-}yOF zp6akqT^Bds;Dm@Ccy(|7nmh0Ep>AXXYQ_{rX%us+YeGq0qFXUeaXBImXU1g<9}#%E zpk_jVK}WdeGa+tsSsf719T##?dP!B-^Vm;OKsj9Hsj5lc|HF0TFNw(8r7S<0i3nxtrz{gkoVcyWuZiIM~-@Yc}Aulb|*vyTl4f6bCI&zQ1_O@ zWgy3`tNWf_8u6=Kr=z9d9My0JJP31GQPZY6TdDDD!-!bZ&R5dZB$~PnvU{zZr-+sM zMz79eRH~x$*wRT=5<(L)l0i7YxpANdM8wCF`1@N$k@70g@dn`7~v|v?jSO@(un> zV6i4Ej277TcNRskMkwCTPtzy|3BQJOX|v4UEg;TWgW}shS(Aaxe2}+?Gx>JDm35-~ z(D>*|Y`h*K1gc|wbU$b7b9|=M+%^!hprOTn4J@Tn3R-zI;iB7g*bhtA)l!{_zy|;& zdIwkCd2e-?{rDq0xQoUD778gu;MVVdHF54!-mQKmM52WCDQ?S-JC=b2QjIOp(qi9% zZXzImuW9a>J{wn7|sjUTMuENGVp^WcybA@lZ#z-AMXdAAAOQ26-K1u4`say$V zp|jw_l?Lm1LiUftSl5@AB}15Nk!7ql>ECUCo-DTkIvhNjQGFZOAr#`G6!o`QUrsdR zjr>G~=qM*kb=7tCN@u!*I$QP7%CD@~rgpyDeI`ie7T5FrwKjX-u+c0=z-N55L0(p{ zM#~D6Kf$fhY+N*Pw?E(i1uBoYb<(Ia8>|h{rqm|fK5_hQJRDdGYSmK$jgHtjSs7Om z{uY)qT>ep)7i6pZ>kk+4doSLR8baC)G=#@9rJMWvd*H(0;&Zh&K&w$NWmMTld+QZn zYzEbH@*-Y4Up0nQwmCV;oiS{y=k&LRi(1fPHx~#ha%wxvGx++B1Es1lb2^%8lNX9x zwql8VXJ1pY=8h~(6E6#6Mrd2j!Q}=Y-8wPqAuO@|M&Y8j)YyEzKZSJlU_HEot7R1Mf&|JhOix7Y|HmwO_zPagoS|aBVZnMOBd#PxKP{e3DMU*uAp6E z+m0Up+;zQ0XadfL{|bi_7$ZUb6-8bPg&*+7sP2d1+&S=J6mlHgt51yk-%+}wxss){^w(F+WQm&k}s20L51`M zWrk`cLU+|u$Y$yh(NA@DKN{gs%-yVY)k`R?cyOHnx=a1_Ab_jIYL12b$U_>jD!I(w z!U9BU*pMN76XrfqQoEA>2Fu@dQ6jPnmx_vt>~F7U!bg-#+}BB-(%ikSam?+%2I-^< zLk9jTw)~bzWtY4=2-2dHR(xyJDnUlWwoZOx3)Mmj({VdjDskz6Qp= z+)3Aqp92cmf@ae@>crQ)?{%oG+`+5i7y4iqb?F|BJ~ip!f1|QqnHMCTb3CKWPV^$K ze06ivM#DOO0QaHOy=!~5_!KYGKqqa|?0#F}* zYZ%J%!_8h_g{_EscSwBa1`;Z2Lo>DDkD@1f1vn<^!$V%xACLB>iYS}HP&s) zID(t)u&Ve^RzfuOir+tz7#S=GESL^1l`Fc&mNUloofSlVICJ`BnvB9;vi9-Wvi6j>%{GZuU6SB7Aq-y;Ut#bK4_zDdGNS z9=WUTPY-e((Ys4*mvNxCOE;pn8i;);VvNP3u>Qjv@A%x` zY}KF8+TlqX(b=BltG7@$!&Q3pntDrhf$RyloFd# zT-QG;NowamI3pFbP$ks)T#AkFMod=!wotX!nTabPP?%2>!?GFWIIVL{MOD=>pfgvD z@v7}pnu%yS>dBg(zLQFVDHTOp zcoSS}dw;A(8O^s)U@xID6`zkvjZPe?Pw8eK9l(XoCuurX{5v*pC@vEVrO=_NFRZGm zi0${Y38M2%P`heznIFd}=f>F<#XKlhLGJlDRi!*a0`)#=;WZkDZ+giGPab^x7QvoYL0|8mT~j zLyLTL$>$z!_1cC(N*BwmB_74~R~v^Z<3J?K@pn+>1&tU)l)JFY^5@g2;5)&k+xLGP zx+Yr$Z8hH%GqyT%eDTH6j_}0+eGQAlW+_{-K$7>l*|+_K29)p(^*LM=n19gp&{8#udFN552Yr;+aU`qt&{ z=JyOMIx~q(CA13$AIx(I$niCa<>#uX+d_C---P3*8}lDqslMhasb955T+_;9vX46G z%Vm0vyUQpr8zZ-?AoCD9g~_P(zV0$>)}GZqbX^5c4OUEZ)}v$dXw(bAl)<0 zp)PkvJmL4f8vXm^GOCxpb?tni(XNi^%jlD}R#Lo&sFoiuPh)+_p+l|G4BuWxt4lSi zjD+R2J#mWJZ^_bQ+P!byRqI`h-(BoYro8Thm-M-&##-?!H(16FN0vDgE~mV-?~WAk zz(ga@t~81MDp!D9`G7!Pn>il5ZMRU%{}+O@yy{5GA}-Y8x<}(yv@0_pr_-re&P^#W zo6(kUrnfvQh!u;$4Mnco7_LbiOalFE>nhHHNkru*3u>DbTJKMsA>=X+Sw<=F4Yby7 zM+Q3<#$l08dqe&GHV>yGYsytmebFyB*Hlj@=TtAQchS%HCz}_KgI)g5)z8ONf6SM! z^XiV2;dLVt%oSY`eQds9h-bv2ZszzK__2t@z$j(;7O{GS8jp5LZm3@=*<$p6EuJTF z=P5W@j2&G>{b``&vC zaS56>%-6ZZC^~dfNvlD>)kFsvl^J_8CEl(GUY=ZJZNa1LhRVI;wx%JFi(m>^(X$9mSi zcuiL8S#5=Fg%n@Y|B9el`^IF&Rr!8(>7ibvgZsSf>^}6aX=hc;SRnF>Cnv?Mn0k8d ztp{ON@zy@gB&9V7Zg#=Mg${;GVs;9lAjd*Zr2J@y0NhNqbH(tJAQ>hww>iW*37isa zT1b2#)^R`G5UO15u6N@5tp3m&kun~+*9Wf&hZEt`PuYTNBsyJOw@&v`j^Z3HWgwy4;~V_e5_HLga%B%ux8qP7(Mh`Tmd|89#WOKvL|b*q zvg27%mf%QtV(o&)&ep*BFuEn<%V8kNu#sgXa60=1al@+6cBTGv&4`0IDXV~G(oa%; z^?s^*f&Wu1Drg+!B9h{clD*y;^{yNyyJ@14(w53+KUyn$w9VOlGj3^eEcrpY$$}<| z-lXi02^k2hlAW;H+?OFTE8yfzc1C@bK4BHl#VvB`uWlHn#$`#3bbhdW6)pYGCW;bE zB}I~Gu87WFpd#X3hdx6JB_Y~uc}8(*D(BpR zPANdNLO-rL-f8?RXt_xE#k|FRLUHx-I3!{7>|E-Cgg@f3{}EgsNzVsK=x!$VAndg^ zx!u-XwAs66`=vcDfQ*-`F)@&+m|fJcknrh&X-2?&nqAK1Ik*mAm0MmP5AOoNFqM2hB>-Wa8(!GW< zTDtB}b@oECY!@%g=%=^6|fq8CdVqd>^aPJ|7{X^_{eaMfFy2XjDF|x3k z#JRBn4b*M5Ak%cVFnXFdj^{NB;Xf9G^$FC{JlizKGnFoo`ZUIp%_c|TjZrSr5!1;h z+}tc0nmR(R@<;-6@RCkldedp@rCc+gWH_a+ZO^OZDky%)neH7FJ4h8k}3Gf-V}dr4sR1tcj9!J!g^SJt z=5qvB5-_j;z(NLEobH2X@o~bvfFb4ifv91igWh;>Zw-q+0{RB%1x{d#^PU$Ag{HBE zt!;>u$^QxHu^Af5gy$ndp%|1J*6g#W;{yjVH4f;|X;^?x1CL(F7pQ?AF5x#Q_xQiC z4qyrvTnPS=K%kOpMkLcN8-?Z{H|*9$fF_a3EVQt+CmA{O0RAY11L6f(Q2G43aunqX zRcoNz6k0ejde)iF4|*)CE`?rpVMpQYi9^wKbSr&%{_;DCiLS-r7@E*57q&$AP<*!i zN^>rkO3HT(RyBn(+h-h~Nz2t=A4+FVg`G`9JrF#;5a?foHhgs`NW<@QyiHeYDrqD= z!1XP)n-@o>uf*V2XYTicodb%=umd?gbm410tFf5|(?5;e@RK;^Ir>T}%6=uMJH-`^ z2PQ^KePaa#z}y8F&VMIphXc~bl&>!euvsrR_bdbK#RyF;UrEbIgEjO#`%}dZRQ1$bg#+@TBj$fNNdux_FpE(Hgu6Q1Ic^BW9*ITTp$Czf~YXErWnCn?hl z^nxNRK?DHK-q6kzssAhhDz*)*i&zxuPlc*OgXgtsRjq6iUnS%`Sbwf@i^%b@_PHyaK#}cz;|gW0=pSj=_nMx zL(AhHzW_dn2Afiw(0rdfaP55}7)GF}%r08&$ASmOBi?sM&A-;Y-_nSD>+i>oL`44< z_yWrHzQkHJ_uueG6YTy5l4et(driZ`&hF;5B~!F}?0wR~D6GWA} zw?LSk;_}p6yr;8f&}6ow=RQ7k77Rkb35;h{Myhq~;^}|_v2(ik8j<@yAD2VO^yY`` zx&$w3tBV+4^*a`$%7lNwqodm>m*o@h`sq8U?t+X8TiDZ;u>p8XR5kjaK6{@KR*X)L zjJSL*we@}$Eb87*hBUNG?%)lf7T9{nSKfo4q_X;p~TDmNmk`;XL_bPbMTfYvrh z2VDbdlGyb~2a)(xpPp{kvDgg}`NI&^>p8&}yF|%bM#g}J#O7O(iFbI7)rZYjbmU>x z#*aA=CnF~p7yJbNB?p zcn+yP1U+2#toP8|UiO-QDv5rkI3ytsep>Upm4D~km%riCvaawC)~#$#+gP2ZS>>?b zDypaP^!b+SCvGTuXv}?E(3(HDR0N2lM3#*X^jtkBB&*c0f*4 z!A`y7ee+jwD~@<}o{4STd?x68U_SepC^~>jiZ`WbcyvmfLEL(0W~vUz&^EZdJU^;i zYxtHnTN9B9*wemC6tJEOUSJaJ&7>~MQY3r!($to1bE`;l=&+@iFRj2W;#>e9di+BD zLrYB^0EZDU#1bH?5zjT$^}(ieXU(e)#}6aVladcTYD{)2IYeabcar zK^F)#QIfh+#{Eff@R2y1y;Z-Z$268&ahVXMQBk5_>5j-4{&>bL(fofRHU(-C79H?p zq-qhh>G#$GlueLik!OZZg=vL!MG+Siu<`r@Y$V!x(-u!_PNaE1%|>nxc0w~CdIR`& zB^CH?uP8GfG);Ov^IPS>Ab|)Y&9|_+pOaWPQb&)g!cK)~H-HjWyk8Zw+6I8tuYrNT zf&#h+gjp8lkmIVd$Po*T9K4{c5QKHB`L?@5E+{jBLVr!1*S~Z)6cR@m!NuV(2hDxFD_L*--@ucUFeN2CaPe9_fA1ojPb#G+p}W6y z*B6;AZk^%Ov@6u1Oh zf;T&}n}J$=oLPXD$s5?in4LF+eKZ4$cE*63`;cwbl%Y_*c`4=U2eb&b)7h0E<$BJTF~c2&4UDq{&-^n4<=X)3#LUv%V==`J zZe&S3S@GRSqM%nAB4{W_yq{Pl40C(ZrjxU_=kCZf2N)`(Wx`^U5)*K~@x2|?kS!vE zCBhXK0ni!o79n+Qz-P_F5b*qfMp|iS3y5R!YWH=W@jvav1XMfm&1U9*E5cJt zpJAz2Q@0(h)u2kFKVp=(VO-{NE(ITks|`Boe`qSCO;1HG3RuH!XrW0{$WdyR&mnTp zfGe7nX85SBW?9ts93FR(Q2k4o!I-I(*JL%!-*XD$cRJfsDVUz_UbUf=M64{%^`lc9 zqCFu#cBK+`T*EoTvZv0EC1Qv-g0{&7D%$FGLOYK?W>6dAOx1r_q9U|#rW|gk<6%dl zv?Y>3&O$Ril%TRMR*tAMUs;qW{Pp|r)sqAjSCq0$yX$7g*<+ahb>$o&*cLI{s5ckf zL zry7zvc*BnGE*{)+d>I=R9GcdPiN7Y%C`XEms#UO@=3WvZaFO@aGhJ0xwL5rY^dp5n zwB{iorfRE`z%>)H_JyIcgbcBhU{W7NI#|ujuiYL-#8-kYYqw_BHNN!&Hd~=M-ygAi zIUhMVA)c)350s9-8t>x{zPo>9;jC1U>I*MV&r0+z0r?d3&fH{FL73Bq;6{uHm5YQM z+2=X8vh)LTQi`!Q8x`toExby^o(u_UNJJ}8a6vygnEZju3*m8 z3MRT(muz1pNM~plbQUD1)K~>tnzE3FD(dBsELwdydPk3Xin!_=; zSyv|;9mbsyQ)|AyH~#H?qVVmqmyCEr)zxG0%R0ukU%Z2V%o=Th@~1O3UT{>ISM+??a#fbMK&x0}`M9wBMt{j_v#F!Fi}d}2%j zG1gn4lH>PQ{1#sKg^?ej|H0~YYEr?mth>AL(MG$IQuc_pA4{ZXF0LjDFG9DwKnEr{ zBV}@jg4MN+g06OZ-!N^%)f~nOC10NK`)E;p)MMr%c;(6*?ThbG-fq~MsSFjbdh+my znJQx?q=fwaYtYK(u^HTZe(_+B-C_>M3ObHtVk7bn%ihfY{oD12g2&fP$@|oQRU{J0 zg|&md6D9JiGUU%!i{~#St^B@LuyMz9^HK90jn9kOBF8NI$9jHx+VX|ui328m5*0go zSJ)Ibss)6dl|9PU$tZPU4Y#>rNxoOp+uH8h42*z#mq+WD;zHctxW>Rc03srz6=mcC zW;NbCOpzz`VP)E+{Ncp{L*~Udq=y=iwqHh3{H36mW?8 ztnl&(dU(3ln-{YhAcUE6l!F*+O zk3F(J-_v|Sk!=^*Wae`eqe*<0>G&d=Vg1YPqse3u{ezcHj*ukvHgp@c1N`{7-hFLB z+c3>@@W&Q8b3{31B0MGPupDL}@H%(&PL2`zHC*&um+sVCu)=n9Zu#Teed)C5!lm(Y zhW>=oIseZu`#lrp_+WFfdO8X>IVZgpWqHh&+7MJ4I1y>;;oz&Gcb)S;Z{1EBFh7;_ z#2R`e9Yh}MdpKpb={zDrtlk0Yc)EN*tJ@Sf%(x?vQC%*%B=CBHr#SgM(dgTE+1J7g zcVCT`C9N0RE%qwQQyvd5#Daiqwu%_E@6$d5-MY)^**i2w#vxy@+pfgM{Ezc#!nqH9|vhYOL8iN;~tXbhMd zL}W7cYoMtY96VM0TTCK43xaXqEP+T%0qeg?PfkLDLhBMObpB_nFnX+W@A*eWtt8}q zP-g+`v)6@eunx-E@%pcgPlMG?o$Lx{+%?IDJ13Pyo3CdV$G`0k5vWB*JY9Z5jwhv< z3~Ed#IvW3OqB3|Esq}fFYk`Y)Ll+_F(D3QT|Alb(CDZ!hW1G$D#%Z^@O=P6<*S{x+ zowJ(FYlUIli9F(U>`L;OKkOph3Lke25sBsrz?!T&=M92{LI{7iUx}$mYfInD1|%dQ zX9puR&RVJ4@Uii;w30-92d=v8&HBsp_szbWs#G1Lt*x;4(gfMSOFFPb@{Nsa6mpaK zYaGZ(fc8-N%M~mf5G5sowXCSd+Q81t6&#=ogyP4*kbI5yo=N29+<#&NIA|lF)0-mY z34JSH4t5$t7n_y7N#bVpxXIfEK0RasIiU(_bV3_k91st*F}L+E1%?Ujlr}RL56;j^ z=8|LhlZVgI743+f^-b|xP{aJ#2+^1mT(}bZ$IiRUWyO4Bx>E?8`?qaNCJ*j65rN5c zGrTrW1S3@*upx!Up$GAw@HG_kL zpO{hSqd(Wqx569NV(1^j*r%uFEZ_1yn8%$HW<*3qX1+C_cry4^R8SBs+mx3UE^0!H zT^mgBpN^)1un`0v<_BICqz1ey2oS+a03z78?KNBg-ax2}T9bMD9<#5@g_@ z8LF{mlY{^g4gd!M-K*@Q%)$c)D?pb!gtY$@?72Yz=_t8GI0ytL%?^M-PG~rU(6=I~ zKnaez7u*%p-M9%DP)i8tKMVj0QCNfnpppB`ORYbh7~i zv7_k)I14Q{3zYiEDd$i^BXU9jr!-+3{zESWz_-N<8C9^LL3Jb$w(A0hfB)a75tu@R zMdioy&Y)=GKO!Y!7J)oy$JpGU?~RQU>AaJVxFJ5IQE{jUA< z-!8v`%bMP0)>-KE_Y%SqQ6?GpqUy@4IszjIhagzU+%9G|Nmuw<5Cg-IB!sI?pErG< zBxM0Lb(Um>t97RR#l-~`UD0B|`e1^8df^`d%!L@3T+s1HE)1M-F5r}CE2XC?C8>j; zNNr<6Y6fuok)Yl^-R!&jQpz7|W_r2k4Cr5ExV`4eG%yt-#p5Tlgvm-f+D(4o7FwQ? z6XI%`T=RYGkWXfh5?WsKfAJ*>Ca`6IHyqF4e|zrLQe8bs0&p&3&($bG8aNza-ZcB& z*hoV`l9a%t$Icg9-~e|WFy~S>^Ld7V&9`X(tkuU zAYACY)1t_hJrQ79YUq4SuvkdgS*CewYWa-kaMkyFXx)xVWwl%MVL1z5i)~&}>=mm4 z4GD!4&=nJHy0Ssea#n>gnEVtMf3dWZzwR~LS8P~KZAaEot9hUrX>M@9&}0x_y~C^W z6W0i ze4mEn*M-tdNL|=ZL9txT;3lMRhoDMuM2sgj^I+1?82 z`mokTl$x5}wWE%Jqd6n*m)1olCi;+G7rM?z|DrX#!&w30XQn5zH?Xkjf&FaPTDDA$ z*<*1bDeyIQTcAi^jtqTspVWcy@xjJN;Y*pQB#M23=7#VJW1MqKN}1kRW9$$H>?_!9W>Z2T3PA z?lvlwis@y(U!Gr~@cu?#y66yYu#8iqY7nvd2~u01njYU)l`<5yuYJjZMjz?f$R33l zhmfK2$<9p;&WfALdj_+53IXx9?BrbgK&fNy*ZdHP_3mX`k(zB_pV{@5poqA#x!Kw{ zF<8_`3iyw7Mh_{_{7-6CZn31k(o>={rh3Fwb#7#f!o)mqX9BU_ z^Bn6Mi>1NwrA%;e`m`zx^EfPPhaW*a`FnV$J^C@!$Jp!tST^z+}BT=g{Vme_dNk5!e@1h^rFh@J22h`qA zWF4hX3cvBU|6_PZwmBTvRk!7W;h7pD1lG6HbzhoZ6-TWj*^t zXXmiiJ9$o2C#*UbKXz1ZCfTQnGDDZLBv4Hl(P2~5(yWenc668nC-pwKNX>@qP14dt zk5f3X`g~GsT7G&cneBkfFE$^Ec6hbR5o%Re=QqG~UEVyAYykWIAN~|XFq-Z;r$}K! z0hX-CNEn9Ir%3yn0_jb(iTo)OpJMNtDh?YW;4^GkUQjnJ{w+D-H(X#T{QrmIG7vr_ z=%Q}}UG&qd#HE0B7Vsh+`nP;zz+LuC*QgQ_K!t{X-fz4hck}pSm!S&i11|-Hk(E-C KtP=ke^uGXaQI!S& diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 6808d7a2dc..031081d39d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -19,7 +19,7 @@ Windows Firewall supports Internet Protocol security (IPsec), which you can use :::column-end::: :::column span="2"::: - :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." border="false"::: + :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." lightbox="images/windows-security.png" border="false"::: :::column-end::: :::row-end::: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 4add3bf791..a6b1ae1ed7 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -3,16 +3,16 @@ items: href: index.md - name: Configure and manage Windows Firewall items: - - name: Recommendations for configuring Windows Firewall + - name: Configure Windows Firewall href: best-practices-configuring.md - name: Configure with Microsoft Intune href: create-windows-firewall-rules-in-intune.md - name: Configure with group policy href: configure-rules-with-gpo.md - - name: Configure with the command line + - name: Configure with command line tools href: configure-with-command-line.md - - name: Configure the Windows Firewall log - href: configure-the-windows-firewall-log.md + - name: Configure logging + href: configure-logging.md - name: Hyper-V firewall href: hyper-v-firewall.md - name: Isolate Microsoft Store apps on your network From e0b56e18533b49455b72e3e1c84d03a33f0c4419 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 16 Nov 2023 09:17:24 -0800 Subject: [PATCH 165/237] Date refresh --- .../windows-autopatch-post-reg-readiness-checks.md | 2 +- ...ch-groups-windows-quality-update-trending-report.md | 2 +- .../operate/windows-autopatch-maintain-environment.md | 2 +- .../operate/windows-autopatch-support-request.md | 2 +- .../overview/windows-autopatch-privacy.md | 2 +- .../windows-autopatch-enrollment-support-request.md | 2 +- .../prepare/windows-autopatch-fix-issues.md | 2 +- .../prepare/windows-autopatch-prerequisites.md | 2 +- ...ws-autopatch-windows-update-unsupported-policies.md | 2 +- .../whats-new/windows-autopatch-whats-new-2023.md | 10 +++++++++- 10 files changed, 18 insertions(+), 10 deletions(-) diff --git a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md index eb2f5d26d5..e41d8e60f4 100644 --- a/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md +++ b/windows/deployment/windows-autopatch/deploy/windows-autopatch-post-reg-readiness-checks.md @@ -1,7 +1,7 @@ --- title: Post-device registration readiness checks description: This article details how post-device registration readiness checks are performed in Windows Autopatch -ms.date: 09/16/2022 +ms.date: 09/16/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md index e68ee4d6bd..71b96ec441 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-groups-windows-quality-update-trending-report.md @@ -1,7 +1,7 @@ --- title: Quality update trending report description: Provides a visual representation of the update status trend for all devices over the last 90 days with Autopatch groups. -ms.date: 05/01/2023 +ms.date: 09/01/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md index 3b72dc6d90..fe9d6b3321 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-maintain-environment.md @@ -1,7 +1,7 @@ --- title: Maintain the Windows Autopatch environment description: This article details how to maintain the Windows Autopatch environment -ms.date: 05/15/2023 +ms.date: 09/15/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md index 690e61a507..20c341551a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-support-request.md @@ -1,7 +1,7 @@ --- title: Submit a support request description: Details how to contact the Windows Autopatch Service Engineering Team and submit support requests -ms.date: 01/06/2023 +ms.date: 09/06/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md index 043db6fb77..0e481d7a66 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-privacy.md @@ -1,7 +1,7 @@ --- title: Privacy description: This article provides details about the data platform and privacy compliance for Autopatch -ms.date: 03/13/2023 +ms.date: 09/13/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: reference diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md index 6588ea5a13..bc26753af7 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-enrollment-support-request.md @@ -1,7 +1,7 @@ --- title: Submit a tenant enrollment support request description: This article details how to submit a tenant enrollment support request -ms.date: 01/13/2023 +ms.date: 09/13/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index 8acdf328e5..f7a2045294 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -1,7 +1,7 @@ --- title: Fix issues found by the Readiness assessment tool description: This article details how to fix issues found by the Readiness assessment tool. -ms.date: 01/12/2023 +ms.date: 09/12/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index b0df16842e..7cb1b4a4d5 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -1,7 +1,7 @@ --- title: Prerequisites description: This article details the prerequisites needed for Windows Autopatch -ms.date: 04/24/2023 +ms.date: 09/24/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md index 9ece385c03..e72d9e8042 100644 --- a/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md +++ b/windows/deployment/windows-autopatch/references/windows-autopatch-windows-update-unsupported-policies.md @@ -1,7 +1,7 @@ --- title: Windows update policies description: This article explains Windows update policies in Windows Autopatch -ms.date: 12/02/2022 +ms.date: 09/02/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 24650e3a33..1e7b26a9c9 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 10/27/2023 +ms.date: 11/16/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -21,6 +21,14 @@ This article lists new and updated feature releases, and service releases, with Minor corrections such as typos, style, or formatting issues aren't listed. +## November 2023 + +## November service release + +| Message center post number | Description | +| ----- | ----- | +| [MC689492](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Planned Maintenance: Service maintenance to improve Windows Autopatch performance | + ## October 2023 ### October feature releases or updates From 0952ffe054e202e96f17fefd4b56390e2baefc8b Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Thu, 16 Nov 2023 12:24:03 -0500 Subject: [PATCH 166/237] Update enhanced-phishing-protection.md --- .../enhanced-phishing-protection.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 313b641bca..33e3420817 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -19,7 +19,7 @@ If a user signs into Windows using a password, Enhanced Phishing Protection work - If users type their work or school password into a website or app that SmartScreen finds suspicious, Enhanced Phishing Protection can automatically collect information from that website or app to help identify security threats. For example, the content displayed, sounds played, and application memory. > [!NOTE] -> When a user signs-in to a device using a Windows Hello for Business PIN or biometric, Enhanced Phishing Protection does not alert the user or send events to Microsoft Defender for Endpoint. +> When a user signs-in to a device using a Windows Hello for Business PIN or biometric, Enhanced Phishing Protection does not alert the user or send events to [Microsoft Defender for Endpoint (MDE)](/microsoft-365/security/defender-endpoint/). ## Benefits of Enhanced Phishing Protection in Microsoft Defender SmartScreen @@ -91,13 +91,13 @@ By default, Enhanced Phishing Protection is deployed in audit mode, preventing n To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen settings. -| Setting | Recommendation | -|---------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Automatic Data Collection | **Enabled**: Turns on collection of additional content for security analysis from a suspicious website or app to improve Microsoft's threat intelligence | -| Service Enabled | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | -| Notify Malicious | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | -| Notify Password Reuse | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | -| Notify Unsafe App | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | +| Setting | Default Value | Recommendation | +|---------------------------|------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Automatic Data Collection | **Enabled** for domain joined devices or devices enrolled with MDM.
    **Disabled** for all other devices. | **Enabled**: Turns on collection of additional content for security analysis from a suspicious website or app to improve Microsoft's threat intelligence | +| Service Enabled | **Enabled** | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | +| Notify Malicious | **Disabled** for devices onboarded to MDE.
    **Enabled** for all other devices. | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | +| Notify Password Reuse | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | +| Notify Unsafe App | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) From 9644b61c4286f306b0328b5fb81e25d686ed9300 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 16 Nov 2023 10:30:29 -0800 Subject: [PATCH 167/237] update links that changed --- windows/whats-new/deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index db9fd0dbb9..7b811e9bf5 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| -| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/install-app-guard) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/protect-against-threats#safe-attachments-policies-in-microsoft-defender-for-office-365) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | +| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | | Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp. | November 2023 | | Tips | The Tips app is deprecated and will be removed in a future release of Windows. Content in the app will continue to be updated with information about new Windows features until the app is removed. | November 2023 | | Computer Browser | The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see [MS-BRWS Common Internet File System](/openspecs/windows_protocols/ms-brws/3cfbad92-09b3-4abc-808f-c6f6347d5677). | November 2023 | From 3225ca1fa97c3382fb5b7020af800fdddff2c184 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 14:44:21 -0500 Subject: [PATCH 168/237] updates --- .../windows-firewall/configure.md | 99 +++++++++--------- .../images/fw05-rulemerge.png | Bin 25314 -> 0 bytes .../network-security/windows-firewall/toc.yml | 2 +- 3 files changed, 48 insertions(+), 53 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/fw05-rulemerge.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 7fffb1630e..ad871bd902 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -1,22 +1,27 @@ --- title: Configure Windows Firewall -description: Learn about the available tools to configure Windows Firewall. +description: Learn about the available tools to configure Windows Firewall and best practices. ms.date: 11/15/2023 ms.topic: best-practice --- # Configure Windows Firewall +## Configuration tools + Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services: - [Windows Security](#windows-security) - [Control Panel](#control-panel) -- Microsoft Management Console (MMC) -- Command line tools +- [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) +- [Command line tools](#command-line-tools) + +> [!NOTE] +> To change the configuration of Windows Firewall, you must have administative rights on the device. :::row::: :::column span="4"::: - ### Windows Security + #### Windows Security :::column-end::: :::row-end::: :::row::: @@ -27,12 +32,12 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::column span="1"::: - :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/windows-security.png" border="false"::: + :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." lightbox="images/windows-security.png" border="false"::: :::column-end::: :::row-end::: :::row::: :::column span="4"::: - ### Control Panel + #### Control Panel :::column-end::: :::row-end::: :::row::: @@ -40,25 +45,25 @@ Windows offers different tools to view the status and configure Windows Firewall The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall. :::column-end::: :::column span="1"::: - :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/control-panel.png" border="false"::: + :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the Windows Defender Firewall control panel applet." lightbox="images/control-panel.png" border="false"::: :::column-end::: :::row-end::: :::row::: :::column span="4"::: - ### Microsoft Management Console (MMC) + #### Microsoft Management Console (MMC) :::column-end::: :::row-end::: :::row::: :::column span="3"::: - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced functionalities and is used in centralized group policy (GPO) management solutions to secure complex network traffic found in typical organization environments. + The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced configuration functionalities. It can be used locally and in centralized group policy (GPO) management solutions. :::column-end::: :::column span="1"::: - :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot showing the QR code to scan from your phone or tablet." lightbox="images/mmc-advanced-security.png" border="false"::: + :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/mmc-advanced-security.png" border="false"::: :::column-end::: :::row-end::: :::row::: :::column span="4"::: - ### Command line tools + #### Command line tools :::column-end::: :::row-end::: :::row::: @@ -67,12 +72,9 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::row-end::: -> [!NOTE] -> To change the configuration of Windows Firewall, you must have administative rights on the device. - ## Network profiles -Windows Firewall offers three network profiles: domain, private and public. +Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign Firewall rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. ### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network @@ -90,10 +92,10 @@ To view detailed settings for each profile, right-click the top-level **Windows ## Firewall rules -It's recommended to maintain the default Windows Firewall settings whenever possible. The settings are designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. - In many cases, a first step for administrators is to customize the firewall profiles using *rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. +It's recommended to maintain the default Windows Firewall settings whenever possible. The settings are designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. + > [!TIP] > Create your rules in all three profiles, but only enable the firewall rule group on the profiles that suit your scenarios. For example, if you are installing a sharing application that is only used on a private network, then it would be best to create firewall rules in all three profiles, but only enable the firewall rule group containing your rules on the private profile. @@ -117,16 +119,14 @@ A general security recommended practice when creating inbound rules is to be as > [!NOTE] > Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described. -## Create rules for new applications before first launch +## Create rules for new applications -### Inbound allow rules +When first installed, networked applications and services issue a *listen call* specifying the protocol/port information required for them to function properly. Sicne there's a default *block* action in Windows Firewall, you must create inbound exception rules to allow the traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. -When first installed, networked applications and services issue a listen call specifying the protocol/port information required for them to function properly. As there's a default block action in Windows Firewall, it's necessary to create inbound exception rules to allow this traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. +If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network: -If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network. - -- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic. -- If the user isn't a local admin, they won't be prompted. In most cases, block rules are created. +- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic +- If the user isn't a local admin, they won't be prompted. In most cases, block rules are created In either of these scenarios, once the rules are added, they must be deleted to generate the prompt again. If not, the traffic continues to be blocked. @@ -143,49 +143,45 @@ To determine why some applications are blocked from communicating in the network 1. A user with sufficient privileges receives a query notification advising them that the application needs to make a change to the firewall policy. Not fully understanding the prompt, the user cancels or dismisses the prompt 1. A user lacks sufficient privileges and is therefore not prompted to allow the application to make the appropriate policy changes -1. Local Policy Merge is disabled, preventing the application or network service from creating local rules +1. *Local Policy Merge* is disabled, preventing the application or network service from creating local rules -Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. +Creation of application rules at runtime can also be prohibited by administrators using the Settings app or policy settings. :::image type="content" alt-text="Windows Firewall prompt." source="images/fw04-userquery.png"::: -See also [Checklist: Creating Inbound Firewall Rules](checklist-creating-inbound-firewall-rules.md). - -## Establish local policy merge and application rules +## Local policy merge and application rules Firewall rules can be deployed: -1. Locally using the Firewall snap-in (**wf.msc**) -1. Locally using PowerShell -1. Remotely using Group Policy if the device is a member of an Active Directory Name or managed by Configuration Manager -1. Remotely, using a mobile device management (MDM) solution like Microsoft Intune +1. Locally using the [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) +1. Locally using [command line tools](#command-line-tools) +1. Remotely using group policy (GPO) settings if the device is a member of an Active Directory domain, or managed by Configuration Manager +1. Remotely using the [Firewall CSP](/windows/client-management/mdm/firewall-csp), with a mobile device management (MDM) solution like Microsoft Intune -Rule merging settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. +*Rule merging* settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. -The rule-merging settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from Group Policy. +The rule-merging settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from GPO or CSP. -![Customize settings.](images/fw05-rulemerge.png) +| | Path | +|--|--| +| **CSP** | Domain Profile: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/AllowLocalPolicyMerge`
    Private Profile`./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/AllowLocalPolicyMerge`
    Public Profile `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/AllowLocalPolicyMerge` | +| **GPO** | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Removable Data Drives** | -> [!TIP] -> In the firewall [configuration service provider](/windows/client-management/mdm/firewall-csp), the equivalent setting is *AllowLocalPolicyMerge*. This setting can be found under each respective profile node, *DomainProfile*, *PrivateProfile*, and *PublicProfile*. +Administrators may disable *LocalPolicyMerge* in high-security environments to maintain tighter control over endpoints. This setting can impact some applications and services that automatically generate a local firewall policy upon installation. -If merging of local policies is disabled, centralized deployment of rules is required for any app that needs inbound connectivity. +> [!IMPORTANT] +> If merging of local policies is disabled, centralized deployment of rules is required for any app that needs inbound connectivity. -Administrators may disable *LocalPolicyMerge* in high-security environments to maintain tighter control over endpoints. This setting can impact some applications and services that automatically generate a local firewall policy upon installation as discussed above. For these types of apps and services to work, admins should push rules centrally via group policy (GP), Mobile Device -Management (MDM), or both (for hybrid or co-management environments). - -[Firewall CSP](/windows/client-management/mdm/firewall-csp) and [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider) also have settings that can affect rule merging. - -As a best practice, it's important to list and log such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex or customer application deployments, a more thorough analysis may be needed using network packet capture tools. +As a best practice, it's important to list and log such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex deployments, a thorough analysis might be needed using network packet capture tools. In general, to maintain maximum security, admins should only deploy firewall exceptions for apps and services determined to serve legitimate purposes. > [!NOTE] -> The use of wildcard patterns, such as *C:\*\\teams.exe* is not supported in application rules. You can only create rules using the full path to the application(s). +> The use of wildcard patterns, such as `C:\*\teams.exe` isn't supported in application rules. You can only create rules using the full path to the application(s). -## Understand group policy processing +## Group policy processing -The Windows Firewall settings configured via group policy or CSP are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. +The Windows Firewall settings configured viaGPO or CSP are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: @@ -213,12 +209,11 @@ To avoid the issue, leave the policy `Computer Configuration > Administrative Te > > If there's a requirement to force registry deletion and rewrite, then disable background processing by checking the checkbox next to **Do not apply during periodic background processing**. -## Know how to use *shields up* mode for active attacks +## *Shields up* mode for active attacks -An important firewall feature you can use to mitigate damage during an active attack is the "shields up" mode. It's an informal term referring to an easy method a firewall administrator can use to temporarily increase security in the face of an active attack. +An important Windows Firewall feature you can use to mitigate damage during an active attack is the *shields up* mode. It's an informal term referring to an easy method a firewall administrator can use to temporarily increase security in the face of an active attack. -Shields up can be achieved by checking **Block all -incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or the legacy file *firewall.cpl*. +Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or . ![Incoming connections.](images/fw06-block.png) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/fw05-rulemerge.png b/windows/security/operating-system-security/network-security/windows-firewall/images/fw05-rulemerge.png deleted file mode 100644 index 74c49fab7b245e2f8adfa4eb9e8d96e88ce112df..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25314 zcmce-Q+Os{)IFG_la8HEI!4Fo*iOf`ZQDl2wr$()?%1|%+f(^{-^~AJp1GWh_jylM z9aNoDwfEXiC=UVxS_%9np}>GMnIU;Tz#piCya+!?)i}-( zZ~$#9s^$O!g3$Z<15Kntzy<-)4;B;rrRb`C*6CxbIhT0RPNIJrgA|VW;cEEXFUjy5 zJgKU#RG%?js2L_wVxEGGDb0(63+uZNUW{}T*SYRLPdrT6;`1}Te0#EqUxS;KEwJr3} z@3RG~^LRTWQ{8^vCd2b2c<+9Y>Eiv+zEP>!I^7w=uQ5M2XQq|0uJGkep$PCRK*{u>2spB6@1-VK&=MRL8TXq01}n3k>6Wk(R#a+q2}s)gwl zb@i3FSQuA1t1-4vtv+v{C(Be_=_ka*&KH7 z6qa-1%kP-Y?2j$KP`(PYCvr4!tp0>AuPIH#-5a=_l!oD-IHUN9d%rwdG$v!kb<6+H z>PhyOrgk*WHKpL@dHaR;TVwW6g{<-KTQb~H3+a}t&WxuVo=%1Ug_TjEf~f7rE0TBk z>bJk`#=NsAB!s&pg{Ve$>Zr_-vJHoAWoA*@iA!`6==!D=td{vxqE@ooVj=<(+pN>8;5AwU1Yjb&>0g}>BlnLY_|KXsiZSh`y%YbP*V`0#ag|AkClT$ zR4qR2jBBIfieN;6(N+ncq=8+$#W%663b_#ydGa#`7N6&w)zkS`L#V)ygfnF^eZ{Mwf3)8 zx+Pk|S-pz2V|X%$oK(7tQS#t5v$M%>DJq>{OPj>@+EHR{Hpc;bW~gsmJZ+{DIvhoN zaLw`!L_Fm7W zs@q8?FH1hEf^h@Es%=174PPOUq0PW^y?|GQ7J4i*aERj>wjiJ=ABGYNDd!ELfc#J8 z1ZD({9EN8A&1zf3NfS!}X6KZj;9*-}M4?W*YG#@!!U1X|xV zy+5tAeOir1Wd(N&SlR?>0v#>Qwjiw7n9kPAtpk?hs(|^yOFB5Dlo4T;=cRw?r*LT#GgZ_?*@|z7PQxH%j5Wis*J|0!I_eli6Y3PC3boJO~7X0J!b^q^D z%kAIbK}f0-FjGiSq!K#6%WGO91m#6YSwx_=8W?LG*92`?d5(#o5`(yLz zz^BXQA{5c*Bd~h?uCe=-HhRYAHt4;;{}!1!WrXJM;^)mv=B(Pq=xcKEyaCVE+Wk86 zaqaUur^EfY>Ho0mAY);1!rFBeX(M!WNBtavMSzy%hR25sHEINQ*ZnkRGtB;u|G{=Q zM5c3k>|W8@`qXw(C4s}`GV|r*qVgpB<93GX?(QxegW5Wp>vD)}L80DW9YPD3Oovpy zx8!cFZp)qGz3$XhiIat9TJ4UOs;a14@8=^EjE(Ns>|`39_uXM5cdb^>G3JE|bthJ4 zD(^~L8k@%P#?WSj2oYW@G1=Pd4XUsmm=#d8lmlHt8%j3zoyh<+77O z@%lSOUe0f@Of9mgWvyOnC)=}E8?QF3-cM9IPcRUF%T=nq@0UzYR6dqMU2g|_f2it+#KjgjFs43Z7SRFINePuU2RyTcguHVz}!3fJS(k=GVpN*{&u2Kif(*q zvT{x1b`no*X#Z!D&f0liYtR_KJ=N^w%g7__Xhxr?g%?+wA{1PNJZiNm#JlfdKvJUuiO%>2Kq> zBEwzms+E3wUTZdEuEw%#E78eak{lxtjO{tOicB}8uR^WUnpb43rb?1c_v#)ml2aE? zY>d=sH|x0<2ySAnUh14M&kaPt5A=85DN(6jdVhB2@znFL%q+XaVQ8Lsb#K?#o|i84 zM$1Q{1cwi-+YgL%%Ijx>T@X&FL=w{J?5+@P)Fy4}w=)BGR5rUGsZ+Tt8oDDLXW>!m zZ#3>12_BVZ=ln?+5^BOYX84l2psjntQK93`UNLQA^$cB_eSmNja8Nx9}&bOjGznr8&P?ZuT z40rgMV2qb%ZApPvHq!IBHZ|C&gOdr>`}U$*d+j=Aa(1@X`p%&`tp4tfdxHDmEyyN~%Y`0OgokUgEbM@(#&#LuH;m^LT z<&Ly9t{RIQb4nBK6Zb*O+&Qdr=XN=>vQn^5*Snah&>qb7S-a_mt0S)c=5iE6x;vDbSg8WkSCL&3Vx2k&a zdY#=hwQotIa;sVjN`b87F$}XV~SB+0~WaMzA0;sGqk3VKK;$@@J!e6TH0)CCVIVaeg@5 z>??q0JhV=XW%GWtP55NJ=Nr$qxXLfx{iQ~{qFovLf_SCG&x0JDxie#N*M?vx=*H~C z-Do#~2NUq3?Pa~Av*=Q*Zh-R78m4;v<}xiZ9c9Eh6U7}7_rwO>&6KgwiI(ghT4LAT zXlB6~sL%Kz-_$XxFZ3lokY(-XvXuz6jFNnAX1y|Jee##<$ido{ZAxN?c~8a>-5 z=X~3@5Z7^%Y4UB-XbDnw$;9hB%hb*dc;%x+bIOX<24iWS#QO3lW8@7d+Hb!ZuC6&_ zYlE9YXhELQnGm>wmD2vru}U->AGH4c?lkqo#oyj7*zT&w#_G1c6N-a}eGud(?g(zwOy|zk8-~U$)pt%pGT^+u z6mCYgiUny(1N~2BBSficeAVM*&N3Gp_UZ5Ki6-VuAJ%Wnjk+)oleItgk{;O4w^q7e zS6sYrR$SI|En~?1lWBdPm+%k9boiXE8gKTsB(^SZV0k{CCKUdOj+NB1?i|EhzSO8f zrHgfV9!446AB+q5)Lt!a@OVlRi_g>Oo2iY@rYe}=!g+Wpto5IrTBN(YzYQLz##@dV zls}xxVZc09(-f%gg;<^nSCmQF^I&hgmvY$XN2Q9iMHCxV@BF*YV?XG(&Ey7^2Tq&j|vIwm~JGAFl zpWCyQU5`!Mr(8-h`P!BZuQY$%gE*XqxbCzdB_#!mh~s+akI0*s5EHgtuCkO(qj^aN zdobf%g9d757qh){QvH#UCT9?B>Sc6OHFkP5P%>`rt+z%oFk-9Yaf{IOT+2)(uHNox zrE4gR)`}hcz_ui0m8QLEh3BzV+r6V@Gw=`S)CW z37>O^?0o!5Sp?U$-xE5VK0I3NLxv1!;0I$KyjWIRb-V5l%5GC}Rl8l!hZe($sI=hj zG(CodZ*JBEzTK6%_;9QjPq6qt7~AZwv=GlMV~1r|Uzh`gJzSL{O<6nsIak<)_$`{djACf@{#rW8j;VI=q+Qm3}zh5+n z9vK;!d#tOywBUTpyu~wEEPjnJX4b0ysfRpoP(Dmq^<1omfaAx)6P<4J(}kyGNuYUb z3irpYf!P!1uQm=z3}I8L$#(me3PzmaPy86^d*W$p(YLMJNa)WE01#&3KVCRLU9>a} za_DgYFt~~Oh-63iDBTMM)D|bY?0a@PNlGLJ%>+OaAHgPoIKQs?(cuHw%n&TZpX5gX z2++tEm7EO$0Dqm1-$*y}gPuP7mHxBWr!SUU)&23Y+IFV{BgF5Lh_(#zi4^&AEWybQ z97<0v-p?<>BK&E-QvivAfHevNheuN^ zK8=D92A}}QlK_{+m>{t+r~ocHgNujz*BhL{Z_lmsB>ntmTbB)cLaQcS>b!Vg9NQE< z_Ds}9o{R1g_on9fj~Yw#xi|9&FG?=`yS_aD8;8Cf-Tszj{=O3z$XP7P2*V(ZdRm0h zIzF$>>a`Y0;6tUMm6i4QWOdmsL}5p_w1E{ZJ+oe#D)|%Z;wQ^*ik$e+t4l#rMidI? z$+Vsdo3L*~Fln|B%;S3Ua`spn%kqp2tE1BWY8v;|sc5jQwRHnmO@!>s3^QM-dnyrP zTMUcaZ!3%?N$Y*y42`;`VGz@X1k2hvak4A&E_D8`xEy_SjERT%*E5zj z9X`j%A|J2mID+SQy?6*{s!JGXd%&6#kYLP`)I7nyv8Z|%U{)hs-%4$K<7iJT zQd*YdF+Ihd$Rh>m7Bz=Pco5Q^AR8|wj3d|Z&|CbIM&YNTW*)nsn*rpQHOw^u zb>)=IS8*z|VhQRXx40RLrXou1*%0a zId{E;`Cv|>idvx;1Ucl=o`p(RQ*kNuWdo)x-+Qvs?WmvTV=O137xzpmDoLX>n_K)p z;vJ(vq-m(%T%qk^;{GfOO1QT)CW-4p3sfG8lEv@c z-h!N*V(uJ>FtKpY_J=3OuHQ{HT?J$WhT07qHqeubK)P*>3L!?3j>VBJ3>n8HWEv3o)v$xT#KUkmjs4D@_M9xq8~4b)3j+=^Kg?UIZ1z~ z_2bIag$&~?6BrZCw~`*lR6SBNs}=jv9@&^-xI3ixnd{OT!V$*F^}py%{nIBL^H4L2 z7f88`MA5X$T^biNOE+T}y)BiFUK~YDE=n`TxF89^Tu^ybsqj2fwyCp>Ua;%CEE%N01&OP}rUlD1px z#;ivg8HbV87@8cjoF4)@TL{QGx3&l5xe08denit${C{r+U1J8=`j^!W3o9hQp5r?q zT+@C$8pcVF=JH@t@yEuFzH2Mc;~e82qLZalz)fQqthkbS6-u-86^Rfj4{>F2bS&q2 zA?L<+Y3@}JV(%jF8KGHI^%DyUM!Y-6;!jRmwu=fq|E;SqKl9X69!g_UcO&3*`fB2l z%6yGV>XpX&?F5z~nk_R6hV=;YID$wJF2Yt(OPoVwL`gtEfZ`gyx?^a9CWk^8hSBu2 zXeg(3bUxi$vJobsSF-x_IfsVF+)|3)IJ5uc-;Tce$mzoG5e6aqM=imoD`_M9E7Ria zFVhNWx6ix3{jXC~R+8Aw!l#(XtYqZ<~upc?WUHOwMH)b9fF@H^7$4+>JiJ3l!bsn_Nh|4#?ZuAdCTqTdTu)j zH1%y7Lw!$&3qmqt7>T4SRMkB}dD)4=sg@;9M4r(gRMF9kR)%rFbSn%}Wnr@J#Ft%D zIfFI)#0X3e4MiVe$LYi__&jj(U@6CWUGm1%tpnfpd5!l6SN&@C-!KaVg+;z!ymPO^qlCj zMKUuT=P|n$gbai+$rI5_F^ywSy?3X-J{cg0TRo1Dubx4)(OK-0j!PGv-TXSy9kNtv z{5=@C#NqF77v>l+FaXR*tMgp%N8C{E&IqwuXf{kn1x*|m8#xaD#kRlx)-ZL$5-~MI z0HnJWslRcOQYC1DED|Gquh`g1j}!c)fk{xLy(N z=f-GH^yP7}m3YMr0#AhRl}+qdYZ?0yCPU)3veFzTSog?(s5|*rsM~ITy`|G$&@`l5 zPGCT*YSOefAk>GZh&HasAK}>rc+2%jAZe9nIVLnu;l{36jw_^za2c^Au_}TG1oFg5 z{r(vz;F&j>m{f4z|8!a$*sWMxwkBM4a-GVW8G{-{TBDr@aaa};s#;}bpk^Ih%_=Jc9LKMC$_A3w`K?=D zoDwGn)A`*;(T#rdG7iYZC8b`?CZ#hb?fe1U#wF+E;z*}B)xs1NCnJJ_Z?^fx0bI|f z;u>I0qhjqxiQIOHH}m(zjZ-9nOPP-}(l@|6JsmZk4om-r?Si^Lfr=cg+fR8ZAnrHW|j*i_F9*kg<-mgv&q;pK? z^;#-x-yiSBmkl7nkS;Sp?(uJN>Crw3AYMQH6Ma_JFKuQDZvnc5K>DK+m7E3Pc>rQ+ zhPNpO4vauoB5zbEX|WIa8TO-fHBYF^HNb! ziS<{!*l=Ez_p?rMsAcsV>)hsoTfPv{b%6DXozKVq1Tf^_;)9S@-}gHgmd|-?Z#uUx z;Xh9U9Bd+$3gF1yniXsCL+*HNPdc}+o5V)e-uHfdkpkw-A@EO!+YM0T=eLRa!rzJc zZ(f`I9(_jDt1rkY&ShCt2t91ToxBprioA5qSdn;#1WA6*Qi(TMOLf(=7dR|%)sswC zTN*b&3%$=%iMGb02qS<$|E3{l%Mc0`A_g@{=uBm1(M!> zkZhOuQmFUWDAH%wd|DCgKu2@~&U6`7puM)Yj@7XueQVpR<|4_jaDVacdEh zOBOdo#_uggD{lQQO>vfO5*nQEj{w-6md`s0VjrfUQMlUjs2}D2`|fG|>qm$2`N17^ zb^c3yM|6`<#4~9r)2@^d>`JnFh=iSHj`aI!eR`JXP9&MekGHpB?8dtNpgWUv@u#IO zWVPw^z?VSiPcD{HGH3IkrTbysLpdIUTAf%xtl(~lH6gm4tSH%LrPuk~FkO9TDl}6@ zaIqfwS)(9iHmXe60!(B|y(L!tj!^PzzGXr|v>63Gg};;tk-fPalXo5a(8k>rpUBcu(c>dF zQHi|33mZ9cozmJAwHKm1Nc~`TNPjbX?=NP8^vKy!^jLbTj<#Ws(NDhj72F@D%IOKG2dDJ zY{bynTFu*D!=k(*EAkp!qIQL{1I_FZ_;zGF!H-=&Uf&qhFx=_d%(-%Db}5qMe&9Cq zJ`o50!b7o%=Edyp6qwIGb)Fw|s9D0#RD`uEPgTSa$uf#16L#jQKYpYzCfnFs9AvrQ zHI@I#kd>qZC%pC87$p%0(C?tcvKx)(S@x;8?)nGd;my}4#Ocz)F2fQ-ks~Vfv0twF z1{3JMA9)B{edj&5#A9yP8q9|fMKOuRH!nJz7f;r2U}cvd$(+EsKx?w%q#>#nb8RK~ zg$S6AC1}?+9#!X)H(53bq1Kk??O@wMa8M+2Y(M^a$Pr^jC#q@hl9{$h?wMc$)wT8C zP6V42pw$;-SF!DKwCO9A857}jhRZx^q z68yJJPVYerBtD4nf1l%GG?oJp3xR-hY2jz!T1;5;E=sRZqWwvJZi@akoeQ$0K4Zws zN;l9C-v@PTy_DK8uM zB*W_P4~<;L9s!m#^F1jBdc3T`No#~EgDN$C=>FEN%_1pi(wuVs9C!9|g@)g}tMBFWL8Zya>sYtlWlQmO>F+vX&)0 z!K%j$iZ#a!F^*6QvBFNua>UEjgZT9!WF@gu68rGY7#6a`wmyg2VKq zv;_981D{P|XuTfP8GM+`9AS#0;htlFp*19&Uu$+{av#NRzA==S z7nO~to5{WE_w_9P1RkX~g02L~Id!ZiB7qg=D54fs-`aq)t%W!#w6Qm^cAPdIzF=zF zg>vrSQRxF>5R{{NPymWCX^2H@D7*=_nXt~GBqPVHZj%!Nx$@mu3cE?Jk^U45g*NtY zB?zzCW?n|_-mk%!J^~JA)BL0J3Sow%MM-w{>bNGU{Ps;Z7YkcSi{4$CB-xClnriH| zel>mx-eDYhNM9zn+bng;&1W*2)3H}cmtoAqhS_=2h8`2%M;&-B>Z*pA*~_mOb#^w7 zZWUX^mR`g3w*fRS0HAr(W(EGK`8sXIk!9$T&8-dU?edf^Y#|WLL-gW861ci1Q~Yd` z1{Hzu6wi1&7UJj>qvg2dGovBAun0rJ4kj~Jrv@cG27eKs9nm$YT6I(0%t7OC48v$n zY4XC@kAf`sg)@!RZQ9cc+6*3KqoujIxoF6|nZ|Nkc^yemW?yv<&xZYGIUoy^l*ikC zs4XocRZt%OU}rmvgr_u-Dea+`Bql4rRR}SDQS2x#cHrX5`T13Ci_8f%QPTE07Zv6$ zCquaSj`>NeY#w{`bU%oWVw!BeQPJeEmNU~uTA=iO$GiVmk3M82jVux4WE`II1586; zj|-k9W=!aIOa{?ypP*k%c6Qgsy+wYfEk+xT+179PcB*}ChsNccjZ{0I>b3ERUUp{2 zBvGM-2bRF2HA%|V-G-`koiq+EnV5ZJr3RR6u5Wlb(>=1gEdxru6@zPik>tijEx9Ct|rTx zes&IUm}fQD-BBqCPJDxE9hF5D;_%k%^$uZDn|njj2woDbU^SewPWp4u{3|fha7VOp zG4tErPvYdi92OqaattixX-q|eL#sS#HTh#Q5>5sCUC*GGL{i>fvIK?*da@NxZLvja z`c5Tfv)%}ojEn!&gwg34gB02%Lkd;ak={13$|I}XXYt)(56wW%xJq!b^8)= zC1ldr=li7V+k9{4lpD>)53WfO?G)VV|Ke0p{F#Sg;eH}4*QnjzQql2R??k3)z8(G% zQ^j#tld`fgGg;=4=Z~JbrV*MnCzDgd9)pX>5>lbQp`31^`L$exW$H$(>{X~y;>%ob z7cIOp``47>w^e_8mk*V&zwH1=x0wdB=MTXrtndl%$b)=GJZ({Zv~jfout-1`485uv z^=ACqLOq3;>fnl}d-w_cW~()tSFynzh*{iPZho__5`Ly>6~Wf$`k1}2o8b3bS=QxE zu%7+-?ocji5cXT()78$^n_HbUJN4%K&Q|-|XCO3BqM+Sa1qU4l*ftRU5v6{xX*RnE zP;k;JUS#+h0a7F=R}4sI`~8)gC#$Xg_W4W}EV_R#U70JcE*#OnlWapZ(wErrbw>jVRJ_u}OnW580D$xex>HT#={ZQ0CuVoz)V}K1YvvxF(i+Xr&cajA= z9%STVKIoy-b~LUjegrzgrz?$gNr><@Jw5$p8WuNK=HUjz{OhL@YY~-P0*47m zC^>YuITeG1x3Zs0C*!A{`R@TM zwhrjOZi9Xl0O19AGLS2`^@1D$@NEa7FWVu!h$ujpLeT)gWb+vz33xJBKHsbv#cq!W zYeeE-;GZ!Gc+!7Cjc#P{*5~?ff`ZQW;qe7P0f>A@S5OO}$6*-| zyPDV0Tx8&7YlC`3g)|vh#%@sY@Ud_5{iU$s{B+nl+!6P-dhdP3=iC7_*arjk*(Qj! zz)l+vS-9mJv89T(OhmA~KcB6TUnfT0*$S03E|_v+W06RKo%w3Ogv92uyBRCd_T%-! z;rYv^(jK^Hxc_pCKS~}NTlt2x(bW1vC9c<7E|i5y7POL8 z2)*POvLpGq_35a)KS>Q!)8HdT?78Co&#CIf=IkuNgo@kF{k`%Pnc1+hTbg6zAJ!5^ zF{E#uzaTzl`r(2^zQ6EX3>WKeWm>2hYj4F~PRDju8!A_IqRQ2%KI41c#x|Cp{nck) zye-dWwaE(J#t~$0YA7_89zl%H_wTqIl@w9%&*!?7s!d8E&&e;9_9BjmI8~uMF*SFM zsElrkBooXjm~L$Uk*8o}X{M@?AzsKCa2rYoz18P7L4dtU(k|*Mg({u;<3$K z-q{S3yB-bx?QDOvsFr6|h+uj>s~7u)_OWD=oyqI-zTFq@zH=nQA&URRO7wA}Z~gKK z9zs>pZ}U>v*2SQw4HYca1Jaw4?()tmr?Qg0YMAszV~6?+gB*@IDhLrS7ZNEdMVKK6 z5exO(j*#A>c}n&%0jDguwW%!3wuH%qW{0b5^x(%mPM7P|=#m61wzca^Vy6dUmX+#D z3Chne%uNiK<%ofM(7&1JK6W-OY7D$`q0bp@_C(7)7?h zQs~VOexzke-gwG>{ikSRLP>cevNke3J!F&s&QR9hN0gbSM-e|>V7NC_)T?&1{3D5-uYVK_%U__4mC9xdjA7?>?Ty3O{#beq<#Gsf!$rUsgp zV&sqo;q>Ap@5N%1zJ^I!@G6E{*sJJgqzZxIi z!mBz7lLQsBS$Gd;bXr=pR2{!hM_VCUM)BOn$_gn5;E2H&C`2Ah%5da71?;sYDP5 zjyqP82RV%~gkBby7)r8DADmq=&5!!G*st$lmvw3qC&ux^dfuAEAH9(d9t4(hzzk2~c37 zCqsv~P=!HgNE*%5+4DxBXmPIT`*IX9@0Q%Hfr3~5ZJKfT(IRBdJji-=Up_`ltBa(d zMk1KRa}86_vX3~0rs0ax;5Mlx)zJ(rYg>xLK8aRuB-_r7Q6CT2lMm1JP6&2<=wl?v z#!ZqR2@(F{Oibv52{~3_(cM>Hn@#2zXNZ(}hLoK|ns2#9?U=An(EJl)9s)uPWx}kl zg)+tb1avwv8Ok_tYq50af5U9Nt^SfgBB$~L%hKuKv|Hqy!Ah>?@D^_eWAHeBEZd8O z5G}5t>+&2KhwCiLR_o)Ome(h(cNn>jUs2b%Q^~Umbe6fyx)$0h&FPX>Ru4>RK%?Vg z0^XMrX|VP45q$Hmx5)V7L_Ri;=Uwb(R!(h1XzuSuGEtONZV95pM%^oF`GXVQj`GAV z+ic-n^mR9wVKv2>m~jnCJJ42IF|hTwUOT(dyKP(1+pBbDzN*QJQHvq0FnY?=b4SXm z5CA;|;^%(9H3XJ+V1b31s-3lnhFmQby4P@@^uv+6*5P-b##3PUyj8^fBY$j{Ny3-( z?ExVX4*Paf{&L?2s71-x^0`Y?At_ICDytbWb8LpY!Vbr|tN8SQCbmlPIKA0D%qFSW zbKSBjkYRe}^l#KpA)5}si&sV_JL-hODiN*3YHLMOd;HV?7qC!WNaVU+H5O~!T`3^B zz%c<564?8Pca1pT=D>>5HdG2I*qn&&c<JC8XLXe~(WS4}o zKy{(36)HvA-{Y8lC@SbR6Jkh2yR?n%iU(<8BLA5~zJ~ZGd-49(xj0tiO97$}@uy5y zfg^HR{ju|D8QXPCM#U8u67alRQBW3^dd`?zrzxWMrPk=_q>~u=_VF1_{@r#|K5wih zO}*!=qC-XOb-ppviED6)U&45DWm&#UMBTxCW}A;;ooT|H84Fm53CabNZri#V(sNBq z@xx8^@NkdlSs0+`ou{aAMzJgzL+6YI=GE1ML}7&VHsHJY&1u3eO zlRR;OvQ;T&7(>EK{T28|p3)oEsGkpI;(5pwx6x;&m)bq%QW|~lALGoIiuzz5B+MmR zmuy0>4kLTVm<6oYiNAshmL-)|rppNu(uL|RmtCn@uHmwA0NK+@=d~f{-7ihQ#D^K4 zvJo_O#X_ne#a|LG7LMaw!fKJ8sS1yvw(@@{ogPQ^XwxIc=mk{$`+Rgbr-vk&!W7%o z;jnl)c8#3W&LkydY^V|P!^G-H)S=y|p*t-4fzV^F*P~n(5^coh-us&|*2LuXR;=LI z5WQJOuh~peG7-`ZQ@XQ$9ufV-?4DZ|1o`h7SQls>n3D@B6h8_Omt?b3kd8ZGm;;Na ziz(oWf`WqN(V%3C)f~ODh?=P>11}2{JjAx@co2ky8HhTrF3e+D$aTgesjYT0Z}+&C z&>WUQ^Qhah0&eUEs|~D(le(;^r)7-c+w9WGIUxE_uFuS{3vqLcPwUHZyLLyXVe~|(}kw=HpV-Y0sQ+J(GdhR0O;ZoX_ zcUNn08ea{^NxL#ACh}hCSO9W|#+FqetPJALDa~4$@Ocf6s%un@h+amTp&Z`2*WIXf z3b(D3F+8ng%Wv^Ero{8QGYs2_r}S}^8I*R1;G+t~qJ5i0d`FPO0-Beu;-ig{In2zL0S1DTcB$V}@jSAC_H)kh@69 zrr6l-@>mSa{Z&8{&0wI~vw6@^?PAopWsMwEy?JfKWTL78ZEX8)@IEws@_wqS+5NH$ ztNYljaH`t+le$gB(h)~Z6Dsq=!3Cwc#b zb|4j(5J)^#akMTTGe1FG5FH63Ig-kXER;7{uN~vXj!<{5!onF!w7D+y=zpU%{4#_f z?9Z3_KT-F|hG(%P%dh`Zc8X+v&k_{04|~<)zuaxUdCwkmD~N)BT3uVO8hry_eE{Pi zk$*xMirYyHAWlUG0MGny4EnEtZI%bhN&JXjpV=-yzPC1~5eq$>?_WN{ZZrvyC*9iJ zNkpKD@@JDUGI|7{i9R6uN0&f&1FXOKXRnp6C_A4cBmw3BpQ>-NOEqqbMdWw<7sYD_ zP8t)`*zXN@2(I!LL)+2ON&@H)8w?Gyy8GQdrxeN$k>~Nx3Y#iGDx8N!fPaei`Etae zW?h_|ltL-!zI^67DEUDa#3=u7MZa(Mr<7`Pl81##n3Ho}+Gej?iODks$k&2^jSjG- zNEWoU_goFx_jTs^TTbE9`|$DoZ=lYB{$HR@!UqQjY^7(gW`0>SoyeOY?=+7f3FOxv}yj&LasefD?(*~A?NcyLFG&rW@ z=8ng6(>3Vpt%*Mu2{B0bT=)~ajHf6s%Gjniv?vuaa-eeBuNV7DxBn3^Z&;?4fV2N%g72A zSk_e*(m(JO%O6F3haQp)Q0Q5%`vHAnC`ZG^_!-teLdM3vz1rkPH%mq#1d;7#`-c`S z%4)1kHc%vIh&S49c`*yCs?6hGl#C&@uj4Mvwa1D&w|20 zniNqBUd|gOCf4@i?-vuSu6HR+h*G#clG7?JkHoNK{emru-9pXLS#MQp2wm z{9}MM{tSpO@zl^qVALpMkX5M)>n|9)xd__G@u@9MU0)=>LH?WIc{zQ3y1}5O%uj|p z{Et64;LF}72>e@mC7ngwC|_qZ40R;HGK;ZAQh@~msO3s;&0zfhOASE$n=wPz$}S$X z3Ku8jI-1p%Z>fkDKob{q-GNRUTpGk$%C+iwkB^61A0+!YzZwPnnK1_LB^Uc{wi z7NH0Di&QnAVr4nz-smU2Y@5Fg_~BBpuM_3S{7PU;HSwN+v1b5#QSchc&^bzb zZ%A9VJ7O<;mnEx=-;?t`uhY*`cI!R(6F~!-y$VHFiXHG5`F(u>Xbkn?eF03EH=5waE#2(EX)cKcFAr6??gffS zeI$>S(|W$Ea}bU4s@__O0|Y$RJu4VF*3~xqGcU)p0GOpO!F_(G?wL3ofrE_AlV$i~ zNJ8iE&Fg;{nr-Ds34fLoQJn>0)6{90Ld5VWx^FDU3^7$`jUd>1V2z)9?Oh5DQ0*sx z&FBQGJ$^4EK|r#g(`ru=6VzjhR6+qZa=ueoUtJyO zvX1c>wn)Zzce6isBgWJVPzt_$1W-9N2m$H3!~k_24Q`v+E7F3b)dPO%88^(au;TTE z3~YOo`rP(*8SeXXz?4gKKLYu`TlYfze_f%S0<;G}X>8}{7!m?roq!ymO#HVg7NG&k z1Ov49SN9-4uxF1?7Vz9(`xI(W0l^9_K(=_t25JIMJO_x+{?GouuqWI`ohH8j_V~Gq z>rUkfx$Rl4wKZSD8nCZ%_9sB+r#Vr71-2$`#_@rk_^WH3@@zSpfq!20^(6xjgHk97=O#oX z1pMh=Qr|YV#drTZpj`O5n>>?{7#I>f9l#ScZ;&T|w-zVcG{ed8VwukI5qgeyMwhQ2 ztgkOzL4f{@P&XkyF)?Ptaq3aTby`--+hfykAE%%O?LMTT?;lNqO(&dLdRQS2YoDFn zBXPO^p^$eLg}tRW%^T4@8>b?6H-wc0nNBy~fuQz{Yh^(agzP|}JH18`aXZEJK zx{P%yUT6TEx}g6`D=uNuX|$yV%`KKjnfnoik2k@ml*+FTxy9QddX}Uo;o)U$_anE7 zCu58>d#&MYH)&TiUjSzpSsa7uX*drnhKaq1b)E)w>X8MR55CN4N;$N3p1gwd_jRjf zJX#pv9}}==Iwgn+S_Gl2Mf(@mfA_y@h4Vc4J4@n*S|Wt|X(D+90$qU-+4=qq-2Fm7 zIxOP*ZeCPQ!W$RvQ7mH|8-y28g(WlS^ecJ6*}*Y4dNDrV9$v1x@0kCA`oQ;vUJ!tu zM4Ki!hJX+TmzNp)$YcL8zVbC~z?6T2>$Z0s8vOvD$&v$e?P!15I*R6YigAE5u)%7e z-XeiT+Ia(o5gZ`Rq>;$?Im8k#SQ*n#ZKNCx4`HObl3$XZh`0WuF$iRhPW+8b_*MM( zI)7HKEHZkv{?2(xGQtN(1HLmwU*BpcJGB8+OfgCft+*ep7M2gxBOD;)UjTv!$!|H- z{~H)oBk&sek;!(y?6H2~g@XG}`yx&tyK#4*Lz&Cj_TT5a2|arujf3z?KnLtA0MM@A ze>o}WwX-(T7i=tm*?9jANc?Y=-%o0>@>>{6$p3lAE1gF=ZcLji{qlk}*97-ta4But zLNk$J_Yi~pmRlP_BOU)&K(24R+5JBE94}hG@bHD?e;AMHjh2JJLXyD}u!%(7&XX$X zo(AsopwM&{CC{douPVAdb%n64XZAvXRgX{MH8`=Nw~Dqw(8Up8Cla*0L>B}EqqpH#DALez$K%AdV{yK z?dI__{Q>XiHq#i52L);?*B;*3v)enS5BFRz=spqkT&q%U=5KZ7o#gMo)ieW@hW*V2(h@s?lz_R0FaJ4Qz*smr7w1^@X z#2%}$G5l@SRE0G61$vWdtI+eUK>tXrr!?<*c1MAaFke!!*?MlA=l|;LE5o8{+qD5j z2?eBv?v_$YB&55$TR^&pMoMWUB&4NFX{15AyM-a889+jM-}Aih_kMdH$NshXyJqfn zuXV82b)9jYLu+%JYE2&JBWKh@TVEx3cbonH8q7-#%Ll%&yB+J2gf*mE8~I@sR#}Fg z)VZ_|RsD5IQb}awPyUo!7cH$6nSNEy*L!W23J8X4a9{pTKQr#K#G-TLPDW6C?2WJH- zQOFBTl+Q1a$e7T~AYADBPNAj09&`7zaSAw@1fbUroQ$wo&# z$12Tw;N`eXjD(9bm(nAWhM#S;_UpGQ-vb-+zdst0Ns$&U<#Ufdkg}hp7vRI6PSw#+ z_$kKlem#VdpUqF|y+?cKl2IngfKC)1PnLdd^=Q-rx6c_ZOGy0U+~!*W$Mt`;pU$qN z^a=%0pM)*M{c0##CQ(d^m<7SegDEEuH+SM!5zp7dU-!flmFl9Q6WSXV>QNqA)3Noy zzary=7Mz!L!tLdgQPVD($SpPFo6{#_8Ngw`N+0@1G$o`jUChFePV4*P!mDCZ24+6u z1wtMiv@@(DA+IjJKt-Y&oa!%%v`$ru>h?C-&=5=NXhWCjWui*?YOk+Zehp6QSPsAY zvrmB7QM_PDvlI35S>0K|%rB3r8TM21;^C*$c9K%2cK9bM#-MeY7Ny8UIq~II z(1196KL4U3keT%JZGkJx#k+X%#5a^)B#*s#iw>A%iY0wt!X{;{ZNE(o>Cg}u!WQuh zpfx|{Bw}(1(B!uNrH`GDHoF$&z_LH#)~!jThK!9oJx)T7!B z4-faCaCBHKGG2ZpIa=0i7pb11ZI|;Xt$C-wM^uhOP`67`6oFEBGP}W z(qgmomTUtysWHXEp-RFyp(}ogT;kFlPvR#O_Fmct|HI?Q%uhc2ZTg$7V}Nh__Q0HV zLO?7(h$&r>bt=e+?J3a+vAQE*jbMYYNXx zwWqOz52ptYjZ1!vnPop^aYLC?{)>`bT9_?_DTHTQt97K_SFwH*`) zJ@ql)&HNzrZhTr6pE$S9j@%OOg%PAweMl*+O5F^2&n*M+LdUiI?WGx|$NN5};tEg$ zKIJVr7Xkd)rh5`n2Jv|}(`e*y7pvt*>-SQNLtH->z%?COCC1rHn17Y6DB^XhR(do) z-tqR^l^PV!v^4kxi&Hw8weiDhV#;Eu64D|%hr$3B=l9TfwVlHE2NJ`3TEl{PHj%R3 zSqu(np7RBdE+|iNmH92k>8B-n{UM9=Nu5O7PVz`;+Ku#@%O0+N_Z=q_=Q5;i7awfa zXp$cZy+kp?pvu0*2`dRROLoIl`B<EM_m4e@`tLGLy^%+xdI z8Drpg@;SWEq0Ih`5?$^bfbrUHp|?XTn^$Vjh*aw!Dr2T@r6TaRHzVrf#i2C6Id7OH zZ%LYeVr%RNFL@My45DA!A+|$pu<}aRj=ess#4Sy-DcGY?M^ru-y+ebd;k-?UrQ5tA z(v<%E!9zU(8(TXU-EySpsg(XD;{Ec8LtYBYwfgy)1MJh8lzOogyMdO}pz7d1aEEMI z$j_SGkev|^d&jV6{s}QvvLPi4Wql*4a{5qGp*el_RuKgsdo*R;3w-OL$_J970?aym zITcs0lP@rTQDs;7ai4yJ&f(-C&2HySFE^|>5?L5^i{_@zGedWu9wrNOnmdX&o8UZ{dtJY$S}Ukt2zHErTPxi*hL4z zmAt{cz8Tc2?}O14={Ij9N9vqo$eAz}WIGzigQsWtn~k?0A)_ATnmT<9)?aFp;wV2K zL2X-KNrV3_>(D-~yY{&(sbpHEcPz-B-E|{vKJ)ZCwBvB#3cVr24E$Y_5X4ybIb{5d zNp5+`ggq1U(kgC{@GM!40zQ}}U+G?o3M^JL`tz=G`{Zc7K7WNvX!LWu9DhLuqosDO zm+q)Osx3aHtvRpLr#`ZmBI8we+9|T*Dzrz7>P>YYM4$cQ@*}%1nnGi`VLbJTTaebA z5=K%qMOo{}>aAG4s#8PkhhZt|Ll3?_cMlZ|q1h4CS@qY(;_zKFZD_bYA6CUOyF<%o zp)D#J+DhaGp9l7KpR7|k?ZYR!xZx|=`=z-s1<}O-fvf;K zVdw(?Pq$w#_iewkZ!!l~gJ^iYIT@;Xee7R}IxPhLyj8;RNK?`A%NV>4b;w^f3&W){?;ct59mqSX7wFILEEr%%Uiv`wRru7I z5-|6-BCyBGTF;lRg`>ot`{R;R+{+C?Nh}(TMK}i^#o@-qWAH%x0tw0do<74dU5-zD`Sxo30<9Nr3X3zs>RiIL(Ip#`Rx;-7xxoN zI$t|bW0@HRio5{ctYyE8rS4OSta$Y1vl;#6o{p=fCTOx9!NY%HRdg!KCl!B8yiw7u zFIV#AlUb~L4AfhkR>erFE-qIL*29hwJ^lOe_gS-%mt4A_drt^mYTnk><^QsE$6fC$ zZ+uyic9%z5{i`;P<=?Q6A$*v;31u_5^G znE@Ap?0nRUSt56*z4CA;yao330O(G>V=?5-wDnZ4ZX{EJ{Rb~&Gd=i!7qg&rcR1(ar0 zZSGDsHWi;OtRi)1g$-1xB^&F=zM%+!Z!SLN;@|<&!A*KZsawnYHbj0iX8RRne1>C}1el z`Cv3Tu2J~JafUXE=NrOH*43-g;-SvO(`wo4{b;_uMhT02$3oSg?jKIs^E51Ke=7j< zZD#@fKwsY}f=+g`qU?BcDzecL|hKT$wsf)1)N%-)cErx^fKB z=Zr+ej#GW{z|>~Bm4qFGffe_xrC2hfXnTVTnF4)2E`KjE{_JPql611$Ena{-8-HWk zz&KvwsjBR?vfuON+e&I?^#sA)6Z5)nu@^e^8sR~YsJGy7ACsMl$5$4*zWQ6nn8ya$ z<_%37ckJVm;lp<0@%ivf4yT<7D<@5w<-%7orcO4^306FU7x94=c@oNnPHD@)I+T4>__Y1R1L+yw8k>^p!5?DQbTOHnBHEb=1H^*HikB8H;d zJaM7i?tx-saa&Lzth4RxR_nuZ+4lplyBpWcY~=5&F}#%d1T$G8qCRbCdra}jw zs}{|i>`Sx@d--z`bu7Z|NTg3(Ig6jvjWLu31{h%l;SAgtjIv8#mWZFJ^{4#z)_r$g z!nquufMJ>;y2es=ep>`F5j{PKxo|j^^I7}h;l_N{$yZ;yW4!@b;|v@B{fYJYS2-g? zDeC!r(UQ1Wc3nnXB{|$b5u(Aq4}Ad{EQvQu-6fyc6V9C`H+Yq@B|?)lM;0gKxxcfY zH)gJw_k)uK(m*8{BS>RwtjDA=v--14mCiolo%Ut6CG+$~1k;(C%RgRoyBz4TXyq=m zQD_m)yZo2F15CA$(RYd@-8jGzN5@Mi@6wDSZQ|^STHe(kSv_F06dn#gc-8KpzbN~; zB!@R&vI#oc)?0*`8BmKCN4l|0>p5YaMcFl_jN&bo)VxEs+L~D8sV2^< z!*yVKRL7BNLYleg)fk>KL68h%2_reZY%>=@i9(OPLlW*IOij@P^{;CVl#1JIRW^A^ zrlx|?%6hIuQrY~+| zHOi!`>c(s5KoedTW7?|4fs73=%}qQml)r0yZ;VPP9m@WKvZ*tGr<-`IZZ^H)dkid8 zjK?`nKG?zeD><6R)4*=q*%$c{=c5Ifk7Hh(xzq*d1+mP>HqOO_o#oFp$7HDXv@e7cTXjfjDt^3ruKi6T`UNLorGQ{4l5MaTOh81U5d`?# z3hdHYr$6C6t@@W}2wn;>M4ymOI#2?0_|ec%JcVW7G6vOOpU`4y&7>jH%2wzD*MQCW z+g`U(41N_@PNZEP)K8;{5LQq>sSx$^>#PYEC{oFY`k9BW3+ksRqJBzz@2~{xbD*zy zS0-~)+aBVy!!23%Y;PP2s%~<~AHG8VrL5NB_5NCx1&y)p=LtP`Ud)6Sl?c_&N-|Cc`zZ>!1bor=W%e^9 z64w5Ll$%kgOs0~lQs&!tPdG}AMjpN;(QR;uWG4p%t ztSQ!Sf3j~o&~<6abaS;^c&Es}Qg6S=6Q^IeX8BZPYxkqhG~qI#kqh@VS|c9bD5W7T z;V8`Qw$W+jt;feSKb@U8_ziU*>VDyu=ns*z%N=BtZu<*UdiFXn_tB?!QPC8h6d)!= zy1Bo%X81CB@^10%19j&I1H2P2pT{fftbwi}V+-cj{+FoWrsqhyxyjo%{;KcdhQ?n1 zm&biX?g!~U2y-D}({y$0{mS5vzqC<1=*iJ+r$=TOA%es^a7e6{qctRU^WSyPQH65R z_CA~U4#_=(j6EWAk1ob(oMzYNG5*^mYQ3hEE{s1#wGvJO)5^UsKnR#MvK zZz3C-S#O#U$D47wtM%jyD{>b$>WXSAUR0r*v;}1vWG^JRt+C$HOs7b^!)MFoUF7f0 ztYoBJjR^;ZL0D;&<#+mD*O_kDUr;6jj&7Mw7>R=1$%gvI6uW@O^U-WBj2tV%N!r!v zkE8wn=#HKreU*ytZZESA2@Mltw^uW7`aL~$0e>lcn@VYr$jL-$#LD%Pd4`6voI=rk zK*mZ)Ot~Ll`ILZ?5pR8Iw=>AS&;8$@l(SEhGwy8tWV*c-uMia%>?qCZ#Lh ztJv*hg(ppVyx5R*k+uOA3qo5RX6Wy#lP!ushSrPd}zMd{uG1 zjeDGO7O<=5;>IV*lzDp0*mP0unM|QxwqC;EHMQAmXGjUJR1!{IqT9H+J?%Ts$3E?^ z`dg>u&ED)8a~%OCA6%lpn4F9+j>Juyr@2d9M@eSC4a1sdtZv;q=eRN<2epT~`oR5jSar*<1Tt!R+EzEx#;irs`!cZ~5JMlmd9 z9SJG%-SWNfZIAb_ zXC!7S@^){>jY<|JxNNJAxlmncV~x}u)V6AISw?$Yab^WkyMX>|LgkLm%0g_@Ii9hu-(u=mXHr6_y6z->fH7fq{PB!-C zaA4A@lWnO&PK$;%id8N#b!kR^jNso}`2SixmsLqZnN*X!Rik~~`d`O6sl}&gKOxzm zU6BXAR^>=ST#0w-GS$U3WwBnu&m7h+!_UIFla|Q0P!DXD?OZ?n~hX-49e!o;#m%ySa zZZ8+<0nZGGRfR~Qa>0LA%U)$gXvk0_{TDyBSV>=y(Xe8_;!ol7E-Fiw>;gyBP%V-rFq6+PNRrlpkFKhra7?xjx55O z%Jc;e$#Yp~PE4#2z1-RPc*w!n+4;tbf?tM&F5(&SJK%6`FxA7ew{AFc_RzrZX&U{$ z0{P_FbRU?%*1oNJ3_W*WB!`}qLQeEB9V@Q|@t89;!)C(siq}5dvbafTtqJ&hD=_*V z<6?Zz9pJ!v$E;=)*DRQ@ncktJcNdphkz^%i}_24^NdTCE+MMF*q-2hQ2F$;$SbK%oOgGaY@ZT(_DbuEJ224?6LN2wz6jBnGctxQrkjX&K(x zXfs`c5%U;P1VysfKrhkqW9>mGGGa(tFsn;F9Tl_lk1U4N2P{xqT|?gcUmmtxEbG@W z`9Nau5P?r?ulvbTDTo+A6{ZE4R{`OEY5?YSr*ET3QHZ3eJCHbmgo-GjAk{OX!ALOK z%XA+s7D&Z;54(eWOL+KGofFvMvsuu9tCr;#5-p-}kjZucLNM(9?qW$_q`2U^#~Nt1 zNGJq!D<>DhsJ$H+Sm^(3x!o1zFL~|19r2zID};#zvpNuNE=Tk!;}-8}{qRpfUS-o39l*B_fjDeZaf50LF29)(xYiN2FaZ1s5y1Zva|V3GQyFPC zvc(D`{Qt6w0V8@+n+Y4ZITs*&%X<_b7n~>vWX%5WdzpD0yvd=1F!T!{Zv-!Mg#vLf z(BxSW7y&Y>VEusDJk<&t;?PM5H#oHN4D>*mqb9&j{JtL118t(eLu`{4^g#c)4}e1$ z#G3#&H3(1`oSwqL-QXk3xJ7$#IIPjVv|fz*=|dE`m7~>8^`%b!~qlAp(Joc2SCiVHhXTECr7Jy$2Fe3fsf>^>gu&b>5tiH##j=#+%x^Ysf zosaC`?%hWvGs1kax0wpAS=cj_O3eo4=7EUVR4NrL6t|3x7MJZn@ZSP7MlF;dMh4}X z{~X+;QGrcQYqA@TJwS0yY~Q>H;Bi%Gw)A&jt-@G62~8zF;J8}XIsg9N>Ghw^4#y={ zBiPjp7~B%9z8b=AJ1eL3W@K+OJZpl&M_?Fi;Ho1Sj_$rIWthu-EZ2&u8*Xj1W$+L!rPy$cVAg zg70LqMOa$fk9YGo0BAVcy>M0HM#ulb^~NjiwiCPc_Dnxyy584sd%rC}zZH9>^e%JL z_(}FWC-FlRv6YkSWZ}#=##tbwuwrE*-;U~u8H>!m7m@D<=}h}YgdQ_Y;qyzLTnwm6 zd1m*sWo_F$tx3H=#pqFu_Ua!>YRKCv{Pk$8IwnleGu7jDsB%VI^ZT83v-Wv#LYQQZ z?|D1zPQbGl2j!>5=afgZ>uhU%sg(ZpX+ksuI}fV96wq?;Mlx6hjNO>g57>5fyjK=T zF}{5$e5cdI{WH47SNCEoD4&mqhfUve$M^h1_6(aTIaIJ3Z&qo>|DJ9B@KBn!f9-O{ zGVaNVw|4?-&Rd>g|C2R+N56pbAIoAb%ihO~j>&1rYbFih;;>&docHpW5F#4NCXh>t z31P7f#3Vd%@8n?99ax?=l)*yD(QiFQ^EqbxO>+KO)PF}J&*Smk>LE(c@!uaqG?#m@ zHa}ZrA)$8>ueQ;p(2$WCQGgpP_5QHfxP>FWeGqQEGAogk!X7?k?5n;)Lya8*yFbMK zY&}RH@oK4yG9T%;9@mrw`%cDu!C{%_9v1v6P!x#! z#*M{Z!~y{k_r6C{m$4Au#alrsDY12Ti>zT5%^Nn@-Nl30^eaey<}HNxF4z%va;A9S zZiFx0dTq8K+5wJt{FtyV-_I8~SyGQ33sh5l{^QMg8Z!~`>nTp;{c07`5jM}P&;=si z|NInyp#k@6H}H}vdIrD@&zj5=;H}KI23gaHp9q+t3gmAR)(LK9wV>1j29b0mB8@nN z;f1C{^DW=SwJJbI`43F-0k7DAHuguhLRg1=4m>JUD&^q$FP-M9zyzxq0IX%(AR~^* z$Ed|^Z@rn`C7wf!QLv*FMGi`mc!TGnciX_l0v^(^;Qzl&SnwvzQ$z&ev>X`j)DwEp1eP3-d=IZSnQ%Yb)jVG9DDM^s=%N7x;l%jtthN%_4k{$ixK+FeqKx(!;kX=KH|nl ziov!WTd`!96_s)1N#~vqR&(cR3)?&kV{Z&%v7XvSAhLHbNJg!){1EZO<+F|f*NY%} z&#XHlDCCEufwndy=_Kjp*9#EYyx`;apk?l!aycQ8?zsqNJQDbml~j`WCT0@!Uz5uq Az5oCK diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index a6b1ae1ed7..7e3878d4ea 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -4,7 +4,7 @@ items: - name: Configure and manage Windows Firewall items: - name: Configure Windows Firewall - href: best-practices-configuring.md + href: configure.md - name: Configure with Microsoft Intune href: create-windows-firewall-rules-in-intune.md - name: Configure with group policy From 2bfabfd9c31388e129281886cae28fb23022081a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 16 Nov 2023 14:06:02 -0800 Subject: [PATCH 169/237] Win10-seeker-8503602 --- windows/deployment/update/waas-configure-wufb.md | 10 +++++----- windows/deployment/update/waas-wufb-group-policy.md | 6 ++++-- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 6af6c31910..0d48a5b081 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -16,7 +16,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 08/22/2023 +ms.date: 11/28/2023 --- # Configure Windows Update for Business @@ -243,8 +243,8 @@ The following options are available for the policy: | Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
    Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | -| MDM for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
    ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| **GPO applies to**:

    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351), and later versions
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    **GPO location**: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| **MDM applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later versions
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    **MDM location**: ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | ## Enable features that are behind temporary enterprise feature control @@ -269,7 +269,7 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD | 2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build

    Other value or absent: Receive all applicable updates | | DeferFeatureUpdates | REG_DWORD | 1: Defer feature updates
    Other value or absent: Don't defer feature updates | @@ -285,7 +285,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD |2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build
    32: Systems take feature updates from General Availability Channel
    Note: Other value or absent: Receive all applicable updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 372a36d6df..849feeeddf 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -17,7 +17,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 10/10/2023 +ms.date: 11/28/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business @@ -202,7 +202,9 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann #### I want to enable optional updates -(*Starting in Windows 11, version 22H2 or later*) +*Applies to:* +- Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later +- Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates** policy. From cbcd5c0f7eb16df83f17e3a969b0d958a91bce38 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 16 Nov 2023 14:26:38 -0800 Subject: [PATCH 170/237] branch chache not supported on 11 8530422 --- windows/deployment/update/waas-branchcache.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 840ea3d5a7..829dc4d1f5 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -9,9 +9,8 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: medium appliesto: -- ✅ Windows 11 -- ✅ Windows 10 -ms.date: 12/31/2017 +✅ Windows 10 +ms.date: 11/16/2023 --- # Configure BranchCache for Windows client updates @@ -33,7 +32,10 @@ For detailed information about how Distributed Cache mode and Hosted Cache mode Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](/previous-versions/windows/it-pro/windows-7/dd637820(v=ws.10)) in the [BranchCache Early Adopter's Guide](/previous-versions/windows/it-pro/windows-7/dd637762(v=ws.10)). -In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. +In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows client, set the Delivery Optimization **Download mode** to '100' (Bypass) to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. + +> [!Note] +> Setting [Download mode](../do/waas-delivery-optimization-reference.md#download-mode) to '100' (Bypass) is only available in Windows 10, version 1607 and later, not in Windows 11. BranchCache isn't supported for Windows 11. ## Configure servers for BranchCache From c0775ea59a68657f8f3e1f7c895285019fcef49d Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 16 Nov 2023 14:32:20 -0800 Subject: [PATCH 171/237] branch chache not supported on 11 8530422 --- windows/deployment/update/waas-branchcache.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 829dc4d1f5..05c5f63d80 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -9,7 +9,7 @@ ms.author: mstewart manager: aaroncz ms.localizationpriority: medium appliesto: -✅ Windows 10 +- ✅ Windows 10 ms.date: 11/16/2023 --- From 359308efd8bd7d21bd99b2bc1d78f1db00924346 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 17:38:40 -0500 Subject: [PATCH 172/237] updates --- .../windows-firewall/configure.md | 51 ++++++++++--------- .../windows-firewall/index.md | 2 +- 2 files changed, 28 insertions(+), 25 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index ad871bd902..ec61af70c6 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -14,8 +14,11 @@ Windows offers different tools to view the status and configure Windows Firewall - [Windows Security](#windows-security) - [Control Panel](#control-panel) - [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) +- [Configuration Service Provider (CSP)](#configuration-service-provider-csp) - [Command line tools](#command-line-tools) +#### Configuration Service Provider (CSP) + > [!NOTE] > To change the configuration of Windows Firewall, you must have administative rights on the device. @@ -61,6 +64,16 @@ Windows offers different tools to view the status and configure Windows Firewall :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/mmc-advanced-security.png" border="false"::: :::column-end::: :::row-end::: +:::row::: + :::column span="4"::: + #### Configuration Service Provider (CSP) + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + The [Firewall CSP](/windows/client-management/mdm/firewall-csp) provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune + :::column-end::: +:::row-end::: :::row::: :::column span="4"::: #### Command line tools @@ -88,8 +101,6 @@ The *private network* profile is designed for private networks such as a home ne The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. -To view detailed settings for each profile, right-click the top-level **Windows Defender Firewall with Advanced Security** node in the left pane and then select **Properties**. - ## Firewall rules In many cases, a first step for administrators is to customize the firewall profiles using *rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. @@ -99,9 +110,9 @@ It's recommended to maintain the default Windows Firewall settings whenever poss > [!TIP] > Create your rules in all three profiles, but only enable the firewall rule group on the profiles that suit your scenarios. For example, if you are installing a sharing application that is only used on a private network, then it would be best to create firewall rules in all three profiles, but only enable the firewall rule group containing your rules on the private profile. -### Restrictions per Profile +### Restrictions per profile -You may also wish to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it is best to modify the remote address restriction to specify **Local Subnet** only. The same application or service would not have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction should not apply to applications or services that require global Internet connectivity. +You may also wish to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify **Local Subnet** only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. ### Rule precedence for inbound rules @@ -121,7 +132,7 @@ A general security recommended practice when creating inbound rules is to be as ## Create rules for new applications -When first installed, networked applications and services issue a *listen call* specifying the protocol/port information required for them to function properly. Sicne there's a default *block* action in Windows Firewall, you must create inbound exception rules to allow the traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. +When first installed, networked applications and services issue a *listen call* specifying the protocol/port information required for them to function properly. Since there's a default *block* action in Windows Firewall, you must create inbound exception rules to allow the traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network: @@ -160,19 +171,19 @@ Firewall rules can be deployed: *Rule merging* settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. -The rule-merging settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from GPO or CSP. +The rule-merging policy settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from GPO or CSP. | | Path | |--|--| -| **CSP** | Domain Profile: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/AllowLocalPolicyMerge`
    Private Profile`./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/AllowLocalPolicyMerge`
    Public Profile `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/AllowLocalPolicyMerge` | -| **GPO** | **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Removable Data Drives** | +| **CSP** | Domain Profile: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileallowlocalpolicymerge)
    Private Profile`./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileallowlocalpolicymerge)
    Public Profile `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileallowlocalipsecpolicymerge) | +| **GPO** | **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security**| Administrators may disable *LocalPolicyMerge* in high-security environments to maintain tighter control over endpoints. This setting can impact some applications and services that automatically generate a local firewall policy upon installation. > [!IMPORTANT] > If merging of local policies is disabled, centralized deployment of rules is required for any app that needs inbound connectivity. -As a best practice, it's important to list and log such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex deployments, a thorough analysis might be needed using network packet capture tools. +It's important to create and maintain a list of such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex deployments, a thorough analysis might be needed using network packet capture tools. In general, to maintain maximum security, admins should only deploy firewall exceptions for apps and services determined to serve legitimate purposes. @@ -181,7 +192,7 @@ In general, to maintain maximum security, admins should only deploy firewall exc ## Group policy processing -The Windows Firewall settings configured viaGPO or CSP are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. +The Windows Firewall settings configured via GPO or CSP are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: @@ -213,31 +224,23 @@ To avoid the issue, leave the policy `Computer Configuration > Administrative Te An important Windows Firewall feature you can use to mitigate damage during an active attack is the *shields up* mode. It's an informal term referring to an easy method a firewall administrator can use to temporarily increase security in the face of an active attack. -Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or . +Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or Control Panel. ![Incoming connections.](images/fw06-block.png) -*Figure 6: Windows settings App/Windows Security/Firewall Protection/Network Type* - :::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: -*Figure 7: Legacy firewall.cpl* - -By default, the Windows Firewall blocks everything unless there's an exception rule created. This setting overrides the exceptions. - -For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access won't work as long as shields up is activated. +By default, the Windows Firewall blocks everything unless there's an exception rule created. The *shield up* option overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access won't work as long as shields up is activated. Once the emergency is over, uncheck the setting to restore regular network traffic. -## Create outbound rules +## Outbound rules considerations What follows are a few general guidelines for configuring outbound rules. -- The default configuration of Blocked for Outbound rules can be considered for certain highly secure environments. However, the Inbound rule configuration should never be changed in a way that Allows traffic by default -- It's recommended to Allow Outbound by default for most deployments for the sake of simplification around app deployments, unless the enterprise prefers tight security controls over ease-of-use -- In high security environments, an inventory of all enterprise-spanning apps must be taken and logged by the administrator or administrators. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via group policy (GP), Mobile Device Management (MDM), or both (for hybrid or co-management environments) - -For tasks related to creating outbound rules, see [Checklist: Creating Outbound Firewall Rules](checklist-creating-outbound-firewall-rules.md). +- The default configuration of Blocked for Outbound rules can be considered for certain highly secure environments. However, the Inbound rule configuration should never be changed in a way that allows traffic by default +- It's recommended to Allow Outbound by default for most deployments for the sake of simplification around app deployments, unless the organization prefers tight security controls over ease-of-use +- In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP. ## Document your changes diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 031081d39d..35df7ea708 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -42,7 +42,7 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI > [!div class="nextstepaction"] > Learn about the tools to configure Windows Firewall and some recommended practices: > -> [Configure Windows Firewall >](best-practices-configuring.md) +> [Configure Windows Firewall >](configure.md) From 0d087d5cd7155c228cb6cb88d30207855d2879a7 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Thu, 16 Nov 2023 17:40:52 -0500 Subject: [PATCH 173/237] MBR2GPT Refresh --- windows/deployment/mbr-to-gpt.md | 78 ++++---------------------------- 1 file changed, 8 insertions(+), 70 deletions(-) diff --git a/windows/deployment/mbr-to-gpt.md b/windows/deployment/mbr-to-gpt.md index 1b24406aee..a0eb436b76 100644 --- a/windows/deployment/mbr-to-gpt.md +++ b/windows/deployment/mbr-to-gpt.md @@ -4,7 +4,7 @@ description: Use MBR2GPT.EXE to convert a disk from the Master Boot Record (MBR) ms.prod: windows-client author: frankroj ms.author: frankroj -ms.date: 10/17/2023 +ms.date: 11/16/2023 manager: aaroncz ms.localizationpriority: high ms.topic: how-to @@ -19,7 +19,7 @@ appliesto: # MBR2GPT.EXE -**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS) by using the **`/allowFullOS`** option. +**MBR2GPT.EXE** converts a disk from the Master Boot Record (MBR) to the GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool runs from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows operating system (OS) by using the **`/allowFullOS`** option. **MBR2GPT.EXE** is located in the **`Windows\System32`** directory on a computer running Windows. @@ -32,7 +32,7 @@ See the following video for a detailed description and demonstration of MBR2GPT. You can use MBR2GPT to: - Convert any attached MBR-formatted system disk to the GPT partition format. You can't use the tool to convert non-system disks from MBR to GPT. -- Convert an MBR disk with BitLocker-encrypted volumes as long as protection has been suspended. To resume BitLocker after conversion, you'll need to delete the existing protectors and recreate them. +- Convert an MBR disk with BitLocker-encrypted volumes as long as protection is suspended. To resume BitLocker after conversion, you'll need to delete the existing protectors and recreate them. - Convert an operating system disk from MBR to GPT using Microsoft Configuration Manager or Microsoft Deployment Toolkit (MDT). Offline conversion of system disks with earlier versions of Windows installed, such as Windows 7, 8, or 8.1 aren't officially supported. The recommended method to convert these disks is to upgrade the operating system to a currently supported version of Windows, then perform the MBR to GPT conversion. @@ -73,7 +73,7 @@ If any of these checks fails, the conversion doesn't proceed, and an error is re |**/disk:*\***| Specifies the disk number of the disk to be converted to GPT. If not specified, the system disk is used. The mechanism used is the same as used by the diskpart.exe tool **SELECT DISK SYSTEM** command.| |**/logs:*\***| Specifies the directory where `MBR2GPT.exe` logs should be written. If not specified, **%windir%** is used. If specified, the directory must already exist, it isn't automatically created or overwritten.| |**/map:*\*=*\***| Specifies other partition type mappings between MBR and GPT. The MBR partition number is specified in decimal notation, not hexadecimal. The GPT GUID can contain brackets, for example: **/map:42={af9b60a0-1431-4f62-bc68-3311714a69ad}**. Multiple /map options can be specified if multiple mappings are required. | -|**/allowFullOS**| By default, `MBR2GPT.exe` is blocked unless it's run from Windows PE. This option overrides this block and enables disk conversion while running in the full Windows environment.
    **Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new EFI system partition is created by shrinking the OS partition.| +|**/allowFullOS**| By default, `MBR2GPT.exe` can only run from Windows PE and is blocked from running in full Windows. This option overrides this block and enables disk conversion while running in the full Windows environment.
    **Note**: Since the existing MBR system partition is in use while running the full Windows environment, it can't be reused. In this case, a new EFI system partition is created by shrinking the OS partition.| ## Examples @@ -108,7 +108,7 @@ In the following example: 1. The new disk layout is displayed - four partitions are present on the GPT disk: three are identical to the previous partitions and one is the new EFI system partition (volume 3). -1. The OS volume is selected again, and detail displays that it has been converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. +1. The OS volume is selected again. The detail displays that the OS volume is converted to the [GPT partition type](/windows/win32/api/winioctl/ns-winioctl-partition_information_gpt) of **ebd0a0a2-b9e5-4433-87c0-68b6b72699c7** corresponding to the **PARTITION_BASIC_DATA_GUID** type. As noted in the output from the MBR2GPT tool, you must make changes to the computer firmware so that the new EFI system partition boots properly. @@ -298,7 +298,7 @@ The conversion tool attempts to remap all drive letter assignment information co The conversion tool will obtain volume unique ID data before and after the layout conversion, organizing this information into a lookup table. It then iterates through all the entries in **HKLM\SYSTEM\MountedDevices**, and for each entry it does the following: -1. Check if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. +1. Checks if the unique ID corresponds to any of the unique IDs for any of the volumes that are part of the converted disk. 2. If found, set the value to be the new unique ID, obtained after the layout conversion. 3. If the new unique ID can't be set and the value name starts with **\DosDevices**, issue a console and log warning about the need for manual intervention in properly restoring the drive letter assignment. @@ -433,7 +433,7 @@ You can view the partition type of a disk by using the Disk Management tool: #### DiskPart tool -The partition type can be determined with the DiskPart tool. The DiskPart tool is useful in scenarios where the Disk Management tool and PowerShell aren't available, such as in WinPE when the PowerShell optional component in WinPE isn't loaded. To use the DiskPart tool to determine the partition type: +The partition type can be determined with the DiskPart tool. The DiskPart tool is useful in scenarios where the Disk Management tool and PowerShell aren't available, such as in WinPE. PowerShell isn't available in WinPE when the PowerShell optional component isn't loaded. To use the DiskPart tool to determine the partition type: 1. Open an elevated command prompt. @@ -449,7 +449,7 @@ The partition type can be determined with the DiskPart tool. The DiskPart tool i list disk ``` -1. The partition type is displayed in the **Gpt** column. If the partition is GPT, an asterisk (**\***) is displayed in the column. If the partition is MBR, the column will be blank. +1. The partition type is displayed in the **Gpt** column. If the partition is GPT, an asterisk (**\***) is displayed in the column. If the partition is MBR, the column is blank. The following shows an example output of the DiskPart tool showing the partition type for two disks: @@ -470,65 +470,3 @@ DISKPART> list disk ``` In this example, Disk 0 is formatted with the MBR partition style, and Disk 1 is formatted using GPT. - -## Known issue - -### MBR2GPT.exe can't run in Windows PE - -When you start a Windows 10, version 1903-based computer in the Windows Preinstallation Environment (Windows PE), you encounter the following issues: - -**Issue 1** When you run the `MBR2GPT.exe` command, the process exits without converting the drive. - -**Issue 2** When you manually run the `MBR2GPT.exe` command in a Command Prompt window, there's no output from the tool. - -**Issue 3** When `MBR2GPT.exe` runs inside an imaging process such as a Microsoft Configuration Manager task sequence, an MDT task sequence, or by using a script, you receive the following exit code: 0xC0000135/3221225781. - -#### Cause - -This issue occurs because in Windows 10, version 1903 and later versions, `MBR2GPT.exe` requires access to the ReAgent.dll file. However, this dll file and its associated libraries are currently not included in the Windows PE boot image for Windows 10, version 1903 and later. - -#### Workaround - -To fix this issue, mount the Windows PE image (WIM), copy the missing file from the [Windows 10, version 1903 Assessment and Development Kit (ADK)](https://go.microsoft.com/fwlink/?linkid=2086042) source, and then commit the changes to the WIM. Use follow these steps: - -1. Mount the Windows PE WIM to a path (for example, C:\WinPE_Mount). For more information about how to mount WIM files, see [Mount an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#mount-an-image). - -2. Copy the ReAgent files and the ReAgent localization files from the Windows 10, version 1903 ADK source folder to the mounted WIM. - - For example, if the ADK is installed to the default location of C:\Program Files (x86)\Windows Kits\10 and the Windows PE image is mounted to C:\WinPE_Mount, run the following commands from an elevated Command Prompt window: - - > [!NOTE] - > You can access the ReAgent files if you have installed the User State Migration Tool (USMT) as a feature while installing Windows Assessment and Deployment Kit. - - **Command 1:** - - ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\ReAgent*.*" "C:\WinPE_Mount\Windows\System32" - ``` - - This command copies three files: - - - ReAgent.admx - - ReAgent.dll - - ReAgent.xml - - **Command 2:** - - ```cmd - copy "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Setup\amd64\Sources\En-Us\ReAgent*.*" "C:\WinPE_Mount\Windows\System32\En-Us" - ``` - - This command copies two files: - - - ReAgent.adml - - ReAgent.dll.mui - - > [!NOTE] - > If you aren't using an English version of Windows, replace "En-Us" in the path with the appropriate string that represents the system language. - -3. After you copy all the files, commit the changes and unmount the Windows PE WIM. `MBR2GPT.exe` now functions as expected in Windows PE. For information about how to unmount WIM files while committing changes, see [Unmounting an image](/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism#unmounting-an-image). - -## Related articles - -- [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) From 2e0f2da643c9395c24c1d3b5efd80dd2fccf50b7 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 16 Nov 2023 18:09:15 -0500 Subject: [PATCH 174/237] test GPO settings --- .../windows-firewall/configure-logging.md | 33 ++++++++----------- 1 file changed, 13 insertions(+), 20 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index e767c11866..296b2c7a63 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -1,6 +1,6 @@ --- -title: Configure the Windows Defender Firewall Log -description: Learn how to configure Windows Firewall to log dropped packets or successful connections with Microsoft Intune and group policy. +title: Configure Windows Firewall logging +description: Learn how to configure Windows Firewall to log dropped packets or successful connections with CSP and group policy. ms.topic: how-to ms.date: 11/14/2023 --- @@ -9,14 +9,12 @@ ms.date: 11/14/2023 To configure Windows Firewall to log dropped packets or successful connections, you can use: -- Microsoft Intune/MDM -- Group policy with the Windows Defender Firewall with Advanced Security node in the Group Policy Management MMC snap-in +- Configuration Service Provider (CSP), using an MDM solution like Microsoft Intune +- Group policy (GPO) [!INCLUDE [tab-intro](../../../../../includes/configure/tab-intro.md)] -#### [:::image type="icon" source="../../../images/icons/intune.svg" border="false"::: **Intune/MDM**](#tab/intune) - -### Configure Windows Firewall with Intune +# [:::image type="icon" source="../../../images/icons/intune.svg" border="false"::: **Intune/CSP**](#tab/intune) [!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] @@ -36,22 +34,10 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the | **Setting name**: Turn On Virtualization Based Security
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/EnableVirtualizationBasedSecurity`
    **Data type**: int
    **Value**: `1`| | **Setting name**: Credential Guard Configuration
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/LsaCfgFlags`
    **Data type**: int
    **Value**:
     **Enabled with UEFI lock**: `1`
     **Enabled without lock**: `2`| -Once the policy is applied, restart the device. - -#### [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) - -### Configure Windows Firewall with group policy +# [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) [!INCLUDE [gpo-settings-1](../../../../../includes/configure/gpo-settings-1.md)] -| Group policy path | Group policy setting | Value | -| - | - | - | -| **Computer Configuration\Administrative Templates\System\Device Guard** |Turn On Virtualization Based Security | **Enabled** and select one of the options listed under the **Credential Guard Configuration** dropdown:
     - **Enabled with UEFI lock**
     - **Enabled without lock**| - -[!INCLUDE [gpo-settings-2](../../../../../includes/configure/gpo-settings-2.md)] - -Once the policy is applied, restart the device. - 1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). 1. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. 1. For each network location type (Domain, Private, Public), perform the following steps. @@ -66,6 +52,13 @@ Once the policy is applied, restart the device. - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** 1. Click **OK** twice + +| Group policy path | Group policy setting | Value | +| - | - | - | +| **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** |Turn On Virtualization Based Security | **Enabled** and select one of the options listed under the **Credential Guard Configuration** dropdown:
     - **Enabled with UEFI lock**
     - **Enabled without lock**| + +[!INCLUDE [gpo-settings-2](../../../../../includes/configure/gpo-settings-2.md)] + --- ### Troubleshoot Slow Log Ingestion From adc608ab6d21a1e9a17fae8ba66b519e15a0a60c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 07:31:21 -0500 Subject: [PATCH 175/237] updates --- ...blishing.redirection.windows-security.json | 7 +- windows/security/identity-protection/toc.yml | 2 +- .../windows-firewall/configure-logging.md | 65 ++++--- .../windows-firewall/configure.md | 6 +- .../isolating-apps-on-your-network.md | 179 ------------------ .../network-security/windows-firewall/toc.yml | 2 - 6 files changed, 51 insertions(+), 210 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 8b6383e09d..8ebfb05ade 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7072,7 +7072,7 @@ }, { "source_path": "windows/security/threat-protection/windows-firewall/isolating-apps-on-your-network.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", "redirect_document_id": false }, { @@ -8014,6 +8014,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md", "redirect_url": "/windows/security/operating-system-security/network-security/configure", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md", + "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/identity-protection/toc.yml b/windows/security/identity-protection/toc.yml index 5762bfaf81..26eafa1368 100644 --- a/windows/security/identity-protection/toc.yml +++ b/windows/security/identity-protection/toc.yml @@ -24,7 +24,7 @@ items: href: enterprise-certificate-pinning.md - name: Web sign-in href: web-sign-in/index.md - - name: Federated sign-in 🔗 + - name: Federated sign-in (EDU) 🔗 href: /education/windows/federated-sign-in - name: Advanced credential protection items: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index 296b2c7a63..a809e05f18 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -38,52 +38,71 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the [!INCLUDE [gpo-settings-1](../../../../../includes/configure/gpo-settings-1.md)] -1. Open the Group Policy Management Console to [Windows Defender Firewall with Advanced Security](open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md). -1. In the details pane, in the **Overview** section, click **Windows Defender Firewall Properties**. -1. For each network location type (Domain, Private, Public), perform the following steps. - 1. Click the tab that corresponds to the network location type - 1. Under **Logging**, click **Customize** - 1. The default path for the log is **%windir%\system32\logfiles\firewall\pfirewall.log**. If you want to change this path, clear the **Not configured** check box and type the path to the new location, or click **Browse** to select a file location +1. Expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** +1. In the details pane, in the **Overview** section, select **Windows Defender Firewall Properties** +1. For each network location type (Domain, Private, Public), perform the following steps + 1. Select the tab that corresponds to the network location type + 1. Under **Logging**, select **Customize** + 1. The default path for the log is `%windir%\system32\logfiles\firewall\pfirewall.log`. If you want to change this path, clear the **Not configured** check box and enter the path to the new location, or select **Browse** to select a file location > [!IMPORTANT] > The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file. -1. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and type in the new size in KB, or use the up and down arrows to select a ize. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. +1. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and enter the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. 1. No logging occurs until you set one of following two options: - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** - To create a log entry when Windows Defender Firewall allows an inbound connection, change **Log successful connections** to **Yes** -1. Click **OK** twice - - -| Group policy path | Group policy setting | Value | -| - | - | - | -| **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** |Turn On Virtualization Based Security | **Enabled** and select one of the options listed under the **Credential Guard Configuration** dropdown:
     - **Enabled with UEFI lock**
     - **Enabled without lock**| +1. Select **OK** twice [!INCLUDE [gpo-settings-2](../../../../../includes/configure/gpo-settings-2.md)] --- -### Troubleshoot Slow Log Ingestion +## Recommendations -If logs are slow to appear in Sentinel, you can turn down the log file size. Just beware that this downsizing will result in more resource usage due to the increased resource usage for log rotation. +Here are some recommendations for configuring Windows Firewall logging: -### Troubleshoot if the log file is not created or modified +- Change the logging size to at least 20,480 KB(20 MB) to ensure that the log file doesn't fill up too quickly. The maximum log size is 32,768 KB(32 MB) +- For each profile (Domain, Private, and Public) change the name from `%windir%\system32\logfiles\firewall\pfirewall.log` to: + - `%windir%\system32\logfiles\firewall\pfirewall_Domain.log` + - `%windir%\system32\logfiles\firewall\pfirewall_Private.log` + - `%windir%\system32\logfiles\firewall\pfirewall_Public.log` +- Log dropped packets to **Yes** +- Log successful connections to **Yes** + +On a single system, you can use the following commands to configure logging: + +```cmd +netsh advfirewall>set allprofiles logging allowedconnections enable +netsh advfirewall>set allprofiles logging droppedconnections enable +``` + +## Parsing methods + +There are several methods to parse the Windows Firewall log files. For example: + +- Enable *Windows Event Forwarding* (WEF) to a *Windows Event Collector* (WEC). To learn more, see [Use Windows Event Forwarding to help with intrusion detection](/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection) +- Forward the logs to your SIEM product such as our Azure Sentinel. To learn more, see [Windows Firewall connector for Microsoft Sentinel](/azure/sentinel/data-connectors/windows-firewall) +- Forward the logs to Azure Monitor and use KQL to parse the data. To learn more, see [Azure Monitor agent on Windows client devices](/azure/azure-monitor/agents/azure-monitor-agent-windows-client) + +> [!TIP] +> If logs are slow to appear in your SIEM solution, you can decrease the log file size. Just beware that the downsizing results in more resource usage due to the increased log rotation. + +## Troubleshoot if the log file is not created or modified Sometimes the Windows Firewall log files aren't created, or the events aren't written to the log files. Some examples when this condition might occur include: -- missing permissions for the *Windows Defender Firewall Service* (MpsSvc) on the folder or on the log files -- you want to store the log files in a different folder and the permissions were removed, or haven't been set automatically +- Missing permissions for the *Windows Defender Firewall Service* (`mpssvc`) on the folder or on the log files +- You want to store the log files in a different folder and the permissions are missing, or aren't set automatically - if firewall logging is configured via policy settings, it can happen that - the log folder in the default location `%windir%\System32\LogFiles\firewall` doesn't exist - the log folder in a custom path doesn't exist - In both cases, you must create the folder manually or via script, and add the permissions for MpsSvc -If firewall logging is configured via Group Policy only, it also can happen that the `firewall` folder is not created in the default location `%windir%\System32\LogFiles\`. The same can happen if a custom path to a non-existent folder is configured via Group Policy. In this case, create the folder manually or via script and add the permissions for MPSSVC. +In both cases, you must create the folder manually or via script, and add the permissions for `mpssvc`. ```PowerShell New-Item -ItemType Directory -Path $env:windir\System32\LogFiles\Firewall ``` -Verify if MpsSvc has *FullControl* on the folder and the files. -From an elevated PowerShell session, use the following commands, ensuring to use the correct path: +Verify if `mpssvc` has *FullControl* on the folder and the files. From an elevated PowerShell session, use the following commands, ensuring to use the correct path: ```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" @@ -100,7 +119,7 @@ BUILTIN\Administrators FullControl Allow False ObjectI NT SERVICE\mpssvc FullControl Allow False ObjectInherit ``` -If not, add *FullControl* permissions for mpssvc to the folder, subfolders and files. Make sure to use the correct path. +If not, add *FullControl* permissions for `mpssvc` to the folder, subfolders and files. Make sure to use the correct path. ```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index ec61af70c6..27b0a9b510 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -17,10 +17,8 @@ Windows offers different tools to view the status and configure Windows Firewall - [Configuration Service Provider (CSP)](#configuration-service-provider-csp) - [Command line tools](#command-line-tools) -#### Configuration Service Provider (CSP) - > [!NOTE] -> To change the configuration of Windows Firewall, you must have administative rights on the device. +> To change the configuration of Windows Firewall on a device, you must have administative rights. :::row::: :::column span="4"::: @@ -71,7 +69,7 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="4"::: - The [Firewall CSP](/windows/client-management/mdm/firewall-csp) provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune + The [Firewall CSP](/windows/client-management/mdm/firewall-csp) provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. :::column-end::: :::row-end::: :::row::: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md b/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md deleted file mode 100644 index 8c5fb738b8..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md +++ /dev/null @@ -1,179 +0,0 @@ ---- -title: Isolating Microsoft Store Apps on Your Network -description: Learn how to customize your firewall configuration to isolate the network access of the new Microsoft Store apps that run on devices added to your network. -ms.topic: conceptual -ms.date: 11/14/2023 ---- - -# Isolating Microsoft Store Apps on Your Network - -When you add new devices to your network, you may want to customize your Windows Firewall configuration to isolate the network access of the new Microsoft Store apps that run on them. Developers who build Microsoft Store apps can declare certain app capabilities that enable different classes of network access. A developer can decide what kind of network access the app requires and configure this capability for the app. When the app is installed on a device, appropriate firewall rules are automatically created to enable access. You can then customize the firewall configuration to further fine-tune this access if they desire more control over the network access for the app. - -For example, a developer can decide that their app should only connect to trusted local networks (such as at home or work), and not to the Internet. In this way, developers can define the scope of network access for their app. This network isolation prevents an app from accessing a network and a connection type (inbound or outbound) if the connection has not been configured for the app. Then the network administrator can customize the firewall to further restrict the resources that the app can access. - -The ability to set and enforce these network boundaries ensures that apps that get compromised can only access networks where they have been explicitly granted access. This significantly reduces the scope of their impact on other apps, the device, and the network. In addition, apps can be isolated and protected from malicious access from the network. - -When creating new Microsoft Store apps, a developer can define the following network capabilities for their app: - -## Home\Work Networking - -Provides inbound and outbound access to intranet networks that the user has designated as a home or a work network, or if the network has an authenticated domain controller. - -## Internet (Client) - -Provides outbound access to the Internet and untrusted networks, such as airports and coffee shops (for example, intranet networks where the user has designated the network as Public). Most apps that require Internet access should use this capability. - -## Internet (Client and Server) - -Provides inbound and outbound access to the Internet and untrusted networks, such as airports and coffee shops. This capability is a superset of the **Internet (Client)** capability, and **Internet (Client)** does not need to be enabled if this capability is enabled. - -## Proximity - -Provides near-field communication (NFC) with devices that are in close proximity to the device. Proximity may be used to send files or connect with an application on a proximate device. - -## In this topic - -To isolate Microsoft Store apps on your network, you need to use Group Policy to define your network isolation settings and create custom Microsoft Store app firewall rules. - -- [Prerequisites](#prerequisites) -- [Step 1: Define your network](#step-1-define-your-network) -- [Step 2: Create custom firewall rules](#step-2-create-custom-firewall-rules) - -## Prerequisites - -- A domain controller is installed on your network, and your devices are joined to the Windows domain. -- Your Microsoft Store app is installed on the client device. -- The Remote Server Administration Tools (RSAT) are installed on your client device. When you perform the following steps from your client device, you can select your Microsoft Store app when you create Windows Defender Firewall rules. - -> [!NOTE] -> You can install the RSAT on your device running Windows from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). - -## Step 1: Define your network - -The **Home\Work Networking** capability enables access to intranet resources. Administrators can use Group Policy settings to define the scope of the intranet. This ensures that Microsoft Store apps can access intranet resources appropriately. - -A network endpoint is considered part of the **Home\\Work Network** if: - -- It is part of the local subnet of a trusted network. - For example, home users generally flag their network as Trusted. Local devices will be designated as such. -- A device is on a network, and it is authenticated to a domain controller. - - Endpoints within the intranet address space are considered private. - - Endpoints within the local subnet are considered private. -- The device is configured for DirectAccess, and the endpoint is part of the intranet address space. - -The intranet address space is composed of configured Active Directory sites and subnets, and it is configured for Windows network isolation specifically by using Group Policy. You can disable the usage of Active Directory sites and subnets by using Group Policy by declaring that your subnet definitions are authoritative. - -Any proxies that you configure or that are automatically configured with proxy autoconfiguration (by using Web Proxy Auto-Discovery (WPAD) protocol) are exempt from the intranet zone. You can add proxy addresses by using Group Policy. - -All other endpoints that do not meet the previously stated criteria are considered endpoints on the Internet. - -### To configure a GPO that defines your intranet address space - -1. Open the Group Policy Management snap-in (gpmc.msc), right click on the Group Policy you want to use to define your address space, and select **Edit**. -1. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Administrative Templates**, expand **Network**, and click **Network Isolation**. -1. In the right pane, double-click **Private network ranges for apps**. -1. In the **Private network ranges for apps** dialog box, click **Enabled**. In the **Private subnets** text box, type the private subnets for your intranet, separated by commas if necessary. - For example, if the Contoso intranet is defined as 10.0.0.0 with a subnet mask of 255.255.255.0, you would type 10.0.0.0/24 in the **Private subnets** text box. -1. Double-click **Subnet definitions are authoritative**. - - If you want the subnet definitions that you previously created to be the single source for your subnet definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional subnets by using local settings or network isolation heuristics. - -### To configure the proxy addresses for the intranet and Internet - -1. Double-click **Internet proxy servers for apps**. Click **Enabled**, and then in the **Domain Proxies** text box, type the IP addresses of your Internet proxy servers, separated by semicolons. -2. Double-click **Intranet proxy servers for apps**. Click **Enabled**, and then in the IP address text box, type the IP addresses of your intranet proxy servers, separated by semicolons. -3. Double-click **Proxy definitions are authoritative**. - - If you want the proxy definitions that you previously created to be the single source for your proxy definition, click **Enabled**. Otherwise, leave the **Not Configured** default so that you can add additional proxies by using local settings or network isolation heuristics. - -## Step 2: Create custom firewall rules - -Microsoft Store apps can declare many capabilities in addition to the network capabilities discussed previously. For example, apps can declare capabilities to access user identity, the local file system, and certain hardware devices. - -The following table provides a complete list of the possible app capabilities. - -| Capability | Name | Description | -| - | - | - | -| **Internet (Client)** | internetClient | Your outgoing Internet connection.| -| **Internet (Client & Server)** | internetClientServer| Your Internet connection, including incoming unsolicited connections from the Internet The app can send information to or from your device through a firewall. You do not need to declare **internetClient** if this capability is declared.| -| **Home\Work Networking** |privateNetworkClientServer| A home or work network. The app can send information to or from your device and other devices on the same network.| -| **Document Library Access**| documentsLibrary| Your Documents library, including the capability to add, change, or delete files. The package can only access file types that are declared in the manifest.| -| **Picture Library Access**| picturesLibrary| Your Pictures library, including the capability to add, change, or delete files.| -| **Video Library Access**| videosLibrary| Your Videos library, including the capability to add, change, or delete files.| -| **Music Library Access**| musicLibrary|Your Music library, including the capability to add, change, or delete files.| -| **Default Windows Credentials**| defaultWindowsCredentials| Your Windows credentials for access to a corporate intranet. This application can impersonate you on the network.| -| **Removable Storage** | removableStorage| A removable storage device, such as an external hard disk, USB flash drive, or MTP portable device, including the capability to add, change, or delete specific files. This package can only access file types that are declared in the manifest.| -| **Shared User Certificates**| sharedUserCertificates| Software and hardware certificates or a smart card, which the app uses to identify you. This capability can be used by an employer, a bank, or government services to identify you.| -| **Location**| location| Provides access to the user's current location.| -| **Microphone** | microphone| Provides access to the microphone's audio feed.| -| **Near-field Proximity** | proximity| Required for near-field communication (NFC) between devices in close proximity. NFC can be used to send files or connect with an app on a proximate device.| -| **Text Messaging** | sms| Provides access to text messaging functionality.| -| **Webcam** | webcam| Provides access to the webcam's video feed.| -| **Other devices (represented by GUIDs)** | <GUID>| Includes specialized devices and Windows Portable Devices.| - -You can create a Windows Defender Firewall policy that is scoped to a set of apps that use a specified capability or scoped to a specific Microsoft Store app. - -For example, you could create a Windows Defender Firewall policy to block Internet access for any apps on your network that have the Documents Library capability. - -### To block Internet access for any apps on your network that have the Documents Library capability - -1. Open the Group Policy Management snap-in (gpmc.msc). -1. In the left pane, right-click your domain name and click **Create a GPO in this domain, and link it here**. -1. Type a name for the GPO in the **Name** text box, and then click **OK**. -1. Right-click the new GPO, and then click **Edit**. -1. In the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall with Advanced Security**, and click **Windows Defender Firewall - LDAP://…** -1. Right-click **Outbound Rules**, and then click **New Rule**. -1. Click **Custom**, and then click **Next**. -1. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. -1. On the **Action** page, ensure that **Block the Connection** is selected, and then click **Next**. -1. On the **Profile** page, click **Next**. -1. On the **Name** page, type a name for your rule, and then click **Finish**. -1. In the right pane, right-click your new rule and click **Properties**. -1. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. -1. Click **Application Package Properties**, and then click **OK**. -1. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\Your documents library**, and then click **OK**. -1. Click the **Scope** tab under **Remote IP addresses**, and then click **Add**. -1. Click **Predefined set of computers**, select **Internet**, and click **OK**. - - This scopes the rule to block traffic to Internet devices. - -1. Click the **Programs and Services** tab, and in the **Application Packages** area, click **Settings**. -1. Click **Apply to application packages only**, and then click **OK**. - - > [!IMPORTANT] - > You must do this to ensure that the rule applies only to Microsoft Store apps and not to other apps. Desktop apps declare all capabilities by default, and this rule would apply to them if you do not configure it this way. - -1. Click **OK** to close the **Properties** dialog box. -1. Close the Group Policy Management Editor. -1. In the Group Policy Management snap-in, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**. Click **Remove**, and then click **OK**. -1. Under **Security Filtering**, click **Add**. -1. Type **domain computers** in the text box, and then click **OK**. -1. Close the Group Policy Management snap-in. - -Use the following procedure if you want to block intranet access for a specific media sharing app on your network. - -### To block intranet access for a specific media sharing app on your network - -1. Open the Group Policy Management snap-in (gpmc.msc). -1. In the left pane, right-click your domain name, and then click **Create a GPO in this domain, and link it here**. -1. Type a name for your GPO in the **Name** text box, and then click **OK**. -1. Right-click your new GPO, and then click **Edit**. -1. From the Group Policy Management Editor, expand **Computer Configuration**, expand **Policies**, expand **Windows Settings**, expand **Security Settings**, expand **Windows Defender Firewall**, and then click **Windows Defender Firewall – LDAP://**… -1. Right-click **Outbound Rules**, and then click **New Rule**. -1. Click **Custom**, and then click **Next**. -1. Click **Next** on the **Program** page, the **Protocols and Ports** page, and the **Scope** page. -1. On the **Action** page, ensure **Block the Connection** is selected, and then click **Next**. -1. On the **Profile** page, click **Next**. -1. On the **Name** page, type a name for your rule, and then click **Finish**. -1. In the right pane, right-click your new rule, and then click **Properties**. -1. Click the **Local Principals** tab, select the **Only allow connections from these users** check box, and then click **Add**. -1. Click **Application Package Properties**, and then click **OK**. -1. In the **Choose Capabilities** dialog box, click **APPLICATION PACKAGE AUTHORITY\\A home or work network**, and then click **OK**. -1. Click the **Programs and Services** tab under **Application Packages**, and then click **Settings**. -1. Click **Apply to this application package**, select the app in the text box, and then click **OK**. -1. Click **OK** to close the **Properties** dialog box. -1. Close the Group Policy Management Editor. -1. In Group Policy Management, ensure that your new GPO is selected, and in the right pane under **Security Filtering**, select **Authenticated Users**, click **Remove**, and then click **OK**. -1. Under **Security Filtering**, click **Add**. -1. Type **domain computers** in the text box and click **OK**. -1. Close Group Policy Management. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 7e3878d4ea..c20be0d3c1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -15,8 +15,6 @@ items: href: configure-logging.md - name: Hyper-V firewall href: hyper-v-firewall.md - - name: Isolate Microsoft Store apps on your network - href: isolating-apps-on-your-network.md - name: Troubleshoot items: - name: Troubleshoot UWP app connectivity issues in Windows Firewall From 3e1e32dd0c1b7abbecddff9830a94a56ad8cd559 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 09:13:41 -0500 Subject: [PATCH 176/237] upates --- ...blishing.redirection.windows-security.json | 5 +++ .../windows-firewall/configure.md | 31 ++++------------ .../windows-firewall/index.md | 37 ++++++++++++++++++- .../network-security/windows-firewall/toc.yml | 4 +- 4 files changed, 49 insertions(+), 28 deletions(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 8ebfb05ade..0e9908a375 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -8019,6 +8019,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/isolating-apps-on-your-network.md", "redirect_url": "/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831418(v=ws.11)", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-logging", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 27b0a9b510..faaf95253c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -83,22 +83,6 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::row-end::: -## Network profiles - -Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign Firewall rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. - -### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network - -The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. - -### :::image type="icon" source="images/private-network.svg" border="false"::: Private network - -The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. - -### :::image type="icon" source="images/public-network.svg" border="false"::: Public network - -The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. - ## Firewall rules In many cases, a first step for administrators is to customize the firewall profiles using *rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. @@ -128,7 +112,7 @@ A general security recommended practice when creating inbound rules is to be as > [!NOTE] > Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described. -## Create rules for new applications +### Create rules for new applications When first installed, networked applications and services issue a *listen call* specifying the protocol/port information required for them to function properly. Since there's a default *block* action in Windows Firewall, you must create inbound exception rules to allow the traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. @@ -244,24 +228,23 @@ What follows are a few general guidelines for configuring outbound rules. When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. -## Configure Windows Firewall rules with WDAC tagging policies +## WDAC tagging policies Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: ### Step 1: Deploy WDAC AppId Tagging Policies -A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. +A Windows Defender Application Control (WDAC) policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications. ### Step 2: Configure Firewall Rules using PolicyAppId Tags -- **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. +Use one of the two methods below to configure firewall rules using PolicyAppId tags: + +- Deploy firewall rules with Microsoft Intune: when creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. - -OR - -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported. +- Create local firewall rules with PowerShell: you can use [`New-NetFirewallRule`](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` parameter. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 35df7ea708..865abc5760 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -33,9 +33,38 @@ Windows Firewall offers several benefits to address your organization's network [!INCLUDE [windows-firewall](../../../../../includes/licensing/windows-firewall.md)] -## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback +## Concepts -To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WIN+F) and use the category **Security and Privacy** > **Network protection**. +The default behavior of Windows Firewall is to: + +- block all incoming traffic, unless solicited or maching a *rule* +- allow all outgoing traffic, unless matching a *rule* + +*Firewall rules* identify communication to be allowed or blocked, and the conditions for this to happen. The rules offer an extensive selection of conditions to identify traffic, including: + +- source and destination IP addresses +- can make use dynamic values, like default gateway, DHCP servers, DNS servers and local subnets +- protocol name or type +- source and destination TCP or UDP ports +- interface type +- ICMP/ICMPv6 traffic type and code +- rules can apply to any process, any service or spoecific service + +### Firewall profiles + +Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. + +### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network + +The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. + +### :::image type="icon" source="images/private-network.svg" border="false"::: Private network + +The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. + +### :::image type="icon" source="images/public-network.svg" border="false"::: Public network + +The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. ## Next steps @@ -44,6 +73,10 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI > > [Configure Windows Firewall >](configure.md) +## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback + +To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WIN+F) and use the category **Security and Privacy** > **Network protection**. + [FHUB]: feedback-hub:?tabid=2&newFeedback=true diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index c20be0d3c1..d292aa011c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -5,9 +5,9 @@ items: items: - name: Configure Windows Firewall href: configure.md - - name: Configure with Microsoft Intune + - name: Configure rules with Microsoft Intune href: create-windows-firewall-rules-in-intune.md - - name: Configure with group policy + - name: Configure rules with group policy href: configure-rules-with-gpo.md - name: Configure with command line tools href: configure-with-command-line.md From 10c39e69efe796efe1305af1b1cc6e7f93e0484b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 10:22:07 -0500 Subject: [PATCH 177/237] update to /remoteguard tip --- .../security/identity-protection/remote-credential-guard.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 7fee850283..2b0d64ce57 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -2,7 +2,7 @@ title: Remote Credential Guard description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device. ms.topic: how-to -ms.date: 09/06/2023 +ms.date: 11/17/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -130,7 +130,7 @@ reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin To enable Remote Credential Guard on the clients, you can configure a policy that prevents the delegation of credentials to the remote hosts. > [!TIP] -> If you don't want to configure your clients to enforce Remote Credential Guard, you can use the following command to use Remote Credential Guard for a specific RDP session: +> If you don't want to configure your clients to enforce Remote Credential Guard, and if you are an administrator of the remote host, you can use the following command to use Remote Credential Guard for a specific RDP session: > ```cmd > mstsc.exe /remoteGuard > ``` From 7d941d7967892016fe2cbfa7babe78c1fa7ec386 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 10:43:52 -0500 Subject: [PATCH 178/237] updates --- .../windows-firewall/index.md | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 865abc5760..5860ceff3a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -40,6 +40,8 @@ The default behavior of Windows Firewall is to: - block all incoming traffic, unless solicited or maching a *rule* - allow all outgoing traffic, unless matching a *rule* +### Firewall rules + *Firewall rules* identify communication to be allowed or blocked, and the conditions for this to happen. The rules offer an extensive selection of conditions to identify traffic, including: - source and destination IP addresses @@ -54,17 +56,12 @@ The default behavior of Windows Firewall is to: Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. -### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network - -The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. - -### :::image type="icon" source="images/private-network.svg" border="false"::: Private network - -The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. - -### :::image type="icon" source="images/public-network.svg" border="false"::: Public network - -The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. + #### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network + The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. + #### :::image type="icon" source="images/private-network.svg" border="false"::: Private network + The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. + #### :::image type="icon" source="images/public-network.svg" border="false"::: Public network + The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. ## Next steps From 76f48710de17059083d1e9c5922e73f9b3d58af6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 11:11:43 -0500 Subject: [PATCH 179/237] updates --- .../network-security/windows-firewall/index.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 5860ceff3a..9bb4d1e275 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -56,12 +56,17 @@ The default behavior of Windows Firewall is to: Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. - #### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network - The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. - #### :::image type="icon" source="images/private-network.svg" border="false"::: Private network - The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. - #### :::image type="icon" source="images/public-network.svg" border="false"::: Public network - The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. +#### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network + +The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. + +#### :::image type="icon" source="images/private-network.svg" border="false"::: Private network + +The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. + +#### :::image type="icon" source="images/public-network.svg" border="false"::: Public network + +The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. ## Next steps From 3874ba33e450eda2bb1c445f8b0deeff315eb232 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Nov 2023 12:22:01 -0500 Subject: [PATCH 180/237] Update enhanced-phishing-protection.md --- .../enhanced-phishing-protection.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 33e3420817..c944556f3a 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -91,13 +91,13 @@ By default, Enhanced Phishing Protection is deployed in audit mode, preventing n To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen settings. -| Setting | Default Value | Recommendation | -|---------------------------|------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Automatic Data Collection | **Enabled** for domain joined devices or devices enrolled with MDM.
    **Disabled** for all other devices. | **Enabled**: Turns on collection of additional content for security analysis from a suspicious website or app to improve Microsoft's threat intelligence | -| Service Enabled | **Enabled** | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | -| Notify Malicious | **Disabled** for devices onboarded to MDE.
    **Enabled** for all other devices. | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | -| Notify Password Reuse | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | -| Notify Unsafe App | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | +| Setting | Default Value | Recommendation | +|---------------------------|------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Automatic Data Collection | **Disabled** for domain joined devices or devices enrolled with MDM.
    **Enabled** for all other devices. | **Enabled**: Turns on collection of additional content when users enter their work or school password into a suspicious website or app. This information is used only for security purposes and helps SmartScreen determine whether the website or app is malicious. | +| Service Enabled | **Enabled** | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | +| Notify Malicious | **Disabled** for devices onboarded to MDE.
    **Enabled** for all other devices. | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | +| Notify Password Reuse | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | +| Notify Unsafe App | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) From 0cbf91228646d14b263f2b322ef5ef2266dcaa1a Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 12:58:44 -0500 Subject: [PATCH 181/237] updates --- .../windows-firewall/configure-logging.md | 17 ++++++++++--- .../windows-firewall/index.md | 25 +++++++++++++++++++ 2 files changed, 38 insertions(+), 4 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index a809e05f18..edae0460f2 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -123,10 +123,19 @@ If not, add *FullControl* permissions for `mpssvc` to the folder, subfolders and ```PowerShell $LogPath = Join-Path -path $env:windir -ChildPath "System32\LogFiles\Firewall" -$ACL = get-acl -Path $LogPath -$ACL.SetAccessRuleProtection($true, $false) -$RULE = New-Object System.Security.AccessControl.FileSystemAccessRule ("NT SERVICE\mpssvc","FullControl","ContainerInherit,ObjectInherit","None","Allow") -$ACL.AddAccessRule($RULE) +$NewAcl = Get-Acl -Path $LogPath + +$identity = "NT SERVICE\mpssvc" +$fileSystemRights = "FullControl" +$inheritanceFlags = "ContainerInherit,ObjectInherit" +$propagationFlags = "None" +$type = "Allow" + +$fileSystemAccessRuleArgumentList = $identity, $fileSystemRights, $inheritanceFlags, $propagationFlags, $type +$fileSystemAccessRule = New-Object -TypeName System.Security.AccessControl.FileSystemAccessRule -ArgumentList $fileSystemAccessRuleArgumentList + +$NewAcl.SetAccessRule($fileSystemAccessRule) +Set-Acl -Path $LogPath -AclObject $NewAcl ``` Restart the device to restart the *Windows Defender Firewall* service. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 9bb4d1e275..ea2523b73d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -56,6 +56,31 @@ The default behavior of Windows Firewall is to: Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. +:::row::: + :::column span="1"::: + #### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network + :::column-end::: + :::column span="3"::: + The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. + :::column-end::: +:::row-end::: +:::row::: + :::column span="1"::: + #### :::image type="icon" source="images/private-network.svg" border="false"::: Private network + :::column-end::: + :::column span="3"::: + The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. + :::column-end::: +:::row-end::: +:::row::: + :::column span="1"::: + #### :::image type="icon" source="images/public-network.svg" border="false"::: Public network + :::column-end::: + :::column span="3"::: + The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. + :::column-end::: +:::row-end::: + #### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. From 35fbdbb3fd5f2d6154bdb9c4d98a014f4279261b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 13:14:56 -0500 Subject: [PATCH 182/237] updates --- .../network-security/windows-firewall/configure.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index faaf95253c..de812d418b 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -7,13 +7,15 @@ ms.topic: best-practice # Configure Windows Firewall +This article describes the available tools to configure Windows Firewall and some recommended practices. + ## Configuration tools Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services: - [Windows Security](#windows-security) - [Control Panel](#control-panel) -- [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) +- Windows Defender Firewall with Advanced Security and its integration with the [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) - [Configuration Service Provider (CSP)](#configuration-service-provider-csp) - [Command line tools](#command-line-tools) From e5ff07b55fbf11c5d7d515e390b6bec10b959e57 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 17 Nov 2023 15:32:41 -0500 Subject: [PATCH 183/237] Remove white glove from articles --- windows/deployment/deploy-whats-new.md | 89 +++++++++--------- .../tpm/tpm-recommendations.md | 4 +- .../whats-new-windows-10-version-1903.md | 92 ++++++++++--------- 3 files changed, 93 insertions(+), 92 deletions(-) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index f878a7d748..a4b40f6fe6 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -11,16 +11,14 @@ ms.topic: conceptual ms.collection: - highpri - tier2 -ms.date: 11/23/2022 +ms.date: 11/17/2023 +appliesto: + - ✅ Windows 11 + - ✅ Windows 10 --- # What's new in Windows client deployment -*Applies to:* - -- Windows 10 -- Windows 11 - This article provides an overview of new solutions and online content related to deploying Windows client in your organization. - For an all-up overview of new features in Windows 10, see [What's new in Windows 10](/windows/whats-new/index). @@ -41,33 +39,32 @@ The [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is a ## Deployment tools -[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later, and Windows 11.
    -New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).
    -VPN support is added to [Windows Autopilot](#windows-autopilot)
    -An in-place upgrade wizard is available in [Configuration Manager](#microsoft-configuration-manager).
    -The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with more content added and more content coming soon.
    +- [SetupDiag](#setupdiag) is included with all currently supported versions of Windows. +- New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business). +- VPN support is added to [Windows Autopilot](#windows-autopilot). +- An in-place upgrade wizard is available in [Configuration Manager](#microsoft-configuration-manager). ## The Modern Desktop Deployment Center -The [Modern Desktop Deployment Center](/microsoft-365/enterprise/desktop-deployment-center-home) has launched with tons of content to help you with large-scale deployment of Windows 10 and Microsoft 365 Apps for enterprise. +The [Modern Desktop Deployment Center](/microsoft-365/enterprise/desktop-deployment-center-home) has content to help you with large-scale deployment of supported version of Windows and Microsoft 365 Apps for enterprise. ## Microsoft 365 Microsoft 365 is a new offering from Microsoft that combines -- Windows 10 -- Office 365 +- A currently supported version of Windows. +- Office 365. - Enterprise Mobility and Security (EMS). -See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, which now includes a link to download a nifty [Microsoft 365 Enterprise poster](deploy-m365.md#microsoft-365-enterprise-poster). +See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, which now includes a link to download a [Microsoft 365 Enterprise poster](deploy-m365.md#microsoft-365-enterprise-poster). -## Windows 10 servicing and support +## Windows servicing and support ### Delivery Optimization -Windows PowerShell cmdlets for Delivery Optimization have been improved: +Windows PowerShell cmdlets for Delivery Optimization is improved: -- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peek behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent). +- **Get-DeliveryOptimizationStatus** has the **-PeerInfo** option for a real-time peek behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent). - **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections. - **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to help in troubleshooting. @@ -90,18 +87,18 @@ The following Delivery Optimization policies are removed in the Windows 10, vers [Windows Update for Business](./update/waas-manage-updates-wufb.md) enhancements in this release include: -- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. -- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we've created a new policy that enables admins to opt devices out of the built-in safeguard holds. +- **Intune console updates**: target version is now available allowing you to specify which supported version of Windows you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. +- **Validation improvements**: To ensure devices and end users stay productive and protected, Microsoft blocks devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, a new policy is available that enables admins to opt devices out of the built-in safeguard holds. -- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows will automatically sign in as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. -- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows automatically signs in as the user and locks their device in order to complete the update. This automatic sign-on ensures that when the user returns and unlocks the device, the update is completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There's now a single, common start date for phased deployments (no more SAC-T designation). In addition, there's a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. -- **Pause updates**: We've extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you'll need to update your device before pausing again. -- **Improved update notifications**: When there's an update requiring you to restart your device, you'll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Pause updates**: The ability to pause updates for both feature and monthly updates is extended. This extension ability is for all currently supported editions of Windows, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, the device needs to update before pausing again. +- **Improved update notifications**: When there's an update requiring you to restart your device, a colored dot appears on the Power button in the Start menu and on the Windows icon in the taskbar. - **Intelligent active hours**: To further enhance active hours, users now can let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. -- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. +- **Improved update orchestration to improve system responsiveness**: This feature improves system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. -Microsoft previously announced that we're [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. These editions include all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Microsoft 365 Apps for enterprise will continue to be supported for 18 months (there's no change for these editions). These support policies are summarized in the table below. +Microsoft previously announced that we're [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. These editions include all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Microsoft 365 Apps for enterprise will continue to be supported for 18 months (there's no change for these editions). These support policies are summarized in the following table: ![Support lifecycle.](images/support-cycle.png) @@ -119,17 +116,17 @@ For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterpris [Windows Autopilot](/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose, and recover devices. -With the release of Windows 10, version 2004 you can configure [Windows Autopilot user-driven](/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903. +With the release of Windows 10, version 2004 you can configure [Windows Autopilot user-driven](/windows/deployment/windows-autopilot/user-driven) Microsoft Entra hybrid join with VPN support. -If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, these language settings were only supported with self-deploying profiles. +If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios now skip the language, locale, and keyboard pages. In previous versions, these language settings were only supported with self-deploying profiles. The following Windows Autopilot features are available in Windows 10, version 1903 and later: -- [Windows Autopilot for white glove deployment](/windows/deployment/windows-autopilot/white-glove) is new in Windows 10, version 1903. "White glove" deployment enables partners or IT staff to pre-provision devices so they're fully configured and business ready for your users. +- [Windows Autopilot for pre-provisioned deployment](/autopilot/pre-provision) is new in Windows 10, version 1903. Pre-provisioned deployment enables partners or IT staff to pre-provision devices so they're fully configured and business ready for your users. - The Intune [enrollment status page](/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. - [Cortana voiceover](/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- Windows Autopilot is self-updating during OOBE. From Windows 10 onward, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the [diagnostics data](/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. +- Windows Autopilot is self-updating during OOBE. From Windows 10 onward, version 1903 Autopilot functional and critical updates begin downloading automatically during OOBE. +- Windows Autopilot sets the [diagnostics data](/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. ### Microsoft Configuration Manager @@ -137,25 +134,21 @@ An in-place upgrade wizard is available in Configuration Manager. For more infor ### Windows 10 Subscription Activation -Windows 10 Education support has been added to Windows 10 Subscription Activation. +Windows 10 Education support is added to Windows 10 Subscription Activation. With Windows 10, version 1903, you can step up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions - Windows 10 Education. For more information, see [Windows 10 Subscription Activation](./windows-10-subscription-activation.md). ### SetupDiag -[SetupDiag](upgrade/setupdiag.md) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When log files are being searched, SetupDiag uses a set of rules to match known issues. +[SetupDiag](upgrade/setupdiag.md) is a command-line tool that can help diagnose why an update of Windows failed. SetupDiag works by searching Windows Setup log files. When log files are being searched, SetupDiag uses a set of rules to match known issues. -In Windows 10, version 2004, SetupDiag is now automatically installed. - -During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there's an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup. +During the upgrade process, Windows Setup extracts all its sources files to the `%SystemDrive%\$Windows.~bt\Sources` directory. **SetupDiag.exe** is also installed to this directory. If there's an issue with the upgrade, SetupDiag automatically runs to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under `%SystemDrive%\Windows.Old` for cleanup. ### Upgrade Readiness -The Upgrade Readiness tool moved from public preview to general availability on March 2, 2017. +Upgrade Readiness helps you ensure that applications and drivers are ready for an upgrade of Windows. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. -Upgrade Readiness helps you ensure that applications and drivers are ready for a Windows 10 upgrade. The solution provides up-to-date application and driver inventory, information about known issues, troubleshooting guidance, and per-device readiness and tracking details. - -The development of Upgrade Readiness has been heavily influenced by input from the community; the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. +Input from the community heavily influenced the development of Upgrade Readiness and the development of new features is ongoing. To begin using Upgrade Readiness, add it to an existing Operation Management Suite (OMS) workspace or sign up for a new OMS workspace with the Upgrade Readiness solution enabled. For more information about Upgrade Readiness, see the following articles: @@ -164,7 +157,7 @@ For more information about Upgrade Readiness, see the following articles: ### Update Compliance -Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date. +Update Compliance helps you to keep supported Windows devices in your organization secure and up-to-date. Update Compliance is a solution built using OMS Logs and Analytics that provides information about installation status of monthly quality and feature updates. Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. @@ -178,25 +171,29 @@ Device Health is the newest Windows Analytics solution that complements the exis MBR2GPT.EXE converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. Previously, it was necessary to image, then wipe and reload a disk to change from MBR format to GPT. -There are many benefits to converting the partition style of a disk to GPT, including the use of larger disk partitions, added data reliability, and faster boot and shutdown speeds. The GPT format also enables you to use the Unified Extensible Firmware Interface (UEFI) which replaces the Basic Input/Output System (BIOS) firmware interface. Security features of Windows 10 that require UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. +There are many benefits to converting the partition style of a disk to GPT, including the use of larger disk partitions, added data reliability, and faster boot and shutdown speeds. The GPT format also enables you to use the Unified Extensible Firmware Interface (UEFI) which replaces the Basic Input/Output System (BIOS) firmware interface. Security features of supported versions of Windows that require UEFI mode include: Secure Boot, Early Launch Anti-malware (ELAM) driver, Windows Trusted Boot, Measured Boot, Device Guard, Credential Guard, and BitLocker Network Unlock. For more information, see [MBR2GPT.EXE](mbr-to-gpt.md). ### Microsoft Deployment Toolkit (MDT) -MDT version 8456 supports Windows 10, version 2004 and earlier operating systems, including Windows Server 2019. There's currently an issue that causes MDT to incorrectly detect that UEFI is present in Windows 10, version 2004. This issue is currently under investigation. +MDT version 8456 supports Windows 10, version 2004 and earlier operating systems, including Windows Server 2019. For the latest information about MDT, see the [MDT release notes](/mem/configmgr/mdt/release-notes). +> [!IMPORTANT] +> +> MDT doesn't support Windows 11 or Windows Server 2022. + ### Windows Assessment and Deployment Kit (ADK) -The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. +IT Pros can use the tools in the Windows Assessment and Deployment Kit (Windows ADK) to deploy Windows. Download the Windows ADK and Windows PE add-on for Windows 11 [here](/windows-hardware/get-started/adk-install). For information about what's new in the ADK, see [What's new in the Windows ADK](/windows-hardware/get-started/what-s-new-in-kits-and-tools). -Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). +Also see [Windows ADK for Windows scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). ## Testing and validation guidance @@ -212,7 +209,7 @@ For more information, see the following guides: ## Troubleshooting guidance -[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and will continue to be updated with new fixes. The article provides a detailed explanation of the Windows 10 upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. +[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and continues to be updated with new fixes. The article provides a detailed explanation of the Windows upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process. ## Related articles diff --git a/windows/security/hardware-security/tpm/tpm-recommendations.md b/windows/security/hardware-security/tpm/tpm-recommendations.md index d9a7ce1a95..890449ba6c 100644 --- a/windows/security/hardware-security/tpm/tpm-recommendations.md +++ b/windows/security/hardware-security/tpm/tpm-recommendations.md @@ -2,7 +2,7 @@ title: TPM recommendations description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows. ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 11/17/2023 ms.collection: - tier1 --- @@ -108,7 +108,7 @@ The following table defines which Windows features require TPM support. TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes Virtual Smart Card | Yes | Yes | Yes Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. - Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. + Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM, such as pre-provisioned deployment and self-deploying mode, then TPM 2.0 and UEFI firmware are required. SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. ## OEM Status on TPM 2.0 system availability and certified parts diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index f4005118e9..fe15f84332 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -9,18 +9,19 @@ ms.localizationpriority: medium ms.topic: article ROBOTS: NOINDEX ms.technology: itpro-fundamentals -ms.date: 12/31/2017 +ms.date: 11/17/2023 --- # What's new in Windows 10, version 1903 for IT Pros **Applies to** -- Windows 10, version 1903 +- Windows 10, version 1903 This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. >[!NOTE] ->New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don’t meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage). +> +>New disk space requirement for Windows 10, version 1903 applies only to OEMs for the manufacture of new PCs. This new requirement does not apply to existing devices. PCs that don't meet new device disk space requirements will continue to receive updates and the 1903 update will require about the same amount of free disk space as previous updates. For more information, see [Reserved storage](#reserved-storage). ## Deployment @@ -28,36 +29,36 @@ This article lists new and updated features and content that are of interest to [Windows Autopilot](/windows/deployment/windows-autopilot/windows-autopilot) is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. The following Windows Autopilot features are available in Windows 10, version 1903 and later: -- [Windows Autopilot for white glove deployment](/windows/deployment/windows-autopilot/white-glove) is new in this version of Windows. "White glove" deployment enables partners or IT staff to pre-provision devices so they're fully configured and business ready for your users. -- The Intune [enrollment status page](/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions​. +- [Windows Autopilot for pre-provisioned deployment](/autopilot/pre-provision) is new in this version of Windows. Pre-provisioned deployment enables partners or IT staff to pre-provision devices so they're fully configured and business ready for your users. +- The Intune [enrollment status page](/intune/windows-enrollment-status) (ESP) now tracks Intune Management Extensions. - [Cortana voiceover](/windows-hardware/customize/desktop/cortana-voice-support) and speech recognition during OOBE is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs. -- Windows Autopilot is self-updating during OOBE. From Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE. -- Windows Autopilot will set the [diagnostics data](/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. +- Windows Autopilot is self-updating during OOBE. From Windows 10, version 1903 Autopilot functional and critical updates begin downloading automatically during OOBE. +- Windows Autopilot sets the [diagnostics data](/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE. ### SetupDiag -[SetupDiag](/windows/deployment/upgrade/setupdiag) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When log files are being searched, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file will be updated as new versions of SetupDiag are made available. +[SetupDiag](/windows/deployment/upgrade/setupdiag) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When log files are being searched, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file are updated as new versions of SetupDiag are made available. ### Reserved storage -[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage will be enabled automatically on new PCs with Windows 10, version 1903 or later pre-installed, and for clean installs. It will not be enabled when updating from a previous version of Windows 10. +[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage is enabled automatically on new PCs with Windows 10, version 1903 or later pre-installed, and for clean installs. It isn't enabled when updating from a previous version of Windows 10. ## Servicing - [**Delivery Optimization**](/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with [new policies](/windows/client-management/mdm/policy-csp-deliveryoptimization). These new policies now support Microsoft 365 Apps for enterprise updates and Intune content. -- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows will automatically sign in as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed. -- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. +- [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows automatically signs in as the user and lock their device in order to complete the update. This automatic sign-in ensures that when the user returns and unlocks the device, the update is completed. +- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There's now a single, common start date for phased deployments (no more SAC-T designation). In addition, there's a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device backed up and run normally. -- **Pause updates**: We've extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you'll need to update your device before pausing again. -- **Improved update notifications**: When there’s an update requiring you to restart your device, you’ll see a colored dot on the Power button in the Start menu and on the Windows icon in your taskbar. -- **Intelligent active hours**: To further enhance active hours, users will now be able to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. -- **Improved update orchestration to improve system responsiveness**: This feature will improve system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. +- **Pause updates**: The ability to pause updates for both feature and monthly updates is extended. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, the device needs to be updated before pausing again. +- **Improved update notifications**: When there's an update requiring you to restart your device, a colored dot appears on the Power button in the Start menu and on the Windows icon in your taskbar. +- **Intelligent active hours**: To further enhance active hours, users are now able to let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. +- **Improved update orchestration to improve system responsiveness**: This feature improves system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. ## Security ### Windows Information Protection -With this release, Microsoft Defender for Endpoint extends discovery and protection of sensitive information with [Auto Labeling](/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files). +With this release, Microsoft Defender for Endpoint extends discovery and protection of sensitive information with [Auto Labeling](/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels#how-wip-protects-automatically-classified-files). ### Security configuration framework @@ -73,72 +74,75 @@ The draft release of the [security configuration baseline settings](/archive/blo ### Microsoft Defender for Endpoint -- [Attack surface area reduction](/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) – IT admins can configure devices with advanced web protection that enables them to define allowlists and blocklists for specific URL’s and IP addresses. -- [Next generation protection](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10) – Controls have been extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. - - Integrity enforcement capabilities – Enable remote runtime attestation of Windows 10 platform. - - Tamper-proofing capabilities – Uses virtualization-based security to isolate critical Microsoft Defender for Endpoint security capabilities away from the OS and attackers. -- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) – In addition to Windows 10, Microsoft Defender for Endpoint’s functionality has been extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. +- [Attack surface area reduction](/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) - IT admins can configure devices with advanced web protection that enables them to define allowlists and blocklists for specific URLs and IP addresses. +- [Next generation protection](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-in-windows-10) - Controls are extended to protection from ransomware, credential misuse, and attacks that are transmitted through removable storage. + - Integrity enforcement capabilities - Enable remote runtime attestation of Windows 10 platform. + - Tamper-proofing capabilities - Uses virtualization-based security to isolate critical Microsoft Defender for Endpoint security capabilities away from the OS and attackers. +- [Platform support](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114) - In addition to Windows 10, Microsoft Defender for Endpoint's functionality are extended to support Windows 7 and Windows 8.1 clients, as well as macOS, Linux, and Windows Server with both its Endpoint Detection (EDR) and Endpoint Protection Platform (EPP) capabilities. -### Microsoft Defender for Endpoint next-gen protection technologies: +### Microsoft Defender for Endpoint next-gen protection technologies - **Advanced machine learning**: Improved with advanced machine learning and AI models that enable it to protect against apex attackers using innovative vulnerability exploit techniques, tools and malware. -- **Emergency outbreak protection**: Provides emergency outbreak protection that will automatically update devices with new intelligence when a new outbreak has been detected. -- **Certified ISO 27001 compliance**: Ensures that the cloud service has analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place. +- **Emergency outbreak protection**: Provides emergency outbreak protection that automatically updates devices with new intelligence when a new outbreak is detected. +- **Certified ISO 27001 compliance**: Ensures that the cloud service is analyzed for threats, vulnerabilities and impacts, and that risk management and security controls are in place. - **Geolocation support**: Support geolocation and sovereignty of sample data and configurable retention policies. ### Threat Protection - [Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849): Isolated desktop environment where you can run untrusted software without the fear of lasting impact to your device. -- [Microphone privacy settings](https://support.microsoft.com/en-us/help/4468232/windows-10-camera-microphone-and-privacy-microsoft-privacy): A microphone icon appears in the notification area letting you see which apps are using your microphone. +- [Microphone privacy settings](https://support.microsoft.com/windows/windows-camera-microphone-and-privacy-a83257bc-e990-d54a-d212-b5e41beba857): A microphone icon appears in the notification area letting you see which apps are using your microphone. -- [Windows Defender Application Guard](/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements: +- [Windows Defender Application Guard](/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) enhancements: - Standalone users can install and configure their Windows Defender Application Guard settings without needing to change Registry key settings. Enterprise users can check their settings to see what their administrators have configured for their machines to better understand the behavior. - WDAG is now an extension in Google Chrome and Mozilla Firefox. Many users are in a hybrid browser environment, and would like to extend WDAG’s browser isolation technology beyond Microsoft Edge. In the latest release, users can install the WDAG extension in their Chrome or Firefox browsers. This extension will redirect untrusted navigation to the WDAG Edge browser. There's also a companion app to enable this feature in the Microsoft Store. Users can quickly launch WDAG from their desktop using this app. This feature is also available in Windows 10, version 1803 or later with the latest updates. - To try this extension: + To try this extension: 1. Configure WDAG policies on your device. 2. Go to the Chrome Web Store or Firefox Add-ons and search for Application Guard. Install the extension. 3. Follow any of the other configuration steps on the extension setup page. 4. Reboot the device. 5. Navigate to an untrusted site in Chrome and Firefox. - - WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users will automatically be redirected to their host default browser when they enter or click on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates. + - WDAG allows dynamic navigation: Application Guard now allows users to navigate back to their default host browser from the WDAG Microsoft Edge. Previously, users browsing in WDAG Edge would see an error page when they try to go to a trusted site within the container browser. With this new feature, users are automatically redirected to their host default browser when they enter or select on a trusted site in WDAG Edge. This feature is also available in Windows 10, version 1803 or later with the latest updates. - [Windows Defender Application Control (WDAC)](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903, Windows Defender Application Control has many new features that light up key scenarios and provide feature parity with AppLocker. - - [Multiple Policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): Windows Defender Application Control now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy. - - [Path-Based Rules](/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, Windows Defender Application Control has an option that allows admins to enforce at runtime that only code from paths that aren't user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it's authorized by something other than a path rule like a signer or hash rule.
    - This functionality brings WDAC to parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that isn't available with AppLocker. - - [Allow COM Object Registration](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, Windows Defender Application Control enforced a built-in allowlist for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where more COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. + - [Multiple Policies](/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): Windows Defender Application Control now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: + 1. Enforce and audit side-by-side. + 1. Simpler targeting for policies with different scope/intent. + 1. expanding a policy using a new supplemental policy. + - [Path-Based Rules](/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, Windows Defender Application Control has an option that allows admins to enforce at runtime that only code from paths that aren't user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files are checked for write permissions for unknown admins. If a file is found to be user writeable, the system blocks the executable from running unless it receives authorization from a source other than a path rule, such as a signer or hash rule. + - This functionality brings WDAC to parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time. This capability isn't available with AppLocker. + - [Allow COM Object Registration](/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, Windows Defender Application Control enforced a built-in allowlist for COM object registration. While this mechanism works for most common application usage scenarios, customers provided feedback that there are cases where more COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. #### System Guard -[System Guard](/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has added a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner - specifically, OS memory and secrets are protected from SMM. There are currently no devices out there with compatible hardware, but they'll be coming out in the next few months. +[System Guard](/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) has a new feature in this version of Windows called **SMM Firmware Measurement**. This feature is built on top of [System Guard Secure Launch](/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) to check that the System Management Mode (SMM) firmware on the device is operating in a healthy manner. Specifically, OS memory and secrets are protected from SMM. -This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: +This new feature is displayed under the Device Security page with the string `Your device exceeds the requirements for enhanced hardware security` if configured properly: ![System Guard.](images/system-guard.png "SMM Firmware Measurement") ### Identity Protection -- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less sign-in for websites supporting FIDO2 authentication, such as Microsoft account and Azure AD. +- [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less sign-in for websites supporting FIDO2 authentication, such as Microsoft account and Microsoft Entra ID. - [Streamlined Windows Hello PIN reset experience](/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. - Sign-in with [Password-less](/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! -- [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop#remote-desktop-with-biometrics): Azure Active Directory and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. +- [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop#remote-desktop-with-biometrics): Microsoft Entra ID and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. ### Security management -- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes. -- [Windows Security app](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations. +- [Windows Defender Firewall now supports Windows Subsystem for Linux (WSL)](https://blogs.windows.com/windowsexperience/2018/04/19/announcing-windows-10-insider-preview-build-17650-for-skip-ahead/#II14f7VlSBcZ0Gs4.97): Lets you add rules for WSL process, just like for Windows processes. +- [Windows Security app](/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center) improvements now include Protection history, including detailed and easier to understand information about threats and available actions, Controlled Folder Access blocks are now in the Protection history, Windows Defender Offline Scanning tool actions, and any pending recommendations. - [Tamper Protection](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection) lets you prevent others from tampering with important security features. ## Microsoft Edge -Several new features are coming in the next version of Edge. For more information, see the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97). +Several new features are coming in the next version of Microsoft Edge. For more information, see the [news from Build 2019](https://blogs.windows.com/msedgedev/2019/05/06/edge-chromium-build-2019-pwa-ie-mode-devtools/#2QJF4u970WjQ2Sv7.97). ## See Also -[What's New in Windows Server, version 1903](/windows-server/get-started/whats-new-in-windows-server-1903-1909): New and updated features in Windows Server.
    -[Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features.
    -[What's New in Windows 10](./index.yml): See what’s new in other versions of Windows 10.
    -[What's new in Windows 10](/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
    -[What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers. +- [What's New in Windows Server, version 1903](/windows-server/get-started/whats-new-in-windows-server-1903-1909): New and updated features in Windows Server. +- [Windows 10 Features](https://www.microsoft.com/windows/features): Review general information about Windows 10 features. +- [What's New in Windows 10](./index.yml): See what's new in other versions of Windows 10. +- [What's new in Windows 10](/windows-hardware/get-started/what-s-new-in-windows): See what's new in Windows 10 hardware. +- [What's new in Windows 10 for developers](https://blogs.windows.com/buildingapps/2019/04/18/start-developing-on-windows-10-may-2019-update-today/#2Lp8FUFQ3Jm8KVcq.97): New and updated features in Windows 10 that are of interest to developers. From db920dcafdaefddf965323ee5c8c0f62369c27c2 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 17 Nov 2023 15:59:58 -0500 Subject: [PATCH 184/237] Remove white glove from articles 2 --- windows/deployment/deploy-whats-new.md | 52 +++++++++++-------- .../whats-new-windows-10-version-1903.md | 8 +-- 2 files changed, 33 insertions(+), 27 deletions(-) diff --git a/windows/deployment/deploy-whats-new.md b/windows/deployment/deploy-whats-new.md index a4b40f6fe6..d42a253d04 100644 --- a/windows/deployment/deploy-whats-new.md +++ b/windows/deployment/deploy-whats-new.md @@ -31,11 +31,10 @@ When you deploy Windows 11 with Autopilot, you can enable users to view addition Check out the following new articles about Windows 11: -- [Overview of Windows 11](/windows/whats-new/windows-11) -- [Plan for Windows 11](/windows/whats-new/windows-11-plan) -- [Prepare for Windows 11](/windows/whats-new/windows-11-prepare) - -The [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is available.
    +- [Overview of Windows 11](/windows/whats-new/windows-11). +- [Plan for Windows 11](/windows/whats-new/windows-11-plan). +- [Prepare for Windows 11](/windows/whats-new/windows-11-prepare). +- [Windows ADK for Windows 11](/windows-hardware/get-started/adk-install) is available. ## Deployment tools @@ -50,7 +49,7 @@ The [Modern Desktop Deployment Center](/microsoft-365/enterprise/desktop-deploym ## Microsoft 365 -Microsoft 365 is a new offering from Microsoft that combines +Microsoft 365 is a new offering from Microsoft that combines: - A currently supported version of Windows. - Office 365. @@ -76,26 +75,33 @@ Other improvements in [Delivery Optimization](./do/waas-delivery-optimization.md The following Delivery Optimization policies are removed in the Windows 10, version 2004 release: -- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth) - - Reason: Replaced with separate policies for foreground and background -- Max Upload Bandwidth (DOMaxUploadBandwidth) +- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth). + - Reason: Replaced with separate policies for foreground and background. +- Max Upload Bandwidth (DOMaxUploadBandwidth). - Reason: impacts uploads to internet peers only, which isn't used in enterprises. -- Absolute max throttle (DOMaxDownloadBandwidth) - - Reason: separated to foreground and background +- Absolute max throttle (DOMaxDownloadBandwidth). + - Reason: separated to foreground and background. ### Windows Update for Business [Windows Update for Business](./update/waas-manage-updates-wufb.md) enhancements in this release include: - **Intune console updates**: target version is now available allowing you to specify which supported version of Windows you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy. + - **Validation improvements**: To ensure devices and end users stay productive and protected, Microsoft blocks devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, a new policy is available that enables admins to opt devices out of the built-in safeguard holds. - [**Automatic Restart Sign-on (ARSO)**](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-): Windows automatically signs in as the user and locks their device in order to complete the update. This automatic sign-on ensures that when the user returns and unlocks the device, the update is completed. + - [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There's now a single, common start date for phased deployments (no more SAC-T designation). In addition, there's a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period. + - **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally. + - **Pause updates**: The ability to pause updates for both feature and monthly updates is extended. This extension ability is for all currently supported editions of Windows, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, the device needs to update before pausing again. + - **Improved update notifications**: When there's an update requiring you to restart your device, a colored dot appears on the Power button in the Start menu and on the Windows icon in the taskbar. + - **Intelligent active hours**: To further enhance active hours, users now can let Windows Update intelligently adjust active hours based on their device-specific usage patterns. You must enable the intelligent active hours feature for the system to predict device-specific usage patterns. + - **Improved update orchestration to improve system responsiveness**: This feature improves system performance by intelligently coordinating Windows updates and Microsoft Store updates, so they occur when users are away from their devices to minimize disruptions. Microsoft previously announced that we're [extending support](https://www.microsoft.com/microsoft-365/blog/2018/09/06/helping-customers-shift-to-a-modern-desktop) for Windows 10 Enterprise and Windows 10 Education editions to 30 months from the version release date. These editions include all past versions and future versions that are targeted for release in September (versions ending in 09, ex: 1809). Future releases that are targeted for release in March (versions ending in 03, ex: 1903) will continue to be supported for 18 months from their release date. All releases of Windows 10 Home, Windows 10 Pro, and Microsoft 365 Apps for enterprise will continue to be supported for 18 months (there's no change for these editions). These support policies are summarized in the following table: @@ -108,7 +114,7 @@ Windows 10 version 1703 includes a Windows 10 Enterprise E3 and E5 benefit to Mi Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel on September 1, 2016. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise to their users. With Windows 10 Enterprise E3 in CSP, small and medium-sized organizations can more easily take advantage of Windows 10 Enterprise features. -For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md) +For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). ## Deployment solutions and tools @@ -165,7 +171,7 @@ For more information about Update Compliance, see [Monitor Windows Updates with ### Device Health -Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by helping to identify devices crashes and the cause. Device drivers that are causing crashes are identified along with alternative drivers that might reduce the number of crashes. Windows Information Protection misconfigurations are also identified. For more information, see [Monitor the health of devices with Device Health](/mem/configmgr/desktop-analytics/overview) +Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by helping to identify devices crashes and the cause. Device drivers that are causing crashes are identified along with alternative drivers that might reduce the number of crashes. Windows Information Protection misconfigurations are also identified. For more information, see [Monitor the health of devices with Device Health](/mem/configmgr/desktop-analytics/overview). ### MBR2GPT @@ -183,7 +189,7 @@ For the latest information about MDT, see the [MDT release notes](/mem/configmgr > [!IMPORTANT] > -> MDT doesn't support Windows 11 or Windows Server 2022. +> MDT doesn't support versions of Windows after Windows 10 and Windows Server 2019. ### Windows Assessment and Deployment Kit (ADK) @@ -203,9 +209,9 @@ The Windows 10 PoC guide enables you to test Windows 10 deployment in a virtual For more information, see the following guides: -- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) -- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) -- [Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md) +- [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md). +- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md). +- [Deploy Windows 10 in a test lab using Microsoft Configuration Manager](windows-10-poc-sc-config-mgr.md). ## Troubleshooting guidance @@ -213,9 +219,9 @@ For more information, see the following guides: ## Related articles -[Overview of Windows as a service](update/waas-overview.md)
    -[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)
    -[Windows 10 release information](/windows/windows-10/release-information)
    -[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)
    -[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
    -[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
    +- [Overview of Windows as a service](update/waas-overview.md). +- [Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md). +- [Windows 10 release information](/windows/windows-10/release-information). +- [Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications). +- [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md). +- [Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md). diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index fe15f84332..888405843b 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -17,7 +17,7 @@ ms.date: 11/17/2023 **Applies to** - Windows 10, version 1903 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. >[!NOTE] > @@ -37,11 +37,11 @@ This article lists new and updated features and content that are of interest to ### SetupDiag -[SetupDiag](/windows/deployment/upgrade/setupdiag) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When log files are being searched, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the rules.xml file, which is extracted when SetupDiag is run. The rules.xml file are updated as new versions of SetupDiag are made available. +[SetupDiag](/windows/deployment/upgrade/setupdiag) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When log files are being searched, SetupDiag uses a set of rules to match known issues. In the current version of SetupDiag there are 53 rules contained in the `rules.xml` file, which is extracted when SetupDiag is run. The `rules.xml` file are updated as new versions of SetupDiag are made available. ### Reserved storage -[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327): Reserved storage sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage is enabled automatically on new PCs with Windows 10, version 1903 or later pre-installed, and for clean installs. It isn't enabled when updating from a previous version of Windows 10. +[**Reserved storage**](https://techcommunity.microsoft.com/t5/Storage-at-Microsoft/Windows-10-and-reserved-storage/ba-p/428327) sets aside disk space to be used by updates, apps, temporary files, and system caches. It improves the day-to-day function of your PC by ensuring critical OS functions always have access to disk space. Reserved storage is enabled automatically on new PCs with Windows 10, version 1903 or later pre-installed, and for clean installs. It isn't enabled when updating from a previous version of Windows 10. ## Servicing @@ -126,7 +126,7 @@ This new feature is displayed under the Device Security page with the string `Yo - [Windows Hello FIDO2 certification](https://fidoalliance.org/microsoft-achieves-fido2-certification-for-windows-hello/): Windows Hello is now a FIDO2 Certified authenticator and enables password-less sign-in for websites supporting FIDO2 authentication, such as Microsoft account and Microsoft Entra ID. - [Streamlined Windows Hello PIN reset experience](/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience): Microsoft account users have a revamped Windows Hello PIN reset experience with the same look and feel as signing in on the web. -- Sign-in with [Password-less](/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience! +- Sign-in with [Password-less](/windows/security/identity-protection/hello-for-business/passwordless-strategy) Microsoft accounts: Sign in to Windows 10 with a phone number account. Then use Windows Hello for an even easier sign-in experience. - [Remote Desktop with Biometrics](/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop#remote-desktop-with-biometrics): Microsoft Entra ID and Active Directory users using Windows Hello for Business can use biometrics to authenticate to a remote desktop session. ### Security management From 3cfa8b07574bf7ba781aaeef1f82e175944ae050 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 16:04:20 -0500 Subject: [PATCH 185/237] updates --- ...blishing.redirection.windows-security.json | 5 + .../windows-firewall/configure.md | 14 ++- ...create-windows-firewall-rules-in-intune.md | 103 ------------------ .../windows-firewall/index.md | 40 ++----- .../network-security/windows-firewall/toc.yml | 2 - 5 files changed, 20 insertions(+), 144 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 0e9908a375..815ac358e0 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -8024,6 +8024,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/configure-the-windows-firewall-log.md", "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-logging", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index de812d418b..4fbcf62473 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -7,7 +7,7 @@ ms.topic: best-practice # Configure Windows Firewall -This article describes the available tools to configure Windows Firewall and some recommended practices. +This article describes the available tools to configure Windows Firewall, firewall rules, and some recommended practices. ## Configuration tools @@ -15,13 +15,15 @@ Windows offers different tools to view the status and configure Windows Firewall - [Windows Security](#windows-security) - [Control Panel](#control-panel) -- Windows Defender Firewall with Advanced Security and its integration with the [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) +- [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) and its integration with the Microsoft Management Console (MMC) - [Configuration Service Provider (CSP)](#configuration-service-provider-csp) - [Command line tools](#command-line-tools) > [!NOTE] > To change the configuration of Windows Firewall on a device, you must have administative rights. + #### Windows Defender Firewall with Advanced Security + :::row::: :::column span="4"::: #### Windows Security @@ -53,12 +55,12 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="4"::: - #### Microsoft Management Console (MMC) + #### Windows Defender Firewall with Advanced Security :::column-end::: :::row-end::: :::row::: :::column span="3"::: - The *Windows Defender Firewall with Advanced Security* MMC snap-in (`wf.msc`) provides advanced configuration functionalities. It can be used locally and in centralized group policy (GPO) management solutions. + The *Windows Defender Firewall with Advanced Security* MMC snap-in provides advanced configuration functionalities. It can be used locally (`wf.msc`) and in group policy (GPO) implementations. :::column-end::: :::column span="1"::: :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/mmc-advanced-security.png" border="false"::: @@ -96,7 +98,7 @@ It's recommended to maintain the default Windows Firewall settings whenever poss ### Restrictions per profile -You may also wish to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify **Local Subnet** only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. +You may need to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify **Local Subnet** only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. ### Rule precedence for inbound rules @@ -148,7 +150,7 @@ Creation of application rules at runtime can also be prohibited by administrator Firewall rules can be deployed: -1. Locally using the [Microsoft Management Console (MMC)](#microsoft-management-console-mmc) +1. Locally using the [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) console (wf.msc`)`) 1. Locally using [command line tools](#command-line-tools) 1. Remotely using group policy (GPO) settings if the device is a member of an Active Directory domain, or managed by Configuration Manager 1. Remotely using the [Firewall CSP](/windows/client-management/mdm/firewall-csp), with a mobile device management (MDM) solution like Microsoft Intune diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md deleted file mode 100644 index b83010e461..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md +++ /dev/null @@ -1,103 +0,0 @@ ---- -title: Create Windows Firewall rules in Intune -description: Learn how to use Intune to create rules in Windows Defender Firewall with Advanced Security. -ms.date: 11/07/2023 -ms.topic: how-to ---- - -# Create Windows Firewall rules in Intune - -To get started, Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Devices** > **Windows** > **Configuration profiles** > **Create profile** > Choose **Windows 10 and later** as the platform, Choose **Templates**, then **Endpoint protection** as the profile type. -Select Windows Defender Firewall. -:::image type="content" source="images/windows-firewall-intune.png" alt-text="Example of a Windows Defender Firewall policy in Microsoft Intune and the Intune admin center."::: - ->[!IMPORTANT] ->A single Endpoint Protection profile may contain up to a maximum of 150 firewall rules. If a client device requires more than 150 rules, then multiple profiles must be assigned to it. - -## Firewall rule components - -The firewall rule configurations in Intune use the Windows CSP for Firewall. For more information, see [Firewall CSP](/windows/client-management/mdm/firewall-csp). - -## Application - -Control connections for an app or program. -Apps and programs can be specified either file path, package family name, or Windows service short name. - -The file path of an app is its location on the client device. -For example, C:\Windows\System\Notepad.exe. -[Learn more](/windows/client-management/mdm/firewall-csp#filepath) - -Package family names can be retrieved by running the Get-AppxPackage command from PowerShell. -[Learn more](https://aka.ms/intunefirewallPackageNameFromPowerShell) - -Windows service short names are used in cases when a service, not an application, is sending or receiving traffic. -Default is All. - -[Learn more](/windows/client-management/mdm/firewall-csp#servicename) - -## Protocol - -Select the protocol for this port rule. Transport layer protocols—TCP and UDP—allow you to specify ports or port ranges. For custom protocols, enter a number between 0 and 255 representing the IP protocol. - -Default is Any. - -[Learn more](/windows/client-management/mdm/firewall-csp#protocol) - -## Local ports - -Comma separated list of ranges. For example, *100-120,200,300-320*. Default is All. - -[Learn more](/windows/client-management/mdm/firewall-csp#localportranges) - -## Remote ports - -Comma separated list of ranges. For example, *100-120,200,300-320*. Default is All. - -[Learn more](/windows/client-management/mdm/firewall-csp#remoteportranges) - -## Local addresses - -Comma-separated list of local addresses covered by the rule. Valid tokens include: - -- `*` indicates any local address. If present, this token must be the only one included -- A subnet can be specified using either the subnet mask or network prefix notation. If a subnet mask or a network prefix isn't specified, the subnet mask default is 255.255.255.255 -- A valid IPv6 address -- An IPv4 address range in the format of "start address-end address" with no spaces included -- An IPv6 address range in the format of "start address-end address" with no spaces included. Default is Any address - -[Learn more](/windows/client-management/mdm/firewall-csp#localaddressranges) - -## Remote addresses - -List of comma separated tokens specifying the remote addresses covered by the rule. Tokens are case insensitive. Valid tokens include: - -- `*` indicates any remote address. If present, this token must be the only one included -- Defaultgateway -- DHCP -- DNS -- WINS -- Intranet -- RmtIntranet -- Internet -- Ply2Renders -- LocalSubnet indicates any local address on the local subnet -- A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255 -- A valid IPv6 address -- An IPv4 address range in the format of "start address-end address" with no spaces included -- An IPv6 address range in the format of "start address-end address" with no spaces included - -Default is Any address - -[Learn more](https://aka.ms/intunefirewallremotaddressrule) - -## Edge traversal - -Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. - -[Learn more](/windows/client-management/mdm/firewall-csp#edgetraversal) - -## Authorized users - -Specifies the list of authorized local users for this rule. A list of authorized users can't be specified if the rule being authored is targeting a Windows service. Default is all users. - -[Learn more](/windows/client-management/mdm/firewall-csp#localuserauthorizedlist) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index ea2523b73d..404f90b1eb 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -42,45 +42,19 @@ The default behavior of Windows Firewall is to: ### Firewall rules -*Firewall rules* identify communication to be allowed or blocked, and the conditions for this to happen. The rules offer an extensive selection of conditions to identify traffic, including: +*Firewall rules* identify allowed or blocked network traffic, and the conditions for this to happen. The rules offer an extensive selection of conditions to identify traffic, including: -- source and destination IP addresses -- can make use dynamic values, like default gateway, DHCP servers, DNS servers and local subnets -- protocol name or type -- source and destination TCP or UDP ports -- interface type +- Application, service or program name +- Source and destination IP addresses +- Can make use dynamic values, like default gateway, DHCP servers, DNS servers and local subnets +- Protocol name or type. For transport layer protocols, TCP and UDP, you can specify ports or port ranges. For custom protocols, you can use a number between 0 and 255 representing the IP protocol +- Interface type - ICMP/ICMPv6 traffic type and code -- rules can apply to any process, any service or spoecific service ### Firewall profiles Windows Firewall offers three network profiles: domain, private and public. The network profiles are used to assign rules. For example, you can allow a specific application to communicate on a private network, but not on a public network. -:::row::: - :::column span="1"::: - #### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network - :::column-end::: - :::column span="3"::: - The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. - :::column-end::: -:::row-end::: -:::row::: - :::column span="1"::: - #### :::image type="icon" source="images/private-network.svg" border="false"::: Private network - :::column-end::: - :::column span="3"::: - The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. - :::column-end::: -:::row-end::: -:::row::: - :::column span="1"::: - #### :::image type="icon" source="images/public-network.svg" border="false"::: Public network - :::column-end::: - :::column span="3"::: - The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. - :::column-end::: -:::row-end::: - #### :::image type="icon" source="images/domain-network.svg" border="false"::: Domain network The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. @@ -96,7 +70,7 @@ The *public network* profile is designed with higher security in mind for public ## Next steps > [!div class="nextstepaction"] -> Learn about the tools to configure Windows Firewall and some recommended practices: +> Learn about the tools to configure Windows Firewall, firewall rules, and some recommended practices: > > [Configure Windows Firewall >](configure.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index d292aa011c..e45a99fb93 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -5,8 +5,6 @@ items: items: - name: Configure Windows Firewall href: configure.md - - name: Configure rules with Microsoft Intune - href: create-windows-firewall-rules-in-intune.md - name: Configure rules with group policy href: configure-rules-with-gpo.md - name: Configure with command line tools From fc864bfdfdadf2fda33f23fb587d83a1dde668ec Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Nov 2023 16:05:52 -0500 Subject: [PATCH 186/237] Refresh TPM docs --- ...blishing.redirection.windows-security.json | 7 ++- windows/security/hardware-security/toc.yml | 4 +- ...ackup-tpm-recovery-information-to-ad-ds.md | 2 +- .../tpm/change-the-tpm-owner-password.md | 11 ++-- .../tpm/how-windows-uses-the-tpm.md | 30 +++++------ ...lize-and-configure-ownership-of-the-tpm.md | 11 ++-- .../tpm/manage-tpm-commands.md | 16 ++---- .../tpm/manage-tpm-lockout.md | 15 +++--- .../switch-pcr-banks-on-tpm-2-0-devices.md | 13 +++-- .../hardware-security/tpm/tpm-fundamentals.md | 43 +++++++-------- .../tpm/tpm-recommendations.md | 54 ++++++++----------- .../tpm/trusted-platform-module-overview.md | 33 ++++++------ ...m-module-services-group-policy-settings.md | 42 ++++++--------- .../tpm/trusted-platform-module-top-node.md | 25 --------- .../enhanced-phishing-protection.md | 8 +++ 15 files changed, 130 insertions(+), 184 deletions(-) delete mode 100644 windows/security/hardware-security/tpm/trusted-platform-module-top-node.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index e573ac4d0a..1b6792578c 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -177,7 +177,12 @@ }, { "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", - "redirect_url": "/windows/security/hardware-security/tpm/trusted-platform-module-top-node", + "redirect_url": "/windows/security/hardware-security/tpm/trusted-platform-module-overview", + "redirect_document_id": false + }, + { + "source_path": "windows/security/hardware-security/tpm/trusted-platform-module-top-node.md", + "redirect_url": "/windows/security/hardware-security/tpm/trusted-platform-module-overview", "redirect_document_id": false }, { diff --git a/windows/security/hardware-security/toc.yml b/windows/security/hardware-security/toc.yml index 1b95b86db3..c941dc715a 100644 --- a/windows/security/hardware-security/toc.yml +++ b/windows/security/hardware-security/toc.yml @@ -6,10 +6,8 @@ items: - name: Windows Defender System Guard href: how-hardware-based-root-of-trust-helps-protect-windows.md - name: Trusted Platform Module - href: tpm/trusted-platform-module-top-node.md + href: tpm/trusted-platform-module-overview.md items: - - name: Trusted Platform Module overview - href: tpm/trusted-platform-module-overview.md - name: TPM fundamentals href: tpm/tpm-fundamentals.md - name: How Windows uses the TPM diff --git a/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md index e2b7facad8..9be58182e9 100644 --- a/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/hardware-security/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -2,7 +2,7 @@ title: Back up TPM recovery information to Active Directory description: Learn how to back up the Trusted Platform Module (TPM) recovery information to Active Directory. ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 11/17/2023 --- # Back up the TPM recovery information to AD DS diff --git a/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md b/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md index 05ed6c63a9..29abbe115b 100644 --- a/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md +++ b/windows/security/hardware-security/tpm/change-the-tpm-owner-password.md @@ -2,7 +2,7 @@ title: Change the TPM owner password description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.topic: conceptual -ms.date: 04/26/2023 +ms.date: 11/17/2023 --- # Change the TPM owner password @@ -14,12 +14,7 @@ This article for the IT professional describes how to change the password or PIN Starting with Windows 10, version 1607, Windows doesn't retain the TPM owner password when provisioning the TPM. The password is set to a random high entropy value and then discarded. > [!IMPORTANT] -> -> Although the TPM owner password isn't retained starting with Windows 10, version 1607, you can change a default registry key to retain it. However, we strongly recommend that you don't make this change. To retain the TPM owner password, under the registry key of -> -> `HKLM\Software\Policies\Microsoft\TPM` -> -> create a `REG_DWORD` value of `OSManagedAuthLevel` and set it to `4`. +> Although the TPM owner password isn't retained starting with Windows 10, version 1607, you can change a default registry key to retain it. However, we strongly recommend that you don't make this change. To retain the TPM owner password, under the registry key `HKLM\Software\Policies\Microsoft\TPM`, create a `REG_DWORD` value of `OSManagedAuthLevel` and set it to `4`. > > For Windows versions newer than Windows 10 1703, the default value for this key is 5. A value of 5 means: > @@ -52,4 +47,4 @@ You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets i ## Related articles -- [Trusted Platform Module](trusted-platform-module-top-node.md) +- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md b/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md index e75ebe55d6..b513a67096 100644 --- a/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/hardware-security/tpm/how-windows-uses-the-tpm.md @@ -2,7 +2,7 @@ title: How Windows uses the TPM description: Learn how Windows uses the Trusted Platform Module (TPM) to enhance security. ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 11/17/2023 --- # How Windows uses the Trusted Platform Module @@ -31,11 +31,11 @@ The security features of Windows combined with the benefits of a TPM offer pract ## Platform Crypto Provider -Windows includes a cryptography framework called *Cryptographic API: Next Generation* (CNG), the basic approach of which is to implement cryptographic algorithms in different ways but with a common application programming interface (API). Applications that use cryptography can use the common API without knowing the details of how an algorithm is implemented much less the algorithm itself. +Windows includes a cryptography framework called Cryptographic API: Next Generation (CNG), the basic approach of which is to implement cryptographic algorithms in different ways but with a common application programming interface (API). Applications that use cryptography can use the common API without knowing the details of how an algorithm is implemented much less the algorithm itself. Although CNG sounds like a mundane starting point, it illustrates some of the advantages that a TPM provides. Underneath the CNG interface, Windows or third parties supply a cryptographic provider (that is, an implementation of an algorithm) implemented as software libraries alone or in a combination of software and available system hardware or third-party hardware. If implemented through hardware, the cryptographic provider communicates with the hardware behind the software interface of CNG. -The Platform Crypto Provider, introduced in the Windows 8 operating system, exposes the following special TPM properties, which software-only CNG providers can't offer or can't offer as effectively: +The Platform Crypto Provider, introduced in the Windows 8, exposes the following special TPM properties, which software-only CNG providers can't offer or can't offer as effectively: - **Key protection**. The Platform Crypto Provider can create keys in the TPM with restrictions on their use. The operating system can load and use the keys in the TPM without copying the keys to system memory, where they're vulnerable to malware. The Platform Crypto Provider can also configure keys that a TPM protects so that they aren't removable. If a TPM creates a key, the key is unique and resides only in that TPM. If the TPM imports a key, the Platform Crypto Provider can use the key in that TPM, but that TPM isn't a source for making more copies of the key or enabling the use of copies elsewhere. In sharp contrast, software solutions that protect keys from copying are subject to reverse-engineering attacks, in which someone figures out how the solution stores keys or makes copies of keys while they are in memory during use. @@ -49,7 +49,7 @@ These TPM features give Platform Crypto Provider distinct advantages over softwa Smart cards are physical devices that typically store a single certificate and the corresponding private key. Users insert a smart card into a built-in or USB card reader and enter a PIN to unlock it. Windows can then access the card's certificate and use the private key for authentication or to unlock BitLocker protected data volumes. Smart cards are popular because they provide two-factor authentication that requires both something the user has (that is, the smart card) and something the user knows (such as the smart card PIN). However, smart cards can be expensive because they require purchase and deployment of both smart cards and smart card readers. -In Windows, the *Virtual Smart Card* feature allows the TPM to mimic a permanently inserted smart card. The TPM becomes *something the user has* but still requires a PIN. While physical smart cards limit the number of PIN attempts before locking the card and requiring a reset, a virtual smart card relies on the TPM's dictionary attack protection to prevent too many PIN guesses. +In Windows, the Virtual Smart Card feature allows the TPM to mimic a permanently inserted smart card. The TPM becomes *something the user has* but still requires a PIN. While physical smart cards limit the number of PIN attempts before locking the card and requiring a reset, a virtual smart card relies on the TPM's dictionary attack protection to prevent too many PIN guesses. For TPM-based virtual smart cards, the TPM protects the use and storage of the certificate private key, so that it can't be copied when it is in use or stored and used elsewhere. Using a component that is part of the system rather than a separate physical smart card, can reduce total cost of ownership. The *lost card* or *card left at home* scenarios are not applicable, and the benefits of smart card-based multifactor authentication is preserved. For users, virtual smart cards are simple to use, requiring only a PIN to unlock. Virtual smart cards support the same scenarios that physical smart cards support, including signing in to Windows or authenticating for resource access. @@ -61,7 +61,7 @@ The adoption of new authentication technology requires that identity providers a Identity providers have flexibility in how they provision credentials on client devices. For example, an organization might provision only those devices that have a TPM so that the organization knows that a TPM protects the credentials. The ability to distinguish a TPM from malware acting like a TPM requires the following TPM capabilities (see Figure 1): -- **Endorsement key**. The TPM manufacturer can create a special key in the TPM called an *endorsement key*. An endorsement key certificate, signed by the manufacturer, says that the endorsement key is present in a TPM that the manufacturer made. Solutions can use the certificate with the TPM containing the endorsement key to confirm a scenario really involves a TPM from a specific TPM manufacturer (instead of malware acting like a TPM). +- **Endorsement key**. The TPM manufacturer can create a special key in the TPM called an endorsement key. An endorsement key certificate, signed by the manufacturer, says that the endorsement key is present in a TPM that the manufacturer made. Solutions can use the certificate with the TPM containing the endorsement key to confirm a scenario really involves a TPM from a specific TPM manufacturer (instead of malware acting like a TPM). - **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios. @@ -129,16 +129,16 @@ The TPM adds hardware-based security benefits to Windows. When installed on hard
    -|Feature | Benefits when used on a system with a TPM| -|---|---| -| Platform Crypto Provider |
    • If the machine is compromised, the private key associated with the certificate can't be copied off the device.
    • The TPM's dictionary attack mechanism protects PIN values to use a certificate.
    | -| Virtual Smart Card |
    • Achieve security similar to that of physical smart cards without deploying physical smart cards or card readers.
    | -| Windows Hello for Business |
    • Credentials provisioned on a device can't be copied elsewhere.
    • Confirm a device's TPM before credentials are provisioned.
    | -| BitLocker Drive Encryption |
    • Multiple options are available for enterprises to protect data at rest while balancing security requirements with different device hardware.
    | -|Device Encryption |
    • With a Microsoft account and the right hardware, consumers' devices seamlessly benefit from data-at-rest protection.
    | -| Measured Boot |
    • A hardware root of trust contains boot measurements that help detect malware during remote attestation.
    | -| Health Attestation |
    • MDM solutions can easily perform remote attestation and evaluate client health before granting access to resources or cloud services such as Office 365.
    | -| Credential Guard |
    • Defense in depth increases so that even if malware has administrative rights on one machine, it is significantly more difficult to compromise additional machines in an organization.
    | +| Feature | Benefits when used on a system with a TPM | +|----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Platform Crypto Provider | - If the machine is compromised, the private key associated with the certificate can't be copied off the device.
    - The TPM's dictionary attack mechanism protects PIN values to use a certificate. | +| Virtual Smart Card | Achieve security similar to that of physical smart cards without deploying physical smart cards or card readers. | +| Windows Hello for Business | - Credentials provisioned on a device can't be copied elsewhere.
    - Confirm a device's TPM before credentials are provisioned. | +| BitLocker Drive Encryption | Multiple options are available for enterprises to protect data at rest while balancing security requirements with different device hardware. | +| Device Encryption | With a Microsoft account and the right hardware, consumers' devices seamlessly benefit from data-at-rest protection. | +| Measured Boot | A hardware root of trust contains boot measurements that help detect malware during remote attestation. | +| Health Attestation | MDM solutions can easily perform remote attestation and evaluate client health before granting access to resources or cloud services such as Office 365. | +| Credential Guard | Defense in depth increases so that even if malware has administrative rights on one machine, it is significantly more difficult to compromise additional machines in an organization. |
    diff --git a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md index e9374612fe..11e1b60887 100644 --- a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -2,7 +2,7 @@ title: Troubleshoot the TPM description: Learn how to view and troubleshoot the Trusted Platform Module (TPM). ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 11/17/2023 ms.collection: - highpri - tier1 @@ -16,13 +16,14 @@ This article provides information how to troubleshoot the Trusted Platform Modul - [Clear all the keys from the TPM](#clear-all-the-keys-from-the-tpm) With TPM 1.2 and Windows 11, you can also take the following actions: + - [Turn on or turn off the TPM](#turn-on-or-turn-off) For information about the TPM cmdlets, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true). ## About TPM initialization and ownership -Windows automatically initializes and takes ownership of the TPM. This is a change from previous operating systems, where you had to initialize the TPM and create an owner password. +Windows automatically initializes and takes ownership of the TPM. There's no need for you to initialize the TPM and create an owner password. ### TPM initialization @@ -69,7 +70,7 @@ Clearing the TPM can result in data loss. To protect against such loss, review t Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. -**To clear the TPM** +#### To clear the TPM 1. Open the Windows Defender Security Center app. 1. Select **Device security**. @@ -79,7 +80,7 @@ Membership in the local Administrators group, or equivalent, is the minimum requ - You'll be prompted to restart the computer. During the restart, you might be prompted by the UEFI to press a button to confirm that you wish to clear the TPM. - After the device restarts, your TPM will be automatically prepared for use by Windows. -## Turn on or turn off the TPM +## Turn on or turn off the TPM Normally, the TPM is turned on as part of the TPM initialization process. You don't normally need to turn the TPM on or off. However, if necessary you can do so by using the TPM MMC. @@ -103,7 +104,7 @@ If you want to stop using the services that are provided by the TPM, you can use - If you saved your TPM owner password on a removable storage device, insert it, and then select **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, select **Browse** to locate the *.tpm* file that is saved on your removable storage device, select **Open**, and then select **Turn TPM Off**. - If you don't have the removable storage device with your saved TPM owner password, select **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then select **Turn TPM Off**. - If you didn't save your TPM owner password or no longer know it, select **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password. - + ## Use the TPM cmdlets You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true). diff --git a/windows/security/hardware-security/tpm/manage-tpm-commands.md b/windows/security/hardware-security/tpm/manage-tpm-commands.md index 52a9473f9b..d309758d11 100644 --- a/windows/security/hardware-security/tpm/manage-tpm-commands.md +++ b/windows/security/hardware-security/tpm/manage-tpm-commands.md @@ -2,7 +2,7 @@ title: Manage TPM commands description: This article for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.topic: conceptual -ms.date: 04/26/2023 +ms.date: 11/17/2023 --- # Manage TPM commands @@ -15,10 +15,9 @@ The following procedures describe how to manage the TPM command lists. You must ## Block TPM commands by using the Local Group Policy Editor -1. Open the Local Group Policy Editor (gpedit.msc). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. +1. Open the Local Group Policy Editor (`gpedit.msc`). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. > [!NOTE] - > > Administrators with appropriate rights in a domain can configure a Group Policy Object (GPO) that can be applied through Active Directory Domain Services (AD DS). 1. In the console tree, under **Computer Configuration**, expand **Administrative Templates**, and then expand **System**. @@ -32,7 +31,6 @@ The following procedures describe how to manage the TPM command lists. You must 1. For each command that you want to block, select **Add**, enter the command number, and then select **OK**. > [!NOTE] - > > For a list of commands, see links in the [TPM Specification](https://www.trustedcomputinggroup.org/tpm-main-specification/). 1. After you have added numbers for each command that you want to block, select **OK** twice. @@ -41,9 +39,7 @@ The following procedures describe how to manage the TPM command lists. You must ## Block or allow TPM commands by using the TPM MMC -1. Open the TPM MMC (tpm.msc) - -1. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. +1. Open the TPM MMC (`tpm.msc`). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. 1. In the console tree, select **Command Management**. A list of TPM commands is displayed. @@ -53,9 +49,7 @@ The following procedures describe how to manage the TPM command lists. You must ## Block new commands -1. Open the TPM MMC (tpm.msc). - - If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. +1. Open the TPM MMC (`tpm.msc`). If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. 1. In the console tree, select **Command Management**. A list of TPM commands is displayed. @@ -69,4 +63,4 @@ You can manage the TPM using Windows PowerShell. For details, see [TrustedPlatfo ## Related articles -- [Trusted Platform Module](trusted-platform-module-top-node.md) +- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/manage-tpm-lockout.md b/windows/security/hardware-security/tpm/manage-tpm-lockout.md index a281a8e40b..abf6374e8f 100644 --- a/windows/security/hardware-security/tpm/manage-tpm-lockout.md +++ b/windows/security/hardware-security/tpm/manage-tpm-lockout.md @@ -2,7 +2,7 @@ title: Manage TPM lockout description: This article for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.topic: conceptual -ms.date: 04/26/2023 +ms.date: 11/17/2023 --- # Manage TPM lockout @@ -17,20 +17,19 @@ Windows takes ownership of the TPM ownership upon first boot. By default, Window In some cases, encryption keys are protected by a TPM by requiring a valid authorization value to access the key. A common example is configuring BitLocker Drive Encryption to use the TPM plus PIN key protector. In this scenario, the user must type the correct PIN during the boot process to access the volume encryption key protected by the TPM. To prevent malicious users or software from discovering authorization values, TPMs implement protection logic. The protection logic is designed to slow or stop responses from the TPM if it detects that an entity might be trying to guess authorization values. -### TPM 1.2 - -The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. These delays can prevent them from using the TPM for a period of time. - ### TPM 2.0 TPM 2.0 devices have standardized lockout behavior which Windows configures. TPM 2.0 devices have a maximum count threshold and a healing time. Windows configures the maximum count to be 32 and the healing time to be 10 minutes. This configuration means that every continuous 10 minutes of powered on operation without an event causes the counter to decrease by 1. If your TPM has entered lockout mode or is responding slowly to commands, you can reset the lockout value by using the following procedures. Resetting the TPM lockout requires the TPM owner's authorization. This value is no longer retained by default starting with Windows 10 version 1607 and higher. +### TPM 1.2 + +The industry standards from the Trusted Computing Group (TCG) specify that TPM manufacturers must implement some form of protection logic in TPM 1.2 and TPM 2.0 chips. TPM 1.2 devices implement different protection mechanisms and behavior. In general, the TPM chip takes exponentially longer to respond if incorrect authorization values are sent to the TPM. Some TPM chips may not store failed attempts over time. Other TPM chips may store every failed attempt indefinitely. Therefore, some users may experience increasingly longer delays when they mistype an authorization value that is sent to the TPM. These delays can prevent them from using the TPM for a period of time. + ## Reset the TPM lockout by using the TPM MMC > [!NOTE] -> > This procedure is only available if you have configured Windows to retain the TPM Owner Password. By default, this password isn't available in Windows 10 starting with version 1607 and higher. The following procedure explains the steps to reset the TPM lockout by using the TPM MMC. @@ -39,7 +38,7 @@ The following procedure explains the steps to reset the TPM lockout by using the 1. Open the TPM MMC (tpm.msc). -1 In the **Action** pane, select **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. +1. In the **Action** pane, select **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. 1. Choose one of the following methods to enter the TPM owner password: @@ -77,4 +76,4 @@ You can manage the TPM using Windows PowerShell. For details, see [TPM Cmdlets i ## Related articles -- [Trusted Platform Module](trusted-platform-module-top-node.md) +- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index 01ddf58aa0..281201247a 100644 --- a/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/hardware-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -2,14 +2,14 @@ title: UnderstandPCR banks on TPM 2.0 devices description: Learn about what happens when you switch PCR banks on TPM 2.0 devices. ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 11/17/2023 --- # PCR banks on TPM 2.0 devices For steps on how to switch PCR banks on TPM 2.0 devices on your PC, you should contact your OEM or UEFI vendor. This article provides background about what happens when you switch PCR banks on TPM 2.0 devices. -A *Platform Configuration Register (PCR)* is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. A SHA-1 PCR can store 20 bytes - the size of a SHA-1 digest. Multiple PCRs associated with the same hashing algorithm are referred to as a *PCR bank*. +A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. A SHA-1 PCR can store 20 bytes - the size of a SHA-1 digest. Multiple PCRs associated with the same hashing algorithm are referred to as a *PCR bank*. To store a new value in a PCR, the existing value is extended with a new value as follows: `PCR[N] = HASHalg( PCR[N] || ArgumentOfExtend)` @@ -21,8 +21,7 @@ Some TPM PCRs are used as checksums of log events. The log events are extended i ## How does Windows use PCRs? -To bind the use of a TPM based key to a certain state of the device, the key can be sealed to an expected set of PCR values.\ -For instance, PCRs 0 through 7 have a well-defined value after the boot process, when the OS is loaded. When the hardware, firmware, or boot loader of the machine changes, the change can be detected in the PCR values. Windows uses this capability to make certain cryptographic keys only available at certain times during the boot process. For instance, the BitLocker key can be used at a certain point in the boot, but not before or after. +To bind the use of a TPM based key to a certain state of the device, the key can be sealed to an expected set of PCR values. For instance, PCRs 0 through 7 have a well-defined value after the boot process, when the OS is loaded. When the hardware, firmware, or boot loader of the machine changes, the change can be detected in the PCR values. Windows uses this capability to make certain cryptographic keys only available at certain times during the boot process. For instance, the BitLocker key can be used at a certain point in the boot, but not before or after. It's important to note that this binding to PCR values also includes the hashing algorithm used for the PCR. For instance, a key can be bound to a specific value of the `SHA-1 PCR[12]`, if using the SHA-256 PCR bank, even with the same system configuration. Otherwise, the PCR values won't match. @@ -30,7 +29,7 @@ It's important to note that this binding to PCR values also includes the hashing When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. Each hash algorithm will return a different cryptographic signature for the same inputs. -As a result, if the currently used PCR bank is switched all keys that have been bound to the previous PCR values will no longer work. For example, if you had a key bound to the SHA-1 value of PCR\[12\] and subsequently changed the PCR bank to SHA-256, the banks wouldn't match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows won't be able to unseal it if the PCR banks are switched while BitLocker is enabled. +As a result, if the currently used PCR bank is switched all keys that have been bound to the previous PCR values will no longer work. For example, if you had a key bound to the SHA-1 value of PCR[12] and subsequently changed the PCR bank to SHA-256, the banks wouldn't match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows won't be able to unseal it if the PCR banks are switched while BitLocker is enabled. ## What can I do to switch PCRs when BitLocker is already active? @@ -42,7 +41,7 @@ You can configure a TPM to have multiple PCR banks active. When BIOS performs me - Registry key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IntegrityServices` - DWORD: `TPMActivePCRBanks` -- Defines which PCR banks are currently active. (This value should be interpreted as a bitmap for which the bits are defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 21 of Revision 1.27.) +- Defines which PCR banks are currently active. This value should be interpreted as a bitmap for which the bits are defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 21 of Revision 1.27. Windows checks which PCR banks are active and supported by the BIOS. Windows also checks if the measured boot log supports measurements for all active PCR banks. Windows will prefer the use of the SHA-256 bank for measurements and will fall back to SHA1 PCR bank if one of the pre-conditions isn't met. @@ -50,6 +49,6 @@ You can identify which PCR bank is currently used by Windows by looking at the r - Registry key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IntegrityServices` - DWORD: `TPMDigestAlgID` -- Algorithm ID of the PCR bank that Windows is currently using. (This value represents an algorithm identifier as defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 3 of Revision 1.27.) +- Algorithm ID of the PCR bank that Windows is currently using. This value represents an algorithm identifier as defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 3 of Revision 1.27. Windows only uses one PCR bank to continue boot measurements. All other active PCR banks will be extended with a separator to indicate that they aren't used by Windows and measurements that appear to be from Windows shouldn't be trusted. diff --git a/windows/security/hardware-security/tpm/tpm-fundamentals.md b/windows/security/hardware-security/tpm/tpm-fundamentals.md index 4393c94d01..d4612701db 100644 --- a/windows/security/hardware-security/tpm/tpm-fundamentals.md +++ b/windows/security/hardware-security/tpm/tpm-fundamentals.md @@ -2,24 +2,27 @@ title: Trusted Platform Module (TPM) fundamentals description: Learn about the components of the Trusted Platform Module and how they're used to mitigate dictionary attacks. ms.topic: conceptual -ms.date: 03/09/2023 +ms.date: 11/17/2023 --- # TPM fundamentals -This article provides a description of the *Trusted Platform Module* (TPM 1.2 and TPM 2.0) components, and explains how they're used to mitigate dictionary attacks. +This article provides a description of the Trusted Platform Module (TPM 1.2 and TPM 2.0) components, and explains how they're used to mitigate dictionary attacks. A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. The TPM is installed on the motherboard of a computer, and it communicates with the rest of the system by using a hardware bus. -Devices that incorporate a TPM can create cryptographic keys and encrypt them, so that the keys can only be decrypted by the TPM. This process, often called *wrapping* or *binding a key*, can help protect the key from disclosure. Each TPM has a *master wrapping key*, called the *storage root key*, which is stored within the TPM itself. The private portion of a storage root key, or *endorsement key*, that is created in a TPM is never exposed to any other component, software, process, or user. +Devices that incorporate a TPM can create cryptographic keys and encrypt them, so that the keys can only be decrypted by the TPM. This process, often called "wrapping" or "binding" a key, can help protect the key from disclosure. Each TPM has a primary wrapping key, called the **storage root key**, which is stored within the TPM itself. The private portion of a storage root key, or **endorsement key**, that is created in a TPM is never exposed to any other component, software, process, or user. -You can specify whether encryption keys that are created by the TPM can be migrated or not. If you specify that they can be migrated, the public and private portions of the key can be exposed to other components, software, processes, or users. If you specify that encryption keys can't be migrated, the private portion of the key is never exposed outside the TPM. +You can specify whether encryption keys that the TPM creates can be migrated or not. If you specify that they can be migrated, the public and private portions of the key can be exposed to other components, software, processes, or users. If you specify that encryption keys can't be migrated, the private portion of the key is never exposed outside the TPM. Devices that incorporate a TPM can also create a key wrapped and tied to certain platform measurements. This type of key can be unwrapped only when those platform measurements have the same values that they had when the key was created. This process is referred to as *sealing the key to the TPM*. Decrypting the key is called *unsealing*. The TPM can also seal and unseal data that is generated outside the TPM. With sealed key and software, such as BitLocker Drive Encryption, data can be locked until specific hardware or software conditions are met. With a TPM, private portions of key pairs are kept separate from the memory that is controlled by the operating system. Keys can be sealed to the TPM, and certain assurances about the state of a system (assurances that define the trustworthiness of a system) can be made before the keys are unsealed and released for use. The TPM uses its own internal firmware and logic circuits to process instructions. Hence, it doesn't rely on the operating system and it isn't exposed to vulnerabilities that might exist in the operating system or application software. -For information about which versions of Windows support which versions of the TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md). The features that are available in the versions are defined in specifications by the Trusted Computing Group (TCG). For more information, see the Trusted Platform Module page on the Trusted Computing Group website: [Trusted Platform Module](http://www.trustedcomputinggroup.org/developers/trusted_platform_module). +- For information about which versions of Windows support which versions of the TPM, see [Trusted Platform Module technology overview](trusted-platform-module-overview.md). +- For more information about which TPM services can be controlled centrally by using Group Policy settings, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). + +The features that are available in the versions are defined in specifications by the Trusted Computing Group (TCG). For more information, see the [Trusted Platform Module page](http://www.trustedcomputinggroup.org/developers/trusted_platform_module) on the Trusted Computing Group website. The following sections provide an overview of the technologies that support the TPM: @@ -33,12 +36,9 @@ The following sections provide an overview of the technologies that support the - [TPM Key Attestation](#key-attestation) - [Anti-hammering](#anti-hammering) -The following article describes the TPM services that can be controlled centrally by using Group Policy settings: -[TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). - ## Measured Boot with support for attestation -The *Measured Boot* feature provides anti-malware software with a trusted (resistant to spoofing and tampering) log of all boot components. Anti-malware software can use the log to determine whether components that ran before it are trustworthy or infected with malware. It can also send the Measured Boot logs to a remote server for evaluation. The remote server can start remediation actions by interacting with software on the client or through out-of-band mechanisms, as appropriate. +The Measured Boot feature provides anti-malware software with a trusted (resistant to spoofing and tampering) log of all boot components. Anti-malware software can use the log to determine whether components that ran before it are trustworthy or infected with malware. It can also send the Measured Boot logs to a remote server for evaluation. The remote server can start remediation actions by interacting with software on the client or through out-of-band mechanisms, as appropriate. ## TPM-based Virtual Smart Card @@ -48,7 +48,7 @@ The Virtual Smart Card emulates the functionality of traditional smart cards. Vi ## TPM-based certificate storage -The TPM protects certificates and RSA keys. The TPM key storage provider (KSP) provides easy and convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP generates keys when an organization enrolls for certificates. The TPM also protects certificates that are imported from an outside source. TPM-based certificates are standard certificates. The certificate can never leave the TPM from which the keys are generated. The TPM can now be used for crypto-operations through Cryptography API: Next Generation (CNG). For more info, see [Cryptography API: Next Generation](/windows/win32/seccng/cng-portal). +The TPM protects certificates and RSA keys. The TPM key storage provider (KSP) provides easy and convenient use of the TPM as a way of strongly protecting private keys. The TPM KSP generates keys when an organization enrolls for certificates. The TPM also protects certificates that are imported from an outside source. TPM-based certificates are standard certificates. The certificate can never leave the TPM from which the keys are generated. The TPM can also be used for crypto-operations through [Cryptography API: Next Generation (CNG)](/windows/win32/seccng/cng-portal). ## TPM Cmdlets @@ -68,7 +68,7 @@ A trusted application can use TPM only if the TPM contains an endorsement key, w ## Key attestation -*TPM key attestation* allows a certification authority to verify that a private key is protected by a TPM and that the TPM is one that the certification authority trusts. Endorsement keys proven valid are used to bind the user identity to a device. The user certificate with a TPM-attested key provides higher security assurance backed up by non-exportability, anti-hammering, and isolation of keys provided by a TPM. +TPM key attestation allows a certification authority to verify that a private key is protected by a TPM and that the TPM is one that the certification authority trusts. Endorsement keys proven valid are used to bind the user identity to a device. The user certificate with a TPM-attested key provides higher security assurance backed up by nonexportability, anti-hammering, and isolation of keys provided by a TPM. ## Anti-hammering @@ -84,12 +84,9 @@ TPM 2.0 has well defined anti-hammering behavior. This is in contrast to TPM 1.2 For systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every 10 minutes. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. -Attempts to use a key with an authorization value for the next 10 minutes wouldn't return success or failure. Instead, the response indicates that the TPM is locked.\ -After 10 minutes, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31. The TPM leaves the locked state and returns to normal operation.\ -With the correct authorization value, keys could be used normally if no authorization failures occur during the next 10 minutes. If a period of 320 minutes elapses with no authorization failures, the TPM doesn't remember any authorization failures, and 32 failed attempts could occur again. +Attempts to use a key with an authorization value for the next 10 minutes wouldn't return success or failure. Instead, the response indicates that the TPM is locked. After 10 minutes, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31. The TPM leaves the locked state and returns to normal operation. With the correct authorization value, keys could be used normally if no authorization failures occur during the next 10 minutes. If a period of 320 minutes elapses with no authorization failures, the TPM doesn't remember any authorization failures, and 32 failed attempts could occur again. -Windows doesn't require TPM 2.0 systems to forget about authorization failures when the system is fully powered off or when the system has hibernated.\ -Windows requires that authorization failures are forgotten when the system is running normally, in a sleep mode, or in low power states other than off. If a Windows system with TPM 2.0 is locked, the TPM leaves lockout mode if the system is left on for 10 minutes. +Windows doesn't require TPM 2.0 systems to forget about authorization failures when the system is fully powered off or when the system has hibernated. Windows requires that authorization failures are forgotten when the system is running normally, in a sleep mode, or in low power states other than off. If a Windows system with TPM 2.0 is locked, the TPM leaves lockout mode if the system is left on for 10 minutes. The anti-hammering protection for TPM 2.0 can be fully reset immediately by sending a reset lockout command to the TPM, and providing the TPM owner password. By default, Windows automatically provisions TPM 2.0 and stores the TPM owner password for use by system administrators. @@ -99,18 +96,16 @@ TPM 2.0 allows some keys to be created without an authorization value associated ### Rationale behind the defaults -Originally, BitLocker allowed from 4 to 20 characters for a PIN. -Windows Hello has its own PIN for sign-in, which can be 4 to 127 characters. -Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. +Originally, BitLocker allowed from 4 to 20 characters for a PIN. Windows Hello has its own PIN for sign-in, which can be 4 to 127 characters. Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. Windows 10, version 1607 and earlier used Dictionary Attack Prevention parameters. The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. This totals a maximum of about 4415 guesses per year. If the PIN is four digits, all 9999 possible PIN combinations could be attempted in a little over two years. -Staring in Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to six characters, to better align with other Windows features that use TPM 2.0, including Windows Hello. Increasing the PIN length requires a greater number of guesses for an attacker. Therefore, the lockout duration between each guess was shortened to allow legitimate users to retry a failed attempt sooner while maintaining a similar level of protection. In case the legacy parameters for lockout threshold and recovery time need to be used, make sure that GPO is enabled and [configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings#configure-the-system-to-use-legacy-dictionary-attack-prevention-parameters-setting-for-tpm-20). +Starting in Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to six characters, to better align with other Windows features that use TPM 2.0, including Windows Hello. Increasing the PIN length requires a greater number of guesses for an attacker. Therefore, the lockout duration between each guess was shortened to allow legitimate users to retry a failed attempt sooner while maintaining a similar level of protection. In case the legacy parameters for lockout threshold and recovery time need to be used, make sure that GPO is enabled and [configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0](/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings#configure-the-system-to-use-legacy-dictionary-attack-prevention-parameters-setting-for-tpm-20). ### TPM-based smart cards The Windows TPM-based smart card, which is a virtual smart card, can be configured to allow sign in to the system. In contrast with physical smart cards, the sign-in process uses a TPM-based key with an authorization value. The following list shows the advantages of virtual smart cards: -- Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. - With a virtual smart card, the TPM's anti-hammering protection isn't reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors -- Hardware manufacturers and software developers can use the security features of the TPM to meet their requirements -- The intent of selecting 32 failures as the lock-out threshold is to avoid users to lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must wait 10 minutes or use other credentials to sign in, such as a user name and password + +- Physical smart cards can enforce lockout for only the physical smart card PIN, and they can reset the lockout after the correct PIN is entered. With a virtual smart card, the TPM's anti-hammering protection isn't reset after a successful authentication. The allowed number of authorization failures before the TPM enters lockout includes many factors. +- Hardware manufacturers and software developers can use the security features of the TPM to meet their requirements. +- The intent of selecting 32 failures as the lock-out threshold is to avoid users to lock the TPM (even when learning to type new passwords or if they frequently lock and unlock their computers). If users lock the TPM, they must wait 10 minutes or use other credentials to sign in, such as a user name and password. diff --git a/windows/security/hardware-security/tpm/tpm-recommendations.md b/windows/security/hardware-security/tpm/tpm-recommendations.md index 1190a55d46..4fc8d8e9ae 100644 --- a/windows/security/hardware-security/tpm/tpm-recommendations.md +++ b/windows/security/hardware-security/tpm/tpm-recommendations.md @@ -2,7 +2,7 @@ title: TPM recommendations description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows. ms.topic: conceptual -ms.date: 02/02/2023 +ms.date: 11/17/2023 ms.collection: - highpri - tier1 @@ -35,25 +35,15 @@ From an industry standard, Microsoft has been an industry leader in moving and s TPM 2.0 products and systems have important security advantages over TPM 1.2, including: - The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. - - For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. - - TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. - - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs don't support all algorithms. - - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](/windows/win32/seccertenroll/cng-cryptographic-algorithm-providers). - - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://www.microsoft.com/security/blog/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption)). - - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. - - TPM 2.0 offers a more **consistent experience** across different implementations. - - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. - - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. - - While TPM 1.2 parts are discrete silicon components, which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s), and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. > [!NOTE] @@ -65,11 +55,9 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in There are three implementation options for TPMs: -- Discrete TPM chip as a separate component in its own semiconductor package - -- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components - -- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit +- Discrete TPM chip as a separate component in its own semiconductor package. +- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components. +- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit. Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions, which should suit all needs. @@ -95,22 +83,22 @@ For end consumers, TPM is behind the scenes but is still relevant. TPM is used f The following table defines which Windows features require TPM support. - Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | --|-|-|-|- - Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. - BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Device Encryption requires Modern Standby](../../operating-system-security/data-protection/bitlocker/index.md#device-encryption) including TPM 2.0 support - Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. - Windows Defender Application Control (Device Guard) | No | Yes | Yes - Windows Defender System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. - Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with Windows Defender System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. - Device Health Attestation| Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. - Windows Hello/Windows Hello for Business| No | Yes | Yes | Microsoft Entra join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. TPM 2.0 is recommended over TPM 1.2 for better performance and security. Windows Hello as a FIDO platform authenticator will take advantage of TPM 2.0 for key storage. - UEFI Secure Boot | No | Yes | Yes - TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes - Virtual Smart Card | Yes | Yes | Yes - Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. - Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. - SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. +| Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | +|--|--|--|--|--| +| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot. TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. | +| BitLocker | No | Yes | Yes | TPM 1.2 or 2.0 are supported but TPM 2.0 is recommended. [Device Encryption requires Modern Standby](../../operating-system-security/data-protection/bitlocker/index.md#device-encryption) including TPM 2.0 support | +| Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. | +| Windows Defender Application Control (Device Guard) | No | Yes | Yes | +| Windows Defender System Guard (DRTM) | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | +| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. Paired with Windows Defender System Guard, TPM 2.0 provides enhanced security for Credential Guard. Windows 11 requires TPM 2.0 by default to facilitate easier enablement of this enhanced security for customers. | +| Device Health Attestation | Yes | Yes | Yes | TPM 2.0 is recommended since it supports newer cryptographic algorithms. TPM 1.2 only supports the SHA-1 algorithm which is being deprecated. | +| Windows Hello/Windows Hello for Business | No | Yes | Yes | Microsoft Entra join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. TPM 2.0 is recommended over TPM 1.2 for better performance and security. Windows Hello as a FIDO platform authenticator will take advantage of TPM 2.0 for key storage. | +| UEFI Secure Boot | No | Yes | Yes | +| TPM Platform Crypto Provider Key Storage Provider | Yes | Yes | Yes | +| Virtual Smart Card | Yes | Yes | Yes | +| Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. | +| Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required. | +| SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | ## OEM Status on TPM 2.0 system availability and certified parts @@ -118,4 +106,4 @@ Government customers and enterprise customers in regulated industries may have a ## Related topics -- [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) +- [Trusted Platform Module](trusted-platform-module-overview.md) diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md index 8d35f5065b..fd028ba8e4 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-overview.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-overview.md @@ -2,7 +2,7 @@ title: Trusted Platform Module Technology Overview description: Learn about the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/17/2023 ms.collection: - highpri - tier1 @@ -14,21 +14,26 @@ This article describes the Trusted Platform Module (TPM) and how Windows uses it ## Feature description -The [*Trusted Platform Module (TPM)*](/windows/security/information-protection/tpm/trusted-platform-module-top-node) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper-resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the advantages of using TPM technology are: +The [Trusted Platform Module (TPM)](/windows/security/information-protection/tpm/trusted-platform-module-overview) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper-resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the advantages of using TPM technology are: -- Generate, store, and limit the use of cryptographic keys -- Use it for device authentication by using the TPM's unique RSA key, which is burned into the chip -- Help ensure platform integrity by taking and storing security measurements of the boot process +- Generate, store, and limit the use of cryptographic keys. +- Use it for device authentication by using the TPM's unique RSA key, which is burned into the chip. +- Help ensure platform integrity by taking and storing security measurements of the boot process. The most common TPM functions are used for system integrity measurements and for key creation and use. During the boot process of a system, the boot code that is loaded (including firmware and the operating system components) can be measured and recorded in the TPM. The integrity measurements can be used as evidence for how a system started and to make sure that a TPM-based key was used only when the correct software was used to boot the system. -TPM-based keys can be configured in a variety of ways. One option is to make a TPM-based key unavailable outside the TPM. This is good to mitigate phishing attacks because it prevents the key from being copied and used without the TPM. TPM-based keys can also be configured to require an authorization value to use them. If too many incorrect authorization guesses occur, the TPM will activate its dictionary attack logic and prevent further authorization value guesses. +TPM-based keys can be configured in various ways. One option is to make a TPM-based key unavailable outside the TPM. This is good to mitigate phishing attacks because it prevents the key from being copied and used without the TPM. TPM-based keys can also be configured to require an authorization value to use them. If too many incorrect authorization guesses occur, the TPM activates its dictionary attack logic and prevents further authorization value guesses. Different versions of the TPM are defined in specifications by the Trusted Computing Group (TCG). For more information, see the [TCG Web site](http://www.trustedcomputinggroup.org/work-groups/trusted-platform-module/). -### Automatic initialization of the TPM with Windows +[!INCLUDE [trusted-platform-module-tpm-20](../../../../includes/licensing/trusted-platform-module-tpm.md)] -Starting with Windows 10 and Windows 11, the operating system automatically initializes and takes ownership of the TPM. This means that in most cases, we recommend that you avoid configuring the TPM through the TPM management console, **TPM.msc**. There are a few exceptions, mostly related to resetting or performing a clean installation on a PC. For more information, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). We're [no longer actively developing the TPM management console](/windows-server/get-started-19/removed-features-19#features-were-no-longer-developing) beginning with Windows Server 2019 and Windows 10, version 1809. +## Automatic initialization of the TPM with Windows + +Starting with Windows 10 and Windows 11, the operating system automatically initializes and takes ownership of the TPM. This means that in most cases, we recommend that you avoid configuring the TPM through the TPM management console, **TPM.msc**. There are a few exceptions, mostly related to resetting or performing a clean installation on a PC. For more information, see [Clear all the keys from the TPM](initialize-and-configure-ownership-of-the-tpm.md#clear-all-the-keys-from-the-tpm). + +> [!NOTE] +> We're [no longer actively developing the TPM management console](/windows-server/get-started-19/removed-features-19#features-were-no-longer-developing) beginning with Windows Server 2019 and Windows 10, version 1809. In certain specific enterprise scenarios limited to Windows 10, versions 1507 and 1511, Group Policy might be used to back up the TPM owner authorization value in Active Directory. Because the TPM state persists across operating system installations, this TPM information is stored in a location in Active Directory that is separate from computer objects. @@ -38,21 +43,15 @@ Certificates can be installed or created on computers that are using the TPM. Af Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. -Anti-malware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows 11 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization aren't running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. +Anti-malware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows. These measurements include the launch of Hyper-V to test that datacenters using virtualization aren't running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. The TPM has several Group Policy settings that might be useful in certain enterprise scenarios. For more info, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). -[!INCLUDE [trusted-platform-module-tpm-20](../../../../includes/licensing/trusted-platform-module-tpm.md)] - -## New and changed functionality - -For more info on new and changed functionality for Trusted Platform Module in Windows, see [What's new in Trusted Platform Module?](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module) - ## Device health attestation -Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that will allow or deny a managed device access to a secure resource. +Device health attestation enables enterprises to establish trust based on hardware and software components of a managed device. With device heath attestation, you can configure an MDM server to query a health attestation service that allows or denies a managed device access to a secure resource. -Some security issues that you can check on the device include the following: +Some security issues that you can check on the devices include: - Is Data Execution Prevention supported and enabled? - Is BitLocker Drive Encryption supported and enabled? diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md index 586da21da4..4ea0c0f2d7 100644 --- a/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/hardware-security/tpm/trusted-platform-module-services-group-policy-settings.md @@ -2,18 +2,12 @@ title: TPM Group Policy settings description: This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.topic: conceptual -ms.date: 07/31/2023 +ms.date: 11/17/2023 --- # TPM Group Policy settings -This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. - -The Group Policy settings for TPM services are located at: - -**Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services\\** - -The following Group Policy settings were introduced in Windows. +This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. The Group Policy settings for TPM services are located under **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**. ## Configure the level of TPM owner authorization information available to the operating system @@ -22,28 +16,27 @@ The following Group Policy settings were introduced in Windows. This policy setting configured which TPM authorization values are stored in the registry of the local computer. Certain authorization values are required in order to allow Windows to perform certain actions. -|TPM 1.2 value | TPM 2.0 value | Purpose | Kept at level 0?| Kept at level 2?| Kept at level 4? | -|--------------|---------------|---------|-----------------|-----------------|------------------| -| OwnerAuthAdmin | StorageOwnerAuth | Create SRK | No | Yes | Yes | -| OwnerAuthEndorsement | EndorsementAuth | Create or use EK (1.2 only: Create AIK) | No | Yes | Yes | -| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | Yes | +| TPM 1.2 value | TPM 2.0 value | Purpose | Kept at level 0? | Kept at level 2? | Kept at level 4? | +|----------------------|------------------|-------------------------------------------|------------------|------------------|------------------| +| OwnerAuthAdmin | StorageOwnerAuth | Create SRK | No | Yes | Yes | +| OwnerAuthEndorsement | EndorsementAuth | Create or use EK (1.2 only: Create AIK) | No | Yes | Yes | +| OwnerAuthFull | LockoutAuth | Reset/change Dictionary Attack Protection | No | No | Yes | There are three TPM owner authentication settings that are managed by the Windows operating system. You can choose a value of **Full**, **Delegate**, or **None**. -- **Full** This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. Full owner authorization in TPM 1.2 is similar to lockout authorization in TPM 2.0. Owner authorization has a different meaning for TPM 2.0. +- **Full**: This setting stores the full TPM owner authorization, the TPM administrative delegation blob, and the TPM user delegation blob in the local registry. With this setting, you can use the TPM without requiring remote or external storage of the TPM owner authorization value. This setting is appropriate for scenarios that do not require you to reset the TPM anti-hammering logic or change the TPM owner authorization value. Some TPM-based applications may require that this setting is changed before features that depend on the TPM anti-hammering logic can be used. Full owner authorization in TPM 1.2 is similar to lockout authorization in TPM 2.0. Owner authorization has a different meaning for TPM 2.0. -- **Delegated** This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows prior to version 1703. +- **Delegated**: This setting stores only the TPM administrative delegation blob and the TPM user delegation blob in the local registry. This setting is appropriate for use with TPM-based applications that depend on the TPM antihammering logic. This is the default setting in Windows prior to version 1703. -- **None** This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. +- **None**: This setting provides compatibility with previous operating systems and applications. You can also use it for scenarios when TPM owner authorization cannot be stored locally. Using this setting might cause issues with some TPM-based applications. > [!NOTE] > If the operating system managed TPM authentication setting is changed from **Full** to **Delegated**, the full TPM owner authorization value will be regenerated, and any copies of the previously set TPM owner authorization value will be invalid. **Registry information** -Registry key: HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\TPM - -DWORD: OSManagedAuthLevel +Registry key: `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\TPM` +DWORD: `OSManagedAuthLevel` The following table shows the TPM owner authorization values in the registry. @@ -68,9 +61,8 @@ This setting helps administrators prevent the TPM hardware from entering a locko For each standard user, two thresholds apply. Exceeding either threshold prevents the user from sending a command that requires authorization to the TPM. Use the following policy settings to set the lockout duration: -- [Standard User Individual Lockout Threshold](#standard-user-individual-lockout-threshold) This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. - -- [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold) This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. +- [Standard User Individual Lockout Threshold](#standard-user-individual-lockout-threshold): This value is the maximum number of authorization failures that each standard user can have before the user is not allowed to send commands that require authorization to the TPM. +- [Standard User Total Lockout Threshold](#standard-user-total-lockout-threshold): This value is the maximum total number of authorization failures that all standard users can have before all standard users are not allowed to send commands that require authorization to the TPM. An administrator with the TPM owner password can fully reset the TPM's hardware lockout logic by using the Windows Defender Security Center. Each time an administrator resets the TPM's hardware lockout logic, all prior standard user TPM authorization failures are ignored. This allows standard users to immediately use the TPM normally. @@ -118,9 +110,7 @@ Introduced in Windows 10, version 1703, this policy setting configures the TPM t ## TPM Group Policy settings in Windows Security -You can change what users see about TPM in **Windows Security**. The Group Policy settings for the TPM area in **Windows Security** are located at: - -**Computer Configuration\\Administrative Templates\\Windows Components\\Windows Security\\Device security** +You can change what users see about TPM in **Windows Security**. The Group Policy settings for the TPM area in **Windows Security** are located under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Security** > **Device security**. ### Disable the Clear TPM button @@ -132,6 +122,6 @@ If you don't want users to see the recommendation to update TPM firmware, you ca ## Related topics -- [Trusted Platform Module](trusted-platform-module-top-node.md) +- [Trusted Platform Module](trusted-platform-module-overview.md) - [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true) - [BitLocker planning guide](../../operating-system-security/data-protection/bitlocker/planning-guide.md) diff --git a/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md b/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md deleted file mode 100644 index c19e762bdf..0000000000 --- a/windows/security/hardware-security/tpm/trusted-platform-module-top-node.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Trusted Platform Module -description: This topic for the IT professional provides links to information about the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. -ms.topic: conceptual -ms.date: 02/02/2023 -ms.collection: -- highpri -- tier1 ---- - -# Trusted Platform Module - -Trusted Platform Module (TPM) technology is designed to provide hardware-based, security-related functions. A TPM chip is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. The following topics provide details. - - - -| Topic | Description | -|-------|-------------| -| [Trusted Platform Module Overview](trusted-platform-module-overview.md) | Provides an overview of the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. | -| [TPM fundamentals](tpm-fundamentals.md) | Provides background about how a TPM can work with cryptographic keys. Also describes technologies that work with the TPM, such as TPM-based virtual smart cards. | -| [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) | Describes TPM services that can be controlled centrally by using Group Policy settings. | -| [Back up the TPM recovery information to AD DS](backup-tpm-recovery-information-to-ad-ds.md) | For Windows 10, version 1511 and Windows 10, version 1507 only, describes how to back up a computer's TPM information to Active Directory Domain Services. | -| [Troubleshoot the TPM](initialize-and-configure-ownership-of-the-tpm.md) | Describes actions you can take through the TPM snap-in, TPM.msc: view TPM status, troubleshoot TPM initialization, and clear keys from the TPM. Also, for TPM 1.2 and Windows 10, version 1507 or 1511, or Windows 11, describes how to turn the TPM on or off. | -| [Understanding PCR banks on TPM 2.0 devices](switch-pcr-banks-on-tpm-2-0-devices.md) | Provides background about what happens when you switch PCR banks on TPM 2.0 devices. | -| [TPM recommendations](tpm-recommendations.md) | Discusses aspects of TPMs such as the difference between TPM 1.2 and 2.0, and the Windows features for which a TPM is required or recommended. | diff --git a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md index 38961897cb..69e56ca8f4 100644 --- a/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md +++ b/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection.md @@ -81,6 +81,14 @@ Enhanced Phishing Protection can be configured using the [WebThreatDefense CSP][ By default, Enhanced Phishing Protection is deployed in audit mode, preventing notifications to the users for any protection scenarios. In audit mode, Enhanced Phishing Protection captures unsafe password entry events and sends diagnostic data through Microsoft Defender. Users aren't warned if they enter their work or school password into a phishing site, if they reuse their password, or if they unsafely store their password in applications. Because of this possibility, it's recommended that you configure Enhanced Phishing Protection to warn users during all protection scenarios. +| Setting | Default Value | Recommendation | +|---------------------------|------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Automatic Data Collection | **Enabled** for domain joined devices or devices enrolled with MDM.
    **Disabled** for all other devices. | **Enabled**: Turns on collection of additional content for security analysis from a suspicious website or app to improve Microsoft's threat intelligence | +| Service Enabled | **Enabled** | **Enabled**: Turns on Enhanced Phishing Protection in audit mode, which captures work or school password entry events and sends diagnostic data but doesn't show any notifications to your users. | +| Notify Malicious | **Disabled** for devices onboarded to MDE.
    **Enabled** for all other devices. | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school password into one of the previously described malicious scenarios and encourages them to change their password. | +| Notify Password Reuse | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users reuse their work or school password and encourages them to change their password. | +| Notify Unsafe App | **Disabled** | **Enabled**: Turns on Enhanced Phishing Protection notifications when users type their work or school passwords in Notepad and Microsoft 365 Office Apps. | + To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen settings. #### [:::image type="icon" source="images/icons/intune.svg"::: **Intune**](#tab/intune) From 1215c3bde6261d0ce221a9cf1a86cc1d1598d111 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 17 Nov 2023 16:05:53 -0500 Subject: [PATCH 187/237] Remove white glove from articles 3 --- windows/whats-new/whats-new-windows-10-version-1903.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 888405843b..c593f3baae 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -15,7 +15,7 @@ ms.date: 11/17/2023 # What's new in Windows 10, version 1903 for IT Pros **Applies to** -- Windows 10, version 1903 +- Windows 10, version 1903. This article lists new and updated features and content that are of interest to IT Pros for Windows 10 version 1903, also known as the Windows 10 May 2019 Update. This update also contains all features and fixes included in previous cumulative updates to Windows 10, version 1809. From 65ced7a69d2b187150f302827528943a1c85c3f5 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 17 Nov 2023 16:15:51 -0500 Subject: [PATCH 188/237] Fix link --- .../tpm/initialize-and-configure-ownership-of-the-tpm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md index 13fb26b05c..9e08708019 100644 --- a/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/hardware-security/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -16,7 +16,7 @@ This article provides information how to troubleshoot the Trusted Platform Modul With TPM 1.2 and Windows 11, you can also take the following actions: -- [Turn on or turn off the TPM](#turn-on-or-turn-off) +- [Turn on or turn off the TPM](#turn-on-or-turn-off-the-tpm) For information about the TPM cmdlets, see [TPM Cmdlets in Windows PowerShell](/powershell/module/trustedplatformmodule/?view=win10-ps&preserve-view=true). From 8724207fea5605688e7d05fd4e8a3badc0123024 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 17 Nov 2023 16:15:58 -0500 Subject: [PATCH 189/237] updates --- .../windows-firewall/configure.md | 24 +++++++++---------- .../windows-firewall/index.md | 2 +- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 4fbcf62473..16f030a03a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -22,8 +22,6 @@ Windows offers different tools to view the status and configure Windows Firewall > [!NOTE] > To change the configuration of Windows Firewall on a device, you must have administative rights. - #### Windows Defender Firewall with Advanced Security - :::row::: :::column span="4"::: #### Windows Security @@ -89,7 +87,7 @@ Windows offers different tools to view the status and configure Windows Firewall ## Firewall rules -In many cases, a first step for administrators is to customize the firewall profiles using *rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. +In many cases, a first step for administrators is to customize the firewall profiles using *firewall rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. It's recommended to maintain the default Windows Firewall settings whenever possible. The settings are designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. @@ -98,7 +96,7 @@ It's recommended to maintain the default Windows Firewall settings whenever poss ### Restrictions per profile -You may need to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify **Local Subnet** only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. +You may need to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify *Local Subnet* only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. ### Rule precedence for inbound rules @@ -150,7 +148,7 @@ Creation of application rules at runtime can also be prohibited by administrator Firewall rules can be deployed: -1. Locally using the [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) console (wf.msc`)`) +1. Locally using the [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) console (`wf.msc`) or the local GPO editor (`gpedit.msc`) 1. Locally using [command line tools](#command-line-tools) 1. Remotely using group policy (GPO) settings if the device is a member of an Active Directory domain, or managed by Configuration Manager 1. Remotely using the [Firewall CSP](/windows/client-management/mdm/firewall-csp), with a mobile device management (MDM) solution like Microsoft Intune @@ -182,16 +180,16 @@ The Windows Firewall settings configured via GPO or CSP are stored in the regist Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: -- Reads all firewall rules and settings -- Applies any new filters -- Removes the old filters +1. Reads all firewall rules and settings +1. Applies any new filters +1. Removes the old filters > [!NOTE] > The actions are triggered whenever something is written to, or deleted from the registry location the GPO settings are stored, regardless if there's really a configuration change. During the process, IPsec connections are disconnected. -Many policy implementations specify that they're updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. To control the behavior of the registry group policy processing, you can use the policy `Computer Configuration > Administrative Templates > System > Group Policy > Configure registry policy processing`. The *Process even if the Group Policy objects haven't changed* option updates and reapplies the policies even if the policies haven't changed. This option is disabled by default. +Many policy implementations specify that they're updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. To control the behavior of the registry group policy processing, you can use the policy **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure registry policy processing**. The **Process even if the Group Policy objects haven't changed** option updates and reapplies the policies even if the policies haven't changed. This option is disabled by default. -If you enable the option *Process even if the Group Policy objects haven't changed*, the WFP filters get reapplied during **every** background refresh. In case you have 10 group policies, the WFP filters get reapplied 10 times during the refresh interval. If an error happens during policy processing, the applied settings might be incomplete, resulting in issues like: +If you enable the option **Process even if the Group Policy objects haven't changed**, the WFP filters get reapplied at **every** background refresh. In case you have 10 group policies, the WFP filters get reapplied 10 times during the refresh interval. If an error happens during policy processing, the applied settings might be incomplete, resulting in issues like: - Windows Firewall blocks inbound or outbound traffic allowed by group policies - Local Firewall settings are applied instead of group policy settings @@ -199,7 +197,7 @@ If you enable the option *Process even if the Group Policy objects haven't chang The temporary solution is to refresh the group policy settings, using the command `gpupdate.exe /force`, which requires connectivity to a domain controller. -To avoid the issue, leave the policy `Computer Configuration > Administrative Templates > System > Group Policy > Configure registry policy processing` to the default value of *Not Configured* or, if already configured, configure it *Disabled*. +To avoid the issue, leave the policy **Configure registry policy processing** to the default value of **Not Configured** or, if already configured, configure it **Disabled**. > [!IMPORTANT] > The checkbox next to **Process even if the Group Policy objects have not changed** must be unchecked. If you leave it unchecked, WFP filters are written only in case there's a configuration change. @@ -240,7 +238,7 @@ Windows Firewall supports the use of Windows Defender Application Control (WDAC) A Windows Defender Application Control (WDAC) policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. -Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications. +Follow the detailed [WDAC Application ID (AppId) Tagging guide](../../../application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. ### Step 2: Configure Firewall Rules using PolicyAppId Tags @@ -252,4 +250,4 @@ You can do this through the Intune admin center under Endpoint security > Firewa -[SEC-1]: windowsdefender://network/ \ No newline at end of file +[SEC-1]: windowsdefender://network/ diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 404f90b1eb..b29fe008be 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -81,4 +81,4 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI [FHUB]: feedback-hub:?tabid=2&newFeedback=true -[NLA]: /windows/win32/winsock/network-location-awareness-service-provider-nla--2 \ No newline at end of file +[NLA]: /windows/win32/winsock/network-location-awareness-service-provider-nla--2 From 06fcce307e272aa5d2de2e43d466692dfe504786 Mon Sep 17 00:00:00 2001 From: lzw_29107 <2910729822@qq.com> Date: Mon, 20 Nov 2023 21:32:48 +0800 Subject: [PATCH 190/237] Correction: Change 23H3 to 23H2 --- .../required-diagnostic-events-fields-windows-11-22H2.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md b/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md index 4ac93439c6..f79b3dd872 100644 --- a/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md +++ b/windows/privacy/required-diagnostic-events-fields-windows-11-22H2.md @@ -1,6 +1,6 @@ --- description: Learn more about the diagnostic data gathered for Windows 11, versions 23H2 and 22H2. -title: Required diagnostic events and fields for Windows 11, versions 23H3 and 22H2 +title: Required diagnostic events and fields for Windows 11, versions 23H2 and 22H2 keywords: privacy, telemetry ms.prod: windows-client ms.technology: itpro-privacy @@ -3655,4 +3655,4 @@ The following fields are available: - **ScenarioSupported** Whether the updated scenario that was passed in was supported. - **SessionId** The UpdateAgent “SessionId” value. - **UpdateId** Unique identifier for the Update. -- **WuId** Unique identifier for the Windows Update client. \ No newline at end of file +- **WuId** Unique identifier for the Windows Update client. From 07ae299921b4ee1e73c0577f054e17db7cba2fc3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 09:13:58 -0500 Subject: [PATCH 191/237] split firewall rules article --- .../configure-with-command-line.md | 4 +- .../images/fw04-userquery.png | Bin 248535 -> 0 bytes .../windows-firewall/index.md | 9 +- .../windows-firewall/rules.md | 79 ++++++++++++++++++ .../network-security/windows-firewall/toc.yml | 2 + 5 files changed, 89 insertions(+), 5 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/fw04-userquery.png create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/rules.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index a8d3366082..6b8e4caa04 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -2,7 +2,7 @@ title: Manage Windows Firewall with the command line description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. ms.topic: conceptual -ms.date: 11/15/2023 +ms.date: 11/20/2023 --- # Manage Windows Firewall with the command line @@ -285,7 +285,7 @@ netsh advfirewall consec add rule name="Require Inbound Authentication" endpoint ### Add custom authentication methods to an IPsec rule -If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](/previous-versions/windows/it-pro/windows-server-2003/cc757847(v=ws.10)) . +If you want to create a custom set of quick-mode proposals that includes both AH and ESP in an IPsec rule object, you create the associated objects separately and link their associations. For more information about authentication methods, see [Choosing the IPsec Protocol](/previous-versions/windows/it-pro/windows-server-2003/cc757847(v=ws.10)). You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object. ![crypto set object.](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/fw04-userquery.png b/windows/security/operating-system-security/network-security/windows-firewall/images/fw04-userquery.png deleted file mode 100644 index 85f748547922aaeba593b88ad441bb45eb0e0559..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 248535 zcmV(!K;^%QP)Px#32;bRa{vGi!~g&e!~vBn4jTXf|Fua(K~#8N?EUw*WY>Mz3s#Od$L`y?8x1sa zCP9J-Bmqz&MLtGRvLs8EDf_***4XR)1*7?4){MR0jAq7f)>|I`G9Jm2C0QZ~27pA) zXf)91ZlH6Hw{Oms!+gHq?>?tag&P_KDat~jaJ%Z%IXirF+IxrV^?E4yYW^m_gabd@ zufZ#P_$?j zAL*oC4uxXUy8o0nHUCDQt5m9o4!*a2+xC%7o8(Tpxdw{Ek!S-OHb@?0NIFdSlQm=` z)?Xc9LV!pg_g^|MZCf8VIQyWp!OL`X@btoM9xhyuK3>{sgu8X<9?UACNW5BCKnEe_ z_sD(r^4ko|NV{sN)5xTy^)C%DILA_~*|&`Q&fjvU}K@7*l2fc85|(EpDh* z;LwtXdOp})iq-&(nupZ-gWuF@KXhoU_13jnb@hgue(A{3t3KP(W!ro^KiEt-DI9aGlFPrdK^}>M11A#6}-ZXQ=Y1 zs)BFaZ2Hp%-24g-sm{D2v?r?8S9tcMjzjt~69jc7TF?}-8>D=3dX`HSu`PTx7VNgB z6X9>vn+~(4zm_@jqp4wgc5N0gi<4%V0=L$}^@wQHC@MMlg5YZPu=VTPRn~H2aiItK6G37_{Jq=r{VnrD)?V;0vnY3H-wWGN_G_7)WkX}YJ;P?q1%2zK-~}o zl)2ZJLO0UpKM@7LCeYdlOYZJ?@kSu)?)4GY&dh6&PK(NM>RkRoRyVwMy^dCJn$lAZ zZurgZH~c` zSDTc6i*616CR!dxU$hpTMARl}dWk|+i>1vHXxwHKkq5c2Gj>I5J3qR$eY1f?14{#Z z!LR^Ikx;azF@(TO{kDBwz8c>Kfa8J(ez(#-62GLpP1cI4u6y^hF-H|kU z>g2+vgfhE_9ITby2`eGR$KKl-Hqc$>CU>2A--%QSN9w2}X+K3bKXf1hYX zQ{Fl&+VW?IQj5eIJ~f)xA`Nzf7!b8uJ%USWSDL^EdL=CH`?IJ?mohL-WTQ1(f_wdF zwI_d7fjMblKydMLeNF@JVhBWhv%|s4S8_Hf>BDpGy%rkdY)rOIts3M7CZ_Bou9@H@ z?Q;;4?YtFK|K4Z({u&mN*Mob=Gsg6?`R-m`p~WvZ)2-dG=t#G#DFc7*Ysip}qM`-O z3S;l34{Vfuyoc7kzp0BG{L-=UmWylL^RbN0hj0tEI2!YKe6?Y;&sa$%*s9**2k06& z2q@k5*iHab8=9uyW2dG%IpUoL{&6UHo1Z~%jaU0UYd|NNA@C7Nr9p=EFI9&j!D!G9s6?#wCs3BuC$F*F)BC6P#Cf|AI2#|^;5NOz^-2v z^$z3Cm&18g_10-rh<9m7C&!aKp$@GZj5lp>=-Pqfb?F$At_sV9Z4jrF-}9JkDB1)LA3gV^v7*iT5#&MtnUD z5ia-=paE@d%9o(tb)O2Gr{FaeCadOSCkR{r21g%GerYt#2Eb?=bju~V;@ES60@REg;Q zQbWLxs#>JBqp41S)_h?4Q!vQ$ml92zCjVFfLO#|*F&&J7$PnQR5W7KY7d#H~TeJIY zknW<#3yi@d>c$6|hz`$Dj`ElBg2BhwK^2d0-gyM0q-bPmz@ZTl2v)&a55)~ZZb%Y_ zvzhuN%~P7t@+PUE695`sJP-*}R2_Bss>S9)YX&8w84HKers0tfTr7q{35C1aT_OQI zN-)^^l7aCVRDEG9H&?5%hzh-M)UGSH)}vvGDl%E)N5h41ind?~6+ZGRKzzQo?(8ow zb4BEeemAx?5IO$x1{qWVzMMqxMupuSCIIV+u#mIQ zO}@C68|o#BY?L0uK4H+hF(y}e`K09|(;#3|aHwg>OHm?rCsQ`)RTVlmab8B2@>OrJ z*`a9Si~&I;Hj#5xZFbh2aJ>?$@ljx!?pK@O+OPI|{B~LzT%#RhZT|)JxDnVW-P~2Z z^HZ)Cnpz2!+IkkM@`{cjJ*YVqsr95INf6Fs`C_P2k{a(?Sz(|~2IOX%x>R;a;u&m44q5y{h2%rpHzzzHW4f5WW_>KrB%XF%U zMa4#8?r^AFP)R{DAyiK!!nE(J1llQ8LM6SQF~ z1Z*}uumC|tLuJsaU*i}VphGP~pu|s5T!k()m0{zl0%WxWP5B}E%?~gJ#zwKZ0~xRn z9=Xk!g2BKZafPjrpXNiDCM}4_HspdsI#pXI3uJ0CFYaUt@)yFzT-K%peK7%Pv07g& z*Q1F@A{NTB$bw4Dawt#x%qS8{RYPf}3^~y(gDDBd5rM*tOg}DZLjYLz02K@+wn3_@4GXP-_O$y1RD>77? z5+3o@Jgq6FMDl9C+zbuZmAQdH1$#UO1ITz7VObv(UWWx3jIF284um$qf{q{9(o`ZY z&^C4x!@ndd1crcWnL9jgX_{0x)Fqr=gKUag8p_0h3^Nr4R;w52Hxe#@M?e{^MyjD~ zEXH4MfQm?K@c^?g)R0*btVy{`l{CO-`qGF;7$qfN(XtWoB~sxq!xI+Jlox|6RqEwh zS>O&2X6_RiH_m%FB^3L#mafR#YgSi%2f|E!4qsJsz&5qc9FI6J0`wWd>HO z0h5TVd=YU-LaB=KQ_4@)D{;Qo!jL^Q4!V-za3U72m{p;S%)3yoAWEsC%_I{bQCL_l z6!{Eh`B8(NTu<=3in4OKTEWPO#{|VuQ5G}_MTr!RRv1vVniT6?R+B(dMM$I$;YO0x zsE}B-QclFV;YnL`34bS~Zr4B85`ITD58^0tiGV*NaeWu@1Q;MRKb0w15GS;YMaJY$5{_vIarQ zXiXZ~EVGaBQnOu5y5O@dO;swD)2B}PH&{Hu^c#Tu;%)czA+=40dpCs{pD2b<=+N1@ z@BH!qoQog?{FlNwEHnnxVyNMAK2a~-xp(__zy6z#KYai6<*V0^9S=`U#+K&d`K4^6 z4ylO`7LHVM`QpM-VRkMzKVMi{UMMUtm-BFN3@%5>MZ>e%=xkqdwkMv?M2pcnoCVs@ z=&&^Gha9N!0;uIG%Dz}GqsuWQDn-n|^u4z~@YG{pPDXoPeBrG(-afpH;z?#JG3X-# zvoIlGuMsJsVNqDHM_5wUBLls+?A)4+hA*B!H#s>2>x2{WQl*^AX0~kIwqs=T?6qr? zS1uPq)rG=JIa(hc+B7;e8m?3)u3ukXS&5|+gQG+7RATb#{M_tPI2wz^L#cFP`;Hxv zNaX6JOEc4xNZ`$zhxgsGx4(C&SPaiD&E*zndl*SEHa%B7w^&>*EhW>To3?M>H8MP$ z$t086<=pbw^CwP^&&-uV(PTF!Otf0uGBUhvY*V$IKXdNF@^YT4x_C6UZTq&7;eq+Z z`LpNGFDw?idwYg94ULR$?(OZ)q!Q(7d1hw%+O_Mmb94DZSpqF^Dxi?iQZ1cI4UhJ3 z-aOiq?WtF4$yg$jOcnB_^XJZ=zj(G-p>{8l%x22v^8DOfI+?oprdxLI*qP0wqtRHo zUO#)`^yxDv^DEV4D%&?Wv~~OD+3D-k*RQdDEWezuRaUlc+kEpaxAgRllq=YGm6`da zOINO49UqUz8|c*Y}05qolRf3Iy1AFTgl~yhkJI84sRPC zNq6 zQtj>P8W|nRS4&qX#+UMiY**KoEn}&8czXQ$!pu@M)`dP;Eaj`A{O~~kO=CMY^^IoY znQEv!u{6zla`O6O4z-mU=qs(Oy?*ub`RVzR zm?ZJd+06Fgfzg4Uc+bG>N@4Qyg;XS*O(m{go0!iR;{(H6`ZDoaW#anOd~PMv*E2f0 z3DGz?F}bji1AFj@2<>n!60K&lnbFbFLa{P&b-Y|G#}g?e#lS%SwvmzI;^Nhd=W?Oi z(CFyC&D#b?hl};f(>ImSJSr@iQ0BT%L@_GrM-*v}ezb?qsdJJdB`0B#ZoMuBz6e}BlU~OuT(tSm)$oug6VYb z!nNf>tyHRJBDGC}12A>(=x`>RDdh7r*BQdq>$5YZa=E|1|E67gzy-W8IX%TsX+Fi` z*REb&$*mw)d-{5J?%vryFiG&q!42IW^T)k@KH_t0`BGPgL3%Dj2+-o0D5^d*x>>*ajm+T`TrE0=Ma zH*MLnZTpT)I)#!ijL9#pQf4j3iB`0WNP*+2Qz7u9mDvcJJE0b?2r`PZINK zX@2SYh4J}``6^PVRwE~qERPxPwTrCOp zds`N@xr*aen(`9{h&PP1pZ?kZe#bDZ(G*k&V@p>*?BuK-G;zBGk*&Vqy5I^4+n@xo=N`X1nWi(PRhA|Eqlq3Qq za8s+IRx7dNo>DiKI%gu6i`Xw*<~lxl}9V!*%SI zL=>|q!e#L!FiFLhj6~y!E`)m(`v;$n1|;SQ%p}^vP-DqV8TnPKi=M+CuUASXczQV= zs&*$caiR?Lj9YSA6!JxykubqZsufE36^R%a74x{pzp+|2HB>Iw3uWSw zSOPg5nslr$7EaVEi{M>JB~`)L1qi8ZD3L0{TNP}wPRjFD&)M8B7+_E({fgi#0eZl_^G(#Zoa_Tn3ei2-Zdnmk5M*p^fle zk_d_WrHv+vbz&+NXbbMg$OS2-QWWQu)`3?lt*hh1*?2axlB?u% zcoe006;~{l>SlVPjKalG5t7J+V?D)CbQ#Mio)1@xseCnENu;rcqxGe5J|8a;Zwe*4 z3-wg3Pz>dll9k0wHlE0I<-*x~UTl?Yq>#YH#T1HVu}5p+Xm7ooEa!_$bLD8dmP|)$ zWv0=Uh_4h%l~}42?@E*w(h{AF=4xdStT9a7k!Xcg4mh^)G`35%4u32`6p2(yY8A@0 z1R5-sDVFgDYw=lcT%M!>8b4f7cCBpHjwlX1jDzF5F47IP4qEF*Ah z>0}}hVl2 zlny7-D9uuSHdI*1FbQ$_)3roTz5r#{aKBQaT)esxk48$NbRpbb6ZaX?TdEdwv0Ah% zJ`k%$EBQhsS`H`BC*@)^Q;VgmkvJMO49!ZdpM^;L4vBA(g)o`LWk{qd2bJ23H ztDIjZB!g}Pz?EFIun?(MuqnckbWK*T)Qgo|1aTY3hAZGM$D{F5I8l(eVQvTkS*fiM zXiW|Pu&!D$T*Ljz12_@Yl?vk|_*PEB!OSI;B(hR0R^aa}#$qU1!i2!K#Gplnh|6C= zeBgX1le{H_fRPBTLHHWVlMq<7SPvBv$!s_>nk&@`2*CJ!I#x;|T*~o!q^klJBGq~P zw{mf)UK>azMGxchs)H^OGQ4_Zd8LG12$vvZ>HwM8V=@zqCd=Rte_l8`z7R?FV@DG^ ziWRHz5@^B!PuEk~Xb(;|AptC&NPQ(NvAgI3@q|P+8A(LSxl|OJnW#prSW7KbYJ*T; zaUoS-!JS+#MyoL-n}j4Vi^H+haw5K1&Sk1AnMx&6tfVu2*mEn(v$66-D%)L)^)3}t zOg$DVXz&h?9@kOADmbB)a5yIs8;KC&DwHIOYeB#pe6?$Mb;mXJ5pd$0{Q34S^k&OB z)N2R+*Z=qZgQDPrujrrtpZ=8LVvSs#EC20}o~wn^1On|X0a^%KvY=2tF)rwvfO>hT zr{@m*yIngA`SQ~AOl5vPR;?mH;`oYDLLAkpg~dg@_W6b7~aG@h-7<2ZzQSS6l}M7x0pgCy`4Mc+%6Kzy0F8LBXb zQ$k_^<-=`R?q>GTTeyy$5Gtg)qUi)YltNPwkBnuDu|zeMD28!nB$P&ufXEVF4rHYv z#CV+H#Sn!RrW8%35f$`N#-bM+1$iukL^RhRK4OmmkQ|=WH)!0k9wYh!CyHXg){Ucv zV$2w+E=3PgZ-+6EO=hztI53vTSFugP+1`OkHf;(&xNiIf*f0AMo2 zBgsq(OO`-2`i5C6ju>J(!erx73EUy(qDjCN1G$)IM24fu<(gQ(DMTYmF`KT%x(Tu| zUqnF?GbRzwf#_H~oJx|mL5oFV$tsYnqf3#8v2Ze(N9Dwlaa4#z?a0{F7&AhSZUhbt zL;PcWAEJ0_T}R0eNFL8fJh4M zz!R`boRAl$RV*D(b@P+3sRr=Fi43<@$}0%zdOThOAaUp|j1d`2p}$jjJrXgLLKs@+ zvgmJ#yw)LZG*SW~%Ixs~QYnHp@g)M`5wS-g_)0vMCkPA<)0uQSQ><3=l0K72aYfRO zU?UleC3u?lKsIj$X#%|p9l}&_Rh3^QO+hRZGavy9Nvh>*)nY742tj6$N|);40z?*L zl1T_6nMg;8SHVTZ1iHGhP6P~mOClf8*93P_E*N%jP)f3L;b=J;hZrCv@v2F15FBE7 zsV=m14U-xvC21zjpJAXT62b-H1n{&inBs8+7;;0bWz4LohxTLEQ4XGZWD%PIL71*fQvLnjgVNTiH`C{YM(5{V|l0!XF=jGB_bJ^?TADTs<8dWkpIGU;Rn zO%WphQd-2qNMd9nDkRFXR4ElBb%IP>URlXQ1@&aAnt&<58}=$xLqaE7#c&iWwOT8# zKrdhn1}@_EkR(W@BI2%u=gF+lHow$sscg0yNf3doVg|-V9+Z$N(QGt%Aekg25Xcw0L%+k0#S(EcyoY)^-nH+h+xPCgrI-(&JbCHL z_*|)m2uRi93DjE=%U*UysX|Q<4(gJuplAx%Q@p-NJc|e0vr?`V2+u|$xrziKQ9AHV zPb{ekxiAz9cjhGp7|X`+t&-sg(X-lotqh%L-X&40MV4_-p~X6wMpZAFZEjQ9>G5081!=Mnku3%(VFTK zst`m%|0RNb5+d`8u49rcA(8;>TisB-6kFD!^*s_FS!!3lTXI))S^nqzD}skx4Kg>;Rxr z3B(J^ITgjW(bcZ8IMPOnXeBKTyd~pLa*|O=1{q~Zelk|iFa(Sk_RNGxs?`KNK-Y z%^Zbn=z=Ijv4WUomI;Z1AoEIPvZbV-s*&Uj@j)q_h-5G|_y`pyaEo{onyQ1dp|zHze^W16$y@b_CR z1Lt=)d+@CWgjKou#oMaQwH+wyPoDY>6nvu@wFgAO^A9XKK3n?RA3j?SW0uNj0JB!n zSfLs+qf9joB_T-a?nGp4^XTR++tTUu(#&jOZYf?a5kbzC3iJ8WQi=R~u7m@KxT=&O zKi-mA$EuYaJhfO+Y|BDAQOKm0vf(Nh;t>=Z;#mR)$RnY6yd4p{V&O}?4AVf=JtDcU zYiQq1cajWSn9Uvk@a)9YVknBvOG=>+@?GLVRN7Z1qAi746y>BuhM-2o!(kXm;do9` zC{-L<)EnhCCF0ffP^LyEfy+_=h}h3b9ajWSia-|d8PSJiQmi9p1?fdoQsN=Y)6JZU zL0(91zec!e-9vPrx@0wjW|NE8VQ43Py;bFo&_be)7x#mxY2)e_N+L?RfF*>4PK!jMz!U1yaA8DikS_2wp4| zu?@O#P6-sE1n>w*Y~(`Gd?ZTd6XAut6k8bw4o>&HGX#^tiZ84NZ_iOnd9=((hp(Pmu zZa)ndinUx0Ul+d(6OGCM08WfFUc(NNaY>ns5Wlj3dh4K7l3KEj13-{Kveh$VKT~%l z6{}Su`BFT@MJb-DC9vgEP%<=-WBN#5(jPos#AK2hRrMU?L8E3}CSV&Rh;zUIU_+ET zrUu`rEJG9`K~XJWU6eDDohS}K2DB;w(bXtxd?tzHmoVZG;qfx@oBMq?w0ZpaYr#4EA^FPg%Daz z!W+bFX-_-_vBGe?Fq)%X#Dp>2OUy%xsevPwG;ASumN?b|qpH*ysX@yf)Tz z$)_<5zzte7pn<*0-~k0GpaM~MF^e(!X^P=RU^`_M@r zMU<{ErMMzw+2O3(auvf;0$0f2B%ysMmgqO3h$wa>-cKcowUmee7R&;&KZ#UkPGf7T z+mN*7P&F@BWHMc#PFLmtCh`PJ=pNNxPQ=8sl9eo?Q{r(%Rt=#ep)YK{aH5hV#9vvd z7GOVgQ8kn-RO>tsVsI)M5Z(-LC>47G>7@}JVH=!D$1qxxuhK3md9}*Nno|+4A2!jR#KAtym*J2`5=t{EIJhlPJ_gmQEVcJWt#!CnwXcE)~W!c zs2opF!WLF$=(dN0clAveLKY>-gHQm<5hq>}=R_?f<;w`VWX!~_kz!0v9Aa*Uaga2) z)VP{RigbpWEKw)oPNIO&pU4d?ZJbZM5^=aCTuhIQ3HrhHND%v#)ety)6dMrb$I1av zxJ;7L6^$zEauS$a%(gd?B;H7DL4wgZ)#6o%rU8r6hb^6=S=H()J)BDmHo=9hWK-p2 zMz*LG@oL1EFcVT7YDsLv$ht3(C6Xl84V5r>DJhm10J2!k0a>SsS0)rdhF;Pfk`JOM z=Bee=;uuLbL_9J)dNdoZz7~^c&8_;~#1kZzAhC5YFD4WcOk8wg+E53SAw@B2>>|75 z0m)VHkG!SIUNt>*t=sNODXNS339pJg(J{%W7^{eC2`x$(OB_BZ1#bpxMyi@2HtZyk zlM<$(J?5!yimhkSK}gq<=F&PifB{5gLK2CU5z0uUijgP8FvV0vxI^N6Os2?pN~bhM zQichWY~o6xB7uA@)dmexU?tS3{<~5pK_h}LCVKz{{*;iCS!6+5 z5>TNH4Cf-Q*saB>YK-B`B#{kpzB?LOID8@qxL>DHv))OMG7JATdWJoG9Tmfu9`V zA@WmJzY^G^Kk+&w;D+G{9agEijFed$AySSy7@>CskVcoKxg?RYa)Gf%;wi#vk|C&w z{Q*G4goBKb{<^LN>=M$@HC}uW%NW5QA*;xg#V(@w2?%1nOCD3!(uN5d=O*zW1fy*qjy*-rb~v z-zj)#^XhB`1z!rM#2^*PW$wQh(MLIfR0(y0xN0_&-L`ql=E45bN^W9mZhSs}c`ko# zp}1H{l+0*OrLLRc}%zB%+XuQbANN<4h@sRf$zdjXh44 zR0vRkL~SPZcd0z9iYUoITjTXf3_QAo#~}-KBvvj`pY**rkiz6@|DwZWbuPjMnJ*zT zNsxZ&f=zNa>Pti4G+C4Na-!8lu<@wG1`%1Z)>aDO3=o0SL=n{v z=?j5M-y)(Us46N*;`XQ(bdH)kvN}caDCt@i;x48njVh6(ula?lIRh;Ut5;|fiC{k6u-_x@gYl3 z#9a`JKyT`i zJ~PV@vp|=0iA&F9q*=}FN;->KOE_B(HV|SG_LfF0a3m-bww1XH$;iKIoS{sB3zdi( z_LKFctTU6cIxVCS+fNN0iK%ONMl`-5OF~g}N+w7)e+3$?7r< z+X?}w0n8xzK`j{pslJ5>9lc7Gtp|GHWu1gRYMq$LC3BZrUVtoM#2S&Tjod&4i;0lN z4P#^}uZb47hm~l>Z&#MFgfG%XAjMzXPsNZSR;M|hm>~KqPZ7zJ1(sr^GNTv?^(3q* zF1WCdSYEXXaYaH_B02?M5_l)UCTt+N6-AV83#!?1VGQ|6`~~%Gbn7pA#~;$Q{vuy> z=32`nl%@slww6-Gf&Ug8!2q=OYXi4vONP)jOaWh@wR{jt#)J12ye9CpF`0?DL6LXP z<-Ywd{+C>&-&TjC_J~%ilvd$et#->!1%$K7Ko$1w+WCzqpZNNtpPm`N{_5KYFI}0P zVP#gXoK2*o?H;>%c+grBLwCht;-kgF$k&w@Mh`NXjDxw;feCq@TG?<&`JynOJ|PhUNJ?#f~` zI~+>&%Hldw>0&X72d~zqkiGy+>D7WK`0^q(#nCELrHbW9_B|(C?nHVjxlBEutg(P2 zTOjHX?S(dbLd8sNQ5McdDP560Ey!CUb4b}piJg>>;C~S&!dPP$0qPc{N6PC{s^BG( zqb`YwUh&$6R=Gq+uDbs03+1x|C{o6%k_m!&kDaQM95}0J0uZ6pKU}WF4-mD3OS^Qrd)~Q_{lt zK!gMZ_7otM7`*a=tl(7lN``G!D+&OABYhPNG8a(+PDbf^R&}+FIaR?aC#X`9O$4yq zyw zr_!c5CMuwm0i|kG+xO(H`BQqMBG8+Lo4(pXf@|3iKm@()2Oy$SLIH+P(fKNO`Dpw0 zV%dmYs)h0<(yf5c7he{|5yhk6c7j+w==fEah!G^~g2~QAa4oqI!Oc%|WlIU6s9(qZ4f{>xQIVwE%1$ zx~-P%rX?sM`$JA0t4D{dV7FkZ5sCC9p)^CDy)>8&o$C%L5-!y9AWU)#r8pTb!qc{+ zk_?zLuXW=988%icsV-?$CoPi|^Hh$a6s<3LI1OP-Nt)Cjd0_z=kt%Yr_?43tF=7^> zbj6g?L96AYP!j7&4P7ZvmJedLn!RP7s2)0@Bk)W+hXn<-8hnCEoweduhN-3kk5Z(j zpU{nRS$AWS5SiIYyp+XEuRFM?LnCMtUXZG81vNw0xV=1WVnrP!861*^RD>#2NgDHu z_!}ZhB?5!|&@y2Gmn2lBYcWyeiW|J-P?WvZ3sDu*1thx!OyC=e>hB3ERH?zy8_% z1A{^qDs}9o&V`B;&l}S$zWYJPB~z7uOr!#0;v7r4()jE`zD$W&Z!(izsfCsaeaF%Z z;lyGrJs(ZaMlv(8ZX)w@iR^qlwGc}#MH9=>WP!>NYLX*Vyr(F3O;XTI5gIiR;Tpj! zNvg5DEL2T}tC>(aT`gt8mA+)8n+hy=Qsga*MpDUS&(ca|W_EdDk)@=%C{7LzQ8(Q- z*3}9KkGMpP@>#U0N@f?UQ_(M+A;c>%0ljLFiZ-xX7q#5Y+*J=)rHYvUBF;oiU~h{w z61pK-YvR-SC#q7N-RetvB?{}&tX8d|76qb1lUSUjhC~5LVjW9DM6oC+!GJUpVTBj?xXa&t4D410zigzay&@m}CRrV_M#rZbYR#B^5tPu^PXMv{(Yq>0*ihB4GZ&7kH zlShA6VQwN_i~)%OXzEns77A2VhGtwSF(_hWfX0n75<1X=K*?2k#*05y+1SM7iRvox z{j@07P$#;>=wGz7NBBysvfNS7BPdX}SGA5wGi6teJ*bG(>Qd!=0hyREx+*}1C*HiS zLQp7ayQYwoQOp$=V96|Gni_f%btLqxn?I>_WgY3PJ#Y!Y6v~2DSq7jAQOOK0X4qJ_ z`iy2k#KTp3)45AT#ALg`!Hrv0o(gE1BC;pZ6N?MVB*a?M__leo= zPBqB*G)|xoX{gI-d}ACR`(`DGgw%+F(y!SVk_gq&D*cMEaZt7{xLHbA^l2NsYgHLR zV@W(zSA>l+378 zL`Rw(GohjBJ=+jPgo(_Gf(4$_IEPrDCUDF;b9zEyFO%@N(xj08*4Z^(Q#WHHZ+-NJ zUcS;^g61}zC_3vl`2b%D~n6G=$TCSaK0Q~SfUh{LXC_@;lvVC zuS_JAlN&k}-?Ub(Pkn$1t9nWc)A6vW?=W`4^n)%4^@yja<=1HyIO-!yl9}QUiP9it zbn72eMZ)~H7ENMz+%HQc2t*idt8u8Bz?rmuJ(Oby$zHl3t_WU9D|nhxg`XyzG?lKc z!4+Cxq-s`MRS~5#Rhe!EtKQ%}X}Z9)g1t0z>l{C|&}D#LD>_h>+|CNo@_XT1NoQ)x zTcnj*`ARFMNhK}6^ZH*J0J)m zOf(xZ^d>hYdEQ}0%{*z)Y$nzFst{aQRHd6)SBy~L@7aY$W}bvISJkH%m5I)zlGbI? z3K^3d$}Ac(mT_r?psiR`1~p_VxtPtSzPr%yRn25(5i+7<4S7|?GA~CeTf%av5P=Ts#S#S^jt+p^QM>7P*VLQNeD+Y8qCqL zDz)2`%xrR8BE3WZ8dFi;k>~ZV3xBxF%G8dwJR-LF>+W6Fuu2Ite>{DnwX!l3Wh_CT zRN&hvi~>~%$o+zTsSWgqN_D)63CCW>&T3_AQcS*T4AKOQ>1<~i8m4vbMwyBZ1&GE1 zJuDlO8!U-r2!_8D>QB$8$F7(<#<#bi`JNXtQtsAOtdj3X8qb@sGNJjRH` ztWL4e#VQc&$O0RsJ+s@S97r=BvW!?`eNuaCTRa3_N+w2@0%&6#a~*^4HZ(Q25^V9~ z`P|-NQ@akMfoo2|8xJ}oNmY;9lSV!QGJ%op!7F94)I$|#<|aQpf4ZEA^lu(XWHaoB zkP9bQqM503WGUV|AMcq(!AJX6;(hse*K#boj1wOYqvrFJEXj%{95`xbDR8AehN>wr zOkry=9U-Ao&9aqDq?(G7eW9j{;zp_ODO0B#>F(;?97%Lf%q~pME>a%KDh{c)QQfX7 zY|th`Q0#vhI#gzP6R?CKz``#jI4jT)ijr)aTw!5`o+rmDb4?x#F-S&Clf6bGe8e_% zmb;4-Xg!8TLuIw5$8c)&nZi)HWLj5cy{T)<@9`@NllDnA3O{K*l{k5-HGMRxv{aEK zBT;|dGsx{<6IY5O4Jjz?J67_vw}(dMKoKy)Dpr(jB1o2@sBjhSs@{-p|11oF8Lz=^ z8-saCY6Gh{b}<1X7GpD`8eMfGKot8~vXPqF#XuJ>Q=wzxkuT;li$P#hRnetfrqlD9 z_5Dkmq{$1BcglX!qlR)Mlu3I0vf>5QhO8pW+6Jn32PhvJP|4% z#Cb;*sbJg}iJS*&MwhsB`6`S*}jWm?MJ{k~9 zCW39=CYRJZlW8mTO#65iuprb;PgRm|i@K6B9hs$RX`PYT5E|vP@fr1*A~zLf2?5V& z(kU8D(CBUheRV8#49<4+WWCU;7#6A`8dR??s46EXXgx@&2)DVbMP)&LZ#s$v)3w%{ z&cKM$@r9#0F{I28P*tLF1D(56qX_*wbIpu4<$w9v;`(OIsDCbWU`!!z)4vLEPX-tP zd$?9OIg3&sSAdv!5Pp=eN{~7peb%f1x6`i56leEqEKVn>bpSU&$iIWefO@aK7@?Xu zdXKjSyVsX8k8zor+v@Im0!y&#@sN$jH7s{XL6T1#+J@s0)vjh*iS*Fc-10Eh-immW zWLCvuq%IFh>7-5stgxkkY_uSEdS<Es}2=2oH(IW zk?Iz3N|(%o@=>e&;UX0a@oTZW=1$ngfJ$RR&5rhH9XbkY;#|rY9FQ~Wd8PmM@818 zdqicUv-A}$&L~g;=fOjzs>(al^r~cZZvGq%x<=Iw%0clS0HQrY zFllIT1gBWAn>;#nV^u2iz^1ZLf3P82S%Q8yAHcQe2`vYALzYe4lh#g|c>{Be+VgH4 z+ISEFPASUI3Shf4&~@{4l|>9D9*KE`8sst$KL&iOnDAaUCHFSjV7ZBwmw(BJqK(m* z(ly}5ZG`I-s^5;2xb8>)vW>n$?d~?URy~8DakC3^IBs-771d8R4hyCkof)$1rKX6@ zOC^+<2NqUvDQJ@;E<|J4(x2SE>lQE!zHQw0@`lj(>hj!y8VU;5_&-5H((uSSS|)nO<;sEw3$isr{tl~yb*F0M>W&0M%To)3iw zwr=kk*%TrIPw5J}Jj|w~seCMxi)He$G@A&NqKPt#hS{}%jUrLW5z6kUrmN;zpCOs8 z3X5H}c$?ZtwknWqb12%!T~5}jY1xIfJ~x-Ehth*1yF#&nQ|G47UYwp@NWMH( zx@>vbX~qe!ws&1byHHJ~Z&=f!G6{ znJ;>^1IL@zcXHUx(gU?Kn>^3Ser+Cq18Qw(U+;ns0XH<2^sBx6UOkd)(2kkH&BWqc za%&AjL8bzC^`1Sgw#Lu`UHGA#_2%wjBLH`g?N*_4qh(Kcn|kPk&W=4ZO-(_W<=gsd z)#Phnq0MsZ@N6?l3&jN9*0wQS2bda4n&;)hw9R&O6S+5{MNPK0KQ<#;kNkrgymhL< zu#@^&9^?3dZr{pmezavSs?vRQXntU3n~2M9YoQFgLKN8z1`k*^>>vgr@mXrrSpUt!U-qq#71wl~ozV-sN5 z4+7oKI!DPXsQXR;pWw2rW@S-;YznFMCY~$C=%k2RLQRr!=T6qUOHH!uA0Z>uUCnuk zbLLhcdq9;^-ZoEb<7oP)cBk6@&99Cc^Pd`AKDPN9-}|nG>7(}7#`V$1HnMda@-@M_ zcYboiClJ^m1T5db!M7Ss8#6;U*!{YO*Z+@VxrkJBqdJ@w4N{PF-Bg zV?t!e?_vW;JXorNy&P1-juC5(Mb-SklGCN!(sCisZb*f~3Ol2-?Jj4eMA71vN*DXa z5TfTqHTHyJCl^YwIJd4^ByKNRc=mnZ*tH@@7sw{K?8V5=j9j55S#N_$BHQE0a!ILh z)$#?ggq%42)l$hvp^mklX>sM+zizO@4SPo$Z10oXHUfdBm~+P%W55;LNP{2eJwYw* zGf9(b55&K;#S@c5TLQrsgc1$Q2`V)bI6d z8rpjEVmWpE{N(v-Gt07DI}6*y1=RC8WaDv??IgD4NHhbw?3N%wT{g``PYN9OorYDtJ*)S;1{=vy(wE<`lYn4ErANt#v zh-r^^|Ju&_AMwCev7y!qp>ANdza+~{Mit2YxJavAX+)LVL%|yu@qc%>v8(N>DLI9Ey_8V=lUg$a)Utqb%{2$JMqdr(f{M0{wV-LpR-l%-#+~;%hL^BR;z}p zN6_0QCZe^ps8b3~Wr;3FEON#~1f@CH-#^sX!x0VnrIq{=yBC*5{b?<>9`DYv1U0rH zBoKhVtM$g^f$rMwvDBV1%IH@(Bo0MRSU?eCN>_Tig$?&^+5mu9Bs=VyER z`fuI0_m-P>_9UX)w(a=zqhEaVkw@>o>#p9Ou8C`xmKNqx>9lMoDcd*5VQv~x(9&bi z>2Tt#ks`7@kb%{EH@>^n^ja|@D;jY~_1L@V;s(fG6B_Oz?{;tPnM+^=#@C#db>m*e zg=n`WgSoH`f9{;@*Npm_uiy>t?scE>8{Fuf9#b?P^vp`-{FKhIJ-q_l8@D|7D`j3`UNqa7mPkYw7-^aQ-M6ucdErC%sx8~}@ zz1p_s?6N-PYQHu>${*7$#**ui*TywmG-k8*ixqv8h#u6pZYkVc0Ll)LlgJ)k}FcVwR&(>P6LhEYT?s_SAQ8&FmayBVajT zTeer{xIWv7LRLz!4J96Oc4j$#X_CW?w~g(7U~(n-vp0?&J%4?%%-H}O^rB~b5F@bt z4;3J+H`BeWM7P@}No2-*QptU{-ul=hpWCxz%TRCn*4;bqz5QlF^yki9C=^P&cHQ*# zFF)~xM;;j5w7I))U}W=_eS7!Zd;5;DzQNh4iQ{KZ_jdI@_2lQD`oiaK-Lqrsww)te zclGu3?A$)KclRDb^b^;vu$h!7c-=(F%nRE-K`S=2Qb-LWUtoIV?daP{XQg1PZgskT z4MFoUDR?EzCc$iV^7>l0K4W!J*skDhK~YtYvNT_z2_RONS_~%!o;9EfF)S({= z_YJsJ6ug^(Undlhda7DYX}3z$&I&%Di5&#h4rq?ywutRu_T3d@H-OrqQm#$nY*>U@ z$G$jkmBQY*8al|e930_>JNrd${70zZ6-GX4R#)(TMc}WIf;Xa2Kk&xtZ)7D~5YHxK zo&0Pj0I%v*%YD2xV(WfrA)?h3yiI_&#Ee_m>m$%1duKlu$I7g3jWFSX8%c6LW7+@vaNOyMoP=A(FcJmA6 z(u!>RC)-xr_TKFAPOh4S`ig|$y!=dYCt;ekzi?hkcsf92hCFTZ!@I){)&Q^jbc$Szr&jUn1y^{Q0Ih1g==9CuN) zvYnRf8rzjlbNt=Hv-a6Km&d!WauutxNci;A@dw2GxGanp3`OI@K9eC@F`I)($Tej}m zxnpj2`tpSfR2wiF4Rx5>lS5^6DVp1tCaB;&$?hq5L!YPMO}qM6I@8I=s^FV^L9c5W zL~~hxC*iS*x6{dkR}$@@H$Dm@tVixa=XQNyHjiMV4xBmB?aJHd!;LHW#sC63*$Lts zR`5<5G!*=5j?u49!8gs%`{I+6FC|+)G_CXh2xM~OkF3jgH_+s-$b&b%wt;c^alTb= zZjjpQx}=pHH_&m1TLSHSahw}#sAUfRsBS0(vhgn0Q1I5s$FJa>h--q>>H}U?!FMjQ zb24I$kb^YHN-{Z4WjVKU`SSVGr#@VmA0O^d-*L;1O@m$81ZQQUrHR#ZCSr=s?^tlo zVPc#(no7u-UYx0&(zC|crVA;lb@cf7B;V7aXtowk=gZ0K)8)lnVtCUn{e!#CU6?s| zyI{M@#%6f^a$aUc$lDLduhP*cC1bxF479e|SSDtR#e(mR*a^RyQT`Ho zX`O8Q^aEEu4uAZYFozp&a`iCmDn++yFRGI-v>_Xhaf$BW1K9I zBa^V4Tb{grt$(2ZH-7WW|Kq>@*WdfzAK!o9-GlwzU72(ymCB~s(xy6f?dqwcA52`i z#N)lay^HfR^Rp8iJ;+VjOa=?3u()*j>{)KWCP*cc^RqM8$FFiW=8j#v`v(T~)CWCW z(pyKYR<&-u^WW*qX7=Cj{QkkwrkeL-fNw`v*&GDb>lW_}SNLonm!u37?NL`34CEyZ8v&v}J@F8p|59YWu0#adwGTyV$Xr_0yRf8sf)y zlV@3X7?`9)G%M2iB@)Mu#2{@RCbrJeiG^zU()g8wA09q){tUI|H}BcLdmD~sz(9;C;eA2R%2C&t9xL3|& zuE%PX;oh#_{LL@@{_p>@yY9L*8p5A1uq4ks7p>}Nf5KvZVX~HIy&tFFq;c1A>C2^M zY6#MqbR?c&U0l7Gs}+|inD0s_IKQYa2P)SJWj54jodCxqvSdJyNz~1+l_DrLkP|um z-S9s??EQ*bYT3c6^ln5|I(^nDu9=&&wbOwOuhxJ{2W_a!bNsi8 z#|@a6($Fe)NnqK<$Bv(-@r#bp9d_E^>~Ge9>&HHdjWyWO7id!O+#%N#wyu*m zn%=ECvu<2aM??lY#Fbf_#_8YDc)nV@e0}`bnUiNPpUd{7cI+4(+tk(570V_gz1`{l z{+_P>-gsYstg9#4)0^(;N_Tak)a#M%YN)#w=}N>>sYt9RkxfQ3`FwbODO!z>4DWs* zKDhV5v1@O?f9A^dxdQ9zF3* zt~Ul<)s0r|2JNQxLglWWpc5-{V^Xp1HA8lN#7-;Q{`B2(eP-qRPn+afE)klK8M+3H0%g6Fs z0B}Zy|71t9_(+3U59~5R|CE;1pwjS%JC0!^a=PUnY3E~@Pm6-D7s8>UXmmD!ljBp# zqBm)GQ}EU`0$NU)lbvg;DEL}kYvB$%!J_5jdhF(e%SLYdRo~+S z%XPfLg|tmEzjem!8x1Xx54u1NgP|cigL}AI7rtw4qqHM}gL=6&Ub8`H`t5cs)^<*q zC%S_781(#?eqL9*+Y=il!wpX1ALDHs071YK*ocv}{ylCR%GJ@-34`qxo4c|;)SIZG zc~PZb;jw-zH+Dy(Pu1~4ku3+x*;hFOeqB>*9m}eNhTrI5+tKe0rgMm1^t$(qd}utc zaFrEQ98OF$TFyJpheM@kY$X(4tk$kf&mBH~a{r-sr{;d&i4#%+1o#M)0t~?KYih~ zgGWzY7@u0^eA#3sp334O7fTgA1YXW;b@39>r5qI>p@2`$7m$3uq{EYOUa?B0oXeH? zX<%qz8*Ah~{h2%NeK3*frKT^DNCVeGF+V&sc-LKb-g4`$n>KISvTOH4k3QBrIB@>_ zrSb8paw$wCKAleAcH6#t?zv}d%hsO0zT57)^Nzdjnw*|HefGjifi3Oj95~r#R}U2R zRv~Z1a@!~pf93ZH;@6CdHI6UZz}Pkdij4^L8(mSefuVhJi(97@g#RxEC@rOSYuJyX z96amtmok)ps*SD%b6?J{Vb`~+u{C)1zaLgLQTXfo^2g?5&@+8o*1h6NzUk z^%$qUaR@wvu)`;HF_#U>D(7{FmU=BE2iM2gWR@eqQSxJBV|(`OzU_`XZ@J@+UTWgv z$w(}D_S(z`M^E+k^gM9K?#=zFVmO`}+_dH9yY9RHzT5Wgy?Wuyb1%Mn?8LcL*Wg`y zckUhQPlQYHo}sbZ9=PqE2k*J>Q`G&x{>Gah963@f64I9gX=Ix})(uKrUU$1u0NFkS z8(Jo32esH-)_yfDle1ghL+d~5x9nmuO(!^|RW0)xKKB?}hSO@AsoYH^MqH z>UE6eU_TpJbJ*PbMgiEqOs)-Se&6l$+h{LsPgL#?tAYXI{a>7WqQ|^?tMG^hLbC? zmCNe+ng`-J1J4O$G6uU|+NQv~?J_f9|t5hm+7U(D9a?EomJinYj zb?WSkFTHx`$nlkOXt^FedGYEGfA+$Ed*=BMPn^u-eWu- z_oFVs)9LH!>KjpRpWOQi1U`YlClL4q0>1zR*4*W0{dR-)%=&l#L*HR%sYyV7|LK)) zeed5)#t4|NS#v8kftnepSWak@m0)Gr?2ZlKYc&GsXzXxdp)V7^dDpfF?z`hN58SoiYr*cI0Syi5hN0$1tm9hS4f4rKi7we_v<)vIToY=hUmSpe9`^V1z-4CDn z@YI#@>EaTH!o)KnmeI%K9Q0bQ#VQ2DS^Q>YU*aG$97^KVW7a$(=h^9j-*V7Ad(7d% zQ~SoYw^=lKIu%bOmX{WC%S)v5^QCC9RJ-@?+rIPEr@BH5KYQby56)g&uBFJt*NQ9k z+}vU@v{;F5*|G0CzxjoS_HO#{t!ID!#)0Wtca5cek=V-e;@tdFhO)tAQfl>B>4%X) ziJz_CtC5<)b#*40w=N;zIYrdO(%_FwN8M(gQEOp6t03UPdwJO#^WX(+)|dRJRb7p6$&cBCZkUc{3&}tpDdho`)yj^aNm7Qjs>Ta7xt8P>+zFMcT z`W2aOkj~LDo4eT&bWL}1QM_nktM>xS$m!1OxTj|2e;fyOYSfJ>Nl?(nzpAghKH|KQ z-#-%Fu%yToyxeYfXW|V^FW1(8^yhgs`J(h@NdvcY~ zwTa1dS1w<=dhPneRJj)I9vCJckk75iSvy@l;dJ*xzI5gK^%IvaU%Yyis(@_&Ks=i* ziGabzA^(mCPi+AE_JA#kG1%7bPT)1fU=x&mq?vTRF?F{-zHa;uM~)_^SI@$`{SY*M z5`4EO?mG=ZI=MmBe&aLwHGd-L4E#clff{HYd3kG`T4at#S3w!kNnUIutojSUwIg}A zU$iSNM#eAD?I(}^8biPxB(mmKG)==ts$x4gy(Jv&PJ?Z|?$MEBF|}vShiQE`h_0;) z!FD87jT3l(G$Z|&hl)1ajiPVY+s2G2w{%M7IZC}KZwl@82wAi%XT9gb2^O%IBI!ac zHaWNQ)`3I+?T0^o^{w}-^~A0nJ8!?`rn_&y`N6yHeCXZ>@4NlM9eeKBwDY#XE&CFE zJ1@=Do__A&U;NGUZ@zbKdL^|~?OLv;O5tQU)l-jkmFp>%wXKv&oLAe0i|r+fMTH7N zWf{77?40^qC!?=A-*$9hEgv;^@#Ns(NKfBDlDt5sE0)f(pq|a_smo*CT|AwMXS?ex zx=Uud``Ej7AlcPZj>HOO3*PGZ#o&c+t==`u=sT_c0Xn?e9~Mi1bjkV`-3s|8tjeCHIJm_)qVi{8ostUWUeV$ zG0r+M|1IZ~a@Gk7&wrOV{Y2mLYGJ8gIjYrVa=m(1h@GLn@mHP2Y}!nit>S8Fc9=Ke zFM5G9+c;fT-sMn|)7~oazFaMHVPfU=L#Lm4Y5z~3f9<^wj?FGC5YQeR*)lM)Gt<8< zksYf>2d~Xk-+1rrU;Xgq|MrvD-adTh>h#J|AyTTRs*!X(o~6{CK1+2L&_#-DgD+>& z*Y#L>L#7;VtI9zy`%AYKSA564&dcM3AS3lyvKmd2M6W~=OV#=UYu9o5V=)T!OCh$; zi9MHcmcdivqScM}ys;pm^`Ft{tPayCK1pX01AgH)kGvP(@e0=fGj#&VPK{m*L zyR+4QJ>VG(X+BFq`hlB*!)n@7=j&=eEt+OqMV@`^}N#&8_6duU#cw2uYzF$FPbnXSF?e1)$|xH5m!BgFTDVH2$EuL$^lJ*)ZlO zP#2&G;1qi96)Qlty%Q6m9@iuCI437kE^$umKf%|XXvHjeM4~`r=zF4GKo|<_=268g26)}jilVfz{<=IgJ3(dhx>dRNKVs$iZ8q_FAJz+wV>(TW$As!Zsarv?2;57tD zW27{BU+vW9H`ByX&5i#eIe4j*(j5HY zpc{ z=mhab6uc4fCknoqS3Xhj9i+!63cd*_>nnJZb?fN(I!=Wyd}%7OYkw{nwpvR=d{Shm zCP0f`R#&K@*VOs39N&78&X$JS-D^RdFL{4qEw3SAF)mvbeDeg*?k+wbyzd{cf~SNG z?TBYejypv0a7im)}$cATu$GE z$11>mHy>My>{+T#tiE0+0KgNJ)+eIjVs5EiCj3v|m;h$!>mJxpp?OEn~@Q4-atlL}n%OoE8kVYOapadC`njU7$AHvz|oVGv54 zrs=w|^j~ufq75u^Z<`0-#y?&NZB?L3C{9ag%#m_`+XTD-p;a6CI14tu5e46lwT@Nv zt5Sl4wu-j~iLP?HVnu7An+mmqp&z9LrGh5JH8toUYqyzaZ!hRth*S^mMO%Gb(KifC%Q|~OgP!i)^g!k3N_Du_~j@M z^Ed`XHHtAI8GhOPl?~oyzjwuvTH6{$(b_5rubEWSST`@i=-3v-S};OnlR1%H(iG7J z_LP+X073h5DVbr#To;Zz``j$m!tz|hl5TW=C&7(ZUu7af-wsHwmesTO12?oDG-4vizhRXbHzf#E+XUd*^o%EK ze1+hQM%Tq!5N(oM9!kt5j^k`oat`wy zt}C6I>USlQ!JCY1ELI+Px5qEnB|yDl^)*Vt=Y2@Z=}q3dore5z>jy{Rj_n#ewF)x@ zZcw~9&T!hzw3jO+wQ^ErW%ts3wi?{i#K0{Ae+~2mvCQYjWW8#y4M0noLgj{Gr~T#A zs;xU})WtTJkvAC7>C+|}@6c?J(fmhD@2tk8Cg0pkwQaKy=vdsY!aWF7bM7o!>b*NE zQD52x@w4ikfhjhPb5+8&-Z#?T#(1OUu7EMwGJe0y)f@ruez)Qi9rc#v;Q#GZw0q5U z@P<2oHLZs%V+NtmP*OCjxdV8@)VQe`UM*#)eCG$PkmF_!e2s=2RuXehS&JaK$Q%#PMl=F&KXYQ>@iZnf)T|jCZV!$%Lh+#(jywm` zRqIsV<%v3!OYvm9E6%xbEN-vj@pF1T-Ow?^N8!iW?OsO2QMqb%2!^c}H%3`IZi5l) zR8PSPDiWV7e9hWu!1I|~Q>QjFc}YiV>)8eUCZjRuBXGGvD{i{M;F5Li{;cZ3cVg)_ zi%^EtTrdz2dwvVD_?A$I*P|-HcD`s&CAU$$32~=?9McO}WbPi|P0}l*98H)g4(Q#+ zzzmG$co@=rMd97#YdaN44(4)E_G6HIkC%(~y443YWT-D)46p4rJT&1VAO3zvI!s-g z?xDw;3J4LKg&DGq3A-K}AT`>sI*;{Vj(?Sq%pGiYd9@Ke_p8yCehVPciEYPljWPR= zSkp=at+@9^zBTVPC5SO`ATIVa9PgqK~rM(U!*nr#O{eBMK z>#?EW_n*yu>tC|bO}F!qed2HFLzqrZQB$ zj=kcz4JX+7HuN8r3Odz_35nISe>^qmWmGJmGX%b)qKQ=}s2CL|hku=d7j0{sh&bYw zTV%SX^BtK9mQ2ve&-%$sOZ_Ajh8lUOQ7c%YBp{Y4ie$susr5<_p8+xU8cXX*3D9w| zR@K97*oR+bI%5ioZ1&dC`Firjv5Jc90EhSr-e+`=t=){2=bCk<-m0q9iC{Mwn_F|^ zPP8{T%?tpOi2hacM6^|h>7YmEwc!KLJ=ff}_O9FOwuHReh9JGGl67--RL~?13^}c$ zx%n0+r`&A;`c|9AO~gLsdNA0w%3yDD zDyk(==L5?9(k7CEH%K3jTH0k^(>#=5O~E%U;PrS#>E5gmU*R}S(V(*iwYO24Z4P4( z`*RB3<=CN_51mWZNE~z|S7Wwd*tzp$JH$YYp#!b1iY)32z_7#5X{Esa zGwfvdZ#SgiMXy^ZMN8_Wb&F9`8doKdPT*QX*a}E zogr^o&X%DFU$`3(%IWH|2+jEx;_sVhWFL$>ZN^SYdDPi}gJ~jd!G83lq!5a%xC9be;_y2pHYs zhBj(yleWGYu{Kl%C=zK4&{ErMTijxm)VjabdQz#SC7Da>deUYh^EIx))kMF+-y5L= zh~+yROnt@Sfay=UEpBa)H`7GTK8J}WQtzOBZ5&Pe>&c@YkR6)?7B99Dq(E;tK?-k% zgLQBH27%f^Z#AJ)V9;z~JHqs-T>YL_qH?{oaa^Z~w`$);cY%R6c?gC?bpU+=Fc+hB zsPdSb`bK!)%DiL&RzO55Q5lT{$xSXhEfj?4+A>B5p?X2n%qkw-$|xr)+%Rcf)@(be zv*y^_f9$YhU5l5rW`i;XL#Q8nTvfq~qGG}R>t~n0`zQZqCPIilnowz2624ak_V@~X z5rJ1FMZ6+Z)a_hUVmjWSK8>igMA03j1^;;Cc;%X-j&LfAdjGa3pXUMDaK%KBc9Id6 zsF~np9M*-gqHveM(|a`wT`6{J;!y*UN5O9Y0#}r$zc{R8KO|(0pTzgb*2|GGLKzZ7 zkXslo=>vRuQUuc3DsaIxTi{tY@(u*7 z8gg~^QxWg*@8oK8&&~EnpaYwSLCiykH0Csf{nDXhr-4P9G}D@QvzkguzN+9=;b_0k z{FjE^ezl(LHh4M(-)!$W)@qH@b+9c==xFP1*aBn|l?rOlvRKDrG8lP$f7cXu%tasY3G;bz?11**Q(*q8()k2(QeWNk>!8( zMZ4}HrbrD^jS^y;c=8o|3%zyhAqZ6|t&&i*+vSCZv1VK3t$%-zy4J>)2j!qvU2iO% zes`kKQ}D`S2mby4{QNUztn0}6UtI727t2;fB5ConNvQL*)MN;?|h+ls&M@%cX}~XcbDfTc)ptnQ*riux;N1I z{zMz01*D#U+u{aIk~|pd5zaT`c6+g!9 z5l-vB9{akv2YpIsLip;eMX%Wrz6zgqJJ|@`7g#nlf7bTF6nxXO8gVh`n@SVAMu+C$ zC`TkHSp)_n9oe+pc$$=olBqY;pk3vS$m7Yz_f>5gn~|*JT<7Hxflz5D@6AT*{tr-< zui(A*{TVg4>Ca9v`2+R)a`MM(-?#eOc(552K`TcgU?y7YQ=QhN1RHX|^D*t)I3AhF zFHsFHdVzbdiw?$DTL7UMGS+dsC*DG2T5Jye%c>2(1VKmGMvohETpgcjFHXS+>^+CM zjtaivpfrZK4qj}6?9VD&w8|!}{;R>h9z}ZaXqkWW*PtaLc9@fn&BNG`DIRE7i@%(H zp-?Ooe&gT$-yR5t=ye+Sre(H`!GnM8?80~d~_&Y$u?i`#hqg3_)Ad`-d#UC9?+1fo0V+9)Irp@yInNeUgN zA$5G7&{u6@%EK!Naf-v0(RrxxS4@2v8ezsf}1uKI4k)CU4>Abj|DX2X1ZoAPDrR<6V==eLm@|)fy^VX4MosR;_7C zf*@CUcA>6*)R#tGgb>8EanQ3`PKBXq90iBWkYBS_Zk=$)DF}jFL*D^D@&VnZ@S9sR>8r)O z4Q6s73ulsuB*ss2!A4gAt*}wJHQMtCy4}WT;(Cwdgb3W@Di;D}2d)Czd0cLq9&a=u z+R5fsK;&I^RBaR`18-aR*wK1mcv8hJ=nYl}TlRd-m#Pw>3Cp?$rDzNMn_WtdZEIN> zpF&**0BUwIZIpHWRpX^6rL8k6Spw$pC2P+$rEQej6$-ul@BZxmp<&m8O!S zHL0gkt>G)9;Q=6f%9*xTNkUioX?5Q{xP2KF~X!J)b<9O??_kJ|Ogslw5Si?t%dd@}$BGCitP7Mxk-i>f~ z<4FaL(O*N~iXo-rcC*lddQm95EFO3hK^Uv3Vsje6hk^-Dl>^!jdl31eKftbra2<$F z(lY_vMIZkDZ6+gv$uJ`dr_)u_cxuw<&C!6b3;izbLx4WKVFVCnDz<5mP0u$B79-lm zxSjU(MUq7k8XlShf~@nfSvMdnH>t&9_;mzmzuWBHxHaw~U^f3o2kSuNSquLBFd)Q! zbfEGk;Y^U`Sf}*ruojrCjM8Yvms~#O%Vjx=Loi|a;NXKTFb)cp&am~^sYUz9{*pqI zj^h*xE>PSg&)S8S899y4th6KmbD4?C99^4d{)17E#}vv?Rw1mz3N&U>tp?wCpBgCD zXPr>+AJkZXP;F?RKI~+4?q1RJtz_$2dhU8N8N0DJKV;bQOZVL<14$mgiw=ziyI1(g zVk578XDK<@*wbcnHtz7o*+esjL5oJUOt49ETZ?*2&^r$x%I;7*I4C6*r;eDLI%ubn zmi`-nGO#t}hFouUPuqj7^lmq-)1%UziEa~x6p`!dE;%E#ff)xr&rq_jBBniJk&V*S zk@f9t`Bgz6d%*+;+XiBO4Q`WXfeVvCywUD_l!aXyO;3ixFa7&JyKk_Ag4fPe!E;>f zgy!Jg{5|nQ5u8ywJG$$?>VKPu& z?f8@e-1Xb6;SBffIBr~Nz264VW;)r503A&{Y}SU;rUqP5|5BOg1c|k;)`r9lG!dZV zkm@`N3>yUDEJu0H-C`a_a0EbK8j;mk4ge|$OnFGo)!-s!CJj2ZS&J=Vv=yL2GdB!@ zE@LVO-q}&G`iwmrP!;-B{^&r1ybx^H9&3pK>!5=+gGw&dk=BcLDc5wIKDKm-&3!fC z7Wkynb+!9UZM$x~rbWsay?96V+HA#2(|r`2xfFzjKLJ-8s1VfuO@H(-tj!s=B;MHalvTyeIiSd;rz!^3ua1Rj)X);q**!7_A~e zMRn`Ey$SmB6}cHiM+ZPjBgTs@f~ZR_pye60qT1SN@@0k0gw~oaDzP`i!?$5A>euS;2nbZTG*OZwq0M@5(XrL$=Uw+= zhw71v3+@fln~})NmXRBKHlm5Ht)SpsrCWJWmAT4N-8EJC9L?slq1>YWq}QqrODRK? zuHB~!UJ#_NuS2k@50TyhL8)+200o8=M1wa^F*dlXz%FfU;}#AVMCpVxp~y@B4h8R3 z(KkGJF`wmloOjR8fBSp?hoxw@?$ja!Co#`$a?(rVB^Z-g%A6a1PJ4~9OV)aW@?b1t z&ju~}$vaE6sRK(5tLq^L^(erIm`lZ9a2Qro;sJ=gYuHY|6Zy6w&~L|Cl4@Wz8FURc zkTw1C8xaDNy5=}IT`PlhRfvK^-=EePuW1xuMJPu1^==SCL&xy5RB03lo|$tyV+;9 z20Wbw;{(;6(h)TEt1SfkY*S-FEW73eZY_ag-7U*&$D{Q|?;SsJo0%_4fvtv&XJ`uI zJhBTm(=_P-W}CXw?Yvs}$q~7KpYK!J6#}I|yrfybrr@}z#sVFzKT%;)&nuP&M2A@L zyn#FCN3{^QLrl})*8!;e*^^d{i8I9}DJ{Lb@Kvz=w!T^}DD&#e7NMzjP?~bVjn&3y zPZP^v34iO~{lD(_i|ovT@I*b^%ZK)#p8574|4+-2tSNYYYgh1g-NcKa#TQJ? zb8xmwKyE58YNfGf+5j2nL0a0v6Ty3&iUS`BKq?mesjgd4gI+ya~X4M!nU$thCg4j>Zuf{lu z5NK+n@w;eaLg+dsUng4s?yi6bAxrW7MQYAhcO>c5cB5f)u2nAT`8_3fL9GV)A&5m! zkEn&%My_YC3!xQl*M)ERuGOmTu6JNi9%*@U$CG~M%{HsR)(Hw8P53og1}zF+#F~G} zA$xT^SyK+40vZP^os6EXiQI2=7qM`$jV$0t8y`3BYmatVjLN~&{2?d38*u|s@Bp4b zVZUlYxZ4!<660)j{o5e3K@Yy2|Jsq&LPBmV3Q=#`Ym$BYj{)M+83oC~04WHtId;Ig zfBP!GHQ*&E+0fWbWVFmw#t?bu|MLHQaCpQh+P{ZFazQ)3@;fIczVQctyb?+I3cjfP zBp$q1B4q-_l~xDf+iEzf$W=eU(_CJJ&liqCz2OUE9k#hv!g{9TEhy`vtOf%IiXhE- zI$%RUlAF8$wKr7vpoSP6E>*1CdKy(N0$WuA{HH-v_1Zl)6UW^~Z%RTOZt?X+$G1>< zfY0490=muIZU3)L*ST0SNE7&i22&!QK9|cjQcrvtG{pii$)d)KYFjNjb8j&1lke1nyZ!5Oj6&{1)#f-Hatp9QQd9jGT!bgYgT?4baidrm!8 ziNUbptQfg^coEvyT1uZp9GXnbS#gr}tRwO5JvDnYoaDBa(^=`w-WUa%{vcJ^s1ahu zr%{6OzG!p{7$^rg|Jcyybfn@`92M0(PR<)Bm6l9cN^=UXK7>Ms?$*a|)_b^`9h3iL>shB!@>U(RJ9-306B;Zo$^w09v%29>?w1FgshW z(U&LVywI(Ym9cD7D&4?hVD)=7CN+6xG-r#T94?ec40Fc!?&XSWe1pRyJZI8)w|Q;0 zOtST>Zo}U6YO5U!vQgXPf%#Yt-sWfWQ(4=QqPrYWr5^h=+Vo|3t1x#^Xu!^Fccn$} zqUHrfPZ~uEi{9y&ARc1B^Se&#{Hj>(M z54OfF_D$)-i6E6bHfA#i0?Yet`T^1G3FrX6Rfx4PkHAaBcOXcnOVv&2tu0D?|IsnM z%(GR&i#)=si~6G3l#n!VsnqR@vAr{|t$q9CVmPt@^i_hLL+j zt=ZrW3tW;a4Ufh=s5!OdfFqz_LPY^os*^k%p9>^L@s$Ij3iq8 zXuoVk;jpX&_k^RHfPFQC(np@6M)rSn5cAcM2TeIcQ4!c=8G97w!_1hi1PMv( zoq&I%UTRRRgNC1gjM9fq%WL^8NO%ujV z*IKa=`0nmA!tlFrd~FkJOj_-GFGT5=*Uq9R`K*Yc>BwKc~Y1FHZ%?L~QRs%)6bSHJOXN@);$vBA`K)1gL_=YRP>?&@J9+NMc41<%EmQt0y3 zY*EC$^V@{P4VfNn?OC%~e9_-qaNhn`RwvwIq-Qxk3O`ae!)(8qEl}TP>rcvD}{b71XzBm15zp4;$P_nPK1xk~2 z(Xo3#a^W2ZTK9|zo`6uayS?G4)zAQ&Q}8MhohK(G;KflI3SLoXix~A*UtCGnREwe; zz*87_*z+#8aJ7!YfaS>=v%Z=XyiX2p64sax5;K7sa?KxvH-I2LSy05ILuY>ZpzsuY zg8=Q5@P^Tg?p1DZ6~3~8$XEA>chRWNO!rU*~w<2A8 z)DhWu8pHARpYc=kt5wVfFyQy7jXUGhYgj~*V#B)B2v(3ybh4^_^ySlK5Ul~wdl2>p z=aGidhRLQT;3@H#Ot5EsmT~OwP1M&$a=~O(;8yo=OVmt8tFpEgTEQWBziU9JK{m}H zvj&<1_c#O8$ib&WuZc!eP2Ia`HI2Xlxd}1??ABrHrM8Q$v=&e=Ekx3p3?1)_P<2$K zAoi#rAX+_^ma|Kg7k$;zKGL?X4M?);+M{qG#ij?fdnu=Dg@n7U1!xT#)E3*tPLpUb z>J5;enDcIZTtU zm|XFn@^%fdRt!rfhxlx!Y2%C$g>BHh_u(8I>IMkVb=EfaCTZRR0iIzzG25W7NzUt- zn<>N8Q_HKJmRrQD!<|nt-t(rQf}{0T8Z>$cRTfi}>1OCX?)_j(F!ylwn`BIN!yl4dB{8*1t zj8o+$*?GOA2|oIh!cydo#UL6mkVuB_VVL`5vOMtWpc{fe`>0jmG(FfNI@^Sn(Lu-8 zI@IQYqUl*v+s?hTJJh3>Q8jmC+4{i5n(5W6|1m3Bo;Hia`S#YSpjgfq3`!1xu;$5{ z*w)bOzx*ltz%n0@Qx0XYS`jE0w8C5Zbk;{lh1?1}*QSD6*HXKQTgD`aRcX4h|CIkr zJ3ib~?T)qYcy&f$%T=qoXw|05;_l^gT8vo}2Cb~EwAy)`6oCrR8*R z8-6LPtQN~{#297FE!#U9bu_5KdJj^qRi7C%+C+S1(7_44!J!*e8JBHa-T?9{61%DS z4j~G`NrTKBy(ylW_{)nctwv`uOIvg6)#d1&&9ca%Qx4Z2vITPXe-j#m*fD1Eq29?c z@W!>)Z#pS`>%kxvgiy(0aTLD|MW=}ryWWsyE-mR3otGC5&_t6A4Zy42F7&5lk2uFt zWluZp^SIHgD1kON*yd$Zu+~gCH-OfH&CqmtiD617OPrpJt>w9#N=>uNF+%|XGV94#5j0dPcO0TmR*R zjVM#SrcXHZHE#1c$DY$4+!Ky=O~Hqy{Lvv>@vb-wf@0n5pkmzXFHjrjbsLmIMpvz* z72M6jhHL2yS>CD~sxd~N$sC&nC4�W>{&-fls&rJT^ct1Co0vuIP;Z_VBv4<5t?J zU|EM)+Z+DK)NQ6+gJwNw`38gFp@Zr%qH-_qliur*2cXt~XVbpIj?0_quhpa$ShPzq zlZQ%k9-$hExZ!)j<@KqngC6xM%b$@H*m<>$4e+!e)TD0<@Z5ClHxC+0b-^1Q#kvMn z(sr74(0p(3ys}=P`JkFmxvleAUHG_>SiO$OTocz#Yi=|!FKpNtsZWiFMZO9a>4Fvaq8QlaNisrj0a@O65ay<4U)|q5JzZuu{n9N$X2y>4{t6 z6;FJ4^Il&BJ0qhVfbG(wgEDNXGPcQ^UY7D1Z}*&_^}M<)Y^ReAgk?OKJFB*d(-e{& zUlv*u{B)2?O;5DSEg!+FasTSqn>3F~dEXrLA5x#B;kDWI4pjin!{(c8R2GoI-n?3a z2JP@z4fE2N#3=1|<8jeJmR;0fvM&_f@Y}t>fQjHwu?6IEUH4XQmK&{XVqpz#ayd$C zMI^JQ&s`C#Ma~-Ybf5gOsWZwSFMjEbs~s{O2HGsx6)wSg>CU)UvF+-&6qRz4xO%SY zm^hPMzSy3iCeWQI(LJ^_cp`{UpIgsD3(SyT{jEwGVQ%wCrP4_-pwEG`u|a?py$ z7}BurTj9F4jon)+Ek#B)hUN%br|ea`sC}Vrw$foUc{EMXw<(*C%y4p98*_gY%m%{% znYG%5F8=EE=wQ%RHEN9+!rXZL$cecJq7*!oSrE%iM`v#95cp!1(z@cPNl$p&BkN-} z1#jNkWrJ8c(|h2miHMe$joWC*qpOCM$xpKWsEL+z4rWVhgSOeHGJm5D&#rN65fr(; zPzmxf54T8Isrb`6eJ?GdBW$d&QUI8^X`Y;m4Y`YsgbX#oiCYNFkRt4EVAOkbgq~hE zwInGX4c%x%!7hzL){{%E@NO`#hYszuff}2XjZS-Lvz!7=8n4N1S{oRY42F#k7+;M} zq$y7%HQ!@2>PF?Cqvj#Vbzu<=j|V(baxm2@PFMb5ZCjYwe)b;{=cI|Ny>3?3$Go&L*2~7R($Bwo^r7pY=pMZ-zd`= zXWp+qNy+d$%(>-Dj^^}{2HmQ^V|y;HipM5MdT_Sx6(0UP*G^S%N2o9Mau%x#C~X7DN!f~rKtrgmuF9UohalJ*dN0AD7IoS^qG$llHuHrkQL(GV*+{2GMYbMjD!^&Czn>NlQukbS1;n zz=u8MuIti9H*|(4XWhzya>C~v7b`(elPm5C??_drsO9t_k0q4)<$jTaZfa^+YS6WL zMh3#*IJ{x|^09+#H)alk#>o#2Lg_J@YG(wX-XO{VTzr|V%wTt`7L)@5Ssx-~B}=r; zYSD2z=CaR*PA<^xS>_a%rks8GK3EISm3D{ z(*B&?ER{?HIMLf1va=Ny-aNb|{RVmkz6U!;4~7+`|CZPK@NEZYhv)~bLZdh%o<$sX zj)`%T9`>U&1Q)b+***ksUs7+Zp4wUe$snmUo^~{;mUM%&bwoBSui?PsEqy6{8Z?{x z5bfx-pjNmOVxF+@3=ALcZEg5$*upb`e$@C?k!c12PIRpri`xF<0rm`b;!odbxLu<8 z-AQ}y?pC{|jgSMZZN8)_XA|9OCwTxhs0KI~(+`(bE8y)HHGWLnG(jf-hk!}v-{YDM zI#ecq+W5=SoL+aya4i!OpQl;kwMZJ-KD>GA?L^9zCT9kTA|Mb)SABqy*74(#ywjYJyTC4d{b0nJFEMZveuLtS?{ zf38vyFITjh_^Yvct-@H*_wj@r=YvzON5$J##DYkhW02rc4ltd-S5C1O}zusTfn)!l^=xw^9Z{F~NlHx1u0*C)MisbtuljmQx}uCqU^X zn5s$>_-veXBu#>!M*PcW(*#x{p$)uzv?*Z-c69G_UUHnYe)Nl271(-YvA%Tt+OO@x z+|rx1+|KgB+k%-ak4=LcacFF_MTkg~-i{WADO+@}y9sze0CKt>-FzPzp9J~%w`!;6 zs5(`K#a=h*X{C=F7<5Od+OsV(rSs$=M%6yLL9XX$B2+ZJA@!_6ED^UQbfdFQjX7>s zM3}AHER$CwfVQ>*7nGwL>8f>h>Sz_Tijk(~bvtUeK3gIdz#YX)C*nIeE)Y7?f+Qul zCix+TzcY_HPt@I@ph=V!vLa*Lh66yY)PUf`^l=KC3gAig2ho%HglS+wjL zayx)q5hcwaY$HmxDt?_lw}^%^mO{%JoZfMx0-I*Xt^;p*1Mq{Xt0B81 zUj{F>Q`)@$ z^tw9hLOvi2U5Lm=Oq9!P>{Cx9ld1tcb+|gzTjf@pMG+J>PJp&QV`7DE@GJZ$I}0(A zSWK$q_>PQACX%{^h(JL60+j*clB;O~#iQLzWp>aH$Kz~+%Q=A}0jc;G-q1DN5)Q3Z zcrY5bQ}jqrbAuI9sbtr-eZ~<-PPCn^=4?RT0(|RHp|Vap;W+JQBFsz_F<(q5tI|cw zms1%wO{$klB_IG_BS}Q*JBtKOFNt-R_ZOW`sex1Q?M9_J1GFisSNTw+u14-f(~8}| zQsyqFSjioHeP$8@qj&ek0 zpw?B{BItW5VF?JFoV2mI?pk`iQ5>vimIbM(;{=;@jduwPe&s0 zSlnW1u9x<~uPdK|RJty=1*pP|6cOjI~|6z^4y7Yn&nYJCQKkQMwBtC1LZFJ zDWd0Nah@%eim_-UmBbZhrWM*$)&edOl#f5b)|nc`w%fGESE~WSrngFx%o=M*_JIDt z8&D??fsXo=gYnEEW00swW`P)wM&n6TsVGpcbMl^QY|n$2W;;@=G=gZL1yScx?op9Y zhl(cY1%ZrFg?YrcI4|IX`U}#q>S5i6ye1xGID(GPgn{3!QD0vh{i)LD4V|dO zgt}5tg>L#zVDqJ!eV24leG3I{u@ zSsGSeQ2!aT4Ob7;fI#5PBm|l;h!?<6xOhYH{_U*Jf*|xhx9F)REEvv&fEb=ws*pyd zQY;p7#LhCQOf-s<08PbQBdQNLlgYDftuZmYl?&A`Rm;YZ6Bh&FGwuas{-f1Qby&xTkI}&C(x*@n+ zuwI2K8w$Rq@iqFgUOHlD6>NX>%fVqZM!rUSYmU3qkE?s|znFp#jMjn5h3r}ep+6#^ zAv_2OC5q^m9q-hoiy`S$!HartL2v*84WYaqq&*qihzO}9Yko|ma4nzDiE|heSI@jX zWr1oUfhw^BV*EV`EjFba^%2|_l_mNLez9~svKyIQsbVn{un!V(G-bI`DJ4=#p+Z$M zJlYt9y6R12ug!O!TpLoGW3VD+n;w+edHT$syVt%J5IA2s97BB;m~t|e5Ql(ZxR@zo z0LYo0n)p;5FGq@D(_`@Hp+B0LXc?;xQj!rh@LDC?hAePz{yybFqpxBPkmB2KSh(*K2Ql(rf0f%HtazG#P z)sg)>UhLe308kOAY@uEslwK@IU{(Mx$S27n+!zrgi!Q8iT&2XX@Sns7l*c&8G6`y| z?APS5_7_aXuPb3Yf*_cKXxyNoc+AXNIA1KmN^z{WY7zG}fejvs;^Ky)1l|G%ugG9H z=+S37DX@{zYxd2&3EwblUT(r%+C7!lu{zh%H!wGjf;BXv|C14ri^Qnd6pNSeS}2uF z5nN$37|mMFt}QWdCia~Y6{FO9e2eM)T7$wG9B z0#UR0=tXf;MfuC!!~*zBgv-s1RJ5T%q`!0J0~U>W(5<6fPeR(rydlbGufCy!f_HwU zhQTA^rq^rOA821V24=1jud85kCHa{qEt)MdUHv$OfR+NqFry7YPB@6jAJF->X=QZxtPlr%av+6n*p1IbGeJ@U`W_%%)l870zZ%JbQ;Yw zYRs*P>H?R=$MU|a_AqwP7!O{%G)HPgtXu7y_^Kp6>=hJk4KRAhYjo0la}yKlW9@{} zQHvObh=5d!%I>khXmLXHm6D*_3@~$=#BYow<0-NBY9vkI;yV0+4d+pS&DSW;6vFB- zY?)E}S2rZZf!CxPr8FyD)HOseH8j-{^a*iBBk@wH7K$aUnAb&Y#R@5C>9h&}$tFj| zFp)-Fy;_44n@dV;TcovLzW#L@Fo*&Lhy!aoA_7;8cb$;2uzUcSG6Vb0aH@6UUT{|` zoh}sEZ5#|BZuF=EE3eReghl4Pl)lDZMB*4l2@k*|V&_tYBSCnviUnf8kc4TeWN|fg zza(m6G5Yh5VKhze`ykHpUk^%+`K(5wKB_%F_NAaYeF|ok>LQe!f)B!0=Py8P>tH?U z`O%H+jm+A=Cpe6DVz{BEI&%8D3f=+M1DX?XCgzM+jb@Bs4UU09TfP7~aTQE$U==bY z-%}75Ihl${cCT8+sS+J;d23aWjl6?OOlNr*r!>4>9fqkwEA=*kZ8%m5;7cuI9=$&# z#a%(UgJ8fMCa9|_8v9t7Mbq#UW})qjl-2Z+Gn`b~$N(jGC5cG2A+;WaG#GE>cfL@@ zH^o)cbgP`$LeYiU0X~a4M#>ZqL*kGvnQdzzED0v54=Oz+g zD_roMRfYz*QEi++nLDKnB8f!PS8J7Y3f-XbeMx`d&SK+H{w98v1c9Xjj&M#*6RJ8? zP1)#=ghM1tm`J9PKR_7mLS#Fh!2Oa%t(ItaC`Wc_Nd>r3`AsxACO(QDn1rwCgn&U^ zONo@~JkWiFe?5wlf2|#DS^tV)mawW=u|koeErFd(ozRY+Pmhjo^lo8de-ND%yhq6m zg{;6b53Pl^J&b!StSsR1f`u2njI34uQjby)SYw1_yV6Mh<>h5z(irh4aTDXQw46Jo z9z66eu^nMJo&^y?*gn&l5b%3j2d?e+dHiiO?%FakR-TatB|%ovH5=mC>Vac%fE`Vw z#JpBY1nyA|G7aU0RAjVCt%HHQMRS`OrZg#wHB6CM(#@`WTgt38{8okH&&A=AhSSmwLY|ef=w@y$X@^fHG|iV%*tsoJ^!Rww0zoeDseN7U_OP%HmHvW1x6JEf zY|U$G6>C(XRLCz*%$2QYMD(BG?M?$CD@=DVyTP zB++=)8EDRYz9_my?E*87MCaoL>z!`Jzbr_R)SAv-CMA3FYeZa}Bds2FvQk27G^X1V zsFlz#WSSJq?f zO?o1UDU}d>Q(lV9#Qhb5S3;CnkF*GBXxB>2_N4yRw=XQEy{0aG!Zu3Kha1E5KDs$N zVia*H$K(1^SSYfVj7L%_DOP~C$uUt!l1?YHU72imH;TPjtLBKPV7kdsjI1|-bS0=` zPL}K3+cK*GIU)T9)9HNuF?o;KJ@)d%wTbfvF3g@Vu~Vh=GFK_)rQ%Wyz9dy)1Q}|q z{LsLV+{Hay5q5f!*IEZ#%rL*BevEnAN%*94Eb0Z_t5I&mk-fD{nI~Pzj0wz&r>#>__e{%v(-5Z zEqSs=^^b&9J&R4M=d@;8H44P*tr=2W=5nPoXU>d|k9T)EKYP@_ftBM-aH%C&zks*9+TP%paiGV5I%TUp8-`QXF1-hAuQ z<;x5c=g!Y9EM>cTGU=Fzz*1S3 znQ6(fvY@9?o?9R#%2JT8%1kAQ7W0dMP`lM2V&Jk5GDn5E zP1|0E1(9LOnzR~=5hp)+>eRyWBK&*i-1$na-q+v94d~pN>FHA^Pv`T6p5A_%Kr3UD zN&l?V5rE@^$~roOu#TIqZ2ginotv9Osbl&OisvGLy>{)|*>h)^ zR8LQj)RT(~;;QT{Pok6{=^Gy5*QKT9Qzy^l^Cj*Fs#0A=Twbc;#phCx@Q8f1g9{|5 zh_9SXEG@5`K6{Q}=HTFf=JZvmTS8JEQ!~+=cuzdZzdk&Dit}$UIi=*}gV{nZh5~-| zn8enP5!5N1IC1i=x8AxoK2BjB28TLH#3MZBks%q@d#?_ZyshOx6< z*;G2Iyj~-UtL$n{oU0!7l#w#84@P4(TO84(1{!el^qd=};l~Kfl$>)0J%S6Bi}>zP z4T}E6>C>;gx&O@h%hb4Jdb-URhcKe-PaG=Ye0s8o(Tb4K(P&2|XV7R)R!KysA!am$ z*npO9<1fSar{lQTV>4$=TMxnne%Rcc5Lecx{;~5(bb6xE9lHw4>rWnUnSn2wpJf-+ ztBRSvxHNz6+_}Yt!tzpiW@ZV_N~W-DBwZyV62_FYwFO6&)OE3gL|7!~rRfc_bJe+- z`OBBC!0FxD9$1iK5%5ol{>-_v1vUUs_z4n_nP; zI=?VqB5@lh1S-@iCDVc%S+JyBE!s$f;o%GCFaGRjKbxGG+_7^4HHjb@^Y< z@0PykNF69qKhQl|Ik&ug{P>BNUU_w9c7FTLUD-@pArPiERis>%f-k8w7B87)b%drZ zBPNZ|Sn1M*OP4QRx_0I2{<90r=diWyx#Y!Ok$Sln4 zmusGW61UpQ$UOlmL2~K=HQZQ}r9{A-AF;8XfAK|B`{k=w_aAsSna=LqwIhS|?zw4iB9Y=|JUOL)S^l7lZuLAvbbm=wo4QuY_+1TclX|MKE?v6x!V524 zIDcW&=1l_wgWQ}-r@-lf1Mj@~#v9qLuFab^>mox+r6kBIrkJdl*OZNf>%|uV=@&0t zdhw-~7Z#SbZrj?`g-0&q0ZOVcEKw|^04WhvjCL?6YkU9#U`6ziAi>iv>pqkPtVKu8%%BqhO zs^wQ!-hStuzx~_4`_a=sx;B1w)27Y4cJ5MY7X{B+45cY0cljU|m~O5hYm_m6uTM-! zm{e+@bZxqfLHdxnE0`IpRCr2RyAy2|&vF)w#A0N=GD!^`h~=x2Q6MZV#PrmUhdr^j zg)aGu0+5w*O!B?=-uo|q^;bXp`SX{rjt`9tZ`nEq`_IlzUAc0ZaDECWFOJHTc-8dG z+|0~;sa#uJ&hv?+46dQ3y^L!l|D{^bsWt&xgHVl$3BWk}jw2N_MujrU4|rQYQ)|?88mat9vR!XiB$p z@Kv-bckrdPiXuDAG?$_V;XXqgXf^f2EJbXBN(=0%zLY8=Ng?TqL~+E0st_F&EaXuB z)aes1z4-FAYtvV+PMte@v8N|9GBSYT#{#jaf))v>PSwS((lAmBD?;*Pa!xq?vX0~U z(Ub4IeV~{x!G=jVy&g)Xl8cLrue|yi)_-qLFOeE<>+0%q=Y5HSpzv0>pREw2X{9F5 zUS#ynmf|-Y1Cb57paEE_iK1dDLbYsRa&j`C%VX>+;hQKo5huVBt>DajOT6nA2aLU3 zT$rCN7t5?+7Jz$8c^&77^&=bCn_aairv(QB>1qq(PcDf2tiASR31i(Q9j-&XM zD#SGN9iEz+e*Mii`3=c?`SR5*Tesh|XIF}7M5T1)@|CyV-k(UOKKt3vvD_RiNZN%` zCP~~$ZG1G6K$UVaw~|v_$U;Zc>SXOq7BOHtnwp$?_uY3_aw`u!@L+#`pVXB_sn{=m zc=W^f4!(EOO*f&i3FOd+*lnmHG1Q3UOR^CiXxbg=2^qZo)_zp@ZMWUZ>IPGafYSmV zR>;Pf+nMzGgO+yJ7NuT=E0}v9xFjNX25me#;0-`dKhe!Cy)VVH# zkP1P`;%oTCEJ)jsSoE2c?vb2k!vIMDTSbCu1Q9wAF^JH8z`_^Ko%_KLe^e?}9(m-^ z`|iDW-!1!wh6k;>1kHzfMsNuw%M}R|i+wCZVo^g4j~`-QSXkJ$ZJXwq)x$mUMRtbK&e(A#@fR0=K!j*}wn$zrT8Y;xmstcJBiZjcgh_bm;Kx%>1@3 z+psTSQIb5zj~@B2fBo0r|H0Egd+z0De)ileue|#5%dZ?hdct5lWB=Fe0CrsW~~c##5k! z$>#Dax>Jy7dY;9c6&p-EbS7toE7jb}3d$KyW5W%JGE_xQVvrm=cJ#f2hf=8?)@RI2 z&+fTt$Jp42RHu|(y02KslL?HaQspAlF0MIS8X(7zuTtVF4i&ovM2L#L_4YfPMmOJe z*FB5`Od%H;&HnxSiLn8h6DLnXHp3${F8dns7u`&85;l!`T;ex0vaxEC%C@Y!(FJS{ zSePO*2EMaRMl3-#etrC<7hjs1p4z>8x7y-r|7rM5R+LH(f~R;ydUWA61>^X&YcIU` z{P^{WZQHghzZYeNt?beva@cZ$TI*vWPc?|0BY1<_@>g(si#6~I_qc(KgoZuMC4%a5 zx%|2F=Z_sbc75VHwdNNuoPYPgySR53E?!(&UO_pc*AE{)j8;Yujf{)}(50n3^dTS6 z!^_K1Vbvip;B@y+?7seuq#nC$OmSFH_uzdYa)U1F~7Jd z8@2E`$C}+Rd4EI-isZu&KRA8r6w$DI?!N2pyYJd}>%LoVxp@<>(M`K{?apSq0FOv# z%E8r@0X3up@bbAbH@8qOA(tsn6a6HjL{_gBt;5qyl_le2^gEI`bvqWK~!MGt(JC6Owy* zacOCGmcd~&(LRD@eqjNRnftLh5LWd4Dj6^KLN@aR#3gNK0urNJ2iB`h~q|Jr-MX|qERx+uSnBmJSQ1txV z92hO;^D9fsP%2kWoj!ZygQGn?y`TU5=bw1u3tgGaiDSo49zU@-zeqqDbGJ||CsLW+ zyKlPVjyng3hNQ}*P}s3!`)#+~wq?r}LeLBVNG{CJGmNq*LQyf?1NM<%FxnhMqNPHB z6%cX1)FIaD$T5%z-Gf0O0Pv6r+IIu9yY1hMeG69*0*j7l^8hZ7O$F znI9kpIGUECqf#M{$cpy$_5lq>RjZVyCazCSPN)yW4hr$!o^G<7C}nV^<`E)I_!^2r z7ZZ3Zl?wzbAVpw^=!5VJ1yP++cUY$iN+J;wpTpG1tuQ)f$1sp2@FOw@AvQELvUA7I zO`FG{oJ=|e5C97@6BwEd5!tAFffNdPU?S^msW=JMN{TrwMLLJfbvud#p;_jUhxqe( z=DvAs^VY3fG1i$WGrojqJ$NcyH+JFbICXf0MH3Scoe&Xbb>FMcP_w5@S z8$%IZx_A*V4-O6P*}aDk#I!L2?!M<95xYq;i}k~YKR9#h^gHkDfAh`Pr>7^O!d`Je z>jw|M|Mb&8I`sZw4A0}oj?>x$58jUr@Pi-x{j0COc=YHoT(psq%|xJ2pFVr_>b23) zO(6BP*I%ERof#e;f=0QB_(Wv7r;i^ycKXcex88jF;QQ}0Z05zfFFqW4 z|KKyvKJ&&KuOB@0-t~#uU3+f1?T$O<=N53sF;R~kIgB{lv112j435RYLx)ZrKXK;l zS=3@zSGVpCSG#iQ!u9Ldzxc&3e&^fYe&mtQedaTtx$pi5AbmDHT7cXA9cpY84<`hDTTIjW)%0B8t= z6j5>d#qyPLzW3hr%rq(-^W@m^6PUXoZeelxrkifQ>89P{hu6w5H{W>k%{PyJc$B%I^LeSGi+o>( zNVoy74v-!?bO>{4WOPJT*XdjK-MVMbO=LHo{^5^ad;JY&ijmacKZx9c!%13`&Dp>I z9hyZlPEJk_4i4Y4Zyze+m6u;eql}Gho}9dnL-zXXZyY&t1Uq18Xt<}hhoHsbLx+F< z+|S>A?_EL>=vQWU^DTQJ9wZcqrpVyr@nf&N^wR4P!`U;bOm=8=baHCy?fq{PL3#iE z_c0p!`}(oQ80TAr4)*UqdGZw27}|v!7!R_QY>r^(?75#l`^*c^zX)WIV%e@*H5{_@f^&K-3k2IGydnNIiJ)y=R|&=D<7e;ErHfW-{rC>(}@1e;WwCckul~ zhmQcat=o2>5rN5bKYyNN6AJ#?)p26W>^ahv?IHe5D(A$plZ9Lnix!SJ`r$E#jl!nE z^B2y)1oa8|(Nq{y5ixh}+<8b6SP@Wx0Elf68R9w!0xV`|!d9=o_8KJ%{e68SqnnSP zJoSU8e|+fhhX`fZlk&ikk>MoUMHGv$Fay}SWo-M_EjzYvhdn_qT#Vy+-+d44*uDe# zjt36_j~@N-#TQ?IHcp&4fp&yE&YwGf>h!7i55AAo9UUDZq4wh+|M>OSUORL06qYFQ zGh%YnlT&ZM_14QTz4XTGuTM`+5B3jqXS0|}&;IOLa6w87I1CK*PfpML_$SZ&{P`ED z(Ir7aMB)6|bML?V-jz$2b4x3!SbU(brz@N3>+MBeJ@~0lZ`-jOs|8Z{?svZP_@j^A zwC5(uKaU+hjub-FoIG&?q8%L_Md<=M0*(9Mc?WP2#vqbBI5U`EzGs@wfLMIC|_Dc3=PCFubeLy=o>ApB$ff_rTk4y!P_pLx(P2 zyo_WX8tI!~oI7^>SUNS>l^sNF@40DgY)d~ejaW20erI=5m?m!bx$_q>ui+ZH>+OM3 z`rwG4{`4m=zVsp~8*V0gPrMe&LB&eAUba3A<0(`sg;S?aLfapH0GvJqKB(lr-U0N( zv7^V29QokA_uhqCc?_e0rTnvVvmbnL1XT>(as^x;IB)>|g#|zXqUP2!7Vo;-Et=Rbe`)z{y+c=<|qS1&f4uAY_Hg6|<~;PTf`y?@+8 zYCEdDeafofEl!BpgPjQBK$lpQ5H#V{eYf5M;xVZvrzYV>uzSZHcX99j{RfCn6Eb}M z`R7R|k+LOA2Xn0~E&k@0zk+LroO=0{*ZTVgF_E#=dwTkomvRRVy!n%#{3w@SCUCHI z>yBii2gCol=bl5g6TF2YpZ?*~yLa!}d(&P-!`u5MQ-C`{fbH~|v%1weyR4<|xa%%> z7+(sWVc7VTh-MUUUvJM-Pd-s86^ zn9m0f9wNYd?(BJF5JWjYKZmkpua`vPVRXz}Z@r01XXJ$aw{P3ZTCz`l`oRxBI6`<3 z!OAjgK$J-L;Lc)E9(?azsPOvuIBpUyR9gA`XFvP-iBqSBM@P4#@OSSS8XgKIB+1Nx z;s4X8Pjz>9BS&;2mrPf87oz_9&!-JvFH^{%v%+3L*>FEWcr+vK_ zkcM~Oe)Imf_oGcw;rKDwE;KbdGD`8hBu)v^EG^^b!JPOy1Yjm7C-8XSK7tmAX=K~; z&pnR&Or`Gpi$blA)_LWn7ssz$ zA?hG`hj292)s0PtVaF_%78W2sEJbGb^PfNW+H0>$d@>RxV!3(q=JBgn$>8GFedpW1 zO_-j+96WS*dS(XK31=VI?ScF6?dwk0%2*OhGt-kZ(^G^nC|!B$?KhWJmZ4z~L0$$= z>dNKIAo|fqK8IU;>g0)c4jdpYfX{lFj`}c+5QG>Q9-W(8nVwk&Hs{Y@E|p#%8XmpAAx^)3=I&%2%A~q$qA7<{z$Otw8 z@Bzi#441vbzHJ-+{f~e06U-p;co6)x zhp)wAU&acYUs%TefSvch{bq09P$u0yJ2{ch6_0iw9vkc*9qCIY2SbrW@4zU8G%}Lw z?#iI^w`>{1zQ<3cR1GkG_~B6u9gLp2`B|Vr8VG|DPjP->5i=K0-8NK4H)EM$yy7Rq zzuUKO$2!3T#P&jHF3c}sC4kd~#W`4NeEiC{zV(fryS9rMk4C8qdhX{hJp1f(SpQ%d z5O();vt`rM0N+3$zdw5V%9Sgq)rra3xw%Cm4XI4;9k<^>s3w(266Got^Tc(q;izz^ z)l(-6ecFFL$|XtlS|8w96fph z+8!AlLIqCEEWC5zF!8*tTel!uXJ@9bPoU;!iP7`*fd@Yg4PY#uJb41)Pw@(p|AP;Y zy!gV4$VNgzaL2xzZ^5twVpA72Pzw@2_ zm`aF|N>5jsL;@iaggJ8H=+UG1+5IuVDe_3%N`t zwP|F8;DJ!l!V>;xUvK}+%);>#r^sm%Bs!1vQwt-CcWmDxsZZf^N@D-?!5(7dj9+cxC=&N3!b*qUe;>}g=bpQVhX#oN5-%bG`R;-JIHs`cX=KpdcR%sOQ{7!XhYue? zC}YB-=ZN;-d+&W;`N~(ivfT&YI|zq=;R|2*^rs)9`1#n0<7i(J#@tUx;G5t4=FXiv zi4#incV+3vKl%|OiShsQKm5Z@TgHfHkBx0Td-ei$?yg)U&ZYTP$+<;)SPw^dll1ykC6rMf?W*0CWkgH9x=5+uw&cCLYL; zKL7d0$-@2M2j2%8_uX^pNe3 z;>nTW;X{YtCw6%Ez4wwhAQyAjUH6V{-j1Hb45Bd{U+Cmp-}?3!zW4>~a=IpG3`R(= z;yvR{LP-Do5B~X6Pd)|T0%7pWZA3K)Tw`*<;biFl@DKk89Y8*aU<&u66#((q0pd5l z&fF=`BRI6QxPtQg@WT&3{m?^?J^sjh@8h7qNwnjMFMe_7&fQpqTCN{`{<-JI$FF_m ztH1Tne*gDx-ghhQ3=R+7fB*er(2(GmoFbBZ`QpXjc)Wk8Iw&3F1d~y#D%|tiO2ZGoStZ z7oY4K7=%uUFW$EAmfoH&bZ{aTrXG+OX0A|r^zkqJ&hPvl_6^<}mei9^K6UTC_tFd1 zQlrB|1W%yY?c2BAdFP!7&BI4Nh{Tc)efDAEQbbcI4f)15zL`yD&YV88Wo+v$H{XIK zbo$g82nHXB9Mh@Or$6_(&wclIzPo47o~M8OBdCZeK+j<6(xr>IdZ<+l5wz6r{O<2Q z^qJ4Vus7}93u%#;!EnU7{k#A6x44ls^4Q~#6SIQvVu{pkx7}5b#AoN1K(6{Zo9o%7|5^*J@K0G{#Q+W8u;d}16_xFGQ z_x}eNc5E~L9}e;7KTm_d2ao*pr$2q+x#u7L?8ATXd%s6C2-5_ZK+i;O$f11gt6%%f zXC8udF}8m4lb=8*UwZ1PfBpx5fI1}DLqz1(+ivgf>0x&F-gn%#x&gf|zR$S`y7tY;x-+hlg_9%w;y9W-O zIeX^z+iydN!MwNKb_WDc;s&Dx%0c0QK}JP^Fd;6S?9YGU3$QA|Gw7N4!SQ1!fc&?= z{p~$_b`kj-8`}gAN<2SQ2PruBqzV4;kN(9Sx8Hf?>a}y{&ym8y1cx5J{N=Aa_ShHt z`UWQ^rm?OdHq;#uD3^+vRD1{-I?%Uc*N#n_cFfH$7fPg}D%dpfSYN4#QJ%Q}tLHX&LLAN~+-V)ZFX zch}DCzx%tt{m?_7rW)Yj`-iEvLp|fNBX2KVz9Kepp@5+_JTm;XuYK(|zx?H=o_zAA zJ-fBSs>I@Aa_)9`0kpA_TY6{z{&(Lw@ZhID^*i7Fokt#hbY-P*^3-W|2RVEC{LJj^ zz_A?KC_dCCho%Gz#p2tf2)I*NP5?<9Vxaju|+vr57eRj z?HAY3zeo#KQ5b097g6_qJL`Gyy4E1#b|{mA1qxA#BN2+k(8f;1$OX#mdtj@;(e5w| zd_qWvmuzYn4{zJH^K%bB`uO9YUs#wrbNa-ggV%WwS|P~)&2N02XdzbrxpSwT z?dp}u>(~1GyQmn zzWwpXAH#EEc<@^^EwyRsxdn-8tv+w|JE{4b#zxc$KEt@_( z{2t*1l7dqcbLmt!;sC#4*UmkVK3*CecksRUsnZ@B9$)~36R=*96tEM^7Vzpm_~07YxU%<;Al|CqWraUQ1ko61-O@kw;DZmKS;_f_7NES`$5iRsbBRnb%%@?OfkECUVOy`@Z ze)8A}N$)Q$VW3RUF7yu%Q@lr^B@08QXJ+Sd6clVhy z=g?t9OOT9IQXM(;KI_n)dg6=Z4JfdG>7^H^rYWmfzI0`L>(0Go|GT^UHgDO!YxhmJ z-*!hSU(9B@K#lFbl1X=^k{Nu%f&O9i&}TmL+1u{CeMyp)%O_8q#6HK7;`8k6Ec}bX zgjU8=Ja_ior$6(M#3#DD$-(1zv8-caict3qhBC5y>$dF&-hH3y%U520<*s`k+_HT~ zD%*AI?RNlkYEl;FX0b{sIw4z2;l}o{Ei>0AzW@F2lX3gTH@-E{+eg})v@y;B(F;OZ z_@tz||KRukfTWC2S2O~7Fc`qRckf(|lqiB)c z+qP{U-E!Bhw-1bDQED2+(G6_Vr0FtxObey1RPsu?_sp5o#MlY8vHTB&qU;~}+~*i7 zbWV8wz`O6_=UBPfo;|y%$ir-X_;U~QAc-doCQKrXLTJO*jx!^ShI{Y5=fMXbB>9`o z;)2W8jmQ&tmL3rxq~We#7g{3wIksif@W>GC4?u>7$EfQdB0#JQO-!LUb)4B$f*G*9 z2K_odIfdza{=(Jix#5Q&c_5jLvB5;Cm|mD)(c_n7y@@FD3dI3g?A=@U-JZ=x03y~H zS%8s|EfnR2>SU=nJ|H{LKUyhIBok!V(ikGQ-@Xrh3F#hs|JeBWB(gCQj*pCt5p<&_ zgZvJn{)s2P__>Eahmn|=wK>26n`ZltZTH-DC!wrZB0~u9#Hq7n zMv|$n+in|s;>jm&zG>&#v#0T+0N|Z>-hnNSxrW1{$`n>KI7EuaDniAm551QY491Bd`3^>nBW>}%Wf zZJ@uOI4wdD8*ua37!f(B0hK1@ShKSPn7Y_5E0ci%$mrnPVfN$O_4g0-_4U&o;UG%) zsDdH=iHSh6;MUu2!!P;j*S#A2;E48 zOtzY`wF!$!9c{J3)EG7n zfz+PV>!=XK+1QpX7`S)cb?2A9^yGsN-cL4qpucb8`uGP&KR~ZDc>E-S2RIhQ5`ofR z{nx)j9U|88NDwG6B-XkWse0ix#|6v~Ljfht)IbVXd1`QAkfD$i|J%R)TY}^iVGyC+ zbJK3dh5_-rzx&U=^{sDVvi$j9{P}x-l!a?@tak*B`&rO!V6FnH0u z{AK4PC{If9BM~ZwWbs~%QijpJH{T3AsS9JYzxzACgGT&0nSke>BZDBn-n5s>CPF?| zYNVyvRGYK#bE1##jjY9D#SryjB zA>pa^0L9#Y*PVCjzE!2|+qT21KwI(%qG_Za4Tge*HgDMs616lv%)Fr9ZCeTONC6b? zHB*LPQ2ro}iz^m;j&JgMdY%6M0OICg`Tn@K?<$}gJOMd+qUPXoA6M-{FN_5 z41fDKe}f9gE}_sB`qj~5d3OnMB&b7(k-Ud6kUS_JEqUv~G9Z%2e2EJD#b5jdnL8~9 zrdpm-Gj`)4!8Aw;62xKE@d(B!Vhv~#*nofmFJy)o0pmbei)9N_)6+kH;l&?6^X$?} zZg_Nzgx%(`(XQ?u0&mO96zRw&KZre|iB!hvrotft+L-ix{jyyI-+Owx`ucjG!iVbC>JwgmgHhaNa^k( z9!(LbieI3c;h+tYqa<<46G6_gYrjBruxcaR>&8N$p{otu6T=b-2hG+Prf03TZ*y zj9d2I0+~^;Nz4QKLp6Y%UAuNt=pZDdi*AoJCm?Y&>#{gtl(kcN?o^NMgZYWL5Ft_wBnC zDT!B&bKlpG^pQnS=u3)}WBC{yDC=Q#PZa{lIL$kE?7n{e8hp5E(+DEq@|8;zkU#Li zT}0cUbqr60C6&6DE}rLRco?ll5j~yo8ldSfn(u!J>BOl-*Y~8l)qAcmz_O-A57QPfq>j~sSaFF2XQzs!T z7F{6YB$hka|JjE>`>9WVih3^Dsx}sb52^QAqylz!E^3QlFr*Q+6fOZS$c<%JP91aKm)_>es(<+g*3b(ve80E0gNU#_0mg#F7!#lM5HP zg?XZYnFUH08%~yahFLR`I(z!$_y7LD%F5!O{K=o}+OzlMsk49nU;Y}f+p;|%Lmq_E z$6^ulcaHjTJknZ`Rio2Hj!We+8n*&BAJ^YkfL%l_-_WN;Z0_(ihSA@Ba380h%oMl&#xhKYE%1j$^Ew z{l>Sx#ZXDT12JkdQPi}FSr3%q&2)NLJXcY2V#~mlBo?8%7hZhsM?d=hnKLIhZyve( z?mG&h0<;7SDQ6=vdE4!G*b+p98@*3Y3y;tUdpoFJFHjVMjOos#&|Zkg7hidKVRq_Y z{_(%K=l)M!xiaznAACPon3A<)vgDoBbN_$#{xdqV>&Wv(;gJRj@4ZJ^ly`KZ5lK;` zB+84V)YILh+Rt>)bkEG4yZYWWALi@3@2)p%^_rRc=1r?xjxCZBU6Cx7_Z|gP@ZNh5 zBr@UNFJhleBurI-WL2>!A_{_&59DGD}HUqe&TC7DnvP}2@`kxo1! z1&O0_qjX}>LQ=AgL&JlpZ35BKw9sTq1(78$X_CiqkR`)~AlnC_&2Hi+DJkCROzi4v z=NaTwn$;+&d=OCJLiG=h=H}($5n&-PsaW8&+Ja$#gp@G+HJLjOWfB*Ym;jX~5?HmeysWdm9YFvx2{HBLiIePx zC!Tt8Tj@5KQEgDYNXMl3qQ`?6BG}1p<^h1*L^d{IIs9<2td6dBHWMm#lvJDX2@IX) zrY58hXi`Q-8tFZttUMLi1Z+gk$!(#BE?>Fc+}x30P>7Y<)z!xHKuG}nh{2%&HZ3+# zeSITSv}N;F1ca6_BYYqr34S(UU{+=}D5Ytd&O)FF>+9-4IDxI;9|^`=T&%wDA{=RI z)X>F|Zxj1OK|eghAP*iU9Z1ang9kAKFcgRsBGkDx=7Fb?$*HZaDZf!RIyMYh z8ea!4x{|R`e_kTNpdh$7$V%#AojZRHbCCOjT>;k`wX}E7J`@ZC-o9-+lA1Z^Q70k; z6@O@GaNpj2B_$=`r9?xS2ZSf-;LRwdd-Lpr4oX}8|5WFhxh+_p86KW4(qYGr9mqbY25io)TelMafJ;RnmL+IzZ6SZrBnsk@L0fY~+O>T0A{HBT z4KmG|TiXdkY~8vI8>p(P0-cRU^v=u-4-IMR-wY>bPePEx2)uT!j18HRl18BjrUeEG z#XU%m=;5NB)O8SzLO#X$3l}KoL`WW}ladK&DI9lp4uKNx0whdof_S`SWHEjmcld*# zS*)D^4g_4M_W-?)~WoeAO^Nv#5D zf*cB?UTATnV>@^6A;Lv)Xy=|i_>9fXtvs86cA&US1t=6wAyjID(`X715sgw;W6ctf zLg!Hu11bYE2|Wdi3a$Wuvh?hELiJdyiZe-eJ|O^x-QC-R_H?ttjS zx{xyh$_*|;P635G28M>Htbn+{-_|@tfm;yr!-IqDM(nhmyLRDXvf{06Es%lmP;tyr zX@nIpV~8#A2wtM+j~UOz?%mrdNT5boL`O&4?A2yRgV6aTGg@BPImFx5w z0;LRzAQ>JxaycqG23^iaF#b*o>8}?3&O^(9ySlqT&lnO2Em9HHb@Aebvu8;ty4KO& zjvvqN0gplh;xwRDFjn|3UImat&CMFP*Ht%bhDXL-u9#iB_u%~#-K(r9VLAd!KrY$Al*p$8>N^c!myWBB71=`!6Ent!$3d~ zv7-9W#S0ftoffGLAP)wPF63#%lx6^k8YOMf2}FosIaRBo9NIJyBK zfl?%3#Ted&g$1NMVV-06^C%J@A*uo=2s?_*=I*Yp{DS-~n>XWvoIZUDrWgTlIZsj& z&K3)F`2E8?q7);7@`hOkV9Te1V|zUS;5?$>_DF4Lz0BKVk3PmjhYsdphOvybbnMts zoFqO4jsqhl-pM>bsYQ{TK693(WNRWQ0dEf-Jiv07UB5aw(6?tVbypHeg!}mDiA$HS zBH6i-g9i^`3Go%u+qg7D0hsFWE?Hk;kRZRq!k~h_`!0!jXSpJP9+W*|%vgS~skO4x zMO;H*d{ibni8$1@ZQIz%0L5T4tklTJ5QI~Pj-Eg)N2xSlMA!sL)&%z0xV05^ywz{dQ zE-o$_6RoZMpLf`<6Lv7;$bGtP))$C+ULpC#}BuEU)#AvahQF!FY zz*%8>Ayvl3$A5hEg?bF=kX+m z0`v}H)q>t`X_0h{{5eK?T3VVQ#vVO-1hW7J-;+;1!))+CL7v4` z(~x#J_6OEK=5=jd4No*#kwlY7dIFV!tAx>mE052Ey^f3}d4Z%~$d9MboWkzJ_yf;? ztAU1~0ut6RJ~{&i1|wMs=|o;GX`k#m)c=!DKb@18U)NBN&jZv)go`Xnwie=a+xBhZ z7|g&C?i8G9_Z}nwlgtRQvq@=&lZ%7FHf7qkZP|v|M1CxrsFO8ap}9FLhmXLU}frm<_x~2^O#7v_0ke+3d70)YV3%~BXAyZ zUphBXxs2jR7)LX1G)hyh4VD2GB+z5g-;}5yE@mMsO>cbMUCRq(uBzbTEu%CLHGdOPHC?Y=hYZK^kVx@oqPjY-SRmo#RYXuq-(x2|Z254$}+k4W1s;2(tm*aOLV{ zBoX2sL5%(&k|!)eshs5{O%X#|igeA-qmPk#XfJLJm4?N`@7N;vm*C9Mbg=~s3JcJ$ z$W0`EXLk>f32`5+A7q)s7Fm#=12MRw>>BcAd+Byk&ySyme>7-wxY)uh=%E7#a0sql zyF$bQh$bN^3BVr)8819k$=j8}x2^aD_%{e*=nHs)KpnW4n6024L=_Nf2xuM-94|)B zP2q!*y^Y2K#lew9`XJO2lTs=5d-b|VOb$jIb0oErVx#SIv(PN0`UnKl!J+Z+2s?3l zTuLUB<*Tc&!%acK5G;T$gjGep15_iH7=h>{zMGW7nAMnWtG-z|H|x&KN`stF0%vc} zKtz}=H8mqH7D1oNXnABY?8ua3q8J;9H+vYhBxT8hgE7nS6e&){V`W&eyLau*BFBm2 zgQ+<`Eumj8j#nf05cUWZ1JJDEqGBEy5;dVeLE6a4$r5i^s_juh&cpbLOcmzmORXWT z`VKlu0xEk9T08bDh&oYiOe?Su5~8tVP^G9_Vq557wktaaIS$M~8Dp6C6u@SaV^Qtd zy&EZn5yKkcLlZ*~$qu?UKTmcEMk+o!GGyPr{Z#yAn+*?*u(#oz3aW=;gH~1E zq}ohTNimh9Ad0gyb?{)nV<zv#?Ixi3k!@@x;V4HH|Jea^C=ooBP9y$~i#Z!n+ zW1L}WL0&PXU|2GcA$Bi82aF@DEz9h1S%!CMr<%*vptBCCi$)L(37Hxj`R!Y8QGPKu2f6?ia%@H1>CWBZk@m9k8}RS8Y%X@$ zBT1hI8Uc;RZ@~b?=!BeTo;yq*j80G}n6n*Somg7H1A^1WL}#R>#l^<-ba#MckfyF}NZO%`i6r_ZkEhxy=a?Yyg9z4B%SB->aCtKbR-cX$V3f|AK(=v%t_LIkU zb_RLK157M=G2AhuVHFH{o^z?tL=P3^Qt><^$9cjDDnfk0jL3ZY;^Js`qFj=rEXjild`pmMkCd9?o}?nhtR$~XkuHxXCdTERrCKT$ zh7eD*&nC_x1ToRwVDmyhrQ{Q6htkkYcnIi(!(q1oE`b(GaYrE#h1wi;&dJk`n@0Yz z5c7oPAdN({jRaNV!-;Z9wO8%Fs+A|Snx<55rJ&vzc&XO$mZ2jK9I6QA-tA7<#8SIA zB!qw#F%A;~G<;xTEK2n*$nf9|QV$hmm0OnPY&M>ydHfYVMO(14=wnl&Qr6K+SzH`A zDWeTx3LPdFlgfP&NIFrkQn(a6PeOUzBY!evzQw031bc&2G~sQ`AQ~x~6#{h0s$p8$ zBg5R__>-e-%ed$$#Pk^Kun2nur4JWFW=UpOvL`4Zu@8hSwkq?3W1&^>D2ymogCuE+ zCDVqv611dji&(Vt3{QF`uywV-EWb-aNsz>w4cU!1rD>*=GjnSQQK)3>6w0l#A(f;jb36&XRrKBLaHi?(;ym)v}zN9#vJdRScT&76rfz;HK z5~Y+7AzI4K0pU=GmxlvN4MAJ2ZBC&ysVvI~+3@UsBqn;7<&a{u1c}ws;(k#x%14`) zc1jXYVUQA=HCx4mlhwo*YNSy1NP=SZrMRqC0F`WKA#E^zR3={`!ljFdwMtcKwi)(> z3Y8G4VT{f|g>&b^C<_nAjb=P}&w8X36J?Wfx3X`UdF>{^Ei-#uloRs42p?MY$eS`V z{K*NWq>UD(w>dB(WgU4UEJ;qo8`|{2@s?*o^-gf@`t|i^nnA1?2&f1qdg*& zI5}V*_WC!!`7P4fSvTq&Q%wu0K}`_^Wt7e4h@e+Ems6pxPnjWpsnUQBBCJGwLU2cJ zQxh*2m{OLHsS~*xDwRu-p9m|0zob+k)8sMIy7b5*6)-;4Zamj7$Lm%Qy-tR&G{2U^ z6sE2ed1t?9i*DqAb{Uj9h#ZQuMfw>bB5fxlg&0{UsMma#r%42aKEo2<v?BPZE!d zNCw{2W(SOcXTzv{A?lOkEG^j}c7#hKJ!!cZX0yY-wqxf=Eqa=626LpeaFQF5Scf!j zr}VxM9TtSW$XlvtgeNaTUrW{_6XZrU^N>pzMiL{JMG#3P)4?+-I$oDaB>=>cGp`I8w!>JbOx9 z3N@Y3WX8BjY5OVzRXw5Y!Q~~@24%;{9WYVyAG53PBe+H0@PW~gQq5Ddm5?+>CTgu; z*^ul6&cRYL819oh;CSvi+G&pn3n9;y&p0WIKo%Z}&eG3NdS20wHC&AqRFw4o;?8xZ zMMiOt4x62;qG{M~a!xIREz>HJl(;SCoorfDMwF>AAcUwENz$&g=F%#mJUwjwj4 z1;SWjG1TOu3|okqXaaeMU2G&6)5xbBZT{)hK83r4qPl zs4iUwB%4l*bzMoUIt~|eO;$?OgE1UgTw!c!3ji?|H3>y@zvc@F4MS?FvN)oiak5qB znsW5PQPEOe*jNc>{e^Zy>Y8*;qMdFe1J*soV-7Fhm)+-jalI|F!ZdW!GFSa4che2EfdM_VyB;(;L zLSv+YveE`+iPa824YRrE}J9iLc4nXZZ1Li{c?Kb;~?O_If8R;?#Uj1Rbg(xXMo z-r-n@A;Mi_UPunTY&OUQLW9>?5Cc?99CnPHR%933OnX;KD{kqyeuMy7?E4%Le5PJj2vh117>6 zR}qQ*E?rlQT`c=Z_mBujA@hr1R)>#wL=8xNuy~i5H zY%+e?E6fjPhqxNNeNA^pyz^~(aQpfNvDBF0o@190Ptfr(OKS~THJ zmPt4+*5;9Mb7I*)Vv&gEX1u1Dzxs|khf?!f#v@WMhER(bmF{H0X2c|wd}dh`L4$n@WL$7*MT5OgYgHanhNSzJVWUNKkBRxE zccfkWR4w?Uf4Z54s4Hq-tV`LYXnntuGZh!aac9=FwX~c{x(EuE!?olt*hONli<7Ne zP}-g{PL5Q2Kny0iteHba5ya7!GVI!KNqu+b%H-=BE17Q@Aj<4mGAIwIUjHq;0Mx$ zi0iWx_!icN*&D|GGuD-KC(;}c#vq$b|2CizQ>&1GG}TpHM{E?v&zs7$P?SK-^k4vq ztehNYbgUjI&j11rfD8x|0H54Hb1L~R#rEm#;d>tGf?&3#Vpk$+1YXo8UOJ6pjG7bx z|Ku}BWP;QZlX;Y+L)KYfbhJrUJhR8&9$u)senhwgk ztJde`_RQn^iXcW!0ptqGW%X7vjji-4V7D2&+}cu@y=LFbq$`f6Iz|MIwi%!baSJKGq0pIncVvu+2u6;`MnH0jI1AHm9P?}x$qZgZ)(c`S{bNKOqano0VGE)K z(K?7oMX5#mo6e+YB_s41DfXy^I6}a3Qzk|OK5$D-M%d!Npmbfj%lT4tteq=dxohk2wm&sSiq?OX7*j>6((nk(y zg$JiSX=n&b;5m%OLjd3$hRQ;>NC!~yR>caD{iba_wY`e^1Of~=kT0?vVeCVJBA5{M z$wcmO?@X-1A!;*eil9hXaUA7$&dIsCF9n|{6)YZ`h$PK-lyC4cw;(30^hGqy-jUae zRVy~5&zr0$ju+ml)>lw$L(nP3RK1dOtg0Qm2tBC}4(6InIbNpV#dGs)17n=2?h))n z$tY??YL24W019}i!Kxu1dD0dBF+B|haiI&dcUD`W5Cs7Dk{2g2+S)iN zAA~~`75OH6jspYdFi5=$ z*`Ff)Bzz;Cn8bCIVY7z?RZ<}*FJuPu%FfZ|K(da4@5n>sL*~CU+Fc&N|NNi-vw0Nt zk)!UF=#87!6coL}dz=oqZogmwi@+%!hIf>%)Tu!V}d6cA) zvFv84uf(nthZx?FwA+FoB-%n<83iY_otJTk)t!}CgLZP$r%#%1lB0q_!zJMEDIgDJ z0e6<>jnW>QW@BtxNGqq#o};r4WH)SH?er>fH2?-xHlopG7PLPj8=Q2JM*>1ckiM;9+F>@N?5r17Bbdg8~ViosM@fo2YNGWm_Q2;tLqQo_| z%7*~6>b9Cq#qWG1aZozHO^l1bDMD7PAt`A>;5;HyTZYR@QHVxijxgb9!1qRd5+2uz z4g#^LK_=TuL1_cS7;%D6Z#+ebG+BB@d{ZM9iAM1|V>3vDQ7zmSZz{kpfGv^*ZyxJP z;bp5SruaCjcg1AXR+tDl72MQQ!tO-8%CSN;(@=<_HnN2T%@S2@iFk%6+e(luAz-lP zNHlrAm^bP0Bm$i9wnlb@Iv|=}!&%$|2T0!=^H@pMLc!o<)0*(JZe}SOp?&j=rKpx) zIHqdKtLp&qX zZXjIIc^XPLfVLVRvU&BU1)G&Zvyy`@+Lv*%WI7T#N_3)9V+3?jOo(H|a#ihXpmGJh zM4!n+p|{UR41iUT+I9w{5wk-;G(?<~VR4Y4CF-0HHPSDTq%_CsFoNX;ij^L>58`sBw2PQ6j;_N|TGp2G(1XugiC3WmSL(^euCw z29wykDk05WnI}jEp_CNk>jM6p7!BknbgIBO5}xOU;4_$qu@2STmTE{GiD;Aff|{6O z*s0yGGw)L+f)WTuBKD%HdjW(fnI&y6^%2&%twF6=DXlNUU6U2*2gJa!B9~L%?;UD z8BfM1=6Nx}U@^`>W7vRZ;Z&0^cxI;|#2{>uT2xhRZRzUk9j3B+dS*Hb9q&TjBpQbc z0!l?P*hZNLU9wt zOyDV&>KY52Y7t(Twpk^BjoYD(KBdJZDDfBp)4suhfBMzG(CPH$m;QjFk|xri-P|EV zMF`gk_$L1P(D=ras(nG%`+A>zfHGNzf4ux1VQsS&|#q@=aG`F||}B~xmw290$o zz^F%=Z(Cy!>2FS`51=`%>8~s%h5RXgzmKS@-xUdK&f(J>zVV2h^&6AM-QiERfdLPA zJ_Wr{u#^IA!l$rq#Q?w7gUU`rD5xu{wh(Cu(iAgNA%{hDzF;jn1U-|MFw>x{@v)3< zlgTl+q!lo9f9ZT#cdD*~PL3RgfS^gblGo%G)aNkJl3I97ow)BPIh_^_Y@1S23ienl z;WL+w4WS;M*sL5Sa-6Z6k;pCUgd6lq!^U#3exP$Al9cy!N(3m| z=g{1sYI;41@vQ_s*0RLLYf~bG3|N;>_1uzBG#?oRPwrPI!M7jGuF&AEawZI1Y^GBE za(Um}wehX3ySzSoE7x761 zOg3ZFap_daapp*6k}6$Qy2_ec=L4xmWm$xJVrg5VGwCxrnO^Q2D~AvL=!H3}**4~8 zb<%W(&G^j*P{|_mWD=OnD(iz_rq0wTl#}R1Rr&j#0-bO*T%?_@SsP&`3l=GMyV!8L zpN(B^Ug{U=+UfOlK4eJN$AGJW%AJ*K_^nY|)Th`=^7ccSu*wW{0; zk=E8)`0mj^17DtBmOS+}@7X-hCa8vEXEvi0ZllAu7)nx{Nc{}zO;V&xa zVb3!dA(}!B5d%e-975T(o(H}zG;a)j=`pO?bmX~G55#ONqpO%QH9ZkDQdCsUaZ%(L z)ReTR+7C#r<}r!?s^ur4F5~G6lL2dh(K(}Haj*rT(ugL}Uc?QY5oSdyzNs@USh2X# z(mos@#5@ZM?}=+Cn3q1HDopiRHTp>(X7kvHBr^x8;iA|eSb?f(4&Yz&i|8%m&&bQT z7v@i+=j2Z%3>jHw;n3jph?- zkOV*YBFhHr(m{fOj8&jdfJepKLnKMTykvU_xlXE5>-I5&)XC91m78L?O4Shn(15r) z2J0}DNa}7X&qUoIWr%3V2Pa;^d?69CBsQORms5z@q$f1yh;LR!NiNMm;9bk{da!>v z%s6HKty>c9ZYEG?8qZHx#oQW8sX+@fRC7hMYUUS9f2g@*mRQFIOE>@k|MW>jK~$I0 zS`iK~lVIvE`F|{BB;+bNe%VK|G}a93CeSncw~+XHvQ;d%OmbSSZE2lkX*23((@U6- ztQ$AWWOjv4ju6OHG?`KPcen;bbSC6k(EX{CqD!fPH*1)=#De$CSF9PN+wuN+}PJwV(XtClsv4iN;)G)!7;? zWX-p zxZOju^HXg06K5}vjm`h~mDdsz;zoyufDmA&VAgcBlK|Sme(kkbHKA)P+=^q&nQuDU6SLcqK%6xa#QmmZg6}P`)-+sCkS+TFyIn+B|YxTX{ z@$SUA7Oz@=EF@3WvH&>(DTr6EO_F5o*0CE_Uvc&RQLixIZp^k2Tk?*#`1^Xm?G(Jh ztpHnaR|yV@KA!gwO`>W9Ve<1AF7^$N(~s%lM;`sg3*SJ;96Ry>1 zZ~x}sJ@?#mr%#{$r=R_dDi8qFPe1+ipZxSssPXjH?|w%&bb`=v@d-P2?1K10kwuj2 z_rL$0LkISBwY9$e&hM_@xHcaOGbrXOkAL;RLk|xOj5RfO7UUImw70gkHw_K-)Kpi1 z6i^xCJKv#YSs`glYz5rn4?lSS(#5mH+o^_4fex^D8ge}J@S~JiqVqKM(XcJ3y72hp zkJA){lDEJ9)vxGTNqusvXu%YtejLq3D3kL3d+$>~hFhR)3#GsaVeH$#hrTbbzy6z= z+PcX}cR_yftAG3|EqW-RcKPzTiHSb)_)0bx501fEjsD>e|FEv+=0_hKrjiD|=BVX) z`SQh{-fjYo2M+B2!$0~%N`pz%K#g~d1tGEtrAt5$fkOfn-kJ}&J_QOG`ks=&r{z{+ z?o&SmYYMM5WyG3N&%C)LB`gSinfCHad2`s^eWF)S$cn-H5BL;HYlSkn2^|dSFdIP^-H$hT~Y9BC=A~aKdFMhv;JE(X=Vf8qsd&yM!4N- zta&@Pzeg=iFDSj-)S3z&IVJI|Pp07Sywg@Fc=L4K`D>qaGk#HyzhkLdGhf2$60s@F zYDs{WS~TI|>6tlHjvE>tg(3u4dhFwmJ32c{OLr6&7J=PU1s3uxMVF2qKZaXRF*W*G z!L1_KnBISAK8f4R&r(L}-FM%iTs9?#ckSFw9Y-#gmzxVnaO9(p2v^e*gW6`axTcsk zUCSs_3h++ht+BDmD_5?83sL_L#tk|+g|cdi2~jRPiJ=+U6e$ZH92lnB%)r1%eO(i3 zTZ-P_tfVnBoe<%BQg;cfh448&Hx2*x=*LG+oH$NLksYNws8B{tX=-7Tcuk2)Z~|(q zl@xE{PcV77Xr!G`MH2gi`s8$(BSJwbD|%ZIo1hJAS9dop6R5^OC0z>cld45oc%1%C zC7YND<`UXJ`jr~vSFc>o$<3gVBDEg-28SmmJalcTthhl)V&9&<5c=pb4=EkP2<9C@ z3`%an!UKTQG#E|fRme<3aXyW0MBc3gpT2MYTRLVvHnLwEeWFLk_<1XoLEs2)KUDKY z^PCFW7Vu5~nawXNH1Taj_9xOztEX|r;N{9b-LvM+-bTo*bJ~}dDqu7#24;CMW+L>w zw|Cz^(Il)EX}4Lmdm;ZU=vp_eF;C5JpItBB>J00&8`k+OtaG8)dA1cZe4CS-y|Dh% zehPJNJ)nW#)W^Zve*TSO>~4e58wKwlSityhKh!(kh@n@QQ(Fh$@jLfozdjJ>ysd)Q z2ndm8X)Yv8YKgl^^(BXcdX01q8WXN?l@+%KN{0Idpsp3hz z8T~{l&8NTm)gOHS`!s(eD2*3R%}da4BZ6?>Df>+6!9V!PPv{oK`BBxBhM@R4mC0$b z^}X+XA5WUYs9Z=?iG~W>ww1p8^2;zhs4u;5-+||!f5GFPp&8n?ty}Z+vImCxC{!su zgM0evb&;5uf>ALtG@hN6Gc+{dbl6^c=?70gLj#-mrp6}X>lDHylwgXEQJ0iH&@a63 z!neNlO-dr8zo}0Nhkz~!+IU0u4rP$3eM{RFZWERdp@*+N{mcu`zW`^OVw^NzA-YaA zY++f4()%u++G@(>TBxY3pa}mful$%YPn06Re!UFt;Sl}kLW6(!!|y--_@mUPyma~6 z#f#Uvy85Yp`qYz8ZriezF#pk`9}|@N{`bE7%rj3@YMUM&RCj=1s8LACA2lhfZ0IFA z)H-F8U&I>`uu5;;a+7|FN9Gd^Nkq8ykg7QM{chA}pkDW%cEvAij&Q{dej>qln+Mis zE3K3#=I`5UcRuw6s;&E4=iIKIPkBd!#{Qo>%Jp?#>p>7!njp6n2KL|DC*4*@Of?ee>_JWD6J9h7NFC(SL<#*We)ogWb6!ykNf z{^F&kmKH+hVA0eKh0#WF;N5$6WoBhipNQrMQalcJN@!?&Y~0o@ThdbK=^l%NE^!z= zr!Z;Bk@ZlkGKLNTw3x%+rF$STe~QnO3!Rjbw0+0+_{5l$wA7fmxSrmgp^*_n;8gsk zh&OFy3-a;-2GUYfXsh6o9t_hoM1q7*V}r_yn{>OOz9ZESBss)JXO}7H9fYv+a|M zVSxnGD8}TBqAvZ`En9hqevU3@R7p|s=OX(Jwm8@>C#~69yf1V5%J#fIv{a!hez^_=VxO4}182lR3 zxLWS6Ltd=sme+Bbdwz&oQP!;bx5PTP;)+%FZ;V?F+H4H}EAT4ooUS!h;EFfbd8+ly z?5$SbuUpr15_8OYHj)1^4ERL|rb|D{SO#QS{$s^hl##qN#VfA3=1^Blu(fB;r`?zA zzjbbr^-s_j;z(;@?i8yezal&g9fofR3@#<-W@g@f@BN0RCR#lG-QWHDfAiOW{lt?` z&|(PI8-Bc$O!rj{(}ZWqUgLf8RGAeBOT;op&~$MNhNICf-VNE>xBrKICKr;^ersNUbb{X25){`PPG_J99RfB&N& zyi^1jP96~@WwaO^tZRxSYH&!BgHg@!oi(3ZDA`ibky_AXvT50B%I#r;kl4ml(TL@d zM<4yWzx})a^q>9{l>`3EfB7%;t-^xAP3NL?FC`z96UN2G(hQVNsoXfBee4_hPI8MG zSs7Hu?H}qJ8tI?$Ofejc9K*TAHK*_!wLrB%BPB&+cI@0q)2-H)X5a)eQ8twn|Maz2 z|Lx!W4UMY)@gM*3zyG)YMw?`wLON$i6BMfV3vI=x3)bB9{)as9mrp7p%|rO9Uq+Ly z=L~^I242)J1^nkRXEXo$GhF?@tk#`t4&EFV=wsaR9@o4J%g)d*8)L)IL-x5YhUtCh zmw71tqBHRKbs9-`zQ*z+?xLpoq?i6A$6E>FpX4jnu`5>jPGT?M3ionq0yo2YHpVBq z@z40cexhsL^5B)mf-gnKJh{dqU*BuB5WCf5_=$}5^I64i@eDOkQ_Goy27aI9$)bn(K4*4B=?+M24WN)#t#dnxWH zg*&8zH-FaF*3yKS7uUMss;*HE33mYkcPi%&El?o&qV#&dSyOZ7?D=zN&sA2G!ZVO4 z+%R2ATbrA*Gt;+j**w_acjnZ|k3Rf>PQdh0rS;+7eS0ZXCt0>ywqamk@J88&5w_^lV|L)zZnj^|Aa&i3{;nu^lBI6Xa;R>u(8 zic1O?gJ)?BOfT@$r!O=%wGIu9<>wWG`!nX`q=fN_5!it=m?wjJcw`X0j3u#o^A-Z? zmgR>{oWZjJrGZ&>>3i(c|)i4?j41jQ@_pp~F@HJjYn5udky= zHHQJwW7&`kfb{^V4vbF~oXVS3F>x_Fc5jc3i<+DorK2b?`+M)b*VWnc$Rm#x7Llab-n}y;Eybkr^QviqRY9*}*#_MP7M`(KYMvVK*%S~6}(uKT~=tW9*My>zF~ z@BhH>{uOV(A^o4OxbPa^GQ{2$Op&`Z-aFe9cj-c3oYSl#*{zr(6FAh$j?zz4icbh>cjsjW>`*pp8@b?DF`ErSz=cF)ev z1l*?hYe`8l&Mvj6Imyo5JCc&(aG(bUA{zT)h6Ig%|#k5Ljfo% zD#*^tjB?T3jEcv>==+Rx>6HXUfClFf_qf5RXcxWA$z@MZPf19K1JW2Do1kd(p@R>7 z?Q368Ps<{Vk(!zeH;^jbQdT4+EZP-QSXhFE0irGo)sQ&z}Vlx>L>|HavbpJ}8IzJmAL&1>H0>ha&+R`@cglh3pv?%tO- z6ug zh&q4bj!PF4x;scem|19a(B{D5Nu9?gh>nh-b}&W0fU-H4G?#;uZ+8IE596&5kI<|D zosAMj>%(rFnw}XN93-6#1&oG{b~y$IM=AYAXn^28bhELsQTPFzkis`$^$Ce_vvV^e z!^4wP?$8ihj4O_wE>udEqUchNN~$Q+szcgE(6`O&rWuLNPIq{hv_6r-w?Sm;PfSix zpoSZyf*$4#Q2_o#)8o+7JWY$$OMV|Ew8$nf6`oQ2d_O5Mna;4}@k0(EJWnKons!nN zk9dVt!^Ucz9UAJJ7@wqqZ$eyRbaXs5PbVg($Q6u>r&l+ns%dLRL3QECEc1_{t3+D?Yv*rQo5sAz2ocl5Zzh@V*CUDg}t~S5cvmC!?lk=Hw z=avufXFBV~mzT|eHOY5U@Ioz@PE9CdLeV(T(qYmxAq~<-fzl8{8n|&jT5Cu-+Ys#y zubo1GtT{l6vC@Wwo*&ZKTMEV@`he!OFM?Flgk-1X!?g?eJayO6%As1YU0Q%3<+KY0 zHQVXROiw4bDU*pOZN#6JL>7=*s=kNFIVqAzkX;&D3Iah1Ng-L2vq!-k3MUhW$Klpi zo09yeWt^o@xvA=GTzPHaB&wXZwJi$0H^dy#Gsrbz0s<{C6?Ase_=S{Ghx!K%0Fz>N z2CY997GZ~74{1RL7{a7cn%nezgz*<-x6$*)B)Kt6KH`pPS0yb~sUeMq0Hx?{XhDlP<8*Ee$;IA))M|HNQS;CkI&!JAJvjDXu{g9SA_?rO=J(*Bc~#O^k~ojer-V=cDF}NmoPZ2pJhEeXN5hJ`b;r z{4_hXH7O7d!Jg)QTJu~xI!Fg9k!&V&LSx9%-8qQfi;>#iMjO*rOH^LEhlNN_PjtLCb*A5C1ZD5Bd8E}hb?Ik4Ld%CyI718C2om3= zk0E85gJ`v>&7a7`<87`lU8kf?xf%!bAEPZJ33!T&h)Mt>!A6;f$~QgbO^8cjLNIHj zDn3`8o25MaoHUlBx3>+0g~3s6S?8QicVZ%mDq&VvYm3ja7jNTbewNeTqwo6F)mpVn zO-q$^k=Q@o@O+iXmKt@aPjA(Y7n@e9J}-@7%@T6AvQhjNfZn4t;JFnc|2Ajv-&f!< z{C+2*?WdcMFZ{PQ6#N%{2{&#aFt79$vtfEIqjXXBXeRAMWNCM4T!<5?Mea-s8B`?t zTQ#mA@F*d?TbO93L#6ab(T0zRIZDV$Q*-TC2r!P(!0&W$QAj|WA!y$YNl@49I4%JU zfFc8sS6OK_;Nl35$L%#a(59`Hwmp!}p6U=w6GPJLFdFdPA=%-?i`7EwAu%)1prSeP z_)(&&;;{*&^`va1)$NM3l@l5Hm5u<6c=(Q0c`zC!OmUopHWR-)X&& zX(NsMPOoAT0mN<)b*!*~%0}s2X+Q{#m%xbYB}U=oNdfDCxG#j@N1=)K=*U#bD(m;Sd=7^-Qk5U()> z0)GN_k6~F_y2P)aZgKGXcHO->%8bnn%>VNJzBCgn4)YzaT@hH6fHMRh=|Ao2H+>GV z?tFFI1*X>>rutrM{x5^Xt%^53v%s2O^Cu@TBat0xdLsuQ{DHsUYH?TCF}GdZd$ST7 zXWf{AjTv|#X5daScy;nb-k2V}LKnl=wAu-4mvnJUMT_G`iytg6`5i}G`!kxZrs6Sc zOLgAiV99{@HAptofG$V18mHMD>5pPszL$zo%c|D!A+nSsk)FT=Lg*7TpLe9Et-93G zxLtu+PAK0sZQ!v$w40<_Ho*Hdypbq-gvm4G072}-q&+qk4ToSKC_g}|@#D4AV^&+j z3Nt`o_}tQ`(bzzyB^`o263<(pR1c@oD@s^_u5>8(xkZ@}qWKE8f={SEQp1P~$tgkF zIW$tNilA9S`iv7E!wjEC+HJrXe1nPvQUuUD$1x7O(}Z*h?MwSqg$=ApGx{L#Wu_66 zNILe4^`M@o{%5HY8G_|&YQJ-iWD-~ozuxknZ>gI7=ewEBw$OitkfH4|&H8FoNH&$# zOo0yZ^WaAG2o_w*^xjqUMSIelMb&Pi=7a$gV<~KF3kKQ{dheo|Wt(7n3Y3JQX|_7^ zW_GEJB$VDvkrZjyeTiik>pcYqmus2GCojpI}#iMaAgBPFg-uTp4w`7g=f1mm^8(-X*fzNRU?xf(=fmjwhG=ueT zd%sNa4d?OPMf zr)E5&&IOa8#VcJo168ITP zHxV)lAu1Wn;sW_2iWp%RiowLRW4f`yI8sU`YkDvvXWQ8w&N)%!vNY4vQfx7b><{U+ zO$f}5k!a}lS z#jT){2V%$@gV>mX+swe76ujB-#ywJzX9)u9Pvc1VcsfRJ`q4=9#lY8UYuLOK$cpkG z6WBjdE@z6l=x_3?PtxAX!oH2=?GKY$@M(b1_TQ$__ZHUbd(cJr3RbZg5;Qp#M2dd@ z!05yz6>Y;JY~e1KBPr1p7ZYrYfJcXi=(gkch9i8TCd?vM2{NE-M4S?`5Os+wEx;rSFl-_3TloRZ6}a};y0RWAdweK ze|+vTP#2C{(BcX~s7neK!HdL4$L?X|BrY07Yj@gce}LbN(`wO$rZyX_(CMj3XA}tz;Zu`S#Hv`J-rin* zw>j*zAhMyqrT#M2o!KJuG!zaOB5F8mFK~^=>m?HCivOVGx<}xOu?$ z?wL8mEubxLcm%Bd;DuR;fdWRW0uaTlo@=C1D3k`l;87QrK_!*&l`n}d)JTd}F%ld? zCsP0hh8HA73{filDG89;nbv^1OdOr;mhFwtebeit&Ckvg>ybdx!orNlqsE}PvqWK_ zQpzu6MpzpL3yNffaHGGu9qC!1Xomqa(3BVi+`itsFM>lV2M~)f|E#ErR6CI94`C*v zCiC;;b3*2zhcdrV8UgAkhj#aL{_c0btEs8W%E^B2x#u@++0J>?AebdQV~^lMrsI(m zPf&6R#uv1Ua7m&7L?H=PiY{=fMQ9p|D+!gA|EOLpS)*iA2<)#d*W_&pV2LrOp$B2J zY6T0>3)S&TQqh9VmSqE%M1Nmtlz;Ba`gsk&5+JMO$SP5^#sEKed-wC2w2kXNU^B2j z1;1j@w{ec|)$M)qr^*`Ss+6hKXIc$2`0qj-R)yz%$KW@Oj0IKK_f=K5b$5@=E>ICK zDkQ{?%R4tWwYV@*RFJs4G^?a2#ug32Tw6 zIZfQxxSN`D4^1IL^_HaSp{4b9m2T%BfdJG=YJ*-?%X`n#4K|p@dn)2-Mr|40M<4f}euylX{xEg9s33-D_ zi?D@JnfPZv`~O|Ja)mY8vUO|8=B;57&ccF%lA4*010<)cL&<`y1!|tTS-ie(<+C`RA~qKe>W8zUorU zVEN4$Pi0Mi#k}depaP*w-=!vASI=~LWm`wr#LTQc!j=*qnYeaA)VdcwobauPWSe@38#{(7a0l6&cUL|Ek&*gepW106pU(jYZyYj zgAa(Ufr@Ww>H2^EpMN}g;G?vem06^*3&aUz17Aos5gxOLfB9j*uUGAAM65K?4lI$Kd zOP%|KcxSXr810kp;F^Ys)930hTx=+>=xV4R80a4l53^CFPQ$5y#>iM$QK)l@1gPGy zuI*2dQs5jlus~Y>0%6+GQTOpYLQ|nMY01 zr^nUeyL|}fpy1IsjhuH^O zR56I+%AFmZt*u}=T@w?Nv9WRZ?)=_R-_YLC!Q@jM0xjFy*LU{J=?fRm(~ALBO$WmI z#-^&9wKOJhI%0wrXdxJCi=YQV6rTG2y?c|B6QO19*}MPS-}}Mtz55v_J(hZUx@ojX zKc|t=QBzI|Gp@67IZG`Hv7+93y;UR9PufKn2Xb@9_TFZRe-)G$jbJN4k z%Bxi{4CxGMmqJexB2p&ihPv|a(+vfGZywo=v);EE_(CXn^PB}b-E027rmDGxxC(q* z8C6oIMqq2@)%nVm7&e~9EM)|E&|?!p?HwZ>T_dye5jJ~lNQeUp7yLMhj1n*<=sq`T z3!h6(iHVJl^m-O<)()S$P*-*XDLm?)UK|=69~v4SpO|zy?ePiG!C_o*0ryY>0j6-h zgjM~P3IbQd13E&X?BwKFettTazFAcp9`4w&V>jLQ-hA`* zqenlyeECvmXLqzKo&xsg&s{qF{s$K?oj-l%u7*WZ=A%GB(&GtZ@*1{yf_evXcx7LO#xpkLN5q}FZbYc*9rv_uu>7+rK-0 z{3uumjggq%t5>hnFR`w^J}NpU%H=wK;`l%P>>p2@I8KW{d}35J6%#I9y!867UqAf* z`(qS{lkZ^T)8|rI6wbKK;xy`T2Q?32}XW{U3hxA**x#!o`}} zT9^Up>1neIb957Cm&8uSuR4GyABJ=zPv8uq$jm_ty94Nti_(ZiI)pADIuT5N6^ z?CKfDm$p0N;IR>nMbFL6dq|3l2%Vevjz)xeQ<7ZqaZbw4o;}}i?n3SOBnfFT4o3pK zDA?VjqeEn3XJ#cwMG3`?1T@v^m=%h`@~b~*&-hcS@+JBTPcJ-taBvuqxv01}H7&Wj ztJQ7~rjK7;O*7e5J9q3sfsKsxQiPX^L_MBBqoy;%g9UzA3)n`c0(loJ@u8NU9t2d7#bSt?d!o2FDfd`FUZG1 zC;1{VA#pp+7PoGt+cM#Muz$&|^tkc(YwPQQ7V--UF-=&kkB=NdPiJIi)A)FFYz!!Z zn*x5Af@m-?j(x@niOx$p=8Wh3h07I{mD161d;;T)GLhi)41jxgI2{-zSFc^gV&iw% ze@V$H`T6-`x=|j$*q8pNZCz9UdwtM`g8#i<-Y>(=eNhzr9ku(KF65eTE(IMI7bw6- z)Rx+C1YN^W@1otwYLk_hw0783K``EfNv95-4~pOe)W^WUY-dmZjF(Wh-R+s4Bk771 z`}yhcP_Hf68?-PH6&0M79-oxxoSc}sd<6t|-0n=VJL2gP2aS#jcykM+#d`}1G7=J; zT!JJit{lQg!nQNooQSzr>ofWHN{S}<8fl|0P0+~5_>CLo#l?kNww4SIcDJB*Q zv<(FZMeg2n(B+C58}ISXj@WD=-Q5GjLo?Z#Te~_3Q8Tao^ram;H&s+tq^73*^iTdQ zBR!+Jq0tr|UR_;t_S`vFOiXTJJ|+07YpT&PTQ+T``z-)igeQ+auB)vh)K964n?T z8i|gHl~T!C=&-7)GBqvrPyXbmKltuFS}_YDxFhZwlMbbE4Q!uZ%2Ar(Rs9o;>H zBO~z%i9J1isTmnRef72Mw2W(4ukPBh^Cv&~F^g7HQDro^s;ZgV+QqsCZ~x%< z)U<~P>(F4|=y2c2aHo5!*A_k#9!f5BFG0_k=3F z+~Sl}&!e9lNzjDe$wV^+TBHXJ;de9>1SmTCNKqD3zubTq#OU$QsA8w7%(z=rO_|Hg zNG&eP!=pqWkdze_6*o3Iedf%WW5Lo9xaUr=&>6b3Y;Dr8&g?PjxK~wkA{|+ zgt16{p~c{#k+JC+&z3D)iPB>kpkndJQ&Q6M^9wSwbHgHO0U(8hal5x{-Rz8V;DvK; zPL-ULvTe(@nQ70}E7xjkYACS7l@k)#!&vbNjjg3u68YLke67L;$ zEeA>3p=39}wS){$b{;PO?Bd*FXmF&%W?C1*=deYDlJ+MZ3l`=f2VA*+_0*X&eS`gR z3Gp;Jh97X^#EE0aKE8PIJjnkbuc0B2cRoDQo|>MOn^%~cmQj#bfEkw*pA-`v3osQC z9=U)2elU!>x(3kxVG=^5UjwZm1(#X!-PipjeO?RxIbU~Uem>^~*tq<9XW;iq!LRq8 z{l}qADK0WJ;5~8d#y|b+@XvmB_?N#t{?9)@`paJ&|J5%~zW(d8{QTOckPG0M?TPL5Abj73I$7^!ZbM0#R(W4)yrl$U@KlsUOuf6)sZ+#O~ znG>Q|5bnV1cACk%V)z&G7n;TCh;rB*^WM3F{DK#7C|`d0&;Q~t{_a2ghoAhx9}t?I znw&(J!@VNC+YN|9LDX^c#nX?l!8FHg^3{ElyQ7PcP}IR&oDPYWgoaQacw}@Kke`qQkN~Fz z9@w^Z+yD9Z|Hr@itA9h}`se>Fud16>^fG3FSWwUbD(TtnQ8t?sP>3JUbOPjz4UNuW zQ0+*NW0OdgAqFfLqC$d{DV7cl(zB6J{0b!h zw)1I<#03XUPI{Y~IvX20I@|l(+j?7Dx@)Ujt8cbcRy6QaRoQg2vbnN?pO&if*81A6 z-kve96i^9uyQfA*`zNOcXFNl*b7K@ciHQx%%85@+j~3M)97IZbVLsTl-4@|qTo?`u zo!}=j!jqaBm6e%9aWlzA^UnHxcg`s})eEMMU4WY)rCOvaK1!PUvszC!bZW|tpGscb z-hF$ad^a@IkB^TLlBL~jT6)^U4?heg8-LL&O3tI#L6TGNj7Tea;E~X$VT5UMw=lqD zNb>mW#DlkN*|KZbE<(k)`d!^!zy8&)e)-E^5{&0a(hlV};(8K@s-~GF9ed}A%uIS;BVczGZ-Gk;`(b1HTt*fiM ze!UES;?O|f$jIR2)EL#_pq9gWkV%h>Xl`nTwAk3xL{u9JJw^jedt7Fy37`Tc#U)HG zM0#q~ft@rqHgfW&rY5dJm;-7X3yqba^CzRCG!0ltXD1B&0cKCq6SN4Ay!0Rv_Asi9 zRj1jEQiqrY+P`oAj-5LT3JMqi<^qI(qT-?*r91e@4o@#4LMq#UvPd~Us^5Fq53)>D zQj}K1^F$U{N`|^?*KSe=Ip@g8h!p3M1bXd=qi~Ta|FrSin1PKM_@d9i7bOONcjtK- z#5OeOsi)e zrOr%Bsw*QSAtNI$KQE=A0QE}BGR0*P&A|>=w9OGUIyU8YPatxMawa9k96Y#t-=3}1 zwUy#&UeBV|8l%{W<|&!PW+P*j)vW(7g>AKj9CDcWZ+%@IQ2XXho3J7Hu(J~i*GP6& zUTNv};o+X9=BmqA&Jw9DFDDmkv8ZqxIaGvqx0e=>&VB7_8ESsl&RuZpz?O5evo>uh zX=!i0QE}rOWcmx|Z~&*U{O*F{Pzj4;O)acvCSEUYVI2xYHn%0aiapJ zuPSAZ?(6zwzalmnv|7SG&VJ3xWNjsQDG6VgqA>D+HarN3Vt5D=GND|RSfIZ9XH%4<` zX5dSy;Fn^?;x|MrI;+EHAbnVp@Klar8|inNrBJCrEUy91FQ6CWPw zOiE4!AkNFlDJaM-E!~`*<%kFi!OtWjZ@9}!Plsnm;aja(D-MBI#jV83(suGHjI;}dgr z!^2_*D4uGKJy56Le+BR3O={U0DZiV6s4DqR9GMt zaH*#_HkO!#Wm!~EScuJ+5FeM6l$f27Zl||$&_Y&r7Q6wLH9kJRWb-EK>|w!lc6B$_ANu}2vp5wfiUtrNiMY*s6W@cw7e&?P+ ziQC92o24(j2oB2BPsF%FP#m_$%0^lLiYe#C#fyU!5Q>adydhOT3%j2D$n08Z6fYqVk4+#k2P~68yXWY{h z%KAXA7}CST%m91`g(Dd_n?ao}Z&VoriT~ZLvM9$LWDu)=%H8zML zhf5NgqT*7E92OW}wA34whA4QXzzIZ}U1+b-u~GDOL?lSRQsRQBuO2ZqF%#va#u>_Q z3I#?TH+qcl>D0t@oGXUF!1&~(jmmnqNDypkOGli7y7zRoms)(9v`3+JX@3GK4CUfW z-P1z$pRw_%ctOdaIO)SZf|g1jr(W6IMLKT?OCAMY;baNbWV0`v=cXcdQ(Z_?%jE0 zFr7Jfy`gDnF(`R_JfgG9O*J~g&|%^8-kDMF>^PkHl#~pI!$mq1`k8(o1}jDv&UmH= z@zh2p=_3~wVxJd3ijpke*_qCw!o=@?@2P#e3nRiPRqG9+J4`UGTr6Ndfaqk22GIv9 z!FAy9y^Xv_7kLHArxC3boEODpa_BYJj(0>ASbAEr@iZ$>%Jv8qUKEpdo{^&S^q0f& z6|$9dNEJt3D(mP~Py?oJzUddNFN+@VpgmrisxK2_&5xNS-zWpcEWaC_=`*6_Faz-W z4^!pmn`%wNn@3q1drPn4KhkH9DY{`M$aiY95~c>R)!fgNH?aORN1M~i`;5vrcr)R~ z#xvtIhp1K$xP;#t^lcKXJ45F1-JWk$OW%LcR_=iu&xV43AeUuhQ0tt5-!m5dI_`Rz zh?kr%vXh{uQ`|c;!j4$%>F%qzQGfi{rIRNvL!tM2!e+g;mZpi*C+bcdt*EJP9~l_} zWyN#CO+=lC3S63Ck4y*;jj=^0*&|aT!$Is*Bf?T6!!w+YOx}qIj|&fri;PH&3{Q-V zNU+=D!^2=!3um4INKo5UeU-F$Qy6~@hagb9FDVdpqcu7&?w?g8N3_0{=o9szBHw2g z@I|HaDMVnh+_dEkZ(15lnyGLiA2;4=VQU$JR!HB1e_2kNC7dMV?}jE#Hu=Oy?x zr2iwG9ACBKC6zCqtNQoF^fg?fc9CftFMsoAz9TvTu1Rr%;*N%oB!@UC)IB{H7VMy(J4AS}TY~K# zPlVUw2n$VIBp5%xz}~cs*8{? z7Zny7MF13VJtQP5ID|?jV5GL7kjN04l#AF#DM_~v&}9|lqVQEb2aeU3Iw!cR(Gen~ z^;NtFOw{~B{$Fbj^K3pvUSX`twH#{9%%cnxbuxa zH)ddC2EKqZ@TFAnfx=DX;MCm0*oM5}+(93 zlANKT65bcR(tU)zRb z!ORf?Q2DMHzIctMT8$_TRav5PtoHEQMV1J?#)s9BH-4%gkk@Rgr5`h<&)*5WqoLt< zua|2zv1xqTZVA)&A>PK>wO-~Ig*>3;%iL;enP_oiQur@n9CxwY0xyTQ-2JNE8=j0@^bWYUGR9_aNLB6 zz5o}R2H`Nd;KtiR!yFVqgNCdnXryO1UnIwxx-}932mMB4(hZKtcCa+ztsB|p> zj&v0-Oh)AQzbt{f+|Ba6DUp7Gh|Q;*g71oYfz(BtZ^@{ZahPN~(a>6OPCmCH==zKL z^L$&rB8a_$_JZQ-NquccB-_ugY%DEq`L7m4?{jCD{dxbMAOC^|swit>%=GwlnEyz? zY78p#p~4$7Rp#YanJbj~l9CTNOusK(ik1|uEUFq;#uhWGd#%Z^zG59Fj18?`XN|!q za34Rw_kEdnzhR&(fMtUT#Af{0HAb5Ck+C@pDiAP5vKQ9;Sw3(JQL-lP7WcLKJoj%a z+?y+z84vtf`#P(STi4g_&7e2Vx-kRR41CEHyx+OeUl48DI1UX+_j8K5I_c-ap9)ql zkg>#%02V>%zJWc-VuF-SJ$T%2DFzo3F*gSV4G$i86di7UK}ai!n|3v%CxY;<;yeSG^d%vqEg}1D7(>T_AfPnOci;aUN5p?~LGYcYYsUaD^oJLF7JMqFQdFfb>U8N_%hi(g#X!?Rrp~a}{D*2J#s8;KlDcFj4r10b;9F(} z1Eb<{ymlfswT*OWK65}VEnhDJzuxx`K)SL}nI(W;g_9`vUDuEvy`bK4?A|PCe>hd_MjI8JNeFhyT9l)A14r_r+^P4T#zm zDQnPR^}?-KtDx`L2UMz8dqH#AeV@VvBuR{$zyjcX!RDnwtuMZ-&N{k8dfgaxZ|nf& z?5T=U$!=Y2wOGF|+w=|>@jJFg1q(W{+*S2CvSJ3AS=9TnAar8{_%QaRH+{OzcXgk# zQbnwE1?#oipOtf)Giv6WZ&;d?=6@-*QfxORMGE-iQ`+P)%7U6BtvR<0GKCFR^9a`G zhOeH-z^Pjr*z!B}57}JSOxK3yeh_y4#uzqc;I=dHWmoV5jfT?i9cAn`c=r4vrAzFK zA-3t+#VIs!aOhk}7+M|dUQ*aef0jOAvxLjTq-y*EKDd^Tm&`N*oraiBMKD8)C;4nK zh@WuOvO3Oyv7*A2Ij`DYTx)gB48hIF?q$-`D5OP-igS4%`OX}^AaBvHmP$8*%!`RJ zJL~p(r>W#dlKlLfdv4Z^@j*`=Num=Z!Rq+xrJ4$NxJXhT@PoLK#<5ot8J*Z@nxbB? z9&bE9<>fEiO-p_tW`OVKbFcyYqtahiV&f8HVPd4#jTyhP;I%NInd-owHJ_FhaR^m% z##1*hjd3XM3!Z z0d>?x^N1Z{0{6jGXQO7_q}1P;_jrP)r|Es-mHI353z!PXaEt@Mi-iTsxyei700s?M zPOr1xF=2!i0)3sk@2(uC&a{8JG}<7Uels&3O2R3xf_iaco=K5A6OYjUtkA?A75o}^ z?q{Q0{x1Wd_WA@y;$td}dYxHGHPkcr-YIekY_uePro3$I4MT zcz%JtFF;2gFQAds?4c)~^a&Cgycvn?4PzTFLlM+E3}ipv+R*af@@?i{RlBiCWabv; zX=OA$J;`2UM@>&pu;ti~R?>$REi%P;R{faOxuX?zS2n}ONj7F+V+I0d;7g|9mjjZ} z&!y}aea^jeNLVj@*Fe>0<`%qYYnshO&(GNh`h!LWgTliSo%YnA1?S>?1m3V#qzPNV zEe@eXZKV7g0=1qWs@rGDJvJT2Fv7U%3Ci;mz$J9&4Z!SwD7mzpv}?-iVtN-~le zCuQw17sBZFN$J^@bS7)LD1Sy4ACLfA0HrWP4P03Gp>)7;hJ{8>PtQ(HxM?*`hftFE z2sEQj@C?cEgYU;3!XE?*AZ=gGgjqViyJDg-XwdHHLi8Yd$xC9- zA?yM*4*Y(s`1U6K+KNPfu5hiHrfr)j zFyI%Bge<+5a0&lujfLa?*LdIhr|4A0_sx0=mC?WR0Ay=4m$z?!-e}sNzZ!E>Y z^;x0a{Ve(wckM?Gv@(wtNEXwDs(duZBfmsx9{#jK^JNp{@R_Bz@#!~2@Wu>m%)ot_ zfiIbYUp}WwBM)*q;$6dW#<)5+n*fG&m|G2sIzMFdGUV9~wPguhQHF zp4al}g#C%aiU%labCvg{4xwP>1`t+a9V%S7bYo)^=!y7*B&RbPl~0rboh-0DKrg9y z(jS&qGNcJC%;LOzCEcI%V;$hT^Ctc1sA*5gmv2&IRU5=f(19WH7Z;`VsD`VBly8V% z#!IV1LeHZv@jJ2h#{!gda-$vIE&#W-={XXW7HGYFqfL0y)q2lt{>b}m&-~}?` z#2c0bIOVA!z>$ZNg)S61?b(j*mPkIz(y9O#9)j0yUzm-clgQ#6%sQ&y(Y_=c1&@5B zoV~b_lBUIJW^wZt1hQAv5hxI?-??C@X%miL?sPb%;Z1lrnqhXH6u!Bz2om;eFa!al zark7M;^l>S-Gt#6q+eMGiVf_2j?d^-BcA=dXgUqy3yGcDPt_om@fNjOIeTue{1V@bAK8iSAg7<4b+p$3G^HI=EOqy5d%x0 zqFJ<~m>m&-J*as}g1~VXA0M9>2+8A}pP40j11oTjkAYAm3NBZW(<*g9%MJ>7V!`ry z6H2S}PrK0gSBkJD6UE$$?;d@(q3deuA1Lv{cOx_)K;;7z+3iuNc`-R6sK8G>X1*YG z6wHp$Az2qS*#Y{t{JS(1KTfc6a9_^9mrT@ENXwUVLN@ODF3-T1Pr>_zy5Y7hNVMD$ z5gHymyEs3xINv|-?V9)YxF_#TD>iJX-gNfI7`boJGF8mZFKrroS(5p1SP~pMLTWbVWQvh z;MIK;zuCmQee0~h3)m}6F~YG(cvJ!sA1RNPpyG?8|v%9=)=j`kHAKuyPc=Ecd)g!i!?sFgHAM5^uc@qm&c0Xh)AG*=~>>; z+}k&R%V~{9-8)N*@c({!ZkUB4?S-$edMFUAHS*tgLw8Hl2cE}L8_bLh1RbycN1koWsy0btaTdE`)u# zasA7ekO%~1UMO#uD;mAn+1-8O#EIYi_P585AM5Pu!Y0F^XQhDX={$pJg)Zk`vCJgw z;)sZJ@GWWgLqP@A?i#+=+g2FI`hUNjrO^kgUa@ijtyquZ6H7~AsbkF`P~gKFsF(!o zA3`rokwvU96hC?mYgA`e`rJmauPDeUE$?RNq2$Bi1+e$?7Jb9>feL0)t*FLb7GN8v z+n9lk8MyTfe98L38}06sapD^hgZIqQ_mlTrQQ?UR_J~MtO!PupnlnB=JT``otKsqS zF{s$-scB)b%}vfNqDv<{v(r$`Jsvlr%@JjHM%nSlVO1@_vJx*Gq#YfMNS^h$CugQ7 zC|GBU44t2y_Rb8?dWVveB6ja8DlANmj>Z%6!0*$nDBMGoQ@EzoFIzNZrbNW&=V>KJ zD7T}%qko{kr?;=It*fP_jhJXcLOcq9HlwICD(TM9A2uWuaJ99y^}ToBbx%)cWoFuF zLvD`<30)i;nK*au@}*1Vz^tgEnVCt7_o38<_ebo2t}_d>WjD%?d~}j1enCNTI3w~^ zy+b8f*<3#3Q0uhFdzxY=bz=5*E+ki> zd^O2Hy17f(f**r$ORPU6Xn1HuPZ)ge+?n6}=3h>pIMLhJ?{K;xQ~)Z_`40#MC9a8y z0^<{ipK{MMG_|z0b&L*;OixbFdZdLQ=n4xfP2qgbx6$wcr4f8uKXAUqAy)`pO$1Bx z2F(1DE~ayxRdhiN1&J4!!-In+r`&ygef)+&IW#=n)6>hR(a|yB5C%)o3{D~vGL6DT zkc3Rr5L@iDF#0CQosftLpb;nsVh-iL;eP&YFHeGz87}n&Vy?8yhcPydE7LUs}2&oT$C!GitCo(7V+zfYFGOx-D()%pbm= z<%(P}Zr?K86=`NM$5pu)>^w9ax4fsj=dHKi`pp|}4D=6VWo1RjxcI!TzV27Q`qh~; zXD278dir|%`g*govu$>u4jGj}l`X}jePyiskb5x>v8pT67)~o7$tON%UDnUsv>B56 z_ja3|TduFGd*jXDU`#yo%rgfL9%Pg^t81eiQJEP@K=PVhDP{yZesE~y!lg^U_~oyD z``fpVA31vN%-N3i_N1ibjEoFecV<9(3Eyo?ZiZEZ-U7z`ffHZT0zFpmPGO=YEo;`u zoYkCAizK0{NzgDQ6L{SyD?fGWRCriKOiWyTT|;$E4cQ_I*uT_()EPHpvS-w zYfDYFB_~J5#73m1M&)EDCnm-Y4G#8ncSBK&fJ84ID$17dIml`R5O+*WY?L!DEYvQN z3=ddDE<81A-Fbr+Cg;5)bDqJ_;Hi+HDTi%=UbOr67Vh4YTaagS*b%6+B-#{O7BsY)Rz2qARi_PO9p-X6dlB}<_a=9Jf z?_#frU#O0~`fa23L^3m>K@WhFjpyA<>k3RbNz4zbei(58t-MV=*Gw$_FXJu#cEpBaU za%yaB6pDmtAS6Uf2>E0|P(|52&9@i{P}9WZW(W!|^_q60yFpW?|W<2v3E?&A`Rz{#9H#gT%57JUol9CeH zUBDrelamnr@!zpNNwx&bmoZF}xakJ(k~uN_4QXE+VEKKP75{zy?uLT@eO}%Be{Wwt z1s|y6;U>>{h=PX%&qE%^PsIgA-y_c#7d_$OxK?vvp^K3bVWc9Dj*XL_79Abybl?xi z+Z{0uM+{wQ_b02lgNOgFpPk z$DepSEiLuT>C;2QLov}YqoX6X$Ovfh=%lXh?uPohY4>zjXV>81P=8F(-1di2-_AAV3?S&2?cOV1*IzM`V4yuAF%l`Cy+ZBZ^7=!MnS*Im7O z6{Q;$6~!G2+M&_$WdOik+45TRjWbJ18C`fuNLW~$7@w%EtwSZp$H%9qr)Fkk_VjdL zx_GgvsVOZjefRF&35kjD-GDAokf%;=gysLXsE{|>gwugYHq!9^;&uP4OcYl zYpbZJc;}tBPo6y4*w8?vBPk(~%15nDZ6}YPI(+yr`WyA1nwCltf{Pa~9y@yM!i5U} zE%EV*F|jeVbq&A$-EYsHJ>{8kk57ztb#>ghQB`rXv8AnZY+^Dx$`S3d+ihX9Gc#3{ zRi{p#0VsIsrI)|+o$oyQ@PX3p+p@DVva&N>uBiIDMogAtM~^l)HFLjlaq-{~H<6n>TM>x*4CnNG582iR8>{g z*3~j6wY4>|F)@@3em1tp-JF3hpMv*?fdzAwoOJYph9@P?tnx<^)o^wVs)@=4(58_LMaFR9=>G1E z0-TI>xsq*m$W!S1)8zsIAk@uJqyn9|Q*v!7DQ_~Wmq2VCnc~9`;ITGvlS2CX1}Z8l)6=syimm2Kol*BseuSef0RrOP8;7_w>xnxKmTp@c2JC{6SgS z^`@rA_V#v=fRxl!g6nU-`PQXNSKHe=YU^so#zwYm+0@qF^6Ovy`r5VY1lrr$+bJ)Q zl9Dz$HhTHW<>saam(u~&adKjOa@y0@H9QVsBFdSb9G{bw2FGz`di>nE^TWfVk3at8 z!w)}fcSNu{G11PXqY=gAawEh7BGmafQ-qO;-S5WPViHTT#M0rjeJ2o)T$Gl}{XTjX8 ztF6HTzaRC<@OH7(}A;J zSXfkDUH$s&uXBdc(a{?>ZZtGB05GJdr&DtQ?M|NH-CF#+DFQ#|a|If_8`JYSFUIfR z<-dFi-tWPqa3mZl73D}+hktG|pj6F=N^ue4Gt*&)AbCh+L{wN<EnC8y7x!{Iyh z(8H1cwM)^>{SR94+&x?XwZmHqqoXJn>Rw56uH1_%1!frEMZd4`%U_^uIRcaLGG zCll{bN#Iyx@&Xwi92%;utcr_|$9HeRZEtMo@9&R_c42Km0LRE09R-q^jf;&#d)aIe z&pz|)(_j7S!;c(tMZ0d4-<+LaeDT}geg65cqnr-E|9)*v^*6rpjUWE-`_V2}&CO~E zbkN`4efzzngp`+l^zy#Fdy|qAsAPQd{kpvyyw=|miqeoM;>|P`RAX{%ggWV>_qWTPfr6jK(74ui{F0a;fM2c^Qd3LBoed8 z%*>{8-oWrkOk6@yamk!=C%^KQue|WW^Q_*~_*hC(qL@3)O^-hI*w>zWJ}N32YmeH9 z@b9W_Rx!ih|G^K6vFhgM+dA4Y3JVGfKoJyXk;S(%MSlOJ>Bb#x%)kRS17AJ`@3)vm zGpJg%8o}wG@?#26xQ?uR)63DYMJucevS&Vvr?dpJo`|n+OXlIeyp#v8JgT=#H+@) zbf8H~Ggv)HKE-ncDW()idE zuqq+d)RYvcWEmOhPe1+DZQHllosJ8aFHgG{uud=(5)KlrSi@yEs7xQv+W8

    5!BW-5qJ2; zx4xB~l|DEyfS;P2ob=KUf3SJ;Ch`ogUA;!k+i7!Nx^NjT^VYK|f$paAPE(q`>+4?zrOwU+vrFfuauNzh74H%^(mo*`31g?Pqw49blbLV=5uJiV7+nmlQ{C>VA33-N8u<~|4>$7FL+-l0!A~6hRnURokhSry1 zWM(o{))gwi_U+p_a&l^tQ4m=`b)i3_Nfk&)2oDdF`JE*W5@u$P@Vs#87Fq6azKiz4 zeqiPy!$Vlh&(Ht+|NZZu``UA5H_HCuAO7KYzxy3$L-jJ@{DObXLW7wT;OB%)yTlH} z0HkC>h{NgNp7{tqBE{w@w6wSYsg2bkY%@w1xY^CLsTU z8Ngn-d9&uf{kQ*q`t%t>`#X2;D%rHz?r>0Uk6er?_jLbYKYlmp5fnNK{!%lEdbK$@ z*_@Lb;a_;B*bvN8N@@z%B0Gcq23N&gmy>`QP=84l-^9o^UK=y8F$4F01~wG@N^v7j zHg(~({x={g*=yQH1o<13oD@{LJ#+W2ocvs8T&y=VY-o12V`09NpV_%i?`%hO^bBnD z-Mf+=I*?IPh??-yq+@>8)B}+uC246Ux!O`R)udBV8Akn1D}~9d_>zZXrCVvyG78*B zkO@td+1Z%b=qH}|${)Y_M}Pk3fBL=eeHWzNJu^8vI@rqaT6<5K=vH>||Ya-O#|$tjEg? zcqwUuO+c2N<~O6@!Dj#95B}h_pT7FqtFM0Jg%@(Ov!uKkVV0wuK1nsFC6$3#h5Tif~v2c52{jLgjKrQ5&${MQd2 zJTNjga`xOgQrE$#A>2VMC*%(?AIJjwrP2eWClLRl_fYU4DndVt`CQfian$iNM$A2(!$G^Y=nsk_8|X` z4397v?w-5@ml8kaG1ze5@4Z;xxWdK^m>Kx;LG&wDUR3Y0{#T~l2UW@;Y~idRw{YNv zpgo5h8s=~W$Hv*9Jx51}kw*tzF3JU;IV>hRBqhm_ogKS*Q{t9Q@foS%QFc%8;^g8y zv33f8gh{EoAkHTKiv**|K$3cC<}VHZYx!?WGnu^P061IghTxS-rcqZ{_x0;nGcz;x z?Ahsxc1WvIEt1>b(NcFvxekpY9cx38BjEOoW@XU?7@DqOmAH!OMb zz~f?^?#WTA>tR6fjn?)~q%e)bV3&x}GSf14m2R_z2gB_uyK#exIz>grz5N5t z%@Fqndi(nbzDmbhua{zZQBM2L((Qjq)3< zEzR9s(APSen_-2w;|*`!vKhaf+v&nq>gZqwc-<(wK?d4^gNJbI-+S-9j?ONU&PGOu zT+vaG?9gs)ZJqu7gN=<1S1wX zqwQglq}{PanEG%#=zUFHLsxe%pEftwU$}U>sks_BJtD$hTPt%;Y~=j;^Drd|{Nt>5 zcXg$Z16fiGAko;=NDO{(Xpk@p>b(3$IZ=@(o_L%bdI|u5{|}E0!^j&P9Nf2WA5a9l zg%CzzL1C1Wc+DtD2ejLxie6`T&&}%UhNi~kl$0Gic1%r-*H+(TQ;m)eH`LXVN4IV3 zHa0TT#J+;wz&Y6gn1 zs0iJbot2rLor4A%9v&iNik$eTo_?A%>5G@(<6nYbT~Sev0~#9}Gd?jEA0M}O&mNQt z10Ee2t|+g-mj&<5FDQ@-aHf8{U$}opDZdKll@dDA@mDeuAa&zDHn%j##l>yfR1zN- zYoju)%?>J#lZ{1!A1~$DVxk{=?6I`e)QXB5r%s=&uC5_m%^8?Zj1nvZ$vJd5U=)Id zU@)CJb+Wg&=c`XW^}_QnkT&+gM<1Oyb)v4Jma+w3efp_K9({ywp@1n111Fzc_-}sm z8|YWow!5nXe|r1&t-$G_;So-!Yj||L?E0npn)1|?#DctR=7sd}gv6A*{32}0vK!Y= zpFMT@%&G3~uEeC|-MjYh+jj`l<>IBwWTkg@bpjiF^IPAdHT&?$5atU(bYd@PZfN%8 z`s3@DSCqq(hZgtrSD((v%pkP^V+-})(%iCX)8-dne34|o_KtR<<8b1D0;r&1R5F(U zgn)oT5Qoslj_uniP789t_GzrIW6=QK;Zg3~wY$5!oAeF#0OjqTc;bm~z4#*2OC5#6 z!h-z#JZ!$+-fnC^I1m{bX()J8GufUmE{ zeYx0!dl4<Y23_8)Y($!o2X{*Y&9wntnmE>+>ilUVb(y#y1YNAqzUYOlVofDR~ zk!+x)+UCPlM&)l!#53;uZC}!hL|}USMR?jc->7sPI6DZij8S;bFuBORrq&o3E%9Su zSUA#@X&W0E!7~M$<-2L=>07pLi;GVf8XloyE2Mn-kVjHnCnUHDec0Rvww#`xmXnu9 z2zFw8D#{g|l9Wu5dK5M6sQMFF(}YXCT8Vsbhr z7T{_#tU6#DhD1D`so>T|Mn+Ki*iujjw38m)jqm#M-|g*m$MbC{_&ZL~#sLq^3~VU) zTP%g?mm;d#`0dNBbWzc_7gd2`!2ex+Q;7Nj9?bf3hD@_Dljn_^Hyu1B@l2^$$W8EF zp@?~DCT_aWN?$c}kA{eZC-Nd1TBInAgMZy02pxTmI0#?{@+sLP*qZ zu)y*r7~G!tHYa4RcASzYq$WInVKkWB2QC4~ z&xs}4A}n!fGsyeW_D9%=VR*^bY>@C~;x9Tm#+Eb_&J>|^X;R1)b#b+1t@gEJNKC(s zUoR&dJ&A_Us+DGdR8=w|9XXG7n_Hm34!noGd-jqtM`Rr)1Vgp>A9`6~en?4qx&TZ2 zLoUI$xLJd&Xt#Rh3cxE23&%7Ri&AHaI*;zNk~}7^vq7*$AM;HkY*&rehLhr2hXhFVP z_o^aWPhzySIfLjPX(A__G<{c^$}3uq(l@yY_wW@kuhvz#Ysny&xQI00Q|j3Y1;coa zWrHJ&U4kMsW{RfMOK*8}w(5RSQP%i<(ITVs-sA`g{t0lLHx@FAD*_826 zg$Ad(u&A)Kv{aTr?}cnYQ~3wIZmc@FQ#IN+Cm(U7@JTgGV(Cs5(&EHehKx`$FPI(% zsbAFIa0*;$&s@`zj+@esIVgKyKBRty(Mpe;dtu()!(H`BPQ9V>Kgn!u9D6@!U_-&* zezyJY;aUpb-*&~XELUr?KxciKviBVtXhqz1EC_L{E0+{aSrDBq8bLbBh$>f^%Zu}B z#a1Zy5mJzk{_yg$WVd&QMmUzf7agEq;BaFf;Ck|}x^z-g7IL)G14K-VkP@tXw#8lC<2taV>VH01LdK)T&qbFj>cDtJ zjrsb*85a{3%fLh}X%?UPS8j@)yxJvC6~Ek(v{S|9HL6VXo1D{tDCR%Zyh*{gRB14c z3SrL6*eso=UnL1bDiYIVojwF!YVugCU@EzqW;}8&eVOGj1CUz31~)Rdql4lS%(=h- zb~}uBNDr*LFbt%-TL_<;4)@%I?h|qMr8{kyKmvxZAa| zz%T*|Ns0s;fOn+Vt=fa;)|e|Z4C%9{Qzw`3zg9H4S^J^5i+ke!o@ztE-{1M(xZ3(> zU_-&*YOa<)wHB;u9jq>_)kJIM_eJ!ZcIcL3@cFNSK)rE=mSgp|Uo@YeiX2q{Ucp|K z!{Q;)bVOUZXlD^|q>TS++$;mqic(TOfnQ|HT}XWxi<>5}JUM27(ng!fx%E1FEB=rL zIJR+%MIDm(q~5%CsaI`ks`BVn)LRuB1T82-GJ58&d-FzH_&U%VwXF;XZT(}~kSp+R zhNshEl&HL6unlc6Ba>s8fJVQXxP!SD?XIT%a?D-$UU>7;&_%Vpxmlm$7gnZk8kKXQ zQ_ZJnTsf@{+wz-@7Y=r!CYP}utTolOHg}=p)IkdAQ%w(G64X963M~zERQ#)<1UZ$i zyQ1a#l7q$YBd{U}jejTTG+;f*OW*``%5|H`63W_{Oio=*v$e!l@UO3)nU7@N^ak}$ zvlV>%z&fF>!n!TmPjKY=1>U_l(tk&OnQ_-Q`MnsnIp^nMY<(^ly?1l?0H1k7!LNI9 z*10KFnfgw;)`M;m^Ol;7u6qFbG#U{vqFt(=nz$^f>I&XUuQ?-Otw&egDbYPXpUi~k zRkkZyyW|V1GB9euXhb0x3fteRrMrxEVByT-ty)@51%azZkY+6;0|6LdGrXCe;1 z4XsUeElW;kL0x=VT-}hW;8Fj^L@>9k^I@zOlP783SYJebX|c?=d>i|2nu+T-IIIn! z|EG7oGz|0m-QC;kd;~trVSYhnMt-mDl3T6d7jE7@%befe?`|mg`#ax0t?`K;CRJCK zjQ070MwQ~RsiHB_**PPE{nFg$xmw<&fWYd9iLY<`Dpff~NvPnm{tJ-m#wWA-h|4c3 z3H&lm^}5spTJqRb;`^)(aU4~#-5VCYU+fwQYlLs$_>8Y9cW8N{#%M8ij8XOyr0~(- zj1n?)E2O(SgmV8lagS(h1Gx}aNDBTW3>&qJX z25&$D`P3}8p22!YZ6r=0E%THvXDm5RZVU_ej2i`ys^+WW!5a>NqWZ>4Fq^@A&FD@O zeV6}N{D$}S7-Mv(vFP*lt+`bbO=B*4uwn^1MV4)6&8i9Z`&$G1b)V59>lEl}&KhPw zpjo!G#GmfjU7?u$x@~=O9j{0(aSNwE$xyH9vn=-nT)-ss^-=86= zG`k-r#a)}bFY1Xl6#N%t<@8aMXV8i(E9`EhwIz)$jqHDljq1{>FN&-N0L!Xvt?yco zx1~@NyH=HB0dVxRHhpH0h4HZo3;29fQ7ee&+-#GB#ie|`%_ zuCMe0pC8lx-J8**F89quu3HK9ImH zy*2q7r7`xL@zj03wG;p}d(2#SX|enoOWw6UHJFeLN?XLy3`uTDm=-bslLe}1{aRXX z{m!EA(ti8$?(7=BV$<9NB^azvw*?s4X5U!*+)NrL@gYfTD6qh3G&6aBUVd$AZO~gQ z@^wzaXBoCkn(sNWB0IiF<$arw&ocfm+IKe;{1;@!0yHSn$Z*+wV5|1H~fX5+0m)e1eTUoi0te!&=HL}Hl%a==B<8MZ99bqtBiQ7TbN@`Z&l zhs;0uih)p#g*51r`r!}DdRVRC*K@^BC!cg$Bp*ccAuY+^TR{Woh#UZg(tU3Jlunj+ z>*e1q#=Ov%K7dPz5f@`oWIr3+>+W6rZr#N1!Fe_m{1;~t0|kWYQVaDpiqn$fOKzW~ zGW78>;(JNoSUhbL*`=1Q(xd#CYTyZ1OwVe0y5{`(hw4}V{^5Nt^KJZ66I=+8BfJCU z%}kl`J}tJI{}^+>fw!~f3p;e#^#4d<$$b=d(^~8B#uL&3wXV8Wf-9FWm8^ zG_%`Wed&~X>A+hsmofwhy;Dt)vtSK#e!~*5kON-?eGLU4u+5~jA{l)evk$zY+@*E( z&mglki_c`7z(%8 zs8Ujb^wF>|Qcf@zczS5chpj*sgE1M!*fFF8A6WGHD0qz=$(^a;s8kFK$1=Ao%3q^4 zCJjd>)<9J2e8z7vKi1o8nOVjUF&q)iztv(1KB~%wg1`NYe!5TB$94I1=id0%U7rCX zI`zj8)~vL&K+o8x%tVSwR9Ld7wadIE;*GL5NHPcTh*1Go9&a_GjiwLOOv`S!+~VID-XU zSa)izi_eDOLT1kON6%|H>!Jw^3to#DD}}2tjqy5+OLNoCnm!^sk zrG#WYMUN_(QZq$$S^e{V>!)e8@#7zW8O*wew8pT5r6rXgs}oz_uqFk(kwjU1X6_=8 zptEH8u5TXhJXdBnF8@*7NY+#yMI~7H&5JvqaQ#P^2Xo`a^snn7*_f%%eFiM|!;<1A zKy19OTLEjr>-NEJ6e~4bUf$92FZ?OVR0NOxna#!y@X01iC9F2*{ZU3^?E4?2K#%G( zcy4!LrqyyTI)2)sjOVc|BEI7Ng&<#UN82*I3{L2)eAeHWKrgzD0)sjbI7iiE! zIu2Nk2Ujh$shzO)vg!#j6ErMh3MMjj0QGXuN;Wky1=&a%C6SU6E8Su<$t#|<6JSxX4s#v?79o$Z`mm} zJa{9>R{Y%UX}%lhQ`QDKvVE2nbvYIsb}Dvc7AS5Z0B3*L{m3A2JM+l`cM|bfpywOcc85 zWI(YzTz0-nHC&IEH$x-BOpRl?mfx20Z-=FQA==&C@G>vZCnZJD%OR3uxrpaE7lghC z370si3A*bS1)z{21-L?fC)c;*7&$=%3Ewh2D=9;O5i3npY$Y>XpA%um5cs;SFy&kx z@9d0}>Jf{SaIF|a;w)=N1OM6ltK(OJ7FMDQt;eaGt$4MRD4rLkCup(o4^~c;Sxf(l zE+4aO8?mb;k3sVar2@177a-5tF4sf#N39QN)>@w?-5$O{EXI`66naU(F#k>Fa2grK{rk7h_r1j9_3 zdJ%WV$MwH%|JJW87ymlW1{57#2dVo|eoBFB7e_UOu_F z%!sk1#xgOWD0P6eSuV1DGG0c+r8PDxFXOlvsi&Hfh6186=#B&ai_YauX^kUZvYg&r z!Z4@wHhj`e6`owv+_BLp{&g|G`{bx>8Z~hw@m(4X%a$_Pebza3Xo5448R&}(DE4lt zD|3FtG=pZwjL|?Cf%~v3I0c@{>{2;pz?l7$7r5Ds?dX5$F;O%jw%fTh*fO&O_F(BD zb9aH~4E(Bg4KOD&I0$2uKnFV5<3XDNSDI(wsp}>Da?>bCfdRBLjqK>mM!z-D z3K0UuqY}i03Ziq}jG*12p^OLL%i$2+2D%_EXMFiY7Ug)E6f_HM;nI53%cs&ziH0gT zEf*af8KngAubrlzLY=c1Kl3Kg|7=7=Tqg$HlxPix3JINw!R9-bF^ zD&k{1olYiya$=Gxr4gdy!@i*T>KR*_LX$Qrkh}Q1!D0)7d<+kb@B!l*8yiEbN5EH% zkgka`Y0CSz*y*Bgb^7EIm~jG&`z&cSwG4=F)=Z~G2Jd%l{R0bJaSjR~y&D`QaIcy? zMw$q_XFMGp9mB&TEH6X)if5d{({ukX3?+r%rj>+&b*i}lxrf?spJRy^wuz?%9jN)viV>d_^I*NofEvyGlu z7K!&iX8JAZM2FozH%s4q6W>>w0nGV0^K>|0T`rpp5&2h)iu%kxO8>3wG|Z=h`hvv1X{>20~&*0 zuA+?mv4pG%@QQ{~7*+(Gp(pA&^(Z4>jNTP9Kx_)MJCGoNdZt)Dt|s;jdrEiDZnQKF;%QoE{Xf;Ayv-n-zL_VByk$dh^l{`z=kw1K{esfZ^v zaDwXV>*;VmH8rU_0c%ebl{J1ztrTRGdy?w-e!a33^--Z2yx8C0d-dw|*48!-p^q#M z8D28*zM3HFT$>auqkvbuOx8x=qqgdIdgGosbEc}QiY~n=$;q77L;pR)64mA4-nk=? zaVA|SK_}jPYGp=0-O<^Zn2kn}&wQ=Ef$T!k8Er3<0zF1|9O*4>AeDSdeyo z9>Z?bScaI^9Ll_z9b%M@|NnJAFU^vwXWg|b2h`+J&sz*EjXbD5X#NIU>F*yreE9JH z{Qv&Xi&&>E9%77{u(K2}y%#v=gVj+Vp%R;h{OgL=$nkpkEXS(+I! zH@#$1D3Qpw(q_4Zc3|p+=--BeZ2TMFze}50O-$*{VQ$m+m1R5f!P5h)o}xRvu|cx) zZ->B{dhiz3GDT&OLqj9)zVl9fLzAgZ%k%lnGtX|`yv1&Z7%b|IFd@&j@1ST_6_X?N_{vGd8No*j4)O@;9v)$%sy&+K!i95X*Di0~wCTyGo)RZMEcD#DOZRH3 zeCM6@dhW#~E?>F!#N$sLI<${A!ZhJi(+G)8S6Qm#A>rrn9W6y?l#o)u5ZIEG$o7-O za!t|;Lw`$z!loU5nb_9W)_2~0ue)#Hl~-QbRk|%?VGiU211JR0o|3&t=Y{!!zP_f0 zy6n7ytn3_d1O*31PjOMKjSxC0M@EERyL##Hd+)}@#=iX0k9&HDe)HyUqg?hEU;I{X zULI$oKoARVvqiE{#zAL05vviMq0tl0X}nvZOo;m}8t3B0%SS%^C_gv%D^EOe>C(m8 z+Ui4x_CEF1C&R)b!AK$_Z0rQnnNW&Jhc43MXLNM9t+jn%U@R}MI3qm+(~b*bp8(}+ z=f(&c6pLf7&zkV~f+a)2-xF`@OU zmzGhhAcqmMp{MAcU&&$g% zE-q05rgWm>YXXbv?JToC@5PgI@6WjrgO_LZ-p}*hxdNMhc6On&qwB*Dj~+jEvbMIN zsj2nKl^Y*@c)Y%@dB!7JMDm?2P^KkYhKCg7 zOk%N`R2ONp6AngKfi@zT3>SA9vF`5N%H2PU`V&f!){?9I+1Jza@sT61|N7Tw&zx;- zX=!Y1ymay6@#DvF9Y6??Q)qW>!5S)I)VaBV{(cMs>>W4?k|&K2QHqyH90_@nPbjf) zydQoL8FX(W_{xzctsK`3?W8j=jAVYD@pv?seSrXENVs@Zh+rhC&EZH-OB){>Z)T2sQUAn}?N7y40k`ia!)6LBdqa#C$b6!FimoHyA zf9}HY$f&vpk`W-4uZ-_*RJayL66`^02SL<@DW{ccOvas-3=*r3XTd{mhE*g|8XmF? zvQ}7VayzjA9nsN%2LnTcS>!#m@xml*$6GfjQmV$LOA% zeFLKRJwDb(_CrzkWV%1WN&OD0Y*G1{o(4@~>&^D}4c@$2yKUR{S6+Gf(MKQ7$;qv% zs$@r|r6&yy57gGxR#aBd7kp~U9UB|R-ma)9KYH||j`p_MS%oJA%i;i|E9w~odGZs1-XYVcXVRPX_J3|_+L5*9_k z&zIe}@xg~5PEAfd@x+tg`~LSIedMwH{KBN9#LSHJ*qCV4d0%fYWoam9=bkI-|y{6<-SUmxB-Cqcn?c6L@*S2r{? z3=9l8oi0a|V|Zk&v!kQCr>mj9Zeh+F?Q#tD^_E>PtE{T-9~cUcw8g~4px4W;UL6}5 z-MV#Ka#9i#-qhTBFQ-h-ZJ6YD{l&fFw&EZ{=W1=MtEs+;E!EW6($_Z>5#g{oYy*RR zEp1Ih1H-k|)lH3cC|l+fauB z7e_{7`4OxE)8;O^yE~EoY$vb;?85qnhL)D*iHS*~*3=H%S z4h}%abVWPICnoCa>KJfqYYQezTtXs7$c2lS-hclv2uCW>ji8Xu_O^=`E;O~YIHIG% zA|m7CV!Aro`g^)J7Z+z{Wf5gKcm6_sbF+8{A)&FcF_YtCRTbq#ulSjmm`F%WM4@tD z*RNlzspj1}s0`6OBfNF#N3ZEI<1HKn2&>R7#cBuR91G=4m@hp*h!)Xa)=6Rzmk z-u{6bgwtl;m*g#P}mM9<%5E_dV6~ZfDOh?ds}-; zb4ycwBeojW1~bD`%#C9>$H&EEpRr6lk8SO32(-k+BIi7 z)K{~z(xF|SJAW=F)|FR~-O}3p{^9p7T(|%(Jv2O$kdVYCy>#)ysguWBni`3ij*U+A z^^cB>Om=j39Xs(cU+n4aPDx9SiHR;NFaP<^f7#yA31*d$5O4Cgq_w#TU-_Mj2W7&R z6uf1BD4WK#Zy~rjH8p+m#EFjf_OE>9u@}DaO>Qb9BO@m}Cp#-UD=UL3_~kEu@xkH4 zX{l+MnHeCLLxY1ugZ)YI34nelPoF|RXXoWP?UB8`eMdh&+R@hTbT}?wzWml(Z{9%Y zmX%FRjOXX)AzwcH@WV4_&t5oxv8$^aNF*jUvAVkUop;{hpr*!pr`^U$&YwH`o8P=~ z;?$Xns+xu1P>|s$dt_f%$Jp>-c1{*Smj1y3oZx#swf9KDPfktX_T=SfLZ2!xzwzM* zA00b(s=B(auXi98SUfiNdcLr`lwiT zcT!ht^VJLIs>;hcdk2Qcr;y5R?afC%{^07htK}6pheu|jqhk{j<6X}1p@Ht!zx>57fq9@Kbai&-=H{lRrVtu9f8qSEe)X%%moK3zQ0Gxm zQK*n3AANY@#PO<|6@7h!u`!7e;ZaRZEx43BcWqr<@b>m};x{KJr8GCU{r0!-96Nr3 zsDFD~XLnccg$rj+oIE->*c**mIWThVT2*2~iqjbjLjK#|y>a^ViL2MHjgF2tH??26 za=oIWvbMGc)e;{cTUA;0=9_PwIC1jYwQE?Pgpg8_Q&5xdA3pr?k&oHly?s3y8L1dL zObRo0?AXzB=guP#a&q#(FFyL{$occdwt~D|k9%sU zzc(c*F+MJ~qT=R9A0Ml4Xaw6p&k?YwuBv$FowqMuyx7*(%Gok9v#@u|E6U$_=Ut`? zWeJo>JPV=3g+BW5qqFDEUA%N@e0&0&;N+=OmoHtyX3ERW!(@5?{r69vJbCu~x$+w~ zu%Ge@@;o@uUCh`V&m)F%V?*OxZ~gXz4?etj@e8yQ}l~(G$Jh z{jJR%$Bu%)0Zde50t}A~1IU$KzfOpaXFnq|qprSzsKn_rr>|eX-q+g)V z9zBXjvUksJ{>A1&?w8*v#{o^x$S5i-!t=pA0@+0FpFVXaAt7#aNl8XpN@GLa#~*(b z<&1j#$*1j6G58_5Ik|~(F_RlrRwZOv~=pUGzoB|VOwjVn5P+D60 zz`#I#ePe7)Tx(l9nvdK#e7mB8{9x9=l~h_xhDKvz;$s~V zBYj;HV z@zHMY42H${*uSP8n#$moR^=Mmz|Z@+S+yL;uW0E($ejPg?ZgwT_`+esi?3xDKQCU zhC>WN^2m{o+uGW0Ev(hF@7c=b(@}+zH8^M z?c27eC#Oz~jZ$1@&%p!RcJ9o}$y%KC_O!RrV<;y(J197;tEZ1b`%gXfbb5LQ-fc^B zQ$~7PPEHm2<}aK(&z4}!TR^n7Z|6>L zR^No~w{ypKtVZ1KlPAwij7^UWPhP)%Bg*C4xuY~UHwU=lgAYDnrHYD+HO9%zB}edwWwwrts&n3$*x z#8AUtT$WOFub<3&cK!_of6u1&Zk^Z!4YWcT(h4KGtE&%d9g-b@*vV5TFJ3&KmX`9w z6OWZ_DkQ>(&(Yi0-`(4XrOy_B_@P6k+qYtCr>AE8_?1`k^Gj}&SA#2l_j})c>ggu| z6>r|GBBZ=)=kDm3nDFq(-MjbX=jRig#*&bnme3F>dSwN(9w@rPN{AjEFOAZ*#3_*s z5O};j1_jx>XHQ~cf@aaox3#ta>$zO6q0teC%eDW& zLE?>|@qnKw0L&er5ulEzpLzQEuYVnWTyJ0RFMj#U=H_PRlhv-RtH&~sXmL<55bHNy z_{Mi${5H-Jp6I)8znhwx`6qw+S9=dU5|@w+`Wod3iws+AZE5f@p4s`+XU`WEmE5f@ zbF1^*BL$zHk#wW{68U#KcI>j-qTAbhI@-G?r^Z@Zo1m4Eh6lAXB{}PrmwxiZS02yK z$*e-d*Hj~y$0x=Q9z68gtAD(A-+rVjgn8BoUvp%5_~n;h{?7NlQ(RQk-P=Frp4+>7 zcYbEt=wKh8PE1V?j!m=uQ<9Pn?%p0wIC$3k_|wmQ?StQxh?Q z?|tuk&%f~eu3fv(qks^g3%JW;<0C!2tqlzwQKH11)XbY0i6OaLN7k{=wmi$);(PY&1+~JA$j!<5-gmzH=wlD1BqaCs z_9UdG{^3u5x@FsD$~Vrsr@IBp?#|CE$jr(co0xV+$NbSB{t=ezFMjb)SFc=3PD%t4 zYi@1<7-0V&IB+m2F|n(YB#&-%XIFPOGr(>pq5<&!qnBRdp};K$75m9gev+7!)YjgP z7-?*7s;sWUNc!Oqe~6gM&&y3rh=VLNJvrG}-$3ku_*dEW8>QPyzyJLoJn_U6=y>m( zx1oWDE@tPh9aI+}%20N_JjxO4u*Z#$Pd)MY6W{*MH?SChIx4HGzV__1-~ZnCva+)Q z*xq>ajnUCj2Ez*0*47eV=emeN9_l~-qd$K7*{3rzGl?!B4YqFE7VU~@ZEb(-(XV{( zd*27VG1Z`@Y=B9B2uNPI*AM2sJO2jB?%vJq-8{2s_t`mHqyXlyltGXtCng97g1@Dw zr@ipP^E-BI!;k;P&wqaX+7-aK!GV4$GdAmmB96Zk+gjB4g zp0+E>1sb24oci)huYB#pK9F63VrQZ^|B z5*}VqkWWm6dHm?Z58rwBorcB+>(P`Y>vYbZg)8M z?c4wDZ+{0$)W7`88%K{GgSbb54_Hc=Whp7i1Y)bIZcdC(-Q794pJ&5^cQ``ECq{_Q z9zOihsgoqORS%Dhpy;Ni#$sZec!Wub=?++FA;CF0*@QNzUBfF8s3|p-)q_Bto12Hg zB~C(YB{L%nM8xK>3%d$qZEkk3zwgLLM-G4R!F6KN)z$6oZBmm?=+nU@S~%N*ZvnJO zBuPq2Vmw4*IgEXU4fpPQ?;SgSyu7@utGj)Cd=zYqdaqPB;50m8f26&*sCe_1 z&CxL~fDayCk|aw?N*D|;hBq`c2oChEZ+#1Bfrtjm>_&MxnhbT7k&#LGi4Z*-pUscP zMfJiSFy~BLYjF4@WzO~Inl?M%itZiJC@*8~?>U$P>5dwUUdc;}1+6J*=gZE^8&s=p(E z8K4p)`Gi~<9-)1kWsfj#xH^2@s&Dvv0nu+L`1>gdKh?F=Q-$v)b;tC@^O=>I`PgHR zVcP%oU;oXY{^?H-9@;lGJ#p;#v1`|^?%%)num8dPfU%D zjeBQ-vf*~w93~eh$7NRn_#%g)%T*0al9W*M!qCSNn8;AENQ5Jl^V(}H^dB8M zxSu_sP0=LBk8_YX;BZF9C&Z49j!lfaSxtZ<_~AAHjp!Kh3`wL26=P9y0fQ;6FI{Ss zgpPeMZSp_Jd=vVi91}b}J;@-^VO$*x)n>E9b>&Yi`=_7&D%cXzv-?*U}s^Tngg{2Xi(Ze>nCGKT??(r`h8s2VJZdQbmG8(82s*{j+0nb1}!J z-EO>RHm{Rxy6xN8@IU<%`S1Vu`@ets>8G0@A{_Y`v-H(hU;B$c|MO>`c@{qW)btb& z9TqU6f~s_Ye^eLX>EWS)C_=_L@=!fHDqyO|zKl}O5e+~fPv_+;Q#6?Fr zseOapL0UjiaCm6AWXH+u&CX7YkKvx!BI#%h&@c@To~MaohG7x5NSgzt4407WV%}+` zU=kd})J{!F`S!P8Wc!gd@OOXr@Bj6`{@37moT5L%9umwB-g6`zqKK9ry%wX_k z_Y?;B2${9iEx|9uAwfp4M|l$PS|%nZ`Ud*D2-bCXPfQYPL~X0qUZ9>O#d45<3$?ZN z|JVQP|9buP-%L$TOTQ2kh4NMNwnlPS?(wdiL@Vp-Q)r5+XcCoz4aE7v!Xsnj;tL82 z;XQr)F)qh3WD2pja~IBExOAznzn>`P>#zUIKm5Z#R905denpFH1jWQgLmsBSTUU4I z;9x(PYG-$^RHOm3rD)m65RN1At8_T;xf|G3UYH?Q4V<46VqxldZ(~yvt1~n_jCRS& z%A_m=acgoCk?c}74)$emP;`_7g#oxVK0X%X!nkr_-d(?PwXT*jH4V7DB_*4HTlo6O z$S~pgy1H6?dXlLitMdS+XQXZ3x+N+qhFVD@qoW=#fgUjfBgxAT3T6`UUD4d_9j&lg z`9O_HQJJhShN3D^UK1!n;?Q{Zj13T;TWoG_70X~^oV;yg?ZIGxNyD3v!m5Dx;$}5E^UQy22@Sza`_yt%9Oadl|Li-0u;Dm70MVHUdB_zhP)v*Ak z-BU`jAjb?NS!4*dh2Q|=6Fhf3Q7jE!eqDWiM^`6s8d3115LlT1SodIA zcsNQAGhscC6#CC@b{Cx7b}V6L#<-tMZZ3a8T! z%mp>1i`?hH64@?T7&aaP~V1C8$p*#g%Kv)>cK#JJd9KgRk z`G|g~xtFh8g|Bex^l4-k8k(DW|NZyS9|sQ}05QhXA(G2!hK2`)C>OLiGB%DWaPq`S z#4B>JxTugq9KU(vjgOCf)X;$cJ%=iSpN}%DtgJeE>^OAXQ>V||tf@gd;O-;Yw{PE) znVCwJfooSUzy9mj;X*gJw$m^rx3F;EzTIibv0=d^^?Bez;yR?HrX?n)eujOsuCLys z7<^$t>deekLtPWlkKvX>PriQrGRbfFtedxN>+Tx3aN%lIW#!qkr|asgqoSg}_O<75 zsZX84;U-(~>V*sE+dJA09X#~)=bnQS(bm#RLRUq388#N6Qe1NSzCC+pJ=3tjPoFvo z#r@a6UUFAI&lKR7zLw19oYG73}vLBg9ZqV0Oesa_Za`> z%NN_*2kf@^+`OW((V?)=x!t=Q=VjhQ@p?AXbZrvdZ7{&iw@J0OA( zQvj6Oy>lm?I;yRsv*UV2WlLKdc4vBOQd~?_L}=(B_HJuiVsZ)v2Cm;IC#uc!9v2fm zJTw4q!5T3SWjD&f17NhEu;I@`R^UG@Dw2B8{Xhat5%w#dHwJNBTztucl zAE`#Wx3u;3jpXE@t>Zu-^7C>sGLx~BIC6Ms2vQ!&7eI7qcj9XoE@H)>KXT*0U8vdxQK|F#$K=`M^4@^Bse_%-#vv^$()`NS{ zhJt^<)+QkND-a~&ZSW;i(p(D91qTs4PD@LY(h<^$WYO-hMaM*;>hNZOnK1B6OLuQ7 z*-GYja&jyHDd8ooU-;fQPjG|N(o?DOg6g7>R!(*X;>Hyf6CD)`I~U!rRcxtDAz5dp z&f^2gvoo-Q)bo?_CU_*kxeS{=C^Q2N4MnI?qKkjgpwzv>+lHbHq7IP|B$ixQ0-Sqx z?~aX)2A-2pqAhX|`BhN?-M65q2sMp;0B`8PzP&q2OYvinUpOlq32_PSzGFuzHiQ)Z z6ig4mISPVz77Y2sq^!)0l9D34BTO$`4qOQ0p{|&i&D*x^JM_@z&BcxgDK6}aa)Kq` z!fxHVJv`EJulM3TQt+EM=TN4NYOT=g^7A)C5y!^L%uFsSDrBk)3W^&W$+YSutspMe zm64IMXYW2}WnjXHV5Su5jJr>`^qb%OR&H)4E~7otHZ;(Wo12!Jvb}W2zK0&!x^=V5 zVFRa{njD8aU$ABSuHAcgm2S^YPl}0lNTucoM|5<;j?(Q3iP002!_;6&PR-b~xpdF2 z-P^Woc0@v_n8$(d>m9y)wE}|uBac10W7iIx@>%a32^VB)?c0Cgv9Ek3B`t~2IYDTt zVkAvvf{TiaU|$pbraUy^2C7YL-L_}fu0xwkwnaH3VdxhYW>5qY8o``5lsx~w-jM?b z_V3%b)9E7C5SEgh344Qx7-jx)bMpxylVZ1N)7G5aT=pr+@$>UiQ85dWSau%UfP?23 zyx7&GsuIX&OR#&P2t51vedqK`{IZP!E zz}M&a|37>G9UkYkrT2o!IY$B@zyRi)b5xd&ay&V8+kM?`_t@8M&&)H|*FDeNXYBdI z&)B}6?)HqYyWM^AQJ^R)k`yU1XA&eq5FiqfbIt`|e(%~*gr^Ygf>#Caz`}*|QCbi( zxY3d&%hs)9qC2v(a}$#imn~nCm>5IRU(5-3-+4lrERsF$o{Y>4t0jfe!h_5KxyV?V zl`{+CGCWnBWK@w+3=cR*jUjwexwR1yJkcbt@_?WmaH7(KzY*5$V5!iS&#Pw0E{*2*eOa(Wmh6c;ZeY!($M2!9N}_ z3kr*fj*i3HPqG-kPMlNS-R)SU5))Ix!(!XpyOE~J8^&>uJizmVgpM83g4cY$gZp9M zd%YMw8mXL@N_kUKL!owbfCYyYsx!*S@pN`}bn%-5@U-C*MG=vubd;<)^+Hp%HOiyL zL<7a=&z<}0zxl75Hg9_1(Z@zrG&Bq^BSG4T49E%?1~5osnS_f$C98@$j_(tr2uE^r z%%BO$sj9I)K1MNAJhai_A%lJ0oo%hqGdeCIGCnCRHX%APEMl}TDs(g?BJ8c#UO#mB zG2=hYp4!f@bVMEEO>G0V|Y&!D4P`E8@cxZq+Zd{WZY6Nok_hF(O&CJL`DFk$>80Hzn08Ut< zB9Ew~)Y;WKIM~CDqM~9F;zw3C7Qqt4L5;8*~V?#zpBS(8v z;v@R{yXc@47L}Y59~TnV-_g_9+cy-SkQo`B7CIJ|iXS9;Fm$YEe5C)(nQL$EKRmB+ z#iLI?mY$W)LiKj_c6W3U_LZ2JY}HIX{D!Jn>G56RyG z(NT$Xql*e321!T9x+$;M)iM0r-@aW`R7Hru_8ptTB1TAxBe5ejHF0dLzq_Xq3X@;w z8II&}BV7<84-U0?M!VV0@o_0pktvZ8sG-Q3p4iwZ)mH0MNT4v@GZq&g&(;OT6u8)> z{fxNJoKIAJRwl=EW7UX0` zhK>&Pc9&f*`Rl*>n+=<`KK$fUP@AxS04|HvlChDN<|eC0tMro?;zbh@%sbx0&QY{P zbTq{wFw(G}SSjdcPMJPp4p5Fc2634fx542d8OeLP5hjQTR)!8N1&J7MT2$08fBl=w zmy4c%@ug+URucCE&C$6D0gj9q>+ERm>TajDPjX5+efwf!<2yTvPwdahh4ON&!=UgD zsBDxy>G;_3ixFOjrNnv}OFl#RP<sK3AYhIn-oqX#J*v5hKFXi8HKPtT4P=Qqmo7^aDtl&pyWH6o?w=h$ z1>hAyWP}sOV|`S;ZdIzZusc;O9UYI3i$=F+vYZM{;5Y=T2?GRF2*>c=!uZRTSbJ92rxbSQJfV z6mlz%v6&xLc&@cqUExCH_^qF({1@l*}T?<>}g~t}ni(n&| zDSVM|q)5O%GHQ_WpJX@0M8MtD21fO?Rj3?qW&gl%QgRBm48{dN<;18+8hB89KLXLG zyQ>3@5PazG?nOk9IcFH5EfQZO#pCEdK!3Z)$aob|9~ve4g6iGGoGEY#IYi}SqYw@O z;E2dD6Z;5}Q%DmK0uxnFQl>iYId|?Ph2FMq+l{u(xmaK0$?OlMLSMyu@4rui`}5B} zOW7aQBp(YQMtPwxTh8AH{+*jUIAcH+c^s_K?)+qO#)4?z*9zC9sh!=qz;Q86Q&!c!F!l|+ju z9yB@^hDQvAhS4B^kT)XZ;tDI*$R{*fNM~<4xWHxMK$MPG2_Zg#Z_aQ7rxbiiy)AI zD3~xx*{fx(ismCzQ!H4u_C=ioCJj{qX>CVB??$PO7)u%p@tQn*ymfbaJ&w%82 zLUP~(s^O!O;T{Ebb2tU~lUVpg>{85UQ!GVzRAEsR>Hi9JKf{=%4^&GvSCq z!krm}YnLZgg{6*S^-cEi)-06f$J{OULTQIq-V5zV?bOuJR8AuLxQtl+06q*&NJt^3 zDK~ExrIyg$85+_jI~2KwNOF9igp6coWiSIVX1el(g{7sZk=d1-my6?>%kVK)amM3f zo}zK;9UMo0O_`Ek)H4FchH*h{CJFn?bHf?KS9aiI7T*hscyj=kCaU!-IWz zZ+JM^#h9+r(z8<1(rCNFDp+&gP_T%#fxKw?7Kf!V`isEp5%U#SuyqfO2*cpb=F($< z63?n&Lc^eM4rA`s7HD zN3K>A1S$9Y;z-S8NV2TT>03ywnn;-nFA{wHGv$IB{QZPgfny0&<+Vy`CSlzw=`qDq z1ovmthEjnWSCmRL@PI`q*8@Jqex{=WarbIbg-t#Rr0<7+lRRo2sKgG)QAS)=n=k8+ z4&OmQ#(FOeUcDX!LdH)iJo;Yn(i#{(KMbCf4y-1z}b#c=5d0vCW3(KHH^){BiAtW`y8 z<=AjFH8(?R0=uzhQo9C%MZ;{wiATmfgMbsf9cT#W$nY3WAL;8!h@-4ttmv+mCqog) zUNVO&SBLdg7%#b1s!be%P+|?(6@;OJ28=+-%qAJil^Euh zVI+JRd@6klG$jcbjnTSkD8|AwhJFe2MVKI-ACCrHo4K%0#8Xkaup5ipb15by;Ys4A zV3iCC%Vy#?Q5!d(3Tnu99%u7w% zP(Wz_13n>0jgKL&hQ!b-0d=e=E_4iNRSVnL3E^mMi2kBCdizz=WDT`;$X z^7J6gpd{1XFJx>4Z9im;-se0!G?p(Te9NFH`96Th8RNIQ4K$6wQBnn}PKxSh9MiQFNJ_#YV-Xy{ywu_s& zYbC^2uC_SN8ujQYjgR=O2k*2d@7lO}2uuex)kb(AyE|1cs6@+yDE-yt zusZckrzpA0GC{={jQ={8ci(LH$p(7q8P@-s(eqrIdaXFvh;Y1dw9r5q#d*n>JkH>U zb)^KjWx@wF!0AZr>DKg&PkHFc1>zIyyDJut!o)i?8?MjgksjcB)yQeI=g3FkI8_fV9WSU428hUzJ31@5^wyprqSVR8M_^n%%{Q5H+UM9@o6 z#sF*>6!-|I2Ub}TgfuZ{F-6D6BVAuFQ}raG!4sY0E|aG06Y748BSzhCwI!@#zo}{{ zO(ye!B_bkl#{J2V5^Sg~nR=9(g+pgqi!S{G(FH*&ilPs#Z=no7v}ChD0S@C7wSa*r z>RV{jVqV*?9$*=_O&+nt?_VC;<(am6z{RS%t=|Dh{F4e1mp1m*W$TaeKi3 zvhoI!jjY@hgOd>Hx~myI5sYLj;v=VOGdF!M;;Z$^rA4zx!@ z>n_X9*ZmdL;P2NJoTS0)fi)S~X#?hWm;ITiK%%!;v&^=7rr~`OOpQ;O&M(dfYv37S za{~aTmPlc>Ht@PKEJ+7zTT9%QVoP6CdyG~4DcZ6A`^I1;CNe2YRns-y!pI~~hO1V4 zwW#RO!GqXKUwrB1F?!%EDrf?plv>`fF_Tr7iIVwp@R(SJmsyZ9C7H9R0P)om1G~m&wm`HN3SsHqc z;{-P&rI;6Ni1VmV0{Wr4q3mG-HDfMug<3`#AI<&)ikXdFNtb4p6cdy!+A<-{4Ztsu z&#`HTaB_AS!a)tIg68X|DZNK%1k1)nYTdqNR~nLJ8H$mEvk**>qEPs_rY>S^S30Oz ztx2V)NgCZRc;`?6UuO#`0TkaPhoD^8j*XAzm=z$9A^!wFWU@V*`*8L%Xf&&v5pF?H;qT8~9;|69k$Z zY*LIY=jOi`xN;CB_Cy(zK@{AmJa$o58$;rS3SyYVkNjkLv$ksF`Ex~{CO8tG%BX1K zv-x@?^k}b{^NZgmyy;v<;>?7E2O%;EQ}qBqZv?yW!T!N0Rp^NlVPhg?kR<$wFxa@5 zz5$i!K%Q{MIr*xP#GRn(HV*=gwmudM?QIJekSM7=rNMZ01FAJhNH)ua?rN**L^@ee z*fu7#-8U@nvx8I+;6FRfZgPAb^Rx`mf;joC#d)(1}BIJ)guXvC($tWE<7QklfXr2xnI^pMd*N0*3`2 z*qyY!&66P{VuRbEle8{32T3Uo_|3*5(^WB{&0mm`iZ@ui(z|AldH<)D1^RJ+v=2K4hkKDh3{CBr|S>%wU0pECx zZvG{h7^;!YcX99Cw4`QPoc!`e7`VB+8Tns<$C}YY1Jnw;tGgEjap?X{cm+-LU#nGg zT*J33y{tq#(*0QZS$*r>*itl%51XQk@Lz4NVc$+Km zXmQ>s6qMSae+;$I=ggbi+S>lnM;}wegj(^G&L+!{&|->?QK}661Ja?IE>$RS9NsUnxs|j9n#}MFOSJZee}RnHzg4DkNOu*xqN(iOE4ZEFzlWD8`!>}C ziuloMvH;=Os6!NSY8$BkCt%-B;AP-W_wGH}0sNEn0h3*JVs>6sHdMEZO-#@U0RcDG zc)T>5IM_=}`)-05ejv3+X$GP>`WU$s+Bh*mBb8e%`*HB^E-yMbi}=LAyw~?XwElZJ zf_R@<-#l#U-j{EEY@0Y)VdAifW4wp?>Fb8)z52w{?Hysj3l}ef+}Mpt1gGTZtFQk4 z%{TV}{K)fk-y$lCI)MA%eCwUJ-#u~s1Z}FLA|ff5QCU&>`fIO!{PD-9PEz{2p9J3n z2M$m;49S2Vm)L`;dB-OQ4<0;u`ZPsH=_6wiV-e;9#)=&_*wc^w;FrJnH6`!p%}s?3 zQiM;RKK16leboD;&N+}zn^cPKQJIHeY_f-5d+m+4_P<5XK{}_ltllM`T3^PqW!vxQ~Mlyw>PqryDc+?E!tPQqF3$n9_2mP@mBw~@ox#c zh?m9NyGa`^012ED?jMGiefw|Xv}75kygSl6YBx~tP~FC!_;W(!(5-#n22RWme(sG7 z{o1_? z0{qu%$$XpA`J9Y>x+mQGd^(Qg-e=zby9WM<^% zZ-E882wCFECSgpL&``RS^i!=GFDy!XXIC#3&TDJys5D2uHNB^Aa2hn}FOyYqQJEl-GtkBX*uCpGPHf6|t_^kykNY)IOsJUHz*o}td>#*dC2KX?8jjY>nqm3oW8o-%e=@1}90gI8W~JIx(5nFCsce85M(w-dG_w`sjs2pG@A{`Em) zz-0o=uy(GSrf&!~exGvZ9g;@qKAVgL69by~&VPig-1@^i1+O5XOF1X*q(^MZ+-0i8(;G_KngnOb0BU-&P+;ZLi@y@X~G;{@*?>;YjC`%%&aSP*9c+-wx4^}9a+TZM-c9QjgC>^Q zJ1*k}etFT|E8s4Zo{cGt(JL6)J^U*&brru(e+L2n>$F-kjCJw@Hst{C#tuXRcZBgk z@AG4QRvi9&U;alT@WHT$>VCp|FO%?3P7OVXW>eI<3#J_>sv66ALw!?AOWUF)OQ=QJ z($Y%2(hJW&w|UFP3+K;KZ=ALKi|52$K3hzDLksSR7Aaz zp*1vc{c6##e*Iejd)3-?3l=SI>+CEkEzQo%pz^u;f6(N-md3x;H00R3cP}=B-~IOY zl~vUnHg2YXc6(?0_2TP9?^8Y9vLRRmuL|Y-)PX?e7B>K-{mVU>t2*@aZJr5T-@iS~ zay@|=PC1_b3cQFzcRxZ*K*h9uGt-ss^c;E-!Vd}l-oU4FV(z|Wos7p*F5-}EQh0&8(Zoom z3PBSq?jO>O1M`3A<02EgW6JS?e}2NcPe04MMW?Rh1U-Dx-UQbQ+ zYf#8*Zr2dLMy2lDoc!f0R%K=7fckXtI(_==kq?hvzET8)6FP?lktRI{-#_#&Ci)X6 zN=r+DUNWw-va={>y=3VUYIIYV17&*IvgI2#Y>cH8Nmw{00gUSO$SS#UgK%g{XCoiL zS=CG4D#?(84uI2M_Vnq~@4f%th4bfYZ`Yt&(eZlQ)@=m^b6$V_jl+izQ~qq(vSlC_ z?bPVEedNf8co2$;in==SDNtruxmKohx$t#oaJO~-1YEfjQ}bi_1Y!jo>V+U5^P3Uf z{fAFs;!_9nNjvegKN5EulAm7(GVZ|11`hj9@H2JDGt+3&;AcD}@Cg3_pL*mJy#Iuo z2VV1TNI7L`CZ_4zMN{tesY~a$$eqyiPUM}DEK{jDc|QJ;`({NNaoL6Q7Y`mj($UqKUobl} zGf6e@sm>M_QeRg?SI|X^mu%j;yj$+_7Wrnl))@sh9^UE6PutI1Z=WyLS&g zgeuA_FJHbw>x*qN1{5MjY}>MxgEKSJN$p{>z8q*vrw$An`-zi5MyN#^j7ENesY@JoAv&d-Q}C~sD8_q z?tYkV5a92JRk-J4_$F};AHZ9XwF|Vi-ZNHdj=yMj(caP1*4~wxoFPg z-_hQ7>sBd0^qelfagEZMadGj@%}wgxaN-~2W8J~ysg6CWF0eY>Wz z`gVC$^~Fn9ic4-1#7B7$I(F~d_d3$U^Upn-m6dh*$`umla%SaV(l5Dj^G3W!gFpcWmjLY86S4Gk?NH*XcpnM)iT`Rgdn0OTW&Je;4GcmDiYV(Ck6 z-e_)W#0I`}*)r7VTV-XJE?uC*Chup@&R@QK88&$Yg87B>aX5B#c9P+Ss!cV(?yhbc zNyo*+0>cOitu1Z2`T2Vvd~n(FrS!){R-nbo>Xpk13g=~KWY*O;Uc7we`i&A`o1U8l z@zIX6w6tX1y0s7N-HUOaK!N7w7ToZQmn`Y->N0s{9Rtb{O^7Lhg1@+s4P!POdx2ELYp-;)opDp zq{mU=5)fUqXd%9KEad3cX{l++DXA3PPD)OsVjWdzh^?dc7TIy6%g@T5g^9kdu0Aa} zjjCbwb#>icJyf&K%*&mXN6*b@`o{P6bcKu!#YBW8Ct-e%uBfi9Z)zJJrGtyAXf0c^ z7|Eoqt$F^uIh4YsYAD6?+uGYndFQ_Mb&a>mD=C6Yn_v2o7v$&9%B35dFMG(rq-&<1QoL6W8)Ik z`g4o}=$bO397Jnv1@{d1S#+>q(BhhKhL5E0siw)@3Wpe zMT0kGULbGwYW38i37Z<5N{crgH!u$Jr@$svVoH~=yl0`k===80|L3CD$icm*8 zI?y0U`09L2%4QA%{Ab-t!SjL?_-0ce2=Je0eS-l1d8qeU&z)|fcLsZlJ_8GB!JG@8nc-m+Uj)wFO^wazrpM6SlTz{9W^c1t}8yJdD zOpS_781m>e_2G3@Y#A;le)?q7rkc)}gF|$q!D2vzI7-yV#zylVO9K)~Ts*zZy+m`W zyqn;+J-=CwpizjYI zfVT#Eyy*4@VuGA%8c84V*jO634GaxOMn#23(j?T{$*Rdc7Wk0C0h+#e5)$J9dvM)# z0UsC`#N$q-8t~qlX@*2bM$wv@-qjo+V5ax3T5E@M5~XZL28XF-%dI^_3iZSPKW4D4 z{-ZJy420`Ft=z{(Xd*Wj#^~q^^o&yVnJWK=X}18%4G zbiLiQm5Ymy@iyl0wJ-Db!U`;87gXi%V*3OS2~yzOLxE2Rcwc{q37Sm6*(cITHqVKw zhzfz4sG#nY4qwDjz-6Wj4*oB{H172Y_ncvb0uiShPT;$1Gpqsn^{K!KetsyOE-N{* z%tVtwlk&TSU0hCD!W8Yj}68x-dg0G@MA8lb(mhf=j9#JgTquAwz@0R6(% z_B&Mnl%3}Z8L*zRxCo*+pOpMD&tP8|SxYhtNP0c(ij<~3oozr%KzncDuvz0=;DzVoNZ=>8M$ z+kNtR_gV1#AO*hm6bJzLX^PPl1Tf}ekTUVb9TjuywW}W)PSx{35NQ5Rr*XimtS$6} z#>)YgzU*z+FokXS8z1^8KGB)V4@h@`b~7F_9TC-hMWctY@`|A9shhS6oZ}cJ;))p& zSLJP`sfaE5J#&n!9x7eZCg|t6UYUq*`QfW+ivBpAy?rP<+imK|-Sm7F z%0FduPM`K<>IDAvsZ9KCrHVU@=~J&Cc-~9^udQZL^wv066x5&AY{L@ftRSzyL%9#V z)WpoSem1lOsd|2DfjzwGuiE{%UH z@yxjt1UF)%jM@L~tu8(x3%DD)+j%>Nc{#$TY_;ImK?(#Z@Rd-&2k?HT86dfjI_412 zKT%#sFWmT1$5?>FlyR{Qi#Jk8vthhAlVb={a1^?10mLDZf-7fK_3|16KjEC=pZm(o zUi`|jm$l4Hsp)-uXJl>D7@~C-40u_k6lGhPD5CyIR#3#D>^Q7`+yhI8$1+qxq7@Y- zM#}6girQ5dNI?F26m4IHSWw*OjzCk9@~5Aait{4^|| znV=IR`gAYvR2qKr6&*3%bOXeoPd&*UFdg8XOy#GMLn&{=X(OA1c1Oa1=4q2`NIn~Y zT}VcNfca0{RB?FD z`f$4JeFxf!E|Ye=OFHnwx!20(IuF@gyo+MgP}HFrGu-Dcr@&ik$4xkxh<}%xHh5T& z0$&9MJ{{nlqTm>)u-7pw$37i?yM`r>^%$eDgeCh zp42gds|m3pP#V4m=S6WNTFNibU~wf=$_Fa$o%k{r2N)&~Ri6j2>G<%uZ}h1b2oS*BviX@emO7iwViV6dzp28;uW}?{3`UMwetCt>`4E7 zoJJe484cTI(Ko@6T_S|Uwm*YIYZ|(L=IPsTyi%?qukAG#<>Gzg-GP&CG2>2f;63qd zIrCJY?VVljeP$7h!f+FW6Hee&-zT2IFK<0RGns-X1}PAvz$6OX5#T4w{f;I2!P*bE z#t4w{6|oG=S-BA<8OsDM_G9Ku_eM-m&e17ash>?uhKNc0*p2uP$F1pS%y12-#dxci z`>Y5iuh`VcyArya?xM1%=0>&H0mJ}Z4wSbHX1layPTg^fIs3&F%6gB!8_{Q``Ira6 z_v6*XJ`1hB;O8QM``ZR^>p2q${oyzEOG-X@Nt?X?xF_92Aa9p6mmZdW!#Uxl;-Uiedv}aqJ#j8he^X2! z8+DLj%+7mLH_toqM`L1+c}+gdO()PuuJ8ej^jzKIr?@+j&laPF<|gfqFm1Y+m|>nj z`IvVhp0H5rqBsy>elhZ@J9mU{Nd6&AtcbpHcjsu|p);81r_C+!T2oZ1K#|E^-fyD! zqt{d${)9d^d2F9ZQg`T-S^3w+2fC9Ek`+WW^HRx{&`5AWnOe+}tEJ%SM1-={#_%wJg9`kJDQxw{H zeRp0#-57`7TPPXFxS(+-^}`FK)=I!1^-xM|ba-%-z+v8xdYs+f)Kt94F*8sz@;kHs9fewoP)Lj?7V5tHv# zh;(b=U8rT$N2X<@Wh1SU?b|2{`&hUL=+tB;+L5SZeZbo?3$o{LdV(i7_A0}h6jh`g;#)vZ$$1eCp>uP8i;wi zgzXbQF}>87Fds~rngyR4{+k#|@V+*yxyX5<$U>`kD3 z-tO)KX2>V>P-BPeL01pJf(d2GQrREB3h!3We_e97Yx~9u&o#uXYZ{2UMv*BT zr#F}i;ssJ4FgS(7`3{V^c|Dhmk;!>RD1oASCa!>q<9*VKKwfhz;C|F(J>)HWZr9bG zzkI2Gcxe8DC5sm?%}7m=+B3?5qmk%x5sb!{?M72_#p8LorIPDBN~Ur+4>$H;AqXWc zn_z`7yco+a8s73YQL9_j8JGvbM$ zC|(G8>VwU#?QI>MscC7mva?l|j(T~{lEsq~N*Jcd?hFLBt;R%o{%o;K82 zSY(7YE9G_B>JVU<6UVi~Rk&AMLInVAf%%W)`v>~l+S>d2dNVV#(o$1N(099wDUvt3^puKsC=AWOM>RD) zFek@ZTU*;&TH1N2qavbs_?sG<4jg!={8mM0SJ&CoXXv3hH-8Sy7ZkOCHL<(?{-Hq% zdPh@JjO1Wo&O;p!u+W^{#IM1J_+*eWU*qG{5gDnuUEkc;8WR%-N8?YJQD0Agds{oq zsHdx^wXK~ZBn*H*8S2pRkeHl#`mMI8!uk1-yK^qJNQo9wyD`AkG*@b&P>hVZ^!E?Y zhnrd=R54>bAg-}y0jE$8bRO}vw6y;Iwby?4>Z@0;T@R0l%FN25%NJG1IFUmlBg02W zhFY2%%S%fe>+0wv*45G7Sl`^#RNvp%!%aOS6dR8MdQ=20JiMRs=tI4*SwL}MfPsaA zAQ6$#2DIapI%h~!J*V9n{~{wI(WS6_Fgfa@TPFS(jY?tZT!u+7NGhN)FRna1GSt-6 z$g+V1Oi<)CQUW^kFK0#+aRYz{`Uk9~N;pdZ#}=(eJSwhE#kDb|ck^*?Uq8$m0mx

    >}85hOI417=J=XXbplgATGswlVDWu zoqIv-f&Ttc>I;mHazIySS6^R$RAdZ?(ZkKqTfpdq4Av1b!Z0+HOZN2-uu9ORwY41@ z@|7STp~sRI5jRcR2&bkEGZn6fs+=w8#7-Vz^#L~aRah8xY`7_i$Q-$dl;yGU-rgQd zb`N7~N;HuOGS=DA$@_@NsB6X7-`KaGojQO1e5k}|xw2)J$xMLa>&o0RW^HTj^%2R6 zqvJdR%B~Cx<1;A39NECEi#={;tLGF*C`EZ}V4#n~z*8O>hRPJ6l9lO0I+RGn2I%YK zf~?CJm+J29>geceT6vKR!mU`kYz0TwisB7`nulF_z!SFAN6CP^jN4f=jND3^(B{@LLgr zY&S@OAO-Fr1*QVL&v@rF2xsuq(+RpukAXdShOLdq7;UP5_3PihvF}Z|>g)1HpFe*d(YJ$x{dCTNJMf!x9~~ zqZO}fda!u=(T_gj% zx$)K(9S@IG`4Q85;D)9?npy&Da_Ge;5*I8!7%?R-j`C%(uz0Q(9~)<-zfp3KGT@j4 zf;7+AZ+`pRGiT23+Oy}WXP;TMW=&~n*|nl;i3v&BSy=+d;laAP+poXz+Uu{s{^8*d z_w9S@jW^yrc@ z5L1V`j36~cNHc~7M@7X*f*AtnK?1&_j~Q4p3KNfsje%BNoN;pQ?c3GwzyE$)Tifi} zd5A0=5E)HhGW9WGEtwaX%2mXKO{<38GjU{yXccpnie}~8zz?Z+NC|i$hDS#Fdi(fO z0H8`PYJ4JgFKG!)RD_L=rucfa>E*I{7!4Uyq#`gu@rZD62s&{95KiG(TWGy_!x6nb zy*fG~vZJ%(%$YOnuIyQ})Lo78>;Q?G7nr827_XACQb|MT)Pjr!A{7-~Ie738b19rZ zpGB7gg$zgSV5}zNh-?Nqm@quLkcK@50Ro` zs6=bFB3Xq9;nVw#?Q%0A&aD1QES7Gq1rmFRsVFw|A`Nze_b4NzyuEvb{lf9y? zM}6I~kYmS=m6eq(UAmM9FfvLHjx&n5j&}S=bQsp7#71M4tuByDCbUP+D()E{xrbaW zc&i`Fv@cz%)YmuW7Zj{qv6ACqulx7!KX~w9T3Y)04I60SotB=Cjg+f( zw0HFMbi?n2F=62V0IaREy|cfs4+vzc=!Ly~^Z^-wH^s)p0$MO5cy3>xpbI>MMaIX) zMMp;gczixQhRXzzrZQ{|im1n-%wlx)uk`WuJE#K!Uol2b3_>*|(XsqUo=6EnmBYAw{T z4~2zbZFg4}!~v7Qn4X>yV-_SMY}4@p18ad9#rW07y0))L?2X4KJ3sqoWH02uRGH5sHL` zAyA$@b0#h>4jghSCYByVH^WqEy^I05O4bYJ>=})TmU*D1xdnXE0hZ#;m_SQRB8(h* zbH}*Y7#h zrAwFLk4u*?X}n5d+)syCr-dXf%fX^>dTiepFVRM6Z))d_;1fU z@4WNooBNNSIF7(EJD;n?H#Ie#IDYcbp~J`}^>q#L@d@c^8BLAN`}XaB=bd-C6FhqE z+<6!$~q9eD&3R$4{I@_nbF>E@q6|w=0euJ#yf!w~rh-e)DE! zOiV&%b`CAhKKl6Rks}|TKY!lA BAK0I;+Ak3d#5E&VB_3E{^-+t%Np@WPNW}BIr zNqbYK43Yv82M-lvLC*WRZ8@d;jd2vki@nkb-__uGbpFK<@;Q&Ye5= z>tFwhk(@h!4$V6!Hy4E1|JHtVL1+j*FIl_<#5;EU_~Ao`&Y!m>b2$#9+Sxf!^G=@1u`DYHVy|^_d`Blxw1DL&Nrt_RQ=oBq1rOQP@a^ zkuT6d&z?E=%U}NT=+UDXV`k0DPEAiQD=$YQuc@m$cKpQq?|*Q!q?F?GSs9rWipRk| zIMCPI(|zjX$+zErn|<5a)zjSCR@cx3h*nfqoIZWJ=d-2B0_~e^rfY@n9ggjy>aDA5fVmbhE@|8cDbk6W6qvA zedWrP^XJbY*YYRdvaGD##ful&sAtcfExvvoXL&(E0Rk4r8!q0}-QCsEg$Q0*QOUN1 zO3aa4v(_mo$u%{#6%`e!si{ayXV0B`gmqTZ@&4~_3Opy>FEeS@4fpjy{p?l z5wzjhTTqq1_iR3R$8ReI0s-C|NoDA63Ej@LW(tKx%_vzMfFJV=R92KuHmfw#)`WX1Hskx25 z04nA0P^=fl- zGu#|S5DBCFRykOLhQ&zG8Z$D|0YVwXqhmcIW0$X7Lswh2bXnnoytvr#TVU2_)D0A)V^>^QW zx3Z$@c1>+$_xeHPdcAAnB=vf7dbJWe7rOu%XgbfYG*#;H>$ zSu_H=foFCjSXEI`+1l3D(9nRT0mMRUJb&TBjT^|(2Te#!I&zx)LY0rgl`gkyFfD~QDfS+=O?8YYvLRyI}l+_`fAY)E(M(nSmqm`MoZICt($ zaw4&=DR@1O9Y28^W}f>rpWrD z?fhoJZ!4<}&O1nfdryJM8oaA?;jMS!m9$;O7q1fy6FrvN(SeeZ;+thK zZNu%F>V*pzVD`LOdJC9O&&+^NrKY4^x_s%{wW~X}Z+YdF?=M}ts3$FusRmz94?hI9H8j>^ z4nYOP9`N&@{}ECJmY6wn3Lkv%VJK2rRfW)iX#osaw{9JG?d>;M)KS(;M>iQg=}2|t@VcW!1@CisCop=O=q#Fmd? zki`55ejGV+1gKcJXkkoDv`crxzKoR~O&u@(^UpmG#?PAvdn|q?^1t()r*`bvwq@(KsSKQb&FtrwfQ zBL%uLY`vtU1Wojvci+L%fbhYPkc3dmFJHO(?z?C{2jQx?70{Ros!C5!S-Nc5?%jKU zTLPGw*QSjdQ<78Au;b$50Uj7Gfl>43&P51FO-+xCAi51&5px%jotafQZ~pqV>y|89 zOc+5=SJ#FO8^MO1J9o^VKezbCb$+nuvhC%>ZE0mN407krom;nT1FszOp?;H`?l=}ThJdc06z$}AQS@bmJGTH$K{5ujWXWO^94oF} zz52oX@4xldTc)Nr;~r+a;++S2dV4y1x;xjcUGu~5e}CtmJ;-zQ4fUwptl;eYf>o>?)I@|ltG0gK`t94dAtAAma3uiJtj?lEi&@9*+qNN2;ibZHLsUmx zY}`{%KfP(wCVUWNz+zEgS98G1l`Dz%;K_aQr5FF~pZ(c}4eK4c`w-owa0XPKa9=t1 zeDD>dK#&4oCIvnP;9ao}dC@E)nLojm=C+RV%9;z8i~isL=|BE2|K|Vp=9{lyxpEn{ zi)QS?q&Y<$*38ULm@XVgIpGS>8^bsWtIf}!(?2kLqqq!^L%rzf#+-|XH56P(Oo$_< ziO`~maI%fVv0K6x*Q{NGJrh>GXyJm~oLOycEiUAW-wHFf2yh&|RyRA0s4&14kU-7F zsOu_qz|ruO#}aL4CG=pp>1pZT`~LU;`Tyyk!vX)xfB7%};XnKbrhsYGp%FBXiHk$F zAgTzo#uEv{wHR`;_y~*Zz-It*Nz{-tJH!H%6nYJb2oZO+Ys^rI#G?V?r`)+~`|dqE zAK1I+XFvVvAN|oEbMg1yJ$UByMG#`oo;_<;uTD!%=3>O_seV9o3@R^B?OXr!Pycksj-BT(od2u8{;Pd&zS-E=LcCgUAGw8`5#86*Lnu^xYil<_Qe$IT znVBnAELVJc$QWj7=s+YOL3ykQ250Q;Xk9qwQ6E`qa0S0OBZq_IG&a^u7QRCN;N~vg zkYIi0gEu`fA(2x6SC$wrby9L7BjtNwDK?g1%0vRWP}<_-2^uHro4_vR;Kj$2q7{Ms z1KzW~v$Bzt@)hJCs#rYM8kx_vTE|DjPQW$*DI_or4dHqD?QegFFBwgA!^RD3*R9RT z&B6adxCRbu#l&05VD=v~0=9ST+=*=T-S2(xFaF{$kdQ2rJY;BuNWd;aGYjVAN3wjx z{lzH86R`RNX-wMjUQBbwm3#Od~J7^wPF%Tfg_cSAP7XAF(z5_4KJT5EePf zzvSad#NeX&olrl2?<;*4UZh+k}7{1uoV*zH!eBAE%cw6*dO z5$_^DI;oqZqXdnTCxWxb0w6@>Et@y}`JesSQ%`>9M)CE({;R*<_r|{K*RDgx1q&7w z78W8~sJwxz`(uSGoF{&&1|J0YFO#hYuN|a-qrfKuyp?2820OJl6yMI{N*S8S+YRj% zwar<%1+#Kzk(;w}#nQt0bBZosBCw8Ql*2vH4}-=BOoAN7d`y&>^=fOYaWbZ+#b;&! zTN%xb9VI1|WEJJ)*B_rF_3e$KzXot!aGWC}ui7*-- z98=tuTF#JIO%yR9Tnt^6_(&Hg41aVia&$aAAvtNo=C#ki_?_opdgg_fUfi>H50PG{ zPhU(<%KWGQ#h1SO-S1*L z!k1)(R5cr(ILOFic}7TRB$tw050XM~QH_zl@#K?Faq*X5ewh=I5y5FBS6+Bt5OeW> zu+NG4z?Q&v#ioTd2sb|u%d%z5$V0&zf3vi-w!RJ{97UYSFqt!NUP5wmXLpx2p2_r_ zxOnm6?>zo^OmyV?@4kKG>XojxmW;HNCmws`;fEdsx3Q*R6+lMk`6B#~00q^VaD2tt z5wkODypd}$Pz5=HO7Pk_5j1!P9hpQ2+TvB={CCeo_0sd?9~JwN!t z_xA4DgI60Khm((Dc9`ujh6C*=*+l&Si`ZG~>S}=b^B2ycj;~#_Zu6EcXpl#a9ED%6 zTDf}ls@3=%FJFNNkyo}HtVLI_O0;2Duay)Rmn>hlZ0XV^*d8(AW@TlN zB@6QNQBsj1h({xs87{+zb+vVR2{)RF{95p^;3wrM)^co(tXz`*2g$wxb(BVUb zya9|Tg8BKgVZnG7VEtT!DCOF^+Qo~PY~Qg1>-Xu?r-&I`zhOP`bm*fPGp}B~%3VM@ zluq=ap}_&vTfmP9EFy~g`g<8S?s<4LPFVs5iM=N;tD&ipXg6R9K1j?RQV5pc>(`0P zzCplRd^|83Nt{3WAMt2Rsjl| z*KgmhT(qbVw{K%(U0Zt#v1r)Ukpbh#9QlJ6L3zZKSy`KLf)I)Dz=coP`KC=9p(oMf1V%6`V!uH+Y~4t5O)X7?4lqI@ zK2lPXm9;O=@E8Li-lDp?f-4kVy-vg&Q4T1ajSbBU7c87JclPj5|K&>;>S}5TF3HQy zWmVYxRBLE!>$-ZixVEkacLTIVIVM1UZb1Q(Uw2n0`&@c+ULM$qvz!P!geL?+R*Df4 z>2~tO2?FJ?g%C%AtBCzpU3I&WebCZE&PY{tRZnkEVqyYfB|jK~w;P$M8O9PCm(*JS>=eR<2l{ zk)Dp%gH2e;UMjj$UVaNPPSJd!A-GtGy!-v{e@`4M2{p`%N7!lbGyC1|LBQReZvCZk z(%^-I6u1v5a2Eh?sqyIL(NU2&PbtPu5K~-S0$S0$d2_IPC&nkh2#B1Dih}Kswxql@ zG(0TBOO`Ceq>TZeU|{fL{rZiMJ^I+}+1Z%AVddC1as6UtMSf^%Y)DQ?Tq{$2vQ<1K zlPjX3p^4O67(F-*f^u;zz?cVMVZ1>UU{s41FXl$@N4O{8U4H8ppog-~*X+=grN`Oh@4Zo&mt}igJ*Nq&w2&;AIZrsgG7$SI2+>cpL$!x#<}hh%Bd0 zk%V;)mVN2+MX+`Cnl&I|(Ul@1{DD#xT1ie^zG5lnam=uI-*IhFJBYae@XQy$1vwxE z8CfS!oh0NCBRMAMRjb!>9n9L?96g^90PH2;3uuA+cKON`P0cMu*RSERW&GHRH>}@) zxdAIQXvcs7TJV5yHo_rGZr((>T)u2M!V^P+2mm2}V*Z6_sD|0IvR1EJf!(65wH4$e zD8Y1b%$>(*2^ge|%Gx!nA#Y=2{n4Wz64}mf!K|`q;UY8X zM-Z$xJAW1#?JOeV3pe3K2z{W#_V!d!B5V(#5p1?h31c@3N>PgTbydGR6PyL~X9$vq017-lyAX!sl z8_P;dK}yOXBOkdUZV-P!p`RCDe1Vt=lUYL< z9x)9(iHJ&wzsr^_Mi6gmY$R2I40wj22c)8cd^xgVF&;2$HXOb%!XT)AA$jO4huC0D z-+c%;!6DsS3Ix`opXtt4VcM#1sxmw1#T#@`xIjU{?9dRo=um5@-%?-K6dfH8o3?^q z7!~_?)RU9rD4Tli`eis8AzE<%yxe>c7uz$89w++z!g&b$=+NcmWw-+tE-D21aK9!d zC6Eu++Di400T>fWZ4Ayzc~Dwz5S0iGp3^b8W8NpR3S9~)T zu8g8X&@yqDL8Tde{2JM)BPj44qQtkqO2V)8f#N3;k8UX{mp(y*x2aAeE|IRM} z_40X73Kz}+E{%!4wW+!I+BM)|#i~_F1WRAKgbjukC7g>qgkyq~Zloop6owEa5r>e$ z*vOaWD{NM2wGlz5hu*xK6M(bUP(FTGiYfJU7eq}8q4w#UXLRNby)GZZc;j8BZA zj$CbB6-5#7k>eB~J``Fped@#F!zN{)vWFJlNSs7UW=1-`4st!JNY)RJfPz3BRvB^@ zl!hJ~qX58p^T}t!N`duTPWrj?=FFYT_GqYULS(^Vfkz)}N^VXL;sRSZ|2^6Zuj6uR7CX?K}*+@1lH_`GuEX2)aWM=Ttvt)?o*;$zwHn8fD=fWd^ zsMpxsOg%-?>ex}p3J6;SY%*&AfI)x0b}|nvlXk}WudIySS1w-MTRtAVTaW@XQsC17 zK7_*E9x|5*rLscksvNE|)Z*q;7#+qYY&9z>fldfLWx{k9_=3d;DRT^$`RM2nDdMhv z4o+Uxu8+doiV~@C91Mooig93@D{}x!;dHE%{m zc?~$D>dV?2upCpi)t`;PicXL`Qi<#Vsw%JYb}C075ssZ%Rn!M{I-^44vAD2U_z}t( zaz6?*v#@(9>kQ4z%5$kOr_}~mSyN;J1P(ydm1a}d85Osu?mb1*2!oQ7Ue_ESqdE#- zalE;yT~ROBBScPCY^s=}iPwXGyeQ$SqP}AghiNKS(K)xR5lARhC4P!4s}S4pNZ&v| zwp_-kqNEr^JtOFmIK4TS>Z5!Dq50i6FoZ}#1fG>pr6fD`cxKn)o}i58L71TbdER$o}#iGLVE2u39A z)M~~ls6<7Asp@Pkc2s9qE_Pi?9old@sH>oE!BBMDJJJ$ARrV!iZfX92W%O>cy(T0r4#3W7zH03&4Z`E~SSEn*dL!y|`!AHLIxW-T+R0~#|DNE)MU5~WcIwsi7mx{IiU_DpG zBdE0pfi6ga01Dj6L~n<9A08nL%t9?C#Ms3Gto*o|R>3C3o2-|V#RMrX59QTc@;#ix z6xr^K{5*fWQI$;{uRihcSlAXpb8rn#cVdA9U<=tI!pP&8jVrDRuW_B<;IJG3f^s~c zGd7r)N_eWBj3SvGBpaJjy&h|lp&B)+sqc6YeP}E;8`g$I09;|8Q1clp53a6g>fV7~ zMNt}swA+UQct+wP?V*EO=ZUjWURT4g!Kh`N9Nbnd4l_94%VKGBM=VicQSn6Azsm#e z!qC+cMmIp*5e9%&Fl8>mrO*ojU`AuvWw3itXGBaHI#}YORi~Gz0kdcND)R3k)>?uF zVF5}vkBtRT03lF~bGZ-q)FQf)u6=#rhN9msK+H=V1+}XJKkE(Ts5?tIYeC5xW&Ih6 z6ch*fYzXQR&e{n`XpX1)?PB!cI&}#_E2Tw@spA=wW`uHPt5O^PF$Ui2E3m}Yk;=6L zND>NZRG$L2it4;VKz{R;3wY#D5)w_W3RS$jW=)M5#Ir%w-j6~C5(O9qa%9A^77LQ2dE;iB=1 zSjRgZqLgoL!PwM?P10(dD(8zr1Y@c?GD3!c&`_UGw8KNy>c%om6|~4^Q+y^PM8Z{l z1qnrlyC&9n7s7H>++%9!&OeD6CW1@G&x^ z{OwF!Jn$|-un*!~kOI?c(a-Q$!Z=_SzzW=4T9iSHQ!b^`TSa%v4uT87(?`iQf?0!F zrk8*({*D^rO-{>4O&82iNlneQU?nO}?yyq;6Dsur9!l<+@K~QI1*Lzu<6$s&l~d$zXIjGns=c!?H1RkQXNm5S~eYg1r+b;iBgh>W|DK zw1^3dQeu_$3q>d6V0CR%Tp`I|jNd}@TtuGV;6Y7o4sR2TDzP@*O=0#h1}sZBVy zk@hD0g7D9cLF%2^GZ+B_pp%ZJM~YU?(W9Pern53a1|UI#-Z?a^lk%ykdkD^Dh3-J| z7~5$8dbl<=QpHEG2MlsYaEFnzC;4p{DG!IW_tj=Wq)?q0gbVde(F>WzwH~| zkYkv-2$)7BHo1S=5^9btd5gQKK(87V%9_FzO!VO|CKbw8-o2`Y(*p=8WIj&LbFo$~U^JHBIr z{5?p4Z#@M*-9&F@L&J|z>ZnA*`mMFO9%(F>U_eYvJbEwenv$+K*LmjS6I^R7bv?J< zuYiy=FmvR~I_=aQ0Klu&0Vjil@Lp>rLhF|?v})Jbo8WL^snxYH{YaKfr|84A&3G7! zeb(&5;*<=Ef3P{>yk`VkzX1c4?LE{L7jtuM=}qHwXwBFFco>ryoMny)z=lV#g>pw+ z@2&?OcL4`2iHvTfWO5I=+O#-9IgBzOa5P}gF-=pb1SM)`H!|$HtuqT;wrF+Chz7W> zoF`3F%xtZTSIqZM=k0Ay+BzGl4jHr!J}_7J(?j6`vH z(9HlC$ITG2c;f6K4aY5c>-0v=2eLxUy_g)3|uF~U;*ox;jn&B(0rCfG=oH0@LL=NKV= zB=oc;ki9|oR;M@xLyXhn&eHCwgNrGf6IIfHae{87bvVBOC}!4i>!M4_W0*SWDS-{E z4<-=e24Z8`GUUyhdabSJ%-vj^D-h)%y%tGMEfcks)n87HS<$xHLuzD0+gSOMERi2) z1?g~5FD4o|SCglRNOg3TC~UJ(bqB+57Q!nJy7Yf@gE^v^%q_&@cs(z&u7%>10oP?h zLq@cRuYiNs=_N4bs-Ne+8s1QHR{8`L{^nTYw^Rhlyu zRC0q4X3#<9Rn;gXC;%Y(7`$1}S)b|8{GBooI1{V#f^->OLsxc9GhK}!VTx?sLR9Mu zE*?!#f>B9;A?vtWhBHd%&Jbs2NOIXyHb-s3&G>1^ZW;`OwQOUF5r6^$3^PS;;!_!q zRc=r=*ibc@g`_g+!~Co$n~bs0NR2_&P}~U&8i_MMXkM;O2!oK9M7O5S3}51?kS)Xv zByOdoy_q!w2vz@314B?GE)M^N-0BhzEVUg;$ea{*#SqQW0f3eNlSS7FaDHF_R~*2& zPxw<7b=g#$x8BI0%1fA_ty{d@$^zhkHPX~jKlQDX4sD+7G&#?;c|-=Ag|`c;vvorm zBq380WtlL@&|$nWueO}rUJcSV17K{e-0=a~q!d}^!V#REtei!B+@ z>kCsed+WAJwPOd*Dhus}g6-;xRWo4@-NB2ZXJ1byxQ?$^I~<-0F`S+@^fH%Ni64+ZW5;N4^Fe;IuE z%2qh0V$ZXC>yGq4;4nHL|FUnTja#QI*A-p=l=tm5+xqWhjcqW%ssSk-)1^(yyeuO& z9L;f0$DItR4A>{Qr^73Ut^!;Ic1?U@Cpktr@!Nr!-^AyiRv^<1TvYeDo1J?FPJA+} zwSj584nN$HUhH>woRJ>}YCk^Os#36UM|!BqSUT60Z=0aM4ifeoaop_)KJfMAw!6FI zog_3d>pQSz1)&)kooeW0FE?ptZ?M+vL?Ot*Vq%PemY*(OP)FyJ;hOy+AZ^U47sj59!FXA}bOxs%J6>$2b?43$lQr$bVY&Hl9fmnp<$w9@6W$Mf zvWTDc*s0#@xceLM`Q?^Lz&{}Y_^@+EfDa_sWDRVBp}TuI>Bl?XKxS;0m<(EkscHJ? ztil*mHAOrxZV6bdu(0X)>ig$~SvyE3afhT+z+-|?_Rdc^T}f)cU%{05#a;ls2yd5F zEWL+tFv8@u(&_G|Hzb+$>paT`lEMO`v&2c zNPKUEjP%uKvbJZ|AWIHSbcOl0FPzDw@gzm=SUYI z4Z8hl&tL$#oooE=NB#*5ch_GmS=h5l!QQf;8h<{sSi7H~@CX*ujCsy8~Zy>Z~~d>?Qr%M>#+1 z*TviylSL$X8{FqQ(eTAW1%VhPSjoJPo!*o&8@1vgh5foE>ZVw>TOgSbCdg(G=N*Z= z=XBKf1FiEbIJbg%zRgXmxGDjmxhXKfP)1K3SqP!`*m%4!;h^2=Rp6M>+Ntk>>!qRF zio4%#GBdv1=l%gt*}Q?o^S^flFweWXz$;)twr^tCAtD}bw~I9o%cJunAGGku&Y?d%(te@nQ9o*0s8!-j=kbPt^DjB}s7FT9uXU(@YaKV=-% zZOYyweRT6mP$G!$JHG_%3_spyXBzbl-KT7v8L)gtn%rSAgC7Se5TwADO@Yr0@G}j} z5BhgNJ0jPF6Ru^6MW_K*LTs-IeX<5=N|lQxb`DgrAmel{GskCWo&t(9A^H^1n944V z-8$Ch=XWy`-XWnALGFY?lg{)WE7iG*z0Z@jw zLqy+!K1B6jRQJ{~fq3A@(SQ@Dj>2KQRzVQ&O!P8Y6N-kUhPa^@5rpda14628fqysM z6>S1m4-CWN_rT0p0Hl9i{2{K*#_ z>GCt#wvs^tly|RO11}*u@8`#gaTtcJrBgkJT<$XxD1nxTZZV7sD-*3PrQF5Pnc;e3I|&W-pK~IF>qsXd$UR|>dB5Bh zC|Y?h@X0b$;4A~582^e)z^zaJcArdrm}VlE|6GfP)sG9L^Tl&WKD7!K$k#3gMSIC& z?k8>2yIQ!31}_k#z_*M7pV;2#4FAUs#-=O=^wC%)+_f4MNUpnt*g$GxVOE%% zN|9J3xkCLh8)HKDM`COCE|kwr);B6=IdHCziPv;$1P)&3dV?FBU)iPLW3pDoVnXXx z5u0g1`wM{AYe{6WQEowFnaj8_m7LofwpxhO^(y z_;Qoo9^7`%MZV3LRmrOA&B-3ak8A34Z8?mj|#HA+BaY_(=;55CmNWhBwNNU!2cMpq_ z6R0aC!37TLLscY%G#2UNyZsF0bzWDMmnFp&oiyGIw^h5f~mLxKWsR4 zSxi&x+sE-7<8)v7_2~e0%1as>k$}eBofA5lLjv!R0?6n-;kO&3y|>sp#UW4uh9+>= zu3rOaogV3iBh5@n?cV825Od+G@e z4A5Qzvi|Tb`$4vwVx|?e_-aY3{jq{V&yZ3wx$MFv1{itswvLF-R()&*# z3y!o>|9lk!BR7h7O`Vvh5DHi7XnBGObgOoMxz~Bc#3Ir+e)leY(FaPo{zkoXj@bT$x-Rq7+V8Z2pOXk4*;`GUei zN~qD&=E}7jw8x+iN@;0HXIBUI;rN(XySb}|s{%N1I4u9vlOb>36&`U(SuS&3wN2C% zTt#NgHi#&t9G)s0Uwd*Kv?wr|Nkftez4j!VNTEX18v2lqgy!`_- zm{*_xV*n#m(#YJ{+z=p95mw^Zt(?AeMZ{iESSlcX2m0>uG zfD)!KNcmn9vuu)NoFk4vG>M@@LkP7Rv4k+I4A00_?0IBV=xPNJ`HHxG6;>P`!DbK@ z7SUGUNS9$~Ln$8B+Up;%9E6ZQwK>1Rj;TRb+9Gtt?WC_(7vnDxzz5vGY1zh5P`@jEh^B2tf!4H4n zy;e}{_yUL;yu>$z0{2vd_f|p;3tPN+F-_2T(bjY6GFoBIrQ6klg$uxYnz++wi%znX z`AkhoRn0gcLG3*-?-&2g-~507-M{;P{qO(ful_%O_1FLTKmYG3oI+L)OD%`1-XQAAE4Iva$l6 zXw^w&!-Ti#T9%*Ytp{R--e9bj*e%7K4s3L{6Qee@Q3X@MdsQtRXlw7_O0?Pi{qKH% z;^aw=0BI;WBbx*@%apH$D;@g;BgH(d>Tq3M6vzXTks-*@QY~JU4^WjAD*?w0>+415 zBnv|UhLRyX*nR|cs<%s%l|C#$tgOMCcY8Al=0=S|!I<*B!)t5m>gyV~X%9EdMc?K$-Pu=N%eYlcLWG_pb3%mO7d7mAlo&PR8-l} zEGVAtuD+oGR###a5pMcLeZ!D3cT1$+tXt*>*!#=qW@TV{<7Pt+7HpJO6Lm;?dYJxVrzGICmX>k*{W1+OG{f> zX?cGiWu8R~CmHnh4_USQ0KRr--TfQF{DRX6QsA3TfiD%{1Jwa9V5lfwsET;Qk-;8; z3hd6hhbhR8nrma@G`sx$tG|Euy?1MBYhXB5z)m((lo}WiF8LQ0pVgNztuAY7?1+U5{v2n2~XJ+Z(%!qTj0#|c^1$@rb z==4gbPi_YnCKQgdsLp{#NF#AV5NI&p*E0Y(Ddh}Y>=C-Ssw3{jjTkkJJLyPf)xU)p z45_z=j^;!r_H}f$1Fm#Sr7640j?%V{4yFTx0F|a`FIn%Yt8XRiQ55CBHdnf8d}13= zj@>At4gKSh4W}329q<7YEan zM<`-vnI)g@>jN4`XD4S7^Ka#1tmJ$D0P_NnsMKpE%~dtlpfLo>w0E=tU}*7GRn;sy z8vqxM%DYB{)AEkubp1U&uHYJnv2oZH42jzLg5mHmLJxVvig0CDiq2}(t07HOb4x=* zGZ)Ot&Q75TtjgVw0fFu9oro+{euW6lNK7p)P7el6DaY&T$+Hg{8ygv3XP2g<4Kp@I z*Em-WnHIWWDfgnDBip;VxwW~ut*@6f2U%9s)5XfTT4}{`Y$1r3T|M2ERh8=ZYCR8S zZDPggDBRP-^*PM7Mr0P%G;O_oo3EI!_0Ca@gDXfNqlG;m+?4k$3QI{-*S7XH?!qSu z(NN8(L6(7z!%&{~xG}Nu7?7YFB58X^M}NO0QLFzmVfmlrulc6)!QlLY6!=C`;7bj% z^HI#_+=WHH`s(jboH+6Q?|*OS&YjMX2`_erZWuHiwx_q}t+(F#=%bHTu3VLn5RcaW z%+t^8-Mt53IDX>n{sSNE*tzYo#~wiGsje>n^{@T`KKjD*FFvsMfy(OY!ykTFRawp5 zu=zj!_~YneXV0F!RaS;Emec9l4s*OxbOrR>vuDq`b?cg&8_%9SedWp(befcu^qo6) zu3WjMrM11G@pj(qY?`v;X$CJF8(V1AotHOf@7@RI&zpnt3qJ)3a1+qU8%(XMtpl@j z^K$p@*^6-k?BSY6j~qp(M`GBzWh=Mi{l0zs-hTT4sIhs|=ES6={MoZNZQh)nmBqoe zb+v2Pt}DpT$Mg*{;kH0O`{3Zg)2C0t`d6=7{lEhc&{O>S_3KxPiY$C#jNa|&c8D@R z{?U)Xp<~BBhK3tAYyehIo;*=iT}`{1#Y>j#+OsD+HxCk{T*AYtnjXQLdqydnK0MH0 zTyo>g`SVqkm6Q)&xMXd}pIu#3i z?uhZ>7&WFFJagt0>4BTKZXX^U|LEh7=;yLy+YV-3TzriV=nEDsxO(;K$H$IWRaRjp z*|B5Cu3fu8>ucAp*VQ#3%*Dqgq^4#thI#YnKmWq>mo8s8fBxK}MT^qX(yFVgd%L?( z*?W7tSFKvRXZK!=E(Z?mU%Phg=FOXL6c-;qaomX`^i$uxdl#{vfGA`+fBt-Ddj|yH zwtf579oui$)PDT&v6|}Ii14UAdv>o`vorWRask8yJ*3J zo!hoAU%HHKdFu3;%U6oJdwXNz;?{56v~$Zg>fQh1@BYWWxArF_C#_w-o<&JZP2I3@ z&4d)77<37b$NL?LdmL?t3c($hYqu97@M-QvmSfwkvVe;u3yKibrWfiMo<|U zS?z6I$RFSR?)O;elc!G(4h?VFynWH)LV7QFBO(F<2qw7ROhI<{15XSF+1(GT5FEq( zNr8LdgP-u~VHJn@-nvz`Y15{;^XAD=tok8l;to-RICPZ#Z|;BpgAelaXFu@3UbrWm zYuU18^X3Ops}g3qT*IXc?CM|oH=vRSBW;Nudl---r3pH(AZ4loVM1E(`N*$ zmoHs{O}8|+H8r(XRNN*SAUQd0PJTf`yxMRftQgv&VQ7-Fh z>pMHUX64Mv&B>BWgG5GD@4gt;%CD@#ihtL$MW)F58JAV8|$xWj35RV}5qQ#3+ zQ&OxRyfPvb!B<<$lu>fq+Bag= zmM>ez$d4R7g3^!l1BtF*yUzW~%PU%2Te7mU7&BIGBum7XM0I#eU|oPpZu;)K@6^=X zhHhuhoI$db);l^vkjJfC-~6V$x(bmCy}z=e0)ow(JEx+e z^2EtgtO8eH>tbw(iHyq1%(`^xqNF;Hho&{`?Q6x?^YdnBWM;nm?z=~h9Az7)rE2g9 ze~6g;e*gXVaX-}8H()VJPtQQ7XB)rw-g~sKW!*9}XAu!VQ>c{Gv~%arBNJm8!Y`JU znNH6mFOza^>?zLdX}<0I#MvG6!QY?I5**e2K!Gn1;6MF&2S{LuVD|j^g=!qv*M}l2 zKdY4j#aj6Gfdim>Qeq-1{+2CU(51?5-CDk4ML|IU7Tnsp##j7y%ojz~RJ^O4*N=i}D6;$L$9(@EudU5gf ztgP&nD_0myhUMhs;ai8pVv)rxTXw57H8n-H^rmKxf9lC+=FeZ)($Wr8FD#r7E0m@= zGJNXvN#GFm`jwYo-nMNUHd}xxB{})@sZ(J8(xppRtXPSjeevQ&AOTg9MqZ%)_8mJo z9th|9U=KF}%Q3yCq^8WypH2K1sRWqB-+T8xX!6sa{`86OJOOASh~SZBItUgIKl1RS zk3NdhiGcy#5j+NjmM&R}mQP&$oBQ6xX#caH{cOvYtvDJGq_AG#>?ZdaQ!d_h(3hI= zbO5+;?(D0ty^6Q~XFvZr29?ar4CW3fa^Lmq)?+@wF>&R}Wsn#5HdX=5(N8}4!f5qWBW7VVJuM|CI}2(dJQR7n(PhEHg}ALQU%pK6-HvVB zc&?D8Hf`GY-S2-dE-|sDuGZwCa5e*DVAW`oh#<%~@dO<@bcjdekN)V7cJJQ9YL?u* zi9e#Dp{c&U@xccldHnJ3V122rtvi3=BJmSQIZSQO-rY-Zezt!;5`gt@`ORCOerh~h}v zxe`l7bQ0i!ZkLjrv}gCOO&d4v+PM>@zrKMKrv}hv;erKQw`^Izb{#MPz+=)ZTu`WJ z>X7l;+FC3M2M->8?X_1=ojL)WqwuM7CsPE;k)E2abTEtC zA{HN`acXkX+&KlCH*H+Kas@x@)~rrXOKodKETI#|Xjy6Lkqq=0a_&`H&L?HmOd;TqToc>yk+yUWy_HjI@&v` zt8X(Mq7e}$R{x?xcaY?LQx2CXg0U`^jhFF_151_s$r=~>5p$b}2 znkY)SsZnWcTnusD$*CAV5*zC4imqG%UzaYyy|5TvlQqIMjzg9bw5h4-sJyK$ZGZvR z@9jHx%`aRqzpyYnCzo}cUpQ~;=1to+Z(hA>1@ad0ZNllWFzW9_M~An!Hl9Cs>g?&0 zhdy}!#PJiw#W(O?XCWV@r%M>Bs{^hUELxN`E87Cc6p@E78e7Y;kB^~};^Qc}aRadc znTEj-RE`HfE;(u5ygB*#d5ujCRn-;HA#ZkW@%8I?D=lQ9p zxO3+&XpUq+yn_XZj1bIt;rs=R1gOGT0@yjoVd&F{bVvgj@DVEu7cPuXOlWWKK-9Q+ z>Eee+4xKphQEO{6h|7!ZJlKbsoE(a9gtKiswj;I7n>&}-QV?4ExVwioD#)ovjvmFv zj?)K`jxdF!#N=7ovu3kx=FVBLsBr1hCDac@lH*=$*R4fOM;766ATAZ-2S$)Bn>RoB zz=J!tZ)Yy}rx17OO}wCR(Sr{@47rk$Q<_`b7~bjAr(SH{iinDh zjzRSY8eyVfB$jYo&gg3B&74el6X*z(S`b_)rc{ji#OS^M{s(z^vmbr*@$K7o%$k*l zvPxL7;*UbYlao_1IrG~_PK1K+xz$P=dK+) zwr|^tGZ?)*JA2kkFTMQJpZyWNYXAG+{@vgI;+I#iT~{ulRl`Nx`6ZuRy-IH6qmMkY zY13w+;i6(_Kd&e`g}V<8<>uxfmjJPN@u5;idS+`|8wMK&gG{3`$QH|Htz8wUXjKhD zNXp1a&rqm24QC@F7x+2`mBBTeNT?0S8!Oo_gx3KlzhCdGxWzmF1|S!~+=f6+#gg zpPHV|iTH6i7ikY60Dxy#^Pc^{kdOo{h*dR_*t8@mknNb7mcdRQ7*HlgbW}`cW)>a_ z1!H!16JE(4W0`z8`}ZH0nlhq5H5~>)GDz?hq(G1YGg08n1o-LqlaCd>FcPI_*X~`U z;o>0w-S71xQV9kJ_gueWJ&=qJEsJe<7-~8v;gTfJ3$>CrFl8m-MO(G$yO?C7H7Np*Jl+W!deX6Cp%GN0Jo*+Sft9&f!`H_(iJov!( zzyJLo{_saHzVytLg{#-DH8nL8NdQ@psPG@7AX?a6EczY# zC60C=L@j45;2#QDQkkN}ksClbkp*dBe6**lqq?$^_b)v6>`#97lNVli4uD60ZER>D zQ0(z1zVqZ$Pe(dMH>;F@GiKtMJdi~HR3&;9&oKPTmS!Gc1rh2TgbKf(nt z+92>bd{t^gLIUBI7>$4MgC9Qs!gJfVZ%WHZ)y_e5utqmrA6l``*#>MOgLx(EW8Hb? znWvwB{`ps4!Hx6s&K;ZC#<*Zw$O!1}#_LZP)STQLgd6-j5P@xzo~B*IF2(wS>At18 znNSbX7FZinFw#=fF>FMHN5;m)ss4>61hRZfmo0nfkw@Ya;_)Tn{bBG3b>>;|S>Wzx zcImSbx@t~QF|-15g{N$Jr|T8>^IU>s3sT_Aq`(*GgP&=blU-uK6(B*d5)tET)~rE` zf^XvGC0U4oeXw+YOP(nDl;n$+ybkJ zr6QJT(c;B(=gmc>CBBK+Z**vo7(27LaAg(8;0Gn=8$`k6i=UN%d3ZWTX}A$#Yu!EF zSl2PF14|fzV+o&Lw~hh;(;Hsd`v=%c13eb^YyFOkUQ}i5u!mVCXOBgDbmu@nGRAHsxv|UtTh{weFZ39FD_>PP#2H; zva$?-3*j>0PogWJ6!Du_8e(IjF$j=zNUbMro25(HicIG6#Y^q2tq7@!35mrwZrm&_ z<@C!}u0UhY&=_`+uC9)2DjIlWcyt7_JPU*opCHNyA9{#jelj?yW=O!q+BItkL}2EW z7i8NoDK3IxpBR1#JZ){%lFGd$7GSYhT^M{H+Z{ont?-y|ZvlRI1jP$% zfH8sSz!*FiK0=<)R{Z2!wxBR!4n?7HiaP**?dr8fiQ&Mp#;&s1p=`zmUWy_a?n#7u6ea+6y#CeQt0h^mwIDhWk zdFa6;fia!cbF8hc<6r^a?{e&@NvM=FcdFe zwj8CFYr@(f8is3fz!4EV?fI!oPO4< z?A0rmyY{kZ_N*f)&VnN=P-rN7R_?-uiwPnlI_%`BQ-rx;qFJ|g?auAnGSX9sS|lZa z@H!xn1AxZjl2R(mprMmAh{Zl!a(35suvOG*&GpdpvV)0s#RyDnkJRByMI`j72*BY|LR}=>7V`S zfBSF$?H~U37ys?Q{U875|Lgw+Iq6^j#lQaB|NgiC{r~s3fB*M?&xTpPeA)do>flI% z6!@wr@CD|<&tx2%tOQVy?7)Gysg(KMSH6ph9D4uL z`0EM02SH(rSZ<@EqHvw^p0GRal9`=_CXKr0Gn<0-i`}>gnyk z0*Hq@HZ~r!dR=WJHtE@US&4D-R$@|xGh)z&`=da>5nVYKXL~1F9*v*!HTY(6D-;yW zCDj|h1GqvJbQ}b`cJAUxkPK5QycLcLPQcSii_gi;RWchWRaOQsrWh)k*~X0=%cT$v*QZ)QPj?p~azri;4h)0SBpF6TMq`Dptg0%ntim%6 z?h*z#dv*@0Irxo{A9r?RZ4ELI3F{#d(W#l)R9DN*E0|l5H{91p=|93R(BQkedzxBW z;}erp($Z*LfPWeb3gC(eh3o>6*$K#VAblYLfeRK8SODqJxotIL5e}Lf8weN3$(e<) z!X7}^Ns5rhVARh<$$b+O@b0sCEc{!P%jd)X)$_)xLoNW`_n}Ut5DLgn+ns;Q~tZ z+^4wi=ZoiBcfs=`K3>-w>z$QRLQuw7)FQssHiI{yjVMMFaSLUG%|*uh$?jg zu`5y)je4x=?xBLM!)ni}5G_imMX4!=DtlTj`XTC@hEP?_F=GA(kA00;2IY>8qUJeQ zS3eb;uH2@NDs%k|#h5)S|cqgHs#20u3^;gu$=g0eddIyRc9Nvf|86B3A2WCNoJ zZiphgL%HU7)VPOn4Gs43S43oNcvKwsrX~zAR){r_Lp|V#yBrumD3L>bEF>Z-f=gNy7JuB07kt42OlTsLmrm5a*nyvk^ zZba6qKqOLqI`94&!ug`QzS^Z^{ki_~I%Q;VnAMGoiB=yO`tM=Q$IcNEp`^mG5CS6P z{*Q?sp}!*Ggkd2gjDa%t9!k-Ls~wEV%ES~f5mtle788z|!iA}%oza$~wJ|tM<6*R; z6eAvmL<#ZnM0Ma`;<*xv6J@Cq$nsjp#YPdjYQ&*Xze*9`?=OE5p1^@lE}MV9Pa!zI zAO-Ff1@0-pQ#X76Tl;_Yt6yU%rj&}>d{J`hC^-sz!g#M-xrFia zpZw`R`_2>3I8+l^1k?1_0DbvmjB@RuyC6no)dgxi?3Rxw&Z)MfRz`;xxM|f$#*~yr zTRO|@RYlv zJ7Aj{WUzm*oO?z_5dQ4}=LoXq00N%5m+GEUt5v9j8$z{P1*JpGJraFHMP5nCr{;(x z2`Y(pb7?@A-|FK+{=FK&jG@6R#!caaiophoToHBDYoNkH-ooM6u7F)jds}03GXf1t z8~OK=r%>WuvvWm?Nk%agq74t_-y^sS<^hV|lYD@LM1@xnh5M?sEnQfKNnZ>>$3;HS zCx(0~48Xv2HDwZ7odDHdRsDIS8Fh;>M5IBBDhI2Ot*Yf)oEj1RtP{3(b;ubS1mI1E z03oA>m_Rr&>Jj6fu_)Ac19*}mtsy`hzpSLL?no?x>a|8hpw2QRnhPT*k@#q1#?D^c>JXpw#kklQzGbM;fH|@>IARoCKQ_i)p|-)Q^;!jj z5if}Wq>L^ziJ+SD5KF_VVkF?Qu6cnHEJjCTSzrPmLdKQY$*xo50M#a-Og|_NHBtA~ z=!ShvS;2@Xi9t&0Fk_L#%~4_yR0H1%*)u?kLY0{4stZe|R4dpKYnQ;_v3($@m<&6v z{l@Qvq(mMr2|zJ1NHbiPz&&C=O=KBEU^QXa_qtzw@b`*02JaK3z}KDvUyu*}?&#ne za8a6#7o}sn;=)U+Qp(48atf&q=pcpca z9tr;il3f(KhG9)gP}s0pD8k=OjmUfxWOR2x#d@0v6s_+W5(=ywIfH`Jj#zW@XpCC+hulx(JNyN?)qOhedu2DvLDCS;NchfSqc$XaVGJX{CUzaqjB z3)s~Nn^={w57|PyySq!f26`-kwveggI@p%e=1XHki0FYPY;qBkZ9^uUdKMu2B6VqI z5MRD9{xAu{wO5#ktqTJD-LbXcQ9%maw-mTn8obYj=3;zMvtW6!6^w_jC9622(ynB& zH#DW#J7R#Giv{^}Bg1Kw373p;X=6hkT8LuTRI5;!8HzF-%u2XWip$QI+9aMBJiTLh zU0oZl9XpL}+iYw*jcwbuoiuFRsA+85wrw`H_I%!NfBSEab*wQnG1eIOysz^_!-I_H zK54{nvQ(`<`AxA9gye!LDsre+K9|uWq@@zlu%%MTm7WC&A&bGvzpWIDN0YjN1O2l{ zviROHPX2isL)e2xy4G6$@4qrYrmoYbS($MfDG5TPFqgA4oY8s|uiVR%q|l&qX%?Qe(?zHThQ=d*#tMLetx7&t#G^h61o>VvfoKGomtj`omSJPAAvvjpz@LZgO%zV8U)Jn{osql_aU=0 zmp0nt`v=()#NNAN|6b@#I z_ATX$ttA3(u&lNc?z#}2eWE{=)-6;JrjYr+^3}j%$sut95TgFvnKU9Ww;>4OB5vX~ zWw?amwu_3Tx(I`8Y1a>AwUmIHA}kZ26oh9t42X$GNYx!>t|8iZWK)g5 zfO)b*|L_}^3jqhJP5!@oI>9`hzQM(kq&Vqw>O6PZcvJpn z-)!%N~qC|Z=eCdxTd#E)r zPLhX+$ClCyBdYc+PBjsqP?Ux+wo#U_p6SWXH8sL!5zzxriZ#L>lUB|1y}v(k8AIOr z!3ARcw&p&DSV9GBvG;K1f+9KdCQ#(noHW{ew&h#uS3xVe2y8h?`DQ2tMwE~7#szFS zdZ>|USwNr)(nv$xz$gIhp*5Z53(I5L_(l4mU)|;2XGydJRr#qg&&e9gWB?3e+%;Oov0hNn| z=uc3wiQU#3Wr~bu1|?iKW&~7R#dFj*SE@GE4>@ZYsdx^1EG($$jwGACM5rP6wj4`y zHRz44yH0Sp13z5Bx$qk?2SiK{8~CC6U!Gs+;p>UdH^zkor(8j=-C53lk|4uw7^a4c z-Z^}`j3?cZOmNe@9-ml_lJgFJAeD6BJFgM$qQo7h=UPY+w62WAj>OAVk=$w@?Ghs5DIHVZL{}q4*G-Yvm zGWq#}J44(gJB@9*BU4{&_#wfEw+K@*0zZx(?) z)y0|Pt=ak8Q4=oW|S3~qtn-Bjr7IK zX{Xb7VtN{aKQR*ai@-?1pwr7W_K!nylDih?Ty`?4I(g1%0V_AlT< z+kW3`S$vI!@|jtz%7TI;1DNL@Q}cA$X6)byN~*=KQ~sxBeO1~a1n-z1@ry3F9{w>d z_{;%0EYOc3aFeDF!pwPP(XuuBs?dSv`Q8hlK@^@vk5H*|UaoD%EL6?!2P>zDSf_AC zys1{YEa;f~pZ!dnQB#(Q(G3fnOnxbM=PEof#m_y(lK0|4{x3Zz8RP?h?eAtHLiT3M zcPb0@%#^TY@I@Dp3i9<(y48TQF{toJ$SU6o=ZeYtaB#{u zl^vJ=PR{!=_UTVmL5q$>EUv`r%hce&n+NT-9dEzRB|7f4{~3*a<>l`M`e+_kp6(XW z*tmoL8}0uN`wt7wcM|l|pTxuw|GyjT{~qdw0s6By*gMs+-nIdHmxCl5#mPq(frX>t z|NBf{7?=TCAQJl^^z27Hz3X-M|NBx0EXaQ$#O>{%7t^>lUzgewJGR~N=rBhiz62T! z+(*C>eFMr(9MA2-Pu1WAAtneaJN2rDN2SEr!mq0|xO{B?osRq-jmq9_iXLc==W6q2 z|HH-g?kp?C&T|AD>%2yV3o6@Z>0f*q=pF&|evatCsm-CeRs(-u&UD`nu7w8O!hESO zd?~$1af}-Ma68?IA$I?HE`jL+)77 zy;(8w3_u$gFhd4|{0H6jl!au%`kxFn7ED;F!=mWh7WMyk!Txs&eI$e4Kz1w|dfqr5 z|L_#O`D}DjmM=`L1T6Ux`EDXY3Ph==h~it2pMEGYKmV%V2;zwROyuV))*U!reGfX` zvU2MF4$=LKiriBUz-0@`4mpKeY|J|kleI}jkmpPwN6i(JBZ zVQggjqS`}W+l`D|GdpzB?eKHu%kgi^wJw)3rnP5$seJAW203h<{_UAAMKF1N5Ogyv zl<5&xt=jp_?)yp7LFP}K1a59Rm+a7$0?jPI$s<4ur>JBC_vA5rSC9hn?z=tvuCRsi zbcr6liAXu=S%}wvZwqgSe^u2^rdN6qM>8z{`=E%W-QlV)UvL*Q z-uU0s&%ICy#H)JLnk5hX(O9%6rV}cMw;u64=V}_HeT(&L58jg8^N=SK zp&nG276Oy3M}`(Khi~xUEpc?A;jwXXVG*EbB5t1uh=>?(m`5?4VPTSyi=++Dt@`;O z`xe3e{$o_SzOH=i8!-rmTG+p9Zye34t_V(ZZtvf9r{lIeOQr{>KQ~t1p{Lo;ahfcM z9UekXev-6~^AtH5yf6{Mbh72T4O1DvCQq{% zhv*xnDpH+lc%pPn@*4`joo8@dvA+aMpXeT2i)53=@W^_&hlR4w=&3i)Zb9?ilqU!) zWxC0M6{r>5%-Ag6xI+cVx@(a3Yp3am+2aRZ^4hCC5qn4!%TyB-&uafo3mcG-U0{J& zj^U7wdo;QZXZfH{%G_5g84>jePE<>WLF2=GpP$YViRP_r{2~p4ZaH*mXGtVhmD>HH zb+nm`^s-;^4_5qc4&>YiY`-qRnxpYvs9>N~N3cETaj^K6Of&EK%KnbZ^o(F1c*KEh#?aG|I{r%gr{IcAEzKE;gM=qDd=mcz0m}gy!V2mI|4n?vE2Mp z4ipiT1LkXRjZrR&qNXN9UKCNd*D=M)V?8QfAn)e*JV5{#+R4hZrlw~GR<SM9dv4i@eNDlusAd`4ZszfT>X2zITW3|8|h!`m2-#CdF<{ev;w zZX&(+VeFVE8Ro|=ALihsfChosB)NTp15Ipbxs2TY?BMg_+~3wa1D9R8tGwYfj{nev zvAYpij4IX+%<{l6I1Oi4l(+C43c_Zfn^5(onXXwse-T7{K3lRwC>mMDw-;ZFU)E#PrSZL& z6GE9oOowum?QtxD^xj)wRg)6QK@8-4eFBJ{Z68!n|BxliaZLYMi6Q#`Z@xA_2dtt! zcfR{_!@s{7CiG+V5#;59o`NTuxGwB3cm#=f0zlwIiv=`1Aha`2fQdDW@;%|uB#w10DLq^r9T zSrn?&0n&q)=g73hT^eZN>WUBoYX1fEkzz-*;WlG)F-Io@1DT`PJB&YB-?OT$oYa9s zNEja-y(gv+7atW2<9mpK|Gs0k?2>Y$CsENJke}y5Mn)znARJSTF*~a~(hm$CLRw10B5OA*y)x)y+p|Vm>2-SMNB7GBBSmaTd0Sk~_V{OJ z#f!WcBVzxF8JF{NgQgVkHY0srOii*0aaOui*JOogX9+rQT9nY664XR0$M%R6mvDk4 z*Ir37wyhHf4S88j%`S=rHZBgzXfbhP6V&)|I{bTcU6R#kEWNftf(XB>;HLKVLV330>#Wpy}*?A}>CTQ4y z(m582(sU7FWAC6TvC-0cTRJAz4h{}IJU)<;4h#-QJ-jU#lnVCE;V)RN#LDQ7;~l}MI|h^;^pJaf*Ex+`wkK~8l#LjuxYHaidl8Xi(&&Lcl&3O4MR!=5jg)Rqy<;>Xx0$s7=I z$ZVIWI0Kp{8H#sx^h!yDjS3*sa(XLsM*DW)CT3Q{6BS^LXJ6JC|Bikyb6mdZ3;$gs z$EAOLO=#$NmY9|44NVC;{`oydAwx`PONe4!3e{`F^FoeE$csZwSQ#6YTqn|@z*?inrI!Csea>ocHK~s{bt&>WMJD2y<;umdBVrH1zoOqlUVXeKd0F3*LQmYSf=XVB zGJ>Ow3hcFV@Xe!@1%%BM~4c?N}9Gu!a&(3r0N(Us@(?J`B06>I5NY!_GNPpK7CQt zH0@9TWaVlaWJ{a3xzJ4?$ZJjNlI|LA-_I7kvVePM1+DZd;H1h_mUOwW;8dZLyul)h37aNVAm9!wG(Ph0S zsO{)9Rc@loSOAw%kSE%8WZc9#B=mc8`vfvspA+gh=^m*q&IRxH=~Y4O47AyI=Rl2_ zUOA|!TG+5~Ypm7Gwd|~5@lxD_`blQLOo2(UA=2OEtZM@(&)Jv438WUIP{=4#`i{SJ z*%9CmU8}&Il1RM3`M-yK^l-F#05i6UA&0!e;+^HdFJ$Ns=UuNDHHpc0A`yI&3%R6=m0*g!_g*2=@Kg;jy9o7Th zMNi*LOB|o@$&-dml%QZsYbzDt(4AL*|L_1zFTV?5nV(U#W!2o83=~c-FL%)nzj3F2y_HE?;Nv3%@WMcm?@h60AKzOT^m8y)@nIb*njgF~U0dF}|`Vk08L z7ZNcp0?PfnzLxi^xnHXG)=_Vxr4_qM6_q3TrnaEB0BFx53!BK|fai=G*hjz<2{S6d zA_|uT($9`--4my3kidxH_u+tdS$F!{J4 zTqhWqtXMm1reHawwrOEQ^ea-#3M7jfxXF%F2iVZXC0DzRPG}3G3NpxrQU@qSEMjZ~ zWE2@WqMp=s+(yOK&DE{N6aoT_Y;0(3piAHEBe*1gjlGlU6W|KZo019BNVrXLw1z%$ zvx2z7BCotpLYWkSAFvZN2T^ddme)8~F44AK8>f3d-qW}*_oKc?7)Q?N3(C$1hX zNxA^7!b2$ljU`RaV%~eqAWv|NJwuHoN%|fsCfb2iSy`#e#}B?%I+`4$11c?!TAX5k zA!V=v?T{0BRAheTlbJ5@`u4`rM?D}P2mLJyZ4araJ^9|)6Crc#eoOC!j1-Q{xZ(d4Y{?o&n=!_6}3B(g^`{@8l^I< zgnop$xFP+yNWDIH#N^~X`vZ)?+biR11CuW5@;VD1iK}KFXOGg*Oh$@J$yc-yyAnuB zQisk?WL9h~YngJB$P>A__3TH)?cq?8MXfTr;clF?UJxkK^$;(vd{j8DU@$C)G6&D& zO^@W{WJ0g!BtQ#&0ii358a2JbxP!693&M(zFru5dD-1&`%M0zORciR1t^K~<37I9j zefOByy7y215h+ech(Wji$KGJfcsj#&o7-O(Q*QC4)x_ek_A!WD6zK27X@B;U1F{W+ ze(t9UL>t2NcEm&XWFKz32WynEF5>H9_DfI~Im!q=hbo7{ApCG^R^u+NE4=MlcL>Q* zL4?kLryO7yUpgs&fI5*(xw;UonGK_=$- z`s(%*Hd}%p&oht4UqdNndnUOYPi<0n)ta6rBjR!Hwe5jWQMB_P$&r2AFF^3oux2+& z!zW8f#mS}@1Ghp@=BBUs`!|L^H!W>wXO)e0H{V6)9S-eaqhOaLs+5!P5!*R17=e_O z#nZDB7BjU^-8c`>MPj~f3?briIjmmfQm!J}4mLI(oZi5a8f3}eu1`*f)FY`FqC)lo zIE}B{+$4xR@0*9cp^_mAwVd1s&Y={XxI-CS#u7_W=v6s=B+) zX`LD1WC+AjQ``JJWb$vlit~#=3h=x?nLS%?o?V<{W6e(0LGU$gsqFj!-0l=yvgT&f zVDc}zi9!%*F(9mIr})#Xc(@Z!PY=CavvGjBaBE{ORsrEEWSU1eAs%zt#S%itRnyEn z)npBgDRWZUG{{KR&-D5m@SI{SFm*ZY-~XB4VC1F4OAO!5BoQ9+`r(aLG$e1@KtMvG z^k{7lnu1|MKoB;~qb!6fY6-I+3dX<5ACpcm5p0yLJHI-rJdRy2PT1p}Gjxa;>kMD1 zlhFb)=2#QA6ow%qmxOP^^kJ9vR~6x9Jc6eH5TWupy^G0MkBwo_ZASbv%xmTi4RZ$z zs#%MD)(@y*`W1M>FUc)Ql$Ssm>g7m1KYKRv%lJ!^vYveejD>S(&XFIhY@~;{0laT* zZ7l>E>GA&FexrefgF!x>`71aKYvgC;17|}o*gm^wWuo6jgX8Ar1jZC7d2j}OnI)8} z8cyIk+Xa*)MHCZmNmUOq4&I&ci4ois)Q<1;l(B;m2qU@bEC`4Iw9RN?kjje~c3fq9 z+LoSf2v<&SckPpIr}x9g%N5X62Eo8|lB%QhpGXsy^5`BCWMiQrJj3WYjE}dM3w{1ZC zC6J`5udh#M)Pu8v1xpp25aZVp@cre~hZZocsdy~`Olx#B%={0>vScAYiRW+Sic?sF z_JVWf-~Ywuv}zi6+Uj~%2$vU-cx}A26cpU7J=mP!13F>AwRm}Xc@=Qo3uqH(2z@)q z(C0mzW$Ie$=fMsg+-3C3==b4jG0!iqu54^vgwg)n5GOKDFS3)JGvV? zWXtS|W5^K02><9iAsCDWcjgeFAMPIw zC$M+)6Jzm6vH}C-vJTCiT9g9}y77-qOg3`PWkG^#4!$|s8xTPc4-K(wKgNG6vw#Zd zMZK4klbRSCgGg~C0gzI+1@t(vMBUHV%-(`bSY}q?wn6ydE()Y2qnA89Jo&#|vZzny zFf~LQrNEj{e)ZN77Bxl`dPs_$j1&|A9(%^owrhqxG#6VN8;>a~tHlD6tn^?$5Zj(P z6LZwo+OT*^E@E2}FRRJboIwLT@iX=d<2_rjRjllyU} zw9$Z#WS0~G*uqMW&KbYNQ@8f^4uyL&MhfrU9?Bk1lVUbdvI3FEq~6`aLK^_%)8>w$ zRYb)o02=hWtKjsx7R|B~6>?|@_x!w_hZl8!Uue*IXl5xlIhlw3;!ow@2vsVIp=J&) z-7eRggV7YgEBbA(Mp14^Mq6KNRMBd+a%_xN6JVa;#QFnjrG8N|F8iPC3mnXcTe(|g z|K*5kO@O#UC_1x~<2-4xPgxsYTI!^P zlPy4>^6-GzLnRP1)zlsGj86UnAX*MKSCR2?{YQ@NO-+zIRA&+$t;)V})S_Z6`7t%&N`tAe=98-&|h*$uu#167Cw@)F7qST#3`2-C)DB#c=#hDQdBcVO(jq$N*+ z4{@?O*17-wki5X~4}E1P_&N&vtUd#+hbu%`$C*amwT3)`vZfdC6 zcz|`fiPUm)b2BqD04`{&nJxD85C;=4v!jLdf#={8{n)$0i9y;r=_=_-$G7%C0@VjH z(Uo0w*VX;Py4y1%zY&-7%AHr+;NrRY7$CGXp=_ zcgRHuG@Fqbp|AFV4!xx5o>d8XR3YS^2+ZWxj7cyrl}cK%fKqi`m-z_+W8i z0lb}pOGaw@>im+X-K)N%fwMxB~*mj*ESLeN(%i zL2AEA3*LV;nU|OGQ>rWnvV2@6judVv))UGG&=9)g3;KicwKyMITTm$@`sH&3DS66} z{wA~kx$(X;Bb-Lg&;QW3S`VR^E#TMI(b3UaSs75%{rfioFX(VK5Pf}pz&mMpfpkf9 zNL+02{@u?o`9KvP0D%pHF+yrth1^>0037KzUx1b&tC6wVn3mQQ9Q-{q)2ia@TInhb z{@DNS*LJReUrEtHNm@zOuJ%pbK9%AoeS2zdW|;KR$t)R{tju+_sKr4!0Jh+wZsvAp zUJu+WE6`xXs--(SKLf3&6W8b|(Wj9lebr3#Eb+^Qv}i~ zHt~%-b4SNsUvbPaWA^#!<<$6i@0Q=u!XMEHK~r}OjK#RgN){*BOs&?mh3PJF$twxp zmq`bIaKvh?ZA;4o{Z^o(6Ie_TR*$DM1~t~-@E;!KLz6YD0lezB9?%OMSxklw-@{u6 z|0iBKba+fg2twfT{$u@RLgMhx=dMQwdWEWaY#j9YB`gf#A6NGWBJZxdyjy?))-9lw zAGvtEq}Kyg&l#6)9)G**XmaXb^^#%=aY@O&;{-*iGmsT1C`?A} z;JRSa)SRT71GEGN&6=H&2qN|ED(yz^$?`>;H|PkN@iFGisT@Hj5&@|9GfSJ*ucKdw z&Gwc0_2$#Ln*d-YBT04k79aujb9dOSKW1ll1ofgAf=@rc_ff1c&)#y`tz7Sb`_x); zE-gVd%Bfc6Dy0rEE^;kV-Lcpo4#9 z+voM*&p}a91d)Ga0G)beV5$i{sJh4HR=w{_^vKA`>rhE-1)!&1tvDKS4A2~L^yL${ zK$fGa@thdCB+%>6RqmtwM#RHT$MsYYK{T18mzbL*jUa4`;P0{54fP+5X*YtXO0&y( z{HPM~p~b|WUa!g8e|N7foN|sJFfJ%aAQZ%QWWYkVTi^Fmdv>lkCY?zKGY@&%FNrUn zKyY<+w$tMZ{1>N#f{a3WRh3xL`T3Q&tLXT4y#*4MB%_tB?EphuwDiIU!0>UL*;$WQ zl+tbY=Z9l~vyrpCk2_xmc?P7cz;(4(xA!+u)$uZO>)jAx*C-@rw!qSBeQw`=hg#HS z*J_2!7&u~K#dN-WRl5)Z#`6a9t7-K5_~4M@DFs`(gz9i?96kur4dq9i3PBqk9Y;e$ zZCPuv3-@$8m&LLb`}+w3@kYPP+sfv-;lnM(1(W)s%_h! zoSgyboXI&e_!L#;;RrHP$(U$HBG2>AvdEUwTwm|;BL+=KS~|Mx>WvPq;H#*eWDc8U zlqMBDfSROX&|)ZTZM`;`{LAHN!tXN-EAh-;w>vjEJ0mSiMc22p~611zs{p&$SC4z8`uK~SkhI-9!s z8lxVEhf2D+x>HbzBRzO5{`krNFi{Vz#UavGUXMxuB-GHrpvmv4(VUNW7bd`F33qjr z)K65X(r=W`sP#A|TYWGwCTs=1KR>6E=efrVDkUr1`?Wqd)8aP11Wo9f zUsHpeZE0;Uk-FXDw0}3<-QvC}p<9<;jc&B1*=9@g@85235H;(_&=Bo7odTht*Wp-W z`5A7H!@rKcme3-ur|vN5BVOW}Cc7RTa|z0+;G0fpK`e1W3#lY=%gpLO=M>;zSS$QY{6Z|FQi&x!yEPyQR*8YKyNAPvQHoez7 zDy7K8(Efd9n|EeABD~A|;f(0(r1X5*{^azZc2{!nxviMhLQ@BB2s zWX;~>9Ny?CY~x~Tgy3`j@6NxCjd$*LqO*kcid7Fr!Ey!*L5Gj6hlWdqPdUcMt2nQODK5W$%x1gy}z)fr$z0c zXJVxxIaRl^ay7k=0ZyCQxw;6NJ>Vu=*+9i1;6K12IXnnE&I4*sKlI#uzCNF-&{N4N zOD?wR@fH*n;_>jPC_n|DxFvqKWep*ob9O%W0e}bw5%Nwgm5IP}Yn$1Q*>Wd$?ilZY zubp@T-dbcs18K!+Vp$3%s%D&KSrNVh3Vyv!7dSXa_mv}@UJzsyjG*NZi{nzkkDD}x zUrCpV*fXa|mPu&U8k_uvsV5^yjD%-` z|3vj%UH;VyE&0Vz+LL}KwxMd0iEt}M(|*sK8vj7jb|f!>gi;!x3 zI(Jxvw7=u)vMtciu+Xs32O0L_ax^eZwTndjxFP<2BXZfloSPi`#0Tl;laHH;rU_v?kE^jL~2+MUW^Tt@Epi zMgTI+@aOyV=V|u)d-LPfS46<`8vuYa7Ee%=t68v6bPz1i+?O65rI(Pkp~E}^9Dvy0 ze+VwcocV=R2`>qo)&J**aSO=OtI-*3_j|qh;Go!cRr$r`dF8^vPi6Qx(@dCZGPnf0jFgn~!WSWRu>0#Q7vUo0V4l^pXe@HMgqhJY zYLHaAl>U;ss2?KnCGYWjSInjRe@S^T?C?PM4mI?RUJ}0@I@Z9oM}~;C39*P7f!zS` zzllWT=aogAOq>e~Qayl?7{LN>tPnT68|#%M?WYgucVzylO_?TDZko05Up=hj8^Kvpbx| zQqkd}W{wzE5by;p_-ycB>=Ns1&mbc{7X&HH$xsvOc;~2PTJI09ZRIsn~$KKPI!e88XhE2hH*Nsn*_|4NRf@usX<~U3*`1`J0P#7@hafT=j)8=b1zjx zKa%r(mn~3 z-%-8T6v!@%(Z$c*qs2v0==%W4dad9%5Cs);f ztHJ-m$OpCzch{`tx!EgOhvNd97doJ&iC;vikS zsETN%KYsjRmNJ!>SXo>gB~5OR26RruOsHbUhsZ#xy56bwp79jK0|oy?ohzCcWkIlo-(B6C;4^LgFQ`uB`xuXFS|9mf}6J zqIaxvY_leqa7w+hx?4_(*YexwuC1!tB$9>efoIQWj#@Ve5ffCZGlXeBGcPY4Sr-FE zEG?Uw0FC0*$fqD->;2Hab!v4H&aItmlfYXf zep$7{GND2qUX!Bfq;yC_zQ^a^F2_fC+&4GSL>)c{C%aEu0nL?_X8$(6hc1Jf4EUuC zJ_4nfkJsgHS{fSlS5H^;dngoI+P~jAKI|7SalcJYjwi&&LsI1nKnHHtL5%WFyx;`{u8~K zQ#nbJ+Z(zvQXGSI?cR=!iy>vA)*JHIbj?OkbS zMXfqenD)!+Uq?^feh+Z~P3?Q? z&*V@`Y%~n%CE`DLY4hA`D>DO>+f9gyAGr6=0KembR6X&Zz@ap4Vsd=U!g@iQ0IUP8 zDMG;tln_UI7`Eu3R8w=vHVkGRP)-g0$89{7{arkpK!$G#w-C}R#8I??ATnN&z?+oL z1x4!Sas6s%$J6FZhyDX#Rs_1o_rmmcGB6P-)A)Y8KK!U71u_2m^#;QmSW|9+9Z$WJ za@dV;W12YmzcyoZ;JG2<+kn6#)@CI%9$WKlSA=TY!f-u?3qBd_CFeyE5A(yoj0(Zb z0V&RIUs(vf!gL3hOTJp4oehTz4y^&mP6*4)Hids`nSteQ>`Rf8(|@nB z;{ESYPE8v*9x{GM85%U3PhMo>yPnTeDembeM8*6^c+WjTO28k?n7B$##%rNEp3cL= zLkm-nln_r`-kG`XqmX4~tCN~C&(6uw`^9NDHaa=T|I)4zAlZgxCTO3UYHS|JpM2!e z9$nFWhxp*OBFKW}(sS_+EZ3fP&kJ5kHa5q=H^wUilKJ4Hv)DBMpMKJJMZVl zU5=(Yz1582oPuEwmW>?B{thP8_`Pu&pC;hHBr=QAS6y|!Z3Q(WB`SgB={2Y2*FG2m z4VE3f4rAR){E-V4ySt$DD=iHEH{%9G+}HmO=`^Hehf}Yg_Z30#@ztLeMZCa#mV-sH$TxI)Q5XF|5>qv;(MH_zCvso z<#jv8^ZoU?+7!S3{>wDK+u^Px&gxHY$q*0w{pC96F$QMaB`0+P;&YN@-b$BA%!21E zt-#LR$_TYlMiK2Ej_@4#m*W-|CdS3)8%!&dfxp-N{Io#7dXVqkhRZanj=rjnD91Kn zhz6j&sPXZj=KCdx*sFMWXHF0otylVBRD!RjfSq1Wb_;g#In1 zrRj@MytNz1w7n=Nr>8bn|D+TrNvSck(v(ym|KlbjLz_DI-k$bOcjw0+0ElaBhHuZL z^lgSAtz$NCz~=z0ukP?@ zHCgOU6jknk=yVROj5xl~0a-dyhe5YJe?k7hoQR#m#u>+7r!L2U(fwurKxxM8BB5k3 zj|eaij2%(Xs6whFgftQmrZxFsJpK6t^KvKo(jLUo+O-Zdv{}szBG^|3COYVy-tVg6 zax#_Tzkf{iwP}h#+PeBWZ67gKYDddwl1gTe|IiF1Lkm|x?52?Y8!635 zPdjuUo#eh+hcQuD!^}m-+u6cQ)XjWzTm-R)+w#>5&05Fi)Yu<qdHoy00tFzM0uj}7~;xCq!KhFEZ z!Gt&5E&TOKoNlR?Hss?bC`Rzd)6|kM!qEqROSf)_UawE(nBJq%cDucCN=yyykQI{3 zM917LrKe$%jWTGF(z+?w3oA?0WTHQp&KjjxYgVbbP*h&IG zOM~%_6_5(t_2BkB4DB{KcbLR(`%UjA*lpvxnyAEg19ausk z?C05)jg-Ffi0G!sO9to~SzsQGnEZ!gTb}!f*)D=_tJ6Cua~rDT@iLW4^NdT}C&k{J zS7LwoLIhrcX$hI3`um1@Gsd4+^9#RMj4tBCMY$L!z6R~(xO`%na3dUYXkFS+w3W$8 zqe7ex3(O2#?en4fySc>))ms5T}40%Tf2NN+)Y%0ocfWzy!# zo(7Z)i^V1~p{6q~PP4D5dsi z2ilRniUCtOf4?~ov@CH9>c$PqTKhkBZ#$^EnAGdji|EKl=ucHdlGB)LgDh86Fg_`0EV@!=qW!n3yyLV z#4ll8!z8Oxy~iT=5Q;2eI26?AY1ky(FqO5WwYC;!a&pC{jsfvKJJ^!az28pBidMAy zSxsKqa)?>8jNolu8NuA#e32mNmX?K>&x7c5TuofXMX^*{;87f@^M>Br6eyoMaonS$ z+iGwdYJpTEX?x5I8mrFJn65B<1JScUT9qEMyK$!Ez4AS^ZRr4t46);WP8PLkZsscn!@kbWM_p(P=8WJqUuf;%czr71%{h?%|4?1NS zbwRGR>=St1y=YAhj~AZ#8Dc2S>RYQY`XIzc&0p=i94(r9ar^G)kCo$T8dlHzLAKh6 z{5Kf&zccLJZZ|#K?c<_nFlMh#@=6FZ&1`BZP3*B`BN7e7{ga)=rI^hzCXS>2ppmMM zuIqBES}Go}c4`h%f)Hxd#o^K<%?zBtL}@NIBC7r6tlFqypkqTUgOdm*oXL(tE3wF$ zpy3>sHNL?5~L1B7uzMB6rj_Tb@WXjSAa=fUf!M!R`dF zj02#k-@rwENq%yQB`ii@IVq0*t;>BdZLQWaei@*gq4O-~9YF4B*sl+_rYs?NiDjJ8`&Ys9%Xp)e6s4E?kU)|p&49~Ue8a#&I*VkN5`4Z$fmXdS>*AS^#ORR)CD z+Y&tfE@<-%O4HRZ3L6p@BV5M>=d+_<02Q>TCnvv05AwO^N8p-y_vb^kGA{CqybH4u zk(mg6qJ&qvrezo-t#^EEKK%PTmSDg|?Jz<+`&o`9?OLg9kdkpJ;yA0VOqZ2W$D+E} z^UoTFPKB&OZH`(VJh z*K->@jK~>AL%sTr)F@YnD#6`9lCpw~b8RWho1jihqiM_8IEk%1xhgh-l`fSe``ODg zAtN<}0&=r|ikRp#b@@=F;<(`Zr9R;*F#Hf7h;n1BZD|Ab2fyD@*R@W%@7C-_yUZ%j zpooKpsLl6$M==jWkjlKoC;KCgyd@rF?u#2sql(svIhoqsKR3mJngbV_bNVv>?}y1x zSn+l`r5hhoRk57j#0EvcL60@#ASdeq^K7kc zO=u+b)x&#=`c^4Tp&el$tW`D7P|lf$?T1l5Sw8_$5HhFtHh7*u+UPstJih;6f>Sht zxa5Q^JwlpA5iE;`H@p7;g6pOIlG3kn;9KfR3_#8 zs?x-fTYAG=12g(n0wqgBqR{pS8Na+0DfDxgqSy0YlUNFt!Sbo8;gMG#DJdV`t{ z1{hp7zN#!Oh{ih zOOMyXivEbF2K%``b2MU(QJ0PIWzkh_ z4{5IN2uuwuOVO{r`aLKnd7YEk|5#zq!4&@5B2q>k7TkZ4p&?bFk2DFs`!7pGVnF~3W*Gie#lFJiGYeY()~r7Kr-n(`fl+QCwYGE={}LI5Ul zV{3)O7@MYHZNkQkaWX+$im@pJ$*LPEf19Ic7%nI*aBgD^!@HF^s-|V>SK0&As6oOO zW9I9axL|mi3^B%R6BiL)I>Yf~QX+*2E02i)mSI5fT$DB$v_P2heK8~(K5Yb$*prY3 z&}}v65TPg#3h*HXZ!A(NwPH{`%OJ0#ocYKCtpwAonYEdwUL1#f{R8fAnUp2|QE^)3 zFf&?1Pko7rH-205ixDrBz(P-LyC(DE(}*OLM?%m9#70o@Ogm_F#!aZ;7C}pwJrHJG z4s}vk;{q#H^+y@CVSMGgIuqAFWmoZ>ENFVe#fEIulEvkask8D#oqigRxkAoU7|EG4W#-t&P@Y@k4!( z@LS^n(9km(v`9kcS7p`mk;SFsT9~Da=`@T8LWy^|ndNH`?*_(hsZlboYo}t^%p7N6 z2_mvOI(hxELcpOaf+C| zmas9zRAAna|47)S(nj}*C6ZaXzL7xwHLsH*Kd0Q-^^_ zu`RHSur%Y)HQXomGVl+-5O;fu#0(Q$O??sqyk|O2#=vQYkIcZWa(u(2c++Sz>bZ|U zLN!a{I9Gix=7XP4d`pa&vE#>v8Xs^1Z&aRbnEFjFW1Oj@XsIf1SgrzqC7#4@D!Q!% zjv2z4mr=^BKL`j{KC9owze)_Yq#H;0A+0}K~4wT-$% z)WMgV5Wg5O0&bGoSbH2bayGGuBt4`vd=5t-h1k9TY)n=g+Bq*J_0eF5<+x}u+ivW1Nm7&!_ z_cXSAHRljhfefP#drpodXQ~l_F!&j>f!=KXeIzQuyk;IVTRhX*&V4IpXu8H!jqo`` zb0L|&lLYw1Y>wnLNebK%3fxtISLMr!#8J)M1TH18SHq4B2Quu(L_Lf0XZd|`Dye(OC z!uct#i;YACB=L+$UmT-gUGHUS+4E>RhgR3Q$pXu9qa8eBda$mH$to(b=$5b)VA0XV zMvaX@=4wT^fp%)rh;1UtWQ#phhcj=uV%IR@!K~}%4s?NqHg1jtFkZ|;Ti3+5rJ>Pm zNk|+F3*C#WEJ4&954`2(Z1Aouv);yJPR3q_WOH6>{Frsg!Yef&;BT~ibFDFIOEAxm zn`M$3{EeuX{5(m4+em@01K{HdlXdtLG^F_eZy`;>l!YTNM1e&iO5A6hc!$OC=G#c~ zMc*n>;gm7P)OR)4E8m=tSh1VOhWCMdHjuDih& z1o+s7ntjY>-)B)PKX2q_-zEWm(T6^H;kS_jH_w_ENu|3B@N>9N9N-gq@q9#&Peo&# zXIR)AjCD5G0N)Arxl*!rYK_ z$qSMc_yeZEf{gt(&G)VY{G4%LYi)y(dxF1U=cT3cp+}I($|~Xyd!i24gMN~yrBfPNRnRvkS>Bk$xD(H z_`{*VB9FrzQSPRqe_ju^HbyLhk?rZMS8)1B+2s`V@ z+)4TWw$dVbvm^z+brhHd@QXO(x0^s;H^ATS`6Ta`q`)_t0`mcW0m#3Gc$AcyzR^pY z99)tD^C)mVfS+^mB28pBN90?|5WBfYB(F|VAW4DSO@SL))Nl6#llMzfAW4C*MgbE< zGcStvtKIba-%bMjouqE^-bo59h5~cZ`i{u*iy27rnj{616u2uCxJzd|X`;U?tC@UA zk^+VT^Udt@b#aqgX1(U6K*T9|msmt{<&qRgQsDQM0!e`XeOVZ{nH11?+GITZH*;~4qe@cX z8$|&a#m)1IB*1^8)-XAkBn6TbNKzn4fg}ZP4+W9{e|zYdyvx@^0VCDkP`16{1z*qT zzfDg~T&bH^M7~XwO3pP&f!jubufqqQ7)WgT$6P-=*z#2Be@t5{={Pn&5NS?;@&XmY zZX4N>H@ZUvLWF1^NQoQ=;1Ho_~4S<9oy!*78*a$kc-*YfL}rhQ z2h6j2#=BhJcmiMh6*r{df+JkaA;0~k|JsRl8wOx7ZV|Lu#3hR!PQoJJMS$0ikyoe1m z;AZ34#T%-F33@DN7`@WKLibyxt=wZams$)zUGy@|y)e#iZ+M3UGRU=a`pVzxbS*TR z^YrUraLtc6pMI%u;Bq`G<0@4F$xxc+vC^T9-Jc$at39etdcSN!L;8`fc$eq8@>%#yoBL5aN%ibTSU0bF-`+;+Pf+x654>^p3Br=5TK zamdT%^`v?{Uc22H3}CRw2Ee5l?fEh6!{R>Z4{9DTioN;8(i)7|5dTqjXTB9CMsz z^&-8swWDIUk4Z*}`{7!IU8Hz&OGovVzBFr~iyB=*c#1XSSgeU4aGaE}({mG}(n}Mr zPuykdw2yz5a8cqIZbF_m`y}BNU%j~qd#h(;&iCdYnVHAW-8qX|hubu+yMCKFguX-M zzU$Nax*n+Bo4ZHE*)0C90(>NjrOpPfI~`!S4a0jN5RjS2)OUg91hcnT^W`-i3WbBg zu-(SDoRJ9TeclszMwwSntKzgkzU7;>RJugMs?SzUg+`W7z`8l0cMBMp_!aBu8-ZmJ z&~?LYcm46q;jH@id>uP#HgMi7U)9C`-uo1m!+)7#h1W5MXZCC z#4S#_IV6h>aW06)hpyHDG5g2dFIH&fLI>un95e=y;Kx%hV&a-&>`4GT)y2$_vi9wq zO>Q>)^R?YdB!YXoyH_Aw9fHk6CarRFXBpYf&s$9Ib0qx0jLxYB{z>VScf1r=Rp>` zxB)=T)`^YzR_%C+sH4B@(#Rko3BN}TzZ4=_BQ(KCj75fMz9ML?_80TT_-$q3to<+@ zir}zO)+P=bp}Vk>MA<w;>`fZkSjp!u%sOfxUtesYHx-ORiC_B^F5@gT%^W#XQRuTjDXnOeejN#F@{HjE`$ z>3t2|EZA5GJ*>?VBiF14#CM2pf|;k!5mI#4=AnkaC2}+QGqz%8oF*v7dg;f>*Efa& zchLvWHi%3Q4G;D8^-cMvfO&J0aI0HK%MM!0_EfNz&+yi}-0rfnvh?(HJ%Q?8jYP$A z@6_*#!sc4ovH>!mEtBn=t{0WoGC8l#fX%BeGtKSjTfYb1V}EyD1(-cul0B!k#V z<=*B7ns_FkS|7!tjpku z&AGtF;0k5<)<(b92}HJFohw;$y|FBo{1qFpwQCUE zCE+&yvdndiBdh}zbzFCo?gKLly_;|$Ln57vwbjj?%pl_nBbE%M9t#>KLod1M_}Ex>cFs#Lzr1tjy}0Frp^(Sz zX6HCvu|#KEN-!kK90_+(NtlP12Q^XN6%M70jZS*K-qbXg23*GCRz+VT2}cQv@t|lnL*XXCk}` zL0K=i+ki(n%=QzLl~6qdrPot#>OJb_r=Jv?_ zZT4y3gXw zOk|BvJ{%T$6EVwXl3ZEnAW};x5b{k;dE6dvnwJS0Z5s08&QoewWKo-t2zK$U#Ur39 zQy`fZ#AVpBbas>nfo(YivaTU^N-!AW%PyB^YRd2T2hbT@E;px7SI5e~H8Ah6J2cxz z_OKjh)j%xyEOwSTGOV&}Je65lPcvr5V-kPl9bpBkv4sm==PxB6sQ^qwtIXMZn)6&xn8zlINxj0>H3_Xmpox?m-q`ef|*w{Fv zgNJio&B0e*F0MgcF5Rn^)T5gt`MNt4hy#2~zHTBR~;HMmHt9N?0rZYiw*edh9qyC_g_BV1RkEtw+a3Po6wgeW^A*J=5XvC~!D@ zzDWb#{L3z9LnD8165)m%#y}t_p#!|>pVIwpV-}o7f#>Nctb+4nPOsRRBT<3~#i}Vl zD0+vy2QqPzMd@J%uxv1osDh9jEf`@q5)6q@A`*ZtMN!}5oy#e8w?>B!WyT=2^0(v zO-5)1ex;U`jZc&7cJv*VmtskzPH<`PJUMUw!qJ=bn3R`;P5f@7c=h zo~`$6F|W;Aw(zU|+;h)8?7WtiwhbFLu3o*`<8h6Sjqls{*@qu~c#wWg!B`~&m2B{l<@nNt5ygniG(~}*Wlp5{sRZ<>YFk%a|Zf{ z2L=ZU^7A>&oClZ-`yS@Z`Qyxp?xhHjn&xGX8x4$eq8M*%kRon#e^Hy{3`IFYLqo&O zjZJ`bW=19~LpXIx3Q`592vdULWpGb(__;k#;bKlXEXi;*qXhG5c2;(OfB!r0yjx#i zw|VoHqM~9Lo$7^xG%gSP6Q&?qDc=Q1l)|S5@SnY0BV^azEY;ilrNk=-__NXmzM`xe17mCQ&_upZB|y6Xgm^A zsT!&RDtCkPiJ3>F8NnW5UNCy6ECeb(!3FSW(czpPzT-#QOF>Zs;R47$sa{V*ecgo% z7coV!D3AuIRBoH%aJd2mZ-#=RD#`5ZZoxDjC0ttx>tdCAd;2a|S0iiY=Hz0|05u`A zj4EnP--t))Y3XL?V5mScX7Qiu^P>GE!Pn#^hxG zsz@Q4l?0!P0OVpwUKfxE8DP6?Fi6L!vNC0N!GC$*EP;R}P)EY4QaHpUWeO?n?QI`@ z^igM5*ZTGA!A`MCshXz(qQJ1oL@{Hp(GJC&YDj4>-9Ubqz_a4i-ZtdEFf&#uJ79$Ot-~yE- zIn-!SoDxSxJOkX1A#OEg)N0d1&Y&RqAnIooKMQv!tsF>2$+WPK$?|%B(XGf16`)uF7&%gNM ziz7$+1_yf^9 zC}#ZBG^3xvvobTXGBUF`r|4kDq|09C2&H9kjcsyroH28Hgh1HT@Ja})8(Wa(*m3xw!)azS}!KbjLaOb zHyuNRnm`37)$WFlJ`oH;A9q?>T3&8;YFZ}dMr`nyNpN$()a(uq%px%5gAb*-U0ydp zkIETAG%yZI{LFUDo&xPGaX8hJ3THv{_DxI(M+ZD4c5Aw;qvP}a`_G&{&4758L2;uT z!;{2}tRjw4df`m)O)ddKAkpaPn6XmJ)I1#pn1R6M*@hlXt;2M2~PO~Q+`R+KuuA0FDkp5VMazqkV5LN*7?M_ zBY;7{C5Ow+H@G1f0Nmzg=Q!OWX7L`g!2Fw;nIR&ej8N1{5w;vQ)|&YmD@9Ld=b-}! z&zwAsby~$E5D0+wAa>Xh$RH(r7xne5YzEUKd)DT_gTSm1^}rtFSKWn>(50Y;h8i9p zADfsQ!@5vgTZ2%ASoz8;ukP9N0M|nbRtkm?2%_v#ddtTSXFM36Wgn_=W=_zhi_^V9$DN9}z|1k< zaClX|1nk+rGJUT%4Vw{19x;kB=j3K*Wu>cmhNa-ds&=j~HWa^OH_gh<<}*gi^wTrE z%xq$OYIJNQ81!LkM2aGZIU_wI)tfFNcRX-`TZmjt5;F#Wbq?DT~4G^SsUZ*)Qw?cy{^<=xp?Uk26_|)w1S4l#;aGZ z?ApEipZ(Dv@7}YAB>Ich)qr|>Mi#in0du=h;R2W?2M0!c6QP#o4$dFCO>;}*$jE@( zV}~Er%bS-r3XLd*y0fOKU6kPq+|<1eBHI$4`9uIcF@(;JXXoZVC~yhN1i0Kz380bV%Krf-HJhnFY+zuZrL`TQyLX@u-T?E1 z-63G1rFmRVjNSb`y;!8PGBPkwx3{*|UA@}g*3sKL)ZN|J-qDqgDZ=e-XlliX2d~Y_ zKy(3qi~?K6?B55DS`H+PixCIH8EpqV>8FYLVsXoK{Kwki`l z`g;4YTeP*eNeqfN61^vjhGxS6)sVLO zQgwG%7jkMwW~Les9R2+RSFT*Ct-Zp4k?#@fdwY8t8icWQb#=1mb8>Q-J{z>Xy_?=HcoHD_ z_LA(b0zBItPQ>xsx@~J!Rh0zV$V;MT6xaUrT_Z3|K*)`-r;V*VL8mJtOT4IpBO)O z?91Q&?yWPY&wcXA#~*$8(WQ&knHd>nr6n-gef##m_1oX>-@ott`SWO+Ma3m!qvIcc z{4reM%9X3|#3sC;Y?d=FpI7)hYdm9=X-hJZ&n{U4N{=1*<`vl5YmRFYK7oR$L_Vw4_+Q0wc@lz+edV7jW3W-`k zqb5o$5)52Cf9~A*ix^Yu8yY|P?9(rg9{cFyj}L$O<)B*K^Yii$SwMFbkiOoYqlZ3! z@4dG_{cQh*3zvF&`{9o)8GNy`tCK*11D_v&4#$okMeM@^iXZxuPd+{H`RA;1^$zAp|PMk2(_ zgCtR1Q~l1{@77$d*|&fH8*jV`?t)Mi73COp-+1Hozx%uYiZ|-mi4y|@gR57s*|vQL zpE4JX%L|`5bNavj?cYMl<42FP=Mh2Jy==ud-h7kQLDVfODMr&he*7pNF~m>=F97?} zrRtL>P9f2P2%R16+zJ8i!}s6iaGXAQ5)>riB|k5p>wot)=jq*j2M!_{rlw_7R93O^ z!oevV=$ve1mA8KTyHE6W_Uu`=2*GJJHCK4b(c{P8dG|dwHYT^q%F40Pk&i$6=&iTj zLVM=QjEoHUMr}uNIls&K>uamX^Q!?)z8(8OaA9y!-CE?;v4tPPsXl_v?T9_22#7-yJ@D zgjJ);7H@K#Kl$|2v**sWwYT^6_aa`El$By`0>bz2+s`acojP^=%cD@Nu%O`dnKN&_ z`PPB``x+Y>Ie^3!VRu0YcdPZXYHDi`juGe&9{l{Z*IxVJgZE)0Xb6>+ zRadXnz4_)_pM3He2Lu6;wPQKndh5;BmNvb~$Xjpy?z2z#9X)!i`qE`K;c(&oRN%r%ysH7!kr!c2-_VaaC_`_j~WZ z^S}Sye`Qx+xNx3rV7#QVe7}2}VVpQ|3fYn2S5}tw_Vw`2Km5Z#e(>Q(r_Y>2Ct102 z_3qufys3mz3Yz195xl z!3m8cRfnJI@>X#&FdlUuX%z1)FXHEW`+5;Ivvcw)DwmCn5`cCAjjg1toRH4$?w*aC zw&dq#^mf)AJM!hwz(`J3@s+DhC~eD@RiTDWPLA~T_h7$5b?fdP$jmIba-~hIRF3HJ z6NiwgS1ez#Y15W9Yu7DZu^cNU3Jt+7hYlTl{q@(eGsB}fLS3C5;?PPQn6agnabLI>Y$w>5vk4T_O zW#tl%I>?9HJ10A*y81GF2R(rImsBnd`mqi~a&z&}3s6Q_mp2TX@X}AAUGCKDv4H=E9;vtnC<0E?u~c7 zp8F99P%%-rSFT#c#i*gEk9m2yFzZh~{scvB<;qos`S~y!4UD&a^znxXMr@w)$}*U5 zZcbizN6(ql7ns+wiw1 zb?aBJTro91Nf;w$ls)%9KoI<~lcx}mmabTVISLi3ysWIeq|ocZvlE^U6N@Ld+`NJ! z)JHrmW8-6J;dS-(sFf@?5Q2dRQHj6^+}K2rA&h2bXW?TOCD`p*y=KkEO`9>E`-X5mVhV20vk?dKu zHEY%o55fI05}Z19lBprbXkdyTPJ-d-qmMqpT3K1X1aU{hjPkgqv$GrU#7Xq|frFUG zDl4k``v);_VqQv3b#-*KV17eNs;NP>Xe!7rTDELOT3W_H{~$sD&IJN3v3?PCz^w-Q zM{wdHb)7za3Izt1xOVO8{QO*&b;*(?JVm6^sld{uE6U5N5Kl+PM+w(Ce(dmxlP6fO z&6~GYlrLqSk$bjn+lmQHob{UCskJr?jwRFNZc<42LjZX3YWo3fpbkNi{Q-NGjCRfa zh*{|I*os37cQp{z+|&#bpnnh#1AYOA#K`dV=GK-&M~*bLG%sJiV)Ld=c;?V4H*VaN zmz5g!4>vV5`6h#znfaYveH%7z`svSqyz9R0IGIkKKEdw8kY#sxOG>InMy863a)*a{ z8tQBAzyJPMzWe3S4RbcmpTCH#`ph%W{q(0lefXgVCniQP>)|3i zeda7eJrGRDKXx`$I?mZ64?hfok-PHvV~>6R2e06a#w=D?SilT1LW=)2Jq=XDq=%Ul z+{PV3=IZGZZcpYGVPbIsZ{MWqE!+~Jb1ran-U7cL21woBC)(GL)=zyJO3Klj`V zD_5*06%Hk)q__kwlb+_rJd5!&J>AQAu3V`@b^hZ&`R98ddwl)o%@~R=oWBHM{QMU` zfBdmWak92HHD#uI*Q{D08REoJ0rL{>G(9plPB=3LmHNgeiC3~aP8>aotnro7MfGHlgCU)7)8#n&+XFnzU;ndkPSWWo-iN~KPDlEEEQ;Q1&ISH@H z-bWt!|E?9_iWkv;~)NL`O>ABlMq0kc=E{~{p2UR zcJE?rCyt+B{m`Vrx$nIEomXCYW&8GRSY;7RSzo}3z54y{eV?dO+^QLFFGgv={>MN4 z$@t{tr~5u5@$C5*Uwro2=U1;@nV*{jsqv790#j_qRBsv)rd{1gB({N}VdOA8!N|i% ziqAgt?5nSSZ_n=C#A;#e>aUAitxTp|EIMO8h9EU$zI4&W?p!CeFp1%Hzmo8^!WpCQFIVZz|RjH+^8Pft( zx^LI+AAJ7@o44GPn_tl0fmf*SsVAR)Mq+Pw;Niy30l?SRT*lt;J!bg5?_uIPcJvr= zvKY)Td+dGm(I5Zl$Gdm$#w&65>=|SfmZQGDarf>$KltGfh}%Wx$j!yQZ9_Lew(RWa zVnJ~tY}>knL7qBw8X@4BXP$of<>wL6Ff5IXA|d&Y9X~;!-@o`5|Kgcvp26aH{yc`6 zlzZ>JkMITjGJ79;?1h(JEGa8N(BV_)f9c`{4(yMA^rM%ae*yQz2OoTJ^vf?1N%3N^ z$#E^J zva*Vdj4YT25|3tcNQv*qAK&}k@4kHBefN!yPU4H1@&(RcI0rEQ#b5r#^UpuKblDO- zARJOG|8Kwj4nkx_MJ1^T>@>`fL=?2PHo>lc_@f`c_`=IuHg8ASKyci$Wm9^F*bdb> zC<#N7EhtvRB*1@D0RAo-QdoD@FA=@*MN7c8rh5{@BI>(ISsUs(ax<~;DXUmz^z%SnzkyAG@vdgH?yj$vam1*!Lw@V zGGgw0J`z`?@U7;!2T|(>26~X+H*eYu#vnMu3rHU&3W|S2Arf;_*R2Brwqa4v$i%~% zCL!WcsfrKZY;JD4aN*q8*znS&OEC4Pr{hESl8X`y2eR@qSFNhruzoF{o;`OuKR=%{ zjDC-Yf>{u84F!dOXB?FbV&{{HD4r2Pzgtb5=IfX8$-fF58R)fm4Oy}_~4GC1b^kqUmIFKS5#%O# z+~`|aYcUwWUU5HjH?-A_8#j^`NpNFT<&x6kl3bLpv^31@8#ip^Q{)49E~+O;{P05$ zRaTbc$~th`@dUcPGe znu^LwiFcDcW?3!_0C=)DZCwA*Ll2;19Xb33?u(utJhDzr;TtgKGHc%YbuUm%;9;XJgMzRN+SFBipfOY2V*}TC z{i>x)nF~%W4BZS8HxSuOzzLwPjQzwh4r(CK@6 zdpPm0sfbWXdcJ&m*{piQ~U7EG)tXz(e5!h&aR?Ksrby z;gCIm84+^AUo^%-YHdMJWO`nJH-i4AjT>_d@)?HYvrYN2?K5{gP@MGgvT{xh;vF;C zv~d$wI?3WonJy|Ugy74U%Yz_0RK-Y+%|IqvT+9R+TR}k{uKJ3~@`A!VG6@K=Mb%!h z0*_@CV?*LW2!jp`LxTT_i5VN4^!bns;4?(?ka`MH$vNg<#5int>`A_Y7y;?H1N;XQ z4%26|aRjhYY51ztPQW|>4Vf(WNAKsn!>KTHGFoF6GI< zt)Dwa3E8!G?FBGM0XwOrAqlc31R6Y+Vj!^wUlOblD|#cSkM^BKGUw6#whWWtBwqMW#|RyyUHsMn z6sagr$w*BVZJ*Tt2_H6U$-pMPiZ9u0!UXMP+0n_@PPzcGM0T5(SZ;Vb>KbI18m|sp zS9|+=AAH=_(f#9}{;Xojvaa6#ciww{$~TVY^rwINr^5sNm#Q!S-9P>#EB$Z(?Z16s z_ipr2o=El@ybM8&L?Gr)JR|G|r!tr!OP>-YB2UT+Y1+5IiPMgooSlG%3ZwbuFMsjM z_g+4B^4NR$hU?m&e&WTjFS>5S#+P4tarN3Nm^pHz+nIss9&k!?!;6vUxQ`8wtj!Tl z^Q6I?5PmXyk^Nc*_4t>^4;(zS=l7thw4s7BnIGXfyt) zsK7TA7{fsDWo3rj})B7KMl9rMA zum0u#8HW_n17Ci5nBg-39zo&0Xe_j{VUU2`Zb_>nT0S)m^x}L;K()tBpcd>N#NaYg z2S}HeQcW7g+Woqz^1v*Ddhe0X=*CvBS{;w zKeTJl{jF^sufOr;S?`35fMmtKD1m%sc8?j92>E`fd?ua=*XN)pI4 z>~mfOs}q9>MrLGWLnKg^ou)#wL-$t6(XWZft@f!M)cvP0pAo} z5_T7;`SOb|0r~7+p5}17@O`k!MTq2tlY_410f?J3#R#OH6{kYFa*!6`mHo*V!y)7$ z4f}Hv5sBoE8G;f}C>}oFI7+!maMuw1Ao-Hy4&cip0`aL0_q_V*4`8%NGlb?~P&{zp zv(C;olU51`lX_RAr39nwjl!Zzro&uVQ)UNEa7e*4o__jSw3_sEs)3Pd5hZf*`0>MJ zWM~CF+tAPeqI_m%mH>x_Lu;a}w)tjrCsF>c0qP%`_4N=D+SJt8(b2hT)tcg>Qqt+t)6xQgsbGLGR7ZY(Hm3#8)|D&G3h=o}n#Ny83F%9%++;urXr*vf{728Rb=E1V>*%*)Re6P1+Fb>W9=YiXp; zRbE~u&Q~}rXCpT^A4wU#A1FrvXACHI1e!H9HsHv_+lI3cZIxSrHC!!ngJjQp)~{dp z_~Vb4mX;8q|JnWz8=J2XMN6dr{d;yVty%&j#*Rmd7Y6_TY4et>>>R@5 z`vwN^g2PMjR&qb!4ZkTNOJE6(YTtxUcMiNgT`Cg*2N!7whz)31_iOz)BW$K;_ zD1zIP;3%j@a)DIt)6y{1Qp?E6A?l0S@kO8ChsZ`cR9Z%sl=hoovjs5DvgjZXgvD*t z-rh+P0h!{+aHu=%6CCy!jS1&wec2W0XT)JhNfV?+Hwk!{6(U3c0``qfjl|pc_4YP3 zGz|3hZM$d7uKVuAHZYDwesq-7FDxSXLCJI?FalLfA~GTog5(KPXDTZ^Onz1so~e6SIjC7S1YQ&~B)&$MDOKB-sZ8O-&6foOpg) zTTy?PFJGFMmm_(1eptWkb5jk*6k9}7=Wzs%OicQKF)|`~E+D2dyo`r{11xm~`MGGk zlj9?hpF}*?m%$T!z#b!NZ0q*zoC`+V$0qI{fD-_4q$ePPa3u!~O%b#E7l*%SX(ZnE zGKByN3i3%dBX*sL2TstHn)=gcPD4p>w70*HQ;Ah$$IhLlWo6v3tE)!~Gf1H~;w2dr zvnKWeNE2(5B&nMWaw!{x6vnIpb+QZ2ou$kMxhGBdxY2ZhFpdIene#$0xn}80i7I3% zZe=Riun;EO6Ad0Kf~n=eg-{8l98(SQJyD8S&T-81DF%NG;FR|vW#jyX^DsunOw|pO z(66-$#91j86RFTgrYryWDX|mF9F9U{;f#pFQvv?Pe!~mRffFQ2{90&F{4!FHi((rA zCI|)4@+HA08qs`~dLmU@39oHxMle!iy9lEsNvb^Lp$Y&a7b8bbE}ka*2$H1GD!hYZ zsA2O~P_L=9WAb+rGM*O!LCH%NNr78RJiMzKyk(KHeT1ib5LBA6xaEh}qFK_MY)r1KBr~mK&CnMdRlar3{P+nd|CUW1v z<*J!z@IX>6NC#d%LW`S@GEd-HGp%irYWW`QPXpHDye?4I2Z zQG&0qp!oQ)lO%t=^6CpHjvOb-;lTF`@(X}@;*!S3MmTkww`>Ns(Z&9!|LOmZdV*^Z zy95RMzWDMG2xLcZ*7koXi6Jh8RD~%F7_j zmCH3`0WGau8k!d69e#{@*VWxgI5$x_g#{(PsUWgBUSUk2m#Z)RhyVER5n_OD29%MN ziCL1Hy!XNT#F0U|{Cp}1WgC+wJQs%stB{$Fsn!nvLQ%9&BOB#YfatS*pa0E&{u^&v zChQFkh<|}p;x7*#1o;5VKxBFoaS$6ekr|Gnvii=L1I{7z$`!{q0reX%! zZUnJQBs+_%6*`Gd=-<^(QWL&XR2I0*cfb2xV$0us@9pzvPi5r@>n|%VyLZRE6dL&a zi%*FVK6K6b zjo8t)GnX%2apvOr4?q57-xr^=B9J#~_o&V-SspC3m@+fc;khJ1^DN?|8rr))*}os= zj`IG{{rB&=Zzs`q1m7L}{NT|qkCOGUY176%d+x{EYQIV$qbaFoAf;3t`DG;)%c_WW z{`Eio6HbUrmurT`$BIfz0qPBFH>_N?k|PoHPhodhQc+2W8KL9<{y+XNE_W)@7*Z6< z8E7;yHg4*VYGolQsDd38$H%9iefn4b>96vL$cs*sb&1hP++I=1IM2?^qK?!cL4O~8 z^zo;kmKGH+U$Fw|felGy$yruEorKRYQ7P-!ts(CLCo5S7$aTtvq#QlC!;WG_cI?&aT?QWvgo09BIa> zb&x0ewW7AY*SS+@IAZ%^f@@2&( z`5%A${{Qx${u7lZ*c}Lh=q+2fZXX?)ICkv#snh3N4(f$WZ@FjVBaiHU@PP+^_x5i& z>AAT@S(!QG6Jtnti8Z-n{W7d9s6}E{^0Kc$fklM&`X*SBIwx*uca@ya*v$xY;CAi;CRXxDb$C?)_pStX|Wc@Vxw- z6)UO=3-hIl*)#@07uwF+H7m2TGu4X+_P951qR8Gh%FOiiwQH3ggaFU#Rclu+Uk#5# zrXL#_#Ed7QQu+C0=&W16dE2&~u3#5l?;Y%VL{Y}FCmB(j{GlT!t6Fzabd|*Pd>F_!#ad^q7GBt z=}$cIR9Sh2FdYu9oh-XCvU*MG!mI zXBZ7S5NkqIHf$HPz*52w_DIAHa>|M9C#-=edI_ZAKTh}X$oSykFg%rl!)pjw*m_T8 zc{vI?K~gBe6-%mi-gh6aeT*J3D3lONv7_ffD45Og$S4?qY(e3|f&#oJh)`m^T)AT9 zx^)|f(jx2#og*VN9k2Fdk3XK9lik+VGBD5w*>m%9iIyV9YVG>f)b$$}>K~gJ;=A~X zmo8bcq+$sOjdw@Pn$zL*^sFVzmuF)HC@z8ZXA}AxB3gdBxT0*;+BFD@DDp&5P}~P@ zN=Y{COKg(0Yu0budEe$O+p;op3iAu9mXQ2iuwrQi5eYbP(7nDqc8nrG*?IZc23Dn?5vnI*8yyjKk!M zVFtC8@P!TQ*5jO}aGSUxq?n8cGNPW51u#53gcOTmY1_6PTkp9Cki)}`PP=aX+81AZ zfz@Y!V!SOXE?luvV!{!^!CxM_e%)I3Gahar8T}hG4EN!2$c31uiHZf5$W{kC5mQja z*REd0aYKBQ;;&H>P$x(o2h^GMJzKXu{=^gPNzx!mGr<6XxPnm)p_$;9H)5wQDySBPH8Kz}vv5e>WVchm8#<5~3PR&`!_vf!iS^0N&0e{3MOi7q0TIk*P^_e+ zARL7)WUpJhzM^so!YWxsT4{comBo=yMhWsXD~K6MEAQH=8n9;d`sFK@FnYW#?23wt zvbF2hZrZqc>(*_UK=9wg2;gkY5t9jNazxr=%orFP#>TpA=?Zu<5u+q1!E&{JiIk>} z=Qt;GGn80)i$vQahkyCYUn0Xwy-6*ns$yxZDVd_6yrL-> zoXIsOxScq5SQ1P`i)*5tQX_gA(;?AxXnwe@COAA(I!z(~}cO%`TjI)M!f25H3W<5ph%$lbxCjBCC=wLpn;D z*NyHXx}3{{XLe|$i+W?ysNU|(%Pw%(@K-rWydEDOB+?~2hm5BTzn^{Yb$N-avcYy4 zBz8**(=a_4Ivz5TlL2yE5Y&A`d;!8Sg~QNO;W{bKpg7q4>6vM+ROh&FaMC}Xn(m2) zY|&r}N<8*kVs=8)q2niye|lj5>g8)+`R=QjE109lYs09H(+vf6auTmD+H)#7^is2q zV4R5wxV_YNQK?>>?%E@V5M>O%NIa-1Vqi+WXkk&qz9f%|T>fG%TP# zG&m&XYeQjB0nlYX@h4xADl}5yvY(Fl?j^>ri|V#GIsiKe7Py7qyEV2a1mtr`hzFV97Ea}$d!?fvrkG~ zqjL+rr!k*Nr7K+cNQn?0Ax4}eQ{vIUQ0Mngrjk-(mosj+c}#ixtZXuYW%VKvzwBx0 zr-gBeA$vwfkWMgnd8Yh6kJpK1lqz9((#TGtSTIj#gc>fOt%4Y)<>`$Zk?*$W_eQAr z2l2VdK)f-g&zkIA1o&yH9!^kHf~4@r9((+uhaO_TO6(5CQq|*45T?4}t%g^WJ;D0- z{qO&P+#%B_1?C8E;49R+q*6EC<2Yj?8c2_{pxErCgro~xBwkEvNh4)T^H7*2sv&wB zb(u@QNg;z;F7JO!qT(-gG{N)r%<{Y^r9M8Lu$z#Jsq#Y7|l z_sW4&AR+I7=!{=#@rytPZKTD81{>PRBEy|6MQz!8POY&Y3}v`Ipt}H+_FShZ4sq;Y zFOhvfFy2{i3n=mws>Mp)ev})EZx_H7=`8~Fq|!Tf2;;|*PB5smQp?pvzyW+pT#OF) z=n&wY0@L)Sxj}5%ImG{^xCwg`(`JNf|C%_6U`I93lxfkISx#R7Z$D+u2y>c3T*6yJ zh#VXZ`!i;H!jafp@?5(g3gg6$L?NU0;S1SP(MPxZ*mM62(}ID61^h=79}1r1S@q3xl18}-#iyqgLT zbw~sobe3Y#+Nefq!HUUGuv{!v996+-yB&R0Bw$!Oa3W4|H#{Enm2EGVP9w5N%!5`* z#*;y&8Okd*VX8w*;~drNc$19^4GGv2Y++TzaOY;R{XtPSIb1|O%9fLY_8eT%xe4fC z1L2O5kif8yXs^jha!tlBS6@AP^yD+ozOa4Aedf`DAdxfFT+5_*9gPS~yIKNAOqV6( z9w-e+v!94_ef_mJ`}>DTPTR9*4`ah*4Vto0j03rd@H?qDNmn=NiGVd*Y#!2S0%3?j zy4?W0^pMmbM`Q;))zY?*#2l&78^R@rM8M=Sb8<9xi1vIGd=$OkjTmi}^ODwWNMNYc z$kwbBrwN+@A5u8dgzF1;lFH2-NioBl{s^Y;9P%`aiLA&O^7%sJ69ZY<%r6s35s_3% z)cK|D7Po=ZkaY{sAqh!)L`aal%Y_($vLQV=WxGihyM%>6GIHmJhDHfc$4g2oowfX|resYn5=(^jwn%kAQrWIP?dBz~974+(m%r0QiHSfBrco zy)gceK`u3@rHZnK&;z;f_*iEx(Hrb`g0R@-fBeUP^6(>%NQDjA;`E7cw3d=|tIJ2eheiGHKHG8~q=I-C{)x|&Qw~!GITT*G^_!7fQ*mjWM&l=<_oJ87+|y#0?gx3;jCuZ*vLggkd7MK zuSJv-1MOyPnx`nXHZ3#_2uftEj$ER&B*Iym2%rVRYTykF8TEoilZzlLOa+4jI0zxY zT#h@c695cgBljTfz!oH9jizuKnnYEU@U+wuC5D%vA1dUNgebme*d?q=Bmil_r~1A4 z8r2F&6E?qS`tnRto*d-)N`@t6+l7CzlfYVJJ}Jh-^|6G@@FapE1k_rjQik5=L)sWe zmre6f4TmyAsVUCXs6FJejRt(wD{!+M=qWB2v6|YXJwi&l$Bo+UkSJ)It*^Vcr>nQJ zYGr;=5on83pR&i$)im|MXkbH;^@NNk{$2cJxt`)0uXT?KedO~mz54+K}Q)k#y6d_-q3?b1a8 z6z`FG@7TUL#S8Ag{{c#mvhQK}*!|e(Sc%CDL8z6UM-qs_PW6hkj1kxl=*vcAhns^f zTTnt#Bwml~F*O#$Q($nCFUL;ixoA>c%%P(eG|C5o(-ftl{EKR?q?CwBO*&#p)EzJ* zqBWLt9s)vRh~&t@e0ii=RZ}8Cm=t;R@CZAM17?kBOpINa9~Gih9~CbnMl}2dSQ8Dp z3yeCZWn!Ed07LX#Dap=vXzc?0BH{pJH10sNhqe30C&Z?i1(d?$M8FYVqY9IlL`2Wi z?psp8PNX8hQd53toa*6m=FFQoSgX{KX0vL}l=vZ}M^*|UgsIvJRd|_5SDLrTB^+{Y zMV1{TrX3B9Cb$b34Wug~`NPRz{;u>?I=54PfQSj|!e^#R0-m%cmAoc!+c`c(F?Lv0 z%J4upTAw#H17?cd7Y#|^Rm=bsDv>1=Wk@>W_yA2Rzf4Y$wU|QiB;9X-U|jErESgto zhg*wP#_PstK^3@YDC$mk5gSF9668DhS%##~<2Z4H`e9TzryZMy2YwrjPT8XqG%F%i z4`7FtqivHhK>7U?qS?n%;kGHl{!qR#J|Ia*RdP394PBtnlPybW$yb1Z7+NLe51CE&stLl@#=BU4Ib;MkxV!@Jq!q}9Pm^9RqTth?hCayB zB^TQ91PSsNvzqi*M2?egxzcb2N0@e$XTyNpqVa{WAF$mp{EEv3K-7v=2yognEyc!S zvcI%biv)gatc`tgbc_T-sC5$FI;imieuaS0%c(5^{%DURI()5Og`pfd!9MAV&W7NKZL2Uuo-0?QRF7l=@oX5T1loFDF0@ zqQv<~#U827iD^wDD3MM{RY*@m;E=L<_z<(PpkM&BW9_3gHav`;I-CsjCCN%QN|Y!K z0`0;l)n0GfVI*H)KLzd#z+WT2PdkAMvylC%nuFR@1r{xUk6GyrlTvG>NXp&$LvTMTu8EgRjeGgV&MqMJzoN23|;L2J$2@ z6}!DQ&NVPnTKEc!0Dg*j0QC&X8XgyK}g*1S^thKO!9Hui0mNBAyi#0@jk)1|Ma zHY{O-k40~QKpyh2G4hKHAw-kzoDzXg%nmX>VMNky z3-vlEsjgftoo6*P7v2gxhKxAZVcOt?sGJU`^f{%mn>Kv`s3Zwm8+J*sgP18DsC9T>>6Axie9D+_3~dH( zPM`*c6g(PJlhhDoqV9C}(C`4JPRhM#Th0_pFJYF)Vu^W{M5Eq;!If*)QdtJe1>qe) z9dv^j+HF&oNMbg%iZJ#5`iJ_r@b?cq<(2aX$mxpsYrg;2oQlkF&3l#i+=_?viwJdZ?Q?t z1X_vHAf z5kW_)PgWnCn27X!g9t)bjmi|!U(@zP6VTR!+L>Akl*B0=|HTy1j6X6y#c%sBmJ{Q; zWVk~D(VdK@S1528DNuNh~Vfr)uox~gKcF|aj3>NJjzM7LL z{inH?c)V~NO3x^aV8ZdE*tQW@rCtPz1%juZRko#+YEh+D-1FKBRxHsdE-)7{dy3N% zet|D)f-AYV_Ljy#M<9%d=`ax3wQy8XV&rfEmVmDW5Qs-#8msePYP#VKMQNe)(uW^^ zOyn))#%OLSUUkWi#b6-11)_lRN7y2e2^dHtXK7)LmW-0hP6~Eb*o4OXHIh`IIx$mBQF4 zUSe^P`lQ{TH%)DxHvBR`uPmcYeg6?4M;r2naYcji_Mw4+qhB7YzuJHWh(cq0Ibxf} z@ri>GmL_bII5O-&*iKQ5NqK@s5*1~WKJmo9dB}911YOu_yuo5XlOP(NCk@Xkjo>iS zpm2{4^&j~3le6b9PjtyxDqg9&OqqDg!qMC}O{iur_aJWL5HkZIdf3Aq=^OKeEo zmYM{}yqq#VS1&FmA+`uY8xf{rBF1{J{$p87zQ*z>qKW4PDI8!>!-H;mwY#e6o^^Cf z`ltk@%ai#EK+a}HXb>Dy=eKx~6=o2;L}WobwArABHj>E2%}kIs{m|&}Co$LxR3a!z z(_tH$dv8}KHE^jLPa=DIPGP1rPG#dU2F|;K-6g$q?VK863@{V{II&x+;y8nyvBoEY z{N^DRBF?Z`eP6)W!u{98Ce~jc1A4q)UhB9WH))cHS#pWM>h6IloiA1FbA+6LM z)j^0jrQ?ZFG0x;IawO4x0T?$#x&F@`5`wLzPhpK73Qlid9Q}$d!TEsgh%xoG!f|20>M%QPj)9{TP8#HqO8F=mK z?xMTYp)U?feJCE7)L&#QzirOniCDTP8!L_MLr=;TrmMk?q@jvr2M zt|G=&MImZh5v4_ZnVLqW01dFMwRy2AcxWSykJfnj#8a-#U8K62VbD?t%uYeB;V%v! zI(hOGniF?44PY3B1UiXH7R64yx(tbOm2~xhS(6^au=$sVY8OcODiepfV{Z(Q#ZL8E zb;*ks!W`4mQ;A087TEJ7cu~R|L=BQKCG`aGMCk}1Y|24{YV9#9DkBBw3DF>->(Bqi zpTF|zt78-6|NS@rz2-_SYz7k!rd^yGWDT%dv;&~#$LPoyw}O747@__|b>Wy4`w(z# zQ@uA5Aa)7kIkjD(A#Lt>K{aGP2~B{EM6XeXQ;NEebocfR)6E?_2SNy`k2s|LK04OW zAvcT0>KSPikY}|(cSONy$*p(cX^DiUY+*lDkAWrX+t7^oO6^tT9m@A?MHdXo$?O*%<5h!->hZ8D^5xF;h!9aj#>2_zCIE)u6E67Yi&oXCCZsbVEE zktiyaO1)STr8oc*_fBXSO22Y`(WG5=BF+f0mOY~J?GoTZhw^kh%E-Wkp`r9kdstrS!$h$)ratG;`wX^N+S)dqO5f1wyks%xN^1r+{MfN zL*sVj00L+oNY!GO)_YU1ie07qUE~9_Pkv0VB~yXP{2RmRxoTyc@7z3JU5q-m&|Me* zz1fA3vrZ#+%zH0^8Vg+zwgwfkXJ{6m;9AuJksICm}86F{BLmaM@;K0=i_DB>@C`6m+Nv+dFUJ5>R zxDV(8cEYXTj9?YY4=Sky4PmeMO~Nb1FqMLn7*n|@0va@g6#{Pz=os}-&6pOByM1DDw)AB856ZjV8w5ddpsJ{=b}WQuzrDjj6MVyPLtnADjnd6=bRj{6e1|ai;QlHB8tl+9Hvk>PPR2lo23 zOp@#+@Y5J}@pk%#N4N$PjT%~{1Ue8c?e4Ygs&SCZ!srXU$9@v^hgd+M7%GU+pfV;# z5t7fx#(m^#2?4w!46)EcG<-VZMF~J%GE+QGBs0>!ag9l#Kjc^3u_CQeMn5&3DtLfB z_5}(7O%Q=0wW<(hLmUu9KvUaQ1!&Roc>&~1hum&zFwmln%}gZ>y324V#BPp6BDp9M zUxLAm6Nj`)Ha~H-ctbkcd&WlP5sKKt3nczU{cvP}UXy*yW2B45^98Xn;dWw3GN$gE zW7aeB#*H+&*(0!2Xi?mWu;pLNu#ljcTW*7EaMGI_=De%#%w50Yppsu-JO%EU4}Ly) zCmymyN!0A2_<`Y1OAZ(H8uXG_Q(TX3$CSx`7Q zG=#l&`?jt3-n%m|H=F8^w7jG&D0%So>wIkQW0e(4yL7lx*L&?cRqUeK;pO)jv6slj(((HaE3ixYRg0>8DQT$WRx0>_d+{ zL{%)L2+W*Ej~=J*1&sNz#~!(F*H+>Q{^`HJ_N!mN0Xpv4{UFu2i2K>OW80e5tLR2^ zweHG_Wy^N%+(D@?y0foax1PQq`}XapC>MZ99ZjfB+YgF;Qh}9BUseZ^3kN)PMjw9U z(IrclU$|6F3HtkXY{#kh#lg?1lp0QPu3WYH$tRy!zHEtjXTx|{Qz&vte;PF1U?`fA zo&WqZPj6bk_S~5h|HnW4<7Wpxr?A?})vNQ13WtVAXv&UW{?LPaUViaKYylsC{Nd&5 zYOg1K%a$FFKKf*Ke(LelU-b632KF|1(cKv9hSFzpdlsu@jf-u1=EuTwHMf&RzHJ*eQME>#p2;|L%&a%50mX zofhRa7pNmdH<2@!F1-KozVI};As(K6)el>?hw}w{F$3V@D4i z`f_M=g!;G-JoFHa!pK}l{FJ~hVjKNaHPzJ=A#P}F#B1>I-n~yg{WRhNZV_7EQ8JIR zbflY71`1<4!WkuiE?&4ub{QoFS$9Iio`3GyO`A94IcaQed+T>^H@CJ@QU>9P!eq3o z!=oLX8Ygv*fRFmdhT|tsH#BwNGg`iK<#W$Jj|4zG1ZzzS8X4h~VWA{nW=3jTd)G%F zen_JuDTqd`ld2`0S1PwqTLu}rtD}R-;&BIzvC5MSMoA?~5K@qb^{2KBH2v$p{u@d& zJ+gN%&3X_S=%=!3&8p(kVnm_OKKd{;HA&00(6s&6zxiGFNbrHZPww8ek;F%rE#g5$ z5BLb*C#qF4KXE81pNU|zQ6<;BX4OMi#$r6!MzK$L#cb}2=a=GbSJBJ5U4jjA@i$rg zl~(&_^Mx2^oW(0uv%kGCoJb<`%v*ll-htinFuuiKysJL=89K)oe$Ebvn}Ce(N4pQA z^{Ly**4Wf?;Na(kl2J^XddN+UP3RnDC8e-4dZ^R#5_2NljmFJ*LkX*<=kym}9HbmQ zc!?TaR#sY6SOB`TwRQ{+P#AQAxV+5F^rq(KFTXsMk)F3|fMYTv|m)8TCL2K>oq0MEAheryt`{#|r0XJW zV374&+FK=J+~w-*?4aT^@vaoiLLm6^$PsE#lMGGjAUZKFZw?Y2(heN_LIRP-#)k$5 z2`3~mm)`R|y#o}C!_-XRF)A6A`*N}~i2lZgPxJ5p{qO&&tGky@Jl(W^X=|mTXIV*E ze_#K>gNO0Bqu#<~Cw=3jGEu#RHlU|YokQiL%R55S*)wM_^FkS#Sks9Wn<}-jE?m5b zwn5N{P1Gt5**lK7zgs-#>En z2p#Y+oX|s?^;)`Q38ojc4}21sD_E=#Kl+FpY75j}mWE+{($eDb$?+2>PY#U`2RJ=AgxVj-$jB?q%_X?aW%CnX-`UaH*+1@1 z%c`qyU{S#4rsl@Fx+`e!CB?;=n{U#o4@H^kav&>x$w=g8|6I6u z;kDoV2IysX;&f>5p!HlY#q2=S-@Nu3g=jIbV~@f2L1;i}NpS|zjfDD#LzgdH_~65j zD5^g&JPI{Xrm1^RE*VgbB*8W&JYr&Uf*Pv?oU-MP9zBY)Oycz%PP(L1_a12gfJdl8 z9zAsE5CZ_+_wV0NK|SI**kjl*kQMUs@(~Tsouvok7%dEdcJ6caN)4v9RV!9dN$JgA zauXN;0Lr^bL_t*7Umxi2-MVcX=a=Gr9lb-|jI55)nqVj-H+_ zfq`IPpl@_p)!G#+D&ZO}tydbGYsn+3t841&9C>W-vp@RLPgks1nwy*1(0FyW}{DkLlc; zo124q9J?s}NdP%IT{7S$6;%U+Lv-7uz~uQ07pd>|z3+eTl~=#JeC0Ai3=bXp{EI_} zDZ9I4=Y9EwrOnN)on0MOOUg@23n(Z;`Zy?Z{P=}kyB_@cFMjdhgS*_)xw#pG^Ur9dw1pJWSu*Irn|d?Mw3zvcQQc5>7V@g=M)z0?&-x5fRCNN9WH5!iz8d@JBz|vwIKG3RHY~1|{^lXX(04|LK}_t6A}m*0$9v>5{pg zYJK?N3rb69$Brby2un(edI$PP#zrcaRAA$-y>x+;zpBde&p!F|Qcc6IJ&$hKv}4*% z`;!Kmoh+*=EicW*ax*nKSX+A$TXI2B1wt5&Iks%xfa{z3Xy5tH%P+t55|xRyhoSwk z$DX8Q6Xp0vh6giJJx9d6bcIU2t5&Zj9D&F(1jaRM*W~Br0`Ry+KKk(eb7xLJxO>mf zfBuVmckk}$?HwE*hD41G4b&R^@sEG}#1oH~mXu1x8w^}_2YzmR+f+{d@sEGVM{NG{ z7tSIrHMO)IJ#i9^8Je$NyRN>jo)uiPYE@x=9#Ndgm*>u%{ouoo%PXtC|C66SviC7c z(*wgFeDFS%4cVfrR_F~7kJR0JcF_c#`m)mUsi_Gw0JUI2eHqQ34?p^t5Oj26^eU7yfDjwN z#q;NIqgGaw8HZ(cO)X*9ufO@`$De+D=G9%q8W(79PNsTFubR0)~vyc zkG_cdCHeglXW-|~XlBrSo0=|PzD#WVnl<3pYQDvowUUR#Jz)RevgICW0bW%FiZr*j5$%?bCaT>6c_?*| z3JVK}U??dq=5e@_acR?C{=fa|S9E8ozI=(6XVf0YHBVJ-x&x3)s|}6&zxd*{vjICJ^0Ap{Nkd)k--a>F1+>D8~^YRe|uox$MsigeB)!1@g@Q5(gYXxC~HCc z011K%g`~lDRwm|zTB-;0Y1GBSCrR|}4chaUUT=FMAZ zr^c4U;X(m(lz8eeu3NYE`4?W;xMAh`4I8i`G&D3J1cOvs71do_R7AD{y#$+@TX@R) z4eRO4LQ}F!7cYMF(TA_S_M4+$epypngMo-v1;{QmW7xE1JyWB(5`h}1%n}Kp(R|#E z+QaPgf`Y#trtbLtc_ z7X6TjEa75mOOr>yL6-auG62c-mcl+-$`#@(l$vnvczAov!9AO`#4u(yx~p_>3$Fw# zqlMaYH0lNKnRv}j{ci3SkK~^lL3ao6bDn|VE1U%M1MIpAFXP$ZSFaE_} zq7J_H+CTos|M)-e+rJNkJgWch-4DF*!i_xvw^`Op64|L`w2Z{E!DBO8rKd&0vp z-H(h;pwUVgUMN6}cy+&vJy8NMs9)1+9>aoXv_Vb_r^v6G;!Te8u z^20y-=YLd~pYyl>`LF-q|NcMVB&N9AwjKBGeeB7{AAcG}_Rs#}&;In!{uI2#4@hfJ zTkQBIP$rS!B+TDCm&&;w6AvG;`+p8Gfd=Ku1eAN>%!>*&a+ z#^R0pgH)Mzl$I4z4)E&L%U}RJ9VXq<(o7r?T{;MABQRTvT}$x|spTOhusdr5VZw%lYN zNTMXa#~C*!XsL?h@nC^R^V0$#QL2)T3=I=uNLB#Lh<$k1?%jLQf}ecqCqMbgpZ?h& zZ``n+WJs@vqOf#Bm$D&j4+$NYSR~Q`q!=F}LUyjiT;iyuEJv!#NxnM*)|nJ1rl=II~&;0OQeU;Uq6df`PZDCFds-eHoK=1Fyu8YiTdTEIBk z`C&sdO-ZhkDuE`hPzt92Sad7|7fBS6(DaBD*TYvq$T6E|MvXz z&k;u=NpVulK$2Xf`K|!vG?&hRLNbxiqsrFJ8mCOYy+=Des52%?ZJ*55x2DgZ)oaC8EioYAuE_w>`xy!hhFbkNGm$|YQ#)*yp}{S%YJ(dhsVdvx@Hfw6)9ahEgg-g|dE z|H4zNR#)}(ww*qGqPKS-D=UBfy3J2N{p|OD@V)PT_l0}!-G(Qa_+zP*C*D9x#Ng%} zp`D^{YC?jb;bc=1nl3p-Qiessf?zi2G$>)uJ@?!zufFo^bI)OBpbspy>o;s%^XMZF zqP~s}57l0&#UVYEB@Ir)NF{^H;XvVj>ggxZ=T4nI zdFs>&aJ{swr=DdX{>r7cORBNnEljSHaH>AFR z6VRbAj?_PpByH*35=!?_U@Z-~fllESSfqdWlb2rlF0I?}=SQVt{!~$ZR!Ko#{pBk) zm+D;Ztc>hJQYDDj@TPn2zklZszxU#gzW361UU>SRO&hYMyc#v;!s9;wI3;~jQZOb_ z0S-$H!~uqpPw+IGG)^>ZX)!m(BS3T8gzZCn2nB&LMSXQ0;w`%D!hv1DA|cp%~#5mu+5}+Fg5asG4%UK zhlV9PJrb#}Z@7H9nkah8KTDWuc{yd;qza9+F(Dl^SW!{>gr8@dy(8Md0CPIUlRrHt`GhuCn*)=NxzX|8&YP0 z(C+;Q_BS^-6XA96i!T}*>M;~!sE1F1B3Li+`PJ55xm0}-jh*(CgqYRV*6`vZxSO=E zn3x2vT3XvKR})usk;H2;B(7dbCr(_19UU!a&z`Bie3|5*^&2)fHMM@WZy%g)d}0_a z85e$OX~jVQF#Rg9?Kd{oS65#g86B!9FGWX}+A?I=d%U0#=J)!#I*I0^xoKOgbYb7N z9RQ<6Iz2|wcWEDqP*D%lZGi1Ez}n$qdTve-=0*ZNy}D7;kZo41TA7odN1R$iQ&W3a z7ne8I*TX~$3-T!HiQ@uma6^5=)%qsdH!feX3I^v=Kg~z>b->3b3y+p`k7@*1NnX_l$uuv6?1eZb2hWdIM zbTUek7szyi?Sje}_i?*o55UubL;8USA0W`0=qp_8h)c%1jL#U0E_cH$jGY#xQg#wY zKt)g+Df);?D1oD+W2euY1j^}mE-Cg-X+F#F2yol7d1Fy&$=J|P?d6*OzQMB6N@-d; z>1*rgs;vRcFIQi>xN6n%T|2jCWv1iDIeGld(BQ;Fk36w?%j!_X-#6IR*wn~YV#74l zHMO^r;^ogr)6b;HXbPPI*in6bV=i~v#NN&rx%0OIlibQGNk9Eltc)Yy(3>O@w-ObPz><_{b5q z6OCUnZ=XMR4jVYLPD{_ggRWhSY~nxC9aT|YPN_%CA$>hPY*BJFmQ*coXl|~qsUdpc zz~`U$_Vi#me_;2noUC-IQxgqeICJXPzj^I)?G+SlA`&n=(GQ-(df~!(NKSlc^`+{% zt5?y;u~LBUgpt-=tz*3q`&bB$WN%+DdyL(9`0ycyL8Dd78;H5s;fo84SV5vyn8iK! zY~@eHZle9iMn~9L% z$!sK$L(4rG4M0NejMH1>=4*w5>9q^lvgf{c2khN(miJZe{Z+nulRWqKUjBPK@Y_p< zukmi*Xn+TjwQh-o#iFFbnqd<#n${Lcn8xXfK^_k=rL93z;+%np`uaKo?9p-v#KnmV zJP=e29^-LbzJj*yS;T~M2e1bu;ES|EfAo=ufSvQ_5d$ucj*S%L=ivt4zHJA9as1e^ zOV#IxhI-4&%l7VleCN)cXoqzG-r3W2bysnR;{w>ab&J;OLT99DdK3==8gNTX3(S`A z^}@oUt=o3cJ{e7p3UQ1*4L z?Km7kK_-5+_G)`;J5KjXg1d6FsP@BUbeZu7A_TjYmsg_t;x|RY*tYeab?a7Bpc{k+ zanGGUPh)i)!|3JWH4jH9X4lx*MDgm1%F5xvVX_h)dE`+H0|XwTC+6o#XKp;-q^Kb? zF;1i(=17NMoVx^nq3EEs1IgF}dU|^>OOUvXm0rrlbaip4@s|VPaC|g27UI!IA4U7e zjskSi_8Z8@tU?5X)_O~Q`st@}Go!SPpaF-&E0(X|&M3juv_Tz2RDy21ckRNuaIyN* znKNg)kncJ>5%{nn18jsYE?>Ts!h7riWQ(%0lC@Gd5O;|Kb1rwF5FTM}xmj7*#(TQO z7qET%y@f@E7ptpDvfu)wN0QRXVBEN29qUV!duvO3W!19Bo_IVbi#95erOPTv^rp>d zT|Fq=Jv2B*e%g{HrJ1<^WN>0~tbd@N+HRGVOX)n6os&^sUcwC-4?7Aao{`hldwg^p zf*=vHnbCu{Y~8eW&1%$gu4!s&0rg1@$1}ZpcXWO7>3)aXyJP3QMftfNm$VQj zHbp`;#c%;)n?QOiEI#fTUx1k|8sP6FBmQbwcOBcpSG(~oPI-}zhFiRQ@@uz^0(T}4 z{-%bPn1f+{myV};3$0{_B~W@BxZKoQA^sc{TngYg?7#rYwfv5uaD03W+oP0z6IY+3 zsJNJdXk0@m*5Du(W_q(a&}(^Tgzpaz;ou|!E-Nz|Bp^}=PI&cdJ!&+8$5^3-w`S!4 zHYk5SAEoHXh09;Hay6afP+vPcy2b22TOtaKa4K+DD$GdRYa3j(qoa+QGt>s* zD||OEw}5+6Q>CL*fEGh5YGP|!D~wf|Rom^AODgknbH_32jt&!r$2$cDMI~jW8QIxG zqhnM+gE?w(GkbAC{>o*Qndx+^lnOEk2XOU*f?_hP;HSV9c8jXY3Tpol8wk@xi;}oD zn|6kL`vtjwzQGFPDCE2TE2n_mtSzAlC}qW;(8}G8|MdvMI-FiK@ufLq#^!w ziqC-YP>J3ukO+G$V`Kd2l>ANggBWOztRpG}vSFR7@g)D|F8*9b|A zECBrX?3050Li%?YH#YJIp%^9ffT!U{Fx=laK;^;G@+G8|lQG!Q*@Zk;RFIDWCNDR$ zqO6#aQ}(XCt=pTKpIcZ=$@Xd6WQxN-*x%RG*g7^Ia7@!NC#SrWNflFiKNKDdhJEPe z;Siw-1r#H~8(vmk%<3R$QqcwVef1gwZ`#L+ji3+0(F^g4FT0|Xq;>O!rTBK`O zfDWV{grt%p`YMSPnmq;4hDS#McnbNAPfS#lR}cuvChsBlfkZuR*K zdc#43fxT0b+H2T$+yr8haF20?{fSgMJR&tEONvX_R-Dgfd@g-`h_e7ZE&~>kDPXAJ zl(8Rphi%3bFqjb~K>kZ(V*?%p#7#C8>H8mk@IG`PvSr)0dzeyFOY8oFhmM^%w{`b} zPd|@Lli{U^GzFRi{tUXx(?rM=XEmAaHi!D;<^NK8eLfb(A@KSp_^$;iZ;DkWFHTb6 zCMj^20e+#wXWomQ%viGok<7JS0*&CJq>%B#LWo)*^{DBjO5V4&!IqM0I4r5|?x5QW zEx@F~45wVWi%N}5X}>64XQY3cv`IDU5pGdbDn3*&Mtf|dhV)PXc^!oUbH(&mifV$@o4Q6d8vIYD{q6P23nL>mFXlDVtR z!L(JEcqOIjBsZOoQd*DaV6McK%ohop;(Z+Z=w1*<0@Nfv%k#mA-j8UkL}3m$bXr zzAe&63xfo!qy=lG7##j`g2Sb4j@D7*R$7CWlKWEGUNe*>JIOQ(b`zj)P^MHxwL8Xr zRCkX$rM2k6F!J638jrBd&J{wCOu>4gTiu~9*H%qk3$ z4FGEMXu{#}9V_K2UnoW6p}DEnE)&f8 zMUrSf4a3xiat>CRMISnBZ#aI|lUp0oA)2A2=F`>wy1c83=$;U^&JYHB*{`8Bl ztlhMMNlC@|NDypKr=b*cFfCzZ)#+>t;9E^qbTiI-E#9?0HwkUAm_O$Ui~ZWd%=)(8 z>?ZLbdHEk01@5GYeo>@~orRdqN8v(CRoGHsVX$^s1BO#mW)%#Ra+Rj^jkbS6?~yv& zR9(^LQRsbeK;nS3jfym3g!}Tl^w!c&*qA7VEvBV$2ZJBNv-BkqUW$jN)1B7kmf=V_ zTX-~qOWN3BVtfq71n-vb5@@DPouw?Ow2+3cN%I_OcoRbMkj^(Cne>m*AS3=Kwe$fH zmm9qY4NJa4({UXqFKU8E!Ap=Bh6frDtk zTGmEJjz^q3NcTKVe3F8xAqgepcPt_jGR>cAO;P1fnv4M<5@zjj3EE0PxU?w)3A9|f z1c6KboS+*aeph z>@2G^1`=nvyZ|7f1ua{&38M6UVa(itQE3*XL|O7UmPUFLOFdU2=}^<9#XDnwm>Bb= zBY<`wmG%VWhSB|$Qp^gy>=x-0sEq?;y(DWC8I(Q?B7w;cK`KNnF=qIlT6 zi@xG0X5a6&-t5-qll<22Ed{DlwlG??1OrPeGb?(R0`D>&K8lY@T12B!Q6^pk!ui)UpN1bYE$PNVEW681d^lRF zzWtkBBy(jxce@w7?mtkHi+C zJUy$;cGCh)CjUbeT%`kzQ$+-%qPs-=ha*_ISvAb{JYDLyt0<|-W`f#mScuLnq%kXx z)^0sUN|SXDA##b3$}iGsMmisglqTI4{C?<+2rFxi4TCng({?iUFp_Xj*&ZTghEeIY zWxNVoXxJ(!80l6h?7@H}QnS&;rP!1JtGr_bVnKHiro<2;t^DNpNZTZ#tpxK6E%}_i z%rBY?Bk~m+UN;Y`DQT0k)m_LdlKLjnT~s7*NjDgqM9$4GEV4P>lYWtGP~1tL$x2U^ zx>t0B;_UMSfwhmRwtbD6=ojS0i&5gg0+QZVrTezt?DrO#k^{dj6!?Y#e0*=4!zO20 zG%~mV%wO7Xt0iBY$|y~6C}NAGIi?(L?UAe@H<}C!(=d!x08$yHBo?D&s3HHNYfs1zkYXf^})Q+o+Ee~2b{DPj*6b1}$kD-?>Gt4UfL+lzrgJSHMk zsY6@4+2YLr-T9HyD>TrfIl0}dcNQfafM*lZ1XwLSWJ`kLTqc$zm5W6B;Yl($HkgbK zS&doA2IXTBUZr<%Du`${s;Z;{=kdKFU4TWbvGxza2RzGIUu3Ijg&A2F=~rwW8J(%N zQROlN7QcRGOmWyVOg0up zC|4?i%C|72D-%}qOPG;5;DwioAOg!2<|%AZvg)<4SFE6y^-U{~L1t?(TMVRHoxl>lD@0H%6srV)sDI%k89uq zMW~1(9mv67BW0Safk)H%P*+IGs4AHh{&kxnVi?*|NnO4skR&3J8LD+FLo7q#*brii zV8NfzN3bt}u4We*62;$7+-C9H>NQq*7@eTGRpQ>8q5PcNnmwYDkV=c7vhEOlqBv9H zM=3t^`1ZDl85^^F&zwIcx~`X%&TfQs1TJd&8Y*cY3dBR?Wbrs)K+>##Gj91;8^Ft< z&_B#>TG$7lK(o2OCeqU^!7aUR(`^zLKR%9I9n&pMB>AO3FbdpdfL{dl5`oPyh->Ze z1+Sccy=wfTdM5Hd!xIxZQG94>j#iF5o0-o4)8cUn7hB9L_C?jSEXceT`?%J8uQPGI zJ!!$HX-3*mmS}L!s=BR{5DPyn*aC9>mKl#SWra8~$ty0J|C#sAE3Q)~E}Gs~J~XU! z&V2P9i+b86NTAWY<{|pRU%%FhTckFUjF}vwSgcHw`Ey1B6IsT>e)&)Q*$U%kPbnZM z&dN)$L-vE-S(_9~^p=?3C4S4276g(2IxWAXFQKi*D(bK3!D2xd(2@6*sDh9nL^ev@HPOi9cXnm)yyDI5!GHve2YH#Ik0S2 zEcr@O;17rbUpK(V&sh9uC32tn_>oBZ1^LuMkTX|GSnyeM7WMl0YCbiZ#vG+G?{A=yHm7#PN`k}7uwl?_9TVWFk_iV|fih0J;>8?`EZTOY(}YsN6^ zE3tVRxnch6I*YX!#yV?P2o%rS2nx)Ke3mW5d^%%gF$R;^_>C+Ch{plmx?XN92yZam zpopl6GdL@Lml*J>rmiizbp}y$mJ%Mi5Ed%*1t(nY|z2<;f;t^O3{TG4V4EHiVlu7)L&s$3@? z6}e8HptrW@l5qcP9kB)9kB>A?#>Je_n;^vvE}gR`*II{bE#2)KNb*j9uoU>Z0si(9 zHjY4ZZX3g6<@&evk?}iU>$W!l?3*3Te4Y?f1Y>tHSf2P=7;+323LaZIPVw%bDliP%OB;gqe4@qy~S737ovWM)Q8-$zVo!9iATN<~PQo zZ~SDhJ-|c_CVrJc=!8XFNME1N_AHW`FD|$TG#g=&0Dm`$YNE8}Z`$h%83`tO1@VNd zt$k(fq3Z*@2nPnG%pENKdjU24S|kyGn=MYw2lxed@uIf&A|d0BuGb9#-q0>#J|-w( z{sa>}FNOoCc#!x?0{k6a%jC^}-zo5W0r1yHce4bG(lmd+S8G9lSA3p5uemI6f!Jcb zmBvKNcctWtEIu;)M73G@P@HeG~&cVC6R9Tc+h=4Jy_RZw&C3N6BD)Z1HBB=odq} zYiTrhom7hy$F48B-pX<$zw@o3!0!>j-*8Rt`T@P+h;IJ{*J4gH(7b?hyCCZ{*UkJh zYpk(v%+uiKsZh6nii^7A4e2oZE(s2J0}L|&G3RmCjj#E6?7Q&+SfpBb^Cb?`Tpr(64!Wz^ZZQCV)Aqf^_^iHFluu4JNr5BWx1FkfcD80=J(6cOb+w z3GlannUZ%*QsB-~;PwOj;$!<49gu!!NszpIk^)Hz+?WDMAN-AJl)NHIfg}YMO@Xgw zqF?l5k{2c^kfgv3DUbyC8) zjySG8{=rZFrlW1XE{go#4D{63$!2=t~Kr3KKj_O<{#UI z=XJ*haECT<^0r9|e0>zSy8wSvoaB~?avct^7>0hW=gw((vEXI59Sm-P2)71xw`}cL zaLV(;L1))ylrP;ftroM0i@*5|@3xo;8tUEbLl=L&x&M5sUVnQmYA4JwcHPjV7w>g@ z!z*uc?=A|sZ-7zp&kizp> z0vb1j?RX>IYt^;6V`N`I##vaZy5WJlDPinZ8U7um!>tY~`Mqx$1@0oiFTnP1M(J5V zhlw}ZoDCKUj5Pti<{(hwI$uYApev<*YAK+0>r&IKlAndx@-3X~1pRgqYMmLB#b9q4 z;LW@ezHZ1F=i3%eM|F4(!Xr!8lB;c)>H*5=bim%N>p{yYiUKZIll64 znaE;a^RG0sHiC;8&CE5{jT3=KXRTMwU$EG%67OS_?1UF@utf1oWz7_pl;S9b2EfcB z>W_Y6zLIzwA-#SOpT2x8@xD40o@NA-gk>>LoFio{o`yG~^^G9Vki^V0abQY;_(Y8u z6qlvg6~-hU)}=D5zzt+_(+b-*A(u17rZ%i+{TAS` zM*HPuet`xeZ-^CP&Jc{!X3VXLFNcDQ^`;_v!Z3{>Bp=3?)w(iv7bE(ZzY^ysmIVDf zenTOwNxw#BZF@?l<~#vvW+&XnGqu32WZdjm1W%c#NPULnh^L4hjNeEy{Hp6`SGkb?BgOI) zwcA2EM`&UIKBW7BeIy&kW^*U33&d26H;=UFX#u?2Xw2q~zsyBu>5X)yt2Rg2U64HU zPw$3AOdDp)C2n`K%K%;|510bC0PxCuEVdn| zOq`9VcBL%c(yI*jM*()gzTrL=+ck`1ApJ12CI~(z`wY) z0S4>Q%HIu=@Em=peyqQvHgXr?v?&hPbkuM?(U~mhL1*Xp8F!~JO&zRg#=`Yf=Mi&( z2pGz7W{leUO>5NZD7ToWGIZn+TnGGOR5&v`ot_8*+**cVtj{9S2r65)ZkbKoMb1~b z-i%hLEnhK)UNZ-k75FZ5l>e&1!oZx~+_I4vRyiX^SOP%I-fa-lx<+TM|C=q4F;1m{ zNM$oyK?W<6(6Ly?bn|E~7P(AeM>Ya0EYnmCUX}*LM=KR$jC_(v*M$44`fg2k=9<{! zb*0RGjTeK52(1*Kj3Gju)-jMZa+6pS%q#9(NO)p=YBTU+#t&6yJRC8TRop6ImR{E+ zPB;}k#ebv+M8qy;t9Tq=4K4@Z8DeDGCXyurD?n|tIigssc%}pMl;19U35qdAgdsF| zBZ0BvMuSHzVE#fzzG$|Z0cvY!$7M2eB4nTu-EO@2h06utWyxe0K_0X1g+SJxkm2iA zPsH4Xh&Hn`lD{P>kfgxfrNE5Y$c48v?y!7yyw7|8|WMD?~i#o#DxIMGTBpEO`0s4xwK6VS%8DfnPvnbFjZEW&dw zfWzc&6i&VvO0j#em%~R<$kEVMln_I{psiix3BA&2y_O|kn4UaREcY^YOGh)0(y6Hl zAO_ws#SBZmVXeya#VBBYGm|$usL|7vl=_K^2P#z<;^+skdX+U~`mkLEcoT16SglY2 zc_C_ZI3nS&@MQs1MOm9I5{dAR@_FcFL0SwfW$=Q9F`>n*lQQ=>6=Zk@C3IC2jS1$@ z1O(K<>5q(oJDb6Xf~kuR>_o#6r_Chr*hQi8{%L$jL=ipS?>K8#C&(a5w@p->Iu{HUu) zsT4;;b3}{<%PwoDexLYGF+0cF{OY)nF>sSWWI7C_>qk7+6`hVa9IRuAf7t^{BNd2& zd9j8tD6VG=VbRxR#*RpeGs13Qf62^bXX{2X$3$g5v&`~QB+5AzVT-Sd#LTS1VV>m_ z`XOKFsZ=7#JZyFZi<|V>-(BvOd|HwMe{d8?6sXPQ5+HZpY;OechVAIThOfo`QeF%@ zP?n{*;xKRzlX0jW+0xeyyW~oF(?Fng55u$#50?AK*{*0tqS1y?Qs640UBP|;45L{H zS_p%k7G(t$2-7A1sxl;sykaj5bvEk}9wuB>e$KU(FieL6 zA@5kT6*g*^AgomWhzS2?wuUXowP%?Hh6-bVSN%pfuOY=e&v+b<_2x!?nu!(@QXA46 z?2)mE)dG!75gH0O?drQXa?xU_2C6caT)WvjAH$~G_XSC{z z){iAFnBglW4ME~aZ_&`~c;mxRSwt)YLaUjuOVwm$3@U5LlTnnAx_{Xw~I+h#WgmbLxUz`6Xtrv2==dRKL{dWo2q2Xd}97@orFlY z2msSICwe)*i&(72c=kT~99cH%6b)Wn^0Hsd38yEKv3WY7*h9>i(TOCkSyeZ~L51CiQ=myK{N5T}+`}FlucevC z=wz%Hu{UF|Vg{hNYT=sbS&Eqg^P(^E5^ie{%iuEeaX3-mMGBBlrz4RtG=hJYJDJtgnObklMvIxn1<`pwMkUz;;Gm9Q z>2B>fk!a$3(`cV6o?3G^QblZsTc^OHjJ3C{H)B`n`Y?3F6xjvXC`4w}VTgrAf00SV z_p=d7M1oW}SN9P1C$w{Gqw4y}w`4j3; z0c#36I3u?iF-B)F66hi;^qFp=23tj(Q3o!DVC zM>6&^=YrS+Z+y*yUrfH4q(G7ai>1IKG_MQ%V@aocSk(fsAfTmes0SFvhWV3skM z+wHjOEv79BXG&O9Kc*wVsADz|YeK>e?uiVcdX+xbve_DTov1>Y>BQcV#~HXX+Por> zUZCOsdab3cGfpfesGhvSN@N9I(cqz{YG1LS0iBMe4fD2;K!zA|tE<*-Lk#!v?Jhc4l|uB9XoUuWtk?w;^rbFx^E@FC55i4iLb}Y$ ziWD>2JTJ9BqmNq9Zq!RfeO|^O1mGF$R|^U<3380FIk4H#K}|%0Mp>#7udWhi`_}c7UAw}cPJ^6sfbQoiN??GK_MN|gKRw~u89y^-s$GST^^JVXbl6=r2moS+B$$KSRew zTr=-Z$v2V|__kAEk>|@I({%w}ZLGr4fHe{4#Re=2nqh{5F+rmepihVb>2QPvB1PVJ zVj@9pqK*+p0B;o8DBn`Bm~2!G zp$cZGxgo>_iD1G28X>3~fN+`MH3tflaq3FsH_9g_dbvuF(zq2OD!VAN7Je@{BPA7KPa472ZxPzf!C>-{By$+WhZmhbsV2?tcOhpXrd|9}++!HDpXot8C zL>-|u)59~WC@DcvcH9bKB_AhlPiO)nmHCC5sK_7jvgaF1Oox5E#h+Nlf!{&4vq*d(8DQri%Sd= zQ72mwnZfBoLUn~xoQwdR#)P6GE)NLXB0)F1Nl;xpSPI|fAhT0KP(u9`_zZ|IF>57m zd_y>$zVVi*46dh{BW42g*aR{bm2lk-nfU>*e)dA_XgIsV5rhMgB~fM zt7zdiM<@g{38;w}z5^2uf~BHON=CV+8DYB&OCGR7J!-VZk%>W=fkwhSTtAg@0a+o* zoHt6RxUbbW>I$LryGpn`h_f_}RbTc}JzB^yhN6Z`@B)C|v4O^lex z7XpXE;zELE8nkS)`$G|KK0Xy392x8E=?(Z1W$b}~9}g}3aBOmtK?cLYiKz*vM_6Vk z5|q1JrrIcoq8?fiM}Wd0@SkG$2Z896y2hr9)t7sE`@-Q!dTJW84+H~>CvI4Ch@a@R zKNKDD`J380CxcPG+tJf!68QlJV>-_y{N<;0XHy z0!K(;>$81HhlK?61mn%U+|fTY89=RaJKB1N_8&PvKItnc%)_uR@~v{UfyF2t~u5)HL3)v2d~z#5Iia?{s*O zYo>fY7(6?KO~8L){F1Qf0e`}gsVTn8z-%sO&}I+Y9sW>A>lxTFW&k<}2e?-JL4QCX z)iypphJYYaoy!^J26mf29G*h_u)71{6r?4U|HM(_53q$*jSw}6=Y|H3$ zKqN|pAq?a4=A_RjTO4r&kGMqrlbFEH(+#GP8j`iIEwhf{*_<~vCfE9 z48@);pt&q!=RhKmAMxLa9Lb&>n+TpfQ`_2w=sQ+(wRzg%%FfFl9-FMIZ=RTx>1*T$ zb`hrI659r%jcnW*qr7q&%VQJ!ZEA>qoS=rgy=@Y)GQ)kcB*4Ke;-i&OU(^cQpeCphVabI9$ zd@3U|v$UeZ;dTe%mnn8YFc3gtB?rfgi4)BXxW!@V1Qa8-OVzd2moBHKrRC=3!D@j< z!B@dn)DfG*mF9GNu@M8Gq8p-fqfolNF1MQ-!uJ7xo69v34vGXJi9Hhg<#M=PF1ILY z4p+~>$bl~o^$ZRclvVbQj2%B$o0gHfZv6_63rl9y!DYxC*pnS1j=&#F>Q#R|g{I7neFcsZ*g)klDH24sUu-KXT7#S!royMMW?I zT!nq%&}1;^^m?EYnkMu11p$;0#&gCeepFx&2`Lb^yHZ_Vk3WP`6>z7yyZc9uo;V41 zZQ8hb+qP{LWo2HEE7b!+r9vF6xS$;}!emgQ0|v(Y^{pN5^sK2+WNc!htfC@6KWEAx zz!IFAnuUkw8Y^4fiwXEkX^3b{ z*2HrFLd>zbrR~_s(|})5Sw($QYioPghE4Yrl@=qYaC`1H<)8BDS|eVF)CES0Q^+mD zKrWGaiM?I_MdKCoyAaLkQKtkhAeVf>=|*J+u(?Sv>}YK5XzA!JDk(20%C(IAw&@^- zoM;%a*yTYq2J$^A4sY1z_C;-&AjHKUk!vvIi{l07f;Y3dYw*~)EB4gX^;@>&pgBBOdgDVc*5eHG_l0S-Dx>^i(h(n1;2&(NHf& zCxT;BkelL7cR@SNgCVi<-&iY-_2enSDg>=Ij~v03)s z!I4wv&re0d#Y?KjL(%50zM_(%($bP}aB6IP5?^Z6?!>YkMV$&wPaukfc>|@^9SEW4 z2quCE5hsuKz!rxmCc$i&EP7^ML19*I0p@Y^_%R59hm6u8Oq7dF0U+y?fa2t zF!PJiA_APC(PHv;dOYxXs4PmUM(YEgzQFXzL||yl4-&i6Qh}VSO|6hLH@|4(rY)t# zg{Wd7{}lg%%9uKaCxaL!@Hb$-uzBobQz=&)TU}|H-t?@o@rkms@}ip3LmB`!h}P@yu-KEn zKzC0sVwTI3s*WC$+KmiGxI?6|rLDH18Hoqn>h2#Jne;DRu?lMw7JI}aL=LydJrxY1 zFi-gXLn9+j+%{>cPF`kK4t6QLKTd2@3f*Gr7gITQZ~J5*Iy4m=@&(7)91b*nJBP%}(uN~$ zw`VLkef)e)O;cwiBw z>h%r##wMmJmQ-cuct=Jj1_p+CGc_Z(sC+3N!nTe+FtV_;3RK2i-#g@UYhGx{3 z?A$CkW=mV!sSB6RR@XGNb)v1hy*Yu1qoJkk?70hFJw0RNknoiAhWv6uvjyHGqfMi#$Hj$}YkX<}H7CL{q@$kuuO)b5_kS#Mk zD=$0W>qch<)WZJYWLtOFx$4WU7$5`T?xC^Hfg!gib#!#B`tqfkt4(A6XhB)I-Ro}c z89RHS?%)G6u%NC(c%%I(M;YvkC?Cc*ob*c8q znF|-{o7)FRfMicvw$C4JZRxA4Yrb07dQ`j(!fC(qY4cU);`NpX1)UK=~Q>Ra1wuC&z5Y{uE$JKWUT zm70|oh&nsEhrc*-yt=lbp}DK2t;gobV7hpzi1cgg?7VdOQb%V8o|o*L%(OIQDeW@x^%Vm`1v|EHa;Upm6erE0phDoP1s{H zvhq^w-uCVRgb9Z?qjzND`1#9+&R#lS-!?Rrl97|=blck72QbxOAQ>DV$Suq&Da+3< z%3HB|X+cR*cXv0YJSD;OAMDB9SEb3d!)RPlWQeeg_ev7oYb$~Z! z1VwlgKP(Apc63Wj$M70&TKeG7FviT(%p4S>w5)uPzJF+#ztLzryZbu2yKsCCkB(0I z{C$1>Qi03q1gM(ZI{Symu?-FkjRiuH^sF4*>zAr84Gj&!ZLt^^7ZvB_h#WM^J73(Gh%&X}N7Zy+@CqZ0+d8*qE1733 zGCXedEuSQ{+aq2512|y2M@KzbInypr&(JXD@zLSofxh1EzTuw1iL~63pgsM}#ishE z&f#%Cstn=<5=nMWc512@o{agowX1*s7sm*8gKv7%(|uFE%QZD<#^aOzOP8-Q<)P8Z zp8nx!yJymD@cqc(uO4HxL}5+bp&U1P=60G{TDVa^JY`)bSH-t*t(vZ(tZIIT;Bq&quLG*kMfnSz9Cm?W?E+MrJCjwr_Z-{ zbdFC=wRd%O^mL--X! zAz%aJ;~j&815;CFWyM)(9yjsd;V9;TuKtns?xC*U@qv-x!0^;W08c_wtCFo<-tcXV|2q-SR5=M_lAqlRg+>*^buo7%gu zfjiQ(FwC^Hw&HJ^n4IYA>*?(3zmNURsTNPi!0_0> z$QbU2th@p??WNi}_I6=OA;yf_x)vPmsTui06M?fAYtCN0I6O8%fZG4Ry*Gc7>&oss zbKkS7vUXGzP}p~nY;K^MY_(c$x7xPk(BhEC{=pOBiSaL^2+1Cg75>2!{wo~e`9YqU zP>dC$b<|R8>6P7NlOREY*taU|weMBAuk$(QyqA@=07w);5@^082vlXhci+9|-n`$l ze9yUe?@z(~;Lp{YW2}5Ql}k&DOG^t&OG{my>F!L5ZoxRgGG16NpuyaoTU*GM@fIwt zEE6R_O~TJ5+*W^JYH{tx-RYGg&Vm?GaH0$OJgk7+)hk!V$8Rkyt&)0@Om)x9FW`12$A3TsqB;bG4Dn&f@P#rvg z-{H3G-R4PPg9LW09)Bu;7j_-KS5l3Ho=%)Q5Gpl-^Gl1%E6aEb?@mqzqOnA0_nmu_ zo!x!74RL~Idi(LbU%z$}rqziTUwHZT*ZO+<$F5(;KY8TH(c#^D0HI`8PdJudSjj^U z+BG!P)8E5BNLc?D-hA_=uY9F9lMx?%y`D^_Vx2wyWOuxGB-%BwTK3JYtzm%XiY4~# zk+3z{vdU;<=A6VVUeZ{!*rQ;K75*#f8Pb-mZax43si44kH14zY|Lf-Ft?9 z;p^Y%8`^zuY932ZqvVw2&}?huN8#vmbqo2Jq6W zZ@l#K>+w_?>$6mofJqQ0 z(wTmY*LxGQs29F)Vs<$fNMsoA{L1Rl6GvZs`L&_p{Zli{d!8Wp*sc4xyubR^na$n0rR|?iw1##{=&n8BHd;dc*0SK-WOHb1+v6trm&9ry>A9L{Bui{NV*IE^W5yx{zC^(zxl?A7hlG+ zJu$TqO?1u7EwlJepFaKS%demmPE1TMFR$zx9O&vu<3|oOs_9g+D9Hw)ldu26iPK-r z<#Uq{?jAjI=#A5_9XWCcm33)(nYDW7-UH0)S6_SW_{pQmMDpUrt9TC%zwpY*m%b8B zq;S>DFRu{SfLYShKiJ#f0~>B)dgb=r=}5eLdLGqh=H!c~PQUrp;nCftviK?@n8*tY zncm)4Uw!4^!F}P7e_?Ju)78=6-!1%kqCMe6s-q{8=&40J)4c;UW-%=}cl4 z*NL46qG{xouSbrYJc+~z@1t*aBs*4?79g0s^wO&@ocao}_Y0S<%`a#BM@IQW3<#Ys z$h4OnOi9ocON*E=*mTU@xq<4@#(vhq&oR4MXr45 z#GxYxdy*;N)WXcQ+hf;m-n@9>;`rDttkwCMscJDF3Dl#3YOq#{HGCO%&yKD=nZbR7 zLrL6`CEs9X;N+qG$M$yb?#~1p@Px}NEAuz5T{(yU{rdHb*DqhWdG*eNJK4fAjJkNF z9&VHx#kH<@_$w!m96P+fmjG)=M^{%Sk%+@(&gNF`-M_QEvV@7VXKz1bf~ncL56--| zv^e*|3&)Qh9qQ~zMndsYzA`sC7xBjq?mxoai+W5 zLb;fa!Sf3-?qYUnab|j|E7N)M#S_5>V9E zuxB()bfZ*{P)=3Il&reI%2NLJ?fX}*Ub%eX(&Fsm^aJL00gJq=E4^p;;GU7LJ$pL$ z?cYo6d2VhI!q>>)uDyF<8pQVP+uhgOQ_AOw$6#01sw5{C60vxONK!1()!Eh873+)! zMtVArj}9K$GkEgQo_(WxNI-z*7VGF992q@$aR10)Z!}oVtxWIgOTF^K;ll@ejvn0` zjRfcC=I9-H9KuFqNJcF_|TF42M%=)4h=?AP&5eMucqR@!+Uof z-rIfjz~F(=(J)jNNbHh{A_?^97K^JZmu_7B=#z7woWF4GI>Cqg^Ye>P4+*|V7Du(* znFx;#W%|;gzK-DG{jrh3bU0XwC(tt+9Ubv~dxwTcQnF~5=kAPOzjgi6?HlKBUO6{; zZ@gZ}^>=g}fZbUx-MxPgXItOkAUewI%8FEP2uJ*p5I%$3cW-_4!P)a?Ke>1F*3$e6 zNfot5G!RN+%Ck`ECtQZRx9^Ilq85N(M|lHw{UanAsX{|e4@FL-{!GIcg9;R4BVM{cF+mVI zh{G`++r4MFQZCHTO_Pi>(A~k_)Rm0%q+;EPP%7w4M?)DLe5tOfnT4Nya4uUcLpvYc zzkm1My`7nE-14N`NGa?J6yka+=8J{=(U315i>$1zoIQJXW@a{>PVC(`di>b&{@y;$ z)rx|Jo$*+p8r4KxC|S{T?C^;r`}Xf19_jzuFMjpg|M*+`_m67sGO6YzcKc)`A_T2m zDGpVtP>D1mz3B|Vp9=WmzG}?h=*^^Hqxbjq96f$?-@$!*5AA*9t<&H9_BZzI83+a{ zF&OUkN{kG*NNBJx6Qd5dq>YgYU7!QUk01N>-~9C>$BtaNeCY>&|NToBZsc-#Vhu^K zI0!X52fMJVEA+Q*Lamxg14)q6eFOza zJSJ5TGqhetQ>i5)LLHP^C-piS71?R$(Rr?3rQ+-Eeftg_IkIbH2(BT(R>-a3C=Z~r zkcmJ^zeu>ZuQ#1e!wyR%Qt%QaH7XFuWV+#oPdu20ht)r@3ok9^IqbQv?hKskLT40Ar28P=ugBXlLKidVhOBKJngYaG#QUWN<&GCMT11D^>d3@W38*3P2YiXJFF|Ku^GQ-7 zR=6{m?16>*K4VWKOU^dd?l2ic+eLOl)`~h zG+d8_d_9>?2CJ?B<}@}kJn+(s$A$*F4(%KIjbHuNo3Fhzm|;Bed~Oxq0$j-cK|)1^ z*~JAiBRaafSJrapKK=+kM}JS(;eDfr_wDC$Nq`K;^Ldg~kaHX&K72^Xhigk*)_da6 z!M=`kG}wrT{3+DO2&pOS7C@W3ns=Ee0Z#&-rvx?w{KjXi9nXdofXFPVW|ZI{6FL#| zb$4M!M#sm-<`);)@}qH~N=-btGc$RQvM51P*s6JW?$t8pRH>Y=my1~vouN(NdocH4 zdTwB3^NCxm)A-A@$IF~Ds%p>*BN$i=Mo12=Mi6@g^|D~^f z;~TFYI=G+RR)8l^iwA1S5LPu+(94~j(cb>f-huSXuO0r{*I)X@Uw-}Yi9;A6YlSQs z)licGw57G|Dx~h!mHcWxj`uT`4%cd#s4r4!gew(@Ls4?=s})#r$Byhdc4Xwm7Z1Jl z*2{0ada}PKN%b*8#34$M5>qARtX!eU3&j0ODK9xzr6PEI;J|^?Z@hl^@DYshvFms4 z-oyjUsDF3!&_ z%;j>`LOx5a7jU{>E&%Yg(i+bqok8otHVPFVw0!*KOKZ8;-~7e5e)*RV9y^}t?TN*r z=t*IJ9jaCbI!L8dgVtWJ&CTLvULg&8WqECFWhD^}4)tde;pjY-UuI^im3*ct`%2i8-;9ywNP4FU7VrZKs%p!#ko0r06ysb4LI#S zsovwqJf)~Y?)J^AON$FMK=gcVWm&Q|i^Y;A@#k~CWlBM;EVCwJ={V56vbMC0_n*^? zBx~N!dRWV@Q0Fm7T{$79`fw)UC8sb09ClEiQg={O8EP~de&fv-zWMDpkDfdbiG@n2 zArv%#n@7qYDJ0ByAzLYA!;LcHi~2$OYM_)4*DL6_w8p?iA)!oO*f%`X^Gk2N{%ha< zrB_cK=3AhKFW(71snkCm`|W>94-_;>+C~9hFi6IY8k@59X__Wq;bYJU-8D z&3l$70Z#%Vfky+pQF}8tzjyia*!1iy`B~TtY_sXE3>8f-T)d2f zoDe&hLD7;J@CcW!RJk!eb@|FPEM-c?!3e__K6 zIe%&V_Wdj{7>xNt3F_$hg7HYav!i=pHCH|Z5Bus3Qng7Wmvd>TkY1sFxpuU#!1a0vrjVkNsgyhjKrMzwSH}U{Oxz% zIe+0Isps8&ecgTii4+E5bl2{oQ!l?1jKw}acj5fSD>uh)QT+yrVJJpCw7;Vp!ghol zC5X#G_+4F@T)F!G*$aRBy`Q}M-Uo0P4<0_6>PTZF1DzV9=1R0DAH@VnSU@t^&!l!= zzj+Jp-aI5b3XIh%Va#3p^KwL5t-H7T=&6&W@4x--`#<^FxwD^~=W%-vl5piOl(Gv; zbLDy|ok?c;5{Zu3c;(RgV5_RXK2`RLs<7eBdljoN=B`}TJaKmno1Yott_SJJgRGq4TGfIolX#^m&Z zSn^WONa_L82QnZf&P3iF1s3r^;Gs@+4GfMz7d`v&`L}uAg-cLIjvhaC=*aQj{=w@v z#((_w&)$3gV{#C{;*Lz`uHB=M;66Hk<@-PW@XSXSm$T(?Jf%hQg0S-_^q@Gn?s!&)GROJ3-q2 z=$_&3?oON=b4!aiZr!_d?bh9?`-N(r(`bEELkQH-;we}}-9b7};2vfmUopx~@Dx-O zXs4uxYPR3jTwZTi^(5d);2Dy@_N8j=cnR~_YvpYS-60Gtc+O;vNxp74#x9dB7IyC& z-MeoD1A=e-yN4oCOt3(ncU5%zvg_?hExp?{7y|G&pl1h|G?LV-m zCzC=e7#`Y1wH?q1PLnT?SXf!TdgD4Y>6zJSe5nJy@PsmCc*7D1hGM};x=;-)tQ2OK zvTKD(yemT#vyV)=Aa!0NbIU9JLxV?;k3fhcZH`iIi*xgf)6>*D?dX6Z-U%BSZ6yzw z2P6H%!<{{8;EFszz+!NCBws9ECrRq|-NmKV&P>nYV@HVxgR_~Q#K@i=bQlt_*c#dQ zuUxr4H@iss5nQwV2lsYo@C67IldT0Oi?lVUTet5{t*ow|JazKLmtKq~eXFa*<>h6_ ziR2bYQIim4da1NSiBnSJKD>B^Y6KY0xI%h*GX20C&gW!;>NRknB(A(?fXs#Q@jIwf z)C@Rs?C8-G2dRKZv-r{}25{u~L5y+`n2K^_?e8AVkY+~x*Ih&XXk#7e^zM;i@Sxs^ z6skVbRTNjPrO)fK%T#OfBxp}2YHeq zBhlSM149Gd@d&o&U?!6Wr1B&wghIP_4GeUri`gRCXo*axKawVk;nv-0i1K6*q%uU@ z_mS^#>Cz?a`-P>2*}293!NJ!~zlu^fcJuC)OP6M5XGjPnCIZp#<(FUS>Wbh@r(6(G z3{Ety1rm$J`pn|$DmilH(okRD;e&hA=?+MUE3grLp>%gYDnxI0h5&pjMr?=@Lg{QJ zaP`)`$*F0;{}7>@MjKWJc^A9fn8{C$(OR z3Ir+vKNR``v82Jlbax6OC+TxNy}k4{)7>*L*pIOJIwn#*IQ;KFn7niQ{@nZmOOZ6T z!Cixt5?)?iCQtIEbo`bR3urVSeBKQK?%Q@TEIb zxFrS#yF0s*E7`T%w{KDrxTm{AN64p+Ex5jnxj zPs$TPP}p~P;3)%!{}zrO1#ni`S*E5}a)r*G-UK#ijbbO^6m{xCz7^_>%uK}tzR}?U z4!0;*i}8-+YT18xrZ7DRc|Y1a&_f9|qOCBYs>Rj5ObXv@AyVx2H2Mg;mtyNys;{R;b;ZS60Sp!vRxs7NFyRNg5nQ!| z0a>TO53UTz^WjK*b*)6s6il>K64NV5(iBB(^Vt=uoFs`$H)?FVGjrK&ji+Q?MOgN zBqO=C+|1+x6=}MAG88&ZCaE=xZHM z_3y%SosRlaK|%{_-5m+K3Fc8&XueSHiH4Hmd@oZ>5KWEp3Da|HD_KlvhLsAzMF<4O zZj52kQ>7I~IvN{8KzGdLR^R{GncPZobl*r{Z-z)wcW0`%D;=mw3Q1#3Ekbr#01{uFV2wAJ}F{Pn?VIE9ajpwCbjR~Hd6ReNvGEngnL6NL{Ejdk~; z0Wjk+n#gDKs1qc2P{Dx7@9Xb@2C%eRm|r0svNks}d+WyaJ-c_k`tpe|PMK&pfp3eW zXet#V2pvhdeh}33I3^10R|0d{+O1j2`PBOdcTwRm5v+B`0%-^zzN(*-0r1?^gNr#| zBOD|-F`Hd07mBGwqEaYwa!_YFEyvPOSHBU?=JSh-OSs?B9*7ad!@*s<`p_HEHZc2p z`g#cMQ*38)W&+JGj$#svFD&Nf7x^0J66uZzf5^#9rASNV%MMF)HMiQCilh@Ea$8uR z{h1V;gedw%D3DhDb?Qzl2)#APO)$%r-^FHoGH`B>rRU z2;%vWz(J`{lXau&%Lvg5gS)YMw<(u?s6p%8pApSTtPeq6dzLxopG0Q%atMp&mlG8 z7H{A#4n|NIx+t4Q%%G6Z!FLlt)|1GJg`5@Vmt)E({7%{ZP^7?7CDc_Fw`rB4w@es` z4N^0|R-*!KjVI(*;kYHDNrs_C>}6y7*dks67D(P)B)6>{16nQ5XMWJzc)MIZ(p40NK-c_3Dc_mDKk#FbF* zz|KaQ*_BEzkOLsAA!k4Fo07j$f*FVFo-%*T4SWRV5v7n4zmU!e>_50SL5Lgj{O;W& zs3~%cx}+F9n3A_vK#svd^~~4NEFgnIo+~y=tD!no zgDJ@xq5@(l(N*yyy()Y`hzIq;D(D!GC6)*Ug<|ALKhWb#os7PBY=fz&<%sSXBk}rYkEC>9sfPA@2L~nOt48YOa3u?SqE^aR$z@Dus=gR354bQw;OArnIkHC20%nC)sw^|YCaF|f zf-+Q?lXr#qiF_cg!lM*fa~O|IH`0+h@+fn9q!EP3IHUv!l7teVqT2C#yvvlYtSr@P zMOclzh|)BwRFTXlBH>fV4!`!5m-@TAQK9spIs8u^tUps*y4M*`0_zfZNG*ChT2oK! z#(0;rW;ilLNN-SutJBjnQ!_-S^90vnsIxJ^_`%F#YZ1ni*!x<&9rq_RF*sOkEOJmO z)kWo47!G%#?l|o3N+A!HLkg2ba3Kwq*u03*Ln3Cc!AecUrAE3O{h|kSNP$;sxvPN) z=3psu2q;C+FiF^wIHao#uCuRED;2=Np$u=C%}P@HFxUuNMmU;9C~DM*)nqQ5^LVo{ z$8l*w$dYq1rH*=~QDLivAyxI)OLUyw94I9cjLE_#DFmZpp6dK^k`0G*lZuC6lTs<&z=UxG4kyC`RCFfNzr-t&wp+PdI>854(}0 z?Z|4@gCO#6p~j3pg(cFlI&|z%sKeLgt+xpwA&?(SD#ighBPF9G*nl0!Qx35sVc` zuyh!i0QeM#K#~%FZ`4pL;o9)kK%b-xFZu(a5aD9WiKSSg0DXXW;Bd<@t7XMDL|vglJLgx_8adThQn>Zp zdFd<2B8SWQ)t!(?h!O^x%W0>A?tr>j@P0pz1k@z@1F?~L!gM7xAVr;2&icdXM0=vTu#Qo3wUI6k z2|;I2oDf5jN`AvKdG};CCgNftA|}*=Fpcq^l7ric zzF>GGQ?el9^%`Cf1_&)t$c>z#EN21Bmq@;i^*YD$Flu5*xWZHsw{zU(ly)hR5BmG% zgkm6GzK#9{i5^;Yj-^$^RltBr2;gFtuABs~WI5J|9LpqXI%oZH04}OI-(S|UNJg>^ z$pb9rlc6BBgXD-=x}_&NdItQnw4Zx@@g%T80*?cD1p}>e!;Y)xfso6rC(`g2Kgb#0 zE?C(~HKrNpx!#&Zua6U>S&kc(v%@u&TP~3!sP!N-IelJmRjAg00S8)$ixr15 z`ygIS<&aZi#777agkX~c!nGT8O#aAuTv~Teb{_$F!DFtpQ~`Mkr<%}X#-hh%>h32- zJliDA^0#biaxG`sh%=SVA8o+SH{)K$D_V^*5=g+(Gg#%kaKMR+1T;FzjC0)|%t$LUqIVQlQr`XC-t}-1C zhKq)V==5}RIci5lBAS{!NQ_T;**uuooi$-U%b_>!#p>|K=)~6{y)u=LPTH!_L28zo z{>?jbo+yz5ba`P$n7F+mX$0#RbRE+(mf_uM`7_P z$dtgg&H_4{^IUOs(^ccG=>L*kq5=`;IHR`Np(zzLZIVkVsq>=!iAm09vOa}^E*Hy+ zm23h9Oq~(pB1z;T6)0r>^ekJ}KLZmTO60>eIxZTMwdziyy+gD1)f1ux8^)|8Q zMF-~tG)P;JqI5B{DtDx+?>Jvuk&!JAlxz2!EJp!~<|lzCJ^av-u=kHA0Z#(YpadQX z@Gbq7eINJ{M3?k1+dIVK(_^!3QxGK49m2MI+u7ZXo86oYArj8SFjHfZjfR*s`y;VK z>4qI$ts5OaQXGb|&$1_iE3`xmm0U83+ye~wLdEcv5Q1W~=mj{J#o_2+94ITyevk?O zzTlAZ1_fzolmBFoWB&}XSpm3gof42l0xh*wm#5EuwF2H2^iy(@sKrWPu{vpsJ;LOHPpBRV$yp|GF$W&ur zpj$wdD-|Im16td_$kx$u0g8p>KgbhxbShPu4$%X2BIGx9L&$+(qL;M3bWZiKdwZ_5 zsg2nFZ&2b)vJ62Q7g$$wnklnY0a|ItFo)$n8K0;Z{BDTXz;qYWQ0W?S6HgI83yVt( zRtAn2hCB7ZHeF4kO-blO=24UxQzKOQ6EV<$9^2|@DIz5SZE+bX{zx-|M&e(WuA)x} zq)IeK1}6fSi`2oO14L)yP4e5p$S!5rT)F)sVJ!m|J=qx zwdpd?k)@XDlMWu2GER9XY{&b-lYl3IFHQmvA=x>Kzxz$bG?Ch8Y-DOBn60X&r(u9&1_?t;e#J;Nbkfbx zb_8|^Hf{{;GG1i8#cVnDa@n2Pq-A3U_|?UY?IgRc1f<1ZAg~~NFn)J&zsv3^_OELbU!)Y8Y8wLTvia!Fh8NK>)0*atz_i#Pa_qOJd#kg66Hb8)91KL(g=Qv@&2!WX zfCtqqW3g!jk+?>9f$GK=OUSl0wm%)P*||1&(^zDfT%(Q1RkF(qIbD8`-CUg(Sl|M! z)UFf2asX8^SB~a%t!?R$zGqS~?|^}?4qhOEN8_u<3qrT`SW|#snzW5xc4bvm_|=R( zn>C#(nMwH%Y2xV>NRufLewLWYqRIeCAS&Nf8D>iy$Mz>~liCxHzB?`&JTJFI_CWwTRftoaqy#jQkMailvh z+Y)r^a&0}wMsP3Se(W#Gc95>EJ0~zK`;=J(23xiP>3QB(B#UbVSHwmFw-jC^$c?Qm z7%WDYqg&|1H0mw|Ma8%?Jd?L&U(?1RjYGnctw}6FF_5H+85X-^dy3gCe}%T`+8Bki!7jjCs;|G-`fzw)WX8_a^YSx`$|jcHRMoJTlg z(c9%{Jt=FbGlm%~{$rhSQ7Py`+Ar zTLZBOIO&bzAJIXn3Zu8GOdQx&s5Q|U@Y)PI|GOe}!X5f(T_7Sry;L9M=8QPM+AtBR z3RzuL?lso18ql)p#2w<8(W+84O=|JQsN~TJ0zvF=job+6iVCcHl3DX&|7-iAP>P7u z`JwR!K9yf3dgXM(R1^2RBcrw!Y^keoOzhHU{bsPfWKwJisTV-Mu)11osc4MBS#^4g zDQh-PoB6sZ!Opka9>L!>?cU3ifG2^^UjnvEyIZ^S{Efid0`PjZ?(}X?EiP_fblp-k z%By>$28oF;YGhMC*1b;5DcKVAiYBPYr+}i`|IU7Dk7(}EvIV;RQ)CqfvF?NFs|L)~ zd2Fs&`B(u}HyAN0#Euraks7hK{cD$0PjLp|`o!&5ryI1?vPH?oHdNj0)F6_9h?Btr z&2&;~-#PZ5JW6kO#H7zP=(7FSS~KCuJEp$goI1ZBCf;gBf0`K-i%4c1PTd z)Lh!l33FR?08Bb!^S3cl>Hv(k>GVe}Lh-V=s(=$8;AV{#*fuZMn`GQk&@mH|^S1sZ z@fW*6_~$O_s6Hos(UCTV=E%g*MgMjl-ISY+-9FVmG}otw!yRe5!r35mdz>R?bHNyz zna0MmAb2#J;~k5n*hs}+rNfX%n*?S2hS@fo?({igbnb16M{lwLs`hJrH?36Hm93Db z_NFtXFs@B#9L5-~a+&Iswz^CgaWn&`QD;QX+Oxjd#Bf2&0&u^tCKm0EId7UPQhpQ1 zl&v@$fjTwBc_x~%>zQks?`~W2%$A?s2W)xEd&84}CxM+xKyX5K*ybj@v7si2*w@>P z9eJ7I>V8Mpq1{XZH7Ok%Or6YJ4Co1~+-@>>(oIaDXX97hu|Jy6(mTYt>0H>_DR*me zc3}+}>K|)g{N~COG7rD(le(4J#%SGfEEGX3iz+m?8tZLyzq6g%db2Jj^O~AZQ)T4X zVUphDnD}OCIhMWNDcv?NhHZ_~uC-}>a>wp~So3lEyBhx1h`l!Llk&bJQb*u|I%$DFrx@07s_~n2}1^xi9FGw z4>|`M6hIfhTL8~mmaChJpiQ%R#n*2)E4k(6LSzegTew<+KC*0_q(1W{= z{5F8OE>{;YVQ&2zUJ@$xIH5Ut%!0N=z@x!ks3?Wa=e)RiiHaBIh~Qz54nX>5cpII7lVT7#JO>q>`qNfYun zZIv4(=$gqtw1ilB+~T=LIb#@f_E>^;*AtRvDT zDX*k~0bLN>s00s9Ru9c~y@+Ph6mC{@WauqYa+{Osaawo(S>G&les!9f9wiMN z@vB8q9wG=ZIuS$w&_9ygkUSSZaq2|7n)!gb#*QYhDWZPa96!}0cc++qU+6@e>=Q@a1 zakK)wc3p1bc(db(g~W+`5~vzT@h4+Wn?HEqrTJDj2697!gjQ zAl8;6=JkfHV;k^DpI}X|`-f~+M8ccibS6VBc)3Sp)e7*+GvDyC32j+4jxySB zOL;x{(XMY|uREGei_cNtOntD4(+P2B*6D|Yz?)wBEuB*VZxF3}n|$I-sWV!4VVIZR zQJ2k$Ae~UDs|KT-Qb&X2Bh7+zHB%LJb5-k?PkP|2PX*%jc$!?i5pi`n$Rk?RG5un; z0DRMx;XKE*c%8}(GIg9o&T`=@Nm1A|gYGJA72I|@z~*`Pe)lBcN#N;7p!t<_zj&Kt z@Xl^+=B9FX3^7E3amO>z|ZcnijD1%CeT6 zT}D`Q%^0lhEY5Cb7Q8+OUOlB%l>umv*4#3;2ePx78qhTU+%3%U7`P%9B6N$mU`MhEigZXA;-FC?0UBsn+-F&PFp2%(Yi9E zP|1eQn?-FA6$hN;K@M$jeVC3jy5))L2Wiy+Ri^f z&7EVxH#@v(_ZOsdn>H|0eaW@XgCdG-mMRsypkLtP9%J%v8T|I&Y{Z z&1{+ndrDLOn-+OXAGQa0cZIm?qD6UeA12ec-gSqQuWoR6mUX^di8_nOSx)YxZW2aw z@yMdxv>x0MwaVUcnYl`~enHHFw>9lr^QM8>)QZGS!LX@tmB-B!W8aXi?{3p&?=4RP zo&+8x0kKG2K+_yxVMfc|&~&D)?_^Fp8)ER3_hL`x;4;c@lNe)_QsnEdkm;CcPJG&S z9J3-Elfsb7@WlDTx9msK8}-1tBQW5!mpYFP1XQ6=Ad$V;-JW!7Hr#Z<&wkKUA;;u! zJn;I4`Szt%1v70&2!N7^=5E+(QkxFY+<_Elx9mrT+uC`tLglY@L(u7fi{siGcU&92 z_D;vt-gO6}%}Rpc#+lu)FWWx5zUR9#6Bo0?53swi7aAjdT{$qJ zu6IGlDuQqzy!nYJclr?Lfg)ggs5-bEOK%$4;^Q5T5Q2lXCpT9?fytxuWr<#R^p+`UCst+Ony0_FVM zI*=cP_oq6r{BD7jrevhsQf)x(cb#>~PIX6M;@tYxc{TvvJXoHd(Yjo`pPx4gH~~^; zi%}o8-{05QXJtA`Y<9M&mc3AFQM(RHAE%hDtgI|7EX>TzMdJ0UPHvEvf-_dy4gK*KDP?U(ZgEa+A4)j z;%n6gpS+_RhHMIw+MM>Xp2|F$e472*5-Qnt1#CNmZLWt6Loq;X{TAr&t(t1Hds|1e z{px(&yN?xovw;oE&5bj(%BxK|Jg!Hd;&XE#J+=YMU2IPLw%5zYn_AjVUwQ1az8n{{ z8W9g2@mBBAw*I7TzB!wnmR}B`DqyegMNO-ByU{nVeBp%`I5Qn{oWnn50dKSv)wI=R zP1Wwj#YM_}%V8tbywDt9E#DyqtC~;_ux&QA)c4xXOVZg}t`ke)F#z9As}EmZX85!| z(X7wSudVykCUd&YZWuy67OHvN=GbPQ;cyX_GChM);PkYi9%8wwv2o&#j>u z-Bz~_So-wH*=d6Cj)c=bjBRRu^KiC%x;6gTMZdMF%~LPSWpgv)R@kymH?atJBogPQ zrzn}H*sD)7BDr^CU~0WJM}u?zdDM2ZbuPAbNPOCkewpq!?~X2TXO(YN$kZ{s0nZ;E z2>UY0PR6>8SX?WmDbGevcMs=o@C5+oH~8w!P3Zudh~8@$Tf+4sf=E4Q)NU)nn6g z!{$CHU3}AP#{=Bjv8_6dRf$`FZ9CxY`tv^AWz7Vgu#s4XzCWZVs5k8OIeRjb;ngFd~Ee<@lr;BLlW zo6($25U|-Max{XLRVtL}#~4NOtR~&*q0-f>9;OVscezOSnD4knxE?)`?Kh=(zImT+ zr54#zSAdrvEL3WuvUqwjnG{F6`>qrGbGj(r-Ugv}?&s7gfn7Prk`vB2$V%JQmtDMd z-Fp_iPV+Nq!K)JYgF=#k43?Dp4%EDe%SRw4q2yt zKIAH02am;O`m8*#M}EiKZc0f)kJ&ET3^r{VmC=%9c{dty&LwXGysIj#>mX2xaMK8?|%~;8h-*5z#SO&9$$3h-*Q zZL5K;TSKj?27|8Fq_ zbVJe8H%u4l=;)NR_04fl*U3$FWfxmG0xE%T7!FID;~gm0Pg|( zmYsG-7Q9mXpS>9TGYasUG1AP{v(!ETbUB5}wQQUuQTvKM+>Y`9{)totwer?sz2S(|Qo6>c+1u6}d{Zdv?> z;C^2!l@=oXHUO{lfCUeW-sVFg-cHJDvQPD!q|I$2!#8L2u`+921nym*ZD4QHqIh^* zeS?$qu>*Pd1#L#|w=ULgbk=sdvBiMd8pW|@+LlB+Pu+0MHbdUZKHm1*`Pud9Qw({> zGq_c7+cvdX5?e3Yo(cLm7vGc2+s*{v)^MJr8&Bg}XHRiPWNaZz8487{qwR-5Btc5o zjCu6zZi4?E@^GHUu%7)kHk*nLkgo&0VGr;Yc8y6ER%+6?DEC*$+F=}F+Tk$`SViW#~M!U?v0P|l3j zebHD%X3cxArzionI5(P`ZeY%-B&N<_b~UsvoWWLu%gQ`7iFbxwI%QgFMJLj#i>^n7 zpJJzn-$D7?@Y~b^Ej;&{Tk_1+C2cg1xQrpX2Cadx$Kq@iF2v6YVI#*T0MY& zii^e2-2?ciC{nMfFO39ryR(<$+SQs!HFh*L3b!TVeQBigxenCvGq-TcEP!G!>xw8_ z?#td4NKv+!*{>)BV!XD{#J>#6nT>txT6OGrr+k^4ST3ON9!0HZJR;FlDz%;_=Sp}z zP0j$`n%lZ4HmGXb=9TSi5?T+kbe_6x-rDE7Oh5OBZ7cJ3a=JeEo_Y`TB=F2hU_FQ{ zI~V3)KuYo%v|u}`*SD>Fx@T@=&s&F@QZ^jnrLGj?f(Z_7!>CjIH$BW=mh@%Le28F= zD^T>j$><^dwOE8HH|o`}i~uLS(_-bS{-_cl2fOSD;5AzHO}$lEo8Qy6jk^^sUaYtj zcPO+#@dCx&-QC^Y-QC?GIK`p32X}W%zWo00v+-pw8_BVfwPt4BGjpA@Vn3=Xx<*K3 za~AF!N%(zcZbQU^tLMnvTvts9*;^Ico;eqt+KK~FCmU<>Df)TF5~j7;%C-EOY`>Xx zbt$;I=CB=J8m;f##Mc*wQ6jexy^WoDXQz^7H!ZKZ> zZ}mq(1kDv`7c<)!q07E|dVd*S1j##LPi#K6d~->+`kTlEB%E}J+>doB5A|D6oVuW+ za?=LCDFNqZa*TYUJ@%8w4}W0DwZM7~_>Q43DR5@|Z2);h_9bfOMcz9$*0)p~AKT}` z4NSsXe68{<%lYgi!=3l4mV;pj`QXFmz983p;f7F?1;SZ5H~B|5&CR5bY}F60dxiM7IrF*a8>VaN;w&7=bI>-1>8oC~qBh;!bT7s@f~!63N8{JC zkN{^aZmbOL_Ub5j^r}v@#D+tpRHBq1ixo&pfy~VpwW9rW0eRFz)~QJO2@bcl?JBU_ z^dJ{dO_()eU8`u%ee`jDZ0Ib$pb#MZw>13LEoHhswCl>hEx*}mv(ue3lJ|Hn5_Qp{ z;cckAoL9uE3Xd8xa5`?;puQi4WL;kqakZQh80! zgveY&a-~y8w^=Oc&2cfo)NT0Ph792=Ivu^73L?6e0G3TzIDdKhlWiQ=RO@+W<|#Qp z9ipTONo`zDN8C-21ytMXKHbQm--J7*a zF7NQQ8xM-sW-0BroJeXTP@2dG1~sQmMviB{qDyaW9Biy#QEb6gTQt3BhwLQCRDJ49 zp{GHuLpy9tnqv-bxDt!B!hZgc|9}0>(GzNWX#=dSd+*dHCVZuF3$^9?15ph(04h2p zD$SA)#lLE(Dr!a!l!YDsmtnGqC^`(S})uHm~(58{~TNMq5HE}K`m zg!|G`oP%T5_K^kEKuOW{)yr>z;P!|pM66vqYADJ?ubC)n8K%IJD|e`U$kz}$)MwF9 zh=%|TFYu;MNl3Ad*1MONmkeW}u-~#sw-n8MmK?`RNA^jnhOBbAXb!2&>qfj~jt-Tl zJG8Dvq9{SCU1>+IUuzC&gLIwg1)rzU)1QlCd|00f9SMpULLY`Z&{1pcFY9Fmw-EIQ zib>2l>cU)Gc4@s)Uitr^TWGWy*X{Xd+PT&P!~3c@db7!2w${<{^74bS*AEOm%`85@ zyTOhyErhn{xS<7|i*hQvno^~n9QO_Qb0!77SNroIO*^CDO8r`U6N?~?Bg6~i81B&#CtTXCj~ z2mn)7UleOqOwG&;=T_8uZ&TbUW7UG*igjm4R^P3mK?YuucORp^99e4Ie}Y>9Z(AWE znAqk{A?_1K>tnXco^cdFU|8tkG1_vTONsg;Y~JuvRn@Pe?##Ad|)J*;!)LomKOBFm@465`SB2q7~4?sHJR zpJvH!u#NHHl+PU$Qv^s*bx9sz+EiUt>{oAU8E5%ib)&%BEpp3kx<75hIP$L?lf?23 zy-|BBSqqS_HF?d~jTsRTpm(==y3*UeZ`lIja z>gw%Hl2ct)MvIHWAy{0Ti`gR?R+6|z$K=A;+w5{2O@DlR z^z`&tN4cN8Xlb7$63%?3M>MBbr+cb8#gq_x$gewQ{1aFpO?u=#u2#(~CqF6J-rCKc zz{uiUDu8jh>89^&N14N*B5hUTNWGv|MLn>SKBI;bB2#j!iH_*^rDPh$d+z7d3rdQN z0ak#!C7X8L62tk7GbTAJ^pQR9u4j-Ag*uw6&lUIAw9I9c>&}9^I^r7wo{pgYV-(S> zEMu0^%929*t-mhLvPSEcb^L#+(&(pE9~vHwTf#``Qo=*;YH5g@)vu?{9}jWIacUy` z!JwWuK?gACV@w6ReZV3hYRf)TA`^v>2m=Pvr9D5dyj-U@W88^|@H+ha$|_l!CbO~3 z+z(xb9QOK@BF&?v3{K3T=!dj!Pf%p#Iz5xXY3R#uXLtGF0^|$Rr>^ffR8Wz2WB~a; zV(gVzgdqWm(z`Eif5Kf=FI%JZaFNU-Fv((p)g*yuLjH{XjF| zj*3r;OLOZkg2?Xw>*taJI;dvD?Q80Ju(sHMIqiEt7k0JP4Z7Jlk9j%Cdb-rn($2+%8$5AV zlVnebb%FP8$QRLOz>h5Hp3RDAc`MYECPkuOrrFTlfq}NzeG0akqv_*7->OVgclcQ& zdt??w@V5A(0sUhdB?&V)?P$S2sb{NWq}96_*|074svUVLwoKPxor0n=O;;2$qmZ8I z*IsRhg^zvCEQ%e9{(V1_g=7g^c}kzZOm$2+^`pDX<(2PNwg7%UQtOicz>GJ^s_N)Ap4LDkVQa^8-h5kzvG zZpXXFja_F-RX&$?ucz9-0|OuH%1;CYs^c%x^{N^=V|XYj=A28{0bdS&FnmJ#$q)#C z4^QSkc2yM`6re&W=dVF}8d!c{S)(1AK8e_^T zMS{i`fe^ddSp(0y*)lJW9ttVm*dW+Mue5(X3;8ZwTkxCjy7VM}wj_T%W;&>gddN~u zgBJrbcp_gcS@d9*(^ONx zJk#RPpX<24SPvQMoko#r*BC;WX6P20whpwpYWXR8JF4J`b2rtaXLkIUQtlY^ z?)c}wL9YunG`MMq%WrF8vkWl^p+w?_u@>jd^i7H13nM!74HaJPkKH@5P6?;@RaR9S zVG}wM3{0K^lJcSY0Z31z&=ZQh-L0*yYyf}uWZADT>XGZ}&Fi@}|7Ni~@7%mHnN%{3 zU12?I%GDA%cTgq2Z{+W*AeDULqKe#Taqo&Aw2*>U$EN4%uGwr73-Z!4vCHF(QNQufn$;H+15}< z)bflD3Bc29=hBjmfcVyhym|z&Y6ou2F^4pUAnws;uLZVDZ>6h@Rd+^i8}KsroPyaH z^+Z{q#0e8CEu8bE@Vw8_TC+z}M^pX%`FvF59fZ04w)!UWI=9|tyBYb@@J5|P5Nk3? zn|;q&;H{;pBWio)h9jz>{0p4_uOe-RgN;8Lb5_P(Jcqdl@N}{ISXE^CDTXOFeOYHK zRKJnupoV(WZs`L>Q=@HHiirH(D_g=UEw0;6f5evRBWAUm7q10TsUwaq&7FT@wB0P^ zf?M$9>1V@mekno@z6_t_b)`Pwwn%Mu{#CD|o?03b9z@L)b1eq-e6-xi7fC6_MS3S3 zPA(pGth6Dun!#_htGYw6l-Y6?SbhpuPb2=_+QloYs<=n=OByQ#mGwHN;L9)U8-*|X zgC(--^w0dDzI;H~dqdYyhG8#ZhFApDHC0?Ia${TGanw2VJ5Izz*Gf`f6J|> zCe~*1UErd$tLd?M4rfE;InCE*#bUO0dK=}@jVi>V0|`2<+dq^#DGQ<$9gJxtnlbk^ z&q~Akf-_tX+LTHpq|rT&-q$tDkARog-a$nEpnwv?9pCh!4#k=sR@_L&tM0pL@DqWb z!{r7a{2TE7{a*%$8LM`?_Xot)9r?`6X+js{N z#-9%0NPs2P1!Lh$-T-^!iqxP7TDG?PjWx8uo!E=-*pT)})L@_RUa>>7vy_^5Ava}i z*GqO<)GFEv#X2)QjUS|`fX?Vhq}6;V>k~PEeMW@d4wt*RjDnh zruM!qZ@&P*bt3LhIeCY7A#AvS&l(Sl?vx?K0lS{TXoU%EerD`Cn;B@oUd_owx%{DL z8$$>0y-F$ z^gMxH^O?(MnJc@E2yHq-aE;PAjr-J|JMRV8mBfBW^%A+ewUT$?g z@%X**_<@f69xuDDwg7&4*<+Z(U!a^Yn92mT5oLSfaAiM*RG|JXC@QKdYGTaz!Im?o z5@wH!n?-@_>Rc=!AP`Ssf?iy#T{DhJN=k|(xiG3&tP=cJWBJ4>8|5pF6F+YQ`iZ5M zUnWAQ1q;4x;%K8Vmy{if>f839OCsr0zJ9Bp*;&ek$aO*F#x&Xa=D{!E1OxO{l`+Rv zrxG4?c)yv`#KeRO(wu)SjHuOjo=wl;6XtyQ=Mksj*A(J5TLsx=!<=4Yg#xl9O3nw* zNx&MOju0pA>Sh#*;!RpZ4fL3Lhi1EvpQkH@*Z#_w4iyzwjL$X+;0^S4l$wT*@Y;z< z_8A`U5I?n64-hsegdHa*FU;$5x?eDe2%)sHXtthJ0qAVXnGl~&!MqDI4DybKKu zy$c>V|LuabO)*bRP9k9s7dj(=nV8-obU0K3R-G;fBS%O6teHVFqjWS+OG`^@>+{P^ zf#mB6)23rA<6WH|*N2f9;`>K#|g4bUzJTwqLM$#ay@vKE+zEu8<-VZ$)T-`t|2S;z3xX80nNqrpX$9x zZiANEd=C~-S)E;rsS*?=B`s}CUT%j`S2moQnnJX{=aR+lJB6H_ScD34`yPRUkgJ{U zNo@^2L7ZzlpX=UMk5`g%k~v#BOi~gK}+<2SS3Hr?~7qV?SO$Cz29eeg+r>BgUSbgnmHYA{FZFWjdPl^2Cf*P7{t7JaUo9)a?au%cPuY-4>s z{jqK`W|!3584tj=H2w%d{HXZX&_n7K`bJrx-h$1dTIAwKtwyg)ny1aoDWC0WV*Zq? zR05Huzd^_hRd{-SdZF&#{Dj10WSW|~U9KN28jqwpCodrxMx${78-7o2es7X~_mX}u zX?`A{q`Mr_93LMa2vE!8Y13_Go__an-fjD(>&mCjE+5cV2QG>e5%vQ?)CK+1u^2a^ zoZk7*h~&8+e&A)I_Z-6LGi)%dB5jDa?n`b`^`4^V;cb8@`AFoQ@9F> zK=gZR^LrZgyM;vSeoTt;!O`5T9IrQ8k(Wz1@aq-espqCaYjCj3Ee;Jn`(*;~ zS_Kdz4i}Y=l9JV1)l|Nt7nE)=koY+W{IdIpRrSWk*#~# zskCu5oCD9sjc_K@JGIeL)ZxFVtleAl0)3ZWM~|B_1a;@6LeBfw0bXu)b+t@ne2&eU zPjN8{mM;ww1?do;*Z%kcqnXG%R{chs9l5SEnsfFrDrywLblxbrJpc1>6hYl~cZ1ck zqNLf;8)VOcppU)LSd2$ZbJ6dp#lPFiRIg4iOBGhdazDuO-cuOWgh9_n`Oe^8AKF-_ z(Ql3ABA{my$IqmsLf)U91){O-FOwiHR)%do%oQCcc)Io=VhO_cLym)~x!895LK69< zA?4uD7KNyYpkSa=C)MWn9-{iG0B2g1%WGmZ>+`t&=*1*G4GjZ^df+;|dp3*A#1N}2 zZPRS0=CypkTGKO6J6bZC`AC&$xh0wC-qg*v<~$v7al4)ed=#wyPr@O^sVAps(t|CA z6x;Lb;(~?gN8wrQGu}^|d7C7}>wZvjkg-e=u9RinaIoY)&X5F8bs4SG{_$K=nf(3Z z!0_Bkz(9g}ft+~43x(e>ZpS@64I zymfAY1t<)B`5qVi%=11~C(;JLeF~tqE0+Xs(w4jadq{<-B;peLzWRsRnLyRqZpE;! z2Cs4k&6yM3_wf0e_#S-s(>r}G&?$nw2@(px2}(#BjOgXWJM~Fw3b~0GSW$V|lD+Jo z9RH|z@p@X`Z3rOH6Wmu|hTdag;+_5K)|8&s>)&CJN*ciqLE2FFe7P`GDG zN!-0KDSCXI{(%DKfic0md7!nrfQpsl14sDt;K3HN89K#a-9%}(&xX^iifXjayA{eh zCl~|3Pa+x*zgj^dB{cfT1eZhiDg`Pil7()U8x)U(h}B-GP~=5MB%FgDjf#q(>Sq~{6_cxTuzL*`9saDyvhDHu_D zU^`-Bd0-VnADrfho{4(vji_xK-`WoOEEz{E2-Te1ERI+o> zV|#NuZ=)BFi2Yq1C`s>asqTHRpdf+9o3*1wi~_=uI0Wi%i+q#;9xv>`<7ah%NYm?O zzXvt9%dHa$jpIqF4JcD#Vbv?5$tblK? zGrCuAW_1rABUxU$g7F$U+P-gQ%Ye7XmF*rd&`zWqoOZSKeDl_(dN(#Vr^X=^_Ukb> zORvje5AKvC0krD-)?Cj5`EdPKlNS%y3jJK9enU!x zlSn(*AAm{1%O=9Z!|j^1A`lhH+4$oTo-7_t3{ zuM^!*n9O2O?Xx!`CMgLS*~n3>jT}}EXckfQY%flj@?V^EK!@M^P(;Cw!S21t>rEVO zSt$}>wy@9ZbHpBF6{FzszY>{r(0xHh_4d#`bNE9uK{)X>*JkyiuZ|mWwbf_Szfp1G zafMIHY>1j9OMD?4VFDnqRfV(kKb-s7G%*Sh-!puExPJG6cd2Ne461|M37M`+Qrkrap10!| zsrpOs%E*wPG`5b}T$@6&mvr1?=KtsyNquH40dnVGWPj9%Q+=C4(QZ;dA4;GSI$1cK z{MeYB(kXZeIyp%AYpiG9%BWP4Y^m(DxN7ZKvel-2mabXBTKg)%QS^ohAW^_%s!6#L zPVeyYGc|BXL3+)5U(MU>^f5Cr!4q(|bd3Da>NrRgoAR|~qyOdoXB>b^ZJ_*{&2Jg_ zMU}Udf~0mUmrQt9&`YWQ)zhmaGiw`j#Yg~rd_fN0&&kUb^tjyyZC!nAU4gbl-Vb@c zQAhkq+L3V4C4tf;oxx1qsf3^WOwRpHBIHNT0je@BmkMd&v;B^4Rb)ATOK!8!}0A>>hD=t25(Wpmj{dO5U@&W#JX^l7Q zUc@t~tGR7qVq~wH|A}tlWkhA#7?Cx=`ez~ebPkhNJ>d>+`r8egU9o=}18z{4zt;NV z{*4{3+$*>>W>Sm^6`&g1QFLs^C#**J2huMr^Ew9ZB#9RxN)>934VL?f?yM~t%hywx*QnYI%( zGgY>G(|eiQlJe&ryk}&Tp7Pwup+i{x_#f?SZZ)octp&SF1q59-$E^=*Uy2F}YH7hU zoV;^tf(`m$dl%mUZhE;1zh6VTotHT_bw*=JX}m>eGsAtO4AzEda%S-pb4I2^E-!|1 z^UMdhv}<^}rWkyxHExGnC!?x%N>)A8&~^Wo|M6&ryK)>+@B}bT!%h z%^vX9oBP$o!6~pdLCEWIsq!IZ@ehy$Q?fy&4^IqR*q(*P|16n^`ludf2j?%Z*W=(x z20hH3Qam>{Bd&CaVM!UJsohXb%}tU&#s~pE$~n+`r+L-N_!W#TMlDYn>B)=HzTm8Qu1aJax3!qD_;P$<>Zn{euNi|FWKk zh4Ty>P^;ol1hjvCdyDev%

    2FI+Bqo_K4cWJ0Z|;RlOa_^6?AT@otdyp6s-@NkM4 zc!@}!{j$H&k+4aH)gMbL)LG99?$6**k15mh`+#uBp)eh8oEaW=D+t(j`#GutlBNzX zMcVy#{*`c$d)tF{LmF-ztmo@|E||0LjJ?477j3^VgGNW2kV*(pLlma{#Qp+{;)HkK zwSgoLftH@h#xExd+tAne;Wvoy5Na)Xnq4N~yEUHHWWy7Ia5GTRan$Ax-_ zJ=F6@oL&6IN0J54RhskMhT3{tMK(~i!5;Cc8YcB3>3r$dijERHNMWP~UYS0dPubiJ z2#6p@xq8eZg<*6a5yf(ZO~4qy|MBay0F}>E*%dH2pX2T6LMJ^>a#XBeEY!HGKi)sz z|0(GEcMbnLsbJ9Q;zWw{P0X^MB!J)Pu*Yrds@Y`l_5EnRL)QjeH>6{u5aa|DI2%;i8*@{=AE3$I6ItRsl*&z@yGqt zjj&ei`}KE((`*mF|Et6}Q|G@O^FKB>9&7z_#UHbA$WwX^g|W{z$V`*o4p1+(Qee;2 z%+1os?9ioWlAsDunK@P}xhl#k84DqDIYbRfv3EHL85{(-zwYk@z3qNeG{(z{sk9N= z6k=Nl-`r&m3uW%t^wT$Y=lNl!=)K+BBS-|H+8d3AuLV|f%+Cw;Y;M0UweenOWxEuf zh@J!lA?}3CAzkX%l5cW!`fdAG&i%r}W6a0LAc!2!=+FSdr9pXUv-aNqlVR;eqKG}C zrTt1kKoAcH?W_I@BrIDo?8cY*N!A|%xACipayuvOYlRt`%MK#et)8Z4v4i2Gp4XYx zkDG!|Km`A8Ioa0~HC=!t}J>FZN5%gX+$qBCb;;q!EYfFt64Dqmu#&qIbwez5;+B$SK^5S!gA(3Rv}@6z5? z!Q;JlKaXfvmQIz+Ncx#S>_AoFL&I0EWm$CVTUv$M)ULt+CFp3Z!5clur}x)sfS*ev zKwNrWgO6MGU7I4#6bjAAJW%#?!hMwKjX*rBlrgE)o|@QnGpyx59E`pGML=g~XixZ} z%+DNW2DxrOQ&Xa_CcHw#PPE?_-(jj;L#v4bry8xMT3|Y$113DK`+)(lZ@<6fBMwl< zJDJcYGjav}l*#8%RZr6ZGWD)@5TaS3!1k@QnSI&-5_vWAf;VApvY1{Eah3<~Pz;dB z6`-Ur6=D-5pJz&H^OPvqGbV5UVSnr>tI+(r{|((iiikEix-90`o){l2aXFa0&x(I1 zDh%zO{cSU2%bb(qB!mPWEuk=Q1jk<Uqfq` zgy|+!P93TFTqhZa8wBzWNo-zJT-?rq+JGtXTK0XOQvkhAPfgs^7T90i++h+e)20SR z+~@WTg0IiYdO@#axMqN$Kf)qVb;$GIr4~d3HR2OB$f>Gj&|gC5x=EPfJ~>QlyE&sw z%xXQ630famebK{43@qM5)#M<3-YFUH=?+G~oGh}>7t5%bkm<0%##OEE0=3&LEtA4P>=KlmgR)PJ*Tjzh4p$XKrsiF+R)GIe4_*(ieA zN*MFhibHrtFR{!pvYY?EJjESlz|!Yp1M#NWsm>@}tFq6{RWx;7bt`u!enk>;kBXeC zcMjc%=apDUYl~d7=G3+d)xzmhwRn~d5Q_I)58yq9N8ay1-_NW%l@ZSg-hAo&4EXC# z3Oli?g{eEA$&{hANxjw*H}C)$oGnKg)^2Z#h8XQg7Hxe(<6ojutmSHsQa%Zqo(UW; z{`m+HZ7Mk*7&20Q?f)K(UkLJ&yx$V6qb6Z6thONCcF@|owDr~z0 z)+BDeIy7i5j?g8@O- znba7bV-{~ykzm`@zw=bPj6l~KITRwyLi0Tc;+wz{;L%DI=TnOuXRuX{_T{Fo1dw75 z?v+D{zdgTkp`)EO1+oO12FXGy#F_=LmNlmoLXK$*W%Eh^1lrKYSkdJp5)6;NI76rt z%xh)TUUUK<_HP0LGAbe7&i}@l;qzE4;=t$~vKmDz}cchiYvjrIQp>F4$ zsd=xrp|S&$lWE9vEBrZd z$5_&>)Q)a`orm|I-~DkfY?1g_d|h|z;po4x@3dwO6B4W=c_YycPS8JFf8W90Azedh zX?PFf#ZrGNV^NcSCk8j=VxTtv&8YXp?+QvexC7&PjZZIKeUWduez8Se0rBg2bk6*B_1kd#;N3a}|rzD^KbchpX7V=-{N3lk& z{6rlUCURVC-`89e-ztQ!u=_AymSzLqW4DC zyJQ|A?)l%|#KRdYb0Rr1x=S3lPA7PDRvyz68RG|OH`*9;@hMq?d5 z-C_UJAjaXERbCBS5zNk837_ z4on-H!S_I8_MclsKYh2CdZ})9Za_z{zngt$P%u;v121_ zZu};8DC?kKFx;MG$V-5=*Hlx4jJ#?$KB$Z2ZQSuU1Nc2@Agn?ob-mLq7RTvI(^EFQ%HUp#mQHl*wn>xd^QQZ zJ@afvwc5b`;*=;X&J+2al+(uNo|c;!x)aBD?rz3Fw_*cCxTrw0qh*295Q_lQ%%W@u z?OFzPsg$U25GNe|sgmBUBk~YEn<^k` zu^j@{x!za0)K9XJu279cU~}ZER43hn$cA~HJ|ElNlK(AyYiv)evF1-VqOfU5f1reS zGYcw3=6h&%xl6UR^38;m*&S00YuPYy5*=ZpQq~l-l2(yEejPu%>HC98g z&)jOI|5swJf!pXIJH*wd9H=@U*gY7bVcBqO*dYmPqO4wGg0(P&5%!%nVqW|x;a^5L z9k3cL#@Duk`|g5~V-*Y=wM&4vz5G-CI6#NpEyZovnZ&`9lDodtU<7>zsJ{5O ze7M`7lIbX-;t(r)fVEYBTcxtxvoke-f}t)lr*~-zGKv zg}6!l?w$(uxtW2e6fI&QOU#NKXj88#A|jy)Ey4q>tAegELfn!`+X7s7``XNLu*LO% z;gg9*|9bzutToMMun}CDr^>N~=f5dLcqda^1-%QRBmaH-^&cG%QHW=~CfdUIm&Q5- zl%J;{EVTtH5I=6K3UVsRr8jx_u<+S+_fQ}=@g_weUzsbHAD6mYb=@d3463iP32w}J zBtUcH@brZMYVMm>YnDO6_uG-QDzVSij2r22@lqTtK+%fqQPb4UmDN~AF+2iE`}LJ^ zt-P;)X>+arA%%$04Lf)g2Hz12)5q1#(#gBSx=#g#IY~|C@v-Am{BTsP4RJV5Zw?GO>fG+m!)0Gtj;QCecu$z0fxl49RzRUHTWAN#5 z@&II<42?ggg9F&f|!b zBAgTFml%`giUe!-+AX6~Tvj@S5wAYFBSOu@8B4s+{$o*>-$~;cU^I(D6}VW*>%%I( zC`zJA$M{wI7R=iWu0LCjdb$P?U*=SsW<}= zi>kR-WcleWs<8~Auvb6Ov03c6@*prp32DBa3>cw9RZsS}G}X;o z_HGX_RV-Y1g5GMcSli~a1AKulm_E&9m9v9ONETm)}!TZ zO1G7lbER}VagfTZ+s&iPw-xppGpqV*A0xTqh)K?zuuQaMX%&r`!umJ=Z6&44->3te zJinuZ-8HHT?q|apM8{v$)`D@ruDx2K0w1_FM>fGEK5ad<|LL=XL8_&9=U6hY4JSq_lOH zEuSzUX`}jSa&r=jpm3PWF@tPYS~N^|%V@^~rokMf`S64wa5?b59nR~5)BN@ixuFVk z-hVs3(_WNzGI>tuXQTQP-SVxFOw9HSz%$g()7x8<6Ht=-xxtz2j)n zDz}JBh1RGx+X<8m>3$x@*McvXw)b)0UtF(eGA;L7@S4d)6i1QkXkZNf-L&nQs`aS} zi3&}I`Y^LTY}mP)wxd0|I%jbsG$+ZZP+3DOQQ=#o)S|*WQuS4tz7(^(9vT@}SUv)n zkOm#0U2Y$^bYKQ@st?d3M?2wJJ+3b+de4}-)k3q~nBbjTo$jxGh;9k}pTmBq*2nK& ziL*7(lp%6s$ZcnF*es5Tnl|I|Md5@gKp?!cKYGp)BKD(;aDo!KvBW-LaPjM5*wK&a zolwrc{Tesg6Be!8c!Ud|o0IOV; z`iJph2@gUL`_bGm@2aRzOwIz{Fdgnuqaj2;GzHX_St`# z=t(dC-#wvx+H&)M=Ssv6d&M$|Kf#^nx>w%Tt-pErDu!Esgck}So>*jjywV(lAK9c) zd1A-fGad=b&cRfmc7)mdY2T2`p8$Q&;=8w2sYe#+re%K{^fih|s=8gJij`pdNwAx+ z3)^f)PfdQ2HaBhIKWDwR)weRIjL9Y(0dtsEVqWuvmZFemb4X>Jzn(TLQFZaJnCxM! z<)@stVV4=R6whyEdXNPTKdg0y^t(e<1Vwrd2iDzbRQP3L)s#!f z#>#X#sco4Bv4(KYeTb^{`k5Rr$nNJinF=>uRd0olvBV*|#FR!jV(W+0DAE$qf{EQ( zIqF7wS7dyF_^DXC)$>BP_}&tP8jnCtGN3zSZv0O`M_4RAJy&eDFz@XO(UdvG>hDJu zthMUM4uszLC-2qsHPey4*pNGotz)_sVse9m7Fr*n&C(4agB}8b%SDcrWSf#K?q<>} z2VLchx<%H2YHnT&JOQ1vPM>clDX|(GohRdN6)9N@8_A>{l{`y@X>x;A8VAKE|Msc6 z9HP!zW5_P0&{ujlxe-<*!pL04mZmTD%|4QS-0^L8uw)@uE z1U2+>%++)G^TYmFQg&9`F9g@a+U{T2?RD!g`x#dFsBOBGr4ikK_34wP9QwsLgjNbc$U3(3GO-|MU6|dGvh|TbKWp-}4aVHmgZp@B;lj*KBT1mnwV+f! zp{*K0&u<(O0bR^becox5Vp%m`pR#DOdup}=&0K&A-(>Hdwv(BHWA0WCQ=2dLz2sWJ zIoHMy)QxNBYIfi)IW=3CIlE<*v%P!N24Tpe7~S`eAE}?5d{Sx# zVjCtu)k?W>XUY(d}>>x7J|5r|cSdK?xpX)Kp$|Wu~`<;&9%glU!ckln*rB0-P zFAc!FY4;vg-(2ch>CZNV%T8DhV2@0AJEs5NSKKA^$(u9fDa>@2{XcX3PsIaqBLb;? aU`%7Ubo1s18v-cE>(@{DAGKoof&U*x`n=Hq diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index b29fe008be..e94b6d501c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -2,7 +2,7 @@ title: Windows Firewall overview description: Learn overview information about the Windows Firewall security feature. ms.topic: conceptual -ms.date: 11/14/2023 +ms.date: 11/20/2023 --- # Windows Firewall overview @@ -61,18 +61,21 @@ The *domain network* profile is automatically applied to a device that is joined #### :::image type="icon" source="images/private-network.svg" border="false"::: Private network -The *private network* profile is designed for private networks such as a home network. It can be set on a network interface by an administrator. +The *private network* profile is designed for private networks such as a home network. It can be set manually on a network interface by an administrator. #### :::image type="icon" source="images/public-network.svg" border="false"::: Public network The *public network* profile is designed with higher security in mind for public networks, like Wi-Fi hotspots, coffee shops, airports, hotels, etc. It's the default profile for unidentified networks. +> [!TIP] +> Use the PowerShell cmdlet `Get-NetConnectionProfile` to retrieve the active network category (`NetworkCategory`). Use the PowerShell cmdlet `Set-NetConnectionProfile` to switch the category between *private* and *public*. + ## Next steps > [!div class="nextstepaction"] > Learn about the tools to configure Windows Firewall, firewall rules, and some recommended practices: > -> [Configure Windows Firewall >](configure.md) +> [Windows Firewall rules >](rules.md) ## :::image type="icon" source="images/feedback.svg" border="false"::: Provide feedback diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md new file mode 100644 index 0000000000..c314594ca1 --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -0,0 +1,79 @@ +--- +title: Windows Firewall rules +description: Learn about Windows Firewall rules and best practices for creating and managing them. +ms.date: 11/15/2023 +ms.topic: concept-article +--- + +# Windows Firewall rules + +In many cases, a first step for administrators is to customize the firewall profiles using *firewall rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. + +This article describes the concepts and best practices for creating and managing firewall rules. + +## Rule precedence for inbound rules + +In many cases, allowing specific types of inbound traffic is required for applications to function in the network. Administrators should keep the following rule precedence behaviors in mind when configuring inbound exceptions: + +1. Explicitly defined allow rules take precedence over the default block setting +1. Explicit block rules take precedence over any conflicting allow rules +1. More specific rules take precedence over less specific rules, except if there are explicit block rules as mentioned in 2. For example, if the parameters of rule 1 include an IP address range, while the parameters of rule 2 include a single IP host address, rule 2 takes precedence + +Because of 1 and 2, when designing a set of policies you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow. + +> [!NOTE] +> Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described. + +## Applications rules + +When first installed, network applications and services issue a *listen call* specifying the protocol/port information required for them to function properly. Since there's a default *block* action in Windows Firewall, you must create inbound exception rules to allow the traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. + +If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network: + +- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic +- If the user isn't a local admin, they won't be prompted. In most cases, block rules are created + +In either of these scenarios, once the rules are added, they must be deleted to generate the prompt again. If not, the traffic continues to be blocked. + +> [!NOTE] +> The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. + +## Firewall rules recommendations + +Here's a list of recommendations when designing your firewall rules: + +- Maintain the default Windows Firewall settings whenever possible. The settings are designed to secure your device for use in most network scenarios. One key example is the default *block behavior* for inbound connections. +- Create your rules in all three profiles, but only enable the firewall rule group on the profiles that suit your scenarios. For example, if you are installing a sharing application that is only used on a private network, then it would be best to create firewall rules in all three profiles, but only enable the firewall rule group containing your rules on the private profile. +- Configure restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify *Local Subnet* only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. +- A general security recommended practice when creating inbound rules is to be as specific as possible. However, when new rules must be made that use ports or IP addresses, consider using consecutive ranges or subnets instead of individual addresses or ports where possible. This approach avoids creation of multiple filters under the hood, reduces complexity, and helps to avoid performance degradation. +- When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. +- To maintain maximum security, admins should only deploy firewall exceptions for apps and services determined to serve legitimate purposes. + +### Known issues with automatic rule creation + +When designing a set of firewall policies for your network, it's a recommended practice to configure *allow rules* for any networked applications deployed on the host. Having the rules in place before the user first launches the application helps to ensure a seamless experience. + +The absence of these staged rules doesn't necessarily mean that in the end an application will be unable to communicate on the network. However, the behaviors involved in the automatic creation of application rules at runtime require user interaction and administrative privilege. If the device is expected to be used by non-administrative users, you should follow best practices and provide these rules before the application's first launch to avoid unexpected networking issues. + +To determine why some applications are blocked from communicating in the network, check for the following instances: + +1. A user with sufficient privileges receives a query notification advising them that the application needs to make a change to the firewall policy. Not fully understanding the prompt, the user cancels or dismisses the prompt +1. A user lacks sufficient privileges and is therefore not prompted to allow the application to make the appropriate policy changes +1. *Local Policy Merge* is disabled, preventing the application or network service from creating local rules + +Creation of application rules at runtime can also be prohibited by administrators using the Settings app or policy settings. + +### Outbound rules considerations + +What follows are a few general guidelines for configuring outbound rules. + +- The default configuration of Blocked for Outbound rules can be considered for certain highly secure environments. However, the Inbound rule configuration should never be changed in a way that allows traffic by default +- It's recommended to Allow Outbound by default for most deployments for the sake of simplification around app deployments, unless the organization prefers tight security controls over ease-of-use +- In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP. + +## Next steps + +> [!div class="nextstepaction"] +> Learn about the tools to configure Windows Firewall and firewall rules: +> +> [Configure Windows Firewall >](configure.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index e45a99fb93..9e2d86637b 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -1,6 +1,8 @@ items: - name: Overview href: index.md + - name: Firewall rules + href: rules.md - name: Configure and manage Windows Firewall items: - name: Configure Windows Firewall From 812d1ca1e4fa09d7719c5fb344ea45389a6c6660 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 10:17:47 -0500 Subject: [PATCH 192/237] updates --- .../windows-firewall/images/uac.png | Bin 0 -> 204806 bytes .../network-security/windows-firewall/rules.md | 17 +++++++++++++---- 2 files changed, 13 insertions(+), 4 deletions(-) create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/uac.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/uac.png b/windows/security/operating-system-security/network-security/windows-firewall/images/uac.png new file mode 100644 index 0000000000000000000000000000000000000000..b4a056643eac83fc3dd5bf68254c202d94b65128 GIT binary patch literal 204806 zcmc$F_g_-s`+j9*!?JDWsw_upq^UU}Ej9PbJ;>A?IC6^!G%PDu<|=1qu2jgqAuAUS z+_=esq&PuEK;Ucd&*%O57rs9n&Wq=#bDneE&vo6`ecx}*O!Q71yL4>dzI`Y3AKbUt zw~xnU-@XIgM-K0;45DWj_HIX?KClbgx9?QuziYolkDB7%;{G5DJ?(v{Ug5>PKLvCuxk64EOeXWP#`p?}-j|&$KbbNmNcBEah zJb5%y{P)4^>HVtI9h;S@<^~UZHhRi+^Wq%H zQ2*MQxA(6mKKTE1Ycjiqrzwtu)eDGz>P@SC&D$bEnK^ZMY5B4g=%#vRhDqX+03VX0 zQDp}#$~Hcndyl00u-6YJ^~O=}P2kazKn92zJy#_Iw!VO=|i`}X(o zlQ4;gZ}~TG=@;Ash>^h7s}uw?dai2i`MEx^(hV1kHOE}jF+D4d@^@T|Awb%M_A~;D z!xNer=Lw=SIu+q{uV9(SHuekRu&0N%)#d0e@4G zt}9~vHc%ksDE;Hfrl!L11oNB|OLsEU@-R-6wM?!mmw-E4!wK)@YK>=ddAmN+xUbZ? zXWt5()a6IDbop$opFE2L?a(!MBBpsINWDA~8v9~EYhvE3JBs1bt3FPc7+9S~fw_9@ z(jT;-Myvn;0}qKKO@&34o%pHrYo$r%93M7ZH!6aqdQAfnc97MW_5DQV>gQiB6BbO zcR#^Uk@UTtlsphB8a%Vp`%C@t`uF|-lIn@ovtavQfja_Ie?&RCHEV{`=bV9-b@-|Z z@TBHkOaM7w(=*2$)+&&VN50!S!r$T5SCCg@HLV^Zm1{h!^b*E5ShQTOv2k74S$L!2 z3|MVL$J&}XNUpUYpP^2k{)l77Jn?Wu#ln$($^LKK?@j#X&|IPB1gLE0?{XF4yj7+b z2^~dcsLk(+eU-aTM)ql;lihgHQf{M*Gpd(VeO zDoCv?{qkAAnkCnTINtT0uO>+yR8M7Sgsv7>*fH$Kch>)WT+MA#Ayd@lj;m>I_T3W# zKbh!l?~DfT7XYvs;gZMB1$lzl*-nD46SB;9oc#e^{`#HSV2}rK0hln2kbw_S3TXzE z@xBD1DYK9jcrHa-RU#*PynBl*yrh2S>V+4MbwuH{+6pEDOaYq+7b26qhDiZGe>+KTwLbOC^K#~g35iT-|ks&LN zpX4Y*0GJer^30Aza%T>akNH?_{b#mGP>&b&jc=2+7$IR$dLZX|)++dMLp4JF`44*Q z)6DSaGiKn%8Yz!rg1s|@uAYn*6NnyYFQ0F}FHFuWKa-F$6>y35w|k2|M^+4>hp3Tu z!BeOev4&7Z-5`!wLVoo&$QM*L-+ZwI!k(M>&r85pGH6_FGE&TNWArk7j9?1m7<8Mu zhCAcprrq&{#OIB`1rq7UnZejz$uq~JTB;)=74QCX>nm5XtkBCeY9&=N&zl2`QoPpp z$+){;MKww3Cc!q$WJrHvTyA%OoWs_y+fH`9jVSgDa0mrIju;b*tcO0&ixTh)e}&Nd>>*B<%L7Q2v-^ehJMZbA+xG-i}@#N#OTc zfq|4Xy~zFX&PEV^T#vnI9%c8QB`KJHH7g=o!G8hDC3IE?HAJu84u1|Dbm+>Yzj@l3h1Y9c z)vO*FU#pS!r^5cM1)PbK;l;snk)S<1=KT8ssB&E$TA5|TQ1_E5X4ov64BNt*Ds;oU zp$#E`Bx<@#-%QB$czCt^oyxj!lQQVi(*R_!Pa+Yg^otlU`aMce zS;$147PtJe0<8?+SzFuFvl1ZGNE_5nj5oTC^LO{$#6UuZmfc(zyc!QrS89pCf9(0k ziDYCa1B=FX9e3rJ2Joex-HAxnB5t{wi^c@HK13Y$3Z;S*H!cwDop1)}t;%0zW~Ku` ziKALVmpLU5#zd;}lXFuFWUh1Qo{gysV8UWMX!&?JSE-> zl1#984d6DnckNthq8)h4KarwQ2xp+0e8QY9@+f*MXV7m~me7JnF2*QacHG&hrapcL zXd1@wd4;X691^eIx@$Y$8MOI@XhR;I2IiGq3*1+Vm%N=mqA92QA-O2h|n~N{0A9oJ6m=rc@sa-=JIhH^j6%2QIk)^Y- z2&i6f{aXs%;hno02kT6&t`g5L<`Y$U8Qs60TNm1s%j?Kix9@V@yvzrdf~V(ILxNGU z;5RVv=FD}axPjP%G3E$}?-Eik*ZrEK&Wvl>%7}9)2E2P5gxTd!QQ8#|`Ac?zo;=Ez zxBD2#i&JWiD9MJfYtW7^!r2X?0o^dIl|D`W$vIEo?vn?}d74m>vaK;Mii$xR4T)sU z?}B^$D^vHFA)v7x(apeCVsBq~m(=ca=3wYk{uyT*qyYY{KF8;K;QuKjWQIOMx76KPCco z^deJe3buKk_JapeD56Vx<1RSWh5h)87@Q6iB#Gd{zX^bSgt)M44`Y`wp=fg_`q6!P zEa3+rpI~cnyNRmJGfjfh(keHCr)@O#&0HAvBb zf-kFP7x{{fpTFP=iXHg9(QGqniTO&O^Bn4RSKW4Xh>L2>tA>?zr)2>Jx7eauZoY_x zU4C{l4H;JYPac5&wvVoov$(7_m*m{wZvU`>cK-1Xahr{N=ftO6jRWlK{pN5rdGmaH z`_zwtrAu6{xtqN{L$&`QZPMz?X0tbb`$l>7)gOd(n`?!9>b{F=1^6r=k)bf6_gmEgW5L!f`gg zCA!)E#rdTg--Mzg@?6)MLH@R`{ztO1199V_D-9q1N0Vf7@x)#5?g^lEJ9fuh6%pmf zGB2RQm)uJ}8?DT*k-qI{sox0aAr(ihcqLc7s_uZ9q?|Q!xAD3}Qhoe3-s@~F&q%3( zJN)tq-j+Y~b2L%5j{A*;(;VjSgm;}704V*<#vu`!6U)K;eL+ioHsT>hOLb15H!IpJ z{Ir}X?q%Bg_`RUBHRc_o`T~avc0M@COk_8OISbD-YPs7)jDmqcm*A^+Ert=~2HS!P z@~f}Z9Zar|%*rS_PCLcF@*Z8i&qf`-G=Y@M8I^dcY(FWP8j|qn)^eB1O}!Pt3E%wH zfaUwozku&yW7}Bcb(V-r5E;6PnvUSVts?)d8(ri@0{=%Zt8)FHGeF7EuN~o}ud(NI zS~rxgcZo^j`}kubaj2#tcK}yQW0ELi8=d^6pO-UR<|3O;+` zMddYPSnpzA-;IZd)0rLV^9ksW_Y9A|Y)>iSA3Ae*9CuLIgnC9|Tspb9)olxGJR23C z6rA&O-uW^M<)G0`;B0<)1BlugxG4ir;{I`hJ^-v%uQ>`fWrp-%(n@<}_;b?o>nqk8 zDyRo;6e7pU7Va2S7Mi|hhe+Y04}-<#;JVsrYYA}QnTgFR-~3IC4~t1mxSjJP=lcaJ zu{0S{X%XGyH6B`~vEfftYRCaVeDLs)O|KzjKx|G$?=J+7fozc1GzgQznx|)SOF}vs z+ymKMpz*F{eX|A$^ldq5FxVNo)8sg2gN|v(z1y`4b*~r6Cq0vYbWW|pELfLplIXDk zErr@Kg8Z<*=iX*SowsTF_`0X}a^KyfBDHENy6+wafKUJY<5aiApnPFD3L4ESSig?9 zjz=3eh&SSUe+?GesPDkqd4K$AQIypa)CkWzbs7xJ;|+~0ju#!>$Q1%#gRmf2UQ%6! zH7~c8Oj%61Mg?sQrb?7GV_}u4xf>d#Kfh>6{B}Gl{;5VM1{nMO(%=sU|TOGjAz;kmo zl$e(_9)OZtzVP|EhebvIH zLI2IAmCrMU?-3ojAhAa+GL&?7{1af`_MMmPoz~BVE?=Uwu(!Q_x~biOVKR3VH@e#X z?*DxBJ2k|88-kI4}OKVY_`132m6Hrw?XKfAw0{Gbsji-t>&(oV? z(ZUa~;)-$OVe3k}xLjB(Y^R0~UOvv7w`~s{ThpwuMkV%LobcQ{vzM~qVa88K2@83l z7vbe1ackd^`Fsa?iD|5H;A9Z`Gi7l3v_yoxCfK@dxz~1MYr|JP{q{d$oDl!-Eahr+ zBe}H&vMW+R9tuHw*Ox8+|cL1>JiVS!@Cw;@h-9~juY^@8GxkT!#ySVjDR)fE& zj{>%{Y{K1q{cfm9`+0WVwYuJ+HN<3o|EigEAWvXo+lki~H*21(3YS@ZH+%iFI!|B8 z!Y6+6+R9m^PNJZ+6|0v%#}VB?AS~8kbt|ew(f1K%C!MWrMkaZ2%wHqi6KjIb6*jn4 z!)1eRK(cSZTA=L@yCauZXGCcr`$l4RG`mHB{MWIGTa@_{2Iyre@JCfQADI8+oQIk4 zN=v+T8jLXy7jBx=11#%&`U$@Pzw@^puD$RD&8yv=qIsY%C55AQ47w7Vmr|}-8YGyI zCnE#LO3||!&7NpY?cjgOw%&Czw@56AL(F7gZ|j|$4AZ-y{`t=iMSKjGhyrNUP@&%o8`;RO+Mbnt$(zc( znxB^FY?ddWquOeCxoIfW`Iz_>uXSz5l3%m=6!6oTR@kNvcvHuQ-Mp>2?AoAo1u*UU zu%KFv*${W|wbW?rct737voWheH`g^^B;oMZI76t}?bk+@>&$hGWo4nF zf4+MLq(P@N?VbmPwl^JS+*pI7UW=>tcV*@Auc`;orZYNn=&NCc>z^;RF%#w~7OzK& zEJn^3e5iwd{K+wsA1A-IIeaV)FT)Hxi5h!r^={Nk_MzPzRm93XI*W7&xv7Z4akc6OIQ6-P;7@toz$LR@IZ7aPeYdHrO(4OP=jHv= z1I*x;Z%(K@ZE+Y*CGXF@XICqAf~NlYmQD{`a=F=_)6Nt)2G`Y}@$Q>{DK1ynY) z_6Na>M_^hS?|((b-; zy@}Vo<_BzWcUz7rFmC;J2O717I{ZnMlZvyIpFntl;%kKm5dma&b!EQ4mumYeKj#ns z0Hbn%<*RB^XBnS94ZimxwQx$e{nFC291a`Hr3V>@crFFWMlXW6WbPytMTUK%$PZLztuQ+gwXDRndsa5}^je1ME3P`wj6SZ!^F zW+sS}zH5&|M_LuUFBs0yNU6pBp&dZbH z|CFNH^uJ&RpQ0fZK`W6-Iq&0qCa5*QPuF0dO0BO!HYVn)vuJ9C)DMRl@wATT!nen6 zr9T=kzpQ?hRt-;5SHC7esdXaI$h9BrnG$DV^_#qiKfF)o|29mGvjr+P_f<;6gH)k6 z&*flc9MFS62FLnG!Q}W~5!Z>cux!W!;*V_yLI}I_@Lj{Z?Rq5X;MiJaMhhWDSo$%u zCr4Tv{<%D5!0p}p!|}-lv#XU-&ur3%PFkdY>`sr8QjU1K-hR)5zbifXo*Me0*O&1q ze>NHdy&Hagi3VJw#V@BjABG*Nj*b_VnCuc0P+1d8|H|sZ?slc}JD^AntTik$PZ4GO zZlGaP2l=&{He@#!K5#E7h!fEp;8ZsFdXC6hA)B|kWr6W2DqbaoF`eGk~x#32$?h|tho@gCPllf z=DUFMBD3oyLW>_GHezK+`=LV(gu$@GwH5HlI}G#kX4LRB+r zH(af?&w5>xdKzEzFgtnT;EU-{go(G2J#2YMJeC{R_F&I7^33`7=`{m6*zXJ2@f`Ra zuB5bf#}kVe?>haNQa|Kbwo`6$)OYU^I|EnJ`4Q_cGd?TQwRvCZvYhlSE?w{Ag<3Ye zYYg2;1pN@paSbeV?2*tjtl5SF6gE*|3K~(Y9mv-{W77TlrJxS!hqZiu#Xs+tdZv3% z)~r?kz3o}-d|Y%dB0tkEF@z6OFG+;usC=LJ{6r?dz&=0yy1w(A}LH%1j0;im$!qtEldV%{CcELow`5xeb3N9cL(p$C1(ZTQoP>?tA%*t#ZT zsy=d$%CKnzewLeZH%+mAP}u#`q42Zm9TLvz``U zQ`*?8q;k%RZwZ7FK1J2ufEQ97u(gWbNodXzdV05CjNQM?(j%mjY}Oxdt$}-rD%+mp zKFhCAM9FVRWxKDGM>@q^7EL+xrtzbM(RtT*tM{-DEb2hEv_Si!Q1$7p_qXn2Hf831 zBiS}Ww?q{WdrG$DVKlx?V-kuIm>U00FZVQ%3WK6Fq8RGf{NxTIT_L*Zl~0>IGfI_` zqPmrj>w#}g7LlGb30VFZ*W>g5RKa-mVYuCQUDSJBLBfoS4%ZgppUzh@c-Q+=XSs-s&F+f)`auWVT%25#gFygw6}k+wYWqN zeA2D6Al&X)OzB%EZlS__eQ#|A_d1RvAkTQ<#eD)om}3T~D*&gR%x8}uIcuEMkNmX$ z{_VH~*_r`6TPON~H2-{33>YExTA=MK?>7YPPyb7OfTk#?>HD>dqlT{W0P)WPaiR@3 zUOHd=aa>^XPLmPyxFNs-AZweQ92EcJ*m`^9bSifINn&ra@YahJ?Jh72f-Ex&TeZXc z4z~@h&53b$f=RfPF=~F3Tvpphw)2sL&Ub0r@ds~>i{|#G**$@;76(V%WeKEH%|T1~ zB(Mnz;Z3$Sp{O_iAT9J!bGb-H8WKu*bsScIp}9lqw(k}T%VotNHeZ|#YCG7jPkvCS z=Edh7=_P9s#{B}2xP81cVxW!LG_9|67Fn zkL1B4<9y@n&Ix%O-4r_%ijr#|DH}sp>2@kGP>o{Nue`hT0&19joYgQaYz8Q0XN60V z*2$OsbvM*)EcK7=v+1ZRcXwn_Q`Gx3srPtbXs3)5$G#S8_TyT1nu8Iv!Tp>h;X(QH z3-2t|zkiWBajD@~`;AtO;G1r>wZ4(DAA}xR6xd&~d+BC8`*Akznd}2jNfd3%@8uZs zdPQ2lE_@iop_IBWQ`3dcp z0}tLj$`SB{_t)^2g7B$|2(WhasyWzmFb2FkE63o@h;e4R*WQPIYd2`RL)Zya&3#g_ zJ0VZ4f^Ae}6qlfmx-ZhrIo|h3PT1M)i;Clwn9JAQs)N5JtQLpHw?|IIAsQinDI>}` ztoj^vg0i3c*5Ystn0g&tQRW)ZkIj|yfOJiVZq~2yR_9RH!xuhzC~q0cuq~z1O!E-$ zTn(X%wQ-fsx+z&T<)zG>8DJ>tx0+Yxj&ca;uUF=yiS`VkiI|!p+YPTnM1SR*yD?3_ zG4Za`z4|HuztS32)k{Q-Yej#70r5WqzyZo>l>e^G zjhQdK#mzS|_J+{=UGosB+WMMZ8!A&wejbbTogFGKk4#lEcz?Z_sP2dJ`9}30w?$c; z1WrFFz2pVfHROh*f&QIK;fBel&KEq71gggLofNeX zO?thnJg==u)}M({%#cuInMD3|>n}^?C4UW&;V1QM=eqC9=3KbrB7^ni_*@RP(dZq! zoaMB8h9}f@@spx2kr#N&KvKOvAKCmC@bmTj)o#8Jay_VM+7QX&rh$mLSiLL(Oj~Q*Q<;OkL zN{}XC^PPBPbiFk{U@9g}47p6uP;TIzNW<=uRydi1np>Z*myMe-sCv$(np;DsSMJuU zv@7|*n>#Yl$~X8)q)Sn!3@0d^A@ee3{#@z^T;JwU!AMy3beV7P3HsF@3Yg2Z7Oie> z-gOXl{t@JU(*PaX*F3C@rKw|IigCXxTiI7zi6rQ4@-vG4ym@4@FGB6JtHc<^JyPO? zATWfo-ENrZdp>=<>rIV#9PW{CW3F+q|3L#(F@4&zG%+6L&6gOTc4_VnZBvO6$Pf4t zXu|FSI*bqC8qL)|5+lU!eU%5Z^cPhM1N1)Cw=u2fd|bVxS&7sEO&`aqP`5}8_U523 zF~vV`n+6C%So-%4W}}F8deH4L52c#MyFZ(){8l^td&J@d<0!L_%^h<#>v2lnV6Zia z>x=s5sQfdTxV}nUrG%lI=POAzKC(62pKqpfFPV1epjLv_I~`lc>pSgjh4nqedJ^96 z*Ke1XHL6SfqBsm4UUfYdYUzXh8`YiH9-Vti`s91pj?|8LDPt)E;k3tFXwEQp{9%b_ zzkE$#ZKdt?iy4K96;XOt8n6E>|9sex32e-dT&{In92>|yvSEUtQzOiNH0`df-5%-7 zmYh8EDj-flJxujVYPmzsh@xGZf2{_TsQ;(b$g^L6Xace$J-81HBqGMMN%E9-Wr8-3{fBJ+z~} zqZ6-#Ug*bOj9CA}>Cgiz&`znVsr`&@{QJrwp*A!a3w>5YL4mQrjSP5vfQT7TZEcXE z;vnN{XsU)QjF#{k#mt^Z|20w#<&Szki(12W8qx=VE8bgq90#i8nhlmY+=Hzv__Vcd z#b7t9;8T^04xE-hK(YjFSr+mmcYZY#4s60e^vR$M5UUcDp&z!jG+gFyy0jyN-4IIh zwmv3MyZ_*?kB#=oLp^EIv@hx15IUBJP%B?tjrwmV`|<~MJcaYLj% zay_&hnx|0Q+_e$o*%dIZ4`p)XtAK;yRA?)3lk9n%y5-tg*nctJVQOd~$S048kUe&( z79lLtY)WoB@nU3|wn?{EUCdCUD|@>#-G*v0B9UVC8k;kDJ%Y?3LVsFF>5RgdIh_ng!URSEj9l! zo7sPGI zV)``%W2{0aJl?hEt32<>JfI;`O@5U0)mf$h;t<*oX8ps2ecoU>BX3qG(e1k zi2o9C-_i#8I!}+SXjHq%&PKZ!Q6Xoztvo>yp?Gq*X3Kfv^0}=5lzjHy8M2p`W^xUJ zN_vr5bR5PBoAMLSduZ4YSBj`4&E0>W)9_)*UEz6P-q*$2bDHR)jfqBnn#;twqRvK6 zqRF(@hx3O7z^x3?xn5Pv&k}}&;=aU`x6$8lL&EcqItQJABNpn*usgtWVy2hnVRyIzZwb!dcSi)Y2dEjHodOrPr6rTHJN=Wg(RM2_)>cdLDur_VM`0Z`#IO0XU&$@I z6=}_-`7YRLTG4dn9*y-Nyzt-VqT@K>?>GL)Y!A#Q%xRpG=5c_TZ}ZCX16O*usI*cHV^wdTGD zc}xdp+|iR~4;)|@x_Zm>mZJl{Q0o-DWka67RVHV~z2tl$Da1M9z6KWim*E?J=-8`Fza`P+|02SjW3DwooJ8W4sj&a1Q3?+$ITgo?ar5FB@~NS1cSa-t5x5HZ;K&z zX5wrP6y+`5V?l00G;GHb9FaAfn@3&$%F@6q|A#Pq`!3<*e7IGqWZ{t-waaUsCQnaP zBq5UGfrYZkadS^peZ;;%pz(_SiE&lj)0N}Y=*R9je+ZA;oq0Jo%}JH9J7FfRnYD6c z^N;V(XO%qV4ZPMJcj5LcS?IO=#W?>+S64?}Q7a!!Ysq;VH;85Wmo8_UbfamV{&6Pk zM)QOI`E<#!rUyGe{Ok7_Y$7~6WiAUMj+I8X2dLz9pdu+Uk47!U zU5vaYFf@;ISReO$I!K{!q*v8!n8se8mcz?EthEg{S%n7nSeBk%Z>eJrJhPjITRBA5 zCuZpESSZl;{n0AseT9*zKu6a$Pu7IOVV{mME1m$bcKnavJygJTR2jdtthqx*H#2Zl z)XYk7;+ssz+AtciwaKAlvDK;sP3GUcmFz&5p^tyUHHm~p>he45n{sFLvdj+L*-HPU zq1uTdO)!6xb?kAynoHFa_PnA#F#wktXC2ZOsh_=y<#M+3qv1=2h-BlfJ`9!QZ1qU$ zQnt54$|tvEn?7hh0nR>d8nVs)JCQZV(VC-GMbrdUBMnw^X4m|okQPjK+Sb(aL>oP8 zNk;n|DW9_r^_KnH(2rUA!YZDU=J#ciksNZRm{9U7#RLuN12K;PqvD>?TFfszf-*5y z``kaRvm72jo|$&ty`rIw<#X7#sV;|fuVE}l%m?n!(=ET}rerb+#Gqi!BfcYD#=uy? zg#>(B4Y$gaRkeL+bRl$4z*(iLH8P0Q|7pG9eu>*_vdXy4Ez?Nq;dbJE|C9zbJGu3{ z66XsGlEnd?vmU8{WM?Ok7dX{fdfNG|qTM$3+$Vsx3FC>=yj( z>#$TeSySP(twpD`h&0FTCfUiSKZGDBfH_j}YkhGnR~hKh<5!P?M!ING4%#t6XWc7^ z?8#?*k4FWs2Wz}vSWZDj|J1IG$0LlP5LN*D`gN+2#FGP>ABaV}rp-SO{_eO&bX|Md zbuiJ82fOvEv-!c3Abs1W`T<%ZzQ(Iq z)Bb2RhCr#`<&@B==djM(6vD*fTghzCkoh}ax*vIT*!B^_+`R)mhh6VYoz`H?Ck1Js zcm<)u+u5_wsSGt$muSoAa6}ud z-M1Jev0JZ{2m&Kt6(f!eVn@)eTly1pl)$u;HuOdos#;*|9L-GZ@5f=7=#*S8&b|#n*gum5rJTcOp$AD5vgJ3 z43{PC!c() zG$r!QNW0(VF%xQbY1Z^qU%P!o7#8%j>+GArsn(IOZOw_AxtqQE3e@~ZE{6>E)Dl0fYUM_M&Qq)U+WiwLB3|}&PE;&22C|RLOxJ=4$+FsGl;{qG;*KPlV zNWN4kX7#O?1u*B*t!doB`_dfgn)On~d%szDH?u0hNS|-nxcbaS$T!XKTeONTfE**H z>tN4)Qtl)0a1GO-qkQpqpK^5C-Hgfk6|68LO&$>FtfJwwd%P0`uJVt}waeIId0~NH zAE?U!L>=dqF8zrpdK$;fFYsqvS$@w?82^QK`iVi!M0Wg2ORJeIGTM_Drfh3O*i?uB z$(N2^gsE*?nGC;FE@qp4-|I64-hv%<%|TLEu?u=OLg()=)LEv<6vEF|407{Dnl zb$~Ql*F^aI(u7ZZ^GSXVk)l;m&kwhCkJOeec}|3aQoz3V)ts3T#etcdu^^mD{lz7W zSfpSX7FzGuiqX*=+P);aW%@cN)4Gf^qU#etKZ0 z5b@hH#6sx3iLcz17p~X4kvWAz_(2&k!{FktCr)c*)OdEiKA3W6@qs0o9nzL5M$BWF ziWO&th!I3}e7z^e3PW70YSH5w@#n$H+w7)?+;-^McKd%g@lN<>vI4w0jX`kCH^%@@ zkQg(4*9+F8nm@Qp3;CWPc~8(_%Mw$`I`Z;^b-Y}N#Z7Xej>QFcX*(&SI;o}FH&RO* z%EXfHbZgAI*zpPtZ?XA zn?L2mX49=k1G_Wxk~a-c8N_p!R4nXEQS5vOpj#SvO205V4jFJmgkL$Hz{{`(h&8W& z`ndhY6P&nw=!cSy!yh^sN{@l`WC$$vs>Ty2OrF@FdG}{71%woK1WE+PTr5NrD&~$i zZPDWx43;f|?QXT#C&{^yv~(Ix54nOopgv|HI+Y;c0zXw984?RZ1o>(b#;2Faw44xA zE>+w~4qS4U@Zo*aDBZUsW??2;%#ZXv!dEQ(&-0#W;AXBfs2b#TT6Q)@4WU(4^Kod^ zTO8N9HIluOi8u5u!3@ZQo)jgGe_+0G>Llv1mzgNMWqb(`h4g@wOs5*my*dj5CZ{S5 zDBc{(xly>JYrhIwvLPPks63@x12#@t$bZkVG2xW z$?@AWy$ty$U{C-&OqryF~Jo;7wFadQDx;p&PX-|3}UzW z@3xH$=2dd7z*| z4k6~ATnW>Vi`cRAb5YOBcxd+dfM~+f{krWh0?mJ0!=|C+VUKL+Li{(kYP6*d+S%9r z(ZDc!yKi=KPd+vlPgwh?V@?>~{eA;{Vf+lOm%T^9&>9p-?t&RaH?Hx0lgkSTxg z8H#^5Mo7K3jGiu+5NGQ?`bBmmxOF>M#{(Ya+ib%3LJ{EQ#S>3sb!?r627m{)ck8(S zEIMnCRb#scUDYA5tU1SCRoaX%|B2UT#uG~~Pu*kh_-=jOZSaucp?`_pid5HArGzd_ zC&wt*IUN=C@bT*;tQJ;O@22qItDBBdoDa*Ypw0HNy=2C7=Bmq3N&Eo6@wbuQLV-=B z!ltrJcx+%!Aa$R4Mm1*s67$(yRed#x;Ik-}7~khNnGtBAT*5<^8cY6ZP}=E`!uT?gj-fHK-MLB<=B5wi*F z{2zNqa()-I#=^$MXws1HXvBrM1*CeRf@f)^75Dv!1V-{at1+vUicpktL_WD%udfQ7P}oZXMHR~Y+vY2>%x!^lU&8VN8RG_`UXkXYBo^w zFZZ3Ku^UXCKk;gR)=JJElbijUvzvsZE@3$YE|WZjKKWhy4`@>2mc#KQ%jfbO@f#62 zzReymMpvBa77FSIcd#?N1+7*f5LfEVQ)_lN58Xo{nd!O28?1Aa;&L|)IX%9UG9dbJ zL18VcI%pbXlUx@nC;zZ)5&;a*^ooQr%cuf!--P&w3T@#R7{%Sze)2z!+Iu3kYs}+6 z6+DrSyV02M?|w1P0g;rtYbCi_tR^K#ieaSeH64Zoy|nEX&vAx7IMarUjLlLu6RhV3 z`wVN$Qu4+PeGM;dcM_{D@rHA6T$f9_Lv!@q`!^W#kj<}DCn161M72dq5wqLT z+QI42lD4XnwRV;yBxYLd@t22U6oj|XOzCY!zUOplW=hpETmm+|Ev)N-Z`EVy+M z7o5xG_oR6?2+?giBH=8rE6sgc&DYG$VOJuz5y@R?P4m}Hfvn}q1VX|xUb<$=yt2~I zBcrR7=iTtp>v2JW6St2Axe+NBdEX?Q8O&a~N|F{%Fz9-bg|FZ2p&{_!vs`J5^GFbI zh;uwk1n zsX%JWUQtz&OTzB%Im{DS_C$hp{&KmV7<@Btc=lji(a84FwKEN<8)n9dr3#*dkE+{> zF5dyF6X?x{3?@1b?VIl>%|GRy&ds`45Vm_j{avr%JXfT)nITcX=9E7B(CD6zx*`0@ zHhIp5Z_wU>%!IqE_2~)(7>m%0J9bOZ)E};%saYl^l(n5kSoFQh3>1yE4lJ zORCpCVOMlSL^1^ zcOgXeKE3-K|hiY+rY+w(1l5_93`^ zE&;?5^oLDMU^Xe3y=lg#|C{v`h|1wIa=6>b-30Ciw+J^VW@9+m?lM!UgH(+p9qzI; z<+qEz&^sJq8aP$Se(>`YiQ39|uJ!n#k=TvOr@z!+?t-o*y=P7LJS8+L#v~oTRn>D9 zQ>xF#)U=?JURFJuW5||lzIAh#TF=f&LX{U zT&}?D!@$9Bq~evlX3K;I_*hzGXWArf7|b39+5X>v>hXgL3qsTDuN%?M&CKF2nrMST zHy>DrH`KdAI(TVc{?T`VrIx>!TrYmFW9vS9;&S7*gBz(~#roRRU}v|wi^6zq@Q2*S zU36sc6)u1pNagx4CP(B=+-Kd5b6x|buC1UKqdLW9(T6ntyX8kyJz0u&m1GNDy zJIzE^bIuME&1H&}DA2f!Axl#y>>7q;d-j|3`5ew-4hBBf<=l2DSFYx0Ltv}=M#e`; zSz~IcLdn@iXqH`gJQr47OaZZue-72IA7N_5X*Iv}ZQWOIE~KAN!QtMq68f zrI6(7Zk7)IrFppWq*nFn{9u*WC88H3q1J+GU5e|+9v*?%{Z?;jXvc_qI-L5hU$Doh zAa#26t6gMevc%J3RK$Y+C|h79y!;t@L6>*sa{Fjtw(?9}w=cikTcPAI$Sr@(tDwKf zUDdE>DmbN;uzkW$^k+XB^p)-%XIS{aK5dtuxOtb7Z2vc2FIs;;&K@tbvx;b(!fdkk zEO}=qUiS}L|9$wIhxGLH0PI5UW)9{XE<3E^urTiI=6pxNsZ=j{*JoX#Vw_gtIG24k z&CJGDjZUiD$H-l5sY%6U=<#z{-oP+P&)e6FvLq)LnyA=2pSx-KFtS{i+0CQ0)h`bR zJBtq$zm$ww$3*T<+n*YJv8;uheL+}z4*1h?P31)IR>kj-j9WHeY?~=gYu+M|REcDX z3*H$|$-geWvc^Lr4Z#eYjh`rD$HgdzpYyL@47>WTk%(*e-@$AR|GrC^Y49G}D=>Ep z%oVVTXV>r5Bs61pcIT5!uaajA2p0~%{<3=>9eyYz-IpO;bJp#2M+Hd*rSBIZ($S)8 zx2iv+8+AI-^iL@jTYK4+kXY?USGXGVUE~iP}FrJ7kp3ck846G?zoaqjOX)dtcMHyCPOHmi4UF zMoD!{@yItk$CSGWg13_qt7H!Lzkx6dZSm(U_^0}_YW!u0j4YxZW=~B4QUHm<7piFE)9pyWfskI;>xy4CW;O8>+wd^qe5Q z)d>tB&}3l}tWfCG{7h(E=|e=~q|$>0B#||Jr!~9?9$@P6#`lJM@kb{$t=}nu^`3F3 zs|*hXbQ;}JHx8WI zC4kBzTg`)Hb}$i6ueL4xrdS+K1`Ylc0f8~$&!&oX%4@gF<;?v%<`4Slbx zQ!Aep_s=hU+cB~_Iy=YNE-uVY-y>|Tk*g_9jpZR3=^F98=PTr1@82JD7NRyBsiq$# zZCs(;b8}_>d{Lb(Dh9Gd1u3WoGVj$yzMqc}7{C32+pMGCuJ#K0lt4LrDvkSUWdnaiCCSJ zx-Nm#^3S6MV@bNUOl0&h;K>!wA7IQk!*XRLC*T->Xdzoo^}IW$>8MME2_D>SW#Ynl)=OFtQz;#drJvb+#=VC}lsMKX(L?Y?x)GBQF>~?HF^X^_gY1p=DWE zTid4VCL>EW3*qB%{koOLHC-styfr>kKt`wi-Zq(1$Qh_$I3(Bp+u3!kx^o-iV8rSM z!Ho1=d1jsH(_r?LQ`y5t*ER@+XHYci@trR>nm>{8#UX0e(j43jZY+J-t44vbyJ9JFJMaG0o%ppJ&H4%B?9fE%%D}%fsN{wj2R0rB19H!#( zV~YQu6qnbI0rXi9{^uF%22S`>>pFPr(Bx+381uk~7tzwE-wH2|ct3>PEbQ1vac4kS;wWawjgZXkz}xFGL=AqacPbn!v0|wIe@N@P+0|;y5ITvu@b%o4xseKztA1$VQ}4 zV2K57dzVSON|Ee-X((M#e%y~Qx%uo%`dOS=`AxtpJ_HEkJ(TB9togi&O958}wSWL+ zqrb7mQT!2$iLRRh9MBb%TbKAuXN~&@D&mK;6TlF`bmD96dM3cdI;VMR(OK5TGNHII zv)|F~K(wtsC)(?~xO#P!dSaFKdW^x~p=~Hac5mB%{k74M1Z0TF==${oTz-)>S<193EFHVylim3YSi|;340UUZ3oy2N}T3 z!T+tV2XHOS{Ei;8Kwq6emJSY%Stry+h~Xmuv%=(PjAWv{+f|7*@vLhlwkbN9tP%5e zI6<0pPT?}_`WNzvt6o39s?}(-)%5ue93#G^hLCgwWIuCR{!;A=lNLu(xt=masD+Hx zn~3fROa>w(l!sKc1|JC9mMX&TN=i9y1mZD5wXA zt&X>k*E@VZI^RYe1AqoQ^~W?Paq~{Q&q3{^r0w9emF zaq{iPI-Pt>=|nP1A77>(u<+iFm*KAC6+?QB2qIDWc%RD2l3Z%|b*A8<+OVBFV`lE{ z97|*bo_g*CB7=}BdxDx|8n$PlEa)$>*di0To6PwXd$27EBJ~{Ah6FA4>Z?|Kv|%y0 zJRg^zi@rY>nOBg7hBMCNSY>U+$)BH2pP!ObnoCNV&$3rAdFpNaw(>&NX!5cjN|0~e z$!6ShB;w4x^|ZNXri2r}aoXYj~~xDcmiq*x}@FYmZmok~fh`TZ>DLy6($TF`GM1yE%Xk z>iF&B@&&QK^*L`FS{Od9oo8Q*qN+w2dYkSr&?)-V@q6gG>2F%ksEMd$zyEQ0wBV{2 ze1@>wsRUHwuO?1?TU*l1Gm(fB%Wb@i_CrcHvyCZRgqsDw(GVdtsjdJ|11rUS`Y_P& z%b?a!$@Ki|ouwnXkES0Gjz||w4Z}37BT#~rc&fY^7**H-_1r%v1<%L7<+lE#8zOty zK-MSqsOc@?dC@~>(B=5n8J_21`t1)NEFf8Nfs=`MD7Agx!JS^6L)NaEvV0kkBhYRKZy1F#TS6=JGh;84 zJP;6j^mSiZstWP(FhXo`DOjRpKq}B-@VdPg0GD%v5VaL^$W(xuRepo#ST4(V1^dsj z{Zy+Mal&a=SCMa`%!fA>YW_!FDJss#`MyzTP$hfy7X&e)*D;@r490HG*m;vis4etZ zF$kADnI^UHZ5*|f5CQvgC0VDKu}tZO&qfOJb_D0ua#A4M|AzEb(J7a(F8Wl{qvL+P z%mQeY*T|mq&1fiX2QX;V>$f*9&N9hSN!gK^Uq^3H_N#Bu^jy79P{}vrfawTAx~}e zHa@+nN{TrV%Mb~upIow+k>^#bUT-E{m?NfaD-=Md3z&Gf9xQqqVjg@5BsxH0*UMB@z@a3HIMc!v>?H3Eu;}yu5iUtz- zc_avYA3Z(&n$XLagku@=wBbcA6_tIHM+Xf~z(eW#SfTVlak$W3C1|R$fjI_NPb7LT^W|!w zVR6R=PeH)7vN)cH5bJxkasP-;iyw9yzCL;4zAq}&t6kOrmrt@fJXH`0(GW}I<}r|~ zjH+c@&J>ynHI(Z^9q2N+*ca4IB_I#X25Hg3W4!GNYSwJe{<(-lHWkeP{P>iM&M{!i zjuok!cJooYlMq#==U{vXiM&wMNhg8{Dvx?^)O+T^&k`0I9;Zf*&u*6Mn?_0b*f`2k zXpPWHB>zX1)F>=PGyL9rQS7)py9}PyMfD9YOG~WI<@Vq=xSdKZJLE*tyC2VQ)IJIQ z>9^dV92V)Yoc+pOfZ?>r)%wpX{+IWdAJ|+Dl{D~sv{}DWO;=<+2GA!`ohL4D2!*hV zetA{tWMy!5gE2-rh%mwf_$o~O3EmAd+jP`+Bb5#%DRawdR!>aNJl1WAR38)sXD8N} z^n|aV@&re!WqJ=F2O3CdPO=~2sq=rcm3Ti}ffwenQmw~){A)86&}(8OrzQw~iYo8I zz;d6phcD9040BDF5_wu)>}tZ6(7@RnWP||legxo(s8s-Wi+D7TGhcV~t~ac_D!`R3 zNg_W<${+TkjGWW0Aar?<=|2>?$iu{lJ%yK_7LJUako%+FYRLu8mnHdGS=TI9L3d9t z`082|H=9^9*UQB%z^noxDLS?A#WrR5FyKXA*vYKbMeK2jQ}b;)TkXbztNrI<-9LP2 ze&FY2UHYL;XhRd{cqP)gn>dnVz7>lOGPMpXRgwfCA&j?fcp z|6OZt!ez5e3xoZRS5#q+lm1PILOwYr$+X9jqrN#0>*m>lroo>Fa6-jZs_t$hKP|S? zyPRv`b&jna{q!cKS7drhjJyEMEd;v6^!4W;+w+J? z7=_3!$yfopXi}@*HV{e+X{SiZ%m*$kU;eVr=`>~0u2nR1GKWf|#ZP{hInApka8qj9RM7$Ki5qX0$BsD<^*}6gqu$ z23TPKz`(}(j5J}^_)?4|H?KJNO=nVmvtz8}N#Dy*oCXOZOQGps*V_&H1|@vD$p zjgBF34*cnTO8bhQP@$-)95%@{DDNs6x>ad$6#G=b2C9pm-GEK#%Y2?60TuHE37eAb zbPWFx(nhkpv2dRRTFWC5`gAVS73~_f^$9WJ3}GDJ$u7m^i#X`~A0i;Buo9HXsU>9g zfOpu>&H(hXa_vdxh(|1AqFMQ|nc4OkpQGjTbiGTu(!<8$r-TRRh*>iXI!sWG+*6De z4X6=x+7#IrqMKojA3@-jyA+hY-TBS*2 zZ4PgBbx7R%PA!NF_2Z5<%t~~v|Du&+spNCs`EYvmnM;<_0O$){_GmQ z0Ny#j#o4dorQy3mpVCJekBDovWeMRKO)+QvZdN!Q`$gj3bW5yqoa^ru4q)8>bkY!H zooG0QwA4NB;3Rt1?jl>VE90xW6fVj)AxSpu2Ai2|j~nZdt2GsxdLm#9-tqd z-OT4C4y%Z+r|Tz$eS$G-QW8k}8 znPeUW|5f-%+?}nir#3DXQiHpe>^qmr(J-|gUF6p4(Y?cdu7_{_2IN_rp>tM@#2}_3 z6hvithHFitoW*Ey^I#wPsac6LGqtY&{jT}@{xCZSZT(voaV<7V8y32H-o^nJzR)O> z3U8K5W@XRg_Y0rYY=*Z{M)=t?(21*T+$|vIwMs_15%vvDIDuTJ1#NVRJJ~@iO5UST zH1%9o3lh5OUqCvhD^GuqJS_*DBr;9TDy)k65L?l-Go68!BfB`XXL*$XS3GBz`SQWg_n=dOYGaOwaMiJK5QF?bF@-A4a&vuV=_RU$V-;c2kI>%wno3X5rg4bPVC3Zthm#ePbK3yNxnS+l%5L|cos#=~zXPw&O+L2-HtUX2XU+}o!(DVk9S4DnnLi<5@qY*y z9r?J2_zkoB%VKbT@W4ou;q(tdIg|IUN}j(|@rE-n>CwJv+RqM-3JIO{;}EN7FCUD5 z@IQ;>(FB@qQD>VrGmQ0JdF6uPz*p2&6(krL?=@q>?Nt7Ho7zpOm5!mF)WlnS8v z5-Pht>dxjAImo-~I&O~3mf$@ud>K%H5zZ{A1O!jGa-2J15z+G{`UFGH42i^gOvp#sI>=qoeV;m;a z|HC5q=dFN;*c|U!m`%+YMx%+`UT6DV{Q|&i?EE=I%@Q;1i!5a1@se!Z>Oa4W%TzQ{=swxZ`Sm9tn$f4Whe`g* zQ}4z0CMIfZp_L&}=OxE`6Ntb^R_fwFTAoUs1SQRwT+IWdJ&;ce#>;0on#z7uSt=x;rueB3Kgf!Q2&u_I{ z_&vbXm0!s7Ly~H&7y>-HM+Sn+MFFaoo5^df$6On|I~GT81-Jzyr2ETuhK4EHI!K2% z0fWh=gLHyu^|Qb$BX=!>8@QIM#Uz?$;aN&i;HPa&j0FqSK+}5Ly!ySs>mv}VZ2eX} zw)jOuOp+r}V#ZRTlE~X!av58*N80h^_vVkZHpGYI8Kn~rTQMCj0vjHH%%o#xNy+sHw_1j8wG)Y zt#xLl0bI5?#~Gl-Y%nY=n5ZHT>-gA-pqp9`I0)d|ovqRMv% zE{WD9ej96zv#I`cE7Kw*VjM&nJmrinG3>i{ejd5%O(Q3G86%|JuqAM&`P4kX+2}JS z84gz%sDZ3$y_;(uhM~Hb)>ztlm}j6FsV-oI>?}v^WSPs0J=-81^dDw)^Xkh;q27g_W@YT?HP0^|V)vu~)$FDLkiDr%kK^Q!Krfz( z)@IhHO1kKt{Xj*s#3E^G(|#wZeyoINi6dq0?1qPUC4#_U&hn9tHP*Rh1XfAccMZdp z?z6;${2+YcYS`)l>f|krTC3ta_xEWbrqew1wPY~Xfdd4fo957sEiU>aEcx-MezM6Y zk8`9>BdL^XJpB$BxB9Y+Z0fbS?4yo|Tr;Rt;`nT26H4vE~3v{$X zG6b%s+gSKbG3tD*8@11?upOlXnkLK2d4b6p{FRU{*w+DU8->Oc rCA?ScXr<>`y zKO{y%j%MfL(PcZ$cEA;&v~r z8yPqLf7?!!?J34`&sKFO@A-rNoRr%PUqie~D^2gC+9BSBu&HswYL=hyaq;Y|!%HR* zIe8qACSlvictU3_$M0Lsq;gs`9BFe%6#+u^8RjrKb`%u=(=7X!zX*vPg+kqokBDC`4}D`{eVOgq0LbeM0kwD>-*Q0jH;rbC-vU0o6|(Mmy7vnz_OgdPKcxRI7b#uS*t9!YjFkI%UH4x$K^d<%;$=wFR5F*U zIo!^}`mp}qY{f?6wSkne^EbCL|Mv6|kJT%~pD*iqMaxZa@08xS!x@>j9OiK*nX`Un z2;N{`InSTbNM3W8;h`NG-ox)qV#;YYSdE+BACCafZfGo3J*Krf3_)@0>5J&kzDhZJ z^sU^`K4(Z(n=H620@|I1*G!oJ-&;5Nc{0*!xT*lBaP;Cu^p}E!1Z?4=2e0s`{Idt4 z6g#CU-?IhG&h%l?!sD`0>Ld-vJZEY&|A9%$_!dd>SRxV-Sju&g>WcIOeV_c1xrlvM z(?!i89@yA*@<(ATqDw6&VZD*Uq{tTBKD3HigZ&l$Q8W5qQeF1Dn_ z5R(G1o`*VmKe14**YeKLVZhAaixIl%OZUd2K1Q<`zkBBfripdN<#dGG;_Z3G!SeoK z@WrIClw0avl`iC0Y{R}HE#s8_WF^a#`mYSjfc#+SuFIKJB{*&)kPBza0#Mw9@TLXE zIi$M=zO0ZP<2+7bA*fBs41@4vb_p_o(RZ%OM?O||3tnwoF#^l3QMhi4>bm_xuj1wh zV->_JK)Q>&bLmofS#pX;c$<-OU3D~vpD&`8j9>L{2epvshm*8d*L7N({?Hq&~{N_yIfjhQvv*kI$R z7W8tkV3A3b|KDEZjEczk-&AC`DCj;P$Ig4Wk5Oi6&%4q)@BtiLqw0KCkaH)WN@mK? znk}7T}^~pBF5t7;M!TC82`cO0h(=XWa*+;7dvUUSHo#qm008$xemMf zcDohRoSL&m4-!0gIDC@8CNW!Y*qHoD<7Z(G%+PvY@BCEv;l9q9@xPc!^Sk@``uVBK z`R1GR%}ANx<8uzIUvx|YR%`1%Y-N7M%^xj|rp|vq28ERMIOvYO(R0I=)Zp{dPoiZN zbG6H3qE~+JLaIlpeu#>4;tk&l(N8Bretl1`RLA=pXk}z^XV}sB<}iWK2;ec_YFkqU zHvZ7WOV~X`wEAV>&p6r!zx$#^atg_{;NvGmM=c`TIBdX=Irz4fvjs1D)*?2LRg4nC z87vftbKu(qWmPG`CGSwdEnKBH`Zl~?46-!D+GT0ebN~sc-jk@sZjj15z3g}f^EHg; zT9(4XB79{24?ZbfQFaLzEX?!)#UTlEn0NXWN>}aS2bVmxcLuW$_hmC0F7xIr#f-+z zFzcHsK{14H+hnOYYb-mlg!Ys_QoTK7^lK)or@eY20NTY8)DC|Ew;iyVDJ>t9NW0V$ zSqX1{;)52%&o$PQ>h6>|q^Z1H^9zLnV7pQ~Vz|gG0F}EK1rP9feC8$^)6by)Ue9r> z*WBUqbJqE6z`m2#eKv!|rjiM$lislq)z?o(JEGmOi6<1GrBWqNT+Vn6HMJF2x7xAP zAF}08P>(M+BB>yHPy8VLKg8hPj! z-RjYPFyT8|nRnBKS1P#$lCSm8Z9_rIc^|E8^_cN3D0u2C$N0xACr6&akoCZ&mS5U8 zv4U#_88*hr#lu4z5MaR0s|l*PG3O~9DO~ON&Dg_C>+#449NSNduT87Y0D7gfN|w8a zs5o&m!MkH*wLpi*O+!mL+oeiLgdcu4KggU!%4YgcqaQ?mZjm8seNRZ3$`&h#5TEnjIOi?Y;dRdJMM?N`!=MS$eZ}P20fFed3J4s`Hiu2CUfE zk>QD4nM&U~Y5(D}VVKDSxBZ8)d%{bY0_+xrc~@bt$D*i`fG_(~@@*h;(td0C%pA1m z00H+fHq)Wb?RtWvE^LHBnPkmTnSyg|hS~`Zox*JRiq$7(J@*jnNWeb?QSxbH5>&@u zoWq=q>84d`%m0I4*&1+ADA*WjdC#BseEt-f^-G-9n<^5#@#``oUgDK)PE#LSa*6JJ z!Pm{H*2Bvfx7T*rm*%wqoM(bpdiHMyMq=t=(FKBuC1v6DXn3I6g`Wk@rSNf=`7s2E zpJ5x!__JNIc`=2y$;Z;1yHaNm%un$g{XfK{CgAHAC|kK}*L=IG_wX*g*F*U4I;_X} z8H;Hac6Ua`cgOEAO&MB3_MmTrs*g(tnC1FKfEcj_%uYFkY5SK{ZB%kkU}IBq4#8Ci z9AXrPPj6ynVJKU!jga=$Yjz+dEgg3QA-N18vXj6nlY2b5FBnYY;yspCl{= z54T7*hAnOVH}1Hdgr|^<%vua+UAlD#w2QHkScFu~{A&Ts9foM(>MTOv5W8tnK@R*~ z7NK6RW;6u^9#CASLBdY(zqf3p2U5x?c*IISawzk3HBDwEgfdY! z6Xe@g8Ziry+K0Vqx-I+ITa&kp#5_B4tUd(qYee%>5kbp1B3P90Lp{{rgwD}3sL+}S zMeqDgrcMs|q$1THj^B_YxhlGC>F+aT=lk;0fcn#L>8e8zQK1YEM!3t&N@^| zSSTW0*Ej{L=_tT57RE#e3{PVOPL_)P*H+exmbT$5p zLjbW%KTBFVrI$lm_{e&H0^b9-+u2oRZMcqS;*SB^##^0pKuC?FGTJl$D9$doK%+@- z+;hHm`m6h*o=?Xr4cj`o1)Ne-uKheoVt6&YVj>f-rgCs;d-|GT@jIs$Pua8Pu|k7= zCOa0OGIOcn0Ujt`3$W7CXYd3ZL1ohGCwcMPy`l zyRY*4e+Ft8{NclIpMU@Uoi-)nH=#3q>T!+Wd^byhRlxv?$&t4@7dj`XX|&_`J%H{h zv0AXcMlcP1bt?-&A7Yz_``Q&VtOdvx%RZ?))wEkg_kF~I+7<2B@?LBg7B023E0kT; z(nK}l=+_R`L_2SJDsxf1)dqe#V_@Lqfbg*mxQ@FPuag{uK|P-?C@wNPXk3sXST*jt zK_?BjXZL5+%(!m-NK@*EF_?%?L|?U*8#w=of%GA5ppX1p4R7(tX2$Yk!>g*3Xj=}h z;{TKH_gnrjxNO_p5X#j-z`qtm`3aLsDm`&?gt@E@kGBoLSTmZq3XrrA`nxu+XIMya zqdJKxL01%| zG5m6gte6>CCC(Dqx_^sm-&rJQaMELN1#2Y5Zv2vcE}~^(&1k%8)Io+dV-W`%mQwA@E$08xZNVBp1OEOp zYqGy$=CkEw*E|(l8ZkQ;hdPjE&s>BAL1AU0j*7o+_Lvt+#b6ke z8CU;xzVukZmQh-v%08v!kZ=-akT6XbKI_05@N z{r)=V-Kv^B6;;UmJD={lBkZN^(`N?GC21!9ZVZiBX%1u|S}@CmJ*vjG5cy;cU-Z>~ zcu?5Wt)Ltr2Ux7M>V4Mp1%u_9TMp(ipY*A?sRnJ;E0v_AUn^tv-ok(me=~X@hh^kz zD8OC-2;DRz7Ho^C=ah>#`xtH*yA`}{f^ufc>-G!$5GzbR`O$nfLx=`6womO;dPoX& zA+Fs6`Tf{xIPvB&!}wLp0g@U$&G^>RvQ&xGF$_PY;{TdCkyaHy89eysQ)uerMmSGp z(~iWK^hkTVA;D{3!Z}2D>U0kha^jL3Cl#sR-H)&kc=z=S;QB?(%cN2^GgqO| z&!6+tj_84;>XzX)`~cm8^7*soMd`%w>5YGe{uAH zx|%&F2bZow$sucp!MhnRdt#y(fmv^SXt07yf$JBZ@sbi-Y zji86*fPCHj^vQe}t3gmW!mOlj^4mt=>$hXb<^-8D$-K?*A4S)n-)S&y@bsf_GB0iB zU=%1Byj5}rsl2*oSdrVN8?T(g;$}0w(%&6@a-&m&@znpdO_Cafp2Gb6c7S5H4nZZz zCN`qZ*qdK?gbNE)j#@><+1_Og=&7a=We$N>FSX)1FS0i9uN zAHtY1U;Lj89zuC=@_ntZ&yo^5Ngl5y21#FP+d$c#M7Z}+!pBVqIAh2P@rD;+;a7R} z>c4#Kph~A;thh$ml5h>utUe)QFX6q0DUY{@%N8n>Uo?cvs6TIF&0JwL2om$|Fu#ehzQ7~U+3N>! zSKfciKuYjG3jeg`jvba%n>GENDaRzaT3RkN^(0jhBc6{Z-kP2v1ZE2RBMQcMYG%=4 zt_Kk^NmhseVSoDgNxtf;#1> z0}8Kn6u5Ggv(B@01>ACISyv&iUiww87RW+kHDN|#qOqMS8TmA>=>4e#{@?y798DZ7 zS4%m6+@zNtXWZqMv@(tBV$<=%`IubXSiFg_Y|0Br_E$Tcl`E1e^Y-1J7n&Q4pN)#u?H0o&?J+KT@h?#y4hnfVXh zVbKW?qhDWPV-qmu(D%1EK5CsyK)tvJi|QdSL!k5fSq^+qgeE2>68k~4EX9Kdz0#*t zs*wGia8~a@^>rJR&9dES>3Vy}x&ej=1^&~aX9y{cqXwl;dzOmG<7{!2VQeHFFqDP6A@2n*dItN9}pU2aV*W@FFQK@GJL0?~MH=vMR%*9~XoiA>w=BTK z0`6f}!Z4fvF@qo$T>Y6Ll={M&r}gokztuSIIcTDtGX`W>0$oOm+_+3#x+ zhZK{a!-j=U;2MVF;_&`4k385B;*5Vix0Myw>&T+1o8c`T3=xIWMyl(2$4F5HmyB4m zyQSpfLMK0ZG3~-$N3p#0?QEV8i-n!M+CtW=dI%bo>{>P<>vhk%vSq&7}2!2Y6_ zNC)l~UB4u0v#@B8MoA4qf3q`v2e80=IgDAzr3+2*ZS&nAB%+BbrAP91> zTNQ|oOBz?7G=tx_>NU`a-gHszsXm@)us#q|=t#=JQ*h zNji-GzGNOc-(>`xJNx_n|6q7!-+e{)^tAqbk23$f&PZi!{d&c1ye!nfr*pKj=AhC1 z5|c-$6$(2|qZdaXj1gXi8w1ZU1fW@`MH?!I-Uqcb8P@C~Hg}RL;{kp+)+%MAR58CH zCX(cNJ7O@8*W~GdS_|~=)X6dCf$C&Mjy;oSWV=|op)`M)bIGGuM)}P|>4qX^)z}j; z?QcI|LcS>U@%QBxXHzi+rajN?60L2oknre|=yn+$&|4<_q903(hdrU8hoAFv4r!!1 zUz2bni=GH)%>UO}k-IO$wE%bVbP35WYk5a}Mi*Su*$`}A8vw@rZhnXI?AmIUQM}fJ znt{ZCYvuvt2MsMe@;FBNf8T_$!IerZbTW`W1qC)4+aQ#6D0mwAD~X=v$nq&8l^W7#T=Cmt+#5@LgQKN%`35OK1*6XHAW;`b zK^;=9_lRxJt4s2H2U&l*;-TUD?+C}C%AzFlyvx&lYp4nGc23f-)-H$PA!T@vp|ia` zpJTX(S+`ymkzBABI(ayo9@L7LeB#Xv=fudSMYDb8>jB-&(H?n(AKCh(CA}5EdO%NQ zat-0Y$b!vft>U!Z+$W^H^u>;K6f`I*&eSQkP^;l0cb%XiDqk=b$3<5VT1uM@zx$q5 z8ssKANiHChm>viY8r&`ltuD|`zacTW)ZjGT$B6>>pZw0|lG# zD<`~WkbKP8QDAgKd6m*tETsHzo5=bG$URW=<&Z=_2K1|e5r`$ZZ*88EY%mF+wFMav zN_<+x%bb}@7(1}w@Z^!d@uC~zo7!l7Q^TJ}KO!}mNE@p}Nhbtn*sGs1CFJWB7sY9n znYP%1q|#&os%uM`-B>x~ZB!c>Y%I9Rc;v%s6crex)B>yLrt3~TEj!mbh$5Lfxvr9_ zVSFf*i}D^M5kV&ESG5;?JB<_=v{u9Yhq}UhcRjpOjuxm{r<+ywZRNag(?Y8_rmV0Y z>vY*${l9=7@(T2DFkim9{{?DMd(HmmC=q6k=jx%3eqc)A#J^q_i^9<#QWCN?gl)@M zDu8Et7M{GQ7AOouXG-As?#8-s@(Fgw&uC!nf=nL$MY_y)^GW$xquO`_9|L@{c2qKF zliZ|J1GWW62`o$OT-wfpfRlzI-G6}2%e+kL%5=+OU*HDpdT#_4Dgn^+hD|oThU3pW z;jcLLvvknbn)0W@kJ>#l1$8c(j!j573QKGuP3t$uhoW{)-YW4wN|14K)H6rH%EIB& z%CFYGg*X%9YPv4ZLEk6+_x2^6t+-GAHVS3-CQ)7K$SV*ObC50xx488@da=hf&&#SX z<64$CM$1ZMs&mnPN){NBgf$z}miFELc8%N~Fn^fZN1ty(8!SL+iI_s$!;wu%+RzN6 z$3w|a*|xF4+2*~i>nvtb2$N-d9eb=wuFy~01GjAa+?}58*5cpA(V9E4;2Uw!3b&-A zbsQdxPLk=wQMl@i!*#T1gQhC#iOSMykIm&1b!!>rI`tUg;lHw6M7m&b)M z_{P#(u?XrQv5}1eAw^I+`2Bx(M!)_l?EQV+&D+QE1Pka%qtIV{NusY%hrp)Q-k_nj zLO0`#a)%Y!xuCaGP&QAYl}A0Jety?XEW*~qG)fxX)ge~kcfXP6;Az?L&6eS93sdoU zw-cXwgBwATR+jMXk)v6^laf1@1Ur6B48Yq)iN)!7wh(aT9Uesl{zoyT5gswAQ) zh!qW>z$AIfoRduGZ(vclnAy5N1tLW(tn^2VRTG8~T?ZJxJoxO4;+;0_8Se4RypDrp z7gG-%Mv1UH3V3#UIx{QN?2`oQPU>ezd?!1-UAn6;XZ54Xq3`Xwyh zLCF{P@1kIo2~G`DgqF}MA!RjuMxkuGm7j~XtB!J&|3B<7;Eo$Ol<@&H4ro@7H68=bR?-FP5d!FNAuoSa=ji*?AJhs%u{Hh5969b#DC z)x@ZO)o-$K?G#*g2Axlfv3~5LnyRi^Bbau z6m5kH4(h$*GMi%>+QtI&ZUinkCe%q<^YL`brGL;*dxvbfuf@h`-{3GCMJQR%vdabf zSlGJHjuP&e4%>OK>Rh@^LfSmjg^1<;dkG2I0386s^Y45AR#t~SO>w*j80Q(_gev^L{@0Cas>X0kcU%~!P zRKWVM!;{Zo%`OHvUqAh#JvEyH)fp9HwotsEptHa#$fY%IC~&LBSIovm)Azxf39LUw z?W0E(x_^ze*j{@Oy_tX4xRZ(%^fuBz3e4i)K5H@vT%R#Xmz=GFFJ@49k)LQZp6w=t z5`qJ@Sd?S{kl-tSjaXxfSJh8W+gNxqn&Efdj~6g(;PD;M_8nM!K@whg*vBa__YaNl ziEa+GyS-i4{L<``FJJgD8duPZmwCldMf%Y-+gB6|_g%4M%(J8!zNXXDbH`<+^J7}u zeL$jl0`h{3I8xU{=o4eHQ~5(%<>;(Og%T`Z%ldw4l3(eA-yekxnD)5-ce>kY=e3h* zYE^eLV2?9WvGS;@eh!aXf7Z74>D{*D5lpphaPwZQpAvJgYSI6@;O{i>t|g+ zY=)Dp-hG#L>@|cHk+VH*u!~kL2aXtCN81ajCEW8C6C7~~Sal-p zizoyJ;fkkM>1Gj)h00P0;2pSB(U33bYF#gmV;_cN6ZPNt($CiujOlD%1q(kwkRMK}hPq%)*}$uTZ~{8? z*As@-sfT*)fO7R$(BrqizN#ifN{AkLN9!sF1SQg9*W8A<3|Nwzhd+k1Ik_t9=0E7w z7I6Y&fYt1~Vj4W;p*l4|koE0@?ud^pUwquETU!PSyjQ^14K9#hxWz^X1RFbmmUj*N zNpJ%N6_=d;zaiK){PPp(jWG!=yAVmST*H=cYG^O&Xrk6FAVoSE9B-5kS z@&aErp#@T(-n4*EOBfVcD8^~OPqfYdC4(uynb#_@$%8q(VBOK}*&|kWD zJg9>Nqq9<9*nL!C*J2VMt3oyV-3LM69c_Qh`*yt7gg{{t=YX)=i5{7U!#aLKK1uh* zS$-vYmEF3b(f7?hkxs5weS;P;~YJDkR31Zb6y+bm88voi%7&SBH&CZ|fe zRqJt5q0v+{|32ATUodI@-~4H!1}Bzfw~FN>?d%B$S3UC_wgLLJ63tN@@!`>J!^@-3 z3RDU>u1eY8*!n6(I{;A&I+x>ylNlI$%hQpA$up9#-jB|}ylWpt9{&DtB%w>OHlHik zDsFvS*Yvm2SIX9+o|lWoxXRn3$LR-omt)V^{ZD6q_uE3_yF!?kzr)h?ZFA>E`~S@p zEgs}&FReH|u--!b%eb9=tlo@mq~I84A}zBLw1#q`^y$_^)_U7Q8H>V3s2H2Pe5%U} zWrL1h$v93X&A8elm+g{~e`~Dor*r%;)~r;>aAMIfx^9(7a08n%oa*~_M3FL;)d!5M z>b#Y!?dpA?U)}#>>aC*U?4mB+KyXNK4ekUFPH=a3celdb3GSBQ4nc#v2G`)Og*%0N zzu)QZ|MV?4j8Rp4?X}mM^O+280`A%w3{6(0Y+`8J(P1MsHnkKJv-Cgen>q6tRY^#; z20zPS`e)P11HK2UJq^d%eqCPEc~zn~h9<D~gI7NYo%n2UD*2-8LR$69(jHfi zPXeZI1`9d6ma#@tg1o;4INsM14=rEoqsEeq=0W&K?%{D+o0yzCoIPOjgAGt2mPN zd*;g~gzIFX4^!T0fyS{TQX#%iA^Aa%W`SoWsa&-mE;hT14vPlNcDfUZp zK|i#P)~^W18P>otgIE5{Z}TZ6a_$cT-WvP|C0zIe+XZPlp3%~FLAKFtOV9=rGiu|< zV%o;@^-yef94XYkB0v+cu?&YTqpJE(>jG$(Y|=_`F^G6Zld)(5r32(aQ1@eku_LHYtzz35G$rLZ2J}g-FS6cqVI^I=akO|+c>!4 zh`fx#f4}eE|KgtW#4xmmVy~YU4=THMDbvaW$f2mo?djqS^izHSXd;su0_S12rSOX; zwK045i^vH0tec{vJVtsk5wgApb72qAs4KrvKcsk>2^XKHZ2w0^=V4}_r0f@?jobSM z8+#q+HkdamM*=~K$b0qW>#uoTsX0Sv;v4(_5GH3ev9pcN&srS&ENM=IodGzAw&1;Q z2lVFsemrr4$0K^*r*ssbE2Y>91G`Ofwu)9Q#o`tsG`^l)7?@ zbElBr*OYQ>_tx(jZXU}vQuL=p1otKFvEtbReoEQ~o@t!zTra@O4^C?5SRVM{ut}61 z9JbcgbYi3nRWzgjTh@xaubnT;mv-B42iOf@-)PbhGVSnvRlHpO&V3*vmWi?-jk zSS_kum+;ela>kXYXBPswiVx_hH=&ps!wVh&j>O1&tlO8rQCxMNdx-IzVClnqWxHes zd}YL$i{x2kc?xbePFL>`!s%Fj8UKngbS za7B*^cTWjTUlpv5S0T_JP=!bq`~Q9u$a^BAm1*o2yLX@6H2YgWXn$yI<+j#P(saJGHE~I* ztALGWaS+4r2s?KSZZFSXa*8!hd0{LHKRgkg@wav3yO{VK!Cnx9)zzv5()Pu6l|1i7N)essY}HOB@Oq+G zbJQ9t;L1&LJYK1IK{rS%M3~)8DYx2XX@+`o{BNS9D=AlHc)IP`KSVBUIi@qvk9=RKZ zb5lJ8cCE`NFH$gV$cF`+Z+fiuQ3nE17MPlg=VWb^cmP@8Tl;xPj5)(ls=k*Wuq-1p2wI z7~IjOnooDai!*}+Ck?+>!k_;MP()A0lInZ_Yn8@z<$|>=JIZ1<&W0$E6k>YI2))dY zB`Q5`LI&|)2VAJ)*zR7rI~bHc!^|(0yy3%3xujXHSzizh)i`2~3U}vdTB&Cr2JmC< zc<$lXI(9e*RIe^--q5^atx_Ycv7!#HX=5jg{$m^Ou2-6K)4Sa#YL5RjB^biKsaV)E z^VtBgB&RSQMfnJyfA*FE{N~N1;;=XIvm?>6wz3j>FU2jg?RsrH=f#-ld&N8(=XQpSJau~D-D4lv(CTd0B5qc(wL6UKx;|=W=oK*{*~$pmG~0U(Ka5Ea zl%b!cI=4$rzkB)$C;wZgNZf_pIU?-Y0EU2eoCJqu0pb#Eev70Nqx#(nh1h?UdtZDe z50B;-ZZRL!P9}@wLhp=8mX%g@VOJwKu0acro~dxSSE`TCAap(E%rSukaqY9 z7n&LGU1eANQdICpH2MZ1{>^sH+O!x(`NliUgmV0;77Ny*hW#p!1d(G-)sX!+1?GiC zz1|~k!OkbX>-+^e2(yKOw}H`(Ext4>MCdZIpCpj;x|+i7p6*ivz29NCKjhn;q2#Sf zS^=YYLV9I@wj}Hod%}mIhwI=M9fQO*v74!`Qw)Vp2s;MkbI@I}{f=8(?mo(yYhsit z;faaO^IavsmwEJ$|!i|Y2NPGq0)6oAZM6Zvm$W<``87E8ZC1uZ1qAX zWgh)I)EPr^9_C!(KK@-pF|vx z1}VryF~r(Uu;Su`;4X3Yb8u+zQ-oW6s|(xkx64c02->B7D`H2ieS0R|e2k!Fz;FWUvQ9A`Nntv#8zeZSt1TCHx7X7U zv(ER6VS}u!E3;S&erkyS_3ix?y7F|Si#qrdl$?lGR&v*rqnf7(?Uz`#^Rsw1gWH#G zIj5<_1On{%XjfHn?b~Y*@P900Ykp2OwMKLb z%0%T=OYm$6XOpu*mhkViJab##kVl22Z*JDT_V~lKALp?taEqnc3U28ALHQh|yq+D= zI3zzcJm&kY3OrXOkFD!6Z;L2roit!wE~8r8DC_4b3xYwfFQkOeMiDvT{?%w*cS%6v zJ$nn4{O*B;!s__!5|`b+hl>a}i{v70qSW%p3=cmiCUuNAI`b;(sy&!OI9=-B@8w5JH{SUF4749OGu{IM&0>J2x%8F9nEwYly~8dS-^-xqUE?o6*axuUZNwkH_u!B^SG^@@mXA6adyO5(iYFVbfeBHQ*$Bq#g8;owf_KG3ejW4g30! zExSupc!$VKnbnxp08};6;W2uBb^anI(fA|>%y>{}hw~?&tdDq+B>8}c zNpi4DLS1xaNZxr89hx9@N;a$xk=P;Y(b?2D(;E`+U1UQ7QFz|}x^75Z+blqyG5;HX zD=K0^_ys|?ZIGT)U~;5=OI&z*$dWLs_B-+p`8she3G=FmZ<+i(9XwZXz3&STs&5Q9 z7NO&LbfA?(AMekK_(b z&4V<&G0HVn)4QK#$*iz;=gAxQz=AodIfVJ6CiP`KZa}P2*E{CDpruZkj zibN^PQ{&~DX;>la{d;lI$~EtuA5UrM^c6rqSI%&nr(ha2bc~@o^Tz2kmwYQ`#^QBGtKtE^4d(c7 zx7GRnBU&$S|H1{-CZXSpC%Q=szG%FVd$jZS6xzn5aM7vOl?~i|FlZ&{H1q21`#L1c z`xSFK_);X85JC=`Sb?EywtU1|h(FAuk`VR0Gb; z^R5Eak15(vwHtu2^AB^JzA9Z*Cb?2!uV03n7G(PE2RF=3Ho95?e5fN+3zX?i(0$T%RH7(@$5!E`x1qirS^sFbpC&;HocI?m! zQw%*&jE9;*dZmYTPKP1Fd?W{-z(WDB_fz(r3zQo6p|U?Rgu%EZJ4^_N!hTj&g-3=PqJyqpC5;3 zdt;SPdcczrKj{~Pob#ef^v3ai4ru|&N5Bd5;1}(fflWHt*ZeZ5kD8pLoOBP{;F{gA z>^$>N^&z6z2PP`~d|INySu zW-;~a(0=~{i@qd8OY(J3!CHPYKud-lY(I)6KC~n&jxZFwPX(QsyP}`_u>u7{>aiwS zrj(loNUvg2$)OaLQ7MUDa%cI45BX$GSfkA!towcRKLEN*u zwwep^Dn>o`%!l}-4Ora>kUeN!B*Ms3(D27|`Bd@??O1;I*qc?7mWVAn&@c^fOIv@N zDx+XfRCicc<7v{3ZFs1fzBFa&F?TeDv2Hm+p9~&f(=KD>%VQu@tq=2+f8+^{P|13! z`9lCq_h`b)%(EZC;e9Trozo9!<>Za2?Zoi%>1aOpSZQK933I8K7cG;mMo%%eP0P#? zx_8@^)!yILw%)37R_FAtgLfJ(rEk2vxPZydDb#c-`p;WAFP*?2xNPCPqBt}@*5|a0 z`{j#d(U^e8*8(I$7aZ5|vm%=jfm0L>>I+F%e$<7DP*fD*z^LAhPWuj%74^g_4#n|e z3%RG+W|VLh`rC`wx*%{a%BoQZZu*7p{g@362Y(v6;`2^GHy(&%=@dq%Y?;>m6y5lW z4VyHJ;Kn=`xPjN+)Pz72fudrGUy;*jQx%Ikk^Ds%tLqL?p7oF~ZBci`3Ux3Ya*dR@ zx#<0U^qPFFqXU+nysq|4RfEZ-OTw5pC)!~G7dAJ2Cy@!-z{@}th3WZMkDub0gy*!J z{qu3t;FFK`B?;A@dVUjLVv^X8j%m;KvY#}$%>uhr4m@%I1TWQ2FuE+JR@Ho->0_qH zoE;gh{)V}(xk1(6m9(R2s?pqlmc1jcTKT3N%!b`$8gu$Fyi##t#Ky#8#6l^`h%JCQ z`PTJ;U!*P66&c?l_?$IY?OyD~a+&h|`#Fj8;&;UuRpyv@`y@xwj5S*zc->v#t0Gi# z72GL_+&aU-+O3Xh0Y4_VpS4n6fMkFRN{Wo-({VI~h2*TiWo=-@kG1wg;m^vA#~SDV zDUI7t#i@n0v+RgUO`u$>#;tBl=08e&25oTqZ;*0*`RRF?87DIvF}NZ)-ng}aphKw0 z%}k#nMXqMxh^||B5X-9AQW8V_;$JI?W~f$*-o@jN9+kXy8Hk%wKuW;qlpg<@vkkeyuBK#xTo4HU+r<0$3e z8N3i41(Ic*q-#srpfx#-?OEHD>?8>=ob!!6p@Z^wSp$7zeZNFLDmCLcUZjzd z*RRtCHy^(T9H<@LRpIv`qlSs1+8fyMu`Aa#aF;ayJk0o_U6#bUyL=nk$Q;}eLmOYc z4I3jgGA0#F_SnySsjNIVHakR2M{+z03RRweme@9xyGe>-Rzhs9>q0DSBF*+_-6<}I zwQa=_-YyvRN0=@~64yVA6>`EE;Ps~~HSm9t4y1yULoRX7@?%^>u=-fzdz?|uq#Ve|CrD~n{O3Z)4)-Cjl}?yE1k z;JLW|Eg=a%{K7^6?kAG^lTArmro%3N&vWZoR=SS4J*7iw)nsD600ODCvyFa@$MXL`a%)0)MoBxfmIdne^Y1>X+63CtP-hpKQyx) z*CH@I1Dn;2K>Xs7pEn(vI;$FmgFuKq_RBoo9u3jye;U%EHD z8<~thkR!FH=oR7DE^&~ztGD@f(U5YEg*A+o^&Uy;a#TyHE$wO8YVz6TOE~Us6s&E! z=dB)i3;fE3Cn~vQWzAoyf4vh5i-j1*AX5!Bm?VlaU{R;S;_}a9k|+|hqlwa1%S9#A zNzlq+>U5M1KMoa`nk@Q|2?d>ncQv5XgV&$P5rxOEEBg*3&h~K(SC86T#9%@n#!Zgt&nN*!A=#3f>P3Hr`V(qttfoS&^>5HlgWim^-fp2>3cqdv@dka|IIX?fW`z0!& zf*2?F5|z&BZeDAnKY-IX^-t(mQg|yFWljzb4nK})5AvOb%_y!`^Mj>a3a47o(ew&a z`4`}`#Emi83Q~3sOgo?%#ZIaiYHQ}Fo*qExc^9|FjuVh!ytYJCKg*y1rl*6)Ln6Y| zUsjCpDcQAcil73AUC^PnoI(GWoc-1$Pk$#@*9K!Uy};(Quw;PzB93u2&NgMY#~)Tf z9Hmh!?!;Jam}73QYi?R8t-F(j;F36$HoOocn1>J00*%>O+&ifi=~Li%h+s$47pIfP zz;fO}3ohzbir>%IZyGKH>5lh!ir9nL+7n@^e*ayfZ%ac=CJw-9 z;CPJctF&A(845uaSi<^rpA<$4ovdGjCIf8X0YIzI-iB*Tmr)^YKKn1YwU)hDQ~#(E z0eTlUNemcEdg^AVzoI}i)2GV)@}a!%4nKa!Dnz@jJaMi&U9URf(@dvB0>wZ|M$gvO z&;PB+vhiq94JLufm0&}8LKe1i9)E1$STsJFQB}-S`SYYlm&-*#gslj{LD{C46tl!7 zlhPA^nAok3RRF&X$U}z92_rog=XYr@7c(iKVj|TCXOCO*S8i&+|hIyKlPiU_4~O zHB22oN@s3VULje{HnLW9wH?AbaTrRv=#yYOq%}(KMVc>r1PtmnG<+r5@F=Bw*3KCy z^{PG$vEA8+*2bQ`29|thr2~iev!Ur~kBxYR8^LLW#gW$uB6zI*yMHyrN~nwJesrgp zY7>CP>iM>>26DZE-DHzdYoJt$ur6T6kLLo$WGAjj$NjA-YPf|Z9b{BJx|3(v^Qi8x z^h-_t3RLPmu1yT@Ha6w;%E!SuDWfZ=F3NBXK<|w-h-;S>$;r=rD;AS}c0J*K{8=(0 z=btPXmr0y$6E)js|Ho$R3-0Fb6o&;rPTQVr718QXIE7XkfHbC2>fTYZ-lL%M9#=l& zY8ETsR>*5*y#Czh(E%nhe8)Dt!cK4RcxFU`jklQ|kJcKa3a&|fDj*#=V^B)q3eZ8j ztzdDIg&{n0KgN7w#`2^raDb8$Rt zCsCf|a%|i{Jzq4~$H3m5?LcS;X5RVfyt(VPN>I~d^BPbDUa`J=pGBW|iqsm$rIw!j z5&2S2tU=QRSP{#|eb?)3WMDL?wX?UN0;N7Fe3;Y>v%bq`rd3K1vm(>0ItYcpya%F} z82e@L6FnaIZ5-HRFPh1I#%_*NZBM6D08k6FWF2H?y)|1R;i0e;Ud!`A`}`We*A*X3&eRy4t7#7UHyXr) zF%XHV?uF4VRXfnL;;){y#0h(pEO3;p!>7s-x z!~A>XW~l2NsH(+)dQ5gq?fR-xW_Do#q*AFVi(HYD!q9M%)Plug;7fWZUZ?qgy;p2X}AbiyFqWe?2geF$t;^xN$qlO%TSTbY3)i zPOVBL8%{<>L)_P2MD1DsX(P=8d*APDOHQ+FI+B2|H?Lm2gZhxv){9y$nF_QW(T|Bc zVUP;Qt^hF+=zFh8R>X*79q$RZG&+lO#In|{P$5P5&FS0og(HB4QrkObT-08YiGDw* z`N_Zp4$;n}j&`v*=%>%ij96c(HK3>%`!Hi}#>k`Q{)z4FVV7=rpd?%wPDo6WxBG)b z1nBFedQD51(}Bt8EEzB4S}UuFh0!Ex|FGRdWuyer1O!QC92);p?~7w@U9OQ+f)6O- zt4Q_qL>C6ve`6s<1^qBs3ysS%NfLi?a!} zZ0uOib`PQ3AIDh(Z~dl_EULXhRNMRTBhW3*^P;xqwghJk$)wp~3(?WUX{B2M%S%EX z^U`V51fOJ_VT&@zOT8!mqeo_X&Hj|qfsc$Ml*J55ndG86Zqj|Z(|~*3#$A9ZKvDeP z>~f4qMYG|vQ{a-QXN;W{*f+Hn@exp61^sm-1oV$%hj zz!-0b?NzwvbvZYM)zfoVoiXcTVtZSQULst+Dlpb;{Q%4n^iYwP!eGhb$Ag%geEZlR z9ju2}mIo`3<$U@)yu43+xi2HRFKz#iv75R)=_+~?!ng?`DTlt*ZP}O?jg883lX$EE z3`vK>Wa6gsDu=_`Fq)JYdX|fv_xvbGyAw|(iUN9WO5SuY5m(z$L`Al^z;u8E*8H=WwS;Wpsy-60n+vf*;@mQ#hnjl`6m}H>S z&uqVew``+Ig|2H9s;U+yp#PClM!afPgr*BZj3Y@5M~Dj9HE?YhVM z?-bL@+f@W}?!qUWqh0Kc^70H=Z=2Af^0e+XA}avoFp6%~74>4otf5%DM6wdr+9Po) z<2-gLHalD+FA*#(Izz9fC91_qRz&pk~>{H z@2?~T99S{m)=jDV&37liU)T|iY}FaHkq<=nMo2gYoblEk|3WtUA4#+IpUV`U7wl$# z)p*D9I);G$Q&GW<7?{dE!1^+6QV$-0Z6z2)xC?>IEhvS__H0h&h7&?RuH*FGLIj_L zQr*^@h(msisWZ6Nj z?H9mT81Pt-{)%}vsP;+@K9BH9!ifAaB_M|L|C@{SJn=nD&CLJoVw*0RzD@&(#bXH9 zhMK3ww$6}F*}T+0i126k=q*lEfaMrNSwK%zKq0xnx!kU0Ab#$x^8r_dtCT@Jtg^V+ zZm^nBbTIhWYG2?JM^Iz?5g8K^;QmTmC2}9 zSgN;h0xrUUT4As9>=t7s?e!Y1*LXWwVo6#>w*=zlExtA&+3MtNz5ChYeRcCmH{j&| z#rwRB*1U|izxN70zzZ6tW^Pia{T?k`tk7#4xKxT`RIrbodGhESZL}w0F1G=-8Q68I zL_6}{SyyyNg8I}IVbJ>}jtFH^>N!U;-fb0wv8z%9SU zl7I6~T-G2Ja7`X!vz}BL(ew{9#ur_yE;q`2`tN6J7`Y5xj$?;C^RT2To<*|LN5i_i zo|UFIM4-Ui*f^Rf;B!FS(7%JHg9!-Dija07 zE7Mr^h@No;n$oK8%}WI=(!d6HGJgd-Kr(FAPQOAIP;P~>={d$*hDe%VVwrb;7JAA0W9!p z7f!eMWEjIlrM&%ej`L~le2poT-YO^0>Jazi1GUjfr3CxqY7Du)(H*2)YL_&H9-eRS zWv6)(vl{Cl<6w1^Ih5Y?A6Zr;VV`r(`nrS$g)(%LUw3sf&5u9gPT0?LcjDr4C1W_z zm@yI)!Ab&-yW#mEN5(O+x9+%#YGub}`<()P|Bv;(^m_O${Z*iu)yt zll3{twP|v1%#8o@vm5&{vM+zhj?3>Q)+oqV^Z_IjTCoOrnui+_MA^OOBmODnBzQEd zSD!!94UY8b`J&7~tG_uM5H1ETXrAR5kK%?PuqrgoDNT*>OyYSTkb?Fr=`Md^A5rGjEI?!{2J;uyz`tgVzCS z;Uy)y^RlRq`w6$aO5UjSB|bom@znjkpV`oC)W&1=4{|4)>!9>#w{_Sf9?7wooFkg>b(m zqVs>tNq;Q#-w%+B`3lWUySNHsVpUJ^`C0iK07kQ%wqX4{NbreHN7nGYZAPq1nUe`{ z!O2zK=3DGKDU7a!qK7a#w@wBbJ^buchT-BLdH2iKnFO0#r>ew#Xlx6Um zM0Fg}Jx5E<8S*mC;_b}Ujnss-R|wY16-k({BxS;)O)2_=bZN$_&>3XKhtnrwUA|)F z5ikqg(z0J0m;CGPf&Z7pDkL?N*gp;E`RGPq$5XX3BJ53!T40^b?K8&Z9i3Sf2<)m1 z{5dQNeY5nxWRLvM5tPdMsM-i|4S}ijek*D{7MGQit-zzn;|@qWsAWkr+0Z`I*~u~h z!Vwy~cVg(&jaTwIB8w&%6m??=h7WZ_q~K7;9KU@Ip?&9~h&qBh11^h0G+KF!gkQdP zm(lA>W@U%c1PLpP6wM5#Mor9C2-B zHL@+Ibe6dDFhR+!WzNczVqf~Vlx8kTP05NzmE?$`z~r0kelV(H z;%iCO7bo_Hl~90sSn`EoV9i*zcQW?-Qw%mew3}5U3MbLl{*A%ygyregB)`ph`EBz( z?}6*RXYq=9g~sc628T!0)dC)vNM+#?PyT!AzGtS^G~G z-mX{t3pFQilc&;L2+K0(oQXLsF^yk1TPPpR@^kQvtH^7~^b~CFA1{Q(FH)ao;AxaX zoYP)JTT)m{2<87U+BsejmgXQl@S^{AIf^pY63=#JlG-Rav{tEB9d}%rnaqD@fRl|= zRXW4NxeFtc#s0Ta6Urr+R(0UX<*-J&7->JEZK6q>++Y%L?~3emP0q&B5nHLRv2=qsHV&NuK~#(UxsmDovwJr zVQqk~uj{U{2LBhCYg}q7LlsCvYFejNfiII(5d&lzaBA!K_CuMaGl3_A~OL;s(ldI=- zYqaKyQ>Tf4jHDq$BP&03!n4fU@xkG`z{?;R2{hpTMYjZjsR;4DFqsA}0{3vg6k&FbkSuu60M(NDRnF$EwliSl1uaQo=C#KBe zwPJNu$Ynk6MhxHO)&}!6OBWm@U8z5=P_1Fl%w!L{$i%*Kp4Aqki0M-V3#&AAWJkP-rK==1UWUXH3)q z*Y7yYJAYbX7!nqTt;tji#lIA!%A=qRo@zfF>nM)wf;SOLb-(Iaj5{g?MgnHy4vgZ| z@Pki5x2eBgs9iqw5j=mKrOSaSIm@8rK}l)#uuE)4T#)G~TB0{bMEAdTqR3brvE^Ql z{lO=FDB`?Zc1(t%e2^w5*_C7?qdvnf{YP{(5ek@r%d4YmOkIfxXqbF_AbTHre<0C4 z)IkA00b--T*N6Cb&qpBT{E@P5%GfCInlrAp=Y6mClS2ntjo+E=1RG=$&g|!{r)h8UWDL?X-(s1!=q4LW?AgJ%hw~j zw^5>;sBQIexL*7iITZ0Z0|;Sl`?-l_@3MS?SsHxI-5M)c`wlAK>Pesu7J(k1*aaPD zvqyO*2kJ{El#D3YYYgh!)SLr~7;<=8M^zGC+8R|*F*4Jz=#5EEavU!6f(WERVbrbC z2Ox@~vMPJ#sBuft+R9z;?uyyhXYLc{7C7<8|DEG>2dl%#Z3Fcr)~y@+Q6+Rgakjq+ zLF`|?nx;mhIgR4swxNr(bH&`a8hq6bO|lr{hY-1|hsae_5kCw>e+I$Z--@ZaVgJpl zIjKIwi$&^<9M*!b!v${g?_$ga(l4{6D0BQ;ysr1R_CR)!!!iqI)9yCL?~xypo23u!c>+MACAi|`Xc3pK_VhDY@nLlaN{hCei5Xzd z?imj|zb&LQKB}Ur;S+Wmtm(zffmRA^>TG;XBd&s`fo>L39lLOQ;q z1pkOFt($||xvIH?E%)D6zq@ZZpYiVBzE0-rwfV)Pzcb%0*K~8WH{B<&dd`FI>Jr*k z)#JmtKetH4O}H7rX)b%bvfcc9AM%T}1Pk#3UL)d2r)siUt_w;v&;fhwA@wZdOXAh_|GsB>lc;HWOvd7yNGn-4D2&i0}WU)*!E9L>=Qtnxayuwn0__Fy&P(P zHuriAHB#W1HVE@Pk?nI7Anm*=`>tp=^_th&zM=URzZA~O);uNPe80;v5q3E6F8uT| zoBMXN!)k>(bo3na`p|90Fh$fIKzys^J$O1(LS;vQYcrNb1Ap^=5ff6(d5q6}AHbrS zVPySc$2*C!BP*RFj9-#2#n-+ahmw*lIhQS-hZag|_}gEy2+M#1d6Awt;|CTGF)g1$ zd8Qf>MukkCf__v-cHv5I$Z_5%^&l9AS;?=xQQu4NjPe17VJ{a?b^4Xt=R%1F3wWd*4rVk6*9b~a~iP1h^U$_X2*v~p9BAjSF zZ)ge>rZq|5o@-z)6IeEEd8by?|B%Bz&9JScAB;vL5{%7+P9msUr+pFX9fbDB_=SKJ_CA!4wO5{MWor@cpKEQ2sPr9?WJi zyVjY_HtaJqcL5)iOA!mfLG*-ob>v3fwDqkc~k~S?|dtuj-iVi$}$}t z`+ag?a3$DyWR7@X+5Uhsk2l@OcF>a95ujHga((mO@0hW0!X1-pe;m@l;~m2cev}8A zKf>Yt8($wWayz$1bw$K(ddu6)aaPj&`oQVyECn(-TDhU%#te9x5IzO>&%?>9D?S+L-sRxAzWNAu({`mXw;tp{M;)a-2R@-3ns`^+K3Amq%!<9au>?oV z(1@i>?tx@jM96}cAFfMQn^=`{Sf%SQ2JZ}*K-MUOb!cQCXjry$)GS85A)LY)EOu9S z5kl4hODvT-X5}!cLPf*;YBlJTHoUFKF0d{`s^ZYuY<9DM<10DFBbkYe7ChR95JmG* z9sgeT3MC2maiT0)@m-n{$BLo6NNK!10?#8(4Of)?6+>g^PGxpWCF40UiW1GR3^pVD z@BAQ)0`GJb9^<&Of4F$H(^BTS_Wi#F7nsaS0(7VNk7Bcz4)8|#6N~hp(Mrp#aN?_! zMu=biEWdO(p*J8>==ilqPjkcHZtEFdXNwG{v}5r{Hn0-R#e{bWwhr7FB=@fH~|y>2wCZ~dGe6VK#Ar^#WKeTScp#=CeV1eC~g zT4ZCqaR%;;MBx`cGyV0zmVu8eFm??2#U@-r86k9BOyQD~uH5E~LxIt)c%`K@Wrxmk zW*hUnwl!mAh5H|yg3m#G_`79JGn9R1&#i3+7cVTCYkzMCX;Fr}6REde@@c&pv3l(j z9Y~SpvEz+WRE+pa4Lu^!U7Kd%N{4`6?m!bP?r7|$(@ZMAq4R-FO+{1aS??3+*r#Bj zqfcc(HVskqkhBb80=0u!<+hrm%6F2OMFl0EoJEidKTSIfwF&?FEW27AyU0(Y)fblE z&dyYdCFS9=$-==ybndVpf$}W}jq&M~*OLa((u3Sg=;knXZKEd!?$h9c-nj@L+@Scw z!7@Jo^pWjo|5}NE_P?P=SC^@W-r~8QjFDai>2tYFh@VV zP_DXM{P0d)dX%CU10p&&;O>%oH+=dzV->@`Pp<1O+!A+2$Q%EVeV%UO3DIMw6e1jJ z$5@xYzf~C4-wycG?Xbs#B%7buOyFW4tL1(54ZgaTMqY;`x5^u;@rc`H%4Ff*j4kdW zLSQcaHHjVI4iFh7YYqi1cVdJ)k!3A2uO4CUU+ARW@F zkub6q51H6$-oD#{s?e$~L?%fG&hF#pud(6g!zzjyZR9P=y2d*#2(5BwD-DUR1bz2k z&hA7blb2SO)K`d1?TpbPtZeXDscYTGcV9ZP`>8aujK88F-!0>&QW2{ZA!-(E60Vjc z(MJEKRGSJTACyYd6Pd=kC6zb8{}se;6Ug`W0B!=6iu8YAyDy=c$Hyu;a4T7P`mT&u z5H6zTZ4_|}iv@P3q>*(reKsXbx}FVR82HDBLV!QsF*4u!bS?JRvV=G=$d9Wt|Dpyo z+h~X6lKC-|&YPYzOIAYv6nVo4Jkpx_!>Z#Pua6_#ip3?DX;pzP)|mb4DWgAb`txPA z{)HrEO+&!q>yy8>2>Wm=4yhY=(7$P_zgpa8xu&K^Z9enuew4MQ0U*aT=Q1W_x|1up ztpJN=U{^gKRX*jbrB?^oRFt8I}?Eop($iS4iUx$4xkHW;L*C9e-5s$z6J^Mej| zf*J4_6-xe?*R-F}kNXDeq-0X@+ogEgIp^Jx#tybkbw%zzQz=YD7rKm8VBzPiS&TZW zWV$A9;8&459p*&}!9x^DD#RnFgs6|Pxg-ciAoc_>zcx;4c?ux2zqE@-Zu^|{jfyL*m$eFV-nfjulrBK zeWrA(B(}RXfk~x31F6F&cciH#>SKi`#5b3@~h!SYIsmkA9Y- zHC+`L61#blTx$Up5=IF$#9jqTA)D^hi6y?{LbkYxU+*vluQ2yQNM7>RyZsCxcHZtc z%<-J->Go4Q`Z@FbR{)h_ictt7!qen`G4&RHO}Fp+uplTQFiMn?9GwyyB`H0+JCyDo zf=Ul0M+sv{htl0G4bmw&x*J5~+5P$5x8LV4;5FXYbzbLroJS;>8-SxC*O=SpivLt* zia;)D2tWRk-oqlUzP22c>4$YDlq^7k>nUkjru_>u?Qn78&`qb5PdnXduBNzY`jn;{ ziVnt)lH_R+HyqCG%Mge*ahm0OUC(t9yO|X;af6Y6VPsQ5;T9>&hJ2ErPhIf(WJIW% zx?tsv{feayMk=~NF=UuE{z){;N~4@g3x?3LfHkH$2FurHs2m&5G$*@Ec82`VsaY1L z-+!Z$nv}BS&)`USV$qcJh{o~7O^=Cl=SzaR#t2Jle2s0X*V1GO09l6Q({xFJ1Rq?l z`6TN@QlY6qh0%UXdDm#=2DN|iycm0dt5w*7edqaId2Fwu^z($;nA-u-`pMBdKX1Xs zs}_mXAAe#FLU^y-uSg6!$_rln+MBN>%3XorL^VCBuLUzpe8-Y?E2{1gTKT+s&m5`u z;5(VDZDz`gIy|@LBX={cC+KMxVwt#K_rUKIn)9?Y{GiyAlqX2}PixDzJfLK#`B+{t zR&iNTM~!_-awAMk?z=l8h||yE#R%b)3&RC)(x!&DB^AloCzQb1kk}YpXSddocJS&Hd31d5~L=*+iiV#gW$i`vN6Zp*5P#N_lSV(ZE`Ks|xwPCC8) z&s+PYzh95q;6sDm^?LGUqRd|#oEE0dYzg+N`*Iw2;3??JqljRDUX&Mo#LA(SB{LXFstp?#z%2-`^hl;a%6u$qVlSX|J?xqF>CLgNg|OFFv1{_Q^=IYG71Rlr}tB z^H}G%&S&xUh!~aI^kKk22X6O1wD8J>`O+KvxqXMM%}qBjK8PhmP zAr~FW>%u0}F=urd7;rKh!WcOyl;|N{W83t?xVN7VQAV4RTW3=<&1i?`GPmHJK>sZR z6aqmYBr}c%gW*8(g|)YHeHx2zLaH`8o>zZ#6=&+d(O~H9e~$>8g)xm2zwiGNB!<>^ zIi!%BM6g|8wJ5_}7K^su|EB-kG%3{hgx5JYAxxN!vW8!iyfVClZe1#j$>~tW{+iRu zIz4`Ji_8)KV1c~)IZ=Xk70PZd?@~isDvD(F-S>7eStmy$BgSpGDs3gw_Avd5c}3?l ze!3BKZwa1j`o;}6;I`HzQ?e~$_Th-vXWk-TGb=uW=smC%=4Zp7vwE9icz&GZi$CT2-omd6-a9+~dNHdT>yYxp63MKQErD)&>Hr7Faq9xUfpEW! zYJx22Y*mr~{k!}h;&Y`1Ns^ykWtr80h)plVd{J?R6YTe)R~obKi9vB^-Jx3osjOLD z05i!)r!BUZ6fs|^Sss8b4e*w6reSfi6^*U2VusF@r3lhOxqYWupU~Vi%20?1%PU%0 z1{I|^up@DfES8dmzY3q;L(Gi~+YFWz#?XZw^% zTOoCd7)3w~MVuL?=4_w$opgP-U2+LGc$EaE@ zuC&zU>Yda8)gsyeiJnrwmrdrSeO%vP9UN7hBXH%X({3a? zWFA(X?Ri)|dOw4z14U|dF*FacwLW+$7qh6T zMyEVmjO!nRM; zl{G*yH2C92=`b)wzPXU(@OnQBx^Ck0vuA6T=I`aB8O;?sMfZ^G7Q%Hjoe;_Z& z8pqtcuWuVyLqLUL?((Qa)zI4DjG0IXHc?pM z6qydLht%PAqPJxYwv6e~+~89jus-U;SgTY_GuXLVMN{k7;VmoYtz)9nb^Y+Vr$XTp zfbboCU6Blvj8nS$13f=TEloCH(ycheZo@r9xtC^RbK=Ux%c`G_u-N$9THT3A{Y}Vz zR<7PiH~l9u;)$ZmnYt2f4WPw{@n=td6znp~>P6H_qmlNEQ!y}aan1`th;3nBk=>G5 z=!-u@)bvF331E6O6nT-!r^)9_en}=XoLJ43_29YK9o1qg5qWebSSI)Y=Qf@g;*Sg0 zQUGi#k~%Hb#qE`@%=@)(zdLs^vx&N7>s53~wzD#W+ou4kXsJ1#?&T8gJdP<7lKf!# zhhV|&(0AE$G&Ik$F@2s`X89RKF}~bw;(L<1ov~Q815(AZCky&fk^aiJg00mm?+3r; z-qpV?S+D2o#gRz~u!^plz0|)7caTJVaPl&15Q=W`jo$4=hXwj@p5Kk0kj3-~Qak(} zm12?%C^=bzCj^x8ZDJ^{Ap$2om=h9BIwa1cn=|e_9`2JU^|{UJjq;h;G-sx33*SmN z^!9n7Ul1R$K2rNtd(Irjc8_js242INfhnKx4|5|^n=~-~l?HnMWpRjH7L+9HN5g)s z1J-pTZUyXEjD@3>>J;&syiE?PbbfV@V2s@AxP8GdXsdsO1?(Q5#oZHOa{`D+ps^`- z&?^<{EeeUji5~lG#E`5Oz(OgeQl_T;@*@t5<{rNcC{aLHRF7t<_9UH8H@iCFoc>T6 zi?Z1%CrWnK#=6f<@R#3fig3D7yJKGQg;GMgdH2pgPq-7dw_TWqi*B?({}R;W;Olus z5oVt0KwEnCO?GG)#_n_5Tr@?ckJjslfA|O{!hU2a(3i5*{JKlwmJ1`86AH0j93gki zz=t*2ORDoGGw>02kk($jT%b*ukj|9P;k%S!a(VWFFBZ5|M_X-GTDT>29`Y2s=8r$l zVm?EA+=Z>eW%dK*2(Zn3nQ)NLTxo7h#-coQ6kX-OuQ!NvjRMY8R}XG~1#k#GP_DY%+Zk zta6loV#pt?Iml)lbqXogpA67~^dmyXT1K)2;2k&h&(j z5nw@^vz7%dw-tkIsQ7h>(2kNmBy=HlR!Kmm?$UKJ<~J9PJ+^xIu!eBn=1qht)+2lu z0pU=K{vU=)ZDNTX zo~JJEc4{rMenC#lz!>tD#Y7`X;g(4+xICKE|=cgp@$iyw} zpe||l?;uiFl5$9p4Xb9;-QtQNCiApAX5p^g=ft#$39SV}D%w+Rr`!C(@aQ9*-<}O90GhmNXP}GhJn(7p_d2Expi*xC47@Yz zgn>2g-rX{n88ohRFwPUcIMZ<7WK!lp(OvQ7a+#3mduxDSpIhAqot*lR{>q!sX33Me zior9U>8v0!*!8|Y0>>}tsCr8m?L;f_XW{*=3(-BA@<;T_02j}KqktCo!m~z;%cX6; zC}g{YSm-O^hl07sWttf(IG9FtmIqk@IfLFyOSZucIR-FPzs{>q5(7apmLW-eQvfZb&SdILaj)V-0?gkxpH$CI7892c-qnLJ35x}c10>@a1q^hO$$((VfJO7#jzOMc;qVx(p5p)KhRDLD5J6Slwc(`YlAea= z0*V|M5+~@i3kyU%&5>59A)b2X8EWr)9Msb*3z~)0u*zgm-9nbKJ=aRmHGce(zzYE# z7XUNA-&PPIA1C8@!tq*Di3Wodvq$y9(!i>u5!Ru=8pH$+oaR@z7K z1~C&27aSK0DytUs3fB;<`|xS9|)o4X8+>>lLA>XSRl@cP$Gn?z$!L;%n@Ru)`@qsgR_l>F03 zF#Asjp0v0+chN$+&9?;L!pH`?H2%vF&&g{2W+PNzTs4=MIE;~|cf9ugxG{fN=ylAZ zIE3Np*IfnMJSg?smreDC8n7369oIHS@&qi?7jmvY*C*XGW|x!+YAzLH#5Ny>ySDS? z-akQ-OwPpBI0VOj$)<=E*Ms!$)tDa34qNc7O){%SGuviXadwhf-eli8s+&$wH+vWs zbcZswvRHssk&R*WH0~Qm`v8TGUmmH)NPTmqcB@KT_XWUGpfWScrgE z<%~tG##sF1m5B)py{MX1ju9)bK+=&1#JGhaXC_5@Qx+r!Tu$GJmfC}{39d{>jxiA} zF#vL#TGE*>+7hnJVd;(wzFYyBWPhJK1j{2SGd z8}q&L5^{;HXVUbG6>3E=Vyjc3ETk$|f&IN1AaI+z$_-N?K0*Wa;_wY+@TBiKkZVK4 zF4LkOEl&x~v_0Q2g*VSYVkxF6jgnzMQ2zZ1@+5Mc)}N)w!f@DWy{S`PWg;Ge<#4p< zR8Q*nl+r$((BaWPQpGUd1yww;kTy_T0`joFEmeKQZvNni!Rdbi-!_EV13%wrKPuY= zp-&ny;4H9QG4t}>?=k$9?@rUG{U$987OARH6Q)kGe7>uPews7|ie!cb-)zp7XqP8# z9c>PxW?(j!lj5#6%I`B|)W`R_E=JhrkXz>-~ws8xz6c`1!YWFUVd`Q?y1mKo~T$ za7z7<>MiD_2gWoxQpkLgc_y$sPo&`7AJMim(Z?x_E;MVJs9Kd&+7Nl{hJS`!smOOE z#s3iHW~Y_EBI8c*bOt57^zlDqG+7k5q7=xguJc9EK?GB zEJAE%cy+V-kJ$dzozMN@vg-d83)@1W^RD;zNB4JX(-c=^?Q*L(Z)=oioU1aWQ~R8x zV~nlYP(meTW^I9yOyGqkGQUB82JKisX0>5Pax8|B+JI}$rp07pPdF$fa>ZK^@w)Dw zrI+=M=Dzon3yX!DM)ek4+}(PmOm3#}K1ZvV33_)FX_*q($4QQ1ytc%eO(|i)I2Sf* zf-Vjto@q?DbB|)-YTkj;7Yud@_ThL=tK5kK4a&@~#|1D{DAm!NmbC;_Z3a+ zfqB;xu~-V`6X)Y=m7UdKoq>4tLi>MJJ%+#zP_Du?_Qyf`@EDZzvNQK$)5~%d#)3>e z#=HVWd-U?yWCO-7V>K+3`6m<;h)RQ;)&L|C$CMDb_nLqPmZ4jW{n&-zhX6>B%a`gjY_HEScou`$1eTh@{A_3#(5Ou9+)HO@EaR*~K6%DGmA&XqE%ns+Ayi;J~p959LR z2onhsdU3U>mSVbI%<#lzUnbnSe0WjF{mmnC8px&a43mEncecjKK&?~@XLN$%4JmpY zf)^Bd9+qwU@u>r5WGUdSR0)_ zT85+fWhS4jM3ZN{D&Me~$R&!r;i zM7Yr_55D+itijhBJP|6Xzd@1Ez!HV{GWLFvqF_9swqk2s444khHx7y<-!u7Fzs7u8 z(18#EdjIzVV|CL9qQy=pS_K6K_cR(2>B24&!-Mba`E^8-01|Net&KM21mSp`*ivb_ zAY+z_C;jn8eWn>4F80#i#``7LmBTF$4zaUvB)j!J13ed>*+{Opi>obvhH`ik(M2&L3VikzLr4Oo5%GBX2QGRNk6Yb)!6Wb3U2R6R)E zQZZu#ZdId;u>E_jIL*Cv$E{JX*%)VYQR{l?N#kHSHlT0JfZr~z-|wL?r8G)69Cy^y z3_%a21&Uh{K)(K~8hY7KlOHmv2EyN6#fgD9X?Uxz%Shv9*cv~fudwWZNB#agya_D> zW)^)aMbg%-)wDHi3Ov8gpHEveS>FSepI!Crk;TI5VBnK@dQ*2# zo(XFs=?g%ZYpj;m$d3v(6t-PLF>QOW_RmkrOpooxYf|XKKJtcezzgxtR|0}i z-PJxe#I>$PM9w6y%jW7kR@Pe09o&V*5D7e1NLkR%4yud!DpsKHUyF77>YdNhEZwJy zkboZg?{Q*NokzQkIxN&#RKg+_lU|%u^#4m4t!jyou=?bu-gUoUs=a9HJLv8E2{$GmG{8B zEj7FgzwUm{h?ESOv65Dem9FYhgwNIR_;%o{JR9EXQ9k>mf&V~55dBk6XH>vmMvn0^rDCEz(JgIi~M$Viaj%FrrP?`U@xvG(Qn zGw#K2#XhbvTEffTi`$V@-6Sp72i7uuaA{OfdMTf63a2A23&5panri-v*UEaJ4NYiQ zZM~XRHQL;iM)X-_hiTDB0$+~U#Iw4mnjd+cbWbU9wy}}5Z!`&`-`f{=MMG}?1?y0g zqCj`S?~jQjG$`(mH;2;;P~fQzuNq}12$B@rmBYdiUMU@;WfB`P&*srhZ)`GpiUh#u zF!67nb;>0^?S=)&*kvjzLFVG>v=1&fwQ)v>ZcUef^JMPnl<#paOyy4^VkC$2NCbPo zs|0G1Htl6d>*+oa#*s8nw;k9x{h}Bj(eVtWZ1Ml(E3MA|p7SbLNxuZBnLn}ofA-jAm7(}(yo#&Up z{Qrii?$-7>ZCp6l8ABV0jb2vGOTOPt)0#p<+l!<^UuT>tA;&O3NBRQg<{te4DIg~x zv0}<%6iy8mYEm0c?xklCeZg06dmqkFAEw{gH+BBKozK%becg+FLrh6cFiqMPnY~$k z5AnWT%7W%4>PHI?B#a^x)x~W>xO$6J=CVyv#ngt#Ckm}x$i?1U z%@K)S$j6i`+I$t_RM26=9xp=XMuOl)|v+m`5qr%EG39Yo!bm5`@cpBZU}F>BjW0l&;1 zBK``X@WHMGB#h7V)fasf_)NyQ4=%P{NkCPRto7C5tpU6p_2|JCdW2Y|~oT;H^VNsi| z@Z@)va8IwtD4+F}tT67;74f6I%YV87l1gJRpF$V+LE0DSs9o<8);+)dEmpAmM{Ci} zi*6J%VHT?ST;#tvHD~PNpWwn&CtTXk+ise~#*T)#ZS+zxS`W(LUyai5cEONZP91T- zbXRF#ffUHg0gDfJdqpp0ILXP(Gj%Nc6phGT^8$?42(^F^G6Od}(pwqaKF0Ogb%IHQ_wIPVby8NhamJ)&$rGlpzm& z%vn809i5oQ+}{0o>Ud*65nFjQM<}nz4B_i7!tDd=)zkd~_NwTO+9f~e(4f=LLXMjf z#W3R*z7800xB4ND1?0pr>+GCpyt%WWWxhQeLsoL!uZp1?D$laX+X;FF$H}JU(wpYi zsLM#$NW+iM(>kyj_GcMXlXyQDC@ukMF2HX~ju8 z;`zNhW~!Yw=vcR2@S``5n7~^@c_AKMfwGEi_+h2R1q}5<=d8J|7-ChzfqQddM=*&6x^fnBA(b*P8YZz(vmV}(@|}H;Gf`~#@>D$ zxth^P14V0g5^ z0B$tlqH4y@1?>K#KhDS~f|=|grw!#^?Y{aS+j@8^frn<(pzYyv051K@bMcRF`)NEj^(M8~;rqwnC^Jb)&Io8%x!CO^uX zR0>v!qEOJ%CRDAJ;ywW%j>0EnKTZE?9f8Irt7) ziRKBcFxo}NQG=IQ+F&i#mJU`5PvN~qzJ;c^xi)Jts8}Ki<1awC0(Fsp`gD?51_Ft! zycdD}1w>Qn*ozasXkjr#E|ip(%R^e{TH;uwuMi0H`?Y}13SM3Rr1L~zBH%QgGN?T5 zU>#-WdJv?Uzl5asMNryFn-KN(qWuX~1gXYz)x`n34apMhs$=#Y1{19u+)u`I5pGFd zTaJ-VlkQ@#+nj^Y0QQ2E)uOrWaV?;o50H=hQFDwdo`t+4TT7gF{L*K}RJ36i+~6M0 zw(C_4J$XdMMEKD#VsC<|R4+C=g8a$E19qELXo4$s4mCJ9uKz4Ob-!ug7xCBGCSCM` z<^Rd`D~QDAcXFW!O1=m|w2%Q36L%Vh747Fj)D_*q7`YB?wZ?Y z(xh+7jH*+kWK?P?{4}W;|zwNf~OX&d&z^37L=wo|H{-CF%`Vi6N#|~1`GryWwE3hRG4vO>oXjvh?zI+$GgyX zC3s$-$K~;q>v&P0n>2OjMlaO~ojA~WcIG7-sH|-%SbdVgDhqQWL=|Ny%ejghyKMVC zmW`yWx~rHE2Y~cO4(=)mZlN-X0@Gq@Xdp+wYZ`}70@Y`gN-L>R<_R-eq9<$5z)=89 zY_CGUEBULD3V&(B&GS56kH=Q#uTYs1V5oA&b>}9u;LAii-Q*rbIl!fWYN;Gasg^Lj z7(XQGL*f3vM{4`nI1lDT^bxPeg=-kgOWggq>uneM2`BK2L=7Y}6G~Ypi&70OkE70nu%Zo0G3!@ubRLixyZ!t4m+^#{k15T@*2CNZ_iyaixFUu)|G zCm|l=-g5(Ue~Lt|&QQ6d@okhMQ*lNAvzfvGMCj{`tB$i^RZSr!vEmLsmN!jz)w#x1#f9qi?W(I&g#x?3B$|;P`zSkxv`Gxm-Q+iGh5> z(#mifiR#Co_zH;#{e}=@YwMq$fT_g8l%8SsEs*t-_PAKZkgmLC{}@emQ1RK`#<7e* zOmEs@;o6*1?6dQRAmSJ#_!jG{%?D|uE8LycbMOBkXlq~R7Duf~^KBgLc~+Nxueyf(cpP)q>I_#Y4=J3} zHa|+v+3*C3_D!I=?Mi8!AlXzjJE1L)#2_S|t{4%o^P6KPV9KD%L&Mq4?v1{iPll`N ziWBKC0l3+6v;?4zs_GLgPxX8mXp zY=OJ(GVWTn?oS}khp3sI$)vow5gdKi4^%CxRu|55TXByV9SxDWyC3M}o%h%+>>1qN z0GmsdF(_NkV80yBx@j5X}|Qvw(O%%=leCUPBI<4%;|-yAvr{ngI?}B;$n~i z7s`}h9Dlu0*i&n-q2ejMjBi>t2~LgglJ+N+QXONMz_$RuP+qLPAW(OReq1kVjmQI4 zI8>7}G<&bqA764LnC_S%OCLuc+nWTE1?$aFWe5ystnZs=RI#9ALVJ!?XGOKuu(MHz z?)jAX8f<7X34X?Y+2|4mT;{6>;Eg(x)U?1ozjn-${*GaI;U60o;<^_oTsiTg-HRL5 z?Lmizuijz|@}*V`@_#0^)Ko1+@-(vpjzRHzsD3Y{#;5^ikw5hgQYHU>5!p3$U(=Sk z%SmTEvl@!KDQ6S^(m*(UxWKAY!f+%F1gZ7zh9{OZ3km`NLVui}rnEIXZCzgdSXd!_$ObVCn_fXnyL~tk4-Oi_1644o0H#ebXpFTOH7Gc+rhfligdZhoFmEL=_^N>}Xab4ImC|Rt+fCipX=MYh!!bAtw<}bp$={F{mbQ zBiN!OTj-axR7a1e%aupZZTsSLRHQQ%o@F;BKV8%N4=gtQQ-shvipQHVsLgJoe)~rbBZeJ4 z`e?n|7Var5q_>cuspuamrFW zAEfmGHPXq#0iR~%RiY$+IUK`j7!ANfgc+fCAMc(_!SL=b$_{wp!s+h};z-*s^iz*JjW<6>`J) zNNia7bZ@{<-}GTZuxXbadbpf^E`|J|ZUWVHn`Q1-R^LhOHh>~0wj-h5Dhi}$zFix3 zmgcVLr_N&()Pi!G77d$$@kREsp`E!RhwD{dYV-ViecU`jcH@KZ&P4doZRjPNAB2|q z&4yQVH-sn7+#SU}n8PnFYmNA3t#H1BGq_ykzZ#egWMJ%yI}9i*Q_ks z^&>VWjgzFteADs|Mgo9{LB7dLjV4~~wi{1j*hfOW?i9tRsb1afpmU1@u6|yP{Ot>< zabqQZZFjvod->`NHZd{510wcqgg7*#P3G3+Uh&-R4c=?HXY8I9738|&oLw8Y1-6Kx z^R-D7Cd9&q=@Vaf{2U{{n7?v%sdL(JJM}9oo{3V@kAa8pB>idn{3dvhv-^ljxbX72 zu_0MZiCgzO!QKEj2yH0X?Yo40S{pt%biQ)uv13WhOv2aTo0{jJ&FvXEYa5>ocJ1kxg#1()+0WDga-P~}-|CBzbAz+Z&U=Q=q&3RozwG(!*%N?% z2uV8CN1;1lJI(4@CNV-PvuuDk)6*Hoh~bMMKy+ds6?qF}lNl`YS!=v$TwPpm9L;MD z>sxE)tEDEp1S*<0s#}sNQy6Zs)7Ek=0re)!*XknQpO5B<&{m=@()W$I3CBjZrlOp7 z4ftqT2$@0iJLpG<3o%X&qW-j}+kD^zYJ`Y27`= z&^!%~PJkwcfCgypp8nU6WFgWQD<+kWgzwxQT6#_6kv4xLooIaftbX|QLcoy-g!>h( z&bp<_O5yKIH-iDQ?}4l zEv=gXL=?gnIg<2clct+KEOnHrk)&BogW8gfW*d``V2TRUVs{-&7@6A4!d;JWsG^#r zmojlV2gx(4;Y~5ZK7l_ajreSeumy4SnQZqoFcDffX%!;VxZku$ehG6e3GNMin&MK8 z!JTEC2 zvpG~PbZ)yyBjj1HtBzyv!WE9}lPo~#0Eytoh`#4eu~mqwYcugOwNuR=FIO&R&S2{%@n?g#(<_s{Z*lDWVa z8k1v>z&DH=o)HP--<_A|ZPYOM$6j`i8%MrVAJ!VUNgM%_xM$?@s1JO4D7OaC?D_tD ztq259q=w1J#%j5hCCh&k>}Vj&5rgDD0T=DcZ30aTpQ}wyh3+Pu9XAL11zHi!;UB)# znt^{ZFDqpMpPB}iLmc|x5`%jvRKLC>Ak4Nmm^Z$8bB0ZKu{G8Uks7i3?P2au+dfk0 zrEmIErhb-##B;{IpX;7ZMhOOg`(`=bCap`>_X=z$+pJZ$uv8K$$@6a{nS$7^ZY1V) z(31tP3!#2Au+UUj#IxrSXjyg@d4|@DzMi4sef;>cQ9hiYxYsZUB+FLvTfO_45?ReJ z)p#*Q&1S6ZM@PPB+na3YvTT@f3~e5r!Jpw6+5(3+uReA32qtr9;ic%OAOyqkE2BKX z?uv;ELhr%^8tRG);beRIzdJL;2tF3gUoogPO7R+63K-~evDCor=V70 zCO*}z-lAF=oZeWyhn=cw+ye3DvdOJZpTs%QtVMge`?^w*DakMW7+q zj0KsCN5q9_*R`3EgOGmr^wxFJ)-K&zp|If^z{H2D7OtU*DR~cFdXu-<%+-4=B}?JUDxyyh<=APv zkX}n=@9*|X2nr*#i6$bk8kD*@N8oQPg`ZO|s^~qna4l`dtGfAxuGjP?IlL9jx__5v z^?2&NiZzJ77N6Bhm|hVAjNzCeiY+;K*5TK_MJ4Q9{>h`mJ)=Az1Ei>-HUi@-++of4O+tp3x=oX{4VjNyvH=vz+*sX5baCYO^sNN#RlzDwD;SnKe{6yT0FhISSPC zkgEst`=h}(o3sVE2s+pg{XkN_q;HJ9xD^rlgNhjjBXgCZ`%-DSg#}_PYDyg30OCAi zC%RSB#Rr2??&K}2Xqzc|3#jfOu5PIaWP`I|g`t`x3pCO0Tle{G4bm?I_Lr($dekOt%#^Ndttb- za0h~FrzF!HC}j3DsrhrVRLu<+*W&^h-g4uNo%<6WD3u_oV*rohk_Y+yyNo2xZ(8wPgKl6zjr?#ISu-SgSsOM%`H%d|w6{OIzi&r=62nbEw;0K`!x_gi z^QhblZ8fKT@qz53FpK@P`y`&BEY~>^{%}o}OIP|LjzLfRGe8Uy-N#x0!x2hskRdbL z>E2FL@hceo(d;1Q<+A3s03@k!!C2%QVzkoCq3p+vgic$;F;9EMC(sr=Jm!~5JO=q0 zZ){I}B9Nl%9AOzJo55v5`ti?)8s|f`qK{z$iUheHy#_`a#1@cu1=H&vJDFi<3x<43 z$cC8qs6>;|Bwmb01NgsT5G2HIVW_v@5qD>BprI^0rW^X%noV^*K_mZ_L6SHO_+W=jTS}C1&p*Avhq3Z@bRk zx+9*P^4pav@ap}XIN_%DzZDK|xu@MT!_;@e+Ml->&8RYJ>|c)(kV0zn)g$~< z_p=cKf|jzqUn8F8_FIWq)a3Z5@Ba?jf{B5n+&jBHKv0FZX{|=YSQOM5zpfA=h}&-bjmU+ z(;vnI&xD9?n5Xtgs5t>F6tHq*76q*g&Ko0&}4b?Bnk6=Uj&^hk6*tsP}syBRnH=B{R7oER^{W9?=<*@v9}0Iu4R0~ zJSoohe?CY5{32?6RCv2h8<;2+~j7WHYA-%LvmKr4;5_ zzAgLp5!!doogcl4!yY_FKhW)*R)k5G*qzVkkzdKfM(dhXuJyvlp z^!M`+x<^dgc)6xQX?gC^o-(X8-CCAIkdj9u@Y)Bf?| zA+)Q}Lo@{}EeeEnd_6pdjvNW8ADC24Hhw7Ai*|DJDYy#liB5j${R+z>g6VG&%#o>O z_k;W)S=N8&JLAfQl^hB61!drJ{6j~n&;jX;tV~O+s`Z3 z6X_JVVc-?Ac?ZXjp&+prRyB5{el)HrR$KAPXKT7jy+tW;|1FwRC}4Lu0DZKf*#MGl zdNk_B|1o@x2`}4J5w6HrNpPe3F(771h%}=8XVD(eS$n9NP(Q;T`) z#eyZ2O^$-xLwAK?&%Lb;K3mng*`ibc9)$^~hy`H81y#eW|7V-EZaKT2PRa ziBdGy67cd>?MtCHS$geWHdEU7XbmsfrP3$cy{QYRJdx~Ijv@hPI9=?l5p^fWA-B_b zH-lJjzb;AsR^wg;a)OBm_s8>Y0g~F@ZufJsP-+&fHP=(?Uff6;_SUJ?+=QuY<@h~1 z>sX8j7N^~HQf`QuGBY!&C57U%JyV~lB&S1)95*%3A;=lLraowwwjpExbBzf9T-zfZ#AbEqBJ)D@Mz~ zxNv8(FF~tLLlDtS9E`WZPD}i@xDiq;Ks|Li;3rQ=68<4{?R!+IxZc#my=Q6Y;^{`( z@KHpKS-BQDJ0!B|MfnUc;08roQaY9P|KrQ%AO=|k*@N7~61EUou_l2Ng^@$2LWBv^oEgiABMSF2 zOL^{RBDagNA`gy*GNdVs2^?fGjTUo;a*Jnh;=3ed5E0u6!JRNI6doLm_BoKy#?k9> ziI?&ThuMS3Qy7FJWWn!wN8#ODsZDikn=S{%FMsgI?vFk?txf@jNMB5*0;oVwI*2wE z4TE$4^m(1)+gmur3t;DcQgGj=ChJ1ms}?jmF3Xc(FQUT$V3tM_b;bp83!d}>yx&~5 zlKm4LJhJdSw&=Gab|dr*TV1VoYvT%&KZQF~Bim~JqR*hG3Pe)RvLD}E$K|`z^64xh zLnY&N-HW%`Wyg4T#CP%1Q_;`HhW`UQ?ubmO)Wk=O7()9ld4uID>6QUHU~xKCdUwwG z$xDL}w$qT(T#XZfFR)WUiQuJ}SU)vAG{II8{vL^7D>QgAwvNJf4Ub!%Y*z7n z{mBFsTQ#K1m-?z(d}Pv<(nRM7^G96x1vGHt8TzQIoTfKlb7et;t^4U!RZs#+r4QXK zpoOMQilxzNc^fso2@o8ev%CMEG7|Z2G^IZ3t7y7vq;PN7nJ%~dNOdRf1G{1*u*wTP z^t_|_!i57(JVUJs1@-#qbi^Gde<7aSv2@0eJE3UbUp(>Jw*kiRROnx=@=?9$1 z9~S#qTl1G|3{u_BmC<{=-`@HCe@wk)Sd?G5zHQJVDS~t(BBe-ohm^FGlz^1ONDT~# zG}4H4Bi-Fd$k0O%Fq914-NU?(``G*Uf4}i@4(6G))^o4(ICd87BZ z{^5|V0g$VW1ZiQ8NU1j6->UC>v}4>M1^o$UmW^g&4Z3HnME3_H!y)^iPa=BK2~iRn zHJ7gVR3`TDxe>@6@-8tr{g33`J4@EtL0SQ1aYkqGgo| zZ2Id2qk-Gn0Y7X?P`Vr6r5R!b#+`esBF>~GNoz=d_D^E1Ca6HCqt@>|?K3r}tK-)6xSM&TOb-9yev7&WK%i}dp3Bv54g?NhyqdqXGXkvTgpbf!8-{g zM^9Cs83D)6ew*+unQT9H`d`Y$15u3;!ty$$css@qC15J6Mg7<~Y!Q+fAXi#>rX;{) zxhkAs&mjblIZmBdpNWDEe^GQaV{~pL2O4B?u=`!6-psnD4;bNP&^6G5-7Xe9fLZTA zqvmCX@R+C+r)>b~NBApp>tffYcn06i>=55;x&u$x|3BN|b6%4Pz1(y0YYCH^Z}o~# zywn8lo#f6gThDcW)O}a#L)Eg=0km|qj0lqU{;EiVbZ;@8L^B;!=4IDfU&4;HTiWG2 zvw}*ejt;0kTHl^l3t4v}Y!7r;u2RLLf}Z58t8YK-gq*cG6+^te(>|IQei|xFl8t4* zM;?*K*~_ZfyJ@%jorvY`odtwhYr(7RMBHrrlaQBe$^u^#K9_y9zn06Xss-f9??_x= zF7i;JOKXe^xCHGCn*orcBvGAYri=u>*~m1t5w-tzwfm~eeRr%4VOkOw)c0$^3%+c+ zF26oY>>5jdQWXJH3&df?N`vNh(lh8bhnliJOQ^&p8g}FN5rqi!?_kOH%wUVXKlh`| zFK}Y{`{@A*343h5@=x6fe6#VvxP}0noF3qQAT;3Eh1u$4ZTfy$&Sdhc=h352s@|z1 z2LsQ#WyO#XJsS5nQB5NUiLiYtxsFK63+h$Sv4ip7>QecER#nz9J+hA!$(ewhxypI% zD5rktoL&d=4tHM#*uOZWuKGO+VE>-JjC9Z4D%e}CO(nlmCAF2ytcor0Hup4T4I9Xf z5wkjIe&^~nRbn?eqTG<2 zOY+se!LF+MvX;g%5tp%zNV9@~yy^fohs{64^gf53y^h{Eg$v!S`0~0Rfm(@QCZl1| zu!fPcK>HumN+JD0;aiZL_Z{gtGTI8(9a*usuL#qrG{d*5_ko>DQ4cZwZ>nbNBYOnbe_y=)8nOf2D;W6RH2Ag9K63FIG*&H0IgaqZ z2HTSr8!udgCfb@NIt`bV&bt}z4ujknu17=a_ci@aZhd&(rdU_s4(xG2A~$;cgFY2AzR6sSblGMt$!OWNDS$^#O=EVK_!Hl3{|0Y`}_-{j$?^=q- z9#X{dW|;i&Bb%2feWg>C7?($iFd+$VN&SnRN{h1PG6d+=l-)M(7RlNWjg27GCybFp z?y%SJ$XL?K7DghG1<{CO-iQv_&CWNlhNB4aTk71&i$kR4I~FH=7~cgT+&(pFnhDh> zC~iwAoe~pe;L>}3pvzsmZBgET+CS0WQ^enO7x=ngfBJd3<%r^Pe6$uTqiWu)csdw5pi{xEqT+4b3%!$;H5N!_XM`= z_F$ODO-~~2fntX4y$irC)D67dScF4nx->FU(B@8dyC#DhA$bZ3+phWiUl+dyGQFqc zC^E<8t%MR;KyW?@1KY6UL7^@^MQ0hxVQ(kpHH>9p?#P=T&nxi-C`H&y_KE529Lz>) zsFzmJMq-8@^D@mePz4k5+66in)yC@eA^F`5O`k$Qjh zx1ayYLiJ_9-E~vuP1B=zX$%`MTFXdYPWIyZio4u&_tUIH?dER15-nKW@50ytQZvKY z-nh`A9HK(Ud0T=-k2^^GP^T^RwUQuOWzrM{W%9w9e0eP|)&Aw;(O+ra@1Hk4^y)II zboa-@?|A&$x?#31L7>hCSk1Zwl(UArPv^w5W@lmr?&tN@m43nN;;{e%w-NTu z{45hW-T8?NSug0>XXa2D{zb(v>;;bk2=q3W&sexN*_eHr3Ojw{|Gv?+O*i3jXNC-b`Q!YMDOl|vB{J>5;s8mbS`%rE}i>vS-ROZe(`B{>>95Tr?<)k zwe0ycT+g=go<9@2xvSt=b2_+oY+2~IN%SuW-Lz?sW&adGR;*;LOISA{>9GWDh~@6n zIeK19CcAKHzWphKfcq0y;0?uvaI)!MHbg>R>un3;q)X!8E4HJgrDPXcANIfmR%ORVrt}rZ({y- zeoYZ1seKp$P1Ri5C&yQWmnhzzlpw-vZX-PqsT29CDS)%PEvwpmfU#qAgSR+ui$1^E zN0Uv1_v4GF%~x@WlUL>z#V$Y126S;p21^Ey#kQrt`SZ6O+wgkNMs6<#O5C2QrnQ$4 z^&FH>IBeVIBlK2!;xAk#w_NlaR(U0l`&fu0J@9;2m3*yz7J%1q3-rz6Mf(vqu!CLx z;)UXmhdu%yqc@~5SC4k;_FQgzT}%uOOm9#ysXLGuWoELl9y-d>=wq_>CYFmswU znA*arcVg41Ox>A6eQ`;DO`3C7E!sBegi6FRzWO8i*TPf#OrQ;q#u)7A!aj?d*^rcA zXfYKOk4GNDz$1bqVh~B@AkzBQ`b+e@Cp+QT<#*)~VRQGb zV=DMFB#B0GUQLs|E2#OisSiF@I1!h>bOI+}v*(Cq?;uso@PYWVb7=9N_B&US7f^=W zXB$p-9K?tG&4=aK+@Y=G?s9^EI&_g;U?`j z@9>09-1uF1_+7-K=pHGr!`Mv(IAO$V(_HX#8@3s zL*x{Yy;W@8LH3m0DpnEan^d(OQU?Z3b*ZmC95jew3Ee5{OzlcKtn!#FbXtzW-VwAk#GFABE<dWE=KlS_7u9pehke3>1u$XZ9EeU5WPqsS6l%UbN=3qL|+g=RplGaRA!x7nz zy4H~1D+no8zxH(;6~%OB2p?51?M)ke7v|Sn350s17rhUl3U%INWPTze4;?KVqK6fK zF1*AIgqyEUJZe#?Z=79sE~%jfLUpH8DC>B~yFP4H#V2Cd&jcp!QhYQ3iWn@Dmo$@Z=GD%pQ*&RYQTwgtm}C<*;&*9 zRneD;@8lehiPmG-#We`&aR6u+l3t$pTAv8ieBZcY!eiQPNe6f3Vj7=48n$)jhGcjG zf}D;iNxfNQO7cF*cSF-4FBzw!HG0^snwA(gL!|CVHf0)4f7-`0iC^T-l8c)fyL=7P zIwgKfKYt{;5eh3Gt=r=Mn6?rPXJ4sZl`*>JkBiN7NNI674H5@|FL=(U(hSx~4p4%d zNniw5H*?(ma+m$P3q;4B`iY?3OSl)oDT|b?vNKX+6q<4J#CfM7Lzw#+-FCpQBS8Kt z=tL7)7ihxGb+b?%N#=WxED-EJ1zRmZL z#FhHEmuK_H;K4!fXme_3e#K<>OR^C97t;ei_*LO4jYzW1Z_siftN54z0?@4Jai-Qi zi(-^Coto?FjOmjmbrZOB4sB4U;enS1S4C^-NqG!JzA4ac>2_V{AZb1yZ>8baD^|uM zf*(th-<6+hcrqw3)$f6`zsxgoFJW=y7=HWREcq;PFU&yE^b-%_g=&8>9j)BP{cwYi z#((%=2P5*IA4EvU^g8KIgm3{jnKn|^%sE|f;*{qvj1q#S!cm9b zj}UK!KC(U_k8ax$mVCN?9ChJ@VS+2|&Vzqeil<+E`fs%cvOEjgxROcXZoT14x`-aOmQ>hE>66J3X7)AE8@9umsr27we421LLZ{(oyp+zZv`GvaVGMz2%*}=FHmE z^&3lw0>`kKOSxG)!t7sps3__x#@N%g;_;A0=^E6#Pj?E(IVz3Q5wJ`0!9+iBO4n1v zj-r^fwST7JM){`6^L_23ApSuA3XF3mI3%&TK79nQ(ala1Je5*r7E!}*1ry8ord?G{ zo*j?=9H&FY?X1?&|L8d8>KH#?yPgfs`RdrA{@#bEioUNs38@Jk<$`^^Qwn5=F&qr^ zwMgDs7WOIdjiq&Jm2A)L(1it}qwR;dBLhT6>96&}W580b5x5yr&A4$YpMz?%95RroC zlsp|EIr`4qN0poAuw;A6gF%w2LEE;d(3pFfB19NtNYn+qM$VVT<;}Sl`~BWW9e*KP zReOHc`&VC`gf15SoRKA$3mxg7Q^BVX8lP`R-o5J}C3tf7JW-CWKs1u%c_J%p-L$DX zqdyk2gt_rUoH7i2H-i;%j$Iu+M@5> zPx78|ejSvqdC=%~Xk;#(F>|kie5ifjDxf~Dpzh1g!IMoV!rqiTMHCJ7GY!bS!ILi$ z)K5d6%sxzI{d$9&U9OH`k<(b(ax$xUi6>8MgLllh#suML4a*_E4!e1}v@*aL`lh*- zC+Z=T66W9Pddu)yV0t#QJF2s@e{_LoPC;gof~dT-*jZIR|?^q}O99csSH z>*|RFP^yBm`e2{7H+LtO8Qns)mxd}fA1~ay#w0e_GaT&i;aIUt!Z&Z4HfAL|08RWn z2AZJ~!4(?+gsf??i83U$68>hXAIOdU{=NjT3Lq8N6Tzn9MbfZGq4l^gV2-Y{G8rnny&{ZLBIY zg~z3EC-r>O>mian#o~ddBF9i*!oQer2hC)kkk@b-w>za56)Yq~` z)I)u-A+p9StN8VUjNb&tn0$3`SNnEY-5qy6jQgD9x;x;OwvaK=e4x)a(Cx-Qo@_cx zF@8d6&!#?n;#MG?@sytMlef$B9w9K~1T41L*vG=Q`4<;I#erC=76Rs#C#D8R747IL zcm>G~d9esf^$HPd(9eh~dnGNEYvI;Kdp8b7`-hYDR`N3*#9hZ7uz5ZY|SVkM5T47pSN`I7Nfno2EC`A{y_n#dfR3LZ}9zx6maqgi^!VaYkf-0<;BA- zA4@-=5EulLXKD(9Q#oc3DbV|zce(!RYrsR}Hc|0is+fEXx&z}Oki(m|N>W^K#;iHl z+Z5oHz6w3|LNQi@Ie+e)rS+Yq*22LN?omWYB~+N)Hmu=3y`R+f<2?A*3{Yry zZ3Vy@HmE9IALFMpSuI#fO*j&7qrs78-ThG&;sx7I)j;3Gm|-2gKEKO=ga(dDiW^C~ zY|6cdV;g&yL!4iCHePs;U2=>f&C#DvrL{e?3oOt$9TL9rWgq5 zl{C?0^`DChVMa6+@nzEIL7hj-g0C6Z|2TfzPwx_2dE<&c{oVy$ftnGFwWcG8R@ovI zzg3nw?VkJ#Pl`EljS7K#IM&Cw{rPhbN1Lqdc41bI*O^HV6`#9UJ)5A?MiaO64)R!N zrn>s@kmnbDPE4xEcGw4N1WH~U7iXdNQfwP}SId^B4HBQhBu-bX_S0^HTgL9>_Rl2Y zu%`J5ydZ9~H=qXtnU?dM^Lr$YG#v(@2q(ni#T zgG6auEiB;*3whc{!}=Y*3wj&n^_$-kC-50%NNMF?|rR{nzOz3J`7hlMqVfaRsiMd*mM>-pF4e~gCA|~_lT~*{yH7u_eW~_s4>Yf>n z#&_8t7fatp8JLD~Wg=B$pNng{F%o8+end7mgr()bQE+Mkt-U?$1d^IdK(2v{?11VA zz1pX*S=wn0^A<6ndin6vtZ}(>!-RHyivu^489m^G^yF3p$U zZ$uS%^KQPscA9n0Y&cfcir$n^CV*-0%XUa1x&>i}qMLuT{meJ^&)P@PxgFP%q1bAP zy;X$Q^mD#EL+a4U2GfjnD5K0br#)P-%aVteq$}|%{}!^eDxcqbYP8AwK?m#&m^_X+)8-T5ddcPPjcZ@*^=4gDJV-hAG; zFkW2aMc|+-w7=t6mzTmxiAI)=q zoBvZaS4(0+ZQOA_Ds!e!UPQ!;dgm&Y`(TkB^r%HrlcO;P{0r)X46EUI+V%J^#Ol(y zWVqd+Fk=Pt<#W@YNjuxmasp&OmTFI<3o0d!(?0h%h2y9~+~*m4_@n`9VSgRC{Tsi$CTpucbZ{smf27sm1se7+o+IGV7IyWX_Tlu$d~0j<(w-P5{9S7m@9Nl(M#1$iQQGa>399L zsoXr9r{NJn!`RtpjJ=fA*PRF}#lIoPuRb|)bFK~hL%saJGSv(k?sR(DWfEGpsmFu< zv_&EGa7gLOT&Df{;?qCr`-ozUK@dPI%tYVb{Q8c9@l9*Fwn z*@c(RNR=I|{ygB)$C{?i4!L%v%+Mc`*@8utIm$n1)^OY|} zT=O2)%`Gt?nk6CVoPq*#6X4L6_?7NA=+sixsh!a7A%f|CusZP8A8>Mh?tdK=iwwJN+VOqYO3tEByOTAun=?u6&85Ca;_$@~fimlZ=ps zGPf9xobqoEEy%d_ogm~1g^LCLF%lw5IoH+Q?;y&1e;-owbAv{~E*#~Fdq!sN{4Rzzg-|0@EGVdc8m%5ojh&I52Qzt^0 zpw-qaE)5WsN4>*84r5erC#29iIH!le9QV(1kH=~9Wr*-TkNiz%IU$e8Tta=kCi(h%FBw?YVH3Z;El?fA1;P=9(%3v-gfc& zU@o9b7j60TGNY;F^z!0V8}x^(K{8ZJ=zR}(``Ite!|JVUL`D3yMf9E68pYVfyj;{- zNyl}`FwGyT&(4t_z zyRf0>%fc;R@2oPNq_V)ss;G90MY&I)Qz2rmIi<{FE7_&9(2G~?Z@|1oro`ysYU#{* zKMcAodRA&N(UXCg?h$Dk?|#RY7%-K*J4wFjavLyQo!`BXSUQm?i@uC0fD2ow^90s>`yz*p+J(cHs6QYDbdzUAQ>a_)4%|+tTky^*8TKruYqS$xEb7)o* z^~JvRgXf_idA88>hy8Z&kP|BNWY3i+irZ4HqY_FB17n07k(qwZw+cgNIvB!i?uf_x zDz{QISdoKwe!APX()9N;tW0!Tms+B%{Q0}V@6dU+LdenR(*TaINRJ5cPkS}mcs10Q zrSl6BpBr%odrFLwC=Mde9W(8Mo?hX#tH&=nXP zXhjvhpPHb=;Kda~OqQ%q#*yDJGzv*~OoM;D^!~RSZ0Y{BE8=eHl;$_c-HUzeSK{tN z$r8VfJB%QDeIye5%%HUa+;NlIyP6*Si2<_(lRU4&RHS5?g9`k;Vk^~3BE!qVZNqF> z@TSTE1&Qo6-a!eXwRisy(a&5gn%RSmtkWmajSs?iU#(#O?HU6@J?O`r-Ya1oldUpn zV_3_YaIBDmK+*t~%;__7vY;&P1coHYc`7h{IEq!G|0^lvgq8OCwfta)Uc&bomrL4J zCrfeu4Udd^oD7|xpJS9*8(V|bVYhW)m1E_!lvFBNwquI8_LL8De&U}*`ge3U0w#q& zUmcBVo5jrspzn^70=LFg68Pn^NI-^O+#D=2<)%vnR!|hplHDJuHY3w{4Ub$DW9ItZ zYK!O$qlP1{$MxTT%vQnTQItn(&HvE~WJ(XPKQCR4c=+Z(Aa{Lo2Y6%D=_J~(Hfnu8 zcA>1n=Z~@>@9Uo=1Cd{(p7-qf%*dL_ig=eKd38uJy;*^%3o=YtX8s3CzR#>~D-}=P zuar#o?Axdbk_fJoi4s8MpJ(Tg*eZZOJMZ`ra0*qnmwVQn0@7O6JC7T^`Sz zco{I0^X~$12-!}6OtnAhbvsjhBjVa&AIaD07@!rX?kZCq0aHP!ZqkJVxgY5=pI67L zajSvb>67=pWXa6vV#-_r)SIk8Nb2^m`vTEmckut@HnE4ZaNqO40Gwc&S^OQ-28q!q zar(5Xe5Iz5Ha+DVM0?iLFV8e!#I2_sj|VTzX}ZTtIxy)O3RK71^ZmlA4nRLn6P|6( zqNPz_ev*$E(cZ)GANm`)3O4X;zc`IUWfSdj?JDelm5xv3tV&Q_B6zey9%=}xufB$9iA_9Ae% zSKgGVdc~vT#G8GAK{E-jk0-n6Rcw!F3kt;%u2*dBIM!gRkQTc6tOs+|3rC`yKjI5t zvHui`$$wh+R9>T3L%rhC?XmWK@h2^GxrXvHA31EtvlZLilEN1ig9TCSG~y;M)nv!= zg&DB7(Sci6ldT#gh0oPD(;bA&c_dx4Yh|8SvgL~vf2(q4-JL;7#nM_!FGroeXLG0J z+}5TVnr(K{ETqpN;USc{ZxVD;7DisSYVU?H^(bpC^U!DdFQr~XmY2~3r_V8HzRer^ zgQzt+QPu7c5G5A8x98t0Dxbk@BpW`T`#S}y;Y=~eygRoIfeJ1cyR~1k9O#5-Fhp*dW z`9wI0h2Sq3IztppL0txaXoADkN5|z4%3x<6mY#f-|W6$YQ zdh;=EOT5GWi(Y&gCyP;QO5}sc4VgK4-&(;v9?lmtzu$$QyW+82 zsoOpHnpKF1%C>9_zjUSfhncUBy?b0>2vdn7_4t|e@Q;pLuNKlRraEK2lXK$7%`$_P zwaSLu4^=}0<{uMN7k_Dqicpi8ADAyFv6&2&3Nv^jlH^E>w7UE8;yHZ#6%c*ozugS* zCjsAcY0Z|Wp+jh*qgE6-P?7Rh_)D-#tViNUCxGJ9Qh1j5i}JS<0w2T-1pl!t2nLjL zTNJflJbSTY{+8!IqN$t!oP$%mp*!Mur#<%0h8jmmcRY`lV|Oh<$&|w5h4jzh<>;CHdWa;-_MQ<*G>yedG#Vs#HEb zKH;6OFEor=s_9qlgMy*|k-2X_9ydwR{bM9@7*l~b(+=SqGV`WVF{BN@!xh!$})`qTKN7}nZI+eG=B&O{r29##w);_`Zxe59J9 zPsmfd&BdY=oF>lE!?f$op7`9hx%WcIWzlDXC0abrb@l%q%G{MPB?bk(1M-B)+ib4w z^l8c~2VNiVf$w)4fM-aPoL|prsgAPKR1Cx?JJlZ>O~T<-{h2Rtr9rXXGD9aB0{S?0 z0Qeq6v12%B8M7xxXXs$kjb@d9)iyvcz#G&oT+}c(rTpOK-KOOOUSC^1~;hi3cvbH)o9BxSES!Mt#>vw zqNGRcLQbk*`Y5kokksDQA~fTau#?`U{xgXija;fdd2%|Rx1RaI=B@n6Q;cGSZxn5JWAlpcST z5z+8Woks6!dyrP#=}5X2O1b@(1_rq42XGs3)ZOIwIdm=|uI~R7&lVY)j4l z_p`6)X90R3#{O8A5BeJpq5fvKEwHf95-jTf)RR9D(cI#V<6p%1yfhNTjVASl4N9V^ z-&tA*z<(_#1t@$Y(MU?6Q_mo$W&A`ZZ~OiGU~;n=uQ-RYHm_`}!VUuv@N{cX|6a^R zQ<mDdFAbz{J+}{5a|IPvRaXWQH`|1 z*Q#^{GS#b7KTW-&;%6(KZ!?AGTj?4%hRFflJQ_Gy%%3H(ji_BiYhh}4za}Lh|Kxh*iozc zjUd~r5be3IkBg5AWZ#hS0OmOJ!3G-io)eDyEn z>D|UlBxpmLQ3ZU7PzP=Wiv)~z-6zio7E5chD8ee zAZ9=27E+o?7bS+>NWT`QmO_oMOvx_0a zX6}*<@J`1O0R=YoRb01W@s~c9IdtYC;{J+!U00~V9~eA4-ydiC0Vpn>II#(2TFszI zm!IX-B~i03QhNT?;q!v$qXaMr&lnzQQ%<9i#tt?VK;%7WY~*OWOze;S4wX&WzE`91 z(-3Qy&Xb!198^qqHvjMe>Ho83GRH6#5Jh#gHt(@POL%KWZmZgf2zWSj!g;0C4+hpy7OgK@|zW_!SX@A_0mu(w){zoB2p1BbWQ zVQ`FeWd$7TF(at@jEv@8kMS}O^V>fS6K`A&P}R73V0sSIOEUWx^wBfsCdtKHDzrIn zZ^g@!Y=<1eRcV`_O@4mhO6-byQjY6&OyjT|jB<*j^V(6yan#MgR{Dk6$6`+E08QT(r>_8*efIgNMt;Vb5 z;HDe5lHVd*-6BkhJ+E;az=Qy?-&6BAG*555ww%6T-R)Spu+#iBHT`{?#sK)0_ft^l zr;~Cnd+MZ1BC$q|k3E(wfc>54)f;`vZN&}8?w*%= zgPg2k31l-ahV%~{(gj{O;-~ItNlR*1MX0*#?6Pk&`Gg=;&Wd%hBD5r6)Or$iA)S4z zi|m7L$M;)+4v8Gt0p<>XlIgvN@_Q^UcWtGBLMuM}_x~2h4E#d(4FZ};Y-U9TStddz zcs#PwGyP>T0cq{0o$@|V4i<6LLjkNpr{Y%WnpztaRwd1u5oDS;BF&wtT+Sw6Vq;JZCaVkLTLCT7-qyBU3F zC&JG7QM{qi94;{W(Kj$-D`WUyUSSuf0gmuY4@Xv--99b#>gT0d+!1~Tw8xNS&-=2^ zPR6kmTyn=BSlU2Yar~Y3us>1c+kzcGkJ}!Kdi4X51fRFNhdd2MN7x$#@u33t96vPd z;a9L3(wy~G|M;Q8t-YVix;zF}h5eUdX9|glvL`=Ee|;yY3JaJ#yO+N52~w6T`oJc% zI>?bG;+sr1gzd`@1SqA_@&#RDO{(*T+!JQjwmPfj{K;2jk;lSKUs&AISa*c`Q1UN1 zKZq26XC><@F*|!3JeI4pj5tCQ~jhd+b9 zen(Oy`M946mO+;3lpSww5>5Ox$HFwQ0%{)sxF{TR3s24X`l#k{#?mC7Vd(E_JATb3 zeit1)#A~dZjCp@x0L%9g(q?-UtxE%VE*>M+**N`r%>` zEig+xKq|+o1QFyDD!-Y>&iXiZ2aD=C-x z8=`+oo=VwW66fc(uoq2Um`er+XJV-M@KkKG&b_}qjMj5gjd7%2cAh`Zmp0N8v7IE= zuO_1nuJkkOix+Or-C8SdG8_eXEO>f z^#^hltJt8`8G<#l2c%~#@aldwV3f@B-^L!Nr+6q2EDSwturqtE5_d6@{@j`409k+7 z$|XahWcSWD1)(V0m!#oSzUJGk&wHF#-RF?9-Q3c=h4i^T=aZ;#7xzftx=Ij`=zyd) zqEe{%c?$#k^C7RZM|n?0sJ~xKrb0E-QGPyQntnl7fL`e2-9K=#R~OONN><>#^Yyyq z?Npstu7+QkMn&<%12Ha(>kLt-`NDo(f^b{8hD+fDv3@V6;YEw@5^yLz9`(fidyc2i zUQ@#gw_2A(hlx7|%q0wlXxn#-KLI@kZ={Nyk9(A&-mjN$0du&eAjzwLh~W(n^SJ{S z8twsY5!n~?S!H2(<_FM_t6jicj2W2!M9+GZ+Gcw4)NeGeU*~k_*GHn;9?!Y&x2nNH zp=En@rb`t*@Y=2UIRnIN1pJy|6rGv60!^jCy}5Py4F3{|MjLMX^gP4F8sJFvU#T)VYseoeT!3!SEwVt(~i^C~@C* zC{e#j*=D@V_|)P{dG1gbV6NA|bhN3Me)oyZc(uND1>h`}NFA3G2PDt8{_u)eX>mY4@da(f%QH)>W7XCB1Q9wZ1r#p=bu>#2v^~TEp&Wz0E5b&`KR=R{rjv@90n8>|B}K z?vD5$h~PLKz{oeS=6M;TL#~a`u)DXlkx9-!z3%v&XBxzcB^xS<*>S)un=Yn5Ym`}KQl0;XT$_fq z`K)_SgB;P(PTo(an5j%_je6cHpB~t_~n)5PenZpZlyz``crYR3vK@ zZa6W@9Bv9^YrEYC_!;c7=l`m_gOM2M&; zFnZgc6*yvi4ZYVn7b-9LD;2C_J14%B#TB*WY!taKHrTuJlE2kmWIqxA3wkkPy>Mck zk?%SJNo`OWqKej`yXTpfgVArp9TWR~Q4Dm(=>-=i-$aEk^==F?`; z*w$~bEkGvmf85@3?t-Vv)^;Rm#3Ek2U^8}cEe`@#HNq+mq zi`^ZNmi*7?s-T_*U4kQdEAarLJBCc4a z-g4^Zce_}EC+tkyoo3}c|H)^l&U^nl@h-C#Zql+5#qZ%m#}d_{j&j?_fck5S+P@=T z@ie;6k>A8PUHdMqiI7z&?IqEG(HQZYqpN>hv^5fNExs1Jum=`;aRYx?(Ojly+MRx# zF(z0^<}V2HxV{*uqtgJi9Gd95PssLaUq#ksQBr;9i}u#J-@G2Fh7)S@$iRitzB0<7 ztssjyI_E|92H;nIetk0k(J#Y0<o%@4Nes;8Q*(r{(XOo%q{8{hp6sS7yReuaFx2IL*0NC|S zbS&$e^-sKj@ydDyBx}UWye^#ZTX1KYrmId<;BYWmHEd1vsPiNZ=-XLvK74AF5!YT$ z@@mcV& zmu0PUd9;_#gty%4Z0HrovEUG!*+}Gfr)663MX(j8O995YykaA2kX17!3tm-5ThrlQ zZ}E0tl-`~L9cYl(K_9uNo&X2RYz;E9FEK#{*qeTDWN!{$)gO`g3u_pCl+ZD$K=r>a z@TqLN!4vT18f!YF+gn`q&(%Dt9rHVOe)N8%H6J*C87e*z{48>82S1h_2plf7px$AN zU6MD`-AJc~oy;?c1*=}(+ui&MbV3qpn+GS4ivvQB_cx>bhfC^WIOiSm%*!}Kq@mK3 z{x+A`V~%Skq2-s?Ik)-z@_k-m+0U(oVi_4chQOi%x|(77+C@2@u|@eG{+=i@TmQgC z%`3m7EEe*7mqeHA{&Uy?_eJc><}-Gck7u|Niy!7ge&*qL#m(VvLmDYS{NZlb(o`|b z#8i33A;LYL<*GS5b#Pq^cT*qMK6O3foS?xPq94^ek-~!3F+4?07Ok8DrLZ)AR=JM` za`9TscTB>Pz03UMa~pGyD`?=Q$57*OY{Dx=3m&_?N>+O&`*63dzuRjc7ah|CB^!LtOJqnbd*GRzKg62TRXiLrLY1sqrUo zJ8>CIiazfPvbBY_g-zIHf9uA!k#LzId1k()dzQoc0VLw;%W9=mspT?5mDg`9^D-+* zc}*BF(S!pfeR7Oy@$>9@!sS9s<=t%>l`c4O6gQ$Y9uD9WnG|tEKS7|Ltn~mS4y?=1 zkN0Elk-h6Y|CM^nhb^Z{fm>p1#gYgk_C;~4;m+Pf!UU<3LWpGzs}nQv+xwlF_#1|)KZ2P#mDW`ef-|NgPup>=WF-+gM-yowI; zwn{6t>rnj@u<6K~X1Nc0BJY@~BR5GBD8Ag^HDp#Vjfc{OFNgo`7j#LJcK10Ho&^{*BeCqM)5T{&mgVFfbgt7e2Tu}Cu{L<#Vd(!D^uD%ak$pp{BGhTtQ?%1l zFDls6rtvVS=tm*;`V1qG0Ti5SV(pI<`0Mu0_RNJhfKR>z6*$R+l+7~y8B*jyN$_`F zvpnb=HE{Y_A`Zo<=GYRK8>u=t-r)fX1y-*(W?aIgXBVqZojml+*RGsbcUm7dpIi7Q z#*|pex(rraQ)7Ek5wY2Ys0vsqS62YFVS}nxE-Y^i?B#dnc;y6FpLK59wsMwoL5^9U zJW$cvO#K`>dJop5hk6fXsR|jCUKF`bzl)p-0s! z>acjzgpTQtW1SCxjz{VPO0@U=$1mhgUtm`Yd;#qFgdFM$OaRC$?^6HR>>lFWEzw*o z#5rnR!hZa5@B6ENK1J>IXOm!xrtOmtC->PU5&$hBcVh$xoF(MZMRrHtxg`{=F&Cj$E+@=mM5IeY-v8uOuRUK36WG{_YiMNj9=^+DZd^A#rY-oX z5g>6B>EdG*MEAYe3}5gisS$ri*cZyv2TxLztSJTSyOt|E+)V6=3&Y-rW<&VpH918k z03njG=>|95|$Ta`#QveZ62NTd^LWcf`_jk&PIEK#odv0rzN-f70|Z* zM&@y5v{&#%z{1X`6!~>4G~|A;AVl04fm%DT?AgliN-JiCa$0t>H7eyaT>Z#`B1l@& zm)DjIQL3d@qj6Sl1*^h;X#MY;$``x1<~Lq2RRDLt{G~*()r%BV@6c~li<>E1uy2h;!Tz}?MU=|wY?4dKyaL78nmI9 zLEcN#>xW_fpkn<&h1uKQJGQl{N)TagaKAk0#MS(UzYD#8;})OwZ4REK7h1sB?-fNU zp)HN_-fw2h9T7x-k2Ae*VM%+s3fQZT(h^?<(*uXa9`NHajSzvL3TrTn-AArU8wv?M zx`$7zf@!_#tdu-xXYOV|KxKj89-{rc4%p%q*M$CpiU;dWf3O_z_1M-Qr;3-3z5^$T z-gHoOPPqw(@cI7DhD7>d(T|Jqt@b>FZJu#PcAG3e0?%;i!YMd$h6j_49X6BFs$_U_ z$O9_BGY7&Kyr6yN;LgAFKvgkEWQ=aLKvwNvFOA^^eN&$R-E;BSgT-rs)n;^ggu3&YPp6f> zW$YlANPic8_{vEfD48%o+e`HS5p@=BQ3q|?RzOm6LAqnrT^cpJ;<5 zsk+y|^X*rL*nmviC~%QqM=DP&xMfF8%@=j>?BVZk5>R|j2i$FB(@H_6gLav5t#y)_ z+Bex~GzTp(f6uoCV}5j8f5cmLi;?y7dA`j47W$yITXsO^M3>x!ziB!Fb6^wU**_Ir zz7)^Bmnrk!eiffDIbThX+4YwET)(A!GIk-m9$;^w+uwV&v@*ze^D3YR=zh z#dOd7OSCy2zZ@qp%;9sWG{6ex;MS@$HwN~R9grD@J2I6;pB7ng;sYhG(}#JM%SDDj+f^LI~+%BL9A_=0j$C6ze>xYXO=kE(1uk!&MVF(_vP`0 zZSTkTj%TeO-gZ3;B~s=-x4^TbN2{NYs`Vd|Cm!aSyJo8b&fwtBm-h81dtqNnEX9Y# z?wg%)Sb0a_cUc(0Jp2W~1qZC`eCwC~l^2mu2C(dKviT~TxzzpE!WY4+!Y+q; zzCq}}EZ%+euG@Z&=fi(?8(0)<@tz=DqET)>jwyLlBMTlnsx7R&)8m+h!NgTX1%7 zUr;oYdB z__JK_yJKh$a=uu%h1rh`W6=4?MdvCj=ty3^i+RXa<@TfUGML*V%XSfydgw>3NiS^6 zMO!7_N1Gg2JCajYoWb95KU+-!{VCWpjr3489Z}VZ$9Fl^I(XP84Wm*4P8_LFfm|fA zX3RUz;X3J4srAp!a=I9-VV2^lxlEK*QV*8@39K??6T3{C6uFvk>$*&s#d^-SP7pIX zQSDG+xZmKFORFv?f8;3$E5(DnBhk9?N>2pPbRWq{U8_#NN06p_*Y;{*yr2z9;o{FM z%vQK_tPJUEv@&~jLf>-7_c*(4K5xyVxfL0jTbwsEW+(Fprh$Haah>iWvi%BKhB!X) zWmz1f+YOAzP0a!_{Mp_rv+mugTe+TqVF?^dB!c_{Q?I=kD9Eb62EnRMhTH8j8V(Lv zHn)$okK1B4tvt1}MuBZLo145MU=pqQOPlYTP#t5kI7eXlBS74$fM;tBJRP%}e$ zYO9a;jM zz@=hlgl0C{3&+!9MiD%8ES!)#9A+M*hg%iUiq`C1nQd7f6 zdr}X6-i7O5@ttQT!f4bSW&d7tx##iW70nG=s>s)=aQjAL9RJ>V-H$42QEj)8Rjfc8 zv0rTdDYcI;bYhwd_)xOF>k`PRV8l_g(nI{0s%Qk|MkopINWG^lqPrr|< ziAiS-fz^B5)b;U;;9*ndX4!xfdP^Ico)y04vt5tKpW8dQpNm4M9!z)(JsCZf3uEZ8 zHb-689INv9zXve6P!#8yG%I61sE4h3yfnWU1f(P&sJ-8Jde{?4PE(~n` zL8D_vlqp}FS2MWJuGhWF%5+pp`>EZLR4V=8?H1=#sLFyE_i`e_psPimUv^iH9MHML;+67o{RBd8rk8%`+v+c+IXp*0;>ZNW%@aX$d(IL(U9#{ z!VmpT-+4S@G|nf}E6ycZr7k9iFp}ZjY;glFH*Kqeh!}N4^L-cYp~hmO;jOm6J?+!Z zJG*>|T_UG4R+E<~*WWRw2<|`3l5eH*+pm13A*gW}=JiB@_hmY0-}IMk&d3|mE8F4F z+hZ0SHx{TSxA^?-Y_)Fv--vNS&X)UnYi{MdCPV5;GPJDqVEt8H@>flm^zNv$a97b~aeP@6zm>x!-ojUwO{@FkFXU$W)!7;apR8I1#E#aPCbarDO5%0h2Jm z-C6}6k5#nku^%nqbo|jVJy56gkmsjS6aGl2zqB+gJtxc1fGhd8IN_|_MU-6_Dj~L{ z{=$StWO0q-9ff?xTJ^>{5#~BXCA!y85w+Ye8wDtP_Xl0P zo}#z&P8H=U%mVP@*`()s{`V6!c%1~MnK!0)mT1%(-_vQynl~d6?T#QRM9oh#-+^vER5lSZzmWuxV`LHQAFf!S;x*U!FVlL9a7MG4B z)25%CZd8Q)o z*KzbYah<3{RsvPj!BD*mVgNtmF`putR7I*(3+PcFWi#+f2=oCx({j6s)puN5k2o(_ zslH86>up7?TMD(wLtUoRO8?n^ZHMxP2r@!U-4SSTFNCJG09WkHJ7*qZAq6E_p4Su zci(o<^c-(MOgCYg3B`?L@IxtYelQVMK)mtB0l54rNJ%ZWf#9eTS*Ex*+|FcKP!T^5 z;?+-L;xE!a)HuR2*8_e}EiJ%CB|l|+pj7tZG!MVvnMi3tcyJh7Bp!jp;(@uX>CKybbiPcmX@Nl&z6yeGyTKOn0nKAn5J4?+>la z0@9*q`ATULI01ypp;em#RCfK?tEg%v0ZT|URLaH|gK)y5Q>l?#0aNd_nvXWlv7eJ6 zBi^`z#xjR{irGV?4E3v>QlRqO?WPFTcf0G-ZRe6ftGa3sJ3-V0bY@87FQ2m1so`hU zR#3tUy`d{zbB|1#Qk_E;`7Y$^;yF{B)^NfsI8Y#dyMV@s({kvC2uKJ7D?7Ehyq`r^xDXOA4VvmuX^du}8zy#edDUI(3GrnR{lAmkJnvFq(@Kb5 zXV^wiZz91f<*$HboW5~FHAlJ*LSq$Qtsr2e^_Te%8~lg_uT1tGn)v;K3$dqXJWr=( z->r~9PBoh&c(Os`HBxl2GSc8u395ijUHgXV1=MiKj~44(pfP9?;@u1PaKt0DfJqh5 zm?wt`-ZKn-BG$r80YW&Zh_5#Nf<~!h$gQ~L{fsG!w}!vfs3M~|eOY^Ij8?m$=*90) zw)<53a(H;itPKYJXJ+6N6oaWVLuwe)0k5>aX=K6^{*;%G?HwUCUgtuR=^NxSW=Rv9 zxhq9qbuiw0fas5_>*#_mAT=jJp^}JdUmae7gWr7YMVTFtPY>L=T}&Yln7XJ+M?x8n zPq|zvQg9@I;;Ss6$$YhrQwd z6d;imc_a{`DwE;mo1mq~URWC2;FMBNCz7o5R$D{`2m}VTEB_zU&z#otb9$w|$wl>F zsq@}!p@J^YT~{_!&%%$F!SaH7@Shltucs1p9L(VqUF;sxI^bQGv@95c*H z)^>;l3z?Yu-j zaxthw@3vhRqkbEwxVOYx zQesE1O!s?u*<$_IQfH_JS|g+a)7bsE;lDG0Cx^@djd0Ej1>9X%U9WU86e0x%4Gzz% z9nT%l332Sm-0|F=YdbQ!TaO-q!l;>#;{AAv=~X9^t}Mzk*e2@$#TW%4+%oU4y9Et3 z5t|^zuk|w4{)X~jfihfAhjctA6T0$Mgu;es*a_tJ>}$BZS#vkd`T67acaYH2{&F#{ z@-pI9Kt+U;--So@jn79&6B+XRHX+JXU5Sn@ih_89- zqm5s=IWRd28%0Y0cN{U8wz`C&j9K$^sg?RGbN#;2>N^4`e+8J9M)G@X^SVq7R!H7~?Qe%>a|Nwx&kP2j zIyq41IMtc6j3VIm@_D{Q@XnC*xk15@G7`d;CNY2AmU||gO_GQGwn^xK?ycz-j(n;( zY(@iU{EARZRO;IIHaCo71fk`>MMC}-{2j&J)zi)T%gbEKouB3~j+)9)e04m{V3nou ziA%vi8cX+Z!O*#gtezu0rl1+_fGZ64rU8N&u>K6k$q{Wz>0x{CvY1#sc%3f~H;p*a zR5SU$4hS5Ql@)zv3>**HXLuMxosAAC=Q-0bd7SeY|A6dLc^oh?&U>q1E@E-stA4E( z4aZ^#^wG^T?eS>!&fxw09Jvt_z!_beoG_?}1sixP+4xIU0btBVD@CIe&r>Tg#;`7( z9!I-Rf)fS@3^>_nBgm#2gL6?6?44t$H%>uF^dLp54ld>Y&LWmWn{Rx~}=CXO=+oB{Hk{w;o>#6iYK%2nlbtDvnh8t)*dXc^qlDh}lq~HCKAuu<>ov zxEhXRNHE&Kc#iaT)|phyv;|d8#r}`O6QMaMEOiU#zw>5}*q(f^9K06Kx3%es!%(k5 zEg=J{t(1Zp$}Yh<$1)mBgTwvQ=_g7hS(>n#`iQ?~KNv|-54n(;j<_~m9H(Z| zIpR?lUmOcwwMY$tr@-GO1oywLpA)O03Mf=34+}>M{4PRLW|0v}F#7mo<{@#C@uD6$^^?#vK8mEd8*aRMFw_1s)2Z z*w31H(+b<=CAh(TO9D4Me9(dEqNrhi3#Tttf7#kAK@jfb_~+cBi$M>jE@QJDjr6|g z@LFtEPF``kHW%w2@BGS+g|sW6mj$@4BkXS6PM&xkg!cJnlHDQY;+!%vT{v`Hllw`{ zEPmjR!-tLNJ!@#pN1f&qk?E`$$BuZm@9_t8h6A!#ThH&Sy~VC7IK26(MexEm5L-d- zc_GIF@G!UzWiCGTNKe@3jm_H2YXqF1X*E77@$BT;@N2DMh9)e_^N8sJf~;k94bM|T zeAC(x^ZI}w4MnA+o>LU>(pnffzV$ytfRAKL*CAuN1LPTxt>7R`0PjXn+n%cL{Jf^+ z4Z*G|o45UXyd#9kysg2$bj?P1h$3J$h8#PbCLvT3MK&8A)xC|0J{lzmI?ai| zwcke((wR)SmCeZGcIP+gqjuae($}~Q#MFQ7u|>1v5(y3u90V>ovfA(33kp-MG4u<+ ziw$C(Q2)YFgvapXch^Ny^_Y=6Dbi{*4;(`i4<$+42H(Fddfj{)ov81)G+6{J@00M6-@n&N$gLTECnxOXF-OJa$_NFj6NJy67azIMS)ul8 zHobO2l}~WQDwKfr8`#q?AQ#{jeGVwGgz&By{fbdO*X^JngRQLno`@Bc;R)a9Imdw- z@`4`j1!UbRic6IXj*^4Mah<=6pYaERm+8>Gd2M=o7^PCy)Bf3uKzG%G8)D)KlM-d|2MwA zerZPRw3+Qo6!EJt$_KV*pq5If!d-=?=nTV_{!BUE)|q0CZMz{%6;dFih8LuO6da+j zGyEo+I&rQ6TKHI026C-TV#MsxtCp)U$BWnZw9cx8MgaD3dJcul6fewEEwTl(iLs)V zo9+CUHB*1PG#gcDyGO3|X-%SOlD=}A)u>FUWa-i4SW6UHQ<5v1`Guwshq8m&d@L*? zK*4}0xtUJE85xhhYJnb5PO%fQZK{C9ylvcq7?C-u0lPvt^wg5!cLx|gu>UwDM4<3? z*L&_aicR+W8!Kk?+!I?>)O~|3rsWGadT%)~wfyh41>s5Dl>w|ATpVk}A8A59w&HwZ z8Tw5lJ85vXaAW9VZKi;B&cB0ZD&+%NA?rm=SdLd&sh~AQK&2{kajdg=xLHG%$U?PL zbVbI^VINgC|3h|__d0k^?$2QTz6A;R(?(mZU?1c=ftRpshWN8;Ctx&*h;56HYPYnW zj=vQI1C_Z**|WY+DQr!*b-50^Ca0)i@Zai#Ah-OWqEUZ{ukXidc*{IV|;zD{6j92pdK5gGOBR0lb<=F22pVz^#B3%-Et3^#A<|`xJsG zPq-K_FK~a)0Mn#@4>B$N(D)S_(i-#Hlx92fTI5v7?%dIj-4dLXB-lr{7EOcPsjZ|# zlP?5(#8Ay>$aELKa^k&gQJtLe!jK2oo#k;WSJyQB$m@zxfF=p*jBF0zd@@id=)N76 z^^DBI44fBU3|0J&FWDT(4*d8KBg<^qKph-VHo(+!v=}|$t>7;h%sRZytFb;)otRIt zgVv8Wg+GM##&NGAjNZeWX<^H`*Bie&WlfEQ_*-a{w z`2Nd;?p?&x9482)_PBtoFv!xiv?)S-26aAT0~AaUyE}N=5}NAr?(L3ecd%rzLYf_C z?gEy=pbH3ZUIo7-ObRP`Go9xhNS zBvp& zBJIDxfd#TMa9J(mu@$jq@#oJB2=r5$ro4~p5cyf!?UAk>DTE!g+@4W`3hxjSAi2Sy zsUJ)Q6MTzA)XtT%66$rqo zn)Brppx0$K={Umj06h8-u=fWm^)6tk=f|TaLv4<&ofd0>q7xlQ%Hs7Wzn9BDH&3zU zJ}=K1e$^t^w|9#^&(9ez+e>yPj3wxH9+w&GhI5bGaSJ%z&(LoBP@YHg@7&{w<{AI? zFc#v(rdx|zJJk$Mz97vsT?rHQE&aE@7vw_;z@l87JEfE97eC0kTR068xMZUC&+#3U zF8*vg^uL@47*!_NIY}1uPei^@t8zy}MeyEsfmZT?sv3Y$EN(b>e)spsS`ABS0kt2G zyv0jILRjBP5_xygu=q(TmOC`1`y^{NoNbb~5n$t(~zMt9-f57r&>)xUl@#%OP@{uz-c5T14^v5*&CFbYnsK_wkY#_^;v-z}a$& zGCE|@H{Wla$tj!{;41F2!ts#eY=H}gDHcZkQv`RfokemIW3U<5T>Gu!er27#zd-yP z9TrM57@K=MuxI}k_wMJx0Qf`B2nF0&YUm9wu)!7JMK@^1?SJs4$|&dVvp> z(iOOjV_Zrw3zTl5(Na-xsOc8Vr!^&mXh;eiqaL9TKYPf2w)5Bsm`qOinI9{rodwTw zKQ)N0^TOvn3{bf!A1aiE+;3!ja+`qdQaOCj5`Y_}t21zbGq~{#5)xUGFxOA4+fL?? z?me5XfdT%QJMad)@v*Ak?+H(3$e0xPcR&szVBhZ|vHjwvMJ_n1C5NFog)<|tHe!#& z*Oi958G-c&wk6VsrrMtGq2R(M7yB0194UatHH0VHaeCVFGEIm@EKVwXD_DW7Ry!q^ zk6PvY#h5?ueYuG35dF%G!j0OpQL#x%Cv zj*?`fmy>>4YYLxjk;YWr*TTG}L>YcY4E`X`Td1xWG9n-r(U~?zYNji`t7HN>l1A+N z?!C`$MV&WwQC55I3+TI4kc0nWxR>-C4613MNS=T&ihGMYmF^pk(Ys5H`Y=MVmomp~ zOck-K2M+J&L&wq}x8R?TC8-)2dk&Z5{3;~BBrEWiHwWQKw9DK(JNtgm`=iTi*L)An z#Xx2e((C>80=uOA|5Oz0xVj=r07LnNx!Hv`8uhZ7C4ZX7n9jEGZSKbHR2H?f0^T57 zTK*Y9VNAZZ1YjGMF!oTHnW6W*G|vd&c4v$Gb=ir#93`G0s$Epn_mFOY{5Pfm46yH* zm9dKQ^YssZ8$^@d@p?HD2HH|aNDQWz0j)r%fIn-K9GZj+VxuvJ779DnOL<|HX* zUkkK-{e-hwXDIx70H;L7#b4>;EF${HRWdWwx6MA{oZxoy3IZ07x(_X^=B-1Xnk@1- zH&KC_+NGW!z8_&UZOCrxV#D9kAFQUj-O|86Tz6s8 z=n7`SGI=8c*Ap2CR$gETwx<~M)n*6;7S7}iRlkTac>3oL>LcXq2rKcxDM?8XhT@hp z!{pGTO1XHO8U?vH=z%U}VS2iel(n_@q@^!RPS%j%Hd`9GkJIHl!xKG@(c^5w70)IW zzM#0~!oiCR4$c+lY32MOjYF~)>d%?=6r=f0Z^4Nr?29*NE!#2lJHw<~F+HIxL=6D_Qvs4zP`lnImrdlHQB6Cs!Lua$K&o= zkt-qKu2z%Nr9}A=kG9pH6$ymPhLf2@|N9@T&rL6Wihcn?T@D>rHN>-K} z^;)1OBl^Wk<{1WFwwD=i^1Mki5#D4sVo%o+M2}1AN zON_w5)=?EQ+Zjfi`9b;6Db`*3zF=sUXdX2rLs}P|l8em;awWYpo&D^*9LCd`S|!Jq z;#m-Qz_P*B60oomYgy{a2vSdXzB_NDQnko+X;hZ}8VbiRq;tvwJE<8z$|5n_bI6V1 zE$f2OWi|ek1Y$bcIE;ECgs?xs$YSdsoVo@(|`V%QsFC5 z;pc3TuC^I6PG4yjwPkJTynvoj0$F}7?cmDW#?pZnPL2_s50e8Vffz2d$^_;WPGz+> zc)}N-P)!d$F0<~13gq(PuFpGh%vcY3NI-Xwh`*kAjeMfbDi*I0K5Qf@{ECC?_1m6Rf_Ab(Gg%(sw)amY;&90GcLpfaR4x3br#*a8-vWei7SLZnPEM zi3rCULnnz9nP!kM(7<@Dw zp2oZAgS-SCy#U_{w*w`F3DXSL0FC{dwP6WUmx{$ZfBlfQti9a0;u~|hXHim0w!!@y zVAK>7C?QJgRp~tg&KS+{rjnb_q4U>EpOZNfM& z`sA@Ymd3H#{8T$AZUDao`s6R$fX)(i*1d~XZYzF8)3NiRa-tQ;@>$^3vM%4p*&@;wTcBAAEjTJnym>!7hx&0IgOg4 z&+l*ai<7JNT|fYCt;G}n-d|)F_zD20L?A?5^Ebm3KGD@r>AuhvXofBW{WrNA6*o&F zp&KJ&FQ;uruOB6)pd^7buVDw>q(%DR^;@@WR&0@)6yF<56HlMJqHmn_(HDL%V{*V{ z-v?Ukaf)qtX0^eZ)7isl+P;X|^NNzONd2Iy*fmP5wt~A)`g*s=i}dcxZ9E4@3Qb}a z&@$+g135TSQl#gAZvatr23iW_K`)8jS{vlrLk<1e3GT#QX|`_I@;ML?^*B<{;AvNl z6GiEoM!9v`-=k<)-?iVz)br;-QwLIacuroe+^qoq%BNE;bzpQ}!Y@?!K?9NdG*boU zeP7tj%9hwfQ=T)+yEoE$391271lcy;lzc9w|9oV9A|ecS#HwpZZcGWN6443waY7z- z7fB@R>|9diM+s~Xr+hcu?-t_?9xIj@3XiBkH4;TS#R5s6&`n>uRhRMKuH`WYUsyP) z!xAHq6QlP^Jpp<2=Ha^AI|s@qiB{UZ9hP}6^a}M00$SA{rnUkuD4Qf7$Ja@x)i@T;nq&u*PG-{QKjK%w}>nQN7Jd8Bk*a9O#st%JBCOy-a1fkyO2%Z6#l~RHd9K5?ee+>U8wZb;Exf*%6?>Rqj1#{^pM%<+(sUAo2BkUD@& zfDtP8mISABPI0MW!ScD0v+8QMX7Sv;++|!5|0iwgi(m;!SHi8ZF={FgJjKK+ox2{q zx&jhl((SFt+J*lT{yiUYeAx?j8X(6yXD)5gMIcecZs&e)&WCHzVQNr8QS&geK6v3! zrw2Ueo8pn`w_~BciC1!_Ay1zW&b;8S%*nmG?8s`ij!Eo5m&iyX|OMU*Wn60>s z=>Z;yhQhJw!MOtQWrKavH-yd(Q!@jMV9S6UZoDKha?HNO>TPwIdtcQ!T!bm2gK~zw z912y#`Yt7$(WesRqHi-wHLJx&wcoPU2@to9mD9_s)lSCS%>9XeVyvVbuexxM*qn+! zdi}@2I@x+@Ys0K966D{#2~qzjIQ9>t+3m`{*t~T}Vi}4@8FRv{kjLdRnw3A#=4**) z4KzJt>SR93SH!il(tLJ6jPFwfFWs{-0b2#SYxTn);*0CbOu46a?4tBnxPH;o?AKVj zUGmAeb$)%9t7REG`BpMOKT7$e4key;mPdB(olUl84uL(R>pi)lOC5P)vQAOI35^N^ zFL#L%Rsp7%?JP7LS^cU;ScXFL(tx1sHSfn(G3oy<&V_&aM;qXV6{H^9!NQ8 zz}RDvv4U2vp#r~w#?Z zJ5pEofSBExz?AmC1<8dGC26UxtsPvt9)m7R9I5C~(S=s)zi@NBSdYV4e%BnNsV=D( z<(VD0Fo?Eq6+yr?aJ^Pm#Mg@G`UgqMCKoNSYOwJqab7tE#(npQO(rsL56m%lR`~<4 z9S#kgPHp3HwLPjq&xj6BC}63!BAFFYjEj0hctUZA+^eC&WV1Si9((wES$ndAY2bgz!7A zkfX8!&Jb;RUjy^QXlhT5@DE=h@=4M)YS9T30PD1Y3Cn8d@!};R1nM*yB&*X&QbN02Ur=y63E0L^)ASKV9`BK7ebOxGwgp=TLCNq2c>{KT-#GLizrs8W5*J_Dz% z?u)eV*P?|YUXaZylP@Dr8w|r9+F>$E(?9q~bMbHkkt`xMGl)kt z(}bHEyXpsnfp$8@Pd$~Fm9*b93nFHu3}H1v ztPw2l&Qsh9DaX^K469n=B*@eYmomhtK35pujp%@;9z3V^FmJkYaBRx4(rM!VU~776 zcYMRqn3F6r6J6K`7}n$0KKpE(jlo%d7l@e@|2{;pK)6=Q=&rmH8S9W<7??Os4Ng$5 zcB&g=VrU)qP(UB}ny^67A3>C6DGvbGPhC+da}^=esIbynyi$ibM_kZLfPdg11mJZ% zsn*kl@yJ%Gj&ya^jQ^E_idasbzW-tm@IXO}Lx9L~>b7y@Cv63#1zfttVCc8^1-orrmIloDUd5V}`r#NE3G8d+O?=Vn*) zE7i@OYk&Xm;k6mdcSaDS05{t&v~*2TGi{v={YXP5K=HBB5u{BHD}>3T+;B14`? zM!ApU(ArW#88u3vxVgDCwUtBfbkZ6+r4Ju6-_49RC_iFrNPQ zCn=*$!Z&Z8(BH6@3m$6U+5v^-q4Pef-b>Ntu8H5 zrg$;9i{bvgLPyiKt1Pd=ihCpwG5&=NhP=<=Wbb8Dt6Y{fq1^`HOJZ^_B~2_MG=$mu zz=b-VXzoylqTzkD))@SlR!G>3ml~oW0-tD{>REw}b;?_SHamlhq9byAKMjYh9zicb z;bEqr(}0E2H}nAvzOqy-_nyoXr39`8Q4Z!)x=b&VEp!>4h;S=U_+NxON$*gV;E({F ztYuG)od}@%krI?x=E7`f8;=!T4Zr!0%G~YBLIn zd-eKX?>W$P&*DC3iNQ=u6KI%gRs4&u&;NIAm*fy+mA^&J7Uh`M{z~at#Yah5UWps_Y+dSsron!U zU7~ZMshoZBsAvLPoeikd)ixbu^8y*j1w$gMR3&tpF83J zY*>Wz#6?T|%Qp9{U1nprt#wU(84|?Po|Pl1pV#(hIV0io;JzT4f?mu;PBh~cm;?E12|Uvz&;R`OmeJOnVtNG|b`HJL%F?31qdlBteLE*M!!1Y-o_p1S6c@)0)bLi!f z*(|Q7p!D*69~Ny5xgNW^&Ycwv6ow;Q%nQ` z;chN(y{%^P3snzjY}HJc_*38hNPl1Sq^D!6p+pU7&|Cs{h(F!m8z$uCy7D>k59nkfg4ROhTHh7z;r)_SWX&_^Nx>C`uYDP6H z7aS~jH(RlvU8g*~&-Z3OrYdjc{RcEfAI*5(xUv?wKeKzWMeY$Ufe4?r; z9Pf;8AE$R6rA&VN{wTsJBRGmsv}JV5-MD{nDpApRyMg9>*Y2&#Mi{^q;PnmC<329f z712QMYA;W?FNUQNo@H_UQ~@HHxxYGlYoTzx+IE%`+C2HxSYAxDZu;F^d9m=-s?Lkp zfsvxp1-t}n;XFX`5)^$uOXPAmGOb?AV&&=YL4eG9tu+=UsDErzHpY4{(0W9-?*E~H z^HahRzM|F#xTVBzefyF$D4VH2U;n@*pn|It47?q`X$o1Ps#8tMP>>P9v@fl#3$yQ6csX z>)8uqt5d_2dG^uwa4Pu$ydYR1k)^_fG(&fNi$d_c0CB0~#mp4JFtLkH=hj%)YnCCN zumv&`pJ~{x`s>$ifzv_O$uq^s6|{IA`CPvNLl-#6|%-wu)NCoF1n)Vj$$`qpf}gD1QK?hp!)G(Q9V z9B&dg_zk6ZyFME^Ni!v=Qs^MZXUUkcCcR)v_FZ^I(Nj{nZjqInT_(u}H+(~?W7@%< z3?W;Y`2ET%@71`G$o&KNqAIWUYAZ6#F;H#(r`hIQlwx=NRfi(vn5}|i2WuWNfJVFl zBy6cQ-|!1VUp%|)QZ`A!?WoJ|91bY`f!xMbA#Ms?yzA0;0Z9)$Wd+4Ep`@7EXG4M7QSsznGU9H z$Sdl6ZrJ6tHQd%5nYrxLfzSln@|}auNH?u(cE^oHEIAle021kj;5zdWY_UC!GRA0g zC83?oErhMim}TDb1LYgZdX7>xV=~}pYr05p)gk!GT|&0H&@bjQw2U1#;dZ}{R$()_ zo+?gRfBq}IOXu*sQjER29|7Eh7XIM*U&o6r%F@QnVxSnP-|w;d{E)p-nd?L0$`0|Q zduadfIEEqoG%arwokPVOfeCd>b_36(p^)!_0_LYG<53M2gN8FH z79RIkhnbyR-}dnGFQixunxV8>v5BH9O1hLs5O#$x;r!3z;wBN(L0WenX8C7NmwxBv zFr9E%BWT;b>v10_Wg3tk^v5}g;ygq@e2rW z+t(h>1^r*{AAfAlQ)p0$vWBV5V6&!&F`j&K0#uzDGu9iGUa1^A#2ZpFOw(grw94ub zU1HCQ4|NUI#>2Bk?_Tm*)r5kM@D>tdO)oA5klZ~9{jo= zqV~R;V^~TST*a-&0X!xt6biXx((OnnmbE-AhTkUCVQZIg<$KSdYuCV7qw3Wohu?nj zNcFQgrI>R!H0ycgVygQuIb5cEqB{_rTx0UP?C$J(oRHIo0d=y)wCp?175G&C=Z}!L z4TIw-ZdR*(VdZ}IZf-YE#>)*+(@xQ9!~S`((^EE(#5xr7C9V54^H|Z)B_2->AfMBB z%fqR|-nyCMEtqoOx>9WSpsLh#m(q&w(M;)|kl5jK&7hO>?%>2VV{e*)U>;HF9m+BK z3+KU937X*uJfPm4OF!r#Dw~YlgB$sPU)UYdu%66u$163d^hR2TC!$=X1CU7VsdET;;J;KX3msVNlJ)@o-W6KZ+r| z+B(mD*7duwYhJyscR3H@#TP%bo@O7nrB=0+#d7T=Wa0&V$g=*ZRF)M!qi(H5uR_BX zEgzRAYmlvaZMIw@h)!&*UiU#KLs4L$p5U z6qK}{pZ@ZT`Venic|7^52I2^Oz6j_PJ{)4W0FEXL_^qyN! zgR|MD0e0%OPQi+8z~p(fsaaiYsNg=FvZC4r(=sv4@_o9T1EIthRX<{=fTsTU=_DB8 zZ%#JlIW;xLV!Ri*SfoajL8ozd1vR=lWQMV;e;O6L0Txk!)>lVl=D;Rw#oh9gD;T-O zwTk2t@Q^_-Nc_3)#UASq_jIaP+uHADz6-C|#c%OZ_$K16MXsH1?)p~j$(v|El2hq5 zzh{d?>k2X?>>}@iee17RtC*_h4BCtxrZXg(cHXvVGVF)gXYsI z?|%bT!H-mYg#)D(D>-&XR39+Rw9mGA?qWEw!jUZXt9eQW&`Ktl&~b#mkC^$7EvaUh zT`n`*H=H^9K=g$ud?4X3U&g3O{QQX|^BkbAF{XyUY%=!b)wkL82?q)bUn$}Xp=RI} zQ_Gu3^DA4_%ICyQJ?<@m8~l%gVFIIL@mrtL@Pi_FT8|16JDXVh(Y}JF*+e4M{ z0E+xE&BN=u2Na0%Kgy+3FuA#aqBWFW%rm}IFAz54&Gj6_%cgbMTy8nq`?q7QdqAg0 z_VFC31NB4%WVl*>nJeh5SD3hl!-;s}FTG%;4xPyvB{1wZ%kd_rU$j(%@YQX$#Tl0EIL&<=}^8YdQl~GY{VcRN5C@CNzT|;*a zEg?NL0#Z^U-8Gbe(j`MPfHVx<4bmyyEh(J?l75fpeb0HnKl5kSnzi;k`?>eNulovr zs(c=^wzVHc!E3?emtjF0RZE+^Vw>W;1ws_%iYa3m3fI_)K&S z7$TZd!1j4okg^$YF#BMJJ|*XBbg{}0rohH4C*e0ylYs5O(V`I&p<{^8uOde2^RfP} z*x0Yd=VWzsF{1tCT8Fg5G~@5>=P&#x>e{wt#GV{Ux!4$O|FeHZYEJ;m27 z95;Q#74&f%&!QLnOJp3`qMiv_e79r z#I8~34ZB5iN})s6e)>-^HK0a%LNyc|UIoj^mGgeoWc|tgulcYixlNX!zjWAGR+| ztQWaLUrV`?j$6Y;1*;#|hJ_{NR9S1Ls-;jva(9aopEL8m$iF#bhLrQa4B{@H8JI-2 zQGY^Q#Bus*To1ON#Gk==3;w&p82B7$zHbR3sAS1w>@JVZCyJOmXRYu|Y^X2MxELno zoC423@EZyIkim9b7Wo$XI)O;fS_+L@h!WMeU7M%xV<2l!(J(=x?59n{&Rv$F>Ycr% zlD(7)J)|`=ed2t*&I~gBd~YWA8=^V6Ztdk}NM*gr4`+S3)C?t0A0zThU;c$azAr0~ zoa&!-?Gs2(Oamt}nT(MPF`LBA1X1>u83p&v=k1o&lzq`HZLt^5fqd!CtUas~|EE5* zTF>x4^13>#UyY`?cIed-%iH?r!dc=$UElK`2LNSk7R_MnH6GD)i&nAdW@v`c#^>F@AGzj4`lPErc1y>u(hL=kP+L_44YtoJHCMDxK1!4Dpa$A&9+L1 zUd=Cnz%(c=Lp&BioVFGR#Apqyxw@$+=j6(KLu-)t=4)dw4y<+;brxQ3G>fgKyp45H zNTsB@qnRACItk%?$=++#r#;D;#0EN|F@PB-?WL%tpm}ZGR`#Bp{lzo?d51t~rgH#^ zcwv1`P9|hM8mg?4@%z-+=^&IztspG+HP+pnSqwY3A|1idKHS#dIt}rgOSb(HCSem+ z^iPf%G}Nfr{8_A(N0nk?@EYun&%Y%S55MCVI!Jk%j0k08Y(zO8wy0Y<>pM5@4`4Uz zMSCD2a-Clq_DWsyNrb~}O)2K6ih0Ahro$K;em1ioYlsZA;RRt_eHQ#co@$Got~^(8 z&L0$NI<=a#SHn4>M7BKp;5R{wLVcnhbA)jq~=0MFHRb6 z$_WZ3==_{kk#IsW^yv8tN@)h7_bi8O?F>C!lPf&bP3KT|?>?MFqp@>h7TeHHGsS7r zW|Qe6oBikSkfvSCS839p(KM=~vZ*x-m91sBZeNm0V~mg}?Sz|T(x|>Gni4Y?E$t!+ z?09Kqnl2A(Sx2!7XPdhO(%fZJr^beki+p32M(op>HRRK{kZobfX;N&WhPVSY23FXP ze{uT1TQP}JzVsZe;d@n9vZhM5xQgwGxC%)|QSj~KHB(#+ z8g8nIh!tNpbZ}KVO9uutgW|?v|KCDiS`S-svlc<|s0ZZ??4IBiGUSF)JtQD>uBu(d zzI#v$bCB!a8T5Q%;8(eDekO%d=}PzNVCU`T?J(6+MX4{)Iq9U8wBnhDzWR=xwUp4igbw` z3oGq3N226-ciq^d;=Hl2F9=VpPC|K@7{>9g`Kr1)*&qR~%ZUEULm|q=S`e;E*{g}% z^I$TN4c@lbHwYjv7K#V~bS+h*vH9{m|31Pn*e6rXg`cs|0xTv$9^M8DuLu`>q6@KY zu)5=Hha9cl|!8@_Q_Gs3aYf0Ix5EtbqH{bwXSN9$$;5gTVr`?Q`=> znTWC{Qm=5M0yVQ(8E8gG;KzM6Wl!uuquYaM2JxXjv8aNpUXoUA z!k#U?qcc$OrG-p^6SPZVUtf+Ez^7!9-^l}$USp9pzp*>tu6JjRWAEv|e|Y(@KJT$a zZmRxdh*7(oXEz@HU-`hX5Uo^heIfD7OmgM;Dt^on_JWXo0}+zO$FDLaJdRrLT4Xx~ z=DvCU$UDW&N&x?Lt5;>DsU&O@=dmwLvQ4w>u}mf?gGNw3 ziDn5DwS^tpL&Uv8v#b&ia~fNAO{NEt-3q8PhgYU=T$ofoxr&i1thajOFKeLU%88M` z*&A|_+~oVW#DlR=@A)5U;sD}Uvly0(y2h;`$<$qbgLBTLHbe57kY)sQfhq}T|O^fN}J`e_4U$!S2Nh+Sdw zaNA_TZoqpy?%t5C#LyWmohn+SS`)jWw8iuc1L=f0v4-(?#n6Lh;9oweI8*iA(+uKu z8wx7n%siyhKq@nCZ9!Z@|EF>Q>_)oYT_a9DCXT1}a`u(>^AYVy+IS=tRONvkXTvGH ziQ6F2yOS<+^B*%0g^$ZbQI{g^02aq#fau%Rq;Q=kVY;3_-K(_fB|4>=nfW?zt*3s; zSWo<(>4AUzKBKQXbNCYvJN-;L#h!T6P}e3g>}kL{@aj~@ZHnvb=z z^0GvVUSj$e&?5w_q+ek=!kXZ;&eY!2?xxr}P0?C0^rsnt!D~du@S0j$@@CB;xk=($ zC|6H!Jp+bNK(#XJx0QoKra8VS+YvvX+K#QVvQxrg$4H3dvXrAU9)F{=o16+6tRw12 zB`xA?YDPLa+1wjrD1pdJe)82)IGp(VTeY3f`WQo-&QM=Xn>M$ND8YqO&qfx4x`9%1 zb_c?w7ws#U)ttrgoh45H3(o+D7d0!g@1escJzPI7XdL^;FG&^{Z-h%Lp@nOnLO3qB z(3=^lOVu+dTrwGS@y(#{V>Fb#n32Wb$M+gj%jG_516i#Ft&YSG^ zZ^XH~Fm|DGo%!8G%N4f$c>)S1rUk#UIL`Q7N_>MD_a!;eY*sPbj==U<)}Nj)rJKbn zg|Mm|zU%f$83ph6cvo2@^9w{;j%L)l5f1##IJ%{*DfmTn)hl?0UR*xOL&WFDv%8vun+woUxWbrR`h(Hngr>Ni6W59Fl1B+R{;tjvv)1q3#2nr>|;EIm* zI8hFZH=d#vQAOmSOD9wR9TawLPV>@QzlsjRY*Y`RcdVK+`BgqJT_C+&A*e#9Pv>zc zVm~|J;SBRT@9~|pw1LadYT^R9gJ>=u(`mOVxAy5TvqqTnpCU3fmsS&7UsX*YhqYtg zfza@DUMM6h1A;-Ph0}%nHw-Ew!}~)R3fa^#z8)j#A|8`}P45rumz;-+mHs((fy38H z%5&6v#pNH6WTff0U*wNHpL&(4f`bX+5Vj(+c8+}?ViydoxjEc*tqlV@E$zy6k@$+W zLQAQDS)r(oXrJXJo>sNAP7D5X0WHvH91KmakYsYY-2HjWeu8zGkI-fn3Ts)sJ!X;l zhCXA)z_4|ucAsG z&h;^Lq(tuR=KN%Bc!^&w{F3Dh_cBb4kf<(5kAzvwGtE4GlQS@8O>+1s*_* z9@TuLt@xuc2&Wg&2~@`g9BWMi^Qi)6xST95?703p90b|h(wZSTKJ4n{SFt#@g+&x+ zCXMH}D2>{zp2KAt&63xn@@69NTpf8-acFqqA2~nK2 z+5U)EP!-;o6z=UbO?R2shRI;fVTbL4p*mYVM=U85J$*M`1aZfy8_-r&naka2)O24Q z)xU|P{1Y=yLJMSGAxok$ai8`BVn`eD?z1e?uLWPrlRFDu*5jXAz__cYXlj#K zC*4|E z7bX1eZcMsPwh^Qc^J2pfw}(1WmWf2CEX#bncBS@OV62#>RxUT4?o$|fX;y>kT8^x1 zZ@TME1$9hb%96gppm|f?f$mQjfY`KBqe&%O)A$w4{aIq}x7%V&u+gx3dMu4P{F6vn zjh5KVfOZTq`(VWG@wvCM`{|mGNl^R=U%Zp&?MfEpxxe-f;PfDZoj1gaLN)|6I z9((K_okUbgJRLE$!GL*Vu!S{8So;4I{C2}gJ)yP3ZlM~R6aXk}j^E9aa>VsBg?3o8!Jeaj5B&h9d`pVl;oU&21JhmqQq_NPRFmMVQ5KL!= zvcv-!W#z?oq)~#E@LR<9_?6Ns?-h_aa9=v?jlAkJDa-wsnf!CpDzcfXc%42(Vhg1= zLYrlU!ehzAg>$UxFz!cqnq;?)tX+5!lm!)qCoD8sVg6M@6>*II2l<4dusSSF_ia(H zPqB>h_(#wL(V~iy#yu}z7(ec$kXl+etLj7C!VVNp;er33zm^JcWxH^E(jaoXw~dg4 zE8Za@i>fR?&6s}BDll?#cIw#HNS6uE6$o?emTegSDa@jJpweWdJYB2^>zR&iZ2T?p zn}$z5k{La=uxgNGv4G=?FKELxxp_sln^|5r=j^cTYL21kMB`_etpDvM%qJqwgEHZLEsCwub{fs;WX$}8$tfjme;UX)@|Aj;uV}t>uk%uX3eHq#M^%7XopXX{2baBNiJt-` zX9-rM+WE0+JoTdO``Q5`5<-bsL>u~=l`Swp9vDK~Ntn8-lH2)BxYn&BErZx5R)#q& zHVIPzM=y|1yRP+nluVz;HSdD>yRYej_)7nb#{Z&}-C@A;>ggTKzYobx^$o0RDMCWc z!mMa;l11=#nn>S8SeP|YRysQ#P70X<7qR)?k9ZxzrY@L9t~zgnw26DOX)P za4v21VDSrP*lgns+7p}yq;gMy>8_lu$~>FDb9y+s{5}${z@tH|EY0K3_pPh zxbM~9p=+jy$I%ixpk3f%x_!L*<3|a%J%ifL5R3S#Hi3aS9nRG6naiTifFJ4LH`!CH zqF+BoN;;*M%svs*Ny!oD+0Q2}V^uB13U0JcZ#t-vb#J=AGSqP$dA^U1%#K>Lz){EP z==Ftn3nb8yI6sYIt0cEh4gM(2@tu6j5&c668a5uI8$OQpWLpS{*w5BoJGjk>?G&7p zjx(ATlJEwWEjTe$gr;5RZ)g;^VI?vfP;zE*UYpcX#Mof8L3sY=M>Kh!O~Ypcq&N^= zmSp?~X}l^(v8mF)ymGfKnD(rn&{?(qX2g5-cI6VMVwCZBO6GNn`!FlFJmc@#bJ&*$ z_4Y1ryi;H+ZfpULK+~0N=t*P^J2xo7%b;VD4M*~^QZXda0&Gvk3z-_OVe?!D9h z?vfyN1;9mt-Kei75*z)%D|LV$uWW+M3Jo%O!v(@Y6Ptu(v7cBOtZTJTaIeFAkj zyro@W9gDNP@>nt%?0yV~ETLOTc?I%SmeE1#L?`zO8=+ltY6-cbZ{!>~#WYsmlFBIm z?i9AQz%j90$wc`mxONX;7uLtH@)mf{4Jp^j=;qP}kbSg<&!cq^qmu=Ir?!MMUV`Tp z%eS-sxHvS53`Eqh+pO*sCn+<}3a`F(T9hqzpp~mJ{fW@TjB-et0#5SE=H})igomkT z*Q=HHoNpys@3uGv15Z%^yf8`YMEUjceT}V9C3@(m462SBb;mvm5BY_R65^CS%;^Nw z72gND&M0)L2Y^IgZzsZX8o4HddVjZUqI})lWx4IM?GuJvTP0l)$$0bkQW}kp_b61| zkldQQNh^)KyvHHfvb#Jv-O7|7Aln(ZMD_fdI+!K#EYcF&OT#0Xya0HrpG7($ncPxd!aopo#}J!CQ!;sp z@-!yu2hHHkUAwy`|Dy=O{JXA(k!ZTSu*T;7d2s|gf(>@mad^Q(9WlG+cM`POj-gfX zQO;;!!g(8dwHk_B*t{3jp&bKP6JUq)@iVHV!m{vEAl^Tso}m7Cg1+{%8TX&4)!*1@ zBxbz?Na0E{jSMNrdj>)KP!3c}Z6lt66{Bv|)GIrX55V{V*m1~KSrZBYRebl(b4r&> zdg;&K{WiVG$pCvo|>fP9h3XFYLufvq0GVN}$1((K5Z6^S_h-(>( zL9#q;&%hg;X62aWu$>*$D0gL^vCy8a!af5D_ZRiORN_BL3sp9Zpav3X-c$yYYNeCI z{3SgCZ|5r?6)PB+w2~ti`d+6-G6{KAMbWBejTBWX3t6kJ5-Pwln?J5e6R)e6QH%tF zWC@IPrmF`SrF-q{aRMgjEyd0xezc9d2rr(BIZU-3_jo26zl;8EAYn|s=C{0WWVyM? z4yelL=S0FTNT+q|$a0+xQFW`vBk^|AiWeKl_UH10F-|D$VK=qxBvifI-`?RDK?GNQ z&Nr#rb7-T_O{_PYZdW%+fH~lUaDLOBYbF!4GyZ`z;iq_Yn<%}_ zitcp2sL^)cdjo^5=x=p=&^ZjM!!oV3<4WUrkEfPu|X8`WP=7-7WwQ^!@!0=X5>oWoT9JL`z=4{|G8`1@opsOR=4rso4lYOc#G|WrV-SPDb8QrGMS~BZ@V@os6g>tD}b-e@g%k zT~|cs233N%0ekQElHSTqMSo0g>vW@GEwfqTDYwz`&%2FoH`!#1;vq$4-j^x7mKj@> z$Gjz$L*!?v14_+aQZ|qcIP+ouGV}$xpNjHK&6PDC{(9mnB$mJGcP(c1EN&{)27v31jZWu$9kx!ho zs8dTF%#?>I-jd zTm?tADANfS)I_l^w&xLIb2T{66D*EI3i+4>G!{26^6ndC@8hB;zH_ebPc@8M+L4$I zC!bwCW2i)5Z0Jj#fRbqSb&2IDDk3*{YemI86U#k&Sclmp&0hAw4i$f_liV$S8e0Av z8Ckz?8mTvWohx7MAW^ndu0?e@>2@kQFMEi!vwqCG|NChK_j~`c7^F`Kw~5GXv48P) zFK2X^2CX2eQWVOn#2~o)n0w~Nd*V;)W^!R@lY555)c|xw^H9RWk69IQy54+$JwGzH z`&-zEL8WdO%xgs6{^HxfDrltRRJZROMhn$_$8@_3Zb2sxvY9>=;@tP{t{gjW8T+5T zz|-S-wAA>Nfg^WWegE^imcnHANF@l+DjX_Bq_f~0Xv8@Kem(@v?+#dvQAV}G=09|g z{YI;q66UG=7_Oh6xOtN?ytJwG{#0atiMd%uN37ARxj4hNpZx)#-{t&iXSh0|CBUGd z`_P)u>e=GO;aYhOJ}OcHeSnO?g)W461TBLIYMHsZeGxFig7x9J#(2=S8(wC&mPD6q zk6POL=5Q^uN*SM(wY8>ivH&NqHNhwCt}^wsJ#O_3`$A4tP57QAi5KvB_Z0c&j@M1f z>BfcYrs!8mf!jA$zC|9fKh3>S+qeJT_l{rWVVy!7LyL$a!lJai+E|TcJHoLEmom3SRP{-8Um#ei()jR_8o=yA2@OrE_P-`@H$q*jMBr7FNKlT%f8*`fo`L&D!^|(+!N+H_jnle z9rp$LZm)d#JJpQ~0N^@JKf{}6rsKl+Fh7MToA!p@djGmI5a-dCLX|>Dca6Db7T61Z zYrDSE^aooRKmpJDyPMh$EIx1>5^Lq#h{1*kLB<(OD%w-YK&!T4_A*5^pU+^Zbr%sQg%Yd@s%T^N!#6G8%b=an&_4#W=Po@5ROb zeSTeqEWt6R_jk?{`p111@K&c zOFcStZ25wtW?Ojbgg{8AMy&f;WgOEDII2TG z1D#S~()<$!pCi7LOQ-^G$zcB$0{xn7cU22>s`J%a-A3bmP6^r2)|0@POngh4_NfsPqLP&KEK-|3CF`zVJuO73)t7ZNXKo|^W(5vc$2WJ4aVMc;0P zcyZN#6}<S-2(NO;-gP>S zNe#T~h0|_`+M518c!^Iae1vTA!Dw;{4FzZ-oGF}USdCV@`9t%d=`f1^bI>a*r_L$y z2qN$FN%%g+@Vmh&U5mk|djybXDvJFSp&I2=o1JMTG#Mc^7 zqF}!)y7&hnZypl{khe?ai2sdaRl9-vf>*2|#n< zB=q=9s*Ye2bIQ~8r~PQotkAsp)UO-?{7KqpuT%HLmEu`EVD@5}$+P|&=t~!fUtHAW zo?@Ek*cbwvFIP8g4F@zdaW*Ahk4|eAs6b2sW*H&xNGefdvC0dBRB1sqUyjhWXBglU z0`dJ22mC_*Tq~>%9h@$p{TGg#!b^qB{}_5XmiCsvJFx5p$K@MN=y+Vm#Oq3Swnc7g zNO}pt@}*VQebprSnPN4svl8$w#QMtUv$HRXusdj9lkg|%$Px}<(GL%xwODApw~#&( z)$R+Zcj=qIs{+tBoOi}mN<0wU{^&dU@nYT^q~Y8)vCr#AO5>vR0c)x6_1lvP##pv2 z3A#UhwFpOY3Z95+6OQ8IM2>zT?4=5s?~&|FrXv#7*APy)VLE?Oq{_k}c96W-rXTXN z(6<_Oc`<*Zg8jlnxi9>)3x%tl94YUEeWk=G(~GkW`7n`4atG&h;4eP?g5mc&WNm6d zd@@O4i_U^*pF`WavyDH)ZWC=n<{Hz9le;acl<&z?E7SSO3s=!lt*_ju{tetRgdlSq zllwG9;y)4cUXc#_YU!pZOJnD?ziu@$r#y`a+&5KHd)tgP34PbaBE3I&^myp8`q)nQ zF%xR@%j<=gLEll;(QH5rxS?EX+z2o8Mx(tc#Na=!&uvxKOX7E0Z zCe8|mt?RrCp)@C}P8@gi7cC|Yq$4*Cgmnx(x1iF zBQIM7IIvAcb*x=z{{3HM_byiT1cN-G2^SR8rqvE=aaL>mX_= zZ%j2GdGn+e=M_GP$d~*0dCA>52?lIi+Ca9mxWp;)g}&1^Mo#?T<~dFN0e2zSgm7)z zvyP!nSsJ+nCndX7YF(x>UwluKN46B-yNlsMCRv0(xXU>=3WY(ImrCL1J_a1~uB~0) z)|9>rr0mEpkE%~&X!KsB>vqe%Z~wu0fNF1mZY5d85zQ|jGEY%1?cfr5&prF&)XQJ* z!Dp76;whO|BR`aZhBQMt%g&bM9* z*HtS}er)74q3Y$TRe;T}Rb)_az_kEs(nimIVymYETDB!~@sa1l!|Hz5w=3p0l*pc@ zsW)OFImvFne7}H^$H~1~vb=vG-Z|X(e6l|r)>zgOYt2MnbTYa7lBv4x`0q<9OEEBM z_B(Chsgg4H!ow>-$p|G{q>B^gAd0kA#SN`J+6^I+}P~Ov#~-;@C|%AV^3!#o`p0|B3eH zEC&AxRpnmlU^r&9PcQwGxT(AoY{}s24cRc9!ns9@78)GUH2RCl~7!f>l9fcK^5e`>`bT7`*7}5bG59tD!uSA^KTcc`8?+ z`*sMvIYs9F8kFY90OhzzLsqEl$ZpaJ{0vOBnjjSPV2?oKdhuaobS^Zuf;}VCzc>al z=ET+;v7eyW>(mh4=<$T78;Uev7u}ang-W01$cu{4a%kc$ar}jixN-kfQu6SP9ml77 zGYd0x9~?aslgh}rnJTCoF6yK79@apHdJiG)x(C$?odPvq!=?Vrv?Z?2{QMB*Nt1(7 zq!M^#Y_~5J1zVPKILZa+MhO`^L#0Pzxd%}X{_p7IGV%poYgK@{;;7y~Ly;?NmnJ(y z50Zdw`yRdL)eaS8DjbXGh!y%wwiw$6}aLJ|$-BV=X8^*U-tmLoX#RTxwSTlWo*n@Zy%^@kW9 zJptXXw~S2bA?zqT5>E!7pt! z?F?++4Y`0rZ7=%9&iBgG4woiPZg(j$t2THwDq8JJz%%5MW4EPOn}z{_#zE)|%ALaL9oBVQKlri|W#<?e3h zRlVcYC-74@g}6LD!MAAbCkA63vxi`(Ck1;-VcwXzRzS}}dIj-V^}RYwdiIw&k|aU< zKLiq~Phj7DAf8WTZylXlg`aY{^xQBWB(G`M{`vLvwLQ_}NWKIj?oKSbq~s(c6+Ak5 z0^iL3d}`K+4LOGV-VwUbVHRE(@zG%X5KRHPNddd((Q|gjs?)Hv%U`Gdq8WoejHsaG z5&nKA+ECHU`|oC^XoeyyCV)3Ct4pXO{+l6+pom+X4vvbiWn+Cs?0qXL&XfBLBJ!FE zROm#BURio(RV$N4U@M*k%(L93p%?OGt#FyRSel4e###cc-4H-AGY!6OO%XyR;3+8Y ziiTqfO@!P-qv9U|Hq(|UvbRl(c-<|SnjG}A%8r&*AyZ+#7O%wK zqIHkZ5*I=wtzIm&osnXsU`r1>tNme=hm~s}GUPQ;P%(pqjyH1IK3CS$$4qh^F7mB4 z=;RBJQri<9pHkbVA!gfNnU^J0rjT%;}nvn#!O;+#dleoB#CG}o(g6XVGKatu(JUg$B-m%C8?G7#nndOK-6&inJ#iCMEc>g{eg>gdbEmrOI z@_A?2N2D|%VF8^R&3_>$9C*O^j6xIMguDQ;+kcR~dnX$7?C~RBOwE)~4;odxm%ehV zIv*07_xL;Mb;RT%{w#m{@eOPkY_$?JZTb;u->JtrG9daqFkEP_gGepehfKP(aXD!? zL^!VqB=;jH>mclPmwFcx;7k+7yGj|76MWJ8i8klITlXnS?HaOZsm17q>i&fP*LjrS zN<(DdgaL}d_VWf?3M=n%b=6Nb>Z_lHK7W7yi9(1I-#x;)msT4$woH!LqKQRwbu%u% zQeC$>TKYKOFPMKl;j#`ecCkf)Z$(>E{UgBOBrp7cF5+C89f>NV?|i&f^I0^2 zY_-m;VIB2dq*4@&ZNSix3&!6asuHW#JKIK*J|`-`qr+=p@pV8irU}6lG!oUE&T6p# zjj(lsv|T|j4$s2)WYl@;`Q7%M4gBUwiAlOpHjV!<>PnYg(*dQhPPFB$tJP zPkCs+#K{f9-I!D&dQ3xbM*a$fqA^>8%>Q9Iy>EnnhO_?|nY`E(u+)sQK%f6QOEN3- zWQx&rB}4S{P3B8Wou64LrEZ%8&_WFsf>Gl7jY7FQ4!PDB@hniV+iCkLs&!gR+d$pZ z0`0n5zSg-+JU?2qCi&=#M%NE7<%(Pu3S%@sx-S|qgHHh)uf!%fLju8?UYFM8kD^g8 z9q&Se(3!J@62)&n)sJ@6=1hZ~d?=0jTMgoic&Te4hb>FMY`Yb{*D@_QO*|-Yp6w-G zXq}42*;L&)S2C2l0brSv)c^6dvK>1*4bJvz02b zOJs7QWd>$Pk@vwZMyGWA)16*df-6yD%BG9fIX$b=y&82gJyG4h!QN!n!U&vQdc_}I zgtR#E?C3pKW3LCaIgMDu3D}6FF&OWRq3f!tfkGjGR-@x0tDEEp1X-9$5%O_Xw!;bd-M$&;LB|n zTR0MKAf^fG#yEaVEXa6^)-ynUNew;9C+3|(BYpF0$T4i}qK+BDF?B$v$YCvmBBBTD zdr-MduMmv@Chn;dxz#T%ZC!SuKhc6wqCMh~xAao-@i350?pCf>#i<~&x0*x6A^ z@+ypC)l9|I<3QF3!DF$inVKPTFksi^9+yLDO9WWB(>r)J?!7s|drDcQ6p1GErQ)t- zM{IP4MpY`+z(Qa4OO%h=jQU3R%?%Hk(l$w%0O|Yne>Het8!*20t_;0loHrDYvX@pF z2=hIfP9VFT7$THwwU`q~kxrIL%>_S|2vE;u7T$kD6{xX&D?XsE?_!bl7zxcA?jtIY z#PRkWPy_doVA05yds$yiIEaK3T-Ld7N*B7YbcA(skaZF|&~8(@dxaA8f^3{0H*(Cu zVzT@-(~4s>fua7MH2LPi&$`VEAP4eY5L`;P*OYt}>dX>UoiX5Epqe>@B>TGF18~2C zF7qm)4_g`xzZ(7bKAAe|Sl-gCQXt2mB={d=tA(;_zy3Lvhbg{Sp) z&y7$DA+TXC3S!C6WCd-H%Piqh>rdO*+PHd^1*j|0h*+2u$F0f*eUf76G!^k`6$dINgkVHis5M`?C zOc_YtWkIarz)nzduKe`@kH)eUA)G~jdd9Y=RC~fb$L!5-^xQhF5U>m1?z9`QOSy09 z-M#$(_`~#4Q3Ny@QIXWjcxFR~YSq!CqgBs$}#^ z)%DF01_r*--SPpV@K{DrQcM6`X&~Gsw%F)1s|wzjg~hsvsPgs7EU|-H6s#B$F@{l3 zRsCOi>sH%XJw+6kRn5V*#CY=i!x3q08JAkEd_tpZM@K3YIYz!-C_@9B-`!_9!;AdGMnALlqrZO$nxC}6GZvH$R zN)#DZ;51z%EBJ6sEPT2r#jb#dEMl!9)9!v65J>N4_zAt-$r`15Z5-qIgx35=r2tJ7 z1C4V)#6CfliEdfrZjiV8)pD0#oOUu?7A>wI==4-3xCOAc-HWXs(IfY`(gWQ za4`3R{C{#KdV#0hmfBvMk08pz%ym~VF8R-_Qc_X`j-3uTL zq09g|pnoq;A&pg4Ne0{0wH7aK?PuSsrLJ!=e;_hW_U~a>v}<^=jKt=_x{IhXg@Inn zW4Gc=462$El=~HK*wGwlfw`k%@lEIin=YBK!pA3DiS4?b(y`USJ0BN{_~h(NJ8aTy z=cA~yX;5*Ufv2Md_dMx{YYE^JqaOWz!-JjYJ+7AFIBk~FTVDZ{hY?S+bA?pE3jXH? z3p}p|jKaa_qSsS`(*rzNOTQ!~F6xutLL6HG4r@snU(u;;5XP6jksr1lkXMY{!j+zm zQ$bww;uoeCPs3q#G{I^+xt_*=bNjDVzMIB10s-7zC`z8>%^Iq;+K)JYjC!8lxExFz zrA45@>OpG|2eET*qY3PXkB!e#FTS1zSK{=N48Y1GRyFC^NM+`nwZ9#7L{y@^I@?~O zalxSISBNhSqM7Uq!%dJB+zORYO9fMoKwHc=q3+D#O?@98Nv2YAru1v-4J6k2v;3Dc z2tyM~+QYq4-YzT{xJKb_@2N(H_*5u7;^)ABU# z?$V(0@%(awSa;{ykWi~6O9KHhydkmr@(fC_#}?7+-FHC5wP8PbAaN{O0~|=yac^m} z3Xts9)-mkyGrk6*t$AOq{i_L7AxxHDg6@|})HgTZrde2EnV{kE)ojW6@#O9Si7hh` zQxKZMWy|!hAWXU`q4A+zAfYYHT0{R5uuqvCQXn<^}-maVCSAVu~`iF_G zQAn`$BhJtBU)dm~vr45d*2+J&S{X8_IGS*QI=UE{BECQ9BKWzcE$1U5W-iRk5P~Op z8HxVJW_f5?am@3mL>xE;IV$U9}=h!+HY2ggbZ zGGxH4qqlixl#oY#no*e{JOb;&iO2b89%s(d#p}>xfEwMWGfXv*l%7;0rt!O2^#Zu1-=;p|APELUeVHWu0C$$5RNEK}n>i z8uJ#^%X2d{kPNAWb0%B;&wpV%{?Lx`(TFDAtBeExtA$Y^2P;YgFC}Y$JYK;Q47|-y z@m#PBEWZz`aS2G4-d)G$?@a!RhUP?I&HPcYVAB3fVi3<|(y2;?p+l%` z&7yF$e1WH$Xjwho$NcbKA1EKWrX}IFlnc{Yu#?c?hVy-_FxN#Mp&jkbWuJ z-*>VZnGu)iM;+O4B3+Al~VGdzlRNe>N)@f+vzEx}` zk0KiJ$sbw6%B!`+x-prh8uV_LF5O&0eVL&hhUIoSe0^qqB5nPeYtIfv8A1s)(wqEL zieYZ|9}G{d_~j(6g|$xRg27SuJ&~-0>F@iH%DZs(~d8DZbT{N{lctJ zuji>jR`GxC$j0liPXAe_upAK(KI6K3*YW&yTmG`Hua#PwBg3h;{+_`c-$b9)h*MYE zYP9`*|I`t?z}>&{Bzl!6MjPERSC`U$r*rXO?OkZkhH(+3yUvXaX#7l<VJDmf2Y-2Bd*YDwmQX*-~vS)z>L z#P|%nPVatJv`PP%=|z722*r%-$3<}!Mt=q1cUbker2rIl5xrd~?dGogqXK0DNHAQD zszBfy4Q|yuX&kSf!sIWnc)Cqyk( zY{#cqGr7WE2qPs27|f09ONBC5{|h}6fnM9f}!yJ$J_#^{?w|Bbxdz!_OTA5 zk^y6s-q&zOflU*k7kT+IPpe$-!Znr0VcEIa2*7>#Zp!zzaCC{9O+7N6v$1ClAcpaG zCRED;=O2rq>NXy^bT1xT4)`&rBEc;{y^d~a^nWkMv3-Dsf7n3S-57HJD{=EMd1Qj& zlz(^f7Ci4~l(CozWhiTN8mueT24Na%5rm~|Hxfg;flkl;LL)pE_SBrO8 zLrOQk76n>B0g2249LWbr37|})2MZdmm}Y)M8CZ1Z*F5`Dj0fZaJ@768Hi!Bp&-3B> zL`4)I`$y_6*@v6p2qNK&!q}EGe@>NmMyKoM37Nlt*xBBBU1L8=-1K`qO1|;gyHogk zYaS1}hPs-ZejsndAz$X2S&?X`dL8Z(Q@~eYmK^9vY z8@&$WAhO6^)1qoi^?I`GhdlmpTM1DVdJwpn4AE}|KUBmiS4a)JTT417OP;80^vM=E z`Tg_6r>f-;>#?Ne@~B<2f4p|Cc`@1}BK&ORjDkJX{!A(gG4~cYXX}DBc7`RF-;{3|4REl(2XO%AsH%-s z(zxJi^U?WM@r+%>A=VEj?07g>=+}noWD=AiSR7K2J5Ow=Q6sRjC)&JEE(_+-3vA1PK$Roqbsdw=td!*rx>78_et)0JK{Favf z0y?)6ba~+GWI$aYkD?=;J+5AwpYy^WIgn%s55K#%5hI_QJWiCtHDvS$H$1h%5`^aG=bdh&MpD_ei>wab9w2y;&lFpT@xF1&D2QI?$117 z!otH@INjYG`+>L7gL$SIuvUItRUxZ92-%Pl*c9~H%01G#zxub9U?6Rq(u2F!sZ?U< zEa4#<_r2bnLEjHC#k0JZvwK3%2+&cxc9W&z?`xF+$C9Ta>gymY9Qu%Dck9)O_~eD-uHao#+3 zYdd+$SN%@86Q``lj;dG*Yq179D3(q;^?hoFWjfV|TzZvBo{uKGrWWfZ+S8p;M&xXb zDcgnGTHUtB%egarb8S>kO?IRxwen)eOdg1#Gf6X}mkT@Htq}D~HXmQU4=+xs?H+%| zwqI*pKLk76t$5czyYoG12acJ^ZCvZecPo$8TW|Nfco=jhHClg_-y=w6ePdcqWqtBI z|2&K;MIoKuWM}@VkJRbD*Dbfwc@BU@?;*7G`qfW9uFY$48$Q;wOhu1EjUGEs-mMrE zkVTAPJkG16h@<+lJ*)>m%tqbi`&_)cJ5E2B2>asMvs&+cf^Q>uz>hsB@cMwq?e)Ly z{ejp|l|6;PTfW%*;4`ViVh4OXe?^9{H!{G~*+(A*)n%&MM$@&T5k|Kl8|4B-KD|eF z5@3&qf4^8S9g({N;^JusQJ-zqupz3yXZfZe-( z%lCkN-?bLV_V4hSEk=uQPzvX5GNVNp%lPY2DwKwGV7p@D=!muuS^^k#?I*&waj>#6 z^Shg3f$%{5#3N!H!H_jl=9i#0^J6ns)KLjezh}#0*g92{Is8%=5S)%C=atGDwDHX& zm{dOMiU=8{=Ox^7st8^?WmKK3DO6II=RpyQVO7C3V}$+z}E-oNyO(vJd;1l;|* zoJAaM-oI9L;CqSKq2DdPdD%`Eb(eT@*VNxu?=io`>TQ2w;Qt*dgl^`|k4l~AYkNQ3 zqsmX%%&k>R4SmiPnV2h9lB~vW{;g9iI8+pMBq1S1U~!u&r{m(8b^R%>f8wgA*La2( zUllmNOz3pAo1EhlPL(V?Eqw=e9umuX|A!TZ#xZJ&IY!Ql*m=Y6FXh(%GcZPqV~S-F zoxphuy0pB`p1*&CoBK60tSt5WWb=MP0(+nml_~A##xNW@T>88t_9A*ru`EvgpgIqGm0P?NuIoaUL3(B5EW|nxG?B^ZWVsO}A4t5K_{%>- z&;|VLbCOhX1_f0BBUSC!_{wAjLdq#q_lQ>vu?mvHxUTo9?+XHX+Tc%>Vhsp$Whp-7lJjJLmit*3oGK}SM z0%Gn+63-bt9pg`gUP3y=OeESG)dd{sFRoY&Fw@R<~>y zxW0?5Mxyi^U{m1tly$2qAdU-5;Fs}LysjFo>X+69w{a9IsjYlGQ6sKL-NmfLq)BcJ zF0)CVV^vku^#?KcCYtb`fq56!JV+}V8o@rkg^k_qm=QzyzJrc*>Jo6Es|b5 zgF+1tOK#>Hw30MKlr3ntubU{6a)8UGJeE83Ev0j2cr^2Lx#a|rJbujgb^q`-(FV1^ z!#=(91#nkNgxU-aFYy8?akU++7!=Cz{!gi(8pMT|A#NX{h5VB&ABg@?lKbL?yy*Hy z9sXq~rp|ojG^b{Iv|qD;a``!Sdx=iXKi7q}%O;VNdWUf;2_Wk$2nefXbXZ_cnRB$h2YPv;5F zh0LahyOVYwCmfe#$L^xMeYYaTh$9aw?$CN_fWqSFCaSeCTHW8rm`1C7x{To4YaY{# z7HzpX!hxUBJKaiMSL@XDP_}W<78y6df60+(!7`V=r(*yTSyIsq)AqsydV7|M9 ziuFx`eDTLQ)dKq^+al|7$jdlNR4i|so{&5dwH1QNtg&HA3YCEIvsqQ69J5onYzV9^ z;631t3?r>~uAveFsa%o5FIk@VeOb$v3>g*p(1``$E;EytqQWFeH6hRlOt;c_2yNc8 zMLBtbZLBLr&SrEBZc|au`E43Drf)S5fcdthJuT;%z!jpD4T-$ zbL9pqE;EZuHK$ia13;}9rVJXNy6ZBls-v>B79I#0-ciOKpScOJ3h%LfddiuB8oxc% z{m9k&%G_QfWciCNrpy`823qSVsox{)z6M~1_na4CeZa`W={=mG_U=IE;e zHCCJfd{+Gg)?rJM9bCHc%MZI%?AJ+^eqV&;5lJu5u4Yoi`V8zAG9)-WzPo!KlN4v} zTV+YXy{i}vfDmnk8IRubhk{T%r%GS(ub1(uMR&&cbTeP>W*$;_cpMcp1^)dn;geya zC;aF~etuAcu+5Cadm|Yi!&o3tfY%pt&B4u%6zl865&1oKeq#r9bU%z`I%v08R(|;S zxa>$4Q>9cR^2iL$oV`uICiJnDITniIiVUYjY>|Eze0gFY$1#+*D*e^MKECz$qZkmU zj0gyVi=}&#!_>VgvFvNXwaQg^5#0tQy<^9~NVp=X3K0MI^joDVjbLmRkpg-VJj>)9 zH5BYP@nE^eyWZWUC^Jm4?_pF zn6hqYgvi()tdvh5> zcY};)xpfRBbI<1@%IIFl?ckA5Svx=uYOs31>X1r?`bwYI$*Ayi#GC6v4>if9-0zsI zhL4(BvR75Sf2z->Pww8|wZV}qO?y*?{%t4tR#DA>!`Zr6C!Ve$K6!FB!8NhTD`7b~ z8wJ=jnm}u}Pl?vhV z%FS5;d1vQkTyxLdE0YW=EYqY?7vmODHAPM;G~YJNkTgara+K_{1P|7xlTz( zjr#3%=$UPQ0P*}dLBw5doqVJ(lomQ}N}6*2jN3tT?jeUHyYJB0FP^;*?T3%G;kS5x z_?4l(Z)4|2U;Uq%AsN!;*jQ%LB;KEcJ{K~uGHR+sQ9yADoQ|DA=w)v-Z`AKTJ}mi;f2P9*RA^icM@6= zDn)yAeg{~_^N;%x6vQ{7UZ123b9V8M9pRK})qL}YAD;+5Goy04`TCL*{8|!{1WZxy z_{39*vOWLXiX5(C>vapV1Y7MQJV)L$V#bCZY ztcDoZi3*L1t6M4-SMdYI#*HqE=O!VHR^D4cqQxcY|Ap}k(xO1Hx!>1rzcqj7b~{X*B$1lPEhBt#32xX5ktw zvHAPdQ8l&3`i^gh=u?~30R!c}Tioc|BE0s{TGfLJW@uPo5iSTfA1Gm#kcMpZkDgnwuajtg#jL&mPxtqaZMF12Z2=$UKTgaO?_nT- zz%jgg9XTeGIQ&@asaYx165bTP4oQj>OBeAuV6@)!qB3uyz1h7~?tWFU-Q&mfeu}Q7uN3WA zy`K7SV7LB*eQwQq*~n~6eO#PC>>D#PIzKLkvS+V*$J^t%ME2nXoyBbo9sO}pHY?Xn zbm67BzS(pQ5)oTV%*~{ro<~mI&-jIq5bsL%g<*p;8A7L?3R?q%3HwP%D*ynwMOC}k zMF^lLOLW<`wJo-746)}Q>9Q6KaO9F^U+um6hPn@Dbd%6jkDQR2iyM4?_R+Pk4!adj z|0Vo8$vVI+n`YK!jXV<(y)06}I&0}o4pw{@)SVoW2d%UwvX17fw)f(Xt?7FDgQ~`uN!>7Ld zBW|9|5VGS48?L49rt}r6$2fqP`{^IFfsO30~Rhj6qlI}Q48gNf2 zRQQC`3dMSxo{bYkH|i{7Qzow=Qms7$%QUe!QB`_`c!4^e^+Yn$SQ+^lP_A5V96LYFwjwT z*M*WWSS`)-?e^zSCQ-V?Yu*$pw39rwj!n_uY3|FSd$F57yX4iK-MIowoCxrpz#F@2?69UAB`FCe`k=5>n4%!aGdJMWE${Z0;9Az&_W zB})!E+L+N?#PEUG;46{I*EE+)=l^YSXjo7`f0bla15pinH&^8`mK z;kPEM=srNCi{jitl+9I03@DimTf2l9GG+0lyWjB1ixo!Q_YG+olvQ^1)(E8IEb*(w zF*91#?GnNf;mITy66&;nh@Ah|+k>C{(NU?xce+CCBb7T^Ru&%i;UWzT&`5Z}AsCbD zQ-wE#j20Ycf$S)EIHJKBh01E`kNK(_H76X3A&;%g=&@aG*nVffSH>}Q36-g+Cg1TC zf{$i#5F=eI-mJtja>)XaSMTzyw~NiSr+%x$s)COFr%5^A$ED?F+_hmBJH24>aK>!h zAJ#8lB4Mh<%csPlTR6@*Efr%ngn0~Et$f^Wh-rAnItYYfcig`pF!aK;F(lu9>TGDl zN4$F6zz=K(K1m+8-4rZF{mE|zjM59N+=BlwSN?C8oAC9z?Yh;)XQAF}LGS?k`lOt^ zw^%5>GjY-6$^Z?&R+-z`#*|@_hxwnV*YIy-cOIe>TGvv=WakPQsbQ}$sRHYKewQ?~ z@bCANbQo0a%?K2`XrPz5pAymHaG6#2$LR|?10YhoNoaz|xiTVl&W{_sz(=SANvHw^ zD68+)u)g+d3jNtDKU_krmRe0`{&Rno+dpW16PBJy29D+W3K9PFDV)9tr=v^6k4yOp z3^jo*g$vzc-1`Af7gmuaFeasRlM_&|Kj-vyvQ2vWf6H9rN;B0hC9hPn6is$zl>=ob z<2B&kk@@SXHoT{CBPoHQ3$ZEP%#Q1$!PEI-il0Ff+Y#-J6wb`^ann1>R6s<%fp+1m znQFN83IiIpuHQMc;N)sWvyk6a{)ReaO1gQ$kUyt-nWxMhf4hJzh{}WlxOC4+5!?Gh5O&uz)^hDH@zJsgJ~gMR?hy zeLn#}0*_jL1r7FD!HDqh!GT$p=tH~Ye}1HYek*JA=>AByqT^+as}ft$!=}Qg-`&t) z`1IZvMyRaF;Rev8{C0)|Q_Qsro%d+$PT~DK>X-hrV^NYtkxA>j&58t|yglep6z`#8 z5k}e4(I1ED@Q=SEU>URHuIk%3O{?Ap@jb+MU#Pf?H1>xnTYO-Y`FoWjeP3W2XR>Cc zS_=^P57g-2&Ye1x?vbz;Gmy#YtL`XxQpYQh$p%4}o7&=PV}_y}jK~ezEU}%?SbwT& z{^_ufVd$M6LgKG10*??aT!Vq~G!8FZK2)zi*?2CJGC7)iq&6e3tG;Gst+}h?a3+@S z1D1W!*2&`KA)F&5B+EvXEjXq>?P%xW+0_z@vK{&A^L>nW6Z{6S*Ft7?hmi-y#bgIX zPA~S{=2c&I@D#bLrz(Jaq_?`oB=rH!{b_*H6&8P})=C#eABn_DFNuHSrXc*X#eT># zZI|zmBl9SF9@0M%SlFN>$C~G?y!>Q_C2jA=b8;>Xv{nMdz9tp7+SESAWRLuKzF`yI z8GrY&{9G>EXfK1t<=?dkAr_GO)hLyOlcuq=Ir8%Z0wu3lxh_2;&nd|DXVe6DyR-#y z9?#d?d~`ReV>;B{DEKQpUVW(LrE=GK_M5WdEt{-HeA?#ct|%>(h&|m;dNmaF$dPxg zb4{Z%@&3$igE@jsYSwQZL$U{<*1czK;5w#)aJjf!lSbXHwv8?`G>ty58k-*kPp<^J z$iNa@A!0UhXMt~|y;cKA#J>PQ#%Xr76_mjqHP&RMUuTpyFTKk#A}AUA=ZjchS$nJX z(;NzL`oh=Y z0EAYHZX%1r%LZ$uA<8F*1mj%}rsdytOVLL6DVzWj?(c|_T`#zd(4JW(+PCf32tJ1P zDm?mGSLk3*-+XD`2y=fdpR9v?`j&=C?U2a-Pm)BF6-P(S%lL+pE|09er=(_tfstLD zpV1=^G}htK2$|t`<`~^jX>=hHl9N{Sy(9 zWCLet6Wcc=76y;^BV4V2kMdB-O2$EL1E(pPp6e@qhpB2WdQr-0T7&X1t>6pt`m zWiV4dU@u&;@DQ1lbmnj4R3h6cwtqW#oem8oTigw_h~Q;>d$t-!`ArmvGW zjq11meGsX2gjk(MI#!tElIG|-1e2A_O=VJ_2$S_whyMh>8~_HRHOHrryITNdBryI zymK-;&sOHcMFD6**kvNotpNwLpS-&UF`}q`vr{ccz^znq-PEvQORKd)K)hOY^ls%6 z*tunJ|L6KV71K2g45u3=w*d{-TH1G$d{dXng-0B{Bppka zCCBK%NV*~Ehf6IBPJbYM2_%*5&$(AjM{-a?>_b?uN`wy8^w!oNu#3wB^sPXrfn^MyHq+_Y% zCx}q0>JhbaW<@9UW7?r)V$kT3^&Q~4_8e)ljrfRV_o z`4M|Iz?<~9fmQaKg`mTj&n3N~>JniYw^8aFh#{7$!hIU!%0fW9BHOAYo3}3yb%^%O z;F9JNSuKW@0?wr5rGnRk)FJdEy_hULkJ;#Dlyz(lyshl^nCT1Kh2XqHv%Ml&4Y^^B zX?U9tqQNT{=us6%MuJ3GE1Ewe7rBq1=|yTl>xj}ej73>^7_eQ0bzG)^jLt+x*_Ts7 z7UYN6Y6+j)wzM{(cg8`q3zFO2s~N@XwO>x$7gnCTQ}W~S=$B(%T6{6`Ow)g9Q$?S+ zS#j}U=D(s#A}Ck7Fh_}G`D*1h`lhRpND>pAW$Y&ZPTmcWR3tUXS67V;_rN!%W?dN+ z9kkO>w;g7WZ~1B+B~vBv7sp5|Wb+Ogg04A82B0!7<76#NpDw1Qh8suuJ6EynuCtee z8Q$9ys9%1v9ti#{N;XYibi+Iw!ne0dTTugEw?y8P)|HGOGp0;Rld2K_kUoC(bitaJ zE&vU+rWuj#GVK_EwxC6xT6%p;=ka9I)KbvL^+(#4okYg&7UW6}f5i3dhfzZbzt9$g z3VSU}i!Ur#RUUs6>$zCk-@+9N^M~bU7lQ)|_EIJ|jh}Gem}%~qo?5=bodsK^15nl{ zUHRHYp(Wl8h)-YIz#@C8)Git-KxzRZ%ofmX!@UCzm>i4R;yf9AQas@L8L*Sn%&t? z_z7XP8hoTxl&m3#oWFZwS$wp#v zw7f3@vZ0*BE?5m14S=>U1h)TJWH)|Vyv{WgOSgKTR&rAsh`Aj<>B?F}G`LU&@NN!- zAGC!GL~h5T@yrjJfm|wSurY$>SJdm~YeUS9Nh;4@UO|ms9>A25VCNJeXRIGA7q`vz zBa(M@&yDuA+i5T?Urhn_4P1wHh5q)a8N)*qq#GA5mE!+Z2+d91Mq|!HmFGwN6bj*- z+Hfm{a!eth)p)s#qRk&0K2e~uz;90peN_zP2~jHopce!NuxcPnWlj0p9g-klNQwa1 z9}3q4l7$iSuBxl-o`wcsK}B6-rhV#1q~nh^rz4iQ>E-rvv%k6tb&4Aoc`%IRgDlt! zpWWlLclhn3e)S+@b;*>_53JP}WxmQ?__e%@9=i6<-nbx;EdH|U72gET&v-7o<}V)> z+bT)jbSo>_^LL?s8E5@0D)WNj;q$iQ63DB)jl9IK0>`b*OU#ynw98bS)cYmG83}6|&o`w`C+q?*a zxncfxl7kW(f6IDu^Ln;2eRIxjY2mwq3r$T!DBP@UZJ^Xmh~g7&cl8pmSlG{b${tpl z@MU=H_wnpe-{9ouY+TZIVuRm-VqXP7hbWOHvE{qzLCkjS^r}||Z=`W^)`qa_x)20ljLn*r=T`w3^vjzQiz9sHg0;LD6+w%YU_-jgwC*y4|61 z?YtQ5t(G_54mmmEUb#?SiFe-o`;_>dcgxpp&HrS4wSDXPaZ)b2dLGcO8>dljl$4af z^%3vm^acQqDWdIQZ|bR4EO&f=OQYRt78!h9#3NEa$$y(G03}Y?+Ul_e0MH!N*H+_~ zI3f+Njc}`KF72qHf?5jfWPzkXSAD0XH48YZZCKQ7k{-);0VU#yzeiuMu^he zzTrS2r?|x@AJ3xtr&Yp^mIsTbc=wt<`|4GG=`ckbr=Q*ocBc5BsgZ!pk!7Q}s<@lC z8$GXIIx3&<)u;pY2(2dYuk@~C(7Ny_X0PmCU+x6_V%*~d)7{C<-RmUfcnpKz&(2bR zU{M{;0#Tf7DL{Uqd@ruWiy#N}#0ZrByfiP`NhzOaR8D=5v$Y>gunAiA+dhBo8uIcdvT;s{qJ!(jYEO7G|Vs#=>%r%Li?RCPQ$;?S!5 z7F?Dt3nb{72sq#!xM4r#v9)=>2)zvW%X1KP{Njn6HX7d6`y;#dqqO#$G>!k|&l7pC z5qhs3pZtzGaoqtl;+NjqDXK}%UTzm=Maua?-5eytbD32MKuo_gFpxl#j!fz09=7|M zFEE@eRpYhSUTg>kM3>jx*S}ZfC~Cn#DoHpoCEUt$!HwzgTPSgEt^or+=vS5BeoexX zp1Gv$j08(I(Fb(0gXLa}^}ORldx&k0`h`CUZ-cy4D7UouK($vg*Kdgmsu>YAH)090 zd^wG3>K&0nM}Q|0HkOkrb*f*%g{YG+scpo};amIE5u~uH{@>&16ReiVrne3aOqvih z?3)gTJVET^7HCQLg(TpYP|3DF2@h}Wl8$nBeLmYmtjD{)7B!cj?@}h7r5mi~af(SAiTyxS~ zGXp+O-0UWg;oo;Ea~E1=j{~JhuD+Hy{*;b-{jFE6i#TYCun;T%c;$_IHT5-ksMyZ9 z$_4;7ER!?-zpW17b7qg(gA}9}^Kl#Fc<}Yd!HMsS`D(2hn8Uf;m<+#QTEdg@ISE0e zh=T+%k*4JmtEsoqGt7EJ!<2M)--KjmaQG$WzL{8F6RKYT)1st0(BP?a)X&{ImuH#w z;r!N?vdh=@>h(*pkXAf*+F`aI=*HLuzuZDb+({#t0L6Ah3{^G#y;G69S(z$xPBl%v z7l1X%9$n;=c2rUzEwO}=CVgp5*@*gL!}9l7>yq{*c&#AAMsL#ikSxkBuF9-|j*3gR zGY_7;YEHYb2cUB6Jj&+_0K$NTnj7$5G~ByVlg0OTk(#Nn1VV%tRtD{ZMhJ42@O)6t zCP%)Wb#12D-VxA;#G7|2M`>R5FqUbz7`^Pww+spENj;+pKpW+@CZy~MCUvuKVOuTK zZt7spJ5YP_dc^$LJtN<|q((c{^~sVXy_o=?r0I_;B_<8t$i5OiKX{s?&d3hH`efoj52H8 zZ5-22jk6ytVeWitCj?cEOxyYTs2vCakPX1-3C&sy)3AFI97EL}@R@3c?@3DzXXq~b zX*s^r-c=|~)yWB0cVAoO*IFL?K<{U%4(7 zG_H`n0Py9NfEd6rAf@5=^Q08g(X)w17toF<_@&{7D7y;%JH4~eXmMJVI)iN-Lt>LH z4pUF*@h6K2p08-qC?c4jBmR7v}4;=tLyfqvM2nze8Mz>qCmAe^t7%$Ljf?ETgX{sepC z4ZD(VV@lJAYb%{@Q?=njuTlPw@V(c|o#@>~DWc!^-NY$X`Vb@lDpW((o9Mq+j3>(| zZf5!&PxsMW;1loFo#2PhAu>uBAB`Pkg*k&&y>O`{QhNHgi+dN3`gYjZb%0PJMw4gA=v!i<RL8iO1*E=TFTtThWgx^7=z37M*JNzuICVc&~_6;ikK*s5p^I zZsY}|_4cMqMHQn_3$f>K(yl+6oA0pxQ#*W=ul_q|;WR+~zh1g*nrS^w*M#1R-Q)Vy z_aFuZj3mN-XSc@{7`XV=k%74r4T|kxyx*mr=D&XCx8QjCns`;F)}lmeSR|N(Xf10? zzUU>I^JZNcUOqeD!I5J5fr77$otJ3`rtNZ>6xP-gT8278Mh!!U96(NH`;w9?uc(CG zJy~}J!G}hG;pY}rMSZfwYxu>EB~Dw)jhEtadZ-Ln6|Qvnb~J0K-TUsJ+~@r>{-|5 zC}#`$V89lfjDxYCy!hv16iGtk0X^qwyMhD3fyXGF9!MiZA&jm!fnRFQaprA0*KoRt zQw8`iw8wdj{SSpTytn{WEv^|})FT5ab|n5I16r9eC-?2o=H^T0C>%kb0yv#K?^zHl zh$3Y~2j!i3hW#Y$o1xLlMTxoaxAgJ@XCY(RG81Fjhd%0PB?p1~JWFiM?$Gxj)-sJT zgD)&&r@h4jX2pMvyX#VGKia#mE_?sTD;1O9S}itRyube>`O-qdMm<7>1e~rxporj$ zEe`heWeCiFYuk{0v~zm>vv-XnD9cA<&JJe`Exix6?i0#b2DtRp(-0g}H?z7i*Cxih z!{nR873g()8+z(w?Sor$=X;dLn1z|p4kdY(IQEwvG3C3fEAgR#+Z1nnN@<^4|hZ?1wO z-lC8WY%*-MK7C7R8IJPG9}0}aFJE878ueBLN zXBNP3VY$WwV7Svi@XUrJOP^7#l_90NKq`RpqDRIVkE9=^x*k3#lOQr(E1(6>Wc-c(rhR#9? z69W2l;w81wD0B;BGV+FaIz!Ckoq4Nr(t>)Skz$iV@T7P)U$;!da^;)=pZWh@Im8;X z{e?+e5m+gKP1jQ)9cC`C>p^N)Iq{YznY3~KtWX(yPWSgy3V{ky26ylI>0bF_e4jq6 zC*zQfi(Ta`X~&Fw(Qoej{2wi6C`XZlr})KFAq$&8_t9?BgJYI(Io*~1;i;OZ0gVB3 zICy{lV=KH)nc9l?l{Ho_wX{ZRjop_Pw6KYa?FOxl%_w5W5=ZAbbO^}>-SeO?t>SIx zm)Z3uk{Lu?B$tex`5ILKV*)Tt#(XDvYTnvQ?nBZMy58kZaxtV^-j*DG>z|ryXb?Sr zkznU@x6pq7PqS=f@ZS^yzvG`Q{N~47qsN1jLX`b`Fv`e`Md&__tg!d)j_l*@#v@BD z*vV~1QJpW4LBxCn&Tzfr)2^P+6>Z^2l=sm`q$$^M;rP^fK|2gK>Y?4b4Cw&)p~~eK z3!f6Pj;nF%d2LlUPR(G6LW(TTJy-_=Y83#uAq0Bj{(hb;F6HLO-Ol(H)c}pL!#SIx zcFq-6*zD)v?LyhHlzq4YQ4Qm(s1e_^{Xig4r`v|>++W(G-i!e(gZ6PTh7Rz}L5xu3 zVD9`tWWn!Re?gsAAmBUw^%u%P)P}#+2_N-R`FMLV5GfwSoXaP#3)L15PYQJtp01sz zb5C-=nsWW#NNf?ej`GxkgI;-59#+*&w+HR|&GB`Yvburnhjkfm;Ae!CB?OYLM5~)U z#J@*sRh%KX*S)MPX$tjbuOlJ3qLcp6q~<`NnDl;!g{+R%5+-P=bFQ}~db^{BjIDe2 zpzO@T8~l0a{J5LvvV^Exo)t#{zZUFCR{-P3qrDTk-OZJWDTF$Vn{EPvrX&J!uhXhb zucZVXd|U|%Ymbb(i=kB7_&)ASFy40VM|U7>m{((Te=raJQ|r1*QSP|V#l#ThlbziE zKyKaslesV4!+XfU0Kjv%uwY7)p5jvv#qj#46a+4anq`uqXQHlTyB>`SkMT=OqgCf@ zY<0j^upX6!{7I+OTMETUXowblYM2<#_=u8 zTy88N9w64fU0+Jp;%Nd5CqeIT8rDq@S_!tr@?_o^lXMzXVv((w;IIeEG*~K5Vp36= zCqt*Kk`50J`IcAfmcmExmch-vh9BuB%ScMLU&}tyrDO&hN$0=A{d_)s7lIHO)6q&TD*ila*0W zbIy>?hi93-$*MXK;Y;O+)@V!}0k^5k)75GgBrWBFUN!@nm|# z^E-lfwhJcYAUX%W1B`Jpu1$1NkI8)Q#7)>i{3Z2)0aTz?UZeECdiwMOv|wHBAq&w} zoy&9#GEqQ5ny6OrOyv45O+#UOxm`b4%p(ts5e#hh7j6&JXYX363?WVyUsjOt`9fxd z1+7&@r}2g;6)cW|sd|3q6kgheZOSLE)8cTu0#u7d+@(9f@QCLQ@i)EXm4(2;3Bzot zp;k-=;;-U#wBg)AZ>!QA1s!zb7eqXRxEkjnTyg_WOx_#djG*rjo8~?k8BRnZiE`r9 zp!`g(2-ug9g2UW_4?0;*dW|;v#I2YWkTDgKj$Z)RigUe9@F?lmxdSt9Jk4u|Lo_{1r_r!ytF+YKPLRZ4%JLQ)VZ)PhB}59Ft~-*1Yf+avRJtgTMjmR{Da*B`R*=Tf3IAk)yzV%e0Kk67x59AIe_KhHzZihZzsE z+1S2i?t9K#v+%Z}6+8G-sEx)3*Kc`HgxK*biWtyB@LNW+^{g4Dfjogwu5L+%;&VTy z)8-K^z{HLE-g8xakR+$sP&cle`QePNfp7mbZuM7vmu7h!d!r!cgF|Et=wywH{ufRY3QN2{({IC9)1kNM98eZzN&iPL9w1P=nc%dXmh5YtDo{^#cW%&*==(d`A% zWF?X6!6x=Z)YlfdUX$7Ck-J}=*!5Q5r4fuu7%w&%ajS(?68o1nw^lzkRim-)bTqT2 zP46HqG}D7SyC@su{`<7PJ_VWI@)afF*IwJ|^Qa{ZD4kf#s=#x%+>i28s``(s*H8y}@uFckss9_hD^}osw9e76Nx1T`! zD741-gP{etJHYrFhz%3^*+fv|`Xg>gADa3dJq|4rxCUtS16c!X;UTSXu4J=lX1xJ2 zgnZOLft)!t>!`S6#AAjuo88DCoYanUc=a8Jxq+=WD@dpD767S2(_2lA&k(zAP0PF9 z7w&HVt(fqU!6QyoS6n7&(b8BMWzYLk-~W7H&{G5WEh8WwgL(pe#pW>H=zQ;f7Vrm& zWY`+(tc!!4>y#Hi4CaAVkaNYOK3?+5|6woWqLj)6=`SSluFW>wk$J>qPLl0w8r&f`oNnyfPLY6NyRMSh^itq|(!|?aqft<3c{=&W9 zNhC)ut>R3EEv6XIHEM-ZWi$X=^Ch|5&1O97I<2HCN7%;qAwhEp0p_nx?7MGDXki-E z9K{w?0a)h8G2L1MoK2rJmTx$?oR}Mql?m!QThMuIda=vbg{J*!rY^8X2sZ3Xqj@bMKJ;Xk+N5WxZ9g9 zmclOx;%LI~SySEl5?Ud`cZXGl+$6bClFK+iP9r5%T5gw3(BTHZ5WQ^O{D^$r z2YDS}bj@9~q!5DwAauhCQ9ETG0?TbCWu00MeMn!mpy^G&Q=jpN#nEuL^Nn99%}d5j zptz~`u2vPW%_#%De^-c~Ha@c)tf2dcrL1<^;UB~SyLg5Uk|Lb}E60v2wsB`1{Zwz! z5O(pDK;w}KXV8Zz{nY>8HdjV7m1!#~d1^y#nAuhfSs#8$pjx8^rGY@n=J={t1c-_55{{jTt>u) z8fT`RIv+U@n~PF~EC5_^bHl*o6{Z9rxrqs2Vcjp8M9P1LD8K|<)!tVu=JRbWUjSzD zKZ7yi61*3~{~d&|r>Cy8DuTt;JF@q;8$RKZMZGTL1o8p=2b%uXI4S>7Hik$fdeD!B zY@nQ5jJG-Cm!^s=&kuIFS82H{-YXkfKBx~lL=OW!?P5}Q^OK7LC@cv&p?nnM3sQf zkv=`x>m`ktP1sCV=jl9MfT*101$;-a*e(pKE%{@2A4DD>({s$g4vw8s%v(IC^I0I# z^6#8$y~__5IckKqVdr$CT`!g}A<^Uapzl0?DjtueB`*%wN6 zK=LJs;-qb;z{wvh;;O&0?h`8zOZVVQ{j*bkChJ6|w!hp35Ilyonj#y;#!8j=F?uns z2w2ZQsmJ=lpz-d^^&@AbeJT5^%_2dq)AcfO!=q(1UXjWEhq0!gfc)h4wPi`38?EA_ zsD~ZCm0n!>vmTM_)`1eHH5RsFFhn^N9bZAh^1~B6;m>nlX{9D2D_;b0F|$i0ipimc zmPio&TKF8kb&{O8U!0?2P#ZQb(I-L;Ziz+$sBth<)(yLGPt2 zB44F>erd*@K;s3c!s7&IIpGzP`BEbM1fo_7WOqUFSU->JV~e;Hy-bxDeXhoDY(|AP zuLtQ*@~VXL$*`3@7OJlq796l@Q-gPRp(QuTL8lotVL=I9UEOd9s8>=<8-yG*c z@1!_=yx0GYwzd0|02HwT!IHLf)DZs7zDH7pu6${Hio+N9?kh{mFMi>g9lKY_U()e1 z8TBDz>3WCx;@v^k6eR@nJligyTEpahZgB?UR~>j<$^v-0ta5D-l;B;btZ001$y^jl zMv)HX&oAg@5I>$2gZ8SctdVe#oC@}_n$_gDZNBd>J?C#1rhVGQQvx9XKw4^o%rc$t=%TVW69iY#d)~=?p*9g3iDNc?T**@NJe9+sO?>a z!7YWsey?uIr=!GkpWWF;8_eaY`le{np~r>WUu|X$kl?$;bII>SBTI+?+KMwhnny4uIcF?Kk zk{-PCOjDKl;$Yex33$*&k^!}o5<2iXP) zn*lSb&wBbGJZHH1gb@D4NQi_6E2}Bm3l)i9WpnN5*W<1S5(IaP&+-S{94aw$o?r7} zs79Ody^vpsjW^v0@9gboB#cL1mAL$bh375p3+m;sQNd9q>a@sOIn$#G(txhe;npai zzQhfD>BQMe$8|Xpe1TPp{}57GkM55vK@eDwxTC3ICPN$QMJ|hYMZho6dM_^dtW<+J z!cQ*)$8XHH4ig_;L@!yt-s|Eu^ZS}zGu&zNn7Zh&*Yf~8ALzS0{>=4e)qS8jZR^}`H~ouvjDuu(nH1|+%NW{ji} zJbwpqAe&^VK$%4Dh*D=$Ox_j|GV7WAIh3y&si2MfE%Ov0_+)-hg-vxt+w7<+Cm8Rb zaA_8+h}cSYrFqZetL&VxXGCgDUL_FWP2>#OZ~gNb5}1H3st5RHimWp3L)w~}?(uwM z6G7qOt3uzAw%r5~-elE#>a$OQ)4X-+ATVQ23= zGSb9-jKFvB87VU9aR0>YC?2N$et$F9v@gi6(gybiLo_ZiX~Xx890=@@LE^d zS3Gbbu;t`ct7Ob>%Z1RX`To9f%KbtTe`p(i7*eUE8{fn&z9(dq9jOz1Su=cuRrGg& z_&9X!w|&a8Cb-f2g=bQvdQB$ubkf1NO0kg26F&3azQjDF4&Kmb;gQ(lN-S@iQAJEr z7`1`n#S*2w&U9q~1-FsI(<1^Gi3C8=YR^xy38JGy2s7C%e#qdX?3Rvb0uk}D?~$K% zwp_TqmARnQPcCv<1#(DxF?3SD$#X<_j(jhUoV`z z_IoD>?BHw@61?jDcS$%nD%3<6eK#=J^}VJ08)2${)um*kW_zkU-|r~)dSv0Eo%OQ4 z^~dRu-?W$OFYO;n+bS&Hgt?|ozCZdu59F6a^=pDAPUjdQqyQBM#ieaa`zPE+%|fvF zWl1oPiMs|0)!z3ccnK1nNX7b&36I7n;`P##G`V{bv!Un+*jO$ABG3JxU8t3M}iPu};6luteLo-k} z0!fJ|`Cc%k_@L8bCGi^H*p;oL;eO;!qM;Ro;<_aMO=*6H-$nCo&%LC$;eGNato@X* zsYipPSktIkEHH?nz~WreICc#yx3utO@sr2|v70;$%YE5iTv|YYB}y#9G$)2dlZ%9B z)fJeIzLpVtHiEm>*)YL{g1?7}X*gQ$ibT7wFKXls=6TPfe0P5D0=NL!q9S`Di#OJu z>^pEQx4&|)`4G0qq;_dr#ZW$Xi`qU*2^_XzMZt1OQ-V3ggO;~>U%X@)62ERe{FVTx zoS^C~Eq)`AV89u9CeL>&DA-4!a88k#t(_CD!^kCa@6@8w)(0gR9Kw)P9@d4x^6y(0^N`R9VN#Nb`E?DCwm=?O$VGbM!^2jXlNgLe`&_ z+Jqj=Jx4IqFI7O%6TUJ0V~EiA0m8(5jOh(FA526tp31_m#T9UjnJLeMe1jf50 zyV=2;BK|VmQU^lJqUY83eSi8HS+7HM;7h#@FA;8zaHEhX=py^AlaW4_`dd()5nLHK zv|v!l>Vcv4AF`mmFMx-)>GJHCr7vql_CTZ9xK+InQO=crk|iCb9@|w~|20%dp1oyf zIN#f@#0MH(P|#w3AW_>>*IOtlW{BQ6lCQ|VEtS}q99%9KkG`t4`5fy1JcCcP40fEJ zV6%8bpL6_GN39q0qU!$Fg8KwtXjdd%&zFd*<_o6D}Nen&X zqnZ>5fn$qt?(9j#8zSHXl=DDCn<0=W6n=0?F)MDL8M3fLw3^PD{>zanw^72r3ASoh zCGDBFC2z8Vv~Dp@<E85?ml zcdN#+l{Plc$be0Rm^`@c_$x$>1&gp&8o8zRajnSTB9J4r4cjV8aXy3SYN|_fn^)6` zoHoG;W0>Fb{HMU++22zfgrXBq^-d+)jbhC>^aV0kEv?Hu;~H2_AHd8F`$wEw9b6FV z0GITA-B^0&V3M?LXu@YN5}vqI=hQ8YZLnx$jaawQrJv}Sp&4zx3;evs*#N}z~fx{R3{=`b2!t-tFotC;PC8P?VHGDgcKoU3QfcF(u{ zuBvZhaf^8s_Xzvph!TrD@dx{Qf1RfR9G1CP<4eMHX4dofnF_K^cb%>21#XL%oWF1q z2X0x4TTtn*?lrgOIRn&Pm129OW1_1knu+4VxK)0`vS%7U<1u9V+dm8oj2*)b^rv07 zZRT1i;?L7~Av!E49&MN$YsmkCHgGXQ*|In?o%d2q>cEw)x~VFQN2X8k{B`-{roq&B z-HK#eTu{sTMD@!)2`zujTnsZJUn3>XnUJtDN#Q_cMIxY-D4JtL-$0|$-DqGF35j55 z|A3~311Mz_h9O0f4#=^{0~BS^WGQ6Q;N@HP4w)T2sD$V5(SOe1?;$qJVV+IOh2AOh z;CE+*w$Nr=sZ8JrHz}`hI>O`LKAb%mbn+DgEud#PpP|R@L{<(47iq&%>4r*Ehmm`S zt4l6(bX1>G20C;LT?=iuKbo5LF};W1rx_l{yr&4^}#@nZ2(bNRQzBW8mTbgzW zBJUt-LeYi=!F!yu2Ik)pj%sa*9C0s9aT=MgDjYgVF#I2d{QSFR7nV(6Pqz3Z`hJ)A z-n;fx(HKL!T?#)9)1 z+r5#!K*F!j#HR%EJBVy2_+_c?)C`eGzBN8mNQ!u^8hso_?K_DBw5U&1hL5Ai_J?UV8WS7 z1RJ%DD8-5HKHT)&Zr2vLhPC0Aa^qy;}98=+btJC`TbWP$3OoVCa$ zmFLVb$z-w?$Wt*my$MR;zg?s8i`-V-HBpq9LP7$h>MmNDm`gTcuWX?*xg8hI-p0?s zef2W|31IIpsFHC)kK7Ts^o`yc-T*IdNIDu;>e<~9w6z&=#Og$_UX8Hgh7bujpUvQo zFOsE6PN;G$-_qd-uDB1cNfA2tqBt!pu0;t&1-MeB1_~265fSq@COuaP7Q&5`NA==d zLqM6DKLprHT7)TR0Z6iySt82Tzn+X!XesCvlJwHdGXDu1kxJ}sLygLyFh!4N+Sz7U!Abrc zJ>u%09ARqocJIFv3rwjj4Ry9^q#jia5%AOx`CT7opl-8AxUQmDi%&b|2Xvr$W}*T>bgL`D&t<9=^A z?p*j6@rcPwRRUAuHoq0zZKLln(%ZnyOV?JCY|=9Dbmii#!!R#pHWMPS2*YM?1G9!v z{sIP-rvvbBiYye)B}jkzoor%NBQ3a48|`Y0M>dLoY}P{kPD2OsRrLZ=V70wa^hnMr z+>ag1lL~3?2VcYLV|17*Y!r`_6^(pPcCUXt8ObkJ(i==r+fQI%E^$F;jx0{k-sa@D z%Xq%R3ZMY`he+uf(eO64j}qN5RFiBA>^H}=US%@n%Z(=R(B@lwwO*!l*C7|^A<-dE zc>-)pIlXxnw~E?xa&?!-eW3Gd1W);A`D{b!K2hew+{_nqGu7nyp>z!K!n41)o;vm0 zVW`qEE29nNdras7ZZY{8X|k7Lz6Hazr5yhL>$@O>i*c8=ea7@$vI)q z451SCxf~l3m_~k#RUtKTJr(}g9*V-7`W(0VgacY>DBB#^IzBNmF*Xxnaum)1(L#tY zYB~Q691J-jYQqsWZ`WgQ_Hl!|jY7O|K?d$`MPw)Jfm>2*G6DK2R~e5!uqsg~g`~v7 zz0BsT#^s<1O!o|BgBBWxfdiF*`$71$;yS*qcqm@WOOERKF_ayp2o|YJgt?_ytRn9R z)gkeqs#5A>E|JhNgy?Ot+GV?c;PWOE-5uk?3V&n@Ucxg^5gj za2uG72%VU*iLy)R)`+n_a&%?mhoIpx=Gw(uN_gR6wN&Z(V;S$pgBfO=yX7G|afDEk znol-h!k|)CAbY+*!c?gTrN|eu8}7C8lfT}U;-!<{!tTXuHmLyV_FY_f50VdAGHFR? z)l1M20T(IWtlwNBg~;fH2|ioaZfFb}j;ALQ{(zjqh`DQZLjZzWH80rk$L+qjU`~E` zb|#S%VI>HgCaBuRoRgl=P?VON+hjt>fL0QFYgY;%t=l-Kc#*2+_nC+?uX-hSGliVwdkXa(ZcMvO&bem7#1zHtb(y-(Q50=HEle z89XGkcXxKe4yBdHkxC5RFx685!DJ8~=tdgTh)~($4$Wlkc z9$N&Rta+9_pL+O`8+v%f<9EQrk<-N~*kAkgLctg70obPed7+G4o`G~=*c_=QNh_3F zitLy>JU-*?cE|*+$IpMS$ZRcE&F)`-?%t=j-CoR(m6R_Ohkm{_r9GeYLig`)3_q?myVy9lWhic6+YrKtl(C2@3_J{Q z@}ARPF)Fx&w_0xn9{5r*bP!zofY~&*_6g5>?#d1o;cVrel0@u=!B=fz-&z7nDe%`L z5@X?7-2|iyn3KbwEq#xwE{DP7U8|9F>7S_FN8@r`$F#y0O6szy&71kEtTF+n!#yl& z5MfGp1&Fmv(8?dnQ)0h7F{*m*&=-PH^<>>PKdGV}#1_M~Hfdj9Zrmp68I^i{scyCx znoiNlO5|svT-(QvVB!gwQ>q8{f@2zEj!b$)t$%+p3t9JxPTc$e87e1fA*&L9KB9&? z5L^Cvb!XwCzEJU8DtH)t!@bu<64=y?8)Qzn3cOF9y4AjJS%PT;@vh&qg^iN^c>&RP z(JR3$54M*tSihJ(1mBQ%g+{;Qq~)WwcxBR2V(5ul<2+9sA|vPDLtRDjJ9H$gZ;(Or3I|wxr8cBHnW%Y zxl~p&kzaImN`r;kMB;n2OQzCYXaC&2cZZozLpeed&@(*tSpv3HzM&)>00_BXL7aMU zM}qcw!CV?Z$p|mp%iDQX;HznogfoF-B2kcE5+%OYyeuRdXq;Jioc=|c1_janO~=4< z|F;GvxHC-#g6ky}d6tQ`LkHy=k|xY8&?nRezHY#+?rG*F{(6MSBgSLxFwC!_!Dl+d zS@A@%Tc%O{JfWOS4SiwSChy-Jz(9#?hphs0{`T?rwA|pkV8i8fuDPBM>KRKz`?47w z0%n|MMHp5^SJGo;h=aZaa1tX4H+v6do(~l#UUkT?RfVMnO{trink9QtI~> zGCQ({eLZ5h@eUq*wU>X?{APGH#bA+eY2C2YV`1p}jgN`K?fgh@3D~-}lV4mr%a|LXNU>JtZWr!$n%0o|#>-;)7#k*R-11m!uT$ z9yIXCn>dRa*7=mrvNSHLh&4YGS z{!?bgUQFw0WGlqckT%`FjIh+KNp~;fZVSO6okU*cz7r=d;E(OeR*V6Kc|8m4egJ<0_R?1hAX8rA+Mj$D6f2(%5V0kOb4sYgSmSFc~o}C zQpoE+0Bfk9P8dkW{j#XLbkvC4+DFu8*3WR3Q|e%=2!rMDRB8TjFw2DB;gR*lGmGDZ z)AN)fotOXR++E%8F%qvxs#ldL|7N9{D=HrM{KAQXKt>7F=E)oFE>9BGm--k{cR3k^ z!M9VpMv8d@A5-iyrx%ksNtw=tT&DByx7nB{!SF449*v&VItO-A1cgXs8z@K(pzK_! zC;=*amk3s#P+zS7PupNz{l{dL)d|Pa$U(}*{vb^b|G_otlO(d*VvJ!~-+5g5elcvF z_1XIm8{fGrqcc?zl|1CsNCdC9^W1Y+&rSJH50&ZTdL9;aV94j8Ic1mY_B5}3G;;0q zg4^DLBAC{3g*iT$(6?Fcn}8~AeQiWYA{D3!slV*Dv;a=BmnX5Hm-~=J*8hQt;%GTG z48wSp(ReFb`xx2N&X^d>>h*Y!2R*6m#cmuq!`(+?p!kTlerN)bDDpe^*S=D{ZPoqX z^I38iLHfs!ZzPoqrCJWdw3iro&Lr6&J5f|)P+wjBzV>X2KhY#U##9jEGqhdc-Z+C? zHhuw{taX`fP!L0{4*#34N2wAb8*C`8h&vp2x3Ncr5S_4|qlTf^LZHR`Yr4mKZV6vv zY@`W*O?P<)D9H6!b-eiX!c$7;d4lFbHxq0%>dsi*KS?GMYqLXiUEjYHlZVl0K<^$n znH}}z;;Xelu+p)|>gm}Ruu;5mV1}?L1wjB0prkWYRb=2nQCE&RCL%-8nc6;7hw-c~ z&r)Z5d<91%1Sx%as&JTwM@6{k2h@l;rde<_vxUZ((*c_g4jd>&z>p5Omld7{BSZQA zkyYF+M4$D0o;7uXD1NoMAczf?HIBzw$f3@3UPEDjH>9Fn0;>0!d%CE_-5C-~@+)|G z*DC|4N~L=6vA=Jqw8t4_@ByyQAUY8QQ_U;o*hKvfBM7PG@1q78rKRqoR)S*0CYIs| zn1wTR(ze8H$+z0^MpQa_pr?PZPm@HxKcIg3Hkf(jn`g-#3ik@RHj9H!c1F%fh3-|@ zqO(!<70RmP(J5Ue9L)T?|C@Sb_U=?fY5RqdL~H0aD9S{nC5OpudxSmCN0>T)QK8@? zaW1SS+eiOUs^S6fz{8@iW(#({?)y$7JvrH7A0B%PN>faG6 z0cq?~D(Y{^U;%eL-N{h#kpNiUH$!T7cJ%|-B%!rS0x(4h;oCemISM-VFz0CCLTUh; z2yY%};uY2ogxds;b}0Unh?@Rncc<}$&Rza@)i)m~XYG>({>(`FK6O7(tbbqR*K-=d zMis58^HYkS%@S@_KmVYxIpl$K{2k{dAAeB>v^VKYJ+Q^(kYJwq7{k$jpbOAorA&Y^ z`3$$2md6tS79ZReYzdFc<5TiDq2{HB?NSjDUM3eX#SxQuzewFW_R=jt`QOH^gJLX< zzHgF^B52D=66nxub7CS*|7`1xx8C<@(kFI=P(U48r?$5vu_*IW-qRT-R1Ad$E@4s z(|Y5qWg~i2kTMe%kd|O4r)=2F9Q4jUy(;(iTNQG};-Fex=kZ%OlN44U#qkM>pnNXp z_4_qcJD914T8Z+^x;b%XmJ!%S(N+f0a$gNzuX6V^@48Cc!v8~I=eiUJ5=pC zGt-drii-MyX6UDEf=DFc*V`+JTUF)Ur7lGJkjtNdWVnUY6zU0dvssS9O!gzIUqZ+q z1(!I^f>r;R6E+cHt9xy|{`P>kK~uV3JlG=o`k;A9cns$%F7HoNo`pyHz2A7t17U?} zzVo$mG;lTrDlRroidQJY><|TzIG{sLZkr+m#S5ZpkO;5sMyVg@a3=xR@bjVorERSJ z{MIl2UQ9El;yXYvAiFlxCo6CPe~3SlZ;3Fh_$kf%S|V1SXwUi&!##cR>m6@cTk%^6 zD2GTDGK*eiJ)Ys8XC{I*EGv0+uzriaQM55HwC`u&iL=j^;CrbegpfAD5_SllGgE^P}6&nAkk9hT#Q*7S}<&J+(GkR`;zJ>w*lCvJT>x^B{FWW-w}Py)v?7Op6b zE1xak>Y~>qza#??qcKX90Xgtdb8+#XKwn*{r)}@>#P8jAgrU7;ln%j$xUIX{@_yG$ zpt0RkM!yxOOTC4gtA!iIBpxLg!2)i($#6CvgB!>B)63>lue% z6I9?P;pa=qQwJZuZ=U|jNDFE<50GkX31;S3tMzHtsg83PzgzR8pDzi>*jS6z0g+XY zi|+Tu?xuti>zay0$bA6eYf^tQ%Fu6J7Y%dBzJ#RPy$$gZ8VSPZNh=%Vd@eSM0b0Z(#o}%+*P2W3`ZT<7H`YKQO^`@3zt{l*eqz6|T z%_a(%28`|NhuAm*{^Cic!-nw8bb>#-erE%g*AHNs7N5O=I*^n zRnL1*tnw{zF=T=vCW73-yUXpsCLhY`yDJ}aS9Iynb?^FRM#H?#vQ(du-c}=UNAGU7 zPli<)j|T&P+u`6NDOKfnw+r&ON4X(ovi@lGSrw}=r8SYfQh33GEMj(wtY_--K?;Dl4LHfJqta5WgG=4n)h`khQ%nF2HfU|o_!zvmj{s#6&zc_mAPLtZSYk- z5eu>0&m=N9hLFU&KtW7s1>HrL;Fp7ddRXe?Lh4OM%O6jG5FL?`70Xr9JSfW9g|#NL zB>abegyW7xka${`OT;4>US3eQfmc6{AEMSYxyE4HoOb-6Ks?VLw!z6U_XKl>aE3e) zcr1TekdtUJV+mo~jI_LbL}ji{w}V%BN4*#G!*pPQPah(D2cEqwX-)EJQaU3aE;c;L zZOkT<@DtN7D|7rI=jvDcRfbhlUpu8Yoas^G9uAx7B4B;4fU6@>fz%}Wbq8@cQK#Yi z*AK73e^F4)+R49g=#^Pfaa~A&T5CfCAB!@Tg6=RfnIkruG0*y(v~@{R<@sIqJA^la zzO*3nnBLf(TkP1@nK%&wv^kVo1s?{G=`4e|p2JZ{k-01BlpWte$e{8;*P4yH3*ty{b>cJo-gl7KydgP=Wpi}V*Fx%|Mg zxb<&74cfV~1 zS(4mZeJ=YbN>1-M=v^WCm!~Ktic$0G;!cFp3L0IQW-*t@!EF>E)mX{`lh1YJ@A;M) zvx6;JCuQzPw3(3aRrU^@EriC&H_0s|Ej4QMxbmSj=gz^d*DgR-ZCoy)URp` zDUIif@hc2~y_~$9jf{AaLi|L1{gYuv};7~g4h5nJD&8V9g&-6lc^60>-!V)?t_tt&_m^Qw1bMhG(nVoW}t1r zwz(C*8smu0%lsmjEuFj-!~c<_7_D{s7niB_z~s;Demg-!C~@uWIkPUIR=LrBc9}|m z5dUHDFtdFIgYf47){t%uuwpT{9DZARb2(v~_#3+YMKRh;{ddC=+91RAw@d3_`nDP} z^XU%U84uVKC=fmZ%q^v_(meFruKe^Tspvsg@`DYOw)|B_(mws2#%~X-&sDpf@2Z|R zEK8N%wyUBgC7f#S+a@gaAh1?vE#{v)jbbH7uk)wC4^|O$qo|Ie5WbmH+{1; zI}4Q`AY`$voT~P-&u!klYkXMEUyRAktYZwPalV3MhGYH%m-I!LTy8KQL})oG!~uGh z)i%Jgu|jp}u;NAm_;kN$zk``+8F!1H-xmcSK>dX9?2f1^Cbq$g!=Y^X?YgO22wWeW z#0pDAwrG%&cg$wge;>$c+Y+0T@uhh6@ zgqjW=%wemZzQei<;dU0`QL(?FfUUxE>3T|2!E$!Niwm52;Xg6f z*J^x>xv=;X9Q}>aUZfrXV}oXSzxdKsZORn^{6&WOi^BiaK^$93;V7wAcTxJGSHLiM z2`b0G5*-2qN0xREylf{3!~7nOF962;1cAQ|R&pJ@S);jbuZDiE11$#vNCG&p+yTlE zXhwijlStRfotvV?8$khs*bB1~7tQYkfg+rXgq<98kb|&Q`UZOXviX5ADbtXhvDM&Y z|AIh|zWr^>8_Xv)cY6Z{9*{CgFFiLhi<%<xgGz;K`3wq3;g^(T$|xtIZc&eN1lrC(d8FHk8?(Ppy!%x%3+ha2m=3 zRFqbX5XkmNnhZR=cnD;h5&02rUL3#B#GRzg#izKqEqnf>PVNFO%&_^QO)Ub}KUROR z5~@7eyA)L5(m~M%>q=t$w0FY=RFRrTLsafAhi$2FP3`Qej7EwM=U2^zvJ|>>5GNGW z(aUt%;zx1>7nbA_>!8P0q;W*l>~gC7W$Giht&Y1zOobWs`_}ww&SCX2F(osOW8od;?JrUVj7VKTnDaYHIhz`-70gPw@;(1x z8i9`tIc^Oc zqrFemN8<$MwO_`!8Kvrav?Q`bl@-T6Jl~kmLL27EKdLgPA2|Y(jWBjw-s&5>N@ogJ z&I+K@MU)bbxQKqoaYAB9(V@z?T8pcSYMp1}aBcZcVN`tZK*QNW9AUwAF)|Mj{Y}a4 zuSOolQ%Ypb*qV6rF40f#{$o<8X)KnqFy31-hH0Q_&wP=BSm*2d8(LwtE4e7!9EBBbJe^rsjH7O`ZM^Knxm+jcSu*+~ER zu7<8%MDl!Z-!sAaTLBvH39ad5=&&L**n)NERWbjt*^L^8Vzxs8ruqo&U}IJL3@O1> zPOUCiQJ$K++UFk+2MZ?iQj53+Likw0rz+E;{nI*i8A{~s@^)ENLmH?yt1`8jfU@EP zE0N{cnW8<9W&a;J3Ej}T>fti^LX8%jp6aon_SzfI=~#z9#{5-SzPQPn;v#$}vtm3i z{TCv}rf47?I-Td>9ixp@J2n1ip+{0EdjK1e32-r3GI$f1^W0b0z`i5y!~vGxd-76Y z&L=DBg-FdU0vOwKyn~xY;o$z<3gD_>+rVJB6qu{icGb|)aJhWh2uMx$FpZt5I8~L@?X;rQSh%U2zUwOw9(#)pm{H_o@#<3tgZVQxzoCcj-P~2v$P-Jyyex*vq`!Y;k(;w31l;F(-E5xz8!et;N zQO5kgiFpIpBwFb7S8vy>&4ZpDhXz``UAxD7$I5u}x@?`;75uCF)BSTPC~oKVm{36P z&HZeraf#$dGi-TYTBx85{TW!45S1h@V7^C-Jvc2dikFEHnr$YSy1GB6B91!oMp-GU z8&6wJO1@IWa-)a?sXFcNcDMTs6&g?Jpz$|~FsD2hn(h@MKhLV71IJPhs?p@7Ntywx zBj94?ft85w6w;tP>tq912+Ky~+u`sgm&Pz1Zo0m2y)k@mhUaxY_T| zH+uNNRHM13+x^C->{jH@!{*Ch&o8&rn!2AWwEmuVJls||>>oHPTUXT1%Dat8%g~&< z>iRkHw;^I^bS`aeYbfRxHFYO zm&>%RkPn}OG@>a!L6dcSb@}Bozete#m#^>Xm0-RE$388wk8t0a1=G1|bo58f6rmr- z3CX?Qey|V$_gAhxge7cIxIA_W`lUH4mCI!PR+x`Ptxju|OQY33JG+8V%;o$aY4f|l zNLquy-_VLDtF2mMiMLiG`UXtilp*aVQhMYzv-A?A?rLXdRYjNw?ZxbVKGZc(XIaHl zc3_WAG_&>n9%Foz%1?RUS2KKG|lid8#fkY{Kvm@CXw@mQ|+<|!NZsRM0#!9!6U z!(P_$Uq%Ftl|sCO5*?b-hDYX9xhxK;4QIs6(;Y~iE6JTsD)PIJYWhb>oQ6-8QlBvs zu-#%HjV}Id*29wCR{QEY&gcPQ+jl6laR4X*sh6DKY@Ykrd}%%DCEGG#)*?blReFoU zm|WLwtjcwWXq&ZGiJ=-3Zx>2xEi%?f|TIgozT5uL?z z#{_qP{T6S4Rw%X?V(JI# zKitATdl^a_OgJW?in1P4cWXW+UE=F<{6y zMp&wQx#nrC$HgY}Jx$(InJ)Z9yk)xU&qgb+>0DND_nVD$TDLu1Tl%IEGZ-fVGA8dx zH2C5Y_%nPYXoa~FxB`iTq~fL*SBv|Q``?1z+f8&zj6vjWqq-o;90alRk-%WZQXUu1 zJ2z?WWdz(JD(266m=%;^wb&fLg_yq_&VOk%F3`XmwoTDpeCXtiE-zW^1HMSf>*_1N zmnN?q0GPkObIV5pFahiDvE*$@?^(PFwi9Ic6XN`}+_yAb*0l9T$V4ECdFO zQa}=*nEVvBewrB;Ki0_?fKQ>o0g+O9w^zrl0js;W@qZi7Ea#VvYJU#xV8Q&u&BJht-+bVpLlI0DmwsN&M$7Qmi#G zLszXnk=%$mzEgNK2&vnjL_KP`CO=IY63zlLq}N_VDnfKdB~T`#4mifeET>!Zk~Ch( z#z(wyHkpu`%(6vTaK#&FE(~fcoZY#IqXkxVR#D#0oUsJAsWKu)MUApf4e9ed^3yDa zh{;?SkpHcn{G!<(IxI`#?yr024TCLCNb0pgRHqh~OAP*O{S+EbMe*@_oGQ)ya=_G0 zZ<1o|#g#SJ&eIAuJtUj`;tj3=j502>%MmxW+Vqo0LqU?;;}>ER1MbDcU`*Viit)Y2 zRcPZNuAXp*WNoXNgu2poHbZ%c7F9m`4}nv`FjA%=N}cLfWuUXiSBaD@eV!8LJV(%y zI!}Fc5KmR70ht;^7s0;W#Y$*d{XmNmH&#Q@lKa0iPXQup=nngC>y0lCf3JVAL2shn z6%Tao8VdbL{U{|cmTSv(-Nrh8?OMm#6KJ7?yWR}B_kwy-q%-*h>p0~+S{@c*lqN15 zTYrD@*cO54eTcXXr~z zo=N>o-qJqoRW>5(2`{{V-_=1c7riwn;kC=O8VV10R8x5RY7g8;VzDI;VAo;j*^bgSDhTjPJhipUEO{Jeq8qie zYKu|bb*H6nkC(LO!?AFm!d6w)BG;&}?dV;_DIy3Q1OEp%maE2MZIbGbwMxdf?i(Y{OoDG}nfsTnteY@JpRJ#g1JZnef z#I5h&zsn0l3<$JXy!Lg%Tq_N^Ouis0G#+(ZDZQS@0TD1xwlD)7`b|DL6#6x{n><m@7kh9#NX;WB$iDwkH<$0VzpWzzU<`M+&o zA`2PAwHo?&-zrDod$*a!-i?Bj2Wnk>J#~B+<#LH@8q+WJNB~Fp5$44#Hty}ZEa2>w zhy$MFTg<<(xf%?L`w8%F)q zpDFO*-x*jnVR`+0nJR1Hj z&k@I`%ud}AsB+{dKndj{*-Y^a8WU(2<{Sw&zDwPmrucgM%v)`8Tg_jkUbJh@r>x7F zsFmvxU+?qky%J}Qr(qblR)db*^+U7bo@betX8WKTO7U3+26wACkZAy?Jf$gl{qG-j z6yG-mxWkPA6e8cZN6Xh8AuO=em-gA_UI~*LyKQYSb?_spyro5lU>Q7X&YtQHX@VR{ z^6Qay!8SI{%@Z3B8LqU0AKy9;RR}uoHsm<`;|OUTu+&8Z2=60 z*F{fy^}Bi9Ar-DP1ck;;&jmc|9G2VkewG!nPPi04!#(B6PFGdy@B>Va_Z7iJtxiHI zUvN?1ZKISR{QtXDIxlSR-t+%{lc;=1Q#izRIqW!~I>#!_kQCs6JbV zp;*xJ6;~04h`*~|XQx1Xik8T9DDbZLFu&cKj%ng8$$VR^KYP<1>5x2%krMP2TnSw2 zNuw_dR*UhAdr93+heITC_A;1R>^bE*vJ(%2o>8KwXPsJq4D=)F z&byN7oA~PBTHQd6f0h0J=;4MjMSLc%!FI0zi~)G~X3-cjzRp~hc_j5w@q~EBDj?V` zZ7bj@fiUS>P}+81HQ(v8$R*Av1YU=l0)f1&+Q*BSAVs_M)djEuD;oaL9UTw4h3xj0 z|6pO5H8&dlBzD1>Eq}Q7$rrhkSFV`NB8+H{*i?(qF|NC5&r_|b&7i%MQ;vcu-)Dt! zL26OGR20jNO!~!;ILQ}QgfTVxkIY@Cb7&flp7z6O4)(#qBnqSePd^ zupCl}sFaB8KTY7R)k*d`B?KrdRhGUYlK5{27pl@;eAkO|D(GT2%rhEMx3;kWhBrGK zpwhc{S=z?ftN2DyvnmRvX2mgjh(+<{3^`A(4i9Qx@H+@Xgf9~|=h!whu%KxjT7oQf zpQaD1k~gMg?ZA;(_$`e!gpqzzVi|~fy=W_wt4Bm zyi#tas|$$OrKFs~KlT}`o2|)~t>l}NGFv3<1|Igz3x_mc*dIxYSHkzU^5*4m4YGi- zDNa`~G^k;Il3+^g=j%4B=M2TSx?LI{W#4z)yZ)AQ8lH37`42-U?Ef!ISsmuPRqVU9 zd%2`|8G7?)VuHFBHg!bEUn_BQ(p|i4o?`lH<>?9wTi>mZck>FLX$EC66u;}vPsqbl z(cj=NO!A=$22AvWJ|#!D=*W|PJrdY+?3Qy@?XTSB*{(MwBTaQ4}Epb|Ly6B zpg!I!in4mR&U>F7pjC*X`CC6jh$bM67dg?%s(-x4__^B4Iu5tJaGNuaFG!`{&rteV zRfoz@Fn8+KlAb!|b4y<%Nzd0CLtG3feB_ysY4D@Jl58gPnXiw)7LdR%tNoCTl zQV+2W6$AL{+E&r3?Ja_Wo#FBWZ*f2pNWl~o%*#`0@`e^6*RW=mcvQABhJdu+z&5(@hxay z-1^#hSkHoI44{Ce(;e`r*JL1&sFfrvcd^%<63p6{n{8$s@Eu%qooWB(vyW;n41r4* z-YJ3V4bww$Ed&+a_FngdX(LoeWjvPpYIWv$gGGW4JQ(`HMx+oe6+#M?B`&phgNMb{ z@MX#1MKCK5{$^kSNuDM{@gpnp3V7xk`rUJHY%DIYa5z@(si<5+%3?z^dFX~t0e|Ai{mQP+KnXFPuEgnoO3Yb)+QPM?0^3P#}nPPj~c zk!yYa=TmDl$LE;K^bO*PhuW~Q+Wjy3+$8DTvaDd9XIbBT;{Ej<0WUgV^QtBkl`bT1 zlTq_`iBP_PJLgBe_vc9Xkrq;#Mnh%;C+VJpZ*vDsL#HmA9&!#{-`^S z5K_W`=E6^hwpc|O`=+90S zL9m!P<7Zrl&i~0m9uR0rou7?f8}8x5^~5uqp$%8;W&O0G4dw9ipss|SM5gec5-uI(l2qZmj?WQeduDiuRLw%S zMJLFOx~eZ*1gPR}$rkU=&Z%)=)+($aCQsOlmQKVs6)29O&ar~wlg=|5Gm{z0$3gW} zT{7Rt!XHVAqxf+E`5mLWL~CMAlLI{DW4d=#={VBpe|>up)<=FX=Uo)2HG=ep8wr(T zJ2i{*XFCdg7412{xj^N-Dn-F0ZJ(HyZEl$05cR;L>venFtN%yUSx2=QbzL4S?$F{z zi@UqFxE8CR#oda#7k76l+T!l+5Q>H3790Wu3zkXen|bG*wen}OR@Qp%bMLw5?ETwq zZ$}(4lWmNYo}`F5Q5l6$2Gi^kzji5o;pOkXSl&dJV*}m!F((L}vWB5>;OVfACWz>Z(N&Lfy z&haV~tROx&bD-=TB1JrVeNS>nf#;hz5>>;IrW`p9^$e<=u0xr?P}1n~xwsN$D)3`$ z;(s?GxC<+C*1}$Pbw!Tm^}mcUo>I(f*jKt^7rw~5mQlSaMXkPV{M2tJirNo| zLL$}_Mxv!ZP_b#uzCa-_wOallJDt%-8)BmInbX?Gb&y}C>SMGXGW|za6QIhsayP@Z zQG}F>_fb^p9u$alm{eD(&!$<&|LMJPJaAWFsL`e(M8i|t{874C0c`jBnJ2+31T`$^ zL94-=CS{TIUf*PrNcduq!Kao!ND+luMtDIgDs@|naGXsKmG!cwPoF5;>+VPfBpBCI zXmXPtc97U2uF|<8K&|p^WqEJ;Px!+rcer{?)G;PZ#f{#N*{om=XHbl#m3|i%i^v>O zitvd-?YiSH^(o!YbE0u*?5JAB+jQ70R7VIi`^l>WC%eo=lo^M?sfw$y-IV%!Vc7$U zd{07X)}ryLWlSGLL_ zYISRyPy0ebav41gL5e3jKOK_YGuF(}6*j!x(KTd8^ghvooUDD4$`N*h!nb5~qOmA| zrG?urIc-=se!F`W{)D8IITmc5!_G(&iq6V&nMNOpq$*hWnXrLzlxZ23es_}P14 zb0lqrMdUxIjh>jOLB($e0ZKn;)vQBqF}{>D6HVPn*C9F}>0nD^!1tWShOh#n6^u;i z**%tK)(a%?1rXTq|CLgQ1uye~4+#jGaQYQw`nK^=xF4;TQVxWIPTs6ep>}iK#$Jto zr&Qz}5{Mc^9<2 zoiaLcevOe1ja6;$#T{YQ&y6py?Mvex%xoSw34R4`5AbGI}C0&o-=-#41@;4 zrQQG8YP;V*s01EyJumk{g<$&`xRHaM_c&ozyIMjt$1+|az8FuCB7`3l{KLrH@69&x zwmhRa<7UOt6pB%6;kS&s9oI8LznsHOhDolV_d`y7NoCcE zXSOMkv~O*c_ug3LG3aEOz+q!Ya8AHfDmZ%u$B{6bnSH$1ro>oV1Dzu!>>cg7QnsqK zZ+otx1o|hr0Se`3p;Cx+8%^dJd{0Io5CJ4stoEUsUj5UHQ}28A)j1(EZ~R3aLk#$c zpTBjofJ!|#aCbC|3JR`x*Woejws+Zn`v{SGD3N;Dgw;#kj=mf;{MU^St+e+R__C7l z{I3#&dGC(G=wFr3vhq02;{?%eZ7$p|z$NS$cZaJw{qrpcHDs+#vL_2O@SA7rYu4A4 zs%qO|I~^0Ww3vPNAatc3_{q zjM~dVVxE3}ZgyuBx3$OBayXO|DldI}f0fbe7liOZr(3b$6*F7pqlm76a(kg9ks^vB zQflJOvJCBM9}iB|0ArW^=~Nr8n?!1!?I@@4HaY%H4|LjTB7p@d2yUdh;T5jL`2pIUw>bg#a4&Z2bEVWx`Adc%cW>)|zw6Q=Sa25~ z`~waI)jp-wO8MTN<}uPdi%&taXbJhFQ z71esrN>0WEp3Yf>`vErPBQ_Z$QHA)k z{ELixVP#5)&PDH;iS6;P)9W?RwkvJ&cO>uaS(%kZijJq(tae(Ta!VbQGg0Lv@m*2q z17r|)^&AHUT6U4FkI z#Rl*=bgi2CY?Gsd2i~Qs^d{k7)@y38C5)uy%NSDj6OfC6sLZgyBYaPB4aDz@J!p;G zQCEr)^4Z2Mm|6b?N2kNPt4t% zXwo@mE(7A@j-Nv}g%v37DVKczqPb{*weyW$o;c%2t&P(-%7t#cy0mv4`K*+hJMW0N zsvQI=LghZ|0Gl$jbr_w{ELT<&pGg(KV)5n7F(dRfl@48w?>L$y6|On=(h8<`Re`fG zRX30I(eM=|_c5?@W0*KhAoBWG0zh2<_?4SefkHOS7Rxwiq2=MXuU{D;uo?JI7EzFG zHw_bjjY4Y!u3W|h<6mg0n|zH6)tSrpg(r1vl$w0=DkP%rj#}fI&vyZrosUm|GeG?+ zg{EKb@dUJ`+K)VjS=3u3?yL>H=jb5t`DP^daW}8n+;)j4%#oz zBVQwI-i9&G3l39njnN9bsE!!#eubCB#^n@-cH(!q)J)H)n%N^f@jBesJ)EE^C+k^4 zmJ1G)a{HR{Cis0DJ6SxHVFwoMTj-@VpyC{t!kf~kV>gYz`<3;py0#w&>m7c6e%feK z&Z5Oi1uxs*O{LLq$y5}DVO)6YG`?WJeiZNlo5!l(>}s zWChCd=~4}p7Kf_I%&>nF2;tceMPIT7w-5*se-rJ9yx!SGez=V8AJN&Tk|olq;3xn$ zjYFtcAuwYx*eS5*w%OPwPzpHnha~elQV@g2BphL6+%sIMGzxg0md>b$&1rz9+9rt6 zdfhMP+}}Sm6rOn)<}g}1+`e*e0;0N_7dw3!5pN!2PRPR^mVsV`lEw&3>Tvk83$kli z#eUjHo~KJ#uTf~P7}xHZX#6Dk!P{D9&KKHQ6@T`e<}Tu8N$KRmNSy{%vLwT?a;&{n=)fMY7^2P zWNs`rZ8j*E-zF_h#)$HArD>V9?!l@3)N}4m38V=XF`)X-6qSxfcX2nhf+H>=?q>R% ze;-?w#2(N}T8rXR#3TG)*b)rQ61;B$7Q{d7OXfRe!FW?P>|gF)G$6hAq`Nm8cy=$f zP~)YiKxIhp-MaZp#`qm>?ISIR{! zQ{cXG*;N!eVsGo5Y*`vF$BT{&w}*ctECgKIV2Ul9IH6mCvt(xi9&N3+7n{7m!MLnh zlvn5|jEKG7^6_q4%4wwzD-}_quM4%JsVJax==ZkOpI;TSHY$C zgk@bg#clHa7%9RiBtpPy1!?rGYxga513P5sF<${x6)s8cR>RK(S5ih^8*oWUS$`fo zqQ+Rni{W{LxF`o;;o=+_e#7GbODKRjQc_kl$WYpOJ~9;;!?mWCDVM!on^uCbycsIa z9d-H3)!>5!VgW8A%V`F5FBL`_B5+_HxhmsX9L+p|g)px95tXEyPXFd;Y@(x_OCQQ*xKND>J0O8b9QLn1>$}!L6>| z6u2M)qGG&+tBZhnvG0bRS1Fzf`J_%yi6lL8H!R21u21;b&t^IhaTc5POV^(*Ix9uJ zPh_>dh5(DKIN*dx;e*3b9`gLojh1M&z7vI&@W(t$_tRYsz`f(|X<$Gch-zi@fqP;C za@<+jVRW7klM^{z|F@cY|6y`h9nNgPx3||&@XdTr{vr> zduumz4fs{?MeXgNQlZP)$~n)sOLmUG43w`i6$bsf81R3d+~{Je4-TcX3<}BsA-!1O z8_W&_(A>Udk6NSn_nIz2;X+fb;31V@mU19?Tf~5&VFR@Yqc^AUdtoVMkGeFqO?J7k zUiOLB8F`4dEHK85qRX+$bJ*||h6Z8kj*vP-DKp+Y{td=*fN}jP=Q1-DV?Jpp@;n?w zfUn9(RAsP57DhKY|7hb?kQJbVVd6!?Z`D(gwksRaveJCx<0l6MYySQgaMiHu|;4#FW8H-FDdBo$Es%&6%S^ zi6>QV)HgBkFn{>S#VHZvl?mvN?2nhW{%--n@LwY9s#6cmqp^UABsr%h7P(_JNfF2+`c( ztdXQi@e-q_-a<^6)Oj+_n1>xRY z>pWbA!XLOA@op%SHy#Lq?9;S!aMNz$9xirpAaOpWnv;sdXO%3w-%~)A^Bi&RsTkK_ z2B$Hm36#ped_6s#uU&-j^8b|V2>-?E>@(%s{J6bqUFM}Fttbw5V2g1w4?G& zA=hb}xG$Hm?hewg^Vt1_07mV`VWp9WpYkLz@0i2L}~yV(>{TGW3xXk-+clO z)Fa;z{2kHr1=LvG|5*^L(Y54cbZx-Y>m zwA5^EEJ=Om zl&YYr$zwr5^`=Y9up4~&m0C&CbI?v~Gq`2V>)Lbef=X=lYltmZ??$8>Z(QfY2Z!Ju z^L3wmBa$1ED?KAytef(OlGGlEQTH#^)z#eybARLC)E7MX^ktH5TE?u#v9I5HR=X|a zSR9@WNU~Lh9+x-lcn5ene(GV4ndz2f<(sHzxxB3KTLs${z)lk=Bs<;W<+B6=J}<4W zv{v{{WPpFzNy55~g%fmYHYBqtzQ|3CvzI>jUSm%tk6PTgz*Rel8T(QNy_e9I|3P@y zLIX`-?DB0Lf#PpkOQd$WVV9C|h8S{H$Om6p4pja2&(^pi^BRZe)53uy5c5} zRD9i(ttD^v=k!^f_>g3N6``}*kJhdMy!>jy+1w=F&8{Z&-L-5W27723fhwd!N=!hF z8xUHzuqyq-XSH1u?v)#f@)P#Ui)h;0blY0B-bMLfWF4-@!loE-h}WKzz^`shmUQC^ zMK#UTvj`1pTc_g>etWvhpr8Tdbr^>;iX30maH$VJN804WEqz}Gk?;p7_^v|D)fSC- zyasDHv=p>XQYYQzWihwa)vf2at<5{t&6Aj!7$A(|hCI)8Uon~)3&&TF9Lqe@s9Df8 z+9Eu9gKx(tUW*0hGGAh=L7O_6A?QLeF`H-p6uO;l!088mnQlXq6CeKuD*aC4>cN}F zl=P~D(XQIMiocF=s-Fy+f3J^iPypw_n{TD3j6Yki?DkJ{7aFpP5)cA4{MPbNsS{CAsR^h<9D* zTXqROZ91t9udowsreI=>0~FZc&gQRNrj=d)waKWdGZvx4s+u&ncuSWkW4a%QUCcLSq_q`C|H5#Yr2cRZR>k z+#)_wg%Fc7mS(glh5Wo@nQK;q3Zsz@d0YdyBFadBk}xPBvX%(_iBo1SLNLQlMT{<0 z!=R*v1+o;nwH=L}b@Z+Xqs+(IH|n6U0-u}GD=>xnx`tEXUc!WRX!3+0;)#t(iV29C zKaTj6KQ#hOZMpLLh}fw{v-l0f)|zv~;!x_Tz;!R&Z#hRZ-p%`*N0|9UE-Duj`c3q+ z)v&wFJ3@xyPweFr!LzH#@y=IH15Pw20*KfZKD_#|2yGnHLvF{wQrYtHjo<;9%!odN z+S#XgMPCa4d_hblZXg>}hzczffwF&mzelM(@0w@bKKah~i}-1qT4r!|z8fub`84vJ z)c$4uM^u3m8tb$uO*^bbd8W~`eRJ0mUh7~;f*kde0m6xWJzok+(iD@AQA!6Yq~rr{ zbKdFwqgWQ>YMK6{^J|sPpS-vMwms;NAt#nh7W`tGkHo7OQ`9E@>^q{Pl@Ibar__%7 zLViv8ar?P*CU`Lmd%H*eolu3%)sk4O4HKgYk3)yk{r5}y{^H99f6wmfG>s^%m1jb! zUGGdWhzNMy=C5ZC_u6fNc}L%Uy{9iFcotU84K%W%u&ANOs%IP!sf2e>t&X_B{8l*; zMo2FaWITxPrA7b-*UUo#rvnRM%8!ZA-c^Hh&?KZGv(NZf;Ky#CPTmAl2XBux?j^C9 z?sBZr6v^6_{A(Q4Co(Xanzq_OQ5rpdSeTK`MJZ1#+?n^PC)|n1zi5jn{9a8=nl`8u zh*ExayXpk4%SMt~_1gI5vO4FKbu{cABpcL=nw(#BnC2=e*m*JJ^~(jvPXeWU70v{U zNSGZ5#n#4-`7GARN&c-a@^4rd{rD~L2m|B0G9K?@3C$nAeUBEFGKV7Y6=q zG$cJG2nxnL5(qa|@P}475B^N4u5?PyKFg?!s9yRQ%LC3fMjSFCT!}q>(}5B%rMPj% zl?yT=YI)wMd}gt1APJ-#>)fK7)aw4SKCU5#l}QPzNUI_)3lTPb zI3K*xYGxzq%{fW&A-nzMqIT!aE-ERO4I4*vIpBGzNwD<(nLBl{1GQ?QAMrd(56mP_ zP4O;VnCF_PsOh%INdSrjB>BMooY^#11NE9f~y05>E~`zPQP;cpx`F%0H&l?`-jfIOx2KTJ)ry+`smASI zGVlapi!;Lq8PhOZ2<(fu!F=iY!;n;z(#Ba<@EKZr;|4t0eIc%(@IMm}P79gA#oQL4==K-71|_;Jv_j zUU=PBKVK-EwQLu?$*@7uqvo6!Oo-fj^l`T+4FBAUr1)(rT%MmzI2^u2Gl3z1*8a-k zT^xqYGZap%#BykoAsXf%ohaA>b#rlIsujY8xcPsNB!2da>%R~8IKodm=!WxvY^RO2 z?OQSX@RxpAAQAt0_o+X*q|upURd?W=@FS0=^z7vhOt#V66qduj{RwfXq@i^$oh6PzUZ@7$UmkX%d70*L1M&NQ1Wrb%23DtaWBLt+98 z8rtbM#1BN9>#pPfTn9;bcEp0!X_9cpKGFDouJ-pDnzbhA<{9ZHLpT0(^R-iLa0hT% z?1~#pS*vfiJM)Qwks((&%fn>jSAn2YAXw-z5B$M*6>WoL^@T@UWb&va@#K(tH(2Dt z?M6+6x3baY2VN(ipwC_YrjY43w1_uTG*>9ZLuvaD3*A6iG@b+&z8>Xi)2y~ief7@x*dF^$WnqHrdHNp1<&yByU?Q! z)uut9o1+!efmR5$wGPN-QwOk~|CCXqPrdEjFn7wZ(~}Y`ITDmfVOVX}=1pS~>?nj| z9*+V`kSU_MJQmU`iiawL;YSA8CBxjh8tr7*=a@&FG4?RBw0MtK<0o3-s(C)MXWGP@bTZqGF}ciKM3HQnA6EYTOum+|AMQm?xS%nadQ@ZiPT=8Z@9fWm3!Fn&MH;$;Om% zB_RcGk1MW=gNC!KEV6+c>)K!ZVqk}KK>Af)b{28A>8C6UB+a8nJ&uCG@GD~9!1^xM zQ6ncejw^sV_wD-B*25a!^fUScX~ScQ zmgzu{i_J@?jU#8lgfS8I!hE6XUa#O6wDIVQu`gp@4MtLEnDoYx{9>VVBamfPCNY0A za4e3O<4B}N2Ey2dc+=+v^0Ox##8=r>%8;(*C#NpEv@9c{TyxXcTs8wls#;D#+&Ge- z6n!|wKU3g1EQXbIU+z%^ueA6X_rh7FcMjr@xZ&tw%v)qrS78_C^*J3TL&EicZaF=F zFfc?Vrz=4zO$PMeN`LjH`PrtH#-(d9BPom=9hRgNFVU@fi$ADzgdNQt*tB=TZxH!K zGX+x?Gaj=KD0U$Ir&u}=wqOg^`%C|V`O zE5!QfQ>Gb2XYZZ*n%Qq3S$7Ji6r$Y)WL$R!n6SH0gII1aqv^B{SDIpq@T%XK?5&xP?96-7wGU+nr2F&!G4=cdyRsn|-5Sr=o@gUvi8F==^=kYjokg z{t42bk9^3c?%aA7PBhq095$7EmYBT8xX`ZsSC~C7mj!ryOj`;#QVj!JEx% zJ62EwzAjalnhl(+*eVdlln51ONuO8!B!=aOH2{VmRcv!(3}7||l4ACZ+*jQK70Y|SO7d%84ZBY#Yu?w~)9U7y<0mp`dQ-6|$`rD` z-^JQi&1SR%u%qLIqA(zi&kZ$Zw#_CQuBvN^oRNy+oEePB90EK?;oJM`P`R2whPlXJ z45)*Xx=({hGWcalfPFD5pYy)qFJ)-Y$gwBZM0?x4?Ives>n9f8mSYj`{QYW24J+gB zZvGrPRD_Ef-VLwieVGi)bs2+p(yU7?cg6eP8QpjZp3i-N)%}*k zipDb$;bCKaO#RDlu}npE{CVQ9W2vO3KT{6y+rh-+(8NA?lhJ~Ct*|0WP!%G=Ppa z2XKmxqTu35f$Fy41 zyrOsY)mO@j>=|()UUQDb71--u3;6nk7z4pG67A zz*!dclw->I$91W)%cbGJ+-2UjQGv2@1NVVfA}Ea5q{747wHO~wcb53I&IM}GErx+`@u`7H6JIf2v@yib_RYRM!O@h$N>P*>(LQd^MJ4-3@7??j>Z}%@ zPVzNRN9M5)hBry&{w`p9j1Iy4R}{t&2`4lvkyKBNIG+R$A9fQ%FiCCsqKow^Z-DBv zp%y3XM|sESC^1;yxZISr|0gduqzpS;2FIkaU z?M5C6zyw}e;ERUk|Fo=sLkhgF>#xOa9F@sb_XT@=Ghy=np+8e)N{&?h4xD0Zj{slR zZ`K?k#yLv@m$sOCU#A-s!3*88f%jhU|7lu&7a?t~d5sv3`M;Lq``}G~MQ`T@!Ba~r8m9VDR@X@)mV0_DYh?*q4Iw;U zVG3ei)k;8I94g1%abXEgO3?0I5*7GH&YeDARtS&CJqEeT56U3FbCW>V#8orW?&Frg zo7SF}c0iAZcYL6Z`J+^Ip*tMg=tYq(*u;Q}j8_8$9*C-nJDM!Ul13ZeUr;F$${nb&prLWN}jB>w7K`m|C;i zGc~4VBB%8+CdDR5Y96BTOnb~ochsHcpX@o@b-H2s)w0+qc4bPmGA7W^JRW}T<$e$_ zims8MriI3=3_t=rctxT-7UO9r+kOg;>71EukR|Cz0ZPctQV(Pc5?E`0Ue>1 z@M(ISiv5~c-FKNb`%UVmH^O5)_XPAh10?=ER8`CZzI9M-+@wWCb(uQr*FNPdA}l&_@V2Aa(Kki@BD284H}=r#j7 z(UBV7Q1B+!^8mr2{W5U z1W*W3=VikM9Hd#9Pczo4@+z~UH$n-V_Ops(#-;(tH!(nj{)K5p>h`;}ALYC8Dx=iz zLW9X*fXoR>zcr(<)~b$s)1&lT4AUPMdt-867*&^$-}zYkBC!`!ddA|eA@=PMSo&zj zxtSQT#E1Lk-*ckt(hA!Y5=qlBW`>oy!U;HGE=A5AIZ?(Irxl0fCnap0_+Pr<@EPA9 zQTSV7Twez1#{F)G-kTTvdg1I|UGZNI-iiFnsT)>oK z1Smk{VLyV4Ic>T8X?}H=cShghX7w(l8r|KT-)Bk*^+u8~`5tB;OFRnSz4Fn^P|CsX zEEWY&o8J^|SW%z-j)nAm@!uueeD>uzpDFM^C8YlZxmRg=XE~53=|9iJ$3G*C9eT-)+fSrIMYVw&bj0RtbBP$ zY*mgA#H~8;)?m28JyFIl>ucTQNB8i~)iB9ppOzrAXB8$iS)=^;?zU9~^2 z^O5P!bpVLL6!b~Q+`T^uxien|M=Oc+(}i0|`&(3bu@RJh1dCP5WzFpOm;DFo*{GJn z**k9&5V?chGLbMlavdnnVuNvUUcX|7kIa%U+89R|Ke=IQ2o0nBay4MDVbNUQT7DBo z!FM*v3ZlS}zb)$84k3<-lk5T{%)lqy7SABSofmq`EH1U}6C*O6Wf6XJ9hUQ2_`+yC z*UrS~8x4~Cs=$g&d92NCXj_VypY-aZ6Zgy~Bg0-!Mp8$Gu|L5!7kIrZ)ueJd>R4?F z&$iI-BiMoyAat2cG9L6(u6Wt%d@7HHxTD#~{>?^+T$yW|l5Em=ng7tD{=?yI-b89y zpz4Gog+q-*?R}2$#h;&k*f&#IT=S9=L(8A##YW|E}KdrW4EQl14VeKZ5&c$Pk*1sG~H5S|q3lt(@s3Q`fq>KZxDpo@hKu%fq>Y>F&-R;3YM zz{wkD0jThiVG|vNdDa=ORJoitf&ILPLv+3~zbuRkXD?79%Ml9v81-U8jZgfbX%!^vrOJel z94V8Wu=xWVMsGSnFUz-(L^^ALAND<@pBlM949odyupUi7yH2jKk_M;7Y-ce2buSN# zi@GT$5oaB&5*{9Q$~9r*Qd-RZNm_HCr2Jkp4LYKp!r0?);wedjpV1;6sX2UiouE_y zi8Z{weBzQGXr`UEtDptMVuHSIWY1l^_A(@0JgVn z1ZnMvr5f2pn1ryq`H9!nt)lfbP#TRY^M$;uZd7;Jdg46?Jb(KxyeLsyJEy}|`(XA% zsz`9Y@z-N>Ky`0y{hC`~hM6kQ%_#maz{CcD|MJ^!l-*K(szzUpZ(WK!0!OfMEub%7^(jj7Hf{Xk63aRZZ2LS8j(k5D zO+;Wm^$kBcvNqQ1OcqHKak@JwZsqY*e zBCg>8hMFUk0m3FNaqv~tB%^4??0e|XPmkD$&e~$CM>8mmR#m>$4T+BV2MW4-Y{q2Y zL~p3x>E5$p%fCyNP|lI?zjf*O`8G$Sw7qiUV&<<~#2dn}dv)xW=Jo<2d*)1(quYqx$MzM&OV%h zwrVfeJW?c#m;B8PFMgHl{*5rCW&@kFq)cS1Su0DHd0h6~dgzdK!}w7>BuQ2l#XWRh zNJ=m?1gXg%23K5dIfwa&J?bJab00XxAh@FodaTu?3Y&{>AHsI)!S@X~qRg>zumPVA z?|3`mD#MfB&-wO(3y*RRrMDv=&Rs{vg-~DSo_d>VSkD|Fn~%2tZgRjU_zGHeDuChJ zwk&W8#0BHO;fB4dt5|<}-q&V`$(=@KKlLol|TPIia)bF$=>pCdWdQz;yWUbG7AKh0ZiHm*60N>hiK^Hg zWXJ@iLYY(74YMd1ojBQsvwOd+_QGY@83=KNt@D`qUk{|(NspYrk~E24Q4JnP^MA5T zwOXzpp+RG3pqBx!B?U1aM-Ww|&%=9`mPzu;1FxGDKH<+g&6#AqQ5K^W3#SvO=pv`IP_vpo}?B5(HnE2aJ`(qpQ4hCR|Fd501t z^SP9a-C_;VH(+J4Yx}-Uucw0IDkz!?40Kvtl)OqiDM7CQE47{zEV|G7gJcP zh@cya$BRj5OR~-4y=IS4&tSz%V@s!24`t)J_|QbF+tc;IeGwQE>c;Hh_j$j9=^^iV zU10Lei(^FEOmWxv?BUy*OdNFFleM77>=;V#WSi*!RK3=numwmw=-qF57+u+yCwE-L znu?l+2TVWyUsVbWKDOKcW|wjFWJUGhW&T!R8kQ#ujBAo)rRIEC+j_PGRYPkJRxVfO z&VGG$LPo88)yo){Y?tBa^%end>#|QHy(As(hBgVgA@GY|6NjheHL3Jlg^Vuv^+7$F z;^!h%?gfIS9Kg$krp0MGnXqlA5_ke^>*>6+zLvfA#bCowa(g~IT>M!!8Unk$S92{w z#Pletql1Vu%QEn@z{4M(b1tyM7&Bfg6Z$X*VpB+RN@w})*r5Gh5d0>f`t$eEBv_6x ze`ni)!f0kZw^?cZeeHSz6{cyOZ;vf$$On{YRC|g)L9>$M01Uz-IK9ue&by{ za-3hoh0CTO1cf+QiX@j=5tR4AI>$$BOC#Q$G_e5obWm@G|HErml*h1e(LurYqjfO~ zV?9AlSB6I3t7#%n(r@~5*-WCy9%p*RapV+p#qFN_m zNHkFQOQ=J0#)qpsrg;Sms2){HWB9} z2u6!bB+Icye`Ga?T1=%tw1^V7)AE;HYSe!Axwf8R%v~jcR=Jmm`0ul5oBCTr#ac5S zDYzQ)cW)Qx@Uh-62Ul-pR^Yxve$9>H)tV5X01xq1$=gE!Ntuka_pD<9uQX8{b$l}d zLqF-(s0R6L-F&O7dS34DUy^#oHOq$;qs!L*PZfE;C2;rI+CUz9)XtRN6xe4LW<63V zE1j)bl3pqGh2P&vumxqVH^0j!5p;U+@(PS4;ecs8R0c@N^7vMxuevzV~V=_u#w`?E?DioT{a_ z-G+O+dq5QYU?~js=xuWo{Jg$Ul_c7@lt+FHExc%gdEQsTDC&JMInG3Ogt(N@_XwUQ z6iHpxpSvuuBO2Qp2JB28uRAtgDfOf&BtPrZG1$`eUAp<+Fz2GkW))viqIWgaJcr{c(pze8e>&bbpFIWM9Sb-?RoTyj?=RT z&WFQE!LEassapgt#)wae`2%zEDc!7!5Le>pE}RHFhJ@#}aE8R37Z)Hs0vFA-TG;P_ z$MF8Shk>g~BL0WE*<M~4|2iWn9Xh}M>{2=KuPHH!k*^itg%lJl}$K0Bwbd7iVI3C+KQQGks`MV6y zj2ihi;6_WmlMJ$BR++iLP{Xt-XJ|8XZk1H>#XW1Rv{ zS&@ogI-2`9EH@|J9_K)o6e3v0#;LmQTAQiIHYTOqa zl9BROw=$Eyi3?SY`g?Kb;J1|Z8VZH-xnIp>uY5DX>^6?$p&lu`y7Xwg@+jj-8((#2 z&H)us>01d~I#hT&*YzAhS136eTc*waPAoO!fNuZkwg1UR;N{Y!-wXI{{P5@q@_t}} z!YYr~jpdC8ty+bLJ1^{}W@9M?OQ^>N-?8B@NexfFRcV?4!PJE_$_4VhR47S;=bzz{ z1Enx!n;f522eV&{O%PldJ&oYxdyOD`>4iyml^!)04w)pl6YWpcpY-KV0aX&ocI;sDHf z@ltqdnp-y)Jc|IWVwq6${hp2NTw+1!duGy_O@$JW!?kdthh{~%oKCxX}w&_0^@OPkD{w5&73xb*al^AT!}ZecU{c6 zflBx?8myek8^W6zEsUDXuhZe!N7!Mc#`YR3BbQuCplYeL$tyqW*BKjCKEFe!$*4NV236S4L_@eb0MtTj}^rpX>1^GS4+l zpu4qT)h)ElF*#s~(Fz1mRe2~BhMS!ZbpOuoHgU?NU*WN;mjR>48;a%RuKRGzQlr$<*RFZP9E#oV{3u8CJ7v={JI;m^(>MV!vMsHJ zzR4I}4?n(z-uXS{D~gKJfH3KBDYPF5G9P}J@d8f(ra>~%&EbNxVg}ZP{NB8a$g1$j z9M1Pmh>Z|Zo1%^(36ktB@OzGh+1ayDT7~Xp0#);Bm9(nUkHIB@a#9sR*=zBL(@nkv z4XljB_Fvlh2%yr|d~Q9g)^47*!wT3(La5qo#w>3XR-^mIOahT7G`zdu&9jO@w`@>a8m74e;Zks*^Ap;1jHE_h(l=_H_|uIV<l8di7L6et3 zLg`JIZTp)gJ$ccr6WI{VG?v@A-9mUy;3dn!@SJrOlKZiGSKJVYB3_hsGs+dIRq8W+}K#1VRTv7 zS^tZtw+d^ki?+XUcPTEV6iRWo;BB!W1=>P!DDLj=P^7qq;?@Gi-HStThu|q1JV1ba zyyyJCbF;5^=!?=|LJWBvwGTbR;4QTXq}cJ>PoLv}5oaqjV}63Bagd@j$B({<-R z?OSL|c_KePhh>AW6UAkuBM!X$x_BF4`P-(1_?-bszS(`mC}T#W2MVOL0{i4jQM3xa z#7BEf%eE(1$7n6xn% zbI+k!xLY*j-XCBDzks(nDq_@b?<^0l)6}=-O?CP+EKOj1-Vs_^7M@=a5v4_l5c|q( z(@H1N;^*dUz*c&uEMr&LMsK$%E(f#H59!`y6My?q2=wpXFW*lYM8w|@ho@|aig+Pf zjQ;lkTYTt-J;0@z!7fJ+Uee)E-$`gtF}f40@v8|`Jej{BUJTu6zY{Pt2-^S5>pfED zi*3N6tY+WcF{4ky=2`Dt z6;x#6tGvNq(;+_FQR4JUFLhXnE~Hw_%YP20c;m~6k#U~g2T0uabxF)F1)U;kC$7+# ziN3P89A*CEv#yd&qDl_d;a1aV&+B6)M9bgvQ>GK1dd8&%kqSaAwN^dxgy!)Z9T?gk ze(4bSuF^%;hW$zU*~=_oNy@?>g&UJ^b+iW_fR

    IOKv)8xMbrvvO3SJs2pbMTnj#w?pOY8RJH%#to}evINJQ6}?ZoPFMWJj}65R=@yiH1gqzFlh@;Eumar9l@qPtln# zg9Fon5KbFJV3jbxTvUm+NWXib$?43$oB5Qw$U3MQY`p(#(`Ig(=Mr1l1Kj$+;|fWU z1nB|6j8UMO`^F^}R3*#pmNSOC-<`j1fv{fX!0VNp23_gO)!|d;=6T}zJ&Nm}!Lwsu z%|nvSL?{-0h~VuoUQAxlgHlOP+Sa0ZCI~wvMo1xJg1y4NdE~W-=ylxFKzBR;1Bqr{ zqVAQ8V?GU=_(7nC?Zl4&RT5exQj0FTdGA5xd*mY$s~MCK8tlL2Gy$YYk0?S)9+{nr zd@5)aDleXjH^~IY9Ql04T`E5h-Qn>T!>-ym@7+9jYS@%eC-}XQ;}SJai5;R56WO@L zKwoLy0sk?-x&EzOd#K{zRqlTL@&3-m!R{XVmUTot&W_K!=PkD!>T{wr^nRmE1Os~+ z3Gy(bZ#U+odRiCadc9K=q%@wE23{K`0`?QQeNw9G5r zlq7Bpwl=-?*X$S=E!QZ2+VgLwFLb_8WPkmuff2DZZk6ns#E<85qE65}VsAtplB?WE zNY6x2_i+o3jzlxAinllK(kEBsDE`|*?VNTHatbRPs#r$QdqN<%UaQ>0kkvaq@88D$ zW%q%5U?*Xfs(# zpDXjvz2|QN3kG?%-0r9xk3KASeAH=RS!dw?%lhchHFCH=rq9~l1pzE>&F3>ZFlUx! z=S!(dX(Kdux%X&B)3**YtK*^V{WF?EBgXn2z-QZxm=T zjHRIDx1`wSP5HG<76XviF`*x(j({`|3>;Lyw%ZNh*q^OI^hjM2l|18T|47!I(Hc}$ z(w}E->SJ_=-XKsd(V3T@U!2)5lsREpCKy>WLRPtOpr2)pQrJV$&P&XQG9(nk$%h8k zQV;y?V;3wX-{M_|J}H+;O3oU^BBW5?6rC{daHJaC(sI++f7fJ_;1Pr#nFWGr?bfrE}B z1)G(w9Ozm%;yi4AoY<3ZB$mgd^qPvNH-+;)_inQt9|54mKpHE*hnrRFXxK@B4a#Be za5ftR=hRUkGUmsDVE&&BfH6Kk9{m>rMB!aqU}=~Vu5@s-Bv5C2xaJ9s2WgAXnTMR0 zJa~HIl`=vS+RlE0-dEXs;NKHc%AKyv(9l}9?aRr6*tzi8(KebJa;PZ?iAxto0CDKm z-MD;q(qr2_4k>oJ|K#29(tiVR0R8?(mp#)_*<9L>#fnlW(;%*gh$ zoau*4nGHQ-aY#qfO5=ZOqfxYhUV7Jg?3K;sMTVkINsC#pC;NfZS`~zJLh^3yU(WQK zoB{yEqVWKhus>sRjKR?H!oU1H1@u4tyxpvk^0&ILT)foJNuudrMFhWkEH-&1YyhChL@8Gt#>TX6IL7f-3)!TjT_QBp`qNOqg&6|CDZ*{sw3(~{Y2 z#jH6F2ii$omSe(vn$DaT;xYsJXP)?+kCr0xRWheE-e95)H2`TaJ-B&Bzq|s@C>cKq zaYFb4;mO^B+nPEw1PGHB1`Zf#pr_#Vx_o`E3wfM>*~cuvJ_;j%sxl?A)XOK-Vd4`{ zJ*odr{q*$o?VTODuZn^HGzQ+*2gUZjx_t$rUqlE$N>K>A%^m~Tom+{0FPbFWy2Y;c0zT&e!QWv}!}NqJ|mJKj72Uzln+ZtC#V96RBF|K8IGk zXZrNhPnVU*N!9kvhRS@yu!=>-%s|Xav-bjB$LvqV<(gBqkLFA?dTTsU0}*QyCHl+Jg64pOl|d zW8w@5;KD*ox$v?6CP{$+4F>&M;g&nq+qlFu#7F_f69WYqO!JF*0#z80nRrhw-l!Pf z0=L~s+B9A_U?YjvE-tW9kBwIRU>`U~9B1k7v&3&HV|RTR3r;H?-DUiZnD+Z(8NqdngwQ7{6t|XD=rG3yhe<*iSpz*<>e z{hCBRG#-$N-Bbb6r~#Vv_F}AwL0f)>s0*kimO@T&W;(^mes=-i+Hqn#DP;fNW|!gJ z>vr}M^bcLta3z7XT$If#=<6}s^cW@c>&u81=5&%XX9m&QfmE_stF!Fy3BGT^G3^cglEwx*vB~-=dhpU(gw`iHI7u0;f_#y= zt%vZsV_2^Gn8%+%WiwC=kRCB3~FtxB?H6dtv8*n+bM{+wylM*2g^; zJ>g;P$;lSKl!zykbH}WTJFF7>yN{fO7w;^BLX%O(W7-5oq*)-6Cfphu#|*C5cxGxZ z&1tqt>hs8t!v%SYPrDf6&TS`~$#r#>-ex&z=H=bgyPb?4RSXCW)h=bG36SlLhU3H; z@cpp8o4h@EH)J6qlx}@;NUz)cHM5GJ(TQe^%)nbI!HOrfGeC8^1(xyw7YWW==B5u1 zf@j-jUzn+5^w1i<>p;4FgelUg5g8n;udA6a4y=^?vl^Kt{vX86{5KN#ODn+YKZr#a o*m@cY^LO?CfBUC|$4@ZuyB~SK+&QTL`^R61i^zb=KkNGcAGOece*gdg diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/uac.png b/windows/security/operating-system-security/network-security/windows-firewall/images/uac.png index b4a056643eac83fc3dd5bf68254c202d94b65128..8256ba0770b0920f6379b93128ca00c2457b16f0 100644 GIT binary patch literal 36445 zcmYIv2RxhY7dBNCMQgU^+t!{{d(+n5dxp~5LhU_E6-Cvoy^@d+J2pkp+7f%V)QH$y ztS{d8|9xK~KhJZo=iKKW&pFq*?pR%I6>?GrQan67ay8Z0`gnME3UEKxdqlXD$^th# z+&_}{s%Bnzcn@-JfA}0jQX;rSd@p^Kmw51DCN%Emu7jeMA|76K64|8Mq6j7ieWWooEym2TPGe*W%!nz&(U+*S7CV$=M z=yh?h$MH(oP~=&Nu*j$7p-~L11;ucmf%dKELzE1gqH990@x#xVFeZf){9(AojnAfa zaL`VZafOi)%y+vjtV76o7kZqzE4tp$em>-W5*L_Gl;2I9A5&3Y&Q}SCvq+pR&b0;k zRr~E)YotwxSxKX%z+9?@5HMQHa+upK^ z>Hiei7J3PPPm|xxGH-p&%7R&cQS3sre$_!gLf&P`7}X(iA5w|=8WhyM(q75h#fRFx z`QXhPqVZuVq!0a^D8NfD#9h9mO|$;A}BDOm?v1@q3;hqEF zvC7M=eotd2w^zeqY?CUk@!cr(Idj)O?2ZFZ$(T)(6}E6^el2ics^OPzIwr4YwB3^K zs-%1XL)?+E)3lyfZ`xP5I4SE_ct0@l*{Du`HT?m#&V=ku+k;Sfv^chDU4AWPJsX$@F%BTFQ73;6~MVCe-Qy)8J5 z$D&89!n>UJM`1Y~HjQg(wH?!B&K$gh`+FSB!pE~=#AMA9oXB+dE*qT}YG@1{%e zvde=q?5sN}HkPNi3V|@@L>Z;5>wWmOI`&7>902pucKr9y1PO{gCX(YON+0+o7006b3Q-7`ra$%a?HHU5Fww3{*y9Hx8v%nhB2P@mc9iY1 z2i`6mvgQkh>C6G(*3Yl5B;ZzAACJD34!m-uZaN}A{CPNn`*z5==G_E;6A8Qq?CzhB zOr#{CJ1}f=9s5>&$^EbQ8^dC1Ea~lA5viYqw`I~}F~g_V8!GbH9sY)SPt5Ms;_iaf z17)AfozC?e-WQRM+Mi@x_X5Tb^G;h;uKRAzSgns!gwyXRI2~?KQy5%c}zL=%LlQnYzJR->Cg37eS)bW~sH@pD1eh&6b1wg&@Hb zL*GId1UO_|IRAW5MGj*&^74@6wrSzjBa}`U$_bLoVKDOS*y7Fxev99(+)+`y0JeU0 z)y`G!w#heON5GiEWbnjjw|-N5`{hAnpX^Q=ZhOPSQy^vv+N$n&5>_0;>^t3^K_RtK z@apC_<@Im>y8PP$qqG_t8ZiLh8N0sSncDRNP z0)||y46ZZYaI;yied>bj&OGH~#%*;y2NA?9rnk@iZu?yO-a=QG!x-im>$eo*S6#lk zryq0Y-z;7BC^x%523vCtmEyXgCnAJ`PTn@)-|V!Q!^}Pza3(G5%~@YOr`&#QPfFeo z+Z(e{C1#u|zX$3+8DDCE?s2E5r^j9Fc63zX%?g7560n{rcwB5Z&{qa6V8n7RHcdLr z^TK8ZtPqO##$~^*>BwIlEq@js=CZ;fGt&Din>V4h#+Ke=N_I;8HF!|ZF9lmht~E)z z0i~8lA;}WEt%vJSo4mUeMuf=SM=e0Vx#>sw_ovPjY&=0D!==$^cnkSg{DrQ zyCA_|0A53)w{u`HT|%!-A!U-fklX)Ckp9U~7tzt*6di#ZjeBZ@s!qpjtQmk-Fr=w_N55C8XGD=T08knt6RgFN{+{$7G{1_(=|K3xO!2Z6A-m& zjMiJcx~drvV08LnfWH{IIbeN#aJxptUJOqljp<%aO-=?*hNo*RJ48T|L0ZC8<9wI? z42!A~^}od^qW_cyE~GeHR4AtItxW7-1q(%$(m)sNx@OM}r<;xMWo*dd<$nE6^fMrT5#&>T3Vo6kIzlpj}(4iuhjL9*vaIes&+X z_fd~MTI?Nhpn2)V;T|7H_kF~bwl(?t(^Ew%nUbrxtXjiYP?s#{u3i#8svlYRYES3A zbk42GoT1CrqmB{dycb4IlcmrapxcA`@X3?@-LfdvTvRpqV^_14$420c+Gd4vM=m%= zEn;A*YlAPk#i^^tk6=~tCQU9aRwV49>gGs`!8GU%8cL>InTBT~?FKUu-)Cavrv zia}q;MdefjMMc;r#piGSKugU89mKGR>esF$bP7SrsQw=B(>`GrQ5T-&sHB@WD16~F zkqVZ*w!X{OsKHn+qQ;ffC53xNxx-f>Pu@gWtfj(fy&+100PBy6?jQSbP2V!fk-EV<=1Agku@R?_yz++M7IR71_h zSf{P1c3P#ug{ZNoBiLnop7XffOU5*O-Rk83+^w zx|Gz3dzEG1_wX=1{R5#kNe`7FDD5}^6fg_;ye0G{4hY)yr+)}v)wUyGBAMW>H>e(q736alo99^hgsQW9xbm+n zr%*fD8X(ruKa}C$o?RG7kK$gu;kiTaPlrO$#NLx)1$bGB841uYZQCN!Lbor+6UF|K z)j!&*gx~qbyjxE{IsAEe+fWI<9hO-NKU)WP^XVsfiv7|mUMkuTcZavZG!sr?zjV4A zRbr(2pFx7#?VqTT-@0*lqoRu;25y<8^UrUs7=$R4N$h`}%%qq7uLs{PH%>2rj~!nIZCDf7!oEvIhk|q%zmNZDNDQNkN0Ypyzs9;#NXDDZ8cikTxXc|IAn7 zz*o;k?XJu$EO_zoW)JEsLn<0Cc3K8@W0*Wu_e(fsofgg+-5PCXO&7kebBu?TfxZwk|9@;Xd=&X}Tz7hs%_J@e_Onm&Jqh2AV1Bu#odB zLP38;4>TwPE**yRm=fDN)~#hGpwyNyZYp> z_m^{bgB{KRFHuG&fcihJn^vuttAY?K-cQ>%3GTrw=?@g-_aZ1iZ(5CP4OpGj+$kU{ z!3Us%gR9?^Qn#Hg$McT->$-NAk34qB(Q7X}^d-R?m8H@xKcDm?;oeNK!K~1e{b?r5 zWXGA2sgfG<1sWO_BQ%D&OC}xIiRCO8IJZFaM$vM>NRSnGmGkDk0N{>tCqh@i-w3DkZ~}^HF@eky(KH1tcB-S@|N1cB8gKB9mXM3H z!HpLx891tevcNeF2OUyl*>25cc+<{~&eq$e1y}P{KR+v9?{!_5 z;CHUAB_(@PJGu;3+t#qDPFBm7i~mF?iwtuMVe^vPvZ3Uyqt>rBYIv#7S=!+4RPyc~ z>zH?N4#(}p3?EX;%Lu((VLeqB*F5=Emo{b?QCFZpMi!C*4V~ZAY+~5=E(J3knTcdP zQ_n`BMQ}#0&b%JVs``Eu*qVc%V9t88qicpo!2alj^-$iWL7?eHUIXS4Nb!99uw`N{ zaCTTsn$=C->U-IdtMa8S9nd9xTNKfP@Tq@%oCEel2E#6CdhHuOsrM}k%)K*LY5ZY+ zKRq586{Sm7@DhsU!8bf9@?`&Nu#T}ArHR@BqEsgu>mT)JO?kNKmVhd}z7-KG!ydrE zOn*;LZCE*tqK^755~MI9^Be+>;{u*!e{D@A#g%y++ElrRBoo?^a1qV7 zhg-gDo&P8S4bYo4-FbBtFmkCOXm`#~R=*&8>*{h{zC%%AH1Z>vKx4t>V(+jCIuY)B zbl=5Zd0Xy82@GxXK5ykoc%h*_mw!;^0Hm@mT)_$m!>@RDZtY|xMzB-mdamChQG<=I zbm~XZof+eRehP$^Yy5HS=2w=Uxq+@RwR7W8|`utV6vulp*_H{aRY>DiRKtm>u$j7S<#O#FJP z-pr^nMn9oh;97)&dY76iRitWSre)(gqx}fcLQQ=l#giXER_{EI6Gj{!MTQ)e&NHkH7*6^G(!ORiB*p_kTxKb44rh!aNr z)$FisP+7Bl#gwH*!j$G)X@QEwykAg6NprcEptwsaMH&#!iV_0V^JYt>)pk|7bO7fJ zvrlGAb|<}x9pvfLk^DAgJj`*$@VquvmvpW{=n>*^ZPDIL>RCDWb@RS(di>p2#R%); z7flzF?vTH0^th!0rU{UXQ&|V zEK1DB^ayDP%E;{myL^tXRpqXxJUCqZtE8~{z?vgIBQMw3EHJj zKUU`UR$6aX_NU4d5pmPRZt0nlQ%N~_VIGJXX@Qf)Y5!&>#Y7pr`s0)!t9A@gL8+c$ zP#oOM_QF$IQ?x)`rF_Xrq`+uf^ZbigZ)w=K7(D2@njJ$v%#u}nhY-%sF#h&JYv2bu z^W6#9DQM!R`2>0d;*f{(Mq_HKJARp(==~m8Dz7q{Pf{uI&FqyTrq$`JE@sH)D zAi*tzS@#N>IeGjIDVjWl5`pUOu0hQm{W356QYj%0S?v;}`At&B?Z+}wEUP4yl80~q zehPg~*ilEzJf;&VWmepqN1CskYaFaFtE~q@MWVZz=`~`{9zYD_(BZD*Bz^wSt-|Kl zl&+c<*fq@3e)Cb5DZ+{PAAE7n;4G0FpJ@aaJF~albjM7Ixqf|;<$9@155=^3ff(2Q z`cr5pPx^j21gc+)Pfpe3UAky{U3_KA^Bg<^oy#VAL1~W`evAp8RaE_80ng>$@weO- z-Kk%sjT081hTNIw8`5Dr>RT7WJqU3E0nWlU{Vnq|sdWtsd4Q*AiLV0|Sl8i5XzThi z!xZIDdwIk$Sg@kn)lk5RQ5&*kfU5C!O(pPo5sXz-OvR5!0C{xr)F zFTo(eNNfOzjrJH{$k$f#y=sL544uqS=mE2K%Mu_Mel;A~d}1!nVt8C>l?+7IIL%tw zFEorN5CgFh<9}g523r{qWxW!x-3r!wBKNLVLUL`*H?8d^SU=xzx?Asb6Kd=!n^vcL zcJ7zgvtQ;(O8WYoq>yF7KJT=asDSx@opQVx9{});sMli*v3vNAR|Lv zunx^u5wl~CxeoEXV~5xVB!$QMnUX@(GfbseYC&Cp81SroQsyXnqdZ*c+2$?Z3Pl`ioO}`Xof?W>PKMiORq#`_(= z)QR;1p9>W2Y1jmlYzAI*dIUIjHHN~-5B@yz&NgWrz9f9&v+qMpKHt5s;xHbMKYE6Uak0#Ic7#*~)C7ci0+zj^hW{dE=E$ z6XAH~Y7qndVB%c9GUAQaU|a7!o0fHlyJx zrRL>YEsF%0Cam9o-s=UqP=znEfl_nh6D{}gS*Xl-JChX+--_Rbi+5&iW_tp|M5_0( zckZZo{JJQuI?}7G30eNhX2!~k?nlNK9())^PH|uCnB_SpZNeu&gI>V5t?j+x&RO)Z zU9!bxI^1!jzQJrJs<*1*K}3(OBf%_ci68yp7s|n0lC$Nj;n`r*ZY*Uq^U_*Xin%bF zF_r$AWSibAi`8_tiGJsP?o&J^$iUN(-`V$sq{PVZ$5EK46cXrgmT1g|I;Z&YW9f5C z27{Qf!>52AdH$x>fVctG+6>0vR+mpsHJf!>Qu=;2wH$yMtNOXG^s3)-I@EP4887Iy zwxw{M_qgFZbN#v3#SR_AtESi>;}Mt5B!i8HL=}59fynV4eIt&iv^iP&$1;Pn=Rt|y z4K4Em@6?ydQTntd!+zdVh^jKrCyAh@YZ+0%&-xXFbd=F?kJAN=;gymUHSwWc(@{?y z;bpiS4kQJ719C?seV9C~J$xQG2U8humqC5iTv0v?XTlYkHN}blpe=_ICudcM1HHWv@Un?9(>u~|V!dnTn(!9>jg4e7>=IR2{GOY3p5k?_7@NdT_(3f`Now|{*Xq|Y9+ zie~OosjxPmg0DATOw^U`RQywhjDnH-v~{P)UfFJqc)fkkLj$fAf9YgmQ9-SM+E##J zZKK(Pwm7axT`52ZUV9xKv_OSzgd(}t9n)qbn}rY)0B)~f9Q!0Cx&76UeY&2V_I}nq z(#_vc1RwR}i}7vz%7apdEpP4f>~|hUi4yhbr6zxahyv&^jj_?9eeQ_|7eCtf5d|xBS(M+7}?J`6&A=i6;NkV_@ctO77jC$E;>ET3Yxs~ z6cgNrpi;mffzbMf`6Bb^;(fT^Ng^7MH0@O_uAD2 z)yXv`xx-!bZ{ijcuZ-RB8_BIS3zC>q8n)+Mx!^j(O1)31F^;t;ma8ePIb+-QW#eQ? z*TCOW-t)CoEHdm9Z2W*_k;V$YeVO5}bi2CFCDKO0Yy>|79gp%@v=bX~z++kFwLb5s9SJ?DUE&wl zoO9+KMhq4o#-Vgmrn3f%KA>m0+BC$1!ea+(nCAY%)U(BT>Fgd@qz2{@qW;=V`n1g) zOJmOH)i!27xBI|Ia+A%D?SNgTB|>*k4758buTv=$$u{m*9DF9askH>&LReK3qu654 z^9v*rnK&8gtK=r0UxA&x&3Vp$ak7o!7ZluGiZhTW%_KRPaDdE?P3R6E-)4W;ww;0l zu5kEOWrHRB^()-?XR`YFr857cMR?=6Ke8l;Y7b6jj*|r6Y*Kx1)2c z4{b>R$!?tFRm_im=B|dR6+$Q$p63E^Rq*hGQ-aw}}Xr7Z<^M zox~TO-G;aKc-{%%-;}t(Cy4!VWT4!?WeRvp@R_;fFEj=Q2C_anJfZrxTwH422ktXl zr#**?e=Ba}As@EUKM^9PyuHnRkr|mWIP+HUUobh7Q+6(_=s#p|n0w(l`Pv^1qyM10 z(I>NUUhfFv{)c2{6+XjW8SG*I1^GtV^#dtH3S0&V{@|cb-H0x!_LKTb+S~Z$`Tqy< z@GQvdZR+g~e{jlGOB{{9!UbBV4FdtrQG9ABfLr+p;6n>}B?w*Ru?}I$rf_n?8snt2&hU z9ZrB9=+6CuhgT5U(7MXM8s=ok{^@Br;?*k0lj|#7Fw)VUy(lA6L$HlTk>(BYKcMxH z(}jkT+%K7-?%`5HI2^JtyhkC6-^J0!p?LiT=lI}P3E&7#XwV`q{GJ{eWF)Kh3>O-0 zuRFU9o#K5TeuFOfK(R^rhNAtB&nFywVzuA8F6+Kv$l^-D@bfluM<*EYOT+)kbf@Z< zCLCHgfGAk6ap_c=ZQ_(gtAW5fxR4g_n-^@Y9lr?$xrPGY^*<2JgBr*#;ZhF^~skXJs@#uZLO3a~h2jcpxn8>U{uywCXj}>+UwWu4! zo1?FYWF2g$A0XuYjgMFGip_CtOPbwr(=zy12Tr*U6z~z^pl8@s>5DNK<|0(O;=$q#iu ziDA;mLGYj{jM}~#JW{YhiHGj~3;9c z8C7>1Rvif=quMc{0+)<`L;}L^SG-Ze|#G7b(6lP?;yl*(I8{=;B z+-M_|oX+T_iaMZa{15)T|L??g(Kk~S`n!RIE%ark1(nUp1g-rFk*91gHyU3U%CWQY z!g;1-jb0jQI%t=cQ4ONb=6*Pczv5{)d-TdHQHwxIKU{*q1pg|3*p(uKREOOe^jW1Gm?x9)&L_$hbMs2o$p{*R9GI|kl`a6(P+pvrSRDnUgI`tknH53l|x+|Jx!%MDtGc%m@sE> z@Y2@VT8zme3j&~Xr*)mDJcF6?pl&-0lbFyMLo;r^dO{Kd?FP|S;N2%=0Of5>!7t8U zq$WN>L(7u&+|iI5Qk1#hy0s6;0lEV+*vB+a$22EM>|!h5W9r8GVUYPN8MV?=kCp^OgTP}&#jW`k(gH3jeEI- zvA)6TUtpdeEu98orI{@~2~vn+Bp#K(B)lTS@5USAiF(vm5Wh~LJ~O1FB3gb^8PrQs z;AE;5)nyn|BBe&0V7f*np&wz1c77J#OZ!vEHCv&i~u566m%x z!{k6d0_Pr!&Z)np(Hv(%9vHHCnfGu7ugym3GA5paPtmPWpB{D0R@A$xXZQbNxISar zn2EKk47x(nt;Fw}ETD+eVg}gcOw=7xm=nFNv)m`t#*sYpVs}dKau;8|Mm?U0MT*9* z1f~UL85chYvjm-b3qqoB1X zLj6zDfCf+9XVmpfq9B;v1f0yHSgRpjX}a5=e>b0rVbAuO(*yHN5v0DSCR*pSjk3Sr z)I3pb*v(WX%v##4<1|1b7FtbR%`YBeQwp0>s@g^gXRgip{s#B|wORa&WGD-a7%G$j zcR`Z++9w1LeE$5!+A`}zpG>zuDnyUm|Iy{`Kuh|1>!8sbg37K zOT}MIK+LM$nLjvQ=NRm%LS$6yIlTKmh z5w=DX^2BPs61`-5k353FLBE`=p@)Q&6R0}$QU4qA_PpW5_2pCVS%g!_j|@Ce2Rg*5 z$?zc|vDR@*|hW|JfNms`nkPNvBw5-?EV`oXp{iJ8Wg~iF;b`L zbJOUly|2FN*e6Xv<_j*%&NEbX6OLvc==DLau}r}Hpn41<(a`6cG9*8OTK{pGmjyhX z+hFQr^3oLI4y^uch3|T&2w`H!fuuQRrE*4n`+^v+cj|~zVI1b^oyZtYqW+Ac=fayd z!v#}!3%SogAdqd#nDPf9vLant!iRnckIt{v@6GLQxQnXB-jUX#!x!zPM11m7yohP` zeWNAkbb;B^X&+Tf?1@)`Nx`e5$^@H)X1-|Z-FiebGzaCMMXCTibl~9M&D3u5FL7&c z&D2?>H>7ZC?_GHI$NM3;1)>-*P?2Mj{pCAg6$xZQ(rgCA#+O9RrZx})L~MiH^(*oo=m(?2zvPIywg=ZEhgGjU}gR=Q#Rkn}OwX?ZfT&i?192nPoc2RPTtsy15%A z&*3%p*CM%cLlp;ZwV$4<2<&((nobOh?6*4Al4&@{pV!J?)Xw0RRVLO7I4d`|CYVqQ z3|@KP*4tVV>h5*AvC6)fGW!Ezx5y#BvPWU+lP9?8Sd{E~csV}N5b`8jYRDgugWf!c zUiXD~HLH^2`BG$sSTksM($6KA{?Q}O@vVDEo}~q@#1K97ncvZ!&}*sHCLEaVR4EjK z6l&#Wn9S(#z_~Q*&6pQxNS==o#y1dYIZ2IbOP?7|nDF(DCpoi8#nGc2?{-`)?7B&$ z^Jc4Viou+xvX6S6Avkx>QhDRY*-iQArE@EvCZL9oy~byn5N!_n;E-?MK1%%&So1=z z3uTBOGXkxiLN_gJ#24mmEG5d^XL%A34zG^T{d7!tbc{po8L;2<3*@L0e;=r{WJS9X zF;7L5A5HZu40QVuYKdWsUBX{VSo=wkM>u_n|8G@M(lIL$ilVJSkbHPGPz{Z ze0492m`yFcMbYE+GsE_>d}GjvSiz(>R{~mnk;9;m+oK*{AI3u*y(^;nAd7c;t!{nmrMX9e%N0EB|_TjQ9x6{Ru?EY%!otH;;&}Jj-Li;6P703_SHOLFm z{G-gM>E84>B6^muyf?9Y5mm!kP4@c6`v zl~m`_99tflfEvb_OrJdfq)vxuX}<+Wh>?mJWra(8KWpa^sZ!F)i;l`!Ihr>-El)0h zC~}he)1?kIdQR4-Okb7_uKZ>kctYCApjw=3Q{F%WdbVyE#3V`o3Vq%TR57v-M8^_% zHlLNmIi_GPvRqFy7a<2u%Za}X>!njHw#0wQYK?mRsi|oZ99tzbrS;j?C}C9kT-;xu z;?aThKDT-A}oQbpIn(| zcs|7&-vontuhc3vMdzexTn9KeOrOoOB_U!yOFsaW4(jtan*gRr$eRU$NkZ*B^XbcN zW!p{y0?~|zTaP2ea0Zzbu_rp8(`UpjSYS@Kz76`mss79d1YekHU`;h6DDd=3_oLG@(M`hITfjqh?SXJR`BG-Cd1+D`<1Q^aaOl0o;++(+vD z!5>A(7C4T{%^u~=`&BQTi@?hkF8B7I@VqwaySg~;)5|ox*>oO!8oW1DZtdr5ykW;C zVaKFRHkL^dQp3vyNmPvE#48B z?+{w6k^;lX_jdv--5;j(ovwf#<}^L7nusS9o4; z8tH=z6MkPL1&$ZT6(>qT|4rVAn{)4I6S;UzaEk-sc@g5&i~Fp_U53}(`gGOUvGBNM#eBD{ z8sx^W8{zpEoY`Rbm9t33vi8X3!HR|SvP|KdRaVei)+OGGr}|0-sXK&0Td z)^igI9Gnuu_wrw^PSZY)RJMhrk(s?^$Kh?{6wWwUGw5!~|Eq7WkMUnlT5SH)wUjc$ zsOLld2%`V=^ZorFX@kB0S`6HZ`d2%LB}xAilo2-stE;R3b$~_nB$bHff1OS66g>N1 zzfu`S|KBjR?g0$;92Ne1Y~5ankB`sIQ?~!BnD6Ab5FFlMLc~F>Ao+&*|5dM<-^qV8 zyYm9GQydm{{pP<>1PG@}UVw;b82_8{S%o-Qj92@%iA=`DxZ2wbJls?x=lb8QqX#j9 zBWU8T{v8kR;h*Fv1yVag+=39pf!ne@^zD1m%ZNEQ-Zyf==L6OP1D1A_wXasuHPIEZ zh=?hkvuI?vSiqY;Q5m1A>f*Mont?dnxrv!vpF6DAdol5ElVp7dW*Vr@?|)-aI8BG=HJ0?PM9C`(>sCXj9Ocw@bYTMucO7)^(UkJJoea3R>vY2%w}U z1dZ5DSgk>nl)xW-_m@O)o?K|W&Cw`%Vq5JVJmDSHl@hsv4PQs)Y z*2V(dVc$}WM+`cAB9o#tCmd)B263IwS)Y$jxO)f=nBsH(ai{I?$J{eyo!U_b?!8&B zG)JPA@XDRdS+{Jo_+!yq=TA)y3alE8(-KF<$NP6c^PlZm}-Wb~z>f}`-B>q~7LB{F#CiqX9Z*E47Le?7Mhwpev zxo1c~Hey<&eQ2X)4q3OYc~IUA039#ZxzBBRbnt(b93b4o9UvNMyvAZGw*()sVn<`J zw~p7%!GNH(-(|Xm8+Q^VOY8OddcJii>%AfjJm3$Rb>pAL%7nAbt|Qs&oRE_l#xB|^ zt03S_s)4qd-!>t=r7qZD$w#i}`Qizp;W!C*!o=q^CvdY217~*hsXeES(>aAmTzya$ zSD*Xlkk|AikAsUMt&?pEow$UbU|EbMa@;Hk;cB%E`V_Lk77{QatZQU1BnN^0dW1%NiI>g*gGa*P zmIhfTYDTLmCm{kZ0N6Uub|tMF+`9i4I|_jrTK>rB=D(|e7xGc0fXt47r-W##i(adG zAhFl9rK}-Jk)>Z;5%AVRPcU^~B$WE7w@jR<5;<}7k^W^*j~GI2BKy;@>=jx^a7n`T ze%`Ao%#d=xUKjV(gOdN&KHH5rkfkxFExZ|U>$ ziqGeUmi-nugs>2M%(GrMGA7CFb%Ao1PYI+*wHGAquO}&NZ30S@V{>6iG^;8$O@Kyu zuQT=9IyWAN`p3}@(h>mH{A`ZxX%Ene_YNgT&zf;4yqqKs?Pu9^q%$YqOkudovpbyx zyD!4H9ylsA!;KAWSO;?@sl#@3WK|lO3@d>mSHm5>R1MY-`!YUVhy`e=UL1f&!t=YQ z-Ds5=tWiS9kjPDwzEq;Lh(ruabVZ;(^BkQw-AOhO%T}3XB1O}XKQZ6%oaiQF|VATi(S?d z^$eBPTnbF3=-}@a7jq%-%pz^$=Ds{T*}POvrCc@X^UA_suT>|QqgmJTD9JayHewis z1{=2-HRoN5SsJ+u6xT6x&6^raWdwNvVdU<`_*#cBiB#~>wy<-cR@Tj<9X8Vea3f0m zT|=6wyCk{ePIIPshaF_QP_3zFebD`~$>Eos?u3(`*+ z+{HTn#)QAvT+8geLDij^{$qNhjoBRIA0r{N_C?AIBEUY|d9Nj70&}AgEtI_0&4$#^ z1Zwz5U0DArD6!5GT36uaA`lN|&}AJMs#3~2TGh(OPqOf-V}7$JpTOmx)XKU+%f#w-q|u4h&)*H}8@t-;%TI+DvQhV@>A>-X51m4{o!NanQfm8t zfq2`MbmC^sq0#Zc3OG}%r^u8QEx4XEwBVR`p6D{??`*o` zikQ-$Ksz8s!&}f3lMHqDaZhD^X>Y*#+p@k`%k1}N>)4FCFxU7zQI|JJv6X}Pk+&${ zdBUd91~u#zA5M|Y6wo{}ryX!v43lqAhI36h(5?9D^LB%_1&dl`_TR^&yAmJQ9Ho_q zv&BNbmYU;%R+=1sybWT2SMC0@L(@bN?w9;c@pRg)0jjw;W=6D`QaY;=qCm7h5^@&t>K1 z;8PK8M*T2P;LpdZ7oFq3tyV`wwYAEu(tL48w=0pU=^DY0Kb4kS<{24i)UuhZ8`-l$ z>C-+S?N*LxCcX{Hq&i%=OGg`uK0hbywae~4Hll^hnFn)IYtdg!kmL)^^PIY`aAxSy-s?X~xrXCx zXF~?262~5_!u=2y86RX|c(HEv3|B5y!GxRw9 z^U&E(L|K+WdKT|8c~|{j;Y1mqdarai|s_8?lGwoQikKm$z*P3?ZV-uf6JkeJhzq(Q-(R zEBmk4dOo_GQO$tC+2e%%nfRe`itXSw{@Mp$vZInQ;+|J#mNZho9!ct0LbR}KtFMk% z3F{v+?|LHMB==r{9VbKn2@+5vFz4ghF*Pi8{yerLXjR;QDxygr&0@l{{*&aM6~Bq7 z!dzkKR->&971*{9+KOSR9IY6DFckX+ma5Om>=|mKXaf))`*cvO+mpWI9pIX6lWA=_ zDaf|=Ag?zcG3SBSpD9C~kfOmatpqHyJwG3+(EE`OB+FT^MXNYlE11mj(oNP7L z>x|P@N>2Q(*qOIyEZzDY+#aX_Q4X=&GA)jMEB()3I7w@l1vxqWAGW?bkgEUx|00Cs zT^UhG$X;b{O0xIfBrYL)&rp$3X4bXWwOxBFlzi~&iO8kyTG!|^^I?fNEq_#1y{bb!fmgzLfjEdVzVjW5Q^VK5p3LX>&ROKL zia4+Ef`5~KJq;_$VwduFmC_`lULyJJ*T-G#b}{QHh8mu{$xUWz1d{!qT~B7@nNr!r z@_c^_1qrz0J;@L6-B zu%~reJ!te>zB6QJ`=GR3Y~vmBPJ!V@gCcrSr+>AN_|o{pTM655wZGY`acl_<--W$A z)j5gTB7e>{T#jtX>%)ot1Uv&!eCbdlmM9woEvOGvm9h$Kd#{6T69V6;&gRynnEA#| zeTTOx*H-L5=!RVvv@M@iS)%j^yj-y(UGy;RgZCF`+l6SSt{E$B$Z9pCi{hN1M7voP znY7)R*wqP5d#x?~naU>nHaUA|y4cb!%ZQ8oxEAAW|92ftfCKqcDq5#u_ z2jRF3ocezX=H0hvjL0wLm{K)UTu1dL+VrL8AEfOByOQXO=5jmjb~<}Obu8e%epx~b zUte_huYRVFWR4Ww`wj2sAfwv+e9EA{BGHXW4hiuH>#piKT z@_RK8V%(W=&UPoRVV$wKOAaY5pQ>@}q3pVc5ut0M2@QhuHee|f)646@-E}3Y+02kq zK#kvX|~*Es|-5dYNtcn;=nboc*|a>YU--~ zSlxVyEmsiBDNMH-+v@&(1K zIN~yTdhIF-Q*&3xgpPf$BIh-)kX7zsZ5PGk^@-nylwjjdwGm^|sI-N`qf8#Aqb#jW zg+=JPwvNtN)gkYNmT%opYt$X)S>bJdsLK*^gTdmheUYm!4L*D0m>Bw7Ay2vzB(@u0 z9*wc+h?{jDFd0cS7$JWgxt?BV)UvANz)GG9WSI*J+kjB7nc-Lg8MdDyW!6}61rn`% z4*dSFJFwTY1K!;&?+cYhE44lVUef9`Ws2{CE}ia?yEwv~Ezw?U>N zbi~$mWO>?8$v~7x8xtCYWsviKOhk!a4IG-PPWBR7L~EXFrUHl@JL}6ah!|M194mw! zpd(7}ev9(SK5u>d=FAfSeqtdd-*WY-){8&GeKEKefGamqA_L;R0r_f(eA*E#kL-$i zA45;)LSxBncc?uQz|Tj91q!eW%$-XJmzfFEz$x5VIWYNH3v*H$gyn4w9md?bY;I9X zL8RA`TIuX|IK`?8vAx|c{2-HD5xMHQVL?0jySm>oqCq@V41BRXZ>KL%jg^+uWXiq_ zUUSg4MC3MAbF=_zOWL8TX20)FN!bxNpp9GI6UTud)K`EsHrI54y8z&0Yb~304(qh; zQ;ruFkwWhdgbs%_&U8$C4@1{ow}OZ`S7x1hI4(4lg)FDV2=iF99Pi?NcO6UhzdT*6 zn<_s*KIQ_>dXH_KihtBD3$4=6{!|Tdmkp$C>2x$xi2vzgLMhS0Uu-&<=!Aw@!NDpaSqE~JIXjx8^8PWr>omTa zorGPM8?Z&yS~yCGW~5+^rAle!qB{X*P*LZSh-3CHvys(!vaPdPHBQASPexW*_HLCG z7~vHDowOQ$nzAfvmFhiNodclWco$s!eTT#EV#eT}&K zmTQ-PE@szjPnB<;)(&2jxQ~=0O19-8e8u-h@_L@l3rA9!AL0|LSR!GxyS_GA$_kN* zvLjJdh5a9Ukd7Fp<-yHPaP?P(ydPYV-$}s=PDv^G#k`g9 zfF;<|(eEASDuq~axlAKZ^w=nR$_ns?sUWPyV}h~qykhP8*$2A7nNIM_Ve42%T1!Ha zkRHA?TlLXhl%e7ESN||b6wI)wuDD)2f!3C?YmVD#PDG+yOtWgNaGB?ry>CK!S&Ex402 z^5gALSdY=1a^}#V3B&|VIV%Ti)aT7r^9zF*t&w-n%9CU9psXB1eLrCDl-}c}c53eD z&w?LmBQ<=Az|(cqIg8AOTS~rTOWisHSvxOscZ$rECO@xb6!_~eYOID21i~^#8@n0_ zLMSQv^j@YxWkZS=9&$uVT%K$k+J!6@%Fz4C{mH3Y#ePI2r*^y26pcyo)=RW5#)Dgl7Ld)n z%!VCISVHc~9`r$u!(tYlK?!RN%jEKocTp*s1pE&M#lj3WJA(=)%jS3Xsg!7^qBIwK z>||EIx(bxgF!~@3pCw2TtO}RF6n<9`0A(l9UwhgvuS^)ZuW)l-Yt?dc1%8XsS2oef zHC(+i?!LTW)O*^zGd@8D!DvZ3I$NrU(p!2wc8?M%s<~jMIpx7o>FW8&sXCD7Jij32R$O2=oUKxezd*aPun`#_cgw&5Doj!|mvWTT z{$?KvTYmsKV@}bRj9Bq8nm&`MEOt=0ec@Uf++B|vthz59$A8QN+(kc{kAse*%ma6% z@s;XwsH>}_D`%VrsbDTYlbiGcw^N z$$R1Ff*YJi1v-=J6U(p?F!h(=XZ+^wirwxgc!4vkL`VW*y8UdO&m>=R-+QDvoo2SQ zb-y9gbV_T|RB^pC8K^b;&KUJ!Pii!|-M#O4lxO&&zD~5I;q!L)et|FD6vsqf2Y3D zg7DMVc)$OUqMVsnI1N$H64h+Hs^JM$1bDau&lN?K(td)E!^0@fYkl*ueGckYt%f!c zNhm}8VwwJlw`<}dKdQgjmNvN^+!s-j0FHKU+`X*(!p_0l0NkH-g0SjeX`oP3-g|l* zR2KJ*cF+jm^GBT(&!UQBFy<7ZIl51Hb@MI8Y$imu8!Iw=1fyVqxP!0q2pk9myZz{RT1xP zz{mjIDbUQ*y^uU}ko$a#luLTZm(XOF*;kgv^DVz|&M9DSci ztDc`CcW=AmP+EA*03~|r72-asXGNx@D$=va4vmnFd(NyS5M zx~Tjqgd6mHJ!LQ2yBWcs;liBS?H>16XGG^8G8!V5GyU!bDqpN2h1x{1VQaF%-C;tU z!nchM)XH9W0cZmJ2E1pSvzF!{j?+MV^x{87W4+d?ouFIq+sR2vMXlNZ=a<&^l+3?M zL>FTwOjd2STGDWhKaVzE*@^-&YD~ork8@r0o_m;i*;K+do?n6BCEbl z>@KjLjUm!TpFu9JOnOvmz%*;yyi^mgs0*MYSCBpUDDgk~!B=v+Ka@AZ2p)ipqyF)# zJlz}4`2H&3Hl?v9oZ(Nu4z$Pa_znQ1tq66>v-5zZF;F)6{kMz96RVz7m!aUBPB-9+@S z>L^6puc-ndPHf76c7TI}E*P_ylFLA1zzCM~2Cn66B8Ft1_4JS=Xp?LGOnEo}a4580 zM8|#f>gcxr=Kw4a;F->HV#y(ml%pDag!XgT4dI&6nc5v7se=fk@)ze>`8_9~` z+za<<@5^lmGXL{_e^&cCR~423zkLGi40lGtYR<4rVn zXcuTXlq|2WG4a_&(UQ})pdgiFQ+sh@9iJ}u-NRG+8)h%I<}or1O!kAFYXMa9E%nlX zT4G0e7mb16RmuVE|KyiB?UWqi74`Dg^PdU+x_-HHpWKVdX3u8U>Mf#t{?Uiykce`7 zU#tN^?{-OP)PB6dHmC94dWSS!plXofKa8>9U6GBlTq)Ao(|-3b%p&WNsUO-2Iw~O- z8?IfPb^pFU7tdG+>hvnrVfZxCmY10nP1YZulrB`hvis@EPhf*%11M-fG3J#(3EDP% zEp!zDX~^>E@~^L22@=^pm)Z?x5^WY-N&m>7;(hWnAuJ{0}o8zIkq zLdIbJMIw_E>4GoejVB#kGfx7HeGf;nw(rL_1HLy|<;l@RT#X-$n&f`R;JJ(@EdoV< z+n3YTbLCOK?AX95Rt)JASJ+(6tT#g~32bxLn*(M)9b+v=H6II39ZE&EaNo#^*3U2^ zTD+!4bvd~D-abkqWLC?MGY#4iqP#!Fc<_iItFV%-q}Kf9wA{x6+Z^9fSKycoV&V5L z+DigjmS^z8If3lJpVR*0%plyv2W1^vY^dyYOg5h^?hCw!#p*!_ous~Y>h z?g9Ae6Zya8qe@8#7h#E~fQ277SOT)2vP{ZNSrD&*Tw>*HKAHdK`HKM?J@<(=jm!{H za9UV!v=AlH3~V@&9JtEW{3M-4PyWuB&whmFfLLkMWzoMbp9<}Lp6=LgMCFA^_>Bn& zOzp!>L~=bwxv16HpWlCyZS>$id-82|40S_xwu>NL+AQ-l<*rh=EbrkASs@|?RG9FY zIbbbBn!fg8wtH(z42L#4BrSYnR1> z;T*qDOYQinPX=aNO4UIZsk44kyAF6k8yTM-YkIcuW^i2`T7(q?HQrJ4HF`RjJ&(HK zDd(mROrdwKz?a89BW7Xj@V-sXVN5jiOx-Ry*p#UM?wH1}NR^{+1>BpqE~VQ#k5O+P zs!*sc!t+D4#*EyJJpGeiPn$5dHn78MH^rXhF;;hBn>b_=muzV~995q2T7OBjry046 z^ek1?@zc^lZCAi$xrANyr*!+hR)=JBu~-cjr7Tk$Bo6zZXy6*IiN2QAJYPJp;QRgHYQQToA?k;;Y zW#V%%OR5wN^6E#s*&R&{T=x2QWYO#{%6n(BO>eYFMiz6Q56)kM2Z^)?9 zvaAwx-c^{a*qnR48xq`3O6r9 z>(4Aab?BtzJsr%K(otzHNW)ErPBjYc7*V$Ax&puHEbnz>(3+g<4?={E36GN7g_hR# zeL<})fR?(X`dAo3_??v`r)7&#@z~4{8#I`PfgOBReAhHequUnZQ-V~cU!=MpJqZ6u zTWxrb0B%ijw~?2Z57x<_PaouzQjlykH3?b{{OQ<=i&)-ns$srduJKd#MDzJKp{FwK z`wFner8D_lggAZ#ixR!8x6*d|toDYFY9s4iwcJD3AbnmwZe{<*fo6UUy5TMhea+X# zra5KKtHb4(81E(0$x%V|`;im$OkOKZOS`<0F<8zz77y;Jow^8{FK2h1(f6W0Zen$w z7APqq{e*-~YUq>reJkH7@RFNMnU4b{6ZWhUsk|panI>U_xP|Ct4-8xhFA-nf9awT* zuBwCL(ETbp)=HC3fFLrW>Gh-wXCbIiN&`EHPl#&R8QWU8N{EPI`1KqDQR&D!i7iQ% zbfk%NDdmkN$M$Jyk7`#f1Ro4T7Y4WU&B%luGP30r3LCTAqqVbTrCv#Ez$l27A z)^@PSFHwF6S&RNkvS*3Wxg)x@dpsShJDR0%%}(2fXYn=j8WS=crap73X-Cm?}O}(8rniT41C-7u(v0@_~?&RS5w8Nxs?ixaqb}x) ze*ToQ991nxI?~vQJi9#)&xrub@o&5&Wk^10&d4z{(SGo0^#&fLlOX1pyU z^$b}O#@yQ7r>cCGOsFp8{i@?ZsoGRQz_YfF#qCXg4XMtqg*yH*H<@~M;~*2(#GD{Y zlv9RNVN(5Q)9xbkh)rI;&xl)!gUa-Bd&Hr`nNk+&Gq%;a@#3uZ@j^5$$n^P@loW`0 z44epQlJ4zofP|tX7@0rwW{eA?n8r9Woyj=j0 z4)YBh+usj9c`v1*pUKSds?A&*v0d;%Fv8Tp)xq$dy>~k+yqII5X|$VwKurJfKQg#h zxT5)`i&Cm-T(0ftS;IiM=6_Hm4;x`>c?!aoePgn}y4c84%NNR-f;Xb1{K9Zqbr$)a zUTO@wzZ*da7&rn3q2bZwu58MQ#A=|CRxT+89A};IsLW`_;^FM!=|>CJQ`=A|ht zl7BI)78o9sPurya<*{EgSkBsM(4r`N74g>QaxnH8v?tF}U*pzvX`@VERj`9E!2Aic zQ^f*3v&zTX{~bA9eOwTmd}@Z#$QZ;4~olH(0UJ7_cU}0tebDY$HV%f z>EEl_a@1x5eS?zztpoOKdq^;@L)8QAb{vpmrz#E-;0)$qSBt5|Fk$fuCqowJvtnJK zfAsG087bWwbkx^73qI)fELN_GrnAcrW+BR~A6@R`h`*<%yXpk(v-qI^cH?HuJrYj(h+j=$p0 zh16#wT<`vBax!k0`ASdtNG+gv?|}{6#ZGH^k!K)g*a}8hj3jrvR~0tHCs$IY?f^Ww zX0SkR+)aQ$S)N+IwVJ8qcD(jLuNO*;SOt5!2!EY7QaJh7fgve26t0y=rW_>@(a>Ey zz|d=;3y|Zg^Xwk#pcjmvl4Eha3VQNoGyw0gO)#e^;U#p!%N&W z<}J0<1XH?(5tlGNvYDo*NJrfd1z`rqDr|4%K1U_VhAeYDTYT7TOV_V_VZ=Gp^g9U5 z>-vVT$;OIYcjOr?qM+NrY}LKQ&K{3EJ#Ngp`g=9L;d3mIV(8ock&%&0_+J$V5o^iP zvj&kK4#Cp1ZFlnhe|a>=W#(-6aLYI;Xu*Gvwq);Zi@qR=NS!~yxK-2L4S_rWt&>NL zYinT_ZICUbE#7|(ciOwFw7P3J#kwynd#WT?6&>kdtkGsH8f$ae*q~V-uKH>bBAj$g z6xOZF|0g_GO%t^d#1db=_CQAw2ts+_0XFyU^QXr+{>vgUWX96`*ofcFYBhP}&9ZiG z^;&kLZrxl^tC@mB_sv<3lwo_QP8OS@uXp!Lk(Ceht=Qp^f%aYU6qEBVcp+QOFY7^VDAw^bvfV25iAvnd#L;F z{*zPy2c1F8fOUjcX^bdBG{$`OO@@f18aWxOA%(W^^Un1mt?EI_^%wTIKkkv;yxY93_Poi2?Q&9Udh@aKY!g~lwCwn3J~pqVe!S`X@$$){0lHxCGT{=* z)1hGOp?H;*E!6FHJ}SLRJhQZRnq)=-(oo^Dq(*yxaU_bw0N!=Y-s7t@Oj0ED9pu7^ zuvu5t?=o1H)S><$d!DxW{HONu#ln~a*X0qq*!{oD)(dy?i>kBk?S^=rim}IDzdJ3G zoX|A`r(fpvT84{102aQWvgwCg!NY)$98nWUPC8%Q?xd@vI_Ck zK9%SSM^9&kqYqPLDP~)oTb^mM&D6jPF&3r)GH)~Z(qr~ssCXzkj+QoOo-EbSFBn1$t~zf>rxi`I!l1KkO$a0Rbga zS742BrXUHx23tV~pFeH0hWw73-mE-cACQ1~oc#5>nu!A*zzGIONcJ6`2WmYX4v^!W z`MFPAeD%hNt^4{aKF>9_F!LE@0Lm7?$d)ymz;}9Ew4!!*X=J_f!k6+?=i59DWbfW<Cm(Y5AMfPs>(K9mIQ%4WG@;g4&g-~mTJt{LPdP2c_H^5#gIGKlS)nUQML?e!v-1&PI!kuN(sxldye7wUQ{Yu@ z=g_L=&R*@jee8|Qq4n{OcFGmH&?*{DH0VT_rgcTDALOH#NSCR5^5yy~H!ZOBt3e8g zq^vW8i~3w$wA@U9YbhIM_dvp(>yaO>ssGL|X%he8$6g=i3Q&FGx(JvLy;3vOzka?9 zlrjsjIQ}PTp#S0Q>Pq%VH9+PchT{%!-MM1Xz{;zM(p*hA$p=YR(!{*OFa`~eB5B>m z%{nXqzxO>fJEpWKJ1epGEs9jd8;N+c zjByUh)%6e5jPmay#m9g#y((BVH-7e$ENw=u>0`ab$?N9|OMlj;K}**rw<-Y`T@#H* z-C~W4y7dPrQo3#&-sc4}ajOJCQOngPH@AXzBa@UkpCd`YjzUI>vxa}hJ>}2u<9V%Yq_z9>So1O$`&;bf&+e%NcjBZA=}I31ubj8F_+~K= zxK?}bDz#CBD?fJOlYB)So!j+Jh|J*(!G9EHKJ|n#V**hyRN_d!n)s_zeQfg@{`uV1`7&=ycC_%*F6Q+6cUOw6B^D(nS-FZPHnX%2J z2EP;9`E996LXZf-L_mDSvMJ#u?537F4-_C((TNt3l)g`KIFR+u zI1$#K=K%M6;zRGR^-^HKH+I`J-=cw{r?ERm;joD*tQP+a>xxTQh!nA(_VmSTZ(B*? z-E;uxUHsV=+`4wmc|BY$J}<}X`TNiS0Mb6>8AAONf*(2Sn&(s^ZJANw_~^4G3%ue* zJ?9dFb_~+L+$|7lq6I+ciMu0?gZ z3zcCS+_a$oz{D(H+{JM2geHUc?#z65+)%UjZjR%saE`*U__ELdrBPngnjV!89Y+hV z8Q8FzE8g=HJahdYpV{NPHJcj&JyPIro;|g|u(CkHxHz20prWG8qKjuh#hG(k?X(Nm z8+_i~&>p@icC5&vM0l3s+)vrT6+;sDv3<8PeU^|(Tm`kcH{#k{z4gO=_AjnueHY?{ za9~q(L=?(CY_CZ!yj(4)B!L4eW1JwQQUyOa_(o1=LzMOIgFbP7)dOLOO={*+P6QsW zjVvC{)`~t@B-@dXXOoAz;Pt3y+!7-Nq&>pYLY*T5#s&YXr!mYIY4S=*HLRO%BrO6F zP{{6L5*I%%IK!%>t^cm>AP+grN^IP#qE$ak<7B7hxCp<;SF7}4vVbinwtDeN5p^$E z-{@1_b5%o|PpIr&ohk)e!K|fmaCb-P`h3-H+QZU(C?W-KxC?&7a_~NHpz-HGT*z5+ zt}78xJSfL=Q4q{b=#-@e6J#DKBO~=DxaEoN`6|9{V7HAy-mjt@D)5+|Cjr+!ZhDK9_1a*QU{ld|{(*TTY|Vc`%t5gfZE|k0c#GbTDu!rRZMV5IB6#)=~!$V_y2a!va-{TwFl^dK)+~F%TP56}?-v zeL?*uGeEE)Iq6|;E;ZvTwkhGZ?URKlTHn&7$Z(B=`=;#a>kshDrvjGR9AA73$ao%s z1MB{!QEOMmJ?z5g&Tg`>SEPSu-h1PxCiX`GnzF1D%|ypUtyT4DFPkQ!X9Ww@i~kiE zyooUwF$w0aPmK(p?Q#yX7-@g1;;0}wvY#QUh>`{a?kmfUgB;(X6uHw_rc862vo*mW zn=>xkP2T)oq_5)06CvXJ(HeGRR~!qxR4=#38L$*SLVk{G2m>aT)F{;qo+s`)JICq1G|lpaAMO{$REfEIS35+I|{x;q%x8W&ID$ zH#;C(?;4k$pK?|7Ja(K08WE&ds~i+=Ca5FBm{zRGp<;-tGr03dGVJ|)zPCX>Py*V;~wsX$WcBd|8b9#hA+ugYwk!m!6SDp4Ec}3NkrsIXhb@xp_|hre;Wn z)9`M7hE@{dgT`ihiB8kMTapdka6Y@L7_D~0yB$!UI-`H^qQ=vcTBk%!jp7~nQNC3> zXN_V}&wuUY^{~!%;|grF-~97@IYtkKB0K-xma&L5C85PNd%pC|H~Z(em_5Pir3DP*PZm1}kDfrr z!3&Wb2DrcbzBF8D-*XJff^Ez+dGn5V09C%YAUUcnfZoVkZ{kTy0Vyf}@82xSuanY> zwB=&5#VB6p)$-&1cN?~wC-kfd^pS$*yws3P(Hu*5(tZpNa>yaByk{Oma$HwkW}N!v zH0oNnS4{M>{WJ0#oU+sxFn^b*S6(dGQ!drGGzRLYUxPI#`3vnX{y@&ilFZ2;>QwtZ=`gKRybo3S=VV?3> zh|sx9dT*P9f{r-h7e>?!atRxy1!T?co5(6m{}*6FuOw)C`?H^&9r1Mu&!vBD&1N+e zC<-L<>1)!HfKC9-aKPucDsm75CkYRb?t55fveq;R6#cS&xq9bXscL`&D7%4A;-kG* z1_4EO$twb3U0Fp1e3IY$T4`)fKf8~!Xk~)Ea{pT8n{MmXWIU^}Bbb2?EE>@N4UQ0@ zJ7kEsZv8<0JXXki(fBHf0Qx|Ddf;`vfgIxer8&JDrEV*KI%X;;^@YpNVT*fL{&Il4 z7SBZqoB6t(MY{7mtH-qv*pxGtKmDV`O=2Wefn@}I+DU+_5fER-<;2C2kw3v?Ba+L% z@m#pijDgzh&zoOA25!_HUI2y2w5E=n?F;kWIxgQD%yI!8GV&_L68iDPE14*)roFXN z((SXJQd0E3w>KW7A>7|}IOF4hSw}~Ur@SLdBa)@`8_4TVoWG9Y^OG$L%o@r(?pXF$ zS@!+pdfIZjq(Y%{H+bL^ZAHV$2*R&k^qJIwf(cq`cT8Y9v<#E^l<}={WFN5fQOk^Ei^kQt)+(_#F@_UuI4O*dTo+HvgGV ze7qczb>M71h;omg^*^MH;xax>fe_DWnHVS^N-X5zk4Z2b*wmw2F8Tz*D)Ht-7YU+_ z-CJO=*?J2Va1_;$IrER(je9zgTz1;f!S(_sbnm?!7AeIpD4ui;VrT4QS;=E$EAps{ zRWWC|)B&~iMx>}Q#TB_AV2ED!KU3-G`&fH<5uT<#CHfoEKE}sGOSljvzL)bHEe#f4 zhe7(|>4C$M)CiRyxReI+^U=YjeSz5n9ROf__QpeGVHTY*KY)*&75$&V%Mj~~stKM{zcO|tj&mmQ%+OK9mRS~eZT;(fK4@N5on!ts{jItUp3`nsSa92y zO#J?YiLP6}O*lgt8`0uF7Za`!^sJP03s3)*Z=>~}pn~B3i@0W&fMS1Q~PcSuPFPQ%Ivbo`cYAsLSS;!xfyYOB2oU*(Fz5T)uakKRL_6G3VxB0eD+&fm8XhiO_9}~6uYjt|| z(Ow`|Xb4*Fe;{)&+{NVZ*5U6ZDd4y<U#_i`Si+rYktU0DY8ZeEplJ9~;T7_45VF$QLwxt~nr!?ZgOhR`eMX%9 z+|Ziml7Ax+m-3%VqAry=Zm%PC7>_Cl6~b#7G?BUdPM1UwbwY^pr=Hj6V-hDd>$kK+ zT3QV4uTJT+j`c`#FD3>8t=aQIXjr((VR*hy|N4}0(Q9Cds<}kmUcrb`7BGPo zc{6`#rHM!EJB@Srjxd`1zA#5Di)bEGlhtFPh^?4U(pJi!l}e9?n>GxcJ?`lU6PtAI zzlfUourYu>O3oQPD-IlFo#Xcl-a9Q0eTHek0}=wdrS0L==SQwYz=H3;<~mtuVF{5? z!bguuc+Aw>CUHi8-(+s4f%8HRrHl}I@}=j%0%7_9yVU*)TO?!%b67`tlylD zJD{SM9f?D1G3#S}i&Gzs*w)hZ_S6}?RV}5_3pdp!uu8M{n;Ie^(0BR?GZ8uY_$?ms zMsQ@fYCGngi?QzQOT#k9h$+z&FBPLVT6BGO;LHyPW^uHb^~q6U=qviaiUk+i(>_z+ z$gK+&JnIh+gTcjQG>~xfEfdp&!EUz;?G&f-?ERr7b)cigc6VD{K4mI?_3qd3+^6!0 z%k@aEq$drd7nf=+v0_nIW}b<7N^L-Up;&PWfY3E{@q0#tD7;bEx+VHJPTjlCUk(1& z+OqMMA(34LN8Dd#|HQM4pcxaxec6`gt+Y>5Jig99v2#tRY+mxopbM8D>-0XzS>OD~ zf+o5|%*Jvi%lwFtS67l91Wmom!j;|6UG5PmTCly%$Su+%cS-fM@I* zKuay}`@#Q?nCdUTJz)%7KMzdjCEj!NY@_w}L#OSxRmIH5o#mypx{XRcjQ^WdqFnPK z$>#NPNVhb&_Mn@Kyam-_qV>zAii2%Bt77OW7eU$f?Yk#&UAfRR%&Vr5*>a!_f@lV) z4r$H+7pkdHmmBcF_Mh7J*GQ_>n|$I%ec8C{mR9*Y9F~vXj}*&MEi4-k#h{?Mi=B@g z8utLy!80oNFU2T{b%D`_>iVeb$^H_H#0wGNO8G1nCL;^X%I)2)wG+ODe?{Y|#s_Q^ zYUT~~^`$|Wdp)4v6XW7~Uosr%Ny)Kz-Os7|84}MA481YLFo49x#hKGl4`D)x)}!p< z02`6)D|(Ts_yHeo)V1M6FYXV2^BemSspe(Av&b7x5Lum>{x!C@^ilFlP~1 zBhUlrYLB>O0q0R*ifPGj66Ww|%#VO}fr){f4l`A9`IpQU77I%KdA-F%kwwzROU!H_ zm%a~#e&`$gQ?lz$-e2$c9alJ|bK7$(z!nC2b&%<{49-A^ecck2o8kt!+|M-(4!+?? z$*9;TUK#y@0)(C{GF@vWOgXK|&ezshZ+uE<|3}s87M4gCyasDMxht?bt|c5UeS`OW z{q@vWFx_uwFuilGMk<{Rs2kJ9Q4LyxCGkxdzFY@cM&&S==3}4%*qMBRMmrORK?5Ak zAITGTps8!1k<-s%6N8@=Ky?_H+SBZN2HR;W)!Gp&xF&$rzpcFuZh7?VM)iU31^AC( z-wb+SU@yxU1fYUlgT1G!Hj-yAKVAii0VS)I4{ky=r+fD=uUuLHe%f5aTNSY6*^Q@5 z2>_uJGao@P+vcVKE`q-j*Ix#O0QX?^-2%Xr=6`YIKYSO!X$5xs%XPSuNCfOi(9Qoi zn3$7l@W$0gatv@1`oF=E;!n?^_qx~(ySjt|N*;EnT&Ux)f?=4Af>xsce}*e7RHtcN zc9M)C^Pg!jb1g}&hJv4j964TF>o}XXU`$xL39s#oiI8~4g#+R@Lr2ohax&)*OUEoX z$O5nkLQ(?fuWw7?&SY9S&~(Q&;Lptj+_APdMl!%vV}o^$QSOl3oLr(aESc+@U_adu zH|omS8MK6Fa239`8jjaEm^l0kCHS9jjB%+>YMGo#boU=QeKyDUCF{@jn;54=24e8I)|hrGv@oymLvpSi`IrE4 zWg#aL7S4anCl~d*s_xmL`myNO@R}0i9v&Tr|aD$Z3^GnO} z?m4udM0BTh9_U@hoZEJxTV#^v5B#AIcgH#^DF^&Vd>8gqkHvENC|*Z`A^rpzl`CEK zk`;Np>6Z(|)B3k!r_&V}<4Q^20ictfK~YIbd}=K!Lrzs9Hwsny^RCEO zzdN9%(6e%kQMZrd1f~Ny^Z17I+(9KPvnvwdVOiz@Xu1l+hqX$;xu=5bJGm5ue=rKG z_1(PR##X~Nr%5h_oqY3wR4LcTn!S*rAbA@dDQdut8%Y1&IRZVzW6`w0{hP^gU;!$- zT}x}g>)bQMdIEI5=J+b1>Uxw^XajWwvNgtv3j}P00h{^aA&4FO`I(wTwKew26ERyr zz%8-DFcyZ}7Fr1uo%?uw?_JHZ7T!2$ckf|tj*gA^Vq7!kItH!8t1lU{*1Xi$PoWml zVX} z&gcpOM%neWZ~FUpHh3) z0rTeh94=pQIWQpIw*N_*rIjU77uIgouXl^D!w|}BesdIl8Ru6Wa-&8L&BE_sGxy>& zT(a9q4h6Koqn}etg$N%W1NPgvt=ge}@6VpjsdIIsd;k!YHB#(oe7^U^0K2l-;qYD~ zipMw<%VyQ~$XCywoPal7DMsvAAbAm33y1`{U;v6n~4HRrb(f7 zQIG_@*t)0Vn!J{b#eu@E1Q~1pa&Ql0M|s~Q9u7A*+qSA+DZXUKnC*?SPT+#6{9uuJ z(=4es2nWJXZST&4o)Emg2tYB4ZQH%GK9?@OY)7gcK3e-^4w?6R(?#}aUR@&V%++_J z627xgMTnS_C2c`Ouj89}SH5{C1rJz*0Aa|(vQ(sJKEgGx0DT{ugIoEd@LP`mJQg0! z3a%x(_7dTXK3u64-bvYQid-ZY)G{KO440#z8;Y`%5M@J*imuf7t=Du%q5f+r@@ljE z70$xQV8au0c~)DZBN3n3tl|4(E8N%6Mz-`UHFTT=4(v3yPx%<{xl_5rY;(vx=^?=l z_TjohiztVAR7t;DDwH=WCKP&CCv_9kwAxi)-nDH)LV()@3sYNVo#WZ3-vmZxIty)P%KUW7?g&FllyqNt1)^&ct zu?1OsXEvp?N_Cufshj?8MEpHA&&y!6jU=-BPXLSjIP(^YB#)%HG1uA`s!*SF5#G=f}3ZCN~$M@M%Gls_>l6 zK`ZZc@G)>t4M!1E(19gR7Mq*kT-f2-s)N*NeiT|s%9ET*P~SISg7UtB)&id@w-6B| zS8G)Pap}h6gI=hF&Axik`r%$7%ZKF4+XT`2qP$$Z(~*A$`z?n^z4^}!X@DkxfNIQI zszzey@Eh!_P$TwqQWyUl(_vpnHML*-scIkpwn-fe+3lvd3#uUBPhBP~M3DgybOcnU_PpdSqVrY6epjxDeYS zA7xVYj5*2Q-}^3kd;0QMu>iCz;9=@-0h!cF;>*q7dUF6>nT5x-)5++2!vHuOJ3mB2 zBrG%)%lF=^?9+p8C#4K%%ZFK0E~+*9%L5fOOmyqV!-?9ixQ)tjHskiPpVgkxD8Ww- z#n2KB2vdgMtX)IN`taBVK+pEYnoO1%_KQ3UG6A}zlH&p$>?GD6C!>a9%kuhNzhBJp z-S*JQ$!An;6izUBm3`vktNeS|cMWz=(*5p%Y_$29{g#e8@!O3t1{ZyW)m4ww1f_Rt zpPM=Eb6PgPm4NV25BXQP1M)`4ax0hZTfnxwzm3+@pQh^+DxU#%`u7iVbYXZ?AI9RR;-x;7S2MsVdchnsvEXYOzeAA2~#T7adVGVY7}sPKz}r z>?Ox_MaC%Sy&xt5m;_2~2~>k^5I!FVY|#6+RCM=&II;Eh>+tA*_%PikiS^h4GUo8h z+y9%Ijb{YxH4qJu9nbpvV}Z&h^0~hMP&XKk65DCT!Nd?*&DP)jirCnlG!oVwA2zWlaIK!2vfw0a5N%0E3;M zeFXHQ_8KC*3#w*G64tTeXxjxE;yUjBmKCo^{Ksf?F`n^>M&Ioco=M|6tY+DQ2Xs1K z>pI8w*={;ko{DmP1J*4i<(OjiAdAnPM=zRO=9~bnXpKFM>P`P}YIN2q4+$;SttCxK z=Re!hb=vKkb#+vhR{Pm8g!Rac-MM+xFeg9 zI0YibSfa1|aUH6(p@ox#r%%ZUTdS(Y(ecFn(b!A7Y0{B6+ezHdM&jr-f0~OGS&Ar+ zU-V&ea%Vi(L1ppoxkJLPiKFsllxrK%3p!^}#sJshuEhDy9z92X?mt9O3ETNIYBTw* zj6{a7g|J^|(D}kJda*SA1AcHRA+*oEi-)smwRLm}RVc-iP*Pt(O<}B63mBoNt#_Ai z=~6G0(CR$1TdR8^Z}%d_a8Y_Z(f4h#wz zpBM{g%3jZG1Q-?osb3wTU-9hrO>b%CFVMe4*Y>WGW4{5dvTE>^VQ3=$89c+xh^I zgR+nc05nD*P2|J*QF*>B^XBHPXy8$)0s?Ko4tEAn%eh}cIw0!j(LyZ(s(#}6T07nj zwR54RH>M4H9e}|jEq=vvQ^keoyC+}7kIrV%mnJ|1AzGkD2Yh-H0nX+&wd1dQEq(wD zgpSGm+miPY=y#+eZg@3=OKYFNEW4ib=8X6DMaHc`-zMYjlChS{L)zH4`q!)Y?@uCy zk;{-4aA#j${#~9i60QZJtA>{2rfupYK$5tW%#`La?|cmeQ0`j!A6YqgY6N=p9`AzW~$&EBwbl{_)Q!000000H)-cYp(f&-}sH+ z_}oC&{MO*-T{^ZaoWEzF7A-#Xp%4A@5l0;HrQ?r3{v;M90RR91z$9qe{eACy-y2@} z%2)pN;OBP+pOM?oD1a6ZKKS6Cfpog>GoSg)p26p@jyvwSA3o|)k9r(}C;$Ke05oAB zPu_FOEw{Y?yz|cc15LXRHJ|Hz&R1>0xqI+Ab|85E#NhwZ>t6S|C;s9u{^HLZdE}8t z4Fc&6w^1tp_j5`ibvk^^aon+cVwhSDM`iyuWK6^2aqIjr&U5~Lm()RD?K5cu>f6QMD zBRX9J&$O8{N@KJ*R4jBlf2l$?WblV&J?j^rR;cAch%=y?rea*T?>u?4cQ^VV^Pknfx z)%e%tMPccFeIHz>!taIq;ypbd8(y;(!yX>f$J>;q*T-{3NWUM-Vwi?CUGE2Vm?x(# z%};r3c)ic{GwF4fHpK1lh7VT}(&6AzrEQiQT9(?6(h{nw{_B8R_=432wk_`S^g zpskD=W{fA4Pd}95s9v1DG>#DWs0@>Q^g}%TP}igI(vHX9W7#^dgY=Km7V0UMeG$sk z^*yTlw4O3$;Ck+dI*Rq*kKxC(j5{96tMB|JZ9h$CKdDc*0hh^I@lYEYwfkWhxq6M| zOQvVP`|xg9fmwD4a;rA;FILZ;jSg=i_iZk ze?0#@|2+R&{`p@wwioNi|8->-+Wxrbf0W)~ypo3`1NmG(*KUf9vPVDWGkN~YV?)`f z{O#|S*R&<(P*z)${Iq-b?lNv)zp}F8@9WAVd|&f1g*}*ZUmdic`v%XE>^!CMe6XnC Z{|E0_UvWJFQG@^h002ovPDHLkV1l?(Y|sDz literal 204806 zcmc$F_g_-s`+j9*!?JDWsw_upq^UU}Ej9PbJ;>A?IC6^!G%PDu<|=1qu2jgqAuAUS z+_=esq&PuEK;Ucd&*%O57rs9n&Wq=#bDneE&vo6`ecx}*O!Q71yL4>dzI`Y3AKbUt zw~xnU-@XIgM-K0;45DWj_HIX?KClbgx9?QuziYolkDB7%;{G5DJ?(v{Ug5>PKLvCuxk64EOeXWP#`p?}-j|&$KbbNmNcBEah zJb5%y{P)4^>HVtI9h;S@<^~UZHhRi+^Wq%H zQ2*MQxA(6mKKTE1Ycjiqrzwtu)eDGz>P@SC&D$bEnK^ZMY5B4g=%#vRhDqX+03VX0 zQDp}#$~Hcndyl00u-6YJ^~O=}P2kazKn92zJy#_Iw!VO=|i`}X(o zlQ4;gZ}~TG=@;Ash>^h7s}uw?dai2i`MEx^(hV1kHOE}jF+D4d@^@T|Awb%M_A~;D z!xNer=Lw=SIu+q{uV9(SHuekRu&0N%)#d0e@4G zt}9~vHc%ksDE;Hfrl!L11oNB|OLsEU@-R-6wM?!mmw-E4!wK)@YK>=ddAmN+xUbZ? zXWt5()a6IDbop$opFE2L?a(!MBBpsINWDA~8v9~EYhvE3JBs1bt3FPc7+9S~fw_9@ z(jT;-Myvn;0}qKKO@&34o%pHrYo$r%93M7ZH!6aqdQAfnc97MW_5DQV>gQiB6BbO zcR#^Uk@UTtlsphB8a%Vp`%C@t`uF|-lIn@ovtavQfja_Ie?&RCHEV{`=bV9-b@-|Z z@TBHkOaM7w(=*2$)+&&VN50!S!r$T5SCCg@HLV^Zm1{h!^b*E5ShQTOv2k74S$L!2 z3|MVL$J&}XNUpUYpP^2k{)l77Jn?Wu#ln$($^LKK?@j#X&|IPB1gLE0?{XF4yj7+b z2^~dcsLk(+eU-aTM)ql;lihgHQf{M*Gpd(VeO zDoCv?{qkAAnkCnTINtT0uO>+yR8M7Sgsv7>*fH$Kch>)WT+MA#Ayd@lj;m>I_T3W# zKbh!l?~DfT7XYvs;gZMB1$lzl*-nD46SB;9oc#e^{`#HSV2}rK0hln2kbw_S3TXzE z@xBD1DYK9jcrHa-RU#*PynBl*yrh2S>V+4MbwuH{+6pEDOaYq+7b26qhDiZGe>+KTwLbOC^K#~g35iT-|ks&LN zpX4Y*0GJer^30Aza%T>akNH?_{b#mGP>&b&jc=2+7$IR$dLZX|)++dMLp4JF`44*Q z)6DSaGiKn%8Yz!rg1s|@uAYn*6NnyYFQ0F}FHFuWKa-F$6>y35w|k2|M^+4>hp3Tu z!BeOev4&7Z-5`!wLVoo&$QM*L-+ZwI!k(M>&r85pGH6_FGE&TNWArk7j9?1m7<8Mu zhCAcprrq&{#OIB`1rq7UnZejz$uq~JTB;)=74QCX>nm5XtkBCeY9&=N&zl2`QoPpp z$+){;MKww3Cc!q$WJrHvTyA%OoWs_y+fH`9jVSgDa0mrIju;b*tcO0&ixTh)e}&Nd>>*B<%L7Q2v-^ehJMZbA+xG-i}@#N#OTc zfq|4Xy~zFX&PEV^T#vnI9%c8QB`KJHH7g=o!G8hDC3IE?HAJu84u1|Dbm+>Yzj@l3h1Y9c z)vO*FU#pS!r^5cM1)PbK;l;snk)S<1=KT8ssB&E$TA5|TQ1_E5X4ov64BNt*Ds;oU zp$#E`Bx<@#-%QB$czCt^oyxj!lQQVi(*R_!Pa+Yg^otlU`aMce zS;$147PtJe0<8?+SzFuFvl1ZGNE_5nj5oTC^LO{$#6UuZmfc(zyc!QrS89pCf9(0k ziDYCa1B=FX9e3rJ2Joex-HAxnB5t{wi^c@HK13Y$3Z;S*H!cwDop1)}t;%0zW~Ku` ziKALVmpLU5#zd;}lXFuFWUh1Qo{gysV8UWMX!&?JSE-> zl1#984d6DnckNthq8)h4KarwQ2xp+0e8QY9@+f*MXV7m~me7JnF2*QacHG&hrapcL zXd1@wd4;X691^eIx@$Y$8MOI@XhR;I2IiGq3*1+Vm%N=mqA92QA-O2h|n~N{0A9oJ6m=rc@sa-=JIhH^j6%2QIk)^Y- z2&i6f{aXs%;hno02kT6&t`g5L<`Y$U8Qs60TNm1s%j?Kix9@V@yvzrdf~V(ILxNGU z;5RVv=FD}axPjP%G3E$}?-Eik*ZrEK&Wvl>%7}9)2E2P5gxTd!QQ8#|`Ac?zo;=Ez zxBD2#i&JWiD9MJfYtW7^!r2X?0o^dIl|D`W$vIEo?vn?}d74m>vaK;Mii$xR4T)sU z?}B^$D^vHFA)v7x(apeCVsBq~m(=ca=3wYk{uyT*qyYY{KF8;K;QuKjWQIOMx76KPCco z^deJe3buKk_JapeD56Vx<1RSWh5h)87@Q6iB#Gd{zX^bSgt)M44`Y`wp=fg_`q6!P zEa3+rpI~cnyNRmJGfjfh(keHCr)@O#&0HAvBb zf-kFP7x{{fpTFP=iXHg9(QGqniTO&O^Bn4RSKW4Xh>L2>tA>?zr)2>Jx7eauZoY_x zU4C{l4H;JYPac5&wvVoov$(7_m*m{wZvU`>cK-1Xahr{N=ftO6jRWlK{pN5rdGmaH z`_zwtrAu6{xtqN{L$&`QZPMz?X0tbb`$l>7)gOd(n`?!9>b{F=1^6r=k)bf6_gmEgW5L!f`gg zCA!)E#rdTg--Mzg@?6)MLH@R`{ztO1199V_D-9q1N0Vf7@x)#5?g^lEJ9fuh6%pmf zGB2RQm)uJ}8?DT*k-qI{sox0aAr(ihcqLc7s_uZ9q?|Q!xAD3}Qhoe3-s@~F&q%3( zJN)tq-j+Y~b2L%5j{A*;(;VjSgm;}704V*<#vu`!6U)K;eL+ioHsT>hOLb15H!IpJ z{Ir}X?q%Bg_`RUBHRc_o`T~avc0M@COk_8OISbD-YPs7)jDmqcm*A^+Ert=~2HS!P z@~f}Z9Zar|%*rS_PCLcF@*Z8i&qf`-G=Y@M8I^dcY(FWP8j|qn)^eB1O}!Pt3E%wH zfaUwozku&yW7}Bcb(V-r5E;6PnvUSVts?)d8(ri@0{=%Zt8)FHGeF7EuN~o}ud(NI zS~rxgcZo^j`}kubaj2#tcK}yQW0ELi8=d^6pO-UR<|3O;+` zMddYPSnpzA-;IZd)0rLV^9ksW_Y9A|Y)>iSA3Ae*9CuLIgnC9|Tspb9)olxGJR23C z6rA&O-uW^M<)G0`;B0<)1BlugxG4ir;{I`hJ^-v%uQ>`fWrp-%(n@<}_;b?o>nqk8 zDyRo;6e7pU7Va2S7Mi|hhe+Y04}-<#;JVsrYYA}QnTgFR-~3IC4~t1mxSjJP=lcaJ zu{0S{X%XGyH6B`~vEfftYRCaVeDLs)O|KzjKx|G$?=J+7fozc1GzgQznx|)SOF}vs z+ymKMpz*F{eX|A$^ldq5FxVNo)8sg2gN|v(z1y`4b*~r6Cq0vYbWW|pELfLplIXDk zErr@Kg8Z<*=iX*SowsTF_`0X}a^KyfBDHENy6+wafKUJY<5aiApnPFD3L4ESSig?9 zjz=3eh&SSUe+?GesPDkqd4K$AQIypa)CkWzbs7xJ;|+~0ju#!>$Q1%#gRmf2UQ%6! zH7~c8Oj%61Mg?sQrb?7GV_}u4xf>d#Kfh>6{B}Gl{;5VM1{nMO(%=sU|TOGjAz;kmo zl$e(_9)OZtzVP|EhebvIH zLI2IAmCrMU?-3ojAhAa+GL&?7{1af`_MMmPoz~BVE?=Uwu(!Q_x~biOVKR3VH@e#X z?*DxBJ2k|88-kI4}OKVY_`132m6Hrw?XKfAw0{Gbsji-t>&(oV? z(ZUa~;)-$OVe3k}xLjB(Y^R0~UOvv7w`~s{ThpwuMkV%LobcQ{vzM~qVa88K2@83l z7vbe1ackd^`Fsa?iD|5H;A9Z`Gi7l3v_yoxCfK@dxz~1MYr|JP{q{d$oDl!-Eahr+ zBe}H&vMW+R9tuHw*Ox8+|cL1>JiVS!@Cw;@h-9~juY^@8GxkT!#ySVjDR)fE& zj{>%{Y{K1q{cfm9`+0WVwYuJ+HN<3o|EigEAWvXo+lki~H*21(3YS@ZH+%iFI!|B8 z!Y6+6+R9m^PNJZ+6|0v%#}VB?AS~8kbt|ew(f1K%C!MWrMkaZ2%wHqi6KjIb6*jn4 z!)1eRK(cSZTA=L@yCauZXGCcr`$l4RG`mHB{MWIGTa@_{2Iyre@JCfQADI8+oQIk4 zN=v+T8jLXy7jBx=11#%&`U$@Pzw@^puD$RD&8yv=qIsY%C55AQ47w7Vmr|}-8YGyI zCnE#LO3||!&7NpY?cjgOw%&Czw@56AL(F7gZ|j|$4AZ-y{`t=iMSKjGhyrNUP@&%o8`;RO+Mbnt$(zc( znxB^FY?ddWquOeCxoIfW`Iz_>uXSz5l3%m=6!6oTR@kNvcvHuQ-Mp>2?AoAo1u*UU zu%KFv*${W|wbW?rct737voWheH`g^^B;oMZI76t}?bk+@>&$hGWo4nF zf4+MLq(P@N?VbmPwl^JS+*pI7UW=>tcV*@Auc`;orZYNn=&NCc>z^;RF%#w~7OzK& zEJn^3e5iwd{K+wsA1A-IIeaV)FT)Hxi5h!r^={Nk_MzPzRm93XI*W7&xv7Z4akc6OIQ6-P;7@toz$LR@IZ7aPeYdHrO(4OP=jHv= z1I*x;Z%(K@ZE+Y*CGXF@XICqAf~NlYmQD{`a=F=_)6Nt)2G`Y}@$Q>{DK1ynY) z_6Na>M_^hS?|((b-; zy@}Vo<_BzWcUz7rFmC;J2O717I{ZnMlZvyIpFntl;%kKm5dma&b!EQ4mumYeKj#ns z0Hbn%<*RB^XBnS94ZimxwQx$e{nFC291a`Hr3V>@crFFWMlXW6WbPytMTUK%$PZLztuQ+gwXDRndsa5}^je1ME3P`wj6SZ!^F zW+sS}zH5&|M_LuUFBs0yNU6pBp&dZbH z|CFNH^uJ&RpQ0fZK`W6-Iq&0qCa5*QPuF0dO0BO!HYVn)vuJ9C)DMRl@wATT!nen6 zr9T=kzpQ?hRt-;5SHC7esdXaI$h9BrnG$DV^_#qiKfF)o|29mGvjr+P_f<;6gH)k6 z&*flc9MFS62FLnG!Q}W~5!Z>cux!W!;*V_yLI}I_@Lj{Z?Rq5X;MiJaMhhWDSo$%u zCr4Tv{<%D5!0p}p!|}-lv#XU-&ur3%PFkdY>`sr8QjU1K-hR)5zbifXo*Me0*O&1q ze>NHdy&Hagi3VJw#V@BjABG*Nj*b_VnCuc0P+1d8|H|sZ?slc}JD^AntTik$PZ4GO zZlGaP2l=&{He@#!K5#E7h!fEp;8ZsFdXC6hA)B|kWr6W2DqbaoF`eGk~x#32$?h|tho@gCPllf z=DUFMBD3oyLW>_GHezK+`=LV(gu$@GwH5HlI}G#kX4LRB+r zH(af?&w5>xdKzEzFgtnT;EU-{go(G2J#2YMJeC{R_F&I7^33`7=`{m6*zXJ2@f`Ra zuB5bf#}kVe?>haNQa|Kbwo`6$)OYU^I|EnJ`4Q_cGd?TQwRvCZvYhlSE?w{Ag<3Ye zYYg2;1pN@paSbeV?2*tjtl5SF6gE*|3K~(Y9mv-{W77TlrJxS!hqZiu#Xs+tdZv3% z)~r?kz3o}-d|Y%dB0tkEF@z6OFG+;usC=LJ{6r?dz&=0yy1w(A}LH%1j0;im$!qtEldV%{CcELow`5xeb3N9cL(p$C1(ZTQoP>?tA%*t#ZT zsy=d$%CKnzewLeZH%+mAP}u#`q42Zm9TLvz``U zQ`*?8q;k%RZwZ7FK1J2ufEQ97u(gWbNodXzdV05CjNQM?(j%mjY}Oxdt$}-rD%+mp zKFhCAM9FVRWxKDGM>@q^7EL+xrtzbM(RtT*tM{-DEb2hEv_Si!Q1$7p_qXn2Hf831 zBiS}Ww?q{WdrG$DVKlx?V-kuIm>U00FZVQ%3WK6Fq8RGf{NxTIT_L*Zl~0>IGfI_` zqPmrj>w#}g7LlGb30VFZ*W>g5RKa-mVYuCQUDSJBLBfoS4%ZgppUzh@c-Q+=XSs-s&F+f)`auWVT%25#gFygw6}k+wYWqN zeA2D6Al&X)OzB%EZlS__eQ#|A_d1RvAkTQ<#eD)om}3T~D*&gR%x8}uIcuEMkNmX$ z{_VH~*_r`6TPON~H2-{33>YExTA=MK?>7YPPyb7OfTk#?>HD>dqlT{W0P)WPaiR@3 zUOHd=aa>^XPLmPyxFNs-AZweQ92EcJ*m`^9bSifINn&ra@YahJ?Jh72f-Ex&TeZXc z4z~@h&53b$f=RfPF=~F3Tvpphw)2sL&Ub0r@ds~>i{|#G**$@;76(V%WeKEH%|T1~ zB(Mnz;Z3$Sp{O_iAT9J!bGb-H8WKu*bsScIp}9lqw(k}T%VotNHeZ|#YCG7jPkvCS z=Edh7=_P9s#{B}2xP81cVxW!LG_9|67Fn zkL1B4<9y@n&Ix%O-4r_%ijr#|DH}sp>2@kGP>o{Nue`hT0&19joYgQaYz8Q0XN60V z*2$OsbvM*)EcK7=v+1ZRcXwn_Q`Gx3srPtbXs3)5$G#S8_TyT1nu8Iv!Tp>h;X(QH z3-2t|zkiWBajD@~`;AtO;G1r>wZ4(DAA}xR6xd&~d+BC8`*Akznd}2jNfd3%@8uZs zdPQ2lE_@iop_IBWQ`3dcp z0}tLj$`SB{_t)^2g7B$|2(WhasyWzmFb2FkE63o@h;e4R*WQPIYd2`RL)Zya&3#g_ zJ0VZ4f^Ae}6qlfmx-ZhrIo|h3PT1M)i;Clwn9JAQs)N5JtQLpHw?|IIAsQinDI>}` ztoj^vg0i3c*5Ystn0g&tQRW)ZkIj|yfOJiVZq~2yR_9RH!xuhzC~q0cuq~z1O!E-$ zTn(X%wQ-fsx+z&T<)zG>8DJ>tx0+Yxj&ca;uUF=yiS`VkiI|!p+YPTnM1SR*yD?3_ zG4Za`z4|HuztS32)k{Q-Yej#70r5WqzyZo>l>e^G zjhQdK#mzS|_J+{=UGosB+WMMZ8!A&wejbbTogFGKk4#lEcz?Z_sP2dJ`9}30w?$c; z1WrFFz2pVfHROh*f&QIK;fBel&KEq71gggLofNeX zO?thnJg==u)}M({%#cuInMD3|>n}^?C4UW&;V1QM=eqC9=3KbrB7^ni_*@RP(dZq! zoaMB8h9}f@@spx2kr#N&KvKOvAKCmC@bmTj)o#8Jay_VM+7QX&rh$mLSiLL(Oj~Q*Q<;OkL zN{}XC^PPBPbiFk{U@9g}47p6uP;TIzNW<=uRydi1np>Z*myMe-sCv$(np;DsSMJuU zv@7|*n>#Yl$~X8)q)Sn!3@0d^A@ee3{#@z^T;JwU!AMy3beV7P3HsF@3Yg2Z7Oie> z-gOXl{t@JU(*PaX*F3C@rKw|IigCXxTiI7zi6rQ4@-vG4ym@4@FGB6JtHc<^JyPO? zATWfo-ENrZdp>=<>rIV#9PW{CW3F+q|3L#(F@4&zG%+6L&6gOTc4_VnZBvO6$Pf4t zXu|FSI*bqC8qL)|5+lU!eU%5Z^cPhM1N1)Cw=u2fd|bVxS&7sEO&`aqP`5}8_U523 zF~vV`n+6C%So-%4W}}F8deH4L52c#MyFZ(){8l^td&J@d<0!L_%^h<#>v2lnV6Zia z>x=s5sQfdTxV}nUrG%lI=POAzKC(62pKqpfFPV1epjLv_I~`lc>pSgjh4nqedJ^96 z*Ke1XHL6SfqBsm4UUfYdYUzXh8`YiH9-Vti`s91pj?|8LDPt)E;k3tFXwEQp{9%b_ zzkE$#ZKdt?iy4K96;XOt8n6E>|9sex32e-dT&{In92>|yvSEUtQzOiNH0`df-5%-7 zmYh8EDj-flJxujVYPmzsh@xGZf2{_TsQ;(b$g^L6Xace$J-81HBqGMMN%E9-Wr8-3{fBJ+z~} zqZ6-#Ug*bOj9CA}>Cgiz&`znVsr`&@{QJrwp*A!a3w>5YL4mQrjSP5vfQT7TZEcXE z;vnN{XsU)QjF#{k#mt^Z|20w#<&Szki(12W8qx=VE8bgq90#i8nhlmY+=Hzv__Vcd z#b7t9;8T^04xE-hK(YjFSr+mmcYZY#4s60e^vR$M5UUcDp&z!jG+gFyy0jyN-4IIh zwmv3MyZ_*?kB#=oLp^EIv@hx15IUBJP%B?tjrwmV`|<~MJcaYLj% zay_&hnx|0Q+_e$o*%dIZ4`p)XtAK;yRA?)3lk9n%y5-tg*nctJVQOd~$S048kUe&( z79lLtY)WoB@nU3|wn?{EUCdCUD|@>#-G*v0B9UVC8k;kDJ%Y?3LVsFF>5RgdIh_ng!URSEj9l! zo7sPGI zV)``%W2{0aJl?hEt32<>JfI;`O@5U0)mf$h;t<*oX8ps2ecoU>BX3qG(e1k zi2o9C-_i#8I!}+SXjHq%&PKZ!Q6Xoztvo>yp?Gq*X3Kfv^0}=5lzjHy8M2p`W^xUJ zN_vr5bR5PBoAMLSduZ4YSBj`4&E0>W)9_)*UEz6P-q*$2bDHR)jfqBnn#;twqRvK6 zqRF(@hx3O7z^x3?xn5Pv&k}}&;=aU`x6$8lL&EcqItQJABNpn*usgtWVy2hnVRyIzZwb!dcSi)Y2dEjHodOrPr6rTHJN=Wg(RM2_)>cdLDur_VM`0Z`#IO0XU&$@I z6=}_-`7YRLTG4dn9*y-Nyzt-VqT@K>?>GL)Y!A#Q%xRpG=5c_TZ}ZCX16O*usI*cHV^wdTGD zc}xdp+|iR~4;)|@x_Zm>mZJl{Q0o-DWka67RVHV~z2tl$Da1M9z6KWim*E?J=-8`Fza`P+|02SjW3DwooJ8W4sj&a1Q3?+$ITgo?ar5FB@~NS1cSa-t5x5HZ;K&z zX5wrP6y+`5V?l00G;GHb9FaAfn@3&$%F@6q|A#Pq`!3<*e7IGqWZ{t-waaUsCQnaP zBq5UGfrYZkadS^peZ;;%pz(_SiE&lj)0N}Y=*R9je+ZA;oq0Jo%}JH9J7FfRnYD6c z^N;V(XO%qV4ZPMJcj5LcS?IO=#W?>+S64?}Q7a!!Ysq;VH;85Wmo8_UbfamV{&6Pk zM)QOI`E<#!rUyGe{Ok7_Y$7~6WiAUMj+I8X2dLz9pdu+Uk47!U zU5vaYFf@;ISReO$I!K{!q*v8!n8se8mcz?EthEg{S%n7nSeBk%Z>eJrJhPjITRBA5 zCuZpESSZl;{n0AseT9*zKu6a$Pu7IOVV{mME1m$bcKnavJygJTR2jdtthqx*H#2Zl z)XYk7;+ssz+AtciwaKAlvDK;sP3GUcmFz&5p^tyUHHm~p>he45n{sFLvdj+L*-HPU zq1uTdO)!6xb?kAynoHFa_PnA#F#wktXC2ZOsh_=y<#M+3qv1=2h-BlfJ`9!QZ1qU$ zQnt54$|tvEn?7hh0nR>d8nVs)JCQZV(VC-GMbrdUBMnw^X4m|okQPjK+Sb(aL>oP8 zNk;n|DW9_r^_KnH(2rUA!YZDU=J#ciksNZRm{9U7#RLuN12K;PqvD>?TFfszf-*5y z``kaRvm72jo|$&ty`rIw<#X7#sV;|fuVE}l%m?n!(=ET}rerb+#Gqi!BfcYD#=uy? zg#>(B4Y$gaRkeL+bRl$4z*(iLH8P0Q|7pG9eu>*_vdXy4Ez?Nq;dbJE|C9zbJGu3{ z66XsGlEnd?vmU8{WM?Ok7dX{fdfNG|qTM$3+$Vsx3FC>=yj( z>#$TeSySP(twpD`h&0FTCfUiSKZGDBfH_j}YkhGnR~hKh<5!P?M!ING4%#t6XWc7^ z?8#?*k4FWs2Wz}vSWZDj|J1IG$0LlP5LN*D`gN+2#FGP>ABaV}rp-SO{_eO&bX|Md zbuiJ82fOvEv-!c3Abs1W`T<%ZzQ(Iq z)Bb2RhCr#`<&@B==djM(6vD*fTghzCkoh}ax*vIT*!B^_+`R)mhh6VYoz`H?Ck1Js zcm<)u+u5_wsSGt$muSoAa6}ud z-M1Jev0JZ{2m&Kt6(f!eVn@)eTly1pl)$u;HuOdos#;*|9L-GZ@5f=7=#*S8&b|#n*gum5rJTcOp$AD5vgJ3 z43{PC!c() zG$r!QNW0(VF%xQbY1Z^qU%P!o7#8%j>+GArsn(IOZOw_AxtqQE3e@~ZE{6>E)Dl0fYUM_M&Qq)U+WiwLB3|}&PE;&22C|RLOxJ=4$+FsGl;{qG;*KPlV zNWN4kX7#O?1u*B*t!doB`_dfgn)On~d%szDH?u0hNS|-nxcbaS$T!XKTeONTfE**H z>tN4)Qtl)0a1GO-qkQpqpK^5C-Hgfk6|68LO&$>FtfJwwd%P0`uJVt}waeIId0~NH zAE?U!L>=dqF8zrpdK$;fFYsqvS$@w?82^QK`iVi!M0Wg2ORJeIGTM_Drfh3O*i?uB z$(N2^gsE*?nGC;FE@qp4-|I64-hv%<%|TLEu?u=OLg()=)LEv<6vEF|407{Dnl zb$~Ql*F^aI(u7ZZ^GSXVk)l;m&kwhCkJOeec}|3aQoz3V)ts3T#etcdu^^mD{lz7W zSfpSX7FzGuiqX*=+P);aW%@cN)4Gf^qU#etKZ0 z5b@hH#6sx3iLcz17p~X4kvWAz_(2&k!{FktCr)c*)OdEiKA3W6@qs0o9nzL5M$BWF ziWO&th!I3}e7z^e3PW70YSH5w@#n$H+w7)?+;-^McKd%g@lN<>vI4w0jX`kCH^%@@ zkQg(4*9+F8nm@Qp3;CWPc~8(_%Mw$`I`Z;^b-Y}N#Z7Xej>QFcX*(&SI;o}FH&RO* z%EXfHbZgAI*zpPtZ?XA zn?L2mX49=k1G_Wxk~a-c8N_p!R4nXEQS5vOpj#SvO205V4jFJmgkL$Hz{{`(h&8W& z`ndhY6P&nw=!cSy!yh^sN{@l`WC$$vs>Ty2OrF@FdG}{71%woK1WE+PTr5NrD&~$i zZPDWx43;f|?QXT#C&{^yv~(Ix54nOopgv|HI+Y;c0zXw984?RZ1o>(b#;2Faw44xA zE>+w~4qS4U@Zo*aDBZUsW??2;%#ZXv!dEQ(&-0#W;AXBfs2b#TT6Q)@4WU(4^Kod^ zTO8N9HIluOi8u5u!3@ZQo)jgGe_+0G>Llv1mzgNMWqb(`h4g@wOs5*my*dj5CZ{S5 zDBc{(xly>JYrhIwvLPPks63@x12#@t$bZkVG2xW z$?@AWy$ty$U{C-&OqryF~Jo;7wFadQDx;p&PX-|3}UzW z@3xH$=2dd7z*| z4k6~ATnW>Vi`cRAb5YOBcxd+dfM~+f{krWh0?mJ0!=|C+VUKL+Li{(kYP6*d+S%9r z(ZDc!yKi=KPd+vlPgwh?V@?>~{eA;{Vf+lOm%T^9&>9p-?t&RaH?Hx0lgkSTxg z8H#^5Mo7K3jGiu+5NGQ?`bBmmxOF>M#{(Ya+ib%3LJ{EQ#S>3sb!?r627m{)ck8(S zEIMnCRb#scUDYA5tU1SCRoaX%|B2UT#uG~~Pu*kh_-=jOZSaucp?`_pid5HArGzd_ zC&wt*IUN=C@bT*;tQJ;O@22qItDBBdoDa*Ypw0HNy=2C7=Bmq3N&Eo6@wbuQLV-=B z!ltrJcx+%!Aa$R4Mm1*s67$(yRed#x;Ik-}7~khNnGtBAT*5<^8cY6ZP}=E`!uT?gj-fHK-MLB<=B5wi*F z{2zNqa()-I#=^$MXws1HXvBrM1*CeRf@f)^75Dv!1V-{at1+vUicpktL_WD%udfQ7P}oZXMHR~Y+vY2>%x!^lU&8VN8RG_`UXkXYBo^w zFZZ3Ku^UXCKk;gR)=JJElbijUvzvsZE@3$YE|WZjKKWhy4`@>2mc#KQ%jfbO@f#62 zzReymMpvBa77FSIcd#?N1+7*f5LfEVQ)_lN58Xo{nd!O28?1Aa;&L|)IX%9UG9dbJ zL18VcI%pbXlUx@nC;zZ)5&;a*^ooQr%cuf!--P&w3T@#R7{%Sze)2z!+Iu3kYs}+6 z6+DrSyV02M?|w1P0g;rtYbCi_tR^K#ieaSeH64Zoy|nEX&vAx7IMarUjLlLu6RhV3 z`wVN$Qu4+PeGM;dcM_{D@rHA6T$f9_Lv!@q`!^W#kj<}DCn161M72dq5wqLT z+QI42lD4XnwRV;yBxYLd@t22U6oj|XOzCY!zUOplW=hpETmm+|Ev)N-Z`EVy+M z7o5xG_oR6?2+?giBH=8rE6sgc&DYG$VOJuz5y@R?P4m}Hfvn}q1VX|xUb<$=yt2~I zBcrR7=iTtp>v2JW6St2Axe+NBdEX?Q8O&a~N|F{%Fz9-bg|FZ2p&{_!vs`J5^GFbI zh;uwk1n zsX%JWUQtz&OTzB%Im{DS_C$hp{&KmV7<@Btc=lji(a84FwKEN<8)n9dr3#*dkE+{> zF5dyF6X?x{3?@1b?VIl>%|GRy&ds`45Vm_j{avr%JXfT)nITcX=9E7B(CD6zx*`0@ zHhIp5Z_wU>%!IqE_2~)(7>m%0J9bOZ)E};%saYl^l(n5kSoFQh3>1yE4lJ zORCpCVOMlSL^1^ zcOgXeKE3-K|hiY+rY+w(1l5_93`^ zE&;?5^oLDMU^Xe3y=lg#|C{v`h|1wIa=6>b-30Ciw+J^VW@9+m?lM!UgH(+p9qzI; z<+qEz&^sJq8aP$Se(>`YiQ39|uJ!n#k=TvOr@z!+?t-o*y=P7LJS8+L#v~oTRn>D9 zQ>xF#)U=?JURFJuW5||lzIAh#TF=f&LX{U zT&}?D!@$9Bq~evlX3K;I_*hzGXWArf7|b39+5X>v>hXgL3qsTDuN%?M&CKF2nrMST zHy>DrH`KdAI(TVc{?T`VrIx>!TrYmFW9vS9;&S7*gBz(~#roRRU}v|wi^6zq@Q2*S zU36sc6)u1pNagx4CP(B=+-Kd5b6x|buC1UKqdLW9(T6ntyX8kyJz0u&m1GNDy zJIzE^bIuME&1H&}DA2f!Axl#y>>7q;d-j|3`5ew-4hBBf<=l2DSFYx0Ltv}=M#e`; zSz~IcLdn@iXqH`gJQr47OaZZue-72IA7N_5X*Iv}ZQWOIE~KAN!QtMq68f zrI6(7Zk7)IrFppWq*nFn{9u*WC88H3q1J+GU5e|+9v*?%{Z?;jXvc_qI-L5hU$Doh zAa#26t6gMevc%J3RK$Y+C|h79y!;t@L6>*sa{Fjtw(?9}w=cikTcPAI$Sr@(tDwKf zUDdE>DmbN;uzkW$^k+XB^p)-%XIS{aK5dtuxOtb7Z2vc2FIs;;&K@tbvx;b(!fdkk zEO}=qUiS}L|9$wIhxGLH0PI5UW)9{XE<3E^urTiI=6pxNsZ=j{*JoX#Vw_gtIG24k z&CJGDjZUiD$H-l5sY%6U=<#z{-oP+P&)e6FvLq)LnyA=2pSx-KFtS{i+0CQ0)h`bR zJBtq$zm$ww$3*T<+n*YJv8;uheL+}z4*1h?P31)IR>kj-j9WHeY?~=gYu+M|REcDX z3*H$|$-geWvc^Lr4Z#eYjh`rD$HgdzpYyL@47>WTk%(*e-@$AR|GrC^Y49G}D=>Ep z%oVVTXV>r5Bs61pcIT5!uaajA2p0~%{<3=>9eyYz-IpO;bJp#2M+Hd*rSBIZ($S)8 zx2iv+8+AI-^iL@jTYK4+kXY?USGXGVUE~iP}FrJ7kp3ck846G?zoaqjOX)dtcMHyCPOHmi4UF zMoD!{@yItk$CSGWg13_qt7H!Lzkx6dZSm(U_^0}_YW!u0j4YxZW=~B4QUHm<7piFE)9pyWfskI;>xy4CW;O8>+wd^qe5Q z)d>tB&}3l}tWfCG{7h(E=|e=~q|$>0B#||Jr!~9?9$@P6#`lJM@kb{$t=}nu^`3F3 zs|*hXbQ;}JHx8WI zC4kBzTg`)Hb}$i6ueL4xrdS+K1`Ylc0f8~$&!&oX%4@gF<;?v%<`4Slbx zQ!Aep_s=hU+cB~_Iy=YNE-uVY-y>|Tk*g_9jpZR3=^F98=PTr1@82JD7NRyBsiq$# zZCs(;b8}_>d{Lb(Dh9Gd1u3WoGVj$yzMqc}7{C32+pMGCuJ#K0lt4LrDvkSUWdnaiCCSJ zx-Nm#^3S6MV@bNUOl0&h;K>!wA7IQk!*XRLC*T->Xdzoo^}IW$>8MME2_D>SW#Ynl)=OFtQz;#drJvb+#=VC}lsMKX(L?Y?x)GBQF>~?HF^X^_gY1p=DWE zTid4VCL>EW3*qB%{koOLHC-styfr>kKt`wi-Zq(1$Qh_$I3(Bp+u3!kx^o-iV8rSM z!Ho1=d1jsH(_r?LQ`y5t*ER@+XHYci@trR>nm>{8#UX0e(j43jZY+J-t44vbyJ9JFJMaG0o%ppJ&H4%B?9fE%%D}%fsN{wj2R0rB19H!#( zV~YQu6qnbI0rXi9{^uF%22S`>>pFPr(Bx+381uk~7tzwE-wH2|ct3>PEbQ1vac4kS;wWawjgZXkz}xFGL=AqacPbn!v0|wIe@N@P+0|;y5ITvu@b%o4xseKztA1$VQ}4 zV2K57dzVSON|Ee-X((M#e%y~Qx%uo%`dOS=`AxtpJ_HEkJ(TB9togi&O958}wSWL+ zqrb7mQT!2$iLRRh9MBb%TbKAuXN~&@D&mK;6TlF`bmD96dM3cdI;VMR(OK5TGNHII zv)|F~K(wtsC)(?~xO#P!dSaFKdW^x~p=~Hac5mB%{k74M1Z0TF==${oTz-)>S<193EFHVylim3YSi|;340UUZ3oy2N}T3 z!T+tV2XHOS{Ei;8Kwq6emJSY%Stry+h~Xmuv%=(PjAWv{+f|7*@vLhlwkbN9tP%5e zI6<0pPT?}_`WNzvt6o39s?}(-)%5ue93#G^hLCgwWIuCR{!;A=lNLu(xt=masD+Hx zn~3fROa>w(l!sKc1|JC9mMX&TN=i9y1mZD5wXA zt&X>k*E@VZI^RYe1AqoQ^~W?Paq~{Q&q3{^r0w9emF zaq{iPI-Pt>=|nP1A77>(u<+iFm*KAC6+?QB2qIDWc%RD2l3Z%|b*A8<+OVBFV`lE{ z97|*bo_g*CB7=}BdxDx|8n$PlEa)$>*di0To6PwXd$27EBJ~{Ah6FA4>Z?|Kv|%y0 zJRg^zi@rY>nOBg7hBMCNSY>U+$)BH2pP!ObnoCNV&$3rAdFpNaw(>&NX!5cjN|0~e z$!6ShB;w4x^|ZNXri2r}aoXYj~~xDcmiq*x}@FYmZmok~fh`TZ>DLy6($TF`GM1yE%Xk z>iF&B@&&QK^*L`FS{Od9oo8Q*qN+w2dYkSr&?)-V@q6gG>2F%ksEMd$zyEQ0wBV{2 ze1@>wsRUHwuO?1?TU*l1Gm(fB%Wb@i_CrcHvyCZRgqsDw(GVdtsjdJ|11rUS`Y_P& z%b?a!$@Ki|ouwnXkES0Gjz||w4Z}37BT#~rc&fY^7**H-_1r%v1<%L7<+lE#8zOty zK-MSqsOc@?dC@~>(B=5n8J_21`t1)NEFf8Nfs=`MD7Agx!JS^6L)NaEvV0kkBhYRKZy1F#TS6=JGh;84 zJP;6j^mSiZstWP(FhXo`DOjRpKq}B-@VdPg0GD%v5VaL^$W(xuRepo#ST4(V1^dsj z{Zy+Mal&a=SCMa`%!fA>YW_!FDJss#`MyzTP$hfy7X&e)*D;@r490HG*m;vis4etZ zF$kADnI^UHZ5*|f5CQvgC0VDKu}tZO&qfOJb_D0ua#A4M|AzEb(J7a(F8Wl{qvL+P z%mQeY*T|mq&1fiX2QX;V>$f*9&N9hSN!gK^Uq^3H_N#Bu^jy79P{}vrfawTAx~}e zHa@+nN{TrV%Mb~upIow+k>^#bUT-E{m?NfaD-=Md3z&Gf9xQqqVjg@5BsxH0*UMB@z@a3HIMc!v>?H3Eu;}yu5iUtz- zc_avYA3Z(&n$XLagku@=wBbcA6_tIHM+Xf~z(eW#SfTVlak$W3C1|R$fjI_NPb7LT^W|!w zVR6R=PeH)7vN)cH5bJxkasP-;iyw9yzCL;4zAq}&t6kOrmrt@fJXH`0(GW}I<}r|~ zjH+c@&J>ynHI(Z^9q2N+*ca4IB_I#X25Hg3W4!GNYSwJe{<(-lHWkeP{P>iM&M{!i zjuok!cJooYlMq#==U{vXiM&wMNhg8{Dvx?^)O+T^&k`0I9;Zf*&u*6Mn?_0b*f`2k zXpPWHB>zX1)F>=PGyL9rQS7)py9}PyMfD9YOG~WI<@Vq=xSdKZJLE*tyC2VQ)IJIQ z>9^dV92V)Yoc+pOfZ?>r)%wpX{+IWdAJ|+Dl{D~sv{}DWO;=<+2GA!`ohL4D2!*hV zetA{tWMy!5gE2-rh%mwf_$o~O3EmAd+jP`+Bb5#%DRawdR!>aNJl1WAR38)sXD8N} z^n|aV@&re!WqJ=F2O3CdPO=~2sq=rcm3Ti}ffwenQmw~){A)86&}(8OrzQw~iYo8I zz;d6phcD9040BDF5_wu)>}tZ6(7@RnWP||legxo(s8s-Wi+D7TGhcV~t~ac_D!`R3 zNg_W<${+TkjGWW0Aar?<=|2>?$iu{lJ%yK_7LJUako%+FYRLu8mnHdGS=TI9L3d9t z`082|H=9^9*UQB%z^noxDLS?A#WrR5FyKXA*vYKbMeK2jQ}b;)TkXbztNrI<-9LP2 ze&FY2UHYL;XhRd{cqP)gn>dnVz7>lOGPMpXRgwfCA&j?fcp z|6OZt!ez5e3xoZRS5#q+lm1PILOwYr$+X9jqrN#0>*m>lroo>Fa6-jZs_t$hKP|S? zyPRv`b&jna{q!cKS7drhjJyEMEd;v6^!4W;+w+J? z7=_3!$yfopXi}@*HV{e+X{SiZ%m*$kU;eVr=`>~0u2nR1GKWf|#ZP{hInApka8qj9RM7$Ki5qX0$BsD<^*}6gqu$ z23TPKz`(}(j5J}^_)?4|H?KJNO=nVmvtz8}N#Dy*oCXOZOQGps*V_&H1|@vD$p zjgBF34*cnTO8bhQP@$-)95%@{DDNs6x>ad$6#G=b2C9pm-GEK#%Y2?60TuHE37eAb zbPWFx(nhkpv2dRRTFWC5`gAVS73~_f^$9WJ3}GDJ$u7m^i#X`~A0i;Buo9HXsU>9g zfOpu>&H(hXa_vdxh(|1AqFMQ|nc4OkpQGjTbiGTu(!<8$r-TRRh*>iXI!sWG+*6De z4X6=x+7#IrqMKojA3@-jyA+hY-TBS*2 zZ4PgBbx7R%PA!NF_2Z5<%t~~v|Du&+spNCs`EYvmnM;<_0O$){_GmQ z0Ny#j#o4dorQy3mpVCJekBDovWeMRKO)+QvZdN!Q`$gj3bW5yqoa^ru4q)8>bkY!H zooG0QwA4NB;3Rt1?jl>VE90xW6fVj)AxSpu2Ai2|j~nZdt2GsxdLm#9-tqd z-OT4C4y%Z+r|Tz$eS$G-QW8k}8 znPeUW|5f-%+?}nir#3DXQiHpe>^qmr(J-|gUF6p4(Y?cdu7_{_2IN_rp>tM@#2}_3 z6hvithHFitoW*Ey^I#wPsac6LGqtY&{jT}@{xCZSZT(voaV<7V8y32H-o^nJzR)O> z3U8K5W@XRg_Y0rYY=*Z{M)=t?(21*T+$|vIwMs_15%vvDIDuTJ1#NVRJJ~@iO5UST zH1%9o3lh5OUqCvhD^GuqJS_*DBr;9TDy)k65L?l-Go68!BfB`XXL*$XS3GBz`SQWg_n=dOYGaOwaMiJK5QF?bF@-A4a&vuV=_RU$V-;c2kI>%wno3X5rg4bPVC3Zthm#ePbK3yNxnS+l%5L|cos#=~zXPw&O+L2-HtUX2XU+}o!(DVk9S4DnnLi<5@qY*y z9r?J2_zkoB%VKbT@W4ou;q(tdIg|IUN}j(|@rE-n>CwJv+RqM-3JIO{;}EN7FCUD5 z@IQ;>(FB@qQD>VrGmQ0JdF6uPz*p2&6(krL?=@q>?Nt7Ho7zpOm5!mF)WlnS8v z5-Pht>dxjAImo-~I&O~3mf$@ud>K%H5zZ{A1O!jGa-2J15z+G{`UFGH42i^gOvp#sI>=qoeV;m;a z|HC5q=dFN;*c|U!m`%+YMx%+`UT6DV{Q|&i?EE=I%@Q;1i!5a1@se!Z>Oa4W%TzQ{=swxZ`Sm9tn$f4Whe`g* zQ}4z0CMIfZp_L&}=OxE`6Ntb^R_fwFTAoUs1SQRwT+IWdJ&;ce#>;0on#z7uSt=x;rueB3Kgf!Q2&u_I{ z_&vbXm0!s7Ly~H&7y>-HM+Sn+MFFaoo5^df$6On|I~GT81-Jzyr2ETuhK4EHI!K2% z0fWh=gLHyu^|Qb$BX=!>8@QIM#Uz?$;aN&i;HPa&j0FqSK+}5Ly!ySs>mv}VZ2eX} zw)jOuOp+r}V#ZRTlE~X!av58*N80h^_vVkZHpGYI8Kn~rTQMCj0vjHH%%o#xNy+sHw_1j8wG)Y zt#xLl0bI5?#~Gl-Y%nY=n5ZHT>-gA-pqp9`I0)d|ovqRMv% zE{WD9ej96zv#I`cE7Kw*VjM&nJmrinG3>i{ejd5%O(Q3G86%|JuqAM&`P4kX+2}JS z84gz%sDZ3$y_;(uhM~Hb)>ztlm}j6FsV-oI>?}v^WSPs0J=-81^dDw)^Xkh;q27g_W@YT?HP0^|V)vu~)$FDLkiDr%kK^Q!Krfz( z)@IhHO1kKt{Xj*s#3E^G(|#wZeyoINi6dq0?1qPUC4#_U&hn9tHP*Rh1XfAccMZdp z?z6;${2+YcYS`)l>f|krTC3ta_xEWbrqew1wPY~Xfdd4fo957sEiU>aEcx-MezM6Y zk8`9>BdL^XJpB$BxB9Y+Z0fbS?4yo|Tr;Rt;`nT26H4vE~3v{$X zG6b%s+gSKbG3tD*8@11?upOlXnkLK2d4b6p{FRU{*w+DU8->Oc rCA?ScXr<>`y zKO{y%j%MfL(PcZ$cEA;&v~r z8yPqLf7?!!?J34`&sKFO@A-rNoRr%PUqie~D^2gC+9BSBu&HswYL=hyaq;Y|!%HR* zIe8qACSlvictU3_$M0Lsq;gs`9BFe%6#+u^8RjrKb`%u=(=7X!zX*vPg+kqokBDC`4}D`{eVOgq0LbeM0kwD>-*Q0jH;rbC-vU0o6|(Mmy7vnz_OgdPKcxRI7b#uS*t9!YjFkI%UH4x$K^d<%;$=wFR5F*U zIo!^}`mp}qY{f?6wSkne^EbCL|Mv6|kJT%~pD*iqMaxZa@08xS!x@>j9OiK*nX`Un z2;N{`InSTbNM3W8;h`NG-ox)qV#;YYSdE+BACCafZfGo3J*Krf3_)@0>5J&kzDhZJ z^sU^`K4(Z(n=H620@|I1*G!oJ-&;5Nc{0*!xT*lBaP;Cu^p}E!1Z?4=2e0s`{Idt4 z6g#CU-?IhG&h%l?!sD`0>Ld-vJZEY&|A9%$_!dd>SRxV-Sju&g>WcIOeV_c1xrlvM z(?!i89@yA*@<(ATqDw6&VZD*Uq{tTBKD3HigZ&l$Q8W5qQeF1Dn_ z5R(G1o`*VmKe14**YeKLVZhAaixIl%OZUd2K1Q<`zkBBfripdN<#dGG;_Z3G!SeoK z@WrIClw0avl`iC0Y{R}HE#s8_WF^a#`mYSjfc#+SuFIKJB{*&)kPBza0#Mw9@TLXE zIi$M=zO0ZP<2+7bA*fBs41@4vb_p_o(RZ%OM?O||3tnwoF#^l3QMhi4>bm_xuj1wh zV->_JK)Q>&bLmofS#pX;c$<-OU3D~vpD&`8j9>L{2epvshm*8d*L7N({?Hq&~{N_yIfjhQvv*kI$R z7W8tkV3A3b|KDEZjEczk-&AC`DCj;P$Ig4Wk5Oi6&%4q)@BtiLqw0KCkaH)WN@mK? znk}7T}^~pBF5t7;M!TC82`cO0h(=XWa*+;7dvUUSHo#qm008$xemMf zcDohRoSL&m4-!0gIDC@8CNW!Y*qHoD<7Z(G%+PvY@BCEv;l9q9@xPc!^Sk@``uVBK z`R1GR%}ANx<8uzIUvx|YR%`1%Y-N7M%^xj|rp|vq28ERMIOvYO(R0I=)Zp{dPoiZN zbG6H3qE~+JLaIlpeu#>4;tk&l(N8Bretl1`RLA=pXk}z^XV}sB<}iWK2;ec_YFkqU zHvZ7WOV~X`wEAV>&p6r!zx$#^atg_{;NvGmM=c`TIBdX=Irz4fvjs1D)*?2LRg4nC z87vftbKu(qWmPG`CGSwdEnKBH`Zl~?46-!D+GT0ebN~sc-jk@sZjj15z3g}f^EHg; zT9(4XB79{24?ZbfQFaLzEX?!)#UTlEn0NXWN>}aS2bVmxcLuW$_hmC0F7xIr#f-+z zFzcHsK{14H+hnOYYb-mlg!Ys_QoTK7^lK)or@eY20NTY8)DC|Ew;iyVDJ>t9NW0V$ zSqX1{;)52%&o$PQ>h6>|q^Z1H^9zLnV7pQ~Vz|gG0F}EK1rP9feC8$^)6by)Ue9r> z*WBUqbJqE6z`m2#eKv!|rjiM$lislq)z?o(JEGmOi6<1GrBWqNT+Vn6HMJF2x7xAP zAF}08P>(M+BB>yHPy8VLKg8hPj! z-RjYPFyT8|nRnBKS1P#$lCSm8Z9_rIc^|E8^_cN3D0u2C$N0xACr6&akoCZ&mS5U8 zv4U#_88*hr#lu4z5MaR0s|l*PG3O~9DO~ON&Dg_C>+#449NSNduT87Y0D7gfN|w8a zs5o&m!MkH*wLpi*O+!mL+oeiLgdcu4KggU!%4YgcqaQ?mZjm8seNRZ3$`&h#5TEnjIOi?Y;dRdJMM?N`!=MS$eZ}P20fFed3J4s`Hiu2CUfE zk>QD4nM&U~Y5(D}VVKDSxBZ8)d%{bY0_+xrc~@bt$D*i`fG_(~@@*h;(td0C%pA1m z00H+fHq)Wb?RtWvE^LHBnPkmTnSyg|hS~`Zox*JRiq$7(J@*jnNWeb?QSxbH5>&@u zoWq=q>84d`%m0I4*&1+ADA*WjdC#BseEt-f^-G-9n<^5#@#``oUgDK)PE#LSa*6JJ z!Pm{H*2Bvfx7T*rm*%wqoM(bpdiHMyMq=t=(FKBuC1v6DXn3I6g`Wk@rSNf=`7s2E zpJ5x!__JNIc`=2y$;Z;1yHaNm%un$g{XfK{CgAHAC|kK}*L=IG_wX*g*F*U4I;_X} z8H;Hac6Ua`cgOEAO&MB3_MmTrs*g(tnC1FKfEcj_%uYFkY5SK{ZB%kkU}IBq4#8Ci z9AXrPPj6ynVJKU!jga=$Yjz+dEgg3QA-N18vXj6nlY2b5FBnYY;yspCl{= z54T7*hAnOVH}1Hdgr|^<%vua+UAlD#w2QHkScFu~{A&Ts9foM(>MTOv5W8tnK@R*~ z7NK6RW;6u^9#CASLBdY(zqf3p2U5x?c*IISawzk3HBDwEgfdY! z6Xe@g8Ziry+K0Vqx-I+ITa&kp#5_B4tUd(qYee%>5kbp1B3P90Lp{{rgwD}3sL+}S zMeqDgrcMs|q$1THj^B_YxhlGC>F+aT=lk;0fcn#L>8e8zQK1YEM!3t&N@^| zSSTW0*Ej{L=_tT57RE#e3{PVOPL_)P*H+exmbT$5p zLjbW%KTBFVrI$lm_{e&H0^b9-+u2oRZMcqS;*SB^##^0pKuC?FGTJl$D9$doK%+@- z+;hHm`m6h*o=?Xr4cj`o1)Ne-uKheoVt6&YVj>f-rgCs;d-|GT@jIs$Pua8Pu|k7= zCOa0OGIOcn0Ujt`3$W7CXYd3ZL1ohGCwcMPy`l zyRY*4e+Ft8{NclIpMU@Uoi-)nH=#3q>T!+Wd^byhRlxv?$&t4@7dj`XX|&_`J%H{h zv0AXcMlcP1bt?-&A7Yz_``Q&VtOdvx%RZ?))wEkg_kF~I+7<2B@?LBg7B023E0kT; z(nK}l=+_R`L_2SJDsxf1)dqe#V_@Lqfbg*mxQ@FPuag{uK|P-?C@wNPXk3sXST*jt zK_?BjXZL5+%(!m-NK@*EF_?%?L|?U*8#w=of%GA5ppX1p4R7(tX2$Yk!>g*3Xj=}h z;{TKH_gnrjxNO_p5X#j-z`qtm`3aLsDm`&?gt@E@kGBoLSTmZq3XrrA`nxu+XIMya zqdJKxL01%| zG5m6gte6>CCC(Dqx_^sm-&rJQaMELN1#2Y5Zv2vcE}~^(&1k%8)Io+dV-W`%mQwA@E$08xZNVBp1OEOp zYqGy$=CkEw*E|(l8ZkQ;hdPjE&s>BAL1AU0j*7o+_Lvt+#b6ke z8CU;xzVukZmQh-v%08v!kZ=-akT6XbKI_05@N z{r)=V-Kv^B6;;UmJD={lBkZN^(`N?GC21!9ZVZiBX%1u|S}@CmJ*vjG5cy;cU-Z>~ zcu?5Wt)Ltr2Ux7M>V4Mp1%u_9TMp(ipY*A?sRnJ;E0v_AUn^tv-ok(me=~X@hh^kz zD8OC-2;DRz7Ho^C=ah>#`xtH*yA`}{f^ufc>-G!$5GzbR`O$nfLx=`6womO;dPoX& zA+Fs6`Tf{xIPvB&!}wLp0g@U$&G^>RvQ&xGF$_PY;{TdCkyaHy89eysQ)uerMmSGp z(~iWK^hkTVA;D{3!Z}2D>U0kha^jL3Cl#sR-H)&kc=z=S;QB?(%cN2^GgqO| z&!6+tj_84;>XzX)`~cm8^7*soMd`%w>5YGe{uAH zx|%&F2bZow$sucp!MhnRdt#y(fmv^SXt07yf$JBZ@sbi-Y zji86*fPCHj^vQe}t3gmW!mOlj^4mt=>$hXb<^-8D$-K?*A4S)n-)S&y@bsf_GB0iB zU=%1Byj5}rsl2*oSdrVN8?T(g;$}0w(%&6@a-&m&@znpdO_Cafp2Gb6c7S5H4nZZz zCN`qZ*qdK?gbNE)j#@><+1_Og=&7a=We$N>FSX)1FS0i9uN zAHtY1U;Lj89zuC=@_ntZ&yo^5Ngl5y21#FP+d$c#M7Z}+!pBVqIAh2P@rD;+;a7R} z>c4#Kph~A;thh$ml5h>utUe)QFX6q0DUY{@%N8n>Uo?cvs6TIF&0JwL2om$|Fu#ehzQ7~U+3N>! zSKfciKuYjG3jeg`jvba%n>GENDaRzaT3RkN^(0jhBc6{Z-kP2v1ZE2RBMQcMYG%=4 zt_Kk^NmhseVSoDgNxtf;#1> z0}8Kn6u5Ggv(B@01>ACISyv&iUiww87RW+kHDN|#qOqMS8TmA>=>4e#{@?y798DZ7 zS4%m6+@zNtXWZqMv@(tBV$<=%`IubXSiFg_Y|0Br_E$Tcl`E1e^Y-1J7n&Q4pN)#u?H0o&?J+KT@h?#y4hnfVXh zVbKW?qhDWPV-qmu(D%1EK5CsyK)tvJi|QdSL!k5fSq^+qgeE2>68k~4EX9Kdz0#*t zs*wGia8~a@^>rJR&9dES>3Vy}x&ej=1^&~aX9y{cqXwl;dzOmG<7{!2VQeHFFqDP6A@2n*dItN9}pU2aV*W@FFQK@GJL0?~MH=vMR%*9~XoiA>w=BTK z0`6f}!Z4fvF@qo$T>Y6Ll={M&r}gokztuSIIcTDtGX`W>0$oOm+_+3#x+ zhZK{a!-j=U;2MVF;_&`4k385B;*5Vix0Myw>&T+1o8c`T3=xIWMyl(2$4F5HmyB4m zyQSpfLMK0ZG3~-$N3p#0?QEV8i-n!M+CtW=dI%bo>{>P<>vhk%vSq&7}2!2Y6_ zNC)l~UB4u0v#@B8MoA4qf3q`v2e80=IgDAzr3+2*ZS&nAB%+BbrAP91> zTNQ|oOBz?7G=tx_>NU`a-gHszsXm@)us#q|=t#=JQ*h zNji-GzGNOc-(>`xJNx_n|6q7!-+e{)^tAqbk23$f&PZi!{d&c1ye!nfr*pKj=AhC1 z5|c-$6$(2|qZdaXj1gXi8w1ZU1fW@`MH?!I-Uqcb8P@C~Hg}RL;{kp+)+%MAR58CH zCX(cNJ7O@8*W~GdS_|~=)X6dCf$C&Mjy;oSWV=|op)`M)bIGGuM)}P|>4qX^)z}j; z?QcI|LcS>U@%QBxXHzi+rajN?60L2oknre|=yn+$&|4<_q903(hdrU8hoAFv4r!!1 zUz2bni=GH)%>UO}k-IO$wE%bVbP35WYk5a}Mi*Su*$`}A8vw@rZhnXI?AmIUQM}fJ znt{ZCYvuvt2MsMe@;FBNf8T_$!IerZbTW`W1qC)4+aQ#6D0mwAD~X=v$nq&8l^W7#T=Cmt+#5@LgQKN%`35OK1*6XHAW;`b zK^;=9_lRxJt4s2H2U&l*;-TUD?+C}C%AzFlyvx&lYp4nGc23f-)-H$PA!T@vp|ia` zpJTX(S+`ymkzBABI(ayo9@L7LeB#Xv=fudSMYDb8>jB-&(H?n(AKCh(CA}5EdO%NQ zat-0Y$b!vft>U!Z+$W^H^u>;K6f`I*&eSQkP^;l0cb%XiDqk=b$3<5VT1uM@zx$q5 z8ssKANiHChm>viY8r&`ltuD|`zacTW)ZjGT$B6>>pZw0|lG# zD<`~WkbKP8QDAgKd6m*tETsHzo5=bG$URW=<&Z=_2K1|e5r`$ZZ*88EY%mF+wFMav zN_<+x%bb}@7(1}w@Z^!d@uC~zo7!l7Q^TJ}KO!}mNE@p}Nhbtn*sGs1CFJWB7sY9n znYP%1q|#&os%uM`-B>x~ZB!c>Y%I9Rc;v%s6crex)B>yLrt3~TEj!mbh$5Lfxvr9_ zVSFf*i}D^M5kV&ESG5;?JB<_=v{u9Yhq}UhcRjpOjuxm{r<+ywZRNag(?Y8_rmV0Y z>vY*${l9=7@(T2DFkim9{{?DMd(HmmC=q6k=jx%3eqc)A#J^q_i^9<#QWCN?gl)@M zDu8Et7M{GQ7AOouXG-As?#8-s@(Fgw&uC!nf=nL$MY_y)^GW$xquO`_9|L@{c2qKF zliZ|J1GWW62`o$OT-wfpfRlzI-G6}2%e+kL%5=+OU*HDpdT#_4Dgn^+hD|oThU3pW z;jcLLvvknbn)0W@kJ>#l1$8c(j!j573QKGuP3t$uhoW{)-YW4wN|14K)H6rH%EIB& z%CFYGg*X%9YPv4ZLEk6+_x2^6t+-GAHVS3-CQ)7K$SV*ObC50xx488@da=hf&&#SX z<64$CM$1ZMs&mnPN){NBgf$z}miFELc8%N~Fn^fZN1ty(8!SL+iI_s$!;wu%+RzN6 z$3w|a*|xF4+2*~i>nvtb2$N-d9eb=wuFy~01GjAa+?}58*5cpA(V9E4;2Uw!3b&-A zbsQdxPLk=wQMl@i!*#T1gQhC#iOSMykIm&1b!!>rI`tUg;lHw6M7m&b)M z_{P#(u?XrQv5}1eAw^I+`2Bx(M!)_l?EQV+&D+QE1Pka%qtIV{NusY%hrp)Q-k_nj zLO0`#a)%Y!xuCaGP&QAYl}A0Jety?XEW*~qG)fxX)ge~kcfXP6;Az?L&6eS93sdoU zw-cXwgBwATR+jMXk)v6^laf1@1Ur6B48Yq)iN)!7wh(aT9Uesl{zoyT5gswAQ) zh!qW>z$AIfoRduGZ(vclnAy5N1tLW(tn^2VRTG8~T?ZJxJoxO4;+;0_8Se4RypDrp z7gG-%Mv1UH3V3#UIx{QN?2`oQPU>ezd?!1-UAn6;XZ54Xq3`Xwyh zLCF{P@1kIo2~G`DgqF}MA!RjuMxkuGm7j~XtB!J&|3B<7;Eo$Ol<@&H4ro@7H68=bR?-FP5d!FNAuoSa=ji*?AJhs%u{Hh5969b#DC z)x@ZO)o-$K?G#*g2Axlfv3~5LnyRi^Bbau z6m5kH4(h$*GMi%>+QtI&ZUinkCe%q<^YL`brGL;*dxvbfuf@h`-{3GCMJQR%vdabf zSlGJHjuP&e4%>OK>Rh@^LfSmjg^1<;dkG2I0386s^Y45AR#t~SO>w*j80Q(_gev^L{@0Cas>X0kcU%~!P zRKWVM!;{Zo%`OHvUqAh#JvEyH)fp9HwotsEptHa#$fY%IC~&LBSIovm)Azxf39LUw z?W0E(x_^ze*j{@Oy_tX4xRZ(%^fuBz3e4i)K5H@vT%R#Xmz=GFFJ@49k)LQZp6w=t z5`qJ@Sd?S{kl-tSjaXxfSJh8W+gNxqn&Efdj~6g(;PD;M_8nM!K@whg*vBa__YaNl ziEa+GyS-i4{L<``FJJgD8duPZmwCldMf%Y-+gB6|_g%4M%(J8!zNXXDbH`<+^J7}u zeL$jl0`h{3I8xU{=o4eHQ~5(%<>;(Og%T`Z%ldw4l3(eA-yekxnD)5-ce>kY=e3h* zYE^eLV2?9WvGS;@eh!aXf7Z74>D{*D5lpphaPwZQpAvJgYSI6@;O{i>t|g+ zY=)Dp-hG#L>@|cHk+VH*u!~kL2aXtCN81ajCEW8C6C7~~Sal-p zizoyJ;fkkM>1Gj)h00P0;2pSB(U33bYF#gmV;_cN6ZPNt($CiujOlD%1q(kwkRMK}hPq%)*}$uTZ~{8? z*As@-sfT*)fO7R$(BrqizN#ifN{AkLN9!sF1SQg9*W8A<3|Nwzhd+k1Ik_t9=0E7w z7I6Y&fYt1~Vj4W;p*l4|koE0@?ud^pUwquETU!PSyjQ^14K9#hxWz^X1RFbmmUj*N zNpJ%N6_=d;zaiK){PPp(jWG!=yAVmST*H=cYG^O&Xrk6FAVoSE9B-5kS z@&aErp#@T(-n4*EOBfVcD8^~OPqfYdC4(uynb#_@$%8q(VBOK}*&|kWD zJg9>Nqq9<9*nL!C*J2VMt3oyV-3LM69c_Qh`*yt7gg{{t=YX)=i5{7U!#aLKK1uh* zS$-vYmEF3b(f7?hkxs5weS;P;~YJDkR31Zb6y+bm88voi%7&SBH&CZ|fe zRqJt5q0v+{|32ATUodI@-~4H!1}Bzfw~FN>?d%B$S3UC_wgLLJ63tN@@!`>J!^@-3 z3RDU>u1eY8*!n6(I{;A&I+x>ylNlI$%hQpA$up9#-jB|}ylWpt9{&DtB%w>OHlHik zDsFvS*Yvm2SIX9+o|lWoxXRn3$LR-omt)V^{ZD6q_uE3_yF!?kzr)h?ZFA>E`~S@p zEgs}&FReH|u--!b%eb9=tlo@mq~I84A}zBLw1#q`^y$_^)_U7Q8H>V3s2H2Pe5%U} zWrL1h$v93X&A8elm+g{~e`~Dor*r%;)~r;>aAMIfx^9(7a08n%oa*~_M3FL;)d!5M z>b#Y!?dpA?U)}#>>aC*U?4mB+KyXNK4ekUFPH=a3celdb3GSBQ4nc#v2G`)Og*%0N zzu)QZ|MV?4j8Rp4?X}mM^O+280`A%w3{6(0Y+`8J(P1MsHnkKJv-Cgen>q6tRY^#; z20zPS`e)P11HK2UJq^d%eqCPEc~zn~h9<D~gI7NYo%n2UD*2-8LR$69(jHfi zPXeZI1`9d6ma#@tg1o;4INsM14=rEoqsEeq=0W&K?%{D+o0yzCoIPOjgAGt2mPN zd*;g~gzIFX4^!T0fyS{TQX#%iA^Aa%W`SoWsa&-mE;hT14vPlNcDfUZp zK|i#P)~^W18P>otgIE5{Z}TZ6a_$cT-WvP|C0zIe+XZPlp3%~FLAKFtOV9=rGiu|< zV%o;@^-yef94XYkB0v+cu?&YTqpJE(>jG$(Y|=_`F^G6Zld)(5r32(aQ1@eku_LHYtzz35G$rLZ2J}g-FS6cqVI^I=akO|+c>!4 zh`fx#f4}eE|KgtW#4xmmVy~YU4=THMDbvaW$f2mo?djqS^izHSXd;su0_S12rSOX; zwK045i^vH0tec{vJVtsk5wgApb72qAs4KrvKcsk>2^XKHZ2w0^=V4}_r0f@?jobSM z8+#q+HkdamM*=~K$b0qW>#uoTsX0Sv;v4(_5GH3ev9pcN&srS&ENM=IodGzAw&1;Q z2lVFsemrr4$0K^*r*ssbE2Y>91G`Ofwu)9Q#o`tsG`^l)7?@ zbElBr*OYQ>_tx(jZXU}vQuL=p1otKFvEtbReoEQ~o@t!zTra@O4^C?5SRVM{ut}61 z9JbcgbYi3nRWzgjTh@xaubnT;mv-B42iOf@-)PbhGVSnvRlHpO&V3*vmWi?-jk zSS_kum+;ela>kXYXBPswiVx_hH=&ps!wVh&j>O1&tlO8rQCxMNdx-IzVClnqWxHes zd}YL$i{x2kc?xbePFL>`!s%Fj8UKngbS za7B*^cTWjTUlpv5S0T_JP=!bq`~Q9u$a^BAm1*o2yLX@6H2YgWXn$yI<+j#P(saJGHE~I* ztALGWaS+4r2s?KSZZFSXa*8!hd0{LHKRgkg@wav3yO{VK!Cnx9)zzv5()Pu6l|1i7N)essY}HOB@Oq+G zbJQ9t;L1&LJYK1IK{rS%M3~)8DYx2XX@+`o{BNS9D=AlHc)IP`KSVBUIi@qvk9=RKZ zb5lJ8cCE`NFH$gV$cF`+Z+fiuQ3nE17MPlg=VWb^cmP@8Tl;xPj5)(ls=k*Wuq-1p2wI z7~IjOnooDai!*}+Ck?+>!k_;MP()A0lInZ_Yn8@z<$|>=JIZ1<&W0$E6k>YI2))dY zB`Q5`LI&|)2VAJ)*zR7rI~bHc!^|(0yy3%3xujXHSzizh)i`2~3U}vdTB&Cr2JmC< zc<$lXI(9e*RIe^--q5^atx_Ycv7!#HX=5jg{$m^Ou2-6K)4Sa#YL5RjB^biKsaV)E z^VtBgB&RSQMfnJyfA*FE{N~N1;;=XIvm?>6wz3j>FU2jg?RsrH=f#-ld&N8(=XQpSJau~D-D4lv(CTd0B5qc(wL6UKx;|=W=oK*{*~$pmG~0U(Ka5Ea zl%b!cI=4$rzkB)$C;wZgNZf_pIU?-Y0EU2eoCJqu0pb#Eev70Nqx#(nh1h?UdtZDe z50B;-ZZRL!P9}@wLhp=8mX%g@VOJwKu0acro~dxSSE`TCAap(E%rSukaqY9 z7n&LGU1eANQdICpH2MZ1{>^sH+O!x(`NliUgmV0;77Ny*hW#p!1d(G-)sX!+1?GiC zz1|~k!OkbX>-+^e2(yKOw}H`(Ext4>MCdZIpCpj;x|+i7p6*ivz29NCKjhn;q2#Sf zS^=YYLV9I@wj}Hod%}mIhwI=M9fQO*v74!`Qw)Vp2s;MkbI@I}{f=8(?mo(yYhsit z;faaO^IavsmwEJ$|!i|Y2NPGq0)6oAZM6Zvm$W<``87E8ZC1uZ1qAX zWgh)I)EPr^9_C!(KK@-pF|vx z1}VryF~r(Uu;Su`;4X3Yb8u+zQ-oW6s|(xkx64c02->B7D`H2ieS0R|e2k!Fz;FWUvQ9A`Nntv#8zeZSt1TCHx7X7U zv(ER6VS}u!E3;S&erkyS_3ix?y7F|Si#qrdl$?lGR&v*rqnf7(?Uz`#^Rsw1gWH#G zIj5<_1On{%XjfHn?b~Y*@P900Ykp2OwMKLb z%0%T=OYm$6XOpu*mhkViJab##kVl22Z*JDT_V~lKALp?taEqnc3U28ALHQh|yq+D= zI3zzcJm&kY3OrXOkFD!6Z;L2roit!wE~8r8DC_4b3xYwfFQkOeMiDvT{?%w*cS%6v zJ$nn4{O*B;!s__!5|`b+hl>a}i{v70qSW%p3=cmiCUuNAI`b;(sy&!OI9=-B@8w5JH{SUF4749OGu{IM&0>J2x%8F9nEwYly~8dS-^-xqUE?o6*axuUZNwkH_u!B^SG^@@mXA6adyO5(iYFVbfeBHQ*$Bq#g8;owf_KG3ejW4g30! zExSupc!$VKnbnxp08};6;W2uBb^anI(fA|>%y>{}hw~?&tdDq+B>8}c zNpi4DLS1xaNZxr89hx9@N;a$xk=P;Y(b?2D(;E`+U1UQ7QFz|}x^75Z+blqyG5;HX zD=K0^_ys|?ZIGT)U~;5=OI&z*$dWLs_B-+p`8she3G=FmZ<+i(9XwZXz3&STs&5Q9 z7NO&LbfA?(AMekK_(b z&4V<&G0HVn)4QK#$*iz;=gAxQz=AodIfVJ6CiP`KZa}P2*E{CDpruZkj zibN^PQ{&~DX;>la{d;lI$~EtuA5UrM^c6rqSI%&nr(ha2bc~@o^Tz2kmwYQ`#^QBGtKtE^4d(c7 zx7GRnBU&$S|H1{-CZXSpC%Q=szG%FVd$jZS6xzn5aM7vOl?~i|FlZ&{H1q21`#L1c z`xSFK_);X85JC=`Sb?EywtU1|h(FAuk`VR0Gb; z^R5Eak15(vwHtu2^AB^JzA9Z*Cb?2!uV03n7G(PE2RF=3Ho95?e5fN+3zX?i(0$T%RH7(@$5!E`x1qirS^sFbpC&;HocI?m! zQw%*&jE9;*dZmYTPKP1Fd?W{-z(WDB_fz(r3zQo6p|U?Rgu%EZJ4^_N!hTj&g-3=PqJyqpC5;3 zdt;SPdcczrKj{~Pob#ef^v3ai4ru|&N5Bd5;1}(fflWHt*ZeZ5kD8pLoOBP{;F{gA z>^$>N^&z6z2PP`~d|INySu zW-;~a(0=~{i@qd8OY(J3!CHPYKud-lY(I)6KC~n&jxZFwPX(QsyP}`_u>u7{>aiwS zrj(loNUvg2$)OaLQ7MUDa%cI45BX$GSfkA!towcRKLEN*u zwwep^Dn>o`%!l}-4Ora>kUeN!B*Ms3(D27|`Bd@??O1;I*qc?7mWVAn&@c^fOIv@N zDx+XfRCicc<7v{3ZFs1fzBFa&F?TeDv2Hm+p9~&f(=KD>%VQu@tq=2+f8+^{P|13! z`9lCq_h`b)%(EZC;e9Trozo9!<>Za2?Zoi%>1aOpSZQK933I8K7cG;mMo%%eP0P#? zx_8@^)!yILw%)37R_FAtgLfJ(rEk2vxPZydDb#c-`p;WAFP*?2xNPCPqBt}@*5|a0 z`{j#d(U^e8*8(I$7aZ5|vm%=jfm0L>>I+F%e$<7DP*fD*z^LAhPWuj%74^g_4#n|e z3%RG+W|VLh`rC`wx*%{a%BoQZZu*7p{g@362Y(v6;`2^GHy(&%=@dq%Y?;>m6y5lW z4VyHJ;Kn=`xPjN+)Pz72fudrGUy;*jQx%Ikk^Ds%tLqL?p7oF~ZBci`3Ux3Ya*dR@ zx#<0U^qPFFqXU+nysq|4RfEZ-OTw5pC)!~G7dAJ2Cy@!-z{@}th3WZMkDub0gy*!J z{qu3t;FFK`B?;A@dVUjLVv^X8j%m;KvY#}$%>uhr4m@%I1TWQ2FuE+JR@Ho->0_qH zoE;gh{)V}(xk1(6m9(R2s?pqlmc1jcTKT3N%!b`$8gu$Fyi##t#Ky#8#6l^`h%JCQ z`PTJ;U!*P66&c?l_?$IY?OyD~a+&h|`#Fj8;&;UuRpyv@`y@xwj5S*zc->v#t0Gi# z72GL_+&aU-+O3Xh0Y4_VpS4n6fMkFRN{Wo-({VI~h2*TiWo=-@kG1wg;m^vA#~SDV zDUI7t#i@n0v+RgUO`u$>#;tBl=08e&25oTqZ;*0*`RRF?87DIvF}NZ)-ng}aphKw0 z%}k#nMXqMxh^||B5X-9AQW8V_;$JI?W~f$*-o@jN9+kXy8Hk%wKuW;qlpg<@vkkeyuBK#xTo4HU+r<0$3e z8N3i41(Ic*q-#srpfx#-?OEHD>?8>=ob!!6p@Z^wSp$7zeZNFLDmCLcUZjzd z*RRtCHy^(T9H<@LRpIv`qlSs1+8fyMu`Aa#aF;ayJk0o_U6#bUyL=nk$Q;}eLmOYc z4I3jgGA0#F_SnySsjNIVHakR2M{+z03RRweme@9xyGe>-Rzhs9>q0DSBF*+_-6<}I zwQa=_-YyvRN0=@~64yVA6>`EE;Ps~~HSm9t4y1yULoRX7@?%^>u=-fzdz?|uq#Ve|CrD~n{O3Z)4)-Cjl}?yE1k z;JLW|Eg=a%{K7^6?kAG^lTArmro%3N&vWZoR=SS4J*7iw)nsD600ODCvyFa@$MXL`a%)0)MoBxfmIdne^Y1>X+63CtP-hpKQyx) z*CH@I1Dn;2K>Xs7pEn(vI;$FmgFuKq_RBoo9u3jye;U%EHD z8<~thkR!FH=oR7DE^&~ztGD@f(U5YEg*A+o^&Uy;a#TyHE$wO8YVz6TOE~Us6s&E! z=dB)i3;fE3Cn~vQWzAoyf4vh5i-j1*AX5!Bm?VlaU{R;S;_}a9k|+|hqlwa1%S9#A zNzlq+>U5M1KMoa`nk@Q|2?d>ncQv5XgV&$P5rxOEEBg*3&h~K(SC86T#9%@n#!Zgt&nN*!A=#3f>P3Hr`V(qttfoS&^>5HlgWim^-fp2>3cqdv@dka|IIX?fW`z0!& zf*2?F5|z&BZeDAnKY-IX^-t(mQg|yFWljzb4nK})5AvOb%_y!`^Mj>a3a47o(ew&a z`4`}`#Emi83Q~3sOgo?%#ZIaiYHQ}Fo*qExc^9|FjuVh!ytYJCKg*y1rl*6)Ln6Y| zUsjCpDcQAcil73AUC^PnoI(GWoc-1$Pk$#@*9K!Uy};(Quw;PzB93u2&NgMY#~)Tf z9Hmh!?!;Jam}73QYi?R8t-F(j;F36$HoOocn1>J00*%>O+&ifi=~Li%h+s$47pIfP zz;fO}3ohzbir>%IZyGKH>5lh!ir9nL+7n@^e*ayfZ%ac=CJw-9 z;CPJctF&A(845uaSi<^rpA<$4ovdGjCIf8X0YIzI-iB*Tmr)^YKKn1YwU)hDQ~#(E z0eTlUNemcEdg^AVzoI}i)2GV)@}a!%4nKa!Dnz@jJaMi&U9URf(@dvB0>wZ|M$gvO z&;PB+vhiq94JLufm0&}8LKe1i9)E1$STsJFQB}-S`SYYlm&-*#gslj{LD{C46tl!7 zlhPA^nAok3RRF&X$U}z92_rog=XYr@7c(iKVj|TCXOCO*S8i&+|hIyKlPiU_4~O zHB22oN@s3VULje{HnLW9wH?AbaTrRv=#yYOq%}(KMVc>r1PtmnG<+r5@F=Bw*3KCy z^{PG$vEA8+*2bQ`29|thr2~iev!Ur~kBxYR8^LLW#gW$uB6zI*yMHyrN~nwJesrgp zY7>CP>iM>>26DZE-DHzdYoJt$ur6T6kLLo$WGAjj$NjA-YPf|Z9b{BJx|3(v^Qi8x z^h-_t3RLPmu1yT@Ha6w;%E!SuDWfZ=F3NBXK<|w-h-;S>$;r=rD;AS}c0J*K{8=(0 z=btPXmr0y$6E)js|Ho$R3-0Fb6o&;rPTQVr718QXIE7XkfHbC2>fTYZ-lL%M9#=l& zY8ETsR>*5*y#Czh(E%nhe8)Dt!cK4RcxFU`jklQ|kJcKa3a&|fDj*#=V^B)q3eZ8j ztzdDIg&{n0KgN7w#`2^raDb8$Rt zCsCf|a%|i{Jzq4~$H3m5?LcS;X5RVfyt(VPN>I~d^BPbDUa`J=pGBW|iqsm$rIw!j z5&2S2tU=QRSP{#|eb?)3WMDL?wX?UN0;N7Fe3;Y>v%bq`rd3K1vm(>0ItYcpya%F} z82e@L6FnaIZ5-HRFPh1I#%_*NZBM6D08k6FWF2H?y)|1R;i0e;Ud!`A`}`We*A*X3&eRy4t7#7UHyXr) zF%XHV?uF4VRXfnL;;){y#0h(pEO3;p!>7s-x z!~A>XW~l2NsH(+)dQ5gq?fR-xW_Do#q*AFVi(HYD!q9M%)Plug;7fWZUZ?qgy;p2X}AbiyFqWe?2geF$t;^xN$qlO%TSTbY3)i zPOVBL8%{<>L)_P2MD1DsX(P=8d*APDOHQ+FI+B2|H?Lm2gZhxv){9y$nF_QW(T|Bc zVUP;Qt^hF+=zFh8R>X*79q$RZG&+lO#In|{P$5P5&FS0og(HB4QrkObT-08YiGDw* z`N_Zp4$;n}j&`v*=%>%ij96c(HK3>%`!Hi}#>k`Q{)z4FVV7=rpd?%wPDo6WxBG)b z1nBFedQD51(}Bt8EEzB4S}UuFh0!Ex|FGRdWuyer1O!QC92);p?~7w@U9OQ+f)6O- zt4Q_qL>C6ve`6s<1^qBs3ysS%NfLi?a!} zZ0uOib`PQ3AIDh(Z~dl_EULXhRNMRTBhW3*^P;xqwghJk$)wp~3(?WUX{B2M%S%EX z^U`V51fOJ_VT&@zOT8!mqeo_X&Hj|qfsc$Ml*J55ndG86Zqj|Z(|~*3#$A9ZKvDeP z>~f4qMYG|vQ{a-QXN;W{*f+Hn@exp61^sm-1oV$%hj zz!-0b?NzwvbvZYM)zfoVoiXcTVtZSQULst+Dlpb;{Q%4n^iYwP!eGhb$Ag%geEZlR z9ju2}mIo`3<$U@)yu43+xi2HRFKz#iv75R)=_+~?!ng?`DTlt*ZP}O?jg883lX$EE z3`vK>Wa6gsDu=_`Fq)JYdX|fv_xvbGyAw|(iUN9WO5SuY5m(z$L`Al^z;u8E*8H=WwS;Wpsy-60n+vf*;@mQ#hnjl`6m}H>S z&uqVew``+Ig|2H9s;U+yp#PClM!afPgr*BZj3Y@5M~Dj9HE?YhVM z?-bL@+f@W}?!qUWqh0Kc^70H=Z=2Af^0e+XA}avoFp6%~74>4otf5%DM6wdr+9Po) z<2-gLHalD+FA*#(Izz9fC91_qRz&pk~>{H z@2?~T99S{m)=jDV&37liU)T|iY}FaHkq<=nMo2gYoblEk|3WtUA4#+IpUV`U7wl$# z)p*D9I);G$Q&GW<7?{dE!1^+6QV$-0Z6z2)xC?>IEhvS__H0h&h7&?RuH*FGLIj_L zQr*^@h(msisWZ6Nj z?H9mT81Pt-{)%}vsP;+@K9BH9!ifAaB_M|L|C@{SJn=nD&CLJoVw*0RzD@&(#bXH9 zhMK3ww$6}F*}T+0i126k=q*lEfaMrNSwK%zKq0xnx!kU0Ab#$x^8r_dtCT@Jtg^V+ zZm^nBbTIhWYG2?JM^Iz?5g8K^;QmTmC2}9 zSgN;h0xrUUT4As9>=t7s?e!Y1*LXWwVo6#>w*=zlExtA&+3MtNz5ChYeRcCmH{j&| z#rwRB*1U|izxN70zzZ6tW^Pia{T?k`tk7#4xKxT`RIrbodGhESZL}w0F1G=-8Q68I zL_6}{SyyyNg8I}IVbJ>}jtFH^>N!U;-fb0wv8z%9SU zl7I6~T-G2Ja7`X!vz}BL(ew{9#ur_yE;q`2`tN6J7`Y5xj$?;C^RT2To<*|LN5i_i zo|UFIM4-Ui*f^Rf;B!FS(7%JHg9!-Dija07 zE7Mr^h@No;n$oK8%}WI=(!d6HGJgd-Kr(FAPQOAIP;P~>={d$*hDe%VVwrb;7JAA0W9!p z7f!eMWEjIlrM&%ej`L~le2poT-YO^0>Jazi1GUjfr3CxqY7Du)(H*2)YL_&H9-eRS zWv6)(vl{Cl<6w1^Ih5Y?A6Zr;VV`r(`nrS$g)(%LUw3sf&5u9gPT0?LcjDr4C1W_z zm@yI)!Ab&-yW#mEN5(O+x9+%#YGub}`<()P|Bv;(^m_O${Z*iu)yt zll3{twP|v1%#8o@vm5&{vM+zhj?3>Q)+oqV^Z_IjTCoOrnui+_MA^OOBmODnBzQEd zSD!!94UY8b`J&7~tG_uM5H1ETXrAR5kK%?PuqrgoDNT*>OyYSTkb?Fr=`Md^A5rGjEI?!{2J;uyz`tgVzCS z;Uy)y^RlRq`w6$aO5UjSB|bom@znjkpV`oC)W&1=4{|4)>!9>#w{_Sf9?7wooFkg>b(m zqVs>tNq;Q#-w%+B`3lWUySNHsVpUJ^`C0iK07kQ%wqX4{NbreHN7nGYZAPq1nUe`{ z!O2zK=3DGKDU7a!qK7a#w@wBbJ^buchT-BLdH2iKnFO0#r>ew#Xlx6Um zM0Fg}Jx5E<8S*mC;_b}Ujnss-R|wY16-k({BxS;)O)2_=bZN$_&>3XKhtnrwUA|)F z5ikqg(z0J0m;CGPf&Z7pDkL?N*gp;E`RGPq$5XX3BJ53!T40^b?K8&Z9i3Sf2<)m1 z{5dQNeY5nxWRLvM5tPdMsM-i|4S}ijek*D{7MGQit-zzn;|@qWsAWkr+0Z`I*~u~h z!Vwy~cVg(&jaTwIB8w&%6m??=h7WZ_q~K7;9KU@Ip?&9~h&qBh11^h0G+KF!gkQdP zm(lA>W@U%c1PLpP6wM5#Mor9C2-B zHL@+Ibe6dDFhR+!WzNczVqf~Vlx8kTP05NzmE?$`z~r0kelV(H z;%iCO7bo_Hl~90sSn`EoV9i*zcQW?-Qw%mew3}5U3MbLl{*A%ygyregB)`ph`EBz( z?}6*RXYq=9g~sc628T!0)dC)vNM+#?PyT!AzGtS^G~G z-mX{t3pFQilc&;L2+K0(oQXLsF^yk1TPPpR@^kQvtH^7~^b~CFA1{Q(FH)ao;AxaX zoYP)JTT)m{2<87U+BsejmgXQl@S^{AIf^pY63=#JlG-Rav{tEB9d}%rnaqD@fRl|= zRXW4NxeFtc#s0Ta6Urr+R(0UX<*-J&7->JEZK6q>++Y%L?~3emP0q&B5nHLRv2=qsHV&NuK~#(UxsmDovwJr zVQqk~uj{U{2LBhCYg}q7LlsCvYFejNfiII(5d&lzaBA!K_CuMaGl3_A~OL;s(ldI=- zYqaKyQ>Tf4jHDq$BP&03!n4fU@xkG`z{?;R2{hpTMYjZjsR;4DFqsA}0{3vg6k&FbkSuu60M(NDRnF$EwliSl1uaQo=C#KBe zwPJNu$Ynk6MhxHO)&}!6OBWm@U8z5=P_1Fl%w!L{$i%*Kp4Aqki0M-V3#&AAWJkP-rK==1UWUXH3)q z*Y7yYJAYbX7!nqTt;tji#lIA!%A=qRo@zfF>nM)wf;SOLb-(Iaj5{g?MgnHy4vgZ| z@Pki5x2eBgs9iqw5j=mKrOSaSIm@8rK}l)#uuE)4T#)G~TB0{bMEAdTqR3brvE^Ql z{lO=FDB`?Zc1(t%e2^w5*_C7?qdvnf{YP{(5ek@r%d4YmOkIfxXqbF_AbTHre<0C4 z)IkA00b--T*N6Cb&qpBT{E@P5%GfCInlrAp=Y6mClS2ntjo+E=1RG=$&g|!{r)h8UWDL?X-(s1!=q4LW?AgJ%hw~j zw^5>;sBQIexL*7iITZ0Z0|;Sl`?-l_@3MS?SsHxI-5M)c`wlAK>Pesu7J(k1*aaPD zvqyO*2kJ{El#D3YYYgh!)SLr~7;<=8M^zGC+8R|*F*4Jz=#5EEavU!6f(WERVbrbC z2Ox@~vMPJ#sBuft+R9z;?uyyhXYLc{7C7<8|DEG>2dl%#Z3Fcr)~y@+Q6+Rgakjq+ zLF`|?nx;mhIgR4swxNr(bH&`a8hq6bO|lr{hY-1|hsae_5kCw>e+I$Z--@ZaVgJpl zIjKIwi$&^<9M*!b!v${g?_$ga(l4{6D0BQ;ysr1R_CR)!!!iqI)9yCL?~xypo23u!c>+MACAi|`Xc3pK_VhDY@nLlaN{hCei5Xzd z?imj|zb&LQKB}Ur;S+Wmtm(zffmRA^>TG;XBd&s`fo>L39lLOQ;q z1pkOFt($||xvIH?E%)D6zq@ZZpYiVBzE0-rwfV)Pzcb%0*K~8WH{B<&dd`FI>Jr*k z)#JmtKetH4O}H7rX)b%bvfcc9AM%T}1Pk#3UL)d2r)siUt_w;v&;fhwA@wZdOXAh_|GsB>lc;HWOvd7yNGn-4D2&i0}WU)*!E9L>=Qtnxayuwn0__Fy&P(P zHuriAHB#W1HVE@Pk?nI7Anm*=`>tp=^_th&zM=URzZA~O);uNPe80;v5q3E6F8uT| zoBMXN!)k>(bo3na`p|90Fh$fIKzys^J$O1(LS;vQYcrNb1Ap^=5ff6(d5q6}AHbrS zVPySc$2*C!BP*RFj9-#2#n-+ahmw*lIhQS-hZag|_}gEy2+M#1d6Awt;|CTGF)g1$ zd8Qf>MukkCf__v-cHv5I$Z_5%^&l9AS;?=xQQu4NjPe17VJ{a?b^4Xt=R%1F3wWd*4rVk6*9b~a~iP1h^U$_X2*v~p9BAjSF zZ)ge>rZq|5o@-z)6IeEEd8by?|B%Bz&9JScAB;vL5{%7+P9msUr+pFX9fbDB_=SKJ_CA!4wO5{MWor@cpKEQ2sPr9?WJi zyVjY_HtaJqcL5)iOA!mfLG*-ob>v3fwDqkc~k~S?|dtuj-iVi$}$}t z`+ag?a3$DyWR7@X+5Uhsk2l@OcF>a95ujHga((mO@0hW0!X1-pe;m@l;~m2cev}8A zKf>Yt8($wWayz$1bw$K(ddu6)aaPj&`oQVyECn(-TDhU%#te9x5IzO>&%?>9D?S+L-sRxAzWNAu({`mXw;tp{M;)a-2R@-3ns`^+K3Amq%!<9au>?oV z(1@i>?tx@jM96}cAFfMQn^=`{Sf%SQ2JZ}*K-MUOb!cQCXjry$)GS85A)LY)EOu9S z5kl4hODvT-X5}!cLPf*;YBlJTHoUFKF0d{`s^ZYuY<9DM<10DFBbkYe7ChR95JmG* z9sgeT3MC2maiT0)@m-n{$BLo6NNK!10?#8(4Of)?6+>g^PGxpWCF40UiW1GR3^pVD z@BAQ)0`GJb9^<&Of4F$H(^BTS_Wi#F7nsaS0(7VNk7Bcz4)8|#6N~hp(Mrp#aN?_! zMu=biEWdO(p*J8>==ilqPjkcHZtEFdXNwG{v}5r{Hn0-R#e{bWwhr7FB=@fH~|y>2wCZ~dGe6VK#Ar^#WKeTScp#=CeV1eC~g zT4ZCqaR%;;MBx`cGyV0zmVu8eFm??2#U@-r86k9BOyQD~uH5E~LxIt)c%`K@Wrxmk zW*hUnwl!mAh5H|yg3m#G_`79JGn9R1&#i3+7cVTCYkzMCX;Fr}6REde@@c&pv3l(j z9Y~SpvEz+WRE+pa4Lu^!U7Kd%N{4`6?m!bP?r7|$(@ZMAq4R-FO+{1aS??3+*r#Bj zqfcc(HVskqkhBb80=0u!<+hrm%6F2OMFl0EoJEidKTSIfwF&?FEW27AyU0(Y)fblE z&dyYdCFS9=$-==ybndVpf$}W}jq&M~*OLa((u3Sg=;knXZKEd!?$h9c-nj@L+@Scw z!7@Jo^pWjo|5}NE_P?P=SC^@W-r~8QjFDai>2tYFh@VV zP_DXM{P0d)dX%CU10p&&;O>%oH+=dzV->@`Pp<1O+!A+2$Q%EVeV%UO3DIMw6e1jJ z$5@xYzf~C4-wycG?Xbs#B%7buOyFW4tL1(54ZgaTMqY;`x5^u;@rc`H%4Ff*j4kdW zLSQcaHHjVI4iFh7YYqi1cVdJ)k!3A2uO4CUU+ARW@F zkub6q51H6$-oD#{s?e$~L?%fG&hF#pud(6g!zzjyZR9P=y2d*#2(5BwD-DUR1bz2k z&hA7blb2SO)K`d1?TpbPtZeXDscYTGcV9ZP`>8aujK88F-!0>&QW2{ZA!-(E60Vjc z(MJEKRGSJTACyYd6Pd=kC6zb8{}se;6Ug`W0B!=6iu8YAyDy=c$Hyu;a4T7P`mT&u z5H6zTZ4_|}iv@P3q>*(reKsXbx}FVR82HDBLV!QsF*4u!bS?JRvV=G=$d9Wt|Dpyo z+h~X6lKC-|&YPYzOIAYv6nVo4Jkpx_!>Z#Pua6_#ip3?DX;pzP)|mb4DWgAb`txPA z{)HrEO+&!q>yy8>2>Wm=4yhY=(7$P_zgpa8xu&K^Z9enuew4MQ0U*aT=Q1W_x|1up ztpJN=U{^gKRX*jbrB?^oRFt8I}?Eop($iS4iUx$4xkHW;L*C9e-5s$z6J^Mej| zf*J4_6-xe?*R-F}kNXDeq-0X@+ogEgIp^Jx#tybkbw%zzQz=YD7rKm8VBzPiS&TZW zWV$A9;8&459p*&}!9x^DD#RnFgs6|Pxg-ciAoc_>zcx;4c?ux2zqE@-Zu^|{jfyL*m$eFV-nfjulrBK zeWrA(B(}RXfk~x31F6F&cciH#>SKi`#5b3@~h!SYIsmkA9Y- zHC+`L61#blTx$Up5=IF$#9jqTA)D^hi6y?{LbkYxU+*vluQ2yQNM7>RyZsCxcHZtc z%<-J->Go4Q`Z@FbR{)h_ictt7!qen`G4&RHO}Fp+uplTQFiMn?9GwyyB`H0+JCyDo zf=Ul0M+sv{htl0G4bmw&x*J5~+5P$5x8LV4;5FXYbzbLroJS;>8-SxC*O=SpivLt* zia;)D2tWRk-oqlUzP22c>4$YDlq^7k>nUkjru_>u?Qn78&`qb5PdnXduBNzY`jn;{ ziVnt)lH_R+HyqCG%Mge*ahm0OUC(t9yO|X;af6Y6VPsQ5;T9>&hJ2ErPhIf(WJIW% zx?tsv{feayMk=~NF=UuE{z){;N~4@g3x?3LfHkH$2FurHs2m&5G$*@Ec82`VsaY1L z-+!Z$nv}BS&)`USV$qcJh{o~7O^=Cl=SzaR#t2Jle2s0X*V1GO09l6Q({xFJ1Rq?l z`6TN@QlY6qh0%UXdDm#=2DN|iycm0dt5w*7edqaId2Fwu^z($;nA-u-`pMBdKX1Xs zs}_mXAAe#FLU^y-uSg6!$_rln+MBN>%3XorL^VCBuLUzpe8-Y?E2{1gTKT+s&m5`u z;5(VDZDz`gIy|@LBX={cC+KMxVwt#K_rUKIn)9?Y{GiyAlqX2}PixDzJfLK#`B+{t zR&iNTM~!_-awAMk?z=l8h||yE#R%b)3&RC)(x!&DB^AloCzQb1kk}YpXSddocJS&Hd31d5~L=*+iiV#gW$i`vN6Zp*5P#N_lSV(ZE`Ks|xwPCC8) z&s+PYzh95q;6sDm^?LGUqRd|#oEE0dYzg+N`*Iw2;3??JqljRDUX&Mo#LA(SB{LXFstp?#z%2-`^hl;a%6u$qVlSX|J?xqF>CLgNg|OFFv1{_Q^=IYG71Rlr}tB z^H}G%&S&xUh!~aI^kKk22X6O1wD8J>`O+KvxqXMM%}qBjK8PhmP zAr~FW>%u0}F=urd7;rKh!WcOyl;|N{W83t?xVN7VQAV4RTW3=<&1i?`GPmHJK>sZR z6aqmYBr}c%gW*8(g|)YHeHx2zLaH`8o>zZ#6=&+d(O~H9e~$>8g)xm2zwiGNB!<>^ zIi!%BM6g|8wJ5_}7K^su|EB-kG%3{hgx5JYAxxN!vW8!iyfVClZe1#j$>~tW{+iRu zIz4`Ji_8)KV1c~)IZ=Xk70PZd?@~isDvD(F-S>7eStmy$BgSpGDs3gw_Avd5c}3?l ze!3BKZwa1j`o;}6;I`HzQ?e~$_Th-vXWk-TGb=uW=smC%=4Zp7vwE9icz&GZi$CT2-omd6-a9+~dNHdT>yYxp63MKQErD)&>Hr7Faq9xUfpEW! zYJx22Y*mr~{k!}h;&Y`1Ns^ykWtr80h)plVd{J?R6YTe)R~obKi9vB^-Jx3osjOLD z05i!)r!BUZ6fs|^Sss8b4e*w6reSfi6^*U2VusF@r3lhOxqYWupU~Vi%20?1%PU%0 z1{I|^up@DfES8dmzY3q;L(Gi~+YFWz#?XZw^% zTOoCd7)3w~MVuL?=4_w$opgP-U2+LGc$EaE@ zuC&zU>Yda8)gsyeiJnrwmrdrSeO%vP9UN7hBXH%X({3a? zWFA(X?Ri)|dOw4z14U|dF*FacwLW+$7qh6T zMyEVmjO!nRM; zl{G*yH2C92=`b)wzPXU(@OnQBx^Ck0vuA6T=I`aB8O;?sMfZ^G7Q%Hjoe;_Z& z8pqtcuWuVyLqLUL?((Qa)zI4DjG0IXHc?pM z6qydLht%PAqPJxYwv6e~+~89jus-U;SgTY_GuXLVMN{k7;VmoYtz)9nb^Y+Vr$XTp zfbboCU6Blvj8nS$13f=TEloCH(ycheZo@r9xtC^RbK=Ux%c`G_u-N$9THT3A{Y}Vz zR<7PiH~l9u;)$ZmnYt2f4WPw{@n=td6znp~>P6H_qmlNEQ!y}aan1`th;3nBk=>G5 z=!-u@)bvF331E6O6nT-!r^)9_en}=XoLJ43_29YK9o1qg5qWebSSI)Y=Qf@g;*Sg0 zQUGi#k~%Hb#qE`@%=@)(zdLs^vx&N7>s53~wzD#W+ou4kXsJ1#?&T8gJdP<7lKf!# zhhV|&(0AE$G&Ik$F@2s`X89RKF}~bw;(L<1ov~Q815(AZCky&fk^aiJg00mm?+3r; z-qpV?S+D2o#gRz~u!^plz0|)7caTJVaPl&15Q=W`jo$4=hXwj@p5Kk0kj3-~Qak(} zm12?%C^=bzCj^x8ZDJ^{Ap$2om=h9BIwa1cn=|e_9`2JU^|{UJjq;h;G-sx33*SmN z^!9n7Ul1R$K2rNtd(Irjc8_js242INfhnKx4|5|^n=~-~l?HnMWpRjH7L+9HN5g)s z1J-pTZUyXEjD@3>>J;&syiE?PbbfV@V2s@AxP8GdXsdsO1?(Q5#oZHOa{`D+ps^`- z&?^<{EeeUji5~lG#E`5Oz(OgeQl_T;@*@t5<{rNcC{aLHRF7t<_9UH8H@iCFoc>T6 zi?Z1%CrWnK#=6f<@R#3fig3D7yJKGQg;GMgdH2pgPq-7dw_TWqi*B?({}R;W;Olus z5oVt0KwEnCO?GG)#_n_5Tr@?ckJjslfA|O{!hU2a(3i5*{JKlwmJ1`86AH0j93gki zz=t*2ORDoGGw>02kk($jT%b*ukj|9P;k%S!a(VWFFBZ5|M_X-GTDT>29`Y2s=8r$l zVm?EA+=Z>eW%dK*2(Zn3nQ)NLTxo7h#-coQ6kX-OuQ!NvjRMY8R}XG~1#k#GP_DY%+Zk zta6loV#pt?Iml)lbqXogpA67~^dmyXT1K)2;2k&h&(j z5nw@^vz7%dw-tkIsQ7h>(2kNmBy=HlR!Kmm?$UKJ<~J9PJ+^xIu!eBn=1qht)+2lu z0pU=K{vU=)ZDNTX zo~JJEc4{rMenC#lz!>tD#Y7`X;g(4+xICKE|=cgp@$iyw} zpe||l?;uiFl5$9p4Xb9;-QtQNCiApAX5p^g=ft#$39SV}D%w+Rr`!C(@aQ9*-<}O90GhmNXP}GhJn(7p_d2Expi*xC47@Yz zgn>2g-rX{n88ohRFwPUcIMZ<7WK!lp(OvQ7a+#3mduxDSpIhAqot*lR{>q!sX33Me zior9U>8v0!*!8|Y0>>}tsCr8m?L;f_XW{*=3(-BA@<;T_02j}KqktCo!m~z;%cX6; zC}g{YSm-O^hl07sWttf(IG9FtmIqk@IfLFyOSZucIR-FPzs{>q5(7apmLW-eQvfZb&SdILaj)V-0?gkxpH$CI7892c-qnLJ35x}c10>@a1q^hO$$((VfJO7#jzOMc;qVx(p5p)KhRDLD5J6Slwc(`YlAea= z0*V|M5+~@i3kyU%&5>59A)b2X8EWr)9Msb*3z~)0u*zgm-9nbKJ=aRmHGce(zzYE# z7XUNA-&PPIA1C8@!tq*Di3Wodvq$y9(!i>u5!Ru=8pH$+oaR@z7K z1~C&27aSK0DytUs3fB;<`|xS9|)o4X8+>>lLA>XSRl@cP$Gn?z$!L;%n@Ru)`@qsgR_l>F03 zF#Asjp0v0+chN$+&9?;L!pH`?H2%vF&&g{2W+PNzTs4=MIE;~|cf9ugxG{fN=ylAZ zIE3Np*IfnMJSg?smreDC8n7369oIHS@&qi?7jmvY*C*XGW|x!+YAzLH#5Ny>ySDS? z-akQ-OwPpBI0VOj$)<=E*Ms!$)tDa34qNc7O){%SGuviXadwhf-eli8s+&$wH+vWs zbcZswvRHssk&R*WH0~Qm`v8TGUmmH)NPTmqcB@KT_XWUGpfWScrgE z<%~tG##sF1m5B)py{MX1ju9)bK+=&1#JGhaXC_5@Qx+r!Tu$GJmfC}{39d{>jxiA} zF#vL#TGE*>+7hnJVd;(wzFYyBWPhJK1j{2SGd z8}q&L5^{;HXVUbG6>3E=Vyjc3ETk$|f&IN1AaI+z$_-N?K0*Wa;_wY+@TBiKkZVK4 zF4LkOEl&x~v_0Q2g*VSYVkxF6jgnzMQ2zZ1@+5Mc)}N)w!f@DWy{S`PWg;Ge<#4p< zR8Q*nl+r$((BaWPQpGUd1yww;kTy_T0`joFEmeKQZvNni!Rdbi-!_EV13%wrKPuY= zp-&ny;4H9QG4t}>?=k$9?@rUG{U$987OARH6Q)kGe7>uPews7|ie!cb-)zp7XqP8# z9c>PxW?(j!lj5#6%I`B|)W`R_E=JhrkXz>-~ws8xz6c`1!YWFUVd`Q?y1mKo~T$ za7z7<>MiD_2gWoxQpkLgc_y$sPo&`7AJMim(Z?x_E;MVJs9Kd&+7Nl{hJS`!smOOE z#s3iHW~Y_EBI8c*bOt57^zlDqG+7k5q7=xguJc9EK?GB zEJAE%cy+V-kJ$dzozMN@vg-d83)@1W^RD;zNB4JX(-c=^?Q*L(Z)=oioU1aWQ~R8x zV~nlYP(meTW^I9yOyGqkGQUB82JKisX0>5Pax8|B+JI}$rp07pPdF$fa>ZK^@w)Dw zrI+=M=Dzon3yX!DM)ek4+}(PmOm3#}K1ZvV33_)FX_*q($4QQ1ytc%eO(|i)I2Sf* zf-Vjto@q?DbB|)-YTkj;7Yud@_ThL=tK5kK4a&@~#|1D{DAm!NmbC;_Z3a+ zfqB;xu~-V`6X)Y=m7UdKoq>4tLi>MJJ%+#zP_Du?_Qyf`@EDZzvNQK$)5~%d#)3>e z#=HVWd-U?yWCO-7V>K+3`6m<;h)RQ;)&L|C$CMDb_nLqPmZ4jW{n&-zhX6>B%a`gjY_HEScou`$1eTh@{A_3#(5Ou9+)HO@EaR*~K6%DGmA&XqE%ns+Ayi;J~p959LR z2onhsdU3U>mSVbI%<#lzUnbnSe0WjF{mmnC8px&a43mEncecjKK&?~@XLN$%4JmpY zf)^Bd9+qwU@u>r5WGUdSR0)_ zT85+fWhS4jM3ZN{D&Me~$R&!r;i zM7Yr_55D+itijhBJP|6Xzd@1Ez!HV{GWLFvqF_9swqk2s444khHx7y<-!u7Fzs7u8 z(18#EdjIzVV|CL9qQy=pS_K6K_cR(2>B24&!-Mba`E^8-01|Net&KM21mSp`*ivb_ zAY+z_C;jn8eWn>4F80#i#``7LmBTF$4zaUvB)j!J13ed>*+{Opi>obvhH`ik(M2&L3VikzLr4Oo5%GBX2QGRNk6Yb)!6Wb3U2R6R)E zQZZu#ZdId;u>E_jIL*Cv$E{JX*%)VYQR{l?N#kHSHlT0JfZr~z-|wL?r8G)69Cy^y z3_%a21&Uh{K)(K~8hY7KlOHmv2EyN6#fgD9X?Uxz%Shv9*cv~fudwWZNB#agya_D> zW)^)aMbg%-)wDHi3Ov8gpHEveS>FSepI!Crk;TI5VBnK@dQ*2# zo(XFs=?g%ZYpj;m$d3v(6t-PLF>QOW_RmkrOpooxYf|XKKJtcezzgxtR|0}i z-PJxe#I>$PM9w6y%jW7kR@Pe09o&V*5D7e1NLkR%4yud!DpsKHUyF77>YdNhEZwJy zkboZg?{Q*NokzQkIxN&#RKg+_lU|%u^#4m4t!jyou=?bu-gUoUs=a9HJLv8E2{$GmG{8B zEj7FgzwUm{h?ESOv65Dem9FYhgwNIR_;%o{JR9EXQ9k>mf&V~55dBk6XH>vmMvn0^rDCEz(JgIi~M$Viaj%FrrP?`U@xvG(Qn zGw#K2#XhbvTEffTi`$V@-6Sp72i7uuaA{OfdMTf63a2A23&5panri-v*UEaJ4NYiQ zZM~XRHQL;iM)X-_hiTDB0$+~U#Iw4mnjd+cbWbU9wy}}5Z!`&`-`f{=MMG}?1?y0g zqCj`S?~jQjG$`(mH;2;;P~fQzuNq}12$B@rmBYdiUMU@;WfB`P&*srhZ)`GpiUh#u zF!67nb;>0^?S=)&*kvjzLFVG>v=1&fwQ)v>ZcUef^JMPnl<#paOyy4^VkC$2NCbPo zs|0G1Htl6d>*+oa#*s8nw;k9x{h}Bj(eVtWZ1Ml(E3MA|p7SbLNxuZBnLn}ofA-jAm7(}(yo#&Up z{Qrii?$-7>ZCp6l8ABV0jb2vGOTOPt)0#p<+l!<^UuT>tA;&O3NBRQg<{te4DIg~x zv0}<%6iy8mYEm0c?xklCeZg06dmqkFAEw{gH+BBKozK%becg+FLrh6cFiqMPnY~$k z5AnWT%7W%4>PHI?B#a^x)x~W>xO$6J=CVyv#ngt#Ckm}x$i?1U z%@K)S$j6i`+I$t_RM26=9xp=XMuOl)|v+m`5qr%EG39Yo!bm5`@cpBZU}F>BjW0l&;1 zBK``X@WHMGB#h7V)fasf_)NyQ4=%P{NkCPRto7C5tpU6p_2|JCdW2Y|~oT;H^VNsi| z@Z@)va8IwtD4+F}tT67;74f6I%YV87l1gJRpF$V+LE0DSs9o<8);+)dEmpAmM{Ci} zi*6J%VHT?ST;#tvHD~PNpWwn&CtTXk+ise~#*T)#ZS+zxS`W(LUyai5cEONZP91T- zbXRF#ffUHg0gDfJdqpp0ILXP(Gj%Nc6phGT^8$?42(^F^G6Od}(pwqaKF0Ogb%IHQ_wIPVby8NhamJ)&$rGlpzm& z%vn809i5oQ+}{0o>Ud*65nFjQM<}nz4B_i7!tDd=)zkd~_NwTO+9f~e(4f=LLXMjf z#W3R*z7800xB4ND1?0pr>+GCpyt%WWWxhQeLsoL!uZp1?D$laX+X;FF$H}JU(wpYi zsLM#$NW+iM(>kyj_GcMXlXyQDC@ukMF2HX~ju8 z;`zNhW~!Yw=vcR2@S``5n7~^@c_AKMfwGEi_+h2R1q}5<=d8J|7-ChzfqQddM=*&6x^fnBA(b*P8YZz(vmV}(@|}H;Gf`~#@>D$ zxth^P14V0g5^ z0B$tlqH4y@1?>K#KhDS~f|=|grw!#^?Y{aS+j@8^frn<(pzYyv051K@bMcRF`)NEj^(M8~;rqwnC^Jb)&Io8%x!CO^uX zR0>v!qEOJ%CRDAJ;ywW%j>0EnKTZE?9f8Irt7) ziRKBcFxo}NQG=IQ+F&i#mJU`5PvN~qzJ;c^xi)Jts8}Ki<1awC0(Fsp`gD?51_Ft! zycdD}1w>Qn*ozasXkjr#E|ip(%R^e{TH;uwuMi0H`?Y}13SM3Rr1L~zBH%QgGN?T5 zU>#-WdJv?Uzl5asMNryFn-KN(qWuX~1gXYz)x`n34apMhs$=#Y1{19u+)u`I5pGFd zTaJ-VlkQ@#+nj^Y0QQ2E)uOrWaV?;o50H=hQFDwdo`t+4TT7gF{L*K}RJ36i+~6M0 zw(C_4J$XdMMEKD#VsC<|R4+C=g8a$E19qELXo4$s4mCJ9uKz4Ob-!ug7xCBGCSCM` z<^Rd`D~QDAcXFW!O1=m|w2%Q36L%Vh747Fj)D_*q7`YB?wZ?Y z(xh+7jH*+kWK?P?{4}W;|zwNf~OX&d&z^37L=wo|H{-CF%`Vi6N#|~1`GryWwE3hRG4vO>oXjvh?zI+$GgyX zC3s$-$K~;q>v&P0n>2OjMlaO~ojA~WcIG7-sH|-%SbdVgDhqQWL=|Ny%ejghyKMVC zmW`yWx~rHE2Y~cO4(=)mZlN-X0@Gq@Xdp+wYZ`}70@Y`gN-L>R<_R-eq9<$5z)=89 zY_CGUEBULD3V&(B&GS56kH=Q#uTYs1V5oA&b>}9u;LAii-Q*rbIl!fWYN;Gasg^Lj z7(XQGL*f3vM{4`nI1lDT^bxPeg=-kgOWggq>uneM2`BK2L=7Y}6G~Ypi&70OkE70nu%Zo0G3!@ubRLixyZ!t4m+^#{k15T@*2CNZ_iyaixFUu)|G zCm|l=-g5(Ue~Lt|&QQ6d@okhMQ*lNAvzfvGMCj{`tB$i^RZSr!vEmLsmN!jz)w#x1#f9qi?W(I&g#x?3B$|;P`zSkxv`Gxm-Q+iGh5> z(#mifiR#Co_zH;#{e}=@YwMq$fT_g8l%8SsEs*t-_PAKZkgmLC{}@emQ1RK`#<7e* zOmEs@;o6*1?6dQRAmSJ#_!jG{%?D|uE8LycbMOBkXlq~R7Duf~^KBgLc~+Nxueyf(cpP)q>I_#Y4=J3} zHa|+v+3*C3_D!I=?Mi8!AlXzjJE1L)#2_S|t{4%o^P6KPV9KD%L&Mq4?v1{iPll`N ziWBKC0l3+6v;?4zs_GLgPxX8mXp zY=OJ(GVWTn?oS}khp3sI$)vow5gdKi4^%CxRu|55TXByV9SxDWyC3M}o%h%+>>1qN z0GmsdF(_NkV80yBx@j5X}|Qvw(O%%=leCUPBI<4%;|-yAvr{ngI?}B;$n~i z7s`}h9Dlu0*i&n-q2ejMjBi>t2~LgglJ+N+QXONMz_$RuP+qLPAW(OReq1kVjmQI4 zI8>7}G<&bqA764LnC_S%OCLuc+nWTE1?$aFWe5ystnZs=RI#9ALVJ!?XGOKuu(MHz z?)jAX8f<7X34X?Y+2|4mT;{6>;Eg(x)U?1ozjn-${*GaI;U60o;<^_oTsiTg-HRL5 z?Lmizuijz|@}*V`@_#0^)Ko1+@-(vpjzRHzsD3Y{#;5^ikw5hgQYHU>5!p3$U(=Sk z%SmTEvl@!KDQ6S^(m*(UxWKAY!f+%F1gZ7zh9{OZ3km`NLVui}rnEIXZCzgdSXd!_$ObVCn_fXnyL~tk4-Oi_1644o0H#ebXpFTOH7Gc+rhfligdZhoFmEL=_^N>}Xab4ImC|Rt+fCipX=MYh!!bAtw<}bp$={F{mbQ zBiN!OTj-axR7a1e%aupZZTsSLRHQQ%o@F;BKV8%N4=gtQQ-shvipQHVsLgJoe)~rbBZeJ4 z`e?n|7Var5q_>cuspuamrFW zAEfmGHPXq#0iR~%RiY$+IUK`j7!ANfgc+fCAMc(_!SL=b$_{wp!s+h};z-*s^iz*JjW<6>`J) zNNia7bZ@{<-}GTZuxXbadbpf^E`|J|ZUWVHn`Q1-R^LhOHh>~0wj-h5Dhi}$zFix3 zmgcVLr_N&()Pi!G77d$$@kREsp`E!RhwD{dYV-ViecU`jcH@KZ&P4doZRjPNAB2|q z&4yQVH-sn7+#SU}n8PnFYmNA3t#H1BGq_ykzZ#egWMJ%yI}9i*Q_ks z^&>VWjgzFteADs|Mgo9{LB7dLjV4~~wi{1j*hfOW?i9tRsb1afpmU1@u6|yP{Ot>< zabqQZZFjvod->`NHZd{510wcqgg7*#P3G3+Uh&-R4c=?HXY8I9738|&oLw8Y1-6Kx z^R-D7Cd9&q=@Vaf{2U{{n7?v%sdL(JJM}9oo{3V@kAa8pB>idn{3dvhv-^ljxbX72 zu_0MZiCgzO!QKEj2yH0X?Yo40S{pt%biQ)uv13WhOv2aTo0{jJ&FvXEYa5>ocJ1kxg#1()+0WDga-P~}-|CBzbAz+Z&U=Q=q&3RozwG(!*%N?% z2uV8CN1;1lJI(4@CNV-PvuuDk)6*Hoh~bMMKy+ds6?qF}lNl`YS!=v$TwPpm9L;MD z>sxE)tEDEp1S*<0s#}sNQy6Zs)7Ek=0re)!*XknQpO5B<&{m=@()W$I3CBjZrlOp7 z4ftqT2$@0iJLpG<3o%X&qW-j}+kD^zYJ`Y27`= z&^!%~PJkwcfCgypp8nU6WFgWQD<+kWgzwxQT6#_6kv4xLooIaftbX|QLcoy-g!>h( z&bp<_O5yKIH-iDQ?}4l zEv=gXL=?gnIg<2clct+KEOnHrk)&BogW8gfW*d``V2TRUVs{-&7@6A4!d;JWsG^#r zmojlV2gx(4;Y~5ZK7l_ajreSeumy4SnQZqoFcDffX%!;VxZku$ehG6e3GNMin&MK8 z!JTEC2 zvpG~PbZ)yyBjj1HtBzyv!WE9}lPo~#0Eytoh`#4eu~mqwYcugOwNuR=FIO&R&S2{%@n?g#(<_s{Z*lDWVa z8k1v>z&DH=o)HP--<_A|ZPYOM$6j`i8%MrVAJ!VUNgM%_xM$?@s1JO4D7OaC?D_tD ztq259q=w1J#%j5hCCh&k>}Vj&5rgDD0T=DcZ30aTpQ}wyh3+Pu9XAL11zHi!;UB)# znt^{ZFDqpMpPB}iLmc|x5`%jvRKLC>Ak4Nmm^Z$8bB0ZKu{G8Uks7i3?P2au+dfk0 zrEmIErhb-##B;{IpX;7ZMhOOg`(`=bCap`>_X=z$+pJZ$uv8K$$@6a{nS$7^ZY1V) z(31tP3!#2Au+UUj#IxrSXjyg@d4|@DzMi4sef;>cQ9hiYxYsZUB+FLvTfO_45?ReJ z)p#*Q&1S6ZM@PPB+na3YvTT@f3~e5r!Jpw6+5(3+uReA32qtr9;ic%OAOyqkE2BKX z?uv;ELhr%^8tRG);beRIzdJL;2tF3gUoogPO7R+63K-~evDCor=V70 zCO*}z-lAF=oZeWyhn=cw+ye3DvdOJZpTs%QtVMge`?^w*DakMW7+q zj0KsCN5q9_*R`3EgOGmr^wxFJ)-K&zp|If^z{H2D7OtU*DR~cFdXu-<%+-4=B}?JUDxyyh<=APv zkX}n=@9*|X2nr*#i6$bk8kD*@N8oQPg`ZO|s^~qna4l`dtGfAxuGjP?IlL9jx__5v z^?2&NiZzJ77N6Bhm|hVAjNzCeiY+;K*5TK_MJ4Q9{>h`mJ)=Az1Ei>-HUi@-++of4O+tp3x=oX{4VjNyvH=vz+*sX5baCYO^sNN#RlzDwD;SnKe{6yT0FhISSPC zkgEst`=h}(o3sVE2s+pg{XkN_q;HJ9xD^rlgNhjjBXgCZ`%-DSg#}_PYDyg30OCAi zC%RSB#Rr2??&K}2Xqzc|3#jfOu5PIaWP`I|g`t`x3pCO0Tle{G4bm?I_Lr($dekOt%#^Ndttb- za0h~FrzF!HC}j3DsrhrVRLu<+*W&^h-g4uNo%<6WD3u_oV*rohk_Y+yyNo2xZ(8wPgKl6zjr?#ISu-SgSsOM%`H%d|w6{OIzi&r=62nbEw;0K`!x_gi z^QhblZ8fKT@qz53FpK@P`y`&BEY~>^{%}o}OIP|LjzLfRGe8Uy-N#x0!x2hskRdbL z>E2FL@hceo(d;1Q<+A3s03@k!!C2%QVzkoCq3p+vgic$;F;9EMC(sr=Jm!~5JO=q0 zZ){I}B9Nl%9AOzJo55v5`ti?)8s|f`qK{z$iUheHy#_`a#1@cu1=H&vJDFi<3x<43 z$cC8qs6>;|Bwmb01NgsT5G2HIVW_v@5qD>BprI^0rW^X%noV^*K_mZ_L6SHO_+W=jTS}C1&p*Avhq3Z@bRk zx+9*P^4pav@ap}XIN_%DzZDK|xu@MT!_;@e+Ml->&8RYJ>|c)(kV0zn)g$~< z_p=cKf|jzqUn8F8_FIWq)a3Z5@Ba?jf{B5n+&jBHKv0FZX{|=YSQOM5zpfA=h}&-bjmU+ z(;vnI&xD9?n5Xtgs5t>F6tHq*76q*g&Ko0&}4b?Bnk6=Uj&^hk6*tsP}syBRnH=B{R7oER^{W9?=<*@v9}0Iu4R0~ zJSoohe?CY5{32?6RCv2h8<;2+~j7WHYA-%LvmKr4;5_ zzAgLp5!!doogcl4!yY_FKhW)*R)k5G*qzVkkzdKfM(dhXuJyvlp z^!M`+x<^dgc)6xQX?gC^o-(X8-CCAIkdj9u@Y)Bf?| zA+)Q}Lo@{}EeeEnd_6pdjvNW8ADC24Hhw7Ai*|DJDYy#liB5j${R+z>g6VG&%#o>O z_k;W)S=N8&JLAfQl^hB61!drJ{6j~n&;jX;tV~O+s`Z3 z6X_JVVc-?Ac?ZXjp&+prRyB5{el)HrR$KAPXKT7jy+tW;|1FwRC}4Lu0DZKf*#MGl zdNk_B|1o@x2`}4J5w6HrNpPe3F(771h%}=8XVD(eS$n9NP(Q;T`) z#eyZ2O^$-xLwAK?&%Lb;K3mng*`ibc9)$^~hy`H81y#eW|7V-EZaKT2PRa ziBdGy67cd>?MtCHS$geWHdEU7XbmsfrP3$cy{QYRJdx~Ijv@hPI9=?l5p^fWA-B_b zH-lJjzb;AsR^wg;a)OBm_s8>Y0g~F@ZufJsP-+&fHP=(?Uff6;_SUJ?+=QuY<@h~1 z>sX8j7N^~HQf`QuGBY!&C57U%JyV~lB&S1)95*%3A;=lLraowwwjpExbBzf9T-zfZ#AbEqBJ)D@Mz~ zxNv8(FF~tLLlDtS9E`WZPD}i@xDiq;Ks|Li;3rQ=68<4{?R!+IxZc#my=Q6Y;^{`( z@KHpKS-BQDJ0!B|MfnUc;08roQaY9P|KrQ%AO=|k*@N7~61EUou_l2Ng^@$2LWBv^oEgiABMSF2 zOL^{RBDagNA`gy*GNdVs2^?fGjTUo;a*Jnh;=3ed5E0u6!JRNI6doLm_BoKy#?k9> ziI?&ThuMS3Qy7FJWWn!wN8#ODsZDikn=S{%FMsgI?vFk?txf@jNMB5*0;oVwI*2wE z4TE$4^m(1)+gmur3t;DcQgGj=ChJ1ms}?jmF3Xc(FQUT$V3tM_b;bp83!d}>yx&~5 zlKm4LJhJdSw&=Gab|dr*TV1VoYvT%&KZQF~Bim~JqR*hG3Pe)RvLD}E$K|`z^64xh zLnY&N-HW%`Wyg4T#CP%1Q_;`HhW`UQ?ubmO)Wk=O7()9ld4uID>6QUHU~xKCdUwwG z$xDL}w$qT(T#XZfFR)WUiQuJ}SU)vAG{II8{vL^7D>QgAwvNJf4Ub!%Y*z7n z{mBFsTQ#K1m-?z(d}Pv<(nRM7^G96x1vGHt8TzQIoTfKlb7et;t^4U!RZs#+r4QXK zpoOMQilxzNc^fso2@o8ev%CMEG7|Z2G^IZ3t7y7vq;PN7nJ%~dNOdRf1G{1*u*wTP z^t_|_!i57(JVUJs1@-#qbi^Gde<7aSv2@0eJE3UbUp(>Jw*kiRROnx=@=?9$1 z9~S#qTl1G|3{u_BmC<{=-`@HCe@wk)Sd?G5zHQJVDS~t(BBe-ohm^FGlz^1ONDT~# zG}4H4Bi-Fd$k0O%Fq914-NU?(``G*Uf4}i@4(6G))^o4(ICd87BZ z{^5|V0g$VW1ZiQ8NU1j6->UC>v}4>M1^o$UmW^g&4Z3HnME3_H!y)^iPa=BK2~iRn zHJ7gVR3`TDxe>@6@-8tr{g33`J4@EtL0SQ1aYkqGgo| zZ2Id2qk-Gn0Y7X?P`Vr6r5R!b#+`esBF>~GNoz=d_D^E1Ca6HCqt@>|?K3r}tK-)6xSM&TOb-9yev7&WK%i}dp3Bv54g?NhyqdqXGXkvTgpbf!8-{g zM^9Cs83D)6ew*+unQT9H`d`Y$15u3;!ty$$css@qC15J6Mg7<~Y!Q+fAXi#>rX;{) zxhkAs&mjblIZmBdpNWDEe^GQaV{~pL2O4B?u=`!6-psnD4;bNP&^6G5-7Xe9fLZTA zqvmCX@R+C+r)>b~NBApp>tffYcn06i>=55;x&u$x|3BN|b6%4Pz1(y0YYCH^Z}o~# zywn8lo#f6gThDcW)O}a#L)Eg=0km|qj0lqU{;EiVbZ;@8L^B;!=4IDfU&4;HTiWG2 zvw}*ejt;0kTHl^l3t4v}Y!7r;u2RLLf}Z58t8YK-gq*cG6+^te(>|IQei|xFl8t4* zM;?*K*~_ZfyJ@%jorvY`odtwhYr(7RMBHrrlaQBe$^u^#K9_y9zn06Xss-f9??_x= zF7i;JOKXe^xCHGCn*orcBvGAYri=u>*~m1t5w-tzwfm~eeRr%4VOkOw)c0$^3%+c+ zF26oY>>5jdQWXJH3&df?N`vNh(lh8bhnliJOQ^&p8g}FN5rqi!?_kOH%wUVXKlh`| zFK}Y{`{@A*343h5@=x6fe6#VvxP}0noF3qQAT;3Eh1u$4ZTfy$&Sdhc=h352s@|z1 z2LsQ#WyO#XJsS5nQB5NUiLiYtxsFK63+h$Sv4ip7>QecER#nz9J+hA!$(ewhxypI% zD5rktoL&d=4tHM#*uOZWuKGO+VE>-JjC9Z4D%e}CO(nlmCAF2ytcor0Hup4T4I9Xf z5wkjIe&^~nRbn?eqTG<2 zOY+se!LF+MvX;g%5tp%zNV9@~yy^fohs{64^gf53y^h{Eg$v!S`0~0Rfm(@QCZl1| zu!fPcK>HumN+JD0;aiZL_Z{gtGTI8(9a*usuL#qrG{d*5_ko>DQ4cZwZ>nbNBYOnbe_y=)8nOf2D;W6RH2Ag9K63FIG*&H0IgaqZ z2HTSr8!udgCfb@NIt`bV&bt}z4ujknu17=a_ci@aZhd&(rdU_s4(xG2A~$;cgFY2AzR6sSblGMt$!OWNDS$^#O=EVK_!Hl3{|0Y`}_-{j$?^=q- z9#X{dW|;i&Bb%2feWg>C7?($iFd+$VN&SnRN{h1PG6d+=l-)M(7RlNWjg27GCybFp z?y%SJ$XL?K7DghG1<{CO-iQv_&CWNlhNB4aTk71&i$kR4I~FH=7~cgT+&(pFnhDh> zC~iwAoe~pe;L>}3pvzsmZBgET+CS0WQ^enO7x=ngfBJd3<%r^Pe6$uTqiWu)csdw5pi{xEqT+4b3%!$;H5N!_XM`= z_F$ODO-~~2fntX4y$irC)D67dScF4nx->FU(B@8dyC#DhA$bZ3+phWiUl+dyGQFqc zC^E<8t%MR;KyW?@1KY6UL7^@^MQ0hxVQ(kpHH>9p?#P=T&nxi-C`H&y_KE529Lz>) zsFzmJMq-8@^D@mePz4k5+66in)yC@eA^F`5O`k$Qjh zx1ayYLiJ_9-E~vuP1B=zX$%`MTFXdYPWIyZio4u&_tUIH?dER15-nKW@50ytQZvKY z-nh`A9HK(Ud0T=-k2^^GP^T^RwUQuOWzrM{W%9w9e0eP|)&Aw;(O+ra@1Hk4^y)II zboa-@?|A&$x?#31L7>hCSk1Zwl(UArPv^w5W@lmr?&tN@m43nN;;{e%w-NTu z{45hW-T8?NSug0>XXa2D{zb(v>;;bk2=q3W&sexN*_eHr3Ojw{|Gv?+O*i3jXNC-b`Q!YMDOl|vB{J>5;s8mbS`%rE}i>vS-ROZe(`B{>>95Tr?<)k zwe0ycT+g=go<9@2xvSt=b2_+oY+2~IN%SuW-Lz?sW&adGR;*;LOISA{>9GWDh~@6n zIeK19CcAKHzWphKfcq0y;0?uvaI)!MHbg>R>un3;q)X!8E4HJgrDPXcANIfmR%ORVrt}rZ({y- zeoYZ1seKp$P1Ri5C&yQWmnhzzlpw-vZX-PqsT29CDS)%PEvwpmfU#qAgSR+ui$1^E zN0Uv1_v4GF%~x@WlUL>z#V$Y126S;p21^Ey#kQrt`SZ6O+wgkNMs6<#O5C2QrnQ$4 z^&FH>IBeVIBlK2!;xAk#w_NlaR(U0l`&fu0J@9;2m3*yz7J%1q3-rz6Mf(vqu!CLx z;)UXmhdu%yqc@~5SC4k;_FQgzT}%uOOm9#ysXLGuWoELl9y-d>=wq_>CYFmswU znA*arcVg41Ox>A6eQ`;DO`3C7E!sBegi6FRzWO8i*TPf#OrQ;q#u)7A!aj?d*^rcA zXfYKOk4GNDz$1bqVh~B@AkzBQ`b+e@Cp+QT<#*)~VRQGb zV=DMFB#B0GUQLs|E2#OisSiF@I1!h>bOI+}v*(Cq?;uso@PYWVb7=9N_B&US7f^=W zXB$p-9K?tG&4=aK+@Y=G?s9^EI&_g;U?`j z@9>09-1uF1_+7-K=pHGr!`Mv(IAO$V(_HX#8@3s zL*x{Yy;W@8LH3m0DpnEan^d(OQU?Z3b*ZmC95jew3Ee5{OzlcKtn!#FbXtzW-VwAk#GFABE<dWE=KlS_7u9pehke3>1u$XZ9EeU5WPqsS6l%UbN=3qL|+g=RplGaRA!x7nz zy4H~1D+no8zxH(;6~%OB2p?51?M)ke7v|Sn350s17rhUl3U%INWPTze4;?KVqK6fK zF1*AIgqyEUJZe#?Z=79sE~%jfLUpH8DC>B~yFP4H#V2Cd&jcp!QhYQ3iWn@Dmo$@Z=GD%pQ*&RYQTwgtm}C<*;&*9 zRneD;@8lehiPmG-#We`&aR6u+l3t$pTAv8ieBZcY!eiQPNe6f3Vj7=48n$)jhGcjG zf}D;iNxfNQO7cF*cSF-4FBzw!HG0^snwA(gL!|CVHf0)4f7-`0iC^T-l8c)fyL=7P zIwgKfKYt{;5eh3Gt=r=Mn6?rPXJ4sZl`*>JkBiN7NNI674H5@|FL=(U(hSx~4p4%d zNniw5H*?(ma+m$P3q;4B`iY?3OSl)oDT|b?vNKX+6q<4J#CfM7Lzw#+-FCpQBS8Kt z=tL7)7ihxGb+b?%N#=WxED-EJ1zRmZL z#FhHEmuK_H;K4!fXme_3e#K<>OR^C97t;ei_*LO4jYzW1Z_siftN54z0?@4Jai-Qi zi(-^Coto?FjOmjmbrZOB4sB4U;enS1S4C^-NqG!JzA4ac>2_V{AZb1yZ>8baD^|uM zf*(th-<6+hcrqw3)$f6`zsxgoFJW=y7=HWREcq;PFU&yE^b-%_g=&8>9j)BP{cwYi z#((%=2P5*IA4EvU^g8KIgm3{jnKn|^%sE|f;*{qvj1q#S!cm9b zj}UK!KC(U_k8ax$mVCN?9ChJ@VS+2|&Vzqeil<+E`fs%cvOEjgxROcXZoT14x`-aOmQ>hE>66J3X7)AE8@9umsr27we421LLZ{(oyp+zZv`GvaVGMz2%*}=FHmE z^&3lw0>`kKOSxG)!t7sps3__x#@N%g;_;A0=^E6#Pj?E(IVz3Q5wJ`0!9+iBO4n1v zj-r^fwST7JM){`6^L_23ApSuA3XF3mI3%&TK79nQ(ala1Je5*r7E!}*1ry8ord?G{ zo*j?=9H&FY?X1?&|L8d8>KH#?yPgfs`RdrA{@#bEioUNs38@Jk<$`^^Qwn5=F&qr^ zwMgDs7WOIdjiq&Jm2A)L(1it}qwR;dBLhT6>96&}W580b5x5yr&A4$YpMz?%95RroC zlsp|EIr`4qN0poAuw;A6gF%w2LEE;d(3pFfB19NtNYn+qM$VVT<;}Sl`~BWW9e*KP zReOHc`&VC`gf15SoRKA$3mxg7Q^BVX8lP`R-o5J}C3tf7JW-CWKs1u%c_J%p-L$DX zqdyk2gt_rUoH7i2H-i;%j$Iu+M@5> zPx78|ejSvqdC=%~Xk;#(F>|kie5ifjDxf~Dpzh1g!IMoV!rqiTMHCJ7GY!bS!ILi$ z)K5d6%sxzI{d$9&U9OH`k<(b(ax$xUi6>8MgLllh#suML4a*_E4!e1}v@*aL`lh*- zC+Z=T66W9Pddu)yV0t#QJF2s@e{_LoPC;gof~dT-*jZIR|?^q}O99csSH z>*|RFP^yBm`e2{7H+LtO8Qns)mxd}fA1~ay#w0e_GaT&i;aIUt!Z&Z4HfAL|08RWn z2AZJ~!4(?+gsf??i83U$68>hXAIOdU{=NjT3Lq8N6Tzn9MbfZGq4l^gV2-Y{G8rnny&{ZLBIY zg~z3EC-r>O>mian#o~ddBF9i*!oQer2hC)kkk@b-w>za56)Yq~` z)I)u-A+p9StN8VUjNb&tn0$3`SNnEY-5qy6jQgD9x;x;OwvaK=e4x)a(Cx-Qo@_cx zF@8d6&!#?n;#MG?@sytMlef$B9w9K~1T41L*vG=Q`4<;I#erC=76Rs#C#D8R747IL zcm>G~d9esf^$HPd(9eh~dnGNEYvI;Kdp8b7`-hYDR`N3*#9hZ7uz5ZY|SVkM5T47pSN`I7Nfno2EC`A{y_n#dfR3LZ}9zx6maqgi^!VaYkf-0<;BA- zA4@-=5EulLXKD(9Q#oc3DbV|zce(!RYrsR}Hc|0is+fEXx&z}Oki(m|N>W^K#;iHl z+Z5oHz6w3|LNQi@Ie+e)rS+Yq*22LN?omWYB~+N)Hmu=3y`R+f<2?A*3{Yry zZ3Vy@HmE9IALFMpSuI#fO*j&7qrs78-ThG&;sx7I)j;3Gm|-2gKEKO=ga(dDiW^C~ zY|6cdV;g&yL!4iCHePs;U2=>f&C#DvrL{e?3oOt$9TL9rWgq5 zl{C?0^`DChVMa6+@nzEIL7hj-g0C6Z|2TfzPwx_2dE<&c{oVy$ftnGFwWcG8R@ovI zzg3nw?VkJ#Pl`EljS7K#IM&Cw{rPhbN1Lqdc41bI*O^HV6`#9UJ)5A?MiaO64)R!N zrn>s@kmnbDPE4xEcGw4N1WH~U7iXdNQfwP}SId^B4HBQhBu-bX_S0^HTgL9>_Rl2Y zu%`J5ydZ9~H=qXtnU?dM^Lr$YG#v(@2q(ni#T zgG6auEiB;*3whc{!}=Y*3wj&n^_$-kC-50%NNMF?|rR{nzOz3J`7hlMqVfaRsiMd*mM>-pF4e~gCA|~_lT~*{yH7u_eW~_s4>Yf>n z#&_8t7fatp8JLD~Wg=B$pNng{F%o8+end7mgr()bQE+Mkt-U?$1d^IdK(2v{?11VA zz1pX*S=wn0^A<6ndin6vtZ}(>!-RHyivu^489m^G^yF3p$U zZ$uS%^KQPscA9n0Y&cfcir$n^CV*-0%XUa1x&>i}qMLuT{meJ^&)P@PxgFP%q1bAP zy;X$Q^mD#EL+a4U2GfjnD5K0br#)P-%aVteq$}|%{}!^eDxcqbYP8AwK?m#&m^_X+)8-T5ddcPPjcZ@*^=4gDJV-hAG; zFkW2aMc|+-w7=t6mzTmxiAI)=q zoBvZaS4(0+ZQOA_Ds!e!UPQ!;dgm&Y`(TkB^r%HrlcO;P{0r)X46EUI+V%J^#Ol(y zWVqd+Fk=Pt<#W@YNjuxmasp&OmTFI<3o0d!(?0h%h2y9~+~*m4_@n`9VSgRC{Tsi$CTpucbZ{smf27sm1se7+o+IGV7IyWX_Tlu$d~0j<(w-P5{9S7m@9Nl(M#1$iQQGa>399L zsoXr9r{NJn!`RtpjJ=fA*PRF}#lIoPuRb|)bFK~hL%saJGSv(k?sR(DWfEGpsmFu< zv_&EGa7gLOT&Df{;?qCr`-ozUK@dPI%tYVb{Q8c9@l9*Fwn z*@c(RNR=I|{ygB)$C{?i4!L%v%+Mc`*@8utIm$n1)^OY|} zT=O2)%`Gt?nk6CVoPq*#6X4L6_?7NA=+sixsh!a7A%f|CusZP8A8>Mh?tdK=iwwJN+VOqYO3tEByOTAun=?u6&85Ca;_$@~fimlZ=ps zGPf9xobqoEEy%d_ogm~1g^LCLF%lw5IoH+Q?;y&1e;-owbAv{~E*#~Fdq!sN{4Rzzg-|0@EGVdc8m%5ojh&I52Qzt^0 zpw-qaE)5WsN4>*84r5erC#29iIH!le9QV(1kH=~9Wr*-TkNiz%IU$e8Tta=kCi(h%FBw?YVH3Z;El?fA1;P=9(%3v-gfc& zU@o9b7j60TGNY;F^z!0V8}x^(K{8ZJ=zR}(``Ite!|JVUL`D3yMf9E68pYVfyj;{- zNyl}`FwGyT&(4t_z zyRf0>%fc;R@2oPNq_V)ss;G90MY&I)Qz2rmIi<{FE7_&9(2G~?Z@|1oro`ysYU#{* zKMcAodRA&N(UXCg?h$Dk?|#RY7%-K*J4wFjavLyQo!`BXSUQm?i@uC0fD2ow^90s>`yz*p+J(cHs6QYDbdzUAQ>a_)4%|+tTky^*8TKruYqS$xEb7)o* z^~JvRgXf_idA88>hy8Z&kP|BNWY3i+irZ4HqY_FB17n07k(qwZw+cgNIvB!i?uf_x zDz{QISdoKwe!APX()9N;tW0!Tms+B%{Q0}V@6dU+LdenR(*TaINRJ5cPkS}mcs10Q zrSl6BpBr%odrFLwC=Mde9W(8Mo?hX#tH&=nXP zXhjvhpPHb=;Kda~OqQ%q#*yDJGzv*~OoM;D^!~RSZ0Y{BE8=eHl;$_c-HUzeSK{tN z$r8VfJB%QDeIye5%%HUa+;NlIyP6*Si2<_(lRU4&RHS5?g9`k;Vk^~3BE!qVZNqF> z@TSTE1&Qo6-a!eXwRisy(a&5gn%RSmtkWmajSs?iU#(#O?HU6@J?O`r-Ya1oldUpn zV_3_YaIBDmK+*t~%;__7vY;&P1coHYc`7h{IEq!G|0^lvgq8OCwfta)Uc&bomrL4J zCrfeu4Udd^oD7|xpJS9*8(V|bVYhW)m1E_!lvFBNwquI8_LL8De&U}*`ge3U0w#q& zUmcBVo5jrspzn^70=LFg68Pn^NI-^O+#D=2<)%vnR!|hplHDJuHY3w{4Ub$DW9ItZ zYK!O$qlP1{$MxTT%vQnTQItn(&HvE~WJ(XPKQCR4c=+Z(Aa{Lo2Y6%D=_J~(Hfnu8 zcA>1n=Z~@>@9Uo=1Cd{(p7-qf%*dL_ig=eKd38uJy;*^%3o=YtX8s3CzR#>~D-}=P zuar#o?Axdbk_fJoi4s8MpJ(Tg*eZZOJMZ`ra0*qnmwVQn0@7O6JC7T^`Sz zco{I0^X~$12-!}6OtnAhbvsjhBjVa&AIaD07@!rX?kZCq0aHP!ZqkJVxgY5=pI67L zajSvb>67=pWXa6vV#-_r)SIk8Nb2^m`vTEmckut@HnE4ZaNqO40Gwc&S^OQ-28q!q zar(5Xe5Iz5Ha+DVM0?iLFV8e!#I2_sj|VTzX}ZTtIxy)O3RK71^ZmlA4nRLn6P|6( zqNPz_ev*$E(cZ)GANm`)3O4X;zc`IUWfSdj?JDelm5xv3tV&Q_B6zey9%=}xufB$9iA_9Ae% zSKgGVdc~vT#G8GAK{E-jk0-n6Rcw!F3kt;%u2*dBIM!gRkQTc6tOs+|3rC`yKjI5t zvHui`$$wh+R9>T3L%rhC?XmWK@h2^GxrXvHA31EtvlZLilEN1ig9TCSG~y;M)nv!= zg&DB7(Sci6ldT#gh0oPD(;bA&c_dx4Yh|8SvgL~vf2(q4-JL;7#nM_!FGroeXLG0J z+}5TVnr(K{ETqpN;USc{ZxVD;7DisSYVU?H^(bpC^U!DdFQr~XmY2~3r_V8HzRer^ zgQzt+QPu7c5G5A8x98t0Dxbk@BpW`T`#S}y;Y=~eygRoIfeJ1cyR~1k9O#5-Fhp*dW z`9wI0h2Sq3IztppL0txaXoADkN5|z4%3x<6mY#f-|W6$YQ zdh;=EOT5GWi(Y&gCyP;QO5}sc4VgK4-&(;v9?lmtzu$$QyW+82 zsoOpHnpKF1%C>9_zjUSfhncUBy?b0>2vdn7_4t|e@Q;pLuNKlRraEK2lXK$7%`$_P zwaSLu4^=}0<{uMN7k_Dqicpi8ADAyFv6&2&3Nv^jlH^E>w7UE8;yHZ#6%c*ozugS* zCjsAcY0Z|Wp+jh*qgE6-P?7Rh_)D-#tViNUCxGJ9Qh1j5i}JS<0w2T-1pl!t2nLjL zTNJflJbSTY{+8!IqN$t!oP$%mp*!Mur#<%0h8jmmcRY`lV|Oh<$&|w5h4jzh<>;CHdWa;-_MQ<*G>yedG#Vs#HEb zKH;6OFEor=s_9qlgMy*|k-2X_9ydwR{bM9@7*l~b(+=SqGV`WVF{BN@!xh!$})`qTKN7}nZI+eG=B&O{r29##w);_`Zxe59J9 zPsmfd&BdY=oF>lE!?f$op7`9hx%WcIWzlDXC0abrb@l%q%G{MPB?bk(1M-B)+ib4w z^l8c~2VNiVf$w)4fM-aPoL|prsgAPKR1Cx?JJlZ>O~T<-{h2Rtr9rXXGD9aB0{S?0 z0Qeq6v12%B8M7xxXXs$kjb@d9)iyvcz#G&oT+}c(rTpOK-KOOOUSC^1~;hi3cvbH)o9BxSES!Mt#>vw zqNGRcLQbk*`Y5kokksDQA~fTau#?`U{xgXija;fdd2%|Rx1RaI=B@n6Q;cGSZxn5JWAlpcST z5z+8Woks6!dyrP#=}5X2O1b@(1_rq42XGs3)ZOIwIdm=|uI~R7&lVY)j4l z_p`6)X90R3#{O8A5BeJpq5fvKEwHf95-jTf)RR9D(cI#V<6p%1yfhNTjVASl4N9V^ z-&tA*z<(_#1t@$Y(MU?6Q_mo$W&A`ZZ~OiGU~;n=uQ-RYHm_`}!VUuv@N{cX|6a^R zQ<mDdFAbz{J+}{5a|IPvRaXWQH`|1 z*Q#^{GS#b7KTW-&;%6(KZ!?AGTj?4%hRFflJQ_Gy%%3H(ji_BiYhh}4za}Lh|Kxh*iozc zjUd~r5be3IkBg5AWZ#hS0OmOJ!3G-io)eDyEn z>D|UlBxpmLQ3ZU7PzP=Wiv)~z-6zio7E5chD8ee zAZ9=27E+o?7bS+>NWT`QmO_oMOvx_0a zX6}*<@J`1O0R=YoRb01W@s~c9IdtYC;{J+!U00~V9~eA4-ydiC0Vpn>II#(2TFszI zm!IX-B~i03QhNT?;q!v$qXaMr&lnzQQ%<9i#tt?VK;%7WY~*OWOze;S4wX&WzE`91 z(-3Qy&Xb!198^qqHvjMe>Ho83GRH6#5Jh#gHt(@POL%KWZmZgf2zWSj!g;0C4+hpy7OgK@|zW_!SX@A_0mu(w){zoB2p1BbWQ zVQ`FeWd$7TF(at@jEv@8kMS}O^V>fS6K`A&P}R73V0sSIOEUWx^wBfsCdtKHDzrIn zZ^g@!Y=<1eRcV`_O@4mhO6-byQjY6&OyjT|jB<*j^V(6yan#MgR{Dk6$6`+E08QT(r>_8*efIgNMt;Vb5 z;HDe5lHVd*-6BkhJ+E;az=Qy?-&6BAG*555ww%6T-R)Spu+#iBHT`{?#sK)0_ft^l zr;~Cnd+MZ1BC$q|k3E(wfc>54)f;`vZN&}8?w*%= zgPg2k31l-ahV%~{(gj{O;-~ItNlR*1MX0*#?6Pk&`Gg=;&Wd%hBD5r6)Or$iA)S4z zi|m7L$M;)+4v8Gt0p<>XlIgvN@_Q^UcWtGBLMuM}_x~2h4E#d(4FZ};Y-U9TStddz zcs#PwGyP>T0cq{0o$@|V4i<6LLjkNpr{Y%WnpztaRwd1u5oDS;BF&wtT+Sw6Vq;JZCaVkLTLCT7-qyBU3F zC&JG7QM{qi94;{W(Kj$-D`WUyUSSuf0gmuY4@Xv--99b#>gT0d+!1~Tw8xNS&-=2^ zPR6kmTyn=BSlU2Yar~Y3us>1c+kzcGkJ}!Kdi4X51fRFNhdd2MN7x$#@u33t96vPd z;a9L3(wy~G|M;Q8t-YVix;zF}h5eUdX9|glvL`=Ee|;yY3JaJ#yO+N52~w6T`oJc% zI>?bG;+sr1gzd`@1SqA_@&#RDO{(*T+!JQjwmPfj{K;2jk;lSKUs&AISa*c`Q1UN1 zKZq26XC><@F*|!3JeI4pj5tCQ~jhd+b9 zen(Oy`M946mO+;3lpSww5>5Ox$HFwQ0%{)sxF{TR3s24X`l#k{#?mC7Vd(E_JATb3 zeit1)#A~dZjCp@x0L%9g(q?-UtxE%VE*>M+**N`r%>` zEig+xKq|+o1QFyDD!-Y>&iXiZ2aD=C-x z8=`+oo=VwW66fc(uoq2Um`er+XJV-M@KkKG&b_}qjMj5gjd7%2cAh`Zmp0N8v7IE= zuO_1nuJkkOix+Or-C8SdG8_eXEO>f z^#^hltJt8`8G<#l2c%~#@aldwV3f@B-^L!Nr+6q2EDSwturqtE5_d6@{@j`409k+7 z$|XahWcSWD1)(V0m!#oSzUJGk&wHF#-RF?9-Q3c=h4i^T=aZ;#7xzftx=Ij`=zyd) zqEe{%c?$#k^C7RZM|n?0sJ~xKrb0E-QGPyQntnl7fL`e2-9K=#R~OONN><>#^Yyyq z?Npstu7+QkMn&<%12Ha(>kLt-`NDo(f^b{8hD+fDv3@V6;YEw@5^yLz9`(fidyc2i zUQ@#gw_2A(hlx7|%q0wlXxn#-KLI@kZ={Nyk9(A&-mjN$0du&eAjzwLh~W(n^SJ{S z8twsY5!n~?S!H2(<_FM_t6jicj2W2!M9+GZ+Gcw4)NeGeU*~k_*GHn;9?!Y&x2nNH zp=En@rb`t*@Y=2UIRnIN1pJy|6rGv60!^jCy}5Py4F3{|MjLMX^gP4F8sJFvU#T)VYseoeT!3!SEwVt(~i^C~@C* zC{e#j*=D@V_|)P{dG1gbV6NA|bhN3Me)oyZc(uND1>h`}NFA3G2PDt8{_u)eX>mY4@da(f%QH)>W7XCB1Q9wZ1r#p=bu>#2v^~TEp&Wz0E5b&`KR=R{rjv@90n8>|B}K z?vD5$h~PLKz{oeS=6M;TL#~a`u)DXlkx9-!z3%v&XBxzcB^xS<*>S)un=Yn5Ym`}KQl0;XT$_fq z`K)_SgB;P(PTo(an5j%_je6cHpB~t_~n)5PenZpZlyz``crYR3vK@ zZa6W@9Bv9^YrEYC_!;c7=l`m_gOM2M&; zFnZgc6*yvi4ZYVn7b-9LD;2C_J14%B#TB*WY!taKHrTuJlE2kmWIqxA3wkkPy>Mck zk?%SJNo`OWqKej`yXTpfgVArp9TWR~Q4Dm(=>-=i-$aEk^==F?`; z*w$~bEkGvmf85@3?t-Vv)^;Rm#3Ek2U^8}cEe`@#HNq+mq zi`^ZNmi*7?s-T_*U4kQdEAarLJBCc4a z-g4^Zce_}EC+tkyoo3}c|H)^l&U^nl@h-C#Zql+5#qZ%m#}d_{j&j?_fck5S+P@=T z@ie;6k>A8PUHdMqiI7z&?IqEG(HQZYqpN>hv^5fNExs1Jum=`;aRYx?(Ojly+MRx# zF(z0^<}V2HxV{*uqtgJi9Gd95PssLaUq#ksQBr;9i}u#J-@G2Fh7)S@$iRitzB0<7 ztssjyI_E|92H;nIetk0k(J#Y0<o%@4Nes;8Q*(r{(XOo%q{8{hp6sS7yReuaFx2IL*0NC|S zbS&$e^-sKj@ydDyBx}UWye^#ZTX1KYrmId<;BYWmHEd1vsPiNZ=-XLvK74AF5!YT$ z@@mcV& zmu0PUd9;_#gty%4Z0HrovEUG!*+}Gfr)663MX(j8O995YykaA2kX17!3tm-5ThrlQ zZ}E0tl-`~L9cYl(K_9uNo&X2RYz;E9FEK#{*qeTDWN!{$)gO`g3u_pCl+ZD$K=r>a z@TqLN!4vT18f!YF+gn`q&(%Dt9rHVOe)N8%H6J*C87e*z{48>82S1h_2plf7px$AN zU6MD`-AJc~oy;?c1*=}(+ui&MbV3qpn+GS4ivvQB_cx>bhfC^WIOiSm%*!}Kq@mK3 z{x+A`V~%Skq2-s?Ik)-z@_k-m+0U(oVi_4chQOi%x|(77+C@2@u|@eG{+=i@TmQgC z%`3m7EEe*7mqeHA{&Uy?_eJc><}-Gck7u|Niy!7ge&*qL#m(VvLmDYS{NZlb(o`|b z#8i33A;LYL<*GS5b#Pq^cT*qMK6O3foS?xPq94^ek-~!3F+4?07Ok8DrLZ)AR=JM` za`9TscTB>Pz03UMa~pGyD`?=Q$57*OY{Dx=3m&_?N>+O&`*63dzuRjc7ah|CB^!LtOJqnbd*GRzKg62TRXiLrLY1sqrUo zJ8>CIiazfPvbBY_g-zIHf9uA!k#LzId1k()dzQoc0VLw;%W9=mspT?5mDg`9^D-+* zc}*BF(S!pfeR7Oy@$>9@!sS9s<=t%>l`c4O6gQ$Y9uD9WnG|tEKS7|Ltn~mS4y?=1 zkN0Elk-h6Y|CM^nhb^Z{fm>p1#gYgk_C;~4;m+Pf!UU<3LWpGzs}nQv+xwlF_#1|)KZ2P#mDW`ef-|NgPup>=WF-+gM-yowI; zwn{6t>rnj@u<6K~X1Nc0BJY@~BR5GBD8Ag^HDp#Vjfc{OFNgo`7j#LJcK10Ho&^{*BeCqM)5T{&mgVFfbgt7e2Tu}Cu{L<#Vd(!D^uD%ak$pp{BGhTtQ?%1l zFDls6rtvVS=tm*;`V1qG0Ti5SV(pI<`0Mu0_RNJhfKR>z6*$R+l+7~y8B*jyN$_`F zvpnb=HE{Y_A`Zo<=GYRK8>u=t-r)fX1y-*(W?aIgXBVqZojml+*RGsbcUm7dpIi7Q z#*|pex(rraQ)7Ek5wY2Ys0vsqS62YFVS}nxE-Y^i?B#dnc;y6FpLK59wsMwoL5^9U zJW$cvO#K`>dJop5hk6fXsR|jCUKF`bzl)p-0s! z>acjzgpTQtW1SCxjz{VPO0@U=$1mhgUtm`Yd;#qFgdFM$OaRC$?^6HR>>lFWEzw*o z#5rnR!hZa5@B6ENK1J>IXOm!xrtOmtC->PU5&$hBcVh$xoF(MZMRrHtxg`{=F&Cj$E+@=mM5IeY-v8uOuRUK36WG{_YiMNj9=^+DZd^A#rY-oX z5g>6B>EdG*MEAYe3}5gisS$ri*cZyv2TxLztSJTSyOt|E+)V6=3&Y-rW<&VpH918k z03njG=>|95|$Ta`#QveZ62NTd^LWcf`_jk&PIEK#odv0rzN-f70|Z* zM&@y5v{&#%z{1X`6!~>4G~|A;AVl04fm%DT?AgliN-JiCa$0t>H7eyaT>Z#`B1l@& zm)DjIQL3d@qj6Sl1*^h;X#MY;$``x1<~Lq2RRDLt{G~*()r%BV@6c~li<>E1uy2h;!Tz}?MU=|wY?4dKyaL78nmI9 zLEcN#>xW_fpkn<&h1uKQJGQl{N)TagaKAk0#MS(UzYD#8;})OwZ4REK7h1sB?-fNU zp)HN_-fw2h9T7x-k2Ae*VM%+s3fQZT(h^?<(*uXa9`NHajSzvL3TrTn-AArU8wv?M zx`$7zf@!_#tdu-xXYOV|KxKj89-{rc4%p%q*M$CpiU;dWf3O_z_1M-Qr;3-3z5^$T z-gHoOPPqw(@cI7DhD7>d(T|Jqt@b>FZJu#PcAG3e0?%;i!YMd$h6j_49X6BFs$_U_ z$O9_BGY7&Kyr6yN;LgAFKvgkEWQ=aLKvwNvFOA^^eN&$R-E;BSgT-rs)n;^ggu3&YPp6f> zW$YlANPic8_{vEfD48%o+e`HS5p@=BQ3q|?RzOm6LAqnrT^cpJ;<5 zsk+y|^X*rL*nmviC~%QqM=DP&xMfF8%@=j>?BVZk5>R|j2i$FB(@H_6gLav5t#y)_ z+Bex~GzTp(f6uoCV}5j8f5cmLi;?y7dA`j47W$yITXsO^M3>x!ziB!Fb6^wU**_Ir zz7)^Bmnrk!eiffDIbThX+4YwET)(A!GIk-m9$;^w+uwV&v@*ze^D3YR=zh z#dOd7OSCy2zZ@qp%;9sWG{6ex;MS@$HwN~R9grD@J2I6;pB7ng;sYhG(}#JM%SDDj+f^LI~+%BL9A_=0j$C6ze>xYXO=kE(1uk!&MVF(_vP`0 zZSTkTj%TeO-gZ3;B~s=-x4^TbN2{NYs`Vd|Cm!aSyJo8b&fwtBm-h81dtqNnEX9Y# z?wg%)Sb0a_cUc(0Jp2W~1qZC`eCwC~l^2mu2C(dKviT~TxzzpE!WY4+!Y+q; zzCq}}EZ%+euG@Z&=fi(?8(0)<@tz=DqET)>jwyLlBMTlnsx7R&)8m+h!NgTX1%7 zUr;oYdB z__JK_yJKh$a=uu%h1rh`W6=4?MdvCj=ty3^i+RXa<@TfUGML*V%XSfydgw>3NiS^6 zMO!7_N1Gg2JCajYoWb95KU+-!{VCWpjr3489Z}VZ$9Fl^I(XP84Wm*4P8_LFfm|fA zX3RUz;X3J4srAp!a=I9-VV2^lxlEK*QV*8@39K??6T3{C6uFvk>$*&s#d^-SP7pIX zQSDG+xZmKFORFv?f8;3$E5(DnBhk9?N>2pPbRWq{U8_#NN06p_*Y;{*yr2z9;o{FM z%vQK_tPJUEv@&~jLf>-7_c*(4K5xyVxfL0jTbwsEW+(Fprh$Haah>iWvi%BKhB!X) zWmz1f+YOAzP0a!_{Mp_rv+mugTe+TqVF?^dB!c_{Q?I=kD9Eb62EnRMhTH8j8V(Lv zHn)$okK1B4tvt1}MuBZLo145MU=pqQOPlYTP#t5kI7eXlBS74$fM;tBJRP%}e$ zYO9a;jM zz@=hlgl0C{3&+!9MiD%8ES!)#9A+M*hg%iUiq`C1nQd7f6 zdr}X6-i7O5@ttQT!f4bSW&d7tx##iW70nG=s>s)=aQjAL9RJ>V-H$42QEj)8Rjfc8 zv0rTdDYcI;bYhwd_)xOF>k`PRV8l_g(nI{0s%Qk|MkopINWG^lqPrr|< ziAiS-fz^B5)b;U;;9*ndX4!xfdP^Ico)y04vt5tKpW8dQpNm4M9!z)(JsCZf3uEZ8 zHb-689INv9zXve6P!#8yG%I61sE4h3yfnWU1f(P&sJ-8Jde{?4PE(~n` zL8D_vlqp}FS2MWJuGhWF%5+pp`>EZLR4V=8?H1=#sLFyE_i`e_psPimUv^iH9MHML;+67o{RBd8rk8%`+v+c+IXp*0;>ZNW%@aX$d(IL(U9#{ z!VmpT-+4S@G|nf}E6ycZr7k9iFp}ZjY;glFH*Kqeh!}N4^L-cYp~hmO;jOm6J?+!Z zJG*>|T_UG4R+E<~*WWRw2<|`3l5eH*+pm13A*gW}=JiB@_hmY0-}IMk&d3|mE8F4F z+hZ0SHx{TSxA^?-Y_)Fv--vNS&X)UnYi{MdCPV5;GPJDqVEt8H@>flm^zNv$a97b~aeP@6zm>x!-ojUwO{@FkFXU$W)!7;apR8I1#E#aPCbarDO5%0h2Jm z-C6}6k5#nku^%nqbo|jVJy56gkmsjS6aGl2zqB+gJtxc1fGhd8IN_|_MU-6_Dj~L{ z{=$StWO0q-9ff?xTJ^>{5#~BXCA!y85w+Ye8wDtP_Xl0P zo}#z&P8H=U%mVP@*`()s{`V6!c%1~MnK!0)mT1%(-_vQynl~d6?T#QRM9oh#-+^vER5lSZzmWuxV`LHQAFf!S;x*U!FVlL9a7MG4B z)25%CZd8Q)o z*KzbYah<3{RsvPj!BD*mVgNtmF`putR7I*(3+PcFWi#+f2=oCx({j6s)puN5k2o(_ zslH86>up7?TMD(wLtUoRO8?n^ZHMxP2r@!U-4SSTFNCJG09WkHJ7*qZAq6E_p4Su zci(o<^c-(MOgCYg3B`?L@IxtYelQVMK)mtB0l54rNJ%ZWf#9eTS*Ex*+|FcKP!T^5 z;?+-L;xE!a)HuR2*8_e}EiJ%CB|l|+pj7tZG!MVvnMi3tcyJh7Bp!jp;(@uX>CKybbiPcmX@Nl&z6yeGyTKOn0nKAn5J4?+>la z0@9*q`ATULI01ypp;em#RCfK?tEg%v0ZT|URLaH|gK)y5Q>l?#0aNd_nvXWlv7eJ6 zBi^`z#xjR{irGV?4E3v>QlRqO?WPFTcf0G-ZRe6ftGa3sJ3-V0bY@87FQ2m1so`hU zR#3tUy`d{zbB|1#Qk_E;`7Y$^;yF{B)^NfsI8Y#dyMV@s({kvC2uKJ7D?7Ehyq`r^xDXOA4VvmuX^du}8zy#edDUI(3GrnR{lAmkJnvFq(@Kb5 zXV^wiZz91f<*$HboW5~FHAlJ*LSq$Qtsr2e^_Te%8~lg_uT1tGn)v;K3$dqXJWr=( z->r~9PBoh&c(Os`HBxl2GSc8u395ijUHgXV1=MiKj~44(pfP9?;@u1PaKt0DfJqh5 zm?wt`-ZKn-BG$r80YW&Zh_5#Nf<~!h$gQ~L{fsG!w}!vfs3M~|eOY^Ij8?m$=*90) zw)<53a(H;itPKYJXJ+6N6oaWVLuwe)0k5>aX=K6^{*;%G?HwUCUgtuR=^NxSW=Rv9 zxhq9qbuiw0fas5_>*#_mAT=jJp^}JdUmae7gWr7YMVTFtPY>L=T}&Yln7XJ+M?x8n zPq|zvQg9@I;;Ss6$$YhrQwd z6d;imc_a{`DwE;mo1mq~URWC2;FMBNCz7o5R$D{`2m}VTEB_zU&z#otb9$w|$wl>F zsq@}!p@J^YT~{_!&%%$F!SaH7@Shltucs1p9L(VqUF;sxI^bQGv@95c*H z)^>;l3z?Yu-j zaxthw@3vhRqkbEwxVOYx zQesE1O!s?u*<$_IQfH_JS|g+a)7bsE;lDG0Cx^@djd0Ej1>9X%U9WU86e0x%4Gzz% z9nT%l332Sm-0|F=YdbQ!TaO-q!l;>#;{AAv=~X9^t}Mzk*e2@$#TW%4+%oU4y9Et3 z5t|^zuk|w4{)X~jfihfAhjctA6T0$Mgu;es*a_tJ>}$BZS#vkd`T67acaYH2{&F#{ z@-pI9Kt+U;--So@jn79&6B+XRHX+JXU5Sn@ih_89- zqm5s=IWRd28%0Y0cN{U8wz`C&j9K$^sg?RGbN#;2>N^4`e+8J9M)G@X^SVq7R!H7~?Qe%>a|Nwx&kP2j zIyq41IMtc6j3VIm@_D{Q@XnC*xk15@G7`d;CNY2AmU||gO_GQGwn^xK?ycz-j(n;( zY(@iU{EARZRO;IIHaCo71fk`>MMC}-{2j&J)zi)T%gbEKouB3~j+)9)e04m{V3nou ziA%vi8cX+Z!O*#gtezu0rl1+_fGZ64rU8N&u>K6k$q{Wz>0x{CvY1#sc%3f~H;p*a zR5SU$4hS5Ql@)zv3>**HXLuMxosAAC=Q-0bd7SeY|A6dLc^oh?&U>q1E@E-stA4E( z4aZ^#^wG^T?eS>!&fxw09Jvt_z!_beoG_?}1sixP+4xIU0btBVD@CIe&r>Tg#;`7( z9!I-Rf)fS@3^>_nBgm#2gL6?6?44t$H%>uF^dLp54ld>Y&LWmWn{Rx~}=CXO=+oB{Hk{w;o>#6iYK%2nlbtDvnh8t)*dXc^qlDh}lq~HCKAuu<>ov zxEhXRNHE&Kc#iaT)|phyv;|d8#r}`O6QMaMEOiU#zw>5}*q(f^9K06Kx3%es!%(k5 zEg=J{t(1Zp$}Yh<$1)mBgTwvQ=_g7hS(>n#`iQ?~KNv|-54n(;j<_~m9H(Z| zIpR?lUmOcwwMY$tr@-GO1oywLpA)O03Mf=34+}>M{4PRLW|0v}F#7mo<{@#C@uD6$^^?#vK8mEd8*aRMFw_1s)2Z z*w31H(+b<=CAh(TO9D4Me9(dEqNrhi3#Tttf7#kAK@jfb_~+cBi$M>jE@QJDjr6|g z@LFtEPF``kHW%w2@BGS+g|sW6mj$@4BkXS6PM&xkg!cJnlHDQY;+!%vT{v`Hllw`{ zEPmjR!-tLNJ!@#pN1f&qk?E`$$BuZm@9_t8h6A!#ThH&Sy~VC7IK26(MexEm5L-d- zc_GIF@G!UzWiCGTNKe@3jm_H2YXqF1X*E77@$BT;@N2DMh9)e_^N8sJf~;k94bM|T zeAC(x^ZI}w4MnA+o>LU>(pnffzV$ytfRAKL*CAuN1LPTxt>7R`0PjXn+n%cL{Jf^+ z4Z*G|o45UXyd#9kysg2$bj?P1h$3J$h8#PbCLvT3MK&8A)xC|0J{lzmI?ai| zwcke((wR)SmCeZGcIP+gqjuae($}~Q#MFQ7u|>1v5(y3u90V>ovfA(33kp-MG4u<+ ziw$C(Q2)YFgvapXch^Ny^_Y=6Dbi{*4;(`i4<$+42H(Fddfj{)ov81)G+6{J@00M6-@n&N$gLTECnxOXF-OJa$_NFj6NJy67azIMS)ul8 zHobO2l}~WQDwKfr8`#q?AQ#{jeGVwGgz&By{fbdO*X^JngRQLno`@Bc;R)a9Imdw- z@`4`j1!UbRic6IXj*^4Mah<=6pYaERm+8>Gd2M=o7^PCy)Bf3uKzG%G8)D)KlM-d|2MwA zerZPRw3+Qo6!EJt$_KV*pq5If!d-=?=nTV_{!BUE)|q0CZMz{%6;dFih8LuO6da+j zGyEo+I&rQ6TKHI026C-TV#MsxtCp)U$BWnZw9cx8MgaD3dJcul6fewEEwTl(iLs)V zo9+CUHB*1PG#gcDyGO3|X-%SOlD=}A)u>FUWa-i4SW6UHQ<5v1`Guwshq8m&d@L*? zK*4}0xtUJE85xhhYJnb5PO%fQZK{C9ylvcq7?C-u0lPvt^wg5!cLx|gu>UwDM4<3? z*L&_aicR+W8!Kk?+!I?>)O~|3rsWGadT%)~wfyh41>s5Dl>w|ATpVk}A8A59w&HwZ z8Tw5lJ85vXaAW9VZKi;B&cB0ZD&+%NA?rm=SdLd&sh~AQK&2{kajdg=xLHG%$U?PL zbVbI^VINgC|3h|__d0k^?$2QTz6A;R(?(mZU?1c=ftRpshWN8;Ctx&*h;56HYPYnW zj=vQI1C_Z**|WY+DQr!*b-50^Ca0)i@Zai#Ah-OWqEUZ{ukXidc*{IV|;zD{6j92pdK5gGOBR0lb<=F22pVz^#B3%-Et3^#A<|`xJsG zPq-K_FK~a)0Mn#@4>B$N(D)S_(i-#Hlx92fTI5v7?%dIj-4dLXB-lr{7EOcPsjZ|# zlP?5(#8Ay>$aELKa^k&gQJtLe!jK2oo#k;WSJyQB$m@zxfF=p*jBF0zd@@id=)N76 z^^DBI44fBU3|0J&FWDT(4*d8KBg<^qKph-VHo(+!v=}|$t>7;h%sRZytFb;)otRIt zgVv8Wg+GM##&NGAjNZeWX<^H`*Bie&WlfEQ_*-a{w z`2Nd;?p?&x9482)_PBtoFv!xiv?)S-26aAT0~AaUyE}N=5}NAr?(L3ecd%rzLYf_C z?gEy=pbH3ZUIo7-ObRP`Go9xhNS zBvp& zBJIDxfd#TMa9J(mu@$jq@#oJB2=r5$ro4~p5cyf!?UAk>DTE!g+@4W`3hxjSAi2Sy zsUJ)Q6MTzA)XtT%66$rqo zn)Brppx0$K={Umj06h8-u=fWm^)6tk=f|TaLv4<&ofd0>q7xlQ%Hs7Wzn9BDH&3zU zJ}=K1e$^t^w|9#^&(9ez+e>yPj3wxH9+w&GhI5bGaSJ%z&(LoBP@YHg@7&{w<{AI? zFc#v(rdx|zJJk$Mz97vsT?rHQE&aE@7vw_;z@l87JEfE97eC0kTR068xMZUC&+#3U zF8*vg^uL@47*!_NIY}1uPei^@t8zy}MeyEsfmZT?sv3Y$EN(b>e)spsS`ABS0kt2G zyv0jILRjBP5_xygu=q(TmOC`1`y^{NoNbb~5n$t(~zMt9-f57r&>)xUl@#%OP@{uz-c5T14^v5*&CFbYnsK_wkY#_^;v-z}a$& zGCE|@H{Wla$tj!{;41F2!ts#eY=H}gDHcZkQv`RfokemIW3U<5T>Gu!er27#zd-yP z9TrM57@K=MuxI}k_wMJx0Qf`B2nF0&YUm9wu)!7JMK@^1?SJs4$|&dVvp> z(iOOjV_Zrw3zTl5(Na-xsOc8Vr!^&mXh;eiqaL9TKYPf2w)5Bsm`qOinI9{rodwTw zKQ)N0^TOvn3{bf!A1aiE+;3!ja+`qdQaOCj5`Y_}t21zbGq~{#5)xUGFxOA4+fL?? z?me5XfdT%QJMad)@v*Ak?+H(3$e0xPcR&szVBhZ|vHjwvMJ_n1C5NFog)<|tHe!#& z*Oi958G-c&wk6VsrrMtGq2R(M7yB0194UatHH0VHaeCVFGEIm@EKVwXD_DW7Ry!q^ zk6PvY#h5?ueYuG35dF%G!j0OpQL#x%Cv zj*?`fmy>>4YYLxjk;YWr*TTG}L>YcY4E`X`Td1xWG9n-r(U~?zYNji`t7HN>l1A+N z?!C`$MV&WwQC55I3+TI4kc0nWxR>-C4613MNS=T&ihGMYmF^pk(Ys5H`Y=MVmomp~ zOck-K2M+J&L&wq}x8R?TC8-)2dk&Z5{3;~BBrEWiHwWQKw9DK(JNtgm`=iTi*L)An z#Xx2e((C>80=uOA|5Oz0xVj=r07LnNx!Hv`8uhZ7C4ZX7n9jEGZSKbHR2H?f0^T57 zTK*Y9VNAZZ1YjGMF!oTHnW6W*G|vd&c4v$Gb=ir#93`G0s$Epn_mFOY{5Pfm46yH* zm9dKQ^YssZ8$^@d@p?HD2HH|aNDQWz0j)r%fIn-K9GZj+VxuvJ779DnOL<|HX* zUkkK-{e-hwXDIx70H;L7#b4>;EF${HRWdWwx6MA{oZxoy3IZ07x(_X^=B-1Xnk@1- zH&KC_+NGW!z8_&UZOCrxV#D9kAFQUj-O|86Tz6s8 z=n7`SGI=8c*Ap2CR$gETwx<~M)n*6;7S7}iRlkTac>3oL>LcXq2rKcxDM?8XhT@hp z!{pGTO1XHO8U?vH=z%U}VS2iel(n_@q@^!RPS%j%Hd`9GkJIHl!xKG@(c^5w70)IW zzM#0~!oiCR4$c+lY32MOjYF~)>d%?=6r=f0Z^4Nr?29*NE!#2lJHw<~F+HIxL=6D_Qvs4zP`lnImrdlHQB6Cs!Lua$K&o= zkt-qKu2z%Nr9}A=kG9pH6$ymPhLf2@|N9@T&rL6Wihcn?T@D>rHN>-K} z^;)1OBl^Wk<{1WFwwD=i^1Mki5#D4sVo%o+M2}1AN zON_w5)=?EQ+Zjfi`9b;6Db`*3zF=sUXdX2rLs}P|l8em;awWYpo&D^*9LCd`S|!Jq z;#m-Qz_P*B60oomYgy{a2vSdXzB_NDQnko+X;hZ}8VbiRq;tvwJE<8z$|5n_bI6V1 zE$f2OWi|ek1Y$bcIE;ECgs?xs$YSdsoVo@(|`V%QsFC5 z;pc3TuC^I6PG4yjwPkJTynvoj0$F}7?cmDW#?pZnPL2_s50e8Vffz2d$^_;WPGz+> zc)}N-P)!d$F0<~13gq(PuFpGh%vcY3NI-Xwh`*kAjeMfbDi*I0K5Qf@{ECC?_1m6Rf_Ab(Gg%(sw)amY;&90GcLpfaR4x3br#*a8-vWei7SLZnPEM zi3rCULnnz9nP!kM(7<@Dw zp2oZAgS-SCy#U_{w*w`F3DXSL0FC{dwP6WUmx{$ZfBlfQti9a0;u~|hXHim0w!!@y zVAK>7C?QJgRp~tg&KS+{rjnb_q4U>EpOZNfM& z`sA@Ymd3H#{8T$AZUDao`s6R$fX)(i*1d~XZYzF8)3NiRa-tQ;@>$^3vM%4p*&@;wTcBAAEjTJnym>!7hx&0IgOg4 z&+l*ai<7JNT|fYCt;G}n-d|)F_zD20L?A?5^Ebm3KGD@r>AuhvXofBW{WrNA6*o&F zp&KJ&FQ;uruOB6)pd^7buVDw>q(%DR^;@@WR&0@)6yF<56HlMJqHmn_(HDL%V{*V{ z-v?Ukaf)qtX0^eZ)7isl+P;X|^NNzONd2Iy*fmP5wt~A)`g*s=i}dcxZ9E4@3Qb}a z&@$+g135TSQl#gAZvatr23iW_K`)8jS{vlrLk<1e3GT#QX|`_I@;ML?^*B<{;AvNl z6GiEoM!9v`-=k<)-?iVz)br;-QwLIacuroe+^qoq%BNE;bzpQ}!Y@?!K?9NdG*boU zeP7tj%9hwfQ=T)+yEoE$391271lcy;lzc9w|9oV9A|ecS#HwpZZcGWN6443waY7z- z7fB@R>|9diM+s~Xr+hcu?-t_?9xIj@3XiBkH4;TS#R5s6&`n>uRhRMKuH`WYUsyP) z!xAHq6QlP^Jpp<2=Ha^AI|s@qiB{UZ9hP}6^a}M00$SA{rnUkuD4Qf7$Ja@x)i@T;nq&u*PG-{QKjK%w}>nQN7Jd8Bk*a9O#st%JBCOy-a1fkyO2%Z6#l~RHd9K5?ee+>U8wZb;Exf*%6?>Rqj1#{^pM%<+(sUAo2BkUD@& zfDtP8mISABPI0MW!ScD0v+8QMX7Sv;++|!5|0iwgi(m;!SHi8ZF={FgJjKK+ox2{q zx&jhl((SFt+J*lT{yiUYeAx?j8X(6yXD)5gMIcecZs&e)&WCHzVQNr8QS&geK6v3! zrw2Ueo8pn`w_~BciC1!_Ay1zW&b;8S%*nmG?8s`ij!Eo5m&iyX|OMU*Wn60>s z=>Z;yhQhJw!MOtQWrKavH-yd(Q!@jMV9S6UZoDKha?HNO>TPwIdtcQ!T!bm2gK~zw z912y#`Yt7$(WesRqHi-wHLJx&wcoPU2@to9mD9_s)lSCS%>9XeVyvVbuexxM*qn+! zdi}@2I@x+@Ys0K966D{#2~qzjIQ9>t+3m`{*t~T}Vi}4@8FRv{kjLdRnw3A#=4**) z4KzJt>SR93SH!il(tLJ6jPFwfFWs{-0b2#SYxTn);*0CbOu46a?4tBnxPH;o?AKVj zUGmAeb$)%9t7REG`BpMOKT7$e4key;mPdB(olUl84uL(R>pi)lOC5P)vQAOI35^N^ zFL#L%Rsp7%?JP7LS^cU;ScXFL(tx1sHSfn(G3oy<&V_&aM;qXV6{H^9!NQ8 zz}RDvv4U2vp#r~w#?Z zJ5pEofSBExz?AmC1<8dGC26UxtsPvt9)m7R9I5C~(S=s)zi@NBSdYV4e%BnNsV=D( z<(VD0Fo?Eq6+yr?aJ^Pm#Mg@G`UgqMCKoNSYOwJqab7tE#(npQO(rsL56m%lR`~<4 z9S#kgPHp3HwLPjq&xj6BC}63!BAFFYjEj0hctUZA+^eC&WV1Si9((wES$ndAY2bgz!7A zkfX8!&Jb;RUjy^QXlhT5@DE=h@=4M)YS9T30PD1Y3Cn8d@!};R1nM*yB&*X&QbN02Ur=y63E0L^)ASKV9`BK7ebOxGwgp=TLCNq2c>{KT-#GLizrs8W5*J_Dz% z?u)eV*P?|YUXaZylP@Dr8w|r9+F>$E(?9q~bMbHkkt`xMGl)kt z(}bHEyXpsnfp$8@Pd$~Fm9*b93nFHu3}H1v ztPw2l&Qsh9DaX^K469n=B*@eYmomhtK35pujp%@;9z3V^FmJkYaBRx4(rM!VU~776 zcYMRqn3F6r6J6K`7}n$0KKpE(jlo%d7l@e@|2{;pK)6=Q=&rmH8S9W<7??Os4Ng$5 zcB&g=VrU)qP(UB}ny^67A3>C6DGvbGPhC+da}^=esIbynyi$ibM_kZLfPdg11mJZ% zsn*kl@yJ%Gj&ya^jQ^E_idasbzW-tm@IXO}Lx9L~>b7y@Cv63#1zfttVCc8^1-orrmIloDUd5V}`r#NE3G8d+O?=Vn*) zE7i@OYk&Xm;k6mdcSaDS05{t&v~*2TGi{v={YXP5K=HBB5u{BHD}>3T+;B14`? zM!ApU(ArW#88u3vxVgDCwUtBfbkZ6+r4Ju6-_49RC_iFrNPQ zCn=*$!Z&Z8(BH6@3m$6U+5v^-q4Pef-b>Ntu8H5 zrg$;9i{bvgLPyiKt1Pd=ihCpwG5&=NhP=<=Wbb8Dt6Y{fq1^`HOJZ^_B~2_MG=$mu zz=b-VXzoylqTzkD))@SlR!G>3ml~oW0-tD{>REw}b;?_SHamlhq9byAKMjYh9zicb z;bEqr(}0E2H}nAvzOqy-_nyoXr39`8Q4Z!)x=b&VEp!>4h;S=U_+NxON$*gV;E({F ztYuG)od}@%krI?x=E7`f8;=!T4Zr!0%G~YBLIn zd-eKX?>W$P&*DC3iNQ=u6KI%gRs4&u&;NIAm*fy+mA^&J7Uh`M{z~at#Yah5UWps_Y+dSsron!U zU7~ZMshoZBsAvLPoeikd)ixbu^8y*j1w$gMR3&tpF83J zY*>Wz#6?T|%Qp9{U1nprt#wU(84|?Po|Pl1pV#(hIV0io;JzT4f?mu;PBh~cm;?E12|Uvz&;R`OmeJOnVtNG|b`HJL%F?31qdlBteLE*M!!1Y-o_p1S6c@)0)bLi!f z*(|Q7p!D*69~Ny5xgNW^&Ycwv6ow;Q%nQ` z;chN(y{%^P3snzjY}HJc_*38hNPl1Sq^D!6p+pU7&|Cs{h(F!m8z$uCy7D>k59nkfg4ROhTHh7z;r)_SWX&_^Nx>C`uYDP6H z7aS~jH(RlvU8g*~&-Z3OrYdjc{RcEfAI*5(xUv?wKeKzWMeY$Ufe4?r; z9Pf;8AE$R6rA&VN{wTsJBRGmsv}JV5-MD{nDpApRyMg9>*Y2&#Mi{^q;PnmC<329f z712QMYA;W?FNUQNo@H_UQ~@HHxxYGlYoTzx+IE%`+C2HxSYAxDZu;F^d9m=-s?Lkp zfsvxp1-t}n;XFX`5)^$uOXPAmGOb?AV&&=YL4eG9tu+=UsDErzHpY4{(0W9-?*E~H z^HahRzM|F#xTVBzefyF$D4VH2U;n@*pn|It47?q`X$o1Ps#8tMP>>P9v@fl#3$yQ6csX z>)8uqt5d_2dG^uwa4Pu$ydYR1k)^_fG(&fNi$d_c0CB0~#mp4JFtLkH=hj%)YnCCN zumv&`pJ~{x`s>$ifzv_O$uq^s6|{IA`CPvNLl-#6|%-wu)NCoF1n)Vj$$`qpf}gD1QK?hp!)G(Q9V z9B&dg_zk6ZyFME^Ni!v=Qs^MZXUUkcCcR)v_FZ^I(Nj{nZjqInT_(u}H+(~?W7@%< z3?W;Y`2ET%@71`G$o&KNqAIWUYAZ6#F;H#(r`hIQlwx=NRfi(vn5}|i2WuWNfJVFl zBy6cQ-|!1VUp%|)QZ`A!?WoJ|91bY`f!xMbA#Ms?yzA0;0Z9)$Wd+4Ep`@7EXG4M7QSsznGU9H z$Sdl6ZrJ6tHQd%5nYrxLfzSln@|}auNH?u(cE^oHEIAle021kj;5zdWY_UC!GRA0g zC83?oErhMim}TDb1LYgZdX7>xV=~}pYr05p)gk!GT|&0H&@bjQw2U1#;dZ}{R$()_ zo+?gRfBq}IOXu*sQjER29|7Eh7XIM*U&o6r%F@QnVxSnP-|w;d{E)p-nd?L0$`0|Q zduadfIEEqoG%arwokPVOfeCd>b_36(p^)!_0_LYG<53M2gN8FH z79RIkhnbyR-}dnGFQixunxV8>v5BH9O1hLs5O#$x;r!3z;wBN(L0WenX8C7NmwxBv zFr9E%BWT;b>v10_Wg3tk^v5}g;ygq@e2rW z+t(h>1^r*{AAfAlQ)p0$vWBV5V6&!&F`j&K0#uzDGu9iGUa1^A#2ZpFOw(grw94ub zU1HCQ4|NUI#>2Bk?_Tm*)r5kM@D>tdO)oA5klZ~9{jo= zqV~R;V^~TST*a-&0X!xt6biXx((OnnmbE-AhTkUCVQZIg<$KSdYuCV7qw3Wohu?nj zNcFQgrI>R!H0ycgVygQuIb5cEqB{_rTx0UP?C$J(oRHIo0d=y)wCp?175G&C=Z}!L z4TIw-ZdR*(VdZ}IZf-YE#>)*+(@xQ9!~S`((^EE(#5xr7C9V54^H|Z)B_2->AfMBB z%fqR|-nyCMEtqoOx>9WSpsLh#m(q&w(M;)|kl5jK&7hO>?%>2VV{e*)U>;HF9m+BK z3+KU937X*uJfPm4OF!r#Dw~YlgB$sPU)UYdu%66u$163d^hR2TC!$=X1CU7VsdET;;J;KX3msVNlJ)@o-W6KZ+r| z+B(mD*7duwYhJyscR3H@#TP%bo@O7nrB=0+#d7T=Wa0&V$g=*ZRF)M!qi(H5uR_BX zEgzRAYmlvaZMIw@h)!&*UiU#KLs4L$p5U z6qK}{pZ@ZT`Venic|7^52I2^Oz6j_PJ{)4W0FEXL_^qyN! zgR|MD0e0%OPQi+8z~p(fsaaiYsNg=FvZC4r(=sv4@_o9T1EIthRX<{=fTsTU=_DB8 zZ%#JlIW;xLV!Ri*SfoajL8ozd1vR=lWQMV;e;O6L0Txk!)>lVl=D;Rw#oh9gD;T-O zwTk2t@Q^_-Nc_3)#UASq_jIaP+uHADz6-C|#c%OZ_$K16MXsH1?)p~j$(v|El2hq5 zzh{d?>k2X?>>}@iee17RtC*_h4BCtxrZXg(cHXvVGVF)gXYsI z?|%bT!H-mYg#)D(D>-&XR39+Rw9mGA?qWEw!jUZXt9eQW&`Ktl&~b#mkC^$7EvaUh zT`n`*H=H^9K=g$ud?4X3U&g3O{QQX|^BkbAF{XyUY%=!b)wkL82?q)bUn$}Xp=RI} zQ_Gu3^DA4_%ICyQJ?<@m8~l%gVFIIL@mrtL@Pi_FT8|16JDXVh(Y}JF*+e4M{ z0E+xE&BN=u2Na0%Kgy+3FuA#aqBWFW%rm}IFAz54&Gj6_%cgbMTy8nq`?q7QdqAg0 z_VFC31NB4%WVl*>nJeh5SD3hl!-;s}FTG%;4xPyvB{1wZ%kd_rU$j(%@YQX$#Tl0EIL&<=}^8YdQl~GY{VcRN5C@CNzT|;*a zEg?NL0#Z^U-8Gbe(j`MPfHVx<4bmyyEh(J?l75fpeb0HnKl5kSnzi;k`?>eNulovr zs(c=^wzVHc!E3?emtjF0RZE+^Vw>W;1ws_%iYa3m3fI_)K&S z7$TZd!1j4okg^$YF#BMJJ|*XBbg{}0rohH4C*e0ylYs5O(V`I&p<{^8uOde2^RfP} z*x0Yd=VWzsF{1tCT8Fg5G~@5>=P&#x>e{wt#GV{Ux!4$O|FeHZYEJ;m27 z95;Q#74&f%&!QLnOJp3`qMiv_e79r z#I8~34ZB5iN})s6e)>-^HK0a%LNyc|UIoj^mGgeoWc|tgulcYixlNX!zjWAGR+| ztQWaLUrV`?j$6Y;1*;#|hJ_{NR9S1Ls-;jva(9aopEL8m$iF#bhLrQa4B{@H8JI-2 zQGY^Q#Bus*To1ON#Gk==3;w&p82B7$zHbR3sAS1w>@JVZCyJOmXRYu|Y^X2MxELno zoC423@EZyIkim9b7Wo$XI)O;fS_+L@h!WMeU7M%xV<2l!(J(=x?59n{&Rv$F>Ycr% zlD(7)J)|`=ed2t*&I~gBd~YWA8=^V6Ztdk}NM*gr4`+S3)C?t0A0zThU;c$azAr0~ zoa&!-?Gs2(Oamt}nT(MPF`LBA1X1>u83p&v=k1o&lzq`HZLt^5fqd!CtUas~|EE5* zTF>x4^13>#UyY`?cIed-%iH?r!dc=$UElK`2LNSk7R_MnH6GD)i&nAdW@v`c#^>F@AGzj4`lPErc1y>u(hL=kP+L_44YtoJHCMDxK1!4Dpa$A&9+L1 zUd=Cnz%(c=Lp&BioVFGR#Apqyxw@$+=j6(KLu-)t=4)dw4y<+;brxQ3G>fgKyp45H zNTsB@qnRACItk%?$=++#r#;D;#0EN|F@PB-?WL%tpm}ZGR`#Bp{lzo?d51t~rgH#^ zcwv1`P9|hM8mg?4@%z-+=^&IztspG+HP+pnSqwY3A|1idKHS#dIt}rgOSb(HCSem+ z^iPf%G}Nfr{8_A(N0nk?@EYun&%Y%S55MCVI!Jk%j0k08Y(zO8wy0Y<>pM5@4`4Uz zMSCD2a-Clq_DWsyNrb~}O)2K6ih0Ahro$K;em1ioYlsZA;RRt_eHQ#co@$Got~^(8 z&L0$NI<=a#SHn4>M7BKp;5R{wLVcnhbA)jq~=0MFHRb6 z$_WZ3==_{kk#IsW^yv8tN@)h7_bi8O?F>C!lPf&bP3KT|?>?MFqp@>h7TeHHGsS7r zW|Qe6oBikSkfvSCS839p(KM=~vZ*x-m91sBZeNm0V~mg}?Sz|T(x|>Gni4Y?E$t!+ z?09Kqnl2A(Sx2!7XPdhO(%fZJr^beki+p32M(op>HRRK{kZobfX;N&WhPVSY23FXP ze{uT1TQP}JzVsZe;d@n9vZhM5xQgwGxC%)|QSj~KHB(#+ z8g8nIh!tNpbZ}KVO9uutgW|?v|KCDiS`S-svlc<|s0ZZ??4IBiGUSF)JtQD>uBu(d zzI#v$bCB!a8T5Q%;8(eDekO%d=}PzNVCU`T?J(6+MX4{)Iq9U8wBnhDzWR=xwUp4igbw` z3oGq3N226-ciq^d;=Hl2F9=VpPC|K@7{>9g`Kr1)*&qR~%ZUEULm|q=S`e;E*{g}% z^I$TN4c@lbHwYjv7K#V~bS+h*vH9{m|31Pn*e6rXg`cs|0xTv$9^M8DuLu`>q6@KY zu)5=Hha9cl|!8@_Q_Gs3aYf0Ix5EtbqH{bwXSN9$$;5gTVr`?Q`=> znTWC{Qm=5M0yVQ(8E8gG;KzM6Wl!uuquYaM2JxXjv8aNpUXoUA z!k#U?qcc$OrG-p^6SPZVUtf+Ez^7!9-^l}$USp9pzp*>tu6JjRWAEv|e|Y(@KJT$a zZmRxdh*7(oXEz@HU-`hX5Uo^heIfD7OmgM;Dt^on_JWXo0}+zO$FDLaJdRrLT4Xx~ z=DvCU$UDW&N&x?Lt5;>DsU&O@=dmwLvQ4w>u}mf?gGNw3 ziDn5DwS^tpL&Uv8v#b&ia~fNAO{NEt-3q8PhgYU=T$ofoxr&i1thajOFKeLU%88M` z*&A|_+~oVW#DlR=@A)5U;sD}Uvly0(y2h;`$<$qbgLBTLHbe57kY)sQfhq}T|O^fN}J`e_4U$!S2Nh+Sdw zaNA_TZoqpy?%t5C#LyWmohn+SS`)jWw8iuc1L=f0v4-(?#n6Lh;9oweI8*iA(+uKu z8wx7n%siyhKq@nCZ9!Z@|EF>Q>_)oYT_a9DCXT1}a`u(>^AYVy+IS=tRONvkXTvGH ziQ6F2yOS<+^B*%0g^$ZbQI{g^02aq#fau%Rq;Q=kVY;3_-K(_fB|4>=nfW?zt*3s; zSWo<(>4AUzKBKQXbNCYvJN-;L#h!T6P}e3g>}kL{@aj~@ZHnvb=z z^0GvVUSj$e&?5w_q+ek=!kXZ;&eY!2?xxr}P0?C0^rsnt!D~du@S0j$@@CB;xk=($ zC|6H!Jp+bNK(#XJx0QoKra8VS+YvvX+K#QVvQxrg$4H3dvXrAU9)F{=o16+6tRw12 zB`xA?YDPLa+1wjrD1pdJe)82)IGp(VTeY3f`WQo-&QM=Xn>M$ND8YqO&qfx4x`9%1 zb_c?w7ws#U)ttrgoh45H3(o+D7d0!g@1escJzPI7XdL^;FG&^{Z-h%Lp@nOnLO3qB z(3=^lOVu+dTrwGS@y(#{V>Fb#n32Wb$M+gj%jG_516i#Ft&YSG^ zZ^XH~Fm|DGo%!8G%N4f$c>)S1rUk#UIL`Q7N_>MD_a!;eY*sPbj==U<)}Nj)rJKbn zg|Mm|zU%f$83ph6cvo2@^9w{;j%L)l5f1##IJ%{*DfmTn)hl?0UR*xOL&WFDv%8vun+woUxWbrR`h(Hngr>Ni6W59Fl1B+R{;tjvv)1q3#2nr>|;EIm* zI8hFZH=d#vQAOmSOD9wR9TawLPV>@QzlsjRY*Y`RcdVK+`BgqJT_C+&A*e#9Pv>zc zVm~|J;SBRT@9~|pw1LadYT^R9gJ>=u(`mOVxAy5TvqqTnpCU3fmsS&7UsX*YhqYtg zfza@DUMM6h1A;-Ph0}%nHw-Ew!}~)R3fa^#z8)j#A|8`}P45rumz;-+mHs((fy38H z%5&6v#pNH6WTff0U*wNHpL&(4f`bX+5Vj(+c8+}?ViydoxjEc*tqlV@E$zy6k@$+W zLQAQDS)r(oXrJXJo>sNAP7D5X0WHvH91KmakYsYY-2HjWeu8zGkI-fn3Ts)sJ!X;l zhCXA)z_4|ucAsG z&h;^Lq(tuR=KN%Bc!^&w{F3Dh_cBb4kf<(5kAzvwGtE4GlQS@8O>+1s*_* z9@TuLt@xuc2&Wg&2~@`g9BWMi^Qi)6xST95?703p90b|h(wZSTKJ4n{SFt#@g+&x+ zCXMH}D2>{zp2KAt&63xn@@69NTpf8-acFqqA2~nK2 z+5U)EP!-;o6z=UbO?R2shRI;fVTbL4p*mYVM=U85J$*M`1aZfy8_-r&naka2)O24Q z)xU|P{1Y=yLJMSGAxok$ai8`BVn`eD?z1e?uLWPrlRFDu*5jXAz__cYXlj#K zC*4|E z7bX1eZcMsPwh^Qc^J2pfw}(1WmWf2CEX#bncBS@OV62#>RxUT4?o$|fX;y>kT8^x1 zZ@TME1$9hb%96gppm|f?f$mQjfY`KBqe&%O)A$w4{aIq}x7%V&u+gx3dMu4P{F6vn zjh5KVfOZTq`(VWG@wvCM`{|mGNl^R=U%Zp&?MfEpxxe-f;PfDZoj1gaLN)|6I z9((K_okUbgJRLE$!GL*Vu!S{8So;4I{C2}gJ)yP3ZlM~R6aXk}j^E9aa>VsBg?3o8!Jeaj5B&h9d`pVl;oU&21JhmqQq_NPRFmMVQ5KL!= zvcv-!W#z?oq)~#E@LR<9_?6Ns?-h_aa9=v?jlAkJDa-wsnf!CpDzcfXc%42(Vhg1= zLYrlU!ehzAg>$UxFz!cqnq;?)tX+5!lm!)qCoD8sVg6M@6>*II2l<4dusSSF_ia(H zPqB>h_(#wL(V~iy#yu}z7(ec$kXl+etLj7C!VVNp;er33zm^JcWxH^E(jaoXw~dg4 zE8Za@i>fR?&6s}BDll?#cIw#HNS6uE6$o?emTegSDa@jJpweWdJYB2^>zR&iZ2T?p zn}$z5k{La=uxgNGv4G=?FKELxxp_sln^|5r=j^cTYL21kMB`_etpDvM%qJqwgEHZLEsCwub{fs;WX$}8$tfjme;UX)@|Aj;uV}t>uk%uX3eHq#M^%7XopXX{2baBNiJt-` zX9-rM+WE0+JoTdO``Q5`5<-bsL>u~=l`Swp9vDK~Ntn8-lH2)BxYn&BErZx5R)#q& zHVIPzM=y|1yRP+nluVz;HSdD>yRYej_)7nb#{Z&}-C@A;>ggTKzYobx^$o0RDMCWc z!mMa;l11=#nn>S8SeP|YRysQ#P70X<7qR)?k9ZxzrY@L9t~zgnw26DOX)P za4v21VDSrP*lgns+7p}yq;gMy>8_lu$~>FDb9y+s{5}${z@tH|EY0K3_pPh zxbM~9p=+jy$I%ixpk3f%x_!L*<3|a%J%ifL5R3S#Hi3aS9nRG6naiTifFJ4LH`!CH zqF+BoN;;*M%svs*Ny!oD+0Q2}V^uB13U0JcZ#t-vb#J=AGSqP$dA^U1%#K>Lz){EP z==Ftn3nb8yI6sYIt0cEh4gM(2@tu6j5&c668a5uI8$OQpWLpS{*w5BoJGjk>?G&7p zjx(ATlJEwWEjTe$gr;5RZ)g;^VI?vfP;zE*UYpcX#Mof8L3sY=M>Kh!O~Ypcq&N^= zmSp?~X}l^(v8mF)ymGfKnD(rn&{?(qX2g5-cI6VMVwCZBO6GNn`!FlFJmc@#bJ&*$ z_4Y1ryi;H+ZfpULK+~0N=t*P^J2xo7%b;VD4M*~^QZXda0&Gvk3z-_OVe?!D9h z?vfyN1;9mt-Kei75*z)%D|LV$uWW+M3Jo%O!v(@Y6Ptu(v7cBOtZTJTaIeFAkj zyro@W9gDNP@>nt%?0yV~ETLOTc?I%SmeE1#L?`zO8=+ltY6-cbZ{!>~#WYsmlFBIm z?i9AQz%j90$wc`mxONX;7uLtH@)mf{4Jp^j=;qP}kbSg<&!cq^qmu=Ir?!MMUV`Tp z%eS-sxHvS53`Eqh+pO*sCn+<}3a`F(T9hqzpp~mJ{fW@TjB-et0#5SE=H})igomkT z*Q=HHoNpys@3uGv15Z%^yf8`YMEUjceT}V9C3@(m462SBb;mvm5BY_R65^CS%;^Nw z72gND&M0)L2Y^IgZzsZX8o4HddVjZUqI})lWx4IM?GuJvTP0l)$$0bkQW}kp_b61| zkldQQNh^)KyvHHfvb#Jv-O7|7Aln(ZMD_fdI+!K#EYcF&OT#0Xya0HrpG7($ncPxd!aopo#}J!CQ!;sp z@-!yu2hHHkUAwy`|Dy=O{JXA(k!ZTSu*T;7d2s|gf(>@mad^Q(9WlG+cM`POj-gfX zQO;;!!g(8dwHk_B*t{3jp&bKP6JUq)@iVHV!m{vEAl^Tso}m7Cg1+{%8TX&4)!*1@ zBxbz?Na0E{jSMNrdj>)KP!3c}Z6lt66{Bv|)GIrX55V{V*m1~KSrZBYRebl(b4r&> zdg;&K{WiVG$pCvo|>fP9h3XFYLufvq0GVN}$1((K5Z6^S_h-(>( zL9#q;&%hg;X62aWu$>*$D0gL^vCy8a!af5D_ZRiORN_BL3sp9Zpav3X-c$yYYNeCI z{3SgCZ|5r?6)PB+w2~ti`d+6-G6{KAMbWBejTBWX3t6kJ5-Pwln?J5e6R)e6QH%tF zWC@IPrmF`SrF-q{aRMgjEyd0xezc9d2rr(BIZU-3_jo26zl;8EAYn|s=C{0WWVyM? z4yelL=S0FTNT+q|$a0+xQFW`vBk^|AiWeKl_UH10F-|D$VK=qxBvifI-`?RDK?GNQ z&Nr#rb7-T_O{_PYZdW%+fH~lUaDLOBYbF!4GyZ`z;iq_Yn<%}_ zitcp2sL^)cdjo^5=x=p=&^ZjM!!oV3<4WUrkEfPu|X8`WP=7-7WwQ^!@!0=X5>oWoT9JL`z=4{|G8`1@opsOR=4rso4lYOc#G|WrV-SPDb8QrGMS~BZ@V@os6g>tD}b-e@g%k zT~|cs233N%0ekQElHSTqMSo0g>vW@GEwfqTDYwz`&%2FoH`!#1;vq$4-j^x7mKj@> z$Gjz$L*!?v14_+aQZ|qcIP+ouGV}$xpNjHK&6PDC{(9mnB$mJGcP(c1EN&{)27v31jZWu$9kx!ho zs8dTF%#?>I-jd zTm?tADANfS)I_l^w&xLIb2T{66D*EI3i+4>G!{26^6ndC@8hB;zH_ebPc@8M+L4$I zC!bwCW2i)5Z0Jj#fRbqSb&2IDDk3*{YemI86U#k&Sclmp&0hAw4i$f_liV$S8e0Av z8Ckz?8mTvWohx7MAW^ndu0?e@>2@kQFMEi!vwqCG|NChK_j~`c7^F`Kw~5GXv48P) zFK2X^2CX2eQWVOn#2~o)n0w~Nd*V;)W^!R@lY555)c|xw^H9RWk69IQy54+$JwGzH z`&-zEL8WdO%xgs6{^HxfDrltRRJZROMhn$_$8@_3Zb2sxvY9>=;@tP{t{gjW8T+5T zz|-S-wAA>Nfg^WWegE^imcnHANF@l+DjX_Bq_f~0Xv8@Kem(@v?+#dvQAV}G=09|g z{YI;q66UG=7_Oh6xOtN?ytJwG{#0atiMd%uN37ARxj4hNpZx)#-{t&iXSh0|CBUGd z`_P)u>e=GO;aYhOJ}OcHeSnO?g)W461TBLIYMHsZeGxFig7x9J#(2=S8(wC&mPD6q zk6POL=5Q^uN*SM(wY8>ivH&NqHNhwCt}^wsJ#O_3`$A4tP57QAi5KvB_Z0c&j@M1f z>BfcYrs!8mf!jA$zC|9fKh3>S+qeJT_l{rWVVy!7LyL$a!lJai+E|TcJHoLEmom3SRP{-8Um#ei()jR_8o=yA2@OrE_P-`@H$q*jMBr7FNKlT%f8*`fo`L&D!^|(+!N+H_jnle z9rp$LZm)d#JJpQ~0N^@JKf{}6rsKl+Fh7MToA!p@djGmI5a-dCLX|>Dca6Db7T61Z zYrDSE^aooRKmpJDyPMh$EIx1>5^Lq#h{1*kLB<(OD%w-YK&!T4_A*5^pU+^Zbr%sQg%Yd@s%T^N!#6G8%b=an&_4#W=Po@5ROb zeSTeqEWt6R_jk?{`p111@K&c zOFcStZ25wtW?Ojbgg{8AMy&f;WgOEDII2TG z1D#S~()<$!pCi7LOQ-^G$zcB$0{xn7cU22>s`J%a-A3bmP6^r2)|0@POngh4_NfsPqLP&KEK-|3CF`zVJuO73)t7ZNXKo|^W(5vc$2WJ4aVMc;0P zcyZN#6}<S-2(NO;-gP>S zNe#T~h0|_`+M518c!^Iae1vTA!Dw;{4FzZ-oGF}USdCV@`9t%d=`f1^bI>a*r_L$y z2qN$FN%%g+@Vmh&U5mk|djybXDvJFSp&I2=o1JMTG#Mc^7 zqF}!)y7&hnZypl{khe?ai2sdaRl9-vf>*2|#n< zB=q=9s*Ye2bIQ~8r~PQotkAsp)UO-?{7KqpuT%HLmEu`EVD@5}$+P|&=t~!fUtHAW zo?@Ek*cbwvFIP8g4F@zdaW*Ahk4|eAs6b2sW*H&xNGefdvC0dBRB1sqUyjhWXBglU z0`dJ22mC_*Tq~>%9h@$p{TGg#!b^qB{}_5XmiCsvJFx5p$K@MN=y+Vm#Oq3Swnc7g zNO}pt@}*VQebprSnPN4svl8$w#QMtUv$HRXusdj9lkg|%$Px}<(GL%xwODApw~#&( z)$R+Zcj=qIs{+tBoOi}mN<0wU{^&dU@nYT^q~Y8)vCr#AO5>vR0c)x6_1lvP##pv2 z3A#UhwFpOY3Z95+6OQ8IM2>zT?4=5s?~&|FrXv#7*APy)VLE?Oq{_k}c96W-rXTXN z(6<_Oc`<*Zg8jlnxi9>)3x%tl94YUEeWk=G(~GkW`7n`4atG&h;4eP?g5mc&WNm6d zd@@O4i_U^*pF`WavyDH)ZWC=n<{Hz9le;acl<&z?E7SSO3s=!lt*_ju{tetRgdlSq zllwG9;y)4cUXc#_YU!pZOJnD?ziu@$r#y`a+&5KHd)tgP34PbaBE3I&^myp8`q)nQ zF%xR@%j<=gLEll;(QH5rxS?EX+z2o8Mx(tc#Na=!&uvxKOX7E0Z zCe8|mt?RrCp)@C}P8@gi7cC|Yq$4*Cgmnx(x1iF zBQIM7IIvAcb*x=z{{3HM_byiT1cN-G2^SR8rqvE=aaL>mX_= zZ%j2GdGn+e=M_GP$d~*0dCA>52?lIi+Ca9mxWp;)g}&1^Mo#?T<~dFN0e2zSgm7)z zvyP!nSsJ+nCndX7YF(x>UwluKN46B-yNlsMCRv0(xXU>=3WY(ImrCL1J_a1~uB~0) z)|9>rr0mEpkE%~&X!KsB>vqe%Z~wu0fNF1mZY5d85zQ|jGEY%1?cfr5&prF&)XQJ* z!Dp76;whO|BR`aZhBQMt%g&bM9* z*HtS}er)74q3Y$TRe;T}Rb)_az_kEs(nimIVymYETDB!~@sa1l!|Hz5w=3p0l*pc@ zsW)OFImvFne7}H^$H~1~vb=vG-Z|X(e6l|r)>zgOYt2MnbTYa7lBv4x`0q<9OEEBM z_B(Chsgg4H!ow>-$p|G{q>B^gAd0kA#SN`J+6^I+}P~Ov#~-;@C|%AV^3!#o`p0|B3eH zEC&AxRpnmlU^r&9PcQwGxT(AoY{}s24cRc9!ns9@78)GUH2RCl~7!f>l9fcK^5e`>`bT7`*7}5bG59tD!uSA^KTcc`8?+ z`*sMvIYs9F8kFY90OhzzLsqEl$ZpaJ{0vOBnjjSPV2?oKdhuaobS^Zuf;}VCzc>al z=ET+;v7eyW>(mh4=<$T78;Uev7u}ang-W01$cu{4a%kc$ar}jixN-kfQu6SP9ml77 zGYd0x9~?aslgh}rnJTCoF6yK79@apHdJiG)x(C$?odPvq!=?Vrv?Z?2{QMB*Nt1(7 zq!M^#Y_~5J1zVPKILZa+MhO`^L#0Pzxd%}X{_p7IGV%poYgK@{;;7y~Ly;?NmnJ(y z50Zdw`yRdL)eaS8DjbXGh!y%wwiw$6}aLJ|$-BV=X8^*U-tmLoX#RTxwSTlWo*n@Zy%^@kW9 zJptXXw~S2bA?zqT5>E!7pt! z?F?++4Y`0rZ7=%9&iBgG4woiPZg(j$t2THwDq8JJz%%5MW4EPOn}z{_#zE)|%ALaL9oBVQKlri|W#<?e3h zRlVcYC-74@g}6LD!MAAbCkA63vxi`(Ck1;-VcwXzRzS}}dIj-V^}RYwdiIw&k|aU< zKLiq~Phj7DAf8WTZylXlg`aY{^xQBWB(G`M{`vLvwLQ_}NWKIj?oKSbq~s(c6+Ak5 z0^iL3d}`K+4LOGV-VwUbVHRE(@zG%X5KRHPNddd((Q|gjs?)Hv%U`Gdq8WoejHsaG z5&nKA+ECHU`|oC^XoeyyCV)3Ct4pXO{+l6+pom+X4vvbiWn+Cs?0qXL&XfBLBJ!FE zROm#BURio(RV$N4U@M*k%(L93p%?OGt#FyRSel4e###cc-4H-AGY!6OO%XyR;3+8Y ziiTqfO@!P-qv9U|Hq(|UvbRl(c-<|SnjG}A%8r&*AyZ+#7O%wK zqIHkZ5*I=wtzIm&osnXsU`r1>tNme=hm~s}GUPQ;P%(pqjyH1IK3CS$$4qh^F7mB4 z=;RBJQri<9pHkbVA!gfNnU^J0rjT%;}nvn#!O;+#dleoB#CG}o(g6XVGKatu(JUg$B-m%C8?G7#nndOK-6&inJ#iCMEc>g{eg>gdbEmrOI z@_A?2N2D|%VF8^R&3_>$9C*O^j6xIMguDQ;+kcR~dnX$7?C~RBOwE)~4;odxm%ehV zIv*07_xL;Mb;RT%{w#m{@eOPkY_$?JZTb;u->JtrG9daqFkEP_gGepehfKP(aXD!? zL^!VqB=;jH>mclPmwFcx;7k+7yGj|76MWJ8i8klITlXnS?HaOZsm17q>i&fP*LjrS zN<(DdgaL}d_VWf?3M=n%b=6Nb>Z_lHK7W7yi9(1I-#x;)msT4$woH!LqKQRwbu%u% zQeC$>TKYKOFPMKl;j#`ecCkf)Z$(>E{UgBOBrp7cF5+C89f>NV?|i&f^I0^2 zY_-m;VIB2dq*4@&ZNSix3&!6asuHW#JKIK*J|`-`qr+=p@pV8irU}6lG!oUE&T6p# zjj(lsv|T|j4$s2)WYl@;`Q7%M4gBUwiAlOpHjV!<>PnYg(*dQhPPFB$tJP zPkCs+#K{f9-I!D&dQ3xbM*a$fqA^>8%>Q9Iy>EnnhO_?|nY`E(u+)sQK%f6QOEN3- zWQx&rB}4S{P3B8Wou64LrEZ%8&_WFsf>Gl7jY7FQ4!PDB@hniV+iCkLs&!gR+d$pZ z0`0n5zSg-+JU?2qCi&=#M%NE7<%(Pu3S%@sx-S|qgHHh)uf!%fLju8?UYFM8kD^g8 z9q&Se(3!J@62)&n)sJ@6=1hZ~d?=0jTMgoic&Te4hb>FMY`Yb{*D@_QO*|-Yp6w-G zXq}42*;L&)S2C2l0brSv)c^6dvK>1*4bJvz02b zOJs7QWd>$Pk@vwZMyGWA)16*df-6yD%BG9fIX$b=y&82gJyG4h!QN!n!U&vQdc_}I zgtR#E?C3pKW3LCaIgMDu3D}6FF&OWRq3f!tfkGjGR-@x0tDEEp1X-9$5%O_Xw!;bd-M$&;LB|n zTR0MKAf^fG#yEaVEXa6^)-ynUNew;9C+3|(BYpF0$T4i}qK+BDF?B$v$YCvmBBBTD zdr-MduMmv@Chn;dxz#T%ZC!SuKhc6wqCMh~xAao-@i350?pCf>#i<~&x0*x6A^ z@+ypC)l9|I<3QF3!DF$inVKPTFksi^9+yLDO9WWB(>r)J?!7s|drDcQ6p1GErQ)t- zM{IP4MpY`+z(Qa4OO%h=jQU3R%?%Hk(l$w%0O|Yne>Het8!*20t_;0loHrDYvX@pF z2=hIfP9VFT7$THwwU`q~kxrIL%>_S|2vE;u7T$kD6{xX&D?XsE?_!bl7zxcA?jtIY z#PRkWPy_doVA05yds$yiIEaK3T-Ld7N*B7YbcA(skaZF|&~8(@dxaA8f^3{0H*(Cu zVzT@-(~4s>fua7MH2LPi&$`VEAP4eY5L`;P*OYt}>dX>UoiX5Epqe>@B>TGF18~2C zF7qm)4_g`xzZ(7bKAAe|Sl-gCQXt2mB={d=tA(;_zy3Lvhbg{Sp) z&y7$DA+TXC3S!C6WCd-H%Piqh>rdO*+PHd^1*j|0h*+2u$F0f*eUf76G!^k`6$dINgkVHis5M`?C zOc_YtWkIarz)nzduKe`@kH)eUA)G~jdd9Y=RC~fb$L!5-^xQhF5U>m1?z9`QOSy09 z-M#$(_`~#4Q3Ny@QIXWjcxFR~YSq!CqgBs$}#^ z)%DF01_r*--SPpV@K{DrQcM6`X&~Gsw%F)1s|wzjg~hsvsPgs7EU|-H6s#B$F@{l3 zRsCOi>sH%XJw+6kRn5V*#CY=i!x3q08JAkEd_tpZM@K3YIYz!-C_@9B-`!_9!;AdGMnALlqrZO$nxC}6GZvH$R zN)#DZ;51z%EBJ6sEPT2r#jb#dEMl!9)9!v65J>N4_zAt-$r`15Z5-qIgx35=r2tJ7 z1C4V)#6CfliEdfrZjiV8)pD0#oOUu?7A>wI==4-3xCOAc-HWXs(IfY`(gWQ za4`3R{C{#KdV#0hmfBvMk08pz%ym~VF8R-_Qc_X`j-3uTL zq09g|pnoq;A&pg4Ne0{0wH7aK?PuSsrLJ!=e;_hW_U~a>v}<^=jKt=_x{IhXg@Inn zW4Gc=462$El=~HK*wGwlfw`k%@lEIin=YBK!pA3DiS4?b(y`USJ0BN{_~h(NJ8aTy z=cA~yX;5*Ufv2Md_dMx{YYE^JqaOWz!-JjYJ+7AFIBk~FTVDZ{hY?S+bA?pE3jXH? z3p}p|jKaa_qSsS`(*rzNOTQ!~F6xutLL6HG4r@snU(u;;5XP6jksr1lkXMY{!j+zm zQ$bww;uoeCPs3q#G{I^+xt_*=bNjDVzMIB10s-7zC`z8>%^Iq;+K)JYjC!8lxExFz zrA45@>OpG|2eET*qY3PXkB!e#FTS1zSK{=N48Y1GRyFC^NM+`nwZ9#7L{y@^I@?~O zalxSISBNhSqM7Uq!%dJB+zORYO9fMoKwHc=q3+D#O?@98Nv2YAru1v-4J6k2v;3Dc z2tyM~+QYq4-YzT{xJKb_@2N(H_*5u7;^)ABU# z?$V(0@%(awSa;{ykWi~6O9KHhydkmr@(fC_#}?7+-FHC5wP8PbAaN{O0~|=yac^m} z3Xts9)-mkyGrk6*t$AOq{i_L7AxxHDg6@|})HgTZrde2EnV{kE)ojW6@#O9Si7hh` zQxKZMWy|!hAWXU`q4A+zAfYYHT0{R5uuqvCQXn<^}-maVCSAVu~`iF_G zQAn`$BhJtBU)dm~vr45d*2+J&S{X8_IGS*QI=UE{BECQ9BKWzcE$1U5W-iRk5P~Op z8HxVJW_f5?am@3mL>xE;IV$U9}=h!+HY2ggbZ zGGxH4qqlixl#oY#no*e{JOb;&iO2b89%s(d#p}>xfEwMWGfXv*l%7;0rt!O2^#Zu1-=;p|APELUeVHWu0C$$5RNEK}n>i z8uJ#^%X2d{kPNAWb0%B;&wpV%{?Lx`(TFDAtBeExtA$Y^2P;YgFC}Y$JYK;Q47|-y z@m#PBEWZz`aS2G4-d)G$?@a!RhUP?I&HPcYVAB3fVi3<|(y2;?p+l%` z&7yF$e1WH$Xjwho$NcbKA1EKWrX}IFlnc{Yu#?c?hVy-_FxN#Mp&jkbWuJ z-*>VZnGu)iM;+O4B3+Al~VGdzlRNe>N)@f+vzEx}` zk0KiJ$sbw6%B!`+x-prh8uV_LF5O&0eVL&hhUIoSe0^qqB5nPeYtIfv8A1s)(wqEL zieYZ|9}G{d_~j(6g|$xRg27SuJ&~-0>F@iH%DZs(~d8DZbT{N{lctJ zuji>jR`GxC$j0liPXAe_upAK(KI6K3*YW&yTmG`Hua#PwBg3h;{+_`c-$b9)h*MYE zYP9`*|I`t?z}>&{Bzl!6MjPERSC`U$r*rXO?OkZkhH(+3yUvXaX#7l<VJDmf2Y-2Bd*YDwmQX*-~vS)z>L z#P|%nPVatJv`PP%=|z722*r%-$3<}!Mt=q1cUbker2rIl5xrd~?dGogqXK0DNHAQD zszBfy4Q|yuX&kSf!sIWnc)Cqyk( zY{#cqGr7WE2qPs27|f09ONBC5{|h}6fnM9f}!yJ$J_#^{?w|Bbxdz!_OTA5 zk^y6s-q&zOflU*k7kT+IPpe$-!Znr0VcEIa2*7>#Zp!zzaCC{9O+7N6v$1ClAcpaG zCRED;=O2rq>NXy^bT1xT4)`&rBEc;{y^d~a^nWkMv3-Dsf7n3S-57HJD{=EMd1Qj& zlz(^f7Ci4~l(CozWhiTN8mueT24Na%5rm~|Hxfg;flkl;LL)pE_SBrO8 zLrOQk76n>B0g2249LWbr37|})2MZdmm}Y)M8CZ1Z*F5`Dj0fZaJ@768Hi!Bp&-3B> zL`4)I`$y_6*@v6p2qNK&!q}EGe@>NmMyKoM37Nlt*xBBBU1L8=-1K`qO1|;gyHogk zYaS1}hPs-ZejsndAz$X2S&?X`dL8Z(Q@~eYmK^9vY z8@&$WAhO6^)1qoi^?I`GhdlmpTM1DVdJwpn4AE}|KUBmiS4a)JTT417OP;80^vM=E z`Tg_6r>f-;>#?Ne@~B<2f4p|Cc`@1}BK&ORjDkJX{!A(gG4~cYXX}DBc7`RF-;{3|4REl(2XO%AsH%-s z(zxJi^U?WM@r+%>A=VEj?07g>=+}noWD=AiSR7K2J5Ow=Q6sRjC)&JEE(_+-3vA1PK$Roqbsdw=td!*rx>78_et)0JK{Favf z0y?)6ba~+GWI$aYkD?=;J+5AwpYy^WIgn%s55K#%5hI_QJWiCtHDvS$H$1h%5`^aG=bdh&MpD_ei>wab9w2y;&lFpT@xF1&D2QI?$117 z!otH@INjYG`+>L7gL$SIuvUItRUxZ92-%Pl*c9~H%01G#zxub9U?6Rq(u2F!sZ?U< zEa4#<_r2bnLEjHC#k0JZvwK3%2+&cxc9W&z?`xF+$C9Ta>gymY9Qu%Dck9)O_~eD-uHao#+3 zYdd+$SN%@86Q``lj;dG*Yq179D3(q;^?hoFWjfV|TzZvBo{uKGrWWfZ+S8p;M&xXb zDcgnGTHUtB%egarb8S>kO?IRxwen)eOdg1#Gf6X}mkT@Htq}D~HXmQU4=+xs?H+%| zwqI*pKLk76t$5czyYoG12acJ^ZCvZecPo$8TW|Nfco=jhHClg_-y=w6ePdcqWqtBI z|2&K;MIoKuWM}@VkJRbD*Dbfwc@BU@?;*7G`qfW9uFY$48$Q;wOhu1EjUGEs-mMrE zkVTAPJkG16h@<+lJ*)>m%tqbi`&_)cJ5E2B2>asMvs&+cf^Q>uz>hsB@cMwq?e)Ly z{ejp|l|6;PTfW%*;4`ViVh4OXe?^9{H!{G~*+(A*)n%&MM$@&T5k|Kl8|4B-KD|eF z5@3&qf4^8S9g({N;^JusQJ-zqupz3yXZfZe-( z%lCkN-?bLV_V4hSEk=uQPzvX5GNVNp%lPY2DwKwGV7p@D=!muuS^^k#?I*&waj>#6 z^Shg3f$%{5#3N!H!H_jl=9i#0^J6ns)KLjezh}#0*g92{Is8%=5S)%C=atGDwDHX& zm{dOMiU=8{=Ox^7st8^?WmKK3DO6II=RpyQVO7C3V}$+z}E-oNyO(vJd;1l;|* zoJAaM-oI9L;CqSKq2DdPdD%`Eb(eT@*VNxu?=io`>TQ2w;Qt*dgl^`|k4l~AYkNQ3 zqsmX%%&k>R4SmiPnV2h9lB~vW{;g9iI8+pMBq1S1U~!u&r{m(8b^R%>f8wgA*La2( zUllmNOz3pAo1EhlPL(V?Eqw=e9umuX|A!TZ#xZJ&IY!Ql*m=Y6FXh(%GcZPqV~S-F zoxphuy0pB`p1*&CoBK60tSt5WWb=MP0(+nml_~A##xNW@T>88t_9A*ru`EvgpgIqGm0P?NuIoaUL3(B5EW|nxG?B^ZWVsO}A4t5K_{%>- z&;|VLbCOhX1_f0BBUSC!_{wAjLdq#q_lQ>vu?mvHxUTo9?+XHX+Tc%>Vhsp$Whp-7lJjJLmit*3oGK}SM z0%Gn+63-bt9pg`gUP3y=OeESG)dd{sFRoY&Fw@R<~>y zxW0?5Mxyi^U{m1tly$2qAdU-5;Fs}LysjFo>X+69w{a9IsjYlGQ6sKL-NmfLq)BcJ zF0)CVV^vku^#?KcCYtb`fq56!JV+}V8o@rkg^k_qm=QzyzJrc*>Jo6Es|b5 zgF+1tOK#>Hw30MKlr3ntubU{6a)8UGJeE83Ev0j2cr^2Lx#a|rJbujgb^q`-(FV1^ z!#=(91#nkNgxU-aFYy8?akU++7!=Cz{!gi(8pMT|A#NX{h5VB&ABg@?lKbL?yy*Hy z9sXq~rp|ojG^b{Iv|qD;a``!Sdx=iXKi7q}%O;VNdWUf;2_Wk$2nefXbXZ_cnRB$h2YPv;5F zh0LahyOVYwCmfe#$L^xMeYYaTh$9aw?$CN_fWqSFCaSeCTHW8rm`1C7x{To4YaY{# z7HzpX!hxUBJKaiMSL@XDP_}W<78y6df60+(!7`V=r(*yTSyIsq)AqsydV7|M9 ziuFx`eDTLQ)dKq^+al|7$jdlNR4i|so{&5dwH1QNtg&HA3YCEIvsqQ69J5onYzV9^ z;631t3?r>~uAveFsa%o5FIk@VeOb$v3>g*p(1``$E;EytqQWFeH6hRlOt;c_2yNc8 zMLBtbZLBLr&SrEBZc|au`E43Drf)S5fcdthJuT;%z!jpD4T-$ zbL9pqE;EZuHK$ia13;}9rVJXNy6ZBls-v>B79I#0-ciOKpScOJ3h%LfddiuB8oxc% z{m9k&%G_QfWciCNrpy`823qSVsox{)z6M~1_na4CeZa`W={=mG_U=IE;e zHCCJfd{+Gg)?rJM9bCHc%MZI%?AJ+^eqV&;5lJu5u4Yoi`V8zAG9)-WzPo!KlN4v} zTV+YXy{i}vfDmnk8IRubhk{T%r%GS(ub1(uMR&&cbTeP>W*$;_cpMcp1^)dn;geya zC;aF~etuAcu+5Cadm|Yi!&o3tfY%pt&B4u%6zl865&1oKeq#r9bU%z`I%v08R(|;S zxa>$4Q>9cR^2iL$oV`uICiJnDITniIiVUYjY>|Eze0gFY$1#+*D*e^MKECz$qZkmU zj0gyVi=}&#!_>VgvFvNXwaQg^5#0tQy<^9~NVp=X3K0MI^joDVjbLmRkpg-VJj>)9 zH5BYP@nE^eyWZWUC^Jm4?_pF zn6hqYgvi()tdvh5> zcY};)xpfRBbI<1@%IIFl?ckA5Svx=uYOs31>X1r?`bwYI$*Ayi#GC6v4>if9-0zsI zhL4(BvR75Sf2z->Pww8|wZV}qO?y*?{%t4tR#DA>!`Zr6C!Ve$K6!FB!8NhTD`7b~ z8wJ=jnm}u}Pl?vhV z%FS5;d1vQkTyxLdE0YW=EYqY?7vmODHAPM;G~YJNkTgara+K_{1P|7xlTz( zjr#3%=$UPQ0P*}dLBw5doqVJ(lomQ}N}6*2jN3tT?jeUHyYJB0FP^;*?T3%G;kS5x z_?4l(Z)4|2U;Uq%AsN!;*jQ%LB;KEcJ{K~uGHR+sQ9yADoQ|DA=w)v-Z`AKTJ}mi;f2P9*RA^icM@6= zDn)yAeg{~_^N;%x6vQ{7UZ123b9V8M9pRK})qL}YAD;+5Goy04`TCL*{8|!{1WZxy z_{39*vOWLXiX5(C>vapV1Y7MQJV)L$V#bCZY ztcDoZi3*L1t6M4-SMdYI#*HqE=O!VHR^D4cqQxcY|Ap}k(xO1Hx!>1rzcqj7b~{X*B$1lPEhBt#32xX5ktw zvHAPdQ8l&3`i^gh=u?~30R!c}Tioc|BE0s{TGfLJW@uPo5iSTfA1Gm#kcMpZkDgnwuajtg#jL&mPxtqaZMF12Z2=$UKTgaO?_nT- zz%jgg9XTeGIQ&@asaYx165bTP4oQj>OBeAuV6@)!qB3uyz1h7~?tWFU-Q&mfeu}Q7uN3WA zy`K7SV7LB*eQwQq*~n~6eO#PC>>D#PIzKLkvS+V*$J^t%ME2nXoyBbo9sO}pHY?Xn zbm67BzS(pQ5)oTV%*~{ro<~mI&-jIq5bsL%g<*p;8A7L?3R?q%3HwP%D*ynwMOC}k zMF^lLOLW<`wJo-746)}Q>9Q6KaO9F^U+um6hPn@Dbd%6jkDQR2iyM4?_R+Pk4!adj z|0Vo8$vVI+n`YK!jXV<(y)06}I&0}o4pw{@)SVoW2d%UwvX17fw)f(Xt?7FDgQ~`uN!>7Ld zBW|9|5VGS48?L49rt}r6$2fqP`{^IFfsO30~Rhj6qlI}Q48gNf2 zRQQC`3dMSxo{bYkH|i{7Qzow=Qms7$%QUe!QB`_`c!4^e^+Yn$SQ+^lP_A5V96LYFwjwT z*M*WWSS`)-?e^zSCQ-V?Yu*$pw39rwj!n_uY3|FSd$F57yX4iK-MIowoCxrpz#F@2?69UAB`FCe`k=5>n4%!aGdJMWE${Z0;9Az&_W zB})!E+L+N?#PEUG;46{I*EE+)=l^YSXjo7`f0bla15pinH&^8`mK z;kPEM=srNCi{jitl+9I03@DimTf2l9GG+0lyWjB1ixo!Q_YG+olvQ^1)(E8IEb*(w zF*91#?GnNf;mITy66&;nh@Ah|+k>C{(NU?xce+CCBb7T^Ru&%i;UWzT&`5Z}AsCbD zQ-wE#j20Ycf$S)EIHJKBh01E`kNK(_H76X3A&;%g=&@aG*nVffSH>}Q36-g+Cg1TC zf{$i#5F=eI-mJtja>)XaSMTzyw~NiSr+%x$s)COFr%5^A$ED?F+_hmBJH24>aK>!h zAJ#8lB4Mh<%csPlTR6@*Efr%ngn0~Et$f^Wh-rAnItYYfcig`pF!aK;F(lu9>TGDl zN4$F6zz=K(K1m+8-4rZF{mE|zjM59N+=BlwSN?C8oAC9z?Yh;)XQAF}LGS?k`lOt^ zw^%5>GjY-6$^Z?&R+-z`#*|@_hxwnV*YIy-cOIe>TGvv=WakPQsbQ}$sRHYKewQ?~ z@bCANbQo0a%?K2`XrPz5pAymHaG6#2$LR|?10YhoNoaz|xiTVl&W{_sz(=SANvHw^ zD68+)u)g+d3jNtDKU_krmRe0`{&Rno+dpW16PBJy29D+W3K9PFDV)9tr=v^6k4yOp z3^jo*g$vzc-1`Af7gmuaFeasRlM_&|Kj-vyvQ2vWf6H9rN;B0hC9hPn6is$zl>=ob z<2B&kk@@SXHoT{CBPoHQ3$ZEP%#Q1$!PEI-il0Ff+Y#-J6wb`^ann1>R6s<%fp+1m znQFN83IiIpuHQMc;N)sWvyk6a{)ReaO1gQ$kUyt-nWxMhf4hJzh{}WlxOC4+5!?Gh5O&uz)^hDH@zJsgJ~gMR?hy zeLn#}0*_jL1r7FD!HDqh!GT$p=tH~Ye}1HYek*JA=>AByqT^+as}ft$!=}Qg-`&t) z`1IZvMyRaF;Rev8{C0)|Q_Qsro%d+$PT~DK>X-hrV^NYtkxA>j&58t|yglep6z`#8 z5k}e4(I1ED@Q=SEU>URHuIk%3O{?Ap@jb+MU#Pf?H1>xnTYO-Y`FoWjeP3W2XR>Cc zS_=^P57g-2&Ye1x?vbz;Gmy#YtL`XxQpYQh$p%4}o7&=PV}_y}jK~ezEU}%?SbwT& z{^_ufVd$M6LgKG10*??aT!Vq~G!8FZK2)zi*?2CJGC7)iq&6e3tG;Gst+}h?a3+@S z1D1W!*2&`KA)F&5B+EvXEjXq>?P%xW+0_z@vK{&A^L>nW6Z{6S*Ft7?hmi-y#bgIX zPA~S{=2c&I@D#bLrz(Jaq_?`oB=rH!{b_*H6&8P})=C#eABn_DFNuHSrXc*X#eT># zZI|zmBl9SF9@0M%SlFN>$C~G?y!>Q_C2jA=b8;>Xv{nMdz9tp7+SESAWRLuKzF`yI z8GrY&{9G>EXfK1t<=?dkAr_GO)hLyOlcuq=Ir8%Z0wu3lxh_2;&nd|DXVe6DyR-#y z9?#d?d~`ReV>;B{DEKQpUVW(LrE=GK_M5WdEt{-HeA?#ct|%>(h&|m;dNmaF$dPxg zb4{Z%@&3$igE@jsYSwQZL$U{<*1czK;5w#)aJjf!lSbXHwv8?`G>ty58k-*kPp<^J z$iNa@A!0UhXMt~|y;cKA#J>PQ#%Xr76_mjqHP&RMUuTpyFTKk#A}AUA=ZjchS$nJX z(;NzL`oh=Y z0EAYHZX%1r%LZ$uA<8F*1mj%}rsdytOVLL6DVzWj?(c|_T`#zd(4JW(+PCf32tJ1P zDm?mGSLk3*-+XD`2y=fdpR9v?`j&=C?U2a-Pm)BF6-P(S%lL+pE|09er=(_tfstLD zpV1=^G}htK2$|t`<`~^jX>=hHl9N{Sy(9 zWCLet6Wcc=76y;^BV4V2kMdB-O2$EL1E(pPp6e@qhpB2WdQr-0T7&X1t>6pt`m zWiV4dU@u&;@DQ1lbmnj4R3h6cwtqW#oem8oTigw_h~Q;>d$t-!`ArmvGW zjq11meGsX2gjk(MI#!tElIG|-1e2A_O=VJ_2$S_whyMh>8~_HRHOHrryITNdBryI zymK-;&sOHcMFD6**kvNotpNwLpS-&UF`}q`vr{ccz^znq-PEvQORKd)K)hOY^ls%6 z*tunJ|L6KV71K2g45u3=w*d{-TH1G$d{dXng-0B{Bppka zCCBK%NV*~Ehf6IBPJbYM2_%*5&$(AjM{-a?>_b?uN`wy8^w!oNu#3wB^sPXrfn^MyHq+_Y% zCx}q0>JhbaW<@9UW7?r)V$kT3^&Q~4_8e)ljrfRV_o z`4M|Iz?<~9fmQaKg`mTj&n3N~>JniYw^8aFh#{7$!hIU!%0fW9BHOAYo3}3yb%^%O z;F9JNSuKW@0?wr5rGnRk)FJdEy_hULkJ;#Dlyz(lyshl^nCT1Kh2XqHv%Ml&4Y^^B zX?U9tqQNT{=us6%MuJ3GE1Ewe7rBq1=|yTl>xj}ej73>^7_eQ0bzG)^jLt+x*_Ts7 z7UYN6Y6+j)wzM{(cg8`q3zFO2s~N@XwO>x$7gnCTQ}W~S=$B(%T6{6`Ow)g9Q$?S+ zS#j}U=D(s#A}Ck7Fh_}G`D*1h`lhRpND>pAW$Y&ZPTmcWR3tUXS67V;_rN!%W?dN+ z9kkO>w;g7WZ~1B+B~vBv7sp5|Wb+Ogg04A82B0!7<76#NpDw1Qh8suuJ6EynuCtee z8Q$9ys9%1v9ti#{N;XYibi+Iw!ne0dTTugEw?y8P)|HGOGp0;Rld2K_kUoC(bitaJ zE&vU+rWuj#GVK_EwxC6xT6%p;=ka9I)KbvL^+(#4okYg&7UW6}f5i3dhfzZbzt9$g z3VSU}i!Ur#RUUs6>$zCk-@+9N^M~bU7lQ)|_EIJ|jh}Gem}%~qo?5=bodsK^15nl{ zUHRHYp(Wl8h)-YIz#@C8)Git-KxzRZ%ofmX!@UCzm>i4R;yf9AQas@L8L*Sn%&t? z_z7XP8hoTxl&m3#oWFZwS$wp#v zw7f3@vZ0*BE?5m14S=>U1h)TJWH)|Vyv{WgOSgKTR&rAsh`Aj<>B?F}G`LU&@NN!- zAGC!GL~h5T@yrjJfm|wSurY$>SJdm~YeUS9Nh;4@UO|ms9>A25VCNJeXRIGA7q`vz zBa(M@&yDuA+i5T?Urhn_4P1wHh5q)a8N)*qq#GA5mE!+Z2+d91Mq|!HmFGwN6bj*- z+Hfm{a!eth)p)s#qRk&0K2e~uz;90peN_zP2~jHopce!NuxcPnWlj0p9g-klNQwa1 z9}3q4l7$iSuBxl-o`wcsK}B6-rhV#1q~nh^rz4iQ>E-rvv%k6tb&4Aoc`%IRgDlt! zpWWlLclhn3e)S+@b;*>_53JP}WxmQ?__e%@9=i6<-nbx;EdH|U72gET&v-7o<}V)> z+bT)jbSo>_^LL?s8E5@0D)WNj;q$iQ63DB)jl9IK0>`b*OU#ynw98bS)cYmG83}6|&o`w`C+q?*a zxncfxl7kW(f6IDu^Ln;2eRIxjY2mwq3r$T!DBP@UZJ^Xmh~g7&cl8pmSlG{b${tpl z@MU=H_wnpe-{9ouY+TZIVuRm-VqXP7hbWOHvE{qzLCkjS^r}||Z=`W^)`qa_x)20ljLn*r=T`w3^vjzQiz9sHg0;LD6+w%YU_-jgwC*y4|61 z?YtQ5t(G_54mmmEUb#?SiFe-o`;_>dcgxpp&HrS4wSDXPaZ)b2dLGcO8>dljl$4af z^%3vm^acQqDWdIQZ|bR4EO&f=OQYRt78!h9#3NEa$$y(G03}Y?+Ul_e0MH!N*H+_~ zI3f+Njc}`KF72qHf?5jfWPzkXSAD0XH48YZZCKQ7k{-);0VU#yzeiuMu^he zzTrS2r?|x@AJ3xtr&Yp^mIsTbc=wt<`|4GG=`ckbr=Q*ocBc5BsgZ!pk!7Q}s<@lC z8$GXIIx3&<)u;pY2(2dYuk@~C(7Ny_X0PmCU+x6_V%*~d)7{C<-RmUfcnpKz&(2bR zU{M{;0#Tf7DL{Uqd@ruWiy#N}#0ZrByfiP`NhzOaR8D=5v$Y>gunAiA+dhBo8uIcdvT;s{qJ!(jYEO7G|Vs#=>%r%Li?RCPQ$;?S!5 z7F?Dt3nb{72sq#!xM4r#v9)=>2)zvW%X1KP{Njn6HX7d6`y;#dqqO#$G>!k|&l7pC z5qhs3pZtzGaoqtl;+NjqDXK}%UTzm=Maua?-5eytbD32MKuo_gFpxl#j!fz09=7|M zFEE@eRpYhSUTg>kM3>jx*S}ZfC~Cn#DoHpoCEUt$!HwzgTPSgEt^or+=vS5BeoexX zp1Gv$j08(I(Fb(0gXLa}^}ORldx&k0`h`CUZ-cy4D7UouK($vg*Kdgmsu>YAH)090 zd^wG3>K&0nM}Q|0HkOkrb*f*%g{YG+scpo};amIE5u~uH{@>&16ReiVrne3aOqvih z?3)gTJVET^7HCQLg(TpYP|3DF2@h}Wl8$nBeLmYmtjD{)7B!cj?@}h7r5mi~af(SAiTyxS~ zGXp+O-0UWg;oo;Ea~E1=j{~JhuD+Hy{*;b-{jFE6i#TYCun;T%c;$_IHT5-ksMyZ9 z$_4;7ER!?-zpW17b7qg(gA}9}^Kl#Fc<}Yd!HMsS`D(2hn8Uf;m<+#QTEdg@ISE0e zh=T+%k*4JmtEsoqGt7EJ!<2M)--KjmaQG$WzL{8F6RKYT)1st0(BP?a)X&{ImuH#w z;r!N?vdh=@>h(*pkXAf*+F`aI=*HLuzuZDb+({#t0L6Ah3{^G#y;G69S(z$xPBl%v z7l1X%9$n;=c2rUzEwO}=CVgp5*@*gL!}9l7>yq{*c&#AAMsL#ikSxkBuF9-|j*3gR zGY_7;YEHYb2cUB6Jj&+_0K$NTnj7$5G~ByVlg0OTk(#Nn1VV%tRtD{ZMhJ42@O)6t zCP%)Wb#12D-VxA;#G7|2M`>R5FqUbz7`^Pww+spENj;+pKpW+@CZy~MCUvuKVOuTK zZt7spJ5YP_dc^$LJtN<|q((c{^~sVXy_o=?r0I_;B_<8t$i5OiKX{s?&d3hH`efoj52H8 zZ5-22jk6ytVeWitCj?cEOxyYTs2vCakPX1-3C&sy)3AFI97EL}@R@3c?@3DzXXq~b zX*s^r-c=|~)yWB0cVAoO*IFL?K<{U%4(7 zG_H`n0Py9NfEd6rAf@5=^Q08g(X)w17toF<_@&{7D7y;%JH4~eXmMJVI)iN-Lt>LH z4pUF*@h6K2p08-qC?c4jBmR7v}4;=tLyfqvM2nze8Mz>qCmAe^t7%$Ljf?ETgX{sepC z4ZD(VV@lJAYb%{@Q?=njuTlPw@V(c|o#@>~DWc!^-NY$X`Vb@lDpW((o9Mq+j3>(| zZf5!&PxsMW;1loFo#2PhAu>uBAB`Pkg*k&&y>O`{QhNHgi+dN3`gYjZb%0PJMw4gA=v!i<RL8iO1*E=TFTtThWgx^7=z37M*JNzuICVc&~_6;ikK*s5p^I zZsY}|_4cMqMHQn_3$f>K(yl+6oA0pxQ#*W=ul_q|;WR+~zh1g*nrS^w*M#1R-Q)Vy z_aFuZj3mN-XSc@{7`XV=k%74r4T|kxyx*mr=D&XCx8QjCns`;F)}lmeSR|N(Xf10? zzUU>I^JZNcUOqeD!I5J5fr77$otJ3`rtNZ>6xP-gT8278Mh!!U96(NH`;w9?uc(CG zJy~}J!G}hG;pY}rMSZfwYxu>EB~Dw)jhEtadZ-Ln6|Qvnb~J0K-TUsJ+~@r>{-|5 zC}#`$V89lfjDxYCy!hv16iGtk0X^qwyMhD3fyXGF9!MiZA&jm!fnRFQaprA0*KoRt zQw8`iw8wdj{SSpTytn{WEv^|})FT5ab|n5I16r9eC-?2o=H^T0C>%kb0yv#K?^zHl zh$3Y~2j!i3hW#Y$o1xLlMTxoaxAgJ@XCY(RG81Fjhd%0PB?p1~JWFiM?$Gxj)-sJT zgD)&&r@h4jX2pMvyX#VGKia#mE_?sTD;1O9S}itRyube>`O-qdMm<7>1e~rxporj$ zEe`heWeCiFYuk{0v~zm>vv-XnD9cA<&JJe`Exix6?i0#b2DtRp(-0g}H?z7i*Cxih z!{nR873g()8+z(w?Sor$=X;dLn1z|p4kdY(IQEwvG3C3fEAgR#+Z1nnN@<^4|hZ?1wO z-lC8WY%*-MK7C7R8IJPG9}0}aFJE878ueBLN zXBNP3VY$WwV7Svi@XUrJOP^7#l_90NKq`RpqDRIVkE9=^x*k3#lOQr(E1(6>Wc-c(rhR#9? z69W2l;w81wD0B;BGV+FaIz!Ckoq4Nr(t>)Skz$iV@T7P)U$;!da^;)=pZWh@Im8;X z{e?+e5m+gKP1jQ)9cC`C>p^N)Iq{YznY3~KtWX(yPWSgy3V{ky26ylI>0bF_e4jq6 zC*zQfi(Ta`X~&Fw(Qoej{2wi6C`XZlr})KFAq$&8_t9?BgJYI(Io*~1;i;OZ0gVB3 zICy{lV=KH)nc9l?l{Ho_wX{ZRjop_Pw6KYa?FOxl%_w5W5=ZAbbO^}>-SeO?t>SIx zm)Z3uk{Lu?B$tex`5ILKV*)Tt#(XDvYTnvQ?nBZMy58kZaxtV^-j*DG>z|ryXb?Sr zkznU@x6pq7PqS=f@ZS^yzvG`Q{N~47qsN1jLX`b`Fv`e`Md&__tg!d)j_l*@#v@BD z*vV~1QJpW4LBxCn&Tzfr)2^P+6>Z^2l=sm`q$$^M;rP^fK|2gK>Y?4b4Cw&)p~~eK z3!f6Pj;nF%d2LlUPR(G6LW(TTJy-_=Y83#uAq0Bj{(hb;F6HLO-Ol(H)c}pL!#SIx zcFq-6*zD)v?LyhHlzq4YQ4Qm(s1e_^{Xig4r`v|>++W(G-i!e(gZ6PTh7Rz}L5xu3 zVD9`tWWn!Re?gsAAmBUw^%u%P)P}#+2_N-R`FMLV5GfwSoXaP#3)L15PYQJtp01sz zb5C-=nsWW#NNf?ej`GxkgI;-59#+*&w+HR|&GB`Yvburnhjkfm;Ae!CB?OYLM5~)U z#J@*sRh%KX*S)MPX$tjbuOlJ3qLcp6q~<`NnDl;!g{+R%5+-P=bFQ}~db^{BjIDe2 zpzO@T8~l0a{J5LvvV^Exo)t#{zZUFCR{-P3qrDTk-OZJWDTF$Vn{EPvrX&J!uhXhb zucZVXd|U|%Ymbb(i=kB7_&)ASFy40VM|U7>m{((Te=raJQ|r1*QSP|V#l#ThlbziE zKyKaslesV4!+XfU0Kjv%uwY7)p5jvv#qj#46a+4anq`uqXQHlTyB>`SkMT=OqgCf@ zY<0j^upX6!{7I+OTMETUXowblYM2<#_=u8 zTy88N9w64fU0+Jp;%Nd5CqeIT8rDq@S_!tr@?_o^lXMzXVv((w;IIeEG*~K5Vp36= zCqt*Kk`50J`IcAfmcmExmch-vh9BuB%ScMLU&}tyrDO&hN$0=A{d_)s7lIHO)6q&TD*ila*0W zbIy>?hi93-$*MXK;Y;O+)@V!}0k^5k)75GgBrWBFUN!@nm|# z^E-lfwhJcYAUX%W1B`Jpu1$1NkI8)Q#7)>i{3Z2)0aTz?UZeECdiwMOv|wHBAq&w} zoy&9#GEqQ5ny6OrOyv45O+#UOxm`b4%p(ts5e#hh7j6&JXYX363?WVyUsjOt`9fxd z1+7&@r}2g;6)cW|sd|3q6kgheZOSLE)8cTu0#u7d+@(9f@QCLQ@i)EXm4(2;3Bzot zp;k-=;;-U#wBg)AZ>!QA1s!zb7eqXRxEkjnTyg_WOx_#djG*rjo8~?k8BRnZiE`r9 zp!`g(2-ug9g2UW_4?0;*dW|;v#I2YWkTDgKj$Z)RigUe9@F?lmxdSt9Jk4u|Lo_{1r_r!ytF+YKPLRZ4%JLQ)VZ)PhB}59Ft~-*1Yf+avRJtgTMjmR{Da*B`R*=Tf3IAk)yzV%e0Kk67x59AIe_KhHzZihZzsE z+1S2i?t9K#v+%Z}6+8G-sEx)3*Kc`HgxK*biWtyB@LNW+^{g4Dfjogwu5L+%;&VTy z)8-K^z{HLE-g8xakR+$sP&cle`QePNfp7mbZuM7vmu7h!d!r!cgF|Et=wywH{ufRY3QN2{({IC9)1kNM98eZzN&iPL9w1P=nc%dXmh5YtDo{^#cW%&*==(d`A% zWF?X6!6x=Z)YlfdUX$7Ck-J}=*!5Q5r4fuu7%w&%ajS(?68o1nw^lzkRim-)bTqT2 zP46HqG}D7SyC@su{`<7PJ_VWI@)afF*IwJ|^Qa{ZD4kf#s=#x%+>i28s``(s*H8y}@uFckss9_hD^}osw9e76Nx1T`! zD741-gP{etJHYrFhz%3^*+fv|`Xg>gADa3dJq|4rxCUtS16c!X;UTSXu4J=lX1xJ2 zgnZOLft)!t>!`S6#AAjuo88DCoYanUc=a8Jxq+=WD@dpD767S2(_2lA&k(zAP0PF9 z7w&HVt(fqU!6QyoS6n7&(b8BMWzYLk-~W7H&{G5WEh8WwgL(pe#pW>H=zQ;f7Vrm& zWY`+(tc!!4>y#Hi4CaAVkaNYOK3?+5|6woWqLj)6=`SSluFW>wk$J>qPLl0w8r&f`oNnyfPLY6NyRMSh^itq|(!|?aqft<3c{=&W9 zNhC)ut>R3EEv6XIHEM-ZWi$X=^Ch|5&1O97I<2HCN7%;qAwhEp0p_nx?7MGDXki-E z9K{w?0a)h8G2L1MoK2rJmTx$?oR}Mql?m!QThMuIda=vbg{J*!rY^8X2sZ3Xqj@bMKJ;Xk+N5WxZ9g9 zmclOx;%LI~SySEl5?Ud`cZXGl+$6bClFK+iP9r5%T5gw3(BTHZ5WQ^O{D^$r z2YDS}bj@9~q!5DwAauhCQ9ETG0?TbCWu00MeMn!mpy^G&Q=jpN#nEuL^Nn99%}d5j zptz~`u2vPW%_#%De^-c~Ha@c)tf2dcrL1<^;UB~SyLg5Uk|Lb}E60v2wsB`1{Zwz! z5O(pDK;w}KXV8Zz{nY>8HdjV7m1!#~d1^y#nAuhfSs#8$pjx8^rGY@n=J={t1c-_55{{jTt>u) z8fT`RIv+U@n~PF~EC5_^bHl*o6{Z9rxrqs2Vcjp8M9P1LD8K|<)!tVu=JRbWUjSzD zKZ7yi61*3~{~d&|r>Cy8DuTt;JF@q;8$RKZMZGTL1o8p=2b%uXI4S>7Hik$fdeD!B zY@nQ5jJG-Cm!^s=&kuIFS82H{-YXkfKBx~lL=OW!?P5}Q^OK7LC@cv&p?nnM3sQf zkv=`x>m`ktP1sCV=jl9MfT*101$;-a*e(pKE%{@2A4DD>({s$g4vw8s%v(IC^I0I# z^6#8$y~__5IckKqVdr$CT`!g}A<^Uapzl0?DjtueB`*%wN6 zK=LJs;-qb;z{wvh;;O&0?h`8zOZVVQ{j*bkChJ6|w!hp35Ilyonj#y;#!8j=F?uns z2w2ZQsmJ=lpz-d^^&@AbeJT5^%_2dq)AcfO!=q(1UXjWEhq0!gfc)h4wPi`38?EA_ zsD~ZCm0n!>vmTM_)`1eHH5RsFFhn^N9bZAh^1~B6;m>nlX{9D2D_;b0F|$i0ipimc zmPio&TKF8kb&{O8U!0?2P#ZQb(I-L;Ziz+$sBth<)(yLGPt2 zB44F>erd*@K;s3c!s7&IIpGzP`BEbM1fo_7WOqUFSU->JV~e;Hy-bxDeXhoDY(|AP zuLtQ*@~VXL$*`3@7OJlq796l@Q-gPRp(QuTL8lotVL=I9UEOd9s8>=<8-yG*c z@1!_=yx0GYwzd0|02HwT!IHLf)DZs7zDH7pu6${Hio+N9?kh{mFMi>g9lKY_U()e1 z8TBDz>3WCx;@v^k6eR@nJligyTEpahZgB?UR~>j<$^v-0ta5D-l;B;btZ001$y^jl zMv)HX&oAg@5I>$2gZ8SctdVe#oC@}_n$_gDZNBd>J?C#1rhVGQQvx9XKw4^o%rc$t=%TVW69iY#d)~=?p*9g3iDNc?T**@NJe9+sO?>a z!7YWsey?uIr=!GkpWWF;8_eaY`le{np~r>WUu|X$kl?$;bII>SBTI+?+KMwhnny4uIcF?Kk zk{-PCOjDKl;$Yex33$*&k^!}o5<2iXP) zn*lSb&wBbGJZHH1gb@D4NQi_6E2}Bm3l)i9WpnN5*W<1S5(IaP&+-S{94aw$o?r7} zs79Ody^vpsjW^v0@9gboB#cL1mAL$bh375p3+m;sQNd9q>a@sOIn$#G(txhe;npai zzQhfD>BQMe$8|Xpe1TPp{}57GkM55vK@eDwxTC3ICPN$QMJ|hYMZho6dM_^dtW<+J z!cQ*)$8XHH4ig_;L@!yt-s|Eu^ZS}zGu&zNn7Zh&*Yf~8ALzS0{>=4e)qS8jZR^}`H~ouvjDuu(nH1|+%NW{ji} zJbwpqAe&^VK$%4Dh*D=$Ox_j|GV7WAIh3y&si2MfE%Ov0_+)-hg-vxt+w7<+Cm8Rb zaA_8+h}cSYrFqZetL&VxXGCgDUL_FWP2>#OZ~gNb5}1H3st5RHimWp3L)w~}?(uwM z6G7qOt3uzAw%r5~-elE#>a$OQ)4X-+ATVQ23= zGSb9-jKFvB87VU9aR0>YC?2N$et$F9v@gi6(gybiLo_ZiX~Xx890=@@LE^d zS3Gbbu;t`ct7Ob>%Z1RX`To9f%KbtTe`p(i7*eUE8{fn&z9(dq9jOz1Su=cuRrGg& z_&9X!w|&a8Cb-f2g=bQvdQB$ubkf1NO0kg26F&3azQjDF4&Kmb;gQ(lN-S@iQAJEr z7`1`n#S*2w&U9q~1-FsI(<1^Gi3C8=YR^xy38JGy2s7C%e#qdX?3Rvb0uk}D?~$K% zwp_TqmARnQPcCv<1#(DxF?3SD$#X<_j(jhUoV`z z_IoD>?BHw@61?jDcS$%nD%3<6eK#=J^}VJ08)2${)um*kW_zkU-|r~)dSv0Eo%OQ4 z^~dRu-?W$OFYO;n+bS&Hgt?|ozCZdu59F6a^=pDAPUjdQqyQBM#ieaa`zPE+%|fvF zWl1oPiMs|0)!z3ccnK1nNX7b&36I7n;`P##G`V{bv!Un+*jO$ABG3JxU8t3M}iPu};6luteLo-k} z0!fJ|`Cc%k_@L8bCGi^H*p;oL;eO;!qM;Ro;<_aMO=*6H-$nCo&%LC$;eGNato@X* zsYipPSktIkEHH?nz~WreICc#yx3utO@sr2|v70;$%YE5iTv|YYB}y#9G$)2dlZ%9B z)fJeIzLpVtHiEm>*)YL{g1?7}X*gQ$ibT7wFKXls=6TPfe0P5D0=NL!q9S`Di#OJu z>^pEQx4&|)`4G0qq;_dr#ZW$Xi`qU*2^_XzMZt1OQ-V3ggO;~>U%X@)62ERe{FVTx zoS^C~Eq)`AV89u9CeL>&DA-4!a88k#t(_CD!^kCa@6@8w)(0gR9Kw)P9@d4x^6y(0^N`R9VN#Nb`E?DCwm=?O$VGbM!^2jXlNgLe`&_ z+Jqj=Jx4IqFI7O%6TUJ0V~EiA0m8(5jOh(FA526tp31_m#T9UjnJLeMe1jf50 zyV=2;BK|VmQU^lJqUY83eSi8HS+7HM;7h#@FA;8zaHEhX=py^AlaW4_`dd()5nLHK zv|v!l>Vcv4AF`mmFMx-)>GJHCr7vql_CTZ9xK+InQO=crk|iCb9@|w~|20%dp1oyf zIN#f@#0MH(P|#w3AW_>>*IOtlW{BQ6lCQ|VEtS}q99%9KkG`t4`5fy1JcCcP40fEJ zV6%8bpL6_GN39q0qU!$Fg8KwtXjdd%&zFd*<_o6D}Nen&X zqnZ>5fn$qt?(9j#8zSHXl=DDCn<0=W6n=0?F)MDL8M3fLw3^PD{>zanw^72r3ASoh zCGDBFC2z8Vv~Dp@<E85?ml zcdN#+l{Plc$be0Rm^`@c_$x$>1&gp&8o8zRajnSTB9J4r4cjV8aXy3SYN|_fn^)6` zoHoG;W0>Fb{HMU++22zfgrXBq^-d+)jbhC>^aV0kEv?Hu;~H2_AHd8F`$wEw9b6FV z0GITA-B^0&V3M?LXu@YN5}vqI=hQ8YZLnx$jaawQrJv}Sp&4zx3;evs*#N}z~fx{R3{=`b2!t-tFotC;PC8P?VHGDgcKoU3QfcF(u{ zuBvZhaf^8s_Xzvph!TrD@dx{Qf1RfR9G1CP<4eMHX4dofnF_K^cb%>21#XL%oWF1q z2X0x4TTtn*?lrgOIRn&Pm129OW1_1knu+4VxK)0`vS%7U<1u9V+dm8oj2*)b^rv07 zZRT1i;?L7~Av!E49&MN$YsmkCHgGXQ*|In?o%d2q>cEw)x~VFQN2X8k{B`-{roq&B z-HK#eTu{sTMD@!)2`zujTnsZJUn3>XnUJtDN#Q_cMIxY-D4JtL-$0|$-DqGF35j55 z|A3~311Mz_h9O0f4#=^{0~BS^WGQ6Q;N@HP4w)T2sD$V5(SOe1?;$qJVV+IOh2AOh z;CE+*w$Nr=sZ8JrHz}`hI>O`LKAb%mbn+DgEud#PpP|R@L{<(47iq&%>4r*Ehmm`S zt4l6(bX1>G20C;LT?=iuKbo5LF};W1rx_l{yr&4^}#@nZ2(bNRQzBW8mTbgzW zBJUt-LeYi=!F!yu2Ik)pj%sa*9C0s9aT=MgDjYgVF#I2d{QSFR7nV(6Pqz3Z`hJ)A z-n;fx(HKL!T?#)9)1 z+r5#!K*F!j#HR%EJBVy2_+_c?)C`eGzBN8mNQ!u^8hso_?K_DBw5U&1hL5Ai_J?UV8WS7 z1RJ%DD8-5HKHT)&Zr2vLhPC0Aa^qy;}98=+btJC`TbWP$3OoVCa$ zmFLVb$z-w?$Wt*my$MR;zg?s8i`-V-HBpq9LP7$h>MmNDm`gTcuWX?*xg8hI-p0?s zef2W|31IIpsFHC)kK7Ts^o`yc-T*IdNIDu;>e<~9w6z&=#Og$_UX8Hgh7bujpUvQo zFOsE6PN;G$-_qd-uDB1cNfA2tqBt!pu0;t&1-MeB1_~265fSq@COuaP7Q&5`NA==d zLqM6DKLprHT7)TR0Z6iySt82Tzn+X!XesCvlJwHdGXDu1kxJ}sLygLyFh!4N+Sz7U!Abrc zJ>u%09ARqocJIFv3rwjj4Ry9^q#jia5%AOx`CT7opl-8AxUQmDi%&b|2Xvr$W}*T>bgL`D&t<9=^A z?p*j6@rcPwRRUAuHoq0zZKLln(%ZnyOV?JCY|=9Dbmii#!!R#pHWMPS2*YM?1G9!v z{sIP-rvvbBiYye)B}jkzoor%NBQ3a48|`Y0M>dLoY}P{kPD2OsRrLZ=V70wa^hnMr z+>ag1lL~3?2VcYLV|17*Y!r`_6^(pPcCUXt8ObkJ(i==r+fQI%E^$F;jx0{k-sa@D z%Xq%R3ZMY`he+uf(eO64j}qN5RFiBA>^H}=US%@n%Z(=R(B@lwwO*!l*C7|^A<-dE zc>-)pIlXxnw~E?xa&?!-eW3Gd1W);A`D{b!K2hew+{_nqGu7nyp>z!K!n41)o;vm0 zVW`qEE29nNdras7ZZY{8X|k7Lz6Hazr5yhL>$@O>i*c8=ea7@$vI)q z451SCxf~l3m_~k#RUtKTJr(}g9*V-7`W(0VgacY>DBB#^IzBNmF*Xxnaum)1(L#tY zYB~Q691J-jYQqsWZ`WgQ_Hl!|jY7O|K?d$`MPw)Jfm>2*G6DK2R~e5!uqsg~g`~v7 zz0BsT#^s<1O!o|BgBBWxfdiF*`$71$;yS*qcqm@WOOERKF_ayp2o|YJgt?_ytRn9R z)gkeqs#5A>E|JhNgy?Ot+GV?c;PWOE-5uk?3V&n@Ucxg^5gj za2uG72%VU*iLy)R)`+n_a&%?mhoIpx=Gw(uN_gR6wN&Z(V;S$pgBfO=yX7G|afDEk znol-h!k|)CAbY+*!c?gTrN|eu8}7C8lfT}U;-!<{!tTXuHmLyV_FY_f50VdAGHFR? z)l1M20T(IWtlwNBg~;fH2|ioaZfFb}j;ALQ{(zjqh`DQZLjZzWH80rk$L+qjU`~E` zb|#S%VI>HgCaBuRoRgl=P?VON+hjt>fL0QFYgY;%t=l-Kc#*2+_nC+?uX-hSGliVwdkXa(ZcMvO&bem7#1zHtb(y-(Q50=HEle z89XGkcXxKe4yBdHkxC5RFx685!DJ8~=tdgTh)~($4$Wlkc z9$N&Rta+9_pL+O`8+v%f<9EQrk<-N~*kAkgLctg70obPed7+G4o`G~=*c_=QNh_3F zitLy>JU-*?cE|*+$IpMS$ZRcE&F)`-?%t=j-CoR(m6R_Ohkm{_r9GeYLig`)3_q?myVy9lWhic6+YrKtl(C2@3_J{Q z@}ARPF)Fx&w_0xn9{5r*bP!zofY~&*_6g5>?#d1o;cVrel0@u=!B=fz-&z7nDe%`L z5@X?7-2|iyn3KbwEq#xwE{DP7U8|9F>7S_FN8@r`$F#y0O6szy&71kEtTF+n!#yl& z5MfGp1&Fmv(8?dnQ)0h7F{*m*&=-PH^<>>PKdGV}#1_M~Hfdj9Zrmp68I^i{scyCx znoiNlO5|svT-(QvVB!gwQ>q8{f@2zEj!b$)t$%+p3t9JxPTc$e87e1fA*&L9KB9&? z5L^Cvb!XwCzEJU8DtH)t!@bu<64=y?8)Qzn3cOF9y4AjJS%PT;@vh&qg^iN^c>&RP z(JR3$54M*tSihJ(1mBQ%g+{;Qq~)WwcxBR2V(5ul<2+9sA|vPDLtRDjJ9H$gZ;(Or3I|wxr8cBHnW%Y zxl~p&kzaImN`r;kMB;n2OQzCYXaC&2cZZozLpeed&@(*tSpv3HzM&)>00_BXL7aMU zM}qcw!CV?Z$p|mp%iDQX;HznogfoF-B2kcE5+%OYyeuRdXq;Jioc=|c1_janO~=4< z|F;GvxHC-#g6ky}d6tQ`LkHy=k|xY8&?nRezHY#+?rG*F{(6MSBgSLxFwC!_!Dl+d zS@A@%Tc%O{JfWOS4SiwSChy-Jz(9#?hphs0{`T?rwA|pkV8i8fuDPBM>KRKz`?47w z0%n|MMHp5^SJGo;h=aZaa1tX4H+v6do(~l#UUkT?RfVMnO{trink9QtI~> zGCQ({eLZ5h@eUq*wU>X?{APGH#bA+eY2C2YV`1p}jgN`K?fgh@3D~-}lV4mr%a|LXNU>JtZWr!$n%0o|#>-;)7#k*R-11m!uT$ z9yIXCn>dRa*7=mrvNSHLh&4YGS z{!?bgUQFw0WGlqckT%`FjIh+KNp~;fZVSO6okU*cz7r=d;E(OeR*V6Kc|8m4egJ<0_R?1hAX8rA+Mj$D6f2(%5V0kOb4sYgSmSFc~o}C zQpoE+0Bfk9P8dkW{j#XLbkvC4+DFu8*3WR3Q|e%=2!rMDRB8TjFw2DB;gR*lGmGDZ z)AN)fotOXR++E%8F%qvxs#ldL|7N9{D=HrM{KAQXKt>7F=E)oFE>9BGm--k{cR3k^ z!M9VpMv8d@A5-iyrx%ksNtw=tT&DByx7nB{!SF449*v&VItO-A1cgXs8z@K(pzK_! zC;=*amk3s#P+zS7PupNz{l{dL)d|Pa$U(}*{vb^b|G_otlO(d*VvJ!~-+5g5elcvF z_1XIm8{fGrqcc?zl|1CsNCdC9^W1Y+&rSJH50&ZTdL9;aV94j8Ic1mY_B5}3G;;0q zg4^DLBAC{3g*iT$(6?Fcn}8~AeQiWYA{D3!slV*Dv;a=BmnX5Hm-~=J*8hQt;%GTG z48wSp(ReFb`xx2N&X^d>>h*Y!2R*6m#cmuq!`(+?p!kTlerN)bDDpe^*S=D{ZPoqX z^I38iLHfs!ZzPoqrCJWdw3iro&Lr6&J5f|)P+wjBzV>X2KhY#U##9jEGqhdc-Z+C? zHhuw{taX`fP!L0{4*#34N2wAb8*C`8h&vp2x3Ncr5S_4|qlTf^LZHR`Yr4mKZV6vv zY@`W*O?P<)D9H6!b-eiX!c$7;d4lFbHxq0%>dsi*KS?GMYqLXiUEjYHlZVl0K<^$n znH}}z;;Xelu+p)|>gm}Ruu;5mV1}?L1wjB0prkWYRb=2nQCE&RCL%-8nc6;7hw-c~ z&r)Z5d<91%1Sx%as&JTwM@6{k2h@l;rde<_vxUZ((*c_g4jd>&z>p5Omld7{BSZQA zkyYF+M4$D0o;7uXD1NoMAczf?HIBzw$f3@3UPEDjH>9Fn0;>0!d%CE_-5C-~@+)|G z*DC|4N~L=6vA=Jqw8t4_@ByyQAUY8QQ_U;o*hKvfBM7PG@1q78rKRqoR)S*0CYIs| zn1wTR(ze8H$+z0^MpQa_pr?PZPm@HxKcIg3Hkf(jn`g-#3ik@RHj9H!c1F%fh3-|@ zqO(!<70RmP(J5Ue9L)T?|C@Sb_U=?fY5RqdL~H0aD9S{nC5OpudxSmCN0>T)QK8@? zaW1SS+eiOUs^S6fz{8@iW(#({?)y$7JvrH7A0B%PN>faG6 z0cq?~D(Y{^U;%eL-N{h#kpNiUH$!T7cJ%|-B%!rS0x(4h;oCemISM-VFz0CCLTUh; z2yY%};uY2ogxds;b}0Unh?@Rncc<}$&Rza@)i)m~XYG>({>(`FK6O7(tbbqR*K-=d zMis58^HYkS%@S@_KmVYxIpl$K{2k{dAAeB>v^VKYJ+Q^(kYJwq7{k$jpbOAorA&Y^ z`3$$2md6tS79ZReYzdFc<5TiDq2{HB?NSjDUM3eX#SxQuzewFW_R=jt`QOH^gJLX< zzHgF^B52D=66nxub7CS*|7`1xx8C<@(kFI=P(U48r?$5vu_*IW-qRT-R1Ad$E@4s z(|Y5qWg~i2kTMe%kd|O4r)=2F9Q4jUy(;(iTNQG};-Fex=kZ%OlN44U#qkM>pnNXp z_4_qcJD914T8Z+^x;b%XmJ!%S(N+f0a$gNzuX6V^@48Cc!v8~I=eiUJ5=pC zGt-drii-MyX6UDEf=DFc*V`+JTUF)Ur7lGJkjtNdWVnUY6zU0dvssS9O!gzIUqZ+q z1(!I^f>r;R6E+cHt9xy|{`P>kK~uV3JlG=o`k;A9cns$%F7HoNo`pyHz2A7t17U?} zzVo$mG;lTrDlRroidQJY><|TzIG{sLZkr+m#S5ZpkO;5sMyVg@a3=xR@bjVorERSJ z{MIl2UQ9El;yXYvAiFlxCo6CPe~3SlZ;3Fh_$kf%S|V1SXwUi&!##cR>m6@cTk%^6 zD2GTDGK*eiJ)Ys8XC{I*EGv0+uzriaQM55HwC`u&iL=j^;CrbegpfAD5_SllGgE^P}6&nAkk9hT#Q*7S}<&J+(GkR`;zJ>w*lCvJT>x^B{FWW-w}Py)v?7Op6b zE1xak>Y~>qza#??qcKX90Xgtdb8+#XKwn*{r)}@>#P8jAgrU7;ln%j$xUIX{@_yG$ zpt0RkM!yxOOTC4gtA!iIBpxLg!2)i($#6CvgB!>B)63>lue% z6I9?P;pa=qQwJZuZ=U|jNDFE<50GkX31;S3tMzHtsg83PzgzR8pDzi>*jS6z0g+XY zi|+Tu?xuti>zay0$bA6eYf^tQ%Fu6J7Y%dBzJ#RPy$$gZ8VSPZNh=%Vd@eSM0b0Z(#o}%+*P2W3`ZT<7H`YKQO^`@3zt{l*eqz6|T z%_a(%28`|NhuAm*{^Cic!-nw8bb>#-erE%g*AHNs7N5O=I*^n zRnL1*tnw{zF=T=vCW73-yUXpsCLhY`yDJ}aS9Iynb?^FRM#H?#vQ(du-c}=UNAGU7 zPli<)j|T&P+u`6NDOKfnw+r&ON4X(ovi@lGSrw}=r8SYfQh33GEMj(wtY_--K?;Dl4LHfJqta5WgG=4n)h`khQ%nF2HfU|o_!zvmj{s#6&zc_mAPLtZSYk- z5eu>0&m=N9hLFU&KtW7s1>HrL;Fp7ddRXe?Lh4OM%O6jG5FL?`70Xr9JSfW9g|#NL zB>abegyW7xka${`OT;4>US3eQfmc6{AEMSYxyE4HoOb-6Ks?VLw!z6U_XKl>aE3e) zcr1TekdtUJV+mo~jI_LbL}ji{w}V%BN4*#G!*pPQPah(D2cEqwX-)EJQaU3aE;c;L zZOkT<@DtN7D|7rI=jvDcRfbhlUpu8Yoas^G9uAx7B4B;4fU6@>fz%}Wbq8@cQK#Yi z*AK73e^F4)+R49g=#^Pfaa~A&T5CfCAB!@Tg6=RfnIkruG0*y(v~@{R<@sIqJA^la zzO*3nnBLf(TkP1@nK%&wv^kVo1s?{G=`4e|p2JZ{k-01BlpWte$e{8;*P4yH3*ty{b>cJo-gl7KydgP=Wpi}V*Fx%|Mg zxb<&74cfV~1 zS(4mZeJ=YbN>1-M=v^WCm!~Ktic$0G;!cFp3L0IQW-*t@!EF>E)mX{`lh1YJ@A;M) zvx6;JCuQzPw3(3aRrU^@EriC&H_0s|Ej4QMxbmSj=gz^d*DgR-ZCoy)URp` zDUIif@hc2~y_~$9jf{AaLi|L1{gYuv};7~g4h5nJD&8V9g&-6lc^60>-!V)?t_tt&_m^Qw1bMhG(nVoW}t1r zwz(C*8smu0%lsmjEuFj-!~c<_7_D{s7niB_z~s;Demg-!C~@uWIkPUIR=LrBc9}|m z5dUHDFtdFIgYf47){t%uuwpT{9DZARb2(v~_#3+YMKRh;{ddC=+91RAw@d3_`nDP} z^XU%U84uVKC=fmZ%q^v_(meFruKe^Tspvsg@`DYOw)|B_(mws2#%~X-&sDpf@2Z|R zEK8N%wyUBgC7f#S+a@gaAh1?vE#{v)jbbH7uk)wC4^|O$qo|Ie5WbmH+{1; zI}4Q`AY`$voT~P-&u!klYkXMEUyRAktYZwPalV3MhGYH%m-I!LTy8KQL})oG!~uGh z)i%Jgu|jp}u;NAm_;kN$zk``+8F!1H-xmcSK>dX9?2f1^Cbq$g!=Y^X?YgO22wWeW z#0pDAwrG%&cg$wge;>$c+Y+0T@uhh6@ zgqjW=%wemZzQei<;dU0`QL(?FfUUxE>3T|2!E$!Niwm52;Xg6f z*J^x>xv=;X9Q}>aUZfrXV}oXSzxdKsZORn^{6&WOi^BiaK^$93;V7wAcTxJGSHLiM z2`b0G5*-2qN0xREylf{3!~7nOF962;1cAQ|R&pJ@S);jbuZDiE11$#vNCG&p+yTlE zXhwijlStRfotvV?8$khs*bB1~7tQYkfg+rXgq<98kb|&Q`UZOXviX5ADbtXhvDM&Y z|AIh|zWr^>8_Xv)cY6Z{9*{CgFFiLhi<%<xgGz;K`3wq3;g^(T$|xtIZc&eN1lrC(d8FHk8?(Ppy!%x%3+ha2m=3 zRFqbX5XkmNnhZR=cnD;h5&02rUL3#B#GRzg#izKqEqnf>PVNFO%&_^QO)Ub}KUROR z5~@7eyA)L5(m~M%>q=t$w0FY=RFRrTLsafAhi$2FP3`Qej7EwM=U2^zvJ|>>5GNGW z(aUt%;zx1>7nbA_>!8P0q;W*l>~gC7W$Giht&Y1zOobWs`_}ww&SCX2F(osOW8od;?JrUVj7VKTnDaYHIhz`-70gPw@;(1x z8i9`tIc^Oc zqrFemN8<$MwO_`!8Kvrav?Q`bl@-T6Jl~kmLL27EKdLgPA2|Y(jWBjw-s&5>N@ogJ z&I+K@MU)bbxQKqoaYAB9(V@z?T8pcSYMp1}aBcZcVN`tZK*QNW9AUwAF)|Mj{Y}a4 zuSOolQ%Ypb*qV6rF40f#{$o<8X)KnqFy31-hH0Q_&wP=BSm*2d8(LwtE4e7!9EBBbJe^rsjH7O`ZM^Knxm+jcSu*+~ER zu7<8%MDl!Z-!sAaTLBvH39ad5=&&L**n)NERWbjt*^L^8Vzxs8ruqo&U}IJL3@O1> zPOUCiQJ$K++UFk+2MZ?iQj53+Likw0rz+E;{nI*i8A{~s@^)ENLmH?yt1`8jfU@EP zE0N{cnW8<9W&a;J3Ej}T>fti^LX8%jp6aon_SzfI=~#z9#{5-SzPQPn;v#$}vtm3i z{TCv}rf47?I-Td>9ixp@J2n1ip+{0EdjK1e32-r3GI$f1^W0b0z`i5y!~vGxd-76Y z&L=DBg-FdU0vOwKyn~xY;o$z<3gD_>+rVJB6qu{icGb|)aJhWh2uMx$FpZt5I8~L@?X;rQSh%U2zUwOw9(#)pm{H_o@#<3tgZVQxzoCcj-P~2v$P-Jyyex*vq`!Y;k(;w31l;F(-E5xz8!et;N zQO5kgiFpIpBwFb7S8vy>&4ZpDhXz``UAxD7$I5u}x@?`;75uCF)BSTPC~oKVm{36P z&HZeraf#$dGi-TYTBx85{TW!45S1h@V7^C-Jvc2dikFEHnr$YSy1GB6B91!oMp-GU z8&6wJO1@IWa-)a?sXFcNcDMTs6&g?Jpz$|~FsD2hn(h@MKhLV71IJPhs?p@7Ntywx zBj94?ft85w6w;tP>tq912+Ky~+u`sgm&Pz1Zo0m2y)k@mhUaxY_T| zH+uNNRHM13+x^C->{jH@!{*Ch&o8&rn!2AWwEmuVJls||>>oHPTUXT1%Dat8%g~&< z>iRkHw;^I^bS`aeYbfRxHFYO zm&>%RkPn}OG@>a!L6dcSb@}Bozete#m#^>Xm0-RE$388wk8t0a1=G1|bo58f6rmr- z3CX?Qey|V$_gAhxge7cIxIA_W`lUH4mCI!PR+x`Ptxju|OQY33JG+8V%;o$aY4f|l zNLquy-_VLDtF2mMiMLiG`UXtilp*aVQhMYzv-A?A?rLXdRYjNw?ZxbVKGZc(XIaHl zc3_WAG_&>n9%Foz%1?RUS2KKG|lid8#fkY{Kvm@CXw@mQ|+<|!NZsRM0#!9!6U z!(P_$Uq%Ftl|sCO5*?b-hDYX9xhxK;4QIs6(;Y~iE6JTsD)PIJYWhb>oQ6-8QlBvs zu-#%HjV}Id*29wCR{QEY&gcPQ+jl6laR4X*sh6DKY@Ykrd}%%DCEGG#)*?blReFoU zm|WLwtjcwWXq&ZGiJ=-3Zx>2xEi%?f|TIgozT5uL?z z#{_qP{T6S4Rw%X?V(JI# zKitATdl^a_OgJW?in1P4cWXW+UE=F<{6y zMp&wQx#nrC$HgY}Jx$(InJ)Z9yk)xU&qgb+>0DND_nVD$TDLu1Tl%IEGZ-fVGA8dx zH2C5Y_%nPYXoa~FxB`iTq~fL*SBv|Q``?1z+f8&zj6vjWqq-o;90alRk-%WZQXUu1 zJ2z?WWdz(JD(266m=%;^wb&fLg_yq_&VOk%F3`XmwoTDpeCXtiE-zW^1HMSf>*_1N zmnN?q0GPkObIV5pFahiDvE*$@?^(PFwi9Ic6XN`}+_yAb*0l9T$V4ECdFO zQa}=*nEVvBewrB;Ki0_?fKQ>o0g+O9w^zrl0js;W@qZi7Ea#VvYJU#xV8Q&u&BJht-+bVpLlI0DmwsN&M$7Qmi#G zLszXnk=%$mzEgNK2&vnjL_KP`CO=IY63zlLq}N_VDnfKdB~T`#4mifeET>!Zk~Ch( z#z(wyHkpu`%(6vTaK#&FE(~fcoZY#IqXkxVR#D#0oUsJAsWKu)MUApf4e9ed^3yDa zh{;?SkpHcn{G!<(IxI`#?yr024TCLCNb0pgRHqh~OAP*O{S+EbMe*@_oGQ)ya=_G0 zZ<1o|#g#SJ&eIAuJtUj`;tj3=j502>%MmxW+Vqo0LqU?;;}>ER1MbDcU`*Viit)Y2 zRcPZNuAXp*WNoXNgu2poHbZ%c7F9m`4}nv`FjA%=N}cLfWuUXiSBaD@eV!8LJV(%y zI!}Fc5KmR70ht;^7s0;W#Y$*d{XmNmH&#Q@lKa0iPXQup=nngC>y0lCf3JVAL2shn z6%Tao8VdbL{U{|cmTSv(-Nrh8?OMm#6KJ7?yWR}B_kwy-q%-*h>p0~+S{@c*lqN15 zTYrD@*cO54eTcXXr~z zo=N>o-qJqoRW>5(2`{{V-_=1c7riwn;kC=O8VV10R8x5RY7g8;VzDI;VAo;j*^bgSDhTjPJhipUEO{Jeq8qie zYKu|bb*H6nkC(LO!?AFm!d6w)BG;&}?dV;_DIy3Q1OEp%maE2MZIbGbwMxdf?i(Y{OoDG}nfsTnteY@JpRJ#g1JZnef z#I5h&zsn0l3<$JXy!Lg%Tq_N^Ouis0G#+(ZDZQS@0TD1xwlD)7`b|DL6#6x{n><m@7kh9#NX;WB$iDwkH<$0VzpWzzU<`M+&o zA`2PAwHo?&-zrDod$*a!-i?Bj2Wnk>J#~B+<#LH@8q+WJNB~Fp5$44#Hty}ZEa2>w zhy$MFTg<<(xf%?L`w8%F)q zpDFO*-x*jnVR`+0nJR1Hj z&k@I`%ud}AsB+{dKndj{*-Y^a8WU(2<{Sw&zDwPmrucgM%v)`8Tg_jkUbJh@r>x7F zsFmvxU+?qky%J}Qr(qblR)db*^+U7bo@betX8WKTO7U3+26wACkZAy?Jf$gl{qG-j z6yG-mxWkPA6e8cZN6Xh8AuO=em-gA_UI~*LyKQYSb?_spyro5lU>Q7X&YtQHX@VR{ z^6Qay!8SI{%@Z3B8LqU0AKy9;RR}uoHsm<`;|OUTu+&8Z2=60 z*F{fy^}Bi9Ar-DP1ck;;&jmc|9G2VkewG!nPPi04!#(B6PFGdy@B>Va_Z7iJtxiHI zUvN?1ZKISR{QtXDIxlSR-t+%{lc;=1Q#izRIqW!~I>#!_kQCs6JbV zp;*xJ6;~04h`*~|XQx1Xik8T9DDbZLFu&cKj%ng8$$VR^KYP<1>5x2%krMP2TnSw2 zNuw_dR*UhAdr93+heITC_A;1R>^bE*vJ(%2o>8KwXPsJq4D=)F z&byN7oA~PBTHQd6f0h0J=;4MjMSLc%!FI0zi~)G~X3-cjzRp~hc_j5w@q~EBDj?V` zZ7bj@fiUS>P}+81HQ(v8$R*Av1YU=l0)f1&+Q*BSAVs_M)djEuD;oaL9UTw4h3xj0 z|6pO5H8&dlBzD1>Eq}Q7$rrhkSFV`NB8+H{*i?(qF|NC5&r_|b&7i%MQ;vcu-)Dt! zL26OGR20jNO!~!;ILQ}QgfTVxkIY@Cb7&flp7z6O4)(#qBnqSePd^ zupCl}sFaB8KTY7R)k*d`B?KrdRhGUYlK5{27pl@;eAkO|D(GT2%rhEMx3;kWhBrGK zpwhc{S=z?ftN2DyvnmRvX2mgjh(+<{3^`A(4i9Qx@H+@Xgf9~|=h!whu%KxjT7oQf zpQaD1k~gMg?ZA;(_$`e!gpqzzVi|~fy=W_wt4Bm zyi#tas|$$OrKFs~KlT}`o2|)~t>l}NGFv3<1|Igz3x_mc*dIxYSHkzU^5*4m4YGi- zDNa`~G^k;Il3+^g=j%4B=M2TSx?LI{W#4z)yZ)AQ8lH37`42-U?Ef!ISsmuPRqVU9 zd%2`|8G7?)VuHFBHg!bEUn_BQ(p|i4o?`lH<>?9wTi>mZck>FLX$EC66u;}vPsqbl z(cj=NO!A=$22AvWJ|#!D=*W|PJrdY+?3Qy@?XTSB*{(MwBTaQ4}Epb|Ly6B zpg!I!in4mR&U>F7pjC*X`CC6jh$bM67dg?%s(-x4__^B4Iu5tJaGNuaFG!`{&rteV zRfoz@Fn8+KlAb!|b4y<%Nzd0CLtG3feB_ysY4D@Jl58gPnXiw)7LdR%tNoCTl zQV+2W6$AL{+E&r3?Ja_Wo#FBWZ*f2pNWl~o%*#`0@`e^6*RW=mcvQABhJdu+z&5(@hxay z-1^#hSkHoI44{Ce(;e`r*JL1&sFfrvcd^%<63p6{n{8$s@Eu%qooWB(vyW;n41r4* z-YJ3V4bww$Ed&+a_FngdX(LoeWjvPpYIWv$gGGW4JQ(`HMx+oe6+#M?B`&phgNMb{ z@MX#1MKCK5{$^kSNuDM{@gpnp3V7xk`rUJHY%DIYa5z@(si<5+%3?z^dFX~t0e|Ai{mQP+KnXFPuEgnoO3Yb)+QPM?0^3P#}nPPj~c zk!yYa=TmDl$LE;K^bO*PhuW~Q+Wjy3+$8DTvaDd9XIbBT;{Ej<0WUgV^QtBkl`bT1 zlTq_`iBP_PJLgBe_vc9Xkrq;#Mnh%;C+VJpZ*vDsL#HmA9&!#{-`^S z5K_W`=E6^hwpc|O`=+90S zL9m!P<7Zrl&i~0m9uR0rou7?f8}8x5^~5uqp$%8;W&O0G4dw9ipss|SM5gec5-uI(l2qZmj?WQeduDiuRLw%S zMJLFOx~eZ*1gPR}$rkU=&Z%)=)+($aCQsOlmQKVs6)29O&ar~wlg=|5Gm{z0$3gW} zT{7Rt!XHVAqxf+E`5mLWL~CMAlLI{DW4d=#={VBpe|>up)<=FX=Uo)2HG=ep8wr(T zJ2i{*XFCdg7412{xj^N-Dn-F0ZJ(HyZEl$05cR;L>venFtN%yUSx2=QbzL4S?$F{z zi@UqFxE8CR#oda#7k76l+T!l+5Q>H3790Wu3zkXen|bG*wen}OR@Qp%bMLw5?ETwq zZ$}(4lWmNYo}`F5Q5l6$2Gi^kzji5o;pOkXSl&dJV*}m!F((L}vWB5>;OVfACWz>Z(N&Lfy z&haV~tROx&bD-=TB1JrVeNS>nf#;hz5>>;IrW`p9^$e<=u0xr?P}1n~xwsN$D)3`$ z;(s?GxC<+C*1}$Pbw!Tm^}mcUo>I(f*jKt^7rw~5mQlSaMXkPV{M2tJirNo| zLL$}_Mxv!ZP_b#uzCa-_wOallJDt%-8)BmInbX?Gb&y}C>SMGXGW|za6QIhsayP@Z zQG}F>_fb^p9u$alm{eD(&!$<&|LMJPJaAWFsL`e(M8i|t{874C0c`jBnJ2+31T`$^ zL94-=CS{TIUf*PrNcduq!Kao!ND+luMtDIgDs@|naGXsKmG!cwPoF5;>+VPfBpBCI zXmXPtc97U2uF|<8K&|p^WqEJ;Px!+rcer{?)G;PZ#f{#N*{om=XHbl#m3|i%i^v>O zitvd-?YiSH^(o!YbE0u*?5JAB+jQ70R7VIi`^l>WC%eo=lo^M?sfw$y-IV%!Vc7$U zd{07X)}ryLWlSGLL_ zYISRyPy0ebav41gL5e3jKOK_YGuF(}6*j!x(KTd8^ghvooUDD4$`N*h!nb5~qOmA| zrG?urIc-=se!F`W{)D8IITmc5!_G(&iq6V&nMNOpq$*hWnXrLzlxZ23es_}P14 zb0lqrMdUxIjh>jOLB($e0ZKn;)vQBqF}{>D6HVPn*C9F}>0nD^!1tWShOh#n6^u;i z**%tK)(a%?1rXTq|CLgQ1uye~4+#jGaQYQw`nK^=xF4;TQVxWIPTs6ep>}iK#$Jto zr&Qz}5{Mc^9<2 zoiaLcevOe1ja6;$#T{YQ&y6py?Mvex%xoSw34R4`5AbGI}C0&o-=-#41@;4 zrQQG8YP;V*s01EyJumk{g<$&`xRHaM_c&ozyIMjt$1+|az8FuCB7`3l{KLrH@69&x zwmhRa<7UOt6pB%6;kS&s9oI8LznsHOhDolV_d`y7NoCcE zXSOMkv~O*c_ug3LG3aEOz+q!Ya8AHfDmZ%u$B{6bnSH$1ro>oV1Dzu!>>cg7QnsqK zZ+otx1o|hr0Se`3p;Cx+8%^dJd{0Io5CJ4stoEUsUj5UHQ}28A)j1(EZ~R3aLk#$c zpTBjofJ!|#aCbC|3JR`x*Woejws+Zn`v{SGD3N;Dgw;#kj=mf;{MU^St+e+R__C7l z{I3#&dGC(G=wFr3vhq02;{?%eZ7$p|z$NS$cZaJw{qrpcHDs+#vL_2O@SA7rYu4A4 zs%qO|I~^0Ww3vPNAatc3_{q zjM~dVVxE3}ZgyuBx3$OBayXO|DldI}f0fbe7liOZr(3b$6*F7pqlm76a(kg9ks^vB zQflJOvJCBM9}iB|0ArW^=~Nr8n?!1!?I@@4HaY%H4|LjTB7p@d2yUdh;T5jL`2pIUw>bg#a4&Z2bEVWx`Adc%cW>)|zw6Q=Sa25~ z`~waI)jp-wO8MTN<}uPdi%&taXbJhFQ z71esrN>0WEp3Yf>`vErPBQ_Z$QHA)k z{ELixVP#5)&PDH;iS6;P)9W?RwkvJ&cO>uaS(%kZijJq(tae(Ta!VbQGg0Lv@m*2q z17r|)^&AHUT6U4FkI z#Rl*=bgi2CY?Gsd2i~Qs^d{k7)@y38C5)uy%NSDj6OfC6sLZgyBYaPB4aDz@J!p;G zQCEr)^4Z2Mm|6b?N2kNPt4t% zXwo@mE(7A@j-Nv}g%v37DVKczqPb{*weyW$o;c%2t&P(-%7t#cy0mv4`K*+hJMW0N zsvQI=LghZ|0Gl$jbr_w{ELT<&pGg(KV)5n7F(dRfl@48w?>L$y6|On=(h8<`Re`fG zRX30I(eM=|_c5?@W0*KhAoBWG0zh2<_?4SefkHOS7Rxwiq2=MXuU{D;uo?JI7EzFG zHw_bjjY4Y!u3W|h<6mg0n|zH6)tSrpg(r1vl$w0=DkP%rj#}fI&vyZrosUm|GeG?+ zg{EKb@dUJ`+K)VjS=3u3?yL>H=jb5t`DP^daW}8n+;)j4%#oz zBVQwI-i9&G3l39njnN9bsE!!#eubCB#^n@-cH(!q)J)H)n%N^f@jBesJ)EE^C+k^4 zmJ1G)a{HR{Cis0DJ6SxHVFwoMTj-@VpyC{t!kf~kV>gYz`<3;py0#w&>m7c6e%feK z&Z5Oi1uxs*O{LLq$y5}DVO)6YG`?WJeiZNlo5!l(>}s zWChCd=~4}p7Kf_I%&>nF2;tceMPIT7w-5*se-rJ9yx!SGez=V8AJN&Tk|olq;3xn$ zjYFtcAuwYx*eS5*w%OPwPzpHnha~elQV@g2BphL6+%sIMGzxg0md>b$&1rz9+9rt6 zdfhMP+}}Sm6rOn)<}g}1+`e*e0;0N_7dw3!5pN!2PRPR^mVsV`lEw&3>Tvk83$kli z#eUjHo~KJ#uTf~P7}xHZX#6Dk!P{D9&KKHQ6@T`e<}Tu8N$KRmNSy{%vLwT?a;&{n=)fMY7^2P zWNs`rZ8j*E-zF_h#)$HArD>V9?!l@3)N}4m38V=XF`)X-6qSxfcX2nhf+H>=?q>R% ze;-?w#2(N}T8rXR#3TG)*b)rQ61;B$7Q{d7OXfRe!FW?P>|gF)G$6hAq`Nm8cy=$f zP~)YiKxIhp-MaZp#`qm>?ISIR{! zQ{cXG*;N!eVsGo5Y*`vF$BT{&w}*ctECgKIV2Ul9IH6mCvt(xi9&N3+7n{7m!MLnh zlvn5|jEKG7^6_q4%4wwzD-}_quM4%JsVJax==ZkOpI;TSHY$C zgk@bg#clHa7%9RiBtpPy1!?rGYxga513P5sF<${x6)s8cR>RK(S5ih^8*oWUS$`fo zqQ+Rni{W{LxF`o;;o=+_e#7GbODKRjQc_kl$WYpOJ~9;;!?mWCDVM!on^uCbycsIa z9d-H3)!>5!VgW8A%V`F5FBL`_B5+_HxhmsX9L+p|g)px95tXEyPXFd;Y@(x_OCQQ*xKND>J0O8b9QLn1>$}!L6>| z6u2M)qGG&+tBZhnvG0bRS1Fzf`J_%yi6lL8H!R21u21;b&t^IhaTc5POV^(*Ix9uJ zPh_>dh5(DKIN*dx;e*3b9`gLojh1M&z7vI&@W(t$_tRYsz`f(|X<$Gch-zi@fqP;C za@<+jVRW7klM^{z|F@cY|6y`h9nNgPx3||&@XdTr{vr> zduumz4fs{?MeXgNQlZP)$~n)sOLmUG43w`i6$bsf81R3d+~{Je4-TcX3<}BsA-!1O z8_W&_(A>Udk6NSn_nIz2;X+fb;31V@mU19?Tf~5&VFR@Yqc^AUdtoVMkGeFqO?J7k zUiOLB8F`4dEHK85qRX+$bJ*||h6Z8kj*vP-DKp+Y{td=*fN}jP=Q1-DV?Jpp@;n?w zfUn9(RAsP57DhKY|7hb?kQJbVVd6!?Z`D(gwksRaveJCx<0l6MYySQgaMiHu|;4#FW8H-FDdBo$Es%&6%S^ zi6>QV)HgBkFn{>S#VHZvl?mvN?2nhW{%--n@LwY9s#6cmqp^UABsr%h7P(_JNfF2+`c( ztdXQi@e-q_-a<^6)Oj+_n1>xRY z>pWbA!XLOA@op%SHy#Lq?9;S!aMNz$9xirpAaOpWnv;sdXO%3w-%~)A^Bi&RsTkK_ z2B$Hm36#ped_6s#uU&-j^8b|V2>-?E>@(%s{J6bqUFM}Fttbw5V2g1w4?G& zA=hb}xG$Hm?hewg^Vt1_07mV`VWp9WpYkLz@0i2L}~yV(>{TGW3xXk-+clO z)Fa;z{2kHr1=LvG|5*^L(Y54cbZx-Y>m zwA5^EEJ=Om zl&YYr$zwr5^`=Y9up4~&m0C&CbI?v~Gq`2V>)Lbef=X=lYltmZ??$8>Z(QfY2Z!Ju z^L3wmBa$1ED?KAytef(OlGGlEQTH#^)z#eybARLC)E7MX^ktH5TE?u#v9I5HR=X|a zSR9@WNU~Lh9+x-lcn5ene(GV4ndz2f<(sHzxxB3KTLs${z)lk=Bs<;W<+B6=J}<4W zv{v{{WPpFzNy55~g%fmYHYBqtzQ|3CvzI>jUSm%tk6PTgz*Rel8T(QNy_e9I|3P@y zLIX`-?DB0Lf#PpkOQd$WVV9C|h8S{H$Om6p4pja2&(^pi^BRZe)53uy5c5} zRD9i(ttD^v=k!^f_>g3N6``}*kJhdMy!>jy+1w=F&8{Z&-L-5W27723fhwd!N=!hF z8xUHzuqyq-XSH1u?v)#f@)P#Ui)h;0blY0B-bMLfWF4-@!loE-h}WKzz^`shmUQC^ zMK#UTvj`1pTc_g>etWvhpr8Tdbr^>;iX30maH$VJN804WEqz}Gk?;p7_^v|D)fSC- zyasDHv=p>XQYYQzWihwa)vf2at<5{t&6Aj!7$A(|hCI)8Uon~)3&&TF9Lqe@s9Df8 z+9Eu9gKx(tUW*0hGGAh=L7O_6A?QLeF`H-p6uO;l!088mnQlXq6CeKuD*aC4>cN}F zl=P~D(XQIMiocF=s-Fy+f3J^iPypw_n{TD3j6Yki?DkJ{7aFpP5)cA4{MPbNsS{CAsR^h<9D* zTXqROZ91t9udowsreI=>0~FZc&gQRNrj=d)waKWdGZvx4s+u&ncuSWkW4a%QUCcLSq_q`C|H5#Yr2cRZR>k z+#)_wg%Fc7mS(glh5Wo@nQK;q3Zsz@d0YdyBFadBk}xPBvX%(_iBo1SLNLQlMT{<0 z!=R*v1+o;nwH=L}b@Z+Xqs+(IH|n6U0-u}GD=>xnx`tEXUc!WRX!3+0;)#t(iV29C zKaTj6KQ#hOZMpLLh}fw{v-l0f)|zv~;!x_Tz;!R&Z#hRZ-p%`*N0|9UE-Duj`c3q+ z)v&wFJ3@xyPweFr!LzH#@y=IH15Pw20*KfZKD_#|2yGnHLvF{wQrYtHjo<;9%!odN z+S#XgMPCa4d_hblZXg>}hzczffwF&mzelM(@0w@bKKah~i}-1qT4r!|z8fub`84vJ z)c$4uM^u3m8tb$uO*^bbd8W~`eRJ0mUh7~;f*kde0m6xWJzok+(iD@AQA!6Yq~rr{ zbKdFwqgWQ>YMK6{^J|sPpS-vMwms;NAt#nh7W`tGkHo7OQ`9E@>^q{Pl@Ibar__%7 zLViv8ar?P*CU`Lmd%H*eolu3%)sk4O4HKgYk3)yk{r5}y{^H99f6wmfG>s^%m1jb! zUGGdWhzNMy=C5ZC_u6fNc}L%Uy{9iFcotU84K%W%u&ANOs%IP!sf2e>t&X_B{8l*; zMo2FaWITxPrA7b-*UUo#rvnRM%8!ZA-c^Hh&?KZGv(NZf;Ky#CPTmAl2XBux?j^C9 z?sBZr6v^6_{A(Q4Co(Xanzq_OQ5rpdSeTK`MJZ1#+?n^PC)|n1zi5jn{9a8=nl`8u zh*ExayXpk4%SMt~_1gI5vO4FKbu{cABpcL=nw(#BnC2=e*m*JJ^~(jvPXeWU70v{U zNSGZ5#n#4-`7GARN&c-a@^4rd{rD~L2m|B0G9K?@3C$nAeUBEFGKV7Y6=q zG$cJG2nxnL5(qa|@P}475B^N4u5?PyKFg?!s9yRQ%LC3fMjSFCT!}q>(}5B%rMPj% zl?yT=YI)wMd}gt1APJ-#>)fK7)aw4SKCU5#l}QPzNUI_)3lTPb zI3K*xYGxzq%{fW&A-nzMqIT!aE-ERO4I4*vIpBGzNwD<(nLBl{1GQ?QAMrd(56mP_ zP4O;VnCF_PsOh%INdSrjB>BMooY^#11NE9f~y05>E~`zPQP;cpx`F%0H&l?`-jfIOx2KTJ)ry+`smASI zGVlapi!;Lq8PhOZ2<(fu!F=iY!;n;z(#Ba<@EKZr;|4t0eIc%(@IMm}P79gA#oQL4==K-71|_;Jv_j zUU=PBKVK-EwQLu?$*@7uqvo6!Oo-fj^l`T+4FBAUr1)(rT%MmzI2^u2Gl3z1*8a-k zT^xqYGZap%#BykoAsXf%ohaA>b#rlIsujY8xcPsNB!2da>%R~8IKodm=!WxvY^RO2 z?OQSX@RxpAAQAt0_o+X*q|upURd?W=@FS0=^z7vhOt#V66qduj{RwfXq@i^$oh6PzUZ@7$UmkX%d70*L1M&NQ1Wrb%23DtaWBLt+98 z8rtbM#1BN9>#pPfTn9;bcEp0!X_9cpKGFDouJ-pDnzbhA<{9ZHLpT0(^R-iLa0hT% z?1~#pS*vfiJM)Qwks((&%fn>jSAn2YAXw-z5B$M*6>WoL^@T@UWb&va@#K(tH(2Dt z?M6+6x3baY2VN(ipwC_YrjY43w1_uTG*>9ZLuvaD3*A6iG@b+&z8>Xi)2y~ief7@x*dF^$WnqHrdHNp1<&yByU?Q! z)uut9o1+!efmR5$wGPN-QwOk~|CCXqPrdEjFn7wZ(~}Y`ITDmfVOVX}=1pS~>?nj| z9*+V`kSU_MJQmU`iiawL;YSA8CBxjh8tr7*=a@&FG4?RBw0MtK<0o3-s(C)MXWGP@bTZqGF}ciKM3HQnA6EYTOum+|AMQm?xS%nadQ@ZiPT=8Z@9fWm3!Fn&MH;$;Om% zB_RcGk1MW=gNC!KEV6+c>)K!ZVqk}KK>Af)b{28A>8C6UB+a8nJ&uCG@GD~9!1^xM zQ6ncejw^sV_wD-B*25a!^fUScX~ScQ zmgzu{i_J@?jU#8lgfS8I!hE6XUa#O6wDIVQu`gp@4MtLEnDoYx{9>VVBamfPCNY0A za4e3O<4B}N2Ey2dc+=+v^0Ox##8=r>%8;(*C#NpEv@9c{TyxXcTs8wls#;D#+&Ge- z6n!|wKU3g1EQXbIU+z%^ueA6X_rh7FcMjr@xZ&tw%v)qrS78_C^*J3TL&EicZaF=F zFfc?Vrz=4zO$PMeN`LjH`PrtH#-(d9BPom=9hRgNFVU@fi$ADzgdNQt*tB=TZxH!K zGX+x?Gaj=KD0U$Ir&u}=wqOg^`%C|V`O zE5!QfQ>Gb2XYZZ*n%Qq3S$7Ji6r$Y)WL$R!n6SH0gII1aqv^B{SDIpq@T%XK?5&xP?96-7wGU+nr2F&!G4=cdyRsn|-5Sr=o@gUvi8F==^=kYjokg z{t42bk9^3c?%aA7PBhq095$7EmYBT8xX`ZsSC~C7mj!ryOj`;#QVj!JEx% zJ62EwzAjalnhl(+*eVdlln51ONuO8!B!=aOH2{VmRcv!(3}7||l4ACZ+*jQK70Y|SO7d%84ZBY#Yu?w~)9U7y<0mp`dQ-6|$`rD` z-^JQi&1SR%u%qLIqA(zi&kZ$Zw#_CQuBvN^oRNy+oEePB90EK?;oJM`P`R2whPlXJ z45)*Xx=({hGWcalfPFD5pYy)qFJ)-Y$gwBZM0?x4?Ives>n9f8mSYj`{QYW24J+gB zZvGrPRD_Ef-VLwieVGi)bs2+p(yU7?cg6eP8QpjZp3i-N)%}*k zipDb$;bCKaO#RDlu}npE{CVQ9W2vO3KT{6y+rh-+(8NA?lhJ~Ct*|0WP!%G=Ppa z2XKmxqTu35f$Fy41 zyrOsY)mO@j>=|()UUQDb71--u3;6nk7z4pG67A zz*!dclw->I$91W)%cbGJ+-2UjQGv2@1NVVfA}Ea5q{747wHO~wcb53I&IM}GErx+`@u`7H6JIf2v@yib_RYRM!O@h$N>P*>(LQd^MJ4-3@7??j>Z}%@ zPVzNRN9M5)hBry&{w`p9j1Iy4R}{t&2`4lvkyKBNIG+R$A9fQ%FiCCsqKow^Z-DBv zp%y3XM|sESC^1;yxZISr|0gduqzpS;2FIkaU z?M5C6zyw}e;ERUk|Fo=sLkhgF>#xOa9F@sb_XT@=Ghy=np+8e)N{&?h4xD0Zj{slR zZ`K?k#yLv@m$sOCU#A-s!3*88f%jhU|7lu&7a?t~d5sv3`M;Lq``}G~MQ`T@!Ba~r8m9VDR@X@)mV0_DYh?*q4Iw;U zVG3ei)k;8I94g1%abXEgO3?0I5*7GH&YeDARtS&CJqEeT56U3FbCW>V#8orW?&Frg zo7SF}c0iAZcYL6Z`J+^Ip*tMg=tYq(*u;Q}j8_8$9*C-nJDM!Ul13ZeUr;F$${nb&prLWN}jB>w7K`m|C;i zGc~4VBB%8+CdDR5Y96BTOnb~ochsHcpX@o@b-H2s)w0+qc4bPmGA7W^JRW}T<$e$_ zims8MriI3=3_t=rctxT-7UO9r+kOg;>71EukR|Cz0ZPctQV(Pc5?E`0Ue>1 z@M(ISiv5~c-FKNb`%UVmH^O5)_XPAh10?=ER8`CZzI9M-+@wWCb(uQr*FNPdA}l&_@V2Aa(Kki@BD284H}=r#j7 z(UBV7Q1B+!^8mr2{W5U z1W*W3=VikM9Hd#9Pczo4@+z~UH$n-V_Ops(#-;(tH!(nj{)K5p>h`;}ALYC8Dx=iz zLW9X*fXoR>zcr(<)~b$s)1&lT4AUPMdt-867*&^$-}zYkBC!`!ddA|eA@=PMSo&zj zxtSQT#E1Lk-*ckt(hA!Y5=qlBW`>oy!U;HGE=A5AIZ?(Irxl0fCnap0_+Pr<@EPA9 zQTSV7Twez1#{F)G-kTTvdg1I|UGZNI-iiFnsT)>oK z1Smk{VLyV4Ic>T8X?}H=cShghX7w(l8r|KT-)Bk*^+u8~`5tB;OFRnSz4Fn^P|CsX zEEWY&o8J^|SW%z-j)nAm@!uueeD>uzpDFM^C8YlZxmRg=XE~53=|9iJ$3G*C9eT-)+fSrIMYVw&bj0RtbBP$ zY*mgA#H~8;)?m28JyFIl>ucTQNB8i~)iB9ppOzrAXB8$iS)=^;?zU9~^2 z^O5P!bpVLL6!b~Q+`T^uxien|M=Oc+(}i0|`&(3bu@RJh1dCP5WzFpOm;DFo*{GJn z**k9&5V?chGLbMlavdnnVuNvUUcX|7kIa%U+89R|Ke=IQ2o0nBay4MDVbNUQT7DBo z!FM*v3ZlS}zb)$84k3<-lk5T{%)lqy7SABSofmq`EH1U}6C*O6Wf6XJ9hUQ2_`+yC z*UrS~8x4~Cs=$g&d92NCXj_VypY-aZ6Zgy~Bg0-!Mp8$Gu|L5!7kIrZ)ueJd>R4?F z&$iI-BiMoyAat2cG9L6(u6Wt%d@7HHxTD#~{>?^+T$yW|l5Em=ng7tD{=?yI-b89y zpz4Gog+q-*?R}2$#h;&k*f&#IT=S9=L(8A##YW|E}KdrW4EQl14VeKZ5&c$Pk*1sG~H5S|q3lt(@s3Q`fq>KZxDpo@hKu%fq>Y>F&-R;3YM zz{wkD0jThiVG|vNdDa=ORJoitf&ILPLv+3~zbuRkXD?79%Ml9v81-U8jZgfbX%!^vrOJel z94V8Wu=xWVMsGSnFUz-(L^^ALAND<@pBlM949odyupUi7yH2jKk_M;7Y-ce2buSN# zi@GT$5oaB&5*{9Q$~9r*Qd-RZNm_HCr2Jkp4LYKp!r0?);wedjpV1;6sX2UiouE_y zi8Z{weBzQGXr`UEtDptMVuHSIWY1l^_A(@0JgVn z1ZnMvr5f2pn1ryq`H9!nt)lfbP#TRY^M$;uZd7;Jdg46?Jb(KxyeLsyJEy}|`(XA% zsz`9Y@z-N>Ky`0y{hC`~hM6kQ%_#maz{CcD|MJ^!l-*K(szzUpZ(WK!0!OfMEub%7^(jj7Hf{Xk63aRZZ2LS8j(k5D zO+;Wm^$kBcvNqQ1OcqHKak@JwZsqY*e zBCg>8hMFUk0m3FNaqv~tB%^4??0e|XPmkD$&e~$CM>8mmR#m>$4T+BV2MW4-Y{q2Y zL~p3x>E5$p%fCyNP|lI?zjf*O`8G$Sw7qiUV&<<~#2dn}dv)xW=Jo<2d*)1(quYqx$MzM&OV%h zwrVfeJW?c#m;B8PFMgHl{*5rCW&@kFq)cS1Su0DHd0h6~dgzdK!}w7>BuQ2l#XWRh zNJ=m?1gXg%23K5dIfwa&J?bJab00XxAh@FodaTu?3Y&{>AHsI)!S@X~qRg>zumPVA z?|3`mD#MfB&-wO(3y*RRrMDv=&Rs{vg-~DSo_d>VSkD|Fn~%2tZgRjU_zGHeDuChJ zwk&W8#0BHO;fB4dt5|<}-q&V`$(=@KKlLol|TPIia)bF$=>pCdWdQz;yWUbG7AKh0ZiHm*60N>hiK^Hg zWXJ@iLYY(74YMd1ojBQsvwOd+_QGY@83=KNt@D`qUk{|(NspYrk~E24Q4JnP^MA5T zwOXzpp+RG3pqBx!B?U1aM-Ww|&%=9`mPzu;1FxGDKH<+g&6#AqQ5K^W3#SvO=pv`IP_vpo}?B5(HnE2aJ`(qpQ4hCR|Fd501t z^SP9a-C_;VH(+J4Yx}-Uucw0IDkz!?40Kvtl)OqiDM7CQE47{zEV|G7gJcP zh@cya$BRj5OR~-4y=IS4&tSz%V@s!24`t)J_|QbF+tc;IeGwQE>c;Hh_j$j9=^^iV zU10Lei(^FEOmWxv?BUy*OdNFFleM77>=;V#WSi*!RK3=numwmw=-qF57+u+yCwE-L znu?l+2TVWyUsVbWKDOKcW|wjFWJUGhW&T!R8kQ#ujBAo)rRIEC+j_PGRYPkJRxVfO z&VGG$LPo88)yo){Y?tBa^%end>#|QHy(As(hBgVgA@GY|6NjheHL3Jlg^Vuv^+7$F z;^!h%?gfIS9Kg$krp0MGnXqlA5_ke^>*>6+zLvfA#bCowa(g~IT>M!!8Unk$S92{w z#Pletql1Vu%QEn@z{4M(b1tyM7&Bfg6Z$X*VpB+RN@w})*r5Gh5d0>f`t$eEBv_6x ze`ni)!f0kZw^?cZeeHSz6{cyOZ;vf$$On{YRC|g)L9>$M01Uz-IK9ue&by{ za-3hoh0CTO1cf+QiX@j=5tR4AI>$$BOC#Q$G_e5obWm@G|HErml*h1e(LurYqjfO~ zV?9AlSB6I3t7#%n(r@~5*-WCy9%p*RapV+p#qFN_m zNHkFQOQ=J0#)qpsrg;Sms2){HWB9} z2u6!bB+Icye`Ga?T1=%tw1^V7)AE;HYSe!Axwf8R%v~jcR=Jmm`0ul5oBCTr#ac5S zDYzQ)cW)Qx@Uh-62Ul-pR^Yxve$9>H)tV5X01xq1$=gE!Ntuka_pD<9uQX8{b$l}d zLqF-(s0R6L-F&O7dS34DUy^#oHOq$;qs!L*PZfE;C2;rI+CUz9)XtRN6xe4LW<63V zE1j)bl3pqGh2P&vumxqVH^0j!5p;U+@(PS4;ecs8R0c@N^7vMxuevzV~V=_u#w`?E?DioT{a_ z-G+O+dq5QYU?~js=xuWo{Jg$Ul_c7@lt+FHExc%gdEQsTDC&JMInG3Ogt(N@_XwUQ z6iHpxpSvuuBO2Qp2JB28uRAtgDfOf&BtPrZG1$`eUAp<+Fz2GkW))viqIWgaJcr{c(pze8e>&bbpFIWM9Sb-?RoTyj?=RT z&WFQE!LEassapgt#)wae`2%zEDc!7!5Le>pE}RHFhJ@#}aE8R37Z)Hs0vFA-TG;P_ z$MF8Shk>g~BL0WE*<M~4|2iWn9Xh}M>{2=KuPHH!k*^itg%lJl}$K0Bwbd7iVI3C+KQQGks`MV6y zj2ihi;6_WmlMJ$BR++iLP{Xt-XJ|8XZk1H>#XW1Rv{ zS&@ogI-2`9EH@|J9_K)o6e3v0#;LmQTAQiIHYTOqa zl9BROw=$Eyi3?SY`g?Kb;J1|Z8VZH-xnIp>uY5DX>^6?$p&lu`y7Xwg@+jj-8((#2 z&H)us>01d~I#hT&*YzAhS136eTc*waPAoO!fNuZkwg1UR;N{Y!-wXI{{P5@q@_t}} z!YYr~jpdC8ty+bLJ1^{}W@9M?OQ^>N-?8B@NexfFRcV?4!PJE_$_4VhR47S;=bzz{ z1Enx!n;f522eV&{O%PldJ&oYxdyOD`>4iyml^!)04w)pl6YWpcpY-KV0aX&ocI;sDHf z@ltqdnp-y)Jc|IWVwq6${hp2NTw+1!duGy_O@$JW!?kdthh{~%oKCxX}w&_0^@OPkD{w5&73xb*al^AT!}ZecU{c6 zflBx?8myek8^W6zEsUDXuhZe!N7!Mc#`YR3BbQuCplYeL$tyqW*BKjCKEFe!$*4NV236S4L_@eb0MtTj}^rpX>1^GS4+l zpu4qT)h)ElF*#s~(Fz1mRe2~BhMS!ZbpOuoHgU?NU*WN;mjR>48;a%RuKRGzQlr$<*RFZP9E#oV{3u8CJ7v={JI;m^(>MV!vMsHJ zzR4I}4?n(z-uXS{D~gKJfH3KBDYPF5G9P}J@d8f(ra>~%&EbNxVg}ZP{NB8a$g1$j z9M1Pmh>Z|Zo1%^(36ktB@OzGh+1ayDT7~Xp0#);Bm9(nUkHIB@a#9sR*=zBL(@nkv z4XljB_Fvlh2%yr|d~Q9g)^47*!wT3(La5qo#w>3XR-^mIOahT7G`zdu&9jO@w`@>a8m74e;Zks*^Ap;1jHE_h(l=_H_|uIV<l8di7L6et3 zLg`JIZTp)gJ$ccr6WI{VG?v@A-9mUy;3dn!@SJrOlKZiGSKJVYB3_hsGs+dIRq8W+}K#1VRTv7 zS^tZtw+d^ki?+XUcPTEV6iRWo;BB!W1=>P!DDLj=P^7qq;?@Gi-HStThu|q1JV1ba zyyyJCbF;5^=!?=|LJWBvwGTbR;4QTXq}cJ>PoLv}5oaqjV}63Bagd@j$B({<-R z?OSL|c_KePhh>AW6UAkuBM!X$x_BF4`P-(1_?-bszS(`mC}T#W2MVOL0{i4jQM3xa z#7BEf%eE(1$7n6xn% zbI+k!xLY*j-XCBDzks(nDq_@b?<^0l)6}=-O?CP+EKOj1-Vs_^7M@=a5v4_l5c|q( z(@H1N;^*dUz*c&uEMr&LMsK$%E(f#H59!`y6My?q2=wpXFW*lYM8w|@ho@|aig+Pf zjQ;lkTYTt-J;0@z!7fJ+Uee)E-$`gtF}f40@v8|`Jej{BUJTu6zY{Pt2-^S5>pfED zi*3N6tY+WcF{4ky=2`Dt z6;x#6tGvNq(;+_FQR4JUFLhXnE~Hw_%YP20c;m~6k#U~g2T0uabxF)F1)U;kC$7+# ziN3P89A*CEv#yd&qDl_d;a1aV&+B6)M9bgvQ>GK1dd8&%kqSaAwN^dxgy!)Z9T?gk ze(4bSuF^%;hW$zU*~=_oNy@?>g&UJ^b+iW_fR

    5gU zudgeQjSa7g0a8rdt`7|0#t2h(*7gQtsr^q|2{WE6e>OVl_lB8m6omz~&4{L?7d_S5 zlRjc`FZfqOE~R}YLf5t!!|emSM{z+qaaU*j96Qw~(j&YuEO>(ve9;~nA7u7|<-{}m zas9+RsK0HkSY%e$<)114S6eD4=r+^a>!QK@#UlDFq2hHN&$Rp z;23zdy*Y#WjlZ`J4@{6hW0E;l;Fy`p+{o8>84;IB9FHHkl%@_`iH8fWTENdw9Wn-G z8SO;P$R70Qu+asZ8HBmpGcEY7P4Jd17cCyB(=J->AV=KXZhHT>$&e4QzT_48OJj3? z5#*SdXk?&&JYDN<+I_%xQG5BK02JcM4yQRQvF#@>8WAkshKZxCfXVuhsIb~TU0^3H zTp+502BQUOxq5TMj->Wyy;Zi(cGn0MIOVh_%0ICQC*c$e+pP8pT+?2Wvbe(S#wJxUz<98-?*zTEx715GxZF?j0TRf5ErXu%0( zJNtpS^MN25XgK1{+N;Ci50qA!w3wQT(ey_M_gXuv3G@i<2~UgUcnbQIHAMD7IgrT z%O8g)_9ES<3K1~@x2L#RoydiDW4e=sPT;yvTAWb_qA^AJCq_r|#T25s0mrE_BTc-& zVMu;W`X@GG$`a zqoHf%^A;D@el4vmHT23|O1n=s+LdM2`M7CMt#SCsP4A*67*`XADJ z8uGSh)7$@@QW$aK2OnY9`RlZd`tdwoyH|>V5hiVfg@80Kw_AA}&4h&z#B+vXi~2tu z<^Fe%nRp*9ick9Pjmd%!PnHre>g9vsc{2HB4eQABgMcw!%nrS zE)w;>N}72aGHdo$0p9qt(aV(;4_R`{4`CmV6?VFRJNi|oz>O_Y;#QVq_MZuA^D^ICww94x&y3^fVZ9YVE~frt(kG`}|kbe^IMX09N< zf1Jv6wJa+BV>({EVj^o>=fXVrHHV~=x3;}pXjBFtTX}OBSSG0g710ro65ksCy%N|* zkfxj$CDOR_fBnJ$X!k$+Ck2zuTQUIrdB|3}AJ8L6-TWN%Wo7=#04+IdozU&?Ln_Kj zBfc2`&wu9Xwh_fU*cqc<3`c2=IuYLUI_#$@-xz*KOwKXGI|Uvlp4<^NjCX;8-H2m) zdGg1r#tJPQyq6|III5DGB_Wkj2#m<+%VL+e$gS{FsvZ*MAEfZ%_90=p#4xhRUV_LD zC}C@FqdJe`JC;i;*P<5v@FG*jRLOt*(&}%Id+}@Y=w^0re;nx`$qsZGYh7=^84`-|%)V%4BXrdu-yTJY-W z51^L2#y*|Y+h*?cHsew2iy1Y&2K@2FBp^lmtk{Nm)0BW8M=S7V;|a?2mY-m}e^tTU zT9g8GtMGuST9pVf`Oxn*kRUuJl8Nl_6o`oyakCs1yv5O?2u;_)& zO-_4$b`l>tT|n+NE|%`+ouAhmN}UW>fhGwEncuWBr5f!F4yt_ji+^P&15?QQ*20uO z`a{h!H4zpHZJmnwe#uuFm-SfQX)KvNW#WG-jU{eWuVDrwZo~&&-ds0nJ&Fy+4ra~I zBJ4B*N(}!?Z$kLl9%g9$Us=y2g7lNDfDA-A6C6qf>^x6l*YLmooy_I1Df2u7CVKk( zRO;0?CC}dXUvHp*6K-;jMnc|wscvA5^~3vy|CA7#gf8n&ri7h&t| z=LMsGEiC|$wV_~z;9o$oVVur5w?dC)$g6xTR;lnyRAO!r?GVy=<{7*_EA$r;ETfqa zY6`tJ6~_u0iD1h*<{%(7^x4i1FaAF65U6T+lN3Q`ks_x%szN(fb|Kcu+jhOrusf60 z@J2jShxgluu3?c_5Ib$D@U9$RIFYjMFBjPvk!M_K#@_(YPnSM^kK=Uk#5Z2%5f5!! z)gR2G6=Z1shv+G~R z_a_JrsORnS`yopZb-S@%TB{V#!J}C$uashm{yzU+Ga=J2feQ>!V^Xy&6t&K)<02z| zEm{a9GB<+Z1S52vaWcm5g}=nTKB%@t<;ePXZAX?3;HFKYEsLKi$9k{y^zIOcFjXR4 zUgsV62dg@Tkn(2S>!KwS6d`d|+k5c{DfXvgQ1K1N+t<;qL>JM$FJObXgsZ1oPtEt^xyv};A2 z6d*2FMF<{3uC_^^4D9F-VG(AnKI5Bj`ba*OJ(z; zrvY08@{J-h>ZfNN@a_yfpf=5Fd#UdYgT^VD=R4LkMf1?>8VG~e5Afl)gE?tGOV+s; z5UGl~FegB$U@Lmd<=7@gqX@(5|G&r-I8_WwJY0Bo^U> zCwKl`NX2risG&D3WJtbSL6$|pi1$@5Q>rQTro-Z<_anyc_Z-g4L5oC z>$9Knyz3l7%BvI|m6z4qE}sJRz8a!L;uOXh2^-P+dltk2sj|<&0lDrI0l6qdAvezz zcEJdwWT}Q3-*q)cXB*2*O*ab)i6P4A9+ znoZXDH>au3IP_?2eqy7Lkp~b8{d8C%jdS<~3>Mt>!zJ$?ad4Y1tThjc|KN~(FXxi? z&${`e$upIGt!&?BIK{Jk9f`YW-9&XDWOGKR9`X;kekm~p8-YLXK;E9IPd}D zf*~{4(yqp+yzSHW*xu%n6p#Q_izDzJ+|O^qljHJ|>M#?w==VJ>?&_XFGHNtvCcX1_ zBc0Dd9@Pr6$@dvBrmTMmQ~Q2lXwE*rWB+g!ocqHO<_}Fj0v>O z$;p=l0gp$<5PCIUbuxK|L~U+z^(@P`RZG{>-D-}lZvfBHBH0vXlIxXLNjrS=3cxa& z%Dde=|Di{;^7IUPWqt zy&k?ueF7#`4n>1qzL@PTq&J+6s`_3rM3y`! zp@!UKTaw*5ri(hnewyRC1Ap#?WvU8;7X{@;9)X;AByDu5xqoLguHF2aui;&48YW_< zO^2NE7?)cyMY&E=-_d`(o8Qkkl=!V^1~@F1wgQ(DYpU%nbLAftnh|^s+P_X2QLvPa zycu`UQpxJH8rz$PE$d#n9xN{-Mmre)%Cv}Ji8w9lWz9i8v(>0N`pvg`-*q4@36!eM z#p6qi80`|J;cVk_pf9W8;wNrh0Q)DXGWcaQdJc>)Wx&W>D-PluB)VZHQn<6d zttU0SXp(NL8UG^-d3q(jy3uo%Yvj=$s~F|iw}wE$_KoneiKHt}W?6J!17@>&0ISgX zKW1tv?li(#xVA3siuMXyB80WD?iCdCDX45pNZ$(UPVQY?V~e^^QDTY2pmN@CyM6@6 z5OA?YYxEgO$+JEIQX?~_N~Mnl;3|K#mQTdS5Z}a{HfcH7BypukX~G2``bXAUjCUusrU--m1>c2Qk9{z!Isk%Y5(yufzM#ivw89SL4x6|QPf9}QFT zvxwtu#Y1HI5UsK;zBO*}4P7|f=!mdro3 zHezDxk32(W_NSr!xq`wZvr0^?qoWQZFtgpFQWbapRFkAX$OFmN^F5g-^rM# zf)CZD%VZR{%14`VMT>=#=M&EL+F)nfdSas%aYYVELx^MDC-^UTy{?y#9Llz_Kp}!(?uI)hWPOAu>vO=fXc31;u-~qy$x#dzjW2FtR(zC z?EAimu7Z?Zenk>O*a>im2r!;jKr%sH8W`nI=Ox;P55uyg)ef$;IC(f+p<&XKsGl5D zSgUbeoNfXi+JE}cZg?E%oq$*yUDulJT2GsA;1QU@s&Jp7^0f=o$#(1d2(K|84Qc28 z1mpW*f|RoH)p0Lc@L*R!M^s%$V3)oD8|=^~?_34OyAY`mpw-$jk=y!)DzjyEWtb+p zOH#bTjtA=gy|`{IZu+cl`BBx!B2tcNW%>3EL|oKxC6|V$WLyYUA&cD2i{trEH=9-; z6(gMlXAj41#rd;lTR%+>H770~NU{Z_LThL3|0{@*TLJ%P{yG4G^Y4f6WN^Id`G=wK zkw&EqA=OdNX!$uksg(2s;L@3!WAx&3r$14FG8(zJ^4U&(G8dzV`)QRfEW^)N?gd$-zjo?3@@!uklXOL$&TVT( zlJq1jA_sw0@~lJt;qX$v*?y*B=21-gg6@`56SD?(j~JO_b=)tEn$6U=-;XHZ3{gyr zwe3GqtXOg-lfuyzO};!|`>gGTU)NC@5sSGQKzWqalCtD%T*@(0oTDZMouggDGbT(( z9zil?#Cu0I5Zi=JeA82?+)p)&^Y^Z|vU(D{@MSX#CRcDjLjOA2SFhF02;nto_^;3E zsCdn<(rOpkCjPnVq)YJh>w?Y=(dl^}j3DGLlGxSPa?C;C?jL2%Q8Ce}ch2hQWyR#1 zKScME?PU^&i9QY`xvv=Y=sxY~%}}cZtU`hcp5EW-J-YhcJop0y6YIM;bJ-zxlU|e5 zeF8Tl)jp<+k^Ds>+P-^Mk9ux*{^J)6RtIF-{9+p!?a&~QqSpknZ6C>h@}Gt|f@dSG zE{!j{QWYnIP|aSKwt&0Maz>55JcO{XaQ!0i=0XKzng}(J_ApyxQUqayPW>4&kHu?j z7+l2+!FJDd$yK!$s46j~x2@kmU-JzhO^GS+@MUoO$MAp%(m30}{H*(*8_xviFEAbv zo1cxd?~6_#ZfNhz6x$t@&T)=(;W1TCx3Nt7%k2t?z<$6CP?}0Nx{_!RdNiA&~BG^)QA~A!JCVqU1Uwmj&SgbU*2%R)N%}6uqZ`pOqzcVKs2y z_hXmRQ)zRbbtQ4GS0g4dme3%t@>Uz4&g(IsW`;Ir6sNN?OhcLyLl#X{EpB`lJIoJ4 zp+`H8+et>yERGAvq!0&jW6*u=JAE)UU*NaPsB$)}+7-VJsfWDBqU=?!>%`{8Wr?31 zD)I((?g4Aw#;+}1|LJ!^#`Z1T_rDDSz$-%+*Tfx8ToiO==;q1Pi5pm45a}$zw}OMQ zX2@gm!NDwL!?8dTAEFlCfo1wD0Wh@>lh@>xpU>@s(f<{x&nCT)V%?bsDj7NHZ<$C> zHJja?6Avw5DPUiSt)1_ENCn@imIkLZp8OAtS8?+cL1>{$aCenjI7u*nrEP@;NeofRw+?}n}!2ieTXm-559?7%}28MLmn zT%RYcwxEoZ88k^7F@3PKUjTU(Ze@o*hhd994hqfBFoic|ps+p<**Hq3uiprKyk2t{ z$?p!=?Y&hC*jx`QJuoR%qy){_w-Ttw0=a&t%(M`eB0am=&8EF(J5z&XzT~pQy^;?= z;*jer2iYh-^h>FS$Q{N{RXLtSvS&V8kKfwZucU}mCDD_HEz&l_M`GR7w;7eb9I$tN zBx3&a8l$U&P8&n4*R8}uyL%L{{=s{!G_)pB8ugJL&VO^ZI=4qPGH6qt_+b+<^>b(d0{S;PI^Y4|7YCpyn zDrw3Jknke=qA@sa%ss#HNVr}xGZ!U$#2Va>u^)O2%cyfErB00 zB7Daj%)gImb}eeKaR|zUg&f>XwhrzTy0uEdPK1Az)o47BJUsqLVxnryXdId<-RpZ; z^!rcXBAbN%`>=!I?(x$OmqFXUnwZIHvWx(y{3-^qquEO_wf@Ym&F)la5c0&|Kpa=2 z9$NX52m9md-1Oy)TOR#;jR))1U6>8U+CnebL~idZ8;;s$$QGPfuv3-Icem&gP%{#5 zxgZU1V-xJejb5{lpRn|@TGWv7Ym?j>5`2bQXH%ToPq%Te4~fd%OXK?yx1>q9Yb z{Bk;LM2(Kh!z5IgNtu=U!(YQfTo^zGePq$lR>oOKLczXn z^6%g+>D=)JA)8C8*qrlmm+JlQy6)jK?XHqGK#8zyId!d-WnCVxIkjt;&$3v@lBkM4 z8&KAgqATDu%KNj3-~M)s8&<>#|97eUFFpzDpOH}wS+j;P-T%K24erCgi>$v(glmN7 z0mD#oSAMsPt@WW_yK^}IHekDGMQ{`P7`$Z?=_h;-jwl-yQzOf+%-XwF^Vu^GRJ-eR zahJux)f895TioeO=0me>Es-XY0+H12(3nwDU`J-2Azuo86iH$`w_g`}A8$S@UI_kzwuklMd)okp6DW+uXcdEM>VE6)`+p>MQYT z?&#^@a=rZl)vMGpXRh%Tg~f-_YIw)2;zd&v&5B~Tj8yi|8vxt)RYQW_q%XEeJ%o2w zDS-ve&{uvoClTofU#BS7jeMWnjjs#OD>%oPCHM5xy!zLj%-H{+KNla6S7pz=gGUR>Mr# zPy#0B7=l0Ly~WcqoUgo6ihJDht1Hq~;K`OM`yp@p(naVg=r)W5qXVOTVGpmk8&mlC zlWH!c_S)ixIavtG7u<0gP0=q%j{0^ZKcei)k4?`}ev_n+aT3>NiF`e>DGKt>9dqa! zKK0J&o?a(i?5p!yy+7d}*3;#lc)QX7+QU?|42Kb54ZHiU6jeEZcm8!ncsnzuTB_&! z;w%AF+s`$*NZFK#zdKaB>kX=LaNyEB%&4Y8c41j@DU0>#Ca>Ej@L}l+Q>f&e_{-Yu zjg1x9tIY1++rA>9(=mpl{i>IGFes2M;Gal3XE!(qDxE3dov+SDxtF`8E$%4X>7H#s zw*sCq6fnH#xEHQL{t96CSmH_?Cjk#C@j99LPhRAv1!;Ag((fLLFkapc?{senI89RP z@LJI-_&kkMU({ce)-4VI4b9A)EQ;B$#W;ulw*iBU0U^US*@W7Kx)l1~Y$(`ZFrD7T zcx43xu7oD(vJeWzKQzOSyvy#m9M~x4xmaH}$H|o|pG?*Cm-LTcRlXD%%jnV<`2jx0 z2}wa|7VcDiPF{Y;3!zeOo$@|jH!m3#wq)aa9oPX;?bD{p<>{2<5vn`;khaK^wWqeo zhq@y5`RK~T8ArVIyhMM-_DZF|1n&c;JSIbc20VGt=B*N?NI6cJERJ6ro40~ZUdPUE zF&mj?IGP8k11~75Uq6dPNP}93Bs;ve%(M2JYg^orvNhhbA6-2P%13JHS;g^B&y(WH z|1Bvz@j5@@ItqOenTs$k&$2X z#mHim*I|I~;8BfLSKe`BcYwU&FG!Q2{@Ci6j+S9uqju}r=~izdP-Snq>D^F+kS{!v_pqa{&f_bOGlZRrRcA*cx#a&Y{6ZJX{BDVZjFh zv9s^EQ&9LqzYKU#Wi#`Ql;H*uxYMbiDooLZ>+hJCkVG@#jiHAcr%(ZZk_=-%)HeW` zuQI$H&bCO>-H9Jsat`IDL*Q)j+ARmH&QV)9g-sQ{ZA4vse|)RhsXIYf4tE7vhkA0B zZ>t^nxBx+euY1sI-fw9)KqhLJdDCZ6UWq&<96gsLC6k;SVB05+=^u6LslHlI>H^C} zI$c?6);z|!cD3?J7v37aPO%6Im`Jb9LZrB+BbalY&eLv%HO-m+Qqs1}HCZ8wo zNOU-$qRz1P#fs-&zfMqV7pb7K9ARxa&=tENt~NN zOl}tD+Iy>$%uy-f-&fGz+`Kn2Llw7I@9h5BIB^VJ(O%3dhO|e`K3vvw)d%|Jz^?@4~r>?CAR^3boyh}TNtLjHtmtc=}cgMZ+ z+t*Z3WUmmsEb6tcqVtZ0+kstoxA}{b`n|D)+>`If12lUe@KS%@Tu=}fRGm7zls)g)mV~&Sdf+Hovy5~V**{rFuYdS}7J1&JI_@^I*LePM z?Auef3nRVjf330||Nn8Fj^!bJq*Gnt53p3yi}8||qgHIb@A*Y~6_jf)yeviWNqriP zsGhGZ7{7<=@Uk-xRTv)npqJ3_%L}e~+g6FG1203F`Tm2r9}wDv7h-SWb|3UU0OnCB^!c{-dtec(d{T39=q`@5g58V_2nQL@Fhbkdi`K>*)s|zdrQosUXR;o>`<@ zW9T`{oVsD=;@?bT9`Wm!e2X2VIK)=Kalu*PHnrt!pOTV;4HGb}RB@;P6wd%dTo8RI z1-M~pa(`JC$c2CvfY)i<8TA=oh(dIDKXmd<^YwnKhT?FY@aljwmtMeZy%jw_4-_v} z8@sw6^JBAF9D{Q{S6;LnHFLj{Ldlg{RinD%|74~=ci$+Qfa>o7`vpYq`9qcPD{`=O zf}nJk0{?)?7xjt$sTpzCn@XcQpfNKa=zFWCVYvVGzZ~?xX!<*)2+_8?M z=J=xZL#_XJB_Weq@#_v50`0!dOx_Q&9oqC_rl!%*YIOM}M3$Y@lsBaNoDo$#KMheP zoV7o;c?AfhW2Ocz_rio<9u`i82a#kupE8sD4aYsp#j~}`xmA$fG&i(X@pr^l4zppD zd)d(`Nd0b3xzu;JAHOE;;TKo`GZ+Wn13e;MWabJ%il%hfD)|iIV@V|lWXgXy`PH4F z!YkabN3y0&dn?P3?4&)hSAa4vtk!l~PRE>isO%lO&WiO)B4U`~Ja>{3qU=*5rXfpw z5c&--nJ(|=lDcCPwm@xk@)0W9Hlsux;bwgIE8qIloDriWPjaq&hizm-2?HKslC-Q% zSMyypcBAIT#-o&;LK^d=pRefUC3E|Xm^i)F+gTc%zjV-26eFh~b^PUJ#~(HWSoQL$ z3_h#%=OH^RV#mKa`A-u*g9R7C5E&nM?bw7Dp=JF2&q{jb7W#WWn@eB)a-IspNGmA^ z$D_F}bt}n)`kPE^woV5(L*Le4#+EQ1BPY9@r;g_KmDyGF#W|=i&-F)G{(~gHjFm&` z{o2s(FT7coO^2U^W%@}xPVFyX8V)`po5Nm;+$2Gw|^ z#Iih&O^r(DCP8+o`#p(y3uqSgUF0CK5vt>0&d|Q<8LP%*nC!?3+p-Z^_KSk^=CGti z;582t}%A@%?1~z-1j9(Xj8OLSajb+8at`vd>C=rZEen?PwY9V(-~IUH)|Ur@UVd zDw$UiW9GyblX$!-_MO0S?1!S;YagL4j%;WuuHso&20Z?(HkN;BM&z<9EKj9Hf_5=8 zs%@I0*LFUTzFKHh*TgKPmuH8EG~lq1f5)eQulejT-Hv z4=@!=9QY`ZYg4+>C{%To&64c+1WmWaely(kr?<$uj;Z$YXm=XBD@ zCq{xbHu8A;=VgH%wj2b_BGIqF_{4_gV4pms)mt)lG%_-AJbp=KJND zIgX<)7e>S;$q7mpFtUE=x*)dBy~q+)SDWx9Rl`$z4rr#t2XiPZDfRD-S@uQcIIhK?bWlr5zXAE;zsPL^#T21Yr^Fh zf^0acuh3n(kxG_mIwG5$7j`}#u&}FNVmOgG=o-7XjLvT2-uVZs1DvoM z6FvVl1Nn?U-bQ&kETXm~VYB_DOu%7E%NU#lWQq-HTb;E4)X7W1je)MNGFvwVUbAnl z`&a8^kjg+^1?wN@tPqs4Jum*5o+%mHd*x{& z1&LW>(Z``uIFnLFpF|I$UWKfcCW$6L4 z)6kTNA$+8&@d`|mJQMqd*E%;l@?fB#$>*hcSJc$pDR^PBmAiNriO=gR5^?|xi3u+? zxt)0Yd(@}=)zNeWIVZNa@Zv@GMf-ylcz(oOR2tFq>|ex`>}Mo_bXVtkZJ%u5-dJ_{Jw`Ud%AL@2Jld8k*U z>pee~ghmd83lN?JNG$J@5ylZZ+(C%WX*c^oWo#iCc?7j4F!HjINmXz_8nc7yoitMW z`uX0pIaV#`PK_)@X`Fr1f7F|#IJ}%rWG*lI`({#T8a2kRzJ^|F zS|G)XV!N=lhLx}+m^e7GhSNN8hkI&Fn zW7gx52Ti?B$J$xZGlLc@OR7D7Zhmqwjq}=2;$@|b$=nWcVNVJlFy~2s=}KnHc@|lU zeEoRI$kvnO(}=*=DCTIJInPqzT@=KZ|9-^A>OsFx$b<;}YeiZt5Nv#MGIv{-GI93P zRNfkYyAv=kuw}sZmOZ<1X8QEw4P`b-8rtlLQNG(p8L-tT($ny)>+Bc%B)1y5R9$6T z-`Jx?VFvPUje>x|();)4xN3qCx3bb0DJjvC!Ps__IAZ!j#hb_iLNFE9|0{lrcd1I|j840qRj8M0m#@ z(+Yd;wY#v-x*7-%?M?ZdiDJiFQ}U@Er60U`{?`2k%;``HZei$94{+a zx}b`0vc+aEqCuNaJqwq`a!Y9Z^kpr;oIltFQ6@vUuYs;!%jiK+_LQh;ya3Vu7Qaut0Zeu4LJjU_M4}xlW@luo$fFx>UWOcma^(Nn%maT*@G|2i z?|&yhn}$7!g4wN9>a+M4l$!#xU(leE$&R~k<(0uK5thl@A1(Lkl=zO5J|C^HPs+J0p76Ng?!QJ zql3*P=V$QVH&(|lc~~v|@DuApAI-o5sHqa8l4L{00UDqwz$?dcJ}>3uASv( zY$jsx6R%6576WEaK=VLF$Vbx?A&Qz7#(!uKe31AlvjJAxm`~fiXEx~rV|70F;kr$@ zbK?QBQJNuL4Vm*~K8s{{jKcC*)0~!hVeq6B`YH2ieJwI9s%`s%=5#=iA=kU)3jjxb zcj?H!V{FFCXSnXsS9Gx{OAw3edk;WFm<~`njF5cRMZ0>$MAp>QjN23x= zNMe?*fv+;UA26-*Div@Zn|2Zs&<|nGM%tk1ca!T}1iOaqGPA8}DoAqmf57Fp>kvxm zoC>38zUdp0mj*p$Jy%+H)oo6dLN6lQC@PHLCeYy-t0y6N1p8kG?#?inyZo#wwvX+` zjk+{$tMUqaI|tbBwoy?@`RTp&VU?|#bz9f#jJ*JqzEN2>{lL1Z)U605SK+OJjk4#F zNe-CX9x83QL526r0iJ30Y0@7?7@SpcR6qK2@VE1@Dt{Lmc$+rwXA}9H?LG~i@7kC5 z@T!rASIKm(kQzhAn89JC`-vk3#ySfP+ar7dtDh;5wwYvgY>VkTHrsPp&uxxTcj^2Qrvu>^gZ)~xyOS0zaXyaB;U_T(e3}{U z+Ox5Nxz*s+H_>;yZI9>kPk`d;So2*5vZ3>^WqggbT&hhoK=XzC;oqvm4l;>fA2{u; z(M|a#KQMvUCfC#nsj%S|l{-B`xC*`QZYrG=2__$+&M$`gHiF(GQ;{4%k{vvV0KxyS ztc|CU92SJ1`KRa$a>o;I+}R&x$}};*7F>}VzUBq_li{j;5xUeOi8b1;e$c9VR~iwP z^|AptGFBp3`{1==vIY(HeGiLiWEO zQ|{B9-qZNFn_Ji|=ecOw^>u9*p|DW4cOIaXv%3sCSCLMIXChvYP0huK>3{~Abk62G z%9g+ZK+P*mEoKU}iTF*;UQbJM;KltQ2Qx*qWAz9)y-Br!cgAr6-!HH5FF(D)jz~%e zXRT2D?XfHuphSf{@7G;dcX+R*s07C8lq{v=?$0$FG8NRfI~Po)e#J3uI06A zK-NvLdl3DXI7u#Dx!5lsOsNO5KK2d1-*^~7*B?(g6@)HhnXcn69EHf`)4N~E{b2v{ zjMrunbbj(drNp_K8Ljj|?OdF?JI+7j}i{qTlQz7zclj*11H zYEq2Zr7srmR(Hz|rdG!QiC{b16*it4d{r8aNv0+9jkLitWC&7W(w=3Ac>S(l6{K+z z@MZAq5sH(~{i=yu$1Av$ex~?6b$yq@Cl4~LYvD;>6}h)+kR?i=(y_}tl9#k)AVo*t zG4*7)rm{%>RTvu~+4<{P&o2O-65hP~9uRvA7g)`o_i(n1HIhxqqh%?)=C^=5 zd`~UFuO~qKFoly!ZC$t)D<~YSw7OOp zC4RZ7N#4t1NL(j@n7io4>T@!lkW-()@7?tgp#RibrMX9}TasX<>Se80yq9BQ+FWMO zGjgp1u+abP!4Kj8UAQg;;UMgNLD+Oj6jW-ohj>qIB6NKKBdr94a29inf5g5u2>cgi zdRQ2M;(#qkI!l$xzEKKV3Ieked#n0LoQ&o}`p0Io-ajT(viCET&Sa{&e9bk=-)+nNk%iqNxBukSh70NlgA43i z=)l4Cdg2Z{NL7F0tZ8vI8uvI&?GE~rbp@Y|2r!$N#ZSTiK*hE~N-D=b;FB<097$Fq z%!)9QYE-DC;nz3x2}eZxg;E-w9hO7Orq*D^qj!dgIsY|9YCv5pW2el@ht8+O+kMPE zzA~wLlzB;eJoTE#y$%r~mV{&Tmv16+aXm&6Dd5=97^XbR`IzG6(;MHzKn_~>doQ6W zkCrY!DXYVn4b;e#*_ZjDHa)ET1pDH_W@kd^7Q!^1k&#=QBZY+HWjULfK0lqXTlPR> z4IVx99g8ulMl?5*lFl{ zh))n@9?DdLd_IW(U+KkvPh2W@fUb??31@b!A)*3oZ21E_%%yQa-?I{J{ZfgJKe6bB zVzRwRCee_e!_dgyuSg#W7qs*R>~+rAepO*OD;+wBX+Ak8KDKMS2oGh+lN0Jf?Cyl= zYR-u5Dx=L#eVDWgjY9{B9j7L`y8RnbWWgM&e#SLu#5&#YeKBLpeMfagUxS5dMJcxrF`SSFX^^81c}ybc(vSfyIS zUY!ng<79us=yU!}{95!r@^Yx%su~|+-j^&uToGg?iz7--@OurKiQV{f#Ht)yP?+B7 zaM;JoEgB}B<>9{MgNCuO$7BI;6DNoY$r}4-Lwnl5P2;rwLdxiT!sCQo`Y*O1pAzD!WkFD6qhn-aUt4f#n32>ZaaE&tZu+zmGHXFP0wem>=FZq`*Vc`;Zr;mZdqA6CGc zjIeR#GmY9RTWQtdzxS}WM5O=Dq;>d zZZ=t2gw=hOc!-`x;X%*dUk{IBuhH+S*Ka`2qD=$4zVqi~x$OeMgyl6YYjkiM$^4D1 zq1=tMVWp`A{vn=wa5lr*$ZNJ{i|kdYF(33rS$T97Av#EkdUw~xBb>c`GcY}*dcT8! zDD!(8AwSllNTxtXrtVsC%m{-V_IyZ%2^JowamTqJx<*oFH2=Xl>l9lAzKF#4mH|OF z(mVh#AoOSgn?ZE-n9s&Xe(;@O593ZTe;Sw|YMT@RVZmyy!yD7YT8@X~rl04N7XZsi znl!kv?=+p*X#mW%NwzQsXH`uKD`4n5xpq2sFq*W&OSyzF!~>2n30LKf9rWYNU}BRjnt5CZY|H!i$jH0h zSTq6~*aOSIEaZ3(q!2g9*X}%LN2LO+Pc24+q>4CvbT`@)0doiFb~##qdeZfE4W2`L zGl&H z@k?ENI5NhpL&rT132ow-fG>q$V7v)|w`nDX)~5E6=bTsoI+~oNXuhZkdPwbH*b%%i z_)Nq?ty9a9{Ml{}^>2)rZ_wUsc#Rz|Wi^5B>pqk01HQ}`=%w2`cV0z9Jx7r{KQa4X zqr0a2sJ%F0at`t7#hT{i&7zP15qw{CBY#mA?ACI&b`jus&3G6b7Ek9WKfxaH1K-Lh z27dRwP1iS&gjvWP`cDrJP$v^%z}pXz zh_)yZ%Db?an_VN$-=yjcdw&)hnHb>SJV`Yxkkk*^Oiz}hXW}aiS z@J{h8X-R=89-_7(ShFjcf;}PjBJ-z>N+6}ahSu0zDjK$U81)(cp8Qk4FFxN9O~r0z zyp%yz^U<24Tlwla&?@!ym#4HF9VbJ8IZGb?{1}-~c{~>^L;k@7GQE?N!vc#s z+L=6Xy&Ll(`}L9@&+_^j&1pSwt+%zjXuE1LYUQq)h#~O}95t8mtMRGm{qF_EBTkP$ zCtv>}Pp<)q32~MAQZr4*9j|G_Pynv$9P65lP~xR=J*R3Wg7Y~M(wgyU6#Pu8R2K#P zmp=b>wExq?K}uPVpd&Qu7$bXQwwL9XoZji3o1~xxhpvVo8=R52bNS}n<>fmL9Oi9{ zJ8Pogmg-`|(l>O!z-Q(mmSB#AXwl_RXFNz1DI9ycb zRyG;}>!mAaZ)tBH!doi#JM(>4tuWXJfe|B*8SaycpGfuYh|L}}9Wh{rwEejL=890% zEtL2B1HLtLz>t4AnC>a*$xQRO=cy#^M>J@Kr~b5C#rDN+y*S@8$U}6+o+=l45djty z^=jR7nn77Wzs*Nq;fYCo_k5od12VQv@HGm99{<@c&O^%F zTt>^)1o!gnPT8jFW&bP?W>DH#v88k4S(FyGUE;wVa>LC`N|hll{|wutnLkm+By*7n zKc*K8`NiaM-nkU`P_~;r5$o&_V#ip~C4N)3&@;5anC-OmT z^5RPDCYxsZm5_p{fRhUH%JAayJcKxA$1rvW`;eb!?sZSs+eSws4i;oMFsXc|dHyrR*MaNTLhSY7>$Qqh<9aq0}>XEyKk`SO<&0aidt-fCehx|v`;Vf43*+M?ZINtdRG6w_1f z$sN1K*Hfh?kKX>rB_rk zkhjeNvxMO19-eYQn54qkfu+1tzfX z3?$;T+yk}~b5A(=XVoS_agJvp1|wYbF>#age`R~ z9xP;=WIs~Kz8Mb`e|#K0O}rWPIs321Ff11zdp@lSmaiEJG!j6Fm`MHVP37Wjiss{@ z_nPp;&-BPW;UC_X-olO`Gqzi1pV8Z!Jd-iafd3*|dS5BgJKDUJI_O5N8IX6;p%aYn zfy7RChnZM*b)`I=Cdpmg$LzsP<>zKOX|vs|U6(_lm}?7*%P-edKSQ?- zO!<`$v^?(W)c>#$+FIBmySAyvi37da`+Ws+{v{@ta;SXoqtBlY0&CAIH=C-PS1LZF zYqw&CyicD!@AhV``1}wbV5IIk?M-*uT}m!Mzx!BBScmMoWVd>i@8%#tGJAbI21G-iHt7bqe6(2Ytbzz4{G3_&s%35J zZMOLXd`(yJ>lt?@w>%-^yaLPTtCJ>pD$37slIswOl@`orllWssbEwsNKxJLWX4lX>6> zW#>6tQ6{NCq``GE+_v@XV-J>4-;Fo{<#TdJ7+{Db!scjDqn^%iJMK%F0fN*Kj^eRvzL_hYy znE53__z0AFYWG_&^I%IMZ-#7)+K_U}Rf-sZqGd&W*;cdr_4*;}g{s})8@lblyy&Hm zR}a&DR4B1j^{21J-cqHH`^Edx#aj?mILL$U1sAP3rw}w+7#0u4YpJ%8g@ccl_`vkQ zk3rIz`QE;J42%L6&+aoTHgnAvlCN@=l)!uh=e*0YNo=AdzbmQEnrtg2g>WD+_I5;6#>+lj0>sX}r4XP*G2i+Mg4o#< z)$4s_AGC5L*~%9CJ#Hnj&dEaWkxxX@haaEj+OdVc4;oLmNV9v}94GH|=f3Tz_R= z{TRahsl1k@!w1ZOe-wNXdJ+n1s$O8F*er(+1#;&CSSXlpN+4b){G`RyN{2rQSy+wqe1_+{e`iKz%zegyAY}e!i=iDXGAd>%L6YNeQ zC`g`3QwJ_G2NJCr31W7gY=-$qiweMXZQcAo*rR(x=J1(h*K2lcqX+8Dk@aAf$O#(l zB{?eA0xZRK(D=cb^F0Y?!m>9878`S^*gWQ!w%iqy^N;bK zFOH|$E$t8~d>Ggxv89tH0&Mcbg5t<6>*@B{XP2L;D33XWbZ8%w{d^Du?|tvSkhkz2 zHm(v_Ci;V@l)#ruP=aZ?e02MDo;AIeKPSy$Dn&VYwd+>WEo!A(dk@Ab;E78fMODhy z2=e|qcHP>vjo>9rYCB~i*6Af7Bp2hN*zE6`BdDzl_2>3}kY|{G^|*unZS|>g;B9|3 zc&KSkty6>C7~|c6V$BrGuIf6!H;os(;}2Vv`w_x8QB}v#EYG~#wH`jG{O?fQtgldj zt4X-`llxn`0SH#ynM~%`q>+%Vu)?nCrYcTkWcyT9Ox9=KGcStPV-#Kp=n})hU=uH< zbV7r3Cj6uW??XODN#P^8`hTovL&VL5-*fE?TF!0n;`Khd!W^GmDA= z(pLS^&9tDC^yfm8tHrAVhc^W$_3fcctXSM7!>%XyIpw|Mvn$O{J`2L^YV3(+W#`eG zb4%V;Y+2h49~J#R&PAKQj4WNXmW83Gdb@$%PbXobikMFJ9kuE8VgDnv-t~5=IZB|) z9|dwM@;_>^WKKg0vTTM1hk@r3;0P59L8Rqc%L+1KU4HX?>QeqMI!!PK`DgJA_;Cb# zaWkvo;E%N&IUgfUc3ht0KhB~nypF*rY=>TBQA(R^p4h3H&VIS}>&E_#;bz!wOPd8j zswR>Jvvp;jfMwb8Zx3dGhou2K1Ut519n(IiV=$Bq&zZlmggW*&-^f-DoF>pDz1gk* z3?}Ig)N&ytrJHII0eYSuFO9~IOuC!5Q*pt9uAOpV0+^VC{${TLao-?3uFmqsmi^$} zykaz{sVD1phnzpkqJA#?p!G$^0n?&Z0xafF<>F*lF*Z$vwc9Jp+qES~k#t#_QnuCY~N z2lUo2|8ymaSYCOBCWAlwx37O|0^~OL`-Vwwoa*K-^hFR3wzsFJ5rQq@*aubL9ke+_ z5n@$db6^`4(tNS9z;(!$1bIpkU*+jR}vC1 zD_KF&^(0SEt$4vA2r}X@?-#FH)@LW3^hV*b<*{Jiw1HH;)|l%h&0o(xU+i2b<~(Rl zzy1YCGKE{oQYBo9tu#9J=9TDd=U6~3v_a^l0f0{^Qvm2nA?3a=-OC;&L-pmf!w`h| zJhMX)1LD(%eZ?Xw+i#sXzLOuB?0UwTH7t zQ9!w{85z(zDMYJ$#6kJPssG(1Z$&ZOYI)Zj^$KmPy1b$>aHjt7|+YWEJ^4Ey{K|A zDO3g=BU)!fO5<48+?F_{->=UUka_S_YO#4Fxr$xACtS1$C*W zvxZoDdxDa}4T8Tmltn;?%uC_)Ff_HKBQUdX^9oOs4O%!w8$7ijS@Fp}D~f7!dbl~X z&u$bXH5RQ3(EekUBg8X}*T&1g5j^0!jqZ6POI;Z`9OwMRl@A#|QfpUxe>t}CNrs+J z$bGt=dq@~PY|M;z*WAPWp5Q*tl~Xf})07(*HQ;Y%7$uH@%=MP(%tc*4hcX_!aH+-! z+N-{$tAAqUe10D@UZ^ed{!@AWO|a$Dvz67RQ{MFA|Dg-4@ty)q6toXx{$p&uO}Rt% zhO|ybfKo~CRB>|@`X?RIBjK_CG7#bKI@14gN2uQgt9*3>MFWN;UhGg3ve+;&FIqQV zj@jvE<(_`!8p976ZfY_hdBY)Q?sS>~m&W_z{$*ZZK4${adx*a36Ft%)d2mm@Jz(Xc zcVja@T+u8Ee@XB~^_8Z+i$BmYTlmPEx2tmhojCjG848kd((hP1XOMiXU}2Co{t1SQ z-njZ&`B=c9%BEv(4CS$Ptr^Rg$(wd8m@24=EK8Uf00!w&Z(P0E4ohQT8@*K0ycaby zWqTjRufM^}bxC&O-kxpJZVsslT4}f3!bxE@Ji;!OXM7NKxG~DO$IWbTd4)F3HD|D$ zvKm=yyhJmzJLSeDlhMm{w_kS9mH}(8|jY;snHYfBtkLdUE67L@4ut~ z@yQMTXLE9zC$_h1$Q<5{AtNQixR5z>wA5{T9nGu5Sko4$?C(#=g+ z8;e)pcBE>WJhCDN78|1)3(Xg!2#Pl+9=B6ssl48N?CIg^oVv+e4855oyA;^itSIJn#7bXg z7q?-1*)Sd=pfCL5@4uHUxrC*IZCOr@;MkOqmy9I_a$yWO4>>eX-grnO7(8#x`s+3s zsQW#z2-j ziyb10OvJ|2=i*giA63f+he+a_^X8#=E@f9`pDWrlGfS!XX?{Nn730%6obWF48V?7a4#N!LwIdOergMF50hMROB9E zD-V}a&BwHdmk@&JE;;urq)=ZmHnH4cF1J(s%AfJE;}n5x#u zOoJL!T*ESE?u9RA+~`S-YN@GEGWEwex)0v5jwW1CQ?A!kI!2ZeAOeM>?Ak2_F>Mc2 z{vuZcV|jKDKMLyzj({gfO#blL?VRTmQ9_}iQ?xxa5bKLK zb#!m!rXQ4g7zC||(ow$zHVizMta1K6c21x~`a}$$SbLl=ulT1}uaypwDuf;^#P;q{ zCg*g=Y&ctt@Wjv;g0@@>e5sJ$li5DqO-m6fYfcr3$D%iZrNp-QmclKdA9lha!!zkV z8j9bce}jP~1}yF#=SRGh1HDg<3Ij#;x>Go253_{$+|>vCj|#SlWBeEspV$&v;odCS&HlfwVT$)BpFOqaOWQV@ zUzN5$YaPmB?MH$fVvy`uuzGqPAmEDUwz3B~AiuxHz7E!(T^w?dg$6HcEdJmMFxVsC z4sps%+gB`dwGVa}(8vWc>MHc;3-;NdgF^H`7LX#wM`aVmoFC$a0ar0?r-XNn z$qhBP%`A_o&rzkd&pI*aXh#&>ofkq~1|=({jcK9{8FYAUXL7Oo6{dy`ncAEEHA1u6 z9_+uKCm~l1%-A;G?()WzsAn7O21+uQ4_QvhHDNo9>sZ(aA!g1OZCIo|W{Tqe@nu&O zyA}q6)ZRx?m=0jC5A4Sa zSJ-^<$!~jVkK)%)k6ng>AZ(92MVqr|e`{k>7nDItp6Ti_%3MS;dT$>d|R`r^Jqbp5h96Aq1$gP+==b8V_hPJ8k zlk7>125KK=IpH$bYnDZP1$dWT)HA{7W5bd%Q`d8N{fvCO6hf}*+(8vaR;f|o`vGfZ z`eTP7>n~byag%Zl~aj z1h01GQ3B@YUm>s6mVl(4bf5FOgf_YOs_o<+4P?2?8#-xP93PU*HMR{)hVHeEj_0sX~8XKDSD0ksY&IJ?}XqUqYz=rH(>P5GuiS+o<2>%-RH$r zN7E}8G=c6paiXSVhQV=6MKd3qJX4}xas?wH$!!KQ@&F5di6Z8 zDfumXdDJ|ZCaO4jKMbjM_678j06lFm=H(& z;{lz@1D%XqQnwldidt9Ia^>WwLr?nYz>rS2+HAvzmQx6tTv(PLpSba%Zhgxo8B+6D zAjC;06umto$bx-pm!*i^l)QEu`&SYgdTB4Jz9uog}}jLkJ{LuEBuH$c46q8(0% zN>ra^IWY0ZA4|LK;5BHlvY8SERg8t9%H%*e4LZ%xlct!I4gxMOr#QwLPik~ANjZ=@c?wNZ40vN6P@XxSC#3zZG!x?NHXoPv4xz$BDWu^daa!A_l&LF z#S;_=g9Uu}AvD+O_G!4X#Jf0XoR2VDHA!fe>22FlYH@IglsK1kPB7i3GNdmu+-z}D*y zzwrim;*Gfc@z{~kOGeEjcC#9(+!p!gl^p@&39!fasn3#)>Jt|W7OHpM16G``hh_Yl ziz8E@Kdvtre5YvZ^kSP%u@5?*6{sx}Y2_l;{xCcByveLEj{mhnQ!8^yH8jUE)xWAp zLYI&_R&pF$%hI?zaePl?mF`^eLfN-~ca*g>Dax;=u%MjrM7`QjgJxrG3aRm7ep}Ug zB=|`Zd6d;MqMUn*M!*9qXBHShY-jRKoHqTEZ- zBF1pfsF}4w6V5>bb=rEa#Kia4Oz@ZD#>tpl=o6Of`ZO004jrdLTWU!C6nkI3CtG$* z{ED9H^vfZhsTBKo0NTf{FNdYy=^eArVY_toTk4mhNhjfQWS_=m-*S#Sd2A7P0c!th zOlfYt7S?gP%&uhIduxKb45V3O3_TY8O$;BA;cYCeRq{ewJXs70 zN$tyfe>A6h`4~*i_Fn*|X}_qU%HEu%zGLk{vXHi3=#}28A+MV+{T4cT&H9%eMuLCx zzwV{^@*no|?(YK0qA5wcdg{o=>7SBMktYl>4?EH2F=l@JKKzRw3sBQ|E`SDI0of8TnWqn?_$TA_{=R6q%Cl zBbNN6V#rX2R@sMrq$;(6g%|D2%SV@5`gPBQKcvH?T=gHB@XC42k>6+Bi56f?iZP&V z4|waPr2mN8F8QB@{RF>YPJl1R+>o|4H+=?1OU%7|Xy{){8Q-a|FO6BKF?4EnK~APv z1u9BLwvRqHH#OV>9yL2(!!-w$A(R5rOQHp&#e4?A97|Z1E100BK;_F zGO@qf(SjwlhS2?TB3OmeFdKn9fG?_q=~qtIAnvto=3ltes%)u~Mfs4*FcgG7){tJ7Ys38Gk}1M&nYE{tE|XGFM**8 zu4IO)g*H8;w}-#xI%nj2(Ta4klG^XoTlW(!MVOn@7r5aPT|8uC|7-dyOl`Y&4*@GJ z6lo=BsyIkHQWtXM!VN!^C`BP2k7AyN5#-(C@sol^9V77}>&7T{J7z^q3U;GkQ%^$Q zoLF7jI*dJw)QNuZwTI{}K9=o-i6%29zc?5%OrlVoU|U+3WD$#8XI5egJ?+_fFIl4~ z@Tu$3s+smrwErx_+gHpv-1;g^8&W!MqHCM7h45_&Vk2i4rn-A#8J9J2c_)X!-?eb{ z@xFV_sd++ClG>_&NHz^Wa2z@$FYd97c5{+Q1#s4Wmje z?4J!=%-XUbsaMkQzxYI=*3vuriwtka_i*hjDD07+BzFk%ra)_6^(>D|kg%S9C}<8`-nfcTXu9RL ztRyASbgngjUZBAU%e7a58GIB@d|_Pn9fPN;hpZtrW9#w$nLp|2CLq0}qJcJ*%kh*6 z=bRm+2K(@W>NdvgqM?Wex!*df%$Z?ZBQL)_`xki_gT)>Z1NfOa!}bnw$hTjl=L~Sk zrh1D9Z9VUCN}m_Cd^@PLp!&5b3ziLkg*04x^h%OXVh1tyGRb=M(r`zuG=r_3P4nJ6 zeL=`^$wQn`0Q(ASI-w-v^K%(mc!z$3_L(@J`o9|?+gfr4{SEu1t#0$P1e=G05-~WJ zR7mPsq08tz_F-8%a8yci*-^86<>!{qB+C>q5`yFJ$-IlLw!>rB&Vc8TY=+6B- zHrh|$E}prTM+lg$>WJd7)vtbu&=2zR8A5-9e#Iaa*BE!bZv6=aq&v#Xgt1WEX`-;g z2$&=A!`$$IpKLZExD|~kKI$Qg1lEWASd|pmT(iX4V3yEHW7-DoL`3BTl zqaQoo+rja}e~kk){%0OWlBT6Za4hJXWC_hX>As}33u%ee;nF5-nt?{G7dIcT3Z9gt zz)Xh&pSEYDv+YyUxiALDWt_IoUj zD!S@~rt6A>p_idd(K}cG;rHh!3TjmYaeeuV-cG2THa5JXkC)ZULdC()-_R^_H9k1P z@*3@J%X>0Oz2Bbp7j`K>Ci+LBZNQq~zOv>e@v;?m)oQag)$Jrjwf?m?vXdyIZSmzz zzq!S>Ik?>Dr*5~`1fpe#(37I-6ZI^CG>SKtt%6_7w{`ZZ`a)&y^wWBiem%2FD?hZ& ztd`Av9caP6LnXG^t7A>R@5rk0xLcY))mf{y=FRsR0Z5KqV%b)htDq55iR%RG_4lmSiaI+A5D)5W~^PrqF!h zo_mj8l~4}{OsK~tV@2mT%Jvj&ArF&!*UTg68bwJHq8Qb(Fj7pmxLGr}RRW<4sNIQW zAaLyZec-Os)c)>i?4QCg=}DOZ;&TUCmm6};O6{Jf6MNs-(>sIcUI z%~^m<81jqkCo9~t{hd;p@iI2<4{z`6L1iU(LdHGxc=rz>&r9CXKlOZ)q{Vy6&pCgq zv@Un((F52Rr=$i-{tm8R>D-(K_Yax38irmSdtLG=n?t$CQhqgar}rWg*Uq}7-LC}K zeqGUm?o?WxQSQ@Nh3^;@ptlOm+;C|q5% z^TS(%GOKrwesMAZ11&7HG-!nXH0yU_g|qNFsyH2L`q4@f^6MSkAbR>|FeF0330xKj zw5o_6D$v67Zg4oXo*qai)RhUmXX&33-U7Vd!2#8zSNlYQZ10P>VpjY41Xk3|XSYoZ zpW|JTbQqweAnDhO!Tr=F!uE8HM}_Ij<_szsmX5279p$o`%hxo=q-_U^3CdS@IQBn) z*77mhyS<^RPjiG3CNTH|pv96sJNenWhHHVsX6#6*905WALzO3=Z24}pfa7m7y6-(RxRLYwKAWqGpBL*MmT}Iy%q$kG zu`u=Tze0t+O}VFnTPx$bXd#W-W2Zl3*A0xBR1D_(C5uxO2->eB_&#dXjA^+w_-$t#f^e^d5TQFe3$RP1mnX&= z4>Wej-GrBOd!tc?1Ni`xBXFlTfsUE8XTy|q%|tKwd!GEDt3-F8M<&16O7wljl<1&J zmRAT+?ck@^9lj@jadS?S#|K{&==^&9#D*%eFA>Aet+R|UdrzXT)G_;}=Bk-d^J$fT z?Y=QZ5PpgkAw~%IIr-OHtCZtd=Fw#d9X;)bcoU`Yb{Zr6`1{*5dRaQCRK2*$Jq z0U-uQI)G~Yx(ocYrPa<>o-_0hNz;b91OEZ$^-9cl>!2cY&0Ndoi*4ES)pqwZ0p~W; z2L6&@JbUZ6FK+oaP#VO1<<`>Sx9F-<>S||acKt%;WZ8^FU57|NQ=8tpRH$E1rAytz z%M_^oLHVOqkveHpyXq9cnpE4JtfDf(xGuUmZ0}M_QMbCtcSoK7!!Pcq?&qPFEz)Ud zy&#dghlA8hzX^y^U0U4^^sm2t<(nye%I5=*R^(8%S-L#tZQ?$epojD@Y9*@bX)U-T)%)| zkNaAkmc+U`L`v^t8C=u?sWR(v35Zo6G_*T@Qks=XdCkSB(SJ;hR^@{M{@Mzo8P zS`npa!#HXSXBi%7vVX~Atvm0u?i)4J^@_bx9mYxh%{u*qKY{kvCZ}YOgU7W6-ZD~! z2@u#H)RRTv$e(uLK%X43_kiG6rfhMC%_-AjRhM4>uI7=$TE?3HX!6Kl*ZC@fI+!-5 zysD>P@_D-HoHk)InYR?wwfp`57n>Gi^YSnaFwGnDBzROnqygO&SBEyLU035#k3Zv% zLkMU$w1S36Iorq=A7j90U>uSmr!8}n-nB26Y(#jwM&rr#gCo6JM<}B)qoqvRc^5F_ zTq-i2zCrtynQ~^9L#PC~jWBgXj%H!*r}rJQ3$KJdoQ&PxZsH7UTEIvH%%oTcdgJpybQa(D3_%B*=a1wZ4{X-;{enthm zK3S{X&4QU{IcA*(5B#>yUUdmHXyxfG3I&dooqA|CT@TE*IA7m37dQVutD}IA-dJyk zIj0uEk~!n?{d<%z0Rd38%b9MQVW+fce{-J4g%hk1$S?4C(!SQ}2CY0%ArY0Y1`h`p-pIXZ?=-Amz?yfcQh+Lmt!W^(F8ZSv;zNAB5AKNp2x<(rhUJcCI19y@#ICH$aRB-SAQnj0IpIXRR> z94f4qitD*d>7)H-q|7NN#E?2N>jrBu#k|1p)Zw`wG8-6XazEzYWD6C0L}eB7SEw3?I$L(NE75Pb((5L;bNDskIjf@C64 zgwfVfnaSx~4(Lk9$BYw_gwEZ#dVRmhr`5KX)CS0uF`urNHtsAbI>21?e zEYrJ%X`}M8os6}e6 z7ijDuLIG}f+F7qj0zI0^R6F~GZ%NOw8x1vuu-o>Joo#xD*PA|glGo9zpe(r~n#VfH zaULLy!#wjv>(9UDS?5SUTbfKI!>8%Zl9mrIzV~rP-P8Vaj223YA@c8E8;Sa-hwA>3 zZCj>j418~%E1fS)Cf((oTSMR1BFplT4kGfNMl&jY74TQgQSXB}TZ0)Y#V9Ht#CT=2e6;cS!+;=|AG1|xqcdVwEp%wRo^#L5BY<#eB1QltS|EowOedTZWcDsd$yiT5Q(X82wEh=kV2oTL zp*VVNVCfqw7}EOvWLVMwWe{YlIip=%>Cd-DEx`PwCt%^O(z)w)N*vYgVe`IXxDq%^ zn>P4kQLQ_hfue#m@g|rM)_wMS{cX)4NxO&$?_ugaaNzX_1@?W!ho??2!z?pbTE1xL z)&@N#o_e)HV)ozw;Oib}$e;H3O2ACG21xB#K{)L7wippRqOjjR``saWm`h^bDO8G_ zayYxghLI>tCQwCgS8H_S3Cfi0G_kS20LFKYcGfjBgB9jdt_vP5> ze+*l3ZasLS%mhRmUWr@Dt=>LDtM zgq4DF@oDkKmGmhFIcz+)g+@v9owFs}e%oJ+Emf$rx~7>1?JRu5@P*9~$t%M09EBC) zRZy`PEWcM7tPceeU1N|g@&o;~!QQw@_xBjO>ppr<%^EQfe04 z{WkuL7I)41cqHP*%~~C!SxJO|?Y)@@%JbyzL;h-GX8ow#ti!S)%9BrLW#)!Lj;-l` zyl#}MdE7|TOB$1J64$dz1u8!W+}FQZ7EX>&J0mYoDb91rJ3RN&beWZ>NMwXvJxG7} zTcI~_&@ug%Qg~N=HwJ!JKw%Yd(P{s*j}%Z+(VeoNX-gjt?1nZw^iF$uY*Dm%W8Qb~ zH9e@OHouimHS&}pOPVb{!Fk7xeBM7v0-T6U>>H3Pxp{fv8neAZ#RuLy!h^B6AQR#9mKpvNmwG4Gfdx*l9iM13u?h3tDxcH#*rE6lJmtO_HVp34*P@8G z)WZ~n7G>r~Qyiza7s!@^?@2VEp;j{&UY{QR^iSE2R^ad42OhWApT8oNKvh_=bkL|C zl9 z1l64{QK0rFmJUY5ivOv+&sX7U0em5eH!Ab9C9QHMWWCiT8U$i2+=uM+{Z{Vlxn>w) z%FNdW@^cB(r(HDmxDi`Lv-x&zJys9FY%ij^&(oQiIu6~_t&sag*Oi!TG z9uK?cz1)!S4JsC?Edb+Xn^`Jq&B|XDBaW?jx-MfM=~K;rW%~%uMq^Nnd@0i6{!MX2u?$U{WtMz{nh0;oj17Kww4;XW7S~do8#3xBFPk2!2vF*%XzhC*XKwnwg{B2;yXx ze-lK;t_9_fN;KGsp8%^RZ-~N_H^N(Adv@5UGLN1ta(zdI-AgR+74$fRhZ?xYw$f0< z2l3&GpPzW!|9X!N_!ehs{yz`C^?>hAVF?IJ=*4FQ+x;^NnVZ{_F&v_vaP+H>(iu8o znTDO-OfZ5-0~^t(puP=Uz4Tj-2zsi+u{{KJyB#8rW9U?tD<2x@F7))rZLROFp%()o zR9sv4Wfr&HGnw58>_)0j@JzObjvAT^BLNT?23}KkWQpQFd3Ifo@e-%Q{>9PD)b)4uzm`F28vw+rw3%H?IQ<(_gF( zc{jU*J@xV^UPLW<$DHFxvW%*KR9?laVrk>Jx#vU>&O@nuV_@Dx{%r@BdgBQv`S43g z*_HDsn&ZoFdsOTpvVK|pzNJaaYr1y$DIk$MHs{ju?j>VjK1q-! zOMQsz(rd$-mM_kJwjN9;?8m(HH2zr_2id#4hK=FFE5@|#bq*W}hGUfXAH;){qXZ;n z$zaX0KUZi6w?wp?dnvHh`B56_5kCp1t+^tlEb&<--d2cdJ(oRc<-rQ!+B_%NPA81@ zx+mC?HN`X?&g1@~K9uO`!E zZ;wA=v9KJeK@vLQ#s?en%*#6U2e>e^U_;5zg_RWGf&i~Ac!N6fC6mC24Ed8+M@3}n z=~w?zv{kJw-(_VS_lo^jmq!Vu z0!lhXUglnQq1>N?33j|oHX@@bN}(8r`X8*jN>Bj;`ZUYstjDho5e<(8{+8k$slyOFGO$7F8D_dGj)FTW7kJV z&mmfH_|KE$tTMSG)^0Lh(MJ@oBOxO0Vc?V>PHd$95lEr)ZHL!&ZZv`6D_fnvrfU`M z5-#}s-F(uEct3dwblQ>K@G1g=0YxAnxaScpw_csb8l9io90=znWDspu{S>u*USZEM ztodqwwlv90-***SK~S4cc=C380KiFhy>3I_+g3-dC?4S5?l$^zy&{97saC%+L5Qy= z95iHGF`6U^iWwBZ7MRp`>xY5 zNB4Gi(NT0X?@?x9O8k!l@9N9Mc|?^jhGq)X_i66#7tT@H3XOQcy9~*`xY;Bak%{cI zol2+EE^D4L2Gr(on&3j*FGXtTNODY?#A+l;{Z< z)WJxd?p~Nr^)#{Uc3ecKFZI5DF5eu!XaS|?aj+(V2-GyjE*Uw)8u?@CPewl3Bdm5x zLNVVdJ*V72rwAFdWxap@b1hfH`UDYW0}o&Q?1iww^O*~e%Yo7S$L-rk!`4Ows#6mx z3$TWqcNDist@^)=p@ZZLbZ0Wgf8ILQG9Zb#U7gxq*Ms_3OmC_|XcK+7FU|XOGeica zWT=V0jWsThGdQi$iiC3@>cFvMdREjQ#@XSd>v=vkbkOGTTzc7Lhr^OEO2jetc4dW* ztm=xYP8a;|Q`ZsG+xc4ajBk(`i$`CW%;bm7B(E}awZY+DOESeizy70dzsvOAEm@eI zdVKWYZ3w{mNZn2=r!pK^mjl-7qKb$9{eDhBxi68D8|MG&8(#&KK9kKB{aueB}PtVw;BVtMqJv)io%7(r?7d#ry-YpWlbX6eu$u9zfzlHrIc4O@m_D7;JOfRc%C~}eAfD`b&tOq_z5lbHEIe93R;Dyk2EMK zPMcCtP}qa{ZxEiE%QoC!Pg{3ySoDHjGweYFwkwq`-&G&a-G(EFaGwD@Xd!G-vr%PJ9+lO z$J#5iw}Kv@o**V{;`N5iR~^CN@XOzCC3b8g=*;t~cZRKor92UOp6I938O3LB`CfSN z`yZ6xKmYeNp|)lFXV@#rF!K1HXVaaz%7Xv%p0C=XrXBM?6MgQ_7#ICBDKJM4TEHXs`TPNPg|n@pR;hypoioBM4Zsv&ULBHuT7PdmHK6**>Yz#Mpn)C z4zv`%_HypIM`iN|9)wcdU_KmM>H0wHna<;_>WlHwHsskQ*SW2XRiEm++`{n9bI#!q z^A1|RQP#mewJz2_(t{JEw1p^A3A-C;8WQ&>MUz zmmqzx?y7`pCldKygg2<&r@W}q0)?Nr7N;pFQVN+3==8#TI32Sh=iHw)S4TiCuTQk! zJJlmM2hSc{-A)bKlg)X=l>M&A1)dcllwmx!6SO^r!8oF^|T%gBzn@5L7y-$~@( zX^-hMuaPPx*T)i+$ChuGdX17+b`VV+={LDN$Bu~P1wUHbfppkAQ5Naqna+$5)6$Bs zUnsX{ISo(+tHFasmac8CbL}y!nJ?$BC+#GcDnpUhtLs8SV%O=HsK2j9qNQBDk22YO z&ZYqe?MJOAO+=>VwYGz-oRDQ@6;svA74|HW?k=qXJe!MuOhZKL+cHOsge;-aE1V4>Jcl{|+c)&{09{8HN^{XC4l{e+5|CbO8VibG)O`GIrZ)I#1Z{8BQUIEOl4eoS zn{UAwfbZ&IzisVp$&`E|>3CN4ZIOFum>YA&s}2X54DKr@9^_siaY#R-niGRA0J40aSitxyc=-ujU7=4Xr(8=S zv+-geeI~Q6uhRzVg+|&)s4FOovFQ?1#rP|RThC}RgAL`5c3LG^oI~?Gj20K|*pv7J zHkU>ae6OK$H%e9Pdn1f6TJc;6=xR`-1$mgbe_byNL$OVIUpDucwQ=)|FS1+xpwwdyQFit)(9nh+*_KOg% z@4H}h>x7~A50!e@%~u*~qE)o4(WPIGwiyR!rn%+{S-KLh1f|ZY8#(spETtKO;64xf zP!gDl>Y8~T$(SSwwue*uzUyb&vM}fB#V}ZA4ZH>j6^5(B^xn&7lXj{oj|ZodAex`p znLlg_DvBlEC1@q{`-pjs2FW`Y+PM~dpvY`>#b%eBU6__=OSz*JlKCC4(?Yszo_$vF zTM|gch{s2if%L)|rcR&VxDmts$rqt&bAZ`5KJt};GM#O$b+pM;9J_$Lb$26ChefZN zbNG~ZZ%iu_+z|O?$uHHo+N(*-=RA$hJ9@9GmVWB3DOGJ593}eUoSn!o(QYTyGW_i& z^#}7KS*UHr^lY=!*PkbyGqslcRz zK{V@9S;e!KwT3e~OGl6E;I0*`CV9i#-0LqMyc|E+Z=d(NjkX|?;HOS%nf-+!;{?CYlywDtnx3lIgMLSrI zmA3ny=3$q?mCX!2&$gAWxx<;hfHZBj_~G7!hnyYyedVX>+TW|aNQkdgjb*Bw{30^n z1q2Q<8@xR-a6vIlxxGcL^)n5fFJY~iDX`zKcJ$>++U3O^#Nm9e%nKW7A#*}lTzc}v zQpwh)AzUN(L3Xv~OX@^*`wEYvBpnd*L8%SM|XuvJx;#ijnO+(yHTzKUWgPS}9IJ(G1#Au{Qe z^<0 zxn?Ib-lZqr4XMQ6WpQ@U3c(ea;T4ozmdD^ZEbKZG-j$+gNEv0O$5H8jatyuXW0Y+S zfUX9HNY@p5Tl10u!0mflY>a7bqu2PpnfSOV=|p+Y%P*Phg*2{mi1ZU*2#~VH4k?@5 zcd%w!|2eqAv(A**_YaOzUAmNMopH6NxSm+Jtv=qSR~89A1+I3j+BVEQm zW!4%_(3I^f`C&LA8Q7kB!Q9M3ll%==0sWw5j|zySn#tXZ ztz}ZDV@2!FUE>*LL~FXuRyytnR&h8Apxq;tbDOX9F!VFs3vbiaEZaF<5wV3e9$Lz5 zPf63cKBFd*(e_haJD1Y$j$Ritz!fJm^hcQx)`g752op&|k;+z7WOYk)uV}23^ZnjQ zr|zLP^*)d-($%v-)LFt_WOle0i72;tuuzty_ttNFFm3DID^zmzqQxk>oRXAJ`s9X|E2%2ZUCDjrgZ~ptKWD4kRW>`A%5Mfy z#O7)xpd}@d%$28GZ;GiQ$ES=$AMAAOt+k-rgBw*?b7hn6q4k;Ud^nh+@z+#$k(#j8 zJN*DAov`}~eJXU(=CtCnP9wVD)#nRqY$*E|4_&d=q(HzuUiPre@19lO(OxQdoFf=| z59*yWpiiXh4V8+?slW2w|AFD>)&|EjZ}FoI!kc&fj=-^^nCw8$y50Wa;-j`I8Yj*k zTGNtD!^Gvi7jt1foT^W*qBfcofTJKfPUFkmn4Lj{LPEotcKkZj&y?owD9-;HTHtN0Tu`xTa2xWS%VS z))Zz?o3KQ))~GMECoK*)ge_4Q$K_ubxJNolairF{r(^afht*5_Wva7Gv5ucr;yow( zH%fO4YuTn>6;Hg)hFB6D&)>C^qaIh?5qx;OKY()&@swZb}Q#?*|quRf%YBo}qF7TrOQ#jXC5(Wazet5iD9`4C!7 zrLs{YWmvbo(p{Z{z%1Q$fy8 z5828)3pJ$NyEyVfa4E>AAfNt(obCRi3P40rdtfw1;O$+-X(*WT>)0 ze`09ilCeKW)(Hp5`hJHC+S*%J#uj1xV1=D_p--vF~-C>d8(E;)r+f_njp)&4iS`26{TYv}^6 zOF(LJrhUjfZ=7l}C3em!ydX`7AtQ@+KzHY01<5ikbl|#{_efTa z#-~Qg#rLtlsR&0&qUvLGLZTZ)S$Qs!(MG1b{v z&N!H#E6o5sf3anBi@MZ7BvtN|*{Ux`)g_gk7wciy;C#;?uuBDsMDzvumA&3GO>+z| zqk8n)6e2~ABltvqQv7zZ&x&h}*i_2epvd2puKe(X_fX0a&`@V@uyX`&Bb>XY(hl+! ztoX|W-o1lC{aUrJLW-vC{aD&5Bj=qxdIYvLC}?mgPhdyAEQ#WfPdQAqyoCzXlYzWCnA zzlDJ0+Rvao4uA+jAS?1yn+Y*CL{!Aw*YW|Q-Y_5#}$98f$F{Uoa zsa?;IkOJa+`^K~NT-tornk%!ePv6Wgml7!Y^7D``Pq*`Mu{ETRDnY~c^-^$gPD%Az z%X6ibfqF)cB~S%QrC!jprjM-=mn=bIrs~waA8okWk9aw2#7ufZn{0$kds#W#q%jeZ zo0uzt>siU@vEeknB7iPP;_T%A?oii_AgU}iarg3SH79y4$BOtA+=*}$HHv8=y2Whk zPUsW7SU=N|M@HuH$)T!*!p-*stRs50HkOJXnT|0#=O;FSJhksm7`s+)zF~>zzfpW( zKU=I-%)5*c=lAmX_UQ0#`7P%W)L5w*X9GMMH@KT5eWWEbrlW_@;9<7~3s zvK9*P+QCq@1oX^=+S8edirv+tGnPkKvhQ4qxTa<5RC^M&0F>ud2(isz1G*c!ns;8O)kF3Fgy2KEUH#j;SSC)trrdK+#{cli&o!|k=2)rH!@*cF zS*h%`UO+NdK$M|JOIsQDm72F}Es=McW1Y1}`5RXat1*pwHx3G1R!e;(RJJ*8r+#k) z;!IridKvAPsAC#-`Ta8okgs~#4i~rAtoz}P`wF0aL*M3Da116?~Nyz8Ve)bUv~NU%I~T2Tf1Sa zhMk4_>b^yo_c>NntyUK?gQa7gy2F&{^)wXC+s5Epr9S;Jy)KSoXmO^+Bg=!lo!)8h zDsI34s+AN!#@;KB8)U7ehWh{b5UQMGa1y+)1IiAhHfpcXe8(&O3?dkTW;YZH*YCNe z1GwDb))Im-;owR$_50s-pSxC9Mjq!pZdSg~JK{kUT7{X3IbZz4H6QRk_-4~<=?igD zKQ1MSHfp~<Ar0MP3d767QY`SkdSuhs4#R zMsm{KKOD=KujVyAz3(h0yL`q{TzUM=Rd0O8vm0w-s&v?p8d}*9{m5J4Cs7=q5uV?4~X4SSM!bp8OPby3<#!%xPy<2 zi-Xtf&(`~2ZVF|Ub6FbfN`6wE4wQV4zdl??3BJlcgE{|ec#~~B@`Ra;IPBMug6Rb2 z{LRI0pp(DG-_HVn(W3`5{TkkT{1tTayN4a__tS!uV5WQhZy=|CjXzuj{!(xQCHQOj zD(DsD^oMO=fnQ^@Q~$Gi|MJ@!2 z+W+Sebig43(~RSl|9Sj)r_oB1qOrhve{KG!BzPl*Z3KNF{nQfnKPnTEUy_OQyp^Ho z_1C|i`P2-|Q1qy~w7Fj16=!VZvBvr~8(Li1h~N2qZ&~9Myb`uKa}|0e1kr=HxS~Dw z9b$zhZ?oG^P^wf78Ur%*dO(9)Bb$-(+nW}&Ibwvo;py=O_eRgrRd#C z$2mD;N6iWHmY4i~?y2I)~WZh@A9c97K0vMUg%;hU3P;rSM~8QxWxh(zzN7_IV$pO4xK7(m+xLh9j=dUiaB2_ZR-T8 z;f@1Dhl`ivWUnilFt(FdC$=nOtaDGE5AR*jV}RFmVc$c}XjK)Y@NqKJp?+u=)wyH@ z1Pt6Dw#V!NSvyiBALo#CGBLh#6@OaN~xs{f+>Y+s{FjZp?_ z)XMJt7#l8A+!!FnTga~aQS&;Nvq*rXxn5J7JRaPAVmpRRYCkJ=u@3yD}c4SIHzJZds)VH<%nB}j`YsF##oohXb-!#S$80d zY&nPLwoZzz-IiI3)MJS4dT}cRD1VhO7pLxWR*nWH2K3BDjFR{LXqo9z-LoIMiAXuO z>b7B_kY1F`RH8$)=x@z_=mV_SOosOxC{Vgs)DPuoX57(9b;i2q`NTuTU3?n*URPX& zH9Sj}2?1%2Xi>Gz1(vHXW{)yV0AF~A&Dgxne4mZ$ zUvTtc+pG&8(`*vA$_5~CT~{keh^BcW^aZEK7q@|4=O)Uy(tTgg#lI2P=JrnEn7_iW zaJ3VpOTmdgBZ|=enmEaq%U#$TW$ngakF1|K4Wl1e>wE<%A&mR*ax&0$V|VBAN8!~7 zkmz-B=bpiNRraHqS9ynC1)c=I4aQ$VNdL;QMXNGOz<^StqBv%$v$;^`s&zTsBueEY zHK%SKqy)$n0Rs)Q*3f$RvS=!zHlMocW=7^-AZDN)Z&-R>@8fbG258PCSHIeyZmlN8 zaGwOnGRO@DSZ6XWYh8y+NyO77cvx)YVy~|`SE?J(p)3Zc1+9O@#IjRA18Bi_P+@U? zcn)N?mU$vFc7Rd$d$zrB!@9!k&mI&YJ*3F^qI$j#zn_+$K^*Tb$;=MUN-O}N2Sh@q z6Y2X2OltsKF7V~WqrvzDk~2Z$Q$$U{^s{O{V~Rg33IAD12+27ChmvAGGjo|(^#wi_ zhXJjrRXMBG-=KA1JKq9uCDGoRXCLWQoV+ec!kTJ`EA&D;BtU$tyZOwolG29X3@3bXXyoHG!BZ;PmYT138NQOr4xwMu66~@&1ol z^b@e>{kaaE0Ti#kdwmV7q-VlL!jR??7T9vuiiojqL)BscIp)^<}Y}Xyw^N* z5)YEJ)eMx4T$SIYpDo2!%1mq({XJ;*(^>66KF2wbSqy~3g+*o)sFjm-jOBp__i^ki zO=9tR2@Q6{)dM}+MLDZHrE(xp;Yt#>I-(WZVxV4KkD8irR&v}RB5+uK&zDoCJ-gPD zAKi@Osl6BR_(&~z?Gi2C%eiLB6&K;S}iVZ3uHdihR^#^P%Xq2Qp#M+K9TG3(j)bkmlRz;PUI2-SN^1KKSTci zXVS#~?hN&_JGx-Bk1!_kg9hP&r|3NYPsZr`!U^Z1gFFnSSM?tu=E@4RP{h&ylL>bk zf`@|o&XDrqy&OUdl@F>A6d%<8$)g_>io=AoS@*J_!J#9>6(|Yd>$FEdTdA#ruVyL! zN!QKBK%00o^b^}k&ynW{ljsw|tbptM`eM3O2Og4A%53F0BufkLhp21GG_r^StF`h# zuJemhm{I<-p$`g}r3`s z_pDNRrG4ff0`WZvGHYFcJXp?_8XI(+8+;?jFYRXjd`XB@xx*DAPkQ*URS?K|&Hg1> z02`J`dl?c?^2~ZSpDCRaljqF?rf7acf#naZN9z#&r~?4&o}T_^5sS>@MaV~P3oNE| zDf|ua4|;C_H$0Cj@EDZZ4=d5}CTy)uzcIE5oG|MP_oqsJj1?=K{CJfzC+H1S#T)7L zE#1F`K4JU8Pq~hpblt%${kWf?(m(4@Ra%|D$_Zbx>coT;)ZtT~M~i$1Wf?KnUwH7I&15^V$>Y|sM7s6){kwV(U! ztij}+Vqzf?ZeAqLdG&acpQ5_lFiX(HI2+jkEG-vyW*ZS45mNk!4{2EvV|%IF701On zTjKv{*r|m(PF-ITTjXYD+k|?Wf-u(0(PMPP9n8|Mj5zDs3)gXsEWGGV(MfXU?xL za>j`1rBr9)3s`T$qLIe34W*&79qz|xb}3lXtjzL8{|@euQ`>!_(=y#{QFP!$4YG}f z`=j>RW0BdZH-8NvO*X!k5o25mLBw?vS6C8H3t)IkZ%U?ef0{gj{(&mM39vBah?5!= z)J4TP!z0YK^;$uT`b8oo7n5IrvUX2CVQl0X}i4+1+V2m zKF431eP3=W6JQ!Z$24 z)GL-sP{F&NnVhe5^}3d_7>SmHO4K|7-|0>>FzyPPmkMuSbCjB`C+5Q5pbOOEQiTGj z6XwIDy3m)$O~U&CZGq@3lSevCZWv0q*H5`RS8y=8wW*AC6iY8 z1`IUBT-@hlccZO?S)yijQ-XNU^L*qPjl6b*<`xrySpp6b<#&BkG2 z_)>SZD_I?)t;24VE(5D(-_Q%OF*+g%Ra>gA*GYNqB9VIEeb!k&>K6Oug!gb+%$H?2?Nfn`^jn3S4WoW;VWw6`2o#uRx^teFD)F5nd+QsO?i9;czD-S3JXf#aixWZ_vT4z zNx;;0>(RVidE&7yI66M&!w-ef%jrhDw<5SzJ;I1)(+9^lE-5Uu%o;(5dC1`nD7i>t z=jE`WM#5JRO??-}RhmNBN9jArpz0vXx6TbxiJ80eao@pmW=-mi0MT-H%fPh98K+$z zEB<_RU-7os#Pkn!P#X*8(L1rPAOnG!iF!sYW!IYGF)2mi7)W%5Pwo*(gkF`7lxFXB zLPrx^mS+pukb-IT9Hu%jqbbc_T0D1c+e2^-fYSKtblwGHQbZx>xNjh-Vvj8&&~P=_ ze`928k>+^QpNhi(2TXixO$vP|y0DpOl6WAy+=5P!nXQ}LldGOO@#$RAJq%CzTTlL1 zeV4?-v1vxV7t8W>CR(?(`kF$Pb>%kE-u8UDF}ts^)|IZ0QKimpMygmL)9wB@O_}rn ztgU;KKQw&6fhw2V`PAzc560>^`3;TA#o~O}A#a;HW)?JbCs-EjODs3wMA0GoRpe}S zY)jP4BY#b<{LL86?;9ru8CfF??OK@3l4p^0F>zI~>;RXOfl7DA(g zR`ZW^=mR;im)bt-piaX;sSs@jc&ITFO5Qc+%NzWBC6kL0e1jqVh|qr4C6B}Sx4(n} z{(_XVcmpL9?lY%xIN+|_c)!3xPoXm2ZI4TONTff>ABNVS+|^!*yRh56lfl4$;FS(& z&v&+7vyJJ>994<~F2yDENMb8wI)6qMK7(6rV!qq-VkZml+=lRj`Z?I`jE7%E(6!jq zP0dB6E=MXD8K13TDBG?(L|lB!cW$=2W?ympvc;!U?rQ8;4@Xh=nEj+0=~=H8ju>=g zc{peA7Pz<|CTyJTSG@R0u(K>w59x zY4@uWK;)%UIfwfKiOvoWZ994sc=`L|Po{S^FectAMkqd0?phAbpt9Bx;`1*>+l)KC z8=u>)Dp%`H?W-xwZn^sJwU(7pa(JH;yQSiY<05;-;G>EhPkXpkMc`8w7fsgoOtBDA zF0RRgA!oU&or6X1d7FB*Q}PfqIP>vAZ#o|1f!rCLqrM&}x$l)Ta(k;{aBd(%R&_j* zYI6SWsvCs`C2uFFk{tV5J^8Yw@z;d+%*~wZl-gL07>5z%BnH{Q33{RMy|dS}4!v?U z!FrX`Em`~K(xcjQj5fqCl~P9~DWs71h0>1?M{A4Ff~l*1jTd!%isfu|pS(a9OoR4l z)An3~TyZOhUj*;-HtZv?iLpiO9f|tVz3hEE6R|!cy*j#B)|h9CaTBY&`z_U9#Z^lP z%4B$bN}2*VmQYubvu4FFe1hcdrgGnK*AlnwEbw$TQeo`z`Ck#&LRN4pQU&1Xj*h#B zMew7mhiSRP%pYorT~3j|P|rf1{Gsb|a%Ndf;1p}~VI3RLa)g{V5)#G+Vg0+1UynS|+j5o*fsn3cvcdf{>QV%FN^zHId_0 z;u|64qKRl(#gR8m-@$(mLYE7T4tM$?r-v$RL7*M?0;XlNE7sF1b~UCrLPTbMBQzS& z$jMiM-`Q6q_ow!rY>>+T&hRebH^T7jy+~&zmm4k|F)6LhCMTx2TL7tSXiqCxkBd3g zo@#5Y^fh^=|I{7pv!Msni*lm8eH@c{zM3x2KfW#bBo~5JtjmjQoXDF#Ed^T;6*yM^ zy+wet9XC=U9%rvnUbefBD$tA=J_XiOekl&i;8caRf+}lTj7C>;RUgjk-KMper=YdD zkGzhI+KEGLWdCMeOecR$LgRa8NM!%>u*I#?+bWn=vd6PgNtk`0V=8$EwgIau7zAx% zPsMqkkU47k3j8h={!Ki&rdGR3t8|0N*2ApEbOv+i@$$!8y3S6%7EL{wd?z zfIN;jYjO8y^(D(0HyNT*0+RAjj`qSeiHoE@0wi}HDzaWPTz4{W6&3-B zuD!DnuSR?KQ&WC7$=O~bcYgJ79k*8Du+7j>MmFqUZT1dZv!3xiG(>$dm~h4AR>?K%n?@mXH_InA z#49}>q3wHYEeaS)+S9&B7Xaa8){mXDdQBY6x5K3ClXyWT%d{TNzP@VuSVFWAYE-nA zhweAf#U@8)^PKZ{oFA4EWM97eH}ml8b$e}Wcl)ws;s{OdUsHvkrh4Aw{*>R*Q0w(^ zt)|Er!_)3lQ9y)q>QG&eE^N}S>TZyK&o!@IF99RK@vwT_Cl-6lo_C>phT&gT&(z0S z3`k2qhkS1n_q1yctdSnseO}el-3pE+xAhz_wx~WeJjtFry+`SCPPtq$&$Qm%MrUk) za`MfsLY~eG4`ckOA;{-bf<2^CR&5S}mXI7TcztWxL9Sa1A*|xO(Z_U=9lnI?XH@}w zE!xmdEFLHsWkcqk=d`nHrg80WD2Lb5@sIrOQ~lQDe`rSv*Ea2Jym&bMo;U%UKky#Z z!o7P#O4~>)f35EGE>X>AxzZ^k-a|VS!a-d7tizEv_W4Q(3qId__M`E@;qF_E6k1;< zGm!rQo^_1e>M5k7eWQ26lUt|5YjvUWM;euUa8S;eeX(#M#KrFMXy%$tURBNRAiDuQ zmnk<#jm{5)T^Xux*R&C1ePp6vKBYEmw&Bjicp2qe&i>T7NYL2UyTxdS9z9!kxBAEi zhWxkb2OjIwI+NFKub;{iruO`iMVXjq#?mOIq}gwlZ+m$w2%LN4;y|Y&+3%cCOjC%A zZn;CF?_9FP`5RGSBF1tC2n0=f)dPe9GBGyGR7TpPd-sqqlUKBs^8G)t_ySN~$i`4f z!ZKz`mEt7B&C+=)3{2tIFPvrD7EKq|PE5y-{>U%VEU;N;J{z84)LjV?XLW@$i!=yR)sABs4sh z_q5lzNgGR$l7Cowh&YmpSO3wbQJv$pquWsLZSTl@vSK#(8{|^eN6_!0)ivs$O^9K1 z!Cz-|z&Ey)^Q5Xla&lFL0HF~Y@N858$eKlGegIQ)LU~?9IrG3sFLC`U2T!*0^a(17 zVyo@xE+T71rBY5t*B^>v?v1WRSa@TUfkSOZd5>1QF{&OKtQ-)zH!n$X-?}8+IrIjw zsSKpV2z+G-PI z$~9s))d}r7o?2+dp^>H%zEIIEBeA}?Ot~t^naoQr>=`}1dWx8+hGSkw zov>mQ^E~zPGD>Iw^M&qr!}#~XfievbJ5by8?#|ag#!w0hKBi+lyMZd;cm>g>|Bc|C znLo?$cDOhSupZFp`H6h@vM7Jyx)r53Y#V4W{(L`&`q(hfV6xBsIBkN{4*tZM&hRATQbcs$Qk56xW_EI^t@s6BnWMs1iKha(gL3bZr28gP2;% z(2=mvg_s#*{3!v7l(coQ9wD_*kelC#!s6!D0np(_FqHGlOWYG~VT%_HhRifUH?~{1 z8a<47YeA5Um&Dcb1wE?52CH!5e+recN$cR)HYy>Rs@~nvtE9$?4cK93idcV)!CrbE z_REEz`>v^voqia_; z8a?1kq9sWq4;~|k4Pg+%4N?imb%F^;vbEiv5LAnl3vO8~H>F@Wuv6F$cQdej5DtBd z$QtcQ^p{Xr-%*(yG7p}(EeXrDP^YBREPCZ_)jD@xl>0xYyd43D*3_)Dhz&ep5y03p zYa2|5S;>`Nn2RhI2QvyW9oMm*dB4mM&iETS_^M`9vdG`#13faUz%ms#BpeAPhCSAX#;J(Q;N101PXb^of(p9#%^%%o$wwwIQVM!)1RlC=RRmc zT}y1fgjNzcXnCc21wK??jnG@{s^>s6-6u4aD*5}eq?ctFJ9`^`=cI18+QdK1A9!k| zU?Sajaiif<>rJJXbdBit#K@R}-P2Z)AAA_NW156|u-302j4D-h{P6YSt2(8my$O#^ zx~iwS>_2sKZ?<_5RUnsRXfm=*q1Tho1Itrp06j))e7nkB0dm4b(T0HDcyRZrU!I42FDznNl{%!w!hVChT@2^=K zD3+MMbY_^qn;|O{gi#u&C4Y7%h0md??=PNbouh$z*7ox6!|&9st0aGSb`Mz&$ZK>{ z;*)(~C~6XRM)oo*>(5QzJbYONndR_{on6k9_V|JCdk1`|VsvOuhfnK!BilRKOvBYs zHov(@3HJq#Tjda!8V?QIJKdtl)Kd2v52N+*kr18fN6@ya?1w8~1PK~1L>4(_X2#sy zt)cOBGMiSreUdOw#ZAvf;~%Z%RhyUP7enyI>Wh&qp&Vlq1-e1_Lq?tuD93VZLU$OV zvLv*cA#f4EzflDdSJHJl;cOeL2bCVn=DK$@5z80ZF>P_DQIB9Sd`ti;*^BNa;-xx}Ye0 z8v|6FkJvXDni9>Qpx!auTp7G+uXQz;Y0k?}5IRs0ZGH16i2{m|6acCodl06w^jIq1 ziETZzp3GQD;;5@b;U1FMQ>B zb5P8VG#v6e!rb09jzIZuV&B12qR{KnyQknL?T^0e8*zgy~Q&5I)6*0z>|f!5T1}Ux#YWf2F$5l zrd0-yd9}u>q_+>d%_#ZZgKm`O2T#*@x@G)iq)#H_c;vnz19n2gyyp}V zEq;|_x@(Uv$kkEWD_UhRKVZ^v#moQ6@)xn1tyq&9Q`5`E4>%R?&sQ}ApXz(r7_jiv z_%_tN&KWji30QyD^(WohXU*BvvV5w4!DtL+uq)2H(5(^97!|blLkMqJ=2bC@AQz~YF8EI~vVLj1;(j?_x*q%ZnrBzHd85BjKJd{w+}9^ccDNCqFMG{; z#i#YY>nh+uo8>~zr%=gXU{i9LqV)OvT_0DRPQbaNHG}TtLav_!KF#qi>hI0RTXs+{ zsQ)Eh&6?_S?cEd@9{pu!PQ@W==i-a1Xb5BLubBFk{oWM1;2k44#+YbXZUfFVgx~7^ z5~W1ni{i=2bh-s*8{i2AvikYMxQB;H;Gt;el9q0T$6T1~iWE37O?_!*43mL7N$iG| zf4Sy5hkhH%TlOK>Y@{>S`6Jwm?cVv=QR@izemB*y1 zAAZuWeX+%nm*fSo`J=lTO4IoG?@5XSAewS(kijh!EvtXQuP&|Kx#NKQ4Il;wJsAgH zn~VHS@FOmyRxFLe`abSQMO{?f?fzhLaM=8So(zW&vBou_nEoT8@%dWT(*?MF}v3E1)Rst-tA!0}>^k0%a`nvxu- zo+v98-z^w4*;k#O3k}R&))M3y(~*Q2$%3$}IbHI*_${7X=g%g5TF4rpD$(xqeWG-gZ<#LC6dZTb{4up<gV>U5T{h(r7(gDgPljxE-3s51){ZoP#p?_YyN-Jy}W-hp9cGvBya_ z;pDWq0@~cDE4XOwalUix4Sx|~gFXI%7X}&FXQ}tAQ*^zc+EzpkHWvE3aSy5z8Q5m| zm?o_E)`K$d`dspZ?5qY)cI4EW#sjsE+87zC#^TrfLlusC@%@)rLw;wwF*gB>T0w7z zZ4GC_HeGEqbX57#rt8oHll2KWRzlNJgP^laNM1#btwk+wbgMjg0Q8Ym)CoKJsZG*{ zFICs8!=A?6Ch%kr4x6>>WFD$0TqLr*Dq*ue6`KHITrm7HCTe<}e>vuI^MXwvX&`cE z;BgWI(eWVq(OhL;%(2DBSp|%%7FIms+-9NbH2F_woCgEspt}pmXybhcg@v8A?H|qZ zLcFBT85+6)FUPg`h=Upj0w023zqI>jn3;{7VQl5+jpAUKrC*G}%kG?pmA-Z$yf)1j z6L6H=<>yi_V)7%}E)ABJ#+PbEyXwu=uqEfoM7Q&Uys}NfDUK5yQhaR^Fc}ZS{(M4N zxbBUOWTk}toct-6`!YkfzyMePh%NCBy1Ok=piPcTGtbTKLs9ehPc}YL)fbe_TV#;g zIL(p3ekOtxvHef`!OuUTMk*#K!)fobau=t9oRybDyIR<`3TW|($2tA zxzoLYKYT!@bWGafi?g#iHar9LMgHI=(tk6%3aVT=49kg4AHG4c4zhy#!#mNFC;e6om*J4p-$AUt3W1G{ve547cjo z%ME*K%+YN_JwqinTeP58)r3FwUHZRHSky;FU$e`f*1f%&XISo_dwFlGN445%F*U6S zdgoHJf|*b8Jxq3*G%MzO9MgZXPV2ga4pxstf=39EmF>lB!rspN2g26~Lw7^2``<|5 z=!3S$dQBb0(z8jL97WL z)fXvy(SJn$ufl@YV7<12D!QF|^TyqU_{%SQc(J;bvoTj_ zSM2vUn`Q1+`cj-hPF(w+r>B5K^?<0_BpWKHgJnC!$3HvA|+4bFZhm56~M)- z99DQ0|7PWxao<%Ank}`+T7Ewvcs}P}UIrke_5FsuGX&xs@O>5GU2WBzYgE}7!g6Sv z{Fj7-nY_GTjIBndlE;%to%K+CO$j1`Up8$uvM-YE?K-cN?bcTu&?<6Drd3~yuy~j`$v^PKQ_*d)0121DPk^%$DJpd!0j;|%#XhePruLo zfAAX`1?w?wlMx(@*076wv>zvvI(5*%INPzX=M`J7s^0Wt_=G&LD5d^Yso

    I9yvY zGtjfY-8GOTi6NsqKS27~yRu@o6U7wU+PiBxJsw>>>R9+#dcO3$^zXVR1%=>)5+H~4 zL*EWNL-T-7!+tEscKPV76zoRd;$!X?;IV@F$NTT+DTzL%HxYN7aP0%F3+9**u%qL? z|E0OehD)o92Hn{q2knc=9!5UhtqK^6POg82J;0g!m*PvG;mfo<%{}mKPhJyZw%)gi zEE<-9O1ho`S6=pWx&}C_b)-z^sB55lPfReajIxW8HFwCkuVa9)M5h3o`XYwp4e6Z= zhN|XlR9kpombC4p{ug2Zh>8O)0W9~f5^aC%Cd75w&V@NsgSfd5i`02^zkKahe*BV* zO4-aYvGOfuVLar;ZJ`U$@-j&@-cf_~MMt(awk%5fp+cKyAk8M zO9w(n61EGTwqJhPCikYF;$L_5svx4Yc-ZvCV;X){7a+7b+CNrcD}{VZU5R0anCG|(Uhu@9UGHMM?P%66(Nj0 zDj_tw7gVV5+#cJBPCFSAJlu$&7@M*efNDmmFQcNW~Ov>E$vTzc74V}-S!Y2`fm zuUm>1Rge;kI^U5}^8Nsvyy=*Dl;U+bl7}UEOw{@bU2DK3dRKUCTmGz4{tM$279(@U zYR0E#*rMTl>m?_~P5zam#7#$@xTo~5tDFF?{BONdI|LMg zX%Sk(+J&j%el#(>*zks?W%dn5cGMv$W%8r!_9zY2t2FzAt%YTLX-rHEzwVc3v#qf` z7}bIQywHEDV-oi5fPByyGZXKgepXoq9CBsdkrNt z=^YeAdhfjnB!PgG(36~v&-;God1ua?ne+SbkAX?*q`LXW-a8F^v;uFNIslg1SSfNv%nD|pnMq0jZ)A)=h{MRY(d*oRjJvE! zxm7sROxqA#X&eMM@7-0$=_-`wJoT%3D*12)(dzBAAocnT4jd^{n zC`roi7@=L@?zaE#YnE7O{vo7`?41(rF^L6@4^@Q-a(AHc?*{Atju!4?69hQXOU+4D z>@Nf1EQ~7v`q5b$a@dN}0fIDFJ)x-%epr+gqQz4CEd$STR%c%YLe*8%L!g;ibI zHv9Mlct&~W=_@Nb8M`Xy`MD1vUad?k-U`1pf||}J1Thg8ksm)YI(IfKNG){fqDY-d zz)x9pW>e`cNNc{STY38Z)Gkl2{OTRLx(jEkFpAKg^JpC`ReX%{ns&+m*OKyG{kv;A zVwR}WAxjyuss_z6{K_S^(-dhnlow~!)uzLxFhl2Bc(z4db&6zmc_7S=lbFAVCbF1J z^2Y3J*2%%N$lW`-Ej}6a*%a|< z8co|#h+;z>jft%FBnU#$T9QbEz?^i7NB*aWBW}^|_fk~YNAoKu3y(U*bYvteeWoXS zSZCItWTW9iQ0YK202KxVnw^xg-FTX*>bKmfl?l@nG8yQqo z^7-D=wpqw>wMPaW_eiM zA_KStf;J0~A}cxm8fNTPw6J?n8GEiNiqRW?8gO%($d{qcV6sEk6t^7-X*}KeFmB4s zD|w7$!4x;4GfWyO813ShJvd!eZxGh!u4n^ZN?#aN78;3)Fpuh!(u9~a1gA6AyDYv_ z5uLZ#j4?f!^>v0qD{1*EcBkrz*!y1Xp`S4f~SWR(^-| zOEd4yxcM(@t9rdBh&_kKOljC&L9Xtia?_;n6I(jPJO}SyAp`KeqI0+Qm(*tC8q(vh zr$5QJ>0~l1r#F;lU9@LBpZg-)MK=1~Jt22qYU9WBWp+YvbJ|~O^)FH%d3VS1ntX~4 zGr>Lbb`af!zH3S+NW+?Dsqfw$qv1W8Qkc!^c@51z zlo-@j4eS}+WiibJR>oW&nZ_e=mxb?z`sIl>%&_e?T4w*l#hF?+ zjK7q1-|g8sIoUN?V*wR?w3IWHX?;r_w8X-ZyQ|Tt^FvclV1}a@?SkFa-tKgL63&he z;TWmE{@x7;tKbxPJ00_c^2K5O&0KWDSFllZAJRt}{7`3JjKhZ^lqlWioqgf>HwMqS ze}mXf>1C4R%dW*c=`qwq$u|o_Z-^_H8U?=isLhC#C{;G!$NE9^>a>YF%wE@YU8(Xi zk5bB%l6H1>;7V~m44tJYrhG{?c-BZm_?}*aS1Hp7ai@p}8qqnY5-Vb5Z0MO?FdqnQ9dDXsbC z526$&-~qh{1ZMrUXv?3;LyL9r6Wx~syI;}zLU~Mlbh(9dQYA@inQ~!5cXr-=9UhQ! zR!L~45Z*DUaajyu_Md1;d%#b}=OPM#H61<%O`7`?(XcBu#v1r{X+g#hY^N9Ns3G!k zKx&bjQ`p(l2T-QW#uQ?YuPa;c{?I(%%AEmZ8|>=idC} ztbec&EiUxRsNSQf`pa$KbX80+2P1sdF*_i9Ca}rt@uX}y#e2ic*nRSH5l|5e%!%Gc zn1q)?Q_zXpjwL3IQ`6_~YANx~a4OAajihMw>~4N zQ&x>~6PFtvI~qIt3kV>_7lDo6zxqP?nZPgzD{B}S{g7t}!_-=Rb9Pal7@iMyc%(=6HbI3X?0qAJE0LMooXJ=nDy z(Z$C89w8Crp6ZMRY-+L-3b}Vx!E<*1fh*aEsd}DlaYIXtD{UaYlo=-RVokRn2;j8_P z$wl2MZ9PLuB?a3@wf;CCd; z^aH86bv9;dHBAf4>CTAC`YDgRUxx}iCB}^SwdT;FhyAua?q_EBwPu7FK;f&JhCON0 zrnBFj;{7R@r5-uYJ4ObRIbu+AE z`lU{KRB|sfh&X(^{6tm2tDH_d=!9$wzY4+Qe`d-vDX5zK`8Ijn(I_@;V+Zi$Ynnqz^^Xi7`TUXEM) zH++^V^hUk#6~DpCjke3;ngPnP%7wWSEA1KswAJp3OD9_niVYcb-{$h7xHuhiIwIS& z-cgLc4K2A?RQw9%%~6Jsqh31BW!Ckb^Y|o_4%H=$vJ(a9$iQw3N8w+y-G#;0q6yp~WiBiuL74=`mrXCuduV-i(CF-yMwozI@8Wmr*v%%xzu*?5rZIp=NI zo>;#8h+j^JdwMa{d!4r$8FoXr?09KP)Fs+1;J89LuHbrWh^a3|`1sXqe+w@Ih$5D2 zuOk*`02j8lJ|txmgpiy!Tx(s;^H0k5idZ-qiMg)F7?|FNzC3t}jObzz$nNgnRKw_Z z4W;eu5b?d2Rb{8dL%_kNpHS-KX6!yaR@4=D5Z_;=}Eg!Ji@ zzNF(Ol6>}Y8pBz+A~>ByB5WW+cJFC%uAZEr^io!&)KtA^2`%UTUdc6y?nGhxy>Cp< z+anQ{vvp7(pRv24g?AIeoiU4g$ZW`$F8EWSYp-Qp8Av$P(jWr@g&7@zS8ndjE=9-1 z)n7LC!^Z5_8PndXv?^;dGk;VcI_%m74(dR(GBgkIZ8L*QyH%X~hZ+lly0CAQgZ_2R zA*Y?d0}5SH%@VZ_OB^|JI@SZIndd!IDlG7!Aq^$BwovNObj_OakfIAc@egH#MsK}v zbuZB=L;EY5+SX+eIe$e5r#F(0m~aPu9lg7s+dQYae%Ed|M;XDLVn11CiT+#{j^tG8 z*HYAZNNpo&nj}Khz>$qqKg;d>S&LjH6@~Nd+;6&Rh1>DhGf0eZYnkV7-5P`Kjbw{? z?5dL+hKY@TH&8|y23-;fGLV-WxC?T7ovZ@=(amChPJPxqO>S3vr^*zH(ngfUcb_a3 zgr>cqod1aSh*|WzAuWClg1VJpvXexoCeEv1z z&%#}UEb^&z4`l9YEGL&S6gR8%BSpAw`rOfMcjGOV&)l5d+F>siiYb$RitK;$owK|z z|0mYV`eVWRJ`AnUb_CtLaLIgjf)Q@ByB0TvTTJns)A?|m%f$bRlbFs_EBkV!)bR&H zE)}R#e^#t$itYttdkU<}2~N%0r!I_%*zQ|WIYoO_c1y)_W0)DHI=q)2A9}~*EYuLv?*xsU!UlTxuRRcUT;x%9tZEx zJP`gwRo(S$k36IMC&^vBa(JEN@PLhcO8fjJEn^+qE{(E8Eq|kwup+~1lDdQ@8% z&Xv*9iJQLyBC>DWS*%$3qCQ#0qJ~pueJUmDu@;u2a@VE`+7#Ydn7{nh{rcml%RbRgWN2PK$|)^IG>v0Yu(ml`A{fiex{}rkZ?6w7^v2L-=`WWrk_cpxJ;pZs`_0;w%SYT+7jf88M~C5-G8H{= zyfOr=4l=BFma2$iYCBzmuWl>m-7AvzBTfHWJG5f;f zg6FJ)V|Kd=W|Y&2#9f?&80N2W4cj^7(G{Je;Snc$j`}HFrx$s{&9h^qZ7`=eWdyd} zIv)Mpcuo25D6#Z<)+SqBIZ`#zNzcb=xY4jWiDoI9)d-yAu?lm)j&@)|}XWJT6Bzw>u5ANw}*3USxO*D*VI`wHPsg64h; zS-i?T+!Ki0;Im{fuW>DujceXjcIXi04HwnmKi7E-q$b&P>bl3+5Cn5Y9bIF~gr8*(uh4XB6oJEjN1NqpV5&nQO*$nh;X;8o6s- z8GV&~qESycIT+*0$fIUV&&$I0sM}x1_vHscp)km5^pUEcYc0}~AzTiJYv&pZ_a!g* zHR5@7U3&3L(R_8~&spAk-)tMXaiyhg)%ZI@oo}(vQnYf%tk9>I336r=@QkE#Ujbdp zk-MB_MXk_jt!ds*8Jafb6%`{pFE4hzy3dpDXdq(r_;y#YKo*UydUfwP&f|vH1);BT zMhB`f_uhM|7iegQRR%%6iHs(0!j`qtj(w?~YmUDwzFc2A;YnaMhndWdW{_wIPD9t{;etaA5cJIky(+*vD>%&xqp(+_GW2Kmj>~hWtfl&Tv<8#g2{^a6 z-I;VYt-E3w(SzTIPwF8a5}0cr9Lsuvgz#{dPd41fKlJEvU(`-64aJLg&T?hKC+UnZ zWIlVATV=BFO|h((}z zrmj9Zsx@z?rM4AxiT?6npkLS2&r*^=J6o6EU;i=cm4<6+%gruhBR-tWGTNQ=#W1JR z7qfy1ml8GY!>B|F>xg23px;t|-ZC8$QCiRj@BD7=u@scp+t_@*eT_f*tVE#y;3Pmz zP3?0IMEg{f;{w9q7_`7DZC!~#!|0cC-F8+po6n9%mZ@-Q>P9PpHQnXlX@RwAis;<{ zrX@9V;$I2DPN~z?&ivfm!zPya{!;D!LWcX?Dlb1AuEd$5Imn&eN8~EhV=wWP6vq-fXk8qq{GTEq?=*NR6?f3~F0}XUA>(5?|Ed~5| zk;Jq;-DylMKLHl{Uqm3yT7Ft&%MZszvl`dJpslf)IvxVb$2lG%Mca3x@qc+&K{?Pt>o-1~*&GgOU)~{y}=$s9J zvh~h+ox+1IX&@`%my`qkycJG^GiJ5Tf!d&5$g zSY%Zayb8Yk=_@uyAP{@T2b*TCCL;sKpcdIb-G%uOa0hJEwDWH?<*m)~eByZYcfy(a*4i>X?X6&!BGB|oM zlx5Zh2W5Wqr%95?fUX{Q+Ba^(VCyEB5*jM??V}a&hdFo1--L+TRNhuF zH87C*sFsQ&aC;pm`6p2sJ2;FbYDCDsvy_5wErD9Dmz>D~Y@` z)sf*sxKPl_loKQ=#2&UvIexgCHAUS{bf2MmLZ2wI%J*PX`@@d3_l^ZT|3^}27W+$I zCl#G!nHtFVW9&M{%wQ382b%OQG*kJtsy3?VFCPahn|uhr^KRl>R~YSj9&2S-qJ8wr zn_Vhl6!Z5y;!(T4_bwM(F5tQ@yT1=q2=aY-C-Gih_VM0vGG+PwA@NEzQm$y&H}<_3 zmd;04jQjASr2LOKeYAkIm1BcQv3vsRCPwD25dPpE+!OR6Zsyr7Qc?=3y%e0(zbdE0 zuB#C$2>QO^t<^%UzeqE8r{osfi*V6PubOK{d}*Op`gTc$*Zt;9;m6Y;jV7&Z zdos^3L-RO%eKdzsvMxS9`+(F*&oHmHEx_b(&z} zrV9IjBV4~B^Tl&xVv)7ZH46wxr+CzUBL3D81^#sPXuPc8P3LSOd#7rbE1QiGxX%q^;?tw?1b+vaK0H7~ z;a%h3Tfm?ANRTQ_9;q4E>MI?=%DQX zo(~T`mE|S_(L8ez!R|SSO4gp!0&I{g>V%9BID^P6XZe+n0UlKJq{mSL?hGS>I-3_L zZQ@A3E)mj_E?_w%Ptcsb(@s2K$d}!emi@lC-gY==5~*VRygxcX{7ys+w=Nq{f+J9G z^iT=AE?k*VDtlsgom*_=+a<~vpxi#+5f}`j)kTxWS;N2?OoRs zXzmfs-f{VGeKR1y2Hn}^v0wsD5lu3fHCehCSAE&G>kj;Y?;LHZe7@^woYpBZ8I6}D zXRru0a!YV=U*Pm_c7qs;pBJ_~3;CT+roYgm1(oB?GGAv|jnWj@FF?Mitko%l6h}$W zh2;iUO(x1YR?V2xc`oAVMLShhHiY3KAu8@q1TC=oXW}D%+O(gX`@Gq(H<({)&G?mo}-o7z? zsB&6s9pdls$6);O)3E#G;#Gcj!ETjQsU`o5forkXD#yJI8Jk79B4M20NT;w^_e#X!nwRhdPh#X2oI^IlXL!FCM&} z;Vx-#=ub4$65o%=m>0cXWe~foxJS32-4Z}^!$q$L{(3*0cMuCK(x1@hpY|h-T=3Ir zH*}J_n$*3KRj&Bd+hs0R;=zIk9Xi&(x-$2MM?Q@ZQOtzWXB@k+^x zm7Hopm$hcG6Jr6@Mt=3ji9=;%n70Y5Le2x^4}J;91j*bvjdzMVs_3zS zE^jdvyFK<7344)(Sh=KtOP=Hc7cPAK(^~f|H6X+`WJOcHw%q6?pU%9R_vqf0OCpFD zt;?%sJjB~0*;m>~(hLaPUyGllXfW+IY!LO~yCwO)hvWM_$$wP8!z_{5xh4(J# zDi3_5>YZ-7WmL!nZyuo!XRnwo>aXz`wmNi5pW2^)SV*{-*z<^3bmX6ijOkXJ|5IJ~ z?Xb8%JL>$pRq=FoU!+=ys+T1y0zqMAElgJea)Fc7W4!8*Xs}XF#Lt}4S+H3EJ{k#)!m+<2HlaQzIYzzMSnwQ*NtORi|+(l)4-B^q4fq=p-#>d z+(x6RZW_MsSZl$}k>kGpq2}&BCnG>oeK4&4-XA-(h!~$C$H_f%M}9Vt@An24Loc$?mL(sNr!-x1doC7P z&2I`UM3ND`WhtQA#cXreKTa{vmAYNra`gx2&&t`kM&BNyC?ZTjyom0ThwLv72R=!! zwPkn2yh1d1{6Lqoxuk29CwgzzTJ!2Y5x)8DbB|ra-9cwlDG*2ZziJ(FfV?{rJ&z+Q z)bPhtehGCj9`TMt+_b(}pv0XITCHWu!pXt|z@W{PtvJ$1M_8+R4@_|owX^msdn+PM znu6X!VUjS<6{R>sn2rlAcUdGlsL1ZK65iD@%Lp=h5PgX}VWgx16P#rp^F%i7)O~vV zIsb$B!Cqy`LMIt}{!e+Zi zcJe@;rxV`fWbPjCu>s#F6s)g&`av{U_%tB3&?LJ|&s1@3q=j^)+Di+ACzGcg2i;tH z$Xp)}ZGrqG4=;gPCnUjU*M6Q;X)VG`yQq7fpxIVeOl=LIQn4!O0WC@BR!9ks-R2yY z9J52f4VB{O;#EirlTb2@#l0X;LHncg%-YAw5GQC*q8RbAvdm0FS@}NTzL(aMBQSg8 zYW>vmc7*DFm5dw2b`y?MB_t;pky86{zJkVBkLjx}rN<4zc?Ghq8?O&EvwhUG+K!$5 zp2U5Gt>*iD-~#omR@!-I-H!zcM%_71Y_g)(D~d1<<9;giUC;y8JPw%2c^3D+{vNu` zq)BIPhS^3M;+#GoI?`6U&W$xa4II}3nYtK2Z()-vJ$n~5O&KAh$bR;LFS|G0&WFqeUg=1j|*!srqHm=rw#5QS-DKW%WBzep8QsNVTM(~;O&%$nzF z^WN7R>KgRl*R%6=IqjTwR&!4-#F?S=_+x^zQjeAfG7#0@lA)Qo53Td^Go2b1eNHwB zgBsel|2WgvCcO_p)!R-COD+*q7oyC1vYh_7N-V{G9=IUK1sY|2jbBWs&|>8sMNBk6 zyD0m~+RovlrduwBe!R)X@l>O$(MK{5aqT=ArS(^VDbPpkA{wpl`r-dqBL_K?W$itVnXj{JM1jS zsTPT#U$u>E0ta{BjXmj{Fo4b==2|VY?2e8W$lA(JYjNa@*El&|FM-zJD<<$z-}rub>4 zZ43Jg$p|!;&Wc{Io-e$~T#ukmIVkMpd9^ZU>Efm_o`keIuHFxz%~Y+`3s7ORgqWrl zYH!f2tJ~t#pFJ1DJ#Ni&VZWKE^Q?BTte-nYhEa^`yNhc6NKs{XFA3Z4I~3iz@v4%x z<~1cFBs)}Nsqan2NfEVL9zvUjF|U>P9rb`CSG65+5XW`x4`{_Wgoc_BM!QebXoEL^ zYOt7s17kg~vj+ z%WX#OLRUA@wq@MG)#}V#HMoGPb%W}smNEy1^$@BXd{FdK_AagTqHv5=is(Bwam&d5 zsp{hal=~if>1L!VYgL(4d zTG`AJiK^cDnhuLFO}05grs?-nMN`O_5bKkIxoBC19eXlS5i<4o%Xjfq9h}hYl2szsI~140eC%y4`Na zSlO~(66rzmGYWRt3aZE+r}_`4PE$s$82@tYK2 z8j8J`Pta7g8~$20ckjlkBC`Jo%pNyn;Mb(okV}5PGh%|-On!S`fWssEVPceH?IYAN z(H{AcjVFB)o9ZU_A90zbr?rLA)Cxfpev{K_Xj321swc??U#;3el{=?NomEDS-u3-y z(yxDaDDjhPlG>GI@Hf1y-#8ZNSMQvQy8xHuxn6PD2jG-vE zTcSfrs{IAR!-A%wM#vW?ZOqf-5tg!M!CUm9$Oyz!s&I`0nz9hAamYkot$+U#Z8TL@pKff^{ znTc6H<@igO|GLWkVW~j3zCFWT#nEBn+v6;Kc>4Jy{JH$;b)^;|em>e7`Ftj!%ch@C zMX^FA+SK`jSjm*L*@PdWW%OdPk7H)Vb({1+40VlPe(4OR8(vt>&E6H6Nt|3ZLif#S zwN4pwG{~!@8>*pM1H-beDB=|B(J651P0TOdQj~bzPX|pH{&aMm6v?N+olYPfr7p6$ zQi6>221jJTNy8t4<@U0{F!rM7dbvuCc{@cI>KiKWco%`#fA@;Rm2rh%E7VG0&lq;z zakYeYmAjqgGnhxrLrc|!)6?C4UgyqZ$N%GaD*ti3-kJKH@2HqdDx)VyJ1xte zkrEDdgp^iQ8r>wL^fRVe*^e(`ulcqnII97@t*b8M@y&crW}wHauK;AYGhMCpvm6ET z;)45l?7JMwHeQ)xc8(Tv@7ah?EV=p*m&=(&?iA=0?L=OQ$`A{kM1~xaJu72hh<$$~ zMPJ}M&HGiU%sKlPiSugv<6pL=l3ZX#kHpBKl4Z0>#qkc>!q200yl8{S6rz&L=6h#! z{TKG)PE^NF#9u9bte=;fVOjkkCwj+NK+I# zp^DVSHp*BfA-;OMm&!htI6FSv7jy7!ueh3M0pjpTCE-^Zx!?NlOcxY3 zd_?Q#SfyF~)SHSPrXWq4X9syS{?KMmLhhr=K`@%N#U0Z~?vIgs1Mu#!IgfFjJ7%hq{+iQtmGapwu+wm{PNqFW zDu6jFKp>7mFJ9>0kf|(x9-AW53b^Zg5pJX?D# zW*K#lr6RSS!{{YQy(A6FoZIFEx%X3x4|d_Is;4_eviWEH*Pkl-(L1O6UpiurR_54b z3RoCY1eOo;Wp_oIj=C~Ur9@Ut9byxtu;B7A@PAM0Nbc}KGXM1E>Dg!OfFbU>9C@VV#_4uChU$1TE@a-7Ag93}-o2yY9c zEeYEO08>Q&hw!Gf;J2$;a#)UJfe;nB#_;m0Qdl2DGj(s1vDa zKS-Wr#^>4GkUnYrZp(XVWsg4`v4Wo$Qsapr;Ax#vn<(=r41Q4??fo zus_uSmd%Q35+hy9>)i3VH%Y`YNZEsPFf+N#xZa~TRnqWi@PQ!}Ep1#(45~k^nt|`e z=;-KX9BUx`b6Fii=;{E_hjrsIsu_so>gVHTPKOSG1z1F##A2jCQ_%g7o9=_(M?=fT z?MxexeVGlxLYta@INxiYG|=#;brA>tVMVXsL?%C1S;Nb*?kXu+Q|$v0em|v5tG`^h zj+=0Q)dDM(=I4NTn}a+^*Q~01enpONJyEpjex2CVr_6@Uxt_{IOK-+|UnnHWLbKL$ zsMkF0vx*D~fPkxKL_}8_m9a+AUk=(=3x+$g|6+%MG{i3#W2gazFs}4U?3X{hw0WzX z5HVrhvSm`I@E=))WC6F{x!v9+h>6HT*YoM?>X8L+o=!i{cK)~(w+EP8_hv(T%)>mp zUhzY#`nd~EY!?jdx^|)$z6+!+>*$a0-as)bd8xWa%8)GipHSb~{nz*BKrF*NQ$HfO z_UM?UEc!~*BE(%zl1^a9t9Yb!=6{|+J8rKC+QrrG{^{v)n=-?2=>>btH|3xdmM=33 zl{%9FOGfinK#ZA(pB*2rBJV(NAfFVxn)jw;e_~=iS^R)T`_<|J=3uq{; zOG4*c7<0`bNj&!&LZ9;HX+ElQ}JUk~Akr-Fg*)6Q#bH zQO!OyNuo5Bzh0Aw8TM{Pw>4d26lJO6zH1!zs(DaXywbECN%`7j&fGxFSd@1l;6S)A{&o|f|`B*iht;c^Fh=L#rBV_gr+Jlgl2Y! z5Lfigl%kP41e)5iKRV95Fd$h={@kl>qIl+A%}?bO-(+5$@?3YLW~RY3q7Kwy13^;x zZO^}MH#!SMLYDI*;Fm*~I`_x>J% z1%7L;8fN%!{s+yuJ#8PGdO#R1A$=B?^9I64utQh$PxZ1vy zm8*ZX$d_b)_#*Sb#g5wmLj2Fq8QWL?{jFN$^AlZ!Mt4}^|1i~K|D^Pyp;0?M@|r)p zoj0aDEfg%1b+uDr@cj{Ru^|9dt2gF|l~}iTyJcRfv@LP(O0KN3_6HB4) zj3soDgXn*HbTlfP0P=w%{tOa2~d_sM~-Zj(PkFON4v5iE07jy3-; z|L@FKu)kikBA+dj{-6K)=lNxxf$yg~_wRcF{(np}KN}H2{w~bhu@KRF?+X6{3e5g* z{^5W0+5TC(bN?T2Gz$bFpItR2sd00}$Yoh_~S|*BlH}nyH>0CHi z{(nCHZ?xn#(Rb^g9#wD5>Tli0sR~Bg>xvo8Qx`Wb{z))}F(^@QzW`pM|LNr^<|55}Ba2w)4c zcfO;h0iJm%>mQbVC--jEd4scCrvCY%%TQ36oC!_L&C!w<7T%{Dj)xD7)M}!yD_DymHljotY{{_iNjm z4wByJ)we7jYk4(yhO{gyvd5axJ8*5>Mj2G>o*u;j5Wg*Vf>L>~lB3AfKr4s+HkjkPIMV(ZbW%h1Om!1o6_s+eC%tim9+kbot z*z6sQMh(S%AEq_InNDZqfj_KU`cVsF5}%jH5yp><=EOR8v@j_;&ewe7&+{`0jqdn5 z5?+S?d0U4W>vn&!*9VmHo1y+q^e4A#*S{>~Y0~^_4@Z^sO;qlCezi7|GcM=e1p?6k zkV(9}3z>^Ie2`z^?r*!@F>^+TZgmVur!lOu!=MouGT1W=o{fl=DDwJP*5>tySh<$!ts26;*ykCA$_g*Vl z-J1R2))*C@MxQ(&CeTj!Ww}S(bC$6daR5&I4b7?dPTsSgT?qK^DO&e5nqTLZD!mo1Op&P?{13z(Rp5YmEkXR%A*L>kQ zAY;4lPfb9Q#f#&V)?bvwYmPaqEQmhL8no*@`z8MY9^ShPPUdH((=&*YhvS8QOwLA6 zXaEQFAA|gS9oTVW(_ROmZyw)lI<-mY!MUV)1hr!GT`=S!+$nlKoZ@Q9hN8kfS+8HT zKhHKz(Y9KTmLunve&|_fILLG$`N)#Ts&s`n%)dxqe?Yj-Uq7j@kxX&SJpM7wTTKsF zPR;~>05f_6cwBQHWY7GTG1cv7w8MRAn`*mJF8;lDZa>P@jg9^08xJDhV6~kkl8$~y zb)M0%)~$MH*C`kwdoJ@*?=KP5MQ`%wVb%YkRcY_eiJZMc1;v>o8od4uqnO4^hdA!~ zIW-gd2j^?90@o#srXBpVD_U9+>$er&8P@i=b-n8jZJQ~bV=aANy7m4h#IlK2yk9F$ zwQI}Qo`H2P$J+HJ5xtDkgc|LDSH;@ z8hl+fDOs*+T9ZEx;w#ulPMF}V)NcZVzdb+u0WVB{XlV^XNN|H?@3A1g3mKU2oI^B=B$X2C{#zS!2- z^WS4r)tp(ux)I9c1%KlVP+s80ZKav&$b;)JOm~M)Hxi~w9PbZ7-`s)7bQ6IW5tDxY zem9C;)hA;c5Rs|dx1ue{w6(Q8Jun)2Vmge!o{U)Ms3Z&#^4T@x+U#=HaLqnA>|oAX z8etgJI=u~_g2-rVE)L&K4qsgcnx25J*#N*^lvuRzt3#L3T-vFtfGycm=8vmuXFi$j zig9iJ;&xYk)bG!a6TlVS1O=$C)%SDjRyZb@QBpOusj_Tm=`@o1Z@`gR&jvxU-IQ_5 zq$1aMaFeN2^+d{R^DYLB4-i>y!5S}4G5kFUzTPx$kZw4qA3b4I-WQbgilH=)!!7kg zc>`BF$CHq$qgUW47^;2Q==e*_WQw2t>#{OL0*3#DGmj?EbDKP8z!8VgJgZ%Md>L%h zJ0L%&ZNyd)k46e~bCaAE_Z8DygkNt0z+KrOCmH3*sA{Tz9jwt(0V$e4e%892^WCal zJYJ9GH{A@%`4QyK%=cDP#I@z(=wgHSZXLk$AP`8(aiN>N=xAa4C2XeeIB1AEfl;A( z`=`P1ZnE%8DcVfLTW2uNA$LfMq8ql$hc zQyg?dwD>-R+fl>cUAruqsj?s`X2p1{cB^A)B2ZYOVJ!H9O}-IAW%7M<9|p7qhK0JR zl)pefRL{EfXnR|Ie`~S(o+|Ut{K0yhsKsTKgi_C~RDcCX59b~Xve@#7(k*Me?$WZu z(!^L2@VJASSr)8sy>hmGZ=scPg9#14!QK|*lxo6GCvm*h#GQXxvWbBUQkr5eS?{(72x=9Ai#cVq) zCF(o`nGdL3k9OqkT=%cl2>)#~SL^wB^1O5Py=aO)jF+4{$c4c@9A(0tw&xA5f^E-9 zp2v2ZW}C+*DCcxwf4vBB(`HkN|Fg^tovLxos?MSb;&=n5_o2(4aX0F&YHLgE246)1 zKc0g3mzuW&lCr^KXkqC=EU#f#SM1#O@U-uK!~7#Q;U&=OPCad9cB;Wc7+;^LI&t&d zX5i=p6WkDTpaZBCcrXv^9}=Qqd?ePl+4Y1OKoW#`cG`G?LM#(Im+8(6#P6#cNh2`XOIc z_H@k5PM9kg023Rd*Z~Osbsk6hmX>fg^$S}Vgn>JaAHp3_6*aCXs-8Bb!FIB^Q;H|6 z+vQ-$?{+ehz0Tt#b^0~qLG_=@y$aQc8Kvk6qV% zeAa;nZGPN-?D`yNdiVP+oR`ydo%8oic2YF?bZ!6HF5pJR_9c2ESi4iJ8CkB~%DW`I z4Wg!zvO#SjKe^u`@#rtmlyZ!-Q%L!t=m`!HDr&!UgOo#Xno!Wm)+0^b)$2~$&YNm%6S1?ZeQELXA@uH z1{fGmq-?*ZoNHdrt>&iOH_7&C>xx-{U;(K7&C$yB&~#nO zv;_Zo)%{V50XvW(#oP*z*~M!GAfCk>B%Hqx-FXH8GvOZpa|*E1^f{jty2@KrQy+;R zMh==%-(G&*KeloG2k$Mg4An+m40^ydL#VP2|w(K&5)fzaSMLxCX;S=U@lX~$gt zn*b>Txe5bT`gbM>zzBAXwd`WMDH1rAH+}oF@8)JHjNtD)f3&;rlR|Qem>5x+1R=ry zG)twQ;tktkKM}`HQT5CYz#W0jb7KQa0De%w4;F9!#lcU|K-C<`0IW3Xdv8)!lv{Wd zyUIi{7+RfmVx0><%7#!#?sT-`H3Cgp1p&DwVI)`XqV^NGp^y?gQ3a(@>7~2QJKZyMMLg`k2LPgqd**^-qxtBn9G@TqVs< zJTOzEjVH!VM2RsfgJ8#5M8j3|8G&{HVdmG_rW-h3toxi*=z!YC45p=t6o%E&Tn`ut zTpm$Hs-HX+K1zkYcJ#9Kh%(~XJ^ zm}`WYS6}8HZ#eLonGYy z05deh`y}5w{H5i{X+>58g9_fB>|=&k4>L29oY6HN7=!6`Yt#^&{`dOubg|rBpyXf& zZp5wf1}!MxC>7xa&oGrVDM^5`%uRix;ir+b=)jRC-H2l+J*YA-)ZZNiA`RwlOB+;? z();yMl@xJmm3gmC{JjJFVhSl7ebT#Y6S07Fy?yey#XoF#^{0Li(8cv1`VmM$nW#VmPj`bJN>7-98H40y18+d zSq~_l)#hk$SL@MU-CHMm23$BoCS3t!W0#|&L7~G2s?MStFfOcD8(+Y;Hl_U$4P>10S|`jqM7IchcSV zuPqP!zgT{nxjae?>g%lqZQHYMnp2F#1 z{=$tcAVS~!!3Ie*GEt3|1gOQMzs^dWJsCEuA9=9VDHu?COj3WL!X4Vkn$DC!4^VZ+Zlu+M>_E za7UO8G&QVuYilnqoi74bhm2qJ!_D>{1rj{M2C5=_1)0oj5Pl>p{kV=oi8lysKY{qIYMSE8_!jq@6#>D|OJ?yqYCNXzTM1~Zv_j>9-`t4_xJbZn-IXAjnV0k~vY+S4 z=g5Rk^72kiAZ0S*!0BDYhy9)U19q>E?6z#Z;>SCH<@Fg=IaP(I(;D}|*ax!-a#}m$ zD&YhLk?+DEzV>9vZg?%7G$2r~?)v7WIC;ok_YC_4Gw6!N!UH+r`vEU(9w0^v^Vd4} zF>tQeN3vhuJ1=^gTk18?>~|s4zT4-Dnwnu-NEvS|P%ArYI`rUPbc{zH*Xr{%aI4Jq z^qeR+I08k5F$G?gNrebuP!Qp*QNJmRP5ca%V-6{e%F(q_i+6qg?uR`O9h-xqn` z>obTx+Ufgc_g63ITHge|L@xBg^zBaKWaXOC2ii&{P5b_McR3VE09g;TLhjaw)vzu! zw_IDQV1)Op(G73d+Mm!Q^yr9j*ODiqwT{Vfj8374(IH|R5(T-HID8z1`(Z$j2B&is zUK_>FGamA9#3F9sjAl9N>~tsj(KulsEH(aGwyQ4jb%BNnk5b&VIrccJI1#E=$&+&& zz5}Hs?|T?HpV_Y0g4}J#T-}?D@yT zSbN~CxXxPjdRe1JT4=Tru`O!lbwL52kBa-ZDl?-Ckq;TWiZA9X<0?A^9UpK5+?Dty zcL;2oY3D9#^WK0s^6UA!xd&{7su7f}=S$j@BoidY{az*(4=YcBuTL7$sS3Es;uQeh zYVNkQxF1D>C45#zgz%aPClF}w%z;9MZL;S*tPiQ)V!ud4ThhdeHB}4~iM@-$MA`lb zLnF6K{G~&xga-=#OLP-8sCVR(a$Ssg&h`7oC`ufR&Ikq-(OVkz2uWD4)r^eUNSE?k z=Xwwl6u0IfRj93~w(JMLE?dE!x{lXszC^?9;|Qs0PPeyjA1MO+Weiz}EgKosys^=lj^j+U&WzR||15}HfT+`Tk_cP99xh;XZRln>Y<7-t?I z=;XY7`!95%`oNWsol?hs?@+rJc!!Y<;J#Q@GF~rzi@d-)Zcvqw0WurB>h!``E~|>R z4TSf$Uwii09e07Y6S2tYRE+s-+=GM%{7ZJx5)2seC=@ebhHZhtyNB>@=Qpc8#+tjq z_dG8%9?8$Au!vV+!{>C^-aJ0wL_Aa4xw5@>y+{VOv|5;`Qm&8G>r!@HjWY8&|B-@7 z%qg*@JRi^1p_~boiCT<4L-(hHn_pjA#F-2}#tj?rE7 zfWP}1uMlKH@)=lIBAd3SY%G^kSpwU#wD{8KEFm^Wo^yQg5zf&58Y?B@hzawvT#gyz zeIHbrsakeh4y76whVrvH-5t7@;@2X>vuq>on8U~^#W^RM=hY)k>Ykd0nW>T4B@zi(0%ow1Q}f(` zo+M-J?TkEt4)w6k0OPd?!OwXBie#>7>+DcYpKAw*ju*y(+D5n(+j=Cqh9Q?CBlpft zRHN40wPB7V2ChSIoM~&Lw$F&jpa`-^9q~RFw}<=M=0rI>`bariIIhMJ`n_HAWpiSRaCe)@dgNnaK;lECkVPi$|(LWTxz@prXuO-VU=j zfz|Ch@pr^o?pW=IQEb|o_%c;wY;k?s$ z(haWrjaQ&bET5NND`h?_S2F+}{9jEN~n z&U@y|Tc`=`Z55A2+XCo1DBR@<|Mux&LL0)BVsO%!@jEOw;Q0`d(Y+qa3vq+68X`Ur z`N2a7)GH04>N29q{Vc`7GW!?-B-8=BEuU(wo;hev!!~QG(ZvC%4#}g5fCyJp>$hHN zg11W&sLu^d5+a1t(W-$`(p07S3`aSw-Es9CQ8h?_yc;1efXxG|94Z9_w`X-0UIj|I z>5)!jWq>tiFNYN5HN%-W;`R1M44ZcQ4jO$Zl#tH>yjazP zd{xHytEXzk7{{anS>=cdGIfqIw3!WpCmxg%{Q0_1fuZy{o8R|#l2hy&HdK*mUGf-Kq!NnpDmR)=3OtVZj@)*H zt{AqCe&2nU{omZa9ZWKrquPBZu2f9&TK_Wa<_dP)A!j0SzO5fEbXDe%k7cm8EI0Ky z=_vT#C)EF>&;h8;&3kaFzC%#A)YC|)Id{-FKXo0lGRm1i^(#{7$b6XgV&q~3>P*Yg zwYe99SBLa(WAH&qM6nRw=Q$5GLZFyql zyESAxRwIBt2>Lkz{pj01K(KpDuQ-?0qE#D)rWzt^yaMbWev&+*ckp9pTy#q ztzp+&OJ)wi+_-~xFF;${LeSMmd~DC9VJ3)VK~hEH?3>t#WF7cZ^8brJEygX~3TAyg zO~3r<#3&!ls8B9il@3}loU@ov^#;bjTtvb+>=GSk#_Qoq=s<7bFnXp7kj{7e`lckZEPS74+XHBVu(mCB`Gn9qU z89UNNC?sh{syh8=Kr!K4%2l|=>%d!fCEIPz(m@oQ_A#u-y_M=_lR&=pBaS1UUEif= z(@bHzps%_ZLQ!4bH=EbtoOwUY z(9qyo#_@>7x1Cu*mTZ>XMSs2YhS6f-Ca#)1?V8kMBx71Ns5DG`S zxWGH42kS!@z95zAMol$cy%B1x0gbqu8tc(xWmaa+f<+?_;BaPGliY%M>Hbr*SL}%E zlXv3LfM@v6@&oz(v$*yW%JGryrKE>Py!(`h<=u&ss2}M~_w{L`D*V_XcN1rxB`ie_ zWf&GzyIs3VtUYT|kz|HADYZFi==5ba`9HOIEVLqZwlLhih9l96nwlh}{wfUpOV{tj zlz&>gU&{mFWst-|W#(y=F30Xbkr{ajZ#x&rT#uClLuh}D;PE5%*l z!pj&f$*<%0J^=f0!1$rFhD@`h$~Own_ue+{schB7hHx@ccyYu1IFJhb-_7-`Br>_i zd9l~S$!Y`IR71UcHs@=$#|fbga-Bgf^D@-h$%;*U!wEs;ZwGCWJ+l?M`PT{EGWK4w zLu8EYqp^9Os;cqkWSr0#P$f-=UE|p&!yG913;CNF2XsI`_tuqs_nhu&dR1>~mZhM| zOIlpu^7{!aui)v+ca(7C>{!5{zR7ME%By)cr0ED@~q)b8i+iXiHUl=ZDH%7cg|x44Hn-Eci`jBdXyO?3=v*>Dxz zS+NZIFSLPklLc8+v^i^%agD0a-4@E6Wob;#G(p?5|Jq*KnCon0LBz^j|!D!bX64$skW zZx^R8bp}cGZwD)LZYS!r6{%W#zfX}C1%4)$efPi4%1W7nsRJWkF@dG*r1snrCXumm zxW-Etel;}lx#a4GxNugiMH2_e$>OTM=(Y$_2;NBxWtrLc*B9*5;9^jszvRuE(8{5z zinFoc>%1IHw<6s``dVh-8q!tol0*5AYIvnwrOq4m#j;|j1u>mU8Cj+>%@E`nwNhBR zOGexlM~#Tz`xEqyDGOOs0|_VK7b|t4Rs)C%{^-@m8)I3YB~`)`l>owRG?#`576*E&iT8s~*p91&mF>=EBLtLVE?+lWM(tv{3^wi$x`1brqN`d@?heli=s z2X=V6{vXY8%vc*C(9)$VU-v!IR@xsRu8At%KH<35DPk1q4Mf31W4uJw*N_5R+qKpM z{o@zF*Il8^ISxpoS=m2bGZpTEH8rY_4 zs=C=K#~Qr3nDD=uLrDNCKNki~t1RiZKNEzOzt-03K5q;mLo8x_yl0{z9c^RK#_)5~n=^KaYl zEw&XpI^|X_X+Qc5h|F?czx0%gzMD>Y4!2+AoXy{|vJ6)s3w-uFfVN=^JMg@1$|7U~ zU^pPJXAbI`G**#TJRuo%b>~ekJA`NJ1+&NA=}7huAE{`=J)KQ{89{08$O2~75Nrp~v(>oR1^CCAtzibDr8TnVuZ{1C5dZ5YZ_hdirbSS!|2{gP&G;_&|y#i8!u+(e}qP*SwRMUhE~dKCH6Ts<==FxElaKIBF z46oDq+VxR1Y1&+-Ml}FcKuzTe;7F)8xz^&u-=8;SA_gpiJWPs!>Y3kvBNUN{01#EZ z(>LOljDzh*0PQybXp7*ncKyNZLG1sW-nC|ZXi6r49}_O$0FpmH$Qh5fXNCY`0~UtI zdGRZbJXlT~q`y%i6ZmML;_D}u?P&|$h;g{u$2ot=U>?n`1o`dtkoQ_92jl{rIgMq$ zHXHQBXR*0EtVN86D`@_t6;=2f+_TPQs-F{Z+6Okq7@z}@)&EEEIK065Kk)cX@m$&$ zNPI8XTrZvX$L1=gknHIelP($Lw@QzE88|8o?D`dQ{5K#dn5P4 z!!8A0n_@mw$DC+W@V20hhPPf9q?Tacwiq^~2mNL#s7!&L3rHE4so$05gnXt6D;$WL z2U4x@vQX3wH8?mPrRBT2`T20GXe36HD6LqBBwAG=-VRZH|2B2yF(8psHEh2#YetXs zkHOqV#6>^I<;W8ymiZY>qS-n1S9+7+cA-T=?WWYh?Qk;QRT;c_v5 z1w_v`%lq1Ju!4w~MT2z0EH+#>D)Qt!0LI7x8^ah}`+j|N`ist~KAqv@rR<==R z31*#i4#Ym1F83b@^=D(qbHHC4aiu3A2Y{3;D#mx!dVqu#5Up2PNs?DHO`zxkG?&pl zENG!=-qO!U;dJ=RvgA)8E&jY95BKS=)D6%@1gh~m5?Xj2_zZgeHhp=&V8^Q7-e7y= zP4(@_>$XbbbMFB8czHrl9r8+48{|8Ixhi_*n|bs`p+VZ>+eXS63R^128gj0sxbqH2 zIAqIYRXJHY$WfT;{Id}>fOsif-<(~hoI))sHNT&PLlGiVll20?iUqm=WD45YT}~pm znvz#kAfpJ#zXAfTc5Pt8aDWQ^t=2y+;zdBJ1SDMqw#BAE-(3WjxU?SBcu4PKS&3j= zp3CHVm(4lo+?2z0LlfoVmeqoMXtaLVqmBMjK(g&DII$lSrzv^4#9O+xfh z&j7}y#5ilu^|{ezrTc7ci#IPf_nSm1NRTC+6gBftp&GR8gR;be<@kqD8vx>&1uF1G zhDJGt0QKqRd={X~%g+I5NmHm}X+U{UVqrh~@Fp_mWH>@-AF|aPn*miA|C6 zoatGE&nN|0)VKP@YN285l17$6oypld*zCKAk=nYF$~FF=2Lz89C_n}2_F$mgUD@ak zl(o+RvFH!zdhPT92Pjg`-M70AhBxd0DPrEE#fbHYNmK)Yvr8~*4{Ib%MqTXy1_09K zoUL%|QLm_lRGvDYzy+UPg>drlU5pL$1_0-Oqf)i#>rW)I6+B5|osi;SDED@f08fnSZ?1M5X<7MHA;Z81piP^*{6as+cnwh-Wa!P zCt%PT;qQ%;S|ec7?pW!S7%_i;)wHv@TtJ zlG-MrNS0#Z-sNeL^~1$c*xx}bOQ3&c2o&=O?l;>F0#H6z>MvaRHOt8N^{eS%_lmJO z%lVGzQs6Mwl4jd+QasFQeLo7Rv;uiW!~1b8@MZITOgvjB+d&>H>wfOhV_Lcmw(oSv!p%BaY=qopcdT}8T+b&C0*Hj>Ys%flxpKNwF~(H8BsqdS!X-#n~E+)WU(fY@9ECQE(UZ1fNRx_HN{ct_r$|@!>JN? zxigUOhi_8Dx4>Xk`m)v|73Afa41;4|Uf_gVyw&E^2Uk7#`A;s#b1Q3Utf}qLX%R3U zuQrcVPM|&X`hW4nHAaVRH8+Q$0D?z*C7Re(xx=c!DF#BR9zGlk)IHl@Vpa2)0Un+y zKvbf?{=@-o6zWL{+)U}%JyFsIi z$M6%v9pz1>+?(jO(E(y^WBKMae(fPaD$OP}11D}EodOq~2aptJ-5S3RAaij1jHcuK zUm#Fbo`0!mtmK2Ce4Z^h&j#0)6VAD>YYHAMN#iN*UGd81(Sj=8{QQ0Q-!Bq_0HMVG z;wo)2ePL7j4Apy&$1tmRT(UH|jaA@_j?k{~l} z&(%ReX?KTiMLi=E-}M}{gbhE@opmh-*0RL2`+f041kc50`5)B{hMZSvM!$LWmILvC zS_jNyEej|C!)Y4hlqvjpHV>O_W?e*oLLI;=f)jfU#3W9Dz$SG1>&pos$f z65-(2F!yz%zy*NHBW^0y2(!>LUKZQ{v5B+#x$99)-@7JM-{JzP>Ta{dcNoCU?cL}X zx#*`Dlk|Y@ET5W?|EgPDMvEawJeNH>D(YzcNDJJ%2LA!YSnS@W8NJ*L1&4a|4Id|= zHBeIkvUL@Hl5H!LiZzX*yMXei^vvZ#M_ys88>prO#FN~U2V8sYR)6tXXa;^0A{|x* zO73v7v>dEcL#!fRrc6@3{?gRZ{Tk4`hEEzqcp~YuoB+#IPCV;!kr))QU2)(rYO_>0 z046z5TNY_X$Ohy9&XSQ&6qdl)kkJVq5a;?k*WJj$V$;bZuKfWYFHZVGGKoRRTR{&? zZL5GMHTl<8uu3lcSbOvMdDW#FIC}=NwvbvWzJVK^Xi;Vz;75U_$=g^54RqmN;|@H- ze2XT1TK=?w1OLfK68N5jqe)E2YEbx3Zo9R0IR8&<4eG++Q+of#>MY%BcR@6B7gv?F(Vp*J+|x5W!(=$4d&7lN0uyky^IuM0=}ZaFUPJ^JND4`XpC{2XCQkd?_A>I4rR%- z%g%3F_+Nt=6BifX3a!Y9hmWu$Bkmcwn7d&>SWtrkXGWpD>3UM}fD+vi)XiyWRxZx` z;Iw*jzS_7&v{Gh=O1$3nqRG`mgPFY9)=4d?91X9l$wqBr!P16%4U@zB zV3stzFb3$Vz}lLKpOuW9o91zua)awL{|eN;o~*@CdcHpB^FsvP%s@ZCJi>5$`DgIA zcVc?>5`x5Bg%5i(25qFw`1T0znshrJ)x2JPtMRv`&`1XO0t?bbJIMw%+WAPxX*EM- zXBdM?HjADTF7HpBy+?hc_fujr6aye4T(2O9mvpjiKYtFRf8flAuk%-~_=jO-)93;pyXWf4o^(>SMViaLv$n+>--?sU+Rw!48me^~lyQ+*#C2_GqVYM+9CA0wJ_Z?*oNG`U%)*-+?yX}dgX+O=!pQo>H7tEfrEtGKVF z(VSOZl;`b0L_kZ$`bt*u3GcX0T)ajR+Nk0RsdD?_s#jpNBzK$gv;E=7$?zV5&2puc zHy^L+rpg=}2YC&J^u1Zs<*cwt9jB5vDj>VZC}JIMsS*f9p~$s+au-wn4^+)6A;SaB z_QzQbuUb>z$h5USiSq~M{pXR3JrKSrp)_*{a?{Xo$*eopk=SBAF}|UvXkoaVN{XrE z?3t~~?iFJr4P!W}jtVPV&ln}bF6kHe$kxqcxJLhmgx!2niNnHPY7rc1x4y@K)l{=6oEw_~r77N6Do{IpP(BW5??? zj&Ve)v&Yxg--Hey@G+6_eR8MzH~DCEeJ1@EUj#rpd=Olzl()=EPf3Sw)Db#R56T=> zNagiu^+X!XYgyVvRQS|*FOm#he}_+^{AUc*vZK!>f+LNzOV-66^370d>Jw|V<> z4XE1{cSr_4S~qan@yMZn7~F~x2lvc>ZL5MpcGSjh{_=~%#}sMF@>h_`k%@Wk;qp+d z`Y(xGYI(Ykt=WH;)3iFNQt{QBRlC(XpO@K0Zm)G^3&GYSH__KTI}<8b#Qi1_{(W;p zr_9ZeE?QN%w@za!n!e8_2s1Vz&h&LuX%L>=IiZl)wQbq*^ce zIxz_AF~^{vSfX2%E+V2ai+X*GLce0jYG^mGG>ubC0(1-?Vv}t(`nUN zmBa8X-IYUyN~0+ug&WW4Es3^wN;NeGPKh;JNaTbE(~yZClYfwAjGAnMkz1ZezyH09 z@{~@i2pM4y9M<|oAbEN6SxU3+iBPD;+0 zuecqlQ@iPyK!f)21AiV<*BSR#znUj0L{-%R6QaB2=DnjUmPF(Nr1rjt)s4+_8%uee zSe2w}+U~O@<0kV*Whb$@i_JdfwyzkF|D9&b1Q8WVX3WKx`*;4ejP#8(ap= z!B78K8UqseOY@L_Ee|;3#baD@69dCpkhBYa&JIc=`0+>X0m71NwFlJG6Tz%TNV=my zox=bEF>2}iV7))a!|xYywf#Q4gggWo1k(pw)f!uawW?!dJ{Ra0 z=OB+XT|Dd_vj{%$DQU`>!9s>D_R8-I$wy=UzP$6(zwge7G)ckcxL+f6DJmvbDTAivOw{@xpsI@Zd_m?dak(zv`M8>sii)YJ zc*<;}bjL3~L|5~HQl7!8%tnj0}o*t-r z(tDze9sPCbr46*nt=eMB=TbS8hs6QZPJR7Ko9Tl%>*BD`hQ`dyJjrys{OMKTA{aKM zn^}0&?+hlAXlKWx#ND!;yj?^Ew2q9W&v0qF8uef5Vq^^26c_(FY_6^;COVnr3Be$r zs?lyi7Pw!cS&crSSmeJoR6hm=i-Lke`Z)Do;Lq23<4tDx`g}#Ot}aOah6vuM&e52r zgGZyP;7=T1MuyDi6gEaiYhaRn&QCYTO9|z|kl9OLbbHUdAtQ4c$_{$#I#HI@9!%K9 zVTEwfw-~`T0di3l*-Wnp$9bqA=|D0;}6^R&4JVD-BLIrROL`ihe)&6cm5} zbU8f(lkI4l07%w6T)1*M*;fo>s6dSN-ixJR{z=sk6Lh=tCZGMWys}XNN~C+@K$5kP z+<^}4Qo{pp#SQQ}fXGILcSrR{oz@S{n?W*OUd=WUTchsSfok)p4qP^eZGwF&^|E^j zQf--8SdV>x(_!WPii=0wp61Q{u5!4y2(j#QQoh0VlsGpJ^ZZElQPqX8_z8#ja2k>0A z+`_PrQos4YmyNc^<`eM*hRjtME5J8}>-908Kv)?dJFf0@%Wf+u2IDb)oXM#&83VP3 z4YZ3(o$^QvOIcbBUyDFP;hxM)b>Iecg+2cI5*6=VR1ykAd7{cKu&=;x0OiJ~F5WCZ zG(L2%GUYXc@kXS^rqfFBJC@SZGkl=`d3UM$J#rK8oq`Z`C1H3V^z>;Z+27!($k#rB z)4+ar@q>chW3qKTeqEm*>S&j_S$cBx**;}!?Mey?LV~V)`B#wR`FRvp^Xbso(Ej=u z2Vgy)uqKishf6Fp^#ssDhj9S~z_AW3?@JW*a4U$Riw5@-Bw$ znV*oW;^UlLe>y4FX!P&P%gcMa4w5Y4yVxRBd23+|pJ#r7`o4E)W;<+CP-0!_53aqP zozbY0Yr3lbAS`QHi0hZWx78Me-vzytb+0cchnBv(JudaI|IS4ATMCN(vngbdsb^^r zLs5GV138U@H`InPSOG((*A>e|^7PDqcjm zz1_z7B-p%1P@ac|-Jptw6_Y%IF9+(jc2ND;-``&^P%sAY%y-t8u8jRCLacmH!!?M&9^2j`t4m1c6Blb(T2`rLS_&-eafbH2pMApXp}<&J{Ru#5e4Xts%GXo4fVT z2{;Cj(x&V6g2%q+4aPS{9d~ycFTg6c2NMakh~5W>Mr2G>Yg^k3Mt%4sqF{Sr;h0qW z_^BVCL@uqY>`auu=eIb;Cx(8&LK%;Yi+c|a{)oH|zsuMHV2Gxx3I#d}gxOLF(J?Uv zP%#vRcxIdXZ%7c!(wcqhSFCMp+Al72*JB5W=Ng>kgn>Ytu&}T#n0x(8(6p5<8!3$8 zds+I+S27~i#U*DKA)KI#G?2zW3@dxadqaSW`w2-~xZ(!PQYn7dA9s{~{Nv9a3!IK@ z;NJTF8F7;C)&~q6{M~$k)5BFos^FYx3XRD@yA7J3a)VpitrP1Y1TO_{6Vf;7f6vX8 zzqcGbJJ-%m7Xi;NaHkOGwAi0^C=}3K51s8 zSFZNgYx5oU-Q#Sx#t=`E4TrvV$OlHsv^$&)X7#P~#c1M(;v9Qi^st_%2)?*=66+7T zLn22m6*;%gOG=Upti?&jJg%1VqJzG6H~)LN1HW^16@Ne%m$~N+H9q^=@%n%7k9C93 z1q=(jCVWeh-Nu(t2N6{{uCzvq-hVWI$$$tf{m+w4$1Xd1aoIwXv*W-{x~376=#peZ z!D%3tzv?;|eeLQ`n@z$1KREySbw*kH^Z5l{{h2FW#WP~5@j+sDnu~=#hzFa7u~_@- znX{Gw&Kvu~#DmQle{GJz;)dkl7)n?Rks`f0j>t?XA*jj; z#IHA3Fgkc5QvlBi-9CDc7+*my#0qYX+J7s#Q(cb{hx%6>UfE^N5!dO9tsUF$t|y24 zPI5^oVC?9Yp8kw6{Nfx35*Ho%26A6DQ2*!KC$fB*p;Ay|F=Q08wNKQI4bbn&#SMx2 zQh709y)!1;v|0?Z!o%<++Mh>UdmsPGR}cG&W@&Kem}F^6*7_RyTC*an5y#Xhg!<^_ z+CRD;+-zSNKl#u6u!F=?TcgKB#0hPEnDq^NXR>`#bym_!=rzvun`DUwXQi$g__&z= z69C2%kbh}4FmI|@sGv5h&N0ggy*5(q6`QiYHZnQ(+|;4gJYeFMRZL1SJaSoq(4yF` z)4!o8=TEqU<(u*4{y3Ra<1`3R%jNMkl|=Yj=ikmL(YcAZhMAe#X?WTNRx2txKyx$d z%D!@-{^#Y~Gg0-E>dpooCT=R07J1D&&r=f0uZ?U*LHndVsXel0$(ep@CRMptkO?st z<%R}X)o=nWYrL53Uq4+9190t7HKejaV5`vST(iEe4wO&i{VH7{a+QTVds@$I_ zFYmyg*r=RY0a!Yc)fH9rw&K;Zm~^em>Q;A3M3+*N z84ULee;&EmXXN#}T|>MnjdM$fS2Q`M9-Jw4H!;)5wNS1BvcMmXasE(Z4OhpTPK(LQ zAd~f>m=X2?0gbXoAkzQN)_S)5g_3^kmbz}Q^42`P3&}ZW?=L?43MsP1)nVGV&YI>( z7H>0x|C^6`LSBEfSbc3kc@t|_Z8NHVHRm;`X;YA#SmNvn#Wz>L&;GqL-AqyRwN2qQ zvNF||g$>`b&BapDEBv2CN_u3%NJr(!wQa9Es6ZYsA#JaUH5gB}m^)FCb~;-rEaC}P z|D58enEONTNs)AP@Bh5#6Y>PNvuonu*|X}5>Mf6*+&&MewA1yx?g!mIrPY0|iv*49 z0!2~XvKaePhcAZqqRk8o zA1400>HSBAVdnC@PD{Hz9-OX2Yje+{LV9^~f6V#pUmpE5D@qlfaQ7P=gh)C!j`?tR zRM=N5*KN%H)ZD@A?3V6+xwF~lS0>bh+NZ>`KqaeqVor7_Ds!M0jxt-Ql$aO!>tLE#IDay`< z^Y<&DodQDjstu^xJ8-^FUGfAsz3IQp0A1<}uN;D79RV z*|L|c1M6ez2^UKaKKF`5XdGWeBnrYr(N(Tyom40{2%))dNN7Cu9}d<2GvkUvFzcPG zbJ|Xv8_13jj)&56Ol>TMM}SA(favS=<$t1g_`LZ?y4loTrZ@n%_WEKj+Fi0nac4C8TAL_IfBfqDboPd&;n{ z@&8FofRq^a@xh2BelUCH0=n*NW;UWFLsATxgZ~|JZwxPi1Ko~CA?IMc7luF4Wqy>1 zU=JMcxP8LNKVkvwA^6k3)BX3(^M8{NvEc+{x3I9M@CaYOdllyIZvj2i&kgAtDcHW6 zdNcl*^VEMDM4{`Eq2T@n;t7^uOfyp#qm3*jdHKNS?AEROOOuxP0EN{8FuwS$z$zyUb@Z(|2FhwW*QuQ~D+a09s(mBG*-U%=HpL&BWdG{akw(pe7N z5I;yr6crW*2B;1VAc&890|4F6?)}WSFGji>E&i@N9z6RZWRG05kky_dxm|q!{s|;G z2r5i;3XQ?gjalEVgPUH;Y0ylWla0;A7PYE#xrp!Rv`C!x5ozbLq~vUuNE~0gQAAa$ z#mfHvJ`@>=LH53n!tM6zVEpG|i4t$6X>HwCJ-0qoujF{z3?e%tqdah-zAu#=84*zg zF|LF+>*D>@h(5aqBGMFRTVi(WpCDwYC_PGIx4CbY#ZN{^Q1wFbJ#lNzM`d^jK4#U3 z)fEHoXS<-{9b9T#dY?QaB*ew-zdABkw%Vi^*RF64vQn#C%M>ti&J-_dl2ubHl-R~S z42xu09~m1Sc0HMi2IMEB7JG>a4=%r^q@KaZtjv32khC+VT_n?r93-9>s(j_Wt z(sIgVn||b)8Qd(5QGk8Jqg?UN`r@LKM>#|@N>rM`qeE>~p8<)e;cOY7@UrchUnCk4 z(>Dj&9T0q*6`~(kXNg4z60jr8G-o@cCue{l7}xom#M+RKf#qh_9B60@?)x)!P4;ZB z1n@_2+p`iRIV!T>!#)yZ8nT{?h}yUuNxb&`l4dr=@n&#fb!vi2VnU-xrFaO8RM^tHcn=hs|v!hB@&)v zAD=mTc(mi+13?xKE`wuF{D@%%d~~nm2m8O6S!JRw8j0pmFGMa3N{|tL6o&0i91@0y zG4xlLtHhTzek@l5p?(SZlt{^yiHIOT8^NxILy?t4lXNuZJ>Rs6L7ixNknx?5Y^0=+ z!}g3iJ2$k4#Ika73YHRf-LNhgxX*)Jlj6x(y|+(qI5KWlSK91}*K2h)fiVQt14I36 z=nY$B2u9Pn@dzMH_Fu@lVRd_FX{j(g@aYXa90ftc7$9w9$S=cSu<`L&o<R~iMW^4nuy?(D$@i&~WhpT#SU z8%uuhoA4u;$3YM4Fv@18`4?m~L8H@vKHM*R!D2DX%`hTfcQvymB$Q_J*#;xpys$($8QIuquy=N!Q-X#(^MbHi(}9Z>B-Yj2~B0?x4a5z`BwAI zND3cZzrPU1#=-HR)7xD>b?iiR*qLp8Bk*c?c(@}L?7XKfZloauPxq%O<57set%$Jn z@7NhP>V>~zDzp26z<#g)4QQA*@`lOPHkE0@lHv;VMpgEA58ULHoLU6R=k*ccdX%Z- zfO)Jl_2GUfq9FDlg%DR10XR?daAzUHM2KT8q_c)9u-* zWIQbM>;*2gC_89!s$zg~ObS85-_p>?ngu`s=^(TykN2V0B?waqPFmj3D6!4t5oilj z$)qfDA^PP1F6TH;G=@=hq-qn>h30`G(rX~R{VhoPxjpKp(RfQGK@WQbm1-Sk5H^=n zI0u?eK#5u{0&!lA8%V(hy8hk3qv(if3tuIp1~aQ+U@?=ve*HoV zp~=@UZqt&F?_rK)k}(YZ4o$Jz=_fvwSKXW@%Yi-`I3OKzduG*gyQ)Gm3#0l2-f6!4 z9niXdQ7s4L<=`>-I-Z=05e zDdC|PtJ&n&l8e&-@Gk1jYO7?q#V@L|x$gOg%QR8x{JKD#bv-~EQQ|`$c`{+OS#-29 z_m$6u z`Ba@kov?B3Io4g<2LnR_OQ3mQFljo&)2Eu#1%;8#@NoKxx^!otF(@QQR)}ZYlUo$L zuC%gReV*2v%g&IB05YeMRSr8E;zDtT3M$bXTb_s{8$Tb~;(&-)7>(XSTRYA40rT?Z z*?}Z$V}Nv+`;5%zS{r>`%Zn50Z*W&woLFd>%x&@h5E~ z9lz1o(X>0c&>o^2Sb-(_-9H0DCyYd^CjU?l;`@ULgRpV1wY=@t*uUp%tNQx%a=4vW zOlD+;mkS6$q|nim1AhSWNhnXZ@Af3p6Gq&LvaP#etLl^{ zCfpwwm$dPzI`wwg7tl5xshu2Iu)?o?d?Pf=|862~AtZJpz<`QA2xEgewfR z__9aFF^rpt_hbDTZ5&Ve3A&8M(wL4kpGvStq~`Chzf5`rU>{ zH(Rk4HY<`>GswMZ4a`DC%LPy4qtmg(#k>yj0@PuT&nJh~`mq)gO10HhtGv91g zR4Sm8@5X7yIaVou+hn)^mCXq7whpO)StL^YQMDPtJBpwx`s|F`jR-u z>SL-WpGimNM-}3nBriSkBi7 zKkLkHFa3hbz`1PamK+H;q2WiO%e+Uc!BAr<8@=4L%WD5?9j`_t&e}xEOv@b3PZfRy zZ_o%6a>?H0T@hFcg$5viI|n7WlrJ9d5HtM2dd7}6hxgz&nZ@HLVG$A3Tc(EGm?jVS z341$MXS!6)AIV`n!^q@5I5@aDkKwUi2^hA&xn?S?RWo)Gd(! zDNAFTTSTGBk3n`+^c2J5w8ZHBe$wo26k#SKi$kv|QPn7Ph9zrspJiW@5|Jr1<;Uc)dqj)$s(gnkM`usC!?y4?R=)^<3Io9 z<5O3bdtWfgr~4-*l?bGR54FPBsi`Zab~L!R`f$M=sdH0ef(BQR-G_+kV<%nPQ|!#q zjyp4Uhxh|~(T{LHDq!fxbo*rKHjw1JR*4=~>!Cc9*s3tgdd{Gfp%9LGj(?cQub&sr zQmAXlE&suruHuZ<)aQFJ@GtX!MRbv-?33_|+&dRE^Z;nU0{lPvw1l$P#* z^*RU_cVIGGUy$-dVa^{Y+4-T)ALQjh&Km7#?}O;1_fSS)Ox1{zEGao`4cltkgJ9}s zzq2g*|H0c^hE=_7aiby%BBgYrbR*p$-QAr_T0%Niq&uX$Q@R_ZyGuYyIz-Avy>q$u zIeVY`ez?#5a`}ip{A})~x5?QPUws+p^A;;$BksW+HkT-TT;fI#(&AMm0a2>+KmxWA3L_ z)JYTYd;>synqOBxH|SD7$cLfcf+`W@Al~OQ#iD_ezBfM+4;~bIpM}14YPGLxaXC!B zQ4j%0&*l+{r7o^y;1uKfpOEm^x;U@LMG{Tf_~vu;t+DalHULFZz`|>A+zJVs>y{bd zy8}Q=_W`J=B_oKEK$@rhjFo$NCXaRU6t$MHw@^~)yu{SvnU_7kHIf?MjD%`nAoJJg zP%8aeIt}&w#-Sc_5HvnyrN75WCZx5VrQ^1>>e*GR?a3>Y7^5iWcoab}jq0m>01na# z3&;8wj_X(-F#W|$^G@=`2B({z;5UMiN}y}-9qaHc?#s58XrooX{s8WQqF=EmG?nT3 zD+!kerC6uUZH{YvidI&1qlFC>0p5b7p|L+fKep^|jAj_?)GR)ftD^sYp6l!^^6ZERLMBR?(^p4*<;LZ&g;S0(>HSq{`_-}!lMMOY4*9g;Qp#@(+x71R# z4mtB}z@G)7l%{3dFbcW8&aJ4l|0dl&{S%H%pnFo8zF^sTV#nZ9owFALYF?IHQpp4z z$Fwkqg~fU2xCd08IaNai{Te~0e_)_@a4B+;1# zM#GCO$}jJd=d$kYOqEAu2`dFXwb>o`85;Z9V*rbSilR`%>d29Bxd;X2{1L9AVci?- zX{PN4%^jY!;)p5`?A5HFBq8%*P)UEoB(D@d`3+3e`Wd#9@>8i%_sOQEcy@UN@85pc z5|xsd?_mi|{?7YxL*a3Cu01Z_>#1_RD;y_)E!yab-hy;dC*V)ISe^(g_6clPS{emb zeXI=~Sr=6abu(HxrF;pW5D3v);_}*^Zdij&{kr{0EBX03aT+CVbQQT|M5ba%B(hOT z_EIJZC!7=E9XK=hu&?_YVaX*z-yPmlVbX!|)px=gV&^qkg@sQ9;$Qk9?q2f*s85v# zwS0De3(x%9#fH+|;qw$1bZ9KqIA^CGnFvit3eaA|JgDC5JtZW|=&34`Z zeKkh{G=q-yaSQ0uh`sbvwDeM)qQ)Uxrvg^{Z}t|4pdo;|P3fM~-lVQk9$b>?!qY8i z^xdhLcd()j)Dd_q1p$rYFH{RY4X3i`-{vCVd}2*t($6+AAK!7GtY8um!uWNuyF4`R zfe^v*Xu+O)V=Zd#{wNT3?t|_$H>bnO)G-o<3NL9r#RHp6R~r zl5&kK(e(Iuf~^w&_n2^3;b$ydIRD}H8iInSA>U5+{w+4|8$9y%qsU&p8k!peNZyo2 zj3D7)1_+v^9H%+mIme%kweRjWa!)PXoirxeV{m!6nn2#jRuin|1CHgy$Ber*#7ffa z$t{y4=Y8MpSB>Yr5@lE4#inywh4PY9+eAc46051=#Ygn&fu0+ED1TuYRs?7C@-XZm zA*e3DgIcSZx>(S>NjOKn_G-IJ5}Q+xK`UOgM-{e&q86La_o1Ya5OLAm`Bb_&IG!4O zh7<5A_4ncGZps`zMad6~9`CJ)6pU-7;p9YkY?4#RF~hug?s2Ff)Ag48b0bwEMXR8E_ihENg1`kl+$6!hh0xH-!^4{{0XP29Asi2Ige>bj9rKOsU>>?x0tCQ|5 zK`q=`ZfrD!+r9pfLiz6vWv*0Iy}e&wEP>>e#bERecf`YoRGB?$^c=2@;YVr+3S6mc zEuR=84!;;?3;!uh6vkRZri!3Br4wvOGOrec*9JSX|O$#^ChVQueQS;di>p*Oo2{GVb)xUyrx!IIUR=P-P9VILq`G zr4sGFd7lMO`-&O*3arc@J%;#?=ENTtfee~O36ye3!dM|OR;nCAj;Ro1g#H#mtBm}%AfZ0n%PHz8j&N1;5 zxFv&%SX1;%LOvIOV?-QtY(z+ki4o)c&7@NNXnQ%rwGa5cv6t%TZpX`jxwGRdoDsw? zYG7~_7xm2D)f0dKj}Z`Vt~SuQ1Fd66fF?+Q8SwZT;z8rCwWURmFt3{!FqU{3V#y(t z9PNiiZWx};Z??*k54R$j)d_ux!-BwQm;WMu!(nlhn*4V=j^`!Y#cHRcCD6L*;rdC8 zX!3t?A9QkU47XxG{66n8i}BdJtGYn*gNWJwn~?$FeDz;Tk_kQ&*{0^CF2cNiXPHBm zx!3pCXSbN>B-Yx&{WkyLon5I?+NaCOqdcGM;=4hL9AI<)2dD%>4R3wD^FUMAsJp`*TiwAHh^%CkjKS}L zc)^iY-CvvanYk(P_}gc@DWy-#f~e?u2<(VAmNzIv)8>YbQIK?^^~MiOg82W%O$P!D zoOg$v^!QvhyL~3PzPDNZ@okb#cjbXmUmmBo#kw7(zmy9&JK~xn5wtozHWloTxY#ud zjX-_!G(1R_JMJ0obAoAfQwCAa1Pk{d1OESc+=UB5bRXY}lS{;>hJs2)ve)H*F=>1Q z;~aTTMHZ?u22qSzr9aQehsOPd&>NhF@>#d|maf})oe4?|?)3bxOa+_2bl1J`yX*C- zZ-UqJUBe55iaY@+_xmbB+RO1W#FB_*j<5Yuccg5iGyK2h>3cr!9h{KhFt1*T*d_*H z{p;H*Rs%uwA_Don~ld9ebM@dS0jY&1MOv2OebkL``)g@j7J8^sl&GZ)vS^H z-MsS5P(Ks3$$r|Z5+#_qv_I^`djVko!EmvWMUo`6J9cp@-kIYpz& zJ*dY77)gssw?y_}XmBZnFcz0_6A`m_XjE+Fk@y%RHKNz-a^@vXz=>`?wlXL`LtmWz zw1|=P0fdPEa7J)w{dT?qhbSMw(i^%fV5GLSe1|jHQo4^$YCWdOB&2e2pPo|EWp-b+ zIr%{rs-)^yd>N?4u;P$VBdmGwvMlrc%Pidz`S_v3v-9*1O%71g!EKSsM4C0rjCK8wwCwaFO9k0cdv(n&B~ck zJWO{7>8PKhPzg9&NSE+woE#w5t;KGv+a`*}5V;16@ci8(xe1yuQ$^2WOPB5Q8Y)5W z-4oA;7yOIa$T8HOo(n5VKdhHiwI}12R)ggJ#s34;hUTC9Q(TJi_iJvuq>%~5?QBe| zLiZ;ulM#F~(4SY=&Bu24*F25zZLJrgo!!2Pmk0h3DSub%8j-ZY;5`$dr4sZ+Y>yDs zQ^%d8i-F?<rX(8-PbMPKQTp(T&F305oWe|A5N+%X=CT~5?yDOGMB zpX#gRcXs*96*V^MZm5a={uMJ9MWYxgm8jK0UDd}19~@a%>-<>K2Nnz}KTdaL4;fAC zq>}7JTItMmT2Z1|nfH}#rN}9nooO1$xCqowSwF1=Ek6B+PzMt--E9=yd+a1nosFDd zQ`7kzUYJH3^8-$v;q7Jh7~xwQ(Y=P2S;|~e znV`@osC#orISl0cZ=bw_CT{x4S-Xbz3@zC`{vo5difeb?sV9&w@IpI{5np7Ml3cXw zX*>UXPNRy%I7vlp;LU16pf*rb8K%YKacokC&P`L@ zYEUch|BDe5FFE+omkFA%?2eizblh%+morIPukUreFCuDnmUovN@^KSeSahYb^(jh= z!B4;!!l*C*zA&N-G%Y8YFL;2NDE76N0rMq#kOEUFX+Paa7{OFGiSz!nua(yky!kOL zeQCb|?({vSXa14T>{mT?F=qw6sL0_6X;G0`o^Mcz={Nt{A4B92c(fnwH5+I5iw^mX zzMlD;mf{VdJ!mgR{NR5-a7JCKjl*P!Jvku8BK}Ljq(ee`O>=&8e|2F|U>C`GY1h77 zP)qjh2{~l?!~Z__k$^|b?Rpu6x}1Z)Ou#c|=L2EeZhAE9UI*-s_O8%!^L!fF=}a8B zG5`F;>Qd{CJ7~`_oooh!t9Vud&I<7#VHGh^n_>aQF>phe3;->Ue%rN=5ktIw5RyO1 z9W2vOM!ejbqzM=RG*Ny8ru~KnYxqqEaG5`H?B~w*&qKRw6+w?{^SPVDB}~-?V~v0e zhTA8Jij3^^RZD~CEAWdyQf)C}qINmJKz7G7_$C0m{vUZ(Hd=&XKDanP3iHvwuiM8w z1^zBc0In-c<^{|A!h#C@HWDmB)JE?PZAJvY_#^I~h66(D)oFDwW_OpM zWVcC0cDBiMe>BjF#TC7M+ARO(M|75;V7bd~3&56b85Ur!Q%miJ!onXozY+aR;fx^R zFfljzxJJc_@%U2{Nbf^rb>TYRry_3{%?N;weJA)?jAdW(v8?0dMVZaWW0<^M=ghp0`7FdtW< zx=n5%?>RO7Wfm#w9R|71-lVBXPBg}S< zw(NZ?<2B$y^u@sT)s0zGy!haximG1Vz#|>_g(z)sXQIet5ExYm)_hh=!x0-?yno_2 zjYFMU2TLTQsT=LrM3C=>aH@?YY&$3=2LA{JVe3hiz144eT`DP^*1tweUVh}`W8>;K zBTg-*c^u=OeKN)~HEWA7y#5lrIa}TOL8GCXAKLx#mYo>Dv-BbL73paIc)-3<*hYV> zwl>_x?QfJH$a#&?Rh@na01iMSyZ~Mrl#5!;f87$RMGmF{jE5A|9~*Z4)oxyrl#^a7 zU^wwHn^iXxi^`AAzxN98+6aj=Mi(xxB_@N+qnpcRL@2N}4K5b`co!9|*7~1IW|E#w1d67RFvPyX ze`9Il^Y8c2u=7HiOVL@L*iX;m*VUE$&eY&g;|acLjU}o*gP2EkV`Jm~T-iS0zD<^V zjTcBx!vBj{2HtuAdVl7Kl5XgNa{u8{J&@@QOoFn8&;69b1!>>~_O*TCA>$$qrv6cJ zAUX>!g1U;n#jx|um4olSgH}|F@(wW8Qi&)oYl&^nGN?Drl}mnml)5m_rp{)9-3u5S z6IzhXPRC!Tjs=P-ph>t1cuL{n;YFpTUn#V|6w}4**)%80f+D|LN=^i!7Rri**bg)h zd64ls3$4;-t9l$U92|dL(1)>r=go6je2>OzievlU-~nS$+;XcY7ih`4=o7gvJ~EGH zCDH>$9e{cK$#MUXvM3vVtUqzwTz8{oVya@&8ZU5Vmg_R~(x66++SoeX8WOra!&DIN z_nUgY_kIdDpI2awo5ZBbN&6E}yMT2M(-);FMq&Qm3d`z8Qey2-=1tGh%ShdNRHEQv z=v})9W~(IPZdvevSUQqL5BoT)p7p*t=xSu<)m>&CQb~VBtt`(mDeZk}#bHZCX@55} zCFcRN3LrfLZz<6g^rc|>6(Z8e(G`&r>?ILaZV1hzaioK}`r{f)RdiyR1d{x)gF6qd zGrWmgnE6eAH2L@fJp)5rQ6jN-7XY9FnQMws{w96Mi9c2f2X*dzvnw-QooU|%?aP;1 zZyg+d0*R*+TJ#Bw4Fi~jq2tu|s*y)9z&U$d`y5E6K-Yst#wxT)T(bP@7l>g4CSZUM zM?5VL5A8O$?EQIn2S_-Xnhf|A-+)NRh?rX828%wzgN%(pY2|Hz`s+YC1uWPgt+N><$C{n8?7S&Pa0HrP{>D-z8j#3^ZUZ8^ZFwsV);q}*ynZa zwwm%`Vx~%rNAcKyZ0CH<{2pvLdz!T~FreZLNU{K%P?Bn(vrs{@|2^A#UfJ(K>0EY9 zECr%o2UA1>*ykHYog%6ihkuwWX1xro<*Cg8!(2xpk0cy|bKVSM?ASj0 zWXk>3UTXcjx@_Mndf;NV{+`$5SE-~mqAloVse*?EOA)7FCK^yQ2HXwHiHRL4e1zDw zpPS=$R)H26Al&|SKy}Y~!(@RTCVRbz(vyac#I)Ur!*0JPDe)hjX-<&xd0vEZ9)x8* zdrkdJ7I0O`I|&?KGAkO60=R2@Ltbv2j5(3GS}H-ScXMm&?wr}1g4OwaZw5xoVTG@f zMp2lR@^uX^y#vGWW+o@tB=7Y?ViqGVFB8(=iJnEXGRPhgtFCcs)9}u-(wH?u)gSEE zl;qoo>2mPm?t!hHiJnTENXbbhu{wqrCT3auHbT}$4FuUlal%a8*F$8GtFU*-7rirv zzKovDL}7bQpJHDFHY=~sO#{lq3*Sb}!|5Vb*8GXvg`S@(8X6bDtMh;-wQpEL{h5~rJI@O)t5C;P`K z@=>?FVURnJbURm+LX26Ba)W0Wbc`J!>>AXBQiA$DSUv&JFH>U9{Z4;cQd(8>+-{9adD{$uN0g~uvHH?PZlb$L6 zWnXe3Yj9rLtotJn(hG=wv5dLz_lV*N)G1@(P33F1rERiDOJ z0q_y5G}(f=%8b<=y+mT`LzdU2YA$p;Va&!okK)hdv*3txT<&>l}wFBes*u!8zD zWWnCumC=(M+N!LH`?-MqeqI^-PKV%ds~rIds`%imm}6SctQu|=1nyWwL`5_dlm<<0 zT0S~fqZY3fB2wlBES}lT+xK`jPQES4(m$__?%aKo?`moh2PJ+ilo46~yp_(z+X@gTh39kTRrLxPK=#dQMTfDb#87 zQD}*qabti6k3l#&C3LzWWf)|CU~7`{OgdOlYj*Gz{;PkbA6?>z1JBkc zTnENm!1h2vzhd_{Z6B?yr&XV9=aT~z9gfa};v5^*<7+x99&hNW-%G!(-%bTv`72k%31h|oo7IK#tV{D$p1?Kn@9n-&Fl;;>`EVt7^L4oKX8H=O@fH~1S!6jRSqF6&i$_ngcnHBYSYiYrn*F-yd?2X zKnW+stw&&MYV#Y8{_`%9Vq=$q!X2v1IBwm8r;a)Ng*QZGmAuCQZt+vo<*^inREB(h zHg(utg&NfU zJm=_5CKNKNLW1KKW}QVf({UY0cM->8TwqEeT@_F3L>RvoJvrpX@iO|;PY;}l0MVni zpqdMM3AE=w!f<{&@_$6pBVs;n678k{6+ZO2bU|OJ4>pk^H&k2c6!eyFk3GAjEXxVqPtzE>zbTdl=UUsvyj>Rpu0P*}}QF9bAC2 zqwZ#i+2Q^7?>#SX08Pc=ec^+sjpq~_=isddNOR|*c=^7+3uH|rVTP*P^RMB(i9T1^ z<|RtZkWb|X)UnU+F{k&++k0PzUEYWK>vmHJF_6+sPY%Z(Lxl#oM9k+$dpS( zr1HMd26Wc8iHx8f@%KzB^xgkteK4iMt{m^--+6hn*%kx>-sDbX7Gmg~fs&DtL~rEY z3St2fvcuxi@W==%3d(Ckv>qQosL9SI8_u)(xS%enyyKaR*X}k!R)l>gA?D? z!-`Px3qXn}m&CvrgG|s1C~W6_Uky~&DR4};;s(4?tAGdCTPlEn&n_x07+hUdFkDP+ zs|335ZY_7(WHRdV^CcuWc{Kr0ab`I+?$m#>rbOx#vxS4#;nCAmhJUisocIX^0Dk&F z`AhX-%60+^>~L!hUjdKlpau@Z67G*3-@l{X*pi3k}aEkVeW8Ra<)rOHMt ztf@Hz%KDp&t$|X8ZpJrf*=q^AZyGhVc~(|^J3qcEaP0uNhw~#?BZQ3{l3;Cx8#jm6 zRFoHKH}@9Ua(RG`RdC$Pt#38Uo`%Y|W_O)@u^00ziK2gKL!kcx`XKUwp*kv)U%)x! z1FMIDK1#U{)&T*|Z}GR*hfy)+#;l*;V9nn2{dT95qbl0o>$+FtI%Pu`3epJ#eeORk z7JVscX(V*R#Q1oR;X7o)tgLDvRbgah6=|IVrT*Vfi%ILLqr30BghyVTN7#AD|1IL zI+hLN2PcTDB>sQS;4l1y=cf(X*QRL77Kp z1LP(brL=Wf%pvp<5{Rfltc?Q(f3PxV`+v2deuxd?=y}fXJGqyuN<81plRUt6 z(wlW~mlUrW3&anUOiVX zhBNE=C>iin!|b~8XfgYsuzXt@+&D(k&u=wEVyLF;NHbXONo{uGk>@LA@_}>a%eoDa zZeI==EFLHa($^q;cXaXmT0pX|oMf_T^;{{d#J4@O0TcV29I{BKx!n_pQt^51JjCt{ zNf*f~Y%A~XWs0-4e*5P=GF9xx6j5lq$xsBZ6jE~2OsQ&gBbh~zw>KlK(JR&Ql&hjj z=U`YP)~D`92YG(3f2oaONLJv6jJ4JuyN6J=vTr%{>!{3R4t#)AO6I4Ra1%*+i&!aC zHnX^Yy7a`PZHm7CS7#NU>X!}p!bS`JeEL(ThO(_!I)goP7y4JL*Qa-`tSU$Q1C6+J zX)Q9tHBt+IdgFP`hECaswGgD|qQDbOV7j^H;N|D>SE~u$*%&s*9I_Q?6+Ou!=rigA zIL$v#NpQyo;_OfllkPb~N!$RW|^0)SKctZBYrEU!gOqNr_Fk-lL16!tZ z5PJdC@~+h9R%HDmui!Wo*&UG*C0K~)_*%uc#I`JUL-6o}&f`OkPG(?+6vZ*Tv!>)UV-l-yqAn{EW6l3hhM1JNw`;7<$!aQX&mcZygyIj`WlOGvS)y^bO(exxz9I z(y^WHn*H?{vRZ$TSMTPWOo843|g_FP>-x%N)&la;c8*ax;_-oN) z{9bjZHf74^RC8^85Yr5;m@_1W{}}V>1w*z^?(jNx%$Hf^X10>R^TMYn5J~6Rxj}G9 z?>>+J%@F29`=z~SGS7!!IW+Dw#g&PX-_c!Z-(vfy#;joPdV&(Om{v>+lYV{I%s>X2 zVqx;gPqZoz(_*%=wEcP>DSijJj~X@`OItnvg0TSbo#w5!@7wG$KC%dLbT`F0Tz$(Zc9k@Xi=WggM2bJbkH z#BiMK;2eFy&g;$iuIFIQOG58b`3)1CzW%t%PtX$W3cjy|&SxGATnvKMQik;i09DL( zbBUyPMDLN5{Dkn^&9j~S*xcGGcleHnV)-YFj4owsDfRSrFXw(J;Bfp0^954$x~7`} zPyfgj`qJq3oG){F9%m`JBiM<#;eCdyq=WYxH^9D4br(RswN=SqrE`bv{BOfG&sFO_ zxe*{2VcGoJH}mcGmJ(A-y-hPz_5;p~jXIxN@6M0ItK8e7SyT36&YWMi)n%q9xHfp$ zRDXc!iIFjH4654ueXZ1{n;zMOZaz_aA6>=y^&e^k06O{f&o|3)Np3ifKit`MEhpdX z6-cR;-OO{7;%sfk8AXTs@y|)BnH#}WpfAw?~e`J zR`<`A4GM-lm+l9*7yQwg?oO|ES_!({ypA$#Jp~qg4ZR!|6d|N`Q|X<088f8`6@*<9 z*hr=f0S$5jUqtC5?8@ug_u3YstD+b8t5Yq^o?k4Wo{xprLEP$sw()4E44@j9CCL%= z)}*RJF7dA>PueN~cv_h9Qbpskm!;W*LycJ`R@m4#r#->LScn{Q{=fJalln}HbIVuD z!Nz-#XdhUNL|uh?}idl-#sA&jb;yR24>XCw+eMau1Q4gWM5tN^ojDL zqe29NHfDsT1?^6oo*lb>{Fv;jh>uWtMUs^=HFYUY-CzCToV_Y&4|A4;ro7p(=CE`4 z>=U-n%CS~i9cidqsKu(3wsOlceVcQ5(zC58>HF#wGidE+RW<(2}H$bXzz z00z4-yMFCE*l;1y%hA_Pk4%R^Lhr)sJYSizc*D4f$5~v)C>@Em!+acG-!k3p8OCuZ zw(M;c9-t<}meYH-W0q2_djG!RAmk&0sFZWq^CZNDiS7er-y+{{+O~QEUvQOmb<+}z zKBN3WKSvpyu`jBuhd=;u(d&pJVO}T>?ImL6U}~NgG{DoGmCh}#t0QCUQj~$Ya~z3@ ze<*theN#GWux8Dir+Pori04vj>}>2fjc2!z52Jnnc1~tHFnO$k{u3j_0X~YUfaSWJ zv1)ryDXqUR_@dQ&rwUq1%KZCS$fp=vSnSOoJw5Ct{4v{XO-aAsOaH|vMLn2&ZkixA z{p5e%kanbg!M&}gi~gV`bo-3(v(9rdGlc*BA7@GH30%Z;DqhQhy@HpEN$>6_Fw36& zj~@`g+fhPD)kvGQ7tZ2_wwZz#|BcnE15}6i;Xi-$KTb=3eW-q{|AL)=ej)e&&p#J# z@I}Q#w0GzyF;-!it4I7TU^)xRu;`*B}cNBl+EXh@{oeO02(X#%?><>S`VS5UyY9a-wjAY0oRzHMd$7;&ZHR`NK*}LI?*qQalnuwaWNy{ za&dfdO#K}0j7>6}D42z{=sZ~k4l_x`*Ct_jn0%h;zX0(r`~J|`oT2Y+u-|gCt95J! zB9TL9XXhA;iUwei0*eb5Wc}J->*+bO0Oj}&Y{sbB+0Q_yf1U+49m#x@$k*5R;7cr( z{2~~OmUVu@NXf`(I~YgX|6YF!jO%05djhOSE1h;Hkua&k2)URT7!JDpkrzM3Tgj9? zSWN>`+B}o~Mx)M;y7g}@rwB^aMd?8SkNy04rOz$&f+rSp;$7!|z$uUc;jk})u4Xvs zTLV#7R(B*89-e)9l}gIDh;iv_Po+#r0CY53&5v!Y&(>JxqEP1CfUs^Y^H|PI=5{QV zXA1Oea2TFk15-2LFHsaunf60sa6C^@QBf#g6=qTKR?gV?Wz&wWYZ&`iP<#Mm%VZ8~ zaFeyhR%~U!#<|JK@^o{6`{pOUENGC z1^B-0;v_dc=D>Jp!2b6sF7J~l2Rrh8l zK#*Z$6RtMjoo-5FS6V3oTR#e~UtV@Op2AY9^+vL5*S%GcArn*6wBECyBWBkZhj4Ik z?(XiaKLDnP2XwIA6a!IlaqPen?vGGeCPl!rZt?K=TO%8oyjEC9BNxL`wyi}Uw$R|P z5l5?Hg9X99^X`y5dn*{`xOeeO`sJS@Gm?r<8WJ z(K0}#NhhZn=T$&26s+s35>&nppQ{1tjDGq2tL!R|^S$x$ahYY?MF78`At5bP7{d#i z)_0D^#>Z2|ew{7TrB+P;cGgUrB4SA200eh94p%3}`0V!jB@&uXl>`we?Ipz0L3BcY z^Cs8E;Af8JnEK0b`ogyR+@Ed>jZ2pvzQ0V5&xNeI!K1*sykcg&Hk$3-2w)U(puU5| z;2H1L+LUl2Hf?M}FPN4S8WMuTsIz%|EM(mENxej4&89rxC%fA1r->fgDTDLs9-DkQJ3GtGrNE75)hh;lNndhnhXGd0Z1bW7R|P8kO0gB}iS>I%HBQ zpWz{Xt~w;96TI{8uC5b#Q9_sZj%umM3sLS{gP);<+0{Kt6lF%$9qY&Q z`C1F7r;h*m9DcxNcYa2*+#ozY0Yz+68rDRn67uG$-;G{G9tMm6 z?^;=NGoV>4^tgH^K-Tw4OhY3+q}s?-`qh)x1keyn#8sV_$ zb2!|x1R?X|7VmAl^#OVcr|k`3EBNpCV`AeM-3!^5203?rgn6j!0TbLA!i7rao<2L3 zcLM|i6bF`oD{!j7Md9`OUVc^gK>=#EA;;^IA6r`r8Jwv2QML`o6(Fil=Gf~wxGy31 z=15OeTs#b;G;+`?^f{!s|BEVNd>Dl&D@-jJzuxZtUMD3AxEV=OpV+^?g?ok*t@Hx4AZ8bS9t%$tfrZ zf_^**tiTwR8oe`X;hm!+Sh^pNZov-t1IptuGvnT$O(_DF7>gtDQvUGa1I?q~>Pg7B zOk&EDt*#XAYPoVx)yiFBPDa2KN&>)O88UG_zr2(b0MU4AYD)QjAeP#&{b;lEBUtt? z;bnAdt+1a8IjleW0ttBN@WfP`Uc-o5C*mO_9PGCm+oifOq5B&UfN9{cXPLX4$?@=T zwwo3xBh$YXVd3BeBxicin1c~1fbww+M(~J;h>Tm%AZ|=B0FRY8HjFPDcz!YDO ztVWX`;1OR*8x;5t8+xB(4}MkK6jnIbU?{4du@Xl%Iy57umP^d^g`)T2_710T9Rs1U z!~-7b;rae^B^RLzuG=Zq(93&Urfy4kz$Ja=?OKo7wU;7Ck-|gKKXX zK6k6poJh)du`>CJ?(E7|r6A64yb-lsb-Im?Ta$URU}F_#2hM|d5@LokS8L@2jH>;I z(*>67TdBy#V0;g@djSXrgXj6MUw_IdA3{`&;d-rG{TyyHHPyC7PEcXqiGO5t)oioZ z?^CcMz3(pIcrh##ZEc9z9sg?iwt*c3mK`EG2~3uqG;?X0%M0Zz zm!&A)Vb@7a2c9Kr++JDgb<2R%0#i()3b32a zn`tcou0f7mT-Ygqp9sOJ3Y3x@z(MyWu?YxgHdg_%?>-Tu;JE?(Xhginl|aHE{-YF= z+J2tkshIT{@SkDvunX-{_N9GhTLt;`17>Q2IY6*`DdE1m0<>mgw#qg(HYmv!w@uEI zJnT_D#!Ff3wGoN9wJPZ3%`{53R1{uO>K0Du4oyp39&wGeAfFK|LML`y*#3!|K|SMJ z;O691bH|AvOg3;wJFeN62)2V|cWrG_QWDryK-%78PCIq-Ea}6hax|+~;w$5aqw%ay z`d@io*wpHY<|2`^fY>8__{sI)*wcz;+C+zqq24ZV|t~tJtE+(3uU0o$D;ONVlsT=_g zhr;2(B(#dZP4psT{a7y*yKrG7Ju-b7G zeq{McfFQX>b#jt(;6~8NgQ#0RdqrhwW(_{eBKf7mErffF`}UJDw@9qCAWjG-&`6jS19Aha*H( z2(OA7YHHMG5PKQG;Q&Zg2)ihl1cxA>?8mdK(I*8wj# zJX&H-TvQXSg#Eel9HLqrV3Q750NQmnMPUwl4jq#dxsyoIhuM+iaI=r)vj`A>SIVEe zgF_SMlu>m^gwL6@F_=vW|B#9u3($h(n)J%Kd~$)E1GFMPeS^dV&#(3Id1P3a(s>_6 z*aR1I^6d!MY80Vj6eA}U0$)KJeT4ocz{AsAb|DS{yr!ZkfQJb1(0P0UMkP*63_&S` z>G5+CvT8gR&pFAYX6v`PDBkBz%XWr8HaDdzu$Pe2?7bP_!8ueIIRv`H4LIC_IDlMiJMJ=ECKcMhmp1x+3AY{P8rE|ZetoH zG6)Fb)hHqc1_rNRzrRBu)s{r+nuR3687=xU};lfnxO<(>5*Di30?~5d5M)hysgZv6%|5$1X($yKOG!APG zX=%TDO=O~Lz-^UCt2O4UIsE-=yRz8_$mqZrguW_`as$SK#|PM2lDNW@=fWvQbK`m= z>)9Gr+SJpLLIzDvNXVa?AM4K*PkfFMHtT)?+&G@QV*r+=sgRa zip#oitF+1b3Q>7aGda3p!=<$(S}a6|G5%$WzPB>X0{>T&$~RV`jLy?_saM-4_gf1S z$8OF9vE%)kFC7uD)<>n1w8vv4*Z>xk+U^K2Vkq5l#y9J@+<0HCYp@<3FdE8P(yLeOTNGU>mL0M@KV}LA0R2J05T&S4&D>;;@)Bl!rhXs5)^$Rdcojo5ui3 zK~w==q}~xgXNt%TuPX7ldgXSS3y4=-PV<0j%Lj%m03q4cLAEf_oVa2>*_t1L({tKx z7Zx$y*97Lk*ME|`-|ord^~@(v5;NBw5TNn_;UDEU8mfYkkU%7vW$n3&FJ z*m@)gkN+&iN#eUm>A9|J}wm`5Uy+Zz%Z(0{@RiTlafm()3}5K zf*!4n(%ibABS*MZ2TT^;9b_PbVF{w!dR-E9HXqP;I!e+ThfUh^dY>Sx;Db@hlz@%I ztSQJR=oC<7)i_@TmBJLX2rWh5%48qNDKJcZg=L{7*S6%sJn6JtfCVnzL8>b4?pHr^W*Y2_qk+5fHR;tf%avn&9Y$0~;$f@Dije@< zkObT<+VLc_++jV7VPKzeeRhP6hxcM49{YTiI&YH3v;Pg~HUyBgeJl##eqzQWHi)83 zh`&pwf&fm1J?+a(G7pHVhzRiCUt>Rm*UAA2U}<=$XdTG4_W)H?&0wUNg02`gsRVjO zL3yYmz>5V~^C1!)Diu3`1=rlqGBRb-`Obp(s&RD}%~ zf5|yEt<&fw6KAl{x}8#-U$8%RUm-n7=ReFIW6ss8#e%=3vbKP*%z!};f+fqM87S6S zJLb3nEYMc*?`*x?qhz5`MFDxTlVjQaEzlHTqdDYA$T&Wpu9CSgASOuY;yJyl)J72( zz*;N!cE3?_Fgqvb(6wNOJd%tTM5qi&K|X{huhbdmp4D~+0;|L~W@Z-1UviEBE1f3lf+v^r(&a z^O^LUYVz}Yf4Zx89DSI52X$j;JIRz&GXPI$F{L*-CqwsMqFc(gidYBU_M^#Pp@(Ju z5siF%IYx9JjN@3#slvHC*gZ;p?33szRJ8+k`SvI^{q!p4<-UGR&8vmoAN~U`E|ol* z;c~>7~;5aO3(bw3dqc!%+9y*>wr646i~!^{(4L%%7cZ zAxgSpcQ79oMp`Q=tB0*kMi z*{3?+ot+HZ>8UX$6jQ)Ex(2%3#gEQ<{N6>(@+aD^!L_xuDqag0c0mnc-`FY!4?xqtVn81QC7fr&gO{1|849t=@{4{crV;%WT(>$MhxaoI94a3iVW{CG41-Y$l)79sB3 zxV(xzFn;O2KF4;VmIx=JRZOL&QSA{-4M0I5Py6u!=&FG|hH^S``bZM z{{H=YHgg+l-9M+qCR<%v)9q73lDfCcA+=GBuL|4QO7t$Xx!@b$4enBir@sSDxL9F# z*OU<6tkZc?@L4H@6hihBW~@+=kyS4_a)QT|=B=RdHUgq$r@wwpP+3USVjaB1BhUIG z0qZr2IXYI|8OxEKg5d>!j)@m_4SVQ)GWYfe5mW7g=0_{Or%S7`3U>*Q!BY4??7ekV zm2KE3iis$QiXx4qBGM@-(o)h5(v39IC<01%BS?3bq=JNWcZeX;NW&)fT-$ix@B3zE z%~~^OowL?iv;V_jKhK?4{KE7XJkJcsdE*2W2J2XKJ`C;4iQ42W+hPFAZrp$7D#Eb= zL1J%%nTCv(2OnsUwW>r4VZHLYo4YY~;Q0yg^7Dp7_!RSWr&&Xb!J=$C^d4^l-}cSS zdTUYv>_@mAlehZw>+>JNFLB>8)?1mDpmH1q;NdMgy~QFbsx{EWQ0FqIClG2d4dN%b zvoS7uQNJm9;MPpKzw7&OuVd+%#X|RG*(7bTVpE!nZP{lP@9BU~h!5u+SZowIKv2;J z_{x@$8MatWQi-A4mw?UkKA$g%UmJPWeMDa?@A|L=p<*Rj8Wvmv#k_=5g8H~kmK%tB zwvO;G@uwHDfAl1^x(BTd8Mld?C5M^>l;MOJh@;P$*MJ~2l*uediv*rbRNI^B>r*}v zbk8&(z}tcZOjgbbOm|nmMGrIyyQt9!TD(S5iO6jFPgG zmOf)#Uh!r!W|eGaAFs03la$1adXvp*BqAhqaCGFcJERq3aDNFcT zo1frKy;3Nwsi#C#koyC0K8-hQ%F!+ie)kB8zqVlXoW3v`eQ<`uT!W*kO!2puM2LZy zB

    pV4V?DvxCQQsnUu!XugvX^5CPR8>)UL00Iu#D%f$3Lph@;F?5dS>pDld4k75J z^Yg}2wI~_bJy{CTjMa&|@*r6m-Ah={s@L-M>z9~KFi=VU_|aP_*Uya;3m;EJ7Y8Ns z`~5EE>Z8of$C?cn%GIj%zd+&Bo*4Hbs3+d{R1~}rlJWX=vehk`iNuK4)$et)*qt5E z&5+*VFMYEN_AnF0dNui8p`kB%nta^sR-)GKiNq%x^zs2qiJ4{lQbvj@qz>G1()QQ{ zrq@n#-V-TYlqyEmOU9sHLZz!2a%L>#(~{ptzi@rXnJdlXQV9pyd5z;$RZt&Y^0Gr5 zKVD9b()CPeEByA<+uIw2pA{m7yj;PTtj2fzmCtc{diosSrXcZCoO$%T+vB3zXLz$Q zabMn&6c_*Cep3DZBUDKq>3WYwlpGcX4*$|ETGDkZRtEuEbZ$=tyxkFGMaIfm;)&8e zULixK)xAIx1Iv8ql*kYzHwEKxS16~F5wdPUp%1K)22jOye|ni%5MFvu7);M=lk$Tf z8fO6km~W>z=>|SB^}x9kMX%|Xa(r@XLT8#xPCdruGc)vGPq__c0FdvHvpSroe&b;WsC zG>b%MpWU4)GYOv;AhxpTM|xn+FD#@?F>*(d;NW#N6kz#&Z zli118REdPSEth{pmq2sb6YAIdl|y=lh*D?sz4G!UPKyh&fznehc1-3$7uk5_hM%dk zG0EZ9jV)`A+{BL@Fi6X5e0-)X_#-TVU4d9d3vy@x)S zM55pi)dO119cv?%47h25`88Og(@GhEHqWv?LL4e{e9Xcpk%r03mG?kNH77Bo=v>XU zmQV>DY2GkxEh6vBHUQ^-Bv+|)K zQp}tMRb*S<7Yu%bz*R4pM^A~1mt1ZPAx*oANM9t&G{YaY0=D%Vv9;HrIQDj3Rq z@3+oUMw5oX%a=fEsUCf#40iQLM-~SIg&7}c!)ymFGQNRIHtrl8DHhth?$@Aw+Gw==NeSq6=9z%zf zPR>Voh<0AU`Au~5%7FgT^PvvyM3Xi1CFUQhJD1(?)t^#-eD{I!(`^Hb7sEZ-ibxNW z!Up|YAU!>7HT%9st3BZn+A}2jYBlN)^lmIy`&?aH085pIzMO%~6cPb7 z-c`B`?4BXEYydX-Oyrn^GEca9BQmn4pPO|jPpR3CZ>d+mCK;|Y0()NnblZqk!9di- zqIt>%F|RVJ!8&$j1xR#m&ijqpfXd*a1de=!Ur8XrXmw~?sy7bat>mF;Z-%bpHN&vc*t)W6&eVQf8Ey7SrCp8?s~a=} zQ$cq@G9*{A^v4E{GDD8ab1A~-R+$zCdE!U9X{+AefzY+MaeHIyZpzhH+8JNAzpk{t z<8^r~D5!qO&J_H5#YRZzGpOY|^$>@m&!J%UL^RyCrCSZYYo{_SI3cIojc&-W1Z2%% zM}tJoR?Q&oUPH9#$?>Z9C%SK}U~|*W;BvE*Oyg{YQ~5JdusYgZH!msu(WmvXu;)2) zH6rT6Gsib;*ZC$^>b|k~+u7UZ@kd#>l*UAu=lblM>amqob&9DIb=EIl(-Xrsr*cu1 zY4a4U!KdI3!Y}(6UKW=BT$FsFmipL;7_ZEI^R=h^ za!MmbeyiAf75&3%Cyz`MUk#~Xo8-0-PCBUr0%?twojL=`UEoCvW$J=J;6McYD>Kmv zIQj1kY)FgYZY1rC2_&0S{Arg;&j+2osLPat;(u z?LUF2aL5fJ8wTx=)iDXN5WuU|D4r(_mG+SV?L~F2W%ELEUZ)jyX*+o zns%pM4L(})uSD48ke+6BU)|8@V0uW8kAEZeq9dZDg}O(hg8C=8NA{ASb3sY(;=wR5-W6sOFIx8&+_Os$C+W{d|d zY&A+Oth@Xp$UI)<6KI_njpyo^^+&rkJ?=YCE!wV8rf6SbJ{)3Skqx)L^Uf6veDgOE zPDeqjeIWbviQUC!Qh!2Z;6y*uE#J-6O}qcHxJ*DvxnfSztn&J6G$x|=*OpW+lZ7wclNaG*cS6Z6M(am+@use zaGKDvGbn!X%cJf?(X{5{^731;*WG!wN~AUh87TP*tKH`%a21|flhbEu-&N0uc0TZ? zn&B{@xY;o?%O!j-V@eye!CJ_x?h*cWcvG*fIju3cAm%e15l* z!z2@>WHY%eGA*BB_tjVL`rAvd$Uj%-YBYSVy6&ODQqYHPD5 z;ho?C;KnGMwIi8ywvpG1RFRH?=Qa!1qAiiZyP}vTYlpZEr2+3aj#5K?M(TKFu)L*` zm_DQPo(E+ZA>zrGz>=J=!;AvtVu%(I zesI-D_t(c}<@FV=CjEC^ulFMYRpSqlL^Vq@!Bejr!Z|oj-80xS3y>aqS5NhJ1P+g) zH-gM?+UnXmzE+zxoF6A+lmmU5a%tes0jVriH1HC}yRv(eey_3dK8s2A1IG#VaiWL) z$mrY^>ao8may;Zi$U?KW>Y*Nmn5i#IXB$&4FCKhvAPRDHnq&+gWMous>v~*wM=mB% z*E;7-p}rw@40Xl%*PGo3HZG0N)W@(LvDucWt+%tN$^cXdo_$R+S^erT?e_O zKKH_pE4L;#Zs|Le<%9kYg@K`2kJ#8yt}+<2@)UxRvXvPSd(B1&jtj3yUWPY?Zas=` z3!nM7lKv6DoV!#fOlsgiHKHh~8g=7jmN`-qQr5)OI4}`yKAnFoN<&)#c#cx=8Fm69tl3O<5t80)cO0hnzduET0JENRY+AN*Kf>*FwFvnU)Nr2B%6zF>5NHl zFsG@g(Km*6>@W;EJWX~Yd$Lz22rB?55k6ZF{-9hXWx`pY;hpe4xw)`3f(xvPbJ++{J~vD zZzA6F{fohfjdeOt1xS}lxb(oaJn~uWd?mfgPmpP-bJv9b#$^j#(Ua}N?LN=(do@s=yw$@6#^W{7``)!Yv6LYK z!mVJ3E5cF}^hXjROwa8<^gkaQLSo@Z{3xRlss@PNwOm~zslG|EG2mwY0doK2b#KP| zmdhe27!(Os`|J8hlXe+y%Zn!oTxcZdTIG@(e(F|a0NMCMsH>VAySZOz)};YdBZq+C z294Q0IiFBhncsSrPWRy#qvWmf@5*L=KCk!8SouV33`CrXz~WrRP4%vHayFG0pWFhM zZR^{J^z@9*MB*H*MSuZZ!Fcz1rvAUI>)qZb0AoXG1RD;DjKT9MZ{~rI8Ykb=?9AW@ zwzx6-w9eguXtTL*KgaS=$k|^!`>UmG*w>BE*)v{@W%B>K9e=wIpw!F9Q3lR{R0bPf zDhmaRH7Jz$U>%7ymjZ0*A~r#mhj_zFKDlAzg}l5xSmzyIz6|>ilWR{@SlS~*klnwP8a`-LdLxZ4~Rg03jF*mW-8XeH;UWA z9QpZq9yoLX`tp$?0E(f`v;@GVHm?Tl2U-aUwaQO=McWCw0+?mDK;VXjB^afD9p8EF z5D1QO;9m|!H##I(c0By$O*M(~Y|)kFWRAh3@%pY!pLm03X}mmlyyzT8cvmd11R>~- zp?00npIz5!13v4Zk>&i`gbkd@Y-St1HLLd{&Ws=avR|u$cXlb4_yM4ze2ov^0Q11C zNJ?{VB(`{HZ$oAUQgrD0l>pPYg=x!MDmJ8O4rHNYG;{3k-xY1te`c8m(q5)r%Y`Uq zvC0LrrY-}#Nw{mmzj0X1+eZIB8^`|WK!vITDCD-cI_lqYe)6zBc$`M_Dg3t%*{|m& z-_rQ=;B6XkT!Jt8d?ka7p#dA>^bdI{`2QWI!LJkH|09;e|NZXYGJ3zp;a_G++qsCS zC=%FEP%i_qMW*hQGCNi#@)wkp*+zi$5#&`t=Xl zlarG%F)?s#XjNGW5DLSR?jbDbsN$L<2&64%_tQezasPhe$v(*Qp>dB-0k)&dF;;;s zkpv@V7BO0Q|NfIJ-JQ^CK}mIy7E?Oc@BQGvG_AhXlJg2#duL;&i^nMT)924SzJT zn0KOL;ZH-XY(COF=2jh@%?UK)@G@Yy`tSeK2b?Kp_;p@U)#irU;+&7YOok8&GE*kp zv#RcuCfa+3U+{Gt&57%u|FNzMAYFj-4_|zfHRa}59VVm7%*4dTG;8-V+{XctmEU|T zVdH^|0Ei9D@1giFHdg@O-PhO0X#(;ygY~_0Y<6C#ry`KLui`_?Sul6Z)_MEPpDQ=z zwh~z5$@sE3tVs$rqGOukWC{AceLKsb>FlXl;{XN;B`GP70jwi->J^4Qb+KCP|G} zYqsc~`M-=DrvNzh9gp^D@7?S5Ny6D#*HB39qfg1~=jfnVaVl7UtOx&1zF7Np-Ly`r%_)70xZ07M zxHGu|U=yu+(j$B5ldZGlNWy!#1`p@6NzAj>U5DJM9Jj4>pRzx7@9f)JB^(Nfs4K#_ zd+lL3TERk92B=QH|Fa%r8+-Es(t-j(gP6qVDPeIPh#iG4#i##PNCZv|ZiC6(qAZ02 zH8q|kdDGXpA#J^WzwaGzos<<1GQm!W;)p0Ge3;IlUa=D+EiKJn5T+KS1lSDXW)eD% z9hcZnsrzz!^GnbBVq1nS1=7sBdK?Rt1`pho_3>sbmwL2s-BcWYmR@A)BTh^Q@hhMB z2?2G%f@^t0>mN}{!^>`!%T^*S;8H}eJU0NUGQc1ir&EEBlITLU>iEFlIJ&^J=_(@) zj3?v{Fso>A3Y~3E_X=TT8Bq_1k$HXXwVb-Y8JD)x?B9DRwy_v& zv3`Z4022TfNot@eC=1x@7sRJerKM+7T@A-@brEFOANE;tf>0IDW2=N0>MG7h+oX8T zwUQZkLA1hxSMv}?iC;4x;p_ClG>2QHy~r3St<2PJjbDVi?^k8awbLhkq4>iHWAPra z90Cl&jO%tFxX2neSpt14IkN z>!2Zc^9IO;jA(!Pibn%Fa3Kcx%<|lDi zH)5|GtW{cfhm`PAtCG`D_;VR0F)JzNjtU(5M#TYn%UhFfI|tcx{HG)}rxGKJw0OZO zQ6%&=PRLE1qcm+&q(erU^K1Hb>d>l&yHh+?OFFxH>hI8l-xVAl77U(|D5I+i`n-zy ziCb0Z%Sme%|Bal@=HPV1*Eqc*88vZ(H{8~@&8k;3OK^l6lHbKp$~dRI%gWEYX%BS3@HgC%qhSaT4eg?`a{zlW+X;xn6Ye8*plCT&aVBQ2a|N|E6?}qN=JYAa$a^ z&MhgFjDy1w5YCI-U2$yk)3We)_=JQ5pn!T{^JJ{6zzsvn#D<8nt~#der*G??#WtZB~}9N1r>(8DcGJJzr1pb zOWLjxaCKPilV0_O(qtcLaHELO);?*b(vx8|_A?70io*$-bf)4~Qx9^^hNZm_d z`GU^MrUQHC8(svar`L|LA@#Cn+_Poae_XZ;n3q{sZ3-avetll1|Ds)yGN+qA610L| zsH>u1$H9@8OL42qaOgEo!)&!5{jm)WAlA6eXZWBCn~-Xi5r!Faa&l&)E1pBSu@_{I z{F-oosKok>fdpMMhDERL~RwIdZfR2k1#$|THI=hfi~`wb$$^HWYuCyfDo2!k8f~U zWFvu&u=LFnaxxxP6Ip{mQ?B_B`zr(5rtbi=%_m+rLONo1dN#x8pYyQQ@)iL*I3}YD zUIgl<-Zi&0kn59Yyd9qKxhhP$xCZDA6J6Jaa%r8PNV?2C} z1LLh`2q?yvFV8GXVFA`yG}6%5=LwdV*Im7zz^+qS0URy%r5I0QIh(VFqT49fSwi4F zrZ9@1RWwdVkp+@)*n)#+UT5Q_TD}icY-*>6d}K#26gYwIh#eEj$6yj$K5R^HVzet= zEfU{slGa)M>=U?&8I+2M77D#wK5Z{Dx1LS*h#uQk6&E_XSZ7#rdPa;dC#+q zA>RF*;D{4jh11xu<>l4}I-Z>eCEG{o(b5y5-I8@wdPGf!0sHP}@=Fj( z9WM%6Nuhk2UifhM%9O%x)`N@RTewbgFidbB?8EUne(y+ZCsxsbzydcjl-Vuz9wXqd z%1c)@5tbhwT%V9wvyozQ9=w#fAG9VZX+oI2y0=_KzNAbn5bR4;L{T+_Jkn zIoDA&4StNTYH#&45~Z=`Lqs7|)ZK#=onhYOgo^CF$HPjH(Snm3Z0B!oHtX6S2s$|( zzL~A>;yTV|JDrl$bBzA7qyHx2#C<8;m$#eVBDvX;ByNwbD%`|!J}BM1X>gNBYG zdy2U&d0q_GW-=6exTjum5uZywHO0Jf|7{MrZBn`N^Jx#)@{|mhyfqB@$b%h&8ma`z z`Mg*D7YbIlVtH<$Vqt6}QhWF_4fwS)9u2^ZT8?aNw?BA1yWku713T zxLRw`ldP0|^(&y`7w-TxeuzKrF466mU4EyL%kS{?v4`or0+6DYYqPS?4__dk$3Bbe6N+sbG4)pOY|wU0>eRS8+#kRrs4n7_6% z#9!U>Z!8xN!nW~(G%QAE?Jh$N4Nw7Z{Q`(s40li#?PH2k&8wV&xuV_P3Fz}>cajX2 zw(v{2sqL@6uYh=wn^G_h)8yNFm~Zeq+)1}V-aS7)IqIYaZcUmog|N24*c)q6^r+cN zY&cn2Lk~uGb?IUx$$l?>Z+oP*p^Mi_osSz!FIzDLfuf!mnS(5Xy z&Ar>9l*E+BL%|VRxD_b+7Qlm{#DZHb4%SdP$knP#k4W5tyM=$`e_)F^jVBAb7?bw+ zagcrvU;_ZIq@bdb6W4%?@5d}e{cTIA(2X{(=7GxZ!NpUQ_~ zma>*z5=@gMoegU_gaiz0?3NF!#S9${viH`S{qy@e0uZIid>e@VCj-qeW;GA}{)lPEMS(B%D@gNxMJJI~5H4+@UIG zsqbqb4jT|t-5;gB;7H2rx?{JU{p1#n?a7XT+`1dS9VQEYKZH5UYnndu-GUybV>`{ZXY5zW>Wo8-T`h8dSp#amm&O{EOpt35Ruz0x&aR09TQEV_Oy{4kLLPU z;xH3Tl8tRJPwCNrM|~`mLKOJp7O2~v$5#pmZajUf;*N)pyu=s;qr}sp;}?@9$zN&;j3`E z18n;Swzp2QXWJjzeV>gDGgbI#eFOJ(^O8pn%w35`P&>cGT=-TC=3%9PlWK$?yg1<%(V{GM&KrywctSW?k|ya!_6{42PeQK^eA zFaM(#`UGulxWs&*w!8@p8S&Tc|(Yxcf_Ywb8xH zHI*OA7w4saDmQS9hd`Z?Jbr+%Yw^QJY9ML%U(8zjf^nubnd}Q$Hh(b2!>pmD9YD*m z7)b(^nIp|xX$9Q%cA<8Vl9EzbujVa}e$^r&(E6W1JfiuA->21x)7)@EN-SbW%>n8|1$8|R+=1tOt?@%YOToRn1eDQN}>7@ji zPPr>pDv7j*JZ-9T+LvW+FLXbi=re1O9GBOPp?dNBOQ1_|y7OUrF!ctVz#&YA7}O}< z3ly#2JKP+Yv7Gie9xAS}p(VNj;qATB`O~?!067IHzBq_+297#Vb88F`o-m782BPGD zd{-!;nPv2*l+%X5_tm#=DbPFV-4;Ni*Cj(FmDK)4_Jm4wQGiaXObj7$KzMz#88|rl zVFSWhkaE;O8kXmCPd+216Y6vH8daVmR%$_vJB*ujWQ>ex%}-)5YQFV#O45X@@>j(0#YPm|_tDtO=v9*6d3?5hY1&4a$F24iXp+q0 zRj3<_$fen{>t$oQ`c+QGxj7EdkiA9$E)^1>PSVrEp-}ZU%HxCGlb>m@1fa%7DamfM z_rM~C%LhmRx}u<)ndOEm_CZlCMp6bYaTw{b;2VriDvc&W-FK_v=Hj4oCI45;h=V+o z8Q^Rl)@@#uF8h2nvjuOVWHp?3>b#S6-P)|4{n&&0qT`z6=d=SU!ox`e(eUu_QtLSp z3(q&>#4{^BgTp36#ao#TLph{W&$iOiroUsOzM=pt#P_deljS^wu@pW>)i0uv{uFF% zyFl*XM0o~GN}>v{jrk~OLBiJtPFJ%2h_B+m!3DDDpxw|k(f;OLG+2P4!uyTrw_oxG zpPvk+v=f}5UP!Vr`y8r{`jx9&yUz9c-|93+SX>-Rz!~*c0ukdgk+@+0(eASHv>S{e z4%a%s{lrJTGb{B=S65(AP>Z-aRM+=*6W5h5#m1A=AsF20pi~ zoyw`&_nkO66(tFRRu@|BiIi>eDgW{A;i?A%#+vXjsE6z?O-UeeLKrUPxkI(3;n2_x z>~!>6gDl3&tU=jedTmC=UB^@F9)!uW!Ow2+iY{($bu(uSXQB>4sHGW{@A;pB2tmne zU-n=>9d1I&ccE6*Pj#3--Xa>Yw(#Tu#>}ri_VNMbi9z@*)zHfZosY))oIp37uOY`k zHfwV8{ZfbnCaWl)Mxee6#!E89z}h%Hm4Gu?>zQ9TLwJbUD&Z<>< z%PxVkh0hnQd;j)O{hkdr6GO{j^Rspo~S0!BI{tVv*sDP(~? zqM_krebTImH=?T%T5iTtm-Xj%`Q0%7rJnp-YwXt_gwp)qzeWuNN>uv)iD8j#1u5U% zj&xZt=tA|J;4{gEa`&osczIXmpZU-7YT91{m=&}FexY(c(4ml4Mn!*|IABgd#jRe0 zpqUZS4xz0d4Tx_$!v4DYXMX{zl3v%kY7gwY-te6L-}LYLKUa@a%K#DX%qILA2Ws-! za~I1ogbe>jK4BXF(*~A4$$!AS{@FrP!IlP-BUHx<8vaZs z&07Yjp;IAevHQp{06UwA%|>5X*qi-W<2^xECseh|b;x0qz?kaqN!WSw!i5U}#_%mj z#Z18hhzUwA;6BzqaRrznchTZ!$%3>JF*J?($PM7s2Mek~&6*t0(@F!Z6ZGFeTwGM?imfQ%kdS^gFb9%p)38{fxbV&6=|6TP;7i>IGI1EB`k3PnX-r0vob8~7 z_9lR=E-&u^>zz1R!u1z$o&FEpxA1RKm9n06uu9Ke$shLg!~pUS^8(zHAbED`dg=1!%qR@MG`30vpDE$#+Qc)bQ>gnX%=`XY&c!^c*jmZi#K1g>YI zC7)ojfVA=H1*I$FWTU2*5-uSj%hx(b=xKd`yGmF@M1j{eODY#zorTYR0GeH)I3An$ zdW@%_XZY;dBS=Bab-%oI?vCfUO~HiWh1GQ_M?F41-v2lYBy^IXC8jGXrw6sd8lxVP zywpx|*&;~7i1^(nXFQ0Qcb2BE7}gYw->X3elyO zxul(eZKS^g<`rOYL|DOi^yuhG=Bj?xi1;X&pcvj0T;Nje$X#&g}hATvAeSJKV%V zLJN-Q}^nuNP#ZU3{~f?tMEyL2Mg?n3-?BB)SU)Voh{+3|6-wvuu?JTRE4 z2WDPB|M?y4K9&Sxg8RX{IyWwYd?AJWcPt^`*%j%vI&``$K6M6r@*C64S-;Ro?55=? z3f6OIQc=z)CqkvGEr5OpxH2d~M_}Yt zmoLubG*Zb`SU34tCmrY*$S#amappzTmSZ(9%Gx=rYpDJ?WMOWAAcN>m8uUzPa6|3Cou}u$r~OW` z^^<>sP1xpd*D$%b2Um>H63|1=7<`L(!vrzQ_0T0smAyT64~Ody%mn^}?Fi~{;*wL6 zm$zkQ!QtioU;^0Vn7&2)C%!mE7-*!w3-2{x%Wgk+(K!aPH0`20nBHx5&lYRA>fU}q zixi0Ly*}h)X4aR!I#4q*R$5U{+pb-H9~U}W2JaD9i~RAa?yy1C0pxnx6jUAU;{T9cs@ zcPlJAC`*oiu+8L3ej2A1vVwEl@bi+ehhOgi>C$6Ue}gah81sr|TZ`2XB#!1Uf3ijtp9M5h_u0SO$}pKM?aP2Nu?6$Lbz(k zpkOi>d;s!rp3qCEy~q^Yx^6IM*+6mMa;848@Q$^$+2CVu)|yG0ITa>OtFMn5>fNXu zDlAr%%Crm@t_zY$4gNw|BBAqpN+KM&k3?$AF}%r|{Hpv&Cql~C4gD>3(4{kD`;R`p zCdRmP9gmDT`2l_k#`!Z|LN?g(ZPzZ2MPQa(n6r=7KA4@`r`p(?Y|W9rOLie`{Kwp~ zf36v~{qkVHo0fudP&p+L`BJCb8nGd-{E+|DH8tq|ogi`qU z_Gr%~Es4+$<(y1>D@&HPIBM`+US19&PP(FTag9J&?jqU?v7Kf%6P1ijMCbAjKXLrA zlOdkCDggz}Ib9jvYhfkB5^)g*hCzzxTcd7ZM6&Pl7NAqBQ@KXInJf!E@kdF><5tUi zIFVm{&DITQ!ZI#$g#;FN8zo77%r6hL=jg?6s3~wS_s>oE zD3=}1Y&QL9n3_G97eS}NR2FPs+Kq>=*FShO1 zA{RVjPphg%8$>%t@#igPci0@XM#&x4(X||+mb4v%R@|PExQvNg2z&Qv#JaRuS{W; zBXZft;hMzyU*Cz8|W79*)>G)L2H0J~1*!-(mON;(MEJ}l6 zoeJ@ms4b88_%W^8vU#q^@$oMtb|oW?&4<>aaGDZ+C?rG z@ut+Y!2|HCS{&Vcs9phnI>!{$qVjA;dQ+N74jM|s@h?ebFOJStU%4_eztHW7ecjCF zlT{`AQp?4#l7PK64Gn|UO3l5mWa5btW1WE~i2n5m3}wl);<2{7%Zgo-3B>bRZY9%g zJlF3px1IcmzI)LGqT6&5`%9t1Mm`en}@mj}fOZ+Zyltd*oog!A>y zoCw!iHGh_AUtM5Jy?h`eXO`ji-C*pwA^YKvoAt=k9774`RQ#XM;*bVvw|&KN?k>zr z_FkB58O6aMbdgli`{CU^>}2}`A+v+s`(dGbbMQ8OAgm_rgodER4-Q6I#r!y{{CzV< zx79r~t5a}qKOc&fM(xk@55T2LlA6-MBp?m*4X?ehSi4#wyuGuJhYPLCKuaJ|Q&G7vk5>|Mtgm^YH}qm6_UoGc`HxmBeTOCN?RU2mxwG|D_YQx= zRX^80Oc8e4V?0HxG00ONp(n+?b+XryuGh*(Pydd^sAAWAtw(iPyKdx3rNzWTfAQcI zwaSWgad1&)s67D7YSojV^uHR-XPfmj4uf*lctCIWSCDaTW zFSnI*4qV$*TRC}8R(w9o~ZVh-#Z>xkAWRvD;7j8Q*1mMTz zL>mrJ?`(_&r(vS~G|uuLY>$x?YwyPs$G_&XJR1^GuH_%b95`7t>-Da%Hm~~~SJ^x8T9_3~%Oh$YOFHg?6x;P_~s1B&PM^lO1 z-ri<|+~v3GA`>-L57YO`!SeoT$i}Oj>gs9^W|pbvjD+e>!$}^{$j>bveZI@>u(LR= zX>b*vN32e_(xJ~`ZKgp+zI>=7ioOnf!CnY+5%~MDS2=WaC2mxzhl`KRHu;JM;T3G{ z_QwnQUOl{JOkLjNgFPHf#8+nAgm|=*{0U&2CUTp@bjRyA`b?Limu!D@8yFcaJspWH zNlSiYWT*RBYc!VryA4vNLw%EEMQUG@!ywa(xD z3it{5P3PZ$6rfo^feAEptDhRDT^@{Ycs`v+>)BOEuzXfm{%CJWQ=?XKgjLZ8#`hY< z-&GvO%wrxEp?NxobE20I+vxhM!NB-BZyNG5%q@8gFO^n60Dw8RU`OY4k zugQV`-It-2S<^<*nHU?3VWOdV#tgJp^G)KM6XX7UTAg`Bs9aoFyILyO$c%>8@5$G@ zTU>y>|CzD>Dr%Wg8ld&=EgkLn8Axp1{;~P385X)$t?o%bIv10wGwLQrEl&7&iiP|d zgo~&j9#O)3jKbfdezSdzcl*W5|L-1g5 zi_@{~-12au(*K=t^*cwZBtgp>g`H_A@scS_tlemCT>}31+-C z+63krlXU&}xebGEJokUFyj){1qTT8GIs2~V&$N3ELR5M(6xt5^dMTZQKvMFB!hik! zxD4ak9y7HcJR01go+1^1*d0M25U*YxUzITmAYd!m^Cg|e=de6Ib{Y?U`^ES}(#i^{ z0}Bbi`|CX z0FIxpR zRD`<@4nZ%8dnDg1y0+FEuI9ZpTJ4$&Mx#cQhCQ{R>3ewolR44}c8l>CJn02c`~nQg z79+xNIkY>8WB&&N@!1MtD$On0Ez=%XI14^PwMchBwCWy&4k+sG<;4zU%J}mL!kOF- zQRcX`Qq{fZ0>gx{GafU>ZmcFS3(ZbfaGJ0O&QTiRuT3bf&LrXO)}V{Ek2kv0Xp|bx zznOL1n3lqSJv2hSHe)taMWC zh`pr~C5OFafpgC%515$t>fwnKAgj|O>t=#NN>Pf7M?G2(`y(H%?3`kh+(3sVuzfp_JUZXU?!oq?GjU+oy5)&z{ z*GK`^#k*aRg{D(1Ly2(awNxk)?LbJ8d}pTNUNaL-=|DIt40zM^jyKmf6KP_&YQS2G z+xP12Y{cJ~fYKm8ll{T{@oV*N6p~%)aJfy5WWIBKj9jj38KsQ&9QDc_nv#o+>+(<~ zS~&Ya{d1B4@z=EXG8Sv)7e0KLs&?q(K{$3qL8w-fxoPjXeiOG~>9D0JLm;k?JV{gB`qa;Y%nBR!RB}`crlk|u#EuI z{LQp>gZtD1D_2ZIK~8&j_wr9WpP`@H$fE{=!e%qmZmC$F!^7@G^IB5_gB%}%xrV{+ zSwqZ-WD$ApEVdir9y1Ia&!-2YDJQt{zkhyKaI;CYq?x>cZ(rghus{|91`1Kkk#EjRfgb0p5A72q#J zyLu&$+B>Kh0%R~>*r8Fn`5|GMlkQmXN zaXAm!8lp;K13g+kP-Mp5rqye;g|MzXp51Axx*X`IeI=*Yub{mt2Z`P#isV?GSi^zN zu7EGE(;obaNir>Y;K<1qjA7Ang+zj|BS2D6uxVA5WhfY--x>s+AvbXQaGz?taAj~c z&Q!DfOZbc%@?>c5s0&U`h+>v~vU>^-n@I-dxL&9|C2oXH@}j&d($vR)#_e{{i=5ot zA%BpdNb)Ff+Ic=3#}?PMU^iE;wY$%!(x9dOzRu%V8>v?B8q4JinO#ws;vj6Z)_Oj} z-j8Q0-c)B0zv~_?v)1cpyjLq6mU7)4!~-cu?VE%l>fl_`o!cegShpyDyPFVRVVjI!{t`~F zp%zmR>}lxbf&3wx*%WI(&vEVcZZYK1@s(CD5fi4BI!!*+?Yv02Tku&8_-rzbo8Y6_Ys7kS1k}9FLL3dcDwlHrPEvdiBUH4@`NmLki^Y#|5bR4Jb ztzHSE*yU&MKXCKz_7ie1obyd^@aq<;bU5KoMm{%*W_xAWn?Nuq$KJ5n!)X?^pqF>txJc+PhH%>}fymxewDbbA$;&uU$7nW@^;L%N?tF=!j=HLeli>G7_8EHtAdw%V^T87QMT zb}}{XuG`V&u!z9Acpm27EIR6RFY`nr;*JA$vP!P0At9#xN;cL>WR8XAgP7`*@b!{M zycQ%4`N#NW&m0`0NbexJM+QgzI$`V8I5_EybPG}6Qu%M}y=PQZTbDM9qGFB*R1i>6 z5D<{8ARs0rOO~u4u_!>vu|yOOBA`UcNY1gyp^z*&=O{VnSX9-WC7$DX-|il_?~nU^ zKf3+r7!>T^=l7x454wYGsIMq3Uw$qcIEc_pQefHF_5ArJcTe=$LAHI2mbPY6s(u93uCic} zxJlTJEEf7+m@q`ClNlYth*_$ySQT{VPg4q;89K7)$a&-pG(2x;jdb_(n+{*xxz=G5 zhkPY+ljO2MvTCkkz~&#C>$I2u242E;9>I3;vN*ZDI4XKG6xxy#)EwOu==*Ax+GR&P zVZAaOV`mQ>qG+j~Vef5P2#OBGvA%l#2x{>qF4KF%s&8$h1q!TAnF~u=y9XJ)17@jc zO)D47v%%4ZNh>_o(V3ar)st$A11)di-FyuoOrL2NPO3rI(qYk*pR7thsk|Y6UZvQ! zBVL9s#VRG}zz>#CLD-lNZ6u6tZd95eu~%kb{Vj}p<*QXXf|wbziD-v%^0k1A;+5{HXUocRU+a`KU54oOR~2HN3@+4v<~kPol_32J4*8M2R6igXf89h zU3GJE9d+{I;C_Gd+Wa5fX@_t;CQ?3P)|dm)-P4j`Ikst)76(_`_}pvaqyn{atqwLS zE+@Urws6XBv7zQ*kH1#IZg8v&X@!Rkm6?mrh`ky9_z=un39U-_Bs189JNHLrY7q z+D75SY#n$mL<~4Uu-SSGexnaHJCvpg9j#-)?ewd&$Q^F0v}l3yB?|7I!-_UwgUXl* z=w&go71AGm1B@eH@skKus$n>vMe9-Nj_1CWa3n11!Zvzte=e@pyIX8ctN0axnE=KkrXR+)fvRjZnc? zO#i;=&E3Wve8Q=k05oHTR#qrZQt_bsaB*V!k^7m?qO|87tO+V~O<~+})gOg0QCis) zxZn%MF8=g744$+mS%5umeg7W#DKs>O*$;yaYKx{kz8LTZidKdwQ=62k9WCq7(7Pp@ zF}6t5I{wKN8_U-9?z>Lf_bkjfpUI)8v|>=@T?bTUh7TVgiFS>Cq3llclH#7M|E~!I zAy7zqb*V0tWY&uOk1^U~8Je5j$DLUHEzYE9PwdsA@MdBydT7$0a&cb(tNP4lS66|> zymvsZDRu)DPYxK`9Oeltc$6h~pu*qs6+F@)V??|rU z7taUO9-ZdBtz8=P2&)pV9=zzWQ|)aN%YC)s!gVLt9ZP519!)r}&xSk1KG2=$hJl0T z?p9@hCe6Z7S~xRP`qkxG?L}Hi+0JgWT1xR+u1ut0+)egf>?tQ+WWV+1f_m;h?y9;E zjil_vkhkvcS);I0_K1S~i^+_;bk$YSx0U4`w^|LEk6v;jd4oQ4_}?Mu4YT}c=^BoW z2SueOHufW_LC?;&6l8l2eLH7CkiDkk#DKb!7>9e^EMP8SIp05RrA*44N%lM@&w%-I z(IZKoxAAf*soDN~nsQMc`PCzFTNeY65#$SD$gwPJBD&bPn6Ip(&f>3%K!sh8QA|`o z+-g?SdY_kl;K2U3OFv>48bblHOvLvdJ>jCt&8YCqy&veYl=(0{!gI105n()DLyGw0 zGrw9zmKL)6d=W z*1j!VKXUhjhJ3__^+mVzaQ$s{#gv+XTh~<{hR)o}^S@85!3Sgn0$9{{`skBYrZ+vZ zTZt`rIt|41cGnxW!OMmR@KGwSZUc@gDCj`u>mG&pkyelvRb40@Va!+ zZFW<2KD&)%sb@-W#}^MC++Ntt<}18dCL-m-;LhzHzH4ZnuehgfHlnaj+aMX#gaEw zS5^{NFgc07mmij2R>^X*Q5xKkOw?>|- z9M#h<+PS489-yc|EdZn(uoylJm{}|36gV0!T=xbucHaMDor~?}%=UC#c>E2Ip*_@C z?NsN_cIWLKhaL0H01bJ`{wSQs&Z^;2KO#7;^3>v~qEo>VGrIhW3@3*1;&?|O0heE&;M;`<}C|M1-TjQhJZB~6R-?wGt1>+vy( zbaFUoz>rg&VW_rUJlN zoTLakPIO4iNjJDweH5n%1@u|!0o^6T|Dq(6(JJA-Zj{1>k5fi|EqTUrNtLCowd@x9#3i9B;ui47vx=NLY8Aemp^Lmy zaYf9+lZ|AvU9-Cls(JTRzxK%QL*@lvnf~mv^HN4<4HCU9ay(I!p@3)HZJ{N>ABO>b z=%2XxNnmImu_PFeRD@ib^_+>(=v^sY} z5>y3?4?Eg3Z+hgaxV>hF-E7?)Pd_gf6RLTdQu1@6l|?-p|9FYro`82yN!VD2IHME} z?Z;klcuTa{1~xn>F3&n?CgEVmBlPF&?5@{llYNH_dlKYgLj)~qEfO6(jAceWp3kwX zK0u-TF^jD+;sE1kXK&88VHbmWXHQE?6iT};K5D?-ZE551+>Q@hqu^?bvA10>P$xb zL?Wg$@|bU<`#rj?0RB)xzCUoBtka+A64(@(Anq3VId^$n4^pCEHf1%L$9H3d*pHID$#MP1htRL=1Es!#){4z!q{LwySTla>CHIS* zv3h6|C17I05Qj+aQB}Cw{p7xhhb~-IKWI_>ghRbkH2sTxlT_? z(oDbn4>Xp?^WTXElIE&q9ZHfnT;>1vJ4s1C>HhOBP~~d%c)Pf`Q~(nH=N*US*>VB) zH|Phy(0TMLa(Jl)nXlg@CAoZJid20MfTsHmK!=w|r#;KLhI&N9bbs?dZJX1XO=47(lxNF< zd&yaIO7*fR`-^P9xJL$Efk)&ra!OmBcEN35H1*$~tVk=h zj?l9U%RPEA*K``gc^C_A*9`%6pm{9Y8RVQLY0wg2K)qXlCj#_E9XTj%E6WgwE(f#| zHUU~e`z^pTWz>1EiU66eFZf#$Ax}w3xw1MWN2cI_|JC@roS+44P(@p}DM(pUGyKb9 zhT+zD0QVwB6VBbd;D}Du$mf8b2>KIxm#8*fpG*qwttjb)vJSfg7S`6T-$n(BXcGa( z2J$_LSb}D(06r2Z!gbiglnk5KE{xi4BRL{x{g4J<05el^g1ktOClJnGKBr!AC5996^R92 zen_x*sJ4-YOMlpdN{GH{P*1WwGHY~XK25jaC#-HC+KwDK8$=13ifA8{zi)^TN|3$T zNaf)%`a`l;f0GtJ08^pn7X+7wakie8Z=4nZ54bZCey&&=UA2xn;GNk{gBv`OwtS}D zDSB=nnu}46Kjf}Wq)GT7^on>Bl@zxhe!e{yC5Z}#3f-o#j{G(P7v}~?kg~h}w+d6B zNq*5{nVoX8EUE?OQ=h)&8V`tl+=&7bYN)2Z9%YhYq1@pmtG5o0L4d&@96Dt?^PQpn zD+}vjVpZ<8x+^gQAU}UKe6c^FyzSzmRM3Sj6w7=p;HSr@2z_#?^MU#Rxv(Z?;pZWP zkq6lyf403z{yKM@o$?~DLEiADhx(Gd)np?K?n(6@FSZR-x%e=4nAMJb50XQ)9Kz3{ z2wj~&(gt>lN2KyjmVwD0Bvr6m#3=zj9Gn=nHVX%fM|Gwy+eS%dJ*o(jN3_^s1Vy}P zaPz$S97*>f3WZ)XZ}DYScZ7WG-Na56yoB) z%nX}kVq&0qp%|O!U7cH7^k<s}Rxq6dCp-u8^^Fa4bwxrFf!UxcZAH z*F0s4jGV=vGxxGZ6TJMZPCA<^&<@{vQgCO)ne%Dp;1rj+vh2)`(Bt2@InUR`83Knb zVn&zei8i*5;`mc{@;weBNRpZ5MvckV`1#;JZuhPaQs2_59)luCJaO7eK%N?%#;qXo zKBZS9N431`glb`mR{c~9kbr9WTJM?CB%9?M61KB_8;s;LgTGNbZCH`2jTF$&)*3N5 z4l}V>auu9=@i(CU`S^bgs1w0X!xtzSX`$DE= z%WCkB_0qBR27eay#FEb5?Dvjj3eJlksp5KIUsr_w-TBbTr%IBz@7PCpTj&<%=5DSZ zM;`LyH16+Xdg!2?8r zeptasrqx%kGAQJ&WCreg0LyR6nOBm#^8qHVPXKV|%s$Z>-?cFV&0W$1afdE=0QJ2) zWA5W|iztLPselIgZM)8TXdmJOk}B6_Gkz*m45WB9RKW}S6j=j+wUMyjG+(i!!_BDr zhENn7w}R!wPxP6f?D(u(RdI3rab9Oq6p)$sLk;b>YPBB8Fc`R4q$p$|5Xo# zn+DDZdkc$frii16T*D$fi(1y>jvR-K%e`~(4;@s1?O(jJ5A>(5!G0*IL?071d zKSiG8D=_~kfR!MlM(4D$M~M_35_LdxSzb7hxbxgqxV7QPr4S}%vS?;ue)GnV9(+PT z0ba32dznNuP({I_vn7eyOME9eA-LzV$2^;AXWXo}O35#Ej&2(_gAhTWuzy;=OElWA zwY-!jZ$8b^Pvk$-uBC`9 zmZ9dev}ZMK-AAI868J({{I_OodR7o<8f7*_S7WH#$jkP+*To#`QEM^q^z&vXW$LDs7)_K+dfVLJJYUr2j|Zs%8>MN*vVa<#rxA+8~%#;PQ? zN>LAHg`~kkgc+udD!$2czE3^)&(2658#>Omg5`ak`i>kr{Ngy%^(y2?Tx;h*oPUAV z$b^FA4sM-$y|nzhd&AtKqQV0|8&J<>XJ_-!U#{#8?$0_K7WbX++0-zhc?%{PU@Ugi zIMEokWS z*+I>He14f(S-WNxP&*rEwI7ptS{}>kmkhOR-Co`5;yckR)dGtK7BubevlwRN=Ll@nu|4JSL+FUXRIS)8KE?vF#0t0US?xm)*JX zUjVH2yu^ODNJdmS8+Q@|B2FL~zOK$|mXqLoaM}M?=3u?-K0s z7lY}!4_*zNnx>Fpd(FMP;VffS08tF3PbAWg4_WB!(j*t35;0L}-f`_*mSf{$AF;}b zuz1zMA|Kv>X}S-Oz^_-JiSkm?8y4~}!hPH}D}_5%pxv7yYSFybf8O;fp4#{mY5#_0 zlby}?OQi2TigX_&n~93D9qi9f4R(M7-Yr^id|PGQXqES>^?u>R$G_v+dg%aNh&_+l zb4-#L(^CSy3*pA^=RV%F_!I{1>yKQ~|9p?SBF&{?7iyTb+3rqv`x5GK-`y;|hW4+m zAv;18r$T()QpfJxIR_88c}(VGeMe{gTSb`t?Ho=^?FL5Pwe|W#3&0R>2&$D}jwsR= zuT{nFxN}*S67g}BTKbC}4GqsFM`$;As)Wi0>Qtl&F48YmTSf)sL3=COnx6dV6vwg4 zzuKvUNm1EOF-x+C+Co$3Ji3TsJPFy{Q=83~X20}=ifst?542vuo>9{deW2QWT_=@u z`klB`0V}G9KFfLOIA0{OQly;(7IzBJb2xbMyh0Bl7?)g4ae~3ixRs!MdS$h$)kV42rCk;N)j{Hr$M+b>3~=CC$9IfIirW)_~nX z@#iy5E(j}FTg&E!Ye|q}2oB^rICB{t_x5-3 z-{}faeA0^7)26<^Db76FmHvJ1^7L_{jE1S-;#IlAN_F?5v=2V9MRAfh4R^dYMV`Cm z1DeH_Hr4C8AAgPs#&SML@$;H8o?h(%O57v+i{H@8%CZxwC(N66j~;HinJB9*syvg; zo3D4hsEU3zVu#m~^fQ+Y`bpkroL|nwt;0%#Y0@*aRK1kJa)jzgKiC_MK$Xi@+$~9l zA>NK_@MM{PGnl($EJ8_GkKsS&?Z0U9cK(mOr)uhIThb)6Q&Cf@f9iog=Z!4$s6#CW zI~z_5zBUi+sN~r_XU#C}_B>#@+Af}igof!@9UP_zvrZv5d*G*ETB-IIpm`DC4iaR8 zUU+(V5vAWch5PDER%kK*LugAGcf%nQ^u!ishO)xKC0Nq8ok%Je5l{rIX0UL-`juXt zAXHCljFam#M0DqmqoTb8v^Q?8!nSUwsB0mIeM6Nc*T|oHXh)d5ZW7D0mFyf@!wKm(KfBRC)^e3e#Bc2sDJmxA&hfI~ zbMamR51ZJ8Rb^x|;}8Mo8$-5PrVNPHQ;}XLvRsg#e>TPFyP>1=6KmALZqhBB$O=D9 z5|n%|O`m%UfNcAWs2}a^>58EPeT*PBkz7A7^Boi{YlM=x5CJc!t1*3gP*?Nu2~ z&9swW1-ZevPz+qw`pA0PAVR_sZ|5i?gS%l-+OAZunir8c6F*V^JupHlfG@stI@36K z2Ti)O$;`qc0Erv`frC6~nNSe2&cnR|uy}*%((w7ws^WPoTb~V~l%}3s>BW_m6_`V4 z9k+z(i0x)}(#b@(+7{amH;X!+KdWM_N$*)_#Pv_Pcl_tJr=IxDMCPnHy<6oS9Hcd)}VTC4j61(9SeY!)%7|3@ylb zZeCdZDw;X?XB)yZ7+2>h)+vVUn)>t%eWU5>bZPW2sR}+uB74P4boA%T)SpP|-ffvr z`oOgTAPvc&+bw<(&Kpo4Et-3;D`h3@?=|IpFnpNHY4oYNupBl|WxBXlEyp~ewtbr$ zA8G|n>B>VC$rk5r6yE+HR)Ylohq4sp+0g~>&zZeW=1*kpY-f~{3cEY9K+QQLlAr|V z5oE(|YACgy&B0l1DBQ(uF^~hgK9$bc$fL))+6l|LH|9g(eGt&JQRa*f>F?iOaC`2J zCNL_csX@CZ=l+rM&JP%5DWi%pAj2zhutmHCbfbNCH6YvA@Wb5YTjjr`-5#ytCMT)+ zqF0dKJf;AH&xopQt^f-^BGx&OAH|aG(W=N+(~v#H8_I9R%Fi!;%uu|;*ieA`vuXl& z!t6H}=45R<*j}M9%>$h4CiDH>>?mvl#iO;->g-2&^E_SCk`mGK;Oj~DYrkn26Fp#| zAX+ywRIx-GqhU8AfY{%GkfLt?0?I9z#ao}GsF>hOY_bM;y5W@_DZgCQ3j4yf^gAOv zQ)hF{Cgb4AZo6wpuwszB>oDWXza9kT@v3*UM0Gh(3yAW)<#jtk(*VvlV;H)7*_cFP zh+3)9irAR~E{9(E;OM9pY8HBXi4T|~IdUK*4W`t1C_vGnw%(;;e!V^Q6xUlGGtkZP z`OA}0U*Y?NelT!+gs!>!mA-hwSZ-z(Gc(5gJeQxcT2V(MTj)Um5eka#Zag?ha{ByV z_`|v>s1DgNuKx1c13Y(ciPy^Bt)tbi`xoF^Znqs^+-mo~!Q`GO5!sC?bvX78&@#rb z@l$9W`#|F}SUMVjBYXz;k&)a}E&Utxook_Ew5u@xbetE90dk-pID1zw8 z1uJVlIw+xaY^PQq-Uk4@`tR%B1Hk_SSpDDBHTQ#>9T2v&AWy$MvG!B$PV!ssUZpU{ z%!W<&O^0jdiXf`3iJaizI^W;78GW&Xht&n@#g z?rzngreAHZj8`ma-K>owT)K1ycZ0_B()G=%a8y;HA$@-;B)Ol4`W@4cZa-nzow z2LdC|o0-7m&!P`_*ix(e06ICT$ioVekW$P8uo$L1Ha8s74Ur zN%pxKnVHf?N!<887%=)JS1An`ePr5wtQ*TClu_!y*Irj!YlH$Zd}0cPsD$xjZnTV( z|8ex!LBK2FNx<+MMCPcl6}LRsy1xp~U+@=BLH6Nlan*-$ zuY%})>t*#xzbM0a4!|{hy`Ajp^p zF}qCEV^+?4Gz0W6jwr9nU1p|tcnmD7c)t-hi>>3-B zsHwG;~nD{O+kHC?RCQK93GJ5=7$JlM_(-#s#V4v1P1j}`-Rq!iJM>}_X+vcEV` zsHYvo1x#i%B$y6na~iyj4a^#2D-BTpe1(RJohLeK7I;jH^5-IHRM)@ROe(b09Q`M_cA?($N&2F zx2IpkZJ;G+&#pTLm_|;tbkI#r0(j*51~Otg612{6CFLFq5L)=@^Md-zpnt{-I*(GBK{|On5aN}=gY--?4^eB zgEb8^7f#{Aa^`g3sDq>@E`$wrB0ADH9X)lE6NwYOa&w5Gei(SvY!`Eb?P3Pk_kp)S z>XH!AJNb{w_efF+Dj$rqpw-vH7v-PWB+Lyb`Z06IX0Fs}qs+nVSs2H7Y3;y)GJ26? zmUCPExkF(YZ(<`Z3(26X9oc%um@1Ac7wNa8zj$Cq|1m8oNnB#fLH5H63w1Ey!#vv% zphkq8`MWa#YL^V)xi>;GtH5bEc1P#u4gO`^MYn$eRkx{^BOyKh#?oxv8+z@V;->q*ezaFp zGxFMO6|Akb&?r6J+o5G_Y6)rdc!zDZhH`v&6^|t%0lk8W0 zGRwFTWeqx**yA_Hfw&RJ&5C2+>$VnC#Jh-55rOvgb)Fke>oXqWwMPagU)>1M6kO4q@6g;2+ z&V{6V`p3APS)ip(QgSupccR5WV7jzI8=kj_kdcku1fm9ppFjab>;OgA%k3XwKhhF+ zP<#1H$%9k1WO zAHiMXVRh4p@{ZP4^A%?yR#wF$K`8)*I}~Fs+W`HLk>)iG^$N-}1{c5B&EAl}ts>C| zWfau?FtdMuuai*63t&W-iaaw+UIqrTvD*sCK?oSj4L^aj{sN(q-^S*coKOoUMl_H| zEVy%I`lBDSqCQJ6n@R#iSr2>I1yfE^6twMH~iV-L~z=*UWCoQ;a zKPd%znPT&4S*>1N-)G3AfY`d|1h5lLHw^KbD3f|xOuQ3b zr}vDLNVUsGhFLcm&6-xcnxPWgnJ;Rn^k(*@wJQAA;+IK3;;-0yyufIcmv>DER(CUe zoc1f|fUwNrZZCFs5Rwh~V32!!k~RpZI|03@Ehu@?ggwl?q==@@rKvr8A{-cSmC;Ok zZ4*^`;fUQs6%fV~l;~fy-v$(V-b52Ry`t}v0sG(+Kdr4`2}O+dTFWXbSge&gkpjy3 z*n_fXhpHBwAK^kK3s9)!=YD1&4YWe#4j{CS2Ah~zlt*eP4#Y%AqEi`URo$&*1%jPN z>h}EZL?d!l%CnqzUtlalfAz9($YVJ4$@1^dvZ7vT{GbLM{;}V)>VM&e{*QLm|DGo0 zr|9b6X3hx^0BBMt5S3*bwo%_I4h+Bg4+d*mt!-R~HQ+50jI7V_smKsONyv1{<2L6;7;S!=D=!NlPW-YPnev~H3& zhyTT{cy0a1TnAL{UzkV`FMBnqC^lMxOhcx{rTU96XyHD=R<$|ATVN>}1Y;?DrHWfi zx6xB|YtXD%kOx611M7sF3?@tbgYJ{#)fIu9dSQ$GjJ#HOK#8P7ZtuxtNZ#cA!-87I z_oOa>4bHFWhQbYC)y85MTa-f~NQP66)T#LRg2-Tzme8GJ&{kD(>;AuaHA%ht!8clf z2LtUd+vqP9Otp1a+#jjRoG?wo=jmPgn84!vgaNV-m6UG$XQGm;{lbQzhY&zaz!qsT zP~dl=<8_K?Et)n?I-H^~ScK-{d<3Wfz2p_aXB@{q@)=AFO}2DCL(hM_f(;S6!$rV! z$WBmN125~Au_iyU$v!&C@i2x&>mTNL>@#I%9d@6cz1bT;A?7g7Ev&~$*xWph4P?`$~>KsrnR`A~S56*>;{f!j7K4?$pa?C6SxjkLs{ zda}9!9PpJ(>0%whYKIG^^;edNeH3&@=wJWH%nRMUFp=W4LbJGZQ^_VJ4Mz~NfDt0o zpzSetc7v`VA`NmCI<5u3*fWNnhekUXW@e%!h`3$I#2sY>(F;D^zZGL^QfYX`V_DNf zpiKm83u9C20ly-b}*bWe?_V@<8g>vc2T_` zZbC)&X#|Uc697k>i*;=-UF{)eN#LUk9e1r1g#uqqqL4*!VV z1UMmARIAGe^mLBv9ZE#>@UG>RRx+R1L##TM<3}{#8qMc?fEju=u@I(Xs}~uwX2X=UVS0Jj&Y85VS#3|H^~8kK(LU=N+-{)HhEF=Z{V>>9a%fTdRwK5fOdjU#rP0T zHBZ;W|22-cAu7 z7i|^UeRf1;hKSoottWy&en>DiYD%f}h`C(K3a4Iu`Vb2-5hlX+BhUIi?@Vx8lyDk{ z@Q5hLcFD&We8i4Nr9e7(?kSqx`vWTLu68h<-ojGlC_LTBI>DC6~cLW99e2{dq;DBlZ<_bp=cKVpfZjn1n%$*Bxb-5-!B}3)ZUbKNPN?bEETsNmE^}D(@h+1= z;nA+-fyl>wSzVFX!9ohLo6NL2RmW*Zi$`oS%U`*>0X$(kEHd%O#0ln z-#05k^C8hDijbxKUJT$~#(0!hGV=vphg-AL)5UxiaF4P?1!pk^F2KoKfWa2Th}l_2 zvU|dWaKfNgm$VOr(SUG8Rj8pLfN_OxejEh!dHBRE#H5rGuhPEYm%GL@Faasd*-Lsz zaxi_f5T?D%D3{WYq>gknsP=49*3(GZz%Etg?7Uzgde9gc%STsAMFUfp3XG?cGeT+_ z1^JcdD9@Jc{|z^EN1#d={MM4W;7*R6kZx5Tf{}Ft^6K+gzc{Msc`aFW?JK;=^x@u=kCbg)h3swpw6)= z0f*uafmuOO#2lCg$M6RF?Vb=jW!~JoGuk`MFBa^2a$WcAT(nzPaFXdeTLEWKX9@)`9l;f=U=9R}i1%C@)wD@w zw4C3?oExe-z>3(&>}>9Ss)UvC_w3X zoohXw_-3fm?_S`~77QD0vC*eUD1bxA6rX=!ku>}_YuI*QfVCQQA)+u1fg?S~V6+PQ zi2|QWsgNh$nM=wBKScz17K6W31jH3TT3B;|%IC-aq?Ph6r0QqQlO&fzxBfjN?CK*j zQI;Y==?GtYe-O%+;mxsI!bq;<MgwAB?LsBo`uK?ujttY|yBlO#Gj*QBYULa7nDGqMxwObd2QUWrcPamNOi8=N_e1b@o1dB5!ulK_ zmEGNGRbNvH^aZ|v$kpt(2~RaB$jm=GM;V#qDoI{=v+yDS>xJ&#TsBS$KfP~3e|g_T zXiro8d(_)57sI_2KD$l{!U8Fl-FJ4nXPyS{^OYJyP;?+j*W^!XAgUp)<>?hXX`Dl6 zu{p2HJ7rDwr)8iA7=q}uf&yhtm28Djq|3eWU!WYp4Zm;Zo8fH#xo_xJD2D>$0&6NJ z`_+H^A=*RKl>}kAX`UYUNj=-OiB` z$X{*DDXZU5J3RNP@}C91H;sXjfZSYJ%>Cy~MQJ#N#p4iPgBp^YGeG z`&WhBP7D5&@*aqAIpzLgPEVNj{Q0Ip&b}Q-CQI;K2ch=7YCeM-Iw;GmUkXTyE=<&8 z&o2UY{zI>z!%my=_u(9Qq7#!C7nW0y$HFBPCRxIWtV9! zOW^|tbqlZ`zk4!8x^@g?5R2H1%+zZIVdmC++7OMvCouo+=&px4|2~WFt;hM?)z!wc z#C;T1Kr35tc&<;WL|-OsK$P-JwEM@@LwMR+BOO^?XO+qbCsHHw0vckklFFHSpwM`V z!;h$Wy}w7PJL5aBr3de>A5`>fv9o&7Wnr?*zc@C|GUkRSS<;JOmHh{o4yLd&X|uBS zM2Ojy_Y!w#hmH@(5?Qky0fG6qKt6*Ut6fK-3jwxr?B-&d)RDCzbk+v2JvPwUAYLf% zrKlypTqg&WJGjSWkM-^Xan%+pCF3+xbREa<^%}Rc4*ZphB3vCDhjOf4GR7bVAkj{y zoz2-e!50z1hJH=ZL!RYo`e$YvFj<`t|MwSS|f?KPr z4u*0quO-N_(w{5t8h_GtI<)Lpkek+9k=3cAoH{EnLr3@M@3{qCz}Z^Y4CIjBjXlIP zHED|AYp|vd2gvuBZ{ao_mgd9wM_Z8mP}rQmR~$b2?CekCu)t*?qEep}umU;#4fAXt z$*28)Pb0_o%}l)KPem%Ls}H~gMtVvPamHfh{5Z>nJNEkU%0g<>3^$`*(IM{4jCW_O zegEdbm4}bG0YT09d+0xXx-fcf&m*8DBlG!!<5S>k1!a{DP}r4<7OR~T7XPJTJ{$E0T^=w!(dMcm`aKNH22V3kD6KyLkvjF;CUXEi z4zu#)2l6`5SldNsu5{ys9B$cnr-Ssi7lYE&I(eCT8OUu=$bdBw`o!5FqJ-vej$AXq zy#hRJ|D@VaH~af=P{$K)GG64gH3#hjaGq|)>V-FJ8j80DtoS~jGb5RXufhm2HzLq4 zV5O<#GB=mZhPj*Ul~wT)aIb5>v*rHR^7TJ1VebD1)(3y{f7Ac|Z$4@J%}FG}1tr;v zML!x+0o^qiWw+TR$SetvDl84vo^@0C8Zb(6BjqkSU@#?CGvDgioNsfCi~t(JKkHk+ zL>Xn7=|obpIl>9(iZ2(i#Ar6INr36WV81&x%9OG!L$4#6%QgLk_%Z#_Jvi3=oz4qT z_!FZPh<DE)7X(+&z zMytIT==()v{r7_z4Df37UySa}9_8%U<9iuW^q>qP=Fg!YzoyN$gcI{VeRC!jNT{~} zBR#d6^pupnLphBBDuxRn$eJ_dU|m71)&O@p-MyTz&TsWIGEk1Y379XQ_)yh7r5BUt z`!)OVaiU5zjz>W)dvlaf+_b6jGP~v?fRXjp7<~gG|cf2o?}q$ObN?7LawfM$>VdwMHlB zSl5f z<{62P3iu;`ayVB<7<3HlL8MJ&hX6v^mcvCS!+fV9pm_&{FFNr7K%oW8^rfpnEnCAA z$U0;IM#+#Pql68`4d@t&<1U>QM3ulv0^2Oyst_i&o{{i+W$XxfrqQ%4l>y=+kI@ud z9`yS#9)0VyoITs@V%SEks2jjqYmU^T&25i4y zHwm_Vg#fsuVB}}bMxcEGn%XqGmz^@CPy7ze5`Vo{-qhl?V|!_1z32ovkVy5*2VnKb zV4wi%YWxS)udG1;Ii6Mh;rZbvrJ2yE$p?kQgT5?&wpcEW@ihs&D@d+FHH zxMdl&jaDNF@c45(JzgJ-lF;+oYHDbNalY6ELT)`R=8^w1Ws+#>0KfHE_YQlI{QQEo z*950k)-<%~B}4L}BZk2e3u2M6NwpVz)_^X9$-x+0U4-o>l=>YOH1Q2JNnE&8nrGs zZNwyYP!KEO3gR>nE$0G!eD)k=93LSo`XM6saB@LGZ&^0kU~3hRP>64j%WeE!r-$`N zywXyNHx{DZdIyPeVvS;^CElM*W<=nx%X`>b^PQ$f;prz7b^|H2nGf#aw6L^yixw-_ zJwD9QCwRHLuRoTXFG+`Be8>q>RaH$|zH_chHGLhLSBNd}8I)6$kr}~r-1`tMkp|cq zd=ohkb~|aZ@jR|>g0LV(r@dIsH1<^}MO?dxp5He|wA}?bVxaTKCIt;w0b>QaVv->FxcCm_q9Bn!zVA>dz2}Vm z@Zp0nDOnN!G=X>-0503XhUI7k^0fiL$eljb;WuJBjq75iYS$ju^>WrgIAKXfxOm2<}V?2GbKJ=|G_ZZSqK=ig95ty+Wb>t!FPZaH!txLFHZjq@s+^S ziYosBa+5K@`9UT}tewv`UecKim4t?d`hmOz47-4pYYmmGyc!)`=vegwj;rsu|BAlL z=8&cXX!1b3#G}Efp990ha8(V|2}(}==F;FzLS#&fAP!J}KcYbi%5K;0#yfmZmTrNj z98aLH!Bf`?m@r5U0;Cm)fmQN(ieHg|0P)jG33U6@Q}=*s2kk{Dh9|Nakm{qCXvk`|4R z3kSi!8DLYX8pT0hE=lv9?Avlt!#LtVe?!zqfqJXax1w8Q{6!k>7sC#$HAD~h0MZ81 zAP_e%Lx2Eme#Xc=9?iv+Gh9{l0$Rv8Nt#2LP!uGS>hG-!Wq9qOl$w5a}8N33&7@uOtU zi%40DZhO0)1w6#OduP7MX`?^oJk$tVH5}6r96dMEq9ETTE5yieHt{i42oRA|kWKNU z!tFnP1t!BPVh%*{XMiC9NxR9|lLdk^c&lMo0=SHWT`no%SUZp;$X#*FbsgvzUcd$Z z3{Sw(K_J3Zv_~6FJ0$ScLGxT6Cctcwnrk>-3(8koIJ5?|ZG0Dq3DTC9io|YugiqeQ z^x6bM%zFNFR^!Vt(ZD|YxSSjw_I%`$kFRTcR0+6JgzyAb_^Q>VNs1Ar% z44K-7#TDJI!w~6hKDVVtg*jj9O;qPX^y__C9<5}NYNApcRLDCknzj#VB<>Q^=MrZi zMdVyL2A`;Y`og(b=PUi<7*I4ocL$jp{6zJ8hwoA^onGko8lOzElZ-SMg+vVuyb1#6 z%nzfHW}e~Ztw9xu>7mY$_i6h{p&=vI%zC z>!kTrqzpP*m{^Hk4$=2rGlRT25!w?@|&1T>rCcFdUN!_DLWOWax@Mn z_K{4x{tW1cPz)*xa^!_yK^~8}@3W{WD)Q_J_t#p3K@@O4HQ$p6h{E|7u!j%>FaYMt zrM=bL<*-@AP@H`1{FX{u@%G*s6@F=F!4PgYQGZeBQ>&~Kt6T)#3x_RGqa%CsWUl80 z!T<(GzL?MUK1!m2L@Uiz63`2KI^eR!ZriTuYn3^4s+qjhh1jdIv}bv!NXuqQJ2=0l zGye5n&U0n9w_*H!uJ5lOkpG(Sg5>D3ef3YvP2m-+;t*UDvEQE z*xTuJ`{$?Qy`5NI%R2&dm`~QNJV0!%TYq{8s$9E_8)7_CQd2GM?!aUT2NEv^v{%Ty zOilqPRmNvcWlymnufQKEp{;P%s7~S1oP4y-c zQOSGlG(h)#cR?(oKF`5jMieSa?7^W(8h*Mtt29H_;+D_aS#GHI{P|4L7lvaH6l{4k zUJ|r$=gv_I@yiFz-`?c2-%9WN;gvDUU=ZA2WV0H6{d&%M`8kMyM=u&3$~ae{$OoMT zxWI`0AJQ|vvj5`OO2RsZfEXp+Kj}Hq9%jLu`GI&45cO-7DAenGOF67QTlba8jezC8 z9_mP*@9mu$X2>K|uF-bQMl9+~^Oj^VkBe8iZfe&xf%r0XMCTM{j*reMai*9b>n&Dr zUX3n~PUJ+=gaRG5@OGtvzIRSA;$p+;?$i8L`^kb2q&g*vw)*t?C9g|C$~F=rVIeQN zih3C3Z%jxIalCmj)g!ilXpPhmoH zloQW$;rmLA-8d#StT$TlyaWP%{hC9ZpUT?Xg31Kxj-CVTn#%6wK9b9iiEU;Z?;~*Z z6O(jcKqQLTOR)4Epw34PsyUE%2AEhp1j!Fkt)S^S5URhyf`Yg$Vv>gx9#o3$Y^}T| z9xa)@{4+;DGxSI^dp#{yV|Rg{C1!Cdl{voHKxn_hccvl5mO>?Ii@RzrJ|l8R~RjMpJPqx@wa z+nX3dsCidX0*+;6yD#-9I6>r`!{@rcwxVYh%sLb;PNu0-^W+9}yq9}_>gS0#Q;sMH z7_$&eEbB7nsBugpZ4!H@B9kyxs(;G`g>Ky^GS?-uNgs>Uz?nNz%c`S)1k+B%Bihhu zdi7uMaH4V^T`dz>HjeXqo4uyjUxE%h(b@9`GK$}2p5ePAN>y7Pza2zb+*Q!usGv$@ zfM;8!(08&8l|=hk`xsvsYH(*JeyxqafeiIL9qjvKt{LCD8yKh^Cm9+k8YxCE;8=!i z#b^pq2ihDvpBI#5mdaYt@SNF#;ZHm@oaNBoiuCLiOG>X)AR~`4tMEV3EM~WEU#ZSz z{yaWGfi~EXyl+vATl&_YZ%0}YD&wJd@@!rpK9Q%*Gccrzi@AW;e^ZJ~h zp*^YDm-w`z>xO^#y=8DrzGz;q(hx0Px1!q<^XzKfs?>^1MR#s@lvG3V058Rpb)=_J zG3o;0Ok*{7g&onqUC0T?aM8-ciHl!tq)xzcVbTLf!K$3KHegsyYJ zE@biv%8syeKB{3+M?N7dQsYhf7hAUiOvz`SHGaY$nTr$7ZujT0`BvT~&x(wST)I>` zx7Y&{A?!XqeAa{}`aOiMF)K3|Cg%n*UnK;jl2+5@JAEc_`qqD-RI)lXx<4JPV4~mHy|y^#5UYgTK&?cw({aS0e4rVth7-Et{IQ~?{fJ1t zV{*Snw>*QZJL}IHT8ST)_Ai55TSz;bJfK^uPdCYY%{an*^$|cjRB!93dTf0tWqg0| zm+YiS;bJL|n*5dQEh!S^FjD=*B$_SY8r404dCaA-b7*a7}p&i<``dx zc9LpmHk09G`uiv#2fikex}8+CCAJ>qe^x)U?VKs-?0HW$3V28DX+fS>!92$wX+u0E zI(x5qMuK|v{(|3QlN+Zi7B3G*7kE9bmYc2eYzD&p8}Il45ov-_S+&n9YBlfZ8*;JX zB4z9!s^KzX9@=6~+uK)y{~*|9{dB+3qkZU(k5;x3U4vk4k4fxdmj<7ah7aPQdU?2W zTs^dz9&&nePSkdA**47IJcr6~<0Rz4#QQdtv&k>dmVVyE^0I&w)uWWApS!wj{q}ds zs;S7;u~(gIZ)?B!!5Ne7{IbGZz9@xYt^14v!%DscOi5NtJ-sB~{YqMmG^cPb;UV&! z%K3WNzXA%96HA$sWKvs$^f+%f=~VdIWp*z-JoooVtIxsqBf=GdzKgNQ5e7BY0@;-V!Y~xk1e| zd*Wl+A|ZPXHU#6!+AGW1m6`8&DW2>#K+O>dkrke>q%GqXP0&IG|Bjcb)(s0o6=eOOH#}02JH6ChnR|NpNvSC94{LF z*~~Lpc+}py{bp{oaY=+O>xFxKRrXAYYd#BMroL1t(U}*1P5CU@=HM7m2|09xVyh`U z-WvPZf#`QoGhkMSu~_ZCVuaQN_LAg~(`tVgPtoB&P~C>8L35gHgKM?OT$L zV;3=OM*(oOx%YB~I8XjS!ivqO3vWq30f;qzhaYD>{7Q!~_Rp*SJ?J zoleCY&AbW_{ndKl3PrI&*uar4xq+TcV+8?Sw&+jt3g_yks8A}>2d27Ct+F60z3g=t zVhCGH0;zE4u95>jF9r~WufQHj|4JZOF<4kKSj$3vefjlkJ}?Nyz*83C22g%14#W}I zOBA%57jfialJc#RT!T3lG3$X77P1{;$Hl#(Z0NXUd8_h6H-)^SB%^2XUc|Y6IJ`1g zhyO_l-6~QgzQuv(J$ebz`?H7<$lE+K?`=c#!|bw$`0IBrwT;9`!gg8DG}AEF)KiKL zFS%!t8|4TzKJCb`TYD-Jk0euMqWn>0ySuNxu(99eDpk{Db;%cJA#Ue=c1aAm5{(V zxa1X|WTK^b#rx0L1NT*aX@#zWIyK)YAblWjO%69Xux7I+J-8Trifru(HY1|}F+<$yOz`Y`zvyp~Q3-4#8ZCe z_s_SQt-?2G4hs%?TLo=4-u5QPW~^t~PC3iL6`deB`)9j-$3*|%j)Bhu|7P%$bYy5T<1j*rM`s5mC`*=NRWOL0sxoj5*eT z_%Z%{ZmaX?QSw2Fv--E&m3vRSjDGe7^ua)KkPq#fcH_?+*XZS$3_BALseapc($bJZ z@(eOVP0MqEQzK0VkxW8HnkT8>!m6#dPojXTXPxYnSI^7YpVS(?vs9cs@+&86v07wn zw-`XIL;7Zs*Odg%%)B{NZD>N?9N3k#h?y8U*bZP@;y*3kIZdBPl1pfgdWv~9!dC&_ zO>WeA#CcOPkKF~z=qbBbVt=_hU!dKfDG3rQ<(i?}nOAv>PFvrS4o0MjhZKUhq%}$; zqtipx2Bl3j8YKf2*y6$H767z`Kzd6>P?6IwNE{P6`@tDbndo0@1$m80Uxv3DU!hV# zh8VC9*$2AQ-{wo}p9_r~I%5huf#|@23){=B31p|RcbWJo?}Zp)xWihwYZW~! zir$WOpCBduFxXnpQm!&6zqNU^8W`2hoKZJLZ30WT=#GkDv(%F|N|a_UaB^5YwN44kEopqlb+&T63lH~O8vXD&=mX=E zR|Jq2LsQe8hi_wTHjX|eQa%2Ke{r-o>fM6`oYMBd8S8*ke^WF8M2&t)vg&;Y>^F!M`Tq_C-C%K%2ZcMU(qe`E~Ms85Y zgjBjg7TI3n9o%wBWZMbLqj^@&pKCF;Cij-TEH^>^11`$W`#l-50qSwf%3zYh zGEBDvm+VAkRb+Gt9+-hU>35un+M{cI{wc~R0yu^UJI_U&{GB7K-`i}#H0JWv@d;Ww zQwMxm1ZDOkTPj^4N%`;kKBFFO(<`Wuv<3MNtpZX|6Du^_nBpmIi<-s1&<1e-&G}{J zx?0j*lK=9OP?^ykC+ectnqGiE6u&}ULyM*dS@F9kR}u0)Aq9O6&57%MAcleKeNW6U zFc&3!k2?RsSs=B%0k6}Ngh!29(TRTDJ)KbcJ1Ux{KvzZ$VqHMGPO>|$uH7i|(zZcB zCS^mki{VE7{tCm-q8jAP3p?PFZ2JOaY-sN78pVM`kpa7_n77hQAWi>}l>XtN|KToW zdp$y)$g1-Wj8$LyYs$FmPu~Jtu+>NE@yrmR@Kw~s3uS0%EA(ZrR1vcW3|sQ94W*)0 zs(=I9YF5$(s6vlz@r64TDm;al0YR6$q9UZ?5Um|>fLBLyzbSqU|17Eo(+` z#gshsarSSv%pL+7JUweHiHT>$3Qz=2WED)-)8m^SkdfHFg1IM-Yx5JGD=o{SJcu^l_VK741F0js4DB7BsX76VJ9@AWMX0 zzJJ6hdSf4i#3ECwO)t4!uc&HYm9LHM4EC#MRyu@+z@s91_FcMb_e_Vjl~PCV&TsMG z?7@pWVRi<8uJIU+#2Lib!mYiX3pl0(_cC)P0AWQQZ=x2%&jO3JxwTczLUOgsWraz| zYen=p*WltE;ol(#spyJS<;XGZ;oY4(0h~<2@#OVxi~F}V3Pg^mv#VeQGTXZ-+s{Q6 zh2B|?zv+4_Rz@HjvjwS&U5tX7byp0F?sj9Frl)Z(=2eG%cQKrBczwPN`dilewKWYXhn$SDp zCA&vqTGM4gT#MRlWL(s)@%nM%#?S2}PiTPwUSBThGIAo!Bbg*k`AG^d-_V?Lag-wz zCgtYZf&)k9v)O|$k+b!p2P#&=+pr-sGkMi&9+YQm1KTh?hpa*E4Y!$=_qSgT{zac~ zKvOI<>36OJmAAAOU(PHrgfxsX2?jd)=-eT&wLrI_)Tn=a&sbA-_ICLEGJW3K+Au4J zQFb!RR|tc*q6cth8n9OZh~>T6bbq%O8@_iQKMxZl%tVd5Qn{XJUU0Y(t|6F0UG(VTXYgqFfuwN^>idi*Gq{wi?_Az^-j! zKs)#P4itOyuMuE3VE{Gk%JZ^Lc@y8MC@vyPz#^wB z(q27K>DmcQwk``V0_nm8!UZC)x>3x$2S+I22F>d(!c7JdRQsk3{x?XiyNS>|jH}$#*!XXLAR!SmCGI zqd#~bm)Ke9{ApaXYsp0bD-j6P!2nwf-~Kuh|K!i$YxEtUj|Nw_*Q2uM4drx!>j6Bx zD~6R2DQpC~e&Cz(?{R*%fm~C&1v4}3S)mf>fr&M3FuvQY1HS6On_{Vwusx#cJvJbdqUEHd z623kGt`hKQfIJs9JW}Dp`!6o7`sCh#d=P=#k-2w9)HLYWn7XtOLBciH0+f#FN^7VZ|!jh#}B5d^>;By_iDsVybF1de$v-7pCmR2eO z&EtknixFk;SdVJ$N383GGCV?s`8cNQ{h0(Coz1`&jweeF1ub9jSC|TQZ$OXndi0(7 z!hx)5D5Cs@EqgrR+vsGn+U<;D${9@zX5KoF2u#XI;A`qwThdxd;7^6>Lcid3BfD5J zUT_uimjvZ(ys9*WLi6SkuljNIMFu9stFDLz*-Qkspb)VuR>SNy*OaV071=X_3t$RI z{4qSlCM$BB-vWqlaIDh6U@s3?t=10#kzDZ63X20jQ4;_#o5ac6(A>kJF|EMsyaja} zs`eGV@)giuk-F6o&v+kfi017)kX37HG8dmlqI6{wTHf(nfD6^r6x)q$Of}3wv=)<>kuL>Y%)51)8{k0}=UVN+p_j*%)Y6Wsf6J1i)G5Eb zJOT`{7g)fh1_W`KFCA+6#}S~Mj5bK z+mks-B1Oa;(b`L6{2esR;f8GT+6H zuop&NjgePLV9=C>vHQ>L;@N_K&o1T>1m-v>^h-}33;&XSpzDcMeISYCq8)$*jpW6C+4y>mK+k?o%V+gz~ zeWfQGSPYzLG;zS&lgJAJi8XR1Xv(j;pOYpvKL#Y7(j4U~BUs=k>AQ%#*9E!$@opWR zlg5hdExXo^K;ZrHl&PV9TJhA#&t_i6qLqp9F_UPnFv*RjU7TrYdB*G-Fq%Q|(H5D*m?0NyIH-q!yn%yn`mR*hsO5$4>=C`f_ z@+!SxC$;MXrIHSK>N;lEONH6DY$pBaA?LZxBx z@|1dTVWhsPf%8^BAz)-jFE<8QWC#nFIB?yKwbk=2+ciD$%^$#&*2>n&rQ_lo70)Uo zyWch)$7JQ4)-2UBR-XieDI^Ee6K?$Tf7#h~T_R|#u z35rSBq?Aitt-u1P+oU5XUx`yXgMD9;1x^ffeAM9i1qU!*v7)_ke*y44vayifG6x=K zJMXSa-`)sC+X&`p>#faQXV&)-$Ndp6A^vXl$KdvlMQ`oM-|lP#;2|MCeZ8%j&!UAt zatUJyA*SaV$g8}u+3toIxn!3WhL(n#65BM(QJ*exiaM*P^Z>U$??~4qlV0 zc8v;Nggw5X+OZxp;;p&q;OY6D&rlgw)7@OlbUtIXdOMs296p)0HX|UZ+;BCnf>%yR zR^t&IGq6Hk?$$E&wts({=}Z%K_E>;}rQOxdd-(pu#K;eZ`vXB^`yK?KBps|s;FK&- z#xNJL6n_*(t=RmEdL$!r_U*9F1LvhNX=Z=CEEt9iEwTG!GKSjCXDm8^HM7V7+y5-r z-uC-X z5|R~V?Y_SznUn-&*uqaomIK&L{zcCxcS++xQqhI^(;;O`{>5o**Fai&R?wVC* zCK3=jcm5oFwOmchZ}gA7hevdZ4Mg>tPI|e8_hHwK)z!-X`;v_z0zJ3Lx*kn@i zarB(k281AG6~Qv$%~5Coi;w^ni2@tMsznTUc}D6|#u_zzqhs`Y2tS^&xQtBoM^X@f ze>)4nzTh1j{#sZ#tT{q#%{%iXX&@ZvfbUJnUQBeqzns=fFzqbAQ*T0zJClQFU14ys zNjBp*4%>QO81(O0=r`@?;{aWT)^A5sLt7gTL;Vh%XBm22Mi1MVthmVY^lNMDqxWyS zE1@WmOzUj0h@`Rii1m7=Gce(KS^AuPJB#daVo4{XCG2ts&Vwgw2&lS2PqS0y0Z2`6 z!&{o?`ot36?k~=_V{+=~CzFSHVKF2%kltH8EhKra?PE}^>IKg@WZS28WQ>4oZO-wx6!sr0dHHzMdy@}WW<8Bz(&#D5%O14e!C@*Iga2 zhJ=RtL+A@gaH_zm-OE68k|mUFcUk|6fJy>Bq&)8dX%lf-&_4@x0Ok6vZ=HsBU2>v z+Nzj)RK^d6*g7Y4e``t)>2i_m$`QVEYmsgp+l-U^47;J6Tx*;1b2s{uYr*B;~FKGwv z8h9YZrs_Uz;B_K(CsYilLy)Exi*=N;&BeB3HFC6Frj<=l%R$!;&HejU`=Z%h36V_5 zvyKqialITQqa4_~=S*`|dhSoyy9pb6_r}|(-v&Q(!&L*gw3&QsYq`jsR_K|nAGr@cJKO-ZSVtYpw>Eh+8>GQgnhe!uWSM3_yin=-Y2vQm8Af;`CG!IGvz7o_*7zG9I z2e~^^8eA74m!<0E-yyo9*5P7L$M19x1DOG$chq~y=XUqEz*BmK!w^pdkZlogL7@5HhD#pUmm_9Z?C2LsvVkBh0~2O1@0mZC zZy}oHqi~VSkYc_GckR=_3ypVn2B#80nh?7w1`h*=a|sj^AM$p@`uw+`AdQHtN`4x4tSUxW;{t zw+cBCUZZg&6jVbXwCHJNMFVCZ)yfWz8KWr-6&Vi%0{r=`e1H~q!${rqnby;utm8mT z-)Rdvp3}}=W}t3lLY?KV|0E?WSv1~OtNsWd(Lv>f?Pjc6o~S{V~9 zYa_cZryD$FleD9^5Ey$7Mttof7t{%2g_{o zcB>Dt+|2_OG#KSCB4$?uc&+KFRtN}*^OwuFPR_@66Skc)>X1uHom0dC;sxZDIE8HE zF3O9X?)qJoN-xZ!x;7&egV@cuu5-^Sxu`_49dHM+CwMFo5iwoj1cw<&JD9<;7`kYK zgbRD2IX^*kk#j635pXL&2w@<&1CI3c>)^33CWV6}w!3D42=)C-Omgz(%vq4Abb<&F z>0FM0D7hn3K;=!^mn<#lLHgsRtjYIxHbK+*JGY%U&)wGA%6Q$ai0hk=Pl=c3-F_0P;#7iL}A<)xP5imLNofW#!_;_+$Pl|}nb<`p7hylRni^+w7H=q-= z_A5f;C3ysZ1C2o*Eh?a410OD$H;ebqwQ7stGgt;*w4OQ!E2-8KLoB&19V&O^ zWuLv8e&s48Dt0q+$y#^0FGuBR0N85MnnNtBa_~p@ITt3S^59l``AV`73~LC_D?J3Zl2r8D=rJ6+6P^UE!Qm=v3;HLSCWzLtOs5H-sg)ZyX zTy!?ZKrNMTFL|X#)|*_xj94T{Uf<=ch@S)8B}GP=F${e*GeU8{TqN-q$a}r|D@GMA zOCH)b{|3fNfPQ+Fre3f>0<)siJe+Am^agJomf$QrzWuNkW_0|HU+!y{P+(r+UeS*w z9-9W5J|Mfwu_4SNj$cwYv+<+xDp61jLFi1ya8sB#t5LD9NozhFLLHnLt{LuS%3R61 z=4{smknienCgT@;P)AQ0PeIBc>daPt=2l%|e24&U2l{&A;>6((<9C)XzF1r?yjzjd zYGybEyBWk~Y08m_)&U1=@i`DL$aS6`aJhn5$pTjz>|SZ!DjLK z@fxL~-+gDB5nFX>*^nkgsFs{?A4UspBi=Durn;e)l!XPuMVo&Zp498J*#|BLhYyWB zGuIpH!_Th;0-(?jb2#Qj@f*UA$XcZ!mw`aPA2o@Idn)YcQ=}mvG9c1`g?9z78q8kx z*e(cV66roC^JZa6-=B$1#&e>Y;nXskACUDceNm87be@d1HW@eY+Yl|^n9oZI>S^e+ zKVEvEP2%xoDo5WfUhV98UTu{mECDc&p-gAUv~EeDRK!^07_l#$_USt~E16=l+^m92 zJXZdu!P9exWyR9b!3KF^{yP)oUy#hTS9`a(bZr=ELP@D$T{^9Bc>k!zSx!3ga5@0` zq_$bG9Ds=F&TS}!!Vo(TAk{p+tPn!XV4SLz4{-b$YQ#RXjFscyA3@i+Yjf%jy`{~o z0*`d?UVs|-V9+}#oZLXAHtpzjPWir*Y}H6gTwaFi?K1aRjp`_AGP_{6X`5|f=H`GU zgi^hKlkpjDUci^}2KKo?Y?hU&!hw40D!eSXC&os1l2BYTT1=wK*@_Jkk2P+0Bl7;& z9by1+6n*dJqD#l|SW0}~fik)O+EEC|MB=JpINII*gAprSk(#fiCgybNCQuy_f5qF3 zur7O2Z7?{eDaQJm{oU|jjN^cRe`jU#S24S0FOg}9?;|X&lM+i!CNw36)STOw$M*t2 zQXf-jsd0T%5wV%Qd^?|y{X_R?G1F0SjmUsw2OOcI*q(ri0sff#105Xzf8^}+3kFgL zd5_JX)+17W1>|abBt3Kc#9H=iO@Vh)miF{x5<`kbPGB}F5{5wF{@GQarJpLnVYz?W z+%O83iyZ1U^ENBs!{YX@mQ>UiIXLljF!_Cj`B)!-S@Q|-xI~QR7IWp1Es*n|feg~4 z`f71=fKDN&OHL8KD@D{UDL$w`u9S=6XosdeKmkac<4F2N zDcrT^fFfLC$ZQJU8!OZKr7g6gQ5SyR@#YrXF6DR6M8Sv3$JyOOp)%LBFl6nNYQQ#* zEbiL~s9&dT>}V_oSf!f))dQI2n{7V}eo?Bd{$f*dxa_>L=38udmXlg2)i>JKiR)7e zs>Q||qu>ztBOdhSMOU_)@5R?S`{abdIwAJF9WNlsMb9b)8DOFM$lVzDjvZKfmu6)lF-x97v)HxC-(teL_0M~4|9TC>x93|p2{9w}P6%pnZVnRjG8_mh zq5&SXE9hsFz3=k@uS;bX$*BNX2r&9Jz%7>iI&Ma(PgdYgaEk1sWfpm$s?otOJCKz_ zB+EY$a~B8u)nMq6Cm1{NpX{zka0X8m;fDIm+BW2y0_e0;muOkK5qZ6jXR?r0A|7A6 z&vcbG4UHuGu7dx4uJtjVQn%GiKv?Xm|DIuuY3Ub`8_?PwA7Rw;I~E3YFhP13ta%v> zV9i;4@>j3s9%ybxB|nrfBsSpNyU8va!1 zM}Virn6XjZ1zkKyaI-+3>C;zdL4Qy6_2|fQ0(3*bTF5;PPRl7)l@Q7Rer!w%O+~6Z zTdM=*PR+3U_{q?>Z$F=eNg47&2wKQVeFBe!(2S01gx7=u)gn09VDR8BSzLM;5Q7PY zxgHLI5HgddDcg@?$mszLhx=2VkX+}Ps(7#sN11~OU}n(CGjPL!9>OR2GE9U}9e62G zB*xpvL!N0N4b_4sQ#X=y(o}-Culf5sQU&6*vL0^Ton-`PM0hmzFJr9IFUbEJSTjHm zBWO{OrG7Mc9JL9!F${VJHlm_x)3>4q_m29*Nn1B?m|gxT5f z6DM?Lm7+x^Va$s!msCsb4U`~R7J{`?c%(2Ez~#CJ$L}^JHxftkJ>AzEa;m2;nwf0f zWy)IWNk+^a%F&ebc9$&);L?ss79Fl$jXPt3MuYcgxgwj)&XrZ9HKA<4S!t>j$R53` zgWR^J_RgFmd`=MCyTDs@>J{PV)!)-@N;Klv^W?XA%rSKl%idg`7(u7QYg;!ptfqfo zOsQ`n4tf+%WcFU~7vPS&Ytf7#IOGkML`?$&G0X2yJ}&nnRp2*4W;e{?zb82(d$kpr zHAyO5+&q3)^fw5FeD!08_7DK%-~XFtS6KcHG-n)i%7}Z`5e^5iVgT2%TMp%);57Fp z>Si2GEs@-^%qpI@+Q+0Q(IU+9+r3N)jLv$)YA-Tf|&MwT?AOAdso)9_k zKOir04WS_!@8D7b&hiRJN;EH;8S}_DflbzqjJdg7Ba1=Q@uZHBSa!6B4J`Jy@NX!D z!x&wc{`UnWDb5U^d5klL2i%4`(Px*(8^oM!C!)}wJ&ud za*6GQirSww8tM*L;P$xNO0u3q2p><1et+2UN2G060Xvg~)4SA>qL>tV$g@*CLf*`B z-h?qD;vWFojoNhc$18G?H0|KdQ}rAE&|s2LJJ|!aFS6!RQY3J#Lb=t9Q{LNQ)z$}2 z83o0=usx8=T_0%~z>B`+Nb|05`s>j!Y7VnUK$xMAhAy0$;xvx0vUovrx)KoH z+J^(bfA-!P$gl$@3YK>fQ1lqj-kxM(D4s{+1?Z4?fyn5X>%NfaMO=k@i2n2U8Bwwh zcn!K!=*BN#?E+EJ(R=1N0E z9qL?HvL}6FB0sszp~aIC1tJIVGevUVn^?g{6MBKO!iWFh6B&Z0l+Si>ATvmeYXNbc zfqe90VA%nJtx3lNo;~3^GSo#8aD1We1Vgh7bM8~s^UB@#%y!+gV!!WYjjA2$G0DU! z9nUHwg8fJPaFrX}Wjf@kvt0l!B2_ypq}*TuoC6Sb{%A}_=1RA=5!#zA745fsO<4y( z2t~$K{&INi!d0xR z<6j^I--3ABb(n(Mc|8KF5%NIAnmKo-sP{*b*y4H3<^508Ui|S^=Au1+`X5SH+5hDG z^yP8nlM4)Xj}M&{ioHSDK7Kaou2*|VV*9=mj^`5&y*=>sk4q=6Uid^UtC1)ja6EEx zI7_87txf#lLsTD6n|jsmH$^$jG)U(_vivSDnGW3WI4vD?QS1Eh6*`${&#!l^8 z@GeJ4I$GOsW86bocOhfoLy*hU)boMkP9A*`zq)pQ2Kc3wnXJN z6|Gp25{qkDbaq;&}|z?T>9@u8wlFiLKd$Fxf^hW(kcrnvx8${Om4+URyA zhIHWO(&_QO8w8=io5!7UPYGQK^zTrWt!C}G!4O=~Yv|6y1wndOl#VFO@R0a2?H!2D z18Ylo=FvM#xYBUa7H+ZJ+R&r#l)uFGC@qsjmULFxx*wBi2PqN)E}GqQUplI!=Dfe|Pu6pn{rp2~ADm;O zUNRHcvwOo!y#3;cA^6at{Hta}Jy1&WOyi>79#yQO&R_NHsv@z^!S&61e6|KWlcK99 z!V~j5tOm8|*tZ|RkQ^h%3k^nO6*0PJo>J;trN0!U06EXtN|E(vAf)C>T1p=t0%)WPX+siT%M5A)t{V> zCmW!>?!nu0Q(s|>6zMemb^B29iG6okib|#l$ZjwG7Tq?f^;T9ljg&en1{Ppz#NmpHpwF`N@YLbF=XZOmja>J4aDjDR zS?crw|7JcXLP%Vo3Oi35eFyPoL75Z2$b=eg$2h(6X%YGIw4qZnlZ^%h!e1Mv45uCWEJ68+{s%d;K5zh}%wmV$zypmwmBVPx>48HfH`2hPiW zzK2Z<-Ua!tn;Tw+&6K<@o*~X|WrY^Gnhc`E2uCIV7v4u?t`6x#Wgg z1C`XC)oHMuXbXyqXtq$GA97i&+6YPPddzu3foWOiBI8^0N_~uG)|xNJ+Ty$+B)eb+Do;F1A1D-fE^B0dJ+NMCzd8?@7Le(UhG(`UTzi5 zk2#pUF7+$OJJCejFLA&=_)gn2+^n3xnpp@Mt<$?mDi zzcltzM*s0AIHBb2`Y9{4Z8#1s1_jPIa}Cw1L|%VSxilMm`m(PWq()|HoK%g+z_KJi{9NN@_>49E)k z-Us8F&GqZA=j)u`$Pbtn_jRB8DPY|L+qyn$g!hK`IspIbhR)AvUJkd?i@o)lGEkB@ z9>snoWy5-7IWS|VVj(Kr^X=0M-id+Yo0dJ5gq$Xt(B`Exteg6EkcgqFvB&yw=zF0W(?(%qHg7C8}^?#3hLGYRq~jh zj7;&VtZ2J(KGr^Q!>F+C4rb8@U%uygxPGJNt$c?$K#>4f9As&Te_;yYA z((5W!4lDCnr4;`vX-ev;wl<45DSw`|N;OF79?Q;6lHc1fOLo{{jhhON7eqQADeKyN z<)A7)6I{gCcEgR1LxiB8S%fdlT4D(I+IQV~=h5irb*7uQUe>6qh;=_2QyV;2$NJ!v z_cYW#mXB|nYFb&M+ISV_*90wiI9G4#LfMRQYl#xr=*mey*8NM$+EwGyFm1{?f7^+Q zfV1^PCL>lXth-HBMYVoKbxiu?fz9r*x*7J@z9%B<$j3QUqE4`KwUG3xtTZ$G8x%Sp zg>*1iSamNWC)}LB-uZ!j6q2!WO$o${W*9bKGb1t2yRa=RBQJ-X==8s6`yxX zF+M2B_a^6E`9(6<3oS8i?Q9*spGE3hH(s-|ok)4bA)q5K^u|I?SlVupv$K4;);a4)OY8f z3~P1Xek!p!I$39=FsH=t)oZXUU#7{z_W-s?VeKu)jP;sVyN40(*Q6A8oGUwKMgiXu zy>c*X{RDJpErL!vPmS&5bhkt4pJnRALV@Pa+qTzV((#-aeVJ6lx4yI%!8MV{(H^fB zblf`=X+P>1{5{6~g$k4ms-nc)wfObk+Km;GVH?F!{`%F-yEq)n%wm9v45@QnR`*zG zmqnheN1~dV^TgJB{^WL)V+FtCl0*#IZK2F2Wk%bNVftC8x>2ryk#dM_v|3cy(>f-* zQsb{?Nz40QN44WIB}1r6q0Pr=Q~*ZAsa&W-VQ2guv#4`&6$M3CNb(UY-s&FtCgp=X z!M;H*Bc5w-?8gu8)O_@=+FIz&(yGHrRGSPs(Q(wnrpcrm*&r{)IM`Nir1FLP8~*Au zRh`G`rPZCQGg?r97A^!@I5>Y^#)|RdH@wNDMc(T5f10?e78X>#i8NpKp}JS+v_%vg z*+m3l%W){KH#)S5F|lo)*#VBt)|jn|(`FF%j8s$I6{s<{X?fn*M?klxAmeER)%`^ckC0h{)MQD1!IUaPHFm;2ahY1;=xJE~sajnV zNwAS(e0hhO>@i<#Kl(o@F~P7EBew;6n#!a94Iu-gon zgp4h0lGbn~k0zUBS-jStOb`N2=539-?@BCq#m=jU zZ#?kG56s(Kf}AYcy4YZ@=W3RkC?)4buW{mlooM04?Ke<;L|~D&Pq3kBP)ouMYPIiH zZYm76HHYyqIrRVVNsDDP8!TnrA=NSXUB~XO`}VxeaHVja%97OBcOKHec)?D1{4 z*L9;oGnQNDmWkA#qj}Be`s2NHdsUIpoo7fBM~W+s+k8A9;Fh?uuhZ_bzV{BUmb}tI z1W$-i>ce&cTkGS2re9wcxpDWa@+vjw&$}|E&1nK=b{B6Mb#-%c;B;zKkW>JiIrORx3=0;{SSX& z(JwB<>2g`7QOxAS(>GUw4mpI|{P;rjW)b{~iL?G*6+RJJrS7{$?3T{p9iFbRt$0{t>0ON5UV8UXT4mLC0(~lcHnI!UrjqG@;7OZy; z`frx_vzjpxF3E8I^RsSpiaP!XrgSiO8PUV25u;t=J!ga0h~78yi+0w-reqJmcLKVk z)#63Drd+Q?>*M{O0-Rg|ZC{urv6A9#n8dnoAV1+_{P2dFyz?Q9mdciu|*bE2>JoQNOxux{+$xLIto zk;!IfCR#(nC`>Dz63CAHc61&8ird!Xp@H#YeFg1WT64YY5ECc%>W>)JUY@?bxz=g6 z)*v3{B((&GN_lNH?0Ac?yEx`D^ZG**(h>8l9(i zqp4|#D-#&vm%29=Q<}Pd6HZENjkGstYL@wmsdUS>mPd))Y-B9+LSLvN{2emyHI`{! z+H<$`N?8#%FVju8c5Jq961!O}(^P;>Hq9A9=cY}H+^M{wFXpuuB1(SuDBG-s}2)ria6WEAr&a z6NC}FZ^a7E&SpjfC*Qu}sY%OQ_@Wll>g3RBZL_h_Q$HLp6h<{vhRxa}ne_^xN^Nx= zqO>_V2Z(;=Uj$61mJQl_J_QK42;y0_W=ld_jEN)NsPd!=Gk2kaO z2ky(i`r z?i&whv&hxeNVVEx_r}tCV%O*P5q08pO0Q>*YT6RTRIx+&&XNP|*D?M64nD2}A`Mv~ zK?N;oH$T`ZEb}$SMjP_7ne}&u$5ekYbq+y8-v0GV8T?5r_ zmpf^GcuU^Q%+2u8+J&U?^r@PNnfB)8DRO?4raBX#YOPA zkuMdUHA(T|H>9zSZ{>Yjm$<}&3L2x^4B}0_&6MDxWW#aDv2Eb-gjc9IhARA-;l@HVDDtgQwq{7BI}Dc8>#Y-AL3 zg|HQ0^my~p2-VQ9JX^CZW^XHT&wl#^;ljC2p4krd$d-RSo8XY*yG=AsxfO*QkMb85 z56nLHT1Zstf7Gi{pt`&ecU++1=A#>zxZ%}+4P|K6<6T?nWPq83^%Ft&y!>>%Cz(st z*lk>vvYfFWhZ*YG>9?bvkQ)BzPV18DW>2)4ITgA;c3cz1ZWgWL`u$mr#M5t~A+f&{ z-Hgd;qC$%^Bbv(!WZZaN2`T7v9&e8Lx9o2lKPaQyhPq-Rh>b?mykD%$<#ZkFu#|62Z2M=o6MC~NWubZPB z!mbSk7u{{9NeO`l0Q%?oi6CK)n@ z&XXb1ZHqT==5ssd#`X7g+kIT=9x^~`rd8>B# z*E6C;f2AK~aa(Qcbv`pk90(s^iF{O-J~d3*X+6bfOYpwq>o_>grX2FmDUgTk5b}0> z|GjBB-H=`qddEkImY+5Mi1*e?m5X=`d7zhuY&pe2HTAWX%SDN=IsVh2xV^%(ySKH? z8%iS&@hs;Uh2<4!FWiy#!m~a2ns`z;GzO>{zaI6MYW=s)2k+}S8P8917CdlIOO`2g-f?UNY1-6kqG!5f|1|B0`gTe~DWM4fDV>Z# diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index e94b6d501c..631bcd606e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -73,7 +73,7 @@ The *public network* profile is designed with higher security in mind for public ## Next steps > [!div class="nextstepaction"] -> Learn about the tools to configure Windows Firewall, firewall rules, and some recommended practices: +> Learn about Windows Firewall rules and design recommendations: > > [Windows Firewall rules >](rules.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index db2ed3261b..3a7aee9c2f 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -1,6 +1,6 @@ --- title: Windows Firewall rules -description: Learn about Windows Firewall rules and best practices for creating and managing them. +description: Learn about Windows Firewall rules and design recommendations. ms.date: 11/15/2023 ms.topic: concept-article --- @@ -9,7 +9,7 @@ ms.topic: concept-article In many cases, a first step for administrators is to customize the firewall profiles using *firewall rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. -This article describes the concepts and best practices for creating and managing firewall rules. +This article describes the concepts and recommendations for creating and managing firewall rules. ## Rule precedence for inbound rules @@ -43,7 +43,6 @@ When first installed, network applications and services issue a *listen call* sp :::column-end::: :::row-end::: - > [!NOTE] > The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. @@ -76,9 +75,9 @@ Creation of application rules at runtime can also be prohibited by administrator What follows are a few general guidelines for configuring outbound rules. -- The default configuration of Blocked for Outbound rules can be considered for certain highly secure environments. However, the Inbound rule configuration should never be changed in a way that allows traffic by default -- It's recommended to Allow Outbound by default for most deployments for the sake of simplification around app deployments, unless the organization prefers tight security controls over ease-of-use -- In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP. +- Changing the outbound rules to *blocked* can be considered for certain highly secure environments. However, the inbound rule configuration should never be changed in a way that allows all traffic by default +- It's recommended to *allow outbound* by default for most deployments for the sake of simplification with app deployments, unless the organization prefers tight security controls over ease-of-use +- In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP ## Next steps From 2028d65280f35134c9dcdc1555016be5878e5566 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 11:47:48 -0500 Subject: [PATCH 194/237] updates --- .../windows-firewall/images/uac.png | Bin 36445 -> 36284 bytes .../windows-firewall/index.md | 4 ++++ .../network-security/windows-firewall/toc.yml | 2 ++ 3 files changed, 6 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/uac.png b/windows/security/operating-system-security/network-security/windows-firewall/images/uac.png index 8256ba0770b0920f6379b93128ca00c2457b16f0..e32ca05ca81920536620b7d0b36a9bda6d8a0b16 100644 GIT binary patch delta 35003 zcmYJbcOaYJ`~Odk7B9MtmZD1SU3=5o#0<5S7D1@J-KwQ6wQ6rQV#kWuv|6+_F%zrQ z2x9N~i}wBbee+k&b)Wm>oa>zXoO3^~$H{cYwdV9|u||Y?RmRLD00E)cAtCefc*?OWh3uXRLSZZjpVc;pQ zjt;2#v%q}myFFSFTpKbusLY5j^y`5=1X5god2t%~>O58ok@ERw;2cqb?oQ))i_3RO zGC=CGI=Q9HcQ}45AaGcA(|^1Pp={vRdEcH|APB43vtVrD1s3ArZ(PZp7p?H?3$Ldm zOMFYbxK`2Ddd7EpBk_H=@+{rQ-G1o`Eudo6VQ82XU&qMEm!MRDU!6R&;}ILAW9IVW zkj`hytt;H)PMO?6RSZq`>D01V#wmKd)hMgxA?p{-&{dF9d&WDd#JBJM6w2)vFK*X0 zFY-+aW1QKjd7|`=ntz8gL^#14U{@|EQZm>&Y2)Scq!r8I$PRQrwo+2#R?q-SIbJAV zTAi;NS4bDGdG#w9gWfhy$B{k{+qR%vIUf-kEQsJZ8$klcKum;-`HAr$caMj>`1=K|Vim!Y3TP@prC2H`%L zj}%}!A4BYYB?bBX^uMe0I3MM2A`$X`QD z0l(v0N~}kgO>PD8n$WOE((1-`};CS~R2vVX!M5Qx~5?JSifu|753nk^GnZF}>gN54lxF%s0_g{xjV zCD2+@z4jR6rnR`(o_riEEhy%E{_KURtH<| zY#CDB`Bb2opnIQ0uRt?2eO8SkARX%70E_%XC|$@2bz{{5IR z6^i_^P;RSXHjSU2O#AYVgpbWl;{Cso&?O+FEf;5q!wOCxf8Y+BT@(40|1kK^N%t{Q zP)hT+OIqdn^jAOK6Z7!DquUnCr%7bmdy6dLz$(@8s-+5a(*oL>)DPAw=OBtAkG+Ea zKzwz0q+4k7_tkeFvKTT;PbTMZeyP>A-*+RolIqHr z@u>|jglRKG!g%?trNT;QrTD+NB!#LargIdq+VGW$yyp_T|G^Y6(J2l%kzIPajWrO} zhC*RKC0CeLsl%b}x^)E(+;hv71X>pYDW-{&`7=|>!yjq0i(ArB=f{@XM`DAZlODFr);v9%aXo}^crc(MwjNgb?1S+%= z5j?+=7t;^JlmcV5?G}*AP0;z6r1ZW|V}ks$x|JW4gF8Pt3$-(uq2aleXGXd15fEPc>~oOSpNLel*1 zVfmxvn;K*ZlH-b|`K*fC*YYb8+q4RdUp#YWk9AbxO95bh39*k~Xts*ez*~7J!D!3G zux`a`Im6bonHuSc!fm-rqgHC<{NSN%z(JX2GCckk{q9oYxkl+u5#qF&cmm>+^Eqd| zdYofEnTjk|d)@PDEL~NLUiVz`q9*%%eN*OQJ7!kQBk#^THV4t$-uiuWyr@AjbLpiD zcR%1|b9La9*TV1|iDAth@JE zU)6`e!Zy{wX624c%2guA=_Qf>SHkPOe3Tc|^)Id-_z+28u<39n;B*nB*5r+|A!oYE zxTNT+?y>zH8h4c-kg~-uwH1?x?zi>d2>e~EQ|?OSUdLYvX{baZjk+^U-;KmeA^v7w z$;uMR3DV5_o3LOhSSGqDGiXJBrbtA7Wy-8^ooyW^agZd5A*H@DGy-;ryTb}ZrdJ7q z-jD7aZ2y{RZMpZqHh6rQ-K1N5lz)xz?;T4D6~+;nE$-x&!~a^GthSV}j#XB3Q2gs2 zgM30hixAq=x`n?USV;&vJ=oWf&%r-7_^x=cLK&ryyl)SMmJ<*-^o+Lx2etE8JCQbK z{I;eeK5H-EYuUB_clgj@UW{C$Z?7$rfr8Ie@F}i?(Pv68cwn@P?e~Xx9l3^(gTV_z zF=5YVvu0y5XK;(A=V8PI<$gV8Gy3Mh`TpV|UGp4CM?tb>g4`RWq_40?~`uU$k}JO zsT_y*V;&PI9I7c)Et$-BL1hhey@Idy7?D@I zk@}U~$cSaxO}~P#CB>{E{JQCp29A+;XumdBZE@X_siUisqpNipy^uR>7@(>2in|V5 zB%+eA#?)JX9y7d#U9-A8nLi!?f(ZpFL^{ffwa*8%RgsDU+O9!sW<8gy&s-a^uxr+( zUy6fj0oykR9sw**==Xg}P~$BdULB9VY+JBj+lbVWKi|8CWO~Xls3exd>b3G{_oGf= zuE>0}!>wdm?D-~eskU3JXhE-M!Nb5A0?}ir$y`7b_4RY}hV&^#rnA=ygmtK}Lr-`g zneM4wHtfgs9#_7XEgJ->br?;Pt7qoSv=+pD23P{0p|;)9Zd?ryF*-lXlkFH_if3AI zk^^O=Vn8w+s-Y~fXHjzER{CVo@dxTln){&rka;vG6jX@9FYj`0s@ee^!ne|bQxX3; z1I3r*_NDbHLl~gEl?@*RVF>AxRwGX^v{$3qx@-*FOp&X2r(M~N?lym+;gSa&kAJ5ddk zS@B-c;8tUuHY<2x%!bp+va3NcE(zKHDuU@=xl&o0dn_isLiPNPYtG72>p!Fnc?ivV-GEf$=}m7Vn)m&pd<*J>1Vj1dJd_aWNB~!`dV#R?fQni^ ziNe(*r2N@S(VthV`&*{U^rQ@t4Z&Jn31e{QRl|PrHuyObY5+w$#kZObL}i_uKi8;x zS5V@~8QtiA@TlA*SFm&#W7iweZf`JO13Oyl9C*%u=f5a)@MzD6*ML}L>+^`n#sk@3 z_ijEZFouWDf}~lnK$H}X|2#wRiCDhJoePB1PuasM12K)8x*IR|!e=}+luLK!-jw} zBAwV~H7SB(N|=%zwMO9(dnwaYzoFHt@vt{+vx?C>Z1@YIJRfSJi_8KAi*cg&K?mEW zax#{Tt6v9z^maU`u z-EtxR{znBr2a}13v&BVZ~^|=whA8*7@+7Ti5hX_9N3*P0f zk$9Yc>D8Xx4feV>+c{d?QRn6368xe{p}e2l+rKzxn)v2BM?mjk2|16&v%N`Xy*_felCgsmc6t=D znpHHXC;6wdLjuXwQia1_aPQt=G?2^4f}G5A1}?2WKOWm%@lD`pUh0jBV?FsseKu_5 z`AnW{^<@-&0Cyn0m+3YkL|Qo!L;<_$W6t|{{%Hp2IG?CmkK@5YarOJvJF=BRP;5F- z0d%bmJK0Ra7(|;TkUxLxW6%H z|CDt$`Rf`H`M5#m>@NHdq0!k$NCi-`;1*;9QqT@7K};7esPVgE@qQ`U$%=F`mw%Xk zJ~5Wwis-D?YsiO6WCrVK_Y7BwevamdKj?4-s`}l%%0zx3YH{K(r2hD+FJ-%bN0f`? zq@jy*yT=5(Bv`7W4Ji`EHb#ga%EeYKj1ifLmoqWvWZ2m=jgY zkf-h(u}sW`Shd2P(Kyi{O+?V=LbqYa5oaunzSWQb8sF*XV5px#wvj`96I9KhP0#-%Q=SRp^9Hn?*A__E5KxD~9a+7~ zNbejsM_I<#dFN;ehCgEY>93v*`>*?V+L)(~k(r z$?}>NhClF{S=1Xx!e~A%OeFcI6$|r4{%BmAzprM+@4>TTup}E$kJ>J4x;Ut72dQbR z*G6s-4~xIJ{~8!~>lNxMJ3XJ?46bu{8n_#I(^RS@t(C>4_Bu=EPW3J4FC+9b2$^Tp z`W~5yQrzX&Vx%p|Fpr?d>6v~THH^k+SG)T)neine~qW&O~iK|g}hl)O8Tl#2J*=kLK_`Cve|Otj`Dgu zd5Xj6dv)J{`VZ{_VcU<3)^OLm7Qc`!oRo|8E-2e435+xxI1W$-yR9^~AQ@Gc)E}HS z?tS>okJ!J4bTgQBBa90YSd)wzSC&WDXgJ;VAR?YU7B=*E$jZ5j-G!&ux_>b4E>lwsUP5cwWoxPK!Da%Jy#gvlIEsndO^z zPStmfLb(MS-ik9Vll*=l=?9l^GT7q!{p(p`D5s&Qcw^0h_=&MD?Sg2hwW0G=tJk@d z)ox}{rB;2s-am%5)JHugU^>MmyJBy5>mmDM?6;sr)sXC@K9`C|L5n zzQMzg%=&x3_=7tqWndKCt5Q`dog&Si+?5~mj?_OY!KCs$S5eQ>!CppsnrYta+N51L zM~N)-fsy2QT5QCC7*rH4T+Y4VHt-8SbD+HdEgI~6xJZkhQ|XTGsk^UU<)>L(#n6j> zn-eidLxbT_l$X*hZ`QaWr}{v_l19y=@K*tSCbz7VN{Gwgr^FqYk$|sd#zy0dd=~W+ z`v>iM4GVNq$;vLG0qXK^vg>3+7Bkj0^nX8DZsm{z zsJ#Qzzk?k6@?CW;KmFNLp@b%yeKzDN~ljaifXJ?6vpS91@WosMG0{c~h62q!ZhxMg-z6uz1(X@Q{ z%Kd^{w#8-LN~Cs83#VXU5C>6*-i^uv&ZUxVv708c6~*$PFSAlisRcI&M<~?5sUHkq zJ8F#X3OX%sN)AtNxHrXe1=WBw!RC^)Ll&5JSa+C2($dN9h$qWn-8!o*WQ+?Vc6zG~=k?6o zEkcxdR4@2WuVn&DRSrCv+@lmRJ!Xtf>2wK(9(jQs2lk2z20y*c;R`1&*Sp)BUUZz* zdEH^Q(&tT(u$uW*(6iH5>$MD^78B6NOXx;*ZN&$w8;v4UCX+x36RNR$kwvupmuyAJ z%>gQ{o#s{3WQemZHn;WpOpU@eC*YR%U%|JH2^*_YPmv&qhIng=Pk^YuO5STMNnmip zc8%oPh5BzU{>9OAUpR9S{iU6@IqFtd9yhA`In(Oldfu1-Rd-LluqI&N?H*JG$IH@- zOive{K%NLCX0Dbyox1+4X|^~E@h9x47nh&B(}_LttkR@kLP)pelVWVl-)~CfDH!jI zLCuOXT2i`MJ4-jQ3Pp$?b<64>L%m&AQAND-hMJ>>`OPcDgcR%zKM9#WGLd!4&C>LSRvv&}EDQ1j&>%dl=l zNnaz}4)q(hw=YGuP^jMoz#4KwW;xlQP+a zz8@+A7kP|jPA3O~>!t*urR5SB;h26N&{J(2C*epcm{Z;!|KvI$yKs-Yb9@Cibf)Zi zf}*qDsvoUZe6q>-zTNm{*@6|@7boD!$yhnNr;6QZaxIx{T<5I`9Z3@TBLgX7zMQ*= z?kDtT1Man4SJIWy)3uoH#Z663O=(jKG)=>FAad1==jsY#9aC3P*WBC;@PN)at=WGX zXJ@3JGf91QQCTOZCqUA<2lquj_Ec`n6#43H{m>`r@^M&}l;?L(?<=8=VDNU`lzUG= z@S<_>;pheP|8j|@h03qwyiH1ad1LkXZ=Mi1Ua`Ul`ULm{ z1e^f+tT45|#c}ETQ^DpU3%+I7{)-X@XsGU4zWeb&=IXL%w>7z?uzgI++*PsGS$ocx zAOA^+QiY!1MN-}ifWQ2e_!Qnd@bt$~a{iy@86LfIsPk>@O0OhPNLIs24u-(_ZoboL zc%ei>zIFs$1?#4Q4yPCYpWsK}EIJZCn$&kU`{>8~Rp=7`g9cbWCmI=gUA2a}P>KkQ zYg^0N{}c4^H?Rd}1#C3r&0Yz4+arZ?wGKVk<+k3;XKn`Cb2Yb~EeZ%&9#kjO2;Rp> z3{~CE_s5fG_icJ80RFH23n4^QD*`utl&%qkkk9NS)g@dO=p{akAV5NzUK0r%$XG!Wfc}bvW%a``KH`=A?yiRpd&ryhcj|L6&_9%Z$qE$Tx`I$5gD^CwRqQcPEQL@U>K{o)+H5kO71M;@Ur4BVeI#J_tvx<>3hTQBp zBitm(0{tFzB7-C=dF=her(eD0Eeg*C6)D>Y2G9M;{Z*&74farb_i7SRYSr8#wP zrosKE*DUKcnn{@_@mmk#PiE@$sEbbV)+&kfJ=C~1fDJBaBhx6{5Uq|mox3hCaU$z7 zTDpcHE0G=z=vJn)FbwY17N17^rq@OVpDi#CB&CwdjVdR4!^jqPieHb)je=J1C4RStekAJV^6~t>VmVNBnI*s#=VLTL*)iP;`jg?XhJK3>8GzRWxbuCYlN4e zbu1*nf%q6OLy$4^yMw#d0Z*tE0(!nPcjU5uEA74*xHxu)>y0R?04zMpjHMgnm#}Mk zKNw-sHV|TcLc?X7Gce?1m%)ptjI9>m48NR;J~t#|9w)?>)t8tb8j^v9G9|yjGz4`PT<>O2|5rRUPZ9Rr z(X8U6e6-K2bYvOZrvR8fTa>3O+${{OgHq@z^a-gmfmOF9OB+=LU=WMNqEa9E>*V$s z1kcCm>c~{p>Z75)pXKfmAZfpQsh%&|P+0eUB$kGhi72!7>8xvwepFx4kZvgwLd2HT zc~UUnS%25c6G-6_p*rp`_kk#KLzGrze>ODwqA*mY(bVj>;~?-MjaFw;GE?sZ7@fO? zP0Y_4)9g{Y76bdf`oM)Jvp;!w$Z#!3#Ie%LR8+UHJ)M~KW<9@$z}#REy(hZ9PfyNb zLnyo3DlsR=Kc>A99&e`uRTZ;is#m6#VIOU+#})BTyVyvM)DEN+nolngryCw=ZK5J| zK}X1gVKuYGMnF$SYV)9YQ}4-rk~)N?mw8&5;a~(*`B3fcQnAY{igdPA(DovMDj90Q zc=F2NRYBzlEt{6)^w<{i_B&qB`?XJ66iWKI%tt#!B9}*C)L9oiT29lMz-VGtabq&5 zqhig5c~xw_d9AIz9Hqijk>!54%l2iai!mDAE#XS20eED5OR;0WMu4O;eP{TeXbwf& z4RuBrDQG$2GomPIZ;QNdyx#4r)C<-;id^JD6~OtLCa&W9ATYa$-Sm9@i&BgJ!Mt@W ze7=|L+8thf!jT`NNTyrbpg98*wR<1lwrt$z2!Xv2y-jX_i(6%56tPLwoKqulFDQ*7 zpf`TlRS7_^#eE)Yg2x$2qALvp4pU10mk1Tp5)PBSn&uIwi1*r8H`1L|) z^0rc)?kYhgX3}R0ckev1IdiNVYvh7*b2uF>c;wh~B(-epYnpu$=(O_EVK8Lkk3TZ! z%GCCj7!HE8f;sdwOJ8Gdsv~yS6-jG9MoDGOx18+b~quM{28W%Kx2*8*6`wyO# zdzbA#Xymt7dTGG+-nKvyEFqOmp1sP0kCNNg=t$;T9Uc4l{NO6CjHMcJvmVSztieUR zD2gA$1e)o;5!zS32bD+Jve&*9)_clgNF~YlW{37VcbGiCK=Gh3=+s`iH6_VBRi%Wu zj~~D_+qCcicLLoVzD6Er|0s_kPUQZ^F*-O_tCKGDXVs`npVA}0KQL!iu7HnY;-~}k z139%9_62T9_YJ8tV4dcQd6Ui^|K2ZN(9iv^9v)k2xH74M9*bL>l^cF!A6Kvp@c!@ z6NfN<4`vvABZYYWGL5PdyJy7)|BSol)jE_~Em}&e!k6#(aEsdz^G1b56!*hct`ow5 za;F!M6;b~Equ7Q_(~CZGWnAYtVeShMQ>fGA8I-u>XD){l9z9>^mh9k3%wyb?;GIZ? zx%lg|H1tt>^D>O9rw15T%oM9Y2B}Nhi+0&=ZElB_xgC0bbk6g5;L$78k-yR*>`zij z_5mM4PgOG*0o01L?Um5_MtMGBy_prI-Bp@jQr@}zl z$@@VGO#N(XvXex!vmKInUihJ1C7!DnM&zH49UKV)^)u@Jz|br?Kdpt@7}GzBOJn@B z%axM!l!3B{?&V~GPV+c=wZt8?0O2O6?aNL@G}}t;&&M?$@7T!sS?NmVAJhB9yhACc zY-Eux^3}OpLY1!hBx=^V0cr+C%a8d#-*GgUq4ga4fNN22sb0BZz08v8A$U5&a~?t! zBn;&le$!Ble5H>w_w1ssO)oyT|IcbUU-lzv9p!jEoyrqRtP9~vFrw&omlf#;N6}F& zp4~%wjShz!eiz+PW?Q~q!v$udwQ2a|F<^VJK50;#8JUl3#6}vW0Tr;c6-0D-2fW0% zwrwQYxtSwV>R@#pc41FPb9!v(S7e?mTV$aJ|f3JpJ)W1xPP7U;QT^xp=Qxqjt z*Xj0w+awTz6{^0*3OM|r_O5;vqq?*nBn6gA?i5N&rUTY&x*tY#^B^n2xN8k0vElL= zl!&d9-gkSeEwvAfdUH3B7nsm%SGdx3SqF$nD$n#D!Ba3idTb9HdR}@V`&H%V^-oOSK?%&pr}7{4>zF=IXi< z4>615=P&V4ljE5uC?OODwRItmq)vrD9b|jGfXS&F43jXSTrTN;Nv0>?8uC05sq1d) zdld1Yp&mu@0xXUCu?y?t=Pl-28n{>=u&XHUwp|UVg`7I4w~6#4x1+xA)9-#hY3ZBJ zOHTIHaRlySlKj%AK7E(A9`$Q2%KNBN-M4FCJbMu4yehKbzD5tJh&YI)w!#^njkq;E1*_uvrD%9EOKfI54G|X*NUGXE#CNpI5A=@Lfo0r`$1J+ ziUe%60H@02xjAgFMA&)i8W9g)u+{TNds1 z;uug&=PKMcO||lzEGoLwF_yh~Jym_OP>ho41^Iv-Y4=lOoc#MRuH;%w0QXewFIz-B z!ii&ZE{Qxqdz)W(thMkw+`;Bi&gbNP&x65mIZ2@3*c^=uABC8JVF(VP>8kZbb<3#TQ6Uui}CXz#d3qdW|zYg9tBNHaO-OmxK- zx=qGGHoJwwF>hUY-*XZ>J&f`WubR>ErxvfG}7pWKt9~ z+OOBnPEssuV}Nf$j&0QIco{U4@PFOI1=RA7XW+OkIlT*ezS8s6p-+o?lOMt+9I_bJQK)A+om+JY_ZwFF3a0#?-G|PAoMnY+TE`{`}fKE zXzz}`o1o3O=o>7mmmoyF{&*?9;%wCFe3a); zcySve;}9ORBKT^ipT zzo1i&Q$Daa!hJM+lha^}fB+L&&mBZxK~O_}oj~FFl6ev}9!vU)R0_7Se{&Xmji5JT z=n>obUs+>?9(pO460~Xik8AQ!c1am~PI86B5qRVppAaVg9}gA#rkAV09?v@w`~#q# zn7YPIOE%A%aZn}*K+@-oEp`LPoh5)aD78~eEe=fMoRA~{#L3f>(2R}XW^xe%g* zsvBfi)}>B76;`Qfu;n2Cw^KaA?XrU)3RRa^#8ycEeSRhMX88YFcn_k0hsjCk|5b|U zd)TJdx4)fjj;*?T=c=^cc)8%eoonrq5E+}4oD5vSv;-l34=3>qAmR$4BM=ntZkhXM zmeh4rp!h%UY_iWB&)9?Oqet`gb#F_du&ij?+JVsp~)c z=}C%zpxj%#X-(C=lehnT=h>&bw4O{4=sN!!Y);{L!Kz&1uVCfk%hUhY;rK2V%lTh# zTPC=qkm_?D{H^1lB&)a<5my4u)kw_1(~i_uN9}YG7?-BZ(;!0sdBZrqHS(=9`k=appC{{l-5&56BMUtG&deVzdoaOwDp)V$kuCAO zWkp$lo4?`DXB!@mD@fKWQF`p9wbA|jLsv1!Stxq;iaXo!pBBGKJsw79`Mj4xK8E@D zrz-hG%<9R}LW}^W0xj(snN?+=BU}5x$8ah8><`u2C*jFSzuaog!fIWk?< zK<1yY5|`dm`b%r119__mfd!j1QV}l^LHxgvign2weCwUI;%jp z`_XdrANH&$LD_|}I0#AEa)w8Lao`}E#L5Cl|5g2Hm~KesJ7V|!;^nLWm*cqC#M8M| zrQ>Uf0*dr`On70*$g)&!)HW0DDy)J99xI(!!J`CBF+pVpm{DJ^qu=l8jLqGYO^}lJ ztsi*VTIOp|y}?$p`jh3HEAJ4kzE`8i^u<#r%bS)KDSGCAOmFgRN;L>S+Ek1P)Xu{*u#OBOXnw<-2MGkDKyqS%M5 zn2Hp~X`vi!qEsz$MT!MVG4v79#VkuR*MfMV)(eAXiSJCk=og6jtV%m)@~cXo4)34L zvYkO3;$z_R1KN?jtQNbx_9z73b6bG~c*!>it>1?iS|_Bl$X1&SFW`9X(FJnAHX4S_ zX3K`3np=7{t3R*dpQSFeHNw?XP}j+U+g0QDbTBt1v-nTwAY1uwO4GxQ(O#C_*C1(_ zI~cwA>hAqTDB1>fB$l`7qKQI2`Bk&(oj4YNYK7Kxog>wjc{_1xewj^${eqg8*~Y@ z9?cI`mAHE!r!*pCEz`gI{aVyK24S?}LD;-K7-u$wX@s`xOXbwXu%IC+cyU~WlAP72 z{CoGJ&Onhm=H0@OTkYg?J239Cu{bvd(O261z+3AnO@wrEuxz~cPO&WnZFnIK+FKQBE_zI5CE;jU-Gl{Iz5YGXyyBPN@jyXB5!IrtL4w+J3k0H<~wWx&~O^D#>N z8|GhuyGpcU@g1I=7wJ>n;NCubs-z`Lhd-sP!_!B6L zV(HB(tVBBarRi;Pu$eogew?$!UQtlx7Tr$Nk@g@%;mo~e4Pz98FeH@N!R8A5 zjL$s+vzulX6|?>J{B_UjRk1&#j9}gwMn%hYS1M^~NURWy`)caak>_92m)N8Kq9nNS zIc51Ck9>D>x9Mfei4^?EsPP%vZV%%n;4Geuq~Sw2MYJ25zGN=&tS@hfia~|1nigte zUrW3DC&HfJ?2cSh@H<#F>nL5WAs+>zP=A!^g=A`(I|_IEzvskT)U6CcHOCvF*p%Ht zYWX&eHuRVFN~G|Tfg6`AUcGz2I$oNAl2cvw?8WJ{oolU1>ZY}Da*ngV+gU>5L{@y@ za{39(VT<0sFM5CT^bI!_XN=lWXW`~Ng92UB5Vl>3XjFrI3U#{KaYHpbCjgsuTO5{$ zUam;#wv;y8%EN^Roio-HyIvNqtW9U7=gM%GH_Gon`0cLSf*jhDzNFWj3RZq#^=Je0 zN0bHElP*UTOl8{yz6S}^?ovA>E3slUpf@Cyf(K9|SJl0o%?3>-T#?xLW=Bh`?o_am z$3p1qp!zm%47gP^I%2{Hs4rs#H9mBD(s|B>b>cdE!WMNv_h~9UCt4j%CzaJ|ailFg zdNcxQad+j25Fh<{j1vr6(~~+w-kY5$qx=cs-h<_DEnrG_8T8~5tQZF%q!|O;l+Fej z;vI3pHpj*gh0-09eIu;@4(2turQy@Ccg|~D6Ri10Uv0Tqa}+5c(pNFBn>JiGP=pnQ zT-esfTl1yQgJxr=jci&LMRFR}Y-Y}qGLi4u7iqJfv~4eEJx*2x2YkeqHyTNlFNi$c zc-jd`U2s;{*pT$`ML))LQHrVrwTN!?F@-V$Ee+WtcNbiM0Fh;r!1esAf zfMvzCFGbGt)*b@lpn5sf1y^#i)UbQ;aA;$B18k4|h+}6}_jP>qwXoy_|JB1_!AJ@cJy$3FFxz0MR(aKQ?K9t{eMqo&W1gmU&g;ow1HBWNY(>IK4_E#{pF@a8J z5O0w1kH-muuFo|Mshgxz&KX zpOH3S-)HkomRy%$xy0sV{nFx({_QDh{d`w zM_}jc(y0nA9QSv22-GpymarWaL_S~;U}tVFm&`!CN*soW=`NUzRB(@8u&|6L2l|ag zCMld61JXHz3kJ18H(H-JAN7E2ev3^I~HYNminF8pT-wG0XUK zU$=3e*NMBKMBYhSr9WLP=yTOag_BQz{(PExvME&c%kjeG(`ougS{8`F(M;}S2zdpQ zN1joK=^Es0I&nI2cRHgfl6^!p7qKnr8a%h`UW} z`m9fezTXX_^U~LgpA*-4@q45zsFyR_e``d2jWAlN!!FNLBgE*`FmolKUnf)AZ23Fm zLGJpGxLwCsY0EHNn|rAvE4_m|P8s^mYXcNyic$Ik!bqzZPl;NeysF^p*YO`fU_IL6 zd2Y64i1J->yDyd_9ZvO72!PQ?5p(bv2BcjGWeyc-V9LVWC|+-DCU`GGOK;qB6ri1& z%3k#5b9|!G&oCYoFQ+~cj2ifGLMzJ(rM7|YH2++$^9B$L%W6gnJuP7c~wsW zqXO97i!9LjKaee*xPp&-nJ80mbUb>&FVPcW@6o`O-Jr-;tDXHAxx1dr7{l}ZXFg7% zV56V_n%PkdY$6d@W)I}??Fz+|S^~%2TOCeayYUY4UA40&?}Rq+&}9-jS4UVS+BPZF zGF`5?TkG4CnqBMLo#$d|2j;`!TOFbE;hXPe#=qKfWZqS>Qxy3Cy6!;M)j(?ZeRV3U zhPKFH!KrZet(6psT^*I=X_p99TdjE2V=Ott%JK{oP!9gc8MD!w8w+`3me%i?%%kIh zj;pBZiSGLWiKJLuALD#%|8(M+$Ng<*#ZNt`Ukf6}VhH1VkcLS(7s#o^!Y_?4XraO^ zFh|UlMTGyywoR+KFJxwl$$eaGvRe@Lq(uzW)FHBrc9U6(29lo98AJTgOMd#zInNf; z4j>zVy;i#Sg9;td_uB;`OIM{fXf%=okADGO1yCwhB;k;ow(M%%P7Y}5CUjJ!G3aLj zYWF1b$+Nn0?dHyd%5=z+eD|tN;qzoG$wG1QqkwO5=Vi+Ck7_2U%D7&qa#1Z>{nlwT z`&p*j<#?GTc2k!LKNn!fL*U*8G9^%O`A)ggs}WeaGWB}|pizVQ+^%ckt6J?TI0)>e z!S@x)s_PglNb^c0&YRJNnLX_kRW`ouxW{nP!`*uoUM*dMYlDWBK_;E`8RB^-`V+MM zC?{~6#f^vHpbu;LA0e8I2eT`3eM_=4!-Lm!)4h539yGepz%WUJLSYMMH{OpL-KfPK z*8g=Wy$O!Z_&Pj~zjFND3XvCZXMWf23IF()&H?szD8_#7>U1e()s(I?bU?5kNN+aRH0vBT|E6>;n(~=`!6kq-`_y0jpCPRflk^`j(NvR< zYpQ^3Ae6M|>Wtfvq3VWIVv8IXcaw4RJWbvkMP^2W6R-x}l@((Pw_jhDF0da_o zVYz3V1C9*XC;IO<)U$`4hvScQig&j@#VJCKa3Tjm+L)>>1ojHE(QA=#Ij_r^KN>+A zhVwtE`&Htd2D4h8I{dqzE?T33eb+S`5}K~CXC1fC_q(qO4$zbFk1j<=c4kb(7}W|S zR=~{w3k!?!G1Q*%{vuT#_DN3QS~I3>IMt~p{!?5-)z}Na2bEivhi9rKogrdD`rOQ% z=WT}pZN_*o835b5fX!Y@z~7d5pTopkil2MpUqPb zhF2E|JU>kd{vs)Y&C$6F{NuNR|4Yc$yrb~{r?V1D=Z5}ico{1K<#2fJKeeo3?*9Ze zKfzep!_&W3f|R>KXCc5}<u`My-T~sXd98(ATK320d#o;Yrn+^#@c-UWS@fR; zaF9>fK}ubXX9~$W{=c@qJCLgX|NkO{l)Xdak*TZYhCwuE`7d#{jPuRb9T=h#4s-YJ{@d3a!-XLNeykg+b=*q{zru&gFe z_+ZY@=*go-oA*6)0HB=%ke$Mh2U6-4QR)x&k4{9K)B@(Tl1vdyU7B(WMPHf^^Dj@z&4(Mts3z`>RUg+|e1$zh9UeaG zgnkvd2r0YFX){epy7Umttv}$v#HwMfzK~E|(^L$ARusDtVv9h0KYCDG9c%8pJH%3g zs-xkrO#{04YIfAc7NXs7oJl!42(hb5!=~>}4$yIE=MJR3OXEh60B@Hh!^uLNc{BfKN8o6D^t*Fi4(Ei>?a#bDOYWdvvy9TK zm%L4$)`?_E7QkE`{^;}fOt_qblnvCLfTbX?wlC%YSmOP>c6UR~kLQpSnxUdQ-e30S zzv81+vGTLZD`*d$ z+yWqXP(&BUV~%|Ddl6}QG4R``tpX1RN|tdsU1_&uMpiLavB8vV)h<3|tr2CkOUiaq zWVWxduwEO^hUMnh(4h0D;MF}acdGvoll{Qi^3Q=byTD0 z$u4_8mmR zqy-3=Bzc;P(t@Cj81}Q!MI^71%B6f{%MesWD~shRZpF$@g zMJM28u?cTm4zq^6PeG;GyoM2S=e&I+(n`$1()2KFlcd-V;756sJTn9ZRW8_P zwNq9s!+0*3G}5_zu^Mw|0xPn<9^CdTX#M!-p2m<_VM@nD#msk=Qr!m8?LQA6MW+i_ zNDpVRKii&n|2m-2VPobbN~_7j2i6Y1kwR9VWRVQ5HcSXEuf zX!q#Y%(r!qc1;s`%%vh)d*fRxJ_tM9E(p#!fySt33rJHUKNxMZZQo@8UYQ8l(0Z1z zU8xS|>CXS4i$iyE-wG>T8~7uK@s!1(g=#=V!nsX{x9d_9z)Ov(T{%ag9*U_KZCN;X zi|(l^rMXq$Kc1NWl{Dz>T3sd;_-ucKOnZAJ_1xbH zvDvWm?V7mH*J#WNqLPd`5n@X&A$Lcf%i=iSRI$+HylD$*>$Mm1eJi6CBT#cC`{D3p ztylC0)a9GW2}jmSEt3Bx>MjTmZT#0|+<(b8rp1+5Wgkd;j4%RtM?V{0&VT%7s#%a} za<@NgxxzPT4K>3%D@z&_SOgVnrhkd3bg(cRY3}on*(!ZdE~5E_MV?BKUtr<>z2|zf z-}8|&=LDmJ9czm`rooor#1J6Rmt1jl;q~I>T|Jhc2hp`q?^=UKi8>kV9yMZ z|9G@#^tPG71FrdVy`X0WnfEu=-#jBC$}8MjPS`j{RTG?E+SL3y6k|G9VRD&K{_ z6su6|0`HT*$c3Q=hhL)YWHx*+f%Rab_#Zlkx zE=888`>bUGZ|z8gGq&B_)|tAio1YbT4>r+ruVCa+%I9^*COSZCoR^1FG*dDm$QfJGg=uZ_rX0GYG6&!f2 zp<20{zMZy=(S2Y`$6&yY6FZg14|n)I6o%wZzooVdsD%X4Q`yy#yVh+XcXh|Tz?+}d zKu~3SzN}#+*UUl1I(48v$BjcPapdFVeXi+cmE4~EV+J#Bzj|NvmILawNCh-BNF$Ou zUCbrf)rHjFxdzjt3xPyEFnKp907f>I3QEi`SJ^kfha4YJ*oG2H6n{<2Tru@%jK^G9 z)DE~YKuS)_9HQRZT~sN?#oX8a;GL752HL?mhj8ClIz=AsY`qjj@1QB> zNv-Aoy|YU@*{nskW`nCcU@dZ^^g(KSkKQuUuf!+&pi2F>$n1()w)(*!p|(J*IPqCI zLG1{tTHbAC@-std$wO@=NAl1sTYaJUK|V;SmFyD43VB}4ofP0U+nC==rrzjB=cFps zsM}*)pjC`wHc|OU46nxSmNe~+^{cE3;Xejx1X)f0;KtQ7VI8u?BIeXn#WL5;o{0Sp zy#Z4HpTcC{6@%tLYc;Ty8Z|G_m0~;k#rr;s^l;Nc>-EO%p6_Hb^PeAvJOU$o1i)jq z8Pe&UvJrUiWv>)|S)E;C$o+6RH;&9-pLwO`TmYCAyb#*0@y4xf8D*wvha3OzsNs6fK;$h%}9(T)=fZ!d%L~fB&8?iFkG|SqJ9KdE%i4 zw@SQ(PJU-L`pS7%Hwg2yB#>id!gWA(0jRne^NwGN`(d(r71V8^U|u;&Iv=0gRypA9 zh|X(V8Z(LSgm(?oESoqkZ~tAnGG%C!tSj^w%Ny4*A(pM)3-w8HeGUaWsWy~DQ^>Ma zq18{vEtfN$)yIpsN?khT*Fe-I5Si}EJ+13+u4^7?FAv*`c2DeH%G_IZcK5lDt#@3X zYO+2u*&z>xKq~(3fjs{M&<3M7EFl8u~ISW68#?B=Xx}7+qnV z_FuzRw6>aOZ|fTba2jWihtAe#rkv{|me5WE;ytTcCLiDo){ehy1c95h z$fJ2idrB@46o@SY<8Xioey4GHjQgFrw3$BKkpf8(VBkv(`NeH&&*xk4s1e`C)5y~< z(Tk)J-wQHZyNzY$aFgEiuqbT0q{#Q`~#$vn^T3-YE%Sk>dY;;{9Vi)xYCx z&5KXq6Etir8sPT9RbO5(+c%1MbcCdq}z1nCzc1_KCn+!>G`aC1BEN$ zQd^M`yhOvj)!jneZYaE=S-QvgO;dx%?@}h3pmTCm47~V@?MT;8c$fL~z zwK0(AA>GnNu|L1309`!4_19249l0OGYfq#x0&qHzd1-+XR=BgYRK#kuX? zy{XRJXJ{Y0UcXX8>o)$O1N6^1p9T)xDS}k_9r<9J%cWegaX6Z!Ua9SwEy6aikT)m5 z{aO~mbx)>ogjxx(=+FJ+$N9d)=n+(HVEOnXNKS3b!u#~Nq-eLi%ra7gCKlH2&xI;3 zUWz(@9Lx^$(0i+zyI7br79n%858m&fi{g2x;sHtb=1hQhs4rbfENPyP9~=JiQRv@a zx80fG+n7}DlYP_aiMPEf05*Qk5bpY<{Fjp77k5>qve&?^G9vwh&6oY2A9c{DMHg`) zKDPcrZ~Z(q7t%blTN#i7ChE~Fa6^BXNBv5QidJ!CMz0^k4t6qGOz-hw+z9xdF?%8G z36Bk1a}Oc+%a;R}4tBjmQa-#NTcds2fzK1q*Zq-D_SGYloE91?&HMT92j}h~YJ=3m%~2|OF~jO|C2J~G4)p$fq7o+Rmn5V| z6?0lEOZ%Ie&7GERTS}TfiBZX9)H8iI>9zpiq0DYT3}pSg(tI_}FDZ6}jmD?xlSpm7 zx}|}H=Sndh-!E;kc6)S_oauqC=`y@anZ0Rg5b9(lwvw&L{*5B<6@k9+NJK5yq=VU1W|P;;uw^{fr3hApEHaSuo{U>A@Ns z^PDW0uW_#d8}B>IfVJ8-Mmv3ugD;iCTUbZHTWrHfDN-=1UcaDTzZK-~mo%#(=+v!<}+>iqCuTa8|- zwB^A?-Y*&~LF($g?fI{1AiB0=+R%X}q=wP?4Lr3BwS0a~zjkT3JUsJ*?owmWS8l%i zt*_MbMv-jfm#9?xd-R;1J+xO%uj&`SD}C4>5lawe#ahWF=vmEnb};0&X*VfrUn|8X z7)*tzTQgPpZ302^o}H@ND_$|$1yY}JV{CP5nf76M7-J`cw{C|zxgrf8nJ0B<5~>SI}yA?b4kk?m%a%{p`Gd8-AfqW&U;N+|T#Mq}B`>TG4vb zg+5CEm1$h=rU~qMb|a)Ub1miu1Nk@G2JQ?9&m(y;tRpv|w6J>VihAQyr(Dv6b4+pY zn(^o4*VrS_VkbKxKp!~TPn??VL0|t z80I#0(x!I|U_2Qi4}*Y8L!xGsm$l#VHx0gy0$y3 zm6n$|N{m;#$LQ`B*S}@fc_h~THd)@+z9Q_LX=zW#BW_5`jsckwznsxvv8biU6A~RV z_&Gk>Kc;-rA#$;mT2Wf>96x9NcFk)Ip)vjJK%Xg_?cCqtUg+lEQJe3W9MQV2XWBw9 z{5Agokk?Kq;!ll*s$O!1Z!rp^=$m&z3K4nrV{%A*QaVLt2gC72*#Ns9ksmx6n$ykA}tm!*zO6G2IX6eEo!^x>G$5 zcs5X_n;h36sjijU|Dn>(ctl~4+Y7}}*Q(sa^}NuN5;F2*2b3doyV;VAr_|muFp_$> zvWydwq;jobD;f~Ryrv&;(L7(Ite>nWDm5jv#$6*FCFp1ga_z=bsx3|M5#FB+&Q<=$ zANSnp=4E34=E`&(fKp}RQ-6<+sxk++etpG9{fhp-qHdvl<9lN7 zdR4Q%2ws=hBmet0HprbKv{sv(KcDi!)-i$lwJD7}G$m#_X{Ok9$pdqjE7rWeA?97C z(K($sF`({N!uciZ7ljGhU}SRFEU>Z>%&Pc=(g3doRERuVwMoP7E2it7Ki6Iq0y79D z(^@m-a%_?V2j9!e$q*Nl>-ohwSYd^NJA=_)+~+XNR3Y?F+|2xgR`mwBhIKq}A+{Zs zKeD;sOv)60xpPz6j_pcHO?4^{fAe`J!D=RbV2+e$^cV?6d4P>FxI6i`>y}lJ67fDv##F~LfIWI zPKAF~t}i^gGbAV8?5Rrby{S=fu)U_W%rAE-2Ef=(32<^-jdBPiJk?wVDrj;H+6&Z8 z?vp^Cw=0nqC@78iskKK&NWV=#r$M{L##xx;FutChx1D;8wH#d%I;(SFR%vk)8%N

    D9GCCKqKfao>21nEgY

    L>Fhfg1U!M+`==S(XLLJ@W8-OB z8lm?C$EZu@g%M!Wbp0JbcU-o2jKNHGx}0Tb*sBS?dtF@nFCHHpTxQd3Tt-HP0Q*~X z#*?@Rb9mGKIH6|h@je-D+HeQ8#sgnBGW%`jvUHOr0@{h6mPX$TvB7KAwB83FBQ5S$ zwZLU9b%~pNJER;`>4%lG?C@qSpTz-o7VpWet+lyaV9{`aa9!Z!T?GFL%7x9;htPvh z&?xqpRxX?(CVPyLLBoD(oxPH?_YsEh!;rbeX|J@sdijg^Ps+2~mx2YZbVxx7Vu8dA z)^8L9pFmPUqVt~Pb@OBMI6|JmBp~t4$G3;)q5!x6#KQd-g-*j;yL(vdZ$Wd2z_(20Y}75T2w2M)n{?-W9zS=`xW_^;J#CBp~39UgG*kj4Jx)$o4=pe z5lQE+L7-+Ov{AUf4+oB4W*G{B2lemb%PB8ZfsE_s{^V9(>kL z;E()NJ09e|mVFoa(+wE~`t;HPm8A@FfCs91E^Sf;(Jxaj8UMyH=jJI1{r4whC&qC% zYUyC1jKgCcr&A(1WZT-!tqR^Jag(^SE!CO1b?AQ{307G zs9iYC|6N+Z10gO8*_P#(?c(y#JEiT*qCOw{F)sLXoPBKZ;RKU})5XMJ{r&K4d*gKE zwj_a1d(fa2d@Wrqm1w;rMSS~**3;rEyT;jprh$-E(+*h(%iYtZn13gMAZRv4C8$$4 z-M(ws%buYjU66^-7)hkigH-xvjT3M$NBBL4ed`QlWzxL&R=J4A4346(5zF8!5x%Qd zU4)7m5R+u}CHzv9){?|R)f4wqm_X`$b_)m@-eUk+~}{02%<3X=2Ly{m(AY;Qaee90M_>?^^FH92@1;U}@MJv+r`g;uWjY z>@bE=d*YTZZhK@x25EUpggB12ZXJ>|9byXY$uH0*iNiVl6V9po2A;c@O_*@$<+G5X z&(o2n=Wqnk&2p4VpU+-Jswt?QZ9aD|D3dU*3&C#$12QJml6EqOdAzq6|Bk0UXjuK; z_0&OVAu9FwRe%Ic;v)re1WzTq(1*px?MeL5c-nu)n!$T+E3EI zwOf&8(eewt?_DKmR60}7J*UF9l12owvwClanonR5DznRmn(@PIE97e>4Qt%vg=Vou zmnMJL0zNKdZdHmgS9*oPnC2(fevmndz7=61S26UH{utZ1Q-%aJNKqecbJs zRB15pmk=U1=M{JA8-iRCmQ7$wT+nI6s*jKG03l8R(SfhjbDuV}8)jM2v#6Ms_BQ4) z6c_L5yp6fB92dq-;(EP2X(e!|{`e8??WXDyv+-d9@0SfOt=S4Lht8W*nT-ouxm$W3 z`3~!~`{R`>Cdc=us(alok1g^vQFe1fRykgh8Fi)vaP1HLgJC}skxRT)xY(;5;M0Xl z+m#+#p^Sx1BC)*f{^e3Qc+o35D77Q;AYSS{c`BkHVzQMNdD!&L!X?&f-O#(&&QpTE zdzEmIDmMNl{D(zVdJ;eUc#GC@WlV@bERiUpuee_T*hFEdQdiGX zeY`qg0*I&bOkafox}KQB=u^0MAL&(~9JiIWB?!{sPd?b2nAgqEV|os{V}?Y>q5}q4 zyW|N$D;m}*G!L1~#`jrs=VU-E4uvS)(mh0$xtbQ`7HsVb_gER#=sL)DIAdEp)wbhS zY(UhT=d0Kq?>C>g_Lb^6t@IK&MuBY0m72;zuto|@KH2C?*}JTryzC1WBcUNGmXqO#mHgR$4M-|Kyo1k2R|>-rw~zL`v) zN86Fmx1P!Y+2R90Q2Jq?Q_#G3AX3yLlt=&Rkr5)UJ$ogZfAS~^EotMLEL~s&-3Y2Y zMg{`ePNU5Ri>%6_B~hqAC(()O3Nn7mY=uR>dGONa`fxW_{xL1x+DO}oUI+2&+D63% zcBa+rO`dgXfoj~u!)zh0RhJ$y8wU7uX`PGI9licAo}_)r<(e*i)WKN2&6IBd)6Zo# z^?4r2nr)r!qVF0FnubeB<8wmz3y_xBmjI8gY_@8jqETQT-{*uMP~o&;wI!bdw~&N5 z5$3);)@v7PGwrjnU)qO$R(7~%F&mF4T>6u~XJ5pA{3;Za&0cJo`DpDwm51UJ{CG_kPisQKII;tii4_p4(TEEWLeE zMxSxbF=3bwL>t1+(Kot zW}T0bU!N3Ri5})NTd(9c8LwF$OUePXjS7gm7%L_+w;*IeM5U^x_A5TaL3BrRoLDCxL!`DO?6?)qa}P!+p^tKFI&ZJC4ZMc zJ}Z1YRzB;^P1QHLz$N68yEs1pWACL3*QE)SMDUU5_6BbWF4JURi&IP8ma9=JF^hMn z1hq^xz%)H+9u{6yHIVke9(P|i;IEL9tXh>AbK^@uFM9!+c+uYZ_}V>QfmRC}zAxlX zd*#y9LUEhkrn9%Tc|H0ciacQZ1* zP}_M-D9`$o)($Yc^eQ5mqz?uCkh|3UD+M(rE>(RVu)WY^6?Kl67IslTAfxg@RBhlV zQvcRc?oIjHJBz`eV#GvZBU5 zgnYU{P}15sTP*abssS5DGhiIze#dW2y1(#y;?(T|%#(2X23fb}zS5x*2f(3h%E z(~n|`u_cX^1`RQXMS4S!MJq05jDd#{cO_sXAgkc1_J*+&PtSE{Co3Vrk!0l|{}2YM zYs`WfER2!$pP&JA?#!!)cP_R^t(DNf1GGFs+SI0Y%?Ex&i8`g;tzU*TLo1)q^3vZBF0d{D<0XycTyR;}{fV+2!?-fr; zTFk~B%QpXBj#^%hUrKq}9@HuzbIiAv*fSD{#ci?$ z8%GopiG+)T7^a%!;ZkO*7Vm$GY@UB@nae-5%LibH48rf*sCRBBjPS_?8JkxQ@z zUlX7DcDXOW%F#8OB+cVJM}oT{F)4ebC&0VR79OSsHkWa5TRD|thRrMm=#*7?RQ*IJQ()O zmPcE$&F^vp9fjVmYFJ&j#6p0j25!=XN+yGhsDYF)R&(aY#_7SRhkXLD%~13Oib{Qu zm-nz$;=SSJ3lPZL`LIW3Vj52xYfJ)#Oz2M~%za!&fX*SwWR*P%ylcT%-+eL?SNQG2 zsw&|#VQ-%pSm4iQ$svVU4BKjkNkV4mKxpvRSE)O`Z-C$U84`=~{*X6%Ze$SIi&UxO zt#qg2;@7l9B{!IFz4=8JH6d6IIYmkrTRS_I9miMCWW}LjKD~6&slHTcD*w7nlq~Oh z`Ktez4?NY}iYqFsuY(OIgw9$xe4C~3$Er6d$)@}FEgi*o^e}(}Ax!T*#<*r&C<5KQGf7Oe zAdF00QdK9mh9YU97|NZ_Lbz7rx&U13xOW|U&1a4OWJojkqIB>TCc+{YVp&}*r|~K2 z(jEO1Q>WiE4H2h#-`xFZF;uKD9sJ|*Vxo+xiP(SA?66;JbNcE>%Ukj1`UQOPlnC=_ zSAeCJm=v`PXVrW`<_e|KOZNh^QK2=2o`;W;;%=Nmu*P5U;Eq(Ee>Si-7Xx=T*=x+1 zJ-sq2T6VHWp|8japg4SGRH!xGp(1-z-9A!g$`D2vvXN}|Sa5-f1nT=bhz$`wr?Qz4 zzVsC?pAhyQO>_1z2X05-lLWjb@kk^L1R=Af?4E?Czr3~4X)e}WX;>^rlbdqv~ZwE=(t}Iu45uD3LMTP zktxX6?aqpk|sS+BsYFTVA?QUk= zp~;~acdVZS44HDyX;HzzVYVJZyttkAuBnwD)@cC{FW~xNfX;UF>AW0%H96ENOn$aq zXr1Y4J{1p*k^ik94oizPUN=}oeI+UzLS_LF+Df(;Ye5h9c2M< zK3?(F2eP-ks8r%OS|fw9;cRwS5!v#^XmB&|(Hnhc4_w!G!r#01$$f*Zcn`WNcX8iT zWv7aKic-3|Q-F8Mg2uLQ>h>Ot;kdM$Sf3%1(;YU!i(+ zHtJ-tn<7n9+PLp7-LncN%R)ZadV3|k+R9}JopW|g@NPympaik0CU0<;#K|2 z$=csVx0E5C@d!z;e6?vNf{?>-BE)(O?yBcX3AA4JX{*5`!@+Fub%T=#W{n_IwK(_^ z*KIzuKr(0d5?)@SkNtBFW*11p=jI!Cue&~pzKDRnWNFaUk%o%JFpm3T z#Q9buXY!Xf-!<-CLu3g4&bYZ?1z(m==@4cpA+E6C3+1iZ*@N2trzKdxhZ{R?81q{v#9i#P5QTdmA|WX{4TFeYdlV;%3pW zGxtIz)XI-a_8sOTSku4J3iA1U;!V}Tr;fAHQt zlqj_j{k2qQ(s4sFO9OxVdhy9tXu-8)CT^PSStJkK;21-I>0TNbsxESk=zJR5$kEb# zTXaUBEwN;cSZ2%1h?b%R)Q*T`i5`$uwNvoo2WRdC!3j=Kh0eWl00Ktb_P5)|J$r5m zATv&SCHA7_@>^f95DTX9v0zDfvlA>!EJ!8zn;XcaWxJQl7aOBydlPey|E#X6tK8h< zWIXM$xXPvfL!h4hl(;{_20A%Rgt$PVRA+6N#L+~TR}~1~@bGYT^jTl1kpx?o{p@1k z``uH96p%^63Y%c_vUY>mV=RHDxkb+v3_(v|% z2Rq@N)d1t^q`+w4v@$5$;eqRRriN+a{7);6ScL5*`m?8hizFvFi^7t?hLzx}St^0S5rDGR$d2fNx^^l)!mXw;{`oj!R`Ci%_M&@2t11tE;F6h zZ6U4~&o*hX77aFfB-WE5eZp;A`}qG=N?9K!`LCB>xkvow4|!J-XbV$xc9MV^;-F_j9fM0a#{;3|ruP#k@0}RyuS*G~>kM_m0 za_l#ER@hzq@r#1tOeWGNEU&nOw|Dn&cCkwK`y*gFcCvBVB&9RK1j z1QMy`1a=c!<;hl~N+nhk!Na*jHe2BV%)F;`|4pk6IMAA(>QDOkj`pwvt+-|og~rLsw|6{r3(0HnVCL9S5R$Uh+pI1mB|XCGwI7jkA)5V<)s-v0|O zBiZ{v*B8*(=U)KC4|=jt|9gKC6vKeVG^l^hKBf;VNwEKSeMbFa!1_9Ff&o)V0q-!qJLoVn}#c@Lfv&=7{_ ztd`Gj%i@tQef00@Npj}S1W)(-6UTsTE=WUQa;6A5yE~VzI>IZwhfY5E22mm;_3!)&tWq-kyA=YQuSkxaj^}um*Y8hhZ6@%#=)^!2NBCX% zZPiZ8uR>Xt`liNiB?T!3tquv*h9=WOe+uet2l&S(P#jXXP>TtJDwErS{8RN_4)l7a zW8)JND`)_;Z9?!KA?jhgl)XShW%ry{3Ly;Lj%YAVC5Tre_hnXKuiJMhpvFdT#<+SC zkJjPv<2=Cu;KLfV5|4QC`O7T&Yd|A^dsM?z7EV{{zj^VGLTk|lU~M<0tGD+1vr<(! zx};D=zp)(^7Ru8kf_glNh%}2D)}O2s5~%aK`scsTW5%Y*RbdZdaenj>=#pJGhp{(@ zQrQJzs2ERO<39_0?^K5>vH%?-Zn8HB-ODDtbPKZw>pJk5>LjFrE+_IzKj8VZ77$zKputxhnTwUV;v~5Jz&f8{4Fdc zM9`5jU*;>z-8zUhs95v6C<_uuLt8R-721+#m6MCK+6%=2NXzGs5>-T;Jam|S^m>{J zx%ma+{9)nM2P18{Rqp4j1wg?$AMFsyNK#1wDN}lmyw^`W&~jT}tvU!SvicRh?L~-1 zWPFx-20NLb!i)aHEU-19uOSCzHrNN4)Sm+)dvAxS2lNfo*XSs&nKEjeXI@C=#D0A5VU4T5E(j8QKP}^R2=P&i1TnUM5-pNLQ*Mz(DF(k;d)y_R{4kR@4 z92E_yNfd)n$$rq*HnD4jq#i1m@4@*rLAuq$ib@g%GU~*zKt(qgW^fvG>Sll#Upp+v zhJqeJoGaV;>b?b{dm~n%4|^pmM1kEw?XGQ1hsQOFylgNivc?;7^!cql=XEW(jKXdA z%D^E8=a!;c4ECe_JV6tjIQ*bxFl+T1bN4TZtZ)F+j#>WkpmG+eMO5VCfYCX(twY)} z-N&|*DI%&*TDPz{m3h~(EbPaCFp8V1aIWhViC7wcj;p(5n7EzBns4cw zG*yQ*_KHJ}dF&y+AxAe^^{6c-0jfmYN+I#6BXcmWs4{+=1Z0AOqiq3e4f?teSzy67HRXC7MFIMc&zb^4p=c2 zxN92tM5Y?QQS{t+J8k-~c$!-VBY*rILmqcYASe1u9^(1o`h2|^-XP>qZP&V9U=J*% zH?6&6ej%g8PLcRy17S9>(S>OCJz{)%USYnhLIYh8F4g>Lr2!CEbSpthsxg;{o48ej z9`g5wpAgr=GuEQegSc|HabzgqF8J;PGT%=$jCOA)>qRdHUQ)Q&_u za-~&KTz_<2cy2zTy<9C2Ivi09PB)}Wa@o|~KYHXy^MD}9`DG8co+$pOTRPe?VcO!5 z{dcRMi+7)^lKRjY1tgPbZ`>H8PT_JFe$?Z0FW0iWyRsH2NDOi^&$gdPJ+ykCpnFtC z^@~=!?mVa)9buTDDsUOp(fXPELVS0UK|NW2R&89)x>9NvfA|LLpYx}2=~pvhObzj4 zI56(Te@+0VA#6E}Tn#5YulE~$Se#UNFX$0JYq&NvZ>zLXH+fOsWiXgeOGd;bFbh8u zceJMrKhJCQ`0+cBLsK27xI=?b@!ril)G1F%^C&|^@%$XG$MlB4V71Jp?_udlUbjkl z3973wr^Vs$HixX;W?y5UtHfP-i8uxA)zMWK&su=#7}Tg`kWZdGK`A01EN)P{+Ov({ zc&~{=C@5SScYR9hPf0n6u0*&@%|3y4_)-o2P}$jQt6ny{KKg{lE-Iy_dAFFwgkLpa zPS0chd2~{HwUO}%j5oui>TUSaa_u{ce601w)X)TE&c1_;jlK2kqbjMPckeLnpV`|g z;8K7(imavQac|Qrt40>2klbGmU!#yiMVz(nlEQ?X3xCsd`1%D#w^yEZ24xCLq&HoU zF4s&IwUWMYy*16?)+4fCbK52eBtqx>9K6=$_H0c$mybG)Q4Pz<>`t+x@EbXVd@Q`=S)^plZ7~zW5k3f4#Y?q+ZQ8CGeGR4Ys~S z+Z+c{zj5TR9T_!`#Kve~U>8;chIs$!lRTH#7)9;Y6mitEyVm6;Kr~DMl0ce1I+Tpu|y00x_c=eb0DWi)-jTj-RJEANj!N!{N9m} zJj+@WZfdSW=ETVfY@u3R9|3!9^JR~Z9^?E_m|o5ycvOKf@5=cm_jd53@ig`c!#uhM zP)zy?Y<;8krukrzhuE={r!yJ&!U(;D7g7QSC|X21sA=DhTwck{vPNDluADPuLr zg1r`9nKG^|79}4e1LtpW_6qC+AALV>{nl+W#A!jWd|$z!uI1MKPk`WW6(NW$+wUYg z>3xgTD>7iUmje7wR(OGQ|HY5Ac?!Sci`A>(V~=-)d*7^%_BcZf?B{F1FbGu_Pwo+t z1gQuhv~DL$2@G#EQ9;Tgp@B-o*pcNLpWIjWz8CK;Fw_vnPtT5S|KER^T_bad(SiO1 zKmhRMkd{}O%}TG79W-V3TFB@?;YniHVaBt=@{+PYhGTyGNCslZ+z?Q@Ow*tP8POSh zWJmZ5T9!=86GN1+z+Ny!@$Rn{TOXyUG~giW7+!$k5hD5Blp*+7XC&q(AxCQsrK0;Y z0io5aQ%wy9pbKU*0lyB$FF+zf2yYPlOFCa*xuQnNaT$z#PeU5&w69|k(uYe5Jfe`1 z99xV@a@DyGV$WT~ZP4lP#n(93U8`U=FWb=rl~AuiO~n{IGuTi$kA0hF0~{C4IzV+ydGP7{@>_Q~w3|Q`aAG3Gyv6a#Yv=_S`m^^p!!V7gc|HZ)9 zPU!l%u z+~GSOV}0XUP25Ey)2tn}J2_;=i7SN^2$OnDr@M)V?kwn=?peaqQE%n;xdCSKtunvs zu0xsXx3I3bw)}#^oL;nK3W3;8WYD5#4l#iT;w#gTN?A^bovq_-@b3{_W+56#5M+cN z10!v0A{DUL!xtt6i#@4fH-j|Np}f8zpMX07MkFl}<;l4UO89i~Q?XLo!=jz&H|~~I zsl;rl4F84wpP?tnKmy~-TW4kcmOYE5!wPdytACo-0FXbSLE}`X*h2L^XIfpgA6*oc zsFi;SQO~tsDJn?6y*=!B@L3w<+9L}wjbh0;0mtOOTtC-#wjuYQ@qsMbW7d25Bip}) z!zKi2qf-~S_p4y=e_gD_@09op{4Yto4X|j~%U+T`EvK`sPKUT`SbyR=bytXI0@J-8 zKF9w+m7Cv5_y{X>|4ZS|Djc9?E2q>E*zfwsyEE_7KCvbeN>*15U>R%^V{t~+at#Ol zp59ISHf2+?d8F+qpH^7rJ|K^8S~b}s6lmdFq@RE-Hi z;=Y0PjF&xIsZ2Njofoxhwz3N!@Vhi0PK0RQ~9S}zSDhr^)nSen%XoAG_Cutqt@YslTtd^ z+PJV}vm^MRAuOu{haE&D5J$Y_WlrT;kod1)zw1Rh*!&~dybGD(wsAn}yXBFRwDkLyGqH8D-6OG1Cxn$A^eNdEGp`~? zul+!eyq`I^96(SZrV1(hq451s8JEA2ifqE?vmQ-6%|D)A*?ns4d9mkro9{KhaLTJo;8JozQYUgzTdh;kn*@j@hPSIffnas9?eb6fg{yOReWq2T~_1kL*D^Ry>! zeP_(XR0k15BXgYvW=d$xK6t*usZR-=%-TgiQ10r`WJp(kHh*y;M*7jH`&TH<=!3U{ zn1^%k_g4|3A#>@6Zc^=AO5^ag1a1x5aI`0$=#MAQsMMD~|@gdX8=@2O@H<9_^ z`Bp#O=8n8+L@S^o!3IQFuQXmn$|xJ>ew-y!+^{O_JId$ z9-O7k+i{h6p=5lP^dyDJU3-MQgYDp2u;pKjaBM{BdQk1$!)xQX`aPC0d4VhkzU|`< z5ut*kksNvap0nH4tx6%@8rlH$ulIr*VzUIK37N;6$KIz`=l~5&j+hm(6Hqaxwny_R z1Wm8tO=Y&P7yi27O&YjFI@$2?y?+k`B518Mw`$!^|2mh5q7X+}Ka=k%gu+-n%^MiRF^t{m_+^ z^WE;!d{~){m>@IA;Qr`*J$#2JH8nNn4A^dOuOz|dp_=e0sB@S~c`EuR2)p?rTtMs(mw7PX!z~g7?l*7Y( zGv|+;u#it6?*TDVLIeG&lKQQRN#peSJOSrI%=ZU6$qs%e=?Y$I{-aK+=6uLex(2wY zAvSympPK5tZJMn@MA3%ryxoWdq$v(#i*5T`1J(OVrAMi*UkQ8Xw9nIB7H{L@hr^8B z)9x6$=K7uEl?t&DMozm!^KoM37fR!%wzzFxXEVlkZqgg&`YlZkSws^n81Y&PQ~Q4h z9D_h(p}p;$3co)+bHP1!{36lQlPp6pen_#!>)Mp4;RrGx_1I4ust3SlmDoEwZakQBHezOB!7G+Wr+Ai=kjpehrlA(|H2S)Zvn1y$^Wi5KTi7#cj#{fAETl_YV%A8< zm@kLB*y3c=GyB-rb2&XRuZZU*MSt$)pVdBBq4qy}2CtJ8xw5R;Vgbnk;d`h}jkhHm zhal$<&U&)G8PCKxsLJUA5ZCo7aw%<`eJ3?+%I_8(jy}jwf2Xczet35Nq%0 zKX-m!-6zQE{N0dv?#+6i&Bfl;0ug^QIEFG|dO9&a9yA`Fs=4SG0ZW8vi_neo{|R83 zQrj)$1G`58o$`?~kft+#bnLjp~Y%;l)U03TIlp+MGc#W2o z2Jf=K7EXtNF#YJQlyI2Wrx*Ox1(Chn?|DIVGox#ENoo`iflScti7(bB1PxxuX`hF< z8{aqDh$mwiZZqlVyLGN5n#a__|4Qw4(vB@POsr^}7g=?wMancCZn5(jI*>80#?rQ^ z13O=;L%#IQY8v-cBN`RMpRi0fNQd?!>ORxG+JMeI)TpnGrhCqLmrt-+hED&NvGw`x zsTs6pR8Xe|C{{y$t!j%x$?813K}1wZKXQAnd&rUDsrMs~*chg-LvD;MiC-TaE78do zoyTO<7(Ii#X1H{AQ}EM$&-kb2c*a}z)P~9hzF0Nv6fw$oX52Vl46g>e->eHCKkD5s ziB!u*S3%!(Hd%YF1x=~1m#MU8L$lN)`X)Np_@kPgfzE1wl4YgK6#102>sL$PEJ1q; z!#{Y`@01zL6h2oin%8wBQPKG_rQ{u&#X#3p^;i>4N7^IJA7F7)Tip~J%rb}W)u|wL z4n@hT{Tl7jIpP%65WzgEV45+^f8slq43)dExz5p`$yzF^&YjRHO=zRk@w2cOUp%5l z_yV|L_WJYD&{o<5eAyD+x`X+P946f;A;?2JfzqrM*yO8!UF_u`TiD}t+Af&xm}p(y zmj|nPz+L^@$e&70+`OMDPo((6VGBjeqI^~k89}B^$h|FULK~0emLG6XaMV~tzT(gN z;1d;W#iO7JTef($l(IYG{$%x?I(jDnv z4T%s9=qB;#w)~Cp8P{7|GZ)Xy_Km6xi`E(8~z1&cxEUwOgLb}vj<)u z4}@XKea6M}h%(~S;^3cJaiTK9S7+dnQt#06f{q&LSN;*7mgD!13%9N$6%pIx*`$dx zbqOEue^4hm%r6rqWBmzVL~D1a!f71lkGCU>jMc7A93n-+j(%UAn)2#>SZprT&^?`U z<}pAJPoy|uwvv3iDU$WkRpuJYR5<(Vuf&>~Zxu-0)31_V&>U>F9?yj}(xb{j&FOFc zIs}2kmME(~uPr&QN`wy*HrsXAqgJa(qhC}ES4k_^qgQ9I3}xQU1WLhGh#*we2hv$;3TiA6G_|8w}rN%Xr2CkJthx&_Hfw#+}zTVkBA7fS62~Q z)^N7f+_xQl*Gp};h)d3S_LSAV!S>*MtuR55o#4SR471hGhXs4~u=yv?dmjp`ODsu#udttX4Id_(sL zuG{iApmgYtW0rnf{=Odt(XbqyUg_z$KLyWvlI_M4Gu1*9X*wstXH1sTRLIlRv>akE z%APlE$B!*$xR&z>Hmwyb1`Y*V^HjR5|C2{Gy0VyzDTpL}?7<&Gd3^|{Tsov&W?9#M z_0ba8UA!I|Zq&shKXsB)gYe&AaX460Id3Q7AAezu6#RcH+_>lr4i{Y1T{ z#@6&BWRX6XJFej&%Xf%!(B;{@0xHBsFHOa0qL+;Fg~e#M+p461OHBZ5|1bOxvutcTVvNIvgC`1NIeM>jfL1-hHi(3_ZmHOg43@oR2#lq+(?ZDM@H&V6-d_sHRS-83(7V5n04Q%<33CLm zkxq&Gxo9tk>)3VKofwlkBGP~mlKRpS|uifcoai)y{x-}GDQ_*WTh zh+VJ#mQ!1Xpq3thf6E%k0D6VWH_!j9Dzqyp4!?OvCD@SnXRdqD6dPaecW}eiK?Ns& zqzr|(`kc1##y!#0n9kiRaRk%Zw*p?TwyO6U;1gw|FjJ;Xy;rJvmiltAGU{s?h6$t)*}g5)DZ5Pmc7UP%e;^X{q!b47NT@gVh11cncK2c|GToG*$ z*Cco$N<+U*PnRrOIX2b2c9GV00C`CLRaW2nrMW5OKGeqk3tvKjcC8#r(a==4^KkV0 z%+m=-Ck)L=%qanUa(l#UNPV}lqnjH?Cpc>TNa?sa+qf&=Te~lSPE=9Uc|+qFX3#FU zq)DM{!pbskLhGfBU|D?5PdKuusnlCY!Zn#D1zdg)EexsS%al&3>8x;V2TvPi9$|{M z$Gr<36_`^|0=6Z*Y%zu9Ijw50soeeW1LU2Wf}N@4lTv`^qG?woHTL?mLZr>%lLs@o z0|i2BGFUJr5SMWZ^_A&G41t?tQ*drJ= z7AQNE(16utAGs7r9ws7@WlZc2Z=t{H#{|_%6mQ<+mn*LF9wC9u@;qRPT$;8uv@|Gu zmqY0wmH#jPu_kE(cgT9gPimT8*nDM*s$Av1bqb3N)AUPaUD6}(J2H~K?4G~k+8ztM zP!SC;qUw+A<=3IW0@*tdFJrdudQV@MT>w0rooQpnuZO6K$+qTolIS4G$Jj8uhj(f) zkCeE-l+nk?{ZPFxDq$A?O=ha-SV~?&gcoK`ndfYI+`FDmGgeYw^=?Awo=!AbUa`JW za7?+m-I-3X&cQNoKnh3tCZqJg7u(~I)MOrSvGWzmN8|eFv zO@DO+bq*f8Y&wD;KprW;`Jy(etJ;5>nd<-QTNXHW8@v_;Ie-tn4>ZNtSuvF&@Wh7- z(y)-`{)~U}nz(oajA$A?h2y~*9&W)+?Y**3dy;8kju~x|l(~)4CT)kZ((KC=6;k^z zf4>iVOxj+{$Tp(;M%uivJBKn?1;{oDQN-xzL(p%q-`JQnKb+iz8OmeB-9{;T0^pnZ zP0wlFv@G!}8}qwO2N`BaXYzlECAdN|L@#|Ok=&eYKK7ICQ$-dAbqQ9h#j;&AlNNd6 z+&Aiu;T^oGyQMI=K@BlAU87I&oZUs?xf$$PTKa^d>?3~6*CP9w)bw#9!_RbLdO6jx z#~DUMafWfm;(cIzl;`Mdu8y+bc?%q5^trXvdpcB8`z>qIcB z+8JZ*Fk3$wM-IkEjQ&P|S?pvzRrHIX_Dgu5vFz*Gafvn6U$k+Jh+h7|RQK-5M)b%7 z4($$)%A<s{WGylu$c5ApU3^TU|o-R9_qTn3}Zp`)A)uC zX)r5GZHO+zW&xX1mW3|)j8nV#AXy_d*5OWKEqilL)ooL#@6&P7+Q1JvkxnG?aliD^ z1hWwq4U8olg^siJANf?X{R2nq%A84;B$1FD2e=l{_n>O4DS!->);B|mPYxVn-|~^& zC~rS6tE4wDG{6y?FkS zztSK;)+i9o=4VDsE4*>UI_=6Jx-w>sPW$7z^h5T8JxC&6%aW@~D52&p_8@pLS;;TW zqAPchcfAp9R{frmcr6}9yJj*=!NWQB>-!)#j(Z*I@ElJByM~oqv@3G@ky9Q%w@#Zy ze(W=nLQXyrA${AGu_c`|`%T=W*k^t7K+YDRj~_Hlg4>}SUaL2GtHQrDI%IG9F?d&F z2sRXl(H-q|`cy044Sp3$G57FhJGsHi?>)#bkBWhW5iiLXCgy z?pUf-vN>&5qDqDuZujvi7&4XY=W=?+^xGRxD0N4`1`aHImVS?+_BoJ;o`xk$m>?fu zg*nUVt=o*r(z>ZgEL)YRp~2x@Bo;7)ueS{Rl6ALejiY$Z3U|Z6>}#eGY8yr6A05Gi z2Byb;Jg=G<6qR+b1f2|<=SR1F$H@Mvxhem0j?sET{KqhR^MzH60+LrMjTuWrj&+$D z4Up!{$@Q_|5>%;<&Gi&dz`luT(&2{+QwwENx-D{t85Ddf8RX8!i;g%L1KGx-pP_8Q zNgbZeEb%a8tMOo^a?@gswq+bb3(*@eKx(QWGBYzd6%Q>#g14QX+G?_9lJ3usFl_}kVz0!>-h zO@C%q`;yhJp${v#Pz3XY?>3h>9gw6z4B<->jG9*edo8h(rs?N=C4l`7+!J2`Do$u+);ca{gxe~J zIM>GgkJ}*71Q-OwXa@Q!YJ(v~ptQCc~26T~;o=x(g&ClHL{R&-eoOsuZnrt) z{qi+01GGlssk5nN8NDJJr-;DYMR5jiK02p#qk-&s@3glwf)#N{C2H+!W=+Pnv!SLS z!k)o8@?KgB_t}VZvW}DSM#evs>%ZVget>@b$taGvVy~EG(?{nt^OdJ@yks4AzA?Zs zA`d>uU}8MykbUIIEr9iVw`*lda0^Gm3z5=;w_1Ch=|pa=@|ltgE+OacJyII7NJ7e& z&!C)7d@_cMhHM7O0u8M08RJY=;hO@@0oKMysW?x5wE41}@--z;dzK&r_)RYtFaZRy zP6XDP=07QOsVPU8%M={%X9SO*dx;C-VCW<$L@=zbex|@8s&Kbl9W#Bz1FEBsYMNniXnjhMOJI#uOuOAuebkJTT z(h3|_`l@CKc%A@d!-l*l7`LJ7Yo zuCA^YL^k}i5>e4Km6^9>BFMsVQCT+ob`+pQcP{Emw%b3lmjU&B7|rbCY!IOe5s}Y# zf%=)f9GlY=o517L8FKckL?ru@vyhz*@-r{so6%JQkxv}-7p?SK9)$DGn;`kWh4T1{ zh}pOm&NTb_`ZC@*-lzLpE+#qWEzgOa^NwTL-->HFs9UYf_l3!6uRgP%q`yh)pL!|u z7kN(SlA8t!{zDK4d1fC|uPkU9|A+7m-^avwzaohN{)c&HSptw(YFH5510L0C->e^Rqjjv3Maw$earqtM3ncYzGYcp8E`h@eE%RE`E2>o z{fl!#c+$y%vmot_rcf(`62lAfe<7=($FucC*`LzGJi?_12!LgNc$Z>^fUA?OW8vx( zuF?L_fFyW`AuMU7|TZBj#--{<4 zE$zQZg}4WTUiID-%Yhrp%@b9gC$c`83I_!5hno~e3>;}xo;p#|Dt7kv$RAbNS!a26 z-&rPqq(*qP%AuPAi)-oKEXj zAwSy*_Pwb{jFf;p#4n@ntf5dARmzo?j8m5-&s;Z5l#ewKCBX+$r@xb8%ii@W@&W2{ zI7xM>=M1U6HHfidLGLPagf+-|yxd3sxaR#gWHg9az837#7s-Chr|<^&he}dwhk4X(39y_UZNuOIotn zzCa7g8&@*+nxP2mH;7g5x%q zc2-(xYSo(B4!ruZ258H2W$^u^|3gE+ z2Yz#8f&}_7+Wmv8cpg&dzd~pUJIjUGJdM60cspwAf5^M6~8L> zVxr7oJBYNIxx_55qDh6MrC0IIF~`%jh9^eyoE&`RyugH<@l#_hN1fslx_$5`&=%j9oU&cDfA91&xYT>M%P97n2sUY}QZS(2AnK5o*$B3c0LGW64N zWUxy?a)$(QmcR~C)t|l=Vk@Pir!`>v5FgPoY3?`{w`>#Y(UP4<9Y09Q`(~&leR9dN z#ofJ=b<=|TVSA>W+{JT+J0%-MQ-;%tabL*YZvmtU>UBcyGQ67gnPxP;IFS_|(|W0n zM~w35vx5i8^lfFWq9~I_cZP()=Fs)vQ7x4YfihFJv`2i5wRV;xa;UsO`1EmY$1!hz zx&q{zy`^b%*p!hu4}Tpgg`rNpSPS_2eJYR&PD|*Mi#MgIukgU4R2@$g?2-~~;lFC* z3qTy+&$XoAHORTc%=B(P6o35o0{JHl2zUQk!i4uHZK-^NlRnJMi=!v1yH$3|gb? zs68WgZ;LMOkQGd%9&7wD^cdR``Tll0rmW6gBeVA>%f-pvwW$yG6~X5yrlr_jQ(zWN zmJ;2^A#bYTn8X(EW0T=Arap?|oe{rQe4VH8&vW#hu@5M*4@*HQ!5Jonj|<0*oy+MJ z$J&kL$n_Cy8?w>meP3=)G5lOGbJk;wAB1(n@RUT87n7TY@oUUs7qe`h8oc~PB))fV zi#jd4HQU`@FFF*TPc?d>6-uWvJp>%2tK;&tM)m$ld8VV8*U}ZCv5?TG$y@soeK8d; z1m!e^Ch{uPXv$QWZTIG0&%MjCV|T&jx$#g5qOqecR_lvHJKSh&8mlt;cDF?2UU8GI zb039xSQUMhfJCTmF=9fw5{DK^Uzzs%1?~N9JNFyKQW6v~kS`1EgeCN}jR8V?z6-zc zc5J#)N0V(2ODGbyo}FBul-k79A!><17S`6*0jdW%K?JumRr*Q%eBmck2%Fls^zVi8=DBK<@M z&m5AVe*dhDfm@`sW9VA!K`-!vx-Dlges%HK2ZMAD{hmeyX~%{-HyYg{WnESd5UWpA zS4#=EebfkZh3{pT8%&Ib7}^DvxWnDFU|oC*V_a)rT$V!G%iGY*#Z9#nhpgCZ1@MEe z)u-obA!NiadMfA1eDY`nn7%+s+@#N$KOkN;D`tE6K-~u5QTkLREWkf4lw*E*`fA!T zyXgs@nC{xFZfXu~eMwKaS*JmE_XGT)p*&~6+7cEm2(p0$vZoEzYWZF^c66Oi2 z`e;q;cC7$uYX1nu036<6uGyxr0dQx8__to zbnEFT;BOMA?2*QD0)_l>41`eSc#1+C?R8Ss;y|_ zyp5Nlo=GVH@4%qC+WTX#AE#`mAsHWz+L6$_0J! z3QI>tsa{!pR^6U`6&&4h4C1bBU$>>C@y@*z=jUwP5gDR zvt|oF&5D18F)50TUBCNzC`K~eMKKP&EiBMB*mk4v+!2&sqKiuQiRh`FzEt)aT;Y5! znk_$2w&z~+{(-9CmXDIz*r4cci*pT?rV9{zTBC4QGeuZk>3C}}Mt*ulD6R$^vh=#O zyQL`1!~1w`nR6})^BrkF_ef%ChsMk|M`+!tAkl6A&*)fv=>1ITfdEhzcKsB7(G%+3 zq()8TN0Sk1!=lr{Je^p)piiFVS9^;(LmOJLL3Yb`W=n5Ozqv+-v~RLQHD4H(4`^qn znNI2QmUC;>nX}C@P&^(Xjjbosc9tI2kvTCMGv)6YO>p6mj$uYSU2i{|-FBBu<;zrC z7e}~EWFB-qL~?DPB=g0Na+>io%VbwPh(iw^dXG*uB3m5|prK#BypvuKT=7P&3a3dN zvVyH2z}GEpC1z)Att3l4FuZX{!137uwwLKH5fke`TN>gQ^DH&GD8LskBURRBOwL;t z>CaI0Yy*zFjh<)O>18n6!1$;jB>x( z>7*#eDQV*@!|gbI4z}mK82{6#PA186Q{tzb_OSOtb#=4Q$TF1~qc2Xgh*kMxVQ*cM zXFJMg|2jovO)>d$$B^IHe%b4F>lM^&<16_HBFf4dZrCq!mtmYE5sO|=g~VnP)|l4J zSY=uv#<4dh3#A#Ip*Z%T9hXEtV? z5Ql>sV!Iav-WE9_SVW~)qNsaDxZ-*a4qg5kYKKp*1mJr;e&w*cV-nA-qY4N8*xy*w zREYb^i;D;tHR)DPs4Lq%c54)CJt<_4)Pm<_o{Y4_xtW8;~K3pOgNg*vo=@h7@T`|4zT7 z-|hciaA-*&s$A~SUcO%TCR`o(IKt&${u`dtN`GCCz@mDZLWD`>C1xOcLFe9fy21w> zngWNEjkfC^s;UQ95J9Ec587grj_7L zsK&1LAN4D_1fG-1bUUrX{MqDRTGLmnL{_MnNe2lb=WEtlN|+*q2KbKNWfOr!vfj+MGddFgwg0g2H=YxA zOV2BE%~z|+ejei5A>O|L&Kk?ltT`%n9M@H)e$xL@y;^vf@8|!A>I9A?u|n&vDiSzq zYNsFW{T;q^Dhtx~rlzaWx~fNxT)fgMys>(amivF4H1>~fik{DD|F#bj@p;}pPsTv~ z*EanmqIp-<9-Gn-5SLK?r++y=jk^Sf+9rxY7IQ_mBU;PKpK`Qe(c4t`YjW>*v7e5b zZT~a3vu#Kv(8>RLmdrAIO(E~E4Dyy8kl~J#;(zVd?u7dK`d&WZ`2VK)N_~aY5%tGK?9~WS zuUY(uX9<5Z_doiNwRf6leoR2jE?)dMkN`*|S?UZz#=!dD#Lvhlpl5tKS2EIB=VEHE zUWf?ujhg#^Q;!+K3XNchIsZE(K7&7~(TbGzq=aQ5PJqJYx|rK`q85?U?tCxgLr(i_ z1pBP)X=|P>W2>XeJ|H6|cu%5G;o^ZWdc`gnk( z%XcA)nQ6asXh~ImFY($@VUzsD$x`1D;)rIpz;ScbP*$%;q!=Iho zur?XgAz)Vj5BE@&8&_aHoOK`Gt&lE|@kWSRk@+WWF}so6a}VHby01H>fLxP$yYd?i zUwQLZ(;m><#cX5st}ub@!MW*M^s2LNum$mk)M}PD?>$ip8hk^N(H(c+`wTC*?nhXK zt~ajcScY-jRjPN|Tt5t2*8J36d=*~DelI;oL~u|Xo=Y{%*Bs(4lwnT#A&j4 z034h3cf3b?)|G9uR@&UjUN%!=gck_rv8|%2a;xOG2=S{DxBx_PAS2F z8JrUDG<9g`Qsgx=sguAdO-UN?>xde|NNK?Z1COV4?@?rn*t1pHRjI<4O>JA$3`hQ9 zLSehHt`${}DTyp&1CIci*_Dw%55$)wz+}j<-ST%CJI9&8fh6~>nymWcrSg&|blXX(^z=Sj3B)eNu zsc!;aCE;AU{>i8HLV^Nd!Tc^noOq)j?5j=4_DzX`sm3R%APAS&8OrQ-x0Bj{j{35S z+m4`%ruXf*{q#a-Jl9XyhI|?`n+M%^X`e(FHr-fe>snWtZpzLG$2t1wSv)NELYYO@ z`PVvhA;m8{ty(c-1^L}?w5Zf8G%yo6DcUx$);x`>#cA!8Hi00AbG07Ro1X0gpQZXp zclh}Dh8iyL8x@;EH}Bzxqw&DirR;LAPsqmqPpYLmPXaA_%f;zxu1(mze+o9r0~e@l z8WtKV;!e^#59BVgLXW0cI~gaegTa@{hC1f{I8tUSJ*eTluYAGdxg%u#VFKaz6yM{l zp!JfCayBR5np4IY-D8;K`CAnUjp;9rIgR&o9&yv8bZ|^y(-%*V>VbASUe=TkBfGUB zzOB8XR_q8&MCa&ktWaBkPboYLBo8eYD4JM#ZS8ex(1!L)a<##8xAOElW{}r)d2;jD zw~O9LQ8GRi(|+6e1GG`;b&3{oL5VK}_*j9(Q_YQoe~!iVii7ugg`(NedQppm5SyV_ zNg?ZI8RBDam;7go0Pu5X-Luc|Cxdl3xa&jr318pB5GYpf4m8jO6@T8c(#tK7#*iDk z(B;Q6ZJ%*5Ba(zjQa@AGA8RiP{J9KR$yQkznZ$5OT)dw&?W)!uf^oN41-}nn;|L8L z6VWqv5SE7_e%{6+KgG(VL7_uHxs_qYk-G76(ov|OD+mFs^5QBO-OFuye{!Oc8v~2) zSlt7*6^TOMiRMw+lkgUiO>{DASM|krn>ClzM=G)RN+^L|TIvfW?}~=eA9R;UkX4|@ z4&E_8?dlRos*h#9ACx=C>I%(Ey4}cmHnB0F61daJb3T49y($5MNeongKimaEWcEB- z8F|=rGB*JmA1!;~pR9XD++isnOt@Tl)g?hsx=qdD*5tJP+?U8(=;@YtNMP-Nv$0HN zs^xC+oSXM@wNW}eSJ31c-+6Ds9;A94sA!AlYfBMKMBX{~o28l_fPj^$a2W-UQ<$by zdDz@t-ItbX^P9%82GTR}S=JDq@wa=6(t0_qc)(qRI_joa!#NW&iQo zs|f*VpJ`N`yQTDstZ3Iz1**cY_;G33$5SJ#UP}U$n2$f?U9BA&kz(^cLwhJB1<@os z2vPRdQRKHYf@P@j*@y&&WmVfoP=kW^iAGJWJFjEiohU~cNzlFA%tyFMPsowa7VV=h zV8tY?yp$pa>u=R~pgXP5L}RqgyFHnJxFO2A8Z<0C#e)y3UxjifXdt$9FRB6^`yN&6A#o@JKKW}h39^obZ1myu|W%?Lf@>L_9T;~M8t2fN0kK`uuU`h zFdb!r@f;NyrqT@cxnna8|61MKs+jcyQas`c9~`j>x<)4n{=j_n1T^p#l$STu3(rX( z9zQC6`S~a+9_GOumZT*n?`u&pGyP#vTg)p=Mr%GOnWkN!TSDBG#4Cfcm51lg$Iz#EL9 z_9!IQ-bY9#Ll1BwEpEN$U4!pFAyABrQLG4j#;&s}*R7`;E`G%G~K!+nVY?(Xy(C75@8@KK-WX310mJrtrkMDg9po64!r|D{A|#;;Y(F#z)pae$}t8 zZR@NqJ`kDBME^6%1dS!V)Ps_FR&;cHXYjlo#Jqhi5j<#$`WL?^5np>>pD z%|{|5Dy;N%sV=O$@(RFw=I=Yh+mi2AoMco6GsQzc7h4cPmVidb?=OQ{$_ZdG4uj10 z4EfU4&~AR?)$rU8YC|Bxq=VIWH0W0gO0K@)M~^@{bSo|6ldC9JSb@m+4LC(VB>Ue| zQC<%}%5oLK!{+^s?uux1n*=zo%+*ew^J7VADfC!Wht&Y^0{^(9cGfZa%X)c8Oh>!K zI>m2QKf3~z45Vs?+<9MIYL#Pbs9D2dx@zoj56+zO7G=M5z%ce@KsMR&+(RbHNbK<` zX}5jmw?kt_*tA6m54|??*%(Ex@C@&q31o3UKqQqFDfX!P_Jr= zJDVp5I_iE!bS;85;Tl#EyCtP0WC*SI7-~r zcIH~vnG6IJIL&+Q9VV7k;@Ghf6pQ(oxZmwNU!+TioIemLXj2|iV~sM)loi@*P>9d( zFG<nbRqM82HO@~Az5uDzQXKS%NZpr9xTYFp14#g@TZ3lj|6BM>*-oU%6F8(9N> zL$)M=p!q00d7AdBph^~1eCMsYtgvFc#_wLi)6;V%srpSfU)4lOjJ>U!(1x}rliw*q zEE$9eJl7Qw5SmGhXZ@j^k}3+WXlrx66C9B-k6KzRyj{+mJbH`y!Lk$Ijg!XRr({Cx zG3aJrTk%_^TuRqU7jbrdMldn9=iapdxMwN-AW9zf=-lD+g}$#IS7Z~YA9EPjI~6-H zN`nh&6{xxSDKj#0L&EFa+=@Z^=WQunE0{K(WBJ+PGHKl{wrwxui^T48sMC1pzrlj) zBo_RgscmDk43eZqu5P(SAS6aV=Z7RrZ}A+w%K4OO9!>=nah zeK3|nzo24`Y1thk9W-Mg(sP#yj(5M`bGQXwv1>G|Nu`9?)$HYT=OU*)u?ABm=p#xj z^r^L=Ri@X+eN|?E>b^vIo28r&cU{uNd8)t_p25y`nya-YDN9910oI&sxG5|5UPt$v z>R`0v2b^rPQ_oWG<0sBCIwe4`v$Lh6=X$dM7~hix4*TwU(?K8{Bl~<8v-^hwGvtZ$ zXR`emOg57XL9QizOk7HbA`Zs0GB0bxwKg*@n-VdqDYgjnDKP0v@slFQd z$^0gD0h-vN)3ZEcs#3aswUl&y^aO)F{*|T^F;(_#@IpB5n+HzYO&w_JB*Qn>tGXIL z=q;3~;eKWDD-|j-yWES;^84+&S^ZMP6SMeKs##3q=hRK{5i1p0%bQDkK6{b_DbzSd z6$^KyYYaNW#Wcr3bN*z5>0a@GzXm{a(M!&lW zjZ3+lBVEQ8Imo~q1|fi3zY!Xmadrm{W$W269Iy@Hi94-gtwUl>*`~n&)Kz(8T`jvuf zV#5!9B#A4fl|#(4Q`3{AEv6@Yqg9x8*Z@g#G+{5mi{&9eJP9tA#)uGv-kmyU*IQlp zak;2XWYJ?IfO#&FpY4WdE7Vo)CSnuZgXk#c)lsN8a$c?8d0Kiq=XLN0M8~;ow<~B{ zxL;b7(ak1RSa5ZqxQziBwSQnS=D~bT&G_D;w6h(?Ao^UQNw+32pXcWpuB^O<8 z8HGi1`e-dkDs>^@#GJMyGu>SLd8@ovqB*V9LL z8VFnt)gC(=hUv|sm#-LeE|C5=&X}^_K|?>=ytk5H7fPY+nokh`jGIknEIUlhai|J!YIRq_!mMr>j&w-dO)VZ>avV6zQr#dX2F4E`hMEcTN$U+}` z?E>B2K?u{AsL-%Nsilu1y@S~I597JxW%qud1_c;daPQ9tWw!aZ(Q+OE-&lE%LH=gF zns}x{Z(foV<&Qlyfn!9+TeFrcnzS~V#Os6~?%YMk5}S4GD|BOew-_q|x}07NtM(*^ zrC74)Sft%zGi@xMNpAmvh2>gz=l|imkpeVtaF+F`W1ebc8y*Mf`0ic(+HQ17Y5B%{ zvo?!)c6B4Nx3N6Ch}@Rxtzk>66BMCt;8;U6J-qie}42CTJ=5HGJS=4X6|a?HOU ziu5{kEsIzeO11At=w)LqCK?yZU4?R3B*NIU$7|;pbHX+NM#_iG6S;qW<|f-d2a>HP z5KHJfkFfpBKJUg#@7-054Tk`%miAU}4Mqk3aWp>|p@Z2$D<}bTE`nxKMwCW zTX*Y^Su-T$EWwWogt?9i0b`uzGGfET)O4cmQ1sk5wDFr0{s#BF^tL#{X9cs#@$!{> zsjnG3Ie*K9++`wMI8Qq_xtCnya{GL4J7wN`$Yw0va_s-L_1%F~{r~@$LP*{XltM!G zDkFQ8BzwyqiA%EgI5LZjGPAC|w`*^OvfXQSt&nWj9{1vY&!x}ruiy2Ld+s^sb@q8a zAJ50*@ua>Nxt3mN)ViW<&q19Erl1RoXiyl~!hEQR3foPQF>9(k2a=XQy#Mm2=Y5}N zC!(k4B>?ixfPeVr;a*Q_^w`)K^}uxr{H$+zn~sNN8_mwaw~b(*p#(8Ts`GWwF$pU< z5fri?1y7M*kjWS>EiQezJoNv*vo3OY{KN2AF^XWd?E)<`?r)2}6qR|VKk_-Kf*Cb|g(DtQ+p1S~S0JWhj1<=O zRCziNs33O^fc0ORWaY4vKdj`5pA77qtB-aPTE%N0X{CZ2$Hnn<93}ykt{@2J0tt?? z+n=L+vQOGxzrcEe;7}~A^mDF0?OMqPgfAZb0zv5JJ1GBnZ%{NF{4(tTo=0`g?2ln$ zbfLFov)k7h^%oMPB7peYz0aLX2$!1))4T)}t}pMI1lGZwl!xGXo5TAtSI=5nl~a)E zb+@c^w>zC;)kHX7qYEA6k}D%uJl8E4CV$inI7T!|hDbn9m*(yCg=+}Xa+*!KmY}Ql zI+n=X<{Iu+P~piiT;1aL#VIK};u2*2a?h{B_Ylk{kbySWd`h$cqG+qF8+P_<41oKT zVHR3O>a4ZR1pdsBLxzXx3ohcrl@jd|`6-%&n%_u#}xlSh-db z+MszWYE!ZIXuWEXr}sgomzKUSpxSgcAI>`vQs$Fm#;ID5DU@~8?o75NuPCOAT6o#3 zy@Eu;Pb{Whw)TRey^UAUqpeUW@dnneJ5tc*MU)%TYT+pez;zo1$zd>xHtT zb`s)))oBY+(n)9q%=OM90StYDdMO2aR3U@W-QBqG$A|X_AnSOW768Ku78+Cx^gt4` z@98{EYaLu>Af8yM>4p$mp28!DhVIj@S#iHHv#&u!$F{n1(>)}ql|%jt%_iEc=k6#}XnoVBM=m9wQa_7aE@SflsV z>LTm5T!$~J)d2{M2>ocmDtoo^=xI*^+@P}FCGnEko6IH-5@xvKbfx) zZ~s!=(znIz2A!#jjpMqZ(^B`*3S=qzB}}m7`e&-ZxT3z?f+{*CrR0|g zR3ZHT!XJ!%={!*_B#6sp9ligGlcu-4fOv!!#!)iPY*oS34S@8ol7Wd z=^_*W>lIA1)fn5x7<%6*J)8(}1;SuaaKqyIk_O2H2HQK`b9_#7Vp0_nTGiu)OZ;B>>!4-MLNnPq6fsyU6y7yF`jyxx)v)9OlK*X*?r3JA(!b+HC zHKBCG!xu3z22`AO83IfQ!|XGmocAy68c%@917}yZft2_TGna}srUZGYaUuM5Ob`rJ zR&X_E^y};4uwJ7%mCWIvzmUJ^D>%40qCRY_n4cQNXpg>mSdkn{T*SdG(*G6yM)@sK zYM0h-{w(ya4ocIf7&=`~m$S%bxT)+r{M^QFA4H@I4&J z7;EZoA`QMn)BoyeT9JHk$-+zLLbK7+`pU2u3q@Fgs%S6zp;M85uuk=9ijS(-=^2_K zJV10)^nE)rvw`QDgUI_If$GS16f&GXvB8bQgylQb|Lp?-Roa%GAwuh9BItTHcAzjVBYNy#J?x;Z2fX0Xu}P%v3OzqL!N z%rF(Dwb*MXxAMtVxRjp72W9v$L5g%mv=pxRqnZ?~Rf&J!(Q$cZ!omll?7&>7fVEl$ zwW5&4*fX2x<6)l!}#a z4R@&#e(F{9>?4iQu6tVuFEFY{X(Vbp3PlVCOpfZBNL1c+yR(wgqrA9G^Pfa*E@y() zDrM{$M+TybyhduQ+ihmzJs|*Dm%rQ2JN1BB)lA#0q`#P?AH-hk?y(8{=qwkuuvLcI z7s7$6Hqu94^<9zUeCSIxMNxO4=#|NSgX!#q})YOXBT~XL_ai`#L(f&j`cKEfh{pgmpD?#cLJNmI z0ksW^>@&}MjAsG* z?+A=an_PTHYtkAdbxElE5GPO8c@7G6CpCU8!AqfZA4eVvnY%0XxML6n&Ky#~31sQ- zX6t<>1(W;VqRbh!vSqCY3|XgB+LES98l0&hZP{1H>Gpe5qp9t#e<8kuB@qW-a=o*w zTY~+$*9-!?iVuN^gC3BcM*9OUEfW|rALHao@yd8+prw))5Sw1Sv!j(q<1otY^Kv)coB5=uFR!9XyFnnG(*#7qG%J;l z8gy4QCHJLDZB*9YXsov){q!~8?%t-UV51OCLpHESwE)H|nw~{UAisC;k&>8l+BfK7 zco@w|oo^nY&tCnC)$j%~31g^VA~*2s^{Qm>*P4&EWzBATH^h{s!2O+@a4+vUwX^p& zfDU9GA*}|M8)?*4b{<@Tl*fH$7%~F&0#VqKSxiX`-XcRhNAJFXUcSY+%`Y)@Q`LIg z;FAU5(>#T}$J6aF-KNZ)G*}BUyM2tPXp04|fL;o?F5wpbo`vL@z1&Bew|HfTeaTF=*?i^cJzonM=NyCX z9d@rGg=ai0UPZFPe4Io+j(sF@CoA>IAD-FY*6ovIJ|QLUDn|7vEos{6 z8`ZDYA+l9%a4UQpdoz(nTWXJc+;81c-9M;km_*L> zo5z@ZiN+K<6Q#z@$wqhkUy?Mw?TnB%uKH6@bl^AWJ>#79cMj$_4Mt3l|5Gx4)i$*i zaQSTqHD#H&RXb=y)Asfb+xJrOMIcslrmFm3?ft;KZZn^i0FH;y@UeFJ>FrITS(A&h z_TM0CP@q)KZrwh>Rf7upmDSKLaSdG2`tYqLpCMk}OeRdK|1?MYyi7B=s0%1!SCroi zl=>fk;S)9E&pZFL7yKZnM5qUWXdbk2}>iC+3aBMgO4&+FczOep`%(~H{w z`~NL6XS{{Y`~7dtBET^3VLvbs5PmzQm%xmH1uE?g zUeOn14(UAW>0xQe2JaeHWyJq%S>ARL7Z>Q&+4Js?J-C3sXFB_lCATa}fp+LF&d+{3 zn0H2ZYI~5f9wv&(Uz}fQ^-y!1=UoSQz?mWGcbm3+>nCJ<4tAw@q}bhk(Czb5!20HV zs1!<9eC;bG=t6^^3w~zpnRi4G_xCZY&vTcvJbHKOW6$LY$}n4E7<#t8_Q{c1V;F$t zl&1(9kw52i3|;$~@^|*%hPI~yP6hyuclEBS0K326u7MN}fMdWd z;m!#V=@O4{BOFKOjn3UtXih(YL}U97;nscWiiTPfpKS~SHA5=~Ry97g6DQFbdbaBx zo;uJtd%8J~mwMpyBEnn?kO^SRK7 zg{o(E-&}=AZ7$h>LLEqqc@Kn#5%vmL}L-tuHQJy0mc z`{-Ljm^W}@x^X&-Yo9S6j&}G=#(#s1B}izI+~i2M;A42xQ77-reSc%${n0G+jo22@ zh9|2cIhvfe$-$^u;YSRy%UIGPNE)zxI$bkY5#`H82p(jm;C@NPjit;6GXV2f7|qjQ z4!RF@j<+7v1{NIKmx*l>y^t4gm|;P-dQFY#ar5@SzMDkGrk)>X8n7jD=f)Jv-d)nH z!Ya-Boi0dVW&!))3y%+k-y1|MGXmm~s-*MO5km=pD!hm4fZ2EZyR} zQxLC-`pd!7ay0+h^E)#kZZ4D|jmi*Na9mh$un;BH0*;(W4PNW&e$vk3N55yxX9J6J zARG+o^0@D34@7o8On0K2FnM88e&fQzQ@aQgv0RTaUOIKIM>l}`*+w^Sa3x>i!qY$G zXS+$$Wz8~=Q?4n8%M0w!P!%FmAcYAZ*!)+6WrYgBfvTPhrGr&;?5RJsL9~hF>GJb& zg>bKFptb6NR=E+^^EI?=7st;0`fO@DG_FM&^erMm(^^Y1sM8y`WOr6VINCJ=NX_q z=dsju6Pnm(Qj~6L-X2q#@mhOIzM~bnjq)s0)AiHV#h@z@^1Pz1`crxXUMs`$xda>r zi!zp}jZ*sq_ce)(@{U|jz)YC?oBEw>=uorGWB!r`ASGV7-$E&GvwQ6lMA|zfa+&

    M?<^@aBg-7Q-f!HzMWb0+Y9sC zQoF_Gp5r|Y&e*ZBFi?Kk7=~r=Nq@8s6Wc5gMo}q9GM7~QU?*pduQgF?F!yC|#uaYH zIe`2fnopM{DQZ^cnNJV+DVDVfi+qE}0Ocil<)V34QL56*<0EpP5i~@fmTwf21?M<8 zcSHoWIS+{B=`197vB$FJxKGLQl5!;&d#yBJEj)D@WnOyPoBvJ6q`9CBH<-KBX>?-5 zIj8Fj{HC+K*H8hg3a($tkTxd#%5JCH+UOfkv^PPn>tD5dqA;>A9F#e&n=DF)fSDg5 zWGD>}O!%t$u49~DRe<4V_ zp7o|i;kIjlzJMT~3eYszBBTj0j&xh-YdtqM%_(eNRzNj*4nu4xEaxFSXOO zbt;-zf)uP{i4mSUsf+OW3NF_feJ{GhW)A0R;nLz;p(yyIraqzD>RU>TX%ZoXPlQQ+&%l-J4EgcRo+a2#U~-I1^fnR*R4`k3644BC8xZCJCjfk`A;`E@c9-)Pz2*9Z?->h0wi`qJ<%J zz8RIMeMa_6#loiSj%b~1d6{Rjn(!)ZLqwmxrnMbB@?(_WUe+R@ERRi$&K=dO+u`qA z+0rUQXm!~(K8&vg<~4uGahv+gsiip~M;eS5V{IrGnrq}sK{7E@Ax7sOwPC8{XhAKt@hKTpG&YNZG zQw9DH+dCK08$y~gUEK@yLgQ|74I0J)CLD=50hSo245z}RhOy@DMYd6!ynLTgw-kHT z>7|Z{eS55O7Ulz?)rs-qtj^&=Gy}x+(YbyVjDifD$mo-<3r4!VrvE5ARcwg%sQ7%R zmMKMdJmWTh`Ho}adpXiY_cIDHCK4RAq;+N|Ossdy+*6US$cA&9D7Qx-Gt9#; z#WO@;p1nRb$tiq6BjeFK&!iUXx1*rzsh(ETl>(5(m~Y_N@pkC`TNzFLOg83c?dCd2 zbb-T@2vY-Bd&BGRygN7$CEN?mV?Cs#68iW4P$2;Aa3%9I7v)sbxLn&YY~x_K)_+AP zeonH~iWH$n3h}72%45SNwOQ0#CYkY~-R%f6&}9;9w(-g+UUJqAkIIZ@DH+KgnZCPV{fMrxd|sBuBKbR;T7ltS#k5W8Z~k|y21{96 zjoJWB`Ll@EHfKYz4~u&9EcG=nPnR{x^;ZYk`+^jr_jYOokcU?J1RMNBt(S(*3H5D*2DVT(ya1f(oVO8us8bY=!{h#@7r=qhHeLx7Dzg zUWwNk?DN7%P^c147n7_BM2aSV-!r^LScK5dqf&_yj%e&D8D#D=&;z-4HF_Xb3Xg%_PWgw^MDqF_);KFCH@BFsjPmSP;Q?PSU$%X$ zygH^ZFzu{aFw;8o-JAJYu26LtYlPT4tJS(ZMpSYxp}}~ET9VbGFslbAooHHvLfB%$ z=DWq|d}@MG%K?+p4-W~wzD^YW1*7xik2H+jWnflCPO%I#KCYgR4&@$y*Zd10lBcg| zoZ#@_*Ptm)(0D6mbytD>j$Q5iJsNqNBB;0WXB$$%oHVlc4bKBIFRP~}m@+nwx`YW* z%``tiIqEqSgc%&Fa=uph5S1h!yu|%*@pg+XkGkV8!KwP(TDJe zf*u32757rRcf{1`apTrCUusAUfky-orI6PHqobo|h~KLAV%E}S*haBl?k8nfv^(|g zpFH}*a&yk>MCCj*4A9>PoATGu;*ZHAQsr@MAi#MJl zoOZ4$uWTDmaqNo9A1fd^P$r*Vnn41h!X}pKzJ}osW*zi_?WR#tM`SFm#zskW4Fy;{M-R+o?PCX*IS7-59T1IeyRUN0&vC6Rvjf_~ZPm z){zp2t9YJ%`Sk70pb^mJj=UM7Ae%2~chp^0b_;gA*WG1Y+tk!}v;yuZ_y-{_zHYf%6IQs2(J`*>>p9c!kncj7J?y2{7+QSaF=I26r1sjZ! zn>X}TeI99U;^#BU0QEDV?=D9+sqZveys~cl@92CL4ClC=)i@?(2rzN4AXP>3JutlV zTHx)e`05_GkSVgFkNxft9iwCF-k-Rg-ERyVoWVm3Gu35JtPeFD_f)wkb0?FbFYxEg z)M;KPrPD1nV308)Us6i@-Z_!H&F7Vo(FX6H$_xBPly59UH$6-6|3a2;gJKFu%ZUGG zHoM0;|9(OXgYZB2dcjXGtw3n{NqZ|QDqcy)&pyQdG{*{h2{l`5&)|m-)gkH5Jta?G z5uN)z?3ylDF7hJhstx~sGdAY~&?1-WTm|5wVtB#5=c6I6Lgz53 z<<8=_9x#0u`%g*Hc5h233nbxYM7g?!kuB**Ke&d!&DPmDnpIp{Fvh^GWI$t-Nx z1KxMW++d{Dqt)|%1mc`^;AtmRzJr?aJoPCr>X@hSaI<4&QQ5cx<~Y4ZW9 z(l9uUCC)y%rs1Z#QT{cQix>W)wbr{W|J2WzF0fb}pd=Q|Gp~dSiYmozzbQcR=bhAL4_Z(Aa}l;lG~6 zG~BF!h?IgD_@bJK;{EA?jxRf`1e&sqqlnJ!ej@@<*<+DH2Vv$@_gON2Aq$2}9jR9mzjtYj zuRShfm$NOBpfY56fw9bb389ncS`sy@=D{g{dr?+WG+whWMb7LKrgil8WwO(ULpJ;R zlY%BHW1C4ao-?5hQ5xV=?S}JoP|fj6v`iHlM2z&8e|+VVDcKqPUm12DtXu+WxI~M{ zJH8JtaibcXFGW~;o`A&iUk-iW*UG??zP{bA^%@7(OO4&}B8m-sO}6A)Sa)2)LZsNc zX-{9`j`rmwfem|*DkhX|!KY`(mehpA>L8u=GLL?o-p22kAU?h>Vu6a(SvX&W@ zj(0y;vLh-VH}L#LGK>STfu$bd5EE?>abLujYlT|iX@!U!@qF<&c~sZn z?B{GL7%8;)+ogMF2$&Pq`nuH77d$TH*IjTl2-f0Uw~Kt@S_HU^Xx0h}eS9N!6UXed z?+#TMiaDeqPZlwEApRR+uT_4g8JLqve&Oj!jC-hXU;>>0Fx(rfpteC+UHlP^wQW`* z5nBNXWU{HNz!plDRg#UcDhabYb3zsk2bs;VDRZbUGSwz_L6L$`qY*PPd1$)!Lp)sF ziv@tx>O@#}sVH(1;U|`S0EML;aaPEjcL*UxXd{5kPi_UhAy;b78=|Ua9+fxSDGV& zktWZS)xvrhN7EvZ{)JpFCUNl-Pi8ojb@boV@8zLJI4F$!RJ9vM=$-7e9TyST1?!Xn zhsgrYnAn=d`^9v9P<^A&`bTPpHldj8ZQW``+b3CnC!jr@Woz@*+iADU@{5ou#3S8^ z1NObQd4o;g2IGRU$+@oNV6~xw*hTS4WKETj^6S1z&l|aHV^BA$ z?+h1sOwUt7>+ZF}nXlUt<+z5Ai1ok#Zv!V*W(s54;x{X{kLg}y`ada1PP(0&OULqzb4s)weY6n8;9Hgy8Lqi^!;~w1 z?IuaZl>gs$$H$-jGaf};g72|mi_wk;s*Z}%qq`a6N*Gxv=mfLW zG{pU-h$eTMz?5}vW41O3VuR(i-4Mv{L-{I=-WQ>`5v^$#NzD5TrVaH(<$g=L2XvA4 zhVxClB7ZG2<@ObMsN+i zWUUR9nwRru_Qh8_UDHbQwkpUV<@C1Fwcj6r-prLT_qmluRGx7!2+%%7PcRcG2Ex9L zrn8mwG4q&Z`loLd^;mr-A|<^v!>C}%xUnR#Y0d1TTJ)=gEbAqoX8oE4knG49`K=)N zZ}nsvk3*et5c2X;nVpCdSnVeYU3yaF=I!)KsKAQXaOW=(e-pHy-dwcEIz|WLPxk_V zavl-bDZ(cv8p_+;RYVgX6As{}%1Gbgf*@~2^$xD7+ z?)K`>`bLs@do9OR)n7W$fqB1;cisyfd-0h@r0F%Pdxh({haUaXQT;O2>m>K>qKWN>~W~!)NP8Z zZh0Ej=?~;&Lx?{uhsb5WGe@P@r4l##eGJ^rZY=sf4ZD>#UmoLrI_|Q?tTMIqv3GQl ze`T+chDyO&!Opgb8Zghv-_Q!qa2nap&(KanI%saBm+ChExh&n-gAlZy-}c8~ zJyq`Ezrr}JS$q^G%6~s5h51czR*8}H;eu_R_a^-6A zVDtN0kZ*+b0_dDiUgo8B=Pp{Bq>#y5+TUH7;xV8uZmvoy)zmLsmESMk;^JyNDgISs zq5&Fw{g6KXHCYXZ@0EeP#HO23l9=VZTjbwA%hQV_J%5|IJ(P|C8HDNUC;LXJxa8TB zzn^`xzkQC`c{2TX0nZ?mCk!BFB9*iELMDfS*7d%?Q^SRh9mn7-`1(w)a@anuqIVuon_N>{Vww8xH0D~rQ$qf<;{)n5;!c?_=v*(=pt4x7qf(}M z1{i~-*H1xOlR|}dr$1pQ3YHRV6gHI5SHFJMONzp5lk0tcWi;(HgEY=Z#V~9=>@IY` zq8ZLk!kD)z3iE!xVLf}$GIkH>xk^>phamasHoTqkLXZO+dwHf zKIs>Iw`Xvy-r{P!GIX5S?a|ybyS+*eq-uI=Pyb!*+ThhiyDovT?oE&p)}27iix%Gh zb9FD=qz_y>{z5nwy4^BH=q;PYrPi8)E0cPMNOb%qffQrhXO6h&UqSaMR>XVJ_&m7)z-|_yH@z-K z$f3ypJNN3JM7T{T9X}P4`q<^$h{g4D_d8J5OYEXd$ac|{Bi(tP!{b7MY|0ZWlpZMc zFJ%&`BrpO$9h6|H2@E>pa^m8ssPE&`6zQcO#4dbTW3a6I?fh2&(iixCy?*}`EMcZK zcjll^&A01$eQWUx`gh8`R4tLxkEdA9#1J&^td`wEV|&YP;dZ^fiD8Z5fa^#`;GkJ& zXRGH+M~r49d)a4**UvaW*YMHNrUiZtZ8J@)>*put^}qd)T-tsu*4iRA)qHYi`IjX&nU0?&r!?Ri@EqTJ(Wf&DvCyvD~V zFp4>C69bifsf9d}aVh3Kn+9C#X}@q7P(?f^zDOEn?A{88&o)@7LZfJh&Dp+QY1+|^ z>lp*kA|AifQiPM=*5vgxar`NL1-^BhQ#Sjm zX;m4b(Xbkc)VeF|^ziiTnFoGN%(Yw~ITn?GX z10I&$+9cM0=G$cbGoT=7Ai4C&WGtBdy;i_1c$qcgPwuB3fOeX-WX}7kAwuaT-{RegSgoSxCc$jar7B=_H)B&ok;(VM4r72EsZ);;l8ql z(q%cQBvTBpW7b0D3OSvT!!*cXDxtm4PsXK=fZDaoI>D{2hVRag>ch^pNNO)uW>W3h zlcA!paFhM;;LGaDM2i3QD-+>Xp;Fazi9~%*BFfmIq*l}|LLpTq9Dql9HRG^8h&xEm8N!ylAL0P! zg#3bbj!Qxw;yVgKM8FnrJC_>rBbOuKK{uZB9xb%82TLiF;KrpqW*Tghc%nb^=?KgD z9Wj!`RoaoWws@0smL$s7JNQW)PeznvW%8_xd0fsWG%WpHZ_;Gk+k| zFkr23D3sfvs;`pM=>}_1A@^qXu<<&fEAxF`!KPGc{o;7S9uvLfND*ucuF#+3^`(Yr zBwAa~+f#Swa*d2;AHr0J)GFbfkTtxumf6q~PH|co-ZZA*YE# zm~Wbx?hW<0o$91GRb=lD|J48+bD(?L>+|oVlGJQ}3eSD;5_z^3$(wY)aqRR=y){-M z>fCfRkyyFi7C2~*m81dLVN<6+W;DseoAj((qYvXWyz2pV#A|EIrpt!pc9q<5zuAC9 z>}kM^iQ%q%Ys+R@=oG)N^Ebj=6Iz?6f^xXRrF*)4H*?lD0@-ooXUN%Do`jigu|YOu zUZq!e`c)RLqT(b}c2Ac!Pr{$4BSptXLLAL4w(4Pa=hO^K2 zS>CUmyiXUP*m3l1X8`#lv%4hTzlM&RCa(}8M8KqrUVc|(1DSqT1~_aE@Y zTh88)4zI4R=3cyLQU%mJL=pQzi~bpN7{KD<;>;Q8hVd~)+d=k-zl~V-IZ??}a!-&b z>caM-kLW94{?7e5! z*AM!B@%HDV1bV>7Cw{lU|BaG0MeeuN+WmkT|I0FM ziI~2T5jWUW>VLsPI@oqA{emndqRu0Wpt;aL3<-W~{;f!GYYu-L!8L+SjV?x#2R%~3 zDW;`tKPcJ4qw&9j@(5ODYDWBI>80;-=eR8-_1ndeiDEH^j~`yP0xf7_LLS=#zQ8Mu zWlG@a+YG+{&iMgK=L8GA3~{tWmQZOD6XuT>v5rv%9IkZ_>?VeNS)kd$iYLE-q1jLA zBQAQ6-|vl_zKxg|e4_!Yx!}~^7GErUtGP^jOQPU{z}4`&?h3T^?!$j-4iYcWe1s4@ z*7&Qo@BRBe_Hh`<<+=c4kJW6Xu}=ffgEjxsm8zTnA||KnH_pyoT0nx?T;pq1s5JJU zr%Ndaa#OG!!0?0f(SXPPx75X#Ara7GSYx{Ybfx)UJoksh1vFZLU-@_*a{!P;a&S`u zE&`CmOZecAcIcnAkMuZbC*=LM^Bm=MmJv$NVe&fN4m&?}{-w8jQcg84aX{htQ6bCG z|3AN#W!mF3UOQ=);Q0^q___Ydtb{=C2Ol_Ixa&BZ0A1kcV2+2usB;Hs$X{Xud>jdYK0On)_9pg!LP-B-9AjLj8ygaUE`c z{wGI8pbr#Jz*t9jekdP`s9&>q)G zEh@|_bV$y%qaGKgs4C<^!NY|P1r?%xRM$V;*Ekga6kZFI8Yc&7CmaYJ4q%RFt8I1p zd;Ka(8G74yXL;e7~gg?h*BcjHT~ktG6WgAEMH{LM0``1oYEu-(6BSTwH`M;|<+ zkq{B4!rAe?D-O$07QX$bRCvW#oAP_zwFePmIUM%&O-nnEOWz`Fk?8uhRRmSpw(G+D z%d&pg|6Bpb?D6b$ixAiqju1WS&EwEW|wKN{3 zcJ}Nw(%fIaCFuFFb!q#gXn<0Dt8E@^g~pcKeyUe&k_Lc(xc%+%&Z;|uz^L!Sj@qF_ zt{~0xNGJ>-&8S-LZji3b6G-2X+l%~#CwoGHqTkm*v+T;PE?4k8S4sO0g5CKHic3r5 zQ|mAp3TjfhQJAuC*Tg>gU4{G&!B*f+y?q>iHG8{PuuZHx&+S!lu(_f@8kJ=ph~`uac$oyaQ|GRPzW<`G2i7PZ2_P5uA0QTYCVe42$m;47yuS#CAz zPly7K^e<2)mVOCrEZFv-+}d~8!KzM!wJ3JG@EU}VXX<8P8(^7V4kC5RsL!1puprJfP05y!QXT57aMw^$GEFIe80bO8IE zqPB;l{NU?~1b^R8^HGHp(uSt?u7M`c^Ete}&=zE=g45yY!ZSuSHR{KBw zT2`U`&%ZrEw`sfoB!dMqF%aoA8Jr#lmOva^|6oE(z>=lpy{Ic`#_FFOqW#!0fftGU zBP}hqZEEL=F8Oh`cSc!9h$pE+P_cQ_ESVQbd$Q2>H`svtq|ZBQf)?dhtdE;lBz4V}aY{ zsVL8Uq-$OQ?gk+@pGu(UYwrI%7VgeISxt29BPS8Ry<8`{m9pI&xk&v)+lX>9T!Dsh zILb~+oD(@FzFh0KR@)PW`44C<_G-8M9?s6fY{MUOhOH~rm5R@7(e(Yg8SZOnBVUG1 z4Vj=sfSb+dQ!y@Z;#6Tj+Y)?TcKFFU*GPS#MU?$KrgT6(wMZZ;CZy<^Zt4cU@3pJ` zOV@$bKB{gKsiXFtB#>F@mr5+NTw6^>>y_pho=RCRdC6EjV6-vqq=NKb@5mLhl=Z-I9_ia(r@d3}$GNnsFc+a1x}Zf{c*1F~op(HR54^KRq9|w>p;AYSEzJmC!f+k6 zA-Xg_8bCWqWs*m^$oIv^fV|I;)%OonTFFV1YqYDu0CD}^USE-v&8|lA+Wt-EX z71C&ZaRFX|>Byf$1D34>kRy83sa zRQ15$?J|cVcH1fLPt;M4CWNkAH=0k&?HXw0g@EAzRQ6Jdz3&=vf+8r@q?&nhlO?aB zWQ@9oA)HN@JB7(hbTd`P#{28HrOaG7yWiyCFa1|X%66*z)2R(~3*B4m_JhcMNV)Tn zbJ?%k=n#R3|3nmE@tJ4CzOSgfuGbEwDDooFVu5n0uZ(%9-(LSBeP#OWdx>ySx&Q6d zAHslKY8A!V#*bHXAo-Y`-?huh=u6`uG@LL$SW_%4B$dGT`m^lgy&fm!jG|VDSyNux zRi?8&RUBM=^Xu(jb=`66RTG@X9p&F@JfksBLhVb6N;P4u8LwvT8cWwk#!o@EwJ*VB zvfPMY%`?Wp!X!G%Ro4Ohluh++!UGx=KRyAHm~SkQqV*!;+vcGP1|Fl6wjorJ;A5AsH45B*cJe<;Ko4K&vt zZASry_rM;iC7W3clXtRx!-E>8lp=!ECe7T2aZl*NCRcvU^$RVNxKpow0~@=hedYa| z8k=n2a@+&rzNcYMtl4t|NZnINvFRiwKi1=v&>WJ`|i`!cAg16}RoVXlD(`wB^} z3FJd8r>{WhQOTX4?ZJB{FUZ6yz@-PvWkUKjbY5bpgZOfrdls zcbqEk4RoNBuZkd?Giqw$ZE0v;#bVcgL|2xCU>Jd zng_+HN*YqT!6wcJ7MH?K65@w^MlcT1U7er;#KLG6gV}>aVz0k11URga`FWaG+Q$B33T5~cN*gNaXpFV%K;QJVwVsMiJ-UTb2Hl5ttCb3O-)g>D z*jaQaTrFJL6^UBHf$c;%1QV+~_}!%*a_0-&fEw~Qi{tQr{oj^Xk6{l#$`{wJgWye0vjfB7}L{?R7;KeK@$5#u9c(M2x06G^Zj;nC-nIoULRiwLHW zf|tHloh-?{_;*}1iD}j90W%KJF?R+O#JQhCEfBg#(ITzFYJQUW+FRcCb#ozQ|I8Y8 zIzi`029nC9=E_s?H}^kE9$;s2XC`19A_lOW27dYyLFy%%&hh*8RzDD)!NuhMZp{k> z+a~Es8lKPK($+6L%k|26W5yeOnsIr^x7ipCl#aKa?K8x_*1uTCe?Jpxj9iAb!8`oy z?Dx`)k!T$la5c6bHlyhdK;hxvWY#o~dFKnD;Lf%caA0Ncf%cxo?qkudxV1nS){PWp(QcWo1{X?Fm7Nx6|y5VqzspljD& z@4Y1gxZU?S`~Dk;z~>6AXY;&g^Mm(1|9qCGAY7rSRp-DRdNmL0qy;+fIG7NpTg+HU zN}zEqZ??P@aEBX{wHAQnfkx=-qlVRO;q1&Y@UIvuUO^l|FC$ zFce-)ZjlH(J4*|SYY|pt6h- zIJ^BkW{vLMTh^}_+PJ5E7F@H51BEW#j~qn052(-)btiFtzV4FdNfu%Uo}qUZ+-FY3 znuT;}Ktf0dWp{|lxRgCq5-HjBrWl})c{_MMLnn*w;;P5%ky#c` zMOb_Ov%I~H@o2iTf9K*U>&O_o;q zIh&~CzT*jL-~NW@YYxPBG`~%jtNMDRj~^AZvaca5v4ztPhp zyC-9F$Ge^7UbHgwm?wq^8lg#C6It`P`&B*PdNdF2KVET-7y7=j1%y!QUPsLBtW)mN z>}mv6av-Jh?N7(^d>(|hhF^{JwmWL>!={&fqJ8s;HC9zBb}rvIr9~j}zr*~iF+O`w z#ZT47v$hbC-Ln?IM9TvAq7c-p?D4+Wdq(yp3bF9CN0z_6HbX_j_GhE!y5XP1=zEIL zCoFbS%2rYZs&84Ry2Semg1Mu)yP(-Xs z)~u+tHXG7~h;vi)+I{;S^XKPWDGTU3fMWyxouIR06X6<~wQiiNB@ODVZV8B;F>Cq~ z%6#eAP-^^LSVX0~)ZfRRXT26rf90QSpyS8kEPvH>qzz(D;NFLukKUQIR#wiV*Ls+I xOm_K$B@&%X=-@Cc@!;om@tkd+^8DX8611L)qXdC^5dKl2AgA)IRMs@${{X(3;Zy(s diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index 631bcd606e..e3a9cfe4c8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -59,6 +59,9 @@ Windows Firewall offers three network profiles: domain, private and public. The The *domain network* profile is automatically applied to a device that is joined to an Active Directory domain, when it detects the availability of a domain controller. This network profile cannot be set manually. +> [!TIP] +> Another option to detect the *domain network* is to configure the policy settings in the [NetworkListManager Policy CSP][CSP-1], which applies to Microsoft Entra joined devices too. + #### :::image type="icon" source="images/private-network.svg" border="false"::: Private network The *private network* profile is designed for private networks such as a home network. It can be set manually on a network interface by an administrator. @@ -85,3 +88,4 @@ To provide feedback for Windows Firewall, open [**Feedback Hub**][FHUB] (WI [FHUB]: feedback-hub:?tabid=2&newFeedback=true [NLA]: /windows/win32/winsock/network-location-awareness-service-provider-nla--2 +[CSP-1]: /windows/client-management/mdm/policy-csp-networklistmanager diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 9e2d86637b..b98280c9a2 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -11,6 +11,8 @@ items: href: configure-rules-with-gpo.md - name: Configure with command line tools href: configure-with-command-line.md + - name: Configure with Microsoft Intune 🔗 + href: /mem/intune/protect/endpoint-security-firewall-policy - name: Configure logging href: configure-logging.md - name: Hyper-V firewall From 41e5a88aa477ecd0f12797dfc2efb7b0ec7e830c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 15:14:04 -0500 Subject: [PATCH 195/237] updates --- .../windows-firewall/configure-logging.md | 1 - ...th-gpo.md => configure-rules-with-wfas.md} | 6 +- .../windows-firewall/configure.md | 73 +++++------------- .../{mmc-advanced-security.png => wfas.png} | Bin .../windows-firewall/rules.md | 40 ++++++++++ .../network-security/windows-firewall/toc.yml | 4 +- 6 files changed, 63 insertions(+), 61 deletions(-) rename windows/security/operating-system-security/network-security/windows-firewall/{configure-rules-with-gpo.md => configure-rules-with-wfas.md} (98%) rename windows/security/operating-system-security/network-security/windows-firewall/images/{mmc-advanced-security.png => wfas.png} (100%) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index edae0460f2..b371495760 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -32,7 +32,6 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the | Setting | |--------| | **Setting name**: Turn On Virtualization Based Security
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/EnableVirtualizationBasedSecurity`
    **Data type**: int
    **Value**: `1`| -| **Setting name**: Credential Guard Configuration
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/LsaCfgFlags`
    **Data type**: int
    **Value**:
     **Enabled with UEFI lock**: `1`
     **Enabled without lock**: `2`| # [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md similarity index 98% rename from windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md rename to windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md index f2b4821cd0..dca9af3542 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md @@ -1,13 +1,13 @@ --- -title: Configure Windows Firewall rules with group policy +title: Configure firewall rules with WFAS console description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. ms.topic: how-to ms.date: 11/14/2023 --- -# Configure Firewall rules with group policy +# Configure rules with WFAS console -This article contains examples how to configure Windows Firewall rules using group policy (GPO), with the *Windows Firewall with Advanced Security* console. +This article contains examples how to configure Windows Firewall rules using the *Windows Firewall with Advanced Security* console. ## Access the Windows Firewall with Advanced Security console diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 5035b95c09..37ee4407c9 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -15,7 +15,7 @@ Windows offers different tools to view the status and configure Windows Firewall - [Windows Security](#windows-security) - [Control Panel](#control-panel) -- [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) and its integration with the Microsoft Management Console (MMC) +- [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) (WFAS) - [Configuration Service Provider (CSP)](#configuration-service-provider-csp) - [Command line tools](#command-line-tools) @@ -45,7 +45,7 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="3"::: - The *Windows Defender Firewall* Control Panel applet (`firewall.cpl`) provides basic functionalities to configure Windows Firewall. + The *Windows Defender Firewall* Control Panel applet provides basic functionalities to configure Windows Firewall. Select START, type `firewall.cpl`, and press ENTER. :::column-end::: :::column span="1"::: :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the Windows Defender Firewall control panel applet." lightbox="images/control-panel.png" border="false"::: @@ -58,10 +58,14 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="3"::: - The *Windows Defender Firewall with Advanced Security* MMC snap-in provides advanced configuration functionalities. It can be used locally (`wf.msc`) and in group policy (GPO) implementations. + The *Windows Defender Firewall with Advanced Security* (WFAS) is a Microsoft Management Console (MMC) snap-in that provides advanced configuration functionalities. It can be used locally and in group policy (GPO) implementations. + + - If you are configuring a single device, select START, type `wf.msc`, and press ENTER + - If you're configuring devices joined to an Active Directory domain, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** + :::column-end::: :::column span="1"::: - :::image type="content" source="images/mmc-advanced-security.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/mmc-advanced-security.png" border="false"::: + :::image type="content" source="images/wfas.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/wfas.png" border="false"::: :::column-end::: :::row-end::: :::row::: @@ -71,7 +75,13 @@ Windows offers different tools to view the status and configure Windows Firewall :::row-end::: :::row::: :::column span="4"::: - The [Firewall CSP](/windows/client-management/mdm/firewall-csp) provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. + The [Firewall CSP][CSP] provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. + + To learn more about the CSP options, follow these links: + + - [Configure Windows Firewall settings][SETTINGS]: to configure the settings + - [Configure Windows Firewall rules][RULE]: to configure the rules + :::column-end::: :::row-end::: :::row::: @@ -85,39 +95,9 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::row-end::: -## Local policy merge and application rules +## Group policy processing considerations -Firewall rules can be deployed: - -1. Locally using the [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) console (`wf.msc`) or the local GPO editor (`gpedit.msc`) -1. Locally using [command line tools](#command-line-tools) -1. Remotely using group policy (GPO) settings if the device is a member of an Active Directory domain, or managed by Configuration Manager -1. Remotely using the [Firewall CSP](/windows/client-management/mdm/firewall-csp), with a mobile device management (MDM) solution like Microsoft Intune - -*Rule merging* settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. - -The rule-merging policy settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from GPO or CSP. - -| | Path | -|--|--| -| **CSP** | Domain Profile: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileallowlocalpolicymerge)
    Private Profile`./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileallowlocalpolicymerge)
    Public Profile `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileallowlocalipsecpolicymerge) | -| **GPO** | **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security**| - -Administrators may disable *LocalPolicyMerge* in high-security environments to maintain tighter control over endpoints. This setting can impact some applications and services that automatically generate a local firewall policy upon installation. - -> [!IMPORTANT] -> If merging of local policies is disabled, centralized deployment of rules is required for any app that needs inbound connectivity. - -It's important to create and maintain a list of such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex deployments, a thorough analysis might be needed using network packet capture tools. - -In general, to maintain maximum security, admins should only deploy firewall exceptions for apps and services determined to serve legitimate purposes. - -> [!NOTE] -> The use of wildcard patterns, such as `C:\*\teams.exe` isn't supported in application rules. You can only create rules using the full path to the application(s). - -## Group policy processing - -The Windows Firewall settings configured via GPO or CSP are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset of 0 to 30 minutes. +The Windows Firewall policy settings are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset between 0 and 30 minutes. Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: @@ -159,24 +139,7 @@ By default, the Windows Firewall blocks everything unless there's an exception r Once the emergency is over, uncheck the setting to restore regular network traffic. -## WDAC tagging policies - -Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: - -### Step 1: Deploy WDAC AppId Tagging Policies - -A Windows Defender Application Control (WDAC) policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. - -Follow the detailed [WDAC Application ID (AppId) Tagging guide](../../../application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. - -### Step 2: Configure Firewall Rules using PolicyAppId Tags - -Use one of the two methods below to configure firewall rules using PolicyAppId tags: - -- Deploy firewall rules with Microsoft Intune: when creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. -You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. -- Create local firewall rules with PowerShell: you can use [`New-NetFirewallRule`](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` parameter. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported. - [SEC-1]: windowsdefender://network/ +[CSP]: /windows/client-management/mdm/firewall-csp diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/mmc-advanced-security.png b/windows/security/operating-system-security/network-security/windows-firewall/images/wfas.png similarity index 100% rename from windows/security/operating-system-security/network-security/windows-firewall/images/mmc-advanced-security.png rename to windows/security/operating-system-security/network-security/windows-firewall/images/wfas.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index 3a7aee9c2f..4aa316f3ac 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -46,6 +46,38 @@ When first installed, network applications and services issue a *listen call* sp > [!NOTE] > The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. +### WDAC tagging policies + +Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: + +1. Deploy WDAC AppId Tagging Policies: a Windows Defender Application Control (WDAC) policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. For more information, see the [WDAC Application ID (AppId) Tagging guide](../../../application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. +1. Configure Firewall Rules using PolicyAppId Tags using one of the two methods: + - Deploy firewall rules with Microsoft Intune: when creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules + - Create local firewall rules with PowerShell: you can use [`New-NetFirewallRule`](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` parameter. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported + +## Local policy merge and application rules + +*Rule merging* policy settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. + +The rule-merging policy settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from GPO or CSP. + +| | Path | +|--|--| +| **CSP** | Domain Profile: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileallowlocalpolicymerge)
    Private Profile`./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileallowlocalpolicymerge)
    Public Profile `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/`[AllowLocalPolicyMerge](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileallowlocalipsecpolicymerge) | +| **GPO** | **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security**| + +Administrators may disable *LocalPolicyMerge* in high-security environments to maintain tighter control over endpoints. This setting can impact some applications and services that automatically generate a local firewall policy upon installation. + +> [!IMPORTANT] +> If merging of local policies is disabled, centralized deployment of rules is required for any app that needs inbound connectivity. + +It's important to create and maintain a list of such apps, including the network ports used for communications. Typically, you can find what ports must be open for a given service on the app's website. For more complex deployments, a thorough analysis might be needed using network packet capture tools. + +In general, to maintain maximum security, admins should only deploy firewall exceptions for apps and services determined to serve legitimate purposes. + +> [!NOTE] +> The use of wildcard patterns, such as `C:\*\teams.exe` isn't supported in application rules. You can only create rules using the full path to the application(s). + ## Firewall rules recommendations Here's a list of recommendations when designing your firewall rules: @@ -79,6 +111,14 @@ What follows are a few general guidelines for configuring outbound rules. - It's recommended to *allow outbound* by default for most deployments for the sake of simplification with app deployments, unless the organization prefers tight security controls over ease-of-use - In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP +## Configure firewall rules + +Firewall rules can be configure with the following tools: + +- Using the [Firewall CSP](/windows/client-management/mdm/firewall-csp), with a mobile device management (MDM) solution like Microsoft Intune. For more information, see [][] +- Using the Windows Defender Firewall with Advanced Security (WFAS) console, locally or via GPO. For more information, see [][] +- Using command line tools. For more information, see [][] + ## Next steps > [!div class="nextstepaction"] diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index b98280c9a2..60aec30467 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -7,8 +7,8 @@ items: items: - name: Configure Windows Firewall href: configure.md - - name: Configure rules with group policy - href: configure-rules-with-gpo.md + - name: Configure firewall rules with WFAS console + href: configure-rules-with-wfas.md - name: Configure with command line tools href: configure-with-command-line.md - name: Configure with Microsoft Intune 🔗 From 97eca532671ae42e55d098dba2bbb7649b1debed Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 15:33:15 -0500 Subject: [PATCH 196/237] updates --- .../configure-rules-with-wfas.md | 178 ------------ .../windows-firewall/configure.md | 271 ++++++++++-------- .../windows-firewall/rules.md | 8 +- .../network-security/windows-firewall/toc.yml | 4 +- .../windows-firewall/tools.md | 148 ++++++++++ 5 files changed, 306 insertions(+), 303 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md create mode 100644 windows/security/operating-system-security/network-security/windows-firewall/tools.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md deleted file mode 100644 index dca9af3542..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-wfas.md +++ /dev/null @@ -1,178 +0,0 @@ ---- -title: Configure firewall rules with WFAS console -description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. -ms.topic: how-to -ms.date: 11/14/2023 ---- - -# Configure rules with WFAS console - -This article contains examples how to configure Windows Firewall rules using the *Windows Firewall with Advanced Security* console. - -## Access the Windows Firewall with Advanced Security console - -If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. - -If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. - -## Create an inbound ICMP rule - -This type of rule allows ICMP requests and responses to be received by devices on the network. To create an inbound ICMP rule: - -1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** -1. On the **Program** page, select**All programs**, and then select**Next** -1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each -1. Select **Customize** -1. In the **Customize ICMP Settings** dialog box, do one of the following: - - To allow all ICMP network traffic, select**All ICMP types**, and then select**OK** - - To select one of the predefined ICMP types, select**Specific ICMP types**, and then select each type in the list that you want to allow. Select **OK** - - To select an ICMP type that does not appear in the list, select**Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, select**Add**, and then select the newly created entry from the list. Select **OK** -1. Select **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** - -## Create an inbound port rule - -This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. To create an inbound port rule: - -1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** - > [!NOTE] - > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, select**All programs**, and then select**Next** - > [!NOTE] - > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](#create-an-inbound-program-or-service-rule) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. -1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number - If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.\ - To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.\ - When you have configured the protocols and ports, select**Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** - > [!NOTE] - > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. -1. On the **Name** page, type a name and description for your rule, and then select**Finish** - -## Create an outbound port rule - -By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. To create an outbound port rule: - -1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select **Outbound Rules** -1. Select **Action**, and then select **New rule** -1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** - > [!NOTE] - > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, select **All programs**, and then select **Next** -1. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number - If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** -1. On the **Action** page, select **Block the connection**, and then select **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** -1. On the **Name** page, type a name and description for your rule, and then select **Finish** - -## Create an inbound program or service rule - -This type of rule allows the program to listen and receive inbound network traffic on any port. - -> [!NOTE] -> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](#create-an-inbound-port-rule) procedure in addition to the steps in this procedure. - -To create an inbound firewall rule for a program or service: - -1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** - > [!NOTE] - > Information the user should notice even if skimmingAlthough you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, select**This program path** -1. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. -1. Do one of the following: - - If the executable file contains a single program, select**Next** - - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, select**Customize**, select **Apply to services only**, select**OK**, and then select**Next** - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select**Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, select**Apply to service with this service short name**, and then type the short name for the service in the text box. Select **OK**, and then select**Next** - - > [!IMPORTANT] - > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: `sc qsidtype ` - > - > If the result is `NONE`, then a firewall rule cannot be applied to that service. - - To set a SID type on a service, run the following command: `sc sidtype ` - - In the preceding command, the value of `` can be `UNRESTRICTED` or `RESTRICTED`. Although the command also permits the value of `NONE`, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as `UNRESTRICTED`. If you change the SID type to `RESTRICTED`, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to `UNRESTRICTED`. - -1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](#create-an-inbound-port-rule). After you have configured the protocol and port options, select**Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** - -## Create an outbound program or service rule - -By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. This type of rule prevents the program from sending any outbound network traffic on any port. To create an outbound firewall rule for a program or service: - -1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select **Outbound Rules** -1. Select **Action**, and then select **New rule** -1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** - > [!NOTE] - > Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, select **This program path** -1. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly -1. Do one of the following: - - If the executable file contains a single program, select **Next** - - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** -1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](#create-an-outbound-port-rule). When you have configured the protocol and port options, select **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** -1. On the **Action** page, select **Block the connection**, and then select **Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** -1. On the **Name** page, type a name and description for your rule, and then select **Finish** - -## Create inbound rules to support RPC - -To allow inbound remote procedure call (RPC) network traffic, you must create two firewall rules: - -- the first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service -- the second rule allows the network traffic that is sent to the dynamically assigned port number - -Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. - -### RPC Endpoint Mapper service - -1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** -1. On the **Program** page, select**This Program Path**, and then type `%systemroot%\system32\svchost.exe` -1. Select **Customize**. -1. In the **Customize Service Settings** dialog box, select**Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, select**OK**, and then select**Next** -1. On the warning about Windows service-hardening rules, select**Yes** -1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** -1. For **Local port**, select **RPC Endpoint Mapper**, and then select**Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** - -### RPC-enabled network services - -1. On the same GPO you edited in the preceding procedure, select**Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** -1. On the **Program** page, select**This Program Path**, and then type the path to the executable file that hosts the network service. Select **Customize** -1. In the **Customize Service Settings** dialog box, select**Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then select**Apply to service with this service short name**, and then type the short name of the service in the text box -1. Select **OK**, and then select**Next** -1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** -1. For **Local port**, select **RPC Dynamic Ports**, and then select**Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 37ee4407c9..dca9af3542 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -1,145 +1,178 @@ --- -title: Configure Windows Firewall -description: Learn about the available tools to configure Windows Firewall and firewall rules. -ms.date: 11/15/2023 -ms.topic: best-practice +title: Configure firewall rules with WFAS console +description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. +ms.topic: how-to +ms.date: 11/14/2023 --- -# Configure Windows Firewall +# Configure rules with WFAS console -This article describes the available tools to configure Windows Firewall and firewall rules. +This article contains examples how to configure Windows Firewall rules using the *Windows Firewall with Advanced Security* console. -## Configuration tools +## Access the Windows Firewall with Advanced Security console -Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services: +If you're configuring devices joined to an Active Directory domain, to complete these procedures you must be a member of the Domain Administrators group, or otherwise have delegated permissions to modify the GPOs in the domain. To access the *Windows Firewall with Advanced Security* console, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security**. -- [Windows Security](#windows-security) -- [Control Panel](#control-panel) -- [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) (WFAS) -- [Configuration Service Provider (CSP)](#configuration-service-provider-csp) -- [Command line tools](#command-line-tools) +If you are configuring a single device, you must have administrative rights on the device. In which case, to access the *Windows Firewall with Advanced Security* console, select START, type `wf.msc`, and press ENTER. + +## Create an inbound ICMP rule + +This type of rule allows ICMP requests and responses to be received by devices on the network. To create an inbound ICMP rule: + +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Program** page, select**All programs**, and then select**Next** +1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each +1. Select **Customize** +1. In the **Customize ICMP Settings** dialog box, do one of the following: + - To allow all ICMP network traffic, select**All ICMP types**, and then select**OK** + - To select one of the predefined ICMP types, select**Specific ICMP types**, and then select each type in the list that you want to allow. Select **OK** + - To select an ICMP type that does not appear in the list, select**Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, select**Add**, and then select the newly created entry from the list. Select **OK** +1. Select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** + +## Create an inbound port rule + +This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. To create an inbound port rule: + +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** + > [!NOTE] + > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. +1. On the **Program** page, select**All programs**, and then select**Next** + > [!NOTE] + > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](#create-an-inbound-program-or-service-rule) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. +1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number + If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.\ + To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.\ + When you have configured the protocols and ports, select**Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** + > [!NOTE] + > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. +1. On the **Name** page, type a name and description for your rule, and then select**Finish** + +## Create an outbound port rule + +By default, Windows Firewall allows all outbound network traffic, unless it matches a rule that prohibits the traffic. This type of rule blocks any outbound network traffic that matches the specified TCP or UDP port numbers. To create an outbound port rule: + +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select **Outbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Outbound Rule wizard, select **Custom**, and then select **Next** + > [!NOTE] + > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. +1. On the **Program** page, select **All programs**, and then select **Next** +1. On the **Protocol and Ports** page, select the protocol type that you want to block. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this rule is an outbound rule, you typically configure only the remote port number + If you select another protocol, then only packets whose protocol field in the IP header matches this rule are blocked by Windows Defender Firewall. Network traffic for protocols is allowed as long as other rules that match don't block it. To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box. When you've configured the protocols and ports, select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Block the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** + +## Create an inbound program or service rule + +This type of rule allows the program to listen and receive inbound network traffic on any port. > [!NOTE] -> To change the configuration of Windows Firewall on a device, you must have administative rights. +> This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. To combine the program and port rule types into a single rule, follow the steps in the [Create an Inbound Port Rule](#create-an-inbound-port-rule) procedure in addition to the steps in this procedure. -:::row::: - :::column span="4"::: - #### Windows Security - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: - > [!div class="nextstepaction"] - > [Open Firewall & network protection][SEC-1] +To create an inbound firewall rule for a program or service: - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." lightbox="images/windows-security.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - #### Control Panel - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - The *Windows Defender Firewall* Control Panel applet provides basic functionalities to configure Windows Firewall. Select START, type `firewall.cpl`, and press ENTER. - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the Windows Defender Firewall control panel applet." lightbox="images/control-panel.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - #### Windows Defender Firewall with Advanced Security - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - The *Windows Defender Firewall with Advanced Security* (WFAS) is a Microsoft Management Console (MMC) snap-in that provides advanced configuration functionalities. It can be used locally and in group policy (GPO) implementations. +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** + > [!NOTE] + > Information the user should notice even if skimmingAlthough you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. +1. On the **Program** page, select**This program path** +1. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. +1. Do one of the following: + - If the executable file contains a single program, select**Next** + - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, select**Customize**, select **Apply to services only**, select**OK**, and then select**Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select**Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, select**Apply to service with this service short name**, and then type the short name for the service in the text box. Select **OK**, and then select**Next** - - If you are configuring a single device, select START, type `wf.msc`, and press ENTER - - If you're configuring devices joined to an Active Directory domain, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** + > [!IMPORTANT] + > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: `sc qsidtype ` + > + > If the result is `NONE`, then a firewall rule cannot be applied to that service. - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/wfas.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/wfas.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - #### Configuration Service Provider (CSP) - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - The [Firewall CSP][CSP] provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. + To set a SID type on a service, run the following command: `sc sidtype ` - To learn more about the CSP options, follow these links: + In the preceding command, the value of `` can be `UNRESTRICTED` or `RESTRICTED`. Although the command also permits the value of `NONE`, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as `UNRESTRICTED`. If you change the SID type to `RESTRICTED`, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to `UNRESTRICTED`. - - [Configure Windows Firewall settings][SETTINGS]: to configure the settings - - [Configure Windows Firewall rules][RULE]: to configure the rules +1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](#create-an-inbound-port-rule). After you have configured the protocol and port options, select**Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - #### Command line tools - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - The `NetSecurity` PowerShell module and `Network Command Shell (netsh.exe)` are command line utilities that can be used to query the status and configure Windows Firewall. - :::column-end::: -:::row-end::: +## Create an outbound program or service rule -## Group policy processing considerations +By default, Windows Defender Firewall allows all outbound network traffic unless it matches a rule that prohibits the traffic. This type of rule prevents the program from sending any outbound network traffic on any port. To create an outbound firewall rule for a program or service: -The Windows Firewall policy settings are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset between 0 and 30 minutes. +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select **Outbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Outbound Rule Wizard, select **Custom**, and then select **Next** + > [!NOTE] + > Although you can create many rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. +1. On the **Program** page, select **This program path** +1. Type the path to the program in the text box. Use environment variables as appropriate to ensure that programs installed in different locations on different computers work correctly +1. Do one of the following: + - If the executable file contains a single program, select **Next** + - If the executable file is a container for multiple services that must all be blocked from sending outbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, then select **Apply to service with this service short name**, and type the short name for the service in the text box. Select **OK**, and then select **Next** +1. If you want the program to be allowed to send on some ports, but blocked from sending on others, then you can restrict the firewall rule to block only the specified ports or protocols. On the **Protocols and Ports** page, you can specify the port numbers or protocol numbers for the blocked traffic. If the program tries to send to or from a port number different from the one specified here, or by using a protocol number different from the one specified here, then the default outbound firewall behavior allows the traffic. For more information about the protocol and port options, see [Create an Outbound Port Rule](#create-an-outbound-port-rule). When you have configured the protocol and port options, select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Block the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** -Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: +## Create inbound rules to support RPC -1. Reads all firewall rules and settings -1. Applies any new filters -1. Removes the old filters +To allow inbound remote procedure call (RPC) network traffic, you must create two firewall rules: -> [!NOTE] -> The actions are triggered whenever something is written to, or deleted from the registry location the GPO settings are stored, regardless if there's really a configuration change. During the process, IPsec connections are disconnected. +- the first rule allows incoming network packets on TCP port 135 to the RPC Endpoint Mapper service. The incoming traffic consists of requests to communicate with a specified network service. The RPC Endpoint Mapper replies with a dynamically assigned port number that the client must use to communicate with the service +- the second rule allows the network traffic that is sent to the dynamically assigned port number -Many policy implementations specify that they're updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. To control the behavior of the registry group policy processing, you can use the policy **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure registry policy processing**. The **Process even if the Group Policy objects haven't changed** option updates and reapplies the policies even if the policies haven't changed. This option is disabled by default. +Using the two rules configured as described in this topic helps to protect your device by allowing network traffic only from devices that have received RPC dynamic port redirection and to only those TCP port numbers assigned by the RPC Endpoint Mapper. -If you enable the option **Process even if the Group Policy objects haven't changed**, the WFP filters get reapplied at **every** background refresh. In case you have 10 group policies, the WFP filters get reapplied 10 times during the refresh interval. If an error happens during policy processing, the applied settings might be incomplete, resulting in issues like: +### RPC Endpoint Mapper service -- Windows Firewall blocks inbound or outbound traffic allowed by group policies -- Local Firewall settings are applied instead of group policy settings -- IPsec connections can't establish +1. Open the *Windows Firewall with Advanced Security* console +1. In the navigation pane, select**Inbound Rules** +1. Select **Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Program** page, select**This Program Path**, and then type `%systemroot%\system32\svchost.exe` +1. Select **Customize**. +1. In the **Customize Service Settings** dialog box, select**Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, select**OK**, and then select**Next** +1. On the warning about Windows service-hardening rules, select**Yes** +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** +1. For **Local port**, select **RPC Endpoint Mapper**, and then select**Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** -The temporary solution is to refresh the group policy settings, using the command `gpupdate.exe /force`, which requires connectivity to a domain controller. +### RPC-enabled network services -To avoid the issue, leave the policy **Configure registry policy processing** to the default value of **Not Configured** or, if already configured, configure it **Disabled**. - -> [!IMPORTANT] -> The checkbox next to **Process even if the Group Policy objects have not changed** must be unchecked. If you leave it unchecked, WFP filters are written only in case there's a configuration change. -> -> If there's a requirement to force registry deletion and rewrite, then disable background processing by checking the checkbox next to **Do not apply during periodic background processing**. - -## *Shields up* mode for active attacks - -An important Windows Firewall feature you can use to mitigate damage during an active attack is the *shields up* mode. It's an informal term referring to an easy method a firewall administrator can use to temporarily increase security in the face of an active attack. - -Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or Control Panel. - -![Incoming connections.](images/fw06-block.png) - -:::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: - -By default, the Windows Firewall blocks everything unless there's an exception rule created. The *shield up* option overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access won't work as long as shields up is activated. - -Once the emergency is over, uncheck the setting to restore regular network traffic. - - - -[SEC-1]: windowsdefender://network/ -[CSP]: /windows/client-management/mdm/firewall-csp +1. On the same GPO you edited in the preceding procedure, select**Action**, and then select**New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Program** page, select**This Program Path**, and then type the path to the executable file that hosts the network service. Select **Customize** +1. In the **Customize Service Settings** dialog box, select**Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then select**Apply to service with this service short name**, and then type the short name of the service in the text box +1. Select **OK**, and then select**Next** +1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** +1. For **Local port**, select **RPC Dynamic Ports**, and then select**Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** +1. On the **Action** page, select **Allow the connection**, and then select**Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** +1. On the **Name** page, type a name and description for your rule, and then select**Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index 4aa316f3ac..868a557c00 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -35,14 +35,14 @@ When first installed, network applications and services issue a *listen call* sp - If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic - If the user isn't a local admin, they won't be prompted. In most cases, block rules are created - In either of these scenarios, once the rules are added, they must be deleted to generate the prompt again. If not, the traffic continues to be blocked. - :::column-end::: :::column span="2"::: :::image type="content" source="images/uac.png" alt-text="Screenshot showing the User Account Control (UAC) prompt to allow Microsoft Teams." border="false"::: :::column-end::: :::row-end::: +In either of these scenarios, once the rules are added, they must be deleted to generate the prompt again. If not, the traffic continues to be blocked. + > [!NOTE] > The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. @@ -99,7 +99,7 @@ To determine why some applications are blocked from communicating in the network 1. A user with sufficient privileges receives a query notification advising them that the application needs to make a change to the firewall policy. Not fully understanding the prompt, the user cancels or dismisses the prompt 1. A user lacks sufficient privileges and is therefore not prompted to allow the application to make the appropriate policy changes -1. *Local Policy Merge* is disabled, preventing the application or network service from creating local rules +1. [Local policy merge](#local-policy-merge-and-application-rules) is disabled, preventing the application or network service from creating local rules Creation of application rules at runtime can also be prohibited by administrators using the Settings app or policy settings. @@ -124,4 +124,4 @@ Firewall rules can be configure with the following tools: > [!div class="nextstepaction"] > Learn about the tools to configure Windows Firewall and firewall rules: > -> [Configure Windows Firewall >](configure.md) +> [Configuration tools >](tools.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 60aec30467..234266f1f9 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -5,10 +5,10 @@ items: href: rules.md - name: Configure and manage Windows Firewall items: + - name: Configuration tools + href: tools.md - name: Configure Windows Firewall href: configure.md - - name: Configure firewall rules with WFAS console - href: configure-rules-with-wfas.md - name: Configure with command line tools href: configure-with-command-line.md - name: Configure with Microsoft Intune 🔗 diff --git a/windows/security/operating-system-security/network-security/windows-firewall/tools.md b/windows/security/operating-system-security/network-security/windows-firewall/tools.md new file mode 100644 index 0000000000..5a0c57e9ce --- /dev/null +++ b/windows/security/operating-system-security/network-security/windows-firewall/tools.md @@ -0,0 +1,148 @@ +--- +title: Windows Firewall tools +description: Learn about the available tools to configure Windows Firewall and firewall rules. +ms.date: 11/15/2023 +ms.topic: best-practice +--- + +# Windows Firewall tools + +Windows offers different tools to view the status and configure Windows Firewall. All tools interact with the same underlying services, but provide different levels of control over those services: + +- [Windows Security](#windows-security) +- [Control Panel](#control-panel) +- [Windows Defender Firewall with Advanced Security](#windows-defender-firewall-with-advanced-security) (WFAS) +- [Configuration Service Provider (CSP)](#configuration-service-provider-csp) +- [Command line tools](#command-line-tools) + +> [!NOTE] +> To change the configuration of Windows Firewall on a device, you must have administative rights. + +:::row::: + :::column span="4"::: + #### Windows Security + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + The *Windows Security* app can be used to view the Windows Firewall status and access advanced tools to configure it. Select START, type `Windows Security`, and press ENTER. Once Windows Security is open, select the tab **Firewall & network protection**. Or use the following shortcut: + > [!div class="nextstepaction"] + > [Open Firewall & network protection][SEC-1] + + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/windows-security.png" alt-text="Screenshot showing the Windows Security app." lightbox="images/windows-security.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + #### Control Panel + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + The *Windows Defender Firewall* Control Panel applet provides basic functionalities to configure Windows Firewall. Select START, type `firewall.cpl`, and press ENTER. + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/control-panel.png" alt-text="Screenshot showing the Windows Defender Firewall control panel applet." lightbox="images/control-panel.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + #### Windows Defender Firewall with Advanced Security + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + The *Windows Defender Firewall with Advanced Security* (WFAS) is a Microsoft Management Console (MMC) snap-in that provides advanced configuration functionalities. It can be used locally and in group policy (GPO) implementations. + + - If you are configuring a single device, select START, type `wf.msc`, and press ENTER + - If you're configuring devices joined to an Active Directory domain, [create or edit](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc754740(v=ws.11)) a group policy object (GPO) and expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** + + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/wfas.png" alt-text="Screenshot of the Windows Defender Firewall with Advanced Security MMC snap-in." lightbox="images/wfas.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + #### Configuration Service Provider (CSP) + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + The [Firewall CSP][CSP] provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. + + To learn more about the CSP options, follow these links: + + - [Configure Windows Firewall settings][SETTINGS]: to configure the settings + - [Configure Windows Firewall rules][RULE]: to configure the rules + + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + #### Command line tools + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + The `NetSecurity` PowerShell module and `Network Command Shell (netsh.exe)` are command line utilities that can be used to query the status and configure Windows Firewall. + :::column-end::: +:::row-end::: + +## Group policy processing considerations + +The Windows Firewall policy settings are stored in the registry. By default, group policies are refreshed in the background every 90 minutes, with a random offset between 0 and 30 minutes. + +Windows Firewall monitors the registry for changes, and if something is written to the registry it notifies the *Windows Filtering Platform (WFP)*, which performs the following actions: + +1. Reads all firewall rules and settings +1. Applies any new filters +1. Removes the old filters + +> [!NOTE] +> The actions are triggered whenever something is written to, or deleted from the registry location the GPO settings are stored, regardless if there's really a configuration change. During the process, IPsec connections are disconnected. + +Many policy implementations specify that they're updated only when changed. However, you might want to update unchanged policies, such as reapplying a desired policy setting in case a user has changed it. To control the behavior of the registry group policy processing, you can use the policy **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure registry policy processing**. The **Process even if the Group Policy objects haven't changed** option updates and reapplies the policies even if the policies haven't changed. This option is disabled by default. + +If you enable the option **Process even if the Group Policy objects haven't changed**, the WFP filters get reapplied at **every** background refresh. In case you have 10 group policies, the WFP filters get reapplied 10 times during the refresh interval. If an error happens during policy processing, the applied settings might be incomplete, resulting in issues like: + +- Windows Firewall blocks inbound or outbound traffic allowed by group policies +- Local Firewall settings are applied instead of group policy settings +- IPsec connections can't establish + +The temporary solution is to refresh the group policy settings, using the command `gpupdate.exe /force`, which requires connectivity to a domain controller. + +To avoid the issue, leave the policy **Configure registry policy processing** to the default value of **Not Configured** or, if already configured, configure it **Disabled**. + +> [!IMPORTANT] +> The checkbox next to **Process even if the Group Policy objects have not changed** must be unchecked. If you leave it unchecked, WFP filters are written only in case there's a configuration change. +> +> If there's a requirement to force registry deletion and rewrite, then disable background processing by checking the checkbox next to **Do not apply during periodic background processing**. + +## *Shields up* mode for active attacks + +An important Windows Firewall feature you can use to mitigate damage during an active attack is the *shields up* mode. It's an informal term referring to an easy method a firewall administrator can use to temporarily increase security in the face of an active attack. + +Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or Control Panel. + +![Incoming connections.](images/fw06-block.png) + +:::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: + +By default, the Windows Firewall blocks everything unless there's an exception rule created. The *shield up* option overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access won't work as long as shields up is activated. + +Once the emergency is over, uncheck the setting to restore regular network traffic. + +## Next steps + +> [!div class="nextstepaction"] +> Learn about the tools to configure Windows Firewall and firewall rules: +> +> [Configure Windows Firewall >](configure.md) + + + +[SEC-1]: windowsdefender://network/ +[CSP]: /windows/client-management/mdm/firewall-csp From da2d486ee5b4ca0ba8f9c78b5db29c8113b9c1a4 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 16:48:44 -0500 Subject: [PATCH 197/237] Modified Web sign-in description to include Sept. moment --- windows/client-management/mdm/policy-csp-authentication.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 7d6b0d757b..792538bcd5 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -469,10 +469,7 @@ Specifies whether web-based sign-in is allowed for signing in to Windows. -> [!WARNING] -> The Web sign-in feature is intended for recovery purposes in the event a password isn't available as an authentication method. Web sign-in only supports *temporary access pass* as an authentication method for Microsoft Entra ID, unless it's used in a limited federated scope. - -**Web sign-in** is a modern way of signing into a Windows PC. It enables Windows sign-in support for new Microsoft Entra credentials, like temporary access pass. +Web sign-in is a credential provider that enables a web-based sign-in experience on Windows devices. Initially introduced in Windows 10 with support for Temporary Access Pass (TAP) only, Web sign-in expanded its capabilities starting in Windows 11, version 22H2 with KB5030310. For more information, see [Web sign-in for Windows](/windows/security/identity-protection/web-sign-in). > [!NOTE] > Web sign-in is only supported on Microsoft Entra joined PCs. From 54c8580064e77cfbd703587f0f5f021f451f34f6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 17:41:16 -0500 Subject: [PATCH 198/237] updates --- .../images/fw02-createrule.png | Bin 165999 -> 0 bytes .../network-security/windows-firewall/rules.md | 10 +++++----- .../network-security/windows-firewall/toc.yml | 6 +++--- .../network-security/windows-firewall/tools.md | 14 ++++++++------ 4 files changed, 16 insertions(+), 14 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/fw02-createrule.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/fw02-createrule.png b/windows/security/operating-system-security/network-security/windows-firewall/images/fw02-createrule.png deleted file mode 100644 index 5c8f858f526d0591039a914973b37828d8d4ab54..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 165999 zcmY(Kb9g1)(zi1)Cbo8LCllMYZQD*Jwr$(CC&|RNZQI|RbKd8i`Tknh)w}oV>gv^1 zweI?Ln4F9#EHoB05D*ZoxR{Uv5D*9z5D>62B=Daj$_TFoe}-?43Zeo))sr|UKtNxk z;zImNZaU{#5PB#FNI#!!YM#apW9Z^6hL7hAmA4E!VOZ;{P)$~O`$UB z{9crGfBKIY&DNZ|bm;EidUT1szfNTnn(h4W)N54)Hr*?*`lTGC)CCJLsP8CxKDZd2 zk10I{NTss>*!3^-J~=^Y={aAW^w^?v9zZyCf$zq2@WTlN_kEA{`KW~ddl!B^{=I`H zqFbJ55eF&t7(qcn($dmCP0PZobcIlFRM8Np$p5+7e@_YnItec@Lm1^}hl-6&l`@72 z0S{1m9etsuh1R;!?G0QE{l|fS{MZ{sVpqmk(b$+cbrgUw#O8D?XJKKXr?(x2i}Vou z*NH%cc8K3;J>{6ED80qg}ac*->k9`G}tQIm%?(M{eKS& zAD9M|?+#1=gT}83F}!$2NpsH3wS83$Pg(H)n}#h1sI-d@IG}&uVWk%0cGL;Wd2$N= z%E$1k-BdM4t+U$`3UkkOsyD17ebFc z1%F#QqXx>?GzEjuvbD1M4h3Z{nS$@9PK~AkjQz09 zggoo7uEk$5F*%QkR>O1N_<+LbiEB8iwCUZGfPT+n!%_omdOstUPnlC0CB=Y-aEZ|9VZ>}m2;VG#(^iUd;3 zB!5a&*9IiNaVD%m-A(c zN0V85lS$9d&#S8%kgk*{(6-z0ZCcf9dm~d*@X&CFuST4)cj+1FvvYH6Qe_NoKCC&&!go`j%r-SQU)b5Hz_IJUbJSajzS$=oYNeP0*and80;2G zJ#OCeHcgxM`o^ZpNwl4UTY!;1YlNQTvPNT`+PFlj2rPPwU%&MO6#7y6!pw2^5-(C1 zJ~K~NJ`hwTe~%!5mbl8oA0j)yn1)+Q#p>WDMq>obgyZ2In9rKI5tb>})N9+howWCM zSpQhHpY2ax<&7y=(o)KgCx*vj^>M0!(|6Nk_0*!rkwsi9vWyQjrzdUm=9#i@iR|cNi$(<_j4S7oTBZAd}6kUAr(YDza#5m(AfJj4SOLzc~W5 zi&83UQ4&;pK7ifMcc*761_)~LpB5;1tEa4fSDmB<=RB^pNv`cYQyd5(8~i;L9pbot zs!<{~*>dJ26MkVbLMR-3N-BXucytOaQxUY&-yWGzRNkJ+RAO0meq9TcIemo3>r!4Q zU~AvNc6(e3PH&9Ut+Q4nW~?Z&nu};p%DD;( zT|bH$wUAh7yK;m}eF7eSN6qr~tji(zQ|fT$e3paBt3z%RKK|$G?74|)U0xnHy6>JQ&yZ(AUNaw!7$TgVj_#&Hwny?$_Z}!dnNva zL2;zc=|H=0kgng0=hSqUj$*qoLuk?gKdF^H~t3GzHzWCQGX*tCcvlU9u!>3kv-dk~?0;(~ye! z2zIq&rq?!gq03|blgg%TfDs;`scouZBIZs&{h%Z|Iy$^S{v_P?GeU;a`g$bl0AT(z zmF_c4?L4`k!I?_1EVV+pew{b zDOk4%Ab(tU0#kas&HpCYAezL6EkrC{DP2(0YQ?8u_?@TBd?prO1F6?h=~0!|%O!2m z6ok!L=$qbBEn(cioVd^GKJfZ*fgQMJB^5kYJUU_-eZp;IH$`k{Z_)t6ggGwKwNX|< zIdkj;-jOGMVUHW1`#K5>XMpn*=%|`RtA*%=rj*ha`-K2Ocw{;7NykrRzb%11~$9m2_VQ_%uiyqT3; z2Z^}g8}TaT*gS1ZJAK7Ee2M$VR za+6@J2ikxr6cr~xxELv?L)H)+3Hb>E@xp1E3u`-Co4b?|R6m9Cd$)t%i8tt&-cm^8 zk_L<%-nM?X2w>%?5(M3vtE?Y2+#?hmh*#`zk%3z%O|Jxu<}I;9k;?wIIU9*SCHPO3 z{VoWKe{(-mAS$b+wvF7S^94U~91IIn{Y1^;O_ncQY)L8AQIhoYnONL8*6;1d0u_UT z*m8nFe*wErozN_u*5!ff&B7ujB(^#gaT6Wv=Iq<6h!`k0>%o3<0i%VS=8oY zfl{FjD_Y&L0iISW{zgc&{uJ=v50MqT% zuiz4ctlvWE%cX{fFg)}3@iX?Ve1H}%jU|XaU^BVg|JJ`@gj@cW#uh+mA4W~DHZp(< zr;&f%uC?Afy`77XxMf{g@gp=o-+$zA78-8G)H-Pd28*B#F2!(z1?UWp6?#rmTGVf%%~Vc`a8xVvH?lt z^z9ZCLTy3hGi_Msn*$HUzj}Y#q7nZR(y0tE5CaA~JS`^`DARK^Leg{(S|ozjGYmxk zg-RDB?}Xq(_d5&})SpBhhhTV7tEPS#7xuwf1bQ#DwNhY zi{Ii1GFe{P5G6=*rL(s19&QI%**R>~NyV;EtY+*au%~#`DoGLri}>g+RjZq;PBO=b zn?v}w8*K`<$S-=9oEVt>xDAh|i#ZB@TD{hFfG!Iu-Of!sPB$bg^E~tFg-KF*pFhJ2 zmt8ZmNb&voT7{=UZQ`}tdjqego)Y{_{5aI6AEZ>DuU?c~!0>_nOJ3N<>-}jQ7Ag*K zdQN+#f~=Z^6vCXG$`m9VvKt@#Z|IY0DjMJro0H^jU+*t=PEb)y(&_!AMT0(Vj!|i5 zN)SaTnM-;wwb_vs4@SQ!m%%_3(6ldmalmFdN#Y^k6_hx8Qj1G|pw;SJJ+ z`x1!y$_r=u@Rehd_Ml$!yu@TbbvUNWhFVa8fWmpO|h0y z%jcC`(*N6vv!Z^B{n1MWbDnX8PVcjMEiO~0&+4}r^e0+>dCfg4f zd5jL4%3>mew6aFOMES}2G6Gvs&{ZswMZhDs&v^38<-&GJVQY5EYvI-+U!aK@JYwt? z$s*$>5ttcPhwH*k$Hgu%Nu;F`fvPGpnx)YIyQUKS(N+O}BWe>HSKn0AB?3;Qt*=+SxQDfJU~xkSt(*< zFd-At*EfhBUbZ?284{*QeK39@iP8Yq#3F}y&}!{n%k-u!DJ-8HLZna&455Kh3IEW9 z>k6DO%14PK==Sz)e2LT>Lt$JuAw)$a08afjmY9;Jt)N~+Ld-DZAeo?!fQ5}p$;f=R zavKU+6gcKIk9MHS;!X@LY^U~9(h@B=$PNe1e~u9vWO!W!2Czh+5Z-~EF_H?$V6bjH zzf6KS^R2b5GJkwDfyxdz{b%eEBX(vhF`E$drak@|7W=48R(t^do`)WN%Dj1KZ?t@8 zdH%XX6r$-^q91=BG{c&;lIG3+J{wQO0BICz5SX(EBfc1v24~15DI9!?-FmSJ3@;l8 zA!Dz)ZgPU^wAnB)kpYo$_O2rP;DK=yi%m!?WKAApMd@rG(%8#w>~DMk4jSn|Ddh-H zoZ`9}RQS~_1E~_N9cs=btsg0xjDtewbj8Tnc-i8yeu+q+zq+D|T%pCS!h3D49cB)2 zgOglgJQyPHcp)Q)!nWLj>O2z(0ly!=igGp)J~xe2g^0E~R&D>Z)zI4QfTixEcoGzdQ z=kIm=z@GX-zUAe$Gdobwv1=11Nb?eG>S`5f^~X1!o1djo$Xyo9u_RNf*#2mt2K1T{ z)(iQbz}!nbuMOXhb&stBQk)zXoU<+}7cd)t zbh|aOJb37kta`1;pi)&r6c&t$(Or{N-rqLl&NS7wB1l(Awmp|>%?1uRqCF|AWy1Q3 zs!!r@lSty>PzeL8c}}4z;r$Cp`T4Scz`io5q*TL$>u@~kGOEt#T_CAF0{}b!gj^Q`26TwqI{8t=`&QZ8+U{G)>Hb6IdYKW;;(Dhy z&eNasM0`2FHS=NN1plh($>PL9_zybUt|9nIT-y^&b&C2wmWJRrhRlbA!NK`AFnsQS z!iPG)B8?vUn_T@IIl5cJoB`th``{nCNDDk3!}|hC7@)0+SIY1=4-4hcFj=dRSa; zwOX`2DBn)%EU^}%Ca}6zCJ*h;v8pmAjNP^2$VPT+s~MQ^^qJVY-l;4$)>XV47W+`| zYIt8Fm(1%rxTxWVSv6}$4*fG%!5cEjb~j?Rb5Ty3GjPAdK|I0ou@NwJJQ1=1LMBd% zmzSi@c|C3NgZ>L+G4A>{(Em2!<#Ur2w^VA>k!$E~AzHt#QSLvH zy%|Z;0&B;cBA(c@-fzQx=fs@^;bU+v;*5JH~RwRd>4szl5H((sG*R42y9{x%LX` z<@z?y>cazKAbr!kFsAEa{pp{kc{#Pn_6H{!cZ!Bb-6gF*`wZ$ z`a_{OQ(AU1i`8~g)3g50#peAu5N*I}WvjcD8lsSSuI!2>+s>o9n;IP1l%7i@YE#uo zBmHm>0PuV{v(kXhbtjX(py<7?X5J9g*Ut|;$Bd)#y33&xGFi56h*!hAKpH@B zKwfHzR3wG7?5QO>b@BlVDx&23*?)F=?}<*Q!)1NFO|bX&aL#rbXATl{7+>Id3!6P^ zJVlEf>FsfI=W4m+b8l%M(Cju1?{WxLruqgAX<^5-t7&3*!A6hsF=5orb0)wsSh@4&{$JR zbj$l5pqqBLT5j!;wp=`-_WEw2B5@S$KW?lk>(TiK66b3z@cP^uT2D`#USX# zcbsgsP-bQ&434Ot4%Z`_xl0^<1@rWErRUVRy^seSdLJ_lK55itsx^gvPiaW1wJ*_T zopEs(5JTbsDijzoX+fW^kwPlErkj33Lr({-?SB;t*;lJ z*fwT=6V!P3%&4+--fcG`bPTL3sZQ%LmXA`3s}sXNBFCbrQE_KRcMVNuF%`b0rh)81 zQ}GRk{1xWjRiU)RNAbHr#Tnah;6kJ&bpqEwpqZYh1>Nl9_%JhnoE6a}d%rwX%yl#e z>1ZELc1=JD?xq3YH>(sWSv|cG({S)Kyw2@#`Fr^ihYuWBg>9gv$~#=k{}MagKzrqa`4w}SV@texkR9rd@&wnouE%c-(aFU5O8_Qz|BLU)tnf&{W=Mo`<#R|WN z_uL8pyj$44>4HkxI3TspoW`Q0w1mw6L$1svyp%H9MU(y)__uY%wk0|@kpLNFags&;p@E1`8zk^fvJnasNt z9v_J%F?}zKM#gqS=n&*=3!$xRoXfjFn6 z7}YL+s;Tl^z(ow^c3u-?z~06zRW5aOVo2gA!LX|i?%8wNP39zX!|&u_SiwcJ!*amz zI|w^K*xrE6zW->bml`KvS-~&A+r5g;)qsv@Y7A>ZV1swqu22g`E z1Kb$wj02Wb0v7q@q_Wir4&wlH;28q;!ApX2-_^|4K)J&2f99ZPOx!cv%8o;X-1p@z z3xowmB%lnaHM@@(4wHUd3t&OO%l%$m^vp;Oru;v?@~?zcC6Jq&%U7i$Dk7pI4l(pg z9bYPQ&W}M2hh;Kw!uLL;+j%!0h$OK&R97y;JNsF<$9QHJ9VJ`qTh`BKuo`wR^<1Uj z{WrhU3{Mfdav1c!InQ9i#PETe{O|d1frBrL;SGJZ-4nn_ ze~3^fYL5o#VGeawi6W&jFztBqWo)#OBqRum1hG%kNobzLe@m#IG(POkiLZ&VueU|g zDBPRs;T`x&u+PWsa&L`LF6THbP!Tkg*-tPZnw)p^S(4hsHXzs=9rABe`! zFYY`C11sw9K3=bH1fL`!;n3&Dn>`MC#GsPq0OvY&VXtMxOfjDkx>Tx}CiO>;b==YW z+$sY;4!JG1pnYS3s?uNe+NTEacW}Xi1^)qeGc$4;Kd_)cFmOu!h&^4-^Qg;>!#+JS zlMd)mP6N0_pSmjTfW`vG-|{A^9fK6hjoWK2KmQ6d>k^>&E&}fAZ5t+V@G*KgT(v!d z!;QVY*hv+yS0Fc{%q9+o>nygKpk0XMy~U&knHeIW4G7D&2dTBvdBc$5c@ujg(4n;^Z52J zNN8+7fzuW!jPk&L((1YvsK%}z0~`+5dY)kT?JWoWH9Sazv1bW>v$;)~_^*&w6R8?>!es?1QsN(`^q7f*K|OZ9Uc+o0 z^}HxOplEcKIiTQ5!9-A%U8cnUFz`P$JSgaA!XP8%wMT*8}U8l`K_UTvJ1Cy4BVHdRcCem)PKb;oH%O#?A$Bt>h;t66=ltb(LX3{_2F>R1T=H-geHW%pd@zt(vJa&HItO~7tDM2NPP#9TU#tu@_B zVhv^%77BGx;^GB4ZHnc`>w`v>3O+)k#W@pJ6#gPHF|k&)V#LU&;EHNbyUH>ZHsOUz zaKU&P&3!wKl{{o%##0L=lb#kD_)2YtW%)d+aj-~}&W7D5o|l1z%@39`=Lcs%iY9pi zc9t3hn2M_A*uf2LJ>c{~#1ANCw2+z)Ab>Il$ z`7?j21$VK0J~|Lm{>tekQvUXGL}>{nTcOW(){wHvoKKbCX?dj@2h#Etm&56BJgvEbfV=s1 z9k%4r`}H6W-7yfeo}Axgels9gu;)lz#RywUxkuf(2>oH`7lX6#x4fF8)(NYUx`UXj zIt--+<2Lr9wzl+918HT3`A&g6{4%1GHCSj1nrWt)FhG|);%%*7w_5Lvxu$AB(<;H7 z;jp#|+QDJ1dWnO@=7-Z;+<1C)ozATKg&hax@}Q?o-_V&0JC@|6omTN(3Q!GLVG}i7 zNp)i_+goH=@$dOc9^JGhm)cU&|LwlkmHt%lnSH%(YZJX=ys=vS6Q3-J4Y`%#q zJylV4UZwPV`c7taosN5QN<_I#y;#<+SW&4|x;-qY>iT{>ux@$XRkduszTZuW$Ac1S zyScFmb(nP^nAl7XZ)`}(@#)2({7?!D6&&!tcL^ETvl=9ZRwvH5uYM)9 z^lqp+s41SYYE~ppkY#v5t2NqH4cp?2LrLhXO`mvZdVuTb=q@g+F6Xac5ETIx3WULo zd?bdyZl~`LR|F)aaVh(+VVDD(Cl2f=uqJwTx?Dqb+ ziP`~9*nkORh(oiNHXRQ=M z;av*;dmdT2WY%k`h9fuiyO#jwA3spg(L(|Qdx!YwNBkT;q@<)26p&J}^rwiHPae-# z=1d48w;_az$bxw=me|v9x1HqU2IDdPPQ>{WL(iJqG4-k}owE>k!dp|fpHsKz3qxCv zx0g$Ek0Fg6wA?%-luF=c7~=R+KQn><)cR|e&d$edW@gi=KFb#j*Oa! zfV7d^5`p}?A#iqmg?K!gaPC$L> z5c=V8*ru14-IVKzp>P1UQ=Bj~nKzyzrd zb`grSdXM(^lYSGw*Xp?&)iM$aAz~2+EcN**lsX>dqUJURK#2|u$KWutk&Cf;Xq9{` z5S$B96zR;LP3oCwoN|S>c9P? znY@=*7%gIjP9C$52-T}r#vu|gzE4Qw0>5L|uwjF^6Bh@V732)a>LHe+^LyUC(>A?v z$bO&JBU;YukF`Nbp6bs^oIhd%(RZaU`(%?V_b)%&r1cQph9@)Ygaq!&kL1Z~SWPaaQ;g_Mt#| zZeVg25uHY6q|8hHabN-|!nj_`o>));jCUAMf*q>ZaZ=grbu_5&jNB|1O;j=_O036+ znzNVT(hyB(JGV%H*jxN;G_Nga+4y|Oeq`!CceXB+(WoRd$4x4?M<>VNHF39fK**T$ z!T?a#&rS?HJa!YMuWkIxK>IMiIH7!v+tB6hAMv8N)~_GsAJ4?}$YOdrEvVzI z&J)?XE-W0KgyBR@ZQO-RLqA`dRP=~|b{^TXE|Jp%@KC#zW-}%G;t0&cRL2MRfrG~` z+QN`1o4`QJ1OBO9@PShZrX_xs&14Oj5-N)59g4 zSeL41{bnngQ;!BzFeibFRS@PsaCMY-w!bQoW7@mEE2>_E0J0tS5)+6wTv9@!I&87y zrfX!e&XK`R!to)W+ZSZ`oC=S`6}+0K`Pr!f$dyZEb_zBzO9wXI=oXrX0jK|srJ=nO zBDoJVK7t&9mpphLg+gBHGWnXb zSy>-n_r9!JQ2q9hum!DzN9v!Ih=8tx-WsYRX*NXyM|nV2TfBSt~ey zXIYgDnJ_FZEvO`>fUO}7-5n~cD);A7hlc> zR}MMBcwHj$@r~Yg34PD$5;^lSH;@9 zB?OeiWGaJj{?S3a%^8VTf$|s{4Pnn*cj&Cq1ycLh| zxGCYT76(e!9~HupmM0?;nuTaY6fhp>uNNXh@))SZ`>BF}j5q5bDCI>j$6^r$*Rpo% zG=>5lwX%}iQu=@vkfwAtL763N>rB<3KN!x}6%ZY!tE@h<<3Qjw^imM8U8Eqmt?b&c zS;VX$?eRQ-1v^d(a!Gzjb27zJ5~ty--ilB9)n>e~w*# zo;~>-#rz~5XSzk!wQT>q7}QtFtLW$APT%FstBGO4jQ$TrSbFQOB7ReSdob$mX}!9% zDi??m=%}!gWnhFIIjQ%@?ATJCe-ecq6M|V-*wk{1t!@Y$E-fmNUNTP+;>TA7_*}c0 zI89n7-4a3}Y{QC|d4GO$A&~8fqb7;f!mn1gA%nSZir)GZ$6;EhCSZ7q#D^}50Hlnx zNKEI6So>qblk0Lp-F7qt!oHac1rpu04#u{+3FFjQX^43}dySm77~U>gHC%B$G%{3L zk+e43U_8WhkbkWDqt*GN!L?|@@;bmoXaMw=3N(iHFwK7Z#S;WPd2*5c><(KA7>AM{ zTUG2$kQg1rKLrg{Y*c)IK($)~=50FL0hh7C7t+C4-#c|gsx>>n`@5F5MErS-kd%}J z7XsqKFpGo%X^;!j;S;uRTMV?T0Ybu1BhYUl{G;pb2x+(I zeD-x}HnaPuhWWRo*cucACfVlGOa{-7I`&$tMt8m^YC^gPfRIIC(7gs*XOxDovUPta zjQsD$%(e*`&>=o~Ehlt!#rC;pgDm>Ql?oA%%r!eZyJ=Ny1Ml*?o^08Qu&7bb0@|%^ z4&6COXhc+aSajfaOKc!e^qFrKqz3Q5oxQ{l&J(0@tQB@zyN&;Vn+(&vHzdU)`Im-EZSksx@97j0fd;Ip4#i{<0-fF zr_`_*tV;#%NQQkkzMo&ubSi_P5~Z@YH#d!+bLRDR=1o^lDlf8sq7KJ_fBfpkV2Fc6 zI=!Tvfl}{y9>opR4eQ?MXM!UoB?TQ##kHg!@8`3jx;kcj?`HxTu*Q!+4qe9p#`lv> z|6%@mfAZ%F$-u<5o>yJ0?CdWdyF8nzX?Z%IsGz;=7dLL(^A=`ixg@pfw$>P!Hdzdg zq%mV%W`3e~Ox@(q?A&<;lN%&095c#uv1U`RTiV_U3bd1?^OTrdf&Z9*ukgVCgaC46aV z=QgcSEJC{v&}|pUa3r~!R}y+s(cS^gh^v+9buQkkpxCvcR-r^EB1${bytmb2d5nB*!>=a<^2SLq1dH+$EE zCR*`_jStsI3?}>A{To-Vmd<&%k*NSDlPWKZrki!vaQEnD$$7BrOwaGW-r6FSKFfG>flJK z?co*>DQlkML?X7qFm8X*4UH*Fz`RTeRV%8aq#~WW_CUWMr z`wd&eV5-4T4jyhnI17tHpf+TLOWv~GcC!280PyzR#GvIZR9d{pHIp^`@(8#@9>Uf-*Eb0$;X+wp$$FeLCD_6no|P0!5D+H82(0vlZ} zl=dFpkj~rZrSAad|HK_E$ZeeDhWqDBSnOsM41$6Y;YavzgIXc{EGT!Y*>vCgCu_3N zjd_x$YJIi&eO-y4>bh>rHZ%SczkB!^WE5LZLRM)iuv@G>8VLx_j}C98dv1NTR&1Z1 zHgDr`+l*Y=x@Yvv@(^QZTO=Lj%h0KK+#Y^z6Gj)4Mu?59209ceg~F4&w{UCKEiIwXoIrQb5>=tm{Jhhlc0bOAo1sow z*vT)VKOQ-8NcheYGj&v(<{N!%@7^1K5`=jCXy#DLSA>*R51`jva-%XO-;!UIJ=ODwy=Ch?=M4wL1s%=_i|0D8 zn~Uwmvs2CJdWW+YmdTyXP3vo^J%+>0kppX+TZ%cWhI&iSv3KW2+eiCz*kJ;Mg6UBv zA9*p!HWMxs#>u=c7qkWaNQtA%sbW0Jw-<9cC<+MM2lr1MjH38SN?hVuHKkbFSuqZ=g_Tv zugdV?E1X}EeJeTE`9=it1p+{@Tt4a#Q;%?yq6Acqaz8KhiAZ&QB^==Sxb{n+ zT`ap%H&8!auO2{*EdM(Gnfoh|xF}XQ))@nQtY;o7>QMnk1`lIc;m>ypzm8EkEE}Si z=-Ztnq|Z4Y>)uRVVND@9qrJB`J0PA;xJ<<0zojg=?_YTDl897j#z-K>@>0= znj8g1wK?t-#PGa63p#oV)t83)z|(cw@=-_N@*aP_U0o$3t-6kW$nv&dZ-(G`?}mAL zibiCmmVRBpadRY`NmJ@urcjb0o2XWQoyZM~WmC11=xp=9F!~CDm z0Ywn>?4H%!5Bs=0#iWePc199RGK2Q4;AAk;7akrc?GVhzKR!N=(0rTN1rOl5pPKMg zd0E9Li#ll~6EunzF(64(2JtIZ8v05tEzIWCxtvPL#w}-ml$|PLRlHrNANCO@DU)yOJ+6X;ND7S* zk;Ysw8Lf7;I2+(@Jc&XT%w;JK{}K*yI!;9+HD)Z@IXN-schGlJSc0olTiije-u~PJ zcRBvywW=MEZz=m>U)c{_{*2Zan-57xdg=St`GSlTQ~l!L8>fSnv`9cB^Q%v22e;iR zG^G|w&Xt`jA3#(rb&fn+YEg{RbvTj5_L$uPPDcJ?<;{mPaSy-tY>Uv&(1)QE{ZBpo zY>T8<@18wm_y%X^$@{q&ASem{m0e{Rq4tWa+sWpBTPZBd{dRHao#FFRJs!Srq1|Tj zwo{PN{pw{IT~ca+`EWSoPyMDjG936$6=;h?RD&>bvYu@1$Bp_)a&yfUM9l zhy;|>o^4)Y-QK!|a&sm_$EMP*D<6Z;Wncr{E^DX0vdWK_Q}C@{T-VR+vgZH|`c z?%`cn(<{;FJsIueewa^IY<*sjEk;eP(++lNu|RmORDq6w44~%>GpbZL>s?rtvK(hx zu_Wxf0KBeRcq=#S59d1Cf5Wmw3V*a^^`7++`^}t`m5J9O0T@Qvl`wi(kPYXN@z%I`y^N+@VNu++<8weB zhnvMXfBAYb+DSQhG@cf)G8q|)Y%q}dYj2I+IOFKth7JU z1WO_$ZtLrBnbQq*x4uq??%#OUJIx=yOk#38o&wCFD~HchvU_N{s`GR6n{DQ1AvQOU zKDX*0#x5mw?lvW{Wm!+Ku`otly@sY@w$oW(=!?03fQYfVkncSj-h6kJg@9obA_WVoSghA6HIJgt) zm;I9t)2ZwSZTsIuHB$171I64dwN`@-t`liYM+XNb3p&d>5a9IGxl5TV-*hLk;qZ97 z9b%%4>QZ?I5v3vs-RcuhxFcgW7%X=xbXC+-QHac@yO6F$ z&L?X-FFmfUB$4f|FPJAr)uPqMEMzkLadbJ>B-Zh8i8neNzyW_oWIM^0RN?I4PI!%+ zG@v7Fw*ZXbQj%am|B_o_v_lQxW#b~{pyc`?r=qN)rEMDj8yLjjKYzDieIg1xK^z}x ztneFSnNaVMUo}c5I{mfwbsOtX&VU)CeQ2R?es%WpeSg%##t;YrBfI)sEp@Ncc%p72 z1!Ui)cKvS>HzkQ-W5?L8$A^vT*|eI6t(#WUtnNl&ExXq`&#u!b7s9HxXf?CUp)-Cs zMkWqhF<5@4_+*<^{b}LYIU?xMudwA&aE!q6a zPjFr)pbC4O?!XV3#aSx{D9YBApqsUo$+6G!;fSsJ{{l!S#%0)3i_A%bb$8H+%0 z!Dd3kkyhXwmpT31h@ZXirxF3iaKRWX2vw@@3a(6e3FIOUrb8tMAptI~t1ivekgPAd z!QBl+gF!_g-pf&bTXB{~^GC;^e&}*NJ8i7QCmFM-?XT{~_b_Q5s$ahq@gIqixWJ(y zn^zWbmm-hZQBpShe>|O4P#w{_t#NmPySoPn9w1n-;O@bK>%!gLCAho0J1e+5EZp6F zaoPKvd-}Dj`k||P&RPE$;~S<*+hRNeE1F*I{q)K~l2ULt4zsxqqm-tL+NiPw%tE|K zxeZ4BhDHCXt$6rXjJ6$P)oQqu{V|aMPCokFnDGhZ4O$h>#iM`!UYmsIVZ|p?ZYU@? zKZfrPOFGyj{hIZ%o=|-KsWr;la4>~p{uc#?Ey(8GWI`&GNX1OV6+o{c@BoG!RbwIG`{8ev1ApLPl5qG(fRUKif&E(ZC-xh#wO5$r` zay?Ce4rsa5>^9(b+Y#arM3&9p(y3VdxKdNcj@&jYLCNN^Qhox(b}!o`Y&vX0Z%9b= z*w`HLnFcMF0qXaZO&UXR&Fj{ zvR$z+|5Lgbaa0o<`vC)HfJ%*ohw}_@lUs^Kf7Gv~GP@lSN-X%hNr3(6wQ;uzI{rAG zyL22D>TpwUr!FV?P{S+;QLYQ1P_G%EN=`1EhrgnxIil#sD}HZ|T+ zsSU?CM1axd*>_nZ$vuTiRZQq#iGxTI?bjDy_4^qRk59U=Y+cLHFDymdIn05cM&CCt zlkhEc>ad>N5M~+0lA9zFmH;Qs87SQ11_zxKeueaKGwnYlNE&uF^oT08mNRu+nTx9z z81u-Q+1KQc(731X_fFW+tERW5~b@>U;CLUo9()tAyEb2114 zS7QL-H4V_=Lz_~Q4q$t?yR~N%lmmMAv7>RDi1I$`f^|q%>;~hkTwXuIX@WFgxK}LA zjCWtUOfiNjPqK#;(ZhEJirUT_B)IMPpfuup<+RVi@k6$*yZC|B;oT;{ z&>z5cM`SRb;#0X+I4ee=#XgUXyNv@^ZdI}m-q(-q?x&0f15qyRh- z;qr=0_t>{`@Ps}L^=`=;bdsrpCt#{6{ogZE!8JN-YBaUJ8xb=B|25G*AtUBi{_v&H zo##IL)yd8@Go&sZbc9RkM_sFPWSCd>DarLtC~heuS}#^=eTHqE`HzD@#3AGa zwg#aW3sO4cq@g-Uvp?+DL}+S@4=&X!=@}Tz8rX7RPsp;F2}%DWzxZcl`3)JT^VqDC z0M;R2r?z+y)7w1nPY7^uU>zuJAIb`zH|}7*KR|hMQG0|ot}`YhaXJ~~z_?Dj{KNC; z#lu97+7L$a$)Pk@%@pBXdQkyqIbpmc;+{+I0l3>ij!KGO+#Ce-NTVjOZ*?%`z4Vn> z&}5ec9yT{YZ2r+C+=I4&UQBL6dATdv@38-)2W|aD@Qa|Nq!j$L*;Gn2H8qj@M-%gL za&jUCFzBiHmSR%clS1Yg!kFWQ87wjRuPnHPWSzR9unlT(bFPpiE00?;m03C8{*dA9 z-uOMvQgLx}v@@9PJr%8pYYTR_^EbYTG#SJr{&L!^0jicudze161xJZ%$iaE949IlY zCQ9T?z6u|-rP3D7Qhm(=ACGwUOiR+!LHLAP2)*kll2_F@{${@!9Lf7pzBl~V}!CNuS1 zavfa!d;0P(_En<>;r`>24#IPh-AI4O?AWRqnR+(}h*a<(f%cKl0;h%(Hzg*JtG+ z7W6*;G=6}Gp8?WtOnAS(j7)ql3!Z!szwo_0zE{)Jf4<4i6-kw6x}EI0wVGf3bodK2 z5ot6?KxKTj{h==^qa|^_hgh)YBGm5SBr3FV1GDutw8S?~n|w>!)AkSVLcgUvf1w~N z8(VBdOn*AY5MEGi#@(YQtUbA=+q&&HjE}Ru?a$mP`BxkXsfuS{a38XJ-@2|X@8lo_ zhlx(Iit`C7Kf;tm>fJ5t)!m{!0=xIokqkQsgi$ILYGRFG}2?&efzs51BYF*;g zf*XDsFAK6-8OGMtr={Wg7c+dw6)7y*B+>8g=6w8HZFXPRe3skqlm+zuzSELw1M-%R<75>6-tjtSptiGo^nK^wXw$;__wt9kK9@Chn`ejf zMP{u(J@|aK^sC?#6|J@rFF+I;|2!auVYo73o-*8N<*Ks;Qhb_f!GL@kU=psT7JWY z3C-TE<@w5mV^kT$x+{Z*p+ydEMB%~XF{~GHm{nN_z-z=W`c8={%DAqr@y#CJ&4Y;y zVpq>k-P_*H7a2_X{YR}fi&!4Q!AC4O#lc<#-X!xodFwO#&K4&+d?s+W$-&m%(T%*7 z946e4&MHjd=ru4bj3pSHq|e+Vx`C3f>8u*0P%|Lbt>GNEwAyb$GDlqFKOn13DtJvgF882Yt^@`<2THo zDXREVqOD2D{KfaOa-!3aZiOJZ^lwJSBwpF3fn&`7}2y`w<*2QgDc3HE^uK zckkzjyT!5LF4b=Lflw{?<1Z5>j8!Nh@AJb|S~&bReTzdm7ZDfSf(jY;GfS^gpiVYC zUw@Y@9y#l=xr)s3hJ0$ppj46%BT$-=lkX6oue}|9#r4+7#0n!_pb_8o=>eAu97^?y zZn1*P-Q18>*uN+C!}v>I(97;iwEG)r!$o#_K7`GRJflz6XWlUp#e3B4h2ef`4ACPP zp)u5tP2zZEHrtg~R`1(~sMmV8_iLRA&}=Fjm3Q_2bSV%*w4}HT7FpK~e66)PUNYE} zRRKPAm(_W>Z)2j<6@1rFF(}tJknD1Tjq1CT>K^^i>-B*;tY}X=BTXE5!ho;d&^D{U zV*;>KD0pOzw0BJAbGHTK51eyras)Q?DO9p);2aSOU9Eq|%W>O!G%frLIAd;_KM1u% zw|#(&RK=SX<>DgZ=PuKD%nk|wgIE)E5ei>dz7$;M@SD8^0AGTLnU#&i!jq;TWvS7Q zVV;>2$cx_L6w_SRYyeaE_^L{pYHFJpU#~|(hodqCJT0Wj_aGjlW%w(9$i*JBb-nAh zSO1*Y8<-~c4}y2k=fJV>@gmJhTFRzcvUk$16#LC)`b>No@`p!uaJ%L6W?bI`! zp#;C^IAW2$UX-&Qbt~!Au7#NSS_Z1T?bzx3Zl|iG1W6d_dC^AqDKj^(*+Nq=b8+3K z=#I;C9cMfzIHEcUe1x|bJwLNef(W-2V0i~qbaw8EV~Cy*HfI-5&u%?ZLRR&eAaiK% zt&JXth^6?~&r^EXqXv5UB^l{xnV>U9pMxSNXilQbmAx$s+C;M%aVH}!ckt66kX^6( zcj>EMU{&ZtxcbBgcJptQ65~#_D`x*1X}6hIQZxM|xNxx=TljKN##Uhyg_eA))o&IF zPpoz~G=ch=#d|Q;r9JSYj z0xHM>_ab0wk2b_<^v6Te%UcAo%nMhR2Y+Q4<;hR!XOs#GM^J^7 z)1n`bAuKtr?f0o7H7u#8nII$w|E$;t@$R#}TrMkJ@EQ-B-^G4E_C2Mk{+Ny?w43*{ zU4akZnb&@h0Zajx%^aS_(Wlkgm96l$qOQ$Q+^BB38~OCv#fxFtO9|5JDG!OLBe(y# ztLd710~-ZN-O>Z>Y==L&J>z6}yUdI$G%MkhoA#|0OaINCC{%m_ECzL$WA-!_%T`)7 z=X|+H!0dSF>#(q-p13`jH-Lk>>d`dp7tVcsA*Qajkp8EnmtyZ4N`QI$D7j zX>vX~9i)s(1U`6+bPA*Xc|Q*9uPG8&lu>%dkYQRgu&GDB${!ujkA71LK~ERb*J=ir zq5DjhR@QSPcgPdYQN+n_7vd)9;<~lVk)+|13)fwAKt0E;DW8CJZx$XZ$3y;9P9-Vb zgamM^OfL(B-u`LszP}h1@!3@0+gjsPX9i#7M*bw@va(1BgVk!UR-1jdTI<^v-&n3( zBEs4+`AV48XQ3b;4(JeKS;9`R*Cc^K!$W8dnJ#P3B4s0n`%r_#`LP8Bb%hN}0hcY^ zs(ay1hcLWTE6DS?&o2IU`ChCbUG3Y*iiV_CvI2L?#9?% zV#W{2k_Fj}iXHrdQ8RW38DfyTV$9xU8@UlF4%YsF{uAj8%eHkFvV+&Wr3zVODJco} zgxsteSktPjVB(g-;7>jPda+*wWo0^*KD{ym(|n_hrl(9J@tkyu?wcAFhMN>`s@zE=#G z)!PT;a{oGnN4$3f3kE;%FmK|c!(yX#_R)0z0Cg_EO9=^rrQp2CR-4ZoHSzpq9^$f z884IHj!wwsW7u*5O)F27g-iRJ9a`lT?P#HBY-`3u>Mqi#eSJ0v6!_wLy5RXV-cjNb ziHH)Vc)1~>7G{!vHLou|3;ivBSzjFP{%qd-YEa+;KlRIaL5_@IA^X>|$J%Nn+`vBM zvrlh(gfcG3sJ9oS=kZA7a9GK3ybamMkmdQHfN|TK;XCc8{|PBMUE<~zW@K%1TFM?6 zjyl0)q4;jrriCns!p&`U=Rw8dZ|MS;$j8ms=j#pWo=VlLCZ#@}`BGl;x&?9&C2ls` zjg&>R2yAza9Y&0swOv%pbAK0y*+N8oOWJltuAVTr(>AO+v`3VmtRG_YZgm}d$Z5gp zz=4JT$pU7!JaJHk5FUK?Heh`Xx>0v4$qWS9$C~T!`eOqJj?$ryj)NJ>&Zy8&GQ9#5n zf6uSFOfsx}W|jxN0O>xXCr8^GuQ3qA z9GHXK!4l*|s@m)qkCj++{*7*nw|}H5Q8>Vgeao!fJPPdJg6Kn7VL{3%Cs%(-GX5me zp*Zioxf+J@yS&)Mi>=GH3dTKS9wH24k>b@$c^I`YP^azL;|C$@UwzZfq^58F-fML0 z<^}0|v=P!$_uCVwd|>lTS;5`$1Y*Sh@*`K-lUf2cz#Mg( zHceOfQ|3rFF?McN+6?@uasagWzGie_>$|5;9}kBfN;N zkNu7m6B7^kLg~i-XhVKLA1EGx;~1ZY{*#zCgAT(_APrAJ%Rf%sV|`l1Ub(Z+SFsdJCfM`?$F>HFkFTGjmOi`!8u}d;2)m-u-YK z_QdZ5OUQt~8Bg2kAmo)o|E{=e2c-$ZteM{m3K5|hrI+q#)hnvvKKcj4n@DbXLbDxk z;VeL()mi+w#Tr0o+`zU2pLNL6@r@%)oN~(0_I2+Vn)A9BWX{-d7ilVR%<%R}OgMJH z2#b~X2SaO9BZ5WqISqu!RHU<^y?_b-n2*P4^z7Ahj?c^b9i&i_u7C)ot+ZF9|lMucX}MXHd;0qPo@0Bz6+8rp?yw(SG7=%jAQ_w18$O- zCvfpg{M{QLu~<%vi;I5$e4T^WrJ5pcT806XfC2olA>vsPQHq@v#`4Lv0+qnePK5xd zR&QMJkJq8Ba!HLW1l0Dr|{`msjTpE$pFf)`=n_GaZq$VYpa0 z@sF?C;r?|irjCm6KYaS!FtR^39*dvTEH(Glt=$T6uJtG{PNo6F~lg86O9 zRlJ`xm5$@RI{+E(m_|sjsby2EjmCBdGJ4U$ERl+5*@JmD_3}gTqb4PS-%7cdZevlj zQbEQx4iZgzxFi;=6O1+NPJ<5-yG=#|Qc{j5=+*BB)A4hpO3u<4=^twv9S;|CZprq6 zuzV;CHMZoCPfFWyW?4hvy(YQ`YrQqQWj9uXEq`gp!#l&qP>7Hr`l&hpi8gbE#D`Bx za=;K(e_}#tbj%U&kL4=gO;!`n*uVI~)|xe>yB@`8lPrw-81GjB1hH3p<^we^#waf? z{fC*@UI!klVsM1|aU{9ZnBhnKSCH%ITkk8#u%(S&n=j(H&u{#19oo5+RYt*hV5F<& z{nee1Mc<<9E~r58^ZQd4?Bs)!tJe$mrtTznXTM(WrQ((12JLq!t2=7fy^X|Y?5)$LU)0>PZ==RV(>kX^uvo&tro|AL)o;S-|MA@S&+x&seN@2H?!ACOY zjm@w~d2@Y(w};j7m*vLn8BV~(Lo!>}>;B>fs*-nKsi#&2P^8K0>jf&EeLPG^L+xro zhWh2rxbNkRW(kNUL2`($c3dI@^!#VPSPusj2P1R67Rw5D-Do!k{HUppFVa!J6f_FI z#4K3taahZSb4PL5iZnpWS@{?N=HMA4c3}nfp5KtYHm%!h`kIEOYEo>kmQ5_%E3ccY z_Ktk<3;qS7%|J}fKD?2A;@ zsK8)LlvHeBiUSK(KdvVt?O4`28(8ZVrD*;crPi4=SDs;g+G(TDUPjLn=_Zb`;pyqw zboTz~HrPI1`g*-g)EmSu47#4+`Eysk?v2E%TZ5Fw2$q>T52ow>R2}?#Ak(;Djgr2^ zKB5 zk}+n^ejGe82xApbpm|7u)7reCkjqp8oE>W9cs~M31SDj_XRyNO_Mu>xV@L#I$V9+f zf#?cp?2!4uEPj_iN7H#**piVMx(eRjR2BpIlmnkk2Ag0Md5mc+{H)1XWBYHDI|K01 z4)5@iu=TytvK*P^Z(Wu1wrXP{RhWR&*(^`%<5^<>#8e(s&i<7?wDGbFJkNy-T=4dZ z37w*+GTe^?pZC#tLYW_N3{F5q{h#gcM<>uglHIfTya`y;DEuAB+`U0a5aaGJ~34@rrCwOR$C!8kSG9SdQQ zyVp_(i@~{&b<8n|vQsUkv0O`tK?(^AVDxGjD;lo_*LEWjkCcD~IUE@&E&wLPCxQ2> z1f?Di+1&SevZ2FQXKwwMhPr+6)K;BtHb(#RixlK)?r9h*)|+K;=4VXA>6M0k)!+wt znDkFHMY+$+MD$NN6h-+MX@wX$xd6N}4m~&tbh5AZ#HgNU5Dm11iF6J1U4C`ETx9p>Sp-9|ahL zyQ(;*rsV~6@(Svg;FE5kJ}5rY<#^!r+4qvj1LU$~cy@@lX%m&>^B9&Z&cv&UrLqyq zdp>E3ng%L5Xi?Ka;}bwN@^#-#SWV&p+-<*IzbojsKwe{w9zTdk<~ia(@noQ)1$_h{ zPNk9ilNhv=$Y4%ZZQPnPyDXp8jhk$Gzd609Ntunv`f5Gc81+0q(yFRQ0>QtJ6u zQu^#<6|^hq7#LWd%!_O17@VR;BUV1$1UFS)2togiC9VacDJu2f-;XBx&4`ZrCqmxI zfq^=1J}qAlDqoEk9!xx4FPBObAcpcwjW>W{DheGCxN~u7+8u4NUy2GD|4g+gsGCnKo zocXX?`>Xa)F5*2NY2NuNotC~p_`rEsA4A$iM3i`+8n0EPGUWl}&&Q?qQs;$xg%gu5 zd86s)u5*1k8#APFi9}9J(1+W%rWaHv6)Y`ze_~+FQ*^ zUD@t82B!_lO1hwx^L6!Agt5F;m9D9<$!C4d(z~`Hz@=&U!|f^o%sZY;7;mTb(Y?%F zEpXYu>*jD#Ree4X@4pMHH=&6)!J9}I=}-3*8w)$1rV2;h;aX8`En&BQ`c>KaGmbx3 z2Tx)nzJQRE)7!qhY3oOz67HIWvUe+gy}{lwnR-%tS{hK(WS54Kpj=yLXUkF#OFRuF zCo@tkbAudeEAhyYugC3{0i);5+^nFS_Huq^vI`zLh;kG6$JM`KLwH%;+FA*yj^VEX zpS)-kC^&=Sq|{^++s^X#{LaS4RgKT2$Q#=vTXHuPlF^gUlk9|h(f&ZjEo>!%Ps@iP zsiZc*BOK`>bL9Cf5OupTqF+iehqT%I-J>ZH*oWvO(dXZlJ`{}>Wy#srheW{by4r}y zWk-gYl|Y)p?{*SZ)O1jC0lk6+te~ZRNY!8?5nJ%&- zwE2CvC6L`&Afm5qMQ!gcUBaOvMRO}RlpH^BNzCDOBd+qQbwa30&ANAe?1?{laQn>M zKY*Zk#AUL0j!nD4^|d>{6C`TqC0S$x^QJiNyJ*TOtvClVNcDbknwj>zAX`v^E6<$I z9soxFY{oq;tEHGLLCN8<`6+mrB%h5%hCf@Ua>&jx39(DwO6YG#e9XP1exS<3vw&N! zYyE;JFA{Cw&4?!tt<7hX9fwws^ZNT)%5J<+?->)vVhTj`~OzB9o<~yjIFGW%pq3FkblQp;)2KZn2gl z5m?-yb(IE63GbU{OCx&HyCQHQfai>uI$LXYxr~p>3VkG-VyF;Su^xoq^!|9Fc!v*( z9Qulc5=a*f?uMe^5RHPiJL)4t7{kcUSS_M8`1w74QVl<}K=B$O{IGEutA)hAf z_i4X_s4AKTm<)J0y@)AXES|3H$vHWAjzE)Gj-)K0$Xjnl1<2!KhLj3V_;qJsQ7BSa zvu;A}N|f;Xz9c3@%}RczT!H9X*T)qpwB!p|(vNDstiW@-;#P|91Eynme4U(OMHCSw z1j!?n>RtBX!`cgx%u6AoJN3>f@UqbEIxhIqOBq=c!V)%Z#TXWq{f+vqr!-|VdGojX zJ=36w2DCc$L-K8w@5khEFWMeI0%*PPJShcbl>KVx64ZoEem?=}Wkyh5*##eiJwTRC zYR0gB`&t9M9rC6_P5yK1L_%_~PTK1E3_22!Bv`cJD2gH!;bb>?UJdCLPAsPRQmL;o zDSd)vzS6SExqZF1t64apbMTveyAeo7Uoe z*YSJyo7VLVmc}Q_{1v1Z;t)F}ZK%Qu$ncr5|M?`o8u0yGgofOwsd#JpLMVkIRxZ}8 zm7{w9X;dB+vWs>jTlem^U73=VMz=*o%5gKF6_{$X6-zK7)J?UP%z2yL?INIVo<8vE znrc?bcFA2MHTmfICDD#79e4buopJIErH4qn+h2&$XaXT2=)~7H1 zYw|h4qHh37wztXLdZYIIci@jGPXgu^(2V71l(X46n5%lm2^ee?XK;L`k6oIRkN`z$ zSWExw>x+CkOIbvrvdr*^bsRT5+L4;NHh34k;uC?dEIAn1QTt)fZYWh-}$RAQrL2{GQEyzJlmabGo@XPPiOh#fanT zb8rERNW%nrdoN`AHf~Dcq3GtU?>6^hms(Twg&`&ciqmjbFV;H=y~~jJ?1^S1(uC*nkDxLTPlFXH<_ zM4Dt#HfaJ}=QD9Vs!naWf4btn_6KO#RE0}N8;7`%W&Y!jcUY}1@ADkbA)ND(p7Gt8e=ZgBtgfSE{~#bQt6(0R zoX8M#zmd=IxkfUF$P#`en;<*}hzD8|`GkJ`H{$@d?mI+vm8@^Ij$4pU)w63v{H;uT ze7&P9ydSU(B}jpnbdy^Tai|QXYfHdvp9{;T$3}7*Qm=C^SB(#~4cg1UV!6Za8Ywvu znPw?zybK8FIHzsEPK8DAih04$i1f@Ng$o@sGa?m$ImSl(W?PZW5NA(NI0p-QWR3w^ z0=9KILbq!L*qi-gJblub2>E5X-oRc$Zx#_hbk3}qe)HQf zqFeT&IB;l{>6ZS%UscN#FlMYwT9P4Z*9Lh@@s`gKx)9THZz=q$vhG@%1Oe*23UlN5Puyz?S#t#U?Rh)rXrnHX6CWi=>@$H;ir9F_5!;;*GOq z)uHU^uCerOONOvQ0^Zlx1=@5>`L}*Y)lOOev?h>)JRP)-M+tc9vIW8o~_&j*F8VI(e_nK6tWVcuk6A6*omp zb$eiVimi@ZWDQaO=(x18KSH2WF`g2k%Gs6}5)4=}RH_R+@1Qw$Z&(PbXydp(4%7*~ z_F<}8dXHDq+j;6v0&BfWk7S}r~1*1>z-$#->5}=n$E+^W^E%1$Z_RqIvmytvNb96c1 zptWNfiqRklc;iYMZnm4hQ(PDU!m~Sk*yT!F1Q`YL1?hkUl9hV z^sbQ?)r(eL1EB*kTHE;e0&+FGH5GuJB8Tn+E|R9&?>`oVDB8;KAMEsnIf=TnIliTSn)$F1<8oF0ppbZr-0 z5T{DxGm8ohKcdq1VQ)saRe$1R2>vgB|5@4P5U-tCkmnL9i^!6c$pqH7EW%~{Y_p== zy50E0ute|gKZ&!B{G*t*V}?5E(;dCO6QUhCP1OeYzEvq~TNKIOQ3zExQ09 zD7wsIOKN~gW$Z_rVz1<7nLA=!{}hO6(DaK`Ztb^UXiCN651jw~U_Y6_n7Q1lhxvT7 zNCC)W5>;NwGh~$Z0|=SE0eS^ESdA@`(apjlM44Av-}DzP%CSr!(NR^3gH6PWDfm^@ zewj3VI{0x)B<_;fi{iu~&ABpeV-9)U_|eZ0jf}Ng_s7ZjJR~&5@LSB6x;45riPIQalUTv*V^mm`IRKNURh270ad*J zb*J?xkP8TSp073uc|O3nBMV+r1VC7a-dzRD$yF$@0v=(&5O!ckH{KSS*^GdjnH@}Vw|8GOCylSYzMP>h<&XXIEMf_HD`I1F+B!&j%63mNM{VW`{ zQk`hH5s{t?l!V#8ZP4U9!O9MhAJ;CGr;kAC^(kR`gX_o?V7 ze-^>ONeK9hnuJZAI46n<0h#sRM!6!hJs*yNaDX_mOauP3<^8cKDcLG1{;Yo|9ql3B zK?4?ze#Nbl->e^5$Erij#AOA%IF51jb+_7n&zbkHJ!gL1SyR-w z6lrrAdV%s5Fy@GVm?N9?F|ykzLIF4RAU3jpF3hbih;pAuh5d3hofey0HprVw!TY;8 zAZ&qMSf4(;RLFMJpqgJhtr9 zRzLqnr5D{xER>I$6{wp!6GW*^B&*5q%hPiIb}ck%$i}WC9|)L}M>HLsuEhvWJ1n~W z+pJJpR$pm-8ynnH{WfvI_K{d_MU>R{Dgsj~lV*s@d}Vi<~e6S&#Sm=nCng zFokEh@Plq`;J~qvxL|c)8?=~aW0Vnqd8O6iG@ts#E(GHvW+;pX>fT zmZ4bMzSR-*tiI9>#`Rgrt1wt>ef(JzAe8X7Oca>yS?!}6#U!X&iRO%3M^HqWt@A^a z-rB%lD7O2+|K2Cjzq=+>{_n4_p07Jcle*4xlUK2FmENO~#_ z=E967=y<#yF3hIc7VyrryBgM)0tF6ZnFaS_;Ne1gi7a0#5$jad#BF9STsFPx@CM0U zh8Hh;H1FR_PF+(jeBaA>A5sLw_Eay5i=2u#AEpmGEM=lApSSlzi{*2KPe)pAri8Ir?Vl z!B3hkk59mvB=WJ-^KkbUOlX2<;B4NdJq>QeUvHzP&gJ zfpj?UDq^KR?uPU#r~)Xptcf`z^;F#se^!iCtytTl4%N^+-;+*uo7JQ+2wM-UFeA&x$orRi-n+3hIu-kSUp;LU{ayWF`(+X$)*mAx5bMcY5x$%9hh5X(jIl@sb9H~(3FXvO zhg=5J)k4wh4f74&4xMj3&DDj|UvAecZnZiztXaxM>d)SVxH;ImUrscAo^PfWHMCgV zUmLy}V%>esSxGFT5HywIc~_cY z3FYk)a_`sk)Y=8}mcY+w#y4F?k)p-OdV5S+q85G_?m*QsdG4le+LWJ9(`+c!Sq_O- z*)5(0{pjvfkJHdrnMixsBF`61&eGB|Ia}dHu$o+TsQrt{eci1=mi~p#RkC>SDo_CR zVxuCl_TcKkAf}W>O#qOkknRCsn>jABvp)a$SMgYKGg?W=TR`%M>rPzkKP3-aIW**{ zV-%%jk`<^3PqI9gGaL$4O;}S5{-@LiJxcUf{M^Yg#gYx>!z-$n7Ny+k$y#5p(l$LP z^j7ox9a*xV36M-}Rk=&$Z647m&Q=4kr5?{$oUVS`T9L9RHI<1j82)&L1+OI5b`@~N z;+4XF3nMs3zQ7u6O2p|SZNjwVc#4m1A&T+?Q_D&LNZ zP1N#CUZtM+x9Qzo6B&VS%~BQZ!oM)7cdwSoxdTEl5@ZqFcec{5Fl2r?0`d8B`cjJ~ z{sKJztPYO6S5Bzmn8F4uLsE4V6-{(@DU#Fam~J6UV6X++GQ=Y|MC~E$6wBl1EV_&b zIny*WmWxfOqP3ZeEj7lg&;o!C(tt~*pgD?6_Q(7EOSYsXGoD0zGIK{*O8ZcAdl;;6 z2s1H`H0#)cI&C$phIw^WrP(yMk)SS;jw3Y8xIB9Gzb@ z{+S~0Z_nh{|8vHjs(+t4+g`NYCiQszdl|(?jyoIF|mcZYL03cpWx-wsc(#CT&8ed6{83f9*osbBp`;3j_TR-zWxDnNm1LcUr9n0Y+I){fhB1jBV zZ;nY=c)ff&=R8K&&MOY6~(JP z_~4N@=|+G~5`IJvtrE27xP*JSFN(y{zw5jzM~g1wUUg8vZrrq{Wq-db zuGYqd3Q*P6PTLtKm8D#rw?mKSnE;Lo^7s!0N*Mg0Zo;H()a@RnxzoV~QpbNfTUA`m z$7~U#*GvJ9$}b9pqBKD$2;X-$wIxznxUD=rlJ9!Mp2h^{LCGT9>Y-9GSvtug6C}>^aIx8(F$%fs~AC z73YaYGf*U7P04iif^wzAO8HN>u9f3DzI9{#HV51WT1~2Lyp!OT?@q%nePX<(*c2J` zn%WPP2XL}H>PbkNO-D*64dnesrcE_?#kHqh(Fe`AWEpjJn*Z`t0_$%Ap*~CI@-VS1 z5n4U;s@bH`Mz9g}{@$ph(=|*coe=9UL#_WY4V)ll?F&YOPIRQZLg-SMWJ8YlWxrMUn+Z7XVXVoxG?`F{((dU&HX)8pE0^ZHBp_f#C5eje0_$=? zh%+q^ZKQs8NjPUbv=2bq<;OePg>AY$vX%Bnm2&4^)gFjTrcmT^tJ^q8h zFgkuRg7U-yL+3rMCZNlwsKZJo0d8R67i0w@!t&7 zN`XZ6Eh(5JQfN4=>D(^EfOH4Ucr08U!u-9R8~p~{I~>x#9IpLAYk1ZChz#Rz5}X$H z<&6Vz3U>#mNB-~0qPuW|fl*^yp|pcW`*cg^Pb{AAYg{GkEtHBJPKECi9d^D}0P){q z`u}?GYTrsTprcOJpMImnml}nbGnz>|jzZ>txEZS~_Y9@vEJ-jraAS zGidxXYqC$HkPQlLIWOT>k2rQxH)}vV3|F(;+^M5~N zw&9_6*`5DIRb-7rc!CQcpfJ-ov91$URx4O!O6qJnEag1dIbv=M2FdyxpH+T8q!Ij* z8GRMQPBb3polTYGCxnhQylbt!O#K~asLc(pbj+-=O}hCz<3SdVGzFk*L7_re< z)X}43MC>Yvk~Pq=&6v|sBt0AM=>qRj4hOH*B;+GlM*2UQRxFe zPBi)VQ?X2Ylq8WXHI68w=b{!1zO@PjMKa>OA;52K446?@H` zMZLI&V7%s)xd+53vO$jc*3cV~Klv2Xx7$QpD6INf0V4|QG>Fgxw6HW)yq~K8!o1c0@_TjhAUif#F%Vc!`j4H(T5Dt{1TYSKCjN47 zbO1tYdf|&{Nbx&`L`avnz!>P2P&@uCnziH%3?l%Vdt9#@M}4DYa&8v&fAxoE=De!E zB8P!!KbNXE)Sg#FgX!75z5}~IJo(bdJdQoSx_|Cz*4OVnY~!AL-1nU&o)h9w+P^$zr;U>O7uSvM`oX4=!_~+hy9;=MF+Gh;C&wB%{~Je{3I#fuXd4|HQ7_L z?w{T1r#mr(EjbX>N}*i0Q*MSlMm^H7fs_A07h-(Gq*3)o*~2#pf8VA4#%4F-rQk20 zHB1JBGtpT*e=ZYOw|N0mFTICJ?^oGQm#Va`XXD)BHzWi8IUN5()ayWh+f2|`>=r&* zS>hLLbh~r1D-^z3FHHrJeDr8M)vI?h8_~PvKdBh@Y6)K>Bgs<2_sF#wu-`-)+?Aw; z8C+3l&Y?BMC;Q28xl31{H;|eyYJu$ zojfBsBuYw(7ES)v&81()TMq!> zZ4j*J42`Wo*KfuiJst`u5#es%c~p$4NQ263+43b0i!?9y60 z+jkN~Gh2@v$vWP6FJ1pcbQc_=nG1-b{Q*GYv1JU64iF=yuh`h4Bv(i|*PJZ)&mMIa znHIrHNSHg`O#aS+)Qgz{p#t2;j?bm;C;%et4bYaegyFfZX$Ty^v%2PbcWOq4=NJh^ zIjyIwd3dsbp7dB@9uj@QyCa)Nwl5=l=h;ku{5}Dh|MM%MLn0+2yIXEYusd~Wsil&q z-Znj)-OOq0G^}jIx#{3t22g8VTFlP3lc7nxD5tuytFIsNVHOu{R?+X@nErGR#x%jxVxYbZrFa;TOUD|3_fn)$yP#0vz})k9xe!u@nr+N$EC>9-r#$5U6bnbzI*+*-di?DTS^xOr@uo#iyux-Na{A6r9msTF({cNE2aWlocK8T~f=6s;2DONaY z^U=$>n}5}BXr2%IBx6Ir-(^uC&QV+1{|5ofpe`vEaT2*OzR|*OwZmqty)Hd2(d7RE z8~>9t?n#2Mz?xUMyg)j)j2;-+FTc0FkC1zR>5OP!HPcZk=twzYuAWZDcv!?CBv!Kc z`AE$nB%wb=FeUW0szi(;_W0|4-b$WUDj5!ptjw7eP2Dk|ag zc`q8*xl_34d-ga;491Icq+jMoCkeqH2BzUA7aS>mWHJcYeR{;VTg(LNbUu4Y4~~pv zLN#JhTgUOYM%lQ!=p=6LT&!C!BqtM&wrtj7Q5L`T-83-dLiYL;X8cHDoi-@vKgysT-_(7JF`3R3Bpm7I}a!H_vo zh%-s=%g8|lWOEC2Jr|tni2XGSSypB8bJ=#r-10*_a=ehhFR6xZ3l@D5B@vOe^Dkp< zh%7A3Y9FhahtAtuf>|C`HHV92u={Hc8wwk!$5$b}>ovGQ8*3p`=YL)&0CWMyfrRHcVX;SAq%bo2ltU5KEH(CKe*p~$bMTi z3E-72anzYcFn&`&6_IJ`{D$B1?OGdU)n3QbE7xL#5jJ^%(<2!Ui0&#I^wN}Sj*a>0kE1r}vo0IRx`!bFLZw zOhjt2Z@fHr?`A`=r1`6JRX%{;d_!89`E15!E!Vn!Ih86GP%C37g(mGm&+In>CtuEp z`4Ij_qW>8(`fB)nDux3UV=8^S_M|UB57W3z45j={KN-}v6rs{t^x4PIGr490=IH!}?h=XAc>($qVFD24o=5=bJcEswHTFz~ZWjl&X#jTxNjwGY*2-mD8gE81EC z?Kbej1?>9N!b|!eXX}Aei6Y4M+dmDpVcw0fB1pq}3=9mshFW65@0;)}nKA#Zko_zJ zuM`Cn6hi`mB(}iUE`oe>klsz>nFq+8&URru?*$QWVsLbr-R-%zgsG^`fsnFOdB$_9 z4lF+t73$ECi)LT+5!}&up@n1?=if>GRe}EIs}bJSAet8=CS=cXk@0~0z=Ko0IaGhq zh_DZiXhiW!p2Y%b;ORV`$p=pTFb3 zhdi0DMN-!*7Y+qF@boenN5~CrJSSjETu(olfK>=8NHjW_-Nrs95U+}>-h6)2?F4o< zMh^9Qk}0_rh|lA5?Kq;dGamzAv*xVgFc{%D5Bhu6ax;6Z!w zC+me~i_3aD#KXGBg&%~D=T%>V$Nk1M0rGDfm1P~5kDLoztCI}B42O3f`-Oh+hE_Z< zmAEcSDynE)E@S%Nzvsk1e}*&JwqzwmZ>1mBwXtTmt1ZbMRF>Txrm1ybrG*qO3VFB) zxy9%?3c+F_x|HO%jtru5#N9~5;Hn1*P&U^;3|nPMpH3HiT-GRf8qNM52ioYUpSF)u zY}05l7LN=rO`xsNh5MOuzn>GemN5vvI3G zOr&wsJTK?EXg9e(1-W#Qk^ZUaU~^=K^P{u2_>lY;0yZZqN%a&k_yLzWWUY>j9Qz!HaW}21vlWLpP1!1sllNwK<_#@>E;0;!9^hUtq1!_KnMW_B`bf9#i zbEG3;nb+o-Y0!!p$s0$Vx--TeG$a-QLK3k%cJ-aAkG`4O7*Y@J0F}wU=I4Of|deHsf6v zKcZs1#KB-+>!RcN-h{6ddh`##?TYHcl6x&;i#s!h5Eay$W-D2y@iBZOL#=-Mh%({X z+Hp8>x1(7D=MIAa^T!~Wgn%A=-8MDKv;DE<0#QYfMX>uGQQPZ25Tvnec(sj@>9Kz` zfbVmik~EK7>RVM@I0I@}xZMdy=ee4-u&7I|97a|8r_KZl!XJ=+|C9jPf4^H#hm7o1<|&f$B+h?gvFW?Qio7ZQ+ic)^<5UyW}hH&$$C2 zkq9vpSzJ{>=^|WKyiy96@;U82;+U?zp}mn%w*6>K=Ju%{=dkT<+C^gL-B7Cm<+Re} z5mWf)ee<(WM#0f29Usob*m~oRq?CbneC+L$qv4q>cV_CPo%Bc^1eR6o~6nA>aUqnm?2 zu*VL4Ar^-Q7S{NT&AYwj$qe44O04TDvnYv($GUBe0{UW^jojtvIV=E_%S*XYvDk{ity2#>WUs(wAYss{4xm4V8`*o64X5>wLE9l@&*c={SSlIeM;LbcEN`sOjw z-k957dARaJV*Q;|Fy)W___O``nT!>8`@`PQ%*KY?yut0E7%=h0Wc5LzaKDN-pxEa> zH-B1uSHQ3MdETepN~N+?W-PL_4zG*#?*dzh_&%dZ;Z^i{l`$2=+7D2wUrk1rFj$ZbQ~I#9)Y+{9yp};?WPmda@FSMCP=&D+7%=1#Lr(4 z67f6I_mqD9uV#+g@!d6y7a52$ymxN*4o*R--Q7%VNtJ_BI9oLnt!}<$V z>ySlxuD8$f+8j}vd5Ai1Pu(24g}%dm>y3W9yzdEwy~tShIrP(MU45AQ`q1ldODlVc zYEKdF+l~GyqU_rZK|1D{-Js!(=FT4&xXE^l z9VB+MmSS?B#Xg32-4)-2D6gyf0f7j3ob<1vb0^Pt15P(>sM!mkd|Tj=C;D~1o*~z8 zccO!+!(Zj0faAjq{hvJsM07>0*krM}+V)@VgxWvFJU`1&3_9z~AXXqK+p2NHKx^LZIOoo+yaO_1kjJfxWhlpb{T*PkS z3cTfHKtU24zOFgg0Cu*DNEwfDGe7eLZIK})olML!6>)RYj`DrZj2Y%@zn%(&eZYEt zy$H?m3>HLQKdBTge1Kxf9F1!CxLV~pci&p?bZT(cUeM;@birk!=M4bvK?!S;T2=wo zs2yf%3|frf3pjp6npd<~oxl2gKh$X10rg7pUUq%?%V;_-Yi?F8QM^B2dy$90bcE@b z&iVQ2V}IWm*bN&qbl~icy0Zv09Ciuv;%S=kk_i6zLvXQ4@Y<=7KO+1iBK4+sWG3IZ zj>PJ+{c9n)rL*QLN3Mi8l|nwbtbC+uz2itC4R)uGiNM#Zt2sXOM{aOvMD|1mHR=dp zn=H+MVY4J;T7Z8z{L4b6cAF^M+g{(q`1xo{y94HJBJWicUQaDsmXDbz>C3nWY5y-f z+bk5ApRYh}aAAGRY2zXxfu_9I1(q_GKO-0&x7+FbCNj4gPpdy2{u8=2JA-WwT#I_Y zvjqmS#}Bo{U0t1i%TF@ALc22i^(*wso))1E(d$Y7@DBs+v~h!n*t2rqcCCLu-|aYJ z8QZC+iJtf;;8}OOPpczSdw%zBeusM)tS+&U>w<4a;OeOihL=D5DT?d((tvegYox2| zTw+BTKs|X-?;Cia0X5{R>~~9qx$GP%_WM%vP|1F04oie!wAJ69ZWcf1{Rlp5$Bk{* zqUNDfKk3~)Yi02z;JKcKyrG@ zA85at`E4Cu{Dh(63)|msNeuc@WxR*TD2!BzB=Q#KN{TCc0Q$kvo$#}T#5C;n4X_hLfq)q16t zyGfe!EHE-Fn{%V*l{&~Xp2-#A^WJ7@gROub&wOowEjHSh*`WWbh#Dk4xfd`diT`Agr7+woI9n$SL-$wQBEvU*S=LelL zH z+;;n!Bt3YU?5rrv93oh_tn*mQ2_LNZXuk(-USb2Y)bWv#aKn_C;I*3w$nZ!htjf$3!aZZfa8v!@HNcpv(Gg2bQ(i%A@H zWS-rIM-GX5pO1*mTNi`24Hrhn3LWw40{)GM_lXUUdXt&`XgtsNuPT5oH6 z6L&C4nHYvUr7?04|Gm%rx*~^RTU;hG17&zaub$Snx4oa94$3OWPHGPuXzf%9qC4GW zSu^H`P(uR${5pvXq#!pC<}cu&?{vsVEu$J#R$GNrQw7q4}py_gE`)Dg7&Q}A&}^4|(F_Dt;S zX{9xjD*3rba~2lGI*DX=Sx-i#8zsA0S=0k^_&rHWD2FSUI2hz?-R)0>)g#I(Z~3&l zj~tgRSp&gvQq?KgsF_@_DFlnzWNrLZ)Y?esv(*0}klq(%e|eVk`^^*Qcy2?t<=Cp~ z`FZ4l2ZXkGRdOCVapHjc)1caF#KzMWi__&A19v+1Ei(c4iyAvX#}u8Y<2%FYHVuGx zGo5OG3r#KdR*nC6v;!zNm1(HPSm=Mba-WDUqrWxFA!E|4eglVO#aaB~?7cbyuu?kT z_X1FVJh3~!071R(4c>r{m3==*b7EiYq?8x)FVB)Ax`&@NKyQ@=S7PzMsK^H|7#wO9Ih|~Y5svwP6e{9yLD~yZpb6eax zCq9Nmrjr(Amm7&)wsu9lKv9IFEL6w&#zC+;mksUE9OT`7r?Uf8^Z&<}S%vuTw<|@y zdPV;inFRr~T{`@qe(Cx^D9w`no8^4^=R*ags7UYV{eK>IpjCE3`D+L*g%cV4|NQ<_ zT-PMW|DfK#18zwD9gxkA8Sg)7Q-xTU;J4D{<*>LoPaO(s>VVTB;l93vf`Za(dnKg= z?J5A;Lg4+syV+6ok?@lz}`8gA82V&%s z_55SURt;tM)LQfkOWb=SvE-rt4#!4x0YiCg>Gf^|-&;lR&dYqR((PkuqH(Vw&Z(W| zOH3+p8={FJ&bnLnqSw-MW@);CN7O=n0pEXp&^I}u0|EmgFxjFcWqdwXY(Unr3r!nt z2V*}ZI^93s>?XK((&;~khcsLCM~uMhm99U$``f%{W@PEe&YCuAFh`ELdpKN;%VcUO z0jmwm-z$C!YFfFEVe5EXyw&tmDLW*cX+Jz+0QL?JaQUj67A+^19yN?xo^na^>x?H# zH_BpvJF{#rTz05e;IUb+g7ndrr|%2nyPzcQuag$s;$H5<2E1Q%ohqN&%H1}oH>OUn=+evCTXu?Q_9ScdfzLbW^Jx0zt#uDpT5V;uH0`t+0~$3uE0${J zalJ|6wX`>zLnx}QvcPCQyjo2`0NmYqg$DxOa-Ey#``!5j79m%SD9 ziUsm_t;L+C&B^(!rX(#Oku1tTN9MZ}xIk|1yw6o&erf5(&BVdN>`#4tQhuCi^MyZ& zwFvmy4_#koE}D1jPwv=jlGmB|UJu_MHoUw94w`T6W=IhvH<3wXMjgHnvw6MVMU_*A zhg(}sv6f;x(LT?Mx}7@vOWQcPd95+F2oPo+O%`LrOFsrUE?Ifcff-6QE_+2XjKpfS zjcVb0f4m{CtJ%vG*Bv)a0M_g2HV$v&XdUX**YXQ4O7@o{@OdB4WkbjLqXn?A=8i>( zuae3r-lYzDj24KHL(MHLilovKV`J^+Aa)$~N6qH3T3t>?^`DqZK7K&h3u!A7$gz2X zDLa4wkOGOMM7gywwX()}5VI~`uni86gPh?fsUyoC4!37v|Bn#3KI!wSkdqm*s49>r zcb=F8xCpr$W?>nJ*X3dgDPnXP*Xw%l$`h`8zNi@HpS?*L{5QwRsg9(2b{%{IdvuIB zy;}0X-&?c0xa^Lt)8h!RvE8W@(f83diPqzK&f?qHnA{LqI}8a*Y#NU6cYRB0KS)Is zO+Q7&rd}HaOQRlg_#!dBw=Btz6$~I4CC0$C+}!rlAz}`!^L98S|K5_bc{g_BT|YYy zT{F@r43?T*P)tz5deWCTkBw+2B_d&*R97qe;PWu~j5#+2zUgs*lez<`yjz*)LE#|v@etsVFQ(zTkyD}-g?d|3q3?5ZI9o*Rip6tch1YmMwY+}N! zNGdf(l`t(Cvig+;oOM117eC>Tnr2yDZGln$?vx~jeWcXF_`0H>G-)XvEzQ{IXmOmZ zC3R$oxty@Dl(3z4#dw8=#?5O0_JhJmL*hNUBR78_!Nc`5-}s@XV9%Q5Q{NSv!E~Rb zgGQdHK1#DNbd!O6DXOFgmAaFfnX+<@Sa=E6&sJ)}ndR}2!qVZeDCt4k;y(7>M+Jbnf0848hx@ zK}A(Ie5{UH8y+tx_yuv=H8?0JHSHtgA$43o@_6B5aJ}OI7B(0HQu!B2{LVJG$v93X zr_*3E!$*&J_XscGKqLdLET=iZ(kS76A&xkdlTC)2s#C0Yg3D=NT%2NovDsg0u1^?t zJ`>>C;kS3*JFL$6cvA5|iHX&X({*KAeh#uN%!Dvq_cYO;j5tI!*o}X z!B-*CbcA6pK`?1L{EAIR%Sz87z0SLx)~0;Qou;fQet)q?#op#R)c8fTa@LMIpDoI= z13g}i2J!HlNDIK_{-Ui)yM0af;N(JATmV{6`z$0_Z4e%twQB=p2L}!b>F(;vY=szS zBxrB_s6>MN9UGgC3qE3$(LgzUx#2?DQ$AMeB`R@yRH5yoHB&h=PN#ra_EE{xf~;RL`p#Rpwp1tEPlKbYE>p^I?Y|^VjQnbVR>-nzl!WoA$bdO zp-1kg)w0+AEMKje!NT^C)tZ@*<~J;K+#a6d z)>yIJat!ZycQo*!SxZUU#CF0%eMTi@Q+0*3unh06MMD!z%4 zF+R60!0+oqe3>flOT)g_QZ*lC5dj}lOF#4IM3k{ueAK_`2TgDnmANjxEKDS8xy8bt zI+I9{#V<7tsI$9iC!8+mt?U^>g92iSj5T9a0ZRN@;PX3qp+q2V}l%jq`uDe1i!*nXmYQ z9j{2~0uU-OG3O=zD4 zAK)|^drrQfm0-W8wczAI1Y2}`sl#gJzCg!|(b%+!H_MBM69*q{h{$s@AP3)Pxv8Nb z?vU4RDr*Jd^>|RC)ya8a7(_Zqkk7P#pS)L~&x>L>Tk&MpyIqVX^JFc^V?Fj3Ic5nB zt_p55S^VwfW4-d?bg)W{F@CmGcVb>4UsB#&{WiFy_%^CLmV$Dm?8SPz3Mi^mEUSb5 z&VGBMHp9uVh0&-3pva0!eZ4ED9mmQMs>~HdNNsg&eR;ZL3xg0>+UoH4(IS0HjY)7@ zYO2e>&mU!)I;Qh2PGKXq*m^IZj(dB7Gu7Y$7^)j++2F*LfYNAnxyY$W9L8RNze!lV zAX77gt!3hWo_ z$nfza6$q7?pUQ_k;=ispqFA)pcM-lfG7Q1{8UxudU+<`8`~Q z^vQrywIw_9>E?h=z5Z|m+rk+uxjiRWRxBEa{e8ix4kr#J?gs1B%iWv7=sEfZ!~4Ze zg}6be3x%nCMLL=JEiDUU{K-3}CQ*o`A%I_AGd<&sgR(_nA(=v(Dqc*9GvX(S-Dw7n zDma+yC6n1SWJ`ia(gYxx*J6E|L%}0$({)xp6fR4NtgYe1piX~F`vofNr_Wc)NEobd z31fQXLQe4czZ?AvrL#IW9}2P_9_F&X+1G^iZT)si9WGQr^~@0>L>hr}4;8149o~!= z@JFf#k7^053oLGo(nWqA$~W71t>0|2`RZbgLcUp`Sq1%WEtYmTb5LxRZefGFQO{^G zIco-NZPJVVMK8Q!IAP}G7*!I^Bcdq&q)rJJg8)em|CtzBktlYwc3`t+rf5RF#$6hp zucJYeHlDHpvoMbGNU{;lvpau=A)%X3noyZxaUY$XLB)j4#iB9eOE4`J-GI6a7N^%U zTevbc?o1-U`I=Q^Fot3WvL%^;L?9G~7>R@kw_7?Gs1_Ys z`iGlbGbe-$Vy^lt=WJwDuuR$c!zDNkJx0CzC#Hj)?Q#6}VQ1&tMi>M~W}1!W+b|Q1 ztp1lwfyd49k~}%PE0=8{RFtpit9@A0@;fkPVK(~-OOW+jA@l zq?Kv7;L*41Sj2-4Yy-MJlU-%XIha5ru_W(`rw6)$)zCH!Eu*!jBCV?uw=y=%WFEWq z$}$f1^EVXHo!b+nP}2VC*AdaGUUXia11{5&eMByySLIJ1_Z0F|{ zniK;qd4k4{6$v)c1T)Mz!;7=yqoYE!sHCgWEorjy9kT2jzQWzoe%na$h zy8YHWuHEdm(MYwYB+#Hqp8W`iy+axXK==5VKgwqemA~+kF`BfnIpa{rK{k`~cnRiv zSM_ZFiHCWfYctfTl5ey=)#9_=yMMu+LLMU?fYo-Mr-7{^GSI)yiLE0`T$m<%q_zYd z+N2PFqKIR_-(TWyhkUW+kEw=XJq_9{`r9`58D-nOa!{&J^F2**^;!K3oi!oxZh%ggaZ7OsT! zcqWg>`8gF)p=eX|vc`J_dX2zKlm$>ytHT|!wA7AMk-P` zW%RSfT`9cD=+{?f4(95!VG*7e2-Vs*kI4FVpVPrFc9ZE1 z3Q8&;es~!8QL&wgdm0}@+Z~lZb7VmcFTV-GxH-yHhptjM%^b6X zqtm|p;AKE@2!C}I3t*WkR#FAWX;uq;ut@PH7ID71gKAxPrNJ@MUQ@sIVM~ zUOh0Cin3HFy<6}lwiG!Re|C}4DS2TMKPXVGH9&*uSYLkRlnViKc}l9P35mL0fSQG6 zs4rlhxCqYFWI|WXt$Atk3X*}+-{9bM*U-dT-}qwZVDEg})MV!n`!F#LON0LokEODR zB|+cXW@m$Qw6CvciY-6Gzb&sV9Jh^*uw~!^6|Ty{g&8f@~9Gb+Wsw zf3UlsH#|XEmckB3ctMWA?H@);$Ttemsp47pYU76%9YINJ!q3BuJnNaf`>>oR!6r@YCgx(RA^03mEJKS6yol6LRU( z3~edwVzoe8E1IKzuE>m;{!H!!g-kUcjy(;?IvwK$<7JJL2#< ziZ$oegnD3`y2@^he_kJFRyCh=9=!alg~K5hltYQ76<`ZugA7UjB5KTRVA^zStcr10R&?4peWUhA_oywE^_zwW* zfRZg=65)di(goY_{c+lo<~D%F&^ogSp}|Ur6Fdu2G9}Z_@yPdmgO3(tYiwxDK9c!~ z{N1x;vUF92y>_zj-zSg&qv!jA!YD&CCckb1C7hqSw3Jpm=~epUte(tJ7)up)-A&B# zUu65Q9kpo=cnsvcfC~;X_Wx0j)agIx`!;N51PlEi)5jNG{F9k3jpG1e&3|c;pM|m^ zP=5aZ9MaVS93D~ z+wm1N(R;j8A!hLZ;PMAVmy`@DWntkMA6Ekj%gd~UgcX8figb}Ox~NTNQs;gu)_&6Wqy~n;$n=ED#YBXAO#jQ-p3}qoC|8KF*pL{g9_f0I|Yep9W)v zZ}z3kXZHE6D;3F^bL9`v(9iii8k5w$T=&FLV8e@Gl#?1==8IIGK|(qqB8*KA%tWP% zBtZmj3w}#Rb=IEPFH80-Pk;x<=Ld#_%2T%Z%e~_ie2!NMo=6faAR<+ndgN<*zq4hATbH$}_U)$cUA^s_NnS`TLs7Mg<6p&7$FsO*q6g+26l%y}P^f_4Or~uk!;L z9sGB%eO1UlaiZ_;_#5_)kB{rZ`8&oy_KnDHVsmC_YpZ=J3Dr!;!NPLQt_=JOd!%7o z7szt3voC6vq~E?=Sc(pOLW#$sby2drdRHiF{Y5e`U(Qfd>ppL#As?TR90LF5oLm&h z5iU|PE=I9~a-=Hdt_~k7XJ-oR%!drD00DSrYoT{1GTIZ_iylkWZg!%y+U;qiOis3p z2H&8zZ((cfne4CoWcY*4})8BgBtJPV@pD15V}*P7n-GX|n>cP3P+!9z?OlE*I-Ej#q}p=fxUqC`>m+ z*`upA`YPG1|5?OT6yMw1TZtsvj&%6bDRx%NrP`zGy^K2JIr4k24UgR_faKX_ zdd~!o|%Kc-qXO!2unSWrjz_w8=Hp+Ib+f74HM*E8y-Ap^kLgbQ-|s?n=Hj z&CDyoAS?8Y1c0dC|Li$Fd&Sd}5eXe|dA8&VVdCa3DWA4RAbkdz^`QfWkLvVsPHdui2#C<|WR^bVZ_yH==kxj$$}`=qeR)Vj zMRjv~t4NMojoS=OtJB$T_C;o~s~QEPQYjHt=GhS^L&T#y>OGHhcimm_=f#XEv(yJ= zg7{-$b~XVWoz3gx6=lNl-F=k02Oe0pKLI|?Yl3*egaZEDKe8Ozd&t>Srb9zRF6XOm z!tiiVcJ{*8kFZpN*mK!oPCyg;uj6X; z-E>wv%{%D~UZ9#j#pn>HWz#LN2ZoaTJ)m)glUin-^$on`|A?7wS}c`|UDJC%S1 zaaRw6w3H<}TfjA#_(QLP@2phtQ|@r1jJm1NHB70iN8f51&E?NR+%8P*CdINy?O1YwcuD^CEu&OKGfv)O!J3Btj zwtkOsXq*gX!uVg8Efksw)1^w6i?H#6lm&hvYMjd;G4#EGx+UeELU$dF+c!|@>TRr_ z$%qKPP_E=-9y3%Z@^L(~MWHBaO?h*z$$~1bMMaeBYL1%!z&2V`(BXo~T++sJD=AAF z#7MY$d+xIKEd-GnNL3D@a6YVgz+eI2+3w0}0JCo1b5q02xm7m>QZq&GjAyn25Ru}A zlPPiS*c(0{cZ(@)qpe=pVBSW>?F64|R8P-9Hs8IW+1c42tACiidje8hgXVMib;F-0 zmg%%|jw156I^LmwE_~{Y;?@=ugW^tltwVU;k3|060UZwrdP9issj3xwDL{m)C;aC= zvWfhpc}`HMVrF(U;E7)Rp+fsl5dRMAsB*7WEI z``fmW&BgWxYuD89FxTitcmMp{8e6eok}ew)iiW6)%fzRR?D^Q7apfSX>`6@lE*J9y zbN!=ro7G7KTGB}bW&4J%_OaqjtK?{$MlqZVgxGa-I9RTv`!7NF76;a&HD+^!i&Mh^ zB6V=*i~Vs!jxfiZ#`>ZP5xS>K{WIgE%N(|c$u(Z;Z7{G3_BScGeCNo^l?%m46&!=m zr+g15e3V`KQ6LWG%kwj@(+nBUmCagvN@~JKUmHkX&lD9T)lNZf7#R)8i5n_u-MYbo zMcsCayC@Q$HIZx*fG-S!zo-6vz5}bL~ON z5+l?bBh*amUi=b7PZU~SE(MZ3c&7t}G9KMw#3c$c1bwht zKmMs7yUKx~GA_;b^vo_luNCXi$CjWQZHzdE94@@Dl<55Ing-ltPvOQqEQI61(P?G5 zwy6#mvbJ7!I8s&B5*G7Rw-8RkijW|owv>s=XjT(;;F z$x+!4v0)F5q+o)O@V$tT9bJ<#7*mQ}T7~v>pfES{{QfN&Pu4=|Iu_XhDpD9IUs*&L zs;?t)xGUq;M!=@x3Vyh!DC|mczpbCC(i0VK8E3Ynm@iw6M*PaEYEzDNu+5<(Jh%k8 z79;Ao$&OTw%d~o(%y;yzLdI6-6Hsw5uu>jt%YRl0rWlUf&OI0ED=-$PC*tFyc@`0` z5b%fNzHkoCUH@;?0iu_efQKYfPdnu2x$oTKwHz3r^Xqsq$U0ie7eVt`t=iQnni%91 zm&YQd+@)yve7JRCY@9CwJ{IWs-k*cBARmsVb6$!7%Y3^ok4T^TJp~5B&#L}l3&MwdO4yV#*HD}oRt7PzI3Z4&>6_%kQkquZN zlU=(U%OF=gcP_Mkf`kY!sG4zs7CicPZWTq$bl0?N}~$I2PvS8xkLLQ2eH{XvwE zjrmUuufbL~^P(Z|x8u)5+cHPk?miw9TZ%TG4 z0)@$3T^Qaq=^?b~2E{#M{d~?+T}T$Dp2KXxWBtW+q-nf&*O&!_7OAt(Vz~+w`D5Y zlf#>`ivdo$S8L)h{y;t1v_6_gwEjR=uehIHUT@WUK+t7*$8Ea)b{@^zycInvg_%-h8*a#cr^u#z+D%t`n$q&-Kgixh0_Z%@l zDl-A!5Hf!@`xHfTz2JY%Ht*0X5s{gKCWg@gLLu+Rv9FfAN5y;RK(WT0lAK^t8N* ziAnQzw`lVxUiZg9n=U0ldo3jTR2w@7GxMdqf`Xu+;Mmxhj+Y}`Dl^r2J*{E#ujRrS z5q~}#i6vG&TogVB7bmo2WTYk_rSTPy3&lp*t56*-gKndGJ4GC&Y){ z_SR3uflY!x3BFk_R`Zj_XK=eABh-OHfx@>Q9*p#>oG398Mpjnu0akkUZGJSSa)h6I zG$@}=Z4^(4;s!~GI*ZYeD+S?j-*SSEP)dQq7iWRcgmDy#Fi$$q#K>D%uUNaj#;NsR zh<|h_(xYb2EspQNcV?6gD7bgK;J>^6bPMM?%Ya9Bihyb-1XHxovC*mOne`iuI1c%S zaVT6dJw3QRTgUYvn&7~GdR;yE31)8w^u|$rf8V7@}ky37%N+6^XHS0 zYjH)z+XL--4J2fbuQ*hT-Foe{Z|fI$+-gAg4k8d0Ia9La^ILd!A}e!94pT&N0xbUv zhD1K)pwH#RIs;K4f?CNf-ysxcigF1Yu zhq|0CT4ppS3<2>&$v#4au*aMKuZgR6`lluC!8s*ctD*PdMnc+t+Y_J|Nv$%)zCj|d zUPjx)+w;p(7Q!)J&IqU5i*jUN5mSdDLrv06b(B{6`sVFyIN}$pD}3;-O1)%-!W;n|sbhPN$b zLtdezhgF~`Qf-Z$%h7ZYK<@f@d0(3>0lmwb@l#E(00QaL2_%WMD!}_KNyqysOCR8Y zz33AbLRl{hrreLtFcfG{M8_pz)=fQ39vf3Cp-^nBECQaQIr7QMADABt%^4wS!mp_s z6^kUH=JZe{#ny|O+(}Yrdi^LdfS^UGTf=V231LZRh!x+hTfHb*Jg&z;LGL6+GJ{!7 zlNOlf2exg%yo36>&mQj=WGavR}m7AZ!!RY)4D zT1up^Xo{t-FAJ}b*bE=log2?Ul+gWY=Ub>`4ikBAe?Nz0assg&CR}L_E|Gt3fU}`F zk%&QUu_Ng(!bD1znD5$O8EY{oaeajXoyiSh))5C~0+)EO;MId52Nkh!P58T@uv!!; zk>*ttXQ2ttGjMET_`foAi3uBZH7{Cb2W2&3Mph24H*N{#{QS~SwfQ?bCF&$4(wLGc z6w+XB#@CP%jufRI!J5{Q$C?20m0q{hWMco2(K=(*i!*IlKW4}ghXFQN{2Mfuq{dtI z$>9|m%1Lgc7R7wcBXwjV>v#gebhLiZ5 z9sZ$0uvB1p)=#gy04j0#zG(5c*{0gw6R+Ca+o|@CX&8ZWyw;SVWKLC4J zL}5owS0zN*G+QX9T7pE~u~7`aKa5+gJ6S$-S|#Dja*9C89wQ^*x9HFz6)%AZ8>rUW z%qBZI#gwpFKSdp2V)J)?*l2kJ$)|Z;CYCHYGAM^y9Lr}JVtibOTqHg?wTw>A1!#Fa z+q?1_zAArrxm6YD5E5g&fv*vJd^^x_!3SgvHl5D_I?7t)gh$uW7A!#J$g+-(C-oe^ z@wU3hg}#+a9^0r(@-{o-8b7>U;ICHqd*`U}iH)ejEwVo2p`(6M$++qqX_Ia2W93#e zAatZdbug>ZKq|+Hiw@PcD|qv=?P2Tc$;*NzZ>r1{?qrm+!HNtY-3l(1Q9#g>{j51n zvBmK6OxnSyM$3(S++d%Y)79n`PcZGCibENrbLArnUT=lq>ngLI2l}X1-N)=1BU;(! z>9T=K%X$WpWuVIYqt#MncnPH_pUc48(~4d3s*ul_{pQIUA`nQXq2TK| zWSw{zV;uC0D^t32xm=J>TpCkbSf{9qIedTCGdie?!BdrFHGCYJSrur&mLb%bbo|53 zB~}$^RE!aVQ7|zdsh`r4$letSNRY$~!M@M%oD2d@bdJNB@~k)7K|WQHX%F_@za`xN z3_uYh{c)OOfhYPg>rw8NTsl=E&Sb6A=6rMh=2880ci0P)gN0M5aXxO{7$=y{+FIa} zY#}H=`-K?W;G#Op7;PxY;P{pLOj0av+Fd*;nh$?l-f8O+z9HU3cfh*h?d;k{heA;; zz~yj;WmdaLQBH0DJO>Gvn5)q_yYPZfrJSO}xi+7O>CGFfVxk_uwGQ8s!9^0Q{Gq`Gg8ia|831QVMNN_p=$A_Xl@4v?=1GwGq7qO*is4HW?cC3wyV5 z>8p#8Ouu?`I&&#@WTm`s zp`V^5Yr)}RpQqbV2CVSYcM8$y%o{A$Hv^mX#Eb*RX~xxdLsU~@z8Yr-OMfp5zWD}F(wrunL#$xMYx^TXWDMPz!%uTkNL0=6ENtZU3 zXsAua6nEN4eBtvOk)+iSR&7drQgkp2guJ3}OS}R0>i%uo zZ98d<#>5siW@#6xCYVp7=uoFr8*@WCJE(@;($HuR$kgBJkh=RUTd04rqr2-s zgA`}5N$RL+W-lP)+m#q$B+6gJ2}JSn8*bf>BysNtqb zxV0HBT4Ig?OEA(uKR(SeE1MlJ_37&2dyR1z+u_58MeX))5fpD$?uFfXp*g3FLi*B=BglG&J_|j zSk&9VEP2eXeW@wR@+1H!WfCDy47h;KYH5~BBe4n(iWWsmM?CaSfpBT|`X3ktTSFjSBg zKN%mL%hf!=Avxvpj801>B&8gViHfObb{q;uuT~zZ8h^ivK(kCR5VaAut^H4Bl8=a+Ph(+@fId14Ry!aK^~0I zEJHR}9F@cR+)QY29P@)Mk4mXn%AIRyw$&W^uRLK?8!~_g2nQX57=w69K7z#Q$kp zfCtpJGqO27E_SJaVNk1(+MNC%Lj}Y5LCUYnKX+zRnn|)Sl)>M{VXfAc-#a4%BQv2S zpBmVfi#zWl&YHIZ4xF1Tj#g}1NlF4{So65-SKe{-yk7S511ugyI$X;aT#?tjsOV~^sV>1w-Y7)oR&*N5ISoC zz-k1c4HrV3;jfDY%F$G7t70@7EjwG6pr#7*B`ksXk1f2LO7KHb7U7^ZSUrZJ-D*Ms$V@)%D;^rzMZ zgn037HhPNp@Od5TO;e<0#IwSdEnCixcu9m!1V_IHU9DP+ATeBfbKoCv5r{#Rctidf zEY>Ofy@s?W#;}9pwYjVaD9lV|xOt^Ef1TNv#LkC461 zdPAHTUe2nh9cn_kDX0cUjg4J0Z@5xyY{^!f#ZQtH7!Udi((bL~+L4HvaG`gwO z)@4cJy51Py0VdOiRnYCrBXTt-Y0FZsORdKX5eM1OkBkwGo}O9^ZT5c_Vl+LQ5iY)44u%vv@suFP2izF(1Q92^30UeX>SSRSmC_LxY8W0?Tzu9Wxs^K0kgB0r3=j4n=zY2V zRNMI_S~XpBaXVG7OQ{iJIHgvJt?T0Ux0of#l${O_>TmtTTg664M}?vsh5BcmhaetH zz7RspbuB)<&qioh^OhVQ8l~3zm@Q_`*Gv`7ji!^S3NOq1!Wa?G#^;Xf&@sL4@8+xd z#tSQDXO41ar-jR_jZpn>u0E#v`d7XAKUeo^Z7??@hITpZenSXj270NWjX9yBaEPM{ zl;y?s#^=wWkVu22+AZQT2M8iBErltAL;g)2BDES4suQ~kji!}xVA3l~!n)+OOEsI{ zJGz40C)B9>OdhLod|hCpqh*0q=fWVhA<&y|gwS=A%&7Y&)w@>?hq z^QYw|TS*{?`APJVBQ){g%&pJE9wHqus{=?W7C5CPt|6-R86{y?ToB`osSwSe^C}=llL8$P{Kj#hB2++L<0!IdZxa3Cc zoFWEGRj7sz!iKj|D{1R35tCqRX*f{nUoN2fmMizB#7bAmKoeu?O*1#K8ws-F$|v_G zN-0R3w((G>8JSuLDFG5)BavxD>31FcQqzh!BdS%P&(5ALJw?ewL>I#G2EmidU@`_P z%HqwBF_%r1*Rv~?CPbMD2;x_HHO*e!YcNXLM7A%GeIs=L-QGAE83dAhZ$M}%{7yjVqSrw4>d(UV%KJb*{5ZP8z*!Zv&REY`F*WAA=SvqDC| z(?lcsGt1k_h`|x=v#uY(RPrJN{ACx-CB>E>5fL8`hk^d1#Tn{;%tc$EPRPYT4op;j zLBQ^OsfAXHgyrcMf1wW)x0Dv164$Zqb$;z60Rh2en(=JXy=F3E4C_>#i&L$MLgTj2 z4ES$>0E9?iD6el(aFbdhI>xZ1CkFtpDbf`b`cr$+m_#(1m zR>Jm`pi+zc*ldlqusk!jm4T8`geZ@oZZxupw$gWHL5Ej00@6r-wKVI}oOss3z&ZC; zl*1z1y%)C#i@9%_T9o0q#XaCKrCH0_M54>80t%YSm==%`F!aXY5a!I0LBJStODtK9 z)8nX*;{j|=7yIT`BExE5yTbEA0xXWSRz{@KwJcMWeRI>0#SvxL!;E#!?55kpY)V$o%bAem_d9mf(r9Sw zdI(vdwr7iiAFNWKkYu3$TYv1VYv(H*vvRcwxyw4SXT%B(4PpzDE?7!alXU$E@!Qy8 zx`65zKe4RVku++5eeqCFcdv_o+K6RjvWmDs;D0(_!A$+^~6L^OJg z*BL=X5KQAQ#d#p?%8k^X0@}a$VD6T{1=(U`ylh>1$rNp2N zLfdg0jcH;9@|GBgzgp^CScF4K=%OH0tWGA6nTJogx#EiFcu~BdvyX5dr=u~qr3&LG zLJ=?CD|tcxg8y94xO@3+hUP?XL;vVvS8(}0Ryd7?DTB@Dh&8je87k)O`W+GudSm(T z7(Qhct7f^I-EXX7j}T}$M#og;^(|)W@m+3$*C=dO*ZtX;Om=BJPMa5s$)zwsU*Gi6 zZ`Yn!Z7W)EhhT|{qsHV)em6O}3gZ-tJf@##7yAg!kon~Y#9zV>X9zAq>0%r+^h84|@=7^!i(D`X0T|@nb&H*Ra25v=Ls9d%y<&x+!i)KZhU8kMxb)u&<2SInjdTiqdA3tbnT2 z?cn#>q2sb_HU>Cc>;I{rXXjyhs|J8x!hL;xKt^Z|#i!4MR*Kf{9(V&KOk@T(SC*`T zW>iv2R(8z)9Y?OLC~4Wa_+VMeK=8>2U0rZvmRPXvdnUS)R1+!{%!xCkfNLUq z`YakA9%j;uy3>1Yb$nck+P9MR6fF|HGxftnEKRH*l+#Qe zG&p3-cORfJ#7I-<5+~X?CHNc^{49oJ`CH) zrmwbrX|-NG^M?DhMsb;p-Q)ON@KruWHSQl47V@|L-s?RjNKyCW)zaYm;dgrm5u)iK z1D>wK3fp=U@O>{rWLdyj4+$iIh5A27dt%TT$#0d~*W2!K9`gx@Y!gN{P&1=U-Dv#H zUvz%174or2g7G;^h)J^56CK@7x2b)!mfd={MPyCxZ!r^SiPe3Zt0%Pfl`dUx&(7)Z zfAq05Zj2sSxbzJr8;VD zHo7L49^6zMiaINWOb*UY2Q0m32vd!jG5O;+z=o+$ zxnRFppDmjBn2f3;9#*On@N2a>9GspA z$0h=8t&xq`4#nO*t+|U`S8AH@TiGFmB0!Jytwqozqw{rbK`D&#j3B|rc(it$tR|bJ z(|O7#7$p3&g=6;O>fe2fEZREyyk+Va5wh!GPM;PaRgZYKJ{b+D|a^=&my*j^jh^^Ywgz670h5gQXr3@Ffk<7@k{-f05zVS2xh76m; zP7L;Ll+Io*bjU8GFN$9#e_f$U4u%TVUB4Lj**(C)rVaZG`Lw@6^dy+WKW7OR#8SD+ z6ngU#ZDJ}_;8-l^hn1nK98ftrSignE{fH!`W%>HL-R z4q(vR*Z|prI7$@}mirK(p)LMcVd@(4v{;smYr+|rh1bpYtRF_L8=ZbGcq5v%;Ub){ zRnk#UrSg^}owNyJg$Ybm03CHQ2J}-jz-i-wwkXP#mlXXULqtdN|G<-)fN#>cI-XM!oQ>IRnJ5GL3z|Jc1kuuN`GC#RxH-jzy6r-Vjat|L=*Kd5s#^lR>9 zHMj#5;K8j35IPtJ-+6F==u17x-LCnmWY4VQSp+z`GMnF2tE)TmM&0&>QImO85%zqMZL)U8CK zM!OwUFUpjkSSkHsPH-+wkX`OKc7R)5ItN082^B$Z3F5c>C*)F~H&aH^S@Fj}AO>K! zCiE~T#;TQ!_}Rn0{|`7CW|FVP=@3`EY{lYnB2ATa8O9iED}+?V&X_aebf)YfIA+p# zUik!iq+j(~MctB`(&@~hq+1N-volwm^3;-9ON;doI|GUomAX6bm0>hvopiOLg&SaU zDQKfFP+z2Eesm2tt(Zq#o;0r=7p=VFfGX=0%Bw%G?|=Vb#Gvk=Qxae-2B|WRZ+Q$x zg=ytUMeMl+H-j_yJ!EJ(TqUwLf5Z3Sf@!_-YLC0#?Kf!hBdlBN3_l(q<8TVPpvMcze*G@Zf!M|s1%T6XDyTYnpAVJD;?hx`ib!hOM6Bci|>l! zTNOm>od>mQP1uZCuz!!FBsD!usDFI^g^4`K})| z`YE#lXOM(Fd;RxZ&jQ=$Z=yH7n~eI4JiybQl?=3o5D9+yoS%shU9t}6V%wBqJOOx? z^-45o@<|oM@zQB$PQ|`1og-0@6aV}7Km-q>K9n4tvN#!e9~tTN3|G_GxEL7;4{h|) zr!N5Jl?5KEw&$2AGOko`(>?7iul2v*3XtQX_;wQ7h?~?BlGTz@^$B5n-o=AY!f9ln z5XYB9_D@@nLQJ{A^`mqrZqyv%BEnC&>3{qw9~CGzN`c}SvV%YDm(nOY?t34x40%g6 z9|eVI(Q6AlEsfyvw4SNgThG^r?J!b`19?qY2F=;-3GHuK_={OVG$A2sUQYsCoCNHNhzVX^(;DS~l9Og)<|TB(WkicAP+9kv?{s*u4XXV?D=m z>5{`s&y*tXlA>|2P@sBEULL z25S|DfnLLzMB}=CBky994utg2e46QG@WAQRV}R!WujvBHytF|ELigX-d31Seit|an z1TDN})3nQ7T-Z$Odx72=br7t$^+xhB48u|QoSvZ!1*E(zQm}%tffSN$O|i4p^gV_3 zERR z+HfclU6%1NB?qQDoOjlXN{=V+1Mfzn3HcmI%kDYRRGYUq7EndMmme5L!8*ut(Eff; zmOveQM+Y6GgaG-s(aIG?>qXGVE^95!WI$eCzKwvj42NrF!!Rt%zwCZ&^p*c$C@5g2 zX45!2oXqaAJGnW3Js+4@)@@DjvUyleNOJ}kI(dc3kxpya8*i&>=+-6FW2lha>NyVC zipk+_*=f<^$ec(3pkhU5);e7cNpb8=95_=mF(I+lj&Lg%SEn;_b9FrTcFXu&@cZym zvU4}oYR|^zU}h)=v(_HE9-}N=ZI;=_CS)j7_aBDBjNRvh3q1Iv|JueTnZt4gBifn3 zvi{%XJeL#Mml0jlZdi@h{XW#mz8L|!_H1*3Hy7{EY72V@2@{djx?a6d?lzy4GGlHW z6+9Xo9Gqixn&V84si%|aSZjj%Oq=j~FJy7Qx*u3^^_u4`Ue07k8IFQSer@duHxT6f zbPnm~4skfeVTF5Q@YZT`yW7nJ;q}qHHNt8snKnX|ROS+$q8+1cI%o7ALfS$i;{B!n zMxW!=bKDSGGR$s^sLgMV6UtGM=0s~I{TEyBGa%Rx@{0>vpc7xddE0=Ao!#Ycv-QM- z$=l<_)74f8!%j&th_e${Gs;`CwYLNTx^UFHa z3(QjlVrF|Av%vuo1TE5HmZAC|M~zPF7r3_D@RG;;_=+E$?LJ=@_ch%>be*{N2X=li zAgL_P8znP&ni&b&F5q|W5sHB(K(wIFo*=@)*m!cToQ>S5If^MuAl6|hd_+5V8x>%N z+sEMQ_gyqItI4f>e(Mm6#c?%U za=55pZL_?+=!=?Ku=fuetji73`m79eUQ15q;^rQ}K;r9%xQ?p<_XH!+nxM5JhRFKY zX@~*nMa0UwxW0~0?q`mkgmJ*0jPJw$n?J>^uFCp{wzLLjn+l8# zoey{M89#*@YvH9%H-8rKgp}M-INr4N&lSskj^rmf^7JOlJ(12P>zSPlOh{R2xFwW&Bo?iiR1YpY9wT zy7HNtbhXU|!&ey&^bAYUeUe@JNha zmb;`**gQ~v9C?0yG#7tcY*Uhwynrrk^z`(0q5-?x+q3P?XBix}LdQZJ92~Pf5A$&v z_%~rh-Orw55DCjwi)9@?TF!y!thH*nKTv?I=ld?S&y5gizaff5k&XIS)fc2g?tu6} zNO4eLpArd9as-De%R87}fBwypfPeYF8Ud+o6;{S3O(kvZ?Ndv~4|jC2S>?pAdFJwp zvu81fbWTZChB9PWJihu@y8iYrr5gooI$RZ6RA_Pl+sI=7^xv+(;vXM6Y)y)2K3F>M zJFMw7NdW27&!NK0YRp4I>#WtzNPo)=7qIV9@McyL_}o|wdRS!XL0t*?1aM*ilLo_UJ}^|yQ+D`aW@>0q`xZ4)E(v+mTn@Z`xl zr?b{xU+2B}LHCOnbX~gi>Z02w8_Yup%*sY1tPxNYJfn6e!o^L?7IJ6%>egQ$rc^+k zGo|rig6D#^yjECIQqM+GKo$rk3kMl}W<1aHBzzZp+GIun8U@q%1`L>nC*)~WsZf=R zMD-WX;r?v{6!M9QiMdlm_Ol;ae;MzegCVA{h6r0Bwjki?EE`$v`fnPB$qG5$>xyul^kHCnMYyIFjRB!>)u#3|B#GR+U8F5 zbQjc67K4JO$Z}yA3I``?23<}qs|q%ixxI<`l)hVCZK%WJWi)R9YoQ##TusF1y06HW zvU7F?da4GT^8k;7FdE+n%KH9wD2uripgcKCp45sD%qNE&#Dhu1Ur6N0ax`?afE8^!T}bd%aypOZ*Rwu6 zO+SKB!f=Iz#hjd?NzI4rKO7-Dl*1Eu(15S_qsqjDiTgg|BcvsYQBu9z{m(qn@}{i) zv&B{#*qs>e+3A@pLX)B4kwt`D4sX*@3{F76y7iAqnE3MqGue@nn@IvLnb&eGS_THg z*_D9K(;57T^2!y#Z)Yp~ri-M&a@F%2c&RdgcFUKhy1GQ+XQr_GK0K|BOc!Z_IxOUp(C z1UaO`3G#T`ZTkVS=yO#40r|u%?i?`~ zy>64cXt^v&g`;_x=)OH~-J7GwEuJQdBIi-~$5$j3`C4^4%#5k(O3&~QRD69-e8hl0 z^ZdXQ{S71nxU`p*!-uowcUxsM7U^mV_10An6lXRS!{VBho(4yCyFh{#K0c=4iM$rX zC(tXX*@NC0DRI)DuI`QTDjt$uTLD7C@9bR(7j3&bU$8?3;clg%?mxRxVm85Y`L~Io4nYQDa*Zl*rDdRF=*yu zxT%WeQr%+=45Shm+olL`a?tRQ!#g||bpmOQNk_~Uhw*L^s-Jwo{J|5`v~m9eq!`0r z)?&(|iCiD2m|2=-BuW;paL*T-Re73!{|N6JHVMg?6+oNY?rML#q7VJOx3gn^FrMVo z?DKG{!oa|wu6{p@Mg$6ShOVd((A?dfT@njO0#3?`kWpKC@)G+Vt+2v%e%8Bel;?b{ zX=0)9gx%cyF(H@LrPG_xf0=X(^I#aHO+zOuRW7go%w4O}goOKS2-E6!^Xyrt zJehzdVi+bO&wx3>+S-8qe}ie@T%TAVozXxDC|to`76PWIy+Yb6pcF2XmM?+h$}F_h z0R7aa`1c;}45u^Y&>k{a=eMTk7X)2t%7?|$?C(qgn&%e{C5phDqJ1e1bSoLnvZZ6b z#XvZpjp&KcYSO3kBORxf{syT)-m3fauwOBV7weOF1*NPJIydxzu4q;yeLN=C)&xXE zdfM9XYuMOb`o{XG++MG&Km8uAwunfTuvr=HvP$O0$bbBqAHMbATLD4e(yAw?$6);i}J@H?FN|*1D>wsSQBDb^F2PR8?8e zWb+Ds52#4Z!<81_Yk8mz_i_6X2Lf$=v8nrq8YcnMjqE%&Sv}AK;rWPdtT! z8JQ-EE+an)zY@EdYX9-~U7Y)Sydq6J4U7|F$R`yQ%wScpJccI4{+J14DNUQQl)*e> zk~*CN8Oth^XJbJgu%oWWoX_>+y&Mh?B?X-k^#v5+vetfI7GiHPM<>n`qf+jrBVYGW zXdXXWYpIbxL9o!bi}MFVO#FzCN2O1J6DOSH5rP&;#j(MC#aLvnjWRJa+tZLFN-yp; zg^U}}mzL8$2^ER2rRV4GP|l^4PsJqU^P4^dPa8*8ga2<<^O^CFap2bmNVy;MJFVX# zUes>hDmfV$Wdww-&ZtF65#dCxgP^*nd>-+$C9qTY+hhf0D?k#!kRi4i5(Bi;WMl~Q zXyT(oK|u+=hmnIPB!$7#aBI2R==t*f>}n6<)+BzYC?X`3u=(F;hz7i8q|>lR`oU6r2^%QVir2{Jn@emCFK`tjfrKN0h+J9*G6f zbi06J$3;?4umFGMT=w_Jb9>+Ei;^e8$j61f!X+q2$6=)`pJ7R<3}UcIah~SCmq9?Z z6@j)L<^ZF@wener?NLr38a&S!QIm%9`40xaSvbe%zsI|Woyv@022}hE6Eb6>j)h4W z%kPojM<Ss_p!A5J={;p2a@QBqRm$mPcoMdL4gEw93Y z@2&XszV(CMopA&T)L43NE?Jcs5}3ZW!LPZ%B7)v>C&Ywkr^ z?>*%4yf2!!c}N$B>?)06*RVdgJHZI5xbNI=0O}yg-?TKll!N1Va2*O5vBQMWGWDL1 znjKqC(POjT=Ui{R?c<2X*P%~I6nO*1w@%V{m^^t)#eES1+*XSP(|e%IpMAexu?r4= zgOi3K`(cszo-~pN#gbzQMr$~d89D%7KMOcy{y6A;M``JnEl~Z6V9QSNvG}vd&w{5^ zS9)o!S!X(sHFAeMW?QXM?>*uLJsLO;B?NTiAsUUgDIQoX!@#Y0vXFZV&R+0>r zL|KHPW+gZP>eh#&C*|sDwK6_P8YdD)s|ODMxoEnz-oy{cB@-$~&H_-PODSu%ZW-YQ z!QaXXJ*(ix`P>cOMAQ{wPsN5q3q{2#JJiVsX4F!lr%EkK43U-r;7CS+LSEG>--|@> z@J~6Si)XiG^tmWlOZ*S*bmHi0BBhc#yg1H6T%x(!wCPbJRJh<@ z=S~}Ahqa64_sTH^OOmDR1=)^``=rNrP10Xo9q>K~d&Ji_@~bBr35ea~BLPVLG=1C+Xz1Ba=;%(!-6> zqx>f-7#0nYFAnvb7)gV~%ua==1P2Krd4^DSaKS`@291TVwVr)@*xC||10uz$MX}>} zU{9U3ndSkQLb*7i#?~Z*o3u<@A|lIJ-@ui^z%R3;=2RTmL}|w+r0GiM<{K$E&=N1m z*2k}M)|^QR)^Dq{c{!6tlB?F;m}zv3Pw@8jg($;quGH(^42$bR8XAAnQoqh$5^xtt zS#veoS9i7A^u2zR)D)s~jIzvJwyOdnjxlW}ihaxbqxkFfH_y95=r){0a@=1V`~l9qx<2kqj(lLtMK3S8ueGovep%L zBk`@UR#**%T~c4GZshbqnCpEJ!eB-4v^`x$kLyEFNP1J|jIehk;ukNUBPLMO`^!+l z89JI>H`ifk9WK^AS+@JenswGM$q{PNmun8~{e{9%;+qd%5x|FgbPpRJ;+U;`Ubl7h z-gGb9=5`Dl9CuG^d4UV_&YD0N(m zZtJn$@LA> z^J%{;A8HP(MQ`!}8o`CVxKx3B9qT8P{1S)gHU?S!@*Rda17<&3YDon`5a4_4)T^_z zbIW&pF1MD}WFa!E;CnmBiEE{zloc}_zI2JlW;IncWo3ceE-jvl+Rck!S67;!XL=s= z*$hq>Saea{N@j;g!($r!ju&mI5msO7I-}>vJ7%9$%R3pn{%c-Z;Mt+0;e>Kqn68U6 z3(&r7;dIpPPM$NbOF&PY+N`zWj1+2Bg+3^yaK(9fg&)N7)bsVJ&J%LsRUcgz5L!MO zKtJHPuuNYtK*hdZPCEvd8|Q0+^-- z6RTyuY-WSmQJXJ{&-qqc=l3v=n`6HO>T|chzkSfiw|d@G-E7L{J)SptrTW?2K-;Z= z8h=UzyBb-l>j->Sa`mM6qgum}W`$*yj;HSmQDq1eVJ%nJ1ALc9g7Hg|z2Z@%HBzfx zPqI&CJ{Ma&-?bH;&U-&IOl+*KWy+r}dbG0jB(1();s_jhAa0)WcOAyZynNI<9!f?} zOC668uh!klHd%VrJg$0!*)rHKdbSrGr$0BWpm5`GY~s3tWwGa%OQ~qDKARHM9ITVC zR&UDiY_GaY>pLCjT>E!);QSNIIBYX}+>6F-)q9YYgnsCi&SD24oc}F3TfOSB$Z^@$ z_xlr@^;flZagc~JL0*X*@A_oXRvaA71eRc9wMyy91;pDWah(?HQo^7;zVrYKBSOZV zVXMi*9}UaBY_bOCf@`15M?*93uAD$CL_?W~%Wmg6j&_ospJ0=#C#0;Nrl&SP@bx8T zOBQ$Kd!tv&H`|KLW4Jn)F=wHSuaD;i<217w^<8c=tgr;uG-K6 zTpMT+s#xUC4RgWl(~XeoA+xb#N}E(nN{pP7FeF&q9=e_0wWZhkN8?|`!+{EEUhYfd zc+KA4(e2zmS#m|bk{Ke4)HKz4Q#UWqM_E#Q)ZBHHpC@f`TC8H^o@7ACBu{up2X)qB zpQhnDO{$rY$LaR@eP<|0!^D&A=j?*OoqujM`uc*TX3|$~WZ#atMKXzzSR-4%{%wRn z@vJ#KVuWly=c^0+&F<>ox+-Z1in%u*es%hJKQO-4qEThai~&e3em{xD#Um_30xlOM z)}|){&Mzq+miXb@0vGybzRjwiNzSAmIrP?GGSk-9(KDVf580y`Xz zCKo)`r?#DGT$^24Pwx1~E}!!BwM$$4};=m0pH2HEK3Ed8zK= zj;SY>KM+ao2Pj!M#y3Lcs9By|YN;uxDCsGxDo+=OF~>vS1(XOCE2r*ucKaMiR>w<( z2uv}qROHAnIz;mLXKqYdzjt}2Vl*kH^jo zFYG4;Ia?+O_$X^(|J6gF1jwJ)zf=+4TYZ6a(_+!62KlT$1jfzf$OMlm-11{8bx!Od zK14xx!h=YckXS%mD^fLihAsa|)>c$>r|pimSdgtM@^9(ykro=Kpy|jpu!_cCOd;!u zy09L`y0voijAsgwU`06PUj2*7Oz0N@!~>De*3AU0#JRV=Aw|rm2dAK5STB%56C+fL zo)NRy(&?rZv+Y+cer{7K>|qvAaibNLL&1Wkk2jzl-cy9$+Wa3L6$#>SO3 zQcq>FM}Q|QA7m>!SmIenkjx`3RRI)b>S@HKkB8xZS>*J7^HVHPx}%8zxH+(aRA;Dq zgCv&Th148UZhfBl_!x&vM6P+27%5#+7Se81YM_Q;|8A3~Hg>>xE@n$iNnVj6W{D5K zxa^NTylTb8^5Njca%?f6HhxfnFu@s)>*A_#s3}Z_69h9_Yra*~gO06rD*>%+h+|+zUV8LCIrzc(p)lb=EY&|Nq@+M97o!lx0x(S-b z6AlYSak&{tY$klY+~4EmFETjX{01_Q#TI95stsL1L_J*EQLFqS)@8V zPt0{aAzO+CBm5k*g@m^$w|?nEJbXFnBazW)5GVMXr2?w_eUcb8+k~nha#$2}DCCw} zqj$S_Q|Eg5zJXfC2TRQ_P9$y9*L0*%wz+nMPBt#Y|70$LU+`@@{WC|^NE7xAwHuq5 zIuO)Pz061}<8LY+#A61}OGBLwZ)H(zs$5>tY~oPR(^VlRrCw*|#M!Cs7l_@5d`Ref zFW(|>4bc<#BN*6-QdVK5kmb?A#VnyprASrd0_TZ zVOPc1PwW}1r4G4Pu)^12Y-xqfqKH4tELLXXdPH)x#g(PXJ6qim-+y?WC0pNM!2Z3i z4giB_i7v)%vfi^1gNQ+}#VW}7&T-D4Ap(B}RF!w%nBK&F`}TD&DI%!+n7;quLpWyS zlEu;0&?;npd3s?ZRZg>`)$G7d-+`wj(fsJ-WdCSMa41^U)nK}yk-gE&nJ{1}RY>UP zr@q;gb!1riCX2l_mQ$`2m)4y9SlIB!LD-dUwC**UIH#kIpise)J!d=L-YjyyeYR(w zUqywHv6@=9+AP>dZ)~9hlft{b=eIasA+>TTGm!aqfA)7{<@WMrszYv53H<)uxK(Os zNXm^%%8~oXrmOvDDcVXUzk4(h*yVlTDI7q0E$>_PB-=PyBb2; z+Kc@u1*=)W8`5j|T{YBKxVJt6&rO&klZdp5HGoq`4gCsj0qyBiB)>lOh496N$HcZ=q#6AQV^5q58dkbw zP8nnN@tY7rr6}d=@igEz7`k$mV+FdAkkleGKQSLXN!}I)D$dG6eoxc z+Ks>`fDJ-UF+!~vW_b)sCd>+pJWtFC|CHDGoK6cX0$30b?-lr=hO(-B(?)<-!_lb6 z*MWrMfL+SQsEDjp5D@Um^)#1JGP^qqtX}jz)R|s=)0ewv@m#;924XFr*hm5f) zbX3c&Kg&ogVe&0fUlIEeDqQvDy#%uSg%Y~cPcp9mpATnb9es!&){~D)L(A3yS%t8%YKc3;7%#neQ1b zO~7l=nNcojF9(CeBI>_R9RLE8i=5c>m`%WsAm<45gTtQ_R4!0va5%|wIe z*EkRcFsi8Fe#5`3n!w8H#d%SHAI@K*JP?uX8V^x5Y^MGcWJl`c=JJ{#yv6@4MdHKV z$PC5u*&4+cN;p*~1WT?rWemK;R`tD+hMKKKmJSm($g@r8RkPl)7mRQa*yrxHG^uTw z@Q)&$>&%OL?Tt$=7bznisRiaX;b<%%txUs)skU<-P$T?*0SdHuMu zxqn^Udm!{Scpl5O=cVv?ZovK00{>{15xY+;PIvie#g=jR)LtvzVlIo>w~)pd+%EFa0^XP^8oDg?z# zI%^2SXg-KcBo@jsg&EPTn$sk&yKT z8e}T>Eu#B3KPQ{lZOPtoZiJt3ouM8h)Eu6{kiM;OL)u1Q&Ug1_GO>Grbzj)F76>aa4!jgD46raw%i6ul`kCtu%&a?KZ(|`L0byPi3X6ych>7)s z^>+W&%E%yFJb$c=8jK=|{+uM_o~(jNra+}kgM(we)v*VG0F7ck3{I?hs1%MkAc1W| z7`alk@UJiIveQ zDKRngr#&eZmHBugwcaUQ=grd-zstG0g@py06n0u)+=e<^gIbBMuvirCqe4vf9#-*U z1vR?F(~WT-V^pD^mKLo%uk`Tp|Hslf1xC_!Z9BGY+qP|cV%wb9w(U%8XX1&SbTF|d zww=G9_xt;>54x(WYwzB**S)Tb?Utkp7>g_VhcW#l+k_K3*=ALg&tK!64Ne_x^mmdwPl}B%$U1qKLwdQ&7_` z11cC+;|%+*o|(mBm>J(KyaduGxEvW6;G|4(_K4%+V5s}?H-3#Zt0CnkkUg{}9e_qh z!?e1Cp+xRSgRT7Z5Py4mO;z5UAYHK8E&e6|g0leO+KC2h_>2ehqE5bggD_dGbnLy| zqEPchngiqJxZFo4zdgd~uC|ut>&G(DNfPhf+@q_1qk|bchW^FF%LjETpc7eQ2m3pq z_x4!qGoehD+^Nrm)7|ZP`KCP4?S2Y&)D#f`RcZNxS$k%Vx0Pjmxpz&3wre%1vU+df zkjSbS@Y5&IUP^W1aoG0?&Ia&HXCen1mI4ttB!44A z7+>AE5RUO0ZQ7k83y=7tP~v@CguwEX2rEEbTEVl(P?(G!)kS z$yJ>yXUo=yr^C!Qc}bTe9aNTJ`yJ_|!-4gDWfVAi3^&dJ7c8^DJx(GD0^X)ig;vvs z7p_yLQrU_Ft6=e_NCR<#u*q}c&Xyge+}4X_lJLTk7(r<4)Yo+~kq;7gd-dk9c=Syno2TA2CkWlAb|SX|I0z z_#I!z_Tl^9=rIXc4q?LgBOlDxV?YXj9#vcTa?cukT(0$MH%}nA4$j2aSSsrE2JDUa zW1|uMG1_iBG-cDyYIi!gsG2&OPMoa$wNNR6hKd&q@*Gk~ggbzs#ZspyKC&61^tuxwteh|OqzyrR?^o-7_>J}1XEFu= ztp<-&#)O^m3+>OjzmHQ&z_O2UIu-(DD3{yFlZrP7QlEpLlY+Lj!3t$;ZFR|#G(9FL z!-D3cgo=>>lZy&f2^0*SE>Gsw$I^x2jg!}TJp<{hTl}82DMVZ^rJj^l?PVG@G7_85 z@Y=;JWTL9B@B5Gi7IUau0_q9*^o+{gcg#&TZFx#JqSqdT>p5W-ox5V zVHU3oyGAJIiy=3$prM!}*p5Hy&%LTI1vf3qwXZ0!wJ8khEg{@5cI7i@ImTh05@4)3 z_4rap>ZaoUde>P~iHAfYtE;QKx!nT*fWVlv zloV6oTxM!ovhYC&jnm9wtcPBB)9#=L&6nH4!k8_k0&wnvGm%sb-;6So2&a`MG>}Ar zrG)!H3;RFYnNv6jQ6gqxxF1h4gnEFx$8COWHsr!F*S7~V<=gt}MmiX4us!<9ed&q; zRNM85qPhiui-kZ>((`IZxad+k04Y4Z4Mo{#2ZCr>^Oss`EulES`_=w-xir0jVmW|p zdMs8YH7PGeoW+ZUo2$e1v4vd|V>>!Vc{1fh14q1G<$ws^8@y<+s@wxplM^jK(W5-a z(nd-vRi_~MlAmWi7fr*~ZwusSFFY7aoqk^C=Xn}w7p`oC8M;=&C!2+g--Bird4NKs zlj{i?&>!kb6v&bvWD5zWrK7X9T%!#HuI424R8$;|#^XDzx3aRafk|F2C_6V-!UC%s zRGG38rse5@I}KLt%A2=SCwqnYl{Wm(znJ~vmQAzu6?b*`7P=6*J!|_1OP9up5!5(T z{`)hJgdob5AXA(8U6wmRh7S#$5);WA=2NA{et+&R;i9P7mGwhEOSN>~Co5+XGGsAF zuD+41tMSjsVov44M#ZiTI-HPn#fmimu1l;~YvK^ErQPfp;o3UcIpDJwnk+?$HnYZk z^Uu=i{jhL0f0-|YE>Z^Lni{Ms0|%YXm_*qkjaCAo^o$<&{VFf&_9$7jejUU!iw=1- znC9;mT$%a$5i-$^;8NDOkz(TjqfZm<*V%o}N%n8ZR)| zB07T(G&hJ82@DOj!ENhIN=S$ThI+PiW9#{Ytjqh_j9|%=K&hb;dNZ_A&PJ(xS)fi> zG#7dJSaYiL{nEZ^iSj?^_-;Ret>BbQpIbvE8^G2ScWw9F8HQ<Z&f^{x9DqL_`X8FFqJu`Q*?j zX`^D9mvN_;an{~4U1wceev1O#;I(HbCOTNqset_&T9XV7+8|ya!Zh0HUq~AEXJ{|l zMdTMmiz6=m*}JZxqWByEcmufkqcF}O^Qdi<>}ay094Wr=gJC8Oii2NM{BjR5IG9uM928#?&0C%qGb+?L5C&q>mwSSI^+$~h)c8o z<{Y;IJY0@!beWlExBB|%%JXIZYpds`*>~=1SUSb(Ig!s_fmj9eDh$7qy{eW4R)Rn# zNNAQ&ew^))KE{_?t%Fq==hDa=Jj5@eZ83unc}%}};Z8i;p^O*ms70qWh=37#ygtAB z`41WVpB)guZnY!NkpAO49DNWY>m+4w#J>6VO1A$!NHru61lBQz*~o?@rzZBMQdX$# zdwFFsmFe=myf?DUcWjST3$)@iXQNxYx|89r*$HT>s{j9ouWL-u&fL&PSWC3R$B?pQ zI2cc6?U3aDCZLEhRmS9!%yCDISz?zJjE3yo*TdiXZ|GnPn(E+SU(-BIq9EFCzZeA2 zP{b1cGJn`{5**{T`XOjYIs+1_MBclm2N|RoCO{pCjrZ~`_TfPHg;*OGWKIte2PUib z0C^|2r!@Yp`|zqqgcf>8KaXH8YQ1^T2m$`Y-S;Q1_8RgU#t9o!qUaTcMdJ3qb7(`g zcKs(|N18jA{e?u~BW_1p=u3fvs(xQHC2!{~$9c$Sw$}Z+mYp<+DHiAyd9pw!q^w}- zyoMl9C%t63SD^UI)U^qi&uNT{H*T9pSI>9;@oTASx3@vX)?{Sy9y?CPWIo!pYM1+{|^IS~F~(_fPF)bk$RGQ|B*qh!dL&QzIGT zDm7niJ}|^pXe&`sQjO46e0BON^kzDZCYjjU&j08Tw}xhRrZUPhWWC!)ESBe~)6K3= z|BVA^zZ2Hp6;55kQ6fX7<$v~x3L(R29QRV)h}n_e-@$ucZwuO9czYo;e_X}Fk=;x} z4A>>g0f4e7;FIu>o=jPAFWW-K<^cc7fQ&o2!Bt8_Ag^|{N9+Fhx!t&^5yQ7llpy%W z)9nNPXc)A7Aiv|X!}MA~JzW)AKg1a(E6gT&6*FU{1vD?_Y%cNA@%bFtR{V{_&A+`j zkCY-QREk&R$yO;($0vd;SZjb19=7V)51*_&HDc>-Rq5fVA~p?kOgh2O{A`r2^3z$$ z1>NQ_UikV}BK{_$$~L?VbG$Miot)O^hf&1E?|k&7#z(VUT%lkLJ`+V37r~`fgItt3 z4`dsQL9$Tc7*LVa+8jk_Q*Y!2Jj}>nGd#7d-!8M)mkw!gB(FOC$QA*Bm@jy=^r~vP z^`@)D%8%}kvY+Q%h8bV}{ipxDEjIQviZ#X-*L;xPEvlc7PK9?4mo9nXqDOX(0`c%o z>rz8Q-mOuTW5g|-W4IEw&G;-n8kx5FT!1@#*xj{+89g?CD|`jKd^7YWuD)I~4}9OY zHy+NJ`PsJw6}{1NL6-sx7MCTczzHvKEAgP^sOapLT3(+FnJN$jdR^p&P?Im5q6g%y zjnyms_O7mOGY-YKem_IF>orNhp`Ie(;oO1yUVC}p6BS8OaU%qO81KHr>~VMQ$FoFRFokgYO zqIJXX<-0=zCy3~k$R3J~%D81D2iTzTYGSQ7@0QC8;QU9(hy-mHKpsdx;*4NZ-S4eK zL24wzPk$3){0t2;wI3ci{a@q7X1;IMcj)_Wni_eGYvi|02jYPo1Ja);53#q1(4-Q= zi`JTKtTT3Z%I8RgeBEYJH(TJ+sc>iI<{O|!48rawFU07*cL_#SrHitSA4JM5F-!AP zFjC!PKZ_T2HFTe58GpgQ(BWv`3r!}wGiHG>u-gwVk}u@qf_4@QKItc#?sK;gK4^{j zptIf@8H4O%m(}#RF{+Mo1cxPIQfBM^^&@L~3+U!!*sNkZ9ZGh?6)Rt#>`jNfe%KE` zN7|fLntO&S6A16&67Fn>6ViD&tg-s-)Ab}y-f+V?vj4C{_8Q3aE$raN{r@& zG`A65nfnQz<#0*R3e{wHr}u2_OwSypTl^6C3~}BMmV?!qNVOVpvWx5M4Y$MjJ;mG( z!@1>{`%PF3q8N9N;G zeSKVAtE0KBo_`WZ!ezb7bq+lV#NkjKo74ZoT0N)Mxt}vRH?FBt!SyIx&u<@9xm6HH)N&~`<(4BV-S6xu7!-~ zkk0_KWe?MLkUQU9ucq-Wk)>~gXBKt|20Y#eo^puGExyvsbZjBL1JTcWTK-L0FNgx; zPC)4ZT(skNGy>TX4j8eR49p8A5vGuSt@YuY;sA;c1et!!1MBUA=>6uQ$_Tdz2>If8 zNbM(n#>dT;wvmFN_$gp2wsd@=E;wt6%}`RwkTF;)U31jw?H~*w#1W*~c)IFwD#n>T zewT2vUA(dTbxH7NL|^M2_WU@Jl*%ZMIfX~kGu9gaYLuzh_c~bo7w9mwr&~vnO>34? zMt|TvQB4%CU8es|HQD{)V6SwEq!EK5>w2;4`*v>lEp7Q|zINTmN`9_Jd0X^_pr^an z`-k1_Q30Xv&zoyXG)o49_3)Ige=2lKS(A)$y{^Fyd_~RjP=!S)Sm1GueiOh z3gP=3XJYs}ot{S&&Jtg!c=?efkH^Yyx1gL}KH+0iHoP1+yD~L)-j=%h1CLU@9;Zi2 zd!7xd?3Vdd(0#3k-?sRl2#VeV`#hH~=HG0iU5w59lY7Bss$5Q=8;FHdD_=b)ngd25 zH=cGT5|wLO&N~8LImU8)wd)IbeM`!giyV=f*N5~9rK96D}$b87jD!}^0$Y_$`}gt*l^KO955S* zEp@i#614y{8wtn7cFg|ite(U*E9;K-S%~n2+8UwuOO)cv2TkE8Szh2sstfzzcpYb^ zetPTx?4!3iCk`pPd7nEchP1sUQaO6yQ3l)0rpX@C#YABHyKZ&te7Nf#JuMt>>8e2{ z*VfBTSDHK-cHVId%PwvoaL*A6h+f=0RuliEEEIIR*U}Gw^7+%r{L>SU=eIHoIG?B^ zpVRJxgrZP7h(u{5Z5i+t^6{~_Z#u63usawEOs$8(qXMNvGT^?drj=jk6h%wpnwER) znfCl1Z-720-^>iG6**W2ECul)G66h_-3S|YAX`G84`Q~VR$I^ObXRQg*vbqqH#A(bum7}P4{A{-X2?rQVwlj~^Zi<893Ax@CVRE9kT`b0`JXv^>_dNF17-37`kX~>z4Y^-M0 zCcQW1(kZ+FjRlC$iGMKe2M2~5UER|3dp!hmb2A&Qo)TQ!q;vz&cFIVMZ0u%%rJxcp zSW-hShOohR6`M5IY>DA^x0YB0hxhwUN%RQM77wSL47cyu^7ltgAL`>e9-jsox>T4E zwdjOX>oJuyB1IaynQ4EL7Iv$lk4QDi`Q0J8k>wD&OcU}5^yazES%#%#89kY83RHQS zcA=HW@a$tbIHIyuE!A4Z3AOA1cRn~p_2dH7T-)#EW{ZRF*32r6#J`E|cG6^2HoMBFfx|< z=1W$Q&m_b{{TU&QQDGE_bai!qzQ1U!0)WyLtMyjk&ymN<$$I?+}#HNUd+#m6K|8h3)_%#nfZz4W zwJSAMeDIb~-izu(97*;ef$+FQZvOJCjQ|$dFHTl)dGEm)u`UV$)G8^77j3L$16KG1Z!Y+NFqqFWw#Ll}(_nA6K{P~kA z^>pDW6_&iliSg@j={sLN=NSjZ`eXN{o?WuyifL~v;^B7h>*MuMoYK%JaB*UCb2As01o1jrPb&m?sD7#V>0J48lCF4m%R1$&NKSoT>C0Pae4T8=%l zez)CGrZ0=p7<~>%=rs#%S~U zDrG}KkGs{Tvm0iqXIvoH{_`*IfmJ@z6?=(QR!ur?sQEsQZHAlk!3ZDR_jWsbw4@(d zdK`iYvnO21IYHf_dRfiCE{~GIa{v5X3|HA9(hT{2`xxZf2@7_AEu*Y zu0kQ3&FoXTSMiFdPi@Q<$qC(fhU(0_9QL`S6rJtGHl&R1-cUosUXN5~;)J83oU(?L zn*GdBznlQCf+dc}U4~MYvy6(HkB*MDm4{2`USAG@eMYbivRGS5F`c(yr>P?!Rucy z+!SaPNupOj*ivP~L6+Yt;ggnrK(_p7)SpGEhW6qL>7ogdqtXhk@ptxwm!ICJ5>1gm)EGb;( z=X&`pwkg{ZUxEK-Yt!7je=evZ-eaNhpx61B8xq_({R)xh$+<@m+*&-F#& zdGS3$MEu$hmdIN#ju`0ZQ#dq4gU;=RE0L`bQ?TmjVDL`AbEg}ebl9H?W`2Gzh{&>{ z#q7H7lf%Y!&gf&IBqHXX-etZxMxb~>8~i75DyZ(M@`W}-YAzb&jGL!wVf1Ry$7IadJBVC&cnjU1ImDk5TtxMffy zu$IENqq+8Xoso;fJcymgXosuIXEF*@u~3s}1?}33LnBsV7tC4s6lx?SP(mW!0Y1%x z{hWv@-BBzkQFm4<{dgX#0#BiMImT?b6kwG`-Y9L-()f-JACEL|)?|xbkb7D00L@TLIC(} zlvH2s#)A{7)O&&g=gZ40^+2QeVKlm28{Q(HKq8DS;zpFii0OcjOvyOi(qe4>yMO=X zvu>RZgm2=CloUn^2|X=uWDTjDrj&o*5BHljq@C(5)<-;+Al9nI*83i0iOirtON;I0 zSlD<=7J*Pm(F|NK&aQb!`!I6RT5os3Am|^T;&jQfsz;K9n=V4|dHj(7xRti)0*P!? z^SPx#s4y^Y++UCQL>S4zzLh|X2%n!RvbJ4gekcqY$9xwtd&{VXqP9hULfY&_b?MzL}Wt_1az2MFBXY$J}tgLVegte|J=GXIZm|2!~4kq5+ZsQNhZ`jQA*1{ zyi26Ci_7Jthn@(%K!YK4Bn|GT77=O274_*2@4Y3Rhi9>f?nkCCuC9`JUDPkh(HgG) zljm~HoYrh9KIZ}a$A_8jzIYMxF%|yChi{I<2OArD4in{~p}ziV^zmG4Wo48ANoS~Fne*#J zv;u!mT`^~xKb!1lWokAWf!J$aQWw1TL(28%OO2D0RmC^&ai^+8e`0q>6WapaKR$fy zYZWVRgklyNI8FtLkQ~UScL<7}pz*|r#B5-fD0e&~V6gZ7$;r^2&Vbi=5(K_Hh&j!c@?&TbOlTpBOp{Av^-#VhY_od5 zgs%^UVSh5El|Gl7c&o+S0?R}LpFgB1VNAWHcm3zQZS$gh&D7*%SBg}jZ<~UKx@sMT z&eN%}ujK?WESwed^@l^v^W{eCw7c5h{ME{oUgq|sz^T@OZM@BI9|b|FYQOis;6OHGTm zJ-5->(-+@aa-@==2PAOm;^h9>HN0*;?$z6x+DPegD@#8^`A<>6-qT7#LWL!oixN@h z<89*3TP_MK-S9RwNvA^?e$A1iy{k+4{1E-xFxc}yurXbFFJx>ldU$DRL{ZZ{g6-Kk z0am{DA;9y2l7aZJpyH_ly>fq1BT}9HpXaMl?963$gU}CqT_;rGGdO)YqS*16tsXaa zCdRKkCn&NTieRAS*}_)lA(rL;Q*!?U?*yV4yRBWW zcRW7chkGPvWMl;N^>K2x?Iyyx=n@hTB)x?r6#?<0SfYI>Od7cV7hT*9r2^T0rlO)E zOY_Af5+MQuPeJlk>K(FW2OK1 zE)YvQ&w2v|dqSSimBGD+X!~C|88|MLMat*I{wwN~KopGg-<_yP;;rQh+X;^oiCl(+ z?|2vB_y=>}pmtRSB#nXLaRB*mC@f*NK+zd+H)f6xv=N`%vCInFj}=z3)LXe8m6;=s z8zUa(+zRSRW%;NRlOX|HROno{Qhi^qtP~Z*TxZuhzg)+r!R^*oyp7qJ4b`hORn!x!u%VClk3RURG1 z65q_s?Ee0~|Mdu;<>%G{wy?19%ggQ{xJ(60(4P^%xIS~t83!xxlaTEyItp{ELXv6S+HFSj=VQ%vcsC+?qf=4=H;*}m4JFQNwl zy*Y*c0n6Q*c1(aJYve%3^&pebNJOy=Yb^P6f7AUa!~T5Qpw2%x_%REMi%5JF%w#u6 zFgM}*htmY*)vO(fA~ZkyBKy2Z=+2sb&_wWb?l+kkHRR%IL(5~tDA76OnnWnlY%4WXGH57Lw5ZT-yurHQ)amc84H@0w30@x$6Z58R z7?9AHDoIuAH7E|@CE(f;#KN(n)`M(WB?d+)8Q$twp~d(Aa2RtaQYhm z%LIFK1wU*KO{w16_WqD`_57MGJx27|2Zn14Qh~RA0XjzYlRkt<+y1S0($&(=&NuLz z?Lv>5Hf1ST0xjx$!;#?N;J|)tYhx&BR&mml3A|dmv&k8C=~)gG#m&YS<gX|q;V)o9R>oM1`ecygRqQAZ0NpqQ(RcNa5r-;9}6^VIm?`p590zYoY z8>}1@7AkFB>j?#Y7@uZmHku~9keJT?^3jxB?skB`WbnFq=9Bma_VfsgxZyMS*$A2Hg&nXLpBybjab+QPmpuZt3I zz~W`#7hor@JS8e@v=1Env+cbFDFZJZt-hl2e*^A@0c>}wXsP;&n!*AL3w9)A&z~<< z_Aqb|h){ky>vH?rY;-w@SngrkJcuc*tf`Wbm6@u3Wu`>BOnQz4-W1z~{(lLi!0g-y z_eU&SOyHV-bT}G=q@Kb1EdddDSw&$^#=L6iPOyY0b_fjiPgmkV8kX)`{~i*@{I)&# z$9gutyti0&S1kL~qVG6zVBL>J!HK!qxjaQI=bBDAbUS6=3i0;_ty&{? zvm{8#a?+$Kb2#tt1se>q=y58D$E$5#!0Oyc2x+Fsoqlt6Ed10^@3&WAoe@`Dl2QGF z`{~xm$lUf^o}{K7Kmu-fZ8}d<{8-YBCnpI3NZ+9XDL~S6qC7m14Cv}R#qM_csfWF22R`9D`MSUUD>(0!fc^Hg|QqJs;Q!qd(X#+&7Eonn>bM@r%Fg+PVnVWY~ zbn-&Ky-Ge_I^D(VjFrQK7F$YodMPHS!vSDqLGz}`dxu&62}laPySsFg#`MTMe7zw(0tQ4N$kofCoBs8lErq9Cv;*{&<}E zGoKr|LNHh1dG(#(rz;q_X-#pij>Rwix!13Mf-_`DN(q6`>_i4Qag6^WJ1prqq>Grc;7G)aRgtSs%#+!RkX2&JAxagivJyThkfpNd1XsDAU&_Y|=lk!Za(}JM2ytlbOESkPCQrXA}#< z&pS&N-x)$rKK;)IdmWeDXGi~7N5zk4E~2zd`y0k6V#eS4uKrqbFm>r8<*fXPM(6ju zum<*LSPq53CL|=>sH=;zB5=@mVQ>(KZtzdb*_!C7(P@kRhK-5Ljg4)ASJ3b7=IQD3 zWy3{K!Tsk7jJKu(;T!3C#@u8@A9sy8NIYH)=bd9WO#=LaUyw6bd+O?uO)jZ0+cuMN7$*nDaSo z4j5OpKoc-xllny4Z1}MVlx(mLB*cFE{8uBqj}rzE85>aO{3b!6#{dFs3kxA=Y*mQK zA~_k0GDx9ckFBC?$$(4cT#{X#+|Tpv^R9oGy>_9os2E%;tu&q)woUS64t z86_idUe7a$32{rJRfvCIsp|Y$ zPQSWV!F3;B6#f5(%$HG1Ad9|`U)6*S&Mr2qj7*1h%?aL17V&UWSKD6-~cD1TqG zyKhzZ2lO^<5>sQS5m~Ik3!F z#Rv8Xf;+P(k76n34_Bm#^()1qMEc1DU%4gatr(_ zzPvcA!Wzx_jNvj@_@)5yG5&PZ7fRFweww<*fT6!(z?*J%S5uD62a#P`Av6|%?!VIn zg$N4qQ&)d(4gML4-4&!zN362cFZ_7$)411jTmr1|*W1npME)xyYLGyqlTGV)RYTzh z_%H!HP3-|mVD9nC%-8XZ#5Vx{#4QR$qUakmN0@Y;do-}@9q@1SD*-?a^f7>9^c*2ith{pnc_eHiRdqHyxSoHlU&(-=@e zR}=>kDZVgobP^OmX$fwlg@F32HbnjGl@ygl1n=Ae>Q0CE$5$!G4qkuEl5bLW1h3P7B@n+aJaCm{iDWW3* z``@v4H%Nm-$W-UKTAi$ZzuPG9ITPgN5TWWWz%8+@s1JIKZuV%ej7#mg@Cdvh$A%3j z({Mn+?_0a<+JJrpCPqLK1P|@O>ONhTxsEA+S2X2~z1WCM~^RBQZJ&~1qH zVNo&)ghq&u^_tRP5tCp%O+Vn(Qevj~d(Pd=zzU8uy+|n@BJ#=}{`^TfV`@?WEU#?pq!bjS z{8h*V(^iDVmz^T z7Q5R834|Wo2!YX=!L^n3=KVix?#e!JazQs9l3_ zVJnVU93NC(e(5{-aMJZZb9%>td@ova@a10}9zN9F0Jo|jRD*lHM!ApS-~O!Zvy1~` zl<HFPL};Dem{8YK~ClRBWmh4)VK)K81;K8Wnh9;776 z_VV)g;auPJTYFIrrBZMq?y+2m1Jwc3omoVR9bu_KpPH-*^G<~o-udnB6DcPxr*IR> zwh%?0cwN}@a!!J%cf;ARhQ`85RrAP?pRB_)WL(73+;Afo-u-|Db|-DuWPNioam1yx zr|c(p?@IpR{}4YNshkDMH5^J%YsA6pb6uv^I6&vM7PJGEN!?vnSqpM+a=qO!TGqqA z5`1@m*}3i|49|CGM;YYo=>@)nNP~O3$~R!7&|fA-I_o~vY~)EK;JiPrCHh0j&=51^ zg2()>6*jiL?mHl-I;J~?%@9F6>G9zfjYwvD=HDQz+zOozj;t!?h&hWS8->`PvYT-} zBJv7_!WPHpMIZ1cuw;mY(MCD8?szFheIAd;#3hF`zFb^!ZimKDk6)CO3mBJ2js{h$ z%Si?KvZzt!rsctQ+VL%_4bw7Aj@E}0jS`rS>;L3sCpJk_sea&`2X!(-`m_5};;4s+ z87~MVV3eDbD@5!eOy@!8M%l=ak0lRNG3&OOty*gv&{p0|eU;vi=nEwke};j)sFPvE zM#L8)51K4SJYDgtS_mX7B!?ZicCl5(O_*b0V*WcmR<8o| z6GEDFKhM4YmM5rC%H^7YopY-Gejk3Hh!V5(lLL#Aq;I#atcj8sQvM64!7Z^%3=@<@ zOB%VbC3$K(B+(Aeuz`<5qlir{t4*0MW>;yAPC8=Gq)mf*%fnD0L1ugto$&-!*==?_ zw}~WIrA547G&`;AXIQd->R1X8vng9{%ygLayevo02R~y2 zFDwA=%5h*u8vv^F06jJeAyA+Ta@XduWe;~jS$D2sVA;%QEE0^or?8L=sL>;6ca?w& zE-b}?19n|7Rs^O!)=nICUwN^A%jaXnTfh*HTjpII6)%m~sFiuc7+>v6O#E?=RP%?32sMu&Q6ihM}>#(kGc_bJO&-dX&u z&sjfOk68ohA1D(`P*_*X+n&u>rLO2G!{!u8i8dP4e9*&AqSvk~cK7Jv;}62TRbCaO zLAqFK`b^4smnX<-V&5vczG<+$065Y;wBVuibje6k!u>- zsw6b0C+9T-sFO(I(s*>Pi>YuENU<5rI0{&t%UaQdmW&*vOX#MluYBOt3O5w;l5Amd z3nQ8f?HpVyXia4@&2U(b#+Jb~bIgB`3xu5}%`tThlpMRZ%Qz48XE2s)3G#szF|;0z ze9KyW6DHak`z4}wW0(>l(qF%2hfPjIl%)md`--`+NK=c`E}`N%7s9Qmsl7}U#_A0P z7PsOz3JUTTia5>RRIJ3)a3}_(P6p(k;bWz+R@D1Xcp4+# zej+MfIzmN`rq6fd>c!vy`wJVX{-PVM%pSYu=HyP8vw-Pgr!ykCT zXdMFX-V^X$3~CeBc8?K$Eg(@IcQ^vauSiF@Ae^Wu{*zFqZX4->pzM5bwKe^ z7V~3F(8U$`jUE9`TK0Qx9~&^w7{DzZMs93OmMlU8C8v)AhQtK*+N~->cqco^;0SPpS???%!X6~$Xl zM*t5N{my$=mVl-o4MwIhF9?*IoiuI+l>`fAi-!uia;2`qJ7kmltK9J6paj3 zj!D59P+k@}ZwI&7SV^}RmRo-JrBX_T@S?%=3e2XPa|kh6l2oeJ5d1Enh69KS+uub zu?z$1UG|nAAGku2Y}lO_g&Ioj9D1;RrvQ=>U24pWA7A{O`MrfR3ihbg;wwoRY99Qy zdE=|AHj<3$z+MrNP$Ki?XWg;BQ109XuPR)^@pz(@+h8+!;T(3T++Pl%d?Y+fcpX2i zSmxxYPIn=2zyt{NjgP*MX76KAU4m)f2l-EKBN|XG8SmPHb#Jlp&o{n$g-UFcU_&rt zQ)Lni+bViro}5HyRu>j6NM+r1IUYo`=I(UEB}8l#_qNv7!NN6ew58TYHH)`x#p|    ~i5lpT5&@n*uI9q_il^f;c6K(t zfWMFLPJ3G$WXU{92X43=CkqQj%_)Z$8?G2cI<&S5i5@!5fQPHQYrxWOObhY#)<1(w z0e~XrC}mE3w$L=m?M((taAc^Kn?dBpEIqt!fKebB5tmM17g23*sR5&CL>JM9mAW-wN7%VTiCw3QVte}DgR@b?Pln7PYf6K3hOd^oxewk3=h z66A~AK8)hoz*C4XRaLZj2>`eI{{!Yg8NW^S(EekI+n1P`8_a=~loT@w)vmqtWKeb8jNl|ZT$ zpJSMyHa{K#`F5+ntqlYLh}hDt6SWUdRAX>Hk0L7&T+PkRO-@c8I&>)b=3%i|Frg(+ zqVz(VRY^%PJ*xl&84MrnQB_@Y=gyrqYu13Rj{o1Yii!%LDDL9s$>ajn83bPh5&)nX z&80w`V$i^W|B5TeZ^MsSI;)QVGOXuxac50_h<`9$Z~RY-2SK8p{|afpI|=f@`rVLx zMuR@H2Zl!+O=Jm?gx$lHmZg26wE8(>>#x3--yhExce8CfVnnMD+sFx zZveLk{PezlS%5AJh`xWVArO84>K*WPGhVSA#Qw{}{9jZDx&V?By%fv_zrM5tR058C zS*;M71pJKO1gPl`Ccp)ennK~5u^q7Gc5 zmSn#>iJcCP#yGgFE%WKgvp0gn!V(L)CT=!rywb4fdOZtW{3}h!x=Q1d$~rn*TACY5 zD=1nG(z^q zAFx%qpjFVxkxaC}fmx%^a^L)rtVFLF43cC3MOH4C$Ki0<94@QpUyz~5+S(c{NB*nc zq4b>G9Bi~+#CzeahEJV3)>RqGc=WGm_Ro`E&q~xkt%R)lb_l$f(~=bi9RB@Gw35}t zvEwI>a@5H`fA+?cGO3{MS!9)xCNC5UQSACQHLt1pFquh_^61-uJrRyr;7g4jFeFk`Ya|YHX$}H_DOI?yIj}e z&mw4yJAOD>-O_>T>-8umKRqrYmZCmthFR`YpYrO$E6=0Fjsq=W1$S=T%PUH~A4eTH zYa~0}Kc=)SIwU+tW;}efM)LhzrQCnhG3XqKKtCZM2K$1gu)q0%N##?{^72 VjcS zj2=B^^k2)^v17Hhwfo74KxXuR0+4sz|HtU7w@^NR-#D79?BIx{ zTxw0X1Sae#Yi9GIJ2?|8{)^7>3fvPp;yAi4_DJ3u%3WnDm zJ?lGA|I)!)%3>0XT?p;N+K=XnKqxWCdQl^YGsJ{cAQ}ZY66NYKhxu7;#|Lvkq zdRKLBLSlmN-TMy%tKfJLW7hNd4TE)8#nIfBuCgW6b>uUp7$sy!$gN-Z@89>!^IEf6 zE~-4?OFbVcw>9|EPnUdyLSnOvg%Skv%@6N*lhN~r(DolZc#q;aYN)G%n5s@D0KHed zvStTesH#8&ufqZ&x(U|$M23bE_!Xw8q1V*X0T*#p6i_gk6sxFCrO2n}paK#23J8F3 ztFErD%F0S2kW_x9fS7k`7qz~&j>Te0K(216Km@*R0+0vxZI6F{=)K%C;>&OZb!^?m z(Dvy+U*0l!gvCH>ZcA-SqoRe8Obo*-gWMl#$^;A&Y#J0waD%3Pe{`co_~n>t8lPXE z@%VB$%t{3(ttyT$6&j$6gObG~>K5%H;>=EuxTxMZZv)$&|p2>khNLPdI z)WA!B6i)kb!~AgrNoe4@$s@PmNGyo^iieH-W!vTrdrxn*m*f`~(_|V$rmo$vVZ-8~ z*5HA?Hvp_JUPUUFVYQUOQl(IWeI;~Q1~xIu-8rK3l#Lr#Od(YUgi>{v&0n(2swFZl zj}24mVuGkHEQitoBpX}8uUyDg+J1JYs~!$VRB3LP=k8^+H5=;dz)(aQTLeQO1vH9= z=3izD`opL|Hb4a4mjIA>0P|Z{u3RZCEftAGXU?1fGhr{cd4XMnK#r2dVuD?h&?@Bn zvW1TS`UpTC*w;6vUs{i(U{Z)|>2BT}9Yu5a<;EkQKhB=^kBz%^?fVhtBp6q~qIY+7 z@j$P*JRXO~<8xSaI*(*Fc-kOtdPqW2T0%@Yhh#8NuPmLaW-;1Hy__v1DC(-IsS4Sw z^pvE8w7Oc5?+84V^FXQ~QEAL`CP8b+I8V<3Zj0xcXUAnXQ@iQiv_Gjy1Z=htiQrYn zWzlfvc1XVs2QM7+@-C$@z@H6}6p6zTA<=@S%);s>rnaSrr?aJv(@0oJ@R5rb5Brtb zIk^q8G;4Tx^~U9sCEbHuU~#**T*McW&M%>q(;#%hvmOA>hr5nGzeq}Df4# z)s@2EiRI&4zG1c4E!Cey1pWkWN2+}Wp1pa-ZupWGPS8_8CaT-JBu5T#twtrt?KfM(KeoQ zMvQi_H8(Lcv$C|XFop-8xZjL3bhJ_fV}(*PcT!^Kmo;d*&0jfdu)cu~tf8c+TsUIo z8g~sDPm!RAlF%6}DM@GG;1TB7_OzsG&@-q^(tQlpT`x?^LhPo6Lf3&9hcvWW>$0t2l`xLi(nxHvSFUR=xq`+anDkUg;n zP=N^iKY`cOC?HMzZ~7wn{EDmzObH6NcVu724Q@+uZeCrte7%ogXLD>*`WuGSfYKj0_Fm&@Y*=yQ7oN=1brhZBv8)f8G)cxO^d;K*B@r+kbpj{FlwW zrpOA7^?wN;YU>{e5OnQ^OqtqKM)za)3-ki5uB8sSU(f{&5qOON@Vd0Lw7^tT?^Z`J zF{Y!V^Ofu}L7@arPJ*s3B%7^aObG&IzCdX8PUPD5S&jnH^ZHrZ(6ser)1fNQ2j506~Uc+Ibp2)Jw(?=^{z z>Im=i$HE}B=J&b|zo3I559|vXtgqbEu8bHz?@QN`x?r%@h$rDOG2wn81wA(@QB_vd z)5!Ao?0;8$cuXmUU#^rBH z?|$Sjx{wtV%oi{295JGc$%Iu_DijwJ;^O$>;m;czn@5b8x^}IBme$)k2)t7y5+(w7 zG_=*mos)@`!L>pdr{vkT!-#;9#}sem~YQ4Nl_Ji+{!t|6&WlcLV?sHVNd8y zW8I_JMF25j;^yL{nE3QIo|wyMsqL0O848)zwaqQ94fXkH@o{Mt^gkaV#c*Y-d24on zJK4$&zl}yS8tUmVQD<&aY1R^geSy@aNYj!K1hGpVklM-6hDzIB#+TY}e_OPNNFj-;;8OTl&TH#X4G{gnXZ zf%Vss`PS@W7grH+ZX;K@D`X{9a&aJgc29Yc{s-)XL^tQ2J#prc&)Flt-1CbJyt?bq zb0JKWeB!|IW&4puhBDM5D+pA2cImgiKoGiu}geXa!uKf8KAI59o)=*F#wPTot% zZ~5XM-oLfW3F_~EP5=acfd$9EDPr+oldb;e7Ji%tg+k(!CyMd$GB#TQfdF?KnLyxD zS}M%T6a3>OpL~^8ZUvhnl^|@i5X}Yk3}$zA6_=z>R>Z-jFgQX)X(?%CGO0CH0+N}A zp^34UmWG*|fhwc1p}L#ZQB%dl=~*hhNZ$Q%x&+no*$6-$*k?lzHT;5r+{@zCSEk=N zcX02HGybvB38gYTMt*7bO+6uik}8&0d;P-e9l4FJC%Cp!>zX zaf7jA2d<_DqoB~>=0-6$=Zi$JxH$2lL)DRy{I{oClF1}OozPZJ zFP&O9%-~BW3EAIE0P?_~E8%k!fCKkNkXhHEG2-VfYZh);yHvdVz-*$uxtWo!fn2zP3d5stxEIrA0zTGY z#)|DbcI-IqwFlXmmzYxnQ?vw8vKX=wQ6?1#rEnS8!-PR2C1L>|sI?+syzWl8rPH`2 zOPBBZec!sNb_6vovJ(1p1A^Lz2tWk-1p(pBo1A_7WSyNj0-?moDR0>_%1=MR?CmKM zNoRb#=;+agpddC+E+75>g`lh=p(XB_GjsNe%PPx%`F^GW4(q;QyYr*fQ$SgBBV0<< z(9|HQXt@9QlZDrk3E<6jUYRByp0IYGrANaIC#|0C)VOBSlqoZoo{WN4A^XMk@Zm;4 z9@vL7glhO80`l-wVPkGmzU8d>!$*#qx^$Wbto-S-JibiGL?{^{8iJ1=y8a{=_?tJAtgXS+JEyp~`q{Jg zw$}tD`lu=BkH3%>=jZKx%lq>B$&NjGU<8Lbzdnh0?CtG+V$n#4DXV_@W1%Vx=dkEd zK-fd@=CK7%s`iu528Q3;I0jA7UwZUr&?9eeuXEoG)&I7K;_K->a?Pq0tsOKs7spR3 zPu!b{;?)9z2Eea08jVh;J2^RhJw(5#p7aMze2^@As5YRc?donq0#5`8q9RUFS<7VD zXg5P`n{m@!c(tWmtsy@y8)<1{C#}!RZdF^dcCDK>rn|P1g3z2YWt=(|rJ`+UVxWvf zVU)ED%#74}9xMyIh$L<{|&+YSGr7QL3;?ps+H=bWR?9J*s?^PRgFhl?%@PP!toxHQN z^KDP^;Lm|N2@}KAyW$_S*{uCb)WipTfY4cOOiWo-mDTw1mL?`IiP34a;(&m5nQZ8+ zS(+*;A4n29{VOK$x+XpYK>~>(pw0GQ@sRiXuDuA{dLKg-9j0G7dv@7S$o+aBYS6I| z0f@i{5J17UB2hjZ%Pep#ebDNaX>gWuuLVkM4Y_vv;q&5hxSqKY>5Yp5@+0ZZC7C5GU451J zn$~ZMdVJ-ce{6Lo$0j5s6}DiEZS{%oW!c-WVrFY;dJzNk z^u@kTL3w3a7p1*6pQdP{4%S7eRVBqG3^ha5-UW|$DB_lif|6#Lz7`2=X06OGY~|pY zr4KIO4oS_UeopecX-B7ZW%HWo2Ho-`>l)Z&y_9D2efYocCT%PI2(r9k=oj%E}5I<@fg9 zD0_RxkcRwNzwnB`?Mqv*Z)j2T%PJ(*nUVg_>p)^-Wo39q(4D8x|FY?+r8w?UP|1r5 z*-4?{sih!=z&jOcMZEWebpDHD#kJ89sachkB>@+sd#aE%rpG+-PJi=0t~a+JEKLse z4J+&UkeM197?RS2#*vhjF~z=NsRiB2iXkeFdcsM_Rg zq3NPucg!A)X$khLHXCh5Z)xqMump_e@~V0Y3#p=}z@c~1+Zsx%oA?+N6(R~IVV4)> z*EX|>TEtc`dm|+hWwcHnUR6aHa_*Mm!d*KTkM$Td%H7I9MGeiUDJ`vSqH<6wstRBd zsI4}?tg2Z=R6((8@+*b<+LDGA9#LHdhk!BLN(;*BSSUp`g}(&M_S!7tH$1-RZ}HQi zpJogjIBb-QxsJNFqOiT9psXI$ri6phs9m(y+VWb8jDRl-x#}Iu9yZFEgyq&1F{it;v%aRXkq*Nl8*d)D)23+UZll>VpC@jtD3_Qn+VR5_507C6)ZDBR+{jUS z&1HENjSQ3usVeN+_0aCY!!0F3PD@iw2OVK#X{wB4Ru&Z1bP5zTm1O`C6GkAS#Z2%@ zghR8c3yN!+J49F&1gkoy1~+D`ZBMT_Q8$8UN**H|5k<)?*Ew#AFc_txu(m_lbG$}n zP8o%Z(NF;ihS~MS`IXH~jJi6QitB1AF0G(ol+^oD6~IJ|rG*rf&2Tr6i3QhGoKMG_ zPMR>v-D3!`mTEj@#o7gfO%07K9X$pZ5xbggvmB6fAx$G`K`+vokxK&`)pz_&05#^>`v1oPhu&qAL<1pc1@n0@F?lls~m7;@#x z6|J2#$OHQ}@2j7}0|Q$+vO!kuw6s;LR(X1QYWEadTU!$olhDvmu#-nmPY<|aJsub$ zxj`gDqK6sb+6p3lBhs1drtsJfqcLWA_b*=e&*X5#lCG>L;fc`+wMYeN_{EctqSI62 z1D-5<>%0D}~JR z=Sd}8$FajOMc&u_<1!11s`*Ni62JWi9u!t(ggs4bqHroxqsrl?Q^q;;t~Pd6#y@-< zOY5%B%1cRY;t!lSf!ylvzm-wG^13BjLu~Cn5g%NIeU3oBs{psEoXVVu7{^yx#l3vCxd_KHrN_$s-WkEBr`RPT(}0ZW-s`GN_23mzDFwgi7lp#l+jUjn`E z*Z+H92%!X8gZzT;di~9G5bwogGJyv+dh}@EX}xM5m=7B@YE))sCX2;-u@)(U!CAeT zhY$!EpWWTw-cA!T`AiO-uP|rr?p@oL*_vCa67cZO?9}vZmQ;E0y5kT1t_;D|Jb&ir zU#NQgq3^?>(^D*!nKZG^&^5qy*gg(dn4H7Mg2}8`3Pw@a(OHRrm$c?)#fRJrEFHDU z=ix)&y>kX2=q!o4$8Q&IJvuv`mm3`F?d26s2X10V$fa8kGJECq>BZ0XY+AqnX_4IL zlBX9&!vEa5!VZ6&Aa*_A|I}|1rad?yUx3q}wdeXn|6lbPO{$(V7OvSi!J_5Z?mIu36DL$&YUD4hVdGoiM zsci%Tyfgar^-j}C^H%;iYp|ApqqTM4fpt?Iy7R-19uBA%5eTdj@7))9_5)Oi)Qs%H zigxyZS+00Rbv;{K0s&o`5mnLJ1tur^ZUbx<7B19KCW^&UnXJc|k_Wh;kZ^i&eih!% zX5PXv+QQM1rh6?2jW)fuJo_WzQ5YQ)dp$5yB9kbPMQo-}*#(;364@Dl4Tq|&cwLYV_o(%lG}h zaeyX@CzQevNP>}tx+Xy&ln9wrw$yC&`aq@{CpcfBk;q*l{bj%qCV9N9W|z#J$!ExiY1}v$q0k4;(nYYPu_u`!dYzZI_gg zEmImgXB#+S`<$TwyS&d5KF~q>c-J6Q6GY%s5df3-;P%y181f%RUjZ*T95#?cdl_Q! zsVso%{kjOeR|xXg)pe*hpMU`H|9h9f-zYB!=9WMd1z7s*`HPQ$i3Korm;42o0)x}C zVjnzu{P@hBOqhwgvXIK;3E?6voet;l1kEk1MjnsLV6pk&ToIGOQ!{t9=ldNw_3-ie z3x|F>lh?uFa>0z1Ovq+%Wd_4X8b@5bbk*na;|pgG|9-Qq1IJ;*xjbHD6Sa}#IN7qn z_r#&ckMAB>y6b6b9g7QG5is?{?BuBqo#J95Yhv+OCG{O`ELpE#fYY=dH+lMKTe-sk zCzuZ#uKD=rY4696@BeY^=;34o2SQWao;$ZMg*S4{UGzj9U2KqmSR!Dvg*ZI7E+I6x z!+82MWo`|HCulEj;mX8322&n-FXnOB5(H6P5g(k`+2_-M^EfmLMeZxXb)3|2-31KC z=>~|#7M`#pzlBR6iQBWDr{py-`8<(Oz+th`1|HK!py*ZIJWf+?BM&4P@EoFA;2S5l z^&o&2y0J8#NZLiK>*UY`JkHC60g74}A+EWSiqbSQwQh>?j|h(p3T@{b4Og#!6qQ$n zRU~$EFgoMMsPXGNc>K1!HXgmcIO%S_SWO)*tfw>j%oX$5UDTee1277e(%l0R6q$g{ zHF6m|+8x&tpO{uf!wmc3hlS(qQPlL9%p#(t+t`sK$4?x_sESF>Z#9~= zbir6#RYl;2s3X9c1l=){rYMR^1EO+qj^pQ!wf@RSr(bzI$-*bOUD?9C1eXLeIgPL!>GFt1lkL=e1pMr=Xh2nK1r!Y4PQ9hRaZ$_ zL(kMe33#gt`c{L?#Z|>zlc7$kJu8H81X4-U(9B2$4uca3D5AE(s3{Y>@&n@X1+McJ zOm$OZmz6V=EFGP!txYsBNW7`Tpix83a-#z?+m$9RnQ2Wzq0}^paKq6P256JWmiCJE z=@EGyT&qE2#tgJJ)H5_UQSXu2CaX5)7qIQ0Ss`T3dq|ai~B9-b~<1D7!K&)&>OgWcE-tR1prEp{68xKz zk^&x)Cr_SiW@ZN3>TRM&4-9OelWXF4*QWbEd>S2}SjfT}o9O^4s`n}Un&Of+4o*Y) z&&Nu7c9i#nr*Y-gNIi2s;v1B`dh2JlRpwW+wRM!xWD{?z+kZG7ny+HXuUv8t*Wc1)qoAEXjNt4t8pq4OV|Xm z(%X5yUXP?JH>+BvpiIJn9SLpOd7W4^BjL%-XVF=CML8+)i5YD$cys)d!060^yv($e z#Po8QiYhlh@_t}=QgUWHOyA6a3@*@y%pk7^L3vcZrMXF0RS}DzKt{in(EE-Abo@sl z@YSzEg1co^bq$e7($ZA3voWu#Z6@K-ofH~Ko6TafxLh8%l~So))>am80gir-aESQZn0P*p`^sz z{r&j4yJ1lg&z^)9{2%?7)=8?f<3i&9BEer9ev0UF$ES88FiPs*4C)S81QmL@!!A<|% zCO#OvC*DtT+87;$!8gu^(`Ax|IKK;*GH4x1J~5@j_ZqYJuoyZNBJg(vdY)9_Xbi^I z#tg`VnHXr}aadg~bp{>i@UX#_qPLz5he^Z&u2|fVlv1s0W=-OR9ozB8-CU_uob2=K z72hI>gd1`G`0a#RT2u6Z&TUP(7nM?yA8};U?;wH} zheo0>C?M}5W#-=4ez{o4%Di^oFTR1>UGg;ic~bn-qfawsAUg?&Nrg&(CGhS~{{6KF zkX`+f0PwW%csvjQTeD^j@V!Qi7y%X^-{5}r87~owREE#kvU}IAgVW7h0}~s$?ADg% z`i9od=IY|&;);5?00NiIq_x%+mz1~Ad;As|ufDRlxU`-PLz0yhP`r+cl9H+xmK4TJ zd>U`LV&kEGyLRn8@$1H!x;Q?yzM{Ceq^hw`NTI6*{94+|7GX(bGKODQT~<=j%tspp-|cDk-dO=V6K1o^PP6F)OKzskZILZ@YHwx^VcH$)5UfMq3rI zqolg4#}FC6yAq^rtZ5e^@JdQ}q1?!_#;zWRO2%vey{YPTb9xMDFHMYZnDNI^!1L&V zeT(N0Qo_LTiW&yGs$kKV-3d%7X<~wzNGXd!?`*6rF0G|<*u`-H4+BzZ+!uQo1tme= zY>&YXN(3wh+dJQez>$c+WG=m-w79B^BX@!%+_rMiv(|2T&t$CHin7Z3u0J&f!S)6+ z$Tigyxv!$Eh=-$9%qOqh_3MF6GdyN(-?MAS!cjvet=hWt!0K@`maN{fd+X|V;Ci~?#0y66BAOIXN zkyLh;3B!_!A|abE-}lQ@RZ-B;P?h|xwiA|!ZZCSedB%*jM;qrKT&E3_%5b`q*Kc1u zQ7iF5o7?(5yLRn6G+()@G^LHLWMnt&`@LHZojKqD4=b)}i3o|SY;UM;X-+GsV9}*I z_M^9K|7qvWWkbz}ZCpFWLK6p9Ad>_ganGW2o0@9sTeHi`yJ=l$7}03x+_5gE&~$OX zz4oA0$bLIC|Ak?nVioeG-5}Tt$Wj2W3l#9;|CMrH$x4K6%YW`4ohy=bM#r`43^C02 zyL#n8QdbvG(2;yUAPP*+W0m0H7fwD5kBba_^gIXY>Y-ipaR0C80u#d0YTMZ|L0fuU zQhI8Le^8yWE;6qIF=N3PO}yN_A!(`-W$np#u6T#Xg~wK-&FobhAO61Yct~7oazYb9 zNst?xl2eit;uYMWJk(C9H1PJ>C(pCu>v)>Rrh23|+`HIK8UFq$bYW+4K~`dXmdJ3B zn?mrRLw`K;i%LeRx@r)De&6dI7aJE;(Nr0kQYNq)JzSx}=aNrILS}B6#MDWZ7JBvj zbN5pc3+h>ho=b+A0( zi4MtTiNuVi%B=L{=g_@g+hjrKkaGuiNDBbs;c1Bc%S(mA@8Jp%X4{E#BJE;{wjg@@6Rv2jv+XF`6!DX+k^__8*fkskcH z&+ixSKK08IkgXi8lzW^@YTRRx__DdJwzME6F`)`QZpuIn9D)zD|DV(t&K;`Vw>m=4 z3r=Qg8N1kO!X=b=-)FhCT`lDxKLTd-)QPqlysG#+Avr9D0O#p$ia?U7x#zRtBL^A( zi^bpn;%oJ7w(*UuLaHdMVlilY983WT=L-ZFGzNu4DG-U>bhcC?Vzb#+mTz8#WVIA# zX5-d*o!+=&hPy6MGNfleNyfO0a<`DCJPMOJj~i@BZcUFW$C}!z^0Tv;;}?xmq!k4Q zRy&SyFAvQ1*mL~owjWlHcSlq5Q3G1aHetj|uVd&l$4b+u#4m_VHGN4w^vO zWzQua-_w(sna@IR-|&iIsi>%Q23@#zC#^SNjZqqQVCUweFH&LyMSL~|%yNNJTGzrt z2rGQ<7dfwgW~5M)0fX*`Qs#uwqv_)m+(|okgXvH_g=XB zFpE3!w!i<8^}|)fqMlhZnFL7F!~b%RBw5*7+FPqA35$}Rg+)A0XSm-F_7A?k(E`P% z&{6jD_xnG+JzlLPCB*-aKZ2VPsw(`7yT2aG>{%g{?~#JPkiVC|A(6r05|K#4YYw`8 z{cf5FOx@KzICbrQYzNF>-tS)i4>v2f)oKi1xMbCuaTXv!k-T(MI<+)OC>Tlt1VdoG ziz`SV89@h0Fe})0b7oC()u@d1Id-!cqpE@~e0uHdgRqPmw7JE+MI*Fv;=V;fpn)%> z*H?jQGB8nAN9Rl6|F|XsN63Wq+Opi@YU%iOt33<}N@kP4-|`blSaS37v4fE{zznjQ zPA8QPeT^Uj|2+Y4Vas)7Btm)cghV2h$QRLp8Q{&oUl^ByFS``2qOGo?*t`8mCITCj zct9FZbLvXVyem64Z~p#RoXW^SBX!7PW_9AeT|2+qa2DbEgR6=0)Y+OL`*-iyzJ1T# zC@`lk5%57AKU&2ECw#W|;GM!&0ZPQ>U<@X&u+G16csnQ;pO$7tA3bm)w^`LxPZbFz zzWMJjly_?pT7`T!PS8=GmVkuIAPk(knYSA&Nqp*5_mQPn`TwAW-2 zi=N?oemq9~q%?vQS_I9bcnJo~|huO@T=I&^yZ)UC!5^`geuxNg3lR(|jW#FJ8 zt2b|3G0Cd;>w#9%b#!&N*H`MTkSoI2Oxbwm1Sn^I`F^q@y{SoPVydSF!)s{4&}db= zg}aw%HC4vt6}EB&AYcS63U<)7+y=P~8o6-yu7x^iAfhz@>|0X75rFDf&%F_Eq^Zbn z&1>y#KrCR>axZPT+>SQ!ba&Jw$hx{jSR)U4#J+*m=!HWywRG%EfbKqAs;DgKZtLP3 zcntL%G;#U{YV5tBm=G+R#lV3lF)lBW7c6{x=v$PZJ$f3E=elPt7@Pj z$@W7$22EeSVZ(w+6V@!A>8O&QoK`}i_x&{z31nJ>w;wq#r*&b+5IvFzShXshDHC~<`^Zjv0F~BH~%vzOMTX%U*`|g0hhDw?7e%o z&vSPlwszllBP>+--7;-Mr@=#AM=ajBZKE@oZX3Ss*r9E+oSmH=jJ0$fr))X7)(FgQ ztGaGDcXW=knX<-!@6T^>!r|=a|8{);3O8_^g+5tT%huk>b=sQE^T(@wu<*sVIoAI{ zuOScYKY$E1@s9++6iau0N?=G>*mb`=nVzGfu!{xq^)Mw=h5`v}j$=xixI8WsXySus zKM{+`S2K0AVm>^5H8||n%|F&1%WC8B`!wj7RBcqvP$zS(XPqI2m^9VF{k7g6Ycf$w%m05k=MAOiDvW zd`Xwdl!;0x21-RmSV2>8bTpBcoV@-t)Gs8snk(v=_(EEHxZ%6Ajvn$43ky5H;oz+& z*=$>t65^coP(G{XQK4oCJn{FnFJLQuN(yD zqU4^Bf}W$J8Rz`o>!7y#hfiNT^0p8J$%k)ais&4vn9JmXi9X=- zafDb5vo1ZUyuB}+Ox4i1yQ-sGhAt9VP?5A`-7m!%nZY?t1T)*g zMqC6&MJ(nua~MsL36=Fqdg{W?=K8*zP%sIHL8DN6exp#SbPn+8K#@sBpyfYR^Lu3U z`F%3_z#XSidrtvH%!+xqZ`H9&VPWBS6RVXyEP#_qYiF1kLK<@a__cx#_?QGh90iZZ zH#apJGRW20+8AwWen-h7Ld`;1OAUvX>FcX2C=f-WS1#(mHjYuyvUD~l|M@2utM6cI zpwYYS8)G+e`l3Y(hgiw8r3v{=hE!$T;y zfQK76Pn$Pou)d0#p`(?mJmvuBFlrh&Y|*#@dM0+$<}6w`cbthD6bAM&FN2R;7ZeBf zae01WwSCe!uzzHMLnD$Kz`P4`m=OVuVb|A}6_k`x@Xo8YE;dHNw2ZB-?9DLL~Ybbgb>bNvs?Cp$`-V*+E+VfuEXMva*^c}QzsU_?r__LN2Q$6Aw!8desXaH&Xy z(w;PP8jg{1Cm>N`J$mj0JK~#m5rK6F3|Ys807`0bSUzUKcR!7D zGRLw?!(y^EXZ)~vh8ZP2i)A!?!Cbfe&^r^acUuI`dcY91+Nj3~8I1_T`J3lkDG)Uc^)xh0 zCrqCRYfJD6O2@fOo;kt-BU7-nH6*|#0=U{hPYqgL8Q;X&R!4q&N2;mtf`Zy?M!35S zA#<9O60|rW&zr4?5=fV73gUJk;sV)hNwa^`v3SH`wtKJ>f^uw%ckbmrj{0Y zBKp?W?51|#nvS;iHl0qelc%)4u@NMR)X-2jGBo%=>fp&((ec~72kSPX!X;gLH%hFL!9S-KAk*t z{g?rA855}V8vtkeq5d1T+LkEEM47PU0qz999&(ToE#k>_v`B&{7=#|=qd7(V1+7u z2LcGNh6fX}VLf{Q8BKZqKDVx3z3P)t_#%S*9qQ;iM9^4SUe(kWdf)pVr#Sf@sLt0v zpYeC%rEE$a$WZ-H!Qp?gM1D$1YtJbXYExBlCFR`>edS0QqrIk}wEfRrN&>KBKu*9n zx8$u_WZ--mv#hYZmHy9aSnb6z*REdmex5}CxA{*HFpR32O79j;4wq8XSXG@{(bA`s z#;i;&?c}{R>g5eg1f2zWRScoL$6{7ecJs z_wU}idHt$Sa9ML}VU+(3(2c8i6DwFfbxK=uB5z!~_Bf>obgQ|loGyDG8~)W$K_@{3 zAOaA9PeA~R1N#(IznD5dcN~}`xkV_$84NQ*WqBXndnrpp2Vaw2)&$e_w0N&LYub~` zH*;BrgYCf%L3wG-di=|YaGF%er&c6Bt27)kP!s=VVd%P)`)B>=lgHbb-M* z-DAhwqG5uJK(B}C$O&>yuQ!yIvb2;^k-1Ti9_i}^UY&6FN-$@_7%O?xoVq(_&OJ(? zBGKH!$oO`Vp1rNsn>SX;D$gG9l^MHPYyaJ1M@M1A)nk6GC|Pq}QbD=;fWi776pkz5 z<~;YxkSNrg4QMyAwl@HZ6&074-$jfcWY)K}{vED)TJpZbac09kwFyXeb;yCsm97I- z$}=*H^OO9pXP``!5enMs{Hns5s<3lUYhYLcLCHj``})CKjVPjwRS}gYa2sXTo$~n7 zrDzUXQk0m~#xo$WBO<8!9xt}3zJn3aA)kuCw-5&g65Rr6LvY)K3Pj+&2!Qkny?Os2 zJ+M!81A^*(PXZDk^8iz@g~{hIBqD*zsM$LYA3S(srg`Jz_%S^kb*8>XB9;>ab>*7nW3JMAsQCo9;Z6k%>vrSLHYz0TQv-*-( zzQJ`uV#!L1y_)z+;00Fh+W>{I+WHo5Pwhf(M_p|boy)08e&*ws+|38?im0F;4edQL z^56(YQ(bi{O^7A*`bDyq?1Y?l!X|HE@xiP6e;#G80b_T8&ehhn$hGU`ePuV+f!}Bn z1eQ$3i5bAi`c7u=^bfZKbgqf=%CwlUDmR^?GwJk!gBLEHSuj=?50kOwU9RsE01JS= z1G~Mgp}vVK=rx$h;fcU2Zd-kAZA%xJTLS4*==84UW~$tFu;;TgFVf}*&Fs8JGgy?n-KwPGyBxZg9nfP;nrGQ z*V3AkTBtB|&7lJaubJt(Ge@CGL5%?Db-gZ$!b6}tF zM4eM~q}|qq!;bBwV<#Qkwr$(CJGRlWZQJVDwr%sT?>py=|Dx)u#;9FyZLGEST+cjT z`>yz!aMGu6cjQ@t3CA)GvYGV4OH+>!WZFZ?Sln>F1MQ;SjJCBgam+C4@)i;_#DTOt z36mnn2NU7;*}Lb)Kffwdx^~k)o_$9O_$%W~IQo`}hk=iO`AyNPu!)$gM3mKK>>W$S zt1Tg?1iXapx4+S37Ej2~9! ztN~!yTU=iE8q%)dY6=C9uaDa?o73e7nlbhYVtrb3 zcv~o5AN0~J=Mv~sn~SQku!C1jpcUex2{R2N-XH~z)GC)YZFO$nt*^|K%^?+5c@iGZ z2G=e*{$fRA=u@WcJWO#P!}{B4@OT|X?Z4QFDLZsr?u^yIb9eOg;*iCfvX845o`X-t zy)t8*>zigt2U_9!5QuSJK0-EXnTyAQ%8cM<25-n>I)k3 zK^D4C0TZgIjf8=aup|#OMAXF%dSrUL({B0>iO%qJh)!W-qjIG~wcDFb8-gYj( zmVX=K@7%U6AB?x-C@8hL-9AM-P22vn^SHc)sxuWt$&H$fx63`@09+G`0&W|n0wHf~ z!iMS=B&_#aVkll$UZPa}w!>~;!Tx@SBB-F9UI*^T;_Ol}H<#P3s^#?qO2gjk?Ptey zQ0nuZD1dV}oKOfRpKv$MrJr!-<;G;Ax((-jm+_03fsBKpB+i!0ZB1B>YlKqjxaPwk z!sNXUR~HQ#*GBNTVf#tD)rl^d7na%Yri1W+SH`)zJ6X?x(Y4M|HNhjye%A(X)?}zIsw&8Bt9u7K`y>X5Wu` z=54Fg-;`^dYa1}YPKq>EMvc+773#G)TWdZZwPrp%^+8^TaffBzJ13Z8BoGhB7l zd&&Nl4wIl2lU{AzNQh#@ZnmAQFUw-ddq=?QR1ptAf^;W!$#s86^G3;~=a-*;_nn&mD=*fVKxUhGsp=`@%kyuinUD)uG?J`B$ z*|w=qtF<(;s`N#0QV3?Q+PlEQ8tt+>T(aZZ@Q_Op6h#M6SA=z>uVHe!#;CG_9$$QU z#Q5s9X22foDc57U?HnZIaEUHz_vFk5%(B$i*WIdj87#W9f!3Errw~ayoj9_YKD0$S zIz>7>kywK2jBHJ!lR%v||XYKl56 z-M0n>y%UNk%20zFu!)WCE4A7DmZGo@JG5wf^hW04 z#J=nV(^;8SLZ3aO@1*!{X5-@GrF4Q70YzI$!vS@9Wy*h6Rj#?oVKEL%L%m>@f-_bV zC1G-a;{-*kqT<|B9eB`?HA^%(^iKeLCoLz8@WtOq>+-(8`Liqt?ydYaD zsws)_8OuN|ItW^d2OJxDf>pFLI-v)@$+;fD<0E&K|N z#pW|x>rFp^2w)f*GdiBaF$y2CSkbf!WN!QUXQ|O+UjFh{4Nn*Vqn-S7!tXiH`A2v( zakuHxrZM22WY1}qign(MgKdc0JK;x0gYUkv8jQMDil2M>+5>*`B)x5fOg>JuCi4ix ztBFU6azOBc~u^lHze#`rq?A$UNN#U0`QVAy6N4 zU|Y>XXNMZAa?xzo`3|#lQ{Rtm#>v99c+7`pDy`FfWUsb3ek! z(#>Vmf0~wp=&wlZXG${rWe@7Xns?^`P?0<6GZ&v|aF2e6**DAMomSUdN2~#91vNC~ zD~A}?B6-vL44cyoYN0Q`Zo0HlHn9ug{{GNRX*@7fYm!=QLe+!PM`b%SUUVg7VV0O# z7(MPv_aVl>d*TO@f)gPXT` zo8SIn`}_ISGV-+o;*Z~LP|pXvH%$5qn#%=;R)c`@;~>(JP*$?~LVo*?v9aKR(#;F% z*i%@t<0}TW+^Fy2zKhYGhU1Y;7KUSB#C!O&W+3CCZ+jm8bTb(6w}a@^P|*2q`KkT#erZE2%1w?adG@ zD3YC&Q_#@VT!PF(suRVF^G61Q@Mg%^RMCOr>0K-GD0eG@d|t%7B`b!sKem7!oSRlQ z&()T6yIpVjBTY7+cz?qTp7Qcg9p-zpf3ivnM}O30&!$^#AYv# zuE((~FU}3wp{c#Q@pw9*YYIuBR2B(>6W!z>`H#E#hM6$_5&un4fi;n382> z@t5Q<5ascim9=>V^iij@5g_prHMU47=xT+T#%r7vrq zvzxvIA;|opO>P;pJoSDZ-1_U`V5k(@-u5dial2|g8T^41j1+@4b6lUn%Fw4;+gnvV z&Fg!RV>>N9=IvMv-qQ>N6;+tK+x|h`GBQc!WstfI+cUv$+8_}AIu?w7f#@gg?}1<< zhRO`MhL&Dz%RAc52nxHty`(4uMSCXq^JMtF0kDgya>1KTprTszuyaIt8nnFQ8WP0C z#jsA2nj1k>y#Tn3MkGJ`qKhLKtK`u8>##N6iOV7yGX(5 zIg{7rY(l!>45AJ-JZ;j@)s1Nt*3!$1E17n?og66=tn%s!ehj9|lM>f^1!@j2|3;Ww zvcK5b*}1Ma3WI$2OX;o>E_DiEr?EFT?G#FpFPv#B>E$K19QiZe8=bu&kS4?c5)4Fi zZF6x|z~m8nBGO|sSA_GsN*7D6c&E;sj{fm(75pYF4c_DArJ_W9g;`(4ZMrcwiEhVL z;gl!hKG(7=VKYhy1Heo3vAwq5B)Ar?2GIxy1DWy2!p(}()$yp6i(8uA5;&JKr8IPN zb$-AkMzIIfzAZ_(1>}4{?De^1x}^ydC0n)8gGH~CA5$gTy2SkFRMQkP%Xdy~0|K6d zAqN6pu<>Gnsa|0v$&2VD{NrdK`jHW>0=UQB@v>wtU?a*K^B6!ga#lwn znAm;vUPC&2@(~au<`!;JP-f93(R(POG3MvjH~yb2eB#PvJM~ z#Y{|f)!QvM(`YSMYuEZ-C#s@1JluXYjW1Q|w7yO}LN*5_VmN!;BT%PQa-d}-YW;Fe zW1FiSK}>puWaE+6>TeS2aJBp1J&r_T`DwbE$g@qO-r+i#f}1MExw2`3)N}b}@i@V9 zOk{p>l~119a=q1MHL_?X(#U4kGfXr@)8?pDvl*V!##K5Knf;VmfA47z9yl`9<90SP zwb_H)imH>2;dI<#vTe8K!ckUc)`SeNO7HGm-lK`P>BQi8KS=`;$ z#8IKGvuQJDY+)khW|I}u)Qqe+ZiHl>VhnvULf|&vJ2XO-Ug?yJtUY!!xvPxd7RhYKHpUl9)4OH84Bl{jR=!6 zH{HUTU3on{B!SYgk<2{nGW)zA_L?C)uQ`@Q%Sd;AZfN;-^R?a15hbX*GipAKRUsCb z@K{zBg%hSEWFcamInm9Te!ZGad#hIh_MiUsRjOcOuzF11D*nQ7HN_csU8S(X4H^0{78r^r%>RodLBfFn|46TpEyr+ak z%PeSoc|G&QP>b$u$m*=HEP)l)e@Vsn(?es5I-xWrY9e8%T5`K?JoF7`0j>l-DwZ-I z{GMJ0A(h2O2Ov1|Z)3B0bt+fApEXL>jgxptFFpNSu~!XWuqS!+NZ$xqc$) z%^B>~-dtTzAbhAEiWR1Pt3QfB+c8d6BLzex`Q=TCjbNJN=?q>G}@eQBr}t#80^T= z5UY0dK5T+9nCI+XsV%9?(Onf;b&U~>*qJL%W4}e1vJg!UDQJ9LXn0~-tjshp&Cl7n z0w0q6wvv&|f9m3K(dH>H_D4xC#@QF%K2$l$tiqihy5Q>2FelGmr3eS*_Z>vvGb5=d ze6g!=Zz)eB&MsNdKXHjko~%xAs=YI$w8mIQw8zI3cMrU%P>WKPonf(aV0lK>y6oxl zBIWWd52)@>e_k+pIM*UeL<=52cyG5gl0}V;dNdTr&eO{LwKH8%Q-gw};?&eEc1oei zODF9I`^uE#U1j(H4dMfQ zUc`Kj7_FBMFRykF{u3VKX~92rjMxz5@)J-@I_5`LEN?N5DQyaAdN%z zY!_J#TS#Rb90qc-m)vMsON*rRxD2jQKY-UI8}ahv@tyAhl!38F{O4C;wR&*Fn-l1u z6$?R?l0H+~H7eqfD0wAS^oZFmk2bU@h?=chlh+yEP-&_?Ci6y&uPkKtAq_1J--w8O z@mY&EOc5oUlDd8CLJA^PvV+={8ta&Z+O>)Xrg}%l{VScD**_fG2tUjmup^0a7JrFa zNR8pRyBpb#WJ}%~WzIRp|NT3CUjdoYZXZ+!+IHgL-jLGKP|SNmJiB2z zK_O=pfGHPLhvi%=q%bg#jEjn7XUX8d;8h@&kA}*UUXfuyuOsCqDPbyYVF4(db9e>C zvlo;$EY2)OsH@BtUYefe7V)@V@DpiB^xBq1na{dmRrQZiR@+`O;R(o-QzV(1*hg31 z2+LqaC(Lf;85Kbrsb%vuy~+crzeG=7AeUm58G>H`9040MGc(Ovh!kP8(P72Q|#;69{0ca?6Vf zUXC!szWRXc_l%JInQ!^f|I*cGe-(t&p|qF+0P}^#DYp}9AD!BA6H07NEiG*5s-f<$ zKN^kTe!#gfsHm|uGtbM%xw=4CLd4+PhTeAgFfnEvcDr_mqQ@7S80OXV8qm|1lM$22 zuv|)ad3`%*;|-avrnAgvY7EJBeh8I<1@;w?(`8?&K71Sv#QoaXIc*Tj$Wu6jcWq|` zPNbU2Y;sO7Bs(Zn(+_Pvt_+WnEM?=)4|A8sQygE#D;$h}XK#<8&2O)r*A2+x%yue< z$1$uyc|MuwI+iI;Ebchp+hwPLu%d@sP(s{G>3kV&ZCz+Y{;0ifnR-N>>p*+Z)^2Ra z+k7g~j9$C@Jc~bC@rPI*P}H2n_@&3;1n|;xoaKVPti4z!rR~KPE}*xs+a1J$j}R7e z;@RyQPyJmUUvMlt6D)=15;gfa8dP15-Q8bEsl@zd94aqNSU^@R?-q3oM1CAHxDys+ zjhNPC^2p4@$jNr1D-CCNf#9Vk>tr>4)3$>`Q;Wsqmc;cZ;rO0Ho74X3xgjJ@-lsVb z!ka{)&*g<)hX@-=sdmQA`I))TASs%D1e+^ikZ4UPHU_%q0?R@Gz@Y!a5|fh&(=Xg2h=AcjG) zD3i)%eFN)_v)ji_MPQ*Bn|DG63}$x>DD& zURYM+)6JT~o8MLkxXtwME2jsHUv~@dqnBMuF8$owOyST4tTNa@Mbp0I`g#`v+W<~D z1{ZtW?q@JiVfeP5C`dgh(TxKXq6_X)^)|EF3H23*IZy?U!=eoELngXGL-gP4?fxzBG1oDJ(XsXi<@?}oqM63)CVq)fLiJkbO&q_xnXu@l zmqqoL%)7Ux&cyv_d36hwo*&qH(ZyRj+0i!TYfl?eLf-hnZZ%a`pH&SiqlS*u=i_7= ze&3W^IY?Pqg;+x56(C~<0??KC!M+6lVP?VX0hn2Vxef-pqmMce_`}1)yj{Lu7pL@N zT2c8dsKX_TJu9|@V{+pZHr`r>1e&9d^PzNaft;YzU#@F(#pib3*aAYr;+E9%=AWVc zQUGU@v96gEHyP1E>dC2J)#s*-Xh9=MpGKEH(Na`hQ=9NnVG`04($k|=7NKBR-xlh* z(}e#RPW57l1BTPxEAZYfEt)H@FQuc-U;iEelS-@8?)36Z8N+E_TNV!`==H}(@r;o- zaSB<|Bzo1L<*KCC6KvZgp}7{KdlyTlOYl~o4dBmprku*pUk_ehojX-QZn_j4Vx|Jx zBhha#gJu27N?fKsN6mncI7ULm9xvTHc7GtLu>&N#%}c@%)=|U+PRGp))xuo_-ei3q zfF!y@^4h_F0*s1PE7F_Cq)umY&~|s_akfUscA+4;WQgAaTF^GCLnhia=}+dl5L@h$DEdYfUDS6QB3XONknT2`QhiYS!UB zd3-a6=NlP`RCv2D+u+c%uw&@N3SBJJVOTHeQFKVE8B%mCJHw zm9zke>v#9tAvO*rV;74{K!18cAqaiGMyiYf)BJP>_}_csH;g zFK(J0FCCW3XY#iov>#^5azc7rYBBES;{q)|Lm)ewF_6Q$2bJ1pUs_PB7zeHKUs7_-632zw)8+8OIVc2MJq3J$uunFD1 z_u2q*=nHw5IilbybP z)(YNX;eWrsA0w43cE##Jl_}TP&(U@|-gt_Wn$LPq1pQ4+wcX}WQ{%TfPoRT${KHJu z)KJzbV6Fj!}+j}5_jG-z)$3zB+byrgyq3d_Tq! z%aQ)wK|h|saywrArhi)A(t(j6vnx)oMk#w7#NO1`*BjSp9m{RSNbMR)i_zpTs6xfs zoK}|0B(}!<3A2lyuCTbUEVn9rG>sA^7+N@!jHu5>?|#%&SJjZ#>>d?tk&8qv6g+TU zR8IQMi9(xWv80I4==4Ov_4|DX9EN;-0FeZo*`hU(WSA|=icb-0>TGX+a$=FRjV-$* z)nv2B>Bv55jNeI)>3t}&#N6UcACU+9UXfwu@R;a!O;}LL(9=~zMnWTtpJLC6T^l&; z9;3F+P(=tPs~G};C}MoCpVscRz<>Cxvh4h%m}$l|TXd4+R+sd&4vRS?qB|mJILS?j z1XY6F#)O6?i)@WuO|RYOo89v!o5xF*oLPNJ`|Ez{HsN7D!!_&3;!o>ZyZWi? zCYMtro8{{h3re&(6fh+mPv5O(0YoCTkWg8BftoB^o13wm_%cx3`1=q`m9dc|Rdm;n zvrZkGX7^7jHLh6F?Pxfz*MVm<my-*T zxoThkQva6CT)E0VO4sux2aZ5y!^udQrVSKQFsz6cS4P?Rvc~3Eh%WqVW6<_y;T@QTXS=T%3o>7T^JuBzywwz9V5bN^e=TGBj1IQpc>;;XRmz$nzi zct-#?`JY>S#DE%qAZ|)Z%9>j5%d;YO>ub+RG3t6X=rG;GL|qGt1n< zPQ#&y*d;3E*>^-h1iT%(WX9FZdG>LnWkT(Cm2+A6x*Fw=9Rm450}xx{xAOyfMa2K< zn-?S0V1&g3Ce3{lbDRN2444+;7hM4ROS2r~=D$%h%>*Q0@gIXoB}D#GXR~IOWw09Uyey{Q zS2a3KZDrhDMCLhqiSwMZ{NOV-#Z&*7+R%c}5lyRan{zc8l9=8X@FsNysXf+kzT39cL6g|<@H@Cj1P>Z4F2Ca z{$U1&n9fQZZkdh@qF)TZ-Sl31+^j43mk>kOo2E4j}q3$soH?&pgoMWC;Bq^-o#P= z%%R9dx4bZOp8Lk$V2~bc6$JH%jE()AtGyJ% zfFtx573k58*bSr&BkhF_FQp^wrOx43L;c^9_5ee4Dv=%}KqL_T8gIa@f1xG-3N6?{ z7VrTUvDi2R?mhSKdzc83bx<>h=V>%6anVS0ft3$L;ITliAZzmJF$LM^iQsefsPs&YE zQZYxT)BR-yU+v>}^`?|XakAceqxIUvYQ>eRax&T0x5H*J8ntPZPN&8G^!TyOmfyim zK(H0U;LcttK9Df6*uXY!LS!f?o9CXsSJPh!(5>7gr*e7VSo^aq zdaJoQylTyJiT#58PGjdJ`^{NB_v^LoqrD#+`JRR6_-wY-ZieI#p_@FH$;0%`b^Ri^ zU!NB`*Iv6cd_V7RIoc=UXyvgOzeg6ClsOG!ent;#tYXfi&|UIe9X__|I9-v}R3vUF z3;Sr0e}ia31DL%E`PUn**bBA>M#Qq6-WSr@>5&vP9Z}iInqjDvyQGtgLvpryMWs`Z zx3{l<1C-IR>`!_FUF)NxEjymKe0Y6#Uz>tvsl^gIC>p!lXWcd2G+(NWMr6?ww9RU8 z!b_Zl)$4a>7(lZ!A7&QYz-7=AQ>?#i-{rJaWwO3ErOBtFo$Bz`Yc|(*u{_A>xf;TV z>EBJ}ty!==XOAXXap6ch9ALN|pbSX2Cs;sSQ2%rO*nlA_lA^(CK#>LCefru6y_-Cg zh@s#E+Ti*t&a~*jT*oaVJE}G}M5!}4IrbzTY_qG6Z;*;D$H+o3Nu&!)*^FNZa7l6N zh10|66V8&FAgTAE#-&L$K)T1gM}{ z?g8?UgL`fI9r?<=29CF6cvskZN3i{6UQrEKqcJ^7Isjw943T&{5I{c!ZC6)yb9G)d#Z5oUMG|GfW+ji! zgsN|k#RUQRuZY4*Lz7tPyO;uOSbL=dMGNzN;J2#P0EB?PywK^*Fnw4|Q+mgRF`096 zb4#lTEz4Hsj&LIzY{l%9d9QN_1|4qn_n~~kxc(w5hR*weQ_)1$KspJ?`tVA4!3cDIe*v$}U*UPKSbQ-zYe2 zUr0gOoMxNs!9;#NKNcA(R9AF2>dhyEjq`&i(@ZLwGLW0EdB$dHotKFpS7m1yNtblq zea?p`A(&XuD|1fIc>O-bE1n+5F|x$-F;^^pv(qLDz?5Wgv1b^>fx#IO-=9*m{^>{d z@9WlSC3M2D-ehFD+-n!f=samxWp#~7D32R&A-YtpdOooNuCg$yNCUbeauQWj4=at?Rm$Q0gDUy@A?Cb5|{!D$r;Yu7Q|7;TX#|^ z$Lt4RP7gr2G4Hd^qx@c<)IIy`p^~j@%asx)C^`2#n>kY79W@R;<&jtA0gvoVyu+KL zaX*WRSDa*ykF9vr|Em-8skrj7X8ooOOYlj8zoIiQ-v^(t|oSBR-<3dszb|K0m zg)zwP7sJb6d1uSh5K`sVxwH37d@le#k#Y?u4v!Em5%GNMf$V)fa~L*Pe22LmSyE6o zH>Smf&*nrOC`*^g?J-v_B}dU8F%AL$(P%KA+zSFu!`OAT8qnYdUFNJQC1hB;{6)jH zMDvH&;;9D7#n3@*qO2;hcrt_6b2I!z@@<&~Q{L|19|a`5(?bkMaldh`N{d>M;%-*8 z3yGc%M;Mp(E8JG#`Ly}!s%cnHG~88f!p#?#+QJTUTSaZi#gc>eA@E69o^fe+VQxed zN7$9_>#5ciB#m8Hn#R9|+{wus>T!iJaTIjZKJI*nl+Ko;wFA0ix05Z;h18_jq@c$TfQ}YFM6k+n7IT+oe=<|; zFu=1I#*SH16+ET(ltvKgr)b)!AIx(tpjnk()s;xtlD8wEBP8N#1geNng1vXwX3eSU zaTTNF1<^bG6Vf*RuQ5PDMX_`155_0mYvKTPBwJ1@5ss9!giR*?3TdMBsh$d~{GTNE z<>{XdpoQ(|vvPz$4*|BU%X*y-K3EOl_|*0&n?6_j_uMZtbd&kB^T{8yKI2h>+H@3aPmoZ+TSCi2 zF$G#GzG#5KuwjZ(2qypfjU#Yg6C)uylrEZxczAe# zC)->XO3CZe ze-Ee&n*F;$2H2$o{f0Rgl=Pq%Pk+qlhUK+71}N9(I{lf(Q*1drA5M02+_Ik|Eee{B zjguIJ?fh8d?B}vGxji3Ji;RxHYVTVLQt{9}6R#}2wi35vLj^#Pb6jfkhW~q(BNfnL{ADFaeR{f-cqPq%$8Ku zTV_}ATF8ITTDxo@kPy|-zJS(4h>#KQdjdir{AeIS4PeS*j6o9B+M6@gg5eIX)%f-X zp+MrCjqd3tEswVoIrPrv6!xZj(J7kj17qy1FGvbQ}h!4(ZR52pp7 zr;C49Co7L0wx7Od3mMHT3;M(wFv=nSJ2MDCuH}G$F*?O-pTEe3%mA?i5inT3T8QAx z9E~U<99$z3jmPY?tr&A-W8KP6s3Q7|Ge*>{X>QB^T0;OuwwIf zfiM7uQa)aOPM%`o9Y89%WEV)m>}lFE2VK^`5k$}dYevu^(8M=`0jhb6EVKK=Itf>4aitiy<;9+))7Lmw{>CRBHZ%yhr54d2Z^B$`K0!x%nv7Qx|hs4D#DY%m88 zUqjX5P|}?SZVl+;R1~Eg>wn7wFp7x2Z!yss;G8s|n_&7i%h7~d6c`LzZ7-@3+u0Dx z>N9BfO@Vn+PO4#=G{!?m!NB^w`#F5{Inb$()<=Swf=~mm#}fwZVa^D4dXJF#IVCZv z(Pk7g&N#z2Sq6LUR$Fl5%M(ED7++D|H9Llk%-yA7b-XwZ1aE|i*P$l&?Egb2wtw~j zySKX&Il%rB7ob3q&^zl6B3i9Lp4fMoUaAPN{uVU2#YD}o;2x(ViIKH~6ywbN@-3=Z z(t0@2;}GGMB15u&MTU(ha9h`C=f~D+vW8JbKHCB6m zSzSS%kB3P91q|#&@hkhj0ds)Y?_R_(;T_+AR6*9r0St*SRW6Jv2ak;R$7Q7hG{U;v zrEb_5I_Ild07LOmhcIsFKb5cwBA_y2AC-aELs!v$vu5T6K%S<`HoH}9Q*+5`xxU5Y z<@(M1SF&0R;i#Eid$#9D6ZY)YCwy!nC)_X9@Y{NLprFFe3a@tyr=p5_-%0G`aphkxR|S*B9lDKqgIO}%ZwOC(rOkr|Do9Q==+w>GafJ8QK;+nQ2KzYMwlN~rhG zT)v_jsx_yYO)j@DdZ(2IG@RxuZr_qtrH||PyRkopvSK1CCCXzIf2pmEI)#c!ZO0oL z$eXJ++nlbOCp)GOm>IWMqpJOJmODT9?_ti_?VdMY9-7C_rk?LEwpM{o`2QPayW9OE z@Y)*9Md1YoMvAVXcYK}o_xC41K57hc=aZ?gIL!Sf%c(&jwBt zZbmEYfJ7w86-@JS3^($)+v0s5zWxCMg7<1uH)k^UdTkAaUf8tL(6P>mS+6S)%Z6rY z@v>?qfj`pWZ8n|@`rnzkV*?g9o=SIJ=-ScFo-gm0to~Ly!LR;kB|;SM?`F=7oh9q$ z==fGzC6L@j4UC8uCOr0S4insu5ukSMc@>HuDm0LY1I9>Vnub)~O<$o4kQomERa-;X zRMk{lBwFHVAX+@jUU2#_Wz9+ag?fOl7ScMK!+!_c@VihOQ>~lXBPTBgB-Kz9`*1%C zkv*s*DlGF01|hv3Ub>f~cY*{P7e@o$;M`&_IlZ{rRcAeO;~7c!`(rlA@kEXm_pOiR z96%%o>7Yp`ThxvA=#_?+-qo%*d@&W}7iLn9z4ie2wZF2%!8vwkyJ~yA%xE`h4>aKG zRie6@eZJd9&`^C4$OW&e2E1rDe6UqY%=u<8wXS`f@AF`u6>-3HJOWyB$cP?gQ1u~Y zbl_}vldJf0?xw6=F)ehF?gp>BubV1Tb4;Wvxi1%L^<|pw0m{Uo6%Uk4Wqta>>d3A- zvOM0~gK4g*jlZRAI2`H_y7<)tA;4Q|-=g2bafa^eARb zaD}Bstkefzi2&yEt8gO@Ja+CnmXG1{HCqlC21633($$tnimW5vae0!H=W~h@TmCDn zD`)54{c$J$TZuTV^)D9P-P_#)n8llDBp^3O_|QQ9&d0LsFp(vw(bXcCY$|IN8Xggm zA-OlP!WW#4U*E|N_-dWCu zR0oPpXC6sH^E#4sOHI!TFg#8CJ@1aSeI-NCZg6{)#=!b$(x9ASeF2`LpkX42$>p-Y zoeQVM8_@n)g(yQQ5ReBIZ=plR^!&;FCj%St=N&Ui?Yu=w2R&a;LMRg+bN|3!1s!G7 zyI({PSAVF!{C(b^Je*lrXOc5Tr*d`$#=^(N<=~%uGdZ40e59f^Y2Aa9hlh*iqFcV( zXS0)$pE~PHmSNK&qX&2N1dWtMwmjqDWi^av9A9mni?1gSZ1=PH{K&@;+TMSW($)7G zOqf?SuV|;A9_g%KOosi^w9ynb&~VgN2KPOT$x2kA`u%aIFX{>^8tvGqHXaFELaBj( z%jNZ(W^XoJihEh*U6m`C?;$!|c0%?ft=)NxpLpmQkM0EQ|BEevZ3p-!SBZ}b*nNAx zp){IS0MS{wPQ9QHG>dzeG`Q-F*7dFZZTL-7Sj6Q%K5-=4VV>0JMLkZ(e9m61s_4J{u?4knNRFE}*L9qs#&g4=!&?`_L!JZj%*o(#4goS1QvKc*>(p|bENXUUk|`BoAFA~e{~9}X1dF_{_8SsAsq{;6FvVl4et=qFhWR=N6? z_+n!kw@XCUC!&&-4pN6(ow5cBF`~T&UHDx3d1<*-A7$cj^a6!6R26|H!WO;$&WplZ z`@gMB=8+W@RSL4w0pVv$(gmgNlw8 zd9=jB%o1zk9Qksg8*C=0OZmW{L=1=oHK;A8>6$QtlS^=H!_%8W4P+_fzmNWg1?8VM zLJ#Mj+-?a{B3?NlbfME#Uo09K^a5^&3tCC8@dfAEd<9WTUp7ZhcR^Y;0`$nwT;ZdEp^N?U_G7Ne;psZ`mC9G2C|G37EY z`Yxpz^(3voAM?wnc_b*HG>or5GnGkF2{CC-4vZkM4&I!-ccCf72z2 zuSC%j*KHv`!;>iy^Afa4M zL0XIoxebTY13WVwQqGJa6X$!9AH^$`m3x{7LK?}+keRAw@())?W_mMd;D4b1Ee^eL z00M*aW6+1_w9r}Q1XDg9cB`dI6A0vq6o(X`jI$?Xoud|KTY zyO7h9xLy0s^y2pBc1O3PqM=CB%_@d3-`xqUeenSD)S9oU3Z;CDOT$9V_nnu^VUJM1 z6ZkD=lQY2_?C#+6gEmly9@^}#dyA0llpj}g<_uKrmcqUF26p1SP%BYNvXD;8`EVl9=43Eio>11R-{Tm zPfet=ybE(Kns#Yu(goZ!U<#cfXeSNwqIjbazI|ehdOK6A$Z=~ia znr*b>L+o_*fWoG{GmnSJ>NZ-ZowS%Vw1ADNR%J6d+*)U$*Lc7zEmK76^32Cajf9aL z)KQzk7|~AZb@S##vdk+hDJcDTEQ>o7Y+`3r2sh@liWch|T7)^ancAmVfu$!w-Q>M* z^!mF5g|@6Vt$9D{ao0IZ`$LlCXQA|awD)ALtstO^_8IYyAgm^2zlXIL-(pYd|CoBm z@JQD0YdGoHwryu(+qN~aor&#Z-1;uG;t7Ypr`P zapD*(a+=V>$Y10;$x?$R$W+nsuw3xpLsi%Vg?delObElN1`?sMS#rk?WFmjb+<1DVC$Gw<8DGO{RduEcM$3_= z_V?*tr7;cE1mH3rHgKV`BgP4jV`))T*@uBwmWc_;^l_kb0oWgIhTufa^uBQ#!j90< z>>n<@dqw$VDh!^QM@B?B8zRfOgTe;{q>q^2h=W6*V#1`Aj(``pnA5DB0uU3fu{V8i zP$iXmO?OBcB|)Ixg<-f|o1v=<#K46HO|W;~3=O@Mybb?O|M{%MQz;WA$_3uP&+814 zFMi+vX!e96aC66R8%#>^UG|^=S+&#-!#tx1GgQP_z@JdP6NBzxm`I9Iiv-{y&op8{ zA4VcTqoyKGXji)T9dKFTXoitu@F;6Qq^&KU5b#;~O5vd!U`SE>G>yefUQ_DKC$Xgx z*D?QUrKqZ9MCaIZ-~gJYEFLP>3;HPg0V4r=2WU0C8FnN`MOohW8xsUw{QG(L#!C*E zL8m7uvcie+%)a0IVe(ek0l}#ik?ro8`kBx!hFWq8DCUmGeacqmVb3qce!2>3I+`Gb zfX5kdRL7p)4(tMzxK|26Wal1(-tZ5ie>yW@NMD}C_9r^$!pb_dl=w!?RI|B~4)3@A zL^HmeItP{G_wq3zH5|h`l__;nBUK(9;Y|YeKO@MUSRR4D)_5R#nIo|Wox6GhXK?=G z3akHCVuyFwr?>aZ*+C{~E*6(x1w=xtAJLkYUh>Mo@v%r}ZJ+dJFA}dEGP&>WT=83v zIGlYp+jkk`eowov7~4c}w8wXy43;(J6?VQ~2n~k|fa3pqAu4~%!sWy_rPby|Nd*W< z{%+p~g`;hjWL7$v3SMocsk~|bd|}N0vFm=~K$qXkqN7j4a73By#ta1zdbRmGMW7a! zC-fUR4b}O3`J&FKU)3uX)CN zf5(<;SE=19w7Um$H*oH&$E6{l|JcTjjCW&iVukqpNw$3f0qTbT&n@-22hS6PH+)C- z#~}a@R94C300o>M7NC>nm4TS7M?!y-UP-uIs(L=PmIA)NwWU`-NEP2Z%_lR7{BG$S zfb%|G_TK_?u^9AjIuu#1N_p6r?DX1BI<|?H`)8QYYj*fSZ}=F~X61~Lckcy|F7co2 z&g(nIZ0)ZHbUCLl)>|!iACJLQR0jwl_*&64M-rL^1?zn$Gpi*B&O0hyNWbIrv|7C$ z%2oKdp?_Cio-3=C8~<8&SMu5FT9*Kz81X-jlf|kQNLZl^R%Wdom)CtizmFL{O2j*6 zy4Y$uS5WyXDY{YJaP0r-bzcC{1D+gYtwUP#-s*W;5W21)IO&&QeL9X!Ju34bB;xvO z#o2cZv3_O-SVC~!KmYcmn_x(wh`t)|(F5q>Q%=e;x$~9Sz_5&b;(>b{L0j65?l?laW?I>*@7S_3aTu z=Lmad^BUu^J+|_EKl1pff)wIIEEd<)D%W-+E4xVEC6Czwwr5PyhHhF0jWId zYa%p51W_GHKp6~FB)PSt!(nOjkKm8cPx_IZ}Dl`M8I~S+>q7pGbStQbq z4>|GtI?dEZL-GT+z%Taor9#0i_+5rdfb%;H-@Zn+u%zx_vsx_`brUXuvrkn`*FBaX zA!aZSMko|ytnjpYrCUZhNN_GJVq&Sw(8DV^CyH;w%!l8*u`c9_h~;bhZm+xUygl#J zRZba#`Z0YbBn?B}!{J{9FJ95IneJVF#ll!_YGjvb)H(;`ckQ#Aa4d*fKZ7-P#p%L z2Z;2|Lmj~UirGnCJrp9r*28>-kq1?(f~dN%mYjskXl{5MBLNYBgZ_&SLjhT8+OI~g z)OwP9vUar?Ynrjz)KNl3Td`_kM{*_3Sm+!s5Q|RCD=QjMUH(?gI&&*f-mV%_p=hQw z8IZuVjI{89Uqpxm0yiU#P6NNOsY73C9a-!R4wfQx`RD`fMo9y7gcc+Iv<9dlQWLJ( zU&zk^N1gdt9y==9B)}tYk;xS6K}OsKChquCCyUXlB2QjuZL~*;A;=V+o`BrxJD_{6 zaQ(~db>e_CzacWVh6hl+a?T6bVvx?9YLTi~xyn%WVCL1$;mD!`W*x7*$DuO6%Haq; zcWus^U{>Gi+V(!dXe8F1CQety}G!!$o9Y&Rb{gZGc z&=|y+CgpBrMi@**jTSTbw{7UK*-5sNC++&+c#@Wf*GL;+K5hxV^J#2l?6zAr6%~Hf z7V^F}E7DBWh5U4*YAlJ0k@uv|aY{*(PNviWUXnBs7+iw|Z`b*9zd>{BpgtDJ4c$69 zL(OLyEK$gIB6h_#5JW{-aep_&X6a>t$)MHF(kvko1cS5d@IPZ;XEb!)>&lAao8@8c zw*ThX{u3*Nmq=spDo7{3;v2;3WiJ&521bCi*H|J2Q-iUVW(&#*ch-|NhNFmaB+s6b zSTQ(>UW7(8WdcY`S5bLrxG{DH%ZChE5ptu87%VBm!2?MiGCE>W5#+&h0Di6*_-8Xm zOCd-HU4{(t9uL)*GNp3y{fMV2J25dbP0LNWONzKSflr5HYm2%AYF zOVEQvLZ+F?)G*j&W4gi+VYJ@DAd00Ex-6S0J29bZp|n_*1_C8J^MF!8GiE-lxG}bp zv=&2ae1!5Z_1@`Xh`~FttnX!Vq5b1)g*D=-O$(creVr{k<47+*JNQlNh{f{4NkO=; zy-#|Dn!cd|6kYbB#Yv55?#U7I881lzy;0w65A&|UiN&&?i(MF%8LFys*n4^{#7gRm zQ&JMXe*kl_(@w{31D_Y4Ys-sMXrf_M!1?`3Krm2=G7R%TaN(?n^H}0^K#$TsL`ex_ zDOrRxMioT9>BAk_=7HjdfBGL`J$)C0qSXeyh3gy!R4N{~59~l^|293L#7s@agmjIM zg7yKp&d`*cD_F3wV=7Yae$7h#c@tIQK6x$wL5zPpqt zC$4d4x!~~%{-^$4wDHlNdW>mIsa<0^u7!5(4WDUv%?|6$hqq4MG4{#f;{S?9d5smXFUaDw&5-7NTe9b`BgXdUO?*1D0 z>AbVk;Bg~!8?U}>9`UUwA5#Rpep=pKl+SZZ4r%n-T_h>n$~h=#II1u@HItD&e*0Uo z=b9jo?}^29-%HZ^K>sy#02taD6qHKF^{s;a>o(|u0ksUgFPZi6el5Tx3mZ88bX1}87RXsu)XzbmCTMWI zj$t91aJIZCQ=NZ>#}jmMjn9^yS%`esTX_oW42j^qUmWrhR|im{fEHEia3kT%U-0h# zh#pyPH7(NnLT7ZdA^koYTZS`!tdP@+et@voNR7;s1aCwdPmNBRvvMA_-8YL3bp(sm5zIC}l2~Er?J9Bg;;ok=BAAS`f?DUMUk=TwX9` zM+bmr#V3y!S;I>d#*ZcI@NEu`v`kO)#t{j&8DFeC3J}_?r~0sTYlKqG|M(+7UuG$q z;HZNO7K5h zDso^>G{{jU!nrnl*h^$59lxe_nf9ePNbUaT9MrT;9T)s&`}R+5%CzoGp2PhgBy1%w ztGLJ@Zv2@-Bw$gD@iNgyXk1pa@J9{}B?{jDF75C(xO{F)Qv0eziWwYstKadv15+qs zrN~WC@P|B3(T8{As1#p#>~}UGR7>F1u^eB@eOVuRbS$x;-wwVP?CBNa^ z8Mqox|MzB&kOU|wNJ~%CJ{he7P!pbyLh7sCmABMuFgho4aKi3Ng2*@%Upe zjjq9@8@9(?nHkCEvw#D$;wAQ}*^T@H<6u(Vr>5d2n65A_%=QoV_Kf7_>SvN@78Gt} zH75o!(Y=$O!|g544@@kqu*Bh0{hOf6 zFjOMdN`7056~;@Evm#SIXaR>Te-N$qC;#++efX@j7w{XF(%h#)73f~e>0A4M^$QCy z0|;)|MIZ~1C~Q(uu;WJ(w(`g#8gO!oujAMOw@d28+o2G^@S0D>M{G@Nc`&VF z+ws%*_P=XaAO&Hl^Kf4ARw$jdjK`J*ldG=!R$Xy7Z8sL|$LIC@_F;rxTSR?6*zH?w z>fh?P+n?hEHi#o`M?e!E*HXoY^UZ1+NkYDu!P!94#wHvY-)_ z!M3sjm4CWXMD}+62JbnJ@sc}UNd7;^fW8ojj?ra5_2ZpDLH$lV8Di+nXc)egF2eU6 z_RDn&!lz-4qHPa2zEjus`4F6O&A6tS0+zdP#->nD55RmUbI zlwH^sdp`#Zv0m|v&sF059#<_4iQ49i&?&YfH#!_{N9Z*Ev?YROnc8Vz8<(OjmV`l~ z2j$&OP3QW)UH=j+_!UZ>O#J1dWm@3%BF;wpEe8>A0qI{Ebjt)h58?q6$>36npomQ6 zOR-_(Xgo?)8bj`itH=4l^}c^wyc%8NXjyZZqARKmey6qZPBwq#aBNN+RSlsqN^Z<< zKl5vq9v|`UOxnJL;x>Wdq6)tEnHc=o5~eO;lmFxCXag4PIYOA1@?L?$5hu;O3FB6E z?N~d(BlGjp82^Z+{r+%U0udpX%jre=RfxH+Zsm>5NL&a;e^q&x>GwW^|Mky=5g?7d z-*)mkU1;;2#Bd>?CJ0Klvzl}f309j5p0_4fL|LU)$M2NHcUGBGej3$s|+q4nFEv%mCwqO|?)2S*e3cL6F~HZwJfgp*R!>2`%N8 zXctk@qd5ALQe8fUXid|5a1;telrz}%yfw1XLlfC4LMW~yB~&T>JH3B#HNk3$q%QlvyMSDmB_wq&1%{w73s_VpI#+<`XS)~9EP z=yf8EOKEk_N?!gPG#9*%q?IxMAd#l<)t`NMz(^x@r)qBzjlgfi0FDxW?~Vl4)7#=< z1WEJB?EA4(F#(iiu)ILpe>*9mOEC}vVC=S`-t+D&90`@*CH}7eZ*|3;!R0+^L3rZp zL26MjTA4XzJ!PZ~O~e|;7=;{fX;E!%$tctG4xV&?pSqi*sj@Gx2&Lm`iWLBe6oC*7T zYL>?9`}@!%O~ouaC8~e8j+toWfR6YsOJ;9lP2{V=ypL$4Poi%TmhH-ASOs7m;QzuL z2PWWS>+L;KlV&qD*~RRCQdTZR+0}EYQ6d&S$G-7?)-_E^=Xy-0>s)KMhQT07k{A@B zSSpvpW7EIfVc!&`-i438!v8P3a>4*D1XtA(bFjW1=TE$Ow&Msx=<>{v=Nfl*Q2R6{=jD@0lm8ko_Ak+XF z<-*8RG0MSl7taoTU=3vn*Lb~dpp8`^=qq(<?1|G;u72wVEWl3NsqzvcB*Y`OI|Rg|2Hv4Qds#yJ0&yY?{_g+aGm^KN@+A`5`E;odvWHUDuAeI?z{lEc&E zj=ws(|Kqax{b4lLNbb1~3Ki3E`fS=$mmcK(eyMGD1ShFOZUq}y=NQ#k1 zh~(lM2(S|xD1?Dz^aVhHz&KlYlo0eIpOlo)6a3&O9x26MO=oqh)xreLlM@u=D87ZG z{ugF|pm^dT2VkzOGs`GR{@?Q|1pe(W>N(fnf980Atd?EY@-rQXKi#HWvgtiv^Y%WT zcqYx)9`XI;L>Ugt;q@Sk8%HZ|oF>nmX)NA;_Bx88Q7xh0c(br?xXX3HwK7v_lexWw z$CMhY-kcwi18D-){uu8&tI_foqe%JnWqLAwVKwlj%BBN}imyS?VLw7R`#<}Jza&WT zNFH(I+~;?)s$G8}kPAZVHHx6Kg}3%Fb99;P$E&5oGUt4~_bMKo#E0RE#H`o))!#Q3 zw!9U;3jKMJWqch5a`-!rEy+)vLO-+0%5HWZ=Cu(%{d`n3RHr%N^nRAAF8Q)<=iF)0 zxXyl$O*?P*ctWkUq+_sK(oR$Q_iqLvorwf-pPEB@{{8#I*T<=KO6!Lv8S&CF&8#K+ z4jNOX*~~CvP!vF@NGn`rj)0vNj0Dk6>{B}RyI=!K)AF# zn+5Xy#ERqeV74T^DF z<`-6mck9o{cE6(S?nM!V=bQIH3HsFWypIoqR4s$yw&3tu%Eh_Oje5IKq|1@*s7@a$ zLx}|rgEcR5-E(HAJUf?{Rei~Rwh(wGtZxP)dJEafBuMPMo$6^^GWBnYD?Iq-WSA$RLI*>viYHH+e&Iv$P zaK&~GNkBB5BgKOH-uAm;QzEK0m|3GLMB#^Q+2|;fo@E?(rY~?T>)YDeYHFsImN2V4 zcNnxl0;j%#=Eh4Eg_UU3VXm!eIkk0eZ0Py>`*Zwwzi|xu(lrll*`(vRjsXo$ngIO< z&Mb{U%X$_3m&Z^BZ-fm6s@!#Td%_amwJz94!?z4lybec0B>)hc$o@M@a>MVU$AyHr zy6aNPGTn7oHz`n)GJM&SC8|=BZ7qrhzfN5bWqv%t!jFG2$x5uEc0Ve84-rwuAYAu7 z8y-UY@i4N(z>u)&nx!C!edOUX7 z(p6XP1QOzs*S0 z7k<$f^yB9LJvFv3i81Uh)|n}(e7qq*kg*|@Pt0;W1yvBMTyZGW6qEG$rWtH<*zZ0SAi zJY{U`^#|STIUD#Lv{}~gmoX6eUakHl`6D5N9;u)b^}~kFW*in4&-w;WM~Am^FmME> zO5#QHzW-vrRMjOK7Vd^l=Vq?*0FopL%eV7n07BJw%rjASw2Ye!{|vQodZU7tf!>m4 ztfrhkE%V;+;gAX~y#36_nmPr32p+rZ$~)VK&1SAHrP4z4V*9?=a)C*3>gFDw%>|k6 zw}hIdkDIVCN-0-iNe#>;>t67*z{}1$5&?`n3=B;*rQt{8S@7bm#G|sNWT^PIR5=Yb z^(D1jrR4#OFQwnZb-2rMYoR)R$q$G49*TpxfFAgNs^8Tg;s6|@?+Mh#0lzxf_V^o1 zp$nD@G)glz{rB{KC@=PDi$kWMN~n)wHHms>M?wm zW6k>5$^;(wXX|DDNnnW_RU?qP{^-5uX$Q?k;jC@+^^K5+ONrs%wZQWk+NgC0^6sWG z^ot0%0WxT{21Od~Gt=vH2h*!=w9rK^k8@S4i>!4T% zf6c;&7x#)tmh7id{6vq1BTNlgLZS(Bt#63;jbh-{_XN)PnajQTj|i^li-$#Njd-mP z5G(PSXW(HPl;p`p^~xqDb_Mp8GGo=mx>{@4YdY!kYqWFD6(QyV?_KiBu?VQDK-Z~^ zUSi@}gz+Q7wW%=L1q3A%{aOPu2%VR%?z$kva8JFteYgltA>5obD; zz7Mg>6bSh*2=E+NHa~-URWY%ly#oIan}YtYGUxz@k)hXO*srXxA{#)hTG5kQ&69{aZhkzx&H1NGr=}w&4Y%$5F?Rh@19V$Y zRz*t$j<`IYb68*gw-C*b1}3}JMk{}{Zg7f8dFgiN-Om zcQeU?Hgi0#%G-baKI^S0{VILqsSY9Gc@o`V>LKaaq;TM|hIgHI07r=>g~fP;NfPcV zPK)*q+42jmFR5g6d2Gf>-v`_y8j)D`_PtPmO~eXDX1x3D;CJ6@+NfsY)4PZ9mfAnv ziSe=;3m;y4S|VQFCMOQN;<(~lDcfXd6^WO6?LLY@#6wOf7E^}&UA~HXI?DDZLvWnY zVg>zhKkQpX6Zcz;=7cf+*LeL91NJWtsJ<%?hR~La&dJwB#RI$rm&wx1PY;dzl6$OC zzhrNs&e@!i(~JisVqvauHynf{)x_#U)0)aUyVc7ZVaSJv8Z7+UUZW?szp*!=t4U{t zPrjeNrucGY*euysvEX#&dr&>;6+9dcUm>acwq(x#{hVWB>Hq?xZ1Eqge--ZO%0|6_La=GRc(K_1z){% zZ@+^(zJZ{Mx<3;MWlQ1bh95mw^Z#`pPn^Kc81h(hS_nkgN)48lfw;H%>Y!YWBE#15 z;^nmVRWX~l-T3!Nj#`QsjK~p7_XlDNSrYxQKU&oULapWPjpHz#7b(t3kX)5|!L=A^ zQi(du0edb{x7L^fQta7=`~qCw0cl1|&imq=(Rn%@)%>~` zHICt9SIoNFxTNs`YX-L2D`usc_0PcQN1=fmJ6;=xa8KTNrIp@57sMPcx4UVA@e)WJ zB}dpVQD=f$6g1q;M zJQ_C0xJFYb&}4*v5*O2q`>zFsg2~6(uIkR@S7JiL&@r_(zYnNaYIHqncP`i;y%8si zm1DM0{8_E%WrsLFWwV*^XpWPJIVd`h@yE!5mtd}Brn zvpJFeo71iWiR0US)U<%0YljFlt1|5ZD@@c5_fTg|q{)6CWtXZc6ffMrJ^Lpp=*8Yp z^g35(_eb~V;MX@I+V@uq#hd+eLogAaD`4@xdG-+$>`9x0tvV1#0l9DtK*H67P(knX zQ}970%+{(DVqWQcP-`v@ZV5+-7Vc;L4XKEKc6o5I;Sqp=H{E!Z%j%n48y#Gj(pKLU zoRXq?RVO@kB#~O<7yRx!X$dac0;&)um$}~?IxpF=uFc!AQnz|!|3{(3Ruqm%(E?AE zm_6u^bnwJaXOEUI^>y`+I9yg+^iYtC!?Ua7BRvj+RJaK!%*Hwq9nltsg18xHTt){~ zUSQd_FRfbX@e}VyQ&~qQ(AIe?Pw;r0qw6u^l+3pL?;9}W?b~_vXpk=*+^g%_EQ|d& z-Yj2yEv5);EdT?(2ClUIHx9f2BZ@RB@&L<^Tpke$lS+)3n1VB8QI_?Is4=tdxgS$( ziy#afoSa}1&bqp~b$f2gyI@U$0g512exj;$xUoMQ>i3+zfQ`?`$A>LPQH<;JfF}hB?_3q*$FqTIS z)C>bT81(--(;wxH^jFk=%*p8kO4VEBfQ4DQNBwQs$y!cs$U3|KEpwP8Ap5;r1$}45 z6=z)6%IZ!dX;Yc}7E@WzbnZi(0=1@0i-d{AWe;wsw8+00m- z2J=aDkFnS!q@2Q}_M5XquBq)g^d`-s?Z_w|C*VND`V;Lhmd<1fhKg)Y7vT;T>4gPM z;hWPmhqNDdk^>D*QY2i7X;J4DD6wSw`~0D4VfZBtn@*O9?OBpcNw2Kr{V~3~EUUVgH7g$!(wRt}t zk+j7KE2fW-k2xrZXJs`hmiV)AvZ<_|RS@BdDE&N3m(V8;7g6Q2YWkQihQ|jc z&8S9n*ZsDL7f{oeAF8e$Wk6=-lI!n};uQcjdh7`9Rka|=N2=n@>tn6O1+7LEce=vk z0h*s3G-@;XW-w)4Ua!WBNovBl&M%wanm@+E|V|NwlZXeEfw_l>!HlLK2>4#)N1dD43MZ* zCcyRR-0nALfWgz5)P|=%`8V0U#%(hZ8Ouv9_^-qIE-LlC{7YixY5pZ<4On6ve5o2` zLM~1?Z7){pgEuCetjoiONmc4tBh`wRP_`-;WWZ}RzC?TxYnNG>NUFHT7L(0WqV~)X zi!sJASs=~83?4CMht1F;O{<*sJSJ|=@EmW}H8l^Pxqq@W8-f@Ur``u0pkl!LO(H{w ziHn<&(DzWNC7&OSYvSRX#`DrK+0kuaKR{gOWcCwOoHT`c0XL+dJ%7KCu^3vs9}SvI ztYqC=OCR%joo82FCV%=Wnyq}RKT_ZV~P!OwM;n(6-hBy=9luFy%OKA zI=5rrf4U>AElr#ybVsyvAD?j&(SMv(*7n3zL2EI`^c_a4^+pya$bJQ{C=70Un5c2< zxs04RtYo(i6)BlJOMgj`iO+^MBM`AlK}DJ3Gcy<3Z-=Pt{`B+riH463*Nv|=;^?LQ zAB5r!0Eq$fhJt*~?N}k(>*e7F?!c|)->_S)n&Ml-&a6&K3Z_`^9UPk<60R;r%&IdA z;)HY9ws18>^1y;pHI>~KCh_&{>e{r6iDA&w`#mWqSN%JiudB=F%_rE00O2IeeCeQn zP-H*P2@Ndk>YF4+nB^tLo^W5`Y1q4@Tn0b;%+k_Y-*CDN2uwIWU)MVzNS+yXkkx3X zDw6E=^|h5(7xzaxZ+q+W{k4+|bFpefiAJ-14P%Wx;V<{^N<;D#?S9O(5fIOs+o#*e z7jIQA>;*>PSElY&2`C@ET?*1{4$(YIFBqzw^ji>94 z$A+6=eFl$8%FUxy7nmK|;^^4OL0KYh(372^za;Yc)CIHDxEzCFi}j@%Vgt0hv!DDqVEA);yld;`TRN#(J+}X6pIIm53a;6$3Kb1?@Z=6cWQE ze&yLI(7=Em(YyXvTHP8}KG)~*aNb)M;A^pFaa3T?X>{B@*0o=x`CJw#m}TN=S^P@l zQ6rYZ*I+DddUomp(?4}NL#y!g@Kx4zuKb#lmn~E6v<5>7uQ!Y9!PXsYX9~(&{~2 zHYAd>c3a-z%T5y@!t;2E|hqI^bfNn8e9VUS3*S+Rsm5)cajf#@w88wDJ9g z&8LS3#JHmiJ`k%*_WtLefj@WPe{EEU5JP$&zCLa;3ff9fdxDokBwCPfG%?V1v6OV+3?N?!xUw(6MV;}AhIcuFE)*1IZ z$gZ|4hu+$;;JR37s5%?*Zil~O8(H%sfAE8m(M2J}wx$)bw6qk-Hn735shG+RVO!}d ztDsD;rRu5brDkBJEz*mN$zMx3jgE)X5q5KTu0c2d~rfo_EjY46LN{y+L<#ZAEq~kbV2=k>OO%f9H=0G4rcCvO!bl6a|m(=FTP*pD2 z`;njEB<@xX`?EUq`*%!Wq-+Z5Ot#b;Ed*IZ>$iaVjg8^H!NCxT!h{bfP;-2(J|WA7 z`g)e9_3SNB2b`;n#YJF#`C8Ds(iNty2>?uiX$LJ&0f-TaGwT1rh`r*+mzUG#4IQf7 z^k68Si~vRPJyE!ewut*90RJ$6tmSZ%&-1`U!o2_Y4`XiZj>jVehwi3JoqVB*N-63A zE*9N>kGF)SsQs@NhnhB5KXudkFQGGWYg1Y>cYi#5IA)3-ZgRU7O4t07XHv3W>wnCm zRfC={O5rO50f|tR786z@CA+~@N1(`1w}xZ0cU{S5uZhT2>FtZWd932qjvI+~xg62N z^TNi+WxIOZ`AMj6-g-s;5~#(^0$D)&@s&y-R?K=?1gK`RdIPCZn_$6AmH5+D`wh z@MS!CbuRx4yRun!hdwE)%P$pcCtLfeRl(XXvbr~DTv{TV1C2a@Zn8s(sI@Hu=`F`Q z;p|RQwu0c5wCZj*OL<$cwgTd2wLo>VcK634#o;OJBeNM?camwBj|V0J{B0l3k{bOIlIM?ZClb!$ zitV|t@7lk)L#t`CCM|3=_(Rc%*>)Pfd!@Rx>1cI&v%CMo=k$

    uC- zo7P9-=0i)G&VpKX!v{;2Cs#SKY1(afn=aSf&%ds+q{~6J8Wael&{%@U4xQ4Yi;*ka zEb1hm-VGVLrM`J(Vc`{PoOh$ivg39^`lEsOVPmV7S>`K!H@fpcsZIqtSA^T09BC9P z6Ks^ZP#3{{O2tp)Np@v^%%F_YGH6R)^KC z#xB*Wi1wRqJJT+!CUJhj1Uw40Pd>jjZ+isLNpJ%8y zDZ{Tf4wc>S?wU{ch(D*_4*g=6AOEa%oh#|31n&3xEu6~=ykB>KNmhpZ{QQisNr(ou z5hxQULxXLl-TxTiYvdO6dzefcaXttxmB*DRe|k>3bpLRwDN>MG`sE@TSF_dn(9o4( zkOU}0MOic72|8`;;BC3!@w~H!F;p`|ZQr%j6OS%W0u`pl7!PodP@z|11v`efgzZ3n$CW@%re)4UvU*PbrgdQl_^#lO#oG>*D^uTrX$5UobAgj(^5Dfp zbKEOrAehYV-aJ)msZbn$dOgf^_d!nEpSzlXJERzf(R&6LkehPQUC zYHQ;)%&>!LdV3?~`gK1X!BVt;4rVmGzVhDTSUZ4p8V{SA%inv{JzPHwMTBs?4>J%5 zPAp+_O|^&Yot*9*naK3c>1AK&+s5FS=lBw=lHxcGCJ&KqRucdw%5ZVk=NvXdP~Kl( zAzw0BVX$9!GGryd*L8k)figfnm{#a0!^f>&#yYv&+%@)QFku7IUl6FdN+f&yz}~t5FP@$&8OV-i zlDv3Ch7N`vSlU3{AxPDD=X2FDj+3>+sPGaUz$aixoA5SXFGh=^TWhW#G5%-)gRt<` z;(Km)vQl7+%glnNWBn4z2XOM+y9ia@F5?03m%eY37P)JoVk3it2UwbZPah(v*Ay0- zUUO%FYCzKYSP$_!;ZspTK|x6gBr@GSqT_bE!KfK4AP__X7QE5@&v}=IaUzQ@YDg^V zMwA~U7cf|T$-Tr-%-F3Kr5IK`zp!sAM6W2Z0tG)osI*{4Ct0jW&C<~f=mroP8^SGz z6(uPwRzZjiQV)*VAkGqNfeKd{UF0G~ELIMdmF5C3`c6LYxPzLaMyDKvrf9hXALker$}&xUxt&swgqD6?HXaSpdM8Q4AG!urt6;Do_al9gs`g#Kl7ZK}~B$ znj#0+KkSIkcY;y?$q0x~1)d2FMr&tX)z}Iiy;qo2C6E_=CR_oy|DU>BDv|`%5X2oqi?3o|FK5;e3xz} zKU@@i(c21|cxPmppbzcp-V5W|&Dk5PgQAl2z3nhM{~bU-Y7OxeDgrcgc>mSTHt}wA zmQ1tvVfXE1uS?5nEnsRe#;ftuqc^22iy@0&YhA1$OF;sY;NPI=8LqIjl#Pyp<^x|? zbvB-if)A&RG*Pp#F5ZxnK^KEqUp^Ni(&+5+v3%><3@nNRS&1$67f+qRBq922ic{_7 zp4sF3mkbg2f>8Ry2jGVTZlm+CTlrm6XRQGEvU$!|8ns|$h{>7(?!0(_ZFk?r#TPs; z&K4u1*wrqrxsCP=Z2D5Aa}1ZZ6XCG5=rK(YMCN9X3AxZFSd9V@Jg@M= zflKGeU*V3IV~4+?gE&UIdaMe0Q|@3h>M*Ruk^$iwo8DN7DEJX@`p1ktGz`h9MB(8p zd>t|TT}fQ?&^bIYt(8xFpDj`p1q$zAHp}`C6A2+xs{`piNS7{})O3Y3t{>jD#<1q9_Zq~^)@n`+pW(>YILyBc01frHnhVH32c%!ML=>w zeOiWJ%eT6(8{)O)E6zh%(IM@uCRcNKSOZpbtJ>np>TgV#n)_8w2T>@oGigj+ z{9%C!pGT4=NznV*(3AL+@x=2G8rT*#I><1w4dmlS2+Cm+$q91uB3&|| zIg?+Yry@A!p)m|7Sbi2Yv^sbANkq#>g65d9antt3ac3!DA4vY}MU%`hW`Y03N)%NH zFC~&7&7U6NGnRFL-~nHV*k6#OsiB%J zWllu!d2P&fVQN_|NG|Yr+1h=d^qGbgYL^jv64K13o!ChyiE)ZwCgRd&Y#k?43dS=E zzQG=z`MYTu!g(RsulrF4FmOs_am}nT@S@K6a5LG%1&N8Fp=g^v=JH3 z!#IN)nnR7>1P?9QpC!Ij63srCc6BmIIdDx4p%O(~)WL)hEkN0vh(K>+rO*F;>r$;O zav`O-1Yfc@-VmFcYxlvSZGSnXcNAigP!I2NrllDL!`1S<$BDtkOAP432Ni-Wk?n(i z`20eQlJFw^EKTG9V2PB3)@NLwddD$cy zoYe3W4Jp^MDAjP|%{!F!p(BLCoF7g6h(dT@^4|5@@bQ-xs27`9(TT%}%bRF>LGs1T zh?V3jeDyER;g)monQ~S|TDjl^M6o>#s;4cKgGmBcIQ78Znj!Y_*0vf{q zMT9~j@PV<}>~5yzh9dzH=xGSRIIx~JBCl1SHy#I;4dTG^q~H`GN1`rlRW^#XC=Ajf z(v-K!BTFSx9D#*aMrH`_wX4cF%4)v4lBX=`P&Eit84a>~wF)v5CukP!NEMgzfeD4G zu9HMmD47fbRwO%-A#MgX5U{~esKyTY!$!3VL}e*7r6R@MGI=`&D{Ph=$mT~kYw2`c zLzQrUzNCPwdQc^+(_(Q-)um+arDlXo(54oP;`nG23Z}S9a=ApB)F98}sKiR7QKZUf zl-;jV0PLf4f4K!$)iw*t$B=i6VKYhYV6YKm^_a1mqfjN7`uX=f{Cn$?5r( zP2(K#u3mnC=G4;C((Hc|b8~YlmD+vAJHWi!+}sTKFl}vZf#lt)`uqC>Bk#4Y%doNDivZ-r@4aLD;yrugjI4*!CEwliC2zB9kIOo;$S3y|kqjn?_nFd8i=k6?8XV1QNv zkk!lNS_KM4A%d#3A{ClSLTi*-sYXXSPr#vdskU(#A_mbh>f_LO1Q9B96#^w`IJ8`; z5vx$(bNZv^UVKR46%c{94gslV=@6qYy(A?y&tYV}FSPnI^#12gEiQf`Ha0eZlKwUK z6>{RgX24-{Payy~@!^#C3xPLof&CFD1i5v-AIb)Yp`P3k2WHd1rikkd@Y01@y`)%o zv@ZP-V3kyNGE0KMGO*M5mmnZ;|AnT_^Ay9NJ55bMCH9i^eU&Aq@4S zu>bNONG}Aw)&G4N|Ea2@ZzOSKYJF|W>bMn=5$KcqYO4!U9u%PifinI3@bhk7 zxSaPQE-+Qj{mApTEB~cAPDt>B< zXsj#CjE}q)l~n^+B2XxCRs8M9Yxk2fsyL6$CRKZ3()Gy58`0Su1;TA>tjtTh8F@W6 zr$u*K5$VW^y?*<8ssKYG;2-@Q)L53^nE7*c+ALW<)RvoFjiAKE$=4&V-!B!YG%7(^ zX;ED4-Hh7CqKuS;+&W!Dn)ZzQ*RDOt;;MML_by!yyWc1RIh2}Gq9Y^kr|ZrH{3Ysw zN@Uowc^*}1^-A5Rb%n8!k&%g|t-3cVUTVy>$mTU~y@GmO1(ND}H*VZd zsRm~Yw7kNb*KRz_Yk|9%z47M&`vehy2)q*rz_XC=#4!I;C*Sy4$i!L&f+Y;LBe&(< zK5_P1Sy@(W?CmT$d&;cgyazw*3eT=cjZei=aK%Yi5|NPu?5ZDL+`Ro(E5A{}uw}@r zGcxnn4Bj)Ap;`O;y$LJfmq-hgft*?~AJwP8_~cT$L9aA05|(8a-z! zsr#US)u2W+B@oQ-YYWou;)enu;+S7X-0gy290DqNN;8i z8t>C~bN`jp>iX)U%w|@grv>0F>$DMz?w2=t5140CbD_XughlDG&D&0t)VC#G&BR!- zTW{|?bTzNGq#*fWtC5K^?b^x2(zcw^dW{jYN*6^LcTg|Va?q^pa*f{ zBc0M6rD2)gjsT)XuoMOxoJ^-RRSRVXhRpWM(X>zYo;`Bx6GcpBS(}sya`%E1+bW!+ zZ^)2IOFmyb)|!F=79^T%JNe6<2T$w_B3IwN8F9aD^r52%kA6SPlMKl49|_Uif~ZE6 z!h+27G!dE|IA_i7gQpkwBj!d$oK80Ta^JaKf36v9O4KSJxvI1XhDb9sH#0L5HS=1C z)=sGNn@-&?QAkCt4-f9Uk=1POHF@{uAN;81bHDs#o*zBqX2kgn`yY;-II&})EUBJ7 zaPER-O9L4Nf2u;o z5=fBps7HugOLQ4LXVuD;tGDf$=8uZF7AMEqjGMLOi_d@9vhDj3-WC)V6RqHDjV%qZ zN|_qLq7+K3F%w))CKEL(p-7?zCp#r#G}&w3ich}yZvD26AGw1zbt22GY%m$~%WrEw z`Dx9kcGcHn+YOA3b>Gn)Y%L548k`YB*HN^kn>AjF*m;auwfc*nH*Q)zd*tZ(3zrS{ zDo?n5zgRSK`6u%|Ow#V%O0H>tkr=g?IcBgfh(K>b0J;Nu(`ddeeSsF(+cHwUTu-%J z!sT@6I*GOMCut>hT3^?^eZT&;>bT z6k=fS=(r+O0-?&rE5KED`qPd3_MC}sRA{lCm=Vdw7?nIVIp#q^S*b{_l!`@C5PqeV zi2%`R&=|YaU%uFIVEfL8HO(OHksf7WI%BjL9;OUsUWeaYH{rvZu?f+)@){)y zoeikbsw4uDLZb%6-UQ3w(Y6mZt>3))*DzFYp8y+K#-+1qa*tV42sz==v5EKZ6bUdG zox4{fXvm4ncA7A;Z(z`n$wLgyO&N;X#FIbn*|X=%#p~kR%!Zkz{r1h~JsZ}4_x&Ye z|6%@=+~~Wp5eeC)LT=^N@QCX*2m_&FnvzdlyOYi*7^v_dO;RtP8nAm1f!BcmOl|Z! zP=;;%e+1re92iIq2BHW2{QTg!yb%O?L>w3fH`ty+q%v*n?X1i|LLfBLm~P_iHfZQz zMMZuCG2qjs(_9^`4d@LuH3~=HAp?i?>*r49wqhOo1^KzUxVbqw+M3b`csj$_J22SK z*`_+bB#+x%&I(vL!VNrOP)zI`Ekz~8)f5;1@uP+WcsV=TSs5`&R65ha&AWepe@5jg*-l$H*@>!q+R)m@hat0QRsjP?+nWgsDmV_4<}8{#(9h4KttPiw&K|XD$=JZYw&v)}ymFf7 zusNfGJ)KS4%Sz-(0z*`pw213>#C;l6rH1A&X zZ;TTkGzxopkHz6L!4WvB#1;2l5!tmJPCBWqGp(x5?ufCWbA6zmhiVlh+GbHEwtK?8y- zDk@K%I<N`Xnytd zVTbxb1l}A1;MN1A>*S{X?VD2vw)~DF@MbnJ^wS;A_;+;D{r_&GvEY!SB=*eOHEX_G z`|Hm?e*fK?%_p-fN^c+B{N1-})_nVWSf-8%tmMwg-;dwrb)IjmPq}*NOjLVk02HEV zPKY>L!0D_Mt!}C=uWZGe8g`eUfm@p$9b5K9D3$QR$!%-atl1SAFX{{g`!AxEr5)c1 zD*55mg%S~9@A_v!I7#=D%99DBGlcSpg{)b&?`sa6AQGoD!wxx@^JG1aY5|?D=?r24o7F>!bpgXv`+o^7xy3r(T&q%uT$GY>? zd@yFb@ZD=aSr^)-w`~x0@x!o)9NiZv1?OS-hOakWD5#fqe%E;EZc7c0dx#=E^F z;Zj8QV_Qp+diuzTdUf`oSZb78oxG0@e;a zs|{FFUi3hrrf-H><55kwKHnwU zwq*_u)$se&KS%FdP;u=}%$=;ETldU2tlGTom(bGDm(H$o&_$tZa&G*2G0)-mAI8hd zRhCl%E-`fq zaI?fUH#fI5iA^0X5l%^MbH(KgHKSInoa|==nip1F|NOI?j^n)E`{)z;y)Q>?<1b$R z)n^mvS(z0=glOv>Xw6i1G`F=i*K@U|z9DXg8g5xueuG5IwDj)dYJ@=q#TnU63KG-Y zv9F`CidUMN-H0-G>*sDEY;S38ZR8^~TR^y0$+7SOj2akTU1oNLfa&Dl*M{ES+#>F1 ztZLWVdb-zy{=756diTCnPV7!ppg;t=fk1cSz+yz!JI>sA-?ZGpE5O3S0+>YIsQ9H7 z(UI2>i3J4(K-E#BMuB?4>ZgAM?J~$f99VK%Hn?dG85mq%QF-#@Nf-zA(gpxl1nvoH zwOlT*tE+2jYO=Prezg`@7v-Ja_5yG9k@(;R&;z^%XCdR_;y_eB7#jWOdK==&7jV>` zi2ztMnp@jDI=F5wj%{rnT)x2D!&RmJf7ArJM?DOn&C;1@I*%k;H~e~ddjhIdj4GUC zJ!1TnZ~E&u4XgIfI%)Uor;|L5was^yFF#>2$e${!t3eOh^v%FKhc35ETHBl_&Nk#` zXGbS-`hNT4JQtRZrd3>Wch9N#u|NK1ki7eNF3lVx$B|@lQ7J4NK}x(RWYNk1a%%^3 z{MQTI@1NKnCmXtcn)1NTOXUiolrer%A5nas@w#6p>urtN_(P{I#Sbu*JJl}p&`loI!fDzk16ua(iL6zMl_pasyVo2&lw#^d>&WN1eX!|= ziRx>6jwH4TTV!4zem%=PZ{5bL91IO#AnA8v-LU%Ghi_Nl7)w)8h0aHDZ@ast8i;MrAgf$2r>1_KsY zN?HzBBL@!v7FdNo65rX``K=fNsASJa;Eh>edZViAI3#!h++g7M046=~#OQw;T_+{G ztg#+qEA+r|B@pn%rImGc4MPV9S5($EG_{T$IYiNE%XZpZXbfrWH9ygluOF{f|d zjV)A9n(kM6t@fi`OH()Q6!l*`+#vnv1FLOoU2Yw}cDEoiBM&oUx=UG(!KR%94*niH zWaaz8Ryw2W85Wql;`;g9F$GzVF3DnSIy~{rH(N~>|31ry_wAR*1Lm)q)mLZha0^2> zU*h$##Bq5=9YkLTY;&{W*so{d&L6yyUYV6%X*_S7aeA@MzWs~Q$p^o_Vz_(9(6lSp zLLa6VuJWwFhoA;1&ZMZ+e>ym|uGDSC<0}lw>j)zybqzDrkZA z*qQcLEB0p2LUzU7Ke^YgpZ&nt0`p$~GXS4J={5qo1*CHgdHh26S||D#3tk65HTPk> zIO3G-k8Qj!c5}Xu>^PZF5K~)K1Fi!F^o0TJcp`;q$OgiqQ@|r(w-xyJf}kEE-Jr8x zHk(N$fu^3iK=%NO0XwJ9_(1^@e1_}THEX|HvtnKl8@TV3V4hHo-Mx&8?+I=}K zRtx9O@U=5W(0H1?Jq5HPRiPiVxf)tJvH3|!o#e78MA^|)c;f55d2Kd-UE=6O)$$sp zY%`Ni@-sB%ue?HtMy@d)IKZ$X_MXtnnMtFgk&?roAL7u17R;IGV#-kCDAta)z+uQi zF&O5G>)ZF;d5B%Oa9*&d9mrlT!P;7Yga9ff;QAM~OIg+f=e@V+lQnC<{Af6fWn@6n zNN`kROJlTLhQTViZCXd~Q41C>T=VPN52yLkjm#Z@8LURM6q;HlQ*|W>c&k@CsC*AZ zpfd*RB`q?~sD?sgGN>f|{e(cG&>0j0jzDG7iJkk6;Qs&;z4zWoA|LgJm)>H~8x37Az;1n4;3Rkr<(UZRtSCGlAO*k!&~=p| zlgLCIsjRUmj&kK5@j?|bzZzA7r65iYPWRQJY0ZfWsftFU>BI1|PoFuT)}%5r zVEw%q4iC(aE*nTA6H1i8TI#f2gxn5}s4L?RA`^?{YP8LeMN|3?^RrjBai!|NY$uHO z5U18V@f~bWHiaM&iDfddO(;?!M4Bi)JTlM7+^{fg|Ndi_?z88mMi<@MC(sLjc+Hk$$Bu3N^w)zI9xAXVoR+^X5qEIpIL}Ew zwa0(|{`CHBw{nZ+y3?SYomMLZ?R*Z2iVX#umY2n7wk% zf3uy^#jS$n>J=^TWHOagos!uoWl||*DpAF&FUf6C;uY2Dg&it9$Qh=;%XGQEo^pWc zZ% z8QV;^4iZVq=AyzA`4P3-s2hC*%*NxJm6c>6$8(iItv@2Dkb`JJ-mXwaFdisz# z18Ita!V0BZz@Yvi1BZ_=Z_bV{m*NA4j~*4`>1b6I;#fN=}o zALmCQF&!MO7&HT02U}AkV61wN9_J)1PAKB4eTR%5-QU~E*2clk&VtOXZzj0*b7uf` zFl3j&0e1YH#Iib-h3~vi7LN%uYA;GGete0uovod%iJgzHC@-%QEm?CPn86 zLt_a{BU4)km%c*+Yz%2w4BpZqaKvzvy0rLe4K;Z9nBjr$pgB7$0}KvNXSNjHih(Sa9`!uFz7Pr^jRoJchV3D6aK0YB$VjeVa#vn5?!^X+Rh{ZCqvazvX zQE29aM~pQgx7<%IVfv4mHKq@n!g6r3q~dTSnrYtCY#|Ksuw)*Pa`cJHshM3o~$Mh!NlqpIVg31**arRzw({;otK5gVFXz&R&d8%r*io0F5{@9z)1_}xJOmVpR77lGHui4RnH zGOWJqwLZqHD>nbh1CsjByZ(07@Z4U#g9U)SQ&3b^T~j-1_@J_~s=9`zN#jS!6~K>y z!ea@k*~v#_zt(C?H8QkRCUeAjZw)!|XV%uR%1efL)`yl~zc+X>4j4M>=F989$hTd& z_S5MW1W8A0ZL7?XiQ~3&Wf&5TZDc?~Yb4w@jzrBgV^-fdy!RMq;feJ_*;o`7uN0?j zn7Na+;)f5$c^gs?PII$BrllE~u&G3~N(C%8S$pjEPohVk*gw@l820P;2ea+BpIBw7 z7PU0Ch&4pE5z`Q-*pZDVGgvD2CHi3PyMHJ!Hlx6vNNzjilYdQ-4M zh``ebbSDn%zR-H_#i*4w_0GOQR#sLo_beoiOy|V!+ImM~g5z3F{dwg;LdxaCr>-K4 zcMiU>33#8mp~j?a%#3d4y>%aTz?i4M&iTi{<08wIu1-v z81YKwnM@N;288Kn|C5g<`mITwI|s_YAOJ$EFu>yl0<3h~xw@z@z2NXn7QJ2B%GOwp zHJ(eC8}&09uF@z|>f_N$bUUAqC1WWR3YI|9b`)pSdQG1<)IiN?=S$HPb6X2~OU{j> z`*yDVc0*`FlU7)`Yr~J5HvD?(_Pqz!(+e6O?mrd*_znyVwI$Ipsmwfuq&H7`7?RYXp@9M{*wJNEICl-@~ri^sKrWCYb+EXHSZrr|q)Amab60aWn z{al`ejDH0+4;3@X9Z_CJ)lNm&;&W{gPBAv1IDCYjJxcjH>L4Q*ejvYkcl_P)wOc0&k zsaMPY+hv43Iq9Ez7J147)Bi;ON56FMz8oxLU3RO^gzZ8Lhtu|*d7L!99XUpwHD(UIMmbEnyDzyO3W!O z%Xlbu{$_9ZA0IEB`|-rleP?d{K-=Gh_-}rHV`QeQ>ofiKQe*N-P zYEH!cBn6fMY6H@_+JaYT6qd|j8qtul6I)Kz5iRXZgg26kDHd)WchYfWGD^+MOTJ#E z<0aLW$6vb=T>>5pl-#notBKqve*%)~h(EWj|5Yca>X`PNw45)hMYPv7lH{v@{i>0&!j>V|y!YQfjG`%3v|* zbPAb5QdgbZdZ|od(@njl8e(zPWIlOEi!m&)egFGmboU%#ZA967>^Ft;O5+pZDwMp8#1lW2lS0@#9D*HNtS5G++1mn(eD8Wo0>)Dn}=_M8vPH zsVpjO6iJ)%(^Aq(8uWIKu%#?DC8e;TgHxA&<$P#znf?@`&c-9SjR`iazn%ax2@$AN zaGr{QQnwXmq@)(r2^8Gq>sLbWWVf}qw=|2jC`8&KQKPi74z54|s4=9Kxv8mnmEe_1 zA!=-_P0O#8bJZP%r?)OSKnFc~;?IZ*ZUZ9n-Syu^fND;HY>f~ut^CoQd* z+o__2Qw224u4wHv4i)vq=_#4TpbD)*&{{9heW(z()^dTPlV6{gl9F1+0hfV|EWU$R|6IpIGCv5 zXz?;qtFq--+JPJS_s|H+f@(Ixe9UN@iQaDBWGY#A=mCYZ=`+-q)*f~tG$|vONA;gF zWvHFDI6N%6mFPHjT!^{6X!DMvl@hxd3lDkGt=^cYU|7FogYm}Ph6KI+pe(~Ca z_=j!yQ3C@CL`F&tVX!?z+gR0DC^IpuPN#bGWieDzvZgti?CH~dKdznb>}dn2vrq(S z`MINE1)RqGjCyWI-pzRNfFW+3)|oW_VTOQg7vgD*!Wt_x(hBMeiyMVC$yfFrxmVlJ z&TYOM^&tCUVFjP=VXsQq^YgFQlJerCatbpO5(}%zjv*s`EIJ=}g&7aa?E?G+1x1#9 z?5fks4IHebStpL)OwB5*s%;U}#9U1m8hfyt&K=3~8BX|Z`uD1lfz`*(CAVO)&3iZP zzZG}yevOqiCgsZ7-!ElW6!0hkliXz|Po8ch+4ZqA>1;w%SCC%HV~^-(3z#cVbya0~ z2?-pcmA3B8_I*)_57P^o?k+87*8gxZF6Y73bcLxcx%Tkp{b%EE-A`j!xycK6{d(MN z!g%$Aou40T>+j9IcIxoml)Q%xC=+b;uJ3mzWZ&F>FwC^ zoU5rZnP%!1V2gC9?Lz!b$taatqi?Ir_R`;Ox=!VjNTm7(kc<_vwXy2x=zwP--|0F1 z3OfJvS;$+rZk1Ive6)NqU+=fgIR)y8#%*fV5y@wgIP1weUAR)n{ z%F!6WNda~gb%N-~I00>rp5y`1=(sGvrXzT*1&sP?6d=?AFXb}12GKnzf{=SW8l_dr z6$lPckm+lX%axB52;hMYNbM@1_6f{Jc;xu^d2PER&RMAP$Jl$hO;GkktY)? zwLF={jD4?>Cghr*IaZSv_sav=EbFRL>qa?^wQYq>G>!;*3 z^Y-V{m6Jc-{nZ$U$3rPkxbSCGOW)tW7z{qiK6U6;Ms}U~peZ)(7emwhm(6mO7__zD zs#OjB`K$4={H(Of!fR3Kqkr5v#xQZ&x5=wMnUEQN6dkbIB4Fd6iulq{`QGk9QdSy}ms6DQzV$d@!muo@i#Z-x`U3;QR1U|mlhT~4pAC!x-5 zH5do>T<<%!Gxw0r>(%-HzsiH9ghC-ZyE}~y9{>IHUw)sx{pVS~FC4wt%hSu))Ci>J z_^T)etpV1RUX&UTDWOq5ey7#|D@^|etYzT2QU4M|(&~f$!J?*nj{rCSqhg?jzv65$ z$m4nyDh*&_?2OIVnR0poJ7hrXM|`YQJ7zNBFZjKR^3SgK!4q70+!|R5w?{b9j!nNEG(Q&193&qre z%wi9m6_A=3pIXp7Vo?w@zu>Ch;}8H`Tb=U!)$IjJfOFRfSdG+3=aEMoPPfje)LQTi z2|nxmN~>QfJNH=h^3?vL-UtK#?{SDhg?cXnuPF}fNdTYPi0t|qJoVy#^h@{p%K@bN zCFJp9q8rL5O<3?2IJ#&|D%F63CZq5)9FxsZYt+CCsyA@oxByojupl4J4Tg(JTSI}A zPiNprPHs)vMBZF*cn)cSV_Re%fQkhiT#bpn|+k|zow=P}2 zeEG=t+a->U0|V@&fL%i@K&;0gBftomUQeRNIDJM1Id@+ViRUs%(H-pAo8&6!mymQ45d#*|Qdla5Ku#hDl zM9-Dq^$Y1L@K44W{9JE%wYPV0d3;xA2kK@R~Cti!3bV9ydY z#9o)Qk;b4p`v>^C*b?zfOP2GHAwkwAWHg3s=VWJQpi6qKMWOLjQ#V&j5(Z2m4B5ca z&Dpeb?-Nf#1XWcfRW-Fz%P}8)GRKvoMkuDvF7{xj!`9Zt#eo`g`*tbXapvrieY}Eb z%F;WD1vtMk%U4gd6BL(p82Sa+cW#FORLRzWN#B^lwsy2|vh?pac1R!7q^N5-BJ(Lr zXAdwJSL8Gs^$T`3X4<&A`FJ~-+nPBz1cD3$?q1dlp2%TVzctoWuAsO6b)cuHE>9vgDK6#Gl(q8iHyl-1y7nj z)QyH`I=fnd(_c*)8P-#l474$Ldln+7>06ILcjCaR6pXCWn*K&|BXesI2L?{-yw0^q z&;H%DFzQ#)C+|n#HP{%fZv=5*C>RI!*3ZZu*?~6`2lf;c{}SK@W52pNZNS=5SX@?K zQ8j7Yh=O83j^8kK(wHatb@dAkqDFxjd=yw`kj{*=od(NmpyBOKFF+S|CU%IGsI|jk z(vR){){QdC`lFk^4&#nHvvaW#+)wESV6e!`LZF**U`HcjzwzL@`S%CuwO(Ev*z-F9 z7DK623ZftMR@dJ}?+ajnII!eQeH>V6X&HB%48J2w(0yyKb^Vj{kb}lr(;QZ*x2)vPHN5Ag<(;cTL!v%Hgtq8nv>Gfth?Y~6?d`X}+c-^CwAYLA>u+nIPYf2N7L;V(tJe|4YirW)-HfjSlvgT#b!t>b7mwE8u2nZx6l527mml@1 z%SE}dN49O;G>-(~+BzS6rN*k=OWSx-KQZIwiH@)zYR)+vASy*}8S>@rPOB z|2$VPBr8WZJGO4q_FqL&nG&B~q(@IskeOH0_TSk5Rn@6C_wC*R)ZV&%Z)92TZ z1Q8US-oAC~pGUG9pU=hnrj&&3b|Ub~LahG(!~K(sn;!YU-*MoGKm^_(0&my?d-g5) zjXWQ{ZH@kYHF@$A5HnT4%ZM^M5wE$%Rkn+y;y}uW-6&mJap{A3m7S?nuyT&4kgBjr`M>9Tl|MZB^OX62*GH z>S5UCz0oClQ>!ii{>8)hTGY)qcAd^?*AO0&?z|f~!(P4(2=qh?>}|lUr|Xzsl$S-i zUoOu_#5k1*!EtHRP2NXD*rKMQ6#4z+;zW(&(Os=Ee&-iIUto^})VwqLnsbZm{;_Mk zq8mHEJ@W*yLfgf!Hbhtc69s!F<9Y(ECn+%J2_n$?Fg|6Vl_ht_BSX^)X9%f2wR zNUd#=8V2=q6X(@xrBc3X{P`b#>1 z!GQ>c{D%6vn%bt8y3)M7{PG5#sI@rs)TNk$c7~aSxe?%=Py&x#erY{8$Ei`v1f15& z;)248wnyx3D5Neup;%z_^^sq``|i8FzyB~H#Fm6o=q@R%2hD*?+S{7TE6Q6XlBTNa z1}^BMlH1-?3Hn{DOM@vBi*%&lz<`vAnhO&zoC$qcsv9Utdj-&^h6nnt6$rSsRn>K^ zqRvfUCEj_MFSX`IQX>dHrU3GPJX+CFR|HBI)`--A)?eD%+)!Fo&6SF4%d472x&x?M zSxa$VUSWO56Sk=mVf%jg%~qiH_ZxPNMw-ehI#3#3MPXikWwRb}Iky%7Rb1ODkdy2H zZwFD!Ybh%zsOE{68_HLYD z?|KLVujwpg59w_$Q-jmN1&1NQSx6l@zCh^e;@H)}hPJv;(Lsqqf|Zd$)|?Rf@MZ2_ z{Fbz)xVc;;7WuP60-S?Ecs?R6KJe2a>y>*}j`enMaB*{SGoqvU<*|`BVsoqc2KIJL zoTB(%=#9Aa4g@I*JA2}4GS9)u$Ht0`)7EE3?%a5yP)V?M@vvknldpx|dzjUMH+C># z=+#h5YEz=yNB;Q9aQA>f3+~O!S?<$@8DraGE``Qr)f0_a^2Yq=R$~ed8Dz&)*H_gS z%FHZkQ%G)o0c(bgu5C@ix%&xIGb?H{PwqLJkdqj7Cae$%478{^yW`Un;pwr!z6lx` zg1xkU@fssT;K*+bW^-nvw86XI)SKtzeN zPu-GCdT+EPU3V&hX38cB(ogPKz2{=$t%4c{Z`=0FdJG*AYi&n*$-?&^h)j&Vo2j)l zM<++!iOWri3X7nKDTq#Zg5Fqt&l>M z%c?3YJhj6-z?BwzEgC~l?1{Lap3s1@pfnx$@sCS)b46s^U@vnF zN|=>WVbjM)SXg4!$F3%=#L(4~-Ee2$iO9H^v>LS`C+Wnd!#Cp+!lIMw^J1^xEXDM9 zqi02IKN^u7UsR)Hxp|p`CgDQHayane*5a3 z__%};MMv)S``J8uPew*^i>;0F!ST-lqsPshQfoisdmH{Ze*MAS=qtAprEdLw%&59? z#FFXS@=I557uVGZ9ESy)C~Bk5Y(8}}Exx>iVSu``d&{wFanY9!+^#~#4GYXVyLn$k zev43MY)mb={OfOj-j2VKST1H-8#PCt0f?o=*QzWX?agVgkfgeotwo?a-9HOCz*uf< zVa;N(fEo01aj3d^qLkg=&wyL4^$)fu^QtnlOK`!{oXf6eT1=kk#zM)JDqwy!G&F#i zFpzc(ghc}q{Hm%dGMNkrGJs8{I}6#+3|_#qkS}*=U~PH?o;nK&ePF$FVvxwhb}`3P zY5%qJW?xMIp{5fHTXRyYA7bQa9#5*{Anl|f)pE+KG((05nmk4UjmM%?lJ>gFiaW>l z9Y2{?Q*r0lV>hZQD_gjnjy9oGEv%_+)4R{a?HrL-(b3e@Di)=l`f>Y_*y7@p18X;g zc5S)=wpFcK*6CX?@pQGNHGFxiYczlx_$0ObWHe>{rBsrM4c-3u4Zi8hS-}8 zLH&aqaY##LbbNxr051cPNF))6q*%ul+fH0LvKYy|79Mu3p1u71<*RGv1~Rx=r_PlP z`08qC_|KZe^l~x7!M-x>c1|0q^5L~SE)!3*CX_v_v>HBU>TnM{(y2G1(EuK@zoP%u zsW)#G6X!=pM110|3BQnu=y?7?DFkC+|J)bOAG3T!Oe$7|&yxjauSS&?F3a~^+%>V5B_lJ;WvbO5Plh-86_TC6T zxTrGxUO{Oa&T;h4qn8eR>Q)?^-04q3w7TcEMuKkXZPGNwhU05#~GJ3^G}z|rGpeX(x2_rnu^9sx$6 z0jnu&&%u+?9a@JkfB*fRO!%1=Bc`6bf(8RL6{Tyv=S+vH7_oHju zW!^)U?)Z8RzJvYK-p`!`RrjtP-?A?QW56Pp-aN4Bl_no*ecl##nV%U%4ov?hNNG@uqC@5>g1TUUEVNh_u)Mcxd z&+B81LF0V4?D>A~>>&=W-Yf%5QCb?S|I|54KbbeoO4{C-bmwNeY~tm}t84p_BF-f8 z6-3Xu>q4&{8_uZ7&409siN;$@`)2DvXM9flsc-j&Ke%yj*YP5v0Sl9LdH>c^rF`0i z1;0gv?{(EyCuWos)pNY3hA=psoQILON-PhAhK5~UKg>{Y`@q2y2~vPqL+Gv}7qXta zk=Z-fj<>j1Z84e1fKlUy`nrlU6M%zM_e=hp0AnjTIr;G6!(i*2$z-ObrGeML6#J($ zl5a5{Q1u><0JOk*{1E*o1?3V2Rc2V#T5Cmg+%xjr1g9BS3eL9hg<3g^tRZP-2%wtR z-G^~_j8drhe<4GNG2MtOZjlJ9s%vYc+;*XgJ!Hw+1tUk#SUzz?pQ*pEm}I7Ne_-6l z&Yb8oVA(foC%W^m9&Z}+^NuZB{`_H>AUQ4j@4+>Qnt&%do8f9NoV;Gb<+O5ZV+z__ zgU4Duh|%D6&%tziC$c*4=6xL}zK=Vptso)|@9D-S0n0>#BbmE-I+IaK9GyT=w+ZkD z7JY#kVN7N)BrVMvXGcpGifm$v!ZVm=4xXxG;Vsh^ufzeidaTC1PygxPEb&pc#inF7 z=owt8P9DVSyc!T`rW2L0wWb3@H|q=7OHJ9PM3F=a&P$_I9$wYSkcD0H!m&yjI-K z#rZlLfomqfD#H?z=l@plRU7LE5AHi}qvHattH<|OX_>MYj5e~`Z?i-184%q=Yq!9B^q z!HJDkAZU%Cg{!4|4eB>&;)2!Rtr+pRBDsw0viS4OTefUDdEz@&Q)XOBk%Hhpu>Zi} z(?4AE=}<&MVO#m>rVE0Aga~RG+PeSvrK`uPvNGd~N;+g(kb?nDq#1ennh;tquHI3| zH5oV{z|w%CmIFH<3v$X35P63HAsGjP?im}IllelWm2+PQfF@c)H|PrNQOiUElJ&IZ z-|auO(L5&@A!z#k9vZm{`z~zIN>m0T4Lv$M418ez|CZ zAwgjl^#1LmtIGFJShy>)jsx!fPd-!%g;GG_4n&vX8{A)Y6=KO0(j#Avjs_M>WOh=0 z<=(j6NE~2iAXlL6CNBSC^PY?McYGck=sjaplT6-OC)3rWr7l~@X96BmSJ(QCBCaWe zge8Gvn{t^%$QS8CeiR~(+_1ktvoUtV*{~~DqOR97`;KwS3p=^{#^DQvB$Bm{x1B=X zT2*d8Xo?}KBt>N7Vbq#*JXu0>X5;Ewnmcse#F`BoVHb7i$nncJZk#^y+t=sO<_4Og zO((8|T}iJo>uZPOi6k(j5ee7ISMcSM>f3h?MBX@e_DEA2@D?WD%BzkjYd$}j@Iu%0y|D25pdc&9Z?Sbd|PT;wT6TG;j}Uu880po+Kujy z&A+}b?0RTwc9j|p^7P4?^V8GA8(H>dh^Rs;X(@_NENbi!i)9*=n%9Vx5g5i=q=~Oo z6Xk6=2^o2{94*7w#}Zq)`N)-s^YJA{fer)?S0DraDPVMob=k5yg_Cn})eqmCx^d&m zsn7;zpCO|Lg;)!;ScXh3Z|*>FDj~ocOwW*khIv=+h+KoIcm-FCSi8HMHyqu4{KmE2 zyMJAC&2U5?4+5XYAl7q4+)ht1l(z=~by9S4a!kzr?^b-e>2g6_T5fT*6c5OopBBIh zHhlQ-88c?wy?b}pu3f+yTd`sV*oy=%vA3tQP}5$50E`2BiwE*w;=oLdOnEiJMtN0A zL!v^dxRxIlUzMs-qRc6VQ?2LB8a$WE06qn9OQPFZ;IAIvc`danFXe7xsnE&9IyduL zeoaGJYJtqqGsIDG^32WFdI8ooWS}!C?(E?Nlx3iY6IJ)bh?L$sbRnbO$aSz6E&1HZ z`^6=9@8wubnm^gasPhJ`s=oZkk;LZK!sP4e)x_Cft#oITv`sM=B64}{w_G_bbs=WlLdNNBqk6^|V- zFnTT-^}!u$#Aw#)@EjY6DBw} zC0~unuQBxr$I zV$*Ooej_Ig3t={87ik>&`FJ=7j2Y&TcPsKC$K|Wf7df+VL_=#AI|IP_NHnl^cQV%9 zB&ZgHe4RLnVfS*1G@iqkeLQ`zr*Ur7^<<9A*Iz7hV&O;zR?apI1Y-zn2DFCEWQt0w zN)*jimDFLsteE2N!l)~bO3D^Gcn0?y(bt_+n_f(s^!_3yKjlp1L$ufEnIk=k2*ugm zmiB0424r2wn%UXen$g&n_D0sme*Gs7bmZI)zgdH@0tXEV@vybBwgWi{uw*lL7q&`C z4IVk(%Tf_~F`@+LGHcEVvqveFfyWJJ>EK{(3`U$xBS_djLx%;K-wVBv!edXEGdaY! z54FAeero#dX1SH`prIaafg%3*=G42{H31*3{U89zPpl+*__*2IyE!_#xe;>jgrzi! z9D+y99PffIEodRxyLq?`9zM*O)_yhOA;Ek8PxAxha;%-Jg9#m@QRA$g94y%2G=?r$ zr&W7pUF*KN#ZgZ$WRrbmdkp-RHfTgIHR;jSC1+B;bvWu@ci^;|EwX(F!@q zZ_wxQ1z?+Q&({i)-osR7D#rZ=& zEr0L51tSe}&SVQ5Nviy8S>Pl!gW!1F}lP8SoDx%dQWhG^a zC2Sqv8E!FVp#9Lk{(V8-?ykbhhK#cj55-!HsrT49!<@JU(O2Ti zDduj$ecg>QtyiukDzWAxXHIuBQe@mbmnL?ZGi9)zaH^x^R#-x_+lYCC9aJ&rFBEW8 zo+DQeCQxE*fW!d|W9&M0F>rDMW{b1!tbLdxk%_H#on(Hnneq`(#559Zf zm&}Q;6*XsGUma5;b!Fn(ThI={rgd>8tiV81f=VLQ5%K7aFyIX1a5%vH z0x$F*LQeeGH(lPG ztw%#B(P10>nS(FT}c9wLb-Oh@mmJ{n^spP6Y#_sBV&3G4 z@9Anrf77tR_Fo|aZ`K0qPRC?&xk4`QGPZyb21Ne&6KH{T2SZrqe?*{1WF`6^`v5QR zCIVy{$=|Qfq~ViCg^V3HXu^mgBf#ck&oRG1FVHBEC>Mv)h$`|EnsovENJCy?Ollnn zF9U2`*>RnWq0bg|YfWiE`4jYH-2?>`lQi7FeCi+w!992}y-6R5^}ma@H9ziRR2sLl zK4D!}^!*ghUwl>nd;R~f20WQ*(&No9pfQea=pERlDe!b)w0IPd(1fC3H1$Gz+ z`~sVgkO}O?frMAQGz5D1BlJt_C#u)ND_KK=2)ML^Kb z&%Lw%mwm^h9^_U%lM^4wj|n>+p`+S=QIXWe?cQ;vtfi%;B<0K>UtceHbT0B)^=Qk| zVs0l?ccTe;>aFbymToU-0liS(-TlRc`I}4r*?#Osh5xNcN8IfPg$-|@;s2&Cyb2-! z5r7E1vk3fUfq^aX=ZZdvtmg~R^SOO_+Y3B1p>=mU)pG_BWU>K|p+FxLj&01e%TFuT zAgwaGf1tA7UCVs%G93?C=V$@sR0m zxCTKBO4iJw&~4rNvH-C^rxEZy)--TINu@$A;kANyEuA@YG~#wpV^wvNUNuC)18-}Z zIl|6_LZbHCs;XL^jzB{z77Lpj>)RzVVMlutN5=~fT!bB<;+kd&$N+%os2G~-s;is$ zQbptK3m{EUjsB1-6o^0%M4&s%)Jrd;QmK?mCG>dp!1?eltE7tqE3a-`ws;<3h1A^( z|5*Sz5ZE$rYy@dcdbEI>x{;9)o6YXsr;AA>VntP5MMd?b@gqPaeobBD#BsxgLeal3 zF@X2EqoV`FpMn=}d=wc3WN!}2*uvraA&i_02O_e~<}H;Rio^R+CKQ2@^Qk+(Q^FEt<`n2$i zJp&HR+|&Qa52$lj>)39_{JZBfN)g$hZ+Cp$*G6{&lwWjZ?Gee3JC~RNpIh;ry*n$W zul3J5eJG&@LkyVv$wZ4=-)*=1?ZkA-ozK2{U^Bp)YCL?ld;Yrhhic_Cn(2r&Yi6Pf zjvS6^5HoCs&iHsyQ0HMr6!*%33)OX1g1~9>%#oa=Gq+j>to>rND)!i}*cyq-V)Ejt ziiZ~xOFIO@29@EY_1ivhEWPmC(S!~a%4q1C@26s;k9>JH4J*U2+{S+T+gQ%2L+A2a zNQOffFLY_$yX&r!*4D1H^)eX6IC%Kl5Yn4;|GqrJ zNc`6}9PeyHPsM@h*eJMsQ6E2Vz|q;2CrghGFuA~d)lXdT7Q6dU_3N3}f_lWA0*bxyF(jb1 zDa{CtX*kG^L{Zh33+fw6IrhWHIso5Lb9s5HX2@LMio|@0N?2Y;Te*ApmqSodkr}-9 z%rfneU3)eg$t&6<^6I2C$0hqVe&i8)D#6go4kOBvOOb@sYkaI570c6DvMVp&p-vk= zfMvmUwzf3XodA`$7d^;Q4Ib+UXhjv=#?s8pw5-_ZLaeJJJ1^`~2Wx<@Lq$f5gI!Z} zD&4^w5NL2Y1xfKP)3q7Isjz z#n~Ls9e?f!A-7gHimLCNzEN-NW{Xcc9nq>%i{!4q?^)6qmKOB!M}4r3g=KYdXHVr5 zJscTrH;+fj38;3h-?pQh#xtvu3nfrlzJ9D(kzQB*4!8Aa70 zhGMpv72uczak6mq@vE*Y+T1+WH>)v7Jd1l<9*88XFMMqQ(ZTmzTdih%EPCG&9gt%adAoyL$MK zT(IWTafXlMdl8KaXW-M{tmIB?nPHGG6{D(4k378Y8q>+m)fVt)A!u`_U@se8t`tL4 ztt98fw?~@M7H)2i1_T{zDBXGp;OoF*@kB*yO%2w<0qE2J!_Srt^S5SNJD8J{Xe&2I zQ!)ln--;V+TUjoiE*`#PR)4<0&DPw>%M+X?mC@MXm<8aK#1WwTt9w5%SgO|{0G2!b zZsUtCn7s}O*rB%ofoDhJgOsHpKxOUPwIJCD*tCKf8{X7N0;cA?yu9zf|9lF-t_xHa`cA;mV(NK;x_+o})S!XnC+vW$CiadF{iuUx(Fv25Ao!8Z0( zyr-uv;HVcX31)82tooR!a*B(qElSWXrg;yw$P3+nC@wB)`|@A!bBss!CmXRn94+w; zd>rjja$!WFTl-Pg{YQEj1_$}#xdM@}UEI*ju=a8@z)~BeQn^?tl7fDy<$#q)BCadL z(wv>#7|c2u!_$*3%Gi4GUR-8su88J3Y>c%Hk>crTDb`@sO0`0wqr#U8g)*fIRH88O z9y^?6gg5o{FyzWWW=6S4*h#XlkVsSrL0zBwFoz2R!MZi=V4>cFfbLWe78@QO4i>%Z z*RK-@gjeBX>pghEp7a0&{@R7qvC(x3Fu%&m%D^pOC=@PUyx7gn4Lni+Rl)oQUNP`t z4^aExRM2+;>_T?aSn0{#0S-uOYin?1IyyQUMBw%5(+Aj9`uMhI?n3GhR|5gI8d!r) zpFR!v1{W<_)U_uIykfwT1JV=H(1P?uX{~4)!vO3;0{0RTt1@=;3G#L(5f}`OalfGh zoh`{yvBu2C($v(()7=uMkqeaUaWh8YtMe}1N}zfKj13+$exhep)cJ^X{Jd4G23S$i zYL%g_Lr{>9kqOz@c0jO|1yxZM5ph@BZ~Dj62hlsNB|KVDot+q;l9633@LKrIf)=1k-$pJG5ly_OOzB^lbRpt?0b}^gj~7n%vQ%F@ zapFN6bNrl1PV~-vOu#;rsu-rWJ^=$qkMp5xC0r4$-^k&%=h|IY{D)o0m+qzl%bJ6OLuF+pSTKR(z|+(7MWcb?F64`kJiOus z5O@YBzCIEk(dtg6f%yl_ubn%0f{6>#HTd}W2m}JX`$Qj!UteGU0HgoI7{!^y$;VYT3=FaTtl; z3+H7I>(X-=S;5z)rlwwAUSLNhJ3AZv1-J8VPTwBZ)83#CKpyzg0dW=Biv&B8AeR|f zU;h1s0k{MdaCLPBM~!N0Ym17CfKApDJYN4i9*{TzYc?dim2L>!KI-UN}M;{FuH0b>K z^ZWPj2S(US_Z2@+EBO5*1c3Pktf&neHe_aIg3ZJ!Q>Flaf*5rb?XZY zB5sJg7n9S}Nn5HGrOaG%hFSGs&yd>;^xZYygG@vIsV>*yq3;WASzyNQhafXL?vk{t!Qj&tZftZ^k9bW zq5#YFBm}@h_u#>U-+%udEO)^D4>k?JV%U=ugt|Zk{vQHQTVQ(13GjE}!i67x_#xQN z>)M5c$i039z#|=(%LUfcIdY^#B6+U)rB@PcI|3irr=Na0ZQ3-jcMQh#^()`a z7SUKd3TeA}Zp-yba3|+o{Q9G>cV6HF)~@W^yT9FW>~4I1^)t;QO-}TsW1;!oY~{&f z>gIbZm#*A>LC2>rDG8f1V&=~1s{c^W|9DATWkz&-XupWrOt3cq{XCc9J1Mqu+n>Vn-z@}tRzJI?8PO}#!C>_PMi@9t0oJ3x(~0$*K5DgqKEaSpx6Vl~(W2U=1kXN> z-26sF3Yh6fj0`b0pb!z2N+IfKZEof32=9TTOetz>t`o=+0!c@^Amf9tI&_b^8l_aK z`xogfr&TJ|DzGUl24Cxm=Jle)8Tz{SvqxpOfY&W$YWG2ocr;2S>1YPhF3}k|h)N;j zx3{#ki*(g#6~gwG=H?czSZ@F!qK=m4Rt^uGoYXZ6>ThlpbaL{mRU!eGBM>Xq@{V?% zUR$+{2kPa@bTt89Zkd47+`^HlG}URhPF+mo>Phy2ps^$}0nsW|3Msd(rG+Ez{6fv+ zw6^o4YGK*s<5yD4+m#x%Oe$(??-0v7d#Y6{6-sbYQX&?#bNLF5ir3DSsPzqtfMRXJ zM~W%LKnyKkjxjXIg23=`54J|K+W_fW zYq{2QkUd7L#o(|A&Mj!HNq&BA)4wEx`l}uI3L?-=1oRt@`9t&2k(`wt>tSi{@d zT^3jtSjy5nO9zEjY4#fIMx)V0qj{Rdm|}_v&q&nRum(Y;NECu%iGma1-D z*vb~RyxCooc-~VFlK39@?wq3sxO4BF`DX6SH#7hL{nd3GtOZ7Zv4_>>aSSX?$PP}% z%=~iM>_s$qePqt4Q-GuK0kKiVcQJ;1Ujo&57AvK)#R@XnN?D@gwkW zzK~BDn3ty;Sn0o)w)I%@ea5S}`A-JpF~A^j>l$mswUXnttr;QPOBDLnP~d^w4DesiPk_Bwl$$qL|BB z&!co(ngj9Pe;JygFJpuO@kDxD9^3(|LVg2^|mbq zT?k(J#Y@G8-frk8Sy}lV0-nO}on4EGgOx*0Az!-}rPK>rQ)4oQon7qua&A?&k1&Q{ zGe16f^dI(Rw;pS|xmh?b`(&N_(~W3xZ(e?vhJsN)Z1>Zp<4bf~(#skA#*!Ai>Ebyw z8v~Ne(EXzw3pfSYOv2oK+o=t8@VWDyWrH=DMT0QjfTr{MPZw!tXQTdk`mHA^m4e~o zOVK69-foD7%jj^E=#R%^fYvWZ%Be2yu%GE=YP)Rj zR@00dRU%<)ehnfd;!*&tI4)}t+t)Sf{(jWSEt2B&R+$Zrst+(^)})n*jTZQN5P4^0I&gGsZu5Px73Tgn|7M2Qlvc;$xxPAq4(F z04x%KaTnMJQHF&8QHdBVwx@?18ihuokl^s~MF}{WV9*$%E)m=|nUgM&2)-gX0`Zc% zyaAWMZWf&Z2-t{|qb;4zVzNf;ZLQ$Ito@}4G$I~{*VWb4o&-%u&?Z(h5E8i}&g3{ zq7U@(xRBbyL)67c6vBH@6`cT+~Lm3K{=-PVOrV% z#ldi7fJ@Ye5AdBgyiFs(=|y?%Fn(`k8;<5rHMeq_F~e+-iJuwh4&(H3wLE51M~jMj zL<3#zViR9aD_g27&4bj%GFZLFPhX2$kl&-B4IhPD%%5TT^ve|Y=051e7-(vl(1K@} z57V29T1o5Q^}>jHN=k-ol7kNw$nV2O z+Y25rNkP6;L;T>~2f6J}EZ1%dG#p4td{`?sSh9AWwRo^5yOFdeKqEKd5{LGVgN!kv zVd-YVQZq1qV`j0?elf(r-k^DDoD8huN#`sBv7xCYpfzB_X;KZvU}*~0s2yEBV5h;# z!fbGG2$ayy&JOIT0V5D7K?wYH1c03)=<`5VRn5TQKsFtOb=J`#f*3Z?dUOhnhhRUF z$LHJGSO)sjy1IMsXXk4X2rAWyDI@NHh0Ct@5q)ON{K`)orV#zMZ`nuL?vD$@%q68; z=PYkpkWdh6d+OU5F%j0qwE5}yMttk7J?EG!XS36D`xdTQRdD6Zkn8rvvTM~^i4co4@&Ju?sjt8>x-|GD3dp z?6jzzmo0aFfG$t2k{jSNYZNOty=~dBGpuZeKanxwb^5^4-u#%bT&b6+zmo6#>Br{B z4_wt=yu`8Pa+?I@pb47$@#@rs6ft*v@GDK%dO_#6mXVpAn8Lj*+QJsk4ZBx)b5HNPEHy;6)uDHW z1Q&l3+2tL)W1evD!A#e=1p*#&zHKc3MiX|?R$4>I&+;?j?>2S?IHN#Y~O#q=zy*jL9djeR~FGsPuB0Xww$QtW!s?7Wa^;)VZ^_FQ3*E ze(*$ooB7&rzh3P@W|m+7txB=_y|=p_{#uL<`p}QukPvw`r3me_{JRfV8R3*CeuCb| ziCLmG@6Fbh!{CU~^32R$jOR>zZP>}HEIbZvH8*&s&M?R9ot5q*&AE50bym|A80?0LfG>(}cE z1~87yVZ&S0!Md#bErv^-`7sC2)DY}0ni+go0LDfE1q)N$Rpe+CpK8vtRNqN&^p3Nny`d}ZGzu<!LD7^lrd;_6IKIzLNf6 zL?VH`R*V! z>ZBdGUTeFk&50leHhz!+0|W9R>cELpnt=feFwpM6$pdr%n2Ck$ZACKEE+YC2!6Kq_Mo^>+17L|R=jI#l+!_z6QL*Dm9?RF$<1 zJzu#|%pGj$_;=YVimMNh%3Ho*CWr$rWVGg{-MxA9=H0AX_Lyv-vxoImGwgLhHMyRN zfZ@$djVC~(NJb_kEVTVKxmxqDmj=v^U>X0C1TO#ex4aoon4+f^|6B0i4AB1VvCPmG#PdC-xkTc~IEU^;}K-v9i>wk%`q4 zKv3G3{{H&+j>W4q@tba~@n3c<{TXfgXP(Gx$TY5;Z9m<;@CUa}Tq1v7pxu!US9v&p*IJ2aiDmV_2D3z-9A!9t(E#fP_5A$y3Vk%j7b(Z>mC}+|H9r_~43KpI@$!jS2*#V#ovLmHP~I!z4ri z9H|%?83Dhp=Oz$ag{ZHu+yDSx+)#oLfDlk2fZVoi8<9u^%a?Hm9E5O#5cs1Ut+}_ezH)d(oohz~QGS-nv$S77G-*y_Iy|uf)Iw3M4H9avpJgHMFz{hOp z*6AGw&)iC{V(I!W2-3?r@YNR)my%mdt<9JfKcA{}U7&SgOPF-Fb4Tp8g7(qD(wO~c zBJZVg9BD2FDn0j6M(dM$j;0lgk8?rQW-$#cDTdDOq>{78j{R~sze&Tkfbbi@y8I<}UBK?MimoWFZ>Q-A^o&e_7?RrM@c%8TeA_omzm_9&~mUjFXU6MJal)RY9AKw^%pSW(Rr$STH#==}*Y4R_kHx#zZjd6HE zPf07!*p`S8A!HSaQN=PRX9_@`pqhuIi$olIr}G6s#ih)`1id$77!K%hZq=u6k=en z)UVW;-&6($G}2$ylW79zLAO8%yaWN|sf4bLHD04WB~3~-HgmHyWgxw4FC? zT%e~Aiu8hA^srXOCKf;&NCPY5)&3e9-Nr%b=n&9ibxfS5IF7I5!`jv)Wv8h+B%m*hz5X(=4y7?7|!E_Q8&MO{WZT4=0j zR45jU1bl%Q*i?!5Y^k27J+iMP{82?|PF`l0j@vA9acb(_hRm#Lh1A&9!&V`FQqycV z?`>^M_H`h0KZLn2YVtCwr(aK$)%(WpZ z_`_&@lUad2+JrHjY0zvdV?|GK?9~*>^x&Oqf`}O9hLc>(VeqgnzB7WBEOax&v4`BXYCX?!)EBp`H0-M5wffQvH%B7 zm8i9VJuKHW^Kdd$RZBe7FQ(3z@2>mgQpBa=K8d-fU+@enyzxHEap{U_4%VJ714VHs zqLR6GbC%J}MLdkFmn|OJ0)sw^Hv$3Z6mp!+2%SQX6R2miy?LjQz^n~8ufQKXcwlaB z4jfe=P5cRT3+R@=f`ASV@lzgGhQdxQP5f7>vgl#_fkWxYgJIuJCu_dSjZj_)fhmRn z2ssRl@m~_0LkEkvTqiq!J#&vr6CcbwlU5V|wL%Xd0>bEE0tV*S(CO1Sp$0bi91aH< zO-=RPA|QniL|Z^yNT6VBW@ZL0z{lAEpllEV6G6bha@I$mZ1sld*F?aB?tu`15P%SP zGZ9d)Rg{rO-^}_!wVEmj08MqNUz5({= zv$kDWr&-H_eXPf^&>5q5bTYUq2o$6JJ%e1~#BIdJ1g!4f;palf?ykv5PtU7w2a;s; zo&k>NZ<8q(GMh8g(=*HKRLX2nf)IcZfDnKXcp(C6iT`m-4G@M90CI=bN1SU!s5El=khRFUE0OZz6?uBN{T#tF(D-@_I%ufhKXt74`2Ik z^NL-uEF~#yjyM)w(DrP=B|&3F<&&Q0#s+v!!AG8?{uGw_pCx8B=S75^xOyWg^7P5r z$b{1o@ueLvqp-Zb+RWUh@i0Mte^qSA(Tg{dE=L|d7FP5!(yA)&*htg;%o;w#)h5t= zp<5sXAOxm30_xC~N(Ki0P3bt7Q@kOd;=`1d5NIL+XINGNXb_7lF?XO0)X`z1Y$n^6 z=7d8bkjiaZ5D!}<`D4RI0sJG!WH4YHphQqA5j|Cwe{Nrvi$!9!NWMCap>*u6JSn0| zKzGFb^-M!|ifSWRJ_gkC{tQG3UML!qBM?ZSypKY{f!;p&!|yLrKS{!e87%oQEIK+m z=9^iAH`51jSPYOO1LXnf&(f+htHt`2m;R`R6j(1y)kTw{&736-8Oilx7!r*@f|@C- zrp!GCG7M+@nt1PV4-ol(ZjX^E0r=yRTqqt>z!6HZONC4-`=jcj%B(E9#pWwf(Z3%4 z+|g1YRUlweP$!8x$J1i}snIV7RY0Ot+8YX)vgW_PK@N}*D~t7elDC&;RVn5qMMcN| ze0+|xhVmX2n$Of!{Olca1ssJ&sv1_IgzEQascurn2Za)Zz?+Q#H0{3G?fatI{n749 z`UPf}ty{MOdqCh034RA=ZqH3>AzGkc{E|E`x)=I8gusgsKx5I5yFj=gWPlY>)YjZy zE48uh%@&#gsVw=JF`AXjw(-&H>+Tz>y&j#IayKsG+>IXHARlwa-E$xAKc1KdH1T~F z%rzyB2I>kPRx?fX6LarK8aLNd^tRI5O0NSzj?jKB>)k*?Gkp0Q{CzKYCaA>68GhvBNy)! zYSE~?yc-8k#Kxzj594oRNj6mqF>RUW___vq0h+=%P`3 z_Vc|zUi$4`>?46+fV(bQWz8UEHW%M$;u~tu=VBz*YuvCydNxlgb*)2v8n zRj4Q^O%(*j=?hub&@szENTyhjNF*?={C^IQU>XLKDbPk&&cRR`2Lgb80KH%EKNgFf z(x8D_XlZEyO?=>r0m2c%b8~aiXf%kW3brBu2SXqf^8Z+8g9`I_JavzOd^e`bfH?Wf zsjUG!TP`OWn(hlEvWl+97clj;xRU8Btr|;OL?}^Ji}&8;RWTW2{OF^H{OxD&>(Q3?c={r*bKf6!`Y6nSUd5(Z z(POSiw=AU8p`6w)3#2N!2)psO<5#=P46!hrOv*;!G)B1uYmKV70)(f#5#wGeZ{?Qh zjJl>3dqZVqmm>>>HaM77z~)W9yu@F!+dE5hdps}3?6%YZ{6JQjcwpC&N9GO&8Xj+b zw{u#`kvr6l+ZRxJuEghcbd)#Cedp-3Fw7RN^p!?m>Toq}xL1dm=A!@Tex3bH$H7X$ z=Fl(ws781VzzaLi{cz2|Zz-YofspJrP+e7`srZ|U78O&3?=;X60!yCQ$y=%pr(P?{PDjK>!;u3mofm*nk~4jY$g6bc0} wu&GfusFV-_e-i?Ld;=cY-Q5kSB=Cj&7e3L)S!0Y|qW}N^07*qoM6N<$g7a0I&Hw-a diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index 868a557c00..86d889bb65 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -50,16 +50,16 @@ In either of these scenarios, once the rules are added, they must be deleted to Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: -1. Deploy WDAC AppId Tagging Policies: a Windows Defender Application Control (WDAC) policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching PolicyAppId. For more information, see the [WDAC Application ID (AppId) Tagging guide](../../../application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. -1. Configure Firewall Rules using PolicyAppId Tags using one of the two methods: - - Deploy firewall rules with Microsoft Intune: when creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules - - Create local firewall rules with PowerShell: you can use [`New-NetFirewallRule`](/powershell/module/netsecurity/new-netfirewallrule) and specify the `-PolicyAppId` parameter. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported +1. Deploy *WDAC AppId tagging policies*: a Windows Defender Application Control policy must be deployed, which specifies individual applications or groups of applications to apply a *PolicyAppId tag* to the process token(s). Then, the admin can define firewall rules that are scoped to all processes tagged with the matching *PolicyAppId*. For more information, see the [WDAC AppId tagging guide](../../../application-security/application-control/windows-defender-application-control/AppIdTagging/wdac-appid-tagging-guide.md) to create, deploy, and test an AppID policy to tag applications. +1. Configure firewall rules using *PolicyAppId tags* using one of the two methods: + - Using the [PolicyAppId node of the Firewall CSP](/windows/client-management/mdm/firewall-csp#mdmstorefirewallrulesfirewallrulenamepolicyappid) with an MDM solution like Microsoft Intune. If you use Microsoft Intune, you can deploy the rules from Microsoft Intune Admin center, under the path **Endpoint security** > **Firewall** > **Create policy** > **Windows 10, Windows 11, and Windows Server** > **Windows Firewall Rules**. When creating the rules, provide the *AppId tag* in the **Policy App ID** setting + - Create local firewall rules with PowerShell: use the [`New-NetFirewallRule`](/powershell/module/netsecurity/new-netfirewallrule) cmdlet and specify the `-PolicyAppId` parameter. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported ## Local policy merge and application rules *Rule merging* policy settings control how rules from different policy sources can be combined. Administrators can configure different merge behaviors for *Domain*, *Private*, and *Public profiles*. -The rule-merging policy settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from GPO or CSP. +The rule-merging policy settings either allow or prevent local administrators from creating their own firewall rules in addition to those rules obtained from CSP or GPO. | | Path | |--|--| diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 234266f1f9..a3b5ee74a4 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -7,12 +7,12 @@ items: items: - name: Configuration tools href: tools.md - - name: Configure Windows Firewall + - name: Configure with Microsoft Intune 🔗 + href: /mem/intune/protect/endpoint-security-firewall-policy + - name: Configure with WFAS href: configure.md - name: Configure with command line tools href: configure-with-command-line.md - - name: Configure with Microsoft Intune 🔗 - href: /mem/intune/protect/endpoint-security-firewall-policy - name: Configure logging href: configure-logging.md - name: Hyper-V firewall diff --git a/windows/security/operating-system-security/network-security/windows-firewall/tools.md b/windows/security/operating-system-security/network-security/windows-firewall/tools.md index 5a0c57e9ce..ff0d3f67fa 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/tools.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/tools.md @@ -72,12 +72,6 @@ Windows offers different tools to view the status and configure Windows Firewall :::row::: :::column span="4"::: The [Firewall CSP][CSP] provides an interface to configure and query the status of Windows Firewall, which can be used with a mobile device management (MDM) solution like Microsoft Intune. - - To learn more about the CSP options, follow these links: - - - [Configure Windows Firewall settings][SETTINGS]: to configure the settings - - [Configure Windows Firewall rules][RULE]: to configure the rules - :::column-end::: :::row-end::: :::row::: @@ -142,6 +136,14 @@ Once the emergency is over, uncheck the setting to restore regular network traff > > [Configure Windows Firewall >](configure.md) + +> [!div class="op_single_selector"] +> From the following dropdown, select one of tools to learn how to configure Windows Firewall: + +> - [Configure with Microsoft Intune 🔗](/mem/intune/protect/endpoint-security-firewall-policy) +> - [Configure with GPO](configure.md) +> - [Configure with command line tools](configure-with-command-line.md) + [SEC-1]: windowsdefender://network/ From bf460d70a3d82c599bec45ed6d8e69a214384426 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 17:52:03 -0500 Subject: [PATCH 199/237] updates --- .../faq-md-app-guard.yml | 2 +- .../network-security/windows-firewall/rules.md | 8 -------- .../network-security/windows-firewall/tools.md | 9 ++------- 3 files changed, 3 insertions(+), 16 deletions(-) diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml index e1da302edf..5f3515a26b 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/faq-md-app-guard.yml @@ -119,7 +119,7 @@ sections: - question: | Why am I getting the error message "ERR_NAME_NOT_RESOLVED" after not being able to reach the PAC file? answer: | - This issue is a known one. To mitigate this issue, you need to create two firewall rules. For information about creating a firewall rule with Group Policy, see [Configure Windows Firewall rules with group policy](../../../operating-system-security/network-security/windows-firewall/configure-rules-with-gpo.md) + This issue is a known one. To mitigate this issue, you need to create two firewall rules. For information about creating a firewall rule with Group Policy, see [Configure Windows Firewall rules with group policy](../../../operating-system-security/network-security/windows-firewall/configure.md) ### First rule (DHCP Server) - Program path: `%SystemRoot%\System32\svchost.exe` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index 86d889bb65..aa98029298 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -111,14 +111,6 @@ What follows are a few general guidelines for configuring outbound rules. - It's recommended to *allow outbound* by default for most deployments for the sake of simplification with app deployments, unless the organization prefers tight security controls over ease-of-use - In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP -## Configure firewall rules - -Firewall rules can be configure with the following tools: - -- Using the [Firewall CSP](/windows/client-management/mdm/firewall-csp), with a mobile device management (MDM) solution like Microsoft Intune. For more information, see [][] -- Using the Windows Defender Firewall with Advanced Security (WFAS) console, locally or via GPO. For more information, see [][] -- Using command line tools. For more information, see [][] - ## Next steps > [!div class="nextstepaction"] diff --git a/windows/security/operating-system-security/network-security/windows-firewall/tools.md b/windows/security/operating-system-security/network-security/windows-firewall/tools.md index ff0d3f67fa..e4d5485358 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/tools.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/tools.md @@ -131,15 +131,10 @@ Once the emergency is over, uncheck the setting to restore regular network traff ## Next steps -> [!div class="nextstepaction"] -> Learn about the tools to configure Windows Firewall and firewall rules: -> -> [Configure Windows Firewall >](configure.md) - +From the following dropdown, select one of tools to learn how to configure Windows Firewall: > [!div class="op_single_selector"] -> From the following dropdown, select one of tools to learn how to configure Windows Firewall: - +> > - [Configure with Microsoft Intune 🔗](/mem/intune/protect/endpoint-security-firewall-policy) > - [Configure with GPO](configure.md) > - [Configure with command line tools](configure-with-command-line.md) From 1c4f51a83b14ed10f711793c07dd300478ed9922 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 18:12:22 -0500 Subject: [PATCH 200/237] updates --- .../network-security/windows-firewall/configure.md | 4 ++-- .../network-security/windows-firewall/toc.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index dca9af3542..dad089eb5b 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -1,11 +1,11 @@ --- -title: Configure firewall rules with WFAS console +title: Configure firewall rules with group policy description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. ms.topic: how-to ms.date: 11/14/2023 --- -# Configure rules with WFAS console +# Configure rules with group policy This article contains examples how to configure Windows Firewall rules using the *Windows Firewall with Advanced Security* console. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index a3b5ee74a4..075afbe659 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -1,7 +1,7 @@ items: - name: Overview href: index.md - - name: Firewall rules + - name: Firewall rules concepts href: rules.md - name: Configure and manage Windows Firewall items: @@ -9,7 +9,7 @@ items: href: tools.md - name: Configure with Microsoft Intune 🔗 href: /mem/intune/protect/endpoint-security-firewall-policy - - name: Configure with WFAS + - name: Configure with GPO href: configure.md - name: Configure with command line tools href: configure-with-command-line.md From 25bd98a51ddfaef049c5091b351664fdb6356714 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 18:37:09 -0500 Subject: [PATCH 201/237] updates --- .../windows-firewall/configure-logging.md | 13 +++++++--- .../windows-firewall/configure.md | 2 +- .../windows-firewall/quarantine.md | 26 +++++++++---------- .../network-security/windows-firewall/toc.yml | 2 +- .../windows-firewall/tools.md | 7 ++--- 5 files changed, 28 insertions(+), 22 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index b371495760..dd0f7055f5 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -27,11 +27,16 @@ To configure Windows Firewall to log dropped packets or successful connections, > [!TIP] > You can also configure Windows Firewall by using an *TBD* profile in endpoint security. For more information, see [Account protection policy settings for endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security-account-protection-profile-settings). -Alternatively, you can configure devices using a [custom policy][INT-1] with the [DeviceGuard Policy CSP][CSP-1]. +Alternatively, you can configure devices using a [custom policy][INT-1] with the [Firewall CSP][CSP-1]. -| Setting | -|--------| -| **Setting name**: Turn On Virtualization Based Security
    **OMA-URI**: `./Device/Vendor/MSFT/Policy/Config/DeviceGuard/EnableVirtualizationBasedSecurity`
    **Data type**: int
    **Value**: `1`| +| Network profile | Setting | +|--------| - | +| Domain | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogDroppedPackets`| +| Domain | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogFilePath`| +| Private | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogDroppedPackets`| +| Private | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogFilePath`| +| Public | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogDroppedPackets`| +| Public | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogFilePath`| # [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index dad089eb5b..4ead383383 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -90,7 +90,7 @@ To create an inbound firewall rule for a program or service: 1. Open the *Windows Firewall with Advanced Security* console 1. In the navigation pane, select**Inbound Rules** 1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select**Next** > [!NOTE] > Information the user should notice even if skimmingAlthough you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. 1. On the **Program** page, select**This program path** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md index 1217da01e1..37d303f00e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md @@ -1,6 +1,6 @@ --- title: Quarantine behavior -description: Quarantine behavior is explained in detail. +description: Learn about Windows Firewall and the quarantine feature behavior. ms.topic: conceptual ms.date: 11/14/2023 --- @@ -21,7 +21,7 @@ The quarantine feature creates filters that can be split into three categories: - Quarantine default inbound block filter - Quarantine default exception filters -- Interface un-quarantine filters +- Interface unquarantine filters These filters are added in the `FWPM_SUBLAYER_MPSSVC_QUARANTINE` sublayer and these layers are: @@ -37,26 +37,26 @@ For more information about WFP layers and sublayers, see [WFP Operation](/window ### Quarantine default inbound block filter -The *quarantine default inbound block filter* blocks any new non-loopback inbound connections, unless the packet isn't explicitly permitted by another filter in the quarantine sublayer. +The *quarantine default inbound block filter* blocks any new nonloopback inbound connections, unless the packet isn't explicitly permitted by another filter in the quarantine sublayer. ### Quarantine default exception filters When the interface is in quarantine state, the quarantine default exception filters permit new inbound connections given that they meet the conditions of an exception filter. One example of the exception filters is the quarantine default inbound loopback exception filter. This exception filter allows all loopback packets when the interface is in quarantine state. -### Interface un-quarantine filter +### Interface unquarantine filter -The interface un-quarantine filters allow all non-loopback packets if the interface is successfully categorized. +The interface unquarantine filters allow all nonloopback packets if the interface is successfully categorized. ## Quarantine flow The following events describe the general flow of quarantine: 1. There's some change on the current network interface -1. The interface un-quarantine filters don't permit new inbound connections. The interface is now in quarantine state -1. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter +1. The interface unquarantine filters don't permit new inbound connections. The interface is now in quarantine state +1. All nonloopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter 1. The WFP filters applicable to the old interface state are removed -1. The WFP filters applicable to the new interface state are added, which include the un-quarantine filters for this interface. These filters are updated to match the interface's current state -1. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets +1. The WFP filters applicable to the new interface state are added, which include the unquarantine filters for this interface. These filters are updated to match the interface's current state +1. The interface has now exited quarantine state as the interface unquarantine filters permit any new nonloopback packets ## Quarantine diagnostics @@ -64,7 +64,7 @@ There are two methods of identifying packet drops from the quarantine default in Given that the network connectivity issue is reproducible, diagnostic traces can be collected by running the following in an administrative command prompt: -```console +```cmd Netsh wfp cap start Netsh wfp cap stop @@ -166,7 +166,7 @@ Alternatively, If the Filtering Platform Connection failure auditing is enabled, To enable Filtering Platform Connection audits, run the following command in an administrative command prompt: -```console +```cmd Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable ``` @@ -177,8 +177,8 @@ Sample drop audit with `filterOrigin` as `Quarantine Default`. Once the drop's filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: ```Powershell -Get-NetIPInterface –InterfaceIndex -Get-NetIPInterface –InterfaceIndex 5 +Get-NetIPInterface -InterfaceIndex +Get-NetIPInterface -InterfaceIndex 5 ``` ![Quarantine Interfaceindex.](images/quarantine-interfaceindex1.png) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 075afbe659..1de1d50dd3 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -9,7 +9,7 @@ items: href: tools.md - name: Configure with Microsoft Intune 🔗 href: /mem/intune/protect/endpoint-security-firewall-policy - - name: Configure with GPO + - name: Configure with group policy href: configure.md - name: Configure with command line tools href: configure-with-command-line.md diff --git a/windows/security/operating-system-security/network-security/windows-firewall/tools.md b/windows/security/operating-system-security/network-security/windows-firewall/tools.md index e4d5485358..69becc531a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/tools.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/tools.md @@ -1,7 +1,7 @@ --- title: Windows Firewall tools description: Learn about the available tools to configure Windows Firewall and firewall rules. -ms.date: 11/15/2023 +ms.date: 11/20/2023 ms.topic: best-practice --- @@ -125,7 +125,7 @@ Shields up can be achieved by checking **Block all incoming connections, includi :::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: -By default, the Windows Firewall blocks everything unless there's an exception rule created. The *shield up* option overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access won't work as long as shields up is activated. +By default, the Windows Firewall blocks everything unless there's an exception rule created. The *shield up* option overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access can't work as long as shields up is active. Once the emergency is over, uncheck the setting to restore regular network traffic. @@ -135,7 +135,7 @@ From the following dropdown, select one of tools to learn how to configure Windo > [!div class="op_single_selector"] > -> - [Configure with Microsoft Intune 🔗](/mem/intune/protect/endpoint-security-firewall-policy) +> - [Configure with Microsoft Intune 🔗][INT-1] > - [Configure with GPO](configure.md) > - [Configure with command line tools](configure-with-command-line.md) @@ -143,3 +143,4 @@ From the following dropdown, select one of tools to learn how to configure Windo [SEC-1]: windowsdefender://network/ [CSP]: /windows/client-management/mdm/firewall-csp +[INT-1]: /mem/intune/protect/endpoint-security-firewall-policy From 8fd802554876bf2fb20aca980936759f685f3c6c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 20:46:01 -0500 Subject: [PATCH 202/237] updates --- .../windows-firewall/configure-logging.md | 45 +++++++++++-------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index dd0f7055f5..9a9ae72186 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -16,27 +16,33 @@ To configure Windows Firewall to log dropped packets or successful connections, # [:::image type="icon" source="../../../images/icons/intune.svg" border="false"::: **Intune/CSP**](#tab/intune) -[!INCLUDE [intune-settings-catalog-1](../../../../../includes/configure/intune-settings-catalog-1.md)] - -| Category | Setting name | Value | -|--|--|--| -| | | | - -[!INCLUDE [intune-settings-catalog-2](../../../../../includes/configure/intune-settings-catalog-2.md)] - -> [!TIP] -> You can also configure Windows Firewall by using an *TBD* profile in endpoint security. For more information, see [Account protection policy settings for endpoint security in Microsoft Intune](/mem/intune/protect/endpoint-security-account-protection-profile-settings). +1. Sign into the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. Go to **Endpoint security** > **Firewall** > **Create policy** > **Windows 10, Windows 11, and Windows Server** > **Windows Firewall** > **Create** +1. Enter a name and, optionally, a description > **Next** +1. Under **Configuration settings**, for each network location type (Domain, Private, Public), configure: + 1. **Log file path** + 1. **Enable log dropped packets** + 1. **Enable log success connections** + 1. **Log max file size** +1. Select **Next** > **Next** +1. Assign the policy to a group that contains as members the devices or users that you want to configure > **Next** > **Create** Alternatively, you can configure devices using a [custom policy][INT-1] with the [Firewall CSP][CSP-1]. | Network profile | Setting | -|--------| - | -| Domain | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogDroppedPackets`| -| Domain | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogFilePath`| -| Private | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogDroppedPackets`| -| Private | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogFilePath`| -| Public | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogDroppedPackets`| -| Public | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogFilePath`| +|--|--| +| Domain | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogDroppedPackets` | +| Domain | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogFilePath` | +| Domain | **Setting name**: [EnableLogSuccessConnections](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogsuccessconnections)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogSuccessConnections` | +| Domain | **Setting name**: [LogMaxFileSize](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogmaxfilesize)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogMaxFileSize` | +| Private | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogDroppedPackets` | +| Private | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogFilePath` | +| Private | **Setting name**: [EnableLogSuccessConnections](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogsuccessconnections)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogSuccessConnections` | +| Private | **Setting name**: [LogMaxFileSize](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogmaxfilesize)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogMaxFileSize` | +| Public | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogDroppedPackets` | +| Public | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogFilePath` | +| Public | **Setting name**: [EnableLogSuccessConnections](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogsuccessconnections)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogSuccessConnections` | +| Public | **Setting name**: [LogMaxFileSize](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogmaxfilesize)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogMaxFileSize` | # [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) @@ -48,8 +54,6 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the 1. Select the tab that corresponds to the network location type 1. Under **Logging**, select **Customize** 1. The default path for the log is `%windir%\system32\logfiles\firewall\pfirewall.log`. If you want to change this path, clear the **Not configured** check box and enter the path to the new location, or select **Browse** to select a file location - > [!IMPORTANT] - > The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file. 1. The default maximum file size for the log is 4,096 kilobytes (KB). If you want to change this size, clear the **Not configured** check box, and enter the new size in KB, or use the up and down arrows to select a size. The file won't grow beyond this size; when the limit is reached, old log entries are deleted to make room for the newly created ones. 1. No logging occurs until you set one of following two options: - To create a log entry when Windows Defender Firewall drops an incoming network packet, change **Log dropped packets** to **Yes** @@ -60,6 +64,9 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the --- +> [!IMPORTANT] +> The location you specify must have permissions assigned that permit the Windows Firewall service to write to the log file. + ## Recommendations Here are some recommendations for configuring Windows Firewall logging: From e4a12e020dad27d158e88d2c82fa5a3a9db75c4f Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 21:08:56 -0500 Subject: [PATCH 203/237] updates --- .../windows-firewall/configure-logging.md | 71 +++++++++++++------ 1 file changed, 48 insertions(+), 23 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index 9a9ae72186..6710346544 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -16,33 +16,36 @@ To configure Windows Firewall to log dropped packets or successful connections, # [:::image type="icon" source="../../../images/icons/intune.svg" border="false"::: **Intune/CSP**](#tab/intune) -1. Sign into the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431) +1. Sign into the [Microsoft Intune admin center][INT] 1. Go to **Endpoint security** > **Firewall** > **Create policy** > **Windows 10, Windows 11, and Windows Server** > **Windows Firewall** > **Create** 1. Enter a name and, optionally, a description > **Next** -1. Under **Configuration settings**, for each network location type (Domain, Private, Public), configure: - 1. **Log file path** - 1. **Enable log dropped packets** - 1. **Enable log success connections** - 1. **Log max file size** +1. Under **Configuration settings**, for each network location type (*Domain*, *Private*, *Public*), configure: + - **Log file path** + - **Enable log dropped packets** + - **Enable log success connections** + - **Log max file size** 1. Select **Next** > **Next** 1. Assign the policy to a group that contains as members the devices or users that you want to configure > **Next** > **Create** +> [!TIP] +> If you prefer you can also use a [Settings catalog policy][MEM-1] to configure Windows Firewall logging. + Alternatively, you can configure devices using a [custom policy][INT-1] with the [Firewall CSP][CSP-1]. | Network profile | Setting | |--|--| -| Domain | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogDroppedPackets` | -| Domain | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogFilePath` | -| Domain | **Setting name**: [EnableLogSuccessConnections](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogsuccessconnections)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogSuccessConnections` | -| Domain | **Setting name**: [LogMaxFileSize](/windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogmaxfilesize)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogMaxFileSize` | -| Private | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogDroppedPackets` | -| Private | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogFilePath` | -| Private | **Setting name**: [EnableLogSuccessConnections](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogsuccessconnections)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogSuccessConnections` | -| Private | **Setting name**: [LogMaxFileSize](/windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogmaxfilesize)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogMaxFileSize` | -| Public | **Setting name**: [EnableLogDroppedPackets](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogdroppedpackets)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogDroppedPackets` | -| Public | **Setting name**: [LogFilePath](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogfilepath)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogFilePath` | -| Public | **Setting name**: [EnableLogSuccessConnections](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogsuccessconnections)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogSuccessConnections` | -| Public | **Setting name**: [LogMaxFileSize](/windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogmaxfilesize)
    **OMA-URI**: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogMaxFileSize` | +| *Domain* | Setting name: [EnableLogDroppedPackets][CSP-2]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogDroppedPackets` | +| *Domain* | Setting name: [LogFilePath][CSP-5]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogFilePath` | +| *Domain* | Setting name: [EnableLogSuccessConnections][CSP-8]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/EnableLogSuccessConnections` | +| *Domain* | Setting name: [LogMaxFileSize][CSP-11]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/DomainProfile/LogMaxFileSize` | +| *Private* | Setting name: [EnableLogDroppedPackets][CSP-3]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogDroppedPackets` | +| *Private* | Setting name: [LogFilePath][CSP-6]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogFilePath`| +| *Private* | Setting name: [EnableLogSuccessConnections][CSP-9]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/EnableLogSuccessConnections` | +| *Private* | Setting name: [LogMaxFileSize][CSP-12]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PrivateProfile/LogMaxFileSize` | +| *Public* | Setting name: [EnableLogDroppedPackets][CSP-4]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogDroppedPackets` | +| *Public* | Setting name: [LogFilePath][CSP-7]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogFilePath`| +| *Public* | Setting name: [EnableLogSuccessConnections][CSP-10]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/EnableLogSuccessConnections` | +| *Public* | Setting name: [LogMaxFileSize][CSP-13]
    OMA-URI: `./Vendor/MSFT/Firewall/MdmStore/PublicProfile/LogMaxFileSize` | # [:::image type="icon" source="../../../images/icons/group-policy.svg" border="false"::: **Group policy**](#tab/gpo) @@ -50,7 +53,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the 1. Expand the nodes **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** 1. In the details pane, in the **Overview** section, select **Windows Defender Firewall Properties** -1. For each network location type (Domain, Private, Public), perform the following steps +1. For each network location type (*Domain*, *Private*, *Public*), perform the following steps 1. Select the tab that corresponds to the network location type 1. Under **Logging**, select **Customize** 1. The default path for the log is `%windir%\system32\logfiles\firewall\pfirewall.log`. If you want to change this path, clear the **Not configured** check box and enter the path to the new location, or select **Browse** to select a file location @@ -71,7 +74,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the Here are some recommendations for configuring Windows Firewall logging: -- Change the logging size to at least 20,480 KB(20 MB) to ensure that the log file doesn't fill up too quickly. The maximum log size is 32,768 KB(32 MB) +- Change the logging size to at least **20,480 KB (20 MB)** to ensure that the log file doesn't fill up too quickly. The maximum log size is 32,768 KB (32 MB) - For each profile (Domain, Private, and Public) change the name from `%windir%\system32\logfiles\firewall\pfirewall.log` to: - `%windir%\system32\logfiles\firewall\pfirewall_Domain.log` - `%windir%\system32\logfiles\firewall\pfirewall_Private.log` @@ -90,9 +93,9 @@ netsh advfirewall>set allprofiles logging droppedconnections enable There are several methods to parse the Windows Firewall log files. For example: -- Enable *Windows Event Forwarding* (WEF) to a *Windows Event Collector* (WEC). To learn more, see [Use Windows Event Forwarding to help with intrusion detection](/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection) -- Forward the logs to your SIEM product such as our Azure Sentinel. To learn more, see [Windows Firewall connector for Microsoft Sentinel](/azure/sentinel/data-connectors/windows-firewall) -- Forward the logs to Azure Monitor and use KQL to parse the data. To learn more, see [Azure Monitor agent on Windows client devices](/azure/azure-monitor/agents/azure-monitor-agent-windows-client) +- Enable *Windows Event Forwarding* (WEF) to a *Windows Event Collector* (WEC). To learn more, see [Use Windows Event Forwarding to help with intrusion detection][WIN-1] +- Forward the logs to your SIEM product such as our Azure Sentinel. To learn more, see [Windows Firewall connector for Microsoft Sentinel][AZ-1] +- Forward the logs to Azure Monitor and use KQL to parse the data. To learn more, see [Azure Monitor agent on Windows client devices][AZ-2] > [!TIP] > If logs are slow to appear in your SIEM solution, you can decrease the log file size. Just beware that the downsizing results in more resource usage due to the increased log rotation. @@ -150,3 +153,25 @@ Set-Acl -Path $LogPath -AclObject $NewAcl ``` Restart the device to restart the *Windows Defender Firewall* service. + + + +[INT-1]: /mem/intune/configuration/custom-settings-windows-10 +[CSP-1]: /windows/client-management/mdm/firewall-csp +[AZ-1]: /azure/sentinel/data-connectors/windows-firewall +[INT]: https://go.microsoft.com/fwlink/?linkid=2109431 +[MEM-1]: /mem/intune/configuration/settings-catalog +[WIN-1]: /windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection +[AZ-2]: /azure/azure-monitor/agents/azure-monitor-agent-windows-client +[CSP-2]: /windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogdroppedpackets +[CSP-3]: /windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogdroppedpackets +[CSP-4]: /windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogdroppedpackets +[CSP-5]: /windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogfilepath +[CSP-6]: /windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogfilepath +[CSP-7]: /windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogfilepath +[CSP-8]: /windows/client-management/mdm/firewall-csp#mdmstoredomainprofileenablelogsuccessconnections +[CSP-9]: /windows/client-management/mdm/firewall-csp#mdmstoreprivateprofileenablelogsuccessconnections +[CSP-10]: /windows/client-management/mdm/firewall-csp#mdmstorepublicprofileenablelogsuccessconnections +[CSP-11]: /windows/client-management/mdm/firewall-csp#mdmstoredomainprofilelogmaxfilesize +[CSP-12]: /windows/client-management/mdm/firewall-csp#mdmstoreprivateprofilelogmaxfilesize +[CSP-13]: /windows/client-management/mdm/firewall-csp#mdmstorepublicprofilelogmaxfilesize From 69de2d06be01ca28a51f206b5a031a00d18678ab Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 21 Nov 2023 08:15:26 -0500 Subject: [PATCH 204/237] updates --- ...blishing.redirection.windows-security.json | 17 ++- .../windows-firewall/configure-logging.md | 4 +- .../configure-with-command-line.md | 2 +- .../windows-firewall/configure.md | 108 +++++++++--------- .../filter-origin-documentation.md | 2 +- .../firewall-settings-lost-on-upgrade.md | 31 ----- .../windows-firewall/hyper-v-firewall.md | 2 +- .../windows-firewall/index.md | 2 +- .../windows-firewall/quarantine.md | 4 +- .../windows-firewall/rules.md | 2 +- .../network-security/windows-firewall/toc.yml | 4 +- .../windows-firewall/tools.md | 2 +- 12 files changed, 76 insertions(+), 104 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 09d92ceabd..3ec41a760f 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -7962,32 +7962,32 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-inbound-rules-to-support-rpc.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-program-or-service-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-outbound-port-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-program-or-service-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-port-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-an-inbound-icmp-rule.md", - "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-rules-with-gpo", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { @@ -8034,6 +8034,11 @@ "source_path": "windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md", "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false + }, + { + "source_path": "windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall", + "redirect_document_id": false } ] } \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md index 6710346544..06fbba84f9 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-logging.md @@ -2,7 +2,7 @@ title: Configure Windows Firewall logging description: Learn how to configure Windows Firewall to log dropped packets or successful connections with CSP and group policy. ms.topic: how-to -ms.date: 11/14/2023 +ms.date: 11/21/2023 --- # Configure Windows Firewall logging @@ -75,7 +75,7 @@ Alternatively, you can configure devices using a [custom policy][INT-1] with the Here are some recommendations for configuring Windows Firewall logging: - Change the logging size to at least **20,480 KB (20 MB)** to ensure that the log file doesn't fill up too quickly. The maximum log size is 32,768 KB (32 MB) -- For each profile (Domain, Private, and Public) change the name from `%windir%\system32\logfiles\firewall\pfirewall.log` to: +- For each profile (Domain, Private, and Public) change the default log file name from `%windir%\system32\logfiles\firewall\pfirewall.log` to: - `%windir%\system32\logfiles\firewall\pfirewall_Domain.log` - `%windir%\system32\logfiles\firewall\pfirewall_Private.log` - `%windir%\system32\logfiles\firewall\pfirewall_Public.log` diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index 9b251dd9d5..36140db191 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -2,7 +2,7 @@ title: Manage Windows Firewall with the command line description: Learn how to manage Windows Firewall from the command line. This guide provides examples how to manage Windows Firewall with PowerShell and Netsh. ms.topic: conceptual -ms.date: 11/20/2023 +ms.date: 11/21/2023 --- # Manage Windows Firewall with the command line diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 4ead383383..8d1b33190c 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -2,7 +2,7 @@ title: Configure firewall rules with group policy description: Learn how to configure firewall rules using group policy with the Windows Firewall with Advanced Security console. ms.topic: how-to -ms.date: 11/14/2023 +ms.date: 11/21/2023 --- # Configure rules with group policy @@ -20,45 +20,45 @@ If you are configuring a single device, you must have administrative rights on t This type of rule allows ICMP requests and responses to be received by devices on the network. To create an inbound ICMP rule: 1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** -1. On the **Program** page, select**All programs**, and then select**Next** +1. In the navigation pane, select **Inbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select **Next** +1. On the **Program** page, select **All programs**, and then select **Next** 1. On the **Protocol and Ports** page, select **ICMPv4** or **ICMPv6** from the **Protocol type** list. If you use both IPv4 and IPv6 on your network, you must create a separate ICMP rule for each 1. Select **Customize** 1. In the **Customize ICMP Settings** dialog box, do one of the following: - - To allow all ICMP network traffic, select**All ICMP types**, and then select**OK** - - To select one of the predefined ICMP types, select**Specific ICMP types**, and then select each type in the list that you want to allow. Select **OK** - - To select an ICMP type that does not appear in the list, select**Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, select**Add**, and then select the newly created entry from the list. Select **OK** + - To allow all ICMP network traffic, select **All ICMP types**, and then select **OK** + - To select one of the predefined ICMP types, select **Specific ICMP types**, and then select each type in the list that you want to allow. Select **OK** + - To select an ICMP type that does not appear in the list, select **Specific ICMP types**, select the **Type** number from the list, select the **Code** number from the list, select **Add**, and then select the newly created entry from the list. Select **OK** 1. Select **Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Allow the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** ## Create an inbound port rule This type of rule allows any program that listens on a specified TCP or UDP port to receive network traffic sent to that port. To create an inbound port rule: 1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** +1. In the navigation pane, select **Inbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select **Next** > [!NOTE] > Although you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, select**All programs**, and then select**Next** +1. On the **Program** page, select **All programs**, and then select **Next** > [!NOTE] > This type of rule is often combined with a program or service rule. If you combine the rule types, you get a firewall rule that limits traffic to a specified port and allows the traffic only when the specified program is running. The specified program cannot receive network traffic on other ports, and other programs cannot receive network traffic on the specified port. If you choose to do this, follow the steps in the [Create an Inbound Program or Service Rule](#create-an-inbound-program-or-service-rule) procedure in addition to the steps in this procedure to create a single rule that filters network traffic using both program and port criteria. 1. On the **Protocol and Ports** page, select the protocol type that you want to allow. To restrict the rule to a specified port number, you must select either **TCP** or **UDP**. Because this is an incoming rule, you typically configure only the local port number If you select another protocol, then only packets whose protocol field in the IP header match this rule are permitted through the firewall.\ To select a protocol by its number, select **Custom** from the list, and then type the number in the **Protocol number** box.\ - When you have configured the protocols and ports, select**Next**. -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** + When you have configured the protocols and ports, select **Next**. +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Allow the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** > [!NOTE] > If this GPO is targeted at server computers running Windows Server 2008 that never move, consider modifying the rules to apply to all network location type profiles. This prevents an unexpected change in the applied rules if the network location type changes due to the installation of a new network card or the disconnection of an existing network card's cable. A disconnected network card is automatically assigned to the Public network location type. -1. On the **Name** page, type a name and description for your rule, and then select**Finish** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** ## Create an outbound port rule @@ -88,17 +88,17 @@ This type of rule allows the program to listen and receive inbound network traff To create an inbound firewall rule for a program or service: 1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select**Next** +1. In the navigation pane, select **Inbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select **Next** > [!NOTE] > Information the user should notice even if skimmingAlthough you can create rules by selecting **Program** or **Port**, those choices limit the number of pages presented by the wizard. If you select **Custom**, you see all of the pages, and have the most flexibility in creating your rules. -1. On the **Program** page, select**This program path** +1. On the **Program** page, select **This program path** 1. Type the path to the program in the text box. Use environment variables, where applicable, to ensure that programs installed in different locations on different computers work correctly. 1. Do one of the following: - - If the executable file contains a single program, select**Next** - - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, select**Customize**, select **Apply to services only**, select**OK**, and then select**Next** - - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select**Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, select**Apply to service with this service short name**, and then type the short name for the service in the text box. Select **OK**, and then select**Next** + - If the executable file contains a single program, select **Next** + - If the executable file is a container for multiple services that must all be allowed to receive inbound network traffic, select **Customize**, select **Apply to services only**, select **OK**, and then select **Next** + - If the executable file is a container for a single service or contains multiple services but the rule only applies to one of them, select **Customize**, select **Apply to this service**, and then select the service from the list. If the service does not appear in the list, select **Apply to service with this service short name**, and then type the short name for the service in the text box. Select **OK**, and then select **Next** > [!IMPORTANT] > To use the **Apply to this service** or **Apply to service with this service short name** options, the service must be configured with a security identifier (SID) with a type of **RESTRICTED** or **UNRESTRICTED**. To check the SID type of a service, run the following command: `sc qsidtype ` @@ -109,11 +109,11 @@ To create an inbound firewall rule for a program or service: In the preceding command, the value of `` can be `UNRESTRICTED` or `RESTRICTED`. Although the command also permits the value of `NONE`, that setting means the service cannot be used in a firewall rule as described here. By default, most services in Windows are configured as `UNRESTRICTED`. If you change the SID type to `RESTRICTED`, the service might fail to start. We recommend that you change the SID type only on services that you want to use in firewall rules, and that you change the SID type to `UNRESTRICTED`. -1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](#create-an-inbound-port-rule). After you have configured the protocol and port options, select**Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** +1. It is a best practice to restrict the firewall rule for the program to only the ports it needs to operate. On the **Protocols and Ports** page, you can specify the port numbers for the allowed traffic. If the program tries to listen on a port different from the one specified here, it is blocked. For more information about protocol and port options, see [Create an Inbound Port Rule](#create-an-inbound-port-rule). After you have configured the protocol and port options, select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Allow the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** ## Create an outbound program or service rule @@ -149,30 +149,30 @@ Using the two rules configured as described in this topic helps to protect your ### RPC Endpoint Mapper service 1. Open the *Windows Firewall with Advanced Security* console -1. In the navigation pane, select**Inbound Rules** -1. Select **Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** -1. On the **Program** page, select**This Program Path**, and then type `%systemroot%\system32\svchost.exe` +1. In the navigation pane, select **Inbound Rules** +1. Select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select **Next** +1. On the **Program** page, select **This Program Path**, and then type `%systemroot%\system32\svchost.exe` 1. Select **Customize**. -1. In the **Customize Service Settings** dialog box, select**Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, select**OK**, and then select**Next** -1. On the warning about Windows service-hardening rules, select**Yes** +1. In the **Customize Service Settings** dialog box, select **Apply to this service**, select **Remote Procedure Call (RPC)** with a short name of **RpcSs**, select **OK**, and then select **Next** +1. On the warning about Windows service-hardening rules, select **Yes** 1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** -1. For **Local port**, select **RPC Endpoint Mapper**, and then select**Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** +1. For **Local port**, select **RPC Endpoint Mapper**, and then select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Allow the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** ### RPC-enabled network services -1. On the same GPO you edited in the preceding procedure, select**Action**, and then select**New rule** -1. On the **Rule Type** page of the New Inbound Rule Wizard, select**Custom**, and then select**Next** -1. On the **Program** page, select**This Program Path**, and then type the path to the executable file that hosts the network service. Select **Customize** -1. In the **Customize Service Settings** dialog box, select**Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then select**Apply to service with this service short name**, and then type the short name of the service in the text box -1. Select **OK**, and then select**Next** +1. On the same GPO you edited in the preceding procedure, select **Action**, and then select **New rule** +1. On the **Rule Type** page of the New Inbound Rule Wizard, select **Custom**, and then select **Next** +1. On the **Program** page, select **This Program Path**, and then type the path to the executable file that hosts the network service. Select **Customize** +1. In the **Customize Service Settings** dialog box, select **Apply to this service**, and then select the service that you want to allow. If the service doesn't appear in the list, then select **Apply to service with this service short name**, and then type the short name of the service in the text box +1. Select **OK**, and then select **Next** 1. On the **Protocol and Ports** dialog box, for **Protocol type**, select **TCP** -1. For **Local port**, select **RPC Dynamic Ports**, and then select**Next** -1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select**Next** -1. On the **Action** page, select **Allow the connection**, and then select**Next** -1. On the **Profile** page, select the network location types to which this rule applies, and then select**Next** -1. On the **Name** page, type a name and description for your rule, and then select**Finish** +1. For **Local port**, select **RPC Dynamic Ports**, and then select **Next** +1. On the **Scope** page, you can specify that the rule applies only to network traffic to or from the IP addresses entered on this page. Configure as appropriate for your design, and then select **Next** +1. On the **Action** page, select **Allow the connection**, and then select **Next** +1. On the **Profile** page, select the network location types to which this rule applies, and then select **Next** +1. On the **Name** page, type a name and description for your rule, and then select **Finish** diff --git a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md index b875b47bbf..3c2f044b83 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md @@ -2,7 +2,7 @@ title: Filter origin audit log improvements description: Filter origin documentation audit log improvements ms.topic: troubleshooting -ms.date: 11/07/2023 +ms.date: 11/21/2023 --- # Filter origin audit log improvements diff --git a/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md b/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md deleted file mode 100644 index 89ffce298a..0000000000 --- a/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md +++ /dev/null @@ -1,31 +0,0 @@ ---- -title: Troubleshooting Windows Firewall settings after a Windows upgrade -description: Firewall settings lost on upgrade -ms.topic: troubleshooting -ms.date: 11/07/2023 ---- - -# Troubleshooting Windows Firewall settings after a Windows upgrade - -Use this article to troubleshoot firewall settings that are turned off after upgrading to a new version of Windows. - -## Rule groups - -To help you organize your list, individual built-in firewall rules are categorized within a group. For example, the following rules form part of the Remote Desktop group. - -- Remote Desktop - Shadow (TCP-In) -- Remote Desktop - User Mode (TCP-In) -- Remote Desktop - User-Mode (UDP-In) - -Other group examples include **core networking**, **file and print sharing**, and **network discovery**. Grouping allows administrators to manage sets of similar rules by filtering on categories in the firewall interface (wf.msc). Do this filtering by right-clicking on either **Inbound** or **Outbound Rules** and selecting **Filter by Group**. Optionally, you can use PowerShell using the `Get-NetFirewallRule` cmdlet with the `-Group` switch. - -```Powershell -Get-NetFirewallRule -Group -``` - -> [!NOTE] -> Microsoft recommends to enable or disable an entire group instead of individual rules. - -Microsoft recommends that you enable/disable all of the rules within a group instead of one or two individual rules. This recommendation is because groups aren't only used to organize rules and allow batch rule modification by type, but they also represent a 'unit' by which rule state is maintained across a Windows upgrade. Rule groups, as opposed to individual rules, are the unit by which the update process determines what should be enabled/disabled when the upgrade is complete. - -For example, the Remote Desktop group consists of three rules. To ensure that the rule set is properly migrated during an upgrade, all three rules must be enabled. If only one rule is enabled, the upgrade process will see that two of three rules are disabled and then disable the entire group to maintain a clean, out-of-the-box configuration. This scenario has the unintended consequence of breaking Remote Desktop Protocol (RDP) connectivity to the host. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md index f400ceda50..fcae3df1e9 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall.md @@ -2,7 +2,7 @@ title: Hyper-V firewall description: Learn how to configure Hyper-V firewall rules and settings using PowerShell or Configuration Service Provider (CSP). ms.topic: how-to -ms.date: 11/08/2023 +ms.date: 11/21/2023 appliesto: - ✅     Windows 11 --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index e3a9cfe4c8..a70e90f998 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -2,7 +2,7 @@ title: Windows Firewall overview description: Learn overview information about the Windows Firewall security feature. ms.topic: conceptual -ms.date: 11/20/2023 +ms.date: 11/21/2023 --- # Windows Firewall overview diff --git a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md index 37d303f00e..52bce4c9ac 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/quarantine.md @@ -1,8 +1,8 @@ --- title: Quarantine behavior description: Learn about Windows Firewall and the quarantine feature behavior. -ms.topic: conceptual -ms.date: 11/14/2023 +ms.topic: concept-article +ms.date: 11/21/2023 --- # Quarantine behavior diff --git a/windows/security/operating-system-security/network-security/windows-firewall/rules.md b/windows/security/operating-system-security/network-security/windows-firewall/rules.md index aa98029298..ec90e0fc47 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/rules.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/rules.md @@ -1,7 +1,7 @@ --- title: Windows Firewall rules description: Learn about Windows Firewall rules and design recommendations. -ms.date: 11/15/2023 +ms.date: 11/21/2023 ms.topic: concept-article --- diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index 1de1d50dd3..ce62534d6d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -24,6 +24,4 @@ items: - name: Filter origin audit log improvements href: filter-origin-documentation.md - name: Quarantine behavior - href: quarantine.md - - name: Firewall settings lost on upgrade - href: firewall-settings-lost-on-upgrade.md \ No newline at end of file + href: quarantine.md \ No newline at end of file diff --git a/windows/security/operating-system-security/network-security/windows-firewall/tools.md b/windows/security/operating-system-security/network-security/windows-firewall/tools.md index 69becc531a..81d8ce2a84 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/tools.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/tools.md @@ -136,7 +136,7 @@ From the following dropdown, select one of tools to learn how to configure Windo > [!div class="op_single_selector"] > > - [Configure with Microsoft Intune 🔗][INT-1] -> - [Configure with GPO](configure.md) +> - [Configure with group policy](configure.md) > - [Configure with command line tools](configure-with-command-line.md) From e247ef6bcf31e9c8b9cdfb042f761c491e68b609 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 21 Nov 2023 09:18:02 -0500 Subject: [PATCH 205/237] updates --- .../filter-origin-documentation.md | 49 +++++++----------- .../quarantine-default-block-filter.png | Bin 51762 -> 0 bytes .../images/quarantine-interfaceindex1.png | Bin 79691 -> 0 bytes .../query-user-default-block-filters.png | Bin 186215 -> 0 bytes .../windows-firewall/quarantine.md | 2 - .../network-security/windows-firewall/toc.yml | 6 +-- 6 files changed, 21 insertions(+), 36 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/quarantine-default-block-filter.png delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/quarantine-interfaceindex1.png delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/query-user-default-block-filters.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md index 3c2f044b83..6c5bd21b4d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md @@ -1,21 +1,19 @@ --- -title: Filter origin audit log improvements -description: Filter origin documentation audit log improvements +title: Filter origin audit log +description: Learn about Windows Firewall and filter origin audit log to troubleshoot packet drops. ms.topic: troubleshooting ms.date: 11/21/2023 --- -# Filter origin audit log improvements +# Filter origin audit log -Debugging packet drops is a continuous issue to Windows customers. In the past, customers had limited information about packet drops. - -Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152. +When investigating packet drop events, you can use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits `5157` or `5152`. ![Event properties.](images/event-properties-5157.png) -The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. However, the filter ID isn't a reliable source for tracing back to the filter or the rule, as the filter ID can change for many reasons despite the rule not changing at all. This change in ID makes the diagnosis process error-prone and difficult. +The *filter ID* uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. However, the filter ID isn't a reliable source for tracing back to the filter or the rule, as the filter ID can change for many reasons despite the rule not changing at all. The change in ID makes the diagnosis process error-prone and difficult. -For customers to debug packet drop events correctly and efficiently, they would need more context about the blocking filter such as its origin. The blocking filters can be categorized under these filter origins: +To debug packet drop events correctly and efficiently, you need more context about the blocking filter, such as its origin. The blocking filters can be categorized under these filter origins: 1. Firewall rules 1. Firewall default block filters @@ -27,17 +25,14 @@ For customers to debug packet drop events correctly and efficiently, they would 1. Universal Windows Platform (UWP) default 1. Windows Service Hardening (WSH) default -The next section describes the improvements made to audits 5157 and 5152, and how the above filter origins are used in these events. These improvements were added in the Windows Server 2022 and Windows 11 releases. +The next section describes the improvements made to audits `5157` and `5152` in Windows 11 and Windows Server 2022, and how the filter origins are used in these events. ## Improved firewall audit -The two new fields added to the audit 5157 and 5152 events are `Filter Origin` and `Interface Index`. +Starting in Windows 11 and Windows Server 2022, two new fields added to the audit `5157` and `5152` events are *Filter Origin* and *Interface Index*: -The `Filter Origin` field helps identify the cause of the drop. Packet drops from firewall are explicitly dropped by default block filters created by the Windows Firewall service or a firewall rule that may be created by users, policies, services, apps, etc. - -`Filter Origin` specifies either the rule ID (a unique identifier of a Firewall rule) or the name of one of the default block filters. - -The `Interface Index` field specifies the network interface in which the packet was dropped. This field helps to identify which interface was quarantined, if the `Filter Origin` is a `Quarantine Default`. +- The *Filter Origin* field helps identify the cause of the drop. Packet drops from firewall are explicitly dropped by default block filters created by the Windows Firewall service or a firewall rule that may be created by users, policies, services, apps, etc. Filter Origin` specifies either the *rule ID* (a unique identifier of a Firewall rule) or the name of one of the default block filters +- The *Interface Index* field specifies the network interface in which the packet was dropped. This field helps to identify which interface was quarantined, if the *Filter Origin* is a *Quarantine Default* To enable a specific audit event, run the corresponding command in an administrator command prompt: @@ -48,11 +43,11 @@ To enable a specific audit event, run the corresponding command in an administra ## Example flow of debugging packet drops with filter origin -As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop, and the interface it happened on. +As the audit surfaces *Filter Origin* and *Interface Index*, the network admin can determine the root cause of the network packet drop, and the interface it happened on. ![Event audit.](images/event-audit-5157.png) -The next sections are divided by `Filter Origin` type, the value is either a rule name or the name of one of the default block filters. If the filter origin is one of the default block filters, skip to the section, **Firewall default block filters**. Otherwise, continue to the section **Firewall rules**. +The next sections are divided by *Filter Origin* type, the value is either a rule name or the name of one of the default block filters. If the filter origin is one of the default block filters, skip to the section, [Firewall default block filters](#firewall-default-block-filters). ## Firewall rules @@ -65,20 +60,19 @@ Get-NetFirewallRule -Name " {A549B7CF-0542-4B67-93F9-EEBCDD584377} " ![Firewall rule.](images/firewallrule.png) -After identifying the rule that caused the drop, the network admin can now modify/disable the rule to allow the traffic they want through command prompt or using the Windows Defender UI. The network admin can find the rule in the UI with the rule's `DisplayName`. +After identifying the rule that caused the drop, the network admin can modify or disable the rule to allow the traffic they want through one of the available [tools](tools.md). The network admin can find the rule in the UI with the rule's *DisplayName*. >[!NOTE] -> Firewall rules from Mobile Device Management (MDM) store cannot be searched using the Windows Defender UI. Additionally, the above method will not work when the `Filter Origin` is one of the default block filters, as they do not correspond to any firewall rules. +> Firewall rules from Mobile Device Management (MDM) store cannot be searched using the Windows Firewall UI. Additionally, the above method doesn't work when the *Filter Origin* is one of the default block filters, as they don't correspond to any firewall rules. ## Firewall default block filters ### AppContainer loopback -Network drop events from the AppContainer loopback block filter origin occur when localhost loopback isn't enabled properly for the Universal Windows Platform (UWP) app. +Network drop events from the AppContainer loopback block filter origin occur when localhost loopback isn't enabled properly for the Universal Windows Platform (UWP) app: -To enable localhost loopback in a local debugging environment, see [Communicating with localhost](/windows/iot-core/develop-your-app/loopback). - -To enable localhost loopback for a published app that requires loopback access to communicate with another UWP or packaged Win32 app, see [uap4:LoopbackAccessRules](/uwp/schemas/appxpackage/uapmanifestschema/element-uap4-loopbackaccessrules). +- To enable localhost loopback in a local debugging environment, see [Communicating with localhost](/windows/iot-core/develop-your-app/loopback) +- To enable localhost loopback for a published app that requires loopback access to communicate with another UWP or packaged Win32 app, see [uap4:LoopbackAccessRules](/uwp/schemas/appxpackage/uapmanifestschema/element-uap4-loopbackaccessrules) ### Boot time default @@ -92,11 +86,8 @@ Run the following PowerShell command to generate more information about the inte ```Powershell Get-NetIPInterface -InterfaceIndex -Get-NetIPInterface -InterfaceIndex 5 ``` -![Quarantine default block filter.](images/quarantine-default-block-filter.png) - To learn more about the quarantine feature, see [Quarantine behavior](quarantine.md). >[!NOTE] @@ -115,11 +106,7 @@ To generate a list of all the query user block rules, you can run the following Get-NetFirewallRule | Where {$_.Name -like "*Query User*"} ``` -![Query user default block filter.](images/query-user-default-block-filters.png) - -The query user pop-up feature is enabled by default. - -To disable the query user pop-up, you can run the following command in administrative command prompt: +The query user pop-up feature is enabled by default. To disable the query user pop-up, you can run the following command in administrative command prompt: ```cmd Netsh set allprofiles inboundusernotification disable diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/quarantine-default-block-filter.png b/windows/security/operating-system-security/network-security/windows-firewall/images/quarantine-default-block-filter.png deleted file mode 100644 index e57ad13f9323f84338a16ecaa025886002694e63..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 51762 zcmcG#Wm_CU*R~r00zraHa2VVf+!6+x!5sz*4DRk0+}%Cs;4-)-5Zv7*!JXg|WaobF z{l3rs1N%c)SAAF|M_2c{dY!8xloe$#-+z4n>eVYu2v}0})vGsd|LU%&DF4czUn>3n z-CjGZ%79)~kCPqzYap46D~P{(RTqc;XoUQ)jphJ`I=^~FNcW%XHAEHg=hdrjPKczq zx`)AWC-T?q1>e&r($E~JnOUl41pyG4L9(^@yH|m$vw7@kd40FZ(vAz_y~3kF4S5^O zWthAK(}A$C0k=5)UM|P08xl>yTLQ7dah=OKz&+7F1AEzNE?*uui3;D$Dv>$%;>i5B z_?|m?biLp8Cxk;X&vTa~Gb^hxP%sewEmj;Pp`DF0gwKuCv)3v5Kx6>13v8jKre$04+5$Y`YaPzOc z>>w7;kuuP=oL;C+N;@^Y@G+LYn>{2DirfZ3tr`;xICp45bc7&yx zXB~AKwa<$wtJtbKp*_SAxM*RfNv*(cT&HbyQ+}Q9WEH!N=$DUBPbTfIt zMLf2DUAL^`Ds^m@pLC|-DEVHZyVeaX`TX{}`Qges7E1DxMm1oyAZ#$#-#F|?F-rat ztI#pRzT14MXlrov*E(kJWMtdC>9~sXrRC-QZfsuTu7KEnx;^Rl(u=Kd+E@XK+X zvKh4B+(wO1t`&@Z44e}l78OymD73=4;Bk}qtkaPX)LPfjNA4VzDY^aPJH3^ORc!fBH)C$2ebhScA+moX`ioVC!<=*kT9@A zGb>bk@Y!pyaw>|?$qkOa`W{^xFRKRPzHdDk{If0*UWq}YOBa?$T0ogl)d%ag;T~p4 zsa0>KNLq?sVtv3NtR{FO8s&V-aH5pO7dolX}& z9IwgWHpcN*yR1t$MyP(Gzpsp$Vr-mSEgH4K@l21=@l7(Sp5T`tx9=#=%X>FGokMcK zs;&LmR*Dd^NqI)(;uUn)zdE5ip%OHDNfa<;LQBV%bJc)vL-W_&T-^RON#u0#$NG=n zHq^IR@#ngDWZKEp&miniN!leoeO8TDd>2s=`dER@@T~>(&_?S8zdC!1$g5Sd@{wUi z)`@P4KU_QSf5}h4%eyiI3uq9wDkThXv|u`y_xCDwI-(R(#a-d+l5R^hR?MkUMgl~L`*My z0x90p*ooApK3|%rUwJgXu9#_6p^ntqOfdO|Y|E6yK4{PpaFn*~^eitdR)&L#oA!t-jNmI#AQ<(iU zUc@4)+7=%Z!kbJ;uxS{X0HO4vwqh0xm5^1bbNo(#>x|H@D@s1RkaxoExx(@YHmndc zhL1IRmeEI}l$T$Gd#$x}7};iPHCOhg#cPem&Mie_%I7;5O(|#fjt=rT4Hon5?J`!z zhW6vW!82}ooc@|zj89bO24%XQYsD}6NJ8e8q^>>K&s&^~UouqiBi4FWYBKZl7J@mI z2VYesUXo|u*k`zgjVgJRCbPgeh+7~@dp(_Di})vb_%-EU*&+R1X8#JcCoazlqfzpj zL#ZjK)*Ozwr$Fy|7wCqZG)kHkU z^n%SK*j%|1^2x2M7qpIcwDa-L4cYTGhR^W@F17 zv7WY-UlzWqB}UYL%hW(WB<@-iAA1;6Co(hSS%DBD<~KeCGXP$5GpneI7g!Su()&{j zyW7GURWuJ2g%x#!pQ}~Wt-urVKWQS^u%oeY6V2VsRCDc%J6*B!HiGIMaGK9_210ht zR@sRJqul@edce;W69T)5^Uarr&8KP}@JCN&f~~CHGaZxxge#GJ4bT>G;I_l-{+4%u zMhP9^Q^vR0@tKHD#hK;OlwocKeO05II;4vTz2cjm!9^Vs01-pv6%+g=XzubXLNpOa~Cj zKx#x3GZQ|Irgm5GLjl#;p4VW7&M=5toJ2}aTi1STcB)=d^?k@6b=;iP?PJUi!F#4b zljvAUH&jpkFByyvyop~d;MWe6V)Ypvf$|sJc;R=C9<(TtUG_ zZ0i%ltzEGJ2;g#}VQSsjE6Enxb-%F@qE_0p&W~UGhAmr<{Y#RhqAz^W6}-aRJX}Wz zWfZ_Y-tUVGGEyn+mX2T@re9HV*t8Lz=^_?vU?_=a^eahg0!_yuNIUz)of7e~SSdh8 zmTC{c$QL?DM&CC)-4AGW_2Co<#_!6q@{2QM9 zyiocAdWPL!NL4w$b;y?4i+%re5v7wwuj0ufrXmtJ+U>IN%rA{7Hn#4x>1e7sn+9(6 z8fZIlnUp6waz5|pL!Hlt8*g0UoP$k_wv9VV#CKA#>=f{FcXR7m+#2;eK4ZU^SXvjQ z-F`)`+&y_b-$;->@XO$2;Dc2p5t}a8xsr1Kc~(EODXjo}{h>bcyK|s0y(#4ujF^F&6C(8__vI zCRXjvz=O*$0k>TdHa52Cj|gpOR`(DsL%Pe@q|ZL)_|?jyry(+V&8GoFssJhLdDXOp z!EFahH9sSTWwBvXNxFP9c8g!TI}wk2pG3#hIP{BL0RYIHoVYPTdo!Dfr5d#qA$9zd z*!+ohcN2jWK=2s9h}goC9Jb72B7ICH(oS0Z0IsPvgk+=)X;SNSBYiBF?>Gmsc(PG}+jxx{Da5h&O%qkbaVPW}mqxrCDu%dAX(%EyNj4Wh=0F zboJXC3FAyrN3a5aMAbAq?oSFP60sIs4-MQ+9Tft0lP`V*WkFSPB*zN45o52VCA-?) zSYe*NO>S*`Q)b@^)eZ>>9DlmXm2phq!?L9(`us*=M|mxEs$d&r7NWEy(_2mgLS23R zff8gsp-j>A8Tpoypk$6}v!hJe)XM5_LXd&hRGedtlvUqv2~yYh$wm9Ei+n{Ve5dP; z>3!%I+D%kR>zBUK9wtmKn4$S5B!3e=9D1LpWDKFnqe0|vbGJ-ZYVos}s;$1MgH5fP zSf#UtLI?Cs2sPxOgnUu)^jQgIWso{YS}B6L?GYFi%UFcg_UZdWriw4}j&95uOUOlw zZ{)oS5O;}vQg-xS)b)pvVP6-**r_uR)7(y%2(X52Ik_v8j6icvEg?-haBlEwmd7Y4 zC9(V?6tyTR;ShiGwCBVPC^Q)))<|qWfi~_MhfX3_+~mlGY{{n@QcE96DgVzu#OE@I z=}-^QCuN$L!#)!dNx$1k(NIkVL=~E>ssR_dBg@zzW=<}dqr)NFf(6lWkQc7=F;F;M zG^I}i+Ho`M?y-50Cg9g30nQO37ty8rAI~d+@lWIb%+YaWNc<&jK~gdy$5^!HWyeV_w?`>2HeU5@ z1}nG*<~R=_TUqypXDYvee@v99u}2Af60TMIjT>DChIOCeRwC+mLC8wK!8vrkV6ZnB zVJ0mzAn^PUrFTrRd3-eSXHiXQX8Ek7(vr3!G8!~(P&k(|R8qw<#KuU&D-t@9A(zh< zsFf#W7yDL5hdoNG(tItEMp}o1b0?OYi#wbJR?^h;WA!=OM{|Jde^(D$^e**RLrVz7kMPochbqvdHyS4OKM~ zI-tCOj1nfZZ}t82Wr(7gh&b7S6uzl23B@tP;b?vbr$jp;pCAjR^`ey4M$4l5N65G& z0wHy)_|6i#WMWzZOU;c&JCHPgI3UfSru`HrS&!rGhV0sEwyc|JX?fPowk^g~6S@56 zoy3!9FzXNqK<77@jtQegF;cTSKKv-0vkvmIBSe|tBwB8-qel~LK=Z6D>*1X5FWbGu zQ1mJ?2i~W+Zl~+JxVz#tn5iYxZo8SF=J7^7Jb1ka9?QqZ;rY}9==zb)56M_{S~EKT zy4Bk`ru0@Vas1DJ^)o3I;RWEAZjv(;VMAiAg+FsYyp?@Qu`@ZM^rx5f1mRUJLY9s*m_;pA7GML9NN9OcVo5R%9`C zunT#cGqP0xr1ZntBiIeowi9=$cv-@FTu5p0@PZ%3*gU*NsT)1TdGOoQ{c2AD@QLOb z{*!K_#)S07uSFL8L|H58PM*BDB_qt#8{FW_2&^`pW#R?lAq>UIlQ>m9<%!J3ia`aw z-( zT7uic%(Uto|$h50Ny%Z$RUKgUk>x9co0!6W);pc0p=Z z9%~VQiU{@MTQPEEH)6^hm{tG4k?BZ_lnhK!{0zxA ziDs_{P={9+)(c{mt15!S6Rl=`r+F4hK4D-eqP<2#JtsCdoGm;UHo;c<l_o6plFTEG}Y~Amt|WpC+5|V_R72Tj|W@5=XfsHADn()K@=k?TO~Wa zrou$&)KK%(!kZApZ!Ik|f(P0UNOSsk&T%7&9o~zp@izkKiox>AX>+oA%KoU5!pruU zo9*HY#A~8!(NSli06T3P5bFswijZjljj`5NYRapjA*?!MAPEUbT0$&_EObqx!CgU3 znN4y`RQ~(EhKO&|xnTIJ2p*Z=7HXlLDAWDis>5xLddYI5+U)-XC|}62<$$;@Kc7jw z9#8~)uXwv&j;*871?vxj8ghMNWc+VF0@3JZx9MQXzbZDH$Y?&PVBm7<8yf@Cv=Z}j z!3DG#9gm>Oenx6)NTVE)YHkYE0J6qvA3oOP)D(yjn06um?(UIlKs#jd3Nr&*%bE36 zj*f;j7KueO3bVbTQ1itqOo<~xo}qBwz=h>)gksgjwk#|ZfIidZed1aYYb zo)}7&BuV5_9iDaw^mH>cuQ8|@8_AD&Xo^}aCI%f3=wX$dZ{p$5I_9IZM!=Bk96 z7FAqIzb1lz@d!;DZ!Az^H-s3IqoHKTT|x_5(V?w8dAapO=b_ipO=LS6X>pUl9k^Ye zbfjr+F13U2WNJh6gw>m@ug*Y9P07x`e3>O+Ld(ks7Ds~(3UHZq2z z4#_FuWz}Uh;M?K{nkp%~1K)QyW;Qyq`2J;(5p-{gVxagm91-hyvdr7Q7OAjnT@Qu1 zs}2+MLd&>Hw`T3{IdI?O@#zjiny?B{;d*L*s<*#DB27`XSKGu9WJE&E;hN^!r%=vJD2%x zhxE(3g1p$UtyqFp4}Cg5YUW5o3a>_m!59KKcCrce%}+b2H-U+IqCAz_g8?z7Ao-A5 zWS?wd#{}~{;gR3!lmD1f>7aag+K-z zM9clqwyp@Tqz77Hg$Rzys|zk?M9oWvY}cWAAo@)(U~shd9TEvA*H4k;SIAU`cAk#LFGoPa$Cl z7F0yLIPNoQ-ay5gMkS!w<a_~+Hl)g-Nnoc>H%cyb$| zLJSuZZCv6ie#{`!8`y@`fO_nC1V+%NR%C-bdW8HKb5RGQ61XlPqs}h0zk^#5N|tf8 z9D{ZE``7Ebs#+(ij6&(fhUdafU9mEtoL|x8UXox~0da_+mn5GNwT`hb(Z2|WvWli6 z#INa2J~<*l5v4!mPnk>m`>8>98$Y~PHY#$?_G_l+gCf0`R2a?s5~(EAu)bVlgH8EAT58uN^s zOg7rYlR0m@^}}_+d8?$)rRxd_E@RGvp!^S!I^TF5>UuQqS68JGu5={T&tTpljG_UX z$*L?eH?eTfI|#HJr|`-EespY&Ttw@rMhhL#ORqviVtMUb2`Zd5w1GvKSsqAG9v(6r z{x+Hv__=_b=zFjZBU$xCX2$QX@O?#3uCU%y6Cc7G8{gJ&LE76LzWKlUKG64L5|zC< z>mUM0S{h!Y&#^^IJAD?PYH?D6%?6*dtY;7H58FTa*prwj=}?d-VNXUB$W04?#FDi9 zXmu8ij>epx;*T6kkd?Ng2?c*`s)t*iP)vsx%G%*THbaB)aSPZ(8G?#TBSZjGEdzfA zJP{d8)Cnq;v#ejjo;Q^|n>;_4n9~aaqmq#-3SNWOu^j8n_2kU9eu6Hd`B>XH3x5V( zv9uy#aw|pAJ5OwLKG6i7PpO2O+DQcYVqiqcOZRiq1JKd9@Ul;LQi#47S)kbThY!Lq zl$7WYyfnUO_EeKh^(F7Kgp4BX+fWk1Slj?xSs6HMw{h0n z;y5@`plCkQdxUoS@nM0z`U6?UtYT|yoc!dRaE$I^l6OzvHzCZUi|Lh5v|g!xy?$OO z{RdW*eb$bs=bVED^u1q`73950$jQ>`%8oi<%85~-fzcmgW|sIRKDXU^u0|`$1UqD8 zeB9q^)LOATB8N-({50pZE@EbM74qs2ZV3MrK}olyfGUdfiP(6Q0Qb8`y&_Lu(tV%X zN8>zO(9KT+B6jEx$u|b{QuLA9|1A|8;n(-xS)?TFFLCO9xxlyn%I$9gr)26G z>oyEPhIjBm5rL`hiQEUYPP}0^Glu^G%IDOfZJwap5Dp*ehf$!C^WiKBWcE;~X~~{0 zAk_3))cswh5M7BPP8Y!}Q{SRsh*^W~eT&9>abbENGtnEFCxQSQ4 zuR2B1aGxrxE6t(QsLtKU7abNKQ=!uobXy142_%8BY4`-I5{g<-P++H2k(#*jL5w*IcX4^?`Nynmr%xy0x%%-MO|aIuzC7pmlN=RR@&H(VGSM(O7fyC^E*?Ci|?wd+g#j~d0N zQj=Tp*mmab(kq^{-d(EupyUD}O&-E6JL}!+q?3gXKj!}!|D*o@$n?`!8n;ga&)wb_ z(2R;14@wuBA~)n}de`@nZVDO& z>~V9+T7VPi_em@-?#J9lr<^1$^@;X1_tO^!$sX!QZhL>uqRy)qQ5hcj&qMQ+RAd<& z-IeS;2}=`>k6yI00DJ&`*K~LR>`TDpJFNkn^OavBD_VZXw^5&v0#$F;1%eZ!c8vpW z*9Ve)=2%|Vm3j?;jCH4?xg#9!72GqkH-y(Z7nINWsJ6WAc?jvqaG$>5Xl;2kPdeox zQkEtt`6L@xz1jSgTlpE?E{}4&F|8M>pJ3kJ!ar&4QtdW=ZjzCc=lqns@^Zl~avA?O zpbvT0LUsNRJ_+5I^i8kKo|0`FV>fz;w1`46|;+<2dB zwhNVDC(pj>!oDsy(M;k4Sdm+AV@4hb$PKuKA)G>ZeIxv;dw-_+xoIEpPvq9Nmm6&u zd1vT^Vr7@SV+8-c)ZBem$Ay`l(`a%q8N(bAF^R7t zC`}H>ifIIXk%E0~?Q^4CpH_ggavlVHCFq_OYZw4WNC-C$PQl^U9r=GZ|rnO}vO zgy1J`cy)?rrNf@Y{a;DUNsBcxMWubn?O`E*7xcP}Wf-`hV8;_mCWRsXtRajvc&@c4 zNRVAwhP>+X0&jJkAe?8frr}&tf+L-TSH{mV3*zJM4Aup|1%d0A8jaDna?H~&AVtO>pC zI>VkSxCOi$kn`T#z({4y18M`7^_%N^Cx0fO2L;bssc1%8veazt4pVV-P04;{mAWJ< zmJ^((deGpjv9TN1O71M9a)j)u)V&?6Hm;C24YLZ84dIpZqHg~5$MVL;pf3{H)I&yi zpF9n_>R4l`7C{uW7huCm~=Cfu9$+Z6!@5aUdevdywp!q0k` z`pq7f(+MInNo(e-ci*PvzcBz!S@|8!@WaTCii{;E4r7iW(a~H&>~*wN*;P>p&+AD? zkpPpXRWF8$OEUpKzu=O$w{_J&K3nS&T??NYS;9ErLiCM*>Rs}AAI;tT?SjWI+W~hC zY_7=e{wB1A3?HUNw@fZE-5o}rZ7X%_Q?01I*%E6z>YvNDKjOSBfQuXETFlU;ZY+iV z4kTEVjIkBCPz$MDs$Hm@!VhFpn3l%oe;yki>|&aDOPl7-WR6ycCWiH8jJw|Yre@vR z8Ldqt6N?7v9Va~}i|qAr=Zs33J0e^M*!6tPNp6F=7&{@tb=oCYG)>gpTJ6{ik){b2 zT>L&)C~s_QCRdmLfu3YH!cA4OR4*OwM8}Z6&^KCr2t)8(mhe{M;Gu7GeJ9^=-Hh+7 zjg~)rdTxoWEy=G~UxA?@taj1lrodKjVSjsZ$u1(GT!Bt5!f04CnViKt1yTE$pwXGw zNg65ew8=$ZjL0lZl=*yUDO^*()$xYgT*iR*R?Ojp?m~_6B|?^7#)~-nt40=o0jYhl zgi{t+E$XM!*QO+Rj5D8^Y|rE)BxT_E_9?P35<{{!wPrWp`^@mNT$-%S@}G8=@^^0H zO{;);s-6JK>a5%6EHoHW2n-ZFSM);? z3u`lzVFp{~rDg4Q{|~8Cn#+AJ8r2%-qJ&{mr-vR@>y`epD|O^vq7fv#t5=h6kM-IE zA2xYVyo88TM7}?S#;J^Xj^DIO5taKF=LvpE7~~SBRN!DP0e_)UsH(|UcKFm-r^%~lNv363|&dx`y=>+u+z=v^cZL0%#gx&ta2kWp2-t7@u19Lui0 zq$)W$r8`)W94*)y&a@FM#w4nbwn1Tp1uo~(sdI#Z_Mw((@0@jTOfv{o|0(BM#*DHd zv{kzg`B!~pi@$yi`9DSQw4>&!$!yI{NoQkHi`xdRN46~jWbS~~gO)zR6LOAgE zO=Bs9)yiyI zD&OZfZYCkGa=MwBlTA1nM$JM*==7(I^3U*;*@H~q^IPg;CMc_ZW9Ws*JK)>GJ6vZA z{O?0dWi$*dIR$|jk9dXqmxoZjgdxKL&*g_um8`j`uUU}hyvRcxFI`1W5j^VlhRlLq z&aD}P;{)X6aPqb_JGNI7;+y=jkJ2|A9Ragbev0nV%FQlJ3FmIqHaYS-PTFcY{VX-) z{kFrffpN^_9UXzEe$I*yHguSAy`g~lv$kAhD2TW+1F$dR;SzzrC*UwKirrAGqLLlr zZ}ssLnoY-v8Mlsqe_>erzdS$-+zTF;3;5&qA5_wtv%Wdk(66FNfFQ~=rEo)O5?(0? zU`M^y_OBbW6K)+{+1VOKbi1P&zAUS*w1N>0UQpp3ozZe4LK|>dT2n8jF!v*|xk*46M13Ay}AY+8-)oio660TulSXtPc{9zotx=3q=%%%&HUM<&x3F zYyT*31ZmILbXyYYn9iYdskL3HwK(L&-{4;P@v8wTFos%_&4s~icHi;=F$YW$rnp;g zVn5#4j%>EtKYulYqE;Z;Dvp{B4ZErn!SR%@0jbEY^cU8tb>(HT81RIlAqeC~xy?d! zghyNyYU&J4X1XE?kM`4^cR7rIEfa>ju+k8MdWWG!@+Et)88tVeXnZ(2`{EVrHa%0VK6S~$1L1-{DOF> z-p`BTC?+CurKl$@T=7RH5($~jHj@$si%Pt(O`SsA;)La#P; z$`L15&Dp!^@Lt@hpz-+6rdz5JN{!paB*X_KczHvGj2wCIBZPVTGFrm^_D-ZBT%kf7 z&&LcMj@w9VIdAvL1S{7NNv<(F#I_Lp;>-h53JLQDm3j;07)*l2Aa-f^V={;SL@wLW zprUJHLZajk(e9${!PyR{)FHCVB)T;8z3>jEA*R3`ld&$*E6PXzj_Ir)v1=^pB7Vt= zX}Qa$))wU)eVe!7@oU_K)rt%MvR*`Y(+ozG{zqI@C>7tq)d$Dw9h$A_8k(oqeR8Rl zMP=1w?c*cr0EkJt%;&4^g%u`7_TG<W)cMs$*p4br*@xCgBw{TPE@+eNMRR;MdG~yTbhP zcti>2YL|1!ZaT@%$P&V@73puxYKua8lS+jzU4tR9p^HcS0SVDhTG~+$pL84K)r*XY zdS_EMOqTh&x-zoPC21#B8n=p+qHTO!yh>cU;MuCxk?X9FL(JudX~as2W8sBPn0e2u zdyCDMBqQ^7DRcFs?q_R0r_bcvH(qwn`!b8mjN)ueVWuo;YT2gn4kN*p1-5^u8a{WN zzPcS0aZ<%~1T30FqI{e`F=~$?FuSv=E=2{SQLD zF5LgC;1so$78^be@^ci+|IMd(9sW!z%LN8iCVy)*+JUL6sR6o)dDct_HS1hwbP&K9 z2qKHlLb?t$V9|d-rp5L4<9p_Lr`yiIOiugICO`B>Q_oG7tQO;2X4^Tv4nw+;lyNo5 zJv2gF83v~BshHNO2?_K~r?uAYT`)+nuN}&}hy4?xPuHQJ!_C$%Trc0ge^J-|z*Ku;0*H{fmL3IR*Xulhg-mcev ztRViPu_a3=_lmoVX@A(lB!G8yS%I-Qd^#GSQ9!3C6**V_$xTR>s$y2zA-L-RL(|6K zYkmz;-VmS*@N5b+b_OKSTr^~i6%p_woRa|dg?Gw2bnR}o01ZONR6WS*y+N+;efC}4 zp^Vr2cNxS7Y3aPf$x0{kq1r7lpf#yngX64SM~JNgaypwE?y=kPxMUS2d@Oh=w>MNF zi)n14$m*K?baB3@s`MzW+E_&)W7l7?9Rf-o6~CJDKWDX*!Er^72$nQk0P*0O=n?(^ zR+C6ehh{k4_ukG3{+Tpi>NE=g6u2JisnB`VCZ;C`u9?xQz@UhIt&_nW9-9R1RuJJ^ zg5x#nV8QP2D&>UW3CFc24b~Kac1tLxg7E1tXG-DEwh(fDkw345i%0F!`mW0x)pzL! zdkQ1SNwv@{c@i6aKHPr!E>8F^LVzx{Y%RQ;puNRzizb^p^xwx_nMRNbm!#O1HDyls zkShjjD>fK{6X-b8Rb>L!D>vv08DlXCu&cK|(LM(8si{GnWV2{CN^JQr|1j7U3)KYA zdE1#uxu!0rLzYWTE6Ct#=24Q;gw#vkHzx(+;Go31vC8jeK57r>9wj6shr2OE21RMA zsdJFTWT}zqK6IvX>+RGh-G6}IZVX3wsWnA*%G3(>24%`b#|ZCM^a>}HKe^6q!WHqE zg^D?<)Y|&AQvzT`RpG>S-vtzT>Tzrn5)xSRNg&}~@|I^?$?B@Oloi z!qvtKzNfl+{uBh?-*bu0j%29WddMrPng*!W!6@73=g{(N%+A)U@T1lV)G;QjyR+3A z;t!D`fGLR^=)jzUyl`v-77dy$T|PD%;8MgItcMDH%GZ5uED^*aZBBnQUqiQ6CUG|S zt+IhEs3OTA0{9$`6}HdVZPkAYrl%7`OIrUdec*JS;%ZVN#Au7#%3hP^SHI-A66A9l z&@!wniaX z*gFW+UQm}-NdIM=)0-(SJ z-S;&NJWm9Sa~JvS$<7!Gh%4Qo2P>@}zY7*Gq!O)(5_TL^H4Xaz91z_d7%N>Y_o<*| z(!ZBGionX-%wVA0IlxOevYdR;-?J4EEy6X$nF11$60rYBOD-=OXH|fxKf66YcwZ!#r3-auCCi@s;{^9Ot0P2Jve7Vh}iLav4PvS~H z-DvKVp8l_iE5*f(*QS(W6V{~TCUUON1(RYEX5?z{KIGe6MU!L`Ul#USX~JWoZ1(!= zHjz4O%{eAnH7BvZr%xhZ9v|1V|6(~;yCbU*Z(G0fJQ;nJA1+k&&hLzv z_BFIBjnF6o$)$07*Vr$5{=kHNip0SClq*+gl_{bIV+2gfA#%$@v@Gm-p8@x{Q3kGm z{>b8X+RNjRto0$MPg%RWU=+YcNH2KZakKxyqpVd4oTAZ=zY~*0M3O^R0);`XH%i^C zG?oG)O&Qp4lF~Dn(8MBKD^h`u7b?$N2@D?h`%sbJHk!6j@n4%29ggZS5=+)n7CIFV z|BWH>%$sU@DsBu((>j(Su?>OIp+Z;?T)Nas2i$NgQj=q2`t4dkN#yz8Q*zYY}2q~ zc=zeo{ZC_cNPz-Z*De309vVq~cX&My`sE)^yqUVbL?KLb4(RB`1?t4h-`l%$H4Z%4 z@nTK}oC-SGl_`e%-&+&hxUPvQmBXwUUwl$!{O<4+u^xto7-0dd>)emFWWtX^G8$qA z%2E(V%!*5p$U|?T$nzZ@nc&8Na@hXfogj+v_#fj4nNQw3NECT_UCuI|za_I+nMX6f z9O9{#mW{ywrtEoKOi`ZCn1_}wwFIkI#GdDFiQF&ZiFo;>mxq4rpcxo2I5Hf&&inoH zc={IfP0az*%}MeYe)0&(y+6kjdET_7Hsj=79Vjyn^E{Xo>^W#nE?Ke=d}cQ9eOdRo zhf+KZp}SzVgGY2Bj-kB+{04=dqcoD`3HU=13k7ag#sEQ484qbD%?Zw`b+Y+0z0V8v zpLWAG?wNdd^$0aeLyCnme3w$yeImUE1l|5H@I>WgL?f_?VCFbIjS7Sk40$gUpFB3< zxIrlA@(s={EHvnM%+q+LD!4f?m$p30m!kzwriS2+r_PtYllD}j3njH& ziHljKykc7b_@o>q+IGMLbkTzsM?qbTkR_DVObp(4?YJ}UdRdG+xK1BpD@_YACVVnC z*pZr2psJ4y2_YfgCG55jO8*dnY`yR%qM^~)r0ex9K9LSPC#RV7Su2q2)BI>HjoX3) ztE+*Bl~4LP6F)l_Mm;ppMw&1ogNr^C&ZAkWKg(DVnjMHcZ@)3o<*Fec*UAL}ImO*r zjjmT-PEHH4%DXrHc7F|t;+}^{_YY*GvYK;#GDm~%`c{B=t=|wf^OUg-LR%{PB za<~7HpT^s);%6eXz8=MMd*l4r$KbKK19WN5-MVYFqlbqI`fuWs_jJ+jx@ewtBnY3i z<=9$hHmK2&mBqn1`~Q;=@^Okk@Shus~fb@lgwQSPO7Y}P%$K3TKSp^h8MPEK9)UtT4S+1{=W zT(6{s*FcHe9l{H9D4I50_}$lPxtj18bGep$L(hDU^6vJ|#He3O>Ek8-*i=|>9LQ-# zbme1Y3A)9E3$1Z+{Wi1mk`}%;;~6TD@L{Cl5^u*AEIk@t z#We=yYcp7BRDG)^Qr)Pq)<5PGHdyE_K2x8>8pm+_6JdX@_2mUce_YBYUXpitSzKLn zbtft<=}fG5WQ=_--mNOCjb5gY+m$V5C_&K=iYa`vKA1~zAB~}Cj0h2U*c9(L;9Yfp zc{+xEp`=acW}7=}SfP!Qrk+_wU8e&OBX*zwd+uR#rwLf|ULYUc&d2wtXvGgCfds#`8oJbYD=#eQ_0F z@7&j%->uBE)ArfLw`559Wd`I{^OXQn%dE=^QcbGz%1yIcPfCuMAhDZCtr@;Rz2i^J z0K5401ojRb;5Zl+yex+;10oU7y<;Bfx$h&eehw> z;4rv51b5egfmxnsw|4i_`~6f`SD!xBr~7wZcZ=rie`Yd1@l_X#P~v)TZs{QhZ|kxd zez%(X={@6-cIM_6Yn+2-Y0vD+c|(I{IVE&CV-ANNVulFrlX z50}5hV7b2c^tDVN>-z2*56+S^xz==UzQz^g80ewD)|#rVxkKN7pH1u^Wo%eF`ZF|X zZNMe)?{m3A)sVAb+B4R@WluDkq(!7_evg$spFz4j`$G z=d0vx1h#k7SW~x(clOR;;M3c{>)71^fLJK-VNRn!KEUhO@df+>)$l&n&I1BY4 zmR5JjYaAW@q$sXpbdkkLM%SirX4IuveGG--7`yfLY``+`5m%FL>h&)NMPYw=qq4k& zHzWB;L5lJ5WA4R9(>BM!x|JqJ@}D1oC&In)SAP57faS@F{_msd$=$tp#B_wfwuzRT z`-RZDXC3k0_~`_K3YJ1lLEOzbK55!X!0uTM{8YO79IDyrbB{NbdiwHy2N&zeQ`9M` zcXe1{FM^Q8#=~~1e`zDtA4ZpyZBPuy;W-=SftR{SL~2JLyOTwYYc${U^gqMoN!D)9 zNTtg^m{yWuOstMO%40PDHU-!{G~FE}6xIzC13mRiT_n38|5F|jOi5;RxQyF;{DtdapD~}#!4p#| ztO926Q2Z9zGR)Jo={a=cdt$n%dB`VC>8ov4O3t z0){T^eHX#j(sP*tqc>Wpzxa~0O;JcSkk`bnYwck(lV7e_PYDzLvv;jUnD{a3w3I?0 zsYM7i7=uTlOz)ODknT@g%BUW+)VRn|KESPMI~?WTp2)daNM)bQz5GoXJKhgIGDDN0G86Q^D$432U(pm?t_7T4AZ`ncKM5jej+5wLdptJ13~ayB6%RC% zu~$SUKO-|JbjFmCHzMDJ0%R;Z&Bei;3X){=v|sFTw>IO@?5H)p?_Ve?GQ<1!==B}f)7H?F*0I>^(vq<#^L zy2V3|mr4Nf+0aJ*$hv1qVoYIxF9gW{F35C~R-z=rY^i+HruA+na7huTVe zjG>L5-n}z46S0{%5n7T=j{jyx#2X8UDeZ9$fbL(lGC zxvEFm+rMIyUC$W-?I;N9uWtKQG2ps|`y+vd*mcb*_h-p)z?Ar78{}LUbt)x1Bl^kG zJmSetjB$H^eyX+vUia}M{?Po2Y9qpSn5%f) z823mL5WA^%pLzLK$-ZQa$L+$1U6OKIAZ1;2O64I&m$*1}W=ZFy$&8zXB$=a>-OBHG zvRyz?wE;ILnSTu#ciyTXybhAZ7`Pxv?J-SfSs$p(2GL zCVkX$t^=^4-jtWe&}+2f?(Lk)I`DGnzczT-uEv4*CE!<*9rI>zCJ#^@`rCOxn2N=Kubm_D$~sHr1;hRH~6 z#eZXzqU9Cs90O)FTbZ$M?N%=++ zy{^59jm`6JbffX%)W*Vs1g%hDQ8qPv%sbIwcHm~jp_CIYcl!R{RVl90+|lN!VU@+y zfnTt({M~|kKO=%Qylrt~^RDo-Wwx%7QeH=He=d?o9+cbX#9l0J7i^LJS@2Zq@4>xF zpXH0qeepgAGHbmW2dO39)Q^%}<(Gq`tHM%hcKX!Wm1I`iWaCHtHs5-^ifkIJW-!-XQzTl_AcbiQV$?iCCy_KQj zqw0f;SwFl`xLZ2Qkq9Q>WPW<$xn+2D*Y_aedcYCF^(vNv;=I-MmzvAF{0XJ&+H1$v zrkvPA-Hmq=qnlE`Av~#M0R{~fC!ENoK*^CNQ=M)?KxkC8TR+gt#YDByIYQb-Op(L( z`-7UN?(uulqS3R11y-+RFDa-IG@7KrF3b1H_k7C4$<;=Y#e61;cM-QuDV4#}a~B0* z3AR#%Z=`@EhZlQi_`jt_tKYg+2@U6M&wQCTF<;bx=W+DpaQ%DxOJNjZgYxvZ9hh~$ z&+FmUPvTniC(6`?eD{@oyUSHiNbIj~V!5*|orj80Vl}XlIYw|8CiN|(g7{bi9vIsT zwYkZ}^yDo7bH$fn;a+4y-ky~v1D;J0{plL+~^4?+xc6P5X%eiLd7;<%w|`h3y*MP>Dc8Z}w2 zfR6j)BZi)~sa)}V_n#dCcqZw3%h}7_zTqU@6uzmMP+0Z*hk1fX0ZCfS2H_QBO36vN zlQQF@<)*Niq15kJH|{q`-@fDI<<>x&!ydd^?0lmm@=nHkMVIBCpzI}mqpg4DbHYQn zD}zpAx{0QGeZi9)eg^7OBDU5mI2iLV?W;7&u0Y_WB62X)(tt^1ZV|-g{RjWRj!VVb zZBF{O#=BooP=Lw(Ol)m4_J*Lf{R7$o0o#W3;m~obYcra$oX8T?F-h{G`n8;hKa$v~ zd+Hq#)_k-4y@AHy^w*Y{QqU1xI|Jop)QF$olDcz(ssCwY4m4gJk({xu8j}swA*HMl zE(0~aJL0L{KFM5Y_j>WHD4kD7+YIW}$A(k4M)z*`U(4EgG(d^e^#4BQB3>Vo>U=fK zh<0)NDX4FBJCe3gd#lq3aiB}UtXbk|P2}tHOqq%o9o|%@>9XM5*mS$?V-q48HJk%Y7owVQ#o~Z6>_J!H?L+)%{F}XHK zg6M?wY#6_GtHw8X&++)$#3(2k`-+ct;v{)(t77Pz+P^W z`kM9C&1-fuh;GZDFP#-$okuz&w4r$$896DRYFE$fj4Bldf#oru#D5p<&9j%tc zhN;4BHAU^Dz2PDH5q_TVGu&18ziSEQv|YR=nEwvA^q>Z%N+i)Ee~fJib-ZIs#mw^13AHq<_pGj2*rBE5sTGrs z!XvdCNvDvXopk;0&j!+F6!Jt9Lc1fo&BxVX=r1MHQ**0L`WP%y%!7g4d|Y@MZTgwv z`q%k-tCxOf&optSG`r|5iYq%$ zS(=~4kEAWy)Yo$T_=hMDg_ZVB^gtQsZ>Mv^N>Y6)KP!^b+34r6HuFr}7Sg}`rs+54 zM7gzCuck&8JC-QA9M#9UGN z0-n@t`0c9h=YMf`E3Sluar3M%H-!s&9GCa?hoIIv zufiQOtw#3TSTE0zXiAQ3j2_&X5vMY4e{(`iy5j2jb7hP=aek-c%B zl=pizgF?D$iwOMKZJkJe-YSk@t^Q`~Rrv^;*Pgsh@*Te0=DB=N<<_afCxA$d>P3OE zWtHPl@j}X$^|_s=bm-#krN41gy*O**hl?Lk5O#gm$C6Cr>4x&=lErj9-h4NJ41ik^ z@MXbpy!%&k^t5?0CE2V(=4;w4Ci0GyjsiT)m!cwG_L|v}-*kT8yDDMh=coAaa$&vp zOw4cgl}3O>87mwIXozQN&%bTHX|BGKpm)cM4j8EM!t&c@-+171`C6C6{sA#rG-!*C zIx2k6qY$SSyKMm(&>Wm&LGVxfF)t!a*kCf}E6W+?@ygTLDDM&U9QngwFd>`QJIY|*C z6^`R$SJN>+Sk5KVbH@%Nvrn|+O_lo8!ng1fiZ9$fH}?up*IwdDA%DcoOI!}~@e2uc zaAL*$j}X!Hnxu^bmlU!zGV2r@BlQ^2eqBd@#}I~u=SRE_Y^wx|NxHLFg`oc8nUE)K zLB8Bsy>p7JSoM@REKBq~UqW?u&VDv~qdSX05cFnf4!6HL+y|cYQy#pZP|&BOF)9(O zRnBz&{$MVJLY#v5*2(gy)k9ocNf;U#Qn`1VB@S6@{qIKSo+9grbdTv!QGX&<3Wd~T zVq*SpdE)%!k3v=jL%&$uLFbh#xaK*YkS{R@f7Yaw)c*5J4!V~STg=A=E5m;adEM(zg*g)VHABFG}z6qL7B=E*{2c9t!C81cWiGCiGC-$_!2^0n=z}6y>r)`@$4*)?s&?~&ft^uyq&IwEY zz!w|;MmncQd5Y`qdKzNOXWxH9CUJ}Ztal)V!rnU8gt)+{=kwbCUuDOXvq1m!+{jD~Xg?*ez= zRa_mUTyxo+_^m=#&kWRa(@&vr;??FOc$Y(R8_8<($O2xS&ta|iiGS76Zn>D@hdaa& z7uo-`?HdAGepIWTnWG!3t!IkD%fyBO{1dsSXEZebuo{Zslu?KMpZ(cx5 z{lmb(8=vcMhre$!-j$XLnG2Q!KTswC3r-!R!v{H>%63Ugb;s|dC#}ETe^kyqP~0Fm zZs0dd`02Nk?bnwC4ilt7s4*2t5GhL#u~H^&&N#SxpmUJcT~+2dF<)v}b$QPKzDZ3~ z`*j6;^=E_n&4B&-QvBFF6?Q87s&oU&$?hGTl+vel$0~Ws=L7};({;HogW|DQe(L)} z3jGA*>sj4()#G(eS^0-0hm;1TM~tp5_yez@)zV8{IDBbc+hC|>#8e^G7rjRH$MS-GRvd~0Dd?(5j*E*Utc+w7#rzK#d` zk36|qr|h&=a|cd%mjGD_6i0~(P60p`UcajuWsIS{HaXhxJszl1Cs}G)u=wrKHh|q! z8(I z0$(2JCr>u-BxV3*d{>XNth`j&YM9zoI>WaRjh_?!!o;21m;CfN(7Z&4TRt1ap;ZRH6+Dhpa8?NQZXz zZMX!>ZEX8C9s!R%@Ncbwi9lNmrIh!xeUl~J6!WJSs!Lx>OK+bhdsh* zY=qUUZ(Jg{)}>qE!U-8Z*agSPP;1nLuy3>_wFQDoBew_BsCocyqm4;aCBLdH3)(ak zb}SNH*~G??>cHuF&N??OuS&$4;hhr49E-lm4av3?56pPB7w~9%F0*h3FijsizYN&c zT+Yb7-37?v7<>G=&OiFJP<=)3tJ(WXRcaDSs{T#NU9bZAtu91wRTuI#dLi@bku*}R z*plJmYXHiqJ#QnQQlKMus6EfzT16@YGT^e!&gN`)4-11BMS-5*UNp#^N3PG7xMlW= z{;|Z&-c9R1J(jsFcgU-9BNCioF75(S28r1nzc2Ec@S|=$_3}C~3M%Z#zHHMX=G0KP zX-^IC7mSDGZVm4{Qx-dgrEdj#xvyZh=-X42sG5d(%kD@W zjN^J;?!%iFsB<0*>!+boFS>%+UfkX!ffr`BwV zkNh-Fz2zeM&(O(q2q$}rGnpwYT%u(*u{`rP42EHYa61Xyd*M6}jYUJCkG2DIzWR|v zm)S)-%<#%dZN`CTuZdDD8;t_-ZdY7iW%lCsnMi$B|BtkyB?lBa>Ky_3)r-y@r6mm?-Q`sjUPW%egKZgZC$ zXWwqwi#ykMk5q>fZli~^`MXKqVkXsb4SSfcEy4{n6kFNU+N;yK$n3auy>ZkJvanBU z%z1$v)i+&$Mt*UKxQV7xp{QL5gxtZMCe<|v+c=$6$}m#O-T*NPOY)fDx@*HOfP1d< zLB@Ce{&t7dB&G}S?vC^SS_CVZmkxF|7Szs@nIsWs{qr3b>^LNmM&gsh^_6K$G=A|* zxJPEkaLs#Aj`@eAp4rS(0#jH}r6K8N$NZNiy@;?8Iw)wl6rq%N2ZzlPxRE+-{0Tp? zK;?`iG5U)5*HdYAemP0d^O_3E=BRX?q;nlgOdIp`ULDI8I<|Q%d+BE?K3csxdLRM4 z{JR3JbyB7}u_)g6h&<(98tJEQ4qp*VH9J23U8uXGRhxt%`GhY-8IO3~FS0hNe5MML zj+ZT1?F^%kf=l0;jDZjM{Xp3^3Z!Mp4$iyl>MNc1+uJIF&~c$nrWyc62O^Wk>Y+%^ zLt@1PJC;z*X{)Z|nl+NyK><%?VsU|9lzV*?6c{B2S(B43OHiBW_2CcYgh~$dpTOdJ zll8GpY^}yCE!JmS?w0#qtX3us0K7L<>*Q|lZ!Zzyr)HTwwXfGcRvw4wMa`bU)&LO_ znL?Twr0W~|IsjHrz!e|OX5WgKUhT)kIQn98GO?zU9E>KzK_@4H&Em{`*G&C}Q(WrS zThd6Yq4Dbm_djE@y=85HjXy22&J+XIF?BW%3S|b}AvCCn`D>j6tR7txF?Hd(3^4}D zRls+l@)XPQn=Z`0-l|pNwJRM`mv)UIQ?W)NLXkid^Brt7oJ`-dKMxBX-U5S(8|=rA zdY7a>PNivfNzaqbqr)$47S9*>M1I`%!%lA`HrNFhK{+-`8IOhi8nQaqYAL5}Aoaj2 z>y$aNkE^qCYv1B)XP{>kxv&sbb}|C0{XhAEMwa#2W2o6zNAuNT{MmcRFL((RjDY(~ z8XMG&>hzYOt;9lCjPXLJ^m1b$9(xM$q&JdZ+H5czx?H@StV%()0rSa;JAV`1xIEl1 z<%c2WRY4$iNgI@()HohT74yv?F@}_t;Tz8DrovNP-H2v^2cNT`mW2if^2Qw8(d*a*jkXL7>U);C z)3r}(wpn$%&Er-{k)u+h$3n-yMLFTJ*E=N2;F!nH)J=z?DLTcI0e2i0T}M^3AUccE z8L_+AwYxWBJ-T_>R333L%9+u!a=BZg$zl?lMn^|PrmQ=o>JgCT>exw{J>j*{*Mp8N z*R<5lHd4__Q_s1aRs;Dqohf37WoBoq>kTEN?BlB#*r18W&oyMM|3a-7E9pANv4nIQ z*4za}$2E_alZkr!iuw{l4WQTnxT?$j*Jr$B%c7pQxuwta%hV`vEo6iJL9ebhnBY8F z5|S?PaGK=v1ItiQfMDMtzhOO=NfN-BcURlH_w3tZ9+> zW|Xt^a$2dOR?q#Q&F}qIoq68dDBn>X5+-V~Zhx3cTsEWq<P?R8g`yv=i7JbM-pXy>W+)z{prk zo!w2O+;rsTL%6sQPe;NeRgC#Vk46-!i&?s-Q9x@a=?35Z(4)G` z_B@rinH?4%cYv1DXtd#643E3#F4Q*`F`PJ&xv5ssrk7ZAGktzKk2eXzwga|7Pj?ra z@@Q0T>}~9TYpJ{LoG{}uF~gf#iMF|T$-=eyc*{6@@e7ndf7MKj-%;vrKAZ6c&9P7A zSuKu(-?z|ID_<+A8o}pXfy-s>=$3q4zFwQ&jKj5iGfXd3j8H2|Ski=)#pU!W~ToIa6zHN;x&1(%m^I<<(Yy>Zr|K5Zt|{CjvLu zNUh1j!2R~vmG7YOd|~WVh)d$-hyNA+Ga?8zL1%Xmadahf>!S&Yx?CFq-1~FC z0D~ic-S|&5{xW?KHqG|i2$po`U{)#fvJE|_=RWl`5UIO%LXbC( zt6&GWpd3h8mxWSWDA#sOH%dZFxtu{tjkIFnlUZ$Zz6?9E@Uz72Kyi-hWz{_<(Z_;` zrh4jd4T)5yckcMWY8so0y+21YS2UJLg%=~DqhxEE52_mfR^XM| z1oxhw{LV4nz3tl)v_Tz+luEj&>`;Sr2c{bWjHxK5LZ&a_8`qiwM7^HMdJRo4qXB-m z33O2t;Lfh1PzHnP?5Mgza}35IZ`WN;j1umVS+_AUTKifJ*zcUYZ}LaDBMzUB1|TC^ zBd#YWW4EtrYrB2QAYjZn&8Yv#%5FHb+V3c278ybu+`ahTOg zPc4&}yW9=lV6M9<6V&LcyU>8qo{=^_3~J_)mWQ zi}P~hul6{srdJ0yCs1(OyR5n4ytdqbVN61h_F1))Jk<);(8e3P_g*W5jk1dMrMo7I z4^i)Ip^{^+24w^mK zZy4W{c5C!h(jeYJ*F1h^53%o`I@|o1r0|c}bj-9DC%}{}REAhg(ec@+)&Ijev~f|^ zwTO(>$Ke%3&ab(gva1zZLT0AobS*kGrIdDRL~CFUR<#CddabFT)5?EGL&ZPr zjvvcD+*ql8e|++9(v?tmTJrMZCz+a zwgb!gaszH92PA}!|9qP3jJz52ZmpDxyQPLRQKio;-;8rwf^MdG1Vbhg;Bki3|8flR zsx2M_%Z{ZfVZtg(KoW1sGdt&{ws(Op%*OP5dReSTEr*HA-j~*dkKIN`l#K5K8@HCe zEdMOXLO((F$iqCxbTlP)MWznv>dY~3fm``T9WKmbf>nJVfnl?s*OGy>7-DW@ZfhZU z&xzS>M@E`|d$GvUew1T)8|r&c1spm2xaeaqK3DMc+%n=Ig0>K2?3!Cw$PxRyNeHdM zBC9O8dDt-es5gmv)Affl1lSd0)P6KJ=nmn%joKQcszNk=@}I8}h+PpnqE(cDy85uq zA_2c%-c33n?wF;zImL9$FtMiugk61O2x;nlSo?d;136aNOD4B*0;XE+n~d`a_d?(M75htv?3#E+vrqZ z2RuFI;BK5;kzj%G>rf8SxQmk2JOoU;z+yFr-mK79&F5W3IXp$qy%m@cGWr7s<*N%@GSj zSwM5q%-mhBLE~!#lX0uWwENNj7V*uYdd}KGiF^>rkxNMH=gVGaCZneXdm8+R57>5v zM+VUN5Kv%dh)Y(HJmn`Fb+d`6*b05UfxEQV8u~##NWu4WoEAmfo~=77SF{bDT#Dba zSXj${wGK0MbsapK7s@%%sp*gEYq<@m@H;FW$(0j@_o}$5;g;e?H@?IRW%!y#wM9k> zX2bB2aK@fxC`)nND&maZJ3JwTQJhD1+WNuX5}aow9c%+EZP28UvmFyWfAZZBUMZGw zKLm|N98%ULj3C?_&gb1zAbHNDYYCEa$W`9DLId*SV^Vcu2?EYFnnO< zw*;dRlZ>-j&@eMW_%J=;w-#zY-nVZD)s*|zfBXh1wD1DuO<-jR+( zQ4dG07SY**OndViA}X7Yy2tr!WUagl4r+_ zSDTYub@YI8B$XaH@uqC|c8tc7{CuP5wO(h71l1FZ@rrn@`4H^{g&@x&L+Y<$99q6~ z)UrMbh1L1I5L$5+b4X1g6!naeZll*DoYG(X+BcXQ2=CMd{iw<}HIE5efv&{;ITY@f zPizW6eZd{{ZZLGt8|4}4+_X4a?#TIrRlJwm6cy9sism85cdeXaK`GwT8OPw<=1D>Y zX@7|pU80(?an1~cYh3?c3UZBHU?Ui%F8Sa(l-?0<#b}*_cp{1^;94j0=H9*HgAgdG z(DE<#9)_#)@aNlR2j^_XIJ(uWh5BpW%5t$B~XKeH{0{+^7W*@{%1z@2w8#RhJp9Y8Lybur?1M;4+Oh`*EkxIWn-12Olc5~66^$m)8)GUg z|1eNb%C+-5BA2HvLmk<9ngDzvXm>y3_p%{8N%(AJ7Tq&U#|tKUgAjlH#g9^PaNbFW zmk~oR?=ztNgJ5xzVwKVm_lLoPDX)x~^bhWug0cvhu#?|1FOBTGmxSS$g(f^L<<_7#igx;r!atz+EgF5+!LJ!z zFg&em-JXB>C3_-MaF+=~Vs97*Z{>nb)}`qnJu=TkykUb~Zh|fyVujP67Z6q}>m3`EhPYQ%W-5Ar zvPhv}i7-3J*5^;MK0ByWcl+Z{+`-TvOfu&_x9XWhyrX3l4_XlFSx}=H@;bJ#vyxP$ zfNEN~yBZNE8^AI^0T-JU2Ab-g&7nJ&WIs4svZbDSxa?D%%pS@@U!#lhJR>sRQm)LZ z(L?$*9;}@SUd>F>jvd<;Mo{-x?5P}o53>IzYj%(L3u&1o$?K@SSiq&Kq%tPFlGc4| zI`5^IWxs!tIY8x`Aa81`b&5w@ULW^Tgvq7XpeW}_o;sinEB|$xF?1PH`BlhKUma-q zeE$XTX2lC{ZlyYt1gAU{FvG*~$g%K%?@gmO@)9#jY?goA*C<%uj|93JKy#?eVfN71 zdzCAywx;r*vL^b_`?9^Zc@>mEWOl{v(E>+_(&iP`*u`S{izr=}{NaE!9b-)ImD~R^ z1uMSWeWvSI&*{(U_~~Rgs|hU$5-6vb@XWI4nd}L{b1vGvGjkJM9(BTrq?DZPt9{Jf zI5G6D_MF3UG)?MDw}61Zdh+EyPFGf#w8UmM3XTV!SoIw>0FJbBtwtu%__vr{Z;pIp zJX;Xm>T3$!a8*Y`*t=*bXm-{0S0%4VnayCv+vdznSF{;>YcH--u{>0me9zqqsz~Hy9x@$ zLhBoOX)hz)gKjBAH7(D1CTCRn`6#-3rzrO+Qvc;BC_3|w$eSeJ&4Y%RpOSROqC)pu z?>1>Bb`;IJJ^dArBqL#tJWkvaT@=Q&@1e(5W_Ju2W7wFv5o^UaDfn))+~=D{hBOud zW+_zjqdogJ?`C!r2Js=(qH1G*S%OOZJ{``uvPW^Y#e=s#hKFKPOA38inO!NsZVhG+ zq`F;m#}F9Bq+L8-QN5txY9%o`Kui`oAKLxd&3^7|0)xhKh-@#6!ZK=Bjx?8lZPxU z2|$}JR9#aVHXP&ORA;Sp*IVBn-y#L1aga?J5~}PKSya~jnCwr}l*^e1nu#sf*UV({ zUC+DOi8OScAA4IfR|Nj1mMa=w5D6XeOpP$ML9w7|t2(aK$6c3`**|kb^P?Y)30ywkQI$mlM5v4KCMvC7`v*%yb3c-F%}=BD+@j^1P`$U=sgR`?pK8=5w- z)_J2u1EH~JJW#RO?}B@O@Dkxj(Y7Dkx9)phH3Xc0f0>Ie{w^`$4tfSvZ{B(?2`0{a z=kOSklaLc3r%aIo*(sv4$uf2)5nt!x2h+RdtBJV^y2Lwcus-81cYti3?uCTsE4w9E zxdj^`{ib^sQ}R;Mi|3F_`8B^#P1@<%PA~Kk#L?1fkGtt3 z;h0Be$&j3mblW29Z3$ynuiV{FB3W;&#&`rE1U?sTahnyJ(hZGI?SuF1FX}XirL?;PJ3xhqVt5My8IfXZXAM zQJzv*_l51b%j(xRW7f$X_3@iS0YfhuD-63A3wvX-TK-zfVGcPAv9LIpyK9k?8WL(* z^na+!Xq~1LtTO%L7aVeSM}V6{IlZb%-ft)kt5O=q@?IWlK9Z#N-D12F@jP0DMU$}W z*0i!Eq$C~_(nIF2CXu5lCMupev5hHS%T@o$vU|lJij3Y;2j-XrzC;M(g^zmJ_izPH zu)(oIkeh2rD)lxltgd*>x|vZGQ!I7ydy8Pka=k3^!3k0+`qtd!^ z>=9!Evml!wXVvQnLJt&Er*UK~S;gSERODD2c%0ilA6a`0pbp5-%&<~^gN+Anab#_O zwrX;pj)@p_IhlBuL0Z6KRf+D@r#p(6f>|)pdHiyd^dcaV8@Nr8<-J`~G&}fHD6|Ed za-QAsw1%9z1**93zOndn$E9Y-65DvzD}_+b5%IunYfEeM*KyyG2aBN|$tQJJ6o9sA z6^mA{$HcqVo;Ew&R}K2V7#DLq`Ag~ba8VWkHa!clbAPjgr4!74@f`;wIR(aFr{p8K z(>JI3Mc??YWCc9xTWcQd``(=14F&pVxO%_I4g?cHBtb%zq}_U0PLG?f10>7loO;LI z!@jzSD6Uh-8S}e8Fhh3lbOTde+QyYuE=ca0L2g?}d|8TQXT~kC-KjE4p59J5-TZ4a9 z=M*toiQkR|c1ofC;lLTu^}|Q)At-+_=c0&guPz~RiNAPH+lR<*)B`$*Ci`EQIv}{2 zKl5%_V3hTVjka@wZ*ouz^!SrT^7`e91?@3omteH4e|pV=eRn}ytDgD*UuQ4Y?zxQ2 ze}r0`aYh%sV13}w?p@;A!|MiF{Q^cf8Cbk{v;#g=ODILpevASSrb!9L9_la@>eF1A2C|CoeRi(-UVA#{JnnK| z&L;q0Rw;`1ehBvCTmA7Sb5Kc1hvyJ)c?5M^D7AZENWQqQ5$^S(dQWqz_@3(UiIeu4 z?x1(my1+QGal3W%2IFp$1`w5j^xy?gi|5zEoy~mMeg#e{kK2DeEs49PePPhXE9(nj z5D(?HOx51dgu6|h+ZJoC3^#Svrs=6^o6)ZSPK{>_S-v8Ee6`*J>_Frzjui7wB%e(%HdZz(2z5bqcU%~R8*=c*Ft%ki z2Y*lx*j@8E(4+b6$)*tc3mVt$8WB&wG3h&W<35%np7XHNF}W$g>$CGA@WI=3^ZBz` ziXlGUO!Thkz1QLXJolDf2Aj0P+LP}$O~_zHTZwTS(l`K;nl>A7pnb1ugaJQyk&*4%`@H1pwX7KW~)d?FAxhB5W3iw zLh!Fo(=D=<2J;4JwKzB+s|>sF#n>`A&00rx8zHvN!EpbPVMN zAV7NhblZw{49u_hPqXmpY-l^}pZ@D(nrM@ZE|Rs9d9-+)FUNKW|40sI;T|r6JQAB^ zlVrjt@(dFd-JpAYEJ_XV))~*Oyw}H}j|ZVBrT!@SJ2`)!{TZwRk|YJ7+vM6}EH^C( zx$JlYJi@yRSwmpYz#{we$ayP{3`Z`Y5HGRZhx6zs zmRcehYu+%ir|+Me`T6;aFsn#1BsLCw-#NMs`Bm+b@sy+1?2n#y9(`u@w(~1~;s_VI z<0NrGj2f$Yf`qDRlq2kZe~)VGng*D?hH6{ezU)ARi!X>X^bdJ|dAj1Y>9Bduf-@B} z;qHH19Dy+59~f33TiJ~}Z{QA0SbI2L+X;N!hT3N0e<8vqY+#P(7_~?mtzvZ7evdn5 zJGWg>WNptbUum>>dU}Tm%K2q@+L8)?Eiq*g;*l#np!;+My6Z-vji;+VBNMrw@PNB~xmzIAIkQUSXLh$T%e+*J z)p|oAJb2p7vipH;f}x!2TMA6f$SoUD za+>rmk{^-hWrt6-r7XjQ#hQoc%zo}^&Api{LbsPaoqWIOG1EAmHQ(ygG^~>i2hFC2RmG^dVsB5FY62MfU*&w>dRaK_fSIa@i?e-}- z>kf(l+z)f?UnpSLX zJj_hQv7xTX{80c7YCk7Kf;yhmFH(=c``WST%d#urE&|#5;GN$%!gN*B?C4HrYSfgq;G6H)c=IU}KN8QY{}N97LaQwR*4bi&pD1 z@;P+ByuS(y;~lBt`CO%$e!zQD!DRNOO1JjnDaKE0LxMj$R ze#4r~K?-Kh>Wt_ZhxH@B( z(R&lpg*VQc2lSSZjk!)7$qB% z;}f>3fP0Ph40X6CHLkKa;2!1wX_R9>JUR%9VN0<_^SK%K-Iq3!Q!uf2rP@~9q!e9^ zqladBtnf3dXLo|3zZxiXCiP6!qXy+~|FN9d(Xb{fFVyEnW?8# z3P`K9*NZ3p*Apoi>_7>YgS^JTm`h!u<~92S~X+O2Sg83`6J)N3wCAc?k*P`l+V9NYY> zIya$bEN2FkRQyAm(bCUN4nrpytk|zutv1=Ji4DlP zkHsZ1o}#20vr8q?2(C#_Y4M9q-FNsHY=-rr+CvTlDJ1aeGg&pGGtIWzxV=x@&K7hc zqxfVkD@hy<40h%}*MBDj^RpYbkum&y&~Nvqi9WE`|CXWV?Ty!2K&L~jFU<1dV}ZhI zh0)A`poBNMK(Cn^b;69ELO^lAb-T1nV~x)Wmsf>x-XQdoj+aF3nZhtDgXn^qVXi0| z5mwQ9{Ct>1xYHq<@AX9SUfNes?~g?7nqYzd5r0?{r$CbM!{bdESt%My)Wd1e*0QG8 zaYs&}0HfvZcKil5?=qQHcdSs2=cAks*`e?K1hY>=B~=K0sh=se5K_Fe8J5@g~qLv2Akg>qzeHG0v;6Di>DZ0?j!1QCfYB8kX$u$Vzo)K;(gm+VXfu>v;Dk@!%0+<)b_&NiQYSsOx0 zb9^_LvnZzP5Iai?&3QqSc>pjYcb3+ibu77liwm@;(vOsQ9`z>cmm`bZ#Ch|a4Mn!ZX&f?JxcP`6^pyX-o6y8-Yu#g&# zX0s1%PBeyylyy;k9^6OQJ$iUcc6YH~sU9@3Fc!-eOj8&53(Lvr zZt8HM%}t~snk=y_^SAqV$}yGr)}rf*)OnK}ht00uOCOJP^SMm@>1qY!2h)gES-IeS z$Hj)6do(LOo{a<1&WV&4ks9W6b(aWjIzn79><3Q61Rr33tfOztL{izHVR*_tV>hlr zquG&}B7;;j!6~n;#ngXT@1v!~N*on`asiLfmhzq$8* z|A=@0vd11{uRXWdn$Mc!^F*$TcT{h+ecGM3BwMEcB?P&7qt?636Q;5ng;33m_kEVf zTs-U{(bRh#vEpJ|?%}Af%Z(o|u%C1oT*e(VSLvzZI4#v+td+BF@(vB3P|EfKyb(t~btl4OG?Fp7 zyflEL0tf}b(91(_s%L=M!HHI!u(m^AjG>`GDB~Mxr(ZC4F`Y#U&b>B~m8D>#gK9Ee zNHU9#RcWdmJxK62ES4IhRkyOeTaVU0SJ+ z6s$GK$%S)rvPW)aNY^%(0l!FGaCn85$~jV_-+5jc^0%1%rm#o|AZindq@sZdc8_E* z4oRM{pUVc`&7zx8K`Fvbm>(6Jg-bVURlD1U_oyvv4N+h%>&s40P>%v=juZV}!YtfO z66@}Y5B3u&5BMo4gnT7JVi3$NEKI&iX5ixlasN$uxZ{jPZd9*Uj8m}-8BA-65P4qE z%Y9k)2dvEfen0OJd>*N??|dYECVL{3p>14s*|5zdd(kHq`o{XqK-mviI$Y#or-oip z)(gs=jj&PTX($-;n$4ZK_(KX_c@_Fp$(2rDbYQy!lke;s6pD%ozH7<&ay|fDEoa3> zg7t~7G0o4s8anR23CtIndGvEKJZ&8+QhcRCF|$sbQck!$W8{o|#G|chJXMr4#P|^= zNX>M$13;_rT&32HUb9(^eRul7Gi+at!rR%(NNFz!vvaz|v4zdT< zB?wd*h0~H|;Si%-emODO2G?)l%mb1d8hccktP2)W2o)K+RIIe6U6=&>x}zzpFfhAE z+b${yNAdUx8DfQr8T+dYqn%@|$(J&2w47RoW+7?}dFjaU^sN~wlzZ1ovws9+XG|!# zIK({0nt>YSm{lh_4$AQy7G^xBpqut%GGbhTNZ$`_kAFL1W&;-)R=I}@qZ(uV&1AvU zjQ2-ysD)jQ)YX37HrX!IAhj};1qRLgGrXL5G91OlCa|gd)7X~nIB@gYcCbwOe6klw zmqB__O~7o-MAJ>mS z4M$7BsuIObUYx`2Ua_zv462HIu?4-M!*CU7AKPHaeBYLtv=-8N=ktj;ZqYzr9Mg;t zSCn2Rw5ZPIe;Dg9py8n);T%!;F_i}5|4|}YER?1^WL~*8a=G4=GR0$L0@fByum~SE zJ_TGFx)(Y4r6RqXk2N88J?|G~pSe$u0b0pQj2GLm4VL1fIq+%h_I|8)&P?<4KEsO_ z)W(n3LAr3~1Au4pM>k@^MtuAhGL^Nza_ug%6o#kA9(9EBK5A!bT{4@*0uSNRUR@rV z{(<-h%SZv($j>2P5INe`T12Z!3yOgji*AOvO;YpSH(}}GRzxv-j0Uj+E;Gu(Oj~(T z!43pXmTslHNv|YPX-!Vw$5>nVPIU@L>{=^otD^quJXOtgFm_ho>So>U=5IT%XOWSa zxh*oZ>(<6Ulqj*FRt49BR=Y6AVK}@yUzydpe&X~m&Xfp^+Srb`G#HaG&8iXA@zYj5 zt8dx4#BtRb@-QCU-lhTNrq0&QIP?c!)1#aJ701W`TK%6C#=C8!D_OL3{Dfu0g~nBe zxCGc}pi0mt{kc2`Zq~AWM=&z$hRmyX?=1w>)047-v}}-i zK^&WujY&OPPMZ5wLj9WeEJ(6$^U=>fEjbg*8Jt1xNkoSjomSRAf5sAwg+a?-$)l5% z6O5iPn9G*bGR9mWku+>%J|f&AoOlPVK5UL!CN~`{)D<-FW>`Ch-pZiO3v)`Cj$&#r z9~8ws9}Bx=H+Ao&5ucnFVAcg@k1xS_ZAz@dNIG&El!1@W*T5acA zGzj=UCu0vFDy6yLKbFUoQ5 z4)w!ZOScpEo8@p#O~68z`FbyM2a|6m3oeBk;C1ZgkEPWA5(Cp6+r+?9}rhj88V*+9|sV&9N+E6}u1vR)w`;2CD zXJR!zRw$}5w>kEb`V0#9RXRVMy0*ff0&lYTZX*YC_zWXS@70h`npWIoPbLN_C(BBh zKZW&SdXbZWl}UA{E)>b1dS_~Cs%OSj8kLG6d`!S=q<$J-gP5oH$J;};AMUD^RfcT} z@v##p%F_3QBPObUX1!!aI8M~@?lWuMHQqQE*3E9C2iM(29*prbqqTZ3dsMoA*+?RP z1V0OFv7|*JZ$-pcc@@4^*)tB2EEH)R0)hUd2AivRro2SMbsN)cXpt*6(+#J`XG42P z@u`{7UpX+cbl2hqRtU+SM7m)=xksNxXp(9HMql}Ua+?w~;mmqr4F z@bxXbbj-wZzU`(mip{FG3;JM#a%*2xU4229c}?IV`O?Tx=UlNEXF)^F z1YmET?Ra+{qYVRD#PRU;$euBMDy4$uv@PjRO1vocT$0wZq|&E8pq6$x(5oIkPfJak z#0bpTcC>BlVe)4GlU-a|8lQYTQ0X(q#7$||y=0A3(Y8|Jml!kC>G$YJe91RZ<_6m| zkU_1Om>;|rn++jjDnG%NU8vxzyK8~oJwRe5janh!u}Lm$sF@fPI8cn7sDah+Z&6&{ zG?9Y-y`cG>sdXNW{Z5)`^aOQg02&!{`HkYfM>}goQ0tXW&9qwLUxP7|e^RIMjmW66 z@~H7p{lm{gcPfVzSFEp$<;-&C&aR5M`Atva&PtwpgxX7ZJDG%LV{fPqrs_`&6gj0* z2hc-9PE}dOmc3s3BTg9I84Gu=i8(-5wNI&4>xzwNuC32L&BJ1DX`% zWlp5}C!)7blMfk1>$W1e^kC6*ncEnqX-_o(&=&ney*wO+?&gU z3W*&x2aAMhyM{M&gcnqj?b?OnP_@P-s5kWd9h3bfV0Wd{vQB1jSdn} zzJ@>kE&M^VeDT6Ef8{qrWCE^(3nu`vc_(ybek9|F!OduWl{qi;3U{-MLW;6A_g2%F zRi1XintSonYi{40_M&knbKG_IBE)KR&6cGmYKIgpIU`S3y8SQ=S*(spI+r?4OY%a* zfyTXYp*NVej0&J_ILT7Xvu_;)#gn?j00hCon9lDScH6HVs6lFrsVBaqeMwul-s#>G z^2~jsx+Ns%P7pdNHp{g1ZxfS;>fQ}n9`-WSk=@O5`$p4OPq;%qwnsl(H|xIeCpZj( zaqKsL~ zjGcZqm3j20*4=`{+qbLH|2WKjd3dwwWmvfJ;dsO}UNX`&UX~+Bk~};c4qtJq!K&0n z<>=z=ryCkXq)EJa61fLiBZuLlmYc)ImG5QEuf9DgyC%HZ9gIjjr>m&nliqlvch(!t zXlUovLn{Y<(DQj0LcT^AObd?7K$GddbM^^k6J1@Vr4XgZv;N9MTMt1k_QS(ZqlwT? zKbWN->#>V&IQ652?Hn!eRvCDwZ5zSd{H@AKQd|3qPTgZ@{(3K-q18yl<}y4EhB36Z z^`1%`$kG2y%I*7ebF$RVD?*kvVw?T3=lixuamH^HgYN|%&CVme+L^lR6@u|izVXgwb+wnxUj6@H+ohl=&27&g9tes&Co{;W_jXC8j}}I{)7Ud%fi_E4x7wy()_S; zb=8Q|Sukry9%fqyjDlrQtA~Bu(JU)49upSRa#SGamKrf$xNAyZT*YW2`(1R(LP^`LJ5=^pVr#1DAk?NncT9$($9tpgs84jIfBRDqHFLomeA5P0zn`3EYRKwzJK1{GDzQtP_2HM`FrHM-74L|YPL(w3UC^B zLEB5!R2_VjRq~JvZwK^8FuJA>^^s$w1CR3TN&Fd?W2UAy%sa>1HF$OBn@%0?lTkwl zg7q5I7PQhi{PrM!d548y_!d|fdi)iD9)pkQ!0hCylYAWIajfwt?inOE=VtrWYCrs} zjn-HkKe)<^OQl}Dz66uukB{h$Ln;@w6u_0R zMr}~}j^Yd$V}>~OX*&69`XJ}3L~ul(o*qiwG6<2==fIMyg%>YArE;gjPFg92s00@W z@)iQ{Cc% z6(fD)hqYr>0tUlQJz)ZTJV)XmRSmc|6Mp( zjxo!!MmIf9#iB~gt_8y{j|}$`(SEG~is)3c{U2^h@W71*=@eZ=Z82iia&?i4(11{y z6VMsLxtpNs&nXA+jkxw6)y(Usm@bXwa<1=)(gQ%yFlfVDf7bh+)0Y2Irh_x&B7v9t z(kSfA6;0YQX`jK<$Pc}mLuc1n0+XcwcM!qL<>kOihkLwBYvE#U-`^%Yc0q20E%5-t zX~lFL6=q5`+Xkn8y$KWp@PVE0e(y-?fD3({ttbwHxFy+-NM_tOig0W_4_hKN{nJ20 zCW-iy+%>hZQavQDc?-w*?&;9C@S%C#^sK;=0T6puc{8v|iws)m$pxMFAS#hY?eFL_3(w5lijl zHHv9k^w?SpDp9g#wGCloDxw$uDK{^8%`UVe+WpBg;S^A_{VE|{^U8@=C21)OD$^VM z$J&qGtr@j6m7+^19I-hXvfaG8F2HCf^ow7p{b8u7ot+)7q=Yz&$3gOk8;-5E{qKvK zoEh7dMClhN>n(0ZWR~`$-%!U_siya--7B3jdR}fZD{kAu-*~wkHMvdR*0iX<2p#`= z{K9YdBd9WY)O-Q+U->7wbAZY(8ufnXoNAaovDr+i2#2QST({SfM(d3GtjC?nz$;~j zZa~{8_&HR%`cDs%;XTa^p>2cR7A}6WC$Bz_$#N#YEQQR`)JsEc5r$pcd4FF{Repk; zYMYPhMUroq$w|8dG9oyD#?8Syr-o z)d_BGUI1hO+rK=$y&{mt&dD2?42Gbh@!w$XuG%ZyfK9F|1BJW z?fs(?ymk)fczKvoZlfOz_wWOx#X{>3ka6SU3a_~CJnDI~c02j|98lAY=yva>+j4Jo zc6=o&4TxMFgSH`pn;fMXmVg>78EA;aS4 zN^D9!GyDa|)(eDOt~Km0sd@{SBU$<7&BLEn&he)iGHdkVJD0XS{~ed0;zLtyEoxS) zYoC~Ko!fBmzmvd8Yx06$mZw7HOkDlDHbb>Fr#rRfqJMtXeB!zw2y%KYhkx4J)Ja*C z=wBt-cH^KnL2#x(;G~eY%aV_crZxN&$YCPfxn3}Nx#+%HL3ZS6Hk*G=0ng8?&y%z> z;`A9+5seYXqamAG%EfX<@_4t@Fgx_KVtOl4yN-{_jPE;Rs*>uuA>voll)I*gPNtG4 zFap@z3R=ui47h7%hLvq<2BD0FLu{Lfm&PpZ|ExejMXaa%xfmRZ^;+QmR$$j}o34df ztlNfCg5YI?2+>P+osIpF=*({f$@1jJ{aBza1yH4W->f;6n6FQnqHXU3AWVo7C{Q_GruBq_Iy4U57UEK4BpKn;Xz) zE@N}gZ*T8nQhJFPdX%cVp$n&IIHd4ds1SfdjN#^t^5 zBXq3_A%WE8r0F66zlQ1Zd|;PT@5-H1ihlJ#aTB!gdO4UFoq-QglvIz9`Wr=Xu{{w^ zk%ozN$&reJ^^lo(5bE-3H_`)YfiV0`lj24pKK=ht6kNCwoRZ+=e^r3LKrB_Vc0pn& z+?P8%?4A%!Z(mhZ;S-S#n2SaZx#j2ze%Ot5CgGQOpXV)`OxC{9kH+o{{f7RA!(~lQ zH(LAYDd=>6Z@l}|f0Qty`nocY_RG)522zfLfHOxLpY`1aygO=SSg(U`AHkQ}TfLR@>r@#8)*;jx z&J@c5Lz*0AI(nb}RxFA4gQ<%*jwT^iGA)aCtzPiq9I<6E$4a%dY&4?tP|b056M}CI zC+yN>*Ogb)ZJ&8X0qZPZ!{1HT;umF8Yt{&J=8$4=EO+ChH>wXr4Gt~$EI3MNEV*0G9)E?=Qt4WZ*aKjhg5Q_M+*TKHy)37)CE`WP3-`U4hL7$gE+hgh!r=k0is>d9O6I z8jQN5tc}7sI~hnG4|F1f861qkt_RE zLNV|SpDvS{RG=|+9 zr6V1V!lN6V+OWZmocl^AVWB`p*}s90I;MKss^JN67;5du6^t7u^(UV0_Qcr9C$lp4 zMjV!9$`-ky{3P0FDNYQ>$4%{>Z@m&*g$9F9Ra0XMB8c!&PgM^pL@O49W+w219L-*8 z??;pjr9RTpVk==a^)z^|PmK!&)B-27fF^h;2u<{nSam{iw@@zaUT1uQ*LSza8Or&7 zN&?AyN1wv8e^6N-ABve0NrWN;!VjU>4VkNdW+MG14eZFV{MCQU`{rEPYK@2j$2KCL zop0fm0`)1_n8jIJ!?7HCLfc|{VqA)x>{nzMbCP#R%FaeInh?Z0*>Z+KOg#1I1==`T zvEmq61 z7i?t%5}C{aLytzXuMNcM)QRCGsug$fNo%Yw-X_{d9NgR#UCtKD=?DdAdGle05)dGR z5c5Q(6J1_y$dJ2uM#}4V`K@8L6>kyF@30l zLsvjkupc0z#)g}MvxOJS96ebbGk}rhj@tZtZ|(k_)?Ks)Mad9+R$Z8og_(+_h-(Pm z0iS?$HAg?-i%$>qf}T(`w?G$-UUa;PK{VcT$An6pIun0{4`)<#a*4nx-q2w?mISNS zZs@&;ES1coQLm{Gf(=3_?NPS;R?!xN@2pGtT9~X~`G_>Lq5>X0iE^)=7B`&!$t6^-NNUvFlSzD8buIq}{ zQARVd^dd%b;*dYhRLvmk8y#<=|6yGs9f?ZnfJ5BM`K`_XA}h4kEljI-8cs8HWVY#* zNwB1dvlSaG5N6z$VCGOnXW0jZb{WE#QhcMQoa&G5K++r3L4SIY5GHOOqD(mW7wc$7 z1VcXJ2uVOljO6`LhSca1eAatg_Wm< z;H7rsHMv)vVc%+#m1FRnVLed;`ynorxxTaPY^yvqXz-90VkIDxku93hQUZ~!71#2U zZk^a&5b7DJm@YeUNNV=LssFl9o~W^zh}OVsP(M=GzVtP+dJQp47-mZoU9Uw?SLS|C ztRRs@F*Heag?L88*9stOu1nz<^EtoXDXVi()2+UzHV>%~d$M zG!c7Gm5xOv(JI5JrY@)%Ul~(gSsBE7+K(QAmNNzIxu${=pA{^c&TV#E*Pxa^t|YgF zZ*iKdPkdk=H^w32h|#1#X}ut7!Wxn-$$w{SGo^rwB9v^_6cqhb;k*M6H#%-fp0}LNkg@5_GvVHfx z%hM8<0{fAQt*M}(8|z1|`WO{1 z9nBzP;9R6M@2Z|Rmf}i62#!=f=VE@TWK2W^U-7Q+-6OKv`#+AEt*EGE5uH*H@f#x8AU0)dR!0Y`Q80Pw#U6@-U{Wp#P+b(_FZqllpsM1ZCyYqzB56>YBf z4$SNGWK%fxyrwoD`@yv7!J#y>5pP&RGJeBfz+LR52F+4DgpRtQW>O$6hiaGbQBp8h zWfygQ4lUMMijfDCJ@t~gYLc(HA?r%`q_qzM!$)y_=wESum0_;mDMr6jHu)6q9!&Xh zgV(fUouy#u9R7h|iH{`EN7XupKeWSRCDf&|8WnkO8g8;;7dZjJPeEJ}Sh7`oUziX(xziVQ(p0Uc8LXm*JK!_X9G{<*aw$c?u$x2RF?zV!S9#jkM9CCEiK=Qd~ zP5@ssVO!E`F&UQGe0oOC&~H()+H5bPG`MmImD;(Dg@DpUyN22!2I@aK&~~a!jG5co z|Kwg}6OduaflEalnyg(k^PbuTMGXjxIKToXwA)iLd8)87gh{THnMzre@{z|yp2BrN z;P^q%qO2!_e16*tA@)Jb!iqA$XDQCrJbA2-xrD(iMEV7q{(FF}<_-z%`x`~@H)&hcQHD<7+B^c7y?6$&W{ zpDb_iZlX9IFHJdDbW1V*3b{NNF(x7iGOXxvfPxAX=Z0>hfu2-nt-5X7Fo&% zvP{JY%V_xfAb^oRc;vKV5YUDw@zxSwOl+BM(uM%jee7Wj%;bt ztcRZ0E>^SnMX>~@K0~QqtuLBcnJSUTbTE<@U(;Ta9U-`Rq9NA4^&4V6aLN7cC91%*=hf_b5>*B_4s9 zyr{Vdbe3AR0AtvUR!7_sFzE5@3skVyQVn)g< zZXVP0Q3v-c1GQ>JQ_oC{(axh3c4`^%>@%o2f~g#gMd@n>Be|FW%M75QU-g<94ulF$ zFb1T+YSJ-#=prmEcxD^bEnQmpf08DlXWk+~`$@u#ovV?eqv>c-1W=W$YfZ4Wj&zXt zB*bF84uNe2(6B9-^H9r9zSgAtoe1wcO!#P#fNv-0>6wyxB@(u^a8OMQH*~nw z5|Oq98Nf)kXGW1OYnQT8U7uCb?sq{fjh9q^f`d;$N|}&GE25N1fg^!P$ZJ@Vyd|BE z4U?Dt@4V&MKPt;^kW?V>@9KB;8brVXtbQDGidm8*Zd{iJ`gr;7TD}?9`GNWs+XPkD z0AoBne-jFAH|F&W3smpo9}FzPVhmEW7=!Dtl+K(i(PM(R z!TWLu59A89OB#bJRM?Rcg>$M=LQ&Sts1<8p;E0$h#u6aV;7>0tDgx;5ELT`y_jdt+ z;)`?IpXMZiS`V~7*9kA|?hhPYUY41)WnqzeW(AIz@=!SZkzreS0g`r@wZqSe7O9Zw z-^0ag)TnZz@eT(~!>PeZIR>^7dbys~cd(V!7`BUtCiN>J_eL~N%#cySlJlG^<*Ev@ zzCxE1kL)T<>9D@oXQ&}d#@%;DJ#}SLi(ciqjGTXu07Q)w?!Kjsw`#Qk;0ojh} zr}!eE=Xl*gw!2s*M&Yk$o53D#6$@60NTKE|S%CayQKMTqkT?hH^EYrK-Q$*lxSOND z+WdN01p@O+H5qMISiBG*`2bUVtwC+2(4JV~@;g&1jv3AbEvD~#{#B;+Q&^X#n1wEg zcf;i*B-e9Mr)_8D z$Oy8PyyA*ok`vKPBb`bO&DsCu_=TH-F?9~G8$5}jwU!-_Eve39TupxRw0%|gB^MZ3 ziZr}YG2<6i&y-wx$>%SlQZrkq2%-DV(D*VR#bMp7*T*;1q@Ip!i^;oyj>lxuwmK4; z)L#;69VFyCIS!x!^gmC_1mC734Um`c+p;;Sn&ot7L+t`YeERUYcCj6k`Ty!-sLy^W z#Vcp7UrwUYHcy&3EE(mI9QE(nf?LPELE@_*R4xnl5mVO9`-ZM0O1a$seQb$e$uxJ) zlp%vI&r*{0kj`5fm|BBH8YjVAjYA|&p9>N%!jiU@PMe$2C9Y2pF;|HOQzt?#Y?I4? zFvBtkb19iYBbH&N*j@0pNjThC-ntm9D?SO3+KiWkjF(S}kiujs=ghYh+T~IR6QHlE z`+ML&H7bi2n~>hVl{16|7#b28H2@@zW@<$mYB1yubcqbYnRH8i>g5^a?QAsyYss@d zWDGUR)+^)+VmmMlXO6gOIr*oUNYEJysYS_MK&%U5 zNIiSTKFYcezlUn?h#QQFKx~yhm~_MYPB<(44E(yW!nH~))fROyc?Vc#>Dn~hoSu{X zCq_?(osW*%x&JaB1QK)3icL#x-Hsz&jXE=D1FJ(}F9h-X*bow3`a{$7`6-rY%}|BU z%fy*D25J?Wu7BqhfA1FY*X?FHU5m?^`r`KnMu1+~8QcD6i8nAWA?@%k)g`v%LZlS3s|#kZ zMo%P%yQo%ZYCcLfPclMJ&!X)K-G`X~4eB?fy!GpYd4Bx%?pQqB5KLXgT+1)E>cu;2 z+J*{wWm!4>n z%Jg~{xW4!~shdzg#<rMLfW&`JUM4!4%u~|SV@v#lsgkF z>hYEO=Ry~=xXQH0x7xzkPkHJnHqk|;H^KJY@*^-$Var!yUn3Z;T3m9a1j^n#WibUD^^WS*07cGg51thK<5#lgKMo10e zz?s(MS~HGH&>mA}+iu;*^PlpTC)u-GKGDb0l?(G(-I%YRSG;j=t9X##{IZXV!aI6m0@TT{-n3Z zD4zej0_4OPqRt*N*%QYt3Ap-#8q%s(hrvo`64+nEs()JG;4Zg74@=zNQWIV-k(ef^GAfqZ#NbOSQ$WzD^N>f@Mh3C63{5DfIGxv#w zmL+_yy#JR3*J^V0j3c?rkPH-x?A_3b-6HNqOwdH>){egJ!;n-bz+@pPR<|*qvniJ2 ziMI%9;jIj@ z5!8v;)65K15t`A~l0mVC0^}q@VF{wY9DDCX1n4ppDU(LoTeP|?Ls{8C;mO#YWVG9o z)UFz?lix^&Ye#qYNFXoXjKW{65ojo23>@~ms`GfS`3i5TH4=iGpp$0$_|^#+muBzA$BmsDbF+4+ z9XOj|4~oE+40W#l0o*w`h=P~WVApgvEdgR$;YNF0y$h*^4m;YI5J#B9mfir*)*5jB zJe*1DD8S&#gw>-f{MK9zlIeZQt9RF6N}hGf=G}n8x4l00e{(t8T8KW|#}69f7wjq_ zeUmVwKK|nH2i7%Nj)OA;T*~H)<$w3vsM&imJ%?0gpf?=m)^>d>vHvfU*$Agv8gBna z1D5f}P|-?916Jg~H*rL^hf8Z|Yjbo!1B4yVk3f#j@bq$MxZbB9g6-Z!nM_LQakLF@ zzjd4(mKk^cS}EuYppy=#vqhJl8xQ39{6*((5ny*VL&kMrYCZoGM`Fjn1Jp7(-DHLK zX5C$Xn&lc_a6rb+{=^M)L&hu&q9MSVwlSnq_1S)`d^lmufHKSn?| z;KOzzXe`&7ac75y)N*WY#gQXWWQfN-r)sye@IUlu^9u3`fznqX-6L{qQ)HM)WxnN# zYW<=00q6^4(~_uHK<`HFwR?1mM9(zlzscva60pIAoN#5@wJJC292b=0IBDl z+JrmV5EES;MXI6%wabpe))Vajl*8_E40=RS4SSY+gXO7hyCx!i3L~%JyNX6S zJoYjQC8X*#I5m?kBQu6AmwsPRj)(W+K8Wi`I|BwmQU<(k*xhDd+kq!;f**5L`04P! zn@)^~?H6}-R77H{6c%~w9iZg(mkO%nVNWY_RyGa;S6AWd6i_nc(Yy&Fz$v86cdlkm z95E3I5Q;1z1p%oSd{K(r5m)AHx!(7JnWWFSq~A3lVBI#lCGMgOZ1yv$zWnbCehyI$%Zr_Ic&!il{xwfLw2r0NBJU+X;Ja|pFuyDTFTm& zP&@$h7kPt=dijHqWLN?6e*%Nqn_Zu1DS?4X_e&&ijsKIJylL=@(+}Z?Tq*T@+GNH)j z=ByVPG-3pGq$|Q*k*~bMhS-$7ODxGu5v*;IzgLXTBs)@^NX_9g65*m+elQXi6n=_l>E+aS(R=^;x+)7Na+Ds_eze zhV50y!*3W?2foPF;i+D&^?y%BxDy_%EC~kKd?Iu_Z{!5u7cioqTvSI799I+_JICZa z_Tv%4(Q~IMT9QMl)4~+NA%>VYK7{kZ8#8qqv6EF@^mTPZL-#0-<#L}I_P?R6S3JxR zocKh?@e?WnStf;){+FDfX_v+lCFnYNB#S?=xs#pACM}7Dgt6? zf_bX@o^!L~8$y;CT#9(;`#aLrUxE5wsTjL7pON?gF57SEy;q1vUf1-8bA-tmato2_ z@Cmwit<8NqGvZWo`R*RL5in$%!mqSOetW!|{9C~u>d-0FC>feC5$cme)-&B%`OAN{ zncWJ8G$293kudzVZu3yQ+Y>uS!^)I9-})<3MeSX8108%YSOV2v{~70kD|$FWWY=j| ztANjOqrU_Z%yW$3q6Tj+hHYEKC9V&5KL^#H1Mg|pL?uJRt-SP1DbB#70#F==#4e=|K89u2%SfHKo z`f-HWpFBStyK_^)j}?XE+ouFAoqS3Da5EV?6KzSy>pAAGQ{c{a@T1vBD(!?}cYs-$ zSAwWKzEf5NjY&m0$Ph!4`SN!`-CM&|ac%dv;Iv$!&}&ir(Gqygl$`PugCVw9L#PE< zd!K*fE4?qIKG(V0(b@b#ZOUjANpciInIPXwqxIe%oI=pgY+(iPY&Vv1hXWk9!zZu6 z1NSYE9x{Pkce-Onoo7ISKSV;forh$gkL^r6?I&!U&}McP1?W=b$#JB08`C^5K{<&Q8u9zi;#&d{il`YOv1S?p#b3dK_Gbn=GC)B?0Xs*4 zzCJ>2wqV?oB%&t(%S4O2H_4U6!D+`qNvA`0amaxdtL%u3~fo42B0IMfKlU}yzkun?;lOGX=q)v0D zVQ??~OX7IQIam$m#`TAjHE|t@Fi2{SMV%H}&b*<=+xZtPmZ0KiflrMlb_f9$FXtza z=Xp#LT_9{wj*=yWh0Q4J9BaPe%m*gNI9(!cieje-{UT`q!!S%~qtT}}F~>iu+^qf* zsi?bsO(Yci$LN8*%!xdoIh)dj{8jN_Og?C6z zBcnV?m7~TCm!yOb>%a8dz4o})`M>v03Q^?@m2Bw#bXgADCz*JAU0#enGJ#SonRes( zo$vj^U`28gCeQcm9rdVbc#;m7y@m8(>u$q;kfso>qA}bHVsG_&_@0p0*vFAkjVoA{_!(SoMxVH))Uopz5?fK#e zZRuF3lYdH?3cW9X+>+FiKITK@KoeHF-!CQR{CKdn|6g~=oBfF$q0GZko(RL|FJcx#A-n zY+5CBMyxd>FK0k#K#^9SzkF<>PDFvnmq5QHQMe>lH7BZ6m{rpe%h(+jxTHr+-eBz@ z6j0g0x^9Cn^(Thepxp~Dwp}&cf1P8)mC{Mk&e|>_)L6GKc6#IVxss>g0fYb?MZ7A-pZD4WWIw~$- zMrCCcF6F1gGbA22#^!PEU=&L4&7(6Xk@Ec*bGI`|c#Gg9qB3IZ+5<{3wX%xRgMo0O zzZHJ5XqbJ2Cr$Y5F@gLjcStk}VW!rgQbJ2YS>cHPl z`~UrKTuZdVM55l;!vkm9pJ4U=1vqhhtgLxWs6dZ)kWJYQ40%jf+!fNM&8^a6O=;}dHX$G1H z$MO0_0|I1Hm@K{saB+jh?26cPck%UP9keD3WKt5*A`xV|KwKJ~$F1T>XzcBw(3s(F zb%%?|3a^-KtS*e;RIDfL*zCPI7VT53c(pl-bfa1DrlWMy!s_k^PqPI&vj?v9vbFjL zDL*=BoSjiUx{B_aOt?B*;bt;GM1zxrrZKGEI|~=93oLE{Fldypb4fr4rQ>2^C@yqv z;9*f3PP8v!WKhcA-1PkmWYB*`ta1M(`|6)I~ zgPoz4J3y&$f`*>eP*@@d4U#Jcu`rM$2<1ch4H%w3g#Z$w0m-M(y)cX1Kt22uvd}g6 z9P=~tSRQQ0Ypt5qZE$fkql<-cf#q`2eM44pp3r|J+zyziyr}4#FH>%PP!QiN- z@>P&f*CDHM9IqxWLLn0i<*9J-MtS!r9*xrV)e$^wJOxj>PpVeINufei&?#J>oyYv# z6h_NKVJDSPSe_`pwMgYLi|N@#tX@rn)Flk%^%oFzAOxuwZlf?a7^g~`(NuH@Ug0Td zCb2&;GlRvumywth1UnMio?fTXyEu-=^NV;mIZk1XqV`xE#3a%WUA%^xk~k>s?1be; zPAUbMA9d!9hY9a(k_`wpWt($mLsZ{0QcvkoiDoUQ0f;_L$A2suU#jMYdAO9k&LO1Vr(hm>u|6#ngCOOuH15lL)^8j(mA zi=~h&DGekXWjnsTl{Dax*wQ1WJW#k2Dc!HyTFOIVF;|D8U4GMVTzawMiw`fhfKN4-6Dh1ATfF)EjJtCu11PiMk3c%7WNLzjiarM6%q%?ED>m( zdW`yXUm6%}xl?4W6X|}DNF?0Pmh!MAN891E_3sjv50+l3LMU&RF6RBlR^F5@iOlAL zk(C9NH%mWrW68=>%;Kl|Vf8KCD`tmS*){?zg|cAzauDi>{m#;>+HxZ)VHyI)}sIa5x;!FR&xh*@>gfjo)53{a=Uq2xq>;_xkNKLB)hR z4IXxU!G8oh?KJLuC!T$^fk)MOa3%5kH#-37|1wO3cXoE--~avJ@h|`KFFX9}zy2%c z=jXXd=WsY24u`|}1@@;%{~v-zXN1XQfLdu=HnP_}pDWB`k5;Sw85)gd&-*zX4u`|x za5(SbBK^OZ|E`-TS-w8SUiWi291e%W;c(u=MLLJW;cz${4u`YP*b(U*4u`|xa5x+e dXTR_O|34|Nowj%a<`Dn@002ovPDHLkV1m}q$(R5D diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/quarantine-interfaceindex1.png b/windows/security/operating-system-security/network-security/windows-firewall/images/quarantine-interfaceindex1.png deleted file mode 100644 index d6679e1e0e616b1430d006fbb2bd90d59b42f5d4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 79691 zcmcG#Wmp`|);1a(0>NE_ySs)`Gh9D+k|cZcAEyF2qe``i0H=iTT3 z`O)1~SC{tcTD4Z)>yA`bl>YLW@bjlnpT5Y-NT`1L1QYsCIu#NApZm{NDV~2GP_C-d zfKN43#K-?+U@gTI#6Eqhk4JtphWjUv#q8-ii`WqUx23fi0&**05ht(ZZ+tS{^3QJwAv z=cDQ)JKq>Xo{Ud?ceEoBs|iBcW9eu~5fVI4r7EE;IQ!Mw1}j_E?!V^ZMYMNE8ydww znNY?Cg$x3$swwR%nrLD8;F24z!L;dwQ;2d;blbf=MfS`?MlVNtk7<({^W=WcYw+*5 za!<(R{q)FvxIAk*{{CMx4Mz=|M>I}%8r@2G%aPn}sz`@74UJJyW8^o+9ak+22MdJd zQ%#`DuEv~@t@cSxX4s#0J{(BzlyLa?Ogw~mo*`a>c*vi^zyXu6`ndC;arY|y~wUb6KN!D_u z`XWS)N=pHZm~;?A`4h79bSaiav6Qx-PAv1!*1mm4i}XsU_ z4935{yrq33f%;QLzRIg0NCbIDjq>s|CzU}Oteh_YbH0f-?!@k#KKI4DkgXa8l#;M2 z^-cIVnpi7v(RxR%d7|%G{*YRi4x4IQO9}7290DlKmpM=2>~h(3Q~dw@iDrQE2YGZZ zc*GIhIn^*XYqXV6c>?jLF!g7!<+mIr38ps#V=pzgnesULxKe%k*OS&>85w&hGV)p= zrM=AyJ>Uh!f;?b|EfEF2SpHt?XV!G(S2%W)t^O|x^z-pr7O2z+2hKyF_D~WXXK(R+ zO)mRm(~fIT@FMXDJ?ITT(3#^6BeF(+$c|)=vfd3;ZSLQ0bB@sT_>1t+r4q>YfV98B)q&)UG z3Xe`HuC)(^3cZACSAGIlE3?oKTTyr0iJUIg7XB5G)jgzxs@T$PdtnXQ+N1Csz5g3< zFE=6n%FlC#hxzu%vVVr?wc!;4KcU*vgNNOFZ}WS19$M5LrkCrsyNm;me9b|!iCTa1 z8b=l4S4w(X`6Q!Ap)HE>&&JYx|wA#m%XX`_nkk;>O&U-R|mE=_$?Aysr-jd6F&qP6>v&7 zGcGgx8WHJ$Lg7F=~x| ziT~DY*B(Pj)Ic`B1J1lJ?`OQVPPb*E6G`fV>h;N%`WKw+BE65)mSrORL4%f01z zk|8|vCDN6TB8)3<9k;{BwuyJwk9Q>mF6jFfKw@ttP_(c5^bnLr_kejb|NPeSyz7sU zjv0)JqAfewmC(`sfoda9)7j>5HS^8)SEUnE-h zyIAlRwG1cAE(~P-|6zW^h#xVyx{e<4|x&qFZPd?j1CK)k3Cy}ReY{huGAPV4dQA2q#= zv)WVA0p83C!=!t!O0me~h}-zY#qKji{Ck0D3w`Q?tilb);k9v6?h&wB>ml58%GS;Lju;T_YG+GI-Ne&6~KYigT6^Orn3sGvgHKIk$qrg9@sgo%m6U1@x^RUXd!QjZOFWXnsNEWMm zq-YwQc25by&OpHu(O?iE)h_<@5L_+#;4QmDI2HzM7mK)@Wn%s^Csc>YF1*&9ft z_&{QMxwP!HUxMfToI-Eo;E&*b@#V}Wr!OgeG*fpA`1TVrtQF9bc6|q@*Tj_*RIPiI zezQlf*B>t8MWWG7ib_fr08}zhVUqGiL3ZfOp59RYc1an3>$v3;hv!=wp)^fH$HTrY z2*aLL68!_VO@Vjo5A{#|x0}TRL~E z-Pia%0W~27*Ix++shJ$=8uxeux5q^{6syRio0li4eZ78&ha>R2l!uWZz}H!tb2Oh* zi@fG&c?TS#t6ew+YM7S`OcJ@dSLFl&AVtvMAa@M(%g|8|N(yY0uU5 zhF={bO;34wt_C&($Y-!(_)E+w4ky4w&#tO@stu9>Kb=uCC~n@EmCXgi+pR=5Kl9(p zTm)te8;X7#{=*l*j?NrN4Z<|hT+PhG09XO1Xhb=YdQ2mB>gnyJ`d3d~UG%9`KGfWm z&&fNI_&`hnX|2#FHl_rB-4jf^DEagpVx4lofdzVH&29J+Jyg3tA0}Aa)P+1ec*O9# zMqc_y4)YS{`_4FP>Sx#2oYX#@CjGK1g@?z_bt{PUk8^4E$VugN**ta^fJ-9H(h@h7 zrI03r&=@{lTzcJI(|Q@-iup+CWwLsKi2rTp#|8S7(}og~|84HcY8$U4@P6m*^fJN> zAC~iwWyx^cIZ-HW>V~KBtT(TM1^83)ZKz=ig_j|Fo8Q_ND-T(d2ie??e>+Rd=i$6` zap*Z05-?~BxfB)orqlx~p(r{m^|#6MP9}jE_~*Fv2biB_06@Mj#v;kQ)09S z>*qaVKyEI^Ti-h2um|OxjD}fIiHT_2OptgtU0KQ6PrLqljKir9BO>wnWq*5L{Oj8f z_-p!p_eGG4qu@fO)(hg$;znZ1;m&>O1BvBY zfwww6GY#glVd;#0G~9}4yZu`IPE)zOIV3H5E4%p^XWRNwx~`o()7L9LTvzjg*Zt8J z@1$bSKwpBa?R%Y~$LL)GVz^DynFf5tY`C{M3$W2TK7UJhR(MY! z%rX~Ef`;07EN}I}`=!q4{%XkE+u%o|kgRg(jG~wZE`c>WJ_4~k%A;%Rvdn6Os>^%G z*(zhG6UWGy@8&pKkINUbo>#xkW}4g()}}ejxP#!pcl5xQzYMs^)GBRWBA4x^B##EV z!QQQ)vTb8g$?xdG6-S2hPO2bDA|+G>;LE&4+}fhP=`Elimg4r0l+t|Qs~}=z z*>IImp|-+o-=0Uv(+=(QVF;NHKrI>c&g#Kt#BOruea+hX!!Qt%<9Bb!vMbEXl)t$) zeu^-B^^~H(vJH73-tgPoE8GJjvpoXWTjKU|XfOk*p+(S0>vM{e+Nk0$P0AMLFY%Nt zn-VpZr#ro4)o~9vJntC@8-Q}Z@inqmL-WPh5+|-VnXCyd@?f2zx4K2 zTq>K1DPL3dw)a zL6X+iLUF$xehzdmcC6S)b+(g(lC?$)7xC&%#7LSo+E%hbF>wL|wE#AT#J`!;zXToW zZx6Xuv=Y7<*`yaB)jkXebUAPz%If2CbI+(J{_$G=gmqF;M5l7xcX|s_7YZL>pA9?W zedF3vw5ZSC;tP*Tg3i>e&hMs!$vQHz^OGBjM89rJnK11BX&!wztF7}*sws^$(ccL$ zk})cOT{zzA^bCE#y`Y?GZIW;L31QYuvo_&H3!QsW{Php^=x)`LUV9YrBis8)#p$YF zNRzL;1wpf9Ma)@XE}o}52M~FQ4J4j3N~c zMg^zIw!>IOhoSg~u}pjIQ86=*dXMhW@4To><7j$}g^|Y;njAJqatmbrppb+BP(n#P z!d($3b9{f#!>#j@VUa#!Wy6@{kmq=hD7vqGmej@a5@Iq>zGIf5*6sZv_vrc{UT?Qg zKBS#pZb+ld!2+n~JZ(5H)b<1eS?SB}!}AVpMLXi(Bhzj^ycIv*Y><(3FlRQe$yFcy zvV0+Xo}IG-QQS1}fz#|hD3ZTA{BR;+YHy=21JhoA3()0kN#xom_3vF{;#=$q2V_qf zr@=-8aM@J4Z+tj>NR3=u!uWapB7j0@&dZQjmU!V0y6NtQuvBv9V71yAS>5BzhmWF#nuZn0@~dk%o+Mh*Y}Q)Py{mX7_Anv63+$Jv6duV)*#b4s_?j`ow~z1 zw?Rw}DUX|h(jwR~P3Q4;pBKXqYQy)bS}*Xdw3j4w5k?D?)}x4l{|m;?Th@}gXF)$O zP;@VGI2YV@Ztq3Ctw3MCzoxqt=6=ijwBSiroJUMZWQ)lE;#9_4|BE8CV(R^=VLX!T zw7`}vVvtY9*O#%&)F5U_yU_G(AlYC{0k5A(G(ho=syDBxz(;HP6b%t0g0jcs3o?=4 zS>S;RDhe_`4-vjlL)beO|F5p+?+oI@*2hO_-*hTYCXBOZEsAUwg;*GFZeNOCS7y(t z88#K0CS%0TM)sZ5{H_Q6u1hI?e|$iRygVbU5_0D$8D#a=bmb7QwdYA+2Idrur6gax ze8Jm#=j(atClY#+>fwpiWYhp_ZuO#wo+CR(p&u-QRg5(+N95j3jjqzuV!Xr55a3sv zi^AtTyQ7sB(QYpx0is(U$F}kdhJC}DFJ4DsJaKk^r{=RdBIp?kZ_z||UzCLU9Z5I) zQ;V>YeA7o@{Y2z6naqvPzSi2=6d580y)2bdgeu%$qnvGy*GzpXEtbb+ouc%p%bDzW zC3pxeMx&W$t4(fA&V;Y4O|;3%6g@K;#KCV%@y2g4(&w<7|hvP8PNtnF&C;C=?v- zgt(RN*PYyyPzk-lT)aIVdY7*DwR_eSWU?4+%?&v{() zqoaBz{Qc>(>A4QbW)&Vo=)Pi-9@Jc}W-@AM2`>_^6wPIPL#rqiMk-s&pwKxsk1bXt z0e@>5QzGHU%F6}nD2UvVnVb>{9)VuUXjU_bkIUY*qZ4>V4-&$EhpewOxg)%03KHbF z*{Yq~;{7r=0EpIhKfwE<{x%vh_$FQ&eGq4y&<)aW`w_NZ(Yp5gdIC6!f5Si*5QEnph->3usS9lz&b{V8nHs^)a&34?p@V=TXu*row1_e^DcZV{<$p;YlN|R&T+1I##=o9!`MD+W5zt)K-$0phB-nvpi8ZND|9uSS=t~DE599tU1quU$ z-J)DMs9Wg@rg%oKKE&_7G+mvEZ|(a!x`BK)5uV1xeUZvS@nXks=)B-=3${>IATl`aBJ>%r+ zKy<^^0Hz6m05zY@aqm8pvBsodA#|dKObLpTJn<~j;F|tzQkXaPz#zx*)hsVp#PVUE z@V=3m-o~mHmqsEB(kt|d>AjRZE)g?YV9J)gy`_~|u>Y`c9nOK83^qFw^5~?M<@jw@ zh7%utp4+Y_$|AP7i6ZKCDtp|eki6D1Vwd1!!(nUm${PyD8&*sQb$OBuC8V$887!!k zl%)=kYKQ&mBHsnt=MAe%UZ~@v$)qD^=u^zVlp=`(PH3Zqd%25q%7(>a;}v6I_7#g& zkKozU@|Q(au4tPu!83c^Mv45bQRKP6-c6&rp|wcJ(34S=`|&$9gio)~tLI3RI;HT; zPtK&MKI^?zNW}i+`wS;_?-ITm05h1h;&h<(;m)M5LSz<0954p$(g@EVAaO?-YHQ_{ zEeqrt^lmGLl{&^s>b92V-3Ui@-u?si;HHFx1f-N&lUi&s*?4`LNP|Q>2JWgRWqP`P zJK4#K>jQ|{OAf^F$Lcvx5@$OKP1_K7982E$UH3@c5c3`DX4PJam6_+)p=v}4^z2obw3Xg}q17%ZjQuD0TTO7Sq7*z+= zq#*a;$Q6}%kz#46o?_L>8KQBLhwN0s1GC&=r^aBir0+_LV|qY%!lqg6Xm;7aV3DYQ9 ztsh^n%?`0aq@s$Jr-%=9jQZzAF%j|#aHEJgNv>1yHFh+t%IOUIfy_z#Cfew^<%LPkTIrX{1pZ@Rs6lvzRj?V74k7W} zjmo6~+8vtd*d+B96Dbg}oF81=;*FN|yT!`i)y@p%I@ik=?dC-7@w%++H!ws0%zKBP zwEL1gH^3XOYnM}K4+bC=KYQ3@gv(E?nD$#aJ+mGi$DCGpX-LA6k@>wyUNH<$Plfj} z*eoF>kJ34{9|Sk8ZeIj{&;Y3a=kQ_ug- z1Fo3GB?XpF3TX-eFk)u+K=Kd>*G4<7k>=-(x81Y zJ;p!1=Kun-_s(A4wVp?(P--AIT2D)OBICmj-=#V?h*=DcIEaqcTcS-5uunqWN}?zh zPqH@)cnkuslsef}Cfp$}{M|1ZXwK)EKD(g_p;SlN0t)~>52G{w(2 zEj!lUDO->;jJUGe-6>YT5VC+B(j{i5-qPSHnQz4><%rs5S|MV`6v9~zyHYhTS3TDy zfv;R-ZRZq~^MwnRAMEQPYp;$rC)p2Lzke*4z6||PadUpMuFnW;3-`SUAnVD~8-{ee zLnjqc{YnlFQ8n;;R%P*h^ra{9`Wa5@l_Ca`Y$SoZZ;MY@RgCdzKg^}7Z_P#V{e|A` zgw9X&U7il1i!@Q}tl!~!cB>&}dgEH{;{C?syQGn86ztn|y*kVHKV61xIffr^4gnCy z+tDxI>uJN-ben%!xH)59CvW{sr#jGgMiPDAe|?^uzSu@E>vzhCYUr8nP$vh9%P05PCeA5K}k)cUb0kp||SSr<+>FP@`3KrCzKV8f>iVk}+o$)u%bhe)U(ufTJ^_~6$lhZ$GwQ_P zGb(6MNX&@)j_gUMvQZ0WPNMvMw!p>PoA1+Nyu+bjo_60~^^Wf-1VFc^CQiVbfRSQp zlQEL*lK#M2GoJJ8AdoIL9v9l}ceI6=qRM$`X~&d^ZnJHx@~Q;u4#a|7Al1qiMQ0IN zr^|x*ltn17WU&HPe^)T2Q&lu1fgtTEh5gu+<`%YE&~U$bk{P8c3s;2PWzM6L>{&yw z9p_p775+G@B6&h*s2#Wj?8d9BERdJUU!bwV48{-Npz$9(|5HW^QV_pqyf)>D&RHn* zNzL^nKV|toy%zSIu21ueomMswcZ7cojjpFMhXqpJgPRotWkN<#<|}8Wo&&rqQZKHM zb;B@?rEc*+I@GU=i)Imum&Bom4ZDhrG86hV?IgOfLAjQ`Lwr(T`EA2I`*%>|w@`fk zD~_%A5pKOY2jMh*PsT03jo~QWt-(Rp+q#@Ni+>}&!|OO00K}E{vY%Y7`v zXYzQ*)30CmsxuAt?pvJ&Xb8y8jb0BX?fAK5v#?U+O; zk+ef)oX3|7;>U#rAnK-(;qwYoX5R#sms`=pKKrX;u1SkFDzKdBrxy2 zfw3>r`R0(-@P(XyguI5+r>g-i3ekqsVX02yI$=*v^zm?hRg_sn-RBzfq4K+;=aXP( zEU0UOVCgU;Lgi<{`*_O97_7aKMAJ{$P`ba+r>&SUe}(-zHnSX*YuX)RFM#GkGLkz0 zoo`I$j+z~)YbvL6NGP>XREX)poOj+8DY-l%T<#bKK2a={T<&a+Gc^5C40%Z&p3yYe zIHu^S$nBKx@W}C*iw}Uf&WS+AJPnBR9rk@Rmo1|cFu4>-3Z7f@`bud|Y&kN7 z{6a~?b$yc zgF(v-K;NaZQc}B&9u55cMpNUnOfo?h`13Mw53h5R8CH2wBN6=`Rl|-Ub~*3|nxUci zx<91%u*aDUL0WI;vABuDLJSqQBvuf$Y2H}gxoRy|6QwXI~cOPm3N+&udAZt1l%w!_Maq8+&b?kd1f;kVV@`!75?)@ z%Rgki_Fc)L`!pb+u|8a7{7x8$QVN2Iu;x!yT&k*q9X80&@bG0$_`v8gB;NUv1Tw0z z92mk_`@xW=2SE;SrRx0Ky$0>#AA?TB{;l-ySU^87W$+wN0J~oNNP+(*Kv?IR;ig8W zI4Ci-|LyD+GPuYakYy`+Lx<*gvW$y6Tl$axq^wlFa7g!7sAi0@hGo}w$Hd3qOL;g% zv%(%t%B4@2q31v&=(E!1&${(|)Y5tYKRcXaxR)syFs@{9g4=-zl9P1NaIguY%X33X zqXjfra_3s)HpoT;H<-Y<%hwmSoU1R@klpsI?m>mTfVe{ep_R$XQYadI1CBA*(YSis zya8pU_QeH@fm-EjLTg&amHmJ|RM zre50ntX|p+T%g5A;V*n+$LF#~DWAP~lF7*{I+c2evM>qvyi6w{pYy8*q(EY76N3~F z`UoNNeu(Uf+yOu?%2>o z-9!UF=1tGeZmoEO6^{U5%pR`lXtt@Zi2}tkEp$p7PHMKc!r!aq2X`tP{ZO7GKB(4KXmf@Zx52=xXKtG&5sQIrb}kQ!z_TR>MCpt}Y=dD@h2e!ktk+ zG96aa<>SFu=)XUu=jG>XcgE5$R@2my*53o9E`d#xzK+--vT^Slxr|NyWvnT6IwCMw z<)sj-soSk|?<_M;8YWxmvr>khAL8apA-pPCZgg8!J;Bl^UT+EMV#cC6)KbyRkd*fm z(uhv0FK7DsV86cVUY?U)S;D0AJ^c9!S*Tky^OiMN+FKnVUZ^W;=Nl8X!fgff6gekl z>|HjB>RuuKW=|w@wW;>P0$oLQC@=;tDQrRA_>3Q5JKdU4gfez=8fFGYf>NO777Pj9 zrW!^i&G#Rn7t2YQRK`SR(UWK2=)78iUt8$#5o=7Sqo_Qwp&y?nr({+Evr_ag4wjN2 z5M1!l8o1(mb<*SX?D7bsQ3a zewC>!Ki8!SwyPq8tD3HeV{vlx@S)CjVyM%5znDhnTGu4>%u+e|(?+3qT4uW~I%Z13 zbhB2f5g|%~N~&zZQDO5|HQYRdmq&DOXpeJwurWDDsnzEbWa|;0*~X68^YCo222R6M z9|g*Ae53biz}j1zUMmxxL#Cj*pE-Bkg|4V0#iqk(*Ctu{ARug6;U-Bm=qLW6bH_ur*nE0F$H2w4GQ0*ebrc zk>4MoCF$gf86=0BzJu`XETXDx=%-uQF_hIJK(d$}_(WNKSZQO0rGAAu;%6&c)1l}X z_aB>fc*gRqI3_uAui^+R!Uwp~T9cL(Qg-g60`(!iEbTC1Ou8Itwo~yX_T$C|D+^*| zD(X2})5M^#bg)F!*qkhP2SKunKcGCCfq{-SqSwC8R$wZEn}dhkY?g#Z+%iN?6-@IL ztc$^OjQUOHwCL`m;}M z4DQs(+CL1+qWhvrnyaW}#1u7$1XVa?RitDVfjCA+Vg@P9My#fb^S@@@J$-`F7ru+< z|H_hhcjvY%8UOGkfjNjq04*ZaEo+Tzo<{)Kl-DjSl$DpE>cyQYO{^j(XQ_(#D?cmg z%uip49DYQx2FB^&N=VNY|6Uk0d%^Rw%VW0$Vm?HeespR+U{9&=rl|_RUIG(;zC|7d zqRcIC4*q#U7l}Ti;KisdjrPJ!VL>q%`b%EeSed@8uGlv~zPU0pA)$wgQ$irovG5vh zKweC{zKm4Yn1x#B7}c8=kG;J z(kpagGe$?pLM%J(mme<&eJx$C3; zuGd@>5YpZ|f0B-?cO5oXK&?XOa)hWnT#5uUwk1g(=1KcoBqw~Ml_FQ)9}UP{U)V*0 zN@|$DZn8HG3>Ob(udvl4^ad33*xMS92$Kh8=S1-@VoJOo3$({?ysi_R@K4R+Hd7e< zczVN(J;SE);%nNWHdvzqk8!g=eWxLC7C-ZK=aqgyGiFv840J=7zC5Qgn=;xQOsi|H zOfM|NjN<%tcjosKAy+t5iSo}5A)^ZkK2b`9KY#RReK#J@owzZ}+y%=3d;USmFtat9 zmDeF#yVd2`rXOrLNM0ec*h@>sm);?Vo=q}eadHK+z6*s@SEbG?8%QL=Ho+|^<_0|R zKOkK%LCaX5%9688-O1T7d@hMa9zk)x9V!U$W4Tvc$F8_XPS^eZO+}2fLPg}|1tC2- znE3*u-AC&B^CoaK z1{laEjpf*YbdsaPRpFxV-)hGAtU)f~QdqO~Jii?w3wa`cw31;$3PIS}E*?cAYG|QM0)Q9xZVo;g%pq zmMkUjzMC<^jbu@P;KXsM#I{7~1I*IiPeUUt5Treh{+s^L+ z)l`C5OSkk8d(<;oByHmNGr^VG>hAc@OR;W*|r#-VUPZO_0bF`wI8&Q)!`F8{y@t~Pn_DoW65Ki2YcKetby++!|c59$iNewct}5hN0?7a>Uwy3Ns?G4$hmz8 zP)vtulN{i7h2Ax%MU(Bo#C}|yUW!jh&`(yOSsDzv26olEVGlZ;!sYZnmt zdJ!1al>^Ftudn}4Ea!t5xc@E>$^Ug75;kZ-4t53p5b#Y<56aX5s$C-5&=-6aX$BN4 zAr9-}D=lK7gBIiT{b%&2(BR%(x`-kT`(9n*R_z8&P+5};6|4nulET@Gl1gr)*gein zPlHJPa1%%A8mulS@!5f2EjVDQ9P?lsF=J$$On5@erYdltW5vi=?5{)7EwV^V{}gqJ z7hU*N(W`s7%IF?_J0~;~WsqaWr)YSA0obLW*irmZqSNJDW~TaF?zjIG3Jms237QKz zn!&a0tvQoZVD<2EehFR!b>nwrx|G}L9Ls)}Idhw%%oyXgIOg4{2xTbJNw{4&BtJXJ z5m|I-sNL+jYkilO6-@uNBlJ!Yp7}xh6Yy*CtN*vrD%p}z^GMt|Yc+d1b@4R|)w$;R zk~j}*@#dOj0oJcRZj}`^yV$=htUc=;FWn#lI4AE$9T+_efu&4Ag-tZpc~AJ}yeB!z zvRbjFU|fBx%kNRy?Ch#Fca+VSAfaqkgp^pHO7oUz`$)xPc^efP?sv^<%-5Dbbp9j1 zMnaOy6t>h~Q0TVMfBU<`D4a*9Sn=X4RM=FuYkD?YpPNOkIIqOZ_wfGOY}Vi%QjZeQ z5w1{I^GktNH;{|x+dJqp>m$TPx27HMxg4jQdZ?d zFN&Fg$#`sIQ>IgsN3V7pvh#vpVrbj_&7-e9q1{F;k+MC(^u+&~Z8Wb0*}NvHOm@HO zrTyTCI!~h;d-Wlrx=7`P4GIT=1R8_kx%zC`h@<*&acsX<9@1E@or$f=&Ib#}tI%%v zUz^H@NSFUaVYF~AgdcMQo~j-F)!>2rg>a`k0|ezkhW3g2Ve=P-JxEP(Knrtp8n{G~ zpwu3_GSa*+%_q6km{ygZ+UiDFN!x0|J9E%nk=W`h#pl4aQK+Q8ySAjX&&pIi87ty& z)STW5m$vjL4EIV;T72xPn)r?G&Mv}=BiOmAZa40P;P%EO5~N^kvH8uwh2U{e?c!KU zK3zp?qNGCe!UC?bKxd+Ku3uPD5eu{Syc4{Bw(NAKB1Ml<(rMFazmIYS?IGb$0gZ;` zfNa0jvv#@M`Omqr8LoZps;_~OISPBl?Q{}1vo1?u0ogj4*X%!|(H+^j0Sp#5g3U3j z`?(DB70+YOw0Fd9ib+aoTI4R(9^vEW8L5)eSw_iy8u|r`N3nC zQTIgKetTL-o-Ey$%6BDJ;EtIghN8ym1h{0Bzv{2f`%?_ZsJkW39`i0(sEj?wQ6io* zEc8)hH`0W1m?FJ8ZT?n-+>!5G?p)hm$1l%RLv%o0+Px21Z7cP#MC5H38*o;+x`T>2!)&vuMXJ&<*B9k`^*4 zRS#Cf=w*hG($e7QeY%LFz&rS~$$qK1j65Ir=E@2=svJeBOH*IK-+kn=)N%_x*WVd= zcvvrS(2OEstFbn#`$0WB8Ny$y)vg>C4#{l~yDtxz?v~<_6%68Ro<4I0`>bj`zjO0} zaxGn!%(8O=d>xf0D|kr)*jnr!398@E-x> zCOFd6j$Cjlc7I5m9J@@`R3#lRWLxY_nA2z5@y_38xgS*Q=O(+sXG~EK>4uIy-Z3Z9 zH7mc;qRYmgg|YijRvhNiU&;h;FTBrVw9z#1644$KY+CF!-HkYZDJvc2iB*daZ^@9b zhrlYX#uw)`NhV<{0tKnJICEYtln=8lu>K$Nk2F38;3*J_BVqi1<5FZI@Y3biJL6`sH z`CMxjVD&*x)48eT0y)b6LooZ7wBveU1;`ivcWZGi^lpIvT?CcHQSB&H`G2@;|F`mH z=?qfAf6>J{6$-Eb|HWhS$^y`a{`V+&!W0qzi>tP0|2YT!xF1QP%Y6I2&xu4aENTKdI0 z+^Dz^h!uh6E<0TY2i%%o_rovDlV)@q)K}J&BHKX(UJ0)0tFxW8%`tA;adIo_>=*loA-j z1FK4llTS}Vm!p(s8WlxdRh+vvC&YnSge2>$)c(eKj~a#|F<7RioGq=I3{^WHVtC&W zn4T}-7LgKq)w#v7XzBXp0{&`gui9$lHVn( zf;DOHX+!A+BG39b#(>cyO0m6{SQ*9oed*l~5*s)fi#JLB=MitHpb?qPKsfma2@cLd z8kB&)4(3>u*>w|~S=o^EkQE)|#j@D^b%THP}tn zjKd!zn50FP_Ac6yxG0$sK-RCKf~X<3dUgl3mz0pQe7|QVe>%pOErZLt9zK0V>TYU= zM7zjpPAvPU9G1=xqt+mZRQ3gy;_u_0rErDA`^UvsJATS60VcTYMnrz4So_gujRkdV zP+mqTGuUEbCqskvSX>O59u7wxhZZY4d*I%4m!NEvSo0`m0utf8dl^d&OwIlpDrJhz zuff=M{JyMuWN*3EP1;FQq%OmN$7KR!GT%Hw*6wIeJc;`J854l==($r@tfs9lXB>dK zy1KfSii1FjHPv&3+R5?V_Fl5{u;KgL`LH!vCWVzB7UdIT{sk%(cu`s9yNrQi>IhM) zAm^I&W%+6LK0U$YgV!77ckEA;|H z=%YuAzYMU(%K)kru%74Q#1aR|hg&bTs@rH9^zI+B8X35Yd=%h5xW|~{b|^2yy<2cp zX*u;*rzw-3m+oofVL|xB+&ec4pg-Au9>m$lwvgH*%}WX>5HO+=4o;YrcU#4*(O#C> zl_0YhHhn7dmmP`M@>{J0E;mw5D%ra7g61M2w8YKAT{3S8=*2?&A!g(9v{Tzg1MC|x z5FdO6B=y?X7@}I;DF6J})Hq{5c%<=jBJQ)Tb-@+K`TRAd;dKQNX9n-E{#dl5m!5IQHJq)o-Ft=G;_d%1WO`Qr`>_rh8`pUjr?yn!rHDl^J_}C zCN$1_++h{&EK2g0s4-Qf2p5iio|HtuuhA+vsl#BxbtZPenmJPpcQk4!8*u(jf5^~% zZ^jB(&=QqniXgl`LqN8M6m0sQsh3y`Lr=W%C=UX69B^avx6QUAcFN;Rr7@Pd& z5;a$Z#7Etp)NFK7O@YmUnYJ__C<?$k1+!2N5;Rb+gLELOY!!DSfCAvN*EotPmpgiY&OTPRXEqs-={xE{!WRnv&2@T z?G1ErU|BU$qJe}S5Pcx%J!b(DVO`akRtHmx@udkeK2O{jGYsLX=Be~k^BPXys0wa` z>k_E?YYtWSkTOVdCZ?-N=y+!gfONp%gG6I3|GrqmmmjlsG}U!UD5uz_ipLR-7z}Z7 za#Iwdlt^kbvATYDTPVk7Qa}^}IO^n7>_plRMp{~Z6MGngde^+05KEPCD|AzJAxY#V zm+NOnK1W%YicKCK62h5mp!OoU--R~r=9`$vTO0%Y@AI9ftF19kiD4+L>tk>1w9jZs z^+M9S4>9SVK#Kp6|27Vi`vg9l=*7tUG`~Y)`6AH?V{lEd{y6}UH+fqLKy5`wJe#vU8m*1rsl=38uHtjxD=27e_T+vGO`yg~#y@XP$2? z+DjBai`7O4{T6SEg_9j;{<_kUmQ!tt0iZ+7h>)G4V&x60xY*-rd0_J%BS|~vP@>oD zk8GOXpDWl?4-F=jhqLv*>?qk{nKm}M6l)*Orrq*SBV$mGAFH;IRe-;Eut4>Ul|n3d z!~47)JznA*Ang5N@IZWIWWqz9{d@RolSv}ZRu??Olq~~dcCjP0lm~qxx4rj$UJ;xs zl85hUxRGN3-b7~ESSSsffr~-4!e1KW^O79c)?~)U$Qf5JUmD*Fb%8U(!tI@U8b}j>}2#~t|gf|b~id9nF2x^)x`WFvNqS4ES+9Z z1ierK-`A}LJrYdS>XY{eX18Yh>Mv9Xbb|pC2hQ`-Tm4~!s1Iky1NMsMs~w_KB!_tH z^{?)zUwmb%zxT#28%nONXnMGL)n#K}cSrikC?~UrYaFuDta>Ko2%>Rrvn6J4jhMG= zjJ;5&VB@K?IjT@nN5cCE`rv!ydT-}eBR6tq-d?`YXbp7ss`>Wwjwym9rnHu`Wy5y% z5}94(-_el=G4uz*@VGEM-_jSh$cy%}D7PP#>%iYx^c!Ptm-PE8+Xe~A{|^9nK#0GL za`&;nZTO@-rpuj1DBvTZcpjHtyp~*J567g>_)fpqGE3&jff-EK;nZ|>x7;iN(;UuQ zJCB(DS9$1<5AotQ8CQBoaY-TS)U)S1jp_8$PdIUHBuz-Y*U-efK79`t6_2rfM+bqp zJkEd52f1cWB7+BZ(C$#zX&0Y-tso?QB)MWKSFB%6TA-U_J>#e7Le8K5JAJ*jAAt~H zTXZU=^+kj_ce7+7g0h@x9!kg-ue zS#wsgpbR>8Zlq<*BDQ$ud}ri6OSx}VrvFh08H_8aXQ9MzH!ZKGu%e2p(roO$LE1Zq za0gW#&QaIt{WGP_;4If_I9J-q<<6WTel9wrgez{pm$}|odF6-`t9d$A{S}*uNhY@- z3$vq_qlb<&;y(FK$%%X;2Tp-1?L?W1s2GSzt>nBbFK5k)c~lEwsjR7^$kM~!mOgFv zfz2Mr>RUg_%IJM;Y95Q^ax$jNosFQ+OV+&0xnWHmq49RQhMZ@Zf*FxV+aia~0rgZZ zD!!QWZn%xB*Dau;AfM`{xzrS;6YTG2aBLD!ehs;$rf$GD(iJ5ttlfN{m(A$+IVAQczq*epVWp<#U*q z2S>N<<=Bt|b4)y$1!WZGW|5f|k5wGK%OwMKR1(?w`DDf!a5`NCO?K_BLUxi3|Kt=N zWm#u|QG&(sjstAn@FM=&cTm&)Q$F*Z2Y7vdFX~}~Me@!mDke4BN_ue-*{MlH8v}TR zl-ZK9D646psjiA-n;)0oOk!NLjKp4T`jdJn9G_7{p%}8dyO@z|!!sfBsN3M;#Nx9= z2l4VdxtQ{T9MY3xG5aUOcf93lUqU5oE-NRrV>7RAI>xBqhfhW#RU2z`JXr;$nl3Uj z60u9z;8s&KwMv;a*-8ov$j#1@eB-eMU1E$PQ%H2Ih<;J2cGoy7EtZhmHFMW96tGZx z-TPS5{|K8?R#V>lA{)ECVZ)PaeO?d7ge=O7^YL}?BLTnI5n7+03D% z$LUi~g(cHzyNu5)qNpHGbdfJUoLdFAC4WT%snnN3QZg@AKJ>`H>F zztOOD{4*k?x)~)G+`v*x3vJdcVn>c}w0lHsD(noS;#0^e4BrXOE~%t8*T%r%gB+G~ zh>9Uid|Y8(HW~S4G}Pu3HPXt?eQmg6q<^HvV2Mj1J2#&^=|ib@Ax;i=$s z;KL(nUVn(>+BK|+JIH_j__sXu+)HfOxP^V~4mWa&4VS=l5?u$h#fM^=jT?Wqa8mN?RL^GGmE(tb$l-_gsM_~UTD3gP!S z@mZ58FE1m;(Zh_5E4l*Zx&285`G389e5>_#qKl1Hrgh~6y+ z7_*jf!6ntiit;;mZek#>~?%=G9kVada_C3VA6}c->PtTn5q#%gKy(Yftw41`E+? z(jF;RoRcm@&6uJRsa?K;`h;;diJtfODY9o0|5Q$OWePp7|AJrq<|+2Oa#*>nM*LJO z2fHQ6E-E0^BEH@2)#MD>GbyXgCCWKUFr`d_&;lBkucst*l;+7;a?;f_B^M(OFD8=& zt*O}*6qd-imqKEU1;4brx=9+sOl(Rfc@ck|nUO)f#e>tOrre8YK_Bk^Hpb$XaPiV; z_U$>!go=dT#4j3U92oBs!nO_P|1lDqmPch>ql|6k#D*M9g`!DMlu^bfdR1eEj0N%8B|@C@$r68_DPx;!%pn1q za`&X$)~bd>^n=wwv+@c0SDtwb(2)awuE%@i`6(HbxV)K z;Bn!ca^cNdz_lw2q+WJ9Hy^+iSH2 z5;OCts-Mrinqr~?lQ<1AWF&~aN#1Ilx1<(Qlq@55d=AC=xnyT%l4NmecmG2oZ$fSb zrCDb2J$u==|0takUTK?fk?CKF zKjL?fy};J?F-#Jt#EMVvby`S}Hk|g!nc0b$98=-fn}{N-w48LCnG|V*T&Z_btQEib zO;5;5LaOK@Jymp(D!Ry(J`j!3=MsAqT}a_k@yeeUlP_%-wm0$hTE1Zz62*2(!|`8w zdK&ReG9qp-F{gss>IxbcE+xg?Ot)8jdrAyJuM>wSr1^^Mj5s_4Z5%#$l#Y>!@J$F! z`C*$ZC{+1oke(KYamtBH`iRjcF>-z(Y0*)ns`_M$Ek>L1ImU2I#k1gsySTP~oTq>B zJ%01ZD{S2GI-3vmXt7~*Mk!TgMKmlvk32&cy)HXxNn#g4xAA4h0-^`Uh zk|cd3sHUXMBNxtYw*;b+n$A|;vdCzK3 z(zdpkEGp~E@gIGZ-~IY`ynM(--on+?rv>Rfa*RQ-*Tk%Rktv@X(M4KnECz>Dd&NvV zv^KVRtw~hW){`{0k5?tG*OV9vV2;b8xJ<@=viKU?KQUS z?_x~)UQ}ukG)q$XPNitp2AP5l*^A%xp@AEa*m9lZO> zRVCdO8;=ZPwpxiz&LmfYtm?W7O44J5aCsm$nkZ8UuMA*5aqP-brZ=pm-gcY~ zJB~0o;gOE3?s!yj<7fVj^%-W$*R5g6{3R@&TZ*B16T1eyM8zgCZ|(J5b>$T-Zm6Q6 zx{NH#Alo+V5+@p*3!Z|EjSW9knknZ+g9I+LwyZQz$ofj{GMW;CXa;|#c zovh9e(zU0VfrzrsXn1m5-3|4K^UqsxGY#&Sd1zz17?gTSAWkB8DYt&&qpZ%hQ+>gO zENz-gv5>gI-T|Vj&f~I+E}*GG3`T;n!tz?0iW8X}?xnqN3~ORGD=)v5i_Txpg2sAQ zEUARfHd+S8B(O?g?)Cr5T}y0O>aXJJE!V$yEv{F7z|&JJxv{#JXEt_) ziKZG1WFU#lD4@Em0B?j4nv4>}#ididWF41Zbq&|7timjv?9lOkaZ+js0kaHx3og8x zOV+Gl;k>!5Si69PwqrE+O8}3R+`9GL@xfbIP$_{z(|pR)O^h7hPV1;y2&Y!K4jm^T z4&7@gVD0r6lhFGdZ}eo)nCs=BkQo(p+JrpSE?viES6nSVtVVoEDcSZ(4(-@OOWzb3 zRr9#$s&{a~@&z=_siC$Ynvs_MY~9@gbFSvSmq|aLvyi0=mau5~I@Z>~VF~62Cw$u7 z#;e}-LC&9FMPp+FiyCto+_RrH3H0m`08VxJf zbHz26vUFYpbLTdaXX(?@#+*SCs#dZhZHSk)9%NJv0DcJJqS{yIK+%Vi?xTo$dpmc^Ng)LgKJ)r)Hg9Nk2xIiJNB-N5yiUBIfE zG)B6bInp&T6O^j_O^G=|)+&jaIv##P==I{YRdD59cXCO=6fH;F7@G28seA|j{>k+i z4{YSnfLj8eGkR5w(Ww-Q|4tGzG156Af%O<;{&Y&pQ}J{ksXxzy6mP*NK1)`Qp<-o`uDGzhVhKrJJO(wZig6h+Y~q_Vlw z!i69H5|`yPv+s})4MP&eYj5NI%i=h=t(h?y@a@_4EL~cOp=~Q0Hn-tadI$<35WiVj zosF+^HwTaP2PFSwK|FI*!DkKWPOOR8&+*pqz=#H6{LE0(rqIOOrbIP(XjT~Zc$0QcJjH%~e&6QVQ#ge(zEMM6` znsR7+bFJo^mX^unm$JJ0_>Se?p&FKCu^qVqSu;xlGy=1-g%^DhO@-dF~ z)8n*Kw(N4QShJYQ0?|cQE+ti>i$XhHLbf`3heKZ<}O*wn$iij zZEs;RWTSNLd%5GPRjgXQii*$y9^Tr8)ojw5NcFqw)t7Vg5#90K3PA>1l7L-)SH^sf^WEUB~5@oF}Bd zmPP9pQ{))pc$)<2zHF}f?3cN$Aco2{D@A_`nOl`h;P_sSIg)9-@OrMj^gQO*moRtL zc`O!k67TG$Rr;pe97p}~^;~?}FIYgHZJd2a zI~aHQFiK1sn_AAQ%dcepg)5ma{$hcYn=ZE6);)qDxsGe@`7rBBlf|x9N>IO?MV0B| zH+OMxz)ty+l~m_=>Dni;)qoR^$mtdTpr)5+F1wj`U9pOqq8!rFGbkvlp{^*6z*q+d zIwyo|ikb%I=Y%*YeQ$We zO}r4`OK-W03m4C!ac%?478Wyk;Ghs9m)O%;3`$&|H9DQL`bzBM2iSX{mCjKciP^;z zCpqb8k^U7`%IYhxW}U>9^JFYuu&j=h!9MX(LrjUU*Iw&N$fABu1Bv582=|2vp?Z2~ zFI&OoSBTsaN8eCyV#D?W^p3eDo)vlI9BXzJ%dUPm?_1X-gtCtEOgj^O$LTj$vi_PY zSd!zTqq&6vV>a{GUc==}vYBe{$DCVBS%Hzq(S__4KkiDsH$e(@+OL+0`whiW!REL{hDjJX3ZQb z8kVqh$!b>3DfxzKtbdATz=UltZXO|7Mev)Q5m&Or6h{e?rrPUoVI!j zmEE|GhUgBq>^rUvo@&~J*(L+u6>F)CZR5euf0pmRa1?vx8dhZV@#Gurl$?JncU)Y~ z)}McdFaG2KHVnp4n{N|Y_A_KJ=HhEFC;H%@`Q{IQ#nx^+a~BJ#@OE)v-#(7^c*v|@ zKvkjzdtMV&2|c`W|ATDnS1)j%Vd~CoC<6%wC|-3lbA7M#__p52<8BEOl1f-|>0<0% zFY$}7e~;(8OcYm?VjelnD=)mn{#G$CvxUyB5A&0s{ER<6vxQ?lV?v58G~M`NuFLP` zcR&9zzrX)6x{@#FT^Gi%ZR0^Ef+q5o2zgpoz|`hn@wqSD$MJ+lE?Anvc-t67Ldb7k zQ%_M&Cg~FN6xY^JSsu^$J_$;VN#vFmi(`3~Rt*&o>9YT%~Js~KoMNV^O|mb&YB z?*)@Q^`qC>6Dr|`D@tg7`VG3(;H2qFbdp{`)ht42mccFLanOBmGncYeC#vdn}>C^_dN99Zr!!DxZ;k2k06LkX5^a%hop0^Xzx| z>Q5iw^$s6dY0*r!9Hq;fF2U^8A(RF=4;Lb1nlowy$hPm-BZkRK`voALjSJlMIrL_z{ z{{z1KU%%z~S2wb^RR$+d5PLx#=dWlWbmT>T@snTj;G>W8`ra-^gbb>|FHs2L>S7x` zqi$joQbU2{w1fvEqt#WH|N<8BS)+)$6dm@oioh zE?{nLBD?N?mhnvSQ~g`mwzr)_+h1cxPk^-41V%d!a_A&NC;_4jChCs$3?Wo^N}UeK zlEJ&$PWzE&+WWm!U-@p$FUgK~!bDn0 z3cj9cLKq?{`wWCIy`D9VF>K%Jl)9L3C8y)r+fBmUxfl-ok^3HalC454vNMv|{fE!+ zZ{L4_r#I}TYs5v!A4By8>&bJfdUrDsiXp9X9`ln&*}C}%<3Tf7(ngD<%=Ud7+1};Q z-mg;c#mA%+QZu)LB*PdEe=4=abct-i-1)4iHq(5dnQjT%YOlGSHI66w z_Os3O?|YT!Uw#c^?KLF6@h`mhOMj64*V!$;+-i%bZslcMP#4eZzy1n8eqtY{tU1gn ziKnlv1xMN()~_sQWb32+^k={2(I=kdjRXCRD>A4-lq^0pWSSzi;$j-bE;sDz2@mq; z9M}YMf|@d2w&-H=ojYVq@6+DVQ)>idmew(UNddzf@8@Sf{u6s#nIcmPea8;4^_Azf zsmd{SD~F%|8UOW@-}2B4J7^ce=l7af{GQKpQ`S+w|K0D&*!D1888`ExOQU2=+=oNP z&739Ial^_od^>*4XFmT2T4Lsi?PuZXbxJUND_1VBl3+NS?7TwC=Twjr2gA+nOr_RP zn(XAzD}Un8_dm`7zYw{#WsDs@O#7&ZtaW$u(ZwDf{jaa^-QPdT(=Tllk~yUwqEfi@ zTHbTTTn_*Fi+trre`M!WEjL^>4@c{6j<`#>WJNq%-k7AJMrsw}38i^>+IJ8v zS;3ipipGQ4O^3 zqSa8wd6%pt>hL4{?YdpOc%V9w?1sY&hQiLZZ&Uy2Vm z7c8VUevmDPC&{mGqMy-|f!W?5)!?ZjSnAvc^~MdvHO<%d82HJeAv zxnf-vO`LZ&cE^P-#*Hd&pgMb76*o)m)_ma@yf1N63dq`^4LfD z=r{@8xkuafvUSHk#w-~mhK4zK^f=>FV&tX_mRx&1%ab~Jfj6}#vfm)Jd;l)`G#{Kt9yp`Y-;YsZNy znkW7un(kd&c>RSZIp9bj)7Z~5fA}Fk`t^N0_WA)v)vTI83>V(}b*}I}$|t|}6P|qT z6OAnr?9P!I_WQO`UaA2I$ORi?2y@mUJ z_CtRCz%v|jR&vp06*vwb67r~KsL9wS#JuhlLTEIZ@edwj>kE&tQGCP7yZ{@w?G{4l z(FmcM#ZY|tz1&mP!B4*U1%C42v%Iu<5AA~(sB*&!a z7-G~3lDT$=L$>g|UFD2q@U~P^RvgdB#1z@N#mtpphT#q-3(8m!XTc=rnSxGwcRtF0 z{_Hiz@GvTa&yM2*3?AFTeP6zlTR!+5o;`ek*MIwMK7RY1eCS_($jiMFtV|5hyn7b| zwhHPR8ns8re)oj-Ai-*hp&~nli6fiX&@#Z31VEaBi%dadE;+dcBI7uws5I?PbewC1 z!K8HNq$Uy@v{JRak@$T(*e(Q_?QgIxYA(y`>}Qw{er9N@i2R<0LE33#*Rw+6qsS;} zph0vI@{DMArPKu>pPS*q9wu`ZaMj!dQYWNmva1C{c^z}DL0pb;hQ;@0 zS1e}j+&NU2=8_Pth6Mvb=NP^207*GjET21%g>@yQCq-+%KtWl%F?%l8+;9u;dC%>< z>y{f>R$`X^W5he$$-a$m&=)_C1@oG;KJS_wl3e9lqXo<4F1G9%qFD&Y)Zxu+><%xS zk(ih&^$YtY<M$_ja^bgHNw(Usssd%3*0VOQY4#H!V6LaCJchoZ3G(vGnKyqv!R}^8i)&dPr|K;K zg}jU&c$lyJ=L?J){EQ#n%T5Ve+V*eYmtXoQ_kQJ9JiF;N9{J&y`N+FJB&7a9c8*Lj z-nox`NBRgQS5Yszh_gz0J|X%duh|^S+>$JMH$TRU9qI{bI7U%+7BFU$m0OP0JcQqn zN|W@F1n)Qlaf#HWr;w15D1mhd&)%K%XD*~Js*fXsVpB?1OD1XQdEz&wu*FHhSt0pI zJxNHSBq@$qgOon4gXwnG%8i(rn#MZ(2H%yS{=m4KP|p$RiwEhNiWr`{M!Pn=tDsU$ z<|vBNlL+=7WYd8bhWwWB>lfiu{z5447P(gHX|&oI+4B&8e&{I<3`^Tij52ADCOgW8 zB^1T{+A{h#J;X~L>M4IjK9!67Rjb9f?|g=5UVek-P8WTLIv5PuMMu%t%_sM#|4}G8 zlx|a!NR$}EsM=|^Y|>x+$psV@SsC2Fo93e~Y<4Rn8(wA0XbR=!3B=meSmI;fV?W}h zE}u5laK!BK!UCtom68{;agoIkv0!{hShHlLEBx-8skm#Re zBq3GEWdiZoSU9JOiB0$M_^~N`l9%QarW;qYiLifAzE&lK{m0A+nvH3_T-8b2f&`QE z$jb`Sd+->&-A*|cVqo)j4*60kF0^B}8S#wvvi-^5v9VuG?{+ij^AewsK#Ivi@79O- z+8001b3-Mpz5ZYM(kE_b?TRWAt?HdtRi=_bD?Kc)vPaoej5g4`k0aeK;)~}~SyqHu zVphM`ql_jjzY=}=w^mnmKw{yj1=LprIVSQ}*VNHaSBJCnDDH|mEQu2R%UNfGivA5k zVw18tebMHHsxkYIDu)76I48)Rtz zOZ@md|H0G8V`y4;H=p^~9jrgUp0pTSIFE>qH7#p8R(V4(DvqRz5)wy*U~e47Vly*w z_$Y_koy6s5lMy55`y90IdW8oc+emwFKYgu-In>s}Sg44Cyd+#=ujyHZ)YsKum>R*G zl}}w<6gJ8KT&g%5PK+|5No~2*nQYWwsf_A)7Ar=xNqaBCESpsruzIOqGYEC2IyG{c z%Ht$SG=-Q5zdswkKwE+}Du&op$$Mmi$w@IzNwQj$gESFRdB;YRl2**(i?8P$x7@<5 zS1zHz>SuV;fnRDH^amJkYoTLkl!;Lpc)Fw$3g38ZI8jUOw^sMau0VBLlafJ`S9O(H zRSH)@gF2=iSJzA9+e|SO&AWihuD_X^Mdn-1&tdGyFwPk1Bqz7%LpC}hbMckq!9y^q^&m3%K*L2YilWT~|Dg1HOEN{qR*auBA z7%y04z}=TdPNav=)s6+sB-dWX`|f!^cijF?Zn^m;Zdy@J zv^XK<7=z9cw*T>){A>fvf6pD?D<{>+CF1wize&D@ad%--?678BFQ6ZiG z@MC=D6CdJ^J8tLB5C03l-s(~74`4|sWA%+6<^O&Bc5c4)o!oxqc{F6lqTW4JJuV!m zs{S95U-Hv>PNWlt`(wDbs=tv`4cfkzKAjeU_#9K~KK2gAQBaab=7Qza1UB&EwkcfV zBWAh2GeZ=rp5zX7Hq+}gk&=}|l0||VNeY)T%SX&ETmFWG@v0-x`9YR2R{0`hI z_LwR4#4m*ta;va7EL*r<;hmXt<%gQVqFxd3dR>u&VHnL8JVQr$=BJksqq;8JTPrA%b#U%`z^# z`8~YnmaAA(mqlPg#yZi4t9vI;{PA)2cr#dh&24=6?ss$fs(O-S44Dn}&BO^c-bujf znyK%bK+{3E-IX#<=t)6zsM(E-yW!n1v{RHG<%b-L)F^zd+Jvmyuv5J7BCdLej6b*B z#yc;}q;F3j&V)$*GG6!xhv}1kXE9IFw)X*k`kxPS$Sr+S`kGqJ&?I(hGFl{XQ|HLY zCWB&hb`zK0{9f+5>vnE?=WX1!Za#U^UsY=xjhQ4Sn#B$rvZvl(4a+3W86MlB>|_c1;8J!4di;NDA4dhC{=2dUuLV_0q9-H~j%89OinN^_8YRO3PtKQTMsi34GoXdFEXj65JGI{=l6b@N87@$OQ>@-Ikn#> zHls0-n3y=}t4{nvO4PYC=lumx*965+S>xic%DC^)mev=kB(5+^prsKdK{$UE6J(Q; zEaALoQgkkQoGsrpBm?D33?}(&mwY5__j{!8DqU-p`dAL5=_e3AclwBu zMoSh#Zdhw#X~>Qe%MXH|oEcvMqL^`?m7yuYN>g#}D(B z?TOs}i95NdECusSfto;(Yr>ns97}Hf1>ADyJ$&H(@8-4}uHvHkLSF19v56Dcg{u;| zP90SC5+6g1A&%-b*K*^{%3s{bwTohD+tr6BMXpfioDGtXNr+N$(?wi!(|fsUQ63$y zJ;;5}Z>LYZmQC8*A5^c8C=tY#l`cFsqM}usDY-N$)SolpMB2<>?L4WkQO2qyaJd{9 zRUVN|HI_ka$V@1@^ULN}1=eg^SkMX6~;L6)? z;i9Tc>|$hE8DSM`1{xl!F`y+hzM-Q{3R}GR%{h~*2kktHgGUBBELJF0P+Fd}$5F>*<9N+U2 zzx>L_<=Xdi=UpG*?mO@0$1gWCoHvj9gkcO>7jenu*K+mM*OC|NBfeoJ_0dvKDPP%y z`oOoc1*I#^E;P~9U)AnXA7!jcnVS8m^0QcV@iG$HALi?y{vdbX{r~u{mk%-J3*Q@3 zQ<`v&vHf?S=Fa!NhkO3(84QirbLWLcGGI&OsYAzX$Y2=As-PqTVpHl^vR0hm6_-;i z0YOSxHKoF@0#3J@r$}P56+>(~H5FwPrp8MD6cXrk;tj=+m}JKi6-!=`5Xzzq?e4rX zTMg1VXYSUDH?^oc>t;FDxtGHu4i5b8vl6sQpMJk=cYTP@e(e`*8?#}S{xEW66TklQ zJ>2=pukd7h6pL3Zqe{q|9}~X*gFN-~ukf*Z-pgm6>ZNhnGUk+|Yd3yWXIDX-Eh-AT z-Hu)Us(U7ZKomJei&(SB%nSeVK0a{w2l)7R?`Qk4m#EWTusz{0lxNj;rBccdYv1jY zO)XfZ4MN&kk|w@STO=itZZ=4|mZ}2EHg;_4AW8+=SIlK<%KMc-X;mSWF%zEpT5fXpE-il*~|EN*v~5W z=$C;pApSBgCI*WNR+V3pdKhE?b$k58#ieMvw8rL9RUpBRDXgbZ$R|F%`fQ2NLD5Ak+c$I(Ti(Qlm(?-;#$Gx-F7fw~iv>=fpO~a% z>>>3rWF?avbPNkAKEjSyALVA!zaYo9ys`~d&*Z{OvKJ-s*sLWh*z#3rJ}{wxw`s;OwIKWXAC zJ6CoS-V>Ox+QnZelT+tuF_74{3Vh`svr%2Ee!6ga#a7b`$xcbZ6!b;To2{d>Kx-pu z6OlztmyJrPV*ZMHq6hb}_295ZVoriOKP;?llMIi0$gOT7P2vv~>uGwNZa4)MjEcNQ z2~g7tGl&m57#MWo@+-^u-vW`u@4>xy7e{@i%)hvfyjby<;x~v+Afup&jLANFMuH^f z7myPx-pCsuK7SGQc@DadJ8($=e|n8(9Z^4KC2K!LXGZ@h0_=)B^6Y@#-6#D(;N5fwZeSEg*I@ z{ar;ZLD|_*KLb-jL^9L0#bVUWt>l7wic==&?egH&W(J;IpKuk_zmk{8p)IUsjv~s^ z#mkRv$D0TT;5wF3`BZg!p~~g*9_YinN`ok4iQe)MAz$w0BLA zQc_P{MH-IwPKGAKpR5S;2{9A1kaSBgZ@jRLBLgOq64WbDVV~jhc!^FHIsPEgX+;$0#o-bzAu0^_Yo%|k0;(M)PpcW@SPy*zy&QV^kNn4{ zKRl!3Pkj2DJaKp&kLXLg<}ZZy4&jbH?KEAmmL-jIXsD|uOFEKIG7Neq8ByQxF~yQy zQAI_%iT*=JX_o*gpoon)mc-%)7S5l~;$svX}H$q(IT;?yTCpkTv zipnZ#3R4Kl;O>YmX4&O8acN;M&))YKFYOv7W!W0meAyU!j=Ce zO%-|S!_S!s60f=$cXTu1&S25Xr9$9xC@3tWrly+8bOT+Yi;zj(VO`Hc(|+!Iz4del zE*;8eD`dsGIoOZyW5>ZRT-se!8EoQnDX1$ZKfy|J_B@u(Uqn->fwuko*w@^~sI*Uh zt&qFqbg~MHDJ#wLw4HLd5`26*Z}|D7-Y^iMqT)QjwBF;KI79&x>! z+1U=cbC%LHM+S@1M&>uvQ5rMBp&dIp&@xPP(L5F}EF!V6oXVypEGmp<;`n|x?>>ev zZ$9g4;y8L>FD*S2vj$lCYv{t^Z{n)!mJl*0NuREzwz7;&n}fCi4{3RoEIe-&^J}Z9 ztSBZc(aL!1QT85eClH%M!{Q|@XlkIYs*HkyOw5Bqxb_?o!ZbxbLr|l2DWddH+3P)Ge+5R*h$&^ zI&4BT4vr-;SN!q9rbZen3y6=Ffyx+Qa(oi6^xNtMi&(s9AqyI+$WD$WN(PvK`1;`q zmyAF#(CMW3qN}*JYLfeY^dyIe)F*(>HM|%wMW<0NI?p$Bv;EbBj2h#qUf4uYj)jix zJL&T#Qa*2y<}Vgh=Mx(nONu?j=-4<(br-TWXNp(09}*v`ZaN7Wicb|kyq>(tt-P>* z2(OUj%*r{;mmnoMI-RQGL|hZ266g-$OKjlM^X6fXPobz`8EeWjF?x=(Q3Wso37Ra4 z;*WE&j(2dRd60lAKwDI%h`CGVQIcjSHaV9$OXgD%>*m1bt?cg^!6$X@@0_Ci^6R;# zWQgB=?@5k{j?_C#s?ORCvFHNMzj!f8{%8uz^GOJe(Ka{;mU!{IE2yX`AT_f{{AUU2 zF)%jn!k$(_RG3HPUH|4PE!WAT?sa3(%>algyq=z`(D`T4w=)5IYbAHrL ze);0D@arG5pslK!QNogUX1Zb2L)1AW9b zT*cKT4xZhx2jN0OuGOldIn0%@GiqQ1n~w)5tyxM%ZLtKHMbyjqmYZl|d_qWrkT##l zmZ28ekiMQJ*OlkQX=B^i#1wJ0Yq`9{#S5GEGpZKZoADPC@>tVpxL_Si8|!G4@v$^9 zghSOcI7Zj-nDjr%x4eOdoP2V!^C(hdwP8x~acV2fp0Rz^JA@Joty@zg!K%a`#q}&) zw3;PFZM^W%)4bg5B7e>b<`xAww(WIVhQt|7C*?dC`P1(q;sAo=n5lJy|6iFXjSdq!l;oZEt{}>Zq)gRAgb^qN^!Tu2bs3K~Y zt!I9!#2UHf)X$qsWljtehqlu?mdTu@^C+uICm}hXOWt`Yx&7OC=+Vt|PR6s~%1cN% z{upl@brH0S�SAg|U+@yM{@tnL|OsB**vdrBi%XUZwc^WIt^O_R-w$A-{4Vm9^z! zGx^%*1?GsoO^D4*c}7K-W{Q@d$2@Daj6r2oN^Fy59Heb1{C#VG&_qmD6)RRWkcjBI zD3y>?u5(3EGDl+QrQ#dKhZbihVz-(k)^##EG=S4D=-2cRG zdR=~P)mw973CmW`Bi)ifZb7;b!$}4l7E+4KDJe`MF(!+Ws+F9#ppYnc7rS@J_%-Rm z6^s#oJD2K$d@?f&sLZx9G&(8$vIB>=iuG44!y27JrIcM;T}es2hhx1H8lgNRgz#8n zGO28=C(+x&(PMo$rSE7rX4NG^puFVMu%w3E!ffrv?wU)NU_H8#r(ZtIgei@>6)RXW zf1dc(T5=>_R__LyeB*Qv`N^)H&l2(XO$(N=xGV{udVf~9O2@z$Zr>OVV=8q^ms4$x zA-z)M&5jo)H!MC`xQmcYw;@T!h(-#{1HAUkCR)_{)wW~`s^_v~@qFrQCEl;7&=$tZ z7}~{C&+VaW!Yw4!ApJg@m6t3dooMpPOURFQ(A+shz+oV{LVWhhRLu5#&bxRS#kNsi zfBXdwO^Q9$HcA{b&YlC!sP7Ypd4p_*F(G|v%w4oZ+ANQ}0`bXWZ))}90kuM{Uq*|w zsQGM&EGo0=^SkzT2q9ced4hq7fo{eE(WFNQ=?0{SMR9+m9imm}(i!wWVwAB2#Y8o_zbTf z?Pl0Hg78ODw+!^+pz_p$ zHQD6aCfIkho!G=I90z4^>>R^jl%UZjn{${+qVNtLqr;WXg7cSCX!kQR*pJH)O|sQR zS7$Gih7@Y%EtJ7Kj;WCWZO}`P3DVcsCvDNe;kH5IB&aRS&nG=?l1=wLNAo}@hYpEd z2mzlXLG+w_(NSg&Sut)7z4{OjzH%IMwB?NLrsM4k^`s&rBMXD{?QMrznDAS$TV#;% zIuQQA)NmWSn>!dBH;`3WL{_Me%^Tie``#A1)yjYa{qzh@VNWlhB25C~{hN64js0}B zAE&K*2#-+)9oLWyK*t%L^q%BM)yl&?dxUtU)v>5l`c`@dnW+gFCt8J&I>;!fVg9lO zlx3x9%e8xY_Ve;fZ_wQ1A~CmwS|MfHGUS=rqz2k~{^^(4cYHAX$qI86q0x5sxAtl8 zvV>s}r>{O7+$8~|ovO-u^7C!hn41 zJ$8&Sa}IMB%_Bd`!{E>e0dovVW(Te9GQg^SyKoV;670K%`xy4x$c{HM+}A~Wf0%UO zaF9IjVrnK{;*Xp5iH{D59?sq?HEJZj$}GNWytkd!wtmD@%781uumq#c`&w|=bEuxb zfYO8zg99=Un&Zffa?;Y)&8Ra(Q1oy>0ss|^Yk5k3YBs{)@qIGzdI^jVi*Fgjl3PYu zkpxCD9*(!QiBI-0(kFF~j;BQYTeRmOPyGIMI>x$1jzI}pLii-8O%VTAo@8R6xtTtR z;Z=|;akdP?LI%YTW@Y7)VI5}kQ%~^RwpOM@25s=2bdb96GOCB3;y0U*2r-h8C87#- zhk3mD2qVd5REuq7CPm{JInJKrqhgao3`*N%l~q!nt3J~ZE5Y9otsNsm@Qaxa^`4mWo*BqV9%_#O_ABvCe}n7kY{w%KHi zKf;lIpZx9N_`oEIr4qE~r<10}wkQXOTG}MYma%)HjeRZM;gzpdd#jt+elNZ1J)9$* z^iTQ8kf5?WHh64+2*OmdWsm?#Uq`(Ebp7q?2x;hTBV z{=WsP9fLj}od>pXWHg$5iFwqA>5~IP?0@}fHukw0Z#zzpCz^t)O3HHcu?=qE=RbIm zJp&Gm77NxW7;N4n@sWxXP4b_gslIla)go6CpE{&H+B?J!yz14c5T4OKI>at|r7x(3 zOX6~hD9@L;B{Pd0yOSfWof543adqrqduKFdb4$s~mRKt-73=5$cC<;kVtYZi#E5Mj zc(W?0QmgseC0>%avTNK*dE){aD)TTo1{jpSo*ZkzIVOE|U_gAjw5c(k{Nf@CGSl(4 zzsm1_{~RsSk5pi8G`Q(Ic8ILKRa6{Z)UNwQfFQwX9D=*M2X}XOcXvo|Z`>`o6Wk$a z;~m^x8VK$*&}{bkZ_adw~{UT?vcde+nLZabn$j62pX|e zP)K!E{$lDFkv9fIg?6)HQ|I6%vmMKn=X67#7!BrS68fa|J=pl!QUcb{^%n+lj|0qW zyLb;L%gR*EqT)C)89yWyYwlseU)@>ZH#Oeeu%cd=&*h7w@P7)ck;T^LVXglq_EPki zR6~?pet!iq7U}N|+CfZ06{?9rZh33+OAF``V<95T0#5#&h8r5Eswk#m}r}--3S&@>qg2!zL{x|mOi?RxKYgxwO zwWyYA(3mitdf*lnK@Kkhm*Q}F2-jVO7ThnlB){>al9A)fd+v*4q3YM~QR zRQHL{c-ExHQPlT14%#3orinTSAItwc{|VMAdyM!fa_n&`tF>5*pL8;^q|B?H1wD~E~JgHo1zvh}=Uz-qm-#V175x*H0~2@FsA zLo9GZ%Cw|7;dHc~TCZ{^7a77NYC+@Z^W#Ee1+fOIv*3l2sk!G`)mwtnC(S!WCiVBs z+iM5mmEfIX(2W|0Imyfz-EJQI@thoP(4AAt6l1U969O;}U&_@QP}u=3J9aSqvcFC{ z6M2n8(#OWQ<*^38@Z^N}*Fg+cdOmA(((?@nZMECi%Q2{Cg0P&G_u^Dsb4Q`E>zAgh z)!mwh$7siUAC1<%ykI7{@#A%SpVV7%acN)|I!N7_Iy$7ds^5iPQdPyz-?shkwsTOI zKL(FddYQIKo1(P4LccB#OO-vRlV2Kffu%ZBZ6^{%b_g0sgucUshx=CZEJiL`;8&IltLglyFN0QItcK4`vTv@< z`vfQ4YhE1E`{!nbR5;b?pXmt=_^I$~gmKCR0EtrAb4h*)kQZMEBiZ$1A3&OkG&*(% z&CHuJ+s+992VXB|FM`KLl&(yRB54=A$pf!~shVM>X1%su=z&qSc5Fb=)fFaa<}rd9 z$WE?)HuO6Fyb%Z5on1!uU^XaSY&5uV^$=?eaes^`{*-YioI_PrWwdgpt z(vX^&bCEe$8Ldt0iO|g3yqU=ADk4UOa(+iCX=SF|@G_vKFeOo`;I<=WSE|817JxAR zSOU#|oXvvLZqZydEm~{7VffCM8#hCv;;WbEt$%+j54%Ih7au@3l!%R=w9~&c0TuTO zRI>w@s~SOx1brpF!ff-$!z!u4n(Ba-@{ze${6GHu{Z63&FcdJHoG0 z)k6bG!YrPbbRvM`ZhGfZ8Vi>>alw|IFYkYSBazp1MKo04X2l9u zVKZl%W=6KKN4Ns&oD=ht!`Sx{7@Tceudhe3wjIuO!Y%!%eK?!jvbI^9D5co{dDDA zaPYTXJ?iG|szEfqc?6qY+j#mQ)&yb>yqe7yeZkz$tF)5CWlMv&ubfCu>Kn!$96Ue5 zE{scte{Hh7Ap8@v;99xSd7S|^SRIK5T{bNp`^Y<}yfZG*&9toa0kO>f2n_NFKCrev zbg>F2REb&7BOiTnK666bgPRVM4Y)~$=%R-^T%X4)ZCfpl=y{abVDfhqYL9rk?Hu+0 za4JD-cv7*%UHBtG6Bi5(?@@~Km%(pv6$^(bDQ6BrmJDZhI7mr1Zvliyk6Q?q8e}5s z=7G&^By(j)9Sh{_oejr-$yBCwri_}*ka&+*`@)yFPfG$PC284n_6iV_=!&8L1K#xM z5?8Feu~jddp9ftwF9lPFX@5sm4n|V8=NFj2r6>T`AB!pOsLl<;o(s#6o?7U1PJ~1P zEf%kUq1laPMl`DG#|zj!qo(f=PaBoj!3%BmiG|zeONcuRzbo2LtU?*}e>k0Dsq@c( z6D+)w*T~>rGG+h1zeFT|w@_AT7|A;yFQ`J1Xf}0c_uPr!bSfV57yR@1@#lZNqe<&? zFiLwkYBtwitk0?c|3ZAanx(0VeYO(*YyVeRjPHhQNF~vPmGee*J`1Q}XGS0LhTP`BzTg7ZO;c*@?$X-x_ESvMReY~ZJo78Mej65HCRxYym zY}NTC!{5rV0?1;|u9#6>+QVg-o9nD|h}HS`{Q;ooVCoCy{|U$Ny|#X%hzMC^0kXK2gDsZDYDmJACl$*qdT3-3_7G3c)DrEeq!~i76Jm<6pgFL zh!X7w{j-^^gv0z}m?@2G*KM`CM>jDJ=}kwpJ}X zICS!6h@j_+;&QM{U+1;D*RJaZ!g75$3}v!7u0ppB*!w&UUs%Ga>m8Cd)ID7rMc$A- zFl1wa+YEHat21{AcT!ZtD>$Lf~ zkyiJym#xxR_nkg%+;L{|E@x5PxuxC?=IQ);Igu4+B@&2cubn!tChku2Xj=IwHnX=D z;Y&F0l_}Ku4OjK*T^%-LiuplIlqDg_R7#4-M-fmngIH2ViEhpj`|+iHL<*lI|IY!g zwS58=lTdgVp8dXSaqLb)&`6J6mR6;Y2NK^qh*VN4lq?FwH*Nx9RjSk&wV`3-N^6$r zy4MU6dtVIT@!kEt;4w)IQzhjS02S4L0O^u!b;e5QonmR2n4*_yTllrU6xfIS+B7YD zA%Ek$Ba>^UOwLIWyPd?d3v^R(IeNV zbB8I@W%K3F-&$avk|S$IMrCYLCxwsFk81n)YNwyszNBLf{Q!}uyixeqO%!^xJ$z@UW|AG^Ipl3RXJ1g zO0aS1qSjMBhVc)=VpIZM;(<8Hb?km zZZ??8zN$7l;YqHoi9?3%GUwSEiGd$0)s*K0Y5$5fg&H5vy1WMTmsnw~o~O&gwkFal zU4j=G+z`4&i{I6jTF;iSDofF+Oc6aHLPCk{NxY}+GRGtJuS9Jat5Pz1^YcGGCLUmc z7a?z@rkJ2=m8yx(tv_%)8!jdSj!6ZmX#l7#FT{G^?NZV$uJ-N{XH|xLR8#p6b8G)b z%5$@2Pkp6gsLea7475+5R+QjB_P;|gLQPp?g>dy#a!qjgA`oL3;X9x4FbM(da&NrD zMwHQvoYE)O71cRGmFnMD{>vF9AC#R8V;qSXR`%G#;FCnrB9g`Ol1b|NZ}8o-LvLIN z1trT^X(74p7NjzUnC~L5`r)g3X`C8|a7flwpBifb&d-hDg@k928}3}k$YXsRVp3z{ z(u6L~a(G3|xG`KM%-zN=~t}}0@NlHqRh`R+gLPWRFH;Nz> zq)Q*SE{7u>YY`` z`tw@}bZad4g5u-xZFIU{QW>W`*lD5EB17O<#zw5+{0Yz0f`=%^{Z8Se@G*kOIV%3r z_hsF=3 za;oLA?fLD1HWnr8(NkDYNI7@_tb;J>F&*kHAge3AadK8g)u0=E>HmTYHv?r82R#=M4c-aOQ zzdX7iqj$lAjXJ0|R(R$nkvi6*GDSUw;-r&;JQg)6Jh|b>PED?{tomf+yUQd+;}P)W z#F{eWElb5<95aXUo}7&yc}LBB@Y4Wkn7piKu>rkedup@v{G81-+h6iV^qiVi^JZzj zO2s|F0U;^);}jUaX5(-EqQ)rodu4}cuz26-z#cL>c30I3Wr; z67!{gk^qucwJ)R7KA*+BlQ#Z6^Y?J+xM#Szy||Ra)Q{yG<_3tF|K$B=gMl4vWA+OE zuV}Md98ua=R9DJlbr#9Hrxo-JPQ2gNT~to6ll^qUwXMo%zJRnmF}Dr@2^*EG6p(B) zSy}lsHfJoVq=^`3LYwmv<10C;SUg<50omeiwd?Wrvv(;wjiqfTeWS{{(HME*an_<>5F4!4%WnoSe(yzp<#I}k>lsM#cL7ENG0vT^jIy!-BAX(+Yw%&_-tzwQ9mz{+ z`ErfT(*H289AD$fksHKM@|vw0Om*b|*>Rs#6aF#pcGL+LZd&H4^Lun6aaVWQAY6_qTfeL0Q>V4N7UkVs)p<@S~tsa~(U0QO-Y%;TLu$l$B>*e;uRyyz*zKb|}_=2oUL zv`qz@5f45m+R9CB!4fE)9^*a~TahmR1)tFOzTxInxD4CDQ(*E9eG0yoZGLMwXuUi7X@~OU)CLm3Js;#$a%v`glsYTUn@1CL8Hz-lLBYa51fkXE_ ze4RlyP&HTF<&=`;W$jb9Ya?+zIxyxb!*vd)Nj9aB1@qkOf&+a0;(R~LjFhI*9z|GZ zEN_^P6^qwbSA223?+AAP!zAjjz{bFBJcctd;S#0VIOK6TqI|xy(qoN>35Q%(zZd+{ zCQpZvT$ptFC+PfnPTyBq!m_bkt>sp)*Y}R|lss1TLAO=p4uz%9Gc#WY*OEiqeYg~v zP7ye0b`IHY0^h7p2-p%O{g~k@&<}c3v%)R4`^1RNJC5}RVQ#JXriEf)^{V+Y%!8X) z(sSbw7Euen`om(hQ}cOl9OdXQ8=R>~@m13kw5`rm*OERWF|oP#eZ;p|+Na(*O2q(` zL)&1w};c~YXyzZ6Qyh7e-`vqJ6mRD+B;optPgMep! z!U{PcZaINji8C7Tr4M2GAjM=jS*|6nN2IftMEbu;woj+QFRCQIFGBn^Vyl>to7xMb zsqS5iI5O9fye^*?5U^4IY0p-6eAKpW}1WxUC zY?5QBNyF$gMu9(RNP;6ddQ}4uIohuXwHuqMKiNxsscHFH4ujNouX26=?ywpuTEUXO z&#q;h;0uF0eN6XUYWVEN(=ld7CNDjjDK*wJtSs^w1 z0$Y009Slkq7}$L0+ev+aQ9UrWmqnBlZDTO0k*0i{u?5B&sP38cumSh}FVl<;tuNx% zYYIbFQqH$~gSs^+3Gnq1@jh0Zn-b9IvTAv4#?Q^~2$Ql2HC!amI^md5^NG(O|&~EB1_j#!g8YX-lBuB<#v(&x{ zhPm;LnGK>~#(CuV52&6lBCwou+KtzDrFX1qBHBFNbg%Z8k~` zI%~4A5xL_>v^G2LFpShZF@r58j0e5@TGGw9I>`DjzRziqz#^qrSi+7dI=>TA^v|aS zT=?fyV&o`D7(N)1ydJ9)VZPbP(OZs1Oc}H`>!gI2U*I{fzhOHQJ6Qb5ms$wZ;M}xQ zkorZx5{F{qNqmZa5FgF&mor;|@4bm+7){~Nk{lt9+}z$Nkn;~4MK~?3>4fUl8LGzV zjzn>_hAssM;DS$`Oh(CtxxGJay=}rHQ5{hTimlD?_})Um?qa8Th8~^^mN_~CG-!l& z1Mee}>u-!}O5W_yU!KtV5Oh1lAVbZJ%e*apIj#~Ul{A67g#&2U0`nGrPfFREH#HiC2J)ymjXx3!b;@xndjdq>8ywF?tIqtanDORLQ z;&zJcv!S8_@pgY-d*0cesNr-j;bXP)G?kUYNR;glaTbxWVl>BJQ_MrXK4jX4P5HW# zN;7n5@d8`>9n!{-qaVxJB?QbJPpCAIGxKlT`YmmE4bm6xXg$T#|q!Axr}_5THq61Y9~nFAET{ zX>GY#1fN5EchW+OfIE|(0dHU)6~^w_lBYtU^|uV~-|8qjoDwhJDr8BH*BVO={HN^7 z4#pqZQD%Ohapeb|GATtlBfrx>o?0>*JoH*W>&TdR<>JEb$Tpo$(tG1+oENQNM~84F zl@D;Mg1G@_x+EPBUkQf$;CD|tU=MYs3%4jq;g1Z@y7^DWeY*$g!XuM_Tutq3+$|%y zs?Sb4f4`Nt_D*6w^vM~R)aEFQx20Btj zqXQO>DGlCeEF`vOwB+zY)}P*9!AmLi)I*dfglAi0fx(_U{&BlqlXM!4T}c-k8o;S? zCnC>=y&37@^K+bpyzg2Ia&>)vd})}@nJ7+5-FHY};V0Dc;WkM%E0=|@8I2Y6SY4g{ zoE~8i*d0b|v%J5C2|x3Ka?H(#U-xFv3Uwf$Xm?_4SP>Rzn!WuAH7^p6L-ys58`Xc& zuv}j5r*+_1vnTs8t$16?kG5k92okbNptt_<$}%^4g!?8QF5xM zPH-<*o)T!;N8YEDwexZ%XM$er-z$#HyDeOdQB})TtR%Zz8>qC>Yws99`3!Wf%X9}M9w#?0*;$na3?vabKr+ zXM5u~x{4(JGwTp=P~SfF&VZdl|9yhrbgaDADyAkhoX!Gm_G@rdfh-O z;{{lxbXxsZEGSsZu;=$W@{J;2Nf509k&5p^JzAd@=j%X#v5E{AIF?Hf@^Cl9C!y~} zqHg(%2_#V7g;lD^{2VI(`c2{N7qT6tWS|_@)z8PmfE1u%X3(#3MOkeTY-YwwbF$i$ zk$_pZ@{&Nt&H8G{^#pFM&C^x?fg$Z3a=qY__w92B#dyS6+l^y(_Cs+{&)Wl~LPLDW zgXbvRF{$PvoQgHQjkU4PdHK+@u|hq4S>Uv>&BvL&JzHGL@fq1;+(YbK`L1vERoz~v z0ZRYQJO7zy%#OCz+~5l(^2qAu(@XM`1)pW z;nq#JY z2=ryaqfozA+Rrr@nD16EL{*TRbJ*mi4yhRPW$8ZO=X`pOHs#G=fo270h6Cxn<+5Mg znd|Q*1$=}J1q6*k9+Pf-i;vY=sT76xBDoYAASWEMn4~J_B^p18GE=GF5=e0?u)w8~ zBI<>fnKJ6WG{)LgdCEC@JHURL_Vd(6mOuN=bYrC2=cyidh5~*hRo(8#7s|Q0UZzz< zM9Oo$N+Fo@`)(jKTb z;k!2t1t#wpCAv6B)}zADbW_1CI9X#EgFo`~)^hgX()e;9sW1YQGN<9rK=%npk~ckd z0x)<4m_NAh#-h-jcw_J*dXF?!_}~%Fb~U`LZ=)ne3L(z z>UO{pq!UViI5>;FnIU}F2}!UoxC+HmL7<);L3`!S^oYC+8Tt4B7H~x-!~!n*#Q(Pe zjK7!t@2CH*_j-&GL;L^8ycm##zWr~PSUv6Sk4yD$n5bB47deQ5!UE8M9duOoGNTb8 z*iCGdj6_e^8aNXi2_`*@-GU?ELI2QUbTp7x-up+T5edFz`UGxc5A;7BBgrq~VJ@`a zgx6Vuu5PY&$1mRL9am)6fiKGz68nCzhK33eRGa!8m_t+rt``F0XK|a0ho!4uQD2mA zZ)^T=I{K*wBdDY}qcPDeuSRwR2muVJzFBdp-YZjB& z`JF`=MSYwIjGGhyxg}RHVT>5p2FnnO1-!_2wss74DqUN@UPSb zF$$}V*u@R8{mXW~Dd(B`<9&ic99kSEqWDA_Qo)>0T7bKH>LLSonF9KUi-rtfjDipA zLd`chkAEY5+k4qv&1RW)aIy>iG*X$SHVuc*yq*=m`k(rG5nOKfqu>S_hxRjC(W;_Dt6U@LnS!&-Q5$ z@Nh=Ks(ytsBAB`16LGWW7~cr^#6g&1-^|Wya&AlXA~QU9ohYQIoY$w-`6UcZlrm~7 z9TXz(d?*m?ftAB8S76*2&2WOn>)D!h{;L7#GCDq^BRf^lKTvuQM--H{*OSf?@Vz4B z=?5QRsTr=OPTq3g0xNG!4jHdw}0W7zleYjuWN&gsFQ z$`1yZzqc;mNoG?S&K83ao;60Q;zeD+ghitO(lskGN^?{zqdSCv8?-)Z{@&XqlN%$WG5O+UpQXe041STZhTQ6s6+us$O~2LxtOH(xZ3_hK+0Dd$ z&G_vliZd<4!j$*vQJ4}wCQ5i1P@Sc&QjCa)v(A=`w9!xVFkr@Rj-#6+%_Io=YzC*Ol zH*(cZ2Wj|L4`0QSow)e0bF}`9=)-bX4tq}RZcVuZBmAm<{PsXxnp7^c-E!57?9Nv1 zvnl+@Z_b$2V*k`5(jD^z$30Vz8X@f9q97&_Qn!3-wrF(cc|sgdj3oiJ_Z9Fg{&ulI`O-qx*k58cKJw-9u z`Q+T*TNrLQpecOdF?NAM|83r;cE*fKm```~d~V(EnRwk394L5|L(F*($7(FmUkJ}8 zyx6Q(28zA%+YdT#zfpQe7dYjwZd4!V%sBKXZBw>Y#MPwYOsB#fY(zv-8$5Y=GfZP8^$`D0IfJEsS$btmyJVJ?+ zox4?1$493aifz&`oS3aHA=-*89j7QDz3?w!6DXx~`jETz3~=Wsg)HK(hJUXvHuEtv z+{eL9CUEZ8)S9S)s*z8D_-2-+RR|^E<5K=r6L2KBJLXXW-QiVE>aHtqruJ;p$L=&g zzAuKeoP1RpuHP~7Zn+BfeZ-LiH~)fGqG(f-*oKmfaw95Vzp-q+!_J^Ugk{sr;R0A& zeG@MaehT*<{VPo%hpKUGVpsG`b&KYSy~Z6Th{VzPcK3w2c%}sERum|843h0@IaC-u zevw9|*W8*YxCs=1C2`xYh^PSeRNUrID3=Jq&Wm3vOJold%k%cuTHUBM{&Z7u4S}*- zxP$Ob8<&rSdc$chVBW2sATv__fhM5Hq`KJmks<9N>XM!2=b_Q9L7@l1Kdn-+pM91Z z%IXq7ld>)?Zn{%=Jm zleE3)zYK1zOGqt`H&+SnauJe8$21Sq?0mWV4M{_2ziVAe<1%83shWkMk zaKtzDEeYmInXIj+C~9}=gAd^g3o*sa@FNY*NlY0vo+zI!&vkMAzJbrlN4X4U`9>j} zK9u|Mde&Sr0peKDDbJt9B56q#JYt!vuOS!Y7m#XR-3!3C?*^HWQ8WM9u@0I>3vwY` zTSGup9@V{D;}cR*If!=;i>8n|#*I#!Hg*rdw7R0^W|=Pa-f~~}e#l#QeRdRlTs4J8 zeA3I)=qtrpR7uLAe8rure>~??SR6*oi{i(WReNEs648UE@>kWQ+$zSeUF{X%tP&68 zJ)D@uDrY}=V#J4 zYJZ}+dZ=))-<=wL>PGKvLRaQ2@-2xyuZziG2#ivvuwt zeoEn>#NF!F-XUS#&a5YcE(c4>rg^*v@bM3c@)Xt9Zl@mGhCA%X#fA^v1VjrR!Z*Dc z@n2fC)AscNau$a(zkPjILi~hP5_>@UNJ3D6DMh8Er$hHs*Lu6{S9^eF5;jp$t@#&7 z+}CxV*Sng0by-nSwuL6ZZ@VC3d@CMMwm)K+@S&3_r3@uRt@k0%;2w4x)apSySZ6{` z))Kaw74DOxgrVLM6|iL*baSgkApJUiyE9pBwve{9-C50SJ$J%Ci&E_2b^8wXbeZl* zCxp;osZ-o_nQ;&<)|*)&9cZo{3!jFn)MBL|MW^O+-uOcX#hL&55-!3!}+xSx1{RaBn81({ydf%b`QjO`|_(4sD^7gGi=onY}e3I6Db<)k? z9?#17HPWEfg5X$+CvVD7=jO1%ZYsdd@zulojxCixrMk{Qs$oUi`{BPJarlYedqt;C zDEnfq-XK(-+4OE#m-5zm&&EG2HAHg#@l|ARbwOUY#p_ds)9TP^F6%}-IZ*VIrhV@; zPw$l{vvF6ZMawzW>Q4=<9n_d`+^ zQ^vUNN|?UVEdO>&@pwQ`M`6f$Az0klTR?Wfo)(dKzm&(@rFD&=a#myoClzLIgntMI`@i;?9O z7_&(9W8Nt47E1sxQs-i4lf<2wANNtykzzjKOg-6DO=m>Dr#N1mTr=}R3Y4`8!!4+* zUft4>_V5{7*N(ldzHqTOQ@MhkF&sjhSN|#SM)pKa!1lrK!*P0A(at&QY2xkvBJr_IxdJy8!!F_p2up3%HZMo6`tz=mN$_g=%H8`5P6tq)VLRFREpcnBIc$N!D#@I5=XOSGXiDDY)a*VY zr~P>3eV?`tXefk& z;(G;$mDPH#*9${1e)q^Q==AvlqRE>^riFLZbR8ZyjT`7G@_pOZhYmFvGIg^jN3+a5 z;0))PJHz4`G8%2J3>FRDaTv;Q%}AY!YyA^duMl)wCfau+wjd{p|4L7hYCZ|=s>5H& z>ua*w6u5s9d0cF%(Qk^unMhZ0;vGpy|I(uUinG-h1eX@RVu72^Vc(CWr35yu>5Im4 z92}yuW_?T6Z@-H8x6%533fLc%n+Qapy4`2^| zZ+Ti1Mhi4$z}goHledblMc0Clh3h zIHk7*8^h?dYxTzEj-Mz0qSuz|;k#0*cbL3W%+jOZckyZ32E&~z?A$%X&G#r++aKiPQ4M&*2?ix$G9P22 zRz&4us$s70~GA!0pxVs>rt^4DG zFWl8Rz4N)A}SPA0-qwzEpV zP5YWc#`r;p9G`Ecgo=+<)^lP>_D8|R-Ucqo-h1^HjnP66Hz)k9KQ1S`>w2EGq~3Rr z&4Dj0c?0=ltx}VnGQ473ss1WUKO?RuG0MeqG$?oednyejXq)xUMyd$XP||?` zTcu0GTNDdY$w=1Z&8|FO zR*Ye2FbLWkZX08A5SRV%$=@qs2{EzJ^PUWda&GC;+XpO0GjAqtgy=EmD;DPDT{G6$ z-iSO~3qZ&3b_9F^6s#11l!I71x=Ds&ULI7?tsXsAqz&KsNM@p_=&Re}Gy^$b$Bz&c z#WT-@dZ9_=;6ra`2v*7PjRG*N2Y3W7HM~ zG^V@#SlTv%7|MG*UA!@0Owpn0~CatuUy`;r0dT^)kJm#qVxHt0f^#Q#td zH8<@)*XOzQ;0NM$*eLR;@J9KDz<1#2fR!mnlfnXfu7zd)jv!HWdE5iH|I{;G+&BAeM^%>=BgS&1+0ACY* zlZtHHH1s|7GRIc^lmO0D2i~b2go8KXYSO zJQ}|zei>~J64jU1 z`wt_z#~L`67#HV-4LjJ5?WeLmNhF9^WAl1lr>Vrycqif!6=&Lz?nCyDj<+$roR z(*)(I@}llIl|BDcJ3MmQej`duc{M#gUp^&rax`yaw5j+FpAw}sIQDN2)QSy^J0z{b zujJ0>%TxVl&%9hjqQeyQ?MMlzE&=~iy1QTh^PhJ(sfg}g_b?m8Y*)zmzPza%Ts>+S zHMe5L6K$4ipRy;RH%=Ucn%Ii}LJ}cOHexz#k~bD|Fiak49_O>)9*{tELFIgBb~0rr ztMnPjyOHNC46?r<+8@n_hrTpWT9uQl90W=WjIn@OU`lZcd(cY?O}piJjSF<1C46OxZrFsCKMtdoGrT z>INF4HOFE_6i(Bep0k@P3ZdEIQ`0m|(~?e3Y|QGUG^nJ%K=%E1$|ba}VXtdOJN*b3 zkjfZcj8{{6+PD|c!CS^QNfPR_`@=u?i!k4ihCE$E)J+hB}B=caFL zu~?i#HoHbx0>ydUwu`e%w>7QZWmC1(>o zC;CO@wOY&{pQU;}$FU8K=px3W&IUohNrS!E8LN1Fb+gzXsB`d(v;TXDXXEFTan?rI zAdyYvCCvpqxd+b6( zf*W_=%CS#UxFdn^t4Pi2ussU5K)~@{t&x9gcg*_%*;#NPsTjmNcb4KuXXKk(OauN4 zNxE>PSq?s8l~&@K5g?+Z?#(Qk{pj%13BIfA$mXJy2UA>Bmc-W;E>$z#jL2^LF`t-7 z*e$Gh%8cQqZ#bdOSfxVta|%;>O}E17AaO3gXYz;_Pl-iRiro@5(sfKVZB%oEImF*# z%R94}d@n+2hOi-PFz;)wU|{kg9%VIglfJ%qZfLdG6baqkY`6cBLs1T|(eHw{YP!#iEcZJWVGqOB-| zrq~4vbPCft~UK)PoVIKTAR*QE1m;$~$uQWvhIGHTe1ek^V z0&86262Oy9iv2AJh9Z&#-l~!Wp0c&(5gU^*yeSAim$vA`p`LKSgic9Kf48N4h^8Eo z;1-o-trkSZr9*Tr!3J9l9xPqA>ncgDOYLG(RwF^hf&`~%me)9GKWu+d^v~Zv zU(1I)RwRB-!RYJC$^RKNvOgf&GMG%;Fzf)z&y>=WLY+%D7>MWDnAEJcP9!l;h01<6 zRky6>uR@agSFzx|`yefbe~y>Ddv<&0Ir^jf+qYCdAB5-QBa#7KzR=?iR0Xs30nBc_ zy2s8a6*2Rve^?7JuI3 z4*gtS9ERyOn*2w|ch$}b9Y6T2j8IqIw6GfVLqpnKFsMGq2(fdx7oFs8Pn$47N8_?I ztk!~#h7Lc*eD>VJZY|jNGAh#Ra8b?3P+IX$q0BPO_Vg&FNisNOcB}t0QaMv$O#nX! z15$MC?cD4hHRj$xR%TSS3xRzdy6$>KezZIWIeLHDnArFO>def#jQAU?d2zghKa4Fu z_(9^fE}XJD2=C_E73kCAc_dXDg-b_dOEszQjm2Zc(r@7Oqo-aNye7ToiuT}s_y?oY zB{4Tw(#Z%(%Nx0zkkaQKS(lygNWed;7&DPnFd#9I<+M;T*F&`T^M+Kd_InzSbowcr zE|DS${ZqNu^=*#`MEgN-K)v3fd{ApBSu?g$#ufbwwYrA3oTvifv$0PY$aopFBHWOa zEI`DH8B=X?EQc%JWxRiEEHdpJR`ED&6h6EehjwyQ>Jf1DEkO)JUph$0-uaP#A!(x< zdb;NEnW{bcTiwmyoEK=mu^Z?;PvU%PP1}-=!*HlZNjd#^#nBG=ma4)VrWjT5IimN6 zjp6(z!)(AWuL{VnK%3y7L4i+`y}N$BS9kU9bCx$_3NcA;3PY3!9QFrRPLCrOu5&FJ zO-0OTo++Yd>y=Ck5BGC(bKz^a6ZBE~xMU>pg^-zwapZ^a4wLnV0 z#r3QHi1vvF^?jVDX?31Rld_Gm!lhEuDW0~FORu?^n=W5TO}3Cm(FcnJ@vc-Op3Yu| zw8uc?TEYue*%uu|mUc%LMFlxHV$8VG<4BCPl8~G$K06hgDT#Df3WiY$$_Cu{g0oA$l0@YqB5bI*M*vuCV`tAFom78kj+)pF{OqH0>l zYjucTKO*Gap6bNzZl$?DB-J$%@bu9)7{C%APh5^)Xiw@v7enMYuO@FO81$A?B2bbU3(4)iSH#4n@F}R z97Mh!kjCZ3+SzOtF)~8@)q8lvFepSjS9Pk^ zw^69yzCH%MK89Nk^UkX;^2{?&i!;BAfB*4ayxs2Awk6k`MKFk8&NmuE!sRD_PeoGSP6hq&vPck$HLWAp^n9XlknP{E;1S{9c2ijz<; z4*FQA>-iY+_(_(aQ{Cd80)qr<-cF7l+d)&Ph-Ir*QSGvV&&QYqB18RMG#uE@YcD>_ zb5B0Zo&RwwkGy$+Hf0c1*%B~I^)&s7L}bvMZlq^qVrFZ+t>eEGlo2(C2c$k883YaN zcC?-McJYKfp~?3mj0pj*b~guAR^9 z+%b+FZ^hfyM2`eoo|Es2jGy7@r=Q}EFe)%X$BiF-N2%P2!~#MiZ_n9F$D%i79$L`pJdx_p63~<)8h}_#jUqJ%Fa%&_8JMq zD5>p^L(;fN#7lo?JDoie9ID;mq|K_X>f!1H(dUsN=`$6qM#b?ZgS1ceov3v{ZSSnU zOQ0K^G-2iKYhvHqs_&lWktbhd%kJY0j0VKXkI*Cf)G`o5L2VxC;%ocPHqbOI1OhKU z(FJpy1BW6DQl8N)#6d=s(lu4~WF6I^V*;VTnD)*$wKQKnI~GtYPXbCGBlz51oH;7~ zW!Elt>_5ht!4L^)$)qCoqJIqkz#vDD?BUJ#_S0s{q%_V)SC1cGa|7*zVr`mt@!~u0 zvFB(fF*%jwN4hxPC&X1WR$C^m;|mDsdGVR1j7ruDv7cu>$cxTMw0R9Ar#XqYeS(!6V#|X{&r|^D$f0spg^<<;j+}9ejgsTyTGb@A+R-v7 zwowI0N>>y)^mLryoyYIz{->Ve)g7mZt6R_I3koHWNv6DZHnllHPQLpL&%g2x2by|O zj|XaOAnHV!RYf$oqJ!_ z{P;6Z{+fGlyOoDt+CxXkfJuTzwMhy_3rWct6lbRqW7RzEhd^-(@%JZB(i$nCdSO1v z;yeAqM}lIr6VozD_PcR=AuctAM61+i)Q{CwOo1ziyI1jsXp<(tZfe55Ph59O5TT%c zh;JPo75~}W%Hi#=^Wt;Q2CB{lj*HlMD}yJF(kKBIz9BsBKH3`&vHdmGKacU?owsw(W3O_kYZ$+j9}FP(stLP|5^ka$tkD>Xi1gkzZHnwrm$-v-5F`-cc5XOkTl(Z;pe;UYcNA?1yr zwjNOv028k@k_>nTI_c=_)9T|Eo;=Wel&!D5z|&7X$>R^+#V>#HFk4$aVsE1S@6$rt zRA%?Sla$VwMRjojg@xtRR1}kH?qTn)eVkD5c$>7-&X*lZDH5k&%H=h&v=2qd$jXy8 z7m#Lg(>0`K+QdHD;>jwhr7|yGyuKY*axB47>76(+!d3a0hfZ_iR4aoqMa-R1Ozc1# z$4;DJ$dXBUPQv(xJSsr5Vj1h@O!o*_Vkn%mo;l`2JofHcEm%;7M;YsIz(VefWz^?- zIk97_kOwP{;yJ9Uut^ZOkH*1KoS8)=+X8gCecF0xYuHO){~&Jl@U;vi^_*c%Wezb0 z8!5?2#F+yOs*P@u;t8{n@8u{53{2^k@8vd zC`&QW*VxK{FN8BKi=YV^vBwuM zXU%LP2cKZ;*)ZYwZ0hFCqIB#Ouf2N+Z%jHB1zC)G`WO)7t_HVpw2#(aFQ!-*#nrV` z*VZw!x`cS6a!3J!W1}*FK4jNXWuUDYOq(w{?y`wNkhW#cX4%?W@_Yw*;>A5QceTkN zp3cmi2*+F9B4aByaaP8W4jOtwxN@qPvve8`PY)(nDfQD!Ns9Edcjqn|JvIuslHSl5 zBc4G9x;yFY9TGVXisR3sB0o)Y7(-)97D61n;yn6BFv+!QYio#eA7{sjF3qq-o!NO~ z5EjRqm{G>;nWgy8>|jqrk2shM9Nw1zDj0NRmQqz!$*cv-s7emtmH8Y#vFJQq$83 zG#+GcbCB%HI?D4*47asw6PKms`J`IPtuzJ8P6+q;CFv%HsxjZ`*E8 zwvOQ{t)aTCn5sD|Sd<$?h5#9{e%kwlH-@~#WzVD}afoAWqY?syQsG&BfezhJ6Q4f5dAiByjK#W6i3jsva6lKQaJA0CT zV*xeOibzT{V~NjT!G;agI$C-Ag?BmC6T{5S8%a3(EZa_v5{^lsP|3#7%#QtixT>d- zmoUtk!v|^gCy`T8Bfdu3b@(tX!v?amvoSL!zS*z69>x(KqOI30G9Do)yrpth4X)u3 zF`3!q=H-xLa?|aWwrBxQ45`KS%qUI7=dntllPHmbhrtn%lQWB~6o>XKoKFJ47-I;} z@F2bY9!$w4VrR05ONb@0bOsCRr&EzQz|Ob#(JayLMX{-j;+^7uv+5QwGjogsZ@tP} zyN+_=WIJOb*Su5{y^Y6c@>)e-E6BCR;7CXzBR59^#WCCxJq5!O=$T?kEvluqIE6^i zPF6+|X3@hwcZlS?GODV}shF{trKNH74Eag2hUj%m-w9WU7{icQ$%e(b_(w-M_U7xH z_5`)bjhKW~GF(acyu)|`MqeXR;ixkg&7(TY$gy|ckzg|{X)`E^ z9pd28Q}lZR5{jvb3>7qZF*-6R&PviAZyJ?&!)`TW7>#m66$F1;wK(@4!o3HZs1p)Y zlb=auMkg-As%F6X1}m?YEXrbR3~hP98o%_oxL+f{P5x5T}owrnP54 z0tpkz;zV*Y)1~Z8GU6mK>*=OP0>p@#of;X#=925CXNX~mBO(D*qk1vz$0&w@Ansuc zGcH+zW6u`$^#!ybRi#*C5=cmZwgcNa)}$h{L{eNajI_7V(%Ow%WR#GRLyp$oEOMP@ z2Ku5eK{q92kYViO(1}LeUWsHTAOqiQjUzeDLGO|69PgGZSsfC@#$oI}#r_lR^!E)A zj7=q{sDSLWRI;VbNroZLwDx0+mmp~F94cfWn8E=q5KWNax2L;HoQzM}`azA28e^w3 z1()<^Tv7_@Vo2jW`LNuB+_y+ zNQ{XmB{h|pU=Ig(@8H0x4o3W9NGuLqBKwR?2mT%jWV>29ed;ugVgNFy&7?db!k7d# z5rY|fLMd}*q|zbI%M+8&v{|*J`Fa^tTSJ+WDHfuTo$RHt@eEz%$PHsl5DZnP8p-E2iPhBUqkmGzQJL}3|8W^^2JA_k>YP= z>lU#?ErSdXy9suRuI6QvlT}D&vYFA-+j-`#z4VF?PmM z$r0NX8<$A3@CsL4fTrCq@SClt>Gc?dt5h*_o&;Y`ixv!q&GBT!jB>iEU4j=Yx{as@?t82+~Imyb( zAuGv>r>~u}o&AjZ%_L<=;FOu9-G%9tfV88rfzyqhANpc?gF)Rf@zUGbiPxSha&(a_ zWn{z~wYw$9n!D&}_Yg@;CATzBNPHIA&S7@G@Cw_Hwd0N0apkAuJ^da>+x-$i*ojMw z$2{1?QStNU!~~4KE*cw}==a-+PlzMNKS0x&CR#dr88wQZ&&${3n3W}UPYBZ7CS1tt z!_(DFw*=H>xndKt6#tW8*K>v=Z6n$Zfbdv=Q3)iIipqpnI!R41;qK|6xqCqPTL7y| z|rEi!C?#1)6q!7*=BmiVuiPhoU$|I|1=!_PSGc~w&E)6_v0H4k&shB zmhiOfWE;au-#YwcRn1`5%xM%Ps5{(a7=_PfT8B7vrc?MtNCt3(kmPmdW#Mn!$9sFu zGAbid-OcrS#xNxcH^|Q=TXY61~8G2ajA#Z}Z#ucSbDaHi6UL=XF4dxM?AWj*6N z?s|p8Tk=ZDm3~jpaFGz`u%d^;WmTQBMHWd$H>ZUgMmLnyPW{AC0iodsKlnl9-+p!* zX`+Z?pF}8O{3C<(^z=j@PS(~kUPO>iHz%Z%krJ=%q&k7Iffky3)%{_Cj4%}pxnw}c zo5KV~hv@0;XCx?2JRt@{z=Ov#O2FhGDKQq4f0W^oQN{x5c6NpYiSbyqt;3|KkzP?& zA@$-cVw2Kv8r-z?33-?V^@8J=L>Gy6Ar}3;j0B9@%jQ$#j0_LB@d|M@+2Tl%4o|de zouthybxYu(-fN}q3>j5ml$JqCf*otbFZp`u==W%M2tOJ!2#j$o`}*HW+sv z(yKOwQM=^Dk(d-Kvgu?kj2si4_Tf>XV>YnX1eL_$uFNlqs-&56w@>FN%j zr;pZdw*+1yhxAn9EHY5TGT0P3lIv=+7>(ZHeLo~1G}wqwO4b5TtGeSYdOh0HL|d;% z`X;(2KO8iWlvhBS!>pB~Zr2BfIyuuhf=va2%J_)RXv=a(2IQLkcvMhfv|tlQ?Mg|K zpd>5yHf%-Ar@Br+ITXlCCx*(t4}kc5Zo9d_!dA;8E$AHCgPA^mB%lH;+6UZ_WP+<FiLwp&t^+sc|a=Px%I;-%YDp!siQUt5}SQ+1fksEE;c);OiG&**B(Iu3Wd~gIqb; z2#t~e(L--fFMUF^jmnp&rje59&^9tNh#Urm!}ThgA-(EMmB2Sa+8UI=c~AmGt8m4E zAx4EPT{MAtsr0>4WGp>#+EIv7db+ zCv}%kWNfmDj3r=KT-g-#(kuGbHQ*;+ar2Y};l}}Om6Uqtx7pW6LwjFzHIe)=iM~4} zV6%+&($%Z(zDm6`J+=^^>>|Y}++GH?+7D!SP|k4&iB-#}ozid8=c*KAV2HNXZakAG zHN>_j<>cXVs4*DA@9yGk*Ra%Ac($}BvoIBhTqmqJbY~a+5`Y>lHe%xwi8cCh4~5aNh4L&Nqbf?%9C5V2emt%pBCT${`aE+;ZJ`2BXKn0^NJ-Mqh82(u`Wwd z2Jw9Y)1Co4-(Kb9CuE`=uzE48GN#d27KnV*fLDe|-KJKCL0b-~oWJCo9EGWes};$V zuj;v{u#}<<*oDxpr|gyX0&O{cdZju$Y{bRb2bMO%ycW&QI<-hM03zDXE5XE~-w^wyO3=U*0-iC#iJwngXe(df-`m zc22cN4o4q=jwYXjrb)M3PNX~q|`JJ1o?BB<((_IXU zjW9cFnOEWAtp^_9aPGDI_v>cR``UBtc8fE!q)=E{L2}<~JpAx)IO(xrRL^5vSZ}$u z+Rad1Q)~Z(9*je+r8g(#G4s+(S(4Dh_Ge$^z19JOQs0k~(ia(%$K(Vi_fJ$57KdunbbYr4yNtZEuvD!Z!pAXdCx(nTiS{83oyKPL-RT*>YxO|jtP``uf zxo7o^mzvrzo3Pt#nm#JOq=LfG_>8qWU3&?$=&RCiwLC0paxS>AjxPwp2EgET?jW$!U}8tm<=)d&spl->uG3{iFIuf{O$(|f>A*Q| ztolG?bzvW9x;*)O<>$}ooRU*iFT&C{>KVi-Q2nRI$oS8RylO+oDI7sArk>5!_`h}_ zTE}R)qCfIEkIDKrfvIC~g10Cr?h+iolQ_A)3hJ8Y^-()C2~j;iU#F?%ep;Ll2!HaE za|*5FtBG*XO6shQTv5})6A$dBfBd+P-v%;JEe;B2uV!g!ine2=xFTVAVY+s|%GRSD z_>u~kw{#tKNj`=HVhSx50{x8~-nNB99i!UDF`s2*s+lLdGnblqHN{A|Ic4jno^AIPv&|6)=R zp9FUywG3QrK=iJnnuV5Qa!9)?A?K=~P%Q~mGsG%jjP5Y1@~HoH=+L1U!e`J}HFE zMMm9px3|#L)D-=+bV@LIe!0ikUwdBueP|t)L2?r$zlz>ky302FY)bl7>5NKB0@T+A~(YzSsiyjQ> z_}nnQEK)uns8t&0`JDW%R+d^`r|a);1u+KErMBb0b$lwQC8ug7#_x(dewm={GP-^H zcI}6neLVM32gEsDlq6CarpaxUk2F@Bk&WX0$FwDQi5V1?6_e@+;2lv9UQf>RUyEpc zRhNC%3Q7LNYE~}FV4$&QJSbFhkpIT@VB#86W%av61e3!_QQaaI&8ed@Hw6M7`ql17 zp8ykmeeRDz#YFY{Q5%nN{^m&3$iYWP0>)+3RCSOx~9&t+gZ!cf9?%Woa zMsZas&WH!ksM?4n+K*paT-bl|QHbii{1y-S!D*iyimYonCEu4?RyuxXn9!Lix;9A< zqo47^>d6-M!(x%(&xCqL8wm#0j_1m#gscX!HbyK#gSMf8-)zJbGGh))aA=SdP1@T> z1-f>Akr90sZM@$n+Y&i2m3ydzpU~c4m{&Xa+xZHEDVFqta!T?N348h&@t-eG5oc3E z8l`pfSTK7Ab%n_UeI5oppJB>a#z;8EMNxGvrSSo}d!ifK{8m~#SsvPf-%b|43n*JL zMISybB(FK6lKD01gxy1osP*L+C8STsBi>K%!?i*80lE+&6tIy~zmO%fatQYJG4!FY zH~Ey9tc%+9FR1qi`G_wV&b@YG$DRY^&sfRw+0~SnS5Q$_N^Y`^G0y<*(eqoKUJTIQ zXI4Cq<@0AzTU9}Mg|xS#oJ>T9*Ghi1Hb&G31s{rzFLIdsw{#G4d%DPpN7Sv#>0_RF zl))G@Cs9x}g9YKZmq`DWS5lUr zj@8#m$6!F)EFvMNf|+v{FsoK^k4nlVJ%$kmhkXP;!aS>8LtPc~Svt3#s!FkOl~s~A z4SS%MPPhMK{MU!WWJ#uC-f9+2OJMNKA=-u~aT@WPrr2b13QMW1pU2ASISh3*a;glj4Uv?=A;=0+nzlFf0%{)FGgmjziBo@zN)q)vRRaJ?cU0BBY==v>W z@t+A52wEIYs%9-F$IwR0fO@Cgr?02l5Y1M*j&H6np!eu$+J{E9RRtFhq;CyY5;Dt~ zJ$D*;PBWf?A$%V-IL4u5Y>i8%eA+CstOIlns&@#hY!msy1bp$rbHB~EFE6BZ+aAvJ zj{KGr6A}o9WNa4I$he-v^lGv7Rn-(F`so=EF0OXA739oZOTBZD=HBQ#xxa`|0ii}~ z%`x$mFT09Oiz~^=%_l!Um#j1=4y)Q@>f%Bq6dcRaBG~l9!h!?ae34X;rb6 z7+&>moB|fFzk+!saj0l;Vz(i+gOAl}!)j4GN0~6Ghy4`+h!!o70<`nT(=Lb_w4JJy z@<};r%UhK`VH4DA5GL*rMf1Kt*i^fHPNbbva{1pHn?TjV4Xl}0L2{fmn)kxY9|1L^ zku&Q`u9^{I+v|JjS8|YmFfpx~6`L=mHX}l8dMOK5u4PGm2}xG9-LDK>$s65OFDj48 z69>_|UaGC*@=%|1bsBH0oUh42?Z_m*&*xSZkaNb%J-6GF919Nja^$TidFrEI=*A$f^07`66DAg%gFWE|bdLG_<%rF5$} zWLu0Ki&^S*u7AdBtm-=6o{8VlUCGY3XhIHZN2>{WobMvl*756(rzu%QvnyFhSr^Je zVdA>#+zaxl9nyTmot$duB(``qbF1>TS1KqS|1u(K>{H0d%3;pB>$!I0VycSsNOw9! zj#gZG^{l$=5*AG_prEjb`X#H_xN()}u2aJKsGQC_1|=iu5BVKEqKvwg?CGmmb@>f^ z=aw~8sB*{qUWbnNLG;I3G?$I**RgElwfx~tOUVg@P%UOS=1exXKl$F+V>E=}| zsZAziieL;|h1Y!1XQRHV5dUGeQ9So@@x|F>=a-2cx>S75bkZzALIxp@rL$PRayheW zipW)Zk&~&tD(V8NFco674JI48b1&nDOBPX5RG@K|e94>aFh_0rgfCEbP5BD(CFlK1 z6cfHp^F1n2xfc0jve>ZMtmD2Z>i1N2)cK*IP7c2D1dqP5jfQ@;0g?*hCKoJ)jQh4| z+3#C=|7e$z&l))tYUmrHR)6*VuO9cu=hLFlcATF`SMnI|1UX7< zN*0SR{|0NS6C^Z=?glwIc%8zf-q(4P+GC9&HpX_Y?28IY*RAp7R4roTr5jndYA%H- zv51x{=|@jd(p3F3u2&l8k>lzUo07wV^;fZ?Hg&x3)i@ZJliK~(7NNgkKU=pRq}}6J z^EcyZB6}%wvP36zVdB{P`$zEx6VBXeEM2jbIn&E2EKu=NJ~^og(N{re^)ykn_8VNg zC=ZLo4pE((awUyZM#rBT!{@FzUWbWt#>eKltV$oFV^7mHrBCB2pB362!kzmMlV3dx z>;7NyqX*t#@7{eJI@L_S_u{%csGtJE_`1uuBIO`|`?LFbbIW#i@7~Rk7LOQnD_OOR zSvt3l>dFd|EPgCWIpm3>9`kqz+S4g5DW8RSON#o*7F zUQ1^-tuIV!$#iPei`a8BDW6tH zc~K6rz5xb2UhVxpj^s=#>gO}Ps+7`#G-ASIxQBhjWS28z=4|bS-FZ$62D_8o> z4?!77F-ani+L_eVR8v`!iNg?Jc*u)C7$PROmijyy$m!)wudSBgyOgZhVcPq=m_&}1 zbLUg&u#!J}HnnBNWG7qk^>pA4it>w5NGYmg=B(LNmlaZ&6_0OVF#4_^shN67x!IXV zbxAJ%j-wnr+o#p|Lm_PpS~93xTtRHZyZrjjM|pYM9vWk&bImn#v79=K ztC%~jl#=2iin46vu zBZu0WLXwR^?R}LY;whRjhx*z|N=r&8tEix~FbA8riLN07vB~*NU$ls6B}EjMmQh(* zMNVP_&p;<`pMkW}8O)qHgDTOz{0s-)zClLDL%i}p@hN&` z%bd+M*Dex~g(*xNV)xtoI6J7`Lv(T3KOLVB3??Vl*WJL{q!AAF#W1gMgf|~~mo`N{ z#d#-Ym69Jf!k!oI;lUTSvhTnV8ru5t34th?zn)dIis{+%G*3VI2B+*ZS+t}GZ*K#g z{SH=q?faCCZsD=p@8^yE{W#`rW?7ksGyBid=No4*`g4R|JV=+QcSYt@mDBs`&w1eG zqx4zISh1>tk%L<}=C+VtP(e1Wy!p(7Jn_nQ_8mG(Q|AyLw|K)~v6C}xG1JE0<)3eT zly|qi$L<41wL1=ql)4IQsVXTXCntl_y6IF^6q6Ei)8`(>A67x1m4dpZ%$`;*J}95e zWE-QMecFrGvr4KdOt)yyv8I*QQ#nai~lOkiDj_0S9^!65{SAhRylVyv#atcEUTfeJd<$CLALL2C7=RB zt#zLq+M^H&Wvu!7*H~cO!{hfpz%#FJW1rM1XpYC?Zlib9PF9)lhuJfz5I5@64$r@FM5tdtl61KoJS4(T6hM{yzfg}Id1)=-q0jKwE@V?_Lh zxYUHqBC4m)Vp?UHl%0xcbVPiLPm_lVRLr?`tejIvSy>51g$20iro|m0y=F1X=T2i< zT^%lyn_yfXW!XuDyo2-%jbV+ABd=m6_0#L9D$OP(#>j~DoqErp7!+IuBD?8Q-*VxV zRnw?T^Rj>2K`HyonV-^QFqEpjVAC%>i9&g4wG{mrQi>ftO zv931E-j^QXi5K2t`+Gatf4WOsc@|eNlLfPCm@#(=#ql0I=2VIcW&GJZG;|J&8Mly_ zUc`(=3#iffUpDb!Uvy(fTP$h$WfbSQaOIU#Q&S^4lZZjarh7!K&@+=Ral`cKGTs$W z&U7$3;1+He)Ohlz#knP;JNF%;uzoSQp5456#)s7$eIJW@`1gx=`~A0p77*5~=aSq( zUfp?8d-+EDKsaOI~QQYEuoH0tX?KtD?1cy60Ed=D_`cN(9NSyag{$x=H_x#6ew4Zw)ih6FY zglTiivATP4wfmOc}dExV(rFF zOe@YJB_)}%+A5r5{hVp*#;2CUO6}~a1x%BH>F+%D2?N4(YUWju=4s*Jz6J*H(%v*i z{-Whng^%&x(RPw*S8(+ut8gXQak*U7&6|s(>jVd-PR^_fW-pnI#E2y36p>d@LP4sP zQPGQ_YdR~|%)u3Erm3lm!L+&DaMfb6e7&5N-;R=HTy@2Aa#EeRQVN*AVG|2;q2b_G z&JHC|zv6l>Un9Y)C6a;3!Z_4IQ@aGX;ygoMpEyb~}A^fIPO3HJwyBkHPvsiK2Y6`m96pK@z zL85y1mPRe>j3ky^2Uh6CVRLp`0aw*NnJ!wj5}d zz-IiNz2N|3J}ae5ui?h)Hc*plBvy1Ld-`G)x<)v9qJb_?ki?>yEL&JlL1r3Rd3n^- zRblHmOJi?{wDLOYs*6cah!sCqAilhmytn`Zt)29ZsCR9Kux3;;uR;RCmWhBcB5qXz zo$7^b-nfSB)CA!?$<)r9N6Nri4m9^;usWz+wu#GD%q20_iYq;voQzn8Pw(Ts1D_=z zRCnL4B;+h*^M+K8J$MJNoKiua_&JZ8p7vIHMlBlGSby0nYKzlJic2DQ=4__LhiGeP zq{o}eWqn%$;!_Y4w*(!g48w%4C1mYSiX8KwWWEu zgjc3z<&YE8&+aV;Xt}7CjH#tdo?D+r-`SJ6Bf^<%BQy$+Qh|;kxq#^_FX56| z#abUECM99@ws5+8l%$e5%%4_Der^^Hg9J<>~0ywo>s<^%dTWmribH)nusl)!O~^Rs4C1NJv)oC z!fcG{CGcG%GPbIOd!%D>x6s);q%9Lw?-f+5n&M05vAC{;!jf_=aP>wUq)H#!M_br^ zvY)t=QkGnD8Ovto5f_s{PDLf9X>klUo~0}7plbP5T(!EM!h8ur(~2Z06n!)g(A?aG zExU%5t5;KzpDElhnabK~;mLh8wDm@L@~2dbb4x~5ST3dsmk4y_ie)TYJe%smbYd=A zG9<(@v4D9C7PCw`dD+sXRA(3o`@I}~?ic+0?q9R(cr)9c_!)oyPe0}t55L0U7K!GS z5stNE@O87}>AU&qtxs}%)Imm8CU&Ef+BH`(C#i!spSp`*{py!IyvxjzE0>DVuxWR_ z)U$qRdBqs_J;Xo!@LzdwOApC4GbxV^iUL8b81wdBFLCSN{Ug74=@bb?<)kMj;>?`J zf`xVX4?V>lxBilQUO0-Wa5}T9G8sAWDv#WA8!v1>!O?Bca{JHznZNtj+jwHjN&FxC zETPCD97pYfY1ob*_}*{`v3u;eR~B zzL8Yw>Ps;NtduRghE)}?>+zrQAHTeVr}sywU$uae6bHr++YRm0!eEjCECE~>q~@h# zwq&vNmTxoN{R(%9jDPW~+j+Jjm#e<9oDA)n>UkkEo{nQY`LloGSHIrQkh4?*uzV5> z(HEzxicQo_&2*{n;joSJsGQRb0UOZ}L_L_MVCB3(gBQ0Ls(x=gIfePeThy+GpNj;)a8S#7?XmGBBqWfT zkxZO1z+nFXeXR{be8Qv@6q4kKBQ-mhoP;r2P6$~SXPi{Ngym&cj=c32hgy2ISFS`i zg@~4`L&t>(huV4T-sd>3mJy8~(;((njZ39J=J*WC>lcepUBbdy)nq$ku_U;#C4(>Q zA){zI3)XF7)pRQsi^{cH=3(tlgxaCp=FFpZ_7YaDT+ICXaxxNPrs~iKLIp!+V$#c4uvqNX z@)azaqn@!EPZj?Yn_{5*(Cggww?E{E_wB@5Tti`+6Jscd%~ih3wD~XqK)lxXKO}NLwH@NqwKjFTYPhl&mqbfHAyWzw9tqNq5nS1p&n9Uv@zwcIl z`O9DO=%HjbePac=(pY;^HEXZC6!Y6Z=7)d(kNo4W9^lpELd?~=>CXyPSE*N0sEhV9 zYIoG};~IpB8&jFSemygVhrRgkf6w3lar+-K0U^KtIJ?PvV* znX_cfnMb{FWt&taZT@w9qk4pw?)w@4^3VUwKmX__-2ZMj1V%Xi+|T&&FYjY_;}Az) z`nmY}f8bwkf1Dks28c_{WBP)nr*@Ea7zGsvC(spzd<;1N?s00kseMRZl<{}NPK1jhDJi2``CBZMDdIY;tf`usTpKBLo^*ZN{=x|#_K|g>|MP5>!0(p zyPxC8h?8k^>L_seX+8Wl@13<$Sig#OYu2z~X+1gViQ0{(zFkl7i+}qOFC6jEwc}xa z^rL^~pMLyr-0_y%9;2fp1Z`H5tO+D0 z6^T-qaHJKne8ozp6{cadn{i37m@L7U_Dq`?V71;@)mK~luDs93LIn+}lodMZ>T1?V z%oIqQ&GtAPj(EbO{X$}_n8lz*j1Dnk*(5q0B&BCFbM9hh6sBTyI7my3C)ujxC3WfD z&!dmM#i>Crq26P>{pvd$=?iGj*!YKgIrQe!92|+xst)@7#5rP!G31h+oi2tULSFf7 z3Dy^p>j)8uPo^N=h7|p|Ks_BBk)SX-bMGe-JA61^D}lL?f}9jWW+Nrl^H{cc0h#tOf(a=UI4qb|7kfK7 zxb1D;*we^}r-Ng=x3lMT7oPDQa1}Z6j`|oF^ON9o5pR+PPgLz9gDp`A_>5(&SiY1M z^%;yd9cK6OHoE$|IeoGPe|#Eg37Hh+=Hc+Rar8(7ZbvptmQN$0>nM901~FPCS#wynZXL_#){<_w6C9DiFRzvb zOXjnGqJf~;*Eq`7tYzb(a$JU1UU=vYT876kjRn+(q=X`$#J21B zFN5^I$>E}E#X45cv2*H`S2@@vzS9uG-Fa49DyE*vub(rYRU6i`WJWnDw&-*D9}4AC z#3xu1CCC)MQdw0+c~KrIvC(9s#meA`9c?Y5`5OhTO|mcL0-}cw!GDVS$lTMC_L!5u&G*gg;&H0Cox&DXnuDb zB0IHVV91$8PPU1@lgDXl3t+Wd@EqF7{((da3gg74i!ToZIQ90E?CF&NQe-eB+`}&1 zC0@xQ;G_Nc9uA&5MQi&MOV-xi&{0si}#?Bs!^?v4FWX#l*#0h)akk zEvb;)tQfkRPt)5yq{&cwhD|y5iwtT4+bRKYeqJV4-w-3CeRw=07?Lu{&5p-nvQvTviqA!5qvRTu@g!M^?#R!m+@nX%Asp)B;JZf%7gUoUlR$EM z9*O>D4jybKC>+7%O2Oew5FR#%1@%=V#aW3FK9?n&b@a?0p1%K=JiV(EvuhS>FT0%0 zmo1_w*&%fvf9_M%Ud0cJTWEEb3PfyiBoyWn*Sn8hhexo84H#`{;!K;D*o;(?9dc4& zgtntQc;%f#bPe{(_g(BbaEh*A4p|vV80@iB)Xrh$vZZ9lihoEm5L_t)bjn0tQ&4H)?gTMXZ5BcHW{|mQ1cL0j!u(&>t7I$(%s4ah zC@d+Xw4{_$r<;9m?58CXKy4wern5pr9)`pqSS%8RAAgM}AAEy`QE?WkJS~_LqM^`R7Ocj38k50{2NYktfhxhQE+vp_As+iDZ0Arr`}QXNqbF#5$R*K z6z_dGq>Q1?M)n^$hP8G*mo6xlU@saRsfTf`F^Od66;oPXK~+H>u z#C8ebPKz^=0UYd=Ks$l5Ih$FsY#r-n77^;)&yM5W;)o>hRDohz9z|spl$92d8#~C6 z9Y<+XL9DufUo9E(;S&oJ4z{!Z&6jy|M*{-^t;W$h$)C{J7(TC;QEC5|79wZGVWR!6 z`f#eATkHv>Nj`a2+~60BQnl!q%!k%C1DWN)I#8ASB`Tf8ziB z&EN3DpWee8EhZ}G%%UVklE;#nmX*uE@t63;-~WWij}8kNh+!-ki^uCB#;}luIo;g% zZ-2+X{p>joTJuPk>v)D`JS)A|uCC(?31yG$iIgtBj7wI|!u{6$JoDCZd=gX`!a;hD zyu-u4_y@Ew^N;aVuf3U@E}KJTd8ziSUr~CTD)k(c|1v7BA-UD_hGzM$ z9yd|CJ@J|Fx6zNBDqJ8UKGT(3LXqY(ODIX`Ve9jIX^)ZeBwBU&MCH6N+k7Cl4qj{AA-SM*=S!xX29O-LiRNZKmgq*{XE*1d;0-q(-M=)@5x zeJmBQ$_Sm{D3jZ&zD0SOx?uE?EG<$7m%bQGz2aQoop>g}CXSR7l^?{^ZCKp+Hn2`&llgFAz} zyAN)IOK^ABK?e8W9)i0QTn2Y{JA8Y;`#sS65drsbBqfhO_I*!^@_% z&(CW@YsmE*78w^mr+MR18uNgb%+WA$#oyUeY+NkKZ+M^c(z@j1?_AJot+YRUj)MD1 zLnlkl$A&<%o3XFTp$+vZV``kdprNmXmT>y3+fq?QW#%Zks?1q*0$kHLh+8s!?iYR5 z#4C}RwPY?68d3I(bo6w3i!fyODq(bn-E3{~miT1399Xz@4sn8<)uM03t*L3BFqV;B zyQ)_5D;NkA= zLGw-5A{9JkM*Ck z+Ccead|L};b~NgA@*n_Nd)dN1XqPMpPoeE&lFwaVb zeu4t4Sf+oV7CF$b;|`INB_-j5?3Jo9lC=lAICC&hw?+%g_+K7+gmRx?;I3jFbp#W6 zrg=S0a95a?>O^>ds+h)bK%4}!-tX-l=h;qwGg*|7#u84_mB@#SZz@Juuu>+E6HNWaO$iVxfyCtlNh~Ol}+^eYs>JZ$39^?ab~C zP}n5iaYDs6nt*p|-4$%rxzq-iKe8-2hrCYY#GluRUqT^#r=O?*trNIHdxbd$6Q%U= za4QtX-5)>z=P-JN0wa^9<7Mw3VwIxsVsGw1FefWyMP_FE9;x}sleDP)ar-xA7H$r$ zbEGW`^Ydcbl4$l!s`jU1-wqy0RQiXM~GG9))9exdz0%1+Iz?VMUc`g3zO{C-o&JvLsDED`NGe;YU~z>@(_o zwQO1whNtAt`yC%}B7hWvhY4w_%G`d1P%*AxccNh;ToYGUcw71Tt!Sp<-z?v&L&;kd zDSSSF=nHpO8olCL(H{l7x^3$=S>n1{w^UrOc?NkKRy&`f+d9{E&ottQcvUV{taLp+ z(TZ{DKYdcFc3*b7bPIgZuqP)EFOTdpjl9<~^F&fD#Wi}dmu0;f2k*)dHQ$Un@?AW8 z_>9y?ea%@>ZSMV9l$HgIV~PI>s!7d+ysCDNeJHk-Xq*q_B_Om@Xt6;ByU~yj;y8U$ z`&ROuO3BmIC_K6G(P1!LyL$+SF0DEM&y1l^EP_>{tM6{;u(t= zjc7be)RGSz;G*a5=W(Lkev5qEd_|wN`X`Kg4QpjmRH)}IZG51A4^;@yhJ8_=nKIWo z!iTp=cfEFlDWi6h+Mc?J4QL?T4^9Up#dc5&; zdN9l|W0Dx@H|&wKvyBfC;DFL&6vDk~hOPZ`CC+MUk94Xq0^IQG-@%Q~ zMNdDDIUGVGQ-`F0^&dGM*Eo5_!03hk^}R|2^H20+FZcB2J~kakvP5pr)=^H8p=9#k zw&Mb@3nY0^3ofj_(H)UZ?oCqDXeRP;a{l10iOJ{|K|_O%Rx6sV!XF2T-J_MJ=p@Se zk@;r)l$88wy>QX;)P*)@LEx^fm;afv#*R3A4o$9fSL>Th@ajgBcpz12HPzDT^GArW z)tJj-}(XtN|J)QObII97L1gT$zf1)(*>cr@ax8h!(h^TItb&V zPHXi$ifW1e`IU+BX0nqjW;s@~1m~Z^UlH8$rLY9X!dK8VraG2I21)4_W$e&=G6IZ& z`Wp?$SamFi6r8fr;xfKjkCLu8ap#<}VW9prOHo^b zPV80)S7_WG7{hE^Aq@g-g>#_e6*lxtRKV|;e)uYhj$6Q?J=i<5m*HwcMfe=bolgl< z+SIJmxU}*LJ1Tr6R~t4obt`eEsw%ep%Q08G)EN-i)02>-qM()#vC1vovFP8X&yHBr zI|p7PZxh~GZOc7E+wM1A@WXrj2r)5>=PYYJXAS-Bu><|=`7UFH69;x>?yESEhI7~4FnphYgI z<$!mWD5ar}neDbH#Z%X&5+Q-@{|+>~SQVh0teK=FDx>oLeH2L)>*w`hYJ+W9sxg<9 zF@_3D`E=;Rq2NlAey-89w7X5GL^-VVSt? zrk^C*A9LtM`6fa!56drh4B)gU$`?hrge-_pWus6bgi-aT-2XX=)(^91auFn~&%ttT ztqYgc3qZwfdEM3OyS84OtGE8P=&t>pfe<#}^Yng<5ci&LRROwT7)Uzty7go<(rQsc zJ46i(MfD-{Cu0)v>G~R)Sfk!-fm>5j+9Mu97;5k6Iwo6B%ng)#LAlO-OVZCmJuqUX ztMMUIe08giSA6ftO1~Q-vR$&L3{_K5$P#qZ{*kQbp7vyIlrppZs^!%f;(0Fmjtvz> zYvi8)ggf3BanPuK)!NVHE=amMwSWG70mLnL_Mdp1}$7G?C?c1gI=MR%Gb7jo{$a zfUZ27oh&M$OpwzMK2GfU9P^@`MR6&$2u}O9G*ekmHL5rzHGNsKG z^}_T*6v^}OYnkU9mTtA` z9pG&QptwU`IuhraoC_w&%g~JVF^Ii=3}a@tMvFlF^Et#*Snyp^z;_F?nRrN?sAx`j zh+SoG)L(8>*zi6nV`U4plFVp~fPgVXxmU`s)EX{N)#ZIeC^Mg#!J+k9rrL^;fc?Q~ z(cCrMIc<;bPzv35+Pn&$Xx9yDLSa*fgmOKe0;GeGv8Z?>iV`fXsi&7y5o$yTz8YA-S~sN z=94Tm_Va`5!^ms)XzXA~T?95Nt2o{%%U40kS`aE-_PH|zX8ce@*&Sn>(0NQGHjH+s z)pg7J?p5mv_={<9PJ*A%`pD_aeQj#RcnGwveu8b+B)csZ%Qm192cJD&a1hfC*~P95 z_*N)%Scvb-GTrBlJ-nz{qqmCD68++O;$$)-ZH9*d!zHOzd`#DL%SesE-HcAmv{yiR z7TJ=e3BiTMmfiRt@?vkuc+YjYdFGQ%T8dYsR=4Uhi>S|xcNb2Uy!-w33QB3OmbxU zveu!XE?l9*{oI6E$TheH1mcvs39)GJpWqfSo6=y4B6D?L1nuK@VnGBlfLuRNyo-Yu z>UBtsm@j^Yd`22~s`rh0gTUVR0fec6)W3GWR!^%)OtMDUNp5_01fk2}Z zgrk{|9UT7HI3MwL7Z<3yOJo~vzb(mp)4G56)p{eIHp#lI$I+epi0O5YM@QTt+ut`v zQ|lO7W`kPyI*36ge9fQ8RE;epqmNRT!4mZJC(HnyBnuK_EE8Zny~@p>ilqY(EJ6dA z_|o?-k`xVXH_PcBDCV9W+MP+!5MUB?Um3n7R@VzJ$hvguOT_ogJDdFFh4k5Ja(1C} zE%3xUaU0Kn(uYiUiHxXOmT=ouikQzD|6sS-o9)07Fm zKk6wd_?gR|L`*BX`a+*Yx8)UQrms$ZN||CF7*>`FN_g4b9FJ<4|9QiD%yh;?RA5zKPnQI7@TzA5N0bxj#11j^NfGcsLGWAe z4NgxIIq=tXU#CtX4r{L=DzRVZn4JsNku}j_>b!9Qr2%>y4xyF7*lfd`chUQ+IajCD z#g78Wr3u+SNMj*#T397fB9BDw-07f$n{eOD35Het^cI|JL?09eA{_IL%T(ukac-`u z>F|+b3_fhbsvFKlpBkB4*^h+FHoXBCcfEeUF^5IEgCX-Bkqs`y`Ff2JWD}xd&Xo4P z-gw=5E(j+~p&crvIT(V3764$)s$^JKm?loilBvW3Se;Xjk@dS#PJ9(v=~I6_=sB2W5c!R$9yIhFynUPKD~iviD)=8K<;r z(5Tf`G1baitp`%xynw*|>dMz81Np~lm|dQYyH+}A&wk?~Iz)QW{Di<*`G|h|hIwvA zR?7?$F>kZ*uoN(}Oi>4?zHf+gl$Vq5PokGnT@g=U{RstvS86Y{<^rJK~%n14-795~fj}U#%IQ@;s_Pex|m9!Hi;779VM5=5Zjb;PXO?a;CH*a(F zX*!3qlwQVc<4l#^w;pBs57cf8NT~N|W8>q+>@FT}*G}UL zJ5(!)Vq%gR_4hL6LWoX>8$H-7`3Cx%OFBNbi?|D(>@Y&ph~FljUUUSO_+P2dM26<+ zN$IgeVM;-Z(P!J=Dt~r>;vVsK&uoypuYs7f0U zZ&f__w$>E?h5!5b@39{Zt&~r*ks>u`i=26Din7JHuMGWaf&Cjrq&x9=X0_cYjyC8B zBrAd>i{3t$Hevl;wEhaXJfcEmVpoi%2udOVfkn7qMZ7#E00CU%!L7Ry0d*K711hFkZ37W89VQ*7r!1?+naCP?)3=Q&7f!NSp#o3}Wgowyc zROE0p+CF2{cMhFkKDgL%Y7qE^nE%!rVEeN80t@xB(1`m4?~lg)k*PS6U7A^)JVv#K zabHIY%jB#U0Q`|(QOsOKk*cT%cA-SOB+K|PeyU5;wyE;PUrvD61B5BWPZIvcPa@{W^eQpuDu-B&jxqV@ zh4$4Z0p!aI)cV(Ftn_-2yu@24@Upq0Q$$gHiKT_*RAPGweLy#Ls>xR=Dv2i8*V4)j z$jgqH81V~@OFPA=-S7|ICx_>IDofB~&&zh=A^(neGF;Qfn0Nm-*j!i8cdXUNoh4;Bn|w*lO>sR|d6+z@Qr)-TsM1^ZQ+~gRzV4Ea z+(>h{_!b_$+BrR`z&eM)9q&9eQfVjjlcoqZ8$S6xq1WY_Fot%Y4;QHgOg_YD+Fw@S zUhgqp#ZyN8F54ch(hu&cHS6axc4PmIaE7Wnr{6-xAwh$Dw1K*{;R{llZ4x;RgT)Kd zel_+Pc)xk!!t}RW>wa_Eb3d3(4>Y|GrNn)U?hIb~L;Fyqs!rX3g|kD5o{aes`kqR` z=Ucn`aN+!l;|yAQ8Rx6}@#rgiFr?wV%91NBkPt}REnmF%{t$v9G)XDC$>t{AFT@Kl zMCqVzcbC3%2UlDdh1g+%8k&prJX_s)lT|hg?tmZ<`Ajlza&ia6;F&z^k_uXx1qNoN zjzoU>9a`dCUZvte)eO;v5?!0h?5o)GnGI{Dr2#&WBlDJjujlVN3Y|zJ6|<`}jw_z@ zxSC#unb2JPFm4SI(+}%Xv@-G4C50K4hd3-`NxdTOqse3YSc@g8w%$&1 zcM#S}vAtBJB@K{g@wdM`oru5t4SC$8 zf)xKnh>a*x-J3D}^!x(rkn!+;xl?19pce;6-qMkLAWeuF2|IWWDJ><4DA8B4=Mn$j zb@G%JthXekcP!NYd}YfxG%0jp2WMnOupNta&3p0J*fFRJU7^>awN(y@i3KeMz-+1R zwk&p@zPh%D?L4uMUTUwvg+d5uw~ApZf(dTf_VD453Pwt62I7>oV1}u~&4|5SkpFDK zt+Zg}OafK4e-`qqr67iYmF!>f-B)6ETTqi_V|^+^^J$jWWMB{$|~FhzqPO&6uLF2s}{UxCp$C$a8P+WIs#2 z^h|61W}cd1I+bN|%k!atG;(5x{Zd~(IEvwevT2^Rb1c>+Ln(|qJ_$cE{ zfHAG?A57Zw_`hn#8!mxo0t}z7OkjE0f&Lr8n-E9hJ3636oOlQKKN`qRqchtx6_0V><>P<4^2>jflD+%Jg<8xXu>-HS{MO{2GBMy}k&*wyPLCnJrojG( z>>g!oFOGn7*DT^V>(D1%O6O!oMats;=i=_|W6uAzjfS=gB3Wt5mVaVF&~(3C>(2a- za`OiN|7x!y2gZZB>!n^*n12wP{rB_Tjs+8;?Eh~u=sq=!|K7phI5#q(p2B~-KI{{M#lahd&JAUL(Yt_*ES~kKkZx$nmx`1ufN!y4Et>~kG^}l za_|t$t48~J?M24^_UoItubragB#P6p2$P{=Wf=>_t%kF7J#BimJqkIc4O;$23nJwW zX;KCz-SGZrAemK))NoObh#@SbliXVxcJSUx_Ghu{zY=suuElT za6GmPiT&tT!KTB*0&%<*0H`p85}k#cpZ8l9aB*TC=+h|o+;J=H^&DJb$%+>#mN#L} zn&zWqB_2iKc7H#|+?REaMRjvE!9OmiXUmd53+H?HSNdH4>cp?CJSr~lOB7*`o5?@w zLiFvjUt2>tD>45xR~x`aV5G|%S~U6&{GQa<8@S=|Im-|Wj~j{^4j?jUII0w?*y zO9PUgg)dd8QnS>_(-hwi5SK=#*@Whm2aL%7h;+r0q7PSr`{{9t(zd0stu`BK3or-R z1@Zehe3^eRijb*@i8)tB(Bm|`#id~q$EN$R5~M2@^gtax3M49pTEoU6l9d6b2ULkC z!QfjQw&vSC557q4{`{(hV^b%m7{7jujrfC2XvWyqWoj*PBE^m)B=n_br=77pW5{^2 zmf*#fM;l$=lm2lc#F2FPK*T5wb)~dBsX(<~xgnV~> z)v0J~2o5uB;2L30AJMnRo|<&|krPFW)Z#m2WM*^>V0hW4sF1FVdzAPbvZu7AiAy)#boTv?SZINwq`4o;(D+INit~vig@%6aQ9$3JjJRN0-{m6beJ zu^#W_I(rs8>6(UYw;k)xx;4NOD;xja3N~J>fGnv8xMbD*=PSUA++Ia;3^-jV7j-5! zH@W8U8Ch+2hvXNf2etD~&p+M1b#o#lf-*XVV!u2$wA!ChZp1snv7;F$Lafa$xkOqC z?%H_HR$u(0?so20$DX4&DwZ~n57F>JACs!0uP}_2koP~zozCqoLuTd6fl)y3IG zC*%4?XJylt-cVAhg#vvgfAG{T9~Rd;`WX7<+lg(`hf{Q9%tqjC1t)pWL$%$!eaf`?jKIh zs_^3q9oA$`jb_LA>SD%~H1_K#g7shHME4&Tik-DW%HSl_uI&|}w3wgK!>pn+Bz4P! zA%>0Le?8^nRODhs@tjdVcmVeH_VVkRe?VV|q)@r*6QGV#O~T+R&d#TvT`DmI!h~68 zhto~_pnG@n0{W6R8ur0uO%iC}LAv zIc(mxr)f@A_4D^tY{Xl!!9lnSEx|#gi1oh#0B&y3z!!TX(`AeqLhun1#5F_s$=Zok zWlcgveYw9nuQ+(U)7w2bXijBSz(|<4?PIX{B^18$y@rPSuP1J!rDkyWqDyiyu21fVV%Crr(ukp~m z3;jDn{!gI1`%}#;)F?wQPM=N@FN==75IS|-Us!R2LiR2)VVm1-&bpgJ6v_;WJCm6djYJ~m z5oihdGppR6G0hNNA1i)$&mlLVlR?%*lRL{a*g&)&^RrV$zO#Lz54XexU1^Iv9y&vv z$f~ju_2K>t($uPE5LpXwQbYE}R~YH2q(^CGxII=7KpSq?bbi)MsHo>(;AJ+qYMhc6 zcJ+~H<1B|ZE>tGB8Yle>4&(?Zu8oW}eqJys*f6PesaM!nPTwzzshPWwnyWj3f8ZV* zpoDcBS_H6LOBT)?=eM7HCG)pVXe^)O$v?zPNLd(S`i^^OQXWCTE#xB8u2CV0ua?(B zdmtSb&>bUP>Menm%)Yp^#9H|+=LSQq=B1nLQf+=-+JvUa#_Xl)Qb~p@f5d~!)127D zU31Rm5PI2Z@E5_nmcmldb%EW&qNOL;HRZ+sSXf`lojHk(4bj8t0teM zYYMWFa-ZhaU{jf}U_!+DjD{-7^g4g*c-+(AOZgJVRLEB%P2uI4nZJiS8}Ug~(-|gT zOdek(p)hDCe^_pM64O7PBe);Vv+dL)A_+&&*_XJ=-^ZZq4)OSAU!%<;r_?Uu&5S1O z9M<4{<>PieZ+5rm;hlDKRM1UoU6lvP>7?D(^$hB8yEfyw8Eje7nNQ$cPGGH{npYNC z+vm!9X@Q)^o9V8ZLSuSYOh3U$W~Vf?vFcJs;QMas6c1_1R^ure+hs>B@~WzlZ9RRp zcE-;3znQt6EiEoxYYZ1>suSWI+%!6T6EKj%2V>rCicBZ`rL}AmMk`faF>>B{u)}q8 zt})udKPtp1>fn`j(2!iEHmjhZEDf@!xZ>77u9vt;>(0RE-W^Q330nTMFk{d1WRH;?WS;WmjJ9*0G}_yM*L| zZu9HZd0Ih!mDX!c+5v{gVFn|ekc`Rn(<-zk{Eu^g2$>(L^q&F)z>9Zz&8QFqlCwM?Gpa33GE zsO<-&+BUNb>`UHof{TDrT0f~?MlTH2ms}&tKWk3A^H(#WzD=hwV~?dOB=bMH#(%t4 z+iBz?CTXMlWKo_qgJ!hM(P{Nd$W04B5t)h|SjZIB00zjPBkQ;Y9+cuTle)*c;+$X5s9Nqzrqf`#H90OukC^DY z%*ptUEMzo>UsO|dmC*-;6ds{`s@jz^pc%}QIG>XUZJn3eU05D@j`g43Qd3kUplU@< z-TlCVt+y@&%@mh~z=l)fGw_ZJ#zD!u(*Ox>WUU__$(0)nR@wQ*L2oh3;j*I298PBG zl8(v=@Cmm&^nJ^6?fF z`gFhXg=t)o!UX7{euP$e>AMUZHBD|88r?DIzsrEnX=#itaR?7N{n{5zY~tehzCv5` zepob1WgipiT%SwE$s|<;5-q^$zaGaP$CK!~Gf7$&8i3nX{xKhkz^dzrvC3G{G;?`| z5DDUz;``HWh5G@^#ovOCYOW^tS<(CV%MUG%W218GLZ1`*L1=k~h4S>HTo&rylpN9j za)#b|6wTqiTpBmG)d5|-?9)C-}Ut3&z7G=q~ zC~3b0rNy+|K+;nBP&S6R%zNqkozww##&M+xEfLaq$=~j*@PYumt7pVHqW665<=PM`Ou_c@?b);mJ)!w8F(~Xmir^B@VdaskitAs`5(0D2iPEfGQtM{M<@IPM56xuD z!^8Vh-EKs)9!5Nt79#|8X@ZIGSfVcf#A4Vhtpb#JUz2;%;LsC_6=- zHH@CY4*sNk5>H!Bga(O2gj)#V04Zb&gb_#pz3WO9@%k@tPjLS~@&@ zlj)aD`0(UU>DYE(Ppxz%K@Dhh$yo#fsPWm>8O6; z=-O@%gcZ^iC^gN{&mz7fsD0hK6rtEIM;u1FXV4>drNNcO3LmC%b zC^HBw)#FPkzgo|ErqH2(%2Wj3`U&ey{dYBSIYBTZh>-kCjtY?=8y5R7$rrrP_M zT5`y!k<8T9)q-oQOY=g*2$2n+;ota3!b#{3qtkpZCU>R?FbrT8mheQ_jPRO03Ck zkC^|^Yj4eFeiT_&xtw(u)g+umr1{CkCgYrXHWbc@&n-f|yiK1Tlo#_8#-ljI(FDGt zHJUQuSy3!OnuQJf#CBr7}k`x)!4Q4?b*w z0LyJW>}^;=E$fu_eh(Rps0NP}nP{t8{AMCWcfGBq^8CDMXxNq#VW=i8##^aFT3)m9 zs=>T{Syn{_v%I{#wzk%D-`vtNueEi_bM)Vl3EoIwN=t-p6Ccn~jcz@?lBIqBcgZ$- zn5_B~mZTInE@$mn#?OY*>d?_qw6bRuwbho9+n-|?fI5~!O)|4~o6=Yo$J%~Lo=q|g zDRdj&&Mq07 zsg4O}YS}kYb<&JXW`u>MG9@O-|L77MdH3k=_|h+>e~Zv-m1wN;Z4;Mc9G?-)XNh8A zfMoWttE#=bokepB>F2`cTkB1UhOT!OneWISQQAT}hJ}XxYigs&x*}brM5#Y>ukXIY zD(GuuNrE%Oty?}~WoI8>ZjVo~4MW_iWNg9fsjg8O#a#1wk;D?jsGSbpFlyz`)#uU{9H zaWQCQA=Vj{fe%PxmAIDN+<300mA09fnSZZ$1@i-<2)QX?mW=G|rcoFcOw<1crg~>w zOcI{QOK#gtGcUKOkBCE7|)hYQrsj1=N_Y&Qt1u^fpiS15i2`T-tkbtF%l)t@APh^<9 zZFS+8L4)}s1{Dw`aduoIvUoWeBbw1j6G}5Ibqy{3`)A$))3;@!e@@3nn7N$O2kuM^ zRSUaKP|jo=HttOdu+?5uH;3se(PKF$E%}b+?%)HA6qCAfwM^DK{j~KA$cRX)nB_RJ zx;i+AZtEg+wX20XFqdey?YIoHAve3u$ zv5WLjvtevXWA5sZa22z^`*@v>==e7nk#PFrLr|) zsh?FhqW$WqAN(ojeO>;O^k$4<6kYwCiG!QWYmJ5DNr5}Lmwd%eKS~RGW#cztM^nXk zPFC^=%}R%Rd|(|leyOF^Ek*r%Vnkmsnhi%qKSA#Qh_eu-%-y<5{jnxsXy_i_bva+$GuvK zP_F}{ZQ^*AKP&l4S`bcohXUQ-N6zVPMQTnIetJRfXR3-RQdA=He4buvEfN5`Ic3en z1yWcHW&Uj9fLr?AQQO!ytqTCLcu6AyRm*Ika`vD&rEG3SQ@}DxSy84bVUGNZ6uotC znTTMda*0EtehJv$xmcezHRd8HfeIXRI}COO4S#9XqO&MBNHbO(m3owPRYAt814h0U z_Pj9gkcfzDNGmBaWL&0=k8=-^kU|QAH>8avwYFblo&G?LW+Z8>R+kqhZm0tK?6^5p zw%J#d{;AZQ&N1uZM(bwaZ8Rmzb^%1`;xeH#cKbmE^1)cc3Jamg(&VZ_6CN48QnoFuBNnH;;lOsU2zY6`3j&{OufR9=fw)|QQ@b+tDe)^K< zGqLO5Al$*=^z$bEuF*7n@t=b&kJX1)xHWIljDMuk=gD%~ktn+FWrP3Vzy8tj?xiU} z{=yA9mJzu1S}sxF_;=ZGC7LR6;;N?hO`=fbeX)#50uHUs-=)*E zN?J|$7dS@#!dR7f+lImh@4yG9Oj)1eQyQAuVy=#Vtwi>UAmr#uUqJ}MXX@*s&LHWU z_n4j9N+29PS99F|hBv-wE}`2E;urO36pMdN;Ekw-oOteVt7m!NgW8HD|7S`3pJv+~ be(}GdU+hj|$nTi^>-7MN%8FD7>HGa3$D$@V diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/query-user-default-block-filters.png b/windows/security/operating-system-security/network-security/windows-firewall/images/query-user-default-block-filters.png deleted file mode 100644 index ca61aae7e28804219b97ac2184ee60ed391b80e1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 186215 zcmYhibyOWOxBpFXcRRSdyB3FoySp9S9a`Mo-JRlEpt!p`6u08;@^bI<+~0ct$eKwe zSu5E)lgXZMJ`qX^Qb_Q4@L*tINYX%Y6)-UHnXg0u3;k8H^)o~D>+;P-MM@N`W{Tk7 zR|e8TL|z08tUeCm%^2z{59bKfb^!y!ru?7uO;IzTyT^Vh`04X5Bc zIBIUksAWS31=J+#Mg=cB`Z8RnH$UO4NuC7-%!-TwK=Yn7236$g*-41CP^Ra}h@ zxqHon4i_O;yzpj&`mZL%pzcG@BsJgZqYdv;T}TEzK`P4N*^qco2SB~h_CP&~5FwkS zlLYKnPouBDD*g3aO+W_vIW1E5KO^(36-7HPesdg%&T0zK42!MQs>L{kOFNE{tXis* zyikLc=-3bRJthfrSN*$qK?_Q|Vcx%zIZn>Q*U8igPyRE6SPRJwh-P6^I7m9u z94UJ#A~=W(O^)6bc^gkaKc`dF`$M{2JNAcfMlF$>ssOw6j2bZV*n{l`3GA@zZQWxz7cXh;ucsJ zjh-Arrazo^=yLw!y!O|YxE$cy^?h=04Wqb8^J)=mwI^6@zhN9Ok?sv04Dg%V!B`o~g7 zB(L1uZ+8b))F9B()HPv?M%q-g5gU*o5~AC$F0uf)M2L}- z$Fs4L?W%ohdr@?WVV5HSHGTsjNdHMNOR}Oagex`iA2bP!DCW)xSAr&@sFxA^KS7bw=CBUiuxv*6u*Lci(ZP_;n6It^2y=V+)W3w26(580Z~k152S<8 zL7|-UIp#fAba}tdJWb*qC*rbYjojkyvQjKS1R9l4pak8;UcA*0Ua>h9sS}+m1mFWs zpxUOdvFCV`uR8o4^`P5Lr-r115|2F0R^>slSlHJbrZKG>6zUfdiuELk22uplOgDFt zML^%h1#C;W#r3QKg5be zQ>~o2rvqs=X%Pv|CPDOaqFlZjEbx_+$n>&j=aJiGA<2#L9eLO)8nfleKA6hQ$--?7 z0=4b3+8@R7mcJ5?>AQA%XC(@WP zcbJP}*ac4_;`_xD@9mrV2KjDr1z83{1Y``#Rprtwl0^_xvo&oIqy?iO4z2XioOY{_!BYuPDu#PjQ2V(G+pwK|E8BcR&S7YOYHac7xLFKP zTuUaI7d^7RsxX|gSPme5l4s6%FxaQcJ}DW7VFj@FB;Z<+)2_o!$Dw5mO~|mL;)p^=#*(@Ho){M!;DX$#azoHrZU zQK64`;yD8#>MGv-C5oB20-qA%{wniyVR1TCtt*BLJ19GFY`I7>k08p)z%Kl{K}Y zYdMkggnC5OKs_p~RU#wty`eWl?yfBy`5fZ`DJ5QztK9nYkBty)I@y++&ZvLZ;aS*N zWK$xw zK0jo|*Rw?ytg3UOzN?`Yn!D$pjz~GRQbi{nQE$apVwEn)6!ZW$l4M5c98uOM^)v}Iq4f(AL5_6KfQ+MVa(lfQFc7S5abBcMc z8C<$bCJ}bHzu9rc6X;^btP$vL^r&QErte9Ks^1$kt0^zVLAm%DR+2aT5pmab$ZRqV zvn>Va__}nnO1S~zH2xCAFutuAX$ZwCI?J&QaR-E2EiLpiD z%+%EPO!N4ngI)0ma0qj-EUTtMDFLBdiiF`VGYSb7+V;kE;c~*0 zL)dRqmzTrDe^rCpx@ZyO>XVU-gLh44=E{qVu+cqd?J{c_3<29A0tmn%PrJg6wiNkt z+R6UD3Cz^@N)B+(EH^SD?I@O{@bx)%C7n!^D_DCZsdo|4Lx?ytLsXVP)R4xzE zj15h1_WLy2kfsQJXD$F|p5(<%>h`(%)Mt@lUd^7cQwpvR6+Vxk5>}CIe4*CKk^Jf# zVyx-xO zAMETS4y!S7zQ+n2M=LCBJn+P)+c+ASU;CY>l7SYxbq?^K7iT0bn;&Qde-jni;)7}? z@pq6I$Ss)$KC&K)Y6NiX)9_&@O`Sn##^{AMe5em^(n(m=zkd)A^KT$iGu}rxI2R9N zv#_z&hNlYLq1VOKz3jA@m_9Ffe;SK0cr~#0P^7pE z{GKO!2E44*4y*jr>}as(d^_vn+l zM{lMfEoRYRETh!L@KhqK!hLj-I4yGrbuit5=8X(>gxI9gn4Pp(Us4AME48SmhKN&L z-qMOe($A*RmepjS@5A8tOvEy(MEW&jee*($`C^G3wH}_$nLhi z?!D!_^;0A9mH}Vd7CMj~O-|971fy@F?q)`4$b~j+tW@X6?k2K0a3Pf1d_pT#?~7{=tuRQhNV@A-QnGVAYqz3g z);AN6Quz(}SOLcVrN{SeZAS)o65I0(ZURx!#98DdcnMb@XCe*WF>#E;}ZuGO>u{oZ@` zyW=mHy(|3V0Bx*|mwZzhY%nhM>wNSXuO_?9w}fDecO@-8d5V!KVS*R+9wDG~imr}p zSGkHQDob(l$)_PI!932?-4~7YqzQ8^GdrDDRjy74_~)}cr*JR7 zJko3EmdmI9cpz|4svr@jf^#Y&sE`RC@77#mcIKh##pMVEtYXlX0 zIE+PrSdtZKcV!oM=;-Hin(kNBa0$?(ocSv_Ld!VVH(I+pkCH1YP)#6z0H|AWQA)TE^x5@#tKN^n(+Wi9gl6s8onw~8+^`v22J}t@@5}j?17<5rsvp`WrXm5 zY=8DKx=CjXunHHF>_c2(FXr=+hkk6riQCyHr=;|t>I^|j^Zi4(8ME0zj5Vb!g1YQJ zqT$*HI6cf!PB1_jwWMtyOZg)FKC|tQdF(=Y)sba!xyBrNgIlog`qurC)g7bz;94+1 zDDrsC4%MInvMy2{E7M4 zeThu4(gs(vNOY$#60HuK5wkvHme;?UYn90ARplUZK7@aL+I>sA(dvUBGnb@=OflPF zM~p{%d8Y@4rTxW2 z8MWif9BS3Skk;q^?zp(WK9KxtQ7o(ch^qHoKi+~Kw|io^ji(QpZ2ztXG(DkDQA0P@XxHwnU(@*AHI1btvVw!TPRjBAestbs!%df3{S6wkP^r)VT?~SD9nRk-b^$h zOB6+aJ-YQbNO5yMSOC2wBp55~axDgBs~(VZe!tQ{n|FWGbJYq6NwI=;&l@!S`2rAl zHeog=?;NKcis|-c{urOcVqu)v9&9XH_zl^xR(X9LXWMtqZ9fopxgNJB00CW=7O!g< z68Aa8^y3D?j^+W61*6{RvdbEiH{kjoZ1e-ihW9#`+7V2>EycHw^Y^Fst<7kN^(a(6 z_Q;45l4uS527LTkZL^`#Wf;~ygi3QN?B6&C_a$}DhmKty&<_&?9Lb>FJ{RV_@o8l8 zT2_>)Mcx&JsCo|+^(pFsQWrB zd9O(Sn9gOMMW@FEm`Xu|U4V2|0WTk)ZgHqVvV|Zg7yS$1-Bx0mPDW6bf{PSerDtm= z-M?~0F!ZkBnaHZPgqf(sK(ae2ZlTL--}VS1*f5c@H3DZhrsvwMgYdiZk-GYTIH-gE zfvX!?7N->ZLC_r2BVBU+bmH_>pzNee0@A^M;%r@cbvD{nii+)>+?GD7 zyqGkDKrkWz3&#HWiFoJp={(NJ&;k&HCv*d>`~HBRH_+*^5sL4?6Rc~$24Cg}eydDv z|1v_n{pfqU$J5@4jv&^bu5|?`PWU39?1`=mDVpnAF zABZ-o53tp&xSotGY190$y+oMYhez_up5cVm8UJDjXtWkWi}^`87iPAWjkv1VY63$^ z)J%ZboOVQXj7Lw3ap>ilM;+hyvSeC;8@xC2cUWY?Fh6HCM(rd@gQX^0%tLb$0p7st zHud&S@{+F@Yq*xC2KBh{h>5(r9Xa+Os+A`}+)Wjs0ZEm|sRo7!y@fCbiN=wV^-pV{ z(tZpf$15TFann-HN=A1$v7jpfy#_r)1TJ_%_=zPVH2n?Tn2`a2=;MLYz=4ws2XdAm zMu|F<7T|Q)Y$Wh)7u*vlezL}0#5Y|7GDwX2$@BBfEgMfu+)kem6w34qdBSXb@WaPJ zYG`2osciZO{?JfRd86F+jWg-@7aQ)Kl-f6_t_KsLy%CW>2xWtx_#IuhPeTxKWQp1# zH-&OqdiKS-Nd(0cj%!sk_GjYWo?roQOa$dz+p>O-k53Op(}fOewa~+!G>AdfVEAkB zERNUUsiJW1RbDGT+VPqi5h}>mm6giL%L_f*#KYxVp^WQX zMi2MIJ5h#SV71x!eK%w9p+0}m>deR-|AjrR`@K>b2y%zx&ea{oqU19@(S0m$`2l)2 z7*~Fi5@H0nx^f;m=4S;?iisHo?1vJ5B1UNX{so==?M5-5qRi%XM=oL?zk&e=X6jiU zuLP)EqEF?X4fQ1w_ow-=TviMw;Q#J#6YwWZt*GKRFl+=>LdoO*nn@?>tyiU|*?um~ zbX`H0~RUsV5PlM*M>aFc|bAu>FUBshx_x@<{y_b1gGQGF zC%*B#BG>nR*DVy4Hk4#(JtAgF8Q!r(wb4Kd!Tj?GcPd1{l8NJ6jowDbA5=xZbK@U} z84_pRB}hXVR(Fa|=77gc3fj7jJzGol*tF9h1+x1BjE)Q+g0I!IfB^YohAm7gc^(crg5So z`GOaKti0T(rI#(WvFragxo39{zVFQ8Z!+h)xtOFfEgNGckIw`8;SWg;+YQL0K1zYt z69De*iE?Vfz``Bbtyd0N0*;n+I>sysI%%p`bZ9{tFx{BY5nG*9 zz&(+|C-RIpJ?pVvHdz-2%tSO zbPc>=#`OdOA2|9V*}8-MhMMxv1s7A>+;?5BIcsY)qBPf3710_ISXVr~dwrG(eUgA& zGYd6DZZ{S#Z@kh>U1OBIo`J_tH2R+wXh>PW7L>jmyS`o7JSi5@q9zvN`Vv~LN_!EI z8&_)HCmr~;j3>fGI75ih^kjgaH{?#&C0XW#L?3srGaMOF{#nBkU(*CxQR3*lY72E3 zKmNgB8|*ZSshKw*;#7|3OIq0L45Ej8nOG%CZno{)5zLyIor~7n6Ug;Gl*sND@R$AB zsTE^pa+}*}$>3t_?MXl%;Ao9HLjn=>#|i;Cnc`~gwyb`{=jJK>JvP$~QuJ8x0X#Md z6&E-*AVI`EJc*5oso95>F+3v&JBZ{)Gd&_@Py<8dRXKJR>bFbqGQ6_0<}#yU7+T+T zo1T8#YdbD#Dhpr|_>kz}lfL=868dX}BGiO)MTs?z`r};!vZJk>Tv-|t*gD^#)%F9= zg1P?o@vw+yJyc6PJeV+LvYKXcEI7wk)HH2|T>wGqfQn$X1!~e9`3@kpqoWhG|zukH{>rjk*KWs_meEXStZQ~1`AA8 zQ~&#+bY~AxVM}NR@H0S5U-b7$i^Npj#IY7$Ta*BBu_KpM9$w0 zrcZdVvZ4_*g>*pU-Vi&DXi7xXlu}mk*vA5WIOxxoi0WB?Izsd|<#0Br|9h#3<*fgh zM5(zGx8~aSuHnPlrg4X(PC<)U9p9#|tq3!xdeO3ivNt_@pd>+kKP~YtIMuPnBQ{hd zdSECv^MP+6o@Zjh=?X!DmAA{^+%S1a7&C-o3yI>Bxr-~{z=*&KY9WjOf#`Y3hR4?l z-ZY8h`-JvN*Pn0eTPII5{gGX3Q6D zZ4fz=2Eo)+S9kQPTKT@knwTao^>Aed!~+CyO^YU>xdc~ZO2tkCcAx*p&;q1^0f7}TNWV>Q3!4@MJL9K z4iAXT%G>&iBDiyo@{K4A9ybv9N9#AL8+EU5O0zT{GK6M_Y56k{68UMhsFnpOH&?x| z2%}aEf-w5{l}g4yl3LQNP?D^CsB|LS5K4BGAm*-c;%q%h4Lc}!MpkjX=M|rFWc*B- zdSfxDu{oqOVvw=(3hS~^FtMNu;HMb-F)?WX-LIjK&XnY4f~@vmvkS=~Kt&;iM`kh# zS?Zc{!qFdd0S`Z=>M9vg#D-%F9IO+daRnK!E+8Al#d;PdShOeb+tlaM;9sa<(F}E= zDP^64g&icct8i)wPzpQh!zIT;odo#O4{-(Q4uFqtTT$Ei|c`? zI0iq_4WGx-uAXbZhqM1oI-5v>RY2YiA^r*Ye5=MWnq(4lOTYoO*Ix1$XTjy1_B$&G zp5W(%*PBLapN-tLlUzQGFKK&WHJ39?g<9ERQ)T!&_@XB@Mvc(ciXab{vhcHdh){u` zU(urZmG#af$+E?x32oKf6T*klk_d^O=;Lw9CP0m2!FO)xE{PCbXEG#l{_~9pN}2Ma zn30Yoldl7f03_E4}rO42vS^1fqNAtmNNjNn0Hd zQtrP^w<}<-`@URI^9K3{4LdmP?`;&z}CH+W9TZOKHU22sfqkmgqs z0j=z1-q-)81!Mf)mea29BD^5AQJm1Xl{Ui1ImAUvc&`qjQ12Lxe9h3Ah2G#lPW*(z z72jtep4N#UjQDKDCxENG-g5><*_j|ppd5485A3}6v-zh9ZbOkrHB{D$N|u-ano*3~ zZF0B>rO@EuxZCf3ns4Jg@`+pQf>GBI${klhIM*njuewhQ4t_{}w@TclMI2Rh4Lk1X zI}EO5e;Xo&tH8K7JF!9vqMqK$40|xhH4Yc$$U}yVIKWM{9<;cOIiplW?`Vwxht(jbu!HSvg6R%&JH4h~W)?&N(w{CS#G{0ZIt>A-B7J(N=gb(E*pPo;7$|1V;WgOAoE zUry+r-mKTMWtPX7zpuIpb#x zw)OFn^z`{Lx_kxm`Tpv;Kfw@qNByUcVgha=I(F|)+vvuW`IBk>H8 z?Iu!LBXhWAtU>Xab*>ffOfbMwhdh(sY&it+jL#L*Emrx*>FHLFi$&-{)Z|^oTEzq>7*1jfS@3O)Y5&$GC_QZM;(E>1}RHAG? zFGOa6XL5mS74B5r=d6)iT@fJJYvR)!OJCHu++gvVrhru#IeXs0p!=C+2>H0e4X^O? zN~xU2$C~jq=qeivmFn3bBlvPcEZz66mi47tXmDb5c@-JAbHu^S;B5~!abifL3@w)k zob4B|WgHFT<{~ZCi7LcKnelPK`qRcKIo^ zp-ec?IIS-(4owc7Xt$0SE0>IQMApI*Wu`;f;&y0ybugdql3G;RjGJUJMVh)CF8KOr zEGtER!zKuPIbvxukyvj*x_T6dLU6%W^RSha&PSQ<@## z#ZVA?ow7ULSP5?@;|^_~HgaT*NS!=~MY%T}O%EyEr7#fmg*)t{I$Ljsx?da|nW!_Z zITDycQlRZ4-FFGuw}zNUejw_X6Tsm|*$S3tR390?b|lH{J&;XfZ6*k%{!K8Ml7TDG zui#;Xhm1#(<#91IwB(J6Q%YXX5rlx_UEhiqI-3y{^T(s0z6tkvlOl8oTAFEow!J=T zpOX+v;+euSN~-}YzoI8#u!N?=%6?!aL04KWaS74Yek-hVovVlo|F~@?CPItI{(1Yg zo;Iw5++Ivup0}!tl7S2f=Asp$`TCo{)q$VX^xHkOpD6UT5^5V35|67T1{Wvmxehlr z^ZmAoALJlo3{4f2u$M17Q!F(GJ8RWkkJZLzK#t0XD|bUK2#dK?yj|^@Mp9uCvnetpAV0MhZb>XZ;C=;BCf{-YG#s%Su_P z)c#OF9)R=yc|;VI+UKY|oT8Be%8IwGb+1LR^|_SGmCLN>JjOVqK|mP;VU(2j01URiTT&xmREXJqS(pacKNH$+tub=K zpzu&tSl0zEQ3D%#Xll8(5j|CXzp|hl4Q?YmnVrV5u(RpYVlthIw-1_wg?(Y=>3|O_ zgVbNwO~~DoFi#~m?uKg|=Qu`OfKpG9(LIn_0dKgWi$7vDGI1t|^3AX(_u4gdtGieX zGsKme58ykqj@+5;z6||ofrQM-@AS6n%QF^flz~5#F$-&*^(!8b*&lHsZI+r=&=nAB zErN$Mi(8sjMDvSAxScdQ_e1+hwAg%M+K42u@Ru{kjDwRCGF_uQE|K8?8&V**b#A#y z`g2q9K_Sa}=xDD9Ly|4tI1&q?QQ4w|NoH>qlB&e?wI(Qk3m0zHoh&!5sQXsxX(2~G z-SdD0S`(vutpkbkkXPXLP8v5-$LZ-18S(okB30F(WevT!FZQi!Lfq9DB6c7&4_g=6D?` zK!+_DU1j_Zi5Qll(7GSj+7E(@j_REKXHx--=Oo4kM%}q6SrawW4+#`W#fe{TjmH-7%4OzZ(~_LuD|cbwuk~z(}Dug zk+B;4J`>@PX{>WwQ3(;06q5=I9_NEg&^QWRcbHSi3<-Dp`GxK9ZT}SR6K9Mr&6^dp zH}hCC^=WKuO;&kP(*XmcQANdI?#Z0Z`GEr)s3@k^Pi)XYs@o2b-NS~xYNJ|{lu=!~ zG|%l0n9Kn9Rszw>5NSDP$b>DWKIgIGO$K9E&u=);nmcKXFyody9H4$QUGd97tff(c!ciJi z^#0M2y9uDq*+?Ox`zKlHp%_hmHk3WYi%;23n%foQ0S)O6!sPU>$rk(&=w}`8-*TI3 zVG(ak7xJiMfKCAQJiHBCY`wG)T#|AE?(g9kB>jVtyBj`iF*5YNkjC3|B&hf_c~K!k z;dpOa(~60Qw#GRn`3Hk!kg%&UGL8?i=G4+hRSa1fD9T8Z z2`ujytpEm$rrEM3DE{zLw7~`$}awV307>usybN-sgXf2@V;}3 zeoA7&i5I>sE+52miX|@VhVot_0_um9H~#2==GxaxCLad$Yi+?|_e-0lB$JLG53?Yd zAdG5=F-p%KxTJ@BYu8TRW%X=8zQ&YLilc+H%-ys2=qERAO??oUjJ%n``_@3sjQRbj zy_TO|u8;ENC7PG86!!KG&@nDvnbeDzgJU;jBi|AvO;^oLa~c{W!hWXb=qfdSD&Ub; z(oy3K)lVwn8mMBR)h>j5emBWhRUw z(KD>7Q>+iNjJl`XzQfM_J*LV~ctS0C(_G5`6bG`&Lo`^g)%)47mm2uNGaF{kz%_k| z`A%;;#2=)HemB&9iEnc_-QjH++UW4~FuBblB%>nC3gGBRfL;;tRM`&3)m<8LS;mEV z#+Tn(`{dtFpm%qXG5(r~w_{T^LQ%yYCOB%HvsQC8Sm@mpz-l`O1V1DsG+!vbjU(vX zIH72l*(6uD?=~c4O1D+Ubvv>oQR3XdK8&SWik8x33wU#kiz=5EfO=EnMY#|siXysi zJnyZ$Y7fPNT4meaV|_`{OM!CVCrCUfI-sVS5Y@Qcj9hd%Q+*V6GBg#OuMTOZk@ZIN z`J5BKrIu;0)Eeopj^>V?khAX^rq&em`AVy{@L(jCFQt}kG_ROR=CRG|+l5d)o8}fr zFST^e?!pg7zr>?#Yb_XIMkctg{hu_u%ih&paFvNAPye0)mT!}n>C{nYw9F4abU}&O02Xz z%QKr%uvfzHKgq*sP-*UZ^g3+`M>RIim*{hc0RjxCI|$*%H5d&(RG5E6I@Fu_x`?=#B8!wGLz|%@_CETcCV09?j zrPXM@(7NT>qmND_F12**>o*|)*6l<4ZA7o;Q0g4tBo?J=N5?T!2-I-7c&$*JqYfmw zO9;uzM`};f5B6yT8{KgPDBG@bo|t~@^`DMydmD988mJS=Mg8>ug^`h?LCD0sq8Z7M z`3KdtzEu4CSP%JVmw#qP;$s=udLsL8wMj1Z66&iB)41)vr!n1=>aUaRoA^MqPda zO6A-PuVK*}5seUBhmqw^GY~sE%CF`d$!ltEEd^^Na#FE8 zNw|eyvYTu+`-b7Hqjq|ra_NgI3S_n{3QQ4$8a8}Jjyf^|3feGK9#R*IIuqeR;F}qh zVLfVW%1z1l40Fx|nss20M7J3sM_VkqFt7?02uGergY#T95vE=WNo$dQ6D(#tCRJ$B z$Vw1HDIK(ILII$yJX@xJMg{D%|26T~W^~sAf}~x5;hf}ZKcRJjP~$X(!NuVw9oNfd z7$(#=<7tOVZ7wnmHRDZ~e~}RJJyuw6C52?b9D;-PLC|zl{>}vM$~g= zipV@A3RV1zh5TP5@G$6{>!Y%~z^5i{`A~GWG&09X(^+lMOtJ-Zs3>tB5YCGfq#{IVG$QTC$tXrfU*Bi~xas6hLW`+k$k8sze(x*5MkRb}Dg!3w z1}Bt#)4|0ec96D}u~79=I~ZqgE0T#-$lNIpd2I_YCuQ$!VC%C@$oMIJixdwhd9RV% zK1Z^tvXwb|EeqLPlToaldwk{T;eQ?oZ7ZHjF`5KT^y~S5pv49I7Mz-8ogyEmcz!adhkH=!mc|{XRPBttJ8M9sruqMDwQC;?fkph ztWRbVL?cfs#L!wWSChykN}j@kRY2K`1q5EYe=321W?T8eV9yGgfxIeJ;PWzUhUZ~i zv z0rG*SL~l6J&9}GS@4E2L&6eij`5hPqJ#;xKKpW=YA-G^VH1( zDA!z4>y1sLv|zO4IiYXyhH)F|fZ^gKl9qC@;6~De)|s=YR-)Nm3L%k?Lz6Lipn%Ys z+^u9x_&>PMmm&ZsA@PMQVY(h`#c}@&(JPI$u}qHNNselt6pDk6!#ddnhfJk@XJU!He_%aaj;iovxxTJF~&(A-t|s4Xp;D?HP* zddvJHY&Nss>U|m0$`#C)=B)k4M8}3z@4op%E?+;w^2S7mjMM>g$m(=N*78?j4YXp) z-hJd34-{5uuvzN=AJ#0^&`D1$-|hG*X30nK>8-ct`H=3m` z=`stui|-@|h4DN2HOt;mDD~8Yu_`jwcnPGQGOvg_%|F0dZxvw~MsokEQBmVDpDNvf zm9lgt`I$Msb`7e+k#IEs?$f!)={b(?5R*q1{$G%)GSCfD2U_c=+QRi-eaqGMNMK(YC)>y<-N>3XrUxA3OkM}Q2@@^_EEHmcP&scLFsQ(wDyXKln zb3A^cy>6VTdL)w2Eoyd%Bfi|D9$swdGB~sGsD1G+bGzNF6#HKyufP;3Qn)g$baMx_ zcCRzW#wtm#TFCW{O=NM5zdV)ON4s+RH~)Xl`pASC@Zc#>QC**$_22pMzgF4=ub?Eb zX`JQ@TKa#aU%}qFQ8J1a0|SHbx`hVy*NO4}hXHmFeyLcq<=wL7|Az&B1^)a2Q`ukZ z^Z&Jfg3HIS{7(n}w~{aTmq(i~TmJpO8edCKwIgG|(iZ8$|26t5vbzqYB>3vb_1@LR z99qHy4)b-EYKp$SFXdI9YW{yZG0cp0$2r623*UhOeUCsEZ4-QfXYxoD=4K&;Ql z45~gCiL^v@MBX1c4CrioM4l$!>R{4k-s7CcVb*xaBKPXHAuQ$n7frlm)sxM?r<~#2 zWZldavGUleQu-{Qd!Rx)zT!HK-!w4U9rpGlr|4-8*v#(cmTY&Q-1@!K<$&xVsAqBX zU_;>P)M+^&Klbl@$+mNn@jpY}>x{L5ZJNq+dmA?Dr0RsIevux{B=cYUrx;0$Z_9Xb zKdifRet~xK5O;m6F?hQd2v_ssWx@FP(zPiq^IuEH-hV|NvBXjI-U)Ja?Il!9wb^=u zFO`+;u0MsKbE^mgo8gq(;ftNn0rmwI@)hwzzR^w^IuGK75&Xo{#lVVb_ zpJQllEuMf1Z5BQOT815py()K~P=u&u<3%az8#>9i)gyWpn@AgcvUCOB?N{YBH;v zY*gH^8_5SnO|w`{ibrYQc7!At=W5f)epvUKADM*BKX>y(EzxVK(R}1*pT%y1(~2uB z4=nd{Ef_3my4VFqH;La`43fNF<}3yo3D`n#Xt|%wN;l)|gQ?A1%|B=r*Zj`2J zcFWu7XoOBs3eZgg>Ic$msPI*RgSGFS@G)yq>+MfVA_(;wFBPse1bnV<*~0G%6zF5X z537XYg6Hx45(i2tm78I)d->0VC)#lZADPs4PyFzW&snlh@%XoQo^QS~-XM_Lwj?QNOelg(V>uq3rQ^NDsr%7_$jP1c~0cDNw9-O;rJ#j0J#P7BuFJf z=3V0mT(~3voKxD>C{4fk=%d^nXn}@oPor4%jZKS#bbzh*sk{{wTI5WH?zGsOj+>?= z5HW7VQN~l``W<@H^yP$#94+Tih`qKN9lw7#k;++vUd~#Bd*~0`(4ZP6>N>>bjZO;K zZbxK=B{~bc0sBEb|FviIfw&(P!njBxb~m&-6;l~ZM%!vKf2v2j&a{d^-&R*}K=3 zY&6``)G4KjL84JkSQbz8Y~AwSi73)G@&=Lx&+1ks8zsIq1Ee3#KV%O|id#?8!ZdtU z!cGqHNnYq?WjmHr<07-3lYSUFrFG~f1YMlYE$jo^t~WFFG|f@-PH(Br%MKLj$KBYX zmLmA4m;cPW$izaL(0WK#Zyf9D+wj#YSkp?~{)gYRkGyaaK@FS2b{R(^|< zvGVDao%zMazpd*11A1hlB1#?K9Nr;;5VD!5hiR8OPjEKjw79A0=jP{l5XD!fqYe#2 z=JX{?a_K%W9ZSvotYRy_Kja7xu_{VJXKO(8?Uc7#a&N+`7;8|o&1Dn7tZa3wLw!KT zcNta3X+=$%)ss)2ns~9qcob>{N86}mF58t|s@Sf#$iv=U2no6r5SMV?)5t5DSd#`v zXQN}{c%ofbJH{_!YE&X%gGGtZH>mZF3aYc51VSU#DUAz4t{1uC*?<%++}xBYG!f%!;Rn8=2aI_&?CZCOM}7- zP!JCymqF7i}^7CBrN6%j|47DA7UH%U~(mmW~hLhIG`MaEfk{~HML z%H4~bIXE$azQJ2!xz+$zjdVZahKFi$bUaooA?w4RX+uA&q8k+`M=cr^#W0UM*ZKbe zyg)<0CD_o>#59BOtwyxAX0Rh-_oBJA2Gv=1_?K1?Vw%|nrD)#Rf!gA9AV>qpnu)5W z2DG%)qqeRdO_ljD$NX6GGrx`k)V0;1lH)~uWd#AF2RU_(=-AMN+IlVC@M;Jl7CyWE zD|({JmSrJjSJSis8`_#tS5-=)lcapBNZP!prXFl)t4EH@h?V649NA^)=;}mEQ$1>G zm}YS%LaWR0hh%U!BBQttn>wms@ULPuKm+T#Iw^e(2k-oHG}M;CL1Q4`4=IBtEth55 zR0&5cgg}r61NF?2QHa*At=Q010k<)Nh4~ejNi14Bw_!tTBPt8h5LjM-FGQVtV|uJ- zS9(4gTH2}4&8RBNp>Y_3pXoXCD$u^6gL!F0ZAA%nhvn%DlBBWxOY6|qT!!SrB78FF zS>32^*@R8)EvT!lL1Bg!%gaj$iJ|$%B&AqQPL$Nup*$}gF~6Vnuat=fl@)nateg4* zL|Ddt#%;1^plQ<g(5WV`R+gh`#R9ir)L zb#%pDT*XnHr_xb=Q|`ptOyin6EKVG{=i{h%OySbd0u5jKBOx(3GO+FNUHHKJZbPMY z2CrWlmuOX*>%(8s&6JzwzFxMq^u(F1lP858hw#4l--r8mSKyUnr?4#jstR!ZF*?b9 zHDXP}rUQr3Rp`dtCrUA2ys}c#F zC6=}D67#kBlt?vandnKN`M`&8V}k(~E>ChC5$#F&QC`+^poNhuo2v+Se(JZeqcDmy zrv})jL~h={Uj0ctB>nNyt@z#hcVeNZA9L(S->4f(U)O~b$o;kJHKSC65l(Lbnl^Nz zqp2Dkk=S=F!DxeA7rdeY+1%0tSyqGcm8lJl5bjjFWPr~hun zRRZ0=gxf#*aU85mNB4b5t z-;K6yyHTENRs$}FYdEOi4jV}^!$cUj%uQPyZlrk}u$htwhe`J6ZV*3|!)15DZM9Ie z7zdUZyfjAZYAZ1C>ce>c!~o3h3T)rC8?AMD@TBLUp^9Y7w@h+jM`1x0ylxL_I(K4Y zxeJ#r_99Z$f!l7n2lw2(6`1Wo&%i7a(ve1tC}`h`kAL!hw0mMW+ua9ieiioLcmwK6 zi&0Woio7&4mPlSRGICIunU1{TT5MrGh8AYgH#UdthHZHNZHG}`XhH9#e#{t(apS$W zV`qV#yrdF2jjZOqxOqo2Oe7r%9;*w}m|BUUv}+%Z+Vq0Af({ZAP#zTg~40~=Z_HJ!M8q3;~$2Lv_CNMdQa84^ec>6wBlQcwF-?7yh zj84v@VB6jJ#0||@Tv}Deq;FvyQ_D{5zvDi1R@;!Uq@%vEfdlIdk{K1)yMHfAv$9c5 z!y&^S!{qED+*yUl%gRDwX)D`+2U8_bfSFXe1vAL4eqV7J*Ak2WhV{g2JzPDxFqvVt zm|(WCe{gUt6n7Z|8K3xdIvtF|%JL>LrI8qOmSA&p7KVE`rbguH5<9|Z5WQz!!kn`f zC8lW{zc{AkmZxww_9HIFVWx`66BBVyQf>$PKnLAr%oRDr-6DOC%L$vz95c_N$cz0a zaC|I+j@km8JaGa`ia_%g<8ZN$kv>hHF3QsYIEfM(@+C%Y!xG8(})tvu0_bLpq$d7Uh2 zv)Wmn<$;axy7iZk(QhrV}CHu{#nwKGNLpzq!dL|e8t85h&yE_0X4a@v31i1jCH?= z;e`aeUJvz)ZIxxP@zzh^rrJ18_s?)_GScvqHq0`j4m!zs zW1?NtIT^d9jAYC+nXO7c?FDt%)trr<6Wy4hv2SsB;8wawd1bbq?Z<94U7eL@z1Uet zGP`bI-MZY&3weR6CmQXwty|FEREC_ATC`MVVv+4=jD4=Nq7981e)Nyb(8yP%srs;l z$qJ8$IzSoCMtMTb_}SOq@yY)am63C}I2DDJ<7Sj&_qyKiU5Tp%`r^W%N zwgFxeY%@EEZHI5c!6UchU~4TRv(p$0n9#JH#A)9~bne-Yy}R0x5t>3IXA5pRyan-* zGnhmk_S|JpVH8oy96xoW*49!%ZmA-K}-i-$f>G^IWi63suLRz--ScB z9wAAog)_Q<;i+X5R@LC(T_42ZLpNZ5brB{9dNGm6!1lxU;LhD`=-Pb{H*T*(d|?tp zldCYevrt}`hSjNF%q)kIUQmOkx)Q8(zlJAY>V_ph11{eJE}cDzQ{88Are_Ao_F`%J z0?zdXQBaVwufK}Zr!Qlg!g=LoKtj~<*#u6;P{20Fd z!zaecBf?_%^JbU=YNDppFPg}F2a#rkB#jWm^%G5 z9)7Ny9c??B^Wx||{VHBRegdaX_mkY_!5kRk^*Jm=tmry)3))L;SXo@gM9&5EPG|&L zDatw+Xe8CNcc}6+_!ltNKY)pa2nx#b$VFltaEv4lz33fZKw9+<>~8hq#fQFxhfmC) zX4`($yJm6rOgGMVpTX%fC$L~IMQ3>$dM{qaayT`hq#y%+ItSr&%MxCF@&`CKV@6?) z6El!SzxRE-NP;@C5P;2Z*~8AE*om{}!(wq;<);X^1%r{NM<#^p2T zFlnpC?YA_d`|Dr91CPIiKxr3tGtD0-+lC33lJI1(Pp6fQO&&ho`ulgdA{W6vGwn#}B^q7-k)%Xs^w| z%6K2k{|wHYJ&l3oB${eVF*`PeoK3q?7wyFZjQ5G5820S#M36*td?kRG(T0MCX5{&X zapv*_%wD#?n|5OP^#|~k?>vRGmxeI68lKl-Ovsm#=G>2pbniW@hf#4w3t7sf=%QAC6A<~#4iO*igA zTSX2+Y@5@*DDpe@;=a3XRdJVlLl|P&McL=>z2$wl<3+R;a!0Px7>r94I>n`kVD#FB2H!e$CjXJUYzTd*VyIRq?e-HNW*+D~= z`Vq~?;X7}JbMZVD?Pb_bV>=%!@R{;)fX403Hyy-=`Xa=a$1p`AUfQ|~x7~3!ZaA4Gf&1Dr*r^#Ocr zn-{O18bCM_Mt0+FeE7%)j7-d8>#ZNc!H#kSrZ404z${!DrPy)sHXOZq4|eR`jZM|L zSezOIn;|wFxRXZn5$xXDiArw(uRMDKeh0_+kA4`3cW=k;gPUOKy@090o%sFRnsM^v zc?9LjXF)aYVI2h~`%&C=D?aeS+pwv%p8cL5Q|#+z=cdtp;&q(u^P{1?9*Na)66gs` zhBB~sPa_t3dok-LZ)E=vr;$^&?_T`gy*FaxmTf3AjiYc;k&7KQts0vvgB?IGzVn5@#n+x4LRot&%1Voo zo9D&!rEWIROpKoyhBc=Md1dXm+L?+Lh%cSj`5k&`??=2N81WcF+pV z&Om0m2Z7KMBD6S#5G7>_TGm;xkEEt-dMIf#%`_LZb%1nr?e@>{GO_}jdB8E6yM8ar=qpS=?o)}Jj^RxK- zfBt7Yexe5^Yd$)5?nma-OZdz`{578N*|2ASCo*jYbE0p{yd&Ob`eqL$R@KAIYt=mNp$Qvf}3_XAur1Y zbA}5Js}*UvMI@d@h)#}Scy<{!Pd22y7M$vI<*q)6GZFNs^S2 z?t;t3I4yQ$S2UxmF%yH`=P}Z@s^W00%;_nWw9UnPbwoWsmglx1szDK&E>>B%A>4#~(WZXmgMKW^UE0RQ|LW*22i zk_81d8#r*@$GC4pM^!f1QR1cVe;=<5jw3|5)|!+&wKIB(u;-?G@SzXfiESSYLqfFR8Y4W4H-ckd+j);WEPc~Op3-DtZ=5=;q_*a zEW6>!$b#KJiKia=4o-~EtM?MF2*PuVjrB)kba8qH5t3?mdK%1Xri}ILpW(o`0#8n+ znw_=f*5any?!o;Zx}T(_7PkeeXkOMH=FfK0HT5uyXr{@yUB` zN3oHE=F|)lZ2KN(KDHdV1^YHNqaf1*r_+SA{8H?^;V#^F=U!l82%{4#h{ag$cFL3H zM6SmLJ7vhWik4CASPVfLo|ZI*XFD@xXClqKjNzUI)-&a18x96ZwAt@OLn{~_7{tWf zqFUQ8Pr8yz8<0%23VrU%Pn= z3Zp~#=D++s{`wz2kJm{&UlfB6}l zp0}aCr4HqFZMb1eEhdgVjKBGd|BcUm{}s%wglMo9W9i((_~*akG^C5SzJxuYLYAI5EpM?s2Gi<$a2@ykZn)t>W8%`Dggj>#Nwby#o#! zKk3=oaIxMDZ2O+{40v2l6xG%t&$5aqzVa{lyMO*NUhbZPC9@ef?(M+H%Majh{^cPg zt2eWcE8^H`6(U;S4+d~yh{JoFFv>fBZ=YR26`09_2!;xF9mYt11 z{{a5tufK)~a{*f0n76EKT5)BOd+wKjHuW%!9Z*N&Pou;=l*)LRR17_{;zM&+zGgpTORa9z{kp3}+G3 z%PPgju4ZI-bJ#E1VP{>|wbo+riErSq|MDO4y=Tv1F_?sZbqN9Xqb21PuqOgoSXfc3 z5JCfIabY_v2L5a0aQzra(cM)2%I z|Ahbf=YNkM9Up;7CP;n-pb=>1C7Fm|Zek4cK069&^%~g$MZ$4pRdnEv4}S_r_mU{M z7 z6$wn@$%np%?>^U!kj#Xn?p+JkU4rC-!>!p6CuxeqAdjti$7FTDWOMUG9#Mr!R{Sus zqjlsKf~ao^ z(P#vrgc%W8r4d~PgCZk0ALT8ZaMzu8;pWXPD9y`54o5(9$cJOEzkp*GFW}-U&*8gI zpT^~p%Q!hWjjXyl)KumpG}?#$ky%*G+KX^PR)kOpX%Z{gWMcm1oN}4tAs%7)#x7%I zK7<`N-i;64b0aDWGGTJ%BfG2=6`S_q9QN>fj}udFlsv z_?d24OY3oH-v*fHCowd&f21itg85!^O)J zNJL^F{Xk}U9ZEATSRH5Q>N6pyqym|CGh!r8^T8O3N?D$sBm%4*9|w?NoNb+hR60|% z(wO#?cH+(t{W^Z{_kIue-Ejl*Ja#Nk4dd7=FXF<`Ec=N@?B25z71>!N&(&z_s08LN z;Dr}n$LO4&T#*VNz#>`4yV-wS6(A-XL`T; zyT6I|-zv*$@|d?8}@8Z5(h(`o$QOfx+*a$JG1+ zY+lwsi4&^>u?Tf!Wfd!{KDAC+dO1m2^hxwc%`Q{llfG#@|HKb*{K5#5)Stt*-;UOj zTzIl7aOlnt<9C1Ww{ia+2T(&}&>+T~ii3Yrh9=TWv29ZgLNrzvg0hsr%>j=x%yr}O z=SR?Z^nU!#?|c-S%QDzDql!qXI2eg))4Y&th15Om9Ra4LF>&QC?Li((3t?CO;*xLX zPu9kV4skn;DrE;>=Rs0mZvut_3h2bvo7Goi!b6l z+oMeKCz+>^ZxJKC{V=ALprpWs%P+owVQUpW_&dLi4;M}8e2yK^V9(}ZMF4od*tub+mc zstvVXhmu`E^1xHci5T`4kB9w03^St>Se%-sQL{)A??h!eiHdI&J)`4T3dl>r63&3| zY8Vw;kK$v$@mn~wfyS9BRi_eTDvh;rlBEk4PYG`R&~M`2TMwXsM9u8VfZbun;`k7j z7THc^?EvL9#8#O0Bu0m)FfurVaT+mJJ4qn#M&%tCGFEN9y()bq*`_YM@;ELpMzFBD zO1};`B~L70dG|#0N?t%s#-kYRzle#j3y1Ig2tItrJ{0Aq!I55uoT6gvy5Uaz+WT%r z84cyqESGvuB|d!t4?X-6=9UNXgD-s!&-SgTzB{SY>@$t!XG?SuKnXV_{~I`Ia%2x}BDb;>>?6T|qa zlj=!OX=EBh5ff@k+i=UhH=`yqm;K=qmZleQ{(KM0x8IH5qV9Lq6|!EXW{t?H@4~)a zby(`{M&HmP^Dg7&EKZ*uLVjZ_^4JH*VAfP$y#-DI|qq8(koH) z>q7=wGY@&2*~Eq;DidB@!P1HeS+q)XbFz`JyJ`Jv>*@llew=>pS$zEqU%=PC`emFS zn^iANs1B43p8Y9x%|pvOOhRKuYi$|a#weU6U0_8i&< zuOouR>1kYk^+`PRzytW~-+cjp`_&gP=1;;BVL3&jNU{^2pPj%Zc8o*ggE)Ee5)#>k z$SAb(o&(;}2GmyOV7})CeCyFiF`V$AwLBl`Y8JZzHF+*k|q$^yoEd+_wLPoifc3JXc*YAB3^GanVT zbx8OpF+Dv=!^MJhlDI08-rEk{gZ&%J(ArpvhN1%1meq7l!iuWKEhu-dVt!&7f#E@t zlSlB)2Oh*z&%dr-VvG5gaOuR0_~8#9!wctzVQ{$MB=HI?&7$Yb3wZjqZiLNN#DXFC z12H(W>d@I-fQjC-7+VR#A!|ixh-K7lQZu<*T3fJf|3P$Arz5i1kEb8`4jy27k3M$- z3nWA?mlru@jW~4Z2JGFw9b30=L1R@8)G~R6R8K=C^Uux0=bOQ)7azuBC&%E*@gT6c ziXaD%rLjwR>PJ5ySsF!VSp|yRc7zv(@#16O!vo*=7Jl^X>lj}Rs#dW)J&4zydmN9y z+Cu`If&6rj+I?VtX$kf384Qp%jn@p@V%!_Bj8L& zLAsM|Xbi7D^)Mdz`Zw{zXI{hTlD3vq3#a`GKauxOEG9dO+IFk;>M~on=g=P17bkK4 znFsJM|NKRK{fCrcU=SC(`!L70w$`a%U1Ke^%5%nNvS*^CtO%xw{|7kMGpk4$r^v0>%R}vnR{JV(=}@;^a$D;}IG(0e23{@-q;b zJ&T9F@Ok{(m%fFk&i7*EL^m$2_*DMmG`h+=>S38YhsT~gjfIg>%mqEDYA=JAhO3Qa zJw2TUC^Kz!W}vpQ0TqQgB$BC8psq)z&g0BD(AZK=a>Kzs5#ktTr$Oz2C$j(rnJz`h z5`jg$^5Ey#w|o|_&v|j@(Su00u%DV9C;5E=4}R?n_{YEfdwk>3S206tz#xQ*WgL$$ zW4NymGs_{&_n*T&$xOj zBT(^bwXPrp%$?DM8xFN#;AQImGc+heao%S>n7)O5pf@WI6~%?{*sTm5DE!P=wwL^8_T77}zX+}nLS?nqXKR!dJfaFkD;i#%-O&FsoS}8V;00^i9fN#=nX(Kl8-H(b~ zCtRh?xbcR)NDRD!$6q*(d5*WDuQE+Ab@3HUTR3*qv79N45Or^H8I2Rmnp$X}?nS7V zE~krSDL2;Ne0M{wfj)b27*(}}Sh;Wly-Q})bu_~on8M|eC1jSApoA7&aX}$m$vIpc z3!o^=jH#Ir3bGs+WhIoAxY7OU6PQm_psB3}xw%ECDez)?Qf9P8sn=9M$1ek<@jKEg zan~n5j;>5UPRjZ#)hMn5I?9YsZb1ps%t?%okE+?H1Q}~leG59-06Q8h;PsM(_)RFy z&%|`k37i?2!XgJ^8Fa67zN+yUNCP=|1%n9sVyHc^6)jy&s4FVL5r>jGn~;GoFAN1>m_9!oG}(=r@735 zcN=Ogqj>VMm*IJQ52!jia@IoI)=>RBD8GYh|b1ZWJKoBefB&InI+h|V=L+# zN>J{wV7{*x=X-nEZKR>3u?9Is6{yblaFAHVxZi;4sv;OxM$kRHL>U-A4aa0O3Nt(8 z@{$|`W~VVRMaT#-d4s6CGGV3?t zhJAa{)zC;{z=6md!sVBq!y`ZX9-evTW%LBoU|sIV55D&_CTRR-R@I?x!v@slc`!BF zgOfd@EYAkCS9mdc{xr@FP9x&XMi=XB?$~qq>^HxMCtm7@tGE_kmT5e#gho{*%4#~$ zQJ=(xW6$8(?s@nlJ}j)Rz_+@Dcu>fm3F(Ek*uMV|_U+n^<{~d92fFe4=`&b~J5kv{ zV&B?`0-F!7zIGhF(=jycJb-5JG+uiC6sA{c5QJ86;W&x*Gf(5$bEEL2TXEsB@8apR zlN=OcG{#nG6s;f-j368iVC2$iyzt!9c=^H*LSY~JPrQm_=f{v$(}mr8cB8AQ2Kl+^ zFou^gN<$*-E=5aQ7v-o!W^^16Kk*tu&NA%3=|=3{wjI0LDzG$o5-*0 zlH80mE9M8N56?WQ%INvt1saq=JpY}CabjqZ`n?A`Hqi)X8???`pr4aih7}!qj^e=1 zjcDTF?XnvY;y~{$tU-Gl4YZnilx0M4{>(`X`&?*jZc=WojKjRxji+8dgJnw|Hf`L< z!MFk~t!*fAhcGt10C#CC8qxze#qmO@mpr*igc2MyYtccHTTxwwEL#Y@ufD`_VhI@) ztt_Wj)aF`ox%&(*jD=9YX&3hGWga)R!4n$6OUKW^Z_dQ#9edD0eW@+7;Vg}k^J5Dn zCnPOq*~MlzGD)(ZKQ)MO(vPUggSKr4sGsGis4Rgkv5M)bMK}wZap%3apwJS;@bCnJ zG}xuR(?Wnh?nOs?HT>fw=nDaqHEhF%jz-i})uT2YICq>znym~6j~t{?UxBZJnsAE{4Y%LGS5P z7?@txI#TvEEAb5M+*XH)3#YJZDaL`Lw_?YJHdN4%up)%7RS8?K%GYEOh(Yc`s73I~~*i?jp z)34)L@3?viU0y<+TTWo(z8#3M?-^VSpzY9IC|o*$??3OuZFe=}dLKpY8saFx?tQyZo|gxEVi6j%R-%#t%r01{mTXNMx(_+@>u|LXaN(`i)ui8OBgM1dAx9%;#giQeG%xat@$U0%xWFf`{!c6JVuVLxW(7nwnMjA|qS zHX);^3Ol#9V(#QiIMy@4!QV)tl!=nkQe-%+@Xg4YWCowWQ0bkgp z>dxg%z)z#XAB-buu_HH=)Jxkfh?3v;8N~ z&*`}(4o2$?Hr7Yd>Qs+bLI3;x_2EItPZ4;6i_L!;wL%GD@Ji{7UX4piiOpg z2@H=+BQ8r?s>_jSjbU`CAEWHFT^aePR9o(u5nG)_Pv3xg(d^A@@(i%K(vV+Ngse0d z4B-`w4U;S_`C%i`Eh)-Jy4$Yy;GQDk7#AHVsYPL?lYA`>lg)sI;UP>eCQw{kg-n+P zF}90-8e$9n82dz-t6K+_f!V=wE0!e!4n-0YF+Zk;$EXiJ8Wb#eDc5W_{2Zv3Ls4Wg zJ(A@NFcuw0}(WiXwE$&-g%5{Gf=FU0s%Vkcnr6rh#{hRdA5 z()2inN2d^GN?8R(D4{_eS)$I4a(qbIQB+>8&5)50j1Kl=lH}9k&O|v0Pqxc|+0lLs zjHh;Cp-~YurQz03{uU~S9>wP$Iie7n(c;Y^ zDJ!8a+1U?_ppWGoAi1xrtVE{AfcXh|Nm^bi_93^n4#jCU$iCAyQv#F2y%?PFA(Mub zY;hS5EVIv;$I{9w!UhM5*$f16Yb#$v@ICJI%a?IZC~unI>6q`P=Tmt>yE0 z;K7#=^X8#i)@ldEI9)}MoMq7$M|N=;iu2j8v8?AOM=&(SGNR5Eq`TDe#D$4L^s%p# zrZ6YgpbF~Xus>D*c5sRUw-5~GHV*(Tph>Aw1N7Nk2$uB zl_ZU}#%j3ay&URskZov)nE_)+CN?6-V*biuZp1m*t(y?CXYTuo#hF zQiPmruX-wLGQ}{@wl*@ww!$_gTl<-cJMod*nsNNQ-^Uq}WlKgGnrRrx&LaM)K6DSw z3Ed!ta5Ha>$g;@tq&^Hxu3RaPcPswz5C2dI^dBd`@P*G~VSWK-c1-g4T-GXyrplum zS@RFRMF{irpaCMz;4ny_`}HZ-~Xc=Evq@!EJC z7Fnkp4=@&OFq1fiL`$ATXJfMQJY$v_YqL>qh>wSY%DGQM0_M??T$G^q^i; zlC~j_{@BSRIOxb5@InCPWs7uAIrbgA16j^qy!yhE7#Rs56tQw(6S^OxyppDbXIqO& zIOc_Mu9cpw8I>)E)BsIaA?0f?xk+Bs2S}JDd1NTLQ6IXH(Kr>4dht-oj7~(DTJ*op_yi8L|Po6etx+rV>)`+D*oGKeur2bPV*@m4R;NP25)Ed|oY zYH_6e^SqkQ(zmi+u9ZW^N~_vdGZKv` zS+w+0{+T8#;ELW!Kc}@HDH72;_63sfwQ}Z|D@zNMXe!U5)6$o`K^NJt$x@QIeB4SZ zkrApsP=(RzO3R+Kd(BOBMeSH5ewiof&tz-AsLbrAAaYnJb3*Em@=JfB_rUE(J+v);~L?arqQaFp2_x~qKgStpYm=6jc@vADXFyA zN?Owct*x-oD4XPo=c-Jl&1-p)`V_3`jEX}mXiW~DD&0`!%RYyH%9~xwov{@~ROpD&je&TETvDR-WNZVpsYV1zM@ovXD0{sOnEy+Fr zTH)!?@r#5uFtF2OqgLdA4fm(gLUv+FvkfH;UD#ObLEmeyC!fbnV_ zrXrIvXiCSy_O1pMcI;}vRK7S+QV!{`r1O=INghQB?TxcD67pC7TuJwV5w6SB<0#$xR6_(aKxxawSpAFE16u(wA8cnFWv? zOe8Lih--fp8CHIImAa?GGtwy2lE;kZgwSgXEqMAhrNXNGNq*#z5UB)p=+MDtA)ktl zviX`I+x@*&lh>i+mkHXg6Y``&n+4YKs|g{{*UY28`zO_P{K6oQky5k8KRrkwjdm0_ zY{t>M?!=J;J5ZVLp}P^DoC<8&dlPQI?FcrvRKjhuz@1TyjoY@Nv7!Lhw|WF5WLsvI zm270sDMD^G$&w-yVn%H#hHQf+k4)on5?PXMHUCSGGRsUyN+w@XA{QqUH}KplkH}Mb zUHdEaS1zvUB-fp*$IFyKmNKcO0%pph#AZlEo>dHl1X>@74jnq=sf>JeO&$^J_|<$h=Avc8R&+Gv!x-@+7>Y1l5{~pjY}mS0 z5oo)b3D$_Hw!TeUtEFhEEVmF{R>^3y!*VK%L}Yz(OqPt$Z$j2t@P^1C%eEw626^?L zfwft2EibYzRUWvhr!x`}f7WKjwSQXExpGB!dEri*nI>sw7|B0lQ@?5^UClZx0SO7M zLx&C>I&|oGx4^V(*RDT3efl&)p^%LGgg%(-xC$YFuJl|~H#DNAyck}G5eb7Cg*9#1 zyJr`w3esV-T478^5r`y_mYs{7oE(%@)}l1mi%4)4{%{|!)DwVit;lMoEgT&-a*XE zKD|PoO?Kp$*P^+h7R7mKh=*3ON;zbyg}fLc(8zF7y&#oSREC=RMwDhc5Drl1t?4K! z%!SQDVsEyisIU-j8U&F<80kfo^xKT8Tn|D%AABV8^3sf=${J7Bn#&swZ2^aNF63De zZ<#_9=hQ77I&|pJp+m>J6S9rn8wj*My6ad6l0U0E6C1W4!k#V7aM`RdL`ftg3FKEa zqP4yn=}vjO8wf7XV=iLDmK*QIJvVeAKc^f`Z7s+#&S7LBfu>E{(OOxE^5!;dtS`ah z#60rb_u_^}(HQu6%Uv+=DIcbtJZh$ji-uF%m@F;zj+2t=QdJkMPn2 zh9+haF<4R9z8iPmup3o5UN~$&{_c;Shsac*D?Gt+aJ znVD7lfR1#(fbaeANn9G9gTdxOZEHK+3+M5`SHF+punT#f5Qc_l5DbSf-gg$4XH95m ztwCtC2LrPK*fVmFT)w{AyeS`cSnd2-RG)Hgmm}qZ4QyI&|pJq2pHzLZGi*1Fb{HdXW6d2JRAH{ti{xEJk zyc0!U6T(3s2F{VJp1q9G(E*%#`4ybH(2J3=L7Y2#R(;^2=iC{!ebw;X5@JSeUrHgr8$HRB9FXmM4=OLwQgD72Q(Xuu$$~Knys*>yOGt{hTTW*#_swm z_*Vm1O2!acT*8ukydxZhe|{C=m=$gs4n;LBxZ%hxI9OK+|56MK@hC}iOnus1uzs>x zVZFn8cO5!(=+L1<$FCHwA<(HgH61#xKsLS)&X3{wA3lWdK7SVG^g@*8r>jlZ!}7V~ ztX$-0XTjsJY2;Pb9?NbMW&;v2`2;hNQ`~^cEFT_!;LG^#lc%v5*Wxu>tcvui!)hfN zmk%9iTUH4vx6sXM6>?5;Y;(esmIjy04UabsZl@iw*eaGH29#8`pfV>H8R;I_WZyc2 z33f{+_TGFqK5_pIC^OsD=clJfdvNwlHy(QEtN8S%KZ9?4?w7piHH&aEjwrJ!6U$oTF=*?YuS=d~20V4D zLx&C>I&|pxmBF=ZpcO5ULx&Ebe+IZSO0eVbEx7s69@G^&G2U|)XD$q4)gMCK=tOnv zMr>`bgEO&=iG?7%>6wVh8s(`4H3KYrQ3Mllc#G<=bMr=&XS)%YJY5A_8)&oLDikeV zytuo2i#x?hkQ52-PO;+d?!}$pF2yCd6RfyfaKG%gyO$rplT7BFIWu$S49V~OOyRB7 zgp@Ewskhxiep-=GmrxYeMP2D@ehj_zzMkQnyL3x8s4>xe2eQ+a1nm&i=Z)~o`j@_k z^SdUlv`UwL+}hbq3RWK9vj9YtKugEteC^_Q{h1;m60x^=EWsC(xQ@j0Vaurb19sFO ztH9YMl!P3QkhP{`wnn&Y^nq5_%{ZgH+okDh8+r?DNck|*!2SoWPxJuoZBERur}Dbw zOZnR)K+RKy&p*0OXU74IYmM7t^svSX^ke=C(IaqKqN1sGOYf#bR#!OKIRS~{db1`S zK4@{t_4RJfSPv2_&Bv2$RIniK4L8$Vz&)ln+Wui>(ZW?0BhN%KsUGLCuO=LvqYHge zg{2~qX_znyknm*Z$rg?vOsE^99x5XbKG#gt`Lvg{IhXD~v;Q+BhkA1g@}2?p6#x@6 zP`SR6V`#?^AF?@Ps+kpBN7mQcj}fEfH5DaYP+z%`EmSx0RH5&=0zt_5@}EwRUhAG1 z{rkF>pJ>FIWcRrJ(wti#BzQ3=f-Cwy&nS@-NbnMURXa*3yY;5?uD8HhNISkL>xz7+7iN*CYk=tkirou2vzLI*1Iz2Ruj}%u$gA0| zFyRvPW*uc3ySaffTR;jIUI9b;thAD730Mm446MO1{C?p2-NySkN#8x5%uT+HDO}@d zTMlvxnHHaz9<2A6RtwL-c4i4u3;VLigrBmXNLr~}xJdsKjRHyNyj*-KIO7-B6n3$! zThOmdb<4DWkonHpb$s>vz^>C;8GXjvfY!iKf;!^k-i^}xgD)fP?NiO)p1kXSU?Ex7 z&;Kb9c3V=^ViI-PQ&h326Ii?avE~f>&QA56RpNU+{`Z>2wOUwlAj*iC(KiDf{U+FO zRkZ0^2mB1jtyB54m1vbM`B$F0yA&@q)+hB_j4nl~5EbdB8yu(y3t*#CO<$6s!PAJPxAd_wYoEuJ&a3B0OyA5@i-BnjE8YyME-BL(KL zrsxg~J5pevkx_T9ehkt9ImxWarUO$gID$`{Ot+rVOrlr6RY=C+Gh+fu7i^vQ0z#!q z8yKW#LY8GHhOERWF(q|wXD~f;M_XSe#9ZI)c5*Go$d>GlM7XE1KfmY<>;-&YdZ*BM zwp-q)zsju!)@J47^WFM|uWi##7{rrkSnu+&-Bo(efmRlPIxQz@p_4=*BN2-^!+BQF z`CXE;7(W6x*XLN0Ao+sDqC~=TFERK$*4kJVb6VbMH95FSUjD+S**v^tfC>jyvrhRx zojB|61kYcnnJPq&^Cy2)uRGAMmz-FH9Z!@w)i*nbt3Vn~;$md}U6j-GpT4Sm_7}a{ z;z9;U^C2$)9C&2E=+Qi!yPn;H`pylh)v%2#6n5zl2gk3jz$nGM5EbO3;Xh2>R;2eV zH*GJRY2{R6vs-Q3RjJ6FNeeZ9>ELwPC^Iu7iMX%r;xyL#VUG0FN0}jTxD-P6&>nGo z05$`%io5=|p*Ve_y{7r*llO-(ttieUiBg*%@c@Ik*3-fVb1+j@N5z5%;x)-~ln&&k z4LAm8fRgt>O2kG|1_$N*;0B*_)s-X}Y0Jzd3}f&MNxVOTJWuss`bn{k1=&s;8rakb zXD6UL#`eox&B{v4pWV^#4WpY0FAS-$B`NjARQ3p6Sy{r1Ae16p-oKr!Fu$pI`4 z`KZ(*l+IXeFRP6wf#?uo6=y`X@p(pyl1xAeo@I^^2&mi6lw0Gf7vr zr?zs!iH{B0Up4>=*vm~G^8)nC=OEUwhIF2XZ;Z;TNVbFp|tYrPohcaLu1 zB1hGVsPAkoa|F|mj!5tQ>+@{_{LEFy^mxf9!<|;jkj!AXznU!$ZY>6OeqEDI39LW< z_Cr`mIP7pA$+G24?-1;@za)u*5<&jSFoYg?9rm(~gYu&N{dcrFJC@j2T@n2iq`asV z_+|B-PNt53Z%P0hZi)E^`I9zVc1%w%fo|WQfw!WR_`{H~r36rI`?554r6Hi(|geD|D-3 zp9qV4nIfAy5`4`?PP-x&&-cXdkIX7)51)XbcYa5VybyGa3v<2APqKA0eO+@dXRB$| z^?1GPb2$F#t^lQ|f<@HQ4DEyFd&U^IvL4H#k_unwc3z~T!Pw}C>1So8Qd)`n{PM;LapIEa5;|psGCrmGW>KqJI|-!PTk$%tb9SlexbzwmwQd=^ny~!o332$8 zlG<-h>!0_vewD(F+D_x3Szip?&wXe~-!uFL{k2(d5reZ~iMM}V2c|YZeN3iqU_qn` zqYkf6j4ksOu~2x~mT>EIgFiI^dgkfdI~q+4@U&mNVJ-dGOf@fZ>qM8-do z`D`Qt%EccHM$h$YqpYeyl$>Tz*~FJ&WRdSQkruNu!$(?r|CSuCwHiEATyyi}(h*^j z7>oSO8t#Ja>=+_X2{u- zTyi={{}(N_jM2lkM|`3YZ8lY8?;c+=2g5g@PM-0{smTo1J`Fb4J#4)n`3PcdJ9gGR z=r(#>vh)PXDt{z2Byj~7nrIn@zb1C)i2s0mt@lEPpsaOzKgfApwLm_f;?|5+tEVky zjPi5mTu-0Ba5+^eJ2te^LBBV5Klb&}u!=tNx;(ue+=edq>Gis=`k${)g!z1!6A$T)z&g;2NC3rDnvtFecwU$8B9ya#Wy>q&I zrgxL0KdgKFRcSR|R^;m&X6q^nnufnB5*%FDnxxK#n&dvE>*l$5Yk-Vu5R^C zGKc@+4(sL$J*&HNH8ewNHR>^AYx5oD&{;BU2k%92uG;c+>~Zg~h_rHqYsi)YXppN_|rL-$VnaEexNkz&osYXOA z^|9O3e=cvxEuRmy^_PKd<};BUz;a#dmXo8&soc}6`=^^{g1uki>3M$`BR%QUp}ks3 z^Hl8olCyhJ(7919Gowo?Ll*BmZv`K;;uvOBEw2cV9a@s7P*>o#YU^fUj|4-yV+a^>c>UJkvR zWTZ-hL!0B0(7R)34JK$szb>2ugaV{l*jqR4pO9_iojBB`dsO$e*N${^Q zNn@Dade{@t3$#>vuf9-_=O^5c8F5h-OwBCBoFwo|4)!P16yW9#Ilpq=-&#{7;`OuD z5%{UDl#%1J^RX+h)}tbz9et6L{K(>hPO&#Cb)QIV$~-2f=SI<-%AlW=RDQ_q?|H7J zi^g6y{2h9){T1aRqALaTR-5vtS;~wWmY=;yXeaU`>(171i-y<>*FUlx`e0`wIXRj6 z5lYE$u{1da3|y|7RB=w$uqvOICy%V(+Yox2VkSSv)CCa&d5?W{4ytUDv+JkvLLlX@ z{-DTat#Ump)_%BiJ@P#^P|fX}nP|QpwfquC+C>|K%uW}nCq{FoWL97fcc*J_RNTys zZ;}Zk@q{zcPlne&g8k}tfsb+$TIGIEVrgC+IH!-BFoE*vb_^8fQ6Alw6yUT60(=>l zf=Y`rPy{&@d&Qfmcf;}ycwXeHW3z-mfU8W@g{Mo;TYav-`=KS72yl{nQ*lBa$Tt9 z{aG7C#HY8_c&W1EeL+H4qoXy-Q}R3HFlcf{Q#f5<1hqWt)Nj^gapX9dTx0CsL1O*? z2jtgv@9!>(p0ZP$cnnmSevuPH z4Lz@6^}fXse4M0ucwV?4qm_w07{z-Cn8h!yn@vf`shyqCEhj`pjeg6!8Qj2Ov+A~U z2&Y)(6EqQNQ);<)Ha1yBLHI1~OG!yauxwiHn-;3H_^o|syYRgcNAIBDx!tPY;E^<%?tnJEjp+m@6~|IkNM2#Cm+ zu3%7Z{)zJ0P&915pI-;Zy2$g%_iX`r)XDp(QOMbu5)6U z*cpcc@RiyUMYKi>I=x;xox@Bt9~vEoht7)GF54893o4|*WRn(Q!=vR|4#V369|7rL z52HZ!rdjy<>jQQ?!c?GH2~&Rx04!`>*!6~IH2qIoHkmOwo$L~GK_JA|%_GEC72#-P zMh&M0kea5?hS}g>V{R}t;Yajwb6>zr_SY-AZlwJ`Au zs%9e8xGZb%63@1`K%^U5z>J>~-fl?+PW)Jd#kkt#eFGxd9CI?{ouhkDIty##Ar1l^5Hg9BWX-%5pBNCREK@E*b`8@ zm6hg>PcxMn;bd!_O;d!{k@fJosEE<){r2WO%casoU#K@dV^kIU22Q4BG5>n1|?MARI@qV^q@{PYzNsXY!4ybcOW0 zXcKBscQ3-C?@Bytts3fePs5zt-f&)8=6CQ7%wXBrxmga%W|gh?hvHa$C}?G^f{hDd z+}%1aCw`f0Zl;M}~6Zm}oSG5@=?x9=A3==SpT-bb8-v>i3$>HYtDVXl0HM zh~g4)9341s@GlCMH)+@NlDD=I5b3ubc_kzwQa?Lx{aJwDnb5&d?8aJW470Hz>+@>) z&GfsovfcC+&y{^wn;YHLmHIxvQJ(x`3U<)N3b#09=D1HV$xEw0PuJ79p$?n?t+-^g z)*G|xsrjEhynioclY1{dLp9mrfrM*=C(jH?CixSf8nQY|Ag=yxW(36kI3eq-;rTMH z)%N)PL6gqcB@fm_r`qwrHFRR9plH6hi6l|*unk%>upCT+J;XCW^PP>O`)>z+-yH;1 zcvWs7mdjl9ad3ZZwqbe@5&}HqX8h6do?GB4hn*mmfELYl6LvS%4rINgalB^&J%WmYCUOa3Jb2UwfNpn-nb4uPWgj@QMVIH%o zz1)K044)Cdi~1RiQ`1;$8gN}iEvLpBo5O#fMOrv!sF%>uX1O~%V{y;YCWrI;%K^q- zxKO=+Sm>OGClpo&PW*-QHScba`ZX1cs|^Fo^o%_d6uGE1fBx>n%65U%lrYKtA%-P~ zShzeyYXbLTxD^asgc>?D?#(_W1O@si}2-54wfLK^}Pcd`vGB zGF{V!J5+oZKSR@0o9%bpr*g2>Dh|YxyLB$BiXKU&m~E5=IX*|SGgYgq%|NRVj=^)^ z1rj7kG`0&nhRt#Ir zz?<*CURQW7Cf5L!Om_Onzg+V~0#Id^A6je7y}!4-_xsyjyu6zdLQY}i*Irk`C9~83 zX@rGZr)Y9*|A`5};S>1~l%aea4DkFQ56Y=-K}=Ft(bJGs9*|kQGD=FcZcX;6;6L=@#NSzI!5%K?s zpGAsFF#EP6Axl!*y_cVtO%<2tphsYYF{4hf)$9F8qSX38G6g*_(g7a|)&~8# z(0=G%^^BTh4#ym8re$X8-jQbI@`$i7tTFwF-zL#Q^TjQHIL-EBA(Na6$d{3*B_Py0 z?Sg^Pp*7w1H&a+0C7>lJ$M#c$*oN57X^>Ft8m$HRS6y&G$~%}d$<7J|!hBnK(s$~i#`pk&hVv#C z;jXJruVw-Ut&H}rY1u&Av9Ik{`BDoUjUn~sB3L{Xm}hmTGmuBR7Uzo^&vQNJ3k`Om zA8$;oNUw=SB(;m?z&$6p+MhCd0J5gV{TRU zD;xVn3snn^RgyLr7Ts)KmaNt~XM~1&Tk|a^-xN8)5RuFCvbNlD3 z-LT&1ju=rm$d5sSjZ~rQqt-u=b|2j)eP;@>ghtW6&a-A+G83EQ)z@eJ0mI8`?CD!HBLlkisu zCEn4~mmHYV+Ocu-hvs?_f^L0>bB`A1o4^7JU_Rq*TspJ8oq-9%!_}6E`XO=yix017 z6i}>5;~!bkF#a$%i1qQy%ejaw)?a=*j(&1)b+wc+0FXW+9Pju%YSYS&Ijm1sGUgbq z;n5a659E5RwZBO$4Pqd!njF{0JzMOtR($KE41VJtxzwNi$Zo>pvMwi;5{bZPyV`wd zX~#xrXTNz4GLW;2CFC(SU2+aaAn}OKSmd5q{6^m88Q<$l|7;QVZ?^knjWwR@c*R}q zb;QWCo%1%V)YP<$N)0Gum>hbW#ZbrT_48dTjzf}V;O*Ku zN^j`=3}95?B-4QFmAdCOJUt1rq} z<6t?5hsE@UJL__DJ>l+|5Fb4OJ7AoGqwMjt&l^W^F0R52 z1%L4b*G2Y`D{5DzpI>qj_#JCw;OEKfB74-$%x^={B!(&-HLyn=bFf=s5Q$CXBYgVQNG8JfC>uuMV+xo30?^yxjmG=XU*TV&2y1+HJ z$n8Xw>r=)x?^zet!=v}JRHlGiMsjVr*%lYG19e6g2%r;>qiFyl+=0!buwjhC3cDhJ zo>OjldL!H>!RwRe1OoT2f7YZHMCKJ)|KP-Af|a*-0@j>T1uT+VJba*2Y)fnJ=}Ro; z?f(e3-=%C!C%T?C>)sgos3gPw$-hrOX=$Y++AR95TvXM7O4{yk2AeE&2nkGn+#o>& zuPLA5<Hl`EfjKP;h?P-JojexZcTOE{-?WhZD^%zwDYZLh1KUj_P{gG8I_`; z;Y?`ktTZC`rA*uCuxuCR9rSb4iX)9sEioDTjOp{sE-Mp^e+`f#n^)3$D4KM#68E}pE1i<*CN02ANb{Inj~kXY+ewuz#mT@v7R5FAH7eP@y03>r;=xGP0aoV!!M~g zs1>kMY+1j0W zbmW>*#;~udZx!tW^===f?O9snHst#bLQULu;D{4im_a0qRelOq3OChq;Y_dvuQ4&A zWiDw|U9K&Ckptw7L=p2wHvxBa>ztN0{6y>1KJB^Fc=h#|^FW$Jx{8wCq)=92VTp^V z@c=QVft4Idl7~2!8oI`=;;C+zOP|>ytUdYI^upkZl_U1ZBeg_VEnR?-8&imY+E>lh z&z{wP>`mqXGC%fK-Gd(m-kVyKd~W0HT$sX34(rJy=0R=Ko}ZmlFic5GSukVwA%K;( z>a;nABxvzxQTAfxwYK|g-|?FdF(C3AgzI(m?H&?zh63r^@TsNxv|{Zj7 zH0-@~G5G7`vu~&(4u!l#?i;Qqzp2Zlw43q^3~oNW_JJ|iqg!X!)RA=53UyS9j_M9p z7+yP=YQKqD!=T394#~Gv{EW-J=w_TljFu!;?!S3F7IzCXQP$MPdlfK5& z*s8GuCS!SCL9_2qtQ=@fxB}#3QBigYr#}?!AWRh{YAkN{qaGSdokF=OfF2rFc`$aH!t20+j9quMb#n})hGcHsjr-RMjHF6( ze9Ygx@Gr8$#yF{|Viy{n7xmrWHpY-rgi`&MNG%RgF2LJ(D`#$MUGX~;XkzXWpI^t= znM1Bq|2D?-waqU?7v|o5;6)S%X3$dg@>X_jHIa$I3=*J-MRg^E2(2LtZVuSRb_<3u zvkP(bmmumT4X1?eo6A0;X{fPEs>G|!eAC$M&Qz%4q{(qI4k$zU!Mu}~*PI9&GO#~D z4i8s|tGuT}Zr0M%qt<6K+O&60ap>Jr(~KWj3dYin_!v@FjjObAh47&fJX&56BVAe( zFgs^T&R)OglqgYD$`G=Mms60PN!~C5n{#93W+OZQ?9%Y4Et1kO#?C#w8>G@`6 zY#t6uI7uZ3EPu8KTnf~0h6S(rz8nWD%Ce`n3V5f=wdrV@YJ90XYVaID$toEyg;A;cAgN~w=d+@*>Fgx*in+&Mp5Xu6;kXN?$_Rhnz0=x9PY zB_V;-Q#ajwLe${Y#;qug73@BG8pFHN$<&>i=RxWnt-WSs!{V*G^qDbDknA*Hu3_!k zRE5Ka#v(sDQhy$*Q%7`6^>)l?Ll-M@!$S-YY{qV=KY3PIIwf*>1k2v7!}4e@u){yS zsQv6#kM>=MmsKt+58Q!FWXvhjx+hRWv)~~enq+0fT^swLbxre3NSB_Ju#+^nCpZ_s zrJ{Mv;yvP_lAUJOiTc0H_0VaX_VcL#{BHWWo5eIs;9J(h>PRegj`X7XS{zFwGPf_4 zdVG*2UB4+`JmjPoc&xmn~$HhzPy9?=6kY%Dv7&Fh8K9 z_g{WLp-;%`cYeys*4Igu8!IfQc%WwvH1uhJh))OU%l1=17R;u<`lp3+^E#$%t@kmy zGvEKh_}~9rn7)jb$fRP__J#wrzSb?UcXE{71RGmAWVF!83!rx!n#4h*6RHk0Jx zo2Y)TO|BgPX*OPhQ>d?%v1>02t6{shk^o&uOyW$!cN8PH9u2m{8H6Fg__~TK$@V=F zsE$=#xzum`5~IZ`shi;mT}zVP?0H;$BafJPaLnwFccpHflWiEeT2Ssg{kp=4Jr_RX zqk#e^?)`1_9d~$8RAAB6ef{I4Z|~oxc(I7Bi#3?MmA(5)NOxHHS~XKhL~Lq%*)hQc zKT9vSpgbaH7%2&&12(ry2uD;%YVbd1TEss*$S=?Ko!&<|SYXXadv9u1k?&HO)l7~c z=YZT3C$rsW^JPQ>XhqTL;fxZ|ac~u6I#Fp%9?TH7)T4oQ!?15wgc2JnA=4zgw`AJC(b#@nUV6;p&yMs$-zMoTE5kH$*eo?0u9X?!zJ))v9H#jOJup8g* zTJu3;jy-;6Ru#ip+M7Loc3K(Z;?G53v5jSRZed(S1$S2@HbV^UUTfl$p9CHcGI3mAZw!3+HJTh;9 zj1r-UDYs?1eEU}v(IHiud<-;CE1869+j8sRx#3yh{y;_C-mCs7rmv92-ikkTc`L{6 z^sjQ1bNHTex-}1uLI#Q>kFtv1S0x)BAII13ZZrrD4VByiG6nY0QfSxFwRlwyauhpR zcXTJ=jBz7iKyn6Es#E30`7_7!@vEbtu;vxri$uvr?!E0!h@hnIXTQ?Mz?Ca%6}i%B zOW0RU;_%V3iMspGLSV1Mr}vQ}cZiP>RyI*V8+Hog5p~D;mO%a5TBy2f_p&s- z!!_eJFQeL?l%rdWF;86Qr8PIBCSi1lSu^prLdSPYohBj;?Ud&E_<8900WWGCyV}s< z_j;YG$Ms2jCwiu98ji`&=Jq4Uw*|Ko-uKkc4=hS-i6~PGs(#3OK|0sYNvKYbS{W_F z93qcot54fXO)>NZ#r2;WREbrdY^$JJRC9f<4<}DbPq)Q!Jz(5VXO{o?{ON(+;-V`# z?G$`&tq%`LUr7=GQUch;pRXOk+3dKSPZE;6yEsgCOqZSgJ8l}hjq@!uCMP7QjT7?% zRe`vjsj=KOC((4(kQrP--RHvPE z0BY|BT{=kwO}Q_?oi6Mx!?CR%dmp(2Bcp^2*vaX$r^Ykt?Fl;Y+t7&F{^f1)hXOp# znBbVPe}h~H^Sf78-Ft9VW!144+Bp7U$#>(Mm)Q(@ol~7!e3CK%AmIe~lr$BwdH~*r zFAAPrOof}2?piU%;c}`-MyEC#^CP(LLL3~PCf}NAV$_W=O~>P6Fqh}FS7T@Kh+8S3 zhV0d}!Y3EWQ|H7REqoIZ#dr$n%q((y5{-<_L-Nm{>1`O<&wswYPa~v7MW_skp8HOs zVUH~LXHnvpi8KvnnNEvrZDZO|%a7f?lkEJ-k(=?i6GoA-C5qgrmWIFDLdYRgnA6tY zAGlBzE^H3+(zyb6awtVUs|=97ZZ5JzFmF03^&Z`cLi?j?;jxzdzsUXqrTqr)zht#Z zn(jUU_^FkI`^Q$ALp!R&?nUltb@Q1m+c8T#=$KbO8B^_K*S$=@?qnw! zYL*(k5@JH!W>uN_o3#PN9lwjA6g`-1+cY$%T$cI=f2d)La#|#OV}q)>yrB#OjA(XX zkKXFoQf0pO*5A!-ff-UR<3N%>eS>qZN1ILt&LXH*%e6BBAtQ?RkFbxWSFCCEFHp2R zq4`Uqs!bc2foJRmX}woH)4~QZw9qYpg}O_e-8f{eHOqG8gf9cPiq2P4!h}E9Yj|HI zjhd=Ujc1}h@guara9BaHrj>ciKC)e{=q#X|J5LWNQBzNLWI>on)BuZzTcWiHe7R42 zBodhKhFv1-5CcDFs5ddRRUMd&VqVeVjKTEfc2*=F2D#MnjPoj-STrnmTWM!`XMP9? zNd&mCw-0qakXsylP_aLZk`ZLM#iK(O`1g$kg2K{pcel2vpakht6qBR-qHEAQUxI;st$RSK=-mYw|X%XTj5`)CZ7T4TFe z)EHwwjJyRir;#@|UoD21P`zyWfJ2&^sAfgppOxiF@JbolsYnVE{tIQi6s((U=ZX9e z+~=#E7#@X=;_=*&M9!cEPtfWu&+K!{_~Lts%+{>4z{9%HmRsG?wgt)TQ|8TF^G#h5 zVYJ$gALUUy=2^mJcDKJ?vHcGYd}n>Ye2E-|ITnQI-fL_mf{kHq_bzPn3&EOs`F%dl z%|bVx!b^ATzmNHDHYe2}|Q1}ovaIwd=Fz)O}7T<~0dQ){#haIQPw%|)+q(nipB zInL=!GV-tt73Y4g&RW}$+W6w`>qK-;PoH{>jBH=JYbH}4JWG52Ms zbcF2!&kIN4+XtGb+&n5IzG^C}&T@VP&CDs36aw5W5w{jB@HiUKTASt=D}j@;CJy$* zRZwR6=2X~SD$QKq%^A-V$Mel*OHUcA&;S1x2pHphvq`wgQB9_naQmYO6SupRIL1PU zL=gx6l+THy!MvF}!vZIEp01IuvjJl-GnzbX96Ws`Dw%?~`6HDA8I4v6HGj`{3^fty zeG!VK5(4t`X<#=#I!&(FBP_AN-s976da6?DW*BIOKK~m$bbi07o8a`L#Irdab>A@+ zxN~d27K*@c^A0qzT<;JdMNrl}wkIZ)h& zdGunQvFTfK?9Zg)bI5rYAzlcj;qWli1_M%zcGD=sSbJ|>u^D?O_0{pwcTeZQnO-wJ zk25N24NTs{hJat(9*4Vds*GTEKK`!F2PFJ+%TY-o5F4`@{)co&;oT1y*n5pyPh}xoe&Szz&mL^Hi zl2SW=9<)WGTlNO1S%`Vi)F^C;Yvsp*;DPI@Tb?dOrU>!CFEe@vip+n}q8G>UH>D13 z-Ws9>%WX6euufE}K=J%W31sZ7%W_Fr%i=k47|@}b^k1zNh@P_ewiZ!ip=Q$VK!f(t z$&NS7^yn~e+Qe*C5Z=3uI#ILnmlWFJOV+)qpI&`Y4AGKQbr90eYWZex(?k2v^F3mz zZ|py)>Ya!Ewl-quSl45(6tu$tdcw?Vdj4p|^%bK9P@RIZ=g5C@?xFgyT|NTLjM?Ce z*#Bt0wg&O=$sA%F%u6i2)OuUntpHGw|a#4`f&ypRRI4LZs1$VZCO-3|;- zi1Y^5hjUf%vmhB3Z!jE{X0^^F4#y1l3Bo>E{!?@Yu8P55!>C_3J4G{=;jZhi&`!fOt_Zy z=RkCPe8!e;Ik4^}TeNtVy`NuQ0wzVOmZ#lC0QWoH(vhW&CV~g5|zhzI-27mR;w$WoA+h6N1xhLz~7*I2L4Y4>HEnX@LZ=SRtE%S9I43Q~p z1vz@oL_(rc>OY5GppE6;Z*J#^iQeR3Fb(P(1XKOwB&DczN4KJb-JSWi{+EjSS8i48 z4P3AkAku=q3_U*5HnoX+y4gtgJ`q%9P`2-L`XeUx67<7>u7@m7sEg3`bRiy5IJ31t zb5^KCa#{vLQr7T3Hl*#2U;~PeKh`FA@khvVRq)Gd!7GApzMSHZ0%*r%*o0tmK+o~U z_0&NadsVvOPF2u+O?lLDrXmpf5FQy>ojCLaM=tp{kY*WhhA%6Snx;+3LI1El!C9VT zSp+@&6OqsrqtF|Kx?08_8CG9*VONHJ(06_18|*tx(R6(%RI;T5b|scuCE~!2huG|n zsh;}1Z?zSrN)}pL2zgxEwUVI=wzoqIwO~A|L9)yr`&77xV3Z5=@zsWm*;r19$WzqA z(Y4p;@+)jjDr}oIbAw--q%E!=;|fH>7PBd)dQB$m{3Ye@R=k;Q6;do zKN`VveOR~-Zt7OUe)r+MpX<`T{7DZX;va|GBD2-*<0o0>HaM2o9UNx}!MUcUjllhG zv`PQpm~#JH;gtgS2>jwBjZ)@j*A^k8gv65cLf15_;ZzM{Z>*8HeAA)z>oo#s&P~dg zpe#rX!&w`xg-DJ$!eRRXJgb3OHd^sjTGicx6ZJ9k4Cf3QNr&7C`+?|$IOD}VuTR=9h#*-c)KuuVJf5RXYT<)~nta|? z!4`Nco5d!eEtt+Uym%BmEy8bj+h}5C?Ym}9e_+1gx$6~qa@3uv)1c!Z9`rASdRWo_ zU@9jV(ip)Q?(p>Rt^!r*V@Me7tn1j7$2wM;B^rjFv->-N>yw^3+rYvskA#?fCo?KY z_YpI?&zI=+5+tDc8+irh*xII3nUt}E&ZEn`}bs9U988nA4L!pXx+IdhllH~LEjdWN&m$C3#vwKsH=1%EqfC%z}O53AoSIy zXxNnQNlZzQn3Z*mNJrexffJY$z;-Q*ew)cv)$?{v4}7v|gQJK%95>wdy;R6!y6Lg+ zQqFmBkN@*a&P4Q!LDj<3c%B-=^S`XD$URc&r6sn51>|VY3dl!bVx`-9)#E*=c#P5Wm4eI`XR8vwwlbse7+gaqDxWYoDY#-~&lgMlE7i z@2#5w08h9fV*ZZ6EGUZ{5~t;u5YHj4pw1_35;>sauSPFPnVR3&99p^R$B|^<^}}~T z8Z%2o-pLb(gbw?Ap9lUjOjfZNNs+dmXai|noiii(k;($bEI zBq90nX21cGR8(lV8G&^T$KCU^4=PIl4X+O=qO<}0g3RmN|qFNga zfnB}tQd5in4yD$Lpp>RGEE{?~fW?^IToV3M6(p~tZ|>})MGox)^Yk@*+#JU|=ccQT zJiz<9I2XDv1p$?@h6J4BY%tjT?^&+pN~*fyy}jT8=;_oN+?4!OCNps1WyGK$=!MOF zaU$5))a6s#HhlmsK*MkqZms%5_sTBSXL!XO0c5+J*f6WtS|Hh}i$A~#c+3ds*EbNb z-ovEsr4O5gp+Kj{yKqVt%MhL&DYf!$=drR+aYFzaRNyk#^lSZcd+DQ(1#w)*l_eU! z^(4EoV&N2l4MT3;OFs0;%L%WWBA63E;9d=N;`$m1INIp|3MAUj!aYW`op6q%)=K{c zLsI@oyJB-s+CmPHQg7v*bm`9t_5%-`)e;9d z>P9?!(sbP@9il_2)oq29sbi2wt4Uktp_~Zkq#u&N0W2`;FF@^p!?XH2pen?6hHZ`w zlaDbi*m~I!10p8eU@4>}D+f z0uC$GqiVlOjbXo$q6%K?2uIx9VpFWUQEYstPN?%@tL(Ed99L`IPloy{$7Ix*$PBhG zZvSQwIu)RcB_?`x|WdXV;$l@FK>(90(_P>a}O%151uFIspzoEC;yNyj|HTBb< zecSo*U00-3PdOfqSp-e{Ict{pp)i4{7yjJaecGJYfaNdPg{mC#L(^EwnX+5DGM41E z>N2HC2+S|k{f|*o)S`l6a*owV$MLY1{78i%N4u*q=Fk5|D^i5SpY;ommLgB!r^k+a z0?^%1(#?JniGF1}W+9LSIc*EVm{sDZhO)&p;|9&6@^l~%wAXiDef~&%3{Y&pX2uIL zkpTpX3#^5{2)v2SzMG+Ow$cww$)^QJ5UVBKFzQoEl^GHq?H8`)iuRgI)?b4fcVlv@ z-$!~MGd%QWc?XExPK}*6ZQPqOF?Ugy@TOHkE5o7{OGR3y8>oYl;ML}`^kG^`{a}#P z67@!EgHCBae|e%MpVCgaP+Y8`*`$31FqsS604&F|=zNr4&&YT#RXz#iVIUWvG1XKxl-mzP0yZlLU4SX?BNNnWM#Vl`fYG`n>S#C{BkWc4Vb1?vJ z68XF!j-`<8&kXH5GaJMjZa!!;B9)6BmK5pA(E9lpyeoxan7P6S63=vxKCu~Mf7yj! zFED-Y#f?@NZpFlUWP$Oms=Jlr+zZwg27hH)s6(hf@;ytZD5q+ z1u;3c;ZepoWzF!eGgM1Hgw9Dxe*S|L-gChdov6v_2`M}7QQ1BPRc!{{w&jb<`ad;t z06{U&6YA#DR>mk42P?7A2lZ$dAz7C74)*kQ^mR;R~PZ{+c)^H$T{t zF|eaCMhF4T&eVj|NnPKUgyzgt?QZ8+z764`gckaAQcZj7fITPKYv9OK$CAsx7&^*V zySP=t(PHR*b8t64^8qgWyXq`YPALDl06O%r)wvxW zo;GUZ5kAb+JFHT)m_e{GSk_z1s|ZY}B_&Kq-O(*`dfuhP`x#M7>A-;6VX?9TrpE+- zes4QtOry!d-p_Y9{Den?s4L^b8CM*EDFB0iQo+V&mR}M-=9l$S@2_l6CUh^AF)5eq@Ld=TB_o*z_))&-&%j(llR``ZefbN++9Nhu&%<*6A3DL2Hz zbiALZb&t zBG54s@5FN~WJ-3sK<4)TFq4X!%FN%}*x8v8Y~C9LHKlwd7K<+wwSG454CFbf5b<1j z=23P+kP%l*er;{=d>8FW+dcKp3!8pMGjk{3Wt5}iIJ=}c3jQl&8cvDKjt~4HV1^oG zCx@p?f5B9hMRDKG^N+PUPuISE9M6e6L<=1m=K*&}Nd zjFpX%g%?975s{(`>RmMw%*R!{FvV0JGF_S}^`` z1U_m=>=r#+@t^FZkC;A~qLyxV5z=C2&wNQ?7)o&&W3MB?Q8rSW2vYdF-&f5@&TSnr zu{=QdWaauGF|Ed<60f_p%#*c!w5A+uh7dD|Q-HgZLd@5jrX)1hGaVbAAPvNqBA!!I z5wERnj-T{A=~+vWv<2m3=^QVQCpHaj@N1@7v|=ZHK0?lXo;pboUegHFY@*9GSc# zi9u3(tU%PB#f^n3=xJ{zpaS)^GreJdyr?{*` z_kR86o^GOYhof0f#nRH4xH||UhfCX;`tw@w|L)*`NQ!NSR`r5`&#selK*e{pFZ%*t z5iuLPx*txe^(w1W)>DvuC{-oP?(L&5+T6`Xl|Gp{f~31&DVdot3w9`}Mu+-SP9*7s zgJ6&4^(K7>2(}vKmIU!T`X9H&qBUyptMXcKTb?^cqCfC(p)p8kW)&=$fv8g*zxtXI zC#R?^ThZ4+92$yjc-r2ZQyA`~HeT%g&}rN#y1q)*kRF#Vl70 zyUoN9fzUuU?XGYX`Sm#@Rthx~HrFKDJ!~zk{W$ ziOKkf#&wmgz2g?6x5Jd!s;U|T+O%a%thhD5QdJ+TJET3Ka`3TI;Wrp#xNuZ8GfR-m zJsMs}u9SKIZ^LyFG?eh%Hvh;F1d=&UH}%OQg7#lQ7v#HvDGgwYo%wSmOWGeY+n~+V zRg@OG3rj1+Mz911>XB`Wl}ii1(h36$7M4A5t&X4&6RUdSywz2hH~m42R85&jtU3(T z&zKVN2~UsRggUlI3odax1^_PqXx=|d9hn}W#ReXoI*^mGdu6Yw=T-yyOSvJKShYp0 zU_o1tZXxZ#=<4sauI?Lq1xz6PnD*kRTCxl%O=+K1TH*S)Jo(2p_eiTRx)xx1!*V3n z=OH2X6w%5L%C>2P(3w=!HpV}u_a+z~C;tX~$+1zEa-QA0!hyee#K*N{-+cGr7tw zmc)~qym;pi^eJ<+YEyf0q^W@HV`!b`<8`UWGa52_EnFXk=}V;(+t%PpkWN$p5o0lU!{L8b_@rvox+L1=R%dk{F5f<0$(k zhHS~Ov@%Rmu@5KP&Lp{_E8EL_f-c6CT8g{IXb1L-Syc=#eh3GWNK1B9&t>sKI5_-H zr-c-3ERDBAUss1skzVrsr%j59y-0dKKu`uXa|Gj;0&(LWQ%R8}(CYWWz0VJ(JY5#$ zrC+5bGsH7LPbqm0QRSkPU`kP1#)}^s*Xi&u4K@`5+gvuSJv@1RDFSXN&q)3uM714@ zGf>jAdc3aJ&=sS3WYA(0XI1o^e#ivwHhinMDkFGXrepFpgXV&5)m=Evhho~*Zl%kI z;vwhS8rhr4uCLzLQ)614mZlLMPCVk6M4S-nxhZO_mM3bV5j>BR9GpC>m)@{l&X8DqLUbjLy z$7o{habwH~gNsj2!msiNnaUffw;R8AE28D|D}_aQ@TmS+MedlpoKOUpG~dM68vkQ{ z)8uu#K(lyMcaOc`y~(qDT%297<974Ux8Z;h_FA*7f zlKr%uN0S>B1s{+maQa{-ixeCwqL45L_jNz^?p}QH6uQ3)h)ev_$G-sa;8o(PrOy_W zHSuJfUm@gHKZYv=Ds^f;DPu5&d^tj=;l5Z{je>j~=V*b?kI7G)84U!P{`+GyUe-N6 zNm3ZCb**wal)YJAHn-P2uP7SAtiHl#TWdtrB7RXH;PGGtl5xZ>psjo}}K^?uDlo{kY?Fj>`Ry*xBy9 zgt@n1x4*mb9mUzsLR*9ZYO>aw?Do`c1%jBGZzLMb%+ zEQ%Ihgo9~>W=P4DUaPmi-(g_Xv&GWY z+xL!BD6k~QPN#WbYrBy)^*E#Mz6rw29<%{Y2|xb(@{()3UpV?oYQI$Fi2+F*CDBDI zM#UY03E8S>-m=qid3`g_@J{de%>V5Cgs{avBw^kw0fP=VbU!l}x!a*sEX^(4p6>sZ zmQskLJzRJHz|$4yleVG4{n>6@yNuh}rnU|uVWb5a_~VGHf#0^EJ7c94!vXGhq?kH=?M`yf zE+*)d4McMC0UrXpYbNgE?+?=okbL%O=68qtm%sPL`|6*c#t`xot@k?|j!Ku|^ewYt zsq30D2?_UZmpAw8**3Musx?}$7}>v_+q9~aY5w{oI8%!|tPy8oWE^ce4tlPa$XF@VeX^0tW?frhrOmMz zB|Dc|Di;HuCFaBB)qYhH+4{v=>fgX!KxFKV zBgUySp#1F@*)1~vo5>MSj2u##OO7p;Hdb$OD~TItpsdF^518UKc2zI>?fYV##M8FD z6ZM5@IY$^Xo|TgixpxtFlD>(DW%6lU?9$N#8&^_lygpp0<22UO5vhWLq*qBy(Sz1; zM+<$2L*o9s5uCB`)tGVYEY}u9=CeH)yPQ6ey5|2TtzIIti1!6VoHAvp%W1AEoII6p zTV)=rJ5ze%Q`clWT2D0x-s&}Axz9;SKSz1dZf$R2&8X2!9aygTk8N_wEd8_RdBW(f}w^fk!g*->1e!7XN#n%AQ^TYUZ(aze4m+F#jy=+X!oL_)*^v=|H z#m%R!nQ`XaRl!kp(^r}2^Efm?VkWMc@MZ9wP=+wq7nStY>&;0gW6kzMTvFq%Z%o$V z)lbu_SE<}2#x%6FE4VxjIvrCjL>PXXhOLMgXl%Zk-+bs)aN+GcU(Vk$3I8j=M4l2Z zcE>V-Qd2(L*ucB4N_l2%z)^NT`(mCi2XBJ3;G{_giN;RWAsU@>?39Z)DYo`|S8uVS zUlm#Sb#J=cA-g)XlakYofa$-|6+TkNhN%n?5W(UUm_W%HCcH^)>A?=Wy>iM1jlVF6 z15=}j%_(Kc(lsGn)C`>7WQ%tCJ@`7i`?}aN}t`BP!xfb1V7%o0{ z6LC#RkE>@)Z7Oc0@JCG;aK4w2j!xa3KSDoQ|DB?q74=kypp1D!P^cGtOG{Gg+j}c( zn*|^0J;rqY{yyI=4#1V@{eK3H#brq_0C9T?zIWbBS-4?Tz{ZB#!NvXC02-q($1ge(#0Z4l%g zNgY+C-F31|Qg2TP+DdsS*B-N@cbdjx$4^1b>7C-HHA?c{L`-kDN022ENXwqRk?*FJ zYiJl$Jcthb=%@oDi=gyTa8h)-!KeeMXu6~zZiiJ0$sDWt+r0W!syYtEj~K|JKNfunNNoC;v{Gi zDZc9f+aOJCN%kIqvTuA>2FuDeneM;IqR$sy^^mV{U*$k_6=N|8r`}6(8(Yq%l)Awg z-N1?H$n=9ndvlZN+BWKZM?35kA&LX5kXHOtkAMZ@@cWV>J}&lWe31>)xe!Gz%xNN6 z7i5-TEl_E$e{rjcI5}5SU5t^A!hLoLCaY2t2ZmN4*ut!<-VN^rUWI)x6(|PYtP^ra-xxBBP)tVVhvB&ti2T{Rl;I|88+YBS&!N!bX|8;JpzkhuXyjvTM z$8ve?{Us1@&rDr~sV2{6ZH+XjL%m+onabzjHN_3HjBQwTy4G0ixowS?swQ#pR^=>v zu1KlT)~E;DHNSy?1BgIH&E`^M9p<0@K5_4BX`CQHk-cPf=H=n?iI&5`*J}%o9xg7C zeqDJmaqqQO@pJXioYR;bo?M>_O46g0)k{_iABM~I{N?D#Z7;HwMBz{J#}S_O`xl&N zw&b~aqq1yOU21H!OXJE~Ym$5nDVT{+k0IV%9pyxiv<#C;ZgsMs^zC9b{Ro$~8ld?} z0k1Nk1d^V+nrH~7ug9rE$Of45!D>>}{edQI;a#+WymdUWUc2MFRD0z{TUXD~mGvj; z(?lO^s(Z&MYc2lolkj5Mm&81ulQGa4^~{q5WjiB2>6t%#mR_9sX4!H4d@lh#gEiX# zCv7R>51ELVs$swn%4ujR2UCg;9fiW;i9d9oIx`3P6l0~3r#Az=s-8D)@VwfvfM!lU zI}D3G`#Lx4dGbz)ft|n@Z%9Xu(5=X-u%PQTW-*=6vLhOh>^QmedTY92!_qdZq4#&g zS=(aP59Kqo^dDzuH4-O614G6nwD5yhVh>3A*u|Zd`nr})fh@~Tbp={4b6zLJuI0=0 zGzqe&3%6}}J&bG#3;FSaB6+*0h>bQjEDAerXlOo&sV1U8qjQK3_8Tt!7WKBgFwg4q zm+^)dsYROO0O&Uo-nf7?ts9F-Fwy3PDXnQiNtMi%mV&oQ8e%cVKlN-t8RAR_qxP=q z+Rhw8_K#t=0anzx#7AYD2NzJY{}Ki;q4y4@f4sMbpO;dvhBY4WaHJx?Hr0QfAAg7K zh#iNpSsWZ!CS)DK2_Fc;IAq)pj&C+|JfUSoA4X7V5iy!&xC7jFE8IJ;Evg?6M%?k` zmm8Qdt{NRb0)*63E76W6H07#+%nQhIC7=>8o*}XG$qkO%S59Q}VKK z<>-$nD78qJw``r7rmEb8)@9fLXVstOtowr&yGB&v7tA6Hwe&QRff{7}s>^3LUmiR} zU15^!-OaW&GiZHhihyvO<3WoeUo3qy#jjP|*ihiX8LA*r<=MuJulVo%DH%scX5gIY zMRhS-+04{zOUl!ZKk212c@a`Gy}J~<>+ua|MtgraX$ zx2v7TaZvw#$FE2R>zbr2+V-kU1{g814!|;dYf|cRUqZ&}$|-pjo~vQvnuD8!kwopQ z^7|9dn}f}fmt~nhJfci~Khb`$T| ztDMD65(AE&6#5x#IWtry;6kJZgsJ}vO+abzmf zDQaB6-v(_>3X4qcDx-a;VCX+COuDP4+k%3`7tX^?HF$OCaHc<+uc}q4?ehlLncAgg6S1vN9bpbLca0E z3^B+A2I|O7>!>gs)=N9-l~Ra3CmGya;UZgb{~nvb^l@7v&u+&?r)Z?KBQ|KfB;UsM zvqFK6P9nq%sKm2K|3;m8x+l7mZ39DUQ!i^crnTEeeU4!+(A0*5ZfmkB`TyR0h>c}7*F zVH-3~G=GJmr%(PVJxmaN{M~4a!gF%eU|@O_H=hm^5)zUt^8PI`;MFJA+y?!PeDj%) z9SMmk2Bxr0A);k$eW6<+6_Gol=HqbNgApQtjS0Z(d(8=djVcA{;x?H*`}&Xf%FDSW z*#RNhpABysW*>h8z*jteeTvHdf`6TiXxYjys{VTPs^K1=des7@niTi4`^+5neiy&pvh?t_Nv?MGgId1H_Nu@#K( z1D-g!sL?v&pb%+}%L5Ij4nkc>UXZ-}8abeWwP@_XC{l=y^gto+;li%F-i$us)uY2x?bXQ+UTa z5WfgjOZM(Jq610@!GR=SQT`F*S`FKwN$C_O#+EUVo=GH(Nwmpe^nwUSMUhCs)P4i) zpHerZ4wiQil^9m?MO9WgNv=nXLbD2cydF}BT!kdd7)Ji zWb+Dz!y#N~VF9QRX-~=$Byez7g}Kp4Sv1^e?liBzt6{U-8-B%XKum(SAk|*T`bh>I zA-O}ola-$v7xjGlBRwVu@+(@$)XR(<6=bRH5?(a*ikItbcQ?(chPQ20(9mn0XL&i4 zSd+i<`X?=4jYcJpQ*uIvZ-PG}FrxVb-zhIq>p<(uEA8KmK>moaOX!-3%Qqu&1$83D z-h!g-t^Dd@RZ=}0Ev7(0SNEWr+<-AO2wTWtlKl2xi{oNWZdA{;FWUQ9@BU3|n@r{N zEJYz1Q)qhpDbH))prs|iEFel#pJBO}jlJB+^%|p5OPR=_ZzWU}GTU}@O0uakI&GCZ zlJs=mP^f@TSy@(n#1a64O{aVE_R>*Rsv)4XNwj3D%`K-Q<9|Oo)o1h z3coFTdAQ~r8(jX5yH0U@5%B6oboAM{I$z__Tx@i+EYXkL5;5|5nv^-|%(p?3zddEQCP`HeIQ!{n-mBX@QCICp*1hY*F(Lr+*qc^Q!kV^9G%S0t6GI#&dU%&NL#rOa9G@$?&-qn-*dRKA9u&J`Ab@u~Hky$4s`?%(&G2%4)glZ#J9d$@oe3tCgO zfeh9lL-Zy)Jy2qE%3$kMDMoRADnWuS_Gfrg!)k&logvG+QD;2fD1_-4S}sM9xvu*H z>OiXW#Fjxjn!S69EB(@KDEX7Lcg=1RPlQAZY&uCe&ha1aC;uu(UQ&f$nlA~n+BSdg zy68>)v0;24trFOlbj}M`@-KfqoYAw-q5-sLt&-&{K)9;USP0kERDLj2ET(b1OXfef zZ82=lAKT-IFWO+&Zwq;1-F|HQB`jE^8ccGe0vzEB#4b=+3lQ;55xMs|d%vwIVGaKb z?+6Ql5+DqV)=%9`+1+!~m82Yf7U{l!pV_RsDZpsS%8yV%&;q5$HM-RhYw5)84I!u3 zU3De;`U`qvPvGf);+8E5CXk=2NgYDY^1f(stN;9;LewVPtHfJOAq(__KLNRly{x(W z0l7-p21#f?Q8rpQxDL03ki)nv0_6G_i@tJ7%{Me+#3cQyjp2j9kGO&CacqaIIUEnQ zpH%2(kYM`yrH^RGafQ&~sOQFd%D~=+{U~oi4yMyps#23`pR7T5c%PLCaN@4ZeL6z_ z$Gd^tK}CUo3uGE1{wD}sU++7IAH}Q(NGh7Q*<-$Z`uZUY%Petk0l~xU9{9e|_ZMXN zpMK~T+O;2ChbZxsMaKM~NS@ZSfI_oHK84M!6=Wj=pS|`BEBC$hY0#6m7gRIlcGt$A zvj)_rWjm&AWoMb0rlgegF=Xp@R9LGO)p|!sK66puaqQ7ol}oEF8LLwfRS>vut^KN{ z&U)ULLHk!Jd}@Pbk&v78x5T6>w71Y>(+ zl=GzNi+L$o{fsIa{FTzet3E5ls<9$Q`z$|-pb1Mw>nT0LXZ}ynCd0I6&+gYoi_|A) zJ9b1G5**;c3_M=5^uejIG5N1CPVU}j*lk?HvQ!#mN5~HUcjR79^N+Cn0HM@ihI~3` z!`WlKlYl=sm&M8d?*xXxsdPm%_Qm@g43??9Cm(^>MDpR zs`M=tPf6Lvr&wtRGVf0Job_9BRdeAFLy`4Y?F;NN3*e3ayoz4>v(Y`mI&&ZVy~ACV z`-3K-nSei?dQ+{<->;#-fTBuOGk7-r_(Wn#l9|0dNQ~(fdD>?vko}5L!PF&;K^xbz z&MBLKvWlD%vm^KN=FyCtBG|-XtS|j~Kc}ua=ImD!)$Gi7Zju5;DG#tVw#_l&pWok~ zTcB7!I!-W7Q}#F)?uC%ftY(Z5WoI{}{}_Hb6b~WQHip+bPwiH1VrRNIaE*UR;+Top z0a#>^eQ1(D{;7Iqv)c~VKxdf*PU^)P-*mpq8Bw6;)i>Y^M^ol{uKyFUH!sB=ZK{c= zmf5HuV<74O8*aHc`HW?e(kE%4M>Lg$t^X>WZkai+j7t#$c@!V$MRjhAWBf?Iny^mhl=>6A|0NjZr-}PwYlMraXXS^M+|w_+xkZjI z6v7}qn>HMbHO=kuBjpDx)#dh3Mu|7Xo%@5CP|PSd{Bv|z#PLPl9p!@imFSY?E|3aE zbgEdph^I9&))L-F&FfYTQp2jjTc^uhakz>BC#TLS73POezYlQaXzFzo_x(yVG0tpj zn~%&24;W_KZ@$D)5xr)yO{F$dT6;dMWv?!NzO!w-wW5F-s=o{^Dj6#~{T*`l*J8UV zfpN`~fS)uqH94JGul{;=7WxyGkJ&(CTuzgKmJtFz+{}j$eR9N0Wlw;3Bm5Ga6>oD^ zL-SI(b62R)Orj1ZMqZLz|UsuADA;-whUnRg*T1w{Uti>WDX+;|-p#BP=D(@H^M zZqVw-u~7hTPRJC|~+*tby6pv?G7&Yn{A9YKt< zJm=QgzQ^pfHN>34EnOa_{-=qNKvdn5V?K0aPC}*TJ5hPsZ@n4$L}vEzGS!)BWqZEX znr)NzDw@J|986Sj@Q|4IsB7Xb3`PQF2ft=wW=#Zp?OA%Ck!TN(Ehr&>M=)u~X-;-8 zUA(pOvsgeR0Y!KHsN}M@+M1Jd@{y5i(=R(tm8|zHjE;Iysni(-`BvDw(nhKyV)CKX zCFSMn`ZJPEj>%*TO%luFl8DD9ihaE=J8v&rkksq3Bgk5S1%^?Ysn!_k*|C56g#ZHfVmu+Sy}dQNujrwqw;k)5lBHzZ34r}A;54SdP}CK z5LWz3zi_aNnM1r?@)>`>qDgvLsVU{DLYbFNzu$C2Wgb9QfwV4RSLEbvF}wUDL$;on z4rVMRg|^9tikP5A6hP8ghaL6-oojn{gjvKEjPHF_u~t{({q&(Wsp4%&){)0nx*L{O zKf}$w^b&yeVxCM8W3xhk=%y3`4>`RLAD1_|CS5X6&%Dh$?c<94fi=0LsH{vhfb8ld zMLJ#aEEhv1etqfvPOdes&c(!2Ci~B3Ai;luR54sk-I3Je359|*LgonBua29ybVz_& z!=@sp+! z@pJuO(-s%?ldsVDK6~!s7S02ogexLyc(ukSt%Ph~lHlvu$^^kI`*dC^>RK;12~jxB zHXEN(zFNJO*u0|;iX66F>(1zVQqpREXSet-RP$*YQzvy%qh{M|Zxv7&UKrgczYPSK zNeaNCR8rD77T!w_%Y>)cr(we^M4&*m#Twf0h)vuux4VlW^Sk17R1Y|fRH&AG%BlC1 zIQ*GShx2%Eyc#CbPhTBmPVGw2&owz78sI-v+l;2FF!tF_9g->O6H1j`j|{Qd7P_>W zD{+;T{`<*9=sncEn~SM!31i6gDdkycxwkM4b`p}7f4pRy@<*Bs=jsR|R4Qlu!k@HZ zWAHKK5gRr`hNaC5oy}5_(8dk{-;e%wu z(3{pC29gr#WMk&TaHaF(j{h363`Uz58>!E;Gyt^OoRDBz=b`#wFXxMp!os&5`^}>0 zKjkvOkmVZt(9r*_=l=L?5(B2 ztBt@0BhwNvkM&t2i~=R{XzB#jIa#qjT<@J17pEmBs$jN0C$1r4TR~g$H_0ze%tern zxea^EnuMoD=j7Ct$fqt|uny&F5E#)dO)oTme|GK^otR=IR%H`RP10%^twHOKDh`Cy z#Cv<=meglONe4KQ{FG7l6+&vAkAU@*pJ5s0)wccEQ>0~9&(NlOqn43%fen+xGW+Vbbd^v(+W-nMP-Fr^QkNvkuSp=S5`fL|Odso%)e ztINfauGul2YADb8qY&=Nj3u8@)AB27woW5zPk4obB2VIVTj008wWzbu=NEG{Z&YA@ z@>^4tw&J&?ygaoh4hI`9$yTWjzGQBzr6XY+`H-E}JL};HgS~;>cyo|~GYq#m>bLHW zK&mqG8A{|{ZEI@_lfQsVkh%CK9>qLR){{SRj;c~4cdSEGNH*27`>dQil#%++aphz; z^3XtIMrQYl;qJQ5w|zCs9-hPO1#qj~5$(x(bp2{$JA1gM6RA#?RTB72?D&D+vs(Ls z+w&1nV}A`L-RKGR+THaYWacw})2We6IX*YP_^)_uGAx&!4wu8go4I8s9dv`mRAWZq zzOdr`9~YMs*FWa*mt(}R?$muWiw0(bY8nfiy-6V5aZXV~SuJ;||Tyxkqh=g&+jx@euWjCQTjp6KQCYR~HjxT`+K z=xQl7<>}o1UynSen#?KtXql?jt4kONS43z%JWxRq;FYa*E)4QRRPU*d*ZThDS*&?5 z$+_b|1b{uYUgEa@+WkO`AW5yIcCu~hf|!8d_xzGPg_XQc@@sPkGjj9HFeTx$O3zFp zZKq^xx)Ch^5vs*6{r3F$G6%J}Wld+TXYAC0UX-QDnGr>I9BNwfFSOBJCnwf>#E)sr zv)s;PW8;QDx;>bcjXQy;5NDEB%o7V+8_qfodVb+$HB zH;F>q-lfts9pI@es19lTb9KH)SK$zmad(0xlOsr2tkAAcJ$wJt2RB|IY?5uKEMi+tZ}_eqtD$9<|AP9AB@e}cceHA>WtOg|< z>rLaEG^UF?m2~s*vHmscrZ`Qf3iE5Tn-SZCfrZQ0;_kaV3UVL;(-Aj`)g4g}zcV|y z>wvxyAiZaR#GRdQdl6>+_h!bkd0}ztuf()eQdUM7UKUH7rLU{`!2@%Kk(G0y>Lmbq z+3!L}mfQC62@kH{OJy;>uOx9E9@bUbUlXMgMSJr5a_Q@tZGF6kIocBOZ`oIQ%Y-4VCH1uDFWI;6#_ zK*AloyE}qT_$YqN1b3%nwH_s;=}PL%J?Sx!akPJbQ*6zV{6|>aC*DGuPCA&mKLgo6 zc}kE^YV21WdWbw~9z1I za^pMS%;z2M*E>&a6nnWi zuq&OE*WUMkut#e>_4x5h^pYaMRx$RY`B7*@3iWUrs*m<>EfCHkk%4ti)Hx=9(N!!L^Y-i;poR z0OI=#@E!Mp?=b~=AooHuWUQunt=lrOju-=6f%t@N^RK=Av29Y(Ox> zXHzjWb?a7`=+{c+o6_fbNlxw-_^zgu%k|+XkT8S)Uod-^Zxk5q1ACZV1lfumb-hzh=c}>SWY`bJ!=*j=Z1c)nX<>||30kL9t29aT`};nB z`8hPCPiQvO{kA*>>vJ-uuNWJ6)H=6_M~c~}udm1_rzIr~=sKpJ^run&9vPJKFD%nw z2M%}2c)`*SgE{rH%#!sipZlW=Ib68K#5&b9M!04yro6rk4l^t3>$NUAsH!eV)QI$Bg882RSC)ED%gm-65luFDavD74O`*ffs=KPl(5ryzgdvkdOk?U zpr9U^L2WSSzAMk09yN^;UsjZtz7wW1(KBqT zHP9p9pvf)j{Z*6zUhTcWX+HAcJ68}+5rVRxa`K8PRTO>qSYRn{I-p3ZrM8B>1u&Wj z5RE0UI{%7a2>Ta+{p$ew!8`N#;nfOezQ>r9oP?n&`FHp~StDIbOiP2<_ymvTk+Y|J zB%CX!nQ$4jpBdb)Fb*8;O>LWo@;h3{a!&N8F13ykXvLDp3~2&bLorB*mqgAbTI$}> zwx(V&AK4hx-ZFi22<{G+gO^6R{YY?-qB{n>O$e5u3o{V??a4I2DTI>ZN;88&)4LA| z%JeBKv$ZX}Hj@rjNu|5;Cr&*Sdi(kaKzf*+6Jdu%Ac9QF#lsx|X~ax-MZ>!`jLo>- zL9#!d&wL#oR94Ex=@jg`Al%kbcJ)!qhsq%t&IebQO;d>p4UsrN@_`tb9kU?au6mO|+0BFEThN zS}Z(5x!bz~6v|flX0;k!oU1MUs%lAizYZqy69&9o-09x4w>Ha0UB0tV18k{Fh51MqT)& z_WulN`9ZnJTQX-QBIzQRy7J?^i15ynnbHtRJNy z@>;bACdg=gRois!b9uXiycPBaMEVrLFnFy`v?Xs@v+A7rkLjH(Ia zPi$v?MU>8!G@jCnd#&QwBhNVWuUy~U?~I1ZULV{|miR!bpgTw$b_4w`__-1M&a#yl zir(uL7uOq)SiQ*^5T?U^nm|<0W+F{FPyJtK+xzSibxZ1mwkaGX}nmf18LaH8e>La7krx)1Y6|41J;H{N1jrfMme+kVWNg z1*^ZW^YF=|lE~)n$PBmdf`S*`}YM%asvHUFsHdpY&w#DmfsHC1M)as`RsK4tsG(cv#P`=h*O?CKi5%Q9UT z?qfY#v*((FyBis|eLQ&GFy-<=gq1~}zo*p4LevwUMKo|Uy1gD8tk{Ik^L>WkxU}+q zc_o6__rPZ_KnpSX`tq?Fx-~2AX|gJ)lPA1zsAIs`hjB1Cl%dp95E{u&FnX1p58o0H z;H{`ZHI5UEk#*BlHi%K`tf8pZp2=2tHum8czmvF1l|uxHTZ6g}}0MY@Idcn8=Hd#V3zWK$Ly7r+lFrU?WWvOQ@PwJNw>A zx!%t08{%aD&(MI#&!)hqZ}Cue!Y9(|26mgG8^-Vb>YrN#S~my;h3;u--Smgrgm7u8Mj4938pv-QI z4X)G3+7QhZXk{mkGN`%6(!GXEpLn!|Kdqq@7ZqET?1DFU|0WQBC%d5No0C&Ca@AR( z0yKfXvpGt_|U@>9JfG)doFDyppv&kz}{1$+}hF&0{BJSweuPZ51M? zL`G|E*C+2@J8Ua_8ty;5j#S0Otj(C^)vi)n_QPGq03|*>pyF^`bQOGkUmHC}qbKzF z^w$T-G2_|J4lPQgt-TijMcT~s>!izO*}?~EGS8zhV^QE~P3_)lPWHj9#^hFYBdgkP zA{L{WU&|s+`vgy)T|wDSD{JfD)5GcG<)ZuZk4%7L)XHS@pA*Z{m23GiWBfZnbRkv3 zwIceJ*)TIyZCOOY8)>GCN6-7(MTmAlaSt?tM7PC8C$vy{H$b7!wttatc zK7ls&r63Dbqy~aRr8J%7{i*OUiqZy#YJv*V&sNRmjGpL!3A;_f;8SvId)uaGxv&V5 z=k0JG&D3EwB`L#-;y4DX(|iAvTbRw9Q9JR)M;q$VrUT7>XL(w1fL6v57K|<2z9soX zjIqLnhU7Dz*Yv|JcQBbjH+a<*X^$6kc5oO8UTNN}tP}7qILR}oYk4a$5s*eID;Alrrt&oaoma~R>I-9&Is39LWf+P z&`vC^@uAsI(q@q4Vo5qSIbYGQYFn1uP;0BK>S}+0dB7O263bF{Lrq}cBX2|vkGi(O zSD+XZKyzh9_6^0@Re9EJa)VG2-ej-^eOzm$a8xKNv}bc~o3380)5Qj zWvcjCbcHr&8q@k6IEL~dfM7%k3*T(e=v>>?yQROU%s0J~=V|QI^0U24<->^Gch72TmX4oo&Q^t2O|nT=+q;MyK+a$+Olb~( zYD>8V#bg*i4bWxWKXj&j)`7tTjVHVl;ZjmM*V08->wE0umW2U>GW$N+7}(b7m&b)L z66kCGvzDLj^xEC;?f@}LWQ1BaYOWXTLSo0Bh+XYpqMuzKB10`^5wQ`20P}K=LHmJ( z%h@tBYs+Be60W*>d8OZPJY8Wq*^Peie2 ziLk;Z#jJ#_Bxkj{N!UQC>QH@>Y|Fu`?|nuDlei~*aBgnCkm~G&KpM=d?6*?qwURsA z%uB;b=ZS_xKHe8ShZ7NxfDG(lg1)0hu28y0OzIwOWv?d0Z)w_m;-splrzCs-ATQg! zAU{7C%{}2hqPFyBCyy3T_24LB)P5iboSQ?7iTHP<>q9&|zS=o*;EUQNE`4HFQtBI) z35nixk0D1S3IgBHo)){k>r|a4_e4VV>^c9dTyxNFyMPcuaHAFnzVB$kpvQjayMVb<~B*=>9!t zj`_mcXdcM2ZpT<1n(VsZ26qh2^ST?jW4haMJRhFbk;OQd7e}c$?k}!y(BdspC5=gE zorE`r92E14BzqtbGX zFLHQAPHI;03iQ#JehD<>!W(~nEPjO-+2Zom@787s6pei2eGccZT%I()xB}nky%wnm zKl&0IU-OD?c|y>0l}%lNb#%fX>#~t6@MuZf93GJ4*sWjX-gpsmJ1NWIaMv{9wvGW6 zsWTvK#AF09%&aLnb!SUUp9KuK^?TU)_x+btQpW(1(tL-CUvhrnCkT7p z^1XeU#cGItD34*B8=#90#S$=KV=oIHRIK8u``Ay`{+p%zX60I6S<7yv`S-;L$Gog_ zFurzX>L)o)Z#~!Qyy}>uXi6z{thK;_Lq~$J`=b@8zOy%#SVdX`A^%|wZ}yPDHd>*C zarYt*9}m@arAW)-A99U*Y-$|8oxuLCp{liOlj&lerb)U-Tg9KF^Wuc9yF^!Sm2pn& zX7Pn(itg0xg5)6ME!Yt5{Eg9qeCcG0RUhS%gdB4o1~KJn!gfTR;=HfVN9J_Cswa>P zD>D*6ZaOuK5@>5*(-j!qul)2dO|Lw(2W*q8Z4%?1BH2Y`(dHgG0}|Gdd3pJ&bVYQ{ zPZ+v@hr{O8%KSBrv1>6KpUiJe7Wh>BMM)P$H*Y|H+T!p5&ZfjA2iHyEU1<@u;dk56^6`>AhS)5Ls1t>z68>{GN)&mVvw!P1QY|O3s20*F2!~@9ZABO> zz62?#s?NwLp&wj76FTtZHzrtLX5CH+=$?ELs$f-8 z&OuN~GBm;a-Wx>TK`V}IuR1Xa+SV>R+(Hi=#M0aak5*t6-W;4Y%$*xxCzLEy4cpJL59oAW<0GoavhW@dH{j23`lVo>sviK*9B=)|p$aG(O?li>;9`0Y^S(IVQy$aUlHLU9ks7>~mnPPZdv-t)_%>#J|Ln4&+n9~ZCq5zF_nUS(+wfRjT0j-CdYfdg zA*yw|Tx3AS_li5+ZBsKqd!nnSq<5pY(fxiJ6>0O~uTvuB)4^9U>2a{UuPp}*26GB} ziRf69w(DOiw=uJu&=Rr~(RaTFDyKJfoy3Ipr=^hZkg4t_E?zQ$%>bmP_iY)AKjDT# zdMt^^6Tb3{dbVtr2t@hUU%TI(YHL-s<4jD&l+Pn_sKgrrzm}Qpur4>=cFyQGRDNm6 z556na+kn2{I@!}}^t2DUOhgmb80_*+uE7)2ntu5gt3NK@HaZj{lOZe3rDBm+KO~Vl z4*9dtwl?q5^N^hJw~UTHT5V`j+84~RTayQPVPXnnCyai=y6eh?+X46{8Z5}JSgxu$ zqv)wX)NC4uBu93xGU%SYHucng#On+sF2z4A7xxW!HhM;eLZ~c^jKVaLRCOGixeVHwD7d}QzER=z37kNPNp@|1B6UwIB zwyv>a*oz`IVe&L-ar^`V8UHM@@_M+J) zcjkbLR7|d?ne~e~H3{f46R6n%?lH5zTiP)=5nIT@B+pzPaDxfl@|G*6J?Qk*ajT0ZV$+p- zk*Rl`V+2z(0+|8=07GEDP`6VO+~s`#$tib*8{Q2SZ33JF%41NZbBcSS20hia;Zy|> z8fw@-3XOfos#;R@-*NVClKfc7Qd+OcJ+d9V6*@#NG4*hfao!4jrTVFTn=^$oTyFtl z1#7wrLBt{=-qHXrrFba^oR-9!`9t~TEVOv3vXCZ}Ao=_9JJj;(MOhQ0Yauru^J{5s z%THkDpzOz+r{M%Z0hk1y>&x;u0AbfnbeV%z>Ywjf8v*MUHs-Vupa{8?aJp+LHDQA} z(;g$N`E-Icp?(r)>VGW&d|Tk3T%#qbQhowuhdDMU?B*TIJaXz*%7@Q~WtLZp`5M7x zzNY~et;2!iyZu{}N$bH~x1Y)fwE4sx##%!BUsq3=QWa}>gnKp6RvhO?{qr;rN5)5< z+~GhhafaO7caMv3ENgc&|8T@tp{F)yoSSwlkB!7;QR717(hE`RFFQI(y}zs#+zS;$ zmcmE3d$%q(uYEw?A}&7O2IZ@O7O-vp7_ewI$l)2@ueONpY$!T*T)90Jv;2=o@Qxq1 zIFFoysoMzW98*=QRLv!bY2o!(>RnfNe^K?gv$yqF&1WHq(U2Xfby+2y^}PnYRNSDv z$DYh_c=S|5xyZ#{u1HmBX4;_oj?U&Ovv%eQ$LwscIqso3ng0+o)7er2jRvvcLu;5u zMwkeF^t0^!W#u{?ozT)zgAR>Y2;qS_uD%wqCq3ra=d&V)tG1b@-F{ztQKfr!)>4R;qoJx;c>{{J{c)(Tt@y>BVjQP7bt%pCVjCHI zUH0?bB~MDjY>4kpR$4=HXJNFq7&*+4!EtrjFisNcEVvvi(nCn$^Wz!urnkf!gRx$1_zeTG73@NgEs8~*fay2wZXsM-AU~#~DNV7k+!(<{(Cu1{AKlL= z_&#B}Y2ksZaAx-Z5W2$J8@T-H*piAnzp$W>gr?Ur3&`4oV6xp${FXwz@5CX~GZ)T< zkd|wTgfrP7vL}KAH_GL(xq=`1QR*uT-RGfV-5bw98)h)4AdkF~l)9@$xY{zCKG9A- z_f}3|hM?#8-v*NKs6=l>kL&m|zk;Zh`J?QqyZiC-?-SAGq7Oqyn<$5qymRN%(~~{0 z>q{k;vJJMwoo|Tl-6L4Fob;^AF*TjcQZwq^lhns$F=L4rb2VO?f?!FV9}!E7ZLdZ# zl*_7ChCdcIxo(`Pmpx7_=U+09mfEAeogx;S-E8^cZsiT1+{u=PD;)gp0Juslw8e0u z-}B=mNVd=Gbjl5Ij`ouC{$|xjyp`Xh)?r-5)|W$^JG8Xv+iK{^_Cj^{(Q19>jtf0= zB)F`PS7w>s&O|%FqOmh15bl;)a6x943(m8szEo^ac%$<(sGz_*XMSxHQQR*glD|(+ zIgb$|waRUt^F+`c@*C=%z{Q@TqaD_pD=@TV!{iRS>Ecb<(i4gK;0KHaolPPN!23jS zOM~-pVi)Mws6llM%77rha{Qj1-5(KBtm4*+l7vE6gJP`zc2R*VX+uEP{1i7ej~S-D z0-MCJMP>A|D2SEyWcS>2t4%Rmf!8u;4CWkXz%$t?RA@Xe%qpW_*1?Z_c;0yTdRnrM z@}4Es+fJ>viVm}xIA+wcu&61>)Fb9Hm5p0ic(kX7$5X-jHfVFjH#Q^$KJZVf%@0+)eY8gE`H>zwUG2wjSg!>iXx&}daDW>fauBococV=H z5iRRN+s3wwk(4u^lR^wqv=+&WzVuI0^MocUjk9Pj^UCRfMUO?F>t+#tWJ3BF0d)ef zMA_`|S#Ojq4naM#=HjB_{1%oTnWdvvz}EJ4Xp!T|PdiOYWw+V86$*oFF0w(v3L_zT zrq9D;h8c_)clj;kjWSyU67Ssxo&S{Ce_7t}3)-o?>?3t@_Oh4R$;jAwc_yPMvwD~k zj#?gG?11~Sf1+HB(l4B~kf~&EpDi}~{J%+)5LM(xggWQx!H-FbW4L)G#ow>G;KSMe znL1g*ziYUa91QW_k}Iu{ghMC`gnO!sYE19@gR= z|M({~^;9!NNhqxmW{IO@B%oZ=7W=lpA+GI?j?l8^&QJvhP+{zOVgn60S0*q8k&SV+ zJT^?OYdO%mOu|_1d%q(c{-6WN$6b4#g>ytzMsg%|^Z_Ev`lgy9-gwr4a@5-`f2ZnE zr{wW^hdp>v`zgf9?TG^0lV7L)oJ~vxgpG^&QsUp>SD;5%L)AJrRKrn{{1@^&Det;+ zC=$*i$D+X(z4Z5M9v!Ta1>90_1#3ja{nO&#&>&Y9mMsQFKpH!-o}9(>!{(QCSGFuU z`UZinY4JNBBO&3yc1L>5fNN|LCP)uAG0r4Xe6yF#n(%Pqcw7Ih+~=`)tD^aa3gdurD9(VX0N_=Owm+R0cO_dG<}LsW|vHd=kl{_RFU9}J%6oNc8D$2i~X@2ck*h8MX-0OT)eOe4$KHq1@2sZP`xy@4{ zI*84tLY$_7-CLOZik^J%mnCUr0oad`f&AV>0Sy@T7LPY#2f{uuaNNO=#v9sE`vdEK zD`Q&XSZozU3l{CPCg+skdm<2VrKf#b{T|w+QbO5?LUdXJeU^4_7n05Y5=PdW3wCU% z2;&>};N@*9JPhnJAvlYCqwkt?PWo4hj@Cwm>gAZ76WGrM+FT5pv!^O48D_i?)`Mnz zu{BA#pJma)Pxd^vGY~qbNOg?D8N{FDZbDvvK${+xH`qs#?Cu^JVfjL60>pObcDp7! zg$RsqdMD_*#@h%ID4P$46{SOTe*tIZz-~Wgd!?Cer9`;8??zC4jHlvPDD~2joI=Fu~2F_gYIJMtn zNKV_$xH}azG6q?H*_=-GI@tEml^22w;}wq$?zW@RrZAu+n+|fOjWl4(_oA*t@N5Bl?|YWajS(6`*Qqg)1g7 z^kwP6tw)TvXU=$v@%0QA{F3J8HTSFIfyO3|R1!?(ev5bi%@FT@f*W7JYYzRp8Sxte z!QsML7h#4wE~h5fy|qm7S4G2XYc<8PYePR>r(RijBQgk`Fl70bzr(2tB+9xb*IZuI z8a7+t>w&0fV|~0iAR4Oc|7?8s`*6OTXCg&jH+a4rweACQ*)ONUv9aA^B*d><8Z+tF%Y7K^wd3nb4}ic18Pk zaFeyXR3!7#wsbR}|oq-r$AFh;NDJjlNypp*Ef#W~3q2w;#Q>6%=ZyUR}(as!UU~d6X#5o2B5COa4KRudP?o(N>X$SITNa7_s zz4*oT@}`-5ul4j)B_AqLQJ-^$k?`A6@^!O1XBOoYa#53j33_(60uY@!z`Y+9LfY5czsQ(xRN+(qx3&F&ugF#5`zUh{Vt-cY11&L*{^8t3} zWiX!0Y?-IK;Ed6{Y3;n&b&CC1q%(7X%;yIp)jY?D@pW02Y@nyi!~9h9Tw`=^%9_(! zLRtUCr2f^tBN?l2waVBjeuqALU`fv$_&T1@_66tvm~VA)gcAUx?@ z#r$*WeU2!B7aUn!QCe6~gV5OWsi>(zn6bQ~usA!$dBUPsvu}g0=olfgxU{lRd@B$#=)4ThX5L)wfq@S2dCc zocuil8W5;qfAi}a_0_Eh=Y+=Zf#lMji1fQno!6vQ;YZ@V)xMN9g&moSYOK*P_ZCBQ zVllQE*+uHDiv{BsQg`iwW@nS6yr|wvZW7C$|6zb9&RmnDvJYr*)StAi-Ne(%aKI$( z>h?{F@8i$Bpv?2;}!Rz{~?km?~8qcWeU9prU15ECi z+on~>VVLycQ?6}44Y{pA(PD5qjVOCVvU*gIM;xBlbV*$rPfXklFzp=*bCQ;k*}J33 zmU+p|wpjDNAvW?nrHfzZcqoe%I-G#B<}k>GTvvjZCP>!PLwn`^R-WzsQO?FxnlY$Q zR$W6uRoO(AyZF%`#MwKB_czsqZ7r(9sQG>Vye`4ZvGEs&+3sXaqupKcN9+JN2m0-L zz%CzhWZbzFq>9FzLq_jMTX!3MnXZ8lqL3JMMh z-}`4Fd~Y%VC(w;&iC{x9fU5A$!kxg0wW??;pvEpzO%7Wm%?S z`4rlri=p>=_rXNnc1`>_0w@ZD+z5IGH>N{uc@^2|_K{eyz4y3@nq~bgpOXnT4fVcI zlg*2hJ+XXTsF~dSnU_NbUKs7Fkv*pW(OmSuU5CH*mWdi^vHfzmv*9uabuu1PeuJm> zAz|T+{%=M>LYHKXLw-`Oe%m&UawkYkWkZ*o6Eu6yd#vozp2Ku%?&H`%95_=rASDiv z?Ke<-AYV!J-(JS7zrQ__Dk{*@RiYcQ1gGDXd_?9>$2-^RSxlmvJ?L~W7a;F&`!0W? z!!@$xr~lHCP|NB`MY6B9yhW%~LXI87vNs4a6mD%hrt|8A*w7)Y+ zA2X@;gIeOH3PHi)ZOq{JS<7xZ@#IeBqRF#$3fn6KO3?G_&#+pJPW;l@@A5N+VRhd5 zKW#L~o!T@1JFRm30B=TofjF~r7FDb~CH{P`LLKyMidhY*mdL^G8; zYAY0iRVc;s$=`ue7SpZD_n9to?PuJIK(*(0DT!zWYS3mLO$9*P7V64EGOc~0hM=u{ zua+l3<$?>)0fy>h19?M*xQ+Fr!%Gis{oRb@x%;7>-@AQeh)!(!Nz$!ceh1Qarpv03 zQ`a~r3##HJGPZYxDzH-|UTxas6q+v@N?)O)X_!ZHG#*V38EJ>G4VI## zHa(%FqeCwpBXHR9mmn|sRl{d2LkR5R7?}^ic_e*()d(ksP|*yVR782*3v2s|ZkvIe*SlPv zG{^HN=2MsL2Ubghc@BKun%4>J81g0Mid8vzdBz~oGVg8}o=&xyE2ZJ+wyxPHK(W1$ z2l?jRH^Uhng80PaUvXjabxlPK!=au(nzW`$OMekXV=3#_ui|=O+`z?wLq!|t#-yY^ z-`sx*u|?1;zg=Bfh41L!vBDoOK1p-yGE|(JzFK4cK1cO+_6eRk(7!k)fb`X2i@#c7(pHPjr zmF z{<#}(H%%_x9xr(|-sz^A#mhhs)2@|vX@-t9!J~Ba+p6QVSQxjELER0ydYWC*Q=`k# z6=S-h3rEIGXf)jjK`DVwCZV=_jg{-yA%Jj7j?fMHlA@$KTd(q45f}3$-$KbvAjd0P zt<($BPo%mAj4NtYkS}cG@FVF60Sa>ua(J2ZP5W)L_deG&^WQGR5xvOO8ft4wU_An} z)V19um`Hq2VBWubCgked5tkieTk`fZ-&Ku=4*M~_yCuEVxy-0;f=NaDBZ>I)WMz}k zZofI-MrPA5JFBr8oUlTjBMu}`eL51$`c8SHBi7CM<&F$r7!Gq9Xno+T*T$fL7HCkN>i=;~(fj#LH=lxh;hh`h`{ zjlVvWy7DAp{b(L4b!r>z=|MYfy8`<^9SyJOE&TeS5Jp`!aCO8o9cg4QO$#G>HhB5t zFlOA**UVjcd30F`GINp7=rc*Vu%6})^0i}*8>p5JtCd7DRT_A>gS(n$t_~>O-}!z# z1`wl%+_&b8N^lQtKcUiVp-!36? z&nypQB>LY32S06Q)(HC1q$FhoLvX7p#}f1Foz^zj9h`6G5ph1@gTb_O+D>OfmC)VI z9wv3(LBV9GIGN66(rnxI=L9w9K(~OXFb{Mmmf%72-y0<+cYQ^4iJ0B9`&@gLnDZso7wGF#qxhC(8#IxXP|GJ^s!;x1kv11C(9#FF`w^qY;}%1o)NYWkup3`qTeFmQUjK<_S@X7_u6fS3 z-1c}&AiUc58m-fFo6AetPvmAMRiGwUnsonV<>OF7)VnnD*1?|dkJ%YTMcx;o)Jq~Z zr4flWX0^gS_u;tc_dkq5W~{~eyD9b{~so+FGYbdCu}6lm*?eWHP}eiB7X6tV3Q?} zBde6+oLa!;G{?ftuxZ&2*Ea>~roA(}y-ahVA%d?+~y}}8h ze#wK^Sk-D_MVzS>zfD>WBF-yExjO1X7(3I~8t5*_-fPo2fvrr_^LfSP!F;@|`>_PM zfAe!kQk2~%*Lm>7D+bj!+c>VI)3#QG28P~DEl z2_Rg|mUdi8qc4!z<4!#V$oEiwFd54CtIFDmAWJzh*y%rvv{>=1M`$O0rAt7KF6 z9&~YiE9yY`KWuV|dW~&j$$Z*Lje}+i`1FxgGUeNn#YB$LXsN}~jEm#Gn!VoQ0t+3L zX@qSdQfQ!5B3)SlO?41Sc*qZ_#&nIKE>0GA`bBr{aNVS$CsW&wvH@+%-Ck2phlpUh zMeBk#H^P1oewSUi&&llp%VZLl^S^0pNe%N>kbr2<7W0ya2IsC+Cl$U{e!nCL(=Q*Ih6w9_VywklFw z6!BLQOFSXtxHB5xYz-YGxnyWabV_`Y&~o@uV^|RBB)^9VuwqYE50;7jQHqG!)&&Y1 zK(gdMPuKp3w*SEl%%^DIUVw9}hZ12yIhJ&8_7bD$b93@*Bw9-2_}UvbMQ)k1bR@R! z)c{M|h_6^cX|ZjC#55)AOS5D$eB)8zn)#^y55T57;c;N=Vr}lb@n8?n?bXP#kQ}C# zmC6Ep>q%OFZ-qg+8DC3Qc7UuOS*nV0uj(%Fo%L%m@N>tkuZ^H;zjCUDokAT7;UbVr zYrt>c5Bl>euY9(gad%^4=SQR%-xgDQ!EPk;b6)K1{;rnl|Ao>FH3aWSHf9Y*9tN;G z;l2%N8ZP?5O3|pB%Ij2~)^l!rDH`&s$ovUM!4^|a`QUU8vmo*B3w~mBF0bpi{x|KX z=PPNEWi~Lq$Y!?yeVH97TEj(-+*5&o;F^M}B0YHpMwG&wwt<`SruAjpDbDuscB^>% zIBpWuAJ2vwnW72gi zRi@((3>>T4_%pqNyZ@i{pRWh9zR6U(G&I9@P>@zSR!b%RHtUY|nL2rC(dnZ?`;<;A z;)}8GA(Pbnf=7QjXK~Ou`Uc{Y)cqhrB~!(T||U zBF24TE{7=nMR^O&dQsr9iZ?y*9dEvKsc6EB3~<&4D4bu8mX9na31n3;)O^;bGXSm| zPtDoX!Oz}{Pqv?w=SJ5%oDIBWbXFeT84bv3kZ#-;9(fhVzbjZW_yY8f6VIy(40(0u z%HZMsA}mDm>6QhxO)$Z0oS`sA75n|s*c)3?lA`jGpJio9n_VJgDfT2S@2$&S!lt+A zu+*n5xEh~2vV~-+RDyYr$%O8S=;7iNXcg5(?xLUhZpIfs2l3E2G+&*FD|!4qGFFZQ z*Kk)amKyrn9QPs_dvRrkNM!HSg`;n7xkzumd$LR|4X#09A`)_rppT8#_!9lkG`4`r z&l-oY#8|Px>Te_~%#mf@f%_T$^hC}CyfvpYxey@%C1n!=(#;85K$X(wUnk{(ogd|4B#^~ z>jn3TxhFPDi$nBvww~6+cr-Z$!{yVh_Y+e}h?cN$GHG905prMt_R+~|o++4mVm)yivCg2@HUTlR z9mcU__h*{b6|xMUKekM_15L&i5$uS-aqAsVW^cNVh&IuHWw$2QJEKJsu3JR|-X-sV zriWkrg)Tp2WBE95hQ{w^fxE#XmAK(ZgNaB$i)3LOiKModpIGA(EQ5b>*P;gHfVw(( zMUWBE@$Xqil&X(ztn7ixN}60#Hg?4Y++g<4{?UB4OYReziJQ-<{-doreR{Zn3NaRy zT|vV+WqS%ci{#D{2TiAg&#*cumxY#v8g}ESRWlEKj;h1I+$xZ`QA;Ik(P26bQ;VOa zzPQPdNd@|8q)I$)_CWniOE$}A9(e6%uAG0%2N5@ zjMoVM^M}FE;W`N}t5nHS)qqX&qi(AG^aJ`iFWjLjzjIyQO8uX-?N7~x;QiX!>FE{G zA=~*e`w_q6I(FQ7qYuGoKTgP<3|6h#zkh6t|$3j24;U}w{+(>e*JE~fib!wdOgccLTXqgcEPVU^=&7m@5B zD@Fy7a_xc?FRP&+Np%ClobLI1h9bw^yk`uq zP&@GX)xi|)J{aK59!~e`#>B)6B+g5hS0=xR9!vb0>c{Ko7UXYE_VRzhEM#2C>+v}} z_c%K|FFvd)67&EgfPs^OjCaU*#n(R?expj5jw#e|L>o09dbjhnUHE*unTL<;#7)( z<5MW#n&J~`T*}VT3-G?h&;;os%3I=38>AIt@7>R$UmS)CaxE!nK+0#W`Q9SNP8&kZ zLGlOM(e_qXaOHU!D?@1uQ;*EgOOjE>Sv}-PrtT?Ii{b-SGqX_9$Ni#_F6I_RUByMe zC%pbxa`UFvkf0g)s-MxaF(+p8@n%=Eb6lS0;tpPnJC-}WFZh!qH1zv|C__Ce6uUFo z>PzXQMU@r5($R3acGQf4<${*hG89WC-|P!2JL(6f;&W(c+7R z39_U->ZAM31XY92)tQNq0uG#vjl(Or2!61GXm1~t_lWXF3KKma%hv%`Z%l8wuDFqE}C1K5}6k%y&WrWyPXD#RnXz{tOY&H2*BsMO9;P zPvZw}dmLLfAkFCAid9pa{?07YyKU#eKp~*ulM)-5>a@u(R6NRmad6oQ>$*nX(Gh7X zad&x8L+4-f3+2@jj-?>}0K=29_)?`MqY6ep5HzhWRv;-x6 zM*U`Vlh44yn4Mi8Y|n?(hbAQgW^te?#=bDc&QUaJk6Y6xsLa|r3bvB~=pYB3ur)V@ zC&k?zJ<-JkoXa0*c;w}F%9~trnSzQwMRUmxUua($_*}}$! zA~)_9K;f(rOya4Dq#mjt0wdVckSC-uFngmRPqSo%l_ZNk! zo*y92bF`pvmMMeHo;tjfTrx6)uTGbwqp3&oG1myYIH`IV8G1>-6p3bS7YmnJ@gpzV z(=+tH)cg$ob}MF)Y0 znxPQ`j9)_e_JgvQJZt+ff1j>?^22!P*4^MU5n;voTpA`3?!~sU`J|wCl9`Xk#FUx} z2t>S%zgVW~U9{*G$23f4hWd#~$YX-(qM*;Jx7bBPhu%Hmin~1eBdS@F5D0I6LQj(c z!CQkY)=fz;`Dj%}Je17O!J`5~%#mBF&$`s)T%<3x?XFs-k}Bn*(U4Mpu)KommTa ztP$>FeKDq#>>XEh#U+MEwjAK+2Oey%lmOC;VyKsN%B@?f^H#({lR(YnkF=JG_9K!K zIv{kirGu)4*?}cW8HaiQOO{9=G7H|W;8{fkE-QwKRzF5dso|FzdC}f82Lw5iD7+-C z>AB9p7=6Ur`3la~l>RYl;o^Z|Z2Fqu6R1pes5HS0DaxQK!=HQ*j7a)7s6w@M+DT+e zZ}uPL8ygImSkmEQ+-Iq1JCpRkczSn1a&vx_nq_L`L;P)9Z-+2dSO3TEO*yI3NI6b; zAJSbeY~GbifJezfoz3fBPil^^PFcN;g5RvM0(?EkL;5?24`_Dj_LGD{JvYQwuND22 z^jjzn>0q1YBV-E#p-nkh@=Dw6@z6~$R3O}^+ zk`;O_<+l4l#ugEgVPk8P*PI`{cEZL)dSK&JL^EFog7{Fm%#dt$+ymR5x`x}HZ!+30 zf8(b-N8~wnoaj)B(#j3oKi`&eI<&^s6r@;^WTfvOo)jpAY58cP2NPIKr-h-|E~#_$ zJk%fpKjA-OkXaVxz5_C`HIUJy)M-vG$jka<@P&#Gn^3`wyUBT{rgyP5wmrF7Vx-MSQwERc81@yxW5$wei3=Cu-chq`Pz;pG?ja4NLz{=u&8 zp)bRL0ykmH$dVSxZFCi_LE9u*gr3!cCyb4h33#w6XfMy4o8wC-IV>UwHIZEUYOYzsT zaIB-3-Tw;B3ECO13Tgi7^X>99b0d1*XrrEg-3(w~*fcS;IeKV-ZRmS;!m9BuKZ$@? z*O+9t>mE6!z!AK$17HMVXlGoDnFV>$^bB?Jphga}jG^dti1y`_NHXSnoby?&2k1aj zmp8u3jurvTO>}H`^K2+mYfRUq3vY078nMYy9AuenrIq%5Y zgf$#g@N~i&`OXTJ%aCGKPuog|Z`!3(TYvO+p1=@W&Cz>_QrxzuO}jRq9W5v!K#ZK> zXMJhp!2wA~XlPL}Lt%4i=7IfSu({;y>@(%*Dymi%9STZB{XYM1xsRJenk)?_oK_|n zN|zU4aoB0+B}#E0IT~*YPG;vAVxuTtvKFVy6DL$iOre4bE*;Ce^JcT?>I!@WlYdXb zyzRvqpQ)oH4PxU9L6vH$6^ zh|iADx6s+r1=*R?UR;#wYB5&WHre#a&xST=dVmAZGHAh}s23~gSb8e~TBUo<+upFG z2p@$R7)ZwosU{`#+US4ni8U4rWzWp_p}LjIVT91uC+z?Snac})rQ-fBrxp8>RNArdW|Om?kAEc=5~$i#H9ly%grq!&rP` z(Nw7|w;+OQXOxpenOtuEdGmdcRFALHYFke->GVkKI;=PAImx))k7CH%69)4iy0Gst z!}cxRgv6|FW*R?-IlZ2}+u=0fEeu02)vdWGVq%-oj=GbZ``ppx@7VSzB>uX6X#fn~ z@Czl{E9wQPgy^?$vLW<2dZ5_gup@HwwZ09Nl*`)F+1JgOx2v)x-CyX@PT<668*d1r zr*-nr3T-YH_C0$*eL7ksZ06zYuCH}EyEJ}EK&>_L_Mo)1$`V=5)>?bIkM-OM=GWs$ zI$ubPozjSx{M8uKzdO%ocG28xqen=Nf~|RNg+nT5I#?E#E#t^t$`!`SK&sa8Q&4XR zqi&Y4M`p&Dw~Yu}*5CfUm7#FpGjCbUs=2@6!3}i?l@>{?yqNEjoaMl2|DjQ83z{9X zc275z?^NHrZaDGR8A@sv8I<_mL0+~#BBYn;h7pk1H8Sh#SdXct0h0&Q%iFM73B~(- z$eyYwNw%L+z&l_K*%?8?L9U-n(#K_dyZtd@^>I~ENjU~|GHZ3$8sHsM?Zz9tCAP@a zE)@hG_scqc*|gZnWy637DO(xFw=j$+F10BfNeR+iXu6fMt{1b&)+1^sntyPRM($Jv zD)1y5YzNL8?e?{)PCxbyk!@|6LHyu4f2jda_+V^aIRI={>!Xc4RZRJ;It7}RF_ZGF zPSH~-1%S$A@+^c;+{?lRiViY3W)sd{9DceJUf%@19y{Hy`7oO*zD?5Chzd9Z1iY3z zov&tf_SF=By|JX4m@14i^bMs9xTW;kPDveVc^?7JTaQOMuVmjaO7Est38WgPd)9m4 z)GqjfPk#4Z<8=RMAKvZncS7&|oEI>X3+`8^2sq-5At%XOATd1{D~k(9uybTz#CISQ zyl3!v$N(+Xa#$=@FSEe5@iZZ{qSbnSVV34*Uh!Iz*!`;Fqg%4@P*7FVz$M?a)OF78 zn@k^bluri~lGY^9x+Zt6pWPhMF4xl_@#ihL`{16lb&Ec$w+xvTxu1WH5f^O_WEq|G zLaIY8>DICP#0-wt*C4OgC)5XqFe$$up#yczoj6=Xo@ZlZ&#nb3G zn&3jPIW*i)i@;7J#d4{<#aC1d?*u&ECu>QGP~eyb!bPX{%km`~OD!g97zV~@WsjDu zc{Ft=Kg#-`T1X4Jv@(3sT?`!h`RU4LkTE~tR=(rz3e3n}bEi-1_QtgH&()56M(Cbj*$4D=OG*nNfmVOZbT-5_(VY(zr@#v4ba> zGk<*EIIpca$Zt4hD9l%0TGdxfnN?Cz$A1=v52ekQM)zU3H^#BMYcJ1@Lk+v@>OBV6 zGwbG4k%@zXf&6Db6m8g4!UK6_b?wY3{u&MGB?#6_W0kPYhemZp%w~|(*RAYKc`~WE z7$U)>zAlmbc*1NZU(YeV*J_UVn5MIqx}A?o0PuhF*^T$hmP*S<22*=JtJ}8RIzQ}v z5+Y@)DyhS-PPv*I&mf69bKV`|b!ds?uKX&Jifg7M=O+c#qxBV*%A(7t+kWom(IE^E zWbuv(kD+}F?^(J9Kq79)A!7bP9R(Us+?RLC(rA>Tzf)geoGpwI_yR0m{%CTU*0oQ$W_# zV^ceD>BJ+gm);iEKQ%BZ+cBWi;RQ*UK+`$7bJp^3xr5oLh+ps&wxBk<-Q%DlGmk#E z3f>QxK^9sgbCNQE+{_C@qzi6mM6q&r*5LTK9WCvZMxw0qX%XLa`YitlQF1}0@Y)s% zjT5+;Ny?icRHZT&w)i-!CozYEf4=g5iN~C2ehj@IOM4%$Fl9&H1>lrj30>!T~X*9({TSs94CJdPbP?l3AgFNT`vhES2S3 zi(ztBw*B00$+eVlO%XS8pg-}f7VT0$OCmozcz;RY6R$5gpz!Aw=9}%ayu29g9lCt6 z`TVzD9D}Q6v7S6pK5l7RprTEQu9;Ba3BI5XcwW-PxAY&yIPT7)K87I9`Ly6sEGsuH z)^`M6AL~o7dp*66PlIUzQh?qzTf zw7loZ4h|WVyLQ6$To_6j@N>TOck+xaVzSr5kbRSK>1HEP@UPI^5;D&=fVZIM6=6uL zXm^MR=0+HH=;*-G5z&0b+81y6?e+fjy{Y5X582A7oC%pgDQOGA;0pU3sEwBjoAo+Y z8CxY5&qDr@p!u@WQUq@8C77lBq1saTH~;WGCOgQ-H$lr-?ZTrnM_F4~I)6JU8E=Cl zD9@L$naK<6({@LVJecwKEsT}TxMis42@na^WI-Vw85^YVRg2Z{SucyeN z>064qxwi|Kii|k@EA2HU4!f0*K#Rs$=MSGOe8d;mhTA|dd)ZPQWL)v`d{p zciw`dZmokG_`OR49(~{GH8$Zc$FOPK7O!?s^`)1#o{^E6Bp2zbu9b~VeA+&-uYB!7 z6KbL4V(~%;OkFf|dAsC^IC|(?aiP?~Al@zL_~~&4VlX!+d*gH$PF!Zb9F5@XxMOLl zck{klsJEH=SMu%J_S8b#p8U2$@M5qLF!=+f;gP54T8LnP;&4_vo91djLT0j<5kd2zNp&mY|E3Em5O@*2?UnC+LsT8df>c>484~Gh^N(qUw3PhJTQ6@v8=m#q)HWZCl zM`4k#!N!@lwhy0eibU+jC4~z0eUPQXKLG=+P1&!_ubEazkhSwx$opySy^jc*LnUJ1K%1AM-5UM2bS<6qT0I_( zPuVz!b*R#`YbNqW@7?xu?$9V{CJrFNeP(9I=H7BzyA<$N_A(q+1UnX;6#G?}ndB%P zs5Cvp0gam$^LdX~=N~kSLE7$oL$LQ{^*5GjP3{~{c}XI)+cm=gFC;}3UzY^|Rk=qJ zkh??_8c+_MN{;1lhHVK=`t>?5SgP7}518x!r>ArFM+mCAL-Hw_lI8hz zxMzNCz-4eqdaFI&@Ni`R#2a<$*c4K_Fo#aPP=A`kQ*FKldUNrvYi>FdCNA@>=U;W} z)U{l8l#0GP(w%eMdm4~SIo4YpJ*1xX0kcoL6$K4%fa)4jyYxM+Jr1pDjZ6{XdozudaTw}2Lh&qKxz$ydQY4^dPw|blV5X#2z(RvNcH%ZvD8`oM(3~p9xYpRYxjaixSc%@+mUEz9w_1}qM|-iTM5@^VL#K=^aNDkp zFsfcirdlQ>dg9~kD&W@9Sg@+metb42dID~iw$^ifmg4$QkS)B#zN149_Wy48qr9YY z5~iml@>Nf9W*U=Un}Zc)BBn$o)lu5+Pc84i5qRhxjTDdWPLLPmYK^#pd`~;!Z@F6a z6vY^t?lk@Q4SZCq`Cz-gXwc*gt`*PXyolzyAxGHgpVD^}4jsMnuOfpAKTjDxaXoXx zsm^Jsgcb`_ZV;pE4=THvwA?w)j=w1lBV_1H@FlUw=^H5O+fY14KQB~2E3$sC-B&Tt zQWCA&u2Og`^=LTt5kJ8{DasqXB?xPo9y-@zCi0W9DsL=tQ#jJ0naJiU;g8$jRkvl; zY^zpVVET{X`@KWPzQAdd{LvMZ!S5JJ6aY0HC&j~6)g2+(1j;bE*Yl;Q-%1WO`)}=a z2tFRL7C!QsqXFzpi2Zc<8M)+2;@|^fk>>>IrVFJA&*DdKWU>S4mVk-MU*rttrV96` zL0}9Twj{xZU5L~sJA1u$Ik`AN((JT)^(T%)fVo|8xr$A4#8WV}6Ub4}=$0*2ZbD8{ zp5z&Y$aEq4!x5qaV|5jJ@)eg0vic!h-HxnZYT?klc~Oer@@Rk_fV8+IK029SEQ{*n z)U1|peSO0UJ4J#%y9Qp<{^QKg10{w53n3p&x`5c3X_(qDJA*yAtek=lRw@`Y-F3fUZG9Z2<3a!w<&}a1p6^uBET^?RRLX63 zwOyU9>}i50@vpDtE2;+VDWr^KkwQpbKN5XG(+Y}Nij@6matq&uT2+TnFON7_R|E$N ztlhz$;;2u__ks<5nl+HW1**81G?+Ev2KB;wxSNmE>Ya1>4<#$gTH{g0H!+s`TT!;Q z+#Jy$1Wc73(yoN>i2874x6}|xAr_8_Lj|FZ^a`STIAWYP$SS+x>>_Qy=!#S8>P(#o zsY@BAI(j5+Hkd&K_VTOMm24IBy-^Yvi48GVy_X7ISZx{M;~&=s%^#uOVFXSS9FUr#IX^ew+`Bt7kgu4&5Cv)! z-Nw&?9igt~jPN>iCn5{eshU_bvWM}H!@bDP5T@QfWYD;&V+DOJWq`ysH6wNYofP@b zb`@;NL9l*JmMRxZEJ zUv?ym_HZskkY-)aw})tm0R`1z<9|fU7|FD{vGLnNaMy&sHJ}>HM@QJ2eLZjW_s@@U zewid40}*|7o!{zo{1gKTuJ*p3Sb~zBqmw_tw9)Hic8X7GPUNb`INLU7PXA&A;W7Bp zgNdG_Yb_U$gJD`}*(6itu`U(a2WN73c2_;!9*SSJmAA+qPfinw0HAayg^MXUX z4$pvp@DLMRwCc?6X@!_vF?V*=lh1qGT7SoHNS%)p?NDLsL|Y^frS0!&gw9V5JSJ2N zlewxW>TC1#scpP9M+g;n4$9W%S7mYIGa$fMR@UqxeRsj0*3g$-6dJhcE{ip1m?IJ= zTyaF89^jw6R`3pNNn0BSGghi& zzWrDH{I1}D;y-RfxHWiY0!kOR0kN5o)$he~^W)bwKlQWlaoEIPc&}!m>UvOda`VL7 zht`~-{B^HJb#S|y4f9-oEcW}0W4~5Va1WR1A#acdl|GafJFfcrcRg?F4nKtq-73e? zpXL@*_E-BoiLVR#MF5l&%c9YO^_^Po)@=+7I5}7se{P^uR%%v6tx>kM>kXa})!EQr zj8)G#Z}I+t7Pyr+nw4bV*;+GgRx`LD=d=Gb`Q6^XJjI7R-D!Q?#%UJp{Mlz~x-|`c zdFg9P)4xUi`YhXggo{U;j<$q1Fy*NU&uf>#&GmDnf?HpN2DS|5|oP{zSzTa{%^|qCCMmgC8&i(X{&J|Wu zPx>PGOdVB4*s|Ybr3Ad$z+6nw(q!5HxhIXqq>Kg&%<{^YGn0#`?R-JSf5+Ag8os6WjtCM z3_jJ*GGW>*$Yo3kTWQik3+Yo;o47O!ky-QfKYx9pQk(#Gm?lubI=f`*FI4@7V9uy$ ze)~;;xnG+)*-d5ScTL~_i$1(k6?<-ZcHTfQ9e?_>r`wl+{P<7g3x_SeEXKkSEqb=i z-HZS{ngWYJ^Vy>RddePN#L%oxDa5#{6RiH3cp(zz^-3OD7;t#r2G(($J;GBL73=Dt z#IozN{;=?P-c9+jKdfly{eax{Fg4+EJ@odM84^9_r9yg3qw`z%4tcbvuAM&|IhbOtLgCanvAj{rRWUrNDME}p)t33Gmcoe zYF578ehBYCAi0uG4Gx#Ow!Y*<)wcKRi1L(%RllwC-}>(UX-=O0vzm6a$;Pz?0;Jw< zvhFF`O_iVDSWA3Zadp7kqt(8@MP4tcin;-USA7Eq)k8FB@aR$faPop(yl`ZE+~51t zj2Xs%^E@u6WLxBPe$$61N7G(;kqVWh_zYF`0D)oLEWD*4Rj>xhCP26h(QA*->ka=d z{X^%|T(yIhHmojp1b50^LLfdjiQxY}`ImL1=J0<2X}%&Ayt(PIr7} zP|t^B1_nmNsSL0YC9pQ(RHmp{E;MT{82jy;r=EnY2S)=|i@Bw~17L;L{vaohQhue` z)MN{N!EOS=c#DtitkEW84=375VgADuh-Xh4-e)R$%3cB8?4!t?=hmcW5bxj<^9sVU8Gjd zfQcgs;&_~Yh(cuxp+Fqj zYavB*aNd7{ZNFOg_!w*uZm65O+nHL@zw2a@zza;{fHY)ugh+?Qbo_SryFkY{i`|h; z5>m`kxML(!)3fD^vGJ^1GT7PCR8cnyW*DLF75trvVze!=@#y92VHX|!2kmI&y1qG^ z5)-d}5#eCPCpNB1k1_sT(Z@DqIC+|=6j!*Km){YQs_=`>78=n#aS#3UiQy(?sFIYjmYN~=_ z-{(RChN&Tl20Obt@K55)gkD(MZADk*Z%fHGN!qtlxveEK4P*k@WqItjN5qK~X8E12 zp}`+XszvS*g`4?lxJzxt*T7Xj8R_IZ3vkdvXc@n#l2nzo%^ZeT1_~}Cdp9w+_r!F* zgWmT1-i;r?B%PyTIzGH*VgGt3UpRiR@l9$n5#p}NdP(C5jV1N^Fi4zGCGHocf-}DN zFc%c}cCRi{Mi9W$>+21nFgcrIyDzkGne~=3mw;8I0!G=20<@8(97Y zZtwO^PMN1gN9T6F)U0Az#Dmt7_kyKbC4=p))03=-g$xTLp^@!eW^_>vg%3q`>@9?p zZ8hm{nQeHsrL)315X=ULn;p7n;?)rcZLIa$k#_e@>a%Z&1#BU2udr0@nQC6K`p(2B zNs3<^=G9f#WWt1k+#iuijMA~mEsF9AvxO)EX0aD_^$jV_nF}l(aD3L7Fjo|QSQP6Z zEaM6O2z<>Kub;)<0^@B@&k5K{n5toA6Mj+;oJ>~lxn%M4zhh*@xi4mb&j_$y8R2eHUrFVU+<>1w57}e;m!+1 zgQcgNgO_F}2OtbD+J0;(E5szva>G%Hcv(?joQbQ@BhW`)0h(;mh{;}m{SSpW^o+R! zTtTe{BU&9Fz9J(}&ZvoZ3yi?xoPTFJj=hP7K&k_t%Gfjd zQPnxrA1Ju-yUTzV|7$_YcDG#_em)PSMoPrOG36o%lMbk0sz#O5 z9jeP^(#7Vmv?(VF^!EK#i@EgZv4~*;l|eU#2jUktSm3DXY6h;Qn)`TU1!;;%>0?WN zVSYI-|4acS03_9~e&^h#r_H6@kff(K2ZEArqiA(of-rHyY=@+K&n--ZBpQ3(?VEA*)()nlg z2xf%gcqg&Z`QQLfYQmN5Zkw^v^WsqwT;+|>7oF&XA20iIBrakv0oS?nr?fyeEnanA zqPV;>XE8IO?h3&m{{DwU=9kiyZ_{O!KjTvX)aYULtPx1s>z7Cxm&HJYpjuG4(= zHjWsvS|sq&Pqrk=o%@>Rvc2#XT1F-+mKEkh$%_hRNL~?-&oAWI|5TCw;~Sp|SeDs6 zQwk&|<3AE=2)?=b+E>~*KRIUrVA9lvnxih+T(iova-yW+p*rA$3Z2Cf-H#jR-y%TC#M zdPbE#86Nvpm0T4>r8TD>?F<4PLbm*dn%G|yY0|R0_dNR#S*fJ^#$@L6Z1<#h$%s02 z_mmM2>sIIb0&<7rn5+5MD?Xiu6WV9lS8pg9+74-5CL;4x7tb>L>3+?8;?GZ-@qQPW zsKeDzw`auEcCYhths^?4U(dJDnZh7aqg5QK@>zpj3y-viRt#eJqQ)*<(hpm;{?IF2 zr3}4W2$eeAN`I_(Xdui)(7w0XmusZf&a+#Btagp<37_)M{+B`kt#77$tFAtl_%=WT z(~x9uB#ZTU7uyKqPMJlWr{#ql^o392lg;6jhojrSbC6${q1lqb-h}>8wQ2NxJBJ%# zso7nd7;J$#eA?f_-igH^$VtF>} z2K)+MbT76gRP*>CQDRjSsRVFF5c7p*93w(liwfcUFRlNNfK@po4W89}@S?uyW2nr`3@MN+8QV5OE1GP5hCjwF+ZGvqi77wd&3allV68l;}nR}3M* zmM&P)Ib|bRjDfBPE@F||l+9ctAY$DGQ`O&@c`cB?Yxbgv z0;mb!qaTwU;I7Mil}b+QQ(-FF7UF2TmhF^DizVqV1=FV_pS$?j$NKVV@#+e+t7?FbvM!PTH< z1;33{KwD*((^wEX+%F8HpK0K6Pi5r$>SL!k4h6}x@p}HmkVctNIm;`lM^9lJ>^_3g zvgFH`j;Vum1%wMyFvMGo#)+HB6JTj_eMLGi;Gg)tyo^s5k+7FV6bXd^j9T~Z!>i6V zC%nG)tv>t(7hx(nf5_81|;kh)E3_w|&6TVlZw#U*r3Ts9%+u#-tz6pQxNo+u3 zdS*8mcAu)ibQfFGyI(X#sj2CLGz3x0W_i;2Ln5m>KiPM1w#KQwhj#sZ0h^z`UGVR5db_tV6K+cCa$b9{ zg@b!yryWOLiP<&t^<<+dppFn@yo?!{1i!F|RhmFlE8lTtfN3t&Mi9MMXL|V0pLv(> z^s<8Gp#jEE>d_7R7)W2j`q6R6l$M|FYwVk`EbTrR1_&J5(b2?3ejlmM?Ib60UZvTY zt?rAl$zNat)$5)*6?ZE%sznRlet`j=1fo-WMho`U=6WiSd)?!_QN16POVf?86#AVz z-rdd5EH4d=cXAWD!B)Ns92{2+*oJ-|uFR{g`$xVzMjB3+(XP<-ftALs!BmcF&>nB| zG9e$69|2eJ22KD>h@V@IEBO1+kZF-o_vFV8_+>6dSKz zoQByWx-Wqj(Pj~1Pr@astK-bT>u~Wiw#I;K_Bl+9Vlvv)jmRr7KzwZ3f&wKVoB-)j z*C=&!K2tZ@2d(bPu>R&N>-2_FV~;3k9~tUHilcB{^7#w@c61ywWn?HDad5eK#w|At zTx5w>67LLhJ%@?2QXpW`I`$tx(gNyxS(gn`kXbJ|A@mVT9RL|Auo0~6KcVNfNkEsT ztVe5Z)B*De6Nd>h7_fX8_~hnXcsRNd=!5|F*inAVzzAsIl~_OclV7jBiykGxeqZbd z3>lPQ51)#YmW1v?Z7{PJq**KWE(aQ#%g(rGIP@YGYtL!hT8Cxv89Bd_Bwo30*0mi7 zy9dWCDd6amjC-B%9pS}7(glu z{N9+HUdu0UWkU-v0Y+;*ykjl_k^hs8BH4 z*_s27h6Mh0i*zubAVqdgd_1JHz{aMlvbNZKaTa`D=G$BQPahJ+^PmW~M&!1n}CCef4VWD?=`j%?L@$Ted567LQbBOweDE2omaE+(l_=jn64H zgN1cRNjML!#jJsB|0Ru+x4(!;S+_9#)BSr>m^{IK(E4zo?m-yGVmq+`W!gl4bFF+t zEHyZ6{YM&!@Vzh@nUj`!WX6lr)mLI8uT8%7F8;8A?7RwV8n58v3l^oigQm&Vg=mn+ zui7t7+(}yrztSZ$B4JZIeWJ>tz?K53H4;vGAgMr8Vq+Gvqtppzil%D1nT3Ug;ZZ~8 zQ9I?ev%D!H7iY4bZkm2!O()*=7FCwV9@buuR>mF@wxBBh)3f7aGH#c1#7Y9>hd5ol z35$IBF{T!msSe5h(+xhiCGy-DQ{s}z=D1?N#h#9?>o%GtJp&EO`OX(3-)qDEJwe`Z z{syl6({%YfDaygcjBt3iD9{U5ZgFp;x(R-@9nm zxM9y;FBrda))%-OjG&D0VT74xpzco@Pfp)V)c`s4ki5j2GQDCbPJdwGW)~$hIq~q! za&iBDtN(H^O5WjhH$_9aQnW`}-cp432<)A=a{sRM`4S}2z_;XUkDA}(KS!RzBN#a` zx_!rT`NwABa{Lx+bjbrVkrrKDZWZ$T;Raevjyb%pzKD6h?Yewjptf3S$lh#}%V@;( zkIK;sF4<82On|KalrICSf;1vK@RJ<5dUu}#EbOwV?geqyJ)r(G7PDG`IpNLE-Dq@8 zy~#hQZLp&=2RMA!s<7ywS6i~M<@%V!#a(#_h@kMBrpF!gKmVt3J>iUJF>pSC# z`OSry_u~*n;*K8IYuQt~jWk{Nak&BSHFnDW$NCt;otv;vvznMi8$WPoNN%mUDf!gF zYl{#<%tWmzHEkvHO>FJ{z0ioT{*MGdUO#N1v*qrol=BVA1#XIbdiwx3je|oWX%v|$irQ}C^bnF-6v?H zO420!z}4lsjc?+NT-EMf1}t+(`=t;SRa>Np_QdP+FM~z+coMGuNrw?D#$kKS_~P{Z z?I+HJfkn@@3CKF&q)u@E7?!RJg#BWz!iq9%VLq!isXdMB|IiHIc6LaShwiC! z+hM~GhTcEiGg=zG&_QERA>Kbggzx?A42Y1?F$L$%7hNO2N2>K7=je!?a8d!N%7uuv z6{);(xekO7R6}uxsEG5fKPx=@bXCASg`>%>!NT^k`1o$`aCte}ac5JsVkEN7?S=8n z%`s~Q-7lE?`*4WSXmYr;WfjGxRmt(~jHYjR7RA_BRWwu^c->5)@-00dSQxI|Q^7`mpLVa??}p3U zJ@y3EZMI~9TKWI3gl3X^6x}1Kr`+8P(5yN8lJ8_s!;! zDNmWtO9GR>)`0mHB|isSV{x;i){030&D=4mL!ySV+)!yDRF28smR#U$g(H+%iK!o; z09UGF^Um)aUP?Q*^|aK4>s(v{JOpg``+P;YnN+denbx;=+#GN3jrxm1S#oqzSlvKu zV;-cxoxoU)dnm{&X74O?*@E)8#Io@xBIzTU0fRbEU`|NTBED>YzL;PB@#{#x=+8K0|T{86bVsw_neKtdj-N zhKluGDdoOXNVv%oWeN#F(dedO&k`FSD!2)98@^bi2rUmX(FO3LBb|u&W@P#h&0^v< zd+#BQ8ygoid;IJPxl`GzH=RJgBD~*5BPyR`xjVxzX#L%NGsa-h!4|}VN=?bFuCXAe zZ1YLU?B`G^o))Dt7D(vE&2`d9U(CuU3?RY_a@?co*NF-h+F8`e2Af-Wh{HK${7T1e zUBMq@mxB8{t#!W$u?gKnz+rH&a=6=K((?JhWM|~c(Q&G{qffE*Q?afYy|}e4#Xk$1 zv6Id5*ShI^cJJ;mbq#yp>{hE(!5sfWZWPkjVVEaa3299|Pk9ELz&^ZL*xdhi=S7rC z=m^s?;ohU8kh)^`3b=(#1QaY7up5M(*p(>J=aPdUaE^_sSaD*5AJbxXC=F7RbwmBr z%W@lMqv0;+cJLGzL2eDb978&ZGK~I0O^LZeAy%V$n=Quezr`j)=i-Tlv_||&PqXsl zvl=N=heJ_$B*z(-2aBFk70@yB>_^n9=hT-=j49J6i#$tQBZ9bWM#@3mIa1_I*pHl970$t6~nY)g_K$JP05G>1vCImIVHxj=@gejZ{TM=eUQ1nCjw9} zat`>1G+d2Dte?{`wbnX6A1J|D3DJ+0W7Xfg@Xe>W64PT>EC3J)yGZDu&d^q)H<3*!M3a^Kn{@?37YnD?sTuuc1UT-sJ`h z(+RAFunmdX__^z4G)UwtfAsWSij}pwdd`@VM1%2I7XU6K3v`|WSNY4ZKM3Lcx5lgj^YE@<{yTSb(#3K z!6QjbSB3Mc<4o1tlcmz7kgAKP3E#0o4<0(n?`LsdJRO{8!!jW@baLs3k2UmpQh}N! zQiI$xoe@lr;QNh)tk&H#A$`CSwRYbIrO4sUj2{ocHW*~e&~XYF3Ir9kJ}$q{{G`tx zo_&3MgVXTUY#%KRejcvX6^2){Jgl?Z@^_qxYYJg-Dxb{_8d5f4sOr{waY@B)$11A9 ztLmODB^<#z)e#sQjDxcO+v%Q74%Y~L@0V1Lh3risZ_}5v9m|K{Sau}88LQ!UB7|yV?~`bgB!Q#@zQKo zVw$$AUO)gd|8yw?+k(zftNEk7Od%dXzLZQg&# zUkaW{ieOmDRUG-Z&vo!%_U(zH8!^QZJ9%b(UJ9g$$K3XzYeAXub_$I{l63?MWSqt6 z>`iC`wzyh;wI|Ipl<&1Y`Eg`?QJrPAIlPi`A-fuac6bxI=61zcmmp;znN(ljIH{to zm_;E=ic9XFmUo3v7s&>a-`zl&Eq4t_Z2PsBtc8CJq#fm!^ArX7p3!_73Yd~|)XYEV zj2pgUF9QNgX@{sb?@=QQg>TX11BSxOb7BqJ!gMIh6n!3izA2J8YSlX(4OL&x=6;Cp z#OueN7ukyak23QAG;h6=YZ{X7`{d2OX1*X4yCo+iX-g^lp)C3GI3t$#)|Z6OmY~T< z9(?_*ZJBlpKD1+mGWiJ(qck{ihn!kigS1`ox>(;29B<|Ytzry_blpVjk3F*2Dn&>GFeHfF6R_?s*ii!(!qj`Eb zNEQn*6llmF4%!z_uT5syzwR;8<1gdko@`IXVbmw;)z>xe7dgP1rrjh)pY55cyQfEj zt`faZjhPq?wNa#{{O;#QgizV`GRRw{?k3fN0HBk9Xkh6gJrWa_Yc;>tCVe(JM`gH6 zht*`2jlUD4wcO``sc(XRP3%09UWQ@59w)4(8qL7}2SoLM`V<^dZJ+f{B^H;JZu&XA z_m?7chL;aY8rcLo#a<8Kvwj?*A)lP}<6YFY*D2AWlP9T5`6Zwp*g#>cq;%@o0W_W6 z6!}Ct3j;r{mm`xy$<=ko@?Yk7x`sD9C}vwtM=NO#)fpUkUq@RpIHA$nUAYfmUk3~{$*0=g+ z+2gFxrIoN?vtGz!vUz(CWCVhjtg*$B-7-BhV6HK@%jtm9%1-S|{SOAIofLW5hCU~J z4w37v1|WHtYOKjGqN`>o~)m<30jEvVrV-0N?bHuPh7#nYO5`fZ?*!PW8cL0Y+ zNpv&E*YX4n8}}YpypASyPk!NeBWXIID9OJq|Qfcg-6I)*_QmVMq=ah2`DtDdydZ7+gT^RawZHE zg0#QSj~KMF^)K;c?>~#Y;+-314x}&ini&g0*7=6q6C>5L?25kO--Uif~Yy380M zct5KAW8W>@Cx#@KnkHm;&#erRN$d$)^d>kcVd}T7o1W}SAyWLZ+TxHD3-SNc>Bisc zc~Hsn{p5AuW3MHpMR=FGI4^VU(-@nnOy1aCk#rALn7ii?`?BV z8TRsw++4RhCf)kG8~L|SpA}l_UEJeR^ftFbv{`YQCO2lpjqOEt-AL>^UeF=6A6vba z>7WW!X_bM?}_t>Tu@Eh+m=GZhPi`bn6~*;NMPXm&Tf~Hm;NfaU zx@45QuCe*&%KktHZ_myS=g2x~@-Q_$s64}GA7Puv-r;N&^AUuE2|$Ej)7h#_G1@tW zoL}yhS3A#`<>r;@gVXE0TzE3qh&UILOkHB&W#7;&?LJ%K2@Yv@xnvXt!vN{)Qd^v& z1bEIJ4l@yd7|zWm;rG>|nwAI821yi!RS_cIN7z@uwfIFX6h@x6KXNzi^)RW8rgf(j}HaT)|#rO0+kKt}B&hk=_dLOS|LMFJ-3Eh254n(XEi8Y z80~iAs@(ov+xKGnix>*7k1y|69RrV@eO(=J`rp02asw>=FpFJPbwg3Z&am2Y5{Jz_ z+?nf<&lK>cxvaAKbOIs4oNig1B}YN0laQjBN|Zd-`*&5ib< zbcmKl*uZDBhD|wgI->|1=3^@l*vEifNWah$X%5j<7-8tOXGH`g2fjTI`frHP@&bQ)rkxXa^ zPifh$Jt61q-7)W%BoCK}mZ|qoy4kHz*6$sOcyUX z41mp)25rhv;SI=;+l$U${J+28y||@e0U_9B)@%AM?^pb+Z=VBDHNSdry1UOzuYWsN z;c?seYAKS@JGa<#*5QSB2Q2r2%%4P3vbF!`t&ZrlYL_F?#6Sk8n+_0%52R_ znxd|@OzXai?pbI#YNFIS7X)9ma=W3-JM0$XG}nFoB;bykin=A(6}Qf&I#@CmC$0*1G@wJQRXWHfq(Qz}GkHBr#&@_)SMiMjcPt`2njI5Db zTKE=&T$YhcPV@V|@di^d#8h?qk~`xxvo+;b;#DL=dUPjBF^CL2&OFAI7@?a(+4InJ zIdutF5D_1Y$o@oj4@QHUmMUGr8naT6|IdZ7aGso~_zmUUIgPlARhZ73>USy%02;Gl z2IW(%sudS(YiEA;W;9GVG#);&j*^=@l;Fzx6jWT8A9OaZ_i=`Y&kqn8S{}K6XLnQ% zEGZqNIJu5j$lG3W9ahlM`(WB1hhBG-4XMR%J`w|G9%{xM2XQhr}3SEjs4#= z&PHw&CU19m6FjzwU>s+uIn$=71ad`C`o@57zu`h+JN{1NTCP9-Je>Q7uMn`4POcEC zyp8gptFPO8s;s7_8MeeT&~WL29`_Fvf>P0@ora%Hwd;V8rigY`31{tsf%Y*IY%EpF zFqGtMi8>z2!4s4BOVHMWZ1)UrUBo$gh^iX3j5lkS>X%LpKKcW+pf&h-GW&6dx0afG z_36TO{l!5cl=Snwc3Ng802=AAw@`-Wc>cuyW+g^|#ogPzJRY%`nDpyK@B|x!?ffH2 z=ktfA{bU_oonA2OR!zEtvf*CR!bBZ>0) z>D0bM%{z{Y`uodP4Wi_MUZAAiU97P49;;d)Ktbw-k=efLiR|gFicN%P!jm$^L?!_!AWX#xe zsNN;Db<9eQecEGP!3*P1(9$Wc#dxhgDeG6DHB{jYOqQVz=eE=dvY!Yrh%@$d=L4k) z%bpXj4Ml-he9Jj!JhbxWTvFN=m&cSMvWJ>7^y;olK!@fF>uZbsM%&q00s$h{Ma`|* z2{F;Euge>kS6E%#g%Sx&Y7MQ!J7k&b&|KKhbaeUCA4MLeuH{5?Z`D`Cl=%+uq1+Eu_FU0(4_|3;mC~OJkVNQM@zF?LM4#enqy7dM0DAM4y zk!S`MW)jE|M{+&(zo(}h#n~T;rda!Lz?e#903s=}E8^N7Zek}7}%`#L_)-Oac zi7zY~-S}8$OcRU}qDRm2_!EntyIAmlnFI$9JB}>=Z~zQ zHTi`3|9?#w`ySOQQ{>b68~4*6Ejl>hG>`9Dv0 zSf!d2%Tf$(`>MCWtT#YSY>r58dz=EV-c0k-#F@Ln^>$7~e_GkI;ZChanc%opiyIcW z+$l_Sm&3k+B>&Fs$is+H69yZ&5%rw&e2!7W0R?&EtNc5= zKS==WkO~iQGfh3Hjh!TG-98|s?>RJb^zn5Q1>spokaArbu$uI|61agh@|jkUR$TC6f+ z*bjp%M`LEn?Xc!V7JMpZP|rC=sYFKVU{vUt?{i&w<5AO;c6jsfbusT&a=dr{cG&3B zC(>5Mh1c^`=@u4d*Q?(viIo84cdyt){xBL}SopN|-tDdckjz@&+%@_ATW8H}24K9w zTUIx|E5fd6e8XK*|)k&5i6J+9S;vXyd<4C70eAfNX1P~6yGUxlJV3lrk&DAV~S@fL@DH{gs4uDSU3+C?PlFj#LkP$4HpbsLHG&; zwIb20%)yM<@anf^H;hE>i=9)nhq5gi9eTZum?oZ9o^sJIU*of6x9mcWen+bDSU{{f z2-M7LDdKFjT^XzqZKh8oh17?UHJas|<2xv_cu)KGUN-pjD?ZXSKiRAQqKM5|MwrKwzF_m6F{*AE^| zK3T!_pB5Y0yovD@x{<`flB&S4pxX;Aysx@nPW(;?ye}7NTj)?Q5RcQ}NKC`JxMr`l zI<8ea9}5ST7UD;u1ZD!w;F;D!#IppPxyOWjIHAEf7j~$sy{Db}iKpPxB*CXK7Im8& zHppM7;^AHT`lXE&FGg*;HfH-(GE$j&`1&SJ!E~IVxV$MsO+SN6`P=fJ(S{iRI*N$$ zz#i%7?-xp&cLV2BX`;)7b5-m1_gzRDnf1|GdBwE7qje&$8Lu!pgpwyv5Yk#9D@TLa z3(ukMRW`ld=FS^)_Xxv7{^e-UJKErNy7f%`zUDGWUzF?F4Jr0(>k^z)J#QDhlr>ny zKGMm>MFZ{N_5E!+6)fF#xld^0?C>^B-eBmpC}a@i?iqetT7QwE&7$V%}t@Bwgf$X6e^aze)_YES=lxOzO+15%YEA4`sD8iRy|tlGs}%}H?@(7 z&tHRXP6>1K3;oY>I|QAMD7~cJCO3>kzpshU8uSlUzriaLZHx?Np*?|zFBHdWup@m7 zKFG^<>w4T~ybbes?DYCd1q%!!+p%`l$muMl>!i0z3e_MSZZ{`ea>bX2R$&*pc3&l2 zqy{oL74mz|9TpFDx_mt%4)duNLioVCOly5&Zl3eW>vsT8hT_Da-7*8{$C}MUp`*%S z9~H`QRun#;3UQ|(idcL7I1~y|K<0=Ura94PAsjjVm+yK6cbP44Or)>y*u6k?B(K4b zBu3~qlymm^u!@1SxltysB#EZ$#Z`%Dz31W^%WgF5OkPCB6_Ma$0}Zd^4ee`#F5|e8 zTn{l-TTzO-vY#gZ#+pmhf{C02t<}=NLgy3avvly`dBp%G3aY|h?fqr!Nm9s=Gr0t;;;US<9mk~7#yP7;b(GonNUoTrA%6z(8x$GoueoD z^5c8SP57B#azj=Ty?Z3=3kPs{SD9V*lGnbUKmYSDb7Ar6cVl5O!bGrN`^O}j5Wsb2D`dU)cCPcTrM!|K8k8=)weU9=7C;q;TIIXK*f zHN4D{-^r;z`xiVd^)a$*4};D5%t`s|ZO8aG|I=65Gcd^RkwJ>HV@%JkNE`W4LX#8% zT3FG_i7!0OfsS%~a|^78B3kF0vK2A<*f;sBr~2?tOtRn&(RSod_!nO}#g5?}40kt@ z^iDJ7NpkQj|CT>{;voHfLWas5tgbGTT{p;=zWNPL?B7MN*o!%~&Wg`S$Ic@>`qZNw z+dGIWxi0!#!C-IX#FwAu)X9?^8mz;+Fv*H1NWz{^_l{%y#lQIy<*T#Y61zxf&xC=( zhMj!<&%a7}2Fq(*To++xCZrP>9Y`;%KN*J?$BlT2}WYh48EAH9aD% zM*WnW^nihS<`Y8NVnRZdO=w|KC(0pEZBlx~GBda!F=CnaL32E$Urb6qYJ2xHSQ+Q~ z&1qsO)h?+TPZ9QeaW#+7>{#W!Ycm;grrH>3N93oOrIaO2x+UL|x0uSWI5O$>P1-=o zTRP8DCTWjUIpRSdetQK+hZ;D0_CwZ#X)>tVC^a&z`ty{WYceEJ)uu&p&?)VEV~#-x z+YFvySZn)~{i*UOXIvW;A(v5Up<{!a-7bRSXUHQ4n)8F|$f!tM5=;C9R|F`c%)q5@E})yehpZ8&bMRi8HTy*zEFt4(}{w{OWD| znf5K2kb9N7lq`YDld>~)&0uiQF7;8ITI2eyIbxE6*2gHh8C|G8Nvl^0i$;Wdm3H&B zlU>YTzQMB8pQcY`i((r_alR#@ls9?TL03FL?o~QbWzpV-NS>8FW3W-%wu{H4{X2Dh zKXtAI^YaUMLJkJ^?V%{X%=Ds%xU$i-G?5V_97#VvN`^`%EIK^?r~fY+qUX6h<&(6; z5mEL1M~*E5eevd;C}bxUwk+He*GLq$(o$<->iRA0)jjM#bVM5HYEm8#K4U(;UG4Iq zjnZ6HNYn5DjrkVVmX}Dm%Gr1PaSrV4z?Jebx9HU#oaZm3L5EeDJAR? zFFYlA?irvVKZVERLz;@a`7l_>FRvF{FCsWU%SymZeS15FmH-P&eu|q1G;%rE)q=~g z!P>e{2%L+qU57ccZwEC6W>$pcMon4NH8xXSTPqI60fw6kr5H>2LXeYRPEAcN^ViOC zb84O3@(y+mHM24KE-$=&6K7=|dGR12Lmmw!7T$mD*Zk_mH@QAOM^IR6et8Muxr@AU zc82=F5lZ6o+*x*T?8{%Gm23RqyFcQCv1L*wJ4L0XSbY<`@UvG~v6a%%T#Z#K)|KmE z@%o#*adDoi#wG{`uvYZ4v(?O*=YPy=H$rrY6Oj~h9?ox~voORnKl%YLz5X6|W>$y@ ziP`L+(omg{mEwvzN?l>e^NY+!TvV6m69^k=?dv7Wdxuxwyh2uO8)aG2pgL;UJKD_H z8^7e$D}MTR4`KFB;I>w?v(C=1e)@f$d--jyPc9OSJZR)Z93JV2O6x^`dv?=QVr6ym z4pS>p8iq&cY;LBm+==(jZEnxGaW(YNQ553U@BNV1Zu;mwa+C@oh!odQv~iOk{M`>Z z?{#tXk^LBEZZN&NAsyv5+tAABpsu-{=H@DL%n_Cs7g+WNsO~$;!M;MSpZPVve&t>6 z%&rQ-Ef+_rmFc&>!%yCrq-%7)IA!y=o%M9PR{80F`zPL8FtF?BKAh{5Of7it9l4VZ zJg1_O!5zc2G}MSqY%p^+(UVHv$y!7S=lKz@JgW2Rc65J9J zG9NFZr!k+ExoILPYF*l6RTj1yF?PV(WonUWE4aJouB=211!o(tRDS%lV znB6BIrL(RO+*4eU{=`vIDbG=eGcW&w7vDU~xY&`ktcydVEzE!T8ZTa0qIsYjhhOaZ z)(x&+zQFru&f&3E(3~IP?GG;E-3YMc-XO27pPJ|_7jMsF61(2}*wZu{Zt~2Jf5G|j zWg!UCK5T4Y$|5|gO1*2@XU*>fJWHtxz+S^*OA&-!7F62TO7sQ z=mu_IoXV~djvqV7U~d-%rgfH9y_g*0IE)28%ejL zk93in3bM2;c@s|2(^5%ZeJ@83?iH>PV@gO{*yG03ewfjMdCpy5A*tyzMOJ<(I}V)W zptLWol{u`8-<0;iLv_yx2M_G0tJZ~Y)k8oWVS8>RBS(&jK6lbtTfoN3G(l4VJH#$0 zFT5drQWeLZI4*6jo7|2AJo(58`kG70Ev%s2nPOJ*;V7tL=l&xiqetvLiAVZUXJxZE zc1`q-h+{j@j&)<1HGi0mjTjBPM#=Y$F}C2B>?SE}9%87*#>|pOb5ycQ8rUJW=?}%} z9z8_0)yK{2*O*-OVadv;w!V$-z8;1~hG;0V<6rk^13iU}{Tw=YfRUZUbd?+U@SSr= z5_F3$j_e(wr=x`Rn-j#!+Sx0|v(j&=H%``^BKmu~iHp5tmvwOX-i%Um1}(k|gi-vV>9^Z0U_+1KS{>h=s95yc*qIg4G(Gydf1qwE+Opwhn1bkHfB z@KGK;d4&36JB8BUy5y;wUGr_bWqlLfD`+=ahlZVhBPiBSBY1n zU7?5Tn@KxbWH;ZVFjkni}W!_$Y7sD;vsLabJK%!PcaDGq@Rk2K^f zc-9vQm~*KqsiUE^L>hoqR)a!1G@Tfqm-VeVv=&J{Hf^> znrt;P5{+uoT9o++z9AlCy(Oa| zLdwfj`A|AgQ%6)C8l>*!R14GUO6*I$EtK%6ZLjF{A?V+A#HTcC^`*`6R|nU zX%f;?U6|nVo9}WZOoauENjdfLI+a)iG zq!cuB@W>u2^B`(3WaQ`(I?J5cO56D26GyOx*O(EKu)Yz+WOdTDb00(E6#HWa+6G2M zel@PLMoxa=>pZ!?kK8=5g(FAk5eK4mr;z8~DmGRZnOhXXDbJ+J$C@}C(ZjCeI}06mp`yF;jvyq@;ecY3`ObEj&lWlEA+rZ*EHMc=E~9gJC+*cG)V2+DR9f9GF5F+kLBW6u}P@6L zMouBWLcn`#vRPSki!+}d!LRQgVc%dI$)Jb4rX3vI)lGJGHa!PVGhFWy-OVw-;z8qq zqA%6fS)6rz`7i&Ju2K_je}tfS4Ua!aaKp>WinO1;ko0X;jP5^3N2QI8xQ*V?J@hx% zQ`bJi7r*{x`l_wi%Gx+_VjtDH4kDguuHFjL+S5UfE&VpYR6E2|#|NdakhmssqN_SN zyhofBgR~hNK60wNgtV7wBj;8}0mFwM;q-w%a_r(5N?+MrTSl=s7mpv?jZ>bj6}LCt zp2V&69QgvL2Fh?RiQ`$bmv1~hileBNCmugQu{`T)YLz3uf?eY5RhH(m>;LR z=EM#{#HGETx_OE77jH-(7|`C3S*&WBW{m0c7YG!z(pKS0Piv9(KUvbjH~!-5v^d1^ zU0xP_Mdg_lBJLJPH4wqK?q+#)jSbbdeNK=j(4v4uEX?x46tS#&sw=X!&LAwtvb4M= zjc7~?EzV$ZzH~q~@ouL%^VUTcX2y8)y<0?WxfIpyVR)!odno+sm3?^=2gRGUrnYys zIz9_fubv`Ohd=($|0{p{^Y;keGxGLZLT*qVq*2Y03<>cvNat&}U=xqFePAyqPaKd= zHOaN>(|98)ZsxuW)EriubcpVtJgCyyrjmZb(t;UHcJ1|AI(qtFv%QGgrVh&UZKNV$ zLIx+zoo&?R+ND8{Gjr_&e*UAM@atFKXI?s%<>~8OTS`#h&`e`xE!l|$Zrqwgy5HZb zoGOm=A=2U4$&r(=dzqOfA1Oy29X*}oS;9iX!bGI=?eFiT(k5iV5ass!Z}8(E{Fs;D zy1+^>Nq(^q|F&jKevgo;kVcRr;*5?>&0s0-;qYE*I3wycm~X*|nYIPv%w`HMgO z28Rb5aH=W9>b0jOn}K5os5LEf@!~v5c@CXsabVWft2ZGxs-xV5suTH>l*UiJ;xpT< zLKrHf;eCQHoZL-;HOYoJ1Ma!&T$u^bJn|@~ch=&Wyvd{|AOzYd4oW{?{Mw)KSAX^m zMmvi!lfWvS#o*{Z4j(?iV0RO_YTmTbLRnKkr=NV9-QAVM!)mnDEJUV)okySG@qO(i zSLRs_#j!Z7xYTrrZ+wG;jaH`aOyk$;IfX+yna98Qb^iJ<|6Iyljl-10-Z5XF*}B|0jl zL&(^n!v}>-v{T};6Y+XjSXyQyBJHOthY+fSC5z61E(|l5cy2S$xnc~)0& zHtyw5|KhLtfBw5aV`pQzlr=%pmdEhH$M}oC_;VgTJV>z+jHJ;@X;U9he)&)MlP^6g zopOmd4QdL4kg&Q|b`MvxHZjfOYEbK})woCfu6>Nw!^ICKwGq(ei3t{jM5wpB8YF*4 zR~b7xE4cc`OI(*>)YQQS*E-iOO$wRO6es10urR)ey}FZKLrpkK@^IObM0~<_)Z0x_uy(if z;@*YpeE)C%j%VMzD9)pDT;;ipuW{+hBzg5MqT?K`?iJL(o5k1)Gm1TlEfk6K5%(=H zKIZ{P6|J4=XFe2&VU=g8qqUA=yICBNCEk7I*Zks{Uvl==f;P`MX)$22XX6wH(7QOv ztXoZA6GtMpz&js|Q$I9FkyYHS2Xu-`2acjr$}4i1J@*#B{NXQo@1}>`3b7Sw?;7kI zy!-acJp1bxcvs4#-cb2hgs87=XpZ`tU!0lx5`>#6VfR73=8v&3J;%D(d_*{mCEFs{!nVJ)+l2 z?5PlbUswpA*krSuOZ{36eqR5{kNMfpe!*)ZJ0bO|9JKYRx4F4dL0?x5%Ja|8ucx*m zi)*hw%S&&($DMgMDPxiLmY_V}LQ))AUm}~1-cD*=(w9gZmTk+zk&rfIW=fnku^D-; zuvhTqfAg~Uwe^ffB0*z zEF>teFQYKq!2FFjc=l({^3(6UPN1lcs^Tmxh5*+tT)MQx$jqA1TlDP&dbqq*-S zfBn@H@~q~I&+Hdx!N-krZ*y^SP4p}+x>B9|jro_jaOOpR^4x3O@y5uNcCw|jAG?2& z_g)s=zkNZ<5g_KQV#lspCSHAsmtK64XTJS9_TfF$hZmTOCaJ33!C(Hx7pciFmAV$E zN!k>Hw9!s+$P*iDEC}xlL?uyqp3SZzb{!hP>YHbBGW`t?8@GA?Mnp(_2U)@=)U=P< z)?wO`H~985&++05FY^A)6_SB9&b|E#x8zwGyYME@zx)Q*rJYcH{O18_0xd8kZh^^gC+BHiez4}he;6(iF^Bush$KM&B>>%tV9Uu0+%k`z%9K%Dk_bikPdfrgPE(Z@$3s92nktYW_*df zmOi>WOL321VPaJ}g)M8}4wV}<8ldLuN%l+Hl1E>ZV|2B zL*k_G;LyH<>>u639wDyXLImv=HNR4HEOof~aiW6uHbKo#G}v+F=ZNF)6~ZkJz1WsE zhtTFC&t)Ot^@+l=C@PoqYN{zOF2HVcQdC+ayKVyq~eW?QkS5Qi*sTn-_B8`}K)!jcLp zUo{n_g=AaPANI+EsSRFea~-2m93_p64ENL8vx}!s9;Lr$2S-mFqNB>e_?tiEfBg^t zKmNb}>wo0`&)$2$N0MA;o?lg#2ddz`_a0~f?G4)ZboWe;pP?I)BIPKpB%XG8+B=E+ z6Sa5RU1?9+lR2%p5;^pK49Vem-`@Lf*oOB&70SD;s(UZ83PAVt7*aFja3=oUiOP(O zjEszUmGwpB%ZSs#QtaQ=jcoQC4LWh+`5)qc{?9MtvFA==&P$g^jR>x*?|ki_@y}oX z0Zw0M!54=mzZyIC?LqodKTe*$L?VnDUQ~v8&D(JIzHUq&dm1NuCrB7;CCa^XT)yo8 ztA@iU?AVE(bxl~aVIS_@vlX3dw_tO36+#o|@x!nD9sc|O`(?a78bV`R8?r+qc5 z=PTdG7_zW=@BMiAuFXidQ6t@Kg*_`D#W`tkjt$`2-~_@{r{SeV%q)4~@eJYRXP(8S z;YIWv`5Aul`W5K&>Tv%jK8c<+l|n4&Nm$QbJ%&-G8XN0!#W}@&j_!kepA+{xDpSpe znV(ujgzZL1BqwxcvYSkplqmh~hBd!oIyMnAP@`iD?%2HvwKdhq%e0DcM%%d;t9NX~Z8S83F!zh@`_MikdBdaCvk0RUbs2IJ%@qWCAt?b;+5}w4X^aOMJG@qw15j& zsZrA0fo!^e>Z$Q#(gm?ZjX)Fqw%Dj~#`VfC@!F{2TUOG=ipcv48$6Q3*3iXZ~H%Y=eKNV$m=HqCP~?()q|Xvdjp%ya)!Puvx8iKO}+6FEmpF+2;+3?`yC_gP5o5!m^{SmIX%-Fc|Anw|~4Y~9kjnh4{Yxf~E zX9jTk$PtV#_~^XcfQe%0(i!NAno(C^qxv@@lYSSKm>b>@-($5hqKHBR^0kW`r@}uV z2peYsY&4PKN4N)M0U1=N8TJh16qF&;5}+T6%a~mVl1Mg)!r(`(3boSt@gYCH<+rlK zi&ro-?8eOW5KbIFhNCaPgp>U<^yBr;di^B7JopFNoL+&4KKJkO*?Ts?N=AJ1dXj5uw!EbB8y|fuPfx4$Jv*k#CN~{I9@+D zfbi|!1SW+VU36k(z>T`CB;2~1(Y>JySqV1=2FH;w*r_$UfrP_mtf?u58E(u@jgoCm z;p&x3IC<*Ui8jhd8 zjzwyz8^w2lzfRhVNKq2D^OOBJeexor_B`Ze+n}dB=wXGKZhB@r-JEPx4pbHv3N_Kf zE*@dJbNcCK7o>7i>84b+@en?K=X!((&tQObUN(ulINgMYoEB`l^FC~8t3y*~H@aKu zkxf7L8F_`MYwpD6b?r#Q5(dZSsIIKY%+3{!k1QL>dGP{E8f^5PH)RY>m{BSM?6=dbpk91`Vw%>6lnlt8b`tm4T^P@QO z>=WXAPrrNuQzYUua&08?hH&=eS-gJiB3y9?$_nYn(H}rzO()i@S%dEGa_E+vaC)OK zkkHD^&O=cVU5CRY#7B%8e|8Eht!%)CZTrzt9K`vnLztf#!%1pje&<`?!&5IF#~6L5 zbSA41)g@F8dHIE+Bf}n^!wWz9E}nSyWt{69#gfN~$?*xe{0XE}x&;)sxTpr@r0Zv$ zPLNin`?5j}gfP_~{isqsrAGF!raP#f^2wHSk#04?=qN$YUH4;su^wY1qli*Nz)k`x zy?Q-9@yQ2}@9M*)F*h}g@?oRzm?a}0mF1Pxh{!@-NhwN8^AYYphJXE+Z{XE4moPj{ z;&pKrv!vK{^uwD|P)K>JK(WI{`S8FO3&FcMi3{g0V2Yn=jtt^z{}=+Q4wV~rV@;+D zr%n&TA7lHZ3!!|giWRjR*1$4*3D3NE0nV9zjLavn_Q2iP+|h`(&Q7#9RfE1x^t;uB zk9_7cxT|LkGRU?yg+W5gKZEmqPLxtZH8;(GU|<$77o)m)JvMFIi%ks$^sS}uuq_id z)rAYEU&pCoieFp;Lu8&Bk?BP94E`I0LoC*`h(t{`(2{9g6j7o6aosH+OU4-E^O;=MV`Yd`cGuxTXInEG^>ja8LNt+%hK}vj z@ZE&&+5*xKMp(^e1Qy2W9(oGX0RsxCfvma*F*UJ3b~uDHr%&R@i!bBU&>ZM410x;7 z0+t(7>_(<}h3e>D6-D30i%<*dQBNW+>{>t|o`tp@o3W{<2kROuV2V32HO9XkGq`s3 zGEN+R9fwa{#IzsOI5K1I#w8p%bsByX*+Z_KZqRfe56fee=-#px?NyoZ&AH+6$B~wqM~&lZY~9`ggL4KW zZfclPy%?j5IC63bLPbZe&;0pmyyB9N4!L^(8qlxu?)K6hr6Eb*Qba!QKb= zA$_)=?!k))8!FMct^lWx4rBf9E*Smu;#~m?!sw;nyUX;Ok)BmV_u?$nZ@m+DZLEfC zq#yH96EYlj7|EcyQRtfJMZd>}wx$Z$3@Rqa`VcGMfSpY(sG)O~ zHlVqRY%#;SBCvnW5ib#*zjTERUd8R_S>qAJ`OVCO`&PKlrNB(gX&EXQ`ocb1$(5_XyJuAANCZ+DY^jS}}3`0?u6-gFc;Z%nfy@D$m2x$Z5QC z_$=mpB+Sjg0*T#uH#pMgHJ1Z^E1Xsx3!Y{HL;dAGQ6hn8kAKI7DS3X<0m3C2)b*NTi_ zFP=Si1>rb_-;@`QM?#T)Kmt(%%IHhqP@ajo{!2J>X&9EG25jEmgSGS{ZCB@U`otLw zPfTHc(T~h368s%)XsIruALm7kQ>&bZ;`7dpVQkh-_MWm%dPXV;;-s~sg73MPi>1{b!Xf^P0rRYiz82XXx9QH;z6V9zN+Wo;wsMO|IRsdE=G zI5C4*IyH=1JJ3{~g^9DT}GyKPc855*86J z78b+EBmq>@)P&M(6=z=hF%Dmvgx*X7pr%T=0Ojdt@Z3+H#FcRm|Los%J|1c!?XFm(1zGdvSx7#JGD*!Vam zoIdEIE?hZt5#x(M^VZ$iwRHp98!NGN%F1Fm(rm~qC_{C10m9QxnCN>}QIbJg!iM6SdQ=tL=zBrmiQ4tp zzkMCDVqqXN2bort#Mo5~jE`Y*dKOE8F#NMOaJg>=ndL3$*|ihvS}GBp?WG0?i6y!} zG_LKzjxFm@keI`f*N@}IEQu^*1{#|i5Ewd)(|xn_UFC0%Rwhxs1r6QnkwXIOeE&2F zvM^?+C!yrjql?Nvj~|zh4q|dK00Rl&;-YK>sj)RRyNC$i5JWNw_yStGYoqd06)FM82885zaPK>0&5%>v%cPWad?b~3R zxrV859(LY+7wV}I3lh`WW)(wJ*K>;zH&NweHyU=`i5;z_h>+T3fgW-3s40^Oo5{vn8>xX2 z!RYmC;=0EdLny4OM@60iv*RNe>>I*@FNomM92UJ1_(%ZG`y%kqjKXay$M&90$Tr4c zrUq4^$%iW>bS;@#2+j0jXqxIFJqzifSzP9!2VqBZTRk#pZRpZet+)}}c5bJ} zK_%3ML7XB%J25>?=hUIPZ4EkFThLOLLErUpEQP5tU`gP{z!1FD=wjE6)c1x(b| zuCxmqN&`55VF>P6I+{Bgs3GLVjs5|Q3=g4qU;;{R8U1!p+6|Sks2=)msA$=?8$BDk z(ArRn`QD>=<=AzEU_eH?86%gD;pD{|$ZFVxqWCcSCcW^IO<613u(q`Z8Hx|ruHAq; zK#iTYF422Eb?pp^<6f9co3O6C85MMI%u%QD%=53)Zv@|Cv^)nFT*&U;herJnE)Gq@ zUQi1E$XT2?GKt*UG@L(j98P^Pb{{%`DhD;v%xOs1hcPkdqy)%@7WswP5UkV)_RWt| zeUCwxTY)aJ0pHvtCP#0exA!_V7^aZj-br@bjw0g(9{ct)81=Yd&Mbu`*oT*&yo&UO zJdB(>jqzXxb{x73o2cxvO(9%9bqs@(Dyr)0P>`KQ4W~TRP}!O3zA-)TLWEz$h=kzL zmiPTx(;;OfW%-MbUi@TCT6*Cwo?-#mR_n(V|QMEI{W z{1Tz=i(mX=;?YOH1`oA-MQee~Q_oFG5*PgFkz1nNv&QS(k`T8fzHsi<&_2XXnjhzI z!;pKW#cwX{;73QP$ElL{AEH%HHTq`b{H{Q)T?6+_axbq|r{a;8IG(kQ=5C?&5>Sf# zxb7WPJKGb#%(!{qz1Y@SjD@iQTt0IWXRnSSMy+igUP-udaANddjKe9;LFXhv#WqLA zC*rNx8U0XE82j8mv{_H;i*%I z7yXjLk_X4v#!tRAAB+we`4#Bdu?4~5lQ?pI2q7`%4?hmnULF!I2YiimBEF&U(}9%~ zD2&qO?^jCvi@bfy>Wk<1+Y4El1BV#RGe9tLNdr^?enTH(` zi6)Qd^|yiZB!-&O3Q0U_RiC_ljmK&KTtHyoj|0TEF-=K4%5m_gi~BDOSXv=Tn0R{#zVjP+b~^x4BvY33N^Sm z9%qGrmpE}shwPb;lHhh>?h#Wx2Di+kVwjs?qgzMuj=y@#omM)^{;?=kJ=>q+KMvjGn0d~jSXZ~Wcnl=#}YV}Y|F>ViI3?$KhUE;=7W(NAUSm`MNEXuDP%t?S% zymTC6vjO^E^7U!wVR$pAt^>8E1)RG!fw+P0i4@57%tOs_+6k&xexY~8HrVb`>2SRz zZJq0ejuY3yE+Lc-SB;i`h_UJUYr<)=pS<{9i+dD**ZF*WEm}QmWzUzX{l;)QqRjXh zaW2}Iv?Gxx&a*9#8nR{70O`fFH-I?1TPD9lH`OhXvdNX-reANq@P#j=1oWeDxm?MD zdWz_usy7@iBz4hK0a0d zB8a!ep0|g-tFW+db5TAlx`=o&YQgChqJh8ETH49DsdI|-wQwyD$vB*t(So}5`*CPz z6Bf?ChNoXRg*m!$yqztIwCOXIE?-D0j0095zuZ8eAlmcBd@RGGon)hZ^BvgIoQb|u zFXGtw0eHDXN~EpDUtMAOZ>gAr`@JmXF)O$Me5r5^s#3+(+l*Q0-h=*iF}>1!(K5Nab&J z+?(=DscOTk(Kd%CLznX*!Z>~^c;(tPw0*axeQVxC_$|k3dEj{3HmO1JR{zHyx(5xm zMLhZK@8bMaU`3oJ)6tGuIWBd++rdBFbRo&}((zm`d@OCPF`3^H=Fh zLMyXd(`G~%$4P#s!c)iGF3;NelJ$^0MoU}EgSIU;1zLP9&T<}zm9#0{Rdu~O&aLn< z+Bn>lR_c7oV^YWQ_O0i_sEfNrELmS$@oAZ}~_pQ#u>TT^)OHZUh+c()3!JEld5kHki zYFi6iRo6r+d>PuwnvZ?=MJR7Cr?FCQ%yL>3c)Rb#uNyZB=%uBln+rxF`6a<$tW@h- z>j}~9P<)|9D1T{1fcOFmJAG4A<(ZRgu$XlS2LlL;xAA|4c1`CNv+@}YqzOX8C!Fp# z5{cyPP>e{kS)q?b5D0|8{nZl5`x<^Cz`eeD?Fojw*MD$f0sY3Nkwo$iU~$WjdHAu@ zzvUjm>F5nsWas7~Cp!aHe))$})G4s0Igp)|1-s2GdY<^@6tmR=qcQcE^>*+Z>|SaR zdJy_mi)V(ePZi@4d&Ib;;z_ndB6)k%2)ynkxOp7tWROJizD7s)`zVi>FU9kR0i~y> z=SvqZTtFzK&CxHBye%XOxmPtOFAwQvJ)%6_=`V1z;76#&^iuTP{SY3ya|>#Ua}aV( zW6rCfx_v9|zVA+KU)zXueF!tNF4#-f;G>V+ixNW!laq4@$Jl4>Ha1IP9R7Z>=Tu(A zk_?kbByYp2?~O$A>w;#p$qmT|mX(guO3ik_I7yeMmb%w)JFQoE|8JVR`Xew6m?4$pLfBp88xHRITwDV9|kq_7P*YW6= zzk;WaT!uRkMbI;cD;F+eXmVb>Vb5}u(^-D0;cZwxw^-NmCXP$yFO^?yzvkPe?M_~Y zL?V$$BoYZBd!Qw6iC(dyx@|M=`{+k-N6$u-W$F>7u#T+S;Qv0?4*`|*(n@583nGN@iR)bt8$-?;@Pb`^0R7k6h5iu4iq zLO^TJLEL};Jz~0Uc$}DVdY2mt5{X12kw`wAa1XQ;(2_SNk$^S30G%5*BF%Xnk3ar1 zT)8oh#YGpKF1L7DV&eJheP5Waq$hqr9@T4hU~6**jy(4i zCe>^-Ru^E7(v8^i(b~QSO*K_8M;6fAKa8xpZnPB}aN@O>Fs0_AwXP8JV-s+Pv@u;J z5{X12k$gCj0$TExB*+}t@xq!@h=!&XH0Ik8^m$37dc_QDrG>eOx~6btXdF&&5C)qA zja4=9^q;`9N6uo7#O%W2946-c$gOS1&Rttj)6j_09N@;OQ+WCC2~7C($iO_F{>Jxk zxOW6I(~}sRm_j5T#ORsBc>0B77|cirfoV5;4RMo3)aG#tr+hb7KwivI|jFTZaNWFm?R`1}5AnYUn^+fr9f# zUdQDL74>VkV*Q#LlopqvvW6!aFk!au8YWyp&Fw=Xkw_#G$%hi@11)(=gpYB+iwiG5 zh3|a(C%Eddp>_Kfv{YvcVH#6-VDuOejgZpTLzhqx;ko+5ekAlUOpRQ`xhoUMuU?P6 zn`&_5=~atcdPUX~9lkF`n1MuJ|O0WdoDU_#i-f^IQONv^7BO>_LV{bz;#a3f z!jwkGS;WjrdY8n{~k#AvH__+h()CNP>J~ zbQp8fGw>|BusH9+3~f&=1(DFl5s!E=H@661AVL|B!S9~IP+u=@jL(B4KLQ>nW}O~7 zho0gF;C3&;;|(CNIE{h+>lmDzz@n4R?Q&sqd;-&pB=mVS4mAw#k`r@uY?O!26Qv`O zNF)-8lFh`)Y!qDr26m~48!4`WNIZgs zLJ??RJQ0IFp@&MxacVkBQy~#+&>LW&kXW4dk$6rh6dsE~r^du+7YW4#Ba3P}J`!c2 z9;Fl#B<2lJ3?|VX9F3`nQoeXfRFgqRX(}Q;9*mBs%;ju~`TY4}IE=3+*^A8fE(E){ zK%ICT6Ho9FbbYkJZYnIG85Z5CsbwV+i9{lie0Y&F5lY?xJa4@s+$@YFPR%TONnMJ@ z7KQOXh1N;Ck~}5h$}0vEo(dny|AZW+4I{;)bSOYf)h!kl$&?0rb0kO{lX#{?D1w3h z^EoL+b_1cfLcmgdg~AnsSu8po#Unwl7)gxNr-9>$Gcr6axR&o!hzO%=U_s4`UR(zY zV@{j%qwUv(GOttG%W+pykw_#GiA3_@=4}NuPa>g4qfklQBs=bYKDd{VU-}A#5mmW& zPx9-8Lb{Rrjk%jyMqC~29APQoL?GLwcc%Zk02uxy~kuXypQcqM+^6En_0+G8sUfvUpR({%91@s zXI91Zsoqc=-Ux*VL#5-@C?Zky7qeT5L?V$$B$78F=>vTpKCf4dfFNd(qaC7mj#dn2 z2de68kYh6-7ziZA$vcEZklvbs)^*#(Bp1e*7xPO&A*|jpEZ|89shk#xF;ZEyO`=L! z>1&j{cW}=uyHmtSK$A(3kmfo5N#L@GrhkS+O!y|V3kSuZ+F_RtttS^GfO(<4noUt% z8YzZeFC00@mRN*GMNhVldx1HWJ`*Ik`2aqH5ZLq&EYc0xD5z{g_r@kPlv;p@8%w?@ zrJs$~&P~|5em#ma4DfoK2t*7ht!+SUaRz)YH;H-{^x~2v5{X12kw|`FlEc{PptIy- z$9LY5`<`;oG>L8w z5XdBzi4r4z%rj824_j6+M&!7GbG0xObAa6D+n;KB~!c#4QEbcJLuQ zuzL+GbpEugX6!kz6-71{c3LlEG)fXHDg3o5qG_ALwfwL@t=J>Z$Gz$Abn531Hd^^| zJ-roLRj}_cl{1$$#plM1F(ViCU0YFAQ9;6(%b&}cL^1b3N20Xw&~tIo;9@~s+O`F2 z*RCT0O?4iNiV-?Qos0B=C}ktMyv^xFL|ySy3$DL}&Vs!14(!;s0X3D`NV8aBV&P5V zxutVA?%3UqoGcS;R(2KPW31@dc`rV4{|@Atl6EW7)*56{veOv*IE&ER!}geZ`jWCC zwkJN0iL-sBY>D=3w#f0{x=bY!i9{li{CcDG^lbmq#ld-O*|Q$8i^p+pGK}Vpn^2w> z!uXUM8F|@=xo6PV*N<73j|34{dt*8irI!Iq zdNFoCa0nZ#3o+As2|jBZ?z*cHQ|HcLHe^6iRU;}(a$z;7@VY}V+OtrYn}f{U0;HRb zBL7MxMETPrGq0G=SDZXwh{Vr_w^vf9P<`d*!EV+e6yi}UZeI{A92K(#IRz!CC@qA8 zhlJBp{g>2W*VavFEU=QGCNWA&AgDs&skqC_P*z-qYzNgP30AYC5bHMYz=1Vo2n75v znhl7A!eS=D%uEOD*|{j9dIHru=fz?%Bfqd5CHZ-v5>>LXX6FVxU1d~T;kKl>OK^8B?oM&H;%+Uj#e#cqC{hSgw8h=EK(ONO6nA%* z$Gz=+|Fc$-b3WNKd-lwa*zbL}0cWVAu`$#N=0Y7!u(L%d?K%}}eRUeB;<7q0?Y%)Y zQ3?t|2$p`R>+F0*j?KO;mT`_F!;)TJ%}sIE>=9sdNq=!xX751^9!!$vu;0pj)EgKS zmQ^`Ld3dM-9KCpZ}i z;44gh870hPeJC39kh_7;8w5D{gm79c^S}IvTUr;#7e1o2v%&g&#`mZ!4fQmGUN7?y zcC+RJbg^?r*XE4YRvro$q>@7?HgGy z)?o|H)#a7965gCKQ_Y$mEqmg(2&Ru48pRYjA=RohI!oVG4Umw1hotC*#J{e0bngVS zvlbS?`_2kYeF2Ozi zq!@h}%~0mhJ*zCTcXaYW(uS9cNlk4j`1{gqZX}UI+CrGz&__Ac-F%-Zx}*8|z^7p) zz{t<4y(j0#pvC$n7t>p9&G{#OclWQ86zBGAoqaGE8^6l!)G|{erGCez!Qtm|IO0?o zibU_)+fp1Y*OJ=_EsehsNDG3th!0BhRlArCyz}g*9A>AoqEUDm_>$Bp*2~_QkDd{FbSz*iO~~eCcyfA0X2LJqH>+^9DCRIfyfzWj^7N{GC;Rb@H*cCf_ACI$xlajvDg?@>fvR0>$Y0@)?UE8`;iPlfD#5>RV6TY1 z`Yi6V;2%dGNJKE0zRm9rV__@9cT8QjiU|o`t~jzP17h$Aqsf zNa)uEcQ3kmc%V#{^?f^of>OL50DW$5grd4ppIW3pypFsu15MCh5a0& zp>}T+{AuzpAoYLtN-A#SxkV=P(TTOqr$FrZbQ1fc{V84d)C}-(6m|KLxFeqJX*8sW zc@UF|W-CjI9Er1%J_fE41203mO|-x(hAtP)MI_iLTEn)RhSoAg{yJs=V?HH~f zNN^GcH$3vVZj>4FzAS`R1b?B|{Y`y9O#V7Ask@{GT?+^g>eqb4gt+6z^1IyM9rC+> zGa_4I$RZ?j>Hg$KF-Oq-bjQBqi)8zO5wUo29{vY=X{gRd}ShP z_3n6VGYR8F%2-=)njeGD3f4d!T==XawLf1)P*2Ux9*HtnvDvqWBz)6z>+B~ANr%Em_p&9#3n?1m(^y1e z5)yT~!1>2Burs4rb9BP(BN=GJ>Fe9&u*M~fBSx7Ghqh2rQW*cpyB>!SWIe8=p1(dl zzXkP_5T$(8l?MxeKVvD^6!87i5AXKVv|^~1imraM3H2lTD_ z-4_y|_au7FBkM^(iy z#2enacD-Bgc!GI3d1Qka{t072gPX3RT$j%?kXH;>UYA#e;z~2-&JCeAFA%JyD8PV_ zo>BfWj)J#Ez0SU4%}85UYb8OKe%K=?CX!@iCyR&>ClSpC!X zfWh8FT`K&*PLX##K9u~LtVGrJx4ij;;#h%^an@dNSYJi?e5)N-$rsWe$L-UI8IbXx zNp~xAuW$jEt1l=ok7E8PR&;*99rZ(Q0HmzHL_?qA(5x#PD38eck9ru;UymN|mOAe3 zo>DvR*zQ)|r>;lWKHC)j0~%f8uIo*_F`%34`346OK?A$o(X6gow(l}jm1wuZXHX60 zc9KT!v|mQdVwCSE>fY$X|FDItlVLHxY0x{|0Imsc_5yD7ybX;Omk%mEvT>V_Y*``A zIWX~0E2ri<2Dl1?@71z$C0EY~G<_&%%U1*A9`rvEQh|v`J3G&~+bChuh0-yzPP)?+ zVa^V@)K+y-SJ$AtpGsPPCc5rLZgqgCtOvFS&Hx?&UC3^DU;xjt)v>QUF~adxDG}PrHl|8ZGQ( zaVHBv=Y#w2oe}aQ?yeaQ7NcR7S|`+#K?}`rcg%W4Ox&h9w?x8S5#YeEPwX|98P#Tf z2qmSp#r}Bg-WI6TweNIYk<~xNnVNlpjb3NZQ^Vx?oYz!FV3UOuqpI9Ru3 z0E@uup3~L_aF_NN9*Z#pnj?eSypLA=5E{xHWI%w<=_9HQkfEEyYUFh}obw7n-!z2E zH+lCd9o>GV0nLDsO_~>%s|EUKxtXvaG9UO9Hl-FVRFyvvlu&BLfj!y{^7D+yz2fCg zHMenu)))=E3QGAea);>~)Lb!nECAwUJ90%QVEV4m-buXq^zr^EEbRU*;^!7fbkn^V z-D$0e@8Wf|>O77zmq?zH$#b{->LCW7{gBPiK_WSRNTvP*@~MWBT1XPrq;K=(V45P+ zQ4A18h#qbfLrH=jj+sk~iP&X48|#Bn(R~$$?{f9TF0qz7pcE0#pb`^m(n4x!geuxW z?xI2Td4_7<@(>60y9|BbhC~Tt1{058kL1ddNN{xmUG^N;h!6UO)xCxWX?y2q1 zFtLwT^>d*}RN^cN=vQlQdP^G8704}%$81?5UGpw`EM6{I)|VHOxE|Q6AR)9RNt65` zeMH>dF_aZcy7Lq?L|y>&-qY$l`VC_F6Aa{*f(yYN1iHQm}Rgz}F!tN(#h?k*OJP1&@;l=D*<1OBNU>hed z$gB~RYzKo3i)i+01KEWLY|r^A{i z!=ziyKR#biDC8}edz0PA#YWm6N>8zIiR$shoT*{4s_lUw|1(!4YuDB09(z9uQ-52P zMeay(TgaW1+~cGBo%ZLhTBsT)FT=uSY6fO?>D-T{QBro`{*waum>?paoW5wtl(R-R zlR_+x^t$^^(hia)FhwFtb-%jrlP9q;^Ofw+huE`xD20!5d!dmBs;cfo-G>QnpBqV# z)#v*oMh9Z4CM(&;t1V%MR$(>2O%@8D3G$?c8d>YeI{VQ(gaR-frS#93gmNfE&E55W z9EGhjcDNt;jAc-XICKOyCb>vQ%#YbbxBt7+K2!zL4J3w2BR`^D7QHL=zt=D;?Y?&v z$n1q?EUof{T74aybMey0NLt_F*7Yrm%SQdNsSUwGvGCXuH1@tg0B-bJfEA*wuy`1= z>aR1V#^bE2YnY6TRsE1D^N%-G<2p!gCDBv6m%hQFNU(B+;m3`=>hiz&&BC&T6J8_B zYiFfrkZY+)O5=zjIjYYxwHEYM; zny92gf0{>LPxA)QZLau={-tfmxl`cWN*a|75`#_&0DL9nQ=8alXG@USSX3pmIbYPwRi#A``aEd>sVf0!fh zKhca{(@WJ`{(wR7>W-eD}EWKH*BV(`}l(g z1uI*h-Nuvnr#@*S1FSe;Y-f-A`%jPij_UoHt4%779(;7x$t*oK-om7R6ocKr^5Rf0 zM8U~$Y}G$b++ljs^NJ-`lf^LaKAqR0qN|MzuFG0}_*&zkf>axt)O zs0A^GZcZIAq$AgP%rIDhS(=X)!Vcb@;eld-6k0C92jKDo^FPMRUj3|qYL2D>_`5Rr zbIqV^U~|kT1qgGG7h}&#AT4jHQMxH15lcv_XS-*7_fTCYICP4v zv-V5Di_D~!#iHh#sEzNDZa5k~@8-Ktp)WUEz}O-mN9-RLIjzP#FY)D;7DH>%dQ~xC zF*Cz`P0$E&N5C+hOBu0d<@76GH}~-`J7Peu6I>iJshgwa-fn%q8eygQjh#(!Y`rp% zym`k%A~X?=bPBkdwRdw|kmj}T(OuOt{0=VcBQ!CBzPZp|cIkhUb1cAyQ^rUu2q{4P z+)uevF;wX^C)(cm+#dC%xA?-Q8X_`z>9)F%MmZ#_Hb#NaM6B5wx&;K#j69GU{vqJTv#Vsmj>Ybd1lG%kY*e%37k~LxfOp)ftPO~m$3AOtI z|5Aibi~H?NHIaY_+m-lrHXaAXi+sTcaLsYxyXNG# z6Y5^%{P4lQaV(ZLHOtya?ux>sv)sY@j1hv7HfUyIS=)~DNY+MvjYmIfLh|dGf1HLU z_J*0;@lUvNZ1Y*nm6@gEJI8o@cJSBlNnsJ5L@?dh1lcZBI2u)syQJ2`&WAiBEFh6-dTjPu-|wbR{c+G{2_m=L-r^A{x3WSw3Nh0xZNCyu zsT&x;MGK(0A2x2jv@cDlF9nwD@Z#X5<*1f+c1hlvuJ#E|RM{RIhcJJ~pTb6oNOPbG zY#q-e?oS(fMwHbAM-#c6owTYIXGpHba&R2qCeq8@8#ur$dzR(YxRXXcc;98ZR_*BI zS9F4^2c$pExaAhM0=z9)d7VrU{%n0-b|$R49B*gfVKxsuYO*^P>=cQs7QncJ)BSfV zk~n4!3U&SJ_ukuZ>5-u9k)zP$cFSwy$HpT&6>y{#p9}>FBgn@vpw6Oh=`ka=7H}L# zK{8X~m9M?{uP-)%2fcGHN5ec#&>ZK`;5@-|$ZbbB`RkD$Nh^Cq;9Clt2W)DkVOO0{ z9hEV_Wf=W?=aiTqva0{7mePJrLMk3){MwZuog&v`8`W6o3+kLKzWh=z2OsbqJ?l+3 z_J%s~o^yM!JwUlPl2Z6K-|GD0vY-8kBe$g(GqRI}HQNhG%!xh%kmCtH7 z%Gmd=wQse+#5lkG;m?M?&v3qv?^k<oR+Coqcj$6*ppU~PyV3i*q2G}G$U2!?DgjN3Cu^2={(CO{!VI9?@P_^CfXz`@@ zNkSHECAC#p?Gp$y1zgav6&+E@o(ahUwxP}Sz5&;gvL#ey1!6$yrO3sZ0k zey9M*=w#eO-;DW_yCFG}e<+c}8Ep z-47qv{-*lb@y8wB+454gHTZyw?tnKz4KownbacCKW756tVbT?hGGFEYXk2z`E6Kq# zNaDhUY93)s z;1*WJ=%9OfTG$a4W8-QdiQj7nx-V1xhY%-L8hKxuYau(CM@~&=kh3#D(h=@(_EcKO zPsH|plo^jL=ZrOX0+i*wP(JTf+ zUkN?T=H)jclLtRCfJ*vU>-eS<<>d35=(fITm^9-f<`8m&?`O*l7fpyQF)Yym zR7GbY#(2%_**ko&kjCO1v0Uc`jA#5NE1HnZ)2Ah_o=5(T$E=%9(z#cJ{SHve9C6M5 zQIbI!Q7c+K?Arwe{D_9VoGz!-pMrfYT?W#8Ml@;MnIZ;8DPwUC+d&1>MmqKm_9&n> z4{!NG;LZUu&ZojR^I?6I>djxOoALgq*t!N;7=AsG`;l0~!^8QNr-G5YN&M~)(0$ar zbteLW^>D_*m&bFaMXNC(OH7#b=VF|k@y!cJnWBF1g>i4{2jVHjzWJ4ZVvzB1-yAmM zpl_je4vHdCHL-hQ*CfUQ?xZLviV^8t6Y~?1qdVSPUz6x;JaegrUt=)nYwvWWWySr}aMolnHU6_Z(Qs2xj zCE^S>vZvpHo5AOvTP{o-ojSJB%M}ulXo?|ZB=>11ueBYE)`mhzKah}%ku9h5DTq^5)$LS}w;i0)b&+fO0ykJ9sdwjV6kgjHu z2)DZoYnd8s{t@?ockMiaw-=Ms++^aJ&W@-BhY0WUZUR!1RiYRVVNSEsvatEPRuh`; zo+w`b%7*xOJlTnJCmaCPvu0+~yZXbE5304nQ{g6EGg$Ei@J{!JB&u7g_GOt#jn$ z%JZ=J1Q_L{&yW=tT0u|~*W(yNZ?JBG%@mWI5*8P8hUtt`l;5XmD4UH$J%iCZb6&*N{-+wJLsUjqEWePpirTJX>jVF*CmlvRtp?@uU=2wp7TJ)%=e3 z(#r_rf5|JVdx~o296cOnwgGmTDP;Nkgk=|vWlht>B@lhs@0z!`YQYK>^6slnB;nf) zj+o(uPW>50usQ8Z`4V6FR8|H=nl+=ucChh#p;FO*~iRW+;_+)k32l zmW$1hDP}G9#k;2s@($R+SAH~J&8(WxF>Lzt!S+paqBDa76XwhWn$m6^*P$Kd^N+3C z3Oxl$5uxt-^BzWa4EfP39Vv zTG%C~tEPXt{$I)CNmx!i1_q_iUeC9CvfUgl2k(>!e|+x(C`Zz*wLL#yeT4D780Xyr z<5HTgFh&AVAL zX-*mW6t!dy&9+-6Z`!-)fUa6!BkD7U2hq!a)eD-mvr{4A4GkH*|FQ8O;`xo%d1AuM zcQzz)TOW-V4ZTrV5RfGe`M{ptRgMo>_Nq69m zb`n#^Qf&*jl>0bct6SST!Ab!wt@nMBg|jdVD@$F7Pafepq=X;TnD}TjaYJ_~k;#rL z{bXc$y>lQ!)p2C^MWg6{+*Nl;aa+H-L3Zq6ydOe5X)C&gI<+8ExwAK5Z^e`R##7tW z#TK?(10~|C+$e)}7fkj8_euLDRD;_r1-m=iC=f2}nfK)FCTzc52^qN-03Wr-^BW95*#lAgt9C7vYv5ERcHg#;F(OdmM+cSj(1D47{nY6 zbLe^9$$iH8>%KdCtv+d&gL6}wze2KqC4Oz~hS&bjtNL6ccW{{_kuEV1(42;w{X5;op^i zI|~XUCcu-WC3`wvg%p_Qq#lS3O7JzmYNy0?)uBn$fM&HkcvL{?^J zONz<&v$jFnyY!IddcW?3_g54fxrJ{vqq#z3xYwbgj)~&UF2oxK^cF3vCTx3J9&>gX zMpJAdg%9&V#GQ6rh`YFB|8*T75b}CHwhGyfq;T^lwryETIBAKfeA?_VXYxbyaIy{M z$o&XeRJ178*vGjk<+a$_O1dk2y=IB&sU4p%hVkPDW!8Mb+1}1;D|jb8%Pz4mz@QSn zu~@G+Uplur`gkJaX@pfqM^RXT(%Qo0a^An%!`1#K$Ed|sjy-g-*1f@pmSe zeNfh&(~c{PvETYM#Y2GRytPHe_a56rmbc_Uacy5L=FKY_`ezO4$Y(Ehf5bW+D!ec| z7c!N~SM7y|hKRf3EK6h6gd>hwxq%%6Iig^Xx|`+;r?Bbj#a#sj-@CzCWReCZ?F)_n zo;{IUf9M%=bn;`tlpeiWu)f9|^}LUic2u-+)xTVw3;5PGvhP`h>+%V`$v{e#;Q>2> z#$L~epog~^`7H?*8}wn}wp2MjBwC0_&IFh+*5IU%p8TF+mhW4attN-71wj%S=|z;? zgl1OUd9GQL@H@eX$%u0X6v0nB?q4HT!YGSJAi09al%3U#=nq7ker4j z*eY&R%q-ndH!sDvQY`JJf@@7YsaTD*x6CGhx^4ICDEwYGOb@Ipok}0#%b2lILAW}> z7*xVIhBWMvRvph;PiMW+hzU%7?*|xdzfzSoSvZ41J0KTD0+ypb>W!(685bv&O%??K zTsA_Te~;oBQWK~`0kY-~4V{V08~nKUTnm2N5O}dvgNii4&QiD>R;;AGb1(Pg=WJp? zq%^zJEy2@~p$y<7Qe1oSgOmfw!F zA*n&&pu~IjuxcA}1;N=I-ssSWJCevXq+zMaiSe(I3on~@3##!Jag&&pVw3k0$yQqL zQVM)rZl2KY+RXMy39I%rX|7~G%}-&XO}L+{*$9#WMxw5++`zHPQ2UKQW(Av`9M}1T z&#~Q`dA=7%q59Rn?74@t?=81dwR8CSU%`v2l2n#4x)1qAPrz7gxniVyCR2uxh< z{9bqbmg<2HJ~w9lDegtABjEx&-NO=yxZe%NYja_EW~6^N5OaJvCy_~2ny(AsJ3y`- zAD;+o;TH3MI8p9ziTGN_<54y8x5B9p10heam0`dNux zqTYn)c4ve;EcP!_Zn{XRU5`5aOZ&aBfB!;kDJozgHn7q z>tqvRwZ{ySv2uQ@PaPN94qGsnPX80!{Nl>L%7>oq^A3AT1Duu?Iz<|66*?7W{>8F!F10_|w z3nY5;8Ug~=rAS5x%rb?&aU{7E&wz%yx`u&ClY#*kG_1F=lnKTWB{ir(OL}(aW8}Cj z!FYkxR~VKoI5)pYAS{X|-t#jbdk4-qo!H;LK2<^+Epv{$$*QN(rW%O{(c|boP%D`GtCiUO%loT`Bfg4MwE`%jz6*3Cikvw)7gO&zp?F{y^}#; zaM-Jj4Z{)FcO@Mlh8lOTwY0bwT1%t7XHBd z65d8Jxsw<~NSCTI$DE?Go8qu*Z+?=^bOhiG$v8 z2IyNxRw|g0NS?%WiA_fDFXZM=o?NSwCaSC81F!ua4w?`PvZy5O9WTr1sZN0}tfVP) zHy%X@*O)(st@PJ=30Z;R!`{1hzDBMU3}fp`*)b^ZW^hp zGONstGsks22=*B!?~Rp8?%zrE#0R;CpZCOPLGBX>rTBH19@u;049XFz4s1oea#Ph_nl(|96T2#F8spAMNO z(Np4MaiT8o;&|O-{#~uuBbV<>qgdR@BFVbv@RV!6Cax_v^0(PA436i>UQLd+?Yhe9+5f(J zDeuaD_59~bG3L#&en?QZADWoROnl@yqteJ|w{|`Jt=JR$&8=I0g9}T`0q0s~x}>oN z#))7R?u^zq-BvGB`^!ymWb&Ftwhv~@dOiW-&c?WvSoF>rLjfA;-RA41YE}IJ=m}J> zYw#^{-OkThR^DxhY}W+oNwX_mFI-miHGH0`|F8DpZM3fcjNN0yPs|PkL)gcFm%=>n zc2;}0Ve-T%>e27L^~Pfkd!uIiBCXyXU=yI}eKnZ@IT)0wqa{jcli3HsV4o%=_DBwj<$Tmt{TZic(37wVZV%W+NRa}e$ z+*n%ejx1(ZLK55A^)pXDy^mz%tBb!~9_Co&L!KZ*ZvAlrv+ZsQ?asl`2!w zkpUiI@>s75zuweBqbq7Yj~n1ZO0wNs-&0Y!EH6LM`{vtx0X`{>eNAOkK= zU#St0JP+GbX3?jB>n}F0r{$R#srkJF>m+|w@ci$5=qO+i5fL#F40vFm>n~JmJ*Hf) zbwXK8M_DKQ1$sHBsBt~k%_Ql*%2QRUN{j%mU(8qEpTIO(oT5()WC9RXbN7kAB@^ zmc*hoIorTuRm5+-WXMPT*?Q3|%iv*mTK27r@Kg*g4ZAFFA8%8=QThvRy*g@bnNDS^ z>*`=@N6<4CBBTu8iV7*36sR#Jf?cz{lyD)%aWNSCeO|ClHW7L!c?5;ZqAW*xf@Q4) zemn(EOw{`6g#r4yr>K6=TlgItfg2+tyssJ~vaABOQL<^=2W=_KK+S?ma3b zRsX_YytH(yFQc=yesOwswJ1g-yEt|!N$}-(^nZWI-%9!eeO>?IdqvJCQf&NM+!by? z(qdYkrqIZ9LSV>ZS=cGg3FY^iY(J#E(R z8H*cYZPEE(a4(X=HIFZ`5wXI*wvYW?eg1!R@x}#v5ldM}(ZgYGxQUfOo}voy(G(Wm zwCH|UX59Eyx(c9vi*YNQ&6P1ftbpr)R{^q<;`UzBts7_WokTnm;VKxOX2LIRaVA*I zuDI<;1#T!T>3%;1zL?brejVS(q83MMCliF}xAY_x!I2JvI1ib%K=Lfi$5gO zkL9{^Eu>83pnWddchX+e95VkOI(m*J2-}48Ml-DXioI;zibc8`*^O%(gyy)CU|*8; zOoR9I;$-CCC3H^Ino6u{&3(I|P4_QH*aYm0foyFEY=BMz& z$J{25{Ce~`;fYQer#*Oh&~o|yO!j=d8^iQln@vEgu4k$sx3kfoJ5d)RgX=nI1F)Ar^) zpu%q)q^l({cH6LnWmrn)-A<{9)0(nGhMf>*)l&K{a!RQ zYvH{ZMu2-ttN`8!OWEOYbBCf7L)uO&1#X;^uPyfo+tbz;RaQzKwm8}!o&<`J1&i5A zYWSfIBe4l{pfD{Rn)1=DdHSf$Ob0pK`XVFD@pW!w^^RXr?YmO*#C&9>)Q3@^*H_5I z)?59%G*<#5irbP7L(yeQVeaqme-FBK7QK0|On_i+$)p@)P$~U*XUh+z$d2FJ9?2M+ zBd4+&NzA5)H2KUC>0)#Iz~wVDa^>ig1*wm_Vw{-hAV_P~_dhYdQ_54~SQxKyB%Yo5 zWDc}PmZnLcYnaP#DnRq`nT6mO_tbZ(H}xWtr&lGm`Os`=BBa>YIjzK@m49Y;Q9aAZ zDdCW^P*+=m4`LVNp%}=hqG+rk3@7`Aa9A2;R;#ty3Hqa}F%x*eV#H9+{UJ34baCQP z*8$)B`IGD;FSWx7Co414yxSV)B2x`!^!tcvRi4MEDj`I+f0x0jYYJSQ3P*lkJ3{vT zk=6N`QLEZ_D;dLB)3#e0W8jI6a6k)r2@k2BHZ`8CY!v}7)gN)Hh{WFmwcR-cnEFTE z8u71CV`A~B1GvaP+NCn{BN|TUPTacObM=LZQgme=mgw0v6_A&LO3gGEu36wC8Qx; zL02A}0boL%zS{tO)BRB!_um>a@m65yt!RUv@Vt_LGI_lh+axD@rmRo_h1%K1NYybJ z<55RSL(7J{xm_RiSHzC|9vcYm{b4N=HwaACm?xIL4~UcVMBQ1SskiV~B)I@7ru93kOEvBZ8J z9ijJIU9#y8BGAUkiSn(d**NvUeFvn?L|;6XahOG{QT%sUHgZcR40D`W<4Ojl24!%3 zdOEaakn>YP0&s@dlxC*djv5MTPElS;Tr+ow?d}}qvrIm;^ni@~=XcPxb1ugRs7l&g zs4^jP-R5Hw((crPe3ktTecYLX%6aq2u_b+$nz*}^l}!Nm?fVa(-fc=ggTEU<>g`gU zUycL}PY?UgzzBq&XRKH25fD!2g9>U$&P*vjvbVRMIlJM>;)d!|dJA zmQhdG|LAxM&OuHx50!QbP6%}ig#>$Z0pL*4qY$pwJ&i(n&{R!Mb?GA9un_rT5}8u+pR#bmcQp_>u1AB{gD z#u+-n$X9kRT~uN(<>!T7(RM?SB_a|P6YPB?>V~;ZNB$%y>*9^-7sAIbxv`*a7>;Hq zq^^?~65)yNCzIF`ahg$Nx^K>fOed|442*nmc0`rjbX9X= z)5=w>LJ3FbtqlgRN?-3tQKSdzsbgWVntOW~Uzs1??Mu+0nk)xj6nJl?bvJpmkhf!p z5bTqSQ{>2QgRXUTOhS--pf9;DofG^b`$-tzjdxv01a<7Da9`7%>`=Xi;c*VJ%* zCU2BU{mUAA@vWyK{y)5BNHHAUKF`qm{)4V{4dG~U50Tlh&X0s>_cyb-b+k~87fl_I zSw;dRsk>$^IaOU3*}rj>`f9U(QROKdlYYaW6|ahJA!`TG3QQ_M!^$@Ku*Hz*nHK6? znhQ{wojRUS|K8_z^r&?G!94wsz?E7~p~7SmX%WpAd3e`tl=$zu5?CBDIH?jnTBj$c2A9GoFBem#i;IGiv_;iZJ73v55uD^AzqNNAHNS({R`FB(JVjcM$w)ee zuPk3W^rCtL$l}jw#$p(1^QciQx8hJ_+~m6|A&k<*%7{E?sq()Hj{qaw#+jXeKh`Ux4~vZZsGxh%YsrK$Z9Y4x&o zNf)vpb0>Ku*N1i9lT9-K`wyM2z-YsAN1{`vXbgR^Mn+eysEB&skV0+OADOkyk5rxv zy@6ONjoIY_?7)=mQ2-RX>13;37+1Aqt>XAcex-`!jkBg8{B7N2#a}VP#OPh!Y`)KS z%iAwcLT@7c*=zVs`YO&W=-lBJ8mF<3S)L&E7CAA8s*XLCUNC1b=_9VSwDV+}mu>Fa z^QkGK)Zt${p>3BLWe-dw&5t9&fFnawQqko4WJuG~^lLw@nSq&E$`PcDt#dV(=qQ^$ zQij9}5Tmmb{PN}E>%Lq_S0_N>!ao$wo*@r1)__H4He55GgQPt>h6I=wc5h4wrw@I{ zK^s*h9==?sgrhrY9S|B?FLABH!{%K%Km`OT)V#|oW+$35l>Y$9_#EE#)x1|)Slc4o6w%)FFLQ^M*xs+^0 z8lOs{@rU=rN*t^W1x!@yNf){Q3FfSaTW%j#=k^PS)J8LKOYB)^d6l4dBELN%eVD;v zAtK)Y344CZ2yS-^O^NwIp1FO>Ro-6@%!01T+n8J5PKve-C&vfBc8!p8q3f}XuWSz9 zu8!ocGPaVMU;8ljHtt+_VidhTw99^YofxsBuKyd{B%8Lu0AK5jAYa5ZO(1WFH^`h= zeBS#qJ6i_5wY4n~2`6tTD;@8a*;A|Vc>h^CUsODnHLR!U21kUn4t1+|y&M-Xw2H~Wj!yv_f_j!-a%#?z^U4#AN!(4fE}zRqqb1}ujVOyF;1 zss0H&8#3uy^}lw>JjswyB2nB3mpvmO>YN`=#1ze1;L!K%N=ZW*n}+J!eU@Nw(NBlU zb4_4KGT&Rib{A(d=9ZwYAlEG4Rt|V;dkGj zbG>|>q^j5jVu-1+5lfKvu4G1VB`e!ai~8hzr#J-h`ZWi<^RtwcWN&_ko7d&kRS*&j zWnjH&dc7m1xJd`SK6?W4*#UqRnic`M5Xc_z7c%8^?{?b&kNm$*7x5c@z-PP3t7^gf zRT{s3DApV(rOlK6e#H6VYHzU`|MBLyH%RETE8U#5ps&#Mw_{g#$F-iY^R2(Vi3!}; zH6=6QF+;gcXCI4l1e&Uuyi*_moyz`wr%3j_XOoi#HI+uHi>?R*4KIV7$bUWW867Lef?EMM(L%~cq1H8NS$5>JbvYYF} zlt&()aW2jvy=NG%&pCY?r`Wkl#++E7!=1?dV!zOe)_Qx|Me5U-(|JU1L@IuG^L)2A z%8El3q4?Z=c5qZ=+=}n%XcOpjhirHQAbFbpZapQ-ejIClo4X1rB)eBWS~f)X>x{ix z<|S#neRniJ85Wn~J-ws1?#_Bau{rNC*WGkVo!ygr0v~Ew$Z_&T!$K)H(^g=&!(6%X zD2?VHc&vaxKhXW`f<)1)a%7;IE3JYBU}BH$z7i62sb&Gu&Y!&Nc-=QD9z7|%&uyNL z10L<#_><#EJsqVSHuaaA1MrCyhbDfxlAi>aiU|&0K+SRc-|Ve!M3(v|<9xDdp9$T& zGSs$5>e)nAAmYnuU5?QSI8(jbrDx48DJ9nO(o_40AiqNE7Eww$tQu!#8zi;&MPxa+ zh??mUtZLAWB@6JmVF7u*s7(x@3! zo+Fw0O>r9s?7=8SHQl!ZA8ZQH@l{E>7T#>iGctPWL@|tbcn$rZ zxgC{QC`g9HWj!e?I-dCbzih#OAx7r7`%}3VAac$LN`2bkk>(*1_rJu`qy?Qnyft89 zMvw(X3e^sS$WGrBBJnM8%0CX~a_XCrl$A${SY1tD7HMNxfh%r#7z1M%t@b@s|6$#u z?eZ_>&QQDt{P@Hn(4254U#MTHPKNCSdmofn!#&qSqq~M-F7~{wBJ9f((l>sZn2TP`x`NrdDLhBiD)B+={*4GKcZmX@ULC) z;mTO~4Ez@tW-(z{$nSpH$qjhbHAs`j@S23g>26lZJg}X1+giKdq$yG1?E+GMJ4dtaC(b(qm4m-VwEGh zYuSVI*@T0f{I1oX?g~{cVnV+#S4jR&&3TBXT+8a!U1e`m6sP%(zVQj)j0Zj7>w%#% z1<_fa)5ox%&CtpV_qxJDv1W~=hmFV5I_(Hzk2ieIR}o1Et8)FIqG~D2Vm`@rB%p*k z15FzYnOKF%uTc75mkz%79nWYlhpT@0g>*Z=c{lP9{1!;{ogWYX?ocW(zHyoLrupca zK1;Br>YJxLHKL4H6$b@NC2H(9FJ~1r3*QwOY06^U3(0Kl_;R1QykbAJhKl#S-|$T! zVe0}?%FVis?by|&_|D%pYGdTbO8bMt$$LhX4=2=8P^ckb20YyD&%Yasz+j^f?0_Wb2cuAv-?f&rn+apDSPeMv&Ns`Lkm-3Z zNkV$JDt=@&?X2kgF4rdhy4f!a|$ULFp+h z^YaU!15`NCThwJr7~~8=wU1hnAc^;rF~&+lsh9;%J-ygyj%~ELzKS9L4mjhgH~P@2 z%TzH$fHS-}3`%ShA1kH-b<47Va!n71DpJzx3ra6o8oChA%Y*9)C4cWY<3q%A@-;7j zUpit;$-ECA5I@bb|9?!qV_;-!v@|>u+fK)}t%+^h#>93ywr$(C?MyV8WMbR?a_>3k zyYK)0(cODL&swXhRu#B~O{I7TJ+;_gm}iNDtwqR?GB~xQ0EPAQvXWDkQ$z4I8u&@k|DUt$>>o zg5^}{*0K;z+KH!#%I~bwZLp${8a$KDHB7*8GCLV8DHl@w9XPszGSm5v1;?JWtTKq> zVr1fsBPg5{LnUVHg6G({YfnGjf9PWDFcWIP7*iD}m6WUKk6iZqBSM(ZD?q$1ElIQ$;ayml%ARod^M*^JB^nRPTCbIWJ~O_#Nx_JqYZ z9GjSTU>`GixG%|BgyD%Ou?&01sPNv6?T|3FQ8-z^6+=lEQRXB}OpYU}ZOc7n?aYqLC(^cU45|i8?AKql#Se zMg;**K9d`B7I+92tE_jV(UQ!$A9N0^7KO5CL7hP@rLz_L-}`3V>l>_v5)KY;^$jjL zGx9*n&;%V!%5a1cV_)B7gS(l;MjWSJHr(jGyI7$jEyVh4rzRFd=whiJK!iAKK-sc! zu4jKK!41AbShTXYHSpD?U2d2HR{f*2Ik?ZMd??|*uzOT|VBH{a&7y#NU!FupC4d`c zh4*(}%*-%+v3rzFNE2geAr^YW_Xbdy!`*gF&02*`nXj$aZ>YyVeI?_9`6YBt;Z20a z?11&Qme_{4sBf!@vVFd^4SvL zHWZA$0}vBI%mi(Sn0}fJBe0ba$17M0NE_w^#O10ebnKLi!YQuDC~!qBt zkd^(TvXj^Z{Q`|}qKQRzQZVtcgUs<*&C!j{W8U4b=JZ%q4-$_&PJ8%VC;u8JZsO2f z?Y>3focaAFaewORoYzh5JX;|0@GCU_E)zMO6FnoVUGF1Iasz0}){c(OeE8xzKyA!u zh%xYtAg1p_g6TNoMOdgbr>P_>ZEH~4Y#^J$u1sQ?N2NlbQvR?c)OCij68zH{_fiA> zmyfG8-2U!9Ei$~Ddmqn!qV?X#^C*}xMGzesG#F36R3F)u2M41yA@wv}DVQqa2gZ1n zP*IkM8PHXXzLT~z(vlXDR3L5B7CxEQzvn)|wJhP}J0g-nCYG5AsK-NOiw~h6J2IHd zKzY*HK9s8tyC&_FJ4Z>qazT&xfhveWMqU;UfDY{V);E&&1|V1wB1+hy?|@@EM4)W!;}XaJsJ4 zKf}!Fbq1q&Knmw00voKB)KUrmlnGNJiDV5h1K3xcV1^i7U5(K`(gL%lZ1z&r2v@8E z3iH0TyP^&ReB-3ykft8z39Otm_=?m+W}eb{Ftpm+=pofCptf8qE35M7_Q9^j>-<(q zpx}ca1z9*&P8%@Z2u!c%0+Ntg2Kz6^Utky;g~4dadHkYsPYz}xS(m$$hb=T!)f=LI z*Nmww?f@K?w6%Im{WAx2{r=(`$J3#_6jhWF-TC*5Ep+`U9=_eh}R&GrQWKFK$l+pD!eE)9%QwvxYWC z2t9EGPPVM$ZbVQF$ z%7hj;?JnIi7$yPN%U5O$h;m}8&YYE`w0;)t9SVyl<6Ot?n(Kcu_dITJfl0>E;||ba z83Yb$L9zUj-Y6YFYY4}LMeV@43ui7)*rR z(YqZu`kt2t`|lca@w6=DbxlVhIM9Qq4icX)ZyVIrR^MmoqK={s%uTD&6dWz8M zz@acYY?$O~>T99z&1H46qux*$_l$j7JV*R^Ze&cOoX}A0P8_vcve0N(Dtud2I%5A` z`^3Wq@Gmr=&o1<%aY<2F58(55d42f#sK1RXz#m2CCo%?L^43tQ9n!?YhN-udrXiR2 zhW&i6{Xj3J&`FAT2vpZlHMBP&9<{+3t-qMBPh%$^jl$RkO&q&982OJTWZX-(0g^i= zZVS{e4u}kmujii9w(}DG6utGq2Uu-}ciX&W67!co*=+bg6*7 z-Ta2)34W1J!^w=*KiYGZ`gAJrj@OjJ)x?zB-ny_a21G-cEU)u|NR_)MHs2L~x@GXe zx4s$RblU+bNezU00)-M!M3rvDi4@(weMUwI-M)W8f`R<&(1{#1V$rK2(+fo_1b+a> z>h|-8xGodi&jMa9m15=tO%T+0#+|oivnU)UUR;Byv!OJI?C}VDT2eDMQd63k1pr4| zNn#5rD=S{6QoGT1UF*&PCvmu``zVj(e{AI+3a;eG6(HxY(;W_Y>k@T1#&j7W2xxca zBnhy3AV}meTo8!JAg`J84JV42=P+2~FE}4!@{y#NYYj6}AUqlu{(gC$@{s|nwgGb; zk6_vY*?iSXN%BFC_=PE&Jr*5rIqa<77|Z(g(zXMe)bm_{gztCfb+~w1PYE4zbL#$1)-yAs_)#>ih9&8N5Tvb-#$b%ngf*)7SW0TN-0 zS0qC_>B)$rkvBF@O*%R|WYV4pls)$5xaY-BfX;>8bof=|?2Bw%*gMcA=;&UR@yh zfF#+e`%N|{T~*rF2ls!-Gu>Ac=Wf!|MG6XiA*iBi+tTOO?R1&q1Wiep!oAh$D>Oa} z8mSa4!YI9Mz#DR$ZYdMPAPAp-Xx#L6eq& z3;VupiO{t&RC-k2hZ?p*6gR)O#WwR5Pm>I^1!^k6+n+&R0_Z`=5T>Hf_Uk2gMu4Z) z((Aq+*|C-z1((a2XHo$HT6Nhb4O+{(;{5@;*1;6(9~%k&I2>V2c`gy@I6S0{Brwd( zIQ6eJ!WOpnbMu~9_v9LA5d@JWRSmERA5iosj;Qad7dIOK>%TNV$}2w%4X+ZhBdlqh5YUtTb?{SQ0@eJLe65%QLC20NJGYYeIS5_`AB9i#1-S)on4yFo+` zerEAQ4$u38P=UU5-p!{?d)4z3tTOjWfa^VWd!OHpH+A=Oqt}OiNVMjyRb&!LC~ z&0`3l17X1=P+mb$O4*RRM12_{Hxn>>8sFHYTu`8i#qLGcu{yA_Y0&&RiUx!aqZ;|X zT4obt+5#6e4EW)(<)>rNHPB)_;@?Kw)k21-fiboe0O5g@@SQg}jk^qs~H924EBV$;U94Z+GPs8czzHCGvoKRO6B3NlGY^QhyV(4V$NJ#t-N`$kG zh!dMWY$n4=!SxHx$n_KIr6f$jaL>Qv+MZvhRCcz_tMcq$f&;^p)GT~-}ZwZ$d6P z|5zN@4c6q=1L}DHEwnnLLvg>*xa)kjOb)l%FB&F zm+WGD*|=^Uf{_FPa_@rnNA7g#mr6P%-hUNo44TMuASe=~CGK4ZKqHU>y{J3=(YY^c z&iJ$vX^AGv4kQSye2i|c1r)ZV!v!I6T6>GCLtU=r6aQJv!8_e4|`hOQvdW*o7= zA?K{qgb(a81b4udJt-XiJ&#y4qfeBTJQHyWBO##h9U9#bFMDyoMFO7v!K?JHup+lX z1Y`JK%Fi9{8Z6uqV?1IQDv>HMZe`HvIgfA}$clQQe*WhmxkojWNtCBLfy2A%AgF;n911}<1kG)&{8FfI<7Hb?Z+ zAJgs;K(E^Yq&b|~US9>6nZGjDFpOqvKjsy-L$ejPGcIV7yxr(;_-8D;997f`+L>|F z9&1w8R)~sfVoy+4DCp`zCAvWf?|M3)ZG^E|^Ee#7^UcY_8QBPmdoYD7@@ni|hvAc> zTp0=9q+E?*q(oVHp9uIu=YC2cE@)JdKmLiBHxcx8z_y}^R8-T7kbh}M3y{4c9k`@8KDXR?25nE#~~Ug;xASGj=ESj`$~y4GP8nHM%_K?tPiWW_yVPs zLTQI1^XI9a-VMRL4fmE?@`{;pzpoGnj_6eVu8X-bD0o|q%NJqf=8wqlq2i>}Qo&^Pat%_9Gw~?Jn;4(H~C>;hBnw}XN9=2QA^hjeo?1NYj3jpHyf{iZirWf zx?X!SDwEt*ocn}lxv(M$hlQMk*_NAA_tqW~RKs!Bc;q;U9zW=(!*>=I{50lUMUBOf z3UA070$-R~ee3{hGnjxd=xlA*`~l?tZOq)EYp21hVHGTvNCoZe=;3}Mot}lr?PE(3 zVf?8n`TpZrLga8mGe?*p<3+}Oj6Ckyknnt5tgcOQ_)03^kb*lm)3g`$%71ty`v03$ z7BL(Q{=kWG6EqCR040W7sGMW<;&$GwR zh}j;!IP2&iwcOtD8#6qs$iI)d!CG2>ZfZlTXh*UKL7O!AyLkzw0<&2E>Ti$tH+6!t z$GwWdLwj{A4a_F+WU0^Ph5QO@YD2>4Ck~!=7z(B_`{*t=lVwEkvaADWCKz!Cp^J=4-HJHzl-WTi(Iix)A?PsDS97k=X;d;_G*78P zvQ6+FtL>>_k<-z5-IHV(dwaxk*sl8yVyE+eH5Jl(8&)4FBbl&%k{(HnB&w+{%`{-r zXywOm@E*#p-dKy^EHhXs$ZCA7yUCn&nm!5Ywl2ML?Do1@l)>#jwKMOz7n%i#Q zJ0mj;X<>Xfnra1EYWRmkvxf#N6WQ?X?0576_V{V-RP5NE{%cw@7M}!nwgk?D5d^%S zXhzA@{;jebbB0VaE+&MX^Eli(zr!s+kojKAafev9*b{@#LPa?7DmgR_8{($ZIi+>d zNypGxWIR!i4Y)%VjCtmd*XXP26tZ#GOo366xUQ3^uVM03S^ogLU5{O-5s4H>VWY)y z&v|_>TJkOxk(ENMm2ZIr^3JHSg4=q>SiNW1qO4-C+(j_ z-0U62{{hP+YS0$GUzy)&=3ZVr-(`qJ$>#4y+_}@LEXV4!w|q?LpMS;8kqEh*!@dsF zCWM!TJ6EEI+yOXmU=3$y{F(j;5o@9smR?~k7CAltn3tZ)Jxdwvo-L{f?jeJgF-qGx zwPD0sOen05D>K`t1**f{}#Q(Kd;;!*iwx5AIGcLSm1O|zL&ygxESKPSDXn% z>YyVvx--MAIK@#+Gu16N-BFO#v3)gU0}9$yHO$=A&3wz!Ro@(W`eUAVhUEu{)~R(# z9hTLK?H~yOmw$mw;Xw?MXPTsYqu4=kjKM2PZWh=evF93VyMWef(myZcv+39NH@Xwf z@|h=A?)#JOQ58*yP(|pw^cr5!e)xkDfpjuh)N%W&(+b~F*|_uzAH>3VRzBq42f>{Qf28bO-_DNf@MdH$L5R&5AkcNs8vYYG(b`tx5FC{4oWrgUA5i}f?z_9_e$|J7meFOOK4E_p5Nos&!e(J%H`sE2 z&iGV1CxAOr0_g{t%ijb)Tu;^Iyd6UB=!{^~bIJ1bXX}mgVzo8>!Gn<(S?IARb_W#^ zFtjQBT36f-=zoTmX@AQwO6V%Bvp;ai6L<*q3&S(*`$bb2W)Diy?g!2%a~w=L#=d=G zEzoxwbUVgC6LO+Cw3h{2GG(-+mNY0J5I+7aN_q!_vtlzK?)&L>J(ulOU$YP~{DI7A zOg-_NV|zFE1>XB5pj$)PWJKZe8(grg1zo+Ni8C~v*X2llvk9ayY8vb(b6cIZ3A=)RoozVOnXklObnt~=Q_e+{(66*)sfwLsfsh%Vr( zBBy;VhCOZAjs_fLNVx447%z%dS=#;3)PoLmGH!Ej$ISU5GR3^6p$PZ6LrQ+YYp>#L zbU5Rx<8@&Dbir~MuhxpL+D=W*i_KZ*$3weP6e%5#bu)4DJboeL(R31m|llx7EMC z2Rp5?K|x%_nx6aekE@Re~T4=B{A%NJhnz&()#4s5V)hI0UjC6wT%A)`+cNA3( zh}ev!nBfIzULw0>Q<;lkf;Vl3FQcD9u6_7}(EyK6AEV1E$M*>5>v_kUg{`)i@;lf* zMieBhg8vD`5a``>u8b@{890L_7zb9@O$ZyFhDd}mb-WgwXNEc;NC2YP0PefUcrtvH zTGbD$;;k?{Y5Y+{{KYi!uDRg92TG#XPB1XS*oY#GxVx&0sWRJ{a?g zKlBxoR98}u^2Pb}_O)5x0K#i8_g`QSMb_REb#{Em4yV!~xXmwWK}dIC zfCwEy-g|^kOi%3MxKakQHpAn;AI%+I4kVPz#S=Md>F(fOZFHA^e5!%S3`qYU0(?J?(Jw_A-W0U?>;`$VCSneNlm2%^Jn zEhuaRZw9wa!^spfv*kH)@^-&p!$h*%49FSL0hWd^?MIV)Wdw)l&!m#)7rXph1bz{f z+4?#wMnV zIrV7UNJtl$4P!#Lojs0LO)f|;@l-}4=0gS=jIaVD)6yIw%GZ8|&Wl`6(8Oma3c`~i znvISy9>Wop)?tYTKiAa&3mz*K-}gL8P5)Qr1)m z`*sB8Ii=VbqebxHray2VP+-Q5QHpEY;dnO=rrm}l&fsc&HkzTVLjjb2{A+}wI-vZ; zJ3kFGkmJ9fsMj6o1P&;hFUBm{1bXJ2)5ZUw<+=mR5>u3Hlt}QJ)nd#nS~zh+o2#N< zgP}<(HXV1Z>1UW18#ht4HtQ+4ZvIs+3Ykb$cKBq@_f#$aaDHjcn#mjmJrs+cDD)g9 zW;`yFEALUQVbMa93e}}6qh{mD^D|sOaL94#0J7h6pTjj+BaTwwvM6-$qIY4vYGQ^K z6yB+XVM=&(xEJ!LljrKc?awaZkcj@PztD%L&12gaA(kRSPEH`>u9qDMB`8dsW5S9e z1x5*3)VpIiqzq~zIpx`L?&nPo6sSQ|0)LTP)i4CcB%hLPU{z zdf1rjY5Z+~uk%ThA;*$6tIijJr&60|vLl=~Dlq;6Ha#22*lF#&uUnF5ER|MkC}oE7 zvq{rX(Mn3?gTdGyd7M5QH42^8rT^Qg)MvZYXeQrb5-F@WVtdO=3@e8U6@m&GR7m7I z6d-{9+GQe65~BoYUie@tJeMotR|CCH{op4OT$o~;;t9Db4_Dy1{K4$9CMW?SVKwnu z5_6e!RSE4^L!^}4Cp-UYPcA}*m z#I*&;xEwzPl_enpeF@%3(b@s%LGa1Z)n!x-gO}Gt10c8WaN(;8w1IUv#NCxaL^%+J zOn936Y)6}Q81Skd3dV-aumnab^j2BAEM+RrOxH~TWOZMA_ovGuP9mtQq+{nE$&?IK z#J`;a#D$^~pO))4FXgJNtAQsu zLwiR4BKkT|B--!f8=ckoJ>$?*^v{x%!xAD1gcy7gNPMAZt<*zg!QuEKM~VwBP=0rp z`29V)opshLayEJ^QLA@^Ux9h^nbprqw}YN9;sshZqpSfF#Mzx=!(0{uk#-l*hd#7d z&u~=zvwX<|=9$Yw?5_?^ACy2{B~JRoR7{NVtQJ>(IvE~xsWPhv8x= zK<*V~ZtY7CD8Bn+tPXY{8OpM^-b`qP)&98YXzIX9KaVJXus(M(i2h_}J^>X&!H3A7 zKm39-;$nJK4}4FGUv7nv^|h6#?N;AVZ*LW<)l^i}4V|p9-(XSGGBia*_PrDQ4{oAD zkugp4=Yr=zK$DT#ij0U9)pc@zow{zv+^b^YwMCHO6J*rHQv26xtfJ_bx>kD+S#3sx z{If+u{QRuRhDro|6as(bJhgke<%g15b8qM1SbVrK(BGMUe5Cx%=IyIMeQ( zVEuZ0c5=W*0Zh^%PhJQpR7hc+DSE_hGNw7<#Un`)BT=fjmxKsX%t-!f!&gjBxJF;7 z#eo0Ki|dj)=3vBEJdWVDR9tdmG^-azMMY)2WyGNLai4*(pe5PKiIqZ}r7$l}(XFV# z%-G6|dIBikV@;?kkoOiV*Qp?{3nO6M8Y|7Y-(-CB;Qcl4@}0lu@y!&?&hy)A##Ed4 z4)uU#ds*QP6~kCyLCD`n2;?iy?Jv_^!`6N_p73%m4m2m6o5;w#N4cGwVH&JL=9q9X z5jbwC!uovVWYgg~T;eN{yD=I{BoZAk5{C(2j0mcC_qo`xl6yY~4OU#bF&cWo646kD zIMH)kB~m7v$?_l4#^5P6fRW^9tO_lu{Ff0XPS&V)e-Lpq{*A^(tWxXkaMuMJ>@qt$ zQCXMoQ&L#`ZX!;TbD9boib2aEjt!VBIx1qv!_^k_bGz%mq{B2|6(n8q5P?X<-)G?Q ziE=DGjAuS%)fxWP*T6a{BRYF3vPm(9m+Encll}aLeE(^F$@guqqvG{*_HJ#{>(ZxL zbfMzWN|N5Ob_oe(0h;tp$d?Ejx_2*C;0jifGCxhvrVj#hqmyo2EmduO(xj zUn$H|$6RZY<0XSSt!^Y-?OZm$+cJWCZlgq%+MhxFhUvU;sK#ndRh_`&gPEeRUCwyw za!(d`m4K|=hvfFS%9h6p_rE4jwbrGW(*S^hZFmE@iK6myIjB2uqB(@AWi%_TjH?IU zkwgk|2kl7BEiCz!c4RHY&5;^-HndcAMeT%0CzCKu{jj1l5NaSAy-YMrfUAL&L~%!P z5MQU8QvA`j%q$eXCTkjt)SAaTo=$6v(3l^D*(aPZY&f9fR<}wrXV2mh@Jrk7VA(b} zOTYs|UBa?BRs1^Df5Bw5SnW0j@q;SU$uEV#g5;q{M+$}|?c6JPGnld5Qj#_*mWits z$j6qtzCcVjH?evb)x?nP!sFIpsSRsd%vSZYoSd6|s%*BeqdTNW zjG?T!hcNw^j77V)BjTip5cM6E7MKG1Fl2Fu{?s6s=W;ZcFC6-X+raAy=Os#Ow;fdY z*sM3jKdkfWC>xWe))tcgnKpj(jvj>sK`YM0CeX=q95e$tyxc$C@=Y@^!_MhRo}h4tr_aSLn!qke>kR7bUl|Xkp`>{38?iW2IVCc0mb~>>c`N==ki(;~fmf%DjymdVy@t68&O zaWKpR-fw9ARbms7(^Kur8e3}PM~hp38@IfojQbAM0QLy0GpKtWFUxC-FMoM6CL~LOzWV^kzDC zYD=hTjNK%M#UOF!W{&6kc9f2`UEK_BIBg}$h%~G^9LWw>KJ2ke#;_$I&R zatR-X?`Gj4IvsWUjfDDsB4p4w)(@LE+HFn0ZRdWHUH0A+?x$a8RM+oV2!IZeyuZ683OsXuZhg)0i8%plY=d1qfkapafei`7N8kI;>otNmFnuxndzWC1Ul4+#j)j5+A%qZ>;MPXW4)l=7weXb! zKZgIVHG!#CA{Wk(boBto6in8A0L>{L%qK7zUqKqsxB(3 z97<4`A$Aj_{ko1Lu z9I7~3Q7=iv(F}u3RMY(c@B~snQUULe!+KN7BqynJ;hu~E|M#v8q>oons3G9qB&Ze%5)-{_xYTu%IF0r9ebX z90D5v7|PU{ykEgHdz_I?BI7(hBN)AeMUDrb3~Am6_}q;;%egoGApg`Y8xG*B_pc7E zDOly49%l&x1E%SRr;L!1&M(x*f9-tK<+p&z|D<5Z!O8c$XGhp_CW)S|w4k4)plgtj zcO!@-b^3eY=6K(7uYt*MH5Qvw=w}AUab3k_kI8|zK711B?%4@hhoO>?ySHB~j$gu1 zA0j*bE3MQM%N2|*md1*%u&cnrJ=&f-VEKQ~Ft>9Tn*uqYUSU)J876XujL5uR;SWvC zX_7Wm;e1s*`}DphCy>bx&+jVds~);@JofSm&4)bRbiTrS-?Qi+49JME2+nclBq76r zE9Q)&CH>|qK2%wkKfi4tSB-B+FKZQR#EwMEYtLKUm>*{Ci(sW%s8}%0O-@<$U$ct* zC2q1-tgB)Y)4Z)Tuap{*RVu2Ubjs>COvJ@NT*lf6pt(3>#a3bEqf!~iadN>-Xc1{* zr~DkAl%2~P|EZw(Osmw=#6@VELVD}CBzoS2WINrQDV6$Ao??A0WtNPuL<7~R7P1qm zMVRU@kAZ=q<@%@p7oB0xeXhQ7pQ)zZX)Oee-Dgtn0Y@OKIvYfy>Rt>O^y}Mt8ji|q z5gof_rlbi%*wlATXw3q#CT`?r!_^^0yYJ2F)gu2}?!Nx&m{ttxq{kcb0p+JIJtFA|$VTD>nmrb?QruTs zXh*1hlIo&x*;8(fRu9-}ws9Tr8^f5#85A_JmkRy;NvNto*Y}%O4*!v4Ag85?uEd|y zMt!-KWE<+wOPz4(3>CyI-A2{=hkRXiiqCRa(7nN9n6|K%I8Vmddj~J$B+0=x_iiFff7MlDLkh@}^c#%iw@79-H3>%}Ufg~CV@=t(ub0u9-%TP_6A-^5lsL|Mk;z=17}jD}3wd)=N| zL|?+T+GQxF%4n?im4m%mCWimIQtnMSO87g|EOq3Rw3$nD!QV26F3kMgQ-Axuk)S$( z`AOaY7X51gli@$9^|WirM{i#B!INBhv7*uk-i#QL9y-&K`0;ZcdQA5;`^${1VX;%h zpuS_Y$IU{RD&#}`oXQfjy+{3!CN)ATfcsGR_N790^zJevFK9ZEsOh}k~W+&KQH^nU$$*lj~z@Z_dJxQ(;#wRvM-hRxKD zXpM#MqR54!%WWb`N{bSbQbT5{+c{f0l(yxf@$A3AG_f>n*=2=aD)X(>q;S|BM|pl4 z3ky@F>@VdKP-nHCZ0RTS_QC=0#DvnOF>EBMib}`a$tW|OhM@K&n2H&2&5aTkf2CU$$G7jtFPU{v-UQX!6)_TbNwNjAxh)Z^L;dTc_EH zrLw~Dnui=K(*-6S1_kN~8cdj2k}E!$SZb|dkPIM+}UL8Qcg zE0h6ArNGKjqM%9i<{4Dz02qzETW;AK;kMBfFt&q+)^xkM)gHt1Y2T}vEp zrJS$0b}W@~5}Ie#+Hk0PtW;AWKq{ittQ{{YD_1_4lOX9U$1I(=D>K7YT)Vfv@BN*M zWSQJlxyl6gukw9)kFqVYW9|CKsSs<$I`XOduT=Gr0N|AO!{!_QrqAnrmHwiPXh(Q@ zIMsm;bB>|uA??kCM)grtDFwwf_D=b<mQa;I~dwGdxTq`}OY~xa|)W*;UliW+iS(!v?^nKyrjFU))zWyW)1v`0;o>j18iO ziWR3*Jh%GF!i2sltlJ(m_KS7Vx3gXElf}<*REBKin=_2~v!rI5ofGR?!^0AYDcHs- z`Vgw0za>N~LN!Bk_bPtb)W{indWH`i+_S1-%+()~KUC8jT3Y#siwcZ15kC<0L=Sp# zC?*)1DLq@Yl+5?sQ`hh`MKTiw+}_$LMNC-OP*aqF^plz?D&>ry4KLnJyO(X+!*l4n zp`U6+*xw^=Lya!B8Dd)FR<3%UH&@k;8}`(~wpRPQXuHkVo1tr)GR4^Fz9_Wo6`Nm!}+2_k$?`vN}38VDmj7<+i_e^19Wedc@`? z4Vh>y>kkK1))rRtX#-asPbnpv9Ui<9VS5lZt`Z zfE-dJHpO0F3P{AQnTG}yI+3R&B&VP?T4t-WXB3Z~x7vTEtbE~7?cfzL;-$KqES-3B zSkp>&7>63O`cKk7Goq4rAWIVOqIWHy@3|Y9sFj}uJe%Bb?EENK9;TkSGPRC?#m@glcHkwj>PAes(n~QTp>sF5LPr8cfa9T;}{Rf4vjh-*UfuqI-P z2nlvFUDA4~`}G<{T1@5kf%Ze3sdT>ST@$&hLNZix1(Lh{(u z6u`8ybxtd1dSQrhkVUQ`lA3Z#?w2PUQz7tNouG(`W#XtQGNYv#?a)kNxg#9(l=?`( zEkslrAHF!8mNvM_+80k@-6655)VKN0TK0PiM_sH!c}9p9l&z;6e{pf~p1HYEBSl=C zwiNZEbFO!cffSi`%TH1|uAHzpmhoUI7Q8T=a41Q3%#^z83ObEY`P;-$f?boxG&Gwy z*PjP-CDdXwytDpfxw5}G;<9mSr-LoNN`we>{=4Fi&cpxB&&%5rvlqb%qBi4u$p?RN zPxr^Z9Lw)OXIX3|3f%9hPa*@eJa0r}_+LTfKlb1xn}6+*f~Q}%jZf4Rlyhdr{qC>& zEu%M#K^<9LRBD!xktC+2%2v4m-}Q9m)^?cgyNv(z&F|&aZGKrv*wB)F^V&B?x?TSB z2s>nuDhZ9;h@CPqF09~QB$^s#2P2MuwP?9cG-1RC|E7qYz650$>~z)k(XD zo@~^pAt5E-XT`ds57@0I@Q%6MbW1YF=Z|h~iRpS`O!T2>yX@TB%MX=X5I7)fWDL66 z;q312j+&*j#64s62!@lp?-?kJ{Q!>Ya}S!#iI@pdTUw?A0o?$vV@W-3pMdsuQ4HRb z0{z$#)it75jMt|LiVu$5mt~f=D0TJ(g_cRPfz?IFuW)j7w@n9F$dzA-mK=;cT%%1} zVhMMqQdzN4Pv5Q=+$Q#OTP)|W`o+F!lS(X|8*ifLk@93#=%8K$A~i}TcOe&BFSWHu4Po6~-K_{ry6K+`=*@*r?VuRQ&poepV!!qoxdf=>ie%o82h@ z?d6(qU)lA(4E?gHa*~h~nyhRVq!Id%#MYWiDvSM47WcS#(lpb>&x!=){g@-+ecq9d z;sFRPoiEk=nPlVnEg@NFtoYDR9J?%M`dWRK3ok}1^fIM~$e%lgp&FnTh*f1q>q=r6 zy9aHFX|Xc&#y?t?hw)cbuX#GPA{v>1zc(~+`SfW{{3FNBcH(d-e6j6qLQjYJV?8g- zPT_X?Ekxm+-sd0_`ylx8o#N|96C6f9^7m&==7~~lw6sT86`>K0Kc^8pC>7nb5jjzu zCAK3I1CsgUzhdJ$o~~Q@M+L4MWoX*;|uNxk++96!HDu0Ed{VMNTGr z#a>Iz0)N1Jm*wXF9gU8j80uy63bCfy7n~w3E$m9l^Hbh{P%J^Wq!=p=cCXwII^EH{ zjj{2l=0_Pac|M1p%T@Z5{npEWPtMKPQRNL4@q3Q-VsZr{6ImUD$K>w1`^JDtY%Bxq zPT9^buFNOw3EEo1(%O|vszL=xJUpBt`j50!!>Ua`FAP?ic_?FVnR%JV_o_l0N@SaC zxyGt_mg5pEeo55N8x2}9S<@*Xqtao3N=J6zF_1Obo(gi~oRm{eU=;98uNoktDoev5 zJj{Ds@CNNRrtK!wYs*GGxGnH7ixJuo(=`LD0zn35zIQOhK*vW8=H#6yuUpb^72j9s zElylS@5ANt&sxm=&=JBhb)l=ew8*1e>+5?0c{nqwsHmW%r!Od|0%k>#(k&Ez-y|3EzMiq@9Azd2kJiRgR)9zF6(_j)?CriC+y0i&Ab(U3 zL9S#A5b@$w3leQC3lmE;iBCYtfi4L(bAVmE|9y@{E2)yArmU?jqh?8j-i%&UR2&zl z^uth%IZ;@gYw?#fN_x=<1Jk-s$Z)v_g!l`W*EVan@gG{SUm(MIc#6%2s<@Wftf&9B z%f3$bR4DlZCWI8FVG|kDQa3D6?IoOk9hk9X$uB8t4QU7ExxA8xSB%1-P9{t23+oEO zorl=ISAP|CN}Soxwq{>cqnA=j94?MuJr4FLH;XmJFl4JX+rkglrC<^Y;N(2YZT<|U z+|wl;7Bg*mWti)E2Y+l!b{(KuWvVF}xZT{z;~&0Vp)EE_lcFantJ~}jG>RYN;27B3 z$Suau%fT};@1ua=Ei#LHN8a7X#A&vMw2U|=$nuATLSW~*8qLy{bazK*49I}sLps4m zPR+_Nb^avD;~pdKo2@T=6PTU>)wVcBg`2;pCpmHG0#RBXo$?G&yJZCOGi9 zqWQRTV|0I)O`rqP^%pu2Kh_K zOBoMT7WDL`jJyHq;IcMr3X^AZn&fy=L9f&d5{+{@cd;{8!243`1XlDT z(j7xbE0sO{AzD~}D1HF3wx<~O{{KhRSFpvgE$!|Qg1fsr4DOmhaCZg`?jGC%!QEkS zcXuZ^g9mpVhTy>+F6TbqKIb2FKfQWY)oZnHJ)vj>@wH@gjiOxDt}Ut4!Bgu)cxadb zrsvRp8#7yrwddv;52E83te5uhN8Tv>3QhexcrepuEOPpZkR~{-hz$OyFjiKhuPBDd;daeuu7h0(XBRdA8&S{oh-$!0|ULo_Pe=t zkKuCb$^cT85}FFJqQF(?1YZ!+kAjt4d7&yib8X`UUYSm++1@X>EqarI;iKjK<)2l? zD+!#wW)jN&0$N>OKCYV1r{^Swr43PEa@~fa2P5j?YZoh zBJ9a|v-C3EHFS+z>-wc#GLg^J)+&!yXDuPrGHILXfn5b^XmXj18UuSYZsjNliVx>& zW=AtE4D)M@QrV#6x(2rNTzuGD5XsPk0X2u{?-|vyW@f`&BJ-179_=SEQq)K6L3i^ zoMyiZY7%^zVq;k%xF;J`9IH3pE&s1f2)Tw{mH(wTQg?WWtilE`soi_wtcVYS|0%x= z010aK`!QQ(o^MipO?KC8{t~`HEAW*S7lTGB+Eliep&((|qC?(Hbs>LjPPDsOXQ#Se zi%nv+su)o~YjKW4oD}(nlzRE7@H*v)y4fjS;?-8go~PoNCaFb0bGBJhnxEuY8rW9m z!Xs5R{y&Ug8-NDueQ8m5qDC^{DknOE2nIo9&1Xi zOj_i2DHTpd+0RIYZp4jmqbJWr! z0W*SiM;%ec-A#$Emq(1?B3YPYT1zk&xi@-4-V z*$N6dQF*IXXfhh!bi}Lqlt2+?nzuiaVxP*4Q*zM3>p6UcwUjBa?f#N`ZHN z?o+d;%6W5y%fr9LdFFyRNIt&{H3Fo8Te9oUk}vN0%!H6dRacU%?@sDZf8KqpRRI_f z_OsxYYO7+@Xm+pjccWfGq|--^x(~kT(UPdX&V=K%U2>hX_i$P2;gxz~W#>KcHs~S1 zfo~ncpPkp08WoUUPLYz`n|A0Gj6p1D{f`XJne3kC?Ia*GU|UrUEsL5 zS1wh(KXR)hBlMX$dpy4jmr@f}Ym<30kE$_)PCGl|;m0EHfORna@b~%3RPBbc7+=+& zh`#b!VvjgUh^QK%P%r2;0^M(w-KiNzgq7r-ehAv2?#U$$+gT0coy2Eii+xr z>&cXE6ylSNetiv~-xJT%q>apDw$hb1=ll_o)lvEICk%b}k6;vAGpN)5056el%Gtq6 zcN8?*>0+Q@RxV+HKSyDESkJd=A+aF3;IKac44$otf!&BkznhyAiWVwE=xxx_Vckc8BR`XM+>hlz$zYo4Ci)_A1LXBBfK=Yh}_( zP}-aRk#Xdckheg>0(>_l`L&bws@^DxCq4FEf|ANr0#sF|49D_~L)IgN+bj8{F$ih5 zpo%{kD8ph69OlE&{68`>e{b@aIqV~MNi-H9Xsdh=-vm|{&DIx94{dY8;Jhp5=hI@s zk>R)RzC?~DWIhi5Z0Ef%-tP8RRGeGVZ^=>pntGnoPyTV4wOiw>mpE`r24-JIOJ|kv zcpOWjzvKvT$+^h#5VtmQUO>8i_rj*@ti}oogu|{+OnA@RGHlV#_bViP7`fOu*qLrV z4J^-IT01gWR-KcWHnQ#_3EjV-umAIrokPK?aq~M9Wz@tfEsr>$uPblbOcbwTDO%(*5%P1g@JUE(Y@arfB!phU5DEWNp zpE8hir&iQmbQ)i5HZP`xmRs#{+pV>Nq>vACo>~R&h+}^#Hh_8Rq#YQd9d_HK;$Sq`KYYZu0+{F3)2=HEFLkVr0LK(@hNu?;KH7wC1d&$iZ`JQq!ADm>Uv(qHlAB{pZv- zB>z)f%NJ!#h{`YNUs)rh36f+n$P$+A12!txibpE)M`{JZ z?qEd=tY~PinqWm2Jhbz4(Sx5?rn?>Fa1@40W68-MOxVt}cpUPT}w>TT$iyw{CZ(h=sYg9Vn; zy(Phn1$kKE5se243_l6Dp0TK(#pC4&PT368RCDQ_4i2sGEZL{kJfQyI6JDQhn)aCpf0 z)!Z&wUWi9vAxJ(+@g-p|(&gyC1VThx^yf-Nmk(WJd}Oup#&P($VnHI5WSNZ70D)|r z&JVdlEQ7qUStoW1;#FOu`yfgM6K~|!&E>ua@_^KUhZB+SfP3ycv)?iZxygs{)3e3E3%jr+zBZgixsdKL`B zDdL$m)b>6|H)cGTva$c+MdIMyL!Y=B6)}RGk&A{591mNt6?Heqe08KZdOKS3Iy<2d zrF^Z3Oy|R(v^}&oqmu%rBV#1HVkQVt+zh8d67k$Q1uDB#@BiLEi&Oj@-;_wzMp&im zNQXy^*<~!Sizw~#V&*eyj0-LnjU_oZ`;EVNQnuw1?n@^RQ{0TIfoFjP_WNkT){qf{ zSKvS|K_7cDNUeO)502t=XROlO_~PvpMDBn3o~PojkI+&uHtQJpgG64usN3`77x7Sr z4+q@Jn=gc~ua2VNjRTkypDiJ)X)aEoW|_OFxQk-tSCN3XrMJRDIZ2T-svt{KFjAB&1r3Pm|k=J}BLt*zwV?J)T z6Eg{QbF-yKp7~TLrXvdHj1Wu< z46jjhjGJvn`4ori*^p`UgBk;vmqV2M$3UXAkGY_!h$+od&E8D@i=CBi0Sy~=R6uGU zSW=jkJfgT#VA*6x&&WHzy)0qa&4(cd?eBbqKZ*tOkR~cliEjGejPjbwl8Uk*B+3|h z?4Js4Ec4Zdit?@>kF_*+$&YtIb03Q|t4!W=M2~DUmzQ;ZtsK0E)`!O}8oaaa+YYNl zwhR*rl)D*bt4Rv-KD2Y$(&<#06_?^vjq3a{5k<5FPE*WR$qYHgl2H7OjPaJ%3<+j? zPhT4z5C6Z)%gK8?``X?Y)mGj{A1P;KfypUp->xQSg?Ob0S)x!ILz1s`kC-dVs##0h zct73Ea{uJy;C0vp-&WqvsTe64Rv=CnL^+9ng0E?hpb?>Fl1^(v1s6tG_b1{0Y}@|Efq`5S4_U@md^d3k|MShtroFpH$tbJ1wg?uB~J6l z+}keww=7?|R|pQSh4CeTeMT&LU~h@6#u7(MEh96OcGvWKUD)qWY_con^LUn+Xl?1a zIV1bJgSbk04K+dcRzKps+0S!!#J3PAC4?pS_aQ~;pj-lTPdhjXUna&2IQ=Qf=V90e zHM=&v^<}Or#t9`%tYY6!(m;&MH9pRmX-Cs5K)|SGh{5wXKG`qahJ?fvWwpV+KPQP$ zNoqzO($4tX;`oT5An`|K*9tag!*6IhuaW{2@3~;Vd?%UEZ@x7k7~A z(Bzh;zet6}ijp_e=al{HqmvFY^Ryvz{0!N+!22CkIasg=_DRuZ{*q!$McbR$Of0xOqcN7? z_)H&nqhOt1&x3ER)(d1-)+{`VwPqhU>c%OM>=+Q2Tw`@_p>??~f5*7^*yxiVWH>V& zeDM{9M>fPf2}`$r4B2VXB1RX|J%? zLeeBK*HRjqzo%#yvmF?LD~qjb#}7gjhGvVq#>Z5wFF=wSxHPU854nGL+c~JjmreGW zo(|K6k&dp48$uw4hDQ950S>;&>#C0dDwq$;ZXeFExRS6Z1cNuhHyrw#(0!LCZH8L#VU=~@F(1Ha!a={C zpBsUa7sRp(BYqRF>X+&}M&5G76*U<;R4`SBnoQ?ai$^b>N;_mxZw1j?L*f=||EsI&rSyzJ3>(OQK7YNfOR?fFvp3{U2k4}Nuh@`^v$b@uQ+}{B zBZO&MIa6CSV(jfV8KH2XcF%S(13G4vGAHHqUe>^HJY(d0%^aiB0Kl!05<~U(6BWj> zmn>boGUnu+5TyNT^SM`~riLbF9xLRm{kslO=)a@_AEDgGYMofPN#c;LQm?eX@IQ$z zo)km-%=#=^ZA)Nk)#{BYD391LeyL+~LpJ^t7i z$Q$}um-ROpoy*-l5nTmpEw%RF>aMu25OJT+a$jke>}u)h3lrUrkDbu6EbS=su!~y} znEmt4A7^sw8KnC*5^ z`nQSS<3o@9Y#U26i-j$V76w9r4e4UQMrHe;onA~!j_D(q*>YyGQK3n*f(i>mMwL&? zO46Mh@HF4+GJU~_Bp(SL(;bJ#!YFONy(bwL`y4iE*E_o5rhdb)El7El?imn!o3r#X zU;S$AzFQn)F1YE-pjf}fGur)jA=~5frrN~`&q_G(MiqZ-GN|k08X?SFHlGsLA7xt0 zbZ0y2d@?APp_KEl#HSaPoyleI@<9g)whpN;LMo-R9<~aTyoQzyF=AzYVL?S*RWeZ^ z*oWim=z*n!L&iTA$xG(@yHgp-67F9R;m@9_Uyr6Y)RWK*y|DfLlk;II{Mp+^!;TLJ_4wUsE-$98Z1yH?5n?;Uba{L zS>thwD0k#6^K84LT5;JN?YRmQnBUCYGM09LyIT38t`b!*@5L(gzxt@eUNQ0q^WdMj z%{!P7c>lO}PFSo^z%5jo+&6eL;*+>BUy|h$A;`VHsckfCI?B}=vz4tVfx6cxL9&*7 z$rm48^n2{&`5XV+t>fFU8bC;+;FkP>!8d3WKZ37Br^Ns6KwqKAV7KuN(eP2fTme0J{WE& zIegq(>U26KpL^UQiWUm5Q=^BtP`%fRU(XR||938SS=ydgpK2zOWxQP{-Sy^+0nX1< z?U(;@eV)YI4WF4pmmT_L_@Si&L{B7zBFtZ9eV(}Tc}p1srpKh4BKu2|4z~QQsLObL zS>uW`V2(D5C1w}gRZdUFXnq@-I{tga1UDV-i?i7N+~XQULW=s(P8=`jOjS|1Pbb{jY(K&r#d>6EzZfRZG;mdG?20WgmW$tnxDq zHIXEQd#_?F(j_5jl(jW_`{%zND(L=ueB33XKNF+q*g4Y_7bRw7h<9xi==>&*|HIIq z&1kba9`?F)K4+NxV5?<1(l4yHhxN6EdzSkl)nJ?P&Wm@gVe)1=lv9EOG?_lxG5do5 zMI)wWDAeFlgoh^rHVIc==5d3$zEQa@KvCyy(f)PH!1Q)1^`-{oZTl32M3mjZM6rmVzx^!EwXbG0t6&F|KUCvO# z@>Q&Ss}24hJK7%q+#GMz9=o>rgm!zrJ{G#5sFV75NR-u=p$Ycc^n=go!6(eRHD*UF z<|=O(xPMX0O|C`An|)uayWi;cq=a-r<_$+rD_ICJ#3|uB%R<=D2IN3A+Hxi zCGi~yZN*L=))D!FfY{5Ex#_8DtSDo;aqGAKTI11RsV?M3SO-B+>+&X^G}od^#c|*G z4u9&!D>X6#OcuyXo~js4=LtL7Z`I!V_Y}V#P~nZ~QP1Fm*=o(8#cz-~BR?|rFI?5Q z7YfSl;M(d^w@Enn^G!)$V(!JE7iVUR>jG3NdhVrbo#)3IIZb_2c4e!_OwSdQje61_ ze&6`r8I%|5IkQDa=&jHe_zZxmb3jj+d6oFSSJuZC8$f*5P}&`xxAaq_Hv>A0@+^<` z+~T|FXh)yTzev)R5!~nVFy9*x15f4^nuCZBLREtT_!@ee17{nMbcrevg+>UoT;x_J z*PTW>R~qYcJm09!WSI17dO(#eHN_nrksXoZ3Y6$ye9&%qJ`upk-|t=Nyj#Vid=Nd@ zV;8%ZT=tsbmm6wgzMf+YaFHE0w8CS~KYyl&)H!eY6E#Ff$4p@+mUQ>HsTQ&rRxH(( z7YFa%`A0a4x?|b`u?Yn(mRZ0>G^?@zHu^q}VdUu?lhK`2mw6Kz>l{-$lCcvB`k8;r zW-D@&%I5fa2;?&j(eMHKwvH1f-V}DO-bBu^<6gxr6&{pozIJOWW6VyN`hcJ3Pf>{% zE{O3$E<2*z=Ht>SP~yuM(WTAr0Lh3?cIz6_a)um$h4!p~%eAigJ@fPGR@K~0aR&o< zzAbNTO<7~%MHAjCBSl4L##7r>hACNGto6Z;VG~Mcv`~5|Bhcq#Sj)TKCA(_jAme0z zKh5ZOQx1Kc@X+2gnYrg`hzM=w>LbyxVSAjZU(|OJeg%8o;4?1zwwVoygTpj0Xo%@` z93Va&C^cT8+n`>Ru6|{u*Bu!&4~w+Q+t^E+i9IbcH4rB%yVNFsoZE_={L%o<5I0!U z)zaKIPMy{ca>;`Cs4aNYBzpOsUbrf3##UWY9|T&Ci@9+p;6wJq$?F^Go9HEgU}JnPR%j zB?m++Rs&LHy}jlqPuN!&J8k;F*7eR zjo`wv9kXVcG$}ZTN#dI8`a8h(w;g^; zt^GpedE@O>y`?z~8*_pZ0?)Au;1-%DFP4K@2cPl-5hek|SQj5_eH?I6(JTmvK z3rqOT5&G20KesXjc}|2ju;HM{6Kmjq<-YS7OKaZh{xO#!>m$h%!U$)9_aZL1C911Y z2o86wPh)!+>oy(ufdoM z+AdALH}Q+)LyXfHIb|l%hXsN^oG5BVzFO`Rzg2>p`WL$PvX>AsHFaev)m^fo0urMY z(|f}JhbJ)TfT=qG%u}Yq_=O&_d4Ke2>(UjXMO`2?i9Qz+Lk~i(aey~gfSMJ$jsJd)pWIa@sEOD zlQQ$Xe}MqHm@?h!#A&-ei{^x6EjgQKm<>xIpl(A_s_{|<57T5xa` z`L!K##ZO|PHg}Riw{VWU&9z)^WmQ^O9!ruiaBT1^M@>#*gsf(zGc7feWP&Qd#+_2Y znG)`C%GKX4Vgf?b-1^u4XLuFf31dpvLG5cG`euF1SL5H>1x3a{62&b4Uc@I+*~e($H5-7+|}g^BaToragm*YU{U7qok@KtqM?1W?T?T0-GILS=U&C(I=^{V7F8iIm zrAwXQ#XYlKqm?Izg&nOzq{Bn2aqthg_`E~8{HS3S4y%rqM?-lk%PJTKcs)XWdfreP z^AU{iu;yGv<+PgTG!kP?ZQ_xsMOg0VfNPsUBEmxv_;DQU9Fxz_RPty4luM?}r(lQSN83LBlb&%k(QpJ9dRGN9yZnUKj^_9; zAkShMSTEVlLYIG{(*JP zMG1?W#P6eM0G90a*hA4BII|qzqzfB_*a7!zE%!HNzVGK)dwY2F?JDBqV z0XsENqo zZ-6&#XyD=klQnIjyEw?T3ZhOYpjP5;k8+fyl=W{X-0SfCko)E}5iG$F0d?MSxva`V zFrNtCySyeaZW$TEEG2b675piSS(a|la9aU#($Sz4w>uq_H|(4Y)yz)fHa{{}3Ul$V|af~a8vN>LQp?J z3bn#lJhl2C8+1U8(Osz_1xz(tHDt^OlJ|wHzl50Ll{7AyPOtWx9#9#YLbYYDkMlSz zfOv=k+RDrt$pdA#^OQ0=NB$zO^sD01n)5STx9(BTOuJ?7&(S4i?iGsTX?%RCB{eVS zcYXWj28JV>f%ItJQ^zrKcs zn0d{`)$=lAQrr)WOrtXoMkwPzm34HQi0vQGabpBzMl{b0FTbzCl+R>*Uw)#y%2Bn< zds2y)NPGeQQ*M>`&J6;U*jezA5bM)T5*Um^G6;?c`#9$n6`*OW`Q;PAW-zjZ;~DnF zlUj!s`__`sV3CmIDw0_jE?EWTckzhS&&wRF1>v%A*bF%Rgp)Vb_@O8s(LjDZJBc$# z>UqbwJ}hM|2horRuOeFA+GV`L6*(7OIsxDz%`lr-MB?olRw8%`Ovx;Qcx($@V}s-2 zvcD*YK=+f9Kyq0(OMGcKUdUk*oF1kn)<|^LM!s1FtA8usUgnO}H$&&s_5q=ZLsp3` ztM;6s%z&64@3-Fym#|0vRJoeEEQ!^R#+bXLNZUqA>c34E9Dlf{di4q7H;rlw$Yz<s@X>v7 zQoNE3>mqF(J5wZt))-})>)E-$&xrv7Bei%oz0yiwFsOTg9=~>d_8K_kb z))ai;Ux{-e%8dSyl9Y5kaED^1RrMI{iCbOWANtlk43CpqbEr6a><`_*H(o#6cLe1^ zYfp_v{3m1JB59aFTQOcIk40zINob0JtKynei@hB+HJFMIv>c~!@;mKAGo#AJKMQ+P zGBgUhvRtj}PVwtz=4)M-d$m*5RaYq`6jBZvgu0A!<7M1akLb&pXgqjnwl@AqoHUU* zBlKpo%RLFzF0Rwla=&N>b;_7k17xUwNi|NOG*UIlU9e~jvd}Es;JFYFlA{bp&hp~2 zF43~Vf!M}KBw|EV-3Y=FRJC@?O3CC{3-wJCGxHd6Od6hGw_Z2>guPr~)8NZDn9K~q zTN70;!7Kx%O$veLrwh1w&~@8Y=JRG?+3dV;O2fSGA{6RkXwK{pUb>(DHD(%MPsSEN z51DlNebkxP13zwV>!mH@UzMZN&E#0sgFBg}RZ}$bc&PcHJ!`r}uK3Is&#{OXlH#J- zlX7cqIbTUv>&;fA52kxyO_Kmu&9eC!X|B2uGS!aZRa&+KE|tbR^>gKx9wC=5v;i{1 z%Lp#*ob7*y#C=wrVK-~M!T*-ENqf8V;Os@B4?{un1Z zq22Q!5__j)OPr?pJA;I(mM*bE=oT6|GlfycIy!^P}<|kmOX%6&w&jz zk*sJbckdF^I*Pe{a%U8|t?=Gfd+Q-fbWoNnwBJ)&tYu2tTGv4zf(^LINa2X^Q{Hbn zx|4T3j>!j8V%fg1^zK!BwN(?WK5nh+X^w=|vkN3j(oCWCDt5R5lFEtRkZNpM7Vj@T zs_q-5N)W%vFTI+m+(jfpQLDyKUGppP!=|NYXo4Sqy~lkt2NiiDTQsM~!pYR=jNJGv zCM1xAP1fADjrvLAt)*0Y)HOF}1$%ZvIW|(`Sms|G7tQ#<=L_2rrHA>6KlRq?Djrk!=l)|`&BcF*pyRX_}~RRlvs7NNxfGvVnN5{+n}8F^_d$z!UGn?w^zXS#Q(; zrzN*}P3@VP)xN0(^XMBl%!$>Br?Zo9&nK!RgwuwAAxdwL#n$oitGrNC8f z!$AO%!sCda?aCx}+#G4ySQF^-5o<=&A~9@S|FaZNbTDKNHoIB0P@DJwg{Ib(;Hqh= z23k6#_tg_lzIOEVu<8&jkn>k~bbm9kM&?7|%MFMn4F zD;_x+OA`h>dg3zC9E{&4ml~Tzb3r*ucrq3nn*&`>1|Ibu<4lRZN){V%M8W)|{NLk0 zYLi<`XAl+CFhYf$?F2oMJ=VRL;oa@1);LH0{^3t;;zZkcc`Y}%JbEE zxZ=JF0OQTLo%fpcB0Lm0jyQgMZ!5h*L|R?HEzvb7G+v`9Y%8-uD%Q59;m_J)V~5pX zVlgeus*tsN3M7o!sXRrGXG}~E?rd$x2c>n%-)pG24;B&T{ z@$t!O6osAY#ZH#FprkmZB#|byL^vJm^s6u4B3V~Ti$0$z@|TLmbBn@J5fM?znT)SM zAmVMf{G%m|<7clKj`(;3Ia67*U_vY&1yQE`fO{<45~XK-j)3xgFq@9N*SKcE@7k{(yirRQc*Bcyvdt zIV4=H&3^v=9Y_02cQarqhNSDp-JP4K{$TMKm_(W{EwihpGWoE71d*9wG(Sf@hh&i2 zmOEORxVfS_WAep*Bf-^dZmM4U)nkkHJK5UA&JL$mAVh?(J5I>4JE78pcaNOhT%iYj zEN|zsy-W^${I1F6=ELTl^!eVAh)@}rcklX>^_na3(%GhrsRS1(;D&}sI9k!CT)#7O zZOa*-Z?h?P_&YN8%YaH#XlCuk)T77}m|%18k@Mq*h##ySQ2(u`cYBH$-PuWx)Kx?z z8Zc&a8`(>${h3>VyFNMFN6$IO3xth7;`}5IS#)=D@*(|6Z?vmmiN4V-!M`Dj6-gAb zYY34y>JBR$nP%tTTjUM5#KYM;dPdypcw=O}j3kn!Tc zdEEv+d3h~M8V99K2Rvf?9_*N|?zK!5;PEz>zRO>zC+L$K-RyDaHZ}&As`FWmW7(ds z#9ZH8=|SJiM(&2qe}8}O$hX754yj^MLYWm4l#p=<)b8+O5Gm)O4D3&oQ>&(=8xEy) z}@ujHmNa`Hg%NpK=Hayi?-q;>kVSk&KsMkwt|xHH!xY@CmcOe^Z#sFKNQKJNZX~ znoB3Ca;3o$|M%Y3&fJzaPVYo{D2kYfh-vMGZS{92N>dog=4MEyNZSA+#H=(4l=g9x z5J2L4@O#AbaUKDPyFeq=P0%=Q&02qT?QsUJyn9Y}m2eFXzV7XbOV(m#Ee==oY5n#m zApGsVA3XxEx{zsOqzt3K&NiB!yd#cGnUhB|F5cG-K<_>zR}s(jiv;c(D`m$#UU7t7*cM$S6y~Czbk`i$Fs>JIN|rCX4(# zs-4K{^*Y`p`kn{J=K~LNh{9G=baq1Oi$@);Uu5m`Q}5+Z`dGwzRCWD1C08$)>GeB6 zYz!4!aWuYMnM&;;9;C zO$B58DPQ>%q$<>GKgsDa42po(`zc~>h|hGGD`+(xA;}5Z%8#3#rf%5jZhUt3Zy8Ns zfgKOw`c`Uf4}VxAO6GeHo7yF=R^@)Q*knxP8`0T&34jwXuCfOYn~#}k)&rrN4DDWr z-*ZXnY1bHv&Zu0^2*BDZ0UuezSmZi&uB8t}9)CpN`DG>Wu5m?L*|1ukt(&gj`LeZ# zc(s+LG2kWY*&gl5=f06xiqP5_>HU(q`zOlqCesV3S43WLt8u&Gjhv9yJ1*vTB@yyY49pfY5@0^GN47N8)89yB98E+*MmNs6qnU&z0Aaq^!Sx}rM_|L7x}CY;lhed1g?w?kKs%i z@Uva@%Q9FMHyI<7k`@=yo2&k=kIAlXSIF%QXKsx3TjN#JrHjgpWWgH_b{dDtH(S7a zzi3tU^=bAnP5d1a!ogC&J)#GZ_Q2a+cFR~2b2HYco6aSbWRR@Cp2Okgg5#H4cdjY~Gu-?auaoGZX89O!VS*Jvll-+?bYeF(H ztn4&Jl%-v%D3!T=fnTyjAM%rlV=42)D;+vwj?vE2GW}U|b{a`UHo|y1gBCP_Spr^J zpW@i*C>0pn-I^AMoga$}C-jhk8!Cf?hkGb2a13^<{ix!?E{Vo=zF5-@ys{&;_!V&j zU+4`=V_l7{wC<}KNPDo72_<10X=A(kk<{!zJi3r+!ls{p(E`xE6Nl&zq`B`$n4prg13=Sr>paZp$CCsWO@)=;ClUv6Z8p#oS{I_mZZm z9#Q_WFTRrTOj=2zH);lW0#HQ3oZS#9=)#rA<4AUeZ3>G$zU*_Vc(TD7ZR;qxCBr??Ynp6c*h3PGE_TKEC_*zmawh7$Tf*;qA%u~?005j-!0+r zgqi8|l#N-5b_9pV#*68b6=MpNHHAf5Ra9WV&{88z6C9Niys{i?Hbc%5~{*YPO0T8fX4gXKEJMDT;bbFZ|MvG>^2_MxgAiV z+1tZxk^CGmz0MIBYnL63$lZILe)lsY_jv@{Y4EmU9Gty-du8SPKLJB&A0MTIzrQWP zdVBXpSc0Pfm5B`s*u(sk2T(>sQSa2^Uk#v1&iSW2pTHW|Qp_49r%Udwr!fx!DnDZd zFrC+zQziUtqEn#B=i?A!@<*}Z%qpjIw zhhkIfd{Qo!`JV|!DSUI$o)W;NG+v&3gXf=RcT{ah>mi~C>?|*# zF$Ir;E@q-PIp^lS>t9UjlkIaYm>5in&v!=}ei7$nnSHOzd|iPRG-GYy)2eqLa9_=^ z0V|@+yj(IXc$$4+K$dM@`T~m9f8f&xg%E(59rLM#z6L1cH=>E{#H*fh0Oo1p{w_=h z5RSTCijn{pPo|J0xD%>FYmFM`{1ErsN7bC>fai5Cvdn^)D6a8$rDu}ad0WhOjNC)!>gyl;eo+?V$u zfJR}|q~C(exD_EV0ceJ&X7A(!A|Tlx*=o;xd%7dvV|)Em_jCI*m*@c_(y!Yu&$(<{(?wzyoexB16oTSvi7rU>#2d?MSEKdP^{aAL)y(FX z6V$#pdSa0I?dV&pbuNKl5=KvaqPG#st|lBYem*UUNvRZ;n`N~{NT55)%#^Gk9GJ!r zm*Y#n^)VoQj{bo@WJ1Hy(wL0kGCSFYD9T^!^Whj10whV)!nf7a7kmM4al*WI7F(K~ zJXeWBD~L*>FVwF$Z%?q~FWcl72jp)smL!HOc>B5QKWG^IsT3% z`Mw&x1}gg<5OUfsHuMyW_ax2s&Yr&qfkBeL&nBL55{;p4P$9?o?iOc@#$C5!XiWMq z<4L<~v09vVo-PI9KH!z|z&vNO`Gv;$K?Z!U$=_n=r?2NcE9jb#@%mut#NI;aEnd&?0)r8)@j!r zy#LgOtQOfcuhdt5R+z0F)9!*|8%|mGj4V9kKhR5sfiNx)5%px{n#Rrz(jgOeyOM@+ zde+7%qAuM7l+H9y&T7)9BFTlKQBznwZRQ*&+*Owl)x z@?~ql1N}4j?U7qr8eg(zNvxhLe8RXR_gVDqzCP}6J9&1I@w?k*5gJidLCWE?lXt{S zD3L4lV~8wHvponuC_4p{?QrZk5rInVNEJj*ppWwXhMk88P~;Zqs{9tO{5mdnRgWI< zL+rjX;Gl|{fm07W3dk>Mi8j+*PRV2mAM;pd^UI_#wSCvQGa+B+MdzzN3U5~6@y)s) zUd4a^;pm>8mgAdFF7g-Su4hKs!5p!iF8xRVY>NJtPA+x<^ReL%acD+{ULhNd;;a3@Lsxf~y!JR9${xPxr_i{OPLOMA53=7z|yohtNyCr@$LCm*;o4q+dpAWsEoe zRd92DR#1>ISno;6J{Ho^%pUKbXCH|D2as87Iu}YuWJ|=@!s2|X!FPC**>=17(zKX{ zMGq-|vZJS-LwksLIV8@CH3B5JFo;%%cD_CIl?zgmKuVyv z6}&e*5NSkRRZS|@IAKQ>e(~AFWw-k}OY9?}q=tizvY#6+fR>k1xKUx+rzs@8!#U2vpnw^^UCNC$F7L`1no$4b+j$dS-)w0IG$ zKvJs@BSAq&7uTm;$ZS>7R+rRMh51mMbm3LI9?s?%QvoQm<`i1w;qrr$JXtMnfNUZN@7Z6! zEXc8>Ro3M+lt+m!(~V|hShK!7ovl@c`E=-S5DI!_BeTstdXC=rNH;S$J-!(gph6JiXcyOK>v6i84jZ=PwG4)7WqJrG zP2j-n3-pWg6CF_!z9(cS&FsUKZc^B|G5g9WYjp_&2Su>+kD+hrZB4>Vkyn2wIPRQ))fI$7%nY?^ zy@_Lp%*b%&>fMAYE2HYA{O$qPIQw*U>>Q&S{4v90zNu1dGa|bs6$Y#8GkIP)qfMTK z8Ty|k_53FFaa^og4(k3B*VF1o>Za)hdoaT9Q<6k@SUMO@rRBIj))9)di$W$93YBHE zEizs6ZaF=nU=tiip6=<-;>le|vDWXJ8G24c-#489kwoi3V(W2M(9w{%2!)#k<~jNr z%2+cAIXwJx-fPQ~^ezKGx*ofGx#^|91OmAGFZHOt3UPC=-eHAdJW=G((toOSuX8&U zTy%7#H7JgJSnS^s_d+>I*Tb}v_x@3-K^VD4`XkIMh;Y@-yEPSGbnyyZc5M=2l&?? znhy{8wM+n-K0IRw6Fj3|L+f4g$V=JrniLQwBZMg|zmG4M1Eh4+y}^T)V=NMjB zxUKCbjcwaDRvI<7wc^IsN|VNEY_Hh1?Iw-g*tTta+2?%wT-W?Hf4x&Ti(3x^IDWOq$)B~QI4g((}r_D zz$YOx>)E5UZirXYlk^+1OLCo5i2AGuh48UQT-QM|iO|-g#OT!*2+nJ!osAml+*emD z+r^z&&<@~b8~kB4Ny&X>IiT6mcieRKbVP`Aa_{W3z){l#%XRSecEq+Ck=wk-`bGAF zWN)TJA2Z}5quJ`|3YeJF{d@H=m^U-hjg4Jpa4eQ~O^b{;gMcYS7Qn6*7+nPDeu)C= zW%j_eNE8GaJ;!ofLv-6P>n8WBZbNa=tH`H_1F=J#9?t$z*49J zZryg8kkQ4dEq|U)n466kLg3)%rs<~TtOLkw{qbB^3Oe|-zn)?@^{{rYf(r<1DZs)Q zGs-}rg-DH|!7twJa}yP6zKw_slBX}!;KAEA-6Gpb%ffq6AW9>{OO{PyBGdE1mrI9G z`XdeM@M}%gw%Zs|(qJ^PuceLGQWtL<;pLvFV3hA@7{74c4qKE~3j2Ej+WHAA&B|2B z#*f@i&+ta&{KHGp)Jwlrmd6=VLgUjywuU@GbVZ#nxAji#ZrF>7iGuMTllQl(Ge$Pr zLN#@;Qr+?f8`oF?lR)IvwZ2@_2&Ab9PUNw>Jd$;QvHhpi3;%j8*)TF_IM)o)j)I#q zq=71hFufN$b|aGU-dVlt!F>5)t@pTq-sigSCX(f`;X>KVoTQK%nhLI#^z_I?XJ6CW zp1n|lk0WM^2gUG^G4YczTNv+>g5yiieE zzLt|6mT9a9aQAI4c1W{~T3KoCbZu-sU(*Y{%)zGK1iL_1{-@hQ$N+BMs{VM+|M#i9 zN>5G2KZD855tLLjC%pE|v&TDTF9m5AJRNFG67A7SFSVDxrrA&rw_u#>I{RX&G&{*~ zmQO7*C_p1AFEBC(f~rlY1t|Mgnfphk{EH8Te>hO6{|Jg*Jv5GqtVY5o#;3*hR<>(X zVfi~t`6Gcq_^CKpZicQrxO%BCIDEo;2+XmS1P#5sA zl)Zf$a?s+nFy*GXU(}cv%3EGv%5%mL8=69G)7Hv}(&Q-&Px&8@A6%$EPFC{vG_F69 z2j0aX#-#$dN(T+0M4T6U#%8PJW~Hzf>(I9pPp%_MjiMxq*mpRqr@4!u2D!Uzs`55t zZ}bykYUhfs6eOKCaDs;3-(zN7?F5V6e;4b2!{S=yZZ4y8#=p{wJI~OPtUkj?#$ujs-c&yd`DndMhAT{UQ+F7a=v?UC4fs(T z`HGL#-m0Hf&E^KEXa);;%Gv+zCT@^uPZczr?mVC@T=pJxk07ckRxY5vn3>*L$= zT(wVPYb)OwtW-$!!gqUtG!)tW;A;^=N^os@9Yr%^m-U=^eJI*uPR7FN{$7W~TG?Lx zey3>B{N9XQ`^RuON2+>mcYp}F9LPjn9I{^FADMz&x&3muIK3K1fC@)>x;Id|c~uV^ zUd^X05h`3&YInbCM4f7L-2WI=R}{x=ueD`>h2vXw`(KZ8a!&B+2+#bi1*gk9m4zqm zW%*OPm%*Se;@z4SA&oQU-^eKWZS>v`a|#TeSPdPCB%>^Yy8;d7{p892(P&Hte9-u5 zelABR#leUPI9EhdDEjZJDUgCXIY+u7uX40NJWjiCm?Ldm6qI-_KaMh74>E~|N_4gI z7`{vM0r9ECnH2V@rtM*m+sOCamIbQ>g=&Sg&D%HIq)%YE^U{y2(fwAkt^@AuI*1?7 zAeb8IPl)0v*(sMm1hxtF2)uE5&eQls$%8*w}=atx`mG4d1=*O~ybq7^#2b z^@D;+T!-^OS!XZwSdA0EU*l)RhP0f1Yth-g2RIq`GE`g!de7FXgjNG?CS!$uFAPa| z0f1LSYp$%PDjm57sb-*9T#59ey!*@CYE3bintUR9NqeBk{PIyW(4Uc~RMwMDSn1fq zsAvR7fwELJ{QhrgA!D-4Xp_UWTp3&_g(5pgIb8a)U&P+bDaRhcU5a7rs4hJvmAKZ@ zFui?#oPMcPxnVRmp~`TmAYVe#{ha9_G=8==Fo`m2IeKl?XMtGH^9QejyLqtGfFm?= zgME8iT7kqf4UUAXnN9O*lB4`dRh(UdO8wd>U6sjAn+AaP8F)G1m0RYcMxg2vpnUJa z=o&Yo$=W0x7WV`s+<>&Si}NwCTEWg)HP{1JZVia73^hQfW(6e8dTfBP5Z4bp(LhXq!b9dz0PXFZQi|r9$v@8ynNYBgZop z14=ooaiwBcpWn1}EE;*eVAkoY08f)ThF-=L1v*Sn?TfdjrbAcSNtONn>aa;9YfEE# zej2PSkC{~Yv*C#aH;%P|<&B(6SL*GmEct#Vm4taiRDG9nh48Fo_w6fazS64aG&4_0 z@HjE7cwFj;*AAs(OiaQ0zY5I{sLuf#i@@&|8kI%t_Tb5lH~r}BuAHF1jeUi&sc{lU zGM`vkz7&6h4tvzk({0Qr(j?z{1ciMv5(M)f15}2yB^7QM%0>}FW89nofn$BtahY*> z65=)$)&F`q7>%*fuj4cH#ZB~?gO=!X1X$d>`U>}zHPk+7YzPp^gxx)oism>={n)0o zeF>VeQi^rR8`JS1R|y$?!n?$vK0>cCW;eEoF}~J#sUb~w?YMms2E0a;C1`~eBQB@ML-{vD`LDaR765ORR?B)-y|uoow~&%?4m2*BSX+3`?nBMU)YoH8 zg0gTKIkp-=y>v!w1+p#}v4}>VymZ5M1_wRqkt!Zzj36vVNr9GcT@--UmzE)6=7NlE zrYhM15wlXMSJl<3+&76)d^V(1AAvM|5l--q6=}}Fkha+1NvN&Do1i9Vs?Hs6ooZt2 zmQ?VHV0~OREYFU94HGIiTv+RZ49inR(GO`Jktj{}TUXjfdxfUT%Jx%*hkw#Obf}s# zyNiTinjvd*Og|*w+uk6}W=z4%nDCkhDJv%@Q_D~dWuJsYgKv190L}_?_DJyygO1uf zz)6g?|LJ&~XmTt6?J^|jOSwcieROZQ4uLhpuuT2V4bv8OZ+5({XysVzY9zp)1r^4V zAxMI6QNgI<%8E({Np!^9E#pRhoHZ^ZPUeS?{Bb%qB(Wy3l)V-5-JDs$a$cHN{Ko15 z%YQ|ihTNYr$Qg@?*jP2$TqpmKY`%&36*)4~T+p4t`qPB2wr;wZ)r>X6r>{Xs0_uT6NoBa4J~ zqYEqH0#_^}6+27Y(Bm#w*6-yqCD=~WP!lOqEsi3iMwWe4q zx+>vXLNSqip#+%pRoeaU#QaOj*-E|((B`-u;uSKpXKjAJNSEmli?FuMAh?9SiPN

    VwVt1VwJ^VZA~+FOFBpid(iSb$+kD|0|8GfRb%MT#0^fGUCA7S`3GIH2oeLoC zphY`yi?MIe8p7&xU^Ia|VU<1v9<95o%I|P|h4ec$pWpX%dkjJSM_a($bGQX-_-Rf| zO!~(mw78@p#f=CldLk~~P}aJyAIvDaR|W%#8*}|9hIIGv$%uS%1Zi`e+A#byNQ?!B zHDiBv$pA+{D3O5Q9UmObOI;7HvnBtCV38j_qFS=UvkNQOGp~2s!V`X+i1}<8=9jT# z*3PgxT2IO34UgvwKQah=>?2{K9HnP)%=7NgJoP$BiXL&P6C9nKQWk=^TL*l)u1l4i z8)!vcOt9~Nqb7`tFCaeL1iVBW%Q8|iv-I`#agn#9Eyq)MIa5X|vJAOBrVxHp`tVOZ z9RobWwx?)c#(@pTHCD7{J{FT7PkBjq6DLGg8A6Mg;4%^d=+ZxAwBc|L3O8McjLC)v z4pRr8dSar7GFZv@$@_NusDzw3G!o4MaR-k`Q+u!sC!#yk;U9#CfBC)&yjOgiSC{TA zZg-Nbnhp4G>}n>&@|%xTOnhS#Va3hw&@(5XZIYQ1(scPhxHN@kk6YH;5zeL2d|~%A>3(yeSFMlq zjdnZURC=e;ua`8UeTcC7NO}TN&1jzp)n>-;1Egvxza9LRwp6r#QzfKkvWQRn3ldPA zMqzLhz>g5AWN~4r*-|Z@a@f;sS6nUH!Pv$d0H>t2UFhe|f+~_0%2v6-rUj+U{$mr! z>=#i#FzT!$2TYLhO&Q8^C~w^S(LO1jA^s@=M!oN`=2|2g5%_U(Prsw3yG`n?oz<2G z8Tn5O0*Nr914iOc`z0KYVX5H{uby01bUTEF59g$hn37+Be?8a4C zwV36tSBz65lsh9!G2y zTF02Cn1VKQ!cLNiTItLQI<8_Zr7}2HPAAG&;ZNkYqiR#SOjUZt-0*!CAhAj(@Wo~m z9WR}&_z9XhV`}Y4lfs{)O@`%%ZyUfPJw7N5>H2Hvd&~N?2`fBC+kMZLU)M4-FaO^t z@_{}j4^YhdCZVT@-R^o}GFf$2VW=Vb!v_zR-jpg3kCeoCI7zG&E&J-7yhz`uZgf-{ zr1Vda%g=Bz&)0{57MtjOZKc)zz{9^&>GJNP`!_9l!a$iQ%r_;rBRETO00We>kx?8t z9C_8_=FV16Lv)C5p#L2GG^iZl_$XN=+>m|04S+d#+qLN9mnIg9>`$NzT2 zHOLyg_*S*CH}LfZ(9)Q=x%x#c!qu8#1|RT-a1)Faem$d2bZ+DbLO1c^A#O);a#Z^o zmjf$jfY{u*L;R`DwQg$0p8D8M5b(~6`9xSIBQD=>3~hC$(oNit1GN1OVFeg?~Qz{q5>N0-lWoE$-RR9h`UZc32xrX<3tIL_t8eyivc zwpYXuHJlr9%SSm|wbaAy*`%8C!_>7UIhUT7ud(uUu|8WtfqLvVdv__>bEsrxtg?As zTFN=o{6Iezuc*B_By0&zp&i9}6nOz;`9cs+aq|;-vScFsF7>}r$PU@8*XZ$3N|@kn zM5~J;(Dn0mN)i){nP083l9E>|U$@j5G0Q8I$Wgmsy@J6GV+qG0p2%4p4dQ|ILWrn2Y#Xi9c&)E)eN=8Yxs56bR(x9splfpv%I94k_B~@!^vHV@r8;=_!yrh_jB8CH3)jeQDKXZu1 z*`_}+kH=>jP*ThQV{DI49m8dStYM2%%C31djbg{Nm*EvXj;fphs!D8!s!O2{U|&cG&-X?4d1DVM7<5(bI2vhu-Rurizu2#@n=tL z>JZem8T8Syq5yJ1$Qv~ov1O?{0-JN$ z7nZqt)elfBLhVEC4LduFgW>6`?2ED4;1F1|Nmjdx_g+YHV73@Y!nYfkRK?;Ofkqkj zIhOV%9EWkbl!|*aWnhVEQGrLM8LpMvlH~=w6s{dw!BNSkYrD9!Q|J(AizuVf)rJgG zL|?8!vl#ZHX9Z&a!k1gn+XL8;=- zYL-e}O>yg2Ly%vCW>z2TjGvNYJV8;7wwib~gY#K^UIg?F2=fTl4wU0^zguUpMkPL1 z!06O~6h+1%>{JRy5>2S}|L=CfvP+hV4HAA=k+*}$x3Uc43f7nvNyPEg$vs_ZR9;;U z|6%4=C!c|RH7DIxho0mtDxa@{U8gHuZxyV@>XSVAb_r+V6ETaa@-yY>NYUqZC_uo| z2q$}gMjNiJO_Et)cdDr3bNuPfR7|>a)-5fEXo3_2fcevnD^<@1BxAW zJ<8RaIpa6v)?E#3co@<`uhe!VSUp0%KAiTM1szloxpb zewjjRDS)Zjcw_fxDQEA@lrcVE|LR6ekb^hPj*6x@J}F63)t}k?Z`rOI%VE-)qOXQB z)UaifK^ZIcKaz5#K{GZZ)vC>Dj!%ENe|lKK`4AKXbPy6Dl;lVCbgt#sUU{dvlxZtM zW(Y=qaQtg&VWQ5|UOBf>rUyG94aWJwn2-`p#mqE6%8vIy4O3Vu!d-N~B(NM|QJ~$1FXu;-HX%z2$^b%6= z#Meyk4wMe^7a`Xe3BnWY5DOGl!I+UA=u6kKq9^woAn$aeiU944BUCj~2<>Gn*5>4U6e>NpLS&>qxcYeyJL z_U<1(NScY(`}d=4ESV=volMi{i}_tUk4=uS$M=Cl^@h(9L98*d!mvTFWe}QRzRjD> zWJajuVW+tp@iLR;o_4wMeA2epTc2(Xg;5 zBt^BiZp{-ewcAn7xnD8KN3oyyaj&3E>6jWhx*;_yp}Wp0q5DtsaPxv~#O>@YBL>lo z@GZC`X-^vfl5y*pRz8BtlmcuxocPl{2H*Imp_| zDxQ?X7R3n^58||GeOmSg7wO=gctwZAAgid({I)t~qJ`DR(&SY|gH5`X)zlDod(DLf z{NoOhk=6tmA-CV3nrt+=h#x%Tk)&_G#tph1N~2yKX`FT+k(r5>(X_{0{pp39cS0uGi?fK{;wYMFGJ-8X0i_;$q*`QMP!*cPYE>%j9>J1sCL$*EQdI)M zhQ`haXYCL5RV*ai6a^o!q$W@?(Y7DV>nz7n ze~O|I^YdT`d-_?#=>1{rJHMk4&zI!5PG796j60e^b@VBXeQW<^e8|^(Q=LIxX-8N& z?$W39>-sW(lI^r!6{w~plIGWYO#ph$7kJ)vzKsqlwO$%3%e0~AdBW#=p+FV(hH~)X ze{rp%UEuAJVG;#dC4iudzB8O^Uca(YV^{E3~Z*OZ(zl#E|Z# zCb!p670$GrdFWgxIA;6CT?qML)yY~~mC^F@$93cp6)6h*O&ElwTXEy&JztS8Gm2Y3 zXPNlqmrQ14&JoXz>3hWwX0?a%8dI>>$8zhsI?qKTo2INrju_V+jG>dbzhn8xp`_oR z7PWFg4_@+RJzmX3itm(`R+0-+$K{oobG*F?ybkT$j>D8#u9IzKYeq&38Mxh3w@Dp@ zmCdF6H;HS;7(pDYgL$TS(s1eHn*`-eN+~)~KZTJ)&g(7fj;6FdBIL(G&hy}G6Oo#D z{EOnQ2S=w7u^1eht{=@r0=&+lBPGuCG%OBkaVKpES{*^`&F}A|Glv2LZ%UnGe-5GK zgb+WWYgR*uGyLc|cKWc|=CGY=EF(dd8W#9htvK30p}7?DHV!B`tACf?OkU2$aegXC zHhFiQXD-%dj{D>U?nltD)2oVlc>0(AeS!6PsBXy}?yIGIGv%!+`co&ar-{Rbdbb+;3&7jJz>bGcLyZvE!0a@WBy^(lqlu)9+Z4###LL+9nn<N z!GTc(Iw7xOxOU!MCDQ#gg+pmBn4060tpjHgA5epJdXl0gy#k5>plbojgnA(7$P#10 z9RIw`22n#Z?^XtZk@>%yB23FYSdW!CSUPqE=k2K1?{eY#I8=oaODzMe9J>u_s_KD! zyS?#R5+*7bYioi~oaJ;AY#dui^&W#RtMq}MEuMHbTRJ)%6t}Gkwt_WEp$`!PPp|MS zDA8L#+u4F%>9E~g^ciU`&<;WlY75P#8;k^(m_WBj2d#_31FNr)B-N;%#*h=kECv8j z#>BbGD^;!Chfo=knt+RWVDEj@uH->V?(cNp1D@;TiL2=#_ha1^c!giiPL^qXvrMm? zf_1+=!q#)0^m5^#=a{)PaDLqKJ2E{PFYo;b?E|ZOsjaDQjOv{d8qKRf(q1>vPIVYz@KJ=3fKXE4_$#OMel;!^F-UizV=F&2`k7WDC z7eoFAf~=GWP_*n9UlwcrOCsJK&d;PX9A4V9)0>MQYwmicR=l5t6H!q?33x<;2V>#> zfESmMi85(;fhwMKnWm>==mrUfpq^4O^7UDMpsC$NU}ZIATuN_U?$xHJhL%XZQ%MEZ!h|8WN`h9yH5r2FJUh)nBaFk`?MEJa z5?O-63>;N^$8Vl=*c@CeE^@pnS64PwWf+) z+P3roS7D<@q`=G9bN5p!dvb%^AHN%BZRN9!vV4xM+N6TMz{u}vIsEvWrdqM}Ws!r< zp{!5npWMS@g}LmNxrkja;?n`&)hT9&n``VQ_Hh08Y0Q~x;9OT)aJcA5S$SwZ%+XO6 zd1Zyj^Qa^j7ENtSY#9@$bACeKf%&li37^mH&HX{WL;f(vW{4yvyRO@ zdZa)T3_P}mQaXz=z$&@wgrMyHp4pb{SuWwp)eo1fQ)HE8Wx4IKFSHX6=-FDqbKHH- zti%=rTm2_GvCvC+1?n}PgCqou(<#|_CVKmBs+uGK7`LND&dA9jii(!FI|Y0_uWfh( zzOg76bPF@zveV4Ud3g-Xq)}zUCUu!yvhz}vB>7aX<|Krk6f@J_+*VQNd!oH_ z-#1vH`$CH$8=b-9aNBJr94=OrGM~ywty;Z2^PMto$xxZu6Qh6SwkpIK9#`zq8HBV< z2O3?WzHwE_+1UQRY4kCq4^!}6?-$vdCfS}Tfn_N3S_eNkE5VE(N!roZbh)QmiIZEK zb=6zg;;%k>LaZd@g$L1sqqU#ZgYEbl?ZoC#Y z1a8nJ?>zLR6Vvu)8=X@w{*=P+5C_jRa6@K3e58rDPip!C&yU)Y2LdU2MgoW|9g?ix z2Qim{1xm=sjvu^TLzo8w1#^b|#NEI63-MhAy2!R_jftJFNFV z7&rR5PEb^|;#mJ$L&ym*xJ8KUr)pGjjAp>$Ge3ee8yvz!$eUt>K4Zg?eLm61J`j<- zI?8km$AI&nih@Dv%=K}c#2DqqGpf+l(gmB*m`N0qEk}YaFzN5&;C0z*t%(_nT(f1! zG5xDh1_>#-Zmi#o(&b|Pfm3i)S_Omn`_Bz+ZFxbdhcV-^;>I@l|2}lf7-%Lg9nQ*-SwEBA;AvIa{2WB3u)i2JN&4d2_48pRSmFDmctJ{->D~1 zCgNjLrL?vAsHvZ@G{FgWAm{U0cbW_zkoC$Z>koIkiYO7jKyr;W6ob4m2qR1rQ*bRaGFp+1z5e?r%f_m;tU9*$8smCf zG(#8!8B!X{eFhDM%=69lBJa<_Wd39Zd1+mM%iI!R$EIcHk7NqpXoQ7DiM3&X)w94s zFcFYRG&-=e-)v7+O+zk8Av8t7o%?D#K|(@Nk!2#)$U{T=Hq2=tP`PwG)PW{f)qr_> zy4>v`M5u2f9?n7$*-}K_M;3;B5`MVV^kBgG{OQI0v7ZHBDZ61ZfSNw&(TzXgty4Z4 znWGjkD!M4?t_^>6ZZr`MfKS0>*V(S2EmQ@kM^3Vjolo z$d7x5;q6Gv$@LRCZKFyIDb#Fbkf4J|s5)DMg6k;aBhgPqWs{RK`u4yGGWy$Nt;5uAZ;@mh~7I9dn zj^p2gTsPC<_RUCXHQfM+)bj;A|`(+i)VKBw?Z;>K7_yzk<^Q2a0OE4|}SGKUzjG6pdfXx($5<{cO_ zR(6&$XA5+K!@t5yD7CX9=MyhHJG;mQP~@t`YF9g0?p&bJQK!6o^Nf9Sbe7sbHZlo9|GMpGtaS@xwMN zcJ{*q9Sr(r9e?{9_TZF=#V|Cqpp+J^i%;8>dT)AaRoq#H!2BbR31;7neG`+SC;!K_%siBUc~rZ zU&dv&dplb0v_6epDb-eIalTyg-*=;0NjR;}rm}V!SL}S1orNuud{jMT3Y}174CMD0 z+5#eEy{GNR-?B9gTFmMLxk~I zb1R~#iT9eJKh&S;7`!dO?`$$Jc`Efh10%3MnPwX~M3Z?C6Et^7RnMAILYvdxKkg@> z0A(k#e|;~Q8}Gfp!sqIX!l9A%8AIW*nX$RakPRTYo~r8&%lFF&aF)tar>4pDr^=gK zbI1s|F2Q3uu8sf#%mqt6jZl*ab`O}0t%Scx&D z0@0n`0YzKNj$_KxGXHBEe`uVo{4xH`04vR%7vPp$c!g{(U`^!F<=~*tUYfy`doXPO z*YE6KT(hK7js*v!7g`M)i|f)4x=&A6ADAPQwromoA7W;Q7hfEh#2pa#de}>-!I@-m z{$#Ivy($0-$ma#eRz2(e)0yC(XsQS!HCyv5v4ZQ7xIUkxD7=GIV|45VN&$Ha_X@9E z8IS27zXK^>BtqPy6UFI|BrtX3YN&=~MKvA>%^^lrfNp=WzAi0Wp6~Xe;LvLKa14U1%6k`vVZTpgk+$OmM+nYPD?GgWvo7|sd9437{L6vMtvNn>>dn) zN1t5aq*2XN>8UXJ!aA{|AmIip>ai_5dma7zvz^NMCSWsK6O{_Z-40c{WH~WvD-zqs z(@ksMmW{ilefT5WQ-P9PzF!>oEr?#2W#PN~jhFDoU(xjZ&`YE`oeo)H^DMq1j>Yf` zuGpymtP8HUSVI20bBEbFv+@Re>>6_wizr|&Db|0rL%_6r2b_hpMpR;@2(+_PB6LEJlA-p}>-}Kfkn7iC?`F$%c z=C)>jO}3LLvk<5Yn=Dpmag)k!#=9X0A=QdtO%f!q>*toklzZ4q;tW%nE0_md*P6$T zqmYgC|FsP6$?^wR2$=2`P?A%l;}C|~`4As|8Ys5s3ZwW8w#-U@qXvCkwz9O)D|r;p zx|sdX_4r>N<+4%;cwnSTBm$dk;jPPM_s6et7wLo9rMw# zj`%yY;N}~6OWxo3_p>pfnBtm}Q}zUg!DCEI5)i~$qSU#e)OQ2g^#YH`JimqXzy!qQ zM?+bn6&@YYV7}h6(77vUr!8ft31Qwu)E>=`FFM^A2TCnFl~qQZE|Gdp=g4afJ)^4( z9`pLf{DJh4_20g}_@5UK?!(vEDF->&ZA`ZjzZ_?moSqU_LAS|x=Gt8v>AIH{NAOfv zwwIb?WwGhQ{q?k#)~RK!uU!00C3WnI6TnJ1nY{N3 z7~$7RTK`o*Lr)s-RyLBsyCLSH`A}P#CLBb`4Qs>W1A&a4y6M)h$Facqocx7FteX>5 z6|UB(!BZyu2(E<8K%v?gF`mdwSKFAMi zT`&>@1|82^d>UU~YKmqZ`W{GHNC_9>feNTOE_9KEJnMdZ^!b35@?85pn2M6Du!06i ztOEka%f{r(k?f70)(Mft8|$l}vtK4>@vU^#84+et5wRr4gI9=u=`z}J9(-R;T3r4{ z0eO63JWxsge%GVn*|@{5=&nUi=k-OG8&UhW;smj^tG)PG_)>E-F%JA3fB7pIP_wUY zA|fFmV9UI(FORTz)3-0Pt?5jpke#b%M9%HA+NBjv?Poge9nBx9q=L;^z<7^ zKkvI z|MJEEW!nY;?Rp&1aMP@^nyM#P~L4L;QqJ#7SP6Zh37ya8LxXc;<5w{c@SAmy$g!9{^+*(yjOFI=u~`wwshg_?dPG zXcOAM8%J?-s952vwu~ZSFlw*o$La7EV|;xd7XZuIVRwW!QyZ&(9naLEgn-|Fi3zT4 z2-$><;4ZjPjnCUwl+n9>7iW85uQy;|gc<>*r!-AdF9*&CFL&h}HuV@l)-YG{jcJ?x1g1;+s^2Y&1&J?!-`clD6~kQZ8`f=w*PqtJbG zx^i~|ib?VPkB3p%AEWeQ2C_sPh_YxGd?6Ou?kEBCqToI1A35c)CPL93PK9Zv!n;*Tf#RMI!>l6%Qau1eQPfYqN zJnOH<^&=vfIkIG%Q8}K^mEMCyAr#@_(2(^1haF~iTofE494Q7(hYytZCr`t{*IkiQ z_XDWcE6vEOb1N}}mStV`O?FD^zbFx57GLl9i*xh@S(ur2mJUuMwWYHFLEf~w=p4uF zF#%mp4b2U`c9Vk{(_VOA^A9@~BXT1wF0a*4cZP9MdcKvzKb)@mm#wO&P_R%{!~lGS zn4p8e4vf*+#6c=Io2UP9Qa}i?Sy;h5ZV;aDEx62?2bcS!?N^!+gsJr>Q$KIc+%9`y zYu(RO!F$Djxt7BOm4qYpyFF32DqvRM_W0SF+px4{L^6bD;Ip;oGdZ7 zpA#K$gwtUwVZF`wcnW4Q-bi=Yx=c-2{CJjI{MA5;;z=a=tov_(pM*f3EyY$^npNCr z&TG}>qxmwkyA}4Xv5;<9@psU(Dd-pI#eW%32ZbnvzY?pFx?Uv~5RDp>QS5`-v*b(? zf=VpuIS8f4f_jP%ouZ=dUwC5Q&)fY**5!5s0^^!ft{KhiOWfL;IAS4wh~vIDyub^5 z>^r%&Dp4-541V`d+A$+6>7;3!G;RJ9pX6uCdFMO{=%w@l=<;vtJ=3*k}-m+v{(^9*A~6 zI9-IWBDb#{m>u-tMHCW_rbyVGq9)yoWUt@>LKCR3LM?&@*yfSExzc09QkogWLX&`w z_b*E@Z0xHj7HsG@I9g=81mCqj=!US?bM1*d4yXm5Ps^!l>Q%srCB2zW(wvMD4&71` zqj1RlTfa=nM$wBvVnbQ%n39ulGy+sjOTW^^)#-M{47CWqwLP=1u7tl;cYcyM4?W#3 z2{-zbK2A_AUD~!tkN(E}`XG!Eeu2HEM66eHBShikP~FK5dJUZ%5^Kv8&zmU@ES|F! z`GPVwq%cD%$#yy_f6x;P`*jWX-yE-h4KoUTX=!La$-WT6qxWSra{kLHxqsfVhf%NyF3DowX-a4438%4yiAKM9I3KHm27 z7CEQ691(WI3%~pE2=(e0s=#mG*S&hc5^t{PpguWm>6Zj<^m@jF*r|zvc>|2>gsqpc zTfHUJKCwv;Q)4KS=Hz8|2vlwWmeMxhG=w{9*=pu+>E(yQn3$#)1(JdAz}gPjT(Uo7 z4%p5G?@988PU5rc{S&pgEae|Wc5se`KMc*zCG6|%`eiVsIxa(sunXzUVUK)e@uBJe zWE(=L6e<8k6G=1V?TnDC^D7dJXc#;hfoB0%FpK4%y16LeIuQ9GXlL<51QvnNzHdM3 zq^6~cAjlmbF6utdbIgyh*?zF7sIa7xPEy1}AZ#9`;o&DmM)w!pq>bNc?k*{rD0-)- zJuR$}kF#F0;DemKOmD!_S^pTHT+LOI0ph4Hi>399IJr<||U4#P&qhWnM>tNSAKJ(&|-j;CrM@7be5M?1Re*ZuY# z<$;lWbx)DPiHfFv0Ca0=3f{M%uj60oQngTb{>X4OxBsYhWHJ?gr6CMw#8vBxDq&{* zE#sUQ5@-+d;ofJ~30+PjP~WG`Ypy2Er;=s98ZIeKM>SkP&p0Pg{UwY_f5i<^B^w363+g|7%-GGfz~uB6P$3)q z0lQ-uwi{Q}V|GA)?Nk&X4FK>b11PjT*s~%cr`tN z>6saHJmMVBuMEeqN~Q$NuBQ9@l(dxi1Am}AJYU$*qs8n|5-sYYzOq7ioS zZ+0W~b`MN@F+lm%#e`q~?y%7o7)gqd#BVcC(PUV*F9xy47(P)Is|uxgqEYS;?B(_x zz=oeR{}^QEynM|U9;_w#3PLzAnjteNZ3)m}!bnBA; z%MmK=nzJ=h+PA>M;?F5Db*`ZQrj)cQCNfmK8fUCr6Hhw6eKY2p;MdEjpjhqLn1-LQ zlKT3V4ky&L_Wnz1LV2g>b>bt0C3ml_PtuUtv~I%pxN@@XH(8A zX?s+D`2J!qm(bQ<*Dj^_zLYsXgEgw-)Dx9;>nBPjK4M#Cqhzf+slqte+Cp8gzx;IY zwG{XA09oEu_BZlQ^>t0rJpX0YzV0c@U&(l0R`!a?Qm#+0wv9h9Z&LHER__gK3ia5& z+jTF$pVQ{HO_KF<;pJs)TlW5wh_g53>z=v&+`cvEVvM!)#q8c^1ymkXu+^`U+f(p< zvB3widnw`-_Cxv?Zdm4ka%602g?p8Z4Aht@$mYgk_!h~PlZ|Y&RV(GPcdGkq>=K))YfkM6>Cdpe$zD~omsd?YXPSZEzK=5V z>Q_rPde|PD`?jL|y|l%3aixpEi-gw)rRQ;9)tz+p>cdYf-pZ@bo4MhZ`|MXaTMwj} z2G6ZXa9T8@PvC0j=M7OgA@f+5tQ1^S!n`#4*|1?$7@dh>QFD$Rq0ja|oChutxHLOSxxcdV1OnJoR_Xp5j@ z)y{7sEBc)rf$Pbxx`)j+HM{h%L{}oHdB$qqiglJ=7dFXnwL9@J{?{YBf5+TQ9xURH z-})$E?n^T-mesc|m!}?>|4Jom(f;z1f_<;#mlmIUB~||^^T{sAkk|8*QzT!U7n*l+ z>#a9g-vW<(zG^7pyW!^Jg!wA-B>kQ{9#2=AH`7yT+SAqR64j@#-M#q5r%3S~I>0sE zVQCXfNE8evKYe)DLgqkb=*Kj$Y2ld4hc$_Y00J zpWWA?7Pd}x&)w~_V#B^~h&>W^Ge+oU)vmhwp4BTe!1Z>^YX-p!ht!+DuKl;L`w_?F zqw9aElmII-v3j>D2C=;_lJ8Cn)_*FzH+;Xn);#^GO5nU(@K=E;Y6hFvH@DQho)=cf zW+k z^c~c=D8seVpgcHjTIY;_Wh$|DpL0q~0?#Y|@&yfFusp1CVcGKGWB^m7{UVKxt1o@| ze9}dI-r|@|y-y5p+Lh^kiiIe%a%0&78G%#qVHUgq4iSzf16~&g$OtIMArqk0kTQqk uvID&p^Vt75$bV>JF*vk={<0H$P|wJ9u~agdxAPJM5O})!xvX Get-NetIPInterface -InterfaceIndex 5 ``` -![Quarantine Interfaceindex.](images/quarantine-interfaceindex1.png) - With the help of the interface name, event viewer can be searched for any interface related changes. To enable more networking audit events, see [Enable IPsec and Windows Firewall Audit Events](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754714(v=ws.10)). diff --git a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml index ce62534d6d..b566dce388 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/toc.yml +++ b/windows/security/operating-system-security/network-security/windows-firewall/toc.yml @@ -13,12 +13,12 @@ items: href: configure.md - name: Configure with command line tools href: configure-with-command-line.md - - name: Configure logging - href: configure-logging.md - name: Hyper-V firewall href: hyper-v-firewall.md - name: Troubleshoot - items: + items: + - name: Configure Windows Firewall logging + href: configure-logging.md - name: Troubleshoot UWP app connectivity issues in Windows Firewall href: troubleshooting-uwp-firewall.md - name: Filter origin audit log improvements From 397f964c1644c4f907e0d40c1bc7c758e7c5714c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 21 Nov 2023 09:31:27 -0500 Subject: [PATCH 206/237] acrolinx --- .../sections/operating-system-security.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/includes/sections/operating-system-security.md b/windows/security/includes/sections/operating-system-security.md index 685cdad996..ea66bca2df 100644 --- a/windows/security/includes/sections/operating-system-security.md +++ b/windows/security/includes/sections/operating-system-security.md @@ -1,7 +1,7 @@ --- author: paolomatarazzo ms.author: paoloma -ms.date: 09/18/2023 +ms.date: 11/21/2023 ms.topic: include --- @@ -10,8 +10,8 @@ ms.topic: include | Feature name | Description | |:---|:---| | **[Secure Boot and Trusted Boot](/windows/security/operating-system-security/system-security/trusted-boot)** | Secure Boot and Trusted Boot help to prevent malware and corrupted components from loading when a device starts.

    Secure Boot starts with initial boot-up protection, and then Trusted Boot picks up the process. Together, Secure Boot and Trusted Boot help to ensure the system boots up safely and securely. | -| **[Measured boot](/windows/compatibility/measured-boot)** | Measured Boot measures all important code and configuration settings during the boot of Windows. This includes: the firmware, boot manager, hypervisor, kernel, secure kernel and operating system. Measured Boot stores the measurements in the TPM on the machine, and makes them available in a log that can be tested remotely to verify the boot state of the client.

    The Measured Boot feature provides antimalware software with a trusted (resistant to spoofing and tampering) log of all boot components that started before it. The antimalware software can use the log to determine whether components that ran before it are trustworthy, or if they are infected with malware. The antimalware software on the local machine can send the log to a remote server for evaluation. The remote server may initiate remediation actions, either by interacting with software on the client, or through out-of-band mechanisms, as appropriate. | -| **[Device health attestation service](/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters, to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and have not been tampered with before they can access corporate resources. The determinations are made with data stored in the TPM, which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Intune reviews device health and connects this information with Microsoft Entra ID for conditional access. | +| **[Measured boot](/windows/compatibility/measured-boot)** | Measured Boot measures all important code and configuration settings during the boot of Windows. This includes: the firmware, boot manager, hypervisor, kernel, secure kernel and operating system. Measured Boot stores the measurements in the TPM on the machine, and makes them available in a log that can be tested remotely to verify the boot state of the client.

    The Measured Boot feature provides anti-malware software with a trusted (resistant to spoofing and tampering) log of all boot components that started before it. The anti-malware software can use the log to determine whether components that ran before it are trustworthy, or if they're infected with malware. The anti-malware software on the local machine can send the log to a remote server for evaluation. The remote server may initiate remediation actions, either by interacting with software on the client, or through out-of-band mechanisms, as appropriate. | +| **[Device health attestation service](/windows/security/operating-system-security/system-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices)** | The Windows device health attestation process supports a zero-trust paradigm that shifts the focus from static, network-based perimeters, to users, assets, and resources. The attestation process confirms the device, firmware, and boot process are in a good state and haven't been tampered with before they can access corporate resources. The determinations are made with data stored in the TPM, which provides a secure root of trust. The information is sent to an attestation service, such as Azure Attestation, to verify the device is in a trusted state. Then, an MDM tool like Microsoft Intune reviews device health and connects this information with Microsoft Entra ID for conditional access. | | **[Windows security policy settings and auditing](/windows/security/threat-protection/security-policy-settings/security-policy-settings)** | Microsoft provides a robust set of security settings policies that IT administrators can use to protect Windows devices and other resources in their organization. | | **[Assigned Access (kiosk mode)](/windows/configuration/kiosk-methods)** | Some desktop devices in an enterprise serve a special purpose. For example, a PC in the lobby that customers use to see your product catalog. Or, a PC displaying visual content as a digital sign. Windows client offers two different locked-down experiences for public or specialized use: A single-app kiosk that runs a single Universal Windows Platform (UWP) app in full screen above the lock screen, or A multi-app kiosk that runs one or more apps from the desktop.

    Kiosk configurations are based on Assigned Access, a feature in Windows that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. | @@ -19,13 +19,13 @@ ms.topic: include | Feature name | Description | |:---|:---| -| **[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a protection solution included in all versions of Windows. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. Updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus includes real-time, behavior-based, and heuristic antivirus protection.

    The combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but are not considered malware. | +| **[Microsoft Defender Antivirus](/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)** | Microsoft Defender Antivirus is a protection solution included in all versions of Windows. From the moment you boot Windows, Microsoft Defender Antivirus continually monitors for malware, viruses, and security threats. Updates are downloaded automatically to help keep your device safe and protect it from threats. Microsoft Defender Antivirus includes real-time, behavior-based, and heuristic antivirus protection.

    The combination of always-on content scanning, file and process behavior monitoring, and other heuristics effectively prevents security threats. Microsoft Defender Antivirus continually scans for malware and threats and also detects and blocks potentially unwanted applications (PUA) which are applications that are deemed to negatively impact your device but aren't considered malware. | | **[Local Security Authority (LSA) Protection](/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)** | Windows has several critical processes to verify a user's identity. Verification processes include Local Security Authority (LSA), which is responsible for authenticating users and verifying Windows logins. LSA handles tokens and credentials such as passwords that are used for single sign-on to a Microsoft account and Azure services. To help protect these credentials, additional LSA protection only allows loading of trusted, signed code and provides significant protection against Credential theft.

    LSA protection is enabled by default on new, enterprise joined Windows 11 devices with added support for non-UEFI lock and policy management controls via MDM and group policy. | | **[Attack surface reduction (ASR)](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction)** | Attack surface reduction (ASR) rules help to prevent software behaviors that are often abused to compromise your device or network. By reducing the number of attack surfaces, you can reduce the overall vulnerability of your organization.

    Administrators can configure specific ASR rules to help block certain behaviors, such as launching executable files and scripts that attempt to download or run files, running obfuscated or otherwise suspicious scripts, performing behaviors that apps don't usually initiate during normal day-to-day work. | | **[Tamper protection settings for MDE](/microsoft-365/security/defender-endpoint/prevent-changes-to-security-settings-with-tamper-protection)** | Tamper protection is a capability in Microsoft Defender for Endpoint that helps protect certain security settings, such as virus and threat protection, from being disabled or changed. During some kinds of cyber attacks, bad actors try to disable security features on devices. Disabling security features provides bad actors with easier access to your data, the ability to install malware, and the ability to exploit your data, identity, and devices. Tamper protection helps guard against these types of activities. | -| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Commonly used folders, such as those used for documents, pictures, downloads, are typically included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the trusted list are prevented from making any changes to files inside protected folders.

    Controlled folder access helps to protect user's valuable data from malicious apps and threats, such as ransomware. | +| **[Controlled folder access](/microsoft-365/security/defender-endpoint/controlled-folders)** | You can protect your valuable information in specific folders by managing app access to specific folders. Only trusted apps can access protected folders, which are specified when controlled folder access is configured. Commonly used folders, such as those used for documents, pictures, downloads, are typically included in the list of controlled folders. Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that aren't included in the trusted list are prevented from making any changes to files inside protected folders.

    Controlled folder access helps to protect user's valuable data from malicious apps and threats, such as ransomware. | | **[Exploit protection](/microsoft-365/security/defender-endpoint/exploit-protection)** | Exploit protection automatically applies several exploit mitigation techniques to operating system processes and apps. Exploit protection works best with Microsoft Defender for Endpoint, which gives organizations detailed reporting into exploit protection events and blocks as part of typical alert investigation scenarios. You can enable exploit protection on an individual device, and then use MDM or group policy to distribute the configuration file to multiple devices. When a mitigation is encountered on the device, a notification will be displayed from the Action Center. You can customize the notification with your company details and contact information. You can also enable the rules individually to customize which techniques the feature monitors. | -| **[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they are entering their credentials into a potentially risky location. IT can customize which notifications appear via MDM or group policy. The protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. | +| **[Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)** | Microsoft Defender SmartScreen protects against phishing, malware websites and applications, and the downloading of potentially malicious files. For enhanced phishing protection, SmartScreen also alerts people when they're entering their credentials into a potentially risky location. IT can customize which notifications appear via MDM or group policy. The protection runs in audit mode by default, giving IT admins full control to make decisions around policy creation and enforcement. | | **[Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint)** | Microsoft Defender for Endpoint is an enterprise endpoint detection and response solution that helps security teams to detect, investigate, and respond to advanced threats. Organizations can use the rich event data and attack insights Defender for Endpoint provides to investigate incidents. Defender for Endpoint brings together the following elements to provide a more complete picture of security incidents: endpoint behavioral sensors, cloud security analytics, threat intelligence and rich response capabilities. | ## Network security @@ -33,11 +33,11 @@ ms.topic: include | Feature name | Description | |:---|:---| | **[Transport Layer Security (TLS)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview)** | Transport Layer Security (TLS) is a cryptographic protocol designed to provide communications security over a network. TLS 1.3 is the latest version of the protocol and is enabled by default in Windows 11. This version eliminates obsolete cryptographic algorithms, enhances security over older versions, and aims to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average, and supports only five strong cipher suites which provide perfect forward secrecy and less operational risk. | -| **[Domain Name System (DNS) security](/windows-server/networking/dns/doh-client-support)** | Starting in Windows 11, the Windows DNS client supports DNS over HTTPS (DoH), an encrypted DNS protocol. This allows administrators to ensure their devices protect DNS queries from on-path attackers, whether they are passive observers logging browsing behavior or active attackers trying to redirect clients to malicious sites.

    In a zero-trust model where there is no trust placed in a network boundary, having a secure connection to a trusted name resolver is required. | -| **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | -| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | Wi-Fi Protected Access (WPA) is a security certification programs designed to secure wireless networks. WPA3 is the latest version of the certification and provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows supports three WPA3 modes: WPA3 personal with the Hash-to-Element (H2E) protocol, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B.

    Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication. | +| **[Domain Name System (DNS) security](/windows-server/networking/dns/doh-client-support)** | Starting in Windows 11, the Windows DNS client supports DNS over HTTPS (DoH), an encrypted DNS protocol. This allows administrators to ensure their devices protect DNS queries from on-path attackers, whether they're passive observers logging browsing behavior or active attackers trying to redirect clients to malicious sites.

    In a zero-trust model where there is no trust placed in a network boundary, having a secure connection to a trusted name resolver is required. | +| **Bluetooth pairing and connection protection** | The number of Bluetooth devices connected to Windows continues to increase. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG), Standard Vulnerability Reports, and issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that users ensure their firmware and/ or software of their Bluetooth accessories are kept up to date. | +| **[WiFi Security](https://support.microsoft.com/windows/faster-and-more-secure-wi-fi-in-windows-26177a28-38ed-1a8e-7eca-66f24dc63f09)** | Wi-Fi Protected Access (WPA) is a security certification program designed to secure wireless networks. WPA3 is the latest version of the certification and provides a more secure and reliable connection method as compared to WPA2 and older security protocols. Windows supports three WPA3 modes: WPA3 personal with the Hash-to-Element (H2E) protocol, WPA3 Enterprise, and WPA3 Enterprise 192-bit Suite B.

    Windows 11 also supports WFA defined WPA3 Enterprise that includes enhanced Server Cert validation and TLS 1.3 for authentication using EAP-TLS Authentication. | | **Opportunistic Wireless Encryption (OWE)** | Opportunistic Wireless Encryption (OWE) is a technology that allows wireless devices to establish encrypted connections to public Wi-Fi hotspots. | -| **[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)** | Windows Firewall provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

    With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. Windows Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | +| **[Windows Firewall](/windows/security/operating-system-security/network-security/windows-firewall)** | Windows Firewall provides host-based, two-way network traffic filtering, blocking unauthorized traffic flowing into or out of the local device based on the types of networks to which the device is connected. Windows Firewall reduces the attack surface of a device with rules to restrict or allow traffic by many properties such as IP addresses, ports, or program paths. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

    With its integration with Internet Protocol Security (IPsec), Windows Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data. Windows Firewall is a host-based firewall that is included with the operating system, there's no additional hardware or software required. Windows Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API). | | **[Virtual private network (VPN)](/windows/security/operating-system-security/network-security/vpn/vpn-guide)** | The Windows VPN client platform includes built in VPN protocols, configuration support, a common VPN user interface, and programming support for custom VPN protocols. VPN apps are available in the Microsoft Store for both enterprise and consumer VPNs, including apps for the most popular enterprise VPN gateways.

    In Windows 11, the most commonly used VPN controls are integrated right into the Quick Actions pane. From the Quick Actions pane, users can see the status of their VPN, start and stop the VPN tunnels, and access the Settings app for more controls. | | **[Always On VPN (device tunnel)](/Windows-server/remote/remote-access/overview-always-on-vpn)** | With Always On VPN, you can create a dedicated VPN profile for the device. Unlike User Tunnel, which only connects after a user logs on to the device, Device Tunnel allows the VPN to establish connectivity before a user sign-in. Both Device Tunnel and User Tunnel operate independently with their VPN profiles, can be connected at the same time, and can use different authentication methods and other VPN configuration settings as appropriate. | | **[Direct Access](/windows-server/remote/remote-access/directaccess/directaccess)** | DirectAccess allows connectivity for remote users to organization network resources without the need for traditional Virtual Private Network (VPN) connections.

    With DirectAccess connections, remote devices are always connected to the organization and there's no need for remote users to start and stop connections. | @@ -51,5 +51,5 @@ ms.topic: include | **[BitLocker management](/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-management-for-enterprises)** | The BitLocker CSP allows an MDM solution, like Microsoft Intune, to manage the BitLocker encryption features on Windows devices. This includes OS volumes, fixed drives and removeable storage, and recovery key management into Microsoft Entra ID. | | **[BitLocker enablement](/windows/security/operating-system-security/data-protection/bitlocker/)** | BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune, using a configuration service provider (CSP).

    BitLocker provides encryption for the OS, fixed data, and removable data drives leveraging technologies like hardware security test interface (HSTI), Modern Standby, UEFI Secure Boot and TPM. | | **[Encrypted hard drive](/windows/security/operating-system-security/data-protection/encrypted-hard-drive)** | Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level and allow for full disk hardware encryption while being transparent to the device user. These drives combine the security and management benefits provided by BitLocker Drive Encryption with the power of self-encrypting drives.

    By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. | -| **[Personal data encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow.

    Windows Hello for Business is used to protect the container which houses the encryption keys used by PDE. When the user signs in, the container gets authenticated to release the keys in the container to decrypt user content. | -| **[Email Encryption (S/MIME)](/windows/security/operating-system-security/data-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital ID (certificate) can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message has not been tampered with. The encrypted messages can be sent by a user to other users within their organization or external contacts if they have proper encryption certificates. | +| **[Personal data encryption (PDE)](/windows/security/operating-system-security/data-protection/personal-data-encryption/)** | Personal data encryption (PDE) works with BitLocker and Windows Hello for Business to further protect user documents and other files, including when the device is turned on and locked. Files are encrypted automatically and seamlessly to give users more security without interrupting their workflow.

    Windows Hello for Business is used to protect the container, which houses the encryption keys used by PDE. When the user signs in, the container gets authenticated to release the keys in the container to decrypt user content. | +| **[Email Encryption (S/MIME)](/windows/security/operating-system-security/data-protection/configure-s-mime)** | Email encryption enables users to encrypt outgoing email messages and attachments, so only intended recipients with a digital ID (certificate) can read them. Users can digitally sign a message, which verifies the identity of the sender and confirms the message hasn't been tampered with. The encrypted messages can be sent by a user to other users within their organization or external contacts if they have proper encryption certificates. | From d4273eb2b409ae11344fc9e45c3a7ba56cb50c2e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 21 Nov 2023 14:44:31 -0500 Subject: [PATCH 207/237] updates --- .../smart-card-and-remote-desktop-services.md | 9 +++-- ...rt-card-certificate-propagation-service.md | 16 ++++---- ...ertificate-requirements-and-enumeration.md | 40 +++++++++---------- 3 files changed, 32 insertions(+), 33 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 61e9d781c0..3d92abe069 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,9 +1,10 @@ --- -ms.date: 11/07/2023 +ms.date: 11/21/2023 title: Smart Card and Remote Desktop Services description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -ms.topic: conceptual +ms.topic: concept-article --- + # Smart Card and Remote Desktop Services This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. @@ -25,7 +26,7 @@ In a Remote Desktop scenario, a user is using a remote server for running servic Notes about the redirection model: -1. This scenario is a remote sign-in session on a computer with Remote Desktop Services. In the remote session (labeled as "Client session"), the user runs `net use /smartcard` +1. This scenario is a remote sign-in session on a computer with Remote Desktop Services. In the remote session (labeled as *Client session*), the user runs `net use /smartcard` 1. Arrows represent the flow of the PIN after the user types the PIN at the command prompt until it reaches the user's smart card in a smart card reader that is connected to the Remote Desktop Connection (RDC) client computer 1. The authentication is performed by the LSA in session 0 1. The CryptoAPI processing is performed in the LSA (`lsass.exe`). This is possible because RDP redirector (`rdpdr.sys`) allows per-session, rather than per-process, context @@ -44,7 +45,7 @@ When smart card-enabled single sign-in (SSO) is used for Remote Desktop Services Remote Desktop Services enables users to sign in with a smart card by entering a PIN on the RDC client computer and sending it to the RD Session Host server in a manner similar to authentication that is based on user name and password. -In addition, Group Policy settings that are specific to Remote Desktop Services need to be enabled for smart card-based sign-in. +In addition, group policy settings that are specific to Remote Desktop Services need to be enabled for smart card-based sign-in. To enable smart card sign-in to a Remote Desktop Session Host (RD Session Host) server, the Key Distribution Center (KDC) certificate must be present on the RDC client computer. If the computer isn't in the same domain or workgroup, the following command can be used to deploy the certificate: diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 851e89b13a..2ede5b20f2 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -1,15 +1,13 @@ --- -title: Certificate Propagation Service -description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation. +title: Certificate propagation service +description: Learn about the certificate propagation service (CertPropSvc), which is used in smart card implementation. ms.topic: concept-article -ms.date: 08/24/2021 +ms.date: 11/21/2023 --- -# Certificate Propagation Service +# Certificate propagation service -This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation. - -The certificate propagation service activates when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. Certificate propagation service actions are controlled by using Group Policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). +The certificate propagation service (CertPropSvc) is a Windows service that activates when a user inserts a smart card in a reader that is attached to the device. The action causes the certificates to be read from the smart card. The certificates are then added to the user's Personal store. Certificate propagation service actions are controlled by using Group Policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). > [!NOTE] > The certificate propagation service must be running for smart card Plug and Play to work. @@ -47,9 +45,9 @@ Root certificate propagation is responsible for the following smart card deploym - Joining the domain - Accessing a network remotely -In both cases, the computer isn't joined to a domain, and therefore, trust isn't being managed by Group Policy. However, the objective is to authenticate to a remote server, such as the domain controller. Root certificate propagation provides the ability to use the smart card to include the missing trust chain. +In both cases, the computer isn't joined to a domain, and therefore, trust isn't being managed by group policy. However, the objective is to authenticate to a remote server, such as the domain controller. Root certificate propagation provides the ability to use the smart card to include the missing trust chain. -When the smart card is inserted, the certificate propagation service propagates any root certificates on the card to the trusted smart card root computer certificate stores. This process establishes a trust relationship with the enterprise resources. You might also use a subsequent cleanup action when the user's smart card is removed from the reader, or when the user signs out. This is configurable with Group Policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). +When the smart card is inserted, the certificate propagation service propagates any root certificates on the card to the trusted smart card root computer certificate stores. This process establishes a trust relationship with the enterprise resources. You might also use a subsequent cleanup action when the user's smart card is removed from the reader, or when the user signs out. This is configurable with group policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). For more information about root certificate requirements, see [Smart card root certificate requirements for use with domain sign-in](smart-card-certificate-requirements-and-enumeration.md#smart-card-root-certificate-requirements-for-use-with-domain-sign-in). diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 4e345d6a7b..4f61d194ed 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -23,23 +23,23 @@ When a smart card is inserted, the following steps are performed. 1. The certificate is then queried from the key context by using KP_CERTIFICATE. The certificate is added to an in-memory certificate store. 1. For each certificate in the certificate store from Step 5 or Step 7, the following checks are performed: - 1. The certificate must be valid, based on the computer system clock (not expired or valid with a future date). - 1. The certificate must not be in the AT_SIGNATURE part of a container. - 1. The certificate must have a valid user principal name (UPN). - 1. The certificate must have the digital signature key usage. - 1. The certificate must have the smart card logon EKU. + 1. The certificate must be valid, based on the computer system clock (not expired or valid with a future date) + 1. The certificate must not be in the AT_SIGNATURE part of a container + 1. The certificate must have a valid user principal name (UPN) + 1. The certificate must have the digital signature key usage + 1. The certificate must have the smart card logon EKU - Any certificate that meets these requirements is displayed to the user with the certificate's UPN (or e-mail address or subject, depending on the presence of the certificate extensions). + Any certificate that meets these requirements is displayed to the user with the certificate's UPN (or e-mail address or subject, depending on the presence of the certificate extensions) -1. The process then chooses a certificate, and the PIN is entered. -1. LogonUI.exe packages the information and sends it to Lsass.exe to process the sign-in attempt. -1. If successful, LogonUI.exe closes. This causes the context acquired in Step 3 to be released. +1. The process then chooses a certificate, and the PIN is entered +1. LogonUI.exe packages the information and sends it to Lsass.exe to process the sign-in attempt +1. If successful, `LogonUI.exe` closes. This causes the context acquired in Step 3 to be released ## Smart card sign-in flow in Windows Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) doesn't reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change. -Client certificates that don't contain a UPN in the `subjectAltName`` (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. +Client certificates that don't contain a UPN in the `subjectAltName` (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. Support for multiple certificates on the same card is enabled by default. New certificate types must be enabled through Group Policy. @@ -53,22 +53,22 @@ The following diagram illustrates how smart card sign-in works in the supported Following are the steps that are performed during a smart card sign-in: -1. Winlogon requests the sign-in UI credential information. +1. Winlogon requests the sign-in UI credential information 1. Asynchronously, smart card resource manager starts, and the smart card credential provider does the following: - 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). - 1. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. - 1. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. + 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected) + 1. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them + 1. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal > [!NOTE] > Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. - 1. Notifies the sign-in UI that it has new credentials. + 1. Notifies the sign-in UI that it has new credentials -1. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. -1. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. -1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB_CERTIFICATE_LOGON structure. The main contents of the KERB_CERTIFICATE_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain isn't in the same forest because it enables a certificate to be mapped to multiple user accounts. -1. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. -1. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. +1. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box +1. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN +1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB_CERTIFICATE_LOGON structure. The main contents of the KERB_CERTIFICATE_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain isn't in the same forest because it enables a certificate to be mapped to multiple user accounts +1. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI +1. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser 1. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB_AS_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.\ From aabd947fff140449541ba3cdc9bc5b1e5eb0e25a Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 21 Nov 2023 14:51:53 -0500 Subject: [PATCH 208/237] updates --- .openpublishing.redirection.windows-security.json | 4 ++-- .../network-security/windows-firewall/index.md | 2 +- .../network-security/windows-firewall/tools.md | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 3ec41a760f..be07145db2 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -8007,7 +8007,7 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", - "redirect_url": "/windows/security/operating-system-security/network-security/configure-with-command-line", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line", "redirect_document_id": false }, { @@ -8017,7 +8017,7 @@ }, { "source_path": "windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md", - "redirect_url": "/windows/security/operating-system-security/network-security/configure", + "redirect_url": "/windows/security/operating-system-security/network-security/windows-firewall/configure", "redirect_document_id": false }, { diff --git a/windows/security/operating-system-security/network-security/windows-firewall/index.md b/windows/security/operating-system-security/network-security/windows-firewall/index.md index a70e90f998..f1d2d5e956 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/index.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/index.md @@ -37,7 +37,7 @@ Windows Firewall offers several benefits to address your organization's network The default behavior of Windows Firewall is to: -- block all incoming traffic, unless solicited or maching a *rule* +- block all incoming traffic, unless solicited or matching a *rule* - allow all outgoing traffic, unless matching a *rule* ### Firewall rules diff --git a/windows/security/operating-system-security/network-security/windows-firewall/tools.md b/windows/security/operating-system-security/network-security/windows-firewall/tools.md index 81d8ce2a84..f77a0e77df 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/tools.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/tools.md @@ -121,9 +121,9 @@ An important Windows Firewall feature you can use to mitigate damage during an a Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or Control Panel. -![Incoming connections.](images/fw06-block.png) +:::image type="content" alt-text="Screenshot of the Windows Security app showing incoming connections." source="images/fw06-block.png"::: -:::image type="content" alt-text="Firewall cpl." source="images/fw07-legacy.png"::: +:::image type="content" alt-text="Screenshot of the Control Panel Firewall applet." source="images/fw07-legacy.png"::: By default, the Windows Firewall blocks everything unless there's an exception rule created. The *shield up* option overrides the exceptions. For example, the Remote Desktop feature automatically creates firewall rules when enabled. However, if there's an active exploit using multiple ports and services on a host, you can, instead of disabling individual rules, use the shields up mode to block all inbound connections, overriding previous exceptions, including the rules for Remote Desktop. The Remote Desktop rules remain intact but remote access can't work as long as shields up is active. From c914df9c699b689c3e5d31a11c88d3008c08414e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 22 Nov 2023 08:38:23 -0500 Subject: [PATCH 209/237] freshness review smart card topic --- .../smart-card-and-remote-desktop-services.md | 2 +- .../smart-cards/smart-card-architecture.md | 2 +- ...art-card-certificate-propagation-service.md | 2 +- ...certificate-requirements-and-enumeration.md | 10 +++++----- .../smart-card-debugging-information.md | 2 +- .../smart-cards/smart-card-events.md | 2 +- ...-card-group-policy-and-registry-settings.md | 8 ++++---- ...-how-smart-card-sign-in-works-in-windows.md | 2 +- .../smart-card-removal-policy-service.md | 18 +++++++++--------- ...art-card-smart-cards-for-windows-service.md | 2 +- .../smart-card-tools-and-settings.md | 2 +- ...d-windows-smart-card-technical-reference.md | 2 +- .../windows-platform-common-criteria.md | 12 ++++++------ 13 files changed, 33 insertions(+), 33 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 3d92abe069..cb77691205 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,5 +1,5 @@ --- -ms.date: 11/21/2023 +ms.date: 11/22/2023 title: Smart Card and Remote Desktop Services description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. ms.topic: concept-article diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 933f9bc3d3..3fa6fe2bae 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -2,7 +2,7 @@ title: Smart Card Architecture description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. ms.topic: reference-architecture -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Smart Card Architecture diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 2ede5b20f2..fe6f0b5c39 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -2,7 +2,7 @@ title: Certificate propagation service description: Learn about the certificate propagation service (CertPropSvc), which is used in smart card implementation. ms.topic: concept-article -ms.date: 11/21/2023 +ms.date: 11/22/2023 --- # Certificate propagation service diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 4f61d194ed..9f8291d4a6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -2,7 +2,7 @@ title: Certificate Requirements and Enumeration description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. ms.topic: concept-article -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Certificate Requirements and Enumeration @@ -185,11 +185,11 @@ A single user certificate can be mapped to multiple accounts. For example, a use Based on the information that is available in the certificate, the sign-in conditions are: 1. If no UPN is present in the certificate: - 1. Sign-in can occur in the local forest or in another forest if a single user with one certificate needs to sign in to different accounts - 1. A hint must be supplied if mapping isn't unique (for example, if multiple users are mapped to the same certificate) + 1. Sign-in can occur in the local forest or in another forest if a single user with one certificate needs to sign in to different accounts + 1. A hint must be supplied if mapping isn't unique (for example, if multiple users are mapped to the same certificate) 1. If a UPN is present in the certificate: - 1. The certificate can't be mapped to multiple users in the same forest - 1. The certificate can be mapped to multiple users in different forests. For a user to sign in to other forests, an X509 hint must be supplied to the user + 1. The certificate can't be mapped to multiple users in the same forest + 1. The certificate can be mapped to multiple users in different forests. For a user to sign in to other forests, an X509 hint must be supplied to the user ## Smart card sign-in for multiple users into a single account diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 0ba2519568..d5df22275e 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -2,7 +2,7 @@ title: Smart Card Troubleshooting description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. ms.topic: troubleshooting -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Smart Card Troubleshooting diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index 87a6861bb1..96a66ee27a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -2,7 +2,7 @@ title: Smart card events description: Learn about smart card deployment and development events. ms.topic: troubleshooting -ms.date: 06/02/2023 +ms.date: 11/22/2023 --- # Smart card events diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 270eda4a77..d218b20bc5 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -2,7 +2,7 @@ title: Smart Card Group Policy and Registry Settings description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. ms.topic: reference -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Smart Card Group Policy and Registry Settings @@ -262,7 +262,7 @@ When this setting isn't turned on, Credential Manager can return plaintext PINs. You can use this policy setting to control the way the subject name appears during sign-in. > [!NOTE] -> To help users distinguish one certificate from another, the user principal name (UPN) and the common name are displayed by default. For example, when this setting is enabled, if the certificate subject is CN=User1, OU=Users, DN=example, DN=com and the UPN is user1@example.com, "User1" is displayed with "user1@example.com." If the UPN is not present, the entire subject name is displayed. This setting controls the appearance of that subject name, and it might need to be adjusted for your organization. +> To help users distinguish one certificate from another, the user principal name (UPN) and the common name are displayed by default. For example, when this setting is enabled, if the certificate subject is *CN=User1, OU=Users, DN=example, DN=com* and the UPN is *user1@example.com*, *User1* is displayed with *user1@example.com*. If the UPN is not present, the entire subject name is displayed. This setting controls the appearance of that subject name, and it might need to be adjusted for your organization. When this policy setting is turned on, the subject name during sign-in appears reversed from the way that it's stored in the certificate. @@ -276,11 +276,11 @@ When this policy setting isn't turned on, the subject name appears the same as i ### Turn on certificate propagation from smart card -You can use this policy setting to manage the certificate propagation that occurs when a smart card is inserted. +You can use this policy setting to manage the certificate propagation that occurs when a smart card is inserted. > [!NOTE] > The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. -When this policy setting is turned on, certificate propagation occurs when the user inserts the smart card. +When this policy setting is turned on, certificate propagation occurs when the user inserts the smart card. When this policy setting is turned off, certificate propagation doesn't occur, and the certificates aren't available to applications, like Outlook. diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 2641967e6d..6727a73a66 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -2,7 +2,7 @@ title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. ms.topic: overview -ms.date: 1/06/2023 +ms.date: 11/22/2023 --- # How Smart Card Sign-in Works in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 616ea96b49..7709e7524f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -2,23 +2,23 @@ title: Smart Card Removal Policy Service description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. ms.topic: concept-article -ms.date: 09/24/2021 +ms.date: 11/22/2023 --- # Smart Card Removal Policy Service -This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. +This article describes the role of the removal policy service (`ScPolicySvc`) in smart card implementations. -The smart card removal policy service is applicable when a user has signed in with a smart card and then removes that smart card from the reader. The action that is performed when the smart card is removed is controlled by Group Policy settings. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). +The smart card removal policy service is applicable when a user signs in with a smart card and then removes that smart card from the reader. The action that is performed when the smart card is removed is controlled by group policy settings. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). -![Smart card removal policy service.](images/sc-image501.gif) +![Diagram showing the smart card removal policy service.](images/sc-image501.gif) -The numbers in the previous figure represent the following actions: +The numbers in the diagram represent the following actions: -1. Winlogon isn't directly involved in monitoring for smart card removal events. The sequence of steps that are involved when a smart card is removed begins with the smart card credential provider in the sign-in UI process. When a user successfully signs in with a smart card, the smart card credential provider captures the reader name. This information is then stored in the registry with the session identifier where the sign-in was initiated. -1. The smart card resource manager service notifies the smart card removal policy service that a sign-in has occurred. -1. ScPolicySvc retrieves the smart card information that the smart card credential provider stored in the registry. This call is redirected if the user is in a remote session. If the smart card is removed, ScPolicySvc is notified. -1. ScPolicySvc calls Remote Desktop Services to take the appropriate action if the request is to sign out the user or to disconnect the user's session, which might result in data loss. If the setting is configured to lock the computer when the smart card is removed, ScPolicySvc sends a message to Winlogon to lock the computer. +1. `Winlogon` isn't directly involved in monitoring for smart card removal events. The sequence of steps that are involved when a smart card is removed begins with the smart card credential provider in the sign-in UI process. When a user successfully signs in with a smart card, the smart card credential provider captures the reader name. This information is then stored in the registry with the session identifier where the sign-in was initiated +1. The smart card resource manager service notifies the smart card removal policy service that a sign-in occurred +1. `ScPolicySvc` retrieves the smart card information that the smart card credential provider stored in the registry. This call is redirected if the user is in a remote session. If the smart card is removed, `ScPolicySvc` is notified +1. `ScPolicySvc` calls Remote Desktop Services to take the appropriate action if the request is to sign out the user or to disconnect the user's session, which might result in data loss. If the setting is configured to lock the computer when the smart card is removed, `ScPolicySvc` sends a message to Winlogon to lock the computer. ## See also diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index 6d468b9bda..cf988e8549 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -2,7 +2,7 @@ title: Smart Cards for Windows Service description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. ms.topic: concept-article -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Smart Cards for Windows Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 737d2d83fc..63cb9feca0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -2,7 +2,7 @@ title: Smart Card Tools and Settings description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. ms.topic: conceptual -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Smart Card Tools and Settings diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index b832cf3024..da1a559648 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -2,7 +2,7 @@ title: Smart Card Technical Reference description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. ms.topic: overview -ms.date: 11/06/2023 +ms.date: 11/22/2023 --- # Smart Card Technical Reference diff --git a/windows/security/security-foundations/certification/windows-platform-common-criteria.md b/windows/security/security-foundations/certification/windows-platform-common-criteria.md index d342773f2c..adfc44645c 100644 --- a/windows/security/security-foundations/certification/windows-platform-common-criteria.md +++ b/windows/security/security-foundations/certification/windows-platform-common-criteria.md @@ -4,7 +4,7 @@ description: This topic details how Microsoft supports the Common Criteria certi ms.author: sushmanemali author: s4sush ms.topic: reference -ms.date: 11/4/2022 +ms.date: 11/22/2023 ms.reviewer: paoloma ms.collection: - tier3 @@ -30,7 +30,7 @@ Certified against the Protection Profile for General Purpose Operating Systems, - [Administrative Guide](https://download.microsoft.com/download/9/1/7/9178ce6a-8117-42e7-be0d-186fc4a89ca6/Microsoft%20Windows,%20Windows%20Server,%20Azure%20Stack%20Administrative%20Guide%20(21H2%20et%20al).pdf) - [Assurance Activity Report](https://download.microsoft.com/download/4/1/6/416151fe-63e7-48c0-a485-1d87148c71fe/Microsoft%20Windows,%20Windows%20Server,%20Azure%20Stack%20Assurance%20Activity%20Report%20(21H2%20et%20al).pdf) - [Validation Report](https://download.microsoft.com/download/e/3/7/e374af1a-3c5d-42ee-8e19-df47d2c0e3d6/Microsoft%20Windows,%20Windows%20Server,%20Azure%20Stack%20Validation%20Report%20(21H2%20et%20al).pdf) - + ### Windows 10, version 2004, Windows Server, version 2004, Windows Server Core Datacenter (Azure Fabric Controller), Windows Server Core Datacenter (Azure Stack) Certified against the Protection Profile for General Purpose Operating Systems, including the Extended Package for Wireless Local Area Network Clients and the Module for Virtual Private Network Clients @@ -101,7 +101,7 @@ Certified against the Protection Profile for General Purpose Operating Systems. - [Security Target](https://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf) - [Administrative Guide](https://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf) - [Certification Report](https://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf) -- [Assurance Activity Report](https://download.microsoft.com/download/a/e/9/ae9a2235-e1cd-4869-964d-c8260f604367/Windows%2010%201703%20GP%20OS%20Assurance%20Activity%20Report.pdf) +- [Assurance Activity Report](https://download.microsoft.com/download/a/e/9/ae9a2235-e1cd-4869-964d-c8260f604367/Windows%2010%201703%20GP%20OS%20Assurance%20Activity%20Report.pdf) ### Windows 10, version 1607, Windows Server 2016 @@ -145,9 +145,9 @@ Certified against the Protection Profile for Mobile Device Fundamentals. - [Security Target](https://download.microsoft.com/download/1/5/e/15eee6d3-f2a8-4441-8cb1-ce8c2ab91c24/windows%2010%20anniversary%20update%20mdf%20security%20target%20-%20public%20\(april%203%202017\).docx) - [Administrative Guide](https://download.microsoft.com/download/4/c/1/4c1f4ea4-2d66-4232-a0f5-925b2bc763bc/windows%2010%20au%20operational%20guidance%20\(16%20mar%202017\)\(clean\).docx) - [Validation Report](https://download.microsoft.com/download/f/2/f/f2f7176e-34f4-4ab0-993c-6606d207bb3c/st_vid10752-vr.pdf) -- [Assurance Activity Report](https://download.microsoft.com/download/9/3/9/939b44a8-5755-4d4c-b020-d5e8b89690ab/Windows%2010%20and%20Windows%2010%20Mobile%201607%20MDF%20Assurance%20Activity%20Report.pdf) +- [Assurance Activity Report](https://download.microsoft.com/download/9/3/9/939b44a8-5755-4d4c-b020-d5e8b89690ab/Windows%2010%20and%20Windows%2010%20Mobile%201607%20MDF%20Assurance%20Activity%20Report.pdf) -### Windows 10, version 1607, Windows Server 2016 +### Windows 10, version 1607, Windows Server 2016 (VPN) Certified against the Protection Profile for IPsec Virtual Private Network (VPN) Clients. @@ -269,7 +269,7 @@ Certified against the Protection Profile for General Purpose Operating Systems. - [Security Target](https://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf) - [Administrative Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=cb19538d-9e13-4ab6-af38-8f48abfdad08) -- [Certification Report](http://www.commoncriteriaportal.org:80/files/epfiles/0570a_pdf.pdf) +- [Certification Report](http://www.commoncriteriaportal.org:80/files/epfiles/0570a_pdf.pdf) ### Windows Server 2003 Certificate Server From 018be943cacf5a13b58a7cfcf05bed359c21e0e4 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 22 Nov 2023 10:14:12 -0800 Subject: [PATCH 210/237] Added known issues for audit mode and fixed some issues in articles --- .../design/plan-wdac-management.md | 20 ++++++++-------- .../design/select-types-of-rules-to-create.md | 24 ++++++++++--------- .../design/wdac-and-dotnet.md | 19 ++++++++------- .../operations/known-issues.md | 23 +++++++++++------- 4 files changed, 49 insertions(+), 37 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md b/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md index c51eebd95c..e8e60567e7 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md @@ -2,7 +2,7 @@ title: Plan for WDAC policy management description: Learn about the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control policies. ms.localizationpriority: medium -ms.date: 11/02/2022 +ms.date: 11/22/2023 ms.topic: article --- @@ -11,7 +11,7 @@ ms.topic: article >[!NOTE] >Some capabilities of Windows Defender Application Control (WDAC) are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](../feature-availability.md). -This topic describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies. +This article describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies. ## Policy XML lifecycle management @@ -23,7 +23,7 @@ Most Windows Defender Application Control policies will evolve over time and pro 2. [Deploy the audit mode policy](/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies) to intended devices. 3. [Monitor audit block events](/windows/security/threat-protection/windows-defender-application-control/event-id-explanations) from the intended devices and add/edit/delete rules as needed to address unexpected/unwanted blocks. 4. Repeat steps 2-3 until the remaining block events meet expectations. -5. [Generate the enforced mode version](/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies) of the policy. In enforced mode, files that aren't allowed by the policy are prevented from executing and corresponding block events are generated. +5. [Generate the enforced mode version](/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies) of the policy. In enforced mode, files that the policy doesn't allow are prevented from running and corresponding block events are generated. 6. [Deploy the enforced mode policy](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide) to intended devices. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly. 7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes. @@ -35,7 +35,7 @@ To effectively manage Windows Defender Application Control policies, you should ### Set PolicyName, PolicyID, and Version metadata for each policy -Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing Windows Defender Application Control events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system autogenerate a unique ID for the policy. +Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique policy ID. These unique attributes help you differentiate each policy when reviewing Windows Defender Application Control events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system autogenerate a unique ID for the policy. > [!NOTE] > PolicyID only applies to policies using the [multiple policy format](deploy-multiple-wdac-policies.md) on computers running Windows 10, version 1903 and above, or Windows 11. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10. @@ -45,15 +45,15 @@ In addition, we recommend using the [Set-CIPolicyVersion](/powershell/module/con ### Policy rule updates -As new apps are deployed or existing apps are updated by the software publisher, you may need to make revisions to your rules to ensure that these apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you use WDAC [managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you're less likely to need policy updates. +You might need to revise your policy when new apps are deployed or existing apps are updated by the software publisher to ensure that apps run correctly. Whether policy rule updates are required will depend significantly on the types of rules your policy includes. Rules based on codesigning certificates provide the most resiliency against app changes while rules based on file attributes or hash are most likely to require updates when apps change. Alternatively, if you use WDAC [managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) functionality and consistently deploy all apps and their updates through your managed installer, then you're less likely to need policy updates. ## WDAC event management -Each time that a process is blocked by Windows Defender Application Control, events will be written to either the CodeIntegrity\Operational or the AppLocker\MSI and Script Windows event logs. The event details which file tried to run, the attributes of that file and its signatures, and the process that attempted to run the blocked file. +Each time that WDAC blocks a process, events are written to either the CodeIntegrity\Operational or the AppLocker\MSI and Script Windows event logs. The event describes the file that tried to run, the attributes of that file and its signatures, and the process that attempted to run the blocked file. -Collecting these events in a central location can help you maintain your Windows Defender Application Control policy and troubleshoot rule configuration problems. Event collection technologies such as those available in Windows allow administrators to subscribe to specific event channels and have the events from source computers aggregated into a forwarded event log on a Windows Server operating system collector. For more info about setting up an event subscription, see [Configure Computers to Collect and Forward Events](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc748890(v=ws.11)). +Collecting these events in a central location can help you maintain your Windows Defender Application Control policy and troubleshoot rule configuration problems. You can [use the Azure Monitor Agent](/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent) to automatically collect your WDAC events for analysis. -Additionally, Windows Defender Application Control events are collected by [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) and can be queried using the [advanced hunting](../operations/querying-application-control-events-centrally-using-advanced-hunting.md) feature. +Additionally, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) collects WDAC events and can be queried using the [advanced hunting](../operations/querying-application-control-events-centrally-using-advanced-hunting.md) feature. ## Application and user support policy @@ -75,9 +75,9 @@ If your organization has an established help desk support department in place, c ### End-user support -Because Windows Defender Application Control is preventing unapproved apps from running, it's important that your organization carefully plan how to provide end-user support. Considerations include: +Because Windows Defender Application Control is preventing unapproved apps from running, it's important that your organization carefully plans how to provide end-user support. Considerations include: -- Do you want to use an intranet site as a first line of support for users who have tried to run a blocked app? +- Do you want to use an intranet site as a frontline of support for users who try to run a blocked app? - How do you want to support exceptions to the policy? Will you allow users to run a script to temporarily allow access to a blocked app? ## Document your plan diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/select-types-of-rules-to-create.md b/windows/security/application-security/application-control/windows-defender-application-control/design/select-types-of-rules-to-create.md index 68d101d832..961a1e4dc4 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/select-types-of-rules-to-create.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/select-types-of-rules-to-create.md @@ -2,7 +2,7 @@ title: Understand Windows Defender Application Control (WDAC) policy rules and file rules description: Learn how WDAC policy rules and file rules can control your Windows 10 and Windows 11 computers. ms.localizationpriority: medium -ms.date: 08/11/2023 +ms.date: 11/22/2023 ms.topic: article --- @@ -11,7 +11,7 @@ ms.topic: article > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [WDAC feature availability](../feature-availability.md). -Windows Defender Application Control (WDAC) can control what runs on Windows 10, Windows 11, and Windows Server 2016 and later, by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. +Windows Defender Application Control (WDAC) can control what runs on your Windows devices by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how to identify applications your organization trusts. ## Windows Defender Application Control policy rules @@ -20,7 +20,9 @@ To modify the policy rule options of an existing WDAC policy XML, use the [WDAC You can set several rule options within a WDAC policy. Table 1 describes each rule option, and whether supplemental policies can set them. Some rule options are reserved for future work or not supported. > [!NOTE] -> We recommend that you use **Enabled:Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked-instead the policy logs an event whenever an application outside the policy is started. To allow these applications, you can capture the policy information from the event log, and then merge that information into the existing policy. When the **Enabled:Audit Mode** is deleted, the policy runs in enforced mode. +> We recommend that you use **Enabled:Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, applications run normally but WDAC logs events whenever a file runs that isn't allowed by the policy. To allow these files, you can capture the policy information from the event log, and then merge that information into the existing policy. When the **Enabled:Audit Mode** is deleted, the policy runs in enforced mode. +> +> Some apps may behave differently even when your policy is in audit mode. When an option may change behaviors in audit mode, that is noted in Table 1. You should always test your apps thoroughly when deploying significant updates to your WDAC policies. ### Table 1. Windows Defender Application Control policy - policy rule options @@ -37,7 +39,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **8 Required:EV Signers** | This option isn't currently supported. | No | | **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | No | | **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a boot-critical driver fails during startup, the WDAC policy is placed in audit mode so that Windows loads. Administrators can validate the reason for the failure in the CodeIntegrity event log. | No | -| **11 Disabled:Script Enforcement** | This option disables script enforcement options, covering PowerShell, Windows Based Script Host (wscript.exe), Windows Console Based Script Host (cscript.exe), HTA files run in Microsoft HTML Application Host (mshta.exe), and MSXML. For more information on script enforcement, see [Script enforcement with WDAC](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement).
    NOTE: This option isn't supported on Windows Server 2016 or Windows 10 1607 LTSB and shouldn't be used on those operating systems. | No | +| **11 Disabled:Script Enforcement** | This option disables script enforcement options, covering PowerShell, Windows Based Script Host (wscript.exe), Windows Console Based Script Host (cscript.exe), HTA files run in Microsoft HTML Application Host (mshta.exe), and MSXML. Some script hosts may behave differently even when your policy is in audit mode. For more information on script enforcement, see [Script enforcement with WDAC](/windows/security/threat-protection/windows-defender-application-control/design/script-enforcement).
    NOTE: This option isn't supported on Windows Server 2016 or Windows 10 1607 LTSB and shouldn't be used on those operating systems. | No | | **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies also apply to Universal Windows applications. | No | | **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) | Yes | | **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft's Intelligent Security Graph (ISG). | Yes | @@ -45,7 +47,7 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **16 Enabled:Update Policy No Reboot** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot.
    NOTE: This option is only supported on Windows 10, version 1709 and later, or Windows Server 2019 and later.| No | | **17 Enabled:Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it.
    NOTE: This option is only supported on Windows 10, version 1903 and later, or Windows Server 2022 and later. | No | | **18 Disabled:Runtime FilePath Rule Protection** | This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator.
    NOTE: This option is only supported on Windows 10, version 1903 and later, or Windows Server 2022 and later. | Yes | -| **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries.
    NOTE: This option is only supported on Windows 10, version 1803 and later, or Windows Server 2019 and later. | No | +| **19 Enabled:Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries.
    NOTE: This option is only supported on Windows 10, version 1803 and later, or Windows Server 2019 and later.
    NOTE: This option is always enforced if *any* WDAC UMCI policy enables it. There's no audit mode for .NET dynamic code security hardening. | No | | **20 Enabled:Revoked Expired As Unsigned** | Use this option to treat binaries signed with revoked certificates, or expired certificates with the Lifetime Signing EKU on the signature, as "Unsigned binaries" for user-mode process/components, under enterprise signing scenarios. | No | | **Enabled:Developer Mode Dynamic Code Trust** | Use this option to trust UWP apps that are [debugged in Visual Studio](/visualstudio/debugger/run-windows-store-apps-on-a-remote-machine) or deployed through device portal when Developer Mode is enabled on the system. | No | @@ -71,7 +73,7 @@ Each file rule level has advantages and disadvantages. Use Table 2 to select the | **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product have different hash values but typically the same signing certificate. When this level is used, no policy update would be needed to run the new version of the application. However, leaf certificates typically have shorter validity periods than other certificate levels, so the WDAC policy must be updated whenever these certificates change. | | **PcaCertificate** | Adds the highest available certificate in the provided certificate chain to signers. This level is typically one certificate below the root because the scan doesn't resolve the complete certificate chain via the local root stores or with an online check. | | **RootCertificate** | Not supported. | -| **WHQL** | Only trusts binaries that have been submitted to Microsoft and signed by the Windows Hardware Qualification Lab (WHQL). This level is primarily for kernel binaries. | +| **WHQL** | Only trusts binaries that were submitted to Microsoft and signed by the Windows Hardware Qualification Lab (WHQL). This level is primarily for kernel binaries. | | **WHQLPublisher** | This level combines the WHQL level and the CN on the leaf certificate, and is primarily for kernel binaries. | | **WHQLFilePublisher** | This level combines the "FileName" attribute of the signed file, plus "WHQLPublisher", plus a minimum version number. This level is primarily for kernel binaries. By default, this level uses the OriginalFileName attribute of the file's resource header. Use [-SpecificFileNameLevel](#use--specificfilenamelevel-with-filename-filepublisher-or-whqlfilepublisher-level-rules) to choose an alternative attribute, such as ProductName. | @@ -96,7 +98,7 @@ For example, consider an IT professional in a department that runs many servers. To create the WDAC policy, they build a reference server on their standard hardware, and install all of the software that their servers are known to run. Then they run [New-CIPolicy](/powershell/module/configci/new-cipolicy) with **-Level Publisher** (to allow software from their software providers, the "Publishers") and **-Fallback Hash** (to allow the internal, unsigned application). They deploy the policy in auditing mode to determine the potential impact from enforcing the policy. With the help of the audit data, they update their WDAC policies to include any other software they want to run. Then they enable the WDAC policy in enforced mode for their servers. -As part of normal operations, they'll eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they won't need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version. +As part of normal operations, they'll eventually install software updates, or perhaps add software from the same software providers. Because the "Publisher" remains the same on those updates and software, they don't need to update their WDAC policy. If the unsigned, internal application is updated, they must also update the WDAC policy to allow the new version. ## File rule precedence order @@ -107,7 +109,7 @@ WDAC has a built-in file rule conflict logic that translates to precedence order ## Use -SpecificFileNameLevel with FileName, FilePublisher, or WHQLFilePublisher level rules -By default, the FileName, FilePublisher, and WHQLFilePublisher rule levels will use the OriginalFileName attribute from the file's resource header. You can use an alternative resource header attribute for your rules by setting the **-SpecificFileNameLevel**. For instance, a software developer may use the same ProductName for all binaries that are part of an app. Using -SpecificFileNameLevel, you can create a single rule to cover all of those binaries in your policy rather than individual rules for every file. +By default, the FileName, FilePublisher, and WHQLFilePublisher rule levels use the OriginalFileName attribute from the file's resource header. You can use an alternative resource header attribute for your rules by setting the **-SpecificFileNameLevel**. For instance, a software developer might use the same ProductName for all binaries that are part of an app. Using -SpecificFileNameLevel, you can create a single rule to cover all of those binaries in your policy rather than individual rules for every file. Table 3 describes the available resource header attribute options you can set with -SpecificFileNameLevel. @@ -124,7 +126,7 @@ Table 3 describes the available resource header attribute options you can set wi ## More information about filepath rules -Filepath rules don't provide the same security guarantees that explicit signer rules do, since they're based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. Path rules are best suited to allow paths that you expect to remain admin-writeable only. You may want to avoid path rules for directories where standard users can modify ACLs on the folder. +Filepath rules don't provide the same security guarantees that explicit signer rules do, since they're based on mutable access permissions. Filepath rules are best suited for environments where most users are running as standard rather than admin. Path rules are best suited to allow paths that you expect to remain admin-writeable only. You might want to avoid path rules for directories where standard users can modify ACLs on the folder. ### User-writable filepaths @@ -182,8 +184,8 @@ In the cmdlets, rather than try to predict which hash will be used, we precalcul ### Why does scan create eight hash rules for certain files? -Separate rules are created for UMCI and KMCI. If the cmdlets can't determine that a file will only run in user-mode or in the kernel, then rules are created for both signing scenarios out of an abundance of caution. If you know that a particular file will only load in either user-mode or kernel, then you can safely remove the extra rules. +Separate rules are created for UMCI and KMCI. If the cmdlets can't determine that a file only runs in user-mode or in the kernel, then rules are created for both signing scenarios out of an abundance of caution. If you know that a particular file only loads in either user-mode or kernel, then you can safely remove the extra rules. ### When does WDAC use the flat file hash value? -There are some rare cases where a file's format doesn't conform to the Authenticode spec and so WDAC falls back to use the flat file hash. This can occur for a number of reasons, such as if changes are made to the in-memory version of the file at runtime. In such cases, you'll see that the hash shown in the correlated 3089 signature information event matches the flat file hash from the 3076/3077 block event. To create rules for files with an invalid format, you can add hash rules to the policy for the flat file hash using the WDAC Wizard or by editing the policy XML directly. +There are some rare cases where a file's format doesn't conform to the Authenticode spec and so WDAC falls back to use the flat file hash. This behavior can occur for many reasons, such as if changes are made to the in-memory version of the file at runtime. In such cases, you'll see that the hash shown in the correlated 3089 signature information event matches the flat file hash from the 3076/3077 block event. To create rules for files with an invalid format, you can add hash rules to the policy for the flat file hash using the WDAC Wizard or by editing the policy XML directly. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md index 8f866fa055..b0ec0ebfe9 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet.md @@ -2,7 +2,7 @@ title: Windows Defender Application Control and .NET description: Understand how WDAC and .NET work together and use Dynamic Code Security to verify code loaded by .NET at runtime. ms.localizationpriority: medium -ms.date: 08/10/2022 +ms.date: 11/22/2023 ms.topic: article --- @@ -10,9 +10,9 @@ ms.topic: article .NET apps (as written in a high-level language like C#) are compiled to an Intermediate Language (IL). IL is a compact code format that can be supported on any operating system or architecture. Most .NET apps use APIs that are supported in multiple environments, requiring only the .NET runtime to run. IL needs to be compiled to native code in order to execute on a CPU, for example Arm64 or x64. When .NET compiles IL to native image (NI) on a device with a WDAC user mode policy, it first checks whether the original IL file passes the current WDAC policies. If so, .NET sets an NTFS extended attribute (EA) on the generated NI file so that WDAC knows to trust it as well. When the .NET app runs, WDAC sees the EA on the NI file and allows it. -The EA set on the NI file only applies to the currently active WDAC policies. If one of the active WDAC policies is updated or a new policy is applied, the EA on the NI file is invalidated. The next time the app runs, WDAC will block the NI file. .NET handles the block gracefully and will fall back to the original IL code. If the IL still passes the latest WDAC policies, then the app runs without any functional impact. Since the IL is now being compiled at runtime, you may notice a slight impact to performance of the app. When .NET must fall back to IL, .NET will also schedule a process to run at the next maintenance window to regenerate all NI files, thus reestablishing the WDAC EA for all code that passes the latest WDAC policies. +The EA set on the NI file only applies to the currently active WDAC policies. If one of the active WDAC policies is updated or a new policy is applied, the EA on the NI file is invalidated. The next time the app runs, WDAC will block the NI file. .NET handles the block gracefully and falls back to the original IL code. If the IL still passes the latest WDAC policies, then the app runs without any functional impact. Since the IL is now being compiled at runtime, you might notice a slight impact to performance of the app. When .NET must fall back to IL, .NET will also schedule a process to run at the next maintenance window to regenerate all NI files, thus reestablishing the WDAC EA for all code that passes the latest WDAC policies. -In some cases, if an NI file is blocked, you may see a "false positive" block event in the *CodeIntegrity - Operational* event log as described in [WDAC Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues#net-native-images-may-generate-false-positive-block-events). +In some cases, if an NI file is blocked, you might see a "false positive" block event in the *CodeIntegrity - Operational* event log as described in [WDAC Admin Tips & Known Issues](/windows/security/threat-protection/windows-defender-application-control/operations/known-issues#net-native-images-may-generate-false-positive-block-events). To mitigate any performance impact caused when the WDAC EA isn't valid or missing: @@ -22,14 +22,17 @@ To mitigate any performance impact caused when the WDAC EA isn't valid or missin ## WDAC and .NET hardening -Security researchers have found that some .NET capabilities that allow apps to load libraries from external sources or generate new code at runtime can be used to circumvent WDAC controls. -Beginning with Windows 10, version 1803, WDAC includes a new option, called *Dynamic Code Security* that works with .NET to verify code loaded at runtime. +Security researchers found that some .NET capabilities that allow apps to load libraries from external sources or generate new code at runtime can be used to circumvent WDAC controls. +To address this potential vulnerability, WDAC includes an option called *Dynamic Code Security* that works with .NET to verify code loaded at runtime. -When the Dynamic Code Security option is enabled, Application Control policy is applied to libraries that .NET loads from external sources. For example, any non-local sources, such as the internet or a network share. +When the Dynamic Code Security option is enabled, Application Control policy is applied to libraries that .NET loads from external sources. For example, any remote sources, such as the internet or a network share. -Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that has been tampered with. +> [!IMPORTANT] +> .Net dynamic code security hardening is *turned on and enforced* if any WDAC policy with UMCI enabled has set option **19 Enabled:Dynamic Code Security**. There is no audit mode for this feature. You should test your apps with this option set before turning it on across large numbers of devices. -Dynamic Code Security isn't enabled by default because existing policies may not account for externally loaded libraries. +Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that was tampered with. + +Dynamic Code Security isn't enabled by default because existing policies might not account for externally loaded libraries. Additionally, a few .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, aren't currently supported with Dynamic Code Security enabled. Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy. diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md index 0666d011c5..91af264958 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/known-issues.md @@ -2,7 +2,7 @@ title: WDAC Admin Tips & Known Issues description: WDAC Known Issues ms.manager: jsuther -ms.date: 05/09/2023 +ms.date: 11/22/2023 ms.topic: article ms.localizationpriority: medium --- @@ -23,7 +23,7 @@ This article covers tips and tricks for admins and known issues with Windows Def The *\{PolicyId GUID\}* value is unique by policy and defined in the policy XML with the <PolicyId> element. -For **single policy format WDAC policies**, in addition to the two preceding locations, also look for a file called SiPolicy.p7b that may be found in the following locations: +For **single policy format WDAC policies**, in addition to the two preceding locations, also look for a file called SiPolicy.p7b in the following locations: - <EFI System Partition>\\Microsoft\\Boot\\SiPolicy.p7b - <OS Volume>\\Windows\\System32\\CodeIntegrity\\SiPolicy.p7b @@ -35,7 +35,7 @@ For **single policy format WDAC policies**, in addition to the two preceding loc When the WDAC engine evaluates files against the active set of policies on the device, rules are applied in the following order. Once a file encounters a match, WDAC stops further processing. -1. Explicit deny rules - if any explicit deny rule exists for the file, it's blocked even if other rules are created to try to allow it. Deny rules can use any [rule level](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-file-rule-levels). Use the most specific rule level practical when creating deny rules to avoid blocking more than you intend. +1. Explicit deny rules - a file is blocked if any explicit deny rule exists for it, even if other rules are created to try to allow it. Deny rules can use any [rule level](/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-file-rule-levels). Use the most specific rule level practical when creating deny rules to avoid blocking more than you intend. 2. Explicit allow rules - if any explicit allow rule exists for the file, the file runs. @@ -43,17 +43,24 @@ When the WDAC engine evaluates files against the active set of policies on the d 4. Lastly, WDAC makes a cloud call to the ISG to get reputation about the file, if the policy enables the ISG option. -5. If no rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. +5. If no explicit rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. ## Known issues ### Boot stop failure (blue screen) occurs if more than 32 policies are active -If the maximum number of policies is exceeded, the device may bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. +If the maximum number of policies is exceeded, the device will bluescreen referencing ci.dll with a bug check value of 0x0000003b. Consider this maximum policy count limit when planning your WDAC policies. Any [Windows inbox policies](/windows/security/threat-protection/windows-defender-application-control/operations/inbox-wdac-policies) that are active on the device also count towards this limit. + +### Audit mode policies can change the behavior for some apps or cause app crashes + +Although WDAC audit mode is designed to avoid impact to apps, some features are always on/always enforced with any WDAC policy that includes the option **0 Enabled:UMCI**. Here's a list of known system changes in audit mode: + +- Some script hosts might block code or run code with fewer privileges even in audit mode. See [Script enforcement with WDAC](/windows/security/application-security/application-control/windows-defender-application-control/design/script-enforcement) for information about individual script host behaviors. +- Option **19 Enabled:Dynamic Code Security** is always enforced if any UMCI policy includes that option. See [WDAC and .NET](/windows/security/application-security/application-control/windows-defender-application-control/design/wdac-and-dotnet#wdac-and-net-hardening). ### Managed Installer and ISG may cause excessive events -When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events have been moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy. +When Managed Installer and ISG are enabled, 3091 and 3092 events are logged when a file didn't have Managed Installer or ISG authorization, regardless of whether the file was allowed. These events were moved to the verbose channel beginning with the September 2022 Update Preview since the events don't indicate an issue with the policy. ### .NET native images may generate false positive block events @@ -83,13 +90,13 @@ msiexec -i c:\temp\Windows10_Version_1511_ADMX.msi ``` ### Slow boot and performance with custom policies -WDAC will evaluate all running processes, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, it's strongly recommended to build off the [WDAC base templates](../design/example-wdac-base-policies.md). +WDAC evaluates all processes that run, including inbox Windows processes. If policies don't build off the WDAC templates or don't trust the Windows signers, you'll see slower boot times, degraded performance and possibly boot issues. For these reasons, you should use the [WDAC base templates](../design/example-wdac-base-policies.md) whenever possible to create your policies. #### AppId Tagging policy considerations If the AppId Tagging Policy wasn't built off the WDAC base templates or doesn't allow the Windows in-box signers, you'll notice a significant increase in boot times (~2 minutes). -If you can't allowlist the Windows signers, or build off the WDAC base templates, it is strongly recommended to add the following rule to your policies to improve the performance: +If you can't allowlist the Windows signers, or build off the WDAC base templates, it's recommended to add the following rule to your policies to improve the performance: :::image type="content" source="../images/known-issue-appid-dll-rule.png" alt-text="Allow all dlls in the policy."::: From 071052fc2dbe232eede4b538f0b6f273bee8c18c Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Wed, 22 Nov 2023 10:53:19 -0800 Subject: [PATCH 211/237] Update windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md Co-authored-by: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> --- .../design/plan-wdac-management.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md b/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md index e8e60567e7..c1eee0110d 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/plan-wdac-management.md @@ -53,7 +53,7 @@ Each time that WDAC blocks a process, events are written to either the CodeInteg Collecting these events in a central location can help you maintain your Windows Defender Application Control policy and troubleshoot rule configuration problems. You can [use the Azure Monitor Agent](/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent) to automatically collect your WDAC events for analysis. -Additionally, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) collects WDAC events and can be queried using the [advanced hunting](../operations/querying-application-control-events-centrally-using-advanced-hunting.md) feature. +Additionally, [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint) collects WDAC events which can be queried using the [advanced hunting](../operations/querying-application-control-events-centrally-using-advanced-hunting.md) feature. ## Application and user support policy From 24372bd337aa20b485d5890cad158cad36c80971 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 23 Nov 2023 09:00:57 -0800 Subject: [PATCH 212/237] F SKU update --- .../windows-autopatch/overview/windows-autopatch-faq.yml | 8 ++++---- .../prepare/windows-autopatch-prerequisites.md | 8 ++++++-- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 54d107d92d..07ad0a843b 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -4,7 +4,7 @@ metadata: description: Answers to frequently asked questions about Windows Autopatch. ms.prod: windows-client ms.topic: faq - ms.date: 07/19/2023 + ms.date: 11/29/2023 audience: itpro ms.localizationpriority: medium manager: dougeby @@ -28,7 +28,7 @@ sections: Windows Autopatch supports Windows 365 for Enterprise. Windows 365 for Business isn't supported. - question: Does Windows Autopatch support Windows Education (A3/A5) or Windows Front Line Worker (F3) licensing? answer: | - Autopatch isn't available for 'A' or 'F' series licensing. + Autopatch isn't available for 'A'. Windows Autopatch supports some'F' series licensing. For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses). - question: Will Windows Autopatch support local domain join Windows 10? answer: | Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Microsoft Entra join](/azure/active-directory/devices/concept-azure-ad-join-hybrid). @@ -54,8 +54,8 @@ sections: - [Switch workloads for device configuration, Windows Update and Microsoft 365 Apps from Configuration Manager to Intune](/mem/configmgr/comanage/how-to-switch-workloads) (minimum Pilot Intune. Pilot collection must contain the devices you want to register into Autopatch.) - question: What are the licensing requirements for Windows Autopatch? answer: | - - Windows Autopatch is included with Window 10/11 Enterprise E3 or higher (user-based only). For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses). - - [Azure AD Premium](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses) (for Co-management) + - Windows Autopatch is included with Window 10/11 Enterprise E3 or higher (user-based only) or F3. For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses). + - [Azure AD Premium](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses) (for co-management) - [Microsoft Intune](/mem/intune/fundamentals/licenses) (includes Configuration Manager 2010 or greater via co-management) - question: Are there hardware requirements for Windows Autopatch? answer: | diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index 7cb1b4a4d5..c84e610b56 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -1,7 +1,7 @@ --- title: Prerequisites description: This article details the prerequisites needed for Windows Autopatch -ms.date: 09/24/2023 +ms.date: 11/29/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual @@ -21,7 +21,7 @@ Getting started with Windows Autopatch has been designed to be easy. This articl | Area | Prerequisite details | | ----- | ----- | -| Licensing | Windows Autopatch requires Windows 10/11 Enterprise E3 (or higher) to be assigned to your users. Additionally, Microsoft Entra ID P1 or P2 and Microsoft Intune are required. For details about the specific service plans, see [more about licenses](#more-about-licenses).

    For more information on available licenses, see [Microsoft 365 licensing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans).

    For more information about licensing terms and conditions for products and services purchased through Microsoft Commercial Volume Licensing Programs, see the [Product Terms site](https://www.microsoft.com/licensing/terms/). | +| Licensing | Windows Autopatch requires Windows 10/11 Enterprise E3 (or higher), or F3 to be assigned to your users. Additionally, Microsoft Entra ID P1 or P2 and Microsoft Intune are required. For details about the specific service plans, see [more about licenses](#more-about-licenses).

    For more information on available licenses, see [Microsoft 365 licensing](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans).

    For more information about licensing terms and conditions for products and services purchased through Microsoft Commercial Volume Licensing Programs, see the [Product Terms site](https://www.microsoft.com/licensing/terms/). | | Connectivity | All Windows Autopatch devices require connectivity to multiple Microsoft service endpoints from the corporate network.

    For the full list of required IPs and URLs, see [Configure your network](../prepare/windows-autopatch-configure-network.md). | | Microsoft Entra ID | Microsoft Entra ID must either be the source of authority for all user accounts, or user accounts must be synchronized from on-premises Active Directory using the latest supported version of Microsoft Entra Connect to enable Microsoft Entra hybrid join.

    | | Device management | [Devices must be already enrolled with Microsoft Intune](/mem/intune/user-help/enroll-windows-10-device) prior to registering with Windows Autopatch. Intune must be set as the Mobile Device Management (MDM) authority or co-management must be turned on and enabled on the target devices.

    At a minimum, the Windows Update, Device configuration and Office Click-to-Run apps workloads must be set to Pilot Intune or Intune. You must also ensure that the devices you intend on bringing to Windows Autopatch are in the targeted device collection. For more information, see [co-management requirements for Windows Autopatch](#configuration-manager-co-management-requirements).

    Other device management prerequisites include:

    • Devices must be corporate-owned. Windows bring-your-own-devices (BYOD) are blocked during device registration prerequisite checks.
    • Devices must be managed by either Intune or Configuration Manager co-management. Devices only managed by Configuration Manager aren't supported.
    • Devices must be in communication with Microsoft Intune in the **last 28 days**. Otherwise, the devices won't be registered with Autopatch.
    • Devices must be connected to the internet.
    • Devices must have a **Serial number**, **Model** and **Manufacturer**. Device emulators that don't generate this information fail to meet **Intune or Cloud-attached** prerequisite check.

    See [Register your devices](/windows/deployment/windows-autopatch/deploy/windows-autopatch-register-devices) for more details on device prerequisites and on how the device registration process works with Windows Autopatch.

    For more information on co-management, see [co-management for Windows devices](/mem/configmgr/comanage/overview).

    | @@ -46,6 +46,10 @@ Windows Autopatch is included with Windows 10/11 Enterprise E3 or higher (user-b | [Windows 10/11 Enterprise E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E3 | 6a0f6da5-0b87-4190-a6ae-9bb5a2b9546a | | [Windows 10/11 Enterprise E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E5 | 488ba24a-39a9-4473-8ee5-19291e71b002 | | [Windows 10/11 Enterprise VDA](/windows/deployment/deploy-enterprise-licenses#virtual-desktop-access-vda) | E3_VDA_only | d13ef257-988a-46f3-8fce-f47484dd4550 | +| [Microsoft 365 F3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_F1 | 66b55226-6b4f-492c-910c-a3b7a3c9d993 | +| Microsoft 365 F3 (self-service) | Microsoft_365_F3_Department |6803cf1e-c822-41a1-864e-a31377bcdb7e | +| Microsoft 365 F3 (for Department) | Microsoft_365_F3_DEPT |45972061-34c4-44c8-9e83-ad97815acc34 | +| Microsoft 365 F3 EEA (no Teams) | Microsoft_365_F3_EEA_(no_Teams) | f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87 | The following Windows 10 editions, build version and architecture are supported to be [registered](../deploy/windows-autopatch-register-devices.md) with Windows Autopatch: From 9a94fa6ff7636eeb5045331cdeb276e12a5420ac Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 23 Nov 2023 09:13:58 -0800 Subject: [PATCH 213/237] Spacing issue --- .../windows-autopatch/overview/windows-autopatch-faq.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index 07ad0a843b..e071af5384 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -28,7 +28,7 @@ sections: Windows Autopatch supports Windows 365 for Enterprise. Windows 365 for Business isn't supported. - question: Does Windows Autopatch support Windows Education (A3/A5) or Windows Front Line Worker (F3) licensing? answer: | - Autopatch isn't available for 'A'. Windows Autopatch supports some'F' series licensing. For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses). + Autopatch isn't available for 'A'. Windows Autopatch supports some 'F' series licensing. For more information, see [More about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses). - question: Will Windows Autopatch support local domain join Windows 10? answer: | Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Microsoft Entra join](/azure/active-directory/devices/concept-azure-ad-join-hybrid). From dcbdddf46958924d8ea9b8b64f7b731407d3f999 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 27 Nov 2023 05:52:59 -0800 Subject: [PATCH 214/237] off-mdag-edit --- windows/whats-new/deprecated-features.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/deprecated-features.md b/windows/whats-new/deprecated-features.md index 7b811e9bf5..9493e41132 100644 --- a/windows/whats-new/deprecated-features.md +++ b/windows/whats-new/deprecated-features.md @@ -1,7 +1,7 @@ --- title: Deprecated features in the Windows client description: Review the list of features that Microsoft is no longer actively developing in Windows 10 and Windows 11. -ms.date: 11/16/2023 +ms.date: 11/27/2023 ms.prod: windows-client ms.technology: itpro-fundamentals ms.localizationpriority: medium @@ -36,7 +36,7 @@ The features in this article are no longer being actively developed, and might b | Feature | Details and mitigation | Deprecation announced | |---|---|---| -| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install) is deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | +| Microsoft Defender Application Guard for Office | [Microsoft Defender Application Guard for Office](/microsoft-365/security/office-365-security/app-guard-for-office-install) is being deprecated and is no longer being updated. This deprecation also includes the [Windows.Security.Isolation APIs](/uwp/api/windows.security.isolation) that are used for Microsoft Defender Application Guard for Office. We recommend transitioning to Microsoft Defender for Endpoint [attack surface reduction rules](/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction) along with [Protected View](/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365#global-settings-for-safe-attachments) and [Windows Defender Application Control](/windows/security/application-security/application-control/windows-defender-application-control/wdac). | November 2023 | | Steps Recorder (psr.exe) | Steps Recorder is no longer being updated and will be removed in a future release of Windows. For screen recording, we recommend the Snipping Tool, Xbox Game Bar, or Microsoft Clipchamp. | November 2023 | | Tips | The Tips app is deprecated and will be removed in a future release of Windows. Content in the app will continue to be updated with information about new Windows features until the app is removed. | November 2023 | | Computer Browser | The Computer Browser driver and service are deprecated. The browser (browser protocol and service) is a dated and insecure device location protocol. This protocol, service, and driver were first disabled by default in Windows 10 with the removal of the SMB1 service. For more information on Computer Browser, see [MS-BRWS Common Internet File System](/openspecs/windows_protocols/ms-brws/3cfbad92-09b3-4abc-808f-c6f6347d5677). | November 2023 | From e31e113e42fafe90618b5b209c425047120148ec Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Mon, 27 Nov 2023 16:26:07 -0500 Subject: [PATCH 215/237] Update ms.topic to reference --- ...advanced-security-audit-policy-settings.md | 14 +-- .../auditing/advanced-security-auditing.md | 6 +- ...-basic-audit-policy-on-a-file-or-folder.md | 20 ++-- .../auditing/audit-token-right-adjusted.md | 6 +- .../basic-audit-account-logon-events.md | 12 +-- .../basic-audit-account-management.md | 8 +- .../basic-audit-directory-service-access.md | 14 +-- .../auditing/basic-audit-logon-events.md | 18 ++-- .../auditing/basic-audit-object-access.md | 6 +- .../auditing/basic-audit-policy-change.md | 34 +++---- .../auditing/basic-audit-privilege-use.md | 14 +-- .../auditing/basic-audit-process-tracking.md | 24 ++--- .../auditing/basic-audit-system-events.md | 18 ++-- .../auditing/basic-security-audit-policies.md | 14 +-- .../basic-security-audit-policy-settings.md | 22 ++--- ...t-policy-settings-for-an-event-category.md | 6 +- ...le-system-global-object-access-auditing.md | 6 +- .../how-to-list-xml-elements-in-eventdata.md | 6 +- ...tral-access-policy-and-rule-definitions.md | 8 +- .../auditing/monitor-claim-types.md | 8 +- .../monitor-resource-attribute-definitions.md | 8 +- ...icies-associated-with-files-and-folders.md | 10 +- ...ss-policies-that-apply-on-a-file-server.md | 8 +- ...esource-attributes-on-files-and-folders.md | 8 +- ...or-the-use-of-removable-storage-devices.md | 6 +- ...r-user-and-device-claims-during-sign-in.md | 8 +- ...loying-advanced-security-audit-policies.md | 38 ++++---- .../registry-global-object-access-auditing.md | 6 +- .../auditing/security-auditing-overview.md | 6 +- ...-monitor-dynamic-access-control-objects.md | 10 +- .../auditing/view-the-security-event-log.md | 8 +- ...ort-advanced-audit-policy-configuration.md | 12 +-- ...-credential-manager-as-a-trusted-caller.md | 10 +- .../access-this-computer-from-the-network.md | 16 ++-- .../account-lockout-duration.md | 16 ++-- .../account-lockout-policy.md | 12 +-- .../account-lockout-threshold.md | 20 ++-- .../account-policies.md | 10 +- .../accounts-administrator-account-status.md | 8 +- .../accounts-block-microsoft-accounts.md | 10 +- .../accounts-guest-account-status.md | 12 +-- ...f-blank-passwords-to-console-logon-only.md | 8 +- .../accounts-rename-administrator-account.md | 12 +-- .../accounts-rename-guest-account.md | 14 +-- .../act-as-part-of-the-operating-system.md | 14 +-- .../add-workstations-to-domain.md | 6 +- .../adjust-memory-quotas-for-a-process.md | 14 +-- .../administer-security-policy-settings.md | 16 ++-- .../allow-log-on-locally.md | 2 +- ...-log-on-through-remote-desktop-services.md | 18 ++-- ...dit-the-access-of-global-system-objects.md | 38 ++++---- ...the-use-of-backup-and-restore-privilege.md | 16 ++-- ...policy-subcategory-settings-to-override.md | 22 ++--- .../security-policy-settings/audit-policy.md | 6 +- ...iately-if-unable-to-log-security-audits.md | 24 ++--- .../back-up-files-and-directories.md | 12 +-- .../bypass-traverse-checking.md | 22 ++--- .../change-the-system-time.md | 14 +-- .../change-the-time-zone.md | 20 ++-- .../create-a-pagefile.md | 20 ++-- .../create-a-token-object.md | 22 ++--- .../create-global-objects.md | 22 ++--- .../create-permanent-shared-objects.md | 20 ++-- .../create-symbolic-links.md | 20 ++-- ...criptor-definition-language-sddl-syntax.md | 24 ++--- ...criptor-definition-language-sddl-syntax.md | 22 ++--- .../debug-programs.md | 24 ++--- ...ccess-to-this-computer-from-the-network.md | 6 +- .../deny-log-on-as-a-batch-job.md | 22 ++--- .../deny-log-on-as-a-service.md | 22 ++--- .../deny-log-on-locally.md | 20 ++-- ...-log-on-through-remote-desktop-services.md | 18 ++-- ...s-allow-undock-without-having-to-log-on.md | 22 ++--- ...wed-to-format-and-eject-removable-media.md | 22 ++--- ...t-users-from-installing-printer-drivers.md | 24 ++--- ...m-access-to-locally-logged-on-user-only.md | 22 ++--- ...y-access-to-locally-logged-on-user-only.md | 20 ++-- ...llow-server-operators-to-schedule-tasks.md | 20 ++-- ...rver-channel-binding-token-requirements.md | 2 +- ...roller-ldap-server-signing-requirements.md | 20 ++-- ...refuse-machine-account-password-changes.md | 18 ++-- ...rypt-or-sign-secure-channel-data-always.md | 26 +++--- ...crypt-secure-channel-data-when-possible.md | 22 ++--- ...-sign-secure-channel-data-when-possible.md | 24 ++--- ...isable-machine-account-password-changes.md | 28 +++--- ...er-maximum-machine-account-password-age.md | 26 +++--- ...trong-windows-2000-or-later-session-key.md | 8 +- ...r-accounts-to-be-trusted-for-delegation.md | 24 ++--- .../enforce-password-history.md | 22 ++--- .../enforce-user-logon-restrictions.md | 16 ++-- .../force-shutdown-from-a-remote-system.md | 20 ++-- .../generate-security-audits.md | 20 ++-- ...w-to-configure-security-policy-settings.md | 2 +- ...personate-a-client-after-authentication.md | 18 ++-- .../increase-a-process-working-set.md | 16 ++-- .../increase-scheduling-priority.md | 14 +-- ...-information-when-the-session-is-locked.md | 8 +- ...ive-logon-do-not-display-last-user-name.md | 2 +- ...ctive-logon-do-not-require-ctrl-alt-del.md | 20 ++-- ...-logon-dont-display-username-at-sign-in.md | 2 +- ...logon-machine-account-lockout-threshold.md | 18 ++-- ...eractive-logon-machine-inactivity-limit.md | 22 ++--- ...age-text-for-users-attempting-to-log-on.md | 6 +- ...ge-title-for-users-attempting-to-log-on.md | 6 +- ...case-domain-controller-is-not-available.md | 26 +++--- ...er-to-change-password-before-expiration.md | 16 ++-- ...er-authentication-to-unlock-workstation.md | 20 ++-- .../interactive-logon-require-smart-card.md | 4 +- ...ctive-logon-smart-card-removal-behavior.md | 20 ++-- .../kerberos-policy.md | 10 +- .../load-and-unload-device-drivers.md | 20 ++-- .../lock-pages-in-memory.md | 22 ++--- .../log-on-as-a-batch-job.md | 22 ++--- .../log-on-as-a-service.md | 24 ++--- .../manage-auditing-and-security-log.md | 22 ++--- .../maximum-lifetime-for-service-ticket.md | 20 ++-- ...aximum-lifetime-for-user-ticket-renewal.md | 22 ++--- .../maximum-lifetime-for-user-ticket.md | 20 ++-- .../maximum-password-age.md | 24 ++--- ...ance-for-computer-clock-synchronization.md | 22 ++--- ...nt-digitally-sign-communications-always.md | 4 +- ...ted-password-to-third-party-smb-servers.md | 20 ++-- ...time-required-before-suspending-session.md | 6 +- ...pt-s4u2self-to-obtain-claim-information.md | 24 ++--- ...er-digitally-sign-communications-always.md | 4 +- ...connect-clients-when-logon-hours-expire.md | 18 ++-- ...server-spn-target-name-validation-level.md | 22 ++--- .../minimum-password-age.md | 32 +++---- .../minimum-password-length.md | 8 +- .../modify-an-object-label.md | 24 ++--- .../modify-firmware-environment-values.md | 20 ++-- ...ess-allow-anonymous-sidname-translation.md | 20 ++-- ...-enumeration-of-sam-accounts-and-shares.md | 20 ++-- ...w-anonymous-enumeration-of-sam-accounts.md | 18 ++-- ...-credentials-for-network-authentication.md | 22 ++--- ...ne-permissions-apply-to-anonymous-users.md | 20 ++-- ...-pipes-that-can-be-accessed-anonymously.md | 38 ++++---- ...-accessible-registry-paths-and-subpaths.md | 24 ++--- ...cess-remotely-accessible-registry-paths.md | 22 ++--- ...nymous-access-to-named-pipes-and-shares.md | 22 ++--- ...lients-allowed-to-make-remote-sam-calls.md | 6 +- ...shares-that-can-be-accessed-anonymously.md | 20 ++-- ...g-and-security-model-for-local-accounts.md | 22 ++--- .../network-list-manager-policies.md | 8 +- ...ystem-to-use-computer-identity-for-ntlm.md | 24 ++--- ...allow-localsystem-null-session-fallback.md | 22 ++--- ...-this-computer-to-use-online-identities.md | 26 +++--- ...e-encryption-types-allowed-for-kerberos.md | 10 +- ...ager-hash-value-on-next-password-change.md | 20 ++-- ...ty-force-logoff-when-logon-hours-expire.md | 20 ++-- ...curity-lan-manager-authentication-level.md | 38 ++++---- ...curity-ldap-client-signing-requirements.md | 20 ++-- ...-ssp-based-including-secure-rpc-clients.md | 20 ++-- ...-ssp-based-including-secure-rpc-servers.md | 20 ++-- ...rver-exceptions-for-ntlm-authentication.md | 24 ++--- ...lm-add-server-exceptions-in-this-domain.md | 22 ++--- ...strict-ntlm-audit-incoming-ntlm-traffic.md | 22 ++--- ...udit-ntlm-authentication-in-this-domain.md | 22 ++--- ...ity-restrict-ntlm-incoming-ntlm-traffic.md | 20 ++-- ...ntlm-ntlm-authentication-in-this-domain.md | 18 ++-- ...outgoing-ntlm-traffic-to-remote-servers.md | 22 ++--- ...sword-must-meet-complexity-requirements.md | 2 +- .../password-policy.md | 22 ++--- .../perform-volume-maintenance-tasks.md | 20 ++-- .../profile-single-process.md | 20 ++-- .../profile-system-performance.md | 20 ++-- ...le-allow-automatic-administrative-logon.md | 20 ++-- ...py-and-access-to-all-drives-and-folders.md | 20 ++-- .../remove-computer-from-docking-station.md | 20 ++-- .../replace-a-process-level-token.md | 18 ++-- .../reset-account-lockout-counter-after.md | 22 ++--- .../restore-files-and-directories.md | 22 ++--- ...advanced-security-audit-policy-settings.md | 6 +- .../security-options.md | 4 +- .../security-policy-settings-reference.md | 18 ++-- .../security-policy-settings.md | 8 +- .../shut-down-the-system.md | 20 ++-- ...o-be-shut-down-without-having-to-log-on.md | 22 ++--- .../shutdown-clear-virtual-memory-pagefile.md | 24 ++--- ...e-passwords-using-reversible-encryption.md | 24 ++--- .../synchronize-directory-service-data.md | 20 ++-- ...on-for-user-keys-stored-on-the-computer.md | 20 ++-- ...thms-for-encryption-hashing-and-signing.md | 36 ++++---- ...nsensitivity-for-non-windows-subsystems.md | 20 ++-- ...-permissions-of-internal-system-objects.md | 18 ++-- .../system-settings-optional-subsystems.md | 20 ++-- ...ables-for-software-restriction-policies.md | 20 ++-- ...ake-ownership-of-files-or-other-objects.md | 22 ++--- ...-for-the-built-in-administrator-account.md | 22 ++--- ...vation-without-using-the-secure-desktop.md | 24 ++--- ...r-administrators-in-admin-approval-mode.md | 22 ++--- ...the-elevation-prompt-for-standard-users.md | 2 +- ...-installations-and-prompt-for-elevation.md | 20 ++-- ...ecutables-that-are-signed-and-validated.md | 20 ++-- ...-that-are-installed-in-secure-locations.md | 22 ++--- ...l-administrators-in-admin-approval-mode.md | 2 +- ...re-desktop-when-prompting-for-elevation.md | 22 ++--- ...ry-write-failures-to-per-user-locations.md | 20 ++-- .../user-rights-assignment.md | 92 +++++++++---------- 199 files changed, 1745 insertions(+), 1745 deletions(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index 3648c69063..eaa7ed73d3 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -1,5 +1,5 @@ --- -title: Advanced security audit policy settings +title: Advanced security audit policy settings description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 ms.author: vinpa @@ -10,7 +10,7 @@ ms.pagetype: security author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -26,7 +26,7 @@ The security audit policy settings under **Security Settings\\Advanced Audit Pol - A group administrator has modified settings or data on servers that contain finance information. - An employee within a defined group has accessed an important file. - The correct system access control list (SACL) - as a verifiable safeguard against undetected access - is applied to either of the following: - - every file and folder + - every file and folder - registry key on a computer - file share. @@ -34,7 +34,7 @@ You can access these audit policy settings through the Local Security Policy sna These advanced audit policy settings allow you to select only the behaviors that you want to monitor. You can exclude audit results for the following types of behaviors: - That are of little or no concern to you -- That create an excessive number of log entries. +- That create an excessive number of log entries. In addition, because security audit policies can be applied by using domain Group Policy Objects, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. Audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** are available in the following categories: @@ -63,7 +63,7 @@ The security audit policy settings in this category can be used to monitor chang Detailed Tracking security policy settings and audit events can be used for the following purposes: - To monitor the activities of individual applications and users on that computer -- To understand how a computer is being used. +- To understand how a computer is being used. This category includes the following subcategories: @@ -161,12 +161,12 @@ Global Object Access Auditing policy settings allow administrators to define com Auditors can prove that every resource in the system is protected by an audit policy. They can do this task by viewing the contents of the Global Object Access Auditing policy settings. For example, if auditors see a policy setting called "Track all changes made by group administrators," they know that this policy is in effect. Resource SACLs are also useful for diagnostic scenarios. For example, administrators quickly identify which object in a system is denying a user access by: -- Setting the Global Object Access Auditing policy to log all the activities for a specific user +- Setting the Global Object Access Auditing policy to log all the activities for a specific user - Enabling the policy to track "Access denied" events for the file system or registry can help > [!NOTE] > If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. - + This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) - [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index b6bf8dec61..43b13d18e4 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -1,8 +1,8 @@ --- -title: Advanced security audit policies +title: Advanced security audit policies description: Advanced security audit policy settings may appear to overlap with basic policies, but they are recorded and applied differently. Learn more about them here. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/6/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index c613a28ed2..d8dcb28e30 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -1,8 +1,8 @@ --- -title: Apply a basic audit policy on a file or folder +title: Apply a basic audit policy on a file or folder description: Apply audit policies to individual files and folders on your computer by setting the permission type to record access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -40,18 +40,18 @@ To complete this procedure, you must be signed in as a member of the built-in Ad - To audit failure events, select **Fail.** - To audit all events, select **All.** - + 6. In the **Applies to** box, select the object(s) to which the audit of events will apply. These objects include: - + - **This folder only** - **This folder, subfolders and files** - **This folder and subfolders** - **This folder and files** - **Subfolders and files only** - - **Subfolders only** + - **Subfolders only** - **Files only** - + 7. By default, the selected **Basic Permissions** to audit are the following: - **Read and execute** - **List folder contents** @@ -60,8 +60,8 @@ To complete this procedure, you must be signed in as a member of the built-in Ad - **Full control** - **Modify** - **Write** - -> [!IMPORTANT] + +> [!IMPORTANT] > Before you set up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md). To do this, define auditing policy settings for the object access event category. If you don't enable object access auditing, you'll receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## More considerations diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md index fd97b2de5e..1b9208a8d5 100644 --- a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -1,5 +1,5 @@ --- -title: Audit Token Right Adjusted +title: Audit Token Right Adjusted description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Token Right Adjusted, which determines whether the operating system generates audit events when specific changes are made to the privileges of a token. manager: aaroncz author: vinaypamnani-msft @@ -8,13 +8,13 @@ ms.pagetype: security ms.prod: windows-client ms.technology: itpro-security ms.date: 12/31/2017 -ms.topic: article +ms.topic: reference --- # Audit Token Right Adjusted -Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token. +Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token. For more information, see [Security Monitoring: A Possible New Way to Detect Privilege Escalation](/archive/blogs/nathangau/security-monitoring-a-possible-new-way-to-detect-privilege-escalation). diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md index 7773933079..017fb5ec82 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md @@ -1,8 +1,8 @@ --- -title: Audit account logon events +title: Audit account logon events description: Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -45,9 +45,9 @@ You can configure this security setting by opening the appropriate policy under | 681 | Logon failure. A domain account logon was attempted. This event is not generated in Windows XP or in the Windows Server 2003 family. | | 682 | A user has reconnected to a disconnected terminal server session. | | 683 | A user disconnected a terminal server session without logging off. | - + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index 9a6340c3a8..e3e8fa199c 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -1,8 +1,8 @@ --- -title: Audit account management +title: Audit account management description: Determines whether to audit each event of account management on a device. ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ Examples of account management events include: - A user account is renamed, disabled, or enabled. - A password is set or changed. -If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when any account management event succeeds. Failure audits generate an audit entry when any account management event fails. To +If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when any account management event succeeds. Failure audits generate an audit entry when any account management event fails. To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. **Default:** diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md index 6da1a9c54e..82647ef71b 100644 --- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md @@ -1,8 +1,8 @@ --- -title: Basic audit directory service access +title: Basic audit directory service access description: Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -26,7 +26,7 @@ By default, this value is set to no auditing in the Default Domain Controller Gr If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an Active Directory object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an Active Directory object that has a SACL specified. To set this value to **No auditing,** in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. > **Note:**  You can set a SACL on an Active Directory object by using the **Security** tab in that object's **Properties** dialog box. This is the same as Audit object access, except that it applies only to Active Directory objects and not to file system and registry objects. - + **Default:** - Success on domain controllers. @@ -41,9 +41,9 @@ There is only one directory service access event, which is identical to the Obje | Directory service access events | Description | |---------------------------------|----------------------------------------| | 566 | A generic object operation took place. | - + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index 523fee4769..4b5e68258f 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -1,8 +1,8 @@ --- -title: Audit logon events +title: Audit logon events description: Determines whether to audit each instance of a user logging on to or logging off from a device. ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -41,11 +41,11 @@ You can configure this security setting by opening the appropriate policy under | - | - | | 4624 | A user successfully logged on to a computer. For information about the type of logon, see the Logon Types table below. | | 4625 | Logon failure. A logon attempt was made with an unknown user name or a known user name with a bad password. | -| 4634 | The logoff process was completed for a user. | +| 4634 | The logoff process was completed for a user. | | 4647 | A user initiated the logoff process. | | 4648 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | | 4779 | A user disconnected a terminal server session without logging off. | - + When event 4624 (Legacy Windows Event ID 528) is logged, a logon type is also listed in the event log. The following table describes each logon type. @@ -60,9 +60,9 @@ When event 4624 (Legacy Windows Event ID 528) is logged, a logon type is also li | 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.| | 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop.| | 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.| - + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md index c9e7094492..66a2833e20 100644 --- a/windows/security/threat-protection/auditing/basic-audit-object-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md @@ -1,8 +1,8 @@ --- -title: Audit object access +title: Audit object access description: The policy setting, Audit object access, determines whether to audit the event generated when a user accesses an object that has its own SACL specified. ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md index bd7e9a9b7e..4db162688d 100644 --- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md @@ -1,8 +1,8 @@ --- -title: Audit policy change +title: Audit policy change description: Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -37,30 +37,30 @@ You can configure this security setting under Computer Configuration\\Windows Se | Policy change events | Description | | - | - | -| 608 | A user right was assigned.| +| 608 | A user right was assigned.| | 609 | A user right was removed. | -| 610 | A trust relationship with another domain was created.| -| 611 | A trust relationship with another domain was removed.| -| 612 | An audit policy was changed.| -| 613 | An Internet Protocol security (IPSec) policy agent started.| +| 610 | A trust relationship with another domain was created.| +| 611 | A trust relationship with another domain was removed.| +| 612 | An audit policy was changed.| +| 613 | An Internet Protocol security (IPSec) policy agent started.| | 614 | An IPSec policy agent was disabled. | | 615 | An IPSec policy agent changed. | -| 616 | An IPSec policy agent encountered a potentially serious failure.| +| 616 | An IPSec policy agent encountered a potentially serious failure.| | 617 | A Kerberos policy changed. | -| 618 | Encrypted Data Recovery policy changed.| -| 620 | A trust relationship with another domain was modified.| +| 618 | Encrypted Data Recovery policy changed.| +| 620 | A trust relationship with another domain was modified.| | 621 | System access was granted to an account. | -| 622 | System access was removed from an account.| -| 623 | Per user auditing policy was set for a user.| +| 622 | System access was removed from an account.| +| 623 | Per user auditing policy was set for a user.| | 625 | Per user audit policy was refreshed. | | 768 | A collision was detected between a namespace element in one forest and a namespace element in another forest.
    **Note**  When a namespace element in one forest overlaps a namespace element in another forest, it can lead to ambiguity in resolving a name belonging to one of the namespace elements. This overlap is also called a collision. Not all parameters are valid for each entry type. For example, fields such as DNS name, NetBIOS name, and SID are not valid for an entry of type 'TopLevelName'.| | 769 | Trusted forest information was added.
    **Note:**  This event message is generated when forest trust information is updated and one or more entries are added. One event message is generated per added, deleted, or modified entry. If multiple entries are added, deleted, or modified in a single update of the forest trust information, all the generated event messages have a single unique identifier called an operation ID. This allows you to determine that the multiple generated event messages are the result of a single operation. Not all parameters are valid for each entry type. For example, parameters such as DNS name, NetBIOS name and SID are not valid for an entry of type "TopLevelName".| | 770 | Trusted forest information was deleted.
    **Note:**  This event message is generated when forest trust information is updated and one or more entries are added. One event message is generated per added, deleted, or modified entry. If multiple entries are added, deleted, or modified in a single update of the forest trust information, all the generated event messages have a single unique identifier called an operation ID. This allows you to determine that the multiple generated event messages are the result of a single operation. Not all parameters are valid for each entry type. For example, parameters such as DNS name, NetBIOS name and SID are not valid for an entry of type "TopLevelName".| | 771 | Trusted forest information was modified.
    **Note:**  This event message is generated when forest trust information is updated and one or more entries are added. One event message is generated per added, deleted, or modified entry. If multiple entries are added, deleted, or modified in a single update of the forest trust information, all the generated event messages have a single unique identifier called an operation ID. This allows you to determine that the multiple generated event messages are the result of a single operation. Not all parameters are valid for each entry type. For example, parameters such as DNS name, NetBIOS name and SID are not valid for an entry of type "TopLevelName".| -| 805 | The event log service read the security log configuration for a session. - +| 805 | The event log service read the security log configuration for a session. + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md index 1382bf0fcb..11a05ab720 100644 --- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md +++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md @@ -1,8 +1,8 @@ --- -title: Audit privilege use +title: Audit privilege use description: Determines whether to audit each instance of a user exercising a user right. ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -46,10 +46,10 @@ You can configure this security setting under Computer Configuration\\Windows Se | - | - | | 576 | Specified privileges were added to a user's access token.
    **Note:**  This event is generated when the user logs on.| | 577 | A user attempted to perform a privileged system service operation. | -| 578 | Privileges were used on an already open handle to a protected object. | - +| 578 | Privileges were used on an already open handle to a protected object. | + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md index b7eb7ea1fd..796e7f323f 100644 --- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md +++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md @@ -1,8 +1,8 @@ --- -title: Audit process tracking +title: Audit process tracking description: Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -34,20 +34,20 @@ You can configure this security setting under Computer Configuration\\Windows Se | Process tracking events | Description | | - | - | -| 592 | A new process was created.| +| 592 | A new process was created.| | 593 | A process exited. | -| 594 | A handle to an object was duplicated.| -| 595 | Indirect access to an object was obtained.| +| 594 | A handle to an object was duplicated.| +| 595 | Indirect access to an object was obtained.| | 596 | A data protection master key was backed up.
    **Note:** The master key is used by the CryptProtectData and CryptUnprotectData routines, and Encrypting File System (EFS). The master key is backed up each time a new one is created. (The default setting is 90 days.) The key is usually backed up to a domain controller.| -| 597 | A data protection master key was recovered from a recovery server.| +| 597 | A data protection master key was recovered from a recovery server.| | 598 | Auditable data was protected. | -| 599 | Auditable data was unprotected.| -| 600 | A process was assigned a primary token.| +| 599 | Auditable data was unprotected.| +| 600 | A process was assigned a primary token.| | 601 | A user attempted to install a service. | | 602 | A scheduler job was created. | - + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md index 0af90ae965..c3a231e65c 100644 --- a/windows/security/threat-protection/auditing/basic-audit-system-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md @@ -1,8 +1,8 @@ --- -title: Audit system events +title: Audit system events description: Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -37,14 +37,14 @@ You can configure this security setting by opening the appropriate policy under | Logon events | Description | | - | - | -| 512 | Windows is starting up. | +| 512 | Windows is starting up. | | 513 | Windows is shutting down. | -| 514 | An authentication package was loaded by the Local Security Authority.| -| 515 | A trusted logon process has registered with the Local Security Authority.| -| 516 | Internal resources allocated for the queuing of security event messages have been exhausted, leading to the loss of some security event messages.| +| 514 | An authentication package was loaded by the Local Security Authority.| +| 515 | A trusted logon process has registered with the Local Security Authority.| +| 516 | Internal resources allocated for the queuing of security event messages have been exhausted, leading to the loss of some security event messages.| | 517 | The audit log was cleared. | -| 518 | A notification package was loaded by the Security Accounts Manager.| -| 519 | A process is using an invalid local procedure call (LPC) port in an attempt to impersonate a client and reply or read from or write to a client address space.| +| 518 | A notification package was loaded by the Security Accounts Manager.| +| 519 | A process is using an invalid local procedure call (LPC) port in an attempt to impersonate a client and reply or read from or write to a client address space.| | 520 | The system time was changed.
    **Note:**  This audit normally appears twice.| ## Related topics diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 95d4e51fe0..98827fba04 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -1,8 +1,8 @@ --- -title: Basic security audit policies +title: Basic security audit policies description: Learn about basic security audit policies that specify the categories of security-related events that you want to audit for the needs of your organization. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -41,8 +41,8 @@ If you choose to audit access to objects as part of your audit policy, you must | Topic | Description | | - | - | | [Create a basic audit policy for an event category](create-a-basic-audit-policy-settings-for-an-event-category.md) | By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. On devices that are joined to a domain, auditing settings for the event categories are undefined by default. On domain controllers, auditing is turned on by default. | -| [Apply a basic audit policy on a file or folder](apply-a-basic-audit-policy-on-a-file-or-folder.md) | You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. | -| [View the security event log](view-the-security-event-log.md) | The security log records each event as defined by the audit policies you set on each object.| +| [Apply a basic audit policy on a file or folder](apply-a-basic-audit-policy-on-a-file-or-folder.md) | You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. | +| [View the security event log](view-the-security-event-log.md) | The security log records each event as defined by the audit policies you set on each object.| | [Basic security audit policy settings](basic-security-audit-policy-settings.md) | Basic security audit policy settings are found under Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy.| - - + + diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index 9c9d050b55..70b4c9c798 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -1,8 +1,8 @@ --- -title: Basic security audit policy settings +title: Basic security audit policy settings description: Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/06/2021 ms.technology: itpro-security --- @@ -26,18 +26,18 @@ Basic security audit policy settings are found under Computer Configuration\\Win | Topic | Description | | - | - | -| [Audit account logon events](basic-audit-account-logon-events.md) | Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account.| -| [Audit account management](basic-audit-account-management.md) | Determines whether to audit each event of account management on a device.| -| [Audit directory service access](basic-audit-directory-service-access.md) | Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.| +| [Audit account logon events](basic-audit-account-logon-events.md) | Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account.| +| [Audit account management](basic-audit-account-management.md) | Determines whether to audit each event of account management on a device.| +| [Audit directory service access](basic-audit-directory-service-access.md) | Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified.| | [Audit logon events](basic-audit-logon-events.md) | Determines whether to audit each instance of a user logging on to or logging off from a device. | -| [Audit object access](basic-audit-object-access.md) | Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified.| +| [Audit object access](basic-audit-object-access.md) | Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified.| | [Audit policy change](basic-audit-policy-change.md) | Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. | | [Audit privilege use](basic-audit-privilege-use.md) | Determines whether to audit each instance of a user exercising a user right. | -| [Audit process tracking](basic-audit-process-tracking.md) | Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.| +| [Audit process tracking](basic-audit-process-tracking.md) | Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.| | [Audit system events](basic-audit-system-events.md) | Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. | - + ## Related topics - [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md index 9a49d95bbe..90f66f7720 100644 --- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -1,8 +1,8 @@ --- -title: Create a basic audit policy for an event category +title: Create a basic audit policy for an event category description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: low author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/07/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md index a248fd4f79..9e83c5b9cc 100644 --- a/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md @@ -1,8 +1,8 @@ --- -title: File System (Global Object Access Auditing) +title: File System (Global Object Access Auditing) description: The policy setting, File System (Global Object Access Auditing), enables you to configure a global system access control list (SACL) for an entire computer. ms.assetid: 4f215d61-0e23-46e4-9e58-08511105d25b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md b/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md index c9acfc2f7a..ba9bfd059d 100644 --- a/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md +++ b/windows/security/threat-protection/auditing/how-to-list-xml-elements-in-eventdata.md @@ -1,5 +1,5 @@ --- -title: How to get a list of XML data name elements in +title: How to get a list of XML data name elements in description: This reference article for the IT professional explains how to use PowerShell to get a list of XML data name elements that can appear in . ms.prod: windows-client ms.mktglfcycl: deploy @@ -8,11 +8,11 @@ ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 09/09/2021 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.technology: itpro-security -ms.topic: how-to +ms.topic: reference --- # How to get a list of XML data name elements in EventData diff --git a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md index 471ed8c690..2f42573827 100644 --- a/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-central-access-policy-and-rule-definitions.md @@ -1,8 +1,8 @@ --- -title: Monitor central access policy and rule definitions +title: Monitor central access policy and rule definitions description: Learn how to use advanced security auditing options to monitor changes to central access policy and central access rule definitions. ms.assetid: 553f98a6-7606-4518-a3c5-347a33105130 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ Follow the procedures in this article to configure settings to monitor changes t > [!NOTE] > Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. - + **Configure settings to monitor central access policy and rule definition changes** 1. Sign in to your domain controller by using domain administrator credentials. diff --git a/windows/security/threat-protection/auditing/monitor-claim-types.md b/windows/security/threat-protection/auditing/monitor-claim-types.md index 541639f07d..60d4da3a45 100644 --- a/windows/security/threat-protection/auditing/monitor-claim-types.md +++ b/windows/security/threat-protection/auditing/monitor-claim-types.md @@ -1,8 +1,8 @@ --- -title: Monitor claim types +title: Monitor claim types description: Learn how to monitor changes to claim types that are associated with dynamic access control when you're using advanced security auditing options. ms.assetid: 426084da-4eef-44af-aeec-e7ab4d4e2439 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ Use the following procedures to configure settings to monitor changes to claim t Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](/windows-server/identity/solution-guides/deploy-a-central-access-policy--demonstration-steps-). >**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. - + **To configure settings to monitor changes to claim types** 1. Sign in to your domain controller by using domain administrator credential. diff --git a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md index d9e2b2025d..69a7d74967 100644 --- a/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md +++ b/windows/security/threat-protection/auditing/monitor-resource-attribute-definitions.md @@ -1,8 +1,8 @@ --- -title: Monitor resource attribute definitions +title: Monitor resource attribute definitions description: Learn how to monitor changes to resource attribute definitions when you're using advanced security auditing options to monitor dynamic access control objects. ms.assetid: aace34b0-123a-4b83-9e09-f269220e79de -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ For information about monitoring changes to the resource attributes that apply t Use the following procedures to configure settings to monitor changes to resource attribute definitions in AD DS and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you haven't yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](/windows-server/identity/solution-guides/deploy-a-central-access-policy--demonstration-steps-). >**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. - + **To configure settings to monitor changes to resource attributes** 1. Sign in to your domain controller by using domain administrator credentials. diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md index 806cdbef89..19e11f0da4 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md @@ -1,8 +1,8 @@ --- -title: Monitor central access policies for files or folders +title: Monitor central access policies for files or folders description: Monitor changes to central access policies associated with files and folders, when using advanced security auditing options for dynamic access control objects. ms.assetid: 2ea8fc23-b3ac-432f-87b0-6a16506e8eed -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -30,7 +30,7 @@ Use the following procedures to configure settings to monitor central access pol > [!NOTE] > Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. - + **To configure settings to monitor central access policies associated with files or folders** 1. Sign in to your domain controller by using domain administrator credentials. @@ -66,7 +66,7 @@ After you configure settings to monitor changes to the central access policies t 4. Select the **Central Policy** tab, select **Change**, select a different central access policy (if one is available) or select **No Central Access Policy**, and then select **OK** twice. > [!NOTE] > You must select a setting that is different than your original setting to generate the audit event. - + 5. In Server Manager, select **Tools**, and then select **Event Viewer**. 6. Expand **Windows Logs**, and then select **Security**. 7. Look for event 4913, which is generated when the central access policy that's associated with a file or folder changes. This event includes the security identifiers (SIDs) of the old and new central access policies. diff --git a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md index c3c6bd7919..84de3a7b3a 100644 --- a/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md +++ b/windows/security/threat-protection/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md @@ -1,8 +1,8 @@ --- -title: Monitor central access policies on a file server +title: Monitor central access policies on a file server description: Learn how to monitor changes to the central access policies that apply to a file server when using advanced security auditing options. ms.assetid: 126b051e-c20d-41f1-b42f-6cff24dcf20c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -31,7 +31,7 @@ Use the following procedures to configure and verify security auditing settings 3. In the console tree, select the flexible access Group Policy Object, and then select **Edit**. 4. Select **Computer Configuration** > **Security Settings** > **Advanced Audit Policy Configuration** > **Policy Change** > **Other Policy Change Events**. - > [!NOTE] + > [!NOTE] > This policy setting monitors policy changes that might not be captured otherwise, such as CAP changes or trusted platform module configuration changes.   5. Select the **Configure the following audit events** check box, select the **Success** check box (and the **Failure** check box, if desired), and then select **OK**. diff --git a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md index 4008b0c158..21f8121312 100644 --- a/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md +++ b/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md @@ -1,8 +1,8 @@ --- -title: Monitor the resource attributes on files and folders +title: Monitor the resource attributes on files and folders description: Learn how to use advanced security auditing options to monitor attempts to change settings on the resource attributes of files. ms.assetid: 4944097b-320f-44c7-88ed-bf55946a358b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -31,7 +31,7 @@ If your organization has a carefully thought out authorization configuration for Use the following procedures to configure settings to monitor changes to resource attributes on files and folders. These procedures assume that have configured and deployed central access policies in your network. For more information about how to configure and deploy central access policies, see [Dynamic Access Control: Scenario Overview](/windows-server/identity/solution-guides/dynamic-access-control--scenario-overview) . >**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. - + **To monitor changes to resource attributes on files** 1. Sign in to your domain controller by using domain administrator credentials. diff --git a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md index 5142eff8ca..26a826e404 100644 --- a/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md +++ b/windows/security/threat-protection/auditing/monitor-the-use-of-removable-storage-devices.md @@ -1,8 +1,8 @@ --- -title: Monitor the use of removable storage devices +title: Monitor the use of removable storage devices description: Learn how advanced security auditing options can be used to monitor attempts to use removable storage devices to access network resources. ms.assetid: b0a9e4a5-b7ff-41c6-96ff-0228d4ba5da8 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md index d97b9e646f..7fc2ba75cf 100644 --- a/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md +++ b/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md @@ -1,8 +1,8 @@ --- -title: Monitor user and device claims during sign-in +title: Monitor user and device claims during sign-in description: Learn how to monitor user and device claims that are associated with a user’s security token. This advice assumes you have deployed Dynamic Access Control. ms.assetid: 71796ea9-5fe4-4183-8475-805c3c1f319f -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -27,7 +27,7 @@ Device claims are associated with the system that is used to access resources th Use the following procedures to monitor changes to user claims and device claims in the user’s sign-in token and to verify the changes. These procedures assume that you have configured and deployed Dynamic Access Control, including central access policies, claims, and other components, in your network. If you haven't yet deployed Dynamic Access Control in your network, see [Deploy a Central Access Policy (Demonstration Steps)](/windows-server/identity/solution-guides/deploy-a-central-access-policy--demonstration-steps-). >**Note:**  Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. - + **To monitor user and device claims in user logon token** 1. Sign in to your domain controller by using domain administrator credentials. diff --git a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md index 02b8e42af0..35b3eb2d9c 100644 --- a/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md @@ -1,8 +1,8 @@ --- -title: Plan and deploy advanced security audit policies +title: Plan and deploy advanced security audit policies description: Learn to deploy an effective security audit policy in a network that includes advanced security audit policies. ms.assetid: 7428e1db-aba8-407b-a39e-509671e5a442 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -120,7 +120,7 @@ The following table provides an example of a resource analysis for an organizati | Payroll data| Corp-Finance-1| Accounting: Read/write on Corp-Finance-1
    Departmental Payroll Managers: Write only on Corp-Finance-1| High| Financial integrity and employee privacy| | Patient medical records| MedRec-2| Doctors and Nurses: Read/write on Med/Rec-2
    Lab Assistants: Write only on MedRec-2
    Accounting: Read only on MedRec-2| High| Strict legal and regulatory standards| | Consumer health information| Web-Ext-1| Public Relations Web Content Creators: Read/write on Web-Ext-1
    Public: Read only on Web-Ext-1| Low| Public education and corporate image| - + ### Users Many organizations find it useful to classify the types of users they have and then base permissions on this classification. This classification can help you identify which user activities should be the subject of security auditing and the amount of audit data that they'll generate. @@ -140,7 +140,7 @@ The following table illustrates an analysis of users on a network. Our example c | Account administrators| User accounts and security groups| Account administrators have full privileges to create new user accounts, reset passwords, and modify security group memberships. We need a mechanism to monitor these changes. | | Members of the Finance OU| Financial records| Users in Finance have read/write access to critical financial records but no ability to change permissions on these resources. These financial records are subject to government regulatory compliance requirements. | | External partners | Project Z| Employees of partner organizations have read/write access to certain project data and servers relating to Project Z but not to other servers or data on the network.| - + ### Computers Security and auditing requirements and audit event volume can vary considerably for different types of computers in an organization. These requirements can be based on: @@ -151,14 +151,14 @@ Security and auditing requirements and audit event volume can vary considerably > [!NOTE] > For more information about auditing: > - In Exchange Server, see [Exchange 2010 Security Guide](/previous-versions/office/exchange-server-2010/bb691338(v=exchg.141)). - > - In SQL Server 2008, see [Auditing (Database Engine)](/previous-versions/sql/sql-server-2008-r2/cc280526(v=sql.105)). + > - In SQL Server 2008, see [Auditing (Database Engine)](/previous-versions/sql/sql-server-2008-r2/cc280526(v=sql.105)). > - In SQL Server 2012, see [SQL Server Audit (Database Engine)](/sql/relational-databases/security/auditing/sql-server-audit-database-engine). - + - The operating system versions > [!NOTE] > The operating system version determines which auditing options are available and the volume of audit event data. - + - The business value of the data For example, a web server that's accessed by external users requires different audit settings than a root certification authority (CA) that's never exposed to the public internet or even to regular users on the organization's network. @@ -171,7 +171,7 @@ The following table illustrates an analysis of computers in an organization. | File servers | Windows Server 2012| Separate resource OUs by department and (in some cases) by location| | Portable computers | Windows Vista and Windows 7| Separate portable computer OUs by department and (in some cases) by location| | Web servers | Windows Server 2008 R2 | WebSrv OU| - + ### Regulatory requirements Many industries and locales have specific requirements for network operations and how resources are protected. In the health care and financial industries, for example, strict guidelines control who can access records and how the records are used. Many countries/regions have strict privacy rules. To identify regulatory requirements, work with your organization's legal department and other departments responsible for these requirements. Then consider the security configuration and auditing options that you can use to comply with these regulations and verify compliance. @@ -199,7 +199,7 @@ By using Group Policy, you can apply your security audit policy to defined group > Whether you apply advanced audit policies by using Group Policy or logon scripts, don't use both the basic audit policy settings under **Local Policies\Audit Policy** and the advanced settings under **Security Settings\Advanced Audit Policy Configuration**. Using both basic and advanced audit policy settings can cause unexpected results in audit reporting. If you use **Advanced Audit Policy Configuration** settings or logon scripts to apply advanced audit policies, be sure to enable the **Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings** policy setting under **Local Policies\\Security Options**. This configuration will prevent conflicts between similar settings by forcing basic security auditing to be ignored. - + The following examples show how you can apply audit policies to an organization's OU structure: @@ -210,8 +210,8 @@ The following examples show how you can apply audit policies to an organization' ##     Map your security auditing goals to a security audit policy configuration After you identify your security auditing goals, you can map them to a security audit policy configuration. This audit policy configuration must address your security auditing goals. But it also must reflect your organization's constraints, such as the numbers of: -- Computers that need to be monitored -- Activities that you want to audit +- Computers that need to be monitored +- Activities that you want to audit - Audit events that your audit configuration will generate - Administrators available to analyze and act upon audit data @@ -230,7 +230,7 @@ You can view and configure security audit policy settings in the supported versi - *Security Settings\\Local Policies\\Audit Policy* - *Security Settings\\Local Policies\\Security Options* - *Security Settings\\Advanced Audit Policy Configuration* - + For more information, see [Advanced security audit policy settings](advanced-security-audit-policy-settings.md). ### Choose audit settings to use @@ -255,16 +255,16 @@ Compromise to an organization's data resources can cause tremendous financial lo > [!NOTE] > To audit user attempts to access all file system objects on a computer, use the *Global Object Access Auditing* settings [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) or [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md). - + - **Object Access\\[Audit Handle Manipulation](audit-handle-manipulation.md)**: This policy setting determines whether the operating system generates audit events when a handle to an object is opened or closed. Only objects with configured SACLs generate these events and only if the attempted handle operation matches the SACL. Event volume can be high, depending on how the SACLs are configured. When used together with the **Audit File System** or **Audit Registry** policy setting, the **Audit Handle Manipulation** policy setting can provide useful "reason for access" audit data that details the precise permissions on which the audit event is based. For example, if a file is configured as a *read-only* resource but a user tries to save changes to the file, the audit event will log the event *and* the permissions that were used (or attempted to be used) to save the file changes. - + - **Global Object Access Auditing**: Many organizations use security auditing to comply with regulatory requirements that govern data security and privacy. But demonstrating that strict controls are being enforced can be difficult. To address this issue, the supported versions of Windows include two **Global Object Access Auditing** policy settings, one for the registry and one for the file system. When you configure these settings, they apply a global system access control SACL on all objects of that class on a system. These settings can't be overridden or circumvented. > [!IMPORTANT] > The **Global Object Access Auditing** policy settings must be configured and applied in conjunction with the **Audit File System** and **Audit Registry** audit policy settings in the **Object Access** category. - + ### User activity The settings in the previous section relate to activity involving the files, folders, and network shares that are stored on a network. The settings in this section focus on the users who may try to access those resources, including employees, partners, and customers. @@ -279,7 +279,7 @@ In most cases, these attempts are legitimate, and the network needs to make data > [!NOTE] > There's no failure event for logoff activity, because failed logoffs (such as when a system abruptly shuts down) don't generate an audit record. Logoff events aren't 100-percent reliable. For example, a computer can be turned off without a proper logoff and shut down, so a logoff event isn't generated. - + - **Logon/Logoff\\[Audit Special Logon](audit-special-logon.md)**: A special logon has administrator-equivalent rights and can be used to elevate a process to a higher level. It's recommended to track these types of logons. - **Object Access\\[Audit Certification Services](audit-certification-services.md)**: This policy setting enables you to monitor activities on a computer that hosts Active Directory Certificate Services (AD CS) role services to ensure that only authorized users do these tasks and only authorized or desirable tasks are done. - **Object Access\\[Audit File System](audit-file-system.md) and Object Access\\[Audit File Share](audit-file-share.md)**: These policy settings are described in the previous section. @@ -288,7 +288,7 @@ In most cases, these attempts are legitimate, and the network needs to make data > [!IMPORTANT] > On critical systems where all attempts to change registry settings should be tracked, you can combine the **Audit Registry** and **Global Object Access Auditing** policy settings to track all attempts to modify registry settings on a computer. - + - **Object Access\\[Audit SAM](audit-sam.md)**: The Security Accounts Manager (SAM) is a database on computers running Windows that stores user accounts and security descriptors for users on the local computer. Changes to user and group objects are tracked by the **Account Management** audit category. However, user accounts with the proper user rights could potentially alter the files where the account and password information is stored in the system, bypassing any **Account Management** events. - **Privilege Use\\[Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md)**: These policy settings and audit events enable you to track the use of certain rights on one or more systems. If you configure this policy setting, an audit event is generated when sensitive rights requests are made. @@ -301,7 +301,7 @@ The following network activity policy settings enable you to monitor security-re >[!NOTE] >**Account Logon** policy settings apply only to specific domain account activities, regardless of which computer is accessed. **Logon/Logoff** policy settings apply to the computer that hosts the resources that are accessed. - + - **Account Logon\\[Audit Other Account Logon Events](audit-other-account-logon-events.md)**: This policy setting can be used to track various network activities, including attempts to create Remote Desktop connections, wired network connections, and wireless connections. - **DS Access**: Policy settings in this category enable you to monitor AD DS role services. These services provide account data, validate logons, maintain network access permissions, and provide other functionality that's critical to secure and proper functioning of a network. Therefore, auditing the rights to access and modify the configuration of a domain controller can help an organization maintain a secure and reliable network. One of the key tasks that AD DS performs is replication of data between domain controllers. - **Logon/Logoff\\[Audit IPsec Extended Mode](audit-ipsec-extended-mode.md)**, **Logon/Logoff\\[Audit IPsec Main Mode](audit-ipsec-main-mode.md)**, and **Logon/Logoff\\[Audit IPsec Quick Mode](audit-ipsec-quick-mode.md)**: Networks often support many external users, including remote employees and partners. Because these users are outside the organization's network boundaries, IPsec is often used to help protect communications over the internet. It enables network-level peer authentication, data origin authentication, data integrity checks, data confidentiality (encryption), and protection against replay attacks. You can use these settings to ensure that IPsec services are functioning properly. diff --git a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md index ac19f5355d..b82b7aa8de 100644 --- a/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md +++ b/windows/security/threat-protection/auditing/registry-global-object-access-auditing.md @@ -1,8 +1,8 @@ --- -title: Registry (Global Object Access Auditing) +title: Registry (Global Object Access Auditing) description: The Advanced Security Audit policy setting, Registry (Global Object Access Auditing), enables you to configure a global system access control list (SACL). ms.assetid: 953bb1c1-3f76-43be-ba17-4aed2304f578 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/security-auditing-overview.md b/windows/security/threat-protection/auditing/security-auditing-overview.md index da20ec1bb0..a4e0800569 100644 --- a/windows/security/threat-protection/auditing/security-auditing-overview.md +++ b/windows/security/threat-protection/auditing/security-auditing-overview.md @@ -1,8 +1,8 @@ --- -title: Security auditing +title: Security auditing description: Learn about security auditing features in Windows, and how your organization can benefit from using them to make your network more secure and easily managed. ms.assetid: 2d9b8142-49bd-4a33-b246-3f0c2a5f32d4 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md index 0d0c6e1fb7..076763b3d8 100644 --- a/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md +++ b/windows/security/threat-protection/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md @@ -1,8 +1,8 @@ --- -title: Using advanced security auditing options to monitor dynamic access control objects +title: Using advanced security auditing options to monitor dynamic access control objects description: Domain admins can set up advanced security audit options in Windows 10 to target specific users, or monitor potentially significant activity on multiple devices ms.assetid: 0d2c28ea-bdaf-47fd-bca2-a07dce5fed37 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -40,9 +40,9 @@ Domain administrators can create and deploy expression-based security audit poli | [Monitor the resource attributes on files and folders](monitor-the-resource-attributes-on-files-and-folders.md)| This topic for the IT professional describes how to monitor attempts to change settings to the resource attributes on files when you're using advanced security auditing options to monitor dynamic access control objects. | | [Monitor the central access policies associated with files and folders](monitor-the-central-access-policies-associated-with-files-and-folders.md)| This topic for the IT professional describes how to monitor changes to the central access policies that are associated with files and folders when you're using advanced security auditing options to monitor dynamic access control objects. | | [Monitor claim types](monitor-claim-types.md) | This topic for the IT professional describes how to monitor changes to claim types that are associated with dynamic access control when you're using advanced security auditing options.| - + >**Important:**  This procedure can be configured on computers running any of the supported Windows operating systems. The other monitoring procedures can be configured only as part of a functioning dynamic access control deployment. - + ## Related topics - [Security auditing](security-auditing-overview.md) \ No newline at end of file diff --git a/windows/security/threat-protection/auditing/view-the-security-event-log.md b/windows/security/threat-protection/auditing/view-the-security-event-log.md index 25265ee877..88b1438852 100644 --- a/windows/security/threat-protection/auditing/view-the-security-event-log.md +++ b/windows/security/threat-protection/auditing/view-the-security-event-log.md @@ -1,8 +1,8 @@ --- -title: View the security event log +title: View the security event log description: The security log records each event as defined by the audit policies you set on each object. ms.assetid: 20DD2ACD-241A-45C5-A92F-4BE0D9F198B9 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md index ef99d2c066..2ede0f5748 100644 --- a/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md +++ b/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md @@ -1,8 +1,8 @@ --- -title: Which editions of Windows support advanced audit policy configuration +title: Which editions of Windows support advanced audit policy configuration description: This reference topic for the IT professional describes which versions of the Windows operating systems support advanced security auditing policies. ms.assetid: 87c71cc5-522d-4771-ac78-34a2a0825f31 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/09/2021 ms.technology: itpro-security --- @@ -20,7 +20,7 @@ ms.technology: itpro-security # Which editions of Windows support advanced audit policy configuration -Advanced audit policy configuration is supported on all versions of Windows since it was introduced in Windows Vista. -There's no difference in security auditing support between 32-bit and 64-bit versions. -Windows editions that can't join a domain, such as Windows 10 Home edition, don't have access to these features. +Advanced audit policy configuration is supported on all versions of Windows since it was introduced in Windows Vista. +There's no difference in security auditing support between 32-bit and 64-bit versions. +Windows editions that can't join a domain, such as Windows 10 Home edition, don't have access to these features. diff --git a/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md b/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md index dc6bf37ae5..81f50b4fda 100644 --- a/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md +++ b/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller.md @@ -1,8 +1,8 @@ --- -title: Access Credential Manager as a trusted caller +title: Access Credential Manager as a trusted caller description: Describes best practices, security considerations, and more for the security policy setting, Access Credential Manager as a trusted caller. ms.assetid: a51820d2-ca5b-47dd-8e9b-d7008603db88 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,7 +56,7 @@ The following table shows the default value for the server type or Group Policy | Domain controller effective default settings | Not defined | | Member server effective default settings | Not defined | | Client computer effective default settings | Not defined | - + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -93,4 +93,4 @@ None. Not defined is the default configuration. ## Related topics [User Rights Assignment](user-rights-assignment.md) - + diff --git a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md index b5ace4fc62..f8a0e483fd 100644 --- a/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md +++ b/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network.md @@ -1,8 +1,8 @@ --- -title: Access this computer from the network - security policy setting +title: Access this computer from the network - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Access this computer from the network security policy setting. ms.assetid: f6767bc2-83d1-45f1-847c-54f5362db022 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 06/11/2021 ms.technology: itpro-security --- @@ -69,7 +69,7 @@ The following table lists the actual and effective default policy values for the | Domain controller effective default settings | Everyone, Administrators, Authenticated Users, Enterprise Domain Controllers, Pre-Windows 2000 Compatible Access | | Member server effective default settings | Everyone, Administrators, Users, Backup Operators | | Client computer effective default settings |Everyone, Administrators, Users, Backup Operators | - + ## Policy management When you modify this user right, the following actions might cause users and services to experience network access issues: @@ -103,11 +103,11 @@ Users who can connect from their device to the network can access resources on t ### Countermeasure -Restrict the **Access this computer from the network** user right to only those users and groups who require access to the computer. For example, if you configure this policy setting to the **Administrators** and **Users** groups, users who sign in to the domain can access resources that are shared +Restrict the **Access this computer from the network** user right to only those users and groups who require access to the computer. For example, if you configure this policy setting to the **Administrators** and **Users** groups, users who sign in to the domain can access resources that are shared from servers in the domain if members of the **Domain Users** group are included in the local **Users** group. > **Note** If you are using IPsec to help secure network communications in your organization, ensure that a group that includes machine accounts is given this right. This right is required for successful computer authentication. Assigning this right to **Authenticated Users** or **Domain Computers** meets this requirement. - + ### Potential impact If you remove the **Access this computer from the network** user right on domain controllers for all users, no one can sign in to the domain or use network resources. If you remove this user right on member servers, users can't connect to those servers through the network. If you have installed optional components such as ASP.NET or Internet Information Services (IIS), you may need to assign this user right to other accounts that are required by those components. It's important to verify that authorized users are assigned this user right for the devices that they need to access the network. @@ -116,5 +116,5 @@ If running Windows Server or Azure Stack HCI Failover Clustering, don't remove A ## Related topics [User Rights Assignment](user-rights-assignment.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md index 89634c3e27..ab6ba1901c 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md @@ -1,8 +1,8 @@ --- -title: Account lockout duration +title: Account lockout duration description: Describes the best practices, location, values, and security considerations for the Account lockout duration security policy setting. ms.assetid: a4167bf4-27c3-4a9b-8ef0-04e3c6ec3aa4 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 08/16/2021 ms.technology: itpro-security --- @@ -40,7 +40,7 @@ This policy setting is dependent on the **Account lockout threshold** policy set If [Account lockout threshold](account-lockout-threshold.md) is configured, after the specified number of failed attempts, the account will be locked out. If the **Account lockout duration** is set to 0, the account will remain locked until an administrator unlocks it manually. -It's advisable to set **Account lockout duration** to approximately 15 minutes. To specify that the account will never be locked out, set the **Account lockout threshold** value to 0. +It's advisable to set **Account lockout duration** to approximately 15 minutes. To specify that the account will never be locked out, set the **Account lockout threshold** value to 0. ### Location @@ -58,7 +58,7 @@ The following table lists the actual and effective default policy values. Defaul | Domain controller effective default settings | Not defined | | Member server effective default settings | Not defined | | Client computer effective default settings | Not applicable | - + ## Security considerations More than a few unsuccessful password submissions during an attempt to sign in to a computer might represent an attacker's attempts to determine an account password by trial and error. The Windows and Windows Server operating systems can track sign-in attempts, and you can configure the operating system to disable the account for a preset period of time after a specified number of failed attempts. Account lockout policy settings control the threshold for this response and what action to take after the threshold is reached. @@ -78,5 +78,5 @@ Configuring the **Account lockout duration** policy setting to 0 so that account ## Related topics [Account Lockout Policy](account-lockout-policy.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md index fe39bbcede..1872b25b41 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md @@ -1,8 +1,8 @@ --- -title: Account Lockout Policy +title: Account Lockout Policy description: Describes the Account Lockout Policy settings and links to information about each policy setting. ms.assetid: eb968c28-17c5-405f-b413-50728cb7b724 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 10/11/2018 ms.technology: itpro-security --- @@ -41,9 +41,9 @@ The following topics provide a discussion of each policy setting's implementatio | [Account lockout threshold](account-lockout-threshold.md) | Describes the best practices, location, values, and security considerations for the **Account lockout threshold** security policy setting. | | [Account lockout duration](account-lockout-duration.md) | Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. | | [Reset account lockout counter after](reset-account-lockout-counter-after.md) | Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. | - + ## Related topics [Configure security policy settings](how-to-configure-security-policy-settings.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md index a735631952..2bae54f4e2 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md @@ -1,8 +1,8 @@ --- -title: Account lockout threshold +title: Account lockout threshold description: Describes the best practices, location, values, and security considerations for the Account lockout threshold security policy setting. ms.assetid: 4904bb40-a2bd-4fef-a102-260ba8d74e30 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 11/02/2018 ms.technology: itpro-security --- @@ -52,7 +52,7 @@ The threshold that you select is a balance between operational efficiency and se As with other account lockout settings, this value is more of a guideline than a rule or best practice because there's no "one size fits all." For more information, see [Configuring Account Lockout](/archive/blogs/secguide/configuring-account-lockout). Implementation of this policy setting is dependent on your operational environment; threat vectors, deployed operating systems, and deployed apps. For more information, see [Implementation considerations](#bkmk-impleconsiderations) in this article. - + ### Location **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Account Lockout Policy** @@ -69,7 +69,7 @@ The following table lists the actual and effective default policy values. Defaul | Domain controller effective default settings | 0 invalid sign-in attempts | | Member server effective default settings |0 invalid sign-in attempts | | Effective GPO default settings on client computers |0 invalid sign-in attempts | - + ### Policy management This section describes features and tools that are available to help you manage this policy setting. @@ -88,7 +88,7 @@ Implementation of this policy setting depends on your operational environment. C - Not all apps that are used in your environment effectively manage how many times a user can attempt to sign in. For instance, if a connection drops repeatedly when a user is running the app, all subsequent failed sign-in attempts count toward the account lockout threshold. -For more information about Windows security baseline recommendations for account lockout, see [Configuring Account Lockout](/archive/blogs/secguide/configuring-account-lockout). +For more information about Windows security baseline recommendations for account lockout, see [Configuring Account Lockout](/archive/blogs/secguide/configuring-account-lockout). ## Security considerations @@ -105,7 +105,7 @@ However, a DoS attack could be performed on a domain that has an account lockout > [!NOTE] > Offline password attacks are not countered by this policy setting. - + ### Countermeasure Because vulnerabilities can exist when this value is configured and when it's not configured, two distinct countermeasures are defined. Organizations should weigh the choice between the two, based on their identified threats and the risks that they want to mitigate. The two countermeasure options are: @@ -114,11 +114,11 @@ Because vulnerabilities can exist when this value is configured and when it's no - The password policy setting requires all users to have complex passwords of eight or more characters. - A robust audit mechanism is in place to alert administrators when a series of failed sign-ins occurs in the environment. - + - Configure the **Account lockout threshold** policy setting to a sufficiently high value to provide users with the ability to accidentally mistype their password several times before the account is locked, but ensure that a brute force password attack still locks the account. [Windows security baselines](../../operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md) recommend configuring a threshold of 10 invalid sign-in attempts, which prevents accidental account lockouts and reduces the number of Help Desk calls, but doesn't prevent a DoS attack. - + Using this type of policy must be accompanied by a process to unlock locked accounts. It must be possible to implement this policy whenever it's needed to help mitigate massive lockouts caused by an attack on your systems. ### Potential impact diff --git a/windows/security/threat-protection/security-policy-settings/account-policies.md b/windows/security/threat-protection/security-policy-settings/account-policies.md index a3fdbe5a3f..4504d333df 100644 --- a/windows/security/threat-protection/security-policy-settings/account-policies.md +++ b/windows/security/threat-protection/security-policy-settings/account-policies.md @@ -1,8 +1,8 @@ --- -title: Account Policies +title: Account Policies description: An overview of account policies in Windows and provides links to policy descriptions. ms.assetid: 711b3797-b87a-4cd9-a2e3-1f8ef18688fb -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ An overview of account policies in Windows and provides links to policy descript All account policies settings applied by using Group Policy are applied at the domain level. Default values are present in the built-in default domain controller policy for Password Policy settings, Account Lockout Policy settings, and Kerberos Policy settings. The domain account policy becomes the default local account policy of any device that is a member of the domain. If these policies are set at any level below the domain level in Active Directory Domain Services (AD DS), they affect only local accounts on member servers. > [!NOTE] > Each domain can have only one account policy. The account policy must be defined in the default domain policy or in a new policy that is linked to the root of the domain and given precedence over the default domain policy, which is enforced by the domain controllers in the domain. These domain-wide account policy settings (Password Policy, Account Lockout Policy, and Kerberos Policy) are enforced by the domain controllers in the domain; therefore, domain controllers always retrieve the values of these account policy settings from the default domain policy Group Policy Object (GPO). - + The only exception is when another account policy is defined for an organizational unit (OU). The account policy settings for the OU affect the local policy on any computers that are contained in the OU. For example, if an OU policy defines a maximum password age that differs from the domain-level account policy, the OU policy will be applied and enforced only when users sign in to the local computer. The default local computer policies apply only to computers that are in a workgroup or in a domain where both an OU account policy and a domain policy don't apply. ## In this section @@ -38,7 +38,7 @@ The only exception is when another account policy is defined for an organization | [Password Policy](password-policy.md) | An overview of password policies for Windows and links to information for each policy setting. | | [Account Lockout Policy](account-lockout-policy.md) | Describes the Account Lockout Policy settings and links to information about each policy setting. | | [Kerberos Policy](kerberos-policy.md) | Describes the Kerberos Policy settings and provides links to policy setting descriptions. | - + ## Related topics [Configure security policy settings](how-to-configure-security-policy-settings.md) diff --git a/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md b/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md index 23e43f6d45..179f5ba556 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status.md @@ -1,8 +1,8 @@ --- -title: Accounts Administrator account status +title: Accounts Administrator account status description: Describes the best practices, location, values, and security considerations for the Accounts Administrator account status security policy setting. ms.assetid: 71a3bd48-1014-49e0-a936-bfe9433af23e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 08/01/2017 ms.technology: itpro-security --- @@ -87,7 +87,7 @@ When you start a device in safe mode, the disabled administrator account is enab ### How to access a disabled Administrator account You can use the following methods to access a disabled Administrator account: -- For non-domain joined computers: when all the local administrator accounts are disabled, start the device in safe mode (locally or over a network), and sign in by using the credentials for the default local administrator account on that computer. +- For non-domain joined computers: when all the local administrator accounts are disabled, start the device in safe mode (locally or over a network), and sign in by using the credentials for the default local administrator account on that computer. - For domain-joined computers: remotely run the command **net user administrator /active: yes** by using psexec to enable the default local administrator account. ## Security considerations diff --git a/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md b/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md index ab6175a99f..1ac6245b9b 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts.md @@ -1,8 +1,8 @@ --- -title: Accounts Block Microsoft accounts +title: Accounts Block Microsoft accounts description: Describes the best practices, location, values, management, and security considerations for the Accounts Block Microsoft accounts security policy setting. ms.assetid: 94c76f45-057c-4d80-8d01-033cf28ef2f7 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 08/10/2017 ms.technology: itpro-security --- @@ -67,7 +67,7 @@ The following table lists the actual and effective default values for this polic | DC Effective Default Settings | Disabled | | Member Server Effective Default Settings | Disabled | | Client Computer Effective Default Settings | Disabled | - + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -95,4 +95,4 @@ Establishing greater control over accounts in your organization can give you mor ## Related topics [Security Options](security-options.md) - + diff --git a/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md b/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md index ca1a50819a..6c768ad6d6 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status.md @@ -1,8 +1,8 @@ --- -title: Accounts Guest account status - security policy setting +title: Accounts Guest account status - security policy setting description: Describes the best practices, location, values, and security considerations for the Accounts Guest account status security policy setting. ms.assetid: 07e53fc5-b495-4d02-ab42-5b245d10d0ce -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,7 +56,7 @@ The following table lists the actual and effective default values for this polic | DC Effective Default Settings | Disabled | | Member Server Effective Default Settings | Disabled | | Client Computer Effective Default Settings | Disabled | - + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. @@ -76,5 +76,5 @@ All network users must be authenticated before they can access shared resources. ## Related topics [Security Options](security-options.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md b/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md index 05b4e8f3ea..947a4c0f6f 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md @@ -1,8 +1,8 @@ --- -title: Accounts Limit local account use of blank passwords +title: Accounts Limit local account use of blank passwords description: Learn best practices, security considerations, and more for the policy setting, Accounts Limit local account use of blank passwords to console logon only. ms.assetid: a1bfb58b-1ae8-4de9-832b-aa889a6e64bd -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -62,7 +62,7 @@ The following table lists the actual and effective default values for this polic | DC Effective Default Settings | Enabled | | Member Server Effective Default Settings | Enabled | | Client Computer Effective Default Settings | Enabled | - + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md b/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md index 0e9b3c3257..44905ab096 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account.md @@ -1,8 +1,8 @@ --- -title: Accounts Rename administrator account +title: Accounts Rename administrator account description: This security policy reference topic for the IT professional describes the best practices, location, values, and security considerations for this policy setting. ms.assetid: d21308eb-7c60-4e48-8747-62b8109844f9 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,7 +55,7 @@ The following table lists the actual and effective default values for this polic | DC Effective Default Settings | Administrator | | Member Server Effective Default Settings | Administrator | | Client Computer Effective Default Settings | Administrator | - + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -93,5 +93,5 @@ You must provide users who are authorized to use this account with the new accou ## Related topics [Security Options](security-options.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md b/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md index da35071790..d034cdf835 100644 --- a/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md +++ b/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account.md @@ -1,8 +1,8 @@ --- -title: Accounts Rename guest account - security policy setting +title: Accounts Rename guest account - security policy setting description: Describes the best practices, location, values, and security considerations for the Accounts Rename guest account security policy setting. ms.assetid: 9b8052b4-bbb9-4cc1-bfee-ce25390db707 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,7 +55,7 @@ The following table lists the actual and effective default values for this polic | DC Effective Default Settings | Guest | | Member Server Effective Default Settings | Guest | | Client Computer Effective Default Settings | *User-defined text* | - + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -78,7 +78,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -The guest account exists in all Windows server and client operating system versions beginning with Windows Server 2003 and Windows XP Professional. Because the account name is well known, it provides a vector for a malicious user to get access to network resources and attempt to elevate privileges +The guest account exists in all Windows server and client operating system versions beginning with Windows Server 2003 and Windows XP Professional. Because the account name is well known, it provides a vector for a malicious user to get access to network resources and attempt to elevate privileges or install software that could be used for a later attack on your system. ### Countermeasure @@ -92,5 +92,5 @@ There should be little impact because the Guest account is disabled by default i ## Related topics [Security Options](security-options.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md b/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md index d8915c4e18..1bdbf787f1 100644 --- a/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md +++ b/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system.md @@ -1,8 +1,8 @@ --- -title: Act as part of the operating system +title: Act as part of the operating system description: Describes the best practices, location, values, policy management, and security considerations for the Act as part of the operating system security policy setting. ms.assetid: c1b7e084-a9f7-4377-b678-07cc913c8b0c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -21,7 +21,7 @@ ms.technology: itpro-security **Applies to** - Windows 11 -- Windows 10 +- Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Act as part of the operating system** security policy setting. @@ -51,11 +51,11 @@ The following table lists the actual and effective default policy values for the | - | - | | Default domain policy | Not defined | | Default domain controller policy| Not defined | -| Stand-alone server default settings | Not defined | +| Stand-alone server default settings | Not defined | | Domain controller effective default settings | Not defined | | Member server effective default settings | Not defined | | Client computer effective default settings | Not defined | - + ## Policy management A restart of the device isn't required for this policy setting to be effective. @@ -90,4 +90,4 @@ There should be little or no impact because the **Act as part of the operating s ## Related topics [User Rights Assignment](user-rights-assignment.md) - + diff --git a/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md b/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md index 139d15f4ec..fb594e8748 100644 --- a/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md +++ b/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain.md @@ -1,13 +1,13 @@ --- title: Add workstations to domain description: Describes the best practices, location, values, policy management and security considerations for the Add workstations to domain security policy setting. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -81,7 +81,7 @@ This policy has the following security considerations: ### Vulnerability -The **Add workstations to domain** user right presents a moderate vulnerability. Users with this right could add a device to the domain that is configured in a way that violates organizational security policies. For example, if your organization doesn't want its users to have administrative +The **Add workstations to domain** user right presents a moderate vulnerability. Users with this right could add a device to the domain that is configured in a way that violates organizational security policies. For example, if your organization doesn't want its users to have administrative privileges on their devices, users could install Windows on their computers and then add the computers to the domain. The user would know the password for the local administrator account, could sign in with that account, and then add a personal domain account to the local Administrators group. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md b/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md index 5ec3171725..5c9b499b8b 100644 --- a/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md +++ b/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process.md @@ -1,8 +1,8 @@ --- -title: Adjust memory quotas for a process +title: Adjust memory quotas for a process description: Describes the best practices, location, values, policy management, and security considerations for the Adjust memory quotas for a process security policy setting. ms.assetid: 6754a2c8-6d07-4567-9af3-335fd8dd7626 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,7 +53,7 @@ By default, members of the Administrators, Local Service, and Network Service gr The following table lists the actual and effective default policy values. Default values are also listed on the policy’s property page. -| Server type or GPO | Default value | +| Server type or GPO | Default value | | - | - | | Default Domain Policy | Administrators
    Local Service
    Network Service | | Default Domain Controller Policy | Administrators
    Local Service
    Network Service | @@ -61,7 +61,7 @@ The following table lists the actual and effective default policy values. Defaul | Domain Controller Effective Default Settings | Administrators
    Local Service
    Network Service | | Member Server Effective Default Settings | Administrators
    Local Service
    Network Service | | Client Computer Effective Default Settings | Administrators
    Local Service
    Network Service | - + ## Policy management A restart of the device is not required for this policy setting to be effective. @@ -97,5 +97,5 @@ Organizations that have not restricted users to roles with limited privileges ma ## Related topics - [User Rights Assignment](user-rights-assignment.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md index bca371957d..3a11417c5b 100644 --- a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md @@ -1,8 +1,8 @@ --- -title: Administer security policy settings +title: Administer security policy settings description: This article discusses different methods to administer security policy settings on a local device or throughout a small- or medium-sized organization. ms.assetid: 7617d885-9d28-437a-9371-171197407599 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -250,7 +250,7 @@ For example, a workstation that is joined to a domain will have its local securi both the domain and local settings. If the workstation is a member of more than one Organizational Unit, then the Organizational Unit that immediately contains the workstation has the highest order of precedence. > [!NOTE] -> Use gpresult.exe to find out what policies are applied to a device and in what order. +> Use gpresult.exe to find out what policies are applied to a device and in what order. For domain accounts, there can be only one account policy that includes password policies, account lockout policies, and Kerberos policies. **Persistence in security settings** @@ -300,10 +300,10 @@ To avoid continued flagging of settings that you've investigated and determined You can resolve discrepancies between analysis database and system settings by: - Accepting or changing some or all of the values that are flagged or not included in the configuration, if you determine that the local system security levels are valid due to the context (or role) of that computer. These attribute values are then updated in the database and applied to the system when you click **Configure Computer Now**. -- Configuring the system to the analysis database values, if you determine the system isn't in compliance with valid security levels. -- Importing a more appropriate template for the role of that computer into the database as the new base configuration and applying it to the system. -Changes to the analysis database are made to the stored template in the database, not to the security template file. The security template file will only be modified if you either return to Security Templates and edit that template or export the stored configuration to the same template file. -You should use **Configure Computer Now** only to modify security areas *not* affected by Group Policy settings, such as security on local files and folders, registry keys, and system services. Otherwise, when the Group Policy settings are applied, it will take precedence over local settings—such as account policies. +- Configuring the system to the analysis database values, if you determine the system isn't in compliance with valid security levels. +- Importing a more appropriate template for the role of that computer into the database as the new base configuration and applying it to the system. +Changes to the analysis database are made to the stored template in the database, not to the security template file. The security template file will only be modified if you either return to Security Templates and edit that template or export the stored configuration to the same template file. +You should use **Configure Computer Now** only to modify security areas *not* affected by Group Policy settings, such as security on local files and folders, registry keys, and system services. Otherwise, when the Group Policy settings are applied, it will take precedence over local settings—such as account policies. In general, don't use **Configure Computer Now** when you're analyzing security for domain-based clients, since you'll have to configure each client individually. In this case, you should return to Security Templates, modify the template, and reapply it to the appropriate Group Policy Object. ### Automating security configuration tasks diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md index 5c246fea41..ec8dd1980d 100644 --- a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md +++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md index aa212b8064..b76363e1b5 100644 --- a/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md +++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services.md @@ -1,8 +1,8 @@ --- -title: Allow log on through Remote Desktop Services +title: Allow log on through Remote Desktop Services description: Best practices, location, values, policy management, and security considerations for the security policy setting. Allow a sign-in through Remote Desktop Services. ms.assetid: 6267c376-8199-4f2b-ae56-9c5424e76798 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,11 +55,11 @@ The following table lists the actual and effective default policy values. Defaul | Default Domain Policy | Not Defined | | Default Domain Controller Policy | Not Defined | | Domain Controller Local Security Policy | Administrators | -| Stand-Alone Server Default Settings | Administrators
    Remote Desktop Users | -| Domain Controller Effective Default Settings | Administrators | +| Stand-Alone Server Default Settings | Administrators
    Remote Desktop Users | +| Domain Controller Effective Default Settings | Administrators | | Member Server Effective Default Settings | Administrators
    Remote Desktop Users | | Client Computer Effective Default Settings | Administrators
    Remote Desktop Users | - + ## Policy management This section describes different features and tools available to help you manage this policy. @@ -96,7 +96,7 @@ Any account with the **Allow log on through Remote Desktop Services** user right For domain controllers, assign the **Allow log on through Remote Desktop Services** user right only to the Administrators group. For other server roles and devices, add the Remote Desktop Users group. For servers that have the Remote Desktop (RD) Session Host role service enabled and don't run in Application Server mode, ensure that only authorized IT personnel who must manage the computers remotely belong to these groups. > **Caution:**  For RD Session Host servers that run in Application Server mode, ensure that only users who require access to the server have accounts that belong to the Remote Desktop Users group because this built-in group has this logon right by default. - + Alternatively, you can assign the **Deny log on through Remote Desktop Services** user right to groups such as Account Operators, Server Operators, and Guests. However, be careful when you use this method because you could block access to legitimate administrators who also belong to a group that has the **Deny log on through Remote Desktop Services** user right. ### Potential impact @@ -106,5 +106,5 @@ Removal of the **Allow log on through Remote Desktop Services** user right from ## Related topics - [User Rights Assignment](user-rights-assignment.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md index 5957adf4ab..25ef7bc3d6 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects.md @@ -1,8 +1,8 @@ --- -title: Audit the access of global system objects +title: Audit the access of global system objects description: Describes the best practices, location, values, and security considerations for the audit of the access to global system objects security policy setting. ms.assetid: 20d40a79-ce89-45e6-9bb4-148f83958460 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default values for this polic | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Disabled | -| DC Effective Default Settings | Disabled | -| Member Server Effective Default Settings | Disabled | -| Client Computer Effective Default Settings | Disabled | - +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled | + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -86,22 +86,22 @@ If the [Audit Kernel Object](../auditing/audit-kernel-object.md) setting is conf | Event ID | Event message | | - | - | -| 4659 | A handle to an object was requested with intent to delete. | -| 4660 | An object was deleted. | -| 4661 | A handle to an object was requested. | -| 4663 | An attempt was made to access an object. | - +| 4659 | A handle to an object was requested with intent to delete. | +| 4660 | An object was deleted. | +| 4661 | A handle to an object was requested. | +| 4663 | An attempt was made to access an object. | + If the [Audit Object Access](../auditing/basic-audit-object-access.md) setting is configured, the following events are generated: | Event ID | Event message | | - | - | -| 560 | Access was granted to an already existing object. | -| 562 | A handle to an object was closed. | +| 560 | Access was granted to an already existing object. | +| 562 | A handle to an object was closed. | | 563 | An attempt was made to open an object with the intent to delete it.
    **Note:** This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile() | | 564 | A protected object was deleted. | -| 565 | Access was granted to an already existing object type. | +| 565 | Access was granted to an already existing object type. | | 567 | A permission associated with a handle was used.
    **Note:** A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | -| 569 | The resource manager in Authorization Manager attempted to create a client context. | +| 569 | The resource manager in Authorization Manager attempted to create a client context. | | 570 | A client attempted to access an object.
    **Note:** An event will be generated for every attempted operation on the object. | ## Security considerations diff --git a/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md b/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md index 7d38765755..011e035679 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md +++ b/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md @@ -2,7 +2,7 @@ title: "Audit: Audit the use of Backup and Restore privilege (Windows 10)" description: "Describes the best practices, location, values, and security considerations for the 'Audit: Audit the use of Backup and Restore privilege' security policy setting." ms.assetid: f656a2bb-e8d6-447b-8902-53df3a7756c5 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/01/2019 ms.technology: itpro-security --- @@ -51,11 +51,11 @@ The following table lists the actual and effective default values for this polic | - | - | | Default Domain Policy | Not defined | | Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Disabled | -| DC Effective Default Settings | Disabled | -| Member Server Effective Default Settings | Disabled | -| Client Computer Effective Default Settings | Disabled | - +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled | + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -92,4 +92,4 @@ If you enable this policy setting, a large number of security events could be ge ## Related topics - [Security Options](security-options.md) - + diff --git a/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md b/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md index 5caf39e495..663cfb1d30 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md +++ b/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md @@ -1,8 +1,8 @@ --- -title: Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings +title: Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings description: Learn more about the security policy setting, Audit Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings. ms.assetid: 8ddc06bc-b6d6-4bac-9051-e0d77035bd4e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,12 +51,12 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | | Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined | +| Default Domain Controller Policy | Not defined | | Stand-Alone Server Default Settings | Enabled | | DC Effective Default Settings | Enabled | -| Member Server Effective Default Settings | Enabled | -| Client Computer Effective Default Settings | Enabled | - +| Member Server Effective Default Settings | Enabled | +| Client Computer Effective Default Settings | Enabled | + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -93,12 +93,12 @@ Enable audit policy subcategories as needed to track specific events. ### Potential impacts -If you attempt to modify an audit setting by using Group Policy after enabling this setting through the command-line tools, the Group Policy audit setting is ignored in favor of the custom policy setting. To modify audit settings by using Group Policy, you must first disable the +If you attempt to modify an audit setting by using Group Policy after enabling this setting through the command-line tools, the Group Policy audit setting is ignored in favor of the custom policy setting. To modify audit settings by using Group Policy, you must first disable the **SCENoApplyLegacyAuditPolicy** key. > **Important:**  Be very cautious about audit settings that can generate a large volume of traffic. For example, if you enable success or failure auditing for all of the Privilege Use subcategories, the high volume of audit events that are generated can make it difficult to find other types of entries in the security event log. Such a configuration could also have a significant impact on system performance. - + ## Related topics - [Security Options](security-options.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/audit-policy.md b/windows/security/threat-protection/security-policy-settings/audit-policy.md index a542276f2e..bf27ff18aa 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-policy.md +++ b/windows/security/threat-protection/security-policy-settings/audit-policy.md @@ -1,8 +1,8 @@ --- -title: Audit Policy +title: Audit Policy description: Provides information about basic audit policies that are available in Windows and links to information about each setting. ms.assetid: 2e8ea400-e555-43e5-89d6-0898cb89da90 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md index 61bd4aecfc..da06353caf 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md +++ b/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md @@ -1,8 +1,8 @@ --- -title: Audit Shut down system immediately if unable to log security audits +title: Audit Shut down system immediately if unable to log security audits description: Best practices, security considerations, and more for the security policy setting, Audit Shut down system immediately if unable to log security audits. ms.assetid: 2cd23cd9-0e44-4d0b-a1f1-39fc29303826 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined -| Default Domain Controller Policy | Not defined -| Stand-Alone Server Default Settings | Disabled -| DC Effective Default Settings | Disabled -| Member Server Effective Default Settings | Disabled -| Client Computer Effective Default Settings | Disabled - +| Default Domain Policy | Not defined +| Default Domain Controller Policy | Not defined +| Stand-Alone Server Default Settings | Disabled +| DC Effective Default Settings | Disabled +| Member Server Effective Default Settings | Disabled +| Client Computer Effective Default Settings | Disabled + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -96,5 +96,5 @@ If you enable this policy setting, the administrative burden can be significant, ## Related topics - [Security Options](security-options.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md b/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md index 40d4bdfda2..3bd99b5590 100644 --- a/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md +++ b/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories.md @@ -1,8 +1,8 @@ --- -title: Back up files and directories - security policy setting +title: Back up files and directories - security policy setting description: Describes the recommended practices, location, values, policy management, and security considerations for the Back up files and directories security policy setting. ms.assetid: 1cd6bdd5-1501-41f4-98b9-acf29ac173ae -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -78,7 +78,7 @@ The following table lists the actual and effective default policy values for the | Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Server Operators| | Member Server Effective Default Settings | Administrators
    Backup Operators| | Client Computer Effective Default Settings | Administrators
    Backup Operators| - + ## Policy management A restart of the device isn't required for this policy setting to be effective. @@ -115,5 +115,5 @@ Changes in the membership of the groups that have the user right to back up file ## Related topics - [User Rights Assignment](user-rights-assignment.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md index 6f06c8e9a2..f4a8745518 100644 --- a/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md +++ b/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking.md @@ -1,8 +1,8 @@ --- -title: Bypass traverse checking +title: Bypass traverse checking description: Describes the best practices, location, values, policy management, and security considerations for the Bypass traverse checking security policy setting. ms.assetid: 1c828655-68d3-4140-aa0f-caa903a7087e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not Defined | -| Default Domain Controller Policy | Administrators
    Authenticated Users
    Everyone
    Local Service
    Network Service
    Pre-Windows 2000 Compatible Access| -| Stand-Alone Server Default Settings | Administrators
    Backup Operators
    Users
    Everyone
    Local Service
    Network Service| -| Domain Controller Effective Default Settings | Administrators
    Authenticated Users
    Everyone
    Local Service
    Network Service
    Pre-Windows 2000 Compatible Access| -| Member Server Effective Default Settings | Administrators
    Backup Operators
    Users
    Everyone
    Local Service
    Network Service| -| Client Computer Effective Default Settings | Administrators
    Backup Operators
    Users
    Everyone
    Local Service
    Network Service| - +| Default Domain Policy| Not Defined | +| Default Domain Controller Policy | Administrators
    Authenticated Users
    Everyone
    Local Service
    Network Service
    Pre-Windows 2000 Compatible Access| +| Stand-Alone Server Default Settings | Administrators
    Backup Operators
    Users
    Everyone
    Local Service
    Network Service| +| Domain Controller Effective Default Settings | Administrators
    Authenticated Users
    Everyone
    Local Service
    Network Service
    Pre-Windows 2000 Compatible Access| +| Member Server Effective Default Settings | Administrators
    Backup Operators
    Users
    Everyone
    Local Service
    Network Service| +| Client Computer Effective Default Settings | Administrators
    Backup Operators
    Users
    Everyone
    Local Service
    Network Service| + ## Policy management Permissions to files and folders are controlled through the appropriate configuration of file system access control lists (ACLs). The ability to traverse the folder doesn't provide any Read or Write permissions to the user. @@ -98,4 +98,4 @@ The Windows operating systems and many applications were designed with the expec ## Related topics - [User Rights Assignment](user-rights-assignment.md) - + diff --git a/windows/security/threat-protection/security-policy-settings/change-the-system-time.md b/windows/security/threat-protection/security-policy-settings/change-the-system-time.md index e09a09a6bb..d985a6eaf9 100644 --- a/windows/security/threat-protection/security-policy-settings/change-the-system-time.md +++ b/windows/security/threat-protection/security-policy-settings/change-the-system-time.md @@ -1,8 +1,8 @@ --- -title: Change the system time - security policy setting +title: Change the system time - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Change the system time security policy setting. ms.assetid: f2f6637d-acbc-4352-8ca3-ec563f918e65 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not Defined | +| Default Domain Policy| Not Defined | | Default Domain Controller Policy | Administrators
    Server Operators
    Local Service| | Stand-Alone Server Default Settings | Administrators
    Local Service| -| DC Effective Default Settings | Administrators
    Server Operators
    Local Service| +| DC Effective Default Settings | Administrators
    Server Operators
    Local Service| | Member Server Effective Default Settings | Administrators
    Local Service| -| Client Computer Effective Default Settings | Administrators
    Local Service| - +| Client Computer Effective Default Settings | Administrators
    Local Service| + ## Policy management This section describes features, tools and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md b/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md index dffd58d25b..3ac7b50a9c 100644 --- a/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md +++ b/windows/security/threat-protection/security-policy-settings/change-the-time-zone.md @@ -1,8 +1,8 @@ --- -title: Change the time zone - security policy setting +title: Change the time zone - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Change the time zone security policy setting. ms.assetid: 3b1afae4-68bb-472f-a43e-49e300d73e50 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,13 +50,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not Defined| -| Default Domain Controller Policy | Administrators
    Users| -| Stand-Alone Server Default Settings | Administrators
    Users| -| Domain Controller Effective Default Settings | Administrators
    Users| -| Member Server Effective Default Settings | Administrators
    Users| -| Client Computer Effective Default Settings | Administrators
    Users| - +| Default Domain Policy| Not Defined| +| Default Domain Controller Policy | Administrators
    Users| +| Stand-Alone Server Default Settings | Administrators
    Users| +| Domain Controller Effective Default Settings | Administrators
    Users| +| Member Server Effective Default Settings | Administrators
    Users| +| Client Computer Effective Default Settings | Administrators
    Users| + ## Policy management A restart of the device is not required for this policy setting to be effective. diff --git a/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md b/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md index 0a179de698..a28a19a33f 100644 --- a/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md +++ b/windows/security/threat-protection/security-policy-settings/create-a-pagefile.md @@ -1,8 +1,8 @@ --- -title: Create a pagefile - security policy setting +title: Create a pagefile - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Create a pagefile security policy setting. ms.assetid: dc087897-459d-414b-abe0-cd86c8dccdea -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Administrators | -| Default Domain Controller Policy | Administrators | -| Stand-Alone Server Default Settings | Administrators | -| Domain Controller Effective Default Settings | Administrators | -| Member Server Effective Default Settings | Administrators | -| Client Computer Effective Default Settings | Administrators | - +| Default Domain Policy | Administrators | +| Default Domain Controller Policy | Administrators | +| Stand-Alone Server Default Settings | Administrators | +| Domain Controller Effective Default Settings | Administrators | +| Member Server Effective Default Settings | Administrators | +| Client Computer Effective Default Settings | Administrators | + ## Policy management A restart of the device isn't required for this policy setting to be effective. diff --git a/windows/security/threat-protection/security-policy-settings/create-a-token-object.md b/windows/security/threat-protection/security-policy-settings/create-a-token-object.md index 90c8d547a4..6c50cc0ce0 100644 --- a/windows/security/threat-protection/security-policy-settings/create-a-token-object.md +++ b/windows/security/threat-protection/security-policy-settings/create-a-token-object.md @@ -1,8 +1,8 @@ --- -title: Create a token object +title: Create a token object description: Describes the best practices, location, values, policy management, and security considerations for the Create a token object security policy setting. ms.assetid: bfbf52fc-6ba4-442a-9df7-bd277e55729c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not Defined | -| Default Domain Controller Policy | Not Defined | -| Stand-Alone Server Default Settings | Not Defined | -| Domain Controller Effective Default Settings | Local System | -| Member Server Effective Default Settings | Local System | -| Client Computer Effective Default Settings | Local System | - +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined | +| Domain Controller Effective Default Settings | Local System | +| Member Server Effective Default Settings | Local System | +| Client Computer Effective Default Settings | Local System | + ## Policy management A restart of the device isn't required for this policy setting to be effective. @@ -85,7 +85,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability >**Caution:**  A user account that is given this user right has complete control over the system, and it can lead to the system being compromised. We highly recommend that you do not assign this right to any user accounts. - + Windows examines a user's access token to determine the level of the user's privileges. Access tokens are built when users sign in to the local device or connect to a remote device over a network. When you revoke a privilege, the change is immediately recorded, but the change isn't reflected in the user's access token until the next time the user logs on or connects. Users with the ability to create or modify tokens can change the level of access for any account on a computer if they're currently logged on. They could escalate their privileges or create a DoS condition. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/create-global-objects.md b/windows/security/threat-protection/security-policy-settings/create-global-objects.md index 748588c0e1..18fb5d25ad 100644 --- a/windows/security/threat-protection/security-policy-settings/create-global-objects.md +++ b/windows/security/threat-protection/security-policy-settings/create-global-objects.md @@ -1,8 +1,8 @@ --- -title: Create global objects +title: Create global objects description: Describes the best practices, location, values, policy management, and security considerations for the Create global objects security policy setting. ms.assetid: 9cb6247b-44fc-4815-86f2-cb59b6f0221e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not Defined | -| Default Domain Controller Policy | Administrators
    Local Service
    Network Service
    Service| -| Stand-Alone Server Default Settings | Administrators
    Local Service
    Network Service
    Service| -| Domain Controller Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| -| Member Server Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| -| Client Computer Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| - +| Default Domain Policy | Not Defined | +| Default Domain Controller Policy | Administrators
    Local Service
    Network Service
    Service| +| Stand-Alone Server Default Settings | Administrators
    Local Service
    Network Service
    Service| +| Domain Controller Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| +| Member Server Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| +| Client Computer Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| + ## Policy management A restart of the device isn't required for this policy setting to take effect. @@ -86,7 +86,7 @@ This section describes how an attacker might exploit a feature or its configurat The **Create global objects** user right is required for a user account to create global objects in Remote Desktop sessions. Users can still create session-specfic objects without being assigned this user right. Assigning this right can be a security risk. -By default, members of the **Administrators** group, the System account, and services that are started by the Service Control Manager are assigned the **Create global objects** user right. Users who are added to the **Remote Desktop Users** group also have this user right. +By default, members of the **Administrators** group, the System account, and services that are started by the Service Control Manager are assigned the **Create global objects** user right. Users who are added to the **Remote Desktop Users** group also have this user right. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md b/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md index 29994f1b96..e5d58fc80d 100644 --- a/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md +++ b/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects.md @@ -1,8 +1,8 @@ --- -title: Create permanent shared objects +title: Create permanent shared objects description: Describes the best practices, location, values, policy management, and security considerations for the Create permanent shared objects security policy setting. ms.assetid: 6a58438d-65ca-4c4a-a584-450eed976649 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not Defined| -| Default Domain Controller Policy | Not Defined | -| Stand-Alone Server Default Settings | Not Defined| -| Domain Controller Effective Default Settings | **LocalSystem**| -| Member Server Effective Default Settings | **LocalSystem**| -| Client Computer Effective Default Settings | **LocalSystem**| - +| Default Domain Policy | Not Defined| +| Default Domain Controller Policy | Not Defined | +| Stand-Alone Server Default Settings | Not Defined| +| Domain Controller Effective Default Settings | **LocalSystem**| +| Member Server Effective Default Settings | **LocalSystem**| +| Client Computer Effective Default Settings | **LocalSystem**| + ## Policy management This section describes different features and tools available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md b/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md index e728e58567..970e2ddfd7 100644 --- a/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md +++ b/windows/security/threat-protection/security-policy-settings/create-symbolic-links.md @@ -1,8 +1,8 @@ --- -title: Create symbolic links +title: Create symbolic links description: Describes the best practices, location, values, policy management, and security considerations for the Create symbolic links security policy setting. ms.assetid: 882922b9-0ff8-4ee9-8afc-4475515ee3fd -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not Defined| -| Default Domain Controller Policy | Not Defined| -| Stand-Alone Server Default Settings | Not Defined| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy | Not Defined| +| Default Domain Controller Policy | Not Defined| +| Stand-Alone Server Default Settings | Not Defined| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes different features and tools available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index 03d85f19cb..6426a749bf 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -1,8 +1,8 @@ --- -title: DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax +title: DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax description: Learn about best practices and more for the syntax policy setting, DCOM Machine Access Restrictions in Security Descriptor Definition Language (SDDL). ms.assetid: 0fe3521a-5252-44df-8a47-8d92cf936e7c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,12 +55,12 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | - | - | | Default Domain Policy | Blank | -| Default Domain Controller Policy | Blank | -| Stand-Alone Server Default Settings | Blank | -| DC Effective Default Settings | Not defined | -| Member Server Effective Default Settings | Not defined | -| Client Computer Effective Default Settings | Not defined | - +| Default Domain Controller Policy | Blank | +| Stand-Alone Server Default Settings | Blank | +| DC Effective Default Settings | Not defined | +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined | + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -72,7 +72,7 @@ None. Changes to this policy become effective without a computer restart when th The registry settings that are created as a result of enabling the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting take precedence over the previous registry settings when this policy setting was configured. The Remote Procedure Call (RPC) service checks the new registry keys in the Policies section for the computer restrictions, and these registry entries take precedence over the existing registry keys under OLE. This precedence means that previously existing registry settings are no longer effective, and if you make changes to the existing settings, device access permissions for users aren't changed. Use care in configuring the list of users and groups. -If the administrator is denied permission to access DCOM applications due to the changes made to DCOM in the Windows operating system, the administrator can use the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting to manage DCOM access to the computer. The administrator can use this setting to specify which users and groups can access the DCOM application on the computer locally and remotely. This setting will restore control of the DCOM application to the administrator and users. To define this setting, open the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click +If the administrator is denied permission to access DCOM applications due to the changes made to DCOM in the Windows operating system, the administrator can use the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** policy setting to manage DCOM access to the computer. The administrator can use this setting to specify which users and groups can access the DCOM application on the computer locally and remotely. This setting will restore control of the DCOM application to the administrator and users. To define this setting, open the **DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax** setting, and click **Edit Security**. Specify the users or groups you want to include and the computer access permissions for those users or groups. This information defines the setting and sets the appropriate SDDL value. ## Security considerations @@ -96,5 +96,5 @@ Windows implements default COM ACLs when they're installed. Modifying these ACLs ## Related topics - [Security Options](security-options.md) - - + + diff --git a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md index d4c07f3415..5accd3bbbc 100644 --- a/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md +++ b/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md @@ -1,8 +1,8 @@ --- -title: DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax +title: DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax description: Best practices and more for the security policy setting, DCOM Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax. ms.assetid: 4b95d45f-dd62-4c34-ba32-43954528dabe -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -30,7 +30,7 @@ Describes the best practices, location, values, and security considerations for This policy setting is similar to the [DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax](dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md) setting in that it allows you to define more computer-wide controls that govern access to all DCOM–based applications on a device. However, the ACLs that are specified in this policy setting control local and remote COM launch requests (not access requests) on the device. A simple way to think about this access control is as an extra access check that is performed against a device-wide ACL on each launch of any COM-based server. If the access check fails, the call, activation, or launch request is denied. (This check is in addition to any access check that is run against the server-specific ACLs.) In effect, it provides a minimum authorization standard that must be passed to launch any COM-based server. The DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax policy setting differs in that it provides a minimum access check that is applied to attempts to access an already launched COM-based server. These device-wide ACLs provide a way to override weak security settings that are specified by an application through CoInitializeSecurity or application-specific security settings. They provide a minimum security standard that must be passed, regardless of the settings of the specific COM-based server. These ACLs provide a centralized location for an administrator to set a general authorization policy that applies to all COM-based servers. -The **DCOM: Machine Launch Restrictions in the Security Descriptor Definition Language (SDDL) syntax** setting allows you to specify an ACL in two ways. You can type the security descriptor in SDDL, or you can grant or deny Local +The **DCOM: Machine Launch Restrictions in the Security Descriptor Definition Language (SDDL) syntax** setting allows you to specify an ACL in two ways. You can type the security descriptor in SDDL, or you can grant or deny Local Access and Remote Access permissions to users and groups. We recommend that you use the built-in user interface to specify the ACL contents that you want to apply with this setting. The default ACL settings vary, depending on the version of Windows you're running. ### Possible values @@ -53,13 +53,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Blank | -| Default Domain Controller Policy | Blank| -| Stand-Alone Server Default Settings |Blank | -| DC Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined | -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy | Blank | +| Default Domain Controller Policy | Blank| +| Stand-Alone Server Default Settings |Blank | +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/debug-programs.md b/windows/security/threat-protection/security-policy-settings/debug-programs.md index d5058a6e3f..c65db98a6f 100644 --- a/windows/security/threat-protection/security-policy-settings/debug-programs.md +++ b/windows/security/threat-protection/security-policy-settings/debug-programs.md @@ -1,8 +1,8 @@ --- -title: Debug programs +title: Debug programs description: Describes the best practices, location, values, policy management, and security considerations for the Debug programs security policy setting. ms.assetid: 594d9f2c-8ffc-444b-9522-75615ec87786 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Administrators | -| Stand-Alone Server Default Settings | Administrators | -| Domain Controller Effective Default Settings | Administrators | -| Member Server Effective Default Settings | Administrators | -| Client Computer Effective Default Settings | Administrators | - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Administrators | +| Stand-Alone Server Default Settings | Administrators | +| Domain Controller Effective Default Settings | Administrators | +| Member Server Effective Default Settings | Administrators | +| Client Computer Effective Default Settings | Administrators | + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -84,7 +84,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -The **Debug programs** user right can be exploited to capture sensitive device information from system memory or to access and modify kernel or application structures. Some attack tools exploit this user right to extract hashed passwords and other private security information or to insert malware. +The **Debug programs** user right can be exploited to capture sensitive device information from system memory or to access and modify kernel or application structures. Some attack tools exploit this user right to extract hashed passwords and other private security information or to insert malware. By default, the **Debug programs** user right is assigned only to administrators, which helps mitigate risk from this vulnerability. ### Countermeasure @@ -93,7 +93,7 @@ Remove the accounts of all users and groups that do not require the **Debug prog ### Potential impact -If you revoke this user right, no one can debug programs. However, typical circumstances rarely require this capability on production devices. If an issue arises that requires an application to be debugged on a production server, you can move the server to a different organizational unit (OU) +If you revoke this user right, no one can debug programs. However, typical circumstances rarely require this capability on production devices. If an issue arises that requires an application to be debugged on a production server, you can move the server to a different organizational unit (OU) temporarily and assign the **Debug programs** user right to a separate Group Policy for that OU. ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md b/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md index b069fd1da1..09c0633dea 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md +++ b/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network.md @@ -1,8 +1,8 @@ --- -title: Deny access to this computer from the network +title: Deny access to this computer from the network description: Best practices, location, values, policy management, and security considerations for the Deny access to this computer from the network security policy setting. ms.assetid: 935e9f89-951b-4163-b186-fc325682bb0b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 05/19/2021 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md index 42bdc8d2a2..c4bc52c008 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job.md @@ -1,8 +1,8 @@ --- -title: Deny log on as a batch job +title: Deny log on as a batch job description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a batch job security policy setting. ms.assetid: 0ac36ebd-5e28-4b6a-9b4e-8924c6ecf44b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Not defined | -| Domain Controller Effective Default Settings | Not defined | -| Member Server Effective Default Settings | Not defined | -| Client Computer Effective Default Settings | Not defined | - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Not defined | +| Domain Controller Effective Default Settings | Not defined | +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined | + ## Policy management This section describes features and tools available to help you manage this policy. @@ -73,7 +73,7 @@ This policy setting might conflict with and negate the **Log on as a batch job** On a domain-joined device, including the domain controller, this policy can be overwritten by a domain policy, which will prevent you from modifying the local policy setting. -For example, to configure Task Scheduler on your domain controller, check the Settings tab of your two domain controller policy and domain policy GPOs in the Group Policy Management Console (GPMC). Verify the targeted account isn't present in the **Deny log on as a batch job** setting. +For example, to configure Task Scheduler on your domain controller, check the Settings tab of your two domain controller policy and domain policy GPOs in the Group Policy Management Console (GPMC). Verify the targeted account isn't present in the **Deny log on as a batch job** setting. User Rights Assignment and also correctly configured in the **Log on as a batch job** setting. diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md index 8e61df03d2..7bdd2075ca 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service.md @@ -1,8 +1,8 @@ --- -title: Deny log on as a service +title: Deny log on as a service description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on as a service security policy setting. ms.assetid: f1114964-df86-4278-9b11-e35c66949794 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined | -| Domain Controller Effective Default Settings | Not defined | -| Member Server Effective Default Settings | Not defined | -| Client Computer Effective Default Settings | Not defined | - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined | +| Domain Controller Effective Default Settings | Not defined | +| Member Server Effective Default Settings | Not defined | +| Client Computer Effective Default Settings | Not defined | + ## Policy management This section describes features and tools available to help you manage this policy. @@ -89,7 +89,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Accounts that can sign in to a service application could be used to configure and start new unauthorized services, such as a keylogger or other malware. The benefit of the specified countermeasure is reduced by the fact that only users with administrative rights can install and configure +Accounts that can sign in to a service application could be used to configure and start new unauthorized services, such as a keylogger or other malware. The benefit of the specified countermeasure is reduced by the fact that only users with administrative rights can install and configure services, and an attacker who already has that level of access could configure the service to run by using the System account. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md index 8cc1881127..263496c85d 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-locally.md @@ -1,8 +1,8 @@ --- -title: Deny log on locally +title: Deny log on locally description: Describes the best practices, location, values, policy management, and security considerations for the Deny log on locally security policy setting. ms.assetid: 00150e88-ec9c-43e1-a70d-33bfe10434db -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,13 +51,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md b/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md index 6a3f748155..24e896eb79 100644 --- a/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md +++ b/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services.md @@ -1,8 +1,8 @@ --- -title: Deny log on through Remote Desktop Services +title: Deny log on through Remote Desktop Services description: Best practices, location, values, policy management, and security considerations for the security policy setting, Deny log on through Remote Desktop Services. ms.assetid: 84bbb807-287c-4acc-a094-cf0ffdcbca67 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,12 +51,12 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | | Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md b/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md index c0ec06ad12..abbf2b5679 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on.md @@ -1,8 +1,8 @@ --- -title: Devices Allow undock without having to log on +title: Devices Allow undock without having to log on description: Describes the best practices, location, values, and security considerations for the Devices Allow undock without having to sign in security policy setting. ms.assetid: 1d403f5d-ad41-4bb4-9f4a-0779c1c14b8c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -30,7 +30,7 @@ Describes the best practices, location, values, and security considerations for This policy setting enables or disables the ability of a user to remove a portable device from a docking station without logging on. If you enable this policy setting, users can press a docked portable device's physical eject button to safely undock the device. If you disable this policy setting, the user must sign in to receive permission to undock the device. Only users who have the **Remove Computer from Docking Station** privilege can obtain this permission. >**Note:**  Disabling this policy setting only reduces theft risk for portable devices that cannot be mechanically undocked. Devices that can be mechanically undocked can be physically removed by the user whether or not they use the Windows undocking functionality. - + Enabling this policy setting means that anyone with physical access to a device that has been placed in its docking station can remove the computer and possibly tamper with it. For devices that don't have docking stations, this policy setting has no impact. However, for users with a mobile computer that is normally docked while they are in the office, this policy setting will help lower the risk of equipment theft or a malicious user gaining physical access to these devices ### Possible values @@ -53,13 +53,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings | Enabled| -| Client Computer Effective Default Settings| Enabled| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings| Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md b/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md index c27928a04e..c2b35adf67 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md +++ b/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md @@ -1,8 +1,8 @@ --- -title: Devices Allowed to format and eject removable media +title: Devices Allowed to format and eject removable media description: Describes the best practices, location, values, and security considerations for the Devices Allowed to format and eject removable media security policy setting. ms.assetid: d1b42425-7244-4ab1-9d46-d68de823459c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Administrators| -| DC Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Administrators| +| DC Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -73,7 +73,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Users could move data on removable disks to a different computer where they have administrative privileges. The user could then take ownership of any file, grant themselves full control, and view or modify any file. The fact that most removable storage devices eject media when a mechanical button +Users could move data on removable disks to a different computer where they have administrative privileges. The user could then take ownership of any file, grant themselves full control, and view or modify any file. The fact that most removable storage devices eject media when a mechanical button is pressed diminishes the advantage of this policy setting. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md index 40487ac65b..9a909d447c 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md @@ -1,8 +1,8 @@ --- -title: Devices Prevent users from installing printer drivers +title: Devices Prevent users from installing printer drivers description: Describes the best practices, location, values, and security considerations for the Devices Prevent users from installing printer drivers security policy setting. ms.assetid: ab70a122-f7f9-47e0-ad8c-541f30a27ec3 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 01/05/2022 ms.technology: itpro-security --- @@ -44,7 +44,7 @@ Although it might be appropriate in some organizations to allow users to install - It's advisable to set **Devices: Prevent users from installing printer drivers** to Enabled. Only users in the Administrative, Power User, or Server Operator groups will be able to install printers on servers. If this policy setting is enabled, but the driver for a network printer already exists on the local computer, users can still add the network printer. This policy setting doesn't affect a user's ability to add a local printer. > [!NOTE] -> After applying the [July 6, 2021 updates](https://support.microsoft.com/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7), non-administrators, including delegated admin groups like printer operators, cannot install signed and unsigned printer drivers to a print server. By default, only administrators can install both signed and unsigned printer drivers to a print server. +> After applying the [July 6, 2021 updates](https://support.microsoft.com/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7), non-administrators, including delegated admin groups like printer operators, cannot install signed and unsigned printer drivers to a print server. By default, only administrators can install both signed and unsigned printer drivers to a print server. ### Location @@ -56,13 +56,13 @@ The following table lists the actual and effective default values for this polic Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings | Enabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -77,7 +77,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -It may be appropriate in some organizations to allow users to install printer drivers on their own workstations. However, you should allow only administrators, not users, to do so on servers because printer driver installation on a server may unintentionally cause the computer to become less +It may be appropriate in some organizations to allow users to install printer drivers on their own workstations. However, you should allow only administrators, not users, to do so on servers because printer driver installation on a server may unintentionally cause the computer to become less stable. A malicious user could install inappropriate printer drivers in a deliberate attempt to damage the computer, or a user might accidentally install malicious software that masquerades as a printer driver. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md b/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md index 2f3acd5122..30a9097f46 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md +++ b/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md @@ -1,8 +1,8 @@ --- -title: Restrict CD-ROM access to locally logged-on user +title: Restrict CD-ROM access to locally logged-on user description: Describes the best practices, location, values, and security considerations for the Devices Restrict CD-ROM access to locally logged-on user only security policy setting. ms.assetid: 8b8f44bb-84ce-4f18-af30-ab89910e234d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Disabled | -| DC Effective Default Settings | Disabled | -| Member Server Effective Default Settings | Disabled | -| Client Computer Effective Default Settings | Disabled | - +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Disabled | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled | + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -75,7 +75,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -A remote user could potentially access a mounted CD that contains sensitive information. This risk is small because CD drives aren't automatically made available as shared drives; you must deliberately choose to share the drive. However, you can deny network users the ability to view data or run +A remote user could potentially access a mounted CD that contains sensitive information. This risk is small because CD drives aren't automatically made available as shared drives; you must deliberately choose to share the drive. However, you can deny network users the ability to view data or run applications from removable media on the server. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md b/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md index 511ccc907f..0a4d6c2250 100644 --- a/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md +++ b/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md @@ -1,8 +1,8 @@ --- -title: Devices Restrict floppy access to locally logged-on user only +title: Devices Restrict floppy access to locally logged-on user only description: Describes the best practices, location, values, and security considerations for the Devices Restrict floppy access to locally logged-on user only security policy setting. ms.assetid: 92997910-da95-4c03-ae6f-832915423898 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md b/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md index 28361156ef..8d5b95d46a 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md @@ -1,13 +1,13 @@ --- title: Domain controller Allow server operators to schedule tasks description: Describes the best practices, location, values, and security considerations for the Domain controller Allow server operators to schedule tasks security policy setting. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -24,7 +24,7 @@ Describes the best practices, location, values, and security considerations for This policy setting determines whether server operators can use the **at** command to submit jobs. If you enable this policy setting, jobs that are created by server operators by means of the **at** command run in the context of the account that runs the Task Scheduler service. By default, that account is the Local System account. >**Note:**  This security option setting affects only the scheduler tool for the **at** command. It does not affect the Task Scheduler tool. - + Enabling this policy setting means jobs that are created by server operators through the **at** command will be executed in the context of the account that is running that service—by default, that is, the Local System account. This synchronization with the local account means that server operators can perform tasks that the Local System account is able to do, but server operators would normally not be able to do, such as add their account to the local Administrators group. The impact of enabling this policy setting should be small for most organizations. Users, including those users in the Server Operators group, will still be able to create jobs by using the Task Scheduler Wizard, but those jobs will run in the context of the account that the user authenticates with when setting up the job. @@ -49,13 +49,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Not defined| -| DC Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md index 24614ad5c4..af6812e273 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-channel-binding-token-requirements.md @@ -7,7 +7,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.date: 04/26/2023 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md index 39803ce695..0745e54ec3 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements.md @@ -1,13 +1,13 @@ --- title: Domain controller LDAP server signing requirements description: Describes the best practices, location, values, and security considerations for the Domain controller LDAP server signing requirements security policy setting. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -30,7 +30,7 @@ This setting doesn't have any impact on LDAP simple bind through SSL (LDAP TCP/6 If signing is required, then LDAP simple binds not using SSL are rejected (LDAP TCP/389). >**Caution:**  If you set the server to Require signature, you must also set the client device. Not setting the client device results in loss of connection with the server. - + ### Possible values - None. Data signatures aren't required to bind with the server. If the client computer requests data signing, the server supports it. @@ -51,13 +51,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| DC Effective Default Settings | None| -| Member Server Effective Default Settings | None| -| Client Computer Effective Default Settings | None| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | None| +| Member Server Effective Default Settings | None| +| Client Computer Effective Default Settings | None| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md b/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md index 63d863c555..dcc3e3be66 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md +++ b/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md @@ -1,13 +1,13 @@ --- title: Refuse machine account password changes policy description: Describes the best practices, location, values, and security considerations for the Domain controller Refuse machine account password changes security policy setting. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.technology: itpro-security ms.date: 12/31/2017 --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | |---|---| -| Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Not defined | -| DC Effective Default Settings | Disabled | -| Member Server Effective Default Settings | Disabled | -| Client Computer Effective Default Settings | Not applicable | - +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings | Not defined | +| DC Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Not applicable | + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md index d918369b03..820c7facca 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md @@ -1,8 +1,8 @@ --- -title: Domain member Digitally encrypt or sign secure channel data (always) +title: Domain member Digitally encrypt or sign secure channel data (always) description: Best practices, location, values, and security considerations for the policy setting, Domain member Digitally encrypt or sign secure channel data (always). ms.assetid: 4480c7cb-adca-4f29-b4b8-06eb68d272bf -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -49,7 +49,7 @@ When a device joins a domain, a machine account is created. After being connecte - Enabled - The policy [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) is assumed to be enabled regardless of its current setting. This enablement ensures that the domain member attempts to negotiate at least signing of the secure + The policy [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) is assumed to be enabled regardless of its current setting. This enablement ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. - Disabled @@ -67,7 +67,7 @@ When a device joins a domain, a machine account is created. After being connecte - Set [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) to **Enabled**. >**Note:**  You can enable the policy settings [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and [Domain member: Digitally sign secure channel data (when possible)](domain-member-digitally-sign-secure-channel-data-when-possible.md) on all devices in the domain that support these policy settings without affecting earlier-version clients and applications. - + ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options @@ -78,13 +78,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Enabled | -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings | Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Enabled | +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -103,7 +103,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -When a device joins a domain, a machine account is created. After the device is joined with the domain, it uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and +When a device joins a domain, a machine account is created. After the device is joined with the domain, it uses the password for that account to create a secure channel with the domain controller for its domain every time it restarts. Requests that are sent on the secure channel are authenticated—and sensitive information such as passwords are encrypted—but the channel isn't integrity-checked, and not all information is encrypted. If a device is configured to always encrypt or sign secure channel data but the domain controller can't sign or encrypt any portion of the secure channel data, the computer and domain controller can't establish a secure channel. If the device is configured to encrypt or sign secure channel data, when possible, a secure channel can be established, but the level of encryption and signing is negotiated. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md index c277be4b30..0086d01e2c 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md @@ -1,8 +1,8 @@ --- -title: Domain member Digitally encrypt secure channel data (when possible) +title: Domain member Digitally encrypt secure channel data (when possible) description: Best practices, security considerations, and more for the security policy setting, Domain member Digitally encrypt secure channel data (when possible). ms.assetid: 73e6023e-0af3-4531-8238-82f0f0e4965b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -27,7 +27,7 @@ Describes the best practices, location, values, and security considerations for ## Reference -This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be encrypted. Sign-in information that is transmitted over +This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be encrypted. Sign-in information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. In addition to this policy setting, the following policy settings determine whether a secure channel can be established with a domain controller that isn't capable of signing or encrypting secure channel traffic: @@ -54,7 +54,7 @@ When a device joins a domain, a machine account is created. After the device is The domain member won't attempt to negotiate secure channel encryption. >**Note:**  If the security policy setting [Domain member: Digitally encrypt or sign secure channel data (always)](domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md) is enabled, this setting will be overwritten. - + - Not defined ### Best practices @@ -74,12 +74,12 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | | Default Domain Policy | Not defined| -| Default Domain Controller Policy | Enabled| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Controller Policy | Enabled| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md index 302edcac50..cadfa2282e 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md @@ -1,8 +1,8 @@ --- -title: Domain member Digitally sign secure channel data (when possible) +title: Domain member Digitally sign secure channel data (when possible) description: Best practices, location, values, and security considerations for the security policy setting, Domain member Digitally sign secure channel data (when possible). ms.assetid: a643e491-4f45-40ea-b12c-4dbe47e54f34 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -27,7 +27,7 @@ Describes the best practices, location, values, and security considerations for ## Reference -This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed. Sign-in information that is transmitted over the +This setting determines whether all secure channel traffic that is initiated by the domain member meets minimum security requirements. Specifically, it determines whether all secure channel traffic that is initiated by the domain member must be signed. Sign-in information that is transmitted over the secure channel is always encrypted regardless of whether the encryption of all other secure channel traffic is negotiated. The following policy settings determine whether a secure channel can be established with a domain controller that isn't capable of signing or encrypting secure channel traffic: @@ -60,7 +60,7 @@ When a device joins a domain, a machine account is created. After the device is - Set [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) to **Enabled**. - Set **Domain member: Digitally sign secure channel data (when possible)** to **Enabled**. >**Note:** You can enable the other two policy settings, Domain member: [Domain member: Digitally encrypt secure channel data (when possible)](domain-member-digitally-encrypt-secure-channel-data-when-possible.md) and **Domain member: Digitally sign secure channel data (when possible)**, on all devices joined to the domain that support these policy settings without affecting earlier-version clients and applications. - + ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options @@ -71,13 +71,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Enabled | -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Enabled | +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md b/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md index 72e15d7783..324f36b008 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes.md @@ -1,8 +1,8 @@ --- -title: Domain member Disable machine account password changes +title: Domain member Disable machine account password changes description: Describes the best practices, location, values, and security considerations for the Domain member Disable machine account password changes security policy setting. ms.assetid: 1f660300-a07a-4243-a09f-140aa1ab8867 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 06/27/2019 ms.technology: itpro-security --- @@ -44,8 +44,8 @@ Verify that the **Domain member: Disable machine account password changes** opti 3. You may want to consider using this policy setting in specific environments, such as the following ones: - Non-persistent Virtual Desktop Infrastructure implementations. In such implementations, each session starts from a read-only base image. - - Embedded devices that don't have write access to the OS volume. - + - Embedded devices that don't have write access to the OS volume. + In either case, a password change that was made during normal operations would be lost as soon as the session ends. We strongly recommend that you plan password changes for maintenance windows. Add the password changes to the updates and modifications that Windows performs during maintenance windows. To trigger a password update on a specific OS volume, run the following command: ``` @@ -62,15 +62,15 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. -| Server type or GPO | Default value | +| Server type or GPO | Default value | | - | - | -| Default Domain Policy | Disabled | -| Default Domain Controller Policy | Disabled| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy | Disabled | +| Default Domain Controller Policy | Disabled| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -85,7 +85,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -By default, devices running Windows Server that belong to a domain automatically change their passwords for their accounts every certain number of days, typically 30. If you disable this policy setting, devices that run Windows Server retain the same passwords as their machine accounts. Devices +By default, devices running Windows Server that belong to a domain automatically change their passwords for their accounts every certain number of days, typically 30. If you disable this policy setting, devices that run Windows Server retain the same passwords as their machine accounts. Devices that can't automatically change their account password are at risk from an attacker who could determine the password for the machine's domain account. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md index aacfa76378..278f2854fa 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age.md @@ -1,8 +1,8 @@ --- -title: Domain member Maximum machine account password age +title: Domain member Maximum machine account password age description: Describes the best practices, location, values, and security considerations for the Domain member Maximum machine account password age security policy setting. ms.assetid: 0ec6f7c1-4d82-4339-94c0-debb2d1ac109 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 05/29/2020 ms.technology: itpro-security --- @@ -31,8 +31,8 @@ The **Domain member: Maximum machine account password age** policy setting deter In Active Directory–based domains, each device has an account and password. By default, the domain members submit a password change every 30 days. You can extend or reduce this interval. Additionally, you can use the **Domain member: Disable machine account password changes** policy to disable the password change requirement completely. However, before you consider this option, review the implications as described in [Domain member: Disable machine account password changes](domain-member-disable-machine-account-password-changes.md). -> [!IMPORTANT] -> Significantly increasing the password change interval (or disabling password changes) gives an attacker more time to undertake a brute-force password-guessing attack against one of the machine accounts. +> [!IMPORTANT] +> Significantly increasing the password change interval (or disabling password changes) gives an attacker more time to undertake a brute-force password-guessing attack against one of the machine accounts. For more information, see [Machine Account Password Process](https://techcommunity.microsoft.com/t5/Ask-the-Directory-Services-Team/Machine-Account-Password-Process/ba-p/396026). @@ -43,7 +43,7 @@ For more information, see [Machine Account Password Process](https://techcommuni ### Best practices -We recommend that you set **Domain member: Maximum machine account password age** to about 30 days. Setting the value to fewer days can increase replication and affect domain controllers. For example, in Windows NT domains, machine passwords were changed every 7 days. The extra replication churn would affect domain controllers in large organizations that have many computers or slow links between sites. +We recommend that you set **Domain member: Maximum machine account password age** to about 30 days. Setting the value to fewer days can increase replication and affect domain controllers. For example, in Windows NT domains, machine passwords were changed every 7 days. The extra replication churn would affect domain controllers in large organizations that have many computers or slow links between sites. ### Location @@ -55,13 +55,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined | -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | 30 days| -| DC Effective Default Settings | 30 days| -| Member Server Effective Default Settings|30 days| -| Client Computer Effective Default Settings | 30 days| - +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | 30 days| +| DC Effective Default Settings | 30 days| +| Member Server Effective Default Settings|30 days| +| Client Computer Effective Default Settings | 30 days| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md b/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md index d5c4b65fcc..5f03addc62 100644 --- a/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md +++ b/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md @@ -1,8 +1,8 @@ --- -title: Domain member Require strong (Windows 2000 or later) session key +title: Domain member Require strong (Windows 2000 or later) session key description: Best practices, location, values, and security considerations for the security policy setting, Domain member Require strong (Windows 2000 or later) session key. ms.assetid: 5ab8993c-5086-4f09-bc88-1b27454526bd -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,7 +55,7 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec The following table lists the actual and effective default values for this policy. Default values are also listed on the policy’s property page. -| Server type or GPO +| Server type or GPO | Default value | |--------------------------------------------| diff --git a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md index 8f52bd244e..2580f51ed8 100644 --- a/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md +++ b/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md @@ -1,8 +1,8 @@ --- -title: Trust computer and user accounts for delegation +title: Trust computer and user accounts for delegation description: Learn about best practices, security considerations and more for the security policy setting, Enable computer and user accounts to be trusted for delegation. ms.assetid: 524062d4-1595-41f3-8ce1-9c85fd21497b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,13 +55,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools and guidance to help you manage this policy. @@ -94,7 +94,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Misuse of the **Enable computer and user accounts to be trusted for delegation** user right could allow unauthorized users to impersonate other users on the network. An attacker could exploit this privilege to gain access to network resources and make it difficult to determine what has happened +Misuse of the **Enable computer and user accounts to be trusted for delegation** user right could allow unauthorized users to impersonate other users on the network. An attacker could exploit this privilege to gain access to network resources and make it difficult to determine what has happened after a security incident. ### Countermeasure @@ -102,7 +102,7 @@ after a security incident. The **Enable computer and user accounts to be trusted for delegation** user right should be assigned only if there's a clear need for its functionality. When you assign this right, you should investigate the use of constrained delegation to control what the delegated accounts can do. On domain controllers, this right is assigned to the Administrators group by default. >**Note:**  There is no reason to assign this user right to anyone on member servers and workstations that belong to a domain because it has no meaning in those contexts. It is only relevant on domain controllers and stand-alone computers. - + ### Potential impact None. Not defined is the default configuration. diff --git a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md index 69915eba98..b2b87b7314 100644 --- a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md +++ b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md @@ -1,8 +1,8 @@ --- -title: Enforce password history +title: Enforce password history description: Describes the best practices, location, values, policy management, and security considerations for the Enforce password history security policy setting. ms.assetid: 8b2ab871-3e52-4dd1-9776-68bb1e935442 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default domain policy | 24 passwords remembered| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | 0 passwords remembered| -| Domain controller effective default settings | 24 passwords remembered| -| Member server effective default settings | 24 passwords remembered| -| Effective GPO default settings on client computers | 24 passwords remembered| - +| Default domain policy | 24 passwords remembered| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | 0 passwords remembered| +| Domain controller effective default settings | 24 passwords remembered| +| Member server effective default settings | 24 passwords remembered| +| Effective GPO default settings on client computers | 24 passwords remembered| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -79,7 +79,7 @@ The longer a user uses the same password, the greater the chance that an attacke If you specify a low number for this policy setting, users can use the same small number of passwords repeatedly. If you don't also configure the [Minimum password age](minimum-password-age.md) policy setting, users might repeatedly change their passwords until they can reuse their original password. >**Note:**  After an account has been compromised, a simple password reset might not be enough to restrict a malicious user because the malicious user might have modified the user's environment so that the password is changed back to a known value automatically at a certain time. If an account has been compromised, it is best to delete the account and assign the user a new account after all affected systems have been restored to normal operations and verified that they are no longer compromised. - + ### Countermeasure Configure the **Enforce password history** policy setting to 24 (the maximum setting) to help minimize the number of vulnerabilities that are caused by password reuse. diff --git a/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md b/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md index a119f6c131..faf39c7570 100644 --- a/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md +++ b/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions.md @@ -1,8 +1,8 @@ --- -title: Enforce user logon restrictions +title: Enforce user logon restrictions description: Describes the best practices, location, values, policy management, and security considerations for the Enforce user logon restrictions security policy setting. ms.assetid: 5891cb73-f1ec-48b9-b703-39249e48a29f -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,13 +50,13 @@ The following table lists the actual and effective default policy values. Defaul | Server Type or GPO | Default Value | | - | - | -| Default Domain Policy | Enabled| +| Default Domain Policy | Enabled| | Default Domain Controller Policy | Not defined | | Stand-Alone Server Default Settings| Not applicable | -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Not applicable| -| Client Computer Effective Default Settings | Not applicable| - +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Not applicable| +| Client Computer Effective Default Settings | Not applicable| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md b/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md index bb10d2ce82..fbf329985c 100644 --- a/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md +++ b/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system.md @@ -1,8 +1,8 @@ --- -title: Force shutdown from a remote system +title: Force shutdown from a remote system description: Describes the best practices, location, values, policy management, and security considerations for the Force shutdown from a remote system security policy setting. ms.assetid: 63129243-31ea-42a4-a598-c7064f48a3df -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators
    Server Operators| -| Stand-Alone Server Default Settings | Administrators| -| Domain Controller Effective Default Settings | Administrators
    Server Operators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators
    Server Operators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators
    Server Operators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/generate-security-audits.md b/windows/security/threat-protection/security-policy-settings/generate-security-audits.md index 5b8810a11e..9b9ab36731 100644 --- a/windows/security/threat-protection/security-policy-settings/generate-security-audits.md +++ b/windows/security/threat-protection/security-policy-settings/generate-security-audits.md @@ -1,8 +1,8 @@ --- -title: Generate security audits +title: Generate security audits description: Describes the best practices, location, values, policy management, and security considerations for the Generate security audits security policy setting. ms.assetid: c0e1cd80-840e-4c74-917c-5c2349de885f -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Local Service
    Network Service| -| Stand-Alone Server Default Settings | Local Service
    Network Service| -| Domain Controller Effective Default Settings | Local Service
    Network Service| -| Member Server Effective Default Settings | Local Service
    Network Service| -| Client Computer Effective Default Settings | Local Service
    Network Service| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Local Service
    Network Service| +| Stand-Alone Server Default Settings | Local Service
    Network Service| +| Domain Controller Effective Default Settings | Local Service
    Network Service| +| Member Server Effective Default Settings | Local Service
    Network Service| +| Client Computer Effective Default Settings | Local Service
    Network Service| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md index 6dcfe5687d..37573dfb33 100644 --- a/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings.md @@ -8,7 +8,7 @@ manager: aaroncz ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 06/07/2023 appliesto: - ✅ Windows 11 diff --git a/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md b/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md index 698d38e82a..918c634443 100644 --- a/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication.md @@ -1,8 +1,8 @@ --- -title: Impersonate a client after authentication +title: Impersonate a client after authentication description: Describes the best practices, location, values, policy management, and security considerations for the Impersonate a client after authentication security policy setting. ms.assetid: 4cd241e2-c680-4b43-8ed0-3b391925cec5 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -65,12 +65,12 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | | Default Domain Policy| Not defined | -| Default Domain Controller Policy| Administrators
    Local Service
    Network Service
    Service| -| Stand-Alone Server Default Settings | Administrators
    Local Service
    Network Service
    Service| -| Domain Controller Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| -| Member Server Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| -| Client Computer Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| - +| Default Domain Controller Policy| Administrators
    Local Service
    Network Service
    Service| +| Stand-Alone Server Default Settings | Administrators
    Local Service
    Network Service
    Service| +| Domain Controller Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| +| Member Server Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| +| Client Computer Effective Default Settings | Administrators
    Local Service
    Network Service
    Service| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md b/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md index 0d6a6d694f..b383d4e733 100644 --- a/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md +++ b/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set.md @@ -1,8 +1,8 @@ --- -title: Increase a process working set +title: Increase a process working set description: Describes the best practices, location, values, policy management, and security considerations for the Increase a process working set security policy setting. ms.assetid: b742ad96-37f3-4686-b8f7-f2b48367105b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,11 +54,11 @@ The following table lists the actual and effective default policy values. Defaul | - | - | | Default Domain Policy| Not Defined| | Default Domain Controller Policy | Users| -| Stand-Alone Server Default Settings| Users| -| Domain Controller Effective Default Settings| Users| -| Member Server Effective Default Settings | Users| -| Client Computer Effective Default Settings | Users| - +| Stand-Alone Server Default Settings| Users| +| Domain Controller Effective Default Settings| Users| +| Member Server Effective Default Settings | Users| +| Client Computer Effective Default Settings | Users| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md b/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md index 1bcfcdb42e..e0afba5ecc 100644 --- a/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md +++ b/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority.md @@ -1,8 +1,8 @@ --- -title: Increase scheduling priority +title: Increase scheduling priority description: Describes the best practices, location, values, policy management, and security considerations for the Increase scheduling priority security policy setting. ms.assetid: fbec5973-d35e-4797-9626-d0d56061527f -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 2/6/2020 ms.technology: itpro-security --- @@ -46,7 +46,7 @@ Constant: SeIncreaseBasePriorityPrivilege ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment - + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -82,9 +82,9 @@ Verify that only Administrators and Window Manager\Window Manager Group have the None. Restricting the **Increase scheduling priority** user right to members of the Administrators group and Window Manager\Window Manager Group is the default configuration. -> [!Warning] -> If you remove **Window Manager\Window Manager Group** from the **Increase scheduling priority** user right, certain applications and computers do not function correctly. In particular, the INK workspace does not function correctly on unified memory architecture (UMA) laptop and desktop computers that run Windows 10, version 1903 (or later) and that use the Intel GFX driver. -> +> [!Warning] +> If you remove **Window Manager\Window Manager Group** from the **Increase scheduling priority** user right, certain applications and computers do not function correctly. In particular, the INK workspace does not function correctly on unified memory architecture (UMA) laptop and desktop computers that run Windows 10, version 1903 (or later) and that use the Intel GFX driver. +> > On affected computers, the display blinks when users draw on INK workspaces such as those that are used by Microsoft Edge, Microsoft PowerPoint, or Microsoft OneNote. The blinking occurs because the inking-related processes repeatedly try to use the Real-Time priority, but are denied permission. ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md index a1ee602ed9..6b6a223a3c 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Display user information when the session is locked +title: Interactive logon Display user information when the session is locked description: Best practices, security considerations, and more for the security policy setting, Interactive logon Display user information when the session is locked. ms.assetid: 9146aa3d-9b2f-47ba-ac03-ff43efb10530 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -66,7 +66,7 @@ This setting has these possible values: For a domain sign in only, the domain\username is displayed. The **Privacy** setting is automatically on and grayed out. - + - **Blank** Default setting. diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md index 1917c4b70b..6d7880e8fe 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name.md @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.reviewer: ms.author: vinpa diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md index e4c4d49b0a..a13d25cd15 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Do not require CTRL+ALT+DEL +title: Interactive logon Do not require CTRL+ALT+DEL description: Describes the best practices, location, values, and security considerations for the Interactive logon Do not require CTRL+ALT+DEL security policy setting. ms.assetid: 04e2c000-2eb2-4d4b-8179-1e2cb4793e18 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -59,13 +59,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md index eadc6514fe..85cca7c7f1 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md index bc3ee80c44..a9c3a468db 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Machine account lockout threshold +title: Interactive logon Machine account lockout threshold description: Best practices, location, values, management, and security considerations for the security policy setting, Interactive logon Machine account lockout threshold. ms.assetid: ebbd8e22-2611-4ebe-9db9-d49344e631e4 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,13 +51,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings| Disabled| -| DC Effective Default Settings | Disabled| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined | +| Stand-Alone Server Default Settings| Disabled| +| DC Effective Default Settings | Disabled| | Member Server Effective Default Settings | Disabled | -| Client Computer Effective Default Settings | Disabled| - +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md index 40c0bcb254..499c8ea921 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Machine inactivity limit +title: Interactive logon Machine inactivity limit description: Describes the best practices, location, values, management, and security considerations for the Interactive logon Machine inactivity limit security policy setting. ms.assetid: 7065b4a9-0d52-41d5-afc4-5aedfc4162b5 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 09/18/2018 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md index 7f6a3535a6..9ea2643a8c 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md @@ -1,8 +1,8 @@ --- -title: Interactive Logon Message text +title: Interactive Logon Message text description: Learn about best practices, security considerations and more for the security policy setting, Interactive logon Message text for users attempting to log on. ms.assetid: fcfe8a6d-ca65-4403-b9e6-2fa017a31c2e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md index fc861f5e80..f97c4515e8 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Message title for users attempting to log on +title: Interactive logon Message title for users attempting to log on description: Best practices, security considerations, and more for the security policy setting, Interactive logon Message title for users attempting to log on. ms.assetid: f2596470-4cc0-4ef1-849c-bef9dc3533c6 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md index 079531c038..60159d1dd5 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Number of previous logons to cache (in case domain controller is not available) +title: Interactive logon Number of previous logons to cache (in case domain controller is not available) description: Best practices and more for the security policy setting, Interactive logon Number of previous logons to cache (in case domain controller is not available). ms.assetid: 660e925e-cc3e-4098-a41e-eb8db8062d8d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 08/27/2018 ms.technology: itpro-security --- @@ -39,7 +39,7 @@ The system can't log you on now because the domain *DOMAIN NAME* isn't available The value of this policy setting indicates the number of users whose sign-in information the server caches locally. If the value is 10, the server caches sign-in information for 10 users. When an 11th user signs in to the device, the server overwrites the oldest cached sign-in session. -Users who access the server console will have their sign-in credentials cached on that server. A malicious user who is able to access the file system of the server can locate this cached information and use a brute-force attack to determine user passwords. Windows mitigates this type of attack by +Users who access the server console will have their sign-in credentials cached on that server. A malicious user who is able to access the file system of the server can locate this cached information and use a brute-force attack to determine user passwords. Windows mitigates this type of attack by encrypting the information and keeping the cached credentials in the system's registries, which are spread across numerous physical locations. > [!NOTE] @@ -52,7 +52,7 @@ encrypting the information and keeping the cached credentials in the system's re ### Best practices -The [Windows security baselines](../../operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md) don't recommend configuring this setting. +The [Windows security baselines](../../operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md) don't recommend configuring this setting. ### Location @@ -64,13 +64,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | 10 logons| -| DC Effective Default Settings | No effect| -| Member Server Effective Default Settings | 10 logons| -| Client Computer Effective Default Settings| 10 logons| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | 10 logons| +| DC Effective Default Settings | No effect| +| Member Server Effective Default Settings | 10 logons| +| Client Computer Effective Default Settings| 10 logons| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -105,7 +105,7 @@ Configure the **Interactive logon: Number of previous logons to cache (in case d ### Potential impact -Users can't sign in to any devices if there's no domain controller available to authenticate them. Organizations can configure this value to 2 for end-user computers, especially for mobile users. A configuration value of 2 means that the user's sign-in information is still in the cache, even if a +Users can't sign in to any devices if there's no domain controller available to authenticate them. Organizations can configure this value to 2 for end-user computers, especially for mobile users. A configuration value of 2 means that the user's sign-in information is still in the cache, even if a member of the IT department has recently logged on to the device to perform system maintenance. This method allows users to sign in to their computers when they aren't connected to the organization's network. ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md index b63d35d0b2..1c2bd90367 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md @@ -1,8 +1,8 @@ --- -title: Interactive log-on prompt user to change password before expiration +title: Interactive log-on prompt user to change password before expiration description: Best practices and security considerations for an interactive log-on prompt for users to change passwords before expiration. ms.assetid: 8fe94781-40f7-4fbe-8cfd-5e116e6833e9 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,13 +50,13 @@ The following table lists the default values for this policy. Default values are | Server type or Group Policy Object | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| | Stand-Alone Server Default Settings | Five days| -| DC Effective Default Settings | Five days | +| DC Effective Default Settings | Five days | | Member Server Effective Default Settings| Five days | -| Client Computer Effective Default Settings | Five days| - +| Client Computer Effective Default Settings | Five days| + ## Policy management This section describes features and tools that you can use to manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md index c418e7adeb..12c079fced 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Require Domain Controller authentication to unlock workstation +title: Interactive logon Require Domain Controller authentication to unlock workstation description: Best practices security considerations, and more for the policy setting, Interactive logon Require Domain Controller authentication to unlock workstation. ms.assetid: 97618ed3-e946-47db-a212-b5e7a4fc6ffc -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,13 +55,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md index 8d49c17278..7175af2912 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card.md @@ -4,11 +4,11 @@ description: "Describes the best practices, location, values, policy management, author: vinaypamnani-msft ms.author: vinpa manager: aaroncz -ms.reviewer: +ms.reviewer: ms.prod: windows-client ms.technology: itpro-security ms.localizationpriority: medium -ms.topic: conceptual +ms.topic: reference ms.date: 01/13/2023 --- diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md index 55213f035f..4ae503eb5d 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior.md @@ -1,8 +1,8 @@ --- -title: Interactive logon Smart card removal behavior +title: Interactive logon Smart card removal behavior description: Best practices, location, values, policy management, and security considerations for the security policy setting, Interactive logon Smart card removal behavior. ms.assetid: 61487820-9d49-4979-b15d-c7e735999460 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -67,13 +67,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | No Action| -| DC Effective Default Settings | No Action| -| Member Server Effective Default Settings | No Action| -| Client Computer Effective Default Settings | No Action| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | No Action| +| DC Effective Default Settings | No Action| +| Member Server Effective Default Settings | No Action| +| Client Computer Effective Default Settings | No Action| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/kerberos-policy.md b/windows/security/threat-protection/security-policy-settings/kerberos-policy.md index b63e17c8c2..c8b07ad5e2 100644 --- a/windows/security/threat-protection/security-policy-settings/kerberos-policy.md +++ b/windows/security/threat-protection/security-policy-settings/kerberos-policy.md @@ -1,8 +1,8 @@ --- -title: Kerberos Policy +title: Kerberos Policy description: Describes the Kerberos Policy settings and provides links to policy setting descriptions. ms.assetid: 94017dd9-b1a3-4624-af9f-b29161b4bf38 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ The Kerberos version 5 authentication protocol provides the default mechanism f These policy settings are located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Kerberos Policy**. -The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), +The following topics provide a discussion of implementation and best practices considerations, policy location, default values for the server type or GPO, relevant differences in operating system versions, security considerations (including the possible settings vulnerabilities of each setting), countermeasures you can take, and the potential impact for each setting. ## In this section @@ -40,7 +40,7 @@ countermeasures you can take, and the potential impact for each setting. | [Maximum lifetime for user ticket](maximum-lifetime-for-user-ticket.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket** policy setting. | | [Maximum lifetime for user ticket renewal](maximum-lifetime-for-user-ticket-renewal.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum lifetime for user ticket renewal** security policy setting. | | [Maximum tolerance for computer clock synchronization](maximum-tolerance-for-computer-clock-synchronization.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum tolerance for computer clock synchronization** security | - + ## Related topics - [Configure security policy settings](how-to-configure-security-policy-settings.md) diff --git a/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md b/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md index 1e9c0d4b8b..7a97507fb3 100644 --- a/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md +++ b/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers.md @@ -1,8 +1,8 @@ --- -title: Load and unload device drivers +title: Load and unload device drivers description: Describes the best practices, location, values, policy management, and security considerations for the Load and unload device drivers security policy setting. ms.assetid: 66262532-c610-470c-9792-35ff4389430f -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators
    Print Operators| -| Stand-Alone Server Default Settings | Administrators| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators
    Print Operators| +| Stand-Alone Server Default Settings | Administrators| | Domain Controller Effective Default Settings | Administrators
    Print Operators | -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -91,7 +91,7 @@ This section describes how an attacker might exploit a feature or its configurat Device drivers run as highly privileged code. A user who has the **Load and unload device drivers** user right could unintentionally install malware that masquerades as a device driver. Administrators should exercise care and install only drivers with verified digital signatures. >**Note:**  You must have this user right or be a member of the local Administrators group to install a new driver for a local printer or to manage a local printer and configure defaults for options such as duplex printing. - + ### Countermeasure Don't assign the **Load and unload device drivers** user right to any user or group other than Administrators on member servers. On domain controllers, don't assign this user right to any user or group other than Domain Admins. diff --git a/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md b/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md index c591706f9c..6be9e7a10f 100644 --- a/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md +++ b/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory.md @@ -1,8 +1,8 @@ --- -title: Lock pages in memory +title: Lock pages in memory description: Describes the best practices, location, values, policy management, and security considerations for the Lock pages in memory security policy setting. ms.assetid: cc724979-aec0-496d-be4e-7009aef660a3 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -35,7 +35,7 @@ Enabling this policy setting for a specific account (a user account or a process > [!NOTE] > By configuring this policy setting, the performance of the Windows operating system will differ depending on if applications are running on 32-bit or 64-bit systems, and if they are virtualized images. Performance will also differ between earlier and later versions of the Windows operating system. - + Constant: SeLockMemoryPrivilege ### Possible values @@ -57,13 +57,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md b/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md index cecd34e77c..cd62546d27 100644 --- a/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md +++ b/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job.md @@ -1,8 +1,8 @@ --- -title: Log on as a batch job +title: Log on as a batch job description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a batch job security policy setting. ms.assetid: 4eaddb51-0a18-470e-9d3d-5e7cd7970b41 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators
    Backup Operators
    Performance Log Users| -| Stand-Alone Server Default Settings | Administrators
    Backup Operators
    Performance Log Users| -| Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Performance Log Users| -| Member Server Effective Default Settings | Administrators
    Backup Operators
    Performance Log Users| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators
    Backup Operators
    Performance Log Users| +| Stand-Alone Server Default Settings | Administrators
    Backup Operators
    Performance Log Users| +| Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Performance Log Users| +| Member Server Effective Default Settings | Administrators
    Backup Operators
    Performance Log Users| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md b/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md index d1f486957c..f96d6aad98 100644 --- a/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md +++ b/windows/security/threat-protection/security-policy-settings/log-on-as-a-service.md @@ -1,8 +1,8 @@ --- -title: Log on as a service +title: Log on as a service description: Describes the best practices, location, values, policy management, and security considerations for the Log on as a service security policy setting. ms.assetid: acc9a9e0-fd88-4cda-ab54-503120ba1f42 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values. The po | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Network Service| -| Member Server Effective Default Settings| Network Service| -| Client Computer Effective Default Settings | Network Service| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Network Service| +| Member Server Effective Default Settings| Network Service| +| Client Computer Effective Default Settings | Network Service| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -84,7 +84,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced because only users who have administrative privileges can install and configure services. An +The **Log on as a service** user right allows accounts to start network services or services that run continuously on a computer, even when no one is logged on to the console. The risk is reduced because only users who have administrative privileges can install and configure services. An attacker who has already reached that level of access could configure the service to run with the Local System account. ### Countermeasure @@ -93,7 +93,7 @@ By definition, the Network Service account has the **Log on as a service** user ### Potential impact -On most computers, the **Log on as a service** user right is restricted to the Local System, Local Service, and Network Service built-in accounts by default, and there's no negative impact. But if you have optional components such as ASP.NET or IIS, you might need to +On most computers, the **Log on as a service** user right is restricted to the Local System, Local Service, and Network Service built-in accounts by default, and there's no negative impact. But if you have optional components such as ASP.NET or IIS, you might need to assign the user right to the additional accounts that those components require. IIS requires this user right to be explicitly granted to the ASPNET user account. ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md b/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md index a2be818c7d..180e73d52d 100644 --- a/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md +++ b/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log.md @@ -1,8 +1,8 @@ --- -title: Manage auditing and security log +title: Manage auditing and security log description: Describes the best practices, location, values, policy management, and security considerations for the Manage auditing and security log security policy setting. ms.assetid: 4b946c0d-f904-43db-b2d5-7f0917575347 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators| -| Stand-Alone Server Default Settings | Administrators| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings| Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings| Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -100,7 +100,7 @@ Ensure that only the local Administrators group has the **Manage auditing and se Restricting the **Manage auditing and security log** user right to the local Administrators group is the default configuration. >**Warning:**  If groups other than the local Administrators group have been assigned this user right, removing this user right might cause performance issues with other applications. Before removing this right from a group, investigate whether applications are dependent on this right. - + ## Related topics - [User Rights Assignment](user-rights-assignment.md) diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md index bdc180ccf0..a750dcb65c 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket.md @@ -1,8 +1,8 @@ --- -title: Maximum lifetime for service ticket +title: Maximum lifetime for service ticket description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for service ticket security policy setting. ms.assetid: 484bf05a-3858-47fc-bc02-6599ca860247 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,13 +51,13 @@ The following table lists the actual and effective default policy values. Defaul | Server Type or GPO | Default Value | | - | - | -| Default Domain Policy| 600 minutes| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not applicable| -| DC Effective Default Settings | 600 minutes| -| Member Server Effective Default Settings | Not applicable| -| Client Computer Effective Default Settings | Not applicable| - +| Default Domain Policy| 600 minutes| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| DC Effective Default Settings | 600 minutes| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md index 43935998f5..6dc4d1607b 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md @@ -1,8 +1,8 @@ --- -title: Maximum lifetime for user ticket renewal +title: Maximum lifetime for user ticket renewal description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket renewal security policy setting. ms.assetid: f88cd819-3dd1-4e38-b560-13fe6881b609 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -49,13 +49,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| 7 days| -| Default Domain Controller Policy| Not defined| -| Stand-Alone Server Default Settings | Not applicable| -| Domain Controller Effective Default Settings | 7 days| -| Member Server Effective Default Settings | Not applicable| -| Client Computer Effective Default Settings | Not applicable| - +| Default Domain Policy| 7 days| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| Domain Controller Effective Default Settings | 7 days| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable| + ### Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -91,7 +91,7 @@ Configure the **Maximum lifetime for user ticket renewal** setting to 7 days. ### Potential impact -Seven (7) days is the default configuration. Changing the default configuration is a tradeoff between user convenience and security. A shorter time period requires users to authenticate with a DC more often, but remote users who authenticate with a DC infrequently can be locked out of services until they reauthenticate. +Seven (7) days is the default configuration. Changing the default configuration is a tradeoff between user convenience and security. A shorter time period requires users to authenticate with a DC more often, but remote users who authenticate with a DC infrequently can be locked out of services until they reauthenticate. ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md index 1d6f14a767..238e860228 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket.md @@ -1,8 +1,8 @@ --- -title: Maximum lifetime for user ticket +title: Maximum lifetime for user ticket description: Describes the best practices, location, values, policy management, and security considerations for the Maximum lifetime for user ticket policy setting. ms.assetid: bcb4ff59-334d-4c2f-99af-eca2b64011dc -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -49,13 +49,13 @@ The following table lists the actual and effective default policy values. Defaul | Server Type or GPO | Default Value | | - | - | -| Default Domain Policy| 10 hours| -| Default Domain Controller Policy| Not defined| -| Stand-Alone Server Default Settings | Not applicable| -| Domain Controller Effective Default Settings | 10 hours| -| Member Server Effective Default Settings | Not applicable| -| Client Computer Effective Default Settings | Not applicable| - +| Default Domain Policy| 10 hours| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| Domain Controller Effective Default Settings | 10 hours| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index 1e3180694c..a416e4543c 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -1,8 +1,8 @@ --- -title: Maximum password age +title: Maximum password age description: Describes the best practices, location, values, policy management, and security considerations for the Maximum password age security policy setting. ms.assetid: 2d6e70e7-c8b0-44fb-8113-870c6120871d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -30,7 +30,7 @@ Describes the best practices, location, values, policy management, and security The **Maximum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a certain number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If **Maximum password age** is between 1 and 999 days, the minimum password age must be less than the maximum password age. If **Maximum password age** is set to 0, [Minimum password age](minimum-password-age.md) can be any value between 0 and 998 days. >**Note:**  Setting **Maximum password age** to -1 is equivalent to 0, which means it never expires. Setting it to any other negative number is equivalent to setting it to **Not Defined**. - + ### Possible values - User-specified number of days between 0 and 999 @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| 42 days| -| Default domain controller policy| Not defined| -| Stand-alone server default settings | 42 days| -| Domain controller effective default settings | 42 days| -| Member server effective default settings | 42 days| -| Effective GPO default settings on client computers| 42 days| - +| Default domain policy| 42 days| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | 42 days| +| Domain controller effective default settings | 42 days| +| Member server effective default settings | 42 days| +| Effective GPO default settings on client computers| 42 days| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -74,7 +74,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -The longer a password exists, the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user, or by the user sharing the password. Configuring the **Maximum password age** policy setting to 0 so that users are never required to change their passwords allows a compromised password to be used by the malicious user for as long as the valid user is authorized access. +The longer a password exists, the higher the likelihood that it will be compromised by a brute force attack, by an attacker gaining general knowledge about the user, or by the user sharing the password. Configuring the **Maximum password age** policy setting to 0 so that users are never required to change their passwords allows a compromised password to be used by the malicious user for as long as the valid user is authorized access. ### Considerations diff --git a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md index 5b2ae28406..fd26c1fd58 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md @@ -1,8 +1,8 @@ --- -title: Maximum tolerance for computer clock synchronization +title: Maximum tolerance for computer clock synchronization description: Best practices, location, values, policy management, and security considerations for the policy setting, Maximum tolerance for computer clock synchronization. ms.assetid: ba2cf59e-d69d-469e-95e3-8e6a0ba643af -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -28,7 +28,7 @@ Describes the best practices, location, values, policy management, and security This security setting determines the maximum time difference (in minutes) that Kerberos V5 tolerates between the time on the client clock and the time on the domain controller that provides Kerberos authentication. -To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. +To prevent "replay attacks," the Kerberos v5 protocol uses time stamps as part of its protocol definition. For time stamps to work properly, the clocks of the client and the domain controller need to be in sync as much as possible. In other words, both devices must be set to the same time and date. Because the clocks of two computers are often out of sync, you can use this policy setting to establish the maximum acceptable difference to the Kerberos protocol between a client clock and domain controller clock. If the difference between a client computer clock and the domain controller clock is less than the maximum time difference that is specified in this policy, any timestamp that's used in a session between the two devices is considered to be authentic. The possible values for this Group Policy setting are: @@ -50,13 +50,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| 5 minutes| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not applicable| -| Domain Controller Effective Default Settings| 5 minutes| -| Member Server Effective Default Settings | Not applicable| -| Client Computer Effective Default Settings | Not applicable| - +| Default Domain Policy| 5 minutes| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not applicable| +| Domain Controller Effective Default Settings| 5 minutes| +| Member Server Effective Default Settings | Not applicable| +| Client Computer Effective Default Settings | Not applicable| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md index e4f7c05351..687a39281d 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md @@ -1,7 +1,7 @@ --- title: Microsoft network client Digitally sign communications (always) description: Best practices and security considerations for the Microsoft network client Digitally sign communications (always) security policy setting. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 01/13/2023 ms.technology: itpro-security -ms.topic: conceptual +ms.topic: reference --- # Microsoft network client: Digitally sign communications (always) diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md index 343e8a2eb7..a3d215db1a 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md @@ -1,8 +1,8 @@ --- -title: Microsoft network client Send unencrypted password +title: Microsoft network client Send unencrypted password description: Learn about best practices and more for the security policy setting, Microsoft network client Send unencrypted password to third-party SMB servers. ms.assetid: 97a76b93-afa7-4dd9-bb52-7c9e289b6017 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings| Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings| Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md index 72d11c51b4..e79a912300 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md @@ -1,8 +1,8 @@ --- -title: Microsoft network server Amount of idle time required before suspending session +title: Microsoft network server Amount of idle time required before suspending session description: Best practices, security considerations, and more for the policy setting, Microsoft network server Amount of idle time required before suspending session. ms.assetid: 8227842a-569d-480f-b43c-43450bbaa722 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md index f8096dec04..8fcc7102c7 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md @@ -1,8 +1,8 @@ --- -title: Microsoft network server Attempt S4U2Self +title: Microsoft network server Attempt S4U2Self description: Learn about the security policy setting, Microsoft network server Attempt S4U2Self to obtain claim information. ms.assetid: e4508387-35ed-4a3f-a47c-27f8396adbba -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -27,7 +27,7 @@ Describes the best practices, location, values, management, and security conside ## Reference -This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers +This security setting supports client devices running a version of Windows prior to Windows 8 that are trying to access a file share that requires user claims. This setting determines whether the local file server will attempt to use Kerberos Service-for-User-to-Self (S4U2Self) functionality to obtain a network client principal’s claims from the client’s account domain. This setting should only be enabled if the file server is using user claims to control access to files, and if the file server will support client principals whose accounts might be in a domain that has client computers and domain controllers running a version of Windows prior to Windows 8 or Windows Server 2012. When enabled, this security setting causes the Windows file server to examine the access token of an authenticated network client principal and determines if claim information is present. If claims aren't present, the file server will then use the Kerberos S4U2Self feature to attempt to contact a Windows Server 2012 domain controller in the client’s account domain and obtain a claims-enabled access token for the client principal. A claims-enabled token might be needed to access files or folders that have claim-based access control policy applied. @@ -64,13 +64,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings| Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings| Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -89,7 +89,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -None. Enabling this policy setting allows you to take advantage of features in Windows Server 2012 and Windows 8 and later for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 +None. Enabling this policy setting allows you to take advantage of features in Windows Server 2012 and Windows 8 and later for specific scenarios to use claims-enabled tokens to access files or folders that have claim-based access control policy applied on Windows operating systems prior to Windows Server 2012 and Windows 8. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md index 4685a285de..030123cf61 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md @@ -3,12 +3,12 @@ title: Microsoft network server Digitally sign communications (always) description: Best practices, security considerations, and more for the security policy setting, Microsoft network server Digitally sign communications (always). author: vinaypamnani-msft ms.author: vinpa -ms.reviewer: +ms.reviewer: manager: aaroncz ms.prod: windows-client ms.technology: itpro-security ms.localizationpriority: medium -ms.topic: conceptual +ms.topic: reference ms.date: 01/13/2023 --- diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md index c560912610..b7f738611b 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md @@ -1,8 +1,8 @@ --- -title: Microsoft network server Disconnect clients when sign-in hours expire +title: Microsoft network server Disconnect clients when sign-in hours expire description: Best practices, location, values, and security considerations for the policy setting, Microsoft network server Disconnect clients when sign-in hours expire. ms.assetid: 48b5c424-9ba8-416d-be7d-ccaabb3f49af -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,13 +55,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| | DC Effective Default Settings| Enabled | -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md index b0119771b5..c10cf64969 100644 --- a/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md +++ b/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md @@ -1,8 +1,8 @@ --- -title: Microsoft network server Server SPN target name validation level +title: Microsoft network server Server SPN target name validation level description: Best practices, security considerations, and more for the security policy setting, Microsoft network server Server SPN target name validation level. ms.assetid: 18337f78-eb45-42fd-bdbd-f8cd02c3e154 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,7 +54,7 @@ The default setting is Off. This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities. >**Note:**  All Windows operating systems support a client-side SMB component and a server-side SMB component. - + ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options @@ -65,13 +65,13 @@ The following table lists the actual and effective default values for this polic | Server type or Group Policy object (GPO) | Default value | | - | - | -| Default domain policy | Off | -| Default domain controller policy| Off| -| Stand-alone server default settings | Off| -| Domain controller effective default settings| Validation level check not implemented| -| Member server effective default settings | Validation level check not implemented| -| Effective GPO default settings on client computers | Validation level check not implemented| - +| Default domain policy | Off | +| Default domain controller policy| Off| +| Stand-alone server default settings | Off| +| Domain controller effective default settings| Validation level check not implemented| +| Member server effective default settings | Validation level check not implemented| +| Effective GPO default settings on client computers | Validation level check not implemented| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md index e42c7f62fc..67cf3aac2e 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md @@ -1,8 +1,8 @@ --- -title: Minimum password age +title: Minimum password age description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password age security policy setting. ms.assetid: 91915cb2-1b3f-4fb7-afa0-d03df95e8161 -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client @@ -13,7 +13,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 11/13/2018 ms.technology: itpro-security -ms.topic: conceptual +ms.topic: reference --- # Minimum password age @@ -35,15 +35,15 @@ The **Minimum password age** policy setting determines the period of time (in da ### Best practices -[Windows security baselines](../../operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md) recommend setting **Minimum password age** to one day. +[Windows security baselines](../../operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md) recommend setting **Minimum password age** to one day. -Setting the number of days to 0 allows immediate password changes. This setting isn't recommended. -Combining immediate password changes with password history allows someone to change a password repeatedly until the password history requirement is met and re-establish the original password again. -For example, suppose a password is "Ra1ny day!" and the history requirement is 24. -If the minimum password age is 0, the password can be changed 24 times in a row until finally changed back to "Ra1ny day!". +Setting the number of days to 0 allows immediate password changes. This setting isn't recommended. +Combining immediate password changes with password history allows someone to change a password repeatedly until the password history requirement is met and re-establish the original password again. +For example, suppose a password is "Ra1ny day!" and the history requirement is 24. +If the minimum password age is 0, the password can be changed 24 times in a row until finally changed back to "Ra1ny day!". The minimum password age of 1 day prevents that. -If you set a password for a user and you want that user to change the administrator-defined password, you must select the **User must change password at next logon** check box. +If you set a password for a user and you want that user to change the administrator-defined password, you must select the **User must change password at next logon** check box. Otherwise, the user won't be able to change the password until the number of days specified by **Minimum password age**. ### Location @@ -56,13 +56,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| 1 day| -| Default domain controller policy| Not defined| -| Stand-alone server default settings | 0 days| -| Domain controller effective default settings | 1 day| -| Member server effective default settings | 1 day| -| Effective GPO default settings on client computers| 1 day| - +| Default domain policy| 1 day| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | 0 days| +| Domain controller effective default settings | 1 day| +| Member server effective default settings | 1 day| +| Effective GPO default settings on client computers| 1 day| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md index 4ef50144bc..d264ff4033 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md @@ -1,8 +1,8 @@ --- -title: Minimum password length +title: Minimum password length description: Describes the best practices, location, values, policy management, and security considerations for the Minimum password length security policy setting. ms.assetid: 3d22eb9a-859a-4b6f-82f5-c270c427e17e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 03/30/2022 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md b/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md index 0fe460d50d..e3f1d6decd 100644 --- a/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md +++ b/windows/security/threat-protection/security-policy-settings/modify-an-object-label.md @@ -1,8 +1,8 @@ --- -title: Modify an object label +title: Modify an object label description: Describes the best practices, location, values, policy management, and security considerations for the Modify an object label security policy setting. ms.assetid: 3e5a97dd-d363-43a8-ae80-452e866ebfd5 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -29,7 +29,7 @@ Describes the best practices, location, values, policy management, and security This privilege determines which user accounts can modify the integrity label of objects, such as files, registry keys, or processes owned by other users. Processes running under a user account can modify the label of an object owned by that user to a lower level without this privilege. -The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although +The integrity label is used by the Windows Integrity Controls (WIC) feature, which was introduced in Windows Server 2008 and Windows Vista. WIC keeps lower integrity processes from modifying higher integrity processes by assigning one of six possible labels to objects on the system. Although similar to NTFS file and folder permissions, which are discretionary controls on objects, the WIC integrity levels are mandatory controls that are put in place and enforced by the operating system. The following list describes the integrity levels from lowest to highest: - **Untrusted**   Default assignment for processes that are logged on anonymously. @@ -62,13 +62,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -94,7 +94,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by +Anyone with the **Modify an object label** user right can change the integrity level of a file or process so that it becomes elevated or decreased to a point where it can be deleted by lower integrity processes. Either of these states effectively circumvents the protection that is offered by Windows Integrity Controls and makes your system vulnerable to attacks by malicious software. If malicious software is set with an elevated integrity level such as Trusted Installer or System, administrator accounts don't have sufficient integrity levels to delete the program from the system. In that case, use of the **Modify an object label** right is mandated so that the object can be relabeled. However, the relabeling must occur by using a process that is at the same or a higher level of integrity than the object that you're attempting to relabel. diff --git a/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md b/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md index faff714347..5a2d90eb2c 100644 --- a/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md +++ b/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values.md @@ -1,8 +1,8 @@ --- -title: Modify firmware environment values +title: Modify firmware environment values description: Describes the best practices, location, values, policy management, and security considerations for the Modify firmware environment values security policy setting. ms.assetid: 80bad5c4-d9eb-4e3a-a5dc-dcb742b83fca -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -61,13 +61,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO |Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Adminstrators| -| Stand-Alone Server Default Settings | Adminstrators| -| Domain Controller Effective Default Settings | Adminstrators| -| Member Server Effective Default Settings | Adminstrators| -| Client Computer Effective Default Settings | Adminstrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Adminstrators| +| Stand-Alone Server Default Settings | Adminstrators| +| Domain Controller Effective Default Settings | Adminstrators| +| Member Server Effective Default Settings | Adminstrators| +| Client Computer Effective Default Settings | Adminstrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md index 164da34ecf..16e357e6c1 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation.md @@ -1,8 +1,8 @@ --- -title: Network access Allow anonymous SID/Name translation +title: Network access Allow anonymous SID/Name translation description: Best practices, location, values, policy management and security considerations for the policy setting, Network access Allow anonymous SID/Name translation. ms.assetid: 0144477f-22a6-4d06-b70a-9c9c2196e99e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -59,13 +59,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Disabled| +| Client Computer Effective Default Settings | Disabled| + ### Operating system version differences The default value of this setting has changed between operating systems as follows: diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md index caccbb931a..9f3219cb41 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md @@ -1,8 +1,8 @@ --- -title: Network access Do not allow anonymous enumeration +title: Network access Do not allow anonymous enumeration description: Learn about best practices and more for the security policy setting, Network access Do not allow anonymous enumeration of SAM accounts and shares. ms.assetid: 3686788d-4cc7-4222-9163-cbc7c3362d73 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,13 +51,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md index 83888d29df..e737e440d1 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md @@ -1,8 +1,8 @@ --- -title: Network access Do not allow anonymous enumeration of SAM accounts +title: Network access Do not allow anonymous enumeration of SAM accounts description: Describes the best practices, location, values, and security considerations for the Network access Do not allow anonymous enumeration of SAM accounts security policy setting. ms.assetid: 6ee25b33-ad43-4097-b031-7be680f64c7c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| | Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md index 770a44407d..07e8b5d1cb 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md @@ -1,8 +1,8 @@ --- -title: Network access Do not allow storage of passwords and credentials for network authentication +title: Network access Do not allow storage of passwords and credentials for network authentication description: Learn about best practices and more for the security policy setting, Network access Do not allow storage of passwords and credentials for network authentication ms.assetid: b9b64360-36ea-40fa-b795-2d6558c46563 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 07/01/2021 ms.technology: itpro-security --- @@ -55,13 +55,13 @@ The following table lists the actual and effective default values for this polic | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy| Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings| Disabled| -| Member server effective default settings | Disabled| -| Effective GPO default settings on client computers |Disabled| - +| Default domain policy| Not defined| +| Default domain controller policy| Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings| Disabled| +| Member server effective default settings | Disabled| +| Effective GPO default settings on client computers |Disabled| + ### Policy management This section describes features and tools that are available to help you manage this policy. @@ -83,7 +83,7 @@ This section describes how an attacker might exploit a feature or its configurat Passwords that are cached can be accessed by the user when logged on to the device. Although this information may sound obvious, a problem can arise if the user unknowingly runs malicious software that reads the passwords and forwards them to another, unauthorized user. >**Note:**  The chances of success for this exploit and others that involve malicious software are reduced significantly for organizations that effectively implement and manage an enterprise antivirus solution combined with sensible software restriction policies. - + Regardless of what encryption algorithm is used to encrypt the password verifier, a password verifier can be overwritten so that an attacker can authenticate as the user to whom the verifier belongs. Therefore, the administrator's password may be overwritten. This procedure requires physical access to the device. Utilities exist that can help overwrite the cached verifier. With the help of one of these utilities, an attacker can authenticate by using the overwritten value. Overwriting the administrator's password doesn't help the attacker access data that is encrypted by using that password. Also, overwriting the password doesn't help the attacker access any Encrypting File System (EFS) data that belongs to other users on that device. Overwriting the password doesn't help an attacker replace the verifier, because the base keying material is incorrect. Therefore, data that is encrypted by using Encrypting File System or by using the Data Protection API (DPAPI) won't decrypt. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md b/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md index 618f7ffbc0..65f3d3d7c6 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md @@ -1,8 +1,8 @@ --- -title: Let Everyone permissions apply to anonymous users +title: Let Everyone permissions apply to anonymous users description: Learn about best practices, security considerations and more for the security policy setting, Network access Let Everyone permissions apply to anonymous users. ms.assetid: cdbc5159-9173-497e-b46b-7325f4256353 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md b/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md index 7a1acb165d..311f70c3ef 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md @@ -1,8 +1,8 @@ --- -title: Network access Named Pipes that can be accessed anonymously +title: Network access Named Pipes that can be accessed anonymously description: Describes best practices, security considerations and more for the security policy setting, Network access Named Pipes that can be accessed anonymously. ms.assetid: 8897d2a4-813e-4d2b-8518-fcee71e1cf2c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,13 +50,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined | -| Default Domain Controller Policy | Netlogon, samr, lsarpc| -| Stand-Alone Server Default Settings | Null| -| DC Effective Default Settings | Netlogon, samr, lsarpc| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy | Not defined | +| Default Domain Controller Policy | Netlogon, samr, lsarpc| +| Stand-Alone Server Default Settings | Null| +| DC Effective Default Settings | Netlogon, samr, lsarpc| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes different features and tools available to help you manage this policy. @@ -79,15 +79,15 @@ You can restrict access over named pipes such as COMNAP and LOCATOR to help prev | Named pipe | Purpose | | - | - | -| COMNAP | SNABase named pipe. Systems network Architecture (SNA) is a collection of network protocols that were originally developed for IBM mainframe computers.| -| COMNODE| SNA Server named pipe.| -| SQL\QUERY | Default named pipe for SQL Server.| -| SPOOLSS | Named pipe for the Print Spooler service.| -| EPMAPPER | End Point Mapper named pipe.| -| LOCATOR | Remote Procedure Call Locator service named pipe.| -| TrlWks | Distributed Link Tracking Client named pipe.| -| TrkSvr | Distributed Link Tracking Server named pipe.| - +| COMNAP | SNABase named pipe. Systems network Architecture (SNA) is a collection of network protocols that were originally developed for IBM mainframe computers.| +| COMNODE| SNA Server named pipe.| +| SQL\QUERY | Default named pipe for SQL Server.| +| SPOOLSS | Named pipe for the Print Spooler service.| +| EPMAPPER | End Point Mapper named pipe.| +| LOCATOR | Remote Procedure Call Locator service named pipe.| +| TrlWks | Distributed Link Tracking Client named pipe.| +| TrkSvr | Distributed Link Tracking Server named pipe.| + ### Countermeasure Configure the **Network access: Named Pipes that can be accessed anonymously** setting to a null value (enable the setting but don't specify named pipes in the text box). diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md index 9c968a3f5c..12988a2e90 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md @@ -1,8 +1,8 @@ --- -title: Network access Remotely accessible registry paths and subpaths +title: Network access Remotely accessible registry paths and subpaths description: Describes best practices, location, values, and security considerations for the policy setting, Network access Remotely accessible registry paths and subpaths. ms.assetid: 3fcbbf70-a002-4f85-8e86-8dabad21928e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -29,7 +29,7 @@ Describes the best practices, location, values, and security considerations for This policy setting determines which registry paths and subpaths are accessible when an application or process references the WinReg key to determine access permissions. -The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, +The registry is a database for device configuration information, much of which is sensitive. A malicious user can use it to facilitate unauthorized activities. The chance of this happening is reduced by the fact that the default ACLs that are assigned throughout the registry are fairly restrictive, and they help protect it from access by unauthorized users. To allow remote access, you must also enable the Remote Registry service. @@ -53,13 +53,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | See the following registry key combination| -| DC Effective Default Settings | See the following registry key combination| -| Member Server Effective Default Settings | See the following registry key combination| -| Client Computer Effective Default Settings | See the following registry key combination| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | See the following registry key combination| +| DC Effective Default Settings | See the following registry key combination| +| Member Server Effective Default Settings | See the following registry key combination| +| Client Computer Effective Default Settings | See the following registry key combination| + The combination of all the following registry keys apply to the previous settings: 1. System\\CurrentControlSet\\Control\\Print\\Printers @@ -99,7 +99,7 @@ Configure the **Network access: Remotely accessible registry paths and sub-paths Remote management tools such as MBSA and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail. >**Note:**  If you want to allow remote access, you must also enable the Remote Registry service. - + ## Related topics - [Security Options](security-options.md) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md index dd86f8a026..3a1924da9a 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths.md @@ -1,8 +1,8 @@ --- -title: Network access Remotely accessible registry paths +title: Network access Remotely accessible registry paths description: Best practices, location, values, policy management and security considerations for the policy setting, Network access Remotely accessible registry paths. ms.assetid: 977f86ea-864f-4f1b-9756-22220efce0bd -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | See the following registry key combination| -| DC Effective Default Settings | See the following registry key combination| -| Member Server Effective Default Settings | See the following registry key combination| -| Client Computer Effective Default Settings | See the following registry key combination| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | See the following registry key combination| +| DC Effective Default Settings | See the following registry key combination| +| Member Server Effective Default Settings | See the following registry key combination| +| Client Computer Effective Default Settings | See the following registry key combination| + The combination of all the following registry keys apply to the previous settings: 1. System\\CurrentControlSet\\Control\\ProductOptions @@ -90,7 +90,7 @@ Configure the **Network access: Remotely accessible registry paths** setting to Remote management tools such as the Microsoft Baseline Security Analyzer (MBSA) and Configuration Manager require remote access to the registry to properly monitor and manage those computers. If you remove the default registry paths from the list of accessible ones, such remote management tools could fail. >**Note:**  If you want to allow remote access, you must also enable the Remote Registry service. - + ## Related topics - [Security Options](security-options.md) diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md index 30cbc5b78f..e45ad66787 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md @@ -1,8 +1,8 @@ --- -title: Network access Restrict anonymous access to Named Pipes and Shares +title: Network access Restrict anonymous access to Named Pipes and Shares description: Best practices, security considerations, and more for the security policy setting, Network access Restrict anonymous access to Named Pipes and Shares. ms.assetid: e66cd708-7322-4d49-9b57-1bf8ec7a4c10 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -32,7 +32,7 @@ Describes the best practices, location, values, policy management and security c ## Reference -This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key +This policy setting enables or disables the restriction of anonymous access to only those shared folders and pipes that are named in the **Network access: Named pipes that can be accessed anonymously** and [Network access: Shares that can be accessed anonymously](network-access-shares-that-can-be-accessed-anonymously.md) settings. The setting controls null session access to shared folders on your computers by adding RestrictNullSessAccess with the value 1 in the registry key **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LanManServer\\Parameters**. This registry value toggles null session shared folders on or off to control whether the Server service restricts unauthenticated clients' access to named resources. Null sessions are a weakness that can be exploited through the various shared folders on the devices in your environment. @@ -57,13 +57,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings | Enabled| -| Client Computer Effective Default Settings| Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Enabled| +| Client Computer Effective Default Settings| Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md index 6b65885d98..587ae7e3a5 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -7,12 +7,12 @@ ms.localizationpriority: medium ms.date: 09/17/2018 author: vinaypamnani-msft ms.author: vinpa -ms.reviewer: +ms.reviewer: manager: aaroncz -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference --- # Network access: Restrict clients allowed to make remote calls to SAM diff --git a/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md b/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md index dc0a2dda77..57882060a6 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md @@ -1,8 +1,8 @@ --- -title: Network access Shares that can be accessed anonymously +title: Network access Shares that can be accessed anonymously description: Learn about best practices, security considerations, and more for the security policy setting, Network access Shares that can be accessed anonymously. ms.assetid: f3e4b919-8279-4972-b415-5f815e2f0a1a -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -48,13 +48,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| DC Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md b/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md index c11be07eab..9665aaaaf7 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md @@ -1,8 +1,8 @@ --- -title: Network access Sharing and security model for local accounts +title: Network access Sharing and security model for local accounts description: Best practices, security considerations, and more for the security policy setting, Network access Sharing and security model for local accounts. ms.assetid: 0b3d703c-ea27-488f-8f59-b345af75b994 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -31,7 +31,7 @@ This policy setting determines how network logons that use local accounts are au >**Note:**  This policy setting does not affect network logons that use domain accounts. Nor does this policy setting affect interactive logons that are performed remotely through services such as Telnet or Remote Desktop Services. When the device is not joined to a domain, this policy setting also tailors the **Sharing** and **Security** tabs in Windows Explorer to correspond to the sharing and security model that is being used. - + When the value of this policy setting is **Guest only - local users authenticate as Guest**, any user who can access your device over the network does so with Guest user rights. This privilege means that they'll probably be unable to write to shared folders. Although this restriction does increase security, it makes it impossible for authorized users to access shared resources on those systems. When the value is **Classic - local users authenticate as themselves**, local accounts must be password-protected; otherwise, anyone can use those user accounts to access shared system resources. ### Possible values @@ -55,13 +55,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Classic (local users authenticate as themselves)| -| DC Effective Default Settings | Classic (local users authenticate as themselves)| -| Member Server Effective Default Settings | Classic (local users authenticate as themselves)| -| Client Computer Effective Default Settings | Classic (local users authenticate as themselves)| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Classic (local users authenticate as themselves)| +| DC Effective Default Settings | Classic (local users authenticate as themselves)| +| Member Server Effective Default Settings | Classic (local users authenticate as themselves)| +| Client Computer Effective Default Settings | Classic (local users authenticate as themselves)| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md b/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md index a946a20ae9..04167671df 100644 --- a/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md +++ b/windows/security/threat-protection/security-policy-settings/network-list-manager-policies.md @@ -1,8 +1,8 @@ --- -title: Network List Manager policies +title: Network List Manager policies description: Network List Manager policies are security settings that configure different aspects of how networks are listed and displayed on one device or on many devices. ms.assetid: bd8109d4-b07c-4beb-a9a6-affae2ba2fda -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -36,7 +36,7 @@ The following policy settings are provided for Network List Manager Policies. Th ### Unidentified Networks -This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the +This policy setting allows you to configure the **Network Location**, including the location type and the user permissions, for networks that Windows cannot identify due to a network issue or a lack of identifiable characters in the network information received by the operating system from the network. A network location identifies the type of network that a computer is connected to and automatically sets the appropriate firewall settings for that location. You can configure the following items for this policy setting: - **Location type**. For this item, the following options are available: diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md index bdd1418a71..509602f606 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md @@ -2,7 +2,7 @@ title: "Network security: Allow Local System to use computer identity for NTLM (Windows 10)" description: Location, values, policy management, and security considerations for the policy setting, Network security Allow Local System to use computer identity for NTLM. ms.assetid: c46a658d-b7a4-4139-b7ea-b9268c240053 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 10/04/2021 ms.technology: itpro-security --- @@ -34,11 +34,11 @@ When a service connects with the device identity, signing and encryption are sup ### Possible values | Setting | Windows Server 2008 and Windows Vista | At least Windows Server 2008 R2 and Windows 7 | -| - | - | - | +| - | - | - | | Enabled | Services running as Local System that use Negotiate will use the computer identity. This value might cause some authentication requests between Windows operating systems to fail and log an error.| Services running as Local System that use Negotiate will use the computer identity. This behavior is the default behavior. | | Disabled| Services running as Local System that uses Negotiate when reverting to NTLM authentication will authenticate anonymously. This behavior is the default behavior.| Services running as Local System that uses Negotiate when reverting to NTLM authentication will authenticate anonymously.| -|Neither|Services running as Local System that uses Negotiate when reverting to NTLM authentication will authenticate anonymously. | Services running as Local System that uses Negotiate will use the computer identity. This behavior might cause some authentication requests between Windows operating systems to fail and log an error.| - +|Neither|Services running as Local System that uses Negotiate when reverting to NTLM authentication will authenticate anonymously. | Services running as Local System that uses Negotiate will use the computer identity. This behavior might cause some authentication requests between Windows operating systems to fail and log an error.| + ### Location Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options @@ -48,13 +48,13 @@ The following table lists the actual and effective default values for this polic | Server type or Group Policy object (GPO) | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not applicable| -| Member server effective default settings | Not applicable| -| Effective GPO default settings on client computers | Not defined| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not applicable| +| Member server effective default settings | Not applicable| +| Effective GPO default settings on client computers | Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md index fd87daba06..02d157f8db 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md @@ -1,8 +1,8 @@ --- -title: Network security Allow LocalSystem NULL session fallback +title: Network security Allow LocalSystem NULL session fallback description: Describes the best practices, location, values, and security considerations for the Network security Allow LocalSystem NULL session fallback security policy setting. ms.assetid: 5b72edaa-bec7-4572-b6f0-648fc38f5395 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -27,7 +27,7 @@ Describes the best practices, location, values, and security considerations for ## Reference -This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local +This policy affects session security during the authentication process between devices running Windows Server 2008 R2 and Windows 7 and later and those devices running earlier versions of the Windows operating system. For computers running Windows Server 2008 R2 and Windows 7 and later, services running as Local System require a service principal name (SPN) to generate the session key. However, if [Network security: Allow Local System to use computer identity for NTLM](network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) is set to disabled, services running as Local System will fall back to using NULL session authentication when they transmit data to servers running versions of Windows earlier than Windows Vista or Windows Server 2008. NULL session doesn't establish a unique session key for each authentication; and thus, it can't provide integrity or confidentiality protection. The setting **Network security: Allow LocalSystem NULL session fallback** determines whether services that request the use of session security are allowed to perform signature or encryption functions with a well-known key for application compatibility. ### Possible values @@ -38,7 +38,7 @@ System will fall back to using NULL session authentication when they transmit da - **Disabled** - When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a + When a service running as Local System connects with a NULL session, session security will be unavailable. Calls seeking encryption or signing will fail. This setting is more secure, but at the risk of degrading application incompatibility. Calls that are using the device identity instead of a NULL session will still have full use of session security. - Not defined. When this policy isn't defined, the default takes effect. This policy is Enabled for versions of the Windows operating system earlier than Windows Server 2008 R2 and Windows 7, and it's Disabled otherwise. @@ -57,13 +57,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not applicable| +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not applicable| | Member server effective default settings | Not applicable | -| Effective GPO default settings on client computers | Not applicable| - +| Effective GPO default settings on client computers | Not applicable| + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md index abc5d527cd..202d37d4e5 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md @@ -1,8 +1,8 @@ --- -title: Network security Allow PKU2U authentication requests to this computer to use online identities +title: Network security Allow PKU2U authentication requests to this computer to use online identities description: Best practices for the Network Security Allow PKU2U authentication requests to this computer to use online identities security setting. ms.assetid: e04a854e-d94d-4306-9fb3-56e9bd7bb926 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 01/03/2022 ms.technology: itpro-security --- @@ -33,7 +33,7 @@ When devices are configured to accept authentication requests by using online ID > [!NOTE] > Linking online IDs can be performed by anyone who has an account that has standard user’s credentials through Credential Manager. - + This policy isn't configured by default on domain-joined devices. This disablement would disallow the online identities to authenticate to domain-joined computers from Windows 7 up to Windows 10, Version 1607. This policy is enabled by default in Windows 10, Version 1607, and later. ### Possible values @@ -61,21 +61,21 @@ The following table lists the effective default values for this policy. Default | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Disabled| -| Member server effective default settings | Disabled| -| Effective GPO default settings on client computers prior to Windows 10, Version 1607 | Disabled| -| Effective GPO default settings on client computers Windows 10, Version 1607 and later| Enabled| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Disabled| +| Member server effective default settings | Disabled| +| Effective GPO default settings on client computers prior to Windows 10, Version 1607 | Disabled| +| Effective GPO default settings on client computers Windows 10, Version 1607 and later| Enabled| + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of the countermeasure. ### Vulnerability -Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft account or a Microsoft Entra account. That account can then sign in to a peer device (if the peer device is likewise configured) without the use of a Windows sign-in account (domain or local). This setup isn't only beneficial, but required for Microsoft Entra joined devices, where they're signed in with an online identity and are issued certificates by Microsoft Entra ID. This policy may not be relevant for an *on-premises only* environment and might circumvent established security policies. However, it doesn't pose any threats in a hybrid environment where Microsoft Entra ID is used as it relies on the user's online identity and Microsoft Entra ID to authenticate. +Enabling this policy setting allows a user’s account on one computer to be associated with an online identity, such as Microsoft account or a Microsoft Entra account. That account can then sign in to a peer device (if the peer device is likewise configured) without the use of a Windows sign-in account (domain or local). This setup isn't only beneficial, but required for Microsoft Entra joined devices, where they're signed in with an online identity and are issued certificates by Microsoft Entra ID. This policy may not be relevant for an *on-premises only* environment and might circumvent established security policies. However, it doesn't pose any threats in a hybrid environment where Microsoft Entra ID is used as it relies on the user's online identity and Microsoft Entra ID to authenticate. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md index 465adda6a7..5e1c37d2b4 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md @@ -1,16 +1,16 @@ --- title: Network security Configure encryption types allowed for Kerberos description: Best practices, location, values and security considerations for the policy setting, Network security Configure encryption types allowed for Kerberos Win7 only. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -32,7 +32,7 @@ For more information, see [KDC event ID 16 or 27 is logged if DES for Kerberos i The following table lists and explains the allowed encryption types. - + | Encryption type | Description and version support | | - | - | | DES_CBC_CRC | Data Encryption Standard with Cipher Block Chaining using the Cyclic Redundancy Check function
    Supported in Windows 2000 Server, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008. The Windows 7, Windows 10, Windows 11, Windows Server 2008 R2, and later operating systems don't support DES by default. | @@ -91,7 +91,7 @@ Don't configure this policy. This disablement will force the computers running W ### Potential impact If you don't select any of the encryption types, computers running Windows Server 2008 R2, Windows 7 and Windows 10, might have Kerberos authentication failures when connecting with computers running non-Windows versions of the Kerberos protocol. - + If you do select any encryption type, you'll lower the effectiveness of encryption for Kerberos authentication but you'll improve interoperability with computers running older versions of Windows. Contemporary non-Windows implementations of the Kerberos protocol support RC4 and AES 128-bit and AES 256-bit encryption. Most implementations, including the MIT Kerberos protocol and the Windows Kerberos protocol, are deprecating DES encryption. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md b/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md index 7402fd0df1..c708a656d1 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md @@ -1,8 +1,8 @@ --- -title: Network security Do not store LAN Manager hash value on next password change +title: Network security Do not store LAN Manager hash value on next password change description: Best practices, security considerations, and more for the security policy setting, Network security Do not store LAN Manager hash value on next password change. ms.assetid: 6452b268-e5ba-4889-9d38-db28f919af51 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings|Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings|Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md b/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md index 99826613ed..665eee915f 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md @@ -1,8 +1,8 @@ --- -title: Network security Force logoff when logon hours expire +title: Network security Force logoff when logon hours expire description: Best practices, location, values, policy management, and security considerations for the policy setting, Network security Force logoff when logon hours expire. ms.assetid: 64d5dde4-58e4-4217-b2c4-73bd554ec926 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Disabled| -| Default Domain Controller Policy| Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Disabled| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md b/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md index c6847770d4..57246a6f27 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level.md @@ -1,8 +1,8 @@ --- -title: Network security LAN Manager authentication level +title: Network security LAN Manager authentication level description: Best practices, location, values, policy management and security considerations for the policy setting, Network security LAN Manager authentication level. ms.assetid: bbe1a98c-420a-41e7-9d3c-3a2fe0f1843e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,18 +50,18 @@ LAN Manager authentication includes the LM, NTLM, and NTLMv2 variants, and it's - Send NTLMv2 responses only. Refuse LM & NTLM - Not Defined -The **Network security: LAN Manager authentication level** setting determines which challenge/response authentication protocol is used for network logons. This choice affects the authentication protocol level that clients use, the session security level that the computers negotiate, and the +The **Network security: LAN Manager authentication level** setting determines which challenge/response authentication protocol is used for network logons. This choice affects the authentication protocol level that clients use, the session security level that the computers negotiate, and the authentication level that servers accept. The following table identifies the policy settings, describes the setting, and identifies the security level used in the corresponding registry setting if you choose to use the registry to control this setting instead of the policy setting. | Setting | Description | Registry security level | | - | - | - | -| Send LM & NTLM responses | Client devices use LM and NTLM authentication, and they never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 0| -| Send LM & NTLM – use NTLMv2 session security if negotiated | Client devices use LM and NTLM authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 1| -| Send NTLM response only| Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 2| -| Send NTLMv2 response only | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 3| -| Send NTLMv2 response only. Refuse LM | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM authentication, and they'll accept only NTLM and NTLMv2 authentication.| 4| -| Send NTLMv2 response only. Refuse LM & NTLM | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM and NTLM authentication, and they'll accept only NTLMv2 authentication.| 5| - +| Send LM & NTLM responses | Client devices use LM and NTLM authentication, and they never use NTLMv2 session security. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 0| +| Send LM & NTLM – use NTLMv2 session security if negotiated | Client devices use LM and NTLM authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 1| +| Send NTLM response only| Client devices use NTLMv1 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 2| +| Send NTLMv2 response only | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers accept LM, NTLM, and NTLMv2 authentication.| 3| +| Send NTLMv2 response only. Refuse LM | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM authentication, and they'll accept only NTLM and NTLMv2 authentication.| 4| +| Send NTLMv2 response only. Refuse LM & NTLM | Client devices use NTLMv2 authentication, and they use NTLMv2 session security if the server supports it. Domain controllers refuse to accept LM and NTLM authentication, and they'll accept only NTLMv2 authentication.| 5| + ### Best practices - Best practices are dependent on your specific security and authentication requirements. @@ -80,13 +80,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Send NTLMv2 response only| -| DC Effective Default Settings | Send NTLMv2 response only| -| Member Server Effective Default Settings | Send NTLMv2 response only| -| Client Computer Effective Default Settings | Not defined| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Send NTLMv2 response only| +| DC Effective Default Settings | Send NTLMv2 response only| +| Member Server Effective Default Settings | Send NTLMv2 response only| +| Client Computer Effective Default Settings | Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md b/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md index 3232a699e0..2199e96b47 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements.md @@ -1,8 +1,8 @@ --- -title: Network security LDAP client signing requirements +title: Network security LDAP client signing requirements description: Best practices, location, values, policy management and security considerations for the policy setting, Network security LDAP client signing requirements. ms.assetid: 38b35489-eb5b-4035-bc87-df63de50509c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Negotiate signing| -| DC Effective Default Settings | Negotiate signing| -| Member Server Effective Default Settings | Negotiate signing| -| Client Computer Effective Default Settings | Negotiate signing| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Negotiate signing| +| DC Effective Default Settings | Negotiate signing| +| Member Server Effective Default Settings | Negotiate signing| +| Client Computer Effective Default Settings | Negotiate signing| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md index cd6838a4f8..5bda79521f 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md @@ -1,8 +1,8 @@ --- -title: Network security Minimum session security for NTLM SSP based (including secure RPC) clients +title: Network security Minimum session security for NTLM SSP based (including secure RPC) clients description: Best practices and more for the security policy setting, Network security Minimum session security for NTLM SSP based (including secure RPC) clients. ms.assetid: 89903de8-23d0-4e0f-9bef-c00cb7aebf00 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 07/27/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy| Not defined| -| Stand-Alone Server Default Settings | Require 128-bit encryption| -| DC Effective Default Settings | Require 128-bit encryption| -| Member Server Effective Default Settings | Require 128-bit encryption| -| Client Computer Effective Default Settings | Require 128-bit encryption| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Require 128-bit encryption| +| DC Effective Default Settings | Require 128-bit encryption| +| Member Server Effective Default Settings | Require 128-bit encryption| +| Client Computer Effective Default Settings | Require 128-bit encryption| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md index 701259d037..ebae59999d 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md @@ -1,8 +1,8 @@ --- -title: Network security Minimum session security for NTLM SSP based (including secure RPC) servers +title: Network security Minimum session security for NTLM SSP based (including secure RPC) servers description: Best practices and security considerations for the policy setting, Network security Minimum session security for NTLM SSP based (including secure RPC) servers. ms.assetid: c6a60c1b-bc8d-4d02-9481-f847a411b4fc -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -51,13 +51,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy| Not defined| -| Stand-Alone Server Default Settings | Require 128-bit encryption| -| DC Effective Default Settings | Require 128-bit encryption| -| Member Server Effective Default Settings | Require 128-bit encryption| -| Client Computer Effective Default Settings | Require 128-bit encryption| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Require 128-bit encryption| +| DC Effective Default Settings | Require 128-bit encryption| +| Member Server Effective Default Settings | Require 128-bit encryption| +| Client Computer Effective Default Settings | Require 128-bit encryption| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md index 754a7cbc0e..b0e28dc0b1 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md @@ -1,8 +1,8 @@ --- -title: Network security Restrict NTLM Add remote server exceptions for NTLM authentication +title: Network security Restrict NTLM Add remote server exceptions for NTLM authentication description: Best practices, security considerations, and more for the policy setting, Network security Restrict NTLM Add remote server exceptions for NTLM authentication. ms.assetid: 9b017399-0a54-4580-bfae-614c2beda3a1 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -59,13 +59,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings| Not defined| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings| Not defined| + ## Policy management This section describes the features and tools that are available to help you manage this policy. @@ -90,14 +90,14 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -When it has been determined that the NTLM authentication protocol shouldn't be used from a client device to any remote servers because you're required to use a more secure protocol such as Kerberos, there might be some client applications that still use NTLM. If so, and you set [Network Security: +When it has been determined that the NTLM authentication protocol shouldn't be used from a client device to any remote servers because you're required to use a more secure protocol such as Kerberos, there might be some client applications that still use NTLM. If so, and you set [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) to any of the deny options, those applications will fail because the outbound NTLM authentication traffic from the client computer will be blocked. If you define an exception list of servers to which client devices are allowed to use NTLM authentication, then NTLM authentication traffic will continue to flow between those client applications and servers. The servers then are vulnerable to any malicious attack that takes advantage of security weaknesses in NTLM. ### Countermeasure -When you use [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the remote +When you use [Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers](network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md) in audit-only mode, you can determine by reviewing which client applications are making NTLM authentication requests to the remote servers in your environment. When assessed, you'll have to determine on a case-by-case basis if NTLM authentication still minimally meets your security requirements. If not, the client application has to be upgraded to use something other than NTLM authentication. ### Potential impact diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md index c0ebdc1ba5..b6aa571487 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md @@ -1,8 +1,8 @@ --- -title: Network security Restrict NTLM Add server exceptions in this domain +title: Network security Restrict NTLM Add server exceptions in this domain description: Best practices, security considerations, and more for the security policy setting, Network security Restrict NTLM Add server exceptions in this domain. ms.assetid: 2f981b68-6aa7-4dd9-b53d-d88551277cc0 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -59,12 +59,12 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | | Default domain policy| Not defined | -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings | Not defined| - +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined| + ## Policy management This section describes different features and tools available to help you manage this policy. @@ -89,10 +89,10 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -When it has been determined that the NTLM authentication protocol shouldn't be used within a domain because you're required to use a more secure protocol such as Kerberos, there might be some NTLM authentication traffic that is still present in the domain. If so, and you set Network Security: +When it has been determined that the NTLM authentication protocol shouldn't be used within a domain because you're required to use a more secure protocol such as Kerberos, there might be some NTLM authentication traffic that is still present in the domain. If so, and you set Network Security: [Network Security: Restrict NTLM: NTLM authentication in this domain](network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md) to any of the deny options, any NTLM authentication request will fail because the pass-through member server will block the NTLM request. -If you define an exception list of servers in this domain to which client computers are allowed to use NTLM pass-through authentication, then NTLM authentication traffic will continue to flow between those servers, which make them vulnerable to any malicious attack that takes advantage of security +If you define an exception list of servers in this domain to which client computers are allowed to use NTLM pass-through authentication, then NTLM authentication traffic will continue to flow between those servers, which make them vulnerable to any malicious attack that takes advantage of security weaknesses in NTLM. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md index d5104ea5b7..c81152a791 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md @@ -1,8 +1,8 @@ --- -title: Network security Restrict NTLM Audit incoming NTLM traffic +title: Network security Restrict NTLM Audit incoming NTLM traffic description: Best practices, security considerations and more for the security policy setting, Network Security Restrict NTLM Audit incoming NTLM traffic. ms.assetid: 37e380c2-22e1-44cd-9993-e12815b845cf -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -33,7 +33,7 @@ When this audit policy is enabled within Group Policy, it's enforced on any serv When you enable this policy on a server, only authentication traffic to that server will be logged. -When you enable this audit policy, it functions in the same way as the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy, but it doesn't actually block any traffic. Therefore, you can use it effectively to understand the +When you enable this audit policy, it functions in the same way as the [Network Security: Restrict NTLM: Incoming NTLM traffic](network-security-restrict-ntlm-incoming-ntlm-traffic.md) policy, but it doesn't actually block any traffic. Therefore, you can use it effectively to understand the authentication traffic in your environment, and when you're ready to block that traffic, you can enable the Network Security: Restrict NTLM: Incoming NTLM traffic policy setting and select **Deny all accounts** or **Deny all domain accounts**. ### Possible values @@ -66,13 +66,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings | Not defined| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined| + ## Policy management This section describes different features and tools available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md index dbc99216c2..f79dd47f62 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md @@ -1,13 +1,13 @@ --- title: Network security Restrict NTLM Audit NTLM authentication in this domain description: Best practices, security considerations, and more for the security policy setting, Network Security Restrict NTLM Audit NTLM authentication in this domain. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -46,7 +46,7 @@ When you enable this audit policy, it functions in the same way as the **Network The domain controller will log events for NTLM authentication requests to all servers in the domain when NTLM authentication would be denied because the **Network security: Restrict NTLM: NTLM authentication in this domain** policy setting is set to **Deny for domain servers**. - **Enable all** - + The domain controller on which this policy is set will log all events for incoming NTLM traffic. ### Best practices @@ -61,13 +61,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings | Not defined| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined| + ## Policy management This section describes different features and tools available to help you manage this policy. @@ -90,7 +90,7 @@ There are no security audit event policies that can be configured to view output This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. -NTLM and NTLMv2 authentication is vulnerable to various malicious attacks, including SMB relay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the +NTLM and NTLMv2 authentication is vulnerable to various malicious attacks, including SMB relay, man-in-the-middle attacks, and brute force attacks. Reducing and eliminating NTLM authentication from your environment forces the Windows operating system to use more secure protocols, such as the Kerberos version 5 protocol, or different authentication mechanisms, such as smart cards. ### Vulnerability diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md index 3a547350da..5f964c33cc 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md @@ -1,8 +1,8 @@ --- -title: Network security Restrict NTLM Incoming NTLM traffic +title: Network security Restrict NTLM Incoming NTLM traffic description: Best practices, security considerations, and more for the security policy setting, Network Security Restrict NTLM Incoming NTLM traffic. ms.assetid: c0eff7d3-ed59-4004-908a-2205295fefb8 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -60,13 +60,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default domain policy| Not defined| +| Default domain policy| Not defined| | Default domain controller policy | Not defined | -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings | Not defined| - +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined| + ## Policy management This section describes different features and tools available to help you manage this policy. @@ -101,7 +101,7 @@ When it has been determined that the NTLM authentication protocol shouldn't be u ### Potential impact -If you configure this policy setting, numerous NTLM authentication requests could fail within your network, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit Incoming NTLM traffic** to the same option so that +If you configure this policy setting, numerous NTLM authentication requests could fail within your network, which could degrade productivity. Before implementing this change through this policy setting, set **Network security: Restrict NTLM: Audit Incoming NTLM traffic** to the same option so that you can review the log for the potential impact, perform an analysis of servers, and create an exception list of servers to exclude from this policy setting [Network security: Restrict NTLM: Add server exceptions in this domain](network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md). ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md index 61092a99fc..8b9e4f8973 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md @@ -1,13 +1,13 @@ --- title: Network security Restrict NTLM in this domain description: Learn about best practices, security considerations and more for the security policy setting, Network Security Restrict NTLM NTLM authentication in this domain. -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.technology: itpro-security ms.date: 12/31/2017 --- @@ -63,13 +63,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default domain policy| Not configured| -| Default domain controller policy | Not configured| +| Default domain policy| Not configured| +| Default domain controller policy | Not configured| | Stand-alone server default settings | Not configured| -| Domain controller effective default settings | Not configured| -| Member server effective default settings | Not configured | -| Client computer effective default settings | Not configured| - +| Domain controller effective default settings | Not configured| +| Member server effective default settings | Not configured | +| Client computer effective default settings | Not configured| + ## Policy management This section describes different features and tools available to help you manage this policy. @@ -100,7 +100,7 @@ Malicious attacks on NTLM authentication traffic resulting in a compromised serv ### Countermeasure -When it has been determined that the NTLM authentication protocol shouldn't be used within a network because you're required to use a more secure protocol such as the Kerberos protocol, then you can select one of several options that this security policy setting offers to restrict NTLM usage +When it has been determined that the NTLM authentication protocol shouldn't be used within a network because you're required to use a more secure protocol such as the Kerberos protocol, then you can select one of several options that this security policy setting offers to restrict NTLM usage within the domain. ### Potential impact diff --git a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md index 5aedc2eb5b..4869db61ec 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md @@ -1,8 +1,8 @@ --- -title: Network security Restrict NTLM Outgoing traffic +title: Network security Restrict NTLM Outgoing traffic description: Learn about best practices, security considerations and more for the policy setting, Network Security Restrict NTLM Outgoing NTLM traffic to remote servers. ms.assetid: 63437a90-764b-4f06-aed8-a4a26cf81bd1 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 06/15/2022 ms.technology: itpro-security --- @@ -34,7 +34,7 @@ Describes the best practices, location, values, management aspects, and security The **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote servers** policy setting allows you to deny or audit outgoing NTLM traffic from a computer running Windows 7, Windows Server 2008, or later to any remote server running the Windows operating system. >**Warning:**  Modifying this policy setting may affect compatibility with client computers, services, and applications. - + ### Possible values - **Allow all** @@ -65,13 +65,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not defined| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings | Not defined| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not defined| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not defined| + ## Policy management This section describes different features and tools available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index 34f17b6527..a00661af55 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -8,7 +8,7 @@ manager: aaroncz ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 06/07/2023 --- diff --git a/windows/security/threat-protection/security-policy-settings/password-policy.md b/windows/security/threat-protection/security-policy-settings/password-policy.md index 70396092e7..1d6e578b5c 100644 --- a/windows/security/threat-protection/security-policy-settings/password-policy.md +++ b/windows/security/threat-protection/security-policy-settings/password-policy.md @@ -1,8 +1,8 @@ --- -title: Password Policy +title: Password Policy description: An overview of password policies for Windows and links to information for each policy setting. ms.assetid: aec1220d-a875-4575-9050-f02f9c54a3b6 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,14 +50,14 @@ The following topics provide a discussion of password policy implementation and | Topic | Description | | - | - | -| [Enforce password history](enforce-password-history.md)| Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting.| -| [Maximum password age](maximum-password-age.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting.| -| [Minimum password age](minimum-password-age.md) | Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting.| -| [Minimum password length](minimum-password-length.md) | Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting.| +| [Enforce password history](enforce-password-history.md)| Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting.| +| [Maximum password age](maximum-password-age.md) | Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting.| +| [Minimum password age](minimum-password-age.md) | Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting.| +| [Minimum password length](minimum-password-length.md) | Describes the best practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting.| | [Password must meet complexity requirements](password-must-meet-complexity-requirements.md) | Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting.| -| [Store passwords using reversible encryption](store-passwords-using-reversible-encryption.md) | Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting.| - +| [Store passwords using reversible encryption](store-passwords-using-reversible-encryption.md) | Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting.| + ## Related topics - [Configure security policy settings](how-to-configure-security-policy-settings.md) - + diff --git a/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md b/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md index e74ff5c974..15ffdec99c 100644 --- a/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md +++ b/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks.md @@ -1,8 +1,8 @@ --- -title: Perform volume maintenance tasks +title: Perform volume maintenance tasks description: Describes the best practices, location, values, policy management, and security considerations for the Perform volume maintenance tasks security policy setting. ms.assetid: b6990813-3898-43e2-8221-c9c06d893244 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators| -| Stand-Alone Server Default Settings | Administrators| -| DC Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| DC Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/profile-single-process.md b/windows/security/threat-protection/security-policy-settings/profile-single-process.md index f77e48438c..2bdc87455f 100644 --- a/windows/security/threat-protection/security-policy-settings/profile-single-process.md +++ b/windows/security/threat-protection/security-policy-settings/profile-single-process.md @@ -1,8 +1,8 @@ --- -title: Profile single process +title: Profile single process description: Describes the best practices, location, values, policy management, and security considerations for the Profile single process security policy setting. ms.assetid: c0963de4-4f5e-430e-bfcd-dfd68e66a075 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators| -| Stand-Alone Server Default Settings | Administrators| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings| Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings| Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/profile-system-performance.md b/windows/security/threat-protection/security-policy-settings/profile-system-performance.md index 9c7b9de8c4..6be8f9269b 100644 --- a/windows/security/threat-protection/security-policy-settings/profile-system-performance.md +++ b/windows/security/threat-protection/security-policy-settings/profile-system-performance.md @@ -1,8 +1,8 @@ --- -title: Profile system performance +title: Profile system performance description: Best practices, location, values, policy management, and security considerations for the security policy setting, Profile system performance. ms.assetid: ffabc3c5-9206-4105-94ea-84f597a54b2e -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators| -| Stand-Alone Server Default Settings | Administrators| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md index 34e5e2b851..590b49f09b 100644 --- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md +++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md @@ -1,8 +1,8 @@ --- -title: Recovery console Allow automatic administrative logon +title: Recovery console Allow automatic administrative logon description: Best practices, location, values, policy management, and security considerations for the policy setting, Recovery console Allow automatic administrative logon. ms.assetid: be2498fc-48f4-43f3-ad09-74664e45e596 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -59,13 +59,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy| Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy| Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md index fdb56ca78e..08ca6beb3f 100644 --- a/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md +++ b/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md @@ -1,8 +1,8 @@ --- -title: Recovery console Allow floppy copy and access to all drives and folders +title: Recovery console Allow floppy copy and access to all drives and folders description: Best practices, security considerations, and more for the policy setting, Recovery console Allow floppy copy and access to all drives and folders. ms.assetid: a5b4ac0c-f33d-42b5-a866-72afa7cbd0bd -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md b/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md index c0f395231c..253213f2c1 100644 --- a/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md +++ b/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station.md @@ -1,8 +1,8 @@ --- -title: Remove computer from docking station - security policy setting +title: Remove computer from docking station - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Remove computer from docking station security policy setting. ms.assetid: 229a385a-a862-4973-899a-413b1b5b6c30 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -54,13 +54,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators| -| Stand-Alone Server Default Settings | Administrators| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md b/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md index 5079dab92d..d180d2acea 100644 --- a/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md +++ b/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token.md @@ -1,8 +1,8 @@ --- -title: Replace a process level token +title: Replace a process level token description: Describes the best practices, location, values, policy management, and security considerations for the Replace a process level token security policy setting. ms.assetid: 5add02db-6339-489e-ba21-ccc3ccbe8745 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| +| Default Domain Policy| Not defined| | Default Domain Controller Policy | Network Service
    Local Service | -| Stand-Alone Server Default Settings | Network Service
    Local Service| -| Domain Controller Effective Default Settings | Network Service
    Local Service| -| Member Server Effective Default Settings | Network Service
    Local Service| -| Client Computer Effective Default Settings | Network Service
    Local Service| - +| Stand-Alone Server Default Settings | Network Service
    Local Service| +| Domain Controller Effective Default Settings | Network Service
    Local Service| +| Member Server Effective Default Settings | Network Service
    Local Service| +| Client Computer Effective Default Settings | Network Service
    Local Service| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md index ec962f77e0..44c6716d50 100644 --- a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md +++ b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md @@ -1,8 +1,8 @@ --- -title: Reset account lockout counter after +title: Reset account lockout counter after description: Describes the best practices, location, values, and security considerations for the Reset account lockout counter after security policy setting. ms.assetid: d5ccf6dd-5ba7-44a9-8e0b-c478d8b1442c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 11/02/2018 ms.technology: itpro-security --- @@ -38,7 +38,7 @@ The disadvantage of a high setting is that users lock themselves out for an inco ### Best practices -Determine the threat level for your organization and balance that against the cost of your Help Desk support for password resets. Each organization will have specific requirements. +Determine the threat level for your organization and balance that against the cost of your Help Desk support for password resets. Each organization will have specific requirements. [Windows security baselines](../../operating-system-security/device-management/windows-security-configuration-framework/windows-security-baselines.md) recommend configuring the **Reset account lockout counter after** policy setting to 15, but as with other account lockout settings, this value is more of a guideline than a rule or best practice because there's no "one size fits all." For more information, see [Configuring Account Lockout](/archive/blogs/secguide/configuring-account-lockout). @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| Not defined| -| Default domain controller policy | Not defined| -| Stand-alone server default settings | Not applicable| -| Domain controller effective default settings | Not defined| -| Member server effective default settings | Not defined| -| Client computer effective default settings | Not applicable| - +| Default domain policy| Not defined| +| Default domain controller policy | Not defined| +| Stand-alone server default settings | Not applicable| +| Domain controller effective default settings | Not defined| +| Member server effective default settings | Not defined| +| Client computer effective default settings | Not applicable| + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. diff --git a/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md b/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md index ca2b72c717..f970ac8154 100644 --- a/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md +++ b/windows/security/threat-protection/security-policy-settings/restore-files-and-directories.md @@ -1,8 +1,8 @@ --- -title: Restore files and directories - security policy setting +title: Restore files and directories - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Restore files and directories security policy setting. ms.assetid: c673c0fa-6f49-4edd-8c1f-c5e8513f701d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -58,13 +58,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -|Default Domain Policy | | -| Default Domain Controller Policy| Administrators
    Backup Operators
    Server Operators| -| Stand-Alone Server Default Settings | Administrators
    Backup Operators| -| Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Server Operators| -| Member Server Effective Default Settings | Administrators
    Backup Operators| -| Client Computer Effective Default Settings | Administrators
    Backup Operators| - +|Default Domain Policy | | +| Default Domain Controller Policy| Administrators
    Backup Operators
    Server Operators| +| Stand-Alone Server Default Settings | Administrators
    Backup Operators| +| Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Server Operators| +| Member Server Effective Default Settings | Administrators
    Backup Operators| +| Client Computer Effective Default Settings | Administrators
    Backup Operators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -93,7 +93,7 @@ This section describes how an attacker might exploit a feature or its configurat An attacker with the **Restore files and directories** user right could restore sensitive data to a computer and overwrite data that is more recent, which could lead to loss of important data, data corruption, or a denial-of-service condition. Attackers could overwrite executable files that are used by legitimate administrators or system services with versions that include malicious software to grant themselves elevated privileges, compromise data, or install programs that provide continued access to the device >**Note:**  Even if the following countermeasure is configured, an attacker could restore data to a computer in a domain that is controlled by the attacker. Therefore, it is critical that organizations carefully protect the media that are used to back up data. - + ### Countermeasure Ensure that only the local Administrators group is assigned the **Restore files and directories** user right unless your organization has clearly defined roles for backup and for restore personnel. diff --git a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md index 7efca79530..78ea3fcb09 100644 --- a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md @@ -1,8 +1,8 @@ --- -title: Advanced security audit policy settings in brief +title: Advanced security audit policy settings in brief description: Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 6BF9A642-DBC3-4101-94A3-B2316C553CE3 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/security-options.md b/windows/security/threat-protection/security-policy-settings/security-options.md index 39d6b0489e..de522cb6d3 100644 --- a/windows/security/threat-protection/security-policy-settings/security-options.md +++ b/windows/security/threat-protection/security-policy-settings/security-options.md @@ -1,7 +1,7 @@ --- title: Security options description: Introduction to the Security Options settings of the local security policies plus links to more information. -ms.reviewer: +ms.reviewer: manager: aaroncz ms.author: vinpa ms.prod: windows-client @@ -9,7 +9,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft ms.date: 01/13/2023 ms.technology: itpro-security -ms.topic: conceptual +ms.topic: reference --- # Security Options diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md index 259ebfec01..9db7d59a20 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference.md @@ -1,8 +1,8 @@ --- -title: Security policy settings reference +title: Security policy settings reference description: This reference of security settings provides information about how to implement and manage security policies, including setting options and security considerations. ms.assetid: ef5a4579-15a8-4507-9a43-b7ccddcb0ed1 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -33,10 +33,10 @@ Each policy setting described contains referential content such as a detailed ex | Topic | Description | | - | - | -| [Account Policies](account-policies.md) | An overview of account policies in Windows and provides links to policy descriptions.| -| [Audit Policy](audit-policy.md) | Provides information about basic audit policies that are available in Windows and links to information about each setting.| -| [Security Options](security-options.md) | Provides an introduction to the settings under **Security Options** of the local security policies and links to information about each setting.| -| [Advanced security audit policy settings](secpol-advanced-security-audit-policy-settings.md) | Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate.| +| [Account Policies](account-policies.md) | An overview of account policies in Windows and provides links to policy descriptions.| +| [Audit Policy](audit-policy.md) | Provides information about basic audit policies that are available in Windows and links to information about each setting.| +| [Security Options](security-options.md) | Provides an introduction to the settings under **Security Options** of the local security policies and links to information about each setting.| +| [Advanced security audit policy settings](secpol-advanced-security-audit-policy-settings.md) | Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate.| | [User Rights Assignment](user-rights-assignment.md) | Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows.  | - - + + diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md index 397c3a1138..062aa06d3d 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md @@ -1,8 +1,8 @@ --- -title: Security policy settings +title: Security policy settings description: This reference topic describes the common scenarios, architecture, and processes for security settings. ms.assetid: e7ac5204-7f6c-4708-a9f6-6af712ca43b9 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md b/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md index f6a3fe8228..def26ab7ef 100644 --- a/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md +++ b/windows/security/threat-protection/security-policy-settings/shut-down-the-system.md @@ -1,8 +1,8 @@ --- -title: Shut down the system - security policy setting +title: Shut down the system - security policy setting description: Describes the best practices, location, values, policy management, and security considerations for the Shut down the system security policy setting. ms.assetid: c8e8f890-153a-401e-a957-ba6a130304bf -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -58,13 +58,13 @@ The following table lists the actual and effective default policy values for the | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| -| Default Domain Controller Policy | Administrators
    Backup Operators
    Server Operators
    Print Operators| -| Stand-Alone Server Default Settings | Administrators
    Backup Operators| -| Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Server Operators
    Print Operators| -| Member Server Effective Default Settings | Administrators
    Backup Operators| -| Client Computer Effective Default Settings | Administrators
    Backup Operators
    Users| - +| Default Domain Policy | Not defined| +| Default Domain Controller Policy | Administrators
    Backup Operators
    Server Operators
    Print Operators| +| Stand-Alone Server Default Settings | Administrators
    Backup Operators| +| Domain Controller Effective Default Settings | Administrators
    Backup Operators
    Server Operators
    Print Operators| +| Member Server Effective Default Settings | Administrators
    Backup Operators| +| Client Computer Effective Default Settings | Administrators
    Backup Operators
    Users| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md b/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md index a21dde7fda..672e91297b 100644 --- a/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md +++ b/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md @@ -1,8 +1,8 @@ --- -title: Shutdown Allow system to be shut down without having to log on +title: Shutdown Allow system to be shut down without having to log on description: Best practices, security considerations, and more for the security policy setting Shutdown Allow system to be shut down without having to log on. ms.assetid: f3964767-5377-4416-8eb3-e14d553a7315 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -29,7 +29,7 @@ Describes the best practices, location, values, policy management, and security This policy setting determines whether you can shut down a device without having to sign in to Windows. When you enable it, the **Shut Down** option is available on the sign-in screen in Windows. If you disable this setting, the **Shut Down** option is removed from the screen. To use the option, the user must sign in on the device successfully and have the **Shut down the system** user right. -Users who access the console locally can shut down the system. Attackers or misguided users can connect to the server by using Remote Desktop Services, and then shut it down or restart it without having to identify themselves. A malicious user might also cause a temporary denial-of-service +Users who access the console locally can shut down the system. Attackers or misguided users can connect to the server by using Remote Desktop Services, and then shut it down or restart it without having to identify themselves. A malicious user might also cause a temporary denial-of-service condition from a local console by restarting or shutting down the server. ### Possible values @@ -59,13 +59,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md b/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md index 7c6df9fb82..b40140dc0f 100644 --- a/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md +++ b/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md @@ -1,8 +1,8 @@ --- -title: Shutdown Clear virtual memory pagefile +title: Shutdown Clear virtual memory pagefile description: Describes the best practices, location, values, policy management and security considerations for the Shutdown Clear virtual memory pagefile security policy setting. ms.assetid: 31400078-6c56-4891-a6df-6dfb403c4bc9 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,12 +12,12 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 08/01/2017 ms.technology: itpro-security --- -# Shutdown: Clear virtual memory pagefile +# Shutdown: Clear virtual memory pagefile **Applies to** - Windows 11 @@ -54,13 +54,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -78,7 +78,7 @@ This section describes how an attacker might exploit a feature or its configurat Important information that is kept in real memory may be written periodically to the paging file to help Windows handle multitasking functions. An attacker who has physical access to a server that has been shut down could view the contents of the paging file. The attacker could move the system volume into a different device and then analyze the contents of the paging file. Although this process is time consuming, it could expose data that is cached from random access memory (RAM) to the paging file. >**Caution:**  An attacker who has physical access to the device could bypass this countermeasure by unplugging the computer from its power source. - + ### Countermeasure Enable the **Shutdown: Clear virtual memory page file** setting. This configuration causes the operating system to clear the paging file when the device is shut down. The amount of time that is required to complete this process depends on the size of the page file. Because the process overwrites the storage area that is used by the page file several times, it could be several minutes before the device completely shuts down. diff --git a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md index adb43f0fea..6b4584688f 100644 --- a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md +++ b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md @@ -1,8 +1,8 @@ --- -title: Store passwords using reversible encryption +title: Store passwords using reversible encryption description: Describes the best practices, location, values, and security considerations for the Store passwords using reversible encryption security policy setting. ms.assetid: 57f958c2-f1e9-48bf-871b-0a9b3299e238 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -29,7 +29,7 @@ Describes the best practices, location, values, and security considerations for The **Store password using reversible encryption** policy setting provides support for applications that use protocols that require the user's password for authentication. Storing encrypted passwords in a way that is reversible means that the encrypted passwords can be decrypted. A knowledgeable attacker who is able to break this encryption can then sign in to network resources by using the compromised account. For this reason, never enable **Store password using reversible encryption** for all users in the domain unless application requirements outweigh the need to protect password information. -If you use the Challenge Handshake Authentication Protocol (CHAP) through remote access or Internet Authentication Services (IAS), you must enable this policy setting. CHAP is an authentication protocol that is used by remote access and network connections. Digest Authentication in Internet +If you use the Challenge Handshake Authentication Protocol (CHAP) through remote access or Internet Authentication Services (IAS), you must enable this policy setting. CHAP is an authentication protocol that is used by remote access and network connections. Digest Authentication in Internet Information Services (IIS) also requires that you enable this policy setting. ### Possible values @@ -42,7 +42,7 @@ Information Services (IIS) also requires that you enable this policy setting. Set the value for **Store password using reversible encryption** to Disabled. If you use CHAP through remote access or IAS, or Digest Authentication in IIS, you must set this value to **Enabled**. This setting presents a security risk when you apply the setting by using Group Policy on a user-by-user basis because it requires opening the appropriate user account object in Active Directory Users and Computers. >**Note:**  Do not enable this policy setting unless business requirements outweigh the need to protect password information. - + ### Location **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** @@ -53,13 +53,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or Group Policy Object (GPO) | Default value | | - | - | -| Default domain policy| Disabled| -| Default domain controller policy| Disabled| -| Stand-alone server default settings | Disabled| -| Domain controller effective default settings | Disabled| -| Member server effective default settings | Disabled| -| Effective GPO default settings on client computers | Disabled| - +| Default domain policy| Disabled| +| Default domain controller policy| Disabled| +| Stand-alone server default settings | Disabled| +| Domain controller effective default settings | Disabled| +| Member server effective default settings | Disabled| +| Effective GPO default settings on client computers | Disabled| + ## Security considerations This section describes how an attacker might exploit a feature or its configuration, how to implement the countermeasure, and the possible negative consequences of countermeasure implementation. diff --git a/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md b/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md index 3949729b08..6744567fe3 100644 --- a/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md +++ b/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data.md @@ -1,8 +1,8 @@ --- -title: Synchronize directory service data +title: Synchronize directory service data description: Describes the best practices, location, values, policy management, and security considerations for the Synchronize directory service data security policy setting. ms.assetid: 97b0aaa4-674f-40f4-8974-b4bfb12c232c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| Domain Controller Effective Default Settings | Enabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| Domain Controller Effective Default Settings | Enabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md b/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md index ce8f451033..597b9027a0 100644 --- a/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md +++ b/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md @@ -1,8 +1,8 @@ --- -title: System cryptography Force strong key protection for user keys stored on the computer +title: System cryptography Force strong key protection for user keys stored on the computer description: Best practices, security considerations, and more for the policy setting, System cryptography Force strong key protection for user keys stored on the computer. ms.assetid: 8cbff267-881e-4bf6-920d-b583a5ff7de0 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -52,13 +52,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Not defined| -| DC Effective Default Settings | Not defined| -| Member Server Effective Default Settings | Not defined| -| Client Computer Effective Default Settings| Not defined| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Not defined| +| DC Effective Default Settings | Not defined| +| Member Server Effective Default Settings | Not defined| +| Client Computer Effective Default Settings| Not defined| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md b/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md index 2d223e79b3..d660ac1952 100644 --- a/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md +++ b/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md @@ -1,8 +1,8 @@ --- -title: System cryptography Use FIPS compliant algorithms for encryption, hashing, and signing +title: System cryptography Use FIPS compliant algorithms for encryption, hashing, and signing description: Best practices, security considerations, and more for the policy setting System cryptography Use FIPS compliant algorithms for encryption, hashing, and signing ms.assetid: 83988865-dc0f-45eb-90d1-ee33495eb045 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 11/16/2018 ms.technology: itpro-security --- @@ -27,12 +27,12 @@ This security policy reference topic for the IT professional describes the best ## Reference -The Federal Information Processing Standard (FIPS) 140 is a security implementation that is designed for certifying cryptographic software. Windows implements these certified algorithms to meet the requirements and standards for cryptographic modules for use by departments and agencies of the +The Federal Information Processing Standard (FIPS) 140 is a security implementation that is designed for certifying cryptographic software. Windows implements these certified algorithms to meet the requirements and standards for cryptographic modules for use by departments and agencies of the United States federal government. **TLS/SSL** -This policy setting determines whether the TLS/SSL security provider supports only the FIPS-compliant strong cipher suite known as TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, which means that the provider only supports the TLS protocol as a client computer and as a server, if applicable. It uses only the +This policy setting determines whether the TLS/SSL security provider supports only the FIPS-compliant strong cipher suite known as TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA, which means that the provider only supports the TLS protocol as a client computer and as a server, if applicable. It uses only the Triple Data Encryption Standard (3DES) encryption algorithm for the TLS traffic encryption, only the Rivest-Shamir-Adleman (RSA) public key algorithm for the TLS key exchange and authentication, and only the Secure Hash Algorithm version 1 (SHA-1) hashing algorithm for the TLS hashing requirements. **Encrypting File System (EFS)** @@ -71,13 +71,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ### Operating system version differences When this setting is enabled, the Encrypting File System (EFS) service supports only the Triple DES encryption algorithm for encrypting file data. By default, the Windows Vista and the Windows Server 2003 implementation of EFS uses the Advanced Encryption Standard (AES) with a 256-bit key. The Windows XP implementation uses DESX. @@ -86,11 +86,11 @@ When this setting is enabled, BitLocker generates recovery password or recovery | Operating systems | Applicability | | - | - | -| Windows 10, Windows 8.1, and Windows Server 2012 R2| When created on these operating systems, the recovery password can't be used on other systems listed in this table.| -| Windows Server 2012 and Windows 8 | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| -| Windows Server 2008 R2 and Windows 7 | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| -| Windows Server 2008 and Windows Vista | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| - +| Windows 10, Windows 8.1, and Windows Server 2012 R2| When created on these operating systems, the recovery password can't be used on other systems listed in this table.| +| Windows Server 2012 and Windows 8 | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| +| Windows Server 2008 R2 and Windows 7 | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| +| Windows Server 2008 and Windows Vista | When created on these operating systems, the recovery key can be used on other systems listed in this table as well.| + ## Policy management This section describes features and tools that are available to help you manage this policy. @@ -117,7 +117,7 @@ Enable the **System cryptography: Use FIPS compliant algorithms for encryption, ### Potential impact -Client devices that have this policy setting enabled can't communicate through digitally encrypted or signed protocols with servers that don't support these algorithms. Network clients that don't support these algorithms can't use servers that require them for network communications. For example, many Apache-based Web servers aren't configured to support TLS. If you enable this setting, you must also configure Internet Explorer® to use TLS. This policy setting also affects the encryption level that is used for the Remote Desktop Protocol (RDP). The Remote Desktop Connection tool +Client devices that have this policy setting enabled can't communicate through digitally encrypted or signed protocols with servers that don't support these algorithms. Network clients that don't support these algorithms can't use servers that require them for network communications. For example, many Apache-based Web servers aren't configured to support TLS. If you enable this setting, you must also configure Internet Explorer® to use TLS. This policy setting also affects the encryption level that is used for the Remote Desktop Protocol (RDP). The Remote Desktop Connection tool uses the RDP protocol to communicate with servers that run Terminal Services and client computers that are configured for remote control; RDP connections fail if both devices aren't configured to use the same encryption algorithms. ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md b/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md index ae93fe4482..3694fe2434 100644 --- a/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md +++ b/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md @@ -1,8 +1,8 @@ --- -title: System objects Require case insensitivity for non-Windows subsystems +title: System objects Require case insensitivity for non-Windows subsystems description: Best practices, security considerations and more for the security policy setting, System objects Require case insensitivity for non-Windows subsystems. ms.assetid: 340d6769-8f33-4067-8470-1458978d1522 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -57,13 +57,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md b/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md index 74bf9dee10..8358279b2d 100644 --- a/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md +++ b/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md @@ -1,8 +1,8 @@ --- -title: System objects Strengthen default permissions of internal system objects (for example, Symbolic Links) +title: System objects Strengthen default permissions of internal system objects (for example, Symbolic Links) description: Best practices and more for the security policy setting, System objects Strengthen default permissions of internal system objects (for example, Symbolic Links). ms.assetid: 3a592097-9cf5-4fd0-a504-7cbfab050bb6 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -49,13 +49,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| | Stand-Alone Server Default Settings | Enabled | -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md b/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md index af54bf48ab..ef7ca4315a 100644 --- a/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md +++ b/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems.md @@ -1,8 +1,8 @@ --- -title: System settings Optional subsystems +title: System settings Optional subsystems description: Describes the best practices, location, values, policy management, and security considerations for the System settings Optional subsystems security policy setting. ms.assetid: 5cb6519a-4f84-4b45-8072-e2aa8a72fb78 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -50,13 +50,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | POSIX| -| DC Effective Default Settings | POSIX| -| Member Server Effective Default Settings| POSIX| -| Client Computer Effective Default Settings | POSIX| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | POSIX| +| DC Effective Default Settings | POSIX| +| Member Server Effective Default Settings| POSIX| +| Client Computer Effective Default Settings | POSIX| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md b/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md index 81fce5ee99..fee999b57a 100644 --- a/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md +++ b/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md @@ -1,8 +1,8 @@ --- -title: System settings Use certificate rules on Windows executables for Software Restriction Policies +title: System settings Use certificate rules on Windows executables for Software Restriction Policies description: Best practices and more for the security policy setting, System settings Use certificate rules on Windows executables for Software Restriction Policies. ms.assetid: 2380d93b-b553-4e56-a0c0-d1ef740d089c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -37,7 +37,7 @@ This policy setting determines whether digital certificates are processed when s ### Best practices -- Set this policy to **Enabled**. Enabling certificate rules results in software restriction policies checking a certificate revocation list (CRL) to make sure that the software's certificate and signature are valid. When you start signed programs, this setting can decrease system performance. +- Set this policy to **Enabled**. Enabling certificate rules results in software restriction policies checking a certificate revocation list (CRL) to make sure that the software's certificate and signature are valid. When you start signed programs, this setting can decrease system performance. You can disable CRLs by editing the software restriction policies in the desired GPO. In the **Trusted Publishers Properties** dialog box, clear the **Publisher** and **Timestamp** check boxes. ### Location @@ -50,13 +50,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| | Stand-Alone Server Default Settings | Disabled | -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md b/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md index 179d04747b..39152767a9 100644 --- a/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md +++ b/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects.md @@ -1,8 +1,8 @@ --- -title: Take ownership of files or other objects +title: Take ownership of files or other objects description: Describes the best practices, location, values, policy management, and security considerations for the Take ownership of files or other objects security policy setting. ms.assetid: cb8595d1-74cc-4176-bb15-d97663eebb2d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default policy values. Defaul | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Administrators| -| Stand-Alone Server Default Settings | Administrators| -| Domain Controller Effective Default Settings | Administrators| -| Member Server Effective Default Settings | Administrators| -| Client Computer Effective Default Settings | Administrators| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Administrators| +| Stand-Alone Server Default Settings | Administrators| +| Domain Controller Effective Default Settings | Administrators| +| Member Server Effective Default Settings | Administrators| +| Client Computer Effective Default Settings | Administrators| + ## Policy management This section describes features, tools, and guidance to help you manage this policy. @@ -100,7 +100,7 @@ This section describes how an attacker might exploit a feature or its configurat ### Vulnerability -Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a +Any users with the **Take ownership of files or other objects user right** can take control of any object, regardless of the permissions on that object, and then make any changes that they want to make to that object. Such changes could result in exposure of data, corruption of data, or a denial-of-service condition. ### Countermeasure diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md b/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md index d4b0a95f6a..58989112e3 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md @@ -1,8 +1,8 @@ --- -title: User Account Control Admin Approval Mode for the Built-in Administrator account +title: User Account Control Admin Approval Mode for the Built-in Administrator account description: Best practices, security considerations, and more for the policy setting, User Account Control Admin Approval Mode for the Built-in Administrator account. ms.assetid: d465fc27-1cd2-498b-9cf6-7ad2276e5998 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/08/2017 ms.technology: itpro-security --- @@ -31,7 +31,7 @@ When the Admin Approval Mode is enabled, the local administrator account functio > [!NOTE] > If a computer is upgraded from a previous version of the Windows operating system, and the administrator account is the only account on the computer, the built-in administrator account remains enabled, and this setting is also enabled. - + ### Possible values - Enabled @@ -49,7 +49,7 @@ When the Admin Approval Mode is enabled, the local administrator account functio To enable Admin Approval Mode, you must also configure the local security policy setting: [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode) to **Prompt for consent on the secure desktop** and then click OK. > [!NOTE] -> After enabling Admin Approval Mode, to activate the setting, you must first log in and out. Alternatively, You may perform **gpupdate /force** from an elevated command prompt. +> After enabling Admin Approval Mode, to activate the setting, you must first log in and out. Alternatively, You may perform **gpupdate /force** from an elevated command prompt. ### Location @@ -62,12 +62,12 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | | Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md b/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md index 4d0f0eac5b..eb9a42ffeb 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md @@ -1,8 +1,8 @@ --- -title: User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop +title: User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop description: Best practices and more for the policy setting, User Account Control Allow UIAccess applications to prompt for elevation without using the secure desktop. ms.assetid: fce20472-3c93-449d-b520-13c4c74a9892 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -30,7 +30,7 @@ Describes the best practices, location, values, and security considerations for This security setting controls whether User Interface Accessibility (UIAccess or UIA) programs can automatically disable the secure desktop for elevation prompts used by a standard user. >**Note:**  This setting does not change the behavior of the UAC elevation prompt for administrators. - + **Background** User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI doesn't interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. @@ -39,7 +39,7 @@ Microsoft UI Automation is the current model to support accessibility requiremen However, there might be times when an administrative user runs an application with elevated privilege based on UAC in Admin Approval Mode. Microsoft UI Automation can't drive the UI graphics of elevated applications on the desktop without the ability to bypass the restrictions that UIPI implements. The ability to bypass UIPI restrictions across privilege levels is available for UI automation programs by using UIAccess. -If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy +If an application presents a UIAccess attribute when it requests privileges, the application is stating a requirement to bypass UIPI restrictions for sending messages across privilege levels. Devices implement the following policy checks before starting an application with UIAccess privilege. 1. The application must have a digital signature that can be verified by using a digital certificate that is associated with the Trusted Root Certification Authorities store on the local computer. @@ -78,13 +78,13 @@ The following table lists the actual and effective default values for this polic Server type or GPO| Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md index b5175062ac..8acd28314d 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md @@ -1,8 +1,8 @@ --- -title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode +title: User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode description: Best practices and more for the security policy setting, User Account Control Behavior of the elevation prompt for administrators in Admin Approval Mode. ms.assetid: 46a3c3a2-1d2e-4a6f-b5e6-29f9592f535d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 09/08/2017 ms.technology: itpro-security --- @@ -36,7 +36,7 @@ This policy setting determines the behavior of the elevation prompt for accounts Assumes that the administrator will permit an operation that requires elevation, and more consent or credentials aren't required. **Note**  Selecting **Elevate without prompting** minimizes the protection that is provided by UAC. We don't recommend selecting this value unless administrator accounts are tightly controlled and the operating environment is highly secure. - + - **Prompt for credentials on the secure desktop** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a privileged user name and password. If the user enters valid credentials, the operation continues with the user's highest available privilege. @@ -60,7 +60,7 @@ This policy setting determines the behavior of the elevation prompt for accounts \*If you've enabled the built-in Administrator account and have configured Admin Approval Mode, you must also configure the option **Prompt for consent on the secure desktop**. You can also configure this option from User Account Control, by typing **UAC** in the search box. From the User Account Control Settings dialog box, set the slider control to **Notify me only when apps try to make changes to my computer (default)**. > [!NOTE] -> After enabling Admin Approval Mode, to activate the setting, you must first log in and out. Alternatively, You may perform **gpupdate /force** from an elevated command prompt. +> After enabling Admin Approval Mode, to activate the setting, you must first log in and out. Alternatively, You may perform **gpupdate /force** from an elevated command prompt. ### Best practices @@ -77,13 +77,13 @@ Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Sec | Server type or GPO | Default value | | - | - | -| Default Domain Policy | Not defined| +| Default Domain Policy | Not defined| | Default Domain Controller Policy | Not defined | -| Stand-Alone Server Default Settings | Prompt for consent for non-Windows binaries| -| DC Effective Default Settings | Prompt for consent for non-Windows binaries| -| Member Server Effective Default Settings | Prompt for consent for non-Windows binaries| -| Client Computer Effective Default Settings | Prompt for consent for non-Windows binaries| - +| Stand-Alone Server Default Settings | Prompt for consent for non-Windows binaries| +| DC Effective Default Settings | Prompt for consent for non-Windows binaries| +| Member Server Effective Default Settings | Prompt for consent for non-Windows binaries| +| Client Computer Effective Default Settings | Prompt for consent for non-Windows binaries| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md index 1d3ea2ed65..6a471c51bb 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md @@ -5,7 +5,7 @@ ms.author: vinpa ms.prod: windows-client author: vinaypamnani-msft manager: aaroncz -ms.topic: conceptual +ms.topic: reference ms.date: 01/18/2023 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md b/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md index b18e302adf..ea22f7f177 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md @@ -1,8 +1,8 @@ --- -title: User Account Control Detect application installations and prompt for elevation +title: User Account Control Detect application installations and prompt for elevation description: Learn about best practices and more for the security policy setting, User Account Control Detect application installations and prompt for elevation. ms.assetid: 3f8cb170-ba77-4c9f-abb3-c3ed1ef264fc -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -55,13 +55,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md index e7e8643f8e..92d124a4f7 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md @@ -1,8 +1,8 @@ --- -title: User Account Control Only elevate executables that are signed and validated +title: User Account Control Only elevate executables that are signed and validated description: Best practices, security considerations, and more for the security policy setting, User Account Control Only elevate executables that are signed and validated. ms.assetid: 64950a95-6985-4db6-9905-1db18557352d -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -58,13 +58,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Disabled| -| DC Effective Default Settings | Disabled| -| Member Server Effective Default Settings | Disabled| -| Client Computer Effective Default Settings | Disabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Disabled| +| DC Effective Default Settings | Disabled| +| Member Server Effective Default Settings | Disabled| +| Client Computer Effective Default Settings | Disabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md index 564d86f514..4aad366985 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md @@ -1,8 +1,8 @@ --- -title: Only elevate UIAccess app installed in secure location +title: Only elevate UIAccess app installed in secure location description: Learn about best practices and more for the policy setting, User Account Control Only elevate UIAccess applications that are installed in secure locations. ms.assetid: 4333409e-a5be-4f2f-8808-618f53abd22c -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -34,7 +34,7 @@ This policy setting enforces the requirement that apps that request running with - \\Program Files (x86)\\ including subdirectories for 64-bit versions of Windows >**Note:**  Windows enforces a PKI signature check on any interactive application that requests running with a UIAccess integrity level, regardless of the state of this security setting. - + **Background** User Interface Privilege Isolation (UIPI) implements restrictions in the Windows subsystem that prevent lower-privilege applications from sending messages or installing hooks in higher-privilege processes. Higher-privilege applications are permitted to send messages to lower-privilege processes. UIPI doesn't interfere with or change the behavior of messages between applications at the same privilege (or integrity) level. @@ -75,13 +75,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md index 8502ded0f0..97d8752204 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md b/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md index 90d853997d..9059607fe2 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md @@ -1,8 +1,8 @@ --- -title: User Account Control Switch to the secure desktop when prompting for elevation +title: User Account Control Switch to the secure desktop when prompting for elevation description: Best practices, security considerations, and more for the policy setting, User Account Control Switch to the secure desktop when prompting for elevation. ms.assetid: 77a067db-c70d-4b02-9861-027503311b8b -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -45,7 +45,7 @@ The secure desktop’s primary difference from the user desktop is that only tru ### Best practices -- Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system +- Enable the **User Account Control: Switch to the secure desktop when prompting for elevation setting**. The secure desktop helps protect against input and output spoofing by presenting the credentials dialog box in a protected section of memory that is accessible only by trusted system processes. ### Location @@ -58,13 +58,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value | | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md b/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md index e7bf8758a8..adb9f83c7e 100644 --- a/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md +++ b/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md @@ -1,8 +1,8 @@ --- -title: User Account Control Virtualize file and registry write failures to per-user locations +title: User Account Control Virtualize file and registry write failures to per-user locations description: Best practices, security considerations and more for the policy setting, User Account Control Virtualize file and registry write failures to per-user locations. ms.assetid: a7b47420-cc41-4b1c-b03e-f67a05221261 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,7 +12,7 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.topic: conceptual +ms.topic: reference ms.date: 04/19/2017 ms.technology: itpro-security --- @@ -56,13 +56,13 @@ The following table lists the actual and effective default values for this polic | Server type or GPO | Default value| | - | - | -| Default Domain Policy| Not defined| -| Default Domain Controller Policy | Not defined| -| Stand-Alone Server Default Settings | Enabled| -| DC Effective Default Settings | Enabled| -| Member Server Effective Default Settings| Enabled| -| Client Computer Effective Default Settings | Enabled| - +| Default Domain Policy| Not defined| +| Default Domain Controller Policy | Not defined| +| Stand-Alone Server Default Settings | Enabled| +| DC Effective Default Settings | Enabled| +| Member Server Effective Default Settings| Enabled| +| Client Computer Effective Default Settings | Enabled| + ## Policy management This section describes features and tools that are available to help you manage this policy. diff --git a/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md b/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md index 17f39e5b1f..3ca31c4fe8 100644 --- a/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md +++ b/windows/security/threat-protection/security-policy-settings/user-rights-assignment.md @@ -1,8 +1,8 @@ --- -title: User Rights Assignment +title: User Rights Assignment description: Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. ms.assetid: 99340252-60be-4c79-b0a5-56fbe1a9b0c5 -ms.reviewer: +ms.reviewer: ms.author: vinpa ms.prod: windows-client ms.mktglfcycl: deploy @@ -12,10 +12,10 @@ ms.localizationpriority: medium author: vinaypamnani-msft manager: aaroncz audience: ITPro -ms.collection: +ms.collection: - highpri - tier3 -ms.topic: conceptual +ms.topic: reference ms.date: 12/16/2021 ms.technology: itpro-security --- @@ -29,7 +29,7 @@ ms.technology: itpro-security Provides an overview and links to information about the User Rights Assignment security policy settings user rights that are available in Windows. User rights govern the methods by which a user can log on to a system. User rights are applied at the local device level, and they allow users to perform tasks on a device or in a domain. User rights include logon rights and permissions. Logon rights control who is authorized to log on to a device and how they can log on. User rights permissions control access to computer and domain resources, and they can override permissions that have been set on specific objects. User rights are managed in Group Policy under the **User Rights Assignment** item. -Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under +Each user right has a constant name and a Group Policy name associated with it. The constant names are used when referring to the user right in log events. You can configure the user rights assignment settings in the following location within the Group Policy Management Console (GPMC) under **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment**, or on the local device by using the Local Group Policy Editor (gpedit.msc). For information about setting security policies, see [Configure security policy settings](how-to-configure-security-policy-settings.md). @@ -38,53 +38,53 @@ The following table links to each security policy setting and provides the const | Group Policy Setting | Constant Name | | - | - | -| [Access Credential Manager as a trusted caller](access-credential-manager-as-a-trusted-caller.md) | SeTrustedCredManAccessPrivilege| -| [Access this computer from the network](access-this-computer-from-the-network.md) | SeNetworkLogonRight| -| [Act as part of the operating system](act-as-part-of-the-operating-system.md) | SeTcbPrivilege| -| [Add workstations to domain](add-workstations-to-domain.md) | SeMachineAccountPrivilege| -| [Adjust memory quotas for a process](adjust-memory-quotas-for-a-process.md) | SeIncreaseQuotaPrivilege| -| [Allow log on locally](allow-log-on-locally.md) | SeInteractiveLogonRight| +| [Access Credential Manager as a trusted caller](access-credential-manager-as-a-trusted-caller.md) | SeTrustedCredManAccessPrivilege| +| [Access this computer from the network](access-this-computer-from-the-network.md) | SeNetworkLogonRight| +| [Act as part of the operating system](act-as-part-of-the-operating-system.md) | SeTcbPrivilege| +| [Add workstations to domain](add-workstations-to-domain.md) | SeMachineAccountPrivilege| +| [Adjust memory quotas for a process](adjust-memory-quotas-for-a-process.md) | SeIncreaseQuotaPrivilege| +| [Allow log on locally](allow-log-on-locally.md) | SeInteractiveLogonRight| | [Allow log on through Remote Desktop Services](allow-log-on-through-remote-desktop-services.md)| SeRemoteInteractiveLogonRight| -| [Back up files and directories](back-up-files-and-directories.md) | SeBackupPrivilege| -| [Bypass traverse checking](bypass-traverse-checking.md) | SeChangeNotifyPrivilege| -| [Change the system time](change-the-system-time.md) | SeSystemtimePrivilege| -| [Change the time zone](change-the-time-zone.md) | SeTimeZonePrivilege| -| [Create a pagefile](create-a-pagefile.md) | SeCreatePagefilePrivilege| -| [Create a token object](create-a-token-object.md) | SeCreateTokenPrivilege| -| [Create global objects](create-global-objects.md) | SeCreateGlobalPrivilege| -| [Create permanent shared objects](create-permanent-shared-objects.md) | SeCreatePermanentPrivilege| -| [Create symbolic links](create-symbolic-links.md) | SeCreateSymbolicLinkPrivilege| -| [Debug programs](debug-programs.md) | SeDebugPrivilege| +| [Back up files and directories](back-up-files-and-directories.md) | SeBackupPrivilege| +| [Bypass traverse checking](bypass-traverse-checking.md) | SeChangeNotifyPrivilege| +| [Change the system time](change-the-system-time.md) | SeSystemtimePrivilege| +| [Change the time zone](change-the-time-zone.md) | SeTimeZonePrivilege| +| [Create a pagefile](create-a-pagefile.md) | SeCreatePagefilePrivilege| +| [Create a token object](create-a-token-object.md) | SeCreateTokenPrivilege| +| [Create global objects](create-global-objects.md) | SeCreateGlobalPrivilege| +| [Create permanent shared objects](create-permanent-shared-objects.md) | SeCreatePermanentPrivilege| +| [Create symbolic links](create-symbolic-links.md) | SeCreateSymbolicLinkPrivilege| +| [Debug programs](debug-programs.md) | SeDebugPrivilege| | [Deny access to this computer from the network](deny-access-to-this-computer-from-the-network.md)| SeDenyNetworkLogonRight | -| [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) | SeDenyBatchLogonRight| +| [Deny log on as a batch job](deny-log-on-as-a-batch-job.md) | SeDenyBatchLogonRight| | [Deny log on as a service](deny-log-on-as-a-service.md) | SeDenyServiceLogonRight | -| [Deny log on locally](deny-log-on-locally.md) | SeDenyInteractiveLogonRight| -| [Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md)| SeDenyRemoteInteractiveLogonRight| -| [Enable computer and user accounts to be trusted for delegation](enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)| SeEnableDelegationPrivilege| -| [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md) | SeRemoteShutdownPrivilege| -| [Generate security audits](generate-security-audits.md) | SeAuditPrivilege| -| [Impersonate a client after authentication](impersonate-a-client-after-authentication.md)| SeImpersonatePrivilege| -| [Increase a process working set](increase-a-process-working-set.md) | SeIncreaseWorkingSetPrivilege| -| [Increase scheduling priority](increase-scheduling-priority.md) | SeIncreaseBasePriorityPrivilege| -| [Load and unload device drivers](load-and-unload-device-drivers.md) | SeLoadDriverPrivilege| -| [Lock pages in memory](lock-pages-in-memory.md) | SeLockMemoryPrivilege| -| [Log on as a batch job](log-on-as-a-batch-job.md) | SeBatchLogonRight| -| [Log on as a service](log-on-as-a-service.md) | SeServiceLogonRight| -| [Manage auditing and security log](manage-auditing-and-security-log.md)| SeSecurityPrivilege| -| [Modify an object label](modify-an-object-label.md) | SeRelabelPrivilege| -| [Modify firmware environment values](modify-firmware-environment-values.md)| SeSystemEnvironmentPrivilege| +| [Deny log on locally](deny-log-on-locally.md) | SeDenyInteractiveLogonRight| +| [Deny log on through Remote Desktop Services](deny-log-on-through-remote-desktop-services.md)| SeDenyRemoteInteractiveLogonRight| +| [Enable computer and user accounts to be trusted for delegation](enable-computer-and-user-accounts-to-be-trusted-for-delegation.md)| SeEnableDelegationPrivilege| +| [Force shutdown from a remote system](force-shutdown-from-a-remote-system.md) | SeRemoteShutdownPrivilege| +| [Generate security audits](generate-security-audits.md) | SeAuditPrivilege| +| [Impersonate a client after authentication](impersonate-a-client-after-authentication.md)| SeImpersonatePrivilege| +| [Increase a process working set](increase-a-process-working-set.md) | SeIncreaseWorkingSetPrivilege| +| [Increase scheduling priority](increase-scheduling-priority.md) | SeIncreaseBasePriorityPrivilege| +| [Load and unload device drivers](load-and-unload-device-drivers.md) | SeLoadDriverPrivilege| +| [Lock pages in memory](lock-pages-in-memory.md) | SeLockMemoryPrivilege| +| [Log on as a batch job](log-on-as-a-batch-job.md) | SeBatchLogonRight| +| [Log on as a service](log-on-as-a-service.md) | SeServiceLogonRight| +| [Manage auditing and security log](manage-auditing-and-security-log.md)| SeSecurityPrivilege| +| [Modify an object label](modify-an-object-label.md) | SeRelabelPrivilege| +| [Modify firmware environment values](modify-firmware-environment-values.md)| SeSystemEnvironmentPrivilege| | [Obtain an impersonation token for another user in the same session](impersonate-a-client-after-authentication.md) | SeDelegateSessionUserImpersonatePrivilege| -| [Perform volume maintenance tasks](perform-volume-maintenance-tasks.md) | SeManageVolumePrivilege| -| [Profile single process](profile-single-process.md) | SeProfileSingleProcessPrivilege| -| [Profile system performance](profile-system-performance.md) | SeSystemProfilePrivilege| -| [Remove computer from docking station](remove-computer-from-docking-station.md) | SeUndockPrivilege| -| [Replace a process level token](replace-a-process-level-token.md) | SeAssignPrimaryTokenPrivilege| +| [Perform volume maintenance tasks](perform-volume-maintenance-tasks.md) | SeManageVolumePrivilege| +| [Profile single process](profile-single-process.md) | SeProfileSingleProcessPrivilege| +| [Profile system performance](profile-system-performance.md) | SeSystemProfilePrivilege| +| [Remove computer from docking station](remove-computer-from-docking-station.md) | SeUndockPrivilege| +| [Replace a process level token](replace-a-process-level-token.md) | SeAssignPrimaryTokenPrivilege| | [Restore files and directories](restore-files-and-directories.md) | SeRestorePrivilege | -| [Shut down the system](shut-down-the-system.md) | SeShutdownPrivilege| -| [Synchronize directory service data](synchronize-directory-service-data.md)| SeSyncAgentPrivilege| -| [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md) | SeTakeOwnershipPrivilege| +| [Shut down the system](shut-down-the-system.md) | SeShutdownPrivilege| +| [Synchronize directory service data](synchronize-directory-service-data.md)| SeSyncAgentPrivilege| +| [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md) | SeTakeOwnershipPrivilege| + - ## Related topics - [Security policy settings reference](security-policy-settings-reference.md) From fa7cc850f81a05a56f91bd1b6535553cdd0cde64 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 27 Nov 2023 17:26:23 -0500 Subject: [PATCH 216/237] enable zone pivots --- .openpublishing.publish.config.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 075a516838..71e1376860 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -12,7 +12,8 @@ "type_mapping": { "Conceptual": "Content", "ManagedReference": "Content", - "RestApi": "Content" + "RestApi": "Content", + "ZonePivotGroups": "Toc" }, "build_entry_point": "docs", "template_folder": "_themes" From 68ea30d5b72503221e4a5cc1a2867890991b8d50 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Mon, 27 Nov 2023 15:07:57 -0800 Subject: [PATCH 217/237] Fixes to improve Acrolinx aggregate scores --- .../auditing/advanced-security-auditing.md | 14 +++++++------- .../auditing/basic-security-audit-policies.md | 6 +++--- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index 43b13d18e4..1aed416fd1 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -1,6 +1,6 @@ --- title: Advanced security audit policies -description: Advanced security audit policy settings may appear to overlap with basic policies, but they are recorded and applied differently. Learn more about them here. +description: Advanced security audit policy settings might appear to overlap with basic policies, but they're recorded and applied differently. Learn more about them here. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC ms.reviewer: ms.author: vinpa @@ -19,14 +19,14 @@ ms.technology: itpro-security # Advanced security audit policies -Advanced security audit policy settings are found in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** and appear to overlap with basic security audit policies, but they are recorded and applied differently. -When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in, you are editing the effective audit policy, so changes made to basic audit policy settings will appear exactly as configured in Auditpol.exe. In Windows 7 and later, advanced security audit policies can be controlled by using Group Policy. +Advanced security audit policy settings are found in **Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies** and appear to overlap with basic security audit policies, but they're recorded and applied differently. +When you apply basic audit policy settings to the local computer by using the Local Security Policy snap-in, you're editing the effective audit policy, so changes made to basic audit policy settings appear exactly as configured in Auditpol.exe. In Windows 7 and later, advanced security audit policies can be controlled by using Group Policy. ## In this section -| Topic | Description | +| Article | Description | | - | - | -| [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md) | This topic for the IT professional explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network that includes advanced security audit policies | -| [Advanced security auditing FAQ](advanced-security-auditing-faq.yml) | This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. +| [Planning and deploying advanced security audit policies](planning-and-deploying-advanced-security-audit-policies.md) | This article for IT professionals explains the options that security policy planners must consider, and the tasks that they must complete, to deploy an effective security audit policy in a network that includes advanced security audit policies | +| [Advanced security auditing FAQ](advanced-security-auditing-faq.yml) | This article for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. | [Using advanced security auditing options to monitor dynamic access control objects](using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) | This guide explains the process of setting up advanced security auditing capabilities that are made possible through settings and events that were introduced in Windows 8 and Windows Server 2012. -| [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) | This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. +| [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) | This reference for IT professionals provides information about the advanced audit policy settings in Windows and the audit events that they generate. diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 98827fba04..93ea3850e5 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -34,14 +34,14 @@ The event categories that you can choose to audit are: - Audit process tracking - Audit system events -If you choose to audit access to objects as part of your audit policy, you must enable either the audit directory service access category (for auditing objects on a domain controller), or the audit object access category (for auditing objects on a member server or workstation). Once you have enabled the object access category, you can specify the types of access you want to audit for each group or user. +If you choose to audit access to objects as part of your audit policy, you must enable either the audit directory service access category, for auditing objects on a domain controller, or the audit object access category, for auditing objects on a member server or workstation. After you enable the object access category, you can specify the types of access you want to audit for each group or user. ## In this section -| Topic | Description | +| Article | Description | | - | - | | [Create a basic audit policy for an event category](create-a-basic-audit-policy-settings-for-an-event-category.md) | By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. On devices that are joined to a domain, auditing settings for the event categories are undefined by default. On domain controllers, auditing is turned on by default. | -| [Apply a basic audit policy on a file or folder](apply-a-basic-audit-policy-on-a-file-or-folder.md) | You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. | +| [Apply a basic audit policy on a file or folder](apply-a-basic-audit-policy-on-a-file-or-folder.md) | You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful or failed access attempts in the security log. | | [View the security event log](view-the-security-event-log.md) | The security log records each event as defined by the audit policies you set on each object.| | [Basic security audit policy settings](basic-security-audit-policy-settings.md) | Basic security audit policy settings are found under Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy.| From 3d31287c33f5a22febd237e8ad2e9b147347a703 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 28 Nov 2023 08:38:15 -0800 Subject: [PATCH 218/237] add csp and kb --- windows/deployment/update/waas-configure-wufb.md | 8 ++++---- windows/deployment/update/waas-wufb-csp-mdm.md | 10 +++++++++- windows/deployment/update/waas-wufb-group-policy.md | 2 +- 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 0d48a5b081..02ead324db 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -243,8 +243,8 @@ The following options are available for the policy: | Policy | Sets registry key under HKLM\Software | | --- | --- | -| **GPO applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351), and later versions
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    **GPO location**: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | -| **MDM applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later versions
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    **MDM location**: ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| **GPO applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351), and later versions
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    **GPO location**: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| **MDM applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later versions
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    **MDM location**: ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | ## Enable features that are behind temporary enterprise feature control @@ -269,7 +269,7 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD | 2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build

    Other value or absent: Receive all applicable updates | | DeferFeatureUpdates | REG_DWORD | 1: Defer feature updates
    Other value or absent: Don't defer feature updates | @@ -285,7 +285,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD |2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build
    32: Systems take feature updates from General Availability Channel
    Note: Other value or absent: Receive all applicable updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index e65bab8900..0d5cb61bf1 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 10/10/2023 +ms.date: 11/28/2023 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business @@ -205,3 +205,11 @@ The features that are turned off by default from servicing updates will be enabl - **0** (default): Allowed. All features in the latest monthly cumulative update are enabled. - When the policy is set to **0**, all features that are currently turned off will turn on when the device next reboots - **1** - Not allowed. Features that are shipped turned off by default will remain off + +#### I want to enable optional updates + +*Applies to:* +- Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later +- Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed + +In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using [AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent). For more information about optional content, see [Enable optional updates](waas-configure-wufb.md#enable-optional-updates). diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 849feeeddf..8da432fe25 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -204,7 +204,7 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann *Applies to:* - Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later -- Windows 10, version 22H2 with [KBxxxxxx](https://support.microsoft.com/help/5029351), or a later cumulative update installed +- Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates** policy. From d1f3f4826f1ba80df990522ff006325f575e5cbb Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 28 Nov 2023 08:56:54 -0800 Subject: [PATCH 219/237] edits --- .../deployment/update/waas-wufb-csp-mdm.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index 0d5cb61bf1..2c233bd385 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -47,19 +47,19 @@ Drivers are automatically enabled because they're beneficial to device systems. ### Set when devices receive feature and quality updates -#### I want to receive pre-release versions of the next feature update +#### I want to receive prerelease versions of the next feature update -1. Ensure that you're enrolled in the Windows Insider Program for Business. This is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. +1. Ensure that you're enrolled in the Windows Insider Program for Business. Windows Insider is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. -1. For any of test devices you want to install pre-release builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**. +1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set the option to **Enable preview builds**. -1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using pre-release builds for validation. +1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation. -1. Additionally, you can defer pre-release feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. +1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. #### I want to manage which released feature update my devices receive -A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you won't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify. +A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you don't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify. - To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays) - To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdatesstarttime) @@ -72,7 +72,7 @@ In this example, there are three rings for quality updates. The first ring ("pil ![illustration of devices divided into three rings.](images/waas-wufb-3-rings.png) -When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. +When the quality update is released, it's offered to devices in the pilot ring the next time they scan for updates. ##### Five days later The devices in the fast ring are offered the quality update the next time they scan for updates. @@ -80,11 +80,11 @@ The devices in the fast ring are offered the quality update the next time they s ![illustration of devices with fast ring deployed.](images/waas-wufb-fast-ring.png) ##### Ten days later -Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. +Ten days after the quality update is released, it's offered to the devices in the slow ring the next time they scan for updates. ![illustration of devices with slow ring deployed.](images/waas-wufb-slow-ring.png) -If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. +If no problems occur, all of the devices that scan for updates are offered the quality update within ten days of its release, in three waves. ##### What if a problem occurs with the update? @@ -109,13 +109,13 @@ If you need a device to stay on a version beyond the point when deferrals on the #### I want to manage when devices download, install, and restart after updates -We recommended that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check. +We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check. For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#update-activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart). -It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates are not disabled and provides a better experience when users can set their own active hours. +It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates aren't disabled and provides a better experience when users can set their own active hours. -To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To do this, use Option 3, and then set the following policies as appropriate for your plan: +To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan: - [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday) - [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) @@ -132,7 +132,7 @@ If you don't want to allow any automatic updates prior to the deadline, set [Upd #### I want to keep devices secure and compliant with update deadlines -We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. This works by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings: +We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. Deadlines work by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings: - [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates) - [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates) @@ -140,7 +140,7 @@ We recommend that you use set specific deadlines for feature and quality updates - [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates) - [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot) -These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point the device will automatically schedule a restart regardless of active hours. +These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point, the device automatically schedules a restart regardless of active hours. These notifications are what the user sees depending on the settings you choose: @@ -172,7 +172,7 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window There are additional settings that affect the notifications. -We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you have set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: +We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: **0** (default) - Use the default Windows Update notifications
    **1** - Turn off all notifications, excluding restart warnings
    @@ -181,14 +181,14 @@ We recommend that you use the default notifications as they aim to provide the b > [!NOTE] > Option **2** creates a poor experience for personal devices; it's only recommended for kiosk devices where automatic restarts have been disabled. -Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto-restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto-restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications. +Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications. #### I want to manage the update settings a user can access -Every Windows device provides users with a variety of controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. +Every Windows device provides users with various controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#update-setdisablepauseuxaccess). -When you disable this setting, users will see **Some settings are managed by your organization** and the update pause settings are greyed out. +When you disable this setting, users see **Some settings are managed by your organization** and the update pause settings are greyed out. If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#update-setdisableuxwuaccess). From 6efccf528c4f00863d7f2cb14942ff4a88c618db Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 28 Nov 2023 09:23:53 -0800 Subject: [PATCH 220/237] Revert "[Nov28, 10AM] Win10-seeker-8503602" --- .../deployment/update/waas-configure-wufb.md | 10 ++-- .../deployment/update/waas-wufb-csp-mdm.md | 46 ++++++++----------- .../update/waas-wufb-group-policy.md | 6 +-- 3 files changed, 26 insertions(+), 36 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 02ead324db..6af6c31910 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -16,7 +16,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 11/28/2023 +ms.date: 08/22/2023 --- # Configure Windows Update for Business @@ -243,8 +243,8 @@ The following options are available for the policy: | Policy | Sets registry key under HKLM\Software | | --- | --- | -| **GPO applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351), and later versions
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    **GPO location**: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | -| **MDM applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later versions
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    **MDM location**: ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| GPO for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
    Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| MDM for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
    ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | ## Enable features that are behind temporary enterprise feature control @@ -269,7 +269,7 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD | 2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build

    Other value or absent: Receive all applicable updates | | DeferFeatureUpdates | REG_DWORD | 1: Defer feature updates
    Other value or absent: Don't defer feature updates | @@ -285,7 +285,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD |2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build
    32: Systems take feature updates from General Availability Channel
    Note: Other value or absent: Receive all applicable updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index 2c233bd385..e65bab8900 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 11/28/2023 +ms.date: 10/10/2023 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business @@ -47,19 +47,19 @@ Drivers are automatically enabled because they're beneficial to device systems. ### Set when devices receive feature and quality updates -#### I want to receive prerelease versions of the next feature update +#### I want to receive pre-release versions of the next feature update -1. Ensure that you're enrolled in the Windows Insider Program for Business. Windows Insider is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. +1. Ensure that you're enrolled in the Windows Insider Program for Business. This is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. -1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set the option to **Enable preview builds**. +1. For any of test devices you want to install pre-release builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**. -1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation. +1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using pre-release builds for validation. -1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. +1. Additionally, you can defer pre-release feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. #### I want to manage which released feature update my devices receive -A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you don't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify. +A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you won't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify. - To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays) - To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdatesstarttime) @@ -72,7 +72,7 @@ In this example, there are three rings for quality updates. The first ring ("pil ![illustration of devices divided into three rings.](images/waas-wufb-3-rings.png) -When the quality update is released, it's offered to devices in the pilot ring the next time they scan for updates. +When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. ##### Five days later The devices in the fast ring are offered the quality update the next time they scan for updates. @@ -80,11 +80,11 @@ The devices in the fast ring are offered the quality update the next time they s ![illustration of devices with fast ring deployed.](images/waas-wufb-fast-ring.png) ##### Ten days later -Ten days after the quality update is released, it's offered to the devices in the slow ring the next time they scan for updates. +Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. ![illustration of devices with slow ring deployed.](images/waas-wufb-slow-ring.png) -If no problems occur, all of the devices that scan for updates are offered the quality update within ten days of its release, in three waves. +If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. ##### What if a problem occurs with the update? @@ -109,13 +109,13 @@ If you need a device to stay on a version beyond the point when deferrals on the #### I want to manage when devices download, install, and restart after updates -We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check. +We recommended that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check. For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#update-activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart). -It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates aren't disabled and provides a better experience when users can set their own active hours. +It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates are not disabled and provides a better experience when users can set their own active hours. -To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan: +To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To do this, use Option 3, and then set the following policies as appropriate for your plan: - [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday) - [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) @@ -132,7 +132,7 @@ If you don't want to allow any automatic updates prior to the deadline, set [Upd #### I want to keep devices secure and compliant with update deadlines -We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. Deadlines work by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings: +We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. This works by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings: - [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates) - [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates) @@ -140,7 +140,7 @@ We recommend that you use set specific deadlines for feature and quality updates - [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates) - [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot) -These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point, the device automatically schedules a restart regardless of active hours. +These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point the device will automatically schedule a restart regardless of active hours. These notifications are what the user sees depending on the settings you choose: @@ -172,7 +172,7 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window There are additional settings that affect the notifications. -We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: +We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you have set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: **0** (default) - Use the default Windows Update notifications
    **1** - Turn off all notifications, excluding restart warnings
    @@ -181,14 +181,14 @@ We recommend that you use the default notifications as they aim to provide the b > [!NOTE] > Option **2** creates a poor experience for personal devices; it's only recommended for kiosk devices where automatic restarts have been disabled. -Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications. +Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto-restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto-restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications. #### I want to manage the update settings a user can access -Every Windows device provides users with various controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. +Every Windows device provides users with a variety of controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#update-setdisablepauseuxaccess). -When you disable this setting, users see **Some settings are managed by your organization** and the update pause settings are greyed out. +When you disable this setting, users will see **Some settings are managed by your organization** and the update pause settings are greyed out. If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#update-setdisableuxwuaccess). @@ -205,11 +205,3 @@ The features that are turned off by default from servicing updates will be enabl - **0** (default): Allowed. All features in the latest monthly cumulative update are enabled. - When the policy is set to **0**, all features that are currently turned off will turn on when the device next reboots - **1** - Not allowed. Features that are shipped turned off by default will remain off - -#### I want to enable optional updates - -*Applies to:* -- Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later -- Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed - -In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using [AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent). For more information about optional content, see [Enable optional updates](waas-configure-wufb.md#enable-optional-updates). diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 8da432fe25..372a36d6df 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -17,7 +17,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 11/28/2023 +ms.date: 10/10/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business @@ -202,9 +202,7 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann #### I want to enable optional updates -*Applies to:* -- Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later -- Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed +(*Starting in Windows 11, version 22H2 or later*) In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates** policy. From 0dc18300ea33102c500ab2c7dad01918c442579a Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 28 Nov 2023 09:31:27 -0800 Subject: [PATCH 221/237] Update waas-wufb-csp-mdm.md --- windows/deployment/update/waas-wufb-csp-mdm.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index e65bab8900..187268cec0 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -47,15 +47,15 @@ Drivers are automatically enabled because they're beneficial to device systems. ### Set when devices receive feature and quality updates -#### I want to receive pre-release versions of the next feature update +#### I want to receive prerelease versions of the next feature update 1. Ensure that you're enrolled in the Windows Insider Program for Business. This is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. -1. For any of test devices you want to install pre-release builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**. +1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**. -1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using pre-release builds for validation. +1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation. -1. Additionally, you can defer pre-release feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. +1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. #### I want to manage which released feature update my devices receive @@ -113,7 +113,7 @@ We recommended that you allow to update automatically--this is the default behav For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#update-activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart). -It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates are not disabled and provides a better experience when users can set their own active hours. +It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates aren't disabled and provides a better experience when users can set their own active hours. To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To do this, use Option 3, and then set the following policies as appropriate for your plan: @@ -181,7 +181,7 @@ We recommend that you use the default notifications as they aim to provide the b > [!NOTE] > Option **2** creates a poor experience for personal devices; it's only recommended for kiosk devices where automatic restarts have been disabled. -Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto-restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto-restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications. +Still more options are available in [Update/ScheduleRestartWarning](/windows/client-management/mdm/policy-csp-update#update-schedulerestartwarning). This setting allows you to specify the period for auto restart warning reminder notifications (from 2-24 hours; 4 hours is the default) before the update. You can also specify the period for auto restart imminent warning notifications with [Update/ScheduleImminentRestartWarning](/windows/client-management/mdm/policy-csp-update#update-scheduleimminentrestartwarning) (15-60 minutes is the default). We recommend using the default notifications. #### I want to manage the update settings a user can access From f2230eb075fee198f6aab1657e692f3955ea4d44 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 28 Nov 2023 09:37:49 -0800 Subject: [PATCH 222/237] win10-seeker-8503602-take2 --- windows/deployment/update/waas-configure-wufb.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 02ead324db..9bc7161f80 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -210,7 +210,7 @@ Starting with Windows 10, version 1607, you can selectively opt out of receiving | MDM for Windows 10, version 1607 and later:
    ../Vendor/MSFT/Policy/Config/Update/
    **ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | ## Enable optional updates - + In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Enable optional updates** policy. To keep the timing of updates consistent, the **Enable optional updates** policy respects the [deferral period for quality updates](#configure-when-devices-receive-quality-updates). This policy allows you to choose if devices should receive CFRs in addition to the optional nonsecurity preview releases, or if the end-user can make the decision to install optional updates. This policy can change the behavior of the **Get the latest updates as soon as they're available** option in **Settings** > **Update & security** > ***Windows Update** > **Advanced options**. From 16df997cf5d5236feb79b38a5931f7faed936f49 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Tue, 28 Nov 2023 09:53:36 -0800 Subject: [PATCH 223/237] edits --- .../deployment/update/waas-configure-wufb.md | 10 ++--- .../deployment/update/waas-wufb-csp-mdm.md | 38 +++++++++++-------- .../update/waas-wufb-group-policy.md | 6 ++- 3 files changed, 32 insertions(+), 22 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 5188ae50b5..a2b53dccb5 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -16,7 +16,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 08/22/2023 +ms.date: 11/29/2023 --- # Configure Windows Update for Business @@ -243,8 +243,8 @@ The following options are available for the policy: | Policy | Sets registry key under HKLM\Software | | --- | --- | -| GPO for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
    Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | -| MDM for Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later:
    ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| **GPO applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351), and later versions
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    **GPO location**: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > **Enable optional updates**| \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | +| **MDM applies to**:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later versions
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    **MDM location**: ./Device/Vendor/MSFT/Policy/Config/Update/
    **[AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent)** | \Policies\Microsoft\Windows\WindowsUpdate\AllowOptionalContent | ## Enable features that are behind temporary enterprise feature control @@ -269,7 +269,7 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD | 2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build

    Other value or absent: Receive all applicable updates | | DeferFeatureUpdates | REG_DWORD | 1: Defer feature updates
    Other value or absent: Don't defer feature updates | @@ -285,7 +285,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| AllowOptionalContent

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| +| AllowOptionalContent

    *Added in*:
    • Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later
    • Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed

    | REG_DWORD | 1: Automatically receive optional updates (including CFRs)
    2: Automatically receive optional updates
    3: Users can select which optional updates to receive
    Other value or absent: Don't receive optional updates| | AllowTemporaryEnterpriseFeatureControl

    *Added in Windows 11, version 22H2*| REG_DWORD | 1: Allowed. All features in the latest monthly cumulative update are enabled.
    Other value or absent: Features that are shipped turned off by default will remain off | | BranchReadinessLevel | REG_DWORD |2: Systems take feature updates for the Windows Insider build - Fast
    4: Systems take feature updates for the Windows Insider build - Slow
    8: Systems take feature updates for the Release Windows Insider build
    32: Systems take feature updates from General Availability Channel
    Note: Other value or absent: Receive all applicable updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: Defer feature updates by given days | diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index 187268cec0..b382e039b5 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 10/10/2023 +ms.date: 11/28/2023 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business @@ -49,17 +49,17 @@ Drivers are automatically enabled because they're beneficial to device systems. #### I want to receive prerelease versions of the next feature update -1. Ensure that you're enrolled in the Windows Insider Program for Business. This is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. +1. Ensure that you're enrolled in the Windows Insider Program for Business. Windows Insider is a free program available to commercial customers to aid them in their validation of feature updates before they're released. Joining the program enables you to receive updates prior to their release as well as receive emails and content related to what is coming in the next updates. -1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set this to **Enable preview builds**. +1. For any of test devices you want to install prerelease builds, use [Update/ManagePreviewBuilds](/windows/client-management/mdm/policy-csp-update#update-managepreviewbuilds). Set the option to **Enable preview builds**. 1. Use [Update/BranchReadinessLevel](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) and select one of the preview Builds. Windows Insider Program Slow is the recommended channel for commercial customers who are using prerelease builds for validation. -1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This ensures that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. +1. Additionally, you can defer prerelease feature updates the same way as released updates, by setting a deferral period up to 14 days by using [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays). If you're testing with Windows Insider Program Slow builds, we recommend that you receive the preview updates to your IT department on day 0, when the update is released, and then have a 7-10 day deferral before rolling out to your group of testers. This schedule helps ensure that if a problem is discovered, you can pause the rollout of the preview update before it reaches your tests. #### I want to manage which released feature update my devices receive -A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you won't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify. +A Windows Update for Business administrator can defer or pause updates. You can defer feature updates for up to 365 days and defer quality updates for up to 30 days. Deferring simply means that you don't receive the update until it has been released for at least the number of deferral days you specified (offer date = release date + deferral date). You can pause feature or quality updates for up to 35 days from a given start date that you specify. - To defer a feature update: [Update/DeferFeatureUpdatesPeriodInDays](/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays) - To pause a feature update: [Update/PauseFeatureUpdatesStartTime](/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdatesstarttime) @@ -72,7 +72,7 @@ In this example, there are three rings for quality updates. The first ring ("pil ![illustration of devices divided into three rings.](images/waas-wufb-3-rings.png) -When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. +When the quality update is released, it's offered to devices in the pilot ring the next time they scan for updates. ##### Five days later The devices in the fast ring are offered the quality update the next time they scan for updates. @@ -80,11 +80,11 @@ The devices in the fast ring are offered the quality update the next time they s ![illustration of devices with fast ring deployed.](images/waas-wufb-fast-ring.png) ##### Ten days later -Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. +Ten days after the quality update is released, it's offered to the devices in the slow ring the next time they scan for updates. ![illustration of devices with slow ring deployed.](images/waas-wufb-slow-ring.png) -If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. +If no problems occur, all of the devices that scan for updates are offered the quality update within ten days of its release, in three waves. ##### What if a problem occurs with the update? @@ -109,13 +109,13 @@ If you need a device to stay on a version beyond the point when deferrals on the #### I want to manage when devices download, install, and restart after updates -We recommended that you allow to update automatically--this is the default behavior. If you don't set an automatic update policy, the device will attempt to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check. +We recommended that you allow to update automatically, which is the default behavior. If you don't set an automatic update policy, the device attempts to download, install, and restart at the best times for the user by using built-in intelligence such as intelligent active hours and smart busy check. For more granular control, you can set the maximum period of active hours the user can set with [Update/ActiveHoursMaxRange](/windows/client-management/mdm/policy-csp-update#update-activehoursmaxrange). You could also set specific start and end times for active ours with [Update/ActiveHoursEnd](/windows/client-management/mdm/policy-csp-update#update-activehoursend) and [Update/ActiveHoursStart](/windows/client-management/mdm/policy-csp-update#update-activehoursstart). It's best to refrain from setting the active hours policy because it's enabled by default when automatic updates aren't disabled and provides a better experience when users can set their own active hours. -To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To do this, use Option 3, and then set the following policies as appropriate for your plan: +To update outside of the active hours, use [Update/AllowAutoUpdate](/windows/client-management/mdm/policy-csp-update#update-allowautoupdate) with Option 2 (which is the default setting). For even more granular control, consider using automatic updates to schedule the install time, day, or week. To use a schedule, use Option 3, and then set the following policies as appropriate for your plan: - [Update/ScheduledInstallDay](/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday) - [Update/ScheduledInstallEveryWeek](/windows/client-management/mdm/policy-csp-update#update-scheduledinstalleveryweek) @@ -132,7 +132,7 @@ If you don't want to allow any automatic updates prior to the deadline, set [Upd #### I want to keep devices secure and compliant with update deadlines -We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. This works by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings: +We recommend that you use set specific deadlines for feature and quality updates to ensure that devices stay secure on Windows 10, version 1709 and later. Deadlines work by enabling you to specify the number of days that can elapse after an update is offered to a device before it must be installed. Also you can set the number of days that can elapse after a pending restart before the user is forced to restart. Use these settings: - [Update/ConfigureDeadlineForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforfeatureupdates) - [Update/ConfigureDeadlineForQualityUpdates ](/windows/client-management/mdm/policy-csp-update#update-configuredeadlineforqualityupdates) @@ -140,7 +140,7 @@ We recommend that you use set specific deadlines for feature and quality updates - [Update/ConfigureDeadlineGracePeriodForFeatureUpdates](/windows/client-management/mdm/policy-csp-update#configuredeadlinegraceperiodforfeatureupdates) - [Update/ConfigureDeadlineNoAutoReboot](/windows/client-management/mdm/policy-csp-update#update-configuredeadlinenoautoreboot) -These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point the device will automatically schedule a restart regardless of active hours. +These policies also offer an option to opt out of automatic restarts until a deadline is reached by presenting an "engaged restart experience" until the deadline has actually expired. At that point, the device automatically schedules a restart regardless of active hours. These notifications are what the user sees depending on the settings you choose: @@ -172,7 +172,7 @@ When **Specify deadlines for automatic updates and restarts** is set (For Window There are additional settings that affect the notifications. -We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you have set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: +We recommend that you use the default notifications as they aim to provide the best user experience while adjusting for the compliance policies that you set. If you do have further needs that aren't met by the default notification settings, you can use the [Update/UpdateNotificationLevel](/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel) policy with these values: **0** (default) - Use the default Windows Update notifications
    **1** - Turn off all notifications, excluding restart warnings
    @@ -185,10 +185,10 @@ Still more options are available in [Update/ScheduleRestartWarning](/windows/cli #### I want to manage the update settings a user can access -Every Windows device provides users with a variety of controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. +Every Windows device provides users with various controls they can use to manage Windows Updates. They can access these controls by Search to find Windows Updates or by going selecting **Updates and Security** in **Settings**. We provide the ability to disable a variety of these controls that are accessible to users. Users with access to update pause settings can prevent both feature and quality updates for 7 days. You can prevent users from pausing updates through the Windows Update settings page by using [Update/SetDisablePauseUXAccess](/windows/client-management/mdm/policy-csp-update#update-setdisablepauseuxaccess). -When you disable this setting, users will see **Some settings are managed by your organization** and the update pause settings are greyed out. +When you disable this setting, users see **Some settings are managed by your organization** and the update pause settings are greyed out. If you use Windows Server Update Server (WSUS), you can prevent users from scanning Windows Update. To do this, use [Update/SetDisableUXWUAccess](/windows/client-management/mdm/policy-csp-update#update-setdisableuxwuaccess). @@ -205,3 +205,11 @@ The features that are turned off by default from servicing updates will be enabl - **0** (default): Allowed. All features in the latest monthly cumulative update are enabled. - When the policy is set to **0**, all features that are currently turned off will turn on when the device next reboots - **1** - Not allowed. Features that are shipped turned off by default will remain off + +#### I want to enable optional updates + +*Applies to:* +- Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later +- Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed + +In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using [AllowOptionalContent](/windows/client-management/mdm/policy-csp-update?toc=/windows/deployment/toc.json&bc=/windows/deployment/breadcrumb/toc.json#allowoptionalcontent). For more information about optional content, see [Enable optional updates](waas-configure-wufb.md#enable-optional-updates). \ No newline at end of file diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 372a36d6df..c23dc04544 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -17,7 +17,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 10/10/2023 +ms.date: 11/29/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business @@ -202,7 +202,9 @@ If you use Windows Server Update Server (WSUS), you can prevent users from scann #### I want to enable optional updates -(*Starting in Windows 11, version 22H2 or later*) +*Applies to:* +- Windows 11, version 22H2 with [KB5029351](https://support.microsoft.com/help/5029351) and later +- Windows 10, version 22H2 with [KB5032278](https://support.microsoft.com/help/5032278), or a later cumulative update installed In addition to the monthly cumulative update, optional updates are available to provide new features and nonsecurity changes. Most optional updates are released on the fourth Tuesday of the month, known as optional nonsecurity preview releases. Optional updates can also include features that are gradually rolled out, known as controlled feature rollouts (CFRs). Installation of optional updates isn't enabled by default for devices that receive updates using Windows Update for Business. However, you can enable optional updates for devices by using the **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Manage updates offered from Windows Update > Enable optional updates** policy. From e813cc6f3678fc7c3c3729a9555a6d6c53d22b3c Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Wed, 29 Nov 2023 10:46:24 -0700 Subject: [PATCH 224/237] Update waas-delivery-optimization.md --- windows/deployment/do/waas-delivery-optimization.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization.md b/windows/deployment/do/waas-delivery-optimization.md index 010894a61d..c93ec2fbed 100644 --- a/windows/deployment/do/waas-delivery-optimization.md +++ b/windows/deployment/do/waas-delivery-optimization.md @@ -50,7 +50,8 @@ The following table lists the minimum Windows 10 version that supports Delivery | Windows Client | Minimum Windows version | HTTP Downloader | Peer to Peer | Microsoft Connected Cache (MCC) |------------------|---------------|----------------|----------|----------------| | Windows Update ([feature updates quality updates, language packs, drivers](../update/get-started-updates-channels-tools.md#types-of-updates)) | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | -| Windows 10 Store apps | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | +| Windows 10/11 UWP Store apps | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | +| Windows 11 Win32 Store apps | Windows 11 | :heavy_check_mark: | | | | Windows 10 Store for Business apps | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | Windows Defender definition updates | Windows 10 1511, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | | Intune Win32 apps| Windows 10 1709, Windows 11 | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: | From 419eeefe40294e8957700fe7b0960197a00d569e Mon Sep 17 00:00:00 2001 From: DarrenOMalleyMSFT <117911902+DarrenOMalleyMSFT@users.noreply.github.com> Date: Thu, 30 Nov 2023 09:36:33 +0000 Subject: [PATCH 225/237] Update how-it-works.md Spelling error --- .../application-control/user-account-control/how-it-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/application-security/application-control/user-account-control/how-it-works.md b/windows/security/application-security/application-control/user-account-control/how-it-works.md index fa5d96ef91..27338890ca 100644 --- a/windows/security/application-security/application-control/user-account-control/how-it-works.md +++ b/windows/security/application-security/application-control/user-account-control/how-it-works.md @@ -16,7 +16,7 @@ With UAC, each application that requires the *administrator access token* must p Windows protects processes by marking their integrity levels. Integrity levels are measurements of trust: - A *high integrity application* is one that performs tasks that modify system data, such as a disk partitioning application -- A *low integrity application* is one that performs tasks that could potentially compromise the operating system, like as a Web brows +- A *low integrity application* is one that performs tasks that could potentially compromise the operating system, like as a Web browser Applications with lower integrity levels can't modify data in applications with higher integrity levels. When a standard user attempts to run an app that requires an administrator access token, UAC requires that the user provides valid administrator credentials. From d215dce1778facf920842a42acb14b69360f1faa Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 30 Nov 2023 10:39:59 -0800 Subject: [PATCH 226/237] Updated what's new --- .../whats-new/windows-autopatch-whats-new-2023.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 1e7b26a9c9..136c0c952b 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 11/16/2023 +ms.date: 11/30/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new @@ -23,6 +23,12 @@ Minor corrections such as typos, style, or formatting issues aren't listed. ## November 2023 +### October feature releases or updates + +| Article | Description | +| ----- | ----- | +| [Prerequisites](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) | Added F SKU licenses to the More about licenses section. Also see [FAQ](../overview/windows-autopatch-faq.yml)
    • [MC671811](https://admin.microsoft.com/adminportal/home#/MessageCenter)
    | + ## November service release | Message center post number | Description | From f1ea8481f5cfbd86c9b60923ca40a61e42093f71 Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 30 Nov 2023 13:37:11 -0800 Subject: [PATCH 227/237] metadata --- windows/deployment/update/waas-configure-wufb.md | 2 +- windows/deployment/update/waas-wufb-csp-mdm.md | 2 +- windows/deployment/update/waas-wufb-group-policy.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index a2b53dccb5..2a1baa5255 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -16,7 +16,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 11/29/2023 +ms.date: 11/30/2023 --- # Configure Windows Update for Business diff --git a/windows/deployment/update/waas-wufb-csp-mdm.md b/windows/deployment/update/waas-wufb-csp-mdm.md index b382e039b5..cc945db4c2 100644 --- a/windows/deployment/update/waas-wufb-csp-mdm.md +++ b/windows/deployment/update/waas-wufb-csp-mdm.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium appliesto: - ✅ Windows 11 - ✅ Windows 10 -ms.date: 11/28/2023 +ms.date: 11/30/2023 --- # Walkthrough: Use CSPs and MDMs to configure Windows Update for Business diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index c23dc04544..22c937a71a 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -17,7 +17,7 @@ appliesto: - ✅ Windows Server 2022 - ✅ Windows Server 2019 - ✅ Windows Server 2016 -ms.date: 11/29/2023 +ms.date: 11/30/2023 --- # Walkthrough: Use Group Policy to configure Windows Update for Business From 15adb0549ce80b2915a8d290e5f5e8a0618e54f8 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Fri, 1 Dec 2023 11:58:55 -0800 Subject: [PATCH 228/237] Added MC post --- .../whats-new/windows-autopatch-whats-new-2023.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index 136c0c952b..afbc0a46c5 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -27,7 +27,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed. | Article | Description | | ----- | ----- | -| [Prerequisites](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) | Added F SKU licenses to the More about licenses section. Also see [FAQ](../overview/windows-autopatch-faq.yml)
    • [MC671811](https://admin.microsoft.com/adminportal/home#/MessageCenter)
    | +| [Prerequisites](../prepare/windows-autopatch-prerequisites.md#more-about-licenses) | Added F SKU licenses to the More about licenses section. Also see [FAQ](../overview/windows-autopatch-faq.yml)
    • [MC690609](https://admin.microsoft.com/adminportal/home#/MessageCenter)
    | ## November service release From 02001cdc71e1cfca805d040d7fff61affbd9f690 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Fri, 1 Dec 2023 13:22:15 -0800 Subject: [PATCH 229/237] Update md-app-guard-browser-extension.md --- .../md-app-guard-browser-extension.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md index b5b54f3574..79a92c0c24 100644 --- a/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md +++ b/windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-browser-extension.md @@ -19,7 +19,7 @@ Microsoft Defender Application Guard Extension defends devices in your organizat ## Prerequisites -Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1803 or later: +Microsoft Defender Application Guard Extension works with the following editions of Windows 10, version 1809 or later: - Windows 10 Professional - Windows 10 Enterprise @@ -84,4 +84,4 @@ Unexpected response while processing trusted state | The extension was able to c ## Related articles - [Microsoft Defender Application Guard overview](md-app-guard-overview.md) -- [Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md) \ No newline at end of file +- [Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md) From b08b3027a8d2b15325abb8e09a90e9fef56e0988 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 1 Dec 2023 18:40:06 -0500 Subject: [PATCH 230/237] added zone pivots to more docsets --- .openpublishing.publish.config.json | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 71e1376860..0015a87b88 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -91,6 +91,7 @@ "moniker_ranges": [], "open_to_public_contributors": true, "type_mapping": { + "ZonePivotGroups": "Toc", "Conceptual": "Content", "ManagedReference": "Content", "RestApi": "Content" @@ -107,6 +108,7 @@ "moniker_ranges": [], "open_to_public_contributors": false, "type_mapping": { + "ZonePivotGroups": "Toc", "Conceptual": "Content", "ManagedReference": "Content", "RestApi": "Content" @@ -123,6 +125,7 @@ "moniker_ranges": [], "open_to_public_contributors": true, "type_mapping": { + "ZonePivotGroups": "Toc", "Conceptual": "Content", "ManagedReference": "Content", "RestApi": "Content" @@ -139,6 +142,7 @@ "moniker_ranges": [], "open_to_public_contributors": true, "type_mapping": { + "ZonePivotGroups": "Toc", "Conceptual": "Content", "ManagedReference": "Content", "RestApi": "Content" @@ -171,6 +175,7 @@ "moniker_ranges": [], "open_to_public_contributors": true, "type_mapping": { + "ZonePivotGroups": "Toc", "Conceptual": "Content", "ManagedReference": "Content", "RestApi": "Content" @@ -187,6 +192,7 @@ "moniker_ranges": [], "open_to_public_contributors": true, "type_mapping": { + "ZonePivotGroups": "Toc", "Conceptual": "Content", "ManagedReference": "Content", "RestApi": "Content" From 30f4bf66ef34d7a06856aec0c81c815b710e9383 Mon Sep 17 00:00:00 2001 From: Tony Narlock Date: Sun, 3 Dec 2023 13:54:08 -0600 Subject: [PATCH 231/237] chore: Typo fix whats-new-windows-11-version-23h2.md manged -> managed --- windows/whats-new/whats-new-windows-11-version-23h2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-11-version-23h2.md b/windows/whats-new/whats-new-windows-11-version-23h2.md index a6c474e939..cedaafdfd2 100644 --- a/windows/whats-new/whats-new-windows-11-version-23h2.md +++ b/windows/whats-new/whats-new-windows-11-version-23h2.md @@ -36,7 +36,7 @@ To learn more about the status of the update rollout, known issues, and new info [Temporary enterprise feature control](temporary-enterprise-feature-control.md) temporarily turns off certain features that were introduced during monthly cumulative updates for managed Windows 11, version 22H2 devices. For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. -When a manged Windows 11, version 22H2 device installs [version 23H2](https://support.microsoft.com/kb/5027397), the following features will no longer under be under temporary enterprise feature control: +When a managed Windows 11, version 22H2 device installs [version 23H2](https://support.microsoft.com/kb/5027397), the following features will no longer under be under temporary enterprise feature control: | Feature | KB article where the feature was introduced | |---|---| From 77a9a9d0a2c702aa78756157022a53ce91906794 Mon Sep 17 00:00:00 2001 From: Tony Narlock Date: Mon, 4 Dec 2023 03:44:28 -0600 Subject: [PATCH 232/237] Update windows/whats-new/whats-new-windows-11-version-23h2.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/whats-new/whats-new-windows-11-version-23h2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-11-version-23h2.md b/windows/whats-new/whats-new-windows-11-version-23h2.md index cedaafdfd2..7a178b1852 100644 --- a/windows/whats-new/whats-new-windows-11-version-23h2.md +++ b/windows/whats-new/whats-new-windows-11-version-23h2.md @@ -36,7 +36,7 @@ To learn more about the status of the update rollout, known issues, and new info [Temporary enterprise feature control](temporary-enterprise-feature-control.md) temporarily turns off certain features that were introduced during monthly cumulative updates for managed Windows 11, version 22H2 devices. For the purposes of temporary enterprise control, a system is considered managed if it's configured to get updates from Windows Update for Business or [Windows Server Update Services (WSUS)](/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus). Clients that get updates from Microsoft Configuration Manager and Microsoft Intune are considered managed since their updates ultimately come from WSUS or Windows Updates for Business. -When a managed Windows 11, version 22H2 device installs [version 23H2](https://support.microsoft.com/kb/5027397), the following features will no longer under be under temporary enterprise feature control: +When a managed Windows 11, version 22H2 device installs [version 23H2](https://support.microsoft.com/kb/5027397), the following features will no longer be under temporary enterprise feature control: | Feature | KB article where the feature was introduced | |---|---| From 2e008676dc6e7e7479a491513ca921613caa14da Mon Sep 17 00:00:00 2001 From: Rachel Price <52579263+raprice@users.noreply.github.com> Date: Wed, 18 Oct 2023 14:28:39 -0700 Subject: [PATCH 233/237] updates --- education/breadcrumb/toc.yml | 1 + windows/hub/breadcrumb/toc.yml | 30 +++++++++++++++++++++++++++--- 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/education/breadcrumb/toc.yml b/education/breadcrumb/toc.yml index 211570e4b0..3ccb28392f 100644 --- a/education/breadcrumb/toc.yml +++ b/education/breadcrumb/toc.yml @@ -1,3 +1,4 @@ +items: - name: Windows tocHref: /windows/ topicHref: /windows/index diff --git a/windows/hub/breadcrumb/toc.yml b/windows/hub/breadcrumb/toc.yml index 211570e4b0..cb49bed653 100644 --- a/windows/hub/breadcrumb/toc.yml +++ b/windows/hub/breadcrumb/toc.yml @@ -1,3 +1,27 @@ -- name: Windows - tocHref: /windows/ - topicHref: /windows/index +items: + - name: Docs + tocHref: / + topicHref: / + items: + - name: Windows + tocHref: /windows/ + topicHref: /windows/resources/ + items: + - name: What's new + tocHref: /windows/whats-new/ + topicHref: /windows/whats-new/ + - name: Configuration + tocHref: /windows/configuration/ + topicHref: /windows/configuration/ + - name: Deployment + tocHref: /windows/deployment/ + topicHref: /windows/deployment/ + - name: Client management + tocHref: /windows/client-management/ + topicHref: /windows/client-management/ + - name: Privacy + tocHref: /windows/privacy/ + topicHref: /windows/privacy/ + - name: Security + tocHref: /windows/security/ + topicHref: /windows/security/ \ No newline at end of file From 5cb8b7b9131672bc1eaba03e41183543fc6be2d8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 4 Dec 2023 10:04:20 -0500 Subject: [PATCH 234/237] tip rewording and Acrolinx --- .../remote-credential-guard.md | 21 +++++++++++-------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 2b0d64ce57..1d0c6679ba 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -2,7 +2,7 @@ title: Remote Credential Guard description: Learn how Remote Credential Guard helps to secure Remote Desktop credentials by never sending them to the target device. ms.topic: how-to -ms.date: 11/17/2023 +ms.date: 12/04/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 @@ -33,7 +33,7 @@ Using a Remote Desktop session without Remote Credential Guard has the following The security benefits of Remote Credential Guard include: - Credentials aren't sent to the remote host -- During the remote session you can connect to other systems using SSO +- During the remote session, you can connect to other systems using SSO - An attacker can act on behalf of the user only when the session is ongoing The security benefits of [Restricted Admin mode][TECH-1] include: @@ -67,14 +67,14 @@ The remote host: The client device: - Must be running the Remote Desktop Windows application. The Remote Desktop Universal Windows Platform (UWP) application doesn't support Remote Credential Guard -- Must use Kerberos authentication to connect to the remote host. If the client can't connect to a domain controller, then RDP attempts to fall back to NTLM. Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk +- Must use Kerberos authentication to connect to the remote host. If the client can't connect to a domain controller, then RDP attempts to fall back to NTLM. Remote Credential Guard doesn't allow NTLM fallback because it would expose credentials to risk [!INCLUDE [remote-credential-guard](../../../includes/licensing/remote-credential-guard.md)] ## Enable delegation of nonexportable credentials on the remote hosts This policy is required on the remote hosts to support Remote Credential Guard and Restricted Admin mode. It allows the remote host to delegate nonexportable credentials to the client device.\ -If you disable or don't configure this setting, Restricted Admin and Remote Credential Guard mode aren't supported. User will always need to pass their credentials to the host, exposing users to the risk of credential theft from attackers on the remote host. +If you disable or don't configure this setting, Restricted Admin and Remote Credential Guard mode aren't supported. Users must pass their credentials to the host, exposing them to the risk of credential theft from attackers on the remote host. To enable delegation of nonexportable credentials on the remote hosts, you can use: @@ -130,10 +130,13 @@ reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin To enable Remote Credential Guard on the clients, you can configure a policy that prevents the delegation of credentials to the remote hosts. > [!TIP] -> If you don't want to configure your clients to enforce Remote Credential Guard, and if you are an administrator of the remote host, you can use the following command to use Remote Credential Guard for a specific RDP session: +> If you don't want to configure your clients to enforce Remote Credential Guard, you can use the following command to use Remote Credential Guard for a specific RDP session: +> > ```cmd > mstsc.exe /remoteGuard > ``` +> +> If the server hosts the RDS Host role, then the command works only if the user is an administrator of the remote host. The policy can have different values, depending on the level of security you want to enforce: @@ -203,17 +206,17 @@ To further harden security, we also recommend that you implement Windows Local A For more information about LAPS, see [What is Windows LAPS][LEARN-1]. -## Additional considerations +## Considerations -Here are some additional considerations for Remote Credential Guard: +Here are some considerations for Remote Credential Guard: -- Remote Credential Guard doesn't support compound authentication. For example, if you're trying to access a file server from a remote host that requires a device claim, access will be denied +- Remote Credential Guard doesn't support compound authentication. For example, if you're trying to access a file server from a remote host that requires a device claim, access is denied - Remote Credential Guard can be used only when connecting to a device that is joined to an Active Directory domain. It can't be used when connecting to remote devices joined to Microsoft Entra ID - Remote Credential Guard can be used from a Microsoft Entra joined client to connect to an Active Directory joined remote host, as long as the client can authenticate using Kerberos - Remote Credential Guard only works with the RDP protocol - No credentials are sent to the target device, but the target device still acquires Kerberos Service Tickets on its own - The server and client must authenticate using Kerberos -- Remote Credential Guard is only supported for direct connections to the target machines and not for the ones via Remote Desktop Connection Broker and Remote Desktop Gateway +- Remote Credential Guard is only supported for direct connections to the target machines. It isn't support for connections via Remote Desktop Connection Broker and Remote Desktop Gateway From 268ce99d70e0d1de94b82f42d0c120a00de5b569 Mon Sep 17 00:00:00 2001 From: Tony Narlock Date: Sun, 3 Dec 2023 18:01:02 -0600 Subject: [PATCH 235/237] Fix typo in configure-wdac-managed-installer --- .../operations/configure-wdac-managed-installer.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md index 44d5693f5a..10af498ac0 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md @@ -1,6 +1,6 @@ --- title: Managed installer and ISG technical reference and troubleshooting guide -description: Explains how to configure a custom Manged Installer. +description: Explains how to configure a custom Managed Installer. ms.localizationpriority: medium ms.date: 11/11/2022 ms.topic: article From 8499079262ca130c279af542335b6f689542120d Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Mon, 4 Dec 2023 10:20:00 -0800 Subject: [PATCH 236/237] Updated date --- .../windows-autopatch/overview/windows-autopatch-faq.yml | 2 +- .../prepare/windows-autopatch-prerequisites.md | 2 +- .../whats-new/windows-autopatch-whats-new-2023.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml index e071af5384..3f0e20c935 100644 --- a/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml +++ b/windows/deployment/windows-autopatch/overview/windows-autopatch-faq.yml @@ -4,7 +4,7 @@ metadata: description: Answers to frequently asked questions about Windows Autopatch. ms.prod: windows-client ms.topic: faq - ms.date: 11/29/2023 + ms.date: 12/04/2023 audience: itpro ms.localizationpriority: medium manager: dougeby diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index c84e610b56..f1351f3709 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -1,7 +1,7 @@ --- title: Prerequisites description: This article details the prerequisites needed for Windows Autopatch -ms.date: 11/29/2023 +ms.date: 12/04/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: conceptual diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md index afbc0a46c5..4c0fde8854 100644 --- a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2023.md @@ -1,7 +1,7 @@ --- title: What's new 2023 description: This article lists the 2023 feature releases and any corresponding Message center post numbers. -ms.date: 11/30/2023 +ms.date: 12/04/2023 ms.prod: windows-client ms.technology: itpro-updates ms.topic: whats-new From a9ad0df5c67e618c199d7a6553083f9fb657d994 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Mon, 4 Dec 2023 11:17:30 -0800 Subject: [PATCH 237/237] fix build suggestion --- .../operations/configure-wdac-managed-installer.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md b/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md index 10af498ac0..98e2c42da8 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/operations/configure-wdac-managed-installer.md @@ -1,9 +1,9 @@ --- title: Managed installer and ISG technical reference and troubleshooting guide -description: Explains how to configure a custom Managed Installer. +description: A technical reference and troubleshooting guide for managed installer and Intelligent Security Graph (ISG). ms.localizationpriority: medium ms.date: 11/11/2022 -ms.topic: article +ms.topic: troubleshooting --- # Managed installer and ISG technical reference and troubleshooting guide

    5gU zudgeQjSa7g0a8rdt`7|0#t2h(*7gQtsr^q|2{WE6e>OVl_lB8m6omz~&4{L?7d_S5 zlRjc`FZfqOE~R}YLf5t!!|emSM{z+qaaU*j96Qw~(j&YuEO>(ve9;~nA7u7|<-{}m zas9+RsK0HkSY%e$<)114S6eD4=r+^a>!QK@#UlDFq2hHN&$Rp z;23zdy*Y#WjlZ`J4@{6hW0E;l;Fy`p+{o8>84;IB9FHHkl%@_`iH8fWTENdw9Wn-G z8SO;P$R70Qu+asZ8HBmpGcEY7P4Jd17cCyB(=J->AV=KXZhHT>$&e4QzT_48OJj3? z5#*SdXk?&&JYDN<+I_%xQG5BK02JcM4yQRQvF#@>8WAkshKZxCfXVuhsIb~TU0^3H zTp+502BQUOxq5TMj->Wyy;Zi(cGn0MIOVh_%0ICQC*c$e+pP8pT+?2Wvbe(S#wJxUz<98-?*zTEx715GxZF?j0TRf5ErXu%0( zJNtpS^MN25XgK1{+N;Ci50qA!w3wQT(ey_M_gXuv3G@i<2~UgUcnbQIHAMD7IgrT z%O8g)_9ES<3K1~@x2L#RoydiDW4e=sPT;yvTAWb_qA^AJCq_r|#T25s0mrE_BTc-& zVMu;W`X@GG$`a zqoHf%^A;D@el4vmHT23|O1n=s+LdM2`M7CMt#SCsP4A*67*`XADJ z8uGSh)7$@@QW$aK2OnY9`RlZd`tdwoyH|>V5hiVfg@80Kw_AA}&4h&z#B+vXi~2tu z<^Fe%nRp*9ick9Pjmd%!PnHre>g9vsc{2HB4eQABgMcw!%nrS zE)w;>N}72aGHdo$0p9qt(aV(;4_R`{4`CmV6?VFRJNi|oz>O_Y;#QVq_MZuA^D^ICww94x&y3^fVZ9YVE~frt(kG`}|kbe^IMX09N< zf1Jv6wJa+BV>({EVj^o>=fXVrHHV~=x3;}pXjBFtTX}OBSSG0g710ro65ksCy%N|* zkfxj$CDOR_fBnJ$X!k$+Ck2zuTQUIrdB|3}AJ8L6-TWN%Wo7=#04+IdozU&?Ln_Kj zBfc2`&wu9Xwh_fU*cqc<3`c2=IuYLUI_#$@-xz*KOwKXGI|Uvlp4<^NjCX;8-H2m) zdGg1r#tJPQyq6|III5DGB_Wkj2#m<+%VL+e$gS{FsvZ*MAEfZ%_90=p#4xhRUV_LD zC}C@FqdJe`JC;i;*P<5v@FG*jRLOt*(&}%Id+}@Y=w^0re;nx`$qsZGYh7=^84`-|%)V%4BXrdu-yTJY-W z51^L2#y*|Y+h*?cHsew2iy1Y&2K@2FBp^lmtk{Nm)0BW8M=S7V;|a?2mY-m}e^tTU zT9g8GtMGuST9pVf`Oxn*kRUuJl8Nl_6o`oyakCs1yv5O?2u;_)& zO-_4$b`l>tT|n+NE|%`+ouAhmN}UW>fhGwEncuWBr5f!F4yt_ji+^P&15?QQ*20uO z`a{h!H4zpHZJmnwe#uuFm-SfQX)KvNW#WG-jU{eWuVDrwZo~&&-ds0nJ&Fy+4ra~I zBJ4B*N(}!?Z$kLl9%g9$Us=y2g7lNDfDA-A6C6qf>^x6l*YLmooy_I1Df2u7CVKk( zRO;0?CC}dXUvHp*6K-;jMnc|wscvA5^~3vy|CA7#gf8n&ri7h&t| z=LMsGEiC|$wV_~z;9o$oVVur5w?dC)$g6xTR;lnyRAO!r?GVy=<{7*_EA$r;ETfqa zY6`tJ6~_u0iD1h*<{%(7^x4i1FaAF65U6T+lN3Q`ks_x%szN(fb|Kcu+jhOrusf60 z@J2jShxgluu3?c_5Ib$D@U9$RIFYjMFBjPvk!M_K#@_(YPnSM^kK=Uk#5Z2%5f5!! z)gR2G6=Z1shv+G~R z_a_JrsORnS`yopZb-S@%TB{V#!J}C$uashm{yzU+Ga=J2feQ>!V^Xy&6t&K)<02z| zEm{a9GB<+Z1S52vaWcm5g}=nTKB%@t<;ePXZAX?3;HFKYEsLKi$9k{y^zIOcFjXR4 zUgsV62dg@Tkn(2S>!KwS6d`d|+k5c{DfXvgQ1K1N+t<;qL>JM$FJObXgsZ1oPtEt^xyv};A2 z6d*2FMF<{3uC_^^4D9F-VG(AnKI5Bj`ba*OJ(z; zrvY08@{J-h>ZfNN@a_yfpf=5Fd#UdYgT^VD=R4LkMf1?>8VG~e5Afl)gE?tGOV+s; z5UGl~FegB$U@Lmd<=7@gqX@(5|G&r-I8_WwJY0Bo^U> zCwKl`NX2risG&D3WJtbSL6$|pi1$@5Q>rQTro-Z<_anyc_Z-g4L5oC z>$9Knyz3l7%BvI|m6z4qE}sJRz8a!L;uOXh2^-P+dltk2sj|<&0lDrI0l6qdAvezz zcEJdwWT}Q3-*q)cXB*2*O*ab)i6P4A9+ znoZXDH>au3IP_?2eqy7Lkp~b8{d8C%jdS<~3>Mt>!zJ$?ad4Y1tThjc|KN~(FXxi? z&${`e$upIGt!&?BIK{Jk9f`YW-9&XDWOGKR9`X;kekm~p8-YLXK;E9IPd}D zf*~{4(yqp+yzSHW*xu%n6p#Q_izDzJ+|O^qljHJ|>M#?w==VJ>?&_XFGHNtvCcX1_ zBc0Dd9@Pr6$@dvBrmTMmQ~Q2lXwE*rWB+g!ocqHO<_}Fj0v>O z$;p=l0gp$<5PCIUbuxK|L~U+z^(@P`RZG{>-D-}lZvfBHBH0vXlIxXLNjrS=3cxa& z%Dde=|Di{;^7IUPWqt zy&k?ueF7#`4n>1qzL@PTq&J+6s`_3rM3y`! zp@!UKTaw*5ri(hnewyRC1Ap#?WvU8;7X{@;9)X;AByDu5xqoLguHF2aui;&48YW_< zO^2NE7?)cyMY&E=-_d`(o8Qkkl=!V^1~@F1wgQ(DYpU%nbLAftnh|^s+P_X2QLvPa zycu`UQpxJH8rz$PE$d#n9xN{-Mmre)%Cv}Ji8w9lWz9i8v(>0N`pvg`-*q4@36!eM z#p6qi80`|J;cVk_pf9W8;wNrh0Q)DXGWcaQdJc>)Wx&W>D-PluB)VZHQn<6d zttU0SXp(NL8UG^-d3q(jy3uo%Yvj=$s~F|iw}wE$_KoneiKHt}W?6J!17@>&0ISgX zKW1tv?li(#xVA3siuMXyB80WD?iCdCDX45pNZ$(UPVQY?V~e^^QDTY2pmN@CyM6@6 z5OA?YYxEgO$+JEIQX?~_N~Mnl;3|K#mQTdS5Z}a{HfcH7BypukX~G2``bXAUjCUusrU--m1>c2Qk9{z!Isk%Y5(yufzM#ivw89SL4x6|QPf9}QFT zvxwtu#Y1HI5UsK;zBO*}4P7|f=!mdro3 zHezDxk32(W_NSr!xq`wZvr0^?qoWQZFtgpFQWbapRFkAX$OFmN^F5g-^rM# zf)CZD%VZR{%14`VMT>=#=M&EL+F)nfdSas%aYYVELx^MDC-^UTy{?y#9Llz_Kp}!(?uI)hWPOAu>vO=fXc31;u-~qy$x#dzjW2FtR(zC z?EAimu7Z?Zenk>O*a>im2r!;jKr%sH8W`nI=Ox;P55uyg)ef$;IC(f+p<&XKsGl5D zSgUbeoNfXi+JE}cZg?E%oq$*yUDulJT2GsA;1QU@s&Jp7^0f=o$#(1d2(K|84Qc28 z1mpW*f|RoH)p0Lc@L*R!M^s%$V3)oD8|=^~?_34OyAY`mpw-$jk=y!)DzjyEWtb+p zOH#bTjtA=gy|`{IZu+cl`BBx!B2tcNW%>3EL|oKxC6|V$WLyYUA&cD2i{trEH=9-; z6(gMlXAj41#rd;lTR%+>H770~NU{Z_LThL3|0{@*TLJ%P{yG4G^Y4f6WN^Id`G=wK zkw&EqA=OdNX!$uksg(2s;L@3!WAx&3r$14FG8(zJ^4U&(G8dzV`)QRfEW^)N?gd$-zjo?3@@!uklXOL$&TVT( zlJq1jA_sw0@~lJt;qX$v*?y*B=21-gg6@`56SD?(j~JO_b=)tEn$6U=-;XHZ3{gyr zwe3GqtXOg-lfuyzO};!|`>gGTU)NC@5sSGQKzWqalCtD%T*@(0oTDZMouggDGbT(( z9zil?#Cu0I5Zi=JeA82?+)p)&^Y^Z|vU(D{@MSX#CRcDjLjOA2SFhF02;nto_^;3E zsCdn<(rOpkCjPnVq)YJh>w?Y=(dl^}j3DGLlGxSPa?C;C?jL2%Q8Ce}ch2hQWyR#1 zKScME?PU^&i9QY`xvv=Y=sxY~%}}cZtU`hcp5EW-J-YhcJop0y6YIM;bJ-zxlU|e5 zeF8Tl)jp<+k^Ds>+P-^Mk9ux*{^J)6RtIF-{9+p!?a&~QqSpknZ6C>h@}Gt|f@dSG zE{!j{QWYnIP|aSKwt&0Maz>55JcO{XaQ!0i=0XKzng}(J_ApyxQUqayPW>4&kHu?j z7+l2+!FJDd$yK!$s46j~x2@kmU-JzhO^GS+@MUoO$MAp%(m30}{H*(*8_xviFEAbv zo1cxd?~6_#ZfNhz6x$t@&T)=(;W1TCx3Nt7%k2t?z<$6CP?}0Nx{_!RdNiA&~BG^)QA~A!JCVqU1Uwmj&SgbU*2%R)N%}6uqZ`pOqzcVKs2y z_hXmRQ)zRbbtQ4GS0g4dme3%t@>Uz4&g(IsW`;Ir6sNN?OhcLyLl#X{EpB`lJIoJ4 zp+`H8+et>yERGAvq!0&jW6*u=JAE)UU*NaPsB$)}+7-VJsfWDBqU=?!>%`{8Wr?31 zD)I((?g4Aw#;+}1|LJ!^#`Z1T_rDDSz$-%+*Tfx8ToiO==;q1Pi5pm45a}$zw}OMQ zX2@gm!NDwL!?8dTAEFlCfo1wD0Wh@>lh@>xpU>@s(f<{x&nCT)V%?bsDj7NHZ<$C> zHJja?6Avw5DPUiSt)1_ENCn@imIkLZp8OAtS8?+cL1>{$aCenjI7u*nrEP@;NeofRw+?}n}!2ieTXm-559?7%}28MLmn zT%RYcwxEoZ88k^7F@3PKUjTU(Ze@o*hhd994hqfBFoic|ps+p<**Hq3uiprKyk2t{ z$?p!=?Y&hC*jx`QJuoR%qy){_w-Ttw0=a&t%(M`eB0am=&8EF(J5z&XzT~pQy^;?= z;*jer2iYh-^h>FS$Q{N{RXLtSvS&V8kKfwZucU}mCDD_HEz&l_M`GR7w;7eb9I$tN zBx3&a8l$U&P8&n4*R8}uyL%L{{=s{!G_)pB8ugJL&VO^ZI=4qPGH6qt_+b+<^>b(d0{S;PI^Y4|7YCpyn zDrw3Jknke=qA@sa%ss#HNVr}xGZ!U$#2Va>u^)O2%cyfErB00 zB7Daj%)gImb}eeKaR|zUg&f>XwhrzTy0uEdPK1Az)o47BJUsqLVxnryXdId<-RpZ; z^!rcXBAbN%`>=!I?(x$OmqFXUnwZIHvWx(y{3-^qquEO_wf@Ym&F)la5c0&|Kpa=2 z9$NX52m9md-1Oy)TOR#;jR))1U6>8U+CnebL~idZ8;;s$$QGPfuv3-Icem&gP%{#5 zxgZU1V-xJejb5{lpRn|@TGWv7Ym?j>5`2bQXH%ToPq%Te4~fd%OXK?yx1>q9Yb z{Bk;LM2(Kh!z5IgNtu=U!(YQfTo^zGePq$lR>oOKLczXn z^6%g+>D=)JA)8C8*qrlmm+JlQy6)jK?XHqGK#8zyId!d-WnCVxIkjt;&$3v@lBkM4 z8&KAgqATDu%KNj3-~M)s8&<>#|97eUFFpzDpOH}wS+j;P-T%K24erCgi>$v(glmN7 z0mD#oSAMsPt@WW_yK^}IHekDGMQ{`P7`$Z?=_h;-jwl-yQzOf+%-XwF^Vu^GRJ-eR zahJux)f895TioeO=0me>Es-XY0+H12(3nwDU`J-2Azuo86iH$`w_g`}A8$S@UI_kzwuklMd)okp6DW+uXcdEM>VE6)`+p>MQYT z?&#^@a=rZl)vMGpXRh%Tg~f-_YIw)2;zd&v&5B~Tj8yi|8vxt)RYQW_q%XEeJ%o2w zDS-ve&{uvoClTofU#BS7jeMWnjjs#OD>%oPCHM5xy!zLj%-H{+KNla6S7pz=gGUR>Mr# zPy#0B7=l0Ly~WcqoUgo6ihJDht1Hq~;K`OM`yp@p(naVg=r)W5qXVOTVGpmk8&mlC zlWH!c_S)ixIavtG7u<0gP0=q%j{0^ZKcei)k4?`}ev_n+aT3>NiF`e>DGKt>9dqa! zKK0J&o?a(i?5p!yy+7d}*3;#lc)QX7+QU?|42Kb54ZHiU6jeEZcm8!ncsnzuTB_&! z;w%AF+s`$*NZFK#zdKaB>kX=LaNyEB%&4Y8c41j@DU0>#Ca>Ej@L}l+Q>f&e_{-Yu zjg1x9tIY1++rA>9(=mpl{i>IGFes2M;Gal3XE!(qDxE3dov+SDxtF`8E$%4X>7H#s zw*sCq6fnH#xEHQL{t96CSmH_?Cjk#C@j99LPhRAv1!;Ag((fLLFkapc?{senI89RP z@LJI-_&kkMU({ce)-4VI4b9A)EQ;B$#W;ulw*iBU0U^US*@W7Kx)l1~Y$(`ZFrD7T zcx43xu7oD(vJeWzKQzOSyvy#m9M~x4xmaH}$H|o|pG?*Cm-LTcRlXD%%jnV<`2jx0 z2}wa|7VcDiPF{Y;3!zeOo$@|jH!m3#wq)aa9oPX;?bD{p<>{2<5vn`;khaK^wWqeo zhq@y5`RK~T8ArVIyhMM-_DZF|1n&c;JSIbc20VGt=B*N?NI6cJERJ6ro40~ZUdPUE zF&mj?IGP8k11~75Uq6dPNP}93Bs;ve%(M2JYg^orvNhhbA6-2P%13JHS;g^B&y(WH z|1Bvz@j5@@ItqOenTs$k&$2X z#mHim*I|I~;8BfLSKe`BcYwU&FG!Q2{@Ci6j+S9uqju}r=~izdP-Snq>D^F+kS{!v_pqa{&f_bOGlZRrRcA*cx#a&Y{6ZJX{BDVZjFh zv9s^EQ&9LqzYKU#Wi#`Ql;H*uxYMbiDooLZ>+hJCkVG@#jiHAcr%(ZZk_=-%)HeW` zuQI$H&bCO>-H9Jsat`IDL*Q)j+ARmH&QV)9g-sQ{ZA4vse|)RhsXIYf4tE7vhkA0B zZ>t^nxBx+euY1sI-fw9)KqhLJdDCZ6UWq&<96gsLC6k;SVB05+=^u6LslHlI>H^C} zI$c?6);z|!cD3?J7v37aPO%6Im`Jb9LZrB+BbalY&eLv%HO-m+Qqs1}HCZ8wo zNOU-$qRz1P#fs-&zfMqV7pb7K9ARxa&=tENt~NN zOl}tD+Iy>$%uy-f-&fGz+`Kn2Llw7I@9h5BIB^VJ(O%3dhO|e`K3vvw)d%|Jz^?@4~r>?CAR^3boyh}TNtLjHtmtc=}cgMZ+ z+t*Z3WUmmsEb6tcqVtZ0+kstoxA}{b`n|D)+>`If12lUe@KS%@Tu=}fRGm7zls)g)mV~&Sdf+Hovy5~V**{rFuYdS}7J1&JI_@^I*LePM z?Auef3nRVjf330||Nn8Fj^!bJq*Gnt53p3yi}8||qgHIb@A*Y~6_jf)yeviWNqriP zsGhGZ7{7<=@Uk-xRTv)npqJ3_%L}e~+g6FG1203F`Tm2r9}wDv7h-SWb|3UU0OnCB^!c{-dtec(d{T39=q`@5g58V_2nQL@Fhbkdi`K>*)s|zdrQosUXR;o>`<@ zW9T`{oVsD=;@?bT9`Wm!e2X2VIK)=Kalu*PHnrt!pOTV;4HGb}RB@;P6wd%dTo8RI z1-M~pa(`JC$c2CvfY)i<8TA=oh(dIDKXmd<^YwnKhT?FY@aljwmtMeZy%jw_4-_v} z8@sw6^JBAF9D{Q{S6;LnHFLj{Ldlg{RinD%|74~=ci$+Qfa>o7`vpYq`9qcPD{`=O zf}nJk0{?)?7xjt$sTpzCn@XcQpfNKa=zFWCVYvVGzZ~?xX!<*)2+_8?M z=J=xZL#_XJB_Weq@#_v50`0!dOx_Q&9oqC_rl!%*YIOM}M3$Y@lsBaNoDo$#KMheP zoV7o;c?AfhW2Ocz_rio<9u`i82a#kupE8sD4aYsp#j~}`xmA$fG&i(X@pr^l4zppD zd)d(`Nd0b3xzu;JAHOE;;TKo`GZ+Wn13e;MWabJ%il%hfD)|iIV@V|lWXgXy`PH4F z!YkabN3y0&dn?P3?4&)hSAa4vtk!l~PRE>isO%lO&WiO)B4U`~Ja>{3qU=*5rXfpw z5c&--nJ(|=lDcCPwm@xk@)0W9Hlsux;bwgIE8qIloDriWPjaq&hizm-2?HKslC-Q% zSMyypcBAIT#-o&;LK^d=pRefUC3E|Xm^i)F+gTc%zjV-26eFh~b^PUJ#~(HWSoQL$ z3_h#%=OH^RV#mKa`A-u*g9R7C5E&nM?bw7Dp=JF2&q{jb7W#WWn@eB)a-IspNGmA^ z$D_F}bt}n)`kPE^woV5(L*Le4#+EQ1BPY9@r;g_KmDyGF#W|=i&-F)G{(~gHjFm&` z{o2s(FT7coO^2U^W%@}xPVFyX8V)`po5Nm;+$2Gw|^ z#Iih&O^r(DCP8+o`#p(y3uqSgUF0CK5vt>0&d|Q<8LP%*nC!?3+p-Z^_KSk^=CGti z;582t}%A@%?1~z-1j9(Xj8OLSajb+8at`vd>C=rZEen?PwY9V(-~IUH)|Ur@UVd zDw$UiW9GyblX$!-_MO0S?1!S;YagL4j%;WuuHso&20Z?(HkN;BM&z<9EKj9Hf_5=8 zs%@I0*LFUTzFKHh*TgKPmuH8EG~lq1f5)eQulejT-Hv z4=@!=9QY`ZYg4+>C{%To&64c+1WmWaely(kr?<$uj;Z$YXm=XBD@ zCq{xbHu8A;=VgH%wj2b_BGIqF_{4_gV4pms)mt)lG%_-AJbp=KJND zIgX<)7e>S;$q7mpFtUE=x*)dBy~q+)SDWx9Rl`$z4rr#t2XiPZDfRD-S@uQcIIhK?bWlr5zXAE;zsPL^#T21Yr^Fh zf^0acuh3n(kxG_mIwG5$7j`}#u&}FNVmOgG=o-7XjLvT2-uVZs1DvoM z6FvVl1Nn?U-bQ&kETXm~VYB_DOu%7E%NU#lWQq-HTb;E4)X7W1je)MNGFvwVUbAnl z`&a8^kjg+^1?wN@tPqs4Jum*5o+%mHd*x{& z1&LW>(Z``uIFnLFpF|I$UWKfcCW$6L4 z)6kTNA$+8&@d`|mJQMqd*E%;l@?fB#$>*hcSJc$pDR^PBmAiNriO=gR5^?|xi3u+? zxt)0Yd(@}=)zNeWIVZNa@Zv@GMf-ylcz(oOR2tFq>|ex`>}Mo_bXVtkZJ%u5-dJ_{Jw`Ud%AL@2Jld8k*U z>pee~ghmd83lN?JNG$J@5ylZZ+(C%WX*c^oWo#iCc?7j4F!HjINmXz_8nc7yoitMW z`uX0pIaV#`PK_)@X`Fr1f7F|#IJ}%rWG*lI`({#T8a2kRzJ^|F zS|G)XV!N=lhLx}+m^e7GhSNN8hkI&Fn zW7gx52Ti?B$J$xZGlLc@OR7D7Zhmqwjq}=2;$@|b$=nWcVNVJlFy~2s=}KnHc@|lU zeEoRI$kvnO(}=*=DCTIJInPqzT@=KZ|9-^A>OsFx$b<;}YeiZt5Nv#MGIv{-GI93P zRNfkYyAv=kuw}sZmOZ<1X8QEw4P`b-8rtlLQNG(p8L-tT($ny)>+Bc%B)1y5R9$6T z-`Jx?VFvPUje>x|();)4xN3qCx3bb0DJjvC!Ps__IAZ!j#hb_iLNFE9|0{lrcd1I|j840qRj8M0m#@ z(+Yd;wY#v-x*7-%?M?ZdiDJiFQ}U@Er60U`{?`2k%;``HZei$94{+a zx}b`0vc+aEqCuNaJqwq`a!Y9Z^kpr;oIltFQ6@vUuYs;!%jiK+_LQh;ya3Vu7Qaut0Zeu4LJjU_M4}xlW@luo$fFx>UWOcma^(Nn%maT*@G|2i z?|&yhn}$7!g4wN9>a+M4l$!#xU(leE$&R~k<(0uK5thl@A1(Lkl=zO5J|C^HPs+J0p76Ng?!QJ zql3*P=V$QVH&(|lc~~v|@DuApAI-o5sHqa8l4L{00UDqwz$?dcJ}>3uASv( zY$jsx6R%6576WEaK=VLF$Vbx?A&Qz7#(!uKe31AlvjJAxm`~fiXEx~rV|70F;kr$@ zbK?QBQJNuL4Vm*~K8s{{jKcC*)0~!hVeq6B`YH2ieJwI9s%`s%=5#=iA=kU)3jjxb zcj?H!V{FFCXSnXsS9Gx{OAw3edk;WFm<~`njF5cRMZ0>$MAp>QjN23x= zNMe?*fv+;UA26-*Div@Zn|2Zs&<|nGM%tk1ca!T}1iOaqGPA8}DoAqmf57Fp>kvxm zoC>38zUdp0mj*p$Jy%+H)oo6dLN6lQC@PHLCeYy-t0y6N1p8kG?#?inyZo#wwvX+` zjk+{$tMUqaI|tbBwoy?@`RTp&VU?|#bz9f#jJ*JqzEN2>{lL1Z)U605SK+OJjk4#F zNe-CX9x83QL526r0iJ30Y0@7?7@SpcR6qK2@VE1@Dt{Lmc$+rwXA}9H?LG~i@7kC5 z@T!rASIKm(kQzhAn89JC`-vk3#ySfP+ar7dtDh;5wwYvgY>VkTHrsPp&uxxTcj^2Qrvu>^gZ)~xyOS0zaXyaB;U_T(e3}{U z+Ox5Nxz*s+H_>;yZI9>kPk`d;So2*5vZ3>^WqggbT&hhoK=XzC;oqvm4l;>fA2{u; z(M|a#KQMvUCfC#nsj%S|l{-B`xC*`QZYrG=2__$+&M$`gHiF(GQ;{4%k{vvV0KxyS ztc|CU92SJ1`KRa$a>o;I+}R&x$}};*7F>}VzUBq_li{j;5xUeOi8b1;e$c9VR~iwP z^|AptGFBp3`{1==vIY(HeGiLiWEO zQ|{B9-qZNFn_Ji|=ecOw^>u9*p|DW4cOIaXv%3sCSCLMIXChvYP0huK>3{~Abk62G z%9g+ZK+P*mEoKU}iTF*;UQbJM;KltQ2Qx*qWAz9)y-Br!cgAr6-!HH5FF(D)jz~%e zXRT2D?XfHuphSf{@7G;dcX+R*s07C8lq{v=?$0$FG8NRfI~Po)e#J3uI06A zK-NvLdl3DXI7u#Dx!5lsOsNO5KK2d1-*^~7*B?(g6@)HhnXcn69EHf`)4N~E{b2v{ zjMrunbbj(drNp_K8Ljj|?OdF?JI+7j}i{qTlQz7zclj*11H zYEq2Zr7srmR(Hz|rdG!QiC{b16*it4d{r8aNv0+9jkLitWC&7W(w=3Ac>S(l6{K+z z@MZAq5sH(~{i=yu$1Av$ex~?6b$yq@Cl4~LYvD;>6}h)+kR?i=(y_}tl9#k)AVo*t zG4*7)rm{%>RTvu~+4<{P&o2O-65hP~9uRvA7g)`o_i(n1HIhxqqh%?)=C^=5 zd`~UFuO~qKFoly!ZC$t)D<~YSw7OOp zC4RZ7N#4t1NL(j@n7io4>T@!lkW-()@7?tgp#RibrMX9}TasX<>Se80yq9BQ+FWMO zGjgp1u+abP!4Kj8UAQg;;UMgNLD+Oj6jW-ohj>qIB6NKKBdr94a29inf5g5u2>cgi zdRQ2M;(#qkI!l$xzEKKV3Ieked#n0LoQ&o}`p0Io-ajT(viCET&Sa{&e9bk=-)+nNk%iqNxBukSh70NlgA43i z=)l4Cdg2Z{NL7F0tZ8vI8uvI&?GE~rbp@Y|2r!$N#ZSTiK*hE~N-D=b;FB<097$Fq z%!)9QYE-DC;nz3x2}eZxg;E-w9hO7Orq*D^qj!dgIsY|9YCv5pW2el@ht8+O+kMPE zzA~wLlzB;eJoTE#y$%r~mV{&Tmv16+aXm&6Dd5=97^XbR`IzG6(;MHzKn_~>doQ6W zkCrY!DXYVn4b;e#*_ZjDHa)ET1pDH_W@kd^7Q!^1k&#=QBZY+HWjULfK0lqXTlPR> z4IVx99g8ulMl?5*lFl{ zh))n@9?DdLd_IW(U+KkvPh2W@fUb??31@b!A)*3oZ21E_%%yQa-?I{J{ZfgJKe6bB zVzRwRCee_e!_dgyuSg#W7qs*R>~+rAepO*OD;+wBX+Ak8KDKMS2oGh+lN0Jf?Cyl= zYR-u5Dx=L#eVDWgjY9{B9j7L`y8RnbWWgM&e#SLu#5&#YeKBLpeMfagUxS5dMJcxrF`SSFX^^81c}ybc(vSfyIS zUY!ng<79us=yU!}{95!r@^Yx%su~|+-j^&uToGg?iz7--@OurKiQV{f#Ht)yP?+B7 zaM;JoEgB}B<>9{MgNCuO$7BI;6DNoY$r}4-Lwnl5P2;rwLdxiT!sCQo`Y*O1pAzD!WkFD6qhn-aUt4f#n32>ZaaE&tZu+zmGHXFP0wem>=FZq`*Vc`;Zr;mZdqA6CGc zjIeR#GmY9RTWQtdzxS}WM5O=Dq;>d zZZ=t2gw=hOc!-`x;X%*dUk{IBuhH+S*Ka`2qD=$4zVqi~x$OeMgyl6YYjkiM$^4D1 zq1=tMVWp`A{vn=wa5lr*$ZNJ{i|kdYF(33rS$T97Av#EkdUw~xBb>c`GcY}*dcT8! zDD!(8AwSllNTxtXrtVsC%m{-V_IyZ%2^JowamTqJx<*oFH2=Xl>l9lAzKF#4mH|OF z(mVh#AoOSgn?ZE-n9s&Xe(;@O593ZTe;Sw|YMT@RVZmyy!yD7YT8@X~rl04N7XZsi znl!kv?=+p*X#mW%NwzQsXH`uKD`4n5xpq2sFq*W&OSyzF!~>2n30LKf9rWYNU}BRjnt5CZY|H!i$jH0h zSTq6~*aOSIEaZ3(q!2g9*X}%LN2LO+Pc24+q>4CvbT`@)0doiFb~##qdeZfE4W2`L zGl&H z@k?ENI5NhpL&rT132ow-fG>q$V7v)|w`nDX)~5E6=bTsoI+~oNXuhZkdPwbH*b%%i z_)Nq?ty9a9{Ml{}^>2)rZ_wUsc#Rz|Wi^5B>pqk01HQ}`=%w2`cV0z9Jx7r{KQa4X zqr0a2sJ%F0at`t7#hT{i&7zP15qw{CBY#mA?ACI&b`jus&3G6b7Ek9WKfxaH1K-Lh z27dRwP1iS&gjvWP`cDrJP$v^%z}pXz zh_)yZ%Db?an_VN$-=yjcdw&)hnHb>SJV`Yxkkk*^Oiz}hXW}aiS z@J{h8X-R=89-_7(ShFjcf;}PjBJ-z>N+6}ahSu0zDjK$U81)(cp8Qk4FFxN9O~r0z zyp%yz^U<24Tlwla&?@!ym#4HF9VbJ8IZGb?{1}-~c{~>^L;k@7GQE?N!vc#s z+L=6Xy&Ll(`}L9@&+_^j&1pSwt+%zjXuE1LYUQq)h#~O}95t8mtMRGm{qF_EBTkP$ zCtv>}Pp<)q32~MAQZr4*9j|G_Pynv$9P65lP~xR=J*R3Wg7Y~M(wgyU6#Pu8R2K#P zmp=b>wExq?K}uPVpd&Qu7$bXQwwL9XoZji3o1~xxhpvVo8=R52bNS}n<>fmL9Oi9{ zJ8Pogmg-`|(l>O!z-Q(mmSB#AXwl_RXFNz1DI9ycb zRyG;}>!mAaZ)tBH!doi#JM(>4tuWXJfe|B*8SaycpGfuYh|L}}9Wh{rwEejL=890% zEtL2B1HLtLz>t4AnC>a*$xQRO=cy#^M>J@Kr~b5C#rDN+y*S@8$U}6+o+=l45djty z^=jR7nn77Wzs*Nq;fYCo_k5od12VQv@HGm99{<@c&O^%F zTt>^)1o!gnPT8jFW&bP?W>DH#v88k4S(FyGUE;wVa>LC`N|hll{|wutnLkm+By*7n zKc*K8`NiaM-nkU`P_~;r5$o&_V#ip~C4N)3&@;5anC-OmT z^5RPDCYxsZm5_p{fRhUH%JAayJcKxA$1rvW`;eb!?sZSs+eSws4i;oMFsXc|dHyrR*MaNTLhSY7>$Qqh<9aq0}>XEyKk`SO<&0aidt-fCehx|v`;Vf43*+M?ZINtdRG6w_1f z$sN1K*Hfh?kKX>rB_rk zkhjeNvxMO19-eYQn54qkfu+1tzfX z3?$;T+yk}~b5A(=XVoS_agJvp1|wYbF>#age`R~ z9xP;=WIs~Kz8Mb`e|#K0O}rWPIs321Ff11zdp@lSmaiEJG!j6Fm`MHVP37Wjiss{@ z_nPp;&-BPW;UC_X-olO`Gqzi1pV8Z!Jd-iafd3*|dS5BgJKDUJI_O5N8IX6;p%aYn zfy7RChnZM*b)`I=Cdpmg$LzsP<>zKOX|vs|U6(_lm}?7*%P-edKSQ?- zO!<`$v^?(W)c>#$+FIBmySAyvi37da`+Ws+{v{@ta;SXoqtBlY0&CAIH=C-PS1LZF zYqw&CyicD!@AhV``1}wbV5IIk?M-*uT}m!Mzx!BBScmMoWVd>i@8%#tGJAbI21G-iHt7bqe6(2Ytbzz4{G3_&s%35J zZMOLXd`(yJ>lt?@w>%-^yaLPTtCJ>pD$37slIswOl@`orllWssbEwsNKxJLWX4lX>6> zW#>6tQ6{NCq``GE+_v@XV-J>4-;Fo{<#TdJ7+{Db!scjDqn^%iJMK%F0fN*Kj^eRvzL_hYy znE53__z0AFYWG_&^I%IMZ-#7)+K_U}Rf-sZqGd&W*;cdr_4*;}g{s})8@lblyy&Hm zR}a&DR4B1j^{21J-cqHH`^Edx#aj?mILL$U1sAP3rw}w+7#0u4YpJ%8g@ccl_`vkQ zk3rIz`QE;J42%L6&+aoTHgnAvlCN@=l)!uh=e*0YNo=AdzbmQEnrtg2g>WD+_I5;6#>+lj0>sX}r4XP*G2i+Mg4o#< z)$4s_AGC5L*~%9CJ#Hnj&dEaWkxxX@haaEj+OdVc4;oLmNV9v}94GH|=f3Tz_R= z{TRahsl1k@!w1ZOe-wNXdJ+n1s$O8F*er(+1#;&CSSXlpN+4b){G`RyN{2rQSy+wqe1_+{e`iKz%zegyAY}e!i=iDXGAd>%L6YNeQ zC`g`3QwJ_G2NJCr31W7gY=-$qiweMXZQcAo*rR(x=J1(h*K2lcqX+8Dk@aAf$O#(l zB{?eA0xZRK(D=cb^F0Y?!m>9878`S^*gWQ!w%iqy^N;bK zFOH|$E$t8~d>Ggxv89tH0&Mcbg5t<6>*@B{XP2L;D33XWbZ8%w{d^Du?|tvSkhkz2 zHm(v_Ci;V@l)#ruP=aZ?e02MDo;AIeKPSy$Dn&VYwd+>WEo!A(dk@Ab;E78fMODhy z2=e|qcHP>vjo>9rYCB~i*6Af7Bp2hN*zE6`BdDzl_2>3}kY|{G^|*unZS|>g;B9|3 zc&KSkty6>C7~|c6V$BrGuIf6!H;os(;}2Vv`w_x8QB}v#EYG~#wH`jG{O?fQtgldj zt4X-`llxn`0SH#ynM~%`q>+%Vu)?nCrYcTkWcyT9Ox9=KGcStPV-#Kp=n})hU=uH< zbV7r3Cj6uW??XODN#P^8`hTovL&VL5-*fE?TF!0n;`Khd!W^GmDA= z(pLS^&9tDC^yfm8tHrAVhc^W$_3fcctXSM7!>%XyIpw|Mvn$O{J`2L^YV3(+W#`eG zb4%V;Y+2h49~J#R&PAKQj4WNXmW83Gdb@$%PbXobikMFJ9kuE8VgDnv-t~5=IZB|) z9|dwM@;_>^WKKg0vTTM1hk@r3;0P59L8Rqc%L+1KU4HX?>QeqMI!!PK`DgJA_;Cb# zaWkvo;E%N&IUgfUc3ht0KhB~nypF*rY=>TBQA(R^p4h3H&VIS}>&E_#;bz!wOPd8j zswR>Jvvp;jfMwb8Zx3dGhou2K1Ut519n(IiV=$Bq&zZlmggW*&-^f-DoF>pDz1gk* z3?}Ig)N&ytrJHII0eYSuFO9~IOuC!5Q*pt9uAOpV0+^VC{${TLao-?3uFmqsmi^$} zykaz{sVD1phnzpkqJA#?p!G$^0n?&Z0xafF<>F*lF*Z$vwc9Jp+qES~k#t#_QnuCY~N z2lUo2|8ymaSYCOBCWAlwx37O|0^~OL`-Vwwoa*K-^hFR3wzsFJ5rQq@*aubL9ke+_ z5n@$db6^`4(tNS9z;(!$1bIpkU*+jR}vC1 zD_KF&^(0SEt$4vA2r}X@?-#FH)@LW3^hV*b<*{Jiw1HH;)|l%h&0o(xU+i2b<~(Rl zzy1YCGKE{oQYBo9tu#9J=9TDd=U6~3v_a^l0f0{^Qvm2nA?3a=-OC;&L-pmf!w`h| zJhMX)1LD(%eZ?Xw+i#sXzLOuB?0UwTH7t zQ9!w{85z(zDMYJ$#6kJPssG(1Z$&ZOYI)Zj^$KmPy1b$>aHjt7|+YWEJ^4Ey{K|A zDO3g=BU)!fO5<48+?F_{->=UUka_S_YO#4Fxr$xACtS1$C*W zvxZoDdxDa}4T8Tmltn;?%uC_)Ff_HKBQUdX^9oOs4O%!w8$7ijS@Fp}D~f7!dbl~X z&u$bXH5RQ3(EekUBg8X}*T&1g5j^0!jqZ6POI;Z`9OwMRl@A#|QfpUxe>t}CNrs+J z$bGt=dq@~PY|M;z*WAPWp5Q*tl~Xf})07(*HQ;Y%7$uH@%=MP(%tc*4hcX_!aH+-! z+N-{$tAAqUe10D@UZ^ed{!@AWO|a$Dvz67RQ{MFA|Dg-4@ty)q6toXx{$p&uO}Rt% zhO|ybfKo~CRB>|@`X?RIBjK_CG7#bKI@14gN2uQgt9*3>MFWN;UhGg3ve+;&FIqQV zj@jvE<(_`!8p976ZfY_hdBY)Q?sS>~m&W_z{$*ZZK4${adx*a36Ft%)d2mm@Jz(Xc zcVja@T+u8Ee@XB~^_8Z+i$BmYTlmPEx2tmhojCjG848kd((hP1XOMiXU}2Co{t1SQ z-njZ&`B=c9%BEv(4CS$Ptr^Rg$(wd8m@24=EK8Uf00!w&Z(P0E4ohQT8@*K0ycaby zWqTjRufM^}bxC&O-kxpJZVsslT4}f3!bxE@Ji;!OXM7NKxG~DO$IWbTd4)F3HD|D$ zvKm=yyhJmzJLSeDlhMm{w_kS9mH}(8|jY;snHYfBtkLdUE67L@4ut~ z@yQMTXLE9zC$_h1$Q<5{AtNQixR5z>wA5{T9nGu5Sko4$?C(#=g+ z8;e)pcBE>WJhCDN78|1)3(Xg!2#Pl+9=B6ssl48N?CIg^oVv+e4855oyA;^itSIJn#7bXg z7q?-1*)Sd=pfCL5@4uHUxrC*IZCOr@;MkOqmy9I_a$yWO4>>eX-grnO7(8#x`s+3s zsQW#z2-j ziyb10OvJ|2=i*giA63f+he+a_^X8#=E@f9`pDWrlGfS!XX?{Nn730%6obWF48V?7a4#N!LwIdOergMF50hMROB9E zD-V}a&BwHdmk@&JE;;urq)=ZmHnH4cF1J(s%AfJE;}n5x#u zOoJL!T*ESE?u9RA+~`S-YN@GEGWEwex)0v5jwW1CQ?A!kI!2ZeAOeM>?Ak2_F>Mc2 z{vuZcV|jKDKMLyzj({gfO#blL?VRTmQ9_}iQ?xxa5bKLK zb#!m!rXQ4g7zC||(ow$zHVizMta1K6c21x~`a}$$SbLl=ulT1}uaypwDuf;^#P;q{ zCg*g=Y&ctt@Wjv;g0@@>e5sJ$li5DqO-m6fYfcr3$D%iZrNp-QmclKdA9lha!!zkV z8j9bce}jP~1}yF#=SRGh1HDg<3Ij#;x>Go253_{$+|>vCj|#SlWBeEspV$&v;odCS&HlfwVT$)BpFOqaOWQV@ zUzN5$YaPmB?MH$fVvy`uuzGqPAmEDUwz3B~AiuxHz7E!(T^w?dg$6HcEdJmMFxVsC z4sps%+gB`dwGVa}(8vWc>MHc;3-;NdgF^H`7LX#wM`aVmoFC$a0ar0?r-XNn z$qhBP%`A_o&rzkd&pI*aXh#&>ofkq~1|=({jcK9{8FYAUXL7Oo6{dy`ncAEEHA1u6 z9_+uKCm~l1%-A;G?()WzsAn7O21+uQ4_QvhHDNo9>sZ(aA!g1OZCIo|W{Tqe@nu&O zyA}q6)ZRx?m=0jC5A4Sa zSJ-^<$!~jVkK)%)k6ng>AZ(92MVqr|e`{k>7nDItp6Ti_%3MS;dT$>d|R`r^Jqbp5h96Aq1$gP+==b8V_hPJ8k zlk7>125KK=IpH$bYnDZP1$dWT)HA{7W5bd%Q`d8N{fvCO6hf}*+(8vaR;f|o`vGfZ z`eTP7>n~byag%Zl~aj z1h01GQ3B@YUm>s6mVl(4bf5FOgf_YOs_o<+4P?2?8#-xP93PU*HMR{)hVHeEj_0sX~8XKDSD0ksY&IJ?}XqUqYz=rH(>P5GuiS+o<2>%-RH$r zN7E}8G=c6paiXSVhQV=6MKd3qJX4}xas?wH$!!KQ@&F5di6Z8 zDfumXdDJ|ZCaO4jKMbjM_678j06lFm=H(& z;{lz@1D%XqQnwldidt9Ia^>WwLr?nYz>rS2+HAvzmQx6tTv(PLpSba%Zhgxo8B+6D zAjC;06umto$bx-pm!*i^l)QEu`&SYgdTB4Jz9uog}}jLkJ{LuEBuH$c46q8(0% zN>ra^IWY0ZA4|LK;5BHlvY8SERg8t9%H%*e4LZ%xlct!I4gxMOr#QwLPik~ANjZ=@c?wNZ40vN6P@XxSC#3zZG!x?NHXoPv4xz$BDWu^daa!A_l&LF z#S;_=g9Uu}AvD+O_G!4X#Jf0XoR2VDHA!fe>22FlYH@IglsK1kPB7i3GNdmu+-z}D*y zzwrim;*Gfc@z{~kOGeEjcC#9(+!p!gl^p@&39!fasn3#)>Jt|W7OHpM16G``hh_Yl ziz8E@Kdvtre5YvZ^kSP%u@5?*6{sx}Y2_l;{xCcByveLEj{mhnQ!8^yH8jUE)xWAp zLYI&_R&pF$%hI?zaePl?mF`^eLfN-~ca*g>Dax;=u%MjrM7`QjgJxrG3aRm7ep}Ug zB=|`Zd6d;MqMUn*M!*9qXBHShY-jRKoHqTEZ- zBF1pfsF}4w6V5>bb=rEa#Kia4Oz@ZD#>tpl=o6Of`ZO004jrdLTWU!C6nkI3CtG$* z{ED9H^vfZhsTBKo0NTf{FNdYy=^eArVY_toTk4mhNhjfQWS_=m-*S#Sd2A7P0c!th zOlfYt7S?gP%&uhIduxKb45V3O3_TY8O$;BA;cYCeRq{ewJXs70 zN$tyfe>A6h`4~*i_Fn*|X}_qU%HEu%zGLk{vXHi3=#}28A+MV+{T4cT&H9%eMuLCx zzwV{^@*no|?(YK0qA5wcdg{o=>7SBMktYl>4?EH2F=l@JKKzRw3sBQ|E`SDI0of8TnWqn?_$TA_{=R6q%Cl zBbNN6V#rX2R@sMrq$;(6g%|D2%SV@5`gPBQKcvH?T=gHB@XC42k>6+Bi56f?iZP&V z4|waPr2mN8F8QB@{RF>YPJl1R+>o|4H+=?1OU%7|Xy{){8Q-a|FO6BKF?4EnK~APv z1u9BLwvRqHH#OV>9yL2(!!-w$A(R5rOQHp&#e4?A97|Z1E100BK;_F zGO@qf(SjwlhS2?TB3OmeFdKn9fG?_q=~qtIAnvto=3ltes%)u~Mfs4*FcgG7){tJ7Ys38Gk}1M&nYE{tE|XGFM**8 zu4IO)g*H8;w}-#xI%nj2(Ta4klG^XoTlW(!MVOn@7r5aPT|8uC|7-dyOl`Y&4*@GJ z6lo=BsyIkHQWtXM!VN!^C`BP2k7AyN5#-(C@sol^9V77}>&7T{J7z^q3U;GkQ%^$Q zoLF7jI*dJw)QNuZwTI{}K9=o-i6%29zc?5%OrlVoU|U+3WD$#8XI5egJ?+_fFIl4~ z@Tu$3s+smrwErx_+gHpv-1;g^8&W!MqHCM7h45_&Vk2i4rn-A#8J9J2c_)X!-?eb{ z@xFV_sd++ClG>_&NHz^Wa2z@$FYd97c5{+Q1#s4Wmje z?4J!=%-XUbsaMkQzxYI=*3vuriwtka_i*hjDD07+BzFk%ra)_6^(>D|kg%S9C}<8`-nfcTXu9RL ztRyASbgngjUZBAU%e7a58GIB@d|_Pn9fPN;hpZtrW9#w$nLp|2CLq0}qJcJ*%kh*6 z=bRm+2K(@W>NdvgqM?Wex!*df%$Z?ZBQL)_`xki_gT)>Z1NfOa!}bnw$hTjl=L~Sk zrh1D9Z9VUCN}m_Cd^@PLp!&5b3ziLkg*04x^h%OXVh1tyGRb=M(r`zuG=r_3P4nJ6 zeL=`^$wQn`0Q(ASI-w-v^K%(mc!z$3_L(@J`o9|?+gfr4{SEu1t#0$P1e=G05-~WJ zR7mPsq08tz_F-8%a8yci*-^86<>!{qB+C>q5`yFJ$-IlLw!>rB&Vc8TY=+6B- zHrh|$E}prTM+lg$>WJd7)vtbu&=2zR8A5-9e#Iaa*BE!bZv6=aq&v#Xgt1WEX`-;g z2$&=A!`$$IpKLZExD|~kKI$Qg1lEWASd|pmT(iX4V3yEHW7-DoL`3BTl zqaQoo+rja}e~kk){%0OWlBT6Za4hJXWC_hX>As}33u%ee;nF5-nt?{G7dIcT3Z9gt zz)Xh&pSEYDv+YyUxiALDWt_IoUj zD!S@~rt6A>p_idd(K}cG;rHh!3TjmYaeeuV-cG2THa5JXkC)ZULdC()-_R^_H9k1P z@*3@J%X>0Oz2Bbp7j`K>Ci+LBZNQq~zOv>e@v;?m)oQag)$Jrjwf?m?vXdyIZSmzz zzq!S>Ik?>Dr*5~`1fpe#(37I-6ZI^CG>SKtt%6_7w{`ZZ`a)&y^wWBiem%2FD?hZ& ztd`Av9caP6LnXG^t7A>R@5rk0xLcY))mf{y=FRsR0Z5KqV%b)htDq55iR%RG_4lmSiaI+A5D)5W~^PrqF!h zo_mj8l~4}{OsK~tV@2mT%Jvj&ArF&!*UTg68bwJHq8Qb(Fj7pmxLGr}RRW<4sNIQW zAaLyZec-Os)c)>i?4QCg=}DOZ;&TUCmm6};O6{Jf6MNs-(>sIcUI z%~^m<81jqkCo9~t{hd;p@iI2<4{z`6L1iU(LdHGxc=rz>&r9CXKlOZ)q{Vy6&pCgq zv@Un((F52Rr=$i-{tm8R>D-(K_Yax38irmSdtLG=n?t$CQhqgar}rWg*Uq}7-LC}K zeqGUm?o?WxQSQ@Nh3^;@ptlOm+;C|q5% z^TS(%GOKrwesMAZ11&7HG-!nXH0yU_g|qNFsyH2L`q4@f^6MSkAbR>|FeF0330xKj zw5o_6D$v67Zg4oXo*qai)RhUmXX&33-U7Vd!2#8zSNlYQZ10P>VpjY41Xk3|XSYoZ zpW|JTbQqweAnDhO!Tr=F!uE8HM}_Ij<_szsmX5279p$o`%hxo=q-_U^3CdS@IQBn) z*77mhyS<^RPjiG3CNTH|pv96sJNenWhHHVsX6#6*905WALzO3=Z24}pfa7m7y6-(RxRLYwKAWqGpBL*MmT}Iy%q$kG zu`u=Tze0t+O}VFnTPx$bXd#W-W2Zl3*A0xBR1D_(C5uxO2->eB_&#dXjA^+w_-$t#f^e^d5TQFe3$RP1mnX&= z4>Wej-GrBOd!tc?1Ni`xBXFlTfsUE8XTy|q%|tKwd!GEDt3-F8M<&16O7wljl<1&J zmRAT+?ck@^9lj@jadS?S#|K{&==^&9#D*%eFA>Aet+R|UdrzXT)G_;}=Bk-d^J$fT z?Y=QZ5PpgkAw~%IIr-OHtCZtd=Fw#d9X;)bcoU`Yb{Zr6`1{*5dRaQCRK2*$Jq z0U-uQI)G~Yx(ocYrPa<>o-_0hNz;b91OEZ$^-9cl>!2cY&0Ndoi*4ES)pqwZ0p~W; z2L6&@JbUZ6FK+oaP#VO1<<`>Sx9F-<>S||acKt%;WZ8^FU57|NQ=8tpRH$E1rAytz z%M_^oLHVOqkveHpyXq9cnpE4JtfDf(xGuUmZ0}M_QMbCtcSoK7!!Pcq?&qPFEz)Ud zy&#dghlA8hzX^y^U0U4^^sm2t<(nye%I5=*R^(8%S-L#tZQ?$epojD@Y9*@bX)U-T)%)| zkNaAkmc+U`L`v^t8C=u?sWR(v35Zo6G_*T@Qks=XdCkSB(SJ;hR^@{M{@Mzo8P zS`npa!#HXSXBi%7vVX~Atvm0u?i)4J^@_bx9mYxh%{u*qKY{kvCZ}YOgU7W6-ZD~! z2@u#H)RRTv$e(uLK%X43_kiG6rfhMC%_-AjRhM4>uI7=$TE?3HX!6Kl*ZC@fI+!-5 zysD>P@_D-HoHk)InYR?wwfp`57n>Gi^YSnaFwGnDBzROnqygO&SBEyLU035#k3Zv% zLkMU$w1S36Iorq=A7j90U>uSmr!8}n-nB26Y(#jwM&rr#gCo6JM<}B)qoqvRc^5F_ zTq-i2zCrtynQ~^9L#PC~jWBgXj%H!*r}rJQ3$KJdoQ&PxZsH7UTEIvH%%oTcdgJpybQa(D3_%B*=a1wZ4{X-;{enthm zK3S{X&4QU{IcA*(5B#>yUUdmHXyxfG3I&dooqA|CT@TE*IA7m37dQVutD}IA-dJyk zIj0uEk~!n?{d<%z0Rd38%b9MQVW+fce{-J4g%hk1$S?4C(!SQ}2CY0%ArY0Y1`h`p-pIXZ?=-Amz?yfcQh+Lmt!W^(F8ZSv;zNAB5AKNp2x<(rhUJcCI19y@#ICH$aRB-SAQnj0IpIXRR> z94f4qitD*d>7)H-q|7NN#E?2N>jrBu#k|1p)Zw`wG8-6XazEzYWD6C0L}eB7SEw3?I$L(NE75Pb((5L;bNDskIjf@C64 zgwfVfnaSx~4(Lk9$BYw_gwEZ#dVRmhr`5KX)CS0uF`urNHtsAbI>21?e zEYrJ%X`}M8os6}e6 z7ijDuLIG}f+F7qj0zI0^R6F~GZ%NOw8x1vuu-o>Joo#xD*PA|glGo9zpe(r~n#VfH zaULLy!#wjv>(9UDS?5SUTbfKI!>8%Zl9mrIzV~rP-P8Vaj223YA@c8E8;Sa-hwA>3 zZCj>j418~%E1fS)Cf((oTSMR1BFplT4kGfNMl&jY74TQgQSXB}TZ0)Y#V9Ht#CT=2e6;cS!+;=|AG1|xqcdVwEp%wRo^#L5BY<#eB1QltS|EowOedTZWcDsd$yiT5Q(X82wEh=kV2oTL zp*VVNVCfqw7}EOvWLVMwWe{YlIip=%>Cd-DEx`PwCt%^O(z)w)N*vYgVe`IXxDq%^ zn>P4kQLQ_hfue#m@g|rM)_wMS{cX)4NxO&$?_ugaaNzX_1@?W!ho??2!z?pbTE1xL z)&@N#o_e)HV)ozw;Oib}$e;H3O2ACG21xB#K{)L7wippRqOjjR``saWm`h^bDO8G_ zayYxghLI>tCQwCgS8H_S3Cfi0G_kS20LFKYcGfjBgB9jdt_vP5> ze+*l3ZasLS%mhRmUWr@Dt=>LDtM zgq4DF@oDkKmGmhFIcz+)g+@v9owFs}e%oJ+Emf$rx~7>1?JRu5@P*9~$t%M09EBC) zRZy`PEWcM7tPceeU1N|g@&o;~!QQw@_xBjO>ppr<%^EQfe04 z{WkuL7I)41cqHP*%~~C!SxJO|?Y)@@%JbyzL;h-GX8ow#ti!S)%9BrLW#)!Lj;-l` zyl#}MdE7|TOB$1J64$dz1u8!W+}FQZ7EX>&J0mYoDb91rJ3RN&beWZ>NMwXvJxG7} zTcI~_&@ug%Qg~N=HwJ!JKw%Yd(P{s*j}%Z+(VeoNX-gjt?1nZw^iF$uY*Dm%W8Qb~ zH9e@OHouimHS&}pOPVb{!Fk7xeBM7v0-T6U>>H3Pxp{fv8neAZ#RuLy!h^B6AQR#9mKpvNmwG4Gfdx*l9iM13u?h3tDxcH#*rE6lJmtO_HVp34*P@8G z)WZ~n7G>r~Qyiza7s!@^?@2VEp;j{&UY{QR^iSE2R^ad42OhWApT8oNKvh_=bkL|C zl9 z1l64{QK0rFmJUY5ivOv+&sX7U0em5eH!Ab9C9QHMWWCiT8U$i2+=uM+{Z{Vlxn>w) z%FNdW@^cB(r(HDmxDi`Lv-x&zJys9FY%ij^&(oQiIu6~_t&sag*Oi!TG z9uK?cz1)!S4JsC?Edb+Xn^`Jq&B|XDBaW?jx-MfM=~K;rW%~%uMq^Nnd@0i6{!MX2u?$U{WtMz{nh0;oj17Kww4;XW7S~do8#3xBFPk2!2vF*%XzhC*XKwnwg{B2;yXx ze-lK;t_9_fN;KGsp8%^RZ-~N_H^N(Adv@5UGLN1ta(zdI-AgR+74$fRhZ?xYw$f0< z2l3&GpPzW!|9X!N_!ehs{yz`C^?>hAVF?IJ=*4FQ+x;^NnVZ{_F&v_vaP+H>(iu8o znTDO-OfZ5-0~^t(puP=Uz4Tj-2zsi+u{{KJyB#8rW9U?tD<2x@F7))rZLROFp%()o zR9sv4Wfr&HGnw58>_)0j@JzObjvAT^BLNT?23}KkWQpQFd3Ifo@e-%Q{>9PD)b)4uzm`F28vw+rw3%H?IQ<(_gF( zc{jU*J@xV^UPLW<$DHFxvW%*KR9?laVrk>Jx#vU>&O@nuV_@Dx{%r@BdgBQv`S43g z*_HDsn&ZoFdsOTpvVK|pzNJaaYr1y$DIk$MHs{ju?j>VjK1q-! zOMQsz(rd$-mM_kJwjN9;?8m(HH2zr_2id#4hK=FFE5@|#bq*W}hGUfXAH;){qXZ;n z$zaX0KUZi6w?wp?dnvHh`B56_5kCp1t+^tlEb&<--d2cdJ(oRc<-rQ!+B_%NPA81@ zx+mC?HN`X?&g1@~K9uO`!E zZ;wA=v9KJeK@vLQ#s?en%*#6U2e>e^U_;5zg_RWGf&i~Ac!N6fC6mC24Ed8+M@3}n z=~w?zv{kJw-(_VS_lo^jmq!Vu z0!lhXUglnQq1>N?33j|oHX@@bN}(8r`X8*jN>Bj;`ZUYstjDho5e<(8{+8k$slyOFGO$7F8D_dGj)FTW7kJV z&mmfH_|KE$tTMSG)^0Lh(MJ@oBOxO0Vc?V>PHd$95lEr)ZHL!&ZZv`6D_fnvrfU`M z5-#}s-F(uEct3dwblQ>K@G1g=0YxAnxaScpw_csb8l9io90=znWDspu{S>u*USZEM ztodqwwlv90-***SK~S4cc=C380KiFhy>3I_+g3-dC?4S5?l$^zy&{97saC%+L5Qy= z95iHGF`6U^iWwBZ7MRp`>xY5 zNB4Gi(NT0X?@?x9O8k!l@9N9Mc|?^jhGq)X_i66#7tT@H3XOQcy9~*`xY;Bak%{cI zol2+EE^D4L2Gr(on&3j*FGXtTNODY?#A+l;{Z< z)WJxd?p~Nr^)#{Uc3ecKFZI5DF5eu!XaS|?aj+(V2-GyjE*Uw)8u?@CPewl3Bdm5x zLNVVdJ*V72rwAFdWxap@b1hfH`UDYW0}o&Q?1iww^O*~e%Yo7S$L-rk!`4Ows#6mx z3$TWqcNDist@^)=p@ZZLbZ0Wgf8ILQG9Zb#U7gxq*Ms_3OmC_|XcK+7FU|XOGeica zWT=V0jWsThGdQi$iiC3@>cFvMdREjQ#@XSd>v=vkbkOGTTzc7Lhr^OEO2jetc4dW* ztm=xYP8a;|Q`ZsG+xc4ajBk(`i$`CW%;bm7B(E}awZY+DOESeizy70dzsvOAEm@eI zdVKWYZ3w{mNZn2=r!pK^mjl-7qKb$9{eDhBxi68D8|MG&8(#&KK9kKB{aueB}PtVw;BVtMqJv)io%7(r?7d#ry-YpWlbX6eu$u9zfzlHrIc4 [!NOTE] > The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. From 400d326232510a283d1f8e02e0bdbafb8cb675fe Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 20 Nov 2023 10:46:30 -0500 Subject: [PATCH 193/237] updates --- .../configure-with-command-line.md | 72 ++++++++--------- .../windows-firewall/configure.md | 75 +----------------- .../windows-firewall/images/fw01-profiles.png | Bin 66504 -> 0 bytes .../images/grouppolicy-paste.png | Bin 11914 -> 0 bytes .../windows-firewall/images/uac.png | Bin 204806 -> 36445 bytes .../images/windows-firewall-intune.png | Bin 143308 -> 0 bytes .../windows-firewall/index.md | 2 +- .../windows-firewall/rules.md | 11 ++- 8 files changed, 44 insertions(+), 116 deletions(-) delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/fw01-profiles.png delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/grouppolicy-paste.png delete mode 100644 windows/security/operating-system-security/network-security/windows-firewall/images/windows-firewall-intune.png diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md index 6b8e4caa04..9b251dd9d5 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure-with-command-line.md @@ -15,13 +15,13 @@ Global defaults set the device behavior in a per-profile basis. Windows Firewall Windows Firewall drops traffic that doesn't correspond to allowed unsolicited traffic, or traffic that is sent in response to a request by the device. If you find that the rules you create aren't enforced, you might need to enable Windows Firewall. Here's how to enable Windows Firewall on a local device: -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh.exe advfirewall set allprofiles state on @@ -34,13 +34,13 @@ netsh.exe advfirewall set allprofiles state on The global default settings can be defined through the command-line interface. These modifications are also available through the Windows Firewall console. The following scriptlets set the default inbound and outbound actions, specifies protected network connections, and allows notifications to be displayed to the user when a program is blocked from receiving inbound connections. It allows unicast response to multicast or broadcast network traffic, and it specifies logging settings for troubleshooting. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow -NotifyOnListen True -AllowUnicastResponseToMulticast True -LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ```cmd netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound @@ -71,13 +71,13 @@ Use the following procedure to turn off the firewall, or disable the Group Polic For more information, see [Windows Firewall deployment guide](windows-firewall-with-advanced-security-deployment-guide.md). The following example disables Windows Firewall for all profiles. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) --- @@ -90,13 +90,13 @@ This section provides scriptlet examples for creating, modifying, and deleting f Adding a firewall rule in Windows PowerShell looks a lot like it did in Netsh, but the parameters and values are specified differently. Here's an example of how to allow the Telnet application to listen on the network. This firewall rule is scoped to the local subnet by using a keyword instead of an IP address. Just like in Netsh, the rule is created on the local device, and it becomes effective immediately. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Allow Inbound Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= %SystemRoot%\System32\tlntsvr.exe remoteip=localsubnet action=allow @@ -107,13 +107,13 @@ netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= The following scriptlet shows how to add a basic firewall rule that blocks outbound traffic from a specific application and local port to a Group Policy Object (GPO) in Active Directory. In Windows PowerShell, the policy store is specified as a parameter within the **New-NetFirewall** cmdlet. In Netsh, you must first specify the GPO that the commands in a Netsh session should modify. The commands you enter are run against the contents of the GPO, and the execution remains in effect until the Netsh session is ended or until another set store command is executed. Here, **domain.contoso.com** is the name of your Active Directory Domain Services (AD DS), and **gpo\_name** is the name of the GPO that you want to modify. Quotation marks are required if there are any spaces in the GPO name. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Block Outbound Telnet" -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -LocalPort 23 -Action Block -PolicyStore domain.contoso.com\gpo_name ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name @@ -140,13 +140,13 @@ This command doesn't batch your individual changes, it loads and saves the entir When a rule is created, Netsh and Windows PowerShell allow you to change rule properties and influence, but the rule maintains its unique identifier (in Windows PowerShell, this identifier is specified with the *-Name* parameter). For example, you could have a rule **Allow Web 80** that enables TCP port 80 for inbound unsolicited traffic. You can change the rule to match a different remote IP address of a Web server whose traffic will be allowed by specifying the human-readable, localized name of the rule. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallRule -DisplayName "Allow Web 80" -RemoteAddress 192.168.0.2 ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2 @@ -188,13 +188,13 @@ $rule | Set-NetFirewallRule With the help of the `Set` command, if the rule group name is specified, the group membership isn't modified but rather all rules of the group receive the same modifications indicated by the given parameters. The following scriptlet enables all rules in a predefined group containing remote management influencing firewall rules. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Set-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Enabled True ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall firewall set rule group="Windows Firewall remote management" new enable=yes @@ -213,13 +213,13 @@ Enable-NetFirewallRule -DisplayGroup "Windows Firewall Remote Management" -Verbo Rule objects can be disabled so that they're no longer active. In Windows PowerShell, the **Disable-NetFirewallRule** cmdlet will leave the rule on the system, but put it in a disabled state so the rule no longer is applied and impacts traffic. A disabled firewall rule can be re-enabled by **Enable-NetFirewallRule**. This cmdlet is different from the **Remove-NetFirewallRule**, which permanently removes the rule definition from the device. The following cmdlet deletes the specified existing firewall rule from the local policy store. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Remove-NetFirewallRule -DisplayName "Allow Web 80" ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall firewall delete rule name="Allow Web 80" @@ -268,13 +268,13 @@ In Netsh, the authentication and cryptographic sets were specified as a list of The following cmdlet creates basic IPsec transport mode rule in a Group Policy Object. An IPsec rule is simple to create; all that is required is the display name, and the remaining properties use default values. Inbound traffic is authenticated and integrity checked using the default quick mode and main mode settings. These default settings can be found in the console under Customize IPsec Defaults. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetIPsecRule -DisplayName "Require Inbound Authentication" -PolicyStore domain.contoso.com\gpo_name ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name @@ -290,7 +290,7 @@ You can then use the newly created custom quick-mode policies when you create IP ![crypto set object.](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $AHandESPQM = New-NetIPsecQuickModeCryptoProposal -Encapsulation AH,ESP -AHHash SHA1 -ESPHash SHA1 -Encryption DES3 @@ -298,7 +298,7 @@ $QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "ah:sha1+esp:sha1-des New-NetIPsecRule -DisplayName "Require Inbound Authentication" -InboundSecurity Require -OutboundSecurity Request -QuickModeCryptoSet $QMCryptoSet.Name -PolicyStore domain.contoso.com\gpo_name ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall set store gpo=domain.contoso.com\gpo_name @@ -367,13 +367,13 @@ Remove-NetFirewallRule -DisplayName "Contoso Messenger 98*" -Verbose The following Windows PowerShell commands are useful in the update cycle of a deployment phase. To allow you to view all the IPsec rules in a particular store, you can use the following commands. In Netsh, this command doesn't show rules where profile=domain,public or profile=domain,private. It only shows rules that have the single entry domain that is included in the rule. The following command examples will show the IPsec rules in all profiles. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Show-NetIPsecRule -PolicyStore ActiveStore ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall consec show rule name=all @@ -384,13 +384,13 @@ netsh advfirewall consec show rule name=all You can monitor main mode security associations for information such as which peers are currently connected to the device and which protection suite is used to form the security associations. Use the following cmdlet to view existing main mode rules and their security associations: -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell Get-NetIPsecMainModeSA ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall monitor show mmsa all @@ -414,7 +414,7 @@ It's important to note that the revealed sources don't contain a domain name. IPsec can be used to isolate domain members from non-domain members. Domain isolation uses IPsec authentication to require that the domain-joined devices positively establish the identities of the communicating devices to improve security of an organization. One or more features of IPsec can be used to secure traffic with an IPsec rule object. To implement domain isolation on your network, the devices in the domain receive IPsec rules that block unsolicited inbound network traffic that isn't protected by IPsec. Here we create an IPsec rule that requires authentication by domain members. Through this authentication, you can isolate domain-joined devices from devices that aren't joined to a domain. In the following examples, Kerberos authentication is required for inbound traffic and requested for outbound traffic. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $kerbprop = New-NetIPsecAuthProposal -Machine -Kerberos @@ -422,7 +422,7 @@ $Phase1AuthSet = New-NetIPsecPhase1AuthSet -DisplayName "Kerberos Auth Phase1" - New-NetIPsecRule -DisplayName "Basic Domain Isolation Policy" -Profile Domain -Phase1AuthSet $Phase1AuthSet.Name -InboundSecurity Require -OutboundSecurity Request -PolicyStore domain.contoso.com\domain_isolation ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall set store gpo=domain.contoso.com\domain_isolation @@ -435,7 +435,7 @@ netsh advfirewall consec add rule name="Basic Domain Isolation Policy" profile=d The following command creates an IPsec tunnel that routes traffic from a private network (192.168.0.0/16) through an interface on the local device (1.1.1.1) attached to a public network to a second device through its public interface (2.2.2.2) to another private network (192.157.0.0/16). All traffic through the tunnel is checked for integrity by using ESP/SHA1, and it's encrypted by using ESP/DES3. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $QMProposal = New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -ESPHash SHA1 -Encryption DES3 @@ -443,7 +443,7 @@ $QMCryptoSet = New-NetIPsecQuickModeCryptoSet -DisplayName "esp:sha1-des3" -Prop New-NetIPSecRule -DisplayName "Tunnel from HQ to Dallas Branch" -Mode Tunnel -LocalAddress 192.168.0.0/16 -RemoteAddress 192.157.0.0/16 -LocalTunnelEndpoint 1.1.1.1 -RemoteTunnelEndpoint 2.2.2.2 -InboundSecurity Require -OutboundSecurity Require -QuickModeCryptoSet $QMCryptoSet.Name ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall consec add rule name="Tunnel from 192.168.0.0/16 to 192.157.0.0/16" mode=tunnel endpoint1=192.168.0.0/16 endpoint2=192.157.0.0/16 localtunnelendpoint=1.1.1.1 remotetunnelendpoint=2.2.2.2 action=requireinrequireout qmsecmethods=esp:sha1-3des @@ -460,13 +460,13 @@ In situations where only secure traffic can be allowed through the Windows Firew Configuring firewalls rule to allow connections if they're secure requires the corresponding traffic to be authenticated and integrity protected, and then optionally encrypted by IPsec. The following example creates a firewall rule that requires traffic to be authenticated. The command permits inbound Telnet network traffic only if the connection from the remote device is authenticated by using a separate IPsec rule. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Allow Authenticated Telnet" -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -Authentication Required -Action Allow ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in program=%SystemRoot%\System32\tlntsvr.exe security=authenticate action=allow @@ -476,7 +476,7 @@ netsh advfirewall firewall add rule name="Allow Authenticated Telnet" dir=in pro The following command creates an IPsec rule that requires a first (computer) authentication and then attempts an optional second (user) authentication. Creating this rule secures and allows the traffic through the firewall rule requirements for the messenger program. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell $mkerbauthprop = New-NetIPsecAuthProposal -Machine -Kerberos @@ -489,7 +489,7 @@ $P2Auth = New-NetIPsecPhase2AuthSet -DisplayName "User Auth" -Proposal $ukerbaut New-NetIPSecRule -DisplayName "Authenticate Both Computer and User" -InboundSecurity Require -OutboundSecurity Require -Phase1AuthSet $P1Auth.Name -Phase2AuthSet $P2Auth.Name ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall consec add rule name="Authenticate Both Computer and User" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb,computerntlm auth2=userkerb,userntlm,anonymous @@ -526,13 +526,13 @@ For more information about how to create security groups or how to determine the Telnet is an application that doesn't provide encryption. This application can send data, such as names and passwords, over the network. This data can be intercepted by malicious users. If an administrator would like to allow the use of Telnet, but protect the traffic, a firewall rule that requires IPsec encryption can be created. This firewall rule is necessary so that the administrator can be certain that when this application is used, all of the traffic sent or received by this port is encrypted. If IPsec fails to authorize the connection, no traffic is allowed from this application. In this example, we allow only authenticated and encrypted inbound Telnet traffic from a specified secure user group through the creation of the following firewall rule. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Allow Encrypted Inbound Telnet to Group Members Only" -Program %SystemRoot%\System32\tlntsvr.exe -Protocol TCP -Direction Inbound -Action Allow -LocalPort 23 -Authentication Required -Encryption Required -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\Server_Isolation ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall set store gpo=domain.contoso.com\Server_Isolation @@ -555,13 +555,13 @@ Set-NetFirewallSetting -RemoteMachineTransportAuthorizationList $secureMachineGr Authenticated bypass allows traffic from a specified trusted device or user to override firewall block rules. This override is helpful when an administrator wants to use scanning servers to monitor and update devices without the need to use port-level exceptions. For more information, see [How to enable authenticated firewall bypass](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc753463(v=ws.10)). In this example, we assume that a blocking firewall rule exists. This example permits any network traffic on any port from any IP address to override the block rule, if the traffic is authenticated as originating from a device or user account that is a member of the specified device or user security group. -#### [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) +# [:::image type="icon" source="images/powershell.svg"::: **PowerShell**](#tab/powershell) ```powershell New-NetFirewallRule -DisplayName "Inbound Secure Bypass Rule" -Direction Inbound -Authentication Required -OverrideBlockRules $true -RemoteMachine $secureMachineGroup -RemoteUser $secureUserGroup -PolicyStore domain.contoso.com\domain_isolation ``` -#### [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) +# [:::image type="icon" source="images/cmd.svg"::: **Command Prompt**](#tab/cmd) ``` cmd netsh advfirewall set store gpo=domain.contoso.com\domain_isolation diff --git a/windows/security/operating-system-security/network-security/windows-firewall/configure.md b/windows/security/operating-system-security/network-security/windows-firewall/configure.md index 16f030a03a..5035b95c09 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/configure.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/configure.md @@ -1,13 +1,13 @@ --- title: Configure Windows Firewall -description: Learn about the available tools to configure Windows Firewall and best practices. +description: Learn about the available tools to configure Windows Firewall and firewall rules. ms.date: 11/15/2023 ms.topic: best-practice --- # Configure Windows Firewall -This article describes the available tools to configure Windows Firewall, firewall rules, and some recommended practices. +This article describes the available tools to configure Windows Firewall and firewall rules. ## Configuration tools @@ -85,65 +85,6 @@ Windows offers different tools to view the status and configure Windows Firewall :::column-end::: :::row-end::: -## Firewall rules - -In many cases, a first step for administrators is to customize the firewall profiles using *firewall rules*, so that they can work with applications or other types of software. For example, an administrator or user may choose to add a rule to accommodate a program, open a port or protocol, or allow a predefined type of traffic. - -It's recommended to maintain the default Windows Firewall settings whenever possible. The settings are designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. - -> [!TIP] -> Create your rules in all three profiles, but only enable the firewall rule group on the profiles that suit your scenarios. For example, if you are installing a sharing application that is only used on a private network, then it would be best to create firewall rules in all three profiles, but only enable the firewall rule group containing your rules on the private profile. - -### Restrictions per profile - -You may need to modify the restrictions on your firewall rules depending on which profile the rules are applied to. For applications and services that are designed to only be accessed by devices within a home or small business network, it's best to modify the remote address restriction to specify *Local Subnet* only. The same application or service wouldn't have this restriction when used in an enterprise environment. This can be done by adding the remote address restriction to rules that are added to the private and public profiles, while leaving them unrestricted in the domain profile. This remote address restriction shouldn't apply to applications or services that require global Internet connectivity. - -### Rule precedence for inbound rules - -In many cases, allowing specific types of inbound traffic is required for applications to function in the network. Administrators should keep the following rule precedence behaviors in mind when allowing these inbound exceptions: - -1. Explicitly defined allow rules take precedence over the default block setting -1. Explicit block rules take precedence over any conflicting allow rules -1. More specific rules take precedence over less specific rules, except if there are explicit block rules as mentioned in 2. For example, if the parameters of rule 1 include an IP address range, while the parameters of rule 2 include a single IP host address, rule 2 takes precedence. - -> [!TIP] -> Because of 1 and 2, when designing a set of policies you should make sure that there are no other explicit block rules that could inadvertently overlap, thus preventing the traffic flow you wish to allow. - -A general security recommended practice when creating inbound rules is to be as specific as possible. However, when new rules must be made that use ports or IP addresses, consider using consecutive ranges or subnets instead of individual addresses or ports where possible. This approach avoids creation of multiple filters under the hood, reduces complexity, and helps to avoid performance degradation. - -> [!NOTE] -> Windows Firewall doesn't support weighted, administrator-assigned rule ordering. An effective policy set with expected behaviors can be created by keeping in mind the few, consistent, and logical rule behaviors as described. - -### Create rules for new applications - -When first installed, networked applications and services issue a *listen call* specifying the protocol/port information required for them to function properly. Since there's a default *block* action in Windows Firewall, you must create inbound exception rules to allow the traffic. It's common for the app or the app installer itself to add this firewall rule. Otherwise, the user (or firewall admin on behalf of the user) needs to manually create a rule. - -If there's no active application or administrator-defined allow rule(s), a dialog box prompts the user to either allow or block an application's packets the first time the app is launched or tries to communicate in the network: - -- If the user has admin permissions, they're prompted. If they respond *No* or cancel the prompt, block rules are created. Two rules are typically created, one each for TCP and UDP traffic -- If the user isn't a local admin, they won't be prompted. In most cases, block rules are created - -In either of these scenarios, once the rules are added, they must be deleted to generate the prompt again. If not, the traffic continues to be blocked. - -> [!NOTE] -> The firewall's default settings are designed for security. Allowing all inbound connections by default introduces the network to various threats. Therefore, creating exceptions for inbound connections from third-party software should be determined by trusted app developers, the user, or the admin on behalf of the user. - -### Known issues with automatic rule creation - -When designing a set of firewall policies for your network, it's a recommended practice to configure *allow rules* for any networked applications deployed on the host. Having the rules in place before the user first launches the application helps to ensure a seamless experience. - -The absence of these staged rules doesn't necessarily mean that in the end an application will be unable to communicate on the network. However, the behaviors involved in the automatic creation of application rules at runtime require user interaction and administrative privilege. If the device is expected to be used by non-administrative users, you should follow best practices and provide these rules before the application's first launch to avoid unexpected networking issues. - -To determine why some applications are blocked from communicating in the network, check for the following instances: - -1. A user with sufficient privileges receives a query notification advising them that the application needs to make a change to the firewall policy. Not fully understanding the prompt, the user cancels or dismisses the prompt -1. A user lacks sufficient privileges and is therefore not prompted to allow the application to make the appropriate policy changes -1. *Local Policy Merge* is disabled, preventing the application or network service from creating local rules - -Creation of application rules at runtime can also be prohibited by administrators using the Settings app or policy settings. - -:::image type="content" alt-text="Windows Firewall prompt." source="images/fw04-userquery.png"::: - ## Local policy merge and application rules Firewall rules can be deployed: @@ -218,18 +159,6 @@ By default, the Windows Firewall blocks everything unless there's an exception r Once the emergency is over, uncheck the setting to restore regular network traffic. -## Outbound rules considerations - -What follows are a few general guidelines for configuring outbound rules. - -- The default configuration of Blocked for Outbound rules can be considered for certain highly secure environments. However, the Inbound rule configuration should never be changed in a way that allows traffic by default -- It's recommended to Allow Outbound by default for most deployments for the sake of simplification around app deployments, unless the organization prefers tight security controls over ease-of-use -- In high security environments, an inventory of all apps should be logged and maintained. Records must include whether an app used requires network connectivity. Administrators need to create new rules specific to each app that needs network connectivity and push those rules centrally, via GPO or CSP. - -## Document your changes - -When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. - ## WDAC tagging policies Windows Firewall supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/fw01-profiles.png b/windows/security/operating-system-security/network-security/windows-firewall/images/fw01-profiles.png deleted file mode 100644 index c1aa416fdf989c32dd3d6f18bf9c5083e098c2ae..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 66504 zcmb4qWmFvPvMvx3ENBQ4+yVrL;4rvbfFQx$CD`B$?(P8w0t5)|?(Ps=hQZz4<&u5& zCpqihA9t;nMNiW`U0rX4T1z`&qNNs21Lz`*0ez`&^>!abisP7mdM z{srrxBq0n_GD5iX`~m5!|0nlkiX>tBs%~gDBu`uz!#C;b1`xVx)yKYyyp=pW7 zPJk(}#eSQ7aKsKb-iCW`rqtTyp%U7R3rmmihe#O5VQnSajrX(K&6Oo9DHpYijtWB+ zuFmpAEO$jAyIygxB4#KbBpMHFGZJs6nEi$Rts@wCH(DRV-bmUAavq)twW9jeROQ-Z z!ixY;Wkz0I{_}gXo;sh0Uc&m-5QU|u+k;_u;H45WGr=En`^tD9>aFL%*D@T<_k|a0 z)(#kN>$TN>u`oARd?)sKYFpvRmes>+XC7KSh45~=+AfG*%aX#B9V|)Mz+f^`&fspL z9X_#HU|)S{curd^X?sVLHi4TXh3@uZS&JWWSt>JIlHMUtBl?1Dz5hLkAqjsIfoel* zU-iZ?-CYLTTu(Ky9A;-f4mLH zCd9TCoB#}vAr&IoAq683CC5-me25^|dHmY>{fKzEfcSn(f-QZ1QNcZ&*R{`zuZum+ z=3!dBlGCJjX}aaeK=jr(EtXXiFLOzISS2AbOdsA;T5kI5Zj-d7aXJt4TB8nK^(X3c zYcc7T9ta_4Hf3JNd_>|r>KbHUUm9x!P3AuBYA+1Az`?!%g;3vU#+|9|omoRhyCQXE zmdxTouvg=>Y+F~uG`)r2-!|qAZlg-ls>nPgFefGR$8e06fBDLyD;N`y6}+*-R!Gvg zwFW7Xg{t3QbXz{^)Sgd|dR;nhJVXH;HV#H}0X0XP^F-w;Bspo<_C01Q1%;R?>yx`s z;f3!^OmejJ>lThR3RO0*H9iJt-D1!QhiQ~PIJ{>uHkx4YNyJTk7Q^_p& zS(snpT*1S{#Q*s~km(;=cNBm%Cmp-M@ZBfjar_xYvwEG+A>yDZYZ?dPEGBxd42>sS z65w~d%F@;5oJk1gnc%QBn&?{}`hjhiE3aG=Pl+SSwKatuA|)O!v+^>^GM7;N!NYQD8wkXpX#mMuH683PS`v2iyhH^ zl#eGo9Z7TvXu}BUR;!6ra%ZQtKu~b2WSq?br|g47L3d2F#T4vDJ>&Dl94E@f$uM z%2%GR*!_Is%Slpa#&uw?7%-(#v<=6$!!(S=3jR>%OD@NP-&KxH0k|00C}K8LwW~Hzfofq6;3WTtb3t24U5EFZ1Dn-&4%|4!9>A5T;xLZIoOCk zSO~tCI{-7%tIDZ_$2OnhWn@H5PIw*f;6|Idz3mZ4JB_PCzh*p|x`jlN%0L|?d62zN z^W^-_@aR2@cnrp1TqC}9tHCkuf4xpvn$)9)J!o>6SnZG@lxuD_h22Ru+{JU$@~a5{M~R-r;r0?F^`t*hMvK0pCtqT3OiZKqzh~_j)xKQEg|kgX;cc#_m^- zvi9{ZLn~j}zRHKUH5mRx8`;>JyVx%=zsLk!phG4TF}C@nTSE#$Jj zQy5Reu3(t8VynS$xi+r1JcAum-6{s|#~?}i*-Eo=daC)r|Krr~@`4Sx!Yy+=%*_DS zlolK242}so?KOW+gkn404Au(H#Mz6y@WyxZEv_e*=E~x3R;jJGX)&YrVd|OKd9n8% zy&llQVS17Q;6}qw!KPq&goCqBDORERiuXgDn#peCce@oE9>@uD{MtsjJC)XXwM~j- zGXYU}E)T?UUQHR*beC4HzYdkwd$2|^_BDfO>k3Y}bgi4H zLk$JXFEHT$N~hZ@@avF#KP<`XU~&Tu1x86g-Vs^zaW1GCkX!82%w0uYQ>=e~efA1X z@|YO;*L|eJx^r1PuDf_F)8kI}TW%_RdQ9rnK`gcu8in*xZv6n`j1CyeSznPGgbrB}JIO(TxxD`(^VW zan4kaot&fr+uaZFSdJg`3_nXrNmW;upodo$x*vC(m8O2&oE@Wp5HOr_z7a>&J)KMR zhKP${1Z%)mDdt%DbPzo$q98^7owNLDeY(SN@6^M%rp&!sFV#2f{2-jX@*e~8O_@>P zJHEj{ZuB7l;t^m6$3GbBSg@^E!@p^IXY-QG^x~xg28@q4Vi}}+Q*F#7hSmLK1MZDGti>?$#^f`F}r%l?nq@e0@i-`Qs1?L)Y&z9>}tjkRJ7Y_Iz07Uv39z)DO zl>XfJ?;QJlAov4I5F0a}AEotAEcyR+F(o|kU_O9`oYE*0`;Ui`C$yCt_F{;MT5NSN z{qxSx7!wi6CtD(lJQNY>3(d>F4DvVj^pT`ue$FqVm@)J9$0&b%o3OCndS6U1xv(&f z^xskEx7eggNZ|yWXo{jgfQhJFzOCy|GXdhoi&Y#C5tz7; zhC%nzy&gn9{X11YA1De7N?{ApD4{s1W`5qx=XTPedRkh>^;8scl9zY#nduW{)kXtT zaV(AFu0JEj{d9{#X?vU>LD7Q8--Idt5DEU9cLxo5U$L7~9uw0>MIwFws`Q{=L)+Nf zGxq*`D&v}NOqSs7P{8D$dR&wzEu-nsK7B27iWz$9Pl@a1ff19hYTDqBsWdg|D2}9- zP>MMpqrMtlq1l$ffc2&VPPUoca$nz{BKRw$#4LIkWctlJ-{o~ZAM6%nD%AAFc|&cK z0qd1T2bKJumdGEB(Sc|;q99RdpLo0A-~PI6_;|`yhR7XX2_@g@MQoO*Dp49nSifbTEaG%Bp`T|M5vqn1vS2EE-%#YVF=^Aw@5}W=V zM>UFnWA6X>+5*<|<7qOJD2m|ARsoa8C8CXdtpi>w+Htzw+&~H%bN+Z%VZ6+@r^V~2 z+`NoEg!I9EvU#EG4JGiHiwjC{X<`I_7Je97a6+NvlTx%=Qr;o5z9R7q>yC5UYBc-e z%e7S3(?bNLHomz8{QYcE4gL|j1pR%^Z$#_t($Fa?P-ud`H-0fTQAuJbwIlI#?4~4X zE9^ShxtET##8Oq87t{WiSNQy-E_2$OCKbcfa$}Kczbbd_K>7L%Q?<8iZ7p(B>s5cu zemv8RpBq-QZY(_b@C|kf-$VK>L>#lvA{h59nLVx2C##B}_Y0mP)hjgmaGI4Dp`^G+ zZOY0P6|UG-YLtC6zWWH1KL3h8=fZFWKYsj}pP$z;1@mX5vOpva4NfTu%>K9gkz!CjySFbqYxv|Z3ijv`Z1D$J<$vxY zJ^g)C6Cgn1&zm%!ZxSBFo&Phs{68<=moH^%xi&B(@B#iyi~k8?WXBySOl33%5OnsK zRm}T8t7;5H2A`a$hZ0VHr;_zv(&fH-8boQnd_)k6$Tr{Szw^m+I1)wpol>qUXjWq# z8YbB^qwF#x$vYN07*|A$|9IpwS15Uhv-5@S<7v{b3q{F^@;*^e2WvPit}I5ccyJAtG6$xwjcu`esrf$2!V>TBBEkkdPr4~7z-yakc| z2!-c7Z~&kh=(L~u>1Gs!!>ILh%0ky|C#R&b)@&?`_o&I?V7{7j$>S_RO=m}p%v$^U zz!pUJ_B$`>+!Z58`?f&0N9)@KOh3d~Z7@NmT28Z0=-TDZW7wYs$$5mN?&gldnt{5c zWi_h?xE9KZj!!QFxOH5sx!P)+#Sle#I7RFDQ(e~Z9{VLal_sbG7|siJz0YN}uh|>( z#+5*Vh8A)==)EIT={&_N9=iLz(vuGkLC2wr`SKr=!n2dkwO0XY(8JFA6K5>M#lQ^l|V@%-)K1>>u_A~DBq;eZmM*MDqi!#D5VEiuFp z*;*(N67q(6b#2XjoaD_L!)gr%oUl2o!~K0LTU%ReYdLxO#X7sS%25DaZ7OS0N$caS zND!LhzRO#E(xt4Si$7)*$3}i^qzii9Q}za&TblR~`}! zpj5~J$i3asbyEnCKUi#b?+M3;&EqJ3${jc;wD0UeP34f$MYiMWD#D2beJd_NqcCO8 zH<3FKA?s2jKyNxZ3T+XI9WL-r0SjBv*arb~^!}eZ5@ zQj>Y}s^CqKEPKlEhlHs-4TbmpsF(T3|H|giR3ioeenAxTYSH~jP1n-266-(}x zR^$5x!iTCF!FHHuc{BaanZ)39_{d<9IcQwItNVUNnwLyBKtkI&WFpe9}X(8x?5H z&kykpLSd}a8;GY>&XWfNJb5-qhf~-sFZbtWv>YM^FJIu&A)ph>c6|P6AT2#W*<$wb zokljscp8oW_4QiR4)LcS%rNNr7aeJXGPt@QCXG|c=o8n9FI)+5X9bWE9#n`8&9QZe zUWEdSUd3&6*D4e*mHCD3%`BR;{t}ihN*KBQOjk9+5!dzY>3nS!wO1f+-mq2x2E~&D z^$*L$KqP{_QUGTot|V&OWV+Lg{m4i}GwXS}*~%!@tc^^^m*BL#eY`s=EG)FNw7hV8 zNaJ=`c;`IIf8}unb*{QfA!feXNYeE(q0{v^>3%i|^S7%7g(X=K!7&O7I25vui|mvtR+f zNHVD$0nv_{`KCxdrKD?7i_s6t&%mB;efydD||&zNa*6xCX{jFdzp zTt=ekuMqo35=5kfBhE&wh-Ho390AMFAuV1BT<@V9^C*55CKGKd#JI!(om~wJ(9XYS z*E3uFiOY1C(fZysmNSLn6*6J?Chij8@(Khh*MBet9|WP|ustw|3t_K(vfLo9TYh3B z09MP0*x&gXbDuv4<$spoHlj-y`A-#TYiR|AysjUl8iG+>Xwry6@1=y2(pcu;%f;{sHPr#&I}I#jr9G~I-33sza|$Vx}Oz%aGad#m~A&-GF^2S=eB zKT-a0PN-npT4iC5we4(~4^Zfr-+F`1uL6}qv#9D=6~qh$@Yx_gRG@b6p3_udYBRHTv^H#y^?x?+`>651>=+m*pI?BSld?92@?g4Xv(%fdquyUozO3 z$-<2RJ}MFne=3;Wr!10uePklxu>_Ya6j2fB8M3T%P5!&26h((+3H|x=XE1Tb3hlqt z^t;$pL%hEz1sUIwbJ#8}yk+=bFGz~P5C3=^Bye3Pp?qHEo%ctsg@HpxA`Sh7h-~n` zPLsomV&WnHual3Mg4io0Op^b`QqMa^8rp{Uzo6K06ilPU1oVo3U6)GI&)dJP6P*zY zkdTl7`}!~81=lhAMn-I`thzGp`u679__9t&0ZhJG!PF$fD6%LPV%$E)qqtJp!E&h_ zV%!*Ye>q5ugx&z_!bFZI$D-}C7s&NAG1_gtf&jc?-21T@YFod?oPXzB zADQy|#r@-xQ^-N}PxT`?sxLCJ-vSU`n9t}A8VBA8N!5D-3-4J*o2g{|P6Nr1{^d0o zQorSxf^ZORTYdb0wPZHu4R5st8kQwxMqL#O-=ZIuPT3Jmmta!wAvi(uezGrI->XOz zdhxX6F^}91i|;*l1G ze!=`nF_Mdg*u9Ni@fE9*?yB~!!m0EEjuGE^1=dR+m)*k1J0RGNf-;-+*U82pNv|uY zak|n3J;mxF|2#Ek!SUIye%sSIJ?t|{&#CLh^L6iGArRs5Vl4a#vUn6{xX>?RvPM?2 z;<%@3IJ}rlWO?azu-oR}uWVrvuy=(p6L0ZY=R2`?t#ErmV(+k3=svA4wYQ^SrNy$5 zVVppWn!@fSJc|dhM7_BT$~L;|8}smIHaVAE#5`HscGzAUBWdBsMq4D(J{uA#;;Y=; z?z>TNiTZ42;JEZTa?0h_kC=JUWLJbrv%@D1o#47Z=alv`S%wMtj#7UwlNqrE zaG*JqPLNp(u`Y@n(0X+0pXHAJWPcgZFgl}qzhmj7uy}ei`lOz4c4un3bg4C;eTO?a z-KFXoZ@)T-zgBFht&I=r)GBd&@M5vT69C1Er{(Wm+JafV_=ucG3TZdr1c?_A-iXl$ zh;u3JeX{x8sR^h3t5dV_@}ZTjdx%QPE#WoKH#ez%HQ~nu5s(d4CG#4;O=nmVq{yDf z(xKgUP^wb>>Kj#lQaCoi?Zdx1H#?fdNm^ag&AXWNcFZSD-fKNcB0)Dat7&8BOaelD zZs$J_C`gnE`8|RmO2TJl#NVO^835<)dzO9c`8$9l@#GDDoem`Mi@>e|{E6J#7gBf> zOCSZm^;H>9Ci$Cep1KO*Du?q~eW8QISiK-eAGX&e+1kH2Ha8u2?~j(sGUrZ(YT=35#}79PA5UOMYrZ|Bb^!tZ)S2G zbmMmzR~#+R1%_27b`kQt;_eJ?!usE84orPRTpsR}+>`|t3 z^si>*FH{)J@f%=pR#wZKw&vfhpzrie#B~j$joS^e%&D<0du|j}44}YA%4pg^8`5e) z>lL6UR;UaP{zj&&e?O9p)Q$od8yQ^avCYll-CeHyh8oH2eCHUu03i{#{caWh0!}1@ zn8y>*!{V>%&b!?4x0iY7rsD)SX5obW5_pcm!@S!SOxk0P){&)DgxK&0762~F>F;6R zsWi2!&fZ?XA>J1d-J?E}IQ5B=fq1Z`4JYSc6>D)v%urM-7=$WGtWSXnFHH(xKx>nv z@lI5XEF>Vzjaz3tR}Q?!1g;9&`!A|5)2Oe}Hl79@gNp`SJt-zKG+Z;PKt#oeLR~4R z_BQL2H`wAHUxTA2ja~?HE%O1k;}%}(NB4=xf6o3XwuqAcirAKsggEMlabX^pe)N1O zFMrAK$(oj#8ipwmP@QL>6|{zW2;h7@Q-sgGv|0D#&3^G<3-&XYCek)ot5(ugkDk0S zezK`wh3JFxgzC&_|6l-`Z@H$AT;EpfJW+Y;QB87j96%kuB=-jNw#kzp+^UPt|9SQ0 zEBR+a=vu@Zo!o?8qpMis;*r{&#H~+Rx_ACm1+CfvWi*ZUJnwB^APVf2C1zg4bSMRQ ziP$2xg;t=4gyjqRH^aM#kCBH0rt~vFsa1x5gsF5{FS{180UTB^+hjF#Yr&b`bk*SU@H;>1ME2~)r#ZU&P0;NXJ zL)*$abOC^wLQ0nM)6j9bt45W-g68U#?Jvr7?fTY2qsC-k9(y9 z3PFk|#4BK44r|QTKYTXcsBJRxNoGabn z*|}YD0#pVQa0|q7d>-o4kJALub;NLz%Zgt638P_c3?VX<%gokP;o&qP9^4-vY!kAe zgiw8_srx#F0Puha3kMc|6CvRnwpydW)QKX%Pvt}=JW z1og4F14sI91g;uz)(+(!)9Cp3gtphf&b)sKm3+YFP zy?|i0*WD@Ak%a2ZI~R%``udKM8`00JT3X3{V2L%5l&8CYC8_pOB9hPK$@usqz*uBt za7J0Qc;ET8(sS@ZMtn9~26O=r6zvZ`m^)Ov6E`W17{_?Jhze)(Rh*CaFvr8+KQ@2r zBBWmFTc{V#ia%2XIpks2!C-q5xi$rCmj?j{2cs2Q8r4R%snitl5>dS3%-M!y1~ zCq&ig4^|pam9HAiBQs)EcWahXM#%jgwoL7Aqx@QFg=N9xUMg|ycN)^!^IvM8)~dCp z_fP1@)tx3A!W(DOAJ@~7`opAD9RXWZH5)0<0~$;QE&_W*u4=mj?7Ws|a6UNJhpR4m zj;-}wGvAN1deu~Px8`y@aX5zb;)olV`$4(pzjCaMI}UOYr3x_QHUjS9S3=(lxEhPO zeKPY-~X*t0E4U6{gUA@v7BSYwn}@+NJp>y(WD2 zQmhUsU|(h7%LW+TL4Fp=Qgh{Gys|~bHGjwuQyJ=y%4UGs0qdnP0wEPevO$26u+)+# z%RY#$)x=HX6_yo`jpTQ(Td1XDQA?JD7$A9R?8!%^ZZ@@_lq>YfFB03$CDcDC1)GAA zT+Ek>v91_t-Z2QXW@poUj710dv#io|Yy-pjnQZC=?e5;9B{6)FUhsa6c#Z~VfMNIG zkCcK!JE8oVg2q4j@j4NI)P}cnU_R*muldf#uw;p_#T>EVdbB0~V_zcv%7Zz4P2vnj zDc6RaWPv_w*Lx})=jb%K?9U=c%h=qi4I$)#kz9F|IcwJ;HJfPJ5KdK*-ZpR}2vo|x z(-8)Z(^DSrMt>rqK9na`(4@d=-A*ob@0RG$#BJ?AQsGi>lKtI}rnKrm+`?PDz%YCUszqP5F@L-oHzqJD_5l+P3_@p@5e%`vd(^I-QI^TR^ zRWC98h(^ho=n`1wymcw_K0`vTOt0Tm2B3FabR;I&RFXEr$OhSZMZvT=G2qu&-G)=P zARG6Ty_8UCwvi@#nLZ4dO^a$}KBSBNN@;-D*nW`u4a#Uh6LSKW7dFLj4lJFfBdMXf z2)Q9-0MX3R?yIPHXN#p3B10B#`s-_(F>9C&0x4{Jm~ej>meMurX{H)X7&E!~a!gta zIpp@z@Cn`n3Z=9^`KBC^L5i_GEYKqa)!aBf;t0_piZa9ME5OS=BA{5J3geLxg6#$` z0JiEBKe!nNjO@Do_sqHdG*xUM*`Ap_I$)rdtZY_X5!rtK;oQkOAln=&rIO8_yV!?h zds%?h!fpJ66M>=pxhp=+QN{n%B@(BU>&gMn{ZUybb8QT(I$qimw08KVZF8?h=Jt*4 zMw2tH45M4@f7->gpfzM7&@onxm`}znN+F?U_Z?u&9V$>8_D$H}eUwG}lU#kqVao1j zs~a&Zh@a;j?8N9;gl>R@RNbN2rPp)`Gn^qSJ4Y;3et`19cR@cmm^C8K}vN1deaSF7K`o)v~&gLMb0Kw6?y( z1TeUj(S1|S3l)MdO+HY+V3EKXSEpgm@Ve;AXU$OS9tcm}Fb7B*`On)BDe6E=%U6Yp zaRIB2VXF)fa8(oMHcEAIjpt2Y-oprPlNh=gdj|vO^tTQAodW{^&qkw6KFTVeRt0F0 zfl=WAIWoMSyO#rxkf0d48^cL$hEXzpW-b5-WfM`%m}tWhuf1amU^*Dtf_{jp|NgrA zmxxDA=EL2@TZ(}1%eHXy#w+HO4V*i!;77`d>LH%=RXMkB-Joi?=n449F#$z1$lA`cVxi`l2E)C1bygQ;g( zy<|hTibK~12yfB(AQ?_42D!&c(23`vmtx1_r1y^=DPffP!3rQ8rSSmk8ezAnx-BP4 zk_^N*IFQhwgU!eL!{8ZX&aiT8j%DYnc^f<`9aEfBGMeEY=xQn!{^IMaNScz8PD>a-O!zUA#nGWL;Jf;VAdnUMnmq$^Sr*T0{0Y@&pj=FY^>1!%m&1_uT>tmm;grrR+vfMy*|W1u91{=P)do`Hp#BW;TS0mzaRF&#^ zTioJC61rvQ8U6ug0N%)N0?&I1K8-cyz9a%!Q32+TJj)9a=6{$y!Sy$S;>zn+mQh5n$zV0;j%y{m%}kCs0*22}@tdK2jN-@k9$!JSqIe`7PftW#lrp22)> zHS`Yir?_=tf1EEwlFSYk@_Th*p{w`z+^jb>9HX;aP90oPR-B-xr{{5YFtn6!B4clV zo0)@{zo8Jy<+M=$;yNl1on&szrs=wg;>aXl=NzmxokRiCu`g;4hqu&i&{S+?4 z$mg>Bb!$iYBrkF@{}$KwriHUeY*tO6sTV1joKO)yk;{Dy9ai>#o)Ihzcj+RSdDOx0 zs+AR-YX7L9?-VSC=M%pouFpW8d}TI{C$GSs!9%zB^=2c9kJ(|tXf0pa8O_XNd%;ja zd-^FKrGO1Jj|6Z0_PUD=RKGeMAEVPMf~t<;;e!qMtb!;ci%k1#^v)?Z3fk= zZ^7{Uoy^J3Zk}h(t%sA=GY&6IMw+&leJGwgR>iG6p!pnHxlK0H*U#kk;L32`yCmy$ zkM^71NU+Ds*@rpj_7*1L6jCG5Q9L_ks0FezJ8wqS@Tm2Lr)n+I*MR&hd)v?z9|&~H zL;Ot$x5i09niS)ro^v?Rh$%mZVj&dc5cy~>1N#Q7bAT`R$e4UtL}B*VbO3p>_cPR4G!1!m%$fu0TJ0bWdl^#i4`;b|d=zAFgD%R?5Ck`UO{P?&&-^BFSA7{UO z;t+OI_x45!vjh#KFNX>O)N+U$AkB?T0##3Fo@}5bcSj~jx}*-1L0Rlhi@FD{r!x!B5M=J!{|i& z-RtR(Vr9CT@fH)<+_~(SUbaG0vA)Ca;V8JW8bviABEJ9d&%B4XB&mSF5)+P1Esm|{ z<3d8bA6X)k>WJ3yiV!5PKmwQVDd1vxuQiGIyhdoQ-VLLMHLk+}cUGtMX%t}lpy{eLC(Mu9!LBi|P2`IPR4?$MEO2aidRRg)_fz8 zMEAjlI)@p5&j18E$W|TCWAAZh66ENLeveK*u+3d`?%Oow;-{q_x&1N!%flkj|2d~E4 zb?rz>-%=4F$UL2``z%3Kb!@?I8(_;BP``!M^|>Ijno4!XB60q0GJ(KiL#E4=KZv3f6tQv%# zr=0UWQ_*+ian^-i_K!qrWojp{)TB9Fad};>+vz5&noD<@al6Sv$m3t@Aye8k9&k{_ zM#KKAwT;LQYkvHlFZwv1+F>lg*{kMJX0WF^11#`pRd|tRr=_y-Na0j1wbp~8;*aMG zV&lIXDV%NpHly7;MO;v;v3oU@!{@pt3%uNifLy_(QV8|DOdIGL;!F(};y5|#Jq2-> zhr9;WHk!J;bi8qQt6>z=51OsZCc`{Y;M-$U8JVj=hAK{mG^~llWUrJig}w%R;px~~ z=OaT}bu_6f(*#Y%89p%nPE%;xr>5pDfxWps+@?Gw>8vJRnfn3NQ*zms#@B2-t5Pk! zS;3z`Z@!cKYY0Y=4Ayn_J9G50OR?Kf*ALITmcl}?!-fi_!)4KHnFkUBT+>&@+m1dy8IY!@&)(Z1|dg^f}d03Af+=jYNl+@U`Y?eAb z4~C$*>)st`y3x5aB|6x+n|7DxPEB#=Jj|xnXtdtmX}{cRDcd(leY{${AnmU`JSl<_ zjV8M1Tbk0a484t9izkq2xxG_y{`{!}uYT>eCkke*xYRLSCz$+rI0^&K(JsqkDSsHX z+7jLBapiiX!>JMZgM3l3HLC_a<|^63fBUySI>K!Rs^giD*po(mliU|2N$XnP#h{`N_MI zSFzzKwIXsu?J{EOyg6%UNX2ta;&I&<;M_c6W+j&l+?hV{q&7)U!jkR%{@3s`d9e4@ zmY9q4^|Dc{#_bT~EY3zWw*a$xJ}P^Mb?eC2Anb!+QUanMo8&7h$Z=w|rP z)T?6yJW<+Oe16lqMqpG#c2|9lr`snaxeR#|9`?w-5FpNF&i_D*!_9#gGo<~_{} z6H7cux_S%C0&)+`ol$Wyf;JwdJ3Xzp^ru1umZs8__#Hc1+B8U$cWm0G%+n|;%hG0# z8DC?5HT?WzL+)DM`~t|-tOZ=|86fXnJosVCCE~T42M{3hv6?)OveS}qOa?^O(Yb%8 z3c7~6Mroo)0eEXJ3o1b_$G$I|(FN+QkGXZxiFwSnzZ3w&>RV_z9w+<4TJIg8$}9S; zMSoe%F;!V_#%h0r9+U{t&5g+Cx$+3AyJqi=AlV(U;&!?9Z@2%HaDAe<26AS%`pGLo zg08+c80F|y*0=(>&7BZ`G-)pp)2%C_%**n9J0+QZw^G zmka4lrMn+K=yoR16JJLB%c$JGY03z{^U=0vo(d;HeRh8OJtB zM4gu`e-Xv5_3@xXQ(3$Lg&e>LjjklswiovlnWonVGHL@c7AuXzuxvUFA}GON^Um>D z?&ua;lf`CQsSQ6fqGc3J9GTB{5-rREb`Gv( z9PR87WOGHVH!nFvB!cG5Dw1Uruf2+&>aM8KTU1>~!!i;`ieSY4A`hNx-)$#XE@m!u z_-B~mVaIB6CY0Fp`8PiQ`5T`Xyg&_682W*+8f?6jkfhVheS|z<%wrXq&u3hheJ<@h zVei_v{J!k?xH!3bRStkJ4Sq60BXQrhtaYgAM!ge?(#`)umv}rD%+DWE0EsN0xA}0& z5^mF76w4}Rt~Nxhxg4X|Av-CXuChu|hqR+0$VF3IRqIGR=WYaXo6v8rUn$FJp0iOo z;cXDvG)%n0ea(Nn=S6L!>uxdD9(SOE3f@ylfv_#-SAFf6V3Uo+2BTI(U)i$glAyB=Uo+4rC8 zh%yvKzpz4iS_dpV;~Ldszvf8F7$F`M-WPd6gA!jr-lU*K5Pw$!=d&F?)Z_!#GE1c| zNa6`^_jN~eGOo2-*TebQMoYepX}PN$WcH9m_E_-~SDw}F-WlRR?PO%)s+;Gm%qpug zHhV@Fh-dOEx~PZ+_8R+^UoidGcuB30M5nv(7O#cc0Pp>7nu2Xnyx4|j2`$+POA8CR ztkONp-M*SmfHq$fczCTQmu~@6c;+JxwtCC~8ds0TY$lJT`=AWQ#m!r&UMf)?GE1XG zlm43wI?+3XkGvV{3S4LtjmB|K!i+JZvt)FNTU0B^5>fuQbQ}UI`+4I(2a)8R;@;Paw*FMwHGLLzklClk8?J+g&N9sb(A`rr(jjo zjYnenxjKI+cLH3ssuwypV^j_N$k`2csyZr*^AzXkdTqmk#y!FJbInMivm_FB&5`r* zP*?MU+PSL6(`{5+IryPU?Kjl&j(1JL33O_g$!unI z5=hUpNC;1^nDj9_h%!b63kp|e6~tv-Adfn>$DD&+Ab76X88-mKx@Y=m^s}~of4Bl# z)6CfXP9O|qzs(rYJ?+M&gQMJpR*b46gmolQOSE2M96D8*yKjVhp<>14U#3FdoNOJm zY*~(q)FD(`uy85v#?lx-SLn%kdih7J4sW-pH;J zg%*Bj&Bsxr@Z=@(3Vol1Bu>vN%+~tWZlX5P?+*Rpc&){nx1bf;Z0%<=Q7d4>ho!v4 zv#cIu@iog;kDPPf!$8Au7&Wg&%VjxZ#`uy;NHig`(g>0Pc1U!(>JtHm+VTDt&J^?W{ZIg>8teUr%QnJBYx4jN0)_I1h z1Pl=o2x!FA`CToZ1_p-VLSK&6bN>j1C^- zGhh2H7+o-ZJG`3q>#a?%E3Er}Y)tU`Q(F$IQMI~n%C2YyNWXYnN$@-gn0Gb<&!B!f zNcbcYS-rs?hC|ibDlUb%okXjRt&=M7@Sy3x=y{QNb#%=8%F%ie#OlNKi{Ih=(3}e6 ziOMM+?&@d{A1ENC{bN1Ht#o_iS3UYLDaK29UwpBq`m=L2gp^2vp(SEl+9~kkXk?r& zA$vND!x9nTL0;UW!_|>3J(54@@=&0uv~%*^ORJSEbhzyLX_Ou?znkEFa#2RNRzkU{ z<7sf1sTKEZgX>WUKd)mRI#HOpZFbPW7g_Onigv6)deyiDwtTM2DJz2pLxZAet~l-* z1x+o!mso+xJ`683w6CSF52ysqH_%odi`Ta9x`r~2NsZ7Cy>4Xoy_jb>3uqUWcjA9_o+>Lyk?XF3 z)K_&_@&h9vLwEG}0cqE!#f-@SsVJZ3>@-xpHha8WPaIR>q4fSr_vv_mlYr#r%6(8k zQ@2Xra?H8$@#FzbWidYHMb9O#2e7pv=HU`NA>k~ap}i$aWzBUU>YYe*o67UXfd000 zI^1@alcB_Xp&z;?eh&Wlm^MM1??l0_X((Z3wP(p~I`rzHyrDS=qQD7E<2E$6;HatU zEif<`3Z#%LUP5d7Sd+nC)0*=XeVv*8Dk7D6^E9l-d!`S9LKV>^3X~EV=YrvX7 z2peqgRPVjoH6^)p0%j@M(OdK(_vMFS;TJU&S%@;am_`TOD60gT27^r=N3_aTUS#TP zX7>rrj#78!!>J^xj5N+XRO|FNrXSdRN)tv2&pmv!e1+rVIS<-(Svp0e6&9(|zarJ} zw>8o;4o{ZY?V#jyXeddKqz%fY8AY{exl6|un%I8s6Drr-CeGIGOSIY)791yvRMfAv zhKnff)p0XE(AjwxLV!9_EXlOg0E8t72eMiobjq!x-Vik@`bc^aBLv$OYqxcbJxy3+6K#%g2R zMq{&a8mloH+iBd`RvX*4?KHM++sS)6GoAVU-%rVhd+*V6p1t?ld#$yH5W-UMNi*n#@5&0gKgsFH!+|_w>w3FA~Soo zrt~vuo{zQ8bhm+sSzkl6fYlO(+!Bl9vHA5Ywe$;neeba)I{_Y#>$dRCH1paGLHtLD z=MKSasK{o6p-Y|o$1G}cRJnNpa|B%JWwij5VXG=F_FXiKvceJf_?@hlWXiqT&eUqx&-2N|olUOls$7JOP7e1EL zvrn=2ePbxhNzmzlc!A?CaZqV0frl z9V}A4b-hm9+C}%I&NE%*{j?fj6V%1@U1j?0cj{xgsmyBC6En_zg3o)9x1&O6I zPMMhrQ?}lo+Pd1FJBb<=_MaM~*WB{uR$TKX#i>|pj2`dUUBvY-_lbrY+ME+ zqs@#dHKW-g?w-6aC4^^Guvqx$3cWq{U8D;$LiL#b$8|8kfS&tfMvKnukf?v?PF!wZ zzv9xWv}c$IZk7MsLCPL=EgryIp$U?ttIBUt~` zcV{dSH(mq_&d;)+l6o&JKt^vgNKV9(3$ri`R(J0RzO6?n4@wy<1dftB;@D)Gw=5m+ zw^cmAAisCQ+O9(Cs({NLdlfww;rq3{X2*>c$uBtMh0kl+e^Egq05d?|q!Th@#-wpD zQQ<)2Oi$ld+9;1kux4|3ofHCFy&y~_+jgAS{AIG0wz+ZMDs`}`U@D}A7bc9<1;j%> z31QI6Df21G+|(4t2({9_-?__N?56I7-{Qe)DbKoI$!hW5afe-}?CG%j)E6b0MMP4f=W9tZ8(XiX=|?ZG^=~hyFT1;J_S~(DBc+z)p+DP(EJZ)r=jZy)(k!Zn z(HSezNmE3ov)ECae=eD^Nd3rc*i$1B8|nV-s>M96VKjkYNC%nx{#iJ**dzFMk4x*9 za+VnVr#VOS>+-m{Wu`a5x}FPIvg7J;KeFB_WJoWy#UpeLF`paaIwzt8SptV7HCN7^ z-op;FMoI@2Chx0th9zYl(_kCMly-~b%x?v!2yS)AdSW6NQe;SpO5qK1dO9`=W|_a@ z-Z9ElP*mE0nAyPj*C=3i?yey?>#eoY;Pz&l_-uNQD7iZDWave;Y|mJZT}XW&6|qvd z2g%p*t9XIA+#BA@FUgNMH%EO~An$Pt5_qqJErXwWbNayU{z%41K%hS!O=}XO=U+0%B~nt_Q&y+BdiLbA!+f`21#>+e z1cY#dv1zO)1tT1WCjDtevMC&7dhRSqUSv1_wkyf(;I$8-prFX09vq+EX1Dgzmbsrh z>b3=!8|Fv76Gu*+Pj0xyWbqT7W_AGfkIEO>noDo@&k8e)lu>_ zK_ZC{+vM~7S5)B&7^lmp$P1V!_u0o5RgNZFX;a)f9N|HY#pZ;Vy!jbrClD9qM&1ie z*Cld>{A1Xaq(g~J1%oa_%b&`pFJ!rc%ffwM&yv(NV4Is0cvMu)5 zs?uErl4^H{g=|%Qqh1-VGs3>(*7n%&ZRq^kU6dMzsNvTh9has#o@}vcrcx)m0`ZaV zIBW1Fu#xF4^X@Bh2p>7gKx^RajQ(KlU3T@KGl_KIVl?#||}R357YQtMgri)xma z?EDze;fPKNST;a-Z#2MB|8&D&OH%@_O2QO$X_ZOts+h z=$i&W-!Mz^Po+e=a_M@*UJr`=8b+KF5y|)yO1~Tnwaa9GR8_pcgEHfMedOZqqB9no zf8ptUPnfrWFJ~i!*okZwvxWho<2ce;VJ-5bt;H!gBVcFB-W|g17(E|bTV}!1$-Icd ze`v7Laxu1@?P{(3V)6UZVV7SR1lVSPT_m-pb2YRc_|7u-U7V#){X*M~|JWwdJGUCS z&9m#B<>u)RcA$3C@ET;3z9JA-t}3gr3o6~#vOn(>8o9?(2gWU?SLRzw@@_%+hKCuM zAe613==h%;J8Z>=AX|nhFS#mGEfO>BFS|}Y+E^DAs~no;HgG1uRt!^dZ^ z;C57!&QR`RFyiejo5s=NJm);4(QaXVbl$J&IUyhw{Ha7P24$FNGn8&;K%yf$&>(Tk z{K8*icNcaB5U?t858p~*k6kXP3YD5;!L@5tzg>-v*)iSeCP3UEck6_}D2R!PIc+=3 z1jtoKO|~=qo^E4cZch80BQ$duks~Ll!l*Ii_o}rpZHDo zN};8pS*kIe8j7d!j|8~4tEq2dtG?NbvhZBR)?q_t6$R>CTt(cQ<(Mn&t)){Ybq-E7 z$s_31gEg6SRqKqX*R5Z*HU61KHcf3p?QcYqSwN_9-eZV%TcU`Kp9OC`KVXJR% ze+95QPrPQeUIB!8sKewKG1Tu z@#h>1kYuq7MeHHwtQMj{jn|L;vNfb)riY_>HdzHWN&a{-zB4W4d|8y@=&M{ITN&9g zIb_DlLXK`|5+4LJSHSY?hdKkxNq3kgzI|!=X8UoD*kp7rzkH{p?Ih*EVCg5xl5+}= z++5R{K)$DJGGfdlJ&Tr#sS}^6+qawK<^GkL>VPJ$TDdRvc02)#^{r*d2K+cv?i12w z9}+I$V@aJJ0TSWI)v%D1n6T5e^c?8a-Oae&(5bdiyvkmt?I)5ED0ti>3v2ci)2#8# zDFJVAG&r~2lz4M%3lm_}mM~$oo3fl1A|I>(4maJoXM!Ys1&hc&wO`(eAStTAVLX z41UPgKa_V}FH@ zJS-9-Gy;^6CAa4r-M*Y)%s-`1@{>PE(}9)bL;k=yJd&Yp%imzX!}Z+l?Asp1 zUURmb1g2y<(K(u;^vzNAqe<&?(b0Ed#Vn7YpL1R3d{M;~i*@WG`J{8~2<@wdsRSEWJX2+z@4j6}c;hwpwkaJ)r|7sIdAO-F0 zGs+!TRuo}IoCfJZ>aruCF5qd3%=rNMNv?3=R`3cA)B;8*HLfcd z4kRu>Np4fmwXg@;zi9fWS|J%Kv$*mkW0}LlrNSt>@O-`4z#1hZ*|C8Swg{$l?wRKG zDmTXKT`Jt_>)m872R#qy`x-|Qqr_PQ_qvXPaK#kcY+9&h^H@(qYL27!Xqek!$QHS zll4^8kDVTUex|U5GqflyA>A8v-+KzX5JW;7qE@Qu{Uj>UybQ?;ebJynA&bYmx-h-C zEOQ`r;vhBGC-c=jzjJ;u$IOaLvHmP&>j|%XV z{AY_bdK6^Ujp!aHPGWXA(rG6`)hf_xMlurIRlWc=E14?aMST^DUsiouR%c#5#>RL) z0Z$+fzRWd6K~LO3KtAc-d_oKpOiF-ypz^EAf0M5-X;}ss2P2CJqC@?3Ls9Z&_VwxNN2C#URrb zg+t;eXlyW<+KSBODQ7G)_tF%DL!~<=s$PZD;;iiji-2Mp7ku(GIdG$Qk;pxntdOR2 zi}96PR?U3usx=74li|YaZ!NTAl(0}JQm%s6$4F?u=p~^YgJKRr#KmQ|vbfyN`Pwgo z&+i#CIm^0df03t{a`D6JEc(OJ;?2{@OzrGqt4j9sYWX2fRotk{i=jllR8>6T3fo{H z#NjhL9?CspZCaZ_uamm^1P1*QeGcs)9JB8r<<^b`1;K~b!4(=cRrx&8N~Lx|U;6f& zh~>Rk&FcdUEQVJPO;Hu|HzF}vc5Lo&#uWd{gfQ~riJ@AoMkksR|9y*-W0sjS0-JAZ z83_UQUq^yZN=wO^A#g%){0RS9cHadGpi6$XM{1WB@Y5x?wz`j6nFTogT9qa05v_xb zW+Ucp8|z@)Vz9EzBP4DxN6Ne`D0W>)2!dW#wd_X*#%!C5kEfM(c$F04dxPkSP zW2DB_MdqHl4+nS9>N<%kW~Z^iLYDJB$_R%hF5 zC6+9rdNLee|EoS#N`;+6B8NGxv2=@p%J_%xLVtQUz@+-|TKgIQS%TH86Pz-`s%8}X z#epAK_v_WD*XzseQh9sjBSEoByZWFOt)ES`FR2Ma0m3dlk%i z)kPIE_5d$W0^f9!8Pa*D(B4x`v)=1%vDUo4w2bUs%#v++KLcDKJRtcsnk$jYLI z%3OC|Cs_tZofX3y!EIz8wOnj@dA_}PJ)J$}HY4z8J_6%omzR%Pwa`Re`M$dU$}|Zm zAwe67PVG74R<)!aF92S@3aF`Ullu0u(+EyFouDI;Up0z!t6@cPd7(WDZ%6ZNu z)3bm3;KZ$0c;+)WXg|f=HOYbr@!xQxydWWvDN*RAd)yWRKNE;R;JOvgo&{=YlDd7C zk#j78n8^zMe>A(YA_bghBumY05M{@03&{xkOH16c-PUKc<^ z{LlIT{_$Rw)ZOUv2UdAmlihAYDL-s^=~7YqTjg&5p;i;GquU)`5%;(2^XOO#nemh4 z5)2&&J!=Ta=KphU@4z|efs5{7=6)(U)+s(4Oum_VPHyM4nIjyrOeH~Qfp0qyPya=r zzN=n}%R7#}{lDKPj_gPZVPYsBxMEM@h4n;5VxAu$tFimE)X>08al}pWeuo}=M9Ybf zeNTv0q$?6z;9Y;8lKdvTJRMB|fe7SWM6HxkP9Ytav9-4e>u|L4fw~(d%{j z;oz#g(dhO$?AOEGSTg%r6HVC69WD4Qa*NQP+Kr{PMlqS$n9+SmNS^?Hw2UY9mXXUEGf*i43b5C62+U%?M^_ zZ=?_*pHTx*BGf(EgZ_`oM`fk0=I4@L0~zt-VO#3rg_6yNSFk|DpFKT(N4sO62$2|l zdz?`#J)Uj>Njo(jdO{AlFP!R2eA2eN46zO)V{?e9<#Kku6bWo9@m3Z%px=JS3Ewit6C> z3E%Z{f~OwQ1kFb%h(s(R44c&q&?#bMT+NC|IxOXOI!t^UaewyPSfAjKI?m|v^LAci z^{g_|H8-|sZ@Ykstfx)VsWw-ANp*gi*0P^w940?XTP~#1(4~_xMvnXHz;H*7m$~)4 z2#PlzWRAj#=7XqX-W%5&Dz)ETg65N=r3}d}DH3%nmpZ&5DVeAA1tX3TOx#-|HDcDd zG~-rMBsS~Yb=1*t8iVV7rwFKTRaF(Ba#E_<$kY_w;r7p}hc*WVYF0(7wVq&<ME&|O;G)U|JiK@;Ov!)BGY2mHs!@>}fx7OkI42-Q@7 z_Fqc+Xe^sK;pXfMC?@SR?u=uhYqEbTC~a#?>+1#>Mjj<1a){!cVE%}x;w3umt9v2B z7N37jWLu^T;btGM(*lUqWN8Fj-El~x3Ne`ohU^Ga*K#@FU=vt zm32&kMa>cYq~q!=jY{6`w4xfli&2PUU6Ij%-eIyQ>dDXp#8BE2_l}Lq$J;?`SmYSu zxr2gNa#d`Q5#45Z3aew@c?pr_75UaW}$E z_fW0{;TCQ4-8$)U5IDm%k{)G6kqa7 zary4E>&o);P#6Q36hp(lB%E>XLLI2ev!>3EpZ13>Lm_eQL+lf~MmA^>!ufzKxD~6E zJk|DP^@A2{9A`{A@op(9AXVxcT6AbYK7g#+FfGI=)oZyfCl`|xPqm!c-%6dRt`Cn| zp2DOtuOC2H81Qw;Eir(QP70*W3Q-FA1~2s>FF2Rm6d z&4S1C`B!xI2U3^3EdzJjd`Xi`_B$2L%iA{o=giAhc*SJZwSD!sxL&N#)T*BaK0q2c zns%(zP|{OJpBbe%SG;tYdp+IIB}xSOKjBi~yHHT1-ECSJXTpytL=1vhp0_5cNsQ0w zUgkrr>@uHQ+3asO8SYxVHcdR-En2E5ebSHMnC(RwS{rcQJNejvX+Tddo4?H>8 zlJXO0Wlr0r^YB%N`UdNb1U(u45b#2AoAUA1@E$Iv@%B0E10!<@${4T*Oh{_(Vo0b$ z;}OtgI3-t?my?raKY86oS?5M^cnrQ-p5P1JjvLRt>b-yksypwwyY7tl$hWtx-@Jr3 zSJg7p;;xhr+Gm#Jsc}wPkZZI2HPy4FP^+zfoN{NR#8_9}Y^_~og z{$Y7R&wL$Jf7SuO;D9C)eqH58c_Qs2@9XRD)!-a9oeK6Xb#r1ryRY16Zps78aT*9> z6s=}__tI8WLFF|UA~imVW_Tb4TMQR+{g~xrrl(9I6dFnC11jK8SJ1GqjaXKC$)?(u$kiPyswL6dLc;=FhaR03j-PK!oJC zhx4gm56bx9QsEy;0gzJ%B$i?kH3WRCuGcKNISx*8&Bii#nO;<_ygMO5Dn%Cg)q^XLqzp9aDOaw6GN8xGDvUVJO7~fi4gJA zeC)ZA^engnn&ZDioC1WC&?RlQbM+c)u6ozWvtR6EbBX$JxjBs%r{|}KQOa7Y&Ti(? z;`R0oBq+h4(m%-(SXtk-aL$7C0o<_pPpO?0P?f{a5hL)LW|Gou=~+T9;&nX~coN?R zH8N?@{F{rZ0(+aOJ5}_?0=^;y+E|!MN=Qga)V)U!r7P%dFxEYdHN&uzw&6}&@H!%=CCe)^x47h?{|+J^8@jo&(eHCM`ffrJv442 zPNc)b9lB+?M6fQqa9qI`2wv|?gv^Q1t-$@l@+PvyNJ60N%MJ{09mqoDUft$~GdeW? zxz+pHpbnNY4>~hZqDU)8?CM7#phBp&fQTVsb|KV$wuJZhZ)4ieP=E5P40G_0weP&G z$UnN@+Xy4A{K6gik3jZ&*6@t{e3bi)Fl2v4YreSjY|#*7`rlxT2y=b-@Gk5u92}iq zGl(*a-AU7LK5Xp|Gxwc$24YauPmtw(Uhu=iLqw75v{Rql|D{S0B0_@So-74Y62E^W zQkRAvn!%v_m)R0DTL}Jq$_T2e<%pIQgr6N5!27yyP7qcfzrb+db6YQXH+g)odkB}L zC-;Yjr$zEz0sI(+^Qe&?#7zFM&#lc;J!R@XuW3y{*1%Rk7_MaQzJwQJG z)oXad1{DPmb?;4Gn<{I55S&wecHSDZPGR6=CVIIYE_QT%0p`s3u7gkRDGvE2x|kY+0}tygb(N{+{x@N6z54;|o7J;6E_o$NsGx z*QbqOp3aa?JIuM*pvZrr8u{{kgD?l3Q2ua!lg@uz9K4*QqkX@&c{(3^yH&CC!^r{4Pte8|t|LkxbI-ry5M311s(?T1NG{3D6V7H*pP#oINm(=T3a<30gPE-|;9B`3i8!PZv4D$rj65Fu z9a%R6_v_@R6s>WvT?)ODY=-j{I>Xw<@^IYJ^>V~gnK4v}O2m_kT65{MBfghkb)h2- zLz-i$_=(+H>A2S=QDK_cne$}*X#OCrlk+lF2j z&k;)|M82zM_a?pc5v^kXyglA&M7r&ghHK+d zqj640wk?{Ds{;7IiPvUAPEb|5<|iqn8q5v3BWi1Yn(~38)q#~E2D|Ymyz(=|)$BiW z&i5$iTjkc}NIP2~09n8ShI>&{+BD(EZV%dck5)4ezyDo45hyUpHbs3i2qERzsEZShGAW~L4>FoV$KnXv&T{p6cPhbM1qp-1L?VYqWAPrJp0CiZMNdjeFEJ$WfgayYl;6`9w0Cx8W-m61nDN9x$?z z39Lny5_(#S`${%3 zmHBMC$u7QB$2`T8KDM3t9{=goj9fFdGoQb51oZOgk;zg9(V|eX$j1P$ear`~T=^Tb zTAMQ9dD4L1dG;C6f^y4FlSr!cW)+0b1F1WxMe?<+Cgx<1Hkl?jN4Nv!I7?DevgxTU zFwLE1;EB%1lH%H*>bLSJ@AEowXT!ghxk7O1-I~{12pUbCxDe!@xZ1(}TS>nCca*2H zT&k1KBn_5M;iznEbUB`{1iIcJ&yA|9h@_u{zYEbVW~|;EQ#QNY+}yC>n+yPg3Bp>C zwQVrMFYzRQurBX)#Pb(14CD!k@0P*PuWe@DWLZJ`xQcokjy9egnSX%dtTcfy&su>< z8zSGmoWKq3OW{S>P_lx~4=uic{ZDEG=m-;ataT3EmV{@RILP~WAZ2D?i*PkpF$lRp z8l!^v7ylEb*ZDyfEeoE@sc%K@5inVC0qQnr_WyNX5Fiu)oyR~T}|I5hmsf4S^$M-j8%;cc-jaOBn09yh|j108RZ9l z8t{Vw#!>2yHvX?i9=Q0su~2A4+#(oop_i7R%S*eAKZ!~^w1JV)BN+im*Eelpa0h*B z+s@Y(Xknz*+~Kb2Q6N!56*4e_|DZUghyHiyZ9t}Eunwvd0F@VRfbWB@fdi1-4w>+e ziHJhNUjn=Eey_=WHc$r$SgC~-QJfDVbRfr}|KIr|rh(TqQj1B@Oopl)hE6I)$nsin zE&M2spIvC zQwsjZtJCz?>&K(=_UlQheA#r*liImeSGahM15_BosQo@ZLB)R_FrpGD5NR00GD?UT zvj?O34chm|s=j}bprNh`zPP-W;GrK0LuSsisI`n&u45rv04bEB4f?WPg-FC%PDdj# zGK4z&S@Y(c-1HpTw&u5rC)4 zA=QGLaOAdTW4zwLcZ!Hgpal!H-pbzECMO&f(|I*_A4o-Sy~?JfLq3^<{>Fp>MH$!1 zA7^oj3LR(3fJX~3oG{-xqiGrpCi#~K8zXf-wHIf5#zs`lA#5@8eT8tdW{E{DdiDNy z1HjKEt_W7fL;#yCs-~GRE5xq+3ji!iwb&KsQ@4NDkWO;+*YvE*(AbTrX$0UAKv zWS`ogiUU|oWJHj~+l)E((R6-mz_sr>l?;zO_Q64Mudr`a#`D9&8aU;N}QI% zja1>vVV0Wat>_mHPSgyqmc+w$Efiht8265~>p1m}bl_Nv+Ee~9s8yj1ZcTA4f{7hF z<=v;~oENFgWJRrYPDvO7@{krEpa(3_fFv$G+wg1KA1&ZLqwe@wnGD(;RRMsyaTr*N zov4YD4(WucC=;9Hq7|2 zhE};+F)&ChPC06gb>^V6Wdu=?L{mW&K?&umx6TLTvjMbIs+|~hGI?b8q429yo7ZsU z*{Uu}#pHtC{{Hdj&z}hyk>N9fp-Zx~zo<2Sq;<-BfT&MQI!TP|#3*B+9yc!aBwd+Z zJ8Tgv>8m5<=j`P;X_KwZ&AcS3QE=l(bWFd|S@OZL)w= zvge5W@k16FX?E!z-9=7fpuUjC1VZj{~Rb;?rlDtyo`xn!}+*;?+# zkSKp?;&Q}oR@t9b?5~QM`f_99e%@X-4h_gfNx?wFh>t$-G$m2%+4?|Ww&(zGibfx@ z^c5MFG*h`mOts~#QC6KJOdXq?gdofk`pEDA@=w2XmGY+|2#w2xJm^Bn(;EQg1={<+ zzO^|va<^ud1GQ#=wof=dbPCS`@ix;0wcmtEj$z;}e7AFRa{JoK;_B)sa#ENmijH`g zpYOXEqt(qe=%m)lLE`$FxT<6awa52F>IIV&4Br5X z7Fwg)sAR$ErMn|UuDpDo_^XC{b2>%&uDy~k3p3sWU1Be7<>BcTQyRUUo8T9@ z;$f+sK03A3M9E;vc(^Gox;PCI>y^|wDM@kW#5c(PRXHOmGVA!zRHvO)-lAWqBW^kK zM)_N?O7U$0NM%(j1rN_yPzpzfoX-$c7(2+3lLUpR$dkv7?8Jx7PHrs9eF+G5+b{H$ zLstClyIUqgD#Ln7OMGZMstoaTc*+Ny_&y)c4Z44=h|j%BEKid7C5Dt#9TaZ*UF>4+ zO`==qz)FK8)+TA*@(pOYBv3TEi}{?h`ojW|Jcv+Nic$fM^vJ*sbTV-~0kjT^sF_?u zGgO?x=uXv8LS{iTfiznJ-WOO9Nr_68BM6&((0cW(5VX&wi9f=|L1|*Nbog$SLrX7i zD>=GK)28FF>-IabQL;$bPp^IWgi$BpxM0X#DLPb$ei;qv9PaODP!jX;G4f?1;BDVC z@SRlVl_Cj#-Ji#}5a((hPp&6TJ&DkrYB=O#sb={auVRCZjI+-KmRBb9J zW*-%SakjEEQxjE}v3hVRc64u6o_WCb{2=^E3N}5_+(pXI1N%^|cQ%G6aa%qUMz!`? z5Cd){DyH^y)?6=3N_yV7#f}>sayVIwYL2A=%P^bFrUi#faS^tS#ti2{pYhOZmp0!kQuPpqHZi)~hGT+W- zWv45JewdX*%smJsAv z3r?k_FROu>r&czyn@NcRF-&y!v@Sl8J2e@v+uw+aHexYNOf+ibBNI9%Fx6=B7)_95 z&W=fho?Xf&Y2<-&oXL-H}jGSCu83^v5SpVpJ^azm^&U2lGLIn+AWy3zocR_)Q5LidQ6 z>{ef1GCz&b(dk3$?XzHhhJo?eM-!7mMir7fSZlX#_aqhV60A#+o(M^}!g+VSldhVZ zvgf(`)6-Dq#+te4A@ur^`Z+*}kypXF!`C0jPMK3=xuj(?A6D_Exv{2Xx{7HD5~l7= zP>u#4$uGX3wwAnhJRG8GHvXHm>i{(dH{OtkOHNBMsW>N6Mzvi&XHC*nMe)<)C72BN zhn63Q0i{)*&bFOTCeb+S#AjI}d`8D$V;&R{BN|2YBd@V4-vw}Zjzd5C2>F94tfnNw zUmg?=e<53P4-?qQ28jVKf8uk;g=RolObYC;n@{}cfPG*ZqdGK}_coju0k7Ttel$r9 zawj@57q_&Ll)FB`kcnhaq-=(6mUViY$J3-fL~yiC#Rsh9dag*Cfvopf(g(Py{Tge( z)T6p`jdCv-16qbk$oyUTc&UtCeo}x*h-wWPR7qB+4JpRPwAMh~L(axVPTY{(DLLl$ZTr>IV(oo^JkV8c+QKF5c^EF9`07x}z5N*=EQ9V}! zO#>9(W&HMzbY8m~kB!`gki$|I(EUq~u|a%YPDQ28bSe*^LsNI!y}jK1F2S@(hlhum znFAk{Ze}%-v9XcMT5qvE?fqO%67t?G#lynG-JS-KYS8tVk{8vN_#U>WGCzHAUSXZe zuN#LR$1`oymZLhYhnGgtnm*Jg@+i@mggb+jid3D7)57ZF{^^8dZ&Dm+@nfPjzN&F1 z6AyuinXl$oCT|H$Tp~MAc?8r33$l*x=_s3;|L)ta-v8aVJ;*!!uMl*D^L~7E#YPCl zVCYj9wmx8*KS=9voFnV+XZLu0z;F;#Rkv?A+~gw*eJb-bAe5LYUybe-qx2&LK|aFr zIqu_VFCA^7DM@2L@aqcquMYXdZTQ|!)ub1vJ#UiNr>WwBbU?+ixapk0NZaPxY^%98 zdE&2*q#p)QVr|S2RP^b98mD{A($#+^VEc7{kZ)e+aff%3mG{KLn!?u#wDrf@@3UH- zzpDEKhrCj?x7mKc+48$lEbCqq(&3HP)+DxK!8k=i^(V_o#XQXK^`E|{#C>n`mqA%m z=)0_-Q{r$ZA<^%|;6o}+2YG{FkF~GoF9B~YFX;c2B1Qc|K~atGd;co|$E$&QGt2nl z?s3-5T}QZ_0vhV?vQbC?kdJH;_|V%1{Ztl==s>P?`_UWFd6b~5I13d(o#@7!T1pl} zomg^1y!{Qj3kU8?Pu(L0)gcl; zyS_sgfdDBH5f)(&9331l6@g}(deQ!5%)|0GfGQsL<@tC$O+Hzlz?6bSBr<-WJJgh1*~Lj)3BK|j)oU_*8oe}z;IqOD+tQKq`= zR%D?utkREBz!R|7@=N&N$(dzDT|MC&t2)-M6-hrfRmG&->MDg!G}HqsFiFj(@dV|3 zyWE|UthSaosoC#Vy5Mo($U(%QUqjXZ_eN$C3+RCpeAstZ&2Q=hbqFgSnmd<5!XmSP zf-n@gV1)YZ-P{|3Dr{h=k0J6MPZ%U=EGdZCo!AFZ-ONCfn2SkB(8!5jt|T&Wg0bXY z!Ryk{u=IoZ9BUk_tY5j*hvQU&60B2l^)LIcmsZ*Ay zs+V$UiNLDHq-Rzd^9784zt*44O0V~}`C&GryltaQ_JHk`zX>!*W2hs(@`wHQ$eCXk zK#qb-adP3S9g~D9MRIGz40vE`7l-i?bTPOY^tekIUnQI%-UQ1nBW{( zE#Mh68kAKyp%vm>hZbcG>r`PRa{riRjw^!CuR_z$toR7IR+dGfC?@&6%siV3$76C- ze9ZDgpp<(i&EW9^tbr)hgYG_pBrY^+Ymkz@o|DmyB%F~-F-i{C8p28_gkQ(;Z5NE7 zZihT5#7G@SxCzXwU$Fbx&UTnJvnOMZ=*E8In_@047_e7~ZxcTkz3=zfjZ^fDF7+80 z+|4sL4iOZdJDjjlyT6~CwZTFSbiA#;v zQI1#tl9`R0)iqs2J>+bcv{kL>;A7N7Mn)7*a|-Qp#$)d>%8HLUh?lru+b$G?0R+3v_8r-z0Aqy=mvTbq19r_830fj74~5C zpxcuKT?(H;;k-l!ytdq|3Nrt*t1SPG*@5LGA|u-0o6aW7P(>ZM6dOtiKNmU>or=?G zrUGXVckjXlC)5*)xp}QBtx9(+D@@j}7wc?6%wY}IQ>MK|eAqPPL5f|WyJxp&p$+l=+6dHUt#ON>DWcAf2pl_J#i(>RoPxQ9}Fe=i62d)Hum0PpCghW*?my;n1h#@+s zU6RS}8mnB)%8Z4%6PZ6=8k$qDMP4oGr_T(?ziv^V&mjx0R8&zXvB8&;Mo&Y;>YHNL z4uE7p)g zg&!=)4tAm2Ezngxz)4bkq4~q_q`{E?-J@2d*HfKW1yLtf#wWCO!LKd67}}HB^L=Co zDo<+Yb=`_g)jCI1z#-^zX~zp@aH(`g^Ung?940In{i*nq*Ca-7O{+y<%DLP8EyvR8 zl&Ysz0Uv#bz%6 zDjS0P4af>35rM+h{&NR2QUoH!kcOoF4Xh~$0jtJkdxTq&>)SHFmw#{Z?|;Ti!TH{v z?SZzlByRZswqw2vSW{HkYzP5hb1RA-|DTojSEP4f2O|B7H15fNUjP!7FMEydH#4fD z*^I=k5$gGXo44g$x9vY&5MY;wX7Z*127MZcPljm9GvQU9hz3Oe zm6z7u2f)R#6-bo5UXFBhJRf%I*F2kRYisMjz;pi-y9r&PztE!BdxIlow66e&Dtqz> z4!f1oJK^6(-kPO**gm@IfPAw;FtqYjbA%V2us2Iq5as^%>M?OI!gaQywl<&HG-XqO z?M}RE1TJS)O-&p!0}eK}YqfF3ze>a5?|@JmGH9Uwbdr?rhMMnOh4k@tZOhG^6)_&2YC4*Fh!uE&Cz_HrD_fZ$qZ z6}4)!{LO59!Z`rrt@3cf6YMdS{gfx>Le}}w2e-_%zP~nL+92HPkr3~{W3PuYv^DH! zg(@g2Mmpe@VZY8qAgy6Fj>3O+D=mCHE#-Hy9S#8o^nN>N0#b5sItPzBU)lpHV;7-NjjS#W)@9wT%si00AIXTzFA-Ex#VVsTf z12z$7Fd5a(?xc(7Mwi6oh;g1Yh1n-7MZ%XZTOfj;ULBMr+U3LDqXqNEG6yzIBv)rRaT?u$3WIhMPqQ+Y$>m zwB0r1)mERVS`!Q`m9%{_EQ)0m96><)bv}%li!TKKR~Ad?4l}-H^;rG97T`tU(6blm z#$zeEsAl}(b6VVUvs4;xCU&LXK1EG!l0h72M;DmN5c)iFLQP}RBrW4eFb(A-s$v~V zKXSSSjI{F1U~%c}rb7s23h51y3VFgB@>L4uKPbfObVRcp6b$K{8t(ZsnP{fS^q31T@-;qe15^v=3Rm)z##n0D@~)HXu8a6b@%WveI!`2VCrI-bX9aI|ay5&# zrU0TLSumWoUq%mhOy!P?x}#Jq91DIIO4E6l=ZQtT1FZ5BgAsdxoh0+HFFI`_E4ZNl z+lw#uUpqlFG_*OACV%&SpFM+2oA^Ab;M;pFrs)=jSMlRclzbV=QIpL#;e+2}0XUR=q0MXW8MQYhlT#d4=bpAOnI)V2oA-yfD8s2JN8xRJFV~Q zTwf29;H@~C4w}F6Tk%&EKj^v*I+iDg?-r*w?}lxJAzL2i#1&22y(YDn1q`bv^)B!$ z@6d{??kV3+C(t^&t{w^{vyPUH|3Bj1GN_KWYZFZf5ZomMcZU$1U?I2$cXto&?(Q3R zcXtheV8MgCyGwAUi9C7UshO#7&iPKAs$KiXuHD^tuUnQ~>srH_Ken9wUkemmP-DUW zW|V~@eU3q>RO*A`4~H`rp&75Wk*?XES-ey`Rm9VBwC?%v0!;|HCDY_aR#|UM($o?ZYw?9!v1evMMJ&#zWM-zwcq_dp{aj(k(uhBv zwqAw8Wh?`1G?8n*d3_!=K{3p;o^bNt8LA1Bg z>#jK}Fm=+Zxim2`%pkR-Ru|~|-bz2Urf;j(!HA-0iB$3wlcEL)9GXp)rEu@eKWEg) zkTvSn$H)sfM?8#Ke_~Ky)Am!lJb7^h9sZ&ra4Iant?BjFFHPVa>v^2Nd@1IEqRF*w zsrLD>wV5)qL4P|{C?ak9je`Q>VstxM{07^#B2b8G?TQnnQIhS@X#suY@=`y#ZcEDO zR2H;aR`GE1gCdNANSGj#Y#N**n9XXns{*9`G8uvUc*SSjUxK=6Mc=0Q`lh~YOVHX7 ze(&+P<}NSKz&YHv9AtbdHh>6Fw^%~vix?>LHzgItlI#rT%2tDN&eC@{(aAI@aHPlO zmNo)kaR-V)KNSUccACHtD-EG72=eu|i4V|9sg$0zE%zsXj*CAPLoBI~4;-_0DI!lK znr^UFH+{3RH&7IkM|Hmjk-mAQUcz~$rD?rq&%M@SPH`(D>CGR3hZ5D4Cp!a#}e2;D8=`gVGt>vECPhh|hf&)5jAeT^L;7 z?(DF$uxW6%cEnS5RF3U2G(#K^o@76C{?yfaLCcM!1E4Sg!J@j}KhK7H%1omK2t zm0RS187FV3zgbBd4iuib8WHJf(n*w2ju^FYeHyQ`e{Uc>#<~+fwlg`UA?Z}fQ=vi! zlNwhrgTUnQP^GF(Lcf72YlPnYQm*?`(=2@IGQ4<47>MItrSGkg769@0Ycv3kCwrj;YYf!r;S`&Hhp%@4UGKf|GaxyhFgIwl` ztIe8;!RVP_;KKVE`aQT1RtjZqR>mi6c9BX;ff2OtH0a+WH(|oddBgPCCyuTAkp&wV zCt~>YJNP{|L^-cb8QW`S6BaDT%ZAKgYz+;hwDct>@e43 zXZ0}8*V(=e#4u;`exe}=9gVZqYz9AFL-6f_DVho_^z$a6n7;)yEs-_Pa-$^w z#9WW7{+jHo=l4IB9)T9&*Rk`BHd{jYZcLVoEti*RxyxK;Z7>O15z>_;x1JQ-AjC2=1F{ z-G~LC>3PkGim^oRUz`0Il&|NrO99_!CQOBJ7j1z?I?$Sb3}s$0E&y;nBTE2wjxga2 z>d1KSlLI;ZLjb_j&baSfloAJTU#S0yYC7|H;YAQR^YA%l!~!8oYEp<_;ibRTZkPbl z#*6Uze;|1Xmhk~M;^D-b>94W>Q>K>!T5z^Oyahi5lvGq^izn^eoBJvh%ikumhmacd zR&d9E+h%l;ylXg7e~TOUXTUO0=T~ikgQ|7zr#ptCpEO)9;uLdosiJ(v9Z@>k0+07G zl{WZ0GK$R|R}jN2(Nya^rs``eElp+9L3vkAt*MW0d*^HI>}L zOhE&<3xC?4(Dltotx`;zbTazKxD*L~L<}d@1|3o3Ttq zjVcuyLSsD9-|zGc{EqO`)%FSi9l+zU+F$QmgNG*vD4Zw0e;*lhZ7RJG7gCiq6gvA7 zGN#M!!$U=gJqc`RU%MatrB)z-UqGI8k`dlY!8CNj`sNPy@ODbI-Syz&rDB`)LVxt< zfd^N;6tW?mp!=n{=0y*B6UxtjoHZzXu&pqx()HYLS^$_aDYf2123t!&x=`d2)7R*ErO z2}hbA&B6Uu^J1l)4US={xyeE#)1dVsxQ*;uVthQStC|5TyH#)G!wh>~LIZ<@VbK5& zg05oI0Mo7O=u%MjJa0SG6)DcE&@!gcxF#>*{c$HlkE>1-(QB`NOR?8C^9tn} zRb;wQBD*?0@;d2hjJnst`N0En2#lsa{HDvvkg1|uQR%+0nZgN*oDC!*${{8mgoiyS zWKk82z+%%AUfpK+lCCz%pd*(xF?(Vn?L!+G$Zo1NKYdnWVEQGEt8Kw>D#s>dS_(0a zX>M3z(0V2C-g8lz-3U^^6(ZRW56cI(GV(t2&{n(e#G3WtYdy*D81T zC=bIBF1la#x;dRRdt0lqH*3ZwIIXR7I_@lXuarfbJQ?^?8mC&TxNLDX`*HA z*0K-isR?7kc;}Q*lI-5>--HRXQRU6H+(mnSc;QwbS2 z{#xEARj5TN6?-O^s*Q+MbPCHB9ZA9$rDu$hj-y|?4AX_r{T}gM?3a^5*_<(HJ^7je z^DuT;$W57??|f*;lw4TK?iE5G5@=7{ZlPQVZ$hzoR{Qi*4I?DqV9mm68aYNRtWC_0 zTCiL3>DSiP)l#0e6*U<=e~giilA*l|mXo)+LsnO?gM_7-PDxPhcQ-Z@ny0j%SSzS? zHV(Fd;E4MS&7&%)!9DH}{${eUDKT z%hT8faC@>5n|(KYJ&>MzkrjImV{4qn`FY0E+b~@72WpGT(eDWrsg0`XW)5b%qgBdY zOkjLyKu~nxuF~?+iT7Tgi0j@t7n(j$LJ4R!dq#bu^B(F+SE)gDS?a%Byj}jVGvFb5 zhvFsL?G4eR$*Rhkxuib0L4#!Q;5sA=e_vD`toppa%Vs&vpl9N}|(8!B12u93Za$cJQ^K>cY+HY~*ov0!THjMrF$u z`D><_1$OhpApLSAsl|1#m*dMlzx)w;Jm>cxH!RiCvT8MqsYJs3Chb;jOQMdBNrY zB3?Z%o0Ki3^A=HVN}|0K<6uM6EesKSN&@ooBWI98o#qdiB5NcT#K<&6ztzS{-Qb*= zBxRcuG_xP|<>?ihMM;dcy8P((U^14@Eu~l=TNqA3$&ZXYk&3(~zBDtXbPNB=n8B`u zsxpQB0E&dHV3<TO?S`h*>$?K-okGXT_LiCZIL?IW*Q&sPkCV6GX7>8V__Am6fD7Pz2aO zoo6q#GTcZ{(HaExg@%(`1^&Tl4 zeDy0p^)O@>GsDTJXtR5=WN%SYlVXtpKQ#%$kauzE46Gg`6DygRHLBQ8vmV_@WCh>- zU{`o7OZ@Oq(TAbf@ixFr=!rt39kz3PNvatUco1<@+P^85i+V%NDktew^b zqM?=bM5vbr5wKkJn|*;!s>4w`R^wu6U;SIEaXdh3JM7<`3kCRqHNQ_j^XXzgdxYHV zEOV}s1i$0_rR>USZ1i(DKvqC9_Tx>v6ld#QW=H<>W`hV0{B_Ll*Q+Fb_JfV9)?fvYc;z+{Mm*t0GsK-7_{|eVTLK;V!Q$3+IP~F~IW@;kLVIB6|qG zJV&7Sw_VShgK~VYD8G7LXFeBe^Ot4~8ymazuF>Nr5z{^Sk-BgeQT58OyQskwW%jjX zI)OJM+Po8L7h#UfC>wIL7T|NcMe?cXDW%MHVEWj8TvhnWh2Fme9 zFL2G6Ud!M9P-$1rpH;@4n%ApPDpq;7l8%ZU7W;LpZ|xjPRS$ZjyEZ{BN^<^g~7uV^Y>jW=;V?)UQ7?1^@U+p1hvm zk)vq;b+A3qYK`|(0U1(98&oLx?<4}yF%$4gI^FT7@r0hg@RrniN`jpdqi85?A7Ar>0cinz_u~~Y0eY^J zE7bEW*7GO?$V%vfzwP>ftqg!ao`47qs?bbKOs?lELZ*|hCQQls63NbU=JjJCiz7lD z!ui4(s_=Zezn=K(n-g$rUO{P#dJ_3c)uc1AFc;F}H|ws>wx?YrFDbpn#Aa0N+OT|e z_4!InaFh~-mjF5M{$=&=iFo3Tct*+$Sd;UI2ODYf?y|;}Dy5id%IJ^h`FZtwVJ;kD zxVZiZy3K`4GeN~ece!r!A}9ov8iy3$UjA~pyo3qf9DwLu+vqf|%t;zx@YyT?CJG=H zgVY)I%-m%fpn^e?Xh$sd;L+pI+L23~EzLt18XMx`xgN~zqo1(bezeJQ>}Z50*|dr9 z)ksdxTNP8Wh+2$qzsag$T9Rq2VM|B!lYFFsDzcqg*lF_5;8@S0*{*|7&m>>+^Y@-p z`&8>!HkAP&Xb9k-l>Ff^H4<%PEhN*eRX1Zx0QS|h%|eHzw-<|Zc?&jk=gpRhcwex- zbjTzi;XEZiz96f3i)Gj=9wb!i)_0Y&>t!HynjBUnQ3e~;rp?)|_+{spDg6+)u~A*v zx!=Q{ihKp_Vyd28+_wzcHB$d#qMoW&bb>_0ziZZas5pgtF6N`z=@pjtpVs^ic!^-~ zad61Sb{tFXqb?8jLvL254gC?1*{775Z+5TcsdR;MbOVVVf&C!RmCEDcwQ+^)0cc+u53cNKpOoj_x+w zxbZR@^}VLZ=w^{x*-c->^o1jPZVqiPP%$FS@45VuHU~T$_uXW>$0PAUfcU|@?=&zB7#mBKb9AVx#+R z78dsI^73uwnOO#nkuTyv)Q~tgL=2RoY^y5j!o+=c7&r!jslxCA3wyq{^|8*Q+M%ef@7c&JpCl%_mut)8ZIPVe5WZ^EDqD@M>^0&tD%< zraiIVecP5d64#;)FhitqGy12V>ZG;MuP=%`$OX+&})eg^BnC_tSkE4{^!Yv8^DHZP4w)aCv4G?D?)|eTy?lCqjB2v z8Ad2mZ_n3Ux=I+rpXK0?n;ZgCcxDbno)lm&h+Lr)fQAhUd+2UskM0*jjH_j>?&}A7 zd&S8bOjsobqBgrVNgT9orBV`;!hYXHC@pqL=#|wIl2i&%%O(}&ZD18-!D8u(IeaAQ zr+wvxgR5|@rp)B+;57$SqGZ&0&$xt2C&bieb7Zm9Fw*sNRr~ezswwyveT(@F5=w%` z^x7mqB?2Z&*)oF=^D;r2o&0kSA7(eMDbc;_!~L-B(in*h#n|Woi=NeYf{J1|7AB-- zowvpN;#45q=t;~1iJM#1dhv>P;G5rp))#X}nnGbZS8}g+YgH3w%nzcAo`eqXV5#U5~kY8PiZ?kGXW*askiRaL@mPM}8z$X7Xm7=V@fYh;8} zn<4hn(o*7Yy5hK?_9K2d&OJ+*rZxtDKC^Q^_q;&=p49K#h(>I#!1e`?L=r*o>^6S@sQ?V7LJDi#j+{Q zWNK*96)n(po}KjAMn<%`HEPu3`)GXZs`|>M@ z@ARS6%LCH$x#%3XXl%&@%1O0%`W^%$PxR8Xd}` zu-*(zz|7v2ZdAwuRLVZ(S*z`ghQTn`gCs7U8ZDXT5k=( z!?9|^r;U6*=YBsymswocue|JTFi*X+Q6cc6Qf{-c3+}lyzbb{1m9DY1gqNW1z|LuA z@MT3j8U04Q0H;PM;z*K~94yF5{rlRyayb9HBNKqT2~zdOJ7sr4Kz~9x(Mg2z+`^%j zc8(q`o8r|yB<|BL3wb7hcsBqn^H=OXBFv^H=~$R#uC*r}*pFq~??`4!b}@C$<@aL_ z`a?d&3&;xwDaG6yzzkeZ!i1OJzl)<%3EmusHj+*%9nJO)2SAl0m42HY(Be&6W0^NM z1Gk#29QK@k@RmncLLcS|-N?_=r`&Yjs_f{qsPv>VYY#P^iG=!c)#nVUCPhohYHRO3 zS5NOP$SW?v@lXa0+pe733QXosOF=hNQJ}3*R0oKJ+|sltV%9W%k7glEL2;j>piHMr z`BX&~+o8)KBa&DU&_0l_Rz1!a`i*Lfi@1&jB4+F?n36VV*h^YYh7CR$b8o#_YA&UiWn88PlV-*8FI$mn#b_r6K3)PwXA z+9x&n(t7yE!Or-6PZmK(cM*rLVt$k<>nB{nJ^Arlvl;i6?TIm8uiY*}*)W4@QGI#w z;L}jtsXhvwUSty)7BWNFH*ZDNP!Nom8$U6(w~2c^+USv^*TcUj1uQ&@Oz^}*vNy(K zIcGf)mPMBBHs4<8qLAZQa4}u`NynEa%+Jo4uqb^K9B8N}TjaS=EbVy*h_7`f9>`*u zqPxyUMTj`^JUP1fZ8)gn!*^U*X zLS+K0MB%UdFiKYD?S8y2L7`1I8lxW5?ar#7G@k2z!c$z<){Fhyd06RD3h&LukVnSt zr`wSIn&KFIq0bxpO4m}DY(EcLYNREBoOsimODL~L!sn;&upif20AB*i4>!0Lx%Bj2 z^MP^~o)*m3Me7SFbCarzj(YO2yo^XP-m*fMBfKztqZ$e++s<8d<70PnKfK3dZIJ)@ z`;0{>LplQF>pqyGfG$C- z3cF@*kJ=w=r!>xpW=2MigDz2>IW9b<-P$-?49-U3?ci^X<81epx71mv?1r4C>T!>9 z?p3GqHF<2eKa$e^Q$I@-=Lz6~WP0k&=kij%{F~=$`+oSo1p9#q>RZDNUI_D7GX~S4 zkatRFCz*MfRzCDBqnfsH*V~|Ww^H=(mRVj!I+*BgSP$=vd#KjT7O)+5hkTx*^dB;a;;bvpomt{9Jjh>n+R*3iq4TgD(?uE?d!i)4a<}4*Ax|BHptN!APr|xp#^wWg^Jl< z$x-xpUUEX!V?-U4Zvq6UzP4aZa|C>WTE~|qFQoa6uK8RPp*|8=tw}tU@X>R#Ts9xI zJuW>iW@ENyM%YG5YNKaSJ4$2z&S-cGceqE81>=X3#q}9IY?yyJ6yC7KGVSQukELXG+<$;P+St0ycBw^twnLd!vd%DqDUbWsr01a8D^CKQOSk1vo zUb3Y#+tG?)nw!7Ixj&HVfJOE-$OQD*FSmvO2~4oMo7c-{^lo*o=i%Xqo~7imr278N zfl1C|H$@l`m@%eZQw;CVvd}~D@VbAja9)D9&`OO;D-*_VfSy$~rxk~Dn?I-;6W&v9 zCaf65%=Drpp>fi&yglJhQv5~qA-pGd^{-mx1u25hGVxlAAIgbUL8;T1=Y6HaOoxtj z=11*t7x?y*4>L8l^ceT)AI#!75vjW11?!#pkw+IEkAJ1RevaS!{W7)riDLTQmmaab zgUis*6<{1q5l@(O-7wJKp#uLU0D~$~tw)gN2R|oP160!AkJlmbry=&O_L);@RBsq!iGEYoep zj;`mfuOHt6_08e?U#}7f@dF9HXRnLS!JpgRM0d)WG~|3!e>IAV!Cs41;MDXwn6Tly zo=M8i(X>MWG5Hwd7A zd~|*=;5ktvA<`>8Z4~d))$4|pBM*-ig(;~(IMQ3RgWAaNjoD$5`o*rP@0AlxVBo75 zMT?5MNJ!KnXwBr}^z<-yCY<78X}Y^$>|#*`kUgKE!BPxWD%93W7;)b4m>Pq+=3CWu z)V2zf*7EZ1kYa;b{4_4(u@Q0WnZz%cD5?A*QvQ+oHWnarXa9F9@`9eAmu4;{%-8aT zh3x1Y#=Vi%-v=cF&mrpG@WBy*Q^H`7G$VZ9NmQocDJl}&G7GYAlr163k%ndnYN22n z&a*MrXiAdJ-zvSNXC9!BiM8@W`Ja1Cht+}F{B8bV zh$!|n8Xr}ni1S6*b_!$l0!Kp#$Y5D~o!t|sCR!2u#ZN{4gLvr)@!qH`dBtO=~2i0GU@&fn2AAn~Gk5h8nm zlW6;nv%pw0>w5`GB$J%aZrp*Om62r=0KU2VVKdp93Xf*$STl!sDlHC?++=vX#qR-~ zIb{t#O}|1AKg|xp;0}U7ez4UR^`xPkyaOoqLNyV{IpfUH5lPd4H8i`51;iR?;?lr@ z;_p!ebC2TIHIy98`6I@Rg3nqC%x7h3x7X#X+$P6>yW5R{!ZVW5JTVKv{_bIWu%eut zoaQ5!?LMKiXAl6FQN{jsRsg;liQL~-331zv0Ev{Q%K`Jhn|~imc9gdlJtfSCY=DIM z;NYNcPq?|68Qk)4>#0A%jOxF&8-RuVEcqWN4HPWcQOg-ZR$#?8^sE2OD!2M|{KPJu zgND3Q{|W;z!;t8nvZG>B9SHw%uWef3=W|fn|Cj#`HhCwN$^k%AE$=VNJ>0H0;+NcS z4<;uk3%)-8jYxXh?iu+2o5c1G9`CIN^vAmj_xqdE(^KheL7)>Ex}t{DMsF0cn3&j9 zsp{0o$TP=(zZ@4I5D|#b63T9a2535TFLo!+^}4RE9K!_1Q%24m#;GGx?*@}4is@U9 zJD(U8V>9@4+U%bEy`Lxa(>Fl@AO~=C@>qz74opo~t5E^W+`K%z9X2)QyJB48Hb(1I z+^?4^vKI@g9;d4ybYo*zMx{s{4Dd4noD;TWrNZSM zj753kBlUEPV5%Ym6V7HD$phdApxa3r;j1UKCX6x#BmbK(^t!Q>{{L)g-UMI|A(P=g zXPigMfck7Ahs!DZhP*@4$(r9PXeH|X;n=q*&7gR zl<`v{71y!((H@`j+8h1XbB`J86hWXhT`hupW%gA-5mCN4qnm{*&vVZ*g{_B^# ztZ(RR{^>tflQ2z_?BQN>M1GSJ7e8O&2fV(b*SOG?d$%IM0gCe|l2Y)_+R{1%=o}aq zj1uM;=X}EZl=mI+KM17geCrLa>@pjB^%X=N3)t_>?k=#=}2G#Nx;*b=-^dH3GE?iPrF=Msw9YwGdkgZBO z4ap1wijxL}s-o2%tmpFJ>J5Hk5Bpr#CMWuGXPV=;VPuudkV%;uQ&xRY1oA}DgKMJ` zeTGD2XcUlxNtz0ZHc8|6?W>A}k481a#puh>#%rn^oi&2V*$|eAG+5Jac1==##b-bA zYGv^VcyR~vQ$D@(?8(XzivTjYWXh|_xBFV-pI>sjewwW?7GP~LvtZVIoV=J9J}l9` z$4>(-eg7^#9Cf?_E8%W@?d1pW8XZZNsE@p3QX~_dlPF%OEH-vMY?}syN{<#^U|e+c zyX)IO!3!G0U_R8MkJ0Zj9|vL-_F62>mj{;tb)NfDVVa8Hm|Zmui3rmnKQ@6%F##Yg zWuu@CcSA;b2O;7#?)LQ8o`}M-*7SfMH5Vew*_jL?v*9G(D+Oiw|M`cf@a; zPS?K#AU^7yN&$hn)r0ayb?5rVnY*joh`rmrujw|Iy_wm0sf_mkG|-k+DcyPI^uvs` zwzt&#=de_u_!C%EfMtMIzO}iagoBzfg4PP{pltI4>g@9l(3@ye7^c_d^~%=!9=+P8 zm^y{uY-UkbHexYvfjCCih;mR8(6KC6D-MWv{4WrHPl|vKP}6)+m_^NeTGJKUWHCWy z7E8u=JL}R(r`h;JF1m*=X&)y-aoB+-$D~0KVOVcC$OM@kkF}OcbLfRBDKjOIJ98aj zsJ3G&-mFwsDEU-HDOn&iQ_u_IM?ZD)N&!Lv;K^F~v77OE$C=O`h{|+a<&Jil_n?ob zpmP<`BvIw0e1j)AA0J-iKv-x?N)@&3QwOLv?HQ7JmV-sjqUcWJSBP#-Vdb?@h@aG2 zK50!o^0o`+<{qjqd~q-Em2rmZg_aN224Q@#m8ezWb6 z?tH@T(*~+mYO^$Y=n1-Hy$N&NOM#AiG0biDraOgu=6Y8wK*Ooeq|y`f?>#(uSphXS zI@mFqLIn1I4RMo-5`_9U`VsuelU}a$&09t`dfcQQPg_WtnV&YUQ291hlNz{mqO0c0 zSsOWBzT^}?B~vO5HJQRm>Yfb*VIpl&^VfPq%imF7gEbi zx3ge1ie4_%Wl*Dq#uv*kMp}zVnfrzF{I0@2w|;VLoL&kRT;r;;_E=5M=1szjjMHpM zzF}ofb8>R}(xY$hfEoa|lb)&@9E3e?o7Z%=2GzYBp?Z0p)sEUj_f=8dawtDu-8hTd z&h7OdvaqKxG*AlGaQ0=|ZjD==$Z$qqqG6@J9k)%d(CVtdF{Ti(J=rh3h&?DR#vqDp z1j(!?>jslMr{gSGC4O2PhnEJU1b?IrbZ7u93i*Wvmz3I(G?Qxm^8~LC{v_dejCXzd zxWs~_Dy6vP7|hdPK?&86U&FYDP3l?JtrDOe@CMODfa3Z$#m*mQU@95A9Z z`Y;xoCv=PBK8#$b$zqTXGQZ&D`p8(WWr$yX&X7ps(%hZdosPL{0=UbWCl+0%^@kXcRhrW!TSkEm35;71~SIp*2A8{vVD2|^@`EQrw#vXETcL%j z0MJrdcctnma)qlD$LFyrW;`W`WQ`_hH{Mn$qY+vD27Qg`E!ywxuFJ@L5sx#WTLxj| zX_fx zlk*jbGRHjEAjr~8*7V0_->r9GU*Fu^=_*+*1ssXgVY4mh`}0PX_sK0GxwUGLMcaiX zAqzK3@=2+w($Q6N->lD=K)%{XZ#~i7$_ajP_afy2ha$gmPe9|GTb`!Dn?&*y4r|9- z`{qKoq4YPdGiSKjU%z6*nGe&yyAL3j9~?9%s}_kt+dKsS(t=ZGL;&jNj87o!fHZ=I zptYd+S&rY|rQAjE>cbADw8h?9K(r3A2&reEFyVy)kM7WKj}^6a+>4`MK^c;TjG4hoe|& zFS;c@c#G^fb;p9%caqv$RDgnnGabN$xvhm_M`Bl^*SIC!7mRp$=89q?zcDU>sQY12 zSu%+$d28$!K#pz0prQXOc33b_iI}8c7-Z#}U#W*rB??KR_uEPJTtgDjLh~i|YOvb+ z(a1Qb#}Y9zk>Y$;pNdUQn~!burM5O#U}7=t&8k^-ABt%$%WInEd^KCAO?a=HkLpQ- zTbr>4Cs>@s((hYKDTVbWN%Mbo3YJNoQS zW3F25MU|BPd{7}9=`RBAbtZPDw;~kBi2g{IKnD8ip_uBVrLuCA9^qF+rgrLdZ@5(x z{(XZYQbBon{z--7iB5^YdGJH9D6y`NAlKC%NRumT@7=T!Q_vh)c!wDo`U;z%!r`LbXsf>W9D8~u{@7W@>kwvS-egBf3!+nb=<3@Iad+yhS zA1~ooal>>^EB;o0@HWFGAfOjf-WUM9Y#U!+Tct zC5zUh5PCevjX2Zl!$2|NV=3gEe@tdz4SDkeL6S&bKKMT>4%jYFO)Z|hu;tW21`8czz-*^@@WeBi7LWGTi9k1;oQYW;qav z=11mwk84gv@bOwAx7(yv!_h$gZah6{v5fU_hsoad6-Venp1UD=8OK@tr4_k|XBQfU z57fVe2++9z1~Qq%HVg*9=2&6*_&}KCj<53Q-fP=2R`|A7RRT99H`T@cG+8W0vuJPR zaf|=N(*{-e+ZG;lD+^#M#MjIdwbElhSyXMguEti}_%Nvt%1ClMWzFMu@bB$Km6$VAadtGyWU_Z~c=+c+fkV0R~pvY|;~o+f3>{NC-53QLqV^5SQjJ zzL?L0rN`m2>uxekN}k)5Jknfh@PEP~h?Sj^`P3@BKa`5t#b+poE&%oZ-cs;Job#?vcmsP-Pvl zKTAmEgzK^#ZctQ(5b+b+GNs5^V>Q58nIlf!iZ-~owP~=WD8Dg>L1hAhW&dd0sMC>2 zfAe^G2tiYJDtUKB=mj21hGI#W`5M)qLi?7ru8wZn#MBhrBxymVX~Cnez??5zL0Gk^ zE~J&h+0?H zF!7alTD_EcET-3?W~Qg>8+Ov2ks%)IS*6-96KqTpShbe+rXIRK4?p`;?uzFwV zA4tQ*mq<8X(B>D zV%%cg|86ukMvR*m|Hxp#X2e*tHluLxBg`roDZqm7p_`Ec42r;$cNhAjK+a-PBKc|% zDwghtvVp1ryr$Jcv9~-<7ty8yhlut-qopxs!aDY_rmsTeUrb}slv}XT(J)?a%gRm7 zD#?s(k1UoRRZ;J$c0*DK<+iG&IrO0_n9IiACi0Hk&$xWoC=1td@nKs^-knf6V$F9f zR4bHoP-fqaJEc67foHL-QgC5~`{mIm8{$b;o+97{MB-H=l%P%atrSKkCfmubs*|X` z0F73cPkP6fwPBjgtC|P5j}Awb?UJG5;pr)8q+M0lTfqidRt4ux&RxctQ+@K~Tr`3r z`l(G2qC7_^m`t&P>4sq8%ZIs2!QaR2$~9KO0;S+~#bz(FysHcp4Z~23VA`Jx=&qri zf(1LzbP$#0D$SYuN4beoEEUWf#yxxq1{YQ7?{2<1@GI3}R3hms+7PiTbcXoAk5UnW zOu}RaB_*}~HAs|-x<*VY&9a8&bLY6uu?8%mLF^B4G$ILx>^2*^j}NC+2}e3kOWT$> z3fQ!>8nRZeBPgVK2Rz{FSX^{@fYn3RRSR{(oacJA-;O!R zzn0PGwCHhB^Xc5yTm}E?8(VJR{AY`3O!#vl!!XUkH-n*Fv}miVf^O1MKHaN}nmUmpMiq8ur(Jz4bV}8gg+EMQf z7bm^3gM6S2Kk_>lJ=1&ckdcMj(K}}+sm#_K^8n=J({66(?l%G?#q_2*AQm^A3t8?k z;#;*q2L26~;XoHj+MKE+gGySFg%_x!*-DkYXF7&1Qp={uf=I+>fk9a&I9e$LD}Lx_ z_*7;|?-6L%bgn~jI62!%!*k+Kj>j>Y%-pQZODTw8)*U8QOe;(BeQ*WRUT|kk6>bOY0cu2GD&T;7&Gv3W^<_`U30D{_8OiRSP+serHNEguTt+Eez@y3&^ zNE}ph>*^JX z-Z`(+KA%N8G=y7t!B5~aGoW8ygxBp*-r`vJp>mgj61S8Y;wvSQGDW#nkuz2Io40aH zQ3EY!(N3?e86-)ns1>qNclzI71RzFf(vJ#A74#QbV8M<|L!pSgNehAt`_PT*4p&mQ5p4|YEB!nN^AYQDYEFj}Ct4!X$$`-K z!Lz(_P$3v}^X)&DdoW|~&$EB<*d5@{wpZMi4dCCcuLid%A_m1%5Poyii)4J7SKysU zyq?MPqtJj6f+HjObusUiDK}phl{DIDx}M}N-EG#din$WIqe%tFH^6+Z^Z_pTdDXYz zXYySo6^zDcV5@ZjcIoO4VuQ3iccX~i@mGR(uQoLTDg5&(fBzX!72m<+kfmcrpFaox zx$mF8VqiZCB-}kCaQpiccos%Ra9~m>!mo$?d{Tm%CspVA%V#^pPow?$69G~!Fy`-i zwogaM@B4MEgWXNA$KXG!%)^gw=fFHjZx3QNy7_exQgTO@K!^@D!BFdUv5gg^e#0_Y zT04gj`e$vF7+$razyzX<-}1=A%m{vSPx!{>+1*D~eJJYk!=<896E!`8lwfF+m!6 zq2mW`@8dj7@eVKZ2@_wUNSTXd<8Giq;#&xZH%%XrvLi9ZQy9QBlYYt6lehm#ozF)n zQY}Xd28emEaj;OT)7FAK(fMj9^ariK4<&gUaeO6wWhnbWEI!L@7b(WUUXs|q&@n&G zTW3y%dNV!(qt4=md+AJFwqf5@qY;l2{hD)LDkxxRom9x#?ViI!q-!jB zAnRd^f{x@2SJo{yuDQ^4jOYT!zb8Q04wzs$&G+M7M`lGbtZQZ}ni$+$(Gs{i)N*>s8C@M4 zI>}MfG06G zGUs3oruDX0Cg2Jdsv- zUdOak&oAz_88=TuIsjFkOq><0Oig?qV2O;Ze>}dDi}>f%s{&3v8v1ABJw#eZwd|>~ z_!_$ay?x%I2F_?H+F^t{ii=B^(rnmg2DhaB@18_ZR_S(V^)|iW=d|Lr^1HM%r`!h> z$j0?tFPn2!v1{(`x_S@WyCB@Q(X9x0vM(L^4mQ7Ip z1fmd5s{S{bGOg~Ed$|F__IcYr5i1lK)PH1<_HP|H6XKO9tF#>cF4*6_-;%fEz#%sR!v!TB~k{Np@$cgjr;b(D=1{O0DS z>!d<|0HaJGr^^|cBPW--^jg89gI7 zLEfDVk(^*Rfal>P;^5!_NMppS+t2iHUsjTefs{%o7n&XLxty8QEH#AwIrW7Df!E_x z!eX-bYIXSmG!%H)Rc!C?@2^s#@i_zXB@Z3-OSd=e_?GIe&KE6CXI%o&CrE=j=^@B} zbx9TqpiF~9zA};@e`6eWJ@&z;p`>JIvaZ%)&8=PIWn;4a$P zkH5wTKWyNOPI*+XB?D|Ibn(=-V0F8pCdrFkGjd4`7cq{xHGNp`Z?aVN;J-xV3NE|H zD$IFHS{8%gxuOE_l}(Z53%Eb?8zCzbsJxPfK%MER;rk^HFA`)x|3&)|ggyhy;`D0XzeF+toa1Q~&g`ve)nIcp5;g2V7waOMXcFNqCW~RXr66?_lh>#%$n?$alGXikP3}$xa!K>7vMh6%! zL(wC!nM?wYHit?aH?Qp|02csua#at=PG#h*ihg+V8JutSwwYVnU1^mmLIt%;<5sn+ zblX3uZ!2D3fz*p+S{r!>Ry=z69?=99BgbH=7^D!j9Qlt zCbCAWmK5K~@uSmkwGEuEU!W=6yliZaz*eDwJu;ACs_wfEThB3Rw;hAxW@c5j=AAJ! zd*;d;)a*Fc>8iMcvF$BX)QXf@xXCKV@HaRE&IqnVgtQ2JRaNV=EHUrQii!{wA23I$ zZPACb7~M?0E%hUL0;HA^V{9j_u#qmkBJr{OIX+2~kQo~)E{+p$HXb!*;JV<)xdJJg z)jDaJF@~v@g4)%x0;UZQ?@VjQyL}o;-6{MBw%Q-^^@Al@)97EPbBpB8C!~zu-1COH zK&50Zlj5Fm9}F33Pesr9TrmD?6gl zLmMeE?F=2@Pnm@~%bw3tnbODB1rrPEwFS=cC(AHwbdP}AHlR;Zxvd9qf>pd5E%xEh z8{-Xa%DK6?ro;)J9La?YiM_F;$G5-uhF`@e3Yq%&{!@j{s4P1CNr|ZD^wQG3BFB6C z%2b~SQ5nA!{=nMzk(WTt`6SF|<7F3uwyPX`oHyQMF9LafKc4&~lu2_e)8oK6v^o^)E~jyt zCVtSx4LC%L0Fa3SWqZSjY?0>BetcZ*=6V)pa(VP!K=y2&L<0dGR&2NoFzbqKK;+RhqzlIf6ju}^SC<(t%r!TOwv)%Wiig%#NlYf=MP+USE%^#>eRpBk-LuQHt zr5^A@dhw9U(2dbG%ufZiU*iqEI^$5wX&L`nRXLG;ZYLRz)-w4@$BqN1qhJgU~x(qe1UxS76iJ~jheSzHtV-YGS%>l86@fa8Kf zcwMJNA0lI3sE-og1!x2^!T&%blDVanXoIcij~Xu#tE;Q{_;%-WUxYE20*+&_zSno4 zB;OR3B3M_Pv6%uxR0>H+O4oJP8Q5$b0&K0_XO8_%7xKF0p>E*M&wt7}b0t3pW4zsD zK4qj`$tMl_IV`gt8%2vuXF(_Nf9%tf2zSDZJ@v^O5{F> zOZB=$e9D`Sx>&6XYJ?Bi8(ao{D-gQ0+tNV2T$nHAhDae6JO7-Blp65;s(QTat=>bs zQ-dHc-=Fw>aV(8V>>SbTZv@T|3tDFeWZuxy3z!#T0_J0T7sc^U7_l#bAH9bk7@gfD zZ2^m^^YI!wNnztX85(SsoFlntqqh)r=@0D>v>+4U70SB=52C_&cbWu?yQJ&?PL8=I zFqQ9{lbI>}yN*y%No^fS_*2##`yAvCLB7ogjb59%Tj=(4hfR4^m1#a51CP=zy3*3p z&Qd!J5VQ7_gh1oUP5pWcc^9aYgF)1kZHk7+lfvP!4K*5?yAq1EG_*nv(Ah$;Z(naW z7JIMoQoNI}m-Kv;4_Dr6wW=P@^Uim$EeM&lxrK_ARow6d#l&8zX-x1llMveWhSEIj zGqh*97@3|kCShlO+B@w=lps1duvM~5nlRwm*+W?jQ{D^1zdI#|Zd5M3@MX|t zKk>)K?m&&4tvgutt#Thq2c_11v>rZA>ox0$nw-95mnX=S?r~~(ycJ>+exSBF9N5Q} zKySQ8#Kn4(>xRZi`DoZIK3I7|huj@rW^lFf`T?&6B8#!nsPyDSP9dQ;kbx)x-b!D3 zr_nnED~!n{)d~XR>8)RS-7N2Lrl)h>VHaY;zM;r|Uw}15u5#u}+-7!lo`;?0PjR4=csk@-bU@xAdu@3Zf;G?2JrJ7B|;=%^v<)Uhm! zg2V8YdwKTQFxRq5*zL%LZ8dGPE%<{rtKpS+r_X2kfKNfB*-78ZdV0tRim{bftJKr0 z#1j;)l%5C~>0{&T9LZo=8F|T|R7aLV`-GDc(!RYILGIJ+7XO{v2K$+Z^4^wO(Oq?* z#vJeMBcc#k(0*LLCpXU?Ii8u1WOHRzq&wbN6|%pr3fl>P3!ayi!QuHxjw30dA-9SB zw@su$d`(Ei7a+XrT38MsvPMIJitq|{8k+c!uEMleTl&G9dkG-tX_71pmUM0($Ld{L zN#Cc!3!|KD0w>#b1kB?4eY)(I~S1nfUM$(J)$f=i6f6`8md}o;`f7Ogh*~GOHPwPsugvAiWpSH)w zN_32<1xwM~SQSOH`S|KG&*cloU$##GG-Fi6wB-HaeOS8(Tp~L9YqQ{}v%_)g!tPcX z{-|>;afFQRJBr4b=1$Isgc(Lm#PC}?!c+nazwL^kh%39o$U>K~#HHP+a!}V9d?C9z z+H)!5JdSbEq5P59tn`UY@cYcM{$)0Y2!@}f*<^?BZ}VjOYI6Ky-mH1I)BY8Uc8RnKrfO9y5wRd|iC=BU_&pT8aA;|aI-RiV+-dY~9Z2a4_H zbH~e}OP~OQ&ywGUc4K*#3{Tpr5ms`YvLkgI5Ovfg=5(&~Dtk&#>#M#T+gvYHLYBuA zU=>t-7Fqw}qdwQyV4Fu{E~!SQVFn1SE-{Lk1jk)GXHTPotQy8x(V?|M@dyH^f2KC^io}YKN;U?Cxn+d3%X@ z(lQDZ@4kZrP#=jRn>fp|V&UcP@fzT(lH;v=L>i^tD!|#CU}a9oa|$+k zv5z&2c%%vrXC;Tnt4^$i10#mvrv0s17BJ6r9r0PM2r-p zz)Qa2Xs$KY-t<3W5Ty*z#&xOb)~-Qn+sE(gPQ^ZS_qwEggNt^lGx~JT-{1c;@m*BZ zy}dm_aOSBq*{B$Y!ae_n1|bK5SCeIdHkkCK`nmr(_NM{eb)J{Y_PmY?WJE+gZVS%i z<#p`(r52A!g?ZQ32?-Hffn@a;F$OP1li)wet$s^bWEFslXEHqL7{C?SiCzFT z&X}Fl<*_N2M)sY|ez6cZ85~NRCbDziA3Xo?^wuASfsy169GuK;(Y}h}xVOgwsjq?J zM_u%gfoAtt@QZzylS_nlnrNR2gLv)r-`pM~ysn#pUnW-oNRq=_)5rgiq#Lu5M(Lk1 zC?G9i(n`JmL+vm`nmDdXRxN8R@jo=_|MhhWlVZRlT$Ln>+tqn%89?VjV+hM`#Ice< za@jphp5G!$G#vO+`o;jOw5Guv z1_UIjshnq?hMA%hR@1z%&)u4HPCPX(E*gd#E)KdvnM`n9Eygaa=Hq&V<7xG=9@0_u z`h1KQzWL$a_kd#g>NC3q3Uc~@i$bk#@n{EWUoB#7x8tn+Fd{M{JdK!uh*WrK^CXJ& z>}1Cs7IHUJ3+3G)%HOHX08V{(#I(@uUhp*O#bG;9O@fL`H7OtK#qy$M`|(#BFR^4| z_3io{$VS-qq%ic{7sdrT^>@$In((Abt6CrW??6d=cJV*_tnx1v99{*lvyK}wf}drD zkrx-4DAFEcLQ|p#3>~7Fwr}6<(MzRk7;bZ|Xe}bVCRe=xxoQoMV>d!UE&-oTm7Slj zl)I4d(958Ww+7pYs$#wTsAf|7>{nIpt3RP$7UMcd=odQTp$4}`l`nXwkz2fWVK z;V{`^lLWE1_|?Xk?!^fD!i(TgZx==L8UBF5>?Eu-p6e`8KwU z^j2>yVPme79}bF)Z^vg1=`#=1E#51rqVGn?eYC3E6trg1kSqm1PlL%HSQj0os$B83 z{JKKo0~z-Zg`(jq$LMso+2xFwlvm+)12$kVn-+PY_!1V`DLYoD?rByG&sgIS1q#@_uM9EAl?%7HS~`WO z)1OQ7Lg=g2Qg5N%&xHr*;hDFE~kVosdAV&QGcPfW= zfLlA&aNg>fTS*`Wd$%Xe{g~V&B?vD*ov*uAuWM<&{XX}jf(Sg@k}o_FlJRsOmxS-? zq=JDCOy+JtQ>CZ~SFx0gIaF+d{djn0A9VLu6_^VM#jJhGd8(N`i7dV=V9K`S#9#&} zV(?SKtb7li@6Y`^HNw89k_%bb*ih|&V?q@nuR}-}(4O&QQ2^HHq0Qq_%TsrflaR*2*`w?O;_o`x{a%0cG+ufrR-enqbk zG@kY+^p6qImKrHxzF)kyBYV zRVeb59@HM=&D{Dp6Ard$70km^){-xuNXXvy4_Q?z)Le8gEeF%?RH9J^V{)~MDRDkx zRfyjC9(sa~%hg97l;BY6CGm(f1A-+v)Z=z+^+2zxp}I;P2lEb`-=?Tib8NUdl41af zY;b)T?N|D~0n#^D2OclwHkz-t!eZc4Z+{%t(@^{BBJ|x0ROWN(ImzvY*OqTAp^J;H z6N^CLGj4-@FJR%n+M%+$Q%Fc;-qmh(4E<2~0y%xDK5nUTg#5wIc39!`L0d9dym4d1 zu1I-W=jkYkAUxrgE!q+L`)wqOXz=DznTA>vv`$06e&mzpK~j9=SPJq2P7GuGIFFj( z2jj;C`LIs2IrlDshc%CB|B}9zpw5!S)l6DdGqrEwcPw9_git*m5PRSL2^u0G@J{pd z2Jd^0+l9(sO>wf>fI1|Oli|^jOawOvIFUFk|U8p2!ZrGl| zzijVxMdtlIjNfeU;mlvQw>){n_9_HC_E#0A6?VtJDE9SSfZo+*@So=)Bq2#@ua`hB z+mdjZVu7P|Y*=`IS7&wY<~s0NbxAhL8(uA?;s3Q!4UA3p_;GNz(d*Z&!orZ@r}+j) zO7db0@ffQc8`vE!2~0ZGcrjQTX6@wSw&V-};t%k*A)Y%654wF$2hTvYhv-`d6W-%X z=su1P;*f%%R@rzAa{;zaf*ZaND{>_Y;rU~{MGF>%rZ|rm>UpY-&D5|o91q$1?CI=M zH(&~f(zeM0g4)C%)@3dZs6gry$sG5Q9Hv`p2a4-*mJ`S>R)c==qW_#&#Bf@Mf1$*+ z1ZEA;!p~i+R|VRQ`s3FHC~9&(x1xpq4BbLj0t^%}c?r~i2%j9#H(><7?YIAr$`*X3 zo>{Z;{SlJT$PFElF4oh!(ET)rqk0U|!wv@^t%Mwi>w|*j4F@yDOCMsa%$<+c@VsNw zeT_6=ke(I#lQl$|oLNmw4)e#&d<`y zNB_2e$)j_`;&1qnt=ruRXo1qGfdk0cF!k6*5B1*Ktf{09;HPYogZ{$f-G zF(mbsxk^&(v&vszu>Pg>146m%a?dF%qsQ-d6@}OR*M7$&O##GB_2BtqA!IG574yDy zcKhua_vGZg6?1d5Q2WKBy)w4)W%DlkMOm$6C$aLHPg{)cyoWEQPIjfv_GG%sV)Tm~ zc?66#%6^%In8ovDIg!igHLc_5@KBe{hmPBGkg@dH!ShecVHCt~YWoD5Ieb4m$@|WP z=3vYNZ=SY+VCGHr)_H~IN2V|nA#TXKAH!P{U^5WYNmg!les&ul^|AWG!V_q!oR)xq z`_eE-`0@d~qfljPnZ`yB7SjcRmX3UXrhGsOKLD%ewzfPb7xCXzI|d{l#I@4T?OyVfay%JU0Cdy zQw2iF*eQO1dwq=F`SXwI00E03eM)YU?UIYR=HlC^OjAihELNTgnGe*qr<6U_dQb$3 zYX5tsG95j0?IXIcIUgx7ebcX|96M2NER3(e%?=Mu8m0cx{LWHU7%uvrW*HpO&Ei%H z#blPL?sO-)S#p3*0FSM0QpIG8Q`3)X?OV`R3)^TUwppgK z?VP6KO>7CioHY+&)$Cb_C#Q{^Q9D0)Dfa2^su~qGj){k$X;J2E-n^O~@na<&=B7-MrPvu{t#A8@kU15EvC9U!*T59QM6KoJX%Xsso5sA1zMi8I zakp(3ivJd5V*&_2YXl~IJTh5tKr7)%Tt;Kt1(H0%5-CAGxO`)EY^*foX zkK~$085?^WZpc^qU>(X$UtT)9(3gtRqnVjm5N5kjv}tzTcV%HtTS1R150=#9y8!1g zNFsEvHQB?Z&$Uf0us-ue5F_M4!#gQ;nv63t$EC^#hyp2L@R$Yql>wQ1Wk6m&f4lg! z%J2ZcNTp;k*amt2hq0$1y#8EUqMoj_P161vYvd@JD$(K?--PDSTi-5Kqo=j;nVowG za)&|-$m%|CmU3zcH%Q1XSa{k^gCPm2jUpA8+_C`!TbVOZJ9m`;7yL>(2JPB2Tn81g z;GhX`7V%8J4_3jR_(20&qeaDFYo{&h7X0+Z_UZY>)Jpld0abL1{J^R18kX?8>ZK?(Htm71K?_fk9HGOr_l3@0~6(#n9 zNLZw&6OY=FO#9kDFth{A2&WR?GIN&h+q<8NfvKn0+UsY~tgcwyrxp)O(EqyHH$RuV z(r~${!#|)~WjF{Wc1LwNKBEweHRcYZfaQ#lLVawgJ63XoZ#|lX-j3fy-^8tZlmCc* z{cHnHU>4-n4)-cvc&}R-N2~?D_!zI3R$J4y2I-jGB0ayso z)|;K=SIsz_SZ}N`lrTW1z!4)U7`JXshEqR;ZFm#|d#ItZT${klH zb%yLPCE2;ZTRe|NNZbppaN>aKl1?)PvdA(>zmPXUqGSWrC?tO6^zeOv z%DAk>@$DuI2$Zj|3|x%wDTb6l3N8^PD=wCh;LG)a&ye5*>GXTe*DDeL&})Fy5ffRE zg2yZP^3Wj0D@VK-XgI#PjkA-kAd2ZRFb}_n$XPdlRjj-L1?BIMpGfExW0`o1$@~x7 zDQ9kige4tNOKsgUKJmo-lFmDLZRSSHAwRjeA7_ws4h}Ze{x%ZUws%Bvr7Y~mGC-{~ zFr`1-X})GshNM77?-e>zuq~DJQ;U9h_75jy4ZL+Eo@AUXjdg=ER|OjnFa@ocai4z6 zbHGQy|EUGgCnQt-b8K)H5Et&4PjX>b$_r*)|iRYuCP>M9H-FM)`pT| z-M+b}Mg8Sdxg40j2W$vErFUYw;@~5aSarYp{C=f|v z5KWV`X6NAIYUjg6sK_^!uV%E6HxQs8Kn)8SQ5H31WQ`q|qb#VC+*3mO*b`iJv~#b* ztmo(m!+4E@SwllCL$A`t5YON0@-5dzsNxS6gq5UJM>Z~+n)pjms;#m7$MIT29(~ZW5#2w)%+Z^_)slM@qW$W8qRCR#c;lR}I63ow^F|oH~gFN;SD%$L|<*=YI z-cPjRd-%j`fIF;Jk=w(&ahTcwYn-liVx9YF?(@N5MlAXf&$^9@Vo&0j{@#)xq`rB0 z$O7+K*||Fd%H(qehlL1j-3&KV*#SoD3ZFf`MO1k5nk!MwugqwrAouAA*b>@`d$@2y znmUmeVO16R$%R8nDrw7-bvd;fi{kTE4!-qt%;Bu7c$Jr~1L%DEeVv^)qP5afa&bX= zspANDMi{=B_(9f}CZp!krvx^B`lxOtwWLs`E_nTCu^ycBSwFXiFg?gq(;aGbNj^3w zTy``?s~)ChA6wKGm7%rR3AJE)%OZSk!pX2ZQGWD2=z#XXO-#1YQhfNwp5w>sMFvAt zVg$rsqH3wVB7Z$L=l5qPMTt#(Qq~=3#L5o}RO*QDV10<#MXTvwVA4M|PyQgi!tp6ZH1(NKP56^H*ejYUg3O zk%JD4_KeA$;(>vo<)MV{yf<<(KIc}^oG4g?bG>zM(J#&YRr&c@p@f^gbEDBbECrdq z&c(0$G%0~*Af6;2;ANp^xRp>Oqqp04k%*+Ot^O1pvNk8qfk12H@m$|lmxQ=N(l7W^ zTxM4?j6hr5o~;pMLfE_pqo7!p_y09Nwq1441EC9IiadE2@a)#D+lA6%&s70D8B%ZB z8%sXown}9R$@vJZbN89GYXgXP9)7^(7Iez&s}z#-EQFj5Z*do4JS?d_S^|Z_MSV|m z^`OZ%b`zAKolAWsVRdPJ@z=f!2!z^E)$Gn!zEcg|OSg9r`F;&8{Xq-5;-}W05(=A~ zJ!+L6CpUbAs`>hPLN&a(BsB;V^@(QfUP>teK`|2a8G#Vns~_LeH}1~4;7h|BMC81JVVTu*VHP{lW&JD}*oNCHQ9yBNfQnS3diH*byM7djX_lS;vX(pD}VS zKw+6UUyb-fP5k^$farU_Et>+3$iGidyI_>&e_ L5GxineEYuuI>CA+ diff --git a/windows/security/operating-system-security/network-security/windows-firewall/images/grouppolicy-paste.png b/windows/security/operating-system-security/network-security/windows-firewall/images/grouppolicy-paste.png deleted file mode 100644 index ba2de148f1b68d93b02485a531174aaa3929d4c5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11914 zcmb`Nbx<5_x9tN22^xYsA;E(aBzPDgcyM=jcPGK!f=h6B7#xBPJ~+XHySv{e?|0-@ zeRb=es`JOx)C@y+SNGm~{nmP(kgqagXvl=fFJ8Pr6aNB|fAIoF8hGI$ApqadZr~~b zZ!iw>VxM1>j}Y$wA6}XWNejJrQ5A)9uLlo&er5Yb&Edrh^seU@48*3;@Wl&8GI5ZQ zqO117B8H>lMzX-M4bm5_=7xuyCkqvWx;CLdEja9#WxC5e_3YeS z_eJrMk>2|i6dC_0I2(oX;w|4aW_WMjDBfFMPj$KPebK)BAe>?1l$?d3EE7S>N|t6^dtzix-Kt`Y%vlpNYHse2l-BTgyT{_RtJwO!dTEK@^|onjVj@UI$Lpi1yTTCO zUa(OsU#t5ff2&dWc!4hAw4Rbua|R|&Yw0Tr+trSk(ZQU=$ZG0Dy~TTZ%P9wP(gYc8 zm{M=p0QZrOl#|ct{68)~wT!l)qHOfudbO-Cx_RIzmrV@Lp=Wa+DN8AzZE&0lA=#4+ z(;uU>MqL&w=|`~;hI_rH{3-M*g;lo=xHc~D`v&ABhs~j1Ni1UrO<*XTtW6?vun+$z z(o9KvZww#L*rRAzo#xOH&Ryc(#ijcwbq1v1^^{eKA5L6MY^=U?-YTcJMbXjCI?lwg zp<0u=%SyFzRk1d;a=_Ga3+m8So6LacA0v#E$+nz?ATvbC(gTr>^h^6X^oHp>E@qu0 zk5d%Y$^1kde!nSIzkYk~ej%wr1)}fdmv6@>oZQJMRlgg#i=QJHkb(NCMbM!YEvFI> z?9LP#JtOHnYsg9CnU7mR*W*?yYpX>y?vY$HCz9KgR~6o&J|AdJ=R97XC0b2FY2OBi zbNZYL@$Q@;xKOZZ*^kCw9xX@3QOoucGw1c{B<_lNx3;$Gt1g9Evv3?89*QQWH8o8c zaLY2@wU-cH%*7+s|H#*U^qVrZpcDRZ!!B1%5T8ZcA3mD#Hg;!DEI(f4$vn>=w%>05) zKsFO`&D!bD(n@uMbX zQ}{GG=ydRT@VcJaOxGIk3bj<=VYKt!3wV8CdceQlaM4Hoqx0e0nT@pSy~xA8e4lUQ zweOMZ(!B=J;myN(RtG^ZC5hN~U8#5wBe$u0`zHQ}1y7zEFMC(_o_9A2Qnwx(ty@dN zk29n_XyC-vqk<1YTU+gZXHUmYX{okMOGk}Z5DoCkkj}F5-sMcB^s<`YxwK#V!cBXj zXqz{0thMUp`_Ls<7$4%8KX3U{pEQHAeW6q&VVUY^_uF`;;|{?zEt1G7dovXf4DVyO z^FDbH$7y3)yIvOpA2qvLD-x+%@0a`dsjzkEA*rKdc+W|cZ#eA)v%ws@=S8_%(p`cY zO@jr(IJK4^r-t*|?@aS^ZGYmju6oWND~A=kTMw!PP}$5rJmCp>`mZn1HhgyP0*!5* z4SmYVIB&rbbQ&nQmvsmJQNl0VJr3qop>XvH1V+cSA-0*rczAy@_TjE;_@dj1cD>+9 z#5$_>pz^Qy`5PBKEk)V9lj%44-iBqptT3<=kKbNJPdU9?2|_37Tx#_=S&x&wg)O+J z%^bWrYB`HkXChYG9iBMANIES*$`#{J4jeL@{UT0+lH2Fh-L?@=HwZcCWWW;m)pJ&G zuKl^M4Tp0#h^#d3m)xWN+&3AvIcl5N!V1Y=p*q`|$;rDbyBSlaI+i+|Z!ljzVqI4) zp$pIv*fwKKmvwILi!>-0xu3MuqjJPm9qd`TyB_?)Xs4_0@zDqz)_A~4PN@$KKV2TM z{pNjWaAyhoajn(mqN{Kzk=J>iHd?x4g03O(Q`_hJV;iQNK97`Dya0;AC)oD1+iEKk ziwaN(<6%~EN=j(v{W^8S!{xk}-&tn>N}Dh3R)u<XQrYRdNBn|J5hEEhjzUk>rd znB}{F5;;EbKU48}JwdPfB$d-=u7jtxO`v(K8QFe+!A0d&^yP^1JLmltla1>1dvDqe zrcy1^L)uXz%1Bbo_RaeJy)YwJ#}GbW5QTq-!Y5{t1sM}n3RkB4G4|4%Z%b4eGt;xH zIfMQK`kqd2Lpj=VYg)^GpNyD)K*I^P%#_aJU2v@N#vi_uhaCFo)ZkWhwbj=jL-6)D zHCPPR?ysvIvN0XSyUy&^dW$-?(bB?j8IX~Z3?QLWEU?_XM_9k)aLEtH5+c^!Mn*Ce zF~2rf)vhzfe`qCcgh z(Lt)Np8xqZI8T5-tC}x)xZcN0=;?z3TGx!8*zs3Y_$IS!NHm@+MQeqTY7U#o$9_~+ z_1)}PL;=xPL0j>P2pjy;chS5lzB|pbXJtN++GNhGyY*L?s3KgG39-&CPm~Mk9#|Q7 zWs+!vMhwI8@ph{6=W4u44zC?>pHl0-F|S8!8acMTpoA8cbxM1z!@s^WII6z!#iuBF zo85Hk{Tdo<84?@|Emf;I&-uw>$_XCqXf&Ik;yoV~rh|*M>8LM@>T5O~%xe%U+v2wd zwxigJS(<)cyCFl!smG(gIa!Pbus;R`$9BcM6N{xb?d>FD_t1bXsn2Zw9poa=_(n@B zokBEp!6Dpd< z_{~f(!mv+6!6)5a5+9rq?|UkK`82v7dFU{e}O#e^J; zWtSYIJKXb&ON82y>ve-Yo~<~O#fVuQ+U^Fs#G)ZYlI0xLNA=NKjw$^^v^& z*szk%v{Ux*hJM0QaQ3@C7fBtLf>PF&xV<+et2)@gEhR&QJ(Oi4Tv$vDF_KImGQ3ti zDJD5GZGWfX9TSSnB6o>SUG8GDi-C(llDYURYDDgG{rHdD1t4~caFi5CB#H25Jdsnt z`-e+j<-GSEb-5%wSH!$J8igCtdR{|Sr&EMF>g!FG=fT2R0A_Fje-xI8%F(4Kct)C@{HN5zJ%1Gt~bn0MYsJN zp$xnhVKookvhGV#V~+yr@$Y%^G>nt&k=h)^e<+2W>E!G0tkSAhUmLSn9$^nM?bgL9 z{#q+Ua+B-xQ%^Q>r*_NZvmy zXE##mnoDo$P>484J`d+R<476RxzeU=+Jw-e4VKXVp<@hGfC{O9V(nq$evc6!=*HUk zq3nB!X@)CRX7g9@W~CHc4;w{jfSu69uK46P>|`@W8OV5$b!RLh_0M%bCf%Lv5|P|^ z7zG3+3!2Q@@gF%&6k-A~-Ic9%u=<|mOfN&k3$o2v&Fim&R!BReE&2CvCNLZL?7zV7vkqTsgMju5TwYW+~ zl-yq@kz8In{siyUR>0nuw_5XF{x)zo^8q+77K3dVpBNX0&Eitv-Bx5kQo0Y5{b~DQ zs{PSDRdsbW99;+X#f=mNAxrPe;jk^9&&pnj6CpWHTxW7&1Ah$RuV+#sZ>qmgWUJz{ z@wzlG{;oC(YjWrRiklo0}rA%T2YSLn$7$5x4zMt+=)(R3h; zqgTaR1wKg2R5tcSt~(|UUnE4S08La{!detTdW{~;Ir(cxHDseHu#)iBJ?IcdSeJ8p z?2O(7Le8^8T)hN1Z%X2caf#b4eSd+@9^74&3BmJ0S(u zGJ6jJR)fJYp#g@#K03X4m^vI7t8bm=mX1f2?tS?CqRo;5sH46g zHyBK-E*J*hKvzm7Gs09sLgBAcs_pNV(utVM_sG>RIewbClq6k-^apIViXB5XT`CR4 zPzVXNzunoW6k5qEC`>_fbE^A@4f|ef@`wLOL#2;XINN{|f}j4nNSjBDtz;v{5ZaX% zCME2ikMEsWev$5Dsj3i(3xU1Hn!tS$AxWQNL>f`wXq-tyuHBu0n|=@1jOB!xW89z- zh=5auD)}lU^CUWR@~(J4@}qYvO-Gq zp&Vfw4iCS^BpJ^RRHS+sG4Ek}Pr3VeHH)JPh?DD->V3`43LPj4bW(M>K~T(oDhFu^ znO@JU`-?J*Xg7;bBbogEEJcZXjoy4(1t-l~iSIZ~5S%}@2kh@#4kfdRF&#uL^F@J- zJrnwl5v;Rc{_-bbVQ#c<9@^}T5nft>WQm7_2syk2H0wKHq_9ee<^1Ucrw9P;=C9!@w%u+Dpxl-uj?5CJPtIazVrdpsKH8MDE*`7dYdY4 zq-e&^WaG>M8tIaS46N$Z9HnheJ4!n|>Fn3QL1T*&=GoYU9UT;P^KsdY|;Ag9hT=y;DIUayxH}%4iOiq zo*|X_Z78b!mnKsLjQIoT#agr$8=^Z}_9#$(n=00c$dw&>7C3rG=cZUqJb9D;r(Gze zMs?`5zhP~+tw5u4O0#7~Q>#;+5%ZI*YC_sJDq+lJA4QwOjFZZf(Ja1Zs1a>`4DMv3 zGS%i?_NyUl4~bf+Z+B^mLY%(f=X1mMTDY$xfc_rg%&*cDzgLD>U&7EJAs zcZg($SImtA^gajEk_-(6IA#rt%5sxM}&ariDy=UGNyRUhzF-GtRbHv=g&T2-` zXBW5^1H#T=5pr0KhqryaB8d>+~#~R_6RL@tzEmo&CSbu%gL!?lWf@1+SL~<*ZI<47N@=6s&~;p;8oJHGs}k)$l{;y(0v zZoR-ty=Dc`*UqW1ic_Ede5eonlScu$(8)%xe!<;U0qf9tUpR@h0neQw92>srU%GVz&p1UYPD)9ps{N8%o?~V?eBDB zxA3e~AaQiM68kCQ-=Gay{m%juuiBUnRD1ZZ6*pqT7k}G{4q&5XoNAyM&~V;;qXK$v z>?;eSX^L87dhnZof2w`BctHjf($SDbo2(9eEtO;_&oi8?a6)ZaC8Qc4DDB<46Q8pC{Uao2{-|uy%=(KnsQ1btzO=a)0ov~ z*;#>3OL|#ghukG9sh|PfF{dun0dLC+qTj>g>J_C@=m%wMJIm?v+mgxI6Qx2N8vyyWWau zcW}lD^wDDq zqo}VP>WOlpX>URSzmbyz2ZSEn4KD?$>^gelK%VDjm8Z3{@Qqt^6u`*82M*wsc3V`d2pQFdMPqtjE)rtp zpJnqt;V5nO(TMB@5(u_f|F-@iMB&)2NgkL4gU91pdbM%toUOR^8nLL!v%5TFh2Nyv zRKVemTlz>O&r|^X2WpHYfN{!Fj#PC|1r67*>HR&(*mY~7J?60CGGr7*o|XF^k9J#h z%IAqRqsHS{_UWD}iRDh);$!OiooI9)FIFpAB=ISg5~rjD$GzxR;!iw0V>9z*=H@@* z7eewV-DuQUiGWZ-vF@W%bC`CCE@V}Vo|$jnyID&A)c9>oz9Bgi@l9Y0NPM6n%S?a6 zc{$)al7fEh;)e&n*55mVR^zo#l*q#kD{cx3Sk|fT481@G7*_UAEzkQze` z1tw2$ATm8T=ojF9`-AZO^_l4aWF8AH znWulHKCL&BB&>*2D@uH4;(XfsFYW^%@(neq`t?bz#`qmP8P5H!yKhFAEBFD4B>_;+nKUSb#e!n!UdcFguwsF2f7{XS&*sdmRxr8kCC0)N7NqhQI zCJe$x18lF03m7?;mCIW5=?zEe6Q4Q9JqE}0Jcor(~U+q+2p zR!YpVj&Pz3PEO9XdNZ)@{q+g{#7w~9q&3ca1wLiwg!Q#4*>?Y+!zYCDo6d;0M|hmS~^_ z4Qy#BYdtF^dAXR(jQ4HaG&UFkps#qfpF_+>&W(n4^(hjhX?~Pp`70V2OW`B&GIbx4 zu|L>m^(>$00QA`T)}tn$0dmRqYC$T32I1h~pg4M@(P8U6t=qtGG``E0fU9+O<92JQ zmyM}j|G@^M#FtwXQToW1Zza!&9HNFdde##8P}(oJv$OL>QnJgX{ciC)TH3RTC(Eb4 z@JCL;SkC-eJ(!2F@Iq`1?_|4^iCk$Yaf>}Kx5zP`14D#cX3{OkSePU&621wo+;Y)^ zD5GSh37o8!j9hE)dSuf`qW=*6&=4Xj>gMM58ByjPo3yxbJdq9;IqR@9@7;ZKp<5N& z2!oIEppkAuEY$>va1&>vW6E0O)ADEw8RqL}(pGXQDut&Lag6WsDBxTT_1znQ;h535 zvwzMUxateKDc}lP4!_FD{oHzwzUH6*o=x1%VhpZ_v(xUWPF2&9zAVS?Xf zez?LOrF1@R?l66947&A+Y;&;t+qJZ262{srUP+Ub9+^GOLgJ<7xt<@a#!X*q$J?0* z*upkhOy%|6HWE}OZ-#@&yj7v%#DKS*pneP#XsyRA!keo!fs*c9xf3xA-;GXszV^5z z?JcKDZ2I|-aKQ8Dv5)Q*Ub&ae=U8D!OHnW3)@vKgP6#)m`2pWp$$Ae(Ygsdl6JwQ? zpQksz^_Acq1)(>qF8{@(f@-UK-6u%0DIk|tci@%!eIL<75|o%kPBLycoh#{@qZTqY zlacO61C^Dd^0a`kEg5R1A7(Majx3h6jEO}*U2#7HF~y3a@TuT*eX1n=iv0Y*7UN_Y zH?g-4=$)W(VhAxarGdZkRsji@(=LOj>$zLnwXQ~okPt1$6 zoEq!dq&$5mlfla>uKNs{{^0fYi_|Se6yXy1za$P2XlccCVwusNY1~4!w*whthX3QSngn3|k_2K`^fe^Mnn|r{VfQ0-1 zEl#nQ0TYn&`C$(s1O5OYrmns$+MpFtCBVLX*8>{pN{>+G8LI+gl7WJdaG(PZ;^I7p zig*i^(IW`yTAjghlZnWpG8YQ0Wg92l~X4C#^QCS*5dghIFOg_P}|aIB0ZOXRop6)^Qi2)Umf~KyZBBvL{CYoH#OY;6PqT ziGg)cQaDqXC|)Ms>R`5T0cL{s`^JUEx5hXXPcO66sjV^sr1}p z6Mh4;XGbD~f*brIAFhnIJ`LFwFONZo_J`SS1Ie+|`yaEl!iWb#JK1Iy7;kp!umUS)%9b1<)Z}h7YEp${y?cw|)0-Y)n3JV9hg*zyrh|99?P^SmyZ8OI z-9vD2HjCXV=pt?zDb%lYfe{5WQ@}?XzPE~keXjqG^UhtixI$@(-GD#kvgzcvLDWv( z!^w|#0C;Fb{uk$%M*esFvZcVMBd=f_i#--JiQJS8mu4A;p

    qiBo;VEwF zVIJr1-9C5AmVNL0OMq-nky(7W64u~*=Jr(>M=kt_i??7DEvFD>Nu; z5}>DI333mf0<*9bmb(VaM8spK^pEpIg{q#46Y^;B3xlyDX}{J(Qi=%qd?b7|kqsc?K63G523BF;IP? z+S&UhCV6n9_E8WQvx9@OrIK8GGb3fu+ySG`Cqo_z8#IY4yW|^M(RZW$vpg#gWjzQm zCDoGBk}c}&^K=$(D0kB`XcX5LC}9Vyf5`ei3(wTERbV+Ff-S`s5J+WTve|U?^Y^}5 zr8u0F^}e1Ctnf|5 zScoavWl%LQPN7(JfsX?Xf?amPANP*B?gQf)#&U2cb5UAELFLsk{`snxV{evq=UKr$p`QYs< zQ9sEU{beR9d#1jToW=1)ej&~ZfW!4N<{eVcI8A&JELSOr$8$21;~vcI$7@HSj<%D4BONkDg4ReJ8qrp z>f$^|ENVYB0qhEf)!#__yBhEm8B&+GVvlVf_>7G7+Jc-C`8g+F9`PBJWS2Hn|4$kh z?Qo{o0wt|Nr$>LC0i*hDN~HXGi-Bdzf(VOb=e0vqq$a?MNZ`ZFQhX8>J<+O&ApOib zTV7fMNzcs84wbl~3cvWlu&#OCkD7q^zDsFJzJh=yR8VWqyhS$a*Eg$8E?lnQGrXN1 zaSf)&TNO@(LPA1^7n_rH8*HQm3z8998kRAVNe|9IsAOc{JKmExB_4F@_Yyk(I^7#- zS$pWNGXs(;q9e;xPp;Y;>jlrcovsr<{{8)LcC~p2Z8#&~GQ|kdCiq1eZDmt=jW(D= zf=Zcx()IY>_`#x~!52#Rgdl@*6*m|6{s#{esdPtan9^Hp*6&x^X17*PIOzIS6G%Uj zWI8i5F^Y@nYf5dDhjw3EI6t=0+&dbRS@&b8Wvg zQ}|8;OKS!A@06jTjU`SR<%{Vm?}tP>V`%>O&By^qZ9DpV48oIp7{7Olcga3QRQM(k zd&v8%u++LhRUu!WYg3Ud*07yM8#o6X%Wx2?_r$>gY|9#y3k-3M?BuvdYSx)#wV-b4|B$JZi;E7IGJ8uF1(qDBvzpj| zW_h*$`mDg8*S<6ty&}mG|Ao!`u ziG5<+=8<`+B*}#D(WD?8%XXX_jgi$F?bMbxM1r(2DBY-tAPp3r+O_ZJ2apN_Vc-0cW&!!UAa9m2*tez$m2 z=A0BGTUF>(Psm*I{=FeUD;L;HakiPf@j2MP* zUlzme@(9%O3*K}i55hsKj&bFswF9nUU!2p0C>I@c86@vW-M=;?e}Zxy6PciJ(Vya# zw=J0>9+BliRR60q1QKMkopO&ezyMC-i)}OjQ^|{KUc%E67P4f#Q$4Q8v%t;puj_RD zs*vT599HlqD4xmyhC4-9vATv4>tLo87w`!~r{k`ufaD34JyX3mAcE)+2MVY|JcZFo`qx+Eo=$Iisn@~kNGu6p zfN0!&B1khTdm9=c$tbT3WC`t)idP9WX~QeUhc_)Xp1^)B>CnPe$T4CpQ5ZjF%Kt2q zuOG~wV=u!U1&jG{+q2)T=tRqtOw$ zw95RRe||hmAzH`}S3t%bgomYNn#Y=GQ|*KQbT&=kXAH)R7Z0dBIIeQjB8~=$-$i(0 z$uwH+X3?cxVSMj5o$s<6%dK8fyI!S7!v_>ibF{UPviogEmq_7iQ+K2;Npm;*@yQ9& zaN?!|fG}0D=LPiHOnmuENd&J6h&&vGcp4YQzdx-Mmyda@;ZP7`2xHbC8E#-JZ85tC z22x!!%fj{aB;z{7=|m*twCa3>7XvUT%wZFlxJ`nP;7SiriJVQgwzRa&!;Sf07m^~M z#;`?V&qnRNuAPUm5!B5a)%nxliTrA^q&fkEIU{|0OA8DAcTTma@lL(w`TfQaQb2XE zSN+YJ#$Lh(X~n)$K;xZF$98~W zUO7F-o|BvV(nQe{dvUk<;;$gpLUy}NXZ%pUVZ{&g9JUsmB~?GstynkEV!K5=D0avn z72$z52bi0N^%jdbGH}p&Ttv=>g!u}a1&ZIBH9ivD{G@FzVHtDcdR& zwONEWjyzeF4uhDi%JwD_CFNg?>_RwhM(b=X!R|I2HNSS}%5$dJUr=-gFKKMTwCXqt zU7~!Eq5A?peXuSZ-Q$0{lAHMfeduMVFm^Z`sONH!^A1yyamk`XvRdJN^sd$Y;4JOx z=qUR*aqIC#%1$?&@#Sp=N3ou>LZ9gv9r@P1R=rmZTdCUwM{PI+1dn(>z~Y7jziLLn zpuYstW#br$)g7btgU)&6Z@}6@ID&fo^yFj{sTWJWzvHaOgEcD@k)vMSH4#<)!aj6 zw@Y9eyxuN5VDjT$5AH2d%@+Ub$x{eq--_!y?zmGxn-506%pziC;31;YiEtt)Y$q=_ z*PAFf-}iAr^}z!|gL_qT1Kk6?>TlujLKES`oaOC85Pd0@$ zi&fY23dcD1iVsb5`v371L(L#r9Vj$DT&QxV%x?y}2{Sn6XQMMeSn|^scxxCcjHF`nS#`-@eJW{I=fDG5 zO@Ok8^9h^++*w7&b)pMy&wW#D+8+?Y-CEp;QA1k4s!9nTx+7c)Z;{rIH}@Y|H`b&T zU3Fd@dJ4ntE{7f)v5jahGh-wgCkn#I4vS7H=!QrfUe0H`c0NSu!8|~ssu(?SMjjhT zwTDy~*B1*f(Uj1wMt)}b13FMHH(7iFIT$D?Dtbftfr2Hk6B)y)&X6HQ{~FvP;noma z$4)&pCW1W3;`g0u^8fv2k?0EBysVE?7c>< zX2#y|gu-td7x8XtbG#xv&RYYL`8_N)@EVcI6$hZeLN>qIXp%roR?c}lpdwFLeLs>iGkAmtZo*bSG~#+d?-;0i)YT37apW(pTmXI)xM?aT`So^(q&O4j&F zoq_hpeG|u`u4|(DI>;3FDOC+6*O&bYZ%TYYB_H;NQq*?*b$q7=7MT4Bc5|`C@p}j77y44i(u56th z-v`PqM=&dS4w8t6rw>m%N9^ts#`r$|xwUeY5{$DIKm60L-_dZN6#uhoPGFy74Se8F zzeiBFU(s6s*KvyH1UNx((e?X3h~^DWTf`}yVLI(@h#iD5)e#t$;@;}j*XH9O{mzv zU~8Dc3)Bsf+D-qpItRxwVOr5*_SYYe-T7l{braWZCHbj;m05f{7viLx$%@r{@Hf?! zH)>{FJn1B%YtfEpSyy<$V&V6fXO@q=b4V4BjheuBm%>Q8E-k!KKMLmdlLKRk?@UKT zKQlK-0~rOX;vnI9bk&(P;giID`?HS&0lqBRaswJrdB!Hj19S4h*GX{KTyyIzM&gfo z%^9?_t*;*ZqL3*8A4RJ!yp*%@h7rKswxFDB&_EDaR|qz z5Br#CB;?}BoEiC(ajrf=@Fx|3$P^?Pz{fxRB`KhK;A&Q%GF*9wD@h8pJquLp^yoNX z+x>g?$iUkUTnIL}ot6=`T~ZCRTqfM^DxaL8+#&7^Hj?OG$kbol4O;-0I%@?vOx-POFY`?rYHL8PE` z>PYLK$2P;{C1AU4O+DFvZ~P4oCds3)IuOE|soFfgl@q9~lffI5fSfFD>(Js6_}_;} z27x4B*KYQHy>*d6(33Y9E^oQn8&RQQ5Ps?&UdOH2_JMFMi3OUvWK&Taqz2T!|D!t~ zDT(X?S9@pQ5seSw0;P^BUo)&9q`ao&gk?U{C5Ef+_^fbJCJ0B3FmwOuv=x9iAE@xb zp1g(ItZZLrzeX%ja(z+O53tHfzzAypNh>nn^OW3N|D!=K$yD6Rt&|Cwl8o;`Y`za7M-PgeB=mo2Dj`c!Y6!we)odWy=yc-przz$G$;L|5gHz zh21psuOVrU8NhKh_s~|q+?D63z>0lDjsKS4KY9`PlSJc@DHfKNUyQE#S4`YKGq|iO zTYg7%x|a$r154YuOJ`F@jSNBmfg$g_7pEv+$7KLkHA(lB>>2Dw-teb1>n;G*kn)i4 zfbD?O*r7-^rOJ1LeN%L+KS;NAAfpDOaVT#}Ij;O(hmriccEi;-}zcqp0A-Z-25|k6P zJF)kJrbqSMm;!zaaMqV^ktV@tzt2`rqfkeWY=IetHzY7*BgO<8=LFpo-@5GTHpvzOkm z)_S?`d2N9hR5#g;**`(~Px(LpH=l@N=-k%rh~*f$!u54kLAWiUV-%L#t6S;lx0h8_DyA@p!>0t2IwptbkQBFNw@_l zW3Mw}6JFCk`6p^nm<+~crOM00g)796rSmk6N!Rr}W32Adv=v*&y|h97OavO>Di9rARfw)W;9%_mP>XF0Bmot^Ck5N1;>vVyDSe>z0x zJB67#tlURZ`1LatsPX@MP056M%}>YdZKOloqZfcoi_1L9cGbm>)(;qY!i(3~YILo4 zetJ43ypRt;_4V`!8!*}_{%(9y&wY?eaqoG)Rd^17?VyKoK<3SIxznZ2?4lw4>$O)8-=V zTJFZR=}b0AjHQIFil3K7+tziJ&Cx>XJ9#A^rywQa;14Zf>)-msm4DV3;>eTR+^UDG z@GcGQ!c#)#${f|3(Xi3YEPgw^S)IMVB!Oh4$kbl&MglR&2|N@n5~MFLD=Ry63QcGx zoBd2}WYe1@(hG(fr(9v+$S?PV316z80ps{sW2fFsimGqKHs4&Vrlhs9-lJ8n+n*d7 zJWg=8svbl$M$OKMi$dxC>C>3P*+K={elKw6F12eR-#1-b_;E(~MGlkkL-KQ#rkYY6MQxZ)#UtE#vP zEzW|p<+@6f%6Ew?7!9bU=}2fND7@@>f*d-T-4jZ%$N;Zw;gGBga_vM`R|6&A%ryJy zhpw&4h#D-JZ_I_ZWim1{wre_#>|bICZAa49%3{*wcl`x#j>=3Z&ty~LJVjKZF7SeA zxaM-<^Egtx9{8tVLp7v8XaSdH{@lp46tOPFwphciNTB!OJ?rB(T)R(H2hElkgw(KP zn~hdnb!g5zF=f>_Dnd6C!JFHP8wq~5@Cqx;+CP4-LMSNeAi-H+Zp)r=+dk@hF1!Q_ zt)_af*yGc)pU)F(V4$ot%H++1d^KqnQ76KylU5I%g^GRpXD}T)7kh2rTLF>s>H^+l z-Job-D_Fs0J(iceI^VOE7_Yym{YK}@w-`8GKf^t=ho~{(3TmnFA4*B_Grs(HyLB)n z1u2&u-P5TU;?l!$!JF0E6bZzow8>yPp-L>12QXp$UHgQ`95mX7@bW;gSJ6Ff9wcd* z_sTSCtyJaz#o!3G&l>NlKy<@=r2%89$p(H9{^Ynn!MX(w*FfE-@&0QJIBeftccl>- znT!DLZGzP67o!p1z?ptXR_CA6C$UK_ug-e#1ot9_@b6iU`@rU;Gl4nR_9+>=8Bz}I z?4W%dRCYfP65<~7jkw-`6F)6wEWg7;=IK@MrFk^bvL1J$x?3NIJH32fUxK8 zr_V<|>s$Z64F5o!6Btb?H&tdy5nF4F615dwE0rAr6s>#y#ZC)qTp!&nRvt$%kzEga z-Hb<;+oJr>=LRBQqGP}g^r!$>=;GS~55dj(4ipiO{Ya^2eZO_>@&WiB*ZXO8HV+*I zUs*21q|e?&u)xSuC4p#I|6vSqzN+>8_B5hw${#tVIM}B|kOAC&)ww9&`6=v58(RNQ z50=3&1kOl0YZ0giu(#6%Ra4__c(^QI%W<^$cq{@nTNK7Dk1}(V9pi@&XXbgrAVId{ zz+E;c!Uxb#C+&x8CiK-BP#TYvPty7xV{V8Cq4lPGW@#L>l;2)W-#{p+VHeWjTM6Ez z_uP(zQY$NAFD=4F^3MPHl35m`^_o%4f{D#lru!Lm+2#?JmY>gi>1>zz1n5<`n_=6t zRa4Q0m({`Mr|V5dUUs$1=iCPV#s@zvbLJ9X7&DQVbsYLaI$g zDD<2Uj@&Vx|8EZY(do7=Z?xm$${)}v4(xHe(Rmo>L>P3mcacCcyEl)tSlcfBCQaC*A01z* ztl!U~E|*4wlLtx1WyII_WW9s`N|0{Gqoh^s7G4jef(sv4n&NjyF9e|MI-d@y{^N&k z+i86hZ)~AHzaZdW!{2#(IK;oZT~6e9(y~nZ{HKBNq2#W-7qSfHry+UvSWC52i0IGs4}%aR`wyA3ysTpqrX>`4`xOm zJ8*IiSOWqkO|i9Gj5Z_r)}UtV$i{1_KNL6M-UNi5oe29j9l}b)e4uJtUhF7hk&5`8 zX~H=|)NVqYP6+yV}h?yt~npQXE3~I2%8!ioyYd1_Olc-n7=w*8By?H+@6Th zA6Eb^cE5)cHhBBPTAxs-`SI+<=KWqm<^twXsoxHkN)V{myY*0s3EB^;OUd5g z_8DCQZj|v8Fk+_Wu0sF70(&dV*)!|hlo3#nJxe(TfTLLv-p-~Gu7{(a|Tv8s@= zJ^OogIy#Lhk#e85Jo5f4u{N|v@LQ5^c;sd`>nl|IfvH2^yz__g6(59~=Sm#1 zbA5?tO91rv~g7-33=tG*@*u zPvTF!q?`~AO;twa?EE3jLML8mcl8g)`u|ow8+Xh(%JDbL(xrGOix`mNbM2O;+O(ff=4+?ZjW zP#5?fg7bC4^N9g9_ETm?N(~5ElgAR>#-&p=x5z!k9%TaHNUac{C*?cOVA&No1j$m^ zLSPbGLQi`7emKzQlF%7`q?^~RV5s1my3ieO&STYGLuPY`aA+Yq$c{F=ZsJ1cqLyT~ zJP-G}?Jq{`v(b%*6_r~b?-i=BUMxTE72f_!;a}~1P9VDt?^~j4Sbn(j`(BYoClz6O z(PcYA#lC5?nW7%iqqx>CQ^LT0@M3yr?0nLF(HPh97V>D7Z{oI-DYz?0iSu_@LTeE{ zvj;a{v9i(o?~;7m6LHTKv;2Hi%Xe;a%5D0i55Abm!MUf|Zd>J7R-s8ehu-WZ z@{i~Xw@2nkw5aWxPt?v#yL|()@YdFlf20!jU%9Cu(Lss}@Gi~BvW^|^1)(zp?)z@V zub*GmG+$myt;uD!Hq1H?-uDZQ?9@@rxRR}=dn1-ybcLwHKf56ND|6Je#8C7Ly}U0J z?Ed@MyBA`KDcirbs@owi%$RR<8CtG?I=A-Yg^X^_zgU!^L31m3{G2x)nE$3PhNlOp z&M%i+7k+9$m@|mx?E_gYm81Y#KHpZ|48Ah4{+K|Zwq$K_PxAq%o1oYB&3?2i>wJd-1@3KczH)0!zu@-SgQjO%_Dl{cwg#=2}$i9L? zaTP(<*;UcS=f!;=F{-TN{0ms%Qx}G|QbIqt@HDc&s0$VmCgv2YP~%NKM~_9pCeF z$t(ku5+)r=(t%4#cuhQ%9DyDBwGH7iDNiCUE7q2X4hVnUi+63;3trv3f6*Oz0~Wew zcl`Y3?++G#T%f^O+Mv~MW%fOO=olfWdGso`&Q+p*vC`M|f?VbTWER^h-ptWGVOw*8fi zmVx2F`p95c8Swj&-kcjXxDMw~YE4^w~uM^?g5Ljtc+o}_Q- zl_oTzD%rm2=Nkoex90_hZ)|i(N-rn8e#>+NOZXGUPNV*z0^0`vD?d<%6C_n}A9Px_ zX*V+z_<&$6H<_5Ly~AJX?9jyNc=q~I`8;7*PGH*7R2Rtm1%^6&@I#UEYr3bc8A2!mD&FnE=!C{N5FXcaK=& zre1tK4@hr5*e3rsdAo!!2FC-u&$oARp9rB>6b zmsIEM4#i+!5c1;e;%^S&hr}HvA&?%+LU@d>|0{7~+?&nKmiAZ(tL)$m1;@HP&?&^h zzVx?~ZW^N7VIbTvp~cSZLP;OIcz5MlB-f8FYMkL7v^Q~Zlksma)d`si`&poY1EX9X z5@Q6N{O1I`8@>1_zu&ceJBN*Q^#1g(OdJ<1*OM;!v}7*g_E$}l`3}wBrE7U``HQX5 z@%(&>SO}ktBeM_x*OjCn{i7;|3botHdRfe$P0?>XkYzbw3o=e$P-A^8X$Fm->^no@ zT7ktt7ueu2ILZAFiD0Q7s9@Kb^L()=B}u<K1Hu1ZC1nPeLD2$zF#VN5CwdhdmE*Ip_r@P42?D^_J^XMZlT{7h{5 zUDV*YlrXLUPc8Kzo}s&BTn9$ho!uiS?;v_nhjjJ5gF*3qB9LRd{=8vLEY*;*(MFNX z4D&*bt=xndzBE>8`_e3olX6#G%o#f+pad(I2p3Nm>^-RPIq`!|8M;#L8<6a!o+vzm0qM5m?YQl-08uI^+UkP4cdFR=jlxxbfa6r=pxf;F#E1ZLx8}@vj;0vhvs*e3tn=q#S>#ct2?41 z%r7IKuCWj@7%d7TUl5mT-0+5&{lTT~ox|PMnL_OSHeJ7H7r_NI+swBol5f{HhY@Rg*mk`IDJRuES`+%B@FOd434 zrfk!KLetIL>$#emgrPXTGzD7}_BG47_(zXRF5q8ZR)cnx?BkT&(6_NB3F&Zd39Jig z-XB-I)H=B26~2+VH%KeyL|(1$cZPhUVB?}~E64qW8#{=7iW;?l%&PuIJeY>4L!WQw zuf@M<>>O2w%e`fxNGTsnFFr5+HJ}ZC%1i;opSlVrv4)hG`4zm>=P*@>-F+Tw65E0HB~A*Ulz07slMI$CPo1@@ro3$C zsLxT7Yx$z|WFb1Fvt<;%a)Ph0a%2Y6oFAP?v-!L@dKjh|+ET+vD4o(QTW8ZkhR<=6 z#vCqjZy7JjK4Dlz>+ZHBwTq}Gxy5Dtuh7$74^?2>4<*9H*D}wSUpqF)UzV6XWWuYU zcFf{4u8l(u>%0s?hLo@|N!@=#$-@iJYsS|PLnl}Q;ZR~nH=71jgh}w)+#y6$e7SPMj`gT1+KLsjvDu)t`Ho_83ntXf+y+y_ru?F% zdMQsT<{yc!=q_J-ogt>Bwf2`LkLh2NK5XscXhl*Acr1F|>-y`%Z+f&&G`Bux$!ci* z(bTuoa?QiS$WXE6c4zwkJ>A=O`mBU=58|l^Q|V3bT&OY=F03#PE~>J?0*`?i@8sQQ zf;a`9rB9_(GU4Rc@(+C5(Qbm*z2*EuCya%kw`9n}jzu{A!L0Y0Zm0eX=3gdg(uY};nQp;D&6I##>Q}SD+ zItjL{BNdT~Nih7G9Dw!T$A7G=aQ6n8#r>JGPEiLV-mrd;EZipL&cx4BLz@dZINVpI z4cX+7CKoLNHFk}6FZ@b2z{ELe%2@;#W%K6N?hJc+b0iRalw8Cq>X*J&)xCXx{a6PF zDI06pe0n3w0}m)(%3D-;2#o(!bHT zh0qX8;a=>(0@<4*Ac(WmBO5O)jPo=q5l1DfdNag+%$vP8V9$1`(fn5ceZ2oXJXeRQf8F!mh|qB~B&Z(3R#yPRUx)hO%R2(Rw5) zz+x^tB6Rd@=z6MFTvOQd5%0MAi_H)XmY?;%A^`jYZ4E zYZQ)bWyt*vq&|WSpB&OCV@rT4nYPX}Y!J5X#n+L5y}ooRb89(!v-9bD9RiM<=Q{v~ zF0G55d~Ni)24FJpS^6JZ{-5)qs(yk0(0!xZ=80XP2pirq|Z^k7I1g`WYqSLXXXFSQH2;$#sm}(Qi5pM5w&D7#ETnxah>a z7oQ>?e_0&5a7oqqDPFI+eg!2|Oz>-xnh*cGE$_ z1bqmwjMflQPr0>eH(xD2hlFLs)>bxU5)As?H;!xQq)+#Vh`Km@p%HfLNIJS7~C41f=6KSvt#cw$A~QWn?qDV~Q5-mehTVF}%|+wuN1 zh&}gE*rFIwN=)h`L{CJops0?BDfu$gsWz z(asB1f{R{Hu7^?OXM=JlI{!9E4DS%0HsdLNKp3Y~4S)-eG>#8drqHk>G;I$E-{AOh=cQepXRj-?X8EBfLH^W0Q`X&4A@8>eo|;?n?2>2Z5_lta4+5Tw ze_!FG+h60)5~lQ~L}$Zoi|m4Y>DHv%_Eh*ovneMWqD_BH;<|@OiQIPaFp(5M+UVs2 z1zTk|2BSTfvH1%XR>NjOy+j-oT*L~X-y?n3d$?rr;gCN%p2aQX?Si;&0~I9- zpWnt!IaYzkANo7UyEwV+bMO_fN8g9rCP~AEGvP*8hhqOa)Bt6cw$Q_YRz7pB{>D;WrXr=`(wl-%|$$I}h;#TA#y z(SiSNdu@b=kFeQ>dmj^J{|i3vwi(bYW%sW9CC_GMn!#UFRX2uY|Jhyr^G_Spaj=tfI11ULtn8JNk)17^WE>=$W0Yg>eH`ce z@cz8N-_QH=`ThQLssEnO=XpHt<955=PC}0c7Fve5AHz4e`=6`!MqjJ&zi8eA&R(1K z8SlWhm>iR00Gg`TpY=nb}Fl>#m5t zAyN+L)>Sqnl)Jr5BttQAe2)%kWo2EJ+M@5#yWi>zynTMv!Yk9|MK(8g)X&T4;`@&I zm!}Vh3!}+lc8m&Wab7Omln$@kgP{f|VUip-)Un_6;O!@kS>LOl&ra9u=T>A!&5xP6 z*6t6XXI~nG5eTMVk^APg898=KxKNsesb-sxR8y80oT97iLmVwOrkIPU@?0Z|~0aH}H}sMFaOUI`0dg3xK7 z=#mx?{HCNq?T9W?)AK6<)H_hgL1o z;GD_x;KEKIr$8P>^n$HefT=$y`(38R{Cag>;=m4KVvPHwoos{*cGBU8(M3-d;!5h? zYq^1{FvX>L2VRVt-7Nxf;J!ag?Tg6XY7THyCsDr9g$zo$`aaOq?JjFyyzU9F!y4>$ zBwl|z7KzqBqrsv3N&w@75fs!qM7hSCBd&%Y= z#}o-YJwV^42=i$3o7It9CaNn)CuHLb8qPv-^eN&l0AKz*gL_t1Xc=4Oe!lsk(KTCp zdEk_ttE`5a`WhHO&OA{K4`^HY0+)37`Tv^4aC(mhWlLR1bvJMRuOL>|GwxFOYjYZb85ar`Q+V7KQtR@`IiRA+dcqW0tJ*DQVE@X_BtrU6v1 zXszh=^hECmn8DK1uaaZa@K zeFAB;bDv)t=t11^H9150{Cd~9s313`lo7JA^akFace5g2FQ#afI^B00*Fstu=t2&8 ze4N#RF3DSlwJX(#iHfJqz{yDbipf++CY3^+HHcJ*#1$|)0_jHrSwbd_2Efe~(f1oC zz$BD4iZqZ72c?=WR-zw?o2l1GJyf3X94=_>fH}gb^&)&pCiwf}JhoFf47YtgxSb~Z zHWFSouR%U_m@(cg_|$Xw-lMCbo4i`KCpa`7=O@4v41h!8xCQQuXP9qo#{q5j)~(+a zMH~Mlc>>sCxpq6Z7f)E+>XcfG9^2g&fPA zy1kjW`gjj;^y!yqpZJ+a;O%|qPB>yHw!qze=w6Afs({1i@zKHP9SoCA9zM>`JFWzc#kJQu_9328GN>vv zx3hKU^fBQ3ebhc2Y^Hb*;L?&?15lf*+T0v0`#HFY60=Vo2#V?!{C5=IYm^PknPPJZ79Jh?#RZW3yVZL(BEfea^T@##9`^mJu<$bSZ;)JVIUEqA zYLPigRGP;ijR}s9QF)#!cUY*|Nug99a9zK%mMnH+4jmcU7%sN-MHTFNxNSDTitGCb zWf^CqzJ=%MhsNBT#mm0@-$&zDo&X;Dxr52Fmcg^Qxh_{-NU?i?pAjSP`nTIfTaUjy z`TY`Tc^(i5Rq+6~VUVri{>K!szf+m*1x{6m;Vhs&x9EpNX>U7Qcs@-$@6`d){R zHV?O_m&LW-yJiGsXZ}b!l=P&Xtj3#~>|Un6ZB8boZiI`DVmKqU!EuS`fa)1s%#%ki zqWaUV4p=qkgB5wGoJ_F`F?Pm^{)KD}m}+<~sRaDelZmxBUt~3FiLjPfVWZZ%=_W)< zbdheKJ(=<&V$=zdg()UNS~7|;c&NN|5)QQz44nu~qikL}fhdv9Tkm2;EL%UYQOmPn zC}~;hJg`%HujB>j*vedPwx_l8h}eZ?Sh&?J+-0a`h&H7UGdlL0b|RY(1RjDawWTvao14#Vq7O*vv*d(Z?5>(P8bgyvhu zPAqX8dE_{#HozJT;&0$QV8Av-P;EJWT&*|?Q@Dlt;lrVp*;s$g>T>j2y@6*hQnVi| zo`hViAPw9GPVskVE$0Fg7)km+1^--i8Zn|3|HhekW(L2wwOVbOQe3WJz2;Lth-)9L z%?>)U8Mz0;7eZeDo~SFiSjp(HS=8Of2Hdur<+~UeG?SjSt)6n^)21}fVLu7J7*b^U zc4Xv%?%qysfvMvg)I#@&cV`Zn>^jAkW#O(lC!IcJ8|`_mGDm!AcuQ`)|C#@m&R|gI z)ZekT6yX&$5NpOWB!-yZiBq~pO^Z^}>I{LAl~P{Lcj!*iyZpu}h^^Sl*>w~xwW}-8Z9C21F5gzyKLtx99a9($~X=Qln+sm&6 z9?ehQ*|pd2^VhhD{=nFXI(*$S7s52n!vQ0`ZtlTPp2}HCHqWhYj6_wd7w-0hZ(_;2 zpNDxYbAZ-n02Bm3Y^5~5K3SZvd>V7a3FcPb6N;VU&af}J#aFxN9F@ec=e5o9&XlFQ z(TF8liM|c}6V~&THI2&O5fWQ+CESo)P4YrBxZ<2>GhoeB*CBcP+C!pHHY!%T{l4sc z7?kz-v&P+^;0IjK`PwwNLh9z4e8fs2Mz$fv))tiluKIsF^sGB>RJfyJE*Tz@U<4n~ zBQIq=4|`3CGJH_4^CTTUMX^3T%a?V^sIVa5fXwy^0+~*M^rY{ zFt5b|7n<#Nq@QuDQ2kLdgRfkqQPD4B9f^YnW!g>$26yM$)F_B9=31Txi!39KTaQ~D zc?DL*VKSw#gHVk8pV-YZA0 zLdGKR61OXh6$j@km*j_LQoVWbq1rRWlL*!^F2Kt>$N&18Zp^*;Cd0lwX-ds-7#mqi zVc6N77Jmk3PaA>W;(h`J;3oKO`!vfgU`FJYQteKExS>R7gd8?cmz77|tLFN8P56;NK6R=v4+i>g!j z`d-!Zo5~0GM(?%9hMfRQh`m$z208LoT&iALICq3w>(IWT3*p(rllBP}Wis8XbR^}! z#S}Xvhw4m<7ea@&zc+9L{Zfw~`Vg!~2x^>vjM6hvvLKGPhc<#;#~-)uy&J5W!$eTQ zU1I3fY&xbj7&W+cWf|rQge=K<)&DrV2AKKx>R4D)EfciM&SOvZ-*JoLB++_ubo=e~ z7DwF&mV?-WgD|0NS6ez!xux#aPxhAC7h8`nVE;MICFkXG8D%^uUHQ$=n%nUnRhmXQ zWWT-(D9c|$YR>C)ua=|`Y9DfPP9*p1d{y+<|525`zR@Fd)&>45MzB)S*=7d+gO=`B+ko7rOlPn?q+VjvO);zuOGIUsKOz^ z5amFR%GpX)+WAVh&=qIIYd$02TfmU95_qFLQd&ACf{HGrud@!()Y->#&?j0r%CxP6 zqad!=3})Ee*eGjM>RDxjRBY zJ~2$a(8J7HB(#9^YyQD+KAMw4J&)!7n9yGh{v-8!2YDB-p@egn;i(RfoN1<)$RXVa$FW4 zyKX&F^LOlT@Z6r$B^Agb7_!kcEy+4u`k55?)z`uXss$9}$80u)0B6)GCQPa^d~Mw; zv7}uk}4N2 z>KR1e-g^!9nLaW@=xwm{O^cn)c?;bobL? z|C(?VKUine4${b_8MybA`7G5Jga`tyTRZlH2&WGf zj=e+zRk^eo=ZqykJ>q5>zk<}5b%cVfrfmW+jIA8}BmCNGD_vnI|MRj6FfXh7Sf5Aa zFVnrg%qqFuQ`b41zqb3#{lMB3p?zGar%-Z@%A7;VBurVsg?C{h{(B^pUjZA$a!X0f zjs>6CgU{K&I!CqOZ26VjeEe@3|M9eviug03*9FtBI&;mQ&3hQ#hfqKKMd|jSA(4mbqLx{8QuCDxM*aGl zj&2L5*$5SNyvwnaK}8ruliZ!jVydI9WDN3#NbEIzPO2Bnt!c3GW)yg+2az=go*519 z-xv88q~nW|HzEu;#FngXR(6=pNR-kcev*wLVyW`!Mvdt!77n-KNwRA~R{C)fEYxH! z$^>H0%FKAxhKCDQs3jyAY2qfsoMU>(x>k8@z7yZp+*QuYd2=#aqGY??eU<729)7_o z!MZauV_&t*1alD&TH2I1r{KUz>wYUgo=%h){qOnCzy69OjzKPs3Av<7koP82O++ZI zm+qNX->a`>_V=7A!#trNVKJl%=^`5cp!^M0ZwNsZAfc)fMHuFu<+~SNLT%}y|cnIgSywzhm zDkaLc_AJ2!94eA_23Vi&=R?qycw=jo56*byU3_TVXqod?gl}wuqA_wVPk~rH6g@y% z$gWP`(jo@z4GK-tNZ&>X<}$^2U7CW111TQ#EE`p`dzm{l@+w(mapUvG=UT~|`WwOe;yXV{v-V%UDY1E|%m*--9y zL=T5Z5C=!DHkqRIS~adMrcDV^h6ELK75rVRe&6RI*!_kTitgHdW4M^yxbaxy@bah70cT)-EPZg>(LW<+413 z3Z+I`#BV2Z^uXU+2Up)lhrOngy%jdyS)M9CsAME_ou-hlt1E0L=q1_Z@i}$j4%lPW zDWOSs=B1>ruDyWr_>M7F&3!X?3tGv1X)&7ecc5fFYjk!jcp5>1n0PPYpe@JtT8ZOb zsG|7PLPtB<;^m5*>xR(i9r z1=iq>I-9+AV2rj$^1eYXS)6pTJ_=>$>%M${(~2kAe`SJ~WHw~$((j>JhqVpes%GNh zgC5z*m#rb!dkONi>jVWv<94RhX=J{^*}ro_l@{5xUYm%dn!nQicCr}#CEmCEB&J#B ztRN>iB$OZ+Hx8eT^Fk2g`ml?57@VvMZu6D^xi`3CHka5&H@M`1rkC(+<6ZRfv!9W# z>uCGmd^b(VFO%xIsh+N|y{sapgd6(b0);KnP}2{Fi9jFyC$#Mm@|W7y(J2xF((6@pk~yh{49lyj9_60rTO5ME`ko#J`_wxyrbq0OUJ_Gr*|mTR2o%u zMdodcI2iWV9uf3HE^WAozWfyBk8dDKe37Z&w(H=yv%`UdgBo_)OQ6B{_sK-dups?H zlH#yC_M$rhCQZmCceN)f7IK@%m~QhBy6X-48Pw?@t!RIUFZ+Q z$b$etZBPLb8W45YnEfM9_6hIpX4IB@;eFndjUe@Zx>m4esa(~sQB!e}``j8MtHs6p_1oy)XazmadZQZh*$3r2$NVJ9{F)}kFNu)6 zVOV!jE6s*2K$(s@$fFDTG1bkc^744{6gNs%E-6eAwtZH9y<9&4N-^{vaF*F#Jl;sY zm@xUM7s3$ggGg-8NyL07mw29S#c|QWeIA<5@DuNPC|?e=`E>jwzIfUeIGi=jb|$d1 z*3WYI;Oh{sp*+*Y8cp4@q>Wn=CQ}nR$oijmT)3>~(BoFCnzr6XBg6wGri8S^me4uUf^VZ$LBzbNnX`ObtP#Z$-*yd>SSGQtz&sm8U` zObPJ-@i-yAK3?JKfs`TM+)1MH!UNL9r2FS^kHu3Kr-e>WivZ5phf(c2zSR8?J#AsA zk1|&bpShT0d2^R>{{wk{%sBA?e@O5pm`-Nn=4@ixld&?2=jGp!T+s$!* zn%B;8Q(6=+CD0r(;i08dBBdYIHUixzxyDsPzxxvL|KnM@>$-zcCqTO%*9R?7Sz6i2 z+0xq?iBmmS^k(rO%&E3pKU}fbzO`dxl1!f9WidV2Mpv;M+MHGzqK)xW)VL+;cb$8Z=6tbioCN$*0% z)_OQ*mYLnret2P=Eq02b5JWU=(JK;zNXIu+V`6>YFk0UC+AHW9;Rlf~Zicj$hAjP@ zD&WWfK`=I)Wftlda{3z9Di$vT@E15w@1-b689*sTrR2W3_nqpN*g!1FBXpQ^5)}u4 zdGm8em+cPjEfiG4q?Zrex- zT)Lqg;*PY6uE_S!*lEDr@sWM~H|@QTJE%$7DAOjliip#2w~hW+=>?`OTXo4Kh$LexB!HY9xadOi^bRwC?PNU2K9B-%8t1QA^oGij@lo?>dDLp!TgSg|V zpm=w#z}|J(I2#|K03E0qHic?0ovhOIrk4O~0gtzu*f)sBGY*hEQ~JY!py7 zgTZ!IMrx3G)sROdNk~d%*MN3Ma@L_@Dc*Yj?^9is!?9jOkkbv@?ohDuGXdRN;V=X5`c^`2+#rw76T!Co3@ko$O^Z?@dNLU?9OqsY%f zEkJ*u!{d4O8YS>M*K(o#!6%|%PtYjykT5het{kV)g=8EF-GX;U+`cFagW-VI-EfEe zi7J~2SOh!u9_CF)Pwq3l4G4mwgwp*gb-D3R?msFRoQgl;q1;vTTcc|~sL-)*tYx^m-Y5uz;B;>ZEk#XLbtekGJQFl+#$+ z@|K(zog~9dFm}^BSQs&+&Flu`kjXp4{V2s_^Y!&WNfu39%8O*yNHh2N)4kD?aAZO{02Z4Q*ytb^n@RZlM1I;Sru5QpCo3 z13q*zf17y5i0b9M5N{k$nuTb?JQ4f4%G@W>F%4X5*z!Yuw zO!Wjzt>uX1VuNhb9vsl9EW%S5G!RKl*ZA zqF@Ze^N7zCn``S_OhkG;imcllY7L&wfA6RM{a5sxUi3>w`Dh`^*8bYGe-Z;>xo_&#*yqLAB1T(vnET9Uiw*y@Li&-Gods8>? z$M24-JgWyG(}t1u4r`R zbP(74a6(*+G;f`EC4h3x-CKN6On~mm)qxQi_JeiBKd3A+6sIu^(0K`%ja1Yy?`gL_ zBwL1TSL0l6Mjk(lH6rot=r9iXRk&|(84vtU*$wbdUl5{Xz;LMZdqavcREBC5LVbVj zRbeCHlZwav^rQPw5Ftl3+@)kLB9t+Xax=ifr>lEMu(y@%}Yew7YZWdzzJ&pP&+U_o3)NT?x zLb7Wt$GpuyK-)lO1E~@4t$!$s9Z$huqF{yp(w}?$PE#u)$mEX~L^JKnbE`!mrsmxG zoA<~M-ifusnP*9fM}Ls&3uqczWH+z2T}59`pPC1(x9jH z!;5bfpQjlI8p*Yqg~Mkt}IP}5m2ub;fiV>zFd;<%nB9VF|A3Dpt| zeGOVL896mQD-PoVV2d=cvL^%_8iw539N;w{)2KOS7M$MC$y+1BIhB-OptW!A6nUtQ zHEFgKh8aIdgC7!$Qw+?!*h-tJG%3kPq-waST8A?9@&4HyE8tvoj?N=UY~7rVNQ-Q3 zD%cOX*lVtX`0_)_%p1QNjR9VKf=Rna(jx+aDyt0vzKK*a^Yw@9{49S69Z3-iLuCam zo@$P+W-o$F*hxrz|HsttUq7KLhaMZMn?UelZ1tBuZAK3`S#LY&n34#Fmq3M^B^O#& znm4l*12zJFPT6OTi)Pm@%86&~L0)dpG$#K+TzDlp4Xq5@J~k8VKxNKY-r4-b6cKg! zo-O1N7j6A!ZdQGfI&t#p@VsVuOB2`jx1iG*+FD)<^e=MrV=-F>+CrLxen`Q^;049* zvx${%ev>b6Ug;*&j%GVxACOzK0S0?AC14Z|RytSwvoK7%s{A6<=lK`YPy}({=3jc? zq{E2aJe{iehmk4j?=|v=;3F&HI=3_2E2 zr}}^J_bN0n1O8Qxjk@E&rFEMS%Lj0}@?+~$ zRDNXmDni$nZ|j_IOq+VR_Q}lx4A?$3Nw?!e zE|vH8C`A<*fzTaz@8}@X?xo`cf%PRA;5r; zb(7em#ueRKYWN-8RTL1T2HO)+%jnHg53nojy-eHL|5w`1CFg;|_GE#4-%Pyye-hV_ z%-|O9m2bTas90hJfjVaU$SN^iW>m(@rohv^No&#heOagWLKe4}FTzpn0Cl5LFuVc2 zt&HXv#TF%}4!f(lU?paNu5}tuqgV?(>So#-FEh1yasu23PYxV@j5~iP@fGYT0SfsE z_rhIl*C~*>%nD78+XV4B{dI;*T(sBij@7r;Za!usryzCDDPgZkF8{|>f?mD7)lvG* zPu>*bpW|diG=?(LdD0Txh?O}PK+dw!x}gmjjvQi6Y-4Jh2Z%nyl^ete!iV$%ExCx2 zE0=|W-dYCNi%HV>Y#^hmeW%)PT>0YnO?iI0@WdwFy?JZ5!jqSm1<4TZAUF7CF=<_aN?wY)8=2nbcZJIT;OKzPu7E6gTxF40G^tP$R-OL=Vtlz592|IV`|JL5xplkQMwswhBpA zaT%vXfc@To-)&vjegEYj+Dl4J%T*x3o?ZY?QG1uuzjnQsz!>L!tZg}aK?L2uAfqEi zsTLVs3lToOSS1T=s(ar)?60tX)!%m&fwr($W?AMKS5L~SS!SQ(8Y}X~dod|$ zj{@QZUr(!(XpEQ!H?^|5y2Z-L zpk;!(&WW@wedGrKh}C1FCe2DkN>-Rub#e$^`sX&u27%t{@_Tg3l#P2u-ldlOB!PBx z0h9_EpNF4~cbOX)(ruVeJtaMqoe40W%DjBOyF1H3B6=TvHdZevI%tXeZCQlIwx9#F z@Jo0d%QHj&-=8gh`-!5FXI8%4L-zkJ&&4T%ap!<)a(CA4I}HN8&)IjW(CgSfRfHB3 z=g1ygeQ(=0(Ngzq*s;oh3NGL#Ffo#Ym4{1Q#|@s%9kNK{c5DNfT>ZLS7~?G!w*64a zjmqS^l>+OZrPG^MD$1}?*c1sZi_UC3h?2TOOe72`U8%FUIsrKdoJ;fQtJO6@!DP}J ztpK>PSE#&NP&mgZeI~nhAtE-~Q^;^7NX${%szY>tYw?zoi(n^JYO? z6r^vhGPk9!NuQV)RvNaXb(?%SyiVOV=Dmoib%eovUOL0~V|ongE^aPdqk(l7gNUH_ zwf{wwihxD_y$q=(OLeMfspInLyIns4JHwym;O}x)>`*0Yx83-^S2_kv1;2ecmFc1f zF|Gw)gmBnS)c(4{1P^nTM&PqF{G4EZTs@2`JJ6(U^#Pp@9PVfz>&yi zrho^Sn)l_vsBv&9x$Kurj*$XihQS-{>6Onb<=qA$TWc92XJwoi;r(>+>3e-&w8>hb zc^`WJzD%}ma~c2`=|X~$FH34ILXs{gytlB zZN2Z^zqjq8ecR1L#lkF~2y>Z~;2oQGKnL=xlGoRqEt+U^4D0`>;5Ir491a#FvW#C> zx;#COKWh_W9U}YXZr^61I>~KAmoYaWmq^afeByF-bCNzUu{Kmegw9ef&trB*+u2lT zTlPlQbR%toIaFSL`XqXn^-6d^lXP*2wWxy{Su7hp2s}M58|#_j`%O-R&89LiLxjGo zxO=}vX`;!e;+|vpEArpQ%BCbTPSAGtnXTN1)|Yc5_w$g(uMN*`?e16LrYa_N@%9Q! z?5n}fßGaNVc^NZseYwQ}X4WfVwqeK9{LZnLD<=>In!`&YZQN&i9Dz$YLt1H!jmcqscz!;YobHDphRB?2E^ICTc zssZfS&H7m;D#IKJDC05_sfOvNYc`&MA*W!X4$Ru~Sfv=V6&0V{Z7LKXcreRC65!e8;M*O8KZP3GSlB~7hDMx%>CaTIZ z@J*9tw9`;_+ShpjL6@dYY3zBqPfOoeO#vENlV~fBV!;wZpMmAp&QZWBWUgeLa3-^{mO}2Z$7H6`0}L38aZx#=H@`{ zVJU0a!w&MPl5)SiFFauu@<{#T`;q9b9g$K2nx*$!Z$|lQGe5D_&7GxamY37~EISw% zix=7iGET2wkvsH&IXILxA>VS)HJu=*_QiXa&2K}MS$M9Gi*930nPoo7PoQ_SVHp&1 zf}v%NnNbU)M*6iur;@e|Pb`^845&$qmr{8`n71AdFbeDT9NT-LLmoqRUQh;doxZ8~ ze$+fgvCG>KnMwH*^5r3rUY1F5sB%WUC*yq^8X-cr)(h#?gMe#*PD7xm{V99a6Fq*G z17Vo@L@gNWTQ7o=xIIJ4DZjM6PG=xm-TXCDCgm#o#Y;X?J%D7#{3X1?DNN9JrlLKt>6DW0lu1cKMTuuN-tRaN%U@lmx zFE3ki6!Y)jU_mt1+$EM&4y$-GXB#EE6mxT4&VuWimgl{8fkp0TEQFy;ks0=@2m-x3 zFo5RTmw$EiaGOg_?N5F1dj0Y{m3f7@dppbKQ@ufFn4<;RI2E_$i<#uQuP3;rwoG4d zShoEV+nLD4+-x7U74we$!pWsrX%!H3R%Wg}oT)%b>%i`YVdl-_;!)D0@f*>&cGUpK zTh6(-neS-H?eXpP?cZ2_B_?DQT{X!#9;l&>bD{%A=oqr20`{6`qHP*UvF9ya>vRjp zf37OD#Y@4*KcJ@2>G2g4NSx9^oycee4wFm6MoVjF$e26&qGcHs4# zv8npsSL}OE}pab<4DpZUFufuWA=&I-xo6x#L&k+qC*2I`<86*BWs! zT;|Ea7P^a)Y))+W7BuTkshEvwRJh4v?k^twTagdQ>!NkSB3}5@xs2ahcW;y#gxTR_ zK=j_%!QyfftT=0UT=^xVmQ#!jFT=bQJ|_5i|sZQ;t)M62zh6>TBnUED;jK z`u-!yYvLUEv+=gMqur-}V0aAvC5#yxbONDnBab@H>ke)Mb+OT$k-N)j9mG$p@ zP1!Rj@T`ZQQ=?wG2^BN&EH_1NX%NY9Q45gsl-UsNtn&);knC^s=D5=aYEUmLsSgKG zE8@45sh8zOZMRU1@jSjBiWe=57>_w?xNSeq#*DBd0~d+nO5Em|`NjR%!q3*eEqZ#6 z1+I~u<>an6g$(lLdaonaG8&FU!7uh5Khmw{1YbgE>n9}xu7<*hk+1aPVsRj|cL`qO zJoP!LDK}w+yZB+Ap#6@(ZjzCa5Ozc!Q-ii zmO2bSFljFR=mkHt2wZgEUh1kuPgoe|_dkb8<_1C;1^3XPWPER;d`j$XE%F1dENE2_%c)_D@Dd3!?aJC4JU((vOmhC!$MWTx!l07#DxuqNajRC-}>Vma8% z)(!~+Sxp)n>QUJ{g<%~>U=&h4fGC&*ed|QQZMHkqa-Nk3OfXI$`^agTFL$>2FFbM@SzE$Cd_Q!%613=(lO& z17?>A^hp1l5zCy@e*1s-p^FnC=%pmBkjQn( zafV0Yj17?+!i4S`iqjwDQ%pi8c_Fb_{$vA65+uZ0wxYR zxi(0{{cPrK?LB^0gJq=wy^ABmqw-b5HLjM_8lp@C3&!=>8-+F+KhE5ZJeT6Kn_m6> zX$Q0-`|5#$z!Rb9^jr5$eGSo1Zr{7%+HmRA-orz#>zR5w9=SA3hrRZ|lRn3QEM+gG=aQ7&!66;8EE`sVjKG&t=_#U&(`=*~%l<1_b^dv}X zn!HVoh>(cn_&A9$S)D|efvXQydnSnJR=^h8&(HlmUh{&XW?ZS-sC@W(3hncp`;&b5 zx>Os|Lr*=`G+fGAu?*%W@JcrS5^?rWOx#~d!KX`B8i`tMIp@J@xD9moS6b!LWyIk# zl4Me>wogJS=oZ}~Mu>_w6rjWMr~KQ-HKvB-&HSBjuiTn4Wa&6cCQV=+Z`RyU<3q`9 zi8vmev-gvDHu=t>x(;4tnOw~^1-`gz_jz;mfYW<6U#~!_;3)={sz-L*=A)3#-IBR} z+I7Y?GcFBfn*j@O@0V!Z`L^#OSBTfb@t0Q5*#>u;tR=3R^9Sw9YovsQBbq@dl6ni2$?4$OV3i|w{7OQaFh}sNX z4x}bOKqIn-{{1DvIps~Sm3S`!RjpUjM+MJw>+J5fYxk8`mhhy9Um-XF%Ei_oXmuyCt@!n(`o9J- zoK(BY?j$T)BKmN(n zRTCx-f+074g&O1Q9FTe!*sj+{V>&#bNUk{to4;H=vll8i5LQf+I>ICc4%0`C{0EYy zbLAMgQ2x8>r-DmDGFNIsiCOB&9@5f?(|S^S@lB-5e`abjFux{D$J|8g zB&XCCQrBPi83~~Nf+@~c@ZjO2r@_1YEHz8JzMgP3t0( zVbQ&Bv|}ksqli>(^Ie>bh@t#<3C$NT#OPa!$h$+NOVZz<`7w5Ro$RM7X-Ib(v4hMq z(c-3~%%)mGNv!%LjBPW6glU`ByG1P>0{{E&vG>oD+g&)v?cMgg1703waqkuVbg;~% z^ZDv#DU`1{^nBP(_;rGmnIWY~fG~;R+hk=+p~2KbfB963#SKl?p64MN%`UUw7z9HD zTg2f#{?>#{;~?fU<($O`5NAV$)+H&F9>id_4G)|dsfHT%zpZth-+h3se&7;CxiaL} zlpXDz<#q6>v;=yZ(~INnZJ+0zd2V1$_2v`Bs5+vuVu@~NQ#%S$cO=$0p^OX9ctr2A ztPP2+&z;~FdBvMXX&CrpZ+?uh(PQn{)7ahCbB49M>KSd^%%t9_O66+f0SogwIObm) z;XC68;FB4pxeX6Qf_U0;>wMs5`2j@$1)nOuXYv*huBW*CswBuc*4;T|U;OLl?NVWr zVDa^5giRl?#t@$8_rsyf5s&JgzQm+HBHuD+&CBM_7w4ui>J1MRk1JD$-yA1Wx|i|%TW_^)AUml_=-MYE_PK6|xD`jMt+Nwt959?dGvd2x)1bpm zC}%~Pl5c0eKHJq=*vuX+(fk@aCl{YRhW#ohrce3$hmf+t*-%i)GpPVHD6mwC4W7ySYfo}NHJ}TUrBgG|31zluCcuWaT#Z;@Fn+Uz?0At_B(m} zVcR(+pPO8HNSQ{vh~%Ak(%a>~V2oGHeXN?UlIM5x_J}q(g*~A=?Ev(-w+ZMWm5$J7 z<3Hf(bwz6HQXcm8TN=DyLe7}|6ra?)JoSQ~P?>|st(MU{sgJC%d(kqQ+FXG&2*MH| z?F>Zb@@9moX#VL2Ua+a=(K7Ni7vQrHUTUue&_0<#gy*L&rv}MlTDyLTpQ2m}i0qPp z32k;oCV=s3WOtZ{hrj<6%kB=ML9`zt7PP8E=Pz>o%!V6la?68&jrsD01{NMu#35*jX9o^rW;N{{4rQP9|`q|hEP>|s+;PUCW9lap5QxnwtNuGDc|#y3Bdcj zxqZm|57h7$o`I;z;hm(9k2~bVYV|+{3ZV=Dx1UQQzGvljnKOHIHe)&s=G%;slS!#( zoW#i!MuX@3VGJ(FMT3QH21ZZ%M>d=SyE_ECIV6Poys~Wi zL2E{vCzo&Ej(NwJNQTo&#A=tHn2azRg&QS_Q@nb4)z)%1)4eyDN6D0CU3mN{G^F_V zIUGSMYPa9?G&og(KZLLIY&$rDWK!+#*FMqefYv_(V%m?*-Ct9nL<$9W(xnX+tr%+{ zd?Xk?9uLtR@oTEd}AI@r?jtG=Wwl# z5Y0un2kNe=A=~1E1i|@k|C6LN&MsDZ9necEgui`Rod!{0Pd%S99Rx`$wQ<`fonA7F z#s@YpqbnL0P&T@dzhAv+#1ICR+xewdK>0=Umwu=W$L48oNcnS{-*mhV<2@|}WouAs zefAx&RgM&s_kJl0Bk~)k#nVUwlVH6hfA992&*v=pDB@t<&k@YJq`04?`^C^VAT*30 zsC4`~anI3vkQqad;}3ZFV?NFTUcPt*qNs&%OvcwG03z*5b_n)zLIN-dv>B~7uo zi1K8F`LmL7)jM9Ql6Srn>If5xTeJo?(quQgAWHLv+q!zXt&z*26V}ihwA3S)!7K?z zF%Ui78}0n<_FdVC&}0qO1n}!8qlBlXd@OmL6xpRlZMOrGUUJGMkFkzK=gJ)LydJUX z6ZQ?soKs!@nI*3AyIj8rSBcL9m$XS~k-UTZk_kB;{Pr(*V$w*?=W2+n`wjdeBd_sa ztW{jRnDZEhosV?usLXIf9f#}>s!D|ay)KKRJr5ug_Z^}3=_et-2;LxuBxb_tcowfK z1w0{2uygzU&*R&&-*dK=&KKyWH$2o2E*hf=_X+T#(U^Vg<}o03MLf^mscYVJcCCgB zRdH;Xru{~31aBL)3jGejGWDXaF2L$ym6nvM@RLUY*xK{E4YWi73f#NgOvKw$$v0>t z9+E(#3C1xkvNZ^7m%U%*-4rEH+SFd~F>_JoPA45bpg1#p8?2@K1^c#_z@sA#ooGZ9 z>give43D_~f-pkra)LM%k(}Csg0s}8Q5nim7l2JSXk64>_0?;N`&?k7}mb3w9x%QifuOL|J$I zl&0v?{-Gm%Lp3!ZrS+m+OBp?+`BKdI{xfms?+40lKmV261g7f45b+@1ljAO**8Qv~ z^!|24!TR)Sl;=zEPinMJ~v2f3g3mE zX3Cz_rKna$Eh;@zz-POg-~aeTI9y`2d5&+rtJI;#`J$=a^Po&fCPfV}c64vMab`#* z&xJ;9n|^lDDEL2Yy>(cWTi^aocY|~qgp!idp%MZjpn?(uC?OrvIiP@)0@5iZTP37x z7+M8s0m+dXYG`JFVVK`y-}kfc=YF5}KaWF?z43Bg*IMiRp6B^_mrZ?|F<~)4l6#ZH zhDdd$zW4UqnNi41;dKhooM=Mf@&ONs8ykve8MxZ)mz6Y~vp)ql@dt_CksUq~?+bWY zaw*$tp*q3C_7OXaSIr-G%DrJRH=C%BnN4Zf~AZPx1Zxis@eo zifR8o8dzVop@A!3oCxXfp4l-$!mKHfurr1qCpc?OkF%MDbKmTfopMt5z_IKX**a<- zQ@tJxVqyofJMDs?N6@2qOhktxiqujT-K)DXoC|o_TBpdh%*(BHBm^$l#Szr;ah` z=>67BOV*ivY6s{15D&59|4au@Jv_8nx}7Y<)KWxrR0TOc-XuESI#osnxB<|Yj|7f^F6 z`;I?@JlL9JO@4>C;xFfiv6YJ`q_D+SE8(3+MSrbgQ_OG%_d-t z8?@oM%%iwUsCdb%PY#3xL#>&p2XNIdHy>@j1-Hg{M>WjlP$G~iFriK^V>zxt^6_Ua zYT6Lkh*mL?k553}?om6z`iZ}Mk1Y9~Uj}II;GTv$R#wmzF5rfKIUoSuAeF5H`mp1! z2fPTAzuBi3!1tlX)hy>wC0Zj}`HKT$m!7rG%VTnx1%p$oe;g0meD*`kNopcY*4&B| z$`@rgq5}MB*1J2B{XrZTh4k9#_dw+dk2yW;Uw~9|?`t7>J;{_)gIS{ajO`9mEYENg zsz{Xi0O^WST&qxF9^hzxf#_dWEhoLh#cM*<@zP75Q~>buNX>=pnF7lW0i#Y8J!CVN z<2&u-dLC3lTYl!a@FiV+cS&U=KbgY3#w`RIx|8+LeQ03@_d$-Yo^AAmynQo>d=d5l zPpwLSmEFhw6oaOntMdLix?Ad!J)D2%rQ(O@1}_L33xV+zK&x1^t>Vfdz^uedIdUTs z;%qCiXonyvOnjxJrFknV&?)Zw=iuVWRdZn2Ni4^9q`> zoOC;8ZyY+ld0ArY-*UviqY*Jh#5LMOpdR@U4CZdAY?=@0U7U+ttpnFf?633pATIa? z;EhUDUHc?;={$UWCNphC;o3}9+mD|%PRKtxU&F0W@c;)kQs?Q@oMZ(@T%UE4b+pk>PI`JOM z-%>L@g@gy3hDkB_(7jnOz+5?r9N|xs|A_7EIbET*c$<`9NK9{=+o=W8t)WYsM;RzU zsoJ(wtUnTtv9cwU=&Fx>uj37hd|s`Y4$x#!#}pGJl@zpD(G}K41ai>iy(S^KEU{Ju zCSkQ8UXUBt1OY*X^5RPwjD;>Og#|qT6~|BSc%$qstEAmO%j)m*Bz45MFW<0TLlGSh>D>MHXv)G8>0vMWL)gNJOwZ*K(A9gB$F%cEJZJ;YwMX&GM2k>$mrlUu+fH~K} z@7_Snyk-*2n;!!#5x=*&k<+J5$h;XK$`&*XS$=dK>rLPqTS>Rxp2okuYgx&qNv_z3 z9;3b+YNUUiy%ExC&de%L<*ysTg1KWC(IOPAqy}N`7x1^F;GZX)HHBNRu>;#Yflnj; z`CuHsDin35d1_BC(PCskD4ME4G4yLWV&t<~^#?@*y#Z2Z@AAg-@EFI+FLCb(ya^dO zK-D9e@Cw7-`G&XTJ|?p_T~Bf@tTF%ik7Bg`oE;3^&&Qu3ACmpi0JO%7E$~a2d(#T* zQ#*wVF;XCr$M$mYh}8(>OAcX5+ktJMc%W<6z3Y;Zg#JwGfFovp3OaM^UCgzhZPw{H zAog@xK>8pu{hVJ>Wh9yfSyU6i@#YNRU7m22e+Dp$8x4yAsG421t*v5o{xctpmQ`8vaY?t#xbNOHk#+P9+K> z@+OQdO7*JJ=u)H?R00?GUfY|JtW_RUpxjnhT+)PSrh4HAL7w;u!`7=*4OPAW^|1c^ z*jVqV#j0I0_>D;s9?J5l)w{~;h*os$|EPx<_V;%lg2@pXbt%-oM^> zw%`AWql2%rh@F6(w3LX3bfsoaTtVV9vCee@>#lPg_S5ge@eh(yt1F0eI4M(w9X(27 zgzwkA%gY_ZMqI?+5nbw$V2qlijD~t^KG9gBOI7w5;Ovs!hd(P=4CP4YqSBh8hN7;%@3;;Nh9i8f4p{=l$UR9f&lyW{;_XOXx7Ttn$7rT) zg&p+*HN>J3ld<#@eFkKqVx!bK8D^5>01^$4t2U;%tq-5BbN&*dpuZniR}YlPuzF`n zhBFSpN9N_a+GsQjR2D*ry?v<-#76vEycGK~Va%sj-O!EGi&|CoMg`j``)cR3eR9}# zqr-o_TYoPXeR~|L5qv-G^g5iLgZRfrs{0Cy`-@!op zu21cT{#7XbV6O6g-D=viv*g74wxN9%M$=B9e=qMQh3NSlpqPhvCoj4y-l8TW_nie6 zBiGE2)=3(E+R-7ZTq2je1k@UG!yIW&A3eUq8R^tVaOC>20QYz*7qGc# z%(QrnwLoN;il4f-)rshm`u_ZCIV1vZ>2y)3122jIj`*+a(?};$BMUxX3tf?q5-Dt( zWW?_KpckZQtn&kpB)dl&2&KY6sxg!HFVMsI>1U+t8yt-yw-`<5qHo8^;!7o(AHvHA z%3r`I<>=0e#{2*KXhiiVLM@BxlL?&Mj2qJHwfpN_ld1Nh3`%jn*++(*)ODZj|0Y2Yom%@GS6-+|9Lyq6|f% zJd6_7lduYM+m^SGM~+XUYut2%&#KbKZ5hp?}@_!7cPgm`@VgEc)a5P-*InA(-)FqDr;21KNbxWp(^14l41Jrkc z<(@nEi*X=`3u|deUGh1!*9QXQx6Qw-qc;JSH8(G>J}4I$wU1g2vgLkj8mnR)m{cz& zJ_fqDO3u2+gx{Q%PEt)V!C4DyKe-W&CuI({WXc~sj50!*rJop zdXBXK$c=xQV*cyn!b+J^4>FaO-p|uHsPw#)$7KR1LCR0ZTbJ}YPbpBL-PgR=gNG#}V+{6T_=*B4+^I})=EB)lLhgio`x zIz;G(M=ZWIGpgw0@1lg?bNwL=%57F(19EF(aCk4Q6?{@e+Xy~l-a-FB3cI0U$LDS9 z@_3}**p~ntAKtpG^oEtklmD?t{%03ox^!qR=xHY^TuL-%StI!LPS~M2(<%^g9Vki7 znR$T;o+o!gRXR3!eYC{IM71zryomQ#uNMViF|o|*s;ED`OEfh37dCU;FtEc><}2l< zQ8E?h0O|9VHXM4!)mj(XfC4?=a;NglsCyhyrh<#wb1j@S7rk^r93<{g4w^G>kr1PN z;*<`ez_v108YkS#nR1iWBCd`(mTNu**4qWSRXkk7G$D_ZskYd;FDW_WpYhz-Y@)&vxEqPV50ML!jAfSwoR=yrTY44L!DTO! z0GCWYDJ-#`YGUYQ47w#ZJlPej*oyh_)IK1|Szp06z)RohOur&O`%o8s{%0mFj+ccu;FaezlGmz_mf9!{} zTI)*Hgm^VaHi2&%BI{tzZ^8BS&|ew7Of>dGcM@YvfvbgT%3dN6Ij3XZ3%MDJKTZl> zz9JO?Hz2j=Ri9k|gVnK+ctK8<*R?puf{%*6dz3zhF7mA7oK&G+5*-k$;xNv{(|k58 zT&t0~GnXlYGR6VXp;AF;65+0dyGe1C^|N(5tXWd<_ub0a*o zjXLL=lHXt~2#_0H;7R$E5AV#^k5bT7-TW5Q4``Xo8jg|GH2RxtWX@EB>@NbAHF6jE z)!6Z^ZFYBc@Vhvb{~IYv)c)$fkk$>o{x<#QVH*DqHu$E$NMv~0<|@&cn{K%uN&zw{ z{vB-(QIEDyNNct2p-QG71z^N2#D`mUl9CB$7iiJpl7s1K4QPb5!p3hW@r3q`jZ}5v zO_}c3v|L*Xf?GjK{mFVFBrSr0!8$x^*_2u1zxI_TH{M4$wn~f|*=l%l7hB>QZdu<78w8x}NMNbO0_p{wW*4K+>!7qoAI@?HL{;^+5=(BQ^2r0{$E`b^*OE z!=o3@pDLQJQ4jvDRsG+kqaFDH*GsvZs-+&uQ`rBtJ%fr_NU|9X)xEA$ay{H~?B3;PVldvI%`Xjs&!M4?>Uzw{N7z`>ifRm$V)SGC z70GgvPGxUG!Kf(&%P7?;)_-{M<8E{%d3PXVw^BE#i40QD;Xc0!cpH ztt9j<`CJW{+q6oD0d=obNbThNx{*Lc#DOGh@X;r018w4MC8rJDCZG=TqTlY?9^5AW0PpO1{@)24P3}~M z2dX?e$Og*!wVJDJAZ3`Vkgqm#%Y3rV3nO}grYj|qW*-P0&7v*XKP(wXd++Q&*rzcRH2TO#tfgOwKRB7n;i}sWw&-;?>?~ao?5T)5} zFDy)kW?ZE>YBOl2qB9HD_N`b8DX%fEIvo?wyi;UspPY1RZZGny_U#OH?=I%zyvR&u z^F6yLblM|O=AN)+vw{1+gRmdY!B{FfiD&1?7yO zQLP;HLt4N|zw zzlMH={`NP79m>`UpYH3#Z`ES_qhW9(O}xsgR8n~<(T;>bBI}vjhTyf{6`YjvfBp#+ zl2bufqIJ=Dv^%DtkM9%~ z`;hLnG6~OfrBXI-9qqNb=WckYJh26%Ol#w17e4yO`lPRg*jUP5S<9;$eYpYH62=tj zLP03Xi43YKzIy@)qTe8ie*GOY+89K+#%!+xiPkd(BJ6n2GCpueX}hs&;^KM}f+%5% zeqaLXJ&ckf3BPf&XIPzv`=&M~m~I4{wI$vBmT=|$6ZKI5LcDNohRpTRpkMvC%#Uso zre&vO*gOdi`ys+j=TCNf?|jid7O9N9wVt~ZTqb5KUP2@ZJp*>LIx&jItBTytHQl-< z{O>eksp!S$hqSK;JR8LwA4GWufF_Q=2Y3HEM#Yd12;p~ruIu9ev`?;hH|U@9FqcC8 zw}jfOZpGR$$CFy)(U$Ae?I)`r5-&n5bJaoC;GnU$+uP3(^@?(#R0-TmeiDL$2%Ap- z5g#s+GfAo0%IB*@Xe`O*=ap$GeSK|w2@6raN;&`LV6GSO+UVMt==1%SkjFAx)8N`7 zKSQ3cv%`$)@5WAtCR4S#f}#_^Yu- z9&I}B2B&Iz^iix5`K17HgeYCN(*m(h3OwaJx}=}e#h&(#8rxk_mX}qS2K@-R#oP?l z56HxwbBGN*zZuP3>2XkEiX|<+#6NL9U5R_*u+Y){{5)EN=BfxhNek|vA*#$NxtW)V z#=XMPtrAhb_wHq2J?+CrhIU$XVz2&0m_gCsOm`99#n^yCtd#hUJM_&zqD!}C@M2uH zP$=g2(?g|?(NvX90L%CLzVfxou$vd}-8;}RS96mmLwBy2wUIZQqiB-VB!UN73jMJD zgh<6%@O=>>^0_Ixh&~$@mq}nCw%IPWPWr%O=!v(rmb>l^j~^udN~+G2q4&G``CX=K zMK+dr_Hl}rNWhIy_mt;LThiu1qhPCy<_LNz5W+n&5r|l z8oHDxBeQ8#_unN=5w{dw=C-~k08lIf+kHmEo(9M1Wx2jtVz4B(8lYuPjkI>BHM3r; z=06gs4wnVF2-2B=a8nG`VCsJOuVT2vhT8>iu^zRZrmT)Ko3Pm}wQBj~y{dDS6+)zL zlt{!&NwyVdAF0YttwXHN(j9}~pH)k}134!sKxvgyq3ufjCGYsL9W@QT)1h5k=u+cL zG-izpNxXs^pstIQ+N z%TfSdgzk48_xR6FXcw{+oN=hhIhW1%{SVI(X2=T`$9els(7X7HjD})r>`ZBct*}my z1;L&CT%ivRDBor5h~GU9P;9saI8hI*0Jn1D^(XP4&wTO=V0L|UE%jxK2l*fy^!NZ; zwnkhE1=d-)J1uv+07+e+H182Xs@5(_dPsS!qW^R?+Z{be+uW2*Met=#Xy+oZ$WAe> z@LO$j7f4x?lan(MC@?7qRp>ah_!b^bI}ox?Mm#{&(2y7^SPC^wlrJQmJO)f!KP)loty4!l-NLo~%$mRV+8&be?~)+aga6_dd*=mXKM zB-^XK)V9;+-pZ3De81WLDC=oesb$G4qdIo9W)$l4(F|Cu$D%!xz5u(9as;$~e!-Od zG<T+9^T77i=Fj-!TYhJ`b z2={2E)x=e_)MU(a&0yu;^Mj>E-{AAmtnWrGXIZT?Q!@A?A*f zE#51P^)wRSV4InCjIa9VwN9kZ+g)o~;9`gln**y$NXO*zpBDVr8!A|lr0S!$Cy>4Y z)f->nvIr5iK)t|@TWWyaTIt^0U*E(!*|sv{oeyZ!r!PEWJlcjrQP}$4amjTBcL#i+ z)%>5W**us?XA&|XRInjhjwk+HdiSKcJyZG_jfym?bf{6@6_J;H;4sZL!#vaZGSBNY zYtTEiEx4~`LoE!?iyOkBCC2CRYC&PduI3N(PKvxy-bAEjA0_?@rHh_(8D?!J0<^sVuGP4c1kef<6L3O6@^h1#k)^xci1)cW2~eE z|C|$(xwwvsBowRvI1N`cB7KQI9a;zi?T&MspF;-A@5AyI*gs8x7Vo5{)hyDo!Gi%L zDrnyS?2{Eb(y3>>+71iG^}kNQUljA3wYdz;jIMMI48*U)drT#}V9A_A4)!l6V|PK8 zyT=rs1?J)-*>s8X&g27Gl&=8@B8! ziKNsyD~Yd7`v%FlGhu5=Er7UECHRFuW0ln8t#@9PHiqlb&Z)*2fa> zDLQ?b5AmL+s5UM=$;{DXP=wdC`G_6)>|-@mC}b#7)(S%?f5+3Tw!}Nei{J3_E4q6< zI&Y2p9!7jBx^2lW@C8IPl8$atz~j*A+qfUb$yB4|WqB`9&m;}*-=~jlFNnOgdc2e* zPftiJF0oAmQO_bQq!|PXj+uEBQ~MvXNVx`3R&j}iVV!|&$sy*l0+A5^tiZrtZhoX0 zCo{E0aZvp=)?q6Wo!dhh2zV%oA=_8;ma6ZeBrl@$Pdgk8wQa@{h(6oppN1|VdugLw zPUWaNE!<&;F_EvF_i04kL=h+SD^`bWL!D-ONQ89AX30%%wve`Gq>^bCXLqiy`jdE^ z#`V0i+wq={-th~5qv5|@1p0Pij)S)r!_ewd`qIfDtwgN^x`ykzZP1))$KE-n+dzKK*ON9+fRkN$ zu6tol6SKJlSzvQr=5{a2rkTA8cp3jbu^`D~hSRM)noF2weJ9gy^+L1V@o8V=bHf4y z@nU{MxA3org69TNoOBEw_{AmnzlaojBO5Hk$|wi3#o5~?9`d!{2wCQFDD#8apyy+j z+;O|Pzt|a)TI|RA$9|>f$$rhZb8o_BU+LT9uBC+?mFHKY)>`CH+EMLGr_@M;=P^U@ zqo(`CK?#_Jv&Z%m>OR`07_^1Y;PW~$r1jCQAact^Z`h`twXSuu-zUrH%_L>4`+0dt zpHl1k9P(GtsY7&--%QZR@6Az#ivG!UnEU*C*#f5dg&8}>5HHEs1=|kVbME#8oBrY& z;`AkGSd%84d63hmquv=j;@U<6y>FfZZ8njwFX6Rhw z>*7SJZmXetLpWN_Tc6bE2mh3>NF)SAvVBK`f5k|#NS3Qgq#1jFML+56kkD$C9lHy& zyiPQZ9LNgFuJfNkekaWn9^Ue!_vauF>rGv~f8%2z$((Aw{t|~2&0+Ai(tJCY=l!U0 zXlbMHM%`INIcV;|WYUfFc)V9ehz2{G370AkjwE?K1tKSyz$na|mNm z1eor*Oc0M!vHtbg^Xgh$rvo36&|-d^A6U4JWzsO!MW|DH55)>au~Z4%(?lcZ_ZC!c zVT3Q{^I^31XKfRxkfu+Md%pShFq_ZaL4oa3^TAs_>#!^MmT7~y0+pQm(~(1~Wv> zm%fDA*(${i&F33P9hb(!(_!1!+IorXKT6~)3R;GIH+Nb(HSaiaH8;8|iabuT2t|L} zYbni_sp&j&S5p$R4vddIokim07jngK;SbF_nsQ|UXVu!PV@q|qr-b~TY zN@r0y_Lm-5+v5IAF5Z$qAHJUbC+T}Q$o7#XIwr$S2_C~dm!{D3Ian~YIb44g@VgHC zeRiU9GBp;YEdA^0tFhps?LiPQb4jqR~8l9`cn?gF8yW))7E5{CW7%Pr2m=xFD` z&?|!Dpqai@42T2D5Mg)$!*-*);~Bd@FUE8lBpPFOdchL({c{8M*KBB2vvVOwt#1hGoePuhH?33QP!iwGgcH z58jb#9?I~j^{~_MGp7-U_*H7F`SiHNFzzFey~bp!O1u$M24wK&8y?;k7~VqxY~t-x zVyOILWjf>Tvxo}aW%bPwzdrKr%>BeNCLhwEwatD{e?DLAoQdpW=>61PZwu2zvZR=} zy%1DE!a?lFTyY%n2^L{jx|4TMSJofw#5UXYQ!3nZ-efa`64^l=oxzE z)ID%34l_~~DVe8vp$wi8eAU^Rm{8aIgpFbi4VB|s3(^+(J^TJ@VXIty?3`}R8x~4~ zCM1%^kn06v)oRD{v=ozb`}hV~K`OQ-cM(b^#13+RtuoI9&F|IEW*-9-0pNQ&`7ScdnYk&`|iPu8*kBpK)NaFUKuGq)Pp=s|ndd|8s zHuZ@b?L!|Qx5I7IT7Mc+x9f;-P@*p)dD4hFrPkjsi{rJzbI+FzJ3WN~I&FJ}g1Uq?Aq=4u(sYtC-pJR0^DC+d2Y? z*r-L#zjj+eE1xFG3P+6-!LlF_kj^hCvt26?)8^DCe6ahnn)XUWoTs>QO_F*0NO1Vn zP(J>sbmq4+M9>}k8D zrO*D;N!8)V!({sM!;Xm7{vO`VknpC${)nrPWBr#BO9U=09}^n4rPnPzwyA!2p50xQ z_8pLKnKvK}k=|tMYFuh_$DWo|F4zV322U1QUqJkM*5t&R?wJ$=a*XdQAl z16Hrhv-+P2oU$~e7mM6J^*uFZt*8`{KB>GxNqX?}HL@{xEXbfrdv_tZ=R7EGS8dxr z$^kiW^l4LWa@{JuF@%OhbRodM-nS+Wk5R5_PjzpI>Uy8nDS3TAte%}mhfMOpd7cdU zcJ*+4;C+u6i&Rn{2}+HpQZx!Keo5^}cZZq8-T5}Yaw2vLg+}?XuOqEkEyQSn#i1bdHlD`p0)6i zMJ4*7()-6auz@J6q(&WQveZ5srCxLptOefCOS$P@6#CplPbyS5?8rRc?HTzm5f;T}3c$Yhu=1ZEHVn%zjvLyv_e6KQ{RM;54~fQt@`Lxk zr+HD7TqSzqR`cw8a;EKdo#&UEoSHJIN4H20e8K$Cz-mj;u^UwRBzp5Gmo8%cz$pH! zG4Y-3itnd}6O~+t&M;7wVR^YO{G~{AxZpPGuOTBJ?-t$?1|58KLEX&JsEe0|mkD8W zun7%;lkXxvM?GQ~&8RX1qsfa92dgN4WrutAi^@pqGbrP`b8vffJxG3o73ld$dS3!E z!*|^WOhgPwVZEk^3gA#*Gqd0-xATCTdQ3Z&fid3u^kk1n|AE_*lH&)lR8O!sj7xUGKJ6~GMgs|=0yS?o=y1S!%t~T+3Jj(2}S;8|y zRdp70p-f^zn^%d}ZZLW(>`H09=qyaUbebIc!P>m&P8>3%J~Qh-%jppQIVhfV z;0?x$7<{U~Z!=`~i;H9hbYzPE|@Ncj3 z6?tD!%js%#PYY@!lFVAYjFW4Xy12!F+}+h@nD+v)G0i zRC7qb=5vP6JS8$(%d0c(&z(q=Ut(6xDuxE`ao>4oW^ z91`5_?FUbIiN*4Qo+V~d?*(l=!fDAs5)lkcElpE6mh=jz`$REU{%)dSZo{Yg#MLe4 zWnHAu7lQrf=Qdm>gwB(_CYh;2Og4+5QcUC6qV^QMaNhe2>N4zy?4-deOxNF{H}S4I z;yQEZ9EZ0#WK{B7-celX^WkQ2jeS&w10zyvmAq-XlL#)>?oi%&XZ0%DZ5U`>kxTDojmOi z;n6WM)dU(x9@+(Jmb+&$LlkMsPoqLNm=zdT8LhD-ZWYMq6dy7+aXq&fC1gDt3oR|u zpFu0u^tmi3%5q)!97V!=5ap~R!%Q>7sHc2!A)WOYA*9EbsU0^&fkey7rB?3S3)mIK zL;60x&ktT7m^rddJ`rurb_;U65^^VqRgWeHLvGC69I_=?;Kte0Xi6XtcydDS3fx?n z09)drIhA^)UbYlXh9n*gMhaHh1HiHWzRWUc@~h*=dre%ps?R%XtQ9JUw-*Eq7eIMy z%)I>U>5-3cqesHpV4W^sflOxuA1AJjf3daU&zDIM2U+zWrK@OJ*}gS-bel8}wTKBR ze6x{*nV?^As>a2=x=ogs>FiPY)J;MYzsV}!5t(_mHy<+DTxxO?@g{KaQ8q4V5AiE5 z<76l(ip#s*!*yF){2>(PM;wk3@t;|1=z;H@Tb%z+5U3uHyigzMV=qDs<;C4Cym5u$ z-{*;0>uaoL0>3JklY(eprrFnLx=)SCUx-9~#wDA&2i{`-DH8d%I`$;b48d|m^H(JR zN50=TR+IjtvNu_SWXfsKb;_x_ zwh!tXllaY|5?);URbJBr(wP(|n!-@cnWo*G?3Q=%14gKMA+I&>056LWDLoHwUSiDA z<=J-+c2;Bsbwokkn64Q7r%eg5^Rxm3ivjmBJS@UUf*c4W^ug`eDl`LMPG{|I;~I25oM(`;71GbfbC} zFCP`gR1KL*TAm$*oevp&yDfZ2^62*&9O+o4e(WPvr^KAI(|GqWJNoocJbo;RT{am1 zhZW6eWeLh$<_*Kd?|+8GU(pN7!T*to_i(NFUWfm#b|Uo4|Bnc*au7>fTM|c+n_|p! z#WfRHQG(?`_|WVQa}GzPxG5IWQ)XV$Hr)FpYoyage#_p$G=~ z+m;VI5PJV%%y5#M@Lo6Jj)TOz#hq}p|BQlAn))AZwFz3r`AWA&v$fEW?wevEVSMx$ zg@1~;yS=k-EHp}mY*)BXqE4#(&qcSdfJXEgHA{?i+<96wo$5;;X5_-T7<1kI_GNmP z{A+~IMwGIsB`MGTV8taPa&QlX8{}qHr^yoA&-Wi^Azb&)0%C))g>~!62luTd>)^1V z_L9UQ8j5{OX}H2#%cp~Cx2tRQM;itb`F6$#*lbt7M&k%XprYw;#s02G^+MCy)=M<^ z+&DCQKE%pB{|Q%VV%-v(-gEy=AS~9^U@hX)<5qP$fI#Ybtbr^c(FAHAr-UG}pg)^s zT940yF)UA(2~E?NY@Y;sdT14=CcJ*6Z{=Kkamjhgvs5&kD)hcEQl z#@WP5J7I1j?+N0q6+>dI6R8}bT9{iu4!O21;}D_yrc z2xj(i5qS+*CAHzp&=>OZzglA*dmFaf$F#0cVq$xrnFYs-00&w!lMYSf<>RcwYLw*tDqh-tT0ynaNt-107DT1$r8J;8Xm>q4^eB5HmdJY?3a7Z~| z7G>%9fnL}{!At%F!TFxys{Wv0E%gG)yH_=ytj6w0+$n-m$XM#l?cdAmM63`?7VyWM z_qw0;ax0bt#me`CkG(5a?tj7f{RZ`+mn` z9=9GYH!l<&NF4969a6#7_C`}in;i1846RSta*&To>#%_G}w`uGtN zx9ojk{52~}dlbu|gRc%vG%nYEGJDh}NYUbOetr$_SQ4_zu20gR z&TE22xZ)4vXXk577L-=}^{Hp0t=A6b8yA4=nH;*akeh8N()SZ%DBlKjS>(du&fvWZ z8Av=Ix8=~DEQ@emI2rVdDVLAnuF;sVp7}iXh>&*<`jujhZms=<8>ZdGleQ2sQ+y zCZ4m~biwVzsecwEl|t9d5R2O$?6>Nd601Tew596c?fv;P$ri(@jpSB=CL4N(cVuNi zaM?Ldq;P$%omH`IUYM-h>Oth1`ami#pJ;j*)cp z6!1uE)JF=RO1vTnP!eQ|FJ=Z~^<)r3Yrn%sUw-bYd+IP(m55}`4VgXqX)!#q(^tYW z?)>@^n=FN};v(KRKU*Xx0nMDCen{I?8Z?MciBRyP!T~2&73PwVI;5U`N^M zclb~E>F>4(N~_|6E9V~Q@lT2As7y7u=chk2(+|5S)cK$HH_AUzOEgUWNB&SMd$`*z z!iz_Da(Cjf<&c~1o1x8KW{NlB{Ujc0vnG_oo<9{pUtI{`hX&}ftMlb$W$C$H|KtT)GwOw@`B>WLsFNf25Cy61#^A|q~$?YGK^8EURl?q4fhYkHoVhPGpsvsn7yx^ zMn`J~rD$3NY1y5ur`nxXE+_hm8ZQl4v@~8qj;T9vgh|T#F=EOlv21({JRQ{NpxwpC zpUp->L5(KQYj)}u-cH;B-HKmr8Cy?3(@@0!HS~Lb$sJ!Ca*ozYDoKz~m9o6h?7$!EKFIy( zVDcf<_wg8+Rz!qbf49d(`C9XR<-OaMNbeS+&`7zhNud>RAgh;R17z;t+xSwS4$uYe z!naD~KtUUvQF+D;LOV%U&(go2y_XzW&=Y`M z7v>BtMqy{=1?HJ~TJMwX#Rb?8w=fqvb2@4**_vu{{op%f+Efnr)3@rI`_hh(aTaup zYbp>2y4w@mJvQUZ*Ivw=T}vDK>7l?K@Y=Y~cDV^u*N_hu_%IEr7O0XD$2-y_cJyfG z8>JV`xZieeyz$zYE@#L3PgcN2dD%3u!PrZ(7ki!!s)ZG1Ql^Pz>HsI3v%zUodVWUY z)$z5pPuAl9YppRXemnRp!FjBgPf;plJuj?kWxgE;dw;$0bhKuaXVN<3k*JE?g#~KJ zZ}>5oX=ZI!>2C|_&g=2}e>kh|;VRKaf5E$tnxl_hNb@%?=8!Qb>sP z1eOh7Y`5djC(Do<$~U zpux+R(?>x`V0x5)^V)gUG6J^T;<@n8`@FcOK^e7T()UgOB0ow3 zkZyfS|XRO={B4N@_kG$(cGHAZKDT!WVc)ijhx7i|HGTv4)AYHEP z{54fmoj<>jMRUSa^f#}HkTd-1f;RxtoDb$I8FX1Sd6m4^f~fTp)gBE#^NTFTDTw5K z-%m+NLEkDqm^_4jj+{Xn({(_+LPti5O6SW~CPN$#@6_buY=gZt#>~qG(J_9IWvXq( zjIyhmJ3aU8Hej}r?0&EZ1El53ts&`3-xqn-J||m94zhrbV#Qe|>Vj5NB{Fgf=TXWZ z_qZKyI_~rH*AaNDhlEZ9z#05T8Ucb(n1(1Jn`*zH>lc7bWKzEgfYXo!yq#`lr