From 2a0f18cfd8fe14876b8351ae87a1cc5fcaad160e Mon Sep 17 00:00:00 2001 From: PaulaTomasG <94612518+PaulaTomasG@users.noreply.github.com> Date: Fri, 30 Sep 2022 16:19:07 +0200 Subject: [PATCH 001/234] Update event-4768.md Event ID 4768 with kerb return code 0x17 does exist and gets logged. It's 0x10 and 0x18 the only ones that rely on even 4771 instead. See line 32 in this same article. --- windows/security/threat-protection/auditing/event-4768.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 6846561482..14a09b7044 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -219,7 +219,7 @@ The most common values: | 0x14 | KDC\_ERR\_TGT\_REVOKED | TGT has been revoked | Since the remote KDC may change its PKCROSS key while there are PKCROSS tickets still active, it SHOULD cache the old PKCROSS keys until the last issued PKCROSS ticket expires. Otherwise, the remote KDC will respond to a client with a KRB-ERROR message of type KDC\_ERR\_TGT\_REVOKED. See [RFC1510](https://www.ietf.org/proceedings/49/I-D/draft-ietf-cat-kerberos-pk-cross-07.txt) for more details. | | 0x15 | KDC\_ERR\_CLIENT\_NOTYET | Client not yet valid—try again later | No information. | | 0x16 | KDC\_ERR\_SERVICE\_NOTYET | Server not yet valid—try again later | No information. | -| 0x17 | KDC\_ERR\_KEY\_EXPIRED | Password has expired—change password to reset | The user’s password has expired.
This error code cannot occur in event “[4768](event-4768.md). A Kerberos authentication ticket (TGT) was requested”. It occurs in “[4771](event-4771.md). Kerberos pre-authentication failed” event. | +| 0x17 | KDC\_ERR\_KEY\_EXPIRED | Password has expired—change password to reset | The user’s password has expired. | | 0x18 | KDC\_ERR\_PREAUTH\_FAILED | Pre-authentication information was invalid | The wrong password was provided.
This error code cannot occur in event “[4768](event-4768.md). A Kerberos authentication ticket (TGT) was requested”. It occurs in “[4771](event-4771.md). Kerberos pre-authentication failed” event. | | 0x19 | KDC\_ERR\_PREAUTH\_REQUIRED | Additional pre-authentication required | This error often occurs in UNIX interoperability scenarios. MIT-Kerberos clients do not request pre-authentication when they send a KRB\_AS\_REQ message. If pre-authentication is required (the default), Windows systems will send this error. Most MIT-Kerberos clients will respond to this error by giving the pre-authentication, in which case the error can be ignored, but some clients might not respond in this way. | | 0x1A | KDC\_ERR\_SERVER\_NOMATCH | KDC does not know about the requested server | No information. | From a8f9f997dd095e1a436188f23f824ef5230ab896 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 20:26:58 +0530 Subject: [PATCH 002/234] Update servicing-stack-updates.md Added a related article - Windows server OS SSU catalog per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10905 --- windows/deployment/update/servicing-stack-updates.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index b1549aa4b9..531f6367f1 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -59,3 +59,8 @@ Typically, the improvements are reliability and performance improvements that do ## Simplifying on-premises deployment of servicing stack updates With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update will include the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you will only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update will be available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382. + +## Related Articles + +[Microsoft Servicing Stack Updates catalog for windows server operating system](https://www.catalog.update.microsoft.com/Search.aspx?q=Servicing%20Stack%20Update) + From dd0a605ff3fbcc20ab63b53a9d5cb3cdc6872d27 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 21:39:44 +0530 Subject: [PATCH 003/234] Update windows/deployment/update/servicing-stack-updates.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/servicing-stack-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 531f6367f1..53152d4e87 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -62,5 +62,5 @@ With the Windows Update experience, servicing stack updates and cumulative updat ## Related Articles -[Microsoft Servicing Stack Updates catalog for windows server operating system](https://www.catalog.update.microsoft.com/Search.aspx?q=Servicing%20Stack%20Update) +[Microsoft Servicing Stack Updates Catalog for Windows Server](https://www.catalog.update.microsoft.com/Search.aspx?q=Servicing%20Stack%20Update) From ffc8a034c9d47006c3621ec2f201f16748318817 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 22:10:21 +0530 Subject: [PATCH 004/234] Update windows-10-subscription-activation.md added a note about excluding the Universal Store Service APIs and Web Application in the device compliance policy reference - https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device Per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10972 --- windows/deployment/windows-10-subscription-activation.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 29d62e08fa..81e56f7074 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -40,6 +40,9 @@ This article covers the following information: For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md). +> [!NOTE] +> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to “step-up” from one version of Windows to another, may want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f from their device compliance policy. + ## Subscription activation for Enterprise Windows Enterprise E3 and E5 are available as online services via subscription. You can deploy Windows Enterprise in your organization without keys and reboots. From b64fa615d60109386c36adaf8f33215a3b37af8c Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 9 Nov 2022 11:20:05 +0530 Subject: [PATCH 005/234] Update windows/deployment/windows-10-subscription-activation.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/windows-10-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 81e56f7074..cf64d2e2d1 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -41,7 +41,7 @@ This article covers the following information: For more information on how to deploy Enterprise licenses, see [Deploy Windows Enterprise licenses](deploy-enterprise-licenses.md). > [!NOTE] -> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to “step-up” from one version of Windows to another, may want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f from their device compliance policy. +> Organizations that use the [Subscription Activation](/windows/deployment/windows-10-subscription-activation) feature to enable users to upgrade from one version of Windows to another might want to exclude the Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f, from their device compliance policy. ## Subscription activation for Enterprise From 6d8371aad95ff97e8f5dbe2399912e7caf44421f Mon Sep 17 00:00:00 2001 From: Dario Woitasen <33589238+dariomws@users.noreply.github.com> Date: Thu, 10 Nov 2022 22:10:28 +0100 Subject: [PATCH 006/234] Update wdsc-customize-contact-information.md --- .../wdsc-customize-contact-information.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md index a4d1b860ad..644c84414e 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -43,8 +43,6 @@ You must have Windows 10, version 1709 or later. The ADMX/ADML template files fo There are two stages to using the contact card and customized notifications. First, you have to enable the contact card or custom notifications (or both), and then you must specify at least a name for your organization and one piece of contact information. -This can only be done in Group Policy. - 1. On your Group Policy management machine, open the [Group Policy Management Console](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)), right-click the Group Policy Object you want to configure and click **Edit**. 2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**. @@ -55,6 +53,9 @@ This can only be done in Group Policy. 1. To enable the contact card, open the **Configure customized contact information** setting and set it to **Enabled**. Click **OK**. + > [!NOTE] + > This can only be done in Group Policy. + 2. To enable the customized notifications, open the **Configure customized notifications** setting and set it to **Enabled**. Click **OK**. 5. After you've enabled the contact card or the customized notifications (or both), you must configure the **Specify contact company name** to **Enabled**. Enter your company or organization's name in the field in the **Options** section. Click **OK**. @@ -66,5 +67,7 @@ This can only be done in Group Policy. 7. Select **OK** after you configure each setting to save your changes. ->[!IMPORTANT] ->You must specify the contact company name and at least one contact method - email, phone number, or website URL. If you do not specify the contact name and a contact method the customization will not apply, the contact card will not show, and notifications will not be customized. +To enable the customized notifications and add the contact information in Intune, see [Manage device security with endpoint security policies in Microsoft Intune](/mem/intune/protect/endpoint-security-policy) and [Settings for the Windows Security experience profile in Microsoft Intune](/mem/intune/protect/antivirus-security-experience-windows-settings). + +> [!IMPORTANT] +> You must specify the contact company name and at least one contact method - email, phone number, or website URL. If you do not specify the contact name and a contact method the customization will not apply, the contact card will not show, and notifications will not be customized. From 926c1470ee83e89890cfb858e672944a50a2cfe7 Mon Sep 17 00:00:00 2001 From: Dario Woitasen <33589238+dariomws@users.noreply.github.com> Date: Mon, 14 Nov 2022 10:02:33 +0100 Subject: [PATCH 007/234] Update use-windows-event-forwarding-to-assist-in-intrusion-detection.md --- ...t-forwarding-to-assist-in-intrusion-detection.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index d48d5da38b..a28ab4ca3e 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -397,6 +397,17 @@ The following GPO snippet performs the following tasks: ![configure event channels.](images/capi-gpo.png) +The following table also contains the six actions to configure in the GPO: + +| Program/Script | Arguments | +|------------------------------------|----------------------------------------------------------------------------------------------------------| +| %SystemRoot%\System32\wevtutil.exe | sl Microsoft-Windows-CAPI2/Operational /e:true | +| %SystemRoot%\System32\wevtutil.exe | sl Microsoft-Windows-CAPI2/Operational /ms:102432768 | +| %SystemRoot%\System32\wevtutil.exe | sl "Microsoft-Windows-AppLocker/EXE and DLL" /ms:102432768 | +| %SystemRoot%\System32\wevtutil.exe | sl Microsoft-Windows-CAPI2/Operational /ca:"O:BAG:SYD:(A;;0x7;;;BA)(A;;0x2;;;AU)(A;;0x1;;;S-1-5-32-573)" | +| %SystemRoot%\System32\wevtutil.exe | sl "Microsoft-Windows-DriverFrameworks-UserMode/Operational" /e:true | +| %SystemRoot%\System32\wevtutil.exe | sl "Microsoft-Windows-DriverFrameworks-UserMode/Operational" /ms:52432896 | + ## Appendix D - Minimum GPO for WEF Client configuration Here are the minimum steps for WEF to operate: @@ -655,4 +666,4 @@ You can get more info with the following links: - [Event Queries and Event XML](/previous-versions/bb399427(v=vs.90)) - [Event Query Schema](/windows/win32/wes/queryschema-schema) - [Windows Event Collector](/windows/win32/wec/windows-event-collector) -- [4625(F): An account failed to log on](./auditing/event-4625.md) \ No newline at end of file +- [4625(F): An account failed to log on](./auditing/event-4625.md) From c353652b97e343590665d0af65b811437858d39e Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 15 Nov 2022 19:53:26 +0530 Subject: [PATCH 008/234] Update install-md-app-guard.md Made changes to the navigation in the steps to install by using Intune fixes #https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10770 --- .../install-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index b4fb01a3c6..ea6fccbf62 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -100,7 +100,7 @@ Application Guard functionality is turned off by default. However, you can quick 1. In the **Platform** list, select **Windows 10 and later**. - 1. In the **Profile** list, select **Endpoint protection**. + 1. In the **Profile** Type, Choose **Templates** and select **Endpoint protection** . 1. Choose **Create**. From 13fdf16793f4547c1b74e968631d54f5b8ee952d Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 16 Nov 2022 10:13:49 +0530 Subject: [PATCH 009/234] Update windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../install-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index ea6fccbf62..0eb70f9270 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -100,7 +100,7 @@ Application Guard functionality is turned off by default. However, you can quick 1. In the **Platform** list, select **Windows 10 and later**. - 1. In the **Profile** Type, Choose **Templates** and select **Endpoint protection** . + 1. In the **Profile** type, choose **Templates** and select **Endpoint protection**. 1. Choose **Create**. From 505c4e24b68c501e95ad1b4c4adebaaeaa1312b8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 16 Nov 2022 15:11:30 -0500 Subject: [PATCH 010/234] MSGraph POST sample --- education/windows/edu-stickers.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index dc25c4e817..cb2e43478e 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -41,6 +41,12 @@ Stickers aren't enabled by default. Follow the instructions below to configure y [!INCLUDE [intune-custom-settings-2](includes/intune-custom-settings-2.md)] [!INCLUDE [intune-custom-settings-info](includes/intune-custom-settings-info.md)] +Alternatively, try using the following MSGraph call to automatically create the custom policy in your tenant: + +```msgraph-interactive +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} +``` + #### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) To configure devices using a provisioning package, [create a provisioning package][WIN-1] using Windows Configuration Designer (WCD) with the following settings: From 81323d8fc891865f0d0615db0c48594388babcbb Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 16 Nov 2022 17:23:39 -0500 Subject: [PATCH 011/234] updates --- education/windows/edu-stickers.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index cb2e43478e..7333c0734e 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -41,7 +41,8 @@ Stickers aren't enabled by default. Follow the instructions below to configure y [!INCLUDE [intune-custom-settings-2](includes/intune-custom-settings-2.md)] [!INCLUDE [intune-custom-settings-info](includes/intune-custom-settings-info.md)] -Alternatively, try using the following MSGraph call to automatically create the custom policy in your tenant: +> [!TIP] +> Try using the following MSGraph call to automatically create the custom policy in your tenant. ```msgraph-interactive POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} From 878812525e2e058920f3e58ecdebb909087e5559 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:50:51 +0530 Subject: [PATCH 012/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-policies.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-policies.md b/windows/security/threat-protection/security-policy-settings/account-policies.md index ba2d477909..8d3cbc340d 100644 --- a/windows/security/threat-protection/security-policy-settings/account-policies.md +++ b/windows/security/threat-protection/security-policy-settings/account-policies.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Account Policies **Applies to** +- Windows 11 - Windows 10 An overview of account policies in Windows and provides links to policy descriptions. From 68b63b26a609464981e75e353da2a47456708375 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:52:08 +0530 Subject: [PATCH 013/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/password-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/password-policy.md b/windows/security/threat-protection/security-policy-settings/password-policy.md index 7ecb04ce32..05a4e8abfe 100644 --- a/windows/security/threat-protection/security-policy-settings/password-policy.md +++ b/windows/security/threat-protection/security-policy-settings/password-policy.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Password Policy **Applies to** +- Windows 11 - Windows 10 An overview of password policies for Windows and links to information for each policy setting. From 022cbeaaea2e150011d5ddfc211525af879af567 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:53:26 +0530 Subject: [PATCH 014/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/enforce-password-history.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md index 4bb6c855cc..ea44c5fc56 100644 --- a/windows/security/threat-protection/security-policy-settings/enforce-password-history.md +++ b/windows/security/threat-protection/security-policy-settings/enforce-password-history.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Enforce password history **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Enforce password history** security policy setting. From 2e2221a9f3871aac65c485f7f749a0a4daabc3ca Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:54:34 +0530 Subject: [PATCH 015/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/maximum-password-age.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index c0b7aae124..db96bc95de 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Maximum password age **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Maximum password age** security policy setting. From 1504c4c1bc4bd86385245807b3ca0436b85c3ee0 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:55:36 +0530 Subject: [PATCH 016/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/minimum-password-age.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md index f6ce6b41e1..2683c0cbf9 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md @@ -18,6 +18,7 @@ ms.technology: itpro-security # Minimum password age **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, policy management, and security considerations for the **Minimum password age** security policy setting. @@ -89,4 +90,4 @@ If you set a password for a user but want that user to change the password when ## Related topics -- [Password Policy](password-policy.md) \ No newline at end of file +- [Password Policy](password-policy.md) From ec830936ee5cf96c697992fb991864148d092ad0 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:56:50 +0530 Subject: [PATCH 017/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/minimum-password-length.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md index 14a19ec3af..61170f8f54 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-length.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-length.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Minimum password length **Applies to** +- Windows 11 - Windows 10 This article describes the recommended practices, location, values, policy management, and security considerations for the **Minimum password length** security policy setting. From 937597b380c002c6ec521eb0e4b3c480467c4f80 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:57:54 +0530 Subject: [PATCH 018/234] added windows 11 added windows 11 to this article --- .../password-must-meet-complexity-requirements.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md index 3781352906..0608e32e81 100644 --- a/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md +++ b/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements.md @@ -22,6 +22,7 @@ ms.technology: itpro-security # Password must meet complexity requirements **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Password must meet complexity requirements** security policy setting. From d45daf6c18761d13f1de5bec8708d1f2d93d035b Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 17:59:01 +0530 Subject: [PATCH 019/234] added windows 11 added windows 11 to this article --- .../store-passwords-using-reversible-encryption.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md index 7e2d99c5ca..51f69e849e 100644 --- a/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md +++ b/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Store passwords using reversible encryption **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Store passwords using reversible encryption** security policy setting. From 905d5f8e0623ad88bf8af12e80d8eee38364349d Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:00:14 +0530 Subject: [PATCH 020/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-lockout-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md index a53b0258c1..bc5e2d96ce 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Account Lockout Policy **Applies to** +- Windows 11 - Windows 10 Describes the Account Lockout Policy settings and links to information about each policy setting. From 8ec70f2cbe745173407dfaa3f2840cedd3a86f11 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:01:07 +0530 Subject: [PATCH 021/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-lockout-duration.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md index 559a82704b..bbbad9fba3 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-duration.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Account lockout duration **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. From 5ca873262b28bacffc4ef01f2376e8a8594a11ad Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:02:02 +0530 Subject: [PATCH 022/234] added windows 11 added windows 11 to this article --- .../security-policy-settings/account-lockout-threshold.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md index 0b41931636..1032bd39b6 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-threshold.md @@ -23,6 +23,7 @@ ms.technology: itpro-security # Account lockout threshold **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Account lockout threshold** security policy setting. From eddee1bfa47e807d8baef5c268c43ef2087a29ca Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:03:05 +0530 Subject: [PATCH 023/234] added windows 11 added windows 11 to this article --- .../reset-account-lockout-counter-after.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md index 900b66a6fe..dc385a80e1 100644 --- a/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md +++ b/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Reset account lockout counter after **Applies to** +- Windows 11 - Windows 10 Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. @@ -77,4 +78,4 @@ If you don't configure this policy setting or if the value is configured to an i ## Related topics -- [Account Lockout Policy](account-lockout-policy.md) \ No newline at end of file +- [Account Lockout Policy](account-lockout-policy.md) From f0abcd176333926b6b90111c6091b9ffad26bf84 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:16:49 +0530 Subject: [PATCH 024/234] added windows 11 added windows 11 to this article --- .../threat-protection/security-policy-settings/audit-policy.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/audit-policy.md b/windows/security/threat-protection/security-policy-settings/audit-policy.md index 9f1e6cd0c6..0553dc3df2 100644 --- a/windows/security/threat-protection/security-policy-settings/audit-policy.md +++ b/windows/security/threat-protection/security-policy-settings/audit-policy.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Audit Policy **Applies to** +- Windows 11 - Windows 10 Provides information about basic audit policies that are available in Windows and links to information about each setting. From edced08cedeff4208a57df54539fb4fc0d3ed3e7 Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 18:19:54 +0530 Subject: [PATCH 025/234] added windows 11 added windows 11 to this article --- .../secpol-advanced-security-audit-policy-settings.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md index a620908a28..5b2eced41d 100644 --- a/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings.md @@ -21,6 +21,7 @@ ms.technology: itpro-security # Advanced security audit policy settings for Windows 10 **Applies to** +- Windows 11 - Windows 10 Provides information about the advanced security audit policy settings that are available in Windows and the audit events that they generate. From b9a7912833a512f695f3fdb4edf1aa4995646b8a Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 18 Nov 2022 19:23:25 +0530 Subject: [PATCH 026/234] added windows server 2022 as per user report #11029 so i added **Windows Server 2022** after verifying below official article **https://learn.microsoft.com/windows-server/get-started/whats-new-in-windows-server-2022** --- .../tpm/trusted-platform-module-overview.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index 06be1d344b..c8ebe170ac 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -20,8 +20,9 @@ ms.technology: itpro-security **Applies to** - Windows 11 - Windows 10 -- Windows Server 2016 +- Windows Server 2022 - Windows Server 2019 +- Windows Server 2016 This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. @@ -78,10 +79,10 @@ Some things that you can check on the device are: ## Supported versions for device health attestation -| TPM version | Windows 11 | Windows 10 | Windows Server 2016 | Windows Server 2019 | -|-------------|-------------|-------------|---------------------|---------------------| -| TPM 1.2 | | >= ver 1607 | >= ver 1607 | Yes | -| TPM 2.0 | Yes | Yes | Yes | Yes | +| TPM version | Windows 11 | Windows 10 | Windows Server 2022 | Windows Server 2019 | Windows Server 2016 | +|-------------|-------------|-------------|---------------------|---------------------|---------------------| +| TPM 1.2 | | >= ver 1607 | | | >= ver 1607 | +| TPM **2.0** | **Yes** | **Yes** | **Yes** | **Yes** | **Yes** | ## Related topics From 427ddaea334fc09703f0faa657186fb88ea4795d Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Mon, 21 Nov 2022 09:12:00 +0530 Subject: [PATCH 027/234] Update windows/security/information-protection/tpm/trusted-platform-module-overview.md Accepted Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../tpm/trusted-platform-module-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index c8ebe170ac..9c25f71d16 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -82,7 +82,7 @@ Some things that you can check on the device are: | TPM version | Windows 11 | Windows 10 | Windows Server 2022 | Windows Server 2019 | Windows Server 2016 | |-------------|-------------|-------------|---------------------|---------------------|---------------------| | TPM 1.2 | | >= ver 1607 | | | >= ver 1607 | -| TPM **2.0** | **Yes** | **Yes** | **Yes** | **Yes** | **Yes** | +| TPM 2.0 | **Yes** | **Yes** | **Yes** | **Yes** | **Yes** | ## Related topics From 85adbbf1d386724387a5d98356bde23886598d37 Mon Sep 17 00:00:00 2001 From: Raffy <48763181+ErrorRaffyline0@users.noreply.github.com> Date: Wed, 23 Nov 2022 00:36:03 +0100 Subject: [PATCH 028/234] Related topics fix Basic settings are related to advanced settings of the same category --- .../auditing/basic-security-audit-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index bbc3b39ae8..977eb2065d 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -39,6 +39,6 @@ Basic security audit policy settings are found under Computer Configuration\\Win ## Related topics -- [Basic security audit policy settings](basic-security-audit-policy-settings.md) +- [Advanced security audit policy settings](advanced-security-audit-policy-settings.md) From f4d70bc8188b1951041913664297112a73a993d1 Mon Sep 17 00:00:00 2001 From: Raffy <48763181+ErrorRaffyline0@users.noreply.github.com> Date: Wed, 23 Nov 2022 00:42:22 +0100 Subject: [PATCH 029/234] Add related topic Basic security settings added as related to advanced --- .../auditing/advanced-security-audit-policy-settings.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index 54ddd26b54..64098b1b13 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -172,4 +172,8 @@ Resource SACLs are also useful for diagnostic scenarios. For example, administra This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) -- [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) \ No newline at end of file +- [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) + +## Related topics + +- [Basic security audit policy settings](basic-security-audit-policy-settings.md) From e8ea481ff25df14cd50700dd7de1868880a52df0 Mon Sep 17 00:00:00 2001 From: Jeremiah Cox <17728431+out0xb2@users.noreply.github.com> Date: Fri, 25 Nov 2022 06:39:51 -0800 Subject: [PATCH 030/234] s/dumb/dump/g Crash dump with a "p", not dumb with a "b" --- .../personal-data-encryption/overview-pde.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/personal-data-encryption/overview-pde.md b/windows/security/information-protection/personal-data-encryption/overview-pde.md index bfb7153548..1ed17da0c8 100644 --- a/windows/security/information-protection/personal-data-encryption/overview-pde.md +++ b/windows/security/information-protection/personal-data-encryption/overview-pde.md @@ -45,9 +45,9 @@ ms.date: 09/22/2022 - [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) - Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN - [Kernel and user mode crash dumps disabled](/windows/client-management/mdm/policy-csp-memorydump) - - Crash dumps can potentially cause the keys used by PDE decrypt files to be exposed. For greatest security, disable kernel and user mode crash dumps. For information on disabling crash dumbs via Intune, see [Disable crash dumps](configure-pde-in-intune.md#disable-crash-dumps). + - Crash dumps can potentially cause the keys used by PDE decrypt files to be exposed. For greatest security, disable kernel and user mode crash dumps. For information on disabling crash dumps via Intune, see [Disable crash dumps](configure-pde-in-intune.md#disable-crash-dumps). - [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate) - - Hibernation files can potentially cause the keys used by PDE to decrypt files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation). + - Hibernation files can potentially cause the keys used by PDE to decrypt files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumps via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation). ## PDE protection levels From d4f3e9203bcf4379c246a47098feddad23e0d29d Mon Sep 17 00:00:00 2001 From: Andy Rivas <45184653+andyrivMSFT@users.noreply.github.com> Date: Tue, 29 Nov 2022 18:35:02 -0800 Subject: [PATCH 031/234] Update mcc-isp-faq.yml Adding clarification around OS requirements. --- windows/deployment/do/mcc-isp-faq.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/windows/deployment/do/mcc-isp-faq.yml b/windows/deployment/do/mcc-isp-faq.yml index 19f6da7226..74c8351979 100644 --- a/windows/deployment/do/mcc-isp-faq.yml +++ b/windows/deployment/do/mcc-isp-faq.yml @@ -33,12 +33,18 @@ sections: - question: What are the prerequisites and hardware requirements? answer: | - Azure subscription - - Hardware to host Microsoft Connected Cache: + - Hardware to host Microsoft Connected Cache + - Ubuntu 20.04 LTS on a physical server or VM of your choice. + + > [!NOTE] + > The Microsoft Connected Cache is deployed and managed using Azure IoT Edge and Ubuntu 20.04 is an [Azure IoT Edge Tier 1 operating system](https://learn.microsoft.com/en-us/azure/iot-edge/support?view=iotedge-2020-11#tier-1). Additionally, the Microsoft Connected Cache module is optimized for Ubuntu 20.04 LTS. + + The following are recommended hardware configurations: [!INCLUDE [Microsoft Connected Cache Prerequisites](includes/mcc-prerequisites.md)] - We have one customer who is able to achieve 40-Gbps egress rate using the following hardware specification: + We have one customer who is able to achieve mid-30s Gbps egress rate using the following hardware specification: - Dell PowerEdge R330 - 2 x Intel(R) Xeon(R) CPU E5-2630 v3 @ 2.40 GHz, total 32 core - 48 GB, Micron Technology 18ASF1G72PDZ-2G1A1, Speed: 2133 MT/s From 059c0d6e2c46512dd49e7973297c5db8515f8f3c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 30 Nov 2022 12:47:40 -0800 Subject: [PATCH 032/234] Update install-md-app-guard.md --- .../install-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index 0eb70f9270..dba507f3c0 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: vinaypamnani-msft ms.author: vinpa -ms.date: 09/09/2021 +ms.date: 11/30/2022 ms.reviewer: manager: aaroncz ms.custom: asr From d23d717dcbfc8d789a8d20451afed341b2155046 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 30 Nov 2022 12:50:46 -0800 Subject: [PATCH 033/234] Update install-md-app-guard.md --- .../install-md-app-guard.md | 39 ++++++++++--------- 1 file changed, 20 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index dba507f3c0..97f4e14332 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -27,10 +27,12 @@ ms.collection: ## Review system requirements See [System requirements for Microsoft Defender Application Guard](./reqs-md-app-guard.md) to review the hardware and software installation requirements for Microsoft Defender Application Guard. ->[!NOTE] ->Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. + +> [!NOTE] +> Microsoft Defender Application Guard is not supported on VMs and VDI environment. For testing and automation on non-production machines, you may enable WDAG on a VM by enabling Hyper-V nested virtualization on the host. ## Prepare for Microsoft Defender Application Guard + Before you can install and use Microsoft Defender Application Guard, you must determine which way you intend to use it in your enterprise. You can use Application Guard in either **Standalone** or **Enterprise-managed** mode. ### Standalone mode @@ -51,6 +53,7 @@ Applies to: You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. The following diagram shows the flow between the host PC and the isolated container. + ![Flowchart for movement between Microsoft Edge and Application Guard.](images/application-guard-container-v-host.png) ## Install Application Guard @@ -59,22 +62,22 @@ Application Guard functionality is turned off by default. However, you can quick ### To install by using the Control Panel -1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**. +1. Open the **Control Panel**, click **Programs,** and then select **Turn Windows features on or off**. ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png) -2. Select the check box next to **Microsoft Defender Application Guard** and then click **OK**. +2. Select the check box next to **Microsoft Defender Application Guard** and then select **OK**. Application Guard and its underlying dependencies are all installed. ### To install by using PowerShell ->[!NOTE] ->Ensure your devices have met all system requirements prior to this step. PowerShell will install the feature without checking system requirements. If your devices don't meet the system requirements, Application Guard may not work. This step is recommended for enterprise managed scenarios only. +> [!NOTE] +> Ensure your devices have met all system requirements prior to this step. PowerShell will install the feature without checking system requirements. If your devices don't meet the system requirements, Application Guard may not work. This step is recommended for enterprise managed scenarios only. -1. Click the **Search** or **Cortana** icon in the Windows 10 or Windows 11 taskbar and type **PowerShell**. +1. Select the **Search** or **Cortana** icon in the Windows 10 or Windows 11 taskbar and type **PowerShell**. -2. Right-click **Windows PowerShell**, and then click **Run as administrator**. +2. Right-click **Windows PowerShell**, and then select **Run as administrator**. Windows PowerShell opens with administrator credentials. @@ -94,17 +97,15 @@ Application Guard functionality is turned off by default. However, you can quick :::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune."::: -1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -1. Choose **Devices** > **Configuration profiles** > **+ Create profile**, and do the following:
+1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Devices** > **Configuration profiles** > **+ Create profile**, and do the following:
1. In the **Platform** list, select **Windows 10 and later**. - 1. In the **Profile** type, choose **Templates** and select **Endpoint protection**. + 2. In the **Profile** type, choose **Templates** and select **Endpoint protection**. - 1. Choose **Create**. + 3. Choose **Create**. -1. Specify the following settings for the profile: +2. Specify the following settings for the profile: - **Name** and **Description** @@ -114,16 +115,16 @@ Application Guard functionality is turned off by default. However, you can quick - Choose your preferences for **Clipboard behavior**, **External content**, and the remaining settings. -1. Choose **OK**, and then choose **OK** again. +3. Choose **OK**, and then choose **OK** again. -1. Review your settings, and then choose **Create**. +4. Review your settings, and then choose **Create**. -1. Choose **Assignments**, and then do the following: +5. Choose **Assignments**, and then do the following: 1. On the **Include** tab, in the **Assign to** list, choose an option. - 1. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the **Exclude** tab. + 2. If you have any devices or users you want to exclude from this endpoint protection profile, specify those on the **Exclude** tab. - 1. Click **Save**. + 3. Select **Save**. After the profile is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Users might have to restart their devices in order for protection to be in place. From ba43f0b6c75c98354b5148da580acd754aa7d3ba Mon Sep 17 00:00:00 2001 From: Jason <38218303+JasonRBeer@users.noreply.github.com> Date: Thu, 1 Dec 2022 09:13:43 -0600 Subject: [PATCH 034/234] Addresses -> address Fixed typo --- windows/security/zero-trust-windows-device-health.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/zero-trust-windows-device-health.md b/windows/security/zero-trust-windows-device-health.md index 84ff0bde52..fd911f02b5 100644 --- a/windows/security/zero-trust-windows-device-health.md +++ b/windows/security/zero-trust-windows-device-health.md @@ -13,7 +13,7 @@ ms.technology: itpro-security --- # Zero Trust and Windows device health -Organizations need a security model that more effectively adapts to the complexity of the modern work environment. IT admins need to embrace the hybrid workplace, while protecting people, devices, apps, and data wherever they’re located. Implementing a Zero Trust model for security helps addresses today's complex environments. +Organizations need a security model that more effectively adapts to the complexity of the modern work environment. IT admins need to embrace the hybrid workplace, while protecting people, devices, apps, and data wherever they’re located. Implementing a Zero Trust model for security helps address today's complex environments. The [Zero Trust](https://www.microsoft.com/security/business/zero-trust) principles are: From 0cfc6b409506f14aec357da00b451fda69b6f64c Mon Sep 17 00:00:00 2001 From: Narkis Engler <41025789+narkissit@users.noreply.github.com> Date: Fri, 2 Dec 2022 15:00:54 -0800 Subject: [PATCH 035/234] Update waas-delivery-optimization-reference.md Update min build for "DO Cache Host Source" policy, it was incorrectly set as 1809, should be 2004 --- windows/deployment/do/waas-delivery-optimization-reference.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/waas-delivery-optimization-reference.md b/windows/deployment/do/waas-delivery-optimization-reference.md index 22dff75ed5..ff80d5f043 100644 --- a/windows/deployment/do/waas-delivery-optimization-reference.md +++ b/windows/deployment/do/waas-delivery-optimization-reference.md @@ -64,7 +64,7 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Delay foreground download cache server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 | | [Delay background download cache server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 | | [Cache Server Hostname](#cache-server-hostname) | DOCacheHost | 1809 | -| [Cache Server Hostname Source](#cache-server-hostname-source) | DOCacheHostSource | 1809 | +| [Cache Server Hostname Source](#cache-server-hostname-source) | DOCacheHostSource | 2004 | | [Maximum Foreground Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxForegroundDownloadBandwidth | 2004 | | [Maximum Background Download Bandwidth (in KB/s)](#maximum-background-download-bandwidth-in-kbs) | DOMaxBackgroundDownloadBandwidth | 2004 | From e149c6257ea466a8fafc79a9015d90f1331ff88c Mon Sep 17 00:00:00 2001 From: Rafal Sosnowski <51166236+rafals2@users.noreply.github.com> Date: Fri, 2 Dec 2022 15:09:31 -0800 Subject: [PATCH 036/234] Update bitlocker-management-for-enterprises.md --- .../bitlocker/bitlocker-management-for-enterprises.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index e3bea9928b..3acad9a900 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -37,6 +37,12 @@ Starting with Windows 10 version 1703, the enablement of BitLocker can be trigge For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if necessary. For older devices that aren't yet encrypted, beginning with Windows 10 version 1703, admins can use the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. This process and feature is applicable to Azure Hybrid AD as well. +Note: +Managing BitLocker except for enabling and disabling it requires one of the following licenses to be assigned to your users: +-Windows 10/11 Enterprise E3 or E5 (included in Microsoft 365 F3, E3, or E5) +-Windows 10/11 Education A3 or A5 (included in Microsoft 365 A3 or A5) + + ## Managing workplace-joined PCs and phones For Windows PCs and Windows Phones that are enrolled using **Connect to work or school account**, BitLocker Device Encryption is managed over MDM, the same as devices joined to Azure AD. From ef8c7eeb4230f5677ed1f70a8aade8ad6476f429 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Mon, 5 Dec 2022 13:44:54 +0530 Subject: [PATCH 037/234] Update administer-security-policy-settings.md Changed the URL to Microsoft security baselines blog fixes#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10332 --- .../administer-security-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md index bc2b937927..4303604e8b 100644 --- a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md @@ -95,7 +95,7 @@ The Security Compliance Manager is a downloadable tool that helps you plan, depl **To administer security policies by using the Security Compliance Manager** -1. Download the most recent version. You can find out more info on the [Microsoft Security Guidance](/archive/blogs/secguide/) blog. +1. Download the most recent version. You can find out more info on the [Microsoft Security Baselines](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) blog. 1. Read the relevant security baseline documentation that is included in this tool. 1. Download and import the relevant security baselines. The installation process steps you through baseline selection. 1. Open the Help and follow instructions how to customize, compare, or merge your security baselines before deploying those baselines. From 13eb0d0edb6873cee74ff7f5203c9df32b333b91 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Mon, 5 Dec 2022 17:05:13 +0530 Subject: [PATCH 038/234] Update windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../administer-security-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md index 4303604e8b..781556ab7a 100644 --- a/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings.md @@ -95,7 +95,7 @@ The Security Compliance Manager is a downloadable tool that helps you plan, depl **To administer security policies by using the Security Compliance Manager** -1. Download the most recent version. You can find out more info on the [Microsoft Security Baselines](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) blog. +1. Download the most recent version. You can find more info on the [Microsoft Security Baselines](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bg-p/Microsoft-Security-Baselines) blog. 1. Read the relevant security baseline documentation that is included in this tool. 1. Download and import the relevant security baselines. The installation process steps you through baseline selection. 1. Open the Help and follow instructions how to customize, compare, or merge your security baselines before deploying those baselines. From c53ab899b4aa177dbe2a8f746d30e11b3b370813 Mon Sep 17 00:00:00 2001 From: mounicabattula <95552440+mounicabattula@users.noreply.github.com> Date: Mon, 5 Dec 2022 11:36:23 -0800 Subject: [PATCH 039/234] New feature - QU expedite Opt-out --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index f2d4f477af..2f6a60536a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -58,6 +58,8 @@ Threat and vulnerability information about a new revision of Windows becomes ava When running an expedited release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update as quickly. +Windows Autopatch provides the option to opt out of service driven quality updates expedite. To opt out of service driven expedite, customers can go to Release Management blade under Windows Autopatch section under Tenant Administration on [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). On the release management blade, the Expedited Quality Updates setting on the Release Settings tab can be used to change the expedite behavior. + | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | | Standard release | Test

First

Fast

Broad | 0

1

6

9 | 0

2

2

5 | 0

2

2

2 | From c36337077f3f41c11fdcaea2e61e097e225af14f Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 5 Dec 2022 11:58:58 -0800 Subject: [PATCH 040/234] Update windows-autopatch-wqu-overview.md Made tweaks. --- .../operate/windows-autopatch-wqu-overview.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index 2f6a60536a..e00180267b 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -58,7 +58,9 @@ Threat and vulnerability information about a new revision of Windows becomes ava When running an expedited release, the regular goal of 95% of devices in 21 days no longer applies. Instead, Windows Autopatch greatly accelerates the release schedule of the release to update the environment more quickly. This approach requires an updated schedule for all devices outside of the Test ring since those devices are already getting the update as quickly. -Windows Autopatch provides the option to opt out of service driven quality updates expedite. To opt out of service driven expedite, customers can go to Release Management blade under Windows Autopatch section under Tenant Administration on [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). On the release management blade, the Expedited Quality Updates setting on the Release Settings tab can be used to change the expedite behavior. +### Opt out of expedited releases + +Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal]((https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | From f4e6063f6d1d7f4c236792f513b2fb484a8aaa1a Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 5 Dec 2022 12:02:46 -0800 Subject: [PATCH 041/234] Update windows-autopatch-wqu-overview.md --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index e00180267b..63ac721337 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days ### Opt out of expedited releases -Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal]((https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. +Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | From 06ae6b451cf97c8a16d68fe73c59cb3fbc7ba728 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 5 Dec 2022 12:04:21 -0800 Subject: [PATCH 042/234] Update windows-autopatch-wqu-overview.md --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index 63ac721337..a97be2ea9d 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days ### Opt out of expedited releases -Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > Tenant administration > Windows Autopatch > **Release management** blade. In the Release management blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. +Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | From 5d11db7d9899d8db9e13693ff245f1297efe0192 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Mon, 5 Dec 2022 12:04:59 -0800 Subject: [PATCH 043/234] Update windows-autopatch-wqu-overview.md --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index a97be2ea9d..12c0848bd6 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days ### Opt out of expedited releases -Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the [Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. +Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | From 3aea5659931ed4f38b2753530865b1936dc134a6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 5 Dec 2022 15:20:44 -0500 Subject: [PATCH 044/234] POST update --- education/windows/edu-stickers.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 7333c0734e..fb0966ddb8 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -45,7 +45,9 @@ Stickers aren't enabled by default. Follow the instructions below to configure y > Try using the following MSGraph call to automatically create the custom policy in your tenant. ```msgraph-interactive -POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/ +Content-Type: application/json +{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} ``` #### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) From b847c85753f44c999a360e5f615db146796eee25 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 5 Dec 2022 15:39:47 -0500 Subject: [PATCH 045/234] updates --- education/windows/edu-stickers.md | 1 - 1 file changed, 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index fb0966ddb8..4a9a9f8f88 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -46,7 +46,6 @@ Stickers aren't enabled by default. Follow the instructions below to configure y ```msgraph-interactive POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/ -Content-Type: application/json {"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} ``` From 01b468801eecf60831121405c4f9d6a0d5a05bc3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 5 Dec 2022 15:44:40 -0500 Subject: [PATCH 046/234] update --- education/windows/edu-stickers.md | 1 + 1 file changed, 1 insertion(+) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 4a9a9f8f88..42361dcf63 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -46,6 +46,7 @@ Stickers aren't enabled by default. Follow the instructions below to configure y ```msgraph-interactive POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/ + {"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} ``` From de4119d48afbb95e9031c8e49114af2ca4ea5400 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 5 Dec 2022 15:49:49 -0500 Subject: [PATCH 047/234] update --- education/windows/edu-stickers.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 42361dcf63..1900c9e886 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -45,7 +45,8 @@ Stickers aren't enabled by default. Follow the instructions below to configure y > Try using the following MSGraph call to automatically create the custom policy in your tenant. ```msgraph-interactive -POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations/ +POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations +Content-Type: application/json {"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} ``` From d5fff060bef67f2d81ef413f9ad6ff27ce5d0bed Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 5 Dec 2022 16:16:46 -0500 Subject: [PATCH 048/234] updates --- education/windows/edu-stickers.md | 4 ++-- education/windows/includes/intune-custom-settings-1.md | 3 --- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 1900c9e886..bc9af08637 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -42,13 +42,13 @@ Stickers aren't enabled by default. Follow the instructions below to configure y [!INCLUDE [intune-custom-settings-info](includes/intune-custom-settings-info.md)] > [!TIP] -> Try using the following MSGraph call to automatically create the custom policy in your tenant. +> Use the following Graph call to automatically create the custom policy in your tenant without assignments nor scope tags. ```msgraph-interactive POST https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations Content-Type: application/json -{"id":"00-0000-0000-0000-000000000000","displayName":"Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} +{"id":"00-0000-0000-0000-000000000000","displayName":"_MSLearn_Stickers","roleScopeTagIds":["0"],"@odata.type":"#microsoft.graph.windows10CustomConfiguration","omaSettings":[{"omaUri":"./Vendor/MSFT/Policy/Config/Stickers/EnableStickers","displayName":"EnableStickers","@odata.type":"#microsoft.graph.omaSettingInteger","value":1}]} ``` #### [:::image type="icon" source="images/icons/provisioning-package.svg"::: **PPKG**](#tab/ppkg) diff --git a/education/windows/includes/intune-custom-settings-1.md b/education/windows/includes/intune-custom-settings-1.md index fa7811c9eb..a8d82dfea6 100644 --- a/education/windows/includes/intune-custom-settings-1.md +++ b/education/windows/includes/intune-custom-settings-1.md @@ -7,9 +7,6 @@ ms.topic: include To configure devices with Microsoft Intune, use a custom policy: - > [!TIP] - > If you're browsing with an account that can create Intune policies, you can skip to step 5 by using this direct link to create a custom policy (opens in a new tab). - 1. Go to the Microsoft Endpoint Manager admin center 2. Select **Devices > Configuration profiles > Create profile** 3. Select **Platform > Windows 10 and later** and **Profile type > Templates > Custom** From f468194f655c7aa181b72c11ae48d13911e3e8f0 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 7 Dec 2022 18:34:31 +0530 Subject: [PATCH 049/234] Update usmt-scanstate-syntax.md Updated /listfiles: as an incompatible switch to be used with genconfig. fixes#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10576 --- windows/deployment/usmt/usmt-scanstate-syntax.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index e8fd16c69f..14b65a281f 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -203,6 +203,7 @@ The following table indicates which command-line options aren't compatible with |**/encrypt**|Required*|X|X|| |**/keyfile**|N/A||X|| |**/l**||||| +|**/listfiles**|||X|| |**/progress**|||X|| |**/r**|||X|| |**/w**|||X|| From e34eb5f22dabafcaf55e61acf2e60f9ac5d53535 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 09:27:33 -0500 Subject: [PATCH 050/234] updates --- education/windows/edu-stickers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index bc9af08637..ab2424149b 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -14,7 +14,7 @@ ms.collection: Starting in **Windows 11 SE, version 22H2**, *Stickers* is a new feature that allows students to decorate their desktop with digital stickers. Students can choose from over 500 cheerful, education-friendly digital stickers. Stickers can be arranged, resized, and customized on top of the desktop background. Each student's stickers remain, even when the background changes. -Similar to the [education theme packs](edu-themes.md), Stickers is a personalization feature that helps the device feel like it was designed for students. +Similar to the [education theme packs](edu-themes.md "my tooltip example that opens in a new tab"), Stickers is a personalization feature that helps the device feel like it was designed for students. :::image type="content" source="./images/win-11-se-stickers.png" alt-text="Windows 11 SE desktop with 3 stickers" border="true"::: From b0e8186cff540420a39bb52bd017444f8de03903 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 09:49:07 -0500 Subject: [PATCH 051/234] update --- education/windows/edu-stickers.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index ab2424149b..669a9de79f 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -10,6 +10,15 @@ ms.collection: - education --- +This document describes Windows Hello for Business functionalities or scenarios that apply to:\ +✅ **Deployment type:** [hybrid ℹ️]("The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) + +
+ +--- + # Configure Stickers for Windows 11 SE Starting in **Windows 11 SE, version 22H2**, *Stickers* is a new feature that allows students to decorate their desktop with digital stickers. Students can choose from over 500 cheerful, education-friendly digital stickers. Stickers can be arranged, resized, and customized on top of the desktop background. Each student's stickers remain, even when the background changes. From 18cc9f63ead87fcfd871ab1c28269f837d08fe33 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 09:53:02 -0500 Subject: [PATCH 052/234] update --- education/windows/edu-stickers.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 669a9de79f..84888e61ff 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -11,9 +11,9 @@ ms.collection: --- This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid ℹ️]("The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +✅ **Deployment type:** [hybrid 🗒️](http://bing.com "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Trust type:** [key trust 🗒️](http://bing.com "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Device registration type:** [Azure AD join 🗒️](http://bing.com "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")
From 5500255fa6a39c9a75df72295137aac826ff3230 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 7 Dec 2022 20:25:18 +0530 Subject: [PATCH 053/234] Update servicing-stack-updates.md Updated per author --- windows/deployment/update/servicing-stack-updates.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 53152d4e87..6060da4f88 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -21,6 +21,7 @@ ms.technology: itpro-updates - Windows 10 - Windows 11 +- Windows Server ## What is a servicing stack update? Servicing stack updates provide fixes to the servicing stack, the component that installs Windows updates. Additionally, it contains the "component-based servicing stack" (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components. The CBS is a small component that typically does not have updates released every month. @@ -60,7 +61,4 @@ Typically, the improvements are reliability and performance improvements that do With the Windows Update experience, servicing stack updates and cumulative updates are deployed together to the device. The update stack automatically orchestrates the installation, so both are applied correctly. Starting in February 2021, the cumulative update will include the latest servicing stack updates, to provide a single cumulative update payload to both Windows Server Update Services (WSUS) and Microsoft Catalog. If you use an endpoint management tool backed by WSUS, such as Configuration Manager, you will only have to select and deploy the monthly cumulative update. The latest servicing stack updates will automatically be applied correctly. Release notes and file information for cumulative updates, including those related to the servicing stack, will be in a single KB article. The combined monthly cumulative update will be available on Windows 10, version 2004 and later starting with the 2021 2C release, KB4601382. -## Related Articles - -[Microsoft Servicing Stack Updates Catalog for Windows Server](https://www.catalog.update.microsoft.com/Search.aspx?q=Servicing%20Stack%20Update) From 91de098a4c2aa8ea391b965a852b74c6c2be9816 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 7 Dec 2022 20:34:23 +0530 Subject: [PATCH 054/234] Update event-5140.md Updated the document per author's guidance on table Fixes#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10657 --- windows/security/threat-protection/auditing/event-5140.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-5140.md b/windows/security/threat-protection/auditing/event-5140.md index 5d72bf2c8c..70aa2bbbdb 100644 --- a/windows/security/threat-protection/auditing/event-5140.md +++ b/windows/security/threat-protection/auditing/event-5140.md @@ -132,7 +132,7 @@ This event generates once per session, when first access attempt was made. **Access Request Information:** -- **Access Mask** \[Type = HexInt32\]: the sum of hexadecimal values of requested access rights. See “Table 13. File access codes.” for different hexadecimal values for access rights. Has always “**0x1**” value for this event. +- **Access Mask** \[Type = HexInt32\]: the sum of hexadecimal values of requested access rights. See [Table of file access codes](/windows/security/threat-protection/auditing/event-5145#table-of-file-access-codes) for different hexadecimal values for access rights. It always has “**0x1**” value for this event. - **Accesses** \[Type = UnicodeString\]: the list of access rights that were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. Has always “**ReadData (or ListDirectory)**” value for this event. From 03f5d62f014aef33c5ed629e31a918965d8470b6 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:04:30 -0500 Subject: [PATCH 055/234] updates --- education/windows/edu-stickers.md | 6 +++--- education/windows/images/icons/information.svg | 13 +++++++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) create mode 100644 education/windows/images/icons/information.svg diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 84888e61ff..d0ae8f399b 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -11,9 +11,9 @@ ms.collection: --- This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid 🗒️](http://bing.com "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Trust type:** [key trust 🗒️](http://bing.com "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Device registration type:** [Azure AD join 🗒️](http://bing.com "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +✅ **Deployment type:** [:::image type="icon" source="images/icons/information.svg"::: hybrid](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Trust type:** [:::image type="icon" source="images/icons/information.svg"::: key trust](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Device registration type:** [:::image type="icon" source="images/icons/information.svg"::: Azure AD join](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")
diff --git a/education/windows/images/icons/information.svg b/education/windows/images/icons/information.svg new file mode 100644 index 0000000000..761a946709 --- /dev/null +++ b/education/windows/images/icons/information.svg @@ -0,0 +1,13 @@ + + + + + + + + + + Icon-general-5 + + + \ No newline at end of file From 77a10e1d3d824e7783ac7155a61ac05cee78e0ed Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 7 Dec 2022 20:36:58 +0530 Subject: [PATCH 056/234] Update event-4661.md Updated per author's recommendation. --- windows/security/threat-protection/auditing/event-4661.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md index bf8b9b0543..d651a58146 100644 --- a/windows/security/threat-protection/auditing/event-4661.md +++ b/windows/security/threat-protection/auditing/event-4661.md @@ -163,9 +163,9 @@ This event generates only if Success auditing is enabled for the [Audit Handle M > **Note**  **GUID** is an acronym for 'Globally Unique Identifier'. It is a 128-bit integer number used to identify resources, activities or instances. -- **Accesses** \[Type = UnicodeString\]: the list of access rights which were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. See “Table 13. File access codes.” for more information about file access rights. For information about SAM object access right use or other informational resources. +- **Accesses** \[Type = UnicodeString\]: the list of access rights which were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. For more information about file access rights, see [Table of file access codes](/windows/security/threat-protection/auditing/event-5145#table-of-file-access-codes). For information about SAM object access right use or other informational resources. -- **Access Mask** \[Type = HexInt32\]: hexadecimal mask for the operation that was requested or performed. See “Table 13. File access codes.” for more information about file access rights. For information about SAM object access right use or other informational resources. +- **Access Mask** \[Type = HexInt32\]: hexadecimal mask for the operation that was requested or performed. For more information about file access rights, see [Table of file access codes](/windows/security/threat-protection/auditing/event-5145#table-of-file-access-codes). For information about SAM object access right use or other informational resources. - **Privileges Used for Access Check** \[Type = UnicodeString\]: the list of user privileges which were used during the operation, for example, SeBackupPrivilege. This parameter might not be captured in the event, and in that case appears as “-”. See full list of user privileges in the table below: @@ -217,4 +217,4 @@ For 4661(S, F): A handle to an object was requested. > **Important**  For this event, also see [Appendix A: Security monitoring recommendations for many audit events](appendix-a-security-monitoring-recommendations-for-many-audit-events.md). -- You can get almost the same information from “[4662](event-4662.md): An operation was performed on an object.” There are no additional recommendations for this event in this document. \ No newline at end of file +- You can get almost the same information from “[4662](event-4662.md): An operation was performed on an object.” There are no additional recommendations for this event in this document. From df8bbc4d3cd0842f381d115c847bbc6be8891643 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 7 Dec 2022 20:38:40 +0530 Subject: [PATCH 057/234] Update event-4691.md updated per authors recommendation --- windows/security/threat-protection/auditing/event-4691.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md index 140889746d..716abaaa34 100644 --- a/windows/security/threat-protection/auditing/event-4691.md +++ b/windows/security/threat-protection/auditing/event-4691.md @@ -125,12 +125,12 @@ These events are generated for [ALPC Ports](/windows/win32/etw/alpc) access requ **Access Request Information:** -- **Accesses** \[Type = UnicodeString\]: the list of access rights which were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. “Table 13. File access codes.” contains information about the most common access rights for file system objects. For information about ALPC ports access rights, use or other informational resources. +- **Accesses** \[Type = UnicodeString\]: the list of access rights which were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. [Table of file access codes](/windows/security/threat-protection/auditing/event-5145#table-of-file-access-codes) contains information about the most common access rights for file system objects. For information about ALPC ports access rights, use or other informational resources. -- **Access Mask** \[Type = HexInt32\]: hexadecimal mask for the operation that was requested or performed. See “Table 13. File access codes.” for more information about file access rights. For information about ALPC ports access rights, use or other informational resources. +- **Access Mask** \[Type = HexInt32\]: hexadecimal mask for the operation that was requested or performed. For more information about file access rights, see [Table of file access codes](/windows/security/threat-protection/auditing/event-5145#table-of-file-access-codes). For information about ALPC ports access rights, use or other informational resources. ## Security Monitoring Recommendations For 4691(S): Indirect access to an object was requested. -- Typically this event has little to no security relevance and is hard to parse or analyze. There is no recommendation for this event, unless you know exactly what you need to monitor with ALPC Ports. \ No newline at end of file +- Typically this event has little to no security relevance and is hard to parse or analyze. There is no recommendation for this event, unless you know exactly what you need to monitor with ALPC Ports. From ac6eeee567c37c9b85e204934b0ef41a46584832 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:09:26 -0500 Subject: [PATCH 058/234] updates --- education/windows/edu-stickers.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index d0ae8f399b..65af26e386 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -11,9 +11,9 @@ ms.collection: --- This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [:::image type="icon" source="images/icons/information.svg"::: hybrid](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Trust type:** [:::image type="icon" source="images/icons/information.svg"::: key trust](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Device registration type:** [:::image type="icon" source="images/icons/information.svg"::: Azure AD join](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +✅ **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +✅ **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")
From 2ec0032bbadbc2967f8875b12aad88f4e1a03b2e Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 7 Dec 2022 20:40:29 +0530 Subject: [PATCH 059/234] Update event-5145.md Updated the document per authors recommendation. --- windows/security/threat-protection/auditing/event-5145.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-5145.md b/windows/security/threat-protection/auditing/event-5145.md index 8f47f2b4d1..5c736eaa3d 100644 --- a/windows/security/threat-protection/auditing/event-5145.md +++ b/windows/security/threat-protection/auditing/event-5145.md @@ -134,7 +134,7 @@ This event generates every time network share object (file or folder) was access **Access Request Information:** -- **Access Mask** \[Type = HexInt32\]: the sum of hexadecimal values of requested access rights. See “Table 13. File access codes.” for different hexadecimal values for access rights. +- **Access Mask** \[Type = HexInt32\]: the sum of hexadecimal values of requested access rights. See [Table of file access codes](/windows/security/threat-protection/auditing/event-5145#table-of-file-access-codes) for different hexadecimal values for access rights. - **Accesses** \[Type = UnicodeString\]: the list of access rights that were requested by **Subject\\Security ID**. These access rights depend on **Object Type**. @@ -318,4 +318,4 @@ For 5145(S, F): A network share object was checked to see whether client can be - WRITE\_DAC - - WRITE\_OWNER \ No newline at end of file + - WRITE\_OWNER From 9c7b9499c1ba9fb843234bda9ca4913179bf38d1 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:13:21 -0500 Subject: [PATCH 060/234] updates --- education/windows/edu-stickers.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index 65af26e386..cba9a74a65 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -11,9 +11,9 @@ ms.collection: --- This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -✅ **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +- **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +- **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ +- **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")
From cb1853c9d0fc6886a2c59b52a13dadcb10fe46a8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:26:30 -0500 Subject: [PATCH 061/234] updates --- education/windows/edu-stickers.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index cba9a74a65..ce16e09aaa 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -10,10 +10,10 @@ ms.collection: - education --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -- **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")\ -- **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](. "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +- **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +- **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")
From ad25351f9f135d026319157ac0e7bcf6b6f1cfa3 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:31:37 -0500 Subject: [PATCH 062/234] updates --- education/windows/edu-stickers.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index ce16e09aaa..edfef3467b 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -13,7 +13,7 @@ ms.collection: This document describes Windows Hello for Business functionalities or scenarios that apply to: - **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") - **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") -- **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") +- **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust."), Hybrid Azure AD join [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.")
From 3f0b549164f74976d411f1372916f680b5d50cb7 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 7 Dec 2022 10:39:38 -0500 Subject: [PATCH 063/234] updates --- education/windows/edu-stickers.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/education/windows/edu-stickers.md b/education/windows/edu-stickers.md index edfef3467b..ab2424149b 100644 --- a/education/windows/edu-stickers.md +++ b/education/windows/edu-stickers.md @@ -10,15 +10,6 @@ ms.collection: - education --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** hybrid [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") -- **Trust type:** key trust [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") -- **Device registration type:** Azure AD join [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust."), Hybrid Azure AD join [:::image type="icon" source="images/icons/information.svg":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "The Windows Hello for Business hybrid deployment is for organizations that have both on-premises and cloud resources that are accessed using a managed or federated identity that's synchronized with Azure AD. Hybrid deployments support devices that are Azure AD-registered, Azure AD-joined, and hybrid Azure AD-joined. The Hybrid deployment model supports three trust types for on-premises authentication: cloud Kerberos trust, key trust and certificate trust.") - -
- ---- - # Configure Stickers for Windows 11 SE Starting in **Windows 11 SE, version 22H2**, *Stickers* is a new feature that allows students to decorate their desktop with digital stickers. Students can choose from over 500 cheerful, education-friendly digital stickers. Stickers can be arranged, resized, and customized on top of the desktop background. Each student's stickers remain, even when the background changes. From 5ad8c9e6c05cfef8de51296429124b231e89c7de Mon Sep 17 00:00:00 2001 From: "beedell.rokejulianlockhart" Date: Wed, 7 Dec 2022 19:32:33 +0000 Subject: [PATCH 064/234] Corrected capitalization. "-online" to "-Online". --- .../install-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index b4fb01a3c6..222fad81b1 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -81,7 +81,7 @@ Application Guard functionality is turned off by default. However, you can quick 3. Type the following command: ``` - Enable-WindowsOptionalFeature -online -FeatureName Windows-Defender-ApplicationGuard + Enable-WindowsOptionalFeature -Online -FeatureName Windows-Defender-ApplicationGuard ``` 4. Restart the device. From 8c7c642bd2cb17f5becabbe32256d4d12b595585 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 7 Dec 2022 14:43:06 -0500 Subject: [PATCH 065/234] PDE Updates Post Release --- .../configure-pde-in-intune.md | 152 +++++++++++++++--- .../personal-data-encryption/faq-pde.yml | 43 ++--- .../includes/pde-description.md | 11 +- .../personal-data-encryption/overview-pde.md | 151 +++++++++++------ 4 files changed, 259 insertions(+), 98 deletions(-) diff --git a/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md b/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md index 4375ada864..103b574958 100644 --- a/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md +++ b/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md @@ -3,16 +3,17 @@ title: Configure Personal Data Encryption (PDE) in Intune description: Configuring and enabling Personal Data Encryption (PDE) required and recommended policies in Intune author: frankroj ms.author: frankroj -ms.reviewer: rafals +ms.reviewer: rhonnegowda manager: aaroncz ms.topic: how-to ms.prod: windows-client ms.technology: itpro-security ms.localizationpriority: medium -ms.date: 09/22/2022 +ms.date: 12/07/2022 --- + # Configure Personal Data Encryption (PDE) policies in Intune @@ -20,104 +21,205 @@ ms.date: 09/22/2022 ### Enable Personal Data Encryption (PDE) -1. Sign into the Intune +1. Sign into [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + 2. Navigate to **Devices** > **Configuration Profiles** + 3. Select **Create profile** + 4. Under **Platform**, select **Windows 10 and later** + 5. Under **Profile type**, select **Templates** + 6. Under **Template name**, select **Custom**, and then select **Create** -7. On the ****Basics** tab: + +7. On the **Basics** tab: + 1. Next to **Name**, enter **Personal Data Encryption** - 2. Next to **Description**, enter a description + 2. Next to **Description**, enter a description + 8. Select **Next** + 9. On the **Configuration settings** tab, select **Add** + 10. In the **Add Row** window: + 1. Next to **Name**, enter **Personal Data Encryption** 2. Next to **Description**, enter a description 3. Next to **OMA-URI**, enter in **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption** 4. Next to **Data type**, select **Integer** 5. Next to **Value**, enter in **1** + 11. Select **Save**, and then select **Next** + 12. On the **Assignments** tab: + 1. Under **Included groups**, select **Add groups** 2. Select the groups that the PDE policy should be deployed to 3. Select **Select** 4. Select **Next** + 13. On the **Applicability Rules** tab, configure if necessary and then select **Next** + 14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** -#### Disable Winlogon automatic restart sign-on (ARSO) +### Disable Winlogon automatic restart sign-on (ARSO) + +1. Sign into [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Sign into the Intune 2. Navigate to **Devices** > **Configuration Profiles** + 3. Select **Create profile** + 4. Under **Platform**, select **Windows 10 and later** + 5. Under **Profile type**, select **Templates** + 6. Under **Template name**, select **Administrative templates**, and then select **Create** -7. On the ****Basics** tab: + +7. On the **Basics** tab: + 1. Next to **Name**, enter **Disable ARSO** 2. Next to **Description**, enter a description + 8. Select **Next** + 9. On the **Configuration settings** tab, under **Computer Configuration**, navigate to **Windows Components** > **Windows Logon Options** + 10. Select **Sign-in and lock last interactive user automatically after a restart** + 11. In the **Sign-in and lock last interactive user automatically after a restart** window that opens, select **Disabled**, and then select **OK** + 12. Select **Next** + 13. On the **Scope tags** tab, configure if necessary and then select **Next** -12. On the **Assignments** tab: + +14. On the **Assignments** tab: + 1. Under **Included groups**, select **Add groups** 2. Select the groups that the ARSO policy should be deployed to 3. Select **Select** 4. Select **Next** -13. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** -## Recommended prerequisites +15. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** -#### Disable crash dumps +## Security hardening recommendations + +### Disable kernel-mode crash dumps and live dumps + +1. Sign into [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Sign into the Intune 2. Navigate to **Devices** > **Configuration Profiles** + 3. Select **Create profile** + 4. Under **Platform**, select **Windows 10 and later** + 5. Under **Profile type**, select **Settings catalog**, and then select **Create** -6. On the ****Basics** tab: - 1. Next to **Name**, enter **Disable Hibernation** + +6. On the **Basics** tab: + + 1. Next to **Name**, enter **Disable Kernel-Mode Crash Dumps** 2. Next to **Description**, enter a description + 7. Select **Next** + 8. On the **Configuration settings** tab, select **Add settings** + 9. In the **Settings picker** windows, select **Memory Dump** + 10. When the settings appear in the lower pane, under **Setting name**, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + 11. Change both **Allow Live Dump** and **Allow Crash Dump** to **Block**, and then select **Next** + 12. On the **Scope tags** tab, configure if necessary and then select **Next** + 13. On the **Assignments** tab: + 1. Under **Included groups**, select **Add groups** - 2. Select the groups that the crash dumps policy should be deployed to + 2. Select the groups that the disable crash dumps policy should be deployed to 3. Select **Select** 4. Select **Next** + 14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** -#### Disable hibernation +### Disable Windows Error Reporting (WER)/Disable user-mode crash dumps + +1. Sign into [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). -1. Sign into the Intune 2. Navigate to **Devices** > **Configuration Profiles** + 3. Select **Create profile** + 4. Under **Platform**, select **Windows 10 and later** + 5. Under **Profile type**, select **Settings catalog**, and then select **Create** -6. On the ****Basics** tab: - 1. Next to **Name**, enter **Disable Hibernation** + +6. On the **Basics** tab: + + 1. Next to **Name**, enter **Disable Windows Error Reporting (WER)** 2. Next to **Description**, enter a description + 7. Select **Next** + 8. On the **Configuration settings** tab, select **Add settings** -9. In the **Settings picker** windows, select **Power** -10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window -11. Change **Allow Hibernate** to **Block**, and then select **Next** + +9. In the **Settings picker** windows, expand to **Administrative Templates** > **Windows Components**, and then select **Windows Error Reporting** + +10. When the settings appear in the lower pane, under **Setting name**, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + +11. Change both **Disable Windows Error Reporting** to **Enabled**, and then select **Next** + 12. On the **Scope tags** tab, configure if necessary and then select **Next** + 13. On the **Assignments** tab: + 1. Under **Included groups**, select **Add groups** - 2. Select the groups that the hibernation policy should be deployed to + 2. Select the groups that the disable WER dumps policy should be deployed to 3. Select **Select** 4. Select **Next** + +14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** + +### Disable hibernation + +1. Sign into [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + +2. Navigate to **Devices** > **Configuration Profiles** + +3. Select **Create profile** + +4. Under **Platform**, select **Windows 10 and later** + +5. Under **Profile type**, select **Settings catalog**, and then select **Create** + +6. On the **Basics** tab: + + 1. Next to **Name**, enter **Disable Hibernation** + 2. Next to **Description**, enter a description + +7. Select **Next** + +8. On the **Configuration settings** tab, select **Add settings** + +9. In the **Settings picker** windows, select **Power** + +10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + +11. Change **Allow Hibernate** to **Block**, and then select **Next** + +12. On the **Scope tags** tab, configure if necessary and then select **Next** + +13. On the **Assignments** tab: + + 1. Under **Included groups**, select **Add groups** + 2. Select the groups that the disable hibernation policy should be deployed to + 3. Select **Select** + 4. Select **Next** + 14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** ## See also + - [Personal Data Encryption (PDE)](overview-pde.md) -- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) \ No newline at end of file +- [Personal Data Encryption (PDE) FAQ](faq-pde.yml) diff --git a/windows/security/information-protection/personal-data-encryption/faq-pde.yml b/windows/security/information-protection/personal-data-encryption/faq-pde.yml index 744161659e..e0ad44cf6d 100644 --- a/windows/security/information-protection/personal-data-encryption/faq-pde.yml +++ b/windows/security/information-protection/personal-data-encryption/faq-pde.yml @@ -5,13 +5,16 @@ metadata: description: Answers to common questions regarding Personal Data Encryption (PDE). author: frankroj ms.author: frankroj - ms.reviewer: rafals + ms.reviewer: rhonnegowda manager: aaroncz ms.topic: faq ms.prod: windows-client ms.technology: itpro-security ms.localizationpriority: medium - ms.date: 09/22/2022 + ms.date: 12/07/2022 + +# Max 5963468 OS 32516487 +# Max 6946251 title: Frequently asked questions for Personal Data Encryption (PDE) summary: | @@ -28,45 +31,49 @@ sections: answer: | No. It's still recommended to encrypt all volumes with BitLocker Drive Encryption for increased security. - - question: Can an IT admin specify which files should be encrypted? + - question: How are files protected by PDE selected? answer: | - Yes, but it can only be done using the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). + [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) are used to select which files are protected using PDE. - - question: Do I need to use OneDrive as my backup provider? + - question: Do I need to use OneDrive in Microsoft 365 as my backup provider? answer: | - No. PDE doesn't have a requirement for a backup provider including OneDrive. However, backups are strongly recommended in case the keys used by PDE to decrypt files are lost. OneDrive is a recommended backup provider. + No. PDE doesn't have a requirement for a backup provider, including OneDrive in Microsoft 365. However, backups are recommended in case the keys used by PDE to protect files are lost. OneDrive in Microsoft 365 is a recommended backup provider. - question: What is the relation between Windows Hello for Business and PDE? answer: | - During user sign-on, Windows Hello for Business unlocks the keys that PDE uses to decrypt files. + During user sign-on, Windows Hello for Business unlocks the keys that PDE uses to protect files. - - question: Can a file be encrypted with both PDE and EFS at the same time? + - question: Can a file be protected with both PDE and EFS at the same time? answer: | No. PDE and EFS are mutually exclusive. - - question: Can PDE encrypted files be accessed after signing on via a Remote Desktop connection (RDP)? + - question: Can PDE protected files be accessed after signing on via a Remote Desktop connection (RDP)? answer: | - No. Accessing PDE encrypted files over RDP isn't currently supported. + No. Accessing PDE protected files over RDP isn't currently supported. - - question: Can PDE encrypted files be access via a network share? + - question: Can PDE protected files be accessed via a network share? answer: | - No. PDE encrypted files can only be accessed after signing on locally to Windows with Windows Hello for Business credentials. + No. PDE protected files can only be accessed after signing on locally to Windows with Windows Hello for Business credentials. - - question: How can it be determined if a file is encrypted with PDE? + - question: How can it be determined if a file is protected with PDE? answer: | - Encrypted files will show a padlock on the file's icon. Additionally, `cipher.exe` can be used to show the encryption state of the file. + - Files protected with PDE and EFS will both show a padlock on the file's icon. To verify whether a file is protected with PDE vs. EFS: + 1. In the properties of the file, navigate to **General** > **Advanced**. The option **Encrypt contents to secure data** should be selected. + 2. Select the **Details** button. + 3. If the file is protected with PDE, under **Protection status:**, the item **Personal Data Encryption is:** will be marked as **On**. + - [`cipher.exe`](/windows-server/administration/windows-commands/cipher) can also be used to show the encryption state of the file. - question: Can users manually encrypt and decrypt files with PDE? answer: | - Currently users can decrypt files manually but they can't encrypt files manually. + Currently users can decrypt files manually but they can't encrypt files manually. For information on how a user can manually decrypt a file, see the section **Disable PDE and decrypt files** in [Personal Data Encryption (PDE)](overview-pde.md). - - question: If a user signs into Windows with a password instead of Windows Hello for Business, will they be able to access their PDE encrypted files? + - question: If a user signs into Windows with a password instead of Windows Hello for Business, will they be able to access their PDE protected files? answer: | - No. The keys used by PDE to decrypt files are protected by Windows Hello for Business credentials and will only be unlocked when signing on with Windows Hello for Business PIN or biometrics. + No. The keys used by PDE to protect files are protected by Windows Hello for Business credentials and will only be unlocked when signing on with Windows Hello for Business PIN or biometrics. - question: What encryption method and strength does PDE use? answer: | - PDE uses AES-CBC with a 256-bit key to encrypt files + PDE uses AES-CBC with a 256-bit key to encrypt files. additionalContent: | ## See also diff --git a/windows/security/information-protection/personal-data-encryption/includes/pde-description.md b/windows/security/information-protection/personal-data-encryption/includes/pde-description.md index 7ca7334657..445e8fbb45 100644 --- a/windows/security/information-protection/personal-data-encryption/includes/pde-description.md +++ b/windows/security/information-protection/personal-data-encryption/includes/pde-description.md @@ -4,24 +4,25 @@ description: Personal Data Encryption (PDE) description include file author: frankroj ms.author: frankroj -ms.reviewer: rafals +ms.reviewer: rhonnegowda manager: aaroncz ms.topic: how-to ms.prod: windows-client ms.technology: itpro-security ms.localizationpriority: medium -ms.date: 09/22/2022 +ms.date: 12/07/2022 --- + Personal data encryption (PDE) is a security feature introduced in Windows 11, version 22H2 that provides additional encryption features to Windows. PDE differs from BitLocker in that it encrypts individual files instead of whole volumes and disks. PDE occurs in addition to other encryption methods such as BitLocker. PDE utilizes Windows Hello for Business to link data encryption keys with user credentials. This feature can minimize the number of credentials the user has to remember to gain access to files. For example, when using BitLocker with PIN, a user would need to authenticate twice - once with the BitLocker PIN and a second time with Windows credentials. This requirement requires users to remember two different credentials. With PDE, users only need to enter one set of credentials via Windows Hello for Business. -PDE is also accessibility friendly. For example, The BitLocker PIN entry screen doesn't have accessibility options. PDE however uses Windows Hello for Business, which does have accessibility features. +Because PDE utilizes Windows Hello for Business, PDE is also accessibility friendly due to the accessibility features available when using Windows Hello for Business. -Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. Users will only be able to access their PDE encrypted files once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked. +Unlike BitLocker that releases data encryption keys at boot, PDE doesn't release data encryption keys until a user signs in using Windows Hello for Business. Users will only be able to access their PDE protected files once they've signed into Windows using Windows Hello for Business. Additionally, PDE has the ability to also discard the encryption keys when the device is locked. > [!NOTE] -> PDE is currently only available to developers via [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or encrypt files via PDE. Also, although there is an MDM policy that can enable PDE, there are no MDM policies that can be used to encrypt files via PDE. +> PDE can be enabled using MDM policies. The files to be protected by PDE can be specified using [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). There is no user interface in Windows to either enable PDE or protect files using PDE. diff --git a/windows/security/information-protection/personal-data-encryption/overview-pde.md b/windows/security/information-protection/personal-data-encryption/overview-pde.md index bfb7153548..54c375e13b 100644 --- a/windows/security/information-protection/personal-data-encryption/overview-pde.md +++ b/windows/security/information-protection/personal-data-encryption/overview-pde.md @@ -3,75 +3,104 @@ title: Personal Data Encryption (PDE) description: Personal Data Encryption unlocks user encrypted files at user sign-in instead of at boot. author: frankroj ms.author: frankroj -ms.reviewer: rafals +ms.reviewer: rhonnegowda manager: aaroncz ms.topic: how-to ms.prod: windows-client ms.technology: itpro-security ms.localizationpriority: medium -ms.date: 09/22/2022 +ms.date: 12/07/2022 --- + # Personal Data Encryption (PDE) -(*Applies to: Windows 11, version 22H2 and later Enterprise and Education editions*) +**Applies to:** + +- Windows 11, version 22H2 and later Enterprise and Education editions [!INCLUDE [Personal Data Encryption (PDE) description](includes/pde-description.md)] ## Prerequisites ### **Required** - - [Azure AD joined device](/azure/active-directory/devices/concept-azure-ad-join) - - [Windows Hello for Business](../../identity-protection/hello-for-business/hello-overview.md) - - Windows 11, version 22H2 and later Enterprise and Education editions + +- [Azure AD joined device](/azure/active-directory/devices/concept-azure-ad-join) +- [Windows Hello for Business](../../identity-protection/hello-for-business/hello-overview.md) +- Windows 11, version 22H2 and later Enterprise and Education editions ### **Not supported with PDE** - - [FIDO/security key authentication](../../identity-protection/hello-for-business/microsoft-compatible-security-key.md) - - [Winlogon automatic restart sign-on (ARSO)](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-) - - For information on disabling ARSO via Intune, see [Disable Winlogon automatic restart sign-on (ARSO)](configure-pde-in-intune.md#disable-winlogon-automatic-restart-sign-on-arso)). - - [Windows Information Protection (WIP)](../windows-information-protection/protect-enterprise-data-using-wip.md) - - [Hybrid Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join-hybrid) - - Remote Desktop connections + +- [FIDO/security key authentication](../../identity-protection/hello-for-business/microsoft-compatible-security-key.md) +- [Winlogon automatic restart sign-on (ARSO)](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-) + - For information on disabling ARSO via Intune, see [Disable Winlogon automatic restart sign-on (ARSO)](configure-pde-in-intune.md#disable-winlogon-automatic-restart-sign-on-arso)). +- [Windows Information Protection (WIP)](../windows-information-protection/protect-enterprise-data-using-wip.md) +- [Hybrid Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join-hybrid) +- Remote Desktop connections + +### **Security hardening recommendations** + +- [Kernel-mode crash dumps and live dumps disabled](/windows/client-management/mdm/policy-csp-memorydump#memorydump-policies) + + Kernel-mode crash dumps and live dumps can potentially cause the keys used by PDE to protect files to be exposed. For greatest security, disable kernel-mode crash dumps and live dumps. For information on disabling crash dumps and live dumps via Intune, see [Disable kernel-mode crash dumps and live dumps](configure-pde-in-intune.md#disable-kernel-mode-crash-dumps-and-live-dumps). + +- [Windows Error Reporting (WER) disabled/User-mode crash dumps disabled](/windows/client-management/mdm/policy-csp-errorreporting#errorreporting-disablewindowserrorreporting) + + Disabling Windows Error Reporting prevents user-mode crash dumps. User-mode crash dumps can potentially cause the keys used by PDE to protect files to be exposed. For greatest security, disable user-mode crash dumps. For information on disabling crash dumbs via Intune, see [Disable Windows Error Reporting (WER)/Disable user-mode crash dumps](configure-pde-in-intune.md#disable-windows-error-reporting-werdisable-user-mode-crash-dumps). + +- [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate) + + Hibernation files can potentially cause the keys used by PDE to protect files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation). + +- [Disable allowing users to select when a password is required when resuming from connected standby](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) + - When this policy is not configured on-premises Active Directory joined devices. However, this policy is enabled by default on Azure AD joined devices. For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](configure-pde-in-intune.md#disable-allowing-users-to-select-when-a-password-is-required-when-resuming-from-connected-standby). ### **Highly recommended** - - [BitLocker Drive Encryption](../bitlocker/bitlocker-overview.md) enabled - - Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to supplement BitLocker and not replace it. - - Backup solution such as [OneDrive](/onedrive/onedrive) - - In certain scenarios such as TPM resets or destructive PIN resets, the keys used by PDE to decrypt files can be lost. In such scenarios, any file encrypted with PDE will no longer be accessible. The only way to recover such files would be from backup. - - [Windows Hello for Business PIN reset service](../../identity-protection/hello-for-business/hello-feature-pin-reset.md) - - Destructive PIN resets will cause keys used by PDE to decrypt files to be lost. The destructive PIN reset will make any file encrypted with PDE no longer accessible after a destructive PIN reset. Files encrypted with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets. - - [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) - - Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN - - [Kernel and user mode crash dumps disabled](/windows/client-management/mdm/policy-csp-memorydump) - - Crash dumps can potentially cause the keys used by PDE decrypt files to be exposed. For greatest security, disable kernel and user mode crash dumps. For information on disabling crash dumbs via Intune, see [Disable crash dumps](configure-pde-in-intune.md#disable-crash-dumps). - - [Hibernation disabled](/windows/client-management/mdm/policy-csp-power#power-allowhibernate) - - Hibernation files can potentially cause the keys used by PDE to decrypt files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation). + +- [BitLocker Drive Encryption](../bitlocker/bitlocker-overview.md) enabled + + Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to work alongside BitLocker for increased security. PDE isn't a replacement for BitLocker. + +- Backup solution such as [OneDrive in Microsoft 365](/sharepoint/onedrive-overview) + + In certain scenarios such as TPM resets or destructive PIN resets, the keys used by PDE to protect files will be lost. In such scenarios, any file protected with PDE will no longer be accessible. The only way to recover such files would be from backup. + +- [Windows Hello for Business PIN reset service](../../identity-protection/hello-for-business/hello-feature-pin-reset.md) + + Destructive PIN resets will cause keys used by PDE to protect files to be lost. The destructive PIN reset will make any file protected with PDE no longer accessible after a destructive PIN reset. Files protected with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets. + +- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security) + + Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN ## PDE protection levels -PDE uses AES-CBC with a 256-bit key to encrypt files and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). +PDE uses AES-CBC with a 256-bit key to protect files and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). | Item | Level 1 | Level 2 | |---|---|---| -| Data is accessible when user is signed in | Yes | Yes | -| Data is accessible when user has locked their device | Yes | No | -| Data is accessible after user signs out | No | No | -| Data is accessible when device is shut down | No | No | -| Decryption keys discarded | After user signs out | After user locks device or signs out | +| PDE protected data accessible when user has signed in via Windows Hello for Business | Yes | Yes | +| PDE protected data is accessible at Windows lock screen | Yes | Data is accessible for one minute after lock, then it's no longer available | +| PDE protected data is accessible after user signs out of Windows | No | No | +| PDE protected data is accessible when device is shut down | No | No | +| PDE protected data is accessible via UNC paths | No | No | +| PDE protected data is accessible when signing with Windows password instead of Windows Hello for Business | No | No | +| PDE protected data is accessible via Remote Desktop session | No | No | +| Decryption keys used by PDE discarded | After user signs out of Windows | One minute after Windows lock screen is engaged or after user signs out of Windows | -## PDE encrypted files accessibility +## PDE protected files accessibility -When a file is encrypted with PDE, its icon will show a padlock. If the user hasn't signed in locally with Windows Hello for Business or an unauthorized user attempts to access a PDE encrypted file, they'll be denied access to the file. +When a file is protected with PDE, its icon will show a padlock. If the user hasn't signed in locally with Windows Hello for Business or an unauthorized user attempts to access a PDE protected file, they'll be denied access to the file. -Scenarios where a user will be denied access to a PDE encrypted file include: +Scenarios where a user will be denied access to a PDE protected file include: - User has signed into Windows via a password instead of signing in with Windows Hello for Business biometric or PIN. -- If specified via level 2 protection, when the device is locked. +- If protected via level 2 protection, when the device is locked. - When trying to access files on the device remotely. For example, UNC network paths. - Remote Desktop sessions. -- Other users on the device who aren't owners of the file, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE encrypted files. +- Other users on the device who aren't owners of the file, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE protected files. ## How to enable PDE @@ -85,55 +114,77 @@ To enable PDE on devices, push an MDM policy to the devices with the following p There's also a [PDE CSP](/windows/client-management/mdm/personaldataencryption-csp) available for MDM solutions that support it. > [!NOTE] -> Enabling the PDE policy on devices only enables the PDE feature. It does not encrypt any files. To encrypt files, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager) to create custom applications and scripts to specify which files to encrypt and at what level to encrypt the files. Additionally, files will not encrypt via the APIs until this policy has been enabled. +> Enabling the PDE policy on devices only enables the PDE feature. It does not protect any files. To protect files via PDE, use the [PDE APIs](/uwp/api/windows.security.dataprotection.userdataprotectionmanager). The PDE APIs can be used to create custom applications and scripts to specify which files to protect and at what level to protect the files. Additionally, the PDE APIs can't be used to protect files until the PDE policy has been enabled. For information on enabling PDE via Intune, see [Enable Personal Data Encryption (PDE)](configure-pde-in-intune.md#enable-personal-data-encryption-pde). ## Differences between PDE and BitLocker +PDE is meant to work alongside BitLocker. PDE isn't a replacement for BitLocker, nor is BitLocker a replacement for PDE. Using both features together provides better security than using either BitLocker or PDE alone. However there are differences between BitLocker and PDE and how they work. This is why using them together offers better security. + | Item | PDE | BitLocker | |--|--|--| -| Release of key | At user sign-in via Windows Hello for Business | At boot | -| Keys discarded | At user sign-out | At reboot | -| Files encrypted | Individual specified files | Entire volume/drive | -| Authentication to access encrypted file | Windows Hello for Business | When BitLocker with PIN is enabled, BitLocker PIN plus Windows sign in | -| Accessibility | Windows Hello for Business is accessibility friendly | BitLocker with PIN doesn't have accessibility features | +| Release of decryption key | At user sign-in via Windows Hello for Business | At boot | +| Decryption keys discarded | When user signs out of Windows or one minute after Windows lock screen is engaged | At reboot | +| Files protected | Individual specified files | Entire volume/drive | +| Authentication to access protected file | Windows Hello for Business | When BitLocker with TPM + PIN is enabled, BitLocker PIN plus Windows sign in | ## Differences between PDE and EFS -The main difference between encrypting files with PDE instead of EFS is the method they use to encrypt the file. PDE uses Windows Hello for Business to secure the keys to decrypt the files. EFS uses certificates to secure and encrypt the files. +The main difference between protecting files with PDE instead of EFS is the method they use to protect the file. PDE uses Windows Hello for Business to secure the keys that protect the files. EFS uses certificates to secure and protect the files. -To see if a file is encrypted with PDE or EFS: +To see if a file is protected with PDE or with EFS: 1. Open the properties of the file 2. Under the **General** tab, select **Advanced...** 3. In the **Advanced Attributes** windows, select **Details** -For PDE encrypted files, under **Protection status:** there will be an item listed as **Personal Data Encryption is:** and it will have the attribute of **On**. +For PDE protected files, under **Protection status:** there will be an item listed as **Personal Data Encryption is:** and it will have the attribute of **On**. -For EFS encrypted files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**. +For EFS protected files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**. -Encryption information including what encryption method is being used can be obtained with the command line `cipher.exe /c` command. +Encryption information including what encryption method is being used to protect the file can be obtained with the command line [`cipher.exe /c`](/windows-server/administration/windows-commands/cipher) command. ## Disable PDE and decrypt files -Currently there's no method to disable PDE via MDM policy. However, in certain scenarios PDE encrypted files can be decrypted using `cipher.exe` using the following steps: +Once PDE is enabled, it isn't recommended to disable it. However if PDE does need to be disabled, it can be done so via the MDM policy described in the section [How to enable PDE](#how-to-enable-pde). The value of the OMA-URI needs to be changed from **`1`** to **`0`** as follows: + +- Name: **Personal Data Encryption** +- OMA-URI: **./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption** +- Data type: **Integer** +- Value: **0** + +Disabling PDE doesn't decrypt any PDE protected files. It only prevents the PDE API from being able to protect any additional files. PDE protected files can be manually decrypted using the following steps: 1. Open the properties of the file 2. Under the **General** tab, select **Advanced...** 3. Uncheck the option **Encrypt contents to secure data** 4. Select **OK**, and then **OK** again -> [!Important] -> Once a user selects to manually decrypt a file, they will not be able to manually encrypt the file again. +PDE protected files can also be decrypted using [`cipher.exe`](/windows-server/administration/windows-commands/cipher). Using `cipher.exe` can be helpful to decrypt files in the following scenarios: + +- Decrypting a large number of files on a device +- Decrypting files on a large number of devices. + +To decrypt files on a device using `cipher.exe`: + +- Decrypt all files under a directory including subdirectories:
+ `cipher.exe /d /s:**` + +- Decrypt a single file or all of the files in the specified directory, but not any subdirectories:
+ `cipher.exe /d **` + +> [!IMPORTANT] +> Once a user selects to manually decrypt a file, the user will not be able to manually protect the file again using PDE. ## Windows out of box applications that support PDE Certain Windows applications support PDE out of the box. If PDE is enabled on a device, these applications will utilize PDE. - Mail - - Supports encrypting both email bodies and attachments + - Supports protecting both email bodies and attachments ## See also + - [Personal Data Encryption (PDE) FAQ](faq-pde.yml) - [Configure Personal Data Encryption (PDE) polices in Intune](configure-pde-in-intune.md) From bc88fff33cee994eba2ad72b97628e77e123f3fc Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 7 Dec 2022 17:28:12 -0500 Subject: [PATCH 066/234] PDE Updates Post Release 2 --- .../configure-pde-in-intune.md | 37 ++++++++++++++ .../personal-data-encryption/overview-pde.md | 51 ++++++++++++++----- 2 files changed, 75 insertions(+), 13 deletions(-) diff --git a/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md b/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md index 103b574958..2f25906802 100644 --- a/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md +++ b/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md @@ -219,6 +219,43 @@ ms.date: 12/07/2022 14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +### Disable allowing users to select when a password is required when resuming from connected standby + +1. Sign into [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). + +2. Navigate to **Devices** > **Configuration Profiles** + +3. Select **Create profile** + +4. Under **Platform**, select **Windows 10 and later** + +5. Under **Profile type**, select **Settings catalog**, and then select **Create** + +6. On the **Basics** tab: + + 1. Next to **Name**, enter **Disable Hibernation** + 2. Next to **Description**, enter a description + +7. Select **Next** + +8. On the **Configuration settings** tab, select **Add settings** + +9. In the **Settings picker** windows, select **Power** + +10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window + +11. Change **Allow Hibernate** to **Block**, and then select **Next** + +12. On the **Scope tags** tab, configure if necessary and then select **Next** + +13. On the **Assignments** tab: + + 1. Under **Included groups**, select **Add groups** + 2. Select the groups that the disable hibernation policy should be deployed to + 3. Select **Select** + 4. Select **Next** + +14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** ## See also - [Personal Data Encryption (PDE)](overview-pde.md) diff --git a/windows/security/information-protection/personal-data-encryption/overview-pde.md b/windows/security/information-protection/personal-data-encryption/overview-pde.md index 54c375e13b..24c2d69d39 100644 --- a/windows/security/information-protection/personal-data-encryption/overview-pde.md +++ b/windows/security/information-protection/personal-data-encryption/overview-pde.md @@ -25,13 +25,13 @@ ms.date: 12/07/2022 ## Prerequisites -### **Required** +### Required - [Azure AD joined device](/azure/active-directory/devices/concept-azure-ad-join) - [Windows Hello for Business](../../identity-protection/hello-for-business/hello-overview.md) - Windows 11, version 22H2 and later Enterprise and Education editions -### **Not supported with PDE** +### Not supported with PDE - [FIDO/security key authentication](../../identity-protection/hello-for-business/microsoft-compatible-security-key.md) - [Winlogon automatic restart sign-on (ARSO)](/windows-server/identity/ad-ds/manage/component-updates/winlogon-automatic-restart-sign-on--arso-) @@ -40,7 +40,7 @@ ms.date: 12/07/2022 - [Hybrid Azure AD joined devices](/azure/active-directory/devices/concept-azure-ad-join-hybrid) - Remote Desktop connections -### **Security hardening recommendations** +### Security hardening recommendations - [Kernel-mode crash dumps and live dumps disabled](/windows/client-management/mdm/policy-csp-memorydump#memorydump-policies) @@ -55,9 +55,28 @@ ms.date: 12/07/2022 Hibernation files can potentially cause the keys used by PDE to protect files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation). - [Disable allowing users to select when a password is required when resuming from connected standby](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) - - When this policy is not configured on-premises Active Directory joined devices. However, this policy is enabled by default on Azure AD joined devices. For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](configure-pde-in-intune.md#disable-allowing-users-to-select-when-a-password-is-required-when-resuming-from-connected-standby). -### **Highly recommended** + When this policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including native Azure Active Directory joined devices, is different: + + - On-premises Active Directory joined devices: + + - A user can't change the amount of time after the device´s screen turns off before a password is required when waking the device. + + - A password is required immediately after the screen turns off. + + The above is the desired outcome, but PDE isn't supported with on-premises Active Directory joined devices. + + - Workgroup devices, including native Azure AD joined devices: + + - A user on a Connected Standby device can change the amount of time after the device´s screen turns off before a password is required to wake the device. + + - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect files could potentially be exposed. This outcome isn't a desired outcome. + + Because of this undesired outcome, it's recommended to explicitly disable this policy on native Azure AD joined devices. + + For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](configure-pde-in-intune.md#disable-allowing-users-to-select-when-a-password-is-required-when-resuming-from-connected-standby). + +### Highly recommended - [BitLocker Drive Encryption](../bitlocker/bitlocker-overview.md) enabled @@ -120,14 +139,14 @@ For information on enabling PDE via Intune, see [Enable Personal Data Encryption ## Differences between PDE and BitLocker -PDE is meant to work alongside BitLocker. PDE isn't a replacement for BitLocker, nor is BitLocker a replacement for PDE. Using both features together provides better security than using either BitLocker or PDE alone. However there are differences between BitLocker and PDE and how they work. This is why using them together offers better security. +PDE is meant to work alongside BitLocker. PDE isn't a replacement for BitLocker, nor is BitLocker a replacement for PDE. Using both features together provides better security than using either BitLocker or PDE alone. However there are differences between BitLocker and PDE and how they work. These differences are why using them together offers better security. | Item | PDE | BitLocker | |--|--|--| | Release of decryption key | At user sign-in via Windows Hello for Business | At boot | | Decryption keys discarded | When user signs out of Windows or one minute after Windows lock screen is engaged | At reboot | | Files protected | Individual specified files | Entire volume/drive | -| Authentication to access protected file | Windows Hello for Business | When BitLocker with TPM + PIN is enabled, BitLocker PIN plus Windows sign in | +| Authentication to access protected file | Windows Hello for Business | When BitLocker with TPM + PIN is enabled, BitLocker PIN plus Windows sign-in | ## Differences between PDE and EFS @@ -143,7 +162,7 @@ For PDE protected files, under **Protection status:** there will be an item list For EFS protected files, under **Users who can access this file:**, there will be a **Certificate thumbprint** next to the users with access to the file. There will also be a section at the bottom labeled **Recovery certificates for this file as defined by recovery policy:**. -Encryption information including what encryption method is being used to protect the file can be obtained with the command line [`cipher.exe /c`](/windows-server/administration/windows-commands/cipher) command. +Encryption information including what encryption method is being used to protect the file can be obtained with the [cipher.exe /c](/windows-server/administration/windows-commands/cipher) command. ## Disable PDE and decrypt files @@ -161,18 +180,24 @@ Disabling PDE doesn't decrypt any PDE protected files. It only prevents the PDE 3. Uncheck the option **Encrypt contents to secure data** 4. Select **OK**, and then **OK** again -PDE protected files can also be decrypted using [`cipher.exe`](/windows-server/administration/windows-commands/cipher). Using `cipher.exe` can be helpful to decrypt files in the following scenarios: +PDE protected files can also be decrypted using [cipher.exe](/windows-server/administration/windows-commands/cipher). Using `cipher.exe` can be helpful to decrypt files in the following scenarios: - Decrypting a large number of files on a device - Decrypting files on a large number of devices. To decrypt files on a device using `cipher.exe`: -- Decrypt all files under a directory including subdirectories:
- `cipher.exe /d /s:**` +- Decrypt all files under a directory including subdirectories: -- Decrypt a single file or all of the files in the specified directory, but not any subdirectories:
- `cipher.exe /d **` + ```cmd + cipher.exe /d /s: + ``` + +- Decrypt a single file or all of the files in the specified directory, but not any subdirectories: + + ```cmd + cipher.exe /d + ``` > [!IMPORTANT] > Once a user selects to manually decrypt a file, the user will not be able to manually protect the file again using PDE. From dbf58834cb91ecc961afca5c6b01c7200ffb2f52 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Wed, 7 Dec 2022 19:33:03 -0500 Subject: [PATCH 067/234] PDE Updates Post Release 3 --- .../configure-pde-in-intune.md | 87 ++++++++++--------- .../personal-data-encryption/overview-pde.md | 4 +- 2 files changed, 46 insertions(+), 45 deletions(-) diff --git a/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md b/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md index 2f25906802..1ed273ae37 100644 --- a/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md +++ b/windows/security/information-protection/personal-data-encryption/configure-pde-in-intune.md @@ -33,16 +33,16 @@ ms.date: 12/07/2022 6. Under **Template name**, select **Custom**, and then select **Create** -7. On the **Basics** tab: +7. In **Basics**: 1. Next to **Name**, enter **Personal Data Encryption** 2. Next to **Description**, enter a description 8. Select **Next** -9. On the **Configuration settings** tab, select **Add** +9. In **Configuration settings**, select **Add** -10. In the **Add Row** window: +10. In **Add Row**: 1. Next to **Name**, enter **Personal Data Encryption** 2. Next to **Description**, enter a description @@ -52,16 +52,16 @@ ms.date: 12/07/2022 11. Select **Save**, and then select **Next** -12. On the **Assignments** tab: +12. In **Assignments**: 1. Under **Included groups**, select **Add groups** 2. Select the groups that the PDE policy should be deployed to 3. Select **Select** 4. Select **Next** -13. On the **Applicability Rules** tab, configure if necessary and then select **Next** +13. In **Applicability Rules**, configure if necessary and then select **Next** -14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +14. In **Review + create**, review the configuration to make sure everything is configured correctly, and then select **Create** ### Disable Winlogon automatic restart sign-on (ARSO) @@ -77,14 +77,14 @@ ms.date: 12/07/2022 6. Under **Template name**, select **Administrative templates**, and then select **Create** -7. On the **Basics** tab: +7. In **Basics**: 1. Next to **Name**, enter **Disable ARSO** 2. Next to **Description**, enter a description 8. Select **Next** -9. On the **Configuration settings** tab, under **Computer Configuration**, navigate to **Windows Components** > **Windows Logon Options** +9. In **Configuration settings**, under **Computer Configuration**, navigate to **Windows Components** > **Windows Logon Options** 10. Select **Sign-in and lock last interactive user automatically after a restart** @@ -92,16 +92,16 @@ ms.date: 12/07/2022 12. Select **Next** -13. On the **Scope tags** tab, configure if necessary and then select **Next** +13. In **Scope tags**, configure if necessary and then select **Next** -14. On the **Assignments** tab: +14. In **Assignments**: 1. Under **Included groups**, select **Add groups** 2. Select the groups that the ARSO policy should be deployed to 3. Select **Select** 4. Select **Next** -15. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +15. In **Review + create**, review the configuration to make sure everything is configured correctly, and then select **Create** ## Security hardening recommendations @@ -117,31 +117,31 @@ ms.date: 12/07/2022 5. Under **Profile type**, select **Settings catalog**, and then select **Create** -6. On the **Basics** tab: +6. In **Basics**: 1. Next to **Name**, enter **Disable Kernel-Mode Crash Dumps** 2. Next to **Description**, enter a description 7. Select **Next** -8. On the **Configuration settings** tab, select **Add settings** +8. In **Configuration settings**, select **Add settings** -9. In the **Settings picker** windows, select **Memory Dump** +9. In the **Settings picker** window, under **Browse by category**, select **Memory Dump** -10. When the settings appear in the lower pane, under **Setting name**, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window +10. When the settings appear under **Setting name**, select both **Allow Crash Dump** and **Allow Live Dump**, and then select the **X** in the top right corner of the **Settings picker** window to close the window 11. Change both **Allow Live Dump** and **Allow Crash Dump** to **Block**, and then select **Next** -12. On the **Scope tags** tab, configure if necessary and then select **Next** +12. In **Scope tags**, configure if necessary and then select **Next** -13. On the **Assignments** tab: +13. In **Assignments**: 1. Under **Included groups**, select **Add groups** 2. Select the groups that the disable crash dumps policy should be deployed to 3. Select **Select** 4. Select **Next** -14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +14. In **Review + create**, review the configuration to make sure everything is configured correctly, and then select **Create** ### Disable Windows Error Reporting (WER)/Disable user-mode crash dumps @@ -155,31 +155,31 @@ ms.date: 12/07/2022 5. Under **Profile type**, select **Settings catalog**, and then select **Create** -6. On the **Basics** tab: +6. In **Basics**: 1. Next to **Name**, enter **Disable Windows Error Reporting (WER)** 2. Next to **Description**, enter a description 7. Select **Next** -8. On the **Configuration settings** tab, select **Add settings** +8. In **Configuration settings**, select **Add settings** -9. In the **Settings picker** windows, expand to **Administrative Templates** > **Windows Components**, and then select **Windows Error Reporting** +9. In the **Settings picker** window, under **Browse by category**, expand to **Administrative Templates** > **Windows Components**, and then select **Windows Error Reporting** -10. When the settings appear in the lower pane, under **Setting name**, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window +10. When the settings appear under **Setting name**, select **Disable Windows Error Reporting**, and then select the **X** in the top right corner of the **Settings picker** window to close the window -11. Change both **Disable Windows Error Reporting** to **Enabled**, and then select **Next** +11. Change **Disable Windows Error Reporting** to **Enabled**, and then select **Next** -12. On the **Scope tags** tab, configure if necessary and then select **Next** +12. In **Scope tags**, configure if necessary and then select **Next** -13. On the **Assignments** tab: +13. In **Assignments**: 1. Under **Included groups**, select **Add groups** 2. Select the groups that the disable WER dumps policy should be deployed to 3. Select **Select** 4. Select **Next** -14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +14. In **Review + create**, review the configuration to make sure everything is configured correctly, and then select **Create** ### Disable hibernation @@ -193,31 +193,31 @@ ms.date: 12/07/2022 5. Under **Profile type**, select **Settings catalog**, and then select **Create** -6. On the **Basics** tab: +6. In **Basics**: 1. Next to **Name**, enter **Disable Hibernation** 2. Next to **Description**, enter a description 7. Select **Next** -8. On the **Configuration settings** tab, select **Add settings** +8. In **Configuration settings**, select **Add settings** -9. In the **Settings picker** windows, select **Power** +9. In the **Settings picker** window, under **Browse by category**, select **Power** -10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window +10. When the settings appear under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window 11. Change **Allow Hibernate** to **Block**, and then select **Next** -12. On the **Scope tags** tab, configure if necessary and then select **Next** +12. In **Scope tags**, configure if necessary and then select **Next** -13. On the **Assignments** tab: +13. In **Assignments**: 1. Under **Included groups**, select **Add groups** 2. Select the groups that the disable hibernation policy should be deployed to 3. Select **Select** 4. Select **Next** -14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +14. In **Review + create**, review the configuration to make sure everything is configured correctly, and then select **Create** ### Disable allowing users to select when a password is required when resuming from connected standby @@ -231,31 +231,32 @@ ms.date: 12/07/2022 5. Under **Profile type**, select **Settings catalog**, and then select **Create** -6. On the **Basics** tab: +6. In **Basics**: - 1. Next to **Name**, enter **Disable Hibernation** + 1. Next to **Name**, enter **Disable allowing users to select when a password is required when resuming from connected standby** 2. Next to **Description**, enter a description 7. Select **Next** -8. On the **Configuration settings** tab, select **Add settings** +8. In **Configuration settings**, select **Add settings** -9. In the **Settings picker** windows, select **Power** +9. In the **Settings picker** window, under **Browse by category**, expand to **Administrative Templates** > **System**, and then select **Logon** -10. When the settings appear in the lower pane, under **Setting name**, select **Allow Hibernate**, and then select the **X** in the top right corner of the **Settings picker** window to close the window +10. When the settings appear under **Setting name**, select **Allow users to select when a password is required when resuming from connected standby**, and then select the **X** in the top right corner of the **Settings picker** window to close the window -11. Change **Allow Hibernate** to **Block**, and then select **Next** +11. Make sure that **Allow users to select when a password is required when resuming from connected standby** is left at the default of **Disabled**, and then select **Next** -12. On the **Scope tags** tab, configure if necessary and then select **Next** +12. In **Scope tags**, configure if necessary and then select **Next** -13. On the **Assignments** tab: +13. In **Assignments**: 1. Under **Included groups**, select **Add groups** - 2. Select the groups that the disable hibernation policy should be deployed to + 2. Select the groups that the disable Allow users to select when a password is required when resuming from connected standby policy should be deployed to 3. Select **Select** 4. Select **Next** -14. On the **Review + create** tab, review the configuration to make sure everything is configured correctly, and then select **Create** +14. In **Review + create**, review the configuration to make sure everything is configured correctly, and then select **Create** + ## See also - [Personal Data Encryption (PDE)](overview-pde.md) diff --git a/windows/security/information-protection/personal-data-encryption/overview-pde.md b/windows/security/information-protection/personal-data-encryption/overview-pde.md index 24c2d69d39..0c628956e8 100644 --- a/windows/security/information-protection/personal-data-encryption/overview-pde.md +++ b/windows/security/information-protection/personal-data-encryption/overview-pde.md @@ -54,7 +54,7 @@ ms.date: 12/07/2022 Hibernation files can potentially cause the keys used by PDE to protect files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see [Disable hibernation](configure-pde-in-intune.md#disable-hibernation). -- [Disable allowing users to select when a password is required when resuming from connected standby](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) +- [Allowing users to select when a password is required when resuming from connected standby disabled](/windows/client-management/mdm/policy-csp-admx-credentialproviders#admx-credentialproviders-allowdomaindelaylock) When this policy isn't configured, the outcome between on-premises Active Directory joined devices and workgroup devices, including native Azure Active Directory joined devices, is different: @@ -72,7 +72,7 @@ ms.date: 12/07/2022 - During the time when the screen turns off but a password isn't required, the keys used by PDE to protect files could potentially be exposed. This outcome isn't a desired outcome. - Because of this undesired outcome, it's recommended to explicitly disable this policy on native Azure AD joined devices. + Because of this undesired outcome, it's recommended to explicitly disable this policy on native Azure AD joined devices instead of leaving it at the default of not configured. For information on disabling this policy via Intune, see [Disable allowing users to select when a password is required when resuming from connected standby](configure-pde-in-intune.md#disable-allowing-users-to-select-when-a-password-is-required-when-resuming-from-connected-standby). From 38fcce4df4d3df21dbfa1735c79528c9c3b86a78 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 16:05:05 -0500 Subject: [PATCH 068/234] includes updates --- windows/security/images/icons/information.svg | 3 +++ windows/security/includes/hello-cloud.md | 11 +++++++++-- .../includes/hello-hybrid-cert-trust-aad.md | 13 ++++++++++--- .../security/includes/hello-hybrid-cert-trust-ad.md | 13 ++++++++++--- .../security/includes/hello-hybrid-cert-trust.md | 13 ++++++++++--- .../includes/hello-hybrid-cloudkerb-trust.md | 13 ++++++++++--- .../security/includes/hello-hybrid-key-trust-ad.md | 13 ++++++++++--- windows/security/includes/hello-hybrid-key-trust.md | 13 ++++++++++--- .../includes/hello-hybrid-keycert-trust-aad.md | 13 ++++++++++--- .../includes/hello-on-premises-cert-trust.md | 13 ++++++++++--- .../includes/hello-on-premises-key-trust.md | 13 ++++++++++--- .../includes/improve-request-performance.md | 10 ++-------- windows/security/includes/machineactionsnote.md | 8 ++------ .../includes/microsoft-defender-api-usgov.md | 10 ++-------- windows/security/includes/microsoft-defender.md | 8 +------- windows/security/includes/prerelease.md | 8 ++------ 16 files changed, 111 insertions(+), 64 deletions(-) create mode 100644 windows/security/images/icons/information.svg diff --git a/windows/security/images/icons/information.svg b/windows/security/images/icons/information.svg new file mode 100644 index 0000000000..bc692eabb9 --- /dev/null +++ b/windows/security/images/icons/information.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md index c40ed1027c..e718457806 100644 --- a/windows/security/includes/hello-cloud.md +++ b/windows/security/includes/hello-cloud.md @@ -1,6 +1,13 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [cloud](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) +- **Deployment type:** [cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "Learn more here")\ +- **Device registration type:** [Azure AD join :::image type="icon" source="images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here")
diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md index e80912d8b9..26b0afb77e 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md index 4ef97bd233..ab68662f8a 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-ad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ -✅ **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index 77a897f264..4b880256ab 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md index 4f68be791b..8ba8d48628 100644 --- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md +++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)\ +- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md index 68521a5a14..b222f73c69 100644 --- a/windows/security/includes/hello-hybrid-key-trust-ad.md +++ b/windows/security/includes/hello-hybrid-key-trust-ad.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ -✅ **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md index fdb7466014..01f38b9396 100644 --- a/windows/security/includes/hello-hybrid-key-trust.md +++ b/windows/security/includes/hello-hybrid-key-trust.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index a8d82200d3..a1b033a214 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ -✅ **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
--- diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md index 2cc01ac3ac..1fa4f7604b 100644 --- a/windows/security/includes/hello-on-premises-cert-trust.md +++ b/windows/security/includes/hello-on-premises-cert-trust.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\ -✅ **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ -✅ **Device registration type:** Active Directory domain join +- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\ +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +- **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md index cd6241fa72..b852117610 100644 --- a/windows/security/includes/hello-on-premises-key-trust.md +++ b/windows/security/includes/hello-on-premises-key-trust.md @@ -1,7 +1,14 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -✅ **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\ -✅ **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ -✅ **Device registration type:** Active Directory domain join +- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\ +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +- **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/improve-request-performance.md b/windows/security/includes/improve-request-performance.md index 24aaa25d9f..f928705138 100644 --- a/windows/security/includes/improve-request-performance.md +++ b/windows/security/includes/improve-request-performance.md @@ -1,14 +1,8 @@ --- -title: Improve request performance -description: Improve request performance -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security -ms.localizationpriority: medium -ms.collection: M365-security-compliance -ms.topic: article author: paolomatarazzo ms.author: paoloma -manager: aaroncz +ms.date: 12/08/2022 +ms.topic: include --- >[!TIP] diff --git a/windows/security/includes/machineactionsnote.md b/windows/security/includes/machineactionsnote.md index 31e3d1ac98..d4b4560d8f 100644 --- a/windows/security/includes/machineactionsnote.md +++ b/windows/security/includes/machineactionsnote.md @@ -1,12 +1,8 @@ --- -title: Perform a Machine Action via the Microsoft Defender for Endpoint API -description: This page focuses on performing a machine action via the Microsoft Defender for Endpoint API. -ms.date: 08/28/2017 -ms.reviewer: author: paolomatarazzo ms.author: paoloma -manager: aaroncz -ms.prod: m365-security +ms.date: 12/08/2022 +ms.topic: include --- >[!Note] diff --git a/windows/security/includes/microsoft-defender-api-usgov.md b/windows/security/includes/microsoft-defender-api-usgov.md index 74cfd90cbb..0b0b2be701 100644 --- a/windows/security/includes/microsoft-defender-api-usgov.md +++ b/windows/security/includes/microsoft-defender-api-usgov.md @@ -1,14 +1,8 @@ --- -title: Microsoft Defender for Endpoint API URIs for US Government -description: Microsoft Defender for Endpoint API URIs for US Government -search.product: eADQiWindows 10XVcnh -ms.prod: m365-security author: paolomatarazzo ms.author: paoloma -manager: aaroncz -ms.localizationpriority: medium -ms.collection: M365-security-compliance -ms.topic: article +ms.date: 12/08/2022 +ms.topic: include --- >[!NOTE] diff --git a/windows/security/includes/microsoft-defender.md b/windows/security/includes/microsoft-defender.md index 0aade34b01..bd9a8d2c0d 100644 --- a/windows/security/includes/microsoft-defender.md +++ b/windows/security/includes/microsoft-defender.md @@ -1,13 +1,7 @@ --- -title: Microsoft 365 Defender important guidance -description: A note in regard to important Microsoft 365 Defender guidance. -ms.date: -ms.reviewer: -manager: aaroncz author: paolomatarazzo ms.author: paoloma -manager: aaroncz -ms.prod: m365-security +ms.date: 12/08/2022 ms.topic: include --- diff --git a/windows/security/includes/prerelease.md b/windows/security/includes/prerelease.md index 58b056c484..c0212561bd 100644 --- a/windows/security/includes/prerelease.md +++ b/windows/security/includes/prerelease.md @@ -1,12 +1,8 @@ --- -title: Microsoft Defender for Endpoint Pre-release Disclaimer -description: Disclaimer for pre-release version of Microsoft Defender for Endpoint. -ms.date: 08/28/2017 -ms.reviewer: author: paolomatarazzo ms.author: paoloma -manager: aaroncz -ms.prod: m365-security +ms.date: 12/08/2022 +ms.topic: include --- > [!IMPORTANT] From b98951d0c36bd6ecde90b8d8e8f388d4f4b36107 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 16:18:58 -0500 Subject: [PATCH 069/234] updates --- windows/security/includes/hello-cloud.md | 11 ++++------- windows/security/includes/hello-deployment-cloud.md | 8 ++++++++ .../security/includes/hello-hybrid-cert-trust-aad.md | 11 ++++------- .../security/includes/hello-hybrid-cert-trust-ad.md | 6 +++--- windows/security/includes/hello-hybrid-cert-trust.md | 6 +++--- .../security/includes/hello-hybrid-cloudkerb-trust.md | 6 +++--- .../security/includes/hello-hybrid-key-trust-ad.md | 6 +++--- windows/security/includes/hello-hybrid-key-trust.md | 6 +++--- .../includes/hello-hybrid-keycert-trust-aad.md | 6 +++--- windows/security/includes/hello-intro.md | 8 ++++++++ .../security/includes/hello-on-premises-cert-trust.md | 6 +++--- .../security/includes/hello-on-premises-key-trust.md | 6 +++--- windows/security/includes/hello-outro.md | 10 ++++++++++ windows/security/includes/hello-registration-aadj.md | 8 ++++++++ 14 files changed, 66 insertions(+), 38 deletions(-) create mode 100644 windows/security/includes/hello-deployment-cloud.md create mode 100644 windows/security/includes/hello-intro.md create mode 100644 windows/security/includes/hello-outro.md create mode 100644 windows/security/includes/hello-registration-aadj.md diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md index e718457806..70d63d9230 100644 --- a/windows/security/includes/hello-cloud.md +++ b/windows/security/includes/hello-cloud.md @@ -5,10 +5,7 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "Learn more here")\ -- **Device registration type:** [Azure AD join :::image type="icon" source="images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here") - -
- ---- +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)] +- **Device registration type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)] +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-deployment-cloud.md b/windows/security/includes/hello-deployment-cloud.md new file mode 100644 index 0000000000..79cde9e0b1 --- /dev/null +++ b/windows/security/includes/hello-deployment-cloud.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment) \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md index 26b0afb77e..fa4351ad77 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md index ab68662f8a..8b5a2a1ad3 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-ad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index 4b880256ab..c052d404d0 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md index 8ba8d48628..d91c8f5148 100644 --- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md +++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md index b222f73c69..0bcdd2a570 100644 --- a/windows/security/includes/hello-hybrid-key-trust-ad.md +++ b/windows/security/includes/hello-hybrid-key-trust-ad.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md index 01f38b9396..49a6329926 100644 --- a/windows/security/includes/hello-hybrid-key-trust.md +++ b/windows/security/includes/hello-hybrid-key-trust.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join)
diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index a1b033a214..df52c11771 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment)\ -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join)
diff --git a/windows/security/includes/hello-intro.md b/windows/security/includes/hello-intro.md new file mode 100644 index 0000000000..46d97c93e6 --- /dev/null +++ b/windows/security/includes/hello-intro.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +This document describes Windows Hello for Business functionalities or scenarios that apply to: \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md index 1fa4f7604b..6bfbf5f58f 100644 --- a/windows/security/includes/hello-on-premises-cert-trust.md +++ b/windows/security/includes/hello-on-premises-cert-trust.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\ -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment) +- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md index b852117610..b6b279c866 100644 --- a/windows/security/includes/hello-on-premises-key-trust.md +++ b/windows/security/includes/hello-on-premises-key-trust.md @@ -5,9 +5,9 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to:\ -- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment)\ -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust)\ +This document describes Windows Hello for Business functionalities or scenarios that apply to: +- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment) +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** Active Directory domain join
diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md new file mode 100644 index 0000000000..12b51c9186 --- /dev/null +++ b/windows/security/includes/hello-outro.md @@ -0,0 +1,10 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +
+ +--- diff --git a/windows/security/includes/hello-registration-aadj.md b/windows/security/includes/hello-registration-aadj.md new file mode 100644 index 0000000000..a05d0d55a4 --- /dev/null +++ b/windows/security/includes/hello-registration-aadj.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here") \ No newline at end of file From 40951ba5df88650dd898d6f63bca619a044f542b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 17:04:10 -0500 Subject: [PATCH 070/234] updates --- windows/security/includes/hello-deployment-cloud.md | 2 +- windows/security/includes/hello-deployment-hybrid.md | 8 ++++++++ windows/security/includes/hello-hybrid-cert-trust-aad.md | 2 +- windows/security/includes/hello-hybrid-cert-trust-ad.md | 9 +++------ windows/security/includes/hello-hybrid-cert-trust.md | 9 +++------ .../security/includes/hello-hybrid-cloudkerb-trust.md | 9 +++------ windows/security/includes/hello-hybrid-key-trust-ad.md | 9 +++------ windows/security/includes/hello-hybrid-key-trust.md | 9 +++------ .../security/includes/hello-hybrid-keycert-trust-aad.md | 8 +++----- .../security/includes/hello-on-premises-cert-trust.md | 7 ++----- windows/security/includes/hello-on-premises-key-trust.md | 7 ++----- 11 files changed, 32 insertions(+), 47 deletions(-) create mode 100644 windows/security/includes/hello-deployment-hybrid.md diff --git a/windows/security/includes/hello-deployment-cloud.md b/windows/security/includes/hello-deployment-cloud.md index 79cde9e0b1..352adf1b84 100644 --- a/windows/security/includes/hello-deployment-cloud.md +++ b/windows/security/includes/hello-deployment-cloud.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment) \ No newline at end of file +[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using cloud-only identities. Device management is usually done via Intune/MDM") \ No newline at end of file diff --git a/windows/security/includes/hello-deployment-hybrid.md b/windows/security/includes/hello-deployment-hybrid.md new file mode 100644 index 0000000000..b35d4b548e --- /dev/null +++ b/windows/security/includes/hello-deployment-hybrid.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[hybrid :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment "For organizations using Active Directory identities synchronized to Azure AD. Device management is usually done via Group Policy or Intune/MDM") \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md index fa4351ad77..fbb447b574 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md @@ -6,7 +6,7 @@ ms.topic: include --- [!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) [!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md index 8b5a2a1ad3..aa837b36ea 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-ad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index c052d404d0..5581cd7265 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md index d91c8f5148..355aecc978 100644 --- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md +++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md index 0bcdd2a570..3b9f6d8215 100644 --- a/windows/security/includes/hello-hybrid-key-trust-ad.md +++ b/windows/security/includes/hello-hybrid-key-trust-ad.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md index 49a6329926..2113b03d84 100644 --- a/windows/security/includes/hello-hybrid-key-trust.md +++ b/windows/security/includes/hello-hybrid-key-trust.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index df52c11771..163c071b47 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -5,10 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: -- **Deployment type:** [hybrid](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-deployment) +[!INCLUDE [hello-intro](hello-intro.md)] +- **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md index 6bfbf5f58f..6087d95918 100644 --- a/windows/security/includes/hello-on-premises-cert-trust.md +++ b/windows/security/includes/hello-on-premises-cert-trust.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: +[!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment) - **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** Active Directory domain join - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md index b6b279c866..b99e5efa5f 100644 --- a/windows/security/includes/hello-on-premises-key-trust.md +++ b/windows/security/includes/hello-on-premises-key-trust.md @@ -5,11 +5,8 @@ ms.date: 12/08/2022 ms.topic: include --- -This document describes Windows Hello for Business functionalities or scenarios that apply to: +[!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment) - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** Active Directory domain join - -
- ---- +[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file From 74021014f773817d21a841f3384350e35cd8d759 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 17:08:28 -0500 Subject: [PATCH 071/234] updates --- windows/security/includes/hello-outro.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md index 12b51c9186..30e19adeb0 100644 --- a/windows/security/includes/hello-outro.md +++ b/windows/security/includes/hello-outro.md @@ -6,5 +6,4 @@ ms.topic: include ---
- ---- +--- \ No newline at end of file From 3b7cbcba029d4987a3428b77f7b3e16a7ff30a74 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 17:16:20 -0500 Subject: [PATCH 072/234] updates --- windows/security/includes/hello-outro.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md index 30e19adeb0..fd179664e7 100644 --- a/windows/security/includes/hello-outro.md +++ b/windows/security/includes/hello-outro.md @@ -6,4 +6,5 @@ ms.topic: include ---
+ --- \ No newline at end of file From beabb37cd42ea10dc1873b18a8ad09ad88e49998 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 17:21:55 -0500 Subject: [PATCH 073/234] updates --- windows/security/includes/hello-outro.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md index fd179664e7..8279c94503 100644 --- a/windows/security/includes/hello-outro.md +++ b/windows/security/includes/hello-outro.md @@ -5,6 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -
- --- \ No newline at end of file From 73c7ca9e8250b859a37a09652b8f044ca17ec1c6 Mon Sep 17 00:00:00 2001 From: Alex Buck Date: Thu, 8 Dec 2022 17:40:11 -0500 Subject: [PATCH 074/234] [BULK] DocuTune - Set ms.topic = guide --- education/windows/edu-deployment-recommendations.md | 2 +- education/windows/test-windows10s-for-edu.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index 983f31ed85..fe413622a4 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -1,7 +1,7 @@ --- title: Deployment recommendations for school IT administrators description: Provides guidance on ways to customize the OS privacy settings, and some of the apps, for Windows-based devices used in schools so that you can choose what information is shared with Microsoft. -ms.topic: guide +ms.topic: conceptual ms.date: 08/10/2022 appliesto: - ✅ Windows 10 diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md index acc6aeb868..aa6d47a773 100644 --- a/education/windows/test-windows10s-for-edu.md +++ b/education/windows/test-windows10s-for-edu.md @@ -1,7 +1,7 @@ --- title: Test Windows 10 in S mode on existing Windows 10 education devices description: Provides guidance on downloading and testing Windows 10 in S mode for existing Windows 10 education devices. -ms.topic: guide +ms.topic: conceptual ms.date: 08/10/2022 appliesto: - ✅ Windows 10 @@ -227,4 +227,4 @@ For help with activation issues, select the appropriate link below for support o 1 Internet access fees may apply.
2 Devices must be configured for educational use by applying SetEduPolicies using the Setup School PCs app.
-

\ No newline at end of file +

From 421f41d2a0e322b488ddba2aa1f7ba09b82430a1 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 17:40:29 -0500 Subject: [PATCH 075/234] updates --- windows/security/includes/hello-cloud.md | 2 +- windows/security/includes/hello-deployment-onpremises.md | 8 ++++++++ windows/security/includes/hello-hybrid-cert-trust-aad.md | 4 ++-- windows/security/includes/hello-hybrid-cert-trust-ad.md | 4 ++-- windows/security/includes/hello-hybrid-cert-trust.md | 2 +- windows/security/includes/hello-hybrid-cloudkerb-trust.md | 2 +- windows/security/includes/hello-hybrid-key-trust-ad.md | 2 +- windows/security/includes/hello-hybrid-key-trust.md | 2 +- .../security/includes/hello-hybrid-keycert-trust-aad.md | 2 +- windows/security/includes/hello-on-premises-cert-trust.md | 4 ++-- windows/security/includes/hello-on-premises-key-trust.md | 4 ++-- windows/security/includes/hello-outro.md | 8 -------- windows/security/includes/hello-trust-certificate.md | 8 ++++++++ 13 files changed, 30 insertions(+), 22 deletions(-) create mode 100644 windows/security/includes/hello-deployment-onpremises.md delete mode 100644 windows/security/includes/hello-outro.md create mode 100644 windows/security/includes/hello-trust-certificate.md diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md index 70d63d9230..a0dfb0fb3e 100644 --- a/windows/security/includes/hello-cloud.md +++ b/windows/security/includes/hello-cloud.md @@ -8,4 +8,4 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)] - **Device registration type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)] -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-deployment-onpremises.md b/windows/security/includes/hello-deployment-onpremises.md new file mode 100644 index 0000000000..8746a5e9c7 --- /dev/null +++ b/windows/security/includes/hello-deployment-onpremises.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[on-premises :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment "For organizations using Active Directory identities, not synchronized to Azure AD. Device management is usually done via Group Policy") \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md index fbb447b574..e1ecb19dc4 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) +- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md index aa837b36ea..6a207c6874 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-ad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) +- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] - **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index 5581cd7265..ae7090346f 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -9,4 +9,4 @@ ms.topic: include - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md index 355aecc978..dc67aa794f 100644 --- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md +++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md @@ -9,4 +9,4 @@ ms.topic: include - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md index 3b9f6d8215..4f84a118dc 100644 --- a/windows/security/includes/hello-hybrid-key-trust-ad.md +++ b/windows/security/includes/hello-hybrid-key-trust-ad.md @@ -9,4 +9,4 @@ ms.topic: include - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md index 2113b03d84..5319cbb313 100644 --- a/windows/security/includes/hello-hybrid-key-trust.md +++ b/windows/security/includes/hello-hybrid-key-trust.md @@ -9,4 +9,4 @@ ms.topic: include - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index 163c071b47..201071e3d7 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -9,4 +9,4 @@ ms.topic: include - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md index 6087d95918..84f2bd6c15 100644 --- a/windows/security/includes/hello-on-premises-cert-trust.md +++ b/windows/security/includes/hello-on-premises-cert-trust.md @@ -6,7 +6,7 @@ ms.topic: include --- [!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment) +- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] - **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) - **Device registration type:** Active Directory domain join -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md index b99e5efa5f..9990eed8b9 100644 --- a/windows/security/includes/hello-on-premises-key-trust.md +++ b/windows/security/includes/hello-on-premises-key-trust.md @@ -6,7 +6,7 @@ ms.topic: include --- [!INCLUDE [hello-intro](hello-intro.md)] -- **Deployment type:** [on-premises](../identity-protection/hello-for-business/hello-how-it-works-technology.md#on-premises-deployment) +- **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) - **Device registration type:** Active Directory domain join -[!INCLUDE [hello-outro](hello-outro.md)] \ No newline at end of file +--- \ No newline at end of file diff --git a/windows/security/includes/hello-outro.md b/windows/security/includes/hello-outro.md deleted file mode 100644 index 8279c94503..0000000000 --- a/windows/security/includes/hello-outro.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -author: paolomatarazzo -ms.author: paoloma -ms.date: 12/08/2022 -ms.topic: include ---- - ---- \ No newline at end of file diff --git a/windows/security/includes/hello-trust-certificate.md b/windows/security/includes/hello-trust-certificate.md new file mode 100644 index 0000000000..d3735aa9aa --- /dev/null +++ b/windows/security/includes/hello-trust-certificate.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a user certificate to authenticate to Active Directory") \ No newline at end of file From 4a1cd06dbc7801602df0d60d39418b7e5fb02d71 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 8 Dec 2022 17:55:56 -0500 Subject: [PATCH 076/234] updates --- windows/security/includes/hello-hybrid-cert-trust.md | 2 +- windows/security/includes/hello-hybrid-keycert-trust-aad.md | 2 +- windows/security/includes/hello-on-premises-cert-trust.md | 2 +- windows/security/includes/hello-trust-certificate.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index ae7090346f..2fdd3bda52 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) +- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index 201071e3d7..dfc0d12624 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) +- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] - **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) --- \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md index 84f2bd6c15..ab18370114 100644 --- a/windows/security/includes/hello-on-premises-cert-trust.md +++ b/windows/security/includes/hello-on-premises-cert-trust.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] -- **Trust type:** [certificate trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust) +- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] - **Device registration type:** Active Directory domain join --- \ No newline at end of file diff --git a/windows/security/includes/hello-trust-certificate.md b/windows/security/includes/hello-trust-certificate.md index d3735aa9aa..82dfd5e203 100644 --- a/windows/security/includes/hello-trust-certificate.md +++ b/windows/security/includes/hello-trust-certificate.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a user certificate to authenticate to Active Directory") \ No newline at end of file +[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the user to Active Directory") \ No newline at end of file From 4107e0d024bac744b043c1988f8fee2491db969b Mon Sep 17 00:00:00 2001 From: Sarah Barrett Date: Thu, 8 Dec 2022 15:48:52 -0800 Subject: [PATCH 077/234] Turn off extendBreadcrumbs --- browsers/edge/docfx.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index d786e0bbfb..d36533a87e 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -28,7 +28,7 @@ ], "globalMetadata": { "recommendations": true, - "breadcrumb_path": "/microsoft-edge/deploy/breadcrumb/toc.json", + "breadcrumb_path": "/microsoft-edge/breadcrumbs/toc.json", "ROBOTS": "INDEX, FOLLOW", "ms.technology": "microsoft-edge", "audience": "ITPro", From 929a0c56335be262a1565024000d86ee5a0c5c43 Mon Sep 17 00:00:00 2001 From: Sarah Barrett Date: Thu, 8 Dec 2022 15:52:12 -0800 Subject: [PATCH 078/234] Update breadcrumb --- browsers/edge/breadcrumb/toc.yml | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/browsers/edge/breadcrumb/toc.yml b/browsers/edge/breadcrumb/toc.yml index f417737985..83065b36a9 100644 --- a/browsers/edge/breadcrumb/toc.yml +++ b/browsers/edge/breadcrumb/toc.yml @@ -1,7 +1,3 @@ -- name: Docs - tocHref: / - topicHref: / - items: - - name: Microsoft Edge deployment - tocHref: /microsoft-edge/deploy - topicHref: /microsoft-edge/deploy/index \ No newline at end of file +- name: Microsoft Edge + tocHref: /microsoft-edge/ + topicHref: /microsoft-edge/index From 4d98e8be802c6c8ccbefea400664c409fcd35cc5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 9 Dec 2022 11:50:50 -0500 Subject: [PATCH 079/234] updates --- windows/security/includes/hello-join-aadj.md | 8 ++++++++ windows/security/includes/hello-join-domain.md | 8 ++++++++ 2 files changed, 16 insertions(+) create mode 100644 windows/security/includes/hello-join-aadj.md create mode 100644 windows/security/includes/hello-join-domain.md diff --git a/windows/security/includes/hello-join-aadj.md b/windows/security/includes/hello-join-aadj.md new file mode 100644 index 0000000000..5709970576 --- /dev/null +++ b/windows/security/includes/hello-join-aadj.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Devices that are Azure AD joined do not have any dependencies on Active Directory. Only local users accounts and Azure AD users can sign in to these devices") \ No newline at end of file diff --git a/windows/security/includes/hello-join-domain.md b/windows/security/includes/hello-join-domain.md new file mode 100644 index 0000000000..56f0037453 --- /dev/null +++ b/windows/security/includes/hello-join-domain.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[Domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices") \ No newline at end of file From 874870428f56e04ede580233b9ca5a2effa07e28 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 9 Dec 2022 11:51:03 -0500 Subject: [PATCH 080/234] updates --- .../hello-for-business/retired/hello-how-it-works.md | 3 +-- windows/security/includes/hello-cloud.md | 2 +- windows/security/includes/hello-deployment-cloud.md | 2 +- windows/security/includes/hello-hybrid-cert-trust-aad.md | 2 +- windows/security/includes/hello-hybrid-cert-trust-ad.md | 4 ++-- windows/security/includes/hello-hybrid-cert-trust.md | 2 +- windows/security/includes/hello-hybrid-cloudkerb-trust.md | 4 ++-- windows/security/includes/hello-hybrid-key-trust-ad.md | 4 ++-- windows/security/includes/hello-hybrid-key-trust.md | 4 ++-- .../security/includes/hello-hybrid-keycert-trust-aad.md | 4 ++-- windows/security/includes/hello-join-hybrid.md | 8 ++++++++ windows/security/includes/hello-on-premises-cert-trust.md | 2 +- windows/security/includes/hello-on-premises-key-trust.md | 2 +- windows/security/includes/hello-registration-aadj.md | 8 -------- windows/security/includes/hello-trust-certificate.md | 2 +- windows/security/includes/hello-trust-cloud-kerberos.md | 8 ++++++++ windows/security/includes/hello-trust-key.md | 8 ++++++++ 17 files changed, 42 insertions(+), 27 deletions(-) create mode 100644 windows/security/includes/hello-join-hybrid.md delete mode 100644 windows/security/includes/hello-registration-aadj.md create mode 100644 windows/security/includes/hello-trust-cloud-kerberos.md create mode 100644 windows/security/includes/hello-trust-key.md diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 5aa1fcad6a..1987c05d33 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -3,8 +3,7 @@ title: How Windows Hello for Business works (Windows) description: Learn about registration, authentication, key material, and infrastructure for Windows Hello for Business. ms.date: 10/16/2017 appliesto: - - ✅ Windows 10 - - ✅ Windows 11 +- ✅ Windows 10 and later ms.topic: article --- # How Windows Hello for Business works in Windows devices diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md index a0dfb0fb3e..e1f813e099 100644 --- a/windows/security/includes/hello-cloud.md +++ b/windows/security/includes/hello-cloud.md @@ -7,5 +7,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)] -- **Device registration type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)] +- **Join type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-deployment-cloud.md b/windows/security/includes/hello-deployment-cloud.md index 352adf1b84..8152da9722 100644 --- a/windows/security/includes/hello-deployment-cloud.md +++ b/windows/security/includes/hello-deployment-cloud.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using cloud-only identities. Device management is usually done via Intune/MDM") \ No newline at end of file +[cloud :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-deployment "For organizations using Azure AD-only identities. Device management is usually done via Intune/MDM") \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md index e1ecb19dc4..475eef648c 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-ad.md b/windows/security/includes/hello-hybrid-cert-trust-ad.md index 6a207c6874..4691d86bc0 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-ad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-ad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)] +- **Join type:** [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index 2fdd3bda52..8257bb90b0 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md index dc67aa794f..c18d03021c 100644 --- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md +++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [cloud Kerberos trust](../identity-protection/hello-for-business/hello-hybrid-cloud-kerberos-trust.md) -- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust-ad.md b/windows/security/includes/hello-hybrid-key-trust-ad.md index 4f84a118dc..a5074f5bd4 100644 --- a/windows/security/includes/hello-hybrid-key-trust-ad.md +++ b/windows/security/includes/hello-hybrid-key-trust-ad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) -- **Device registration type:** [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)] +- **Join type:** [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md index 5319cbb313..6f655a6c2b 100644 --- a/windows/security/includes/hello-hybrid-key-trust.md +++ b/windows/security/includes/hello-hybrid-key-trust.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) -- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join) +- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index dfc0d12624..664db48668 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust), [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Device registration type:** [Azure AD join](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join) +- **Trust type:** - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-join-hybrid.md b/windows/security/includes/hello-join-hybrid.md new file mode 100644 index 0000000000..550c6ee26d --- /dev/null +++ b/windows/security/includes/hello-join-hybrid.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. If an Active Directory user is synchronized to Azure AD, she can can have single-sign on to both Active Directory and Azure AD-protected resources") \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-cert-trust.md b/windows/security/includes/hello-on-premises-cert-trust.md index ab18370114..b106b5b8c8 100644 --- a/windows/security/includes/hello-on-premises-cert-trust.md +++ b/windows/security/includes/hello-on-premises-cert-trust.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] - **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Device registration type:** Active Directory domain join +- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md index 9990eed8b9..2a31c533c2 100644 --- a/windows/security/includes/hello-on-premises-key-trust.md +++ b/windows/security/includes/hello-on-premises-key-trust.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] - **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) -- **Device registration type:** Active Directory domain join +- **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-registration-aadj.md b/windows/security/includes/hello-registration-aadj.md deleted file mode 100644 index a05d0d55a4..0000000000 --- a/windows/security/includes/hello-registration-aadj.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -author: paolomatarazzo -ms.author: paoloma -ms.date: 12/08/2022 -ms.topic: include ---- - -[Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#azure-active-directory-join "Learn more here") \ No newline at end of file diff --git a/windows/security/includes/hello-trust-certificate.md b/windows/security/includes/hello-trust-certificate.md index 82dfd5e203..ffc705fde0 100644 --- a/windows/security/includes/hello-trust-certificate.md +++ b/windows/security/includes/hello-trust-certificate.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the user to Active Directory") \ No newline at end of file +[certificate trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#certificate-trust "This trust type uses a certificate to authenticate the users to Active Directory. It's required to issue certificates to the users and to the domain controllers") \ No newline at end of file diff --git a/windows/security/includes/hello-trust-cloud-kerberos.md b/windows/security/includes/hello-trust-cloud-kerberos.md new file mode 100644 index 0000000000..76dfb6c4a1 --- /dev/null +++ b/windows/security/includes/hello-trust-cloud-kerberos.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication.") \ No newline at end of file diff --git a/windows/security/includes/hello-trust-key.md b/windows/security/includes/hello-trust-key.md new file mode 100644 index 0000000000..133f7f5204 --- /dev/null +++ b/windows/security/includes/hello-trust-key.md @@ -0,0 +1,8 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 12/08/2022 +ms.topic: include +--- + +[key trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust "This trust type uses a raw key to authenticate the users to Active Directory. It's not required to issue certificates to users, but it's required to deploy certificates to domain controllers") \ No newline at end of file From 7edf5d8aeb4ec77769351c01fdb60d145d98c6aa Mon Sep 17 00:00:00 2001 From: robinharwood <19212983+robinharwood@users.noreply.github.com> Date: Tue, 6 Dec 2022 14:26:21 +0000 Subject: [PATCH 081/234] Updated privacy text to reference Azure Edition changes --- .../privacy/changes-to-windows-diagnostic-data-collection.md | 2 ++ .../configure-windows-diagnostic-data-in-your-organization.md | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index 48eab123cc..c06da47c28 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -30,6 +30,8 @@ In Windows 10, version 1903 and later, you'll see taxonomy updates in both the * Additionally, starting in Windows 11 and Windows Server 2022, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to reflect its behavior more accurately by changing it to **Diagnostic data off**. All these changes are explained in the section named **Behavioral changes**. +Prior to December 7 2022, the default setting for Windows Server 2022 Datacenter: Azure Edition images deployed using Azure Marketplace was **Diagnostic data off**. Beginning December 7 2022, all newly deployed images are set to **Required diagnostic data** to align with all other Windows releases. All other Windows releases and existing installations remain unchanged. + ## Taxonomy changes Starting in Windows 10, version 1903 and later, both the **Out-of-Box-Experience** (OOBE) and the **Diagnostics & feedback** privacy setting pages will reflect the following changes: diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 4e4656fc55..87b36690fb 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -164,6 +164,8 @@ Here’s a summary of the types of data that is included with each setting: This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows Enterprise, and Windows Education editions. If you choose this setting, devices in your organization will still be secure. +This was the default setting for Windows Server 2022 Datacenter: Azure Edition prior to December 7, 2022. + >[!NOTE] > If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. @@ -171,7 +173,7 @@ This setting was previously labeled as **Security**. When you configure this set Required diagnostic data, previously labeled as **Basic**, gathers a limited set of data that’s critical for understanding the device and its configuration. This data helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. -This is the default setting for current releases of Windows, Windows 10, version 1903. +This is the default setting for current releases of Windows, Windows 10, version 1903. Beginning December 7, 2022, it is also the default setting for Windows Server 2022 Datacenter: Azure Edition. Required diagnostic data includes: From 4cf11ed29aed77a8473759ec35f366155729b0b1 Mon Sep 17 00:00:00 2001 From: robinharwood <19212983+robinharwood@users.noreply.github.com> Date: Fri, 9 Dec 2022 10:00:34 +0000 Subject: [PATCH 082/234] Updated Azure Edition dates --- .../privacy/changes-to-windows-diagnostic-data-collection.md | 2 +- .../configure-windows-diagnostic-data-in-your-organization.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index c06da47c28..34066bed6d 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -30,7 +30,7 @@ In Windows 10, version 1903 and later, you'll see taxonomy updates in both the * Additionally, starting in Windows 11 and Windows Server 2022, we’re simplifying your diagnostic data controls by moving from four diagnostic data controls to three: **Diagnostic data off**, **Required**, and **Optional**. We’re also clarifying the Security diagnostic data level to reflect its behavior more accurately by changing it to **Diagnostic data off**. All these changes are explained in the section named **Behavioral changes**. -Prior to December 7 2022, the default setting for Windows Server 2022 Datacenter: Azure Edition images deployed using Azure Marketplace was **Diagnostic data off**. Beginning December 7 2022, all newly deployed images are set to **Required diagnostic data** to align with all other Windows releases. All other Windows releases and existing installations remain unchanged. +Prior to December 13 2022, the default setting for Windows Server 2022 Datacenter: Azure Edition images deployed using Azure Marketplace was **Diagnostic data off**. Beginning December 13 2022, all newly deployed images are set to **Required diagnostic data** to align with all other Windows releases. All other Windows releases and existing installations remain unchanged. ## Taxonomy changes diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 87b36690fb..ac1febdc26 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -164,7 +164,7 @@ Here’s a summary of the types of data that is included with each setting: This setting was previously labeled as **Security**. When you configure this setting, no Windows diagnostic data is sent from your device. This is only available on Windows Server, Windows Enterprise, and Windows Education editions. If you choose this setting, devices in your organization will still be secure. -This was the default setting for Windows Server 2022 Datacenter: Azure Edition prior to December 7, 2022. +This was the default setting for Windows Server 2022 Datacenter: Azure Edition prior to December 13, 2022. >[!NOTE] > If your organization relies on Windows Update, the minimum recommended setting is **Required diagnostic data**. Because no Windows Update information is collected when diagnostic data is off, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. @@ -173,7 +173,7 @@ This was the default setting for Windows Server 2022 Datacenter: Azure Edition p Required diagnostic data, previously labeled as **Basic**, gathers a limited set of data that’s critical for understanding the device and its configuration. This data helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. -This is the default setting for current releases of Windows, Windows 10, version 1903. Beginning December 7, 2022, it is also the default setting for Windows Server 2022 Datacenter: Azure Edition. +This is the default setting for current releases of Windows, Windows 10, version 1903. Beginning December 13, 2022, it is also the default setting for Windows Server 2022 Datacenter: Azure Edition. Required diagnostic data includes: From 7e19753acc05d5d84ecb54beb2d43b56a7282371 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 9 Dec 2022 15:25:21 -0500 Subject: [PATCH 083/234] updates --- windows/security/includes/hello-cloud.md | 2 +- windows/security/includes/hello-hybrid-cert-trust-aad.md | 2 +- windows/security/includes/hello-hybrid-cert-trust.md | 2 +- windows/security/includes/hello-hybrid-cloudkerb-trust.md | 2 +- windows/security/includes/hello-hybrid-key-trust.md | 2 +- windows/security/includes/hello-hybrid-keycert-trust-aad.md | 2 +- .../security/includes/{hello-join-aadj.md => hello-join-aad.md} | 0 windows/security/includes/hello-join-hybrid.md | 2 +- 8 files changed, 7 insertions(+), 7 deletions(-) rename windows/security/includes/{hello-join-aadj.md => hello-join-aad.md} (100%) diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md index e1f813e099..d7e1053eea 100644 --- a/windows/security/includes/hello-cloud.md +++ b/windows/security/includes/hello-cloud.md @@ -7,5 +7,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)] -- **Join type:** [!INCLUDE [hello-registration-aadj](hello-registration-aadj.md)] +- **Join type:** [!INCLUDE [hello-join-aad](hello-registration-aadj.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust-aad.md b/windows/security/includes/hello-hybrid-cert-trust-aad.md index 475eef648c..57c03e95a3 100644 --- a/windows/security/includes/hello-hybrid-cert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-cert-trust-aad.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cert-trust.md b/windows/security/includes/hello-hybrid-cert-trust.md index 8257bb90b0..d6ca6e8f5d 100644 --- a/windows/security/includes/hello-hybrid-cert-trust.md +++ b/windows/security/includes/hello-hybrid-cert-trust.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-cloudkerb-trust.md b/windows/security/includes/hello-hybrid-cloudkerb-trust.md index c18d03021c..61346cd80e 100644 --- a/windows/security/includes/hello-hybrid-cloudkerb-trust.md +++ b/windows/security/includes/hello-hybrid-cloudkerb-trust.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [hello-trust-cloud-kerberos](hello-trust-cloud-kerberos.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-key-trust.md b/windows/security/includes/hello-hybrid-key-trust.md index 6f655a6c2b..d9feebc213 100644 --- a/windows/security/includes/hello-hybrid-key-trust.md +++ b/windows/security/includes/hello-hybrid-key-trust.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)], [!INCLUDE [hello-join-hybrid](hello-join-hybrid.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index 664db48668..abdacf0e93 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -8,5 +8,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] - **Trust type:** - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] -- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aadj.md)] +- **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-join-aadj.md b/windows/security/includes/hello-join-aad.md similarity index 100% rename from windows/security/includes/hello-join-aadj.md rename to windows/security/includes/hello-join-aad.md diff --git a/windows/security/includes/hello-join-hybrid.md b/windows/security/includes/hello-join-hybrid.md index 550c6ee26d..93777d9174 100644 --- a/windows/security/includes/hello-join-hybrid.md +++ b/windows/security/includes/hello-join-hybrid.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. If an Active Directory user is synchronized to Azure AD, she can can have single-sign on to both Active Directory and Azure AD-protected resources") \ No newline at end of file +[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources") \ No newline at end of file From b5a795ecd4ccf871609ff258347461106f3796ba Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 9 Dec 2022 15:31:46 -0500 Subject: [PATCH 084/234] updates --- windows/security/includes/hello-cloud.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/includes/hello-cloud.md b/windows/security/includes/hello-cloud.md index d7e1053eea..1c41485f11 100644 --- a/windows/security/includes/hello-cloud.md +++ b/windows/security/includes/hello-cloud.md @@ -7,5 +7,5 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-cloud](hello-deployment-cloud.md)] -- **Join type:** [!INCLUDE [hello-join-aad](hello-registration-aadj.md)] +- **Join type:** [!INCLUDE [hello-join-aad](hello-join-aad.md)] --- \ No newline at end of file From 17c23d00f99bcffb9677069765cbb32eee7ef74a Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 9 Dec 2022 16:11:38 -0500 Subject: [PATCH 085/234] Update 2 CSPs --- .../mdm/policy-csp-clouddesktop.md | 9 +++-- .../mdm/policy-csp-windowslogon.md | 38 +++++++++++++++++-- 2 files changed, 41 insertions(+), 6 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index c0907eacb8..28e62cff3d 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -4,7 +4,7 @@ description: Learn more about the CloudDesktop Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/22/2022 +ms.date: 12/09/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -36,7 +36,11 @@ ms.topic: reference -This policy is used by IT admin to set the configuration mode of cloud PC. + +This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. +This policy supports the below options: +1. Not Configured: Machine will not trigger the Cloud PC connection automatically. +2. Enable Boot to Cloud Desktop: User will see that configured Cloud PC Provider application gets launched automatically once the sign-in operation finishes they seamlessly gets connected to a Cloud PC that is provisioned. @@ -51,7 +55,6 @@ This policy is used by IT admin to set the configuration mode of cloud PC. | Format | int | | Access Type | Add, Delete, Get, Replace | | Default Value | 0 | -| Dependency [OverrideShellProgramDependencyGroup] | Dependency Type: `DependsOn`
Dependency URI: `Device/Vendor/MSFT/Policy/Config/WindowsLogon/OverrideShellProgram`
Dependency Allowed Value: `[1]`
Dependency Allowed Value Type: `Range`
| diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 33e709f97a..ccfd17f1ae 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -4,7 +4,7 @@ description: Learn more about the WindowsLogon Area in Policy CSP author: vinaypamnani-msft manager: aaroncz ms.author: vinpa -ms.date: 11/29/2022 +ms.date: 12/09/2022 ms.localizationpriority: medium ms.prod: windows-client ms.technology: itpro-manage @@ -43,6 +43,7 @@ ms.topic: reference + This policy setting controls whether a device will automatically sign in and lock the last interactive user after the system restarts or after a shutdown and cold boot. This only occurs if the last interactive user didn’t sign out before the restart or shutdown.​ @@ -70,6 +71,9 @@ If you disable this policy setting, the device does not configure automatic sign +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + **ADMX mapping**: | Name | Value | @@ -105,6 +109,7 @@ If you disable this policy setting, the device does not configure automatic sign + This policy setting controls the configuration under which an automatic restart and sign on and lock occurs after a restart or cold boot. If you chose “Disabled” in the “Sign-in and lock last interactive user automatically after a restart” policy, then automatic sign on will not occur and this policy does not need to be configured. If you enable this policy setting, you can choose one of the following two options: @@ -132,6 +137,9 @@ If you disable or don’t configure this setting, automatic sign on will default +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + **ADMX mapping**: | Name | Value | @@ -166,6 +174,7 @@ If you disable or don’t configure this setting, automatic sign on will default + This policy setting allows you to prevent app notifications from appearing on the lock screen. If you enable this policy setting, no app notifications are displayed on the lock screen. @@ -187,6 +196,9 @@ If you disable or do not configure this policy setting, users can choose which a +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + **ADMX mapping**: | Name | Value | @@ -222,6 +234,7 @@ If you disable or do not configure this policy setting, users can choose which a + This policy setting allows you to control whether anyone can interact with available networks UI on the logon screen. If you enable this policy setting, the PC's network connectivity state cannot be changed without signing into Windows. @@ -243,6 +256,9 @@ If you disable or don't configure this policy setting, any user can disconnect t +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + **ADMX mapping**: | Name | Value | @@ -304,7 +320,8 @@ Here's an example to enable this policy: -This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. + +This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. @@ -374,6 +391,7 @@ Note: The first sign-in animation will not be shown on Server, so this policy wi + This policy controls the configuration under which winlogon sends MPR notifications in the system. If you enable this setting or do not configure it, winlogon sends MPR notifications if a credential manager is configured. @@ -395,6 +413,9 @@ If you disable this setting, winlogon does not send MPR notifications. +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + **ADMX mapping**: | Name | Value | @@ -430,6 +451,7 @@ If you disable this setting, winlogon does not send MPR notifications. + This policy setting allows local users to be enumerated on domain-joined computers. If you enable this policy setting, Logon UI will enumerate all local users on domain-joined computers. @@ -451,6 +473,9 @@ If you disable or do not configure this policy setting, the Logon UI will not en +> [!TIP] +> This is an ADMX-backed policy and requires SyncML format for configuration. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + **ADMX mapping**: | Name | Value | @@ -486,6 +511,7 @@ If you disable or do not configure this policy setting, the Logon UI will not en + This policy setting allows you to hide the Switch User interface in the Logon UI, the Start menu and the Task Manager. If you enable this policy setting, the Switch User interface is hidden from the user who is attempting to log on or is logged on to the computer that has this policy applied. @@ -554,7 +580,12 @@ If you disable or do not configure this policy setting, the Switch User interfac -This policy is used by IT admin to override the registry based shell program. + +OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. +The policy currently supports below options: +1. Not Configured: Default shell will be launched. +2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. +If you disable or do not configure this policy setting, then the default shell will be launched. @@ -569,6 +600,7 @@ This policy is used by IT admin to override the registry based shell program. | Format | int | | Access Type | Add, Delete, Get, Replace | | Default Value | 0 | +| Dependency [BootToCloudModeDependencyGroup] | Dependency Type: `DependsOn`
Dependency URI: `Device/Vendor/MSFT/Policy/Config/CloudDesktop/BootToCloudMode`
Dependency Allowed Value: `[1]`
Dependency Allowed Value Type: `Range`
| From 4e2d62260ad48c35e30265cdaa3d9f49ae8163a2 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 9 Dec 2022 16:25:24 -0500 Subject: [PATCH 086/234] Minor changes --- windows/client-management/mdm/policy-csp-clouddesktop.md | 2 ++ windows/client-management/mdm/policy-csp-windowslogon.md | 3 +++ 2 files changed, 5 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index 28e62cff3d..b150214dd9 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -38,7 +38,9 @@ ms.topic: reference This policy allows the user to configure the boot to cloud mode. Boot to Cloud mode enables users to seamlessly sign-in to a Cloud PC that is provisioned for them by an IT Admin. For using boot to cloud mode, users need to install and configure a Cloud Provider application (eg: Win365) on their PC and need to have a Cloud PC provisioned to them. For successful use of this policy, OverrideShellProgram policy needs to be configured as well. + This policy supports the below options: + 1. Not Configured: Machine will not trigger the Cloud PC connection automatically. 2. Enable Boot to Cloud Desktop: User will see that configured Cloud PC Provider application gets launched automatically once the sign-in operation finishes they seamlessly gets connected to a Cloud PC that is provisioned. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index ccfd17f1ae..15d68c57a4 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -582,9 +582,12 @@ If you disable or do not configure this policy setting, the Switch User interfac OverrideShellProgram policy allows IT admin to configure the shell program for Windows OS on a device. This policy has the highest precedence over other ways of configuring the shell program. + The policy currently supports below options: + 1. Not Configured: Default shell will be launched. 2. Apply Lightweight Shell: Lightweight shell does not have a user interface and helps the device to achieve better performance as the shell consumes limited resources over default shell. Lightweight shell contains a limited set of features which could be consumed by applications. This configuration can be useful if the device needs to have a continuous running user interface application which would consume features offered by Lightweight shell. + If you disable or do not configure this policy setting, then the default shell will be launched. From c7332c5ac07c781313137999ade1a959ebe45c86 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Fri, 9 Dec 2022 13:31:54 -0800 Subject: [PATCH 087/234] Update windows-autopatch-wqu-overview.md --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index 12c0848bd6..b834b4c886 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days ### Opt out of expedited releases -Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release Settings** tab, turn off the **Expedited Quality Updates** setting. +Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release settings** tab, turn off the **Expedited Quality Updates** setting. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | From a130110bab8a66a9aa7300471087efbb7da86be2 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 9 Dec 2022 16:46:40 -0500 Subject: [PATCH 088/234] updates --- .../hello-aad-join-cloud-only-deploy.md | 4 ++-- .../hello-how-it-works-technology.md | 22 +++++++++++++++++++ 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md index 721ddca258..814f5855d9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md +++ b/windows/security/identity-protection/hello-for-business/hello-aad-join-cloud-only-deploy.md @@ -17,7 +17,7 @@ When you Azure Active Directory (Azure AD) join a Windows device, the system pro You may wish to disable the automatic Windows Hello for Business enrollment prompts if you aren't ready to use it in your environment. Instructions on how to disable Windows Hello for Business enrollment in a cloud only environment are included below. > [!NOTE] -> During the out-of-box experience (OOBE) flow of an Azure AD join, you will see a provisioning PIN when you don’t have Intune. You can always cancel the PIN screen and set this cancellation with registry keys to prevent future prompts. +> During the out-of-box experience (OOBE) flow of an Azure AD join, you will see a provisioning PIN when you don't have Intune. You can always cancel the PIN screen and set this cancellation with registry keys to prevent future prompts. ## Prerequisites @@ -25,7 +25,7 @@ Cloud only deployments will use Azure AD multi-factor authentication (MFA) durin The necessary Windows Hello for Business prerequisites are located at [Cloud Only Deployment](hello-identity-verification.md#azure-ad-cloud-only-deployment). -Also note that it's possible for federated domains to enable the “Supports MFA” flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge. +Also note that it's possible for federated domains to enable the *Supports MFA* flag in your federated domain settings. This flag tells Azure AD that the federated IDP will perform the MFA challenge. Check and view this setting with the following MSOnline PowerShell command: diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index ad5eec8634..fedf93f60e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -70,6 +70,7 @@ The certificate trust model uses a securely issued certificate based on the user - [Deployment type](#deployment-type) - [Hybrid Azure AD join](#hybrid-azure-ad-join) - [Hybrid deployment](#hybrid-deployment) +- [Cloud Kerberos trust](#cloud-kerberos-trust) - [Key trust](#key-trust) - [On-premises deployment](#on-premises-deployment) - [Trust type](#trust-type) @@ -102,6 +103,27 @@ In Windows 10 and Windows 11, cloud experience host is an application used while [Windows Hello for Business and device registration](./hello-how-it-works-device-registration.md) +## Cloud Kerberos trust + +The cloud Kerberos trust model offers a simplified deployment experience, when compared to the key trust model.\ +With cloud Kerberos trust, there's no need to deploy certificated to the users or to the domain controllers, which is ideal for those environments without a PKI. + +Giving the simplicity offered by this model, cloud Kerberos trust is the recommended deployment model when compared to the key trust model. It is also the preferred deployment model if you do not need to support certificate authentication scenarios. + +### Related to cloud Kerberos trust + +- [Deployment type](#deployment-type) +- [Hybrid Azure AD join](#hybrid-azure-ad-join) +- [Hybrid deployment](#hybrid-deployment) +- [Cloud Kerberos trust](#cloud-kerberos-trust) +- [Key trust](#key-trust) +- [On-premises deployment](#on-premises-deployment) +- [Trust type](#trust-type) + +### More information about cloud Kerberos trust + +[Cloud Kerberos trust deployment](hello-hybrid-cloud-kerberos-trust.md) + ## Deployment type Windows Hello for Business has three deployment models to accommodate the needs of different organizations. The three deployment models include: From 87d1b3268cd96cb9581c63fb7b70a2ba284da4a6 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 9 Dec 2022 16:59:27 -0500 Subject: [PATCH 089/234] Updating reviewer in VAMT docs --- .../volume-activation/activate-forest-by-proxy-vamt.md | 1 + windows/deployment/volume-activation/activate-forest-vamt.md | 1 + ...ctivate-using-active-directory-based-activation-client.md | 4 +++- .../activate-using-key-management-service-vamt.md | 5 ++++- .../volume-activation/activate-windows-10-clients-vamt.md | 3 ++- .../active-directory-based-activation-overview.md | 1 + .../deployment/volume-activation/add-manage-products-vamt.md | 1 + .../volume-activation/add-remove-computers-vamt.md | 1 + .../volume-activation/add-remove-product-key-vamt.md | 1 + ...information-sent-to-microsoft-during-activation-client.md | 3 ++- .../volume-activation/configure-client-computers-vamt.md | 1 + .../deployment/volume-activation/import-export-vamt-data.md | 1 + .../deployment/volume-activation/install-configure-vamt.md | 1 + .../volume-activation/install-kms-client-key-vamt.md | 1 + .../deployment/volume-activation/install-product-key-vamt.md | 1 + windows/deployment/volume-activation/install-vamt.md | 2 ++ windows/deployment/volume-activation/introduction-vamt.md | 1 + windows/deployment/volume-activation/kms-activation-vamt.md | 1 + .../deployment/volume-activation/local-reactivation-vamt.md | 1 + .../deployment/volume-activation/manage-activations-vamt.md | 1 + .../deployment/volume-activation/manage-product-keys-vamt.md | 1 + windows/deployment/volume-activation/manage-vamt-data.md | 1 + .../volume-activation/monitor-activation-client.md | 3 ++- .../deployment/volume-activation/online-activation-vamt.md | 1 + .../volume-activation/plan-for-volume-activation-client.md | 3 ++- .../deployment/volume-activation/proxy-activation-vamt.md | 1 + windows/deployment/volume-activation/remove-products-vamt.md | 1 + .../volume-activation/scenario-kms-activation-vamt.md | 1 + .../volume-activation/scenario-online-activation-vamt.md | 1 + .../volume-activation/scenario-proxy-activation-vamt.md | 1 + .../volume-activation/update-product-status-vamt.md | 1 + .../use-the-volume-activation-management-tool-client.md | 3 ++- .../volume-activation/use-vamt-in-windows-powershell.md | 1 + windows/deployment/volume-activation/vamt-known-issues.md | 1 + windows/deployment/volume-activation/vamt-requirements.md | 1 + windows/deployment/volume-activation/vamt-step-by-step.md | 1 + .../volume-activation/volume-activation-management-tool.md | 2 ++ .../volume-activation/volume-activation-windows-10.md | 3 ++- 38 files changed, 51 insertions(+), 8 deletions(-) diff --git a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md index b5ccb893f4..b00e515b54 100644 --- a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md @@ -2,6 +2,7 @@ title: Activate by Proxy an Active Directory Forest (Windows 10) description: Learn how to use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/activate-forest-vamt.md b/windows/deployment/volume-activation/activate-forest-vamt.md index 70940f40ec..dc8833d2f8 100644 --- a/windows/deployment/volume-activation/activate-forest-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-vamt.md @@ -2,6 +2,7 @@ title: Activate an Active Directory Forest Online (Windows 10) description: Use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest online. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index 3892da1105..73f32edf78 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -1,6 +1,8 @@ --- title: Activate using Active Directory-based activation description: Learn how active directory-based activation is implemented as a role service that relies on AD DS to store activation objects. +ms.reviewer: + - nganguly manager: aaroncz author: frankroj ms.author: frankroj @@ -14,7 +16,7 @@ ms.collection: highpri # Activate using Active Directory-based activation -*Applies to:* +**Applies to:** - Windows - Windows Server diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index e136dd82b5..0e54567f4c 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -1,5 +1,8 @@ --- title: Activate using Key Management Service (Windows 10) +description: Learn how to use Key Management Service (KMS) to activate Windows. +ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj description: How to activate using Key Management Service in Windows 10. @@ -14,7 +17,7 @@ ms.technology: itpro-fundamentals # Activate using Key Management Service -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index 9be66de526..3166add837 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -2,6 +2,7 @@ title: Activate clients running Windows 10 (Windows 10) description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client @@ -14,7 +15,7 @@ ms.technology: itpro-fundamentals # Activate clients running Windows 10 -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md index 0fb8970234..48855f3afa 100644 --- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md +++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md @@ -2,6 +2,7 @@ title: Active Directory-Based Activation Overview (Windows 10) description: Enable your enterprise to activate its computers through a connection to their domain using Active Directory-Based Activation (ADBA). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/add-manage-products-vamt.md b/windows/deployment/volume-activation/add-manage-products-vamt.md index 5f9bfce03d..53a1f70b1b 100644 --- a/windows/deployment/volume-activation/add-manage-products-vamt.md +++ b/windows/deployment/volume-activation/add-manage-products-vamt.md @@ -2,6 +2,7 @@ title: Add and Manage Products (Windows 10) description: Add client computers into the Volume Activation Management Tool (VAMT). After you add the computers, you can manage the products that are installed on your network. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 95bad2b880..55297e1791 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -2,6 +2,7 @@ title: Add and Remove Computers (Windows 10) description: The Discover products function on the Volume Activation Management Tool (VAMT) allows you to search the Active Directory domain or a general LDAP query. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/add-remove-product-key-vamt.md b/windows/deployment/volume-activation/add-remove-product-key-vamt.md index 0e37c178fc..5fa51a1c12 100644 --- a/windows/deployment/volume-activation/add-remove-product-key-vamt.md +++ b/windows/deployment/volume-activation/add-remove-product-key-vamt.md @@ -2,6 +2,7 @@ title: Add and Remove a Product Key (Windows 10) description: Add a product key to the Volume Activation Management Tool (VAMT) database. Also, learn how to remove the key from the database. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md index bb61a1db81..0aa4fe2fb3 100644 --- a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md @@ -2,6 +2,7 @@ title: Appendix Information sent to Microsoft during activation (Windows 10) description: Learn about the information sent to Microsoft during activation. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj author: frankroj @@ -14,7 +15,7 @@ ms.topic: article # Appendix: Information sent to Microsoft during activation -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 382a9b53d3..189f8488ed 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -2,6 +2,7 @@ title: Configure Client Computers (Windows 10) description: Learn how to configure client computers to enable the Volume Activation Management Tool (VAMT) to function correctly. ms.reviewer: + - nganguly manager: aaroncz author: frankroj ms.author: frankroj diff --git a/windows/deployment/volume-activation/import-export-vamt-data.md b/windows/deployment/volume-activation/import-export-vamt-data.md index 7a5aaa426b..63e839c6dd 100644 --- a/windows/deployment/volume-activation/import-export-vamt-data.md +++ b/windows/deployment/volume-activation/import-export-vamt-data.md @@ -2,6 +2,7 @@ title: Import and export VAMT data description: Learn how to use the VAMT to import product-activation data from a file into SQL Server. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/install-configure-vamt.md b/windows/deployment/volume-activation/install-configure-vamt.md index b468f34546..833bc9a283 100644 --- a/windows/deployment/volume-activation/install-configure-vamt.md +++ b/windows/deployment/volume-activation/install-configure-vamt.md @@ -2,6 +2,7 @@ title: Install and Configure VAMT (Windows 10) description: Learn how to install and configure the Volume Activation Management Tool (VAMT), and learn where to find information about the process. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/install-kms-client-key-vamt.md b/windows/deployment/volume-activation/install-kms-client-key-vamt.md index eb28f3ff3a..ed311b84f5 100644 --- a/windows/deployment/volume-activation/install-kms-client-key-vamt.md +++ b/windows/deployment/volume-activation/install-kms-client-key-vamt.md @@ -2,6 +2,7 @@ title: Install a KMS Client Key (Windows 10) description: Learn to use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/install-product-key-vamt.md b/windows/deployment/volume-activation/install-product-key-vamt.md index 350971254b..00ea59707d 100644 --- a/windows/deployment/volume-activation/install-product-key-vamt.md +++ b/windows/deployment/volume-activation/install-product-key-vamt.md @@ -2,6 +2,7 @@ title: Install a Product Key (Windows 10) description: Learn to use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 8cb4d09f92..1ea051c4fe 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -1,6 +1,8 @@ --- title: Install VAMT (Windows 10) description: Learn how to install Volume Activation Management Tool (VAMT) as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. +ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index 292a9965b1..1d5ba5f37c 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -2,6 +2,7 @@ title: Introduction to VAMT (Windows 10) description: VAMT enables administrators to automate and centrally manage the Windows, Microsoft Office, and select other Microsoft products volume and retail activation process. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/kms-activation-vamt.md b/windows/deployment/volume-activation/kms-activation-vamt.md index 6cb46bb913..348a87ba6b 100644 --- a/windows/deployment/volume-activation/kms-activation-vamt.md +++ b/windows/deployment/volume-activation/kms-activation-vamt.md @@ -2,6 +2,7 @@ title: Perform KMS Activation (Windows 10) description: The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/local-reactivation-vamt.md b/windows/deployment/volume-activation/local-reactivation-vamt.md index e761c3c2f5..e189dd781a 100644 --- a/windows/deployment/volume-activation/local-reactivation-vamt.md +++ b/windows/deployment/volume-activation/local-reactivation-vamt.md @@ -2,6 +2,7 @@ title: Perform Local Reactivation (Windows 10) description: An initially activated a computer using scenarios like MAK, retail, or CSLVK (KMS host), can be reactivated with Volume Activation Management Tool (VAMT). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/manage-activations-vamt.md b/windows/deployment/volume-activation/manage-activations-vamt.md index 80263f739c..17dfa9af6d 100644 --- a/windows/deployment/volume-activation/manage-activations-vamt.md +++ b/windows/deployment/volume-activation/manage-activations-vamt.md @@ -2,6 +2,7 @@ title: Manage Activations (Windows 10) description: Learn how to manage activations and how to activate a client computer by using various activation methods. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/manage-product-keys-vamt.md b/windows/deployment/volume-activation/manage-product-keys-vamt.md index 423133a3b4..2b9594e4f6 100644 --- a/windows/deployment/volume-activation/manage-product-keys-vamt.md +++ b/windows/deployment/volume-activation/manage-product-keys-vamt.md @@ -2,6 +2,7 @@ title: Manage Product Keys (Windows 10) description: In this article, learn how to add and remove a product key from the Volume Activation Management Tool (VAMT). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/manage-vamt-data.md b/windows/deployment/volume-activation/manage-vamt-data.md index 5d61f42b3b..d2499a44f3 100644 --- a/windows/deployment/volume-activation/manage-vamt-data.md +++ b/windows/deployment/volume-activation/manage-vamt-data.md @@ -2,6 +2,7 @@ title: Manage VAMT Data (Windows 10) description: Learn how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md index d811b9bb87..7205e81894 100644 --- a/windows/deployment/volume-activation/monitor-activation-client.md +++ b/windows/deployment/volume-activation/monitor-activation-client.md @@ -1,6 +1,7 @@ --- title: Monitor activation (Windows 10) ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj description: Understand the most common methods to monitor the success of the activation process for a computer running Windows. @@ -14,7 +15,7 @@ ms.date: 11/07/2022 # Monitor activation -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 diff --git a/windows/deployment/volume-activation/online-activation-vamt.md b/windows/deployment/volume-activation/online-activation-vamt.md index 4e3c76dae1..f1dcda98ce 100644 --- a/windows/deployment/volume-activation/online-activation-vamt.md +++ b/windows/deployment/volume-activation/online-activation-vamt.md @@ -2,6 +2,7 @@ title: Perform Online Activation (Windows 10) description: Learn how to use the Volume Activation Management Tool (VAMT) to enable client products to be activated online. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 43a1c717d5..97cdedeb4f 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -2,6 +2,7 @@ title: Plan for volume activation (Windows 10) description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client @@ -14,7 +15,7 @@ ms.date: 11/07/2022 # Plan for volume activation -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 diff --git a/windows/deployment/volume-activation/proxy-activation-vamt.md b/windows/deployment/volume-activation/proxy-activation-vamt.md index 65f7e79d8d..2410bc8ba2 100644 --- a/windows/deployment/volume-activation/proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/proxy-activation-vamt.md @@ -2,6 +2,7 @@ title: Perform Proxy Activation (Windows 10) description: Perform proxy activation by using the Volume Activation Management Tool (VAMT) to activate client computers that don't have Internet access. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/remove-products-vamt.md b/windows/deployment/volume-activation/remove-products-vamt.md index 231f5081c2..b8118e73e2 100644 --- a/windows/deployment/volume-activation/remove-products-vamt.md +++ b/windows/deployment/volume-activation/remove-products-vamt.md @@ -2,6 +2,7 @@ title: Remove Products (Windows 10) description: Learn how you must delete products from the product list view so you can remove products from the Volume Activation Management Tool (VAMT). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md index 2985a6bc04..85a3fe5222 100644 --- a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md @@ -2,6 +2,7 @@ title: Scenario 3 KMS Client Activation (Windows 10) description: Learn how to use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 68ca97def3..c234aa5c7d 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -2,6 +2,7 @@ title: Scenario 1 Online Activation (Windows 10) description: Achieve network access by deploying the Volume Activation Management Tool (VAMT) in a Core Network environment. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index ccb63b5311..223ef377b2 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -2,6 +2,7 @@ title: Scenario 2 Proxy Activation (Windows 10) description: Use the Volume Activation Management Tool (VAMT) to activate products that are installed on workgroup computers in an isolated lab environment. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/update-product-status-vamt.md b/windows/deployment/volume-activation/update-product-status-vamt.md index eb5553920d..be82deed6b 100644 --- a/windows/deployment/volume-activation/update-product-status-vamt.md +++ b/windows/deployment/volume-activation/update-product-status-vamt.md @@ -2,6 +2,7 @@ title: Update Product Status (Windows 10) description: Learn how to use the Update license status function to add the products that are installed on the computers. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index b733a5046e..a381b30b76 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -2,6 +2,7 @@ title: Use the Volume Activation Management Tool (Windows 10) description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to track and monitor several types of product keys. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client @@ -14,7 +15,7 @@ ms.technology: itpro-fundamentals # Use the Volume Activation Management Tool -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md index 71e97c1a03..e965f4be1c 100644 --- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md +++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md @@ -2,6 +2,7 @@ title: Use VAMT in Windows PowerShell (Windows 10) description: Learn how to use Volume Activation Management Tool (VAMT) PowerShell cmdlets to perform the same functions as the Vamt.exe command-line tool. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 0507f060c7..4c29fd57a4 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -2,6 +2,7 @@ title: VAMT known issues (Windows 10) description: Find out the current known issues with the Volume Activation Management Tool (VAMT), versions 3.0. and 3.1. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md index a304218987..47e54481c4 100644 --- a/windows/deployment/volume-activation/vamt-requirements.md +++ b/windows/deployment/volume-activation/vamt-requirements.md @@ -2,6 +2,7 @@ title: VAMT Requirements (Windows 10) description: In this article, learn about the product key and system requierements for Volume Activation Management Tool (VAMT). ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/vamt-step-by-step.md b/windows/deployment/volume-activation/vamt-step-by-step.md index 880a8cf474..2378579069 100644 --- a/windows/deployment/volume-activation/vamt-step-by-step.md +++ b/windows/deployment/volume-activation/vamt-step-by-step.md @@ -2,6 +2,7 @@ title: VAMT Step-by-Step Scenarios (Windows 10) description: Learn step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index 9771f187cd..d767dbeb7b 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -1,6 +1,8 @@ --- title: VAMT technical reference description: The Volume Activation Management Tool (VAMT) enables network administrators to automate and centrally manage volume activation and retail activation. +ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client diff --git a/windows/deployment/volume-activation/volume-activation-windows-10.md b/windows/deployment/volume-activation/volume-activation-windows-10.md index 3cc524e10f..3bc4621e7a 100644 --- a/windows/deployment/volume-activation/volume-activation-windows-10.md +++ b/windows/deployment/volume-activation/volume-activation-windows-10.md @@ -2,6 +2,7 @@ title: Volume Activation for Windows 10 description: Learn how to use volume activation to deploy & activate Windows 10. Includes details for orgs that have used volume activation for earlier versions of Windows. ms.reviewer: + - nganguly manager: aaroncz ms.author: frankroj ms.prod: windows-client @@ -14,7 +15,7 @@ ms.technology: itpro-fundamentals # Volume Activation for Windows 10 -*Applies to:* +**Applies to:** - Windows 10 - Windows 8.1 From 0ebb6cdefb67e2eeb9a3ddc90e60de1937c1daeb Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Fri, 9 Dec 2022 17:14:06 -0500 Subject: [PATCH 090/234] Updating reviewer in VAMT docs 2 --- .../activate-using-key-management-service-vamt.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 0e54567f4c..c9d04453fb 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -5,7 +5,6 @@ ms.reviewer: - nganguly manager: aaroncz ms.author: frankroj -description: How to activate using Key Management Service in Windows 10. ms.prod: windows-client author: frankroj ms.localizationpriority: medium From 33df09e23ef3072982c26897ca907c202fa580ec Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Fri, 9 Dec 2022 14:21:19 -0800 Subject: [PATCH 091/234] Update windows-autopatch-wqu-overview.md --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index b834b4c886..2e1935639e 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -76,7 +76,7 @@ If Windows Autopatch detects a [significant issue with a release](../operate/win If we pause the release, a policy will be deployed which prevents devices from updating while the issue is investigated. Once the issue is resolved, the release will be resumed. -You can pause or resume a Windows quality update from the Release management tab in the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +You can pause or resume a Windows quality update from the **Release management** tab in the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). ## Incidents and outages From f45f3082a84807015c31f10ef82140f3681ca4bf Mon Sep 17 00:00:00 2001 From: mounicabattula <95552440+mounicabattula@users.noreply.github.com> Date: Fri, 9 Dec 2022 14:28:31 -0800 Subject: [PATCH 092/234] Update windows-autopatch-wqu-overview.md Added changes for OOB --- .../operate/windows-autopatch-wqu-overview.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index 2e1935639e..6854aa174f 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -70,6 +70,12 @@ Windows Autopatch provides the option to opt out of service-driven expedited qua > [!NOTE] > Windows Autopatch doesn't allow customers to request expedited releases. +## Out of Band release + +Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. Customers can view the deployed OOB quality updates on the **Release Management** blade on the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**. + +To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring, the OOB updates will also be paused. + ## Pausing and resuming a release If Windows Autopatch detects a [significant issue with a release](../operate/windows-autopatch-wqu-signals.md), we may decide to pause that release. From 16de507861983d6dbbe460f3a91dc7a82a8378bf Mon Sep 17 00:00:00 2001 From: mounicabattula <95552440+mounicabattula@users.noreply.github.com> Date: Fri, 9 Dec 2022 14:30:39 -0800 Subject: [PATCH 093/234] Adding Section for OOB Adding section for OOB --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index 6854aa174f..d63d67b12a 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -74,7 +74,7 @@ Windows Autopatch provides the option to opt out of service-driven expedited qua Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. Customers can view the deployed OOB quality updates on the **Release Management** blade on the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**. -To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring, the OOB updates will also be paused. +To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring , the OOB updates will also be paused. ## Pausing and resuming a release From eaa9a2321afbd02729743d1f552e98247441a06b Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Fri, 9 Dec 2022 14:36:55 -0800 Subject: [PATCH 094/234] Create windows-autopatch-wqu-overview.md Reviewed OOB --- .../operate/windows-autopatch-wqu-overview.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index d63d67b12a..f2968ce393 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -60,7 +60,7 @@ When running an expedited release, the regular goal of 95% of devices in 21 days ### Opt out of expedited releases -Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, customers can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release settings** tab, turn off the **Expedited Quality Updates** setting. +Windows Autopatch provides the option to opt out of service-driven expedited quality updates. To opt out of service-driven expedited quality updates, you can go to the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)** > **Tenant administration** > **Windows Autopatch** > **Release management** blade. In the **Release management** blade, under the **Release settings** tab, turn off the **Expedited Quality Updates** setting. | Release type | Group | Deferral | Deadline | Grace period | | ----- | ----- | ----- | ----- | ----- | @@ -70,11 +70,17 @@ Windows Autopatch provides the option to opt out of service-driven expedited qua > [!NOTE] > Windows Autopatch doesn't allow customers to request expedited releases. -## Out of Band release +## Out of Band releases -Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. Customers can view the deployed OOB quality updates on the **Release Management** blade on the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**. +Windows Autopatch schedules and deploys required Out of Band (OOB) updates released outside of the normal schedule. You can view the deployed OOB quality updates in the **Release Management** blade in the **[Microsoft Endpoint Manager portal](https://go.microsoft.com/fwlink/?linkid=2109431)**. -To view deployed OOB quality updates, customers can go to the Endpoint Manager admin center > Tenant administration > Windows Autopatch > Release management pane. Under the Release Announcements tab, customers can view the knowledge base (KB) articles corresponding to the deployed OOB quality updates. In case of a normal quality update release, KBs for the specific release will be available to the customers to view in the Release Announcements tab. Note that the announcements will be removed from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a ring , the OOB updates will also be paused. +**To view deployed OOB quality updates:** + +1. Go to [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management**. +2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and normal Windows quality updates. + +> [!Note] +> Announcements will be **removed** from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a deployment ring, the OOB updates will also be paused. ## Pausing and resuming a release From d41e645589f28fa9113f1279cf95164c2dde48c5 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Fri, 9 Dec 2022 14:39:01 -0800 Subject: [PATCH 095/234] Update windows-autopatch-wqu-overview.md --- .../windows-autopatch/operate/windows-autopatch-wqu-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md index f2968ce393..0479ead7f6 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-overview.md @@ -77,7 +77,7 @@ Windows Autopatch schedules and deploys required Out of Band (OOB) updates relea **To view deployed OOB quality updates:** 1. Go to [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) > **Tenant administration** > **Windows Autopatch** > **Release management**. -2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and normal Windows quality updates. +2. Under the **Release Announcements** tab, you can view the knowledge base (KB) articles corresponding to deployed OOB and regular Windows quality updates. > [!Note] > Announcements will be **removed** from the Release announcements tab when the next quality update is released. Further, if quality updates are paused for a deployment ring, the OOB updates will also be paused. From 2ffa9a76ae92d40fc1e657032f3d68e57fb95a16 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 9 Dec 2022 18:49:22 -0500 Subject: [PATCH 096/234] Minor update --- windows/client-management/mdm/policy-csp-clouddesktop.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-clouddesktop.md b/windows/client-management/mdm/policy-csp-clouddesktop.md index b150214dd9..f8bcc48c1b 100644 --- a/windows/client-management/mdm/policy-csp-clouddesktop.md +++ b/windows/client-management/mdm/policy-csp-clouddesktop.md @@ -42,7 +42,7 @@ This policy allows the user to configure the boot to cloud mode. Boot to Cloud m This policy supports the below options: 1. Not Configured: Machine will not trigger the Cloud PC connection automatically. -2. Enable Boot to Cloud Desktop: User will see that configured Cloud PC Provider application gets launched automatically once the sign-in operation finishes they seamlessly gets connected to a Cloud PC that is provisioned. +2. Enable Boot to Cloud Desktop: The user will see that configured Cloud PC Provider application launches automatically. Once the sign-in operation finishes, the user is seamlessly connected to a provisioned Cloud PC. From 23dbfb36576fce268942e87f6c1a0d4e2215a442 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 10 Dec 2022 09:21:01 -0500 Subject: [PATCH 097/234] updates --- .../hello-for-business/hello-how-it-works-technology.md | 9 +++++---- .../hello-for-business/hello-identity-verification.md | 2 +- windows/security/includes/hello-trust-cloud-kerberos.md | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index fedf93f60e..7bec9c2543 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -105,17 +105,16 @@ In Windows 10 and Windows 11, cloud experience host is an application used while ## Cloud Kerberos trust -The cloud Kerberos trust model offers a simplified deployment experience, when compared to the key trust model.\ -With cloud Kerberos trust, there's no need to deploy certificated to the users or to the domain controllers, which is ideal for those environments without a PKI. +The cloud Kerberos trust model offers a simplified deployment experience, when compared to the other trust types.\ +With cloud Kerberos trust, there's no need to deploy certificates to the users or to the domain controllers, which is ideal for environments without an existing PKI. -Giving the simplicity offered by this model, cloud Kerberos trust is the recommended deployment model when compared to the key trust model. It is also the preferred deployment model if you do not need to support certificate authentication scenarios. +Giving the simplicity offered by this model, cloud Kerberos trust is the recommended model when compared to the key trust model. It is also the preferred deployment model if you do not need to support certificate authentication scenarios. ### Related to cloud Kerberos trust - [Deployment type](#deployment-type) - [Hybrid Azure AD join](#hybrid-azure-ad-join) - [Hybrid deployment](#hybrid-deployment) -- [Cloud Kerberos trust](#cloud-kerberos-trust) - [Key trust](#key-trust) - [On-premises deployment](#on-premises-deployment) - [Trust type](#trust-type) @@ -245,6 +244,7 @@ The key trust model uses the user's Windows Hello for Business identity to authe ### Related to key trust +- [Cloud Kerberos trust](#cloud-kerberos-trust) - [Certificate trust](#certificate-trust) - [Deployment type](#deployment-type) - [Hybrid Azure AD join](#hybrid-azure-ad-join) @@ -336,6 +336,7 @@ The trust type determines how a user authenticates to the Active Directory to ac ### Related to trust type +- [Cloud Kerberos trust](#cloud-kerberos-trust) - [Certificate trust](#certificate-trust) - [Hybrid deployment](#hybrid-deployment) - [Key trust](#key-trust) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 37b6335a50..51c809a805 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -6,7 +6,7 @@ ms.collection: - highpri ms.date: 2/15/2022 appliesto: -- ✅ Windows 10 and later + - ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/includes/hello-trust-cloud-kerberos.md b/windows/security/includes/hello-trust-cloud-kerberos.md index 76dfb6c4a1..5ddac53ba9 100644 --- a/windows/security/includes/hello-trust-cloud-kerberos.md +++ b/windows/security/includes/hello-trust-cloud-kerberos.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication.") \ No newline at end of file +[cloud Kerberos trust :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#cloud-kerberos-trust "This trust type uses security keys to authenticate the users to Active Directory. It's not required to issue any certificates, making it the recommended choice for environments that do not need certificate authentication") \ No newline at end of file From edeeb6a85f8063d0612f364e17fc04176cd229af Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Sat, 10 Dec 2022 09:40:19 -0500 Subject: [PATCH 098/234] updates --- .../hello-for-business/hello-cert-trust-policy-settings.md | 2 +- .../hello-for-business/hello-feature-pin-reset.md | 2 +- .../hello-for-business/hello-manage-in-organization.md | 2 +- .../identity-protection/hello-for-business/hello-overview.md | 2 +- .../hello-for-business/hello-why-pin-is-better-than-password.md | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 6c48751b0b..1ee4530318 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -5,7 +5,7 @@ ms.collection: - highpri ms.date: 08/20/2018 appliesto: -- ✅ Windows 10 and later +- ✅ Windows 10 and later - ✅ Windows Server 2016 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 561975c7a9..e1aa2e7acb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -5,7 +5,7 @@ ms.collection: - highpri ms.date: 07/29/2022 appliesto: -- ✅ Windows 10 and later +- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index b32ad3664c..a548960eab 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -5,7 +5,7 @@ ms.collection: - highpri ms.date: 2/15/2022 appliesto: -- ✅ Windows 10 and later +- ✅ Windows 10 and later ms.topic: article --- diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 49a2cc77ce..50d6d7f166 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -5,7 +5,7 @@ ms.collection: - highpri ms.topic: conceptual appliesto: - - ✅ Windows 10 and later + - ✅ Windows 10 and later ms.date: 12/31/2017 --- # Windows Hello for Business Overview diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index ca25fdee58..89fe8f84ce 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -5,7 +5,7 @@ ms.collection: - highpri ms.date: 10/23/2017 appliesto: -- ✅ Windows 10 and later +- ✅ Windows 10 and later ms.topic: article --- # Why a PIN is better than an online password From 77ee9bf0e3eeb4354da9d73cd3518d7b0f0a4365 Mon Sep 17 00:00:00 2001 From: rlianmsft <112862018+rlianmsft@users.noreply.github.com> Date: Mon, 12 Dec 2022 08:24:13 +0000 Subject: [PATCH 099/234] Update windows-autopatch-wqu-reports-overview.md @tiaraquan - Corrected a couple of typos. --- .../operate/windows-autopatch-wqu-reports-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md index 739953b809..2e61770efe 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -98,9 +98,9 @@ Within each 24-hour reporting period, devices that are ineligible are updated wi | Low Connectivity | Devices must have a steady internet connection, and access to [Windows update endpoints](../prepare/windows-autopatch-configure-network.md). | | Out of Disk Space | Devices must have more than one GB (GigaBytes) of free storage space. | | Not Deployed | Windows Autopatch doesn't update devices that haven't yet been deployed. | -| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | | Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | -| Intune Sync Older Than 5 Days | Devices must have checked with Intune within the last five days. | +| Intune Sync Older Than 5 Days | Devices must have checked in with Intune within the last five days. | ## Data export From e9b2e73e2174d9856355d07bcf9bbe16aa9ea988 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 07:52:55 -0500 Subject: [PATCH 100/234] updates --- .../hello-key-trust-validate-ad-prereq.md | 42 +++--- .../hello-key-trust-validate-pki.md | 123 +++++++++--------- 2 files changed, 76 insertions(+), 89 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 57080612a2..6afbd7f245 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -1,39 +1,31 @@ --- title: Key registration for on-premises deployment of Windows Hello for Business -description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model. -ms.date: 08/19/2018 +description: Validate Active Directory prerequisites when deploying Windows Hello for Business in a key trust model. +ms.date: 12/12/2022 appliesto: - ✅ Windows 10 and later -ms.topic: article +ms.topic: tutorial --- -# Validate Active Directory prerequisites - Key Trust +# Validate Active Directory prerequisites [!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)] -Key trust deployments need an adequate number of 2016 or later domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. +Key trust deployments need an adequate number of domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md) and the [Planning an adequate number of Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. -> [!NOTE] ->There was an issue with key trust authentication on Windows Server 2019. If you are planning to use Windows Server 2019 domain controllers refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044) to fix this issue. +The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. -The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. +## Create the Windows Hello for Business Users security group -## Create the Windows Hello for Business Users Security Global Group +The *Windows Hello for Business Users* group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. -The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. +Sign-in to a domain controller or to a management workstation with a *Domain Administrator* equivalent credentials. -Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. +1. Open **Active Directory Users and Computers** +1. Select **View > Advanced Features** +1. Expand the domain node from the navigation pane +1. Right-click the **Users** container. Select **New > Group** +1. Type *Windows Hello for Business Users* in the **Group Name** +1. Select **OK** -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. Validate Active Directory prerequisites (*You are here*) -2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) +> [!div class="nextstepaction"] +> [Next: validate and configure PKI >](hello-key-trust-validate-pki.md) \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index c3a9226714..fdcab4e3f3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -1,99 +1,99 @@ --- -title: Validate Public Key Infrastructure - key trust model (Windows Hello for Business) -description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a key trust model. -ms.date: 08/19/2018 +title: Validate and configure the Public Key Infrastructure +description: Validate the Public Key Infrastructure when deploying Windows Hello for Business in a key trust model. +ms.date: 12/12/2022 appliesto: - ✅ Windows 10 and later -ms.topic: article +ms.topic: tutorial --- -# Validate and Configure Public Key Infrastructure - Key Trust +# Validate and configure the Public Key Infrastructure [!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)] -Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller. +Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller. ## Deploy an enterprise certificate authority -This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on a Windows enterprise public key infrastructure running the Active Directory Certificate Services role from Windows Server 2012 or later. +This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on an enterprise PKI running the Windows Server *Active Directory Certificate Services* role. -### Lab-based public key infrastructure +### Lab-based PKI -The following instructions may be used to deploy simple public key infrastructure that is suitable for a lab environment. +The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**. -Sign in using **Enterprise Admin** equivalent credentials on Windows Server 2012 or later server where you want the certificate authority installed. +Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certificate authority installed. >[!NOTE] >Never install a certificate authority on a domain controller in a production environment. -1. Open an elevated Windows PowerShell prompt. -2. Use the following command to install the Active Directory Certificate Services role. +1. Open an elevated Windows PowerShell prompt +1. Use the following command to install the Active Directory Certificate Services role. ```PowerShell Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools ``` - -3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration. +3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration ```PowerShell Install-AdcsCertificationAuthority - ``` + ``` -## Configure a Production Public Key Infrastructure +## Configure a PKI -If you do have an existing public key infrastructure, please review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) from Microsoft TechNet to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your public key infrastructure using the information from your design session. +If you do have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session. ### Configure Domain Controller Certificates -Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain—namely the enterprise certificate authority. +Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certificate authority. -Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the KDC Authentication object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template. -By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template. +By default, the Active Directory certificate authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template. -Sign in to a certificate authority or management workstations with **Domain Admin** equivalent credentials. +Sign in to a certificate authority or management workstations with *Domain Admintistrator* equivalent credentials. -1. Open the **Certificate Authority** management console. - -2. Right-click **Certificate Templates** and click **Manage**. - -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. - -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. - -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console +1. Right-click **Certificate Templates > Manage** +1. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and select **Duplicate Template** +1. On the **Compatibility** tab: + - Clear the **Show resulting changes** check box + - Select **Windows Server 2008 R2** from the **Certification Authority** list + - Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list +1. On the **General** tab + - Type *Domain Controller Authentication (Kerberos)* in Template display name + - Adjust the validity and renewal period to meet your enterprise's needs > [!NOTE] - > If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +1. On the **Subject Name** tab: + - Select the **Build from this Active Directory information** button if it is not already selected + - Select **None** from the **Subject name format** list + - Select **DNS name** from the **Include this information in alternate subject** list + - Clear all other items +1. On the **Cryptography** tab: + - select **Key Storage Provider** from the **Provider Category** list + - Select **RSA** from the **Algorithm name** list + - Type *2048* in the **Minimum key size** text box + - Select **SHA256** from the **Request hash** list +1. Select **OK** +1. Close the console -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +### Supersede the existing domain controller certificate -8. Close the console. +The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension. -### Superseding the existing Domain Controller certificate +The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\ +The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template. -Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template from domain controllers—the domain controller certificate template. Later releases provided a new certificate template—the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the KDC Authentication extension. +Sign in to a certificate authority or management workstations with *Enterprise Administrator* equivalent credentials -The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. - -Sign in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. - -1. Open the **Certificate Authority** management console. - -2. Right-click **Certificate Templates** and click **Manage**. - -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. - -4. Click the **Superseded Templates** tab. Click **Add**. - -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. - -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. - -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. - -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. - -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console +1. Right-click **Certificate Templates > Manage** +1. In the **Certificate Template Console**, right-click the *Domain Controller Authentication (Kerberos)* (or the name of the certificate template you created in the previous section) template in the details pane and select **Properties** +1. Select the **Superseded Templates** tab. Select **Add** +1. From the **Add Superseded Template** dialog, select the *Domain Controller* certificate template and select **OK > Add** +1. From the **Add Superseded Template** dialog, select the *Domain Controller Authentication* certificate template and select **OK** +1. From the **Add Superseded Template dialog**, select the *Kerberos Authentication* certificate template and select **OK** +1. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab +1. Select **OK** and close the **Certificate Templates** console The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -236,10 +236,5 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. -## Follow the Windows Hello for Business on premises key trust deployment guide - -1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) -2. Validate and Configure Public Key Infrastructure (*You are here*) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) +> [!div class="nextstepaction"] +> [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md) \ No newline at end of file From 1872d46ff62e6830e86a5883e0ee99324ae30b36 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 07:58:27 -0500 Subject: [PATCH 101/234] updates --- windows/security/includes/hello-hybrid-keycert-trust-aad.md | 2 +- windows/security/includes/hello-on-premises-key-trust.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/includes/hello-hybrid-keycert-trust-aad.md b/windows/security/includes/hello-hybrid-keycert-trust-aad.md index abdacf0e93..4c073f0897 100644 --- a/windows/security/includes/hello-hybrid-keycert-trust-aad.md +++ b/windows/security/includes/hello-hybrid-keycert-trust-aad.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-hybrid](hello-deployment-hybrid.md)] -- **Trust type:** - **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] +- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)], [!INCLUDE [hello-trust-certificate](hello-trust-certificate.md)] - **Join type:** [!INCLUDE [hello-join-aadj](hello-join-aad.md)] --- \ No newline at end of file diff --git a/windows/security/includes/hello-on-premises-key-trust.md b/windows/security/includes/hello-on-premises-key-trust.md index 2a31c533c2..f290b0d975 100644 --- a/windows/security/includes/hello-on-premises-key-trust.md +++ b/windows/security/includes/hello-on-premises-key-trust.md @@ -7,6 +7,6 @@ ms.topic: include [!INCLUDE [hello-intro](hello-intro.md)] - **Deployment type:** [!INCLUDE [hello-deployment-onpremises](hello-deployment-onpremises.md)] -- **Trust type:** [key trust](../identity-protection/hello-for-business/hello-how-it-works-technology.md#key-trust) +- **Trust type:** [!INCLUDE [hello-trust-key](hello-trust-key.md)] - **Join type:** [!INCLUDE [hello-join-domain](hello-join-domain.md)] --- \ No newline at end of file From 066958a306d791357e5406e8a5ae6e1774ef028b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 08:55:48 -0500 Subject: [PATCH 102/234] updates --- .../hello-key-trust-validate-ad-prereq.md | 2 +- .../hello-key-trust-validate-pki.md | 84 +++++++++---------- 2 files changed, 42 insertions(+), 44 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 6afbd7f245..1d66a37be8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -12,7 +12,7 @@ ms.topic: tutorial Key trust deployments need an adequate number of domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md) and the [Planning an adequate number of Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. -The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. +The key registration process for the on-premises deployment of Windows Hello for Business requires the Windows Server 2016 Active Directory or later schema. ## Create the Windows Hello for Business Users security group diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index fdcab4e3f3..d199c27b42 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -12,7 +12,7 @@ ms.topic: tutorial Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller. -## Deploy an enterprise certificate authority +## Deploy an enterprise certification authority This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on an enterprise PKI running the Windows Server *Active Directory Certificate Services* role. @@ -20,17 +20,17 @@ This guide assumes most enterprises have an existing public key infrastructure. The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**. -Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certificate authority installed. +Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority installed. >[!NOTE] ->Never install a certificate authority on a domain controller in a production environment. +>Never install a certification authority on a domain controller in a production environment. 1. Open an elevated Windows PowerShell prompt 1. Use the following command to install the Active Directory Certificate Services role. ```PowerShell Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools ``` -3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration +3. Use the following command to configure the certification authority using a basic certification authority configuration ```PowerShell Install-AdcsCertificationAuthority ``` @@ -41,39 +41,37 @@ If you do have an existing PKI, review [Certification Authority Guidance](/previ ### Configure Domain Controller Certificates -Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certificate authority. +Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certification authority. -Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template. +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certification authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template. -By default, the Active Directory certificate authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template. +By default, the Active Directory certification authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template. -Sign in to a certificate authority or management workstations with *Domain Admintistrator* equivalent credentials. +Sign in to a certification authority or management workstations with *Domain Admintistrator* equivalent credentials. -1. Open the **Certificate Authority** management console +1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates > Manage** 1. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and select **Duplicate Template** 1. On the **Compatibility** tab: - - Clear the **Show resulting changes** check box - - Select **Windows Server 2008 R2** from the **Certification Authority** list - - Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list + - Clear the **Show resulting changes** check box + - Select **Windows Server 2016** from the **Certification Authority** list + - Select **Windows 10 / Windows Server 2016** from the **Certification Recipient** list 1. On the **General** tab - - Type *Domain Controller Authentication (Kerberos)* in Template display name - - Adjust the validity and renewal period to meet your enterprise's needs - - > [!NOTE] - > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. - + - Type *Domain Controller Authentication (Kerberos)* in Template display name + - Adjust the validity and renewal period to meet your enterprise's needs + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. 1. On the **Subject Name** tab: - - Select the **Build from this Active Directory information** button if it is not already selected - - Select **None** from the **Subject name format** list - - Select **DNS name** from the **Include this information in alternate subject** list - - Clear all other items + - Select the **Build from this Active Directory information** button if it is not already selected + - Select **None** from the **Subject name format** list + - Select **DNS name** from the **Include this information in alternate subject** list + - Clear all other items 1. On the **Cryptography** tab: - - select **Key Storage Provider** from the **Provider Category** list - - Select **RSA** from the **Algorithm name** list - - Type *2048* in the **Minimum key size** text box - - Select **SHA256** from the **Request hash** list -1. Select **OK** + - select **Key Storage Provider** from the **Provider Category** list + - Select **RSA** from the **Algorithm name** list + - Type *2048* in the **Minimum key size** text box + - Select **SHA256** from the **Request hash** list +1. Select **OK** 1. Close the console ### Supersede the existing domain controller certificate @@ -83,27 +81,27 @@ The domain controllers may have an existing domain controller certificate. The A The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\ The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template. -Sign in to a certificate authority or management workstations with *Enterprise Administrator* equivalent credentials +Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials -1. Open the **Certificate Authority** management console +1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates > Manage** 1. In the **Certificate Template Console**, right-click the *Domain Controller Authentication (Kerberos)* (or the name of the certificate template you created in the previous section) template in the details pane and select **Properties** 1. Select the **Superseded Templates** tab. Select **Add** 1. From the **Add Superseded Template** dialog, select the *Domain Controller* certificate template and select **OK > Add** 1. From the **Add Superseded Template** dialog, select the *Domain Controller Authentication* certificate template and select **OK** -1. From the **Add Superseded Template dialog**, select the *Kerberos Authentication* certificate template and select **OK** +1. From the **Add Superseded Template** dialog, select the *Kerberos Authentication* certificate template and select **OK** 1. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab 1. Select **OK** and close the **Certificate Templates** console -The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. +The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until the certificate template is published to one or more certificate authorities. ### Configure an Internal Web Server Certificate template Windows clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. -Sign in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. +Sign in to a certification authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certification Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. @@ -128,13 +126,13 @@ Sign in to a certificate authority or management workstations with _Domain Admin ### Unpublish Superseded Certificate Templates -The certificate authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. +The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. -Sign in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. +Sign in to the certification authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certification Authority** management console. 2. Expand the parent node from the navigation pane. @@ -144,13 +142,13 @@ Sign in to the certificate authority or management workstation with _Enterprise 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. -### Publish Certificate Templates to the Certificate Authority +### Publish Certificate Templates to the certification authority -The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. +The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. -Sign in to the certificate authority or management workstations with **Enterprise Admin** equivalent credentials. +Sign in to the certification authority or management workstations with **Enterprise Admin** equivalent credentials. -1. Open the **Certificate Authority** management console. +1. Open the **Certification Authority** management console. 2. Expand the parent node from the navigation pane. @@ -158,11 +156,11 @@ Sign in to the certificate authority or management workstations with **Enterpris 4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certification authority. 6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. - \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. + \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the certification authority console and select **Delete**. Click **Yes** to confirm the operation. 7. Close the console. @@ -234,7 +232,7 @@ Windows triggers automatic certificate enrollment for the computer during boot, Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq -autoenroll -q` from an elevated command prompt. -Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. +Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certification authority and the allow auto enrollment permissions. > [!div class="nextstepaction"] > [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md) \ No newline at end of file From 97652a4827466b317db61e9a48865e2e48e9909d Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 09:19:27 -0500 Subject: [PATCH 103/234] updates --- .../hello-key-trust-validate-pki.md | 187 +++++++++--------- 1 file changed, 89 insertions(+), 98 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index d199c27b42..e8935dcb1b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -10,7 +10,7 @@ ms.topic: tutorial [!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)] -Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller. +Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller. ## Deploy an enterprise certification authority @@ -37,9 +37,9 @@ Sign in using *Enterprise Administrator* equivalent credentials on a Windows Ser ## Configure a PKI -If you do have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session. +If you have an existing PKI, review [Certification Authority Guidance](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831574(v=ws.11)) to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831348(v=ws.11)) for instructions on how to configure your PKI using the information from your design session. -### Configure Domain Controller Certificates +### Configure domain controller certificates Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certification authority. @@ -74,14 +74,14 @@ Sign in to a certification authority or management workstations with *Domain Adm 1. Select **OK** 1. Close the console -### Supersede the existing domain controller certificate +### Supersede existing domain controller certificates -The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension. +The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension. The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\ The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template. -Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials +Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials. 1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates > Manage** @@ -95,42 +95,46 @@ Sign in to a certification authority or management workstations with *Enterprise The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until the certificate template is published to one or more certificate authorities. -### Configure an Internal Web Server Certificate template +### Configure an internal web server certificate template -Windows clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. +Windows clients use the https protocol when communicating with Active Directory Federation Services (AD FS). To meet this need, you must issue a server authentication certificate to all the nodes in the AD FS farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running theAD FS can request the certificate. -Sign in to a certification authority or management workstations with _Domain Admin_ equivalent credentials. +Sign in to a certification authority or management workstations with *Domain Administrator* equivalent credentials. -1. Open the **Certification Authority** management console. - -2. Right-click **Certificate Templates** and click **Manage**. - -3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. - -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. - -5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. - - > [!NOTE] - > If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. - -6. On the **Request Handling** tab, select **Allow private key to be exported**. - -7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. - -8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. - -9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. - -10. Close the console. +1. Open the **Certification Authority** management console +1. Right-click **Certificate Templates** and select **Manage** +1. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and select **Duplicate Template** +1. On the **Compatibility** tab: + - Clear the **Show resulting changes** check box + - Select **Windows Server 2016** from the **Certification Authority** list + - Select **Windows 10 / Windows Server 2016** from the **Certification Recipient** list +1. On the **General** tab: + - Type *Internal Web Server* in **Template display name** + - Adjust the validity and renewal period to meet your enterprise's needs + > [!NOTE] + > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. +1. On the **Request Handling** tab, select **Allow private key to be exported** +1. On the **Subject** tab, select the **Supply in the request** button if it is not already selected +1. On the **Security** tab: + - Select **Add** + - Type **Domain Computers** in the **Enter the object names to select** box + - Select **OK** + - Select the **Allow** check box next to the **Enroll** permission +1. On the **Cryptography** tab: + - Select **Key Storage Provider** from the **Provider Category** list + - Select **RSA** from the **Algorithm name** list + - Type *2048* in the **Minimum key size** text box + - Select **SHA256** from the **Request hash** list + - Select **OK** +1. Close the console ### Unpublish Superseded Certificate Templates -The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. +The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. -The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. +The newly created *domain controller authentication* certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. -Sign in to the certification authority or management workstation with _Enterprise Admin_ equivalent credentials. +Sign in to the certification authority or management workstation with *Enterprise Administrator* equivalent credentials. 1. Open the **Certification Authority** management console. @@ -138,101 +142,88 @@ Sign in to the certification authority or management workstation with _Enterpris 3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. 5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Publish Certificate Templates to the certification authority -The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. +The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. Sign in to the certification authority or management workstations with **Enterprise Admin** equivalent credentials. -1. Open the **Certification Authority** management console. +1. Open the **Certification Authority** management console +1. Expand the parent node from the navigation pane +1. Select **Certificate Templates** in the navigation pane +1. Right-click the **Certificate Templates** node. Select **New > Certificate Template** to issue +1. In the **Enable Certificates Templates** window, select the *Domain Controller Authentication (Kerberos)*, and *Internal Web Server* templates you created in the previous steps. Select **OK** to publish the selected certificate templates to the certification authority +1. If you published the *Domain Controller Authentication (Kerberos)* certificate template, then unpublish the certificate templates you included in the superseded templates list + - To unpublish a certificate template, right-click the certificate template you want to unpublish and select **Delete**. Select **Yes** to confirm the operation +1. Close the console -2. Expand the parent node from the navigation pane. +### Configure automatic certificate enrollment for the domain controllers -3. Click **Certificate Templates** in the navigation pane. +Domain controllers automatically request a certificate from the *Domain controller certificate* template. However, domain controllers are unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment, linking the Group Policy object to the *Domain Controllers* OU. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. - -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certification authority. - -6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. - - \* To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the certification authority console and select **Delete**. Click **Yes** to confirm the operation. - -7. Close the console. - -### Configure Domain Controllers for Automatic Certificate Enrollment - -Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. - -1. Start the **Group Policy Management Console** (gpmc.msc) - -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. - -3. Right-click **Group Policy object** and select **New** - -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. - -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. - -6. In the navigation pane, expand **Policies** under **Computer Configuration**. - -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. - -8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. - -9. Select **Enabled** from the **Configuration Model** list. - -10. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box. - -11. Select the **Update certificates that use certificate templates** check box. - -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Open the **Group Policy Management Console** (gpmc.msc) +1. Expand the domain and select the **Group Policy Object** node in the navigation pane +1. Right-click **Group Policy object** and select **New** +1. Type *Domain Controller Auto Certificate Enrollment* in the name box and select **OK** +1. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and select **Edit** +1. In the navigation pane, expand **Policies** under **Computer Configuration** +1. Expand **Windows Settings > Security Settings > Public Key Policies** +1. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties** +1. Select **Enabled** from the **Configuration Model** list +1. Select the **Renew expired certificates, update pending certificates, and remove revoked certificates** check box +1. Select the **Update certificates that use certificate templates** check box +1. Select **OK** +1. Close the **Group Policy Management Editor** ### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object -Sign in to domain controller or management workstations with _Domain Admin_ equivalent credentials. +Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc). +1. Start the **Group Policy Management Console** (gpmc.msc) +1. In the navigation pane, expand the domain and expand the node with the Active Directory domain name. Right-click the **Domain Controllers** organizational unit and select **Link an existing GPO…** +1. In the **Select GPO** dialog box, select *Domain Controller Auto Certificate Enrollment* or the name of the domain controller certificate enrollment Group Policy object you previously created +1. Select **OK** -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…**. +## Validate the configuration -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. -### Validating your work +You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred. -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. +### Use the Event Logs -You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred. +Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials. -#### Use the Event Logs +1. Using the Event Viewer, navigate to the **Application and Services > Microsoft > Windows > CertificateServices-Lifecycles-System** event log +1. Look for an event indicating a new certificate enrollment (autoenrollment): + - The details of the event include the certificate template on which the certificate was issued + - The name of the certificate template used to issue the certificate should match the certificate template name included in the event + - The certificate thumbprint and EKUs for the certificate are also included in the event + - The EKU needed for proper Windows Hello for Business authentication is Kerberos Authentication, in addition to other EKUs provide by the certificate template -Windows Server 2012 and later include Certificate Lifecycle events to determine the lifecycles of certificates for both users and computers. Using the Event Viewer, navigate to the CertificateServices-Lifecycles-System event log under Application and Services/Microsoft/Windows. +Certificates superseded by your new domain controller certificate generate an archive event in the event log. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. -Look for an event indicating a new certificate enrollment (autoenrollment). The details of the event include the certificate template on which the certificate was issued. The name of the certificate template used to issue the certificate should match the certificate template name included in the event. The certificate thumbprint and EKUs for the certificate are also included in the event. The EKU needed for proper Windows Hello for Business authentication is Kerberos Authentication, in addition to other EKUs provide by the certificate template. +### Certificate Manager -Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. +You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager. -#### Certificate Manager +### Certutil.exe -You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager. +You can use `certutil.exe` command to view enrolled certificates in the local computer. Certutil shows enrolled and archived certificates for the local computer. From an elevated command prompt, run `certutil.exe -q -store my` to view locally enrolled certificates. -#### Certutil.exe +To view detailed information about each certificate in the store, use `certutil.exe -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates. -You can use **certutil.exe** to view enrolled certificates in the local computer. Certutil shows enrolled and archived certificates for the local computer. From an elevated command prompt, run `certutil -q -store my` to view locally enrolled certificates. +### Troubleshooting -To view detailed information about each certificate in the store, use `certutil -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates. +Windows triggers automatic certificate enrollment for the computer during boot, and when Group Policy updates. You can refresh Group Policy from an elevated command prompt using `gpupdate.exe /force`. -#### Troubleshooting +Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq.exe -autoenroll -q` from an elevated command prompt. -Windows triggers automatic certificate enrollment for the computer during boot, and when Group Policy updates. You can refresh Group Policy from an elevated command prompt using `gpupdate /force`. - -Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq -autoenroll -q` from an elevated command prompt. - -Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certification authority and the allow auto enrollment permissions. +Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certification authority and the allow auto enrollment permissions. > [!div class="nextstepaction"] > [Next: prepare and deploy AD FS >](hello-key-trust-adfs.md) \ No newline at end of file From 80e5c86d7414d579faa6de135362f52cdb244f13 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 09:41:30 -0500 Subject: [PATCH 104/234] updates --- .../hello-key-trust-validate-pki.md | 57 +++++++++---------- .../security/includes/hello-join-domain.md | 2 +- .../security/includes/hello-join-hybrid.md | 2 +- 3 files changed, 28 insertions(+), 33 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index e8935dcb1b..ae2142daec 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -10,7 +10,7 @@ ms.topic: tutorial [!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)] -Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients, to ensure they are not communicating with a rogue domain controller. +Windows Hello for Business must have a Public Key Infrastructure (PKI) when using the *key trust* or *certificate trust* models. The domain controllers must have a certificate, which serves as a root of trust for clients. The certificate ensures that clients don't communicate with rogue domain controllers. ## Deploy an enterprise certification authority @@ -20,7 +20,7 @@ This guide assumes most enterprises have an existing public key infrastructure. The following instructions may be used to deploy simple public key infrastructure that is suitable **for a lab environment**. -Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority installed. +Sign in using *Enterprise Administrator* equivalent credentials on a Windows Server where you want the certification authority (CA) installed. >[!NOTE] >Never install a certification authority on a domain controller in a production environment. @@ -30,7 +30,7 @@ Sign in using *Enterprise Administrator* equivalent credentials on a Windows Ser ```PowerShell Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools ``` -3. Use the following command to configure the certification authority using a basic certification authority configuration +3. Use the following command to configure the CA using a basic certification authority configuration ```PowerShell Install-AdcsCertificationAuthority ``` @@ -41,13 +41,13 @@ If you have an existing PKI, review [Certification Authority Guidance](/previous ### Configure domain controller certificates -Clients must to trust the domain controllers, and the way to do this is to ensure each domain controller has a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the enterprise certification authority. +Clients must trust the domain controllers, and to it each domain controller must have a *Kerberos Authentication* certificate. Installing a certificate on the domain controllers enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. The certificates provide clients a root of trust external to the domain, namely the *enterprise certification authority*. -Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certification authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template. +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise CA is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates don't include the *KDC Authentication* object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the *Kerberos Authentication* certificate template. -By default, the Active Directory certification authority provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template. +By default, the Active Directory CA provides and publishes the *Kerberos Authentication* certificate template. The cryptography configuration included in the template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the *Kerberos Authentication* certificate template as a *baseline* to create an updated domain controller certificate template. -Sign in to a certification authority or management workstations with *Domain Admintistrator* equivalent credentials. +Sign in to a CA or management workstations with *Domain Admintistrator* equivalent credentials. 1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates > Manage** @@ -62,7 +62,7 @@ Sign in to a certification authority or management workstations with *Domain Adm > [!NOTE] > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. 1. On the **Subject Name** tab: - - Select the **Build from this Active Directory information** button if it is not already selected + - Select the **Build from this Active Directory information** button if it isn't already selected - Select **None** from the **Subject name format** list - Select **DNS name** from the **Include this information in alternate subject** list - Clear all other items @@ -79,9 +79,9 @@ Sign in to a certification authority or management workstations with *Domain Adm The domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers called *domain controller certificate*. Later releases of Windows Server provided a new certificate template called *domain controller authentication certificate*. These certificate templates were provided prior to the update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the *KDC Authentication* extension. The *Kerberos Authentication* certificate template is the most current certificate template designated for domain controllers, and should be the one you deploy to all your domain controllers.\ -The *autoenrollment* feature allows to easily replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template. +The *autoenrollment* feature allows to replace the domain controller certificates. Use the following configuration to replace older domain controller certificates with new ones, using the *Kerberos Authentication* certificate template. -Sign in to a certification authority or management workstations with *Enterprise Administrator* equivalent credentials. +Sign in to a CA or management workstations with *Enterprise Administrator* equivalent credentials. 1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates > Manage** @@ -93,13 +93,13 @@ Sign in to a certification authority or management workstations with *Enterprise 1. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab 1. Select **OK** and close the **Certificate Templates** console -The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until the certificate template is published to one or more certificate authorities. +The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates isn't active until the certificate template is published to one or more certificate authorities. ### Configure an internal web server certificate template Windows clients use the https protocol when communicating with Active Directory Federation Services (AD FS). To meet this need, you must issue a server authentication certificate to all the nodes in the AD FS farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running theAD FS can request the certificate. -Sign in to a certification authority or management workstations with *Domain Administrator* equivalent credentials. +Sign in to a CA or management workstations with *Domain Administrator* equivalent credentials. 1. Open the **Certification Authority** management console 1. Right-click **Certificate Templates** and select **Manage** @@ -114,7 +114,7 @@ Sign in to a certification authority or management workstations with *Domain Adm > [!NOTE] > If you use different template names, you'll need to remember and substitute these names in different portions of the lab. 1. On the **Request Handling** tab, select **Allow private key to be exported** -1. On the **Subject** tab, select the **Supply in the request** button if it is not already selected +1. On the **Subject** tab, select the **Supply in the request** button if it isn't already selected 1. On the **Security** tab: - Select **Add** - Type **Domain Computers** in the **Enter the object names to select** box @@ -130,27 +130,22 @@ Sign in to a certification authority or management workstations with *Domain Adm ### Unpublish Superseded Certificate Templates -The certification authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certification authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. +The certification authority only issues certificates based on published certificate templates. For security, it's a good practice to unpublish certificate templates that the CA isn't configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. The newly created *domain controller authentication* certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. -Sign in to the certification authority or management workstation with *Enterprise Administrator* equivalent credentials. +Sign in to the CA or management workstation with *Enterprise Administrator* equivalent credentials. -1. Open the **Certification Authority** management console. +1. Open the **Certification Authority** management console +1. Expand the parent node from the navigation pane > **Certificate Templates** +1. Right-click the *Domain Controller* certificate template and select **Delete**. Select **Yes** on the **Disable certificate templates** window +1. Repeat step 3 for the *Domain Controller Authentication* and *Kerberos Authentication* certificate templates -2. Expand the parent node from the navigation pane. +### Publish certificate templates to the CA -3. Click **Certificate Templates** in the navigation pane. +A certification authority can only issue certificates for certificate templates that are published to it. If you have more than one CA, and you want more CAs to issue certificates based on the certificate template, then you must publish the certificate template to them. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. - -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. - -### Publish Certificate Templates to the certification authority - -The certification authority may only issue certificates for certificate templates that are published to that certification authority. If you have more than one certification authority and you want that certification authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. - -Sign in to the certification authority or management workstations with **Enterprise Admin** equivalent credentials. +Sign in to the CA or management workstations with **Enterprise Admin** equivalent credentials. 1. Open the **Certification Authority** management console 1. Expand the parent node from the navigation pane @@ -163,7 +158,7 @@ Sign in to the certification authority or management workstations with **Enterpr ### Configure automatic certificate enrollment for the domain controllers -Domain controllers automatically request a certificate from the *Domain controller certificate* template. However, domain controllers are unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment, linking the Group Policy object to the *Domain Controllers* OU. +Domain controllers automatically request a certificate from the *Domain controller certificate* template. However, domain controllers are unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates, create and configure a Group Policy Object (GPO) for automatic certificate enrollment, linking the Group Policy object to the *Domain Controllers* Organizational Unit (OU). 1. Open the **Group Policy Management Console** (gpmc.msc) 1. Expand the domain and select the **Group Policy Object** node in the navigation pane @@ -179,7 +174,7 @@ Domain controllers automatically request a certificate from the *Domain controll 1. Select **OK** 1. Close the **Group Policy Management Editor** -### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object +### Deploy the domain controller auto certificate enrollment GPO Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials. @@ -194,7 +189,7 @@ Windows Hello for Business is a distributed system, which on the surface appears You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred. -### Use the Event Logs +### Use the event logs Sign in to domain controller or management workstations with *Domain Administrator* equivalent credentials. @@ -209,7 +204,7 @@ Certificates superseded by your new domain controller certificate generate an ar ### Certificate Manager -You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager. +You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates don't appear in Certificate Manager. ### Certutil.exe diff --git a/windows/security/includes/hello-join-domain.md b/windows/security/includes/hello-join-domain.md index 56f0037453..0385e2089a 100644 --- a/windows/security/includes/hello-join-domain.md +++ b/windows/security/includes/hello-join-domain.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[Domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices") \ No newline at end of file +[domain join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md "Devices that are domain joined do not have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices") \ No newline at end of file diff --git a/windows/security/includes/hello-join-hybrid.md b/windows/security/includes/hello-join-hybrid.md index 93777d9174..3d3e75c6b6 100644 --- a/windows/security/includes/hello-join-hybrid.md +++ b/windows/security/includes/hello-join-hybrid.md @@ -5,4 +5,4 @@ ms.date: 12/08/2022 ms.topic: include --- -[Hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources") \ No newline at end of file +[hybrid Azure AD join :::image type="icon" source="../images/icons/information.svg" border="false":::](../identity-protection/hello-for-business/hello-how-it-works-technology.md#hybrid-azure-ad-join "Devices that are hybrid Azure AD joined don't have any dependencies on Azure AD. Only local users accounts and Active Directory users can sign in to these devices. Active Directory users that are synchronized to Azure AD will have single-sign on to both Active Directory and Azure AD-protected resources") \ No newline at end of file From 69f4f5ad630ef58ac086dad67a54eb41ec1f27b9 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 10:04:31 -0500 Subject: [PATCH 105/234] updates --- .../hello-key-trust-adfs.md | 104 ++++++------------ .../hello-key-trust-validate-ad-prereq.md | 1 + .../hello-key-trust-validate-pki.md | 1 + 3 files changed, 35 insertions(+), 71 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 4a8dc18965..c5fc582c76 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -1,69 +1,59 @@ --- -title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business) -description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business using key trust. +title: Prepare and deploy Active Directory Federation Services +description: Learn how to configure Active Directory Federation Services to support the Windows Hello for Business key trust model. ms.date: 08/19/2018 appliesto: - ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.topic: article --- -# Prepare and Deploy Windows Server 2016 Active Directory Federation Services with Key Trust +# Prepare and deploy Active Directory Federation Services [!INCLUDE [hello-on-premises-key-trust](../../includes/hello-on-premises-key-trust.md)] -Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-premises key trust deployment uses Active Directory Federation Services roles for key registration and device registration. +Windows Hello for Business works exclusively with the Active Directory Federation Service (AD FS) role included with Windows Server. The on-premises key trust deployment model uses AD FS for *key registration* and *device registration*. -The following guidance describes deploying a new instance of Active Directory Federation Services 2016 using the Windows Information Database as the configuration database, which is ideal for environments with no more than 30 federation servers and no more than 100 relying party trusts. +The following guidance describes the deployment of a new instance of AD FS using the Windows Information Database (WID) as the configuration database.\ +WID is ideal for environments with no more than **30 federation servers** and no more than **100 relying party trusts**. If your environment exceeds either of these factors, or needs to provide *SAML artifact resolution*, *token replay detection*, or needs AD FS to operate as a federated provider role, then the deployment requires the use of SQL as a configuration database.\ +To deploy AD FS using SQL as its configuration database, review the [Deploying a Federation Server Farm](/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) checklist. -If your environment exceeds either of these factors or needs to provide SAML artifact resolution, token replay detection, or needs Active Directory Federation Services to operate in a federated provider role, then your deployment needs to use a SQL for your configuration database. To deploy the Active Directory Federation Services using SQL as its configuration database, please review the [Deploying a Federation Server Farm](/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) checklist. +A new AD FS farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with external networking peripherals, or with using the Network Load Balancing Role included in Windows Server. -If your environment has an existing instance of Active Directory Federation Services, then you’ll need to upgrade all nodes in the farm to Windows Server 2016 along with the Windows Server 2016 update. If your environment uses Windows Internal Database (WID) for the configuration database, please read [Upgrading to AD FS in Windows Server 2016 using a WID database](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) to upgrade your environment. If your environment uses SQL for the configuration database, please read [Upgrading to AD FS in Windows Server 2016 with SQL Server](/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016-sql) to upgrade your environment. +Prepare the AD FS deployment by installing and **updating** two Windows Servers. Ensure the update listed below is applied to each server before continuing. -Ensure you apply the Windows Server 2016 Update to all nodes in the farm after you have successfully completed the upgrade. +## Enroll for a TLS server authentication certificate -A new Active Directory Federation Services farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with external networking peripherals, or with using the Network Load Balancing Role included in Windows Server. +Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity. -Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. +The AD FS role needs a *server authentication* certificate for the federation services, and you can use a certificate issued by your enterprise (internal) CA. The server authentication certificate should have the following names included in the certificate, if you are requesting an individual certificate for each node in the federation farm: + - **Subject Name**: the internal FQDN of the federation server + - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *.corp.contoso.com*) -## Update Windows Server 2016 +The federation service name is set when the AD FS role is configured. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server *adfs* and the federation service *sts*. In this example, the FQDN of the host is *adfs.corp.contoso.com* and the FQDN of the federation service is *sts.corp.contoso.com*. -Sign-in the federation server with _local admin_ equivalent credentials. -1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. -2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). +You can also issue one certificate for all hosts in the farm. If you chose this option, leave the subject name *blank*, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name. ->[!IMPORTANT] ->The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers. +When creating a wildcard certificate, mark the private key as exportable, so that the same certificate can be deployed across each federation server and web application proxy within the AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. -## Enroll for a TLS Server Authentication Certificate +Be sure to enroll or import the certificate into the AD FS server's computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate. -Key trust Windows Hello for Business on-premises deployments need a federation server for device registration and key registration. Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity. +### AD FS authentication certificate enrollment -The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm: -* Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) -* Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) +Sign-in the federation server with *domain administrator* equivalent credentials. -You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com. +1. Start the Local Computer **Certificate Manager** (certlm.msc) +1. Expand the **Personal** node in the navigation pane +1. Right-click **Personal**. Select **All Tasks > Request New Certificate** +1. Select **Next** on the **Before You Begin** page +1. Select **Next** on the **Select Certificate Enrollment Policy** page +1. On the **Request Certificates** page, select the **Internal Web Server** check box +1. Select the **More information is required to enroll for this certificate. Click here to configure settings** link + ![Example of Certificate Properties Subject Tab - This is what shows when you select the above link.](images/hello-internal-web-server-cert.png) +1. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the AD FS role and then select **Add** +1. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name that you will use for your federation services (*sts.corp.contoso.com*). The name you use here MUST match the name you use when configuring the AD FS server role. Select **Add** and **OK** when finished +1. Select **Enroll** -You can, however, issue one certificate for all hosts in the farm. If you chose this option, then leave the subject name blank, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name. - -When creating a wildcard certificate, it is recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. - -Be sure to enroll or import the certificate into the AD FS server’s computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate. - -### Internal Server Authentication Certificate Enrollment - -Sign-in the federation server with domain administrator equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. +A server authentication certificate should appear in the computer's personal certificate store. ## Deploy the Active Directory Federation Service Role @@ -131,11 +121,6 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ## Configure the Active Directory Federation Service Role ->[!IMPORTANT] ->Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. - -### Windows Server 2016, 2012 R2 or later Domain Controllers - Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008-r2-domain-controllers) section. Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. @@ -154,29 +139,6 @@ Sign-in the federation server with _Domain Admin_ equivalent credentials. These 11. On the **Pre-requisite Checks** page, click **Configure**. 12. When the process completes, click **Close**. -### Windows Server 2008 or 2008 R2 Domain Controllers - -Use the following procedures to configure AD FS when your environment uses **Windows Server 2008 or 2008 R2 Domain Controllers**. If you are not using Windows Server 2008 or 2008 R2 Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2012 or later Domain Controllers)](#windows-server-2012-or-later-domain-controllers) section. - -Sign-in the federation server with _Domain Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. -1. Start **Server Manager**. -2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) - -3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. -4. Click **Next** on the **Connect to Active Directory Domain Services** page. -5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as fs.corp.mstepdemo.net or fs.mstepdemo.net. -6. Select the federation service name from the **Federation Service Name** list. -7. Type the Federation Service Display Name in the text box. This is the name users see when signing in. Click **Next**. -8. On the **Specify Service Account** page, Select **Use an existing domain user account or group Managed Service Account** and click **Select**. - * In the **Select User or Service Account** dialog box, type the name of the previously created AD FS service account (example adfssvc) and click **OK**. Type the password for the AD FS service account and click **Next**. -9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. -10. On the **Review Options** page, click **Next**. -11. On the **Pre-requisite Checks** page, click **Configure**. -12. When the process completes, click **Close**. -13. Do not restart the AD FS server. You will do this later. - - ### Add the AD FS Service account to the KeyAdmins group The KeyAdmins global group provides the AD FS service with the permissions needed to perform key registration. diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 1d66a37be8..5a09bb7ef6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -4,6 +4,7 @@ description: Validate Active Directory prerequisites when deploying Windows Hell ms.date: 12/12/2022 appliesto: - ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.topic: tutorial --- # Validate Active Directory prerequisites diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index ae2142daec..ba923d7b2a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -4,6 +4,7 @@ description: Validate the Public Key Infrastructure when deploying Windows Hello ms.date: 12/12/2022 appliesto: - ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.topic: tutorial --- # Validate and configure the Public Key Infrastructure From 6cdfb1d2f284cfdca0078037b69d0566012bf4f8 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 12 Dec 2022 10:25:05 -0500 Subject: [PATCH 106/234] updates --- .../hello-key-trust-adfs.md | 6 +++--- .../images/hello-internal-web-server-cert.png | Bin 131616 -> 397629 bytes 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index c5fc582c76..86e1e8c728 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -19,7 +19,7 @@ To deploy AD FS using SQL as its configuration database, review the [Deploying a A new AD FS farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with external networking peripherals, or with using the Network Load Balancing Role included in Windows Server. -Prepare the AD FS deployment by installing and **updating** two Windows Servers. Ensure the update listed below is applied to each server before continuing. +Prepare the AD FS deployment by installing and **updating** two Windows Servers. ## Enroll for a TLS server authentication certificate @@ -27,7 +27,7 @@ Typically, a federation service is an edge facing role. However, the federation The AD FS role needs a *server authentication* certificate for the federation services, and you can use a certificate issued by your enterprise (internal) CA. The server authentication certificate should have the following names included in the certificate, if you are requesting an individual certificate for each node in the federation farm: - **Subject Name**: the internal FQDN of the federation server - - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *.corp.contoso.com*) + - **Subject Alternate Name**: the federation service name (e.g. *sts.corp.contoso.com*) or an appropriate wildcard entry (e.g. *\*.corp.contoso.com*) The federation service name is set when the AD FS role is configured. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server *adfs* and the federation service *sts*. In this example, the FQDN of the host is *adfs.corp.contoso.com* and the FQDN of the federation service is *sts.corp.contoso.com*. @@ -47,7 +47,7 @@ Sign-in the federation server with *domain administrator* equivalent credentials 1. Select **Next** on the **Before You Begin** page 1. Select **Next** on the **Select Certificate Enrollment Policy** page 1. On the **Request Certificates** page, select the **Internal Web Server** check box -1. Select the **More information is required to enroll for this certificate. Click here to configure settings** link +1. Select the **⚠️ More information is required to enroll for this certificate. Click here to configure settings** link ![Example of Certificate Properties Subject Tab - This is what shows when you select the above link.](images/hello-internal-web-server-cert.png) 1. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the AD FS role and then select **Add** 1. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name that you will use for your federation services (*sts.corp.contoso.com*). The name you use here MUST match the name you use when configuring the AD FS server role. Select **Add** and **OK** when finished diff --git a/windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png b/windows/security/identity-protection/hello-for-business/images/hello-internal-web-server-cert.png index cc78ba41cfccd7204a1ce5cc3c1a809af1182cb7..63697551ad556e9f92eb39a435b2377cd57b9ab4 100644 GIT binary patch literal 397629 zcmV)4K+3;~P)Lse3|zip4UEm zuhj*l2l+q(h3c;EwbnlOh{nBVukLCTkVqsFi4Tbc;lKZmaWN4dQ z6+qR$)a4@(7!0ufMTkKq<_-OO4M7QWzcnLtnoeyf)rEZF$a0!kq6l7x_i^{ zJ`Jto&BzPC4Ie1>5f9l0y|N{2TR%r_b3A!{8wJ@OTq?K8;;}h_bpG8dkw-q=n0DX4 zaqREUkvwJB5yChUNOMZ2W2a;7eRFR|ch|S!(+*>pYU^Wr)yok3r&&5XWpJcBl;hQo zZ*nJAM^oy)h566sa?>Mw1x)0Jv13Ddwr!vAU>k@HMU&r@p0WHvKHQF&ng$ozGbHMG z65ix1Weoktamty>GIwm*nldVnS}sx33mj~#r1lwCv&W<~x9Q@1fSCkt`-X_5TuA-# zKeKg{R$z5*x=d?JuE+cF9p{hPJk_<^|Mt{(7GbbQsSTP9KQE#Imje4gKL%il#o*bGo$MBl;jzRu&yh>1vzyVx3{U5g31NN z1fq;YT9%gIlF5QC4XE`E!Rwb!C0qUZeBN`4kP@NRiuHWPaylXB3;BT*#(G@dxXE;_6}47yEug&Mv@D=RsHLLR3a-`XY)S;8B=0Fti3lkr?+buIurhn) z6Xno88&9omDJ3LII<^VS6}1S@Pp1=VDLAjI zztCf5lv0G2L>(PXz8EPHPNx&r^BGmYL)U@KRb|2Cv+0Vuu2>#USe6BkkB`WCQQG=( zUu#7vD^8~e5CNsg_mmQH&LB$KZv{kzoU+m&^l{%P<&Dr>O2N7ogD zg`2yHHDN#z_2)GB(*`dk-Prem0^>r|6V0C;*jBkR~PIf`>v(^$;+Hbw1QmP)fn+bOJN$T*G*H`$qI? zDXv$DNc1YG&0{s#7nyL%qHCnB+1Ixs4^8JVYG*v9&~B5jye!B$2bmFhU}pJU<{XOa% zx+qf87u-OR@XSk~txS8_Gy?p#Sly}1SL$f*0&XYRqR(wq18&h4h}#tcg+EvNiyI$j zx#M@=2W-OUx%O=Q*$|lNvR(2N9EhNS0avzoueG93bpSyY#F95D|0=VZ@ChjsmSmu! z@{`T(ZuYmak05{v54w*wYg0%{0MJa*2-Y5f&pRn#2 z7cF679P6nH9G>zCl-?+iS5VHyW!eCfl#_!PT&w)53wBmoN-03C$e9d3R{k`(Xf0^= zOriv)wmISJC0QtY9T9kqquM|L=-*COBM7d)i3|vVTp6WQFc+jGAY;x6l`FU!uWVjW zVuJh$FwyjJzu^G~n*pFGAYBz`Y=CPI!pd&~yf&Fw9H3_|4w9MkIdmx#eZoaI5tPp8 zAW)e=3NVq58v#-Q1G}Vaq;p6Cd#Rx!Qe>Ep6#=l} zdd?lcMh2Vw5FsrY3-udPR=#YkEV{{5wU0$77=Ud2f{wph87U`ZN`UE5X5=MzvVg!J z>jN%jSYN>3H@yJBfzw*eQBj^HRpPZ&AN!=6YZ1tl4JHQjic%}GgO}{Qjw-i`f{=cz ztquT4OLn^{g?gqEgEsxF|N7(`3mgGfY6{Uma&HuLRB#ZLTNWnUM3Ybd zfBJP!2L-#+N9>PoDXa4i|7-(yp0*3cYq^i6D~rs}kS?}sR05uEq-86G-klT#8GT8SA~ewFLb(o$5P}V z`@$bnAS}Ms{=ItI!R_5kbX}9E-Y98{RPkbD1tEwCl}lT|2G1xkqv|s-<9s%tVr*9{ ztE*c3q8p<`3ef3-I{_(^15YF1)BN+d$@;Z<2}-}37u(iby%kIm#!0+EZe?*gh>TLajuU`+4XWq(ruYdDN& zZ4bk}H<{VJHU<1`o|%N!PZP!(`vC1n);U8!lhwz@vWTaw(~-m*uB=kt2zHwXX%7NZ z$2Vz5MO};cTh19NB?WAnhg>nxF7;#M+Rt#?@#tmkvkl_m#Lc2X}~W&C#TBtptUe^t-ZB`27HV0J?$p+&%T zXnjE&54xpK=H*(0ehynZQRqT`04N1uDh)^+is#BGC@}DyfdHs0Fc|>zWl0XaB0SIP zExxYnR3FxE?D}jRTNtNGfD}v|SVEAxGWs#uoCV|!c`o$jhX)XVwG_a;KpWp}YEMMK zl2NLFkckMVyy$z|(;Ng@7r9rlwY98B>OBg`_!r$MeN-!>))fqq755e=LSndVY-R|R zNg6i_dZpu@<4oc;E3-n=$>Jfdpf$LiK+rtvx;__BjplO{IqI`a=0FjP(fkf#Kz)fD zi5{}wlz8*uWm2zz{)cPL*oU0rbQzlhm5-co#}4ZhIuLUF73MUs5sHZ$t3=^QtJ zFZ1N{tD;_aZoGZ2B$r_uFC4$={c_2xciyHzt;*l)b+8Mv9HJGk6)}!0dR9&G-Zu?J#zo-uGHCM zJjlts^j%NcUF|u@&&|m1kUBoLMf;}8nB9dZ+U1eolM1@>EWbfKLp2B5_ zAnZ}^NcEbmr2vWCt4Kg_3SA$@rUGx~Jr;j+k8BKppo4j%R*ZS11lMu)U!?nj28xXy zLw+Rl9^~dVy$L@+6xGSxrgGk}f{t=jyI7y3gbelOg63hMbabf~SO5zIs3VXbKW7D0 zNI@1JWWjjdj+Syb>RKIejAPBiJ$Nx&&v6>^Mm{*$X#j@`dIWQ8WiaHJxEzfY9WCuq zxPloaCDGk3>elaeL>lV&RsDFn9dlO_Ixtm4k{v{r_rjPW=xmCf+2d(C9#nvm@*fUl+dRR}GkwKPze$d7Wf0Xo5ht^;y=@qu-? zc=*W=QP$-cx9UlzrGy)7@Z>K7x+y+XL>>;S^yME}VNEcik^WoHi0&fH<)A|q~ z@%Hq2ssZ0Ij6^8~Cfmx;z^gXL+W4szVFQL`Y(X}}Tpx3rJIwRbHeMplfNoM5eGnPW zL@4TwE}qi_!F-F%DL!F}9w1XFVIH**HxfdGLVp!+W6MvS*=O@doOc)!a>hVR1F0qS zfO&8S*`o%~24#XVxivEw0HZx)8&fIAkSc**(}zAM$S3W0qbBw>Z_B)m?RxPwSg|E!}LI3RgR}9UV z8~)BndoA4@r;(TD$xXBjeZmMp#yu4eZ8^}iW33;F;Var?=k>|(>IGtJ%(@B!&>s!h zR1^ zzlS~~y4=nqUYzz_nV&H|w zmNaAnkb58eCC%!f1UJB<>JjafJtiNK#L>${C{(cOGmEb|<(4+Gti_Me5(CH<-eJog zA-9304xSnyFt)(Ka05F86z#Leyr;~=Fh z03Gbub@EQId<_pFb<8C1?^+qlBH)R5rS|<1LEBoZ$FMXyYEeMQVqB)&IHEjl0A2&R z{KznK7bCazA2}a0MZl%PWY&&&*DA;S^Ri$`8KqWHzcKWP zcVVn7$G07v4gJSlP)dsjU27XFt;z#)1;v=wjlSsF*`|+i^K8%~vDic)WR;PG(`k|T zv}HvpD@+zh-&frl>=L3jqG=NIfzq_seWkA(__zj-1N6Ys7d!Q=4$oSb5*&ELrU2?1~2lPGl zvMSG--G=VBW{1&^P3icSdyWP9-;}R?Ofx!J>uK{#R4rD1-`4)yR;>CZZT!Q1wha$_ zacB{KBSF>}KwT@=dIr>kCwrVai+w5HSj3GM_l6=l##u@QmsLIF zlIt7RhRPKP>Ma-mqyG42i0jIv(QY^#JB=M2S{}fQYqp1ZFIHyo%3VLtxI30+HA~ki zpsYZk!II6xeypBHua)Y_%S|gd~p@eZ@1+OiMXbA{j^>;h+U;Q$y-dk0#cJcq5)*ySvD<9(S zDcb8ae`cE&p>Hg&%{%M5qHqm;QoyBnj8b{Oc?G+!1i&h1V2HQ1dNo^2>~&oQJhu%Q z$5X5_W0tndZ96I3z0tS<$PC^1(G8DcUh$B*L%eAF*vBq&-5q466Ip>;o0Hq7f_?A# z$}S^u3M7~w0Jw;fNGZAQtrpYN`<+{i)4nL}`?lefLZ7y9C&HgdAJ+PyKMxy_`358;FKK{0aZSI`juc?4k4;V~Wv^ zL%np#eG1mdouyIt?Q^7;t7oQmZ!i4@S0}U5m zjau*}2HlY+?p3j0Jz>wQ^p@0_OwU&F7npS;A1Qu#j!k#1&bZi7L#(TgC*wpHBRsqp z3*w1D?dgDHtf9^4h*>Iz(Bn6Qa?tS+8@8{5E}&$g(I&-?OP9L%tYp8$$>o4JFu zwXJz%Eoh7Uctmz2nmWOju4*8P9OrFdgsj2Its$Y4kkW!|b=pnlJDh86ZtHxhwx7ZL zQl!b-G5O-zumSTtiu~(d*r#jzki5+9cyUrOx0Wz`!_|v-K$yHgE5s8`c*ic7E{pm+ zUT{YwVH)s&n5iwDSjv#azj|*e*f0V;&R4y_ixo`D0UWV+a?Yp_Pb{f2dgrxc=e481 z9Z@c`TjmKW%K|7a%c7UuRF_d}w_JcV>vMVE09Jdpu4m_$jc?zWN#0@IJeg99i%MV< znyxNFLRwlIVw~E=Jk+$FS}WGF!n!tsbxjsq7>MrpK64iz(m`!&zY3A{Cs7h`jw^`6 zE$vEmMYy1hpx|iSOb9@`l2&SQj4h=e?22R6=(AhiTey|bQ^s$Ti_~;*2XrQrKLHG@ zUqIGMYjK17zG3G>#rb@eO$;;{a(xKyXm6l>KS>ynZ{*o!Nk)T(@etVwmx~RlX)aPd z;HAih#lwS+(ix(b^|c^~ETwh98MEbL+4!@(ZLtnSgR$<&rTA zOEMI1e_O0mb{=kZ>Hz~~Vi$DJL!EYESyk`!Or(2tda)MB^K`;XqF*IOuX?yDD4$af z^HCo%M#P1D9%z?~!Q)pOaYTf)ELfIB#-f&AOT7lD&L*s3#$o_SO(B6HH;j?*t~NzV z0v9s@DI-zA&zCd)#)9NCad>=PLnN;hu|W#HO2Kr{S0F zX6BA5N7JWQQqQN`-+!qzH%gAZ^V~WoNoM%=d7!V`VV-oOPjdvo3`}{^4IQ17Cb2EFwn&L&tQ_uTaF>r}FyN zv+Yotp@%zm<=#)8VJ6SMm~DF1_1I8#H}f4ZX?$^IcG|{NAt_DXl#HKVNJjbzZ6%!94>dW`m2lbMc^2!Lru^H3BIQSz95u}lWH z{ZN;EpKd`1%|j(V39bHRr%*z1=LME+9%|+5y_3=IVX=LX%|3M zuIi;u-B?Z3i`vyd1Mp_m>Ds5ilk)b&YkXZH7xd^Bks9w2ZNpjo#xt`IyAA4P~ z(O|lR;(%QQ+ZC+ODWSkB!;Skof z2v}&kJ?agMt=s>znYUy^$No|*TQZ@y-VC=v)i=u z>URvPsYT7h$2O0+d?_OYJQq-(Yehbtqa1dR<+!B-ZF3aj6s1P8w;y7N8&!j{ASf8`7b5>-n%FKM*4uid-{mK zvwXngrvf}J_{mRyia-3V_xL})`U-#XiSRE!Cj9FU3E&5yYS4ME61K$@N4JyJ(-rX- z!psi5()N4OD-?NC-7csvS?Dvebh5H%z|IS5bAuXDIk|Dsv`|x2Cfwvt?ET50=SW%* zl#6uj5XABVMvHym=q zHh>6BP*}9bHkDHJ&KC8E8Fp?3=O70He4)weEjAEm&6ik_;W(%Bhun5{yN2MPjveuB z;7=TT2LA1j9<$Fk8zf`CaYNhwFt@mS#uEcR(HtzM8q(Gf12yEsjh${;a~Krc`ebjT z)%ueX0ad{@XQ8#lW;-dz*DK5&fI5ODMw(;Alw^}3eD0Li@YQ6>kGUF6UT^h!dM%}Z zT@Bt^a@Drel!%Z|O9QEf@wl$%0DMKzT&SzHDqu=pw&eAZ0gLA;x5_7dFK8NOxdaSA z(Hp_-)T4PkN`ENFT@IQg2#BpW+LL*AukznPdXalPbqsF0kn`0&QCOOGvF(UOmejj zt6uq;yagnuiJ>71_c@&;001BWNklI* zE(sMPW0y`#8{@+z;C9)Rg$ytU#*P=pXMIp>#gdb5IE4FYRQGX^ttJ~l)3#0LMpNgS zwO}0REwRvfu7}$Mnvyuv5sF2W(eT%nC(up+is*wg(2nE-vH=wVS!(Z&VSMMW ze_0DSy~FbEC;0fOAU*yHzw_=5{@#xg{xg2UuO5Ma@v-7xeRz+*d}2J6PoVN+ENKze zC!nBcSO9IH#t^chGwxn?T#3{IsccM zab$~L$=^IC+JGIjZu||d|F00bZBVDQwvGDXrfyMy#=qhBi|J+-9DJbz*j_^DCuPv( z-=60S%iW*Oli)gK*UO#08I}|-%7ZM^8FyYKBjQ)1h!gf=GY zR_ffQwWHbw3OiLC+ZpseTbp(4hefBW03tc&tyNY(A0Jwv0Eq#(b>s5aQQO+8{Bb~c zVp2G$;O|FXHm@cF<_H=SPgm(2`qlx=Fm8wvPD=o?G{$DFDfDem)Mno7h8>5;1dw>y zfk-@fYg#)EU-6ydAY!_J( z^%qSwnQpRT8wLVQWt6fG{jB{_o4;>7#%my;U?{QNigtOAT=YW(yPwPf@lsZla@G(I z4CemGb@PDd_8kBPci%3IMCg}9785gh{XV=X0;zr3(K|0u^O#K}z?hUH&*g%hU>LC{TqvrkGW+1S5GKy@;uuE+oAOa=vGOY@RavkI|8~x;9Ce{^< z7OOTV^6})Jmca%va5qwEyl7+D^e=hYW=kd2pOsmsf~_~Gm~Ty%{F;H*;d1#Gt1P+h z43`6ThFI^Rn{)Os6E^-GsIQFGE(hxXZZsujvZig~usPwiR`w_BT0kf*PHD9`r4p{g zc`Up2z}UCL_ua$C;0{x&^9GPIjMon&4>=Vm)XNl zj9%u_F2;FX-J8GD$*bzVoN>wv%oE-CdgrB7k!^8r`3%qstnZN$;dkBufBS94-+ucg zeugjc@bm%Y>odN7%J{Y{NLcVbCG|F4ft0~Z!Z%L|Uw$H-=!Bo182{*}AMo}UEB@&5 zE&lnZ1%Lc?!e4w>J$NmsAQMoDq%1X_K%?t(=&!j=_t!9ee~k{daoH2bCst-_sm7Nbjic?&@DargbqRpL+pq z3!G;r?my4gnYYz4awjT0EziFOqw1zo-NgTX(lbHT-o%)}4LfB=OaDlIuZ4pyxP`)5 zU9-GH9!DUqjTZZTFV8jeXsmO;uCO+q>-r;UDE?CG*l5~RcCCUfG2L)^5mi3dDTj&< z(_t5j%XQVPlpp3C)Y>-m$+RgK+BnQV{m|IH_k6uJlo<=Wr5gtMolECX?NGf)&7OHFG3g9PGts{RqexVEWCKLxy!2R$zfhhU z2-fZ8o_wa9|DI z#iZbS3qugQqhA-Loa9F9vPyj{7dK_IF{<%N@;6{~o&@L*H=tAOM{N4hHXj5`jq=*~ zIQGBGeY||h`q~kTo=zFJ>SJl`(Q)DzNDaw6jbn4uCIq3DI{>OeCp*||{T(-&%o8)_ zZ|{l6X7hBln5YV%s>dOjLh5vazQB-t)HH<4E6YV$d0Bi6g*Pp?k0Sx;tAq3Mx9PQ7 zR_A*ZF_Z0DDk?Qy;uDN4Gx;nQ~_s2fgK%e!$4bXUk!22D9oR>LuM54b4 zowvF3I=sPQ?An+!{s8b8!@gldw*sn@$z29;0=VF`yur`jo$w#LeZucQe21Un8^)1d^@ss=!|K)BQ3UV6Jqe@s0duO>UEn*JM8faMj4Y$RELR21)x~(jMRE zG~GyP*T94CUR*@IWO}U;BC-_CvF{^214kTiiKCm^U}I`_qqHC3&?}nH?-VaaW7B%Ub1^NKDX&3z;dq^^08pk~=H$qAA!W&rFPo9#x)_jh}lvo?P6f82Vjd>F zr`4v5ZV_%A2W6&&kefY@`KY#0Ia%Esd=uq_R~JZd@LFmf;{n^LA@> z&RNipj|NPcybDn3z%WC3V8>?lEuEIk^Ui?7zF$KbkpdU`n5WMa!L5|^_^bccJaan` z%yJF;uH zanHkH==-6cSURd>xP3|_Uda{eC0N8eO+1VR=(J0GDjP2ie2DGqZ4>GLfj`O*2Yhub zm9>bpbt>PE#EbW#TzFMoj?L@VfFJ>4nhQn~r*qoc} z1lujXM=9yWIzt~_vDpID2lG_4&4SLuj)sQWWD&-XTws)&4r1j85tvC|X`ptkK~s$e zk;)Yp9pnm*ws(gy?>to<$gx$eY(Gk!GD>}NK#{bcQzE!`YMcvH@0N-NlG#Rus}Tj! z5c(T!To76e)J-P>-p2Nv8*f89j5OkyPk&K%r2ziNi;|>x)7R=v%bOWvGnYBI>pGso zSb#tC&4Q|4#$=})L|>O$L=R{@Q|F_OM;_$-qD8_@kN2BmLBDrpso1707t`B#@$~~W zxp7d{DpH+2jHlKst?y==7JzIDk~eFsQ9zAm7Yt_9ZLY3yu)$7v9#&Z!uM{JA3|{DSgb0mD&W2kbhm29h3ED5^CZ{j>cwl^ z-Pq;NS(T{)Ka}{YX;X{uK)zCigAuZ=Y=?QbEYOCMH%8WeEeF#5Z(b_%#Y(-CPe+R$ z)77eWfk?XW?J^O~km?(|7m>3)y*`@Vn`=`PPX_x?$?lKabWH|t@51MHyfXGs5n5NM z(oCe889z(b{%4D7)FnHG9g;0Np0E9p76=Ju93LrUPTO6)2uysQUb~*U@-KDXxEMpT z*>6j>n7#1gO=Vt}?=1{+AzfbUY=0&*4{jN2^Rlh_>u|xb^5UX<9^;fCu_k*@rkP!~ z(d>uXN^K0<( zqo`V2E9udEA8LU*F7bnN#QphV*J|gy0b;TA<=tzb{y(=Mr5-f@Gi1^K6HBg#6kZgZ58@V zFR=2@*k zLsc29$2+(%2o*>bzyA*Sum7!Y@V|dW_@gfqJ`v+g2~PxM5U9#gfh94L2f^0~8BnE7 zptXXPU~!;lxgoATfighv-eWy89-q$mPzo|Je)Gimo9{CI^Pez2{LQ!cU%xrypMOF4 z;t{Aw!s>>Wy{;wyoW#3dK2x1TqL-%Qz|7Uv-xPuE(9TMmf*{o1_ZTrYp>R(@g&9AC zF~ae~J|A4~x%K+o%T{*MwUyqXDqoN;*WVkf|AyBmyxLt|TzVcSx4n#av^^B%J8DFgAn#Qsx6c55}v}!@k~|rfz964$QDR^tq1WJNkQgZ|fCv$!zVP-7_RS4*H!1 zNHc>ycd0HMR8<2lJb89hQe>Q8%6*M)?*3dZ;H; z7jQa)!sBr)`*Bwy)U$5U`l2v=C}hZ&lbOO>kcp1I!o_ zKeN?C{yW=zIN|&GeC}w8^6H*X785aNInJ6>E6dD#G!Vrv01BRcq`wJZDd1?Lq<~VR zSHQ*Q=|n`xONPZ~)MA{kEuy+GT|B=CbcP@G7vM)OiCI~XNt4BnR8L6uQUG1svYxmz z5N<6EWVN`dtYwK8s~i_616QIgMN+zfFo_b7;9!Dz2FeZO($7m;T%o%+EgDGDoLB59 zzVO5VaJvY|j+)zAEG=?pcJroYlv0tiv}5HJ4r0ORMp*BuS6+=m+mA=vn-I*Z*@f`_ z>i+RmYsI>*(r3$pQ#v(%Tf9fIxV7qhRx7aTxk~CibmiTu{8g~F_MXbtMnK|Pb~;OO z6cc#45NX`hAqV4EJI>AQx7-^@o`^s>NjzbTvAeG5Q$INpLoSVmU7*FFu6a%OwRN(w zmWI4&c8dliee>`Zk58XmuUj17CT~GsB|>Hb<-93V`n(6yqyBask`kyCR2Ij+C^qJW zok&1uw$OsELJ6@!td57xgShoa)eF0rG?1XTU4%UH@K**}} z#yQoLKhsHf&!k}t!q-oP^j$?>-e7rni~sQ9Tl^RQAmckC{CEFs!6OntX|~DuYnpyd z2pxCzUasK7g_^RP=e@!wjz)LP+Z$vli`1FHU~cz58QEY)EQ`A$drA)W-+{GG%Xgpy zu4S27s+U(%ubiU7nsn3sMb6W1oWVu z>g8+;noET(5O(OgKu?^`&B)^p;WNt%a8HT-;*O`GAw2!mkGZ|pcR%BDmU|Oztmu#q z0A?3ueslScTK$3b-Ou}k+(EFqhwX^6CKabid!D zJ1@}wxz&%>dAQnH-(Va!J1^edw)wmJJ$yA&VD%2YVVqr@O%8(Cm(%|He$j@{ohFUG zN=3&XYgp7F*UZ5k1EV*Af@YY=sV&g__pS~4e$+WIAOo^kSMNRtiLlAu)#h!TiI;gLxc z`prHlkilWSU~)9dHY-oM&%s-Zh`@G)ej*E2NAwV6mc_Nj&@~bR`DK_4DV3v803aBpqQHy#{>sWJs=`fUI_9=|Ke)AyOLu)Bm*A)OGrQBVxXMGSw zqMzG$w0)3e8EXu1(+5(1?PN`WtkkQ2Zu-PG7J|c){MoUv2o3lQ<9?=W82~EdTnf^| zDexeGfHR%WVO;rGgnO)RVjIK8ZJ$0eR;N+-We zFEWx6B=iEpDAmw0Enm;Cj;%p0J7~xZ_$6iX(7m16E}5#WpOi<|1FcAvHMJqx!vdtP z4;mRWTSDw^C)YPNFIpR2Ka{l~d1S{ZCkzR_V0v5o!t@K<#sWka*yUR+rw@_?*OGG1 z-jB6bAE)BXSDR0!0;@LH_y!i=0;rOg>>U7`q&eY31^)63q|A7FWSkP?-+9OQgC8e+ zyS~Mre0+mH{qh~Y`09-Bm{GVOqhevXGiYJPLZVbH<_7CTqUx#J!Q_-sDWTRPu^!$q zN~(C^g1`6UjNe|r!(Ti-0r;(cenIGus}{v)Of$u>^XS&(&3sN-d-Q1q$BMp@;Wqdv z4)twmqpgLg8f>y@#d$^>d}fH*E~)QKn7kt>avfZT3qhIj0g5v|g$gpoh{6?fk1SJRj;m~GzFOH3mSu5yQKyxtWr zpcpJ^TXyS=ZGEoJ9N%{yUIrEKu67Stos{1VJ+q{E{C)G_Vv4)*V}0>kcYOayn%b*; zUWA^A8_0{4u>@>y4R8K#*0pLfZPg++thHjj^gBrM0>a0wF&|$E z;wB%4diQ`XH?Y;z4GUQLnPCeLv?n|LN8#`NJ@SGY>%KZ8(>;UP7@8&a^JJRkuuz_- zTL$n@!Jg~^!w*L?9;4{u>w!c94toaA%je6qXy4e;%v$X@puTHsjc{xDW^Nr=8p++p z+zi#)_c*<|D>XJun(2y8DAYm3bWKv)i{6IqcZ!(3IlhlJK4%7D(~Yfx5x9cRCS2L+ zkl2oWJVR@6JO1C>RBZoJ;0Me`*7^*D^c#_7!EIn%n?o68l`F7qA={_6w%fJ`NV&iC zXtOZ)TjWjGwdawmUK=%DMqpK{kmL0WAZ;;lg(Sbk&1ChgOu7zWa4Ei)h#?=^Jkvff zGsrxmDBSj~&!RV)fi`jG_BFEcpBbe{TikQb-c9XDYCN_oK*u;j!#EAVw}szp=9FD( z6=*P7O9>AT4=8JqaD7ALi9}rDoFi>E8K|A9&(5cIy?Cv)D))qZyes0Z{I6W*vr;^8Yo8w34aUbNpjnd{a{ zVcVX7yksA{E?+KBP1Xe%H+|8(4sE?$i}Y7o3`$ZjJ`A4E=*K`u*~|`78icw+V#t%3}Gl*;KLV1RsN_ zeXQo@Ro&#+Vo$paP_tZ}j5aw=ZAbC^&Vg+1WXE(|%2@znJHGCDBTsFEqaZI9(k0eQ zR%DkQj2=<{YnN`bgI}Wn45q~muU$6AyEroK zDSURD(M|x{(fktP(U8Rlvf0ipa>xZ(9F$^bfd_hb3EgYphU|?6Ha2bc=tvg@Mf^G` z@a$rqdF~@`KPQ>`e34pqnLf1dT6K2}iA(A7g8vu^Tax!6q-XNdjpA4C`4J50tyw2! zLqW6AgY0w^Q$X z*C5(69T;a92d+BXZT6-P>X>cH-VwYwny&R#Pm_I$9+(cR65uDD!X_Vqdd!d7d*g!D z%5LSg#iftQu;?=nJ?el)w8f#-MFJYRUhMj~8~j@i>B1dh@lI&q0Kpc+;u%GZ&R%ak zn=i;CV;bA~aU|a~%m4!pHg|MWe5J39oawF_L*Ras6~Z(9JS%uX0( zm*M3`M~<|F%hPKT?QcCgoii*P#k!ucu4km2|ioHIo3@}&J($n89{UQLW<0^vY z+weT0EeJp#wP)^SM?GjHN4_ogt-k<+q9ZSKuf*_0zr2c+iLNuin=w2~W>ZAX*#mS< zvWUcUP&~F5twTH|y_G|lEdSh)VIOZv>!+AcQw_*@j}}oU=e9|aQtrSt!481t(cN_M z>LE+|WMM8^e(xm#0|$;+JtJW3?bY82aD5m7Qr6eA#(A!*hRqmcF;M6=)XK;^_`oYZ@>`_z3AKvgN(U0o z1eBcc-KP&ok7xY;Z~PR0_ZRPRF2I+cp71aJ;tPEJkWdoi6wSNx^{Y3-gGwY!l zEitB5%+z~z2OS#5luec|k<@&`VaDE?F0a;JEe%s~BL`cx@=7hA)E-k@RXm6PFWh&$ zF~6Q!Uid@ZBTa$+psN78;knlX&zZS4T5IV0I5izBPqnJ{A?;k$6D5&ocH z!5fOWr*B3H*_*TGcKtzJJr1(XmwAs(pKe5Yj0<;}l#3ZGuvesuVl$7~TCc9frsfod zXWV7=rNPjS&fLO4cUKO<9LC(+2T(7UD16+#f2|R1O!OQZpI*14#>#m3q|0^lbbZkv5k&xcWm3X-LY-wjs3>X^taaBnYr`p zd48T%r%qL!+Pn6NE6X51wyaqmKssSWH!SGEYzbr1g#Hw2gn4*Lkrtxtu>uovFWl=>*MGXAOK2sHVN{E&4ut3Fcp6xV3o%aw_x!l9YxwH8;W!%Q{=<-{aF_6cQ z$!k4`MXW% z6@=&9V@U%t|L`b-^38sX3h|9uH^jVwm6pZ>-wM5kM~uACS=r(K*QGJyX9pSNz=wyn>Tjj%>YO*cEbiZg&4papOZdGOvWA$Y=i}f_vUgc%B0*hjX-+D+``PE(B|4U za2xf-3xgDOfr0-rFipy=#8=muweGFNkfe_y%B?c4T#KK{9>Seh5{{@QZHTN~}HGY+rU zlNZFQr=XzmVu#658v5qqS6h!urnH*Y@nx9~f2BUx6+)X4|J$Dy{}DE;IewM5jV7cU zpQoj|Jm&PxEO&<^7K9Jrc{}4ps*}~7)dxQVMi-_YuCAz8O>aln))`2VJkdr_r@y2A zR#+~9&^1SOj0Q~SnKJd02QCLpPJ5LLjR@%&*qR$JsBYmV8H z=0y04<#0I{7>29~=b@O6#X&NzPixgcpwQVY9{NdKE4LT@?8-;%{8X1gI2s3-17wpE1nVVbKBwAc_f6c8h=(v_SX~!;J%hdjL9KP zUaZX)xZw6?^{VO*y@jOs!a}8Lv|h|i(>6R;+BsiG$7=LlAg90r1DYrIutN?3``wu3 zimr242$rc{RG7OXE_0x|IH8+nvOhuR|Eg{ak%3T$GttdNct&A^tkP($55oF&s3wn# zp_-SpcG|M;`(V~-Xk&7V)GfnA*y0(CUXsBg433Qsk7R(d<>uEmUlfSMSM*>i+wM1~2A4ld!3so;b;?)!!5ME-S^ zX~Zi9WKWD?IO7t%osC9<_sNHRbpbnK^>chf?0fz~=#>w-S$TfBGZ}6>k^Fe#9jQ<& zRwPOg^bP)g9&GaM)gd@uS?xMs=^3BeIp?7g4WEaX>R>eArrUWut9UWybWoUUVM}L`ac1kI> zuOcXa{f5MXE!U0(SM%u|gFtbn(x?!7*iMbScMpeRLYUiOyfa2A%iYJg3$DF|pjBBd zc9oCg!;kxB(sLdCCa)ecT@ah{l51En4V`wUhe)CW{;x?b&F6*lBkPl0U*>g{$FPgI zbFY1kByHs9WEN5EDs=uZk8NCSEKV-{5mI9P{Q(sg#V+2cPg+Ak|IQNvz@O~^pk>)I z@`SYUn=02rJuG_Z=*(Z#X019gzTsYufD@6li9*bU&MS5=j0f@B6<>~*RWutbCse*} z7~D4t#~%&+on>Hf!{m84Q^JlXZ9sY(@A+I=$gVU^J6MSL<%D>g$j zP4UHUQ=$r{(bWTcwL!(=gQM0+2FDO}b`^2RnD^J29bV1s*@_A@96PGlCk|hFb5KGQ z>v+o^GCcO_0Jh=wRzho)t3oFh}gQ zaOS;PkS6%YwRWc2YV1SeDS>)G4cM2)Y!=mI`%fw=8M`kt@M4e6$gNBB_tkF;!%O6_ zK{Eqti=wJu%M4}nlQq-f2ur99vHL`00dm*Dx}V<0g7nEgz4ipf_n#@=-(!8YLK@I($YC7xa^^$8`Xue1%mM+Ah? z1fFT}S|ZfANi^Wc>QPFHXtHSiPbLt11Y76PFp$-xpJFqEy+MB0mIst`N3mHJ(mpQoQCkdjFEEB-uP@8*G@<~t9WI*+}2geL{+wll3j9*|pQ zQr*Y`o=oihjyOE^qwL$s(LbFU?aX4n%quvBO3VIn*is=PI0gc>FJ7NeH+~O6cceU=J;PcAxnEd(^;*D>uv+;E~sT}RtsO7pBxl6>VI7di{d4SKu3K;=^Zs>r1~7QO_fluTl8KN3S6;u%phTXC&o}NuG?p-Jr1NNh^L?)fr`rODWATfur!#`jz;+ zNL!)@xm`WQpG$;!(tg^L&`qTKmW#`^v6m3*&Gublu1jl!b&vC7{{`qKYqU|TWY3wU zq^PMDE+FGz+LX7|4) zmffj8m`%RlvRwpoR)2KBkV!aO`Y=sX_087|Mp{yl#3pbt+5WbwQ<#h^s!p4N(Q>ij z@2xGvEjKv|3B?b){*A=`YW6^Nohk$6!YxCX!FiEQU-C7L=^v)R_3fgpM~147C}*iO z*I*ie3&LapISX%3dpl9+B7SQd54W@bM}k1IVH=1#Yta9 zdjuE|rSeD|Mvn1ibG3YQ&gv5EPoh3uZC zAMmJUs;{Y7U6BZgr|ti=RX}UKsgIi|)x_DpiA5{8%BZ_=DFyJ3%5X*L38zX&$ zqp3z#LaQ)={$Q|ld&vXNbfbpT=7y6Ls0Xz~-cwH>_DU?1)7FOY+0XORa4n3byD$n5 zIX18%>GZ0mfRjQy@e1E@y1j7{6iB?CKvz-{1CFMAudnDxc%V_L2U4E1AS5#k+4-6x zVmA+k02pYR!AC3)6~gAP;mt)bJINlt@6#}i0Y6u^YH_%7s+K|m&8NddTv;X8Jw7to zdmbrIb*|Z%OT4sdxVA&nvqJBDy*Bn>hvml<~ZugXScwbHKMNVu&O%pVT(H zqeajt#s&k+~ru0megWM1;YC+$i}S3kGz@kTL2QueB5`r0qaN)h!m!*J(iW#wWXx(+K*mG8 zA}yFd%6pfyySH1QPNJ3+NM~NY2%czREWPhc@ZZ4iP3b*GSTWuH;$V8v@GdjZJe4~4 zBe(lLb;VjY1K?TaaUY(Qsuv~UfcYjaZifmp-3F7J@1?Ii!WTkf>M)-bE(uj2j;z%W z-#rn=dp+qoD|MZaT_dkk>fE9Uou@3Zic^)hOwdoZod4DGs}t`|iHDI>uQQIzO>Dpt z^E=$Il=y5hPD`9d^2^)b^=5Gx#P%qO0-;)3^UnCTo$bYH*>=JV(K|;(`;uY1+RPe1T}4!rJqCJ zUwiWBob<4=k;L=vC$qTpdpOCx$K7=Pxm{??#h7y#_*-ePR>*$P`V>{?crr17_+kz7 zms!1+o(@v|gyuq*;Y6n~|AqMPFrD@`tBd>C8~C`v9y%y3jdYp_BZkb?ikNKH<2wPaNkX(XfL@p{-fydaOfrN ze}Z)^lTiBVuYZ_R>0Lt3aD%4JRE|N)J6Ce>YzGw9r$8ftS0;ZmU>(Y7NdFD6o-eL? zydRHhDcm^f&z7tCNS6M-BfwBb8J|`zgpVK6U~=3ma5HF4S1x-y-n<7FQ2OKhJSaC0 z^KZWoy7Jf|jYT&yRT;Ao>*(!&h1f>KNW5t&=|HUIO?PfivIav2?EJ*V8b3T*3z_m= zk5FBZim^GMKjWo;{je(k)qL|TGX9)a``n)n$UGH@3%+-J55nm7d9$Hp<+Um@wa+F0 z(k|wov6VOoHM+$$sh<~5k_LEeYwoU-);7_PWSHHEPrHlT*?RDf`zKqtOW$786#HVI zsAk2!O&92d8nf)%_u97bI^4A`HC=-Nkjn2qU8>BODoz!8wmMDeRIdu_v9EVv;>y2A z^C%vpS@Ov=mdCEJyaBD((KQNaXvHts5{8s^a2t2oCaKEF4}Xb%jg?rrchF^>AUSxB z!i_c7W=xs*i5gfaAgV}>G}+K!XE?y?=c zt8?ONr@WdZskNKBm?C-$Oz}mjCo_(0x&Rxs#4}(KkfAR3!b$ShJ71F`POkq!x??{q ztd&GvJ2;}4U%OJN-$-Tzu)SwBM%N)P@~z5Ox|Mj6k31!S!NaR@aGpT~%fPZ(%qzX2 zdxS`rw2!*CHW}t&%sql74eGFaF2{G==P2#*a^h}1&%llxGC@YxTi`fpHi6wvhno9a zxKr?spt8dT)H#QULv#(4r#=`b$k?-?;o~3CP z{g25F^z8V)F;A81`;L8mnOUIcjt=H#dt-yS7s(8HOexpKUvhC=#?s_U!o5l-jk8QzoE@)COWL;QWbK- za!k@}RAB~Aw-PrLu~ijZKBe3z$4dM3Xk&3kEs`=Kx{x#%=D&Ixj2Nl=cldjzbf>)P zwYK8@vz)Pql9;!bnLoZ30A2K?P#0O{g2osNND6U8GPCgk7R-m_6cIX=MXw2^SkyY- za;6=!eEtF_Vs+^DN0{=0oO>p0XW=E_Li_19Q{Gj|qSJl{_J$5;(MO%5gZhKd=Xt-z z>e4y7vmTkJbMJ56zt}OItoBWJH>n8hpeBb0My^jTH7ZXBetq9)^hvfbs@!<_QjP9h zPj=gTPTfBpaWWDT)7|oTifQ4C`>y@40#~`pQ34yzjrLs%)LKfds*`&D% zb>sTBEm$L)k^ki_2>OHGD5b3L1l~FEgWaLD*;LKA&y4Tf+e86c22#MOIXKx5+}M=Jo=c_9b<;qo8#NLq zxe3IDrfafMDk4Z*SuFkthN(pfS|Z;&KeX3Y)F7a*crSP;xjCyv7967Akl&t=5R8eb zB~%}o@j!sXxV(0GM#rn#9@GWZy3&gu>RpS)I`b<5i5e$;)UF!$b_#}A_mnayNUFyo zFC52Eq7vfNj7LvvNGZ&7gOzx+L6}Nc+ZzMMu}SMJPV&2k?s?~7IuGQlgYfc%XB8Yf z$sRjUh#PdH3^85%6yZ}>Hlb*VN5D*%B7q%x#SR~&x3xwlE$|c`2-fDx90_gmfS7XG zX{BN9A^9Ro-JyWYC~8FpT8?jSf~&K&hGxc8c34)l&MD?%s}WOR4X9mVk_fv~PwhW9 zvi-F2936lfzaiWq<5}nzENV(U7jOSV-q9W-&3UvIun58J*_R`#f~h^xVVGLIYrK)} z!2u-#b+17$V^O-Js{1l>t=^N$Zd)uZc(`>~IXtxdYHj)F)B}&`>X(XxS6q>t)7i52 z;CRSC;DeaF=er_vDHILrt<1ArzoqaE9)c|#E{92g4wgvsucE>iOtQjDRm-0LN7*;h z*Q~#MzxN(i-^5GsuHTU02jo7{S2VDR^G9xZVPQaeeEo~*GKDc5yCf_0ep>6~2YFsV zBQgE)XXn|o(h4p8;kAsBP^ct`+huJ=pmWb3i?Uqcm4gMktpT^hoHOhe`(#{CZ`r5$ zY^kSBnOvqy^Dml~zNA7^l?o7YB{QZ=DYT+4=KSra6`6?OQox|T4ujNJ&NdUhqelFhoSW))|F$GvRb^^#b1oNWggKk@LG{YCF_7CoBU}G$jhuCl@+{U$tKP9n|<>j?VdNA*-|sK z5+X-nT}!1)`7F}itVNpooNZnmU@B?OfexiM-|S2+X@3=vV)g`Jr2h`ZJ~A zY9hM!n-o=cu`IH>2FaM$L7xkBw6so4J_}z4t2-Cm7WXfTh}VHqMfS+)jkdT{mYK;! z3ttqPwK~mvxP0uZ+5={;wZ)+zWUvM*u-Vc*I`Xr$21W&lRHw)#KcMm_(v4Qq(@W8q z$TWK6dQ7fDANoQfQi^Us>M_p(AfiaDO)`D7A851yN0okK(i6ExDjczPy~?Vftx)$r zH0AA~dor9Q1Yiw4^fl*cjsD>Ng>fCO%P{H8zwQR7=d`|>gSKx8H)vAnkO?ElA{h!Fg8f>c1_s>!=uPU{!+ z)CDSjfxSrfeG`6P-F!hr=H6OyNBx8*bBhj=RFPaoAQ)KLgR^1UpL7L{K*`>0Ys>F~ zWXIaOAtgs&x)CT4f9*|vik^9IBv8mo5ctq|9pM?B;zXUwLYkFb)O!(Sq`_&yv-Isy zhM|wR6U(4%4-Bsis3ch4yItRT0RGv>Y0WdB(Mt@DigXhoDzCFSA!PQB>G^4~+Mf+P zfgw|vM3OkwU$@8ZmFsNDazD<+n-rLv@m8gJ)~=h~-5sAFN71_qvSUtSe%flT2+7s_ z3Up^QKl3ZT-OCLce0Oh&Y!G~ki*M2Vmh-m{HFB0lj`O@B{`1UZu>%(ik=l0(0LGw1& z#C9>$3C&A!@<@5-EI&cI0h$yKa4=l)|E#8-LQ*DLr*TvHy=X#KPGD0W$8=XIscFo|od8pAOKO#DB41UD9$Xch z0K>0b4B!p~Ih8h8u^aV@A8O|02z;`8u7H_T_Af{)K!e|^Y+{>v2_&5zCq#!DHEF2D z#l``h{R(!Vfek1O74?~;8JM+jLklF%H>9rJsj8JtXK?`b1E)7-@kBHRga z@+>w;YVwI=lKyL`8OnA+^KJ2tM%t66f;>faOtl#LgEqTFm)bivHQ7JWzI!a<3iDRR`f55gH z1b=PO!Mybx3%sJSFf z=#0@ww{?F?thBEVgZNs2dPf^5-RtYiD)V51&^ug=-`UecVrG9(FI0ivJ*y{<)+g(7b=p!<#>6q;Ek}Mi*zO)5#11fTX7AKH6(W;do z>fI%*Ujq&~x4R$veNo^0MBlJqAEbc3w|9rz*)PGTolEXo(%I*C(_ClkLB#mA_P{8r z#6nCN`p19mpR?=DZReYu$czh3Nv;o~wb=K)a6HGs@8Cg3KWbf-&Hr!#ZiBDFFCsF| zF0RkcG7>tMH#Akq#3O%T27xp%sta9FvVO)}RDlUaqPDp33c^JQE&pO^QovB!ef#R| z>)fAF=s&_3pH3i9cshyai4cg1G6-n$r-(fKe*d}(^c8*pF@varm`8cq?foZ2=y51H zox9t5HqD~w2tf4LNw@GQ{-(vABrOJ{5gQ1R@)$~rCUQH^*;Bkn9V_QNI}=dze}DP= zm--KFR@vt{|3HoE+UEEg4)b-q0QW1cN(+2Uj6xi%^|H!$o;G4?sEj;-YF7t3n z+XhE^WkR|S^e?-XeNNi;;hubDHz1|rw+#v*5s-6+Qik}EOys)G)CfJgcYjk1o%fb93Vb* zO!QMKw$Fn6fb#{an38uSkXhQf?By*kD`;)=?~I__!M*!5IfWZX#VLYUw};A~=IG7h zYu9&k19HW!>pLZC(r@z-y2KuH9wJd48Qf7pvdurgXKkc?{9C6mgy6E=t<};aI)EFS z3u**M#+hpU{luaDXqie;hZ&?}<|q>SY9z|@Cg_4s6WBfl!V(w3_1YYnOAiIM06e33 zY1giZ8G2GjvOjWTbP>`V7nwc}T$55R=;aEZw4J>r@C`hME?2HSP;gQZ#3s?p&ml7Y zvso|NsjZQ%OdNzLT4XvA@>QcC{D=ybZ|sak_un zy?xFRWH(w-KEy;a+AScjbGqHG8%RjWg&%@!0;aes6D&h-b zC0)>XHoEHKF*^eIy%9W#gAQBR1Qfe9yE)Eo7G54_V+XK_>`a~9S!hv)xv>M8Su%9) z+{Ne?q`jwJxY5!+9qiIxyPhjAGadO*5{E72Ef2oLo|vT!x_BtF=wy%CS7BKCur6_B zsZsPViDM09FKNTk|H2gnoOoM8TACRshD_;dQs{k65s_)*;Qd0WGr8Mj=m~4=i|hR6 zP?aHH#b5snA>q(>6Iglwo;G#I3XrIHaW{WbCgILwrn%q96PV>CXwUHnH}xmNCocD! zAnIs9C5(%FNs}8ZWg*^3ZbN9}5Vc>aM3%}WoV?%tGK|-u4f1C-)9RpYZ_+U=TR6D6 zxxS66AW?WevckEok22>8L*);A##0#WNz?-UdCKfDnaqBWNl<5s3ldXf}R2?$%R$ ziK*6;jn>-zG!4fo=^rE7DSmuC(9SOaOIA2;6&c7rJ$ zIGX1BCt}?Yh)J(U9Iif46qmCAEjdKFV?g#;SVx~!RO7?5Qee`Z_Y>Pc2S&K%^Vh^D z!G9aTKU(d=2vr%SO9#!M>{eB8YG=N{6qXtoLO+d^B4X$)jj%_~aOPqFFP+iWBEp!EHR+cjwuXLU6lna%3rv2KbB9Y&f&xYDqm_5~7{DdNM zdcByYdYq6YC!r-9+P1}cX%L^~1}I$w$pWHkVI}EY#6ILq9@pD_+{cY^*Y&fT`9c}S z-J_BcWI2k_H^g3iMITmWtvpI@Ubrn2FDtJF1)YDo_0Foz_f}q;V~*MUzq|l39B@Hm z1tLjzB+h;m`IXL$PN59#rdY#1LDj5cX>xm~PgZDM{7~4t;;0saF#>@Kuuy9dTZkgn zyqtC%vC6K)r3vNWP#KgE9pa4|8qXX_&@x)NR{W_@+Q7u&Cqga02Q5XNw1!M=r=?c4 zJ=1Oicy<5L(a@enzs_k2@H$|oDj^-M#v0DC455hZj%;g7Kxc7m-l%IY(7CjVA?&E{ zIut}yW6j7jVP^5VeUdLjK2z+ni>pK&yTIL~hopcuiVD))GcSoN8-?ewz4K6vDJqlA zhW(?aod_Ht5vx)VZncYW{OK?XwI3`k*8~=gVjIdWmpn+4_+tjP;=dgtwvGr?YPJby zZs=DRke|81F#UsZogoo9Quef_fN4g5rF^ba#`mmjeSKaTuyq!^@lAtaekWN3{L=$C z|A-YURyV>H$AF1%ZAd}h^VDY%w9#eHhyabe`LUs=z9}-Kur>o)Qn6NXjWw%kg8^IW z2H&AeIGaS^3D|b#7(os@`{Y2vY1WWFcG?<~y(p$uUj_R!1-|m@ez(BT!os33HlmB< z(mHOQa3BdSaWe~nuWxKtk==7&3mkwIKT)({sfw!eVQHNH2j94?0OoIeFP~+C=#Nb% zQWP<9x5&;g*$vH>(9zC`Kx8SDaM!ZVmL&E6??@O>j%cM7qlC4;HV;L4X$`*?Cz#^$ zGLk}@;4MtOi95Tx^Y@PSWCpZ7Dxk1i6$9G)rv z?*kM*YUWNe#kROXHeWgw8@2$Xr3BjyeC)vZ9PKVN)&I{ZyAa9BmTahK>Mx@bBkk?F zn-jpb99(b25~;&>g}_A~?vmSE->kq5`|uSP?8rY2hHFNGS8!GsDhK0J)bgut^D(Vf z$n~jCoOKNn>GZ6F|M;4o1GXv?Ue!?ikYTgXO7jzr=BU`S2(}?m z1^XWUNQ@7wFIO@0=G4r6-6P{)BqNFh$1(4qeFnC7MWEAeB{D6ECmXskEf(-eqNqh8 zb3AaREmlYe0ghsCEP+f*&5G*p#E@@_Y9hYRJ(G0wjA#%8ft#j--Z9J`xudL#2Bto? zmsQw>|8Fw+7et0E?p!z={c+*;dp7 zFr+zXC0t-DGpyfh2Zk9|JalC$ihrs5WQ~dCm=m;zP3;%GALW*+L6fIkE7vwfAy*y3 z*?2rs(^}$2uDI%RDIWsP{Ek;MsqDrupkMsUF#P>(vNU*2ZHm)!5{if`FINznY%(K- z<9WJHjlZGk^l=CJy%8IBSDt74Qw(biI`7fwaS6$3mi2n zaHMu_6%pCR5?NCNtkVrc18^I{&sy}$U%NA+d$0P%W8~CzQj=)AcSt9ldhHleeAMO~%O^&N3|pMmT`yG_N=Mxii^I zwJ7FKk*Smuv}@MyY%XYaY!;M1K9Ky`Cq|v|rtEP4eDdQbxvEtm3I~=<|Fe=IvI61& zumKZQFhv+}PqE)sc(K(WVK)cUDlde_*csFr42GC_LWI>poUdYsR;%`e(b>YRhKDPb z<)v37msLO*c;o$!KmGqy9RH#%P`#*G#Kuf^sVQZIXNFU#Mo z1O(@WgNTFF+Koqo6|X7pxJ@$;2RPr&^Ze5rmvZ&J=4><&Y1K_gR<0cA{}7L>jd^FdKkwWO~ud_RFCdOp&hv$waI zIhqhx=5k9WRE=R5nIJT^Cxd<-5sRf8_DnsHTpp&vUu*h zP`*cP=UtMalIvW`q*8e+QJTU_btW1Pdh=nGgQY-*rrqG?G6iOaRJlzfyxIF(KBOY~ zGF7!9M@Xb{UCwuZ#*!GKIc+ohxC7A^g`ePJ=$yFWf3CR&C|KPCPXgmS;~Udcw{8S4 zt0CEF8n7}STOss>JV+)yr~u%EKOqFSN-CT`UQL5*a_~Pp^iy%wy};X<=0)j|u}PQ~ z0+RJ`oh9VhD{$!}4?y{*C3ry)v`ekMyKRn9o8P}tqAFj77E~XUwTD-+DtvjffQB#_ zOMC;G1!XIo*G_2gl2Fg2nH;l=K#b-jNE2G?;*ndse9aB0$!TnLsOfHD2br9V zv;)VUeM91@FjVR|kztw@SanQL)bL`M@|ALMDn`sZWROB`i>@FRnmmi#(j8f=mtHf< zBYsU!7YCW1d|dJIorwce{%ACX-keCqQN$~wix>yQjM%%5Rj*}F(Fwz3OMvA zYMfukILIz4JkN^&Xgo-Yt`5QRD+xwl=w!0x6k3bO3!aoZLxIJ1lxC*QAS8CARFL$3 ze%j0_toWF|$vPMzngu_@EUAKF*-LBY>4Q^=O-buq1)1x82hV*z)%#82KG6l?hq!2I z=q33&^PF4ofD`wNwoX}{AD@t+pfc*?Y4yhOZPtI_b)L_?wtHH{IsHb^JLvq%{pCba z#P4lYu=u-RsDLAj7VibT=mD#jtc2Tm|NLSLj`HOmYv#^ON;*sSzWM>-ing4iHLb(% z6<0@JNLcFpNN}WXVTUjw(slgQ~$E21Mr-(%jYJ1w?Ob-ro;1{ z;Ol6E2hBt@{fXhxFzANQJ)vMB*g&CA=KM(gnvwS736=MC^kpDPva@xrdaH9F=2iSQ z%7f~hetc2zg9H#d+bVGN#*u|FIJSl?z`pZVwri~5n}(H_Zs>f>LNwFnu@9{{uh}(O zXV5#&+V=vf`iaye5tcKJp}m7l3jP|thUB(-4crf3U7N|<8})yp_sS_f|IfYBha5t< zKlBF{Ha0fb@2s62eGX2}zQ4-89REU_=hFf?gF#0Sa$ym4jLM(q9q+i_UI7OE?w5!e zs`v#_nMl}0Cm&)*5nQ2v{+lEMM`JBRZdMIesu!ZtRzmN(S}DGFl6d_DRE}P@PtsNL z-m%op4L=cg1j)Em$DnDhmoKdT(b1GGIKLXwP-yMaXwS^P!;rO36B>T|gv(=6z&c|g zzX;1SITtGB+N%|?yg?jtov!nguEC{I&V*Yw#`T+YKwV~YisoVu@|Kr;CwNDS=uqiu zgOSGyEv}|DpAxy5=|uvSGlm8xbSxA;jKt!O-e>+GzLq)HMn(M(vtB_h1V)m{@Q;ea z4a*#Ghz0E8*r|%23x%Pe1^=G*Yo0BI6$*-QMre#%0!1=RV}9$O?xTi*DDgquu3cQ+ z48Ci!;po|>6iDCgwj^Gd%znRUM2@^tFJ_g-)#f@QDmd8ZiMeZzzLLtHG$ z0MolvV$-S(pW_pBBjAZ!?tB%qnz2i8>@E2ABkb-eDMzM6j_XGYeUdV!|;_o!1UC*S*n=gdV(D3c&eWfdkX}6aW zg57&?F#nsDC7Rj$30h5Vmp4>@M<5Jg{sr&lxkJEQ`J}GjyIrZ@!|H>tgk7zL)1RFx zMpoaxza;=GYMH8)e2*70#@-jQM2eg53&FeNl%Im1I{+ltY2OT~GZJUQTx_wi#_H2Jb@ z?(rP42dxZ;=rp+Xke3mWMaj!U-TC@l$Cls=MbJk|*!6boS8p0;_s0N@9fH9G<&Xc9 zhD{8#YgWK-9NIPw=A{U83kpbbeV={_yzGHTugJ;CX<3|m-^{Dh@QW~G^yjNZsK8ml zO9Vu-37>fqL-H(CxfHhztNY8)nl82I;}N8c2S?+oTiIoC!$NGV*+1n*ldZP@<(`os zcZ*N-BRVSvG8e~dkWEMQ5;P|7_ASGt|n>8TVY=d#1PmCINGsBvI( zHP)J;rNrkh1vX}eER)aCRg;P&W>(3JNw^j1Cd}I~q|t*`aH&ng&#`7Or!UDM=nYlYa6%Rd}g4@>x z+a;=HS>9*2zH_?}y}6@Jqu{4`JF{In4~s+r_8wYek5k%vRu_zb@rZvkV9?V^n6`t% z#WyKq{hckk*uo<*2`xA|?L}@@_YuLOdtos$^?gd3b9$utrDklT-oM&_> zk{a<5ip{;Pd}-r!g#m-Le;h#S(_9}Q;71afTAw$EBSI{hyGSXK-q8{Wwt*KlwY@8b z9?tFh2IC33c|qH1q~9Uuc*uno%$<57VC1X0{|xVZ_d@20B-Fs>9Tk%);l-cL#cO85 z`WLF|!t72wZuyDq&8D-1X>`F20WF!!?SKqCVNfmH&TCYWIXBD9-ZOk3 z;QRFShD)@qwGYJdpE;EBvP*#qOS*Ai!Av*U5lNNc^7Tr@ukUFM!VJ2S!I(|5-PS4T zOah!!x~KDaWvejfU%_S`nVF}yt}!?H@TCEkhL}QqB<9%=uD3G^ww7LcNV79Cg;F%r zb+n3NM)!u$CBvg^xBJHbN~CDKQxK)aI-6T33N`=A&M<1iT=0LvrYu}V(%UsPw@>JN z!olXB01oXWgXf;-D)x$i7){}lytQU`KMD->3RAJPlXfa z5QF?hX^Z+P2Wo$7_)R%V9O4E>3yvfN*=8ocab?4V`6yRYM+L!ajT@?qM){4N0qV2e zGw1>m+&OIAm>)NnNH?J|6)!@-HbH zDyg9kq~%XM`=6zmvD_K_2FLxce7~;^DF6B$sAgmod|mXNG`Jfa18E(c_us-l))#*I zceD)jZSL&tRx{q`oMmNueX7TPe;Jg2-+bfQ^u0>{_38oqu9^Pz_4w@2pwBLp^e&r~ zZk|Ew&^wdULJ_jr{l218y#jCTo$LQOUDwg7q%gAJC@je-1AEk!_PSiBZ|qhDy3_$& zk?nq1xR|nI52VrD@r%)!T%PTKd0IBN+9xzVg$aLR-^Ilg@QZ2_>_qyf59VIz$k}l> zQRne`r`wsoPN`Wn#as80n=xI=uXv1>y#3DUdDMbb4qg*u^>yTaQ~wLPys5o8bZ6Vp z%?gb%Z`7vlZYPVVew$@)`~d?rzh~Opp?hXa0&nA@`~8^LmIHzJ+2L-btIhI<}6p{<5aNNsZO2)z`>oH)@S!P3!pEIbzE+Bb@wKW=4G5Cco0@Fl0t5~4D-}(3Q zj-$heP*v|Rr%j;Pynek;0-RexA*P<0Q9DXckK?m4&*z@!+mIL3 zA+@nTUJFe}_l~bU%#MR(!OU<*a>?YC^V<86gc7*gm39Q7Duy972O1LO8RhzPL2xJ? z>^1L;*qhBV)G08b(z#Y-`ER*#C*lbZVU~iT*kQ;i6E-D3_gDU~sKD^;Vh-wfP9LY7 z&+*6rK2%H^YgN3n&{=q5rF8REv|<$DB5ypgFWXD%8z360E0X_>w{{Vrh8dZ%C3)n= z-FUl1=8Suqh-TiDTtKW0oxT(H?sEI%ff}wBEEZ(?g1=c^Px;y$%A;Qs7gVHMb5zIg zw<%*sKgC0dppA&O{V2NZqu~ILlG4G#C1sz$L|Vk7d6P?NtyX3g=;D!7KeRl)BPPdd z!C&dcr=7HRNF6Ne9rrsWc(U*h-YXK80-F`>d8YW}ba zZqAfz6^+H7+tj(7Qc!)rg$qSfeb8%1CZIEY8ySsAxc7P2p)7L5O%?Eq>55VQI;TuS z4%m7lU$x+Toso(anT0vY^-3Ja7b0qEyLLXkT+9}L=Y2kA#qE*&9wWoby8cLP zy!EdlfXmO&gO{=LQ>^6mMT(yButeFpX}pu@vG&ozeC^ zu~C?~-2RvpxzABD{I)I>^Hey122}~!dObx8iY)WkUuZDhM!uaY0bRkmZrFySs+($P zyoZm=6PPT>qQ&?8kXAq%{M(}0UPt*_bt4EF;CGg`m2LnK^G#^P-IK)1ZMJEoeAZ}c z;2NE9L#W}0lAz?~;kd2PJln{**ji8gcwy{Q%!BZVcK?3m^x^CIJBQQm>7DYwxcaKF zxVC0nNN^9qg1bv_cXxM!26wjxLU4Bo+F0Z6PH?A@;1;xTcfH*6-+j(L_i4SYZ?0Lj zM%Ao2YSd7`Is0U+#3p!|bO!^RLciMGEoRuz$}S8B701>|3&SH2SdkqtodC1ieV+Jc zQ+@!Sx1O$%ez133t!y}LPtvm(?hjlcE9CGEwYr9p5ki{ZcGF6RfRNH5bWz`*6GktA zA){22Uc{oMX`dlEdlx2%2El0oBQ)%HUj(yh((D10l!0etuCUZfK#Ti5J{qua&xrr8 z_GiqaSH#yfPZp?*J>j>HBok+sg(ND61ltjoESOK6(!Rnwr@iz;%!|*22gn`^xGk@& z!)vIgjp!Gv1FS+m5OhMmH(UYVI{32A=Y@dQo|$bL#16u+*sQ(Mt2k(Lp`2EEuxr4? z=i>avnNW~&6`MBG`K%FOVeeJQIg&fzN*Tb`-s4#Wc+MT(FTKjjJ`5Tme>=Y%syGoC zOz1+)@pTBE^F`jz7}~r1#zg?0I+6qyLic^9!2kk=M^7bV?_~92@LNsMd;A|@HgUA8 zl-MtJlv~|85cnniA7+Lag*`qP?ePG1P;g0_t3L;Ak|Uc$6oa#S`o1y%f-!dB2YLN= zFr*Zn{cQ;A>%$@NJ1(Jf2g-{xVGjp)K&k}S#?3zu@)}yWy5+RJqe!0GqtAa=bz`Fe zV&=~R5M?wK{kFjy-%yg5l`}Tl&6-E;^-kWgzjPCa7EvV6JLF;Q0b#uVTpkA$Dkv$j z2?%t=1=0=RiI-mM@`v#d!-247+1ayroPXLhj*gBZnWZbtNlTW9p=A6Hb$}#no(ouccdN{0HUH=s_G^n$Mf+ zl&xiO@v5Bc#tUeHkb#&|zP0M54o#58b!X>VWLKopOogr)ivM%&clajl>?KHc>HZ^` z9*jB4J*N6vKK{BSywLRx=8g}d00|jq*H>EeIcvJ_$rGfBA)lSozD7?NOxdGg28AUc zZP5B4(4|u+LVA`9Rhlw*58?vHB79RGRZ3!3mR$2@5P3lTk8a8I=C zncChKqy15#$HAK><4>_KlbWSZL$u{oSfsY&nl>RQ5YxNi(+h!VCG7ni+$>bonSvOA z)~rj{oDMjZuu!SdU&?E1>^rJHF-6hfvb`ppp+#-Y5%SqWTK6CTahjCFzPmdL7I!vd}X@zr%!nVFyS1 zBocwo5v5SPO3^V+tsRoy7G?f9yLk-j8+XuB&S^l$w6{mG=FEv5q$5uba$FC?*Jl==*0!F}H`?>5hUE zPYVHK!jr^X*AJH7fV!}gN;Xg)4V&VhNJ0{#tw)b96HtcE;eF!MordUCEQRJMb1D2C z0cN2FZ=W6k5oew_M0h{8$cm%@d#CG=`+q1^?uJ*#@@=#ksNMl|BH7tO>wIC5lMig|31%#|Lq9n z?eBk*mwPji3att)U<8$i@F{UZ!S8ZQa&(vNEZ`h^8IO8!h-Aq-7~{SxE;4vlr$Swd zv@nc~^gGm`MbYx!HnG>@ovTE8Y5%11`;Zp_mXYT_%aOnjG1pXoO&YK0wwSgI7Z|ML_u<)$%f<=gG!4!xts{W&_^6Gb%uiI zo8Ae-2cKYsPCR5*f)Su|&fc@67kU_SbxlI~v+aAFTU@JK0h&jiLfua0W zYB0;DhrP%!$(AWcTO<1AGsmodFWP(THNp(YNL}(b@R0EkpAY2R}+^v2f zitM5y)mKb-0S#mpL;bhMZWJ5RrXVJvmf^3v1VqqkQ0^x&P zUy^|90T$kQkmF|hE8O%?_n7F z!w>||GNPQLlQnw(Oazkb)=>e5Xy=M%I z%KZxAvBc73oF-~H4%NE8>2g1_l)-rv20phig9y)m`QKr5W!9cxKl_U%_+Ir<$R{Zz z1`aZWWM#fD=$1?aHj?4C@rG#?5Lbur3g-+V$T9;d&QY}c##iG}fPkMsLcxK#PzC&W&{0l}mCPJIeI1tXdh)?*el3cv^a)lTnhpR@Ys^VV&Qs(POG3~vW&bTnz@ zXqTfyK@T90+}kFd&s_O9qn7uhRa(I!coTvYog)BVnl=~`m>0`Vm%c_uy7&ScU?!eY)($JedqsyFRM)JSF*K5*)(lXCrSPj+hET=o^^-CcV&))mjePP zeI>^sBIJfp6_9B?tJ}n!8xc6R&qjkD(=(!9;}c@hjE!ajgQgE=(sV-|Z>erD#`|Fd zBb3Yj`{0Z3SM-ZP4XYqr8;4TF*M)h{2cur$ZQ+RG`}RFr633o35GohMq1H7Z*2X(Y zs$R5290p(cXYzcC4OD@w1U6Ydys}Jif<}4!J2Q0b`GkORwRNEKY0Pe)&xSo!$sit*MWU1X)? zslBa8eQldqYgv5nltc6E(b|~$HB6@M*zx=dUS;Bw`(hDM5zc|~)5DbtKK}&BOw!Qz z0J{ixp;Uw3u9A^ekUcD5A7u!hV4P7$+M%Fra>fOF6S-FlIfYg^QLI$P&o<>GJHvgo zY4%BTkvh7ITW{KqlT>)PwbVqY^^*E7b?kjPtDW7UM*CzHrz)iyzn;#&S!mfNT(pX) z;&W-GEmk)3aJeIOd&CVO{jjk2PFd5-Zk&@$J#{R2fks2e65T(g3!s;3EIrX$EYqM( zdtZ1)G*CdXhP`ivWI~lWO*f}?@R~Y{*E4uMfsR_v+%Vt>Zr3G!?)@Fy_{o>vWh(?4 z^aKX4=lJ@l5z+GnL>_VSPKO7U2i1yKD+^V%s?6%88af$W6VE;&BkYzJqwF1i+YWB8 zmy@sjM%XVS1pPN7zI zlBeg#NkOhiyQLf1oF=JRhej2(M21u=tz*57u4gn)ZoOOF z5G4LRRXo9gaBYjdS7t1NR<*p2&Vl2JOpWJ00so4$fe`NuD4(za zUxH}?y%7N@7eT@OL#}dt{syr%R^>{zh4ATyOvQ|%-y^fdi#grn((L8QW0|Yp42tZL z!fPZ!1{Qv=^du9NdOd`)%B;qge(9GE+3OLr(Ywv*-|Bj=PH*v#2sAy)%2%_$w{|7t>W2Hs$LhT$K-%W$|OrJI;8*#%O;n63wTGnh_(UM5P{KTtl)~GBoS+JOnq;;(>2hs)g_ZD+L2Af!M zX10u|HAvd|eO9CNE|=K86a*SDOaFyG;3+_oq^lgpzjt0Q3x`XkTZ;pKO1sYV5}21s zN!?m;Z7#S=t?f~>bTPd1w~mfALz&rAZ5kIoqQ@>|{rF)c38wW2DK04pXh#67UlFlR zWDTP=CkXR?J_&dPFDZoh&CP{X{A$kh%|%s&mcPU}i%0?($Fddslr)Kz-5{B`!?xBV zuKY|@wJJSN2q%q8gvHOxo3o<;kic-@b2iZv*sXR;zO1ty?c!)(b#}P!Gj4lp!NWueJ|`$M19y=HS-w^Yowg3QFyrvHr|$(zUpBeEaA}qf8xiCbq<>Dh|7%6E_Guj*91o`uiWiDf)?cTt$+ZLP z)cJWGJ-whAgwF*O3bClQ9*!BU50djuWhg}Hrn$5w+{-92ic?1C(4ud~!gDw6FJRLHKzHQw{Bq>}616;1q!7+6{TX}6JZu2VRg9mZLm zwy-4UM6lt0@d*5Cb$|`p-c~XEJAeIwVXPdcZwQZwamHbO7(Lp>D>oR!KGk8v)W<(C zB!!3?EI8IWV%V_?B|Y?{lioVf3Bu+o6T$@s1denON`-JNhl+0}UGEist4=kwI);&^ z4lAu3XY~z0tq%AZA?`;=3?x-fQn~%gDr8DjNdCK;$=SDc;?G4N7Ca3PYlfxu9@?GO zypFD3ewmyCF_D>@DPd#d?~`=jii(OP0^Y%Wkp!&*DHEr0q!*DcM~v#)$;t=R$56EC zZ912a1%$-3m`(V@GZ+QpoyJ%#^f8Gp^5o@V+}h;PW0=K zBcZ8>Lca(J49XYhFiZZ!)m*jl-Q-5- zXo5J$Zxd6T7hQAZyFX|!p>!LISkfW%A3o0Jy#{^^+||`pMRj$3U0vOoHc0JVg=rfF z1qHCycVcX78}$x=10V5Ku#sTl;NW!h_08Peu91O`Cf-4B+uWYkWBwic6ChSNCdwSk zcU#hcYUg|h>3y}F=8&d{Vv=W8RnQ9x4mDXkVx&whGF%ZPEP6OdIU|rURIBtEbq1@Z zHA*-l^tl|qHV!R%i#RtAx0tlU?()=$xDB{iB&b%E{kA9^oT!($eU<5t0neTA#hgVE zbzM9}Pfx#koI6vLxv|xj-@VzLvN!IWPb&!PTl-q(|3J;dmMV~79;H-~LCO1sa)?87 z!>4>i)kWekO;Yh`N8Bd}+T}%jc-qc{q9lmA{NVxF63Q7)<6sH8etsL(XCAYMP0->g+^Z0zkEc=meP&GxVj1jMHM zv9~<+bYGgd{}K*3{U8YHg$x_HKi8@mwM=&V*9_jh9fFgJRE<#Wh5WBLZ3>jHRu8Ig z$K#M1+kX?BjXOWCY?#yyy?n z$%cux!jA~K*G4i9Hf&BoaAfHZ$WzJJ=u7#^+(X%H4G)^N{Sc;E+}@8w<|#Icg*D4b zo;$I6q8cH2?uL&-ChbI=6?G3K)T1&n^)l*g!oT_jR><0lbc;%5@T0Q$MqN=qkbtn@ z&Os#J78GH&(&^pUJVB&24>fu;ymca59WjzKr?kO%D{iAm#a)hId$SLAJ7O635#fvy z%YW!Sej`Dn`)f1RZ4fe+dDzV-r2NebiTk=7+K-P=N%zY>0a6zbJ+{U3rmP%8vn(&5 zYqV+S9#oKG9SNdx!&75&tev?|H~W>|W0^ievTbORrL}rYb3M$7nzte0JH;l5P=U#W zIoCpw2pzph(GV%P0jOscX;B9?b=YNB-k}JJ83*U$e^VI6i$=TP{8MNwZCiFj4d`Ke zs?H4TOS-mWcJcEGv}DO4dy~HW#oNU*xF{3xH7W0L4#Vkmg=INwNm#98y#R1Gpqk0_ zLNj@~EalC0J5D@wLe#uz?(DJ7AY7hT}Bh8^LXF#l%!$FH; zg%Aa10>{ZV<)_}<#(m6q_PeV9PGT$J7^Rn7#ap|L2R}eC55Crqc!XK0{3)4eqYqRf zjbFI=qa#s?w}m=S;22C;>emrG<&sKrH=5XH@oVNS8YFCjaJXs~9u@du=U$|`1AZS{ z=IniZkRvQxR%!JKd0cyFFo_csXWOtdtER-J(1?CL55po36kOZ9FH^l?W6)QWqL#{z zKmCVk#X}e?thWw$!wI+*?ownB4vD9CNkRH)z&ygQc&R2?c=M}aoEXa9okafw%ap2r z*{2VsoMN^bc;q2WF*NibFq@yWU;cwgq;}ZVDgBD7(%C7xOakl!V)JGIZ4#tmH(7$c^R^837HSWKiV7 zJd~AdE20=(6U%Kd1)xRO`KH|nGBhzT!CthV%7c-JnvX}LO_fXE{F9D+p4s&txk>2u z1NJaqzy^L{Z-+J8Lh{}O!ee^Lel6G##8KvvBeGT^wjwITB})f!MV zOiu}lu!9;^{PjSOg6@nwUi!<$q#j69@}XQ`kpFn|={&=@mD_kdj7b5yj6%6-AuFm=}SW zzqO{s3;e`2KWFi^rW(lx?cV?Fnh&%9=A4M#Hiy5KjNSVm^Z(aJCP}_Wi$CVp$#sMM z!({Y==tQAbAQ1$GWPAD`C^8rmJUvTlt&mFq38>MYOEQawKAb>jK&^D7MYvHmL{%R) zJN0x3etn_om$hUvpAM?pFq$e?rg;WZd%D`&zAyM{YB_ZyN=D!m!^Nz*Xb>rgoR~oM ztjJ3#0hx1DAO;M?RwSET&YnDg1Lo#tF%^Y}J7W#bA1^auO`G^DiUerRdg&|6R8Dk1e0y!YMD* z3EU_>@SzTtEHqRR+htRP+6x+8KjijK5i=zDmTlDq%+eA5j4o^(=KMmWE@wTke9YSx zE~!(nje81umw)IHumBNL>MYO~jW zfaHPE43JY(P)vj8P`ByU_KIe~z&5Av$Aw+|0hJUhE|F@H?_fUoBmU|8uMEFfVCM%m zdTt9aK!_p2n~%59wd}v~??1G(Tk_!WepPeHiC;P>bNCcgVsf?u(J&%Jp%}cHs1iTP zyn2x`x=3=xW9+&ASgXMhpc+RvDXGzsp-@b_fuUIS3L43P;AuM!`v+ewX+<}#BB zoDya*Qg{j)V!(;u3DYaNMxrE0!Log{^|p6i-)2T3<**%2nQRDTe=+ckrninp@H=V2 ziAK>EO-ertHtYI_IxSbO>AQm$XPBOkY#Nn%_FJ+@Y^W)GTBm_-O1wC>?83xW5C!`I z>-8Ta0Cx)hyOFF`ed8F234g4vzT2SWbI79YZ+FwO|IV=f%Zm#>XY)wTy1W#&Vm2KM z;;1U_P-Cm**Mkn_sJuvp`S}=VjJ=;Vr+Y>GJDNRWcG>nwaLa_*W4SN2_vYcempDwfb3sX18 z_BbKv4#nb}9#f`nLoG9u5ny?Xb)$2c{}}Qg zFp3pcG_|CY%QIi4kfDr~{hYRgoY1CCF^0q0g53ODFLaO z-1he|mzhVuLx$4l5@_tQ@9m2{8Es~Fz8n$@Cl}jOrNb8WI>K{#8R5ab%fTVg+1M!j z)N_I>ld{xR)BR%YVBP{269N6MxWi>(M9kp|5ERACJ!~F74xc@LN-TfO*M0mmioS^d zzh$mdhU^>wY=Q(f>6Yl(4kM&dqp&6vaI^}$#NeCRZBv^Ds!6aJV#&}!F-=KrKVhC1 z?45eV*?IFPtfz$+F1djhN9ffQnPNpxa5O8A8ri!W`CU2f<>u&U26aoC=;ner`OGS+ zilbwo8kuLkS`KPIQ?X^fWW=yxf1n%4DN;XJ4*%ZnCZ}~SD59dMhIm}GOux`OdoMP{ z)^vo^OZr_ZULn~cCRqp$Gt6)vJW7^ubAzUgJW&KoHug7rJ&5*t9E?)mcDTehc z|N8jnSg>Gz`TgD_8GU9A`^G0JSEUy>L$5OO&}*1#Acwq!>qaUnS0xt%1}gXjj$BNg z>mM#aUMkjQt009nr#=G9@3aiPPFZFn%5y5ckcJGV%K^1ZgL%1Wo3I@hp%X2ccreBG zQ!iIcQ<2Vi!3yef`c=pT+>KUdu1X<>fN^YWb<9_k1T`t5JG+*qWMVa;dmqpLuHn3Q zXJsl>YRQL;E~ZD?8!NA-3%O{^fun+Fh9&Vs5jNuRd2}lkzQib)GO?%Uh8Ow@hD#)` zncYW!i;UoThcAz7l+iZcw|6xJf%U5Ls;7YJ#@jEa@vEz=QtTiR@c9sL@kw6@}8L(?8qo1`($T3CUS&Fu4k{!@O z%%awFdF^zuiFsvm0m%3j?Db-qs8R`PYX*y}UpB^%O^%BhZ*_8}bZIyes9AWPC! zSiOyY>N{TQO{pJhJyVIvmi%3M8E1RGHuCfC4-##dVh=sEIUrYT4!L?l%c(V^AGwC_ z^kS!Pz1GmH78Iy-?uhn8x@5t(7@=OzT894mmfGHz z$2gJR#|EBNM730-7d|r2uo{=;I|y~or?W4zvY|+?^8W9pO-S8*k%HK_C+=dUG7WhM zdkTH0EXYhL0T;ImEAJ&n<-wm4GeUwqLFT_6!X<^)3_NP$Azp@)Bq)+{bTWzgL7hBd zRbHs#9R)StMu|sXVyx_}rV8aob9Tr}8VI^^*{rLQG4XXi^-rK_)*myRkSEW1;=R_P zxO`$mC{Ap*%|61g=Z7`8c+~Wt?4?>RUHD6;CNnkqmkpmNXLl-QMUxzB%kX(|IX0hbAy+}@77NfxplKuj zXs&ndAnObOis^|&gKqhWw1kwu9INt4G+8_H+um>5Xf-@@D|1A_D>b1S51ekFCrbW$ zl)Ol-cq=mXwyA1p4RV>e3j)hIp61l)U2G>H=Pb}19*7yQHH;h{K}22Jn)G> zd3wxo60rK=MCbTb2lNQj!NJ3NI@Y9Ruu5ds*?oH3diZJqCfV2xT;Y@mU&KPyRAf;o zlML!*F8Xij175wv>M&lnu8}m?#QUz*GGR1JgIsbC{}Q$o1$-)-jQZn^{f{^PKc`Gc z3b(N=I{eGU61JUJLq?9En_(jE_MO;Iw@MSo zSqDfreQx(hauue__GlQaiZO=hm@7MAp#l}TjIX%)w`V)~d(LBJT`J8*K?Ajjl)%yhj=!&++4)p){SvLw+98s`o z@^&*B3%*FL4k|5Vu8x8^vf`f&{eQ0bnF4&S5z%9z2xW9buv+{e^cPmd84dACrc3!$ zhsiw02e))A2@0x2gI=<+MXPLBifKUQt6M{1_jx7pc+T|D7zZ=eK_>R(5{&qa+w@m zB1S=Oid1jc!)`ozP?MiN!#7L=y4&ogoo+u-zp6l46f{YB7`;A&`utde%36O2o_G}I z>jkC>cr$rU&<_Ae+C%0yS!bMpXQ@(gppSTRnb!#L%jYF zzPq5L-0EYPvi5`;ggqpE7n2l2L#r7AJr*|kc~TZrsvMEugX_U4ZeE7r2Xq+n5(>U7 zjY!XKy}m$)HCI^X=Z*^juPFS#X(ZWy!BuXIikt+4^o%4WiN_?n+Qg17!xLn+NR}`Q z{)Pw9P`{)AvHy*!|Jn3d_-cQjz^^>&SE1@M;S-FIvYAQxkS2BYkWkHezJ_`tRp_nd zt^D~mr*BHCO_zh}t=5et_h45YcQXG+)Qr`M^tfV|2Zd5JQFdI5D=R20GDsuS;~r}L zB^9n|{SWtf$Pm7GA|;V6Se5Lj@#tt|$DhAjCsu7q!cqqv*`IRdY$@^hQdqm#gauMn z402DCkp7AwGdZK&aNP^zUVqiKS0$;wsz=xLU_RYGV;)|t$s2hhsdl}6Ko#=PB55YV z^uPO{xbbST{^IoWP*G=zeX_cW=r7S2meK0TuWyR2P9pdBYo86=GxoB_IEDQR&I`-x zTxv#+4@sAstf(`%bCO&l@C>iA>Fcb1W-?>>+j+9QIZugF-6$3%i_?7WIKvz&ck3;; z6?`ufgkkVUdEX$7HTJgR_z5DGt8Hd`;vGju-=s}!W^^*Wz8LROpj}2GWozwiB@!!Y z_+405OZ{)qFw{v#TPm4P)F|h%b=KXJf0Z}2AtS~iFJ(Bj1$~u$|G6!{)xhjA&ys54 zvpC^{zUrA}pIEV^SSHbbGH4Z!xl}BZNIr{6hD6i9r=S%_7)qU1=iUidrA-1(}DNAzTFWS zbaE1Eklp;^%}Kf_fZIUTRg9L-n5{VN=pu zmJ>a;ho@9&{(O~+L>t3VX16pu2D#P6xo*O9qD!l&P$y}6F0QBs8YiNO0%=#_tP> zPBk_cQN<$de5V6 z0AxP1^Rv;X;(lo*yClDx~`b&*<%R5MnOW-t6$bZ;xomGoHiC zv@ghR+5c~A`X7|V)?MeWZtuI~lcy%(i2`Mzk!=EE)3I1_mfzzpY&qUG6f1Xxr;9#T zckBXP*8H~!(k6FTt=+Hu4&KINu7W-Pj;G}8lFMI!%wtaTre$*;^=E%){=5s~@5Pi} zzBfo<1s`i#RCzfj3rpjPikw7{>oP==$ zvFQ;q)mm)Y2}I~BWfPI+;ydvtKip&b2AE=B>V8%jfK>BAWM;84+oi4swM4J7l#<3M zkSPuLapfLd`FxF(CsHO(%D3$NYXKEK3BaW(0XYtOb&hW-*?p0j-1x7h2^YAKIMziw z)0m#ypNHkS=o((&6FOzm_b5p?$u@;3s25ard9LJDCN#pYrEe$<-}UN7GKr@(2cwo- z>U2O`0>?Rx$Du2k=l+xZC)*Ua)^6O{#QnXAd?U>juFgZpLgeqjS|sHYZGfM2NVcH6 ze+LaHhl)qFa0Y4{KplL6n`gtJ`LXbe)tWzMKZIT7)m5RWR#CY4JK*Fq$yWEv?b}`w z@RcLrt+pE?+;#Dd`j~d(p_;|%sc+>+@{>bHAbbvwQo_~J)MB5s|CL||gj;C*^?1Ks z$RE7$uvK~Yz|Ypp#Qn-hE>wv?92RTTDcPx68Wd>)-x^_fj; zb?s}ywexTJBy?p-^7oxjbhZcpYriE3-=BB0Iu~vqe{Bx9ks@Adc;f|{{ySAoNZ*p* zM2ywImYD63O$>*DluFi(TNd+$!ALXwkXPRrLinje8_!*a^j&u^yHEw8R<0b)vJ}bG z_B3{)F1lilT>hmtgkfHJ1-V=lgW0B0(rFR`vZ)-Yi*A@>#5dV>m7VV6QrPA+kyWn)sjfyl)#a27Ji&s# z;`#7ayvC?tyOy1|+_aYHdDg3fU1FUlhs<`rBE5IsRL-_u+Jzkb4v5KuFLSJb@!`oS9uRuN57kaT-@_@ zqbKp?9Q=b7QQpa0O4rQ++}Zop4JUBHQ_Jbk2Pi@>7eRD~?7wTmZ*W!ZRp zF(Zf#Cjh_Jih-T)N3`%ZHiGW-BdT5e|8q)tkEoXdpGP0F`{=Y+wR#dV+WCVTXVc0d z4zfQbFeS9i6{cH-7zW^IZN-z``|H(KY>a-1uH>huEy6dj;+Y|lHC9L^XO|Im{t~+? zl>=dpUdd17$)%Sm1#8vsP5|GlVRW1cHu{P$-p?KNfrQu1RgE~jXL_&Ga* zQIB3=sR5Fz(#sJlI_#v&Kkpr*>KPjy&7)xpyh1lfisZ4VD_BQi3;^F^DPX};hwP%B zYCPBdwO^!p+T6oEcJCx>2%!rAV477-FeS$>R8M9y@gN9zIE)swP6~9szxnf(@37cW z9e(~R^Lf=6qc+c2dLthYa1Z6l>8txa^H`SQyX@d?f~)8k8Z$|sWOt*iQ<9d6xo;k0rQu$S*zgly4mc@&hEksjAOtWEM7Yh{Mrqq z$!z|S@QuK0XGGB8xj=Z}#?hZDh$TuMrqXQ^bMu-5nX27kgp&T;Z)<`3- zyMXNu>{oq;BuY~Fch7!MUTk%4V6Lbx~s`6v#zTP9rdknh#8TYSra0etNOUfyi zSEgxKulv0)A8XVLw^&C%JhN#|EX?6X$rc!6!^Fi=IXZTzm?+{@!$%9#CosWrPZt!L z9u*?AF$W_$2N!0e3vl11R)EPRXvOOkS^ezLNS5f>Z7zwAFn+*5- zX!k3K)&J##6;p`%eB42HGatvO%RF~qMk2aOtjIo&da-2DXN?t|+FawOSK@WRZ*sL_ zWvb{A1Ylcz*jpLm`*gFbDsfkxW#AOnK-H%y* z@2iaGKBG72jr*=$#f45BSF7Y4?|L2AQ8sEl%geH{NwZwO9($wq1Z-rZ!A4w^i)r*% zH1uf3zcfYxMBDA$m+5h@pQ>)j{P#3nTV6uJ=T>J2&vC#fy3n$_OYVRR>2afmMDB03 zkNwQ%=FGw#6T5(&%#FQVzmKlw!p*Dx!jR6}7nExSm$87=-)&UdmxsuES9c_@W~UpR zzx6jRwVH$g$N?|4$}R`_$@=q-J4BA1k>YV1Lo`B{G$<^-yxNue!zUXp3AK%9Jgf=p zl(gLA-F}D4-g{jvf%TMwwVOTs2fS~clm~bLZwctm8yHYN2OVq4Vx_ zr8%o)u3UV;6EcbA(QiqEw|e2xEm-A?gYFmg#AO5jha23S#ha*qIX9)tb9inv3r({% zQeL4!zx0Q2*A@X^4&1LnA2~g1_C7&-ub08Vmum4{8(8bZ!-__LH73Ak0SyE!*h*>; zK7-8M$UWuY#UE&_m>a93dIU}KWb1qN!}TVb!;wsE`gtcRsQhWqfwUmjLFBSY-eiWe z!-Zn;`EnUJxv(NVu{}FyL_o)Hj!0m>ZxIn#)idd_U_s}|NtK3(Vk^ZkL~@^Oj03DA znjW0MVYU&^vW;IgbqK)eqW2P35%`_L0LaY zHgJSh1mi|DZ#oDS_JHCwrY4~kH+af(NRdJbz6#J8tE-eYpBGK#i^(@a4HO>1Pg`XN z>QK`VCCP<7BRnH3^Rav*3+~*<(uyJ9opjvzy;Buan7%8$@hUXWY$V>$u}zeOoj%Y%=>8H!5`N z0Ql8TyxvP!Y`44D?s3i#@XG7IbNy=ib`itP+G}p$IsiN66I!STYVM8`&pg}8DOUG? zaeNDBNSzN{m`&;gRs(L}*4=i&Do5!r&nJ3HE;3LR26o{AS^ql&o`gO|lp_UbIQa)Gdrca^}bqX9z<#|m0=waO?zXV;h77sRak(P)`JGRWPxbC7E);ocf z-`p>l8t3T9U;g$Y=TrKQp{w)ZnuQnh&0-@pl9zg-0 zJEmhFyqSiP<*{nhlgOUWnW33GxBO=&jH;`TA<9mfbvkIScSN2}t!#ge%5{A80uJ6q zc|ba!e#ytA+EDFHo9JSSR|EdTV?CsF5)oTO6 zRK=)HL(N?g<$_XRI&GKJ85n#V&~K}O{k+a-qV=K2c1Me+J4WjamvyQ%*8yzpuaD>7 zR(+oo7qdS<_qVSPG&?>qbFZ%Ew*7Tu)?;@&MkGXq{2*rb9dPg1jY-4K^u2S~Q6~rv zg1`Oh;f4M#P4ao=thS*p`Kr1rV;1*)loK+E1~Z7w6VWoOwt~lhq>kzjaI)s#7>4OB zbP+3eM$6Q%;cQ6Z%7sv3xTry!j7(m^Ba*~jfeS$*o25jY=fjB7A#!>q`Ojw zXi}5NYHdHoL}xjBr;!W4C634{tK91fd{c@A)laP|mB^74J!t1tV|p}rII0z^nQ5Wd zXR@CRn(7Hifpz{VuP>~x;0^!KqseawaDXI z=nVJ6&FYmFzC)bsxK=cHi`1^Y>T$e0GkS#6?s(Atr7d`I5W$lXGZJf`6a!~H#_G6a zgTulfa$axf~bAQQgzp{e}~&rR{c z`&%UcU0F(}qaRkuTU`r=Q;)#B9Q8CKm1pngZBV0ye9Mx0%9_=%W+B%@o+sBc3qqc= z%$nIGWwOlin3UXA=i@UW{Ps?c`j(-rpJP47adP=m_4q=^3iV-K0Vh}h)HXoeopXAu z6?v1wZtU)K5n2M3?bfE~TI?_)xgvP=ob}-S(r`7d@98GmIQy(u(b~BW=n-wZCU4cA zTOpe6!~ z!lBzPG#yk&xgB5hB9@ynRdO7yN7k2uf5Xl&n%6BA1}uS|uj9Ur2>V~(wVV~X=DLS3 z$+PUF1w4Gap7>o3pd@ZNLZg0E+B`(oQn~qrm*ul`q{DqCZ?~wuX}RHq{dOL92Jtl# z{3v>{d=!x23hw*?ejX`)*bqnTzP}w~MVN>{d`vSO1i#&b0GB~$kU-?gUZqnD$UUP! zq_bM`h_$XEgn`o>({iNkq=n|UZkl1t@?E=to__xvZuTc7a-OsqyXfieXH5Uc<*55( z;0ul?(4AS=Hp^Qcyr&&-0`XcJV>Z1z3ka^?xb)w<{-ax85*OCh9b@zyRIl7S4wDHg z)GcOOk0@Ye9n5F1{##ttnjY{l<>(4ovP@`{(rMXp@!u3o3!HdvR+lrON4(p3)_pxs zZ(pi?aP~OReD2||dI`MvF8we6xKtC#b4vecrn;PVXlph#8sDV1-f7dB$10l`tDw#j z2K(8}N@O=iBSQ=yJ4{VTnllb=_@HFs6o>m@9$cj5@-*rkOCC1zXUOHG3Lvx#5>5k( zk4BWMr$jcz`+N^!i4!`P5|>Wg&z~WNEMp(5;UKLXS`6uq<(G_x7=*}TqBuTvq7zy_ zJS4@xY5NyC1?=@&J3wn9O=TZ3(5(%ywpMa4I`9J0*gOsLF?hdfu3r15`G%Cv zV7=_`QfLV2)K;C&DTUF$qz8s>G$vByqFT6-EC97k2A+A@@f6uTH`SDk>Qh5pEmM@# z%r7oAv)oV9$ARoo5AtdC9&2A1v-qRfnLD!BQ_;2v8Fji+wO@wIdF?kVD1fHa^(B9J zATtcSt|KZ3s7rmN#g)cATPYon?hDR6hu+^2#=t^pV}>4NN0WS+v$!ZKL|H@2^^;r4 zv&v=@ZL`0)i{m)cI!LOxJiV**K=)@!)W){*H56 z)*08l(XwapmT?WI+fKgATvYEqv!~@kgKQZM8zbEb!nVx*yv2-P#8epdoZ%J> zo@`RlZ)VwTeBc9q+-yiuexf@5%h#E zuKw0XH-_UnPo?ejn9s|D5~Yh~+t!4S+4utk*BZpT%h zn$^S7afZw5d+wbo-wLT@K8i^~{D`Ykfq_IW?#5_20aQF9UCq(A^^ z2OX`vf4Bfo#!hZqH;iTq3D#vXhzUSUd)9HW0Ugg0)q3lG>G`b-`7L#n zxeLXuVjU9Iyi+Mn0Uz%!Gm?=qOm%>6WdZA}`1rvW4};e}b;;DKF5am`S^iW=`)Elg z%hHNhDhNKqAMN;K(R^%8TA2=S`OO#d$#gGpXB`}k#;e#O{x$eSBE2Tr>TOpb&`O?^DCPG|Pjd zWnUSEO-Na}g8y>82TH~pHV*GiMTr0MgK^qL3x|VO*Rn3^Osijpx|?FnSQ+6Fkb*^0 zY)Bxj(QrTge}8F=S{Hw(yn1qCzQP)xlU#u!Y*c*Fx~d+JR6Ppla|7!l<3~shxs{oU zRKd4M7o4w#3L0>tPD)d9;$oY|+2kc+4^qEqLlAV)Ua!&Vri}aD1|6EvZ=T#NbIO!H zsUN5?REee9g>w%3^6u7tY~617S`tc7rJ^S;*+xIswgqdXD%yXO5I%{i@XNl3Qz7;e zcK?@;tdo$1%if>D;Hv*a)jNjA8FpR6ZDX5F(%80bClgL=tFf9!jcs#c+i7guNn@K0 zzPaD$dB3~wk2$ViGsiLK#<}-i>souLI0zxJaoUO%BifZxJ-vlifE^;7EQWhWH z2(|Ep5AG!B#O}%Y{Sl#mctnWW$gz2WlwDf8vEUar%5y`bA~bk8fiu2T6}tTOQd%ix&30!Ib?p^;WLty2Qj-S4^5@Vjj#oXd=sr~M z{?4}f2gUuTWsQa7#$|gE9(2#^+%gE=*Kj(6Bdh<{eoBn6UVNYj`#Dkwj5;tQ{;{W4 zJG4A0++FJz`pfqprCJD{^d%k&3%nsR9o#3G4jmR2eA zhoJ})RlU5c_DjTdGDHa5114}LDTkQ|h0hQ2^xElpQ4jX&QfPGB{lS1nGCqVnT$%|s zf{0kNDlL?}GXr(@P%&E>L^XM*V#N^HLMt~+kw%-y0v;j041RwCt1ojzevqY)t;rPa zN}h$S3b()G*Z>Rc&Cz~X)~lyz{~C=P-IFG^oz|B>XHZ+mG=&n3sCDrqYDFjjrt!1L zgSX3~dbA@D>=pG&h2stN@ax2A`emI0aECLL_DxDqkxE=F84V__T?42uqbJ6$vg%>G z_OejPVk3&mVy8zBM(ea>c7Bh$R$!i5j&;uB^zz7Nxn`8*5SsVw3G zD#lQL;mGjuXZFzO9R1c?-C|eWb~#ut;8Sbon3&vKp=sc=OR9rz(*+TVxp9leke3m8 zT2tj5XO>E(uc?^MR&6ZIxG{tk=l>@EHIc!^W-66xxneT@7!qP4u!RgS*TE@s*i4V! zmCQ4vIdM&{_5YZZ^iOM({lHd=g<_|Vgfn0O~j2)A|~k3v;U_va>hz5QJL)F7lYMH zy-FaRFiwn3Wkjo3DXq{tS~LR*9$O&d0vR&%K){Nf1x1UunJoG5yWL6UE7hsDkl&Gq ztVna%Zz%@sY`D$9%e-noPIkYaPzwpR%oEGf*H3d zU9=u~?@1n|<}w{>OIZK)3MO>S3!WuaT}Gfpw2Z@sa^*eg1+nMpi|(BZ2>s=?n2tx5 z=DZ-lQ7g3aM>Vn$fCg$Zcw9rz@+&WO?&J!y{vk^Mj)5K{>p_gw{@5YI9?X8#OeqjJ z>@?6^|JYkh8(ATUL_8&UZ-eD8{x$PH-{OaYxUSuBNi5tI&V-@_l zkNRbWU3HmGJa;;6DxaT4Vji#A{Bek_Pzi5yc2EzWTbynae`yZ%5TBMdl=WCiYYo?V zC>wWhV=_eqPOa_!XbFp}Q^lBtf0Q@=nH<(Ac@Ima@=3qod{V%8PkJk}T8!7p$N{LW z>c1eQXYG{_B*NgPnURv5~V`F{A7)(X=LIzqlDJ3@z09~SU&kQ`ZM6z}r{XMB84Qp;?Na>%h z7z@wpvqVUeRmekYa8g%=PryYla3XCP zKdd=0{;ofoBL!o*Uw~NQj2qx6&j(G?%{VzykE#|EC~BTL!q@C$mmTBo1tZ0`GfoL8 zITh|oolKdzc7zmpfC*w(SZQ}hLBL@omC2q<(Sk{Hj%k2d*OAfAxPk~+px}7ce-0Y8;xHi8?RQAb`zv zR9CHpm5CFK)uAz!B}1xzGC^-(#FY6UYY_%9hgdhLq>5r*pi?D@Qb89WS*5>3&J*_@ z?7smv64Av~q88!5ab!#>kv&1{i&~~8!Tq_3)Z!f+BkW>ipP>D&+vl8@6a!<)=d>2{ zEr)fELbmimNH(vRLUUlTw4`9&hAv_5%~O!)csNm&x3xb$`7V~MJk2{pcC()-wu8t|{V=4vh+6EU}JUBU6U;iNY z^754p%iThTkI(yb67m*VPbu&sM$dLBf)4YCeFUtOe!!IN4mo{u3j#hL10@Bx2tw#w z)4!fTvT7O7cAzqj7Gc=RDN8B?ja0P8;e;>-nuSk-wKWwtEA5MH*P5bcW@ZX_g_2b1 z4Z1SBy1GoF4>L`Mq6z0BwP~SHzma#k9M9rK!Lb==rt=CuHrnxbnI&3F{AIfC9n!O( zWAaPdfsFUc%JG|H)nKfeI3oCWoX0P;7d^bKIuR_%U3XlvkrqbJZb#e1(-UqOIVISr z{VP8JS1j4g(geO|9*6^}X7GoRRG(cvoPKN=AU<}Y!AKnr8zvi2V;SK}ZK4dzSpR&2 z`kObTW!)(qp&GNhMaPC@%txclHMdi_qS3vvs1ozaD{{#ca}xB#4ymq&y4DevMAPci zn5QZus%V?NAR96rksk^>Tdd$o*xcMa z+#|?>?IRryZ$p(c~N$n0R!8L$2fI7&3|fpmVo=kq;kI~!`^r- znc)+;Oz)}wBX2T;j@ykQIw~460k?1^(9F=#&8YP8o6GjCc+f`s<5fR~QjPUJE%YHG zk@NW5-^V$frSa^IB^L8qlytpz6lPxDQLEyt!Qa1s%jf{icaraS*S~)-`wIL557OAC zPldRn9<~atpk(P9G}zOli`@wR3>mNp!I%AGFVC5s%s}Pr=qJ_t-qQ3_LS-;y8@pF= zpP#cB+SsKgcr9v-eD;s<`SOQ%fT(5dskhUElT-UiBo}%s>J7%nxqmqR39z&?Y24HKgR;%@i_ zUuGgB75`)!FIDMrA4c;WM5-vCpXUkEfr_P^Ps&>9@ycp#jgsn>D(ALLmOF*^j|pkW zFv4eQ6Z^<8N-#Xp$^JEG6)Z3n{z6&YQTw1??HWI#zR599_DHK*t-V42D~7l-&Y>mcBV(|Zo}trd1Kjlc7Mw(uA$87XKidYZcPQXdTPG%r9_3(&%*YA6WC}78rN+2(RA8ndGhHQ&BOw4UG8f!AjUVlP0 z*~Qb;bHYB%ZcNo)5Rg|~bm9~!5?cTc9ZcvrjWWAmOrzCXHw26W7acs(DG)-I>pxHt z4kr9v;^!3g2%#4KTM37ar*?c5pbRbEN51te^^|ED&tSodfe};YLH-SulBWtkgP+;g zR<~A1K6#)xgB+(`w6H(=hxB<@MCT;-Pr%50$`H(XLFgA)q~f-G&H+!O)(v*rv(oQW zr)n%5Th+piDZAA&%|`VCzu?iz_gU0xAF7;+Nu;Z$f^)r07d*nnloh<4f64F43#<%B zD5(+V$UhH(gMW=r)$~|alJ2b~`D*`fbM1SY(QG^}`4{8?Fzw?{W|H%&Hp(Ypg7*TOUggNJ=aCP%!4lK|n)7f^jBMltHA#9V} z1&IPDaz~HnYeQF8S5EC@F~Om^;&DyD^~UG+*QF;-Pg`Sw-CYy%q@c@*wv3cU#zWVL zt>N&^eg20xBtqv5WU6TXH3`}MFPl&&!a>is<}7|CDI;On7zqmEinDyu!Yh=^GBxU$ z(Qzz85Px;fwicvRPfbWOpuU*&wc~z0ANa%j?v#p*^=`D<>5#bt$GsX7<{Z6Ki)lBA zM1hcv2Yi>xzOF|yfPmr8=&M^%*%O?zY0wA)R%8kP$YRUUAT zmlaJuJ{EVEgAu1+;gI^?f));Rp5vKhBS@t(+FVR?oVU;V;UoAAD*;hr{OU7aV@hsX zX)dktz3!K;x}Vp1Wy-!YcD@bG7P}w!YZ9Lf+Bb*X2J33LV92+8)WkrD#nYK{Pn_ua zZOn(;8yminfD@LWh~2d}Y63X{0qqlO&5{Ed+zas{PR_LJsjbz1hAH{{WJZgYSvffx zYcMc2wa4vFs7wvRIVL@qXijIQjuN@rdAER6%#bZ`-m>*PY3K9tcZ+I5Ro=r1*JK(9 zC|}U(@L+*}fH+%gj#;UO&Ed@6RK*;=n(^p7wp$!~k2&NPQiU7c1408Wa7o#e_fj2wVvG?Op2pErv+55h&Til!!6p|A^K$^gq}@&P zc~IIYo$s!52%N39hZHxRndP_QQZQgXXa(jc8c&}6Fh@dcVl!!bg#U7r4|VG}nb%0F z02oBR6!84U^H0U`oF|+onp|pakv_}mwoh>&G2%z`S=meX@NbyIaAlHc9ipQkEmO5} zQ*y^jJiK;AD?*c)auTs_shdd=zxk)tbg&SV@=co}p4=)tm29x<0qA{{4;Shh%npW$ zG;Dyg`5wz>-q-c~yVb>s9K)26`7j|vRgb}rNqy)=-RkVM=k*z`x7?s#21l)(p^@n` zX4aSO$Y`GDlhI-EQK8Kj%;s}T!;}isidCgC>UeRnOI=K{<@s5BtU)UL$W}N?)66+@ z3R{7Om^ZS7;M~;>ckyA7-##jeGjj%jGqHWERf2jE_e)r*R%ebC@vfR3QN8xs>2X9P?N&&EVrZcv* z=e)kv7Bx4tM10HwbGJ3g%_Ll<)fDuu?W?8`Oc7y`0HO&njLg>vu8dMxr{ZEYJgoZ( zm6?eG9fA(?2NlMusK!{UmV9UQwv2rc<#wQYW2~vu@C9b(!793wS*g;v!U zwW#t5MjR4^2rnIJB$^_){7?0Po(3oJYWAcz$0Hx_!7>B9Az1LK<{tuNLY(Vmw(hc5 zr@OSaFR0D@bczNyf0<++?46TXL9_X4f=iA8vA`CN+tTDeu)Mw@AXNYOZR*W{Rks>w zjBE{&RK(uO>gYwm9FF2)mh%n`6888eW}R%A;y@LeOWBFTGli-$wONB8h#-9yRbc(- z2h-$!hH7IB7EdX~$5dxHkb0ErK2Zv<@HFo@c;Pr&sP#{H=vB45?Vp3nU2-{1X5cYJ z-wdFVSh##2*8#2|fq`-mpItINQjvX_k}B<}nso|R(tUC+Y$^z{WZ^V2Dw;)5P_cX= zA1t|NTz33oPCmv;Nl6KgPO!Ype+tPu#~sm0?%ha>Mox+^X<*@QUG*`0fyvEm=;KK- zdahd@*9rI+ufHT?zeUpV-7eN+>^u*RNKjHX9b|=VCF60iC(;J$C~kdQAC9;m1zO_f zG?~oq!v{%vOHLE&}$OfR^~xyS=o9PF4w7bta`w7 zA$5ieqvLJWqJnJEcSf+;+hfYNwS3QXr)gg6b`_7Ihn9}0fKVAU4~HR=BltLuAC|ry zVbGoO_uGct)b>ir2?3<{IHGzt>p(y&1ify{r$YkC=NL&UY_yQsaEK7er_H_?=gC!o zR+s5#QqlS}R<|c%i&v3AT-3{k2gV8F*!)DM5BI7gUkH7JX%R=P!&is4S>&bh zg0G!l)u$Nuf3Nj#LMe@Be366~( zcTT?L&}mnG=37=E<^xgqe!3k){N!~v<5Py)g@-c zB3U$8+QIGp?D>Lg7Ya)F2m~K()d>qKKfcVEDp7ynBDAfuk1x#-Z2^k zi&|U1@Nz4)4M*u*BP0x(NDkIPe7vX;nKO@wLGc8a{4jfVW(BDGs!NnM`k6lj+R4VW zf&elmxv8=D1afeSd3xgB-QDFrOyzTDTm-(nyri;OC?49%IXuuvFL40UWmSjLuvhva zV{E-6`Qp#dHvB>xbu64Orfq4XRBU+z7Pc!$6tJ{y(Bn!$>$Dv#Sr8fKrm99Oby#QF z71u`(EQ~-Flu9H7obkg7j^aQp$yu@Wwp+SPwntUPtWIPq>_d7bhfSY;XbCooZs;h< zz}nhcE4lZKi38_9%C3141_q5Oc`v%qFBSz+`Ei^c-Est!te z4cp_ilZ$+w=?r#Xou|lII&D`QLLj^l)($tvJkE(%MFOFd{CNmuL!SRM#oS^WPGm+* zpR624(Wdne!>%q^f|5s)m05Z_J`Y4^d3&CX1g2_R7{4UXS+d94zNS)qc%tXoQd48m@S6gA_w2Q7n*9V@o2!{|H`lnL!B&4^AvZRY%CxAmFq0ny0;{)FIr`%L4Pd$ zvr(OtV<-NxoODLAd3}J@1FIT~;1)oVzuv&~_)MmR-vXOD%m zIc=_npR_xDJ!t(bA~dIbU4-XtI~%!HtEM&8Iap#G)?t1C9SbK;6Wi~R)q=Np_UjLx z2RV(I0I#K)@1-A$2jnft&b5s0CCPH{w-u}Fa6WZ}WzYD(fCww|-Ts6HQ;xE(Nb}oW z0`9k+qlEkiivYg$p>@!$Onl*KMtZ514O%UA&_G1U(RpR8tDE zTgY=g_6%2f%JW^l`yu7K$(qo#CZ3_$N7~ePiGX;x#IKUA_*Sc=V?p%w>uxu@l1Z2fMDbqPiqiRd^ ztoIh=8jsw7+AH{NikWQd+K;;%nGu@u8%i~jeU+QCM@5Lz&|6qWm4Q4w} zM3TRTW;_jRwaA^Q{Ts|$@8(-8^qI?@H+#w|8_hRXPCY!{ypYd?Pzg$*Z5XtZu_#X7 z-rnY|ISwYXB3ORa*0M0R9g!*uz1>|&y3U1{%>lg7=p+heOkG@3KOjz}tGq28zh zgFK;(KFgdYQ~QF2;E$%L-*Xg#ZlCP66%u4wTbDwB1N zPAD(i{1;n53vxmcmxyE{i(J7B;KHY9&qj(n$~P&(4=qcufToFMN}M^3Rk{&{$rz(l zOqv|1dQ=O(ENOO>o|I-hch4Y~x){|T*f`1A9`)7jl`g`XP7A#B{#ghy&H3z`Rn4wp z;2ieDtFSK*#(z<}I2@Eopmab2dy70>lI&VsI$a3K*Q99z8utQP&@ih5sj94z7*7{+ zwDNwTvUJw%LQAe=sJn%A6uO8!bxa7UgWA5a6-l}q2N_D$YNqb+9ZLA+*4)fAt*uxd z9keKcNXVe}_ZC%x0ro#SOAp9dYI*I(OqGp0XQG>P#i10#8D2APg$HJD=r;)8Su_r# zx=qvLKk@_Kxyujz9F?Uyy>*9j$bH=hEfyVD(xFWApH6nYtriLD%Q=wkzaE53s4E(< z!qBP0qiRr7fFY-!o)GuZa9)2ob9c&83`Xiea^Tc6V2Oe0t{z&@yy5m0yi%z`t2Tg; z&rP{{srBWgoac7DX|9I8kSO81TA=W%?fb`Bmb(wZ!b(%Mv$@-Xt@cDb!`S!Bjpgkx zO|>kB8Twyjwn3e-lCUHlGzRFz!swzuKgn3q2*b;ie4g`0+4zaDz1hA`T7Ev6dHcp< zW}!)^-DGB);QUOblb*!`{z;3<&ch!UFno-7Ti%~SI9-b6iWM<|P@4n$ZPXn&&Di>6 zq~|XN3`eG=E}^+R$+?BZlFjkD-%V!QL*F9u_^at!*PK`WQ1&8F5EN#iipJ*TD59%5c>-Em!%cV@H=dU+i@80q$zE}OHon(_uB zgzQwgIJuFWQKBnYp8w&6Bl5b^{)Kd|U|&HdhwWf)x2qU57f9L)-crO@$I$w#a>R=h zUgmOHS+S(;=Va@~!%d0q@6R2qfrEvl<}{R%N7CK)fh`|tW*yIAa=lJ6PLrl{JLC)dksWVSh`! zguw%eFU{d=(kP9)=r!bI(E2KnIF`}wCso=Aw=*JVd(g#N=Ai+}jL~B6bj?=c++{XB@OOeaiWUv=qhK>qBP!vdjS~mLi{G!F|Yv6O@M~Q zv-Q@5fPgQ9QD3FDx_sT+<@KKQPq(v!{J6D}a{)tNWN&Vz?bj4Vx!Fr3=^=Zuvd?vd zkJw$_5M!@;?+Gg=kO9GeOH1vHT@@hAprBxPv_}|>Sh`-dl+#1-KZ451Ks)Dmm@w`U zo8YaAVB9BpA*?LXc&hTBh!! z*^4`Yw2VH@6uo!yV9_A<5CB+T|DUh;V}_TFs=_0D4_yhkx#0%2@%5QtX}JYVf><`I zyps;O-a<$Q06cj&KD6K~;U<*7N9V~PS`~JQuGOHKLS$SU+(SECEvx*RJika{J%Y4z zD)B1#>z+NW)obkWjvIaHhHciW*S938T(`}mmT|O1QQZny{jWzL{?a2M?FCiO!;v^* zzy;Zb#8`Ek>+wYwOUtBbXnbQYfL}ylQ@-Ad|2;wr3P#m0DpA#UreyfSRp#((p;T#5 z<S<8zG)Q<-%!*vAOin*DY z<2cGcmeW?eam22W@9=3s_$Fm=$&Z~Dvvad!3hJ_CL7L}T3)oBX@_1$+*08)}VkE)R z2Icoy58prjp3=jD{h&FLQtI~iI)m-HiqafWKX(zM;xNCC%Gc)8whHa~U-lbqEI(d7 zUhYqEx@rOu$f->nu(F;rJ()E4D3ui&x!LpLk)+qUBLeQmZUx+Paei04p}#;UA~JrR zIV*J}2u_eD1`!iQsKlqpHB&0suZxy%R|N>e_p~t19VhC@rgT{A#&2eYxv7rWu9<^T zX@2l@dqPR7zmyhK*wWIXmsN&@gjA~N%hEGlW)z89;OL~%k{C*&{HL>&B0h?peQ~#~ zaxcodW6)xRGKe9S*$I*xZW?ZsPWJN_Zw0|LW5GUb@}zT`mM6R(f>%Qy8eAfJi|jV7 z3_!JjFlv`J+p8X%uQvMr6yGXbTUs+gJ^%!)WtBo^@h$sg8vJMzX@-*zBhKMAA6Keq|wM7EHHB&5_JS)No~6M0U)e{uxE;XfKq%*@_0) zaN@d4u5-I2zWW-%Jw=<#B4mtXb&jv*o13`X;0<=fsDAmZ$%iEhDVhNNVPW@?DiY3w zd-0R6N|&UV>VbzN80t`NU&)8{E*z%dB(2MFXyKxc~gDcMj z{a7Ta+%;@GED?{%I*Hi*ZWgp_i)?Tly&Er2>GY%mcnV2x3d0kOw zJYA}`*c(=xXVl;B%X-JfVo%ZUyiIO`@m2Y2_{e{PDdCutJYHRk)N_1GHUU(NOk+QDz#G*VX*euX5e#bO(d{_t^d+g4# z=eXb)k2Od|UBWhNG{XpN&M`^zNn!7!UtM?}&Cp|RU&IF=d3Sr7&P9qf1aVRIOZ_gx zk@p7N$@;Nh%aq99Dzm|}?pb%;m1xQ3KWoe}nwn}kGk6MZZ z5L#8?L4gPcAr1txbY2Jj)W<+9UQH0DmXQT-4MT*-55^7e`#k$0WVe_74^|ZDxG{Lyb; zeDn6uVLPhJsD(P`(y}sJSKYNHZqqy1Ci}I`vLgm4M51M!A(_jX<#r_pS=op+mwy7< zkoi-tfOA4ha60XhW;8_a7{)@^@QFBmGSG&;yN!e0A?yxX`6*iIO7=)^NQAh?7Qsq8 zZ!^C$eyqlN4n9D%fO1f||Bh98hK7(P6!Bg@l9YZ01>c%x>JMJ@xA5YwUG`ylEYa;J zdyTcax3aqfQCn-lY@3EOJ!VqL5S7m=rNpvobmKQ#8ZvUB%+bFkYsSXsf4{8B3$K{$ zuo%xHJ$BQL04zND`)0pBGv0L-<=igrB8u`|y{oIaYxCwbu_n5VuM|6%Rw+((Me4(@ zz}Bf3c;=-syzaVtBru-!RF)0y^B_<=$n>5@aY&cij5uRVgx^8ioEo{T9 z&-@icd>l~zdB=5htrA-IT-uD6`}CZ?~+##CS0DG}rC-;YL_rIb^1dy*t>H zdEd_Ee6&yx)4A$v`fteuBu@9H1>nmOGyj?d2w`Adr7Jyq$z6F6>qAc@5e&f*f>hz- zqfgbOg&efK6Sd1OYcO~#LaD; z!HszE=MzFDm5bEVf$G>nqtVf?YedE-;;;+ts66$y3+WH|Sw_i%67LU{VaKJUaf@j9Avzi1Sq(5T==# z89OIuleW($Mx2+X{mcUqfJWkQGRw-+(sFM3@1N8M^RtbOkbe>kViSc7I|qrGmya$n z=?SqrJEkPXsOwC0U`@w?s(ucB5;hX5X_fV>wSEWu=5HSSRJ_0gHPK=ALpl!@NLhsL zGQmISNbi%cM`sAxJ(;2kjAhdjWDs9`X_j*^VU4`MRG^Y)pc@r_{;6s&uGJ_yXJKuw zLc;E<-(e;~Q4d?M0iby8K|5}kA%!_m(kq6G^mnw8(wvLyvrl6mVYQ=bmwSM_wEmdU zEBdDFf_-dU7D~U?&Qn~whA*r0K+`cOq=0m0yUvxb_ke6QA(1yOKi_cSjHV_z7=jw0 zMK9^=>$|$k5SHHCjqnG`M>-Mn_>|Vq782b*_->Wf3Mbg_u7 z;%5u07EkMrlkcX>(X@YCTiaXRrLT;LNDt0U%fI10EE&?FHOh>|txl5UEQ>8yaH*!C zKF_<|7Mi-$PwQ9 z#Uhf2vrMff1$rW?s)r~Yx8@C(b`P%%xZ0HqEy&#`8}X0pwPBF#wZx#8$brO_6hh(j z^6JASvxki=Nh~QdNC(ZJ(K5z@za#e1;vL~`SYkc>==_x zN-rJduX)}t-KA`$xL?rdQ4Vs&^4N|9NW)+gyQELy>is`6Q9#Slgbmm#|9CH3q^ZS@ z(%@x3lW@&;4DWI*`(mO`y%#?USlBEKELqM?6cR6t!D8>e>8Ca5CKXe*EAj{N@VX8{ zc+-_N`Gwiu;+ck*;*CAJP#tfXlB_+gY-If{P}7o4GrF4iA;{X~es4pL%WBoc&e~r*F{X-g`;Wl@MFU@{rFY83-anDD3U(nR zSu&P6JYXgVhlY;(=fW47brxj-Aw>fc<8HCe zO{huCkK%?KNY^!>JRMd=^Ep}}&2*h#Y&ob|c~&;nNvgm>@xKKkg$FaQt|<@UBM){j z@#Y#D>5ob9a@X~?Irj7Rz9%aOc+f{Dp=Nw_IF({LZ9CgkCqES31-|~{^^V(Qg_^RA zp9)hf$`WsaWV>n9M}v=f6d+PSX4=QTw)6=5+}U9LZ^RmUC3$t)aX{1$@LDefe39VM zLe&=Fvo=V>Ys4?N3G()VF1%5?)e10?BmU%36Z6{>|5^MSXKJ|pnl9H|u7o9UAx?<6 zH*&!o9f<2hj4Jw~0%xBNjSV~B)0*@{vO+u`gp5$?`s<1Ua=8*g3&tYNCBr<+4z#go zRtFc*&K27a*R9!)+VaDly>$vwoq@g(nn4xbXAnMndsTzA03u!e{`3l2V(~dv!Pf3? zbmwlUe*7^RJk4t)VxLIVhk5Fvqdf2(sWuQiK>nw3{qU70sR_d3zYLpcU z1$@_2qE3o8B}Gf#MIaHDz1qm>;f9|w#D-0@YLhEGjz>ke8d2881QLVxE2|68qO!NC zgQSzL5MotxlcX^`NhrR{8r&_&?$C1C@?TUI^yQn-h*25W_gbBQ^FyWi8EyYHi^Phw z^3Vm#@|?$XE-5gyk0TQ0O0P_n*w-X`c62OZ;rMnlI5)kk03vy#GTy;zqY2lx{-T`1 zs1a$`%y13++fn2$k#H^nP2(_JO#RbCJX6?ifq=z#9I)rUyj^NNV z{-NK}&QiAXvwupWmVP8vrSDi5C@N-x;VhUsR>YuF^Hvr73*x8RMu?{(GUS7Acw|qF zlFWYLSH$zEVf4;Mu7Xm%>V}Xb4dZ&Z6klJ3#!KDD4IYlEkFFm6kMpUXyVtL)(ZZ-P zaDuP4461H-1ckj!kDBoN+%%e2{TnnODlgt>jO5q$=)fx|t;AEfj2~oW%z%Zu=_+_< zMgPR_CG1s>PI^>!(X%l`$|Aco9hBR%F;K!Z>(dJ~PL7=>2pd(r3$U`yxwglN=@|Wl zu$3yL+-{^y+EE2QhxG3)vVWheHg_$B$kcx>`j?ak3KZg)gcRv+Ine@ksVi0NN6+PA zVdPF)5+^ITgi=RTjkA;VI{g|X)a=G|A6x(=TCLVdfpRaib zDk~u4Z@P591Vo^Dgnq09d1@d+_iYlZz}ztS_K8Fu0<47cdRIdN!mXvQrE=r`9{E`y zfnSFx{(JM{Fm>o>kPTo4pX;_EPw{rv+ylN|!zr8T^4CIC+vS>U_3|ase&VTGs~s*& z(hbj(51TbkQQ1sW^nGsqIhyVrHR5b^_9A%5#oWvdS5)3)FC4^OPLetTz8yJdJ$GMJ!cgxG_E<*=Ox?Vg|hM30_vN zt>n{>U3KFSfg&G&c2wQDK$t5s6jHgMPaRXuqVUS?^v_dXg)oej3LK{ zHSP}XKpW$xf!Ln6l9L7Z>OofAE@?}UcI|gp;HC^ew#j^Go|>lmMRyq9tTcJL$7Sau z9<$*m5D4_woA>|E%_I<&Nylt;Iohp0EHT|r`m3xv2x0!Y_^Gq(+uX>jPO(iCQYo_FlRN&i}>@f{k z`ZRQD9a8n8%cOe*xj#_#MG*x(UjEY+!ISwz5>06SxcG_-<@4C!@Qx_*SJ5CQok`)1 zjFR79ZmXgK%jO5?DKLV^ig8++8zb{{~`DuH(5fpOgi}j^@ z$i(#%t;EY7_2ZJrFN z;^fUIWL*iU##Vp5iLj>a<%JNLU;h~x&k@Set~XcFw(7rl`%iLuMnq!ZZYzN^3O1CN=ZNgOMRiZam6 z0;4)iZWb}VoGspUx}cRY1gQND)$l(0x)JE<6HTgvK*d|Bk`Vg3K8jKAaRotevV3)Licr9fSU>am!to~#yy@Z2D7)I zvwd!4%qKIg#MJ|PYPPIwZTD)2h{R}u@3JsPOwnm5G@kw@8u@{zJGHNpU;pEr%gtb3 zLZGTLQd{je_jMWRppCvl}m=~-}_spGdKYXI?psaZeE3Z zBW06#Q8^1F1+!=`abOb@`s+-rOe}1ZYb_iyg-gQ+%ZkiVIgYF{3jw*6Cat^< z0vmCrSCp(H6R%Qv7Mes^0m+B+P@&8VMHWM?vokbO+bXfZQMYDSgSJDMJ!PR@KuOky zi4V^Z0oxod~fcbE7L5>ZS z>JwF{UyQH0lc9CdI4xCW3tVS$T;CWUzbI!TsKFl}3yMryDZhMs1p%-|STXhL)jJVj zNAG>JhSW!Kf;!(;XGN{5HB7IX7Z80BA$Y&)0 zO-$u|S?XEfOeP$Hj}Z^7>-bEjjdi?eyQRoTPKr)UKoBy1<0Dap64-OaGrhbVYPU9? z&JjT(_UjWEdzzXr1$e&QFRgU>@#g&1XSCC&vLSfTmJgH>NGINuSIa$`&jJ);xRyb6p6dKIEC0c9!A;Wy*n zn|A<(5deDTr6dx*>9Lxi?R+gh0ZN=*M|Gk`QKPJm(r5{BCX09F46yM+S;4|VzlQY2 z;brG?BXvc7km0PYQNf+1pGbkKJf{9x(*9Qw;loD6xI}?=?KXtss@4 zjY)*xVeeKyQ=mb!5k}vT68LXp$TnvW;GY#4jX?|Q*ZjXEM{~$Rt>1c_k54*zCDr~RV0+N6>zl@nbedc&J8{sIWH_C4z?OYfQL`z_hbbF zi3TMGUf}AYN2ZCu{(l1nN91512Z{#DFz-4@%}SekNCe(La-hRp?P-vkrq=fBke{wc zld6HN44haGE-5As;IB&WoHoA-v+DPlLt3oa7;M zxcJ2F(i+q}LtH!&t3|MGAXQpnNq)M0;NXi$e^oc%M_3a2G4D9IG8--T0`U9TBHZ3J zczxcs-(B%rA0mtC97}(>CwKlj92T=TJJvmwIFkf9)ul>Io=wKy@rkgo>3Oe@ORKKW zd~xr(@aT73br4y&pWK zNpm8>A#|5sYqmkSaMSlXQh7;^90u==xY{$g*!HK|%q!ZIIIcX37i&4O*s_qXj(^A+ zvai`bKh!!%WV87b`o;;<*CRrYT~Ja&eQMI$+PZge@MDsV_5VV#;LATljk8qrc{O%= z)j8Wb>XcibjTXdTJ6Fe#HWvd8i_ae1TYM)AmTtM;sH!?O9@vGYsqN_W;>q1459scI z)&zQrmTz5+V(79T6$^K?Z49&H@gU@G}>f+pcvMG5)yJLBsWC@v+>^oe}>{NFPPO>Vt>cVFKbTr^Wz2WQr z7Tx~T6dL%GE63~SlH0>x%gAmR*28v(Ty=h&k1b{n!!u^HE&o=hA!V!Z{!+E@YBraq zvD9RYFz`!-OO#M-mVvh$=OtS>Am*;WQ)~PohTJts6`tPDTV|AF%?>aH{8Q;zSXwRexK_+HIuh6RZ|D*V~o*#I9lJLkvu-WN2aTWoLJh} zMaKy+)^Jw81~^T!y;WbzI9lujQYoHXuCW&@x5Dh?!Xy5$bGDq>y5R9NWVT?oC$0kU5giYcXzi^DDDoy-Gc`Y5GW3B z_Bs1}d4E81t!J)T^URvLg}_(2(+534pe8#b93a@@Vn4bM9X6w3J;t%zZ5Mf^cyl+#B~B~ z_rB-wLx|e`g>$fo+?yM|gI?W5Ze?l71u*|QFfbOn&li2TC=*WkYNk__|q28bA-EMF)1UV`@T@k~7~22ZSBFd{x3 zPjs~!?z}x)sWCB2&j^GxRgiTMTj?0DwK#<-C9U>^BZA+d{)2jP#i`?Txg${v;ij;P zg92p!$Bu@6R`Az9$)}%=)>0P(2Y_VxQ{i_kucM@ZcB8!SCa9!##LLsW+oOg@%>c*U z)RLzNK*Xop+^RV4nxDu0y^zabZhC`}gA_$jDitEt=2sziu)VqsA(NP=fDL}rp|%WBL;@ZBTCJXT>aNs{oCGmiT3XJUZ4xB)09!rRueCNJ_HRR zWAVB*P&kY)p#>*!JmblmDY^7-!3I^F5e`Xq!Te+P?i`DLfwaTS%0u{eBMNeB_@W)58&8?2m( zfIBL`eBr`WM~;r=mTNEUZ>ei`eVT>3LW!DjIT!Bn4&0EG^;8m~l=Wmr(H$Vvs{xX$ z^woseHDq!!5l1B^=Bo91nIE;}LevZWP)(^%IU)s+;4K1~8OlH-aR+1JSbvHzvng{} zKwstZ?spziZzkS23xvN{!nWQn86Il}*rLt7bS{e+kSZ5+t$T6E`I2r3;0>MVLuckL zBBTPIrD`s80vUMNF(4l$1{5yVIBppesTIgR`(<3uKhO*3x*<33ct%kg>8 zVKTod+01gfP#_R-1?bGgWaoKx;P2%&Y6L8lXbt#8CXh)XJW+Md{!1kymXakMvNwov zbvnuo9Z)P(IB{z%!SdZEVjZlVc^?)j_QAvxh{l_GUV-!+ch>lGGJhVpq|z*6XqWtwQd|m|^>-_aOJ?`}$|+v$iu{ z(S7hto$+nk_fKbAS$TTAf84KaJMKhd&1lhfrx3wALHMAMw3NH0->z>mT*FM6T#bQE zqnl42n?DclyZUYz1-N6z0An{P8Pav6}?%J0Tz#rvAeH6ih%O(EZ**p zY)9e>#>(G?`WnD~pJb@LcN@H%L0d}7i*{TQ7-!>Dy|1`lqP;N58{XHC_}YzC=rDP! z(@Y5><1&Dj*|JgNr@Kq(`?omQn?>PX z&q_Xy2V6cmAg}vkO&Y0~iE8p`xZcz3GFj*kHIEA481{Z`2Im%wItrMoZ0kEBW5R zVP{^Ytibl{vv;r%%X6S8C|)pN6od5{q4#xzle$NnUFW~^l<@9;rvV&`i%qM?iAJ@y z+mYVnSmr>`xbMTT1IGNrk)-by4Dx2DV16(fdpiAh@^>2OD51n;q)mmhErTTFu`h^#7kbw_h zg$<5@Sxx}N2I{ubX&f@$Y&L6(Upa0Ys*A@#0*j|oddS&{_=Z#zykV%#ydwMiXwB6X zMvWG{GR^dI$8Wxv(#{CQ$j=m@^!>Xhx9~Tmrc)$AtR0w$+aDrvjjqWO@#I1!f*U2_ zPtP54H8&Kw?jrGI_Rh%w>h`ZR^v0Du!=uwogN@ea2VIh(C+NmjO9H z&)}<-;BM$?%?58@S;Ze4kU2KhQ%}d=ix@AQ#w{+h94!o=?N-*0WyW1m@#vTRE*)}E zNOba|X2lPzuj;g65_!NNuf>14ZS6HS&mh?`7ia_SHp&zngf`M8rRYtRo{YMzN9|{B zbB+*09F1R)L9P>(pF3zZp)Ef6&tDg2{`O%K@A(YA=i70ZRXt74=PD4t!&TD3AqWfg zPhOZ5vuHStnffisL}owi_yt@3Nea5fK4QYv7$=1PF-L2@RmqCc)a>WWh>Z8^;D-Zu zdaGqZ;EtftIw|iJC}f%CPOxPmHS(>sS|vO7J(OEFrq(GHYVCE#tpMoLKmkk_eGw(! zh(@>Oyts|Ybe{;T^*;L$;JVVJ{{|2w&}CsbR-Qf0gbsneLDl>PJrg5Ga;?Mg2u~K) zG3K_>Qfmh4i&XT>8qN3*Kp+zfzWY2$svpIPkRGqEAVu=YuF=3zi@-->88YrT6N5i8 zg_7X;|J$SVJRo(==&K~hq36j9++3R7-|VD*_w!aIhxz;iZE}Gi3-pBK97ny z#^+lRrORQl(zr5V#L7d|a$U1EPrem}E!pS8SIX68FLSw#e*!nwy(0Py&8+q)S+1=p zfqP=%w$3c7D23!}RV9?PMc)|x=h&|b!ddiWk^B4gUq@B5$`~5CF(dwJ=JOH8gatR$ z=rh}V$fwViL%Q+-BZ&rlL)yh%v5TAU;neUQ#q@ZQJ3%fHleTs43r?LNV7d1&1N`}I z5Ad4zLGA7lW|^4Da?nwBXmx#$HQ~fR|2Iomd>SNMlin^&zWjMR%nUR%{`D8G+hw86 z+8woRs|ig}z=c&RnGgJ`_oSg8*FGINV3L#ZWX(x=`C7p1MDC9bEI`YlY$kDUEC$E6 z)uGrC;3ML<&#>Hu5oMk%W;U|WTl|YZ?C|ztfs;gLgxTB-7Twt9!lMLxn^?b?K}@Zr z9BWL4C;jVq+*++s)5luZ@LR<+U!MAa0wbe)J@rR6S~T)+zzI3~UH@4pYq^~<0vNs4 zhKh1aPFA5ie7v3{B{eguSLt|*^HM5)Q)es3SBU822or|e^t)fde#Ixry>4WIxDD@% ztcb^*g|Cr6F?w9zvi^%T1DM%?)Y~h<8Xr}V%U~;84|OQ zU+`6rCuOBkaLGWmtWDVW_Dg#$`l!qJ*AoScFt4}N$+BX3-U$I8i;FNCi&UIink@B$ zG>y4lqXy^LY7yaaVB(Mqm)y6>z^3$;IE%7Nbea^F_3IYh$-4t^DwO1^DgNj1Waw02+Sh>*^9k}g9 z?uOqWwK1$9c=#z^&~Nqwl=bxRk)rEt5Mbx}6MPckeO0wm^%uhbx+$N@QHu%|zJtLK zeq|Iq|J>u+-%6m?lG0h=mq0k0Cz5& z6_BmRbGrSO9std9jCM$VZy3PGj^gaS&+Zv9^E#Z@A8Vq>#~5xd$sW1nK|bV zkUgaqFV%OCiy|E}pSNQ#E3;}uzu`z7(&)cH4g1VaLc?&j74zhf^YiW^t)IT@cG+&y zU~}xgzAZOJQ8ZrL;43okhhJae?>4&mJ((MdE33&l-|shG_QHwVPF8x4WHJI%MAE`O z@wpQPKD>hY9IUYddro*-7~Z*SDJlwsAuMl%yg*l`-u4qj5}sN*qTUqJUx~6d*fAB7 zzmu!q7VQm(^uYdmU!7CB?*5T5*2od?6tfa9ca7G7nQsbasb@r=*&v#2`rb=W6~;=c zF_&PsB8rp3GCE}hEe(}BV+4)MgK5FQnU}jN@z6RwFXh>)%(}Cq>peZDuCQ?^n97Pp z%HJo29MbXZtwUD$cfck0O3~ma-AFQ*qY#_`=Q&LJ4Uk> z));bQ;n!gcJK-fuoATY0wu?9EPrdN*dI?l$XQs7ncLeCXkJfuMnqfFJds=MS5CNN{ zEfjG9*xt$D1xoGiQ1P8cHXeA5nVb!1Jq}N`F1TEom;WI7VHjW7Xo;pIa`(y3_Vj~u z4i98gBH{WZTfn*11r)b(^-p&=s-i%VciH(247Qxg#@%$CO7r`T5YKNZupDpE)obis zouh{kzwdL1_^aAroHg*qU|YW>q-r6-;WF5z$!Aq5Gr(HIc5Y8;`EybHCAOcP&Y5{h5q0IhR{fK zHuYlNA@9n2t`u4x-=loRyvdoqmediuyITVZ*cC(81v=ba3lH<~3NZt3Co!sx!z|kHwyT!+X{4oAMI*^vmnr@Jo;bu~rHu zX_n`rLPzw{rVqryUas$m2JF1yX=Iyu<-3T;iE-S*N330FFQZ8*KqII(W` zXD1Zwb^w9$Ad?h6o2T8b_pz0#9qX!_6KYcL(NJaq8PbfGVf z3FU@aG2VQ6I*jVBYHyyGeu2SKrP$Y*_~U2P)QRFKI3te~gcs~(=##r*=(m1riN5oQb#uz?<-6fFPY@>zPeoYJaLGS34a{Lx+PIjklOVO@Ebq8W&LVu_ybKs zQUoT%$9=y=^d+WX8wMx<=3)`HWV?Sk((+qw6}_8A=(x-8yS*0nelo&XzyuFW+G+rp2l+O|@yRG<4}{5(4j5>?gnG$fl(*Oj z+qL3fzc%D4ny`+qEkr;Pn0iMMVV}(oy)1V698*UNK*=#I7Jm2Qcy;as3LkWX6=_{k z`f*Qxh~c>J-;lp#GBxyM*|EIyY{@}XI`Vxw1%YqN{Q7MBRM6wS{|sDIK5ebDH1J0j z?YO0f+pv-2*=-A`3i13-i(S-L-7KGS_A7CpzzJbb-1eL4-ySaa-u!(b38HUNMj1%cg3r{`nKvkb-Ip?5!tMm)Bf1m5 zq$4_`cTzMdQ*tcmT%j<$YeVrJx_fzYnE^LAC|_4!c4ZdNYb8ACcaPQLOJ{?h%7`OD z2gdN+B;v_A88U`qA99Ym2h3QfK#MU-Wwp(bSg_BKRRh+mgg|bNKp7Fyo;%&}blFU< zU+_+>Bj1|?u-4hN-~QG3{VDr(cG(dgF#I{bAWGw&`|WiVGD+h50kK8h;lcEab2d?B zT@6)(8-9ENd%BSE31FkL%I-@=X>f{VJPrQp?Oepc!BJ=up}6+;T~Y>MzLk9E@qXEP z_kOyfnYv*2)yH-JmGwr+j=#oqY4fV7KsgO{A;QaKJJ(KDKyjV9SyQ(2R}ZYT>+w~+ zI`d;@1^GLjnKXv!5uwpuLB>n=eY)e}San_(yAzGtOvkU_RZw8dr||A_8`6aBdpO1W zs9YcQe~gs>v*|(iBqAn$yiN$5JgEqbVo;;CGO&VT1YT}B&e~2Vm`=949W)XiEz%Uo zwp!O*)2s&=Po{@~A{nUl4@?cYLUAu$Lf`g3=5^kiIRh`4wSOnpdE{s}nZo9rafz?G zUx);A&IqKj;ML|qNLcx)_`pnb!6LC$EuQ8^SUvO-joFU8-O7)xyx_9?K2|jfGXz zplIjp0BSLF%OvlZUCTYZJu_U7FUnbT%@uxM1dbo(v!SBMn9UBz$Au!|#l!%B0_!>&7Zv z(Dk;ZJj8!@!*tB~VzaH=hR|8eOP9-*Mp#03^MdMj%=Vjjp+_K#WQjZ#5UTc`Q6nGT zL}QY&QIuH1@_-(;)bPjH2CWg@j8Gr|3DyTsnKR&%TZW_Yd6gB%$#F^4ov+bZj@~Y;zGB10S~6PzHD51MZ`loEU@oJY-I#lCEZKma8SO{#4|L z_oFxqz3~f?NW#&0(3k|m)q^~k&9(0*?TkQtURW8DfXhD%(Y{O0p@M{%j4@LcT@U)! zZFf|so<~NAs2-wA&WAw^GvflXPu&kF)rca4&oP=wqV`BB2}04Q(ec(RdrbI7k~&5+ z{`$(o(ekXX=pmgx*DzZ$lX*q?~FV{}HBRkj;YVPyOtH;&`GtCFM+4sdSDX52~~zF0@*H8+-qJ8}=XRo^H0}-)9mUWevz%93l?6a(L_u12z!0{Vr9u-H2sr zNoW;_LaL1vzIz)nz8s|HqD!UX9`V%7E7!+NvRaH(S-Cug+A9Cm512j?dfFrjct{)M z^ZO>V?dK(8p!wC@t_yMD4;O@!U_AoPjjSVPBR@YTb%%?V?|c&Mx*NOe@b;He#V8{F zFbO*aI!tkT*)ytne7h4Zjpz>XZFs@LsIS@EY@)jv`zm@6(q*IXHg~&~Q|xJ7tAq)d zsnGF}mS6n3tF@v(Q;|dA7^Jou;^Ys0j&-Cc`DwIIOC;Nd=k4us+tRN8n9@lAi7Rj! zNKAg^ApcK+Yi50XeDnhe0(Vbq8pQ0Tl4KOW`@SqFi5_MbyywQe-3M+kmw$9;U@ey) zWu8j>Ti%HEMB>AUukel$*m36>PiC8h&H5$$DC^mA|8ix;su_N6hXQk0$OPcHj1pH2$!qqXXkjLhZF{8+4agmm; zhsUm$C`;Wn?I&KiRIdeIdjd2AZ@Ag(s8 zlH{7X$GRfM-$S!7aTPMEHa#C{eC7laP(0Qj#=p79y!<~b02hVuAUFLzzPL}?P!BN| zrW7oGRb+K;l4<~^EQN%N?(y5N)d=~ixIG^Wlk~Z)&7aWI#BnrTHls9>!pcYlAm+smiCk=VZJb#| zEV4UKPH;BT9u$;%4?$B%l0pSVYF2FSj5gL69G>g$BZ~6=t1c?r>5U)5$=)?ool3HA z`mx*1uZG4t(5y+V&SSs7{eYI&|w;S5$8b$L!;*{$Dr z>o2rZ>f7!}FSFxu87kyxVbSZis^MW%L7M2)S}3b#H4=E|h$qvD%CRo4r|6G{b_!7$ zmXPrqgps>Rv$J4~pOC@B+Xq`zr^dHHb2*87GL2fjH_G>{)~J$j&+sA7ZNEUQve%i_ zeZf2giH$3x2*#+G;oZ@|utBTbJ`Z4f;>P;}CY57X<~Uvc)PWA&O^lO&p6K=~ftJ5N zz3m`My2Iv3qT{2zc5|qd9d8Ow@&uXi$+|xbDDXKV_QF8?Ph(IxZAQBiaJuRJXF{2t zK0>N)?b8+Mw$AVP?^8s-y$R)_Nz6V&b>CLULK>#uU8R=^>1qcCk3plEyoheN4$IAh=Ccr*BefOdBsideeh~>nBt$C z92#0Trlo|0y-4x512E{+2eAv*chRD^iX5-0^aF;^^j&AZewtXjdxBZ4-+Kgs*bgTJ z`OK8b$hY57r$xc8mw`L9PhJl%`<#ZI5DrVHg7G*}eliO9bW(YZi2q#RJuDp=|k`=NK{5|#mn6s}KKD)8B?fB8kh^(}P4d|l^LVD}I_^Nq3lq&MSZ*;k> zwLVN0w6NV)#?1QAu?jshQYE}o;OBb46$rIw`C9gZvuc`0&~js~^;f=YsM>_pkVbly zR#)TuqxxJm+4abbwiO19Y7%+)HHbESH@f)5p#s~#=s^PhDcMmN2|oCwUn90$`7dm4 zwu&*7&aZd(v)=r=@w8T@<1oQe#jm8`YU^;cXMs z6Pe}X2q)LRD*{`j*`BY48%UNO$o!^*9A@-VZ3bu=gzPaQGL#y%6s)J+G?_~zX@(xD z+lx9*YSe=j?xsWTv*%23%<1c+Bl$Ia=RR#Wdb8+J9Eed@Cabm~8=ZE_hYxxrv^b#p zz5xnnDL=<=Jozoxs`|CPYM=V#%a()=J^!tg+z8wP>eVuD^HZqxF3AMaDR%FAZ=5d^ zCUbNp_G8_!Q&fsmqRbwz%XB3Txr0bIdzUb!BSR51Nm(#;sgj9s<-1R; z_2JeNe*7Cr+3hCA+ME=7EYWr(llz5-5*4$|?qpz62E15}h__prDSibH`UdP>^W~&> zkApAU3O18%H5+Oz2C&T5T8_~Id}js^aI}7#ZYfHW@ zotbZRqXD$^4`ItR?hRJ7gUM%9lr<-k1^P1?{2A&gfj@h2gMM_Qt7u~;RDO=f2ZJ{W@GtmIyJW`=E{fL@Oe5$Is4ttXA48%Q=XT{MZ~=y>p6p?ASS^82=ILP1 zz*NKs$Kb#6>7QdZ?2Q_8e+;Khc0A}>N+BxQTbxuAVY170c$CnOnvRC!+OMA&Gf{aSZU|kIxBF zwt4OZ*;dr{zO4O5U-ehPan=jPm0~{Yh;Zo){Ve0*a9!7Z7B|o|NKH6VifKhf18P6% z)Dv|K-pJAVYUVp%EbqY$-%p3J{y0R%jz~0Y;zlWv66yOL*85k4 z?iW&?uK_6|o8rtbO4kAcnom%ZC`SD(K$TVQU@o}<;J!yo!lTuX$7yvumepv8J;HPK z!c4ZHwYBxzw@*VVbV=WI@jRLFG(Fqn_oE7uEHxgA3(p*K=ciIX0_-LaI~+4v<$mY0 z8Y56rKVZT2lq?!0+GZaL%9JVOIRRQ!>SNCMplI0K3aD|zu9lXaQfk`C^xSNnT=gco zkc$T8clxx?+_2Z2$GBAH^x^Wrtg`~CZ>7^{`C=^Au4&O|UxYQk9Q$JPFI$twbo7NB!nRhpW89b|t z`PFZj+U5+eruG(2U2S*9ONICTSNbVUJQvK}4i;1q14$`w!m=_cE^Zo~W^Q zlDGFYK`bB3r`IK3_LoS|1*#Xgo6~A~a+_yHr~u@4!;mXf z%9_{VUjE%htWIa#{DVc^#zL8yFG@19&po+#gz0#AwC(!c<;<8-{$T$U%KhbszkXC# zLaZo34Pgq(>&0jhcYLvb_PBCd?Mo-z2z=&kUamGmY<5tVowj9{}@GuJ3M8cU#XW@&MI225yP z4|kkR#R9&PjiL(#E9ME#x3LlakQsxEBhFCO-%Jb+7DpF6g?j@BH(9TZ(KAr0^yMOh zcil;*A1nTeeu+_M_DzV6M!{n>RA_bFIyI7Y+U?(XhZ~f3-7fs+!JKF@pw@b`k&|z_ z-puQ5d(Mb}aUx@S$(ifD-9Y&K$VjVbG(8gLbbX_zru{d7>P)qckBc)M((uMBgT^1+ zO4ga70#>wqoIu0z6bSZUHJrY4a@udE*wPVo5?XoP)!lyj`PppSKa79L;AF$}!-~

8J{G(M~80qG2<{~M_GR&Tzy1|aXXJw%%D zp70$Ts_p(vZYICsNHSMMXuGTTaxe+JxlS(g`!{{o^?Xwz#AC_skAPN0jb>-rJ=Va| zlZL!daWm%Tv``H;7Qm?kow_L=1!3TGxJ`fNVJR3QZs;BDIy}?SK#%aWA2VVVjR>1k z+8N_P9uaXD*4h+_wn;JCZ$~C35ICpL<>qXEKC1cYdRr0eeWr0_)xp+m6(jsC*{IEo z2QVyZZcg3q_JtI@zeLQH$hhr>;j>xK7Lqn-Bf1?;7HQOIa@nQ|BD$x*H`@ZELOR_G z`?w1Neyo!Z>_*(}Tu~()?0A0VKfe;eq4R$UmdMv()c{0ns)QQBOi8r{0bxj1kTg9^Hb)ghYg20F)I`VzoLZ7mq_IBL(d zMR8`elr!k85y+g%?u2TGFvPB&%0}hLN-F9T`t@pwy;Y~qZ{lN#uxRU1 z%jSB-?ZVh-HTFN_el&Uv`k9T*^7^HQn?xH>NYryctQ#`tuiMavb5y1sk9^6P(A- z5g4?`llxYZ^miFbRT%LKa5vcsp^YYVok*zk{>nX9NmKFmkRiz3P;5!c-=Z_Ria^Y^ zvq;WiT(R7u{qIxM0Ee_6?K%>A z@?zCjyUB+}kGN&;1!y=CE2Y!pwPEnd=EF=+OZJow#_Eu0!#kbdQ-Rdl}zt-u)q>ovD@{qs!;#8JPa2StgI50>Ba zoy7KDSr*9fHJY6l=VMxH^hZlUbarSTu8Ml8o^t_JTgiU6LzG7iCj+kuK)Ftw*vA#w zH=s=1!wOZxY!!iKLU#_>$OAsFqi3@5dw~>0X5ryk3$kMOB<6{>QsB$cDk6~kJmWC& zgLiXgH$!-!Y!HxnePyBV3D_rjOjuas2qe=GZAg9;d4<#;OHA#jG=Voh!a9*6J0kX64JenAa9*rYLql z*i;z$S}%{dTM%(Q?i_3u>e`i_5rHaF3;l%3oKqM=_YbW6!cD7FgO2e@>>`QezEcES zYKbk|C{SS|QHdjXeP{Sivp{c=o5$!HcC=YaTl_5uY2vJG%nN;mesCoSby<>#;9B(& zCC-L`mK2d!dwGGZexEX|?+2}loK)8DBC|z|A@x2<%*?0{i>C{TIm*X~@lu~7Uo2v4 zmZb!s1S|=Ua)Al+w4w(T`nu~SN7QPMNrw!i+-hGH?KJw-*aBB%s#@s*Cp0lW{c=Um zJB{9u*NF}H%{#`*`Oiit+Mc1qra^2?p_^&NJ1zco+RS&@J(@k2v4Mx|mjMUx+4sU> zDNn7ym4!x<%1E5BC~8Gv;C^}UJ$g+G9{X-qAiD@GYKGr*a#host9A0S%%_7kG8#*< zhUnUcF?9`?;V-10qu^9wHI{zn%V?D8EV^KqT0~FD%WzuxBfdHJ|2DRhYIZ~<#*f{H z+OeDMb;+#?WT36ZtJ_r8PwzdGX)JvU8SZ-jhjXwia}7o$`&Of2uYHBQfM*ZDSI>j1 zb|q|hy>FOgbzyMy61vy-MUM+|ZDsclPbf4%G3Itk$nKxBde2c5n;Aa}37n3q+uq+& z%5bq4%}BrKomvw`E$00^#n<@$%`uxNrw9nEQHfOuPHH&bEU~=|D<$- zbYxrt9fP)H+}vNtfOHdwI@tzg%VF~8KIyUs&*7lV+pur`Q4EdS+U+>Ww8$g%y3jv5 zmYzBWs(Ah+@cq^!0xcdi1J_!iONC!&^_}@KEJWX9@V>VFTR$5!=jhb92`r=t<1e`L z7j?}VF{l=cv`NH1D+#Gxx)NHw_fG}OtX0L^nTwQ(gQ_@a&XLTuPstYA22cz~U9N;M zfcH>7ux`+DK>hdB$WynHwqHM$E07@iu=iEpex;x~#AZNHDX!97%1*zv z-3nvyCiQtJ_yvKy+v;O9QIxWnSMf%+`JsK_W!% zD`L{HLyKn3DPm+RS)}1v?owKGb7M8ghjBK@ZpizQ)k{b-s4&-M`cBW}Hu}fW`Um=2 z4^n3nhs!yGy`vyYl|zj)=iy|&U`Cu?>p}3(dx4;{)eSk1N5(FD59TJk*=%(aLPs&R zX6Ln|&E`NA=AXDfxN{))QH+~bx_VviFm zj2yxkL3T5ghd~gXnjf=Q!$_8zbO9S~$D`)2dZF?GH-I&jsHE9{n zK-C#R)G;+m9U=RT5{c^~%(@rj{&s}C_vzjJ<0v>_d=gT>mmo^4E>qkKt!&!==#D0{ z27mBwO~T{r_w@zAerS7pI%~UpI=fCYefVwi>>2z_aKeW~;@(08PaXUx00=3TRxp8O zEQ?iBlOsf~qG-2J&;Lef8TOQ2I2RW=;%wUZp$Jmp$mi%3&!HiqW!qz)y&z{N>t(W8LZ}96)b4(=v!yufLtKNoh)@QucN_exUkp-6|?Si!x};N8KVgh2$b-%4ZHa6yzPc0+$L_Nt>E21vsP2y~hZWKc^y2 zpTMgB_L~#etd*ay1772NXz044UdTvKbnp8?cQsL?0E@ED`O{b?Ke>(%9K7&hwaXN? zYJdp1(mVh#udJ*ZrRIHMj% zJslBU19?pWcjJY!gIqXrag>w)ZPRELq0p6Bk28CTcv*Gc6AAR{iWHIlo*85K_{-?s z9&@$Eh8jfkvXYUr_`1AT*pv zA@zDy!ARZkFBo3EVkROLQL4aMVc zO5k{kMD@P+;_zmGF6rlgI;%(qsAVrKj~E zbOFB0I;q@tec5QyF^)ZX6m>Lf?IOcy^4eTSVl3WXOnRF2rRF>WxkA6e$us3yCk2KkRGMGOhR*4 zCq3JxR#^C2#!W`18&j$Clm0yXOb)7h;@a_N0y`O*F&$1x18lyf&*!J0j2oTzS+jNF zE})@^yPG#)*5Jy+wNe+FW&bJAeSGRrl05+Gj`vtLqSNX5wL~W2=ypK~*pAyZ z#jM|j2QS!?mwC6fynsO8s~7+p(iuo=oTCD&JDYL_MxGC-Mo%+xRwT_#_tm_A?s z{X?3D4oWnNOS6oW6mC>7<>${FX@};r%IcWETo!zWl?Qo?geF=wlB|_wC&u3$ z9gmVqE58sL1!=_Kt6bX5mpRy|*&b<+$r3))_hi6a_T zks-bNi*Jk{Ad=C$`Ti+E0W8N~_q|Pwuv7KtTCIyEN)S1piiN_^qAnHb=s`8Yfb}st zRDK2#UAd7cY~ zILAY|JE=cdh#s+1>^ce&iW}GVav8e?W2;0kAj)|L_CEkfb&7s_p!QaZe2MNhPnI*a86?y+ke#hio>Mg=Sp>v zgbqPIZ4!!YX|yt_#xKr>b0o-3G8)Z>%?hPWwyESX7aVdnwcW|_l9~qlJ#3;Hi2N7v z*p}JRoBx`}u$`$WmW6PpMls-5X9-C*fb>df*`~Jsfvv1*MMU^N&ekV-rq@!R`$_&A zL*{f?#EMc_x;)QMUk$>zS^rbyhi_<*?508#Zvs}$8IKvk-iE7U$fEQh40w&hXC#Ix zvwSNe4R`?RXw+u4iZo*o0TcHCGFgnPq7)0+7ejIKgVgY>>Y@r&i5+w_ha7%yE|yAZ z7kI`aZQK!VUHSSLh1CsH1pZ+ipezo_&b^r)>CL%vtYe zyDJn7rtgq2}}vw(z|Hvq~+_| zu?%iM+&ifeaN6xC)reE=RKGC-a=Gdt{}pa}R$ko1Z?F5`TK0dj#si>ZB89SjwBB4J z?2sFD^%YG|Axe9US+}@!oLyzi881wYmeeitYqFnwB&@@?j31%HLrMM^I$K%jud3gL ze zk^ABgcez1~v(2bW50u=K`_13t{h5fV`u~dUe;@E4D;H56?)v?BwSEcp;j>CgStWzU zPeJ-uM1{2gQmc=P)66DU{!vvau@$<>*u0KLXq;n92*!DXK0Ob z?ov2EFw@`d3`!=Akg#!ZW;B-`DJ!BVU`}K?5hOQa&U1DJf-h(jk7BwkO(+KR7dN9H zv0yqBr8HLBibAfvzCOqfWqH4;;Ohpkv~XsDM%HY=C5oiB&c%TRg{J zd|?k`%ZymFDxO?)hTdB};C%tdFV&71RPjfDH0=)BZ8`H%!nS^6X_D%eW3{;LFWE|K zj5+`zp7TXd7Juiu{Fb_daGn15DgA_Jb(x7Rhk#txInGTbYVzoQS&zp|tE{pU`>i#e>Z8c(KC$l?f_pP%>1fU3Y!LP;S| zX~+g=OF`P4DGrkXICTD7<%w*bI=8GlVjecPkxx*$V|jtRw`eQt|2^;xH$^=n3gvyd zDhdr;4~X!3(WB%@Js%`BJ*}*K*Q5iZe(ZkN_04=Kh)Sa{ZDeI4bxCH=Jnmd`@1xB$ zKarzggH{p}t`e0%xJs!CWerm3gtlZA&PRQyjdjuv@hGwxTB`UWO*z8G6ldl{p9gV4 zV6&2k(JHSRFBXh69}N*Z$FVg3-(7P0d#}$yoh^!De=iAw4KStbXa+AG{)NzL|2NqL z#WXZ<^8~%h^;#V_431Kipk!yOziy?f4CsRAY~_kM(g~Ma3`|S_U%#ym4}~0&ynJCF zZT6-A2^D}$MlM3#^}TxMQFX{&PL#gWi)555{PRF$l~{WZB{XzUc?ScM(f<3cN}V(m zGK^t$Y=2w16K+~TT&{TcVh8C)SoW>N-})l-cUrnsA3tz|Ha{5@m#?LbjaMCCy>oME zQ&5k6F~dz;VVgK8w=InXRg91pyU4I|BgTiS@2jVIZ^WaHN_U}4X}I1;uzwVwtIWQR zJzL?z;ykl1JN2rJUS;iA&in6K)3=H&wU#@e%bcgrt-W)l-?4rE9b+L^{D7@EeL^G7 z&Ml&EiZLMi1U9-vuv2YVslg01D#j80G87^g}Acf926P9u5R&^!6 z$YP=ao;~!haOb)vU-`ZHpdClpf}aW(4~9X41h>~0Te6X@qMjB#-)y2lzZ{PLzIlJN ztk;_vx_$0UPZz6hPnS>`;M6J<%dBSdpUW~CL;LRiIkG-2EiFC!2>kDPJww9LV&<~y zguH-TlLcNJz}M|467_jwBPF}mxulSVg9zHs$W(mEN^b)zENyZ#V`bervb)ED}e= zT@0;QM!SrE?|EM=XYW1lC$Imz*Vg$rEF^O= z&>UCo^sCo6$#n&o+KFpJAg?iKEE0s`n$W=@l)hfMpGW~CVrutw`jii0U+l;LJ{hs- z(8RD@RKNOVKi?x>uEIZVI8%JqQiwtc)ozdx1fuH;qe8a~QyI`}64Y=hM9GE5LM^BvA)|kZ zif#By=g7stgQ_W8G~YY_r3@6!?F6!8MaFP>E?3A%)$;D4e(Fq1vjz292IqmoDY-Wj z4Sb8h_ma*$uf|Y4HMVoqIdU8mq?A7lur2uy6P9zg>!OYz_LqJAz^7$_3-zVG2FN+go(jX(uaHh zrdU$3$5)pHSLw4V(j;|jB9urt&sij5@QFr6)f*fh5VX3EPi9MUm*x&6LXYiQ@z(=q z7;3<&SQzLeT}#yqTJq!7qksQaPOWgkCH-IS*~wApQh5&9(a#ij-uoeRhYTKn0pV89 zN!KDCdgc=AcoL;N_7L~eh4Wtg3jrQo_rWD|3&1h3qs5qXx@+U!`zhdh z4vZlzpu=Kn+7kpb5>L#iKlCYYF8}#ekSF9uJ3*!F`K*3YuPea6V^m99J3)!2t4IHw z2oekb;{iq@?4zb5Ya6JqkN=ZE@Yq53p6540fCm`U z@)NuvU*Gs^+k*Qx1X#Ea>&u!kNxQ0RcdJWS1>YYADo$H2N9qI(tONH(NmhyD2oZ=) zJzl@67uWj{qmlKxc#8f|(5^fNB}e|1#}_%2l=zGjDKIaq{5w=iAxNXNLHLIN^(Tul zHv+2k0VthY-z7_heb~Z*(WBc(7-9jX-I|IezuN%BMCj1ugkEmeSFOFib+s)d(wU?D z&pL7Xef6rA4$o}XJk|gKUqBV_l6A>{C+k; zGpA#wL5Px`)9}Bm#a#pmom{pvP@;63p!ne6;2IklK~;)`eABLgRczm^UTU575w}t<*YAj<8#_dasz)$5i7F3_I2xXk=xg z!Qq@G7|UW)9Y4^%DaPt)pSrJM0Ug@<#)RLFvee0Zdz0&L4;i|bnL%^f#m$s+zZ|LA z^V;SI$}3=Mcl#$^DEmfWL{?OX)f|SE%{5-U)^XW z8uQTkR+xG4u~cGZ>4KkYu=DQ>t*eigRV*b<*6jT0lo_uT)B&VN^}fY{+cB@|(*-mw z)O=o||3|C@HgJ6sHUKjfhwYUQ!cL43iHCUty ze4rrs!o+bwslF@n<(kJ7s=P)Fy9d)F%fmB&*Ee9SieRH{*E$Pj1gH$}zHV>zz+HVB zV9%mu;6YNw-Fa9L7Qy;@)S;jdb@>7p$r4Gw$s25Y)*0Ds3Y<;i8cFR|t_2OI5|g8T(!@oeRVVX*`K%2l4!%RUw0mU|Idsz8Q5(6FljagNsZCX=Aob*BRIeP4+fYfc|q1_MhxK zYwUtA5Qo{I?`Rs*P^*LRJ3>Bxg*gk$I42FIC09AKI6n>6hz9T|a%8Nfv){f1FQI&cW0yD*Vvfm-FkS zF`XwutuJ_;^a{JoGSVZztv8P=C5D?Ffo1ihN@HYvLV%k0vF~WB4S3t9bQi*?qBHm8 zYfP*Ezpc(AC=3yo-K@tt+jB$xbqki3!~F;R?qJ~9&(Cj<_j3;nriVyf#yP(BW+fX2 z4^IYd++}jB(-gmRYS`B%fQG){t37o%{A?`-wJ&PmSFli8E}La?t;R&Vd6{_3)HtRn zYGtLHmTXMAbF-*xl^bA!UB59kzg76elwsrVkjoZ2cv+&Gb}CfreU`52%U&V(j)VQn z>z^}3m+yHx2$Q!;mXW72;}tz)TT|W)VV~%WZUV@uITFOYbBDE&^Cl%Q(sj+b5mw+@ zX1HoJI={TqnQKSj(v)AnlLma>0~FOpnB!80z@^)4=7+-(P@)N^=ma$p1UT&tpe~}i zTDVTkuemgS7ir+hb6WuzAkaS1O~U`#W)CAv;=zGM+lb(J`OabI%3@M=zk#h~Ub-wm zQfW+7w|jru=EwL$$lUJ<07!bo){UrSM^0;cZ zdf&mMz(+-t1r2VFbUA4NW($UA`%1$umrO@dgX{YKp-pQ98PW(q@S$&s<(|&WhQ`PV zbqf;Dhl@$ZpZh$d!jhO*HYj0r#@EIt-XoE+#!joc^d!o_c|DSO%D3_pKVdhn(jstAo=WM*FRcM89q6_)yG zS^&IQg;1wZ0%=_V(5kb1QBjRS+a5Q!eXhuj$ul;wa16wQex)|I;Bq&*+)TuP&Kq?D z@`QwPf&da}ih7Q`MH&~e!p5D`H+!bX4BP*=`tGT$rV}7-LP$vX%;nGybU&qWJ;<g4Q5d&A8BviX#Jh4BmdL zCGH@G-aC0ESx%;YTEF2T7)%okhMvq=dZ0vA-wMa>5tmzh1xiI<;lX^-eKJ+jQf^_X z<{Hg-8Ec)!fkGSOb=k-)DKf_iR0@DccUO(BnQ?|3OC5OEcl{Y{vsOshUzB#nA_zsP zrVK?clX6lgv-wF0E%5|bg=VnF!llP#O1|yejuJX2MS%|1a>Y%L%sdHGE_YF$i|y5d zVOjX&tiAM&9>XLBxKV$aHm#Ifc`DEXk2_d#O#*WLZufLSxbFZvQjv^OeF~A?I1|I- z@1+cMksmF66zUpX<>rh^SNVn;*tP$brAg|K2|akVEE)wmlk>C!%ZmnM$%q0rV&pI$ zgyNMT7|yz0q=j+-aF%rJ?js=KVkaja6sjI4nj(mHJ%)l%xTC9<;Kz-iOnx;5}X4>l4FE_LHcWmOb4? zw&R#McUBhen1e}+>l5Zi5{!)Tv0UExaqat&TK9afgKp95C0|YtvmAla{gz@x0yQly zDM*C|eT+5XfRJSx4sgfLIIBJr{YjSLAlCcs0y!p{o{5PnMQKN2cWCUHIBtqI3`qqL z_uIxoG){^0>PW#AK-x6G*MC4Wr6bgNg;BZ`@T9q>~zMDEuOB7Xw+h+#~+t%usaw|?g z8Y@B$G%sm~Z20Qd2KT@eBWQH{LsQKHZI_B9($+6X)@m}g0Ly`J#B<_0pu;e; z9Iz_skhUt^Uw325OdpfIsaRguFNLe!BXs-FxS19g!CG4u+#gDVFGm!*ZsaUZN#S|q z0=$gqzFpYYdH1g|=SnJC^8y%}y^CtqbrhblH>NpYyq|LAaW!btpCbQ8$Rc+YQx;ir3wRK@NO-XM3vEiCk0*W@I8r~e>>O49+o(G+3KUehpNRWUllFg3 z8qP={9`q#UgDQIqhLh$H7EuOA31ep<5vO(MglFe$a+)d2{`<@2;ZYInrPJ@RaPQZb zJl2_yGefZV-nAF@>C;w71(!R=*gpVK#tzEe#a!ZvGUJoYf(!6yBMc@i46xK1?rG|s z0G;Ir6nt)Lz^U~1T?4FmUZ~85m)g#~%J1TFIuleRE+B~>@U3vkf6c^C+OS&dgT`t; z5|7up+L?{7FC4}lYAoZ}*)z9UZTXf4jL4EJtmNfL?pxCGvp-V?%{q29JXD0sOnF6?avUnPsv)%+MNO!~zqFgjOTb8|e#s@A=n$%-A) zc`xkKU@z}J&ttSGPDd(BNV~cK_$o>FLmvd=L3c0d_;jw0DvUxa7oj zoqyf`Vyo?EBsrWD`Y$O{UvV5z;nIK6WvUISds7RyU>H8&9>sfnhxMy9izohDrot2V&}JctEO>IMWc%UpsWIJ&3EFOj(hSr!TbGk z6ibT+vh5+`+z(*nnrn|ZVz~=Oaph>n-NdSrQOhr_dKNdq?`R!azU}u5f?N)Q!Ji|V z3RkLR5Mj@cR|KSl_bzKnK_JNbwWxdSPt;dlCPA8xaRayhQZwY+G}r#3x-KMpC9P3X zSkPi*d>C+r&+1(1h$cb4ru1PCjnA=DwWx67chA|geB-{wI^c3#dROev>b4z`BHs$_ z^tP4J0fVSS4Jv$Hbi8DDKQo2nP3w@L^))-tH%tZTwBUjWjgF!f-YFMts|$4S=+IPn zv82Z#28NPuMoRjaaWuiAYxOWWk|pemKgOL`dj_1`+o zaK6_X~595ENRF3 zH4(44xLGRnEls`6eL{oX24t2&0H%B^eD!_opm(C=v46AV`>{oJ+b#V?%lRbM5R#+N zBU)CQht>Ygal42I&SJb!P`t@IYdrH0iTD87dXJ6DHLuB0Dnw(3rp}(MT`Q--seFodZ*VJmG(fsNv=QXTq#_5rw zIuHRlX0fJx=%;;Oi#i1T4q(K^3nBH_z;6AoS+y43OwovKTOOA`vy`?4F!p^R#FcIO zF~2DqU-Vmok@!2b;zalZRll4~BR_oRu3O*SuE!q=nkc|5DPMe0Jqa+YIG-$Tr4C{~ z{6;tq?2IHO)&5)fT(7h90>qBqyy=V+63O^L9rnIyrw?askQi2Oq%DkYnc(I5Zi{w%Q%5wC)&})3x z?O0aLY_YUm({JB|MS;K(QkG|aQ>JWKWYodMDtX*eG>)hTzt9m4{T%89rG4T_&WNEzO0lj*w?X4SfYq;J@<*8gK zKnpF^gm6Xt*W616R1^Y1YCje}m-zKeJkT(Zxmmyjmmo1x-(;a>g3}ol&EPvw#(oh@ z73^{uNk*3cp%8!x+F}S3qrnj8?~2YYqgYXKcrV!H!97La`}s1Gd?@SqL1D0Q7Rb^h zGXNxWJvjb9EkKM0ctGbmGWZVzb%GpOu^2SCQ6jQqH5r7W-#B3I8BN?RMg5Ka8kCykz9Xhgjxq<}k0IVzFeK1@Rne;>~czuO#QL{NVY_-??i<(3uI zWg(+x>W{SSgwQQVfR_eu;;@Al4{NdHjQgjsLqs6ayZ^iMuH0U0RQBWS=GE{CXUl!* zX@<|ZCP1G*Yw+Eh)hnElQ}ee{ip*<*+N> zkxq#!oVCir7iG*&1$Vsllmh9?*|&4G1+RYm`y@-ckg7Bfu}$^*Vn;9jq;I8!Hz}Jp zPNqGRN!}|n)fqK)hV4WQ4D&*29TaSFMoscsyZtWxD!jRfR)D9r)i@lJGq4zICRv1Fw^; zx49e!B6n4b%`2=9imxrS*iD&oWG%HR!%+y7+M1B*HXFh{P5d)bDtV@>C3Rs?gc2ov zQG#_Wv9OYFuL&J*m$O-IHfk9|!bubp7_0~O^5Pz`vBd+iQsYm=ju(xot)sA(rKB)vxe~WgR0W zUG0gyrlgAUc^n|A;4ss%VzXJ5JA5~$)5YrjH&j}uq3v~>#2J8oTcrFggUt$E|ITxg zKDZzl2iAQ*bT_`luOG@J@Y)+hQzKnt(ErQ)rT)i&g-8wuadQK;WV~n?N=aDciTxA8 z46s<;+nMjn^;#67ropT>;y{@%jh|QR>|&8TFq9T=i1m|q41-S4`W1wLtke9 zES|6{vX(Bp^PS#+N`|C!%mWgkNH7kxz6dcd31rxnhben<2HTYFq#svq{CAI`P$bVf ztcI3IUYjXtZ_`YGRx;v0Bm#vtp#9Va&p_ZEO_KHR{02)@AifJlKxq5` zIYyiwPasT66o*VKp2DmQO90svJUMw=6uWtu)1JKbmSfgnF|-}u^Av>$iC}oJj_}b! zC;e&KnAupgLgvdT-u>Eb@qyU<7z^Nrx{8-+H*ApPJ7NhEVF1^7X7M!xFUP-o+>BZ$ zYY_qTbH1-_#lcILzc>q1p{H}7`mtva*lzLrHuDSj<@X=N}e*%1HSBO?3ieB!h z_UUw3)5rEou#wId)57Ji<}Z$*4=$_NtJ|4xX|C^P9i30?RXJ`1Bh)*+P|VAi3e%-ooDVfLj_uoTUq{FEnt(i2D~Uf=!rvnrEicY8egTGXZ%Yeinejxv(80bU;o;0bI=?)k*-f~ZO;r?7vwOX z;LC=g_G9*v6tWv}di5C&5oo^G@L@j!888fl)3A1xd))#3SnRG#7-{L}7 z_4*~5Ub*m!9^P$~@cp$4F!sO$oK?_Lkb_5eDK-y1I&!f;`4x(hlGt$4-dn8 z$NyH7%aUVRyz!GFS>3i}?uEKFDLGt6ZHW|ge-Nv@*E(Pw6tse4qKI1>K zf%1vNP=-2w6V{3g;>$k<+HYa>O=qo-*fMo$_FS9safx~1WDy|umxk618f5b=i<&1Ijz z{eFp9h`%731eUaKhkh1c(4F3M-J9NZ!z;Q=_}%2s>uGH66MwVOHRp!kD@tw_{n0`x zvn;YO5P7!jdMazyX1y>ujC&_pndd1O#iafh8j&oO1S7d?H>UlTp6-PF~r&Tkx?zRbQ~@xV}s^n39}h#E1m1P zz>C9_<<+C*CfK)do$G@+b*7D#%(K=iBd^sszcyXkfzBtaA{szpU=7E{lNXF-NeSR} z^CSJ{*$QZD+I^yISMhMj;qfZ_+mJIw-aIvlWw`Fg+ih$PS6WszII$^CvAkTTd;~$E zxc5%}()FIPo^R)F^y!>6P^?ySc$8IS^zDOCl_5t$w{!66S@GE;zG}^L(}JbrkzGZA zZ+LX_Ekt&Z8#0d@zJ>LpAvLHMKB<=ApnV}IOYV=~N?ALv_t(R2=4CAVnK3E{&#(^PUqKWow(|r_Bdz1BSBK+!U&}JN zvv8+w@+I|}y)j35CbsU?MHG2iwu)VA4q|vWb|>Sz#FOe4o|Fca;X&4&Jw>GcDyvp; zUN3<)Y^N`Wu70cI$&Sp{tFOng)7nhy4L_46J2Igm6pYD9V5$CWDZuLipT_SIqx$_> zEcf}a(XX!I7Yi)6`F8BH(!ba54o~Z*R#(m zix)!ITc$PvJB>u{Hi9~n|9)oWr4J98w`qW@66alMZiC7#Mh6<(U+w}kR@>PTt;eiy zdLXy(&8*jPx2Wr5W!_Y~ttOAq3lpYlTXJQ&7>9Xq%s>Z)5I8~YOc7oB7?Jxq@$zmD-qB9?9(${=a zv;VezaR&hRAR#k=b?QpmtHD#O!MX z@@3bA>};CTx#gi+c3(8;ev2Z49HN{48)|k^H4hH+IF)pWl#)%jCv?!D8x9e8BCXNlk_P(yXLtU zs4)a*&$X~N0g+~|ygp0pt(~h=f|fSnhz0b*h6zwv=FYXnxp~i5PDEIR-~_%R5<@phU+KG;GmJBR9~( z&y>jn^c+-@!RFomgHj@NlP9}mv=&$J)u+z(*n-6Szc^uQ54Oi{vd#0Lmz`dq6ev>iAM$n+<3yQ$fz|y@uZ{B&8;_$we@hyP zOhmR zB2OcQB5~Z?tnR9ovmV9ewRQ-&&!1{OMr1#MmUQRbECkKra|H3@SBI_xjMR9;GKM)#M~N;xy3?0FNGOVWY+kDKSc;q&`cnJM{o+UYxz;2Z_v zARK}M@gHhHF}`Seh|#w2F)~xSKmv0~$5Z$8oA>vH**l?sS{JYL-dswK2dH^MvX7Lo zf9!iW{n#9MC|64GIUR6hNnFuIpLKi%?z6{RD6d(l}AzGa%; zL0lXrWp^4yQ@g*STK0Y!?#lJbo~HFn%OeTIf^*Vf>8w6jroAlku1_^`I%VfldH$Wt znL$e$7zC&%A#!zde3dr$a+;$=5_pvX0@%Y;2UWJ7bd0?|k}Q#)E^2J_bs|A4v0uI` zS2b($*i$1|xly`CU5!zcuDUGK*F{Ew8mME9fvB3|!s!=W(pfXCSTW8zrvJv>Nt6k7X=?V**lN z?ljU(h*6{nZrNk}^K8xJUQvX@Ua99G`*qRxTpvrALlbY@!|bV;DAu*Xdr#3`+BXym z$diFSm^~bqmM#C|R3d=)0@?>jDDEK2#URg(It@s-otS6Zvsxrt^b$4xWOMQZDEN}b z#Wr`#ow(@ff)y1MC~mtvhWWNU3aRuGa}8?Zj| zF}dL#F|3|#_@TQl%$b$sQKD>6rGp>p0)+)9^Nk~Y4~eI#X8gYKx*tAk62_X4_AlP* zBHuSa=x6u@^k_M<)*N;F1J%%1Bm$mfDM&a=25 zGTlR{?Cxt~9*%lLyYV7J&}l|v{pKTo&YlQQLq43~lp~}F<3FB1dtAPw)w2lX1^M4@ zod4)Bd(uC0_SY<_|Fq{NZYNT3LdD}YEE3Up*P)Z*@|(VW$}^9O3Ow}7Ln$v-NgKq# zTPe(9Ti&Mg3By)!(!W4#k*nB_kPMA3;Ux5g<;y9{^-1RMQjtWV;JI5_>}qbiL@sSQ z#a11{;YrQ;S`!K806b@ zW08i2@Ft_N86m($m*)KyW#6Z3-Y!+&&1ofKt$}G|#bsO6{o6z3{ciyHdeRTft~t~? z$74*uN?H^;huXD{NyZBrs@}^|qr+!k3CibzxoxK>vQ$fTHYXunCDM_}i}sX|Q`W-1 zUqr$yBmBCi!`jvo&Q4@y)M+m#R7RYxp?|`#M~2+#t*tr=_eD&m?LR}Q@dFo@wQ!~R!o{`6(f%D+ zqSb)NIB7$Qe4FZ?)hG*QDBmA2Cq%M9JxC|X_5RYELSv;NOg?AgBnGW1*=v5^BY@xb zwOTMIG-^sbC$ zYcVt38ln7xqL!U82!eK(QqF=uR4%Gh&Gzs4{`XG;*5P3y-KDB8KsY1iYs*~{=?-dO zTUv_i`*5s2?$tEoBqbxnGVlt$@cAu6#2pRatp8X2L@DTI60izJ%!1?YohYPhV|`Po zQv>7ZONX>PgBYK8-#+5CKM4L7>vOj3teoN{6FT2o@o9Ep-iKdNa${?BpRRgbWz!rB zy776g1t1pHVG6~n^yjN5-;F{t0*nNGtb-H|*AczyUO`UQ%oy= zz*oDx>O_Kl>zl11W`Ug%QnMya7d0iOR^&Cz0t&Je1AW)Kcp^?nC9@M-%`v$LwQ|sd z^gEnsN|Y2zg{g5^IsL-4O$D4iW=Mi6T;%L)fAo9drUNWU1>+mlGTZW~5r5PIhUf5S z=|?&BtS!_yE%@FLIF99P9EJdJ=p3(O%OvdR2*;srA?C1;GkP4qj;-Tph-QurwL<{> zfAc;rJ%yTlM8mwnT*Os_BxFXcM#$@M=qUJj;o@)I!d!P1J7=|J=s0F7SsWoJfg%%~ zUk9f+UGVwb@VxcS6kxS5qKW=;DMOKmT78=u0QJW#w-u!Xig<|<3pUq2&kHPEwx+A` z#a0WRFL2S$Ht7cT!kOWHVb1RVOD;J)8m(rso+oF;>F(<}Wu!5_TqKJI`KCOM5K!Q_ znd!OnU91r(0=bBfHKa*L3{IDwb_y*tCfs?W0sYl{nZjh^tXI7#8y_=V@T5(%Gb^cV zR-S_LPfFN~vWVZ?AwKuMQPbHQ-fHNFK3|t)4iv~ur2GjhMN?1VRhBHC}ZpTSrm63s^Iol_ydA=Gt0O0F$g?i zK`fH3!{@W$gI+fCI9ng6E>c$!?2PC~^fcE`gy5uSXf+Y%DrkRdL>Cr*xjXu7C3-`} zy-U+k1Fy}R)vkd-NNBuh{GAj30aYck{jluhm+$bN)`(_O=@PWp-f#23Y59zmsBG+N zoxW$1B|W{rgf_3+Sm^PuY#BIZTn7#MZQoV~B8(-%)#7A1-my)> z+hi>{!Hi@^?wMXuYx=%>-x)6oCsE}836KAYlUF8x2jU35-=C@dURL#!ld0h6fhbEI zgg_#BUDLZ$SjmWm>lwxPYlwU9(*due`NNg-@^LIZO9aQrf-pjtHUH`E_cX%*0Wd^qsnsw~IFKzL! z+543`&Ib{b=iCK9R&m1id-DG zYi?ctTUo#DnF>JmEn(;V5Dn8a%@AzKR2&*PacnHolp9BHw7D%xVB}T(}gHF zVC^uH3ZNyVAmf1UZAra$H7^LhSW}0i(lHb+SP*84YAnFu5%{*uqns&k#}^SFxb0z; z>l*5xb>RAv_bww#7x9J3#g(C4v>}ZWmf)Kjb(JiEt^JRpb~34?y6Nvg1!i(&h&q6v z-zacbH-qc8_bkBwtLW=|M`ZT<+QacEn>l-^eJ~*#eJf(Qk~gE;kwLnm$hCHW>*-)E zCVSmYUA{N11j3k&pj;RW1)S#h0e6|4Tk;iLks;IfrtoOa3F_u;_XFYD2=@ zY;MzTeOdp`wNOlHy|0O*|fm1#zWL1;Q|{+$6_+Uynj>D7D9K@?{0xO<~8pG zl#DLNHn!cV2;{{{W-Io`QB2!_(L%Q&e55hq2~5}A?O@LLnD#X!Kz+_Sgk38A?|QlB zBQic)7>hBNELZMZBawwlPalUeU==>0kqOc8^EO)Mr(>1Y95jQdDy$5CFy0HQns0H& zbc#0K%=g*Mu-CWe9KY?suC3i!*}A(+&+8=VD!rz@I(w=w%tR7&(pD-Y1uK$7LMuJx zBYp<)qz7J_={>JX$#u0#hbFa5g3`}0K12EUS2(FP%hFVB+1#V4WM_D0-m$tS#)@sW zN!v7k>M)!KyR_(;Mr9C!&{2vC*fd9E#Z??g3I=wGgcf>+qKyoIB&D77O5y=D3M=WQ z$B8)dE<<%pA8#4BMnmSTufdxl`JC@3lN{w-u$<_=yN~sRrHt#kwWS?I_9OWgTW~Dp z_}x$MFsCB7%$X-A(^PQ6G2x{lZgYrqpA0jrzay8unfThvFTts|*|OK;Uha>2zGpK| z5Dnjcc*3H#;|$g@GmT2nBlnn%dBwIIr{koX1bQ%VQgUVm?0oY70uZFFc-XQBvi6ybpBze=uFsBu) zO25CfSo~B*5FTWiiIQ=g7$0!s;mM@Mw^#1jAqdjTsEbR>m*1kwa=9=)PHd8x%?{j3 zYT2UccjwJ33#|4rh3M%$&p!(s0`3A;cW8+LHhp|Z;~`X#G@ zed^TiO5&-bANLW>tG)WvHm0YETEhoqtXj+P%Hk6tq~!}cJzn|$XN8|Pl#xh;(m5xI zRJm59d|xc(j+G2tT(^_*LbrR#Sy5M3vd<9_%}%tE*4Ad9PEDI{XY<~Z`CW654E{iz zm=UYL-$3g^jD9rq#&x@VJ<}#(jo(bi+6C^DP;kcH3FC#|Q5&Yn6cCZ&q+1?J4gd2J zI5&n6bl#J*WwcAThI#$BIypQ`&)U`4AobA6}0(}I1 z7sm?q?8+|Wl3i=~NEJhC0YS)A7}1eazh0WJ2SvM-B*k(3&nWk-AB$Q|Kl?89(G&3` zcK<4>59XCnmxYQDk!P<* z+`JlbF~aC%&t1vLX6!cOY#PnS)M!Q96b4z@qK&96+4SwQyHVTNDE_LXqQjhZDDDM_ zH*@_%Ch0#4P!G6T+<$$)uHh)JOW661cWUYdQ|rh*DSVCR8yD24#gpRwJodcEN_W%} zY4+8%M+`M2$v=TxNPLK&YjKO9?WBFzDfgcm}nEHZp58J`fI)2^!4tvz0*Sg%rWo|GaMoM#y){BkQqaxbCnZ;db4>LOT8LB9WKU6bfXSemNPSd z7EOYuy;?WKA{aO6e<9HM+}rkSv>rec&$PcaF%NK`acm_V6 z0{8>JR33;*7Va?7pfH-N8#01ZC3oaUizx{tTb)7V%C$d^>jBLm@Z)8m+09R)P@0Ul z+mHQ^RAzHEXB<``H`Zt5n%akqKn*(}Rko>^tvHVB`zxahs)~i9KjQucG<6jebCtbT zE_)9C*W81{&1ZqE3Bo};R*?|lZvvPRsT^HZDWR5a@K#i{Ko2P^7VKyIG5;%G3s0i` z8$}up@5lkvJcr%WLnTT{J;>V7=6xyFQkfA_{wmzpIc^BCFC;1Tn$yqT;7zhu%pDd?D>TY3w`zg-{har;F&so{sOo$4ZR;PYXalZTz7*POY1AYJY+bvMv6hAil> zaiIo7lr@l{BupdPiEfYXB}Gbp@}2ToDrMx_RokJC!FZM(>8qhYK&8lOx<=PTXlas? z;&W)Jwf?6s6#!Fa2BR(=c>(>?gn^bA?Iz0?1`V~N)?Hk?)rrSUw4Voy-McBmVHHJ2 z${^1aS%H_sf#uD`A)h{mT-i#A!^}&+%edUvW&~Pl%}umHkUD{IpSA2`FI?D$TF3tt z-Jid-`$Ck=bBl|bCMNHtBgaQa-xjNlWAWH~#$V6H;DRjmLwn66gkMe8TAV3e4_>o+ zBPf|n)*`|X5%n9&e?cQ6=(jcfqLf8g?(Fy#hL{t`+MzX+$t_JJRL+K!gU?yYY1R|U ztNlTOZnu>YDBSa)M{Wwf=b>4^>R^sY(7=e3F`f_qYRE7GgL3%$x+s$S%<{g~{jAz< z>&}(sKy%S#d@RE{!MeFF;2EKbm|rDN+&qKdn~7mVLj7YFUtbf5ZC^5t1R1H&Dpk!> z0L~A$>5ShS}Uf@bmA^GOrhJCSPWzQ5g2pZ!o^^SH@CBH##xFH)72$)X1l z3?F}eDX_R9^2OBZWt*Y(aF~fc2sb}lZ;KCUY@AzI(C};kzP1|y-RY{k9tcX6vy=j? zBF!T*!AGD<+l`J);)pEp1EQ(51>Z*OqI8!7sxzR@zx(sSpCAOlyaJQ@ zSYJXJr6Ee)PMEH~C*KJ6qG>PpVeEmIV(^TaIr!k_*p2J*aDLtn{=RCPu{kh4b4J2| z5U63o9lQM%=GPyC@)$cM0zo2u&q!TdW^-46PTYVqM5BP=uuu%me0Zcv&?muxS{qnz$#9NRD>CW? zq&fu<_%0DuUB_5bev^Wy^F}Blt1#RBf&Z?8;BTb*ZU)3sp18)*B2d`xMzMK{7jQi? zlg6*HDf1z2&1O3SbyMF%hgFJQ)>xGiu-}Wv-Xf~~_D?N^6*6djb4^%7!OGiR*I&uE zG^g-!Bd$cq2^8rUSmo_dGSB0DKAY!+&p2OFkc3;$x${Y~w*G#p1Yu=7w)Uh3pP=vJ zbC(C_KtLeQgDA0y1S0RXlPQO#eEqOdG&v2>AlV^1(3pe8)N9|F3@0wD)Qt9qR-m<;vViXtvw zXT$H!`gg*JVhNSfIZ`saL-0idzVtF8R;)KgFUAj4i1_1amYMu5sV|-K@vMn$p%-2_32u##zz+DV7m; z2o1;S{yoYfUb8uI5Tah1EgTmV63*tmL#0Bf))&Og=>66rKRz^@&gX#hSs70U7tg3@?SO_LE*~9Euzbr1MkSAdR_Lo z2G<#{le%3a$NM<<#B44nmPXDGcqW^5nUoRA91T#&6nTs++3;4d+LD88ErpT5CYlv( zp2LaO^aM+NCd0bWA`h6PGNtcR`2;kvd4GS6Pjfu`It9QSm@WA_@i@=&7@D#u&-^LU+UVZ8gH^V#g zdUI!B92p+<4a5Y+A>T6@Hb&jcM$1PELGcu*4XKJzJK^|+%BCtDmrJZq`LHq(KN4JH zXI~rw6}T$quvok+l3lPt)z*x_oS&E!dBvMTJ8bi*pRRf@xFsKJlpRr(;gHt6aPs%IBY+{+n6*v!x5zI4X@ zJPpch_1Fbeg1hjEZVYUI2J>ugGkS{Slrh{;_2!qY9KA>J`>!?8jC``U2rwB*yvuP(n$xT@Z%0LI7w$KG9AsoDXI9ieF}=$fFwbR(MOIFW15{> zEEejwJ zD$W(H;$vAHpf__DM$xfT#ya5bfp|DV|2DWpg6N37J=wwW@a2S~FM!nndH{csAU> zSiYN(ri3<3qv1(>-X$_B$pWJd`rpa;OT~?FiT3Yy3 zq6Zgof{LX3!O6^VLru^9c4Cx~bmw6xhw+3`D@*V~!M_^52NDQ@{C z7U4C?`5bHElj*_JRYdf?*=wTJRk^v=HmvB7($cvUS%}2sKmzP?L@#jgNxYeEPg?)s zJ*Lm;{wmKg0vDIu_b&+vp@aP_vgQb`Xm^%Nlu%(6d?wVNXVwGb(#2)4mcBci9I}~- zF{Uk#W_0uS7x7kJLof{=wlFDwU&Fm_sPl_O6X8q4lukQ+6sDBXHVP!MBNq}EEwPDc zvCMDZ*I)T6#GJu6-n910!dSU;+vKSfsQ|0%_z0b`Imwcc44VmFnrnO#6cQ8r1Q45V zR@6`C)zw|DRZXV%o@IhtpYG}(z(s})VNxtIzA`9jdm)XUaCrrZeC`Kvzx6K3$5=8! zbggB_T*HG>w~Pc|(p9{}g zo8+AxNqhGP7W<52bIF$@kXjDEz?%6lYBqu7NnBqSe}#6Hr6%nAwrOwNcSPrsTH+&8 z9vg)#-7TN(vz!(V36)@t0JT0z)!FPt_d)8yb#9_JOW3^EkN0RS)<2B0Asz!kT_ zx2IBnUqS?_P%kvJ?hUP&5UFh69Cw5N!tvwHNWz;^?R#2k_Mf8JKnUs29-FB2Z7US` zh<=14{%Mjexb|AWyFvRm*JbC#S9ioWNbeT+Scwl9KUMRVMW$N(n1e1QTZ>-`3CPQ4YOd=X75=nm=5Pl-y z0^PY=iiw7(UvSK{(S(+<+Jc3y`oNvH&bKkjS?ZZZaj^y(a0q`?*n-IgluI1g6niZ^ zV3ahMdWDqz@n{I={PsjvFVsY1Er;T$#X=PN69tMt;zymFz$(6{UfIOaTEVJ=CS##x zDNwLbL!iLY%druZfkXHroVzJ90uFS_Y{Bo7`EBtd6N)P=R#r^x_bmuqipLffF^LyQ zL`F@L-a_@m=3@{)m3(`!oD-`=y4$!*l9U`)rR#Sv70Au1#iDFyhzV_Jy=$GZ^LX|~ z7%GSfZRAqt=f^QcVYtFsmFrSdtx=ad_LmoY)PBz7ZPt@@&!+ywLw`~-TiVpRdy+pc zXl}W*%`zT*UA7csDX7YYb|gARWXtBIH-eJ1(q!Oj%fLV}Yin+jBK>hrW2+ie`$hJ7 z-efz22!zCGSTZ9C%K(C&NHIZWi#Qu2DL>QP0jR>D^OHKzQY}Tc;=azS0PPn8O(PB3bNIl)G*S7T_eH-#BTep@OKM^skdkg4x+_NOf@Zf zFBF|amDZ3W?$CcXH3)KTNbb^}6nHcQ6B~xyJ4tGXKsk3PL65439i;`Ix)*Hme6<0K zDZ|UUHZ!se6)!YG#Y%C$zoY7^ePx!VLeO>9liFR~7s|=qZ0qExM9IRekcKb6zIUtU zIrJzJdenf#mA`UMv#?)p)Y7?O!m7>$F?bh;AdJ;<)cL}wb&yOL_a?lO`}!9M|E>8u z(=rmvOdcN>cM-k72^rEByVW#5AMcbRBrPIvAp=TFMZ>xl1p4qfbX z&YFq`zi_oxZMU>o{(T(cBnpdeQ*-U3V2!)>zv|=)azM`~J}EIuRBlQ{$~9`S5-bde z=Q^{QXRLJWqn&}`8tIqP8+6l_q)6N#yJpc9Kai8iD~jK#x$7?0KoxQnX6ST}*;~{! zJea)baLnDbqtAfLf0sCo(k4VHE?G=9WRJ|w2>T)MELaDABC|^>@n=$ml%b@27zN<; z=K_T=1Kl4(j>qOd(M z7c(t8&3)Yy67z#@B&OUhsp+&t#F;%2ANLnp5ri!2vP0gv?|kUpVSMO^Aj3cu3)l%F z!^%KON|V18y|95r#;IRnrqu0pYWy{g zr?gyIj5!E-81Ze|HAwage!!MXLJ}E*0UYV1|zU>JG=2;Lu-ByXf|$FqGoMhm=Buwsm+Yyw9Fj%%%B;<_ zD80&O9B}zO(cd=ZE|sKjBvs!k9mcMD@mRZkLU%li3$7ETsZAHn!E7@Y^Ba>S$x8Q3 z`b4_~%eL9q-FJM+RN5A!h=dr_K{cqBr{_s3)ScP09;~LGagUAX!_bE*B0f^(wf3u?I<@Z#RJoC6m zS9Us^(l_}0@R_=}YBk0~NIb&p1Tnejm6eqiX<~A6leksoiScec0Jge?Nd$-%ex58b z0-ENcq^KA6HO**JQ~=r9h1+V1j=7mxm+9bAR8&-jZhP`b0tHE-$?j-UBq4v+^Ye3a z!SnyspY0K(sCqZgVfwo1qppu}s*{ODj`yAt&@3kn9AB=xi_TG z60N|E{iM$6dOmG!wF#rMPaDdLg)G}D)`=>g-TR%Ol1Sbi#=;RVoaLmy1iAI~>-yc% z#gEo1^EVT}1p5q;n16Iao?{6cFe1bfQbqfaiwnCM8_BfrI;e||E_6SFF^4MXp8Klh z(Mv90dW2FD4Zo1w1d)cn@3%Q3&aHxDPt=Q(_#KTACIPpbGE1S44@;4X5e+T2KkfCN z%JAyUKghG&J*#Mz?3XPS9Nb4)P_519T$UlEcdM|UQ=2&UH}32LL+?`WXi-NB6VVI! zrIq9Ggxa3?TC;~ju!DaP2bJCZ^@%tqAX4Uqm8IaONU7*BLRxI(q?nGEvxo+t1{Z~z z1Y1BD!U9=8T~Co^#2p6TT}M7#?E{)gI=2AZimB#5{v&#yiwNDQXU{*AzyS5wSib#6 z7f@)q{PPjnVLOVQ$?e=A%kzx$tozMpl5-yqxULUPo~K8g|4}g*5!XfPbfeK4v$eGq zAWdpk2NQC;MB4j4fq@m`lafR!(YKPd?cDpaj52F|-+X*-%JqM2c;9`A7-)GqYi|W! z8)`zTR0C&g?ee9B|E+`ZSxh@;_V)HBj;I5zD6Aa=jv&AYI;_w0;Q1&W=94~vn-ruB zTe?cKF6WdfkK4{dT7~07ufJA2qqw+UNWlI=&58Zp6ja6eTHJ-q;#430?b%oE>r4E9V4}$j0~MR0-zTkg;65!AT+)>p}#Khf(m*DUATsu%y}cw z@d>;b@gtuL%YB?}TzNjUa{sa_Gk=y8dfhk)kSusPWL5H(-GKF|<=TB9)<~Y1F}7Vw zc8V$%@m;iFG zFugBjN>XR7`vi2I*GiN8Z(ab^v5%1%(>--#U9+#h@TcSP0LJ|#X8 z{nxJs1kV>J6GD;t2Hei?o%!TvmH5i-vfFw{l($z02DODZCzJG`42(c_M(|nT;>1|A%ftqzmEY4c{WtqnJ z>*z~jspKRO+}e=Rg0r^jsRJE`7txj2Zr1M-c&L)n@<%FTFNg4eNha5kfy5uwnN%|F zc5wEAn3URiEJN*Jn)WM5SOZpQB6#g$Q|?An_Lpa*$xngjroy1p_P}yiju^)qt7Et9 z&oQ=`*^RaI40CY>$n-|bt@kq^cYP60GfFR!}5)iB5eI{+uT`Dh{)3p;!L4`9a3 zr>)9y-F;tCLE-P6u(&u3G&HnK1_z^p-hVSUC=NI-WlM^MKTdg)@?yh9DUgSJ7gzMn zhmB6b3?2kMCvOnd>fBgK#-MPSocBCpandUvFH606FMZ>Z$`<1dBy9Acmf#Fq%9w>a z*IKzvh3a9i-^p4&>FB3LGrjT$o%WNt-TEpU=h5^@$vm#4*invxvyG&E2tJqoVwrU{ zg?>Q-ZE?TA^-{??+R*z{oWE;+0{4OWiL;V*CYnoB5uXU)QguQV_{_KBrd-0=%ji`c z$F4%vEx}zd)>aZe)Jmt!4Rpq3?eB8AVnnG;MTPDoaI?BC<40toO)UEoX-X25@{Vzc zNOt(aiR^Uk7!s9@)#9gSOL9oMmdKw&K+?El@g~*$VlGDsa+BY>a5SjgnS^c%ta)^C z<|5YQquIIBoa?nfrf6K1ZgBhlmN8@p2MmH(B6W4c3%!;fJ4{n09dG0`>P+AOV!XBZ z(iw}yf6m5ctt|5Z zIr;0+@$o-{bzS`dBP%QGtix1p}C!{mw<`^^w5YPR)jW`nVmaTA_=SSRN zK|rRy`{mRg;H@R0r;m}Q?@VlKx2M~S+V+Kc zdH%qCivi5>0myvAfLt3u{JXVmo^9IW4-L>j@gFQku;L*(-k%$GT}0V403^VHD9@+% zzWHr!Y4P!>X=!P0&lf`vuXo*3zZs4H1+ry;ksc5;7|-UZ zEUeJ14^GkdNo_xCiwF+>#KpzM@pA_j*ktfLN&gLaAFeqVrNQL8z6W|^Gus6fn2xkb zwIg`4l#p;=u(NYaay@CTCsC zOsAZ^`$iuUtvP?c|K!G=>wpTg(ku6QL|!$|qfC`vkW?uTJ6O1@4SeI}+Y&*!M#cNW z#j!Carw1m!Npg)SD(Owq_LYTol7%seH&>1pFC%A3RN>RCNbGH@AYDF=Z%`bp%Gkgb6wPvD`CP4!aRW(gOmFdkYdmJTn zBO-CUb+=%!lj-NyThPTQMQmpn=rsC-k$dcKVa+T1q@UMX6?YrS18>C__+@fXt{=}n z)Q*4LFpS0bv6h|O{Gg(Z3dwqfU zUY++LGkZTe=|`1W;?!zH0?f>_D=SilhC~-`c(QZAruk>g(sZqXjn<&cN_+1JV9Vtm za{=2y-up;d$Ds$B=XS~12HX_2@w~?lFbo26onxS`TULN6NCMbFDT066iD<{Rwj$`w z1|zYbA3@!Fn<0c|0Dx0bSHF6g^34KJ`J-fI*HtEj!DJYPzvW83VAIp{CM~h+rjx2jXVBD!>~&g=v#J`!Qts#4wA-LQ_yQMgh!nSI=z8o@ z#{Kh6PM#;tg&yb2d%oW&9GjvTJ<*!oHjeZnoMJlz+!FvLQ*AarwJli=nsV>CQ&*) zc}12Ig*7%2HDAQ$pl0PT1mUx%Z!ix7amhBnZxm>?7a-VJe)iy_sE99HiUp8`gyoa- ziQSDt%U47t$%5~Ua?Y@vo3XciI8jiOa7{J?o7>+Tn#4vX!xc33{2IO^RXlzlVta{n zla4%*_+*;kBe0uDPkfzKzk-R0S?_+eXV(qx^5*{MjeY?_X0ZQ!7(gAVkvxzi81S3p zM;;{N{ox64CbT^d;Ys!d%qo(A7dQZe`52p;I#Q+E-U8`*nr4}}vzNUgzj?I-{PW6+ z*6Vo)e@W#_r3E&*%xKCMp-)3i(PyrE*NKS>KPyf?T4y5ttaZ=*W zd4Y*<`daAPD|Q@Rc1n^^(L%*nBBkted7PPmzKH*)7ocP(Wi9y4 z)znCSbRvtCKU60D&Y6s8t^|c%vPnXZP>Lfu#Qz$KNg~O{df&KMS9wyubLdlxc9{um zb+OkmHgD$8^>?n6Jg&^W1_C+d^R~@aUAZFRuVXvhch$|dmn9U{hJNqt`8xz0C4TY} z#2vlNc^Lr{TLt}frz|vnDsL(=B$s`UYo0nzt@?NzP-X9Q`+T#UY6T>3#%{etco%pRlal+7PpL0qBF~Q|=H~ULW62FK z{|?nczmUkaSY@tYHrYPi#E1}gUGq{R-b!F%lk!pJkfQOGmff z3)h|Ve~OR-e#mrf@wBB-+DBh`&us~mR2e!l=L!=UCiUMX2b!nBdl7x{Yicj~VG#s>|Lu`E~qPHVUGyk5F#hz(597ZDAO>1c@-Ob6L?b z?76oXFRH>^hRxA>USxKKtdz}|&;eK5bcQxtl!OfC2^>5Mhy$BzJ&@M zFd{{TE3Q(SotgP%3)XSl4Ei_t4e_~a2TD5xV|5l*R(U|IY<1kPbH6fkIa&IJ(mRE7 z*N-Nzps6_mBt#l54n$Xb6UNW?7kE5wv2}G!)HF16k0-!fIM4O8FajP2%2?fR7E4q= zd-`{ivM5nv_=G56KwP+}r@z@;*RhAC#rF z$Re9JQ?j8yV}b7XFS0>@{(8RZIK^nU%7H|{GaO4KJUlsh*5s3H`UM_1kcvS^|O;ccxmcHgn>9OxfR!M$m+YQ55tY|rdF5pUqDPJo*hYM^<0nT%Wv{l z&(h{)6(^hW(&atNAaIZZ0_nqxw39kzWakU;oN{&6-&e%Y`8z}wSrXJU&Y$-$(CUU& zmIrBBsKIAE{DDP<6d_9RxyM*-XMrVPmo((kcvSGqxICX}F|O(=|8j$RGek~K&VObM*b#%_2jC40 z8`~q%IYBE2U;==(VRQZ@#bvWG=nF;!9GhbwBK!2p%IIhk4d-dY92UDB9+0OO0C`ZC z_fs7}|1Ok^@~=iC9D-yz5RT!qRwR=uWNB%s1xCW>>W{|f=5YA?uHEG{56H*?42Bjn zlnVS;pms)CcmT9|&6g;en3)-Aegz(Y3^fcOVeB7{Bl(9-)7fnEa&r8%?OKBXhUEMH zi~cY)fbkqKWCqJwQYL0*pdtipnBa;ETBBMlY;5dEeD1G(3>LPwg(W4SrOL(sP^Vg@ z)&M|9A10PBlgX8|wPgf+6pccTl${+!VIdAoEhs7~YViZh?491Y!vF7>Lk22PrUmv) zVoD0o0|6v2OF*@cL@ZLGo&{A1XlDSNI~XdpRAIKLvob1L17WO5l61?-sXta=EqcOc zeOW;B4Rt-NaQP#ct>(o5cehYf*C!h6;_tTF4~q?1lD}~qd!LndhaRGZP)5Cx%6EX2 zj7{;i`MF6v{f^OoU3tDSq?D58Ph|Q*+eOnAIq=8invH4BrEb&j;M+zet@VA~6H>|+ibk`1&rR4*^Ay5f$iS*2jBGzn^zi{JfDzs$IrfAbWH!&=+< z7AzY`g`Ji zI>m0PVqKA>%w_th^&WPxO-#%(XR8o@-0zZtfbZ-y4u*2Vyq1$_FeY?9;i{SQ62P3WqQODX!jD5}0wLWk6^-8HyUTG$fe?D@_;!_!c_`d4v_D-nL zJ@RLHE$q-V`~2e5%}nzMT$>qQ^me|kCXn*kqe8(@`|Nwa+3aQ`jLYt|MQ+z(^eJu~ z@=|2b2&(ti$4_D{j>{%;dsu#Q|Ka$l`2`ZSqcO4SyU(85PBtl<{Y3k6T}i741JpXq zDLJ4G6BgG0G`)ypD=-JHNN9OKo4Lp(b+i#S2vP`t=E3-~vq8W3{uv)+Lkhpp$ zxwntCzV(3R+U)(xOU zWHT?;7yDop_8OlK%BHVJRVzTa2WlhFJPf77BNMx>-7grpYPO~)515XJNtma4x^`m-OMqy}>QTu?6b_CzzgrdFBjjwVOxfh-s_w+MUo z&ip&~=lr!i$3ydE!Q_Rr|26vedfk%nMYFg>#a|;h`j8LDeH;Z=BV-W)Sb^{ z@rEE1Mvl+1k&n|mkV@w^-p43P@&IIdfj_ecV zlN4ic%4NOhn}B!6-OJCFz=)R3QOCmx^tYv^f#;KT{@H^j!8ul^?acOMzTpzxCp`Yg z7vYA^Feaob-(T4;uhk8u%}P%BhFHu?q|09AVbh*-fxF)zRgNG|?&96Fq z!OLh)InrZvD3KIr*4PDW~srlg|GY(IG5 zI@N&_q|1=H^~`hI(G)rn0`<{~WpBze4TNiqP=X_{^s>D4(*#DI_Yo>$(Ov{SQAsa0 zL9Zpe-sP2f+}n=tNsBfZ;bdwv^LWXFLriqz1C)cs(5FRvZn?Lzt`nUXrgkvXp+4U3 zAw~A)O)%C+7^H8sIfYfx#!>Ngqef0S55q`%|JDZC_ft|A)AHl`-45dO+{|y&>NO=j z4tnVMTx^V|c7Ko#I+$yYoXxxDV#8nWNw~@~8M$n1So&f`E&Xj}yd#9rnS2Ql^ycqE8V(;%#@*k=9dZQ>Z=`+ zn0k{wv)%!W#68nm>oG2uMb;Y68=8)~J!d`bTT(~Niav6ojY}q`6|EBc1WU6d3w`zxnPzddUad9*{IOWxO8o znRA}5YiLoZ*QMPBkae%kPg?JG|DNv3uB@mTSp#-IZFL{_HY5t+ zhWc1eJq-2RV`GvkJ4i|IIjgi@b}Wditfn;sD@soIby2;;L{KQt!3l*rd9s~HwYz@X}B9?tBj(sM?*_rP~C^YJ9J~QRVj&?oZfxE-pe+F_=z>lS8m6M*K52eDTf>DT8}#N^+twf|t{Mj9AFYCNANgzT1@Y736#v^4OO zxntvjo8wx6XYo2ls(V7rA*JYTLM#V5^;0LLF>AJ445t0MU~^jSFnyoqI(h1Cm_rey zMjw?kQhMS#k5k$03Fy1)f_`UB`PKP19C!L`nCUHd#9W5MBTSf$m0_G%28MS%h~OgE zT8)|AR)Qr0sPp6vX{LByXkpNBSYO6wei^sl&7gl)Ry;}sySec?W@Yrvs_RiCW)H+g zS(ny-rlhjjJ1oxLR}d;L^3}wd0eQK>_`b|}^E@3P1!jr5oAO)fYfl<#N=OQ#$@9PP zgve&5jWWGG<1aTxx4vcdU7m7}e6P&oXg|J`e93hlPvs6Vt+o;0`Kqj!F&3w5o%(d3 zlMGoBwbNuB&@^na*XirojrBxudVc+_ z{c-8|jK}Mqw3T^3<1QnW`)-nX>Z!ws;esj*w$YhomDRRW;q(;EB7VW_=ZwvKzuoF1)qcg!#Y8I4Oe33q@RpzR}k&;j? zh7c%H@jLa_SDTd=I;`V;{aTSPhe*s!^~r`6y=?_#Nn}DUR&W1AKC1P->bPjMr!t*G zY4duCHG{7uX?bqH?(m$E7_7}cKmzYNiKrDzgWF# z$PC^Wc2!-6Qb@F~84qN?I*;R-S14?zyD;CBP;KINUTTR;Iv&?wNX<@62wuNYZ3+hgX-R!$n*O!9o|A*&aBN z#({Uk$g`VOQg^V*N_4y9ID4~$E;~4z%NN4v5UoFtZ@)ju_e?D#D6FImho$3JL7oZQ z1A&@_w2R*pE>wS$`b*tU2CGM}Wp7ALIQAh1QkH(d;3LNRXb&5gOD^`@Ikoe-E^Ek z!VDWx8*bj9f3@3*GuJEBFFI~7BCmJbq9mu|6B5(Hqc|a_!=8SIvE{j5%qs-@}GxaJA%D-8XHFE2Nytl3uZJHD)IgeY;)d9OBM z0B2@S4vrdz?dBn-9*Hox@2a{(Qdr=_>G#bH9(VZ0+%KYWrDe3mjSGA1yW84dFE2}K zp-4@>eDA49{k-H3+U8;62?-t)OVidW{Z5l#DBDf~{+!xvg7GW&i;eaTp-X1fW^4Bw zQaN&;+K-md6ul?RD8aCP*xaQ;g)QMx?3XhO7Dul4?^P?b+5_U~dB(EH60qxc-r<7* zs#He;C23|kPa4&vq+vPk^gS7)$(dWP^RrVHHkR2{tNf-8f3@Pw0LN~V!72qlf;TAE z5O}xEC|3(aN#bw=n<9k|X&*=Ql>`JVpm0+H>lX&G6)4RFg24PLRgUqI9jlGH{N_C3a@ecRj`j___xa+Y^o-ejIampLeSu z!e>YwrPQd;EY9|fBN#cW#Za4k&3FL_Cyp}^{tR*^Xm~M2b@-&xK3^jiVW`H(twu9j zF$mM02(RU0M0#y2SLEU|z$Dh&z1Zn_xkKS%dQJW&6PJ*W%pEF>)7f*>iHI<}e1y?Q zjY|{$y)qh!eTD7wR{y;Hs1t4$Wh&GIH;ZO`;I4_DqI+QLYBXh}htG;b#*+lgibBQ^ z@3&&x@z%2+NN$cs#F5HvPW1G4fpDh>j*`9V`diPMgwR?6Lvd?oIvRO+J#i`{Ab~P; zD`UKSs~qY5^1f+Lek);M=+N;8@_3U6FnBhS%g^7(Z{Hr8#7yBpyGQNeJWn`Uk;xdx zin!*sIYPw3%4*QusGzABlvk2?rrj%@PmY2!^F;`mQd_)lI!a3;AXGp z!GjjdUqoMI79a*!V zp0htals0C==L|t0MY}?SEv%-97x$NJ%$e!w(8|`Zl{)y0pUgqozP-_Ze|b%_Cgp?o z&bLbB8HP;1STU1`ifmHann`Yo2?h8spN~*Rv-6GtC@ZqOS z)YOk8x$gBmNdAhrq;bEDMIB#FTnUK+foNK-T{jNeYpNYkn*7JIgIY z3&}{LhCmdL$mB3Y0l{7wTl8`dtB&BjBZ7*wvLk8*#do4VmXkd`Gf2UiyHsB8F(a^`lIeDKA#2d|ee+l<@2&Bu|CQT*s%IEW^Z9Kk3>Gt0_Bx3@s5`Wr zZ4skVV6-h2Q~xntTC~W(ahQ&u2|umf;X}?!+7Hy8Ok^I>VoEeJn!zhjb5Z?W(^&0q zQ5IPd1$-H7?&QZ|pN^Y;-oP-#j)xtR$ZU>)$w^`@)T+Jw{WBts4iBC>x*NOg)&J0OU)HdDnGB7^zP@|;Y4oy4 zM&B8R4Gdml3}HrssPi zCsewiqvXf4Dxz`XTxCka>Y;N<)ccPjAed^;u{11SU#$)p&~QGk?v?U8%W zwq!5*iQpT1BfdC3o62`Q6>fc>N5aJG%}9a^^ADmmjZJ@@mRe}YgVLCHX?Z&X{Cf*2 zecO}yUtc}g=Fu;Qx8-B8?Y2*c){BYGh+kj&v*FN=+;(f99-Kx|`JVTqvf3$RRcA!L zAaYxWtD(%F5_T|csija4d-mZFWDiub>y0G`-|$=y=bJPH1T=|NFdp)p4=bAlr4D=V zGm>L|opv)O(D&vdAlo&{a=%CN-;omId;XR^r6m~?65Pls|2&0@_+AvKCR<=^@&eqg z6t6k zW2pY>`aA3`xr#LpGS4f*g)( zGBOJN!bR^(w!xVb@6@U*v)L1s7|%Ua!rs>}ASGlX&5nyh+`x+O=8ngR>h<#9 z_bz<-Bs`VLU$5+fP{WxHeWDKcI z4NyFqQdqV!zN>m^kjIs2PZ)!ZhV&c9M17+|snhF9AuCrSLWV?z27gPPZV=k-|Fq+4@WPfs8yAvvPItZ!mj`!Y!&vM(c z@BhsLuYCk3H@p`no?X{!q3?c5*cMWfe+x@O=nHEN0%Kj=ZEDz1xF7XUJb0~ZRZPhK&f~gz z6t70b_*P@;LJ|_h%=37#5e7G{VcNW%cmfqfaT$^xQrp21>q+1hT0t3P>H;HFf-PHa zym}xXdge-R&%=R$2ArmZ_bm!J2~m{EW#`qJd<>#db9h6X`Z0Es;>gevSDf{X`{nj$ zme(zF-sS5sv#aiBL^2+i4Kx|OmLPNc?mrMOL6o>tRsg;w&mZe=C$-Zp(CgbyCO=jG zrx#%OyR7OL5wwy<^a@?!qjPrm(<WE9spbG)nFqYa_CAj?kBU02%K&|1?6_hD>9AFzyeQ#JjzECy8Dc`v(|9p zcrgEhIU>Ed`TVOJGryhv5z|Z-*6Stc`&Np%b3;s z1iT*>`o@W=BQZpoS#uN%N}2!jVbnUU_P30L85)u}3E98^o@J@=PJ(AFMo@U2853$5 zr(6Hz?wzhw4Gqka5hDp)T1dl9y0$dgE(R**#*a7((-zR*R}o*e;fqW1y8I3*51(n1 zrmBnq^Uuw3=!D{q35W@z!Z*vZ)_lT}VNqk*Ewi{0l6(ERMo3hZJa1F@!{OtH$`jWU zXtkXFhio|%RE8ca<-{~qA22+$JE?2BjLPyJ2gpK+$?L=RlBJ^Ym0O-iq+y-bW;8#3 zT&^=g-M(~;dIy4OEl@9ddjz_eFhF(XWl0runxr9zLu_QcNiGz}78YgO z4nG(}L@1{Cy5KYwIh>1lVF!8B3OUXM%eOz$m zAI%22rQ{21iNO;^F@+yLGo{L~uxD=VSTc8eUMt0btONuY^1e!_$;of&3XNTloA`&b zX8hg%al+S(0nI>FV#SczcAM9UA@GftIrX$yBn@YbiqpYw_R=ehno2;`RBmw?0qK0* zhFv8yr(ZynmaTnTu@l$5A-_?9^n8=$`EY)P{LmM@%j2{mjBtSE|1FGfzc_Tn zW--Qg8#|hSOTzJrHfyO1Mb+7%Oq8@LH&Ki;c|-p|2{+yNaJ`a*yP(<}V1@L8{y`{j zHl3u7Mv|huhCU!G4AVwpKK=KXjCNz_QE)OF1lzlk>;gpAG^YbU^o9iMgS?Urb{|or*iV7t%vUBtiN`n^@hs5fFVXNee$w;W3u-KR7$G zX-QQU6hOI#d`K%Iw#c#acrN?o|F>=Lvt3ZNb)_x{S5{dU`OEbUTPhi;qL5l*eb+v$ ze<+;nHJ|Lw+{FhWaKg2AR>L}zHc(Ufk6U~O39FizfFN?3VhaNCw1J{xGxZ>btd8xs zSQQLWWmwpVYxKk!zmxYMCURE>X|tH^7fe0UGk!vYI4GR*W8N2#n%Zo^p-(U|{DkuY z$2460k+OKnyowRAkcGl3{MXM!U%p(Qa7PZ=wIV1gE3&?iC`|I@?F!!NqsZ-M4+6L@ zIaq5nUU;EI9pB|GjdukMwdUHV0UaaQR*Y!)1SM!G0$>#p^S&Ql_aa)?R zhkPtfcVwUD7jhc2da03GWrlB}zOqbc=wAgPS)hya3E?lS7@|S3E=1!vo$sY%*#|Tf z(M@E({ke+oo-MT1Nh>mB(~KqM4vEh2U-!`Bk%f6U$=BTBz2$pr$s^G&?i?Sxl2&{# z8W#uLFmw$R+9F+emv`{hIph;b34B?RQB){bd2CEk>C%@2wjFZvYn)O4!)+{9Bhp{_ z8{7Vol-Zoa<`aT(o%`{$VHl-Y{VEa{n_3VW`k zWK~(eTYX^qutwh&R@)iO$t|yO2k1QWpf(IB*vO+A@l!RY9N>P4` zZB&pZkJRn+#JZ>o(r2%6U= ztv}h2TliyxL`>Vpi>^Kxlms2*JCT5Y?J*r12Es7!XNzap_ z^&_46-ah1FG@<$&@&htUw({07tpbf0CkT2ABEZxcXn-R;@8#Dwn{R1uby!-v#&IB< z?x*%mkY$yHM6nj)%PQdZToDAxx(BMVb9A84(oGN9f$DVLH6M7YzMmz0>i zkbr3qt;OMV&hb6-@qm|-$=@RH`eviOpJ+b zPHfw@Cbn&x-LY-kHYa8$6WjKi=RNm*&a=Pum-_AM>V0+9wf}3aorSI{I&T7uwkS2p zYD2ZJ9i63TWDn)B?{zwKE56pzV2QM3q(5QmEa_B=ps2D7R7no_qWEv>NaFeqgT&K6 zl^y(uc_$B2i=9KY3SD}o|AdR%cQD9cOK4wB4kT>j)Hc#EFFgLePqAjNp9mz9$^bq% z^QgO*k-Gw_*X|Wzt*`?L4cVm4u{kmkj5P&;cc%i{TWVieFOfN4H}sZ3t}kZ(0-@^9 z|5eBY2aapE<9)oxGZC!WW^bo7ld>9{8wnwyorV^duU?+WDo4%bJv#@>21>^8oyo2f zxVG~-Ej2sM@m-a{!2;BTAi+9_6XuIZ?BufsOBoE0u@4NE`eRs1;OBXlAk$)K%x*qX zMI3hn(|B!&VY{lyxW}dPl*NE1G6xFPZ7)({vRcz8lOh0ORylmSl1Gze`}r8m+x{cB zCy8nzGLb&y1eug8i9}|y$tO#u7LYxs#dX3rn1E~eo(my8tXFyhtENJ6^U0jwNzr=h z0H8s?>tyVdsj%XE&tufVx4=NHRn^w;{WS*+IW3tq-q}kreHfX&wLh3Q&;O=GgaXo2quwyJImMKs$}jzK;J`XOMl>V2{R7ED^V8BOCW17HAIvX zgs(>;jx4S30noDW0FrlKQ`tP&S~fY*WEJbyv$CBe6S7vcv>3z0ozBrym^?2GmkLEt zF;DjP>ZCk%nW9_m-R#KQUB?XiM^Jxd;Yqct%yjOrGd`Y1&@MOFZ_+0IQz;~*5sVD{ zg)yP3t~2~Pf1sH9OVFD;ZO*6(zWq%};eC0HS;(DwSs#?r!tWUrf54ycYi07xV*ZHZ zh;42yq_(vUs^b{$ z7&{OHT~1M&hHVy<5(>KT*|JCvtXd2$hlNZPZAP2i;RohRAlNgx+`!j=-;$JahsokD zWV~o_@CKNWNmh{hEg}eo-ibpH=Np=HWzMJrZ`!WQ;jnxci@cki!A?>7BO05(JS`L8 z7;vJ=xof%i8V(?lFlJ+40J<_ChG6V^%&C9W@3*@YN$Qr~(t>lvOyzSVA9}SV;_61uk0@=C4T`M9yfov>$mxI#DmyfP>i2bb0&K^MB>qOJyRN5Nms(Gpc#vflLZ zrq7fKFFW42qMJAoNxD?vj)il%JC(=#%iekl4)W~p1p=M1g)-@1z8(Y$nJYfAZ9C3? z=N5zv%z4yx9f@)n(uQ7s(Ig1cW%4P?Z%x#Yh#ktoMxT$?PPAVi_vj6)xX}F3f&+_? z)bSn@oz!QFx}Q}e4oc^ADi4XO#*HrKsC%xoa2J7O{hrL^a)M&pT27EoYve|y#41|6 zXgcB(;jnhz$kJr+b9%2_x*qFx%_()F{*IeF4VIWbA0EPK8r1Iu~eMdUS6?rY3Z40G4S218fAfZuqv z!5Xl0*lRksESav{k;De-)S5g-d`qbakin2B)J=aie4;%n*pQIY0$2y7a@QhhA?LcB zz!|3Trv@QIu8MbQwOisUSU6|qR)dvJ&qsUjSr?5F$O9a$ok^K)*LUD59>7}ou>UtKBvCwZGf zYNr;+-L<9Ock-G}2m=H7R(>E1?HMINRsFpdyc!;HENiVAn3YapwpnG4?ya=@uG$z_ zQ@D6vK`NP}K45|nf=*cd%~%!ZGc^^( zWH2A=J<|JC1bD>f+VZz48yqrQ3Qddu=Y8MT-n6#{5g{z-yr)am zMZ+k4{vST0UxCE7m$4k$=Yz#&D3<(v>>!(5tp5N>rdnHl$`<7AVFE51)U-AsMi$^_o$YMIrYcbbhyq=mndxf z{EmPrTy8b%D0@D}AdXR%uuIyGsS05U4Ws^a0c*$U#c{s2A{;s$)B;*}Y~iB|krQPmQ&+$@6s?9n@8&=Hd?0tN_&{VkJLZ+9CbV)~ykf3VqX zi5jNp>9E|P5bys`tJ0Wieh*6^W@^p#a}%l}pUKq1Ifa!RC9Uz|@?xho`~VQksgAvU zY4sY&WVl`sb%`Syg3D+W0FGB_;86crmx;qg=4n6DJD;sZF=|6iq+r$> zeJU1)JJTN>a$Z!72*+~^`L9p5KBF1ZfBoeeKGxVe`)j)snSC_c#>|svJ0M8k4D~O9^VrI*1oRq5Ep^ZAy*w z_3YO5Y)a%x68^4$1B+FPT(aq3qR$re=sMo`oly;%vsmU!%UuInue8M>@V+qb?L@&^ zbBx`fSFAex<5)_ir9YZSUtE&Wu@tYL-Irq~NdHkp z_L5JUf344GyL_;MVSC=flnx*om1SeP31uqu;#%tchMjH$-*w{2v>rCAp)9MRgwY0? zPx$8Lgjake;@IIjsHZQkA@$v{qj0WFTz_q%2@M0iz9&DqQqN~B9EO;Q6L`T{2IF5) zgfHz(-NuRc_M@~hO1@9aCo`r4F#*(psYo7CyNBRBBPsapjP9ofG4MEfK42Q;g{t6} znM4z{qUoLa@5vf^-vrgzA%QzEA~X9vyk1p7K|#X7=G z-!&)vQBq7pS-{Gjb^W}vsCmbOB;-=2!9+I-*Wxh+McVds7v!)VQBnv3k9-T z!odp{@jUk&FLy|0wogQzx{`v*V8FPRrw&VW#Y;(p$x!FynMh~y5*AH>O}SUud`rc^Or}|MOEV;SEX`&`c>yv zVE;Ddks#4TXCu@V7jzj_r*@yIe&kvx_rL8rJq%)Sz9`nJ=yo@Dy-Djq;dDw1f6K`cQ08{WV>BPLlY@AaJb=p=^qPD z$u{-7BHZ-0Zq;wEWO!RHkmazMCXjU{wn8zzZHe2@^l8l6MeO&;g7CX?ub=;Nf6Pjn z_S|&n{$sA&a*7LwFu0T69KxxtGebI3|qe( z{LYg5P7d7HJ|4zJ_-@+p*)10a0UUB%O0f3AdmMV+0cK4T(Bdkad@na2c1DO>ASn2} zgbN!G{F2jyfthLBXjG|v31kMo^rjM0QZG>Xuh;g4g{g|4X~Ts+t1JMRa!`SgOG&jf z;L%Ck;o1EKP-)-H>Yq;;9$3w|h=x8}#DorI7f{s9#%l{$I9^aa!H8Nd_$CS=ctd8? zW%079;*}DJ#!z=`d+MU@qK)(9KG5D+Vr%%NB~_6fB2Cw!R+!3>aD8`1ZEGFVWp|-* z_jU4M?s#xXDCidL00#&EtCAx6Eq!JrdtF}*Q5ua5Eeua}K3;~rr$3JTTnF>ej#zFc zOh1t0p4zqNgY|#FrvEhIe5u08L1DK%jA_$diaay2%`I72e>v*iXinK|O{ZUgI`^YK zPxs_$oD`4bX%_1pcP_hGMxS<}qb>ia1emfwkIy@{LAS`rTRf&2&oC&5I2V;J36tJ% z^yq)z<$Hc7UNU~))~<~5^V@{5@79<;xm{-zE53B%%Pavsa*BH&DEMQz@5j;cJp z+}n74z-$@m@rx1Y$JOxT^BZ?w3Z?sGI6wkJn#J>MI&KqMwjR5@)jspb?1sGk?6~!3 zjX5tNDw?0zE=|~J4_p6b%-j-Px!m&Ud-FrDKD#)v*L(Z%wMz2n0~Tb<+qWMu?|m-a zdBjDLRaJRE%G#xrYmy3oq)(jc+{VY)8lu`er1ANdWcRDvdd?Ibsi>;tM0-E-;X5vh zQ=gD=>DsU|td^BiN9I=ui7JX9bwN_LqO}DUzScMIV?u%O1sJ~KLJaP)Hp6=Fb+sS) zAN4Qpon8mqA5~R3pPq;nG%*0u|v?{VgUhJTYmI^Hlt5)@ivzzhE$P|cg6 zG%}LBlyFC}xSasu8N1alR~*4Se(;mNFbipwr7e zX(4zztgxxw&t0z8W?<}>-tJj@cY{vm6H@T*>cIXURxyW`e@!r43M$9t8<^-UdN+9b zL~-xPjlev5HF?kKGoI?!{dFE?PYm{5iBhz$Q43$xLBAW-e_PjIkI%nlh+VJD{~r?k z`p|=4?d*O9hyaj!cq@06J?SM;Wmb_VeN`dJeq*M*(fX)3GzD~31}PKA3N_Zau(D}j zBtD`WgF{6NIvEI2_3s<6lFyg|I}d&l{*9`-Pd;orrRpt(<2uX3$DMK4>l+dzizt+{ zyox-tvo?gJ)XwDO+W?y|Ed8$?}onh?#^^|rOki;m#(zK zxCKG7o|fg2#%w{wL=*Muc;%jp6*ljxK4Yqy$-LR+`IMfclB&vz#!!k#38bh1%KWxB zRaN;s@~Pc1>Re!{X~WoJT=mkRI2Ls#N!KO_A5u4J9|9~9q^y1ks z-v~|3RR+9qKQgq{08kmqFY|Y?)!?da(x~KWa-Op9!Y^*TcH6}{*!A~v`lTLKT(3TSn7M66BypdZhlc;gC& z>wLINNdOy}3k@&!Ts9mg0lmHcIafT-=i5)&HYyh9M~igtU*)mCk50RkeFTv5YV+`U z{6)6dQ-cczn5lbzUWQBt#Autt%H^srC+7U&p?GDt?!!nInV}!!A8?1>xGJZBA_c-~ zCM%*33IA$`Q*DcqZOi-OVB1F3B>_AkWgCSB#pM!#{*s9bETR-PtQ3(^xrs6;`NfzK zb5WueW<@U@e(V`jn~mO6SxlG2L8?;=g!2FX%K}iy>X+=1Ho&S}`g$s7^`h%m79J?8 zN;#tk%)KhVFO7-zd7go9SP@4O=M(1s;4?1Ey$#H#bRVpKxhyC66X|Adr#%z(QS;Q0 z&ZS6`PP!r2a>&zq_#pmQpFgGZvC>e5pE@mah8FU(2kKIOs|g7*;ONMFGWoM8s^-5- z*6a6OOIw?Yf#I`g;Av6NqHMdjZl1KzY@Yt=bv8pAj-uY6VR9gDLwau+y*e2u^=TSs za$|9nu7x7clJH&TEOJ9f_WGI$z~l(i^21t(FPqGZj^|?q6#O3iyE5aEEJSwo?!t9B zPKu}|49UjDvdK3y0;w*RYN6NFpdwe&NrtHn}&){Q&P&5 zEf1^*UrMn-^?D44q5dkj7vy*Dyy-Z)1s%f7Zx;0xgVT98!UowR*7p{-s)0RYg!mS4 zNnGK;mZbo8tnaQc+rDwUYWxj!P;!?>D+Os&4ZSp$+wN_3W-3<@MxR)6CEw5 znxsKk9K0us^weuW&n+~_4EyMB9cloef9LqJuBDA6?%jpslbf884a1iyy&xiGzT(t| ze+q`RghORkY9v+@GTap-`Z;{A(du~hE8Mg_?jW5Rx5~WONbNgq&jPUd6WqL7==O_& zK+d-vDhuP_2`l+}s@qfl8gfc6mRqFj4e2dJNGYP}s-A;11-f0q0>4~U3qqlEIV;Mk z1I-<6mPcG@G+e+{mXu!|&{u_oMTCa7wp3JIZZO7z*Ij$rtMr_hbNNI{LPK+pPt+9A zTwF@6E&>S&B><=C2R4Nj(q#OqWf_dF11Xt{fB&j%Bvahw%b5M5`0`+5qNs? z{nJs>n(^x%3fqd4E%p?1Ikf`qKGm0+2`eV%5F-4qBE}kh>2N5fJI1Bw=Lf(4aOwAb zJ#U?C!*O>%*c*bAcp2AZFDW-VwOWmoAX? za!RBOrZxSQ0TGLljdzdi*IK`YsI(Oc2p)4nJ%T^*T)vE@Lx74dcuBk*X8DMQ3S7GB(=9 z{caXg%2IpSJH=-DPisc6z}I|V zM3}?p%MQGRhpLii=|>J3F+qs`u4up(?$@6E%VCR@l=Lmv_sg%3KOe*tuY z7&UZL1!vH-L}1z%s98z75+Msu^qVdG94DpTVAc@zsL1S>1E2%P?G;!Fm`^B1N zKG{xKaY|%pc%F|bIP?bPKsIOSB&#EV7&QVB@!;qK50^)IVp}%kjAuzG3;`A&rJ}ns zx?C%!u#i%YU}Y#9Vt+yPf`Z@g_XrLP(>!XzS<~dFCHQ=@tq605gq$Qvu`Ud2QCMmY ze_VgldTC0Kq;#a1!0uHyUSek1{@-Guhva5MwG$5S&h(oCZOvM9yn`#Woj@DfZ0;;{ z?FZE4ctMp~tfAG>0~hHr{l?6Jl61-A)YujKP|00>BzXa42=pdu*a*dN z0oh|;4BAxb?Q~t1Qo%wpQKD}Y4;KcPeLpN|9_k7GV2fnq6VmOI>(v}sYArx0H<(rb zM$1f5nCEMyz+aa!?Z>gi3^gEb4;gmsgMgEb#xr#ld`&Z~7q-|<26HF{ND5S&O(7(# z)Dge8zu~Sog+PpC!2Yx}8DEJ@Rj&Ps4yWi4F(?KJ@mI$ukYU7U@NBUIjOHA;TejI1 zG4L~hbZ}j>(|~9s1AR`p^H6ST%x5x#FC)L}wN8uz1ruX0P1$MDq5BtiI%kMiJZ;`6 zohmN3rkIWpiYc;y>EQuura6WJjl7a$du;jcdRj_PqLFO9Z*2QZIbU6v$NYgp!=xa)0tgnbDXc;or;nlBIG+RTN&rTX0dBN%J zKh)?lg+9`K%mb5-T1gH2yRPxp8@^&Etx9>?f;`|-lxz_RnaL2q;%%BL>2wD3ztTw* zj|n-Mp`vmf+#eBQlUeOgdOb1dx5Uh?q0fV{52mum(?KHu$Ryd8r+X9zdEC&MHEKJ+ea7YxLj(|&k;70+O3(?X5Z4r9I~}{ zjXIWp+e~}MCNC>F+#$IfJm|0$h7qLEwJa&9q|W4%K_#k~R1x&Vpt0DPkj#20AQG00<`~<7OwL5RusBSVJQ4LMyR_=TzXLj4 z`l^Dn6$}hoJ<%#`5ivvfZ?OkbYM6Ts#umsWrz!wul;3dJVUK5f#wHNrZs_&)`?kcW zOt8QiMz3L&CG?y;A4~E)3?J4R+>P-KEGJEM$Hed_72=@I#E-Hd?N#r8EMsHUr}36X z^Do5INsRdrHkEpuIYZJvs49XMCPic@tta(GeB3eA;g9=2&T*(3ppcg7e<^UbnxKkP zXOcE9&s@(1X{R##&}SeJl;{dkpM%qt(k-G*XAA@`T9qybO3FuHXJWEaJTg51XKA-Q z(Z*1Ogp_E*q9RKhhLMpKh66<>%2cb2Nl!+`mlP!X#zScJxIIuGTHYz58*ciET0r~Am8~0%!hNf*(_lri%Z%du-Q8z1ZjSy(XK0CjpQ_DxO1?8{ zUU?iircNOw5v^d&&_d0~Mse`v0iQ z-DR;-HGJKXQA|C9kqGF_rk@LqFu~!fw4?e$6~%Q%$KK7Ep?MG;bw<;_@Vy>*%csa2 z*OW|UvIRmofdQcTx9)Z|0__pFn(mrHU7yjCD$Qdxn=OU$Q&6(F8Qj?rVz-7?Ve*9vFkRLF!z^T)Tk z2&%g?5S&!Y)tys~W4T~Rv6iV!nq*qyc(1J_ZQ2u?T};~eSOEoW_(WlwJLjjTAGB*l zNP*Wf^K}%}S0q$UJv7dDwgYB2VX803l|s`?OY*~--iYB?lc*I{909#U4K~`GiI*KI zzu+Yw2h2Ndeu`^^xvZ+pM&t0*bXf35fZlY;%bT;Fky(Re z`%KQ^6d+#-5ordPO(&Q%8-vN(&f;jPwRZYUwH92^Etiw^t>XcMmUxVEUR!hEvvSW) zDsMVbR|7|z3EvD4f8=}&v6e8|eDP%ATDst8rif{*N7Q1G8vW%KmOq)1*l#1e@b>6)96@x7*kNW$w8GFN$;oTf?P(a7!8TvwiV2mOng; zO5~Ui5+!Hcjl6>3nQlF34tt)>V&UGUA zj|U=d8cr`^gzBzl1X*D+QTUPE2TEDVa^4op=S8DIyULS%cB!W|HAPs}jP6c$lkt4M zc&V_am(^?x?VzuZ;kgsV0-<=`HzpDnMmfq)C@U)Sn{Qye;+7LKlSNxH|g!`XGr?K&t#UbJf1G$CR=OXrqvo@q5Ur*x149@Be@$g7%?6}ZrvII7{-QM zOR6$2j$Gdnk`-oG#-{^UY1fxWlQ8cKtnK(nw%$_PP2rMC+~Ru-xj8)`B4DrefDhFf zGm|E#e_6hVIGH-hMC=D{I44K@MjURwqIem6dtm;acDHCOaU>lVZT>*}3OL-vl?4t- z`Dntz-NHqjt>jcNjNi9Gmz_~(&YY=cd`oMBJ8;yAF)?V7aiyIq=?9EMb?s_)+0%DO zWk^cT6k4@hG-hgy!PWRl_*i{gG;3~Xv?q9nzB3$KS@!UH^Ono1CZ#5cGLq&$EJExa z#5XT$a^?qirw3BC@q^|IR+>ENoqn(d9T=YndSn7nj*<=j?DuP)Q8y(dtft|E<}~iF zJ81b$^W98QYr2>MCgG|{sU~G6#;T&-KYpUT=m<-kV`qE4lVIDZQA@YfTHounKjKMn z$MFXMH4F3(V!nhi8gwjp>qEhk%5}v*bG5b5xYcL=xb~SsE)I{cHgJ-VG382AJ8gLd zwDeGlz+kL){DB1)PZ#YSIh3E^tachxi;k#NA%T;cfREA zW%hmEMDJv=WXcNDkrOISdnwTV^*p{__|S&7Z%@Pw$3|3&pf-~+VIht3-T++9?D22E zn%3cKh1mUkNBN#9sk6e1ZqKyeltRg2c`%*_qTFPRN!k2}Rx3$T7H6;X)`jKuayI=) zRZpvHMgz`C6rl)QZs5{ZLu@HH1e!!0*7fvDnwpw;10e!z&MhDpL`qPyr1V<w`9nWtEgUUG(BNVpoky?NssqTG7>!%k(_VlDAqyeSXKa;QX5`1-Q%M`0;|*W znU1&?b2R$ERXgj?&{j^RN9@S_;FQ53d9bs~ymF6G&6Xyxa{nVwz!NHW?%U{7`(4!M z_yYWYk1=2nJwMFZiep|=*G8qEuZsMTEWtafph^a&bMkk}s49$I7Wrb4b~l{5RsV4}fpp)OOfHnL{Nr@?y#unIj!D8`6bsA&MmU2f!K(2i00sX%QYj z-+xr?Ee(Iq2TFdiyRo@#y^*(UdXv!1(C+6^d`QZ1QxNd*2DXRub>7ePppdg&9q@li zvMi*JD%iHsjIgfz#Elzo)e$VpPul7fGN&Z|z-~PMRo)9uAH%wbLA||gdprQ!a9p3F z)ll!ld*qkWD?$2r?}bQh*B^N$`G|&HN#_qe9F8$sG2w)17RyxPnen+JD%&p1%b9^}s+vPyL$7+iQPPZsr`e zjZI-}?eukbS(OsPNNR9G9Y^Z+u%=kKw_Ye8eVWXazma#M=N| z+xs;4Q987CfnvNdX}=8qBT8O(%GJXAaxVA;zjy5Sk)A;)vlPNKWN-_-w(W=4#;ZKHp}ZfY-$o1uPf;&>Q6C3^cdwCQUpXO3|7XE2!$Z;mP8 zI6L+X*%)#L{&2=6KzP;~Z}R_zuxUGveI1hpXuS7rwHj@Bz5UzZ^S-&65aG@mBe-Zy z7ujX(={dyL!~O*O0ypMfK!XIA?eO1}-G79M#4|)-gc(-=cyp^{JcmS_+El(W{w4Yw~#kd zl?M~v_eETNr{|uXVD+8I^YgL=94UM~UhznmZTA7UGiLg8L!BS%6`ZXn5Y=5iOf>9S z6aDJs@d}P$h;KVe3&Xq{Znrh5PunOT?z?HWpHM#2|IE%KOL^@5Lv3>EtY?Mpti%k> zf08y`4u3^pvEl{&{RqHGy*;L-$JKy+}KKy-@oVAk&~Vv@t%EBe=!~{?fkINyy#EBC+;@chZ!f@8c`vmvb4eY=55d3U7q{CQ;b?Yfm56k(4wM;3$~ zv&{kKU61WA8q8^-2}%?DxY$AV%)XfONX~jc2376kTH_BPUrtvf`~t#a3(ri~B{M+) z`kg%#Ll0wwt8n$<$Eg@mIh*~V4dV4n2Itv_ArutmTR>PfC+KC;eZ$qJ7`-bV<)9J<58&KlFk{)-}QyHKI<*GVlV>s>P} zhyP8~;_<619JXjvz>A1;S{WH9Nc1Izr;S}MB}J=RnMVg^Y$#Tk&cFOTvo77;{?1ll#r6GBeXgTK zL`0o(@=`v<+3GN`I;5~hQ@jA#sZb+?wtS`Cf@FPQk;na#%XuKzTc7UTb0QdL=lFN2 zAKY(rdpLn_siwG4&+lXM&A1LwpdS*e^>K_yEK{jZ*qnpeLF5B9_{W zJ_AU?1&GOlUgtO$Ek{&#kF~UfI=&I29B)*GH+OmEfh(DQ|FK>~(pXTb$C!c1_Y@s_ zzOLlPB11^Y2+w%tu~xPmZ;U0XYQ8|d;wSLusj1E(@h5Lc^KMGrr^HVosoYw^IQodC zrE1WP__Dj9C2h_vevMyy`o_a5ZdF_^bfvEgXM*0q3oym7N`AICz!|>5mH|v%g=(&>HT^BiZ%3doQy0zJWGVph$rzV^4olM4X=y&GB9VJrEsE66le>0yt zUr|7m7&F>Zvt=ps^o1x1z+>*t=nYaUMJZ^+{DH#zvyGN0x(v2DQ5avRM@MJj5^uYo zLC{V6Z>M(qWoG2|W3tk%&t@%5`7AS8VQL*Y!s0s|pOf1c8qf$hQZIW=iRx_ef4Kd% z_C}&64%Tuu`ga**b^zznt^0>9%$@4Z8K*ORuccs%DAHiesX|-xuL)Kra=FG=25a(f zk>hIxOCB(#!A(Ed>{dpbK}5bjk0{Q%hYBHLaqYU+TR$zwvRfkhV^>u|NJhuN z@#6Q4BRlR%Mn1CUswm@`(#<<}&RYqS_+<}Cy%V!P!(^W>M39T#+Q0Dlo z{NU*@CQ3?4V)9yrmLs_RW-%*Cq9nc zZr5j_IZx(mF)N^<7NqqOjcv{ZMq?`|swTA;?4PZ)r@ah6w!TJvp`Su7U;B0kc7vng$i>O1jp3=Qi8tp>v7`-BB}42?wk6} z85dbhWieW!o-)0RP%sb;V;SRz8H8v3GNHvJq^AL4yJGjD7a7H?#2flB+ZgqMsjn!N zVIrXx!y+>4A(6M-D`=?zT)4yUU+01F@NDF@9C7JK>vVCIx+v+k{_@>FE{>V$b(z&d z$wtpob&)cXw)o0_Is|P()NjJezwm@jZ-``?#do6Sv8f4aqobwtaj9>AevnGqHUSci zOMcp9=PaQlRk7hwFb)o`_(2HXTRGO@)A&_%ym#P5{I{^i$yZPcf|pMp*mP_++Adkm zf}*_+=-Tx^%`Uns5l>6_`rc8O+SOZ%%hr8S|NexKOvupd9w$;_VmfBG|MGruVvA(_ zEdv~6OQR+DBx|Q{^6a!YG6xSN5|ASN%^K4kG;DvEWJUsqI)Fx6Tyk>_r;jAVQO9*n zH+(W?Ltbm!ttbqcRN4d`#093{QkzLFNlwC<;1en29Z11YOiM(SoJ*Mo9s0)*Ta7_z z6cSZPq}+}1x`^toYx|Ea{vwc-fNwm=&bAlr%kj9~Kb{-v^gvQo2yy`?qvbLn0B^%V zWr7+@5_aLoe3pFesyA*vD|hPC&Ug6M^WVO{a=&S|{DQ-_wqnuGN|n`JAjMyJ8qK)H z{U0bP!RS1i4Cm)@x|hD3I)~PENM9$=z zS$)y}I^z+Ms*uI*P0~Umv<7Q4U_~1LO6@1*tC9t_ah?yYmgL_>&+bjRN3-i?jE24o z`o1wwG*QUJteyN|55DcKu2LCeI%iso2W*D+LD26fM}_)>n-Q%PPwLl4vDk%1bL)Fh3PDA7! zQ5AO7Wc&cj*2ArXl++Y*MR~+tdflp}k;@PggQbKNb|5Wk`EwLb;5fkfPFp7ogTh?D z;fsS%`E{!2Gg%7aEiI1|{XuZssiIaytZl8^i4=)V4}i0c-~-F*aFz6iCyy zeWrB!9w1_A8m_)9Lx#58h?~mX?a$jSpc6jcg_C;sVmwTO45V1BJOkJ5zW* zyeh*s9dcJ#CAr3E=c!HSZQ)c$E4^=_1d-`a#r~P_g9OSnXCt~Bk>n^?gnAVRo&0Z5`AI-NHFv2+20UVf`1 zuivZgXI=0hLgI7&To*drr2Uu|8BG>A34X%~-TqNgUfzEE4NcSn0N(2%pDx#}B5tjU zHlb)KwIre7qDu&cFLl`$nxWOnKwIjgX+gEiMmwAYA@s0bA! zMX}IYR+T;6P&~XH3_hNmwiDNj?cc2WPRZ@YQV+RpUpRCf>R%Ym_G^FL{q?@3?PbTQ z^{OAv-EznJ0MoV5DAZskHt3Fj*P79pSnL)_AI{1fZ02!RL%&^&!|;=~QpYtN1Bxu{ zb|iD?QvZ!+CIk_fLU(=qYByW`$mx8#5ITc{4O@ZVClrMeD{`I#IV+J`YP$XzEZF)R zUMhYtSgbqqld54-S0;-kCTLd27*>gS4GGi|(z4~AL&Ja_!3d9yjSVxd`ISn;i0`>Q zQy5ZHVuceFx9JtO(Oqzqo;5xkD%PL<*K~lJ0EhDzF;RB{>n-0OS7&Ylx$M3_4M?KU zA(T;O-DC4L%|#rt`yh6T*|N|5yNji)fwtg-`nv`xWob6%8(j%46z@QS zXimI8zeLib`K644V$zF^NhSPHkG^=aF6iM9}_&r{K*k+nx4$K;Q%X1YB{=%urTgq#D+Gf+&n zs;NV>`P1tPzF!TZA|mU1&}jxhCuUwakDUnYJ{)(lK9dY*GiS!y0E~>H#k4Yk_8MY8 zhfpyq_oFlkW*-a??7Fz)$|sfM&yD&ceWH;>i2vlb(+$H04YzacFm>4Xtqyotyol3U z<;ZB2X8U+q{&JoUFm_*y>_Wgz5i{4Xnb?<>QrX!SG_I{bg)3i#z9kRxaIH> zz$AY^mxr{ZCsk`B_u0- zK)lw_4Hf~Qo;iq}PeVd>ggL?gj!jd=MyEI9a&oV~VO(Gt#J0QkxVK>I!1FY^tMl5+ zyjLVa$mMhquI&Cg@1~iIMao;9eZ$)X&vi*$Z&>m-JFsgorw2HH~a;$!)MOtu>2=WY#?cA4J=Y3jpoBKf5dv~WCj6!Uh}%>D2!F-He>Ew zhZln1%Rf%?y`w^0P+w&c&XHa&Fm);9R-Rz+`+TuNssm?)io;dB*l{ijM%8oXQ>FI~ zU`G;(j^7Q-X3hR-0;`kLguX!hLF7oQ;XVTCcRu6}FdSH+!DjR0B$Uw3r#^gG?|G?B zO1j7!q_XL2hkcmsfW2z5C5y25Nrrn^gaS`^rr^7ZD)>d%sM?RSC|WBna!%tsTym(L z$NWAlw;*PmWd(VT9!KaQLaGK^z-2U}vbx3?wuvEUJ9vWf2JvHIm0LX&vvfDSs|F(_ zVYO4y#VVhYGq%vA!&OzF#%c)=JcJ%}!>W){Lz5;{6HKI8lD{!GGZ-BDC&54lEv*<& zsGYZaA-j65Ji}HZYfamD;qlmNowae=`lzpbsEL+kf)UI}uD$fNj-kii&kXazj+_tE z^uCCedH?7706srbOOYjLZ=_Vil1Cj*|5>c=+Dk+@yqOJJ?Y2fZeOzQVf3iS(Jd@1X zHf$p5Zha zoG?LQnKL&0ZJCL=GGCxK7T%8|Rr5Bn0hcCHQ@7&ALO7Jb0@kKIw1@mcY3<(J_Tq${ zfB~#E{azXT) zLFy3PL4)Zseq>ne!4eKV87Jkug0ig8E6>XVl}O#PoRqD2&YU6ppf*A=ASY)^Jqok7 ziFiDIK5VY4HGGrTlaLsB4IK^1%^BzRpr&v>7q0cRm_`CY%9)C)K)N2gY|`-lqW@HI-qplmfW`$)lUTu)Gak*XEp{ebR5i?CE~E4~W03&Qw>nZJTv z60yqKHZ@K&Ok8Fq3D~6vUGm9}V^eN_Ym~VR>RpeCPk>x=oYkQox9aiycf=P@&nBeM zq&J>-WMq!Up1TO(Hth~;z4+Gpyui2;Is?C?F?9C#KxHqN2M&C)_J<4kYL$_G zD7Ys_JI*2!hJ%#l7&65q#zw{_EnJ`P4+XM@XSd|iwF3qn>E(Hb{n#8`sX)tm&rRnC z$#c%n$!@fV6LF;h--GG2nUff9*rwxgDu@?_H9ta5)1Pn{w8rm!Kico`2WtZ$B+A#u z=2&qkj}~)u#AikFyW1lRGr?aH4+_4`zE~FSJ^W9qO8<0OWhQ$ZuegaE9%o|zg=k_j zS{_~%5pPR8zOIu%>H=;RNlz<*F1N9NnNy=&iC0emJT6aoYdYvFZ#ah)#|?S>V*D={ zuLQi7ttl%})N~d=lhuvw^+ZLEcbBC-`L0-Al4!eJ3c&4L)aZuKgj7}`Ci%rAT%veB zp33k2Q=im)!e|NH#UxjlU`eKqgf)6-pDwW@k8JWnjqK~Yrq@faAYhzu8Cdf!-^^XfXL!ODm- z#krb{rKEe~8r2+^dtqY{isc0tqIz4{bkCZI;5K12CS$h3y`0&!=E$0ChlGuOU%c<2 zg=>?ED`iP*)WK9`MI{ky3w3c<`^sL0knBb8U%{Z!X-SjkY|mtNNY0CBWr|}pk?BOB z$$<-zhX;3F)w-CYCO;E6lVwiFTn7h+!ibDwc{G{R$)b8v79LchkYgTGpelC;vpbSC z+a(cWX>h)&=m3<_<R~PwMg&R1rwO#CL^10JNH9^SXd%}L(jHINcBhb;6H4{YYYIi58 zX@xSoXG5pej<8q`QGUJ4|K$k78^xtK*Mfier)na%A)dbFoS3x*qx5ccZ=4jL*=I=! z&`46<^KSOyI@%|#CP%)1Gg-OP7?u0}l29N3dMs~;W={|HnU%!Il(B*4&oz!*Ve{MoX@%=FA-6Ya8ERD66BYf&Y&KzV zzEUSrsQBnAnFt-$PeMwX5Pt<a3`C=j2xallM z+{R$V9?>v_tiyQO<1Q9^HR~6l-|OOv*{uRJL?#>EcX(YTXb-MMR(MfW?J6c8ncx6I z%59#QqL$W3JW&j*D8}}5u9C{;)Q?N+S=NguNaFe4ksHVL+&ZQoZbi3Ll1kytWseUSynSNZhwsMrn zWb}bFl}}dc4*L5(Nt*392aG>GK$q7e%aXW=BFeN8$0(2Yb>KX1%e+KY#T8sP08_q< zEmRb-!Yb)@a>}586%rgXG{UabtF}F{sz9-R-%`Alr~*S7n!RWXw?+3(3Yxmf--cVX z%FIYktu~S?BNQw#gq0Bk zwPo zam-b5*&7WnpJAa=hWCBX%!ytZhM78o7*Mfz#!Fc!Idk{EZt$!lEgq$o<$EM|#4}-a zP_j0`_jVfgf~2kZlVl~#6{@hBUGs`NtF;~Q_nN4w}!C#Kygxh8T|X zkj5332u7YyAuj&3^RRgjNj-~irM7=xR@>yR(K<6V-RhW2iakTzj)qz-K|r%kL_xPD(gKtzXVt93Ee7I{OyiuZF!oU)lLkkWXNeS1#Ad02xUwV- zum~vzt__Q#Ai~3#Re_sk(`q5AnYcol?|li5FAi~ zY1#a&1@BE9$&bd1`TnbY!V-!9s6B6>KX(2T^X73bFpZu8G!<58`m_m4OA`hOGh8*; z>NvgYM$?_W`TY0?lsJN@b;{4|1Ci6k^)HBk*xywLT_8kDep+y!J`-~_2JR*KkM=}`rQDZ*v zqvz7`3DmMV^g_mA>M%+ou%I=Fat%WYxD8M2j@#_e5S=5{2q6+_jIqe-jgDSjkb}59 zRcylm%YOhPutLp3cU3sIiNhIdHkEEq{C^{J?0i)vhZq}R4cB%H4?bK@3EK+j6LCxE zJAjHf5sQ*}hFl>PM)YHm;C*s11eHy-u-ZF^M)&QORUg@Y;G?b?L$JDr|t8Kw@ z(K*CKz%ZkTiY8hYti!%dr3O?HoQOC@jY~9%5B^R>cGWIaU#rs^3HWW@Y*0Bef|s!D zfYS`#;ws6)YUKsD2B+o*my-~W0WOOd6^wenHaM;c;bhFW5TC0@9hu!s0l z1~=)Z>Ohr~Xglu+_P(1 zB6ZWlNvpEq)|Z{!aOcG1O=JSK52H!&dVH+@wgqUNb+_%Sq zCWMF(29n`REmT(24J#%Y1^TKrd9_&zQXBP|C@Y)J6MEKXuYs4`t3p@Ar&wlI-&h^+ zy2jS`z^>bzRpsoDik}9rX!n&{gr|Af{Cjl(Vi%dhc|ca_>rknZT2j#*6y9lif9Rbsa~_@ zChdq!`N!{NhL3A;kLxNNCtxBoq_V4onmS4#O8Y zM{;?f3QXyx#&Hj#8W^Rf8c$zYEvr1zJRj*OEJ%}FYsV^L>#efHQfuew;Vs(_+AwUD zTL_Rty;yEcI{Lto?OL~_FwerC-6N?;2P4yOGuOf^`PyVAuaSj1kDObelA5)|BEz0% zJC6gl_%qS+-`Bj=fN=cCK$EaG>BL||Of}5*Va-$MicrJWS5BgGcYgI_m#nx8 zYMFo{4I^@iY6&VyWTC|POinf0>!m&PCS^CR3nUapBxocQvYfYytxQQ-r)(+4gr(=z ztg{7y*1kITPqGUS`24;Bm!XsJIy;MQ*JRM{n_AFtq?Ptq-0aq-zFrt`Jd@S6;`WL2 zquild@Rd@+|KFDPX^Umu%xHV4^MJ2(%zCUMM|m-lIem0BnARa-IUmC;9`jo^yDy;X zY{hYgfU`RDfVzi>wFbXX9D!_sW+#<|8p1@Q!;8_HPhZ$O4KJE=&jtD7-Rg&}>Cl2F zj*#iq$nEiRTh)=ppQ)G%jxuwGT5}8%gHI5%D?bghg@rtLuqLZ9SDx*vwAy2LG?p*y zHPr&n%EW{`x`PA)gT+8w@~SP~N`0dI5j{B{^$$fwd4d@w)|jObPA%g6v0C?jEjRpt z{Z?Y{ZYz|G5Yue;moI^nhZYv%n%Ap5YBlS^T5d?@IsDnthumPUDcBi&)?iRnfp=Km zRHgUSMTfm+CGt7bNTdUl=CK8h#@NkO`l7{1;vUoJ54b5DjUUEp-pv8a`Z>L(#?yoi zj50pF7711*-RvRo+%1g8W9u%GUC9gKaz0HbTO7E&M)#g&R3drGa^?n(=+vo`Mw2f- zCXJVW+K%$%YR%{`yC1>E)2fe}9BUj$Lkf>qNuvNh*y)_MglGXCp|L!1bFsE^H@XLV zpmy66&G4N%j>-TF5>UVbbB!T~CvWce%G%GMfcj0f$*GjfPQ@I*hFY29KB-rh(%=G0 zHdtAk#&*%(QoOo@DxVgW%kZiiY@XE!)}6nm7t7g4%UK2Wn+Zb*3^=$T^-;MUCbXee zVkt8{NG)+MSwR(TH8&5mIVSm}x(-^0N%k2Ej6Yp%&N0E4N$)qX> zwJhLj`=;fZ<29giWF6I&J$UnfN8>a7;Z-c@+ckZhQgJh>wrt6i48iEi;BelAkffaX zV5O#a-5!Hq_bn_Ny+>Y0UiQ$;_!OaZ#qK2gw!zsSey2y(Qg%usL!P5Fj}4b$&8Mu{bAss9Oi)nK)DwYmz9TAxWr$KfG{q z3r$*jy*klzt?EhZt~Zy}-p*B!IkXcg462h0Yo_1d;pY!S&Xd;>`WA&=v!A>Dmdn>B zxqXo}_3vTVgEi04i}0Lg`V(~!VU#_ym9r{Pp)TH6oWT`VnbQs=i!{qJ$t$Ob3Lfw! zw3=9^pO=qp4`v#p24B@`vT;>JCgr?9p<3-2Nx7?f>JUM}-dDpNR|ciOalmA_*qR+2 zS|*caRw#>wH{^u0Qb@HA-R7FZD~H!aa;Vqk%#zh!J26wDmv%`o!9>LzY6ng9^M}w& z&Z$n-kBg4quH)7JiGAXx*~NlAUsI0C$2gLD_`R7&sYLqVEoPyYO`A(^dJPZNE6q>m zI8_|KVH)o5Kj=J;|Dv3PR(v^s@8oc$3Zv)FY0iD}C0+}sE4|vw0_Kam`BypXAC>y~ zL@gFV)}1yvs+1t?*Zs05QLWyie|$?+CzCfGv9F1SA7^2do!vJlBnh6;sCQtqdc?oE z5@uf`vLl}6eRZc&g1R1f=O@)I-<#Fn{v%x@SK>U$gADoRUwYYtfEJ{VjlfW)WAB(l z_r1T1aJI>7VIlVIsri*s4ng7V_(CR|FXj~gJL#k|?pECss_z_GUgSGey1NH1GseX3 zjBDE5=q%o(7g^8M_j_ErzinZ@QU&0%Fa12v9r}t{tjXfQH^$L|O#Urb?7giF$-FDY zI|C>@j~7a=Vu)2n{sHrY@(tfdT-1`@R0~wydFUZiht-s{o1J=M9p`!4WH&i;ah7OG zr9a=9Pm28v_G1p(pnOF-zwZn|Hd>^gHE=0v`o{l!RcE&U_#U07+uOw78g7~b_q3?% zt{jhbSjU~4-+Td$*YPS|B(eCmGo|fuQkC)cUS0P=8~(4q0AqXrrut>`{gukI?=k1C zTyCYO#4=cjP};vyRGl36%RqKA0HD=Zba5w=Ue|LnDU(p}{0UAXqMTEk(R&)aw4TFe zIbJSWJO-=g1qPDvMgC7MK$7uJcz-NK&a%ih&09Pj+%0B<`p+3fuc3_)rZTBm) zrifOXZ9{jFHMoyJl{59Av|0lUzO8^-(hQhjeBT>WyNL!2`)!9SsqrEfR^eaSbSo*x zJ1$qukX1DgAHmfxu*!$Z-R9)l?Dj_H_l9_#?zruSptM#haC2d064sxl5CC{>z=9?) z4#XKoTi%{3oR%{j}W!5&PJF$DU=$i4+zeovt)k*2DBYkyuXv z%oH|4jaQsn>IF(V;js8q?oy1<6VtEa{b~VEY)M051S>VDo_RK!dX0WHA;n#9Dek6= z#zIZc{Y9;)Kh<1iIMsE;gM6_U2$%xWVy{}UU3GM*7h-e0J}xoW_Q-H#O4JaVx=7Wb z&&|MdPfT-*bsUEn5}jwsnP*`slv{I5OyxixZTy0~ZWaXTishosli!RjEV@jMmXvfO zX(C~2O#R&1h!*?N;Q0>OJQ}#Y*@4wRv)WS{yXB)*!g%%X@$t-MA}R=C>?33S{&jT< z>=a)25jIZmdV$uWn8G466cJq27G0kx8`?YWin0kP@Xdk>k&C|3F2tt3SThTN^#!IN zp=`ZmdGd6!5Q{q8wD=1HuV06t6%p^+oY}l1%RHHE+^^FM8b37Zjwy&Jp|LY<_Cli3Fn%_2WI%u(Me!cE9d?FfU(}R)|p>$9OF6(4JaC+wbu(4v{fZlB!Ey!xjd|`PRLmeElO5- zNsisArk)l<2bE1COHJBn9TFlR94BBsrT`-Q7a|^x1s(}8u8d9?_$w|CD{nD@?WZy({m9V50fleROP=Sezc3*Wz-z7d)M6J}jy#YJqd3Q8kIEK-MtxEE zGmjPqdnEmwx8RJKwf# zYFsb%zkL+Gr~4Zo9}5v-LIg$>nKT;y^{?CTJ+YK1LCeI+@E^YYOcmt*hG8A$kw;x6 zqMDs17}!?dN`FihT4R6PgiyWSg!td^Q$G&Gd|MDDel^oDedS)B+Ub(w)rCj9WiVf# zF(E@?ei$6Ls%{(+ABs+j6T69*@oy1{BPDHNoe>Z<*Rz}Xt5age&6da-YMy9KqEHct z6fFX#AzghXVB`BrLsvFlX^#Bs9qQv#BHpIQM~(gUQ?QL!v54nq(gDk1+_$dSjJ$67 zu8mv)?{E=AAtA`4T>eP@o;ynC+qJp2s)4PGFbZr>I`cf{aB{s5I7=N#sPah4dG(oi z{`QdHRu+nVNM~NE%LT#xvnx2RF%Bea`+PzO!4eV{plfFG8KiF4qXU*W;V!)u>{8db ztp*beA6I?EMXVp;a-&>gTHK)^H8OkojM2bOHx~)!m4?E=0Q204qO;(_%wOJ8X6Ok% zSsuUUUUfWYC4vnRV^^N{WP%(xY|wIRhc`5~B`D~!>Wo8gUNP{AS)FKclYR^GM$2A8SV#jGf7$xvghb6B2f`=?Xd#^JUj@wHbU3@aNV4*}st4 zuG?k1UQq(6BCqwOlu6Ad?(l~aspLa+b2+gpNREZQhlYTJ+?${6h-}#&ydRN5=OHVs zb4#;)Rec&dwk?-DdjG>cTCQ7~WQ`SgMBcSt(5#ey_d2{^HJazVK2PmoJmf~^S0AEo zZe!{kBIlU)U1|4YUW6}zGIOm~+xW5BDfgE#t6%mNDGJ}(gf???y_bEu-ScYEuwNE? zaIGJ?#BWj0-D}Uz#`=H;s76wXpmNrmb2#ZIKa}SBDkiDnY}7;F+H8!TGIJ5lb#yd$ zc`sDo7`A_HVcuo51nASLWz zet&Tj{dVVoOJX`->JCHr>Lr0tq@Xa9dM}M$dtea!=igkryI0yB(X6coQH}V|=X~fW z3>t%rEvL1#@B4FbQ{>7u21^rdm0B(EbL|dmzm-tC0`4B3?`Y1y2so)h&0!%l>_@Tg zr#z67Q;JYjp!mF^68$s;^fMK|zb51$7u1zRDrCvsQJ#qjf>PV#@HE-nX-%&PGsT~p z(Yzh>*ys}`XNEC^#PX%T;&ShRib7)lKD5qzQH$&Dc=(EWia?lu0yF`dZHCxZVqm2R zG$r1zWV>r=Gd0>_N!~60pd)Yg#+XY%wdjUt8lHmeb{i687Pn%?@RTITUPl8i@G2wmcI24$U4ThJ9xySYM)D9!>DHEp4*cQvH=6!NbW_Jz{*rgLl8y1Ir^KT%t#)2~*(ghSfM~Af;m80*mww7mtJ3bgxMawc!C zBKal>x;eJ&tC!oA$5{Alo|+pvbg1=Ozm_$9)V}6aD*JoKvaR97*YVc#A?DV-N}K4i zsb81XX4VWK!H#pWz80O+o6T2GQ!!2q{e`GRwm*CLfBy;m_x7B1PESu)8ZA*wO-;7} zIgydDW)tauR_csFSR?Q(kpu}LOj1gUh;Rp6haOa~#{@PQLBljF3v+MX-x+84^}4gt zQtPa*`rmwF4Tzl56@J10f+B_$aHdE?89w)>piB;shRABNJjO~~pMsg*ghh6T_tDRe{~f3kDB%gH zsDKF(qHP`=9Aq>dLk&g11#vs!_Jqy)xZ7;DhYag^ge|MP6Vtd8Vb=D4%AzoA_L!F7 zu7Nyr)hZ|2ufZ~022l8M`xmaugM^u*t@dHXi%;fKBE1@%oeMW zN7vkZ3|$n;OD{PvMB5f{(Fm8tWJZ zj#ECM#fVh`aRgUf?{+iXD{&@$U>&49E2eK4WoKeEqNI$A7vC_80>j3=h!lUe~q8rp|_w*zX9a86OOzf{87% zy;uC6W4}h{HRm~Jf24fj?>2Nu^0BhQvVbOW(E7yL6&8>iV6~Ujh{=FPEJxUNv8VmqK zBP_rS-9a~T3g+FR6fj-exz=M`JS%V!Sr8!ji{8p4E1jJ}vSFm2NMe`{Swfk~#oa|F zfrMT7_-%Ak99(ihL_7d(>@xUzoGFoHol=#Syn=?>&7qv`TmVBG0Ii9wy96tNL&Z!=**13)<(yBru*Gg+U z69r9K-lFAD2>zOGID>`bH82tSM3rGCAbv4AElnxlO5 zVQ~Dhp-qasg&;|=4W@EUNA__Shil+u;=LgI4#D<#nRAraY`(>i9G7J&sW6q z8uRO$E*s8*q>QAg@a~IIm;S47`qf+gV>#jx5@25L<7N(zDod5y{lTJ8jc zyGF+3%Bxxn%gz;yRhkZLLJLm$lC`Yn&{&-?`uUc45pweVayj;9GpsBb8FQ96C&yEH z3U#T>@2thegeE3$4l=tc*A%5iU==oKvy>y}uB|cug{=SYNMMk~ELxQCXbvRcEam;mtqm|9{1ARS1ffkE)`_!Z5{n6ioeQLC z!}fS0ac*E^?!cq19$Ldi!jZ{X;&um&6R@Dgth1+i{2_*BAL1YUP3gOEkhgKxID)DS z&ZkslcG5lAYNckr_pH-dWT{2+;EZ$?zkayI!i^nJfG zQoE=dR#crH&*8pVpbes&TJW%Zb5avQ!OX_qm#_^!t^M8Io*ViC4VMP|+q=W{f?9I3 zhCQx9a!_{{_tR$EE8J6GRdKzn&gGe{fGc~IIOQ6Je-Dl{P5v`o5_ZO+C~^DU=jZ$q zYvLkZI4YZF2ft8U-o43lBP-9-k{kG{WB8aC9yhrA23w+j^oU9Sq0ht{AaczsCuF?2 z!CW8R=hdBTr`Hhp%Lyj$l67T>X&LWayJ>WF+27jA@u^8h z!qk+|@~y!)7eGm=S#<4la9fgPHv@~K+stXN=NeNaSJC}VMeB}m;2zy0g*c~ltT!0V z%N-VF#f@AW3XHHILuoqN%r|#crf$}(&s%?)YKnmpqy%Vv=o*`K!*Wr?C7C5T^QwuP zZIT+u=P;sM*@%;B4IyPORa{o7RgyQIZ%xB*zu;;FMa_nnc;6n{NQF5G)p0JQO3L3ATDyf4zdkzdT^?R9h}%BDx_a{5Z!n>=7cqVO5auX$ z<_UXHxhXY2YAF39kYEx|0&X>qqW~sKSmqB13=e%C2R(^3d2*n1>^Ku`cci;(<7vkG ziX?;)grvmzg_lb6!}K+3yQf$vI_@nHodIqd~FD@{H)?VUAjQI*uqQ3tl-4 zDxL~adD`~yv1cHG6yP!V&9%#LlX6d`4b}b`;7tS6(d|C}`ppKsXRu1p{W^Br(U5X$ zBMrPVy9U=U)}C~QDdNYt{ku00RHQ)`QWaGqt3J=dS0oIE*6R>m9*<>B9gXZ@qfjIY z2-NYwSfrhdw6vS4G&1=O=4?eDWyU@vE39u|G9UcEj&R9EJwLA>nVCD5e*pdWI8J2a zi6+5~1YsiU29T|djG`<|PF|E9h%amr#YF^T#AZ#fTNoTCiaKPxlL2zfxHVoC*;Wp0E}d$`q6GCm?F$qK-_)FlqRd+jmPOXE=8jw1FYRz(jrfCMYTNOaQ&SA16wP}HFA5z~M( zOm<*J!9e>JRnJ*jJ$tk3?-*_q!*;^B>u~e3E~h4Q$4Be8xlNFeqk_JDgO@V=brncP zhv!d^9bcw$=>FGQ(?zqbJXNu6V%Q8WXZSqMNET^A6b9>AwnN(5Clk|XYI^=`;f_|| zyj#wi!)STev%^8)Unt7TMkw<~KFeB}m2M}v%PE?|Poxl;_c>nq1tkv0Khd7rl>BAP zZ6}c@Q7sKN64Vd2DU!>T`&>+gb_il-VyN>LSVX4l2xAHw+XUP8nq3js%uy%q9@-^S zI{l^1L{?Pi!3L*+w8?7j0|E}cf9bNF1aj9M*{l+Ny86|bn20dKe@zx3@nb_0icdLY zqZpZx=)dcWeD^63IBB2k{1D|l%K3zo=Sp*ou)u157nB{ZW#u z$Z^YrpphdWQcb_DmUmmDyg@3I_gO1AUD`=l9+xF&DOzc!rqKcv=D15Vb*n9N+OI@( z9EM@JEjHF!+=5UlD$Lr#%aKv4pD{iA8u!~zF!*9nHJKDOYuV1!TN4Im zSoH?wnU=#y0lV3bs*sL3NDo&zrS&}3vN6)j%{+7YPq74_-g;yOMGG4CvYj-qydE9Y zqqSt1o#@7En&8IOu92_nH7o+|MnKf`xqMH-_g?k4P5igR5&IljuL(0{$FK35=X_sC z*DJ~*I?jAL`g)tuz(slJ)A}FmVN^1qDIZ-d^VutlPMfqUu)z#t=eGVBd7K5obS%A1sgY%^?$egzug;&V{)%zpKCl7 z(imcjUIWQb4)(7{#bNa6kO^OMJLVZc;EiuvM{;_og_`2+Wy^cCLVuMDf;be5oy?*| z@FB(#oFWxTKjhaort;S+3AVpC1#mXxK$y(Y3$W2#MNH^qasXFz%+(SeOxAPfGqrs9 z1G8fP!TSdns>kpzp?Vbw5)bEishyQv4O=XYjuP5Se=`WRgCAFuP?vq01F;QX-BJsw zASf=+#A6Y`zt%cAwVuBHk$KsJ06twx={;N9Ynh0SOib<0@#9R@K<&pnZ2aB`Kk*&A zS~PbquW*+bP_7Zxwaq>a?x?YZmXRjAn8j;?hcU{H;H2&+At#O+r{~C4hB8fZ*r?SX zmq`V-a8=UV-=B@_*Rb78d`=#{;n z6a2b#7fq3&sj1_;lb_8+QF_8-~)2Z;}ghpt~Veir^bZ@#tP3?ZO%H{ zE?V*Yx>Ed|+m`_YS50F1Vbz<<4pO~GJ%Bc8kDzxvn2efMNKFkrO_w2i9_p}_$Q8ul za98{8QKA2f%(p4R{PWU!s=X<>)E@6ouUk7%|Gx}*W*$580mlYT_iOpmW|^^9+T2Q@^q?Oy6x)*r6E(?l1O zTD^W3S|1@S0@PTSH_>lr41wQ5>Ajw)&dUZqu{Qu6Lv*pT-o3(wmt8du)qQdL@~(ai zox?mGwejO}XMLr6N4HanTwISf;uxnMZheqeMFd9e8F{9rtjP-;E|;nj3A&Tg_%;0x zP|=Hw9}TLNRdt)v@hO65G(jQK(&3&R$@XhwPz_Oa#E`HQr#b@Wg|X&*x)|BROz=|U z)+=h3^9q~2Lvxs`o^3eXPW(WQ9{OVH7RFz;xL->A*FrIy7(XLYsIIhDIp07**UH@@ z(Z|~pIGY-&5Js=rUaHfW6)u;Hwe+wAt~`6DxTh!UAZzn$xd8L>45Gp^V&N7>s_CuV zDz4-e+f4T_q}Rh09$vej2OnGxW!15D9;QFn&nZej3$T5-j}ptV(s_Pin=+z|zYdZs zEDU0oInl$2=D=FuM_kX5pOvMGSI5?`o> zh5tLdK^ytj`Og=bep*X+XR*x<6-v@(+YZwUJdj~W#KVp%k4H8B!wmF%eFmrX$O#26 zwXT2LW|AdJfCgFdw&IU#;G~#Uq}4`4S@{}~&~V$3w0;X5E>gNmlH!+COG8mmn0=CR z(V;pLxcpU5F_=WTAL}RUSQc@p4{)|GE7&O1;u)#_FioaB;94qT7x7vl`M?A z91e#$dwNY@{odxz!TxT@KjrDcHk@W>s*=ZpY}(}AR+8yFg*$cfbr9| z2^*yQsNvb6QZwp0>Os-o3Y&-%=TSOc_Unw1?_&*S(0XZ|i7x3nwoLsV0zAx!{bFdv z^jZJ6IKM$h(sd569v&mKrU@v0x?Ba+`Y7QE{HWBgnn`{m#Ev3QP zwck;4hDr*K44Q)SG(u(Z0ue+-&QCYeE8bo%;H6r7d2_n2~*(KZFyi@gUjw z@!<04aVIeB&_T$NvGC<^RzYu4-TJKcYGda+OH|v{Y|Y7B6)mrpc>3)k8P~;fgs|6f zqTheJjUN~at#T?dU)1lUNlYX-T$u%mlO^cG7U-{kq&UU(-YuxISff}h}(BM4R#k5rMF08Cm~Ev8OC z>$xr^M`qfbtqZ0V9X0u7I$KO%0ds_lOxfob*i^f6QnErE?gH#Ws1`zEqnVCNzB_At z!_iD8HT$L$_FC*7K8n2ZhGxe7zjk-jQl-CImd@Av44zM!*oGj)<4y-9-?ifxiNXwh zw3EzW+b^_7uIM>|jI`ML!hUEZr~!#K9tb<9aDt*xe{OxXbZI zD)DRMZ$M>W&GOPtdIo5oQ2Jjnm};Hrve;7_Y<_+9fppo47KR(0l-i5;wY5wzi%;4P z-1?@tR7IN~DuaNnG|L77MGsd3MU}DVch-P}Xv&rEl0p`hRIRfBPtE@25t?TdZ zTEA_%eJqs^pnF{Y$NUYEga1Fy z&I4WS-ptGlqKn-RV@-7FG`eEr;n@AdLtx121?Sk;kwZd3wxA{iC!ICy!&6(K%+46)(R`P7-c4Ha)Z*-TbTToIGYC4|E=yCP; zl0{BZ5(b4#=5JAw91&g|)OrXaDB~5MlOt<(D1Ucf@b6dniFdC#(9qC|idk8)i%Uyy zm$dC2M+n1ax_w@|7&>@|$5Nn-@Lj{PNx98vI_qtbb2LL{ISFIrVwjMg8U~TQG^Epw%|mu zrE<&d%K_|Aa}aTo-G+%Wt;7l&(zp;N(Cs8RSUmyN<-Jl(-{$_CasRmMeOhG^^(hr< zga;9)T;VWjcrrZPN@y=4T5LGa*N8aen%y!+lyfLs?pX6tp(A)7T%hCN>R z;TcTGAp4bC^>NjcuP=B0NaVBya6RDeP(qezY0Rlf9sbwMz@$VxJbk;f=D)*uPyh!d z79p?#LGBQxm5SCX>oZ)o#{s>=rS5}a^#pe%^>~4rFt?3y!0LF@{CWgy(rh;VrYgk` zaPaK88*-Mu5_M?3ky^o}{DYzrQe#F%?~I1Tq1kT?c~UfnA^a`YMG4F983~*s-~eU@ zR-rrn9A+Tag@>Icy|0%6LTPQqt=>eR^792T9PmM-lVqp#T~*@I*FOK+1IPL(qiFl; zub+Bf08~fQCxV^z7mH1hqQ+MCG@t0|uU}OE8n3u)0*B75$~JnTP{?NM z_Y4p?e?u_=<5P1>^vA40=Hk!~OIU!!2uYkkg-MttJLnWH2~_%7l$7}SGrV}q(f7p9 zI9VMbFERYoyqpS6XEZCX%+#4ug^dj@3*&1=`n}$YF)&KG2&Ek-#%{P=k4-5FS``gTOMxXuK6KdF1 zFYn^p@O!2T<$J_^m>(xI?!eunJ!4@@Gq~LYmDPs|2H_}cwkN+{Q0aAE=JDM1h1pQi znX<=ije1LIHhK`Izyr^oGV=JwbAI$l!22r?I)AnW4ePxp+oG9zbDnqty^cMpkUKc< z+nvzqG=)_Ab2FR%U0uI00{Wn}1lu4sPk58b(XnDcr(z%A#I^dd<=OOu@(3oXac9m$ zU*ZI0Z;vRXW@jKo-A`;;q4MK~p6;3L}YFRr*^+sMuS6g^di*~~)?@iP!?I!RHM?Oy%Xm=5?~ zwC7o{F5~mwo9U4^cP|zTtQYJHg&KWsKO1>m{(JkETE|fywKNSJHw%54c_O2}KF|3l zuO;s}?u%g<;y8kFe+^IClmjvs=V^r|TTYa%ya_g>oxe!p%&p3VUtABypReXeZRll7 zm6v@qJ`cDjUX1YQdERMCa~-~a?Z7CRXfzsk;>%zO*>ws6zWy-Xuhk3pAieB)Mu1bV z*-N_qEOrLgoNO1%jyX0Rj6WSGjoMJg&OG)Cb9hVq05n(qEqo+XBr3ph+P8Rdx9SIw z-crVhTds5_%Bn`r6<;!)jfe1j-rZ)q&CNDOuq!D49E?@J*}>k^sCQ${>wMR5-_H~C z-NzWZ4*PT(C7;paLF^gw>UifU9sd6B!dZ%V8?u9_Qb9Q@ z=Du>jyu3CnbmOl9ifuV3n=&(I<~ylN)CyECc7_Bz*KD0NStnKyv8tq-Luw^I-F!lq z$VCw02`q+isi2!*jp~x!7?vGa0{mngvKg>QyAuJ4u>5eUgef*IV2Rg|hK!5LGP)P+ z``-7Lk8Tb)uVKh4J^4I-=JlYA?c;#=e?Z>MO~Nt8;kd)S^}K_jSNJLZGY>9|{Vxpf z@9G(;n3&LjTaapcTF;o#O1_UIJ82Y|?+CS~>b}zSdCRuhpBpK=_p^wJ*T1TI*-4{G zQ13bI_sp#)4~!BOD64HL8_cF;%UfRTn-hZ@4)eCj;&7|vg{;`@m0@dE*&@-2yS4*H z@RSW39GAp)U3-i~A-on@c1#~RkLjNs6>T>QKIP@r1=ZcDkyYB|_7d=f6neZV+V(wJ zfIA}CXq{70Hc?tBkGqes+DSSS(_|*gQ+3d5XlXv4Scke>!hs>*8ZTJGC2Zj%GIJ?>Vm%XL^Yw1J&zYj+Qg zO!Z~VAn5XHCG$+A5rUHyPEQ9NnElk2}Y2gAtOriu$K! zu}ltIR)u|QOaQL4Z+dCazbjz-XMhXISiC`??K*Httf2gkd;JwYpJ#TlCr5&WK{g5G z2yrO;FfPS>bI1}XH+d|^l^KphgtlYr#uiS8Cg#jlK^~T5i-GOX+eB-xR#C>J%qSbR zPqI!?^6D#v`ZEaVCjdJ~D9NKu|Guk9W@VI&i2okuqDFo-65Vb8u4~hZ~U~ z3vZr&o-398^vaa|hYRCZt`;MoO0aS!B&MNpc^)z0Fcgocm)lX6{QT}%kxb^X2-b-vvl zYx(y-Sl*WZO!TcTgMtVR%6zTBprRB~L@S}-j*a|@L`|n2t78p#KsseHwN0p~dJoRl zG@0wL9aedHr^J{3D<(D5`Xau;J4)|_1p&@E7;PMkRM*s;te&SDQP@VcX)Lk@;6$gXGMybP z9C;2&5F^Qw#;L9|XJ|nP`Y~m(4@E3VAV09f;j+gRQcyHm+5GI$sZeBzM0DHI>?q7t z(ujd?lp{$UdPS4bM5{X~wL$;mNUFoW;@JN!IIL6l6&}>Z#_LK8cWcJ2sYhC*O(=A& zdoTf!S_CyL&`PYlhQVlN6I{Z8DN&X|gq@Ehi3>&lB+>&o-%$QLbJP2mOb3?BB3cES zU}1<^bXvVOS^J9vtR$&zt9`X`U+)iSZN(K(K{=!FLjoFEd0!GIG}s7}vw&QtcbqaL z&yVQ(PGmT$J*b!jx-SUojRy=VWz@J*m}(8~ zj8mSuZJ8C!pj;;|kK0_uqFfS<4`+u$__hj4jv32quhSH-jwq#1-iY+;_3fa(Pe8gI zt9F8=Ao;K}SP3%>Yf^LPd#rAk^eq^tst0wcf0AJ5VZZkORxBrwB2>u+{^%1XM;RC_ z4y&rAb9&Q`6hd-RUiCIwR?sbt<8~+cxRunC5#Ox@Us4}Xx7cg6PZUp%e`ASG%-D?N zgURn@0^Wb9bX>(*YU4fWa|NSSvG)_{1>K;u#*z@x^(?@e(SYLB?5*0lp{B$)>Q;vm zS(c8@>h6nG+rnBUncz}PcEknK1@$v_P|sp zn?Jt~*GZEJv40Y49UZlqkN-AsI>sVFj1#2}zelfGpZV1PZ?$m2_N#!=@yoiia3Fz4;(#C;{-v9!+MX3l zWya)TuFiIjtv&>d5bLuvDRiqk44CZ*74_(DDn3nv_sBKDsV$v z6kh&ct=Ii^6lnsA+tDu!3A{D~$`^^^b(qr_a|=k8wIIQ(8GDt>dYkxtQBMDv;oD670g= z^}iF-zUD~O7o*ECmMJzd`7^=P_fF=)_w+r_-AX2nI4PE-f#ej_Y%HsN-Rw%ZpKIu-9%sn8TpV4nT6c zLzFb!$qDxW$Jw}W{_kEmj^~E)^JP7U7n3J#wgb6K?E8=e!CaMt@8FTW*u@eusPXOO zJc)Qp0Rf*UCB;G`hmapZFE(U7usHR?<$A-`VJ1thSn?HVnP98x-*e?T7vo>1(?d z#%1iy4n^zj-Z&o!0&#=g*IyO+|H)!!@P()p;h{JdC8Q(Gv~u?#^Sh%E0*OKB-Jb$% z`kS^MS~VlgT^mFsU$UPH8pSAq0Shh;of+SxB+3(a{R@>u1sl0k_ee_`C^KkJJ;-zv z^dE|T2L1hx22~*)DynPn_hDGRLOK2h$E)MeXG|tz8+jNxq%0eiA~;5Kkoctj^M{j}Uc&c*Btz^H`u3S+m;*HkHF^kGi_*WmZDnd1LK_5R$$hfdNmGE~&m zukwe>D=Q7wE7YJlfMXQl4iXnbk-SKA1{#D-_6ot z)Ad3Mwkew`iChKSZsMPj$mv!U0vLolg}RPHmAu}#ysh~n&|uO0OG($|^m;;uMU&r! zIC_%#`S@n&@3u|ACbpXFyDPB^dX1=go5lJ-@L!g_Z{DV)>HJ>EcO15b^-qNG0?&jn z#$>X2Y~k)bPh~m@1jW>Un*oHK7MrqJypdiut4oJ_3%c(6Sk1C5e_mH)9Cf0 z@8=J|bDnTS+gzV`4II{GyLKTR&!GE?1ygP(Lgq4>Ov#ALz=p!%hnvqQXf9;?@GrlQ zTkqs{hZ&nsXG)ZPK-Md`V_VhmFj^WS{K6_KoXrR92{qd#$orZ7w0gPR2pI2my<~}) zRgbAa5dfaUWu0<9Q_6FBLrs4>XAjgc>9}3~4!k8L-GDu8|2O161s%2%3~Q+`0f4Dy4X&rk-0l~W_V!o$ z={vba)zvXrO&B*1kE^7j_@xCwjV?snjot>VV(l|k+i&1uMuuAGafhC9>PS#=rB*>e z?Vrkx>UtE^1Dw5;*!1yFeI7+%F@p6Ep_8P&xHR3;s6kALZa1Le9I>s0RI*`DccCl& zdf3RpLt|1{=&C{xTe{yj8AT`AK+Xd>u@O^IADT z)NIHuLb41_Zno_(SeV#& zzA{JhWdROI{c-$791C2I$eFb$gCv(UB%Q0k#r-vHKI(J+H90dEZO zf?I62I~Uc&q*qV{dV*MLF7hek1$haVuiC{`k)t{(A?#mm^UXT4EM;To$CY zUpYmkM4#NOTxiAQbwnOAyopqPv(dDdw_F;q;_U>@69hlJc;3yyUo%x@5jMrRpZxDe zi7U@hP2-stuyciD3E5Qq=dmwV2c2@Ej#->A`!Gc}o+5wz&Uln(#OY^52V++oXlW3+ zhJI8A7;u`fZL>;KhQdra=CUkT9eD_}s}hgPKDbL|bTRh-J2~bt@?%29H_G5k^f3uK@@`HLI@58cFfk49CvuK1XE{*4nTmzt?imdhY=TCp)ktBt}KgmTvH zp$my;{{?2Xg}K05?COXcDeV15Sqxs1ZQ5(iVz26eP9;Bor0d(U;u>$I60TtSHLHBx6o5#ex-YUL8-p%|H+$x!F#_Aa!0@S@!B~k zfWqy6u94kg6vj}aZ}wDufQt!_GU^h?;$iS=Nz#aKP+h_wTc4kD&f=l{taQm5^w)MH zP%XUDXxM6mzLkQCt{$>zEP5MCR0{QQ4}ro`?^NwJsI`Zxlc-27R=9%WZI#JgY1jOr zgzDor($}G11|$Q^7)D~2TAzLsE$k~~9_yb{--QjmT@nU2bU>+t7FFP?;{QvZVafVM z13r_+t2B+FJVZ>z>TLh2Ral_>H9A;qaBy{Pl7T+SinQAxE?KOq{DZlqNp<}%C7R^e zKqGAk(T}z&Bd?5FB0pq?qGcS2uT+DByclpx?XYW(N@i70$v`NN?%P@s!!k5`6f<1o>^8@vaZ^YgCd#k#u5RT zZiT!w1?HB=NSM`fBDEOAeTh~8eQ(6(GTmA92(nc~ar=4v^$g3nnHnP#b7R%JlDPxs}zVX(4*=|rD^(lJB%LZ7zGe?t5JzI0Gg{?4$M z){j$bqf7;Y)wklhW)(orGpkN}MFYxEQ+{jB>ibYN0R=Y4$^$kJW&cvE_H#ewJXqWK z#Q}gEWrR41eG<*Pxf1iU234q4X{THgyoQHfoGZ`{`vm?@c85(<@|ZMKXD;$AzO2|a z)W|5`vB?B(h%hlVED^+#2Oh51{<|1KhZ3DfoNAO!X72H#QZ7a0j!*t{ldlC!Z1@@W zpN7pXSZ*AO-C~laAO02v|KCm4R20q^U2LE#8D3FJx{@={blav^s4YM30I5?ddZXDc ztl@Yx^_*4)n`MhNoEdn-OaIL(tTR>mI;jwr&@^I~LJy*tDPazN19L=`mp=MUF&R}~ zeg>28ziZ_Za%Z3fGsK!T6Yho!`SU6>l%||}QHV2)qSt${k!YLiRk%SF>brF0QQuze zK-ZDfSY?3z+V}Ihspf5$_O?C`A-0M=a)+)}%{c{GlmU(ZhZyC*p)BK&n+on18Degg za)qLX57Bn3NZ9vW61DH8eGF1WXi&J-{=UDhG9@dvJ--j3?diHy&@f|{N)0z}OMXka z=ObrP$3upO)aXOYtx`1XY$MP$WOhFX7qv|^nxUfYNZuhE=bG_3dK?0wk z{1JdBG+UWRbk1cuG*hN%NCEPgwiB0AFw(sHYI@Wdfj$kO^%>r8WXhjmRE)AE67KwbuWMN{*Z>Ma!&ZtmidQ5YSe{$O?$w2A| zcK1a1QlsBQAoCcV-P0Q~R${@zw`5hxglQEx4u@N(&~?Y^ z3K(ZKHO{i+`YD#k9}G*Z%`+~8ukPw(Xdq4@le`sgRsjyWd@`O?G57gAvJk?)=}r6& zJwi|vU0k`}4acg2oVi#)q0b5(Mj_&%E@jwBx2)bu3-cW@Li~$eJo>-42?~ zFRN-ODQQW`+0n7Ft*EN1DzDA=hmqZ7@S89_?&cPs=rq_5;P$3>{IWoZwV*IwUKxAb z)WPLJDypqDDg%04U_Jm2ao6axhozkWmtYeGo3cN9rW&FNWtzIn&VC}@iPuGe)^+t-#YNi=M~ zk~V_E-M(ulF4#(*Si}2x{+%zC{8fUw=n;rr(CLYQ#ce(Yl0F-aS^W8^B$bwS*bS?i ztvvGm@nqA!hD!Y0$Kg2MbGDlr=Ze?97*7rro06?W0<>W^V2@x#wC@hWks$PtP=s4M z2|%HKS$RejI#bjJ3D^GT?jEnuZ~Gmf|AsNk^Ta#Ld83i-Jjs>qaTWRwd}+(L-_7EE zpT}9gx|I4vFkDLkO|nF;#P01;wOC88x4a>y=EJ*;=E$>{HaXnD)0(NJGuuxrQ60;i zHF*u8=y+SusCZdrdAFDSFrwTJ`$v3d1fgy6I`pGX`j9%b#hX}|gdIiGI=}0M% zs`Drk`aRir;+G$t%p(^kb1EDA#Hp?w(?C}>_y^M)RJ-le*QRE4vy+m^Dn~>#@hdfe*3@SaiK*WkE7~4hLcR1PuaI@h)p=$0k$>$nTn$DBs=I3E2N#R zq<4b+{}L)Jsfpof@MI50E#oIl;>o1FJ&Y*if)w*`K1&i&6e@m*~uZ>37nm(r%#!KDt z?S~5(yh1wj0e^3@{onUR12bo$Gg>J}V?6+4k>PmbpTXizXHMZsy;Z$LU$}P^j!!0Y zN=5E>f}q7f6Qu|W6E=1HC=ayC5G6+Xubzr11PWZp0P3Odo9)))@Sv#+McY6MitW?X zJKPXR2*u#AjKZd3UJ?{AXstglKZ(I2);^L91zj=leTGDNWO=VzzlgTv2OftjzJVtk zbj{?`>8o~`WZZQu#m58eT+R9AL6@J(>Ulg4tM~1#xf0O=+d~X_8NhQ2KD8sMsy@2q zt?*{17|Uah_Rh7v~rP}?~ z4$t3I*sExltyYjHPqcUcp)ey=$Y_DT`FcGg#XzBO+@tsE|;TFk|R_GU&EwWtR-#|dvbkqZxtqx0?$8MH*v6%!6%lXT{oUhx7 zi{oa>GwG^os4R7Q2JX%0HW_va@qC9EQywK!45YE8zhloAlt-2Bb(V~~qhTTd?f z0<(_qfziR29Y;sZYNs`#)k{m&R)3V|3vaCWXLMw?(cMTxE?J?UyqQEXUaC zW(gu#Im6bt%pC7vR^FUMqL5Lzdon}z%;YWWqgCGCkcWVwT#H;<99{&J}qLZ)zKJEay-VE ztR{&M7IeAMPn3F{8oI6r$xNHA6olj<%+A@Bl?Vo8ZB0kF(NJ5j|MFpw$(+cV+0_WS z(~4WQ`E7ZjnY6a^snqH_Bv?wt#b{Ze|c55B9%(pX;Vt^~DyIxBNhfiC3}i4}g=b zPIpX95IpJ;Yf2tXE8X7ZjRTX{neoMas;lKz;v(FxlT2!o)_el{#wqQGH~e|jloq!M zbrX8E;aRa$H-{Ng#IH^CmZ3_@vO*$hfBT@eT%SbHHjYhB=exAcVy2|1EC||x_aPREx)&SK?r!g zT9|(pN}{^y14jAGCQ0-9n|P&$8%(m8*CR8Bz^!UZa&> zK#WF`lc9L`Bs+lPoFwIwgB|b*>YTKjez9ijfyWd*&)&Jg4^f2f&E^esGb1Mna3X!# zm8LfJX@egN;JrLm2fh!_mS{^jj zLoTML@jj_*=m3-39aVq*=D#;jzWR3)KA?eyxZ9xdh2x86UG%(nO}u5)zvn@lvACRp zuiB#Ey4^!L7ZFZVBH3IEgk^rg9juT|XSHS1gF!5iTZ}p6pHsIoTRc)f@>xRJ^*M?&;fu{q5ayfi%VKQ%Tk$SD zdDl(Fe$oKt_eMC#YA&7mefF(R=({p_KAmyV&Mh3L@J#As<&Rp+O>d7FI^JIcoD|!5 z0|ZNZzNlG_48tBTfAx1G0QOeuT)3X+`F%eRdSd)M(Db^{8fxw7!++sO51pKDI|GLh zPi4)`x$+b~qHr8KGE(w-XGN~*^KH)2T?OuCEME_-;>!%2^@%M=l;QH^KR4KRU6S|FOZR$seKU1 zNk+C6If56pCJ!X=h#8PP2ig6xR4k?sQ*|87_e0V=4Y!Ru-6-?t_RCnThd+O3F=%UP zNztwfO5M00G+kltO9Wb4*oIM{rK8%E0P}xtQ8PYAU3}X+U=`p_C*KryCSda%N^F2X*oRM?=Kp+e zo_P!yMO6WKXO@vy7ubZi{^BZyJ6D%K$?d`)nY@tJ_GVHkn>`-gvMD@5k#kKz)fvV7F*qQ92;;ndTztYQf{T4GhB@>eR+YawG$M19~-67 z0|Ns9L-oakA7ri%PL|dQZw--Y3xo~3D3(d%j@$v zP3vXMr~Ng?$X4^2sBPzqSF2+OX%wAYK5OiOV@J5JuzC;MUK6A`*napXua9w?^UKtn z<~CN1*Yhi>80ZSw5IV7h@h?8B&V2LP!prRyqO+AM-vl58!nG4E%gaoCs9N>Ljx=)3 zoka{jUCy0U)m9XBG!!;gFNcxgrhOl%_-U?2O-w$g!+u`h#rqJ59lI5jB*jfni=b`! z{ySA|ba77qTo|jS{9p;d-H6QG6Fk*TTYN%+%wk($>Ss5OKv;2TX`Kpy-1DxI2i5|M%!(yLB#?f~xaz zn4*k1I2;inh^s2yX?8Iv$jzLd5}j6Y#>HpnfcrE>s79lzuR@8&&FqzzT;WyG`!AY9 zBS0rg@WL%ZxmUI_aaS=}7}K7lig5MYzWLCBI4bE+Wsoov-0btSQxeTX3QZ|^1qxBx zb9PPf*SAVgVD4Lwtra?Ju}d8tDA$(Up^~R#*!AF9!4r3Wafk;ORI5II?7}YvLFQz2UM~YsXE~7poZIv*7@5u5t2?7A^2ihTD9>cmf7# zw%JeAUVriB?uU;UK?)ljzy1Wx%0Sb*+Uwd_ zHQ7Hno2v74HgBP2dCgXArtRn`o#B-cN@<%sHIAS zs0rqDvz82P1h)Nae~s&rBhAHdPM!Akp6&A`FKr`WUF!anBYaHXKM%>mV3w%Mg)Zm; zeX(Yu<(cac^mu0Ej2T|Y?n=f^&S(>w<}0a zYB5DO%|2(Xe=O=Pr#4qzFHWDg(}x-J0gmFG-y4My0=m9*AKGP1_YLQsuA8cr4BVMc z3jC9+)kN>WSAj%=io@P>`jZ2%ibMPnP=-dmx& zpKdW;?@rWr@JClR^rUO$Cs#HMz>GEi141>CLCU>OCWIw6hWpI1isKcFQQ}wpIWUe~ z3Gnp0PfdHzTPbjl?&=UXGKqp>yD?AI|H)579kpTRp`EnGiEPFgA zilO6Ta_V&Vhx&>J%FOk!0YgtJeg`_(RZmP>sa)|{H;EO%2NR?9LUd!*PIjF)J~D}X zPuG`HUxRzf>)5Ysr5<_n{pI)#+Q;K`qBmwgHvQqZJlUgekd@;Ym|I{t{PGT5R0)K@r_`UA?)04W*11|r zYLe%V>u_`FxVWAAn+yw!T{%H}FQv@;dj-W%t4`0d@}subsA~G*cE&78a+qI z*PDVv-w^{GlRL=m^HlaP3<47PVA}LGVYyst6~jho*dG|I>BXJ7)2@9z$SxXZb?i4* zdEQ)3psr|$sC#_AjO(GAV$*sv%)V!)=z7f{+aSzB`w+Nw>q-w+-;%aHweXQBU?xqN?I zHfZeEpG;ZPmF}`6Yx{gripiyL`WPuo%3U9PNYfoS@$A5x-0m9}1H9TC}S+M^t6-TZfnMZZQBoRkzf!_ z^@aq@a`9Kxe4oEc86Htj=7(dPwK9wRC^F~bK)+zR)W^bH1l+$68MN*DEU7@NbV)0p z!urT>+4|)nHs~RaPc$tqJdV#tnGXHa z#bf+j+wZq7G5jZt-YpI352rl;@giyM@LXJOe6&ZV-At1_Eq<=sbmTYWTWj20kUS}} zo;lA7kRzx-O-Dqcy|f-=4-L01)w_XcpNr2 z%@x{p@!dnL)t-z`*V$4ikqrQdDD;u`8cYpPeLWG3TGH||a;>UDne)qIcS*dEC#j~w*y`BLVEU#y!#+fQ3GV$B; zQwafOI$h}Lpn-=OqSZZn@-0X(m5MjZ_?|y>1qGCIrqhzvzTkYL8wdt_oJhZJtdI-6$$OZyJ24aJ@G0 zz4Wiqx*v|?yTb$m;%y`qqLD#~yg;x!+MK|v!>xq=Ox{+@Fd~HcFzId07yc#wC#)qI z*~0WA=+JJUUM;=fZ86LK8d_X<0w9k?&UcIvcDA~UO~dE#B=k9gwZO5_>U5{Ktf;*o zb{?-oXW3;10usWqbUjA@B`MVo0AN_;MvHdTlX$Xf&&? zt=l`X!7$>1*I`#!aGx*$NC+GXQ@X!rWw)af6KgzW zX*Q@#hbix@sn%5*E2oi2I+kN7L{3i8j(Ofede#RH3?UR;q8QZIHe)B`iqw7Zs386v zFO-SLZ@yTR;dGszC4PT7=tK5&IDwLY`*dfW@fdT5jr z+X@E28xP<@MfvYZkRD5AKjdV;_eRFe4|Yh95>gDpLf;X~gYO-N;_F7{^F3UK(^_$z zkw_`Q_7wp~KHL`8nxo$LMp<1e2&XP1_;MZ9!6siLJeJlV!|?t=B55DZKr|K{N1fJW z1Unq3_7!={X}!HBcZgZ;!Wk?uSO|M8mOn-ZkUp3imEg;51`if+qXR=s4n5`<44-dG z&e!!+9L(VvpQ|@s;Z$C`DehziA%W-B&H-?JMff`v6*}LJrg7`-Ifs`bKlkyv#6N}C zq_QU8OlzNC*_o_HliK8sr`urh;>x-i685UnZdU+`3et)GI|8j3a0DkuHG7!CY9FgFcqQ0en-`I%Y5k( zbEx-A7#tM+k|YRAf>9SgcqmFV>}!LV?;ImLuSHXcnApsk6{))SxdcF3C`M{D>Gl9H z6!$?M9!$*&vMYV_iZsi!-ABA&QjshS6R9{c ztpTXOevf-R$#wqWa4Dp3Q{=Bb=y3!ASDLu=04x;_a=6V56*2i3RjcTzzPjBe*DUP_ zPW&RjQbl@qzyNueJX|kweOh{5?A|5f7%}}1urA(CUb^o#H14@uDC&ASVo4Nwqws5t z4njDzI<0x=w%ja^#*vz5*(-KiQ|r`Im`&%uH7?1WO>wZetV(+$@cjuIH4AHuJ5Ay@ z-A%M>zMM}p5r->r{tzaY&y%VFwHhXgFVHAcAFga=eyeKv57o2ro{?PXD^BnM8>MYl z@=HUfF`;fP`A<#di?^d&YyTFAxmfVOzfJ1Hts3D46kEmp4yd0Bc~2T2$}H z+rO`i91l%3i`FlJH&*zbqQwOGMI=;P&3=1XCh{a^mWgdv6L02BdT6 zO0P80S?_ov+`Saouj)xFIE^&7r<79oY;Cz1pBZb~h!#u>hxSl3s#;J~Q5t?78d;8L z{e{PrXs7@SjH*c4zOc*gP?Zz36=+;U>5~1G(e$!$gil*MBQo*W{VfbmQrOCth=U@l z$*hI*3Cd_V;ukOObXI$<==2Ucxd?2BPpgWmdT^BnCW*NDp1loWKmfnJkWKX# zA2hR)H*1<+cr@dEqXlrlQF+LFL3byp?15jzo;+X{ z0+Z9170F*7cef$;vLpPT)d!ZrmJb#aBXr5K_|ydg5t3RZ9*e_Ps7i-izilTmYYJ##XAYR&6cgvrL7Q%WOt!R7de zJ(vVc+!Sg5dT`$kXFb&gF@AL9d4o^zWY1Jp8ONv1uAsaS0+8;Hcdn#%!{mO&6EZOy zU64@(^^bKZgylYv{DK!NLTmEAxnXiK z&J(jxfHA}prl?aNda)hc&ha6dzatukP#<$+f2e#UJt5_M7r$WaY}h|9TL{Ky=}^1> z+~B<3ebJ%l7@<88iln9W?3MneV_Rc(-g>FZo&j~UNLHLn~6pacMYA288BK1@uE52`$5rrY9T$mG$zm;twX=$@8 zE9-`SV`k@=mCjc!Qnmgg%TZog8IIYc_Azpx zjP2UcCd%HMBQKW3r2uEhjFs@cMLW7E8m9t`VDHqa0xGd%*S!`W?=;z(CmDvMWux9Po`zm+o83riR^}mu_eFtroU__$5~rO_F2D2ot^fMuEe}ogL&Dwp+%9T zu69eioHec{^*U-ae>MCu6I}=)q(n4j%#48=hl07|5l?(3wRrenEr4isdnRQRy8M#7 z1AG#tyJIXhU3P(<-ly4wZLIZAI<%l43%7AhK)}eDUTVTuAR4tMtxZjun%*R1TUD1@ zSxCwd+SDB~Oo5LhU5fOI(?S`?UqtXGv`RGJl&&8YK^r>&X$-@fV7Bt)mYv_BPs_g; zqt!RRm!!n2UF{XO@JElptV*L9e!Q2?tBp6_$J45Y+6#1IEMBGo z1<@B?etTnMSl11oc0b*fN{^sEWe^9uE4w&A|w zp#L|qoaTth8zD+y0R#UreI;U%@$|IjbloUrTh2N87LXHO7SDjc>r@QiJ{{(O@yDe( zVIEQ8k^VV(5{Kb#{0||z?>}yeN5iZ z$+U&ccjT;D;(avLb9XmLyXQoXXG zhJxIa($d)i$|+Vh_5uz}D|_qwijJS5(V3|>7Fw;YR8F7x**x7za$PVl&bzGLYH+@6 z4iIm1&B(|{qq{%zoJ+i^6?U`C8`%CVaIh^b?#kPU(8bEt{KctyK0AEkQa2+dru_54 zJ_ho7Ec0z;VpD-j#3+2#7XuWDU)dzrAlWK%z6v@nenlkg z01RsUsQNV*Zp|0^A^G{O%3(i!K7LpKF*%QKU^e@3I-4t4a0|Wn^8oA?W(x}X(e!ID zW0|#ka{M=YX+Sd~&b1-<16vTWO6T{=u&}D>uOqNH4H?nrx2AwGdG>1>)5jPf(_d|? zg>$Per<~3(^GwDb=ua?5~?{D;}24ib;u}wa!jtydwjvp{A@EEskeLXTdHZ46))l~T2Lbcz8+2hGpN4>aTWg1IVRc0w0{N`?8U?7J&ZyrJsP8@R4p=Nb zNnuD0zOZ$@@AwRSPZqCQoDai~-n}}U!C*fxL+&3*uctOZ2QL=7z#IcIR2eSJyf@L$<>$x#}j`y6BPfq!ulYKfuHo+l*fn&|Hz*$x@xWT z-?E<-9wfceTEBu)|D~EuP z@G^wj+<}l6Y9{R1ZA;t2j*=9dG}w&0PXyk#2ik4g!_t=CxYSg2?AmP8M<2kyWsm6b zdCX_~D<0Fl@=^~$L^L$GX9!Lwb_=j$x*w%yCKp_){ae?4vAsP%i-Z(ROu%O7>>}*o z-tUiHondsK;GD@U6zJEm_03$b)%lt7AotFa5OqV=2KIG!`nWG+Vsjz`??|j z_|tVIp|0VXkcv5)-Pbp>UqwC`{64YO5Iy4~&kVd~DC+Y~{0X=?8d5lPykDGGRU1wt z@Ec-*1$z9bl+M_pNt?$sHXL=)%HC{ArXr{{8tBwBeQs$ycoTazmlamYkdPvQV$;az zy#`<6&kEGA!OH7>|IzvZk@)vocwoQef?IPqJ02jswi&XJUsll&SbB0YEBA+XX&p3{ z%b~cUAaL}Aee;|~i}g(eUY{Kq3sX>E9zM%O;qJ7V>Y3ABScIcC`zW|?c64M4hXbIQ zxCk2TG$ibN>wt*68tey{KGNQa=H=!MVJQ1b8A=l?Bo^jMY)dFqPVnlZA89)Qzw6x@ zs#Yj+TBf$Dr9Fy{?>&4GYq+mxyV=25TKB1r+^f&Mc=IM_Strn`Zo=F+>MdVi$mY8eLhZ+-7Eo39$}3_^w{Q*%Y9 zdE$+EIH3}$jeK9ME&_g8`0hE^xLO{;Vg|nbt3@f`kfDl78!;l<->6HlNbPF)2eO|| z?v~pOn1|KpK&P7Q&67>Y|GTQL{iwMkB6TdfPVD%V8G!i?_(T7T@KHT<2TgF)a^8s1 zZS!xWI2dC3(@)}i}SQ5|0jQzUXKs*vdl!vqBQZ6#KP3f#%*)ZbGu}3 zPDl2O3?FpUN|XDczxEIX(fn*J9F3K_k4e$W9-$;<%WMoDPn1Hy_DC)w!Ta{!?TB?^ zxLJ^;utfv+Dfwn@OrHf5f$s~}-LICAr{8o{8uK7O`~D|Bu7iWbSj{Q89mA*`=5%x2 z*DOY-z`;2!3AaxI6Me9Qe`au#Z!n=of*eiSVH#@~l!s1hTWi6Rj^3czFK;}EA~B7| zh+4gHslz7)56-DvTDnvHhggtIk#auSJHLTay?H&Zu_%MJ z+kbpm_klieAW8}{`{rA)L7KK4MgPGQDV^%8Y zwr`bj^tH{pyhFDoIO)7jjER(m9Ii7JCIW7)cpT6!zC^jC>n|H@+x0djHdt`oVW`M?R`zDh~dQ+Lk)BAh2PpaH82HCb`qQ=?AKN$qu}aNKO+_ehlY-{f&D zcSodh9a7 ztXO#YPi|H3@@3N^WXV4vf7232KGw>2E#ioJ_W6uFJ3CL# znI`%gbIYc*F)q%Ekx#^8`E<&ijVXF{4aoJi!k3s`VP>v{oy(jMRMF#!?|vYUhmStG zKVi^p1;SkWy;FSz@vZk+;|CbD;&xFp$ggg&Tt;u)ySMD?&LWq-+o6d|{W!|vWHL3K zz@4cfeZo*DXdmSvm@77@=Xs$4-flFOL`YFjZm~^!UHTF8(S?sG(t)*}Al~#h@iLYw zSollRX`xUg^w6a3qU4z$M0jG)UJFwUj5`G!oi^OCX3GHu^mC<@#876|*y~Rf;T-&) zq5VX*H~M_>2|jLNwStqNUDv+B95j(L`o76yzh55*E(CM-p0T*6Vy5363lH+zS=De& z!OrzfMClEAamsGc^=Y^fU229=p0fO@9jKKYL?v0Ab;MMO<(ymjzjh4 z7`-&3PYnR#Nx|`8Zl2fGDmHJ7~c&kpB;@=wS)2Vc(|9fE5T8ibFQ~F42?&&X|)d%4uUSQj=*2qx*P|zt1LFB z%F9yhx|S&EA7?(p_sfn=BI^@+RpV3(EH(paAy4&1Eu9fmb3GGvTab5yd`XyWhCFQi zD4w3%f9y}AoYfmY_u$N@Kf{IvDNK_Bhj4li(z2y@zn)c;gLk;vjo}GCUTJy=6hr`< z!+#{q@5c6(=KW)%Dei8%fLvEoF$J}rI1oMGgR9A{=lNoAn-g$|o?INvvDc#AjhQ1Y zRbeKb(;B(^LKRN@MU;P&Br1i^QX(BZfUB*nl~ax%_7@)G()%QYgJc@PtyjcHpFmGT zS%O*Hw>Y&9weGuxvf?mLN5>Tm-_CoC5L2DmHp=w3|17h)V2e!;!|6WOd~|w)_S2Z3 zp!c410Sn=FO(XZ{H88e%LuaCkV2+q=IXIXGcsG$q5Sg18s$DWDUQ=ueU{1v=KN(Um zPuSdweOGgNF&$Cv-W1Uas7^r;c#8}9CLx-HuVTWsHaUyz4_M;mY=w0!TxRq=AZ@)~ z51iwhbH0wyw9f{_ekajF`5bpCGO^-L8%3E55Z+Hw->l@QcQ-(Dm`RuFWAuQp&7KRF z@h7&CWbWCSiF2`Vr!#pdfZ)%#ql^3=H(nTcnAK;oQY+KV1X6UP<`cFY2w)xPm_^c)(B)by@URd$`i+R{1U7+((AhGMdAP zA+nM+t1fSSjN8lFi{UB<=}#^qY`4F%#6o=dMWwggC80iC?}ywl)Y|F3UqipP8^Q8? zazProhV0E-xT!~to2&bbdswIAy-F|NMpr7~Nc{4urs1>MH# zuw&b{Z95&aW81bnwryJ-+qP{xdFS5yeQ&%s#vbR_IcG0a?V7t*)tq#wSNk(9j^x-0pY5tC%OU@2hHjS~skUyq9KWoYMf8?=7$TbTd%;o@&g`9(rTL^Lm8C8$T1CeX`YP zZU|s6@fFi-g?v3nyEz?0< zz0ogk-*v=w2-t_0O_-RZ4gJcRAl;v%Sf5bSQL_0*7j)U_T#@rd>^H5gA(_%lj%Z$z zsiCyTj=qO&Eoz1=&ZjIz=~13!jCRAiAY?rK-f49UXxD<|Qn1+19Lht(^9nqF$aB6E z`>1I#ESBm`u2H`%X6JXE^=@Y8^uiu6VoMP*IF1;zu@eR!_i(iuIif+ zdY=Bm;a4AUy#9zL9Bt8k*+3OgKwh>5Qxd3&i3Kryk3Y@twLmzZgVX6@3{hw))ob*X?Jl zY&Rs_4sP5Cf&8!WtkRI6hq%V~w{*w()<4Nqgi}~rPiC-(ti488-?q14Qhh^mC z1*il*6FI4x>qASp6=f09yWN!2gsYEYAUyd@ZnwQcZ1|g!lHXuVcwX=cjbYB~%k{s? z$V#Vy#JD+;&@uuv+q;6DYg%P=JA1+=U%5*qVu^W-f%-u&xZ%Zkh4)7Ph7}Z`%lEv( z==pR-Ty&a1@Z69na^%JTZJK7#_1ZzvioGZ%A?^N=ONAJpIaPavx009Fb<32|eAT}- z8%@6L9{f;S{V@td^mER>9{Nmz`(w9Eg2r%viS9g7F1hMJ7g-1zYJR3`RJliQ+itl$}oJ?0s zs!phjgS#D#fj8s~-oct^NgXVj3Biu9yiR;$0=)L zd5%VpC$cyWF6Ng$Y{J(I5qyO0O05sLM-m+2t+1V=3u*N=5Qq-<=^Tji5R>tTyUXEa zu5XW7{(Pw4l+~)``PJ}3{J}w#w6m)`e7Ew*eyP>xhR3#+b6VgL=C`s zs|3oE_*II3M8D$_HcmB!qXwa#4k&}8;Qp=hvvZ`=@f%zB7|^OTtwN!NX_|{4ieFL+ zNs7rOzDfXZX2D)@2^e0=)zVof{;@fJ2|HozGnVO%{zH8{1-G+|3D>WR_0yLq>YU$S z#)UQR6MdwI?fIKiu>+E+(3fYuTF-PMmjZt3J9(znKgcs(ukVSMND}V(P|BPW0s)*V z39AUaNx4+T#I-x)j)qGWKwL$z2Rec6QnZF9JZNx4^OB_2i)Q=I2A1S*7@i+h@e7QR z&>yJPK8H52vjy#Nm7N6FANs z_d~~LmodomS|o8IP$5rgQ^glmN^sBX7L$s4s?P1o2@Tt+k$t(qK8(a?MVMvLdwk*B zEo{OQZk##Z88Fp|1?j-(CJIUk zO^1-%1wkLp)n*KD!3p-&c+nkznJNvwAjJLrmye)l-Mo>=r-#VwSJ+f9-6)wT(S5h z!v3=;c2Oj3jz5jge0LU0@Cl9ferLD);#5Cnp{W=f|ALCd7E(uOz`O7i`Gd79tubg! z0Iz{ISq;fPy2?BlGzd$=ICFtUUCN?OO`lhspNfC%GhkQ%uj7c@JT-d~#l<7^Q!*T( zp>g@bhQcLWvs8tOHnP(UQ{3>_l?s(f3KvKdf-aJK@BDehmmVbirTzq-MZwFCs;|4NS;Tg1s=N?1&I&H#tgCC9keO)}? z^*LtmFt+>m$E?o8$2*M)O)cr-5sGull=JxV5Ghsyg_g~ch}2Ye@zWjnJrC2_Y|Dbt zIfg{<%LA_ z+x-pm4+_j#_C=#}lpx8gi}8Hq5F5u^A|Wq`lD}j=)-jO_%K-^kQaiyBt_3a8|GDg1Wj#Wfc9Qq3aO*Csk17k!4yB zvW7vaAC!`^2h0hiJRhnnVE+UgA6UTrmePU_?RLHs^MmGemX&>P2TNu&nCXM)4e88A zx4}!;2mgK(YBTek$)|DX^x?$_L_GW)LG;M!RHeei+3(<1mTjz$)#ZR&`6g7sQjxFdA$MYCch8cO-sq z#;lxZ4<}moT4z{sTb8{uyxF=dZci|zJSes`v=x0K}Gglxl`Pcm3C;7Qs}WWP0k&+i8=WIR@)(uK{+Z?Vr^=MZ_OT!m6a z7sLij%)1?B*tYF3MU~vz7qvhVOl$ymcb;4C_B%MelCVZg33rqXW* zX(%#sI(xRZo zuEfg|p%Dxur+9rmQW#?~6sTCU#8|V^{xIIwUE!BqjCxs7rTLz0wd5L(7|AmpAc#c; z{A?m^*o~DlSm_s&i3e#~`=}g#36;2tFY;UwFqy<%sY+c4_a#`=+y*EwEua&ySmWfG z12L_1+^^i@>sJ>IT%_QOUN59%gp;CZvg5hE3STvy2+wlYYT*jKN0TpbaU{V&R!RLfV}HlZ(c`Mr{pW4yAzxt{Sjj6UL3=-F<7jDMP}QfqH?XF1=tZ6;EtLAS-?SLI8Ai*Y;P80EI%rRPN_1(~3i(fgUq z7(~EuH2MqUlbo3B6yCa>+V!w{BPm0Ka0U})6y`u(yvkqfVb;zpeSDQ9SyB8Bua z$V$PS%8hTBV2}i}!i-h@UmhKFMCwyJ^(2H8sOl5SReFYt)k&63fgP$px&4%+pN>pX zvpO5%DKtPN)8mF?Xa&#-l$<*V$k^{|w~$&tbj*%=mPAy#H?P0RlFM`ki%R&B2%k92 z0jNAgx(MAIVq!*^Ipy4TXKNS~J1@N%AjJLqen@tEMnXr6n?0w~8n;QCPe<;De((z$ z-B+A+h=PyC&CiIp25pW<8Zt!@w22RdrBeHRGaywKxTXmx8 z&JV6^wxiL?x+c=&cXO*YFKA*Dyz*jdbjmU-(K18@m>Hk0WS1YwHMTan)m69}c>|-P zX@0eC+3v5boiwk|7T6zN9&tF#v2o(hH>bmnFG5ZSS);pQ@j*(C*funh17`6G786>$ z%+Iw!qlQJq=`vyUQ6Q|%E^;p+q&E}eHM8?uGCnkBR;Rmjta{_t5#Xtf&drB+r*m}e z*1HZmv~r3zX20jFjFi+2O-u4BYoo|8Gr|1G=oZ;_eqKg2=uv#p(b8zuM{L#gkK!Cn zegyN^mWho18J*s*uFlVJO{FoYZ@mxCAB82LOk6RO(e63H#Ft#c~R0balrU(Ocbq&X%q1> zf-Y|?ss3G38((xpWzm`kW_xmZ2_C$^7_ZqaLPZpXZd%Gdn%m5s%SS@Ny<`o~GCDj` zq}^62j*23nuybfU)RYuWafez@p)J;4j?_c@LUrB;r_1IEphz1InI*|@1WT`LaUEbM zi80mn$ijm+`5du;`{LUoc}V*;PJH^mwE)sbvzuN#Mr@8+)^6XciW2z?(F)q}r?pP- zl6XUrzBETgMZ;l|jf3<&{v~=oS=ne^)QwMeU5J6BIH+^Iv%onw9N9jHtRCt|adTqQ zU-i=(F4dLm=>+LAn@;mOfU_7p=QG)4<0#zw5i=WZsf&xOTlnbXv=qH-41|ES5WMQF zVOnuj}iR1aiy>!qRO_nddggzOa%pgYee5P3&6Hz{Y1tVu9E6mL$ zkm_~$m)8aT2p(n(uQ%44mE@z3Fg(VxJvFuL=s*Cj*s`YKQgm!<%@o7T1b4)yTVC8p zIRF4x5UTg7uZC+3{G~@BG3yHB?RfbW1xfqHfQ)W&4~u18#a;Eo2$1?Fy6CyWqXqGs(TSHS2%Ykfie# zx~`WD1u`YarcK+rc9;bQFhK5Y3_OgpzFAsnjxF|xfgRs@{omhOqIvZ86|SDn1*6v7*|pZ?EwBdJz9s#IOqCA(%NF*LS?8NgGR}68k}sUTE1OEMGtsE zBSDecpCzn`Ic@K@{`swdBtVzHAEbs&KQA-eR-Eo*ejWyY4wx*IgN1hgjs;IO7>PLhu9$TTiE%EvJsH zw%fAs(Q0=0noNFRZBv2{NA)*z<+yHV3@=S)Xta6orofS%&9AFyF4R|Y|S|Y-j3d9h4)2@)k-@<*4!OD^!d6V_XNwlfPBu!fc$#$ zEBtabF|`5&x<*yanfWeVi-0T9{wvA_R>{uV`soW zs*y(@#xeM7lVhmVWwy)vm5aGE=W&ZMD;2*TmOlG#=a1V#W7wWJsG<)lb;d>;icVyH zie+_cy*stLI6AB!EvvYS~q_+-=478mMH{XiQf4QltfSFPPml3a{Jh1cq%FD%Sdo&Ysp3=hJ zaKMiOEQ!0$0MBZ(7WsOF<3q^E-lkgLRFKs>Kj4oHgwy3^mV5I#ms`#s(ua1JC^G+p zU5&=1gPX16?K)ylQ2wv>m^C)u@{CDBtBbl{QWqNcKg54b8wlyogwd4Wsnv4zL`3bH z`=z}%9cnU0qE8We-n;Pm`eF^AXJN8YBp3D;+!n_~XVgtj~yn);XlJ8Ws_YO_2Q_^+}x{immKm0`&5bR zOfTcLj^l>#xQqT~v-a3^mZEeio)xqIh7PRGatRDi6*Rh4U1;zLbmzet+ZOLli?B)N zG2g!y)p8GG-)2nt9*=-q5rZQWnEx9Ry^6+rx$ktV3N|_ynp_Wt&5e^t#Ch(+`kbeD zp@v?d>#L04T);d=5}O+4{Rr40Q+TbG-wlR`RAbIWv`OTvt?rPK-7gWuMXX1BDr>vB z0hz4Q93JICFHzxOKbox6QznBWQE?{5_a9ziU=XfN1|y6Ynj|?aR48OyK-54(O_f@n zf2kell3TW}UXeOK@UG}^PiWar6M7EI9ZjY7-g=0O!CeJr$lGee8c%$Ap>exf9f#tp z+1C}nqA>^@u0$S4$g@?gN0^Eb`54r3H0%DpzojxX60)!TWnZudWyyYFIGe(6cY$AZ zn-3<%jiUrRc?MSd8Z%NxIw*OxtcC_9W*2 zYK*X~f)M!2N)eD0 zJP~mvL@922#%#@N-SfP%aNLxOp04XF}gVP9El;mYXs!X?& z)fP;2!+t%zOex*jCas}ooi^%kou4Zu^q@+_U(}&-9e4ET!0gX>jk;X@M~@jCs@DA( z^Lz%{`P1Lm5&v@({|z1YTUvl3QrZhr!U7nj>Km*gRQH!cU8G<*YH6dUn~Sr~HIFjX z=HK2cwwyj${@yWZD&p;kuT2rh6-*8on@CibUd@ihNyFaNXm|mL1TztqG%lWHn`-3E zjmOEiv)X{Bg=Lrn%__MnzZz7LCe49z6^lf)bG20=Nk9*SG1s5p&uGk%*_H{zDC_R%mi3w=8DN1<(al@vNrh1 zbhxco;xaJ;1I7MMO~$6`+sa*SPktE%t29ZFJY33KY4hyz#o%nUMBb}D1`Uc5FK!b! z{AKWXe?`LDk=*Uoj;LWpOq$CnykRg*Fg#hM{*#Jm3-fes_+6*0!YW-@h|s4~Zm?Ml zhr?+fGx8ww^)bR>)zl2;#-ZeN093_xMKUbrqAr|QPyV;x-*Ncfyx~&P$&CRbA)s|Z zga?OZBtHB|4YxP$77PL$341PKAJSpP_W(sTnkl^O6Z-5B@RqCzNVK402<9l*TIqO8 zMxV)^#__)f<1{5m{mfDsKmXcKKG0|BdPg;X8Qr^D2yd}($r`GqoU+}xb z%&w-OXXi)><*wF`D;D&Xx)?3A%J5uT|8b&ig&bgTkpPJoly~fie`zGqW+jrngxOPi zPhTgBU}?^PIz^Vh{$ob;naNRaN`7394HX@o`zXa**Ut?7aMCATR6n@gAGe1LX{Oqi zkct@GRqdHD@w^PIh_eUvr|k)iDB^dz17fR?=?lQ#I_cjZK^8_`chO7 zAgdaay=Q@3SO_-|ZNX-z*#Jg7h86yiXYy^I3 zTb-d=k5AOcD=D>tesCy!S@BuB>hh&|Ei+*{CA>mrV22`)gmJqbt z;&gd|N}M9goW^Oxqh$~6%p^dP@rPN@i$38}4Y2dX9Tf5fi4X2xABz1+0Tmram@9WM z8ks>N5qYsAaz%iQL9=VpAfluNbuC}1H3t=s)gvIHjU>mz4XtiZyhDRKEt6c)N}=)w z4Sl*i+^JJe)N7McSi{J6_X6SdeEo^N6dBOfhQpyGVVodixF!J7X=QF6%;&v-`*cgr z){0Jk=i<1tB3aEQNmBSkOhpusc(RpmDInG#kK2v<+yP%tQ9mIDR?3K9-?Jy_Psdw@@SU{N3= z^zG!~nkL>{%~vP_spvrx`w=jYalt!+#U2Md%a=JZY4AM@Ql2jI^9|wewvKd0B_U%s z0z8|P!aCByA)u2>xUqaQJoY5IHKG&sOB;r}7?DWK{3;e6#>P`4sNDcwjUnCZ@0?)Z>x5 zu3RXd@;u}o;X=KAzZg6|zqs2P!`I!4$c2r=_99n@gW)pQ+DGV3fHB`{+uIyFRpMNM z=c?}=3K= zBD7ma2jaou2!KJ{T&XPq2R*plh_;FJ?|k?ka;TXa2eX?x+2_6xC1-ukCwQ<#%ofl0 zhf2HPQZNkKCTd+|o6i{r7Wc6u;RmrVzzM3mNuctWh_H0Sbe z-v&IlCty~rnjkz`9Ig*Q9^B&PbeY9+SCUJ9Co!~v@^%=P%hD^prHDOYBJuIa;bD@6 zDG35bks@9_Bs`f`e?*XJtGEL4k)h$k2{x94iQnrvl{Ms@JRm*|`@$k(d;7bkbILBD z9-Q)DPJq`gI>Tb22F#RxuG6;}!P#1{BVuI<`1ule_jyx}toQpHk(XJp#I5)O0cUHb zYZ>polkT6Im5FD>{7L=YxyiNcqJ@tCHUy#UV}%b1Go|lvC28S>Vi63-_!)1nmS$#^ zbUM$Dgnte6HWZ}b;Diq;mo4UWN5n}8(?o(eU&C*XX?{|jb?A^F;3b1m{vDgL2odPt z-p`-zFU8hkX^S;n3w17L|<_=b2N{FdIs{V6MCb%RU$eKqzC zZ+~?ab6AkwT|dmF}q0FI!YmHFz~`l51+-o=7Gj#DX;;#tP#0n>0BsRH$_e)O;7N z)tuF|B+o^ehYnfe>NeGFvF&6o|r>xEOekG49mK1dOy z>CWYm{kUYwjH_KWUPLB8O3b@~8&KB$BOEP&KmoYgj z{YyX>!GW~5Xoml z#mv7@mA27bBa#rLdA|-h@2iFYQ2;EN~~Yjab)FmZ!wzr zXo=CZc48O)bA*VjAm|AH1ahLf3u+7=Z?yU@_L1C(1w+By$_7xkd-*!qMx=F=y7xR? z;Jbj{lKAa;yzOft=bDo7Xv~zZps}2=eIbll&>MDk^f=;l%!hJ5#dvtij&ZkP%ELkO zkbHgJS^d4#{_ zh{46V2QDa3GQYdCvQ{0;^g06q}LuIfX4vH?5wP8ib&@znkuzgVjdoxyl8zsn>R=pY7cB^Pm?PHh%BZrEhw)<$1;F>SAib|L)Ewe~>ZPG3Q*xYJj2iu-GVh zWpTl*-r!!+eZYzxnjRmGZ3jQ8QtzbKMXf>^yacSd?{VD}4Gx4qt!v3IME@=v;ID`a&6%$mIYE>RgHET7y)i>e3;4fC7{R`OYyCchcWK)h&ox*T>lk*`Gh*S-^Ug@cuCgefJySFCf`4^cQ@UGZ7 z-MM-{#ESN?6>O9Ak;C#guh9CI_b7Yi&Q!;hX$P;ozQVD|fXdBs$;dgq+)=mZb>WN= zjb|*4^Gg$%$>mxT3ks1_Z4Bemt@h~=mJQ2ZgKnr7a-2SK4mauzrV~f5`IAPPx~dxc z?1N|Z=%b?GJ)C4Zp_$r%jn76gg~OzA!JJI;`kRj$+gsC6mZMR2WUtT%Z_lrR!)w%YUW8ndf5#dK|BYSaVhL@>a$+cTW6ZSH&SQB{}P`@^G zUI)R=Wf}0vQQ?sjRe#QG#Q;99w;Hcj-BW2gM^@?a^9l~0uVH#!%38I~;XT=UyGQy7 zF0L9G(+Fc&%yUZ-%%OkKyL}9~&6_y(_=#pqw3W`9b?8Cu^RYjFqOR(JRBg2#+4a1Y z6qBS^odPYm;xN$3{f>%OR`qi0ZaPyZ1*5?a2l#i4mT4O&+h@*jH^Jt3Q?PfePXIUNLP{;`M(SMcgy1zUHHDMzU%gp!iJ^Ql4c`W<|N&cvIsqodslr4RhO zKLjFUyg5%R=UX0Fy6=K$x$Pb__>WHH9sgACg(dh5AWd3XtQ#?uWHGxTPs$;7L!3~- ze{H$rbQT@ok`{@ER=sYe-RTnkGs^%1FP++M!k^}CUO1v0z|0cZ3}pl&MvV3wR!^o5 zJRJT_>J%Kmie0NTjTE>D1h_-XCY{3XS`w#I9URglQNn;LrzvD{YIR*zr3wH9x8kTf zAKAJxvO~ctnKJY8)@3N$SySvKeXb*{Hst5W@rB97aAjCk+~Fj(X}+44m2;=*iE>ik z`%WE>6=bpN^^6HT%k|0H%{&E78iK59zx;|Bd#4KDA)MS2%{sG2rxR zxo$|m2lJ6Z`w<)a2IOGDX1e{Amy*)MyaW+j9Ui0p!XUZ{E)J2RTMk`oFp(9TC>(+- zM*hIDTW_3}04HCFH%WanQBg~Z{F8QzO2u45fXd#03p&?19|eF)$X?2r97sF~!%?@G zWpoItWiqEd_BQK<_(7Iy;DS5#dZ;h=t0am9^Bfh0&YI_Y@G@3&A^HZ6V=gA6IRW&3 zrR7ZQR!ud(|WMlfb9OG7~hF$}OeC;~*;R7uHC zvCtD(rRB`cLIf?8% z%DJzYauS^1_k2Jx3ko0#dWTN)nm!>;4H#`YjOp}wPwPq$6t>xM`C~viWAX~h_}JGx z)3=N?rKL3Uj8s8?e1Tg*KN9)rBE%PtT&ESyQ4%C@;=pKOFMYu?qin&Xf zV-r=4tH@m_qOCSY*^33Ga(dYpzkA=>3JF^b5%9I8{WjmH3I{=^V-m+eE>1 zF5Lv*t+?_;GAQk@Qp*rT&u$GhaYshK1k;3T|uwc z3kjX0GWlf}?60D{vBA|rH zH%YJND+$uZ59juC6VqVyJO5%GI1DHTv4)h!)vh`zh5uInN_{kfGzgQ!sUFg2po3hR zCP!7sAjC$osFK8|`GI@0R|yZ|U~qDDiY}_SZT{@Q2&&FON zqgf6z6T~UXX7<+vOOX_Ps9hPkxrn}E#G28ojJr?h>LcQTaSl81QbJ2vg;n=qiz)34L9MQz{IAAo9 z)son}`BwkD`%PFZ)`~R*$?V$n}P*oO~DJ&XPqtJQ$_)iK)4YKEb5wC^z z$^-t@D<;{b?d5l}gd^p&I;q$loH`pLs>0%cB5>qEH_C+{(WG(9ZC0%AN%w}e$gH5a zg{1d|!$Nxxuppwj!iLz$qH>9gQU;xYs^-DEdj8&y%SlHMG8t;0rZvJYe5pguZl;4%tgxqRF<$3%7t99y3v=wRhp*@}E)(h@PS(?z=(hWH zWwv)E74*4R1(@1j36`e|1>{*CHq%qwJ(Jtt9<=l{6bx<|Rc=>h;UDL#oZ8Qk%%h<> zR~d5uf&oEw{zvDg1$4tZ)kT$K$Ma40YQ53MUt5M1gu*9F&F!;l!rnT#T)!mwHdtO? z{|g-MwM%}CaxAbQe}4{(%3O?n1`?R<$*>N!(%tKd&_)~2djmPN;RG83T4y1wP!ecO zTEZ1lVWOx$%aepOA{m=24L3ElB8U{yj6Up#Fsv9yQ532bRpwZ_SDVP?RD!obTW?eO%&V`%-CQEcpcYZDo!)8t~;+{lqSoq4|}UuSr(7JtzE|V ze@SesYAXL~iC@;u08B#HaOm8&z8nZfSl9}~btGKdZg$Qvyy|~z0Z2cN#(ropo5Ixi zC`e1lTt=|UaD0LIJdfkodAtRFm|kgCw;myAI}8?WJcLq@(z`{xXQzT1kiJnnb^U{* z1QDAt;Bs#MR`nbvCdBT0ZgZw5$aMrQ^J)6Bd8>5zX;rsn|Ju@>`>nN6>$m;=riABi z{$-jPWjy=t=x)?IH*Ht>uk~qVDt&sUF<^xdN}bm$eR0Gn6RKKfnIyBhRFeU?{^tpx zGNoCeIw{Je45<>K3wDekKH4^1RM8OhtB`rC=u2GX6q2|Mb>?XjVDdD}>M;VqsZL}I> zm(dp3SrD0wxAju z#_zUsvMVnKM)FKIG98Bq1b%fn{U7K2GL(JV5*TdG^=I1T-M5$5v*kuD(+v3i{I=h? z(r;cF(lML+%sBM_pn<+*5o+m^i!6b%TO})_Mi5-EDO63G_NgZYvU0L1)!d6Z0w@J3 z#fM=^yXZm{0TmjJ}Cjh`Z2^1qU# zBaK^tgWJiN&;%oRhC7Wt4jG0X6x%1-ppe^=ZqA&3XR8y`bx(0!}5uM$YN@B zH(La%+vBx&y2CY_EA@LXUKfC>fYc`;snzCOB)A>Q^Ipd-;o|DH0%-q3Kb1LQX*H9D z9)EjrSbXGx#7ML((3zdzxM5f9!Lqat8H45BPRo9sHs51-95^00xG&LY{oP04o9v(_ z61(R0$Mtmfr^t8NwJ7Hz$yth!@%130pUjre_zL87`@nmV@LH<&3LPfn8_Yj+cfnvy zXB%{Ndl@ZT=*nyDDKOdQbuCgAJw=ZSwgpH4lZGUt=G@#pa5i3YXM#RsNd^bBs*g9O zWSb0CKAX>*BfjIblH*dL;7@pG1zQT;J>uWoRf$h7<~i@pR5;& zaxJH1du5v2cFUJow;bo*b|{q*oA5o8z*)aDJKQW~>`Nj6d@YEcc8E%bN{TCP>aY~6 za<1&4D8a$ih{66MGiNI}o%UW{yGRfb@%^)&Ziypej0m*x>1uM|B`vJ9`!sR>d<>QJ zm}{~7*1heW`Fxb6E+-bes-DPf?qrlxCt-M_47ToewMw&~QEDH|p-p?0)xru$c3^Hm zSu=uIqF$w;=)IXnShcKpwR|kHWl2*8Wj`J|z7+J>RLAviv4xj7tIti(@jUEv5~6%Y zev--H9eW!#XBmCUQ2eqc!VzRr#Ha6m{R8Q*~BurMu+uNTZ<#2BhB>%rRheivyGf?}|-tz*BeufbGb6HsaszQZ~F_umFvI$|pgQTx~T zjpvq*RIX#;EiZ$g$2p#a^xb-aR6Y}MDWA!s4Jja^c&(qu+TP>dG#c%R;#ciy+naCl z5r6Mqr|oy;r}pzqiq+K~gg^O>gnvTP(@XSL{%-TrLi<2mk);=h`3wV!`qv$L&idjA$h&UxI3 z{4y%qqknb*-g)C))dupG7*Ii?C7fX|Tdt60j?<;a6Cw8pi<$e~2soGF z?Ul{*VRM@y$F;DCXRsAmOxdicpVPDjBe&Qf1_AtyTt%F5&=AQ;<{n%m~V*L(H*rt5UJ83agYGkfzX zOJLe%QAO?1;F>qGvCIj*Sa_T9Br zl#7aC#N6YmE@P!#0B%{P)fE2)i9ce@zk#r)s_ii*x#4q-eBt$`&k#bO*L(JyyUd;(Wzcg=oc7wnUspcvvthSd)(Dl?T^%z9Gfpl48JR9P>~Poe zY{|4}GkGTFB?wIpS7mtQ%1Cjs9F z8O9mWerKlSm=D~V{clf!z?RKqa*!R zniph=o+IS`GuHShx{felL?+%Q|K>c#!_?5M;Z`sz@|lK9sKb8^*vr%@+#m^YHqswL z&i(X79#+pp%s8ln;G-iLRgg_rGB2v_mf;V_kQm|Oj&}8j;KNQ*(GOy9nr!e>sxAY^ zwWv*|h>@DCQc>=m)=bG;Bgs*DWpx8qF+Y_0yoJ~4(Oa@yYn0JTf*vY!WOc4xV*w%9 zq|MTl^m2mNR1#!|LK!l1t?D{&3D31qO~6=|r8i@<@2M8gwXVPZ73uY^o9Q{|Jmqm& zwWi5^{%FpR`R59~c|Bs^$1c5xJ+na`Q`xy;k%ZFC}gOy$V-RTfg^%ljhY7 z58><40(j9*ZnwTMT7UYx7dBBz;=% zV*o1(BPJg(gjGa|o90kQwpWDoA7_b{p}b#MH?k&^Mv>|(U?hu%kx=be*geCOO=s7* zR)Di|hZU6EXpHtCAiYv$kC9}RpyhNcp7Md+n(=GBDJn+ZB<=n zOPvJMx}-02hdDi2p&{7R=Fi5tI+%T$csI=Gqe(|q2LBKH$Obi)6$EN?Kk>cE zm~=nDPRr-?GlF_5sW+vwf?xZTRv7>eDkPV|^Fy!zkJSu#*6YvL#uJt(m?8%CN>!C6 zGs)qqH~S6qW2Q!FRnp-=g`VpcLLjnpG zzmvpZU)l<<6nb6?Vfkrip4-a8_t_%y8~u~U!ipzTzNy)tqXJnZ@;~djcP1U zcPr-?-|)m&aVw2^1J1bkLBoNl{=-OKlMLWwd@ruW^ehkOYiWJ;uboWv!v^B8geNmG z{+E_*yU#rV#7}#l=y)bm+>x2NSY{R}-Q(Lf-63kMp>-cw=UPkip+*Yo1J-1vowbZAJOeV6brtq7lBw3nj zw>w79%P^9sM@y@liWh@Xw!O2}W9yS@+pc8M!DoOtJ-W#h~h;j(MH zz_WhF9F&k>bZF$@{bOA(Ooo+%1B|2GE=2jsQisyU$D~LJWU{4m5K>!dSYU!@PPD2| zreKQ)u>+W{Pl)tAE}98?u7qn8Xk@Qkg+D7tUTIjUPU=bn-Ln(}+?PE2E! zPu+OGu&=^`D4Fb7g^KxGg;K7=hO`ab2P0YuGmkT?LaTYHd^9uu#XlbO1wYuK|2(;J zN@KZ=KQh+>)J6S^Nx6qPXsrC~+r{MHxCGT_Qrz5}+~#=9w z5Q;07ryzmiwYP+chJ}=hCHEe6Qv1ih zj`M&51FlxBEh#E0nqZxjl*IG069`}xN(StVjsL1O*HIU9O2xMug6jmHMAceEri<^5 zv+;Mi3_#2TctKMdMYJgXLq^w}jeQXVbSSrrp~_HtC#%{xzZ7sTkn~!zr$tOS|Mr>w zIgrchuSB=LSZH2Eipqo(CL0f3p&(^6${~kLsCM3Xsz%Aos*z(OR%tCosrDDa!g?)} ziuw!yL9;r@3L27e8UzuOIeof%**L?;>vXPVnlZ4=RQ@+bt`)|hosywir7Q!kAUO5O zq|_2Xo|Dr{9lIet4$R#!o*QHQ9(+DFfZ)Kw+wcZ!NaaVi0wxy0u>F9p`)_b!137sDd9$0r+OckfD62G3fig=*(fj;x>LJf(C#Ja%}mZ=HT@;f(@R#@tB4QS!n` zG7GxKUig2Qddr}=wk}#U5FmJPC%C)2yKCbF>EIUJA$V|tySo$I-QBuzC%AjC+vlA7 zy?0j?`%hD~m+Wa{j=83_*JxHxc_TG998f;w9Yoz)gII*^$aas8Oi%>vLSC+?K$O8! zo|`V_0{C}^FeXT9`ugL2AxIg1-`}HPOk)0qI5<8q`J4MGDfoQ{Rad@!|Dr&Uk3zx- zpN&e)Ka(dB#w3KYteazyP-j2ZlnQ-o#M=JGU`a`xV=!+x%ECMmTqrBcP^ zNK}$mKKfcYLLjAu2=TripNtjkKadoPf_2_jKQ?B*k zvCL7|m6qi#MpjT~XxoJE!dHngoB?5>`%u8k4seACrT^iQm#}*fNihF=d*lMiOnS-; zlt|HG0f@YZbPq{Imw!H8FzM8&NupsifEaau2SYyAh+KMG&YM4zyX)?oMa~CP+9aRb*?_`vZpSe9>rz8p@@opaqLn6p&75-?rN`n$5Uy$g zFLV)tIE^m-NBRtvV?xgmlhkT3o(2ZM@gjvfrmpFw14PfLOzH|ION)`Gfcv57%wh;y z8aGz+TTON^jY$2U0T-(S%~k313`G+*AHgv_!wx}yvgMSgGoMIRONM2HCzQC@=)`9; z9Z1d&CH-*uax)#-a^aY6Dy><#x24(DAQB-DVAM5XN7t!pG;6M}2GE%EbFq$Ovb++_ z8SIw0t~=OvC}vem{YkUqNJ31KZ%qvp<#Fvv<|={Sms;%MnUeRG_r$eYX%?=Zk~}id zW(^qk1MII9xK_^(Fr5q-xT98a_zP<1CPkWz>}OVRS)rLvcqzQ`NW>h44ro3-Vf^Eh zLa;&B==K%+ommmUCO}N~_YKVU{7egaG^wrJp6kT6q}WG!^iW9Fpd|KV*)#jH7KW@6 z9Szs6WpsXN<*f*|5ya^ORU2&JMG2tGTLqH#r1D~0tqW=%lQ&ZBH`vJ_i z7B75|w~5vw0Gcv#Q&h*Bm+JuyVyvm>NF6)$2n&MZL~TqlF^5A*ky#xTPqWGcrW3e? zamdi~5~jbOxAAUk(n&ERL+t~x$rBeXtKb7!JF7wIF2bWa=LGhusv%1B<>oio|1Aje z3|5J5X$zhX^x1?rqTG9)%}XRlcD97BWGWVSCeMa0d*(!!sc)|LrK&}HNFtQ zkIBSM?>sHKp2)t(H87`mPb~T$pP@=NT2kCUq_vz_hy%h3+^v3M^vpKUBGelbdhsa$ zIsw3uGtxH1W>V z?vz9NBiLYk8cd0*g~dNJ0J*Q8B5~FVzq_$1v9bKSXIa2_6xVX7rqyzHEbOJJeJTZ;X~S@T*a^nFcfmeM)Oha%tVT$w}lBbhfq}s9W(pXHL3zp+x1^ z+8_T@d;j;jR9IRVo7=f%=2r%Qu{#P39meH_wZuCh$rDB zjcI}P)n z@|>Vl`WTJ>ccR-TF?U7RT17F_O9z4UITh*ff#DkLbO$QeS`75`b3lT~nxY#WQ{c!` zhh`R1IB@qyLdi3rW!k`1JfGn}W#{7@wJL9OsZ<^(%rcy=j;*aak1c!X>iG~Gh#%K_ zt4VkBlrEa>lAxwH8DYe}W9}PMAz1Et4YV|%14NKG1FJjbP@~kZQPD+LeLN#-_baGV zPL$GZu+Drq30^DJS&Nf!#UwW^|9_J|q{ekHdIboqbL za0~_{v%+V}9*u(wXz3Z&r<0#7q$X%1R7Jaf$A^Z7Hb@G2XM)m4_;D>OO)KyFO4M~~ zgt^ZtE`pU4=;~O)Awd@xA%byKB-RJ`zD(y@J(}P2j6?JX@=8vc(Ra^@`3RYqpnS_j z&tpx!u|&fRpE{~$D}I@?VWoZq+R=g{2&v9W%M7`0`q!kr%78`&pHWj8Ko*4f;_0Hd zS_-H6pR*Tuxo^7oqTPB82D3Y;p`cV~sgE?~o0-L&xrxN*WcnhXIq7?a{s&l?sHLY0 zg5V^>i7b%S>d0JWi;HfDj00GaH4dz;h@`NjU{;c3#r2Oesk<&19)`Y{x8Bn-|`5#=1sYo0l%?XmP+J0wr{@`w=zJ6q!3lqqjlV zip?1rv5)mKklw1kVq*V#$FA&lQzs?uI5|bO=Bwr;{M6`U3-Y3Cc;;N3{D06Z8c53Z zpv&i?!MUuWW_xP$>)4ndChzWu;n9*WgWmr=x;{Ag{tqK21>_(2k?RJ@_2^s**xyOv z)!6`aQo=bjF+ju+@w9OcvJ6a!5hksLD3H;gQDZ#y*5#<&N%~c|xP&}5eIkD(l@y$_ zRo#cZ1(T$Uxc*MnL42l}0Ov?*-KtTxXwA(9ri`_zN^q-9781{i@gP#M-^c`k*zz@3 z@_FKB?M8KZ!$uT-`Tx!Un|!mJSi&6-wWk3}zutV9Eeh{97t4fCq%!f!{O`V3^{b&M z+|sgBvFQjd#&VRh7~GrdiDt`LZ!}CdLW#zA$+ywr3wEoyn}x%;Ecf-WyiNgj=VMH) z)q9HrvCgJ7@qbnA(ydM;8=Gau#xVajCp?y;?Oew~Wh!KusvAkxQF4YAYFK%VZaZ{S zA!(dtbJfG@$E<(=YSooSEBUqDlk^g6FP@C$bm0x1L_lG5_E@NTQQwno0gMH@D{%@I8Z;zU)fPJdxeGb_NW^Z0T2mVYWRWwc<&5TpJ|BwOrzQ4K( zd1z{kLko=aEr?ua?}*rnc@~&ixF60Y{|5jQW|X&vwUSlHWjSZfW!^b*f;`vQf!Zrl@uZ10B<&uF0i3O7-}iXXw#Q zz3_bA3BQT+Qxzu+{V((J`*F#EHk*7ykPT=(-L=0Mr7jU8>=-wI3${Puq9qhAo}J;J z{pdT0ULPRgHT_sc&)IHoC>80WG290Z;kC|P)S_4hKHCev9a6^NIg^ug@Q1|i*k=mc z<2h`;s*tb80F?z|$=1s~Z^Bpk&fMRPhw^q)oe!88?fEiom<5u!y_mXNw`}eI`fId2 z_K6r@+cn+J{cClX1}qu#rr;BP%t4KbWAWv2(e0`jvRZ9&JCOWXd3i(!N)2UK0bk%1spq$yV!J6creUi+}s0>dj+~2x=m>} zVUz7@gL!RyPlpL`*=gOOuYa3uO@TQ7O?JWdSjB6o4~YaqdsiBnVaCqzxMleaYJo$4 zJ`)I~d4Gf^Ss?1aNyy0sUtZbHHwA(fV|s!2-(;JuKfuM{No|%}=v?+bcko%Dl2qvo zvar0O5%OHl1}@&7Xvo!6J=>2`{fo?Aw&wLn8%G!;S&G6cD{{VZNNvFiN68VYSyi!# z5)GG)r0i8ff2&ujYE0#oE+Ni|dM7GPz^C-)-`yXYG6>L$SmON^uUb%vsa+LIC+nt2 zR7^!vd8bsCInSZGA$44D&6yl_=~@zz z#Jwt>l4Hn|JMZ``uDsT3nN&exiRHp)T*Nf~(pFuf#54Y$f_T5tG?<(n@vqhFvoLiH zB8%YZ*aQa%7d!xaf>^#!8@gX_w6ld})_>Z90dqAflzpNPpd#rQH-$8%h4c+?vRk(A z*~q+E_YEgN%;mCMb*GGp&?!RbypjADSFAw;<+>hoaYt?w zUu9iI#SNE$t@H7~3&4#|-Z_&_H>twE(!RQns_xF=oT2!U)~41`aaIPC5~Vtd?XXaB zW?3uI?SiWW1U|~yl0wyu|Kc7;~F-L z1fMe5KI&t{s8T+wy@A;E$?;?T`E`(LoE`yX2 zOX<&wO!Z3ztxI{SP|}cQC9lssc*s_xEccfJ2Rw8Xu2wYL(e6-W8RCV#lH}x4i=X^P zQ5t9JvAdRJba1^pj3g4rXKY{@hjir;61Q>16&Sd1c{%u@BP3UhEd>ID))Z7&T~f-ZQjqZfA;N%7%G%<4g_A+b5C|5+5Of zt=&!(hOj>d*|)8p08K3|`=cZHz}mFSv%HR`G`mDi=4|Sx{AIh*`@&NZE7>B5v22@I z#2;o`Y2!$zRc=rrNa;?w)&wMYbMG2c;jd29z)Lhtizy8*&Sm4-{OCa`?o76-a-O2! z2W=_bV;oAm(7}>OF;_H z4}32u(CFb&R<(QaYZK-u>Uj7s4+n3=;B@Lgfo~S;!+C+S@|mC?svT9HB(mVAR@UFE zP7UQ9?-EV|aqZvF=rnbZza*iTDw40)o=SRXW3tx|D@}F`fyd@UdgBl*W8Oy+f(263 z!aL_By!b5s2CcLTaFAQ8x8-01Ana6oO(VS=_zGP%?kZkYdZs+>F+Nqoqk=g2$k9~2 z5?~&d$rMt@Mv@+AX%s0NM^)}4laaVX)s+p~0LXYJUN#e{|5mV$1gxVVoT31>i6T?} zlaN_4tDmS|R18>&Z0F8Okg|#%W)Bp=I`EoU^|Vp?dVjMAt&2eEMg{#s8KJ z%wO3TNEjerGJ8!8~nl9yjfQ924CWRSF;2VUM$(ot!Him9$g z!M4>F^mu=L=Jx6$A|f;eU3Zr`r74BN*s2||aH@h_Uak!^!4qycgbWN!>{1p2dItKL zzw<^HZ2%IEqoV`M`bp&|;+2$XR!KgPDlJwxhsfd6nEY=NBm!$(HmkY%hO_pMK)8qJ z>;1|in+B_&^{C?4t!u@Gko68`Ka-}=;Mxz=gf{iuTI77Ym$6y$%?Ucx1N1|1A*l?z(7Kb_x9hQgD7`*M;WjDP z6MLh!ovY1!XNOm2tACNd^lljHk3MJptFx!rA}}!<>65x?Q0IdO0@4J{tEf`O^ODG~ zrxy0E;*shpUyfKs8KR?=j@gw6n3E={c5f92WKXPjH1agP!zut@MO_VZ)xl-gJ7#rx zTLziYE`glDMFEwBJ6OH;OwAK^W2j9$`fzDk7U=?6sLhdxD2%k_N-Wx}#=XC-@w}>b z%ipQk(lj3%yOtrjohJESi+2tkOu0vnSV|vx5JXI9NE%syZp&E=_I_yf+Y&uksXP`q z4im3vKit3i1p{MvBNABJf0+%w`zcq5WDd3t6OGxo$C&N?M2{lkiw}ww49&RkOvHAz z&v{}I8gNH_r=~G@u?1~j=ep**3&{LFm)3FLO8}b47%QXsGF)T-N^_S{;hsi!eSQi~<9G-% z=TYf6<2mhIwLfJy=j?aiNb|iHNvwFkXJt6yQ7y)*+0V|X-f2mg-dTig^toM;?D8H^ z^Ld{m)YW<<0{u(G&Papc`;SKuipHRbV1(AwwO#+Pf6#6W!Ml;q2i$*Lk?o4$y5dSU zL*^8P8-e=CVgjVfbDa#t+Oc-=`sd_yP5eGmQru7-(iqdISkJmC@<5_=NYV%0hMr+teBgNn!hPt3i`iSt$s8}+%ocrqfkWMZCpZ={SxGEOsV8oWtbgwvKb{iUmk^39=jOZYkFdsJuRzc|mV8vsC6n+kQ zf!D1MSlZ~^{P&Mqcu)9b!=OBYmYwmrGMW;BKA&T~DkGW{I>2rvuA-DQh9XDzc!&pI zjEhf!?qIRl)SRA{P#=`bkX6{71*xlX;=6tlG}#J<-Os8Duh*p8H>_hD;?*vnizaGK zyULWUf^t7gaGbN57~(F%=;FoFzPubLvFe^gJzeAawsSIl{W9@nD^%^!HeOyta@Chu z=F^cM`sJfEYi`AUjKIat;)5{h`)Sb2bBG<@Vg-``Dv4Z*pZ?WV#=PhK;PUOVBagI0 zH`i=BwxZ9TqqYA1RvbdR8u}uu>yG4xfu=-FZ~v0(0;(owda`)lN2PVu=1s~QuurX0La(1O%%?_0d4u79K{Du~=2dA_;Oqo=i4YAs; z+B153!>OqFCYeUwM=hHX`L;FQSg=iaK6!r4y5Uyqq9~9?u~@eGeBA?_X00hEe7~6L z)_AJwKiVwdip1#{bY__{-cR@P`b^YUO%bYr-!mq4!De-R<8sCk$6cPxv#F0*{IlG8 zx<%-|P@{q-Z>3W-}c4=w=2OfzJFo8Zr8K5W-&JO^3qsMKI<*L@s zdd`*D>9!tlJo8%1;^z&QFn`iY2-yaU#r%iV$6IHYRX4n>auk+M!G!8pI1c-iES-8| z?&jCCi;nv@=<;mOpJ8rigMI~JYUt)~$9w*2g4dM{Pm^-qSC34%PFr;Eq)o1Qrlpffx!bDqC07a#cRxlQ{bnrypwr(BNbgEIXcbUJT=Uw!U9g$>js zn*CPi+wBITz?;RJwQNyDE4cam*}gj_I4jjetbV7(mD3J^oD)uGMl+7IC7V&KI z?8UfJ2|-Crd?cx~uoMRNK3OC5GSkkP2eN%-O@$f?v=>ybpf2?6vFWAQ;)Of(}Xf|`i&5?f0B^iRK+w=t5dRs9PyIYY&YYN5yTr|v&I7DP&}&VP`qW|<2E^Sp_B z-D4jGY78DoYr6PjJ69|BTO5e{OG#c>66|>s+8tT~H#ctB`@>MSsyr1QXB*vfaa8tC zHKw*&`HTAN_T#h68 zi?{pr^ZN99XWjeWx zEn=@-_RPOr_Vli~?_y_OJ(sjT=zck}`KwQQtTs>Wjfute%vtwv$19@<@41KG9g!@c-;|(fIp?ftHI$~hJ8Jyh zg@r+@2Da*`eplGQ_jS?-=<;CBp$mwkU|hIPG0K@%itXrS1`e@4G~()XHAQ^vdR4j| zuDKl91J^QnUsZ^#k9uxyBlv5hpSDmfq(SE-ZmR=C*RdQE`*&38_*dJ~RRC{;}U}nltrjJ0xij+#O(vgN~uw6w! z%(;Bd$(-8v_x-7&RRdLZC}2xc-F0P-O1#eHTZej+#F+6)N#lEh7y88+9rL0k!mK`f zdyPZoAg{zi?XzwDeDmW`nSk@v(ZQ_AX1(Wjo{ic?=LFs66SWt(9>4oQNACq!MCBjg z?NV2#-W-KNt1?dcuw+UfXBOThi-m9vQs-FXa7v z2kAHX<`Bx*FV>2h8moA^6zXK)|Zj`x&R-@5y_ z{`jggy)!gky))uVQ+tr>rbLtKmf~z}6ML>4XRD(TS;yCh2L1jqWBQ;M$Fg&s_q_GI z-4@*I)EmCJd-VCn;Gy~1s_v1l%YWnUWBwH?1l6wN7+}RzhR)d(f2czvdl1|9E zJ8r(x?YedSEFTj@o3~qCZ`sRCX!(;r@AXF-4*~?}KjXKBcmo9&hL+eg6&+mgxW{U1=Jg6dgCr{Og-gc77Wg4Q1*lE5T znREYCq?*_YvT7ufu#OKcdb{rlgmF!qz#?(eg%?z0Cy8Z9S*7it_gP+k5*H7zeZ{@-d={pIlz zLB);a$fOh6>INF)t|^(LLJ0>~{S5Y7hgbcUI%P|4mY=?E?8dHLuTd6v)Dl6 z0Svw`DwY$)&QdIy1|F0o4>6>Dv6Z8cfBm8tgqM zm@#!)Nu}lxK4_GXKI(H&z1~L`v4CpB2 zx*jVk8Rl&n$uQ|8@QWnXyHL)eLb7_CnhZEGG9>mX=%Sa*u4oq`KJk=DGkM_4Y1jE5A*Pz>=jr- zAzQlhdZV@?=6GHMx{F8MvY^4({As`GLiVe$7yf@tu9pa{Myey z6nHsK=Q!*I;F{MOdor2mR%eP^jqF2fvG}G~luQ)AmI9xa2So~fr8R_4<0M*KcTgbh zxzM>>F&2fwoG*oeAU>9V;*&=~HF-5dL!}C>sA|Ehz#~9Z=Oyfrl%{u}R?* zhSWzLRh{gp^C@Ugh?=(2m33_lMDV&%v-aB5t?830KeNCwRK3`H53MLq(jsjzq_cB&5l$y^M75xtY)GAs1e*In$l_9_4 zb|%dhK?gma+$AA_JW9e?866&Ac)yb42ZmfS+`QhC{-m(t!=m89+KA$>*2QG!Pc+HR4|HdpujumPAL~4bz>zZVJp54E3G|_=x6#5CLy1zi%BFty_8~M=j}v~zMEf1 z*dyb!r5Z>G)wzG!ze(rGdBs&>u^#_n^06$2Vuz`j6vB47D_}RfPz#>qESO5pvZ&Xr zS1O5rqjo$cs@5fAivfZs=;1{PS^X5xBzx~VhiQxc&FrZyG+>Z26jK*HB&!2y*w0m~ zu()R|i)Q&n8Ne=tNN_a4p<-K8W=x*@#KlAVtt)eMb@bjP3lrl*Y(woXTt#;@re%?m zm;OE);p2^K@w!olijb*@I{C^^2VBGTO2XTBRX-x7eKO;@WC?QEOOVTdy#^jb82$dc z>nagMzJDOx#n|VkVUhEL4Sm1KrmF3??)8aEY(S>h6n=vtTNd#1M#3)&8OH$xTvmTG z#aQ9jBTd)`BY&vPwyn>M)pT>JpKVSEXg>&rU5p0LzIyH-4SN8?|NMBphcQn17;Adq zXXtTN_r5zeUbBTO@=m2;?kjncy#L4C24&FnR}lxvb_V7UyVtE{jKD5p-`DobRU7~D zsZPDxrs|lLku1#IJU^y|1@)h6GMOMDx2;29EUC^Lj(^8F*uZfgVBkLfekHdSFN7)* zLm_>8uuaJFZK3p6)P}1dc=MI0;kb|6_phqXJ^wI~6Po*UQ|8U?eCf-fXP0Xaa})tr z1jC!)uQM8=X`Y8wbb!J5v6qg9w#pGux2G$NWb#LotD@H*D!B6}6gQHU)=>>(B}F3a zr@f?4%MQ1wr>wT#(r3PS8bN~D{R>|`oPF|?|ih|N8SvNQ&(4hR zOzg6P|a>1YWbeK=sBFVv?$&N1ZU@qVlAa0k^hkX$KF(iCId} z`C&hXJ3OIA&nGyh6}j6va-MudjO1-F{C}DL()*Ba{%Ta4Fx477@6>(?0`joB9HI^7 zxWZ;kf()Kl$1Rr`L(0n$ODh$Znj<3U=h7RuwY80;q(`lp`GA705@Ak5RLybP>I%{a z2F$z%k|3tHbd)5kO!p~#%J<7na+3c$a)5YJNXD9Hf5w;Vb(&o8Z&D8Otlbt<(O|^o z3X6;5<1>Tld!qDz!UxC8$|;d?QQ-qdym+pv_OaTLZlQJ>eIO%-Qdz>9W`1Gn!DX#X z`N0bSFoaq_SH;#BbjgR(1W3utk)nMM(XP-t||eVgaNYL-e*S z?Y`2@;rQ*E-OU|~nu(OqB9`Z`n6fnG9&v`Uv!PIAKUoU^l{jX<{n@e$+@Aud85~q3 z)Ev7O$y>EOpDTqnuD-WS4~EzXKGVjjFI|0T(XA}D%6IC`@)tf-!}|2{2e1DI8b*|? zy*SQ_FU>Nbt!Q-^r)ZIXGwBG~+8HgJR(){gj!@2iK83;0mF-Ng5Gro2g^mm$qcmzP zdQPh>>`EWx#7}m|+LqiGmq5*KrO6D*q~;o$Bf=5r5Yufn>0mmZUOxOi(_YyfuW(p*1+T4y5RR>rT zGFV+Ez7=N+Bn9~Ls}VBGpm6Wsjzd6m0f!=ebHv#d`Z0P2d{!su0w?eGG~6SmdY$*X z5}*36R0fBxjH}mG@H4tBg`%!hYO&qwe1juFSy>t9xb@^=9nBnVDMdzu#n_%)gFQk1 z?@AboBBq2A#e4uTy7QROUAC(~(?w9o&Ge*Pd<~~ZmF|pHu%jJkC zUjM@P2g5W$2tDPq!Z`dlSL3n5gi-mB_}}bsv5@zZ`5tmvVg)_BOB|ykQ-!QKV)B`- zeV>D-S8B9=yIA}@GM3es+1sXz3 zalEEdK7C+dqe9x%GGo)}hRp1J)oBS^!7ws4Y{DcYv2|6FQ*Srz7txHXYF*6Xv_}d( z=j4r$hgMNW+HFi2kSNV5ujED;PlO~%j-JkK_cx)V=5(WzkdCTKzghSc`26^S=XSaz zMvFzxz)-Q_9BP7w8YZL`=*X!A+#QOp@pk|AKQ2In4LC+Rnt(XG?Csm>ruG<*0=UlF z!8xD&W59NscnDhZ$dYJs`L6ICzqYHP`=AzG(Z0)FM=M=<#14HRXtMNUnfFGsHoLHZ$R;U{f8bCv!?Cc5*` zrC-DrU#Hy)5HmBi^=q3d2#97E&IQa`L!@5t^q(zd5NX{c7&0qCM{EvYB*m2zs;gM|~U4d7geoJ77T}{{?>`?90&Ia^zrebJ;HFJg+PAbo!5O z_3^`Vs4UO5F#q|+BoSseQC?1eeSM9`X*uK1sVpal06BNlWdvOMlK5>^h1HxSi&fmq$Q;*sY~pJ&@h*5Qc(e_>YCVoc84*ZcJ2vE5+-0o$#&Hf^)vnC5E8%D(w5|&wO^@8ImXe^2Byt@<*>enCx7Ikmqb@>NIkw&6(A${D)SDSy5@873E_;^O<{QR$l^1IV^N8A^iNP)L=CJWg7=sw!-o2 ziq*#6&tKuQADc4iiKXUpv(v4awx4*=YuHJ#0!(=VuB92|+HW_l@vw1I*Wa`1PWMmj zlsvv*I^yfB5H~7naJN))e9}mV*Y9bJskm~sk>B6Cq60r!y{u6czenx5Py2IjzY6-S zx(dDyAtOHYSH-T&PECs|hUC0YKhON>eyZ^2I2-cTskQyMuELvBF_m+PIXyo7&o~I9 z2oBUMiCP-v5J0mg{ZTAR3Ax=)i;N(g${=)sxY<4d{=jp1bf>yR2fk~>)%*?I%1|6jnm8F(YcN;TFx-+yi1 zq<#*LY&mg1$dgj=cu{E|{e0pP{}5NKOj?C+VdO*=`Nw}SW!}haa3@<)(36pP)x3c2 zx-_C(81hCMb@{?P3N}NsMKP$tk^n3ns_QulTmI;>Oq~xUWl2G3eb(^%KjWGh7OJdE zVqT82jh4>Uc#s<32n$!&qg$twc19%KsJH=sUp+oL(h}wqU6tAnrBxiI_kN=E?eooiEMw5KD z)ig5A_ymoahEVob*m5`laLu=2zv#7Joy+xBD60{9M)oY?+Ea}WMzvBpT(4&sdb5oRPTSU0wEkr-_ zC?!Nq+-KfJGT_ZTGrT=)e0s_$vT1!_X`UAlm^?e%+TGoCmW+$pouj95CoWzxrD{P1 zfXR+Wm0&BcJ!%P6=n!I*Er^70D2&}pam97ynexS8Cx2lBqy|}0dIspLaNV@%9bp%A zhr5;;U`p+!t+T{F8~eKu=(bMQ_b|P?6aT*F)&xLVwYp@r!pFWGVFNImj0J4DCiP^% zN|kOp3w$yO@J05*m1kXzSXN*Da%VV5881lHd7#s|bFW#=e@ z(>e1uOGg!j_P?!gs{ro~Y8)R5E?D;;+?|$#{et_|#M65ZNZumvW@8Lo-#j!qlDEFz z@p&zr&G?i~zcy1~VRNYur8pnV0mq77u5Z=gtuU5TrbWJ{PxUS8_m<|?T9O15GLNkI zV%e_C0n}}v_24yXa$8!WL`xZhAJpQyqn-ZdE`--;V2RDf_!RpKh3%iX&v}htO%Vxa zx+%rapcpCMU0w0@!7H?AE__Ho(bd7O(7mKyl!3K` zoP6Y!WxTq1pXReA*Q)3~NEzF7y6qNwBv3=i#+Dv`i_kOj&di)j-3-EX$o1%Q&#C`X zYuM<>G?NzY?!Q*WMO(gteO|rGQ%6s>@w5C~%`p`7>h+gfV&B90GTR_ob{SZ0Jk}L! zaO`Zk&JHPw3!NvS_h4j8XTQkmFD~IQxp*!;A}Jekx9#jd8fr-*zZ@!mmYR0wkgJ~0 z3m#IUXL`Y0KDyP%;HS{e87}stDedToI4vG2Q8amxC=wh(DYV$c*%DH+#9$?`L_;&= zwY^!xjC=ogMRk!KtF+^+wD8L%Rk8!)R-VYFctd_-)k*h$k$=ZXobczlb~B6!E7cBX z2H06nRjhG?9p?pf@fQ59JXP8}q|SWW0aG^9I=s=*(c!Gpaw~c&eXXmzF`-P)o5?8r zzh%-z@bG&AI1`AF#1@N1{y1vV|#~N>t}y(It|2#yXt{&06EhoG@TF+s(kHFDzW*3)r_%>wDS#M( z<1fu{i=Tl^=KO6TG#ZNyhFQu--EkOF^BCZScu~?H3(*%s#NWB3ylrVJ7EZ>Z1cY}5 z@@S!9VPR+^hM%n41&ZRDW&z|Ud_cRBGGbt^2LU_({4X~keaWw+eA@FYA1f8=><4;G zb}gYWe5>?aUcOS0A8&r+{zl`lWslMck;6P^Phu{7Lrxe4wv68!i;pd)&# zl`572#lHmdKSh-5P`T*nmPV*Qd;>?Ij*OiTKrSw_%0X4fSFq1HUvs(n=)>!d@wz|> z7cCV1L#wxY<1tvkz9kNsDyke7KGiR7wk{Yga595OLtVXZt2fAMp%lHXy1lxfTHfE($Ps0#C>j(Mg#e*L=b8MrPY799HY~EVzp8 zL_$?uY=+y33N=*8FDy9I84?*Adh(_>C`q!uq%$*G{Cg-arw zh$NhtkdWlO^HU}xEshyHB%WisTk!{$QPk3Zp<&pHC^udwLWF^Cy0jRQ($)r+U*J|f zcWPL(D2)#uXY@yN!pWoIwktE|4S6aloNCFO0TLSA{ zA-5yh4VNiK30$5RTFGMt13)aW;=g3AjvTeRtk*h^g}&V5-g~A;U}+(X=SwW6{d|D5 zhv{@e|xAlgkhiz#mJSC zjx#gr816g%^5Rfq54j6mN92KGLzf`;;O9o^9n3-~r23$-k!yh#gE;AQ>LVU^sn7|x zeZIazmguhA%kdhS;M)jNhe#=lw$h=Kfeb5ABrk4%olX>>LJJ)=44=asIhuegA5ua* z7>QeNyUY&v`HRn5s|FNA-k91xAGB>yu)1cY+ONdQ9PxTU&%>q3!dR%Z|Kf06cfu&6 z$73_);({TtaN1tvakgg+CC9=77!$y?nGDph7fGT}&6g_?%yE`gMH4l?LbTx(lzt_q z&bgWiLT;!@3$*}`%6dYD9*@O>=f(-StEA3>WB-g=t!o!Q37g~D+;a_63jet#hKqtb zoe4u>O#gys*EZukoGfi?GmIdEMpFPVWbtv#s+3A7R-k&JrC8VhBj|Q#@L63}pt&c8 z>r!znny>a@65HNTZE@u$DCLEu4zq6eqA-tnc-u4KAJYUG)BXs7#-bGdlSFSm`Upqz zi8$*jTd`mxF?H4->brCTT3E3fdtnqxm>RU4c5{J0Oa`%~`qA|s2*;mx|6E>IuyB}+ z7zT4<`*a?r_R`Isf@?^`;k%yx5NZO>4J-@)QQ-W!&Ab zF903IR$RsmP*~35)gfO+PC>*#Oe2RH7sJB>LyVVU*&REe z7yB!5O8HGEdSsqudd4s!wAC#I0d*HoJ5#P8vnoE=rbrTzMj}b_ zj-%@Y#r88NfC?v4*Ob{cx%t3EK3o+`AYXK#0P!?RqbR0b9ezCAIvS`nHyJrd{}78b z2u)U)F?~EhEvpEII+@^6Q@z_5yT7o0{@1Vi=RpLGVaPLbzLZmz@>MAVD?EKJkye&CHH06Tc* z!#e#dj}lBS9JFNmgSy3(p^zC!hkuv~V39g&|~iYQKNpIzqM zKetRQW++pY#X)-depdS7$h=5zc(~oa&n+Jj-5pVZM!qK+;t`a7;UGE;nh{~Rg?!}y z4!(OK>CByI9QIZC?4#H3_(ri}O8dOfK{S$TPCDkV1kII-s0B^~-aYDi-+a$nP4y#=p@%+tPr)ktef-;yj<-@dd`0IlYpR3eGsH`t*{33Ut*wF)6RIvVlZSgG%yfk z4*6{{N|^r!ZVF%GSh(c`TN{0UA`;-WPw(=5o~yS|fq<6)09bAh;!p27zZm0D7e@t{ zw&lP^ymmL=ZqB$W4!_dDP#dp!R+N{w@$5tXJyx3S0~1>9S{1zJ>NfpZv08*GYtgp- zCow08L{UZIsaE{DaLA}O(50ID;5*4E7SJ%>DW@da< zo1qKR7P8kY5ld=5CH{V+k!1^5XH_jMuo^O~Q9f#)*BSHcv%94{Sr+LWU$hh6|CX@R zCa?5t(g75RZYq>KZX>kHg#%A&5?@p3S>-g1+O^0C}t}tZt=VcI)?)7@$l|j zof$ET?7FXBE{teQTlg&L#bs}G5^ED(zOaW^O9-uUQBZPS3{^ddM4?CKpUf6Gs`{Y* z0;rtq4L-zTEvOYl{Ksr{1>FcUA+)#EwHxFt`*? zY=%9p)7kSzHP&Nk0sw9oKO>8+j8pkBXlfRjGu(%Hm<~!WIo*G+=PcbcVylevA)UWS zGZrFLLqZbgF}hcx~VQC}GqXBTT-p~alVoQn!Knq9{VWQ{16dPl z2!OuWpjR@5RAGyo@9%yTV3yfT((v_oQm*mp-Lc=xvi%21X~6Y?qne*03d7^$+$*5} zxw}3sguA@m0?e_5^NLnUSPv*pS)*D!=a?tHPdUr<5g*v=9(hm;1X-H#fTqJaai_h# z5Ppa#gbDvTTWy|l7JI_Mlm-!F-P!tp?L>??aq4$clK`f9%_7=D;rRxLxH+m!&I=i_ zSH~a)RemQd299i{sb_*%ajBZd#rkww4)~g#KiRJB$y?@mlrX@Z{sr;ovrT%qMgLP# z3~-17qS+?pY);nvK|K8jUf2L=AiVUwIv!$6|Yj8b=|s6y>`|F@8LKK+BKoGI{Cfne@VL6Vl1 z28Yj^Sx``rrY%@#^w7}Ta-D)PXTlu0@`-24|EPyHBh zQ3Jo^FB-8T?V`&LL@paZ&m@0ia@>|lmB-kJ3`lrs%$-TCu-_$4BdzE)a28 zUEK5CJX$rG{F+6*&1W@Y>dOkEiI$@ib`9-T zWl1i{-_a!&Q}djr@fW<3#K4-S{hu0z5ayE7`bmE?LN22B&>CgJSzLGGz~&EXfRmT6 z_BW-E-iWVPr;z8_V_rc)kZF#0GI$SPh~&WV!YHNlcK>)F|)3bIV(gb*48 zeu?pF%qGxz+27?ZDuVgvl~K(NjyT)!gvkFmm&5QcI$P3CddaUL`-n+5-g9MJotzby znO{tF1_7aCQn7r8qgmvYrF{D*(*bDGpq@ng&J|6mR+F~?3wp#% zfdq<8>wdBjvN$X(Z0qeLS0x7UpDhgFC*b$cAo?W=3;bfN4PM=$HphqN7&LP(a@3$aDq0PMM6rJ& zw$zq784?r{6a+omJZ&Kx^$+FRU^x&nA`RhEq-py~RPLIgLA#?i$3hfIjnuO>?ySSE z2I1%E2vzdr-FYCBJT>lYgCPoiuTylpFceu=53*`yPVmXQ7J}Bz<@q0HaXz1^osFKk zuip2I^LD4!V|*MuNV2?xy(LvuCg4UZ%F4>0aM-_&%$1f@h{7Z_G%(K@a!^W0f`e6m zex!lh8~VRLfo1NrX2dfkjaovB?0~{{_14dtLa}wg>1Tt8y zvAR-INE^55p^^%Ihg6;RJAp=vuR{{3D0}6h2z#dUh4a2k>5vOk-g5a3_>Px6MDj5-=(Z?()^n`S?k8Nsk=+5GP+^hy1W5-?uMb;JLigks@VRhwqC*q%Rb%H6||ZjVEeriz)$= zI_=W+DDRubg?9^T>ZE1NF&4%iTdIs_6NJEaN?-{2&+&k<7|HT4M&N#GW4bX1B-sUf z(uH$12`9{IY8rt+`ZXy4GD4%yL78MWGGb8nD~+vBnfZ!Ev0cbrSlXAE-zQlEF-TD- z;bnGu+IM=pF9Gup4mBtb;4H|7`ynnmt=4eZ4j|h`gfpgolpHdp@6(y_zFGS}!SNyKZD< zF=wIu2JqkT@v9>oK=@Tf3ST+J2JVx%?~YzxufxTDPB+a6u(g_8h;{ru$grZLEFP3T zoZZ|Q4Musvzt_Iy;0+hew_0yY0^e3`?&^Y2FfcB+bDJjdS?d8VG!J%9fZdT{ar;Fn za3IgblmHH=XDZa06cu--2%XU5~L^~h71?6 zD5-)5ne?~5o~H37sB~moR=4}Ja8YvH-K;+D4&=LUJ;SX9visz^;m#KIJ!?qmL0gOn-laNwqJeKsYz&2VYlN#>f49Tc{XK`S-fY4(^;a;; zR9F0qZHB1EmKaX?4$Yd=Tcs1{+k=+xdkMaC2Nh8Db}7Nuezf}Xx0D-E%=$ZAx92hD z;JwAd)eV>G&13$h{i#w6Ly5J=AIE*J#haybI=gi#Ii`b8r!SAfV@>uC)@*e~#RB!j zr(mu;Zy?9vj?~Ec?0pZFWY+n&3^Y&9CpYf+lr;xbRnWZkpZpAKInxPMhgKHP}%Nhz|LlJ9aYs&szPB{2x_uo z^IvG+%zr|Oh>(8)p)+V}OL)}D{ZJc}5$hR1B?z@?b#B8JB&>kuRB9+0UPON3WVD_XemK}B zS@dbZht@`1Sst}qA&F{jFz^yFG4~n2qzv*Wh5p4I5~TZNF(HCeN?TD;$it>@4u|6b zz5R}`$HT=0+oqS2m|qm*?!b`SMb^ADyDg=u)>^W-HOaty{K^V_RDvQF&dcxqQTL~1 zF*A;9MCq4Ohnq}Vnp^SbY-IPoV#zUfkfiGer7~L zg7P3J2!yH=)T-wIvG;rQ*5d4mV4nKr_WIaFC$z6u5f$DD7|ynC*fvH5?z-`kM~Jie{DX>mt?WBx|tx zJTR`SB5d-)3pZ*mcRG#^0Z`+;wbprip#H-jcaMjW#TlPmxeCh7GCC~Ur(UW{Ig9o_ zS}gx+U8jizo{u?YN=Kl1EH>`rS-RXDv8+2;Y${4yZqhxnulkyPz701RIZmRXAh?n2 zMM?BZF5rCLT%X2diyxSeclMqC@Qy4Ub;zDu=8J=6tw7TnJy=mN9P~B zf{~TgUhZ29NM8hHg_tcDB1vV^A1{=1hyw7h|3#m-y1*I-rQn)$3J&*T;JN&r3XBJC zxqWkS4?SFSF6t86=>5+>^z`SX@=KG76J3dnU~oh3xP^#$g;Z`##zJyY;l!wt@{4NE z0PTcpW=@elTY#eSmvj@B?7DBd)v*~!gn9vl(&aeaxn-gXhf>>nT`)ln)YZ@z3R2E8 zs3a(|3A+YmNRuCbcqiM6TazEs*E3dO1X}`5wmC5WO4hl}7J_GXX-ic)+OhT4qgelr-!c9Y_o}kieR*p6O0 zY({c>;4?WGV1Q-ntp6HR%Pe=B$qghPl>0eCMptd9%HcE`R%g~H`wWjYTt!n}%3Kty zqb=@Z&k;z6Bg_9ul*N(nCGl<(ZKi9}P8O2^Nk$18A`sQLIr`zSB3HS{ZnmGo$tv!M zpK4rp!X@pG?j&CX>qw9MRDuV~t%=WQ+vWXi*Cu^YGBqn|nr!IlK5Itb>Wv-nMg3^G&v{_nQF4*%Bi|A7~}n9BGd--KM9_ zXeGrhl6nzFP}NcY+1+Y*G{o#_wd3!fF@?H5qP-g$q}p%Tyx#Y$pCo}&W-ECdF!Z;r zmT68Co9ySKo{vL0MH*Dc`yG65hKeiqyL+@FUau2YU6bWoqg*-rl6nVBY<8oz_=n@> zuGeShho5TBPuau~_$?fUy`@y=J{^w)3`Qv@`*0+5@BpOSo?Tq=20S0~05-e3>Jj2L zY_SZ1ZF#uBdqb7$`9J&8Z|9X~>dlF*R1xf+b|~oMSyH!ELdP2m$eENdZ1n`yK{G@l zinZP>ju_Or8ghpH5-3N@xf~`9$v2%zM$X7KfBn(=ZR#9vEe>cjq^+6PwecW&`Tce- z7jApk0B2E!4znW(M~TbBZyYV4#quYM1=EUE72%AozEnns-@dy8kOc(!=29VW_#?kR ztAC2bWb>cK_Zg6y`iPj3dy7*pOZ~W(RB6oQX7@cR zd?nv#3!uZGE@Vxgthq)RG2g`b`xDL6a`;T`kOdyqT5IsE8eJ(NdF1gr;V5<4ZjOKV zFVbP=TpWgu_5^&4kI?%hOtz0B%{-dEkGl;W)=L~ZGc!akV>u4OTjV|X0DXW%5M-1VqR@G-WAo_afovgY)F za#rqdCxbR)7I|{>rmO-$p8I` z{D|4GC-U_@M*%*dGVC@Uwt&BZyh7G#v+m@oszvIRU^Dh~~KQ#U3RQm@gdYt{Ch>W03x0O6+B4Jq5l zwGIrh4|?^4*NA&P!NndF<$80zVtuhID#I}Kc1QbueMv{&H01pRLQC{&j()j(B#L>v z`<7g_K3;tJnt-v9Y5hSfe$es8ZR=eZt7iSp*Y_0x{16A~CCy$^G5&TECKdU5S2W~B zOOhDAcd~7Y%`bEgH`%JGDSSc*u&`%mXM=_++3dg>cyfW0R)Rui3Mwi>^oRxQda0au zW+nX#t|^B*e0)7~9l{A~1~h)Q3e^Jhe(d@49$na_{Ot=LhVT^>CLGmTzQ$U z%SoAQ-7L3;0jPKb+dG^29eeE)ry|(2>}v z%KJK5EwW3D*J1Oso4uM14ebY>n+Y`9zJ66p4I<(ueWqw>*YA^mwjBI(o1ot=T1odU z#GJ*_VXY+E@1#u#F}FB+7sA=#3#y2K_!`0;@YnQNro63lLQMt>1rV552GQV0B}47WI^1ex9PWeRH62Hr@5n6dPks-_`p3o~zsh?_ubA)Bh7t_j`Hhlj2 z9h@G01Rvip(R?rnb1;!HBte$dPv>(D3obzC!XCR98@5&S5Lb zm;ClZXmTj#ezt6SJi{G+(s|l)vBKr%J1Oy(LU*vpp*JCBLqxU-AlbgRiOAp?(YTH` zkx)XZF?F}NG1;C2zq?W&+IlNxy`ChiK2o7k>)%@!k6h2OD9avR8F5hOwd?Y$T@~qM zIyjS+q9WtTmG{|&&bRGSz=4a+_&r1Jdib<@=H;aJC`lnirZtgD_81%`!>Y=(N3-#2 z{>h;YH)Senp4jdR#oNx2;~QBA=lQzrF&xJ5i)uaJ#k?NRb>0s*K1iCSn9w`!h-13$ zInU{^#AV!B$Tr-#FyxLVZ;pL;qkSj0+Rc@Y30&w+k4*-(7^1Wz`1S&yJfC)X5E&XQ zl@7Y^P-D7mDs?qg2KxD4lOo9Oxvi=(a||*5J1 zxlpm}?#K<}h5Ms=w(k||hQ~R;rt^V;_9uJ#rnWbx45W0f`DpICq9*$(Q&~Xeh%7uo zyX(#+-MGQaJO=&#UfkN%s})QYXU^m(ZI@PEl0Am5WCZ#I$6ekSIVH8p*h#h8>kTCJ z)aFzoI^`^VT=p%Z(4vB(CjH$G75E>D^d=UmpAVf>4lYd{iX;o_fP`ea5pTvTiNp~~ zJ8s@ZX}KG*>Uw=vQn}n2+;$k_rFu~>5@*6lC*6YoAa}iSgl&3*h?+m%(dL}5l zie8cPK~Y%y%i}i2efcQ>}=jz{kHrpnzyvWx8;lgM#xt1C zzBNv%wHROvst;$&bCE`!$+-7A;JvJt&jE=U6Ntk60?e`e_!V})(DU;vm9BNAck@0m zvM{Ehn>UhUi7SaMI;T71_1CP~EY!+e4qxGAEi0>q(Ppf=s^p_uX^drGvffUSUG65S z1=$%xmzHWz!+rEk6zc`;%DjmSoypK6)Lh5UhqK>S zRc`u0A9;dBvrPN8+Ve{R#8F7t-+et1N8`7xoNZx3418my&Z*xzv!&opcUeN#kB z1uoi2Q&`i?rMdFk>588Jm%4xh9h8+ogBC=uom*AqIM-{vWkk0-A@5uV*sW4T#?lIA zo^UDCh*3Ab%nsjbp{s0Zb>iTKEB>9aBi= z!S4~I;lEFiRCGQEsGunYevy6RJs`9MB1;K3Ar`PC%b%rw(H|fcN3O!CbYJ!?rOe(n zhF%F3ljniRS6KJ{OUL4iGno}OH>W(w^Pm+U9}o3CFwFM&9rkkl#5xG^8t~(CpOpn>1z2wjcT^#AhK(rtH5ZwP1Cokb=#y)2>{n8EG0WY zt|e+bz&l$0D>ezj1asBpve5qFz&V=f0$X@-?fUh77XI~mecx#cdbaA2|Gy_^m8JhZ zna_PG1x3<2xycWbjpWK@tLJq~qR9)(HJmCEf%@W)s^NM*W&3Uit6sYBY~etee=E%qEYG&+A{(;_XPrX4JqvLu}b?JxoSh;UIbfXol zCSCU^X|>6qt^)MMnE zk;}aS57f*+mU`4=zeqT*Po$I`{QV-#r?t&BrpDsC}vYb!JIF zeLhtR0V)!MLeKU^X`=lG{IzDdeb8v3a!W1sdjPGxFlpeBm)032m)u1wz<7n@7s9;9 z<8~<@7Gcn-pp2Z{VO|6+=T;rKX5o(Wy$O##uH3gaKn$-ViY8)crdmpB^gcy zWP~~Wh2FRA4O$j+H8e`fq%QAQ;LFe+|C6AF<)5FEbn(pLL46A%S;>-Z$h%_?x`#pc zDU41x>K%7axUa|eLmbXl2-qo;2F}Jr7rdo(87ku@%Y%w54HkkP@gb3t4rDnarTB}12(atAqsY{c5wH)WD4xGkcVm)Um z8lG-G^FA4ok{#R|Ohs2RpRk8zihc$*Rc$Sk<^0~++pc)IS6WbJ*`+glCbcToTejMG zvVdP+#uWz_|Ir&Vygldi7ASGmdMtN(y&hA`;;cpFWoeqv`4Cta3KAm^?lPK=_m6bA zZ5MihjEJk(^*F2{Be|j$9KqWzXTm_+jNu7}w)89MWIiD7-2?#uPS*=*Vr2c9JdyD< zrcm%j*yegEt72lwh{a;k8<5oTCV`hh>5_XPx&Lr@=y1@VF#YB3Tf6p{>D6ibyTER8 zRxB9OU7^5qxPO8>v0BfhH&9776o#aK+KNh9YS`QYW?bxFHs?fry01zbIhsjGeSa>e z?s{ibhJyoV@JvgJ8jmL$sOSujwWsW#<`kTUB@J%}qnv&^kb-Da`LBl_9QLj0V&m37 z=eH%kX2qlUy8jqFh~YSGdogFem+VS==eA}5NUD43$Z)n%i zADOiL$?~L}?Y_;8PKtPtbXs9Niyca?Sr-|@`<^)qs8@^cPPqoc%o1o}55^M6yjUvb zDu7T&(W!Uy<#>yY_N~wlF_;ue%z%RSy^7hsJ3q>bBMB~7)hpH(Qz2!?1ypDXn~IWa zXpdZX(wtuZ+VH0HCNT7QD0OuD6^!c`E&o8^9ikKbk(lB$G=$$FvDe;|c<~rrc-t*} z%#p2|!<9Up&Aj4khltO5!$!R#oEOC#UH5fFe+0A8SpP=n`J+aDI`kT!X?&M>HeW$cQejeU}A9l zei5%20@+HXR0=Ib;Jb`Ee$Fm5h@Ss?O}TbmyG=~b>L?^aX#+8tO4%dtOXgvgsH9>{ zt{EYhXb%CpV>*LG0V-ZCt3GUU!kmg=C&_!>MV$@e^lDd~#UM$wkQRP%f>keM%jH%cSQ`R2ZH+6cdaDten?~ za|KGHMgwSDZl~a-w>{f!Td{5JAiEAPe<&!U)mg%%B`1WVLwSAdh{erXWL=IreQ)Gw z>1)W#3-~v735=3~VQ{r(8(eHwE4{bpy9&)_+U?5_ct1;PM5%qUPPU)2c$>mm*H(mSq^hjYzU&#xUeD%_dXrQGU)8!#+iz*Vx@*jW;yCUbLMa zZPtD(VxZv`1!Lk zzurE%-`XI8A8Gx5KHlQ+Pbr;4D8Rhfv@{6|3rZFi7I2LKxS9?ePLonl3S z(~X!^suiT2*1lC;C#ntBHmygB87A?>PG62?MsOJuRgNi>JdpE;RO=ah$=*ceiags}GQsGF*@GQGi7m->Pey>+ks~BM)Eo&$86jwU2hI0lxsa}BIV{Fo|J8& z=h=EW-#QQ=FW1D$9K+~X^_C)%b!P?JmZaHH$zTSn>{o2UYL1HaN&={mWbDv);3F30XpS@@dIG!FeVHvWINk03o(+f=iI()iUB&gZTWgET7lIY5oj( zVPRo|#rz2$Rxvn>N~75{4d!+}#p>nDb@rP@Gwa$yw}mCi%B zJ^~yBw#WA0=2+NlHU--4F3c8lN8-|VWQHGIis-c3V<(*x;XpW4eE>mPQMdtHRGH>G zV#|d@v3U}k901hN0-7ID15{Kfi;(MSV3tG^97pc&H4J{!veHMMdic#gMfC?AN950D zko(F9*K%c%J~2CgmX}&MOV#dRqbsuA=wDoaD)?=$BYdcJA6u?D%t5EDp3k&;a6BPp-kY^4{do+`AFeB8 zpTl#pQ|)>dG5D#GMPTRM&&9v4$6gEsRh@=<#aT<@@_g^zic31(Py+}|jU&Bj;&D&C zg~|f}B04&Ff#2buV+O%wK>dXZb?Ge5Br|5bz#V2NX(=fplEUrVfsPJtaMR_VJRVM+ zhm=h|eK~mVY=@gye354>bKYL7&6l@Zno^H%Iq%Xj2jPcUOgUWh-^34 zPd@(!sev7#qv_mG=QT6tQ825H9LYy%pOUu@`Yt`^X3`Mn3<#Hl>^|vF}*LH<9R7UQfEBzg7Y8%L?;H1E&C6U z`xDM47=!tEe*?3;ysiguMn^~GQRNXAgQE^2Nqj6XUP51|Oy_%k2LwvAeoSq6 z4lUa!J$zg;F*R>?uD)2PIs;Veh&AJ_zw~~y`pWQ=zB333Y9IC(T+!j-10l#16vU4V zg+yP}-?{3LK%$vkp`+qmcR{XBrBmJLT%38E$!KcAd+VNkcpRpa zZ(!}|0hU3!jy`IQ#a;sp-bi zMUm2uIRWiN(cd_|sonQlF7K3+^NYHZee(xl&|8N^`v=$R7{P%R#ZSXaYWKNvgE}%2 z;cIwlD0msD4!oF3N#`>Pay?kc(STDv5;WR)j%tSil_>BunT!q+p&Q(R)9^~aLd z6AhfrVO7Tk>xwI)VO{dA>e4pEGvcKQfrVXf5gweL#}P!v<))|>8~X<$ZEQG~W+>dq|Z3ZPTCNh|SMtZPEOY6?xAM+#Twq2?C%7gGaVP)MR5c z=U)51gDI+4FBPX2-xw4e$YOQ!yOR*xl_=e!C zl7fIiawt4fIxb`*e;ImSN^*)W=Ln%Sto}KUCT=?Bw$U8rbZ_ud$-q4f8EH8ZRE9GR za$WuIVlqk2U`_9!LQ%8t-tjG9&Fd!gY%xLc8+#dx(w)G;$kc^-zreUNZh0SN`^G>%}cT zNgm15%BFYv<$6u<)a#pT+{Q_L+Rp!IN6TYnkPJJz*7IFm2Y6^+fiYoLfy}pGb^P~e z@f=AB1;NvTqv56+SDA~#+b!|wb^OzlO~sjy4F$nfr)ZPMXjU1D`^wZJX_kcIrSc+Q z8g{%2M~9~vWz7Be=9nQ8SCnMSIJcokPXUJr^78Z`LV#3w3$qMCaOHU8`m1$a1HYaW zi9#~vymHYQ%V-8Ml1qiZ>1p2w(Ei00TKRtt{J(|L5&ng$-dO5$M&#{DV{@t9HA`oE z?T-3u-5!4G(-quw;DHQc`VC2MnseGuLj|T4!3mL3?c#9O)_l=q#9U{9j3Tu#?9+34&^Fir%z-pSp2p8z9TX3@H)w+{)gR0v}6_g(>BgTPVp8 zsQenJopRBHzAg=Mv66?=7|}c~q_j-!)G7v4IWB~iA*7YT(7p&#Q7TiRRwoWfqq#6T zYO0sV7WFq6NvvoP1mos4FPWI;P!bV>+Xs}y$2Mw3o&0t7uMmL_l}CfhRibR0o!DfS zp&p|yZ)bKWqOcZpW(7T0V9usQN;^Y?QgBCwOS!DnTUx%jeXfgc|EI_Q&dw|P?w>{7 z0r&^s2-}ZU-`r%a{_184^(pW zog25vyp@84Cc6lfFa-gXOR8Uh&K$4gVng1Wq6WEnxekp!8WrldDkVzrHb84oA^kBv z(dIg+NR<-e9k9*|@Bn;s^$j%x1izQ<37Bqr!n{^=j@aa=RJ2f!Evm!+kh^{W`gtaJ z*XAlC%=r@Zvk-$WcZcJKbZrv;8I1qAc3gru>9zu%&=jyB*z@i)h_ zn%8>ee0<1+6i{URlE&g?jcfeod89b*k8B_BV|+&{+1?^I*Y3%cM&LrO9G?KH46V0# z7n?W4LvnbgV_!9YV&d#U>b^U6-E2N|tjV}+?}!8@#%s}vktPskjOml9xDRwVwSm_$ z01G1}S&&aU&kVnAe@Yjdz29&ClvAZTC`i*UMH638KMW{To+<3KTU(CjSr*P~*v+QY zWGTb`UMC+aM81OG&CEQ+f?t`rS5eU|td?w$DM?XFZBFJFP}fo|>j_KyfuPT=nZ|{2 zxW!1(+#EYRcA=ZGl!Q=fk)m*fPzqz1$7OFKBEpegl{6&p4IIsxcsn(2U2HWvk@`$1 zD({6E)X&KD7wo(t;6>Zr;a3W{f@1zp&wOn4uU7ax5Pdo4N6<3b1e9-!Kdv5LhaPOV z{H@Wkt9|Hh>v_FkR#Y;lNM==BDm>m^p2li%9(X+vK~#%Z3o%}qnHxZ8E00^TrvkLS zBFGCrURonRIMS&9l@d8=0I1pPTC#3`u^ zY(F2h1N(B567nTW^M1{_a5V#kOBF3-k;}k$Hh~W8D$uAb5p~UolAKFSTLaIt0X1n( zLbOow;*#ANR)%Uov@wd@u~=24w%E=`iX={j?B99-S_$_`*x{~g$Wj)M8L_qFCzOvI+f zYp32_q1V1=$|OhCeY~ZbOZcr2qWuIU-vkRjx0L^%AeVyATL{%#=j>Y%#2lM>T zz*um=YEdE@aVb)4xX8@g50yLWKFLYDqb)*&Q{IJYt*}^h!6UP_5Pm|MaFW7&f-g1m z6|;4*@=k?~)F{UtIF@Y}#3r>8-^c3sLDMYTMw3lrGtRh)!6azuRrweOZye75Y3pt9 zAC)Ld8MMIklQx@#l=>Lw;qm2y6RQAcmnBr~MQciV4VMjK0J>?zc>K+6uJ9!qYOPK+ z2B3(Yr7*Y-XI5b`)43Iu46rB(qcK)zrT9RdsYA#CNc-%*x~p^_vANpQ=yvo2@yT*89|c8=vQ@QtR6X>y>}Ce930Wq>@C9jaV4m zm!H`F3kW0gwo858Z>L`)BTcgb_8dwES*IMr5)MV&hs3_T;NI7h>ZwylnBsN2OQ_vT zn8uV3H*rsr6pT|#2c~K|@4-};?yK?jlROyNpKsI?vcwFf3v@rjdwd@*xV7TJF=Q+r zHomnwjbcjT$v6j+Max`AkmXAo>!v=X$Q~{&U>j00HS-n{WF@FMc1?G-kZUIddyvTC zWbA}!E0EU5cYp~Xt(4(~GzOS2A=wj4yDV|Fd{;d4&S|py%Ra=t<4Td*WqBQ&km4>` zse2(=3WH4XndbVFvgFU2!GCZby)pUznLs!F-{zcHz@<5eYolb2Hso9dfRdD^7*|Al z%FO&MKOuC^YIOn>Vnd=p>2YEPxWN9u5S^ijGoE|w zGs1)L0$X6u2?LIGMD-VJp)neY)c&ozlQ!KTK25(04O00xaWbo(GrnycO+|Z^GChjd z3Bm0p2f?{IY9j?g3rl9$(=uG%-~9bB%%L6BnW`1~$){b0a2Duy>cqUTO@ha}tLoO- zSr}!1^XH^raI3afbS=!b%~+blILL{zS^QO22vTuVet+3NZqYKidq4nUPVvw_ zD@pt+N>hxToyXPZoQr+Z)HX-&K|XohG20i&ly5FO&hAK&yoKEyX{YCL@ftIf;B|NZ zxhbY|>8vo%_tyZ$P>34$gsLt64zwx483%Lk;YFt2rCoMyDe-2DWh|Lk&iSkS->9S$ zH(J&UZpPkCE#Hubx0)E&_d^O^-w$T8A!M(Y`yU8mXv@kWzFmf~WP_8u-3B1cF2@IA zGUUT1Lf(X}jOM5s-;;std?3h>;<+g2#ra-vt0z~2*YySBMU*LWiuma{tMBlvTlM={ zV@oxA3~KRE{J`clSRm^h{gb(>4%q)iWl3Mb9jf56oV%BWC%BVT{<_CrY3*k8UHwXvof@he^mRl_^(NP%8{m z2bXXUh5yi8qrD#;2?b{LE-er&JOqk``;mwA~>*ObV zlGdr5?w-(Byz^>w3b8tLgZ5GcCY4_GGp{~77U%}K&dE;?wbNPYnV*ArK1ty5qMCw( z>8|@CQqBOn?LvdJ*T22`7d(cp{NzWwSs7SIRi64*P~W|^+DrWl8|gmw@!=lbhC;q4 z&v8FU5BS9NOwVZnx|p9v4t`wlyp8_i3hHtHgkkmtPCL_?(C0`#z*y@1X%XEc+K}Y- z^(glT-br&clMIxTw%$+2F<1!i4ofATF$wKs3Earr z28h6>KNYhv*H;kstkRYkE>r2@a*`GB#9W*@KFffmk~_0=sW&~g%Enq#@s76k{l81L zkRM8MgqSQE=U^*WhnlDV2EfC-5MDE$i+3C> zj(s}Gmvg&V*=s1uvBDOqtOxO@Laj47f^N-k5g0%7$7;!m5PMQn!pkBkd<0q+mrwM! zIU$CQ)4$&zROrmJuCMeOHPIoz_4Lf(WI$f1gSlM7ajhC5 zTvmj(DRma3Ihe^(5h+T;R)e~mBnhm0eAgyqr6I|ptWB|4cq-hJZ4)Yk$xSNAHvS^V zWv+sGO#$PtK1RcnLh$!2Luw!;T=H|wb}v0#kc#~E%B8nUH%#bSRiri-+fkw6nbpDK zz$Fv%@3*h?68wU$wEeQDigl*HIgyR;PBNY{x;3ZpJ1jW1w?HU{$pMp1l&nT*&6g5( zGpClgf)Wmk+2$QT=*BFVCGmRD5g$Z3xNQ_s5FDO>^mm`bitBKGGC>n^u-ja>Wn-PZ zk!s#g+35)~R#yV4+P@wdV9TYoqpM?BbCdRRMIq_=1SF5^k_9O4!WmgpJnU& z>djFHkhtJD*maf)fHJ+69ab_66do7z2#*+uxv1y}PIPJR zf+Q(XUehdSgh(F^l!fpJ4*D>No|KOmzQR1el_V2`pc&vuZY_mV$$;GjpwQd05lUzw7 z&c*W2u$awD5bWmDDFxe%b$t`iaVr5G=H`CNj6)Z3+$?wroqePN`u3Z(%=5<-=#S;C zHS1E0#)MdCLvllIHFQE{l)c_VU$mC0P~;@BETo)yU6@C+1rnZDKB-p0B&15#JPC&+ z7T!XRm8owKxV=uJKHy2sq^A}1DGeEqeLYg+Zu3p|MnT6t2Xy3e4KJ&d&*YMCdQy)- zR-Npu7pJQ$@5@Ct>6>U7a6Bnp}Ae-vcq;efn_<44Ox?N1>PsqT#e!|$|!pvTh z)iU3Jzl4OCC7NndwWs9GQZD8NPjW5=i%=*Atu7va3aO??J`PUGT+nNWjYw+S)^awt zG#(e0=|il95OEK-YAEyxX$%h7uS_i<#o4Mu)5i)3kS3kV2AP);eHZ(VES;vK(_EGw zP1$?hMUI#$jdJVW^3sx{+IZX_AJ1uOWz0IY4r!1nAt0xT6vL>_O()#L>~26l^;|`u zUrmrOS^K6OvL8_vR)XUxDlM3LhM%Ifpd^*BX*Bju4oOD+|9JYUs5qi++u$Au4#C~s zT|#hocXxLZ+}+(FxVr@p+PJ$l?$9`|&$;)$-yYSYYS*r{m(4Zj8n`#JN;s6USe-Zv zjY=S&c#qrdppBx>iBFTv2v8{_Krc85JPKT4wf*JDH)TdK73xSJ76zWmf~alnwp@hGs3@)HuCa8)IxTv*_2 z^irlSk0X*;h8C?86-u=5u?TCHthWVn$jG4MNlU5H6soG~#%@;?(*{eGAS%i;cGm79 zseilqZpOx5ayP?Uha!$6MQLSYeK>RiWmYPxDT(9@R~A8?91|BeGt)}YXMvubNp%*O zs~A(9LYCO_XBKeNdikGv2LKY%I5}S|0RX)A>5-ytZK_>ol@cUUyzvyhvBu>}r6vrm zyi8%`Z&2^w)~5{}y)HmPp=EU8t@6?<4fmn_YR#&wu1rHWp2U{Au^(-TvzMDTEXde8 z*B~F53@y8APa6hRZ#sr3nW#&IFS3)+HeMK#N~g{j-O4aDS4*KrpDc|P*CcHlXs**r zw}PNclA7BrLwn+u|3hYiON<8bRO3r=BV5i0I#cH9K%h)eCrYXLHxYUG52wuOemDFZ zxc3aA=ry1I^=-clIO4U5?5*}Vqn(OmRa%6BV%LXT68?C}Rd(gUPFPVBzF|{w>|gcO zS>ci#94M1^ac7qVMxf^DIUiKrudz;}vn-#tt=Mer2tuFP(pgo43(GJo^)wTVx{}`Y z05j*{aLG6-+z8IQa-5K;p|MG~B*!h*F~c6=0U0*G!*ok{=06tpxkjK9X(EBdUBfzi zs`QqKLx#o*hS_Eby3E7vD`GQH$q4vv@kCKB>$4o&{<;{eRzb{f7D;J3!6RX4xh+)N zJ=Q^C&*~iB@~w9HyGMipd{r>3&11}-!%{uwM2>dq8y&7$5UP@;Dt1DNd(n;#q{*oV zauN)wQ^|hk@A`H#u71GjfJZrmw1ro%d#9B3xU#48HqK&d_P6=EX*2`e z-EN&&|MJm}PcOplj@HPZjwfXC3YJetQy6|PihSB^7>Chq@_X@5ECSj`EwIPcOo>wL z$=1Do`?&7ka;5wuqPv5pYFr48)eL&rfc@!4&iWSGG(trzmI~IssGeg zn23AE=@R1|2C`#sqVSTcYw6Ah`Xyo{l9Pi4d+hN#?vcM_G|6QdzR*azvIgG~0->9!^7cH=X_3@l2kK!U^#@_&R7G-RHcT3-do_k>y%;k%; zrF9O#Pf=FJ?swLTAoP6staqUN2JC^_*ksn$0vy&Zt;?d?FlVp^Ua)#`cH&d4z+QVl7c>*(oL-jrkU zID{M=u}--F$xSzYt(i#&_Xqbl!xm4yorKl*T+&9Ao_nLoA4OO)utgFGZwUM|#i%dp zpD^uV-|(mgXYL(|k0K{J3Es)XLOlOA{jp_FyL0mXHMJ{Sp4BQ7<*PB&aIdU=KU^yQ zR_p7_Ug#E8_wMsW(J}Lv{y9fl!19}>wh3NxW`)3ZhkHtVuP20i z)*gQwsL5Q#)IB?$+SimIE9GrM5_>LD?m9PI)$e_c#F%-gtjX_c8bRoxpJk#3^Yf{X zd_nEm>JL(*v2q+gG4bvP2KHtwQLBK!fJk#>Jmw1|4?D|X`c)g$sCo-@5NNA@lRu0sXS4v@3NX!C=p~S8DH7SR z=Z0f&)Lh9ND1}9c&Wi(QJf4EcTSECe-l~} zoXII{*eJ=|oapr=lTSPWRTikRvIRkYqQKXGf!njbq-iYR87IhyB;wgG>C1mg`7mD) zIRaopg*oKuM-&(h_e+u&6pcoC7(?Lx(DW1>H#1OB!S_gEriH&^!aN__ z1-WQw7yZSV9!F7+0np`^_^W6n6g~QjV2p*?%}-+? z;ztw#Wh5cew_-9In2Y;NJytYwYS%g{Z3EM#uA-`i1Mcc0Nm45KmOKSwG;)#RZmeY zsP4Am^DlfK55@BvXRe*y>`JF^2(x|uLF1t)cKC!;(7*#TmNsp>i#-(a*$ul8&!D6O zuKBB!V4a~3Ks~y6l4HU7;*^ePoAV!(IR18kCe9{j&=0b)(K_NiZn!FMS&SjoD3Iam zh_B{zCT=8#Jl$4%Wgv**&Ixz~hBtbJ8TLA}o}Ez|zMME;ZV~Ux-<^4_hoT^l-sT*~ zH(lJ&_)_b5zrOe|@g*4To>FafjssSdVsc=@Aj0G1Z+GhLN0abl!S|!CB|cb&tMqm( z|CKRy?0%I8V6*J?+p`RQyDEggI$M~olwlOD zw=gGkTp>2??2WSpAl)5o8DA1A`MvhsX=^Y_QKn(eAN)GCBgijyd_DEWev953c58fsX@tLw}PTm^wrg z3;7SHeSxj*eJJ*c#1G87C63!x^#H1{VsLn)fRN_7?0mR~S9W&leU^o0YC4~R-rWh7 z^^*?pAK0t9sy}OHke*gysB|##8!2&Q8E=)`6JVX4>{?p9JAFsMu5mcHuni{Q;Tew& zzkPexn2h&;WymvssO|1-oi7+1yr!p3G$dDoRy+V_Im+}zrBcrpfaMBr0z6wKKS{`CydSF zfxjJG{;=%!%C0>6PK+3svknjSjL2Q+GVA2=9?8*Ffy$d$kXu8yj??`LZhkwZ%=8#O zpXWPG&F*aTo_(F|e!TD7JrVw47!)?xQ&Z!#SPL{*W&j+CfpdqXow?4J-{qW0DsF;p z&pA;s;ZWo5vdNP^ecf?z_<{b;qnO)Z-oA;?Tmi&qcr8<*1NHTA#uc;!HW3cZ*LDrw-3g}-H~&3Uw%VD;4)fClJy!N zFi=Iy9J<_G+p6(?BnJRwf&9j|md)$r#cXE!gv>MVnUpmG6Y>rQSjd{nCtUbGHkwTh zFQ|LZGKl)>ey5fU%Y^r4<&a>@Eo>=9>bp8gO8<|u8lD${U$4>2`aR?ZuQJGTUZNs~ zssDjgVnbSH6Ziw%1)k@KW_k-XO-+Hf>_dknb;f2yA(a_lAQL_|tIZOZ;iH>{WUVwK z-N+NS;wveECE<8Y?RKiZ(x12{s9T^j9h7DS3jE8VesXM* z@!MoyW~xG|zS86vg8y73kby46biEWI&}HM@K51pkUxRk{YBE-|V!Lppn?NeCld!ZD zqKm$VsQ(4axf{o>)UxHr{KbVlqxaU$W3XMoHHoI)>|Jy1rwZNu?|AM9wVPo{jC+q) za6x3kyw19CHpZCFckeOQLVNa`MdW@MQ7xjAadG~~4a2I1sH|!P($T6+BZjzjSULL} z2ul2ID2c+=Tg*V%MPo%|sw02_21VV#C(Aymmb*`Q@ zj{^4KOI%%~E3)N;1a zgu8!55YtOgWm6xZxcE^>YPv=|$NAb?x+V;B-t1`-$v2%r&u|15MmI9cKYC@L;!=Eae|5@BU^@zqHTU<0a!6!|RkVKQQPkuv?3N4jc{i664czjZA zl4)wnLSSZ^old@QUGU>i9)SXzQ0^Z1{}ZPu$pCtrU?sdS`le`L9X2EG={lukvuD7m?lL;`xgN-d4{uLGh?b`NYkdDP1^ zR+S*vfaQ%LC-l(L`#t$l6*L6jjC0=)20L%`q&vLIj0Via>5zrMZbFxt+C%nUQxFujNt&^OxM;h|IgJq=18w><_PD zO~{HzPgihZPZf<)mhyfEeeB$HlEqv_?DLL^rk5x#kL}j@xLGA_!V^J{XlL1OmR&zv zwvAla`nj)C-=1}GTo%Ppn~bF+)VxouK|K4XrA-RrI!Vcz$osq$rz@VT=U0ux7}CmyxMN;E?fj6!ko7XLh~7bLo?oof>->*I%8@U^L5jdo4l zy+5sK6k@X&tSd}9*!zH-;aVEG1=ms~)|leBD`(+NVX{^>@b!gWsQ*|5@^;HnQLcqm z62}g1eEqdFDwvm;>VT((${(ke{@oVxDEZy>VIPUeis$<_K|)K-YdA9cL*OXvpUl|Ux9HFs<22s)%`JkWE-HnkkO$fCUUw(T zA1}aiuZL3|q1M8zPRqRg+2M(ZkB@-cX8}e=Mu!Xr9A^9wH1H6DLcWl^tn7rN|D=Mh zGGbt*O{Zpc86%OTm%t;Kek6uWZTW|*fut6?Ec_9(w&=Kk7)PG*)*hBr91DlQ?;q4E z+duxE6_=HL6Za97DJfIko(rT#{~?2Pf-pC?CZhyW>GGmfAux4v!!14Gn9>~>c)puS z%up#VEsmBzkhYX$&*Dh5a%0qvoQY=@Scu2uTXdIy>T$g~`w!mo#;!1>aZI2zusKp~ zqA?2EnpC6GB}op9MW=!uh%BwN#!s`R&Qm{(tRjF^g*O)NqKkC!noS97meVcRIj{30 z&!Sgl{G*6;Z>#LA<6(A#3lV0)Q&JaduH*53h^Ry-4uc7=5coF<-8yU7tFhI8JOGxN zVv&wtk@xabY_e5%vZCD1wc?Yu{c|1l0p_L#GNo9i)Jv}LU80J98)t&v*CRd*aBvK~ zh57UrDoBH)bGso(_;SJi7t<*ICrv^7En$@17p5-6H(05HO1dd;TZf}2L!S8M?iaiv z74-ymEc&zs_Ft03zwY|Pn>j+fHX)hGdrIwWNc(mUjMCa6vxSp$BfhMCGd;)wk8&Al#BL9+ zTyru_tsuHO=Q_>7eLvc&TWdEC*yokQsb(*%G_~Wf{=s+@C!kwJZG~6ZK5J+Ic4`7G zRwo7`$zC{nFdjN44S8}PUbK{Esjt1dNO>{kzfoq}qE$;!@e%6`I&EVanc-4j(j4O` zaPbNU%7yral1*x*OkLT-#*$mSLJg4u8!}VEhL- zC7R}%MwFwS%@L~aI~U!`v`QWRz(lP`UfQz z-kza%3mscM-rP)N=iD@k`%;XUW`v1qFCfTCJL_3w>u+7Us6D&=40AQ#hXWH-Pn|T! z=LgiokSFi0{I!+?9^{m)TpEcK_pts2FQsgX`r=G(-Wm~6PI|bd%f~q6N|1FR7M$T- zjmvcOxML4u1{G+s@Tm$3C9pGA+6Hx-R!mR7V+eHo1-y)OoS6)JNtJIyt9iTgWu1Gk z=y0JX?<<$o?t5OYh~|q*CXY}v*%u98fn_fhT>ms$-kJLoJz66pAJHGpixAkX(G3zn zzvGh+YVV;}<_O*T!jwxk4pFS+R7x0 z#K$A!UB`=CisJ_Fc%R92Wki4X2pVx$NrzY7j61%6(hq}K4QvI9PY%~*hpss{tq2;d!uFLTDY1GJz~v8F98HiUcrt-pFFlx9UnjWqyu{*?e3Bj~t88{@>5;z> z-|c4nCs|@aTN}tTsy$tyx>HHLY2e=sPj2Har7G7XIEv&n)iL(@Q;+6j*EjkJl;)&#yIGplcl+gLt2IV!K^KdFM*+0?{BWp&m ze%F4t%5vJ9qLXP*Qcr9LQ_5@F{YEc+O?2tDDXmGv>Wr(kEp1(!Vg&5ps&zyd!V9c_ zkMj-o(JoA)@%|oV=bZdy525`7)@vug%OzbN9s5Y$y~RudM0&a19WJ*d;5m!f=q=4u z_m{Z9fS2l5)wh`M-Pdi-r8}N=h))@fqoptyp4C3W3GozU3M7b$o zOUK=5EY6l5c9<*1m|}Pn31=E@8)3^c*XbsXtpig&*SDnbGu+qwxeHd=+J8xWF56)9G@ zlMagxzs)5(_d0MN=X^lxwRj0nONfx8XHk0U+Z&f4aB6D{;MC+OY|YiA3-WYhhL1Y%ZZ zu9o@CGOO=uUiH0B?kN2~k^ox=3+~HbUg!BVJ>cpm=el#*;U^_1D^R`@x`ZNT9lKUL1) z>i*~@az8BW$x=K`#+q()c!n8XW>9S48#gd@cq=9qV^FQfkMeRPL7_C7??)9Xn@bUG z2oBfwGvLW4aLe9tS;{m{qn4icj??mh4Zlz;sISX8hW}CGdGV6=g$;YwD=8cF<9RlC z{~VwD!n)wQnswAGNUo_$c;fWZ1{h72{1k1$b>WjXba<3o;7d^+vpdY;GLR^`s0 z=a2s`yStRtZ7-VIy9!tZr1i^mylrqwB~Iy@F&>}Pn&&wQ3dmR; z+?IB<251xN`{e0@_|CR&pnbz#u!wO(YS(SY^Q1isEmfS05m z<;VtoMM)xC?Q7P{^2Hks+#@LbWfd1uO386|pAPtkdBLo`zCe;LQ=+YUhL9AO%PgC; zr2@az9Hx82>5!I*s(+I|o(J@kH(ZUvh#h0uvKlVxYLJxbD4&6^KRZB1DfxD};OPc2 zt5#n%D#I7_J|A!+_GjGsJTuQCoVoiPrR&{(;GCtwv1t7Btybr~HhjR{nRY zXu7SWDRW8nX3=GLo-W=g!u=`Nwy&^f2H4JTkk&yO2nz?V~k(cTmt zq}a3tG~!F^f$Q!@eKx8jY)cEdrM5nox3`pID52kI$;0;ePJ7UL?&iNQ_|vYlmMOG) zMi?sN1;WfeKUDodUG93XwVD`+Ir^n^r4)(D)j66HvRcI*Ym&aX@yj(aO8Z!5^3m00 zO%?Ns{;BaO_CgBx!`{up!6$cjC$d@En+3_!vTQP@{+0>#a6zKPRaq#H1mIe+Ti9-j z(fa^Al8uaq)C8HmO|>>|+0XPL7knTi{482MbGMhm>?TneXUR83*|k&gYP&}?C| z-QA%Ip7=az)91IhXUeI29*>gL>E}4Yv{I?ephbPsO8+3eX)zxGyJO_NWs+1*gypA> z%JQg5xiHB%%M&|<2IIthtQu0jN@VPx9C7!f(zrqzEi1L<^f)ipbG)rMC7ki0Rcvn@Q2drPg}`Y=?- zN=l_P^z|evZ|E~141y1Ie?j~rqrrcc+rm60B~$MZkfE+`oVI8!5Wq2#h$rnSiAHbU z*vT)ZS(ASGGZxC9)u)_d0y{)&{n&h}h=db%$hF?WID$?;u^LyAxhk9UF)yOAhIz_K z#q=VGr3x6TrBUASt`#FbpOh!Dn6tfSu5B4H(s-a^#fL=hWJaQ(c6YmWxTv>q2{bcI zse!VVtBY4OSeooS8u!LW_BpX$TJ;ndZ|y}Ml$Q9?-49q>K&Y+9l53$ealw@r~pYYoPGxbSyA5KkbPDcF82>I zadlzY4g?Lh>dWGy*HAnNvyF8Pqxwrm!X(t))DV)as`D-5>9eMTB6f~5p`8auv$&Xf zku;c*=XWrM=CSQjAT&69l~m9HNIson&5Phq>+;acFvlLs+J%UC*`azcf9m==5;=ED zbcq?hzM65Un=ZIEVq`WDn)UDyRr80|@{#dX18#ht0(;JHBy0_3##>}cm~8AYcq~VZ zpv!4^`tLB|FX-pz05;5~<4gFa)+rKG#3crJ)idQEt{#T1i%;OM`S3sMcxBfT68_%h zXJvKIP`y`lNq0MoX~~9vw)Q@Zilaie=iQ(6Y>W^2=ta>OB~c^ViT`%bVSCO`bT~V2 z-6f2p#>xx{<_@dnS?<1X#yuCxGpd@u0y6(G5w*8AK+-R#FLG@bR*>`do*IY8@$}&h z;2SA^$76_3|8$i`I?JY~R$@6e-4|e{o*r6R%cpYm>e%bnVY;|??q;4Yez(3gV9xKZ z4h7fy%V?!7V5)GSt>IS;$1${rlOEA(NJSYatsSms=l3LZqDm;WTS(+A{eNSj1QCv! z-Ydv(pxR=GSY0EfglK)mZVA=ez%)}2 z9(mkX_MyIbJT&oMs;(|mK5RD!aI7l=j}6dv6`5;Ev;R3!A!K8Rz~`y^e2fnV&N9T3 z2B+~x&$>!7rJI69O}yzvRVy&56>^N8Zx6AcQ_&#jIc|J-BPEk?*c4b=p{JSGXoq92Xb#iQ6RTqQjuBQ^wOQ`_G?_~4J3}~5ocm7BfJkly# zoiSf^C1gAj4rLWEA*^}IK;#-f^x=&-QYBcZ+k=d7Kpi|LLMW>KR}=%Nj)Ap?}04Blo45m$#N2-#}p$< zA+8f~a`pZ#(a(@ghbY8N%J+()zYEgVUbT#HO?{SAT;_E&p^opd#rhDrK8gQ@=j_EW zk=DyWysC6}57%eL1KEw3@naV3R5Y80k^C?s?BzQII-M?I{`*4bQKbSaxoA@JH zJtPQ_Hz|ZenBRoCwTeFOO5#W-FcN)7@?>}JMa9Ax>b!J|Syqiqd2O;{+;toT)J}7M z6w=6$NywGHUhcy`6x0L&)fs)Pw^f^g6=z9aM>&7~$p!+gC$e=Nw^RTHJ>%BJ8m)&6 zu6KGEOZ`ZKhIy*qGRAZ)(^#Lo)#Ws|3SxiC2R3?h)*XR=b~^y!+U{8@xyAODc(0Zn zTp4Np?EV&(G^4Fe+;mrZX8?!$yw1s}TYyilnu$k5u%!p1$X1f8omUx9h|t1Nj9M}7 z*0PQI2?$~^vhUFlI9;7gFUJR#>)cKIY~`Fu^1eT9tOcAN@PHZVgMRrK;+%bNw)Crc z=i0&XHDz$TbvCHFIzbHxlcGQ;;B^UkI9nF3bD^T5Y6orkdQa$Xi7}> ze~a(S&s>!kLl+}K$d$rTi=vT06IE(3y6Pz?FW*}2nQz($c+mNnfEbRo6>pS$aFi0Z ze5n)Aq#V200e7#aoe1pR7YksWl{fY-FC`2j@-K! z#vn^jAIcznt@RrS&3c_xbkWx45UGxI@b7?=go5@fqJY8{W`J5wRF?t{yg0Op)kU|` zHbiB&zYZzVM7>jr+&_=haprza+yQuKlfFo7F|d@kXz(8%*2U~#>!+Y53~Ij7M*a5@ z6;X;HVwg(!>HLe_@)gTm-9@7eSeow9{_QGiihb(uL(pdQXe|$TjgqH2S16u2o z9V^}#zd_m1?TJHh3jdZnzrD-&+;ziF=T!q|u42y8mXT`1-JqYk<2`rTwU`&kW0T!# z8jf*|M!R2`I@753kevT}o{kh}Tnl{feBZq|k+qk=-@Xoq&eF z=t>T5kYb z9GZcsq^&&s>nJ5*i6xQ)@9?67(#ver7Wn=q+WK67=eGjGL#AN#X-_U+@Eu;@li-!H84(=_XTXguW5 zK>OFs-!TkiENDnur*-EDI%=mv8A_<0NtTf8=qMSQ_xKK#O?3a#jWT5!I^@BgZ5F-t zKgRH6oQWjZB1PTi79?N0ZlKG~&>wuh?hqCmhb9yR@c=TQ6B=| zC{^h5`y`Cwfb102xmOaj;hnZQY}S}JKxBlj~^#__9SDY3T0$t z7|vN7R+9}TM;+T67eWc(9xZ>~J>P1~nhH&-739N!B|G$vA>D1NtKEk&3<7q5ue~3lTDnwEz0=RkleGs`=Ns3k>8kqQ5L2-}+gMDjX_M?XfqGIEx z0-0zeg{U0o-ozb5%00NoBsUK^Z>xgEyie=-3CW$+?@VAfDoxYJ9SZM5I&^gWEP{eI zN62x?>*%j(BQ|F(2K{>l7~uKcB=*mB)_7K!CzCw^f0S{?rC+FU?=}0^4X-bQf6>Bx zzxKdtwlr)sp@Efi$RPqqW8Ht5RAOtRQjD!W@PM9^c|3(Dn5*}DtA0%*SO>6|lu)`3 z7Z@s1)&DGhelQ6W%ki{Ro#vmxc+RXJAe|O$T@4VH<@}|$R!i7`+wI+B>fLy;dK zHX-gFWkdea3K1y~r8{Jdevc*HyH&F7Y4aX%w4YthEk=aa8}(q3C%0-(%_zm!9KYJ_ z^4OI6LXMW>|82o@9+nmM#<+UuRx357-^I`g+u6JB<~7`(pprF!m-WH2AZ<#s_&-|; zHj`&gupDkZ@-AXIWp>8>A=Ah0wQSCo;H!w@1$C*_CIQheYjlu+K+wxe+mfMRF9u!j zP2>@9)H&y!YXod*eTJBbqiHk~_V|ZLi2>eyp8*6sDm`}UB<+CeLz!3{^Y^3d0Sr@& zabOSYwTt9?naa2mh!Gj;kVn+v5A(PT?Kc{3*uNOosnoS}Uvy3Oy<#hnS>#Lhz1AVx zouMGf73S3%sI=Od^o6OpKHAaIobN#C9dKB0$}*6MwEBrNI3cl4=#bm~XJ4s)*bxL$ zBl6Rwk?KmewjU}|IBRU5G<@Pcf3x{xiL>NW2|g44v*x4ppKFH<8T`2t^sOqwRph~n z_#$b*NrsjB3_$rW36)~K$pOTHu`wR?L%Fvn)ilQqv84=<_53wt=Yd7N*PK?bPFL*t z*G(R4BSV!vJG4}ZGhAVFK7J&IuNSNFrg2t^(jRvfesO;my^fTPmXeR>wA;>7{J_X~f|`8mXr-s|({iiUc;C^br{ezCBDgE9?f5ts<7lXel}uV+!{;4YLPR_xC^ zBr-JIvfb2{(Fh#H_j6^EB_#wFM$o|Dc!=xbFMfrKeT3~YrMjnA-_g`(a>l2eIgz1^ zI|(mJ-6S+fpihh2dncnye&EU*>#&rw{r{mkkCATrX>a_ z2jpZ_{;yTc6410Vd?qOh=l^gC{yCY?7W$lh>wUk3M61UY*+qm4!N{MGoje*Ooh&W< zB*$Q_s-q%it`0K{(-pap!uEWj>Fs~c_tj=GgHb&wujgf^vG?`R1aQRcy|XJxi^yHt zpq@{cC?nnyij(L4jl4@xn{@0reuU+-QTKVB(qEh9!~UmVcaR4hXX)q-(5NmSz|K5% zc#YwkSX=q@GOwuJ+8g0pD;P_0rPFEj4kmhjN=~8VBwv>+mMKZb(+9AV8<6JAr=4T= ze|~VM4X1BR*Wlb+3?HC+@6>1$_>YjVjeD@4<|^B5++qF_YQ-}*Km1XojELlk5xI7* z#g_Q`aRrl<dhBXQ)$? z1Sy&u2{Z8YGgpw&RS_MIu|uXH zZk6_01CX#Gfr8sXr!ov1TE?a`MchS~C#6iHlU~csTlG*V8O08Fb>pLbFxL88o0R># z*8e|JORd&Eq{8%9V|t#uG7Z|38Vu#j>-PwR@E+KHrn7tPZW)I-c{O$ZX3eguSNZOA z^bEZ2Um(MIH>c1^PEe{g2n%yry`@t>raH+bBh z>AeCxwY~O4UI^5Pb7Vg5#_!a)1S1nc2I7?nv*Ugr-lLou;W_>6o`!KSlb`2Um+v53 zWWqTZQd<^w9j9T#&!6SZXt{aqk!`}CIktd+1X%!oFf$U>&9d%QiRmC6QP-|_b*<&? zq<*^3e)nI0$KL6LVjVWn1RjNFZ_4gx`-Y%__CPUn-wzc~6YdR2w*GhBX!k$=y1sGe zQGyX;`O`rCe*U^{sglJCfzNn)X;u=IhGa>{o-`$pE1ok@LhEn$ry$_nv1hzu)br

6 zMC=XLWk4}~o5cozUcH~qM2zNxBI3-hw3}DdZYG1Av%a6orn=#deF?me_ zR(m234ofu^JMGB|6r1ddVKMN&Aow^u9u}*(nI1#KETzGtAQLGWVEvZlJk>lSWts(@ z{wt{5KCR26i`-|9k8yHKaQMrg(@nb-t-%{{*yPiP1jI-iL`38`JU_eocnANuvWjn{ zj-KCSN@i;1QFY2YB$r#ob?1`pEBjx?j=8)G`0~4RVWHqq5Jz~s9S!j(5IxdpnD9N2 zOcu2izI#BK;y4V|(wJEGj{O#Gcqa;2Q06Gh>h|;OZDh-z$}Y}v+A~t=p2sYU5)8$L z+HXB`24A4Dcz}g1u0luH!V`bYr>hp)1f!xe3*8qHPXKCvwdDmP2{a3F4_Wx2##C}9Rvyll`W}6_3c-# z<^G>*;Z^!mX&;0C3;~DQkp@THoj;*~C&Ko1faP0dN_TE(f2ZzJwW(*v0L5i=A_(Ts zyt26W$zghjhmo&A_h&#^EsY3mKZ z@s|`I#*yvq95XL?0w;!??TQcwq(xll($ojnVs(R@qdYE3q~PaHOXnIuwB2uWvdCx4 zQHh`pKn_Z2N$FTf2PW2mvYi%3b$*naT?tD=47@G(NN%zcx|muMl|!!t3_mTG9DZ48 z5i(jCs7JKZu$N#ow?_rmA}R86tmHo%nEyRgj7~G>KAYuvpyG-xmia8+vudPE;|yIl zI81)d9_^6l>#WrRePleZ|AT3OjAKAjra^7D?JyV+NyKC9i_2kKaY9>@f#wwX%^M&ANdlhq@82; zY-?|nmTrNSjIkw0xl)#x6(JL*#g!XG(g+x+ckJL%iMOfkoj1<^rkCK@_j^d9m`&%@ z_$o$5O3o-4Zf2@0t(x?m!(?X1K;ZrbgM*E^C{%l#8l$(YarMRkAxGR@ol^x@1ZH3O zJ;J66Pny=4t(qc63gI*0p40=FH!|a@c+hW|x08A7pkw(vH*xB>D%{PSEr3lWb*{GX z;4XfvTpNVJ+b#`DPfz!!HWD_~JHPRSdNcFyo4^(3ESowRdlTur8b(a@mi#(Fzh!>6tU?=x)pk3?_o~W2wbEbZ z@aE!F^f5#sPw+C;91SO4i-mTIn&N=X?D2>FIK-4qM>1=cv_h{}aLva7WQ1A$PqU6n z$qSHG25b){Lz7nHGxKpr!~h|&;8S|5e9GtZKH|B?QCc?#Ca=e>Gv}}T@l622p=+Fc z3ii%yi!rWBWz(1ZjeH!#fDl-9&6(Q7!Hjs}0&`HZ^)gQ|R_Y=cIM%aDN5;8mwD#G^_e)nUBmJ$|H zwSB65gIF+E1`QoLCLb*xTk|mNneewZM<;?$wmXRG1%^@W@I8+zR z#Aue^@%b;c$m!=<66fORJ3tfX!O7Uf@L%RIwB(@<{oRlfkMAG!yDsewBVrW^oB-J; z!}v6m;KRlX`OO=?&?#IU9Bg16^o`^)+(b+MxpWL~m{(gSV=S`yp9+Ol04D|Kk>anu zU>w6YRMT?xdEkO9?>}j>5Tn1LZ7R5gW9AAlId4IxQ zDZb@MjE%YRz1T7FertI)Txz3jJe@V;@>b{(0_4J?`+ zaZtC2!b;})5rP&7mJq&FDc3U4#bAv7P?TjaOi{oSK!K>!vREQf4J&M0|jrSI9$%eFfiw* zg-c3S5@Ag4JB;)LTl-sW_Q@vScXklpWtAMTZytOp3`uZ+ zcrB2a^Tdzi(6v`V`Y@x3>99!FfsA@1BEBrn+}Q;^{Hs8|>@<-~((mA}XJf31RF`J4 z6mbGC&@oF629=2$zXL{5%iJ~I4IexH>qLa9#<92(Ss?(9bcZ|&BpD<8ir^BU137f7 zJ$dO6hrH&~{rFlcIE9IHBTz(!p%kIvu2ZAc^x{B)8symY)1cIcvr&q=vM7GptGLcm zU6p~&%J~kla}?Kk$KD`^H0li2igz}t=7xaMEJ0zD-rNV5P$)P3@!JP#RM<3HuWB#y zz+=&;#8t+)JakmIBh$I?A2lgI;6b>d=&Z9Vo~2o3*}P{W&1JCjZn=GN7hYo3>D2Vl zVaB9S`R_#T`{NF>W>Hh3SPpRw8H}wbRMg31I zJcYWqNm=SPE?uNMUy^S(d3);uCU+H&ClU-;;0X;4mCNBtWS{04?5PK#i7Dyp%j@Xi zKRmkjv|CK!-+~*u+kL;Bwj0eS{!LDnNJL}5t`-laLDJLUMDx;@5W>*k*Tf>*@du%i z%DD=|LRw>}2PIgKT)GzhV1Xaq){F)iw#PSQ>s~LIYMQPni)mPWCOZ}VU_}QhF9-BN z#SyxHH+gEgkCTUP0O)Ow;2BS@QU7a*yk&f?vF&x=1bzRHD!cpH(rk~fCn%b&-s{H1 z#>VD&v1%D2FZZZz06hQfOb|{UFK{cOC{YYyG@Zj+QeN)5VjO;D=sXnE}z9DBBWeIQGGJsqWxGDo1gB5ECA|Ay{4>I@&gna@m~C`Hm- z$@7g9O~bi3WCK|(vO>@DkM(7?`)Tbt_g}JlhfcDJKx^C|WQl*3PP@1ubLotc(=B1%z4aIX!f~D?Xd_^7oKkt%bAbd^8~;{YnJc7H32r7V zxy{KBJ9AKn=f)>d?z?wDf)3NXR3t$g<=%*j{M(SD-B*#ShAzpsHMhbFFG`|;q((AM zMG}%eczTH>4nxLX_KnB2r<$rnO-Jef0%)rbngb7^pn%Mi?bC$+`SA{k1ndC59a5y+ zz2X%FoCs5Jl_K&@E$eLKke2SZ%agymhf=GNB`83j@T?$)IAxm*%UkBJ$3+qAl7{fN zMy$8xi_)QlHd3PhMayW9(`wrg4mjYESOiF@gB?gfREMnoEJv?4j`L_;O3bn;Ye<(c zC1o7OgfeIMJ3Y*RTy{&jmOQYxLcud|vGcm9j7( zQR5GD$jeRqpb53k5P?5T9oz3vL=ncPR;YK|tYA(2CLqa3*AH>p=8P$3got4+4Va}3 z3e$vFtXFGb&{WI$P4Bc>l{cXV4>ic5{4^_Fds;I6^l-JReLXY$_j z-RJzCJu}^1wY#gUR;`7a3K>$`ltn0#+nD>mV0Olv5pOuJqazbUI1J90L@0bw+?cM% z2%^ij{m3jm`=0mDJ$=up%9y0Vg<3RnVYR{Lt)$Vns&pl>Ipy((9q{wM=t^`j7Q-?w zq5bq&DHbT}_%g=iz^j1VA*$Br6#N2tubW+dgCqI8aR$yoIZv&E6Cyx`786NokFG2P z-SO*7v$L+k81|VcEaxvHDQPJpxDHXR&DNXY+vc*Q!1BbqbUA7`A$^<>p8CHJAX0Ur zW@A0iNxgoy-=ok7;(yfpD+dakgEjqN{~vGag8E0j4JuE8^oT%dtBI>jaWX+u(_+_h z(7`=%g@kNY6@@8{KMVt*@cF*wR{A1X)V&_%RMHmM)}1an41>eB6CJI{2>@*BR0k@% zr&Uzv(m3D+m?|r-3N%m>zriW%ZQKb1s{%TZ6W3KX`VK)urC3_q)P^>$k^s7GSE***N`yAlkS5 zQTO8a9Zc2GvBxgwUCZMqBxMfjx6suC$`q9vibiRKRxIaQ8_uC#cdm~MECpAzfSH?g4UyQ`Y53jjD z``=CZHUVkhuRMs*%IB!~O7gxzg?c5iHzfm5Vi5#g}`pO*N_)Q=R@Y}Ib1dha@^$jreFD9y12 z4#|D6grQ>aDJ(F-Ewx&%2}pG7o!X^R2x3tw6AgUpGoatO;L$;T?yD>jfbEAK80i_r zx%zca@}B$h(dwW0aT0rnVJao5`*!RDcvQHm z6Xx$EKZ+=`UyNYpgsCN#8|AaVD^t7ScR2c~-H{9GIO>spriT3>g&WK2@g+3eLc(jkK*SA`EFmI`uci=J2nK) zY~@sYP43NiX5z-=3idGNun9e^zOCS+-{gm-(QE7c%KWgs(W3Iu z2KoyKQ8LRJhiW1q;fDs(3B#++&Mga{A~Y^8E|7w8=>GnGj)yB~ElPe$N*L_ej*dOV zFMuHRcQ1*_$%bp}ijwJU7LK_krJ%L(qr%~^l?K)E5%1XkIWkm2MuwEF?d3n0C|H4# zlLi>tDmSlnp7}J|tkK^N)6b|$8mzJB$x~tVf)1%2CHI3*(9awjUM-_YkGX_NstGth z8U%nBH_P!01MJ;iCdzq_AECWMTbc%7m&1GXV*Rda`^!PMJA+jD@094 zw;znDn+pm;L2@$?Y1l3x%}1|?bAzdDKIh|Ue~|F&X8BITOam%i-}XA>aQv>f2#zZEdw)uJ!Nh6XbR|MT3a3 z`o9;_e`aqMtz6f0Z_)0s{?jE^pdQk8LUv$%?Z)AD?5?u0FeJPa-Q|zcOQKBQG*dXoiDjyPs}6 zz}GPQm0sz(WaV`so#&7ikpW4OVj5!I(~+c*jsje=fXvO+a1hHa%YmzV12AhL#I^Xr zwp9)M;oMs`gir_~(QbI;SxdcodR{*s}mtjgABjC9}GA z-mgDZOwb=MK{N7#SOje8*A8B`+&4FD!5SMvk8!heJbKQCeP}-`186g1Uf)SXNdI^8*c^N6;jO zP~pq}umC3LvtEu<)e~#kSc@E<7wQXd?s=4)p{z830!*P1*Mi-goQMb-&6VS$L!X13&0F>ng<7! zm6hKb18F5(RL~LRmEwmhC7ecT_HHF_o$|tjNnw^&Wo4M1O1yg)`|82jX$g5Wg-lGE zF6aIW^CoJr1%B(CeoyfY_vy$c4T8=DZD>pCdlo`nkqej#J~Jv<-$0e^4x7Tg+`@r4 z1O=W5{Adbe;OdMy5-X-2D_~QLpa8- z3#lppPG7Hwe85ww*5F0|_<2Aw+400ujmsWY!PxnGEtJ2n58mTT;-&6@Q7rHH+XOkk zV?4XoQkDK~H6hoeZz;|42)JKsPy<6(lvPbvI&F1(Qn=I7`>})6P0HV8qkfHeH3>35 zYPn6m027{3)Wx#Rc7G_ljxZ<2jsV)4wkX=_?zBH+>>t}c$+mjq37_uiDv%20k!m-` zpzqd}9lyfoTLUY#{uE~o_B!z19NS}9zu0=Tr|V^lll2wLWP}MD=4T=WMB}>MZ2zt6 zcwSW8^uC~#l&U}lN=Zl%Q&NVKOC^KkSCTkO>(h8Xz^l8S*gPLkMQVNwJM3+J#`07X zNKWbUow(h7iQ&2A{6;VrtIHR=f7kt^PZtKzuIjiEEQHNwjuiX$>XccILeP3G?fGyn z()|IBb#5~Uk`H2Nv4I#nlHGaB8@?`i)h!&K!*yfG8c(CdAI>5442}ph?kz-YJHn1RxP!{B0I6Hw&)#}G1ZwbGf61-1r;h#chV&h%qNq}vUUKOfVzTzY z=$Qywl`u*@10#clA7he0#-pzWzi2#(tx8BB*okraoG1vQ5S6HKS0cf{NK z7n`k)y!w?k1N016-`k^~E7?W75641u%bEf*y^^BquWVyCU0Y7|l`Ny72^=?DWf}Iy z=jl7$N*vdl1Mtf8*MR{;Cin9SnQkXJPmV?w_BlFTfk#(fnQ2n4UuwP9JQrt1l{H4tK!mKeXrmwe;?i zm5;I_$Ev(AsAblZU+~Miqf6fUjn@`3?idC6G9yxpX&`^d*`)9QkOLIrBe&~GBr$!u z+emthy&Jh^)nv1(_@9V@&9gw!kOw*u7da2h_tG)L`DMRm8|bmZv*;;gkKm$OzVkPM zQl8T|PRlP7U5T>@3;cKh6Ua)<)I8;i{!vcuZ|~ z<_o9zx}pIV8B4dY3hIrC5E&6Xw_d>8`@tmvD-)z%g#025P^2ri&Cnw!!*n#*4^8t zL{*W;6$+H_TAMZY{Fwn0tK!b#;1r!n9wW>-x@Nv;+z^d+2iCk78H*(#K=uT~bRvDQ zH~^Yn>u8pQGNTseJEeC|DI(>~f|}mVsup2Gllp9<2Ln`-rN2^R+De0IT@jODWFSJm zNP>0wr#+V@TR6@yw;YS2KUD_J~rj94MU966D!@BD}8+3zdzvrlL zu7~YlNY#Ywc-AFD@N^CLMO8H}4RJ$OU5EFwz$gWo`(Dl=J z!Pjcq9Ho?+(fA_W=8o?g#kPGZ<6aIolwDXM&6~nKe`={fJ zK&D%-h_iL3;JkwE(ZUt>UZa&9`O?Q0rnbW)+UA=zebNFuXl%nKZZZeyJFF{8itiVJ zZ^&^f(l6Fuoy;bT`x0vc+k=_v1c{~lZ4~}KYsuYCCZczbBt|Sv?ZlbsQFIUaAUGd$ zr+%OM;m_t%R0E2|K*^ls)UcyXAYG)rqT)79bT{yp7Wds+nIEAC$&m0GO*b)VS&0k5ep9=TV65V}W6V_j?vyzk9y6Ef-{y zcAAktfKrCl$=&;QiM&j7+(=H_<1*tCWoDmoPE}h*qGl^O*>kU!iqQ(kLutaPcz}p8 zz((YK#I$%kTQ1?0!y?WZWB8sQk5#jG+yYg-weHt=W(?eqJpO1!85-E;I_Ejt*=QUL zMm?!gU+|b?*55!GZRT3X?1qrlSJCpfu2xl z_cC4CkARaZPy5lj4GmU18di*|g8sNbPN0~Ve7ubnCbQF~H_f^83%=LaEGJxIQUKZo z4RJ|Rih*I64;yMQ5#KA(%L8E#GJOIU8&p@z8#VASWv<#l$bK}9*_W3Vi1vG}iG%Wi z53ijpCz#gt_Xbt?;B9w)7~3~|Ka{G5x$6c|q^}w}G7`Sj8uXnhbu>nkcj0uJof+pC zP)@TB?^K(>%oDwd0-E^AnPJ48?PT~=j%z>ZOs-f{6}vf>3vEvqYtcWKEcKe62{DPx zMlZsuHdKYa39fJiyuUM@1Iu@_=rX&5L+BMXI_(*}L`Y-!cOW#`D<7TszyS_V-Oxh` z30Zx$6{}1h2dX6RzwUgR!x_`U%sv{gt?5b)N1FUh*T4Hg<=VRu!#6ZA{eofK9Ql2g zZFIbVcyqd8)`Gi2?#=STdfIe83Ui_ObUyaSyRJB~;>yRr!XIX8Yy8hr?Dn0(<8_~o z8F=k;q?-hcfTg73-xsEFq!a3ZZ}&2Xav448ItOsA57qhv?cZT*N7-*z23iXnxigJC z8;4&QR%7Xm4l$)TFNV4stX967(ya_~@!>F84Z-0wUCESSz<;6IXiZ+RdYJCEW0VBa zo33WolvS3=JHOuun36Z7Uj2J?kodLEw&&g)#vPu%{Zh zq^Es$enElFFN5PYfVOcwg^Cqo@@Wr9Lmh4~boxQxc6V6l8(J`D1E3NR?JvGNpNl2f z*g&`*#`D6HXx5(W*7MBx_yBVCXbAWz!@z zySUu$xj>bN$GoDg?~T-=9iz#<*H{@<)nUC8_Z$)5TVz)C77BVsN_{z9V8*96L1fok zCO#%ye(NJoqXAZ`I6GZt-zUYmzMX0iA}%f*mjTg9a(}=HYHG71EBqQk-?YH6{8T`d zRf+-XH1 zq3Y4?mYgW-RYg&h=ex`#j}vrs!GdyP5cR0mVEzK+-K87ceP^iC`>e)!A(xn&h0IBH zlQbSr!dFt^8l%wZ0+l_V7!JD)M<523V!|VfU9V*QD#2v<@B;~5PZ_n@$I_fehv9d4 zM{bApKj0Qv7}i=1iCIa+f+|{R-Ml%v!w5xEQdplWSU}|$V=aGjRfMqJb3Cit~ zHTmr}104QxtS8B6{)$q#v1_r~QS$4!#D6iu7Wh|xVr?;sY^B*a6ahNY`TEKpms1{j z`2HRi8S7z~E?n+xbt*XU-Fo#Rn}S`b&-Zv=Vng!BfrAj(CF)ZiDRf&pe`HMl6K-7r z=mS7$#6j1$r9$0)I%0fAk{&xwl`}Z3%jFOQk|ZHEOCt~Rj}Pv;&(~^YkxT@f%&{Je zQ$R0@|M;1PveBwJlE3~y_*@fylOW`$P-*HiO;8W47AQ6*%}*p#L_Ok0zUO@2?;U?K z2R~CAH`x~=bm%X|G;cOze%xXX5T(yZn5+EW`C?->PCLcy;tO-JX2N>bI=s?)gu#G2 z8@?pEJ~%)Q**JDF60)FW9$x?|B}hg_Qqk7rnohZb6nVigj-#gXeZqX2R{J6g{9TY4*xjT`1K3A_h0O6;F9B{UlNC66As$+cJyK4h z>+Q>_M_-YDA&@qX_YCn2(gM|drOAF-^D)MAB%{wLsWUnFIwYer5LQA+vcVz`T`8YB zniYwC-Sb`h^F`{eq1?lFU_)9%^XFP})k>oWV^z9Yz2hOJH5IFTJ0_FShvH@Hk!?Bc zXlYqlabZhX{f#6jJ9(J)y16~%*DYL3wNv(bW$Ms1(F=9JVs>LZG@(5-7yFjHfEDhi$Vnv*gk*9Cynzl7aX;n7S&oM%&gjYBzzI)d#$`mnuJfxn;-H8mARd{BS@?PXCXU^pgc@CKQS3YL04BmM1f%M$1@{tMM5p?A+yKgR|3ydk@?; zN8x2J+0X;tOO|0(u^o5*OJF?xU0qqO{?U*^CIBP`9DVgSeyaZ%XzH zkfApt(Ve9^<&X<)sr*hXuCkQXZKhQHcAZ&_hc$a|U>AW0umUC~Tr=VT^d$6i`l_GH zfGCeghfUn(Yy^D7-HH_@jfS$Y_8Pvd=Y-9JlUR(IIu)fhI4&r&1(XlFeKS0l!)vyP zWF-LOnL9Q0Y_(Ak`ZK?yG6$Q!-w`$bLO4XykI^)M>!9p8}W5uhdqYi+na*Tv~U0?8jT- zCf#vQk@L;*SonBvJEFE_ON5o>?@?6XpD%x**>O-|kk_PwNYB))@$pyh)uS?(jO zM6_lv71c|z)|UCo_en42cr`BZ<^GS>E&ASJ^--|jrpVkrG~t^UXF9|Ka zycSK%UVXvSm6e>5<1ygwd|eR};=k;=o0PW_jUFeUb6q|RRaJ<1>E2?^cClRVx7ju<7Km)Jx;n*kMve-N3nI-rM5STMn>h!+`!!*AYYnkI;;mM#HQZI#z0rJsWi zl029KRJ(}>+$vF%5oJ+H(iAFJ|E2l5XQ7=y1vb*ctK!G$k3xfms3#vC3m4WMEhq`) zr>>`cKNaZ(z+AQiR{(rya{=F-pv%MIfBSaTSrr&P`oURXYZQ`S{9FZ^%4DzHA1{P5h<@#cJon6!p9@v3Nfs$OfcmZwaP z^-AK=!=Eaak}aufjh47=p8X7nEF*lh2EYZDrz<8`sY@H1(MYV=oN(DgM<*7RlZ`4+ z>WzB%I6XTL$gDq4!rFRoTOiok{++Ik#C|+slkK?Toosp1bhVu_o14WR$G?Y(T)NnK z`i3zY{@PT4Ah^S1!jr=C_HgF0QYpxGK5p~4E)e;RLTbooz|0A@^)*lIWTl$8VaqR> z^5d3}`_qCb$z%b~Z*&lj=Naj|^Q`sdG{fC(m*r!f6mM+vuP-u;1_iEJNB?na5%0}i z#odUEm}o^=jN~eNYrGB*>~hQb_ruO-3^(;w&jPKVc_^hd zGO98khzT64Z)byXAU*rMdVPRj=Z@`38Zd~D{-D9Pi-L}29TCe9gxb_ndjOwla z-$G8llOT`~0WrkF!a}7^I|ea?OgbCbPsz}Y_V3hFvA^rp^+lyikGlGklFm(*fFwU& zty#q$#!0BD>+m{{EYxn#QAK!f=EpkjmUTKlC$-icr}oyFt*InL&xI&I`i~;(3N)IA zcgBDCaOUfM+t4CsHR>~~93>pei%vLQ7o`qXc3)wy+XE{tilr%zXAhjX^T*K}~E$t>xONKoPp z(lbgMzBe7sZZ1#G*Ko{z&W?@PrVdWu){yYm{E8kkWqO>Lq0>|w_@hBF8duuFD=-XX zR&3zf+pQRxTALU$(PMgyo}ts#8wls30GJ%y@$MK_a~&`#uTWGIxPsgHbftFRH6ry9 zQ5)C0E<$-TnNdFSzL9mVu^T^xPTfrNTroMz%V`3p4HHfEW^qgtvXX~(!>_Kd$9Zi# z9vxyXe-AF@d_+QRekLAew`B>uQzW>o12Vm4cc`!pjv@Q0mYYK9$IO_Hnh@1%tHb8f zvBbr`VXHvbN=MR59o1Hj>^xIm6N-?}}JlmFSTl2di+rN+ndFyoK! zd!h8_4oACremXIR??~HEwAN&oH0>L}&g9SKEB+J_$HH5@V*5t;POzq>*O$Y<8MhHR z%yRSYp?%*>$;M^UAx$;)!^*_3yDu9iC^yE6X7nLb-*U$^BiYDMQUo;Sa~N3ujx1oJHX< zQ4%)W&A{vnCG5v;iOiWjMfUNG(IIhM+smaG#GDsaNNhfjm#d}U7Rk3yTekZLZbJ@F z{F8D|0wXcX1_1NPB#w`0A(lS8hw+OJE?c;ioQ0IbEH7rd3UsdpCBo0IKEUeABR&Dq?oZo^ z-AxLmn8SMRkGGS{lG-!Cg5iIyGrrAK+G6FxB!78E+C56TjAj|{F?Hvto29qNP{Lcz zybx6FL7kbpMzq5~qkPkW57k} zoSgm2lzpE&Y62mQXoKZRkaT_CRi2&5ejxO^6iKd)@c^Wyk;m*@lpr5mhF(Hcc0|yg zAQp0)iez@GBPll}sr@VknjSP(#cn^apUEHZUyal@O~(t7%F3v*`eY{T@kI6zLY;)0 zW4=`Cv2&u_TOrEKX%Du%)9mj|3EWrmYN!99&|i4nE77p~lHJRt}g)L-VuxKgw6wdzdX zG0G8TDOqpz+gv%Je|?i#oo=&$1t4#9z8wv*$<#MA{23cFdVjfBPZm*C#aII#)fpXm zzPLz)_Cb^Le79I6O3DY-l$$*03H_Sl=-biy+wO?CxTp=J<1%}LIrztW@-Y8iYmv6T z?qGTx`@eF&9Q(rkCHa9;N~8aR*`UBOYK5pX_L*I$-rbol=>*2wtvi-if~R_91*$fR zv*fn5efzu>&nX-sFrCPl ziZEGN=d|Vnkn^awdNS(Kt&f_3Pv!QPN{nkXVk?ak^RLIFzPc70-+E_zKG>9tlT%jp zxq!5l+-ojcz+p8gOte7ZZG)X+nc|3SMPKbt366>qg*Ae^AG1DsC?{1XPWD=hhX)1~ zbTv`reMA3j2BKu<<;iT$2PmhY$EU9%jLqbTrMLar0>Y$O*So!n0`1fX*FJG3{XkD7 zU6FHDkR3c(bcD)5-Iwv?=Z*1EU14mf9<8rc2V4*n{b={{R0?PbEA z@t8e0f8un)_Lt2OS6Bn+j-6pS>al%Q5iV+TrlT8qH0Yeob8ylO`5P!IhYzVib%P15cAE_*xA$M+Q-bSDq&r87b8z(gJN?l(DrQ&}K@-FhW*?(=-vs zy!^G&pd19dNmJQ9*m#yDOLQrx>wT+A${zz{WU3Z;rCOtngUq&o_)ygN)>FAg!F2J# z#&2F%^$l&1H6Lf}`a%B7hJzS2-`584v4hfXp2i}j`a2MvY+JQ zvfcs)?(Xv5xb?1MOJTFxVbUhJ{!PI}C|Qcj%2QQ%4&X{yzASVy?B3M&Tq){!9HJdx zZA!?GXoI}zDAHr{n3Sy7bji27vQ-yPH(fO98-JG0=1n@2<$^0f&>?RS(E_Ez3`f=G z(m1_Xg<{P|o?uX^V)_jD+8Qi-G51x1xw`Ba89L7uH+}Y0OffG_*Ivk_HJZOSTpQe- zZC+}zDmT-mPo9?3h46czUaE5dJj zo!S8B@dircn)Q>aP4>|J`r=$T?}GddL{r}`ser0Y`t!HVMi_Sb%MleD>m))*RWx}m zbYG(rei^dwUl0`t8A)HM$>&MWD$R}9Yz6agdGkaots~l!W=hKzyOvmfF^JDZdF`m$ z?21a+Oz$B!TNgD0WMs1IJkM1%&(Zzq{DLlVKO#|9+(9EKyZnx9z3OGx(A5ZO*X;4^KY4evtYsIy-p0U7BmJyJ;|c9xknM z__DJsjP9NSwuy#@oNJS_XK}m9Cfa$={mg@Qr0a@CBt9{oFIEB)q22ApiV>y>-H!@6 zUyGP}?_JD^z2H>eA^DEZZe#h=&n3HWzmZupt z8vit7L+C(Hi2tlJ)2{i!2Cvh*vR6yT>8(??bjCSduSqU3l5c5lGdgu)V;#RgaoRoiY$yB>;&8 zMY}{`i?ZfYPg0_A=z3M2I!KWddDv+IR(fmziC9ftg=G>>tAbw!zpq>oR*M@3zBK?K zoIhlN^{ua66dL=hg{D8Pisa+EM)E<{-qWE{-TOPg*Ac#+NK)7JRa#m`5E@AKn{n2w zCSdtXU6oIj)m3}j12DNMMdy24WW{B9MYYQXQBO4#(44-_wqKbnV`9PllKw+xQj9V)*QBGw%_~h3=338XPTMDWVJhPEK~+ zM)z-QY}CZ}gN(25)Oyv+B-m;|?IlPf_JWae?50 zcpuIdt-y}Gz7AF5GIe*00NPL#xY&tid9vqh+Eco{TYMeH-%N^+pduB$E0Vw&f7%9w zGUGH)%|@S7Z?r%hhJ`N_Av?$82fnuJ2wf&(#MuLq&<}nhVCuelnQD7rqVjWRMh<66 zw3j{JtQ;wEnu^Q0+DuVay#IXRkSJ(lidECg{CN;Zs?O(!LR*n;zcZqnYSQrTBe_PR zh)-c^3CF+Vtoy#paM^LDA&a$;G-{tZu|svBmGbwRQfZ~#k^B4Yqhk<66x^)KpD4sF zWA|67k!UU9eudrSq1wHv?IgLY-O2WxgZ&vkjb?l9u?P13of#jbB&TrYP}E^6oBTNF z;`cLOf_Lp{mn_*VZscguG=9Gytfu2cq@;nMZFh#Z84!(Q%4#;rvia_fe>Ucpdo{8h zYlgTp?=Wl_Wcl5dC)vAK!LL`E^3c2+<1J_IbZ7sX^(8&_NV85qH=};Qi2}p2> zH{NL|>Tb(m)e#|O;~nFBv(Df#s;u#D*%4DsufA?;uSeF1b*AJ=-=O!)it__q)_7m^ zVARZA;SumIXAK8Fqfm+4j5){mN7AmzoO*3tn1kT(G+V?C=5=3Cx1vj*_@WO_u!&c_ z$KCOdkx`MLihf~ff$jpigIbBl+Y_+_E=PC92;gBt@>;^7ZBXFuC!-*0Vv_YvL+lns zTM<3^8nD*K%9Q0@O>EZ?+H`_*Wq8?#Pbo#DhtLK!j0e%kdQ{~rm1s@ z6cY<8^+sKg+>bQbh0`)R?d}YP^knx~$FEgkK?UaD_G?myIsjhgTjj(WCl<%W(J~Wb zj1h!_-gX2^N7nl1068XWdpp19mD`e=$&{SywSKwYD3S0LjNBQf1~5HokDQus0JG^_ z<|s?n1i8&utQcHbl^u$FPpe7ZD!@R&q#1gqoIo))IS%`qTq6*j6eV1cDycGxiq=%l zP}7`J@8d|xRrM$zEKSCd$?f2J({FRn%`8el6Jy4F9LC#xI^7}EZ9l!8aOXJk%HSs@ zC8^6B%rNUtmBje@a^}MXj!FY$u+Zoe3s+P#cXb-Mk zSi)&v+Cs2*lHMr&;HOpfcXMltu8ntr|-={~Y)@ zG7GxsSbaXrYn#+H%^S;~y?-w{I5_C|{CE{6K?Z^<`5;8w6DX;C`liuf3cuz1N)G}^ z8ofPTvsvzYyD!#KuXbj^iVZ1?DVp}%C#n}tq~QU@ z_%FYcNW|^dLpHOtY7Hmh4jFWNt6?+zg+!+-#1KOsPDer@ot|6=-In2D4@>)0Swr1;^%YVbt-uFEJ4c94#&U{3~FLgK=Px1=bH0 zhkER6J#3^bO4j)TU#QWKHtWPa-64>8L9P(P{ebn&*xhclbAShdPpDMrao{}jSS z+tqKo9KV(Agi&^o@nre|yXtZ^H7($Cyx72Kan^#)0|f>zU{o6oh;=sUz-C|W{`YB5y>c7AuY6&gZ7*+c*2sSaq!lm z+VW-DWJozUQlg^ZKw!i0;k`<&=9v6^lG$0sR8}vT@2VmvOh8;WUG@kg(deH`XTCC4 znR5|$^K83{)A=@PlkIQcF1yb(x!GJU$LybV%PXCSGVM{o+t@%E2z2A7i>U=QUFkKv zVUd&>vJ^H0lu^sR-+BG!NkvKq#mt`LoZlYodFa0fZU%y=Qq(ZnNM$uu5%#89gF-*O z8NpXM@)TU1W)*RfQl{%|)EHWJMK9YgEZYEbC98>eT$jc%1gnA5A7}&(5ly&m(~l$9 z&US0_dYLPQ*w^KJZ00l3wpob%bd1Fp)2Li~rJLqI*Qz&4H|vsDZdGT>kMu(j&t&8t zTXi(c=KKbTa7r{1RU}`cu>`k#eM;9`Luw9da%Gx{qp(&}2s&TqNTeu}R}&{M6xHwU ztzCz395*JKSqqg=ck3)^3Z~7({WO~_qIHCVhToG=-U#9ED~YmuF;lYE#62qN^D z1SKQfY)pkVP1&oprmAl^3#QrfcbjOs+Di17)}_BW@2T9pVR#(%f(!w z2W-auyB>+f?1zPOazcz6!VpqM5lL7UT$2^YEGD>u#6@YJ11OlbJ zv9bIgLBUe&vj=~fwS9NWj6Y%}pVTg5X6gEKMHYM8bqON}si>**R4P=VbUpZ$)zlJF zQp7-ge{Xaw;`?z$g@s7mJx7D5`Sj;e#jLjD%xn|Vl^JuKkrAhs+^!c97!4=9x%@U6 zCNp^|POz$zl--g>1I$L)T)DK*x7|Buc9;!yxe)|`qSKu|tTdxie?~5PdI&DE-jx%P zE!QJ@13iC}5MfjgNLq~K68E3X6als-KGW}cD!9DwsM;QnWoxp1ELQUYG6jR)?dI4v zuXiOj{cMWqK-2A>YOJ5OdvFnB^f8|o!FQGy9Y30`W^%L@hQ?3y>h{}tja7L>qmShZ zzWq5O)&`~|7TaKRw%}6#6=?_@knjW9ybSshcgHI13R zmnRiAp7-Y3+W5}<)ciXS^e~c5ki&(w-3(Yl3~F63G(j|ZV*MfTh`r|s1YVDcOm;JF zbZZ-lsf*A$QW(;mZwe=%sxs7T+l_o6Nrl$#rI~-**>U=z+AK7RM`>RQV}i(d5XA{} z;%u@wBTA1`hUcC~jQSSjS$HXn#K7HAsxt*%5xcv#=Fju{l(yG-ww)ZzHQ>7MSAmo= zxAu$3(R7OG4e_sqM%J*|a!0&vebzq{tC<6T5>&7jZzrhpRhe&zkyV|by_ZRSSe*-f zQ7rMB5j@PA%V@m23#|Rji2(#FbgkeWj^@37e$~~~9R1GN(X-j<#r(Cm-vvZyg%LT^ z;o-#4d8dfOfv^fsmTW;>r1bUkJ#N6zK~d3?XMgwF{RR_dtGg`0S&vwSec!i*Ifqc``wB?%p%GoHA;+*y4q8zKMk8$v4(>jRm>Q{}Bb$&IUPF zVn1Av<9HU-JxwYmwiZeRWVFm)+U|HCBmXknSD!HD_WLE%YcLPg7pGdKIrtBgJuzW& zvD$QZxsgE{!@2uQ@8K-?)7_!|;o&~BZi7SjGuqux=mu3=^tQV3lC*dIyX6*UG4?Q1 z$F0jY_K-}1JU-!SkAu<4kpE;S89}5`Vc{FyDFBThGxJdk_u={JYnYf3RvCbRXST1g z@KZDAuFda@wT0mjG5GRcyX-TD4 zDz;y>C_(#Ml**bsCFV@4g8CKcq>!Q-pn zM{S)k$rWu&m&p)vTiw*sWLqd}ct*f9BF1LI(X9}(5p!eW&jQ(C!94l5ZZeEW1x-y! zOUsKXR0|6W@4FeXC_Jusb{pRn%=H_N>b*aH9b>o^?Mkw^LFm^~k9-E`fB8Q(l9LjP zXoCJOvBH6`0TXc4Jyt4O0u02VottM==*j=MWq&JF-l{v@WU$d|fsZK5W-yV$g`di! zskQk&<~aK3q9f1YxW{*prFK-1{w1-utpmXMfSGP{5M%=?Bh!rBs zYf2Iq1o|6E;{nejT8kfwFS`~uPcWg@eEb%lyj=vBP8fZ!dXBl5HPPqi*0$a64}nba zKWmOs>V0gw85OFNw+l|1M&TZ5k5`aY=`x4C?7ICIJR$Z%TvxB8o%^4_OrpZY6#tH$ z#NKQ0OcbJMLB%R*Vl1dE2pc)Db^6A^3xIs6ka0mm)hElxysQUovUAtW-vI0GYAXk% z+jDoqN<~jEGWRs2r|k3Q0P#8}38ezrM?m<`)IreE;=!gB>$^d=~Pbv1lB-anWd=Balg_ z<7wOi&X%t3%Mb0pxfG6g=YUzNpu8hlW@G-dBbD!kICUKz?wv7I$>m{LdhtnQp+swb zb}cp%AkbFDe%x$Z6s)DMcwmn1?9_|#XG@Aj5yYcYEF}@F!Td?Qiy;Kj^I8V0n$FyB zvaa^$8{=*Dj)PvTuV&IGDf?@{y8Q5DF+Sr%E=Rp8;^$0s`D&XYxZR2 z>=t8;hGX(A+HQ2HPQ@NCH^7!VJXj~v0dDK*p{|m!!GhPH@uQ=XAX?C-tx=-jT|b$* zVi}9o#uI-vWh#3b{K$xi`Lk4z$RSd|zxJKou?Igk+ryGCL0Tb~;rZDWtjDVNk{f{x zDgq>oDswK@V}h&f>1yG$MHyxh6%Z77`CYnH+I8}6vxd3;iEvR@6TLZIw8e|H2?1y^ z0+dXlLEr#&oy+3<(fwK9poFqhjN1aMZD%QrYG`^N1FVUa6t$r%lYGyESKn_PUIYM+ z^q=N9f|AWJD!clf-ES#UX-G*{H>mRgWtbL&u|LPQ@5XEo?}Yeb1EmXqoh_#?x}lyp z5qd~%)pHeUjGp(3u^@VrJkG@P_0|LstbaORBvLpzP0%51nk^dCR!(FS0m^wR_@y% zszco2mH`*6!u>p)7<``bE-9m=qI5Lvt;Z9qzH4?GLZB(^;ylMU>shgc$}okTSDrd4 zZ{2l}*RBrDeMu4?UGQ2S&InH7*nY_n!pZktXqTaT0{Uv=Xv zhd0lQSz+?50dn@d_UCfl5Q})+rbP(tLgyi5z-~kkDTQS=_&gBbU~wy^kU2o63?&kE zQtL`RU^KL^Rb8+`naVPM;Z(ay9*-O3u7Qatp!`qs3|y6}5;Yr0iCl*DkHAUNwUr=|&6-;+ zEHPg1w2qilb2Hu89|f0hH8ao)6?ZA&?*2c)t?jy1dp1tXb9#w0Jt*-rI9h0fxfh=O zixq);nn}Md6Ss}l^r2WZQR|9)*+IlaYp(SwoohlNJIAfMWM9KmAs%b9wmNy$)*K+E zP6i;=i%-PhIMXVDJlW9}tLh|FC{k>VS4uZ}hyu=pev7!D(hF$%fhX|ynIW_4=>J&` zG`qnXxPw#0H>CMJ(Q79`J_7vAOgXuIr_6+F_jQ|&Lh^Jji4(IR*gRsmTDmc0Bd~Qx zKVk?VEl@DGa&wH_#qUuj^($K*7YEeC!N;x^Eoc{^<@h!X2c0^pop4_6PLj1Hwu!68 z9Z>97aHLP3w-B){sykq{J^ma}mGVgwgi0WPmX~DT3cDjwOtS6f0;$dT(vtzwL`2zJ znH7bG-*9PMO?IheQSL-V=G15^jUA==`Wd!wB3>vj$Nk?%`TzOgznL)NQu46vEW!s1 z4(vJ5jopmx2Cvym%(3mxKz|W*E9BjQE!w=w246VQWyF7^sn$x;Cn%#WgPn>?LlUv6 zLF+cXqH@dbqC4XLVYBv);}MVwVC+Sw%JQ+W6|JyY`KWun{?c-(o_P$ewd~(Yp2IAs z0ndJVW4oGSNM*H7weg8(fNs6!7^^TZPlAe}K@8AqzYk%x3_gPrwCU!rj{*N64%^>4 zJ;f{j-;47<=RyIk{57sT7}&5`K1{qxy0{jJ^M=LGqBEGKV#?gMIIvk@+fqySZ*#;xR1zn;}kKzDJ&Hk_W?KG!GEAOvf&cQc){8xY{cY))t|v zF;LU0igo+_LKaNsmPI*`l5X0kViTgx^qmt0`}_Yp?Em~6U2NVtT~UG>CRorHwLG^4 zHutRU%D9Pc43mYPLrMiP__wVQH8nZV#2*)X`(kX0W)Pr!X{GBz_ggpAOS`#@gRy&^ z-$RRXj%`O9oinY|z>NKjdLXy_leFTRn(djEy{sF(U4DjtEv9X3fym4#H`0FxlJg+V&Is3gtFiNz>I?tc#$c8ilO$MhWKS;R0=t@A2hT@}tc|J_LO zO)m3l-)l+yPzRajwVCTV4@Rwwwh?6>HtU;A3^Cxk=1Biu>IBA}IWW4&l8{)iEjqVQ zCjRosC67ct{_11zQK4K2;jVlo*nadXxSGf0{}A<+QEf)swlyd%R*Gv|DDDv4N^y6$ z;_mLHSaG-D?!i5{6Wrb10tDBWo^$VgWAFzufbZLT?Y(TSIq&Ktj8pc5PFo~e9kG&0 z>*?*k>u+S33TS7I-ce?L+3OdlfvzRdUS)B~`yvh1{jX2By;G<+$4BQqN4Z157KRM{ z4P+UVMxKBTur{4U?M-ny6`2-OxTd7BBZ5-q#hNx%i-2wO}N6O zt)M_^)sJzQ^tgmmACCtNvIfp8k^=mk=3qU_T9POmf3tMUe$N#TCbHL`L>$zYIuNRJ zkv~paZ|B|J6=c}a9mOgg$!i2I#n5aRIA7~a^+#ArF)IGZGH-?o&pc|Y`&o;{u78Vy2I7TlGkK- zlZAY140>|1Qxrz|+-pd)bPtIawX?OzDpk2O!a=QJB9Pg*iEPS#V&*?6l#Aijf3Bo6 zxuf_zJ_<$R3ANXAl_hheo4IfVU7C6BqbdK#q^1--$4VG-h%Ul<6j|u06B(QKVVZPxS%l z0WzHKMId9PuihIhZceM$Ki~EBW9!TG9~>Hk?|)jzuU%HFw(=^!YX;pNAp=lQ$5Bm* zTY@5HVq%F+%WC|1mI54SYYqrx`lKNcx>mx0aLW!mSK#|jl-V-fZmFmhh!E!5 z`(M!6yJg37Rri`(v~N~b3iexEC9-Fu_Rd#bX3#@|~J8vtY8_qnu9fX5J3 z(yY;1he##sPGw?}96ZzZsUB#m+MP2jGG%T=5Qn}`@G)0B#$O1+DiCZ9;%sb=LggET zU-Xr&Ng;4GOW>#1Tr=skqt`#pkT$p_;bgTthw=N!ubX#`QV{L0%d;(;a}6bz^cX(1 zDXG4@Icc)6J{Z;ewe(qr)1Ykp&0h0p%lBx6BW`WBn`eyE*C$KahqmrTLr)3B|91o+ zU7`I0W^CcP54A>zxKnp0XHxU^$Am7L<&D>W{jA)NSm|;x_H?{?o;35Td=??vu<7@7 zT*d&))mzFI*7vaCR<$Yd((S<|+h3bYHBAp7)0phO!>OwOoSk--cW)rog7f?E^pM0g zvBgH|TL4sjX4y-HQHzZvESoThj0i{p1Q`bWOs>MKkC&Y-!F~HR-}Vs;^s~eqxb|tt z1wq_)ZFKoZ^Fpo-hQJ%Y0?YkorEA-TL^AbFG?AQ6<#I#k)Spe|#YDlS1-XQX%?0|v z+w)hQNb(ydIToNSi$&GR#*DCO^KliWc(jjGvefMq!VXL&wsKcJmJsWX{3gwkOq8Qh zo!fr-!YqPgg6nn>Z{`0B5Lsd-@1g~4mN%q*_4$`*MvYg)Q)&s_=+X)Dt7j#%=QhNq z8dL~g=>(${8s1yg+bnf0LRD*O%EHB<9SuVeum;&+qFA+lGy)VCz&7BDlwZQ zKSkORu%L|B3NP?|@SAZ+m3B8Mf(upygJNR;oNy}#f^u7IWXyr1^FYx7>uIB$)80bL*Q&!gj=QUv0gz|c$3zclA3+mF6#q89tmwJS`9_CB`&^xL z%YGA-MTjND*Qp{Y!Al}GXB|Mn6hK0C;u;{c?DS@3{L|kaE{7^Q%x`Jo^Nq$WZ_0yC zBC{>I>uVU4_y9m;+DQIn8_XDEq1wky8H4_%I>WR5Ua{rvMI)j_6lT|LzEIkJX#=m+=Ho%sO5M~?xW6lj{brVQKUThVFYQ`tur|bN=HaL~UUPw* zVZtt_Bm&9ACBJ>P(IBEMO*K0t%KQ}IL@Z;LtV%>}Z}8eE$7>Bkg}AVU{zSOGgwah> zP1-rYJRm6hphsqk&o#2B)RG`5o99R~F|*i03kSFnf4$^0OC!<$9US-iSIZxZbS_lg z$nKX8wnL~2m6}k@@&950Hk^Fn-58Uxj1f3H%VAwxd@MXM6b;7{)YM#*Pw zv%B5!I$K_&vhe#EF8+^WBH0Ztn6qgm5c?8F`oEYpvu?+HLqH! zHQ5S_JEXdD(;lEBB#xTrL?Ge5)%2#Y;NX^B?%Vl;f;)o@+%y4#!(rrhkR$7*u4*gz z(Em@&Q?E2O@cJu!PP8;~A16Qhe6m^m^2O6~J0zpUd@$vGCia+N-I_4|QS1)!29|Jdo zKSzirU*1Xcr?h2|Y_&KprBF`QS*jUS;b}G47s6iPXTpaVLw`PmVIF^Vf&BUYU zBaY^aWn3;UyWhAO{=3!!_>*kRh&75U)t+BtoIm-Y zYT2v|G}lDR=Gv@4oM#!F0h)ydwhwE7?oe9+BiMzlTXu6d^)R63f}fWv`U=x>fksHt zn+@B{D zl*?{;uK5iHk*~0vZ;Em6pv7!p7^pcd3{=7#F#B7l*H{l;c$Y6E@o; z#fZ}_nM;xbHd@&Ice&PP4t8TT69e_}0u+_1q^GF0=F(ZbLJUDQI-S^X0wxWd$?9}E zC5w2_Lsu>(3k73&er|Jv#|Q`@)6Ike-(G^qx3d^Ffte`;%k!Az)(1o_c7%HPaOt}H zCH8MC9XPKFj%=LMbCL2+xYRKBAocK2VF~w-ceXNx3-Pe#Rb)4YLHe3=_h53}GK?y3 z>Nkx&DeoT0GlMO{JDB;2kwD2E?UzXFIY@H)J@in-A&yysjvzY+96nji0!N;540u1$(iYS4!Ye0+X~K-ozHYSsuW*;JVHNkDK6FW5uN`LG z%j_$x;a^L?cTV|DyE(Oqbyu-Eb5Gh0%CPHG^SgCp5jU?y3OR+Vvg8 zb%Kh@dsjPi%n!j;zs(llZ=Mc0^*{5;yFFJ==pDY_v?lR2X7QKfjAMupdbT#<6>a2} ze*82l_ut@i?ESY_4JmQ)pO*kn1rnX&ua@dR;3GDJ4Ewg~fSey>$gn=@;~~E3w=e$S zXAP7^EV1nSP$ES7EB!K6++AR>rspIpkkI`wsgLa4C-1HpLfL2zDN6c-^+A7Mp%@IU2r;oELr{d zJSMjxtMc;@-DHh)$ZswTr+ja0E_3VvSG$KTNpBPzH>1BCoo^@>O#I#xSXVUP`ltVk z`(F{lqomiV9VQ#oFAk6|pq-pGonfv$y^hwgRvC@$_a7Z64YXDX>amWWR#OwLbvom2 z_(u+7sbX|!-7ii})$4LEf=9Z^b-@{_jNHNPPd7{V)?exCcgtaWdR5-|a!&{5s;7_k zFmVFkElu_l8s|Pn?a{3$-hn@0sC&CaSh>5OeW>c$JQ;fR*NW}+VHmC~9gZQqh}-k# zP2Q(JkB>UMXB|o4>miHhr!LYV2&u#po7wnpxCcvQ)RW~Tk|j~@(_lKV27%X&g3!P8 zRc>rGK7+&>pN7_$toG$aBlttB4Er6XV{-A>osbG2&lRrcKhbIr*6pSDF!z%{x*2^X zc&n58K|F!kLcz?3e{=CzUFgK%Ej{?R4%gOWl@1$#Q9gG%wdEJy9guvp<&KlAfIZzD z@9k$5`!I5)wXGp!pYF4bZhUSlz?{G%3$}o~;NO#ljuG69?i%Rmv;Nyx*uAuF#~bf8 zz~yi>m1ah><^M8A% zrrn8+tJ6V`&I?BcE#0(d0~UY{K{74ZFC;1o)$mR9jPBJc{fh(IP4Ub$*%^i2B$pLM z!d7d&Rx_(U(Ap_LpYT)NJS9m~oVDfUiSTNw|5mi$1Fv&Ow-#ZMGR@^e&~HTEZqO%A zg8!y(kG_J9?pfk+U1_*lf`n8zyNuP8G?G^rb*Za?4Dq*_@cycNrvN1xSng}^{wr#7 zQL2EL*v+uIE;XUIU4}muuB48w=TMJMd5a3~mkxpOsAaRCz?Ulc0Z> z@ef;Rb%_;cJDrwMhXeMU3j%9|{?A?ZgNMzh?2D6MKbfqjnbJ$tUY+$=Kmf$BBqwDp zy{s!Wr!l_*c!1dGDbXAkyAmF%M>rAs6AseoEK*|FP1Lg8S+r!xE^bOpwP}i>wsd{U zd$5W2#@kDCqte-J|hyXz!lKYDKJ zrBpvYe5oinz@rXY+Li4eNA)?L@iVTWV7-F(mbr`xM6NJGMjUiKpFb4PuYLFpI@oU( z96%!e)$L)B2)pm;PpKcqSeUBexmbeviZ!Te2>eQ;Os*eJF%`YmPxF3;?$4G?bf)Z8 z{03Gu01GCX9C1r%fak|ygzgrT+(Wr0<<@XNu>@xeCXrL6n)ANG+0*f&w)JX@#W`si zuPz>KejM3H)tW4Z>CfkDCG&Z*-v!z)lFa(eHZ|q#R~lWkfUj2pyS_Y0zOBzBOGDP0 z_11C^*X31`9IU3-R_wT`wWs5L_4E#Zj~7O#%^j0lo#^dvT8li!&i!3)ZSfWrYUT%K$p9UjaWK z=zBhKn+5q{lstha0TJ>8^0(0x(M`bk?QLJ$kVrcp0rq^(e`-Q+w3G7V z+x+2(Zb^L5(zHfD^~Oy}G@DL8QXsrDg)0DuDmk@(IkfSo>A;o$pv;Z@vKEj7Ov4GS z_~SuZMj1sBQk_w0&XZE~jO6S^v687WWv#Qb2l_)hgt$lfc59kw4V#-y#*x)LZtf~P z=i$ESSQvHS_upew0$%+O+4D;;ZLG?cr&(>Zv%xRDN%9*RZZmf@_}LRh_OwA?e7^g8 z01(&z8ulAJo|Ec6_os&Y?3zp-e>9Ov9R@xcRHwR{4$n_)8(9QEkky}8WC=KC)gMnt zs~6F>w+-)WOgf!R=tl~d#tpeVewlWdK<@LsSZy)%dEylM!wbb83g%7XCv#{Vc=A5c zG8%PuMQqm&!NrgRkFjO&I8Hei0Wxwxo6gXR+x`~ErfpCmm!VUzW-wVUwim1A$5L3B z`E(AeVL#Eyu(R!JsifVBMiHS|IxX=Ov*E_`{;B4w(PfD*ELWvX+wmM*mBTgo^G#ew z4JQ;js@0^v=>6%Bgur}N*wrPYM!K4CZsKYqNJRI$F4E_fwO2K<8gZ1cmBf`=C`THm zDB5?$>WKV1&w+UCvU&C4D$2|skh1um*FBJw=MxLrm!}h~GTou&9Ue|&buBpQN~Mt@ zv;X@mGP0R058KyaxVux{W^j4ey8vp|y%?oy#1q1FsRk7P+FGp8`m)`)UQ4RVNqkll zUgA_Xr)zx`<|Bwi*`lWSL)$2L(>Rb$H(4%j7QallI+`VB#J)fCM`<4-tnKkHwcbd+ z#NAP?ts8r{XC0Zga){Ml`X$Zo2yl3Ere)B4DhxA!S_Z^b^El&cx#*=^j|^rgV6Ezv2!)K_iQj>*6~qXzSV z=6vLNGD64Y#;V%EyDPTsPc}EbUq^uX_PzP($!!)q6BF!4v#WhAq-t@!tdwzTcqWf* z?WU7GJg=x2=&~hjlmNemU~`Vkbz}C2*f+4rOj$?vYRS9xZborS*5BvpN_X2!#a^v# zX%MJS48(76Y^@_?PIjFm=_v(w#kzjf-M{ve5kMUFKLp8_JoXNvUxWcQgA<0~>-)1I)!tr<#S5F+GCzy-_u>sKigyKfqfJu{w zAnaja`)@nCu$cbHe6e7nAJLybD%2XY!AHQ-y4(=^NjNehn^2z~zMU^uY#veTU99Y` z)Se22W1@Xge&JB-t-uM%(szNYxd{9bd~$frX)vs=Xai18(sT2l7+VoUOc;K)Vxg@+ zEx7uP@o3_vha>j@HyP6@H#yctO!^}*80|TGlicEA|9X4c^WSd3Ef;LiRwWb1O7M5ou*PQ-%641 zj&pA`YRaQW!c6U6-pW-r0c7)jVau)EU>$`S_Jp!u^pta)kN2plx0~~@t^qqnZsfA4 z(uissZ&Oo@oR1;5+&$Cky=WQWJqq2&u{|v8W0T1v#3}JrPxM=NA8yXaZVHr?8~x`fpA&q2s{%IZOWn6KmhO(G##l|y zHM`iBg949mYCJg7+y}{trW!stw%rqah_})nSkv`M&G~5hbYV@Ka=R})iyQDkP0gUs zFg__sK|vv89F^wd+{G>rw9=rP-K6!w)dsx9?4r8(iGJtH*fOMjHC0w&Lv}U!_B*3* zRd{HZ%;V0rz(q$-(tM*kd~xmw;Y8won-+q3C4Z9P49k21`C3V^InPXe75#Sx*x<7y z9=H2^*M(|#LfGE0;SLbn>v`dQ*@Etm=gkzjB-EDGyoyL(bEw&H9y~D&En&)EQazh) zm8)sy4A)TU(StUn;I2NV!KK&k9tFl6yE8M4<&+H)%C=%sL3@576_q|P7n9Z}x(5C; zy55N|_+59bLP&zVB!zk3x!wrECli|)#(&nq^zv${>FFs*D$>^$np}MyP?GPSg+XAL zJx&mDXt;Raaed%fE`pH=pP6ua(IC|_r_ z;=y9Wm-3%yGY?~qJLyq1c0#YYMpCPM`byK>@7=Y%AaPa|C2KrVgZFoI^CtFv`D#oy zzZ`dm(?X`-!32ELaaVzxqrC=;EsW>8dG5+;SS$y*=(jdU4D5`lgWc%7ok16PF*z!{ zS9_FqAf}&G+wlc>qDUQmd@+y;l#m>VkzylzH{tMnH{1%o9R++uZh+l8MxA#(tYv-7$6jw;Lo8oF<$UJo zS5T-hzdra}hzoYk zYMdUFHIF|UN)J&v6Dn%>75M|XK%|w`)~TzT>kF4;Z>^}AWiTNuRe9-V!r04H(H>vz z2$anI!ZvgI+E;m7AFSFbfO&(ZlYM$@DGMWJz&iiC%=YfG@>sD<_e2{mb7dURHhOz| z>dPn*1lnw=tfn5$`AjrQ=!}=i=Sa`d+T^#k_JrZTXtC^j;0`Ceqo73P4Q3r{|D)3q zwovOu0n@$vo9}K+G^hSct3LHX|8tF1B!loi4}U#XnoVjvv$_PWn%cg_{2T z1*3;1*#b1%!LgE(wEj^WKFWuDrVx+;$clAe?F*aNej@pN# z-n86MoyqX?Og2UBka+LmY>3)3TY7oIUYx zDKpl2>aPLwGY782Rmjsq%QX_H@!Ve3x-_eK-H<qt;T#^28Y=jBc8}M1x@u|<=(bX_iV!Z$sdpQzz|9p z#BF^L7k@hYn+dNZ9Z9axY40%u6{+nV-ER9m2Bcnu^Jv%+|7r)YnC^jU8hLaSZm5Zu zjiox~k*eXYkO9{V0W}>cpXiP_`!}8{eR)h3ScScF)%N*pPKp7I9Z*a3Vm&ZaO`2c! zxwQ)-is}4aU+nd?vsc!(C3(LS^jQrr-}PzQ)8B!3an&Xi3@4dvd$=h?vhn2{ zciA00N{`Op+w?YS6CKV3*79-=kSbkE9RgFw6^mO7mO2qnw30DC84{%W_>xc(xpH#w z2_!_Qy(BU$x|q-{5AP#0=4iwb$@1^9xIpQ?`|i-~zC4g6+RQ^jxVR^)WBim+A%F=M zp#363QkADE#vN_DJxM#^je{3Rwl*g=yI-dxf$~aF)oL>o^3q|M$+&f&jrbEj`|UJ4 z=9A>Qcemd|rkZ9OzG7P6c5kd=>LL9m zfs&Gv`5M!x&>_Xg?fH5cIO=(Dbd-Nu39bhEu~)DUa(yYRs3i$l5_RpBFHH6BO0bY9 ztkrdGI8VTDD_IS{`ALMn?|kWsna*8gE}Ei71i=HF=oa+CAQHxO%1`w zr}=sWQnRK+z|etc`{~JRv&o#d#F{3bBPdLNvJaXMWU%!LljqI3sc+lP%ij2iO~J3G zSCd+oaNk*PwbGa(o@<9TGLfFJ{?k!f!sQtj96rHrtuE48u=9A7^4@JBQc0&R7*Xcom!>_? z34eI}wT?yRJaMs(NREm$GG!evDH#C zj*qL`QY^q?GNO%-`%Uyr89g!36r&->YPm7?4?V5BahE^Xq8}*uyyvvP&jz7}ETBfB{Z@nm5t40x#>YS~owpSIi zQbLvvEL2o^Iyx)@9dX0arG|T>>F_7R_z&g3{=;>;)mp;XfDgVrUZIy7Gn_D!nx0z! zD)H*k)rTY%`Fqk0p|qx^#bh!mTdJe2TYRn@e-!%j6P>TeSthU3nm3Vs4^`wzhR#Di zZ*^*g$w)6nA1%6WFYegB)iOrDq+S;X^4t`(N7s3j4@>f!%#ZH|q}mUqwOjKz0C92A_ba*AaE3&=RXQvoNBS~+ayIF@HWrd07xOjgKBUa4H|74;SR@G;i>Z3la)@{YMbaA&}$F< zLr>^-wGiw^PeQJ!AnakHhN9K_f%?$orha7JoZGX0uZGVS)t2|>lWkva0PRh5;zEQQ zZ|FO#8#W*4uCes(17SP_Wsx042+0b9h~XyPf~|0_9#4`xwh@1auayk-JE$0Hu3q!rj|8%gJiGN^7gLmD1?Ha1zTGxYTu?Fe^$w28|$abWiFaVXj5M z=MD@ak3f*+r?CNJWk`r|KN(w5SIHE9OHd7t+!Kl6E;0EzoG>YER{YvY=4+r9YSD*0 zmE6aSZBgZCmN%u1`7a^2Gr)y%wvrz@er#@5;%Zal{t;!`<})vZ;mx2jDccUAPM?+l zH_WxM?Rcg2-$>bT`poka8n89~i-#qJ_ZT<>V+B3(}Cb8R96X6708tEw%JGoxvXpl7jBnd++F+@1aeDFr^ zat`Jg9Q2o1 zYT=(_WdB9Kga#Fj;c+1Ma2Sfu{TOi4hZD z<1XMm3$_Ghg_ecs*}FImO!Gd&v1RGPKJKq6m-kB2PnVeY8PmY|3_fM4em^{VMq@e7 zO;dhgVqnJR-_kB>{PR{1}FCVHxQU-Xq)MYwE7gmC0SSAIOZLYB*LHX`E^c_XJK^!8@;e=fA$P8`K4SMc@6=7lUs(%_j;m0fy zThW^%hYpk(dZ~5;YtG={46q+VgyIi%ue(FNl#7Y?X}&$E;Q}R$U%c;Wctl=Hp%DD| zUo60rScYIKN<>4Zhd=!U8uA2I&!+zvkjo`?FP32;0s}k0{4%e&qZ6>Y!nw#+RZAoCc~b6 z2iJ5C-T?>?;Owrf0$yR==q<@6_LRAdZe=lc$>PH%)B9`VyEUG-k1%Q?zC7HPhMl;X z>@Te>#w&YkwVeZBg&I=MH?+bJoiLgTWax;#5#gc`I)1EZ^QClMWA!^HYgWKPt6?)x zXmTXa^x{w7G>+4#tV%WvK=j~FY3?0HUp1Q6Pa0pY4G|#~mgzjJqC8)Ocb3OiFgf*| zY*iWIx@H$vBz$08lbN(;Xp3I<=HCh0k<}!gkBer>Rn# zYLd=RO^?)->QD`}$ZU8$nF=F#5c!m~Dwpc^kwMKb#sm$#C<+?G&BRQXWi@#7#UEao zEMusqQ|X1ty}($GB*{-xQzcAeCR)0x z?Y`4X*9H|~;IRgvbI6%?1D&1lyeN{=J&DLOSI4kj+r@Knh(9Hem#uxn^FD7HK>gx) z|AmASwojY#G$^ni-PF#J%*jgWEs+~3<}jKZ^Q@(yHM&vVvSzSRUyA456(Y@hMYPL? zH%!YB{_bmyJxx9`F3k5h-5so>;(pU^S?)dBnnD>H?e`8TU>H;4tG=po&xb^RpQuI&^H79MW`_ zvsQC3E7i0CiU2F(vy?Bm-N<-Bk1MLTF1OTMj$N0Vjj8nbjVXK{WR8y)By6*jy@&9L zT+a8J&K{*W59SZ7mhC84a!r^#jyuQhZiL*-b89z4=x@%CV7`(*V{YuWjZs>l);Fv> z%KT@uaR(koUojbPJsBQ%$iY_UPV54194ll6utUr!qsnS+_h&gS`^glex9_X3I#cgv zDi{p=OV%8>n#H(uEydgWCuYW5Y63^sPnQ^s4-VmAL>_wMcD7=-L$5%$^=dp2W*xPgF`B-y2t_p5zSeh*sB;{m_@pK|SyhJ<7y5 zn-OonG*23jZDSBQtxX}G2hx|PGqGegd%W^hI0Y5qFqa3r(7kc3hs*kXlu;)*#ffm= z{o=#@7q9OXK3B8{?snvAj4csD1@yl<|1?QwawSc?<<;`Ua>N-iHJhr=MX13g9{KxP z22Af(t-@ry%Zo;$*^UOx-DNNsYSdr0?^aoMIy&KfoX3ewYfV;?#l{ zhE-n#PXK;gpB*fgR^4OjBgtw(vhT401qw7rgac+GSLmyD5?A2Gb9Cw(en;6FI=B^- z1bL6j^H+6DwNFMMMky+#Cp16FzQ0>5rQQz1F_Je_1KE_xVEqRL5#Vnf2cy1e`-HTB z#b*&vN|PDGdsLLY`<_U4G3m^1{a})zvO&YfD`2U*LpOXK@=RBAwm6-H1w1_TcdKCd z%$0r(iPo)LN+!cQ>-rn_Wi8~9aK3bRP)d~@&Q_o7c5+Ibx^H(Kokmrt!GQYe^L4|- zvIDLfy;f%cwV2~@*Mf99f86bIVIAyFm{gqKosC zOX$Q_!8s-L2`}?u3EkoLOg^^RammCZ^fmbSa*oyYf(b6VsESC!5_Qx5B25wb_Z+!f zY|`4Hy0bf_!44xBMbXOE)p3(nw-;QzWjG`3e*lyF)p;qgPgiKUF0OlieRI}3<{RXW z8O&leZ-(gP9LF=#xm9oxdE*^E=6(1ijXx7b%$0T)I(H7InKS2C(dsdHZ+YqwtwEXI z7cV3lANC&Yi$t3t@)H_=Xl^8DxWN(yn#L``s@DYyz;0kWci-I(b&f%2aNZoob)Aea zoys4~?9WnJ$l`LNtBE3joXlzW#_rI%*_E1( zcJ&hR`v8K80m(c`jK-F8Ou7#R90u$aJ0;`|tS*PVI7F;r#jLxmHlKK_h)swaeq+c$ z>PbeHF>xp6>obrUZm~I5y>P`C_!DlP;TPYs6!|0V7i(sRAAOzv85%j$tl29zHSREz zzDVMSw7!Fb1ARC>rF1%XUHGt{UAGPv!iY&+AIT{$hwbWcBr#7ir@cWFT<6oecF7tj zW1ox6NOW+6`K#yeVcl7b7)hrl)tb$7;Q%EOwtatj~^eO8xk*rmxS4M@fv3MBER!bwLQIfLA*XN?tAY$hO?B9B`puN^<;nNnD(j&HSX&VoZ1Iq z<*EX+n?O(3i|0VO^oUxxlw8|QEA;$!D=O*5@Z>{2)`?5%M6MX@)U`cTzdLAV*27Bw zoTR!hWA)N)@#K-KRbe3PPoK>*5Vdj z_abi^3pv{yZK53CQ-!9{NzEM{nBFS;R#?RtRu{HhXMocM9@>Svo@HqKJ%;AA2DGfJ zK_+{)#SK`qNxo`4&wc!;qqtaHfYdRl<=NEv8f`tZvofwDy!iOkHx_-e)KCLwc!=b` z-`@j_!Zp2aSD-%qglo5=izhU3JZwlroObIZFnKtB7?K;sKNLclq0X>WssDDV!Pa!W z!*BB|mM+sIl(Hj6Ox69dVbz1STs6!vlFLL-M#e3~9yY>ZSZ>_;2jRhk=Fh7R=Q*8z zxO8PQm*XzO(c%d^9BzzCzT>@rdb;}v8{30BT+cz@BBvW2%ezHa-#*_m-p~^p6iMu4 zI@(?(C5Vj7AG4g*jzuy3DzcktHT>e@@b>JVktHykC?Q&<#77?JSsrs~`1mECQ5Z!h zpeU}SKD|G9cmmiLLm=l475b7sjZ`|jS)5^`DR-+(qwIOGUr;w1MDiwJ=aoptlo?=L zR0&H2Y(tPMW0tn#9Liy8A-Hg#Kx_mFfi3@=v> z619#b_T=;bugzRcZ*knmr@4YB)W*CrNDEwIjq%|P#Ow((y9MK<8n_kLUK@?gt$}H% zcBviBGee@AA<<)$G&@tr8HJyf{D8?H$BcsHu5JzwdZ+DBFq8sy9IERx^g@VJ$ z#}}P?l(}(-k=%mWfpn}{PUNAnZM|tq&<=$3??(MU^^xPr`(95EH#!S)&f8m>tQ=aB z!#t|X{1iiZ#|B|U<%Y+9X5IF#)3Rxh;Bh2Rfpp57j@Fx1$Usc4zn0^gtOWew-9E-o zCTpsQEzD=r*-x3Fx}eMS!e8l~AZO(nbDWYnYWY@ zX|DE*iv-CAqFdNtx#K>(Qz}M6VLWfsutY_SL5#R9Fd7-PM%5BwSF- zj(m;x9V@EURh%CK{9LxP*CYg2wrr=!_Y0e@6Dc=_*294F-6{sg}?t{?z zdrp-E_H90`CYYZXKI^kQ;+185${gdnE8cq3YHc@3X#9%%>08A>XaO7}NIGJ!kGl^+1UAjy{= zW>(?E6&{|}>lMLZm0k&?dX2fK2GK=jyQwRizIg70*3&E28J@6B1YY>$W9hobS1i}f zkR+H{>e$s5z!+KO2>Go@) zWPrpU>}p6_{)~lw zx)8NcO=;M$8Q8T}i~gc3hAq{IfEOrgQt2L6kIHqB66De%!h>!DESnIiNy$Dt=MD3Q z2`#!KQJMhEt5MWiK>&@MdbDAOTxsoG%%Z>&lCK%f~^Npc?hqpA$!6e zQIilHC6k&a)ElH|Y(ni^Y zLyqIx1%ZkNg1wE35<~v}U+r;%_#v|f*e&ZgXTJ|c(MR~X`ggQ+`~6wM`ETvuj)yrI z6|q9jptCIZcAK(opaSH>Wt+j3<`R{=aJJm)fuLpWzZyIXGcx35^zEInYPH3l)2&IP zl=jy^jxwDMV5UOQ;s9-I=0g^mTfbnU;difa=!_0wb2xS~`bG+z7)z%EGQ^--Ba?(S z##&K({g4Tg26;xe-<1M*77G-t1a%FkKwv@?n-E# z8o}lrZ!Mwg6O?qQH4!tGr@L7pQ=C4XR?UR?<>^aJJNL92u46(dgzi*fkvu^gZ&8ot zK-=doL5J=E&aSpbvsIK1Jpr-In%G^*2xo5S3Z;kDjP zv&Hv+i%Q}*M|q$|a7g=bra)$=|9d4Y1bB$&xF>7Vc4rdKJQ<<`KiRLkJaKgjR1m~J z6Z>g4d8)A3mZKWqXw*wlx3C~Wi86*}2(H6u3@z4$gTKXncT*h+Il9a3#MZPa?#7D{ zeQT<%v8aby!tJ1Gqs!@WcE8)l3ViQ*?MN*< z&Qhq(m<+n^C}R>=+l9ZJ-BQBdc`jtuZvRYBn)}>Zy8XtZ?I8j>sk(K*u`U79c3}N- zf2$#FM67q$*Ivy=I9Sy8>r|tiq~5k*#^(IYpKyL+$)Nj0?Sj$t<&}Wd8=)2e{P=3A zrk#^K-=Fl?Y+hu-wn|S8CingEI1M;m^}Lu*(7hw)=()pJM{dsJzIdey>7L^f@odR! zj>2br)g7-DP|^G#uu#;ymf%e?sv25Vsnz<31XSO}l?`vXd7lYjC#S`H!rH(5BIE z2a?3<`|M?32wz;HuK}@MsQiFfnpDZ1?3j3Vjg%0eE`F?haW1Tussx=JJK9(y<*7J6 zhbpw%i|@cBp9#-VX==SB7ALp3_8M%W#kLqvNM1F^rL|N)x79u$j7OYzfCEt~^M~(NYT>)tkmzi=@yUJkea!OVBC7S}j$Kzy4;#hE(!k zt!q(@1$p}WpQHSzGU-E3_*u29m!|m|{XwB!# z+-hY&gzq(CcnyFc*BzGfWk>#s>5C_Hsfj0Z4884^+G9>9(pT8SkjwMhDqfLJry0u-1-3i#uN<}P^Ke4s zeK|qoILsWYK#TOpE^FOTqM7-ZqZi$TobIG@hHgT}k!EgQ$%Il9%21Gsre$aj(ouO} zV}v7vxN-5eH@ZOyV|&4=qP`L_!U!q*=tbQvK|-H`;Cy+aDryxK9YVd39X+EM-Gf^5 z?)Z%0oD@uznAA4^ZYFT!unN6TQ>979yUvk5GRvVxb%~tN^0Q`Xd_d!a&$c|=dHg4U z!Tm5~M77i{guXVGHHd7674@3SEi6BbY z^0;4K)?OH#)VlRu6xF7>W{%ly;48_Lgq70qa#hHC4jek4l|i_$UDk}lu(ln_`SGM2UsRW>1Vvz6M@#PW5I_{XeeWI;hQlc^_^| zfeO|ZciQ6a4y9O&TaXZ-K+)jAwZ)ybxLbn+EACL-g9a@w!GpWJ>3N=We&2a#GWSd- z`Q!fR?q1imy9_+8GO;#254vewA7iVgc7Nl*f78wDIH=}o=M{OngIXKSV7%DS+3x@j zNXMKyOq@jeA2rYVMx9fa@S|5snz`!-y`pZTEBgcVw^ekAv%~bA@UO#TFP70x>~60p zJPxGjUkS^xAk@6RgTUiUwMzn`czv*Yk12@;cD}*}C7xxQaTGq|vE*l_33#}2^j2t+ zehSDeerm>Iw*_FDDSP?@aj;wu!P6A*b&|3H#DCH!ai@Dy6#oDy`yg(pL4(kmEdJeQ zReW@E;3!|#8-e=pxt?+t<)3?Eh`3vzS$Rv{V?;|~)jzh>|3Kq+z$DrH{OzXXyXA0V z!MiI^Y0JRjcV46hsJdc%8q629&%iQ#2y6S&CY>a9=e}^8r+MH(VV{DtnRtB5Ip2A8 zP4kF1wKT6oSTRHY8Ma=olv|~w-Wz0#7tOmZy%Q96s(^TVtcdBwmxngm;pRFR25Tpt zN#27WDP1p1Zm#}7>d&P*woryLiSU`^g+Q4!RwmHb%7i~6&XaE!&mNH6oYO0bufFlV z8CEggifJ93A(;oX%~WX8Rj<+`pCjmhyY6xu=`wc0#N_U*SiJ zCV##3wK>$2BydnJSG|Qebuexv2ahUYWydY$qlUE4o)swX-KDtS?ueL+>G$6}9P z8T#W|R|A!fnY((YrTkMP+FE%Nr`-YpdiI2@f}tn_W#?OM)tK+?1E70B+t-^i638k7 za&x;{Xia(yc%k`Epca_;S|OXM&iK12$%}sgRTnY7a7U+-A`xw5RF%H4 zfJM!8L|oGJTQp)zGA&kBIGHA+HF5`!YG6A1U@5pK$*bQg&3E>7%Na^?ZTC#O8~0@T zt7)=?4VUY&56FFgnDnAs)1#|MWy9$HwlQsfwl^D_ziwsaxv=F?pOU!q+gjA0j{_uh z+=Il<_>ys}F&Ul6`>j;;8b}XjN~AQ+>r3L=G%DNMhvRD2z0OB$%O-O)G|Uz^t}AeC zw}vemIuOOInT{x^ui1L)?^THXn%{=@MrJxs_-;;qWOtK3c@I?WzJc#=puUcTBw7O7ReQuh^+kVha~4QnkZ)&)!#- z0e2r1F6+Gfn0s7JX;@f5-vd$Qm~6P9^fSCRR3oAT{1Y*`KQ)C6Y<5_1x%HE4&pYt< zljEhhlcL0TP=BS9t`?lwG{O;Ga;9m>Ut7n&_R57)O~om_u0$PLXcF1#BZ>G(d9CoI zvGGmz!FQBqAx?+YQx&D7U87~*Z(ikbZp_;Qhv?Cw^M-4rLqB-odhb3#(yY1MmY=R+ z$7J`;C3SxyW-}a2GQQPwKM|c)=c_wuV66jKbt`9d^ezXuqF82zKic1=44L;p{FyW8 z|EmS~8&Ljk?>1L~et@x{yLCwIPAJ6V4JiCPK|?)>6sG=9id^bj`z!G1YQ`R4Pgadz ziiPK8lf{;?D=25Yvoesw`RTzh19&x=Oh8SuvCcxL$sBYhk^u=7;+p-&C|@#3_1==d zy8r1M_ughs$)ak(w9ZHQHgx{J1r-6PiB2x7M!HEGv3^K3RIjmb18la({69yIFQW-z zelwVOxNe^o9>pPDf~(*W-ZTVHu$W~oGwo(pBTTsD^n3NZiBcnK{iSj($m}Al%os1aX&%iLq}}zPu#HCSPIInemP$~fuZ-5JxYCX` z+#JU!o;975mN>#SrZJ|Hncx4#D84E>0Ob<%Mgh#N=cJ};dfMT+E{7F^+6eM>kbEwS zsS<*%Ul`>4V>{(e8ya>MJ@XbxzYvgXEf*gs2UR<4tRyzGMW(&RBjHgP2v%w77gJ6y zAy2C%43cLJ(!dO2e;?+zcTsq#MPOUBp`n`ElmVZ4wa;%t=>J*{TV`30o_QL(tn|E8 zOk2d48RqFwDl+AR`k(KRCf51Y1R8j)xmlJUB&TJLFGyn9j?F zp`j2J)KP3vl-Ef2#fOMbj4MVdw=i z&_}w}8Z7cu=95lc8>F!AmS(Gamd174Ee@Uzlp?>GF7}EpIy`Ez+|wTX7zud($5q2fKB`vRnZ5|a`%0*>W;s0;58z6l`}yOpVpme2^ihAemWZ(GKmckZ zUdSx>y(Ng~SS7ZyQrakD4l1j#qwr0O8pUTgRiRVFJ`kxLCkM4bBw3I@R$+0o_Nb#x z$b+b;{K;V&;r9K_I9hqKbhR0duq*;X^0l6a{qnYvA07{{ldSu~sZ z81N6=B1PcZMr7L{ue|am^GeLXV15aIm&fbxZ|>X#>mA!3%1>P2#wECqav*Kr$=*D8 z&!-01zy}1gJa*(Qk!J=)l8#wjH>k~UXTrAPDv9mC#yk|7ET~TRtEyQx&ceEiV3&nYkqFY#YfAv{{%A!V!2ldWzEy-DdxFf-H4I5ir{^0 zrc)aiVNY|{kB1OvyhiW4E1=6b>BQd}h~&;9i$ zNHrVmO4uEk?;cEz+OUL{8FRoxz9H6BhLnhNzk6>f1ra1_0e)eRA{v3DUo=QzL1p(8yTk@+z78_Zm!V6fd;?Zz0^jI>JZoYOShWjRZKK3}XYqz!G9T2K$-6?yRCW zy&8jHp*Blsba|MDd~BgaJuIBI?$NZEydb%m*t?eo;{yHlOugDB7DNxftzZ$7W28iz z7D%kpd+@SzF%{H*92h_DWYf}F;1u355%vq#Xlo{?EG~U>WvP0uQ+PsSG}NajkB&Hz zayt$NJ{Fy7b=}UP;{^LVTH){1+QfGN>sc=FmFGs`)y8)z#c#Z-?D5e3FD@t05XXNu z%N?1J11*}iU>rX75hq%H@Ci*{TzmdS8`_@-#?YUkH3lVCXjx33A7Fc5G2ddQPGRTZ z4-n++A%Yw^EH7FAwc_pEf#qgJfECbCVErR2oc<_dX%c6k$mu>sEcr?~9`ZDb*+6*$ z*T1}yIMrVr4B(NXjP^HYmcP=tP@2kj&g-Vs31SIS2HDJ#m4!`)t951uGc{VqdzPI` zbkY!D+GakUUFt<}yAe@JM6156`uM)|RS5c?{*PlWMuD!I)Aq}_qcfdlmq^K(1}(LC za!u2~z`+7lphIKvCDmpNjGd)thj$&K@{P45>1La39o=;gR)i!3ek#DHs!FS9T%D`1 zk!{znpTx=~LbUq$cZxKw8iGc>Vq$g%7?KU+SBeB0h)t!%VuTD|em1@P0?EkQ!aA&q zq~(h5h2;!Y<(6nW?*l1vU-lRHTW7wV&O7ZR)8{x{D(PSi>cg3}N~@5{I+b`bT)m0$ zLhBzF_VKdbj}*Co$H1szS}2E+lRMtk{SoR;-l`8)49SnVEJX7SIVR2Dwa9gZN$#@W z1vtqt=3`(lTOY&!h&vhO@i5@-*9N4RhE~ys@ zN4hXq1?OoK$0tW~Ys~mfXDo3=dBA{MOmPgV*7VbIw|s{B`r*YbH{5~Xsfnm>xI5BX z@10)e@1$6<{{`&-Gs*uvcWpJS8X%=Mzv3vf2|xvfX$xL40$8Rvvg%9e9ekXxSy z={Z)Jv`zjR!C42|dWFm>zddw>oxv-4lMT+lV5F=|1E|g~UsCe55j;Sm@-}Uv<}5A# zsRk|_HQnb-Ja7L0Z)qmhZ5e5o^K^eahe;t@jXCH|sE1x9nasp=mI8ASPu`%Wt+PwK z*=2+FQCa^>zZlkm!+?UqIBAclQF8lSFa89i{8lBQ)_`!l-578@U*o4TS@Fj>D8r!k zs>{nakE_}nnX(dAgAt8dn1J#E#A*sSan>Vv$Yk5P@c!x>r~XDg7ScMUbqqF`sr=eD z98}O9Se*Mbe(l}go%z2{`}1(@@SNXf(VyPqrleI8Qz`BjRh-jWdm?|qznitu=ym>? z(0ZSF22hadH>ef}|Mkh4bgJh@4bu`@?x+IP(JSqf*#^IO1n{>;uz_ol8{W>b+NNhz zWt7ioHdf!8+ssd=ynd!(3S%31Uju_2Qoet~*0e{EQzY|cA`-Sgk7+@rP{dT7ml^zQ zK*RY_ykROs99h8olP|d` zTJ=O|k^Ve)vWI1O(JPI$UszP9Qx4cLVK)$|L)ouWI>|TFa;)&unv^!LnFY`fg9}&T zzj$6Z(aEw0e9pW1N_DB2J-z%|MXki(-G5Etf8JF{O^vB)R7*J-_VW5I`uO*gK0u)p zjox2+c<-mPQWXMn^JxdQadX~*1Hy4LG5u9xp=k>ZT!zB<@vqg3LN&@(j+mIPnOw=E-WxaXg+Bja2Pok)^hk60Njar8+bY_n z9`x#IPeBizmJy3aCG29}18vja6)ri<3;M%C3;$X6c122^wJIuSL5jv=a5WH3b(o8w zyl7gE1tuk7x(+u=4QG=w|G6IAzrUo7%*R?ke)K-;g>f{iw^x)I^P;;&_9KUsn__yukM zF!E=yq^e!M-S*c>SN^GF^E*ft4m2voSt)Awh+$`2+S=Y`DKikRb!N{tS13`qAHdRO zYC1ak=<4&euomMl8-@M^CUU9T)rH-k9#-mB*eUiLc_n7_^uVtkx!E(j&LGbeef!*6 zuAjT^mVEpVVttT9FB2NPtER7Yj@x%@WqMZ#$p-)6$s@dr)37wn0auL89_2iF@c=Lw3(Ls3w@ce!$s1f&;*XP8BzZ^oj^nQaQqmPvlxa!YFRE*IDz_7Zf<1) zz}ohOlWEEG*S3V}wrLR%It&3`GPvlGSpF|rn_$3DpQsT$p48`?%;;O8sj5E*{4CIC zXkJ|o8~`~r2gFUWK53Qcer;L7R`AD(CQ$jlgs6#ZUZQm=sbBfjwvD`TZ zSlW*CXI0_h=8aum_J1y{3WrZH{Yaoc3!aX7PBmWx@G4BY-_|SzJ0FS28yoD+UXH16 z`}DfFw7l!7XD&el-BD9)X{zQ*X(@E`Q2I;a-=4iWkUA!txbOcOA1U|A&AV4Zr)#m~N)sv^jlAZ~xP<)8$pbSTI#B2-lAz*cx?8N?`$*>!+f92~Z#TRhU z6s$af0nFE1!Nzy;+N@MV#KJ(#w*l??&YG;AmJ0~^?9c>Ln9BSwrjm@)H1r^k8UpM3 zS`dioa9&g47pX_?`T84W+_MUZ9Xx2g8@4|jUc9Ce`{e9k;rvkNep~Xg%|j>Abl!bb z^&-*!?g!DpPC;i^F49#Jt(4Iarle>2Ht*I`@sfL zE<~5z)cC9y%#9UmMm6`2;8kTQhf?l~$*$=yo|IoA{EHalr@WeqqL-VV59Oxyc#!-_ zg9jZxKzh%p_2*kY0*{V1|K-3#aXYU1*9&30qqM|D3N)t@lyhE9_+(`q&l1hwd*FBq7C5H-qb0Y@$QZ4;$OQj{fOT?$fY%z+2?+Z=q-L^cuZ}ZWa?Q0Gh-ZxL1w&h39eF8O- ziW{hgDv&x!pqrif*5;awhibGCo^pSeEp&r)kkwqjS% z6o{xW(|pSmp5vT%mEvw)fzy=Vdki}fGYe&SD6kGA$Jkpdo~WC4hS?kv)(Qf#Ar_fO zXVxuQNyTgr3TT_r?66xLVi(1YF?f(EX@K(f2P2&npaz<0uOlW04^c3Q@J2o?jAeakkSlFJUm&-XX>Kh6na% z6|ze()B6zOLib2YG^ER=`wUhgnRwA{41ZtxoxBGQJd6r-vuXQOMaj zVKzl0t<#9;_>(~-$$?onjP=-3T9aMDqD-3Se?g1z56AwU#kT7jrKKuU#sKpE>$@|* z<6G2S9BXMM<#Di^lVwo^2fk_k5E9))iu<<8?Wj*#v~F{DvBG5*v~cnjzha#7Jsz9) z@%2RkYU5_Wx5o+bsXb1%$@7FsE|M~eLd0P)qx9FJMyEML`vN0><_k0=Dh0(-o?Lby zHTA!)V&c-%ZcvW}BlIX9PprwEO0Z#st}u6hig+z1n0J$5hWo4h^40pjJ5o9T9aE8{ z0)9-Ea!r?)PE8V~yaYzMM`ZFOPrJjM%hdGkw; z6FIQxd&x0}>ot>_bX0NCiL(|ddH>kr=5k+dcO$U2DdyF}SpA8u-{B0>7VfW>kFYLB zw@LvbKO5VB@3&=C%}{c4J8#K|rhVe|qJ(dg_6HDLD)o;gUoY4%wWNCbZQdix zsOa_k2Q1Oq6>JF`A?3v`P;eDfIPKat76Y$4YGh%==JWc688KKavL~^=z{<+W;r*C$ zZqioK<>eSYdCSjF0TV*~(B6k-{tw6%?=^jkk4p)&G_6`SSY%!WazZN!{U3y5fd(^_ zr{0KorbD0lEAO@4j{mLoA6qXAifLN-NIe-{u8l4XBJ%U@U_`?Y83DQ`nuy5>7uxS^BN8;Uq3C)^ep$cG-b3_VT2eI&ydLBhQ zWh_v$YR=NsVPUm|{rve3uaSse3q%x>D*QQgEflV>bA4FBiVA2@GJJoUn^-#{}zKLX#I;Q%iyvg6og z)eJ&N2Gm6LdC@Z8#qym>Em8-Yo zQ&^)HmHH|6(fc?5FBGcN}3HeO*|})tK=S)r6X1qZsAo@haaR_nE=0 z`^`N_)7(Cn((@H(ciW7|eFcgrXl_`EqYxO(gumsnZNjAwMydYfM@mw08lbBj z^gMgyYW$o@Oks=UdsYKuNfmVkEfK*#QNcgYcEz-}d@pmXb%l*>fwF5IOPaH2j=TPkWu$$=iD%c;s%&qUERpwd?{=6* z<(BwDZ{=j%{LzYPH^K2wkHuHp|DO$wGtNxbB2c%_O*q0dwYdlS{CdK z139`til3^L%tW$4F#D`!)u@?(HGfQ9!!V=m2deZXQo{dq(98EiNtY1{2h!WADFVd3=x@K0P8=o2x?SAq}5s5@PgcQy2HYu7Njw+}8DT4<*%;hPLaKw;Xb(vng{5GFrMy8iwTmt=t z3EZj}TzuuE5$jcLYPXR1BZu)xw;V;Bzjh-P#Dt$^qc5*snr$&=YH-G1%)A1N5ynDQ zC5;lx!M4|+itieDU{)^zahh=|h7x$w%DFarAGiJE^qsyF&+nYYS z#;zBCfJ?6s;8q319Fptaztb70GUIQCZq?aW>w@mOn|r_N7P* z9m!t~Bq!?O`^tj1;TwCdGm$LuCq+zn?+I?b2}K-BHBa7d6m>TZI~kQdz&3l~LzBan zI3bL*Ve`W-;ZtC(Dov|2bAIPp4C`UB^5Mp)&QMHwHWtvq%i1+1HXQIJ1yo3dc@>|k zbIOmHe7wB0$v)PZ^9Wc{hFaMXO+;o}_b9!1xc+@>f}O~#-r?tD`@lIs8DV!vzecb2 z59mHES-+VRaj_xTT3?n=_vD%yy18%XG(e9$SZ=*z+Yzj_G&fJQO~LKjOS})yO!MQH ztt8{Q8ACTSK*WD+0`6W*JiwoP%gb-J3f(w zM7^9&(4-Tafq*BhpmRiPWkG$TR0GfIRGdl?Y+#nkVgUIi=a!E*^Rpo7Y0>*XU(jv< z`wpaL(jPllSvVma{)a$+sqNCBRFm1Qd+&!XERG{+<4E^(Dqu6~l!K`WxD^di!i9MY ze?mgXy>!&}^f&HpUa0>YH%#Auuupot{7yaL*u5kb=AW%kws}1=zFa%kH?<*AH057sK$ay$2IvhD5-2W zF;-7zkVnwjH}M;`5ZX5d%IZ$~_KG~QKIgYr$QVqMt%Q0qBcx1@qN4bP(}$?A`MrQx zfuX*}i5up~)g4pBpNtlBA7u`0B&Do+-23uAC86kO$Hy*oeEb>hZfW3VnN0T~p4ib| z9`Yy$DppQA3sKg^OH7137yGr{-bS5ONV7AthLQVpD-iHP{ohl2n|d_#1?>cVPTu$m z5IlUh`eEVxZ03*a{JM>A*C@_Vd+KhZ&cbhm;C%N%0OPOIzBF_e0G~m!`TX8Mo%tn; zT%=?qV~rlqI4}3fr~hgJwrl{v@!9eymvhP9I_a2Co!=f-&9UzulP=Ps1B5|!A!NDi zS8HqdTVk*QYxB88gS#n4X;M5a zs?9lcu$+vDBMmH0E6`vbyTfPD0bdH32!v_sxs*RmiWq%{rqiY=@DRuqrFaU(e@`_5 z9_Xrp?OZ=j4k^xN;3_U11L|yCxRfK;-~W6$E5Erv)kURa^gFTj3U|NmT*|K1g^UE` ziP1bcGH<5qvR8I7rUN%$pFfB6C@a<S8BQx zGQ)3UCUYKm`z*L%+oc7#aop@UG->b8I+xCpR>(Q*5_MK_J-Tj{HhHf_gII!h;C4>LYk;JS*r z(oD_Q1zXvBu}jNGE@$lv=zyBjG#StT=HptlKeb1qBrb@j>%+=y(dCoZp4Hx}`(8$5 z^4`_C9n|AD2bq_DFOzhnDbmNJ!j-p?G9CG_aJJuS(zl-Iu*G>FyFL)TvX+?H`QjBG z!}!s@CP83xmprWfcrsP+m`9Rb-qWdXO4!l-_1tsF+cln9pN%GaGd=SP$+%2#RBzz2LoKZ*{$xe zq$-W5ro*W5JzzR$(AdP~m}+=JiJ>d{rz*YxGyp<0So0Hg>7YQQ+{(h?J@KIw1}zJ% zBX|h$u)L!eS^vzV!>5A_bTQqnUDUw`)PC1QVuk4bVPolP=KX1-*d(h7?BI`OQe?=~ zVtcrYo71RY+R(M+l~rkz6@P76-B&Ma_fSSRyibSa$K0h+`_zMx%ptr5tt)*cF%|25 z9MSqs--7!O=cSWG)<0lb;LXX?xd`OnhdQPm!toFGYg-ep?HZDXZ^vuvuFDy%PHcVY zpZNbGVM@<03~Xice^WWr=|wZ}Cje4CGmqQ4iTWVM{u23d@I`Rj`tI_c(sL&!vP?ZHhp z9>T(NO2=>t>6yrsN%XIPoD(nY=t6uR|C+eg(DUh3+1&3v6^t(_;bUaf$X*!IICvjmJH13mHdS zhn?NTd>Io#p7b#`gGr9NPt$}@PiiEZq7};;%o9y*bgTVwQ;9IH#NkJ&I=n}{9!(o@ zL4+}qot*GndO^0v_Y&Kk^&1(XD5+ zP{HEy*)^@0TO6G0@)gLXD_%+bc3AlMG(W33-)#Wca@}#P>onJF*%~EJJ+Gj1pX(qh z2pJZqm|hT%HlO^xG3RbGuHA4&6=rR_(Q)Pa=qc8f}<9sY-qeW0D^>wK?@{ti*h*Y6bJxM2DJsHRH^lLY16T}kw z3vep|1bhE#*Un+$SFhMGM4Ok9Wp{XkngYr|@5(4e(`RdEmk)g+0ng}CT|rq`3z||lBe}L=id!@O=EZ|{-=-_bY*0;dVl9B9?KB5es{*M zlqwWSrD~TuKijvVoXRviS9j8bJm`p+biC*swGk+qo)~9{FzBiM(;7MKw>)5DMLoD_ z^F;i_B5?7y+x_}nfx5ht8V3A+J?PJgMdp&GpC{!2=jGFTr+ozmWy%h;M3A-XDplyZ zaUjX-svPG`w0_I~xvs~Q_T4b{;yaxtaX;r<{+kX--zdh$9-c9rpYph$bsb6W&!SMd z@>G4Bc0*;H7r3=|my8!i_L2#r9Jj)L_qp_x=Xr^|pL-bYc6uZ?_Lc7kv5kD6s7lla zxMoyZ9h+7;4PeyXW(@lr&hhmqnQJAkv_I!C=}OLATeTNWiSRoC-0h6vQc5h-Qdr%%~=^D-5CB?}J&F~ZcFNVBH zZF|+;J4Sb$L!;>7i@|MC5)m=?qu$y#`+gT2_WR2}b=a4_yVM@U8r}E@RpyO|yA$A- z8urr*79$t$w(LpAjX>3$#7YT=)AO|u1Xavow`y7!Gow;Af`iKy%MIj(TU*=^atVoE z%DKP7y9J()?s|j{B+j>Gb;S;{m2^D$soV`O ziE&uw^c}>oW6Ez`R~7P{{f@HFjkz((1>H{Hks~awspqFkS4XRqjZV zjCP513(SpU6O9Y;kiSAPH(>`ow;OoNbS71}6paA(tj^LhFsQ%8ggFK7n?F$cvnU)A zL4O$ksqq>j*d55@=l^`-GRX|~u90b}dqZoXu_Cb5xhp}u$U8)coU+J={8QK701m>* zv0@pEdlGu#ABR*Bvms30DSxD}V?kFSQ3QNjy(7CbE(VU7VDC76aE3u2`Cqw=)rvmI z?G&Xhf5Yu}-i1FB8G)U4h~?|%CrER-#+WQooH*>e_j2%sA6g51he5hjWOPr?n*QjS z@7b+=g-0jr1)StATne|>OWyEco4=+vo$kyP@;TLHs+KGErON{#q{S?t_Jxv@Z1k3Z>iap36gf z-=XWpE7`jfTMLJI)7#5lMz~4;f#Ka&S&Op3H4gmlBy;>hg3*b%#C0x2$o7y9)Ow=O zkk=B+d6RiRypW1Lt%o?jFN44#C?%fQ_`tVs>An)QzjU1;ks?+H6@Jo}Es`w(7ulls zj>&b&bSANFmjM`2_T0Ms89=L;0{BjQMtb@Y-Pge4*yQ?QVdQy_UIwzBH}-Mw>po;q ztQQKBi4;SMxivwM;;7;4k^Xx7P4Sb$8gAD?UaSVipqD1bFE) z*z0mFXZ5PQeCJ)>M?Pg{O~LT)^_y{{)~_qSj_cM8NYoxo-AzHgmlh>^o)3#W;TL;S zLI%31spSnIYC6NTaL5-8K(*YL;BefMAq@`HOIyL1oMI+t@C%L?a#9`xzw_v##rC== zn^8EEW%>gSTb9+cX;)1ozkevFxlYy>OeS7r7PSoT2E;5iO|{}N3}$N*ryX0^n=Vlp zZ6r$8``2Sr_1BkOLTnb5yz`xWJS@1yU%Bslknq@EIeP*z(oeI= zmXQWbGw1j3nWo(E%#`4FO8#cEb|sh=-2K7*WTJ%kLOUb<7TGVLBkG_N{*T;d*{~F@ zt>%FoOQuGhEPi#XNYP+FIl?Pe{~|;^?WQY#riMX^iFDQkwGAcW1>A}XNI|HUpf1Cp z^%POG4449G;MvmC_VBaLSL^W01;h<(6G?P)6V5)ifQ=zsPJLN15&1;B6F$3|WQv_y z|2X^0_>_nqk1`+8`p#yPCRO;yAyS^yDj5?^X3~FMvssPqAoBx5nt;p4Vh2$l$L2oEQ(_fPxQ0=ti$2lj3!MkM?Lp6z>YT}>1Ao+O;q{I@qxR5(%oe4r4qmMA zi&bGZ+a1NtNL!4jKkoM#Gr(HI(#8S-+6Rno#YOe zlbrH>t(PU3siez(_Jh}vlHqN)o6}vMlu~2J`yiwPec`u7FV&*_#N^5=$C}TU?(Rr- zU4qA7X=z1}jtl-#^#xy!si_o)H81OHiOp~tnEVTL5}4MRftYZQewC1h1#PoRmNYk^ zoytc3&}f!Z?QqE+ut%P(`o}VkSuya;Psbw}1R>b=f<^H`bOa(f|f1M-Lk06#QIf@k4Y50|2?DVttl&CBmBW+~|&tCgHC;p9xJ71X5f#&{FQq zZl=Ca@!11|9Y)n>eIjT5Gqzb7w|RxqjQ#~n#DxzoNDjL=eKQ2peIF#Y++*AvEif`g z<~fh-BOEhHj*^Fcg9Rll=rS8OrEfMTL%8>dqlx#Zb)D`jtbgY`;QvkKCizXUMDOlN z40x#OJCeh2-H2*DaK~=*R1$T-47|i6h!HKfGvIs`<&KgT$l4nz&u~@6 z$0BLLUv+C?6?HDoogWYAHcpq{`QEDLNh5=e?ELlSNjsdeo`WbmJB~Tr+Dp7bW@l;k z=eBlPR2w0?h{|X=b^bF2d30HzF>tY_v%;^IcUG|!MuoZ}nKFtc{CnCF+C`z)kJ~DD zoj09D>UiSXz)g&DkS6(Qdnvo&!D*Vx0`HAX0 zMxzPy;_a2$P2X{hNgw;vuaA2ly+E9|?h_LpH%I%T^=p#$tC)T#pu4-(`@x zHI*cIA*V>Xs^9Xe_gI-(tGJks_jT&7OXsnWL)pha<&IyJr2&0TMI(Pa_K3W%AjiTs zSMD75aGhkwX<Gn1;+v zl}pm~4ek7CsS+(Z*4UGCc~oPTk(1wGY6V9MK7>?6EXW8Elv6Ns;Q1OQ#nM>4n4t%- zL6&U3*kxIWzf3_77F9o)VsUvg?e%^Z?6gK6H>L|p5CQPTFie4|S;J-y>&LK1r_uQ? z;k$tV@+y41=~6je+3ik1bBYVMv!Z0sm}4&Hgap|kr0RI0OYhQ(=^y&(#yB_PFpfgU zVIALB1$DvPbd+w7jKj!NpMK@hlbP1xXXwU%PF+ucMZFp#S)XF^=d6-g5{cBG zPysRPaZZMJYql=<5i!EiEnm&hB|RIbk9$du^QKyV+)Wb1=A*jm`d$eyWBRpShg{X| z_UJfCqufrsUHYJy|7Vdg#4{jF?hQt{u`?fg!Sp858$9tJ~g0&}S4hMxu$2Jd6V+GZawrYIH zdYP}vFnS8mc~r;?pM2AedrX=?d|&O2ZWsUjnKM5uL_*pwIkQ_WzA*EeuQDoc{6sb< zpW`VniRu`&xvXBfpVgPG5Ru#v@p|St&Zw5HZ8+KzXSzz1dCx>_0=WDR%f-Ab<-FBB zg|60+IcLdKG%6dNyu+U|tzNmE)Q0>$<9uPlxzrV*uxdF3xhj-$B5+b9aeCFju6?ce zZ(0c{0=OLC&4A1=V~n1(Yc5MUVjfZdG9hdU2-1CobeJ?rAL7tf%ie8fFx&`M`!Y7_ z2=iyv>bgHVHi!{7&U{Oo-}?YiSoBt1(~P$O);SC0lS)y2DG9bJWm=clVT*^6JJ$;( zoJ%#qF@8e)SFqE$C;C%#MOKtxJ2fiGpi}*6L3Bc1Rtj7^pQsnhKV+e5SlMDzG{*Vv@`0YX{(=YV47yN|+q?^jJeAAD zI63mLhXx5NDqTVA#h5#)|HwcI0|Ek0&d+&$BZnjY{*P6=cqvX(rEjjqV?g9Ad2A!8 zzB!j#(=}MVA&7fuxU^0R5MAUg?2vYaMxJqf@&F3U^nq}2xbd4>^N;W^0uk)~+q0ib|;NkUFUaFmmrDdpTjJRuR2KdvbFZ7BD zTpkrSDiyhh3x6vp5wq#OGcsBfpt%pGu=@=h7?r1K9_k?u%x~wP0(AsFeI>N^O@5_WB8$Pext)=3i zY3F`ISq`(Q*+7-^$5IH7nA-AXtzLz&s2@*O3MbJ7{bX?Ise-0^Nc76yW)##qdb~=} z`PW9$LxAvy*zVNFy7~!p#P1kiOqw~4%?L^2iZH|g!MR0zp$&S!A1e{E^+A-~w1}Nz zHMM%eaNI;TnL9#i;Up_8 zHuyU@N+`<>Vq#5c-$~sty&^0}1-k~B$6bzt+|KXx#ZZ>VRJN&qPl^~uFV$*%t|dv_ zVR@L}Tcv0K2s;hR1hiata4$xEQhLZ#TuaD2_s6U1%za9#2c&6A*zaEn2=cU6i0{MA zY>#qlu|6U+*PJU42RORN;lDR`_#^T`MITDxZtm#hHs-P9$4D3EB|?*2Rtu_9wl>R14p@~srX0n= zrvWq!u$N)MGNi*I(X$!Iv|}#C-z?{$ieef#Xs|3{mh%J5 zRAg*7(ugHH-Mqkv6!L-KTYW$S!G9NJH%08cet6#8l*+fep0Z^~?v*QJ)g%rsZn@{F z^$UO-7hG5*JsRXDH9d4NI=WSoyDB2p%ZG&m`ARyNg=u88lNLjC!H_1EhD;vau$U4E zq3l=g;0m_#8kx&SuSDnF1Y5$Jv&M>ln3GXvM^TRD>GO^jXb#sGacneTVHdg`rny&* zMq%l136=1{ML)n1!6{_V*K#BHkp(XeDqIfvKZfQuL9s}{h+WoJyljXzVLhPNPg#1R z+mVAz4MB=-T3zC)>X%}FqgtJa;0Rn$o?`zyvi8!p{WHDpUAyPRuFrzBMR%uiT^onc zAyfzFdOKd1R}6RX!onyd8B=Q7r4adJMZASgTF=wzgLPEcus*mk4f@bji9Y&~xVX3w zl4;;2ntdC6lz$))9(0+ud@-@~ky+L_oWr0r{2?hXU6mJV`gxxR36No(PK!WO*>-J4@zd|0>wkoHvr0A?gYn8hCheFTD7aPzd+ zTRo&)iZ3smWgF}TJBUGrZ&Z`Jm3wv@H~>gv#22%5tj0=o&A-3PcJTAiT^m1;4L1KZ z`m|WrsKTiuq4{Yeac=YP#tr1LBq6n)4iA?${<3Z4B#`{CLU#9qNuGtnm*5H)3tKn_ zK*2at3S%#@nt}^p zl68%{@!288`k7SZ1fgua8?35blxAbuCz6NDU2L+xU%beLlI2;RLEqy7tgYWx78Vx!ABJ#jJ+03kNT>FSOATGyj_XT#V3 zRi8P}F2O)Y)eLC#)g@cBRLkR^F)QUdFH0i_?+hx(Jq52-Y>$txv2-gu-7QqjLUQCB zyWB4i8s^o0cSoDHO}N5`{_6i-+5LI>pG0?)MsnAK7OvmEb5;9>IsVp;A)8lRMFjx1 zB?f8cGTJIR1m|oz2SbEgwM8;{cfJ-jWhiVSMEH}Oq9RA@!n@bUSmP<+F1tFCr zK^2L{r*r8B7do`)OJ+V}?O~TNWxU!9%d=t)JuQBQo3>f6;RA;Y(^77RxJ?q-4k>F> z-lDfZ@|wmE^przhdK$6b4nz75|39w2Ix5PpdmBMOS_PzA8j9sU zR6;r(Vqj>H?vNUK=WZ+znYz3;cy{ReBo;y&j-=j^@D-q*gapPnLU24k;^`i|{A ztbs2V^|fz?x>hSIf!aAXydizJmQW3qA~nt4nQnntYyEUOl<$>1KQ7~3)k7mmo+@nn z8XQsX+AdTo@LR4CN+0W@pn|LQzGc^IY-{Cu*sY<&{V^oZhNRsmV>wQy0e^K}Y=Rz>q!3s4%brY0TDJ_*t)Qdz&;b_R=# zff%6&N}B4ytooKmGMMrJTIT^9H##!g_2bW@)@i>+CB|#m(+wP=vp|X&gQ=s)K)Xyk zDe$BFtd9qk@xP$qKcHTOF*q)qZGX({cATI!I(8^}_lCDfLm&ih%nIh~Z!h#ti zqt$*ibAfqZQ}9s~YS5PawY&bDjX#e_ zuDo(jec`ZhYI;^5(=aI%;2y*#Euq1Vpr{u|Ot#h`GL8+T24;OA3n#c1vP%(CDN{ceX1maVA|ck2{%0LkQjM)X zlD)zdU$EsTju);3ei4%+UUGp7@M+R!J>>H&^`5toS^H>iJPjX{&Le9AH(vPyc0Y8r zh{AK7C(O494A4J|hxj35+Eb*Nyn72b<)x9krB$?YIi%*N9X5zeC_U?k6|{2eM}-EW zR%VvWt*P<)lM8#TuwHhEp^OEXkq@jOb1E2~0I?zz>JNpXFB6);3bhEJw6&sspRt%C zY2RRivBeT^SdAz&eh|1wOT3xotu-YyoK(0168CI0!dbZ9U2l~DF)3u`mGgry+2!zl zo(ox6{hBo{9?glCWtFjdBbCaR4M+-zVROU}6wHGsZ6*XZ#~PAw?UB#lne z9`@Uclf;JnyKH|Jubo}u>rQdCCBAff1)EC;(CnbR|J9bW-Tr-GQPTUCuFCU_PhEPFy9N)oM*nCNt2 z$|_Pj#9Dd66}mM_?KkL6LZ&Wg6d+`@{#vMEOLGFW8VysPpyrUH5l$8}6|oXvz?>S< zEsFL^A%UoLbKJx~9XW9PPoMfzW1p`=Vpzf%uRkHGl?vzKGHTQf%46Cy86o52 zNeVU;oxMr9DJk-SJ#N0=$;m7(tGksazR1GLFYx4TmAs0t%;~*faunT5HcH&z^~$6k zV@Z_RW*oBr|gq^LsMlw zB8wJ7Ywk;`@s7<$#l(sw`xhJ`@LP4c5l;ak0_~bTDlj8DzQNU=yQ!w*(xcu%`8h8= zqz1*Nn?P=&k)mH4+gIDCIBU2Qmg4k_no}&q+-%i>b?-I&i(;oM-bIo)TG`5O1)sM( zLEGmU%puj@elE4-9QT%LzRoxjQtm;V>;El2vfah5VZ<9-qMBw?On%2?m+w|kB=O)6 zHP1gM*&xjYL0?SsxWc|CkcRM>vd?f4amvci(Yvd%gT6giAv%StvD5QQOsM7n>YH-2 zN_}?7P|TRGr7bQPXqlBTUr^G=K>@vy za68wjfQ>Q>6U==0(ni3rmUHt>{D*AJqz=s>y73!@z-YmunGlx(0j=7+X6A56$}ky4 zN#PT%qWOcDntqzeK+GtLt`p&Qnns!6{jt{(g$*SILIMK6|8Tr(l^QkyZ+#A@5e0EU z1j{@zzx|wh1_I^w_Y50Q5be;zd9VVrD}i>L4(L1>;@VMfQ^O%c ziE0$lvCLYl6!(EFFKf#^okiQu1(vN)1~;~gu=-_+Xpt#Z1YgN73^I(Fzq0;ZfdOb# z#mwcczgT}_(Vv8~D<=?0s5u!uOx@2^4gUV zI|TC(>r@7jIq38~>7kGc*yJo}I55N&y0FYso)R=;L$T3DprI0-TRG*ppe+{p1OH|B zp3=PfE%yUr9lt-Bss!!}JZprLTJ#SmFH{9tentm7ed0q~XW=iZeibUK5%IHbTufBC z^A;Y)dFp~0uSIMSV(KXIy32xw52Fx}&36Tq3&~>Gv}rVIu_Kg8^BIhu-7f$Tm3>=; zklr$Vjxh*@GxU&zER&mUJKM7?SYYrl_U8%SeiS*6e*Xz-sgNM|(N@i+>cU7Rl)&Wq zp~V}INkR=8ow|Ib!!KY4nJRjyDIBTYR)ycvx2y zG;6P#sZvDL0{BY;-d-g0dNsf-?kmWyr+k`!&pzCbrPW(vOH3q)I39{#VN@oGyWGO$ z{?BoQ%*SbB9yZdQ#j5AZ28>h0^_~}2<#C{z!Ea3B7!R4_WmrRFX`!5G4x$UF5^zE7 zgju=yHyGLSHD}c>^ph4TicK$oqX3Q5Jn9Pdep&hk-Ce=r^Skk?0PBbNZYLNrWpsDl zS2KlQK2;k^cF*djpO9JK17ChTwd4JKBLDi_3)eFGq`6OH|D|iSx*lBt++wQBl7c$Z z-s}B+6siCJ>sSZzY&!LfWK&Hu*Po$PaQT3`p zHi%WJ|7lSzAAudpd;(jC&DAKF%IxCw0k3ox76j3XY)|4eVWCa0_T3(h<+{8M=+BJG z`olQ<&(rQs{V}0CPmzb$wXsOQmuW*T%+T$Y%OevwJ@y0B6r6Ys2^ybFss#a;b0twHSTOVV%Gs}G;KRm5JdqFr4F81>rWm3+*Uie2BskIkucN9A8={=$rpgOD_! zz`qcSBof(tc2Iv|?eD)Tx)*SkEV5aEiVgLOPd)Gq+4iZb+pf3K1yJQ@y5Zg`9ikH` zguiWE&2Dg5BbqcE>UKtE%sdvsO%qOjY})a;yZX^$Rtk7*+gm8P7AXtz3a1#FW~7XG zLfL%pUGgw-jtxlaPPP!q^cw3CpZ=l$-#hX+4jTGEpacNKe=!{|J9Q!3m;>#4v)vr1T&4aB_}bz-mg#i2a*afg*VWx~ zxVCF_kA^;&+BZLWpVS}V%AMJ8CN)0zpwR9u5l;wA^k&^ik|Jb~t{IH&*eH3-* z8+v|=b8_h*l1dhEg}UH)JmGtB!Ybf)A@s0XnYsQOYhft+Hq^zzd&Rgp;QE)BYb{aB z3dsMiNU!!P_p$Y7yRAEHK^P7-=onr?vY8ZVyE!K-Bcs}k%Dmxdxw@Bqb-*2J&kGsNbWY)`CV(o8Bni4J>4@I$YiY+W1 zzq;8JUHdMN5uFz4@t1vg(De7(7O!+3Ty)%6K=IvLQQ`F8Xx_S@8xY?j-T*B6_%wI^ z=a3^J2Cl0ub?AU4!lgE72JWRP1+fhO)&;CT8ZT16PHcWk7$R{fIbBaHV4UuLKIY*? z1O#B71Dbe5OMUHcGz03{vtz(SaK-xs2r>Xj;1g`Dm5nuc^fh!eXyh8i6Edf{9NVKC zHObJRnScizB{kws;M>$3QUbb4wPuRee~dqgw9IywPU&o(*LayHB{=U%VsPm*iX%wP;zBd|2^{()GJ_ zLSQ;#U3xmmblh(FueX~rV*NH21wO<&+3H{WJe<5a+!PiUkIBU~_&w<#fR2)?yq4#q z#bLT3fS{aZMhKai0tG{JUjcPXMdQpJ4_FO*A_-$%76-*wQ{EcDq7^5dH`WHRAbn?! za7EZAy7)aWdfMYFn9qa6+)40|e;{K-&{UdFC`D zfP>%gSeL!U9QE*i7=c+?)bziH2CU~AJu>Wkex=B7&3>JF>2fr{mr+g@@lT#QsLajP zLkC9k2VB@dT$rrUr-n#!L8D`UnW37WmY0nq5i}YGE`_qc%m|)zpu~1%#kUEQb@d?U zn%G-gmpuh)6r|8qOT45g!WpdaUp%YXV9>%ru_ch&9f@+A=IlzlQOz&{smu}>Q^4SB zttluqy5X5UXOw9k2zICL50V^q2|Y8z@BMfeXZVPy81o@o)lJkog63&)6@wrEbDBnkN8x>%^R zCX(rTPjX#|pK0PwnUW*<`B47mL?2krrtkMUp6+QM3TSm}xy7;RKJ3p-Z@^PLXbe1N zMNg`;4@D-%aQXkbJdyPQewk~`xJ0R0X#5D1|BRgb6w`@g8FpT$KrE-yQOy(YVRj!1|}o`K&>(kgnPV7s`t` z+3~)S1uTdgq%4f@4R%UWXi6t+>LX+xH%0E{mHO*X>Ptvao)R`Gd@vJr*s8&VK1L{4 zHm8QOXAHRB?8P{L==fdZWnq-YukpU$IN!n&Ar%_HiB+Wd_Jp=*n*uZ#ZOL zUWsJzkv=misN};OSO#@lq_7@O*csZVsr2a#;>VKIG*{J*yY>sma}k{5>WrVDW_-!0 z2fS~dEBBZRW1KyI|CoA}Lc{=5kpBq>)_M|nD9v-M3_7Jh^xs?Gf zMqxlM%Lvzkn%}j{?+FG3Y$#u08r{P2bbY6K)4cXv*{?@Et|m}oIxlW&i|T|wE8t#zRi|CYO<0lZS?qbV=v&TgZC|hIZnkCnoB$>xA|?C zgpX1mZ!+>3!_~S=n#0yODOCOH$lbVhk7p`JFxN?UO#VoD2E*3*8Wq1bdE~O1A zv3FxFN5_GNVpn;aqJ!FM|E8ggs^G=7kL>n!F3b?iU=O8q!5=cWhbl&T(um8pJ8w{k z6;#GboVI~GqVPGFX49o0aux?#XuEeTd!(n@b)T2s=7vced4_uZ=I1wa*O&@lG{!b)@k(2PdthI<@W|eW~L9e zUuaZ8;TeM4A}j)0aWi_4FGhdM0`fpWq7o@-$>+K_iA&^K-O{~0f|_wRGX@VW04oMo zTS})~G2O(6gM9sqe!XN~Q?a-SG=Hac0J+~DLeVR0y4Fdi4VkT^1Z?)+3pI_{-u zJB?Qw{az5i=g_{pj1|}~K=HcD1}kMevf+}K63_93L@#F6kefSN3Iu4og@qCG(dSu~ zyRXmtE>~uL7-a5oxpgRAgX3si|BgV{D0$>Xyk=Vfu-NG&;(mB|wQw0Qu%qYSetrqv zAVA`dd1ybWe7s}n8So;MOS>@HxZis`31;;laETH7O4xsp?{M)%qN)pYgDf9G>tnGcHqdq&RT61J zh|#AfkUX}9U_K$fH|6Coun@E|_0EohyYH;3wA!W#HeYr|4O0m5vJ_@&Ac#k|bDkZ_ zFT^eO@6bO^+$K{oC%!Z&V2bCYVVw}x98d--pqd)&xKqizCrafEb;>g2G7{wTyO($+ z8oZ?QQDR(hl0an_i%bzj4&XVa@qcGSp|H2=t+AOa?IMfob&DDILKAX(vK|^)bgC*d+@ER#b;MhyQ%$7lpk_T^VU2sS=$|)AG_SFlY zY*Xx%Frc^M{D*Vb`eW}gV_NI%Ld_@CF`tpuiAeHTVeUSB7A{A`#$t9uGsuqeDAYE{&4kslgrDbP1hoA;H>$GC?)xp zqIX)#hJ;9p^%c1j`D$d{Fv-W6<|x6B3(^mpeTQ7CO3R45Fk|=t>5veA+?dfBd0zD4 z^3ji$Kw)kFAgYHYAM${K^2T+5Pvv2iAqT$aeQ4=woKfu;qx%ECg$oGLsYk#iuGr(@ z;*yQW!u!MVy1VTc`J7fq82%oEvAV+JCdXE9mk9&B6aQtW3Mxab;$*VWz3sHtFN&2% zG{j>IgR$`$58KiN5mUFQI6h7gsds+^RwtM#^B-iP)NMx2$28yL{b7agql?IAbSQTW z3u!^A%r_9{+0y60XNxAxFKXIlgTq)K>l2QRcDZktfwMwzc^$DSX0f$Sepwhu1A)=u$Bp>j78`D&E!Q@MCa$&l1 zcm*40_u6Hu>mn$Mlhh6~EsFk8O;gj;Hb0mP&Cc~MSIyB6MD!GBlI-hPB=k;u#kfRY z1t+OpKS4p=1nT7bV?5vbK2}yCsrlHKl5QRvktqbD|6DNW2i%W!l0T`0XDfLwrD4HF zb=rz6hG)Qj@Rg@K<;XM)Sv9zuR)yDku+@8ZkBJ=T7OwJJmNy4 zY`SL2%B+O>p+p%PWdT?Zxs5Mq8qY<;I~`i48_%1FG!p4$1}X8%j(!q3^;Gi_i;GVO+^G2Ik78vywx#Pb|Pk9Z-*i3htKRd_qf!t=X3O8;9$Db zuBCh5F4jizYrby|CC2=2wZHZl-e7fpk-JCTuU)co)PZNA5Fp%Oi0C}X zz?A>s3Nv1Lqd6n3Mj)tB&lFjVg4)w4xoWk$l!AxW@7Q>byH9}tK)yWE(I>g-x>^$h zvaDr!tFlCv`~Q5NvPrTD>`oi|rv93)#@4?0dFD)lDQT+Qb`GMBt-#?%c}T8c6RGoN zm^nPSh$pfYz&pZk-wo+h=@B?|WZ{WDQO_c#HZt(P4=AU%+YGLc|FsK z!+DDH+Ps`@yT|Yft5qba4*HodHX`}5b2L$f?@qmA_%cgu2>L>?|GnwiW&lvgyw;Y@ ziVdq%79xDguD+rq%`FDo35XJcI{LyBPx`BiNGM6oyXX7_9oua0hGi2M+=R_nY-2=R z12BaVk@CG!qR0`4A8d4oq(>s0vbXjGqvYWjh`l8!a$DOmb+sjWH{|AVe1%`B+q_13 zW4_lj63*7i)Z^!|Fko;w2QwTJN@H#+v%OZ>fTgvkB=kFVJvCQ4SU*U$|7mez8zbOJ z1E~zO3Aoiu6uV;TVauSZmqm~Oh{%X66?b??@d10TH6M%;%^W3VIjgPT0}~#EEs6$I z4l6q*gynP-X)<};i&R!N%gDH*@#Hrfgz&#IN>+ z$#SLSZSe7M^OQ1ro3S=4&SGXAAz8oj!?WFXbrBj0seFj#@FPE@AmdLMfK%p!l#)kP z9I{nQxVYGn))&v*xNC4YGd(s%pCoemVc}{c z*yDod-$Eeu!$}d&Et|;KjOK`9&;t^Gi9y#MA}258Wx~V@T^2c0PU&n!y)Bn3UHLIN z-}l{WY{~&7p`wC!&%IG;`JmLudQ9ovb6IhA0bJJq$v&1ag_ITForD}}Hh&YHl$>qR zxs>;$7)}ss+*e%p#pej^p!pOR?g}EWm{h_PeK&GoJe2H%_(vH6WFb=v84FWvGJm43 z>}X^;TNc8FN<;~%qoV^MS*h=uVt&ja$ZNA=?XCt-(V^$mVh-&v9j>iNR8e3$9>Sei zTl*qu4epmI=dq|l1}z(CXo6?r>VFc=6$9j~opa663mm#Bm{t(HK@vO|kc2>Z&ljD{ zR9&!5cDyx6c-Q8)X=sK2COIaMw;KXw%5Q+@pr*N~NUF|fG(o=4q#C_-BKoIU50MXg z>8bMglX*|vii->mUH)cy381dWI*RH`1^=5V?pzgXOTa?p4#o0sWJ z>#_k`E-~x(EG`8!9NCf+f9#%XYP*$n{Zv_#=&-XL-;v~mu-HBfEiI=Et`?$Ap$Pij zL(|bSud`^IF}|?mxY@f4xSo#V*0IvIgQ>_sx@Z(QR&1aTL$oU1v?Gt^B8~UQLdL#f zFf-y78{3okN)uRe&@==atzeTQSM%^@kh9TEj6OLN@g^XGRujnPS_kEy=zi*#H0|R! zU&vMO6;8+^?wnkjJB#F;&#YbtN*o-Cs2ekThp>LQLJEU3M~>x zLsePiP`;!^4Shp>-d#*(=<(BCzV1{M2&E_PMwsQGj+w)3{S@B(m3M zueUbCWZaw;;TTk6lKe;yR?-mMGn{$OI&kU!D(Jy`-fo_iC+ZItxmAY173*9kYV)rQ z;rVb(C{{rimglAkTA>tkv=+Rwe&>U)ca~FrKw9t6ie*C3-zGk&Ch79Y>sg(JN`I?QScYM?Emq$&^X~I$4x4 z=)GvpP7u4M0_0MZ+jOJ+ry3zbcP#dC?#b#6!%tq&XQOvfR4 z^>t1W)n77&5K5h?s8{-| zDx5!AA1yc4>Afum)C)d(?l#nb=d_{q7ByzhJntq~J7F(0d+wGsT-w~Del}S8|A&UT z{h-?t8EM#&Ov0IBd-!r%m<*nsPW#TYn_Bj4rL1CdrlQD2+akc2u!AJvbH{rDUl&6Fq z!916w=vcJlnz^$n4XVt)AyIF^Wj;YV9LXg|5mr>S8}>W5nf=!qBTBgF;uT5$RYsqB zeEp+h@6Az14orK5@)5v>F$VJl1`kU$0-PU^>O}X3Xmyq-Xl}xNzPV<^%_*!d2|$|i z&_xkslfcgTZNuloup;mkV>L2ZX|QQWE?}rQPQTD?AFsl5r>SSQ{(UhM6fkj@WSYdS(E*tfwpkMx+}^x(i!5h6=ONEFEph3LZQdyC4E?XN7s3MWNH1&H zMCY-btAH;Te1y`Kt5sY9LYuN5eHb?VBAyv~=l(>ZlG!B+% zZc4%mQA*Vl3%Z4VP=KptWWI6LtLJj;DMWE)A198`TvoIHW+|=6ePy JL#Lpr=1k z0I@d!^01PrGe9`6Z+_YUiE^VkCwMCnq@{oY=`#3AKbQ8Kanv1a+}V!o8M}`8yO>;V zNu7ii^#54wKZm3NH#+QmVa)y)nbT`|^8HsDyV3bOfZ~(dkqJ`TCx}kI5x(?cp-D^l zPZKZS=aN#=3fteA^v2fGI#>b5O7`wRBdMl6af-YI+2o_)#8>&Yu8ljg?hwY$rLtD! zxL`K|qc(KYNm?}6byI? z)Oh{QIS(GH1?BaOb;I4~RbXsWjy4XnOwN}Ix+9clK$>Rr(rJO zvz#MtIEox!kM|~Xje--lT{-Eb)9Gz&wZ<5lNX1$JYd69M{F8~R5d`ADG?t^CGE_D?g>fZXE6miM#Kgg`-)*?gRH8ox}Wio-q)E+ zzXM(@T7D(?74jIbzLn!#<4u&JDY$zC&%q2HDUV1zjbD%?09Jm0Jj7yB$=}L5AA<*^GoRxDGgGSj#LzTR>fYi_F1~-Q~?L~KNFa90oRQ6A!c8!v> zGSm0;4Tybg|Mb#wTLBZHFF|V&1D9!8169M-5kS1hJ(w6Y3JTf{E2^Gg3GxKt+jmT9 zg3lJvJ($~iw{xN@UtoRR7-x!O+yLj52Qlpe2aie93xL9GkoQPXiEsgAs#Hr74YO_r zZoA+5Zgg|iVup0kAbdUpMvFJ>m|z6z_j=~)bvzth6#?yf`wX_Q)(-8$Ufa?FsBLjR zofvd&pJDg{I%&CAX8ezZ{{kqQFj;O7jYcqi#?VC2@4Ne0sK`7Ip-`}m`H77=`TV`c zw*O0+F{=76oPuc7O&;U(3Cs*x>;;l9UrMk_%KH(}vzitT;lhq;-8B|9wTT+Eb7k!T zIF<4031kzuYVKcfiqmrEt#heAXU{Vp7dEyerh;r%)}N%4H#4(N)a`(NqTc3F>yg;V zy>8cns{%1#u$e&t&CHmB`mPRj-%mRK(ElL5wmY8!^Udw;-@&FkmHMx%_9dZ?=(}<6 z@Egr~+=S1>F-5PNGL>cZe@lIak+_P%Z(f|X(ka**R+P#%D0Rr^u z3R~9&*rn*I;2g~CocH!zuYJWab;!)q)N2~5sQ}wER04VQ{@uNQ_Qx_F2G|ikT22pv ztFlDo!2~07EZ2f0*R4w%xZ|*@*!tN@^4>yuVS0@$6*_f-yd~^xIXO|)8y``vO)Lq3 zaZ9_YbUuf{tP{N4s-l$Zz}!0{t5B{mF0%{IkAlJoI%I zl$F!rF+Q*}(^0nZ^R+hag!QZC47jyokhQ_k{*0JfPT$js8Jme)U4fb34ODqX2%v9fNg z(Kz{59?I4pbj+dFF(j$R%y@={kU&jnRMTjAp_Xf&ESb$f+pIK4wmk7&}|1nwifGuY{N{u8oNTQj%8i9@t z2_hyCsCY_@(`x}w*4^;_PEFe{A3Zr=V|>B^k*lUb zlpYkLkQcpZCJjjkU!w>BIsRzi3J^G?PIg{-&q- zl`e$9(vFX@z&$Fr*-L!4Xr3LuKR2xKe+7KRB4@O{{#7Wssz3c(9<}0gN~Z?Y&DE4| zzR2wd3y(okVR?e=g!J&*(ExV@Y39)Sfg8AVA&Es-Z1*}Z!6i;sFu=1!QD^@pBU!t( z>t}1Qq!x4afCg2UrglFsKtr3QKPSUmJ^-x2x0fxL(W-3|dwUb_@U{D}<`gcyU~=|# zgrI;UakZ-d8w>J(0+_$Po-Kvg=RlUkulXVf=pRd+B7SyVe7{$r71=P;X(<*&e(9{_ zrCh>^8qc}z1(w;RwREs|ChB0G`&L@Vw5NS8r^051Kj69FZo4(e;qwdPB2LYL_fXyr zg%>DHM|>hig7)`Y6=nvEX57$(oo~pTzxcXPn5;)osyQ`%7lh@LoPEuTULq^fGL0<~FjDk!^&^GFyr{|k8iAN|95~Q zIPvOBLAAPXXI0v*oPWaS^Ly)3F648}oa-cAon)7**%ZI9Fewqx8aSK4ouzG*CkL+? z#+>E>;2mMlb=DEhi3OCZb!MB^3o$mvE^>aC>z`T9oTY+@?|NHUEM30%EBU^J&v4{dV zD9uGz0JVaSm$z7feZ0O56#Mjj5CW_XZ3X+OD_f?7VhxsmzvUjxUEpVq{!!zlnful+ z=GA-JkCoix&vuY)=F1^fl7gstmT8sj0zO11K&f7Twg(TfV(tSCP?T(TLOXasCnY5d zQm2xRRRVYP1+c-AD|LsWNy}q#Ck`qeH&`-9%z@zDwhB5Dn+8>yoImn-)X#)buCf1W z`Dka4!duBYr6laXjYA={e3tu%^K$U$2+^MtN&DVgUK5qH-Fl{^x?4A#)c|;~@cyA# zzoa*N$8RF5klkPFWwrxD804F2bQpx7H*aC9$b|?>yV(VYR@DJCUw)4uDIGCL&HJ{3 ze!^B!n_6Ki=iiO3BHYLIxq7DaJqlP=>~r;Ct(MHUF~i&fP_!;y_W96zwF#f0?r1V6 zxEg$~fByD&`1u>U$@hN_bO=R+dSo;ie;-xLUs<9l-a<34yyCHPo+A6UDkjV-1az4s zTs``JM;W+D4zg0pK87s^=5Q>v357>1>u5T9gM43U1S658WvI#r!_cD#6L1eHx(Sln zm(uh1;+b+eW;8j`#AIJ0b%&&B=SsR1R#Xv#%NMc^KSj3(`)Ey$TH>FW0&8ViB8Rrqwp}cXn3!^H1bA@A2=sE}(Iz}t zn@QY-0A6!G#FV5tW|%^}T_Des-*379+TDBazi?vX;T`T-{q6j1`F#nlcSs7EAFIZ; zk$BSbFu(+6`N2^!@Oo|@j6$mx$D%etgoH$On{Jc`ZbD4NDaQIaO_ZjL9aImWODKL# zc)iR_7b6`sc3_9X+hLB)dj3>xLYFG7E(CJY-l_gDx>A(`))TOhA3=WpCKHrv!wxJE zv{7r5*&&B_7d&lU4py~>*leaj%__pGH}xl`T3O{vZ>Z<2!H%$%w4SZ6`=GVtb&_~F?V{OcG4f8QwM+w~HUPRmqQig@vZ6vd!Z$M3NZ1X!olH4q)-2_)t z?-UD}61^Q4&~mK^e5?7MQxt?+8-IyZdm>+eka8?r7_qJny4#j?ha#upNwRmA8#vYq z5wV`T_0_mB$qeKmAk9q9zY&7)bJm>a$z3|^ip&=OgRFOdEm3=R#gtP6g1*2h{9cyw zR2@uU2`HMk{|r6f0M6qS&4`M6?w%5FC$%RrY1St>%&_gN=oZGrTL^J||KuzE+$lUP zj0q%TABoCdnmu7X!a|Ua;G(Q*PmCF@FR>lV^Z((Z*CAi%7T$NDW1$!iZ<9zNZ&*MN z)It|8j5g;|Uk~jKb`{^gks>&}uzB0&OOIKVa97GV=PGE^&lK|(Nt4v_R2FY+%-GZ(`=GFu5Ku)bJF}W3y zAWQP}JOzz$S{%*dAoc3+{+VP(T{eY0LguY#+C@<%6Vw|lVAI}5t(M{c&(c#ghL0wC zuIJEwXA6Uej?Nutn6FotMucxW^?d-WSd;dH6sOAxWGB;7fgSnO-^0)WoEp3^?V0hX zikq^)W%-k1W-ZM^os`VV(i|YEY$d8GdPChA0 z&lMwRZT$>j4O6TNKvt#GOXiDe_jvUQO%WXn=AE~){x9mQKOp2+mme(-=R4T?`?!WK z^=uAZXji|#@EU@I^!2eo3fhssA&0Oq)qT!^2J34Qhappyr(T>0a1ALHtqPdV*6@!f zANb2QfZHmbhSq?q%bzpLGOwuzJsVHRiL7A%2sEU7>m=$^dOk>H<7ZRq$DaHx`5VcL zn*b1k;qG9 zKh+>Y#COFFD5pRBApbWo#0b-{LZ}hEvhTVXm+>t_w5(JU_)||7@B~x^6DMbLJ~2mX z9atMoa(t95Dcp>w!$eCWeu_ei@45X4jLNcqk+#hvDGq7z&+@srCB29toJdDv=-ry9#jzx6+k9t+C&fHz@T+>_D%`(QSB7~H>asSr*Bf4OHw~S z5D6xZ{ynQB-S*5LB*kF6t51qvvHIRi+(g&EWYX)fEhBh}v{FR^4W3fwR}UC4!T6*F zW0T=7un411HERfaYo^xPv)U`d!@VeAVqnnYiHw3pwn|hX@o@x+b`D-5CKI*;X+gL2 z3LQepZ)P6q@Fn~+P+bz{B?FQr*TFYUm%YHOD&|N@REs~qP$Qt`c~2W9#Fx_7rS6ox z(JyUlw&7Z81r2=@xpjiQD}!DMZx_b9$iY!}ZVfWcuoMxK(Pk0Gt6(@3op^qUfs;zQ z$=3QIM+tjyi`(9tv7NPA`h$XC!M-2Hv!2A`o!orU=Rv8;Ul1C#&C>Hsh;aN0x*d=cF zRNhG{{b?1aScPkZBmpZl&_zt9{QF0Ys$AW;41S(iULwWYkD`g?TzEWHm^mD6F299% z!-Ax=JC}489Eu}?%E-s~C#hq(Bqn{(KdDV2OTUvae;;P;544cZc>77KyB(5+tNCYg zby>dw$!mhlIQgu)MCk8y6IlvmKZ^Y|2{nS&wzgv~5y3LERWscxNLfZVGM5ok07ZE&h zYnVbO>-scb;`b*eLC`e1TB0dRxk(lO2YQnNA*{a#DLZ0R;#L?ZRBG-2x4pvrfK)@! zsd%VXM~P{~Frv~a@j{`$LTS2C9gasWnt01L-Av!^Jhm3OLPf1iL{N= zh8Gn{UI~XGXshZRw`qYZsh>KXufvd}P4ZC$}|GUzm$zAjaagrAc1L^nn!EOWDw z3w=3`Yz%#mD6H92+G*x=8UxbPDeTpTA`O})^po^xNo{0iZ-bX#zvEO1J)599o zrr+90#lsoXUrswEEhT@5jsRYLnWD<$%aQMMt?~;@YHnun1vz$V5N_Q)Vk1ied=TUkxeKa*{#%LVF>)!Y@C^wo6xm+ zSyqESlcEkL5|g5;zW^qabb~$#@`~@DdzZl(mQ~49Ue3#4I}S!8MO-CFx_;v26XZX= z4;*fkzrbJ96021go#HHDladY`N-LZe6@L-Bg@ioiqGgWvJRb!ufgcY902J3!fEBFV z#;{rIRlf~pda%plB~fQx@XsdLP6^2N{VvS$_`N%Bm47uG&O;LZ9!es&U*|ximf^;$eNzaQG|#_ zLULRy3$1O7FfT?Z_1EmJ52!nR*(EHV<^-rS_5(-MdvZ@r?Hn_`sZuP;<#gkzxsLWK zZ@ujmR&)1x=+U3I3F0Al=-_v0*0ETzbREIkT6u0!BtDpt1gy@TizE@T!VE9OHkzCr z!R9U*a}apYr>#8jxNs1Xz#;mHB@L%x;o4)>;{2FxR>@yyTutj4NwBvQE}rNaZ<>xP z6I)AWI?dT_9z% z<0eJzDt>0WRIGS(#%1ln#^h@L;_>}dMd7=BSjjP=S!Unm+e)*DYZRl7{l{gMy>rTs%;kN1kB3PU zEZWhAFm-D2GK!aRc}m$51pHEGG^q)>pE0bYyUJ}TKk;%}@Xq(6b0(x5sDH3`HW+*Q zag)FMQzUh9*yvq1hJB=wudvwDjStG^a={Z8trr29l2uiXneJ>8gaP7I|WY)Ay9v zv`#yFN+eKu^3!KEZBe#Mmaoji`-w*}#!<*ki6-fp&rAK2>C*^B8pgxTJ(2lnO& z!$awjh0%Wu?ssR%{N;n<&t>U`f~@2@&>pPqjN)d}D(0 zdC|g@*z7K$=0F;q1odP;4v|iE?^niSp|9C#V17EiLQsU^3;0nq>spyJH2&r{@BCwYFl@&`M}F_Lec0; zdy=OH(Q!GT=r1twIB0aF-{qqB6)uBVvCBoCyu_X&)6m}=6niz4{UI6mFLw++U zW0M; z%GxjFWg6{}aZ*e(PT=B(_}m>09R6H+331l+vAhq2PSuY-9F5Eq3hCrTXD}h1*zNXA zojVv=rB^CT zZMRgi`NClbSLR9pz)G)!SfuGGAz!pZd;6UPxsW&Zr0DGou-C*u{5htS=hC5gl*tgU z=lS4J*J!)^*^VcjwtJaC16AhDZcC>r*3$vXHiLji!n=W?N0Az;TeOFc$8*Ib@8f7s z_{AH~t^Uj&BfkflyP3yhaZ?YER{>YIEfK;k6;wX%Mi{5V5_?VVLRKGiS2NxN;&6B8WJZ>HISBkGT~aEowg8;4P1S~V&~ZG9WI1f z!chZkUgVj#<_9O3P6AP>qu#u8q3Tm}RnB3_`N1~@&`Y7|7gvIs5#$mip>jD{kc%YM`0o_O&j~$<2JK@hyqNlhzLF7 z=hSl-L(vvD72b#u3-zJ&eag7;gVX9+0t)-03*p7VbYO>y*cUoRR{h(w|Hsu^0M(%_ z+oB71cL^HY-QC^Yo!}DOCAhm2+&#FvFWeo11eXMtzjpRH_ulubC<=;#n#|cYx<_{t z)LT?W54Rt*eZ0fmEEedT=QZMJoTDTUp5H*(<*r3Hu=M@OA|TLOp{DfM#oBp*CKT`m zR}y%YcOR)8rq%oA&rusn=fOC&#vDd#l^@q%jy)CyiXBqTDJnhtbOFz7uY6!+96n;}7L%8)p z9mjtI`+lqBPn^FCA3cg<;`^!#Ag$B<3*aPl40PkhGw^Jx!F(JzGSFLXE(KHP{n1E= zr)djq(0MaWP$4yFoRy9hZEPN?4(q{%(OC~#+6R}|a2rH4&Tac*+`}qZ#-C_c$X-fA zCisiPR9KH@rAU9~LW^)a;7V?l#j9e5@k~@glfl9iq{?%bMKlra7$JU?vg=g1AfsvX z*bk6HE*0#XeKfi;Dvv}iZUp?}Uv%Q7#b^-B8dV7>N!$U4J(pQY2fy&BtNU*U_-&3^ zG3av(iCcNy{J0QMZ%a!j_-Tc=i^i#JB+jkhl^nqbhRyCG=WsLlwlFi#-RQ28aXRg%y;GfiHp9%xPj9;Q`Z0p#BB`*-B?fP|^b?C$HnUKs~xI z`TiL3et#(Sn>_fik1Sb6lTT31E_WdwH+r9`qF=fZ~Y>8L29<5qH$ zS?px^;9uWIT?P3KS{*rN0C!O%wvoPnNCp*a$n7*oP6cqQy)5%tSVN=c^7j;?79TE| zCz8WPTx7xwL-Nj2+z~fC9Hn&7L4WW*mv5HlA`DAo z&4-)z`jqSAv;Sq81614_hTtErfDoTcKUh7F%i)h}p>BkoKl6T%zo~?R_8YDCq_*F& z`CTV*&leTDUONrLCMo6AHBf$h!Ds6F#pm>78Inn77?}UEvmM+0jw<*x&UX`wfzWpP z)VfRM|C*b@dxPYAUK9|?B;K=q424!b2@fzizfQVztu% zS5s2G*J&S*vT9QGSDk7EkJ6xzYh>;Y%_Q`GOml{t^ogg}GDNWlcomCso-Ai1zi_w? z-*Z98mEq~!3Z-=YS)O>%6;KSA?{{qbdz>>kOOy?~!KOSvzZc6`G3A-m6+TtZBWb-B)GsCA{n*4K1ahwGft|s@iV&b1~!v$>C0X zJ4D0ZjVrs~xB{qhP#7V=cSYL%Pz8W(YcP)t0Lo9{i8`-~uKYRMYG?IygEKo29iI~e zklWx9q6PHtyV7^5@?T6BfkB8tp9TdVEFLon97HdC$GS~H9e$5<9!4-)E9Eu}Z(4ud zna(F}4*%QjBKpa+J9eBqacV4)l*|QAH;sPrGSGHD4h4MB4)mJDET8K{k5PJ+!g;3& z2uvW;K#fOi{ja?Rp6UiwznzY-u9$pzy$0KMZ8Kn{74cRXq#46!LE%DJ7ZaZIPlS!Y z(Gfj!;WSerx^_z-nW|Zy&9ZMLM=ABu5joaVT7)81IdbNDvpS8^Lb&YThz=<*W$Cxy zJi@rkL|Q39Hfes!WNZoKN^2o_V^>-9u*Udy(TbiTR}0W*OraosszMtXi*mAmX|1b1 z+(ThaBlpu}rzhLynZ;yQd8jUd@4xwlYSxA_0Ae+b>Nd@6MEM(1S#>jDmNp1Ss+1ol z%WgqGLW0u4+u^wEXyCJ{ddg-2f!Xe<JP+u?1V7-uC1wnE+) zd|_+RL%b2x2t-7rxS0_|HR7$Ri74i(?~+Atg``mFY}3!XR$AlIw{ zZT8?^uuWFi`=MB?VSsce(>67P=07Sd7r%sl!pKojC$t){$g1PtaZG0bq8R)mUDb@+ zY{9)vUnXp7>{IWfJ!y&a_`#$L6ED?gyl{#8uvnz25u$gM)iSBD6$M}#)(#pPSk=v- z5rIAK4Kg&UJc6_Sh|-w>n%?ny#MRN{X~Hsy(1i(b(EUR_>M}|4ROWGO^%lwoca&-( z@x>%QE-6Co74=CLG-vF#m>j-QCCIe_M=*8WZhqrS@Saz?NCSXA{1DThGB5*Qp4j&( zBu~=IDi@3{@ZYPa)A4Ekm3_0HlG<=TW3m2zr^4t}Xre5>fO+v#|6m{iFQv z!Iv??3+l1MLI7~=hfm{RS#ISx{Tzoytbws3y8k634Vjcx;Cluu0my5ghg4el6Ummwji8w*T1EZQ1heUlXnwePg|-2kQNm z-keWUF*SOvrlzK%P)nqs$)RfSB^#}dqmPemKm+3B6Jb*j$NS0=4#RE~C z8a16f zk@owoPqDr_RsqL(WJ<|tjuw&?tZc9aw>`hw3c7Rk zN7R5DGmHLY2EIY{P#_D#r}#of8Dr0(BkcrBoxo;5Q=5UA1D)D|tc63CDPC|Lt}#kN zBpD0R5>^FA%XRY?0CuSQP$JTd@i&l$A+_>h0Jit@Cl?m4$Ma+{unZ5*vB=N=ekJSXjw!2l8&U zX34bU+!q+=YRg}wwVucST3N6EGX-%*UwRr!b0T!^{dI}b5i1ZbHeZyeJW_FH zvw0OZi_oB8n`22+^;L;Py15HiBYeEF!Y>&vK8B{yjNP*Jz9QqCAl-KDSD+uNYl(=~ zQq{cg&lTF0#2KBAxN5vKapP{U}JQ5;7I6hfr ztn^(gidWFiQ2J;u;FtR=YU#Md!^E(gdyO@#^;%L0soF%I_BvyMXto5~De?*PuCVfE zB^w*8t!iiScB-bDqSA^zP4%E^eo$>M(+OFjTJqCn%H&~Z_3+zYL-F5t9SKGwEVjb~ zJ!zIA7>G?2@vWT=OBh`jRAb>Pg)K?y)Ln7oH^pRE^S9al1Jbryjr;xc;ufa~d&dLm zq)%Tx>4lw!Mw--)&|*z%Jyhf+ljGO1`FOl&6fSoyprdE$r&~>*0wN4AFtXd7yE)^Q zM#9$3dtKO;Pw*YmU-Ogo+|)Bao_?wyt4CM<8*BdixshmGT;3scR{t8Iy^JG*`mhSw zwU(7Fs!)2ZLPDkZk2s_)A|j&Aaeu1Z!1svIaYuY&Dlk?IB0X^WEWd%Q>VA#%BK-1Aor-cHO;p-0PU**oSfN$>$7e8N$FNXOy3~Xh{JnD*L*_Y|U%4<%au(;p z@!HINgs<}X&2&t3N*PQOQ@LFYDHZY;hD=X&(dJ?UWzU)6_8dOnu3;HKRtP=Ycwy5{i`H8 zZrm?ggvl~((PTv|&=P3Hd}va4M{4utvW;5Nh0;j1;@>gVl1Sl$%L~kRF-RMozd29nCajWLz_IgdjjWDK+bkNw!u(1*3bWY4N9CvrOc!ec33DdS`y z*SdJH(4eGj(wOvC+-Tp@y%fAE_rFh%OhWd-^taC$`K|Bx2o?YQ&=+3{dRG=BtW)`O zSm5IB`dww73dt{t$r1Pz%doN=P9%sN&mB2PSYJg`p4U9cb?JZ*L+p(xbp1GbW47~Q zqyJQ0wd7SsooHA$aD4gBr|)s0vFdTi#=_MaIOBU6?YW1LAKyK*StRsN=z&AJ<$%M+ z#%3#k_-~GViK>IOf&}+Rld9`+Y03?RHAfX~6d7FEt$wJ6Eklm03~Y@7Qt%gXV6{o| zZ);N)L0K&-_F9djT}6t6J+w~+i&Rr!45M`1Z6-)6>+(a=SA)$-EP-70X<4ukR{+V) z_@r#j+MOYK9dJ`ZVN~rqo8=#Zd2BcZ6pSL$ccf2^g<4t6G$OBulxG}Kwe}*-nKf+3 z>YYevykTYFv)A@n5V8E1eR%w4CU?lj-cn6q@#~(s$^am~eC}qP-^;zpRjO9)p9oBg ztv*EGUsWikSKD;X7tLA+k2lGl*Jts2pt<}5Y!CV^%Y*+?BL1R~R53_0&}PS9{*17) zUwY{=Sd?38s^A&*(z9bS@Hj7(#QP6Vv)#xL@xRM=?gn`=&F6M{Z!3D zJpo>BFyW?fOi;MO!rzBk$Z!U~j7=gIh++n^sb=<=t~?S%xMs>)9E3ir+(I?{tA((l zl@FxgsKTSV>TbD1hx&n>BcFqGhAf>sp!ZmYa33=yY!5Ob?2c^yP}{>rDGb0OPshxE z&+wA$Fmn+7)RClT&i_kx1jwS)eh)uQqDWGXN}fU14HjT2X`pf4F1CP+ znYo}&Mn2hySeVZu^O-&dYLIF!MOr^gA=4KX87w40?zD?rC8&{F^r`di`W)tK_u@|) z9uY7n>ME3(BJ88YLU`eZnC;fBq7mHH0Zz*`?w*dy0o;=KDE6y~Taa=E%B;+%96ub- zz>8?PHGD~fk>GOJuAjsQcRkq=B|HMMDgUrNX^O;6GVs2S*w3XBN7NB8w|HkaV2|ep zb_7fD|AVLg=Y!D#H?TqEE2apuM;W>bs-#(FZ+z_nzmZ1I5wey@T;$0mdzkP@u<=G_ z1q*=&Pzg5JJOUQ>ELeVQd<#EIq+nbYDri_555=BUU~Y)2hpCApr}Yc1gm`%+EqiX% zF=$}PSoTFaS7Fj)@YgANTh3`W8z5BMNo`3roHpBWBRz&!k?>g#1O#=IQ%wlP2VU%# z=1-8Fh1CNlJSAmo_RM|--7Xf#(=9w3kHJe}z}2g&|9yq1Lj4~RV=J&_?aA{m%H8z) zHkaU7Nz%BvHJlxwixLJUo>3d6yHVma%*5rfV9H=#PJl6HH`}AID#_yNRGDR7hhDvk z8OKd7n%@+s2mS5oapei7Sq^h0Nt3(7J&?@_z<%_4@mcLxPJvkMA`$M4JUSMN1_qOH zzf^BW9>f7JBvV=JRLFob7ChELsHK!Ll4OZDQL7@@{3v#v&ED!OW%7yF7ibR8o_=?u zkeQX}@(x~2qyKaJm==Q=xkbz0zmvfgzEPZdwNMBCh~-Z!)o2u)(Mz?@d2j+!Wzx6l z9PkwXCXQWLl!l;l$l@rOoo;)TH?LJ&%H%?77yyedM8qp4@eD;=04LoKl(G&P%E4C- zYUf}VMNJiBq;GwnC}-_u#E0T`?emT=CX-`ih(#q-^PqF;rOe{+(1lt#tQSKhK#$dR z&T6Qp`^Vz{?-AR76r|N_b?#=RK+6iF3P>np&4HRC)T8qFIPON|7>`OP-U}eNA-QOM zP}kZJK?xXCiUzD9l2S@4jZk$_be+MI3X24DX8ntSn_-pc5fQn?o+Ez-)&Qa`r(sto zazwFPwZzDg+h%&PqFQbx4THfYw+NYf?1&qZ?B4CJOzNXCYrVWmk{a+cTK1{2jpq9atAcY2sMMX-(bUn zvs=bY5xO3(jWgPsNHK;C;J|iENd$hTd28G14j2iR>WALX)nrM9s@89Xx#A_?Le6uP zob7YxkxY2s*Idbv3y)l|?Ed6jGotumNF?dU@4UEA>Oee|eC;k93V+T?s( zj5_xrX|lj~a8h)Vc6&d3+X!&jU?%dP!|U?{xY?gzZ}>$5FH$ICI85jv+txXF8k{%B zYxGw7(QV|dbyE$5W^=i@{_h{#J!B1_8;8k4Bxd zIyxBQZ*Qy!*sVxsdIknCc^PT@%J+~lomDarg}=SBp)Gfx7#9#jUFs4APhvLv>uVuG zs*08yKKbn87=f8_p|UPt_&oOa3{t%m374)Y0rP--U)3Q^36U)n29v^$?uX z1t8Qql-X+jC;Y|R;NmwPyr*1&T9I2`-|IxvAK#a|PCAFmPsks9TNj*MqFL9EEpbd++c%5&G4Eb#}|7GtbTUSQr zBcXlzm_;DUltqn=Jm(ns=SEoo?4}2ubeJMVxvBENg;mWZgA(2SsY2aL&b zfL8s<0OvPjzeJO{Rg_UnQ*qhQ+cNRxVtz{CYDVvGGC%^#$jbvY(F|P^S$XA$Q)&0< zG0LdHc%YBnf!0^@jQT6$0CrQ0ZGtG_8$ytckVurhCs?s{^=xn1EZJz27F(#%=dsJO z`Syo0YQ%+*6s|f`T5haXpJsd+iL=rJp9Iwz-3#Lj$927?UE+o2Hr8A@2x`tz^~p~76@=FckGBU@`+ix54H z(1nxN-(;TX{iygjw*HJ}DuK$w)Zmti&aj*Ko_D_G2pqQj!zWej6Q3$wkgu|<;xuk^ z1TKZB`kXG+DLx2NRnWlx0~TGv&exj}IzhXK{w9xdID8&1hqt?ZR=jbe3K4^NB9bJ~ zSXItC!kSwsilekM5sIH08|n3?tDniSil=(&p~Xop15Jx4f+MO`OSjW_+W#qzg~s#s{>uf}$thL}{Ml1y zLShU6`t*^*j?PV=t_{98`GZr4V6B11zdykObT)=?e|nYIsFge*#SixuB}XqUOm50P?4Z>=8YU$J{}0YCtR~OEGpA15@0``I z1U*>VXF3gh4mj2Od_FY^ZuXHM1UxEs^oL;5VPEu>%mJa?feG>WImOGX3Hk6l=4Hs{ z)vDy*?-_{CM?W)aLnngL^g+f*{XVj0;I0YJ&#bC6ys9ry$DX8nayeZ0L?gPmwoR@w zDZ*b%<7P2VtAf9^Tai%q_xNW%<%HEf=Kx=3; zhb|PtHs%+GO@c*OCPd5Ng@ zQv6V5W#T}i1`Wvv`@JM@%Ov}oN+vBut#zsJDs_}7?ge3iF6SA1*{qsHgG*L(@K3KC zG__xtS#$&ES7J%aS<8UN|IviTEJSvqzqw!wg|;8>O2~2Yr6jaRTjvzS%`0bM*0S#w z{wn1Oe9cUOM)3?3)_kH<|h`FS}d2M!PZ39V#A6@)LK z)m4vXrkGW}VmV`t>F22YUIC^LIy%~_xvr}`jz}Qt+qZ9WQ=9?LAbaj^xBlac z=gBRFsLCooatUeJmld~fB_*yt*?`?5y@Nut1v%eG^ZwUYQZ7z@WEQ|1sGZ&*XVln%%{hB^m-hUu zU)weOR8~-7thN0|D6(aIWhGE{HxcLl^_5>Shr7TLlao1{%Mr8zBK^nriK+VKIQ^?` zzO#HRp7+g7!lUEkKmW869Fl>iqF_)d79+R+RWCdJ;jJ5UK~9*oFNo7~__42>+6?MI{3fX>&#;#&Y&@|KcT1`ItK%T;*D7YV0t?8a zax9x$#VT}U2rouddbw9W5G}7-#y@tGpxS6bkYMtk_B3w&l+z)fM|hxrnC$GQA;5St zG@Nh*R|>c|7LM9 zdt3d!?Wb#jAUpJ-b)=+%N<=ell7>P%%v=79yNjNs{Qq^ChrZ65S0HlX4Q7{IG!NYh zOx6R?D*!8QzcS@v(gjTitQaLFJw4r|CWv%__AXsSnzQ1L2(nK%ISnQe-D%q*b{B8k z3ssFa(b1y0#ajsKxT1O5=VR{b!>osvOL1YZrUI2f8%kwK3T=Jp$;0gvfu@8Er)5vn zciFiFiYNx>m{f^{`bk{`y;b#Fr75R8u*VcbW?f~2c+r5{z1q=!1MTW&P|u8^OSt+WaflELjXMi{Zv#hJG@$K-?;!Wp&afW8@w{K9mW}p^{QZ{BJDEq2f zTinOAJ!|a{S{*8da(Ul6gdYZ-Ngp(3uy{3ylDREd=@y0;IxASX!aDAvgH&I_4t-HS zXNs7s(gTL4RGq`XrNPVFQg`yE4zp&JIzD z{{~X2LSc;jCKE^$(@^iCFWv5giDU8N36_*hYw;o;aU2t; ztCL@O8qQILLS`R@Yz!?Y^B&>FwG2LWojDuRLk)Y62m{SM1dv7yDi{f(TM(^yHL|M$ zNH=O)7$lH0WFpa)gQr)Q>taG76AQ*{IQD*u7r4jWeqL@hJqG5|qS6q+9}|MQcw)01 zI^c+3cVV12>|6Ji^&E$%rlulITPDik9?0Lv0X3Md%L zT_e{VA9Wr#axN$1Xfpj`1BH<-gqGoF4QnA!X(>r%opPrdM>EjSb;p`Q5;HNuuSg=O zgx4W1oC9;LZ>J)tb{joEJ; zgfZfXh2s9+6#p&k_7l)!e}uqsXnuY^?CH0p3ZPi^TYArLP`d;;=uUiYf>3+`jsY(l zEG#U}KrTE9mEFD|h_;KC4Q4*RXpinQgSPkQvxc^|Hd(Fj|Dsbzri>?Nn$=fTv@u9`xS zz^wkqkI=W5hq5F)3)CwCkfXmpU&G)XcLdZ7@`V5T^`-0W!g2Iv=fnT?hWLX8^mD`8 zr1avXR~64IRh^D5!{Q2coixAz3|_$;x~^$OSJ>^_a{%XA2Xq%q;mJhoIxd=9YB1fB zE~H3G5h~thg?V8gUQHI}c;^)nPGea-8r zO+H(+JiATu_v%h%5mT>ZJ$!5CQUKDR^>=2t$^t;xS^LN}C?#>o5VR5y(a6>1koP!< z+krONn&z0LADQ6Wt`oDfBLS<^_8*RG_}K4bsJg~?iVtdoE*vQ2--gTwowQew%AvNTEATE3QCQr7{T>CR@TCj*P)zC9-^cb z$b=@Wx{0RZX72K6=ub&`56@A79z^}78h{K`k+eR7B#B6KF}LJC?#Fad3I~RBJI6+j zMoA}EKXR-9EWFOR&ne&l;?NRv+*X4t33U?!jF*tf52)^IMAAt0p8zidpufvh5fG$IBk;sd%*p|AZcIvjJcNjbnpo=(#(*2+%s6tMM0L zXGho-H&l8t#_cjn)nje^Wi>xnB41H*K0iGdRnmUt{nT~oRww60NLxxv0C!B-;;n&y2d1&Q**rNrz3ck@s0S2v6gp z@7!dZa!=R2K{LylCCAnjHY|tqLTxso;Tr!ea&exWhF}KO>Xau@Y5o~oG^77Hrs#^7uj<69inbYeRhL;S<1@7>;x8x0`(OsZ_#v3a{Ec0eO>! z*QoZYS_7LNC^Qc^zxZrz=;LMEFxqDMer-RnKl{Sp)Gf$eNsW5{hSdMOMD-^~JxuCJ z@G#gZA~%hK+E4tjxr#79ZGTtdGehSp;tU~AcB^^7^tQo5M>Nu_dbw(Z^Y98WR~}LX z(pPtL-^sfk@2}y@<-~v5=1TjpQ{dis$f03N+n6aSxD8Zeb1OOi-90@+w{eUHP_1>8 zpvGdN<`|t)OcZ}_#Z~qcE#1hG5<6Mqgy9AnY;~1i+9ewBPl1w=@wZ23 zA+@c{+OPdti2Pxn?K>iVm#%1ojZ)`V$9H_<_c5vK%lsFKuKNzg_uJmhu*0+M;Ox8r z20_qhhT-0)Zj`FFzs#>HN@*wR_Q*Y|~sKvdaOB;0O8lxBo!XHYm(OlK9Ol^B>^*{BO^#Ja1bhb3Ka=#>cod4h)7C1R$xmoZyK1>6rbhGu zhetFqT~yEx1bI9xIM+kkEJJz|g~@juN3{dr+f>qSy*}@0Y}OKP6-E@&2K9mZ@|J%f zrdH&tQX;kz9hU*gz(4bn2A@{ksVQ0QrP>2S z$~$Pi=WPhhwbiPY%BbNnB_b;-XmTcfx(()$7iaM-pKxqRn;EJNssRX1M)2Qz}w zLQYaBcyk?IkpC}g<6-+2l^8aR0P3c#*5a=&4cb>b2h7jH_dILE^fvdPg@0$Umz3(0Y!Rb5C3!bA7 z-I&c)Ox|YS8YoT=UT!*j?+CcL@AY3_b{?V5JMBQ-O)e;ct~(2!kCPq;z;NQBf_94Y z?n}L!sPrya1EFvx|4WDOn=w?x@3d)?2A)e*hG7>A*}G?6zL#nqyTn&-l z0{vQty)9}j)2^*LKAeK0qOq^9ZwM!$r8dC?aImQ*NH%oQzk$GdGwaFd`#AW8N9nTL z7Hp%+(9~39O21N`PRQzw-erZB^1T= z{#v&m=Enyb77_nR%O7Fe?JWDotoK!A^X`N+MoE5`&ghxi{}4EOGeG&Nx%flye!=hoeI;>T-t+wt}1+Ad!NqV6jb{`vs0-s{?{VWX~x*6VQM5A+uMouI>j zNBof%yV1u2rhN$F57yFAxTgFk%=eo;@<*-K?U(_>oDV8oGWzM6y+>b^nN1I*xXS=c zsW_s+v<4dfr?EF~!+4XsQuOFMDkoEaxRuMTZ&bZ#X-e_wAVCPixSMRdkNQMn*1#V? zh(gR4XWMfKZMQYV{rIzpTQlD5?EV74cn*^~f;%r#BwO^GrVp_jdGhgI znD&jVjQ-4QkKH$a#vi&6_sGU5eWsWdDgXiq;A-(`E+Q{`faTnIg)>lX=l*>`7 zk4fTPw)`i=_tC2^qUK-wBUfGs{=cZULp!%W9IyF2{J@ObeK6k7>w2T~0-m+5#des0}B;7weAt-;3LrJM1f@jbJ|9PLUgCpUjprR?EHBcny)ePq3txUdbj1f&?{sf9wG z&2KA7sq!`svoF3!#)s72vQ6}T=2~QEU?yQM*|eiVUz(^(TWmI6!7}lhtM+(OK3efr zBNM!`+W!E9(8%+jvpmLqk!%YkydzkMfOtW_@{RGWl$s1YPL`$2JYZdBr;JMc%Ao|lF7?nKwsU*#=~xFz?)Tr z)x7C1bT6UR3wL900eX6tsDVJ*K1_q_O)%emrJeBjw}a$WevXi}gS+o|5Lbjz4K(MS zr?m2MsjDr=tY0USxvy8rwO9R-3}1uK`nOGvFDIR^t46O^=P2|&OocAr&y&kP?WJWK z1z(sQ?b|hqLtfDm@_1uT%0Vj$-XqcHW{gH2$Ytp1hcU>?%f}3&7VxozINWfj`Ajl5 zZUVLCG4zkGVoJ(`yJrR)62u|HMIFtW0e z@e%i#hwfWcV59?_&q{ib5W4P@n#1Hz1S>n`YxtuuYGn!3qf(h^xY; zUV@kMNF%=hvK6N7?`!F7zq;%b4Tt+Y!0J$~0&elNkt zgHPQ+UC)a>^*Nc12g}E{DYw=^qm=;446YB;<>P8Ds4v-Z^!IPv&0Fxx$GeT2{HsTN z{~Lkc*ejo3uGd_xAGH2gSC%2D6GR$y;p;qY>p_vsEG$rLJ^&@+%t6=tb5PF1xN)`T zAoDTt<1qb3fN3+@yFDD_(MlkUMguN1aB^8fB9s|`2Sc0aV=;SU1!a4gd#6N}R`FD% zexs5Y$-;g{6_p80FoOM@kdXihgANP#iVj{tVMG#YX%^y)GlIqC z)Ze|)NI%)Qe#h_8%69i=X6bJAaDVAV^egeV^mc2_@uj;}+06Nrk06vtq-V3XS<@Nn z#kT!>7wQ1d)a@bcMOMXWdWkIC^lvg&DK*k+6ykkEV9kJuaOtKYYZL02M!M128C}Ax zAOqp# zitV$S(r-2#z1fa^@9AFG(%f>|ZiVyOj=Mve{wpaXRJ*Ys4UBjPhcAP(IC3KU% z={(|Wx84{#81GGFn}%{d-uukv|FqARk>y}^;NBl?=)^i=J@02X!+^@)c|)^qLt7PR zIQ?4&KKd}x$H8iAL22RpU>FtAFtX6(NZIm224}j?0_C0hy5-wJJZ7De{jGWB+&Z(x z2z{v%ww<>oTLAD};PQaHYvVx@ID|VmJBzwd%Ff2|yqiOlP#6S@w5crL66Uj;!BFG2 zml;SBnORDsYl}`=KT>F~OF~rxW$PlPIl`CQID)+oy!4^bsZO`kAoJPYFOjd2kUd@< z_x|*B{R=eNscwd>OkJi4uD=Vwtp?Rks;M5pE1iQMl7L>3LM{O@jz6Zd7qP7jZN^Zs zoF|=ToKx|Q-USWs^H|%EFg>3t$81Adx1wmOfOO^Mpko6*$3O2`BpLhn3zpjY<$0U3 zoZpQ*du(@U*Kfq{p>qD-Tx=-Zq49qE#N2nqOFwvL>Q5gzG9a*-+x!v+^FM6fe}7VP z`V-<&zqf{=&0ZC`wiQO}L0;Ybqxmpqr8`~bh2gLh$8cmgeFvC?RrNSVB^aU|0JHPD zt)$bti>mk%yJPM-&ySxB0+1C}^~N`LpiLu9*fqQ7YE&#fA0eJIQoy~ckGCCt_u)f& zp5LB^{*SbZdT-8_0cRVV*G-c$Fr}`Wcy;D`18+R{KNr>@n5 zb5o3+hvr`2aM+4h8oXQ)wjAyj)d(`!-GtH@4P?bygr(PWPo5h?tf{BZ+wU?tE5M}j zA(At>9BI`kseC9Bc~sE&43ktX^*8#)tYP0 zxnfZm!F^e8sjOPCwUh2e%_$=s`?WqgL96zg<5>`?b*@{CjbG`Y&hkVX(HQwJf25pW zR3jL(N!9QEHV2gbZ3jXS@Sr&VA%iIh{v#OHBxJI1nH`c?%WcIOxt5?#suYx1rk^qI z|4VCbiB?IX7$^&(3~>xp#?meX0jSV`kxkQ9+^j2dLAuhF7OH6*Uh47ANFUK`=}Bd` zltqea(KD1P+7!;)IEYdo%3tHCcc_^H9M);3RFyF8N?@3yC~BF52vYJS*vKGv3rC`2!z|}3$Au} z0hH>hh)SN@nSxcxWxZjd-Z3vu?aVh69P{VF%L%A$aXeq!WMvlWRTRDS>rF zg{2$`QZY2>^x;Zj9{d<)f%3Xh;oZVw)yW(?Qe%iM+-d}}cmV$ycOA(KY6&VxVox!b zkZb>X0oZ~j7SEZnp_6#GFXv)B@Xv}RK8AUUta7*y(z_~u=1W%0OXJ)Kp$t^Sin5R; z!?Hyo@X(E&T$RIF4;J4qr#5fHEdG*-e|B_O`_JF#tmC6oe#g>1zfEy5F8Dt}BIYq6 zNtpo{LF#by$6xH@Pq*X)d9F_+if9z@zpUqF<8Pv6SC;Qcb_JS1>cU2UOK!(tio$qk zR_RI3=jAPcd#KSN@^#_^$sTl-Xb)#`b6Llbl!dJ179 z;&0L?#zd(-w}-6N8l~*-apIQJIa@Z-2)~ZKFJmzuMwq4LiSv4fxHXei-%)$f@?Px>L;Z2)bGLMmM#qf1c^eqKY3&co^#OMPRk<1pw8`fGoWfKz0>M-qaYwN(y zr)Cw5A(`pu@t|0iuy7QmFNLoAkUpR_L&Nk6!R%hwt`_pS@+DmdNQnrHnt#Q(Io38LyOh6}Ynb@|GR4Sq*q+LrEf9BTWySf zHKk(|ibTVcecEC!KcpQZgdxb%(d_OkKn_6KJQ8K;>)6PEAnD8|o0OAUIkCgDIndNk zLO8HUDa#Z(#(69T7~0x?F-{3Fqm^+E1((mXueeIIVi!(DG-gn^fSBzq{n!CT@FMhk zly)&rstqBn>*6}gpF$s=Jyf|`uvh*2Z*mR;nd-9au+@|0IiXVZ6O=S*7EFg*zWnef<@vknEq^2DnG6VUNxK>#@Hn)B^K zJv&ubQf_>2Dh+djw$3LHDkuWtjV#nM?5FY=z?K7 z;He!Io({TgThD0Ml;lVWP_L!H}`rs~bZu#;g_bTqdFGug(H!^Qa`sqLKo|e|cO-WhQJTjbmu7QHCG(GJX zPN?NcA(5SThpGQNzCN$BuQO4cL@{5~n9}**!)@jzcCD1p;)=M(cFV7hUu8g;fO%AE z!I~s;Af;7-jM^F1o+;h_zi?U1_clSSopJF4Gwb(sxy(rVji9xGh$M6jO2sa9JK8vP z__Gu8(hrPrs9MzlYleUp(-2MpyP2cja+2!bDK*5wU%CdQ#c#!oy z2_&R!@Nf&CRer>?nHts*?9GsSHB;_RoZvqhWak}cXqs8C^c!z0YON2J!rNoH@0<+> zK9Q-!Es&;EGWn?BX=|i8Hr8oZcO{U-3=pXx0TGciL2Md`G-vIBsyai6dnpx!lO=vm?)-DpEC}v>UBp<C~y7aPbv-~kS0lsjkOI9OkRK8Y}Le- z2#sFN|G}WYsxxsQ^!id5q&H1&tlAKf^ewv?*rM8)*6YyutU#&uAnn09F_PH6W8p` zaE^->oR_GPIM;#d4WcFjJ_j&H+bO$dLN9s!Rwp{0r(6#Ce7OiiZhcF1|NWMcF%e?>7r6n_J1znpNZCaC@B8XpUXLz zf7$Z>jm!EJ$`P`V63D6iuNBor1@YuNt9^uttBzRd6HEWnWC?<< z2P%-a=toK92Jnq?^9-YDq&3Jn=3v;;>5C*}_6pS$n3pq;F)tJy+~?h92^`-EgrWqLZxLezH^3GDRhLGLVfahzNdBbd&+i^uZ^D{9$Be1kk-m$hZn6>n+t znRS9LO2_3MA30}pcfTpsX)YUu?dgxW=gg5MtF-M_d*+4ZY`}J42eF8PivIo0No$;f zkImq>NnS6iDg~wtj;*?m>Vp!kjbVs5#LF%c!|^C3K~Qf=sInT8EEPat*siBFn84mQ z$!zp%*3&kZyj_*$S<}+>ICU@DQ0}PAQ02c^BYm*aqTy6QBJ@)a%+z+}K`ywH&d$Dl zTh;#Qu3z4u`B#I|_ZTP+>bk97fv4q_6VFk~EXQL6zUO!-D}zk9|Ci3zoy6mhEn?de zHzO{{O?}H4U6Av}bVgM{a>ozQ^=8@S$_Zb+jN{Cb@Ys@{GXe~Y@ULDZp366c zn%yA(JFToPpYV^jgPxtmecK%WwFKMF2kP#pe!0iTw%jc!X~n%~IsbvFi}gR1q5tw3 zYG7_eH$1^UN$3ECK3GKb8LL^peS4u7rQDrf(KK#1dX9afKS}AU%gs%LDO)ju_m8H- zXG)jr7rrqhue;p$!mfOA_U$<&ABX%x*DWObNrRb>+naAldZ6_2^sX!~1}&E-sLgHR z9w#CgB4^eUhi;J3dRr{Y+l*d%wss>Hr$$&*&x=?0ZC4W`@1gR1b6A@1zi)oNGkdQO zaSr?OdtnWCWhYPXAzIgYaUWPyM)k=K{`(G(cehZLI=;9{>n;=@Hw6s54{9HOlJe|q zH`=r9o^^=5O^EvY_1f-0H*NdfmTAVJZI9aw%g>evmyxEBMlZW1+V{VGHd~{_&*bJQ+{@;@%|b{>_n;;7P`E+F|eZ~ICy#g_Bhq^ zh8foVHuY4MEN<&*fuYAkzgVTGWV7n}esdu-xOMT4Ak^x^eBgVA;IkK|Rp)qwHq3;= zW;r4_PO;>&-gT0;Vec}yQnCEp8|V1%enPOri$O1x`}z^%MAYG+@8Xr%@W4$NAqkEgS`!Vk04}X_1M{zUo)E`&6<}Zn{b*A9|yHL3!;iIcU_`ftH9YOr^ zohO<>7XP*y%G3{l{uyonM}|vGY_S85X`{D~Vg78Y5(lV+?yHpIX9#} zMk-H+TG#r*C;aS$LmthB7vAL-4uU8bsh2&XWOvKpm)4MNd$-62ij#GY`jeW-WnM;K zQi9&+djm1djM$l0^och3e%51}s}Oz7#6!iD#DM7KwvA_>IPI6B76?h&m;~~qXBN#% zmh!{s7n_oc@%#UlyT-2ff!cfjYh60*!yZv7-xPcdI86Du5d&mM`a7v1{AOg)a{e#X zrp9b+dxy_rQd7v~T$1o1)4#97&<$N_-JQ<=+2do-T$)h~$-#81oab7}|4otm<67|j zEY#>~1;saA*yl)ASL*V%hGmaH_?3^v?}Fy3Kb1(yd-bP~_hjzPgu_QbqR_Q-p)8-{ z9-hx7%f?jFgvWK@<_AS}=f0+*@G}*m$9{#j>i~zX*Y?-*_We11uM@k@_ePw#x;~UR zNUGv#KymF;f_LltzJTYaePQ~hunXT5GXDM&2CvOcqXDOn1M$uqESl?G zJDjUPm+r};lI)R8B|X_8z^4bSOZU}V?$vh7JCpxs3>`HJ2)d6!`8>i1A7GL2rf&Mr z+~981$NIni4SU@8@EdUQcjgweP9gHeCV4&d#{K)qu<>yJ;I!=4vtP6Mj&JC<2en43 zxb=4NlYo6al=n^J)c^CN4LpQB)}NuOyY}o2-B0O35@c_G>ht^S3#Rs!grAu+2<-Rb z{5~M`eaCzm1$>CKHt$Fso=$r9nJkI>K07B-+wGq6){Y@m` zJ^qsp`?Y-L#~YE>_2z-W7{kW9%*H+FQ@w1rxb8IPlsQa>s*aU0Nbx3>D)mZqo2_IEmOPS zFMJRn2<*YKGA=*hl{S5`j6TjaI!{ri_8tuDBlDOtab=l;U?#Q##Cd9uuDsh$nm_(! zWL|7>U3d|(^z44K&%JXNy4~2^t24@)TI%s;vg|o4=-dmb@H}iMxlHhXW5c05X*=p2 z@;Z?go^+_u8NKf%n^o-4WGVl@_->ut^kPbz8s*3Pb-JLyuAtsh)D(Ir%E59X)J=&j zKUEpCDIx>}1fyXmFNK4(y6I#V-)C6Lmi1aRjDV=*ayZb_1R_Nc&rj|!<0y(Sbx-8U zIW=uOte>f043*vD)c*#a@^P`om$l2$CGgTInsVw&2m6u2+exL8U!woU3rv?A!_K6< z=H6+OBBP>5i>;+3x3#0ZquV|RR=YqczZIJvp>*xS?};}MN?_Nk+Er~|^v4NM|CY^v zWR$S%hE&J`NM3T$8ReNWoLRKh)E72d47N5pmEp#MM7O${hUnSHaY2+@>dboRy5}lv z@y!i8?}|H1^-t|-efB=Q*PJz@SC|nS*YAt4QM6bLAm!VI+_+k;*$#fP)ec2;qqnR_KC3Fhm3&DwOMfF zY4e?*M|frX-&5k>P?H?%+2h8Us#ucwl+Y$l{){7-+zA4|6BXvixHy+huA%F8p3Weh z221Zd_Ykq0%K{H}hkIE?zBk88+KeDjjq@JaOBHpSlYk%g^2$WooK)?&RJWB{tx*ahB8ZOkp-Q z1jj+ce$v6!i5!WkoOha(DcM+@U}(BREeE#aAsNDQN;4}pE;BbQolJ`$7^VA(%U&UJ;`?Zb5Wj=M%{3<|#eoXvfW9-lTUgzcb z0__}GI$QP`0g36l_=C%tQqP1zs$XJb6B3&jyjY9Xq#hWKCilGRotUPISVKGM3Ye-!bNr<|@)VpFamm2QZ`s|Oeg~3Fb zu4mrJ;PTY>#)JXjpihQeHy8(kc0PMp(DV$D z^qh-8w>bQ(bIa6jbM~)g%JFn28u7bHTU1tD(=V|?Bv+V$rd9wte;}ng&FsZp=dpYU zSQ5kf-)tCNF^UgM1xa{X7>P<3x{iMq#3ptgKE1Cdf9~OT-wi6=)a1UP=e~}IeSy%N zmH1q>`Z*h(NGHT=eJau{UqV~G-+tcSn$ymJ;U@|u@@nOCgtGB&Q2q_pcyZVu=O|PZ zB*-N4A>hnf7jeR5$fxs%Ol0QnN0e~8JR0BBinxrL<*Z**#(i%~7e~p2u?Qbps-alE z5GkgH|E!Ij|7QEkDM`SS2bD?TPHJooVc&g@&fIn^BXr-yQg6}AdeHfRowJY)-@d+- z%cXs`jX^D`m_BsTePLSZHB#kshww4l_Q5%BDRd`#pBSo$%7p`xq7bEqAguimbA2&h zDHBC(O)F8%?Auo$(0-W5PGQMC8{-K{M?l^!s_{jjVNO>RSfEU_WKA4ugB1k9t?(xY#c1kLFSZje-)UJwVOf{k)OyuuIpU1 zAKFvng?xE7I}Vu*?>0XAZ;Q>X9H+hYJ)VvlL#^CYp^Fu%i2QGCB&NF^D7gW-8Rh)Hq}hi!XZqtVZ%97U zq{nykf4+Su>{2BUDdOUk5a1GdtZoopvquV274-T*(*OCylGb9yHt}_E*Z2gw=*t4` zkJTNI%dVT6-+bP16O#q{uLVt6x3j|gzwzLJB~V2Dkr-1y?jHR6N`&v>h&=~^hz^^R z?_;Tsqs9n2-ZWDF0sq4V*zl5niaD6uc!uo%DP)-=xOoS4hNL7nSP4vQ+Zl~|+;U>z zy&9$~JZqk6Aw6rv!?!ohW<%2z7e}g(cj~Tc93b?aBcK>pa19fFK9=@R2ah(dsX(#3(VNxJX*yrM+_Q#4DHnTn=%3ANb zQcmNBX*2>Uf+fYyKzGZNUcX1V|CmRpRc@I?~60NMqy*U-yJS9S$NYYDLh=x zCR#4d0Y`!_x1=!D{2AidZI7Qa zq0v|I*!_QPpr%x#;U=E7-lUMQEANX}BJ8OQF>6FIK+??G$Cypq^S++fZp2yE{q@q# z;!;<9DC^{FKpmx;#Z9M%^qki%b9L7fHn;8|oMmTHYIbu*$;BJh(#E44v7zuVS%u>E zq4<8imt52ygI1l@y%{G60-O2A7=*|5pJK9DehVy<+I~<$ti=;3-PZqJXLnqZ(0?2r zeSLq~GK}x=Fu9V~6K_h-i}FnReEV3>ehWx_v%SCTKaiTU1WvVo!Te=(9i5p!=C z{1|AD4KEr59A>k{N*!@Jopft1W2wcU(2j0BhSQ%FzIBu^$lgv`tn&hGdT`jRRNr0)U-BMC`dDD^AaY1 zbKpP!98v`uIaL#!6en5?47IE(W3D^^Q>9BJ z13%YL_8+yz_UIh2g$*_}XVJ=3gHEg#O%Gonz+9Q+%Ad!K zPy4k@kqz7uRy(O#84v3*9hCH=QM3%QQi?!Jm|uZy>Z=~#f8kW74`edvpIF(@-ICE% z=H{yffA(a~r0Rcjpj1p@rmZ+1Cq26RN0S+JK7-TnNs$N4%E>wK%GdBXgT-@Qtn^)k z-;uSi8G-(#_epR2tRO|>IdB~F3$Kip4by1FjK}iT-DkebmR{C)z^%cd7HD|MK;dlX z$g1Hw2N@WEbo{{VN0tS__)zH$&Pe-vx(^MNbMPfNk`Ux|tp>1E)36ZCnTl&VR2N_# z#OUXPGmxin7oiFs-l3-PfS9okLW0c9lo&plko$29j&B@NuZX}UjBViY;f45<( zawnjJ~l16)NoXpJMW=+!mSnkv5rtL)bevcfcwRrS1B7Y#Q#Y?;uX3dtuIOMO`4Q&{^Y* z%2RaHkCo)Re78D>p}pR}jGN!GIA||1LY)TM{9EIT7p-hWtu}Eu@ud+v_)mTmx^idM z9V!accvrBkRG{E`OrUKiD5PY_|94*3@kIu7`M4A3GKi%$k6!+tB{2h2r_hJb^~2;Y zLaLy*A4Pclc%kCq2Q%12tlo%GF@ybv^WrJ0Rv5YP$0OnZ&=Ig;-NgPQ439-jks8WpRC$e@i*i3Lu(4ec<&VwBd`rl0OC(5u#DrE-xVs;-m}J?zCCTWf zF`2B0xGYsxUzzl^9ebz(tR7_sWw=8NLS{T)PBd7OgWT2cmJHqvr*5OBbmvl82&-uN zXHsgky!!W?S65V9yRRNf5lA^`zY{7Jgv8^Bxm&Bzkk8YnEy#3z!C$W zl*dGBh4O<@e7w-GFg#pbT7c9!U863OBL5NP{&;$WG%`T^Xvor)cX0%_q?&m+;zZa)n?Pqy`FS@`I+)5i13#F1eRIr&7s9F)7b$qktOuma~N^ zIMCA>von;demQudy{(xaUgbyHnaN8Glo0BA{NX=R&?5fI?H1Ih9nBIZ`>T~Foy~;i z`}zEAP(Tx+{YJ=_JY|eAWr_dUB3Q&6haI;gXcP~dH2(8U9@2KTIfhQH_%>;~{A%r2 zQ%Y~ID78{fmW-4l{GxT8J?!2O6+h&WM&sp1lHStgFE~T&Pp}QkjYCuy56br@&u#iAj9(2%kYK zpK2;9VZ!vp++N$E&8CkwEb{y=r4m!uxdWcJ^NtS5_AN=t?9j@Q%AC|z5_@)===!o#;HX*v7W(y_7x(_Y z?(ZiOARu|45$hq)w!AE~FYSKN>?GC|d+!My>Fey_usLL$ndJ}ZE9u`GS(j`vbWQFK z%pN?eXXuDrk9l+Cl!?*G2BWK_Ltr`6RT@6**pTVBSkoJ94Mi3c<>!g6z>76ig7Ij~ zy@Tn5jRNI=RT^daDsvg#jvWJ>l5^p%R&zW)<;t=@HPk$8>#~gE=Gm_+a6R;M*YD5= zQxc@H_Ucop`zf)LG}6`o4L_YLws?$;E=gA}0U_R0*WF-OPTBLR%b#^?{DQxjLMo5} zGFXd%@iX3Jnhz*F{Y{(-99SQ}7fJe{(YXO=VHbg}V!bwH?cJKO(GkVoy ztz_ll^RF6bbLg0(nx`?MZ<|lSN8+XTnQ*zLj-e#&HBr?p1>qIB+U>pa*}YGzYQ)_& zl6rA4YE3pP%8&L`Ul?rf`8}4_zrY>unFCkHnchntIhl z|NTC?+EGrC%T}nB9`*}SD0xWs>a7mUlW|E=^gU0-I(5D6rF0;tvfnA~#{KZhX-)OK zUWhlP=+(Zj8qmHuX;yjU_MNA%xpEE3y_Mx|6u|e_Q~fusUsa^@xbN)!8{a-Jn6o6t zvgFzZR2#e5>+11lV_pd9ewpN~{zMG52b9d^KFtNxj*)cZkT5xbz`QUIb?eOqQ*p%K z*hc-n*Hda=ypUUHNky>pX;DAJkEBG^QjBXXG!&f_P{7zpl9UZAX;Q6Uh_B8$ND-DC zDLme_8b0mEtS$(6k93RI`49eQ&188{t63Gy+)mZLHx+$@r2!W2a;LtO-|pZ@-3!%| zjzZe*$rU~O(mksi=EXV^+e@yM7I{&R8ft0`3U@WoMtaY*0tpWeeUm-a?9*GE9p0;X zEv~)IdHrds301@G)vUS8DRKTDFqN*Yjy|KQZmXC0dTaOOa!U@0k)s;=^%$z-uy8AD zY947*;&8|NsCXgVWvaE~1zL{WP>}L6o|ls#M5yCt%Ar}PrmEb2L)*g<#+KDcZ3^TN zKNK8VWn33*FIO}zkQ;n2Vk#BUdi)3;rxJ(rrAT6l)*zVmFs9++aa#S}ug!%OIHG=I z>RraBg?^2er2z$bH0{Vltp|~pK^Z}z*PE^ZS%_(6*HLKS?{V^mglF?7T)s+(8!7is{oeouR5O9dp9w_I|kc zYXQ4B_(@`(Kk;LKOQ(coK1?#XQB8O+LeCnD9_yBizEJgOF_ng$NBq7~9`YFC;m<63 zQdeR+hF)cIiZDLY7u+g7RJ+asengso;~uL|Q>ZjfifAneX14XHTp1!*+>Hu(^k!3z z3-hS|@_mkhh68$g8TO<8&bNfn{~iS2?BwQ=R#&JM5+PCw=6J16EBYzLhn&sNm|u_c zNUS-vvR>GTXFSKIsb2lYz#Qv7*FXWh0P!OdqVIJoTY`29?$li8*1+-Jbt&xDJmsy@AlT2Jk4_EYEwd4dPgP~TtTPS^b-(c)u1=uPOy0~fcmMUqHGCuLGwYAs!5F#9|};;rny6gsbmu^K$x?M>XL72|sFb=jiq8(B%= z?3}|BlpGzfkogeFp|&Nin)uEb80E?D3DT2T94$ZK2^UBDt|}2#u_bGH>{5S!bJ+>ldTH~yZJc_zQZY! z-74xR{=~Hj5r7Cpa1qW+P0+~_Za@QV(;I&E(It&F6vruUA8i}Db28sm-OXHa0ZVf( zF9F%j>b{nU$YCQ$z-CTwZlvmY2e+4Sf{MRdx9zeYvq-CR3I9}-qQO(l$cyA6$!iDC zZJv6^BR*1Yv)h%q)wBRUADg%mkMKUIcfyO;3ppM^~un6K*K=?#%xgg0Ynq0(|`25(xd|{DPx?@k! z2Y(6lZnM!zlCe`!6;-(rm9mRz_iPKcPso~4^yJ49yO}cttI+X?kfEYUY^poSY5r0W zlQDdH1t!hB2qxv#jDFy9sowiOUUiA1#5Oa>e2pftG_?(=#&OS0eNhy59U^j&kN~Vc z$6~@V$g(ge=)uB1H7$Az+_gTt7Ic(VyDt-OAQ5WV6jD{uxYHATD}r zsFxt95><`x_H%p@DVb-XXiJkLG{Q zTfS1RPrY@(or&jvZ%PrLv=i^1_kGBem}G*Nz(!YKd9k3(hW0}Axn$X)(k&)I<)&=# z;AasTV~FoZ?5-Q*PKlP#C^BS!sH6qLWc&>AjR9~cOU@(SK|MdDI3|}a@582}hXP!g z4pydl6N|MVW~Sa-IGi7@*+?J^kHxm1$(1X-rB9&!K8KPILm+6_ks+trytSxR@74ttTSxTx&Y3*3%Y^7XetH<*@Zc5?NGN8~GwOJIx?j z;~1J!6S1c0^lzf&d2}4J>Qv~aP*w^YP6MjSJ;-iJEOl8oh7o_Bn;q@WP6hEzYr&)% z5|uhN?si}4&;XTKvBUkOuG^#bqOb?X5|DQ`cFHj_+864>x`FXXm0Yywg(+#pEMeB< zsD=D@Zdl-;)CNw{;KCUI;InVwB`MpA3=I5MA)yPSPz!4{<4RW#zhEPu3> zRrz2v76nex`vgKpcT&Z6cZLHNKH2-S0+VXV?f_$j@mFNr;lPn$xp z-E4)gyGDn`pk5mViTLvjU6gn8L!aOWzHjQ4i8o@$0%Mm?-f}9&80_<`xr(`G`->~Q zN>^#iRVdiP|L2dP)h4aP=oBj^0&JE|hVs~$55R~a;bP`~DSk6qD zPbrd3rs2#?YV1ZYmkhsWO1XR>lhqa6_I6{86vHQVkJ42ubhA={EP59B#!l5Xpe$t*ad z*kCPehcwjfTyjAH=iKl)`U0h~X!^;kAWNmoJALE6E~}+l?~O5A!hMxw<*w3)YSQ7q zRjU42&9A$#rnQmbX1iNCt5&B3e7(^ae~)7#Ppf`u<&Z!Q`WaVBn%PXu-ZX1-3y6^% z&LcdNs&d zCK-?`NocVYb*58f&{e};_~R{rk8ItSW)*{lRx2cc_Z1fq&U=1opDGq`OWzFUC0CM& z99JO>e1!8IO&+Pi+LnzdqP2^^WKakX^uhdQhMtB^=#^SQl)CA#s9Sjta_)QnUgzQi z;TLl*!>lF6!h{D_mHMK?+FQ|5LqW%;>-|m5;)FD}HSwAQxf>@9yv0 zDePuHtgwcc` z?Z6quYjlQbDT*SBgQ8E2kh}rLT7fd!UPboVC#q6km0oF9Pdy(MmcQEpwlbBnX<0Bo zNrF~~lWl8Am0Rnnja@lHC$|}T=VXe{b990=_$T9}QY>xE!ImSgnX9f3iiEESe1tlB zCcmXVzd{29tn?)UA~i*Xn|rA!k8SN8yqE^_{C;STRVe1~l?-)iSmWARlaS+=@qxe=4NMFMoh7(LO-|2xnQ`~9s_>5Ihw}~P zGo;e;9{MKV$c_?cfm27_8R~kI9UgWmJRw`k?YZ6RGlf0z<)sAa1!h7I3iL%4X7I3- zd)Ow_9oD*rOWA_@BiIoX z`u>l6!+gL@Bp&yoYa8z^%ZNImq9|dc9T14fya1H<#6~6znzttX7JUOuctak@YvL=z zAIu#jm_<51W!tv7dg;TEWfrRU6$75iDKV_kV&|LidM(Hzc6d~r7psUyU96>?la0RRWnUk> zCuQeA?*+@x7jn>AMgcHYr2gyMMkHjD6sY8q; z0=&5%iMT~fW3=Jvv&lrGLpgobrwztOclsP-Tr(S~d#|Uo3B1^1_R`AfH3rJbdtT<0 zBQuw60xM0VaB^u11>bd{oYI9cxDN;Un#!{@%+DVbOJ}>ocaV+C&k@Mr&9WKgz+U9D zn&UfoPP#&;7wAyqBb~phMoq}BFU|ETHW*sNW#(FiWW8XE5nW4m3e|my#kA2*X{Eg2 zH>9A(x;gupH~NBm2W4akw*CaH{7mC?{E*F7+~c>SLQCYJ-An!!*Sn&cA2g zd~^yLZf3hsjgo21>qM~xruZp9OKy0#35HKCC9D8Hej z)G%8w=9A>NY>BK*HeoHdbsX@c5aFsL7j}|kF?At`mP|Ibb-O>{)lm#nz%vOsr#dnx zqKq+9rMz15?W^Kxuw3NYyh1<{#b0H&G;M@5xF9r{g?BUhfaXYJx>~$V!~A&~_H6^_ zl)dXxW}}LTd4tHlJ~Pa%2e+fV|476CiXW=Jtq%evBCuvpQ{7oOXgjR2>Sv1c$n)Z&)IUNcQYL4p|-@#Zxu9}%(BGW2gXO80W3hNYzajE z(0303|8{ARabl(`Z2yM~5I%HxS;OE%xajb~uF6Xe0l{aT|BwtzI_W&8eVlNyopJoFkRN^^$qh`WD>~XCG7FGA-hg*lk^0Q&o4E z|A6ZLBP7BOW~%fUh~6B5DpW}PDc8IA8Q0v=cE@*eQSy>>Mr5%DczI!%Bck>+OBGOsyc1EZANO&zGMh%oWvN|gfiv@UpmnCIyJi-q~ri`ltn93$R}1R!w$f8L2RVh>elB06>7m9=ahvH z15$Q@lq(kvry*{h7n$Mxd(M$?WwbYj_+MKbsA+u_hu~eH6seSIMYYJek-U4T_ex?Z z6*(^jRDqBAC8z|uHaix91TghC(|fpw>o4b^u7lp(lAdUj;qGJt`%B@wS7I^Wh@6Kv zG>8k(kAGs@gPs*+{!($?xYInc!lZzJ>=m2@*s{&nC1kVlX_q<~-mpu;`4BjB%@WV4 z>p8WVPa{R8lK*$ z?}&=IKk_#?JZcJ5j2}f56KoxWW{fAQ+cZ@WGBGu2>H!$UWD{$v2-fr{?ZgOl%=x{V zz+T2*{Bz}r-CUtloD#4Q>U;aNX>e@Pf#u|NZ(>pgHVp8!JCzqXMdZ_8qt%MXGA~J4 zOiad_itR3AfL&0bFq*=AaBm(u(7slk3gL1mao>DyJ9gom;#EQ9Iz9m7bf}s4WPxLg z(-UVteFO5-zipk8rVw@9k;jh(>+36R{jBM5SHvtV>pBf%iZmhM&}7s?1i3i=CibTU!!tACzLe`d2SYIUVh) zx?aJ+MXOE@imGhO8^HB~bM6Gi6IuL7=gxt|phd+5c= zOt>b!;2g%0GklzVfDE-=x%#%ey=N~Z18wk-E<3*lFPDF+!GU@$wfX~_d^lWFr2fWH z*R*01!%w&i_3QLB={vdyMbq&oOjEfYIsPW;v{rqmob3=0s!pc+U7Md5{rVVAU=d>S zT#fQXxx9CNejKF4l2o4S=67PI^LyoVj}K!7va92Z4qlQsZlMnLclP$(w`ah6G_Ga5 zAYM((C9j<1Ed{A`;wD>inP8YSh)E!l$U5s`?O>u zW67vxUVY(a?-^Z%_h1+@xb$+AfAa4P_r=f29vagF*7N7Tv&aaKuUp#!Gbv|_7XU*K z_EUhd)SOW{38MsiyQNe@oS_{n$aPoy1sr={6rYl`PQSjlX^hcUurTK!AA7&7Jxep` zpW5y^_+rfnsa#V#*w()~+Yrl2lm{uoHc2j;RYCwOK|mZeszX(zH>t$}lw3{zsP1!1 zEF%*p*Fr+c+3v?wNzrCPEt|!H;xgv(?^Nm5R*)D1`A&u%hxCt-JOf z+DoKKFZC+Ct1Qua5+GxLJ$sO4^5A2|gMhWFi40PJ0 zI?c=nSSfw^q<==b^vm5Oo0F_lgZ6#@xn@(l#=Zj~aAayUPg+1|gOGmy@>(5Ad1+Hm zX6EKNVh(})nk~K8vMEkvWU7=Br6fu!(lo^wO*m!}{!p!(auE;-Fw}%5epb!xj0Ok;92{0{L5oGnoq^6beD z>+375Ly%7D*RhlCz7aSDS{I*9gU4<#sYVDV8)j2a;3B~aNb~$!G#Hh4OF>R}_;On> z&u`Dgezd2IyE}6f1qd_2`q#}sfNodxH=Fx&*OV~@~lx~hmp^x7B@FZ1jcC6j&|cC>|u^BP zjFeEd&>L4$W}+2%oUtnitbU8{^1Z6`tFDb_GlclN7FGUI)ib@y)I}7Rqz-C=r!NZ9 z5aTIfSYt$VZDx0pVBP6MlNu8iBT2he{f-G#8*Sj8D~QWqHuk?e(;t_(;yBBMPsR+1 z?gt9ryI8%#&mgbSO=gv!>y^7w9x84N@^x(2QxTt5ey*5R5nZdOV_W=T%QyGX5SVE1 z)m@Sw0XC42o>c7-EaW0P>$aXO3#3t44CXBuHnBKWd0QqK1EJ}@WmJ$S{jAi*vvg6+ zqMt21sqF1U`}j>4BVJvakZyn2>~Dysc(!k|e8)pPe1>wxWdN|o6Pz|I0mAw^)I~&~ zLcvaMmSOl%H#$v4_C>@z-5nl6Acq13(xiZwLMWd8Lc{{L~w5l~3;jBWr!gU+9 z6Ck7dqD11zAYp3^!bV5(VLTWKsdI8A5SgD@v6hORx9q{h3P&tdG0UB()_A7e6$QDd*h zXvStNnOZzkvXygTCb_hSv3us7Jzvh9K}Mp)>Y!snRrms(Q*par8olnt6hi-G$JXjQ z(tc&)dGGE68FuNx+0NF{SoSAX0Y@%V>G%lIMVg0Or33qNpsuXuM5ic-d5$ta0*cJj z80#|H7Q3(E_#sfQ`DVU%mhy1%E_>|Lyv@r}IflzM7m)~E(zF#>93?U*O*rR+Il)mR z&%0>sjMepd@n0p5$dpQ4(5{|E1)@uPAR}9?MGApR5~OhCXKubDpPPjAYX8yL5fR^0 zH9LlNos@aLq*N1A<$tV8kBK{d?Bk?rhJC((yACB)&lp|y>~@}|ss>6jwA z*9`eaJ$pDrT$S3+X15C=-?5j}@#xQ0HU}})Dzdu;yW*W2HRsr)u3(ljgiS%T>(4@s zVcprqW96(uzjO19&?qbmMwe(g-iSkBY((F46S4aCxW?=M_L348g>a)qP-Pz}R3NS@ z`bRu(LLsu4fU25GM@n-P!A3-;IE27>!m^x-h<+8)^ZR>2RF>0zzWH%{yS&+o*xVV%i`pt;JhF&5*g;llIAl{d42OhprjyhoV-$KJaxHnQqagG-dNXTJA;lzF(B z({Z8sfg~g@b+er~-O)L_Q?BA7K!8{X!5NgDk6UAsgXJ6P|3paEyauWI9WHa&S>3!0ie&b#n$l1_z{0YTZ=cmdHv%_3nWJH+vJmcApPJk z&%GNZy9*v@`%~`QY!sIUnaq*~YWaPf!2)!6Nk<#cG|*X@xYqNQtAk;kY?W!RFV5pW z)8RWebuv3b-tCGTGhf^3X2*y|b@FncuAL|!%4%=?YnL)tGD~*DYXvkF1Ucrz^%P|@ z)9B=++_o#<{L<)AOR9EE@ShG;+1`a`vox$#F3B4Kl)6`0(ha)TApOzhD?qtZqK%i` zu|Ij(Wv!>Q^Ibk!lO6=OWcOa5w=RG2;jq!qN3IP<7p&}E;5FNvo8?*J#y(BlkGH+= zTCY6M=9Fz24d3L5=plgdf{LhohJNAFQGnr0w+LDYPeiQA<6^IyW!^t;rL!S_Bj3aT z?ABiWR#h6;wlZ$oSe;~0n8@o6lbek&?Q6PuJ&C(CR(c`+u9`ThGyT_13%jK~Qyo_Y z2Iv5{`o8+vWJM$o@YI568@96}R$LZ?it6f@(K2P=sRDX!@RM|~*oWo>s|yD>bmcROs4K98x%c%3;@44GRVX=mVdPMN|D^XpxW48<)szx$w;M8Nw2F7sz0O!-idTp-`R`%R+@oom(qGL{@+9oShb9fcutj` ze|@I>A=YTW^aY^mJCm*MDt&2P*l{xqfYR{-{+0Z(Vz_?^4Xr92abEqBsQkA2jC$GUys{?J?+X)P_;QBD+)D|ln zAR^*;5Ke{MIiCh=*K5b%R?)g2ZT=o;r4MuqJ;asxF;x^j|#eQjjf<6`8iQ)&NoNkp{p({ zc#=9J!au)6{2S>MCi;T_)Q(vDHuhSoGqh4ngse^X2BIk^}X6W($ zBx7M_F+fZ0C4<#JxZm_5>2J$Y(z$<@3#@LpH$C$Iv#C-3eyVW)($`UIZTUMZ{?adv z>2F@3K8eha*N`?gYred0NB+#dpB^23voBQpY+zfz^Ie0zVWm8Q-f5HNyM0irD0E3OavP5Ck;ElbdDavNq-8+%4qsQmFXp=0*G=BU~2d)+jY7z)RJ1R z0))I~+}FF?#DZvC|J|V5Q8yM-cN{UI2I#=lf06XK z|0ewf{d<4x+u2NLa1@6(%+Sblq`=UbbY}dHlyhAajS3m8%v4wA`WvVPex>3sN0PsL zy!l@0(5;J9)99?}x)o}Xix7;RfRh)HW4y&6^UbP9Xef$0q`M6SyBNrUw-JDC!BPf0 ztJw%0xtwyWrYhaB=L z=@WDgjhh9pk@#QwYv@M+Xn@MF%*@sY)JLgqf{Z{_^{F~@qeDd1I(=35Ymz4cdbS}( zFW+=Ls^4l~Ok&l(apYf%^d9u%hKcv7x=2GnYT!fgA71c%HT~Pl{7L$)s~<=I#L>qu zpfk0nN67a4l6G`u-2aQ(l`sZV?K`!WCw{@W^ZbvW$MZ+CfO@&rSB(q05dO*yglB9h zQTxEn^F?}Pt;e<7o;losbPVu&K1BAVE+D>$_D-}1T#j{Vc&;AW7^B!{aDR(m(WZIA zepBJp#CRg?h;iYof^4oMlK&!K1vG1r;~`sarnV4e4^F=hfNuk9A4f~f0=E{YV%sP8 zuseLdjk}3VD>txyvx*PZ7+ifQYFg2ku7Vu^o8NEEqT3inwQM6-=vD-{X+sJ;*ZIv{ ztELn!+nl9a$)a9zMO6H(*LhN6v>T9w;zEFRUxKadPuXburC<6k(oF*At^@M-e!nA8 zs{O%F5$Z-MQMfqU`gMJQ`~9wu;z|Ual2!Xv38@=8_j|EuP0NDYZNYN80nFusI&t&$ zd*uIJNGD&Ds-y9!e?FtYZG}~<8np`hsYlX1-`-MaX2CUjzok(;yFN~7FN5}PpGUv1 zke7p59gbw=NZwmze&M3$yL>x7<<|H&pd+BcQ_J?`dO8YvJgW@02oNQF7G^j9)=fwk zK@|n#YM@e0i>dSb9fTo1S0Y+Ja5Nxf#FT zY?bQAlp_G*VX&QhdD=>Ily`f%)gnKZgXxSX>B>+xi4*wpeMqCU0NEr_wtqcXar~;FtueE0E0Zl(nJSNZd05@GWr^oNL;KUKaw{)BW(VNex`>*902z!ad3n=49jiTm zmgl+gxR$ogm)3Tze1}ss1e%^+fK^j>P+oyDCR78)TDCq-!cj}(wpWGzphX-2mPcq* ztL(n1U^k8^U(4-=+id|ubOvU3sTDmBQ1yf6FFiu%6t{07c08Wxv~OOlU%Eh} z1^Z6}+<)mZ{Zt@W=^goh3Qs#-P!)jA^5aONyW{`s>h!6;4iBVnMmw@7>+^p<`2pTf zuFvpu+Oqmb(3_T{!JCGk2f&yAKH3|KKpW3K44%ufu>vE22!Fh@RaJy+o?y|0&!zR!#{nC#o zE*nVok~Y}p)Mzy5=6nfKHZvB9U*4CC<4`WSV);ORAoqiTtcx1GhbYMfbHbCeCfD)n zHr`>6?017q7<6M;f1~QN=qD*P57E^lm%jkkbLk97_>~L3-**0M=+JMH@dv+pgd)GqrCE5l$t2m*1n@L<56oAoPn0r)hT z7+CVZle~4*@V04T>S)v!d$O2_Y}fzG#uU+`_N;CnC-U7hrf>gzEzO}ESi8HW##REO zWzT_(TQrB_XG3X5?9In)|8D62*e#ewe%XB3SDj>ehP<`B@A7)MECnHYeEp?9LZd7V zLk@v2n$F1`u*hQ|E*OnUI+msf+Rb`vwQ_wNUFx0LKO|u<~-vhXtq@S=zRs z2{QxP`xF(cHnnI~z9U2S+**mcoQyFok)5iba=f=(YeQJ`9YFEXno>eWwl=Esm8&b| z-|CdjBDMH-%vjfK?URyPxN@ycDI>VK#7fF^#Qnpbxa{`zH&#=ABJI`pp&OyO&ZaU z52hYVl7{1FfHco`;~7&EkdxZ))P~?ezt|clw;0i})*#LRIGiOvA2RC^@wmw-$erZA zWhr{1uS!q_mLpRV#PTGIQhBXIgVn2Ai>kF5S8u=uhmNq)P*w*PZO=Hxv<>xmYZg_-B2)euo~!v{Ct$ok=||8iC}5S>x;VNnq+j z@xDt|Pn2Uz21jj`8({oP$Cy{^QD%hjF2Lb7Tw--$Krk6jLC&BefJg0`V36lFh~&YF z?Y5Y$U;J1QtWS1iDQp(hO!mX?@HC@6->=^_zt)=ft2qwekH+^m*!SRL6Dh1K-6ykv z^b%K>#cquptpWQCiaa!6TkVyD_HaD;v@H$;OfEg5zAv=xsNIS^sOPPs&}_Z{>%I5} zOq8(Z3|a_D`(sx>j&EbDTKcv=gF87hkg@s-)tk1f<)k5iu1K{l<`~ zB(xvBF*!>fK_H0H?WxNhx8uEl8BajRs@I3d#gf8Qa!%HLLGp-CaOd zwe*f!Oj&Cz3t?SX+}9O}7%AOcTBQ$ueB6w;<+dQ@JhM=Z`)U)Fr|!l9P7#e$@!!+A zpCvULHS#h={#8oZUb=rz>%RqkJJ554wii<8!oLC8AV#tY{^tCCH~nO5`IlQqar5`= z_W|{1(*eq;mZI$}OwHee#5=S3=-6B+#)C3JvS`f=Br;&CEXpbiZ7yZuTo<&qu+s7j z*ZL!n0LnGKKeH5gxOBCZOb{eFr*heqYZw#O7IgvHaWo zT;<}?=u{tPfksz)Q~WuMX$>D!R|^w=A;gj9c*Y5kDcgHvUrT;NV3789+~e6?p{Y0? zh(oj=2xjeW}Rad$*qBsw=##C1=Ox7DJnpym&pv$Qk1&|cToY+0w@oJl3~VO zlx|2%k_(_5=Fk+)gPOx}fCR*L>FZ@RL;x1Yt{R64;GCI@{y`aey@z~sgEhH}wAT9_ z%d&u+UTLZa7Z(C$1Avg0RKaU$@6qWR*2}ACK}JSOWEUS2qZqaR(l31_J#*P4eP~@* zFo1j3jSC%@sE!M8`aBh@Z;0#EloIau`*^bm03(+%yzI`%xKW&Whz9}WtggUxQx;g3 zgo4Aeg%KNCVgLX6>~hoHF5N}Snz5EyP0b-A13RV4M%LMo`~n(eaHM^0y*c^Vc(+>C zF8}}_07*naREIrK5MK#fK}HMQNxUuPW3P}Fmz&=g>1e0^Q~AGv&iIZ~<@2Q!k%}pQm$`TX|1|x@ za>J}H#QgU&`3}N%c+Jkdaw-ct%w9X?oLN@J1R6f(W=Bvpq(o=;o14Gr7GXp7X!KLn zIu8zP6oF%ar}YXC);yZ1t?u;45%Hfa-f?X7?Z5Kya_ZKfWf@xMX?Ir3jmkqD#Kdc} zvlIhU)U;<4GJIMb5M2L`b33IzjDTwW_lPX`BF!3l&w_K9Sp4E;q#X~GW)^}2Oa&?< zkE&XszXWhU@?1X0g;=m8<(*ND>mm&h@JJS&-H6atTjYz|KwgeGrnXlE~^4 z$=A*x(=u}nZNs(iI|CkkS_*>canBZzB>*|gqSae}4hlCqA6fM>X;ZF%9``L0(roM5 zx6!OVl5g6H<>%HoYON`iZhi$(;Yl3}$8A1tEpEsAmbI`EpaujmE3r{7_T02fX-d6q zyZU4;`cDKtL$S3*xIAgNOqys7r|m;x#j5>M<;cqFM8b{?b9Hx6ES6op`gD|Uc6F}+ zva4rCv92p+&&Uk$y5e@bAuS6&KR;_d5eZn6?RRn(&NE-mdKpzB!tHj${l1$2*3ZvR zBoO}3$7+DkRocA_aOd-8_7CXSv=jHSjp@C#ujku+-uu0geiwB&?mVB}>e>~9+1PfC z)?C-tIp<=9Phy4dHW$o-oa;%H(x=Ks#0OEd5G_=rZ!8_oYy{gNax_ z=qa7&Q3kHd{%d*-Bl9S2vX@aee9~C)26XI(+P|f=ub@VrZH5M}OY4?=Jp$Rh5jDj# zCBIt-HZPh5YqUt+$RkY0TEFca{VU}&Iwob~HrUYlT?X$d$0L6IB{E-=fAoVm2oQg8 zT@0P}!>HY2lx~y9>2zlwo>Y%R&Eo8u@am%dP%(J;cp{4zj`scvj|1!-Qh{E<@x}(p zFmwb}!#6(-TxgFn)ze9tIUpre=EELRt$zN77N0xW5cP39$QWNXX)%`@wA*-F+1qBB z>d~Xiu+>U*QXGxv!ARQ-DUGLwVI$EXg84F4z`X~^bVEe>^Zm5GVHZ9TKp!6f%JKho zU7?rdRDX=xSWZvTG9Z?#@JgWD4T(zYQz~ULmnN3xub%Qt-#||iy`qBaMnmxxoY%F3 z%7*tMp!5grZ!>=Cct8f8u6YHoD?o&0xna32rEfBWQ8$&CYdqa$(Jhu+*nLvJLjWLF zRvkY9t#ze)gN561YnU0YO#{J$%I7%Q%$u4p!{F>Dr0=iWU)rEn>H4Y7)yd&=6~Xgq zjdrj{)T@?H<%MO?wG664)a%QmjisMWyj8JZS-fZDWu{_Z*-8EUs0ektx9P(I`_k-U zwheT-o<<0xzCT%Cy3ueXp11g#SmBX7*B|Pv*}Z37ec9g@P>l=F`iGj&HQY5F;I(wr zI(2#+RMR=1b7g?T8_RJ^v*zw$__aPg*i9L&1?=S#H|e$ymGVG_gU!K9=onnr`Uv$P z$T0w>MFzL?osJvzh87lBN zn6{h8XuO23jhfdz4pn1JbxWz6U>(_$m8b#k#yn55GNxJ?i1pRWqI^FpkR1T&exI32 z6liOJPG8-oRj4JXtMIuII-6Y9xNYijWxp-I(tleu2V+2^T7GU|fPPLMQq`lxARKo4 zcCH&m(ZKOwq3*2eoE052n_twF5Qa!OFxjFp(>ZIST+tg<9=r(R7=zfU=FgUYJIN1r+muz zR8K(>NG`C-IU|1-Yw(ht9Tt0_P zdS6g}?j9m-0F$+{;p4ZU+uafV;YF` zX$Fgt=_uVeP_6eBH%e|GR=)vq%iNf=y4zaUD7srT%;)9QD<8Ak9F5ZTTb*}gkbD+{ zLpq|3zdM*374yG`HaaCevprr_e<#!J%6V*|^m>Zr_*yAz#~Yo4|H$8LdhJpXNYm)aMSRkcpD#f|@qswDZf zPQ*tCg>H{1YF`{RccWzK-)H-XdKR6BOZ0;|j^`;t6J8BJ7_|dsr)qJa z9=$iL=@l|G!6AkcKw_~wLz{I7Y1HYyH%#>HgXJ?`ImWGb7V+bC)h&K7WxKL6n#@o1 zq^3M>QL!I2{xhU4V48GZBLK6F-nRUkO-J33xnGRo09{#{sFne$3gISl(4CTWzX+YW zp!b4QzDB2uVpb$N;CwCIli_|Y@iX1tnqT^-#dAKy{XLZ0SLzXe1^DVkD$LaAq<%zn zI<{DL*_)bqgVp)D**#d}xi}24b6{s@8 zK&5X1wN_U!vhf0|%-7@ejmYVd;*pkQ)^s6n*5XQ=l$iEi%hII<3s=fg0b;vYji`+4 zzFvRnucLt&ZjLSCdlPuRAzo zy^Q>uG!x~2t{L8>Pk#&TH}v*#f1l33T#s);Wu}(rW`Xrp^lZ@x+R`)VxpG=>^4$v4 z=IRz8`k39&+o&nr#v2vER+NLx9f;~v4WQ~fbYFhwsb^o1Pl2h|@Y;>c2Wg(j{tVfv zraeD~FQp+0RsQI(H^Hj*Q)^MV$EehmA^~5dVC~7`)=Kmz(4#ExT7Vw1@z5%viHnoY6#DxryJr_L+K%T_&xWQVy#n2L=^O zI+(R=+mp&1;bbCY*Ya8ms>hj=Tt=lX4%BtyFPQpEr|8Y5Htj#WuHc*txOuyQ*L&T- z=q#AV8xdP%$Mj2d>7(+6YAEB2VH+SbN-5z+mQbH%w?MH0C=R&8Nz3wX4;YQ|d5k)l zI4mG>LK5s6Q)gFu>3+#z_Q*{9JTCf#DgJx~O@ZT~cb)&Cex>UvSJ5d%_V$rR97d+TQcosas*%6O9SZZ zKkU&H0JAhY#N0l$i*UzN3pWTCUAXoqZG1i~V|D~>kVxQ*hVRGZzwXo@kKnGTqYZ1W zeKkzq_Z6S!{zz8SjD85a@%V~d?CCdKX>v2dH4j_u5<#GYI>2=Nzt$l-_;cE!$KzU% z1=nc|yc;aCMyc+4pdkUUh0mDDbO9@oQ-jC|{n8io1omA5! z_%%97yr;GHbgg$GxIZCh}Bd1Y+!_?Z3W+2#%g$8NVX-Kr-FPwhI?PrA`l@kpivzbD4UkpBs_ zsvXVi@4%kdXL)`G7(0vm zbLHW%F}^>p79ZmGucVDEeQT@bW1Sxx@ayHQ_bW*bFZ|y&N?6SglbpPWu@1E}H7`7G zMd{dHWy&(htteYd#1>rDMNtRJ>f&O~`Y`)5;lrZR$J|Zi%qnf3_i=q?Bili`qo7-y zwc1&H-mvg#Lf3_)#G5QyOC(iXWB)r;CtCnk>yy*+*-LZhck_NTy=Hws3o-+q221q% zCs;u>84iEV5VD@ykn9;pG?M{=-HacHQvAIJ=eR)N19hwz(Bxi_t3@#5pk4 zv(e>tK5MraokD!>mn>ALi)Y7Chs4HD+k9;li_82WbX49gBP=!>0z_ z94ViuQ_NC2J6c>OIV z?hdFneo_Ei>sV2LYtf5)jSPUrr|Mt>BrK?U&0-3u&g<88`BRIJk*aY@W7*DTFpzH3 zB=3#LN0rXk$>pB9wiQja+&1ok+3YkO<#Vs5uH@gQIqCoh1g2e$hAZ8)cbo)O4{O;c z+j*D&;fwF1>Ee02j}JDQ4$#ix-e)mQ_;`kYi&J>(DZ37^o-J47^q%3lddK~;r^{MhHlMO$>$-!swJ0k*8YLx85j*-5~p8b%KM=b4R4Op?{{mL7)O8HZYLSUm?@ ziC?D{U~aqY0k}a^YEtMy%;O{65y?1CWO?Jjd{B6-^}xDn3Y-~xUfnuEJNa*w{OZc2 zCNQ>CozwFMxa(?1Un4OsZoXdNCk!&wjWJz3J~B3rL(Eq<+`ia|1#6m9^*Ttqbbsm= z@>8Nxwhq8^#qC?9-M}0$(-el8!JO;(?Kj57<)3EBE{-<`)w0>K+04KqIsyq-40vnM z5%sGbpL03NzGlB!A-+v1l`!^=?W?c9O|Q9B`LpBx46y`F1tjKj@l(NB{be>9Pfps% zvE)C0{*+U`^4`GUlt9c_kppM7ew+FrMoNU7Q?Wv&0?J|qGBXk-WUK%fN&HGO^Ix+D z`K4>LH@jb3M}Gk^ck4|ZWB&KQ|Cxn1iE9hLA>!k8X-J>7@k`bz-l85vSe6CLvOw1^ z8os)+a{V5z9xdYyK=mng-H(*7qp!^C%g8NUhw9$Z!n&2wPp+svEqE(l7mmvUZ>qVC zG`$CTdbCqrE&pFY*C&BjRQiEfA=2dbCOiuI z#DH7C{yc_@uo-t_S+j|C*dg79#}*EF(!BQN-E2}HBTF{-?lib{k+Vnhc$ZOYpI$q! zbMs`m@m4L*H{r(ArxUOLI9I;PqfhTd8r_~p15zHQIJeqbr4M2m7v38N!cZkg)Lk+Z zP}-iqc4{a$%NL!YT*8tyW$5@6kGNC$c5tB8lqy%%HDEZ>>kvr0s7b`+|80DwE8Qj-GJ=%|<^<7DZuq*;3abbj) z1^M$69%AM$^%sDr?cM!;hx$vUl)70%_jCarvZb>H z)qmo`s%8ja15oXo>TL79rm20ZiWi67sISnxzLc~;eaR0m@P_r#uJ~sQ!AH=+y~Y@U z#4ndj}M>5TtL%cmdTgh21=k=lce9ftA@2 z-TXA1$jLoFQaBXz2w;nTvsbo?w&lI&XSY$A!J4RLh2W|wNjhBgIggtlEwA& zA%0KmCN5~WPQ#fDcH0~tm<);a)}{O823)gn-X14HJ<9JOu7l_vkT8p__BbpW@DdRh z?$Trcas*ugjx~!l<#H>zW)8r|);ORgA|2Dj`jwKm{ubb!`ieBmQQt}=?n3;g1?q-H=tn}#wWrS@;O+S2GXN6)fcY$k)(bm`C$CA8j`#W4j2n@$Co$8?U!O zgZ-p;0Jfvap2ypUzs}Kc%b+I@7HkBaZ6kdj&B2o6@gLI%>fH3GPI*0k+pR_^o!X;$ zGQC`D^#wjrjehe^A!zxDARF<|3p@|i`A)M|kt!GIQG=^e*R{3Shc}H5PkwEMHja3@ zE;vbV>QH>34^cU0p6{z{!8%k_h!d~(E&iN)~xP)TuKDa9+YLPN3~d0T|09| zUd3l>T5wwyb3LF|tpsU@V|eN>{R8wP)aQn53=`QdK8Y!Ssh-+C$<4R{N$YmI`AFrx zGeRljMjhvSzUo-NXV|q3sBX5(nFZ!^dO9~h!U+Zjs^d5XTi;Bqj;y~nBWmRK_asiJ zoY8X|e^h7BToCRR{EOPm&LFn@yqUcG^>n5qoR^KN$WSxL?!|nD9K4S#HO7m9_H_MH zSM1jpla#)bMsVn8-03G=rRQ4QO8(sbY%;b*|6W>KZ?^jd`(PNM;5qVY5gR3C3Z#y{ z9{@#$Z1c|dFQhL2Mu*w_7X7`AXxEBql>aoKes3?;^WSGtuPSCw&sQK2#nrZ*?f(`jTQ9#|aq2MZWeb!Byf=Yw{qef)Da< zLaC2VCy=rxH=i)%7(2(AZnH@mi&K&{eYPrzX^lV@i%%6aF(0a2cw!Vl)8wBKPWUjS z9&@=^s#v&{Zw9iW9@F=A?k!eZAT@HRGMk-!SoP-!uz{|c5R(9`QjWZ?0GA7NK5icZ zHfQWn7!gORnt#`_erC9sHTF!D_xfvSd^ug^fb2v4J*rFfd55Rzp$iRiB=3H^ddPQ)_)7gAUnHOlDR3g2U-6o z0F;W)=A5}1n`?e^K=qlk`!i{@U~oq>;zag6tFoC8K8KTLMx5?GJ|(j!)1zJVRbBi{ z%WTa)SMxm*{}l_MpG4Pt&(}L?f1kl~bUBeK*!$(V-9vrXUO6~^C94wZP4> zDy8BsA^6@!l{K~GO_Z=K3qJqck(QG7{r>5ESk?=>v<-;}nRBUb>nmmctF9EBTod8H z+k%|4xJw`qmd4j@E_Eekx!>3b zWI=wURoUh3j;ZnJ`yk)h!m*8ey82Fx#a}^Il;<#XIu-67b^_|Wxj9j7lAn1;O&7&D z0tLtEI~(}I;KH*SIih!Nb%G1+GX)5b_8lH~?~UL`LdP0XCb!D%zCEvc`Xo-K5l$&Q ztP}hcvQ_Sv()QG#3wUfAU0)wl+jn&iorT}*{gTFTq!4gx7;#181ONaa07*naRGUXB zSAK?havRDm^A0Y97!@3B(^Fmz%urS(v(g?BQB{zpViOdO$;Yy6j8)B?NA71FhAVJe zIT-6c9vsn|y;%yA)Y^8?1sEuR93!+}asYXp`zp{}L7~}NR`_i!TZw#>!j!+ETrFjZ z87vr9&7uBVRl4d1fQ9EQKsku9pjxXKrUf$UnzV>e7dD)Fpsq*`j;Rc;*2 zADH#0-)jAe6}0ef>2fZc0U%H+06arndgN6ART$XF0Ep^kP6bFNxu8zkQ7V^GvP~#3 z`@cOm0Zxvp!TkjRp$}f8uxQbg6Sj20Efo-Zg3W`M(D}2ULAC@aF0CMddrw z24S*4xLDXvZ1R2&RBprm(v0F5^ZN1NTP-@@Z@4=~{HPSS{qAT*G!T*=RUI;OmcwT@ zhG^Pq2>_eF;TNBE;o_7Epst3xRYOsj_t~Dr9|aC`@kX8fR9XEZYTNNRjoRu&ItMSn zvZuxZ>!;C?S+;KrRjB9l%b_`EqPI?a&9q66=nH4U&9mJOH@fs;#6uaWno;U0WYQn> zwFB|Og3raR>)YLYduryS@8}{f&(ivSzJM)IW2oy?CCtg1?F4wBX^V8#Jg&0Jy0=E6 z?Xjz=hs^+kpGPPzP3yoAtGdmn))rVBW2S>N?C~HyNzD5MJwjDaC1< zmL0i6*zEos{>+F5Pg8wDDq<_i4m>6=i4OEa)u4(sYn0|T&Fq^3HQ#IXF@smedap+I7W%q1S1vj#ashtV@-6AH?j->VGBSd-BIk_d zc7uYk0EZ#hhp3I-VG6H5{3eO_4_Z@?X>-n4mK!M53)=4YJJ$OO&RM`kNlz_Dopo?Z zK*9pfEABZXb4H?s+p?g@&04H&!+7B51g|>+ zR~%{?%{gOTR{`M_ghjDdmF7)pkqv}wZZ(JqH(J1)orSCRm+E$c`5{16E9l5~*SO7q z>)NP^w>3n1Emj0^II_PvU1ITs!gEx|J{93i#{0ZpQ}Lfjmoneb8g~7MjaEf%_z_cQ z!oDf(Dz(p|B2_whm)+J@$r#0Zq%QXsl8@4){dZVyW4#sb(JodWVs27DqshDrFwnFg z;zVVEn~AMmAhayC{897Csb5xik{1J@=ogReyHlvb@WUH*J{xD+zwj$8`8}`1zLy+r z^9G!F1@S25FUZ#=9~JD)pyM~Bu!&dD^|@OX0`3?&yJYr=8qw5+!^@hcmDA%p@l8TU zRUQsceQv6(_c6z;)df*lj1Gq@Hzp0b?U>EsfHDn!%pE~{<;#pJV8O5g?#glmPMZ0- zP73E_>WT=e;D^8ZVSh{m5HHKImu((Sj?Z+q3pA64aKur0n43O7l=tYDhq8K#>%_75 zO={F@9eunMRk(g*MxE2qIoZGBzQ#u}yVFpif3t;a^YY>n0H`2G%@JD&xUx4U3@q+e zJNiqO{6v!hDGT~Cx8=~ZEB`Hs*w?DlWJtl4n0M9hl>rSLQz>bXs}l`YtyU3u(*R~b znZFs6ExuW7dfu$yF24X2HCCvg03xyaVx$t$%Ye3VA_5ZOe&?7*19D}x%5-%T=gb1U z7E3=8a4Cb=jGP%n3?|5BV#&(5t^#N^{wf(L$Hg6}PWnFq!ct10RCp-I_Suf^ms8>% zjEbtdwh2>lQL)?>YYzpGt^FlhO2yScUNipu`BUp!-5kj8!b1i)gXo4tz$(6Mla`0& zsCQ^_$w!X4FaQ0A|NZ$>`Ux}cIpYT4LoPw0)&g3D$u2oEWgzxtlR*|saf)MGI6c?Q zcdg45Z8I+yiHgtNHLu`LHeTulPHI(K)ATd60+#oDM=pAUs~pzv$Yka6lFMPe13icsGA7uopI+?tX>oT zuiFiO{`UuZ#6M@1q0)bd3J>?sPvpE}x!oQGRAL86~WT!zwUPehzzj7DqejY)pRV^SHREdI}AM_)wf9@3$o6l8X4f)UfSWsARb##?zg{4SNEcR8+ z#*aXCgHZr0uAtWKc7s}-WjW#=)o!*QbsfQIdCtsWJ1$M`NO7T6F6jb*ln5UmA5f5p zeR^6>cc#C)0LO}}GBRr4UVii#__8Dr^n$GnKzx*fo6RA@lEgiNvlhH9OUYG^MHeuu zLghrTBl<*a$EW>pr2;*yHD<8FSPrHQV7wTn+NximwWKSTQQ)8mO)m zVmO=rxDV2E65j5239bo*%PfG4gLdHcT?ErD-#XGYK&jiK=*~In7L}7M*gtXqwtYh* zS#-~r=YLzU>hCYoXhxQTCyQ`S?yA~fBcIRH4?U$T#c`;!7=2hpIKt?Tem(rVmHuo| ze}d}jc#}I%(;@3<);6})I5UXiI(`2@7f-~q{J)Xw=jI5_ktXAh@nS5E<&Byj1^_UD z_4xIkC~vXYYzl3+)t_KDDa4m8<>U$nb+1w}}bW?wX*0N|vAhk+k zt!ssn$t62)$LMRd;Z?wmslR-VKZ^BYec1v|R(|$!zy|u*XS1&KGNu-vK((;!%cJ$C ze|?>Y%c=y7X)m1W3)o*s)ux$J627w?bFU|jxJy6GYgF6Fz$vjr)d07pmT5@|_xl~0 zP>))pf|Kp>>$EIlA?WgM>NKx+q*T^j_xoMaS&HvXhFItlijGS`an(HYnt=>C!oR>S z6dKg397;5N(lN;yAh)8k19*bD~rnj$hU-K!vtx0 zc?BbZQjK5coC4%Ap#ihm)XU%YNhS0 zte8s^_;)J%wT-KFE6IgzI*3tm2arl%P#Jh4pgLN(#!ga7)&xD2ZZmL<7M@?E&;QZ` z)QG}J#p3qEM*Ls;0rX0J{ZQUEYcyQ^UBYyAo&TNm6q(@eVVJsK+6}|I)i;F*UtOcx zVZ7YJ&7<6hZQnRQu)B5K9rx^2kN30)eiR@f4C~w3 zKRSUPIX3^DlXIJQ#FX&teoNicf$_l*-^lE?=GGxdQRO?suq|0<5zp6A6~{?j0~fcp zwp?LaFag|^b7Yaa<&q_|6~#CTwrKbEKwU7l4Q1-M_OG|e1311;cx3HPRbC206W=R9 z#1No|tqxdSvoYhI1&BidP7I`yw8y|NH`c1figWq+fZib9@|u=nHApB{lb`o{0rye` zbro=~7M2+-SX}|!YOS)X=RwW5`qp2p-Wb4n1!of9smWbV#0H{g1(e7EUy@=LOH9ty zucWm@DtX#beyaX1%Ta%_eAL1b%;vW*L)H(aA2A(JZ`UgB;?weZEg2hdMwz`xXD1Ko5 zbYtnGSY>~F+`_V}Zm3k5CN6@dKx3H>zzjH;iLpsN`FT3Y?-R+K_??9>` zZ7TL-3c~~I8(%L@>p#s`U48fMa3QUR4O4P967JWMZJQrlp6D%zJSrDp6Epu&|Qjrz5gm%Y#yW^0Nb6s9@QN;-m~^yeLIoM>$Rczxc)m>fWH;7 z?*;nME_4eW;r&?osQ-CzNZL-{H!fzF>?P`eM(*ooI9=;w2Ob=T*(7`_SGnjWKdK!rA(72D;j;F_<|aHQISGCo85 z)-YtgNZmN7$M1o1X%p50c%_uE*d;v<=xpjXXGTgHx8;U4ugGgX_6@|bolwBlS{kZN z&5Zj!1Nn{u{G?hJ`cG9?t!}Mf8wf6bQwg}QS-{%_hF)4kc2N^&cE_=6yJxv@NUbRq zAk-u9{wQ=R2phma&MQ(Pu~3b`EQ!@9=hfmdksQ%3rSV`|5+KoTU3a=t=#T0n(=2Bh zIdicLbvzUdNi9UHeDq+S{+Q^$moQDsB)KIYRH`iiohTciiuv!DnjdH*T$EzG=fi5c|LO3y``(sP$5lQn0_s$eP#M zKV&>m*BC`sOByLHUjV2|nL3SSv_7+M8?zzn_qS71PLuDaZwU^6@xsUZ2Kv&hAE6(^ z=s!q5N|0LGV?2(5I;g)d5jw>rem#?tS5w`u=MAD}op3F-{Be`{AfeWhWPVBUPP-1| z{57E5h_1@qgz3Y{%>uegeA=X1G|;c=UC)>1LE_I&W7u|2s zyMS3w%hd8b<_*SqT^W%bK&^Es*1%r18q%jQgFD@AqP9XnA)FL$G(@CX<1+{hL|nQim9>yZk1{imN?{ptL2`C zV-J9_9L1*wmncA|mQ&O77XbPCCE0oYyx(!VRUfkc_%*nIQY%(#gCu!*qXxBpO-rhl ztbWa-<(CR6fMtDe{A=C}n7>Y`Y(3&0>QKKQAnO~-KU_Z{V7=b~Flf2eBj#Lt7o}*4 zTaM6|OQSs48#d`^z_0$bF2m+YA%dY=5d~4r%)sj8gv9-UU0_!DZO0PtvH&O-HfaLk z4hQLKy}wu(z+QX{*9{5JM}<6_mVmvs4ZORi8Kt6>93s?dYG8g8sBz#TRz zW5tq^SY4yGHB-4+jqCWu{L~}=J7j}M9RX}$2$K;th5Y+y)K{H>)C=ef6ufiV=p>D} zWAsaZ8$Hsn`)cy`9JsXr+RO9B)aavoi+lf`_szP$hfc6_s+Ltz3O^~nyq0n^2)m^M zA55u385$?*ZFZ*IyNovZ8-?j5hPv+;$f{whR~9GI@fuLnhP)Ez7Zt6w*j0L! zWvV0||2nwqc_Yv>0TOOr&_I{#A~lcC0|mAdXdlMuP3zi;*~>@ThF5n$FDxUUkb$Kh zfTID8V2cpawWqUb3+jHK_bbVd5B1&Ad2%Qv9)z%W8qmk+(|$Wu*0;wKnxre=!8C37 zzrceBF)9z^x__*Q%~~YjaibCAOm2g)q@%uk_rR8$6Y7W%=fW0bX)W+9550t^8Ov*m zhFI7akEa$jiP3F0xAX6mr zKoXySGxqoV$vXv|j4h`$>e$m9rS5bSrxzuv7eQsYf!_OgHJ_3VU&>2;;m17^ELbj; zlFNLoj>YPcEHnuqS8qqx`e(;~2W%;rYm-2>w3$&XC`m)Z#@C8*iCnUA zeoXMd98fnUnc6bA^nIN&d(oN#Gi{j6a-r9gK~+a@PK>Rmm{RW0by4D3-U(Tr91{FL20qDSDK$w>oSKIo!0am|K%h{oI}qO3Px$*7LgB@qeXdS%9TL zCjQ8OouPlsmIcU! ze9v-OQvrm$MXolrUIJxW{6L?wx{&%T7YP+`ZWMN1>m^PR?y2pp`Q$aj&dwWSBxzHW z(O7+jcX7Q?E`JgWMg zI#u)X^0BU~VB-a3z1e<}fWX+?xe31Jt z8Py8UB<wL968W3ZaKY*~8b9qG&+FFEwtE_k6g7M%$9-_cUTqrfqZvCqdhTr>O z`Z%0F8JZh##5WxavN#=dHEieULU z$b?F01LIm8p<#iWc=|#?(9jH_{8@ld)is1uhf8ER_Fvyu9?bfa1f-H%?(5uHORXx6 zA6H2(bh4K4b4CO16(COPlNDT(WAj8*2EALd$tQbKZodlTZN>&dJGz-2wn?%Tti*NH{ z7HSLwDJ{I>2Oc680T2W=|Mj zyy#waC7{vE@}btvTu?}WMjlwp5)qbVDVH9t8Eam}gc_zq>Lpj|GdGKzw0>ll+sy!D zJK)bA5M`$;h0y^pS=G81OH=u+Wn>>m0BwCPmbWmAO0!P493)RYcAraN5)e4E11C`} zl_`}rD?X1U15)5vWnWpTGT|>G1GK(0kJ6X&D!^nCAH~dOEvs>Jju)W$X9a{)NQ?e@ihYFH$&165;BI%)*KgANszSQjRg z#$x`(6f^jqMWFTKtq^-D#9@>Dm*>$O65tq$qdZONyY&8d^?Uhr@>70K=Z$@ucHaEH zMMvxZ9Z;E8`FIDO5H+MgvpRKslDoGDGlX0CwK3bJ)fIA!AI&aIx_*u7<{P(z31(!c z#8>V{mp@!*ai3`N?2`%V*}06Z9nThKyM2zQ)~?!WJ9$0x3|H4Kx_BX#)rma5*PKym z%5{`4$ZtgF=a6|DZ}~gEMBF_Le%0LFk`=zhx}KaQcbuKs(CJrQ-5533x@PacPAXdR zwe+C!AL^vO3iC_|?njSUhYxUcoxHFdnRbjxX}w9u8dXUJO5D`RevBBW6IX0w{lLOc ztPNd&Mgyqe#nDmS-!32CkNC7-O$o^XAmdyn&v6x1AE-8AU~5uev#bZg=e%Kxg>@sT zPLI)>uO~^xu`@Yv#dRZJgE{AN++UCw6+6w1oNl4OhNaWElkq-74e(L^ncUr=ah&6d zoVoagvLQq@t)v#BcFQ;iP)Tn^Z?<+#oa~l*MzH`i|B{X;E-z}^a9yH1|C0pQCp4J1 z9Bu2x$z&;7M%KJo$}75)TIw2LXx6WKL1L`7`d9(j;)4@lzY)>u&`mORS4@ zo@!;O^)*V@wW|YDTUQSTAcM`)vG7aCIpZ!s-?A(v9|vMK)nKwsn!gABM)QL9F@niX z=8XG#4?sNtWIqxSxe6`si;q&VFa^ai)613gtzxN}tSAZ`7qI(E2V_{=V!6F zz1_e-0U1HK-`7yTX-VexLEU4lYmq0jGzB4x#psd}?)N(g)n$QJZo6^e$@ohtfUAqR z-C!=4N|mp=z zBxBH1Y;rCo5to@UjjaS<)qWf4Ualgyn%5ZN%YAHYi!+fIPOj_z z@;6~wsQ7Q}#!xa~$S1BAi9>z`z+7}xHMOiBzb=;&m8*)#En%4eWJb9lC<&9EAI)Du zAF+%a^dAFuiLfjQsodBEJu>bigy_sbA}lEh;D&nCo|RuVrbk$ZsM4^lHw_zAIGdW( zaL%@@$i?02UmHU=iM%i~?)OhrR>=J58bHllE>X)Fd0nyQjI=CR8bQtLD$T)Ft|Y^H zWIxI$;M^WK0M@L7$)`fKew<(^%wg@Fxm>_Rsn)YCn+Zrou5U>J!sseN!Px2wMBYnd zDqs4pY%r|GcWryJv`e25KsEU?%PdR9WrO-jUDwq%D3bS`>H&Mtk9^ZO%d%iy*Emmz z;DsSa`??FK->t=@j%<-&JnOd-FTd7@>Vz2Zp0MZrp`B1&sr{VAu98Nn)VAMdYm&e# zLDhGmsE%~|l&90#I{0usO<>l@y}scFf{|uq^Y?c*!guHYTAG#a+GYX`66{p*^J)GV zdKX?>MSq~w8BLauawGeh619EXEA9HO=5``w1xmFX0~u2#$urY=G)lm91E&+ylk$2g zUYn^X2S*0fE{!2G4|Kh;TyzR&Tpn*GS8?&HV*$bt!`t$A_$xe=6HU2*%-(djB}#ior+@nN3!5v{P->%V-~3M=w6@!~kyrP2Y* z&G=u}`u3`?%k%TzDQX+Km8Tn)5016!H?#&E&y}tYEDo9Oq*i%a zLUtV|wplNW>i@BocM`^`C13yw0%pKLSnI^Ez!VW-xg}?5%f^eZD7MRj`WmyF$>ob4 zb2h_K&atdiEl)#Vas7u^&+0G6J+I#0r{=C`C&E{)PQk@DAaA>`>-D0R=o`CyfTYg>+FJf(!R z6d+xFo$7o-Tz!#_$_a4cQ>;TXXRBLqDm{|QWmv0#l7&|mYi(t}q^2@aWGAD7uO-fX zz2knrL*CsZZqSp4* z{q20mpuoS`y6;41wcS^x@k`f30 zx$E3c$Ew4byVd+w^uJs_dGOTHSImRE$@AzB=5x_W~xSa^rnoSMy!^@$rF-VriLBed%WT&RmZ7 zEBFg8zH|d{FJ&otXn&|Osr8gOgY#PIk_hX%7OU(AR8`=3Sr*)G1+HAzyZLiXDHU)S zGOlRf79YR$BDI9u?S}h$cN++`ZdyEE!CbSjHPBakDqGtqNSyO`Sf~a%t7Hsjl70^S zr4w{`UHxN;27(b4ykGh{dQ8^-!gl*nMWM;F{vJ)_p8Sk;K^DTor_JfAz4=J_ugaVK z%dxfyw_!-gUgMc?^?2T#zxSI?26%ep0z+Y-vt?8jN)pZ!7`WE#a-1`kB0jKk-7O2&o11Wz*$a$5zX)d$U)H56S$m<<>T|g+u z>%oj9~OxUVSWV~LwR;!yxeYbkxxPq~IOrPO^SkAx-1G1SH zCn99yLVG!yZUiV$n-YPt@=-aqvJnjQ&YZ!k)O8{xEHyk8%XF3NbX~!{NM6Wv!DL1)b?&PC|`>5f+W@ zl3})*deWlz%jq4VCdbd_&fbwZU37peK>d`nFQ~5#K;u#RJ}riuzu!m3fnW1|CtF{X z_hZ?_*h4vL*1q31ytH{f#77g+#-s^Ay35Q~SRdpp!)NlTpj8}hb=Dh{xql3)%>e!u zoTE{o4Ni9xo#fxXj~1NGB75=+1ZQA;L5L!b^LlDBE9F18_SIE$OWeu49>wl2;M!I9 zocK9*;Rld*t{obBOWtPPi30p6V%S>j6|1zxz{O2Q4Ir(!98toeAfj4>4vXk-GcSCY zzeSZM2adII{a;@-gNy*6fNxYUzao-j+lv5>?$~$miz#JM>*4~?tp$iqi^0LwJwU?k zR()``;GFldsg!6z5(~cj{f?YhYod~CvF0s2>rw7fUpcRG9NpCj0qa_h_W$4i=LUel zYZiXAqMWb@kZ1BCzrEkh(Gov6fUzS%1OPLdEj*p6|%_Rl++^(}mZz zTb2bxBz#IawO^-HEKGBid6G>L?UM?;Q%VLz7THz5#03yv*R}XjB|=&jBr2daW#ImK z$ERAbg0PBptG4Ub#!)saTdAWd9ONujIb+SMxOZ5vEXn#$0q{$HMSkx9inZ(y1XL9P z_lUS0zu>Vs^`TTJ3$df|x2R3`8EHO?HZ8Ay7|q-7XP4`{>8QRxlk0K(vu*N@fY6xY zM0$dL4B|XlQW>avgszmeDq7n~gc-p7>%MUP#q7WEWYu<7{@P{2J5W=Gw_@%r7}~e- z!)R()$Ze;yHLV=sptbmm%Rv|5VsXA!#qbMO4t=YBe-E++^SiL*0EcsM$Yyf8bTprN zxSjs-jnlR4xi$Ge!pv6OR=EfCC}5ZWs7|_WeuB^0CX_>@T5PceJ!i>o&9Ngn9rdSn zgx)V%90koKxi+Q(GwkwjfZFihrPji#L%*NCez+p6n|$|zHkz59OAg#=aiz*XHbI8M zT!ixM#_UO46Sa!Z#89I~4t45m7%-Rf>X~v!q6^b{q+9b&iLfmHS^YBu zOCmcSt(8>3R4)EYlN_HL%UDM>ue0zSjQ_mq-YQv)};mAZzy5`ejWFhCUr6jiy4@>|xoNi2n#R~R6PS`Gpg z4-=@qM%B_cQ9V)*l_vpcRR-5}#kywPK0b_p?*?FxY!k?DE|@Ef=%ZLS14?}*@C{b} zVkMnw{n9F+w^)peZ2lZT)uG}5#3?e0nfqiQJ_}s7>#*m6>OTxY z)v3HSE5xVDLK3;wOLHQJS}xsb zs6(4uXt08rzFH|Hl*FQUS;`IX8F_q{DpxQ{`Hr4qeYxsywcsnR3^IJj%voIllq2R= zE6fJqF1KVL)w(VbUJi0Gxq()s-!CmJ6QZvLS{m^|{<`2BhlyM1=J5Vfk6R z5#i(G!}1{lZp*D$l&&k*`)6_WKuG{`ky;P-#wIJz3RFscnOq21tQNWETNeuU)eGRb zG`NA)IcKpLCJU>EiO^Ql6M>SpUL1v-LFN{qv~j2MGKzZxxXmBbKIuupa4WS4y!s8U zLxs3NNYzcij4J<5&u$|K{|r>u3j(O7g$!f`%7(`MUaW#utQ8=aD)~WxYD??{%WpQ| zF(B!gpxfB`lkD4j0DNz!hF_v1mbTpb7$|perSC?Q=6MrsEf3u?qge?)TB3GoutkTg8)v&( zrUUkJ86{7Znd1xg_n6MO`TL$U2EM)^)6p|LFW0yV$@$JO=om+H@D~i#o;Q=nF(CIc znuu3j3P_JWG%y^HRZAy^-HbUtyL>9!V`*-@M|)~7j&#$F%D7w^Vqa}`yKV2%t)K@7 z0B@Z70L-D<9Mkcb+tMB(4`mgGha%);AjOcso=M% z9;aSzOR-W@AF7#=QwG?Vr8zF|Dwc?l@8!5NeUP{dsJKSk*UVp}6vbQ%sGO^1-*BAr z7KUmKso<9O!P43)7kb3oz$25Z^1_Pc+Cd*m8ihZSv@6)>2bXf>97&H`mkv!JtoL%f z-;TO#D|wkyIU0awp$~+0sa)E%D0rLe_%awqeLu0hQYy_L%n)D~G`Wl*g?Dmg)fdM@ zE;35)y@ALnAu+_F6UE{e9>~ui!8UkhtW@NFNvXOpko2_AC9!T^*E>>5`1n{v6wDU9 zND2{XDM$0~_fHVSr2uK)&tNC-3cPDuTdySmIlA8n!)7~%va16st`QWlUeW?A1>oEq z=G2NmSf^5zMd2m(w+jDqmiAMb3j*Oqilq+dCj+X@Z*7qGSXKPeThgz9{LV5 z6=1qhA)}tVl}wlbTOhYfY?S(U1COtyH!0hogKUq`6P_PE?thRTojs0&SsTjc+tZI? z_FL#t0QEq^!;cjD+rf5f7dm@+A44&pPqS<{**U}KqhTMdlM`t+$Uu+zRZ!_sdb&nU zgH*Zx8BX1UY6vio$8hGE*5nR|@N_lt;$=p}W0X;OdrCyBRh^LoenK-u;hCrD>WvIR z>UBPr|55PkFt0SlrQ$mQk;LLpkvs+Ma)uqtB`Zv{!mALFK9|3G+_{zmfZjkJ3Ja|F zRX#6RmIe7<+)NiVSRyBV4EPyZp>e3<}c~*a!3P!P&IeG_` z?A>kk6A5X1bbthKGO|64f`ia#q0A5$DW)Un`Gcg<3u1CYcjQjm=`7gH{nk&xg&_pnv z%4K2Fu89CF6%@@3My}SW%*ZHhm6<_cX@l4&%!*cgoZgnD`uz2Xq4;;z3N3&)fV<<9 zynKsfw6Z%HCh9&)MJCNk*U1rsJ3p}1XY9rR>t)Q(bBb20C2TV_6n6?Y1IM*3t$(G2 z<)-aWebllfzog{{1FAH624X`#FtI&R=NK~bK31y#64i}0ZLv>?b)53W zYQuvd-4Pi1+YOn&17QShlpdH{T>J<}Y@o=4A=50aE^a`LdTiV0rhQAnt}sN-(9j*; z>RP;})dZ=)65xGO>jHSdTmWe4S1_dehoA3TU;OFXJ*A)9I#q`934B0Z%t>d z=)pp&z=u<+JPwJrlyMzGHGaTr2Q?9_VpY1;YLI|L;nJzfB2C)L)d)*kYDE{+Lbm)h zt=T13#8*_11Fca?3dD z1yI6lEk_-aQxd2#mE-0tmjLB-E2a0Aj85UMZVgn=(sH}{BUIm)0$`Vmsa%iJ^h?FX z>4Ox|N_H7h5^G?)49J0NS|){AwdXPy0FV-a*J_bTM7Vw23edO`Rzc`lFY(fFs9>D} z!sIVwl15!p!YXbbK;`(ng4N5iV4;MxB(NM4SD&AYTmZJNV$DiUd|X?p=&Nf0J)&>^ zOd;~GZD74eM;qC);QAk_Kr-Y)GQ}8^v9vpV~)%=@A;~ zWj*3p!wQYo1T7uaJ7;pzWxtWxeqK&}ZH|^qgHq(|t1!M^XP&gLjj~Z>J+*;*UJeUUpJKMaq+>c5#TpLV^ZMSGUaMXh# zHBF9}8#)jsq_xAl@&~cPtH+qDoV3TPE3n!YqSj}7j4z!+*-jLh92Mk3SdvT!k0^5vb^U65JZ2?(W( zb;jZ*#5Q;cMBIe+<4sJ5`Kgyu`CgnrOh`~4CbjBUx_68mA!0(}vU}q@i8uRK%2)yQ z#dgIkueDt!nl#@tsGG`v(bdb;2>+}eo5|b94Bt&2V%TX~A}7>^^NN8c#Wo3DBDWo> zJ1Jh_h`X#hU>r|=)UP&}iEO!Y#;Sf@FM1~$?ZW>nWuMY;5mzQ(lOOGigN+bVR2$OC zxX~i(d!6hKkKjAuL-^~a&5f*XaY;Tz-zECA52SgtAB^trXuFwLNNbVn zQN0fEX7?=LTfgSVX=8p0x~|mXWc=8pUY$O}UNgV@xlmtm)dhkaHer2VnYE$u=oVUG zp}$c8-@n3w&L`uGLMjUsVn<(nXh5G6G|)c+T+)`y@!O6o%Eu(5?$3059QEr-*wG?2 zFl6y3Y)wdumKwoi|2u#vL*|Z;-whzK#hLMz-COB*t<_g$MccWiLdqj*ThL&f@RG+a z{~&LKAlsR9&}~&u&}tj;rltS?**o)iON#RDf2+FBa<^gjVHoydhILp61VQvQQCuSK ziP0EEOfZQ?Q895vfq-HJBcLXrxWu@{eTha<5d;LoBKy7!F#CG9vvgOze^gg@b)W8Y z&b@Q*orUx88E&8MTAr$Us_Lmv)EviOU4)-TNQ?37&n51*b2?H2FyzA0g3J^#G_Qn>9 z3L(81WU`ik7W9%N)_$)1Ss7Mgh!=r>3h<(viZmdk#23OGc@9G-4J#gzTt@JkK%=Af zaxEy$F?CXMY~#nro&Tb-u9U=3=^wWX~0yph%AXsomp$h)bVs-t3jMOo{uwPS0y19{iG#(H%=$tU+Zm54aY|Hg7u)#c~z>deq&+p|caP7QRO)6G-Z zvtVn71UlxCC_@4$V!iUIy*y&_*N07Uy+gWI5k)3uV;)UuI zr`v_@nX-VK25JG73+5U3=&K75xZsT-x-<#m497dUp0wJVhd`eo#b zL4^w6_p!i@iR;B-Z5oz0DJ7BwtaFdeTUkoLR#Pq&oxxU0QSv07?<15V6e0$^!q90? zVf$&qZ>X%S8Gu(UVHr$<~{#SKspz(+{oDN*TCZYoyku z9c=qW)l@2#44A7FLF8B0_N8*UM6=m6_2dBRp6?^0%g$8Of{o@PC@E!hR9_)u}`97QVvd( z(U7AJ5^u&Wr74$uf>1|(bCZ5&>tA{j6{^@BhLnN}?VL6V-*W;22rCK-BYsbb#`T~pG3+fH~o zMpSj&!Me7#vo)FXJfmQc%L5bOzuUBTA|-E1DO;|h`kKn}=j53;(HBknaW_b9dpT)q zogOqrI&iv(I`d9D;oB&x?glws%nJYjAOJ~3K~w}&C~Mhlb^(RHn8f5PZ93AfTql#G zSgDIF1hiG4>@I1%LD5}WE#!{fMPVjOjv}9%Zzk^vQJZ*EA$wC<4^uKHiA2dXzbBbY z^grudeY))J&c7S^IP zTlQGpPYn(EvNBck@jM1jDb!tR+}*x7~(lVV0@f92=ILe5OOGMp=Q&!z+;>i&W+?+ zMc|u=f7|&{oREWU%Beh4+%|8QOT3@lAZ`#d6AUzKvKv_r`&p~M8 z8UR}+5nYazbOQ5TSnV!>gr!XvjfwzTsf{mK&nrdXq>)7f8UjjVT0%v}Aet~VV59US zzo${&o|pJQjlpuIW51wb7@7->O1=ScgTTm(He-(`4X`MrFrI~VbfFXxkQn#>XdH?F zU$>u`@~e1LLkN)oqCz4(5nmo=09+4i@T%gzu29j`(^O$Hc1H?FprWJxSRgZzi}*q{ z%qD{tA)zrtMS97&XMOo8mnThLNgYk!HcZln}GrRCHVLyrkr#n=y`ap zz?=!0s1~F}43H-8AaI->CmBTVtbd7E>F9PLk_~5;{!>ONCBR8HzVR^4ht_t|%bb0f zH0`EjC$zQy7D!*|4PF&%QjqOrbg&G+$^N@M3v!d&=DMX^}#y9R|7f`KoIjLS=rWUKy|X@fSOYd z;_K*$lg-2O>jH8)7btX_cJa5#C7C2WO^DKVq-%C|yW}mikwnYSM6kN!C^O!5;K6(r zP6pAK=^UGCP1_-r-_s`CF5BCVZv4DDZ5J=DgO-n(Um|%GPjY$ja=_~%c8bcKH;0Ox zqo-3P|C4Di-Dc+PHa)kBCc?vH%AFTS=X5N)n04zqJ05nTSY6NW+aeV(0h{u|wxw?P znMA$jE@QL?EmLZ~$kx$zQUYoe^Ogk6<1cz{rxLcyBc`13Gn;0+`7rhm&;gh&YGj=g zU$@q^1qxcC$Dn|WhxIsAY|ugk@>pSY(ovy#BRzz$o*gX+nt%hX1xjSufNYUGS&+`% zsEBk56D4{pL3$*>CW$6#m&rE1c3x_&V}B7=j}Z`qhEf>dK}XquqOfoBOi@K@Rq^=6uxg^R5s(IC92v9!rM)B+*>$mN0of($U~N1%>%i4a+yLTsIEEJ+O?T10q> zln4=l?lJIfHlHirp7Pz@`!kBDVl|0;GpEdWdzQSPvp4E2ex=UCRil1(Y!Q zl8)LzdtM|uk?&G3IufoUi)Ix9l0ZOcD?bL_qJXjbAW&h{*Q5dTbhJSd4^5s(579yXd%%8l$Izo()W?lBM6#kZ7p?O6-^t^GG3F&$YNI_ zql>W&;0;C(E)KKSwOXUBTtvQk zW3b(}y-bWSwFRm@&)mxtZEPr|X{yjzU~7#imE!TxXWK@moOCIg)WVie$`4w@ca^4q zFuk}JLa;}FAFgi%1ZWY)4y!W}y2;21XVVnvJSI!A64NFf;Vdvx{EGJRCc=bGw`iTS z%ac23<|wkA=66ehm;y?C z-E^XfjT1X5pc*N1W7}%&V;9I^yx=R`H85&)sMMtUSsSL3^rkRblU~$UTp%C|sI~)t z+9y7#PhC-A{bm5I38y>RNCHoq@y}Y@WVuTH2uZ0EI`d>jsN2!2WrI|=JfwNiM!`z$ zV54KJnp9Ge(w(1v_WcAaa4G>+$n{N_4(I3!={M=%`H2(+$j`H_WpSHww^%n??4!&0 z6QW79R|`-xne^OXQwFFO)Ob!D3jnmF(DFLcdA1i&%?+3X-q|cW(Ub$KMR`X)??@`f zj!+Tg)P~>A`KL6>F4EDYmkl~QFBT1$arwGwmrS^f{2ambT4d)gm13 zk^NXkB3^_v;3XK~%>p5@RjdWITCy|JDQw|2F$m`&W7(BD0iG=oXRIX^!t)F;X2Ce6 zky^$#-U|y9+VX1GUv0Fe5&|OYOd%yAFd$W8H7DXS#r3WC2~wAZ9Zhv6+a8tY5iY!n!E zS%bBRG>Bxpo{If+J9$adt&l>{44M&`=lJt=RV>@3v@)ktqQs0fGs&Kd1?r+sX@Fma z4ox5nOyWw3*3q3PI@TFY7$ESc2*W0xFOi-Lltv)CO4foRuBYVmp$%!r1iRTJgg|PU8Ut+Kx9NmR zp+y+ytCS*)eAWtkD!`L50PJ}ls%flSrERZJM3%q?L=T&e?_zD;kqCs6G0q|)R~}NE z3(>+LMEbtrF%0o5Wl)MBc0nN!EIV$BG|hzECC7A;ZU)SrJBKST{3rwcRhmr)sLcaY zGn}zF8YQy=aEH#HSc5g*y|?T!GNThG}#%)XmQS~Ey9(KOl|1K4fFV5(^c ziNdszu#UGgq+wv7pF8h=kh9PIxY>Cvl#h0TqY+k1EeatrtFP_E_ogh3?I16cxxoXc z^J2p;D4V%33OiK6n>2)5IdCNdTT`*Y75ljcx02GUG{GCImtSaiAx6>E#fL-Fr;P3okBj^&$`87&EhtOGIpI_kqe9#)WUWbD%+?z31)|^?7R4P z=4FESBpZNMMY7rEWtW<#+yl#LIJ3R730)q;?z#(1uMms#BKDw!BeHA}}}M!TR@gtHTyF;U+QzB{7)Ln3Ewg2@;*GOzKG` zbw>igS(`))D7%$sEqD`|hg2dCOYUZs5sL`yjMa*yvucs#pEPw8KeeHefP>1`TO>mX zJCWN4tHa79j$7Y0HBBN9sd70ooOPdIWxf6Wki(bT7jy*Px5%_k>dDrtihSDIeq}4m zR+G@qN+$9*8f`uqQBdYGIc%qhc#3rXL@RgoIk!EXP7%5Air~&v5JZ z*_&#mlJTX|K`Ae!^kCI}yl$vl)o-fv&GJw*bM7uwqzp}_UMI0Q*k!0lv+7Ykbt^Z! zN}cAnzvoHD$3}UyISO0XfuA_RpD4-DLx%ZrmDGgZBu^~t%oIAxh$R_o06T{ARyhh| z1~AjZfYu--ePcCdNgsu|Ai!M?rP&c_L{7JcNPSAh)CEDa%5)J4v`_?L9dB$SURc2o zt4Ja6M#d1Ew-{euHYp8S?r5v??nnSA3kGK@!dhKSHr?#++uD1yvrawe%==xq zZ*=2YYO3e8P8Pcfg4HpY`#0~6A(8Vo511&5pQS8slWYH?SQD3fmmIX$5n2%v`%Z-9 zXmXxE+XNqS>LyZgWOTYO9ZxuIs!8!stc~RUPQVL4|BI+pRu;Q`!@ z=bSo-5lv#bvAUIZo>E>2Wzve-87r@fg(JuIx2@;YQ0&M+x*tyT9-<_!P$KRUEhCuo z-fdHBiJerTQ->nmE~$d2>d3s**^i9|Rar9zNzH8_%OC_ket7}~+=)mFv|pm31=Yb> z%$_|vzVWL^J?c?snk-1xquqz{Cb&|mM04F*np%Kgjx1CsCo5VClve_^R#P2UHD`7peZVn2Bu77o@PLG=iQ{t z8>uD*cg`qHXkEKA(9XngJ67zV+9Ix^;5n0M*7~lk+~>&J4AoQ7blNFwSEMmOhBi=! z!6)N8)?;0?CEbkasLs}80wgOV=a;EY!0T2#IhjllRAc}xUeD}s+aMB*FR<9W*gorLPBpoLT zEJbX`+Lb^REmy1sa3TsW7@7t!V>uJ~X=KxKz9xJi;zo@D>Zl9?kzCH6V2&{uXn)7( zd&+V)Tj2cPF{tY{Xk0`U`?GD4%bbE+zT^JmilGxo5%x!l)>QRrnrfIvZ zrboL3<$>z>XPk}Bq!Bu>kJFEt#o21mnvj5y0EI>oW~>HM z|4VExT&>J1Qa0JVrJW{LXzhZ=>RT!GEM72VBZJfhpuf-{6)m54nM?U}d_hSox%HaA z=$vw1a-Un+$>5~|T70JFffu{UJU7+Fm?H4swV7-6D%@299e}E^Lx5?f7XI38`Amk- z87!NN=jxpLZx+jKEh6I-S(vn$k9dEG(VlGXzL(P z^4s-}j^xbEf(T?1#vi4<=tqd|t=)>kX5YKOsr!DSmjJp4ieuantBNFAN?doD%1ObV z+Cp@ew^o_TTB^4A6c?hc@r=j-in0Gz2fuWEx+Xws^qhCJ-GZzn?Ugp|B$b*4yYgmk zla-NxCjRvMwGR zIfWL<$f=dsb%6ErThyOKY|&lZhum~=WmE`+7hQf8`2_AnZNubP^QHiLobl6@+f3Rz z^*<}4=`@o;EJs#5lw-F5RD0B;9!-vVR;oRk2=xH?ZfMu*Q#z#}(@t|~n@TZdce_QD zRirBB9Wi%SXM)H#SIP>db)jGZ0u^6;p%GffMUYXB3KiX?OLBxTF1M4hF2GuCFirbn z?-GAbSQu4^spg0?X?88*9>g}lEOEJhQT zMLTkvT##0rj@#-&2u4Q7Xw)0DFdEg3l>-;BP8BipOXt4L51SjQokef~^#Ii#^{7WZ z>QP(j0jU$A{GH*Qk91@-;HtHb;%ruq(Wh>f!Ch(}+N?L?J@@!ISGA5-md>h88$VQd zGFJ3ka*mWb5tYxT?+Jkvf zCjh3l``p7-CrRB_S|MjG}#KW2BI9BC0 z<#zV73~pGErd@m&Z01e1jCG6h3inf+ib$QD=q96_Hge+HxiJk#x$&}pi>PD8cZ?pV zkT*@bL5r~P4!LJNsT=(u|HM?0g=tZkcHugGYxh0vI}|K7YV{EN-oi|RL_}2Ty9GWo zK%_|UoxBl4kOuvVp0m6cxi&~JVf*aDpXN`zZ&Y-2It3sX)U^d{lbTEZq@uLZ!3wCz z$~0?z+>KFDURv#B!2Xs%j&=VjoyM%r-_j9v4^Zt9I&BBrVGvgoDGeB4=BElkt$ zC|b)hUHNz2ghlm=GnbJWn=%;{m8nSPia>jJzIF@Hu^dxapOZ+cb*9fxM{8n0sT~k% zpNl|Lla?+FSCnoi%hwc0XXCacMo!tBm%^EQTjZ%VxU0Ff1IyZ3Y3hP7*%&6Tw7fe| zAPLOnil~UZExAYjog7-MG`p4AiBmVAX%PtR9*cL=$^&SHvq_Zz>FK-;*a)_uiRPUt z_!QPd)>^h5P1Hiwwqq-xY6@YC+AjB^Z*JYkqF=Pxkxk6)1GJ2c6QIl}Wp(}*^;z@) z)gJYzM?LCMD`@}~9f!`|r2R~$W&^?yN@e8W5W@3GFRm1-Rzr`Eo9)=L4_=WY+37}t zvM5ya&&5w2K-DVEvGP?2rWR3woVXUIE^8vnqmXC&M&XGNfkqOd(I{>COe^{#%1>*J zLgNX6CqR0pbfH$LFhn3CD*(}|qltp&Y?<-^)m^EpWb403@tsyN&4Q|3MzORj)%Q+E zZ7Od%0j!DAjyfR`TMb2QbmV2Sd`@He+9usazS%K*DyZuXkvx!Pl0a}f5)KnnmRBc$ zXp#tIO!<|Ty4+`H>Ayvk0_M7-Jg~3`ByDF=n)htO=A~QoJDsOSAkiWMlq?b)l{Ja$ zfNB;jimdSB;PLqDj6sfmBQii&5&uQJCsvGkbtK|xIoHN70!w4Yv~#4~J+&hQsZ%cr zmr0pY?gU(b*?qr#a$IDgn%DO2;<~?c-6#k^xgfHeQl4I$1+s11v@cJl>Dq>G&0~U; zheA#cnKV&jY&~DDT#DO6w*vNY&nOt8Er@T!2`7FG0E@)--}tS~+l=YX2W-zmwMRYb zQIC3*OGeoV3H=<<=$S}LL4AzMqWu{>@>vWXbSQmCu0+flKcAX>vnf$#Y=nhmyX-G)FAhKh2ff&zYZ-F2+p zyopk^GV#LhR+I))JBFEZ%2SgkNG;%Mq(Te#caOG@CQ^sHPX`hXFkpXAtu$p*n_^jw z7p{|u*WvwSnz>WDSu>*ys5C8LYMezTAD6EkMMe3?0C1Ym1T=8ubVrw=3+e=_=Bb}W zmj&79cEFj9@BVFDOS8)aFNvXRah$y??u+BIuoXom1e6i zP#r6Sh9!F;QVXON@txxrG;{JNDU(ixN#bSa?#{AN1d zXxaFu4bbW0vt0nD(?(f!d^`CdP}3w9mMVrWIevlJ~8Et!_)9HJ7U`mDZpl#YrQC z@vo`{H1r1QL6fo&NCktH3Z+s%jmBC^)oLrhE#=#dsjFgkTGC8arqcl?^=N7++y2jt z%C&gp^ogwJjEOj#^{MSfEAzUPHWrDY*s3wFjEN=_lHZC?yz zB?rs1{HBlmw}PxO&>8`=6WKTEwB9Qpi+1H{HblXC6Ok2z@H8 zRNZtZL=M1Tgn^=yv~z>xT7A0j5(&uv-kN9&TUpH0P0`)3aKmVA+_Kp<10t5?6o{&E zHWwVgS7X+4PQpDvHA7NLJkN_8Gz>$O>iG`rQIC4mqY05xW&$ca?%pO`7)CxwcY>8p zV;pa24*R_3?JRo9o1m{kv$+jbtD~qRbwEgnQXx_(v^LMG)S%ke$KEel$(~2=!GoXw zAD;O6eSn-1P}SrR0ii+@jB5-6DPpw_?I)Uj87KjPh~F7SSYa=0O5bE{wSGx*Y0OlE zZ-%50XdQwK@JpbDAXG+q^*xUuXvV&q3`i^qm7?UA*n9CjnxUdx@=-y+*w`pS1bA)R zU^-UqJ2}lrk!J`@P0=&3EqgRI&sjONhRQq-}` z>>3a)piY-nC7Id?w5dk#06+TWo-VD(QZS-#YUyIe_G!6M_;C2c!Nr9T}{jzp*aaa0V z@|*{z>Shq#S&{B9NhGq~tJ38AW=-kvlHIZ>tRWY*77hR$f&Uh0?E$I|4Gav>Xf)Wk zaU-=_jlRA<=FOXj@B566jqPamdeoyH^=Q{1ttnN?c+#U*s}%#IHk{{C8?VK?fPDi4 zG=nBVGuW}9YO{eium=a8^)D=V{>xGI24QV0QUoZi@CZ>t(U5^TU9U9?5K4mz34@Su zyusiBb2;gP7vYye9{KP4V6Z&x>t-#$*OFk=W1sosobgJJ*?JR56;-M6gC#t{IFg^< zJH&7QZvfpG0YAD}%M=P!Xxc$W;Az8yejiy5QK5)#)MQ%lQ~@-bO|%X;VE@IS70n<7 z=`%b$%9?fSIB>sxqT5q7pdt%ZP)ehfiY-4%WuL9v$|%(^0By&d+bG`FS6GXJxGMo7 z8B>^;W~vO+fdXvz5{zdIg43y(JBujqP(DQZamqzwCzZD%wz_SLi4zr?=IN7k11XZ(1#qT>DzmCIZKtvZ*?e^Gv9yr?_Syau98>Jm#FR_7}^WMc0 zTeHgNxu`sOt`FMX=$>~Wm3Gpx;BU-U#;{Pde25dze|Dlf0m$Hxjv?&KjgQ@0vgXB! z>(T|vt^847aft(Zri>k1LEz-C`@Mbp7c<>Ch#Rz3!%e`{ls{RVHq+WM>g>F!(e|@a z4DGQ8^XJdS^P@ZQDv(P603ZNKL_t(5BCtMLawPsx%@@n1q*1T2dhL3GW;3ZD$7(vR z&Fm&b&bt;twQ13_Pz6kd4Gau$#p)>#~T?6HiEjcxZ% zSC4wsqaN+{G&aWbpZ{VGU%re>&c6s|&(04wGRkvb{!)%T@(3=z;9{6F8@3Je&*z-Y z&whO^H(q}O^!3dw@0OGTE!gK(|G=W>y_~SwM5_={0<=U4jaC|^H699~6QI&6M_M-V zs3FEjsSGKe^WhWF!{a=9%~Q}P+vh(8Bti+bGA}=VJ^%Q^5k#|0qc#>B|0)IL3RKE) z^0KY`$GrWycjG>Up~lk?`&LyNJc%xOAbi+X=KfVrVYV5q^{Op;zHig*p-?Mk4-Rqk zVTUr_Y|v;l>8tkf#FJ}y_>sps^6*2cR?3CBTHUAQ30ALNhtP^6$uEL%HJT)x*34)O$zkPqi)jp@LAyfHk$ur2On2pfY^8K-lEKgAU^AuY7~AfAz~yjn<+CZJjO4L}>Z})i6x{1tA0h3=TlK+p^{ZdaC6`>nt6udgMn*<eq_zM?ebq5Bn{r_g9~+8pq72wEX^fF?lFAZ&~>v?%20 zf7qARcdVnfwF!O)cL>`U-qmBY1q&Yf&(4PD8AMbxYV{#5U zRFM*>4X6@ZQ%HmaRf6-bta91ae}w*Wl2~-~KS|zINw%XcrJ!8$*|2s4kFR+GDI|;L zFF*o*sYJ#1C<{fXK}dnhSdLoVQpz%(fPre2lJBE*azTVk?pg;ODUEsBl?7z8k#`j; zY?8Jp^Auz@P5nBhzfZOdJ6&Za{nP%)ZW1LEx)no9rP(&@1SoIxE;`2V0-Wvi(mcPG?ZUX>+U1?xMh>?0 zDc+rWNc=RK2*SNIGy}3ij(X9?D%bidEmtadQc|mp(?2*!v)LpFg6MQ|zE!Ht*xLCe zmUwBDRcp=sMGKfcdzLAyQjCs|GdR!>*2Ff7lHBu_R{GjBQT-7K6x59=>A8P#&Ka?2YX>5u!k>q9k%rVdb53YtyxHw+De zuQXIE%w4#Eh4bgJVBS3TTsWT_|8N^mKCuc)r76pPvQ({Bx&Hd=`Ot?x#ChkP$C+oI z2|yTzc%H}Ur=QNJKmBRm``-6*;DHCSV#Nx^$H%))UwVF_uQshhf^a7NvuZRR{R4f_ ztT9#(cM2DUy9;Rz<-UF@B4lK|Mo;PM(KD7xCGNWK0bcz4=kbs4d1vt?q&4MonV(+s zYp7P^cS4G`6W6p;(4e$nZ}xrJ-{O_ZYNwmi9-u}zy1NQCc!Fh~B&bE}m1s!~}r zfLHd+&Co)D4DfUSnB9CCHVDQ>S#-<*OaI?o?*8T)@TUW~vZTSUK*guB$3FBgUxpa2 zBmAMr^^cBhNqu}d#Nhn>D9>L&b$qSSN#gn!iGHHB(UOOJ4&8SkL1t6Ok@6I;JVmRM znwAb5G(+ain@e5SkkVtp+<82*Y7K}IS}DRn(F_&RlSt`Br}3?JYx3|sg;F6xS_==y zI>X^6V-wN^f4e9ZHbHOh>XA#+45ntX*g2^H;pou}&~(m|&pa}<*{vXFLbsq@Bmi2c zu+v17y?CnIv^!n+RNKV>s$W8QGA@^er@#P4%hzXdPZt>gy&ez zy8G@0;ulv*%PxL#S=yCzIxSK2!0k@HQ?sV0d6uXysG8{zg`9+8NVQr4*^j7HvilA# zJjXILUdQu20&B37-T{gNrQ;`jnzAN-ab3i`HSehbRJEpDDzWzg`*GmD`*7TmM{wtT z_p{&LOL)a;FJS)MIV_wvj|KDRQYn}D%fEjY-?-<#VymSYA}ffOUw%2Kopu^$o_QwY z#nx(It#{<9IKyz4`w5FvP8kB@UGca#&hK@Ld zq0OTp`T!YeG?D6|0uUaIZUz;`*r`>Hg^++kX@w99S<_G(11S+`<02=DlUZ)$*Y5=O zzhi3zrSPRkqtT#LDx-x)X+fww>zx6OCI~}H!ZRSL7N8^RVa(hcC{3sp8uLC9xoA<5 zhEaunhAiY$O|ZL^cXugAL^G~RMJR8joBf`pyp?hMu$%Se zsiuOi+HN>6Y@SSb?fk!O{vs20iu+31cVv63xOSH@wR_*K)oMpxV}^C&JJn4u{+}Di zBCZY~soMjBF5hnIi}zf_VTUYd>467u=poCv?uMJ0J8vFy_gb9Rx-u4b^+tnr>o(A6 zG-7Ml1bj6y`}(SE+cwOF7hlHs@GyJtzaQ^^&p+_Cx4zw^Dhga#X@JdK@|n*wXU?2f zl+A(aV%=+OgcG0h96s`av+1u^@I4P}G1x7o+!{>4or4ep-Dog>;e0-E{)af?u!H&G zPk+w9z#vB)ekdbbwn1M42&b%;b3yO~luLnj(YyFL6DI3BHEW%k$9GYgQt#4SbwOz; zHMg%=->J^CP9CGb>B%7hqjhn*IlON7j4;{p$=NUvnS`bWP~EzXm%i>beCgjVrdp{` zE|s|QYu{vGpr02$_mr04jYhKr8a*>qDwTNRi6?mMvBx;~+;h!h%K=ltT!vAtR(a(s zU&%!mUBs3xTNoM|Y6+Jm;gzU1xA2Wi-^=B{c$mSy3eC`5VB*OVsy50|ulfL=eAg=| z>l&e&0ZmQ#_-ZS^zxJ0@`cC1@(++_h1gHwnCs_R;w`~|>?}LtDk5WLmODn4a-&Z_w z=k@&T@dodD^NSG#Jq5f+&rBK}<=M|Wm5+bm9PYmB?s#Xsg@S;+_FlqoZn%j{KXC~R z4KioHeb8w3-+Kv`WVDW| z*CEuP0|@^*KpU7?Iw z@ckJ^Jur30)2_nj&O)6)RhPP%DteSpsl~meiB!H5rOUi_CMp8VCU(Pkd%vs`p?Id! z89TlV&YT5U4TzX!EE}>z-a$ZR&OH9=b+2O8lTUNbKYs+RG=Kg2*C3_f|DAer3%J(b zSEW*|LbJ(|{r2W(|N9%R`1Gd{{j*~hw8L?&R%7wvMO^f;_jB}7hjYiB_b_YL5cnl1 zr~Qhy0Li0`cym05`@~XqY!pq%NzZ*QpSbWN{L6*^%5$H43IhZEbP~cmS?KOkq#R4+ z`Z#ZV{hw1Qm)W#w6Q8*BbNtPl-@w{+8;ma9jyg1(3!Y|w7ueIbPp~MTHehOg_$=0) zHGa@7ea^j<3P8J-oH2l!PRAbi&r-L2Fc(~Pcu!={txu7z_pb7?yG0Qq>>k6*^v@}? zP_0(0%o-ewUj<>v$mrOVBtKmwrDXHw%_ybVfB*eyHuJ$nr4$PmEC9@4GHceXj%jNZ zP^Zetulfg;Ja3$Ve#MV3zl2-m5xo5!uV8R^gxUKZ%^rOowNXWKBbmp*KtH-U&RA10 zI9Q=MHjehHR4c|>t63kX)<}0|S*kEljm-JOI%8uET8Auq-g1vN}|c=$T%Sazf_?=;zI>>#>N{tOK8E+KtK2W z?rP5e6_@r}$vX2Oq;Qg24LQVU7B(nqCa z4lXonWw7cc<)q2TXwBTu;+N>F+IX5~y#X3Z z)d7b3DoD?#zcLurLyfWV=FX^#^r%PELt3+7-W>k-+UvRCpWY99%*_usJj{z<_Zpsk z{Be;YHO`7t4&iH8T*{+Qtm43|v~J&G5Ofv6)?6CE~a5+H*h0w$-q90ITa zs8FDcFLSMo-!2gYs*04ws?d=V6#a{p28|H*yNdo9rARqSO!g`NcanU!3pwQpR9OeDo3n^u+ZyHt@Ymdogd;EJB&U$8n}QQH)ZX z<}HhwZWXUxkvdiW&IVw%Lf(@L)1$6wx`5PaOm|>bhG_+&=fboxn}#p{=ePLH&wm6cPJiuRanzBA zCE$@JK4ocR_4ik~`@RQw*E#2M(Z}A;2R{07KJ%#y;$!$N5Uf2u@1)|iV!9^6fKsKx zzh3?+s+AH49ki5B{oCjH`A@#hX{Y^31cxQ{pXW!lTe-;AYfHRZjpauk$+1Ts!N|xk zzrFrO2KxIs`K06d#HClT|G|gw*rSh``+(y3_FvANqKz)y7T|1Snd&}w>pQjOy`V)V zTSr<8c3Pbuw9W@WQ+>ALAp7-#&NRMtcfkFGhbStt@UiW zKsma;NWMXG+A^okrwmY)nZ!#aAK%Y6z41J6r&yo_LBOI#i>Op8JpTCO9CFAZG#ZVT za8gRvuU`*9rBdl`@YR}7`W$%7NgU#P2+`n)AAE(i9L@_)ehve`sz3gkpI`eZ#~yne z1G0g_qs$n$Tz4bk+~pjzx8m17d6WZAI2O6-dTzS)ae~rZj$C;nhc6joyw*S=s8lM{ zH$2RbZ@QgLqaJ%LTgkIm?u}QgnqS|>h`*4dPFTsZB~=>ZO^_u9 zDw-$my@8wVd<^9+WW|Zk;;_A|H0mMa8z17j`!;jbv4^nk_rK!d#sW?~X$5ooON_34 zh#&p_4mOYaELpyila5;gE+0ZrCgA=*{DyB{e;?~t5AoBle~YF2?Za`$9>eTD582qn z9l!ns53b&d-#3>dR-VW~dks>nWx-jE^sAJD&HV9KzvO|{TPXF4-wRQLN z+XuFB%(2T^ed9Ge7VgQZCmzPEz6!zU8m{}@%{;ko4B^k`;A2;E+<~S$d6hEZ_!_SL z`Sm=pO|tJ{D>;6}B2)|iJ?hc!OJS&xQbM&K`umCkQ7V-Z|2E|^Ppw_cSO5EaJoM<} z=F+Aef{kc~$3g;GLHH7lXM9O%WiDn?W!Sux#tmO*^!EQkHAg`R8c*KM);%?|mp%(2 z#z8j-^*CYJAQT~pCgq?BI%Gx`i!uU02_ir>h!k}XP~b&ciMHEs+9)M9zSSX6NEAXR z;HyT(;U{O=;Ubt_SPy6jYIVFu6K~T7h97-^;GTO}aL+?*Ep6fHJ?8P_>u%z)CmzA; z?`I6j{P~M`!>eD#iepw7mpfVzDr-3+V&7)kIokh>g5p|M&+dnvl_m<9_GaBl)6Ogg zQ%yZFnLcVKM{VoEwmC zak|N0N03tcgt2N=u6qChG^%|;DxVa}Y{C>8ReKYbo={;NN434h=H z5AvIz{}||_TrM#(G74A&ro;--BD?}YwNjzJWee|q*Zb+4Gn;bBPYNN0<7P6eQ|Xr9 z37o1yYi92;i=|8V=UwkRmu=gIS@-1Az<^mxxT#pZQ|n~^pEMXZQNS?XPx=i{O+bduyx}me)gkp^XV)8gU?@aC8E!+Z*)u7aWAaOK2OMw!Kls59c*#p%g6DaJVPXyG`#xH0zW2TFv2x`~=FFK>Xvvx-fu>O# zqk%_Xf1P>|5>RIZMSlQmZ~Z?1c;%CP_UbS3CkJ?psXoG0H}I*CeTZY;`z=<^zKehR z@Mk&XWhXMa@isPWE3skCQ;dA!ApZH>^Lg2^3uy|Et@r(g3(x%|f7DgxtAM9AeudND z{UP3Y`myNoTEg{i|YEdT>0%|`S3;W=TDX`VB;Tt#m6qXiI+crKW_ZdcUimt8#w;?&%(R^7kuzTD^9$QDAV*Ki5oPF-cc|MxgU^XIW) z?bDp_*BA4_zdVUPZY68%ReSqxEGbRYq;t=C-BjW{)y-8KbPS(_j1+w=kvqW zb@uG%9;zM0Isf`Eyz$w4Gd{k9 zeAf1;N4o;`ReAW%d${6@U**Ba9w&9gVx~xdR+`b#5cVj8QpUPbDWf<@4>3MQ@W*Ru z-uEk1ScA%diCe1^JoHCoZ8`KcARI-D8cNm(!Wu|(DH4q)I@A->a3)Mq`a+`#4WJr8 zNRyI33Qdn-tWMejEmGd>&9efeG`Otx$|%2r=b5ASE)d!Q4&CmONGTDX$ME`1)c$xs z>JK-u`qtZNJhh5a81nl@gB!=TGJfwpoO$#L`j#HdlTvcqqmS|PZ+)4$gKuKdKKs%) zdk!TJJRL%)(88x7H5CkC+p1sb>20E&lBT1?+bIJR!cbdO=^kwtO<~*hnxjW;DNjIl z&rTUonqJs&vd9b9$gm-)N5ox#ZH7{?s7qLm4tR<9G?LdwYK zC~tY=U-0#>f15Q=uR~NS28h=d7#56-jTt>5vrbMAi zpwxVUOMo}Q+I8!B=wavSS=G+b4ZNNx zs$qz(jQ~FQK0o=vPdH}9Vcc^2AMt&k6OTWZH^1#{hSxsKcfbE*&V1AB`TS-7;pEX; zy2MAQ!pLy}xSI)|mTOwxWz+8nrsi0y=KV~J3tEBHeAiyBdFV_e@z%G#l`sqmBg-j( z&wS=H+;GDUeE<93$MZbu_4;<_*$e^>f6<$H!8hK;b+_HesmqR~Dgti(znd5zcor`^ zbzkb6?q{I+1h?I{lJm~}JS+B}g&2E`e|^VUTzbV9Ir4KKWvRG_i!Qo^;iYHt&5ym3 zc@@pA|NSxE`MJ-r@`z9Ky#33J)t%$=Qc@aT&wc9`@|U0dC}%HQ#Kt?n&s*Q}VZQat z(>UgglUehBSM%}D{g#)!?<(H>vgMSiBHnKQH?b-@5l8K5^yctk}DcP_O1oXTOc}F20OqS6s;QS%UGV zk>GM)nTN0a5#POT18@KGcX-j>6*g~qnysV#NCm5I{W_og_nUb62fxT0Uvd!s$m3l4 zPk+ZHm;Z>PE`BqC_Bi;ozvIi#Igx$mSE;SOiFdy7y?pz|7xIx;AA_v!LEom^`27Qi zbKaMK#r}H^F}waa7k%Vo+@eMD+&^&o?N z8kB7H_cdV>&fhjxF4ytg?)9@^{%l68RhEnov&L6!@}aIhDq7*832_uSM|tbf zWT{tsJ)$QDJt`(ad-JEMfepJLo%^^`k~3X8@M8QakGd(6sp*}k@JY+JKW^L(Fe?f- zk;|&Or8sAueom$Dgq?^~cW3P?2%1eU{N!bv{f@uo2jBY|KmGYN3`IxPJ5jw}=ZM1( zVa|d@ta;*TbBy1yPQ~{aA0OupZ~8k9Jm>&E_QCh?_IH1fjT<*3N@at~W&vWdGMZB% zEx5C2sh~Kf*1V>_%!dbk_C(=VD(E2KRi5C~a+P;)sj*q*Tkp1$6J4t_ICl^J?9X4t z;fF0J3>E+LKR@Sy{r2U;PhHMi{`xO@{P9(s^_DlV_maJM?JNI`AN=$e4%bfm>YZGlZ3LJ?QVu}D&rInRQ1U(SJjzv{zN%o`sz36Z-#o<&-gf~f9x{*du`#NBOL@aP&)~an z_zE{Z@C3`By$_;Uk2{Z7s?Z#Mifey$2PeMvSu9w%l=;mD0bBU>H+}|3oy2oaTFjQO zv?9>}03ZNKL_t)iS0jgJanw;q^5d`mo(G0s$I8VAbJ}Th`2CGP=9)h|&W7>Fc)Y%e z^6E{5fFK}L^LXKzuVv+7dl3R_uKgz0J?!(QPo2Y|iv}4RZ_?LaHm314O2uUFruhpQo8MYKmnd8HZjE<%!HX#VY z5VfP{2;~vtfew)xls3LxY^rjxNvwf+j+ZvT1xFpL+Bq{Bd|Ms#2f{Fvs@=LU;%S zN@+qJB0P|uq*3eR*g1D`zI=?qaxGFwZ2Ji3-vkyT+WFUpgb)NlfG<7tT{rXC7q4da zo_kYSxQNQ4MJzsiISZv==~$g$%P=ErHxO=I&-%^l8QfOqh&cmnd-y>%JhcwJbt9B3 zoTBRNJ?itn-d5I@1}OO@!@mwuI(;E}HLp6I>uWqxLt^i!CZ6OlrPb^{!%8^sIZq=sc&Gw>nxm26JpX#4>DzasU{Ba{*@|a4s zbu?|JKVhhV{9Dj=_(B;2rVb1YaMe{;asK(|bJ=B=v3&V*F1h3qF1_?pMn*=cR4Oc8 zx|DBy>suUu{PB#Aj!qo|T2YsS9CN~{_}BcB+t#1Oso~xH{t?M(uRk0gZH|UkXE9VQ zp;Vn94AG4y)rCu#(^QN$wy<`?Mz%iw6kq(n-|(d{S`_O#oBTmuSV=AmN%GaG{tC1A zoJUzT7zs6A7$8f7c+v;9@${N8*4+Lx-uIRp37V!uHO7XiE_@bcq0m7C7A|G^l6laq zqe_ak>o&0U@l{;)&u`_6p)!J|>TL0cn4QCiQX!!-)<9tZS}VpzR$&2;KE`YQb1pA@{p)$dU%rHW2e$I` z>Ty=z`xD-K#&6?t)JM0`zvyHJDiyZf_Y>Z8{ukIZupfucoyU?T3z;`>cH$2>XuzJ! zIC!tQ=td1y_F47h(^TYs9CFYgjj;w{?4a0mB@I-UEM#^NQr7_`ArXEbp6Ac_$>kpP zXor#3G=qQ_o_Y$~{{CGsIFKK1yvE9B9nad08&jKXGp76&kybD|j1C0?g^rH62dYGA zbQGx+RLXesRv_2hi3&zQOJrY#p(7UKRqIe2N6H35*3n*oR}C3^tj;}OSj&dH$Dt}a zvax+6;+<6KTqIQw0=70n`osuTnv8{g^h<@OHK7tHEx-#2q>ol1eo#koBwb-BU?AZ-~tlAsYDih5r5@U zbe{|m27o|^j^9-sqJ@_#qe*29t##xNHDeuUm|@G-Z9M$&W1RDkXK~Q7rCj#;FY<$L zT}`MIHQ>d4C6@Re+wQrK+3$Dl#@}-fYGO(=FbNDxS}@Bx*&{H;B@=vfvnWW zdE490V0d(lH~-B$3CA|F$DaG~x<7vf|MJPt@HcP%EAG7eUT(kXMsC09Mq<6GGKeUb z((O?+HvtML_1B7|jCr5Qd}{}$7E!C40OxmW;E3O}*tVD{KA7~ktS zPC0TKmf3>@&FN0N(O}53{_~q#kMzl5)A9MSCrz zIaY8HQfenfqjhw_2vsU2!G6cTm~+l~1>V+SLJh(%GcYj3em-moH4sLixklqtt&|zs zb17$j@IxHrH)wibV)pei}w#Fui;yIzXeHe$-*RTv!F zg9FN2`NoxB=83_R`H#<^!vQ`}Tf@fR|2I#@xQ+lqRG3&|c@oAOo7pz1@#jFj0aAK+ ze&m$fFr9AconQl@M?IQR>hI_JoBx0(J^K3lVDpyza6<6oYktk`cijVf%$ivqi%19v zn}ko_jM(QGgF}kQf2vjxj3Fgx6msr?l$Si4`lCNXOHkttR(IiR? znr`s)Z5w#xJL}l;a1AQV00<$Baue9&{D4vfVSoq~B_(N;t5nM&v%?YU%12|iLA4h! z$A_)qd>UHfNr}=SS_kN$j!-^AXS5%yN71T|wWro)MXD4+;CUWD`|ba4@66-$sLFi* zJ+-_`uSsViB!qx00g*j|C?kR!S42^qkr_msaTFaUq-gDBqSjV-S1Y*IrB$tr|PYGyF2Mlx|90x30?20vpi?1s^|R9bDnbp z?${VFt`A@<#im17@c6tzs{eHj1M8k*Y?X;`R}sQwfvDgP&PNy)1Jc7BsN>)<_Ur~m zn@xuMYZ!H(x(aqXBu9iL-`cK@aayamBe&nqh9Wzc9(}xBh_VthA9*%w*`NZ` zs_7JCwjlf1O`;x=$G|wrOm2g4l9=l^l!QzzBAj$0Elb2sIdaq@T{+TSCFSu)+228& z3^A5d&n}Bq!(h=a3%Kn6{g_7{U6oFvsay{}^cVKt|1ea?WzRj9GG}-wC^7amnU*vn z1)HrF`!C;{mEZn~CYeGQ27R>}jb^jEM!w5I2OY@DZ(kM=ZKQpZHfS%Vfx|P>HMuwYKR^ zM*8frY#BfL*)Q>%4WP!E@A?O>yYaVx;3Y@BkawT;5wQCZ)x=e$5F+L=5%^8#PJ)hf+qi`A>10Lwyze35E*=pUKOqFolmdc0~q#~#aeXT!4_ z!kUS=jRgTeqaXSfEqv&Hc=h(}dT(gariM@*9^$HNuI12Iy^cMXF6Hop4&a^#9%T33 zmN0+rT;`9=W#PPeESNt+wNjyyW%RcpA~N;c-~Kk|op&Ce``qU^<&;wx8ykxsx{;9) z7A#nR@B1{H&1rk_D!+{w-k(>za9_Uro0UA(S*`$e}lvwE$Ag^@|Ba9xW%_S=vC+EqNcc0Paoy4}Kik_~I0Mq2&3 za?~mnTAswNfMMDU&EJ>j@3Wcz|D&7u+oMir&Y%tW+={QhScTTu239}0fj#yZh*$DT zlqfM<5fG=a-e4nsvmS?JtdDIZVzCgD-gSPKd z_Zxg~!|D92aXe;6;&&vjD^bz`Du681gC<8ojz3#AOp}KmUB#}?ZRW)$*b?aPqf?(l zwbI8x&Bj$8p6B8D4jU}V6U*ixpW48_YuCW$;M?!JW7s$dQN{EFM+Z#_hEjp|*jT|& zYOtfzsnd^b-FoT%o7E_^*w|hf6%g-{`AJcm?*Ls+_pazFb<&LdLw?26vrU3Eo)Vc<9p*WK`2s?`dEgZ)|= z5iuI1d-W?`#_LZ!9;C#sR`|)!e+gDKzx=p;p<1o6dd)L@;lghK0@rnL+HDprT)^l5 z?c;p-jPn4fRx4Px9oPg4gT`2cHP5UKh{>qmAYPys0_Yz^DY)&18~NvRKE=n+`2f4` zz8hcp{uQ`VAYBi8_hk&c;Ut>Z{RV5%BKl5vEzYlhg)0^Qq}@FTn#~3;*nc0c!~rCW z7A@k2n{VS||NMS#y5)9OKk^u2V4$n*Qv_#38j@Uh_bB<6k3#RAd@?mx@|>Hw_^pt)7$LMV9UH10EbsU$6AN+3~zW+h4`PHuj^IEC+`la7vWMnQ2=g(uoym>5IIGd~YqeN#;PIUP+MD?7 zCr@Y9O~mKDFKl~*Q*|kc$)sE{@>8tV7EkEa*Ke&zl1NLRU z+Q3~mKFW%d-^s2P>~->)9ChsnIqS63c=<7hGhn+seAjI(dCiA7`;;Sj&54I`*2=H* zKJO8B8)&lT!AI!~)o8cf-~sYFVLgMU@;faC_C1CVzWF#l`K^!e4-XyBLAwhcyYmrt zdC6&<^Y$a~+6_jV9g-KJ!0R*_Yqrqr#7dOdvC(XD^ed0!{qJ}iSN!0LV(ZgZn-woT znj;Q5h>xB9QJ6n(+sau4VZpllQETr-?Dk>|&qG-XDFCyUtbQsF!>&==`_))OOX;k- z0k5?l)#~6i)2pwdQpcXZ6t}Yhg27I@L@C~H&kcN*mC8p6t;sl3NAy6{XJQP_qaw?zz z+qMzDM0qZ4-{;xKA7=2eM^TM2Fa%YgPnbvqqy2sK9eWI`e|0r(!@_Gki{+bO2x_%K zEW3tbm?%%-c@CBdmKm&cORd|&>g>RXObjx=XBsBuFGp9}XBT0Rg3A1z)&)5I`^BBI*9j?#jPKUW~IThJuleMvNdGT=J7u|AY{`%+FOndC;6#F_!t$Q4Jog$= zox8GB0wp3+IUGGgX$Gt55idlfQYd0;)@)hT0lxaBuZ3w0pu_$LAI>+v_C*ZSNu~-G`x&1%E)cH^~jNnAL zEPS60YuB-1^%@@VeDJ)0Os!NXQ~;*o11f~TvMesX_+rjG?>s*H+0UjdQ>PaS&lBu* z#4)^-eX%?@?kLamnYYK09K6pUt=*5~@J0PNPBWNmOBcsj#GBv!cIMoFJ=fj63Wi?D zd0#w*R~)vOcDs!-D!lrPkJG>S3VwF&o!mFNiaB%k;Z1LR6MGJIaCA4e%EL2;Ir5lS zVC_8*&-FnmJW=6*qh7&mq{LBBjfFE6UIlueM1K5_qvcpc|4KF_k(|52( z_U1LO@>w)s;du)1X}VSZ*SkN#z>>@P+4XmG-*Y~5=Pc*1-*__1hTAw9e%f&yb~*GU z&VBc@Tzc(&JiYo*Tt~6wMQ`S!mAiBCrB`zA{dZHV4D-J8zs##&vOlsthUR4v-!+)O zbUC{&xt04Lx{r0n2#5aN2YJ&8M^SB$;SWEbk6ds8mw)$1-0{f$R4jvKD^BK(FWVpA z@i^>n&f=WTH@WiWyLe*h^ElzH@8{_Ic4N(=d3c^jb-{8@c$Lk+ zTT(UJ*rEXls5L-Zm_p#oP$3eDBAH<8Kj=PSTNX9~Tn}Lg7C!I@b394a6f|6k37En_ zC?A>z>z;gy>T_fCH$1%h5RPTyI!$cX1cF1Tl<(m=4u&BSMh$}siT9<5QKck?W+W!C z@;;0C)a{PKrp;^jvXQqdW+jO`tG;in=ZhJ=8=zCb?P3iC(?MJ_iY^?cSSgCFqr65WC0lj$Pe zmw9=RQ*L*rfq>n9MIqlhH44jl@uY%+A6Y)RJ3)4#B3S&P-bXSB>)e0mpLoxEKEwqV z{2R|(wuHkDJB06F{!_mB)r+9ok1)(`8M+P?O3GCkGBuSn+h!tX3;}}0d(ZS&X+B(+ zIrB#Nj|^!Q+dl<-a@0%*k%W0DFxNOek@#C z%??t4WmoB|RoQ(1&pG{_|IVw+JvU|AKa z)e4at38j2G?KZ9_F{~>6b&Gbhh3l($tmVql>CkbrazuigRO>Y=rh)HuXtg>h4D3pk zO2vv(_^w08adHpX5>|zJt%fOrwvoPv({TdpS-{NJL;7?&K|O?N1;mXhP*UQ$F2brJ z!gfgN*~Ha%w;CpuN|lNg`t48>r`^Kw6qR}(RpB$%Y7=~16?Uzknki{ETgaVRSu8Ot zU|AN=u3yK0{`wmJ>6~+e-3F6g@%KD-U9yN6$whRj4w&9>t;mG$Qqz}SJ3WvVO@5X9x#PoBmVjki)UU|IDMJ~;A4 z_8(r4XWN{;(&Dmf)+4G0$~QnrFeH%poX!dTOfa` zzg1dxx)%`izsYqbJPb_zC5and8-~HgO`B;qTZulcTZPJG^u-qnRBM!d4m_AkR$jn& zzjrwoU-S*A^v83?$$T|($Dsfva{8*{aN_G;jSzw>fBs((`qiB}3)LA8&+`}<7~qmi zE@9rhdE3Y`HGvS|v>G_!57RK%^yDMl_3SfT^Q{YM?)OSgSg{vgyP1K>DXlqj*|!nRrc}e=-IZ1_sXjJusfWA49qsB{U#Xqp!0tED(Y3Qg`*8w4b^KiBGT{W!&Po z9$pKo4X*m*Tvq&33t##e{m(Jym?x3_>o9zaiyvOig?|`Bn1R(MR^Ut39c?mj$R_$; z@B}SqGxxabIO(QQ=D*ATTpjUz6HW8SQ4L_cb)+#*XPmx8b1{S?BX~qY8fnW zB?Ho<>N`|ikeE0oR6U0UqYuy)k}>Hr*fbEPK*$cZF@SItEvfKKoBmpjv8stDjIOa3 zEWFRKS?9E2rhlJu7=TXvLt2Lz7lVcZ4 zNm$YReWES^ws!uXcR-d-P(qqCj8%y=4;J6=MnV08!t(@5B4iB(Q)Yo8jvwcuG#{_= zM^z_X^^7C3P=#b_kVaT0V8z+13_%xd0ndtQ3_#MaXnhV*PD{d+D&W`*aMG- zzEg#fCY8JVoEAU;s#=N3v99g>6D8(zIyKMQGcVy5sn9uOYHqs8F7!`g!6nr;S~_jS zXzSd;MY8=r?%{NPnf%j4ya1sP^+Epoz6Ut&_&4FU+E5)x4yc-BohC!@7h$I%RFzU# zmc^Vob8sAIo06${uq#zo|LICTdf`v7p8rbD`RKdYz20WD6LqEnv%=8aVXBtcew;#y z5+zDZ7D`Qw5Y3CHR6wpq*V_|@h4R{P`&Xg49(l;y5VaxX;9}f`K9#ligYO1}VhW*Z zZCK#7=sbBl?bWv-bJ7q>g0esip-jQrO&w7EFgnKiUtEa54;If{7n&6i zhNhG&kb`Wv>n6+xe-F|H1%6``d<#SqED3%{!Wz0&YGfWTb$w?j0ft~xaoD9b000i0 zNklsd)`cvATIA<(A{MO^AWFqfUq*ewHxJPPg*fsjJS~Bcchp^AM^)?9*~4!0EKv>$uaoWX0c7 zpF58^eFkG4FYZjQ<4~P{6kqtx;n;nBv|IVssU=F3C{bb>Vb~x&#NFSA&8v|6yasdE zL-6K34`tObH$Q>Z-i+Zo#F~>;1*eI>=~0|@cjIh$fIwlG#3y$=Vs*R^La_e^C5%90 zw*UewOf|L^r6dA{VcMulg~W~mln{Ug?kIj|BO=t1B&M2)B>n@^hL(rBOf)sm1&iK!|%q-xG{kh?WpXt#Tl#d*F%v%WtQzD%UbQ>a+A z(@M-4Qwd2GAKs%>s6(O=vKm2}Nv~f;@syHj;x|*LLLzybIC(^C)E?Qs??twD)k5Wv zs8P7egiqqRj8o1uS5lerlD@~3y?eUGsTLM3Mi9D!h>8C$H9nMeoF>eUwKzO8CUUDL z#Lh*i&Lk+Muxdjr8Zc14kK4%-y$Z}K!y|R1=jZ#}C{dzBiD^Rl#?fF{!AJG+8{p|X zQ1h3g79Wn<^H}8EC3x*&EN2wqx2fXdulh5sCvL}Uu0eUt;BY7=aR`-;q9xUFlPOR> zfkP>iSlJhVSpocja}8H+b+sk7j=%=PM5)k;v=M4Bx+y}J3ernJmHHRkf~s*gM1`k> z8gW@Z7GNs_Fp!qVm{sGsz5)D&@Ia?UU)yJX!(~ZhGfT&wrN0Bu)#h;9lDVuIs)Mwt zdlsH4QK6SMg|8Pm{#;*QHlIQza^_+tR4{GXQep;U#yt}`!ptc7c68(sM5@QPWE)|| zjnm0OY5$*{(BJ4?^~mw(s~Xa@DvhJ5$A zmzoY1<&&~pjp~v7(h0#_sWNR8m!raVR9X}37O@$(0Eq)AzIrN8-+kI?a87)E}-Y6XvHy`0UX(2YPyjO#u~$FWCELlnhNhZY{VR&YHj zbiE75c{z4jDr@lzg2>G=B0Vz%d2HP(64GA#E0WY`y!tDuagM>)23jv9!mPSPVqrnfe+Pfb7)qH5+!z0D20+LP#OqMDYZ>- zJdfZ*rYRHAM=eOGz2+0`B)xDMDII#$;7b%Kgi19ChNn%Bstm+2Pw)n?2?w+_H1hGp4 zZDN4Xql?UqB0&vOTeK9UCpIcKX)rnjMx-1?avQ;lw5fta3{B}{w?P_p8vTMszv3x> zh&$A7D8Ls+FwA_3r4)v8v3-dY7E+0DY9J@51Zxd2>nG&XfhlT`k~f`2$aL0BeBcQT5xH6IqCee=^C zijm`UJ;S+WCCvSuqF4*JoG0vMFBLi2YTfnEEgpQ1vL9Sxk~HU*mN;4s4oitYaC*c^E*nlU zdMew(0^16-Jf{KSk#i97jRJ&$uxhFBtq^9*G7%zhS0JLcRhfLYCsP$o5JGZP2t>5X zovU?+jC^*oqB57-#N3oBh%Z251iW&Xg`on)OvXgNM2K+Zxr=xn4`JKxl%(pmsBqLL zlT`3aY(t3I)g7}*))LzvGx~L-5k@ms#+ia(ak=Q6$?XOyyv~ny^BHHs3 zm^x&eYv#1pOhC3ZwiTILgc;3plqgYRN5YmaY?hc&NLvi1E!_0$j9uUa^DZU|CyTr- z<+-F=(f03@kI*bpx$Si7tgq6d`*}pIid+b2el)wduZ$WH({rh!M9$SXa%X-Q&QyA- z*dhu_0!6$#FOyA|zuP2(}Ug&fVa^sPs5U-|w+t8!Z@U9A~e- z>$zxBw9ul<)Wh(jBveb3*om>Nw^EmwSqQ#G!Rn$A0)&BKhys61MPsGgo-;3|9;USa zcPB^`zMXP(<}->j6nV;dFJTjPMuq>R47PB^hZz*4iY!dyojNH!E<>oI5Hbi3EE6$GgYUZrA67^o7I%@SMZNaFo zh4duUdMuh0&uOv@rm(`NOVI z%Sl}eWZ*(Tgrup8l>ac7w4UDE$Up$nN9q3vegEzd=sCsEFga_45+$}j%JErZ5-3_< zDu>Zdj+r$8vRmkTl4Uvf^W6eWEg8Hembw#3Q?%edaYKwAi^x+^{Vwt@EXxpd9EYc# zUK2`?qA*jxvzDo`d$cge@pLvpHflFfsZg<@r3wp4jf3#K45<>fAgO<^UV6*~Z7zUO#tGMA3C1wOlLbXKn zaSTqf1k(^G46OLumi_={RI!|}DUxd%@|0P!>Vq;s?@M+bqrx(y0fP9CWtMuR_$TZ zF(oKT+Y(!Xa?F&N1hTK0>?dtDqkC)6`0>VzyAxod%Z%HinTijkN|TVih|%;RKly%G zw^XKy`cs`~o?DLWo}&;tvA88_&ZHzz#BL?fEhqzG&{uN8gQl2Jjehs4h$6MED>Pz= zlSJWqAt_&|+I9R}OOw}EMd96*$-Q6XKQ$(sg#aZ<4yez09^!O4;S(h5i+n7Phgr`; z3LzLB9mREBE6^*?lM1t4oZFNs?YtBJ2t;c;oxo zW$E5DTCGrl$=~izCify0GNoRI`HA@d>9i^vkds*y$1pAMJs!CJC-lu(K>x@hEW5&E z_uawck6ZxNdO;>7rUtW}(I~OqQS$O7#zUS(6FI+U6N*f@W)Zfx$h~N*iO4mc1?fbP zmwuuoYcHAdNY?S>$UiV>J7T=zMVHpcbh4^N2iitNt03^*AH~gTy@n871ZsRHYxq0( zWu)>=u8CvDIYbB3>L#4o&4*Dt>BMH2e*r>&r^U@KLMzksp<;g-@(hS8k#886+KxSuZ*X^blCKf^t<YbM6-)UE6|$RON2l)`;{C&Ju}uT-A$}?F#uHE091c Te)FE~00000NkvXXu0mjfNl`F) literal 131616 zcmYJabyO7p_dh<%!UD2{fYJ@p(p^hQ!_r+UsdP#%T@oTK$kH7W(y(+%H?n|)lz<3G z34D3IKj(LTf6O`aJZI)P&*x+Ay>lOrdnX32sf7QC@(}<4_$tZ@IskzAa0&)+FaQ7~ zw^sMwXcT07G zxdC;b0|g``Bu?+X-Ay@@-r6x;Ph8`e**Md8F*!3X%o1nfh`8|Jc|}24y>j;Cn}VZs zT*`zY?#Bn3=?d?t2XjtoxyWc$qToG6dwfdy{--hrN-mV>QHy^r0oP^b!RT7?oHEsY zjnbzTgBo*k7~BVU9l?J7^=^yhbn~WB@!m2JZ-#<3$TSBtJy}|Oy)-jCAK3QdIGX+n zu>2B6O8%3THIsRp!3{&OFeuLHgp>iM_67HIztXU+^frQj&BW8L*DYL4JLF^^NiT}9 zsQXm#vy%qqz=ymJ(ty1{xeBh5@IsZUW7^N&ot`0M7gfxr&b>nJSuE~z#m;DAAThnQ z=Qy9*eeYT({z$ROW7R28bWZML5lzBsq+}IAPf?CyY!8y{Z09hz9@mE)X~U2q5y(S4X$9AUxJB zCSE7`%j8G`vztT21VBOvC8R{WrOITkY7}CR_$5yp6)!ITniMvGWhq?VG5@2p6% zKL6ox$Wk~XybhY|rLSwwFgiSgn9|h-Vown6*L>sJ__KbND|Pw3V|Q3(|8LFrl*M=T zXuq}4zV3RaWMJ9Sb?+^|OfA969)7MF)L&)}r(rUs{yK0Jz6eU=YmC!Ji$}~PmZXpe zRAca+I04KIXF*r8nbY)@()}1GO<#%WzuxyTgm7g)pP;J*rb`VTdcrxkrE-Y_)wtp10RjTxI8m&O|16Ee8)tc5?(wQU#PUi%|?iGh0ipYvC>^j3)s^(WkUSnrfPr5;B{%{0uJl&u{I-)lZgY4pfJ zv=raP*>9}qX~@43m5QjeW#@?Nfeh{zz$^?t>X{_qwsDxy5DLEfdhH}y7HkFB=Xj=> z!5?Yd6St%X`q`Amj3NrPW>i}A5Hl>~0MlG+jreopCq){$j@QI0QV`S0x++Uoid?z| zi&R-O-11D!P(X3eW9q(rL9|kI+=mv&sdsa`Gx;`6i!0VNtFu^;qVIya5F>W6L~p=i zY=cnuE5d@1C#W0bvRb{t&tW(L*%q0^!v7Ur&rzw92+yZ>5>^lqd%Kd@9Du2hPJqdX zHi?ctZsiFaS`lbZp;4^h3Q=H8eua4FsJ{#vK2_1jjoB9o83kKiv{x8mA1QoFg4FMR zZlceNL&Js&G#M`5|6)`gdSb4NGMYpyH-N2a&k=06TZn(r$Fpbc$ zVEU3cb?wOL`}mJjLRjyy(3=5%ed?{!9>C9D3};b29~XbM#Btt-xn{gjnT9J|(+mnS z&a9r|=DNdEstVySG#Pl(_j`!Vj)xL)F