From f8220a64d2c06de5e3e0ccfc7e503a65d11f671c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 4 Aug 2017 13:54:42 -0700 Subject: [PATCH 01/76] sync --- windows/configuration/TOC.md | 2 +- ...change-history-for-configure-windows-10.md | 6 +++ .../lock-down-windows-10-to-specific-apps.md | 46 +++++++++++++++++-- 3 files changed, 49 insertions(+), 5 deletions(-) diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index f4a06d5d6a..876c4c17b2 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -8,7 +8,7 @@ ### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) ### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) ### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) -### [Lock down Windows 10 to specific apps (AppLocker)](lock-down-windows-10-to-specific-apps.md) +### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) ### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Use Windows Configuration Designer to configure Windows 10 Mobile devices](mobile-devices/provisioning-configure-mobile.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 9d2b98bf69..2a495b4f5a 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -14,6 +14,12 @@ author: jdeckerms This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## RELEASE: Windows 10, version 1709 + +The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). The following new topics have been added: + +- [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) + ## July 2017 | New or changed topic | Description | | --- | --- | diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 445d25bf22..eaf60f5ed2 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,6 +1,6 @@ --- -title: Lock down Windows 10 to specific apps (Windows 10) -description: Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) +description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 @@ -11,14 +11,52 @@ author: jdeckerms ms.localizationpriority: high --- -# Lock down Windows 10 to specific apps +# Create a Windows 10 kiosk that runs multiple apps **Applies to** - Windows 10 ->For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package, rather than creating rules in **AppLocker**. + +>[!NOTE] +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. + +The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. + +>[!WARNING] +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the assigned access enforced policies. + +## new method (1709) + +Process: +1. [Create XML file](#create-xml-file) +2. [Add XML file to provisioning package](#add-xml) +3. [Apply provisioning package to device](#apply-ppkg) + +### Prerequisites + +- (latest version of WCD -- is Store version okay at GA?) +- kiosk device on 1709 + + +### Create XML file + + + +### Add XML file to provisioning package + + +### Apply provisioning package to device + +### mixed-reality + +*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + + + +## old method (pre-1709) Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. From efd642bf57b62c025b745416e43ccae627a0e1b2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 10:11:00 -0700 Subject: [PATCH 02/76] add art --- windows/configuration/images/profile-config.png | Bin 0 -> 42858 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/configuration/images/profile-config.png diff --git a/windows/configuration/images/profile-config.png b/windows/configuration/images/profile-config.png new file mode 100644 index 0000000000000000000000000000000000000000..473ad156eca9a18e94f3bd559a93019408431dfd GIT binary patch literal 42858 zcmZs?cQ{;8*EdWWQ6oefB}k(8UMC145+!<#&Jadt7)GKddhbNE=)E%%6TSCNMjO41 zHpAd`KhOPr-}}e6uj|xnon6k^Ypvf|YyZA!s=p;Aq9?+`!y{EydGiqu4}bCQe30y=#RlO9~3hTjmRY8M9FQZ}Fq*O7na3Kjkme z8=a>A-o=*=ORT)SxQD%YcJc1*+ajy~6?sEK;#8vc$-kQg4NsBbSA0x$5O#ZLgk5*k zND}lEjs9jcJJYv z5WxRDT1`{sPIf_=@`)eZ@y{Sl(jwUEh1SYA%LgaZk0yyMchY;*n)lV}ETb4cCg<)2 zlr1g4Dya5jq^MpPn|mqL)}q7J@2giO48*xNZ%Bjta64h0?R(R@ZX1Y<{F=5Gir>P+ zXBoFf>7|`?l1y$|Bh*MF~j9HKTN}1e_a(V z|8e;`j(OaN?0WAI`UL&wrk5Nf6BclZ;4fnbgeDU_=*^|I_^m8_nnJE1H_MD=i9(Hz z+zb=2Fz?0SV!Pe9iaKzz4;^{Dbj@NDyX1^mVC-grpKk8hetnzupsv$>rao5o+FsjJnu9`Xp?Bc}Y`CmLL z=l@Owm>^zA1_MIc|=i44kEncLVk2%4^b)o$?XQH`h25bXbM8FVmy z*BHRJ8a0}KK)zz{MR1LBG>vbFb_RK-SRX7!cQX~6l6C-b2M4UW=}JNlD$SWxxoIdew@3SEI%JtTrD{hCs^9%XJSfX2~2_YJ+XM?ME1o) zILkV~AGWS2?7LN@d6TUybnvC$QKa?CO@qC*zTG%|p=ELE=Lm;b<-p~62Rn9uo{XfJ zBSDyqmhVv7J-*FscWp9mN?okdJK{9W+hzFKCXi$z8@Yc7RqPeNyy*?IJss76VM16= zP4NgNB)`3XlBmO%eT5LG_g1{cn3gn^aDU%8;#6G!Rjjyv)HmgpD92np)AnuZqp2C| z2PZ~(oB8(RFzC&A0+XRO*QbDE4@jlnL4xf}pIS66FAXzLT^iri?H`5Pixz|u!0SZ1)pBWkq-gvn%N?op)n!>$k)a) zJ%p6cN!w3~w>ZiaUrqHFjby#bk+DmMZnkZsRsC-g&6xFf(QEvfKcB&Zxt4}sZ->(Q z;F$0~F}I4u3zIRhusQUv10xy-W-3izt+WL+n_SN-&*Z_kW(D2m7o{W*N8=o}sr}Lx zH&s^D(9=$D{=)J550kse>Y3g;v}bTJk4g2Y3@x1buB0W@-)IpOy-V_fY6bWKNZ2~| zddGxZeL{E)COAIb%zVUtDv#-Cw=35vW|cE7Ulu;|UFcgYP+i(&tuq-fOTEtO=wQ1V zjvS1n|M=?V{43%4>Y`DN5VerU8tJQP3g7>k$XtYx4}lmi2J*lG`uf$o-%`=R!VsTk zzW^`)1nAo3Gjs}pc&}`Pw+aMQJ;(NOP&_|OU$U}s^Ycq)qiU5XhAw>Rijf*4CUV)gM_6)GFL z9F@ECNBD&kAy#>X89N%ubjg|6(Krf&w6^-UpXBjpD@(35&5%1>`_6zUt#MUEh8=mP z6;SIu9IiqX{jbKCu9$Jes*p4(B8HiJX#N+(Ak&M$0@oU*;mOmv+^T6@$GC9=KuQ!!_F1O;RUQsNZfi2{*lWdzL|JWxK8>r?ss+)ET4J-;pg3^RPJ2{4W| zh(6UDP*d__E%^8|-rMeGPIFXyKB(PpOb@%}zq=m4o7@k&y^38d{Z5nVe?*uj)HWze zKU@^rlbKM-L0{Uy1Qkeye4_f1+uEwlo#?%bz2SiGu@dw1cRbEh6n6OPg*UHTNZl^M zMq{WJp{9eR9@r;t>;(keq{!fuZoAmm^ErK^A9Zaz@Yfb%`5(&^+LcvlW{b@imc2P2CZjVm zWmV*g5M@-&U`^5Em$Xa-$myk^vjFP|Mr@9E7rS6Xcf z)}ktSQ;t2K8NDW?d>3~$Byi8YbgHC}JjaAPOr3tmN3IrUSymJOluo$LgiKqGT6n~X zPZ65CW|>Rn`kv9S;2^@(;^kg38@Ekn|GPDfMNuxmaU`?eK>%fnUyxb+mnvhCGA{p0 zy1ddUBidJMlkrE2%z6~xMR?z=6n*6LJ2PqISpV^OkbKs z?BB(IXvUUe((!&kZspOLD>6q(7onpyH0kDYs`II$k8Kl*kU`u0?Ct8Ye6#ZuD_v7) zvI&x8k1_O7FlTlnxz@ORzx?)+%tcsdp#KkjD6fOaXmqPonS~}QCQXlh zLbR-JzVJPh7N_=G9aUXO8Xz=a3~9Akor!Xoj|3QPFGoCTWxrHES?as+jK1J>6Ji#v z*NaXU8Z2Phr`)GGWWEQi(y2@ae-SeQTPjP9I2{e3#AeJ9j zC^F5i!1}Kz<_alI#5K?xwk;2a#>8iqf!>?#XZj8tLHMSJpJD~n2VObLGOl$`?A8U% zRKy9bhE+)TSe7^7>sF{Q#0nw>?kSkEGfA;_In=)&6Uz{A(a3DxrYdZe4XcBX#ndM1 z58Oe?slk6KN`d+w4XO{a61fw}eZ=Jc&7Jf?L(9}NMRmB(2_?Ox`ZX7;Mq`{mm6HnU znZ&gj_|4HUO6yhlxz*x!4(ip9fBt^o=YQ5EY_pllwg06u-Y>;@EQK%retmp9_V2N? z#5T=*>-FdfdvSb;E8XpywB7*Y$mgkh3om=#Gry{o@r~4*wyZa)7Xoe1&QG#vR5&NX zWZK4LX=p%*+^7L*jjVq{j&DAs4ZNVX(flSZ-Y{SzUYR(xFu$IusNBCB&CER`16RFq zx%DmP;B^h_hwZe1D)8V}-Wsivg3Dh78bFxAi)>kNzL?5Jh2TO}-iPUJ&yeoh;C^{& zWvNNMRW*6}<)bHnyU%%p8I4Aj2cOkq1B^Ss?}lLD#L2PLmDC@%Re1P$#3 z;a&58lCNHsbwi*SdxL_yXL`2@ru#Alrz!#y_@qVr#iknvIwtR3Ui@^Lmq?LlG}t)= zTGd1{8NK?{YTK-bGip9M(yCaEMeQ~=_L=V7Fq1oZY|9tqiu=Zjk%6T^Z9H?cJSi*H zddt3O3CVzN0df6Cr3u&eLb|Bi@4V&nTLyH;@6H(0y?a&i$X)zqI-T6gjU3)9#r7B; z?X8TkU1a&GO)O(X@Dko8g7Vr?a%L{eHZcy8-0p{&8gl8u-FmwAitn<%%6fHcru~ZI z!kkA9Ed8QDW)^y)mx?|l+Llv-Z>H|`*uCiqs@hKzPz5tH>k)744zYjGw9(s0NB(6eGrM|H+JNgRd?~+%GQPY)Je>Fnao*~-s z&dhyJ!XG6xgZ~n&4|ep-;^Zq8FT+)g$@t9_C)DjFx3tN#eHNiExZPZwyHu~O4{VSxSj);xP1oN?C(JNzHMm}{SBTcQxkn5r zE~i9K{YmFP9It7Fx|iOetPSVC_iUv6b(*0!U+F5G3Q5}c*B=ibv8s1MEp_vfb4b(0 zoj&Goix)QN$U&!dbVujO98u&25%1gB*y2Am`!;uv)d?Te$rOXPxiCB%@%&sqP1sx| zx5>qCLO-d?mnq3B?PHa80j6J#3(up!oPbue>NwI>@BSJi(tT){4rpWrfT#ZT23lpO z%il$HX`lYE3#l<_s!(Mzp8J(nCde_uY4YLs3=sS^;YzRkxyba38690`ei@(qf&8^P zt?Z&3ReN9a(#D4V4jOR62^rnSCal=yG&%KfZhVr{y-suZW0&h{nG|+r4RGefp|gZ; zGeqQn!AM| z6X6T=$@e}f8NxYVn!89NO`H8K2z;?V=jr^1M(-b;QJlv31uUDo#%@|1 zlIETmPoDEV^4Y+zzk_4C^VqG}u)42;G0GBF^@0+X{ZE?xkzV2tVhnnf7xP4yitKHg zkHW|1k(^^hbxTXz{zCJ=uY{t0w^~JwS>!4P;fhK!Pe(y`IVMX#WIdfEM3>BdFw)Q~ zNQzNcb+{sNi#;TU>HLdr|RQsT{ZOA73}f zh5#2Ehee;aZ%8|}Ins)fN<=c+V34)193=s(%76-(TZD<*lAFFb6sr|dN-AZucdSe5 z)}uhbW{sJafLttoyWhW2nNfP?70x|#B1)dKG+OpOw{v6vv2a-5bhmn1M}xd{zJd6T z;`OKe?|2d4+hjlTiha%OXy{AgmU<_AI{c)%Huh{qX2`wsWI{?w{qdM*K1Ijbwo`@N zN9E{rsY%frZwD-^9F_3dO<9m~OO4+~-aLyAlk0ezGCr^F!=om#L~CIby}g(g&Uc?;BUl}Smblb%yL9XzN4l#{L?}oY02|) z;V>m><@l(8L&Wu#&Acxdb9683~J;^>+;D3v_+0)KW@)Zn^M3bow!X`Elds9 z)Hj6(!=D=0<*G7GzGt(2`i%+DPxZ1|-ETzPAx|Dm`{PZqy+PEeGu&n4Y4cvPE}Few zig~8LG0U& zs@8NN9u9~0X`#*I&%6@vJzQ0ZN>F0xeK%53_l7&HTb?D?+leUUebMT8M4lk#C?_W= zLp1wkMtbH{NT;0EGo0W&;g1((f(5HpK9NjJ$%`IN!DO`h`#f*P?XjC;7m}QzMrGn@ zgKSi<%c;dSQL!n?5nua{B-)jfiGR3SjDelEVjs@qB|4z~ge8#1v~f+fmCSf_oE9ck z-~oSatFT?2w9fR$X*<;8|MEz}+fXKWP?|POOezp{|Jk)uhvD-W`!G~YI*^2YtV)pQ z_LtZ>Y3h$1;*fWU*Fk?`H&ZH%N|Fy88eeZZe9-6lH&$;`G1f-;Fc&G|h#KsxQGV7( zAR3i3-q!Pu^}52xK-$Ye(%5R-VneE&#QhM~zO`eEsrTXMFagrXMl$bGz7%y(3E@hk zKzGbmj~>6<+rXlO}7hN8C4%%9W`8SI44T zN;p74yc+~F`n3V6H8#P_5QsNX@P-0ovh}#VfvpI}M?r(Z1D!oc(E_7SY8weKW1bX; zr53f5II>CX{FnkY52vy}R~=*XewtIXcO(}#8s`c8^c?1Eo@G+X=(YFAOX4V-BY@|n z)SSrVz1O-jy#qSBs#SvJqH| z@Z2gUo;y8g7(nH5nqpb)$Iy>h**-yF*; z^%V(XWlFPU$8GyF#EYE^Ku1Fs{>SWT-Ash*XM^7y1fKnLDHo%{i+JMFXjl1LX0Q1P z{Lh3YmA1~8YQbx6{%j;qFMB-!mULgY<0586f;;4Us3i;1AMq#YVS7?BTS?YaYiEMp zNGJJ!woX*j_V=#dYs0<}-hINn+Qe>qt3A0FWw!qwJ2Y#lf}pq9-bXV{!h0bk?@KDHqt1$ zc*q-U$&A?z|84tl0nj+Zw-xS*a4VO{$h7%~KxSwCX611b-k>jUI(_igK1j9Yh-?oC zw?c}cqAfgqv3x9NN?bziUox`ixl&e|`*j7B$*Qa?pg!$Jg?m?JvDN8zBpQ}u0^gC` zVZAfD&iy1r$ykQ6FUHx+dp_*NLNhP)LDdhSL53Bw*GT8y`dNRKbZDvN!3b%{rGPBY z&>mT*o73r{$XRdC3ZOSCN2u>!vOa^T9{d=chQ35ax%cC5Tm+PR1Dma)xV<^<192+p zn((fuI=oO+4f5;J+;aJZp%Mw0NzgMq54UwLs;*_R@$s$7$wKyW$wo`x@rbNXuwy>r z=ok0rUBf08?N9a5Vs&0kW8}Xx%bJTawV2}o@5h852;x;7tu0yyhUQ%^y0B%bW`5!&1SYJ`VWxLBg-zd?-OK@7JJT(`n5`TpqxtBGecqh zkB+$CczTjk`Dy&wV1?Rgr^NFZsNuzpEYygNoM(qrD^A(tH63H8ImEUdMzE=3X!6F` zeR9&mIoJ|gNZo8IEtpSnh^V{ArontU!RmA&mAN;ei`8IWOBy&lFfH;7C(C1ww<);r z2AdQ=GHUl@-{A=*#lY!Bc12|$Pt1=O%!6{B9)Y3D4~j5X73Aj?Ol{oTv1(^}sGge^ zgD7HVW+!aRrQXajp6)!|A4(x~cCRAf17LL_@}oYV@K7wPc$DmAyf7oE;6M`Joo$eD zH0Uq=b+_lhy8FDepE;<#RtWUK9RTNv?5`Rq8qQ+9i_4Zk&)Y!g2JKf8m*7J~l;INGCe@qm`G*38p;4l}O8B;^sYLg-j&0ZO{ncIPq2J7|ggMlf z=C8E4hN#(vnrdyr1@F%_LA-u$buB(*d!&=S%;y_gXKIL5l$7~}hCh>I8l{e7p%Il5KVf)TzoD0^pBzMDTv zi{;r#t87-a>hNt5)>Ouh%JnB%T!!ps2r-KOlOAXI7$o|bmT8c8CV=dzlFHHAH!#We2tXa3cG<|R5Ug6Gc+ ztfMOavb&dQA3wRg%i%_qxy&JuwdnfnEdIhuv=PQ0pTsFeO{?oTYmn=4=`Y>CLBlvU zmJ2_YV{^b!J@K)&X?L`1H&*8K&vbh)a97X>{FdKMaAJhRL#%fpqOG2r?e zII?8q^ez+ddgJAZmL}COaH**M6ev^co;tnDepbY}Pva~B4sd2?qt|*uCM))OL#*H* zvgf2x%+rD8JegsdAEC|CtJ$IQ_&3|V0qdYKcX>^ctXz*j(&||pInuBe>A^K^lzP&L zz1>&!hwgfT<>Y-L?By!8$>*#^I71l^WNx0x%Lk72wf`o9F6z3&B2Z7+=@61b^F{ym z4Cz0GUg2t2V0~S+qV`PZa&t5`^&&)jvELNe2`baLVF5iX=(Pyc9m3Dy29J1r|E!w) zw$Z2yuKSZMowTo&#XofdKhmMeIbO;#d&!tQv8arH`CI=7NsAz9^9O+v+gR9f$wmc~ zK>}_h=fA9joys6fw5roa93|5ru8yl*5Jw1av6ivd|H;jK&Ylpc)e8)za(Oyote(B4 z_h&+7!W?1AT%keGK1sf93Hg1L6;_~aG%xTK32>D9PC_BXo4BBrcSAj}N($HdOTW<= zLS#RhRj?1+-jE(k)CkMcx)L%e-uTUms)=Zmd<9uTFi%9s@pp6vTab7$@Zr}C`7Lu|Exck| z7F(8b7>*I^XKQ4#Y8GqsY=x{Gwz)OnkmV=qMU}wU0mt3Wm^?&<(cjRD`MSSEkA^`JTfr`XC_@7XEE)W`o zs&&~~xl2&!<1n1frsedZszBd!Dr`?Hd7QQ_xqG`Xubol2YZkA8(R=T6sXG_03^~)t zP87d!gG0~K3(zTH(>AXb`tZ!20ZUF#`8TG7s2}d!1+g{e79-#Gj`T9M-6L+}@L}mS zpywuERo?tPp^mxt{PjmlzQ@zU!}k zh!z_jEp$$W3MTx6Bm18F)OlA&Xpy4lYUcGnIz`sIOg7f_Io2%-^t36Io6}!v*!OJ0 zJ_#ZUf>r`-zpx+vMn6d(LqK^GJBs2W0Ux7HmP*J36>KC4k7u6oiVw_yDzRm(PH{S+kD0Zxq`tQ?z0Zq6~ z)$-tJ3;gbQyD4~oWX+xqq2k0|)Ah1!h1JvH+i~{kM5>>42=}fK+y&{;e11QyAGqS5 z3f(UdHdVYS2k7-CD{r13_c8a=AW{SL70SJ)R|3#4ns@xe`qW|=)|S6r`VD(CCnXtY z)DIdi&WRvp@CtR|$2Dn2MP$>%Tk>hX;u^b4G8ZKK7bOy~QcrNFO9LVpl>UKuGf1`Z z5bluNhB{Rh^3*8+d@#R8#MBS-_L4*ZOm-4*L@O+=iGxeyF|9F(ar&-INdF>)ALoJ( zBf~%Nk{Ws(!w0t2sGEsSi+f2t(z>)g^`}#vbw-!E`IxST5xT6pKqN+LquH8O!$ds|K$~8`Yd`tV z`R5uOPr8@qioSV}zM8Zn-5QWCC6}EM>{wsaT>QuQpzQA(dDB~+kq9L=k_)`};M_6_(XwvFgYi8@ z{?t|97#=8Qc7?hX@|^zJW`2!pn9x>jD58p?KmOv!($Vt~>nw2;1cU0`Db!PJy%%eRcEQN%Hxr)@Jr;Y9;zYeBNa1LW6!mAF zhe(qWq1Sr5GFaJg6S@69;WBPO^S?U&0VZk(!FBJMpXKOfpzPWvAw)w@OBi}c{tyW+dS0~t`Iw2n6N8;q#F z{$BVEYFb_2g@xUGVXHS&s1*^%*!A*+zW`VLNEOaE)3SzE%QNM4c>JpVfrn^#IsE+; zx!#E?{X-Aq(Yf7%S=r2QQ8J#Fy`W-TukxE`fG$V?q?}QAnP5s~+z2dmR*x}dB`@~XE%gawyL$iUq zp7f1vNl~Tujvjw@ZuP;}=s;$%5jYI<-YBO4(s?91!2!MHk2tB!bc{LI0+0J<;bypN|&QdW8dZ8VbQ?Clj zm#cz8v_{)sF8(BKr2}pfKWU^BZpzCV;u?K%uciNxlz#;di6w&TV7$7`Z*bB!6fM=L z*lBT|Y5Dt4gPFv+9~kbP)H|lMCV38O!#DE39YC$A6~Ecqf>rn8!b`o^-zV{eipE?f&U0+d9NmOHCwvY3vS*|m&qbIv!Xe%pUGSUhfjKP4dj zqO9(LF@1e*U{Tc55=m|HrDXhuMjxfVT)-;Xa|^SS?g%A|iZ4@b)?-gV>hm>bfm4N_ z|J>t|;1qDY0L7vr!(FO}R(EGWX=9f?dhsY`5rsRyPUVdOx^D(}{4i!Rgd_H?2r7XV zU%6}NLVVVrMZJQ|?CUWhEHSZ2rQg&^ds6o*88|1z+9YA3SIh+InBdY4wNHZzTih>} znV$p02Jom)aFs^2Il4AyU8Tu8CvM{8st|#T{D&LZcDwiS8jkILV-$JT5nQP&pe1ZW z%UcU=xwM%*;$Xwd(7)c3F~$tfCIwp=K1c_Z^_XX&sUvd4xqPpNgFu+ZiAF+h$&0HxVFe$ER`KLbeL<~`!(h)1a~aj06qU~ z_U*;`>YRQX4~{`TNenXxKy|jR@guUSOsFZ_Fh_z1qeMJiyz>;PI{KVoNl2SJmV5t? z6wrc-h$su3igz3vx9aQOtfE04`W`$~RwAq9x4=QWNi{dFz0xVSp{_4ao+k5VUf1Hu zOg?f0y-CU5q(syRVh`b^VW{o-`GATQF|4GdcN{kuOlI@^`kHd#Q8E~moaE4V>Q((c zLuAPR_Op);Lz${eYX7^SXx7EW(e1Ly87ArJV+G(k?bQ)p#>I+jzfa?ty|H#{+5G&g zyVV`mJ$`N<@{Dy=5sIggRcQs+NSgOvCr-}p?cG3Ml{9182U{xUFJs@b578f}-~0^I zn6K#yCwsOa@O!#Y?}Kp;teq{2=D#bqd{e@3KZWb^3QVP2jMs_vd9}K#6&&jLgqVH) zQt^U~_*LBL{Toj3q(VNmxP&GLvDWLQIxC(CQlxf1w{@fk7bcR_PI!O zJj$(oHPHA;a^XW*W)UM$ec@-@(Tx$031U#C|D@i%=Z{Dv{q<>usPl{MlDA?~O2IGp z%DIAxR$gATXMSGF;v1SBZgg|>D~vuK>~e2itFBBI8zg&r+$(nicbp_OH-5P={L6j4 zuX;XBVrA1s*z6avH_s`ycbZy#&|$nGq_~E3ezU4@v!^m+O_?-8Oux zNKv*=Ga|d-UqX&2F?@^@_a_n(fj_T^@||wuSb2zM`a9VWgr*a zpv8g6bFx;CD^LB)ZEAS_w_l9mJe2y`U4mSQ(@RKz|8^!!OrkM4Y4R;KdMscR@&o=c z>|jFuL6)LaMVX{|{uW{Vs3hiV%f-8LKjV5_^$H_}#Gi;DX}MFBQVB_hDDay8{t6jO zUV%Gd-k%GQx?PjO#`)QM_byWz)D7SCB}#huZlEV|7u?CZmvWg;yQSMMX9W+gSMr@` zJ%5@_B-OlL_**5(4G}b>E&qX=Kthr(C9N&Xcd3pg6_sJLR)dz>&;DfT{@#Y=lQSAB z3z)f{((W5Xd7ouE896qJOYcIkg?iq9U!6^7i4}Ne1bLYG?MX-q*Pa~%W-4L}GBT7( zf58EVhI{85AF~Y--`WwVr4Ey$mrf^bz0L0Dab-Fv&5u^NOED4znLl5`?&+m)!TmpW zl@TSYOWfobF1#R~aaVaN6-s6sma%CL7K98YcKWI3@Mx5kjMO3X-NmA0Wuh3fLJkm& zft^DthvpO)p-`Mi(+hMA(bEX!uV0l}ayzSZL;Alem=l`gs@~b*k1v?jeMxdRa7)8u z=wuFfCfqJ66d9TkH9=yUD!rO#;iKT^c4YW?Ad_jD5BYO8?bFS5yJMD#$s?hxXMYUd zGc*NGtpgraZgKu#cq5;8RA(#oFhoH$=+7#D=h=yAKsb59a>?O$lF#}I7PT6YkYXjH zKFMX5GqFVVZ(<5re5Ac>^knP(VpWf>vXUfeau-DMk0C%VpoJ0Jza`1Jgpy*)v3EN z^J$$@c69|{k{3fYKV*a&+q|jxIy!OpnjyB(@h~?PNGHGXYx~6O9z2#lxtkACug_tl~0N`)UkXX{oExH_Q!3q~%Vlse z-)8KTp$C%m;x0C4f;L0diF-O~QWB+l#1w}8Zzk^VF5$o4V=F|AAQ?S+U27E<>UGoM z9QwZrsZJ{Egd^9-4v-aZR^rwiRP9J;l-X?U7gRDLAKr|Fi8oE;Zc&X&7RfB0lVs6# zLe+#{_CmZbHDjg0N|BIX-%ldF9#2?NNZF&dA(f~+CWgtEgxsUbg(Xd z>w&*O8Z&kN(2&`rFiXDE&EnFnbJ+@=p{O-WwzZ(*4@)9ui#}m?c?&7pXJ-P)9X`$> zsGAAlS`5f6Xj873Se7G&@O3Is$N?@98jA5FwP2pu%r}LBRgbf~YG6=chJY9F2xEB)iyxB z0|Ug5-c1=X0Lvyx%NUN+Z)UxD1>tu%#PXxGMRC&Kv9~ODZm^PpoCnWB~$V|^~mNADNF%wu~ zr0ijRCS_odDZ*q>U|v6RE0t0*|&x}Vj-|3!4`Ri*|{?qc8tooY!q5moN zv%4$9sQlc?g28*bOG#C!l66@&dk#+eJ$^HRA;#>Ju?`+LHdceaz?$#3BcCLel0@MG z9#eUMEY@RCT$%oJ+)|EjYWGOFesh4^wKhrxM(s7e{pPWI9XIH0y9GW=78~$mAaG?F z>#N&VD_1odH^#0ES>$v{v-mu3+5kWkZ%9^GEM{E>8}HEjc1pczD$MKbWwaO%1@Sde zG({P)Z$Ho)aeI3|wugT>Kd48Bk4?wpuVx@e!2AOqXQ0i-wMF?y_1F{^k5%>#q*v*a z;6JW443vXEc^2+H$f?>oY7MbUr|ngfR`T`v$Cc5|w3Hqll2h=RB|ae$POuo@pWmEQ~7y+driGWbD1L2Z^rsbT3Gx> zV%kQAvB{eH$TEcZwZ(erOCBzB`+*@|Ya)&xCf**N_OwGKpE@L3 zV7y=O@q8u%QscFMOe6@Is z!&(KFXfqK#o=wYuMdO!nVUa}Ars2vJN3{)z9sszRSIlHKM~~Zi8y!{$fpEPDP}L5- z36D7y8t4hiJ+`EwCU6^FustTECRRMX6Wo)85P(2Wm325^U<>^X(ez`<>%kbJTmial zrDj2@q86QjU!Te-FRfJQFV+WGc}FHciPPt+<%BHD?E3DvOo{ew15K zP!d>ZuCyr(_U9L`ZU(r)7w-`OYF<}cXvPB9DV=D0iY)~&Rjx@_!|Tj> zuz6gIPzZB&T6`z@S>h4{1_4A*eCsUVKdQoQhC18O$79-SLe|#S1g#5g9xI!7WK!T`#@XFQZy*X*LrV2Dj<6p3qkS63>-w!8Hdw~iw!z`rP~AYmJMDZLx}Lvd;j1t0E`f^dd54Ce?$N_LDv{MhsRN_G)eruC8*5e zeXGG(66Kq**xF?FjEqka627vG|GRdj5A!8uBFHV)0}x6xj!xlR&hkRc0LEufVQSvj z`{~bV3PTQ0{*M2hdAO5Nkkxfx#ObVZBNq$+1u=@cWWg1JzUIjdFT>8go za>U1ThaxR%{`4ktUQ`4}7+>@(K{|mOQQl}9o-1`FqwWtWF4gK?5{BNOGqLw6a0~D( z`7CkZ(cI|W&$a@*J$wln!cTJPMy_xH!o5KErSP|jKzs-C;TV=qfe9QS#}AA|>_#z% zGRpzb$Gp(k5m>mU+&`E$h}IAfj{netw)r5cXOvm-(C`I`L|qE<&%Oh7bw9nLy`P${@f(xVj?}|BxKggrD8)n+6$w@CBjI_5dXw9o}Om-lk}D znovVS=P?{tS#VIr)bCIs6Fg&#%N14shQ|1#P>cBznl1;-(? z2Nn&AqF1_wPoG5}D_lHU3%S{E213jUvFDl8V5vtxT-aF888})7m#UhAC>trr{DyYj=2){X+c!Dl}-D)f0{!-~+sGY?lr(2x1oF5y1TojV>N@J@h z8+q16ZebC69CmYZocm`0#T-0xH}Qy>*H4&P6Uog5T@Jmtl`Em2^Na(LVP2hg*&aL+ zf*QL9guhcLIN|adiYJZ{Z2VnjPTUilNDzGEs|fdIB7|xDXp|se{X|dtVxp??l=wO$ zW7Nrr$)$%`U+8eW^Zw`+5ilR}!()4`+9BJ@7M$8KXZktU0-h$+zvw(R%+jaH)TtH< z>QGEeKnEQ$j&~AY2RoCplxqgi2B_T6^~*a85xHo`BAhUCpaWi+1OG0tj5~A72jZFR ztNtKO_-N&^{8ocNepf0%Zi?oQx|H4?@$@Bp+pw!*}op|9vrVv)?`zJ|RsS zib4U4n+g1%OhD-1jtN}R@wbUpQk!=tIWalZ0pX(^vKQ2_JNzoV4p6vNCdcO9!ZFHf za7Cj`mht7eQGF;&{K1{Jf}XL z<-g9M+&lxY7J@v}rMO%TIbMtA&VgcA-zBi)vNnNH8h7f*p`CsUy)y%f!FNj9h?&4x zq_V6$xfGZ3KA~Awg#W=P6R+I|xrVB=kW+Ni^vAu~;%f`46M4MSta-EiyQ0@l<_S7# zST-$mQ4x-R3)=p?6=i2ZyAn_oLckv>9NfI&?5xm;lm^H~veChWoE2$pw_csD=wnzE z%)n^6yKfmt-JO9WP0hw3qpXb~j&BewrhvtmH2)De%1JYXspufRt z{EJ~X`*WR-SeTC%_32dHS7_o7LMKw|&0pdX*&9dIrvZrKnKo{sWbS z5qo4U%bi6Bk37c$ULe#Ig(B;GZB_ho@?rN+msiDsxiI$(>g+M!f&1<>o1iW6i!|+9 zIrke8Nt=e-9}3~?s@e~^7p1A4li2k{n?4|#DdNo+@jc9b-uZ<&%=2x6U}qv%X4Y-F zU@R%Ik{tGuh&(%FDkDea*8iCI{lSk8=#z0YHjJh}Cx-ma$6#bKVCEL-(kD6jfX*X% z%mU7ZK(+CClx?6o6oftveX-IhK#zlu^Q4R%=dguQ4U|UHp#lycA4P%G_t0B8P+4rC z-P-+=g!hOSOTXRYsXK9Dgdo*`Psp=p)E5ftYAtG^Y19OSh{sF$*h6lpd0oD-xyS+D zf0f6-f;KOIvV#Lveoc{|f%jUZKwa zGxBNS#jbZ}mF_HgaVhNX zJ*CSPVk|sR;F-keft_645)7dC-4A9R?#NM#(wZXmp8W}2Fl_+y-wQX_@SEz1P+PhF zz3KqJ44LN8>%r{lVlwuaU-5=kHE2cSA82qHcqPrY?eGs}SZ~$8qpyrZTpitWbKAg! z_nD%X0X_DaEYx887du&hl<8@4ww zGBb|Dv-B4gp|&ZgsPSLkt8e(wnWq=brbn|sY;tO{5>N=yk)Bs4ZK@|S8Mb^Q?DpCE zs6O{{_MR6zeeqF4HJ{zZMj&Bn>1GMaIxQ=K9nNG0IrnFOX$ZmAZocz9N#_I#VjZ!w&(=`ClWs5_i0eBP4Jl$B>}PujFjGSNBwBl?cnz;cK)NO>u<1RVxZr+v^Y5iv9|3lYXKt=U_?cXY2MF~-95Jo_yL%K&rK)SoTyIVv`y1N9V zJBJjI8e*iS1!ial7$gP;_#gBa&-<+RajjW8t{FIU=A8T9``Xw3?2vzGRhE2FXTXb4 z7l8d%?ec-yyQX;xruLh#l;kSl!D*GmvBb(dClOWhW#fUnh z1_~zdr@^h_NvG^ceP(8!BZdPaJRID+5MdR|E*0&r4)?v6go$W=TEENpNjoB-Sn zK<{&UzM~Qw&`6}s%d2Pn3hb>v&)-|_Mvb6RsIV%zucrK3b3#dZ8dl+cRxnTCW+3k~TT;2*+G_do&I zK#5be*+aNa@5=LfF3T$#<P;Qur(Vd?OaP113g==@-H0A4>#qJc8V51DrRkXC7=Z!$9N0*H;y@!t{27 zN7aXR)56y~Vw95=>yR?~Mb6K{osKtOZ;97v7if|W)mD)|-!4k&R_SdDB(XEG z2^$u&P^D&_dYWsX;DFryMms~ahoR!N3j6BDD=(O7FeO|y0$kb>*`YWyC`{$M?11wH zD*>Dt1lq1FQ|ZaNSFK&!&g>p)-e;zib95a&FP|2h@3^DW0zW;iaFHHDWu9hSa*nw8 zIrPLw0nLmRNV;o*&`79SGaQ|u0}r7W2;@lENWTY~7A7EO3&C10K9NXKs3T|ex;jAJ zLocxoxu7uk;lh&9oubWesCBb5HVmG_u!37TkL1>(M{ToBFwc)L>u4RsXUQO84aAY? z$kAeexw zrG8tm?xm)kjqPM!*?lCu_6#d!Bb@&M`zP4Z!YMp^*o7tcEoxyZ;hiQ!{G)h67Mka82-*RtDEWF#J|_iO61|3Tho$EF}bw{nd}QbOO{*HFM2aM^|w1_n>rr0=1dU>&rdDLCk!i+UfP+^wuz&>orPD~riy zM|wL%Q|m)=0~scsBt}hyiVx5*4J8@C(O1$64>^B^n)xCjd2uVEqd>oP@ic!cmv1X) z{<+Yb!rW)B9z9LmYXYQ1k+gDLF&x9XXVmPjF7p#|;p&;naE~vV>BpaJez){AvkbGG zsau+bBfNM=O+C3;dM9m3O9;3`zGM@2k52?P@{sfk-BEv50Bc4D1Wht^$$UF z-j&F3fyd+7M_LlBk{#a%_49qGGdi5)l7|;%d!BJjtW8#<-~!Tt)PDBar>>G%Ss5E! zPU^G)+5A?yGO=KX?6sGa2E4;841$P({j>HB0i0ZhBH)!+o5F}87m2a~ml%!_=jHAc zt!w|QZN`9_@gcqW`}ZS?vbWyoNw0fR;0(Id*0Rt9qzl1GNsA7BT5ea`!3ZrNU%|_z zqd6M|T4W$}9Il{k@U%-5k5Y(t%g}a0ImW7Xk4=-s2d}`%&nA?+-u1noOe-ac)#Ngs zR*2=^ZhVM3tV*K^e>(&n|2!4T`iJB8NS6NaMaVN-%zmWGCC4r_Qz|T(ccH;-;jw)v zW$pX!-jbEa2JNCkXd#y#`Cox}YldP)-XkChNBLM1`%>8zL(quECVE@Bx0O}3dL z2#eIv`k!g$Or%!HpJce`1NyS`?IH>8z5WMwWF?Wx21~G-&K_{V=i`BK33vbYS}L(h z-l<$1UmiqEu&}~dM|^#~OXjJ)D&MrCey#qt59iWSi1$LS%Cgpd66bHG8BG+Pscsiy z2Rof}5AhFtIOq}XC+JzFxi7%n88b1M6P8dLA2rbm%h+hvXtMG`c01ReW^Yu43)8pN z3)APwUFjb!Y(H3eRMb+KC2b1fZV`5HIiyJ$av5oTG?~yROR*~(;5J{EZ85&wJL{7U z@$44%Ky8E|5cGKL;Qh4Z4Y~R#HaWj^CxvwZ4lj&I`*5R@Kc{a_V>=uoQ)lbjF}&Wg zQ())RwjjJ82LwHJs0(2QE6S-(cG4w1?X<(($tbN!mH^V51bSc07_)k-q3@N3+4%7zVwFhTpw&o0YfB>{0C^1C1|KQA9=jeJ#! zPQ~mK0axXyojCIM@KBBF4~y8EqC>j%_mt=zRIZ^($8UhkYMvP;h8pfugZO+ zT<5qAQDWco7;^2GM=#-{D<{J)BtfdJUPf5ZAaMiLxeiq3U4|ITOrvZCP*&>?f=*a- zuz7{h&4ptX3zC9+%^AlM>u8(Ctp~#BOFiR;f!$~0tL5-}jn3vDp}|S-vI(04g##?n z59vu?UrF^aFHl50D)AE4KN8j~8~YN)E&J>```&e%K-iJvm}-;GQ5S9PqX=GZh-Z&5SnuC7xbu?YN`KK|9Y=?2-nX)S3W#aEKq<_<< z-Mjz!r!aQdAB6$X7}%dNE&N4AwSOoE^t+osCwIPdNB#NFpSb_$3r~y=9)Cb&Xv5d< z>cA~LD&zK->Xq3b_Q9B6(`qQd8w%B^)MCS(;W5*deD_W`B@EjDKuTfdrdKYEZ_C5H ze9hX0yuzwjomw8|(7@Z)YM)$a-m+LfBXs9S?+&r2Z^_TDe98fiViC8Lm?uK8PfCqu zRZ8XYwn_m|Gv)RsIK!c${h1U zArI62h5?_yqB{#3`i|Fvd<+vELE|6k_Q_1?dZ^pXGa%~xm~n_nC0;08dzc6V-` zuXf)1+Bh-!?>E54HFcmr07y=g4tg&oJ;eWpxO6t~Nm$M%&doJC@MgR2TWxRAI>!h@ay~-w2Vwl@i*N`{%3PoaM(WoJ5ir2 zS8^4dyjr)R*w36LB@Ai}A1GFWNyU{X1li)_2<0B zEH5s;0Ek$e?wXKHQIAwz*9CsB>oh{dUXg4fDHX5w!)(nxA`p(iPL2gGAD+u83LSyt zxid(pT3Ms4p+bAp^L>^_%xR>Vwo~AD^|1t%=28Uxt(0Va?7pg{^#1JMgr&_J*jF&! z&7Jh-VW}Yf&qQJ!b|GU0Eb+NY!R_x_Zm7e$BB&26^*JduuXJ=Kr>cCqh%B3^QKl~t zRXZOZt}O)8HdeBd8u=F@7QdmdUMDCETz*)oZHI`lwOb|m?xmZd7Be&k#^qR%lQjSl z&Fp-Wi5y%`yTOsjg6i$;%nz_a*4S8)0D8ywXOd~!&6NR**XN74<#U9&cPV)9qR%Ai zgnsg&8Pp{nrq2(5JcKp^h%MqBMfB#Zis|YB4rHZ-6$Q8)2QRLh6_+kTgG+y^ONZa{ zTFRp{8y}G7GuS>gqwqvJ8##H|6w@ycbx$S41ZRz&I@hH>95$F>fR#HWCr8USIL|K( zN+Jqr0e}-HdTFE#zCwJA{8W3@yDzEs9-GDUl=?x(K8`crt_>#JYRMxVzP2H$i35Cv z_h_oKHP6Q9-eA=-b6j&1eOQ*F_@n7|b@WOG)|Y*JJIe_}x2*M-jvx0_GNhwwm4WXv zVR3&MW08e9n4UsSZc6|FrKv05L+YTlhb+i*(e?xz;Ss*3fp7Dk4@o+PDzU%<*sm=TSA~qFQ}-f zMyn*RxJTQAx&RK_37*3<4Cc?>2)ZT7nT&L{D;&e$r+KR_>Q8Y(C0gc5soi2a9%k)z z_&6U?s{u(MAH^;u$p!Wo=5)XU_PDW_0+ zbrovFm9VFRl6zU=oEEYTnSvIdGF=831Wtb`Ib((e$$1JEdTUfHtaKR$XHBf(AA2Oq z)U?Z?@}@UU<2$)=&Pz1;2mppws7ee%Ix1iXI_h&c6g=h5>kHRCmoN5S8zqDY zpL9`xsiObV#+#?am^Y${{zRYptI0D=Y-1U4N-P*9ft75bAnF{3)MqvD9m5lF%ycll zzzs-t)>>yVyYfV=z9Ib3U9HXy0v*`;emnZLZop~AvN)r%E=f*F9*|M>>iqRu%{2+q z6D7mP^M~URQ*P6vK2C)8Y6zleo&Rxqake(JhxW%u5 zlBthEbpOW~>MLQtkpC0FRzJVrssT#9TWSq;S>7Z+GgP|Qq-x% zLwSDNg$i;4 zeayOd$btw9yS&T2pec_(_X|l;zEbTI7MmQC6Vf%|G>FABn(JV01RVRl~3gl=Y<5qpUr*BCu~PF3RiwL zm^Wr(IaIF-r&)g*d#3d&p0duateaPP`PLns!qX+tgH$%Ej8$>VOLe2LJ@Y$zlc!Zb zPTx9tSkee;SIjhJ3U@L7AShGz>vtd>Ag$EhCedHnWGApy3~qnh$lcHy?9Er^b{*Hr zG9KN}M4q?h76?5Js7j;T7jcQVE#7y`3HVLI{&+6qcgW2R)(VBi+{7^V1RA;PArd)N zm%9{idvBj*6$An$=vgW}QBf!$aH2TXKCQt)`vRK!rPCJSOz{Rw?GmGq->=XYVmoTH z^)~0{?2NB81pHis>lU=9q!*?q3qSXF^X~Mm9(T5L?j)z>mo0GE*J+PAoFnc)EDqHz zrbOE-r9{t)EZ{~Bw&c8`M;}@uonfCctm>33!Rj(6K=0xg5~~Ev)l~zkmpMgX30>+~ zqa6{^lI7fHb@fuKEpPBp-QM1*XNiy5&O|J9p5E5*tPM-A6jo^M2YTfdmLGsNkjb*0 z&k)SIdkF+rn`K0UZ4ahUKWeG$HPgMUNJ3s=`_6x?uuuG_x1***FFW9uBV?;5wDlpL zL6z}9ix8LXo)L_u!h%}l6ccL>JGj>ki@AbC1B}ic!_+6t6;hN7i&(g!=KK?L`~N;& zY@*V!Dyh-gys~VqmdS0X)K{DVcKMi<4mVWxGMG+7q(h2WJbY61EQp0{$xZZ__v>^( zRJgcI=C4n*C)L;y9`s^IMepU)xQ0cpFZ1w6Q6`$HG}}0P^iid(2?p0bQEOm_X%2Gb z!8U7#&H+1^txHdX+tiEgqIV(1wo#?K({>Inn0VTdG^LM=qn}wvG?!j@Z+P70Mg(tt zOwumrX8D2Bt}w(>|AlZP1UBW6biNj$n){AtS23hpt%i`4ih#&LO@OMy8FE!3hoWhS zBwzJ+b_>eD>iqp>)_J%-Fa6#Mre4I_~0OTIW>oqv-+Pj${nnb?G?+N7Hkmvk|wRz#5_@&`v9ZF9xF?}|a|`qf)E+>R?o zWr~ZHe9Lk48wz_FtDlswziS@iZDjnTe!m4H(>{I6XOkF zVCm!mII6Mv9grTLasQQ3HGI!CAvE7IFK%f_4;(hAWL|Z^VF^fT)V+&px zo5$xnB7N0$8pdb)?mE`fGd_i?O4=+vHqZsfl2EHexC2;2(CuBJim_aU|K`m8*l>%H z0c%gUVVHK@?5qw!r&}nlR*R~6r{HXrB1ztI(r+wTikJlhsVEVvSTqLMgD}S;P5d%tX5Hn} zbNZ&|`RZrE2Gkr6*j>5F&fwVGY}sPqU=%KP3B}{bufn<(vU%KF?@>H8jQZz4F>+V0 zq*b-r#;lthswD@O0=sglv9;fI?16xNdTu)p4p|It(jZF7diR9(w);M_xF>Ivj0|H=u^UV;0pAijT!toK(S^@55{8=CkLpQdU^P zZcO5kaDs&adg>HCWd%GfAi}H6YH7Lg)WcLqSToDMXj=%XJ+wuB-~d3ewQ85oh|~yh zefdZL=7y2bty}ctS2%w@*KiPgFP|+U>t62))u_^XS#@?uh&n6vo?+zH5@|C-zVYOM zP~O8@w(R>G>lfI*0|L7~UOOxDB~y8a8N((QuvOEyq>={1R zRLP^dOYCdmD)ONl{vpQLt9Q)AbS2~^I@101mE*EDWV=SrUjM=*K#!#pVi5(+)=TXd zs@t@#)b6el@Gtk>|Du(y-eYgQTPdKh;;D<|5m274QFpv2}XQAdA* zYQI~WVw$fWV_~_}FqGfaM1frMZHL>Xb5q#%_gOboO&$FZJuGdVhz2LR7YuH*YdG>4 z{;lmb8<)Qz%+%AxU`|A5FEsVd3q6)^)>q7Aaci;3we`qlJ5#Xf(IBH@V#PY;#2pLj zFqFB0T@a-^QU{FwN-mzoJ})A)_}J|0#9&vfYg}Y8W5OKtNvHC~@(x0Xk1Zu-p?d&5DKB|C;CM1kq&^^<4f-kBPWxd0Ua$vunr~Q-~ z8kN#TKdErKsyQQyMBSED)mmQEn(MSy_Z}l8V_cZMyRvYbATBX-f@{$_H&2G77wz+s~AVd)D_0Ow=~o{ZqZK$uBd6Y}PS zS{7CaZzu_v-6-q<0(~yYCI9Vr4e2uQ90G@UY&9>9WRIZ`Dm&C30Oy>ut8o5tMu9%o zc^Iz)_Ws0FAA}g8kMbzXncY9nWfJM6nBAa9-I~cmQK;RHYpvkFt7{3(&H2l(`vl_T+?0x?f1#8SZE@i3Nto=1?>ZFcb z1Hv{jzl?dERxKg0?-i0!-lN4OYN2qN38$jD`8#93+q}-=ZBmA!3OTCUk~}eWTl-`m zo@;;q84AA05yf(YySv2dY1XOiJ+Uz^sN|agc<-=Rdy3~_qh93S%$+sDT zGvd2UO_Pw498E9ONJ|n_IEI=C*OW@R*SimBUS1+d-kI*AiHY4FowsY%}!kHnSh zvNw82Y-h2WV%sS>iFzZ*G13NQI*3 zHy@-X=Yxw!jko232LX_!X9tu2D@!Mf#B{t~vpRJ>)r??x&eFN<+)2=)lEfy~CdP!( z2x^O8L-o{u=#?nHe}W``vi^=)KE(Jg$DvbNTjo2p=VDCl!SqrdTw~n>1kNonPyJ8QuOXo1HO$BG>-;u^4pm^9;#J&hC@)zLu{j;e~%L zMzX%fkS!u<2oC0%k1{qK)NER106eFxKe`VK0rVNgxe!n>?hCrbW3DQ$GPeK)7s&G} z+{$V%zc2&^+tfPIM;~~2V&`Fk(g;TWiZMOTF92C6_KOnh<8s1~haULTmUANS{^(id!0Xh<83nu=O)>9_QS2*dyL19UO~sQha0&5tAV(NSXx>far?Yi zHWxJjqHYW5BL~pPgMc9V(%>8bTSKRY7M8S0lq#0yR@dWPNF~L0+5W!u&04>FG;hGd z7~8k<#Da!9f3$&nbjyhnsE6fSxK{0lQPjLCR&o}i{tPC{OIOVVh*vF(a{5qd{^z@) z&1vlBo@wpvAEqd1`Z?O>$s+eZ)(>hTB)PW>19`afFT$B8)pFEJG~t=QAC>o%D_ zYm_5MU}Ly=`}5!{gaF`{o5Rj{0Mp{Y{j8zCzvua45J$(2*(wwk!tL*{Lg~E*c=19x z@&CJ)-Xwk}kH6O?0)N^4J(*oy4|e;%k5e)5yDo!%eN#(>glgPe0j>9#JDCw4D3rnW z)*!*<3oon{y8J^~{fJh+(?N@cjQJl5a~C?g?t3`k!8MeD$o8dl0%P0F%}d-@WN$Va z1C8(;R|VoR?0Fu4-wP)6q}K#|fU$wx`uZT*fYnj*1&aR7Wj(?9Y4Ar9xdvFQj(&X@4ls@IMvkaL714AS7pJ$M*XB>e`-o1@q-TOiDoD0GnKXnOD z;Vu;TpW2ozSMH8)x(9N%=sk={>=gICr2dab`&c(_!Pwp%E7#W76pL)J z5>5YkYQX&n6%RZj)%m|bC?3}k^>KC zp!Bgn$)Du4-|yFFcUJ21Zl+)WHJC;Zw5o(WD^wlodaY{O*;F2|;!`m8_D^}{k^g>i z1$4J((eA>^4$L0>4d-ohKi|KK5n!1eB+~hFMMeIE-ejIG_#|>U`|9)`P}juA_?Stac*fPu{!7Tro#Wy`vIG7N?1kLHy`B>rUbd{qVI9q|26re zy{BlDr{3Lalz8x9Tbb|O?1H?$yH)S8Z>N5iJ{LF1R-$wYXG`}l+7m%-T~T}tpzZ|* zd4Idw>}#|qH_)I7Rj5p&`-Y*FLo)Vg~^h$xX41P*|L8m}*GhYSR^*juf@@!{cRQniCWgm2p*3tYu(WE)6qfHh! zIBW6#$b{uK^eqV7tPVc0A(x<#Eu`juFb6@A`?@QZ8q?B{2`;+?nW{Us20+W9&`ZPX{K-CZs z`*!Dj%f*?tA8>8MFGxp{mOIR{G4NyT0rq9rSYR9t7FyyzOmyvce z*2aXRt1HQ%O*9oVpjJx&1~qsbF@7!J>IK-P>Sax0Ne8+&^rC5~P~YHWg;63&ie=%k zOGsAfC)_9)9sFh=11@=PpOBQ891vYdVynD%gnPO>0n1aOPR47F-9IwqZmX|gLYAHo zv&p(gQ)D@#hudkAwnOPqgqe$2E9PR>uGUqh&RtOmahBEt53S0g!;Y?+#=N@zWVI6N zGV46S*|9JxL+5{oBwi=71{1J%l8p^{AKhj`JI>lUR z?Gd{;r@l9lIN~dN5%EG?oSCV%S_~d@bAnj$9R7QPqF6PXX%T*Q(|e@jM1Fr(mX5)G zl!>*Osa&v1?T1d;lz`pf1XF03v{qw@c!%SZvez1WPO`&NweHe&XfPo4jHCpJ)+&*d zp#U&?_;0+n}aHV{>c5MJg`(JYxr!LW#f8gm=qN>;sYdB}6o5~@Ku zG~|C)&~~j5k@=R5c?{QgoZT@zJ{e{S=a5r)dta<5&4vABQ~W z>7H2%-ZHTs(u?u9j8@kmw_(EQ+PQg^_}(w=LG&b1-uWb?H6)ue@B--M*v1Lp7S0H8&< zy-|u-H+-`6PH7pNTh;~uRF?1XnPAd_G)zsAV&Oz8Ft%XHsG^B&?xBY7eC6i0n(vw< z%yJ+yYuDkrFi^?I1Tja`NU0*}gwQ35b)a~q&#VOO_K!)8C zwAn?D{cwhw(chP1EZ@%7>_tJ7Y)P&vj^*^cS@X=Q{p7vwv*yC?C!L`n`E{9Btb0`U zao9bEn6I_3`pZkFwB#w>>jwd8Iq7(Qo-@iPJYgH zt-H+Ngbj*dV3-7uWc#F3J}jj5;WP4{b9s*&f#~SI*{9e+V6Y{JUiN-t61x%5*L732 zyT=DYh)I%(kN+5_!5`5>b#T!SUALPzwjKP6vwx#XA71XITy?y)y4Eik0C36^Ev9)& zjy2;;C~v)hhKZFh74vFTeU7-Fb3R>Y)~>VUa&C$~5_*^nYIm>1Y_1BRQak{je1?E7 zfZP`f-dNGd?p*O&gF{cLndnM~3d`%ivwk?Aq9jP%Z}*M{Ry7Ex8Zmg|m==6|6~@?r z+5s?S9;KZB6oEK&{V&&p;0hGWH$(`x$B2uIrjeUlx^Yo9{dbp)ik z8%@Xd?)mMA0g7Ay%^)(Crw~a=)3|E&NdPmA`nf^CmMq{$!k<#ar4fO$Y0$j!k_u=3 zrJ05(>{V7%e+jE}a3#*se-%O5qAH~{tJDGVy?QQSJFZyqY!&C6z`!N9ZEw=4QbW#X zeraqa5zV58s+#!hjqb&U>c~^?cc{NIw=7g2c$m~hfU5%1_vrq|3r4Pz$)Z`eKQ4V< z;!-q(4vlsvVYxVsP7{?C^|*3PUCZi&O-%q6+u(< zx%Kp&zgsrkFIAI>GC=&s&+Jgqip$KM#(HeY0r4I}8eN_E@Rn8FpP&R!UNrdg5;Ms(x>MWJc6@7@h3w~~N)e<$C8JyEs77Pz8immIq_z4o^fOi=?ke~R2c z&aC$!?gPz6N!m_D12g)9V)~`hm2KskNgMCInp!TQGGDC<$+lSZx4CMwL>!u*icA5S z)m+U)Xv@kjq4~6QFjJ3t6q%XV$377c+oZDM_fi&MJ2EnvNjWN7 z6$#a1V-S5xn{9}$Z@1?R%}SC?M12LJ*CTC}8ZZONAc=cbN;|HIWD@jG15$wi0BpwP z+{Eq&V15xx;5oy1&(`i^S`aeSL_TEkN1dd1gCu{P@{sx!F>M zTcE06!g+ZDXdPk!`p;)XJ9;68shGvi00~~88hhFH&v8sB-@tspMI>hH z>X^x(OxN>_0exj-KIj!189&&=tm}8Wf3N^|BEed@386F?Is<-+2e)2hnSJBH16_+6 zP2adx5*B~pTr49!%`<%0TFg*-to1P!<)qg%FRo0vN)ngM*3+s5k716i2R$~@R8chg z;QqHk+n0xWy#V%&vB~DlpxwMg*Z+coPvITx?9xKs)#tXB6=td|WpJkIc*afJC`3IO z3J^_m+vhk*XF|^1(bM?MaO|e@&w~e3W=-YJ$N;BPZ9aOH@^;q@9c!2>X6b{c8WRxl zr_q{(stxR;O&2njW{Of*9ymB(S=mje?3W#Q#H`E(`@lM&$w-oQ2$G7wy?1a~a3Phk*5Xah` z)6EZAlj)?LueR@@5sN#S7hDgECt9>u6OF=x(`S|^&s$7Q>X^h&pdQd;1zY!I-o3l6 z__uIhDIurQ68ejUb{l%%TJX40#Kzr?FE75wC)}X5NFu~>X$d<-F!4?sRKHAww~~^*&9OwjB+~(>!^;v;bRRH`?Glxa*!jTivm@8pMae9+wzifjRaRX$y&qZ)4SLkt9b*38 zr`8Yy#2pa7P5fk&d$Um~eZv=UO=;Jd7oR`4+BTGB8Gzh5_^IT`5;m+QZB!hyq)&DG zAJ>>P&@d+J)N5SMU{4RBSnVn`Mn9GTgM0?nY}Y##M+-n=PHJ=aZ5^yrGDvNc*$vv? z0oJWTRjU{NS8sX{;~KDW`R}HD2D=2F)n)8Ag5eG*=jk_ZGm%?4s~7WPl-ya#z;b#~ ze^cpj-kH!r{CXe;46EWH2esmqoxrOQHDmv(kdWp$543IL5>V6J*vSNW{5tcbPx7rr z^pDQWjb0H+f2LW9w4Z&@xt*$O9EIg&MtYyh;wa90h=HitVbHy(S?05E5k;^Zm8Y>= zyN;}Y5^)RV`p5$rU_6J=g1g89?VYUSktn-bbDxYgu9#hu->6)M+c;VLseOZT*z7Z- zqviLY#e|M3g5FI>w;HW4|6w6B`M|_Xu0YZ8m2kpnSEj?Qix=IUB!lP)(1JtvfVK}; zU;@Ut*+&)4`?Im<8KDr5YWhFbc4Fv0sQbrxU;)SFV~#)R6QBho{@yzJIy7S-*t6&1 z^P2g4MnJ=B%C6p8W0eS!pKN@52~#qOyBxl8bq^^D+rKedlPfs+I96SJGaBvItFBaH z?L4k@G%@><88VZ&=@MsK?vQY;VkUF9lwpdxR-11a3nVzk*Bszu7MayP6Fx_|!Mh&C<;Z;HoZl7~8f3s-PsTWA2KEKEL+FRewmoNr z8?~U^PggCLioUkJL#mtABwx1AQDqC(jx*}5){C2duMpHhdb^jkt%fQxz5WEzTw z7k(@+xm7714jncr$G?1Wzt*@cAQgiOi;?O>N6l7l@@YwB)CHCs6sDqJMcti- ztJ~|tp=AvlN%2!Q*{u6{hx5!lJCE#awiHPdeG>BT0qYE4xV@)J{%t+P&R$t6@% ztVEhTQ{xKn9t7N;zreI$N6hqiM9Q%N-eqp0sF}U{%1=nHjrW?d=3dxAxP_}eE&D?~ zB`s9T8^jRHg^WC&|rr*EeTk+A@?Q|r)- ziLiD@xOM19qc~GsRfT_lpcR#7vah#?(F^73R6Rn!xdDq-?o&A{uY*Vw%Unshd30ss z#QMXO1dEwLqlAzFPW%mEHj)4{P>&~33j5&5Q2$|x-bIo@nu!&^=e}AW%L+CwAGcuP zR(>CT`wH#e0~IaJQ3H5LFN)ys%)`u*kra>Tf_OND%}%NBA+w9~+knHk{DydWXIush zPnVkZsGIo9hf@Q6$h9}}nDkxdM(&|w1#}+E>!3ACqDRn<3zRDil^5*m^U^>{HviC; zcot?f;g!x?Dm_FQv1yrmiK9f(B&mi*cA#})haG^1T%cUvd{$s!<&>g(`f0iWaCC|d zZ6oTjwii~o9E7~Sltsv{)HkXa9IhP2q6SO-EE82o7`$*_Rp7m*(^ri$n3TwJIUWrs zgu)j!lL``&zPl4O=w$XHdL&Y`L$isYS7WOR-K#?=MwtPEqV{~1Z0$8-WN>Iq;%W9P zC17+)rp|BA-QPx)cIWdwl#}s=zUFVVA9?s##O zo&E7P3!k5)e+pNhmie4j8kc{n1!D7Q@?a)f)rag99FiEVYy6}u@L2F2!qE@~11+C^ zIR!iSo{vB(JgmhIj0jD`ppXsrVZ=k+vHHVxd=wQX~|SO{ejvO5_)zmmm5f}q{4I~8~eiVs=$G1rc70W=9wz@J7+?6 zWv;cE0RLW6hCk3)ujyZ&)@-x#XOl-|OP~FeI07<-LF~~?mQY#hRf$?fhS8Yh z*@pQ!U9G~0uM%M&8Mt+89bIaTu&44ZFm3=fC&uM=r(j?z*UQt8>tMB}WwO^#;@VAxJaANhs;$kQ z4x^6nX~1~%2MdQ<1>H}#fNl*|(A7|#eB2MNuWvA;%;v57d3KgC>cBpK5%4e$Ln;C5 zd>*vm4T+tl`p^{nIK!S3N+zyO)~DM-$;O-+-|&og{?-}xw4g?DKm(QDT21=MnN=6! zb&onr2MlNYgmV-#%2i`%QX0#p>Mm?GU+zzJcTBdo_xAc-rxj;H=y8Bg#)VLMM<@ znEil-yANiihq(H7I*)M9F8p{&UlM$R1_~4}*t1rkw8tUNorNWG$#&N6SA!9cdCctR zf*GHvd~l7=&1)+r{N5w&`>h{~jJ!_-k<$WQunRWl6vE!l5Yi=^t&pIuylVYCB0jq! z?{#SDv?JmP9ee-1kk?` zb=!eeO^eD!`&WS*3d!v4o*|h9R)KdqRf&&oIK|PB0>XhWrMV^d0qTs%D>5{V-7`#w z5$jv<>*ocPi#_^$u)d*wzE2nq+a8zxB1bNkyW!nu0EamF^vXZ)B%X316WMRT-%EuI z_&u3tFFFwbWy6cnw~8Y%R=;zO(@TqIV8z0Q1rolGxFgzTT+u#UVGA3U6j5Nc4KNfm zr0ydi9m!B!TUVF`Njgvlv2Z)xaE)Szy2_`%3)K`tn#LIsP2$Z9_>Ft>Zc>wEWal6hdx_tL@8-8m`U z^+fn>ZHF6ZcxA%-nhNFKv%&yY57DBS%0ve%K(ZMQBhu6UO^g26;Mwc*Fo|$u64G)F zljIWslTwRnN2ltRai6Skdd%&qGY1@YlSg0oWAmNuNr*$T>^;;Q%lO)G%_L1Ga+3EV z9R>U{8CZFem=ZdkNl#sjpsWI*ocYRaLL@Aok4)y=v-oYAp9*>vM=FgZ2D zbyNP8kVtb-F(||0glyzJHNl*A<8TbDGx=uNoQu!WnfJhs0@+46mjO+!;n>Hj`y}>c z{*`O>UR2-i;4$reW@Sa5YGFsYip37o*L@32Fbh#l98ANGcI{d|n^d1ULbm#i_E9mZ z6YM>=6h{$H1yxhb3&P`){9kbUJScHwasFcTriPY|bXsU1FN=6)*$ZLY)bDs1%?r8Q zsz3q8+jxUZizpeLM$W^fSx8O+OD>F52~VPfQAcd^rGY2Ju$6=)G=p-1m1FiktQ!w8 za)YPoGF-oCEgRB~CD*1>(qoFLT%gIpTo?oG0RB2TS{|BCBX)bz23zYc8g$QJCIfelS|AtERs`h0n@{vb4IfPi&z zMX*O)yko*lyfZ{?pz`*L-ZO8TxjCYysZp@t4>r?4I{(nE+|I<|r)&{jmh4xhRC)`} zt}iA8K>RN8n0>$!c*>T}yc}@M;Z_RMJuh@G@urq3~+6~n1G zc7^(O@6>nUw-G9iRCa0!rI;pID{UTAk(^*bkl>LesI*j|UM{4g-Ch^=`SPQxw)a5F zVvF)}-bfZ<29;>^05*l$eC3l@kKiP{@#C!is=ZD#b@L6jm9F_>ePZaPlH`RKfZ(h{ zV(a$VW9d7ESJxXlxM_nW`e49K!G8R_Q?~+6Qjt?=Uy5KSD4!XHYkM>v&K^lXDYN z!e2<0yH-{@-@elpF7^xBNj?Ak+U58OU)9L@htATek$M;;H1ft(4kagRg8_3`S+9LP zgH*mH*;_7!?!-Oz%@H3RGJOPKm-i{fOP}eM`mLgN5PPIgnYrjA9V4InyPr}(kcV=W zzu*#|JT9pIP#b#;SC3>1e~YMu=xP3Zo7XpP=jg)NVd#P)EaJOFE;VQy^4YYk(BXwz zur13Ni*62MNi^q^rjd4>StvlLYdqE#RcIs$N@5+_e81}ai2IHjVRfEmWzKprT&nTy zB=42j5S(+bOPP83v_IG$RJ9z_FS_>7V`&>;ZvZ{<(@^3VTh)jS%BKg4})N#tpPRkY^26JlmxNgnYrX=%r!8m3UOY`os=WdZ8M zhVg!fa$#&eMINt9QDox+#ot-zgZhp|l@R_1TRK&#YyR|Iq6;9Kp3`95uVxg(S8HuU z)JZL+k%(b?7n5oY$TqFrQmPd>mwGsn`8k*dvBW932T_-+n@b7?nj0 zNSeSxGvn!(H${{CFBzPTa)l51WQT+=Ot+rbI7Y;QqLn{w%{V**;WSK4nQfDPPIYWI ze&HWbM3w8ORhY~@71^x#WdNA=Rx-W9#&=#&!w5?efEydpA%9ZzGP?E4mL(`;a)~3g z+Qj@l=cTQzEtq3cGA8+r%(Ju)Rdj{A14RdR${GST^k6`%%)SCdVeMi+{HDXs`O8;> zCl>x^8_q)>OY!K!JU^wbo)H4p`22PG#K#S4(Q)5A7T)I-XGdZHn3IH^g{iazLlY;{EdaXIWWJJtLvpz%vQWgqOs+JZzmW4^Bt zHHoy3P>rnfGVs$sbyRv@*5uZF83@elJRsIzGop6yUFY@EWko0H%w@6+ytl~6t1HX- zNsFs`Po1tVD;#U7%Evi^GNko#i`Bm4!KrqN9*lgJe0nYoPvF<3;V0Sg{%>`K#P+`4 zrmr;57NQ(D^!JZHO2iQc@GtY?Ybp}3EYi>qm%4z0$nNvk!a$?(G{3_YuinPNU@n89 zGajuf@O2dz^pE0?z!G9)=H$2jh*Ca}i3z7j?7hx$z6Yjyqp?P9(yx^pQUcmbEN!*z zPi)nwoD>l3AS<7I90NQJmYPr8-+6Y`X6uSnYIOa1pEsk4NvsB3A4=TUEV)v*eEGp? z3YnXUonq&aWxvg3_u&Mgw~@}3D`2^{T$)(pc=@A=fG0z=eWf!FMmxnO;N+flk!bQi z#y-YzVSN;rHNW%UqCr+?-ERR!GR9pZT_&u~<0_V=pDY@pjZ(M{E`90TngGbE<5!(? zyudT{$8)~Ql|G&EY2xw;vQ_%=YNZ2*dM|)o#0)#xFJAoF= zk8mN<+~wX7WcY~v&tbLKh>5^vi$Pw9)s^{7!ij(JX0P&B{3eMP3Kdq4oYkl!?4}Ck z;ErC#7#cORG*#5+tkb4?DM<=C*&LCqqSgo?nmLg_5yGPz@mqej*NwIF|2jMKXei(R z|Gy(qwl;eR*@+O!Rz{Rvl6{RdvTs8MshCodJ$oXu@5@+5*|O6}mS#*7gOFi_!QgvM z-tYJK_xpZ7fBeqxKF2xEF$XjEeP8!=y{^ae@q#f!@dvZfyXvY^r)Z&uyT?YFdKL!Di)ZOSpLU&fPzxFqvz^NtnhHQRwm&_w-YcmG+2Fd?`$MGMz0}>g{jrhS zK&ggZ&rNKLVANd}O2`Qr{7D(ecq|mbogr5+XrN=jV@W{8D^!-nMtyImBrH)>({ff2a2? zv*5z#GWD8wBN(JkUwyXeKaJ?92z!eAPIJfVgu6 zZ$P*K%=iRnzl2&bZe|=)YK&#CAg_VO2+2dXvbO4eQ~og5_o?M{yFVk=eLuB%@T-D5Mul3oRGJY3}z(Ii24Dk63P3 z{&h)e9tsa~Bp(UsYK`RYJwv*hrh1kOrG_90V-c%|7~8{W{Z4H&6XY)sMXl_{sB=;& zx%@*6?Z8Q<#5wxiAt6F2@%dbh;TgQ&dMAkfuF1dN`b#M)Vg`y*?f=BO7@;PV-eZ0} z^+LTPxn*mpi(^oye6s6u9N4c-=^HDvU0|QF-I_l#fgYd5ki{!xOPt9csA*h5jl2o@ zX3ec#2QeFUY(o6Apu@si_zt3!o)L_N1AfXG_jJmTi_D zJPsux@H}l~CdZ5qm?vTFD+!K|z$XjJndHH<{t3WqNoK2{MRcYn>rgjLalj#`KE5Sz zB)(vaB+IXn*pn4EFvGZYR$A4MhxA}An};9Lp-*?Ay#F_=b^2=-Cj*8iqu03`YyCO; z0&OcV_#3}*Y*Ax5)Iwq4AH&xYvus}fMm)%c)Ayb_rdZf7v~e2zBp=Wq)bO*zY`YLR z8Nwl{c;fL{`f=VoHvbUAC=Z5gW=F+I`8{wY&AtK*UYjx`uLtPa7^dZ)_|W`06M9ic zr3RU_w;6Q+4IQJ?8mH1rq$xlmlHT%F~&UVuw~R*|VyX&<^8 zxqPT~1e2a#vl8*St%5pERJ#U6l6KYn!fx4hB;;=o%yFd&^cd|Jq^-}2{^a|e!XL$& z`N)I;*H)>*fQ`rtH-5Tfd}O(0i++oIgIda-zNG&ch2`)^fAJ`uspim6fQXLXeZSjY zh=X@$T6FOF{8+xdRaF3oOt-(ZJWsDo79E z;IDVocu~me5VDe9wQRM3^DY5hb)FgNLmCTr_|Sw%ur>&dqTA}>k5a6O z?W(^|j@vUzTZ>dFOo!C(@Z$uI)Y6Ri#>&=sB9^$DG;+TYeWb9 zj)M2#s2W~~b?%Kd*-F9}<2s_8DoPPK(k35F7PR;psz}i!4Y$oL6K0FAWO@DkWM|v9 z?(6IDa>!IqhGk;h3>7`&76q)Ab4pc^HC4>3yIrD8=r(f4$EKyQusR#=Y#2=!>quhc zUBFEEc6SKK<&@2dd(+--fV;njlvrYCJLxcSU16tA!#VN<|Bl@{%pzI`Y`t2q#&==S z9YIj&k$wY|0(1MZYzRPsj|bl5d*$!dicE(KXzp)hFy+de!%lh~k791C_~`I`Gg&l{ zsKyEQ{Jz3G7le1p`F!$Wl3OqXiXc!)}a7K&7w(DupBs&=M6osEFuL6&!LZ& z5dXDP6|o$kfjrcAI_S(EfONzW+F_9ia73tYSXMq*)1PYlJtRQGEz{(stY@8 zjV^#$e;^-ACr|D^PdqwIQ#+>skkbDLe3Xii{?D%mxsm@Tq52ODO66Bk_s-4;L(k4| zm3kjQ(vAgZf1$9!UoGBrBirT_z`opMEx;Hj_Xdrc{s4XeHT@f>Ht{=ysSlB|p}A4K zp}-df{F>T~mDJaUs~q?-z;r-~stzHSw|joZfRnMSb-){+ks`8uC59s!Ir7YQjE@$G z&%kvb01&L^V~^{Aq$x`&ZzdW&B@AZ}s%H6${T2KMzZpa2Ua3pIgES^t2IEhpxb>8^ z(`Y_UXJ<{P30Xd{Jj4;9^Cg32f@W^mwz0?t@*^X2SX%f!s#roJo1A+0eX&G}kO*rM z*e()2wOEvw*D(J1+hsEPc-3^H2A(=xZtDEItl!%KXLG!GzTZN;X{fFCA;TCV)2!`7 z)&Zj)J_AD5-K`0ZXsL zxjtljUQ3>w{?zwrC`*Excao@slBhLmQ1UYaW`NVFDs^3!ajEJiG`lxO_Ewt|+PKZ~ zywqIY0)n*%=)acY1McEj1DwL3n8_Lu$0PVr@^!aUt7Xe(=@*LLv zs1{%eRksW?)b!OUk9y?%{NMR2Gs?Y4nA04o*{75(pM<@lqOhVv8vK?rpntb*Sui}e zWNNbL*lp(!(*l*Res@BftbZ;$;v;JCCezU9fSuU#ok6X6psdBE{LcV^()#kQR$$N`I%kvaOojv@izQd#oReid*qdKLqi6<;> zN{ydxY-03h;@uR|_mFzaFdbLKi$ZC?)-mEev(0O6KiOT>-&uk1jh5ZoNCBqSJ2c@Q zPJs6CDg>?m(i0Z&Q=W8^pGf4e4(O{WI=Km21?c$hF{`(zzCg*4a=6s~0Nn?7S!Kv3 z{!vZTqa)bk>OAOs0vpomjM-`5np`Hk-H>GRDyh`GKX5IpOT|+=Q=i+eu(!?(Sa*;$ z#fsb}rc$+T6D+2EzDvVE=+QGkT5Xk1y0*yuu15J=;@c103MJ_HlT^T1=)Uq7loq#j zLh#f0(bj7vS2m-oY^Ocl7JYs6OHBJL1KdMImzyaKpSWGSgBqe3=j9WNt4eQ`>fSg+ z;k}U8A@0KRMQQ)9EsM`KrY0f@I=6aX=MW}SCF7#2oRprtlroH1B*tc{jlLVgREF8T z#;-{QdS(6Y@cYOLr3JV4f6l!nySv39l8LWOXPL&LP^yq${2)hq+2hr7EG(d!`I=V@ z{gA>$%PR8@U$y|6cYs$8xT%_#fxRF)_Y=4mqZ)F?B>A!Pvk(()DNRk}6v{gtv%aJ# zE+dYv>60)^JlEwc?!P<0c{n`%TVrN?X#3G=Kwq(@09YrH3b^JLjP^bHV0zSni6?|3H4G4bLjPLN#d_ zOSVn1T(WX!2szK{QYPI^GZ)f$?-6G6nPQn#fi)2pYL{b|5YzO08uG?bJlY(c}zOxR{E|C%)#h%V$1m zL#uK;j=`BmKrpxW(-!vHZ8sPrFHe5&V@H!cO#t5(D%&5wp+G-8`*o@B1z` z>*(`JfcSV+M)0urC9NdhuM5Vtw}Zp5NAD1XWL^u7dXCCERwC;3K)UZsv94j3nP`fw zg7u)X!xPi!X@r?_nR>3(l2SL6aa6r*m839#ky8{Z=r)YNfWwJ>}e}#6nH!KvOPU zvm=rMnmNAHR-qA_^FqP%ty)awcsZi-s&~RdoW2LouG;*euKo_4zHDISV0uC{=a!$j z+?;Qt9=hyLWiD^``91k&xT8Dn8P|uQ0|5#a; z{TFCy2~x0pQJoC{Hnq5NbSXtTN`2zEpzBkchysFHiiQ9%L%`?u4%f1qyyvy;vP(5ckjU(|iq24oY7%4Wl@qHL!q_h_T`b>bKKw;W%T^cHXbz~I#)A4i zl00YB(-;2x31z8lbWm5(g<~Ej8t=hO5$lxj_(;t{<(ZuJB;i^n?elb%+EdIz^q_D~n)pjwgEFF=tH>27*| z#agM%d)Z#uNP5w&#IS7u)&7>*0Oy$ zCE+>S2{np!LrYbWjh~qv_m@C=)t6s1cb)f{(AXq)H@MN243^*9;)(Xkf81xr zuWufr3cMAAt~ME+dUkCSj4{_utqb7z-gl%V0E>Z#s(*1{>SO&trxjCEJX;y!VofOR zwSg6x2H2`%ZIFS1{26R%Z&|na7j3hwTsN*N7Xeex@y+vvu=X0Mr!@XFbycMWIRm@r z%@^xrp;cwFSuJ#>jte_he_K(G7)O-`Wl76$r{XNz4;a|Q&R`BRVFW2n`N&cd=Yd4N|40zZYp17c& zJsfO!$jieGHe`XYNNreSNbg&j$kq-Z&j>7Yy?YjaG4eX&G-E;4a;fQ+2asF! zsew(6G#a4!v$Nivri5>;2$&K5L&l1jXQQ7(g;Itj7H%dnO00ba6O{qW!gAFIH8y+O zw1iz({WuNOv;$CcT^{3Vpln>6>{;oZLUg{BZH-|_&42kmQKt1Cm?)Lf_Y?xMwc4#V zd?Q+zG@@euocsGiEUXqjo_hQk)kMSo?~L;xdbdGQ$JA)6<`Jd~@W{E`W{EznWOsL< z*trvD^I%Ok_$HeS!V*4b<~M^aF!Hx{7=Qa%PP4};xNK^2R_gYwQf!*l;_R@2fNMl; zp?KkBTC?M6C!|#@(*#SQ^VLMf~4?v<>*l;a0U2yt1%2wjPx=u9<*{(An6 zb#_mCVwO+FAsNd33$iG^hy{dMcN%T^5r>T9vWzU zAdE>+mkDwbeiTc63Ji26RauU6 z9H)Z#XOzR9R-fB%2|}#-?d1qz`6i`f0Bst-J!?2I`9+vY!hdR=eKt^)i!9X%tGiIw zV#+MkYVMrx{8O2HD)%Ix->W`9#&)@h($4E(zBu!6^&;t`d_hAyH%qEDdEY&Xj^|L;(9rRyf1 z=Khfq{9#AXi-j7_dz>^>?cs;-cMNwLY45A=OAkk0LA__6s^&?<_PU^>q%SZRg`&a+ zeCr=Z2V-!cS2}V#6wxg#lP--5A2@>~0joClLTYKPMS{!19k`c0`R5ttNa;dBnOc)DiE)xTV|{en}sZn#P^2C476N0V+sP`7%@%au zFykWNDvWGiAc+#<*i>u~k&p{PUi==M_FjZzoYIK_75{sP!Xg+;a%N!hN2p6Ao>1KP zTrp#jGXXu~`fFo~-8%bK!T$OW;5jp`NBv%d0_dVBAZ{tVf+18Ie4T5D%1%`UM15MJGI zSNo|k*tBG#6#J7$&nkrbc?BVli-D)#xi}3}49Zu7S-|&cL5uNhKY|E%=-R)aUGOJ` zm`lX$3UxXAE)+kZh#mH8GL=Kvz4>x!Dvnkm+0!lXYpuBTk2|gB5f1u1W{+(YY_>D87|y=JuQs!EN}*%+v%yaAd@W7 z!6HBQC0adLH-NeQLlO>oK27N~-e3EXTBVN-pKfHUDn(*jtcf37yElo6dW>=Y*$3;E zX?dpoe=0ULQiGJ0Awn{-S$M54r3%yxuD(!fWgSa9MBT;$EkQt0fezK85`9Q%xB;T1 zF{P#>AP0}GtJ%Vb&*}XYkpN&g50GoYDokT!;(wmdiJMm}~U2 zx8pq zO=~V}+KlbIQvYH4w`>?T9>mRCpZ9F*=+6bKBul7IVR}KQri)9}j_xZ7EiV&amtD|qb5aa9iK?oc=8nMxHR=N=33O}#JOi@Pvc zi+|^6f!1tPb(#Fr9q*9}Ns6=Pk7R`#+m*O3`j(3*P~fi7+(lGH?v0Q|t>Vo%=)QnN#pU-SnN=%lw_~*NOx~FJhTkWX4ZeroPWj44MiBnBY zJ$5*h`ycl4&%E&IxEDT&<{RvF!rlPbJQ5z0PT6A2ldgc_=Z{5)z*FJn4{z#{a(48pEo&?|3=ClLLKhoxhiT+h{ty z-v;a%P1B-si%&~yt&J)40@dw%U)zFXL76t|<043(y+9C>vy{M2f%aS;kSTTj=bs!_ z&rLI)Xau_-2RTJ;xk#!>hAVJL9a9nE9N=aJIXW=^&$zuqldX;B?tSIiUj1R2Jqk3K z(#VVSgzQ5-cSu8ia$z8=l!|Pth=+gQ9f96qX)Ma1vw^b}>XF~to2BvxYJa|4`b}2< zILe5`(jV%X!KeL=tHJ4i4U&<++Of6QOdZ=9+M-0=Ee0|_U#Y^=Q8V2q`Jc45|CW8g zsokx_8PkO9^qSZ3PtZyWe|6B232r#O`Fn`|n8oiTTXK?CJUhyW`$dXKD^+O5_;((B z$1v&mL1D0>^zpHQj~*ZgUjg!kiatzUs~ z#a~B*ZcwszX%yg5<^1Pf*&I=iJe#G!2EzN__dTr%h73Pe;D(pdjLik)Ki%pB?o+w@ z{z)rHG;+EK^GqxC#65cTkD%*Hr0V{+*oHey6XiYT4$)dz7u2WTM^g22X4%yS`2~?f zEo*AvnX;DRI?Zi6qCFy%!oGJgY@R=jNFjp_H^E4HelMARjTq&vJA0u|H!}J*<$_T? zV>}uIttmsGdzs8{+NBi4oG3I=TGI5!zV;etGX>KMh2Q&-g}q@aGjm^8Ex?tOSNNw) zeZshMs{}K$$m47piuk7VjD*ecFS_8mAfkb<%Y6q4+szO59eZ0^7QFJ@sV0^9gW)O; z;uRGX0aMa3Sv;yseyzqN(BunzY)4mHltsE*UNeH|b zM0VHEwkVylVwKX?%A;1BEr#qQlHH+qYpY)Pg4NJe`TaBGtBB)Sdqd6DIMfp!LyN^2 zR{dGq=`~xY%RF61dTX*qAtWyE%OO(?zgD&rnl-64wo3koRv=zbr&O<(D`6StXXmAd zP&~U`Zd-ebncE(A$w{~LMVa&v`2`qZPQ77yi-8 Date: Mon, 7 Aug 2017 12:53:59 -0700 Subject: [PATCH 03/76] sync --- windows/configuration/images/sample-start.png | Bin 0 -> 94324 bytes .../lock-down-windows-10-to-specific-apps.md | 154 ++++++++++++++++++ 2 files changed, 154 insertions(+) create mode 100644 windows/configuration/images/sample-start.png diff --git a/windows/configuration/images/sample-start.png b/windows/configuration/images/sample-start.png new file mode 100644 index 0000000000000000000000000000000000000000..8ef9cc928c9559ee98d7e7801bdda01bcdf68049 GIT binary patch literal 94324 zcmXtfV~{9K&-U83ZQHhOn`dp?-m|uC+h=XtwvBJ^=dJI@)YNoWPfd4{E4h+Pgo2zn zEEE<{$^uG&Gw*WZ+0N|%sQbbV2UGLHd)Zf(Hfeu0zJ&Jcggi8A5p9xC6l&@|NUDI4zW_u40wGLa|IK^)W78p_B}+Ofr0WWh_o43Ti-5 zptEnXe8>`nqdI+!nD2RUIU6rvEPj~}hm3Zdb9`wHv?8a3{5e)}&SR$b;9PUa0G}mn zqaLvKfP&*vsny=NxNGxQAzRe-+QoMBIg5b*nqZ8TSWv1~ftI076zO6FDc~`>shZjv zot3Ind(yyerR z3;v79OS5kZ!=nD@(f&}fybZtoFdQiF_clgtw#f< zVxbZ8A`Rb=8m4unL=rAD(t(fHkzUNLNak55-!a#bj>%N-*6N&6{(qsYpsc2q5RrK4B^eA|zl+dv z+B54gk|Ibm6F>zacrz!K294zO%Vks~JY7u>;d;a8vv!B*`h@&rDmFcvV&2dtvI_1B z*WuO_bh)dA&|JVs(e-GZDP)!IvkkIQj!A;b^V`lnEG^`s;%L`h|Fj5i6uq;puIWiwV_U`vHQO8D`flVd* zwYgk`5!;b9%fY$bHGq4S{gg~=mdHyVKu(r#rt=j!0MXzpke5O#;eXs+d4$edZE1W; zCpo{4XOeme*#M~v4=NR`AR=ukOldjC)`j^*J6j54@)D+hwMWy!KUVP`OM~*e$IPax zA3*tqpa!d!t8QkXdC60OJjT5d1H0($a-W?aO5OrR0QmJ`ca{Nyi>~sorH7NLGPskFLX%cW!=C7&h*(E$t55Oi zu@HLuE$VW;31Q#9(9@|s(PCjo#?bVUB~vksR1&9~4N+l@&Sd5QmoF4~upAN!YGCo2 zF_n_*d?uXIKI63O*7lVSMaZw}E?TmDRJZWLFW*=&SQ-?E;GP$G*!(!+)}cAB$Y>|~ z6$?|0{l)5l;bCK;$JI)x_)8fOd7%Lji5{ChLU1>G9#B1dTk&-zd3Mr>h_dAwY@jt8 z2i=Qzo}7S~m+o&!!8@H9Db|0!wiJio@bJ3CC}>Cx*Q$j~(5Dm#J7INs?)4qJOZ=!T zsHdw>DKWzkeGps}JS!KdBwNW;!K<5?kVX$oM4_0`t|`MT#V_E0mUpaHo6CZ;x;iMt z`q4@kEfzE(^RX9PwwBQB!nh>BeGyy3aFUj{7)mUZ@2j0DR$WJ-|1|DIg(0Z;I^}=n z2vV*|K`m;jIFRr+#J_SoB=ROWfV!={4+hFl?|dQ^-LHjgs6HHaXujxM9lEwx2Aova zFo`2Pj1zF7H4crDdul*j;nBRykyhCfQ}B-I1|qW6Q3n@h-o%-+m0hf9R^JE=>PADs z$h0`ECYGzT065EE;YP`;DxL9EP1dCbLW(y$4+R?`T$4VXYVSc-!9+a5LN!o|^72VG zyE~zv!3j(DSsfHr>6KO6GVtC`+sx4!<~DJoYP!0kR{alCrK}vUn>22Tad)wGvHm+N zBk(-CcC-Txg$L;B@H4V9_QN3Rrw(exx*D?K+eN41)(l2ZSDUsAx$G$U(3}ZYDpivA zSpWoci8rO6v^Obf@HDMyreb=-ea|K3KQj>>Au%J2bMgbSz94N3+v# zJ}R#)E3+~*h+LPU?6$|9&=fjUoRLgL)dkN~5-6hRuB2M28xBB$7wczwP-Z%lxR!}2 z^}mI=|7d)o5FZKEnJyK)_sgX3UCQ55@mpnFC=M+3;eF z+0DjT<(HvUXE@LX*pFEdrA62WQ2BMa?LjQnIS<~=>HSm(VUDyzDD=pvS9GQC2D;sh zAQ96LI#*HRXM?hDqgnF}1j|=qILk2T*Gi z?7e37n_|0Q)e1q*@1R1uGJ-9kMs6`*{hjl*6@B_-A7Ef(!LVOEV#aKstiv z({LpqtGzYAnLaJu&4md!>)qa0cm4BtD)=C*Qu*xxJ*1|F!=?5WW#%q80N8y7yv$ht z9Y*JUpjUv}<(wE_2)EM_RPSZI_wGzXk7#nY{#2tI$8c{{7RH*rY7oBXb;tc*=5_!& z|Bt2nxoBKpVeYr%Wv?H8X8H;oN#MRMmP}an_T4focT}p8-N{muD7rW=g;pw@`b&q@ z=N>y~t~t6n?+?`m1T9KWFYj2~`a|@7mU!FaqR^Ss*Hm8SIj|u3b#VZxkcyCn{uy`B zzVu@7S`PdeW7m1JUx57QOD{9LGrnFmo9-Eer`gD==eSyuMmlv0?cg_XSlz|4cKy@m zL!IM4rez1n6}<^efWaI6dYp-OPluB$xAYws>=jKEuj{n{H+2sY`tu5{k-6egD6pu*+I+@z++2#6^BSv!^l zQ`C zgPG-a{_q?uLt-2=`g*wDt8Z!*KpJ8uD%=mp%3uLxd@KM*{qOIAw>@F;I zo=ZJxc##Pmd)BCre7`@16>=>YiTRjJWy9;C>w0?Gi)`yY<}eEY|ZE#QK1^ zTWzc6qXx_?4{Bk`N+SUjztRpoWn<3@IMwiI+Ew7uUK>Up8*e7$EjPCn8o zW>z*^gPcsise3;SxY--NZB!FeEKi^I&G+$7S2L%kE6{HigPcKgKlcY`#O^;3B_yT0 z=(^^}C5Aj*ubY6F3g2P?)`T5=VVid5UPs+7O6P>L zQm5`UobWU|eit>P+l(wK0)c1{SoklZ%Qr*i2W&@xeNuqq5t9);<3-*RFekuesH+=5 zY*`l%)ySPLt3^V1=+aO?rl{vm%5+ZBs{Dz{4qX%AYUvE)a>aG|V_N)%80SlI-Erf# zSl@ck%YWy~mg-tGPkFvde~>Qk3+Qqg)Al*BSa0Xfy?tA;V)(&{zMnY4gM!X`A$o%rJ89mlDt3{)ooWAr$AP=gHQw;o$lb20rFUZEY{0g+Ab+((80w?a%_=kH+DB zQI47USHKplwrC z^@`P1RWvwl?M5ScMmvXT$&v4x<+It#`xo50H31v56s-xFC7JAkP(a!2XTVvzq9E5x z^K;DP3B-8qu#$c~9=m}LngpCs)k#Hc_c2#i!%@Hc{)1i!xz3}+vRfKgiwJJ#MAsjU zMzDjRK~&rgS=`K`*snFaa$|f|P91B{=J}l1^HqD%k?%C*DY+KnP>(^{`T8#bvZ$76 zxzC%U+>wwt9|k=8V^Eneu&Q<+1Y$7)%r#o5F z>8YeWuk5jQrvmeA+4^dAUCz7>yQp${>(9hfy&&Ez)mSKb^;ETpC#P*XQi)!THw&Vs z+X&?`7Wl-t$6JD$&!d^U+?y{i0>5}r*_7l{0cq(dxA`u|BGL*>;vjl7X^R^R@l}*+ zpfN*HKm6fD%fxJ=fqT0POU|J+OkHrQyY-zd-KT}#DrjP(ZzysB|B}4n1K7YU1UdhV zgvn#aXccF<9hD3RV-4~<5s<-lw_~Qi^9wY?G?W>|XNriY3Pn>O)N!zed#A(DgY?X5 z9QTF7&eOR_)FtHQ;O&3CZgzE1VHqN z#F#D$yY3h3rsE1+mg8_p-~H1cVP)0^vwViGCBdojtL7IEr0(Y$j!SNSSP|Ff4|cxB z&;q~=5aCMVmh-bl<{u^}8%GfW!b)~c`>rLhq+j(Hq3T0+`>FLz?Am^;?_1Dk|WY8&_NRNK+5osg#!^I6(X; z7W(#*LoRsDS-IHo5QZwxJbI=<=%$>(h z-psnNv^MA%<-wI=6Xf{f(^>!0XXt&pEt_K#q6?PTp$uZ4iire#gg}?vP^EI{V@Wa=2Qtc=Fm1FW5 z)I#N?BcL1nk7+QW8nW(6bBp3uvuRLF!9K+-wEQ9K99hfs&W@jwi#!VSXv^k>g_!ON z8A+dd!T5NoY-Q!1G_f3kuKiHxf@P3c-2UHD?qJlOm)pE`q163AJ&(Bir?#<2@zH?*d%TJJ>J?ahnj9hD$L#r695 zdSnjXsClQF_S=tgI851?UD}Fxm|l$}7XDyhapayK^SV>_dpa+cSJF{ddB}lpbLCD| zu>WS!<|p@9u~uyXB@<>d>Qu8uua@onl&8*#o$YR^!y13YOkdOHQDchMXr!m*k4p?z zDW&j^bq2s~T42h5-ndL=d7tCH#>5SM+H7%YH1=p@x7kQ4a!)geNNIZOGT-5KAG6*G zt?c>o$Y>lu(#-;4`eUjy>#Agha(Y(F^P6I#QP5TiL;BE{aMvAocQp-by1&dj(R#hQ z=ui0TnTEjjapY|GQl_&R(5^Mx>0;?oYs_n|ptpHGD|148&z@_UDgAmOV_MO`zrRxd zC->?Km6t=x2dfay#)T`zR&3b45@x{({i(RcbumZWGRKhD8d?H4wvjNq|3C#%ruX@Q@ZNb**d{(ImAmo;9(>8-9WD=c+dAgJH?T6e{=t0 z=#{zEv+?!F=W`vO*#v+Um_<6APuam8xzFP$P}%sVW5M3)3*_JTwq%viQVK~5q~p?Qc)FXu zyp(CmUkRr1Ob@d&^!d7wo?_Q6WQLIH9vwpNkPRV~HINMAG&JxtiAs|WBE z!Yg>r7w_Q}N>id!!pEL1l^0dP%=$8uxPlIH&MqLuMoOwFa7?*T(b{{+f+LW11h?xg zxMVgB(q)z%z6|sRB&M;So*VtXyV5>!38Cc?o2kaI-gL9NoGwkhi)Q(H>`M551M9rK z#wR|xMaAaA4rzSb2~ld^yB_ulP8$BU*EHYFu%h$~U!CRIG^W>dOkznT5o5A~=H1^3 zFF*Uhl?s>=ATB8Pb2%ZxjC`Bau;+@%b-mXqN|K1)Ee}~H$ju1=<9eYyMcS4NTh?3! zd8V{qgiXt^YthEkb(f8;wzH&r*}uJHPO(Slow|!3NMsUF(6!Ek>BSaPpq8xnFx?Ee zfzEUE005>?=p4B4dSRtGb+~9}KY)pud`(?glxVou0+(PJ(6l=WJ6)+-*D0>+>@0Q< zx2{J7H&AiExfF?bZ6;ckmQc{SX~CWrDG98}EUwN^F1^~Y{!dBO#l4OjEQh6eeH1A#W+@CM z{(+8X_Uh~g+B(S_kjK(!Qgx3c8^Shva%2=YzLQNcQz&$N=yB8^X9^e7u!n(-m9QTo zfujLFw*8$i=8lXH)|P}k^9AzI>$0F7FZ|prOz;T1B7t0@jScYz-sg3`=}CBzbb*~v zScgwl^~zEjK_xYwEtt{BydOn~&KhcV-lw#@Q*A)63d;7%$p;Y-N9tGO5$oB#FwQqa z{dR2F4mKOj*7-S|S`P925d(9o_Ag7m`(rA%VO!CYps}PfX9ynwN~X(U86%)!5`T&1 zL?Co8Cd>?^)V6mQ3$8{if#^>pB(-BgzOP; zxj=cBA@D;h;ZAn7p=jWeu zzLGyMB<6>^KiQmt{!CZmpT#IMPhT<7h+D{S@x~G~WF?}A*)NCPAf3_Yo9DJ&b$xE$ zTaqp0IZ7kblB(sLnYPpAhX#(zt1AxPR0q01L}@O{$U0{vpdbh9dd4sSD?>`+vimw! z9CzUYy<|`pV#Z!1nS&9bdVH_jMp62r?p79xO=2WnWIsT%q#WxiL6jBODk{?L(D^Qv z9aQqKWw2QqvIZW%?t&|ef-u$ecu+5&#Cfy7QCJLGZ#`d6j{D?jZ8qd;v(KcO5kq7L zMnq=iK@UYL9D3iO+iOP5zZI6v*VD@gN!$(H(pqFz*LfNj-)p=7i@j2+^9s8_0Zo6i zR4em9Ef<{c|M1ErfIji_%WLvv~wlYk4W?N9JaM^sj*-CMO5^d)pNv1sBp7wcX&^C>N{46 zk}847os7*~*qUWh<^A^1qH&vgrc*p}REtJOhZ@1Zt(E5Yt;jyx?X*!g`T4vc1X4&z zb`V4wu2kDUHXU==@!rah2H89`K-#-aBH-#9xSutuv#&5>&3faBJeBK)o)h5e@-@x- zyNkrUA`f-!La*nO(Ezh|G${dvSU;H!17Mcm+_c4k9iK~s^485ZmGM=1h4W{J{j>!t zQ1wP<9c)$B*kUCHWx)t_Jq=qfk}C0Xfta``Siko7sCnso#=#JJJccc+z;WY5Y%l{8 zTe^!iRsR&bV`x2Wy~Hc!w_4?XCdZ>%FaA%tZ1oc}B{Uz8+R$=rsVg^?V@N!~J(*HG zWNQf0_(Nv+OsCw2B zi!9sxxWka=`Qk__tS0a}PA>&b#ca{*y`wgP|psR?`h+@R4ecC*>LFlb|N$;k)@|f&$W?+hPgt#X< zT+ICj#I#Sfc4`DEkYB0uS7}RO24i!VngUK2pRbO<8spJ0cJ-fAH;;@Z)S8Y%{rwzk zLZ@cQ{xxo*6Svx#+YRw79$_0n)g8Qo*R5&DB!$8dzzJr2KpY=NUf^*UTbC)MK`xCS+QTOH-(j}Z=aJSz55 zWtAem`t>->b=go`tKX#J!k9Yhed%DGOrCABTtt>c21Tex*nEBys}(g}b>QY3WYoB_ z*|jFSn24xQv3inSOm;!@Q4d_Y1{*L$;#jw=VJ(_Oh=r-4byBcxO& zwKjUy+nwzn?G`fMwM;}iA}QblYUUmyU{>6H=k_8#A&VWIoB>~}SLj9fkXDtX3#B0J z)h_xY!W-WJwUBbD%rQbH*4Q&JZ+xA)#_F53zN3}*Ww?a2GsQs}r?jtV8qo zowwj#yymAph)6zfvo}*L>#1b=k#-$jj@PNp?vb;Mz=7-=KJ&9m*;kahd&QmzO!vkL zb;RWmdV;NYmx2WH}ZoJ%aV$>`YaPy&lzix& zT(%Q4GRtJ`2W#)%=2XyiS(F=Qm-@2Mw z-nJWUzW#*H@p&At&;^K1MH#p+cvu1sLqybBgUNwQn8Ic5emq)7(S@j}dhkf`pGgguU(O zE0j|FNu&vgcZ{YE^Scf_ftZS%GEZ1e#G~zxVdDZXp0eC?*SuwQ=M?C?>jB!4C{@;E zMC2{7hXm{mhs|6U$|6jEPkkd*Wz^}R#K!FJCP^2Et8!%kQ{nnaI|UQT1#FW|o9iX7 zQ6;+H=NpIc&xj0KzJw&zeIUO9SKxgrDQein%DN9X!=!oJ$cnhoQF5fCsB6|+cHNkf zM{|iO1NoM*HEg!tuUJwT?meeXOPt>(9N84!D<$m%l;kTutK&Y1SN{GYi^)nE z5U5Mm_EX=%&N7Z93L|G`L+eyO@;Dp7yi%fxOs~Lr-VbyC8+O{AsoT`cr&Jw2$2=^_yv58 z^r}^)`0kNP@DR;azGE}jJoCS3(_>BO`LJ)#J8F#wu^+@Kp{?f;Mj@^ib6Weoi?v}Z zFiC!^LPtw0u#}ncE0akt;dgOml*7hR=7@`~rzYf!-*DkFOAs45|TEwLVK{ zebhZrMWH-{0F8mv<}17M&N#JiOPGIwTY+;&n`9Vy?c) ztn!+h=S!=C&K@Ij^G<)u+e<-QGvmqu>b{i!g|%>H4>( zN9Sz!Q5~2Gbd?lJKPDzIUYQos8mih ziVA|5V%x8Y0|hoH%u<~tWcMA}nd6@Tto1^=ANR)RMSH*jO;UgQ@RUe~=fS1a2)})i zIUb<*>jHytoaHG>Grycmpc@bp8s(|RQ6=0`mssw;Mo%M%yyhh{etr5U73yWHb)Q$* zWs8jRnBWiAaek*WnUJ zW2u^5y(|W(qR4+=l7vJRgc-_cILoA(6o>})(4?y}N)%P5wQP@8 z5K|ykFVzg2s`fIo*Q^(=x?E=?Uk-`L8d_`!ZQ$?vZQ$3I<6C))9%ya7%B0i|XZ`|2 zMg2+_r-Yp1_lzEA{R?Ue6fFiQ&=+Q|?4ik22lDwF%7FP9?R{Nb>>f|qrK8^# zgD#O!65%C-gGHz**01N5<&yy0f_`1P)7*1>PqA?&9T6jnmu&iTVxA2x-Xh$PC@wy1 zUE6Jkuzq_T)ZSTBGZab()<-^ z36NJb7>x@~j5J^hTUH>leqAwwx@CvkZ=~Y?$w68UUR{E6s&Aw(m=c~BUPe(>VT}JM zLsp4z>_koK*;0)!-=vCSRmwOfl{CX>W$eR1lQsa(v9{Y0_nw1X8wCbJ`l~nO6h&vj zT0o4jpON!{yZFRZD7d55_t=_|MWNKRdO*YW?iy0MJ;8AL#=>eR{}@m#CX=djA; z@-w0;P5*1o1NjTWs8YV^zo2~#Ok2q$*RXUB+b+pJ?^iu>Sw>$|kAP`lExcc%^4`-` z#HStMb|J#{?O(un!$T}4M(Pn}0_fyGI2WuUNhf$YUZxfOL&ACqK{edVE?p#as40og zlb^-_0D)M71l(wG%jj5AxaTR-i>5wfk1=dThv2zO2Sk##2(?~RwaFiMPYAdc3W8eS z5!E(`9Ip@g`v!!P3zDfL)S7{4=oZ_p{Gxs8iP=H^HYS$Ats!;XQL3WoKCCjYw{2*<8W9OD?82qV^O zF$CvTv_h?tSW9*8VJ@m4G1-%v84wLZu%DjwH_Z4?m|(G)A>cdkSRMMJu1GX_AROs? zWSBYsf07JWN7qVWzsTcjgHQ5??{~pcDxxz?_!j9eCIiWU$53KPZ!!h~L;>$iTDc+! z#y@LYpfT$XEF}3C(QxUYTB`g}Q3X5(KTl*t>*xVIbf)RF`aeS`xJQYx5scH+XbTwV zE?1^z4s6QPGtM#(WD2mR0FIpLCRCEAs#O8gFe$SG_wi2X<5OC``1fAWuyF#zw}?g{ zfIJ)i*Bn3NB!E`HSVDPeT&X%%veAxIg;<|A^e7b|3QF~_iP9HnnqS%O68K{M)82q< z=Zf-wHX@qWoWi3bD&3M1_}o~Of5(Uci;lk>riv*ftw8#VIUIrrS@2K@yRX680uKAK zZ2zNtO$s*-ReXJkAt>4kvcHF%i+~O3RYl_dpUBMmZI#sGAXCnOK_Czet_i7-N+V;G zsK8ASVd2KWAQ*Tb&ok3}`s9BPtW^Z}SM4zc-ji|32O@ z8-tF^J=WPx3wI1_Oox|IKE#V?@Nh1(zM&33ykzTqGw{cnW9DXE#}#>VHJ zv~NCGZ--Wl66edMq^1ic%ugRU^8cg=m;#n%%ZE2z7oKKckr^I}2p5JBX+g0EP^NFP z>;_A^tvTY~L<1O~^(fxp{(YZ$mvxPOJ9{dtp@wC|Ti@gSY%D2YIrn5y2niwO4={qw z!hur$1r1HWhJXv67C%`CWox*%U!6<_2Ed6N3+_l{Z{T(6xvP(_J)m#16SwjQyAOFK zb}x|CBdfU~dO#*Gb@GjUFUp!fZslJO*dcS1{$=RMGor02tA%Np<=i=(i#!Nz_sye@OdOK7 z`Uul*mw99T8TsI^x9&$YGnd2zwEd=gQpd5l0iX7G-*5J_JMO5j1-x_j8!@>iB$3k}F8k=ts4ec9~A z#@)Jl{mkyWX)tHtShkapriuz@pmwxixBurw4Qz7axjSYD+HjB)L<+Ssc{$F1ZDl`H zbWegbi!8Z60sl!#w~8^)m&1#Jk0)g14paWsc{ldBaNGPFe9P&+PVmq5v#4;Z{tuLp zq~r5Qj10X$NH6Y0kdkJ$86uaiM|q^vcmr=O%1J`OmXi)5QrXzqPQ);0q4G2~ByY6+ zb3CesE~{8ZA?er%@}w$mkK3;Waza~Zbe>{JrfHaX)JbO|ITB+6oiT^fh$DMgf-1-) z!-P~_#PyK@4xU_52F`FP)T!=={3pV0b0^5Fwa!+WGRjDiAdsm8|Mf^b4YMWpnzhgP zCox^q3M2&8z;3^cXneJ&AR3yjW!E8-+u{0LZRh~9DG3b0Mmvh-qCi8!*nlOfTNqTw zVTYl|%NmXTtR1gb$Cox#Y#5PLlZOLq*pDTE-FNq*I_gG0&Qt z>0|<90xgo@5#yM>;$eyA1s>$!;Rx-oCvkkE+0TcNx?>Qssg`JJBIx>q%f*%xIn)k6 z*rI{8=8U)J7$8U&0%U+SV3QSW?;m}B@}0aw3L=YhS?7Q`;W_SpHHh@uFU@vvAioh> zn%#_K?bTV=^9ue4^PQpN#v5Dh@(Y72@?dp!ApqR&d}v3%0TACyik!~pFeqNXVrC20cvc;q0(2 zu$M2%6_&=SYF-DWSqUAMRt_d!I;)#6TAim3SvZ|$OcJbcjYw*bLQ8x9c~~w~G=BPo zF>QMH)*UNd1*}{J?Ux6nPjbwUA^w3zt?wuVe*45AnjIfQvUHPf{_>il8V3B>zcTdR zTeH6XmTooFmFI4#`YRK0@OFDMtNDpcjxjNZiz{}6TRV8o?H8lM87b2eo!|^<{wzM5 zjyHV$0l(X;6gT*xR6A@?mi@MDXwa?K9Imh?ZoFMV!hG4yi}63D2IY?1-mTvWpG6x$ z!VmAV!7@p+?T+;p5^^DU`sc}*V3v8{>7Z!Oq^>?0fZPmSY#geK^u0IW z3uERqiar4mHaObggDZDr&yYT-(Gv`0{>FJ+t^o6pbA4}kC{21OteMd`YvHG52Ob+u zjyQi&omecO@Fzqlxqe6@a=cq*xIu2$CeE_IG^ZU9USlV8&l$=sW;1X@thRAy*&4GG zGal!SxKUsL(Q-thArBP&P*EtM=(cZLmxF~PoOm!y;aW@H&10Mh`7f2qH5a>BLe3JD zR1wPmwivS7-Tf@4S=ETa3jPAJM(T|+~!}p52ZG$HkW~UUF}8#eu$*ffX(vKe;gCHsEFDx zg-t|^$WZ5dU)6oSoYwsZSslo-WJ8;Y_pUDOZ9YK5hI-1;ddwlS7zUMIyuD`|A;;Ma z+_#rKBIt|=?g$El79}ArY<3G%JS~_uduES7a(uhr5J$3v+U^BKY7}*Vgq+ljJrI`K z%VB(+4kj)xPXq}WPCa&wj<1WwqK}SBRvLh)b`NR$v(A<0W>fWi8G{59XAGVIPtrho zgmUyGYBbv1zUYSXb>aNQ(9e>ZX^q2G1TRR%9T+MErQHpT=#vYiWVa=_9^c54Ub6Mev)SP+%kItGh2Lt zzOdzlV?j#Hf9P*-57}>T=je^4&GGI`FC?&}IsAm#)x=Uq(K6>1VjHXfNhmdC>m~e0 z(Pn8F)ZQ=!tfj&S?Vdzh}VDGgXu`w+%#OX5c)=weLRViKH@B(wPq(}y@dXoCwd z=+PN7VCVRPyt#rB5?ESZnvA#ZO(~9`B$7Ft$kQcfb^Wn4kf{&)FNj_{M{GrC5(E;C zs%Xn3%3vc#!7ioo`mTjvj6LoYEh5|sC5V*h%x342MBTRrf1A{)M6`)V)x5JiQ zQf|Rdb|=ZwK47y$umXDaD=%Oau@{xXwl_7g2MECX0`6d*OB*m`POfx>>rv+CP)r^` zFJ;XbnfRpc2QWPdql5y0&D#A<(t`-4FeYLS3aYIcdH7<3go7ZMH*Eb>1|2ypB>G`qxwQE4yLKgWexph zpv1HrRl7V%J(5xe%a*Wn?nQC@{SgUBcuK!vF{5{0xB<~lepfrSx-4y}e~`Ut_h3c~ zI=Y@-n)7JzbvbI~AR1NC`wjGhIyU9dP|H-|T|7g@ZcHLJfpommwNHmZP6wBJPEe!s zZiF_y7%vIEREo3_!l*y52{quFP7*VyP&3*TP>+K2FbZ^IU($^751VK#Zn+}{sNMtV zw3n!!gwa3<&^-yu$+O#>JjfN~^lfwEh^Dt1IOkJF#5hTxVx7C3Hr}tGIuJUq;KNP- zhTClhzUs0Qe&XASa-sD{=HON7Ek&_XcOcls5F$|)qD0u|D0)OyNQ{MO&+>XB$Kwno z=yp1^9q6E_XGO`BhwH>%OInS;;Y|G2hWy*YZ0-~)w0Yh^^5iDO-ul3TC~l6ztI&_Q zUY0ADG*caCpb!l3_Q2AMfvUqrh+n_-ZGoPalibhVuH5g1KLYNEzCRUxR(q-%fa==G zqbKy+v$bLX+fY+T!PzV1|BjvIT}sAq7VOqaZ&gajoX-04$iB#NObl>F3;T;Xz03>|HjZ&1k+v+TnHYcPjX0(QXx!8)zj5-A)gQ%; zK8G2%yJx-ZIG`uehVn0*FF-yv)g?D^r4|RgOu$s1<{$xky}q~?w(X0Ir1l+-srQFf zXfTYy(EtOukTVe`amW#o8y>Hpy`~2-Ro@Bw8Qx3*D(sPsW1b{pO$SN)`3vD7ND^l? zbKon^hdk^K1IjWHneEwxEQ;pB#?s%WueI42-x`{9QPxDUzLme`fuYdlCJ6YK+0)?K zAKxWUuf&!b@-Pf^Lx zrpS?}@GchQ#!f7*l1gt;-6A15W5gjkpvm=CC9EgTMceXWYb(GqKN3#|{4bVI1)DgH=<oln+-NWeH3 zxwO+Nxqgzo&w~T(^&p$7P3%}2z(#Ruc0^L50q5|Z1kEGb8m%YfRhbB`=Gygc2Y=U&CM1shaV9!xm4*`r4>;0Ft~DO_)x`}?nhMG0dA-%d zD3}YerQ3u-A?%s$affeoO)Qwma>IHT3+LTPK`G5mzt7jWFxn z7kmHq9LY9(LTSFJChotmNK-&~)S{+;1i3XV=CPy*ou0`Ns>-QPr^Gu)V-r#m{iVwz zo;0t{G2tDX&6+{%7&{r~s+CPt63aLwNeDM^vcn#3@W45Y_L<2ye5WN$#t|bat;Vy- z2c@P!?rT}cj9Z6N;mZ|ns)VnW?}f>v^Pm~0>D*I+`e!uCC**zBeo<%XMV|B1hsN{V zBo{sJ(}U9AkZ>`lx*62J^>VP?6NRYP9`ZzVuOS8{IKw{BF`e%r79|jo&FO!xD7E4IL$t9P=$M%rbMV!rVShw47|A;#Inkj#!5i zpw6wNv&ja832ldB;0TmxbBNkh<^(BdkADHV29b#oF)5E6Mtrz$pK`zPex94HZ$tFA z!}k6_N;0K|{ka}C&)JSs*PD%$NE?y|PdoEH>emM<^s0AqXNCLIk#yk84rvCNV1ZG& zF4Xq?u6?^PXhSh1p-=(qhM3Q1fDE}^27Uej{+!|PYbA10-d7>ij0}3iao0JojrS+D zvAdk+@}DW=`+^zL%sf6@jbg)KZ=ff$7sn6Bsk05-N_*YViLL zsz6o0|8qhfCI`u5TTds>Ska5t7zY{-Jf$)R+tG34i&3OT2GHIWM?_x_Eid&0ISUMy z)96?V@kAV>tc>gbv=dkS;#Pd~_eXHWp5?f6yxl&ws`IVmxeP{fMU0btB(;K7iXt?A z7=1(6WBf=4ceZRpcExs#7m|oF+`i5>9N2L`ZrY#1UaVkqZ`5EH3D!^8nLKH(ySNS* zAV7c<27R1Kef*ir@xH5uJ(Hu*XSJ6G+{iET;2Xr8vG|04MM5GaXHK2c(t}?FU28o$ z&r@KkAO%-$a_2;lxf4H}{ZfJQ!ZiN+F5sKjC-A?&jAGZGJT|np;rx}oc*w>C+PXUs z?rcXk)`CP!8#-D-XyuHzR1RaPkip(`8tGyVkKVi<_YEGwfuV5>C39$x7E!Q|w3U%g z9YT9+E84;&Ck1bdXQ`FNVu9uO^&1Z12RGb>Z(sd;T=k1v@Wp$gxF@^~q5ghccxn&A zF}+TlrW8@scTIA9E|Dmbpe!4?8EvBnu=~CPxc$u6qYw_0oJ6s4Wd}+Fhw)2>`|IRd zpuL;*z0?X_={ef5YP(BgXeCavRJN-E1PE}r7A{%LlJP>hNCtZslcY zS-lx+`x02)5y!3_cj5cj+=1^6tN}Xv*^ZaeV9t!&Az2Cgr=3G-ZIYl^p?MOtqW}R; zD7^lWUD!EX#E9NcT#AtX(UNcVN5nj-vIYs^h{L2s5YK+5@CUCj{ZbFktqt%s(g;)8 zEhb#LU705M5DDR>-_GDOzboU8eH=h`jpKQ}A-whcwRpi9oA97z9av66vb?o$hWU#97}B=XL=$DPncJ)pUo_l>U;qL1UTXFst0yr*T{sWhou84 z(*$Q#Q3(e|NldFCP9bSz0~6g{!S03*T?IgrNabKaUa$p-jSZAX&z>$yNA^->$>@f7*>T zZ~6|t{_Fc}AZ;(@u&h0fR@O^_od#%5*LxKQpIv8H%iPBhRVr_C7bDwvoQL5ky-OF{LL?7c+zKg;qhNMfH!=77ryzs zL)dpPjgMY?2p_p)1#a)Th;_s~mUES|Tq^rkk7fWr`q_*ysD%9rUVT{MSF_>711F?13 z6I+YH__DE(L<*Q$-}Z%ttGFfpkxQ#BC51u%IvXIjGOL2mbs=-PlW1@jS#fTi z9m`o;Qms9}sgI?TiC_6WzQFw0ISS^7QdSx3>_emCSxi_P8wYm%zS0)roxp|%u}QE# zmLgP!wZgVu&SvrZ>>0SB<>53tj@pj;kod&Vear{zLj6n=2=a{(mYuGi(HzuaR-6L7 z_)|c7^0yNL1UTWKfo*^t=NoUP;vzv=wgq_32P%W+V!)eWv~w1k;9xqRKR&Fn**v3d&J68jb{69d> z_iLKR1Ik)5(Nzh*yd zF+xJMrd1IABB~IU<`dzFRmh5FXGXwC1at;P_92R$N0HFK-g*$+TSFoZW!mXCXtb(i zB*>e!=_6x0yC8RQ3GZXPwlWR6*Y{gQc67i|ag}JN<#-c?Dbc;cqniK$PDa=na<+eU z1NBjLW3zD3WJxBCL`45MoKPJfkit{tP_z%N*BJGa_qhflJN+KFRVc+2CM7_C6BbTE zc`FlBtu%;eggEG%J1Q;_5|mYPO2N8B z^9VZ4+(V>7ge0emk#Y>9hl=dXHEnq0)@69|S<7+hIm>EfIUapVKh9g%hBdu0PSU7A zt98n-0-_S&goFr(L}xVA&Uw-Ac8IXJtsDOq3A;swaPTT6=%gMRnL8*9H$hXFT8ftV z-x$*UgovEz!o-xA)|gLp=-R&7qH`@25gCc>0%f}hP?@XkkT?cdcvyed4f{-9@%!VlKaHFBrE%-tG_9$`wO?*JvSAU;`6ZcQI{Pzx%G+pzmZz34kY`T=vIU!w&zb2p(XBmBKfyca&x*_Qq2AEf9J8)EQ z@qCmzv)g-%=VdJa%!Mw zu?@d@?Kb@2&sXE^kL|^C&Thj6>ta~ZF%>xxLg;P{8TyK^5tuA`(JOzC1>^^s(o$|6;r4I0vyk9 zZCD@5qZSi+5TDR>I;e};E)m1fwrGeXC#1J+d=e%x(E(SjKH8f&&YTjH(4YE~e(%Q) z;(DU6MS7}4!!L@w4rFdyQ(pK{rYFp2`!Tlw3k$0ZPXa6&+%PDTa-6;~eSAR*N-G$- z61J{t#lJjt4SxNa4S3PHzUAsBpl*}a8Iu{{wB<2e@v^n}((~8h(IhRlucz}aK_{F! z`~yyaMS{vcP7%w{3QCh-%ak{1x(V7&4m8>RXt zkQ4Sf{f3ag{W!5VifCtV73rDju_Q4piz~pwLG3~19t??#4kP;&32I|LAtfX}kSXFX zFI<6Ny?Pz~?lC>~$%Lt}V>plhx^@JAarq#g@`ZzV%%>0G5ueiESvRg!G zsl>?)AWb(x+s%;eH-d$$_MlG9H0jLD1W}u5qm|l^UudR}yy*i~{&ZQ>3fkA=fb|t% zNg+5SJ6{lKD3sAjLhzAGm*d6fd7tTSfIsce;$y!X#y4*p!-2tKWjjdgT=q$ALXZ06 z$cW9rI9O_RCQ-tR&g;izjN_pj66kN8poy#a!@dmu{OgDDr@iCsiwegA4KNk#kmerX zr|+#S?{{wip73`-mSq@V{$b_sKP0O*%YogRZ<>R=cUEL7$gRensyo;A8P04V?~S0Y zXA^)LG~3mRBu?F{fyW$&pISd&VTWW70M~q$eLN0yt_lvxE+p)bEcwKapR%87oKz>O zjA8XhvH-^hk%w#vYnCPOg=ep6OioBH{`aO7Uhw4uc*w_h;=g}>2nU9;tR#|>1Qk^a z!_jB8CHnNX_Ql<^eTJKE5_HS>zI5FoJoVE%ap5O-<3D~qgu~-UwPcFC^267S;Nc(J zi9hWg3CPKez_QZ$ApL+_>oS&occp#Z|yB)72q|5^WK2AesrBSBbg~ zyP%0QsOw7VS8lt;i9G14Hq(q)1OWn^j8JFN5AjGUohl$Ga}6n(TnVRb=)fQUVjG@* z24{G6aOHhDJob}&@uDy7#8+=Pg0y~=t&OC^e({r)W3L7~&DQ|Vod!_t8->caW!E^~ z{G9`M@W*!HT~`j_`h6KZ;q&|OhHvddF2guPZUS;LGic1nb3n|KJciYI0xS;HZdDoD zo}swMrr>wz*hQ0YUZpLy661)8#04dCqM4xH{?WFM2`zLkMcX(!lxx4=k7>~VH*`T_sv$p_~!7|k^-DXBeJjZ}^ibiu#R{>@Y zYp1&UL{-r=XH@%d_pUR9ID?3Y;!|JpCqmC=rf|(cMf3@K^OWFYjKX_u%i0Q#3#=B- ze}F}SsxiRAL*;IZC+as^{pW;`hO_9Y0UDxMMo(7)|Nev(SY2mV=k9?5p7fc6`2HUU zsH0d3nvIE6%=Lh$@I*%999TnSqH)Gm`x>(&C3(6jQCZrLqy@dRE;RV)XZDNiL8YV1 zj{z16EPt&=*jq6i+@0urikhs(`spB@XS<%WY~$=E70AEpU*tnX!-;$LAZL!RxW48@ z?a8))Xjhx3YQAV6VBw)UlLW=T@NjBX=Px}82+CYRukRKk`0k4~;9(mzOPYuu-JQbY zKfMQ6-+82RHg7(NNi7t<#ZeQFDN0^*VVt_E8((?JCOqS;{>rLapcp4ZWm3@Bd3l}h zItx$-EOV`5*^dBn@OBd62+zy31VvR=B`CAR1ahMQ6>+V2kTXX@^f190JHHP0+7=M? zgou|ugYVCm%mOSNT(zoxRP@29xOh<4Qhj*+HK>ZYfPJYogbzPw6&|%kGpULA=pT}J z@+Wp+=iwwLS*(G@9ON{}D!n8luYS~W{Q7n4@%%Fr_?IViV|5>UXz&%w`p~kYz5pB) z&jN!5ZbVzZPgAGgG}Dz-XL6?j=vZKNPhw%;%b2Pm(9V9B$0JboNq(kZKQd_P;mcL^mC-QIo+`CQ%S({dsClMJ)zIuJV ztnDEup8Eg`2W@eOSyxeSn=R0RO9BBwIaZX)=<9C7J09JSR;`ZsaA3HISA1t528MHN z_!I3G6zXjHm1E8hEme#|Qp^sjKH3r6EQbILcztSRoD{=%9ouln^1w1QLm5JqPC6#Ob->KD>B`C5)hPQ1sm#R59q{$ z*Lh13K0NYM2XOn&bcLKO*2;-G5c^$wTNEFB)&~6S_I(v(57~p0cWgk$L3|6Nl!;oWUtr21JsAwv5D?| z;!w}b;0$%}Yla_Y^M_S-WTJt}lv_t)s{ZQqdD%%3JF!3hh^7GB$QHJx3s38;v=x>| zOFW84ZR==EQZ!KJ=BQmUzBqN+!?v`eEx~d)k#vM@w^4^r^|C;{KCU|UyQiB|SG3?+ z=k+uuDXP2a^ufspHB)g!6`SrU0YNzysDtY4$&;6P21oI)R}bOdUBi`+t<4oVY1DBV zLGDSQ&fL&}pS)}n{_0`V|NhT|)?~e9>wRMw-#IbHHoQM9sgk7^a^;K1cijpK8jhdPU`gW z%{sTIvuVEa>S>K&OCKkJDj$`bD^FcXPTqCtDxA8KaV_M^*OCXz#`+68h~7L^KcY+| zC~^~^Iap&0;f+sRH)+`Vh~u>vkQi!9NOh~acCUu(m#F1l{$->#rM7W0L2vBXIUp)_o9R+Y zA}!v%t}?eD?sK9yX6UBOwyff^GV?_Dwc@wakN?>>O9VdK+cmuPs>C4Yen_cSAxkP- z3%3DmOIRYsESVk!wvAuyOyk>swiZYgk!PD2apXj8#s%r=iidA#!xOi6SK5xu_}}c+ z#?+={rrE06nz`{BrfYjLLu?N;^q0BrStqZ4NbgaCH&y#M=^*CLKBJ#|FcM$sauukY^c0j= zb6}&~u(}m*dDz6Su@z|k{%ek4aB!T;(d*k;ldI;pl>xo9lab(SZFOG51g^;V`z4MK#EL+#tHkOy-7o{C464>Dz9JUt}KyX zqL87Gz3V$AF?FB@eN3c8(b}%5>x&9Q7V@Wfc@fvq`ID;9omP9QBU^Lz*+x?Hq3e{qn1D;5O`tZA+ydER(JRP^P4c*0dvUzO>Ui;8qTy|~(|M|Ri*s`h}KYP_C zw!1C(=AUmfKSTd~I&Ne;Q(GJVm(!VCPP!hk9Dn%BO*r(9Q}Cb9-e?5+voF|){qHyx zKYiIoEN_chyFQ_y?5Nu8*QZq{jp6U(Ke=}dm%nNwuK7QktS=|n7GHniGFF|E~*bor8m0D zv0vp3FfF7I*sw0y)`@l9l_GRFFj~S7?iM-W!%SCCOwlmlWXSfFKlL1)8QF;6zIGF? z`-_eE<*QfWy4P;R)l@Ryd&x#T?}1d%C2B@nNv2~i@83LN%e_Coa~$XV z{T=wpT{&F1u?63I=|(*3%Lj1YJMO?~AGi-cdD%Mr<#!Ka-!SmlcifIMSF|8fj^oU? z-iq+w-HvxYZY3VNsSA(U5X0j?yC2W}z`g9l6WiU1j1UP#OLqqn-MvV3QTlrkqqLBu zMElnux}4W#D-r5l3G}W2I+p`ooH(?1Q|IxTpwerhh|Fju#J)Sie&ZMWV44%(v&f5H zF?apTFH)Q~L#AjJZAzAYje+PYGY{2U-AF`WBpRV~mHXzfvOS8Ie{(Nh@_=q^=}RC* zlCo-jJKplhPISNZ4xIV6+pu%6fTx|_&HjG~|MlB6{_1nP@X@EOB$+AU*Y~IKtkVs#@iJ2Lpk$FIZ(zqk{BI*`Th_hj(Avs@8QQOCVaO+{b;d@7L+o3FW4Ce9PC#=T7u>y{yipa7}BuHc) z{fYZ=&WG>CQ_g6|`>!~R+YaY&@uzm-j@|mP%M-37j~yx!PmXH2DmiIfIRQMdh+>H_ zF51dLyar#oIf>yxHoR$A_#~)PGoR@kC0jz8C73RUIg1S=9Sw8B)ruHNNR(tG(L?F&LulDD5|&j!pM<1kSwGOT zjKXVo56KIOeLG1+3q@NwA|xR#BZ@4jOj+)>@}l-HGY8qpj|hlJg?giiJjJ$}+;$Sp zR481UZp7w zOv?ZKc0b<3S< zdN@_a&b=9=IGAb=x{ZXRQ(BEZO@l>GYZ(82%>aJ;>a}?E8J)Q0U1#H8e|Z>(NJKPF zKH{N$xcOijFFdCOk3GK|AO7=A*v-L4_4wpdI`Myhybs&@+Oc_kr?tbA0wf9L4BKaR zoC9!%*EGsmmPxjZd|Kp%T+oxOj(xD`3)-sD>{NZRmF>8z9f__^wDhk;>+0OWT z@|6g$kgP&@C1o|Ge-#Oihz!e@?$PP3z{Dxq>e1G!^&4JeBqUM+jKVaj3G2i!T3Hd< zsXEdUwulKqEBn13rB(M$pd}WfRPy$oUmd}#FKDxN^@qFD7$CX$+h=dYB@gVz6HjZy zzy4wr!?`@3a#|EyR>tx9KOVw6E?R@LS0!-HDh|YKpFOQny!-*Zc+>-W@bRbi;5)aE zU~7K@g?t*9Z0*GQ?l|r}lEbr4@5Y-hU5Qsds0R;T+j3%ZV-ZVZ4U+m9^!M?6u4JTR zbw>>6uW8|U&_Xg;As`|o;vn6ej6_N1B&w$vuLEOYyyhXjXlZ8~I$8Q~Q(&Jid*UI2 zw&m~i?kja-GX`})UaZ4WJR|6H)9viM=RBPnK&Q`7QgFud;PowdJsX+MRyq9ao-DpV zB2eLZDzGM?o}Lfkv~`{M=_}TtmkfJ0c+A!o97+Sfzdu!}Ge?kgWwl*(UkbNtCNDc< z@4k3gzdh{eRVZQuZdq^0gc-EO+Hn_ZxgyyE59IWkagA*KTcey06 z?@yJst3s6?(l;y06m7w9kU)uzSR(x;rLXfO(sR;Xy3(o6-s$Xw&TPmyOyUsIDolje zM1m4WD4syLwF{9p_J!7Vlwu?)tt1s3$Pr`5Zl&ngh}H46*CE29{-I|b53!An=aEV0al@gEtrLY3(7;D@h)O^)lf5Z2$s`w#uwuQ4eE4rF#=x>t}t>BOQvUtG1-^cuT z?c!vFI?Lcr;Cp{pQCxkSfTz8iZD8VxlffM-76EkdoB8jx0-!2UvAXs`+e5l=IP2RyoO{5m=r9 zJg{*+W}_{WR56??;QGB}a%z+_K`D&CeQf_RlM_L@<+ra{&l~NB*HoD5wqE^OV*u_O z{apz4tpK`L0-fEJt)sRM)+Z%OiBQ6xNLed;jo@!Xg4%*3uv)cqZN{|` zwI#J1HyHZc9o<}YZ_-xj&`NvfM_1>@g{?UKW+&pn+Dw*e%U`ILsb}ZKB4 zB+KU%%`8JFZxB#FtUa>(WK6vjk?lOvJWA<1lkfk(>FZ(fDt9h3w@tt9##QN&1M zV(lG>b+#ea-Hlj}u5BbPlrBzs+Id~5!|AON{Ml!B;Scwdgw+nZCmUGR6UMlODE|Nz za55cn(h15@ZufwTwuRd!l zBn-&De?rlj1d*1q0%rnT*djSHVt+w_LV{v$Gx9@sI;4@UxG7}wlr;HI86|~p!IUW> z6e3Yd7=>5|3i>cuTRS4{U1;g*L0nr5wi>hmAW1pt$%zB2tttT)6xPMre=2i;QKXZ@ zNT-wR#j=q!i(s&#vJ0VYB0s@Enu574ow4I=qMa_{{H9xZu6_;B&t@i0|Dn zfG2+V9z6YXdoaxS8ev0!6r1}v8*7%JNI~=ej?u~F=M?wJ<^UDwP^P`j!I|!y2oNkQNP%JLbkG74poFd|qqM5c% zL|PbxZ8_zNDATMg-ebb&VwzDY{UkEQ95M_$r!UOf_gSKoMc;6lAZ(9KNj<+3#nY_N z{d7_{?s_7(4WwSUlcZkyjzt)zwF^RZs{`?~if5*2^t+z}saKvR)0DZ|!33e1dj(zx z&hdM*>>Qvj|1ruvp)I2G8l@W{Lxdr=L+6`Z4!U|-QB!Xsk(xk z1|xYSKX?w>Sa0=k$3Ov(`S?y8($RK2P`ZSRKDh@s?i!Rz z=P|!u?_NYjew%5sA{UB7ex*Paj>Rj>8Yp;kN6VZ)RisYl6%&L1-Z`}!y0bSYc(1pXlr$BAj2$d3GIa1+>Q=$Ha*}~aWi>rM$gMwI z7kxEtdQf>1B8hc^m;e`+uGRQ`ux&r~=iz<4(t+x>XDjbX995V8GMN@ijBBUV+jY;G zFifSz4qmgas|l=ut7~0V-nuHd2F|PYewcq(FM1GL_Mk_rF5YPMP+8}_hL|#mM1ua> zTB7J;_s|%%jPn*9vq`bc?>Lmkkx`L+TC(gyxlug)>~#n;oZEH}U`#8Qp;i{15*4>E ztXJYvS$l2X&Rg+WeNg%|$@2HNA34D)5)@T{3c#N^S{l^a&71~B2Dt1L5|sZA2uck> z`41A5H_w=$aK`lEbFI?r;mbEB@xrfoVfq_-zKB!ScH+)AZuAT$Vw42tNuNJ}-`veQ zYW5Xj5|kHTupD1_UO-SLz)w(Gx>yzLD04X4H|%|P2!Z(lvSXx`KzX%Hz5*3y~6859`yEx-TK@K_A0V>Z((S_(!DC3 zkUM|YbuTmX&p+;22@)A%SoWx(cq0x|jn}17S9`0-Jy$L^4#-#m$jp+U2N^0Lkpf;d zTh=%yE2|@lpte#?k09db<$jr>3wu(*9EG{9xk{8?KV14O zAC=pqhJ?LEBq4OjTV>@BgH~}8u{iroEYXT~Hon1@vicRP!xGf~C> z3CfS|PvNHBDP-~;2xrrXjO@Z|pYuR;vaNjg#+}$x>_morw^(XHR@DDa!b&tk{w@Os_?>?Y*){5fZ3uh!S>Li6V3J7FB{nEPJhdv4AXDw$Ww$L zV3x2ggSimaPgz?O65ZEvBZVSG=f3gLP~^WR40~<)Sj3xQ>%KZtOd)b>uK`aZQvUYV z3`P3H%&Ej`-DrEn(!l}4^bTjVCbf-P&z|T~=AfkkR3dLm-c-<_XF`YaFUX&hNuVPU zCmY1n(O7>WiPA$T)u9_3t!#aR)1GfCG1-H5Gl5J-@8#}i$M$GZ`4p|pCUukrSGBh=Ro zbW{2{BI!r%x=GBtcyB))&_TsSvrdN9PSIy-wc;SLttrOCOXZs|tkVed5YJo6nhdlst~TDc@?Ia?Yh}DGv~S^Hm*608*B*vLaqi8Y;p!Um z!gEr6roDc(IN`r4O*$-0QTp^oiSlGy5T58O!T#`^XvI)hy`i8tdNkvd=()PJK{2-q zgKn&RboIiPxrTqiX{6YP0(~NPX2-BBy)ImqjlPVVplFLU!un&mg!vrq=tNZK zomj73eO>5X-ifaM4kUWJ5Ne4aLjt0+;3MND>^+>uo&MFeek|{4!}4WaY)%OsvqHGDh)`UFrNAruj^+e9 zFBxW=S0A$TWt3v&8p3jK1%-7|7wR)=T)Gk4Tdpmhj|3|ywOc&DN#d`+H^UW_(LDCQ z=Nzo+^qy-lk}2acpV*0;bjsen?k6Qy3gc@p+l1$yq1v5{K{lkv{?8uVvS*A9!SgpA zvPHb`ATVze+pApr8=q?j&5CWx}P=Z z*_5mII4$Vj7&ptTSyc0+gfcFFf_1BbBFlEX>pG@`%2tVy0@h%mekLyyAWsU^TS;=k z`O8lCb@QZxreat6{r+mJ#@Pw7v#?#f@?QhLdzX%SX>jgj?(DPzYK|%XaLkR&nE;nQ z^Fv2^cK*em{OMO1(g~_p^X>~*?wnueUy!|PgQ{9>t7uDr7Ezj;cm63ANRFhRY<8sj zk%j)~S?*OfE;4~}yR?W53vw9mPTJ&A?@p zP#I`u?{v059>H@~F{g!li_Af{a&KiR1HWgbix;IskiFafGk0odYSV;^N8!2P{Xtm* zEU}e~;QZ)n>1TMVAKgoDIsdZPJ@Xm0x7sSt;>Pl2a{`fbP6o8a6A2Y)7P4-(GNKif z5H`1@aN6>2tZ0uzBmXrAa`^4eaU`?tJts&=6zY5`+@sdZ>%^4%dp@1ly&%r2Io(N zy9SCRD7&zKn2b~nq#2|Oc>Uwo;X_aA^$aTbho24LAAb-KlXLRxZkKk%FX;eA^reEV`M35X_4QpgjUxZ+nwk?3BQ92jfUHHp{=&b|60 z@Aar=->3_@AQhEurOKg4j2gl3M`^DIzjwKF1{2)VtgK8>65?o~*|zNDzg{=@hhym>d&d*11V9hknxP-*V8OYOdvoI;Ly9i8;-@&=-WDN$ z!i2h~omQ!|x+Q|pYbXe_NhuCuc5x6{^0kqBdr~ z8ALOAR~lU~&aqgdedN!xuri{5^D8r#K|ygVT$y`RfaR~Q#pxLOA_a6M3OI%7KYdw; zeSvtGu70^Mh3oH6A(`t$B%d~d@~Wpl0G-7QuDt6o2I6hxJ0vLVrLoE;Nl}wfUi^7GSwR+jI5n{#mbZlvYnBW+P*HsD z4^t0x=d4NK$UmQsk3D|_{_)b)xa;j_PDxILTMp*2e~5~qS)!!I&&IpHb8`CcI>J^n z!)%?<(3XRiAl>Vzb0+M(CxYmF&YTO|ApckNINP+er`~*#QdKuJa|g9~8AvPZs*y>{ z_I#F=>k@@DROV?urvmsUSi-r7=Axb~_MCplVf*FohR z@AYYR31`jaToUO_3Mo#s^sC4z=0D9ybJUNCwld;vCB$3X(b`67??7vJ8``ur(A$P^ zR|~?_H=!1a2$RRPOti{i`C`J#tP9)XlRl%wC~?+(JM9@h+Ucg9W*tnMCQA`Case4BWcu`)yS6nnXxnxWBedi4Q_yHE{-qHSWOSHxvPKVVoj-SI!=P)e`wv^#Ck z^p${fPcBBC7lS`v~3$KM#aMI5ayltc_Id~RurAwg1+;Gn5- zI>Z4vl&AlE7NH_1cEvG-IUvVb#_9VuvRbZ=MpG7EF9OBk=fQe-RaFAeE`rt z7RYCvJJDGZ5hI>mrZt6KNQuEh=>bYqLmiyl~^8V zZz6{b+w?vYZgs?4SN{gtInYu|7c5h&cRkyc=}W|{IWzot9*CsTEX~4?LkWv1Z2*n)X=KWdx@|MGFV>75Q zD!#6^D7Gw9FFuOlObNFgVn+z-KEP6f+M{Vg4FbH_;7QQ{EIu#^awG?)O=VEgrp}*4 z_f8Cogo@h+bNZ3FKd!1f53;i`<(3YNq&V@#+X%9DPU?j(OQl6yGIo_29V$*cOv`xe z9070Tw^juCQP_g+W$vEM9SyazQsRuLDjYZqo@nbKq?t6OC}Cvs=dvhK{1U;w#+&0n zmS=HD3Mi8F6nHJBN@K2sU;^u%V6DwlG$c1gz%$>W&ty>WFf37plA_+fw2TKf?ht!|{Kd zI(&%bMsh+z5{-@{LP8L=?Wj?Nb+{LF$MzK=8HzBSky3$tAcsYqiy}-b+Ak@{0md*~ebdZD?5z%S|b*vrM6%%3MMHrW@5;AVBf~eitPb>Ju z&evFl)4fkjFRQSbL90-aE{3fwt0J!@KC4c}dWs?(G}BRmO5@>$_qNi)z>E;l-d2%Z z2dfYb?;C^Fk1SiY=S$4CDqrqs!Apq$NLA@Bf-J`rojI}Qp{gy1QMR-Y%#x)k6enSc z(0zrtZ6KL1V1(^NVp$9@Ly(~S_I_3LQE03Dq3hHTT<>fGV!E*~zIwwTzIY=W z=rLkHdCtY3IzT<5*5WmW>7ZE|ThaFJR&48?*c^6_GH+*^tF~r}p7NXLaBKXD`D!+xxI>Qx`U@ZAVvk zoRho+;v^~&tSnAI3EtoMxD#?^-fZ5xK7-;WaUV4e-8uO;3^&t}H5)z)gb6^l9hz;#p^^u^+|1T{DK??P5o=1AsFK??i$Ww0^n!F8$Ie zJ5y^9aO%Zu|C+T1n0KiBvm^++Zsep(Gd!9(WoN`$3eJNboqa{eRz$kX;2dzIvsDP* zo0#QM$bHpJHxj2g3G+)w&Ps6z)p!VJXZHN#W{)zE|7rsLo;)~z66egp1>+nj{Vsf6 z6}D!@HoKJ*rdej1h$zh#o#$3(7<4{Cb{ZfoF6B{X)I&6$kT-g%KI>j^>6=Qb{&b^& zB-D{+uefOL!qGMWpWW_3k?Bfnxt|89ToFlmwMNjv^2{=gw-05pKUrk`#1R(x$|mvfGgkAy zfE`Cj%EGOzTGeeCIjyGHEADDrieLSh&uRwMhQ%~#t4!sj*}hhomN}29D%cuXlTcfX zhj7U@vFVBU`b`5&o0Pd{5Fo%(fZC(Fn5|Z74}agwq8 zNL|XG$f+F3%)2NaS=EbA_U49vY<*k~CB85kq3V|+=gzAi&W%KqNX27uQEb&ieVC$W zmoF1@MDCQS(;r7@J*i!!{{SP0#m2yX0&;-PEX@aQc)c-ZO=Y)KTcx}}I-#@9-cQ5Z~N z_wE7Qcke;$xMvscx_>|J-!qDxhXyf_%99`!tq3F05Td+^8Ie$XRA$viXsLYoNrj$O zCJy!km>fssMS=+H>F6kZ%=qm%*xzR1S!#Ko0eZ6Id{g4wt7DS z&QO7>4R~=XJjErElX`y5OztS=#{PI>iJ~+>t(A+%T^)4q#KA^UFL6@-em6>sZfw;> zx4bvugITeBG&KhdvQ+ulAbfiXVf@M^LyF=@I{cC^#~u)d4GSx|25>sHIm~ zFLs!haoaY9B#r{xM1iAcf$^p}CS~$vq_Rbf7eW{(8A+1O3}q4+CJ7o!6>%tCz(AIy zC6~dzWDa{XCG4W^92_ZNe2DqWN6?apShkO3!npU~e&{90Jk!^j=s|a98&>x8W7CR$ zY+KfjQ&)CjU4J{)cO|f*EryP05s4_nh=!1oNG@D`5Mnv_kG1X~s z^z7oW5eB0{YnXN&NhdkxDz6X}Bj6)Ui?|D7TZKXlYUe<+OmHEEtTS z=tFJSvn^`S^4g*v zYR2q`deptH=APoE_^+^dnbOkGSGynGOwL% zZz6Mw!V&ysD+ijOsxIWtM1zT!R<~6ocr)h8@BVoA?stf^%&+jA(8#1}CVQ5@ZD-Je zUd`U6$+@+>%B_ec4Z=|-HHs1k%RD7VB9krV?X~A*AwmL^$FLo`EMp{F##p9^!DOD~ zC6DBI7W+ptNVJBrtRqH!Tf`ssjN)KEhW)t`_NBrYpx<$J_i6s$peRZ#O9d z=F2kZ6P+Vc{n=#ED?^nBWaSjGKzYuN~>^%Bp!U$YNRt+>>W&DEZj!kT1MJdMMN~&2CQ!?U>j5@ipy&o zRj7^1zLH4Bdb(USh6XX!hTap`?>8*pc9MUn%|o$_7zxUqZ`z8@eJaqS_=lg3;UBNq zQ>pY>4es=(N|*N-S-HrERb~Zt;9WmGuUU&;hnr0ts#kWv2XE`c@BU(qXIMdsabNVw z{kZO4k{^rvB!>1ykL(04*Oz2D6X@RrJoDW^hJ$8+`G;ow`cT_7ALX=^lcR~+)z>Y& z8@*B*(&0f)k^Kh;g{oU0Y|QpssJ)X2sed%W1TJ6ePU)kW4v;!KB|*kDNk8h9H?o`1 z)nuvk`#o`FFi`@ko+sQ^;l=<#dC}^s9Y*vVJG+UhtAa`4(LnC~tHOGfm?o(mBbE%7Y1UWmh}iS$gEAHf}zX7(`1sa;XtKd|f*( z-r9}d-=D#iJI7ICUk^n~_AL(`hlq0wY+>1#>0U|EaWtK4iI5nzMZzQ>9Li}%o>O_V zn8CMD+^&^Wb)IFGqi#)-DCt)oq{mYnQgekOa+v}~vuTS@{8uT?v8=;%qb!%K+-YjR zOXUiIf!o)W1^IA`1}bZ{fBB*4tsb{Rqx9(NVC{jC=qCwmg@un*`w+T92`rC?u_m6x znSF7bLZ-DVAHuh9AHjYywrny>uPo%uVf@t#&gWci4Ac^+%FKTMg6e z=@y?#P=%y8G|_XFr}R&3^UZDX*dWM2#Psy3?_dSRDzlW% z{l7eDO@7wlpC}MH*A~wm-XU47pqw78pez_v{@UW%{Rfu6+M=|YuTARK#Jf?yvDv+# z87Xy^8{MjIJrQgG^BbzwYgXyaEbTy{1_t&yxswwGDQ6N(lM_J-n6Ni#6bAjfl?e4& z=S--2l|98)RXj1&^ zK+8v%)>-sN^EhpFH}2dwg1spYn`}n~+xiQUl+c~Fk;p1Cyid_jvJkc{_9N*m4yN)r zFq*=yp%nIwrLcc2hdrZtnip_58^Tbsh+&eGJlnG7JBhY1+S?-N?+9aUZwTvpBiP&< z$A%Sc*i2cwEQRJ2+UMo@|H@w;k6x~_btBv#7+A4LNoehd2!FwG(?qD15Wce*ml+fQA$1n-i z9sBY~X3A89agwMEB83zla_$=BQ)S#eTt+(7!rIk==L9*4!e=xryEvmSasr@|700dA z2NNN&*Py*Rv~*Q|3we6D#t~p55)pj=_lI!*kV^U}){$lY{o}eTg{{UtTR3H9WTi%` zN^BMoi!GIK**V>K)aHqA?x=PA_iqQuKc$>KqW}RG6Y4_N#nd3Fj4KaQK<@l91t#e> zzrV@=Rhi|97%*O?MMh3@PDqO1uN>&=24g~Q8ztR&Q+gzpXZo`PwX$$HL2Enkz}4+IcV!#SSsB9_D`MEvQ^Km&Jo>^J^pddXlk+W}#92nsd>#?|#tI8b zKRzi^V=GH6Kihg?x!9XulFFmLWs(l(kc;G)w-E9qfckDlk^K zw|?%Rf{1+tw~BC_VbLzEuMO*&!lYD1ZgrKpp~T0g4#_fRQNLgXWg=8Atc<&dOL*aV z9Wtnx6X&jO!FVx>Ywt+HJ~J%0O9D(wp@hEfc6{aetI*qCZ4HJm{xOaB{_Ietv4{wr z>WykN?k1B&jW%N-4tQi^rq{A$FL;?^@AJ7f8k zv93zeq;TZWb6_9Ps@$5fq#k5$?s#LbX-XKs4XUzKT3i5fsPKiFJgN-jL@=lPqruwF zG02aN;1q=|dwOu`leG)hg)tjgxHaO!u7*!XMjB{PD}p{8=f0Y1{#g#ngMEgdSF3AY zb(mIpRGdyMPrR|Xc`rBiQ9D%>@8w2*Ij(iZ(>Q%yAMV&YhC>BT+U!GWawpFki4zt7 zLbYsV&+=0`#9$&KHen9t5r(P{kkNg-okead;$yv1ACDY#vE_>xq#uiYV((KP27N8byC=3@dt~ln7S$MX{NZ9#8W3px^%c-X!l7b7_+7cxwKoaGt~_$`Ff4i!&(k zMh=-_m79H8m)D5Oo@Uy|GLodL(xGzIbF**p*sPs_1_Wg?ST=Vb$>G!$9XOk8){n<; zZ^g}n1vdIrr3@FFq*!C(m7Qq!+qPp(w|d%9WY{(y_@R54PBxrbZB3nk2nfpJ!V#4F zNl-MKwSFWE4H^|CR)x%^V5Q%xkm1CBISJl4V~~Hr`YQW@#p43iUcMgrY%8Odkjh2L z@E#|^JW$wPq@?w%M+L1eR?m;~;p-u;+QD0r2-}XJ z*h+`|dtP)ETrg(t8QNPj49CnUB7quwV-ajy)sB1i7jRglz_vnE=gJt{ovzmQG{~y& zGhMb##9IYsXPRW?O?Ff>m4l-bhm`Dyf=i^oP2Jij^EN1 z!**>U^(U}xSpr*oquAI%Qqx|-iqSUtNnbE>Ne|G0GMs<>Pn6SCqF6ld;vnE+>It0@#)ad7v{ldY~W0F}AL>$z9H z6sE3D1S2>arD!0+W@iaxUa_vaQyA`APn;iJCkQPig3@R1X<^$gN~6pvax1udU6o!x zykLxT2+p0tE9cSOTEr=B^9GFDiJ|XB98t@1S?q2J#qc?KpcmXCEU6%g`$0(R^^mIyflIf z&f9>|u`CV^Wszmtpuaz27rDiZfTl@wFGP#Htl!{23OcDWwI5;?&+_xfTEM)RlPgd9~+G zfFInE!KeRlgn6Mmkj5iU;RjS0|J7 zoDBWp$b*Dt&V4mbpG<%p%CAO0`Qx+oOFk-{3VwQRTya;09yGh>VCKgJH+7(-IH{&v z5AvuqYVxUc%IxT6fQU!SOn)j)eLsVNSKW9b zYh4w8E#yw-{m(Q?!w9$8LEhnL8wN;d_7?Nlqg9t=3U`mEaL4dC zZaXrD8;&IL$AKJfIg-ZBN3yv4PzLuN&fqZbkBk80BV`oGVA@EI+DTB?kc4b$kKx>| z2+myAiU+P}$C)cTaLVfCSk={mHfA-WpC(XY*~>Gkha#(mWyGvTdEXi?qq~qsqL4ug zMXy$Ovff(grHxrkXiJEMC!+jnTq-bsb_PlJ6rCNi^3mUB&!DKlwIma)piG9!hm~{t z-Ib-SOSY*29)*6i>h%xl#Vtc++_{$(st&PGBtRXS{W+S5;t#Lih)YkKm^R`1JsCXZ z^ZSt2=BWCDb;l?jULZ&mjd1z553 zZXNV&1C@7g(2ZZDL^V*-p=~kvtemx=Fsg8tUK(umL4N7Txp&s`Co_$WE*;K|fe)sa zm1kLcaPFw*t67{1a___r^-CClzF%PG5d&JPpph~N>?O={%{_NaL!WL#XN;cTv{V7NQAORu|wf7L)6-YMS&dc#AGfU?`;uYYvWE&+`;yhAYWp*Huvvz#6tdm3 zH+JAVFW!g;u2bWlh;g?2M}BlK21iJoG#Q)gv>fjU2+HE3mY|qfp)nL97e zo33h)^%CfJEOI1{xJ-IP=vhWd&&%G1*ljy++3*ES95gRKc3DanV zw~~%BMc+>;llYV!VO{CR{?b|n;WbOiv0r2;uv=@trw!{!`i(*B46kR&3+n(Tk9Q}M= z)fy*pNuZY#=Khu_I+^TFot-IX(ap(2qNuH)655!e2+Lnp9bm4&#!$%R@uu$|z|Zbh z1y01Wwh+Gf{AGCmv)5tWiY}66HY6=)IYKcPP*@61uLrmFGKJ{G1%uNh{YzEsh{6)U;dAR#|?K++p<>a~5j zmy=p38iPMx7tTx||2{u@bU{k|&kZ354Nx!b&A`Q3^)CZGXi_TCy%(=;Cy6}kb#Uk2 z6TPvKXE{l%ykt%fjq*2HWzj7iYultU=Qg7$p|Gpri&#ng{wl=7cBu4NFD+Wx5XrE6 z3Dd4G|B47GDLPOaWw=`5&}xU;!*n#v@o0=e4lquAigJwU z87;RVN#ZeDj4}qjR?H+RKt-b{yd;R9CUZFq4-eTFdb5;rE{z`A_cFfaktjBG#&Aks z1ZS;i!2?#d;Q^~!@G$+_^qMZ5y{Z%Etm(vqcs*@JFV5(VHc3#F0L5M{;Q)1^MjQ!Y z&ygH1`RERO;}$iR$$0a_y0Pmm8}RSX*?{)ej!H%AXSc2Md9^)L$e$W)wuERjikCcW zE$)5$HvIdO`>?ueay8#MP{89qcL-PCc7$zN9V4jQ0LLLrH&KkFOw)#)6N&t2OT$|X zsLcF*a6zeWYCv)E$o&Mk0A~yJP3Z|mBH{3%ef>uLQT<#qZJYTjaY=d;8JI&TpMoak z)nw?#rO`8V?gSZ`@Q>0ceO4OI>k4a2Gq#8bfBQ{-G@ zx2`r+%P+5bRvQSlB1y8Erkj-9DQTuMT?V~`Sa?c&8>6P^w}Iq7PsfFJ+R@D3Hqth_ z0#F33AB#_-`zg|F+dwYz8nNvhiPEc86P+VuJW8SygTjy~K0)_tA8J!1HevZw+FOw4 z1U9YLor@8qS+1iTKZY32XgG#Zjv-^=R*aP57-!{V3Sov6sfKRd#mbc)Xdp9n!NaWM zdq#@bKU&0{!{gX{WE}SmO48Ufl*GNf-aDkXk%|~h7ZBB|49VV#)-pDAlyO>r8RxEw z;6bY+c+}c<%l*_)#>EirQ@GVq2+#;>K>Dn7tc>S=We@)Ax?#^^BGlI2@`x_{?zQXi z_fJ}l&194Ilbuq4?lbm|urw06(V-%JGdUMVOFW9Fo!gBcy=)^s_uM{g={HR<3AZ20 z;<2CDhg)_qZ3(Z@2MBOHflc4EqJLns0Y{qCMh#CI!1>Xeby`U&ONp!V`TBxxB{qTZ z#6i(W3`&e<;!2DUmLBiw;QYyp#O|er6~9D=g3?mUhG?fP1>4$@XrSWNwjY{=KP^*1 zK`L2-OQ!~N6W+VLDa#UY7O@e}!d$mm`)(#Yh z*Dma;a;BM9W;A9fyEc9>0BxD7{j*Kw>9;`gl`KUuUMM2TaV5pN*7sa;w&fK^kp-k^ zbv!1jI<@*|oGd3L#hL_3mXcBm$2mN;Aj@m2$gpTQ%JFR^UB+lSg9GCk930JH*P%3a z42)26*g25J?jy7t%wuenl5FZrvP_6Fq$Mp86{RG=^w9ogA&)oz;4t3w!$YjR`UQ8! ziU{6yQ7``RmmBbf7jD5T9fY4@VKpNr1kN|8^eFPHYgGf+MxephubySbXT8DU z-ViZ+4n+1*u_oc-o(?W=5|>uL$jl{GG8N3;Ig%$0o_v;(lHN>u99*1Am#ykIK~fy# zyvPXk4GwE7eAauf9E>AOh!%N__Xu+9@~Rc9SwVp)ugatoJvV@B%gsW;I}ub2R%bLQ zFdi!(rCpiw9JyO-K70^CQ9sey8nq)zzFcH5`dmGS8m1^s%W4y zFXcQbP>DGUSq}Bqb%BH@OY0=sk&+Z6BtI>lw34v2kg&Az+J>=QD@NJv28_UjF`%Cb z7%X59NlOzy7D!PZ^dTBm?6U2^WxceF;ax+{wH?IHBHg>5xvI_wxK;6-0Kglq2|sx(sXa8!V4pjZ5Y z9}8SONZXC<2Y&G}P6U0wdFAwyQ|fwl<5bn0hDN}(>@Ej&;EdHL?BiT=uUTgkaL#Sa z(MYCvWZ;8y<3wrH)tO79Pk>91CK=3xd$bRMF_HF*&P_soEnoIjiCf8Zka;8B;o@~r zT5I8VQ_o&7H~gb~8nM!>$n&U+OM~u}K3)B3ZUnirFm)qQoi)l#4dh&~^5?*uFJN6; z4(FcMi|g(j!hlvb-Z547e!CWL>tVWQf+Hjh; zEojvb)$*yAM5jAEhRvN3Y+u)o>uw&w)%T2YETXNxpj#Y9FAm}jfBq=!**}W=_NS0+ zZL=deVYXX^o+UACW&MZC=?dp#$ofoO85v6DFsxd(Wr1na*9YQEBDHe;l?f!}Xlg_LmZc8Le)M_RKww;AHesZENIH~W-LZF2PM)x>jK&jqL4>@)5N-876QJG2& z`Q1qb7nZIGeEFDuNpaJSRXZ*%>WT%Ox zD=SO$aROHq_44P3^5*K$^5@u~Ji4|Ws=N%uyIiPXFJFnK$)!HouYVQtuh)VrP1#+u zyb0$+$gv!CT0s(KU`77Z;!d9a^hS|>`=~(jSET5g^(0rO8HrDl1aVRqnHoxhB*2WI zie$}}O9g!M_lI!qhj!rqUNMN>gHmMk1AX`ACwFJC{R8*oZ9m+Lkuk;p=cS1)OH)pIRmE)hAg z@2Mza4R11ZaDyV@(oipbjo|V%=TLgJ8l$xO(|dxz-yRIgBO95{Gum*Zwku>wMD&Zv zq9P(8^r-gAy37?bBrkGDGyBzUZ3tB$0-`7~+7b#!`CR#=e+c^eNsLiwGe|#*s9yw9 z$ofLA-VTZ~#wf`Ng=Dr6i<7vtG~H_nMXMK-bdXE;0cHesQjvpr2>XY#crQuAhWFls zhktwz{{G5A{C;l^Ssi$tC33|w_6`^D<2%Q3>E{lh`ycPa6F+9QcuNu>xTlHPrGFIF^kox)+6%iuxmZGr%w zH@^R;VWhGollrA%y-}n%gL(^avO!H=T}ULwRvD&PY4AfD*@y@|7paz|F{QWNAg18# z8!9x{eO)a|3u#+Nj^sve<;REyMFx6pRm3F1S$l+mYsEov$i1BSMebc+cKumrq^h50 zp9K_*6UE_3nqO2NUUUWnErfo9r2a16)u-ZWeq z%)i2^j=Igk>YAcB-Mt=kwJ*EYrgx5@bbDDocDRa~0Vb6(^J;I0sV#|$DDNdU-GY6* z&EEN-i4~8PlLDZL_ZD0<9;q(;>Bsx+UhSU-wql}Z1z`212Zu_bhsp(VRgb*zPgSNp zBr7-dM8XtKx1V0Q168lY`^B)*Q||r5C@wX9xo& zmp(c$J*x2L5H6{LTU96z)?Xn&7hKjNtp;RCva3zib@q{bza7iu{?Gj&f>Ox zY236sjhlUPTD?9dy(`_W zSz<*8AN8s)j2fY!#twBG=mz*v6NLU zTwva<2C{nIr-VE@X%aQgbG)Bi?ekFRHSr!h>IA6A>B>-Ul;LWo9YmgKNm88;m)$0% zL0*#nEjh&@r@YFjj2uN3D9}XaWrm=Sr#LgK>&lxuZFJDW@G8>=bsQZd(MqQhm1>fp z1XvhU$qGeFXL{R4B1Kj!GM5`iNK9c$0t5(9g{MI04$`;`PNw!i{kA%z+DpSc+ zP+2H$S2i<+OS_rFI`~@ooSR4t zD@MC6Y$*EKKUdVQs`NHbQEzzZ`zvZsy4TjA(Upp8uZIN)5a8qhJH7@@i9Pb_{~~ea zlaCeAm#a<$NXtoQ&KVS#MrZF<#iXkSN(U9M%GC{U+VY6-US~||!B0pOUcFTmM+oK< z3cpsAH5x06W2Q~j<;#tL?m8QybHaiJWIxKN!m2>U zqaPLY84>!P3G1F_I`b?_qN25Dde4!Flt|E>7gd#3Wb|%Ot`tVL6tx#b^cC7lf00Wz zw&IN5;t3ESz;OvjNOV$7XDYNQtb3VJc`WOQVf)HfJob!Uy!TlfvFBgTLF$9&;DS?n zP8^a_g{jV|!D5*nHIAf}WmFAb<;#oCW7vu(HMO3dI5J~yysKXp1BzE8f`6;Y5hbP3 zUv$o`#;>Zm-$9e`=h=y%pcHpAs7=?5;EPn@%-H`@fG-bo4mIqG4p0m_##%0F)5k0H zviJ4ac({@R{&5;ZWJXdd>vxm06)zNR1L>qdS^~hPBeWL zAi#+Xkr2HNRt}@1Erzq#cHv29_v3;sBp>>gHO-%PW)JRq%NG3n8_QCH~ z*4pmSz#ZmnFwRj{D+^lc&NIFoMc-4=PlqTCMixE4P6U}Lc@o_#+s@qtILlg*M_p$C zg{`7hkj-F1T9k2@;3ngBWo>0uBeOxZSug|koeozHb)dA%t-Yzk!8Kgw4Bj&rs_kC> z=W)=Rlc3ceYucoPt527mMyQsZA9@3)WTlv+o#r%ZuGs7Rdm@dSE8$HSF2navgNqqWovQ%HZqZ937`Jm zC_erB@k)3ev^2Z1iz>t34_s_04VuYG{pqTcs7oo>Vsecqb*cKIBd1TPrTeX44{AcD*vOx^*HbU3H+d zLD4)iVb1XxmtM-Ucnhp!dr*7x%5fIOIV}{XlBPIkjRpioMWOJgDnnP!b@QgJn<7h4 zA6e6@z?GzC3fi1e8MEE$BW*OdpY-vdl!Qn?!X$rDR%TQTgoLFKDX{s65HHb;60 zNUY0HCV+-A4-g>0aRX0Fm{L>M4xzmziVgj7Ja}^l-u{$LxZ(|4@SC@sijKC*zVHw4 z%;20gQ9NpE6stPINJK;EqSckJSd9mt-cF5^!YjVAA0Pb9#NXF?&;|~!IyR#Bt@ zofe$Qs6{xh`gQ{qrHKse+5o0yDOIiM%0L622+~xbTYL4FZc8M7Mjk2li^(J_MobvE z>d^8cJG!fio)x*?XwdT*h3?FKE#$7A5Dcc8Y(Es%oWmEd9R(x_K20UqRB){aBe zqEY(mxpz^UdzTg`+LD+m&!uV;KN?+a7(~6a91FZ)EnL^9=Nc}Kso>n0PO02Z1lzkv zGI8{;9IAdNM<5%OcE&5zl5213Z#1%|&1)?onH*9;Pyz%vzECLRj8$zoe`6;*IlFkV zgtJ$*LvbZ}IP zSvuTSp+ru2HG;&Ez`mf$dnx|B%=|*Pyx5P_g&3D)#)+4E#m~XTPcTbNkiA)Pj8O0j zR)d=jxP&%<;%*|Da}Jlh#fD461d<{{ zDgl}KQB7~1gwwAxRa3Tuu=cH!$!;6*Qa=KM5+K0wgj5l?zIhX_e)(Fw_lYZk@eqEy za~yyB<0GDfqj>!G1itpdbsST}xM$ZWF8bUa9IW}i;+e}MxbAfuv2|@bQsYUy%Mz{8lqM^ooJ||WUFwamUhQQ5_Fxyy_}2G=^G~^AGT_u!-2eaVi3{s zRIe@ywhA{o=qh(EZu+gAayrQAgn`9@e#$kg7`FA{(s7JXFbY~xOc>l{;Y84iQ-jgp zAI7}FpOzZfS(U|LCO%B6w|Ro%nJTNUh^lQ#25fY-#V7j)#cBS$`jnH3)5(sH+D(ms zpackToMB+RfUeds-ul=ceDvj;sSrZA{MY+&!N+%ESQAzsF51$H-@R@N)~;^D$l-B3 z;FCLW_0BAA++V=I{bGbfWIs0l+uhio;vk|!ZG{v*c=cXfb^9>(4Qr2?+NL_NE(JIZ zcnomf?WzK+DKvvDr5^R$I6gwr2rf(&mA*}sPtr_eKqG=16ayH_|$yL0C`&_x@Qu02$nb{$m1oC4t~ z6B{5vfTe{<2-oa9xD z2Dd6f;nm(+spD8-C<(Gwd^3T+_!N~ZKZ63Ej$IMX+WB`P@9y3eV>9Wi>qddp1It74 zyD~6m{A1s-X#h7s9}8U3s5&hFGEkeIMZ2B~wMDPAH!2FD>R#z7@^1(QTWP8o<=HRn z9UPZt_QPn5nefP-jO+gT0=+222~kf|j?EF2DFO%(Aix5G3hnyc6BXD$U($oWd{iIr z68P@TW4P=aNAT944C10s?!q}Ax)&FJdM7TwZOAwHu+!VmDo{J5F zf^#A?mG(;EN9ifgHXS0N53ztmP^^3umXVSYRY=@!tKs_FkY{eku8^&sOmgOSPO1UI zQ?*rt0H5A5MW^t4dIG= zQ`q(&ci{z}--QoeJ&2#(GKgFD=)8!hG_)e3ua~;tY7%6wCF|M9Vna!g*0Zw{8oBkr z{LWS{sYn!*NQ#28Jl2e;a$`luKlTZ3Id+D+_d(uF+qwrSb&5V~Z(%ri;hUmX#LA1# zowQMCCu@Z>(-jPtEC&VcMb#8sypm%@Z8{{=LJ2rZ4Q36+t@s)SB?k@ODw>PDA1_cb zsL0ifn`kF?$hDNETd#7p;^Ey^kY{UmKlnEd*tXUDTX{9r#D_>U(Xh!kS1mRDF+hL- ziwJ!{N?Q;jB>HM;LcN|nU0+w5Yte74OtsX#V2~!23S^pWkkPZYMP>;pM+Kq5%(B-& zQ_G#%yM<{<9fhc5Ss1Jb)sK-7nbpADDL~~#L`Eu@{^V7+WGejsp?xq~kv){A;i#=8ol z>5_T~VcF?E-whxaN@RhZbj2yai$BE)OwId>0Ro(e(Ek0AoxtUP$MK{U=-&)H^IzD* z#ykfLjBE+7d1Nm>_RKY&!Te(PND&+U;ciZOsCj0yrE;v$xryPuz||jM8kSegidrq= zh!XZz9*za3+xSO>qU;fd+I;%m2=;|h5)3&rJBkq!KG-)9vkUYaH$3b)Z{ z=HTLXWm-*({^&s>a!Ut#(<)pP7ZVh&rS*sJWXqSOZ=MM^A`SG_^2ieIy%8V9^Se8xUVH?}9bz>L)=Zn8WD%Zzu zK+k%WK6eC<+17_AUvwINdEX%Rj%QF#bR(OOF$e~t@A|km$MX8oK$S25v+V3ew`j>$ zQxfXaF3Vn;RK(N6a~vSR$qDru^(1L1$>Mg1w3NaEVJOY1j-7s6Oh}t)Q0G;9-_q*( zgnU(-9V-~7eF~owFnzbg>R9#dhv&wG1BsTr6+a&IU1p9P z9Lqpg3xz9a6~R^#oIwL9ElOvt$nR{5xOP;rf!CF(?rWf}105!wGM)6Vv?%O4K}>)@ z80WTnm8HZB&qhh!Gu%+5h=S@?qot)s^{IBoYi*oL$5hFk6&R=vQCqyTDfn4H`I0oM z>mtj?`WzjVRX%d2U*4%08K@tk@hEFo>nL8q=w~+UgM@OxGAz+t?n!E7WOD#H(UkZeL-=kkSX(nCr z;?I}LL1KPo>4mHMDtYx0E+Vh6w{e0Xu_v;WSHMCoYEv&r}@ut3o?ge#+ZFmskUuN7yWL#26ARZNqSN&uc;*0HUs z`B7#w@xu2ZASeL>1X$XT-V$G^)n79luO>i>QsJ2f)Qy(%-NDr%j(N3aritq00qY>5*NoXa+*@g?mYVWWbE~2BHBiZVrE3T9YYRAp zVktanH#s0E0RjX#zMw%!N^-UYMM_ZmQExzL0I!}@l%Xs&U`qT0DIqKI3?2B>0YPm^ z$gGN5tt}C8p(oq=@f=U^GoN63jGQQc3l`~QOe!Nc!ik)yjCJosj{Vy~GHVj@I@4_0 zK$&B;hHQYXZmwu#oI%tlE?gmm`7dh4lJl2~%3FpkyeV6m4v*{Hm{u#JDrGMaug*fD zFpBn-A2Ee5?tEapSed4$>(1d$AF2ico3 zgy~voS>K4J@mEGRzA_vegJnQywM8SLoa#E?n6#8W3n)J`ftOXgDxVX^9cL-Hw0Y%b z(7hAE@7{l32daX}W84&Q;gzZ}1_NRv94(!qwW*rAptY+pvvUv5nTVjRoY;dI*~M`c z&r7C|L6+hW)JK2-0hTzZy>x)CNX4aB7TrKJqrs>Sq-Pbb9pdx?lR|Z0$rP!m)y3vV zH-1CGOO&U3E7qRpYC3rz;w(~j&fUC%5zPfb5o*h!5#&Zi;dkrG%sz;x!f)KZ+AF?jD2iOU%qsTkO4hEdb(OeRjs5V|p)F>GqxSl;OGdczdlp_S z0RjXFu+$)>r$e4L*tQ-W*JcY((Hara@8%dm(Ta%9p%B%u^=658E67|)aN4s9SvY0S zdp+uRd_r0};Z@4n!clm+W@W-&6Ni-Kwtcu72-)-K)+%d#}Cr z+QV6UoqhH>S4V6q`QtH=hdV4=0_YLc4{O%H1m=)H)EDr0i+535YMb_)NYfB)#Ovcd zk>W$Qery{>R&QL>VuL1ql~0^tv&#-3_iV{t69X2!f~}=XBySuwmD()-v|LvzC*AC) zk=H-*)FivDn-Lryt}3F`AsQ_HDw-UY;;y1Xg$fnUH)NmK_ra#t%>ZIBidaAHj0?GV zBitP(itj!2L|D}Tcl!v#ZpyU!uOXv1X_DVp&e?>@ZOL0GO(q4(?a+s9U5I9hW1u)! zfF{xulgGN;o)H)X83lr zAf80IXIEYLfSGifUVm!KDoB3FP-pW>5Yp)wkvl0cSEx{-!g&O?X;?E9Mr<>IW8%xz zJWjwea%5t}@D`i>g3c5MVbmnPi{QdLQMYQ zr1X?LlQ-7mR8NK4pHlhi(GV-qT zkj6a+T}P~Z@TJ+FRlu|9JpUO0boQ9lS~w_O@RB+~z;mR2-gkuxPdacdRM*230)?4l zHsu6|V^-ZO^UCk;w{cXU5`5yqE;6wxh&ATDOY(6yi9dj^Qh@PthO;X+7~%#p7I+9p zd`^CoDWY6{)fy$2`JI~_G}$?C^V>=^s+6Go6!ha} zU`3rW!L;4^M5wZ+8a=1~4WeAwIvX0t5vN1h__;t35`74wYEduv2GG55_z}RX&1HDJ zqz*~g5Cb`itWe>}46XyNNT|ZO1#REMSttWGY+!8m>t(u#%O_&Dh{*O?zhh9t0a&fC z`DQ~rochxzK_gII|m5AnrJ z5f#jkt4CdeH5IjPtW_s3KywRkWbwm~tkyT=)%nIs9K{U&yGQhAPT5$XEKZ@-%B9HQ z$qA_3I==?qRap{MRzXUmZC1{hn*)kQ$3lK6OG0|8;d;bMU9RhTKq1sMCoTr$rIkJx zt@8PeB01ia7DED+SPXGTeMyYVyp=X&V>(6KVs9)N+-c^7KV+2dI5hn900?N&ofTt$;Q3pi9E$v6rrg?dw2{ zezzQbNG9wXh946fj~F0~cR!^37;3Ub*}0jdpZpP0AWsy?6KbpmU!9R0pR9F`2=a1A zIxMOapN5$iBCXA8Pw?>wT*Gi=OR#%up!Mn))% z!ubN_uQXL%fQ31R(ulqLo62)Wwn$KM}>{I{zyr2Ox_HHcqGNK!NkF% zD)F;V2K(*tOna-{*nsR| zwPTa^gn=w(R2Wx zM|l@?Z1F^y=L#dZ^3@-9mi6{*~4GoJ#YW@9goPU$RH#`we^6pVnRqpYFNao zFOR5uflqD^F%gRD%!HZ@Y9e2H)~VaKGQuinGP~M?Forgt7(npo$gQPYaQyhqmVvf*vbSr!iwl<%L0sHBFi!Z5s#C_5ke=+BoI3Kh;fhIBz6 zx!3H?uhw;>yO%vzo4xGkbv2$$4CflUT)ED5NAmQG$86_>?lD#vtuq4#rO|BLhaX+A zg?S0z>~D{(2TWck9yNQ{Z_1W&=aqwsGr?yj%qL~RCk*Tt20I`=ET%^(jY$zUvWE!l zcUN^ep$r5Q#-JvdFQ=ks>+wb`yNQNpnq}2fzoF;{k0{I23}~xdR}wveM^`MnkO9neh9nAbvp2_B0mk1vgCF_UQ?G-Rs_K&9UtrCLHg@llC?L zDUWA+r9L2DhH*)lLtIIJ^Wd-Kl(Sip5>tIz0T|vzot3sL}EA}z%b~*UH@v=>zRT{ zo;$|#2^^H;51YN?7d7|GparOROi+c2S!3XcFd4@j>`6?782XeUj3cKp5tZS$fbhk{ zBXEir=SLB?(?#+}Jn4?o<&UVmSlxi1J5mQ7$Z|bMX~-cOpiju>2nY`fcfO?au*xs$ zNgYC1KPVmj1JN$DGvW2@Y1ZPv{y8|SC@4q5}Kp&tG z1YaQdQ=E^-6t|YR9KNk%NcSf-+qHbkzDQ2oScnb`E7Kpc6Lkbj4Mu@B{{99b*yC`gzg+ypMk=;7iTAzu#Je*erP~jx>KeMR_4)pl`gn z;@_o8ge$V+stlLH|mnn+U_ z8uJb6$BGG$?R;Di20FInoREf`LKcNkUP5t7fWGfhubw3S785s4C7uys9SO6_dd20R*=1}jN_VyBwu+QQuUP98uqPE{%bjimil}c zc+s1zt#%wzmyi4B>zBpQkf3G7%O!N`R6~0Cz8>kxW@+CDox;mYVo8EKpd)&a53Vd+ zp~901Og0ToY)edl+*MT9z&Qnz;_PwJiEf%p#~F?%Wf?X3EvkPOuMQutvTU#66W;!1ov!Nli?U=p}a%joP?cVnW1m z$d-qd#^Yo9nVYR}h*)J~Ps;GHB#vFwsU@A0>eCmz{&dkTX8-b!bkXTzs!-vH4!$q( z*d1oC{f5pXh66X6ecS7+@qezsBeussYxaM>(`;f#iUcxd+=6ij-P2B&44I!|ZD9^W zr*Qnbu-|DWc#@1Ht4N;ae@=rk3&1Sif`>fFRnYmc;EE$XY^(zw^iO+X27&Xdtb#q& z!J)8!88@9eD3^9h2zHL%Zk)iAK>Uaj{2k8>lnWb^Wt2B8xy0uMa+--d4f3d-OkTb> zNXW7kIwjEs;HP~Y<-`FH`jFLEL#0BNGg&%r&wcupwrBgIz3qbsHRQJ2yzb(e zm{03~5RsqL-vX<89#$LQHn^r0a-RFsOX;Q)e7BoY5S) ze8vRz3i)y%Cgiy6)y>&+uis(YM)uij-~2A|PfMP7aBfZD#fy2SUYpn{FdL4lLO2a{h^eNZ_l z6`pLsK{+S~<+r|3SJPC-LHX9oK{;oj{oO(NH>VwxFlZ$^+X0anw2~nsiiyL&?;x2S z>(_}R3x*qboQS(qj4S7|!G81!8A^G=sFUWCw*vk)LW+YmluX$?fxATR!U_9ZEs19> zATyj0f9$~I7=p3r$Ra*Rl1((MUao+SppFBjBk3NefIC!z*H4MO{>w4nJHp-|W*t5Z zx0Zv2YuV%8L&p*cs|PIwOxfhd&nY#7?+RR z3!nE?+rP`~Q+FS+Me*aCE^18p+uNsOq?FscF~m8nLHeK50u!llHrB{2Tf2JFU&DPyEpEi5dHruXwIqdgZkJ{ryMn z)F3N#5`v#}COr^*K3S&| z4>GfnAqNS{$JbVa-`{dkFj$EuYdCzUQ-&|&Cuawq05WI-=J>p5m%|^Ce-58;u3r)o zr>Sa=T#kc$;-`K%WjK2J&z#+C&D)iiPTTdD?6>Lt`^2K_ys@n0rp+xa*rMt(yV$l9 zn*L5TTXw3kXlRi_Eqrvby5 zj-AIUh13pG9Z6aA{GECcVy&#htur2%fV@pWe9SMP^dXhcE7q;yrcIBG+vIrLeZq;c zA)6j*`TJ(K9jMuUF@5T;1$*6F-lhugRv8QOb!Ke5K5k$0WnXB|c*=G=#n)x!a4gE1 zZ>Ybx9ccS^dgP4gUu$_;j*GI1ZE2|{R|!`|@bMz2g};ixF(je;5f61;4V8mZ;mL+r zLHXU}ps<2cIVk52`3lO2929`j<>nC#V**z(URXD*_j=(g6{fs@i)=!hF_6bd;k-vd4d7K)}N{fsFc6DV&) z{3PS3(DZ>q{ZgL%)WyOma)*y|!R3k3(+362I6J8T+JLZcfL6ajg-#{-#13@SB4Wu~$R$9jvSp*)|O^9o?f*8pU(YO44S5veqpwYX|bKHHVi$TZ~Eu zVv@tufx_(>bxYgEhR5y7i?6ipBQ1OQ(Zlx0<8vxU1+gcJ@v_*kF*!98W8!Vkd&{+I zlNyq>&bI+Iu4+q*?&z_i;@gXqjSaKIy3Q!I!B`?tLT3d9ypj3FW zAsm$7&K#8L5zo0pI4FPcU1pQ{9+UwQ_N#~S>xsg^E2F4zvU>Ht6F<;Lt4O!Q< z9|+?^er&jHvuPL|sfe6NoEhFQDJDte<(2G(K6>{;-ZnIQQqkiG_ZWViNgEv!Jb%A3 zrDvfkeXJA4H*$IX#vK&aFm&`Wqqbq}FS*O1VidQav~jfqD|T!WmrbmYgP zw8aJ4=%y3YLv{=+K)p!w&D^AE>_uH6MFD3kltvGPK!oEw!d`HN3QsaH?iv4pYo)pl z&M|0kCWd&+AgIr6R}PXf?qS!~q5@=;eBWb$@nrz?C@Z2+(G9Vmod)Sx*&-_eR!o?X zQH%_n_mEu%EI~Oqr|hnB5{h%miaNkZnXCxqt3nF^9&xqs`aqH_uoMia-EJVE8 z!G=**ok;6BZ$~}>M+irt&|@u-u|!OItZ1-V6IFAfiV*N>WF5mQ3lp&C)w!IJw$5Ah ziSO!^KKz!EPyQmYd7a}GcYkw8M;t6qOzF`sT}0df1T#lgBp|}*$IS9OvuxYsNWJ|M+0*Ip8W(coKkd z&&8ImvkK=LOa#3M=YiK@!+Y!l`fN4IfzJaW5{jaHf~Tx-lzJf4aDE|t0`5-POW|Q6 zxie39=dJ)Uk)2-cEd#bPfzX{tFO*S~lZXi>CQ*MJ1gR`Oz|}?b;z>uEG}<7DI0v$V zxENH2kiqZ&EU8_h-9k` zTwcdzMZ|x{W}9eAS#XM!=C2u(SAy9<%f?q$O@2U{njO~&VCqV zF&QhK$+T!+@!&YEmk>m|&_2BgeOJU&FCBBBYoSYtD8nCV$tk1`9_ENcp}q@8XjBxx zzs06tqGiKVPk5e5gj|f8zdb8{D3?V!`vS;G9Kvz zMHXo|fSqv4ouIOO>4uLNb*EIQP@%$k0>(%N&sQCCB91$7pS=bERA{-8%&+J~umr_9>4`50wc`uF{zi|8-^D==Z|N)@Roc7_*X6+S9Us2UL;YK0@+(@(mfGv& zBT71Iiwh^LvB{^u0+aLq@$lsqD>qm_UY3c zu<uM&o3|AoTj~ng}N;?*z`H1xwd9= zjRk8YhoIeR*-~SvGw(u+FMTea?neuj#3AyZVxCHrj65?VotW?mr|a#eZ2*j^EsZL@wG@ zmru*TSduSX_tFv>G%r0d6c;I6d<-8Jx}4cpf#meCDilCR;q+TP0Hw)L zu2*mu4$2=_4oZb52i!rq%k1~RRo5dQYP;U-8(ypHNp}bp&OW$HJbaJYAHQ1d-@`%4 zY+7&R3<~>)*-o20ha2lP1$E{R^7=%_U2g(eOCr0#YQhR|w=a9@$5k>To8rPQ`%#fy zSztn+9&(Cmx$>uNJ2PaFCJ>*W17;E5CsIzxu}YfDB)yMrD^QZ{!#^Jeg_MoNYnQ%KY+>%`Pt4?2^BO(s5i` zy1QpThpSB6=6WhqQ@Q!s1IqC|C7qNmJtc?Xw506J_r7@5!=WLXkwOVxRnV)yKp~z0 z?M@pijEcY?uG74bUUQX$a*-UAulZ$Jt`mu& z!dV3l%F+AH-uh#j%coOh0(J?*n;Ysd#6U*SjkK>I$lAi^;Sw}y4a;%y8`+T6i%oo3_>LMc41QJ0DoEx4iGu>MFGlds!A|ZD@YR{_WR(j!kYG zw|C$1xV4(gHZRdb8dMEkR}FbSeE1GfqK^OuTvP2Y`^pAoSBdhYevnYJZ8#{M|DEi3 zT`4tC?8KGJv*$*$Z+l(kpj3Er0ONE-ckpl09sH<_)She1Uj7SmP);U>3TG8ePW+nj z+tucL$#*Sa!Z3c!7Z^Q2od03(M{e7a-P7%By)6eN^5I=zC`&*B#bFNGB999X41CT!{w4HD{lr$oL;45WB(pHA>}zCe#M;VD*HbQ9fF z`_O1BP|Az5(Bwnv$Lw>Sez`3+j@ccbeN5wFuVy;-KhP@bH=Gg|hm*ou26{6{P&B7r zpv*K7UC(lz6MCt8HsE6feN-T;DV(!$+QX!0if90GRv%ij%NAzr#ZNt8cOPuqU%l@$ z;@8a@D?`nO9F(K>9WQ^XO-)VM+wOea<|VVCu~r|htCdFF@j2Zc6cQL#OSWB1Ct81M zqv{q#_?tw0#?4c7Lga`pVE-jkHDXS_xhM%>xzdGIsPH5KcZ#FBHikqzBB(Baa}U1* zWfI7Ue(}wJ8S(gq-wE*#YbB~dI5(0Ja&SCZ5gQ?X!kQyBYYk7xE>2oYcF>O{YKr`g z56F}cTgloy{(`^8IV_&35}!!pra3$=`IIrFdp(hKF9D)k7j$D zwOS(S*^)d@M~;(Z)`?FtyNI|%lsU?)v?ARZ`w`NuD|fR^_8hQ^olh!S_2%sz>d)Bm*Q%KeX%Czt!ld^A;+gm*uj5=& zrVhR6Tp;w}hyED5cn$Ow^FD7UdAyi{blx78gE2I2OXEt@wbiB_SxurkY%*D1^k(rE zpdPHM3{R`c>edin+x-WPMJJ72U5}?}R6N5rul}1C@4V9IXixfv>saG)sI#M)!AZwZ zg9;TYbb-qPgUJzlRN>qL!-oZ2LFy1DMgJNq23FM1j`<`=Kpn^%3;r84#OZDlXQh~Y z*FcE&2^A~Nghf7%OjwD51LQ_KBBGp_>^YK;aGVF}oV!`_=4v6LOU)>RgpAniijEQG zItYYUu&ZH)HNb;sy&xZQynQzS^l@iFLRhV6Qg=~9ZNowZ*B&?hPGU|A5)Sglwb>An z#(6)$2ZcPqkK--ZI*%EY*z^kVC`bL^Hzev;%8h)3BG-*Dc?q8{gbuVR#}%aZ<~uko z^@AUEE`3|A<&IyY{vD%P*ev23Th(sDm=Y$%z~$s$wO63#ZP>P<DG9 z8bLm2Xp=$bw@NfR_G#c_Plw1)|(?dBk-duB{FD;IB|22Uil8 zNavdCk6z=a-?;3D_44N+Ur;ZEer3wbf@jd{_#gz6C2#hHL2Ll*6cDg~&AK=lfpiNh1=19*|O7U1*lKyc?#2I#Z~PGel` zB6h{{nk=uUfS3`h*@`MElDhXyPQ|lqr(yYpBs#)KLGl{H8zxun{zm zg7rEpPMu2P=hkFT+OaoD&I#L%`DG*6yHOXf(k0tTF$@77GkREm&UAQng9@rXH(xYn z*X^c5uqQNrrpD`bV27?Q{}`8$#^EJ9N4v*mKPY{;UbE{p21mGES&Ki1%G|$w#BMw= z=EoIdSo&SOW5lmZu9ItYZC<^1RQh5_1j-W6_~?*bMEN4cx_V6 zKWvl!{TszQ4=XG+TN)bi%L{OmSG(Jp<&iasUK5CfH}A$Mo+I+QNQ`_`%QHor zkPz)z%;;hf?{aFVqHdy%B2~Y0XRc!q&Zj#fSgyM#4x&()PQBt>A;;s2*#)DTlI&i@vF|l02xhKL; zK<(h;elr~uIR&r!yj|96F4>p=!aerYzkZ+X|Eas|p2IU5$0~3}7ac~E$)DpXNO7Fw zX304EIkccKPR6Ww(w&{>!P6p+yd1N;yhbv_|LnS5HZ-nE%fNp9Q+L_%g_fN_9tN0~ zumQ3OlP7eM6ZNMbI%41W>-VT-)hy&em(aOFg*7n47!$tp3+3bzUTWI+Ja>=ZwEOtP zQTK5#@^PgEj*R1U4Ltnlf_?3;e%9`LT$2UyeocsHKJmqPWqih+w&HI%u+8pxykTGe zL$@o7${w%VkI6B=a<49W${wrRfBEZ2?VtVjgZB3iE!fxm!9(_)zx9Cq&WBFecRYJf zN8iaYd&O&u#9r>n6UEMfnav(*32gX415pJUfdD-WhqQje}}5h%KoJ zhTUn+K|hF*iPYcv>BRO2deV-eV>!IqSR$=Qn|D#F_eMa~qIw*uOS!tYCGc zp}L6ApRg~y(@fH*IqZ*qc%|57$$?w)Uwf|UK48>pa!^heL0jSkv!aAR>cjX}`=ATW z@uSBU?A2d% zvEBZ|x7vL_aie|i)!Xd--+!Z>_}N=*`4^sQUwFedH_ZS2WtUmwmu|E9pTEt%|BElS zZ+`A>`@p}yS&oD>m%*J=e0_Ax{`PyXwL?F1v;F0(ZtzDk;iRw{b!@(E`=(oV^`2oH zn;x~Vx^=gG`mv@hXkz%f7wofle9yIJ$CosL?6tpo)wMP`F=QXp9q-)FKgE9IYp=4e zf8HK@`}gbaQxm|CzxXm+lzxYP`WAbs9G%KZsh|r%)LFdjg~^ec{pY_uW#9ez+x?p0 zPW{CyL;ZAajC+Mw!QeKNjr$+ zeo_X4yVZ7a z6Ae~ZFwG@dXD~MvShG4&2<1lwN{Hw_$s0y4D~cZko1sI`wncE}k(^064jo_Nme>XKc_kGIvQ9wQh?C^DpIK7`|<*pO-h2SnJ zQJl(wAzS*{2g=K!l=y|iE>h)vgHXA^)8HAq|0=Usa2#0fe)xy3x9@quUca-Pl5xE1 zyFP9&y?MKR_VFd#@vlE-&-tJC+h2U^m3H-|6ZYjdOxws0+-{RU_8I%m=k1hHKVetx z9=3}wp0fY>wU^s}d(UzEZ(q7cH;#4tjz4|WE}b^}vYRv!q{m0Y80jNR_SV}^*~?VM zQ!kmYdr!>S#}6*}if++ZY9B&PIW||xk*cc+CcpQS_8tH8PB+?1npkeQX3D-scameT zx!v~v;HT`(AD7b=Uz(}#Bn6`;jiElkA;10cMLRxQx6iw2m%a8IFSFOY?S#gD%}y?~ z>`mWrx&6>z9rCgN%kMj3Kl%kY^e62%zUFct=Qkf1vG4nfN9E`Y*%3J-fB$c;vOoC5 zG5d};KW5+Z%xU}OZ@AJfnI5)@@4v(T&1>)0T&BUyq&B~7|3hj2^_@rTOMdrZ`@^rj zQqIPd9XYjRcOBMs+i&RV!no(YllH*}7wmIgIHh^9{}kdRD#M5nBx?&A?*C zD?>!*#28}Hq8~hu>KkKF=j@Z6s*iP6NjkCVX{-LkY7+^bhmKoTF|3-%QSrqM7y{_X zBf3>QZC0rem3){evjZ+*p3VBN9p;plVfsNyhi9dX?&!GDIeu)(zU?>fwcr2PNnhX? z(H+}c@06D(<9cAaWz&evrSvH^ z7~hDg@FWIT8COiYdtU`R`H>{oI}Q=ihX>z422gZQ%qC$|~b` zd`S8px1asuz4naDM(uCzKH7CnZ8_u?i*~{$t_!R8-=>11Aexim1Lf#90r#@CXF6Gj zE?XVwNFOtYmD}qqflsx2(_AQRRDf}!`PnH`Jc6`ij5~;P(&D@qa(=!fTU)ka9jD|2 z@EFH!ljoH&ODnjXdXfCm_2@p3c$ekfIR8NAgbSHfARYlJgFoi$zTEo*W`0|sUrCBy zlymWOGN5<9`Z}B5Ic&SHoUki*j@Z%prj2WY-_A2_8NLrZuw-xlmg{Ux&dQIzXqP=Y zvt$QPwe0_U+8+CYXY8~ux@F3qb7|f4{l?!Pw4eUs-FDCMIa@w7Yah7pl)d7%UH0d9 z%-DPGo45OqEfh7t0bz1DsXM}t%kg>s)ph%wzk1XSK1=Tp9c$XNE}O8S{bTmLE5;Qs zedIm;jU1kr{{92@-Ou0QTU@5Z`^br=>+_;#?zGEykH~=%Z_FAMo`hhKVFdij?2A#2 zbDWXCyMNaH>9te#e?B>*>t@+kM8=f%$wwFM>z}^UCU*_ne|z!e_O5%6+597?wtrgs zXxu;e@Qgiha>>5y6<6E#y`%OsUwV=2^OXJLwtKJi#_LYtI+>6zg%6_g-u}UZ_RK3r zZ1?22-F;Y2`DzZ$`2gyKadi+7r9;Oo6^Y#lo`JD0=H3XMRxz2yKHNco40y@29*`#p zFnpOk&}*xs=+jXCECKPuYu|WmP0&asn?yB;rl0$bJ>ns*so=@0&k~8xt1TN>cuL`# ze>g3%OLiOQB*}5sgwxYxt@G)a$TJY+g~QCs3r}s_`5E8!W1YlRKqlIO^`32e&7S^M zx>(rgl7Ppr^xN;5vkx6wwqO3r1NM@er|r~2+kWH^9<-giNA0nhW&7AcrQdbRh9-yX z$G&KtlBJBMY`Du~RajKls-Nc^S$6?tw+S zao>pjyXWt+ue@=GoRm2`!5$SE)Vhehv44B-tbOFjvJCd3edwVDo1PxA2XzyJgzG?M;u`sl}G>S9$wKj@v)#PWK1DaF2b-_1o;8 zqmp+-p50b6+!f9~SXG=qVRq*`HO4i-CU%8N{n0?fV1maeUf>=_qN*lYg!h<)avId?Fy5O29-$^OF& zrtPb5+ir*FmhCw|f4BY1&);b;ylUG1?BmB}gga)0N3oM~qF8yT(pU?QG3?4JH5F3k2h?YFCFW;>hu;5dJi3Y3DJcU{oT5`NeJVWpfPv)4>i+D{x`9_HUfDDXE;LdA! zQs=1-&Z|HEYr;%AS>1@jals?(dUQt{vdj!fW92LZY?SBg*g42oDgy*R#(!NPV-KB? zMR$6gR{^|ag&0Dd2YTug8A|mX6p=j}YG(v@J|(bN-M~S~D_trGmJPMDGBu9cEjL|m zGn&&LJG@{^L;Pws&M*Smung2LeAb_0spm$3j_8+HW3zy45cS8eLf1k1qsS}8eBnW3 zS#_Myb+%9PcIi5~ZTFDfvVY9(n;W*@f5+`IOOw`W=ptyGuw7H*_MQLqa>cdm-S^Mh zjNeGK)ng-4gAcV00#@&%-qoN8rXY%mh-O1|! zALrd)VK@y0cVN%Zhn9?yrY{kUwfUP4|2{3wjX>Up= zxK5BEC?7zbxJ~Zq3Kc3;*koX!Tg+y_=kJmwVZT1C;T-Xp7MUKw0U*(`ws8C_+ z0|SW7DhwgUE%u}k7H!0u@rcMb5woW#jO8kzeAuz490x@_W+6Wms~cTT*Cr#%x?qu4 zfX>A!fdr&rvGibvn zMDtULd@yH~qWzCQZ1%VRLvzzqicDb7$ufHcCOcNN3=F8pud=TqipEYlB7);8c}Xso z)Hw-0?)FQMdq@Vou2&3r57j$~Jsukojjm-`gMhp%>Y8JXwptCV)@1|e(v=gwpRo#Z z{s_l$Rfu8vsNHg7+Jo|V+JnLubA3~+#uswDT~xV^*3o4M8|}L?LSBHexEAs})PcGb zkYnCnw#nL%O%9KF(so^6JBJo+hlb%TdnfIxiMBn|s@reA^8uT03|Wh}SQZ<0>Gqa= z^9!%A`DV-Bb02$9q)ctnmUaEHO{Ip<&t9;86^|sfjsF}Jr|2i2X?+d~zihbuVzcM| zE7d1951mI~fM^WfF2Y#FIur4}`}+w9zc~1#x|Z+0Hge&t2aJ@iGKg5Eor4!PXf+h| z67g|B>PL5`E?rZGe>7;FeIBw`19u8DN6bFE5)!^#JD)IAi! z4sZ+TpTFGm*%i z$sxl*nHnCq30*teYc1PRTeLlLP;TBcX%|hl?Ez){{lC56jx3E>dr?9b=k1amE&G-) zl!LO|vUfc&YjfDip)p%-4p~Di{FdkG&)0|ID3Fv1-IT;M?xSAkKBceAK>;`^OIyG> z0ccKR0KRk^jgMg(;cjbvRon8QI-~qiPd0VI_>YgJIugV#p6x1!58!I>r$;+;8u|dv z{UZ0Xl_1@Jr4%Ee$)v&RgqR~g*H5X40!3K_xXa=K=*OG^7UcKSDF;r<2zRpr&agWt zfU<}$l~=C2U!Z>0xh_|zhn!v$;Q&A$+1Cw}P{x|{r|ky;Z1m%x?Y0*DcW|VGJ1BIr z>hraDen`{%6zc7 zlmF|0hraSQ=X##8r`&pp9X)*9j+~T(Qcn&_+BE9?I4Eqy=H98uJ0Qrv;p?;qkk@z2 z^g)q_hCq>A84?>Z15LiAYTM+{kL#KoQ~mdiv~0KP`_z4twri|ykIE_kpYMFoj?GP4 zdr6gAIBr+$YTGxx@CrNCY}w!5KWmMlQ8^bi|KY`kM0b4P+=z3eL9z;@Bo53daFe_N z2Spvaywx@-QPI2_3ge()WS(dUJIgrZf^h??deQ`EVhjcW%^77dg4|$)4ke&Z7!>lY z=AeL_KgYm%VZ=dMjj@E%HPROt@nP=51%I_QzZ>XN_h_fkA4EKH1vo)YAA`FV^0L+q zmFp9~%8hY#&OlvxyM_utY<`q&k#Y0S(dXcHs-?K7=W62tvC$^}GZ^$;)<=;J@^FAS zfWzyPcaQ#c9{s`b^lx?O2m!`ac^t=ZK__?W0msZn^=yCA5S*Oj0MSv$je>GF+d(M< zJvU=qb=8*>Km_6FqdY!=sC>+T744>kAu} zi_WCKazwq>tAqCigR#dTZFgP@o*tRdsBGAz9F*bOlIg)$TspFGIvmPUATiH(fQ8>owLtcD{?}e zcijurQCoZ`HSc2Q4hq5bbm&$Eb%4Uf^ih}U$>~|NH;#~xarQA@(jiCaLz3&e3i|23 zuDs~M$$%K7tuWwAd?@Tg;+Itz(;e*7k%Um3i_c(^RJCkx#fxV ztOA8``l7#RPsOp~5i2Wz+pngamq$J$cDJydNg}e9f!L^4*+I$E0CFM@L>QuYe{K$Q zDi;I~>5NOx-BA${AGSYa#>5EV3CmlYNDx7ai9B5(5rIX^iGy;39F&t~2Zb>yqJMpLSMrh3x3BtOh5l!Vyk3K%(1FSj$opN1 z?Ijx-s@rsZSq{pWO~}ER9-6o5;bFUMqG8wVp0b@Ia!`hc?6=?hkUcsl2W3uja8UNj zLHPnXD6F91plI&xc2Kxb;*mH&8Tx7E*dvA5813udBzy5w%>LDzw$LWoei*!370v+O z%unF9=5fQ}yUpJ8Y8l%Jv%S}vz5M5Oz3~`oGwXc@vM$)>&lS(DZ5HpFWFInn*DuRz zvErb(nDp~30n&-bfaeZM#OISbap7D93d5iBmiM=W9FoY(1dRP%O{V~P!}1pLGuPka&6nHBqjFH<5s$B! zDr0-D)6c#qMQwE<51tsYX4yeml7sS4=@E~lcN`QJG@@{ni3@?W(+$(MCAD%*shvJuzk{;Ymt-qc zcp`xb^5}hLfA+&22W9tFW-s~atO#6Uy^XzYOgd$GobzZ2Cp8e+;UmmEmWzyd&?{WX=LF{<=>}ZqPH-iHKdlgOx+;Gk zcv<`r@s-xC>Y$J}+A6}{4S52Mzl#2_k|&n~iar1}8)_W2+itzw4zYp~Uy@}7o{hOU zC_X-(01isOzG%;DD9JIAQ^ub1DLE6Ypllca{;{_0);N3m{z?B`o`*(;?2kWq*zP|% zWQ};lv$vHTly=8Ksl^J)xEz$WB$roEKytJ_?X+U3IV5LkjJ4~j z+zyI~?=bjVN&z>2BCI>{I?9k1vxomK5AkuXFrU#ZgDC7PtV~$kVF!T_3Ci)k5brBzH{vs9VZ#ni;XbYjIibT=@tLRT%%gLOV<9Jm>PH;_=Z&y;eFPKMRIFlI@8A0a~ zz1pG--xNILS4OAm`l~#xmIk?;dVWR2S3?xtY-m77TX6KfkRIr~P%ECc7@MAh3xo>C zwZ#$si0^hz*h*L*l5@g|a3;-Np+bcU=N=d@sGrd#4g2TD5Xym(WO7TyhuT~acgPq^ zh%}DG!QTUv5%xAGK-pftkjJlue)Z`>#)N$j=Vwr0@o~C*LK>*R^8-|)jaN+OBoN7_ zY8X~Q%$uu19fgA;-mY#c=c7o7K3{LMMP0&KT~ViVfIh?cbbEFNEL&*v>NQ(!e`yV$ z#QoY<&1M#7RSlg`C)&70%Vn-a2*COGE+QhXIe3YTYb}GKxu+P(bj_qzs8FH87DpKR zUT|Y5gzXDM*#($_QAeMZFwnC)mht#q@@ec7aoi9i-7ltS5pjQwP86m!^T%(PXpfG4M{%k7upn*P&p_SDpc6|z;X zJ5EZp%@YODr_53t?23UA&3hrVA-dAv{T%gPD8^K;N)9QeEq9!FHnVoTdv6k5GhN)2 znU%ZhCzNXK&L@pxj5_GdK0n?mzS?rrcdK~eLgk=Ts8Hd;0Jat5n2eVL!xzSncu&hC zOTb#X#SF-T`p?6Il9$phEkU1cpcZv3CX+Ivf)Hjr%@myWsqO^}>O;M7OwP7*a-o5? zSx>vrj>VY5vnda-T4%3`RJgE!wF|;X$0HrLW?_^{xc2}6a9Bx1K~xGmhPD9FSW8bXKe|bL zx_c`C-#MB1b8|l^B2P)Vbv^3YNV(?$t|s*i8UU~j(su)iTSvL)64Y-)UDzX|x0Nmq z-qLlax8wQn1`coPkL zC@duQE^Jz1HSt#PMiSuhGzI*%+AJ+lyxEeiqIBJ%MnMUjo-q&-YxO0HIz^FL(We1# zQlzN6u$pdO4gKLKOW6HbE_cfTh3SZ#2AH<;G13c&C0*2REl6r&jy$CMhdwnX7#EC> zNZTk7x0YUK6NR^-aCtnrPHNkBrzIAoY>l_tc!r~hI(jSEFo@Wmdoe@G1ca0hGqiX!5YxoOcyUPzzCtp;fOS>8G1Wc+moJO2WegHoYFg$oy_E#ewDZS=as03kh0VV7*u zGv@^n*wixug36Qy)9DIz3k1VD;Bu4j<#Y@=l*2EHv$_IpDJNxyM28~KY| zTNX*-&>eqrJz({))@Oq%&WRj^X1ifc_5HjGX*K1vXsj$S98$6FtoTw1sCB-1q7YIe zwhZ18qQvp^kwLcI!h4#={n*m=H6}^p?!a`=OVbJ!Dpc4yzM+H=@uxbb7Q%=2>nAYx4O%!K<<>_tZeNWdvy%bW~w%iDDtk|dY~e#Yq0wR zBD~Q7(XXP4Pf0P{*Z|@{9lw@BNlgs_KEOsg;Tl7N9kl)kEP){Tdx&?ZCSg*}2kT)( z@lj|0u(PL6D1Nw;-8Zs#;wuNGLWK%j9~i9l-ZA!sTf@yk7-RH;HpPiTC^}}7P?U2v ze1({e*q^{1Ha{&8@Vy36_yvS$!qj}LVMtZxe%BMtCb!s8Hd;04o(8 zTi5|%tXP*N%V*piFz1;C)~DLddfZd%mK)*IXztnGV@=LzVt~H#KWt`8m1j=2j zU-|+i88b113(?O|^y8p_-}BJE1mpxU21G3t<$I~y<7&zgn`<_`o#vLCHWYi9Jey*h zVkQm|DcauWagdh@yktJZxULHF#@i@NG-m-(%{6rqqAB>p4+$i}X0?U$ZFw={ObAwXVE z#0>&;DfD0*GZqz58x}RlH|wfQZy;jB6LA^q)rSU~)Ikl_ zZ#xMhVH4qM#>a)*JfpZ!fX+E>SamXoD}YBaDyL+~7S$HZt)}mXU39NRoN=wKxZZRk z7NRCP5vSpz$-sa}o?z$<;;4AvA1m?=wCcXfL8(w-5Nw*Ut+1)UxMA=BeH7uINX)EV zvndpZg_V_l6F;)nlzBElf#@oV;JEMK8}FNVbmXPvRAaOI#> zs4xh)#^MgM!qx`M^o=$Cv3c2Ez% zw=RoX_KZ*j*_n_ybsb3OgqfFwv{9F6DD;G-$g>I}Pw<~_l=UG@oP$20y?RkXk(Kc0tpc;+Of7Y}%{SbPuD`=A?)YA32wp+be#!1agS;%cj~wLxF`5;VlK@$Am97huCe zdLH;O#}JXkmEYE3*JZz*mxBPgAj;#IgF%+bkNL8gH%Uh)2+OYnB1nhwFf<6(!#fDj z3EJrF68ezen~O?CzvPtd7l8%dhQ6A7Z;`fI5eI0(M$N6*|TC}!2h=%l?kt5X{9`QZY zZB|>@!#)988}nLSA+ER-^0ljWBq`4Ut(+k^a#S}@NE{Hi=gaVEmS2ODEx+kA`nkh7>;}o}rp84^P@ct!{IY&1%zlyVhx)Y$NruA{KNCA*R#3 zHER!#+VIe*YFf9t^cZd~SzXRdTWP2|G1Rhc?Rls1;dz@DZ5y7m$@+pEoVHEWs}+t$3}cSt)2E@;c)SuFytR$Ll#6KCE%%1R!feJKkni2 z4Oz!@$^)9V)o@};pl4W+3aO_xZFU~#h**6Ym1D9^j?%XFf@oRsi?&@3(ezNmrsTZT zL?bGDTo>XF37wWu`lmvL3Twgd7@!JINMKPnI;k?Dtr!{|6WvW^!F|3ZC2> z7e9^*k7JzVX7IR2;re3J#(0BA)OmcF*;$}$G6*oZBw>?`>0*Mdvx=gyh4R19Jmu{ z%<3pwITKZQqM)ZWT%*5B^GgR9aq>l81ar6Fs{nYJY#^+Cih>HH6Ap;znrPRFkc%AV zuQQRAV};IZAoz1aAE;>4h-B4-aE3fzB*B`8b5P%|t`uWilRpQw0UI_u44R-@JQ68^ zbmuvXpm;AsO8EwjM0JrTNKu>;9>LH?!}`-!+d#vjA<;+*J1O10g+%_9T*Z4HoIC;1 z?&!$I`6>+M#MqTPqO!--ChRpSK29Q0oo@+sPF;llk<3p9OzF5y$8Ezk+acPezSvW5 z+P?9oT{P9UOLvail{;&8{r;Lg<)Tr$>C$n#@v?Ed=F(BS>Y}>s+dFJi+lOsvynfc3 zyh4R12Dl06AN&?&H%_o97iwX41tQs>C(Fo;4SzSD2PNMbSi$mQqZ zmsOtcn1y**?YE>ZY}r)3W>-$u?aGNEIUvJ!?Vbs{df&KReqhS3xO|UYcF7*wfAKEc zwP(tvc1&4oeB4eb&tt72duXm@pFX^7pLlf9{{F#5`@4G=?XN#O+fl7Tg$fn6E--{W z?rK*9_E+|MLm;0o^D_%EIZ%FvIQ5yW7ou<`8jfT@4s{?cfoR`@AT!LNOx!&?KaLKh z^Nmi7K4E!*YtR7bmnGLd;5_;hgfl{9T@~T|)B31L-T~+Cl;lL+lebZh&dY+LSvkU! zgY+EU=A8_Dql5JWe*mKLM+iB8^c$qU<7=osE=p7`YY;>p9MgL42!$gOl>t#9(nRqX zhet8~!;Xv{9qT$DT2ed?goxLMmwD6^vUF7Y*IG+*IBLoUpYk%3n&fc-M?HX;_u$;6p^%uV&;BWn?t#~}c+dH)3?$IH;;=rU`v3Jb&PmkI* zvDAiZHrs65;p2;T|FK28{jml6@B^pp{db?VcicN`e{+As-hTg*{p|w__MS&h+WQ_? z`s0iC>67ALq<3~+J$MsS;R83Cebei8?Hx;z6)HS|!7Fr!?=gGRtIfuB2fOE1vzPs( z=9*K9;Q{~?152{ls?J*Wg#+FyIPtLAyM9q~^fpCM304vYFk94ng!*Dk*8t+uT-aH< zCND=KJ&Ox31U-}~qNxhvIgfdy3nZZb_-UTdaXp|N{7yTK-obXZQ z8Ie!MW0^@EN91HojgH!cBDX1wk36Ne+AS5YnXK6dA8y#|-hZDp>$}trYM;h&yKZ0I zzVQW@+DxNmA3M~v1@-03V$0^5%QhpzZCG?2YSxs%CGYDoxne`54>c37cE~O_TBkyV z3af#OsJK$fcQ{)dG6wabn%#QYlwG%fO6qe9exU*b2IVtEACSDBZh|)#>&^$A&b@UB z@OpYbMBzcmVGoKjMG{dl$#T8|Fv64`>wrO=6S5VgKae{llEWJqBhn+Bl`b8F61wCh zA{mvaJGwBD5RR+`pZ>5?!f`|ltdj6*t>1N%o-(k4P~=hAA2*b#!|LTlnX9z}ypYQj z`6^T*cTUs>uCvZ->~VleNs>8a{0^_KZ)VM|Hj*RZkADP2g&t6_^+Hy(^HDr?8b+RG zZO@Bbo%;%j;NKZZrPGo8<7UMN_xg2J@|VZi!~@3@?poP5(?c30Z#Qp+cqNavcw@|W*u zNr%6<%PR}yJZ7&FB5zFUUC87FA9d`!TGBxek&aviWET-hQQDxGa92St2ljIF5|@kV zvRg`k-&Y(6qpZTd0W;^z;QXE73fXI+kH{|IB(X8n+mH-u99B-E9O*x@JY!c)&D-aH z{>AozPaL)T4lUW@@OH6^-yJHLHSdv^M?;7yw@WX;N7kHoD4q*JAQZ`wu1)gGc^PUg zic2So=EwU+<+!kYq^))ym+)~popq(xhwC;ao*~t5`-q&Ckzu8^ZDM@H#_Kh!*N1FO z`Nrf(@WwFZ!`}SalafDV4LKrwHP+oaACqNJPZ~#wFwqp$ zxzx6mgK|D0=j5LMe3MPqY&h`IYA2Zw0V^v_QqRT2B9wwoJ(L1Uz4$#NemO@4B#juR5YX@vaZ?qNH+% zUw=5q-sfo!GN6w$_D4CHvXIjyONjCUq+@W(aj{Yn@ti`v5M`8g=!;TWA;6>cC)DBS zZKA&EYQvPsq202H)~sE=ZOLBvoc;FB+mGA*k1pEcIF7KG-MIoV1LaG_IkIR+oCk2$ zaEJ=9Qi2k!j-VWlkC5f#_mqc4{B+G2PUUjj&}Nj!FOs)oa?&P8TcR-=(fAx6m;0jX zP2hc?GD0+$ENW~oiCBo4TWtIH+DU8`g~Na-d?mDCztHYpLvme=HQUM>D{`?K`S{hwtPYk%1${b7s)|cvNzs2YYRAq ztc)E4O14cKoh~eRaZ*y-l0;Mz z;Xp=l9t`NBFtdz*a$I3oPig2~l$C+3!0Q9EkPaPiLdIb1fjlYKvrA4wS9yt%Hgnx@ zqQW@?rFP5p&&$lw(?r1>N(G1$Gi8&9jTFJhk^o2l8C>@~m6ZAhC&9CFrmy?ANcXx{)u2E^jzaVnFx;T%xj@Pf){d62$D zW#kTPoQ&yjeW+=}!*!YHnvKcX7?qyW?EBD7<@i|L_kr+qY*aEw^~V>4B#q+O)4C|{ zV_seeLl_5SuF>^?TgGV8x1(JK)z=G3a7>WTQN6Rezbw?Blj49X`Tr8A+`CEIz#tEhq~8XM{pE)nR% zNf=-9D;)fkiTIq#Dr3O?TO1KUJMpxs3UGbI!|S>1oj@)QRejMX?pAx*CP#-o`zXAMW7~|?#Xl-OWO_W4sEAGG z5O2Zw#0t%+s73j`GvZ_Oyr_24MwgcStEs!>C|^2Jv+H(_+6{X~?CE>A+0!l`w$Hs{ z(w=+mw7uZEX?ymy+wIv`P1|i3PuWxUP1q&dMr~3KOnYw0jvZOBJMKMfAG`Cgz5k9G z`}h~dyl@@o8I2Fmj zc0p;E?-{j^zv?=B@I=d=`ZJ$2+lDzVfr$u1BI8_>j5hMZvpJveM?8<3z3bQIm+*)u z>6BZoP?I>n%h!=fCYJZHy`C6GFw4x+Gwa>Jos)FExU6&}e{mUw92wrCU?CIfWs{U8 zpGIQzgXH*xpACNP{TbV*HCI3WQq zmxv^s<^4$aC}$vW8vaN~Z6EP2A3hDpdU_1vO3|O4vkq_KiAN=;6HgsGzf9HYwtd&6?H-?0w+`EsRK|ZC85TeOK)N>DYM({T%l>AsM9yh0pOqtWYGKx9 z7ix+Vsr&^#Ij^cMsLe;^P%NU3FeIVFI_I>(H5zj~pzZxmgjCwJQ)UNwxCh7*rhzc* zBWmBp8GGigC41>D2kc{qYWBzPx$nX{8PIrMvY z_2|bqDZ`!L6n3oCuX0e%CrS>=t{=bOj-S-Tx87GlH3{w9Ic)#%ombm+d&epVWiwHB zP!7mJdHEJ`P>wBG``4dlcRs#sFaF&J?CyiQKK&LZUFbL&I4`UL&nb>K5%|O-MlE+{ z+&LMtS3Yy6z2R#wvLka%+xs7G-x`}~3kT&lIu1%$D^!O#FX9yNyJhYG(~Rr}7Y42a zC@e6L0M^EtcxVsqx-q(eY|iYUhnz?ceVG4xA~E^_Ch17~_cYw;SjdcsvT)+1hfnYc z1j&;{^+bpSUQUYe-^T9*I}Q<(x`Z)CC>~zYIfBRsigIC0x6PiM^u|dDFBoR>#%fid zOFm;+{lf`yT#JkcPa~r2m=Kpir@jSAN7Nru*=*c|i!W?Usqgo;X6@Nm@3iZ#+HIeD z=!pG;Y-Xcfx7NsrE$ccN(PTTO>u0R3ysW~F$|;cpvVFX6qZ5-hHY{gBT`*2LQg=x5 zd5v~?v1yIPhBU0%k{prwrMAt_F52w;qRlPMi)YvxGzB{9z<1VK)Qz`T7`u!ODEg76 za1tXGa1bDOV)ABI9OF3N3hDy9w09qbIL2gz`NqoftbOj(l6~cE2kfJVm+g)3kv(J& z3Qi=Cc=mT5@jP^LaeWR7-G|Q9D_u@yMD;6d0q|4PzNvKsG$yAeJoE}@2{doAyITTs zKHqcCqTR4>*xvRnSGtqoh6QWPHhfJspMUKRd-=0=*-O7*r@i#~yX`BVy3206Y+A-a zJUm~7S5C}RF4<`%W-Hy>+04>}K^Zm5M(b5ev)-W*jICRcY(n8=7zk^>$r zVA%?$83LjHs6|H%DTG|wrqiGztf<=8y_O^=Wj(Ers6Z*NKX#FBtkTpp3AsZApOCXc zg*=^5FF&D7%4UK|lD zD^JqTAE}A_5er9A$RaL|L7p$QLocFiKGFf{f9DMxIV`NIu+kNI(Z@dx509cmEcoy= zX#0fOj;WgMo2uI-+uC-?_L^PJr`C6m*fkezw_C3{U{~##v>nZsUAJT0KL66)_OyLd z_AJqJFWzR)xqRB5f88E?{!It$c{g5c&$#+hyXB%?wtI5S>hnu>^2kwp=z$~lsXGqa zC+<3I|8VMmp-Og?>E9pe)eGu2w53=M$wBl+r3)@a3<^y! z(>sUlL*I3cUB7pojH>g74wR7;u$l@GO~n@VI(h; zCE%Ci0&eWNgXfs!7nV7p5S!%#zN%4roJ3yui3%~1%(*)OiYSU;LdnW46;YsEwLllY zPLR)pz)cNx^0w(Dd0-&jiVUao0lu>m@sU43wD(63Z%K1deLHQT|_i;Ni zH?Iq=S8w)5Q?t%q-68zfFWGMwZy%`~l+DCec2KzTF%o?BlJHQ&MkmJYO<#Yxefdoo zzqRo_Z#`e^btMrMfDDo$DYhrQITLuO@T(>JuMZ ziLsEMAum7VcwSNPwwju&hiqKVhW{p>`VQ8e;$u$7ruuK>>71XBfoD_+RC7qemi4c; z%&~3P?H#d;<>)UgHEfy37SfMbcw4faOM$! zWQ%zH{_;}Ni@j*OZQdE{POFVOI8MK$b2@}G|6H5-MoE)$vv5v@= zgY``}XJL zuj8(crDof{|1XZ(FTe9(XM)BU`UJ8?(9=P|vgQUmfm46%fc}hoIa@8|k4cpYfZs52 zCq?j;6DAY!Bhn{XId(ig2oWog@;XC=Im#jNRg(mgdrbfVcVcwJkaKh(2VFBcQ3O$L z^h=0zN0M1&*9nhVh-YP~*uNo^>xLZC3Vkxc-d-fAZ4g&L@&55KRg^b2aBxF@fUJ}i z$F5(@Edib`9ZDdsh;Lb4&U9OS&D@Spja1$&ch_7eu)2>a)p$a}K9BY?8&KtlH0E{5 zw5?fh*skFr+qGkx&77FCR%2N5h9rB*hR51AKDy)|KpP)#+vxD5P4C#QW*pbG#&66l zTVr9t4llLr_)Oat7VCC+reW=d+#lCdeaRj$2im0$Br2jK5cTrY$o#Mcv=>*#yk%O8mW#oV3T}0CkLYg$)B^IwxoR_PMEPuWp>M# zX#A%o=JSr!zcWpH&v##MFS}Jv)H=Xw-Iv`sX>*!f-gn0d873_I78*0O|Kg0<{r}i$ ze}DXmb5cS$9mV8^!Its%$2$S>@B?cF#6vpuO>>8XiJW3qAeB)DdrQLFlMh)Odo^R| z3EV+qf*~)ICZ@;;D?yTSeY(`p3E4<5h&qK%DUz}{?WI$|9n=&q9#JV1D^T7hN-WYv z-flP?L{KKj9!M%Up+`T)Tz1U4U8Dr&FD89Cn!IV&UT&#NTh@@1u*91$3eU(be7Io`AF11eM_YE!{quJBeTVJtM~>M8k1pEdM;GLnjM|Q!+id&xVcWlB#CGo) zw_V%EY+|CW>bBG!eA{GRm)4Th$I+1O@JBk3#-p$Jse*jh#YvU)aVp{$i}}30JIzXi z{QEBn{D>j^?(ixcIpfzAHDa8 ziW!y9tBmpk_H3K5r(C(sPRQ~5^y7=R%y=nQ52ZIjx_t#m@aJPfI48tWc!zpst8jks zj(g_q&p$I~fAoo2d+0=ToY@B+T(Y++{!czNYoFmkXu_utE!v-bdd~jz_F4PDLtACS ztZ>dD6r2kC^t^Su+vWOb>@iHv2wLQqW3DS{1# zaZ|@zyXAi&8o?iWH5oJDCPo+EcD0_lLvb8yEy(Wkzmd# zLpdr{wX;$r@)c6*ts|Rn(aqmr5|dAS3UW$wkQWMFX;Yk%Akus@FX>D&YBRrk5{1+1 zJR(k!>4KPCm<)RWKIR(c9@yvy91Y@F(%?&C-1s)jBxWYxMNQ6f7@QjFzlO@;wU~zV zYz%u9#>76#=1n$%VjdS&s2q)DQJe6*mvYDN#JZ4Stp*&!Yr`Ei?7_|*KgotkUg;gdCcQWqca?KUnf5|UsaC;gDdZ*dg)qh_wL36HI?Meyand(gh(7w)#NdBelD*jXcV zeCJyZ+E*(6<-h*0Kl=>)?0b*dOMd=td+9IUX9u^+6Nd`t7P1=ksS*1(&)tA7(+KF>)Hl~lsxR9ei zOzi%K3g>`?C?t-^k@0WioOok-Y++w}f%ar#W@RJZYKaNI7oym*OutJO6(60GzSNUC z`x`xqBb_`!I5J+oD4ZH6>BEn+QRg7q*WcXXs77L92{o0aOKvggD1c+c+ak#QR?)fKu1hjyvj+vHc(?dZW}d*r@D_UOIG?Y?`C+r#%iZigN| zY)6mI*{tfnr23C&R-YapwY|G=T(;Y#m+i32K640Z!`G^ z>eK=B0b>f?hg1g~86KbEP%<_c3r^@sg=kRsAUaTz6W4-Y4?W=fagqqN1=U}YC^jGa z0vq`g2uhQ_qI!c|s!u`mt&UD@e_Tf~6}AW%_Xn;RvwwKim3Hl(!UCupmu>W-G5hQ9 zzS5q3>FIbMI{QcMjo*E(z2p{kZiOc#c8w!Y#w{<*UvZySZL(ZxMpTJ2_L}7S|kQ3tY z#LmI*?wFlY9DqNGE)Y%uz{4tLBreaoVz#&T2o__&iJvn*bS4~O{1OvTTs3}pJb zWVkaS*)!6CFQ4J;ppTaePa=u%d73=%oAjlE= z|3Q27;Bom&E!#FRZU=Ua+m-vq?BYENi?;8XupK)_Y(mX6K0YLWMdkY@a4GELWv-)p zF_<_gg3a$f?o)J;ta=n6Oyv`F-SEAbaq%t4nZrR@R&)7NR#xXq@alWW1rGpZc;j|5 z+D&Vb~_u-y>gqq|J$##e|lqg{L>Ch+S|V6 zDtq~DGFBCyxX`39B!lp@%eUDV@)POTP5be4uiB=Ixn(=m{m_|WmyDi270_MSbFbkO z+?}#ssIsowqp^41ofMVt6KF->`2YsIACPk)L!i5CjpT!zT+-ZhaA z(NW5h6ME!D5XU*+DH-7opL`;JJjFCZ89LB7zB(Y{v5GqwkS1atiQpJ4DLfxEYc{Jq zGl}?Bx>@nfYGMp>heZ>e6Ap$7f|#_u9a0#F!B;fUNBPhNC&3@(AOj~u(Ks}|s-p9` zQym>}&bgh3d{svIHKF+=+)`ebqdfk&L-}Z9Z)ZVG(sATeHpvixmo`we6Y+T-?+;xE z9#(=oPAUs0D&&)o@endt&G7Qbt1-q{pzf?rP=Ahc6kE+PTW*YMULLdNOv7dm9=5~x zKVtWNR`i+2?4bvb+2KPo);clg{>IL+VcWfZ*!Ia`*{_R#*X}(wy<^ID@7!jS+v_&I zZP-Sp>Q?7-0s2p|zIUZYJBv8-NXhrL=*Uu(J2H4~3Og+;>%9ECwtN-2D(bt%rH1c^ z9^w&OQ>5|O`Q~n0)#k%?LpGxETJx1CNMZnOLs;F?c?_o$Xf_dJW?uccpuXiNm5+&Z ztlr`|pD4Y>b7H<_J0{XehT{uNLM!9x&xsy4&edByn~1IO7LOc*OLmRgKfLNXyF@-o zj@rNel)doT)AncIbeV0#7@Yy$cK57(>1!Xbn-7fHC;zSLnc+`9IcG2b-*;<%i`n=b zfyw#AV`lIBZTSj2bS{Gq{7#j0kvk|U9>hd}H7txS5h8vp=OT~CO5r^URyn;I!N+{kQ>O`*q4ifpCU%VXQWm03}LM`fxdfYJ{il2a%LzUU?~qD z;-t=Lh>`b#Ng$60y>Uh95VD94ptn0Za#BK!*T{x{D_=a{GU;cmyRFA2HlRMP~(js*hSo9 zG?w{wSmzsU`_RMl_K0p`ACPbKuzb%?KBkL3 zy+x5O^D_qX;Yk^<&mJ**NM%sg!BZ{!=s_8ia1PETFm4o!&Gc7UW!x}wzMq3gksH3m z3$dEOky+I@u(IMHV~TUa6`{m zL1H*{Tz9VO+!;A2(41&Vw4hFJh?b>?f0-Ck8!>_S-F`a8xlinn%7Os1;Ii(}8{DlY zL>hCYlN60dL_Sf8eC32y6V;s+6MqaO@_I=Ck8@%V2}j~WrzN!?`(6rtM7^$xh%QL= zgO{cbSw&heg1_9E8G7asMc?35aRd^zDk3i+54w3o>KBS`H+4xgZE1ed7EUbM$)gK) z{IO$p?4hG}?2$uu^vH2Ldia#h96M$6qNUk6WgD_RyGQJb0~2=rRpWO372|fvo^ji^ zcig6@CTz!K&9+Z2+xGFA?HO&_?uoiCx3;T3r~YWxr>r?LZlhxw=NkWPj;-n6k{q9z zR?}t{n*L3h#^Qpt+52-+G%K1vp>Zc-FEIL{k%%I#$>@TDR->buN}_ z1!WVl6;@CH6CoFJ{+NZX9jn{(ubZ|%|E9}iP|mEc|LU$;d+F~#sQFCg$jG?S4zM~i z&P;iZ!Aiub$IL$PI_V&T$i4w4Zl3-7l6&F{gz@jpIGW^i@JBirJjMAZ{N<>ynGjxI zwV+;Uvf z4wJHPidEk*!3Te0^BE+poA zA7 z^aYMBjaf8kH()CRJy*%n6S;;$Ey@wa< z|J{Aa7MAO_D96)3o#!_KI&yP>!|VD{a7Pt~$0bDbrZ{p}*dln@?;o^h{f~R?#lQ2Y zZgNid+IPS8pgmjhpZ6>G+rg8ka;1%GpgYe*S+ChsyeY58x;PNGagXi`$><0H*}MQljg6aPsoR@dsCb`G-n4NK4tgb zbJFg+7>2#Sy$SZ-m=?1|LPrf+hx1#;@x{}d~8xq&`A0ukrZKEvQkD{`OQY6xc=Zt2U@kl z7Qv&ZFh&jg)vvfn9&3z1vt#UpKiaVW{^k4ZS(k?;mYu?Q9bL8``igz_Ww+?=vci)O znr!cRc*Z_(pC+XV*WuZ3^k8<>(yVkx!!O z=x-5aaY1Y%!@*!R`lR}A_LMGa=%m7rCpseHag1m|v@Bv`jcPE< z#UzftDicS@H<3bW2eB3Y8}-47QMOK)$PDmBe6$7Oo+KTSj{|^SJig&;sQx@aLVN>m z4{D+pc@_3m5@e{bSoV)cJRVj#IiYtz$-PN`Ale4`=+^yAtPe>qcRsp=Wdu0VKq!Mu z_}4&Wr_E4>tcVyCksks@`zP`@V-$!V6687{jyZ)_y&F3BHq|%@@>j5jZU4UgcFiR_?Y677 z*>i5%Y0tQ3huwVbPP_b)UAFt;9kyfdHXEMarW+q!k4$Me^(xlM9ef&rcZl*wJe{}> z@=6D)M?9O0(j%Uy|I)+uniuV|SKP*P@YDFJ*FS16xoOhA>6trHOb4&|>%+ENch&#? zc{@`~2h}5@cMIW8Cnc4lNJVyJ3I_6`xj^sUO{Hn#ECmf8S9v|b07l?$zu-s z-6t8YA1r1}Hp=UFe#%S|j(|VfQJCyJdWo>q@^W}X!e416LHy`T5RjLNiFyW04&uUi z2jD64!=OY~Z#Z(ABh+`KM9O5JOv+kJ?Cy*ai7e^J-8b^#A)0(RIT7!xO|(l{X(40= zU_nM9i#X(^a6iN&9tT3`6VCApi;A5_tQL?Iaw)SPoOd+^1d0v)X@k{Jlm#=qwB>5@ zvpVE#WF={h;)6*Z1;25{% zWVjH24G-|fkw4o~R~UkPIt z%_~8;PbRNdsnLph3BBsETKRzDmf`&I+;yV?=Tbq^4a(3SSy5!oVZPZ45bM(>%} zrHB9zV^(>5Fw>?CBtRP@C+SjG*d0){WjN0Mhdk*#1y9=wl{JKe5`6`e;#jru>w_|M zWEIh`!yy~h#5X)TZo_gAYYNwR+$#O}!2Q(Zn6>MBa{j|*5nI|p(M8I2%0$Lw*sj}4p1#}u_#5`Ga9aD}Q->P%lHYyI?s@D)$JnsSz>wK0 zPDe4xM46*u=yFfV`nBjEqcN*9~;O*H7Vx()bd2JrYxPcYI zPP&l?9C4Bo3RNhd)tZP%%DNnc#N-eVA1ttQsm`~zI90+ke=QR?kv=R$BqAo-N zq%e=V^8F@VKmjJML69q$WCwEb!3LbQU)dRO9H|zpL5$Hn>}HOWynqD%Y&vNI$p!y_ z$i?<4!jX#Tr0ayS%igBA>yO80tkCiJu&RKB>Ql-^c9PX~9VyJJOr-f^RSDH;eW-42 z>DbW-=9JF?KSUhz%gR+aE0|eo8DDEYG2iy@9|iaUtQn1iQ~cPK@80i#xAA5c+fMu- zR)r@SxGpsYo_Xa?`WnOR-WY~_iJA*U8KGdEIeFPUbPuQPC;Fa)gdOu5hB`k6Zhsj=lkv4XGmkO_*89gV--21DlHKK;=78 zu6QXQK0biP$H#DXd>;l&*vcEWHUi-o@<_-Zp@;`@fs|a>{jRb}q+Li%$nye!OydDR z?R*DCx;QD^j=JgGH>fJwN&G!2rSqtZ6%qC(6t4y+QdB{CJiz%NPkiaM7m<(okE(^d za@gl7@fHPTR8#*^PuiWa;ChOX2}@b0$QsDS67Gjcb6%Zr0kYpC>OeZ5t7j7S52Iz| z?M+`R4|{QV#Ni*S6S3-m04~}f&S^JRCtPrufbx3d;Et0AD2-&_$D<={;3QWd!bRH? zR@uH+N6aAte+0y;q3`DrKO5I6j=Y@HxBk-v$WmrEND4#T2=V1&exaNjzhRNTSp{F) z_{Hg#=DV6rU(HA0I)#%rJZ{cW7DRltg0i_Nt)RU8^@r@SlM6PiyWijb>Pzg}J)M#8 zy?=4YK6w9vol=MY_E#UUXIXc zd9kl}=3aa4SM9fHmPo(vPF<%m8jCI4zi-OE^oB`$-j!2!V4Gj_jR&uNcYH+tNI>zf zLjXSXCY@7w;S-Zj>M)b;1!M^M;`jYN@R3&y&T{>r@W)=g_>mRmCb{0fJ@g3{2;}Wu zAlF}ECeL!Y(Jr~Xh&vM?&zpyGbz~9`U84+lJQ4<7!F0Jl?rfYIrTGb zNq@1@>JDWwfKuDRBS)#YkjOuwgZi8FWy$fqCL;ElpnH_zy2}0CgNjAIYQ` z|LKL4?y~q|3j!mLSAc;j5KrH6tZ+{7S9i?W`#*WY{^@m7g>wSld!OPzbi_XIvWdbu z0Uv*K);{>*qxRGTHGA<59p|LNlL!kf`@dg*kvk_p^>#TF-0^bJPYm0k%VTF%ic1O@oUX3+Tz@t&Ckq=PU*(-q&4T|V6h5v>adQ9cn$aXQN=yhp_59VIiVY> z^!7{qaGbx&ijhtfch){xVssO^ffxB(G3n^-ruG?DIA}!V{3ZCEqK+8cpd4X)v9n>= zAw)rhxdU~;kjfw`q5(I_m~QS`osYY5)zg2!Mn~$s$ep?JL;NmILE<4DJ|0*3%8ugM z1WA4m6GvK^l#V=rRD z9j}bMe2!UkMM=pyo;B{vX!3oox;lFPr z2459Zzu{>3CRc@Fj@3YZMcLbw6*cA>-VRNk2Wt5q6XhKiKl$-5d_|Kq5y{kz^PKqO zudlPOB@qtdl5||w(H{*djAP4}Y}0QWsbnOIe92TLums6cOt}yWuW(i|sy_M2S6pI0 z`bE1_Ob7h7!4G`Z752Ygwl~Fez^9D=<%=(~KYHb*Tk6G&CoJNc*ecNEcgN$4_WghP zxc$gqJ*WYs%Q=i2s~=2`nlv~(|Jo^g=H-*JO0h26j(^efp3L6q&XHPy?qx&PIFopqvlUiKEs&al+asdG%Hf3Eu&M{LzaHD-$z!bWVzk zM;I)f`^1KQ6AuoHFQY5oUxQ6Yk0WntBibq_+NM0&`Pd+wfm6(CU!aHTMqUuvIWi{@ zz!vj3hzZ0e4*Czu?6yC`N=L|lqejVouCOn`GYLV2i7S)hX=ne<8wfcme|*_>1re`w z^zla~@JnZiiFi;d^ZNuYQV|N2Nb!zxyvTo71}Y^Xhd8Nsx<80OcP8jaNQorT{z0%I z2juM>L>%?+BJl=A{-CG=jw=&<&_>}aWKxvf-h7Y8-?Cz|mmVM<(NJzY26Y`!hI~3< zrQLr5f&_?)N0_}Vk{OM_!B^D;9u1{vM`Y=VNK8aoh>0;1?L;!Zm8fP@2il!wm1rR< zLy8ol0RhQ0G#=AM)gzuwL+KIEAADraUil0*bams;KeK3Gdfiy(%ibB@`{1%YWpB-P zP0*XCQ9a_>MC6Zn#?&|auQ7Ys7J7?^F9|bg`j3KfWtXtrvKua%usdFTjo&Db|J#pu zKD@R9y2#mVivxq9lM$wiiA^7XmQp#7*N_ARsse}#)VHF}PgJ9IJq~^wv*FlI=%JCbGL^v$I!X{8} z_;6})>f(2!)`Vm@8_MGpa7;MUx|EBT{zIodCORf{PPm+LVSr$(aMsYvIRRgO(@N(A zJpc0H70yY8vjnb#!f0(FY}3HtE3d08p+ypV(z>2=cR@@{u>2U{RvS~Uzl@=8NaZMl z>S0Y9q+#qKCeoO!Rt1@YRssE;v#v$}9r_`+rGo(5PoBI!UOyEE`LcdS*zw|Aiu-Cw zssL$&5_@%`jDBSWkMHZriE^bRlen*@usXrSj^eET5MBckQ?w)Ov_mg~ha>I7aD{xJ zQ|A~6iCATFy>%L61@d#^$(QoF?uq=7-h79AL#Q(F4Un!ni;Da~p#uuC@&yr}4pF~N zLteIse&p!w!Jv!Eat;(nlqXTo6gLpm&^(I48Fc4HQ9);dym;n1NX5{S0@AaFq=LQ! zeNd$qS3h`C-+7Y~YNY-tVNxBGD3=2L(O4(gc{HH3obtyT9w)wn z^d}}r-bC`p9qKQCQ%7MYd;bwZ98Agfaz#-u5V8s#dQhaJGK4QsK#5&W1Pm&(rm~#~ z(-DgIukPyTkM(qfm-^#$@TiHmCOuv3IAzS3IVs8!x^Q$vLPS#Mggj4?Cn;aC7S3*aB?2`rz;I!PJ70wL0kbN(hz_{ED0*y8c zV>*lOtguO-g;}z_urTBkhOT`-T*!k0-E+bq#a+5)5T6`VG+mX?dmFJ`A!iUoxxLB? zb%VzpD4qDk8Tx1B4jA=;6!!fxI-U#i@}ul1KM^Zdg?=gQpY7);UME#B+MEi9!xDtU zz_jChDKBq_`XdzDLNdbJ@J+1PG4YneF1vH^vN(FXCL&yr5^3*(C|_mxS5H+guhNp= zH~s3|N#_8ax#M%vd6~G=XBLgJInu`t7upGSg$07}m&aG=e^!8Eg>uqWPNF-9=MbSn zPP89wnRz3Dnr*uXmL5I9hGnJvnSY`Ohx0LmCr5_SQ!_kAyB1#2%DC z|8cX)?J2ShH&lrT_t*yl;tBSePzLs(u+f+aWT56E4@OeN{3rUFcbbJj|R@5G0U$dmIFiNSy{jZs!= zh;rRTAo349R{H=sWgUn^e}_)Ew)}%}XBkl^fIj8xsn9V)%Cm}t0+i&x(kTf%pT_H~ z9F)xkPQ=*&gT8W3&Kz9CN93UV$q$*0PRl{LQVz;bUpNj5z%cvfSA{Pm=LCd<@@H~T zrsSaX9n$%Agk>&Sc#_FW(wcx-`FZ7$>&UMq;#YxBHe&Q&HddHs_B^Y!cdqhUD9Vpa zDT0ZO$1EsG(wRInUXMP36~$#ja(TY;Aszj9kn)7oKIO8JOB|~v>}~N!OP-=EO7#6T z(na5Cs-*iAwdMbU)Ib?k-U6BX+BhB$nQZ$X|H%WoAn9mVqDCR62{Y$CW! zxTlqBNotRZ_4Ds)r6A}kP$>p2fQSXt1Z zi|jZiP@I=32j}pzT0vJha%S3r{hq3eKTcu{q-gR4alTQ64lA%hp=67!c{oQN7d*5n z*Di!JxS9!yJiLjOsH;nQLp5b^(bB%7ne$Fcg$hqPlwUEdaBi@!W|z_Tw?-gkbfcGO zU{D|vs4&Q?3+#-I*yq5+$X*A3n}r)Z9gFX;Vz^ z+d*m{^p3Y?Al{e2wDG_Bv-W9r?C*;FntuRN3I)p>gRreBtKl0<4cvllKI*5akKnJsQ z>784l!jlb*eHl34R2CMb!Z`!YKaj!Btvi{RWE4mAy1Okalwcr4m-WfZDEJlOzn?{d zB6(9J$lnlA9FO2u#AoM0z8@oqbLH!b3nD)9Azy942kZDbe0OeAdM|Q)c;kdTnw*89SG!C1|He?qXnHu`Ap)xdBU-X z3sRmkKNGBnbzCv=u7{8n)GMx>mdIBuWa|B^pQW^3v!H>)Htx<13D|Q&9$_x)k!IXZdka8Qv};CiPWU5ke-%9*8mP^%mu0m@N7EW}>V= z=hPwUlBWd$9FuTfRzq1n8_W5X=h!@)%In)~6)IE!x{A2#TGHJhzg6Ntd(M?r;hZ9x zJd9%i16`VnP6I|+Iwn5;{3yLDvK~H1_i&4tXOzD zVd>%%yhI0KjB{|_YvSo!&ow|ba#{=Ucv~grE~h3%Lns-KhL#es85{kB2RY>D2oc90 zoQ%AT!l_^uj<`V(GJ+^P-eomADC`V(eS4ZXjNm)V2&C?2f zDX1%oPbaJy#UHn*0`XWS_LX=Vq;n=79lR(I^(CI8Q{w0MaC}uqM4p_d7a}d>cM&p4 z5QTp111Udlg8cg>nnj97H0gt1o`<8z+an_oNAz?jASJ?2zT)F;oRk17d{IYOaCTzf zPT};Bfba~FmuPpK;E@vvulJRLLGTsw(-9EY#ZUrKB*)Ae`GcJ>BSw#7B}Tj)heWmy6px%JyB|<9san7v4WWzV_+uN%>IL#qr@YVN(M{KkMnY*&kQa(}a7T!8 zq;rnoD|j<=F4&tMY)(i4dd6 z0$I@}>@^u4(UDCn5KtWLR%)NhL8(w-O=MRpZx-~m2o=sAvNk6e1mZ~7&{Yt|y9}RD znM5H?NU^-1QyBiB^5g{dip%3Ee@*0tMo%rbT9TPBc&onN3mptS%yZSC!r47{sSjdkY2a%jmN1TsfN{CZ;QV0-H;t51jp<|AapMg3D-wOU-P#^dvTx6|*f#hX~ zDh<*PWkg<_hRp!&S9ly6Z|9+Kwqy1DF=Yq!Md(lh6SY5%QMey5 zw-x8`uR?_*BN|R|(Pq(BLCD(>5R}@;_19_W*$b2%6mWg?$G?vvS-eH$y03y1j6I#>n$e9N~Jkp8BB?Cj5aGrU5xDh7>qAq7NE(GKh zUI!-`dZ<-7C>1JHxBw7VvKL{-u$)XRtQN>YaAGxtiBdcZGFK?q2cbfg zS?I5JDnE`14$YY zMkR#aMez!7o%r}qQ5ooo3Kc3;xWIwM!}?+6f;h*b%OJ-i5298h*vL{2bBFDe!tMk> zi4P*JfYL%pJW}yTElgxQT9RO#6VI#o2Iow|;^VEEoH~UnP2u7ZO_`E>-0=kCde41451_Cke>;5U633^d437tV{x=gzc+nAR=l(D zkv9LJTtsjz!OP%}PM0=zE-^ z?Sgvre?L%ms^+>7I#U!Yi!LNx3$C2vI6z6Q%0a16p~4dc7`1K<;PqeHAr zuvyeUuP(maZZoOm;hc!?1@dRds zqPo(1R19&{YpuHX1p>%Kd9=SrZUD;2YKpgq6zY1@XBD9&1^FL3lzb~Xs{>f*FaIDN zV?#OzNTVwK`nhOx%19s@&~`nGjJy!}a9}}X?12!EysW6cKoojM-|<^*MW5$HT~{eL zmy^p|4??^j`I91WnppkwzU@ST%0a16p~BV%hBzk3G7Vy&3qyz?CXtlcofSxNzWN{| zT@dGKLd_{axhqKW{ljG(F}BJ;QNAjocwZ3-UZru&WkY}?dkxC8-aQ8^1cN-BgLoz= zW``0_Sp;>WDWf?#u8PQ<3EIfy23$nQNwR!WkBNOPM7~uf<6Lz2$r=bgbu2p4F44ze zpmu_A7GhlaAc3-ju?I+sI&s`cKSo~az|kXA5w63i z5b>hQL8(xo!qx|Ns~2G)!{^|9RbU8v5l9xXpeUde&!dX`5lI(mlJrLqaz^~^9!)YH zhqI&jc+}xUoTwjqsR^yCz5y8VZZP+R5fqyVaw46Ho5_(0pJOqLbh42>Cyd_Rm89RHJ_W!QN7SRbnQt)=LXWOCiN}x%Cfa-l#V^o|dSSJ+GS zjMEsa{le=(7# z+&VxOR3cl12L=vEULK~u7lF{1b9BaONr)uc8Op<}0!9>O(v|XYn)la0a>@vWHiEVC zg_5*E0#S@Js4qe%`Z)tpQ9q9KVNXPUh=OQ;+Kpo>IG43vgy^1#M5v^HFXXZ|s!x$G z1u_+4L~agP;^ec-{2oJ4*|>5J544uyB^{XyQoJ88ukux>a6aMVRL2GV;TU6_^I{CA z@LGV!zsW#8oyTvR43hWBj4*1n8Pp3jVN5Oqkp%W4_Ce%Uw4k-ni?>I#R0^+teCkpAIPp>$ldaE;f_Z<%BF={EdA3k??gmBFw*;D*I#bUG_XK&P z^J$m}D}J-g0XpyqvI}wENB_-0xk$gJ)DZsTl8lc|x!n#5nKoK+8R4ON&Hn34ue2jS zd6PZ*<2Tt|ues4|wlv!0Z2aLjUE}1A$7)c+J>!ZU*8ch1%x37A5@g7qbM>SjD^xgd z&^Y~^%O~vkPv2@+>=`keZ`rSX%@y|WkKb%|vSF9(p0f5Y+-i2J#~98bCuDqN$et!y zT!)`~<)nT32XD2Vlajg7>+%T=uKO7g?Mhe_k6?J?g~u%H`@jH)ZHo`9!Rz6O-vrta zuz^XR5HhSV^&oC23!^u7JIY$u+yQfBh;T3Jht<*&25JZ71Y@d~*G&h&jD$Zh2tthK zMJ}?|K$No{^vgqh6uE*Y^ohqM>2XbrPd_ROVhDtP7;!-^C)z$_rZJBU+AHTLc~BsZ z8y|j8sklZsDuJ)Nwni0Sy1qI}t%S=GQJ0?eC;@&beN5Ix^QILybG&ZfP@6U8dpIcT zsbCJ>>3z?0_t?#Q&GvlHC+*@N_>}$dUmsH8Ds)yFW1Klkf#dT{Coc~tg)|%xUbUN} zh5`mgJWFyu9;c0HxVa<;UYwF64SUbGUuAY!9v2OaOwu8K%!7FO98Hn>Goionkx_Ck&>V+kbuJCDZvcZd|Xo_0iphP~%0)Ka^x1@f!~Wr>F_LLrMu!KAaT}wrG7$uLq>}}$DkG2b1FNP!!{e5${WHrY+M}Hle@~CLi zd8I<90V{HP)q{ABWnx%yB(D?Yo~F$i;&KFb?;f$Qd)jvUcYkrvOkvwKYJc<($LxxW z#_dx-e3KphZ#Uc9zUNwbOk-+?cBh&$s6Y0V7g^&MZ?$`W{6_nN8~50ozx`^(H|)|q z+w4u>d5s;D0mt{yt);#3Uted(|NAZWiPv0jSM3|Ow|xJ#HloSlvp;*QjgQytH(q&} z&HemSZ26a-Vz*tsL!S7s{pq(~XCL^1>+CgOvR`f7a}-smaAwf8G;K zVxtqo_SSE{!fx3&YVDuC*$&M#b%8G1C%^9+JNRF3u@~RA-R$_1{f95P%&&vRUwn$$ zqYL)U&)H|M|E6o~(Vx26zTmoP8HFd>IF|wN4W&?SEU|uW)x;ulLoH&txcE+q^7?Pg zh<6BnOkPU!FmYH(?s5lgH?romVdO$Ea+EK9dhTUWQeIfFm(eeN!=Oxr(oVEHZPf#r zYJ-6cDU)v|Wy7izXR;a;Q6}|8#X*!<(LSX-q!Yzmy-(2e1-JPnz!QYLLWh3HGeC?z zDodMko(?&!CC~YkzoxOv7y;u&4jZXYF%;?LON#S+{@jdDAxE zXxpj9rhWTYUTm*?+D;q!wvXD?Kk{k2=UBs@cJa6rY}?52klnI>%o+;&YuhtR_SLVu z&z}9O_u4z}Yua~x-fnxzPu^(mN8`zx0y5_Owf< z?SFspG5d%d^mpGsYd8Gd-S!Qiv)x|)Pxjka{nmZC*E<&-u)9d`_=YU zw@lf^-}7;M&u34`NIk*ExvvuG=s)w%QRg03&HY@2VZ#tYAYRR71$RWG8=1n0cOl}i zlxKh_JIY@-&?9IK1WOqGC^roJhIQzN&?^d|!8Z#bS45Edtk+3N*_~DcydZD4eucps zV`weGp##mrG4B(?P*0GN@^MmnFp(V14HY^EqF^XFDTs@xF5Xp8To*~6KT_0jIsG<~ zKk^|eFE8>809gA`h|7uMQ=L~jC>ybD%6ELe<$F+S{%lR9Ky%A>(VkKJgI8W*-}#)~ zwtc)NKLZUqdhF93x({H@WzV8e6 z*v<|V!jCNm?1*{Wfp^UuDvyD(S zFE{GAfhr6Rgb%t&WKe{{ss#Oty{BFr2SK!hxBD8EC)xS+hiwGD5{LIo1D4<`aG}f^ z2)RtGxv1zHMD!eku8ashIC37DgpeC-L4_<50!pC$B0Gfo@aAn9GI}Bv=8uqMOY+A@ zUHXR-O7}fqsyM{sIzE8t8IZLGQgQugbF7&J&7NAeKe_#+-TuATn;nya#~b!*Uw@fh zDTm?s{IdP~U%J~anHu%gkP(%NWAW%r!+!LOrqiC0w%vXI3A=HxjO^%`{j1N}*7>rt z8oVz4E9K~1zGK3^{kI;JuTn4U@JL-3%g%B8%exlrpFd^XWsP67!>-s-w?F&LNjXJg z8r_^~R;bVy8qY@$F32~o*>kTRv$x;3VDJCfQQJRNm*Y{hg%fg8=34f*_srY(|JDQc z(|`1cuMR%*@-h358q=RTylm5BHFw6hkBoH2zQk_R#WJkBe-;4P-}06_mgL0L?MMIg zuzla_9#u~|I1eB-I)YiU7NQ$ppcQPqtgE^(Cp{A2 zhwRj^-DanL@m9O%h}rFj7VYVmjM?$u{~Y^++fUe$xu)HHbjco*Bk|h5c+B4Tky$(S ztGC(RKYF8W-(9!=^U)bQ_Ft~I=Uh2z@4J6a2D@b+d~nh3KfYx59zSVEf8iv2TCQ4m49=xnUq59pff@r=Oo(sj1YB1V5;N5I;X;m-{*l=LFnr2I`MMUw(M2P%VY(C zrvZh`0cD4bC@12=_sB&OE*Nv!Ia2~`x%`3@=}#_#AJRGdQ#>w3g`+|qRkg^!7K$>X zoFED1=qs8c93prqgE!DTUBn$1PA7L@5$2^Be_IFAb&azVx+c_Y+eH*R81R}dy2b2Y z{*l?-u@qUtq6$rqad29Ese`u;D3_H%mQT{78yn*-2b9z~<6d`yo?rhvUY_zJgUzj^ z!5eA53?t&L2tYcIeemwUq|#_G@=R8bcPeZU^%1i}cbdKKUuwKfneD&9>>FRJc@n3i z2N=JM^$7;M!1#=@%5Lwt7IbRk`m?Aw;yL&I62yszVLd4sT*RX~GOQ!a^$_En>w|HQ zk>GlIqG3qa?%{jP{`l2u(;X>tgGf!b0_x(G2xhgdgL7z76mhGdToze2#SGQIwF_gT5vt|r_iI%YEK!_KCsq%)RFXI{V8-H zqDMOniYPDO*M2A1ja)J6Qp#AC6F{w^+Au+Mx+;L3h%ogD3VxZGp2&FyL0LEQ_d_^1 zTdb(!I7S#Svt+AEd2)nv_5gY@Cl3S!P>B#kM#{_t zphmw*ZoOdA>Zx=ez=~7Ds)qyJs36438^<09c0cl`S4R<_Q@I`1(Ya+&WM@?+#1)7L z^rkNHSR^5r5d^yWlSu3j`l%3qr9O>ew<{?b&~Lu)Mm+xZ8|R5gLqsp?DlZ}Q30e)_ z&nk~SEIj^+A8BkZ4(OoJJ}AKvs!*Xqg(nKIY1sW7{LvPcM0 zzM2YZ&4_3AG`0BsAjSFjS$Hc*deX1nw<2WqB6OxKs^2SpAd+4NhpQA3sU5tWv;weJ z`xh%b8HfszO!i$>jzowA%7FT`d9Z@enPWjpbc&7_u~~RoM4UTd#8U_ABJ%I8NHHhX z*PRI^wzqZCi@$gV+zjelVXDS82njBYASCqpouvpLky0e9EEtWjVLQ6AJgy zBch{>O!R5Mg#6ftgu@(+9O-}YxU&&n00`l!zx-o#LPQ5vlv`#<`FkrjAdrazBpEKA z_NHJwl}>!k#^s=_HJGRyJUk=XbB)&A827OzVW`5RUhNqTvKq*bW1T~B z?o@$TK|!xR{j~x(DdC&|${>H}jO-YsdHjV0_n>L`v!py?V*t@!YdMG)1Y#ic*lnI8 zPonN|;caE$q>N8@!cBGDVmAISIM7Elya$>RZ$oXM_ zsAH_W=#ZBSdNjf5ys3@_a))^}BpyWIH*m`19h9#%b&7+666@{owGb7&(11tjhC7zd z&H%K551t+%4bVn(`~?px#2{jT_W>;Bx?YH5)JQUs|_ zF%f1UEham#uDX*M`AIQ!C4aB#^#dY+mm7+%@u+1a(kN)1&L>$=mkqj+jnx6-A&*N5 zMY;my;o7WaB72q3PJlZJY zlJ0@f*UN~L0iBd!hvJC>;JjycMRGlkXxwsbdQ==GfUmZ4t-9k9f(JmavSP09DS`}i zikPCEgD;Xe$KeS%IXEwuxnd54Au+Mx)`hBmY&?$qo+lph5E%t;6c{4vb0#vj0xAb( zgNVxDqBEE{FM+7aLD?GU8s|OwYBLZ+qKx$x7cwH>s@Dum7@|$A7h)LF$zHFG&|!ed zERw_i_G+(92Zcg3B97cDI+C<%dj~R^Y-$aedEfP_+raVzNp4Y=+PS9V!1)urT>YV& zc)a3rCe;rL=XyFHq<}x}!M+VR5XcL9$qNzTzmD3GG_p%;Do){p4>etOn9C%I6Vr9fhj-FvE6nEd`HH zFu}Nv$z(MYvPA=l%M}D1G4`t=Z=PC4w=QqR; zIOd})vOz2QHyA<|=P-%<+c%|g0wN3WbUGt+3oynw7c&k@_$$EKlrO%LZD#*JWK}C2 T7h)D%00000NkvXXu0mjfK$-&g literal 0 HcmV?d00001 diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index eaf60f5ed2..a92afca98a 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -43,6 +43,156 @@ Process: ### Create XML file +Let's start by looking at the basic structure of the XML file. + +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. + +- A configuration xml can have multiple *config* section. Each config section associates a non-admin user account to a default profile **Id**. + +- Multiple config sections can be associated to the same profile. + +- A profile has no effect if it’s not associated to a config section. + + ![profile = app and config = account](images/profile-config.png) + +You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. + +``` + + + + + + + + + + + + + + + + + + +``` + +#### Profile + +A profile section in the XML has the following entries: + +- [**Id**](#id) + +- [**AllowedApps**](#allowedapps) + +- [**StartLayout**](#startlayout) + +- [**Taskbar**](#taskbar) + + +##### Id + +The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. + +##### AllowedApps + +AllowedApps is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. + +Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. + +>[!NOTE] +>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). + +- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). +- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). + +Here are the predefined assigned access AppLocker rules for **UWP apps**: +1. Default rule is to allow all users to launch the signed package apps. +2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. + +>[!NOTE] +>Assigned access multi-app mode doesn’t block the enterprises or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in back next time, it will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + +Here are the predefined assigned access AppLocker rules for **desktop apps**: +1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. +2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. +3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. + +The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. + +``` + + + + + + + + + + + +``` + +##### StartLayout + +After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. + +The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). + +A few things to note here: + +- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. +- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. +- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. +- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). + +This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. + +``` + + + + + + + + + + + + + + + + + + + + + + ]]> + +``` + +![What the Start screen looks like when the XML sample is applied](images/sample-start.png) + +##### Taskbar + +Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. + +The following example exposes the taskbar to the end user: + + `` + +The following example hides the taskbar: + + `` + +>[!NOTE] +>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. + ### Add XML file to provisioning package @@ -54,6 +204,10 @@ Process: *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + +##### placeholder for lnk + + ## old method (pre-1709) From 96ad864e478f59d4163b6667c7469c7336cd21fe Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 12:55:08 -0700 Subject: [PATCH 04/76] fix level heads --- .../lock-down-windows-10-to-specific-apps.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index a92afca98a..19996b5275 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -222,12 +222,12 @@ This topic describes how to lock down apps on a local device. You can also use A ![install create lockdown customize](images/lockdownapps.png) -## Install apps +### Install apps First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. -## Use AppLocker to set rules for apps +### Use AppLocker to set rules for apps After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. @@ -268,7 +268,7 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 13. Restart the device. -## Other settings to lock down +### Other settings to lock down In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: @@ -304,7 +304,7 @@ In addition to specifying the apps that users can run, you should also restrict To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). -## Customize Start screen layout for the device (recommended) +### Customize Start screen layout for the device (recommended) Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). From 7c99a65fa5a3e3a692bccef679db8e81b1f786a8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 12:58:09 -0700 Subject: [PATCH 05/76] sync --- .../lock-down-windows-10-to-specific-apps.md | 27 +++++++++---------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 19996b5275..543adcbe20 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -18,7 +18,7 @@ ms.localizationpriority: high - Windows 10 -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package, rather than creating rules in **AppLocker**. +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] >For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. @@ -26,22 +26,21 @@ A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typicall The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. >[!WARNING] ->The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the assigned access enforced policies. +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. -## new method (1709) Process: 1. [Create XML file](#create-xml-file) 2. [Add XML file to provisioning package](#add-xml) 3. [Apply provisioning package to device](#apply-ppkg) -### Prerequisites +## Prerequisites - (latest version of WCD -- is Store version okay at GA?) - kiosk device on 1709 -### Create XML file +## Create XML file Let's start by looking at the basic structure of the XML file. @@ -78,7 +77,7 @@ You can start your file by pasting the following XML (or any other examples in t ``` -#### Profile +### Profile A profile section in the XML has the following entries: @@ -91,11 +90,11 @@ A profile section in the XML has the following entries: - [**Taskbar**](#taskbar) -##### Id +#### Id The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. -##### AllowedApps +#### AllowedApps AllowedApps is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. @@ -135,7 +134,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula ``` -##### StartLayout +#### StartLayout After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. @@ -178,7 +177,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ![What the Start screen looks like when the XML sample is applied](images/sample-start.png) -##### Taskbar +#### Taskbar Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. @@ -195,17 +194,17 @@ The following example hides the taskbar: -### Add XML file to provisioning package +## Add XML file to provisioning package -### Apply provisioning package to device +## Apply provisioning package to device -### mixed-reality +## mixed-reality *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* -##### placeholder for lnk +#### placeholder for lnk From 53f8bfb3464bea8a375d85651ed9c4914dabc0f3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 7 Aug 2017 13:06:47 -0700 Subject: [PATCH 06/76] add xml to code sample --- .../configuration/lock-down-windows-10-to-specific-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 543adcbe20..e76ce71a80 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -46,7 +46,7 @@ Let's start by looking at the basic structure of the XML file. - A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. -- A configuration xml can have multiple *config* section. Each config section associates a non-admin user account to a default profile **Id**. +- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - Multiple config sections can be associated to the same profile. @@ -56,7 +56,7 @@ Let's start by looking at the basic structure of the XML file. You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. -``` +```xml From 8e09327ace3db1b69e7ad133eb67f5b2cba9ae2e Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 06:53:59 -0700 Subject: [PATCH 07/76] sync --- .../lock-down-windows-10-to-specific-apps.md | 48 +++++++++++++++---- 1 file changed, 40 insertions(+), 8 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index e76ce71a80..c732e8f652 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -54,7 +54,7 @@ Let's start by looking at the basic structure of the XML file. ![profile = app and config = account](images/profile-config.png) -You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. +You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. ```xml @@ -92,11 +92,17 @@ A profile section in the XML has the following entries: #### Id -The profile Id is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. +The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. + +```xml + + … + +``` #### AllowedApps -AllowedApps is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. @@ -107,20 +113,22 @@ Based on the purpose of the kiosk device, define the list of applications that a - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). Here are the predefined assigned access AppLocker rules for **UWP apps**: + 1. Default rule is to allow all users to launch the signed package apps. 2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. ->[!NOTE] ->Assigned access multi-app mode doesn’t block the enterprises or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in back next time, it will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + >[!NOTE] + >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. Here are the predefined assigned access AppLocker rules for **desktop apps**: + 1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. 2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. 3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. -``` +```xml @@ -149,7 +157,7 @@ A few things to note here: This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. -``` +```xml @@ -192,14 +200,38 @@ The following example hides the taskbar: >[!NOTE] >This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. +### Configs + +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. + +The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. + +Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. + + +```xml + + + MultiAppKioskUser + + + +``` + + + ## Add XML file to provisioning package + + ## Apply provisioning package to device -## mixed-reality + + +## Considerations for mixed-reality devices *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* From 7c6c964ce3f53611d05e560a80f7393a593dea4f Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 09:00:36 -0700 Subject: [PATCH 08/76] modify toc --- windows/configuration/TOC.md | 2 + ...change-history-for-configure-windows-10.md | 1 + windows/configuration/kiosk-shared-pc.md | 2 +- .../lock-down-windows-10-applocker.md | 119 ++++++ .../lock-down-windows-10-to-specific-apps.md | 114 +----- windows/configuration/lock-down-windows-10.md | 15 - windows/configuration/multi-app-kiosk-xml.md | 364 ++++++++++++++++++ 7 files changed, 502 insertions(+), 115 deletions(-) create mode 100644 windows/configuration/lock-down-windows-10-applocker.md delete mode 100644 windows/configuration/lock-down-windows-10.md create mode 100644 windows/configuration/multi-app-kiosk-xml.md diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 876c4c17b2..4166b7475b 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -9,6 +9,8 @@ ### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) ### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) ### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +#### [Use AppLocker to create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-applocker.md) +#### [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) ### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Use Windows Configuration Designer to configure Windows 10 Mobile devices](mobile-devices/provisioning-configure-mobile.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 2a495b4f5a..6e279b9adc 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -19,6 +19,7 @@ This topic lists new and updated topics in the [Configure Windows 10](index.md) The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). The following new topics have been added: - [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +- [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) ## July 2017 | New or changed topic | Description | diff --git a/windows/configuration/kiosk-shared-pc.md b/windows/configuration/kiosk-shared-pc.md index 21d8d0d394..420e550a78 100644 --- a/windows/configuration/kiosk-shared-pc.md +++ b/windows/configuration/kiosk-shared-pc.md @@ -20,4 +20,4 @@ Some desktop devices in an enterprise serve a special purpose, such as a common | [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) | Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. | | [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | You can configure a device running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education as a kiosk device, so that users can only interact with a single application that you select. | | [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience. This topic provides guidelines to help you choose an approprate app for a kiosk device. | -| [Lock down Windows 10 to specific apps (AppLocker)](lock-down-windows-10-to-specific-apps.md) | Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to a kiosk device, but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. | \ No newline at end of file +| [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to a kiosk device, but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. | \ No newline at end of file diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md new file mode 100644 index 0000000000..398e2d77e9 --- /dev/null +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -0,0 +1,119 @@ +--- +title: Use AppLocker to create a Windows 10 kiosk that runs multiple apps (Windows 10) +description: Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions", "applocker"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: high +--- + +# Use AppLocker to create a Windows 10 kiosk that runs multiple apps + + +**Applies to** + +- Windows 10 + +Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education, version 1703 and earlier, so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. + +>[!NOTE] +>For devices running Windows 10, version 1709, we recommend the [multi-app kiosk method](lock-down-windows-10-to-specific-apps.md). + +You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. + +AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). + +This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. + +![install create lockdown customize](images/lockdownapps.png) + +## Install apps + + +First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. + +## Use AppLocker to set rules for apps + + +After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. + +1. Run Local Security Policy (secpol.msc) as an administrator. + +2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. + + ![configure rule enforcement](images/apprule.png) + +3. Check **Configured** under **Executable rules**, and then click **OK**. + +4. Right-click **Executable Rules** and then click **Automatically generate rules**. + + ![automatically generate rules](images/genrule.png) + +5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. + +6. Type a name to identify this set of rules, and then click **Next**. + +7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. + +8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. + +9. Read the message and click **Yes**. + + ![default rules warning](images/appwarning.png) + +10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. + +11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. + +12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: + + ``` syntax + sc config appidsvc start=auto + ``` + +13. Restart the device. + +## Other settings to lock down + + +In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: + +- Remove **All apps**. + + Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. + +- Hide **Ease of access** feature on the logon screen. + + Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. + +- Disable the hardware power button. + + Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. + +- Disable the camera. + + Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. + +- Turn off app notifications on the lock screen. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. + +- Disable removable media. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. + + **Note**   + To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. + +   + +To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). + +## Customize Start screen layout for the device (recommended) + + +Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). \ No newline at end of file diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c732e8f652..bb01d18c03 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -21,7 +21,7 @@ ms.localizationpriority: high A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. @@ -206,7 +206,21 @@ Under **Configs**, define which user account will be associated with the profile The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. + + +The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. +• Local account can be entered as `machinename\account` or `.\account` or just `account`. +• Domain account should be entered as `domain\account`. +• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. + +>[!WARNING] +>Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. + + Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. + +>[!NOTE] +>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. ```xml @@ -220,7 +234,6 @@ Before applying the multi-app configuration, make sure the specified user accoun - ## Add XML file to provisioning package @@ -240,105 +253,8 @@ Before applying the multi-app configuration, make sure the specified user accoun - -## old method (pre-1709) - -Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. - -You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. - -AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). - -This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. - -![install create lockdown customize](images/lockdownapps.png) - -### Install apps -First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. - -### Use AppLocker to set rules for apps - - -After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. - -1. Run Local Security Policy (secpol.msc) as an administrator. - -2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - - ![configure rule enforcement](images/apprule.png) - -3. Check **Configured** under **Executable rules**, and then click **OK**. - -4. Right-click **Executable Rules** and then click **Automatically generate rules**. - - ![automatically generate rules](images/genrule.png) - -5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. - -6. Type a name to identify this set of rules, and then click **Next**. - -7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. - -8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. - -9. Read the message and click **Yes**. - - ![default rules warning](images/appwarning.png) - -10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. - -11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. - -12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: - - ``` syntax - sc config appidsvc start=auto - ``` - -13. Restart the device. - -### Other settings to lock down - - -In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: - -- Remove **All apps**. - - Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. - -- Hide **Ease of access** feature on the logon screen. - - Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. - -- Disable the hardware power button. - - Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. - -- Disable the camera. - - Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. - -- Turn off app notifications on the lock screen. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. - -- Disable removable media. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. - - **Note**   - To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. - -   - -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). - -### Customize Start screen layout for the device (recommended) - - -Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md).   diff --git a/windows/configuration/lock-down-windows-10.md b/windows/configuration/lock-down-windows-10.md deleted file mode 100644 index 0bcecb6b1a..0000000000 --- a/windows/configuration/lock-down-windows-10.md +++ /dev/null @@ -1,15 +0,0 @@ ---- -title: Lock down Windows 10 (Windows 10) -description: Windows 10 provides a number of features and methods to help you lock down specific parts of a Windows 10 device. -ms.assetid: 955BCD92-0A1A-4C48-98A8-30D7FAF2067D -keywords: lockdown -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security, mobile -author: jdeckerms -ms.localizationpriority: high ---- - -# Lock down Windows 10 - diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md new file mode 100644 index 0000000000..a532786d85 --- /dev/null +++ b/windows/configuration/multi-app-kiosk-xml.md @@ -0,0 +1,364 @@ +--- +title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) +description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions", "applocker"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: high +--- + +# Create a Windows 10 kiosk that runs multiple apps + + +**Applies to** + +- Windows 10 + +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. + +>[!NOTE] +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. + +The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. + +>[!WARNING] +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. + + +Process: +1. [Create XML file](#create-xml-file) +2. [Add XML file to provisioning package](#add-xml) +3. [Apply provisioning package to device](#apply-ppkg) + +## Prerequisites + +- (latest version of WCD -- is Store version okay at GA?) +- kiosk device on 1709 + + +## Create XML file + +Let's start by looking at the basic structure of the XML file. + +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. + +- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. + +- Multiple config sections can be associated to the same profile. + +- A profile has no effect if it’s not associated to a config section. + + ![profile = app and config = account](images/profile-config.png) + +You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. + +```xml + + + + + + + + + + + + + + + + + + +``` + +### Profile + +A profile section in the XML has the following entries: + +- [**Id**](#id) + +- [**AllowedApps**](#allowedapps) + +- [**StartLayout**](#startlayout) + +- [**Taskbar**](#taskbar) + + +#### Id + +The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. + +```xml + + … + +``` + +#### AllowedApps + +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. + +Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. + +>[!NOTE] +>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). + +- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). +- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). + +Here are the predefined assigned access AppLocker rules for **UWP apps**: + +1. Default rule is to allow all users to launch the signed package apps. +2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. + + >[!NOTE] + >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + +Here are the predefined assigned access AppLocker rules for **desktop apps**: + +1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. +2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. +3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. + +The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. + +```xml + + + + + + + + + + + +``` + +#### StartLayout + +After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. + +The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). + +A few things to note here: + +- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. +- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. +- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. +- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). + +This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. + +```xml + + + + + + + + + + + + + + + + + + + + + + ]]> + +``` + +![What the Start screen looks like when the XML sample is applied](images/sample-start.png) + +#### Taskbar + +Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. + +The following example exposes the taskbar to the end user: + + `` + +The following example hides the taskbar: + + `` + +>[!NOTE] +>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. + +### Configs + +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. + +The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. + + + +The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. +• Local account can be entered as `machinename\account` or `.\account` or just `account`. +• Domain account should be entered as `domain\account`. +• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. + +>[!WARNING] +>Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. + + +Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. + +>[!NOTE] +>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. + + +```xml + + + MultiAppKioskUser + + + +``` + + + + +## Add XML file to provisioning package + + + + +## Apply provisioning package to device + + + +## Considerations for mixed-reality devices + +*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + + +#### placeholder for lnk + + + + +## old method (pre-1709) + +Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. + +You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. + +AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). + +This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. + +![install create lockdown customize](images/lockdownapps.png) + +### Install apps + + +First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. + +### Use AppLocker to set rules for apps + + +After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. + +1. Run Local Security Policy (secpol.msc) as an administrator. + +2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. + + ![configure rule enforcement](images/apprule.png) + +3. Check **Configured** under **Executable rules**, and then click **OK**. + +4. Right-click **Executable Rules** and then click **Automatically generate rules**. + + ![automatically generate rules](images/genrule.png) + +5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. + +6. Type a name to identify this set of rules, and then click **Next**. + +7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. + +8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. + +9. Read the message and click **Yes**. + + ![default rules warning](images/appwarning.png) + +10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. + +11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. + +12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: + + ``` syntax + sc config appidsvc start=auto + ``` + +13. Restart the device. + +### Other settings to lock down + + +In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: + +- Remove **All apps**. + + Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. + +- Hide **Ease of access** feature on the logon screen. + + Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. + +- Disable the hardware power button. + + Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. + +- Disable the camera. + + Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. + +- Turn off app notifications on the lock screen. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. + +- Disable removable media. + + Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. + + **Note**   + To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. + +   + +To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). + +### Customize Start screen layout for the device (recommended) + + +Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). + + +  + +  + + + + + From b2ee56a3681b00531d4939ccff35d672c2fdfa48 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:01:44 -0700 Subject: [PATCH 09/76] sync --- .../images/multiappassignedaccesssettings.png | Bin 0 -> 5081 bytes .../lock-down-windows-10-to-specific-apps.md | 62 +++ windows/configuration/multi-app-kiosk-xml.md | 421 +++++------------- 3 files changed, 177 insertions(+), 306 deletions(-) create mode 100644 windows/configuration/images/multiappassignedaccesssettings.png diff --git a/windows/configuration/images/multiappassignedaccesssettings.png b/windows/configuration/images/multiappassignedaccesssettings.png new file mode 100644 index 0000000000000000000000000000000000000000..86e2e0a451e756326fa5d8891cb4e8d50c361f20 GIT binary patch literal 5081 zcmbW5XHb({x5tA@5fnuZdISUkArL@Ba_B{BLKg@qB~qjX2oS1-&_o46i1c0zN(oI` zkd8`|-diY&n1qh>P;Wf<(>wFd+?o5~+5f%Pv)7uvo@eiw-`=ku8bB^Hb20+}fXmuY z4PyX+u9Mb>F)`5E{ea^Yn$US0L(~9e{oG45pM% z$9wI<;yVtnUWy%5a$GXMYW;#ES&x?){wBcOkC&w1RVcxAkL4eJAD-Ua7y8Q-)8hS+$n8Y>8YB zM^ur)o6=&j%MNEfSf3uZ4KTXll-~lobjTb64^RuSp>rh(`v&#>1OFC z_8DvCDB{0~kQP3F`*qA~0fkYIU~~lQl|~%zv}5RbpVQi#^(ViTtD0h#peGHTUpFQw z{dDdd>W+*kI7Lvrjd@<`@CR_)H$k{_)jgR!W1Tgh z4k${SD?8&9R}4}IUa6PZ=Srtq`rx6_OLyfFgogG~U^!*;G-&5r*g<6t*Q8(h*!<-7 z@BO9fsl0>lLG=e=RMu7oilw=^xy*bJ10!Q!t?-?(-9)npDL2ghN{hVD$F`!(Y&&vN zu8s+iGxD+bVmjFevUbDocckGZOKYi?5S0^Z9-X%yg!9pH;mZLf10T(pYr8$S^Ewtr zW??+R`t5<`JBWAWoA&k;UZ8yDMU{egz2`TE$Vb-09CiNAZ8`a;&n*W$)4uF_b&tF+ zS+4A|K!} z?t%9h_wa0=@K=^L=*)=5qg5r%1J~fCrx83EC#r!=syCG}b~Rl49-pjVf`c+fJKS$6 z5v7AjqZLR(=^=k%%S0KSL7IXa5kIplgI538GvY^-KHC4}>xU}$KkPs|4&G3eqlaG) z%F*JQHw@PuKjAve4F~~FU7?5-7Z;N7*hmS{;uaQP4r5PQM^`r7K zmt-JqAG1g9w_Kg87`T$E&L;d6{n?;5Gf-jPa9)<7`0>#dj+{o<*@T{In;7&M3!(tN zH~jEKocyI9`Qjc++gx?uu7IdbAMLPswQ!dK_#yYr%7(-F-0$d&Y_6h@wZjg+BJtZ_(=zncRO{t(P`{LOcmkCVMDGInjNDv;}iL8>ob=T9rpH z&yXD80iO+!0|Vi%Cp$*8g$K)6#~GG*O+n$u(vr|1L)Hd1vx1?b$_H(X!VUAwbCE!jtZ(>%*;R)_FFk_Oc4nGbgxz&rmaZ3B{gIa*2YA63G>m*Q@5&-2nCN; zfoK$tK}oT-;VNhwz+!zwGQC0!YW+oRBYcLP%sxK}EgQtic7M6FzBoTAG2IXwx0JFi ziDlvfe)_YY4)R5>o>9|z0^`)B7!E~F!APIwv~eA2g|+R?`EqpwzHIRBgoM}6%xod5 zd0!7cGw)42mszY(O@r0|P;hiR+#1BVo%QI3K)!rDgpv*B&OfRI!Kvm4C@mO${sl(Ewcnz958X0*56G( z;P+gqD^OeN=^L@JmM%JMpg*F6zY|2kitd_!GD3nY2N#vF2Y1ACO>TG@*bG8c)4JO?qD;O7EZf>^+h`~h(kA&2v)k)gu=JdbBo+Walg6$hr4m|Efq`c6;N{mm6yiVQg z%(wZcd}-s|>Cn(;(x3|0Yp(+k$KOOh9(NsS2E>&u+`^NZHG9kLrFi5>`62uAj4Cm< zwV&rsi#Hti^3=dVCHLq18<3=BbcB~WTfZ?k-lJ>vu}4SDv+SW?)gk6zW=7x`&wpI_ zRQVm7@uy;$_<+qk72EYb6|0J#j!t#aN#h9>=oNaFV0-)1yx?Z}lpF^vbKR4avAVt< z^orw5q+HQ#AI1=0r!I1S==ck#I8ZajB~I^|Pw(Eu{gi{-V*(u3g`|TpKa3 zl9v`4T<<+#FjjF(XL(3hX0HTURazAAd2<2VnqBWkbScxv4S05_)#@@L8-Ao-S}mcA z*S-=l-P&aEqRI9n@VPY`#46~CUPNUz`U3!b;^E;oQl zROS$jidS*TQ7rL16+%JAMdb&@!5Nj2mbzfgicfj3Q(?8-;;((Aa8wCJy&OEoJR)+ZaU)cE}$FwV8>t81a z)hY#OpdAD0{(T=9hs-iF4Kd~4amun6k>yqz-0`yD_}{D^xM6&g4EYaQRmauZ_5a~6 z3i$s;TyY_M_nCZdWUM;dm0Dw=tL%Ndp zi&*a8$_ZeP*i{XSH{4Z;@DebyX_H>cb!zIA-eqh5FJ7Bz3vi2^{tR*bno4N<0zcfP z_-l#DZig@jMArwYeyXV6-mtRxS534V;do8;0{RWfIVcDol&tm1iu9QKvYJFVuP$tR zWW}d8Rnig=y6*KR-(3X(qJ=jaLmv-{TorRGPig2Ziz_a(_ho)I9NV2@tKGXC&%0X0FVyCk8+>ZIK%?| zg~X$OLO*lhL2%I+V?L8S`l`+t22KL~Yt9JW>W>d`Ka{g@Zf`)KYT4`pJt4!NKH>ON zK5f_RT(6{!p|``j^7%$~cMX)RbM2;LX(x(FD>B@%fYq1UE7iCKh4-SgeUqt}AmmeX zwcV<6mJhMTu&9~x*Ago1-iAr9cK43fY*jk(SRIFqlPC7P6%rB)ijHt6b|Y4iubzmo z>pEZ2IWyiRdKmV(@%=agf!GAA>2}`FgJ)l>tsCQwIiUwQCsE6R2>S)G%ilV-#Ioe1 zbgL4~>P`2kB9j7(^l3d+PL$pfV9_=>VDS=tMgl2yb-(N~@BT>rabxLUr12YzmpGPK z6taNlq?LxyZEr<}XFnji9SaZ$C6MN~FJ6eaj_r86o`+8mm1~sig+8yHwLa`5JEKv( z{`ha5Z&HiNzlt7;CGcWQ%Z(6VC_DasMM6t;VUO?;r%CW?qxm9)yz_ha=3U^?5ujMi z${GY8c`mqs>K7FVAw_n;_%t7Oe$r3TlVgTGRlNumZUOaN=Cr=QZNQb;$8BSq+~P-si3AHYtpo*U&#=0bCsjN>}{QzJx(W1*b?gygW*P z4d{0JMtSkSDL9w~i%deWW$alK{4!v$+Wra&vb$}Hza@b0bxq4C?;q|OyvjoP2d_UX zJrN9X(hSr5yEvd~gKhRMjPkrZeYU_CWe;o1Rjd@ZL24OCa7&6*X>UB2Zpzwu8hmK%L!~A&#R%rT(-)(PS(&QV3!BZk+z(m zw^O|_K1r14O~T|O#7uCxJ(EfCsZ2Q@iw0wqSU=$D{ZN!sV8(8ht;sxsb0_qg)}uo zr`YB#E{o|zoAZ>W>2tByFggsX-HEolV^`XB()5>0Tk}hKRg zl6mBc1mJf<+kx|998?)XNK*xttxicvdZ&r54klT$l6tpyp{&l{QZ6v z^jEhO!{2ts;l32Io08Y2|($`(17>m`Cp*I{y8dV`1v+=}!ODzu)Q3)%YoNj_dF9@qQ1| zdOY@>|MA-d=H|2B9lN*J%HCW+jOEk*bR;m8LL1(uhu2S@%nBeS8i!^<-Z()Yf5MO}G zk6$JnQWe-dP;oLU7v;65Lz2`PgyW|Gmgi4RW3@KRz1#%j7osE4s^mglW*L4Q10Xc! z9BKya*Bz%4AB+6Cz<%}RE)jBCm{W8?&KCff1S^4Jx5&hW;biSj`7p(SC%3~#pO7U* zjhn782oSHmhp9@8R-mZFZ&2Dm8(=8C98DiE|3|=oV}*b3mqM> ## Add XML file to provisioning package +Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md). +Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) + +>[!IMPORTANT] +>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + +1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). + +2. Choose **Advanced provisioning**. + +3. Name your project, and click **Next**. + +4. Choose **All Windows desktop editions** and click **Next**. + +5. On **New project**, click **Finish**. The workspace for your package opens. + +6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. + +7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. + +7. Save your project and close Windows Configuration Designer. + +7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) + +7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: + + ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) + +7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). + +8. Save and close the customizations.xml file. + +8. Open Windows Configuration Designer and open your project. + +8. On the **File** menu, select **Save.** + +9. On the **Export** menu, select **Provisioning package**. + +10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** + +11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. + + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + +12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. + + Optionally, you can click **Browse** to change the default output location. + +13. Click **Next**. + +14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. + + If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. + +15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. + + If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. + + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. ## Apply provisioning package to device diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md index a532786d85..642995cf1e 100644 --- a/windows/configuration/multi-app-kiosk-xml.md +++ b/windows/configuration/multi-app-kiosk-xml.md @@ -1,6 +1,6 @@ --- -title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) -description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +title: Multi-app kiosk XML reference (Windows 10) +description: XML and XSD for multi-app kiosk device configuration. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 @@ -8,128 +8,24 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security author: jdeckerms -ms.localizationpriority: high +ms.localizationpriority: medium --- -# Create a Windows 10 kiosk that runs multiple apps +# Multi-app kiosk XML reference **Applies to** - Windows 10 -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. - ->[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](#1703) to configure a multi-app kiosk. - -The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. - ->[!WARNING] ->The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. - - -Process: -1. [Create XML file](#create-xml-file) -2. [Add XML file to provisioning package](#add-xml) -3. [Apply provisioning package to device](#apply-ppkg) - -## Prerequisites - -- (latest version of WCD -- is Store version okay at GA?) -- kiosk device on 1709 - - -## Create XML file - -Let's start by looking at the basic structure of the XML file. - -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. - -- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - -- Multiple config sections can be associated to the same profile. - -- A profile has no effect if it’s not associated to a config section. - - ![profile = app and config = account](images/profile-config.png) - -You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. +## Full XML sample ```xml - - - - - - - - - - - - - - - - -``` - -### Profile - -A profile section in the XML has the following entries: - -- [**Id**](#id) - -- [**AllowedApps**](#allowedapps) - -- [**StartLayout**](#startlayout) - -- [**Taskbar**](#taskbar) - - -#### Id - -The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. - -```xml - - … - -``` - -#### AllowedApps - -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. - -Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. - ->[!NOTE] ->You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). - -- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). -- For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). - -Here are the predefined assigned access AppLocker rules for **UWP apps**: - -1. Default rule is to allow all users to launch the signed package apps. -2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. - - >[!NOTE] - >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. - -Here are the predefined assigned access AppLocker rules for **desktop apps**: - -1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. -2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. -3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. - -The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device. - -```xml - + + + @@ -140,25 +36,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula -``` - -#### StartLayout - -After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. - -The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). - -A few things to note here: - -- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. -- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. -- There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. -- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). - -This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. - -```xml - + @@ -181,184 +59,115 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ]]> -``` - -![What the Start screen looks like when the XML sample is applied](images/sample-start.png) - -#### Taskbar - -Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. - -The following example exposes the taskbar to the end user: - - `` - -The following example hides the taskbar: - - `` - ->[!NOTE] ->This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. - -### Configs - -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. - -The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. - - - -The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. -• Local account can be entered as `machinename\account` or `.\account` or just `account`. -• Domain account should be entered as `domain\account`. -• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. - ->[!WARNING] ->Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. - - -Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. - ->[!NOTE] ->For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. - - -```xml - + + + + MultiAppKioskUser - + + ``` - - - -## Add XML file to provisioning package - - - - -## Apply provisioning package to device - - - -## Considerations for mixed-reality devices - -*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* - - -#### placeholder for lnk - - - - -## old method (pre-1709) - -Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to [a kiosk device](set-up-a-device-for-anyone-to-use.md), but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. - -You can restrict users to a specific set of apps on a device running Windows 10 Enterprise or Windows 10 Education by using [AppLocker](/windows/device-security/applocker/applocker-overview). AppLocker rules specify which apps are allowed to run on the device. - -AppLocker rules are organized into collections based on file format. If no AppLocker rules for a specific rule collection exist, all files with that file format are allowed to run. However, when an AppLocker rule for a specific rule collection is created, only the files explicitly allowed in a rule are permitted to run. For more information, see [How AppLocker works](/windows/device-security/applocker/how-applocker-works-techref). - -This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. - -![install create lockdown customize](images/lockdownapps.png) - -### Install apps - - -First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. - -### Use AppLocker to set rules for apps - - -After you install the desired apps, set up AppLocker rules to only allow specific apps, and block everything else. - -1. Run Local Security Policy (secpol.msc) as an administrator. - -2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - - ![configure rule enforcement](images/apprule.png) - -3. Check **Configured** under **Executable rules**, and then click **OK**. - -4. Right-click **Executable Rules** and then click **Automatically generate rules**. - - ![automatically generate rules](images/genrule.png) - -5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. - -6. Type a name to identify this set of rules, and then click **Next**. - -7. On the **Rule Preferences** page, click **Next**. Be patient, it might take awhile to generate the rules. - -8. On the **Review Rules** page, click **Create**. The wizard will now create a set of rules allowing the installed set of apps. - -9. Read the message and click **Yes**. - - ![default rules warning](images/appwarning.png) - -10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. - -11. (optional) If rules were generated for apps that should not be run, you can delete them by right-clicking on the rule and selecting **Delete**. - -12. Before AppLocker will enforce rules, the **Application Identity** service must be turned on. To force the Application Identity service to automatically start on reset, open a command prompt and run: - - ``` syntax - sc config appidsvc start=auto - ``` - -13. Restart the device. - -### Other settings to lock down - - -In addition to specifying the apps that users can run, you should also restrict some settings and functions on the device. For a more secure experience, we recommend that you make the following configuration changes to the device: - -- Remove **All apps**. - - Go to **Group Policy Editor** > **User Configuration** > **Administrative Templates\\Start Menu and Taskbar\\Remove All Programs list from the Start menu**. - -- Hide **Ease of access** feature on the logon screen. - - Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. - -- Disable the hardware power button. - - Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. - -- Disable the camera. - - Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. - -- Turn off app notifications on the lock screen. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. - -- Disable removable media. - - Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation. - - **Note**   - To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. - -   - -To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). - -### Customize Start screen layout for the device (recommended) - - -Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). - - -  - -  - - - - - +## XSD for AssignedAccess configuration XML + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` \ No newline at end of file From ecf0396ff22eff74f32d69c6ba54703b68b2ca03 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:11:19 -0700 Subject: [PATCH 10/76] sync --- ...-by-using-provisioning-packages-and-icd.md | 2 +- .../lock-down-windows-10-to-specific-apps.md | 24 +++++++++---------- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index c4a13cef3a..18f215ad22 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -100,7 +100,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. 12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index eec365b65e..302ba40b43 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -183,6 +183,10 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ``` +>[!NOTE] +>If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. + + ![What the Start screen looks like when the XML sample is applied](images/sample-start.png) #### Taskbar @@ -256,21 +260,13 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**. -7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. +7. In the center pane, click **Browse** to locate and select the assigned access configuration XML file that you created. -7. Save your project and close Windows Configuration Designer. + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) +8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - - ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) - -7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). - -8. Save and close the customizations.xml file. - -8. Open Windows Configuration Designer and open your project. +8. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. 8. On the **File** menu, select **Save.** @@ -282,7 +278,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. 12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. @@ -300,6 +296,8 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. + +15. Copy the provisioning package to the root directory of a USB drive. ## Apply provisioning package to device From 20d7e2954a06b99f18c97b747c2f8274b14aa29b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:41:26 -0700 Subject: [PATCH 11/76] sync --- .../lock-down-windows-10-to-specific-apps.md | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 302ba40b43..0aa83ed072 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -302,6 +302,47 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ## Apply provisioning package to device +Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime"). + + +### During initial setup, from a USB drive + +1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. + + ![The first screen to set up a new PC](../images/oobe.jpg) + +2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. + + ![Set up device?](../images/setupmsg.jpg) + +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. + + ![Provision this device](../images/prov.jpg) + +4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. + + ![Choose a package](../images/choose-package.png) + +5. Select **Yes, add it**. + + ![Do you trust this package?](../images/trust-package.png) + + + +### After setup, from a USB drive, network folder, or SharePoint site + +1. Sign in with an admin account. +2. Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. + +>[!NOTE] +>if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. + +![add a package option](../images/package.png) + +### Validate provisioning + +- Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. +- Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. ## Considerations for mixed-reality devices From 7afa9eded4414290970ef1ee5326b906200bd5e7 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 10:58:32 -0700 Subject: [PATCH 12/76] fix image links --- .../lock-down-windows-10-to-specific-apps.md | 93 +++++++++++++++++-- 1 file changed, 83 insertions(+), 10 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 0aa83ed072..c25edb0187 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -213,9 +213,9 @@ The full multi-app assigned access experience can only work for non-admin users. The account can be local, domain, or Azure Active Directory (Azure AD). Groups are not supported. -• Local account can be entered as `machinename\account` or `.\account` or just `account`. -• Domain account should be entered as `domain\account`. -• Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. +- Local account can be entered as `machinename\account` or `.\account` or just `account`. +- Domain account should be entered as `domain\account`. +- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. >[!WARNING] >Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. @@ -309,23 +309,23 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](../images/oobe.jpg) + ![The first screen to set up a new PC](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. - ![Set up device?](../images/setupmsg.jpg) + ![Set up device?](images/setupmsg.jpg) 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](../images/prov.jpg) + ![Provision this device](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](../images/choose-package.png) + ![Choose a package](images/choose-package.png) 5. Select **Yes, add it**. - ![Do you trust this package?](../images/trust-package.png) + ![Do you trust this package?](images/trust-package.png) @@ -337,20 +337,93 @@ Provisioning packages can be applied to a device during the first-run experience >[!NOTE] >if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. -![add a package option](../images/package.png) +![add a package option](images/package.png) ### Validate provisioning - Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. - Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. +### Validate multi-app kiosk configuration + +Sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. + +>[!NOTE] +>The setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience. + +The following sections explain what to expect on a multi-app kiosk. + +#### App launching and switching experience + +In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. + +The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. + +#### Start changes + +When the assigned access user signs in, you should see a restricted Start experience: +- Start gets launched in full screen and prevents the end user from accessing the desktop. +- Start shows the layout aligned with what you defined in the multi-app configuration XML. +- Start prevents the end user from changing the tile layout. + - The user cannot resize, reposition, and unpin the tiles. + - The user cannot pin additional tiles on the start. +- Start hides **All Apps** list. +- Start hides all the folders on Start (including File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal folders). +- Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start).) +- Start hides **Change account settings** option under **User** button. + +#### Taskbar changes + +If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: +- Disables context menu of Start button (Quick Link) +- Disables context menu of taskbar +- Prevents the end user from changing the taskbar +- Disables Cortana and Search Windows +- Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace +- Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings + +#### Blocked hotkeys + +The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. + +| Hotkey | Action | +| --- | --- | +| Windows logo key + A | Open Action center | +| Windows logo key + Shift + C | Open Cortana in listening mode | +| Windows logo key + D | Display and hide the desktop | +| Windows logo key + Alt + D | Display and hide the date and time on the desktop | +| Windows logo key + E | Open File Explorer | +| Windows logo key + F | Open Feedback Hub | +| Windows logo key + G | Open Game bar when a game is open | +| Windows logo key + I | Open Settings | +| Windows logo key + J | Set focus to a Windows tip when one is available. | +| Windows logo key + O | Lock device orientation | +| Windows logo key + Q | Open search | +| Windows logo key + R | Open the Run dialog box | +| Windows logo key + S | Open search | +| Windows logo key + X | Open the Quick Link menu | +| Windows logo key + comma (,) | Temporarily peek at the desktop | +| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | + + +#### Locked-down Ctrl+Alt+Del screen + +The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. + + + + + + + + ## Considerations for mixed-reality devices *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* -#### placeholder for lnk +## placeholder for lnk From 9fef01eed8d22124633263f9ba3634f8d14dbb01 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 12:31:38 -0700 Subject: [PATCH 13/76] test table --- .../lock-down-windows-10-to-specific-apps.md | 48 ++++++++++++++++++- 1 file changed, 46 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c25edb0187..61203cce6c 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -206,7 +206,7 @@ The following example hides the taskbar: ### Configs -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or MDM policies set as part of the multi-app experience. +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. @@ -406,12 +406,14 @@ The multi-app mode blocks the following hotkeys, which are not relevant for the | Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | + #### Locked-down Ctrl+Alt+Del screen The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. +#### Auto-trigger touch keyboard - +In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. @@ -422,10 +424,52 @@ The multi-app mode removes options (e.g. **Change a password**, **Task Manager** *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* + ## placeholder for lnk +## Policies set by multi-app kiosk configuration + +### Group Policy + +The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users. + +| Setting | Value | +| --- | --- | +Remove access to the context menus for the task bar | Enabled +Clear history of recently opened documents on exit | Enabled +Prevent users from customizing their Start Screen | Enabled +Prevent users from uninstalling applications from Start | Enabled +Remove All Programs list from the Start menu | Enabled +Remove Run menu from Start Menu | Enabled +Disable showing balloon notifications as toast | Enabled +Do not allow pinning items in Jump Lists | Enabled +Do not allow pinning programs to the Taskbar | Enabled +Do not display or track items in Jump Lists from remote locations | Enabled +Remove Notifications and Action Center | Enabled +Lock all taskbar settings | Enabled +Lock the Taskbar | Enabled +Prevent users from adding or removing toolbars | Enabled +Prevent users from resizing the taskbar | Enabled +Remove frequent programs list from the Start Menu | Enabled +Remove Pinned programs from the taskbar | Enabled +Remove the Security and Maintenance icon | Enabled +Turn off all balloon notifications | Enabled +Turn off feature advertisement balloon notifications | Enabled +Turn off toast notifications | Enabled +Remove Task Manager | Enabled +Remove Change Password option in Security Options UI | Enabled +Remove Sign Out option in Security Options UI | Enabled +Remove All Programs list from the Start Menu | Enabled – Remove and disable setting +Prevent access to drives from My Computer | Enabled - Restrict all drivers + + + + + +### MDM policy + From ed412a7a5e6f06098c5a9d01216e1f4e798e04cd Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 8 Aug 2017 12:59:56 -0700 Subject: [PATCH 14/76] lnk files --- .../lock-down-windows-10-to-specific-apps.md | 28 +++++++++++++++---- 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 61203cce6c..fdc42e2380 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -425,8 +425,7 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t *There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* - -## placeholder for lnk + ## Policies set by multi-app kiosk configuration @@ -471,15 +470,32 @@ Prevent access to drives from My Computer | Enabled - Restrict all drivers ### MDM policy +Some of the MDM policies affect all users on the system (i.e. system-wide). +Setting | Value | System-wide + --- | --- | --- +Experience/AllowCortana | Disabled | Yes +Start/AllowPinnedFolderSettings | Disabled | Yes +Start/HidePeopleBar | Enabled | Yes +Start/HideChangeAccountSettings | Enabled | Yes +WindowsInkWorkspace/AllowWindowsInkWorkspace | Disabled | Yes +Start/StartLayout | Configuration dependent | No +WindowsLogon/DontDisplayNetworkSectionUI | Enabled | Yes + +## Provision .lnk files using Windows Configuration Designer +First, create your desktop app's shortcut file by installing the app on a test device. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `.lnk` -  - -  - +Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install. +``` +msiexec /I ".msi" /qn /norestart +copy .lnk "%AllUsersProfile\Microsoft\Windows\Start Menu\Programs\.lnk" +``` +In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceContext**: +- Under CommandFiles, upload your batch file, your .lnk file, and your desktop app installation file +- Under CommandLine, enter cmd /c .bat From 37f226072848bb36e2dbad17d70eb95849e5f189 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 9 Aug 2017 06:54:32 -0700 Subject: [PATCH 15/76] Edu or Ent --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index fdc42e2380..3eab3df448 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -37,7 +37,7 @@ Process: ## Prerequisites - (latest version of WCD -- is Store version okay at GA?) -- kiosk device on 1709 +- The kiosk device must be running Windows 10 (Enterprise or Education), version 1709 ## Create XML file From 0b0cf6d2edfa9d1454141905f75680762e0935f6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 9 Aug 2017 12:37:23 -0700 Subject: [PATCH 16/76] Johnson feedback --- .../lock-down-windows-10-to-specific-apps.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 3eab3df448..47da3a434e 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -37,7 +37,7 @@ Process: ## Prerequisites - (latest version of WCD -- is Store version okay at GA?) -- The kiosk device must be running Windows 10 (Enterprise or Education), version 1709 +- The kiosk device must be running Windows 10 (Pro, Enterprise, or Education), version 1709 ## Create XML file @@ -195,11 +195,15 @@ Define whether you want to have the taskbar present in the kiosk device. For tab The following example exposes the taskbar to the end user: - `` +```xml + +``` The following example hides the taskbar: - `` +```xml + +``` >[!NOTE] >This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. From 87a2d0a7d0408baf31ee5cf1532594df9c9c7246 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 07:04:27 -0700 Subject: [PATCH 17/76] Evan feedback --- .../lock-down-windows-10-to-specific-apps.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 47da3a434e..6f1dbb4855 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -480,7 +480,7 @@ Setting | Value | System-wide --- | --- | --- Experience/AllowCortana | Disabled | Yes Start/AllowPinnedFolderSettings | Disabled | Yes -Start/HidePeopleBar | Enabled | Yes +Start/HidePeopleBar | Enabled | No Start/HideChangeAccountSettings | Enabled | Yes WindowsInkWorkspace/AllowWindowsInkWorkspace | Disabled | Yes Start/StartLayout | Configuration dependent | No @@ -495,11 +495,11 @@ Next, create a batch file with two commands. If the desktop app is already insta ``` msiexec /I ".msi" /qn /norestart -copy .lnk "%AllUsersProfile\Microsoft\Windows\Start Menu\Programs\.lnk" +copy .lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\.lnk" ``` In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceContext**: -- Under CommandFiles, upload your batch file, your .lnk file, and your desktop app installation file -- Under CommandLine, enter cmd /c .bat +- Under **CommandFiles**, upload your batch file, your .lnk file, and your desktop app installation file +- Under **CommandLine**, enter cmd /c *FileName*.bat From ed13ede835e8e1b2d493cfa1cdf80e32802cefc2 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 07:09:26 -0700 Subject: [PATCH 18/76] Chandler feedback --- .../lock-down-windows-10-to-specific-apps.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 6f1dbb4855..0f9c3e2e49 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -44,7 +44,7 @@ Process: Let's start by looking at the basic structure of the XML file. -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run. +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. - A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. @@ -96,8 +96,8 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can ```xml - … - + … + ``` #### AllowedApps @@ -139,7 +139,7 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula - + ``` #### StartLayout @@ -180,7 +180,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ]]> - + ``` >[!NOTE] @@ -222,7 +222,7 @@ The account can be local, domain, or Azure Active Directory (Azure AD). Groups a - Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. >[!WARNING] ->Although **Start** > **Settings** > **Accounts** > **Other users** > **Set up assigned access** only supports specifying a local user account, Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. +>Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. @@ -233,11 +233,11 @@ Before applying the multi-app configuration, make sure the specified user accoun ```xml - - MultiAppKioskUser - - - + + MultiAppKioskUser + + + ``` From fff16fccbb7870a0c3303141f082f75aa1bbd94d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 07:29:04 -0700 Subject: [PATCH 19/76] Chandler feedback --- .../lock-down-windows-10-to-specific-apps.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 0f9c3e2e49..851affbd69 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -474,17 +474,17 @@ Prevent access to drives from My Computer | Enabled - Restrict all drivers ### MDM policy -Some of the MDM policies affect all users on the system (i.e. system-wide). +Some of the MDM policies based on the [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (i.e. system-wide). Setting | Value | System-wide --- | --- | --- -Experience/AllowCortana | Disabled | Yes -Start/AllowPinnedFolderSettings | Disabled | Yes -Start/HidePeopleBar | Enabled | No -Start/HideChangeAccountSettings | Enabled | Yes -WindowsInkWorkspace/AllowWindowsInkWorkspace | Disabled | Yes +Experience/AllowCortana | 0 - Not allowed | Yes +Start/AllowPinnedFolderSettings | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +Start/HidePeopleBar | 1 - True (hide) | No +Start/HideChangeAccountSettings | 1 - True (hide) | Yes +WindowsInkWorkspace/AllowWindowsInkWorkspace | 0 - Access to ink workspace is disabled and the feature is turned off | Yes Start/StartLayout | Configuration dependent | No -WindowsLogon/DontDisplayNetworkSectionUI | Enabled | Yes +WindowsLogon/DontDisplayNetworkSelectionUI | <Enabled/> | Yes ## Provision .lnk files using Windows Configuration Designer From e216a81eb02c29097cd41a4670d5099b936d79f8 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:33:05 -0700 Subject: [PATCH 20/76] new troubleshooting topic multi-app --- windows/configuration/TOC.md | 1 + .../multi-app-kiosk-troubleshoot.md | 50 +++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 windows/configuration/multi-app-kiosk-troubleshoot.md diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 4166b7475b..e418e5df3f 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -9,6 +9,7 @@ ### [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) ### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) ### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +#### [Troubleshoot multi-app kiosk](multi-app-kiosk-troubleshoot.md) #### [Use AppLocker to create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-applocker.md) #### [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md new file mode 100644 index 0000000000..9f065e2414 --- /dev/null +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -0,0 +1,50 @@ +--- +title: Troubleshoot multi-app kiosk (Windows 10) +description: Tips for troubleshooting multi-app kiosk configuration. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: medium +--- + +# Troubleshoot multi-app kiosk + + +**Applies to** + +- Windows 10 + +## Unexpected results + +For example: +- Start is not launched in full-screen +- Blocked hotkeys are allowed +- Task Manager, Cortana, or Settings can be launched +- Start layout has more apps than expected + +**Troubleshooting steps** + +1. [Verify that the provisioning package is applied successfully](lock-down-windows-10-to-specific-apps.md#validate-provisioning). +2. Verify that the account (config) is mapped to a profile in the configuration XML file. +3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. +4. If the issue persists, [capture traces](https://msdn.microsoft.com/library/windows/desktop/dn904629.aspx) for components with the following GUIDs: + - 94097d3d-2a5a-5b8a-cdbd-194dd2e51a00 + - ab84611c-2678-5cd7-d292-c940f9be6c6d + - f9f7f27c-5e5d-5273-468f-038e61965660 + - 3e8fb07b-3e10-5981-01a9-fbd924fd5436 + +## Apps configured in AllowedList are blocked + +1. Ensure the account is mapped to the correct profile and that the apps are specific for that profile. +2. Check the EventViewer logs for Applocker and AppxDeployment (under **Application and Services Logs\Microsoft\Windows**). + + +## Start layout not as expected + +- Make sure the Start layout is authored correctly. Ensure that the attributes **Size**, **Row**, and **Column** are specified for each application and are valid. +- Check if the apps included in the Start layout are installed for the assigned access user. +- Check if the shortcut exists on the target device, if a desktop app is missing on Start. From a756d2c12fc071651ff60efbb189fd9143e22c25 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:35:53 -0700 Subject: [PATCH 21/76] plus feedback --- windows/configuration/multi-app-kiosk-troubleshoot.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 9f065e2414..2e4d7088da 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -48,3 +48,7 @@ For example: - Make sure the Start layout is authored correctly. Ensure that the attributes **Size**, **Row**, and **Column** are specified for each application and are valid. - Check if the apps included in the Start layout are installed for the assigned access user. - Check if the shortcut exists on the target device, if a desktop app is missing on Start. + +## Feedback + +Feedback and bugs can be submitted in the Feedback Hub. You can use the Problems Steps Recorder to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file From 3b96acd451e306aa12d1c1e3dde8bbadff17e464 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:37:01 -0700 Subject: [PATCH 22/76] add link --- windows/configuration/multi-app-kiosk-troubleshoot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 2e4d7088da..6d9ef040cc 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -51,4 +51,4 @@ For example: ## Feedback -Feedback and bugs can be submitted in the Feedback Hub. You can use the Problems Steps Recorder to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file +Feedback and bugs can be submitted in the Feedback Hub. You can use the [Problems Steps Recorder](https://support.microsoft.com/help/22878/windows-10-record-steps) to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file From 9fbecd8f17baccaae5ce699651f437a03f1dd246 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 10 Aug 2017 12:41:06 -0700 Subject: [PATCH 23/76] add policy links --- .../lock-down-windows-10-to-specific-apps.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 851affbd69..da932fc46b 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -478,13 +478,13 @@ Some of the MDM policies based on the [Policy configuration service provider (CS Setting | Value | System-wide --- | --- | --- -Experience/AllowCortana | 0 - Not allowed | Yes -Start/AllowPinnedFolderSettings | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes +[Start/AllowPinnedFolderSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes Start/HidePeopleBar | 1 - True (hide) | No -Start/HideChangeAccountSettings | 1 - True (hide) | Yes -WindowsInkWorkspace/AllowWindowsInkWorkspace | 0 - Access to ink workspace is disabled and the feature is turned off | Yes -Start/StartLayout | Configuration dependent | No -WindowsLogon/DontDisplayNetworkSelectionUI | <Enabled/> | Yes +[Start/HideChangeAccountSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes +[WindowsInkWorkspace/AllowWindowsInkWorkspace](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes +[Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No +[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes ## Provision .lnk files using Windows Configuration Designer From aa9bb660860770c7285d390d73643f46c40226fb Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 06:36:54 -0700 Subject: [PATCH 24/76] sync --- .../lock-down-windows-10-to-specific-apps.md | 39 ++++++++++++++----- 1 file changed, 30 insertions(+), 9 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index da932fc46b..41c14f7bac 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,6 +1,6 @@ --- title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) -description: Learn how to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. +description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 @@ -34,10 +34,12 @@ Process: 2. [Add XML file to provisioning package](#add-xml) 3. [Apply provisioning package to device](#apply-ppkg) +If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#alternate-methods) or you can configure assigned access using the [MDM Bridge WMI Provider](#bridge). + ## Prerequisites - (latest version of WCD -- is Store version okay at GA?) -- The kiosk device must be running Windows 10 (Pro, Enterprise, or Education), version 1709 +- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 ## Create XML file @@ -343,12 +345,31 @@ Provisioning packages can be applied to a device during the first-run experience ![add a package option](images/package.png) + + ### Validate provisioning - Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. - Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. -### Validate multi-app kiosk configuration + + +## Use MDM to deploy the multi-app configuration + + +Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML. + +If your test device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely. + +The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`. + + + +## Use MDM Bridge WMI Provider to configure assigned access + + + +## Validate multi-app kiosk configuration Sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. @@ -357,13 +378,13 @@ Sign in with the assigned access user account you specified in the configuration The following sections explain what to expect on a multi-app kiosk. -#### App launching and switching experience +### App launching and switching experience In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. -#### Start changes +### Start changes When the assigned access user signs in, you should see a restricted Start experience: - Start gets launched in full screen and prevents the end user from accessing the desktop. @@ -376,7 +397,7 @@ When the assigned access user signs in, you should see a restricted Start experi - Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start).) - Start hides **Change account settings** option under **User** button. -#### Taskbar changes +### Taskbar changes If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: - Disables context menu of Start button (Quick Link) @@ -386,7 +407,7 @@ If the applied multi-app configuration enables taskbar, when the assigned access - Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace - Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings -#### Blocked hotkeys +### Blocked hotkeys The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. @@ -411,11 +432,11 @@ The multi-app mode blocks the following hotkeys, which are not relevant for the -#### Locked-down Ctrl+Alt+Del screen +### Locked-down Ctrl+Alt+Del screen The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. -#### Auto-trigger touch keyboard +### Auto-trigger touch keyboard In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. From 6b9c893a165dd1f242f418767bc40f827fa31077 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:10:37 -0700 Subject: [PATCH 25/76] add WMI Bridge --- .../lock-down-windows-10-to-specific-apps.md | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 41c14f7bac..c8b830041f 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -367,6 +367,72 @@ The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configu ## Use MDM Bridge WMI Provider to configure assigned access +Environments that use WMI can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. See [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider) for more details about using a PowerShell script to configure AssignedAccess. + +Here’s an example to set AssignedAccess configuration: + +1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). +2. Run `psexec.exe -i -s cmd.exe`. +3. **WHAT GOES HERE? DOC JUST SAYS "powershell"** +4. Execute the following script: + +```ps +$nameSpaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = @" +<?xml version="1.0" encoding="utf-8" ?> +<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> + <Profiles> + <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"> + <AllAppsList> + <AllowedApps> + <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> + <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> + <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> + <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> + <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> + <App DesktopAppPath="%windir%\system32\mspaint.exe" /> + <App DesktopAppPath="C:\Windows\System32\notepad.exe" /> + </AllowedApps> + </AllAppsList> + <StartLayout> + <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"> + <LayoutOptions StartTileGroupCellWidth="6" /> + <DefaultLayoutOverride> + <StartLayoutCollection> + <defaultlayout:StartLayout GroupCellWidth="6"> + <start:Group Name="Group1"> + <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> + <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> + <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> + <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> + <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> + </start:Group> + <start:Group Name="Group2"> + <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" /> + <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" /> + </start:Group> + </defaultlayout:StartLayout> + </StartLayoutCollection> + </DefaultLayoutOverride> + </LayoutModificationTemplate> + ]]> + </StartLayout> + <Taskbar ShowTaskbar="true"/> + </Profile> + </Profiles> + <Configs> + <Config> + <Account>MultiAppKioskUser</Account> + <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> + </Config> + </Configs> +</AssignedAccessConfiguration> +"@ + +Set-CimInstance -CimInstance $obj +``` ## Validate multi-app kiosk configuration From bc67748390c8a8b2da57ac3d9e895b48451fad55 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:38:20 -0700 Subject: [PATCH 26/76] Lily feedback --- .../lock-down-windows-10-to-specific-apps.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c8b830041f..cb6ea2db23 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -224,13 +224,13 @@ The account can be local, domain, or Azure Active Directory (Azure AD). Groups a - Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. >[!WARNING] ->Assigned Access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the Assigned Access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with Assigned Access, and consider the domain resources potentially exposed by the decision to do so. +>Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. >[!NOTE] ->For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for AssignedAccess. +>For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. ```xml @@ -521,6 +521,11 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t ## Policies set by multi-app kiosk configuration +It is not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience. + +When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. + + ### Group Policy The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users. From 2d85f06145509ee674f5d7f339823568804160a5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:45:12 -0700 Subject: [PATCH 27/76] Chien-Her feedback --- .../configuration/lock-down-windows-10-to-specific-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index cb6ea2db23..f05e2550d7 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -21,7 +21,7 @@ ms.localizationpriority: high A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. Avoid applying AppLocker rules to devices running the multi-app kiosk configuration described in this topic. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. @@ -109,7 +109,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. >[!NOTE] ->You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). +>You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid applying AppLocker rules to devices running the multi-app kiosk configuration. - For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). From 7fddc375e7014407e015a982346103e87ef5df10 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 09:48:37 -0700 Subject: [PATCH 28/76] fix link --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index f05e2550d7..644d811400 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -247,7 +247,7 @@ Before applying the multi-app configuration, make sure the specified user accoun ## Add XML file to provisioning package -Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md). +Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](multi-app-kiosk-xml.md#xsd-for-assignedaccess-configuration-xml). Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) From 89cc6f2f0bddf2eee77d98d4957ea4ae8713b4f9 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 12:36:33 -0700 Subject: [PATCH 29/76] change CBB in Surface Hub --- .../manage-windows-updates-for-surface-hub.md | 27 +++++++------------ 1 file changed, 9 insertions(+), 18 deletions(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index 84340e8542..a38f402a0f 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -37,7 +37,7 @@ You can also configure Surface Hub to receive updates from both Windows Update f ## Surface Hub servicing model -Surface Hub uses the Windows 10 servicing model, referred to as Windows as a Service (WaaS). Traditionally, new features are added only in new versions of Windows that are released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality. +Surface Hub uses the Windows 10 servicing model, referred to as [Windows as a Service (WaaS)](https://docs.microsoft.com/windows/deployment/update/waas-overview). Traditionally, new features are added only in new versions of Windows that are released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality. Microsoft publishes two types of Surface Hub releases broadly on an ongoing basis: - **Feature updates** - Updates that install the latest new features, experiences, and capabilities. Microsoft expects to publish an average of two to three new feature upgrades per year. @@ -45,7 +45,7 @@ Microsoft publishes two types of Surface Hub releases broadly on an ongoing basi In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes. -The Surface Hub operating system is available on **Current Branch (CB)** and **Current Branch for Business (CBB)**. Like other editions of Windows 10, the servicing lifetime of CB or CBB is finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. +The Surface Hub operating system receives updates on the [Semi-Annual Channel](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes). Like other editions of Windows 10, the servicing lifetime ois finite. You must install new feature updates on machines running these branches in order to continue receiving quality updates. For more information on Windows as a Service, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview). @@ -55,11 +55,9 @@ Surface Hubs, like all Windows 10 devices, include **Windows Update for Business **To set up Windows Update for Business:** 1. [Group Surface Hub into deployment rings](#group-surface-hub-into-deployment-rings) -2. [Configure Surface Hub to use Current Branch or Current Branch for Business](#configure-surface-hub-to-use-current-branch-or-current-branch-for-business). 2. [Configure when Surface Hub receives updates](#configure-when-surface-hub-receives-updates). > [!NOTE] - > You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://technet.microsoft.com/itpro/windows/manage/waas-wufb-intune) @@ -70,29 +68,22 @@ This table gives examples of deployment rings. | Deployment ring | Ring size | Servicing branch | Deferral for feature updates | Deferral for quality updates (security fixes, drivers, and other updates) | Validation step | | --------- | --------- | --------- | --------- | --------- | --------- | -| Preview (e.g. non-critical or test devices) | Small | Current Branch (CB) | None. Devices receive feature updates immediately after CB is released. | None. Devices receive quality updates immediately after CB is released. | Manually test and evaluate new functionality. Pause updates if there are issues. | -| Release (e.g. devices used by select teams) | Medium | Current Branch for Business (CBB) | None. Devices receive feature updates immediately once CBB is released. | None. Devices receive quality updates immediately after CBB is released. | Monitor device usage and user feedback. Pause updates if there are issues. | -| Broad deployment (e.g. most of the devices in your organization) | Large | Current Branch for Business (CBB) | 120 days after CBB is released. | 7-14 days after CBB is released. | Monitor device usage and user feedback. Pause updates if there are issues. | -| Mission critical (e.g. devices in executive boardrooms) | Small | Current Branch for Business (CBB) | 180 days after CBB is released (maximum deferral for feature updates). | 30 days after CBB is released (maximum deferral for quality updates). | Monitor device usage and user feedback. | +| Preview (e.g. non-critical or test devices) | Small | Semi-annual channel (Targeted) | None. | None. | Manually test and evaluate new functionality. Pause updates if there are issues. | +| Release (e.g. devices used by select teams) | Medium | Semi-annual channel | None. | None. | Monitor device usage and user feedback. Pause updates if there are issues. | +| Broad deployment (e.g. most of the devices in your organization) | Large | Semi-annual channel | 120 days after release. | 7-14 days after release. | Monitor device usage and user feedback. Pause updates if there are issues. | +| Mission critical (e.g. devices in executive boardrooms) | Small | Semi-annual channel | 180 days after release (maximum deferral for feature updates). | 30 days after release (maximum deferral for quality updates). | Monitor device usage and user feedback. | -### Configure Surface Hub to use Current Branch or Current Branch for Business -By default, Surface Hubs are configured to receive updates from Current Branch (CB). CB receives feature updates as soon as they are released by Microsoft. Current Branch for Business (CBB), on the other hand, receives feature updates at least four months after they have been initially offered to CB devices, and includes all of the quality updates that have been released in the interim. For more information on the differences between CB and CBB, see [Servicing branches](https://technet.microsoft.com/itpro/windows/manage/waas-overview#servicing-branches). -**To manually configure Surface Hub to use CB or CBB:** -1. Open **Settings** > **Update & Security** > **Windows Update**, and then select **Advanced Options**. -2. Select **Defer feature updates**. - -To configure Surface Hub to use CB or CBB remotely using MDM, set an appropriate [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) policy. ### Configure when Surface Hub receives updates Once you've determined deployment rings for your Surface Hubs, configure update deferral policies for each ring: -- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) policy for each ring. -- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) policy for each ring. +- To defer feature updates, set an appropriate [Update/DeferFeatureUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferfeatureupdatesperiodindays) policy for each ring. +- To defer quality updates, set an appropriate [Update/DeferQualityUpdatesPeriodInDays](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-deferqualityupdatesperiodindays) policy for each ring. > [!NOTE] -> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) and [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates). +> If you encounter issues during the update rollout, you can pause updates using [Update/PauseFeatureUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-pausefeatureupdates) and [Update/PauseQualityUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-pausequalityupdates). ## Use Windows Server Update Services From cd6ea4d8f918475c59184e16816416146f2e11e4 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 11 Aug 2017 13:05:34 -0700 Subject: [PATCH 30/76] tweak fix --- devices/surface-hub/manage-windows-updates-for-surface-hub.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md index a38f402a0f..ece11a95f1 100644 --- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md +++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md @@ -37,10 +37,10 @@ You can also configure Surface Hub to receive updates from both Windows Update f ## Surface Hub servicing model -Surface Hub uses the Windows 10 servicing model, referred to as [Windows as a Service (WaaS)](https://docs.microsoft.com/windows/deployment/update/waas-overview). Traditionally, new features are added only in new versions of Windows that are released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality. +Surface Hub uses the Windows 10 servicing model, referred to as [Windows as a Service (WaaS)](https://docs.microsoft.com/windows/deployment/update/waas-overview). Traditionally, new features were added only in new versions of Windows that were released every few years. Each new version required lengthy and expensive processes to deploy in an organization. As a result, end users and organizations don't frequently enjoy the benefits of new innovation. The goal of Windows as a Service is to continually provide new capabilities while maintaining a high level of quality. Microsoft publishes two types of Surface Hub releases broadly on an ongoing basis: -- **Feature updates** - Updates that install the latest new features, experiences, and capabilities. Microsoft expects to publish an average of two to three new feature upgrades per year. +- **Feature updates** - Updates that install the latest new features, experiences, and capabilities. Microsoft expects to publish two tnew feature updates per year. - **Quality updates** - Updates that focus on the installation of security fixes, drivers, and other servicing updates. Microsoft expects to publish one cumulative quality update per month. In order to improve release quality and simplify deployments, all new releases that Microsoft publishes for Windows 10, including Surface Hub, will be cumulative. This means new feature updates and quality updates will contain the payloads of all previous releases (in an optimized form to reduce storage and networking requirements), and installing the release on a device will bring it completely up to date. Also, unlike earlier versions of Windows, you cannot install a subset of the contents of a Windows 10 quality update. For example, if a quality update contains fixes for three security vulnerabilities and one reliability issue, deploying the update will result in the installation of all four fixes. From 588b2a64b717a578812bca04d286bcff0200ff9b Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 14 Aug 2017 12:07:14 -0700 Subject: [PATCH 31/76] fixed meta fields --- windows/configuration/lock-down-windows-10-applocker.md | 2 ++ windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 ++ windows/configuration/multi-app-kiosk-troubleshoot.md | 2 ++ windows/configuration/multi-app-kiosk-xml.md | 2 ++ 4 files changed, 8 insertions(+) diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index 398e2d77e9..d4422e7212 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: high +ms.date: 10/05/2017 +ms.author: jdecker --- # Use AppLocker to create a Windows 10 kiosk that runs multiple apps diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 644d811400..3d5708f045 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: high +ms.date: 10/05/2017 +ms.author: jdecker --- # Create a Windows 10 kiosk that runs multiple apps diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 6d9ef040cc..def3c5d507 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium +ms.date: 10/05/2017 +ms.author: jdecker --- # Troubleshoot multi-app kiosk diff --git a/windows/configuration/multi-app-kiosk-xml.md b/windows/configuration/multi-app-kiosk-xml.md index 642995cf1e..d355221ba5 100644 --- a/windows/configuration/multi-app-kiosk-xml.md +++ b/windows/configuration/multi-app-kiosk-xml.md @@ -9,6 +9,8 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium +ms.date: 10/05/2017 +ms.author: jdecker --- # Multi-app kiosk XML reference From 4dfc9e2311edbb8b567aff79b69428200093dd86 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 16 Aug 2017 11:03:38 -0700 Subject: [PATCH 32/76] added change to min PIN length --- .../bitlocker-group-policy-settings.md | 28 +++++++++++++++--- .../change-history-for-device-security.md | 6 ++++ .../device-security/tpm/tpm-fundamentals.md | 29 ++++++++++++++----- 3 files changed, 52 insertions(+), 11 deletions(-) diff --git a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md index 5853b5df22..5c3968f8f7 100644 --- a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md @@ -237,7 +237,7 @@ On a computer with a compatible TPM, four types of authentication methods can be - only the TPM for authentication - insertion of a USB flash drive containing the startup key -- the entry of a 6-digit to 20-digit personal identification number (PIN) +- the entry of a 4-digit to 20-digit personal identification number (PIN) - a combination of the PIN and the USB flash drive There are four options for TPM-enabled computers or devices: @@ -323,7 +323,7 @@ This policy setting is used to set a minimum PIN length when you use an unlock m

Policy description

-

With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits, and it can have a maximum length of 20 digits.

+

With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.

Introduced

@@ -347,14 +347,34 @@ This policy setting is used to set a minimum PIN length when you use an unlock m

When disabled or not configured

-

Users can configure a startup PIN of any length between 6 and 20 digits.

+

Users can configure a startup PIN of any length between 4 and 20 digits.

  **Reference** -This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 6 digits and can have a maximum length of 20 digits. +This policy setting is applied when you turn on BitLocker. +The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. + +Originally, BitLocker allowed from 4 to 20 characters for a PIN. +Windows Hello has its own PIN for logon, which can be 4 to 127 characters. +Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. + +The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made. + +The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. +For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. +A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. +This totals a maximum of about 4415 guesses per year. +If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years. + +Increasing the PIN length requires a greater number of guesses for an attacker. +In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner, while maintaining a similar level of protection. + +Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello. +To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. +If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended. ### Disable new DMA devices when this computer is locked diff --git a/windows/device-security/change-history-for-device-security.md b/windows/device-security/change-history-for-device-security.md index cb46edf710..148538f76e 100644 --- a/windows/device-security/change-history-for-device-security.md +++ b/windows/device-security/change-history-for-device-security.md @@ -11,6 +11,12 @@ author: brianlic-msft # Change history for device security This topic lists new and updated topics in the [Device security](index.md) documentation. +## September 2017 +|New or changed topic |Description | +|---------------------|------------| +| [TPM fundamentals](tpm/tpm-fundamentals.md)
[BitLocker Group Policy settings](bitlocker/bitlocker-group-policy-settings.md) | Explained the change to allow reducing the maximum PIN length from 6 characters to 4. | + + ## August 2017 |New or changed topic |Description | |---------------------|------------| diff --git a/windows/device-security/tpm/tpm-fundamentals.md b/windows/device-security/tpm/tpm-fundamentals.md index 525a5a312d..ee007150c7 100644 --- a/windows/device-security/tpm/tpm-fundamentals.md +++ b/windows/device-security/tpm/tpm-fundamentals.md @@ -97,10 +97,7 @@ Because many entities can use the TPM, a single authorization success cannot res TPM 2.0 has well defined anti-hammering behavior. This is in contrast to TPM 1.2 for which the anti-hammering protection was implemented by the manufacturer, and the logic varied widely throughout the industry. -> [!WARNING] -> For the purposes of this topic, Windows 8 Certified Hardware also pertains to Windows 8.1 systems. The following references to “Windows” include these supported Windows versions. - -For Windows 8 Certified Hardware systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every two hours. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. +For systems with TPM 2.0, the TPM is configured by Windows to lock after 32 authorization failures and to forget one authorization failure every two hours. This means that a user could quickly attempt to use a key with the wrong authorization value 32 times. For each of the 32 attempts, the TPM records if the authorization value was correct or not. This inadvertently causes the TPM to enter a locked state after 32 failed attempts. Attempts to use a key with an authorization value for the next two hours would not return success or failure; instead the response indicates that the TPM is locked. After two hours, one authorization failure is forgotten and the number of authorization failures remembered by the TPM drops to 31, so the TPM leaves the locked state and returns to normal operation. With the correct authorization value, keys could be used normally if no authorization failures occur during the next two hours. If a period of 64 hours elapses with no authorization failures, the TPM does not remember any authorization failures, and 32 failed attempts could occur again. @@ -112,10 +109,28 @@ In some enterprise situations, the TPM owner authorization value is configured t TPM 2.0 allows some keys to be created without an authorization value associated with them. These keys can be used when the TPM is locked. For example, BitLocker with a default TPM-only configuration is able to use a key in the TPM to start Windows, even when the TPM is locked. -### Rationale behind the Windows 8.1 and Windows 8 defaults +### Rationale behind the defaults -Windows relies on the TPM 2.0 anti-hammering protection for multiple features. The defaults that are selected for Windows 8 balance trade-offs for different scenarios. -For example, when BitLocker is used with a TPM plus PIN configuration, it needs the number of PIN guesses to be limited over time. If the computer is lost, someone could make only 32 PIN guesses immediately, and then only one more guess every two hours. This totals about 4415 guesses per year. This makes a good standard for system administrators to determine how many PIN characters to use for BitLocker deployments. +Originally, BitLocker allowed from 4 to 20 characters for a PIN. +Windows Hello has its own PIN for logon, which can be 4 to 127 characters. +Both BitLocker and Windows Hello use the TPM to prevent PIN brute-force attacks. + +The TPM can be configured to use Dictionary Attack Prevention parameters ([lockout threshold and lockout duration](trusted-platform-module-services-group-policy-settings.md)) to control how many failed authorizations attempts are allowed before the TPM is locked out, and how much time must elapse before another attempt can be made. + +The Dictionary Attack Prevention Parameters provide a way to balance security needs with usability. +For example, when BitLocker is used with a TPM + PIN configuration, the number of PIN guesses is limited over time. +A TPM 2.0 in this example could be configured to allow only 32 PIN guesses immediately, and then only one more guess every two hours. +This totals a maximum of about 4415 guesses per year. +If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in a little over two years. + +Increasing the PIN length requires a greater number of guesses for an attacker. +In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner, while maintaining a similar level of protection. + +Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello. +To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. +If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended. + +### TPM-based smart cards The Windows TPM-based smart card, which is a virtual smart card, can be configured to allow sign in to the system. In contrast with physical smart cards, the sign-in process uses a TPM-based key with an authorization value. The following list shows the advantages of virtual smart cards: From 2b87e7e324f520425b5327d82d15c65a7b56c880 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:22:04 -0700 Subject: [PATCH 33/76] MR kiosk --- .../lock-down-windows-10-to-specific-apps.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 3d5708f045..c9c2485ef7 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -515,10 +515,22 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t ## Considerations for mixed-reality devices -*There are some Mixed Reality specific bits we wanted to include. For example, the IT Admin needs to include the Mixed Reality Portal as an allowed app if they want to include Mixed Reality apps in kiosk mode.* +With the advent of [mixed-reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed-reality apps. +To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): +- +- +- + +These are in addition to any mixed reality apps that you allow. + +**Before your kiosk user signs in:** An admin user must sign in to the PC, connect a mixed reality device, and complete the guided setup for the Mixed Reality Portal. The first time that the Mixed Reality Portal is set up, some files and content are downloaded. A kiosk user would not have permissions to download and so their setup of the Mixed Reality Portal would fail. + +After the admin has completed setup, the kiosk account can sign in and repeat the setup. The admin user may want to complete the kiosk user setup before providing the PC to employees or customers. + +There is a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](https://developer.microsoft.com/windows/mixed-reality/navigating_the_windows_mixed_reality_home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they will see only a blank display in the device, and will not have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen. ## Policies set by multi-app kiosk configuration From b2e8ce08843fad85db358d43a3747994d3d702bd Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:36:19 -0700 Subject: [PATCH 34/76] fix format --- .../configuration/lock-down-windows-10-to-specific-apps.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c9c2485ef7..522492d226 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,9 +520,9 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- -- -- +- `` +- `` +- `` These are in addition to any mixed reality apps that you allow. From 1bd8cd5d0dd63c39a1547f9fe45aa596386b5d03 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:49:43 -0700 Subject: [PATCH 35/76] test --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 522492d226..d306a1794f 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,7 +520,7 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- `` +- `` test - `` - `` From cc4b1ebc7ed0b9c7179b0c1a9d3a7178510aab2d Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:51:34 -0700 Subject: [PATCH 36/76] remove test --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index d306a1794f..522492d226 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,7 +520,7 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- `` test +- `` - `` - `` From 326bea237934aad4d65430233388c1bad260c5a6 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 12:57:17 -0700 Subject: [PATCH 37/76] reformat --- .../lock-down-windows-10-to-specific-apps.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 522492d226..68e5b214ee 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -520,9 +520,11 @@ With the advent of [mixed-reality devices (video link)](https://www.youtube.com/ To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): -- `` -- `` -- `` +```xml + + + +``` These are in addition to any mixed reality apps that you allow. From 1f00f87eeb91469ce0400ee303618ec723ca8361 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 16 Aug 2017 13:38:58 -0700 Subject: [PATCH 38/76] fix format --- .../configuration/lock-down-windows-10-to-specific-apps.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 68e5b214ee..93da718408 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -513,10 +513,10 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t -## Considerations for mixed-reality devices +## Considerations for mixed reality devices -With the advent of [mixed-reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed-reality apps. +With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): From d613ac927fd3acd5a7af1dbb72d67f7cc5c541f5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 21 Aug 2017 12:45:16 -0700 Subject: [PATCH 39/76] 12339790 ESC note --- .../provisioning-packages/provisioning-apply-package.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index c12120567c..c5cfd6a7b7 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -20,6 +20,9 @@ Provisioning packages can be applied to a device during the first-run experience ## Desktop editions +>[!NOTE] +>In Windows 10, version 1709, you can interrupt a long-running provisioning process by pressing ESC. + ### During initial setup, from a USB drive 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. From 9ddb6890ef7cd675469893effc21a7850ca4bcdd Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 21 Aug 2017 13:09:32 -0700 Subject: [PATCH 40/76] added logcontrol --- .../device-security/bitlocker/bcd-settings-and-bitlocker.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md b/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md index ccd9afd831..5bbe801d60 100644 --- a/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/device-security/bitlocker/bcd-settings-and-bitlocker.md @@ -126,11 +126,12 @@ This following is a full list of BCD settings with friendly names which are igno | 0x15000042 | all| keyringaddress| | 0x15000047 | all| configaccesspolicy| | 0x1500004b | all| integrityservices| -| 0x1500004c|all| volumebandid| +| 0x1500004c | all| volumebandid| | 0x15000051 | all| initialconsoleinput| | 0x15000052 | all| graphicsresolution| | 0x15000065 | all| displaymessage| -| 0x15000066| all| displaymessageoverride| +| 0x15000066 | all| displaymessageoverride| +| 0x15000081 | all| logcontrol| | 0x16000009 | all| recoveryenabled| | 0x1600000b | all| badmemoryaccess| | 0x1600000f | all| traditionalkseg| From 6ae43a8ffaf89b4e387119b089dbdf1c23c89112 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 23 Aug 2017 12:43:10 -0700 Subject: [PATCH 41/76] 13287783 --- ...stomize-windows-10-start-screens-by-using-group-policy.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 1313186ea4..16c8908aff 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -8,6 +8,8 @@ ms.mktglfcycl: manage ms.sitesec: library author: jdeckerms ms.localizationpriority: high +ms.author: jdecker +ms.date: 10/05/2017 --- # Customize Windows 10 Start and taskbar with Group Policy @@ -61,6 +63,9 @@ Three features enable Start and taskbar layout control: To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain. +>[!IMPORTANT] +>In Windows 10, version 1709, Edge is pinned to the desktop automatically during Windows 10 installation or upgrade. When you apply a custom Start layout using this policy, Edge will not be pinned to the desktop. + The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. From 70c1756f3a73c5f7875db440c695afe4ccc3806c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Tue, 29 Aug 2017 06:26:17 -0700 Subject: [PATCH 42/76] fixed MR section heading --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 93da718408..173cf6862b 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -513,7 +513,7 @@ In the multi-app mode, the touch keyboard will be automatically triggered when t -## Considerations for mixed reality devices +## Considerations for Windows Mixed Reality immersive headsets With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. From 7bd6226fce6cb7cb254266b4c4e18169bc77a04d Mon Sep 17 00:00:00 2001 From: Jason Gerend Date: Tue, 5 Sep 2017 23:07:15 +0000 Subject: [PATCH 43/76] Updated windows-defender-smartscreen-available-settings.md --- .../windows-defender-smartscreen-available-settings.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md index 957fc1f33b..f68b1bb523 100644 --- a/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md +++ b/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md @@ -9,7 +9,6 @@ ms.pagetype: security author: eross-msft ms.localizationpriority: high --- - # Available Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings **Applies to:** From a7581f6be6c09f01f97c41ced21ade0e44449e87 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 6 Sep 2017 07:15:33 -0700 Subject: [PATCH 44/76] wmi powershell --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 173cf6862b..64859ceeb0 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -375,7 +375,7 @@ Here’s an example to set AssignedAccess configuration: 1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). 2. Run `psexec.exe -i -s cmd.exe`. -3. **WHAT GOES HERE? DOC JUST SAYS "powershell"** +3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. 4. Execute the following script: ```ps From d30b6d864b02de12ec48e64e17e03d9d1ea752e0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 6 Sep 2017 08:07:43 -0700 Subject: [PATCH 45/76] 13587641 --- .../provisioning-packages/provision-pcs-with-apps.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index e818979df8..2dee2a24a8 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -21,6 +21,9 @@ In Windows 10, version 1703, you can install multiple Universal Windows Platform When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). +>[!IMPORTANT] +>If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Online Desktop Cilent, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. + ## Settings for UWP apps - **License Path**: Specify the license file if it is an app from the Microsoft Store. This is optional if you have a certificate for the app. From f41df6287c63b51d49c1c5b681263f434bede8f3 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 6 Sep 2017 08:11:43 -0700 Subject: [PATCH 46/76] ms.date --- .../provisioning-packages/provision-pcs-with-apps.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index 2dee2a24a8..ba8b6cd461 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -7,6 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library author: jdeckerms ms.localizationpriority: high +ms.author: jdecker +ms.date: 10/05/2017 --- # Provision PCs with apps From 32757e214d32e32913c04138feefa1c579c73085 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 6 Sep 2017 12:14:49 -0700 Subject: [PATCH 47/76] add link --- .../provisioning-packages/provision-pcs-with-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index ba8b6cd461..a2f8ee5eb5 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -24,7 +24,7 @@ In Windows 10, version 1703, you can install multiple Universal Windows Platform When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). >[!IMPORTANT] ->If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Online Desktop Cilent, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. +>If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Online Desktop Cilent, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Office 365 ProPlus 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) ## Settings for UWP apps From d67c011ecd19904da5eb96f19275afc4f67b9257 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:13:16 -0700 Subject: [PATCH 48/76] added per user services topic --- .../per-user-services-in-windows.md | 169 ++++++++++++++++++ 1 file changed, 169 insertions(+) create mode 100644 windows/application-management/per-user-services-in-windows.md diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md new file mode 100644 index 0000000000..6d2daad557 --- /dev/null +++ b/windows/application-management/per-user-services-in-windows.md @@ -0,0 +1,169 @@ +--- +title: Per-user services in Windows 10 and Windows Server 2016 +description: Learn about per-user services introduced in Windows 10. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: mobile +ms.author: elizapo +author: lizap +ms.date: 08/14/2017 +--- + +# Per-user services in Windows 10 and Windows Server 2016 + +Per-user services are services that are created when a user signs into Windows or Windows Server and are stopped and deleted when that user signs out. These services run in the security context of the user account - this provides better resource management than the previous approach of running these kinds of services in Explorer, associated with a preconfigured account, or as tasks. + +> [!NOTE] +> Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. + +You can't prevent per-user services from being created, but you can configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. + +> [!IMPORTANT] +> If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. + +Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. + +## Per-user services + +Windows 10 and Windows Server 2016 (with the Desktop Experience) have the following per-user services. The template services are located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. + +Before you disable any of these services, review the **Description** column in this table to understand the implications, including dependent apps that will no longer work correctly. + +| Key name | Display name | Default start type | Dependencies | Description | +|------------------------|-----------------------------------------|--------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| CDPUserSvc | CDPUserSvc | Auto | | Used for Connected Devices Platform scenarios | +| OneSyncSvc | Sync Host | Auto (delayed) | | Synchronizes mail, contacts, calendar, and other user data. Mail and other applications dependent on this service don't work correctly when this service is not running. | +| PimIndexMaintenanceSvc | Contact Data | Manual | UnistoreSvc | Indexes contact data for fast contact searching. If you stop or disable this service, search results might not display all contacts. | +| UnistoreSvc | User Data Storage | Manual | | Handles storage of structured user data, including contact info, calendars, and messages. If you stop or disable this service, apps that use this data might not work correctly. | +| UserDataSvc | User Data Access | Manual | UnistoreSvc | Provides apps access to structured user data, including contact info, calendars, and messages. If you stop or disable this service, apps that use this data might not work correctly. | +| WpnUserService | Windows Push Notifications User Service | Manual | | Hosts Windows notification platform, which provides support for local and push notifications. Supported notifications are tile, toast, and raw. | + +## Disable per-user services + +The template service isn't displayed in the Services console (services.msc) so you need to edit the registry directly, either with Group Policy or a scripted solution, to disable a per-user service. + +> [!NOTE] +> Disabling a per-user service simply means that it is created in a stopped and disabled state. When the user signs out, the per-user service is removed. + +You can't manage all of the per-user service templates services using normal Group Policy management methods. Because the per-user services aren't displayed in the Services management console, they're also not displayed in the Group Policy Services policy editor UI. + +Additionally, there are four template services that can't be managed with a security template: +- PimIndexMaintenanceSvc +- UnistoreSvc +- UserDataSvc +- WpnUserService + +In light of these restrictions, you can use the following methods to manage per-user services template services: + +- A combination of a security template and a script or Group Policy preferences registry policy +- Group Policy preferences for all of the services +- A script for all of the services + +### Manage template services using a security template + +You can manage the CDPUserSvc and OneSyncSvc per-user services with a [security template](/windows/device-security/security-policy-settings/administer-security-policy-settings#bkmk-sectmpl). See [Administer security policy settings](/windows/device-security/security-policy-settings/administer-security-policy-settings) for more information. + +device-security/security-policy-settings/administer-security-policy-settings + +For example: + +``` +[Unicode] +Unicode=yes +[Version] +signature="$CHICAGO$" +Revision=1 +[Service General Setting] +"CDPUserSVC".4,"" +``` + +### Manage template services using Group Policy preferences + +If a per-user service can't be disabled using a the security template, you can disable it by using Group Policy preferences. + +1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/en-us/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. + +2. Create a new Group Policy Object (GPO) or use an existing GPO. + +3. Right-click the GPO and click **Edit** to launch the Group Policy Object Editor. + +4. Depending on how you want to target the Group Policy, under **Computer configuration** or **User configuration** browse to Preferences\Windows Settings\Registry. + +5. Right-click **Registry** > **New** > **Registry Item**. + + ![Group Policy preferences disabling per-user services](media/gpp-per-user-services.png) + +6. Make sure that HKEY_Local_Machine is selected for Hive and then click ... (the ellipses) next to Key Path. + + ![Choose HKLM](media/gpp-hklm.png) + +7. Browse to **System\CurrentControlSet\Services\PimIndexMaintenanceSvc**. In the list of values, highlight **Start** and click **Select**. + + ![Select Start](media/gpp-svc-start.png) + +8. Change **Value data** from **00000003** to **00000004** and click **OK**. Note setting the Value data to **4** = **Disabled**. + + ![Startup Type is Disabled](media/gpp-svc-disabled.png) + +9. To add the other services that cannot be managed with a Group Policy templates, edit the policy and repeat steps 5-8. + +### Managing Template Services with reg.exe + +If you cannot use GPP to manage the per-user services you can edit the registry with reg.exe. +To disable the Template Services change the Startup Type for each service to 4 (disabled). +For example: + +```code +REG.EXE ADD HKLM\System\CurrentControlSet\Services\CDPUserSvc /v Start /t REG_DWORD /d 4 /f +REG.EXE ADD HKLM\System\CurrentControlSet\Services\OneSyncSvc /v Start /t REG_DWORD /d 4 /f +REG.EXE ADD HKLM\System\CurrentControlSet\Services\PimIndexMaintenanceSvc /v Start /t REG_DWORD /d 4 /f +REG.EXE ADD HKLM\System\CurrentControlSet\Services\UnistoreSvc /v Start /t REG_DWORD /d 4 /f +REG.EXE ADD HKLM\System\CurrentControlSet\Services\UserDataSvc /v Start /t REG_DWORD /d 4 /f +REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t REG_DWORD /d 4 /f +``` + +> [!CAUTION] +> We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. + +### Managing Template Services with regedit.exe + +If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the Template Services change the Startup Type for each service to 4 (disabled), as shown in the following example: + +![Using Regedit to change servive Starup Type](media/regedit-change-service-startup-type.png) + +> [!CAUTION] +> We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. + +### Manage template services by modifying the Windows image + +If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. + +### Use a script to manage per-user services + +You can create a script to change the Startup Type for the per-user services. Then use Group Policy or another management solution to deploy the script in your environment. + +Sample script using [sc.exe](https://technet.microsoft.com/library/cc990290%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396): + +``` +sc.exe configure start= disabled +``` +Note that the space after "=" is intentional. + +Sample script using the [Set-Service PowerShell cmdlet](https://technet.microsoft.com/library/ee176963.aspx): + +```powershell +Set-Service -StartupType Disabled +``` + +## View per-user services in the Services console (services.msc) + +As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they are displayed using the _LUID format (where LUID is the locally unique identifier). + +For example, you might see the following per-user services listed in the Services console: + +- CPDUserSVC_443f50 +- ContactData_443f50 +- Sync Host_443f50 +- User Data Access_443f50 +- User Data Storage_443f50 \ No newline at end of file From 1a1df150ac2ff84d2731208ac972fb48a9c46ad2 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:22:59 -0700 Subject: [PATCH 49/76] Added reg info --- .../application-management/per-user-services-in-windows.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 6d2daad557..ef38831b8b 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -17,7 +17,9 @@ Per-user services are services that are created when a user signs into Windows o > [!NOTE] > Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. -You can't prevent per-user services from being created, but you can configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. +Beginning with Windows 10, version 1709 and Windows Server, version 1709, there are two ways to prevent per-user services from being created: +- Configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. +- Create a new Registry entry named UserServiceFlags under the service configuration in the registry as a DWORD (32 bit) value set to 0. > [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. From 1bcbcd89a16657f10e97e17e66cb780f883cb909 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:25:48 -0700 Subject: [PATCH 50/76] moved a note --- .../application-management/per-user-services-in-windows.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index ef38831b8b..f2c8a77f83 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -19,11 +19,10 @@ Per-user services are services that are created when a user signs into Windows o Beginning with Windows 10, version 1709 and Windows Server, version 1709, there are two ways to prevent per-user services from being created: - Configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. + > [!IMPORTANT] + > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. - Create a new Registry entry named UserServiceFlags under the service configuration in the registry as a DWORD (32 bit) value set to 0. -> [!IMPORTANT] -> If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. - Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. ## Per-user services From 8a6d3b02c796e2c32f542c6e217455392b478940 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:28:55 -0700 Subject: [PATCH 51/76] added para break --- windows/application-management/per-user-services-in-windows.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index f2c8a77f83..52167fe4ab 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -18,6 +18,7 @@ Per-user services are services that are created when a user signs into Windows o > Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. Beginning with Windows 10, version 1709 and Windows Server, version 1709, there are two ways to prevent per-user services from being created: + - Configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. > [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. From 9c5da3d8ce41112298a783c61c9144c22a5f367d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:39:13 -0700 Subject: [PATCH 52/76] added para break --- windows/application-management/per-user-services-in-windows.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 52167fe4ab..58562b4f94 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -20,8 +20,10 @@ Per-user services are services that are created when a user signs into Windows o Beginning with Windows 10, version 1709 and Windows Server, version 1709, there are two ways to prevent per-user services from being created: - Configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. + > [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. + - Create a new Registry entry named UserServiceFlags under the service configuration in the registry as a DWORD (32 bit) value set to 0. Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. From f06aaed50cfc9743900a565b9a4184d0d42a49cc Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:46:12 -0700 Subject: [PATCH 53/76] added screenshot --- .../media/user-service-flag.png | Bin 0 -> 16441 bytes .../per-user-services-in-windows.md | 4 +++- 2 files changed, 3 insertions(+), 1 deletion(-) create mode 100644 windows/application-management/media/user-service-flag.png diff --git a/windows/application-management/media/user-service-flag.png b/windows/application-management/media/user-service-flag.png new file mode 100644 index 0000000000000000000000000000000000000000..b285217937e6e1826a01e70ac9a8968200af6a93 GIT binary patch literal 16441 zcmc(`Wmr^g7d8wc-O?orA{~R$B`qP{9WrzbEg&f!14;@ANH<6$B`|b%r-X#GH1qDk z`+lD1`+mLuUXFno_FT2swXU_!b*{C;Rg`3Lu_&>SkdScYUQ4MVA)!E!kdUb`P=G6v zdbhT~+e1t7H{wW0l~C*(Q&gY8&3! zTkSHN9m?D7GQT=yce-Bh_Q>t^$nE#Z@AW7j3@B{FR1XGp4u=$vMih@n-)!{S{OUJ9 z78#_OrIy(!UhsVyt8)s*0;q$d{;1>#f53h{{y3Ni4-#5;~fp4Jj`PiG) z0Qk=!_|IVY&yc&Hq413`_(nKcN;Z$aT(aqz8=@a=f`b|QQ`3H~bu{_8V* zCk?)n4&TXu?`FbxzruI3;qcnQ!NIxd;jyu?3E*dPa%yU7c6N3iK0gl!e&#neHVzLC z4i68HkB`sK|J+@lTwY#WUS3{Z0k5m;>+72v;B|Xf?`X@L1LonGs@ zAR*zkBYu%dnB@I|ixjTXIrT4hIX@Coeg;I6!VD>2r|W`PP5PRs_H9TPDYidh3PRa?2I5fkxMmoo}4HO=jX zzVCuUutb(68=pzXC=@=Te5(>?ki~_QNafir7ByZo^Za!qDp4BhBlD*kddhT-<}R$*8vN|ULC_fhKWi2kzmC+XSyCqj5UtBq(i zPZPW7h_QlsVUy=9%%A1jDXOMJbUw#dsOVU*@vZFguem)M{Ie01-Rxp(^^5B^PGPv+ z{i0`XE@)fQXtvdLcz^jr%(L}p!MQparVm3##-*B0`hd=EKxf{e{j`CEuiDebU`gCovmQnbrLL8lZF6Zn4y>Z0UnQo%Fk^P z^}}c4M=sMtck?5i%>K{IB4AwVlF-T`6(&W^h0&?AkvDm{+1aH$g-nU%^bz!AFcPe8 z^M(MArgi1J%p<|@usPNIir<`c6>f{WnU&M;^G}Ic^}G^1_Bx9svPP`dmyS66nmDAY z-7ftX`&eb?ZChLdgHMEHshV6Q80-(f#pp>suP;-mBoCk&n=c)Z$l{WQm`lN(A1?AS z6Jr@xEW9Fv*&kZ^6MAlFF%dVK0#i?T8WP=M@!j3@uF`MwkYWYL=s2{606m{1QdMLD zn;!N*n~oLS?*D)N^{ZF-^v3hIA*t77j$J#?Q%*7?`3T>1p;1k9&9;m+a?oQro5UA} z*FYwpE6q$vm_E&#dhjrBa&3-UVSV(au+LTYAklF-zx(a$+3{l*Vp7b0+$UV6q|=)^ zl+ar5Zampwp_g%(m)g|deRKA#-;rQNe%L@GDA?g9bKg)Z2w>%#YD$NQMz@$oMHln? zc&6_gBs?BWPdqsHT94w5{lXkmdm!@4_3BBZ=lP{&S|vBoX22Z$tSq9f{SKBt^ky%I z^zV>iyDv3O!yUYHNL}9Z_6u&8$n0Y!Fd>;DhTFNw=vU~pdM^j8OV$7Q{hm{lrAErD z^ZgBT3MKz)tt&!(P|){c)I4=oqtbsgRMxUSGN%MlH{(RHv!NDLp#>CiR0-DMoX4DX zv;00B%{Oz)5%W16$8Wm$J={LgMzL7wg2C=!BuO;$mEW;#v(w0;)5-Nr2|HN2+ZhEz z!z~5Ay&S!E)_unElpv>g-0_?8<@;=1X$hm|EYAAtIlkXa>P%s*X^tTe;M@lk^4Nez53FJt1KRk-PKInVduJdYbvv+CgdaaxPQR}|Njx$qm+&{X0 zLho)kU?@Zw-OsiwZja_7*7_+T8tL4A-^)%V{mhcicT40q0hDUm2WKLCRsRdFh~S*J zW=%)J6o04>jTXvT2LVRiHCx8h0Yqiid5T%b4(i_h|t^9)GXCl`J*toI+52$0O;?&l47~ z)a!KrJ>y2%=!x`~usLF2ZWh@4Z(jXkQFBrI7o<=#nlLG5i-ejrk6H6PJ1E&ZttZJ5 z&kRx>HP9*Na~2>u{N1wRhM;CO;vv)nC^VrkS5~)Uh;nFW(H^+=$_qy2bZhx%k zZ8xhnxK0uca)?#k-*G>ZQM5bMD zlMW6mhuePEFuNN@*{HnCGu6;<^a}`duEdl28WwL+dhxEM@7I@;;gzcO^lNJm+43lw z6dT-6T#Y5$D>9d_?{KDhdHc}!+<6D*lQJaZ_C(9NvDjnmi8i$DsjAxDr>(0S1`Oze z|CrH;D;?!_j-%Dq)J)T-n-MDkrf0?A`nG+~Z-v_&-o6oJpO$Oi$lKuaO5y$S<*Ie( z$Ubm`RNcG-4PuC-S- zeiPsSL~LV4IS@gKw{*+Z2yZ%fdW%0;9oe#N8(Xs$+`JZA z1x9Ba;z)8;GJiU?I={S1oMjY27t5bOQmR!=h87tLU8Tf5sjiJMBq53r^7;8=hWgPt z4bw>D3=09NqWV-s##SWMa&~Aod5s4eW!XSt*MLv?!zPRt{y1%V>E{$Itsd4;T+fgHd zF+L#kxQ#L_f%T?Jul9{W@3L(C!1Z>dCWBToRF<8ubSm+AXO_mY}!N#j0of+w4XD(A= z()cg3I3$?-i$E^CgN?G3u{lYxND`@>vbDEERnky`CE5X#UwwT0#q!iz5JkmUAity@ zzJJ*yQ0kn7N=*y+1zzL3&E<=WZn3*c==;5F+S~2r8f$^L0q%%3EOu9|1ryx49JQP6{1=S9`=97kqs1esCBf8ixbhG}r-OZ?B z77;H9Wi0EKB=%_;QGU$9^q)?Xv-@t;WMfXR2oCfQ5+b{-Dl2Xesu;^X2 z3>@tj`sqJj>oC;&-91g+=JNj;AzA)W+ru8{{je7&P~jt$s=@K;*5QhV{UCM!GdTzo zPm6_G!4pB&GBKHF=cB;Hr;>0!#X;V(b>*ne{tTL*7)R zDMJyvrO`ryS98no;H{d&TZ7BdXZ6dMml@YW+;v9XDWsu~BOjbGRK8IGdRAt1r-~;S zOT_d&ULmzBveUk+7s%=PO>3yyw= zbz)YjX^^PP%P>dzG#OuYZUXkzuTN4eqL_!uYHBy^iLmdSjL|QS9ho>9*9-y=(O5=a z5})hTey=39)lLQmi>&lcpp^@}F2%po%B{DM;_fHcP7}V(5*tuZ?|UMO;ucF45n1MG z7esS_D_zDPuW{hO2AdaN4|&8I=_kbL`Jc}v(YvB(21!rZr|Gb{ zUm9@tGexjg0|VSb)<7#n#NDz?q^4H&ZxdCCwXL%5rKKc_<`cL^YJs>4>5E`xV*`Q_ zQxyjboO+UOj{GI(o~_>p0`P%A9NeSMqNzk9aM3oLTm>H1=j&X0d|4AUO7W^*nDPxx0WU@Lf zVi{3Pzq_KTJ}-D~Y$O%dFJ9y6V88IwzHqSipNxWBY=`d@nc}(b6Oj0xQ*m8mkK)fr z`biB`FFybcWA{(hIaNi$8R zfqu*}#!E$N8pu~(TN&cJK7%nWCf%0swfspRXf!b!pBG!dwB5-q zGYRc~@=);Z-=Ar{NSY`FD|;-8kWk~ftBoNyz|xIX?gd@4Mt-;@X?p}m_d|m1FV|%6 z$ig5k@83L?`=9{&6s@WpWy@{3<)QPQZ`wg!plHEvVPbrb#=-T*tm9S9i!b)-dwVKX z9g)vT=U=@D%kU+ZPSl_KD*=S|@b$?@A^Y9g+O0WQUDcGoFU_i#bv#yhJe`BHN_kdW zVv|SS_fzT#daYd_(_Fm{@%OE%tncCuN>=dSbF+T0rWfZJNe2c;m$)N377B3R@B1&h zIGp*s8d?jc2ArJ=KOx`>)FHUeu&j1zOXyR!tOy8Z#s##1F+?Cop)0w|%pY$9e1c|e zY?aMdp0#b0p~EFwSr_#&m=*SPbk6JjD+l{6GGf5VjmT%%8(4U)zC7YR4SAb5s z^>!L^btb8;fwNkKPQzw|WUoEgUTWN(8>NzZ`9z%U@$JqaeYGR=1fNZ+yYaQmDSM4F z6XU*Cqwm|%ivsO;vW=-&yycVVIR@Ql*sQ+1Xg7`um?!P?BUHem%j%VV)`*7Tt&~hk zxcD4puBtGjctO?rYOg`6CrvdqLXr$r+kT73&GOae!&yvAxvz$Pk+szWy;E8f9zAdK zP6)-PU!P%gkloYTV>cV=#BUeITF|tA(n3Pl$9`}V_*Iev(4k@8vOp3sS`-e30c=M} zN5C32thF(U9$mL8ZF{0>ps)4W zTNysby<4E`&V$>>B-599KEf8`jCPA_Xt%Ma$Jvr_p;n|1b78opI8$94=54tTk8=-n z^sj4&{f^FN3hG)8A8Z+)f8z8xn)iFupZ472IgNIEsI~sabsiqalxU0KW?5x^#)}Co_hFdp9vLDhwe9 z@Qw^g19Te#&>fBMYIvRR(OFOJUm15jgOO;_-0!WUy}{i8=HFpVu*v#j4W2L!ee&YQ zOgXpM*Xp{4Z*LiU4okY7a^8V9)YtD9lFd{$f*|S0=@=aUM ze)4?JS@eTD!D1(;@AbJ)znG_p;Fm|t)nvOpNiDmK4By1A&-Rkd7(Vm=d65u<_E+@M zkYIP<%t^8WZsc+XS?k6Jhrh#rkf@g=>5OIh99*6qmctts)pag>ntKr2_%P>;Krnat z&*eG%Dfq+?@|65n{n9_$!!Kk&&}grwV|ssv-+nZQ4R`y)@hN5I`KvXp(ndI#!+Nh< zA4ddynVMQ+BSOKi6uBnKP-YgND)zxI$AWA8B>P4Fls8N4Syhw)1hy-YC1XZ(Z|{?! z$bPHWS@r**4gE3sT{r4Mt2~KleBU`D6nUfK-c_{X{~K`;VIGr z=BvgF4{|GF5%(BI*Q+ou8fVjv%&5g;yC~#*QzK6*FG&Ets4hh3O{0FPm|Jg`Qqp5( zN&ZpjX*lvCq0b8*fO2!NltE^#=P{hR7n@Z%^g8>ujP>wdk}eAtY%Wft^hn6x_2_`h z{Y)v0A~1wK5ekq?_nX0YDuxSDn>qh?lmmjqmAB6Z$qP^G-Wgv$xBlLtmg4(n*~1FsNGmU zF}xAN(RrBBu(>`zPPL*!RcUG>^F_cq3OR{*^Fv)0AD|i`Yh6to+aFYsx3|)l!&{(v z*JKBxa2(}r^{o*?33P=ZtQjh)6c zSW_=G#q-F3OQgfaOCB&U)~^-tl1?Te(4X_Yee!#wmQ1u1vJ{JeEH$2nE0~fS>prRM z$dV;bN)m*#$i^zZVFX(S9;#=u2|d!(th)3v^jujvN|lX8&m;V)DD7;?H&xTWB+{tU zcIS|NT!o&-J9|z2;xT7lSk!i{xPW3m&UL?ASSRsCPIi-Tb#JBDrD~b8Dc)MW>D>t)ZDSETM?r->PB!mCerQ z*3k96@t6~XU=2;`h=+@>DWr-n-xLZA3Wp{VQu1%=uVeYt(&KMtu?(?7?T34TS^ zOyqSYoUcb?J$ifyDaUToDHP%8JkY4lJ`el(J)GY5=m-VfHz0A+! zj|1_#2`u$B**;^77&U}cdK4wmw(s#h>6#%X6o7up5c6%it$K!NP`6evTA6YjnicRl zFjwgd_Kj0jVImwS%J{0t3W=p0B;3J>Z0HpgUqDCbWa{rw{eeB#m~a1p!LknTHrt`E zYgom9y%NU(^0aO7Y2E?t>U`^gKx>D#cB!OahHzbNOHHl27iYK-S})tbPV62{p58*( z50Ihf9LF+yQ~SfmlTii>-Xx@)w04pXFGSrzjKGNpVr3yjd|)E;jPFQf#Ro3xm9VGN zSCPecm_NJ*X!_5Hst(lA)mph#MROo^rT42ediU`0VO4(pnp>6%;u0FTI$9yHco}7B zPgBioPjd;KNYb#}8n)*>=+f$1dVhl9jKjSG4eGr$9+SyvRsf9A@faalA!c#mFwhdt^ zU+|!eJwpf7+M5`P1b;EVO$&Nc@pN!p5kQ_(J^l3OY7{qbBe|+aV$xF7h>ZVH!7sC{ z^vxmZuyH&NW{hlyJi6S}u_5xUaDh4?)$V}!mG@rGihSc zl@LH>RqEcK$DB20{?MPj@GH$xHO@Yw?ONbLwxh>yuWK*zFX2xGgnH@^qEh*-eG&Qk zg}sltaHdUZ*O%GNAQW#mrk#g>)K^s|i#y}7uX3E9o(!M|ope2m5qz*}7O?Fm2lu%PB$)H)(}QF=Pt^~Uy3A`zg#S@q#YWL)J2X!ZGl{m1jCG*|vCWA2nC zxdE}iCf3pvuo1Y!XHH~Rj)tV%B}n(y*s~PVgOrL<&(rp)0UDh^25X0 z*q*ZWmv#OA7h0il#-AzoX{XRX#fkfUB~=U^O;$p!w>g!qtN~lt;GVaMM1wzy`Ff?^ zT6CHy(yZ63jB?utjdJmn_Hw9c+cqCs59=O~@PO$<3sfD>kf|;r!jovA^*V>hg>Q)Z zHYRDlz0PNQS@K|qyc>~y-s}frw2VDBWJ`H5ly^6+LkDxV+l@gr5{zFaxuOJ1?<%mz zOSQvslz!|6@)Gb6y?`5qD7&mTpzh8*xRzh(x*Q6}kJ)$j$;^>|l8r~1&4O$x>fo+E z%2s!U)Vc01jn>!Cy5|2juhyA@5ItU@*8;^WV=0EM3$h)H{nuF1pbV`FCdqmUE$q+h z)AGv6!d(G|#2FUAY((ZW_2SCujf#%cJ<@e0M``IcRzCmYj*(;ey;jEJ^+lS?PS}^?0{qZ*l1+9caqkNlbucbEJQ*pMS0BclKFZF#o zm=Jch^EtCZ2SJ&N|Kdgymf3X@7n3n+45jjbMNrWY4ILFtm#SHDhCnmWKI;ArEBeHuuGWR+Ep4INw!414Q!!{}M3>IESM+4O+2T+o^qHXmy&|kQ}WN zO@&i`xPFk}C{*yd`;tDzf*3|Jhly|?2%E}|SYJNBdA#^a+=GY=Af^txWzk3vhUAVKRSFQ; zJ7{c++{xBS92kc(!h0j3Si9W$xNq`*q4^mTV=sd#|ZBaUMWYe&%gS znvlt`2`#-vk|?PRaY)!NLhDx@4SQ|@&!e>^7pF!N25l#IrK&V&nrWlj^}AK`$i6G$ z)3$sXW(ov|8@kNy55we$qqlEom`V1OT&#cyQ$Et-J^@yte7(=KfOI}n2at2#Nm%zCSZ=xj`r}s_s>kPZorRP ze|>}J?M*G2*k3Gc`*Mj5tzccvGs%d+A>AWvM1*H$QGsR; z1Y{oC1~zKkM5643-+v?*48^?~kJob9tn*&>9(B6ovT={c)&C+dJ%qCnL|ss?gOF=9 z^U%MmVFjVxT$cNu?P%Vu2lXbeP3T5Nl*tSB8j91KF@8IJa^9H9(}O3tZt@GeiF5e+ zXs2nakl4cAjDE5>3dS)mZ@eMs(8lYq=G~ThephFf+=juPrw)W45; z8cPAM1c7}cGOXgD|DZkc!_%&=e)Jm#tgnJTd$THOf@hU_k^Ker?M3$}D{q(FsR)yH zh<`#OVqOTn5@y3r3L{Cx|M!4zo%>HmjJtKuZEP`>m)4x=l)}E&w;w;P!~_u96}i(n z3oC4t)SjBOwoH4ysjiGOa&6B^Jf14y9$z9*T3J826R(X;>qS=5UQYeK6G!Kyo&hk& zKW2oBiS_ES)0?3GH3FqO-ffZ7!GZUjaMi~HEg7#jqvP_^REz{zER~n?$+T7naEMg{b9)%a!Mq%@iec88)#>oEL4n`8{r2 z`;p7te2u*5=+l4k98)m}ttqQM5wx-&F)s9T;Ncskpx%pOa8Bae7vgWE7k#$U z;g8ZWY?W`~NxrSLrZID|$+jeD2UkEJ7Wd>+-&j0O)E&=zzgis8J20U~X_% zVm^HJq{-{6c6E0$)~8jXLaHEzamuNP{NE?La@kVlX7nCo&tvdq97&zkOVuf1rz_CS)k74#Q`ZE+;8lI( z_r%qlUSE@L)6hpp$G4IHV1IgnR@y5y@!%6eRxD3piyvyq-NTh0&Ng{|MP5M?cxtJ| zrzK?1RQ!b@aWC40`)zGaEMZ&fLL$s@?~}h{$V-4A81Q2zuA{gX z)t{S5I;9b4;bokVK^%Kthg^U|AG@k0gjKF(({xyGVa_*wEMqaNc`!NR^sZTml+o0u z4pK?(V#8O)vnGAaK^Uo8Ak+N?L#rwJOeSGHI@v;n`uUaG&Z7pbu9hb=sX%NASQ2Fw z>K&f%#^w>&(UlZ$`-!u3N?+yjr_JFt%cpt5qOIAw(v&_(Ktl1w!oC^O;g+y#F3g7a zb?xLug&B;7bbf3m1hmG10DEp?cFe|j?c!*vcV>=S2J3#!W!L0~Iz0oCr=7jTus4T| z{*k#C)=2QC(g05FGLvC7R<|niCT$81tP5+AYysw!wU~E?1puQ~T(_vmF!ltndqM*? z>!0g1wnYp7BlXrVXBb`6N?23ZUwJu<^>1Bx5Q=nSF$G#tD6A(1h#KU-l{~+EGDF|x z5954K&~8WO7kYQGW1#FyR?+7`b}0S`{*?#Q!Xs@uIHx{)aNZOC0ef{hK#UFcnW(Z* zK|DU6m){-vq#&_(2`3NGuqb_X&BKcxw~E4gA9g&mn{lOQyrz<@K{b%77-VC4SO5@< znIHg@&o5!L8<^+#xy#Y9W6Q{nY@!^3?fdbUuAT1E3{2%kOPkK3+V#EUE4Qq5Fn$hW z03tO_1Y{XVqUiEpk65<{$vc?StZwXRl42oh6syM^skGsPTxd719Ix^&590v4GDZj3 zl}&|n(8^JsW9yCgJMVj}K#Ly-DRWO4=FPH~kv~(MNoTtcN`3GYTgx z9N!^U{`wv)l_`2q)u!>OnZrNYO%$sKNkPGgY%e5WGnRIy*?h|i$P7t@e53CEEr69a zdiLb*VH2Twb)I!JwbCOMf~nf1iH~+_mEktcq+RAvJvsy0%yop`AUO1NihJtK2#wF- zqP1$Rh-e;T;Dfr%8bJCXIZH~rRcHTn`{6)N97+;iAn?r4Xf2tf#=DhF?@%Uc^fOrP zCx0R}?wp>Q!Z$eqhN3e)a;S(+xRaZIp2@#pAAYRBS^2KxAzThpFugT3HL4&BMc$U~dBd1uuvSU2;zRKn{yLQ_G(IUgQ*ck7axtQx0|Ony0GPzXj2 z-y0g)=jv~ZWFk}cm&y$`xasB%PqB+JcAm4~Ciw;iJ1$?-k#2a>(WG6CnAX&y%euat z3^X_qg^qcw;mCr_f}S^p*G7scOErc|hFw7Q7u^R&%-q#S_!B5r0rg?7 zqWp0|qWn@9c#uI_x!h={P7S3#OervbCx}I9OjAD;TNk_)mduZTGyQ8ltpTIE8@Vsi z0iA*3KHN&>M{7EYaTMFF=>fv~H!vP@b?PDf9XBJ?^_-$jvp1v(T@)r*+f0vaJ|7>Z ziPUb7{CK#i`VJ?U3hnbrABuohol8tEq&MvG`f7HD?+VPrPwU(&nN{=+Op}m5nZ(+S z?1O^)(=h40Vtl15CirRTh~i|}o^w%}|G8pBq;!>EfT4Y+Pvy`%Cc|b1VM|r1h;kGS zvc;Ir=Rn4w>;T!ZVlU#_CI|#O5)8y^To^RN9q-M3vX}H!Iv0YL)`uzE%psNF9Ia+L z79ru<(T3`faG_cAjQR5A&v@X_^?mes$vbOt)3UP@TUDYRew9LpB+vFcu;TaJn=-+i zna{3HH<*l=JG%jFlT;pR9ol4Mf=)^=t((0Pe$i=~7)FJP&9(h;lqw#6n4EhG0T-PHLeN?O!R zpN86xJjA&{b>@m?aF?1qShY2uCgfJQr_|H$u zO6QGjMgt>mpP#;B22P>x$jHF&lm}$Q-Mgk6M)Qn zKhm_CjWqCR%e-nV(f$Fd3v9raGvQ%}LbGz`%|g{a!6dl*lXL!sx!{ml@ ziYDox=h(sjjj8W5%>CYNh4m~zRq9-wuVoXa@NY79^1lT_h}<6+ljXU{3cOkF9&^Ps z068l5eK0u!YknBGdA(dl~x|w3=)h=I7|IYucybvwwH;q2<0?i%N zxkc(yj!pRoHOm^KZ?nc`K_QVv20Rp%K~)OGyd547#`l&y2#`fTzMDc&0Vf*+QOI>; zkKVwVZ@9e@(hf5s#)(=AeN(^%w8@O3ac<@q(TW738DHmowr+he_@_D&^95%=eVG7- zB56b#=7re>ORJ&PZ$_CS*jJUzg57VeIc&6op+2`k+OM~ho-e+H} zG99e*nIETQf>`!Pm9wK8`VYiHfM7S)+L9^7UNo`w{egGGwuc$5n6#iBYTgtLiseCN z-?+p2&;Yp;D?5;9KjCb4J!63%HL#Rp7xXl#d?c7idli6pCLg9(rCN?Hr$n`TjZZB+ z^c1Z6-Bh8_K^3C?^3?8QOIQADvT6G)A=D<%#Cy^Z@SHU<$XiZn{YPso)Gl~*ZJUN3 zp5lOH-@u}q-_bgK5G_7+|E-y!y>^ zHMV;6#x)`~CnkTtKQI)VyEUEIvl=q#R}aRq48|pO&RjFA?5|cMBiVXoy>6of-T~lK z>;WyBc?39YU!??l+GWq1@6P%l;_Ksb_Z&iYOAvWLO>lMP$q-m z%zU(|O;bZ0XG-VS1wc)69N0uOuOOK6K^HqhmIubK`5_9 z7I)i)N6x3$a6N2dZ$xFsy=(6?BmWRv-(!R%BNTwZMnwk~;XK?e>&$Gm6jbO%8ze{;?Mmdnhq1~T!n zXx|@wu42H`c^WcJAlf2ok7RVCK`Wop0GjYVgvMfQ2gF2zIO{C;^S!Tyj05R3KzLD1 z9JDA(<=96NlwwXiPmZdUKC_oi2WJ{78IcK3W?NapP*CuS{$Ytj*7)frYkZt^`W|^2 zs&ulAIvh8~QiBdB+buW3IT2>A52%r}i9)750diBmo;p~fsygOQg^J&?*WAPjtE51< z;nt0pN_NkuGmsJT@X-wit*jf7X{>8@)E&J4y{5i3<0g?*ex6Um{Fwnra9#i2c*X;b zUUxnB^#!HH#UWBQSqVSp>I===+(3|Y!yB0I#nit#Q0>1{Q#thbQ)tiGUAy>W5#sh) zI&Z_U_fQ}YRyd1_lBe>dZgA5A5!sO^>vsEh$FF1l`7$+!3PXrznj0-G0Y?*~#*oC@ zJl%uG%P$1?UDbvf;b<4^>z17&>5pBBJ#RMpnjDLA>@+h}5|3|hbouY&5x~a2fFeVG z{n?N{PyrN2DIzjrh@twK>auspyYCoe6p>%52Bd-e3GU=3EvS!8%G=p2$x6aLp?C#U zBjEIvn70-G3P$x|w?P3+g~meiH0oYl(TVNZu{#f^bHOwp8!9bH$c|z;RwcPDDG=8H z>o5-x%)VLpNmvUR-8J<3SBcAsP3&kkVw=@lQHPiW^j)&EY|pO zC6UV(FdaN|u7hUvt9@5uBP_tC_-EaMQ_=%~G06k1OcHPJI6wgX!-WL^1Ygl|2DU(H z=`2Mt zQ3oX7>3Pv#w43EJu)uC%63`11PM-Ts1o%o_Km2+ZvU#! z#O2t{Ds%M`Aqk0Ah*)Ync&saWRJp1y4cMAIM1D?`$=-lA?Gm(-RS%S=G;?fgA0%e9 z)Xn>*PL1qS-r9WSGkqfqNow1b5M@a9`nmfVeJ>dp0}_a~KLACh)lOSNSt_eH6zzvI zqdzC?6=cDyOhh!c_`G<{uYwfN^~o?ddN=5W7@9!@)k$OK=Z&3&%6+tL9lBZ1HC}S; zjIafA0~R9UA@o6|MMOW!BC!W)4DwWbU6^zA>)rkb&3*WqW)$Ox{u`mqYRZL}S9JL& zJ(<7_u?*pnNl5~{fD7%&ta+p}@EDR=rxMokpXeE}MhlbiPtrL){IH`}!5@zHne$c2 zZ83o@QO^PQZ@#)ybg^Dn>Kr&gCbJf(g2bUTQl>5GK<=GW{WPj3SW)AL#*cFAD00`J z-F%jTNh%+4Kb$ZnR;O=krMJ~i59c@S&sg76adBul)%F;X9W$#*-pWA?6ytdvqVV!& zmr*#zoWbj6kEQ<^R%2m?+zA-g6%}?(VS9Xr>^?jTf6&pC9H$>*<$D~K_Eo%UQW<6U-onBjwR z>`UUq?;X$WwE>j}38sK4P-6U8f4B4Pj;L$Yti{xhK&dsUyCWP8yFbHJsgqaSvKU96 zc>c0esj-VL?iuS!4@&{a53w_rjKxC(8kz#RNCT+R+a?xjS}4gf@Z3RFPyg@&BUF?n z2AT6z;_sQR0Fs6OInO;L+S|Cad%1tv8A~d@(pi0_l4>c{g(v?Q7JvzCCqI;M{EwXh zN{kac@jd^h?12kL)RZZ*p}lIU7!S+4VszcG63cNMEA)imv5jI zFSd6F)*^B(m0!#{i(qZ?3PAGeIf7t7B(H>4$(`_j=l%Y3Fee8h#bjj%s*#iZ0cM*# zeik^y##cWZUe@cINeS^SL--c~CH>c-Bb+q&F-nWy>M=6s*30@-l(m^c*C=VgPyahU z8W$XFJMpD^PJ-&Inf}`Xh^s`= z(wh4$Uj41U{x@DqeTU [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. -- Create a new Registry entry named UserServiceFlags under the service configuration in the registry as a DWORD (32 bit) value set to 0. +- Create a new Registry entry named UserServiceFlags under the service configuration in the registry as a DWORD (32 bit) value set to 0, as shown in the following example: + + ![UserServiceFlags registry entry](media/user-service-flag.png) Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. From a96e14a16df0a06b2443977b9a850c6e939f5a04 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 8 Sep 2017 15:50:52 -0700 Subject: [PATCH 54/76] added screenshot --- windows/application-management/per-user-services-in-windows.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index bd22070c2e..1d1cc91b2b 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -21,7 +21,7 @@ Beginning with Windows 10, version 1709 and Windows Server, version 1709, there - Configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. - > [!IMPORTANT] + > [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. - Create a new Registry entry named UserServiceFlags under the service configuration in the registry as a DWORD (32 bit) value set to 0, as shown in the following example: From 61f1ab904c3e5fe833be39e3920d15b428b80988 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 11 Sep 2017 07:21:54 -0700 Subject: [PATCH 55/76] 13076119 --- windows/client-management/connect-to-remote-aadj-pc.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 43db69d30f..2d1385d654 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -8,6 +8,8 @@ ms.sitesec: library ms.pagetype: devices author: jdeckerms ms.localizationpriority: medium +ms.author: jdecker +ms.date: 10/17/2017 --- # Connect to remote Azure Active Directory-joined PC @@ -33,7 +35,13 @@ From its release, Windows 10 has supported remote connections to PCs that are jo 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users to connect to the PC, you must allow remote connections for the local **Authenticated Users** group. Click **Select Users**. >[!NOTE] - >You cannot specify individual Azure AD accounts for remote connections. + >You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once and then running the following PowerShell cmdlet: + > + >`net localgroup "Remote Desktop Users" /add "AzureAD\FirstnameLastname"` + > + >In Windows 10, version 1709, the user does not have to sign in to the remote device first. + > + >In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. 4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC. From 019c82ccf0d5a5afe80d276176559c0c31fce11e Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 11 Sep 2017 13:55:09 -0700 Subject: [PATCH 56/76] reviseed screenshot --- .../media/user-service-flag.png | Bin 16441 -> 45132 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/application-management/media/user-service-flag.png b/windows/application-management/media/user-service-flag.png index b285217937e6e1826a01e70ac9a8968200af6a93..310d4703ec3457e3847e574119de339220333eec 100644 GIT binary patch literal 45132 zcmce;WmHvd*9N*#5$Tlf?$~rocSv`GG}0YPBO$P90qO2;kVaBM8VTu;kdCwWR^Rt| zp6`9X@tyPII0nPTV(qo=b>H)z^P1PZ<_=d@ltMaj>4!|ezTqLwyR2?i_+>M>g z0k4g%>|L1c&0R=2m|2yM-7+&Gw`4aQ`6~V8lgHW!}lo$GlP|wqnu!<~ z&{~OT?O_KG`1e1fY!2v=?~7Www>&VA<9vb%X85%yki%qq@fOOknrJ2FI~ptK9|@VV z^)Y(1yA1uW`(J7JiN#c-KrVb86y_#_wnZx4bvt&yxgRbUvyE>36!I6T7|Wz5j&V0j zd&XBQcfuLkS5bySO=p?gu`a_8CvIXfGvro~>yl;tCc~c)!A~uXjz*W#4)9D#L!Lb; zji*BIW=wZ_(PHC%taDG2$?@PV&+XSN)wAn!B!j5X;yVQ zdZrHi5XBy<-fGRWo6RYJCX3}tNI27ZB~nA%YsY=h%e17ByzA=5e(~ zuvRDunYt(tyxgreUYoQFOdfo#z_$h`#zVfSn%kw3H0Dv7ZA%~@PlDv+gG0L8?oJ~xY@j^L%=yd=ZWU-LMEwZpF zw}0$x@6m>4rTEdATKHhYDC!r!BScCW#BdSGrvc5dUIw%tm_fVP3i$+(%*JO+>pyez`C-#kgFR0o8*!V?5HVQ%S!M4oEQPj@7S{I-sjB=p z6yT|GqKZ$zpECUtJP8z;*?>Mqx{~ z8QHor1v+G2AHN57W0w0wK9Y%?h=)wrI5*@CoiS8GSVALx+5*kc$`in+0jEI_8^)(o zt&u+4-f-YSepdz{dkp@=Fb-r`@Q`a*mmoWU26EWx0<|>AAz(5J@==I40myUz|90`K z(~*J)p&z3w4xGCF57AdEjkczQ+1HtV6dIv>?ZdJD#mxA*IMM^~T=x zrK1Oks%%$3|2WDc-Uoc|Z_1FRRLsbJWN{tws-m!Kgsgx~e`PG%i_8AV2DcD2=C0~p zluy)wnyvon(kIxuP`1<6+EMU2S~R|3fLeq9T{EWn)ETsg!4STd&!i z1uhr(_OG!Zt6GrJ_C(M-CFCXHn^lYPQa?((>h_aM+1%3dWg$PD-qWAlo+eazS#b)L z%sLG>a=CBt+4%si&RpvQ%XhAh)miovcvdPc&hZ+*tMo%g| zwd_(*7jzNYKu;&R@F6qt8tN>f!W=SxzE zBYaHFwY4_)nQf7=PxYhJ5U=iemEm_nTFA}t-d%GutPlQuCuiW>)Rjeo^0e1o7BB#CA@B%S9UzC$vrjxPpj*9?h_9vZX<@EDk6leEc7}Zb)a@xULwZj(Qt&eu zjyeiMt!j9w8I_lAH#^Ux(8^@&&rDx2tD6%g3ky`%~4GrH2@}SDkuMmVN z5an34W9K&T2V2(>$ESIYw{$0AxpRp<4^a+AI>5!#Ul1u;<{i>c`ssW%Ab>mrFo{Ix$9&@H><2+QvCKESM~1S-s-xSQmZMt zYpP!x$D&9^#rLasum_bIFl6P3yx#csbscTW-S?UN+0IiV!b{F1Q@!g(A=zTXVUA8q zAJ6OtX^Q1sQK>HRvXj0o?YU@#kaAyXA$l{CUNw9bB)DAi;Lzr5Ou2*w$+(McCcUp_ zxSxxe3ryEscBS0oufmOT5_ieq*(sw1qM7vhDe;u{{CJSgEc=hRSI$xNUaQ9;6nk7p zN1ruK=HMBdfmE)Lrf{|f-cLK~AL zvC#0o=b0{?ZCB=r8M>u+Z!fO$O;iZzkE}7}JMtZG9q04cJ670FVpNxkmJ(=5;Spi( zCWK%aKi-~5s=MN=QcIct9=jpv_3lW5kzTEza%bW^Ie_C+@HSh*r{r9}<@CC7(*>09 z{+yf0@dV#Af@eE&b<6GOewT~vg#Sd*vu0EcG z7f!zXl8z*D&z_r-LZ&?ix31~SZ;!+SJ7*woR_l$-Ova}wPOjAcUylfl^*(S<`d-Mp@iLnV+@((;=ZJ57^5!(=qa7Ve0tL&W#78>+c0e3 zdvcm9JTEDInfRpGZDK%Sa*c2KAQIcnT&tsT4JRWy#-Ng+V4*&p)PJ90pLSWae6|_2 zP7cnzSCujVZYT2*TVs!j`I5{Ns?AyDm2egVTaQJd$PBEv*E9AZas~WNX!(5A8%r_( zoZ9f}Jo=Y01vbJSp$@8I>f!TQRyzC06cPP>E{6}SPSXyWoTjb}cF%oSb$#0goa!-D1zz3c)eG(ZT>OV6a=t4#oR2%vGw2 zy1r#yw~cwQ@4meT30l-%R(DICfZ9&kdZ>QD=33AVoEQa^-Sv|5(cL?4eUZYBU;3lSt zPXZ=3o^HS%9_RTS4YHnaaW2j}vA7=C&C@R7`M7NhDHOP_JGm`jmG-u%$xmo)w;YI|2aG=$=`r=&+PX=3?et>S)lDSfVrk>PRW!C- zlE^I=Rk#+$8eV6zbCWw9k;Fp^MrQrNV`8i3{xt~o=x4XDw1L8l)yWy?nYQEts7#Fb>njF<&3+Zk?TMM86kkE!Z z^_l!K{;bku+~D!_Gb$6!$|pGPbRz=GUo09xt!9Wf;hLgPDqu-m$8K25RxiYgJc1Bd z6Q(1q>NOHCT`0BRRx5Xh^t0)Gx%f~(a2sFkHSakc{c5des8ZB@NOZ&}RO{B`8D`=E z+@WS9p^>v|Y;IWzX0NnetxWITQKa#+$0bw;=Lo?>pO1y+K9=C!9^#XwKe~!%2alrJLA1JneX-Z z-4R)!HM?MD7yd?~jR>aRBr?t%8jgy`of}!2hA@s8K8t*}#{`kfYCgx?T-?L29^*Y! zvsO^sAY@+Qr14cevz_Q=x>Y&V?_qWb*VD`Vdg&iCG`wf2Qw`#^O{ZE2^@JlN*Ttbl z7A;VTJCfZ$NVtm-TRTB=$O;*eHClv22Q%_+82;!ebJ$_yZzvQ1H{y^102fgj^p|W;b)Lfk0EEvWu%DOf;eO@8+lmOK zdq#NQ1K<_49cxVst74(D*ygRN^NqF3?+_N6AMkmejUb|S82EYEc*Z2AeQx1S^k`~7 z`!+A5b7&~o%!K0n7OE=dLe9S;)*^WTFYG zAm_apl1GrQl6rjZ%mM|PRVfE0KyOBK9as69s|m#t(1bf>;XS%p+D5l}RH1m~x+I(t zk9drl7~Okd{3F%8)T_UoMu>17z~ zrOI!)Ryi~CtzS<{__|+n)FRaHqsX=CWog%iOrxkTUWhi`xIpa6ggNcK?`g0G%{=(9d-xzU1`6v zY#nHof?de=X9)mF!7+l#W!K&t1xK*$~2Dct~AomXZ zzKUy%a=AsL`y~wdy%mW@Ckhq1k93w^r%Csq03M?YuAx0&M=N=&5)upSkCDRHBl=?G z!B>H8v_gz~pwf3_Z0-Kx^|2lytiaayFz4u^m+YwJ>HFhsH+x5mEsc#28&cuXtfB4i zY0==);x*sd*esEo?e?kJ_&UNUi=KsvoV|O=`ekSeDG!OtT(M$z9joB7DgeZbPoFD) z{9(V#*%51?HHCDvYG+3s@AG}F8UrV z_x2X7bcn=Y5XH74G5Wmk*C4_!cwOpGSJ*Q>$sA&+<4FQ=A@%BckC^m07MK?z)w0M| zmYRRCg_y)})Hh00r)gfeqxigh@aE<1s=yn49SbeG^&c=Yxp|gPa=JfJNqsP#oGbxy z@`W@$OrP5EW?vX0#i15NDT)lCkPVW=>#pc!Pa!^8iN#Ca)c>fU0tO7oFX5bW$w6>FWa9m z@#Sm#d+*)86?im`3EeC?(s);xGur#9v!^xwMMNr_N!D}}Ez?JfU!33Q&&wu&j=fp- zB|AFQ&AJd#p8jhi6y56MwX=x4i?*6snKz>|C5G9C&z36A0>$P=3Kn4YtqI!JG7;(7 zs#0ie#e312ZjK}*u(}tw;ZSSte*uD7F8B0-7Y@wC!>}woxRFkSkeNTV>F_api%m3H z+R@}0og3--c`rmyqpKVE84LA2*gF570XlcYbx3ra(&M0^~Uj>Yp$$x^)rr7bVelD%E;+2 zlVg$L0I0@5CO1!KDBy9v>QL^uZE+909NutF0#aROS1!Z>DFQkL$h>m#W#52Ou*Br6 zR;WmZ13-9>q*Dx_39ISkMF}ue&<~K0@W*`=rkNb@+#EczAK@*uO2g9I>IgGL!W6@OG}3aH;dUL9BIyTi(Dx&Orckn;f>Q%C-yi<%qsMK~(K z4Gy8s zW>;N25ub(sUAi|8&PC=e?F2d_C*k3>bfbxhk+XI?Xwnssgpi~^(8W-N9zY10h@lsB z&Re5IR&`=3A;ei006-4esqtH${`>+>bH*4FVIl8x#-fzEI!?CUN|4nAI4azG&24fKEv zQpmO~iUn%qYn8eU5-4R>Ys%rd>O_rAc=;*dt=b-{uIcIQedj1^$Tpu$E>FiDIDNE{ z_KJ*szjmdL0X1x*IjqLAEK{i%x?2>KDu&eV%aK-+K1%d+>^ay~gVdlh|`KL8wzuAv2$GT8-n*zy*P_;!B08 zO4xWN_-hTLq z65})}8nUr{5`~>ZI7sZ&)HXI!o0oy8-Xm6T`GP+GHckff`VmPE?=P5CWVSUFe(>3% zsn+9&oJAK0yMC0#_KTCf@%p0kS)=O?Rrph*U8uz&B?4`1lrjYBy?R-~gEbCRn9PTZ z(}G}8VkoQ>DkTqo9<&-eww)n0Ja2WLcQaa}st$NkQ=__YA#H8{*mDm8a zR{To0mu5@-TpP^YaBW{GX?5yzq8-+Rz`F65aT4g-u|lM}pnv;turb7x6vYAW1&A}p zk?DaRcXQfbkHOE%n$GoLd8V61oo6-~=3^Qk0J5w=4NHg1?(RO^t?a%VMNoPReUe+) z7#^XLMol&a1<&GcqNtQiBEt-Ksf!Fc6c!H~$B+aRi9#Hb3XQp6xgNa`gP5Iv`FA&; z6OGvR!GfdlxW)Io>uStdH%FLW3_4sRoj2t2I>7*opSA4Q>9ZKT?mhi*6=kJ_nsE89 z*Gt%GvT()=_S5`}4ZH>sL0){oUS#eg+EFLRHYi>B|01q{-OwokoKD?S-b}RC_VxM9PCJXk2wz0CCDm>lce35U ze@+-qTFg!x>R`4}q4432N}nn0$e8eh_&dWoEea-`p&z{5AM#?7WzLbWyO4+}1eYnH zTy45QtAt9vdOwFQ$zMM1MJHC8l4hh^co3CqasS=$UKDYzY~qvu3&k}D@q7NdO#ifK zsY}dd)|eI}T54AxVvIJS{qM=f0!q*;ht>M1{zTn`4g_p1H5wu(R)zooE<(nZ zQx9+dRACC-S4Fq&rwIN!q{0zaTY;p3B{RnWk;#9Hd2x^PXjUuBneFKU6VD=x3lpwx;Y8!X$UURHrCwcR*1?<~4ssd)nGqPV) znRKh1BvO>!k|j~-d9sNZCp|e(} zz!aD8|MO&<_`H8ZcI({81Ul>z{gb}Qf_=MK;IZ~i?w_^ta<-}<75jObG);~u3=<2{Njaq6)A6LJEmS;YgZjXt3 zwLWCtZE00fz7rI+!1%8rmqWjT7>%f%)O0#->czZ?F@OY9Ic?p;*WV# z{8o<;1j(qZnP;-l2by00jx%ZR*dAH3sukr1(U zHohfGK&?J7Z+Lz_o+hTu;8@NiOTEQK7O#fBz#cBMEJvC*5cQd}ohB#eHN40V$2@Z4 zNh|%M`u5D&`4(o-ZoXDAkD5LMBAOcKsc=~u2T3Mn{T!3$>#g%-J9qTfIL!})oCFzo zBiKb8&k2PoHo`7yHlChkAo34=f7!j+YyJv%jtN3uq%_e}>?xdPcKVQxHINJATA)JK zST+jesW8NaIm7!i$p@CJaPnh!toXt8j|?&@Q!$S|N!v zqh~1SL-B9+UA}kMFqEvHP>Q84)WIQM}ZH5YDSCYR>;yn6s?ut z`bHAgL?N{6zxNroJ7T4k<8j34b`e?FWKHWV5+Y4Dm*A}?4<>p2 zg$_I2l7{f^RB?Ha!Q(__X*=47|8U8uo}1*w+iKOCT9VmPvD{o)BuYu0pO2M67q1NL zKK==m=24JiXtRvA$gNe8eRecY!q=&1KbO@k1bKqXC3}4?!u2CSa&R@HoLDu|GL82TM*q&eJ2YeUm{ucl_QS@qSA; zmISFL6v_b@458U}vh44$+-IyjdZJ&goxR$p!b~^5xK;^`w&D_+ZLg)xqC3{3 zS8&*{;&Di=&n)N;DoeHcEI-x$9+Z`DHAjBV_Tv!+jl{XOQ6%#V5j{78kKCNu{}2`Jh!N%deB)?xkTfzg&icgdgiL@o((Bx!}-|pn(`e zEO@>4j^!hmVW2RDkWO34sU^URiZ~G69vHNEUobNZ-Q6R5fwrFsig~wIarjGt-=4Q| zguyfASzo0IZJvj27UB|$JzSH?=au^?UDd9s z4J9t`tGKW5e_eYp1+&=XETwY*UPdVh#c02st?!>f z@c8d>aq{IxTH)&moy*B?IovWHZaV8n*!s0!xFwOaZ*A!Fan~00&dR<#GNa3Pafxk! z#k0(6?{2=qLM&@q+`#9E-67rIo4lkQQ_vNVkr`ybYC0TpgdqH}w<}=^<#U zd{B0Zc>Xe5q~fpE1IFr+<__+fGAY|hlPLS{rk9#adlA!8iZ~N~&K=yE9DTw;EA?e$ z38yY0tScQ>I0x@NNW79(#A;c(mm}QwS0|m2BE@g=CDJ@Vv&XsrhDv^yaZok}N*b(6 zg+FZ*{p$jPdD1#WrorO6@y}6Vd6AiT!`hd$qwkw1GqSnfxTh`IuH+ZYzcBUXkD(K z<*m6`C2}zt5M-cpPtqnK{esaRzd|gy7_*Qx;$(HaEMZX3%xIf#IGg)@@l#*Z*5&c1 zcNoZC!GHCXkHG*XonI+aD63Z%n?}!Unp3JO>XY6YA1JJ~*aU+@`+6sI4NOOf9VpoV5ilrvV!vm@v^Qd@*kx$QY5_gHSJ+287q06cJ64HqL-Ol7TgeFXQ{!=B% zCUz5Wl|^}+*)deC{grIJS^pQ+4Yw+egx(i>?Ge^DZ!Wi#ITaS7-g&bJRd-&`}x<^#EFp4_0kook_gyqW09gZtm%-qxmP zH?>R+c||%P^Xzlp=UAcXQLIaHfm~htW=Wk4lQmtKpZprb+=BNLjub1B^)VQU`4Q9f zY5Q$S_qDtbO8enq)>Uq_1*O^(gHO-cwQO6SZZ(r_*N1;g$Yv|Xvz+6|Gmlgo#EF6b?Iy%`*8$RgZY*DCdS>rIRCcM5sN zK<=)ir}ju-j>j_Q`0zC*uq@Seo`2PdEv$F!&^ncSn@EoM#!~-@w*-0N*1*;i$gtr| zx5>-J&|6hFBsqz&2HQX7H!;4E$>8JqEc9^dco`wW`aR&AnZHC zf5B{5mCdc8Jc%LYh0HIFWlC>}-JLd04GEP6?uz(UBj@nx+EBwjJe}tvBO-H%w)Uv>rK^Vp2NeVl&nbbg{kr6S7u#q$h6$!nB4w)@tz5 zPkZb~8_C8q`7u?G&-#&1wT(#nq^T=PO2!@g{XUH{R}-GcVFj(-l*WHcy>n8-)Nh!OP52kEe-AHbk%Ra zi^WR(b@fPvIm}BbW6Bv(#TC1$#N;P?gd}Z*V43T>;J{};bP?6-}3Oz{Yt;uz5K)banNggA}e5tFovj9;5X@;&(9Em7-BJF z$}2y~I$Nd>vgZvy4zU5v&GVccD#~>-57~N;BFr+Am-w5~K@?DGISCll245dMzbtLN zX?XvgrS|<2K5Aw-G1%UCNgu-rEd?lU69Q2~H&$))32S~AX^%V38TOd=m$i1s*+w>t z4nBjkFX;j`Szau<`1Uu0cjMwh^N!pQU1REQby39@lH6;}BA+Vrs$qLQoTq#eY8FK~jRe_h8gG5D%F@s-9zam8{|#7KAy4S+2QB~-f-B+R z;@Vu6>G{`{CU-~2he2>PSA;#ACX;&FN84Vt+ajTLV!tr*OM2I<(8Ea=9d71V4GLX4 zt#Z9sQNhda=cM{9tvY&o7#bPPpYSg^0t!lSo zB9#LNKfNii17l-2FLK22r^E?D`{T?t0;WFEqdZVKvl@SeMj^=$Mct{S!%-FG4(3vJ ziM8tFaf&Vx27?OtEDCH*urZ=`@zlp`h0Z${YF1jCl8*#qoS>QwE8)_`KvV z6B5hVW*>vEQ99_jXiG7)(;s2we2|f{R)@_q7gPI!%zMkF0P_bSkEZi~u@22e5)>T) z03^i}E5S6O+-^tL*<%?9-B{Yu=IST%uWB|vomfQ?p*MvLftX6)BM7kw^Vbr13Q0TV zFASxd#t5#sY{Tt}qQvV7ryxSt0gl|9(YvKZc1T=Fs?ntvr*W6X>}71$+xP1ZUKWEGqH9?4~ zknI#qYN^hnWkkPqbj_>v=k1$2H5@_txrND|wMT?@fc8*>w#yK|JlAIW8I;jOro59Q z;Mjaou8`AcEY}~|n4;1A2hzr+Gtkttq<#Og*7mN|R$ptDucK1tb5n4X^Vr1tOkNTt zen62Fv<5<9UMgRubpWnH37I>*1BENyiLp*uO*{!bI^_NQe6nE{UHF)W*-tX#8O{S2{WV-#DVji*M%gqW8S(eqlTTEUw8|RWd4mA;aIv4S=L$3`M!B_7)51J&LY_87MFOVsdTvHryvTm{TRBZx>PLe4hG}< zH7YKts>X};`SK!#-=u`3JW~_LQexOVD~z1N@*(nm`g3cEM{Bg2XlGR2_OrnEFvXeB z2;zVv^_X!q&u~W4F576iZwaH@o}K>yklsNl`pHCy#^9GR50tACoCLZ>IaM|tIiF`Hgzum0C8b;Y*0P7VSj!~a1^*Ncj&>o^vknDOP$T7= zPcnv6p-LYU^hCi_odOQnmWk{|^VMqd)HpMbB++4MN`H2)-u0syFx#7esqn; zSRcsdg8nt@*Vs@Z%nXeu^%6U&(#NaX7NpkA)B<+H%9@d~LecB!+5%kP+W(sYyIPnB zoWVhv&vejLlao~}aO%8(!|v50Z>(t#`e*?2EKSwtJm>reHc9gG;aG9qW)$Z7BJ@%z z=>?-NRmlgZr{ZJ*bhp-SavQf~{G!pAH@s+*XdS_&hsvNO3w(WHsfY4xJdR9U-lWo|ov;hr>AF0^ z&h88@q#UzV!gQ(y{#c0Qu%GxgPVx!O!mSQAnk$y13Dd^ek|ZS081=O1So=poPbb*V z1dt5)9Y7%ENu{S9)>V?C`U!Y(@?ldiR3ybw0Tk%eCe*_-IU>`2Ol*RMHXQJwRVgP( zlz)={uYT_T5(}D3EG=;ljyP(E&%Nv5)&lO2OJ zo|HYzH?%*R5Ewv!W91hri4V@;GNR|}1GCWRIYa*~usH6HMp)KGJolw#ub$6KNo$1n zz;D~X)tdkSb+ml)Z>(D-;CFkuKUb4$ahrAx|DP0nL5V;gZR$ASawn5C-fI`AD~I&v zU`j!nasE4j)xJwkPW23j#=LbD{zwo8+(7k9x`THuXGEIgKaT@${ZY@C23N=q{eSwT zMOz)Vx40UM5F=LVXlu)~zax>s%|GK81rYvk99sS`5|}&sxni{TTVVmAjZU;WORxd? z&wdx7{;BMN$bX^YzJv~j?%#qGC`vGek;Y?F6YKL5q|nc6yv4Z5h>95 znc^;6syI*Nm*&HiXb;8eUf#miWI{`3Z49vv);p5SH?xb?bPE&DF0W6ylFthM(2 z`b(eVTn}~09eAtwkZ~M+zlVq`d3o=ES4Jk5G4nqu zKY9+xD{&|U!w=#K#wHCs3hF7}6yjf*liGTASSz%eUT%RkxjdnU5jA%3#Gc195o{df zcGRT}K@ywozlD|mN$Y5SohQHW%G^S4NSs}Tl@CLX*eLu!ZDK4U|GN18JyOTuTA*to z87{qKvbhow$FikTa#s9=q1Di1Y8!Z3Ltc69o4{Y`%3M2rO+Pe^P9r&PsQWx#wRRke zhqo?f&kCmw2Y^ZsRVd8;xU|}`3EB@drQQSciI%^k+r{Qqw98hYRanqQc64#DPBgre zv_jpzE}UTTUt#`$X}PQ7@S`@JBhK0@f*sbxVI$^~XKyeyryW0=;+@`*u0wwz_Z!CZ zDlArQxd5M06(rSr;w~w}XsG0CB>_TefJGf6>|lwjw52SM{iRl%h2Jpp#>ZVi=N~-0 z!qb|+^AT(psj%PI8>j@0&4TXs57>lG5MhF1R#`7vfR8cMZ!Rj5SudV&`!a;Utn zS|%UiJ?<(S?!wK&oJ4aSHRhR8d`Fy6CSZnam4{v*X+Hm2j4KV>P0~^VCS*{DkmFP3 zyLaK9qf@30w=zi^OfA{2KYQWonMb<l1V$pr^*V%1k238xE{=AJ~ewK56xqmcAH- z2Ou;SU1XV{!ii3<6B_~7sU&(toA9^A0ltX@20F)$Kz~!0>{t?29jUn z{WZV-yTlw7zr8fh@Lf^RiV;31&M@C^M7H^ll>Rqf_@^9lz3baDlZj+Yu?fSAf#3R5 zPL&V?g`f_pHwJacaX@THsp{Em5!)a0-Phx-@||N$!ama9FyH(1Y33?eL1&c7_Jemc zaRYN3LuXc8;|SmmQp?J>Q!P=97IVmiQ zBP)sRPaCeirM9xN(cPPZbw@JI50q%3)FRp5{67aki1E!F3KRtd50lcFIw&a+)*L;# zN^Xty^uOD!86))m>0Z0(5NoHQu#u^hvd6aXbq;E?;;MPrVjoMr&+y#*TGDaq;Nf^w zoTL0B<&{C*me#tU>+aVX+7oH@_)4)iqi2U_#HmA;Su&kU&-8nyDZ3kb2;i=w7sWA0 z6ql;%x>FzBYD`%Cct2Sd$rae}8N(!*Bigb;_4y)OsMrXXxLZPL&&qn& zk$==abXmHFZDNLZ>fRW^@xZnCEq@5xLf2-|K&8<5NVhH}RB->3&0m)w;QklN0BdHE zHL6{>pSE_1S9iV`>Y;mDL9_PsC2*I4HfS3A+Ly{&mqJ3wd;fWptts7erB8kjLu`qh zOtDk0xlt&vd@X6Jg6SvSAHGFq49JJmrNKA}7WdkfoxDOPy5#Yu3D! zSiKd@bBP|C#2G%?@GS^+m zYE5=Qh%aYbi<{!%e=A9m=pJAH$^^k`%cyRfRFvl2$eY=HaH4HY{;la&1nTL;XSbvv3<=WwM*`eEeG0DgG-u3 zt|72xqFZ~Cjtf=zM4>L^AqhU;l#8@*Xi0J~%cU9YP+LoC?-dGvP6tqf#z^pv7SI^K z-KZ?VX1hC6eGdcxl%vuwRlsnQ-A{ekd)AkdV2X@NuT(rXlMXleQ70PI zMeXJxRn^y1ul4HXPV{x)f?F6Pc*CE(MuBM)iJp7n_*U_M76-D#!?oGAkn9-ix~cFU zZz0LT82ze`LUcN{J?P-?Z&0I{Gyw;13$F5^jTr1iAh@q;&cpxW`m?al)!N~~S1LYH zIb;pmX%*@#ek)}JKsR&;{R#Y#)bL~cji$^H$Q9fv(FSfH$@F`8Dk$snL(KwLRRFx#?l4yF(*8%I3p^nC7n=g%+gn;%M27Y&$^~kil7)Ye zEG3aHI)5bam3m7Te6IV#H;)v}Z$iXB>Z4Bzk6a`RZ3`z6_Hz@d?HJbBqTc*%a;EO8 zpcl-!+@fK-B-rhSD+EytXN0IHKf=$KllAK%G<-a%z=D@;ne+feF^&hYK!OBeF#N2V z4^A|j*70K_YyzR{f4b2B!ksXMZ5;52}bH27f^Tm~`inc#d%uUX`UL z@_~%8cnF4pVWKRW_r&Auv9^%rg~UN3d;F%CZy6Tl{)LSWf*?qjAe~YoDW!CGcXu}ef`D{)E1`5rhX^7q zrL=^IfFh}M$9ZM|1;xGh|9#Jwb6sbD-3T*J{MK6cx?_3Lj?H0c>-%=ecs&5jm%t%T z|L3xKK@#IEFP|-uv7yrG`+(bXuA|DQzeOOgt?hlJBGm($$Mhfd>k7uc%s54DLAA*- ze!+8iUUVzzhgnVjw-jN;+^IT5ln(h0_91JjjLxDL$s6>r@PIC*3N=Hm4Bbp#0K_7k+s9`;Fw)gQ>`aifGBB2Yr;7@@0b1M(qj8j)^u7 zm~0=9VOR5ECI^KAt4QQkF~8+aWJ7zuVwO!C40n@;#YK_2JNT38A^jo6C(E>7(P}||EV9QF=W)5%Uqp_R@W`a;#C0EI%enP0E z=^^*}@TkiCgSGMMOOugAvUe9G)@Ys@uR>kpVGipk-=nGxmeV-4FwZ8vE4Tdo29x2# zY5Ug=NOe!i!V=?3xLM@lR%CY93e!92RcuruQJFhQYCam7Lk680(h>OLUW~n^@fQp&VDr zS6{H`IYx?qc)yR&z}Ah|U-zaTU$XIoEsBxuY{&JP8VK{mnr)5uAV!I0&++=M_>(rI zuZ}fEB}D?`lG|4)jnIS)VkP{;u1=iw0wPgNz~@fDneQV~*fOOyR)fvYgJZO{4 zFcXeq+V|vMr%S60KU~x)9$BRFb&JV8D4kq^Rmc_+A6kNYJP@nD_a#WXYh&%Mg&`t9 zOo1~HOn$p)j_gpd;i*WhRZT`MRHj9z*&StQp_qspB#kk64F$_>Yr|^Dl~eR5Sta?7 zNQvLm*9H0-cv4kb*PXnpO+z2Dk$n2rd^qBx(;xWR@QF^>mFMA2qJ_YZjmvAae!Gg0 z_ytON}&W)Zm;E3a`ne>cYbOdClbS7zMIAU|3$StdAP()4zs4)`vnpZX?|=af z2S0Ef^Oimnx;U)ki{Y-b+bqo(#6N<_tpK$6FFnyocm8*hY#Atee9>G^yoRakndcZS}FB=Ek2mga%ND6IeIHN=_V};lJ$@>3}QQ?DU6l#_6I*3uR zdSO$8LAyg-a?CRlNLq~*o|^>*TU#-bKe9qoZ!CwZCOfOe!OSd(n|=R+V{-g`W1gIJ zFik-Gm7}0$-uHT~Sx`Wq4cNWS!E(<-DI2e!vFF{lo_8ia?{a#!ZULk&V0-EiD2khm zPD(8>5C`LB2DwK7ID3wQ5XmI`3dWTW){`wuAd<<%!+BQaeQNYRUUz6L{IYw~z<@EA z76!%ctjb%*AIT(kS;Ew=Ud?kSj*1s+{dX+~C4Eb{D?!Us$)xbS?xanNnxm=p@MCpYh$PA!^(h)l?b_Kq5?m)W{_yyHBZF6t$fv>Yct_kbul^@VwW?JlX5K>E6(P}!rSU${^yEDG>e5lySAd90X zh56$Kc8UPzbi_N5rA0^@hG_z&8*hqp^U?f>!fS7OtRGfuHHY-z_C<3jeq1@G^?qr- z*_d1$uGh9Y81YWVb^bAH4^|Jn2e3JkXVg=P3L>0%5h9)oJ0+;a;Z6Ez<@WAIt!cUH za;#mLTt(A2c6q#=snZsXup~)NcSq|xs|E!s2hpmgL-L+VZ4zOV4f@=()1gz(1E+uu zG*z5Dmi{W=YLL*viUrB{+QD~jCO@L4wX59aSBgiMS_xf)_)MU~x8eJCjkR%0BszL% z=RNL5%9LOQXIUo4PWdA-(qk3bhta-qt+m&16OJsBK9xWK)-gGNbxcIVf&9}bXuxNO z6KtJezQ3kRoiUb;_FZ|I?vqleOqlyUg)Z)!DtMgrqAxv=BEEX|GM{ezvZJ5z&|+xi zqcH-Ou_T$HdB&d}2TNcnDduU-E#`{JTn*}rQiW}JDiv9ilOaqVo@kwMwW?{&aGSe)V z+3h@*P)qvcu74HRY=!|(M5ai9r&>p?Cu=U97O`M0uL+089!qQe{x^|*ndG!&omAC3 zr&3;kf$PA^*NJ+hh38%AeWV&%aeYr%M4e_*mr1r!=e~pFi^j;DWh*-5+m$cTww(sQ z+}UcON>nLI+eLutUNAc>V?(RJ|uvz?P}vzmJnb|Arj4LTwgk3yAvZ*8p!p=NkSw( zc)ZF3Z4V@pr(m9}{PydhY|Iq3aB@1_ua${8ixj!hwar&dQwU*wNDUrJ-0idvDCi3D zOFtP*&D0JPuWqf^Ehz=X^Q3Xo%eR>lBkzA`(9U~B)7(?HO(xXv;;=xiK7La|@kBFy z!&UJux-_zbkXb@9bNXEz{>)J&da7%f2rEbdV+8LBEutQtzWJ(39K~XSMx%PlnqFJ>8hpkRSz;WUCY&i< zoQFSteYJCqhhpbo`TKxn!O2mm&$70+414_~#r{~>&lQXP#g0OnLeMlL4&@WNrZ~qJ zp|{bxI#)Q$WSP-v+w_$AdFNQd4F|m}J3aT`ORcjEGd+Y-2tCtRZOD_B>aX6RHIGc* z4SBpY%+6AQde%gaZxWlULL<=&~=56xe{`R{iB(zR9Ows6j=Lm zG(d?2OZcd1)_m9RX`Ja=h1*fL8y>!v0y}3+)RquOT&)ma$rLU?eClj`faLW7;0M1#RhM8@F7^hDaaJZFeAEHeY{S>{r;?R)&&h za*kh)dQLY46aiLHUU?9l=0t#XY6NmHcIWKRS*MZ#c0DFf50GwAD5FzD1NPe|)+FW1 zjdNheC`dC7H{joheGjciY*LprM)^?y%bXLA-`|@c3@^FJhyz$OgBuK+XD`?#a&7!4 zC)fr(PE7AhZ;B9>l)%z9m&fTz+>m4RCrXs7frPsEIywXGdxl~}1Ht2)lB;l*oWXDj zulpKFrahe>+YxEg-kf>=ax_g{lre~ekHPis<13EYI$=w4+psfa4$5Qb=8RLtqdU_UJPa2_3sc|&pQo_9vAx<;^^=~3F-0T6j%>!#DqDtVhtuF416H-LQMm4Sw zBn$7WO=ZL|Syz1?ZGTsmMNOXSrmPaY&Ug#mj{XCIcqjYXXZf6a3@06wcXT%2TSt`s zWDJ49R$7~MJ2ASVd zdmJ$bCuJW1~PLgiY8TR z)?nfZu9h>kYw!9n)tY&14$b5ob@;1ozOgx6>GDEmz?vPGo56iIr2YJbu8U8eYQT|m z#^E7tp`ACa4JtuO__Z`*UsLf_9NHA7kGN#r#D2_yPYvgIs40VvzRcjo-+e`aqHOZ& z8m{7()cgVb7({uii3NmeL!Ga(nFvy4S3YIwuel6`AX4=__kXw-E0^3j*Y{FPAix1F zVgAaTXQhbbz_(c>>spo$W{p1V;o#Ag)9S2v^t1B9oBMstt!u`N#qlH% z`p_5UxHao_IHYsjNt>EGIR;RoQV?ADZ56~lJOb+k$KeH)n2*Ywh>XV6t+K7hwb>qf2h4$rEl;pMg!qN&_lpI+5jJ0t2-i)w(E0M+ar#JGJ z9R;6%c*(^#=ioJBQcVk3Ov`QSM$!BmvA>gnKSQP|`?5j@+M6KB;eIZF+1P zMrfia@|X|7u30?;0VH@|?gWXd9vm9VP2}D+eT7M#fNY#1 z)N8(~nQ0%!lW&xCz(Geqp0Oo3N~J;cBY>r=sGvAp%%sY=^aktGrccP!uXVPPWtNy; zNPeok^F04*gK) zB{i)Uuz~xluNZ*jOGg;W3s-7nA)=Wj%&8N7u#$pahpeHp09pNp3RDnQ$no{ZHvw}V zed1TF;Z2gFNdPUvvL)>^7icc_IY)AXD`h`*qV|p#jz@5G^Q}`3<(~$LvWg^meSx?Z zL7LK`vB4{Hx*2Sq46%TOvA{_}$CQBRt77 zyTJ>Z55TGgNE<*tSx^C2R$=!Q)7cMJcF4E=v`z$;l3qa&^HvARp5nu`3rx*3+p!ZV z(l1iWe*@r;x6{o_lrq6ea#y=34u z9SgX?VmPkNJ-I>XQGc*9yheDNEdd}Vui8JF2mI_RJ~lkG|FLC(er~`0sM&MZ=BSVU z;n3ZmTIv&S>)%=#*mNGqJ)i-SJLp^6?lc^fy?TWwhP$nClyNxNc?7&lL|oi0@4H(j z;sz#UJ{%my*;-ggILc&+p?k0f+w%0vv9vXOjXD&LBN5*qF;wC?d7Xap~Yzw0xzOr=k14B-*&P%|P4v+_3Ty*p{lD4B0DD6=^ zMI#OHM;WoT87jp!AU}221TTLpxnyW`Niwn!3w$@Uo;>mtFx!uhkwXWQ^$`w+io@#{ zWEzAM+<`{P=bfxGY>8f$yq&Xn_Rijg-A&0^uapVD2Ek=*yw3_SR2-3#yHra~| zh*dl)8`|Pg13wF-%Py@^co-6l7GqIlG{E5A;jwu?@tm_SC;3<0m4N8&g;-P*WCN#< zepJpbA_1*i6iFHyVWL|58hr2vNl)DhPslc;)CMIV7({V>LvUe-k<_u5 z21si4i;EBTRA!4vzhwy?bKpoki*0t!8Sva(qIUfuww+j5h4RKX`1SnUo|kQo*Idgf z--cgb#RTJ%CXZbRSTHAc;pbR_t3$|NXew>QuaTG+h0?=23t zvfIc_CD?WT~Sb+l$HR_(kHYb_7BZbJa47((KI4!mQ#-(FRrt zaJpk_$bjoR9G^={zKX}uv=p6H@%NE;CP>aN7>86g0}OYhu!#xxgMk^%K+s@qqJ)L;2OcS1x9_)@#zw&6~;F%ZBOOALe1WoDcEi*!Z(>`Z9$eO1(_@X zCj}dP?E%L~_oWX_A4ChK>bWxRJXI}LBH?CV%Qsh!jTIkdRpHBdmG;!^aHMz!yhDOr zSycJD-d3e^_m&nBL*HVo&c{08HeNuF(`BJ?E1Tp+&6{VtK`qbDQ-mLUQ^s`$Q-m`r z7!1RZU~lTxh0K)L_g5IO@qh&-JxWQJ5@87FcDv$GggJb7hIF5B_p>$8QoL!;-Yb(= z|CDfDtAtun8ezeGQaZ%@f-+$9MLtcfDHOF?gqJ7n0f#Y03rE7Br%%v%=FLnLZ@_0; z5#8}p#Mu)nw5)tK(rvqz!8=QC8gzScwv7O@Bpl&a*YLaBas;TKqQfbXuVjyq>1y{q z2(o>?Z)qR=1Mxw*u|F%DMI$yTcIAYIeA1aD4WBlU3LXEpr9yf$2pRu>wKP8!8IR?S zi@aZZ+QEYu)PAmJE_NcX54SYTDp%(EGVZ+IxdL{nWdgTY|7D$Y=06Wqs!L%bU>7a` z5U_UZMt2KGcPmDZ$QvZ?ULY>+!+J(ssW-he26>@D44r#BnlGa{#xkh`<8{Nq zTG#jQ*5pPXm#?I9%vu+~z+xPBr|c)|_u+VElpavLrRoc4Y0wus*O{zcPr_(BX-)dn zniL9B^FXggqx|KPWXo0F8iN;Bze5`{;atWQWF`j)r~NmwY$vLAr|mZ1zvzy7z@#Qe+Xz!W72CQ}ltwcPivdeg@tv8Qt}gYF_d zaRVFgWrBvIhEV*2(TqnG;KDv2_1ZWH657Vbd#!Pl;qd!mF+DsnPlR+w^`&4F${vOB z1UQMLnh7Zl4ZpAiZamq0e4b62heP(=AEoxTi(A+d?yj{?`j3&m z*yT?_;%DX(>a|p6{qG&d6H(Hj^(DJ+{878xF3w= zUeY05uv+`2hSzgLc=Ju&Nl`wpvtivU41HOOMzWnuuWhj^eEU&w)cTeBXo9}3@fm5@ zd9|FKJ(+jc@hu9Xn^}}qLMM-JSu0IWIgAUdemCU|s*5aNWQgk+tSeH*2xcvG#EY;>RxLbW3 z-dsg8E;$9btrgBJae^}rT#xa-7d`=3)iIc&?Dv-FdVx*PA3kbKMS_r>{?Guz5V0dW zEB38sgflqT^c^4NijNVdWnJkUB7e_Or*@Qm<-`H>Ye^R3Du8!H)UUzamTd~~-ad9; zP~&_+VsvkcJl&Yw$r$xSqO(`1pI^Ly(y{V{j+>nu3hnobzmyFAY|oy?ck9Xy+rNo5 z$Zi54rXEYpxDKM*m+1>(2xvQ2jl=nzKrb`IM5-$9cdEWHRu|tNnc?QyYji(rx_Iyk zwIPk9Hb5dwwX5}=G@f=2ui$-_y(`OLmORrw_t`IY74tp%7}W|c=~H+FDF4i4&YY1e zrEF^=Q+3n)G09aaI8M*<$e-$NQbx9N$6pEWpMIT$Ne31DAYMOlZTlMco;`5tU24qz zCEy01FbCoF0ArQ$7#Pd~xn}O0JGokFkE5X=Di?@zZ@>o@0&>8eZ-oNa=Pei<%!4Ww7>jo4MPiE{VoqTMNofG#V+ zg1w}UEjYG0E}~rDZzNH9X0yV`Vr%8i)quwku}pgGsw&@lO!Eu%mW=_KR<=YC2o7Ef zw7W#&xSNfev*(V}nf$s@fmRzFdiE4<$XJ_oDJNRHZKfnA#r|Lw^101Lq zjkpISbtu@`F(Ez9dA=@WVSsTKS@7|m2r$S?Qx|r*tyi(Iqn|AXfLu2G6Ax#w9q_*` zLC)L_eyv)5Qc-_l1CZ4_D3S53>r%hE1GvNK;{Ok$cnu>Wxh53=b6?_~`%}F5dl1V{ zUu9DH1>z}wYM|ju;d0I#LKee)=nHnV^*>>?{H{7jqjrk4eHMF@y4+@Eo2s{gzyy=g zMS%5Y)&y2SVZrteTL_XD&WW8=jlnOLFs9`R^$pATbfWq(osC4{=piR(^V)@}8Kh z>dNNz3{9pJIBq?M=Wss4^MEWx)u`U@x1a-%B>K;*d{N12tK>iX$l=H0)EqW8bYEi} z^xSvGEpt~#Q_T0bcg6g_mGsjkpx)XeXPuOD_{wrvURn32uoV~|yzQx`aY&JAZ%J`M zV624Rw4gtB`_Hlv3G~+x-7P z@5*XO&F^{8@+;pvg62)3;s=cG-4}8>B*=rf!)^{+<6+Lq@V!eL-lonsHm!1E$=V6i zbIB0v5qeUV3|nYS9bg*upl&*_3CT|N`w!?f8u1e@1!9W4#qVhjbG=bMe#m&62)1ys z)q4h(PG8yeu1rK>2bZYOeS&$@8z`FR<9j^|*q^Y{DlZM)m{_rDxcNxAO=_K~ePHRw zr{3pU&CT#!_7Nf`Cc)<$*fs z2CXy5H#rH1pvXmHxI}j)NjN8y*tHw`VgUvp$X`fMoB%i%e#&bDGeaA-#Y+cx>M3_7 zlE6z4@eRQ}4=GZDYbIjeML1=xLzQWCDVFA-vBfX3%(FeM(^jNan1juJn9>BbeS2_)?IZks@WWp*gCzot z+;a7=b#od42U@T_w(4BV!>uJXd1gm??8`m8`2wUL6!xwvu){9P86D3)tKzhraS_O) z0}Y+tBK)dY5mn=Ufz}4u|_Y zgX^OuY~3}pRI$C(1v3Zvn*8K}2#)u#1uBls)ra{BO#1~UPj6oPK^ld*a|#crWOUgu zTn&07h#>HV|HWfL!n}{13{uy{3qidGOt&+B3Wve_kV{efliPKP zBxrv?dv0oSHXZr3qvFGdyVvHv4bYzuP%h8aIC=Aoz+M}GA~>1fRtXlM8G@Ck5S)ev z*yrl+m#NX;{`Bf?*RY=-U>EVE;;F_6`!@c4YpsW3&!G|@o<2OMo@pl(Pu*11lcV?7 zjD5z6IMZDIBCq~0kq@5h(&R>_L-A{cN(@6_mIt6*g~Y@G3Y>pR6#DzJ0azofV2eSv z^pCnHhtEL&f0)rP=;!AqZE)7N110m853BZxIgm)C;xgPPL z?_2}I^&}hEUX(dIyabyen>+xU_hI%EkrKn21)+{!fva(2aV=Ejyb{J_>ym!r26b)+ zQT=K$EA+lMEBm{Jz^$kIcsZuA4KBWGM`2(?j3FJFitOl08KZWz$J5vLS2bUeREOV1 zVZSF~P21|SlT`i6Lzde72CXFCgBGwa#vk;1J1&#Yk6QpGPiZ{KcxPu6{$uC>xDz2B zc=HgY71s!Lm(Dywj=5W9)H?JySY1nQnmqkK^ceR-%;EhKy*#6L%y3m{?qv;xp71oz z2=oE5OxdNK->x<#zMcL&a~ox4e#10Ew29DlSh~P&rXn_UK#T0Qb%ax+)0-&r)E4vA z6d&$$G>(pGr4XBOz^32QHx?JKzI|H7xdN}5d>As}F9|~?{Nc6mLXV&4sI`~J6S6h0 z=JLpngBw&WFm*z&)FsgJ#|BB6<-nr2-^uWP$VeR8b0B*uCQdZ8LXt8rucH_rDP*y< zT)YLD^j>-G@zCIcvQASC8iMXCkTDj3la}A5{@FwDix}aTBxm6#w%&WO0{@iZHNPY=yHjFC zxqK(v&cSBCpoHsukVko_GdM|NbQCUKE<@L6@xh?b+*@k@O; zsLUc^@Kc2d!d%z(U;3-V+}o#?p6j&*&OYUX~dGsz^*&afP!J*$7DJX z6qs&6&cpO}uF&0m)JIeV89}!}yR@fHjzzxtWybV^E7`ny|tX%$OU68as`bfsE9G!#;f91*_3dBn8BnaBwId{R#;K9Alk zl!$)R144}6KB&^!tm)xFeL#Z(JgFlE#LY~WhdyBq7t{B6MTFfQ87()6a)tt8H15F8 z$vgHg+_QL(Cq%}!_UUCNE0(>HA3S_|J7mwf0F?g<_IltMSXO~^UrKo2x%MIBaRj&8 z6!Z|GUnhIS-2K_{Rcn?+l?NWRqN4fpH)`**3VwP^Y%TrQt=S`Yi;l$aRkY8NCzhJnEBcmEeLDP~sp z;qekrI}oF4d1v-1xBz}|F2N{T#mDo<2gjrHsz)dd8pk@vI(GoO%iil71#S=jOiX|%{f_z#=EpM+lwNk)BqhuD zC49|qc$V*0O4h`t@$HNuy54Z;i5$sPacb+HO?0@BO6YRbiT0O>)xkE@=M?F!2-OiH z4QRc$je@nArbWo#Oo=5~sULkSK9V`D?(_gAFUhetbpQS-nz51J{fjKW7E)M!F#y3Q zRwRn<{zuetHTCP*^<<$?-Nca7_|%5Ob1!22c>j3nI44umUNZb)pnNJrv@+3mnXq15 zz5ei{IIOTnD~CSQ>UVO4#;=9+tq#Y=_*!7^%lFM0p?+2eY?nNMKH)neup9tydCU)$-`h^>g-TsGGSmWin1WLKHB2~G6}x(>;lnDbGoZL8UCS1p!Ma48D{p3CeNUi38JUz zzEKK4sjQv0(&aw+P-01LSQ1&WQ_Y+Yzh=UQE2^+%&`4UiA0#o)_ijrlIuUGR(+#4# z6VXp-I#=qc-4MuVLvlZ!+>Q;NJm5|e(eBw8l}{K4xiPuFF?_*OgnpC~RZ$c~@Cz=ho1dr%*h zZV-tqYEo)3Y%tv|&ZvU-Rg}>2o)0dBrws^fjznmcKMp1It^lvaVnc&SmoBxyu}F?F z7UkFzI?fm!SYL^SP?c7#fp!N1rFg1@HN!h>A=S1e%RPvFShmnOSgiiC;s#Y zSu+(oed_Fhg%{bT24RHGWlcsb_Fh`(D&bbmH34cmgty=m<#9Es$UkjkX{SaUOfzgg z;33)T?lCxvmQCD+!>%ai-(yx%1G0KfDGSG&lQwetb5#C&rS< z@Ble5r^+oUP-@#kD?I;2oL{mxEsnm^9kU=3YGigi)mjcUugH<1^bUcmOBoKAAr91R z5X1pqT`Fyqyb0A$Xwx2ioR!=uIt3p7%;f?RuW4|}b}VjnUEEf2@wh~w|mUx>pm zNzHb?(LXMtGNfDaR^^43}JoB z;-T+>kGPf0c(O~_XKru33~;-tAm^A}W~j}+5{1zY@kTjb^$b~mN|{rvA078{#ky=w z<%2d1O=qK4soqW?ItVsS|7n)2|9};nWeA2Vrrk614IFn3ysHCduan@#SP#h)|JY3U zR(}eY`^hx;{zR-1J>ArV+Mn7J4Sb&O%ypgcJ|usa8jNtk5_IY+pBXxI{Wxl*KmK0r zd{n?=>2ycEbA-9#Gm0qZSA?yP1VXq^xSaz`i9X@V;8den=TRO(WnHted$w1kp>oH4 ziEUBOd_`oqJmz3Ya##mw>QHeN;D%BM+<8O=sd zIhocpl>9)gLNLNm5RHB>ozV#_{_SJJdir+$qam~V2sKrZUV}5v(DtJ~# zQzPnjPpL(>L@k7V>nt_6pMrR*9*HNyakJ(qg=Ooc3f$ zAbBA)?1gVpwvu-x`LaAgnHt8XIFQ1`nRbW2Mk$Rnw}inlr6XncQTl)uvn3V|gyVFg zFj^sx0NkBH=uKTR#csQ=LFi72>QS~kX1LMP8n$G=>jXS2t@(vlg${j=qXh8UviJLMmd@G zwsC?$R|@pVHv;9;d*35yJWn^O84E3K6N zE52>QmB&>tfLu3S%U^%|pCge1r!BS6QGLQ-WM&t{;auT)UajXB`l>a^DkmX)isuwo z&8?1CR{o+6-w2B;=?zM<{>I1^>@`X>uCU)#QueP0z3g8T^d-G>}#y>@6 zgO&un!jtqjU$)ka-b?BpEpUQZ3BC;<JiL-(DERgu$A$3;gKrD?H2nMVc1rC2Q#ZXy zR@L`@hODg&+J&sEued=0zN>ZP3$CY~OA9E za&ecAlS_&F&0xa>MB?rNdDqbtMHRqvW{E z!agQB#bL9T;VI2U`Jcm8iXIE_hXf6{_J{|LSohY$xu+Ld5RtWmK1K$;!wl-u=Z}Da z^K+i|ZOV0n0Q9G~g#0O_Sm$>i7LXfta%R8W{{&>~$uxNS5K?eHXV??v}1Ug6N!ow<|qMZ~t|4o-FqMFIbuvOkROtgl0k> zkb>XEgZ+OIhy1D;0P*UdJ-&YZC}6nvGwAbI%)$9G^+yo*@m7cAfh1ib{IA!LY`_c* zfL#pTB%vll@b|nS7cgBo0x_zg63H+Alyq;fI z4GFm%?`F2YVLjQWgs}aq4iJ3uwDKxTfUWX&l#(vE=)+Jq_wy$kZd?f%7k5`J560pr zFt-muRF5Pt_*!Ne+U3o0E~5Li3jN8aD}W35aMRE+*xO0CmzY#kpR5`CDn}T_Ty&GU zvhw!zSqLU~a@pRJC;p3vPkumOrlch!4ipByUZpCwJS_XKO9{4P0xsoc>5zeZ^8Vw} zjxdLfMeJeC!A!pVl@mqSUD$BYvk)1}`MZYbhGnSgU*uV``kQV(c!A_@*=rAdE zmMFfV_<@>Bo~0dwE+J%)Jb5xCE&i{}dd@#y7hQV(>~A2?>VMkL{_0l26Bp=Ies%tZ z1Q6$6u<*I2Vx#9eN`tnCi-l`M{F5%=xpR5>dgJq$nEH2}`!AjMS>ewZ&A*np?b$z6 zjB5YMC-3~1{9oT8$^!(Ot}rpv-mgg@WHk_>2cX z7>tX3XTjs@lr~JxGov?r5U}T0GXP0)+8qG!+IGO)Btgd`Y7_gx&!`KCYR5T)bTI~$ z3z3bUyL<^tKYql7?=IVTa>@3b+h%@LRpX#n(H?w6+QaF36{Dv>ynC*IrPe(cy$)1y z?yo0(JH_Gz5P-R5N&A8U*YM5$!3E!OQf_|1w@iVOQ4IE+mD9=jcR^UE(;*No@lQID zLPh)|`yhE5I{vx|2@I^yj1SvftvVNi!-7LV45;9B%jwJK2#5(Urq>%=SxH^4z!VgV zH8rS@l`9=2t_Fq@(BQdl4Lqd&J+K~D4A+_q7acPQLG}JJ=_o>BK@Biw^KFQuO}L? z>-qn7QTx~J%&(UKaB8a)f}{gz5Up2NLY-LPoG-ZG0^|k|lbs~XcOeUxy`oPf*0)iQ z@olllGQD=s)dZ##@C%u@tCe(7#s}la*!?J)*yzpFxt8P~unl1=z_hjb+%JXzKna8A zO!YHk;n^Y`t34#?DD9Oj`JPpLBj9;-Qy%ub(1Ur#=ws3+PMG?-8 z+2Ld&;$Z!HNgz?g9NDvfX<8-p*r}UHDUfM^7w(JRbL$#GHxUr|xsUOan2Tt{n5N}N3OV&WaH<9$ob zXfKkuBgO(!i1@7=JPTF(^;Sdb6tdd^ND}MfCzkH*$gt6N+1Xrc*64Dp_^A1*zOOQo@9LjVO>Y$rPI`CYLb5KP^wep;4)N!}W8I zqH*r&8*!QG6#{R4W2Vt#i-BY5ARN<)JQQnlo#^lG&!Ba>FyW;J)}$W~KVpqwo4xQW z|EVHog6?VanW}vrn^g}&zn+D|S7fh@O8F&lNIXweMZ{RDMEFNoGw=KJU7hS7Zc;!- zM+;`Ne6|pvCH?V3+jBSIj?TyW!&*TROf0Xv!cfA-E*$dVLCQdUiod-%Ls^;pjRtH%q)VJpfKYq&jc3PKqj>c{v#KoabRxXy?1n5DP96nD1x4V4 zMeo@#te!dn{LOSSJ4eNc##6=rOcQultuyhGArdG7l{#mj-ic!2N-xH*&i$91G48)6 zRs4Err9p4*{nmZ_zrr*;KND;m=Kocd@W&1{{+(PLjWtw=b3ObzQO2pgPI&t$Cl~#HF3Jnm8s^OkbtW5dpwJ# zyeA6fDPKUZAU5dEbJeHcSN2-&R?x3<&}Ziw@u$gep`4V_vG z_mAx<6fE<2%^#K>f!;zE38!-v;39iDTE(iK!0t^`s(r&?xv_vuN<%zIi7U_72ATmP zNWE|uH}XTjuFkZZyicWIEeE{xvvDplyjRD72^0}S9nc&iik^z-HhmnOUV)f(brU%1 z{m+5nC&NbGOB#pEh+%s7(G6iG@UpDB&22T7r$6R#Pw5sLIo<@WB}5l=^08LPlK`)3 z@R|EZOih(;TmV_jtx|F`C8oUiKIwwTFo8EOwCnd0F7y7dK-Ge-hoTJnRsKTlJ5Fd5 zf2=|O94Y^Q$ozDx1D=!rfXuo2iVyRN)}5qCkIW{!KkQ+=LGK_Tj58OD0iAnN!FIji zW=6&Mf&2BdTAo8DnT!73Gl%vQK;4meim9f>xOmhM ziB6qZk#!|+zVvR@2zCUCDDExwX~Rj9#PbI|I4SBI;KH!}J6Y9KN{kXlNxz=HZOlhS zL|sT<;^Z~Pt6+9}9OEjK2 zoLIbbyz({VRkconsT3+PVHT651DM{x!;~>3?A^~4i%tIan!GUob6y6vbBzdPGh}ac zxrBnTP=xd_z2Uu~at1AhuS3qBuTOn^pP6g!?JVyiHe@n5PkYKx*lrZ?u^0P1HY!f9 z2I|dIk^pY@YcA2q%R{@dAn##iJJ&HHM%K7!KN#Rc5F^{@!O|fK#U{ZQ&qwsSA*apE(tv6j=X&tfumI zl)&pHAMzvFu&3POw@`uMZMNb82r$`@{7>EaQ!K>YUD9fB+yr9|vGB0LmnGykABh9F zabP)u40F&RzYi9ac;`!@uIRfP9r=Fp00Ca=mf?MYci%zXNcM9+BvA@t?o0qE3VdKV zUVwjyzqJFENCW(X$Z|gp9Z?HKYO;=HPXEYqE|7x{{+_PO7vJa7)WGQ2ZH9#S`9Eb# zm|P8bdK+I~NfzjkKnyo8`>TItJ(^tgd&;a%el1H;9G4%VGB*0`bKra-k4_N==77Y3 zn>cTN?-oq_5)TTep2a?-78r3rC0Rt^cm>VC2Hg1kr~#3A7}7C{#;3!`UcZYM1sj^( zcpC~AJu27^dvs*h3SNUU->N;kDUK`N=}2ti44Q@I*l6SN o2IP4cdSkdScYUQ4MVA)!E!kdUb`P=G6v zdbhT~+e1t7H{wW0l~C*(Q&gY8&3! zTkSHN9m?D7GQT=yce-Bh_Q>t^$nE#Z@AW7j3@B{FR1XGp4u=$vMih@n-)!{S{OUJ9 z78#_OrIy(!UhsVyt8)s*0;q$d{;1>#f53h{{y3Ni4-#5;~fp4Jj`PiG) z0Qk=!_|IVY&yc&Hq413`_(nKcN;Z$aT(aqz8=@a=f`b|QQ`3H~bu{_8V* zCk?)n4&TXu?`FbxzruI3;qcnQ!NIxd;jyu?3E*dPa%yU7c6N3iK0gl!e&#neHVzLC z4i68HkB`sK|J+@lTwY#WUS3{Z0k5m;>+72v;B|Xf?`X@L1LonGs@ zAR*zkBYu%dnB@I|ixjTXIrT4hIX@Coeg;I6!VD>2r|W`PP5PRs_H9TPDYidh3PRa?2I5fkxMmoo}4HO=jX zzVCuUutb(68=pzXC=@=Te5(>?ki~_QNafir7ByZo^Za!qDp4BhBlD*kddhT-<}R$*8vN|ULC_fhKWi2kzmC+XSyCqj5UtBq(i zPZPW7h_QlsVUy=9%%A1jDXOMJbUw#dsOVU*@vZFguem)M{Ie01-Rxp(^^5B^PGPv+ z{i0`XE@)fQXtvdLcz^jr%(L}p!MQparVm3##-*B0`hd=EKxf{e{j`CEuiDebU`gCovmQnbrLL8lZF6Zn4y>Z0UnQo%Fk^P z^}}c4M=sMtck?5i%>K{IB4AwVlF-T`6(&W^h0&?AkvDm{+1aH$g-nU%^bz!AFcPe8 z^M(MArgi1J%p<|@usPNIir<`c6>f{WnU&M;^G}Ic^}G^1_Bx9svPP`dmyS66nmDAY z-7ftX`&eb?ZChLdgHMEHshV6Q80-(f#pp>suP;-mBoCk&n=c)Z$l{WQm`lN(A1?AS z6Jr@xEW9Fv*&kZ^6MAlFF%dVK0#i?T8WP=M@!j3@uF`MwkYWYL=s2{606m{1QdMLD zn;!N*n~oLS?*D)N^{ZF-^v3hIA*t77j$J#?Q%*7?`3T>1p;1k9&9;m+a?oQro5UA} z*FYwpE6q$vm_E&#dhjrBa&3-UVSV(au+LTYAklF-zx(a$+3{l*Vp7b0+$UV6q|=)^ zl+ar5Zampwp_g%(m)g|deRKA#-;rQNe%L@GDA?g9bKg)Z2w>%#YD$NQMz@$oMHln? zc&6_gBs?BWPdqsHT94w5{lXkmdm!@4_3BBZ=lP{&S|vBoX22Z$tSq9f{SKBt^ky%I z^zV>iyDv3O!yUYHNL}9Z_6u&8$n0Y!Fd>;DhTFNw=vU~pdM^j8OV$7Q{hm{lrAErD z^ZgBT3MKz)tt&!(P|){c)I4=oqtbsgRMxUSGN%MlH{(RHv!NDLp#>CiR0-DMoX4DX zv;00B%{Oz)5%W16$8Wm$J={LgMzL7wg2C=!BuO;$mEW;#v(w0;)5-Nr2|HN2+ZhEz z!z~5Ay&S!E)_unElpv>g-0_?8<@;=1X$hm|EYAAtIlkXa>P%s*X^tTe;M@lk^4Nez53FJt1KRk-PKInVduJdYbvv+CgdaaxPQR}|Njx$qm+&{X0 zLho)kU?@Zw-OsiwZja_7*7_+T8tL4A-^)%V{mhcicT40q0hDUm2WKLCRsRdFh~S*J zW=%)J6o04>jTXvT2LVRiHCx8h0Yqiid5T%b4(i_h|t^9)GXCl`J*toI+52$0O;?&l47~ z)a!KrJ>y2%=!x`~usLF2ZWh@4Z(jXkQFBrI7o<=#nlLG5i-ejrk6H6PJ1E&ZttZJ5 z&kRx>HP9*Na~2>u{N1wRhM;CO;vv)nC^VrkS5~)Uh;nFW(H^+=$_qy2bZhx%k zZ8xhnxK0uca)?#k-*G>ZQM5bMD zlMW6mhuePEFuNN@*{HnCGu6;<^a}`duEdl28WwL+dhxEM@7I@;;gzcO^lNJm+43lw z6dT-6T#Y5$D>9d_?{KDhdHc}!+<6D*lQJaZ_C(9NvDjnmi8i$DsjAxDr>(0S1`Oze z|CrH;D;?!_j-%Dq)J)T-n-MDkrf0?A`nG+~Z-v_&-o6oJpO$Oi$lKuaO5y$S<*Ie( z$Ubm`RNcG-4PuC-S- zeiPsSL~LV4IS@gKw{*+Z2yZ%fdW%0;9oe#N8(Xs$+`JZA z1x9Ba;z)8;GJiU?I={S1oMjY27t5bOQmR!=h87tLU8Tf5sjiJMBq53r^7;8=hWgPt z4bw>D3=09NqWV-s##SWMa&~Aod5s4eW!XSt*MLv?!zPRt{y1%V>E{$Itsd4;T+fgHd zF+L#kxQ#L_f%T?Jul9{W@3L(C!1Z>dCWBToRF<8ubSm+AXO_mY}!N#j0of+w4XD(A= z()cg3I3$?-i$E^CgN?G3u{lYxND`@>vbDEERnky`CE5X#UwwT0#q!iz5JkmUAity@ zzJJ*yQ0kn7N=*y+1zzL3&E<=WZn3*c==;5F+S~2r8f$^L0q%%3EOu9|1ryx49JQP6{1=S9`=97kqs1esCBf8ixbhG}r-OZ?B z77;H9Wi0EKB=%_;QGU$9^q)?Xv-@t;WMfXR2oCfQ5+b{-Dl2Xesu;^X2 z3>@tj`sqJj>oC;&-91g+=JNj;AzA)W+ru8{{je7&P~jt$s=@K;*5QhV{UCM!GdTzo zPm6_G!4pB&GBKHF=cB;Hr;>0!#X;V(b>*ne{tTL*7)R zDMJyvrO`ryS98no;H{d&TZ7BdXZ6dMml@YW+;v9XDWsu~BOjbGRK8IGdRAt1r-~;S zOT_d&ULmzBveUk+7s%=PO>3yyw= zbz)YjX^^PP%P>dzG#OuYZUXkzuTN4eqL_!uYHBy^iLmdSjL|QS9ho>9*9-y=(O5=a z5})hTey=39)lLQmi>&lcpp^@}F2%po%B{DM;_fHcP7}V(5*tuZ?|UMO;ucF45n1MG z7esS_D_zDPuW{hO2AdaN4|&8I=_kbL`Jc}v(YvB(21!rZr|Gb{ zUm9@tGexjg0|VSb)<7#n#NDz?q^4H&ZxdCCwXL%5rKKc_<`cL^YJs>4>5E`xV*`Q_ zQxyjboO+UOj{GI(o~_>p0`P%A9NeSMqNzk9aM3oLTm>H1=j&X0d|4AUO7W^*nDPxx0WU@Lf zVi{3Pzq_KTJ}-D~Y$O%dFJ9y6V88IwzHqSipNxWBY=`d@nc}(b6Oj0xQ*m8mkK)fr z`biB`FFybcWA{(hIaNi$8R zfqu*}#!E$N8pu~(TN&cJK7%nWCf%0swfspRXf!b!pBG!dwB5-q zGYRc~@=);Z-=Ar{NSY`FD|;-8kWk~ftBoNyz|xIX?gd@4Mt-;@X?p}m_d|m1FV|%6 z$ig5k@83L?`=9{&6s@WpWy@{3<)QPQZ`wg!plHEvVPbrb#=-T*tm9S9i!b)-dwVKX z9g)vT=U=@D%kU+ZPSl_KD*=S|@b$?@A^Y9g+O0WQUDcGoFU_i#bv#yhJe`BHN_kdW zVv|SS_fzT#daYd_(_Fm{@%OE%tncCuN>=dSbF+T0rWfZJNe2c;m$)N377B3R@B1&h zIGp*s8d?jc2ArJ=KOx`>)FHUeu&j1zOXyR!tOy8Z#s##1F+?Cop)0w|%pY$9e1c|e zY?aMdp0#b0p~EFwSr_#&m=*SPbk6JjD+l{6GGf5VjmT%%8(4U)zC7YR4SAb5s z^>!L^btb8;fwNkKPQzw|WUoEgUTWN(8>NzZ`9z%U@$JqaeYGR=1fNZ+yYaQmDSM4F z6XU*Cqwm|%ivsO;vW=-&yycVVIR@Ql*sQ+1Xg7`um?!P?BUHem%j%VV)`*7Tt&~hk zxcD4puBtGjctO?rYOg`6CrvdqLXr$r+kT73&GOae!&yvAxvz$Pk+szWy;E8f9zAdK zP6)-PU!P%gkloYTV>cV=#BUeITF|tA(n3Pl$9`}V_*Iev(4k@8vOp3sS`-e30c=M} zN5C32thF(U9$mL8ZF{0>ps)4W zTNysby<4E`&V$>>B-599KEf8`jCPA_Xt%Ma$Jvr_p;n|1b78opI8$94=54tTk8=-n z^sj4&{f^FN3hG)8A8Z+)f8z8xn)iFupZ472IgNIEsI~sabsiqalxU0KW?5x^#)}Co_hFdp9vLDhwe9 z@Qw^g19Te#&>fBMYIvRR(OFOJUm15jgOO;_-0!WUy}{i8=HFpVu*v#j4W2L!ee&YQ zOgXpM*Xp{4Z*LiU4okY7a^8V9)YtD9lFd{$f*|S0=@=aUM ze)4?JS@eTD!D1(;@AbJ)znG_p;Fm|t)nvOpNiDmK4By1A&-Rkd7(Vm=d65u<_E+@M zkYIP<%t^8WZsc+XS?k6Jhrh#rkf@g=>5OIh99*6qmctts)pag>ntKr2_%P>;Krnat z&*eG%Dfq+?@|65n{n9_$!!Kk&&}grwV|ssv-+nZQ4R`y)@hN5I`KvXp(ndI#!+Nh< zA4ddynVMQ+BSOKi6uBnKP-YgND)zxI$AWA8B>P4Fls8N4Syhw)1hy-YC1XZ(Z|{?! z$bPHWS@r**4gE3sT{r4Mt2~KleBU`D6nUfK-c_{X{~K`;VIGr z=BvgF4{|GF5%(BI*Q+ou8fVjv%&5g;yC~#*QzK6*FG&Ets4hh3O{0FPm|Jg`Qqp5( zN&ZpjX*lvCq0b8*fO2!NltE^#=P{hR7n@Z%^g8>ujP>wdk}eAtY%Wft^hn6x_2_`h z{Y)v0A~1wK5ekq?_nX0YDuxSDn>qh?lmmjqmAB6Z$qP^G-Wgv$xBlLtmg4(n*~1FsNGmU zF}xAN(RrBBu(>`zPPL*!RcUG>^F_cq3OR{*^Fv)0AD|i`Yh6to+aFYsx3|)l!&{(v z*JKBxa2(}r^{o*?33P=ZtQjh)6c zSW_=G#q-F3OQgfaOCB&U)~^-tl1?Te(4X_Yee!#wmQ1u1vJ{JeEH$2nE0~fS>prRM z$dV;bN)m*#$i^zZVFX(S9;#=u2|d!(th)3v^jujvN|lX8&m;V)DD7;?H&xTWB+{tU zcIS|NT!o&-J9|z2;xT7lSk!i{xPW3m&UL?ASSRsCPIi-Tb#JBDrD~b8Dc)MW>D>t)ZDSETM?r->PB!mCerQ z*3k96@t6~XU=2;`h=+@>DWr-n-xLZA3Wp{VQu1%=uVeYt(&KMtu?(?7?T34TS^ zOyqSYoUcb?J$ifyDaUToDHP%8JkY4lJ`el(J)GY5=m-VfHz0A+! zj|1_#2`u$B**;^77&U}cdK4wmw(s#h>6#%X6o7up5c6%it$K!NP`6evTA6YjnicRl zFjwgd_Kj0jVImwS%J{0t3W=p0B;3J>Z0HpgUqDCbWa{rw{eeB#m~a1p!LknTHrt`E zYgom9y%NU(^0aO7Y2E?t>U`^gKx>D#cB!OahHzbNOHHl27iYK-S})tbPV62{p58*( z50Ihf9LF+yQ~SfmlTii>-Xx@)w04pXFGSrzjKGNpVr3yjd|)E;jPFQf#Ro3xm9VGN zSCPecm_NJ*X!_5Hst(lA)mph#MROo^rT42ediU`0VO4(pnp>6%;u0FTI$9yHco}7B zPgBioPjd;KNYb#}8n)*>=+f$1dVhl9jKjSG4eGr$9+SyvRsf9A@faalA!c#mFwhdt^ zU+|!eJwpf7+M5`P1b;EVO$&Nc@pN!p5kQ_(J^l3OY7{qbBe|+aV$xF7h>ZVH!7sC{ z^vxmZuyH&NW{hlyJi6S}u_5xUaDh4?)$V}!mG@rGihSc zl@LH>RqEcK$DB20{?MPj@GH$xHO@Yw?ONbLwxh>yuWK*zFX2xGgnH@^qEh*-eG&Qk zg}sltaHdUZ*O%GNAQW#mrk#g>)K^s|i#y}7uX3E9o(!M|ope2m5qz*}7O?Fm2lu%PB$)H)(}QF=Pt^~Uy3A`zg#S@q#YWL)J2X!ZGl{m1jCG*|vCWA2nC zxdE}iCf3pvuo1Y!XHH~Rj)tV%B}n(y*s~PVgOrL<&(rp)0UDh^25X0 z*q*ZWmv#OA7h0il#-AzoX{XRX#fkfUB~=U^O;$p!w>g!qtN~lt;GVaMM1wzy`Ff?^ zT6CHy(yZ63jB?utjdJmn_Hw9c+cqCs59=O~@PO$<3sfD>kf|;r!jovA^*V>hg>Q)Z zHYRDlz0PNQS@K|qyc>~y-s}frw2VDBWJ`H5ly^6+LkDxV+l@gr5{zFaxuOJ1?<%mz zOSQvslz!|6@)Gb6y?`5qD7&mTpzh8*xRzh(x*Q6}kJ)$j$;^>|l8r~1&4O$x>fo+E z%2s!U)Vc01jn>!Cy5|2juhyA@5ItU@*8;^WV=0EM3$h)H{nuF1pbV`FCdqmUE$q+h z)AGv6!d(G|#2FUAY((ZW_2SCujf#%cJ<@e0M``IcRzCmYj*(;ey;jEJ^+lS?PS}^?0{qZ*l1+9caqkNlbucbEJQ*pMS0BclKFZF#o zm=Jch^EtCZ2SJ&N|Kdgymf3X@7n3n+45jjbMNrWY4ILFtm#SHDhCnmWKI;ArEBeHuuGWR+Ep4INw!414Q!!{}M3>IESM+4O+2T+o^qHXmy&|kQ}WN zO@&i`xPFk}C{*yd`;tDzf*3|Jhly|?2%E}|SYJNBdA#^a+=GY=Af^txWzk3vhUAVKRSFQ; zJ7{c++{xBS92kc(!h0j3Si9W$xNq`*q4^mTV=sd#|ZBaUMWYe&%gS znvlt`2`#-vk|?PRaY)!NLhDx@4SQ|@&!e>^7pF!N25l#IrK&V&nrWlj^}AK`$i6G$ z)3$sXW(ov|8@kNy55we$qqlEom`V1OT&#cyQ$Et-J^@yte7(=KfOI}n2at2#Nm%zCSZ=xj`r}s_s>kPZorRP ze|>}J?M*G2*k3Gc`*Mj5tzccvGs%d+A>AWvM1*H$QGsR; z1Y{oC1~zKkM5643-+v?*48^?~kJob9tn*&>9(B6ovT={c)&C+dJ%qCnL|ss?gOF=9 z^U%MmVFjVxT$cNu?P%Vu2lXbeP3T5Nl*tSB8j91KF@8IJa^9H9(}O3tZt@GeiF5e+ zXs2nakl4cAjDE5>3dS)mZ@eMs(8lYq=G~ThephFf+=juPrw)W45; z8cPAM1c7}cGOXgD|DZkc!_%&=e)Jm#tgnJTd$THOf@hU_k^Ker?M3$}D{q(FsR)yH zh<`#OVqOTn5@y3r3L{Cx|M!4zo%>HmjJtKuZEP`>m)4x=l)}E&w;w;P!~_u96}i(n z3oC4t)SjBOwoH4ysjiGOa&6B^Jf14y9$z9*T3J826R(X;>qS=5UQYeK6G!Kyo&hk& zKW2oBiS_ES)0?3GH3FqO-ffZ7!GZUjaMi~HEg7#jqvP_^REz{zER~n?$+T7naEMg{b9)%a!Mq%@iec88)#>oEL4n`8{r2 z`;p7te2u*5=+l4k98)m}ttqQM5wx-&F)s9T;Ncskpx%pOa8Bae7vgWE7k#$U z;g8ZWY?W`~NxrSLrZID|$+jeD2UkEJ7Wd>+-&j0O)E&=zzgis8J20U~X_% zVm^HJq{-{6c6E0$)~8jXLaHEzamuNP{NE?La@kVlX7nCo&tvdq97&zkOVuf1rz_CS)k74#Q`ZE+;8lI( z_r%qlUSE@L)6hpp$G4IHV1IgnR@y5y@!%6eRxD3piyvyq-NTh0&Ng{|MP5M?cxtJ| zrzK?1RQ!b@aWC40`)zGaEMZ&fLL$s@?~}h{$V-4A81Q2zuA{gX z)t{S5I;9b4;bokVK^%Kthg^U|AG@k0gjKF(({xyGVa_*wEMqaNc`!NR^sZTml+o0u z4pK?(V#8O)vnGAaK^Uo8Ak+N?L#rwJOeSGHI@v;n`uUaG&Z7pbu9hb=sX%NASQ2Fw z>K&f%#^w>&(UlZ$`-!u3N?+yjr_JFt%cpt5qOIAw(v&_(Ktl1w!oC^O;g+y#F3g7a zb?xLug&B;7bbf3m1hmG10DEp?cFe|j?c!*vcV>=S2J3#!W!L0~Iz0oCr=7jTus4T| z{*k#C)=2QC(g05FGLvC7R<|niCT$81tP5+AYysw!wU~E?1puQ~T(_vmF!ltndqM*? z>!0g1wnYp7BlXrVXBb`6N?23ZUwJu<^>1Bx5Q=nSF$G#tD6A(1h#KU-l{~+EGDF|x z5954K&~8WO7kYQGW1#FyR?+7`b}0S`{*?#Q!Xs@uIHx{)aNZOC0ef{hK#UFcnW(Z* zK|DU6m){-vq#&_(2`3NGuqb_X&BKcxw~E4gA9g&mn{lOQyrz<@K{b%77-VC4SO5@< znIHg@&o5!L8<^+#xy#Y9W6Q{nY@!^3?fdbUuAT1E3{2%kOPkK3+V#EUE4Qq5Fn$hW z03tO_1Y{XVqUiEpk65<{$vc?StZwXRl42oh6syM^skGsPTxd719Ix^&590v4GDZj3 zl}&|n(8^JsW9yCgJMVj}K#Ly-DRWO4=FPH~kv~(MNoTtcN`3GYTgx z9N!^U{`wv)l_`2q)u!>OnZrNYO%$sKNkPGgY%e5WGnRIy*?h|i$P7t@e53CEEr69a zdiLb*VH2Twb)I!JwbCOMf~nf1iH~+_mEktcq+RAvJvsy0%yop`AUO1NihJtK2#wF- zqP1$Rh-e;T;Dfr%8bJCXIZH~rRcHTn`{6)N97+;iAn?r4Xf2tf#=DhF?@%Uc^fOrP zCx0R}?wp>Q!Z$eqhN3e)a;S(+xRaZIp2@#pAAYRBS^2KxAzThpFugT3HL4&BMc$U~dBd1uuvSU2;zRKn{yLQ_G(IUgQ*ck7axtQx0|Ony0GPzXj2 z-y0g)=jv~ZWFk}cm&y$`xasB%PqB+JcAm4~Ciw;iJ1$?-k#2a>(WG6CnAX&y%euat z3^X_qg^qcw;mCr_f}S^p*G7scOErc|hFw7Q7u^R&%-q#S_!B5r0rg?7 zqWp0|qWn@9c#uI_x!h={P7S3#OervbCx}I9OjAD;TNk_)mduZTGyQ8ltpTIE8@Vsi z0iA*3KHN&>M{7EYaTMFF=>fv~H!vP@b?PDf9XBJ?^_-$jvp1v(T@)r*+f0vaJ|7>Z ziPUb7{CK#i`VJ?U3hnbrABuohol8tEq&MvG`f7HD?+VPrPwU(&nN{=+Op}m5nZ(+S z?1O^)(=h40Vtl15CirRTh~i|}o^w%}|G8pBq;!>EfT4Y+Pvy`%Cc|b1VM|r1h;kGS zvc;Ir=Rn4w>;T!ZVlU#_CI|#O5)8y^To^RN9q-M3vX}H!Iv0YL)`uzE%psNF9Ia+L z79ru<(T3`faG_cAjQR5A&v@X_^?mes$vbOt)3UP@TUDYRew9LpB+vFcu;TaJn=-+i zna{3HH<*l=JG%jFlT;pR9ol4Mf=)^=t((0Pe$i=~7)FJP&9(h;lqw#6n4EhG0T-PHLeN?O!R zpN86xJjA&{b>@m?aF?1qShY2uCgfJQr_|H$u zO6QGjMgt>mpP#;B22P>x$jHF&lm}$Q-Mgk6M)Qn zKhm_CjWqCR%e-nV(f$Fd3v9raGvQ%}LbGz`%|g{a!6dl*lXL!sx!{ml@ ziYDox=h(sjjj8W5%>CYNh4m~zRq9-wuVoXa@NY79^1lT_h}<6+ljXU{3cOkF9&^Ps z068l5eK0u!YknBGdA(dl~x|w3=)h=I7|IYucybvwwH;q2<0?i%N zxkc(yj!pRoHOm^KZ?nc`K_QVv20Rp%K~)OGyd547#`l&y2#`fTzMDc&0Vf*+QOI>; zkKVwVZ@9e@(hf5s#)(=AeN(^%w8@O3ac<@q(TW738DHmowr+he_@_D&^95%=eVG7- zB56b#=7re>ORJ&PZ$_CS*jJUzg57VeIc&6op+2`k+OM~ho-e+H} zG99e*nIETQf>`!Pm9wK8`VYiHfM7S)+L9^7UNo`w{egGGwuc$5n6#iBYTgtLiseCN z-?+p2&;Yp;D?5;9KjCb4J!63%HL#Rp7xXl#d?c7idli6pCLg9(rCN?Hr$n`TjZZB+ z^c1Z6-Bh8_K^3C?^3?8QOIQADvT6G)A=D<%#Cy^Z@SHU<$XiZn{YPso)Gl~*ZJUN3 zp5lOH-@u}q-_bgK5G_7+|E-y!y>^ zHMV;6#x)`~CnkTtKQI)VyEUEIvl=q#R}aRq48|pO&RjFA?5|cMBiVXoy>6of-T~lK z>;WyBc?39YU!??l+GWq1@6P%l;_Ksb_Z&iYOAvWLO>lMP$q-m z%zU(|O;bZ0XG-VS1wc)69N0uOuOOK6K^HqhmIubK`5_9 z7I)i)N6x3$a6N2dZ$xFsy=(6?BmWRv-(!R%BNTwZMnwk~;XK?e>&$Gm6jbO%8ze{;?Mmdnhq1~T!n zXx|@wu42H`c^WcJAlf2ok7RVCK`Wop0GjYVgvMfQ2gF2zIO{C;^S!Tyj05R3KzLD1 z9JDA(<=96NlwwXiPmZdUKC_oi2WJ{78IcK3W?NapP*CuS{$Ytj*7)frYkZt^`W|^2 zs&ulAIvh8~QiBdB+buW3IT2>A52%r}i9)750diBmo;p~fsygOQg^J&?*WAPjtE51< z;nt0pN_NkuGmsJT@X-wit*jf7X{>8@)E&J4y{5i3<0g?*ex6Um{Fwnra9#i2c*X;b zUUxnB^#!HH#UWBQSqVSp>I===+(3|Y!yB0I#nit#Q0>1{Q#thbQ)tiGUAy>W5#sh) zI&Z_U_fQ}YRyd1_lBe>dZgA5A5!sO^>vsEh$FF1l`7$+!3PXrznj0-G0Y?*~#*oC@ zJl%uG%P$1?UDbvf;b<4^>z17&>5pBBJ#RMpnjDLA>@+h}5|3|hbouY&5x~a2fFeVG z{n?N{PyrN2DIzjrh@twK>auspyYCoe6p>%52Bd-e3GU=3EvS!8%G=p2$x6aLp?C#U zBjEIvn70-G3P$x|w?P3+g~meiH0oYl(TVNZu{#f^bHOwp8!9bH$c|z;RwcPDDG=8H z>o5-x%)VLpNmvUR-8J<3SBcAsP3&kkVw=@lQHPiW^j)&EY|pO zC6UV(FdaN|u7hUvt9@5uBP_tC_-EaMQ_=%~G06k1OcHPJI6wgX!-WL^1Ygl|2DU(H z=`2Mt zQ3oX7>3Pv#w43EJu)uC%63`11PM-Ts1o%o_Km2+ZvU#! z#O2t{Ds%M`Aqk0Ah*)Ync&saWRJp1y4cMAIM1D?`$=-lA?Gm(-RS%S=G;?fgA0%e9 z)Xn>*PL1qS-r9WSGkqfqNow1b5M@a9`nmfVeJ>dp0}_a~KLACh)lOSNSt_eH6zzvI zqdzC?6=cDyOhh!c_`G<{uYwfN^~o?ddN=5W7@9!@)k$OK=Z&3&%6+tL9lBZ1HC}S; zjIafA0~R9UA@o6|MMOW!BC!W)4DwWbU6^zA>)rkb&3*WqW)$Ox{u`mqYRZL}S9JL& zJ(<7_u?*pnNl5~{fD7%&ta+p}@EDR=rxMokpXeE}MhlbiPtrL){IH`}!5@zHne$c2 zZ83o@QO^PQZ@#)ybg^Dn>Kr&gCbJf(g2bUTQl>5GK<=GW{WPj3SW)AL#*cFAD00`J z-F%jTNh%+4Kb$ZnR;O=krMJ~i59c@S&sg76adBul)%F;X9W$#*-pWA?6ytdvqVV!& zmr*#zoWbj6kEQ<^R%2m?+zA-g6%}?(VS9Xr>^?jTf6&pC9H$>*<$D~K_Eo%UQW<6U-onBjwR z>`UUq?;X$WwE>j}38sK4P-6U8f4B4Pj;L$Yti{xhK&dsUyCWP8yFbHJsgqaSvKU96 zc>c0esj-VL?iuS!4@&{a53w_rjKxC(8kz#RNCT+R+a?xjS}4gf@Z3RFPyg@&BUF?n z2AT6z;_sQR0Fs6OInO;L+S|Cad%1tv8A~d@(pi0_l4>c{g(v?Q7JvzCCqI;M{EwXh zN{kac@jd^h?12kL)RZZ*p}lIU7!S+4VszcG63cNMEA)imv5jI zFSd6F)*^B(m0!#{i(qZ?3PAGeIf7t7B(H>4$(`_j=l%Y3Fee8h#bjj%s*#iZ0cM*# zeik^y##cWZUe@cINeS^SL--c~CH>c-Bb+q&F-nWy>M=6s*30@-l(m^c*C=VgPyahU z8W$XFJMpD^PJ-&Inf}`Xh^s`= z(wh4$Uj41U{x@DqeTU Date: Tue, 12 Sep 2017 07:29:22 -0700 Subject: [PATCH 57/76] add 1709 to change history for config & client mgt --- .../change-history-for-client-management.md | 5 +++++ .../configuration/change-history-for-configure-windows-10.md | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 457e51889a..cc7f5fb34a 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -16,6 +16,11 @@ ms.date: 06/13/2017 This topic lists new and updated topics in the [Client management](index.md) documentation for Windows 10 and Windows 10 Mobile. +## RELEASE: Windows 10, version 1709 + +The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). + + ## July 2017 | New or changed topic | Description | diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 76c39cc45d..cee30eb876 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -14,6 +14,10 @@ author: jdeckerms This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## RELEASE: Windows 10, version 1709 + +The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). + ## August 2017 New or changed topic | Description From ef907b775097bf7518c6ea39a34711c6b7236267 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Sep 2017 14:35:37 -0700 Subject: [PATCH 58/76] added user-service-flags --- .../media/user-service-flag.png | Bin 0 -> 66480 bytes .../per-user-services-in-windows.md | 7 ++++++- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 windows/application-management/media/user-service-flag.png diff --git a/windows/application-management/media/user-service-flag.png b/windows/application-management/media/user-service-flag.png new file mode 100644 index 0000000000000000000000000000000000000000..56e03d1bc557ac17f2fa990fcf58dbacc25cf291 GIT binary patch literal 66480 zcmb5V1ymeSyDf;jyK91LaCdhI?he7dad!(4B)B9%a7mEHwQ&g^+#$F-Oq1mP@4k66 z>&~pzy^8LpPMtckzy0m~RkW(I3@Q>45(ESUs+_E(Is^pNDfkVG00;i&``zFK_yFmq zE+Y<6HAb=z{s3bwrX&UdQJaYTXbKDdjOZ+@>jnXV*8Td1#HEuDf`EAWDkmxS9$<9% zg#L+G`}1zRNOD{BE{N5$vmRUU4cwwStK%>vLr3=WRR)*JgM@=?d}qQOGoVeCOU z8zzNw{nRSw%Yj#(uao97gJx=3+05_2aZtOVX5;S_V3|l``^~qK<9LXmekd^vm_ILt zpweutzkkBi!mu%&W=cl@LMRZxFEh&x8N?!It+VpnoSzGu7}bxx*F=(3YIU91|4u-% zD8az-)hiKPI(Hyt-I4vTA0&xukezwN(Dv@S+l;3vCZ^Ut!M7h(EE$PH<^E|pgu;L= zjMKQTu*yyEBo1eT43Vk)7U}^zn&4d?jNre%eaG$rI)dn{aK&58zZ-Uvmn#qR{q0$Z z4$@x8qLZrWuxD3-PnOIeFW-z67k9b6wF&NCrA>Lz%S}-tVer38rNJ23`-ahc!nNdsl?o0cuDf8(~U+`DsdB)te?Jx|GNvk@1o?+oL|-c}L1!oEF? z6d6hP4mfNaX@A1QKN=T)K=Ip?AWz%23NEoE@NRfs_DQB2p3}x&>(50e46Z*YvNFk+ z1v$HJJQ%cYzE5;3hJtR@G>Zt1F~E(G##B$j!6A0_HagX}T2fB?O1(|>I<+A>!ubPN zNXQYJRi96-GEcwdJ;JCD;s`#B)Sq%=9}z_6177x3^1^ez<(#JEJyN$`&FZrW2n^4; z#0k1cqmRy;FYbtk&R!D(XWfPclwB6G-r)Q`xA;`AI)uWuPn@iSM)N~%pl{0+JEk-j zTmG{yf!weS57YJsZNfj7r-*9!`3r)@`RBYMcHwrL&-t6fUv0>_zQ^9pP;2`oxgjEt zp(0_l0go_#w-V$LGv(S6)5qdPyS7_)tHIGmBMpcE7^xOAsHEd?rfHMRUgp0`rWPZg zAB}1YGdJSNbUl>(7DDi>H<2<`zH2<-ngg)2U$VaXm=y^9a+~-vuxzck>a}E~I1=RY zAuO6<_sZKC>UlldIT|*gfFKJG8GB7_+ZqaezEQ^n<-!aWmg@ZLaWl<@jUlJ~Oa%KPoj-O2zTB*=^hVf?1)VhR8#~dbIM|GEg;e4pGb#M-+{Z>nzfxC{9eKO;?3ngO`!Wa`;cnzS!OdiV;TA* zLdrHu$97#$pf#S))l;u4TSg_+^ZQ_R;XjBF6@<|ClOKaw)TIg@*HRaMPetU3)9x>(mo&g_QrP?YabaZgy8)Rs7~rV=DjNCyM5KwU zYjP|A=bG+(@?EvwK@Zjv{PP^X?!|^K$K&j;o$a9f8UCab{A21`7Fp3jnms}SWEJ-*|foq}iMM(Huf7&#}cF@QVwBFYtrr$R}^iTwwRwWVSb z9G=K`BOK$WiQ0Ye<>VWV98T?bG>={6kC1|QTPZbeyUHx59-Eg2h{w?6F9=J3McQ}> z;ti$YE-_?Y(ROkX5~UtlQv8k9@NQ_HqI$r}@|UQCNMUPj+(!t_;@Dkmwt)v{MG2?b zYshb;?xu2|@;?z=?j@*S1%uGFYF*aq4U{Y~I_hbrq?%Sc+=nUuVoJdt|1dKX&E-2& zo@5*Em#5Vif3n0hPnOXX-o~ zn+2Ur&{@vt38wug7ey^8pf=lt@4aaM;)RxAX`Y8z0(o^IBPz>gE6c3fNYMjIm4saz z*(#F6=X$~=1LJEUtOK(z@3JF5)Dd^jKah&y%BmNB;-7yTkE=D|2MK;<`%PztQ zWdJWIx9##)rc<%cQW7Mfpt! zm0oE5Cr0*?ATTcFOkTK-r~D`4!ARmC9bueUkzKcDU(i7Q3q%-{8RWyhcK-4`u3ifwkIh}YGIgG9BcJ8 z05U60)Q0&)NsHSj$cP=LsOhHzDwLa)NJ-s8Yn=X!sP8Eem|8&<$3{PY-t@;3TwcB{ z;ARepT^F7TyEu`-&rYs-{(M{g7P6m4(kMQfJ?NM>4?XdMPd;(Lb4h{&G&$FW+2qa?QhMv3{ME9(0Q$~?N^^IPZe57AdVu|e^O zq#biq!`28U@1Ly(ZWufMB75P5$<2xMNB^#J!*2NN;2RvHc-zu%-3%HZ&PmY|fPwU6 zE+T_aB%ds!x8XiVWgD9b`IiC%Rb-C40OfC8$p{dVWP=XH#ZVzneFR^=wS?O!@veMm#qi{tSe51jBIiLtR( zUpt3G%obO?s`v+YYi~2)$#0oHX{vE~X&h`oEZdl%&@f;hI*~Wo=|-+rmpJ5`SlLcB z3Bq1Um$&Xf023`l)4rmGe~GhJ$`1`EYLw=Qkx)H2z})yz$x90Tc#6B4cIhUzjESGw zIY-4kw#D>kY4uWlZG#e?g+-+M(dAGK+m!c#EaEGIB;~I|@hQiNcsPo@!J@$>-Amwe zK$2&LG5$!CLFm~!{Y~qRygyRepyL`VQcZ#Cb}h*nw<$pc2#c-sMu&RX5inN+*QuI; z?xAl0{R;HDcH&+#nLK{Rv6?+OawN3(ynn_&s!u74`P7zRJ)qZRAK2BMtyCF941?Sa z8+ufd9j-3jdnJ*#&u>bJ+NS%t9hJryr(I4(8|!9uT#5sG(nrsrD)qzjl6v|?sPQ!?7|lVAE$;|%Ky}}n zH^sgB!3ZyKo#Re4e*v9$g50Qw(4CzkDpd*=j!I&}(0DK4@h_t4g?js|9wNy!<3x)fgh`){417C}!xLeJ>wxS!a#R@&nQS)enBt27cY zkqHb5qeO>tZ7oHMUAiktuoTM=i|Cz{4=%#DKd?x|`s;t}nA`T^jG=Eh*=fzbDc{s` zY;^s0##^1I-B`EKsD0hnEh;tI6S3VC>!6pbpU!EOO(-d>Y`H<${74q;T_H3yu6uZM zX2w8Hrm&sq#+&|(;HfnF8O-1lZsZA;hFGd)sOcV%+g`Nhs)!pdwutYD^;R_Abw@Xl z9Y}Ti8Kl67jS#OuH-V%Osdyiz_yuJq-&s`!8=}I1gQ>DMk^eHjuafHL_?_7z%1qtIO4QM_ z^^~wL=47}8W7^xTA#(wX0Xe1%@6;h$Oht@Y=HSwpp;c#xHBTaJ8{&7HJrp>o(to_O zNPSY-F?*M|V<)?|tK)01=pfSW*0tWAlYSnK>&0y__Eq3_K&YXH8%M@?;6RadMdQ;9VV=T#4ga}vO`1b$Jjj#>sbM}AmJ=q-NxASQ3WLe&{@FCB-T(N%x3nHSX1gt$Hhzr z0rZ{#0{jC+Kh4hdd$~6x=cREH^uu95gK3x5lScz<|IkB0blCb0ek0;5`cj$}N*4Th zSMMDCMozcR@mkOJ2K)#A)`4LjkQ?D%rk=&^H%9Yju>mcRNrL8J2*#IZy=$f_ccUSr60gLT3%QrNA}M_3**;TAHSI!rbR8M2 zImykM5Cz8OUGxogdbq2^z1^12>G7~lyxGZ4PLz;-nh3Sk&ImZeZX%4$Tn|WJ<^41G{@a~ z6fjDmYD+?^C6P!6L(U$;3Jd3l*j7X>@80lj#a35FQRX6T8-()j5fIWYhJ46h6=Cj8 z-`fwTm8ZpMENHc+IGjz$_C)=T=%)UDo6!INRr(7Kme zp;l|!Iiwx#kYX+Fzy@-yEh?U4w3Jpv7+j~qW>5`cTj3y?b5jfd2F$(^G)BQun1EN5 ziH+pY&&=8$xz02kHU2sipr5)p*KA88q;7?7(`Yxi@5g6I45&o(db>1x{?S#ak<3=m zr8$B(AmPXGkLB}QpMn*EYs(W~7Lggo&8vsy{dUWdAGv2OdBt_U+vS^{EI9$bOQs!S zRrDer^KTT<>h9my#%cHG{CN7iz&!O`QZToEtK*DpOn3#8#bxN83vZeD}9N)mZ~Xx!5fk(aCq||{AfijU4O|9 zwoPivy<;)MPH59hM9K1INV{*{z~|W$9O&pfJP4l0em3EJz$K{WBY;zl)2e5)xtViY zlzHWpaibx_&P*+zg>zNrC2Nrcc-r$I8CZ64hI2Us8NF69>&ZZ92M|FhcBc}2TSAt8 zOZ%3br{1Iuyr3%YrnIgj9azB^l1MwO3wPk`(m5?cp?MQB;QJ?)7|MasbzPWS`CL%!Y+Ht3|j1uow8%xl*8uj36~N2M%`r*mk86k zU(@z=w7u?|Rf$nIJl^4;4Z+*QUW9{Kbc29;E*Ftq27TDa>0CDNDwvd0eP0*CO}6P> zVxiQxAH(qp+rLcEJui~Qjh`9b=>O>L{&FT2YtCG2v{;$o6y!Ui-03^^8E@OpPN-;& z$GFjrFa5q4)jP&XF2WSRv~CZZidt0Ms&`18mSy3gkM$wu4xsE|DbQ7?J=zcRXO24* zfMfa9QD2{@ZCzBpk$at6V<)1jbRI-t7o&)ccgW;y11g)hRWKw$r=A6-;+lau#ri7L zPY^$zTXc(L|myUQT_IBXzpMfIl2TRRnAvR!0<{1hd0I(KWe z%0S9MXual?v1$$fqqz%yJLsQ<7JZwIWne@{E{;3eSW;=SJdrT{>Fh@mm}u@`($OH4 zSUo2+8xwRx0t#3)oA#ULKzpcN<1n6c+rM5kygoR{L~<5n7oq8uk6zh%=Qi)X{k&>r zM8%lyPryRd&D`(mKU!O5PhN3od7*b?EhFkr#`(fRBdOvh^^G1Nku=SYU0KOs@ z^mt!FfjNIK1lq;HDno%B@6i6wV3kDGbUqY`4excU1_uvdxX{ z_NjMp@BK3JW7>8TpTicz=q)r!8@$p~n{~FjVASqpCAiHxVjL!E?2Ui%+?n@)7NMR>dTrsHwAqZjd?%#0EHvC))k>1OUG z6Y6=TgMKaSRUfrjIwN;XatrA(7NXe&^VO)--owT8wHKaS>n&(-VqTkZ*PR}d0QKw^ zn46*i=B>T*P#_~64Dwrn<0gqQW)!#O7x5BW1T$MU4i1hI(F%j-ySx|OG0b61{tii- zm4Gaj0jQ2B@29(iK5xvIzV{+3LxRd$PqQ>S>9p8@_ zO;+TscAG|k1D;(AhQB$onJyOQ(*#pgkci)HO}0M44)7%*HII1yY`lW4e)Ch-ii1Xb zuF_wM9%YHHyCyNgjx6|cAk#X2KXJml;Sd&hOCgRFgWAl1kP4Y3tQi)OyDKVHHQjal z@$R29koyr<7{+u8{&@_7=Z11ciiD++3NakmKdi*#nFg{zGZSP% z9Mpr$4*?+IIw4tGQPV_@;bFJp|6c(l7-*)#p18`;Twm6$O8pGM(ski zg#*wlR&s1`C@q`jP=eS>ks0s6X??$SK8)r7i29?t((V}v3eEY%iIuX`5b*`q#RtzW z%BbylmX)U{fafCTI*zqixhOYL@LsTtWmp)9wqV{yB1epg0E8}S>Hh)s8%O3V#|eRdmn^>*dzTOd&%CEeSH{K$u{njtD-IRBq* z(u~k3gsD=vAC`-#aw`Yqd9nwyo%1K<5yzD^ZdML zga$7k3dMUHP9mM&&G_MPALO&D(e^>>AB_Q{X>A|zoM!W*cCl4wpXQ0DR5fO$-n}hV zp7BPikh~8YauOqw9zq;IUt}N{Z$&h-EQq-hFQC}nQRxlDT3&3|3A)hH1aA>Z)A2bU z$XA(W5>fp9o<%Ua*!(5khQ>D>1J4CZgWfzoH|eUg{M79n=5Yf6npUL|G>1q>Ik2gp+S=-JS44T*Vnm8{6W0A!wkg*OMc$TfYu|k(@AU_aRNWO6x&Z0XZ;5`pRFu{N1m}^xku@_3a z&T`3Qrn^Yv_`ssHi1}tk0bnt=6R0TK65{oKXoOkdAMRtF-X#S*3Sb0fMCPd#uBH-Bj`%4Fb=-RL@J_rS z8TZD56IzDrYIvU1d2gPy2C?XRsq?Ag;o1?a+?nu$s>tx~+ej)HD@V3^%*bZVa%quR zCmB2nmHKc4Un3}X(uKSv)jxTM z*5{bjqo}XpttEqh`dNF`67X~{x{=d!p#8W>xw7!d$x0EdnAl4;bXq6kuHTIq_539J zHkY5N2*H1DYfZb>qDe*?HIT;Z-lOK)tRrc^(n4N{?vMC-?#oCNzP!7a10JAZily!$v_nKKf16_Q|-s$#b$Sv4Q0SQIfYL+DLQE>D84<7M8e z1ML&TEW5G;&t6vuCu5d}(;vDeqR7|cF}Kaf9U9v&eJQpD%b3qdig}hC8y(pn4khaX z%U2<_-;(bvg3;o1WMpKZ*||c$5iR1FvD@0IL#iL4{qcu68^BAM1#>tl@Od{dV)bcx zHC3Ujb0wUt-33n`xYm;!uH_Hepj2d6#PB;h+>B*6U1xu!PI|d49P?EiXN1H$mDK4* z5`1i+^cZG(Ji_*#ddY!#EDVJa#3Z9!8-y2zLC*POOEV1wtZDa=hdqH@$H=R(U~26t zkRPdbu6C=PJk!}9ZAQGaEAA_mYFN&2+Z8c-H-ebJEf0vdv=&?_gheu)7VN*jQ_HXR z9}m#+^&qckxu?MshSWB4qekYbIduW-O5;^6z@PkT!e6;Zy`m8Pt88NB8`+3Y)SkOR z3p{s`S#AAK0T`FyqhVO|M1}=XwF`;<7 z$)TED)Z>CIK%U8m+~z4pb`acdfm&Sa^6}UbHC*sA@_ddGfeN8SB@Yb;56JQ=V|I(- z-D1EfC2n}#952_H_C%Oak$E(;o>i$lO@Yll`UQBQZge=fKQet6Sf)qmG7Q(dDUGsb ztow;-t@?cM$H#HLflN^ds6n>>x; zHO6IJ-kP8?Y=k4DA~W~4a6i!G&8*yW>0gWMjH}6lE)eMs0uI5#I{g9FXRP<(_f~HT zR7(A<%QW(xY^6MYM2k6MJ*^_E4u6cIjk*(`CVXz%h+(|NLB;xe3B3RBVbnCBx6GE> zqDq>-CsZN z>KY)J8GZ~(-r(L$C)k1m7Xy?UN)!qxlYx~*P7DUAuPsAxigB8hwwXJKAv&VhM~k4I zD#I3wxYYV^97%M+q2Hg8EQ-!ib5Op8jCXA^=(hX2TVsx0@H12Rt;%U7a?%P1Q2g#7 z8Agn}NSa|Zt@c2vbRkGiDy^;B_DGd$}r4Ke{lw7pIS#UwS8q)LYXdn?0 zDo5dU*K8A~MD|1I{vvah;K*U)4L%%m+9cgb;{PVwAT6=c)&FttDvT;aBn{|D?pDcx z??{#Q340i^j+4*6A+)_8C}}Z~_Zp4v1-mI(2jC=_XKdvWl6roU`Ao;!Wcj=2kzR8@ zO!!I(IgoHHO_;{qQ?wvK$f%azx&dYJ_}5Rpnu3f&J}7vd9JYr|68o5e+nV{_$6R$% z$AG=5gpGi^qU^+TNZy~+y+1^CLE>`ls(o(2`UA0fRTnlmpc1wn14Hs zv8i(-r|Vz?ZzD&AT`vz9LY`8#EcENujH~?U{nb=uGZ{Vx@V4?tdl%=mA0jx_zw~vu zm>&m-s`i>^CvfGCbGsb-qKj`8ALK}Rg)PrbNy!F0QA%+FYoQzZ^c`^$2Ji+}>rwx( z1heqET{vC{uF||K-mzc0x97}!^W4E6P2TEL#>`^Xjj|CejjRw zZXt3i-dDe?o$M@!s36Gc8T%tS+J%*w_rJY7yL)vo2ak0^VuZg*j(#>)?8jj)56-|~ z%Mrhqn)A-xh>^LoDa+(o&uDNc9txdfOriVo3`SW|>7Np36tM*uFzFj`6zZ1N1TJV2 z@)qWV`7OD7h&AG$Nh`ZF*XYh>r4eHCIu5F+l=oquCUIDIH}5jxC%ll7C>=*0G&V8X z95DrCxf5R=Ct(JdpoT7%dEdUDTvpn*cR@&4@mZ=l$3B8sR#NLI@^cbpw>)@+gjfAk zR8XW49U#Kj!PltY?J%5RC|f>o6uT4k8xJ2(!KW=dqyNwo*le)DqdR5ty^V?GuD69! zH*2RO@T~+Gz{2D@{2x49#_Qiht*-k;Liv&ir8FFTQbR&wO1*awpPev0Kw zcf*jYH(v>QLU&kSENj0+;Ql4-hTmDx@*>-haa4e&AuWS(uFvuHBJ$PA4K2iPzKjBF z_P2Pmpwf#kqaU_=9Et0NBkp}OYF5H4yBCcY^e4kQgxWj+sJH=y*0a3o7x#;KPEt*e zl^KUBJAQaEC@k@jKRS;8fNxEO{>#p_f`U!(&lq>f!?lfWg|nU^jD&B{PtWhjyA*cW z1mW<XHrO7KtD3` z`U^eLAEKHLDt}gcrMEwVJPN4|Yq(~*{VjBw1n{J+ z?1uT?F2RJX&{L~I3 zn(^^RN^gLnwkgIr1922bmm(TRKg^^jvAx;dyb@#mpwBubc zOI+LQ>Gs&SKjZiq3H5lB4X76%p|$1JDRnvEMeEj?^52}?4!a=^zA+$0l52Mn6?dl; z(%$0nDw-JY1MZt{HZuJtj!8uZPgBjrJ~%Wkv5^HphNj|aIUK)B2|bRcUIH@qu20TV zso&9I5kst2#sHR#sl2h2=e{DyWedVhb;lXu`UkkF#icMYvMs#5W8p_cmTeDj1k z;DtJ0adm8y+GCabOE&{hiX_m`cX!uu!h(uM+G2hzgp7&Csh?pk_48}q$#sT}#2`-{1r>fA;6j{61SjIPru|I=UfzES`y*4BG>bo36tGI*;Gfead$ zuS?8@CV^C-U!ra0w@?Fo5_8Q7O)-AEmyt9@%(#a;LW9zHCOONHk?nT@^NlMW$Ia=! zt=yIZ2=954_|7sF74}J%%}J%rTxjR8A8>$Qkws%wr1l~_D+~r6myfk-r(3g?jQX1>=iy^dpxW zOyn&zMJN<1w1(?+tr-s64O$_O zJO<jWLCNADG`spKe!^hIX~Mxek6-mz!U>e|WgNJRfG|*>Jz~7#J9c+CHKHwtR8? z9Nyti)dA?M^~6JJ5r$4O7oiccH}eiYW^L@i0&b-bA1M=8HM4Z==HN_g!W01qYkErxs9W8tx+ z3yT!69FTWau*%4muQk?szy?;#?#o$M;K8QJ8w4|>`348#>gvm&VSe63s^?&MvNhAu zOfJ`WM4$n$e;iP!lZ77N?Jf;v-tfyg_7 zuz|E^91*&lu#c2Caz-D1o*>mOQCO6l=Lb-4CcbfR@w+D#R{2*)#rn!WCobuFS&do| zSle%@1fOp=gCzy=_n3QqO|Fh5r!e{vfCFHadq{_`m;EEQ^Y7|?+{ZrUzE)_|Y z*k$>3;p_;5{v*{^kZDCV%S{n_r6PtThH{=TDIL>y_HeL_iva&RL^S@KM5s&~Y6GqX zE8?wo^-kxyN0r9)maHSDF|{W%b;qD%zAzW8dqt_^Acb6#x0Q1rhy5U8D)@L|#V`sw zec+ycJ%z;+^K=(0Wy$t}B}yi-S5cy7|7<;`P56J%vP=V<87ejyOd~a}hf*k_l&OfG z{xSLk4y->U8~MLT_NHufI*Z{(+HIwN8~h92xS7*g!ddzX0Jmz%nb{!IJGU>~q^gJh zq04T-lEjpSZ~TEa3O8gD!R!B-w=4SKoa}Ljrg?!6%At7PD)Z2dsQ?hYaE5ked$vjs z``r4cr!}rER}|M2OIf;yl0+Ruv*(3ICvx-_&!c2^tjJ*h%k^7)9HXi?IK=XX+Jh0S zC7BIM(D-MV_C>e;D#Y*Hde$E;uK1_yNTG+*<0Rufz|tD;iPrni+Lu8WCPvoC^ik($ zB06x&yVCJ)I)RTtx@cUdZUYVEQ7C{s?8u8qOZAJNp^HvB*-^?A72M1vyzl^POyLGQ zo_hjz!97w_j0?oq8RQf~I{3p{EB}kNf`jJ{`=v7zJXrl%R;M+vIRuM8<-8T(HI|Fk z$aA9t7Oi@hczrM6<4j~4dpFx6`on+N%?)ue2;{4RSUxNW@##l6csc0$QAHs(+3b8* zAA>s#w25WKOceLDPK3jDg(zCshnY_F)hcZ7#I&cit_{dKQTzDmLPHor#%CHXsxBcs zxkBa6>DUM3dTy0_R>@ujb!9ADzyvhihPOUy3iZ(5QszoY!i#~=3g6O>COPs>Wrt^& zdC5f}koPv@c@ba&f}?_8^ZknZZVf+h3@DV2nTHxoVNyg1T}!<$X=Irh_*!wgtP4-n9mFq^fNa2f8tumQ8ux(yUc!7An)j(9An*jvGw2R`c zPZ;$^-W-#@`dsLF4BYw$ZA0F^p0r-Xax_JFb2!i3Cf1ll^`Ocss`-g|dN5k6Y&Ip< z&J=1QLvqxkNeroXtmP)E}N*m=VE%3 zvBirqeB7}gOdAucLk>pH3{bRn=h*cmjgB{)2b$bjEf$*h8Z)l?+L@1Q_N-EV%Gj0E z8t)+e0cjzlFTo}%o7!U{NY$;U{@hQHt$xSkYugthA?ahL02G#N0Z9BY;V$=<{*t7b zlaGjCxc-a~e$`D|y*+i~zpE>JC650XY+~k_e;`oI*bmc*k4ou*bskvRwQAOWMb&AT zhiBFxmD!@aO0h8vpYJo5jxs4Yks2zg+oTmIO%_&^shc=P(@2P?lS+q8S8{Og$>J^Z zQ`JYmX~|@{;{Ky=>c#sT9#gHXu;06mp+)FfEK(qHVWh_8l+cV1Nz!NSjBw~H?pj-Y zQ1~gi52wfiV=j{rQNoXi8BZ=~+=P++1|{5R)0kGOKt0}$pv!5 ztg1WIb0;l=txeqB;Iu;7(T{9rKO@b;*km6-wJNZc#AISr!f8E_YBTE957Wkc<@@+C1lgA%z`CQ2>Cq}nw3 zUbXQ0jJe6k_=x^n+xl#N;LJmA_Dsp5FL?l_@TShS)f~;$1MHN)q>#~)wqL{HBJ7U2 z7l-LhAJog*)#O9QS_`d{Lj@BI+HNBCa`@UaJpUWs{#J>4VLXA}&*v>#Cyrzmn zfW+)$E@@e;@&6ncw461Q$qP%%SANRxUOK5IRGT!e! zHKh*>)^AV)JxlwUclXL%%AE4dAf1$25@6H7xx}|LyvILkwyl$hH~Q^a#7Q@GYLD~D z=Z7pJMhL@+obO~1_N9tl4WheLDAyNW4Yz~?5|Ga=mFwT#O?DaRtv#9m%A(pBql^Lx z1mOWJO^chwAx`ci2Mx9(1P$Y0TS9MT%DF~$Q_F|sTifhh5z3|P2=1Th-!~3?_PL#L zdsx#JS%l{x2mqoR`Fd6(j30(;=N+%Fr>k6bDjum=f{jqEcm1JUCa03XI~2RRHExuAa-yd)Ucv$!T00grEps&mI%ABEbqQo zLUX>BnXEKB>*hFePr^9l;ThCG!zfV5^X||)oDa`vEi2l=%YSGQH-d}zxLpM5t_shP z1K5?|^_=VQ@nBF4te|8OGul5rH0Fj0IPuxLD@3Q=|E}a29ftqnxQkvL{BZm;u2EDW zg~0u7*~gQ)r@l$z2-0DD)|B3^=xv&UF-ecgLCNt`qN2V8@RX+(Zn#bbMb|RCY3ZY_ ztj!e;sx>7bQ^>&cB6|4B{3nZH5D|Vq*KRFR(FR1HHT1_u&I@9!ZcYj(*16?v1?$vv zhoN2$OUO=7#X{&%U_FzCS9Ph@90Vwx3k6!ttNB$FNz^#_%svvRUdtCP6Jl5YbRjN^ z9VD&s|IIhx?M2Q9ba+Z zkt>P!rX}xvA3yff*RWr=`CudutAIMI+OB72W|IW{vCuB}ENEpF&)oSgCEd=#5p`aw zhwXDIqWZc=M&h!OK|qfKlf8B-zw2v#i@3F6V*$8OuidR=j<4#`Di8m+gl1p~{5&6Q zU3q(FZvgGR7`S|2Cz$OBKe~zv*^hwVDtI?gKh`T7f6+%R7_zNzB=kO&uSz3*myoD7 zo?<7*o*Vhw`xs<5ls#bNFhO-SF)1nP95QNcYiC5d!{scWm%{=Jp4$R~nHWYt=J_8R zHh9%_ZAZAbC8}pzYoMxVzTuHMW5alk-KLj2WRC!>Y;VHB3$4|mjTJ=&t_8ybbn30* z4J0afCp6{m^3&kI-ekgBvZu#W;9B!X?y7FLD2 z0aKD9`}ipTriGYp!y{HOg0H7fD|N{ltkCZezBXawgR_CpY7~ZV?1xDf_;?mnUA~Y4 z3Ei421W^tD(uYE~|1*8?uS-kz&rclhl<^>jBCx#E zk?}C6YWv%QDgW!Ry;>!O%YTfLpE5<0om6Cf4EVqQH^si2L=3g%6N5^j=&YQ$>3f#) zBH$gt*HITv-q!~B$M&a6pu@wfV!`@Gl=EN9r6>xN*w4~(_>N^`Jlll`W=WcHSU^9w z`IMwWuMN&BAb?f>y8AIob86|{+ktjoBdA>j?{&;Gv}+Q?Iy^;8H~ZsjY^P}crUppU zfnWkCHGgU20t(h*F$DH9pXoO`rrKq%6M?H3K(`7`tw`FAO?WJ$g5w*%6hEr{djDqz zc{eI^M5>xLkc6c|VWPqHF;QP(|D;0yn*nV1nHH#egK@&!7kLdffZ=@r53~bx4h)=T z#9~Y^{lu)1svY~#f~A7z1JoALuZz;`^)AJxHbXgT0M^cY;B@MOUiv^o`*c%{gj9`1 zuco@58RW`l8wHVgBsf*uX=vk2?3WykD zVwRnr$N1Y6G0atS+>`eNrhI7woynL542g`bhAIro#QT-+uLYBRN+Yzn-L%MX9@6QTy z1^V`aHw=$R1;!=AZ9)R4fc_sS6*rZm09FbkLQ>mZ&%x z*#u|dJ=$}@9IN;xpkb^c%a$Z0q$?s~$Db8H+Y$@6da+oe1(o(xV;eXWQ8$2p?naBtS-E}9ePHX0nZyfR%Gi8n+a=AYr^Y zE|jD*qq~Mo(wAvYlC53Yyp!PQX*PEyhMTf#w*{m|J3E&73ww|-$@!&QTulP;amZkU z(ZJEI5cl^+3alr5@OthMPtT)3=tku1u^~zr5gdjEvi!u1n^N0VYkd$8P^}7>Sm9L7 z`cA~%QRW!~g4aiagFBt!F2*13R)4$8xFZ~fj1I2V`QoKE%%MKT&a|yQOws5@3~;2^ zAZ(03SPwc(ZnT7lVMu^J(Oox>vA|VeorJ3ig`fN^Q8e!q7y2%vRJ<@YXX{doZu-(O z9ZV*iP&OVjtx&&-y?=bFD6q1#fhUuk3>fEM_C*2tu$9~?t#HD4dW+^|PiNAum=4;?;3-*{LE#qEfsm(U8_Uim^) zYhVhOs~;n)7KHBgyv|K@PLQ_Q-&8 zsrsz};jcd0-;&}t^ohp(?N$b3)0ZaB_%GotvKRC&{OM$&bll6s$~UI#>aTr z>rObmp4YzPM|#)5yyaQGIn3t-OtM6nI3+qB$tf2d7|8LR=!UB+S>CmUyTGVwFW-U z+qY^9`Wa50x$53*Gv+LTes&%3v^=taE-=;zPA|pT5S1*rN8;R+z9V`X!9hq%ZyXY2 zIg-V1Kqy|u)wqR&R(75#zoC3FxnFy8srZE=A%G{YV!3V5mF0|xAkrwnu*Q3NM$*x| zIsIrZcB%Lq83E*?hh@juw58=r0JDHWeg6~5jn15Vwf>o~G*jieV~?{C8nV~Oanz_d zXI%`_sp;PP`&)%MiNkK;sJ15b29w)e|C+m(1;*}|Hhk_U4RrLAhYp`LFXKmz&oQt1 z{4cYWo1>Df5Dmfp{erhku+)&ZaK>wFs#%BLA8_t-m>UXgJKdGWu(amc$x}nuyt_d= zY?Tec>kpIgD-xtX(Y@(9ODW$+HFV3+Xfq#yAIV7XrP~9r>H+oB*j#vFLJe>P0=|DU z=Syb^rMquW*GHKrfa#b!H?Z-J`#F&{&{Om5OPbgtPR_A@BP)DLx%d9=thefau3LES z`|9=%7hF?8{C?9k1RwVfsHfMm1ot6j?cg^*HUigsvI2PX^33YGr+cSJQh;ML_Ash= zNDILrf{d#B+5}0Af)b+v_zu_+RS9McNu#c*d?dSkY5Z%@`F@aVKlFBZ+p5(TQcRt*d2xd~D)Ix!q#2`RMu5_N87S}DxXlcOo?QboA)I3kJ zQl))s{@gj4_h09l06kB<-uQg@nPOKvX}*MLXh95BpVELuXpYi5uOJ-q32u&YtyIpa=8pM zKl%AASf&%Z@Za-q*%=e>&oB1P&OeEOivdFdmI;R)Vvq5UoIYhfZ@x48+S3d8aG$?1 zyfP9(%0cr)HHiRL;W4=V*QBu=k0n}Tc?}$4V?0rFoAbMF+aO-9RANt62%g$W{5HGQ zF~7^*wsA?2&g;nX9a<*^qb7@(&b<*R0T|_Z*AYL@C2sMX zNu`WhfuH(!F-?FxU^eIn_%GL*7g72aP^RI}n9i!xmce`(brSCE$>g%zA~M@fiolGO&897oWqMb`Lp-Y^af5xI+eI6@o>6d3O@6Bi zR>)J=|9cT@{*Uq>0BZr0spfpWtnJ6dnA4M0(qQ!3(>`*<8=P#=>4}0ex$%JeSIFI? z33dBkm0{WFx?_nGvLHFnP(QosWHLj^>!C*2IHeaC46{6PtHu4Aqm$~c!23k-b3$z1 zs^cl)p+M%r^+xVg!p+I$QlytFYWZKqu2d@>i}fguAo=G2e^Ro*gsJBj2UfeN?ez<^ z{do7NZ35tyN(Jvv*{ZT#SR- zB`NsZ)p+CoqU^1M;%c;Q-z0c&_r??4g1bWk1QOgmKyY_=?T`d_2ol`gJ-EBOyX##| zzP-;r=e~FEdsS5N54CD_vt-UW#`sOG)Z4Ap52DA%L3g^bnRE!4MORSsVT|}oy>0DY z7(PSoxz;1PeM1@@<*%hxjvS^V5hlUwWS0ypn>I}0G)>nvC?2Dob;eCF))mmlZa*y+z2x_>e?A~s zHXwr2H6DSNKA;LDrk3oGZaB z(uvv|ZtIJAS|It8{YIy#^~n~ioqoaVCzIC1fp%PAR}kVcJ`GmwU1S{g-cQ?=?zo|; z6NC3}Wa6b7*B0=-t=PSO#@~WrOy-&Bdw)E^nGspre1$3;obN60Y%uH2>UY%a3vpgw zQ3ujgodgte#w%3?g{DWfUT>zGyF0Fb?8lXK;ozRcZ9%O`K<$>kJH4(4@(d7dXjPH| z(cPpiTM`{CkQ1xrh>v?>JeU+^#%E&WV%+x*H^omWf2!pc@v02+p~e|%EVh6D^3WZk zajjLg-qyd+_G58gl@#a73sb=E>rQsKmK%Ul2>e%y#7hU|u#uC7;mGv5zmeTC ztGk*ZV$V&Jz^udem83p02F`4p2yiO?&kpWH5X0fL+}VG+kJ{+EG#U)f9=5Ve^%2#oxF7eX&c1Aud(I!NldL=w_vBFjQjzJ zxprq2dO^>hiNDUv9ds*$OQ3mW_;UHIEhsU_Pv+<0fY92a-?#5E>%2d~s>qKA!q;*n zjy7b`;X*uNO7ibBRnrhjRL&fcNIU5bgm^wQ~%AJ zYViPyyYb4)NcTa){zr@58vUZp?PzWHa^3*R#@JKN-X|P6G&?_7+pnm}pdQn&Uwh96 zwAVIKPfhRBx315lBta_*>-RTjh?bfV9)!AIa^^qHqK|g7XQNkNJ&Kir3oykv9SElZ zbXUP=|JNbJ|Ml^#Mc~%@J_&-W`HAPkEd7f62$)Ibi|7D;NE`ggIAYt=OzLh0eez}B_;kJbREET<{ z9uEjh$&MzA0w=y=i1GUavj@iwgcZJMgHELpH|`<4o7`1Vey3jfBkDz)7X(IH+$=Cf zN0ZifNJ46s`4jbe2?vxhiEN{1Etf+<*Eu%VbHRAb)B@}#{F8nPXw~oouaN+|R&p^D z6w-SiFhzjKjO!uspb_(Ce)_%xLr|;sN5O7tR9e$os%w7R=BrR1$U& zeFko$V{%WG^?JdSdI#rxa}Qq5vcm)UA#Qza2`HCiUMM=*+0S$8@dvab#dElan9|f! z@3i1`&IA=-n zNoW?z3A4{22T~B5)odhie0fC$agRz^TD*ixQ0YY|-BTJO&rv1JmPN zrF)_&*P1q)cIv>0`?9HM!*SR>d=yTtanut=(CQoNJzv@_GG>RZkNdLUm?_Ein1aIb zqt`^|*3iKdTI#O3=P^FT$K`pEprXllc;?`|o%}=y`ZgS^%sU2E6ZOO;QC@mX=OSqlT zQrMBFO1TNYsL(#l&i%^9(fv;ECy7@>QMcPk6Z6#Cr>!j^?e<%C{&{xOMM0t*yWfjr zti3fcuDWfuItKY7@4vYX?5TfIJ;lAjGjh;;>zUJ-^xSNDdVjiDES<7) z*aoRj8#p37a%zIqfEgDvz5NX^VoE{}#8b+xex+rij!e7t9sv3vT6X{m; zgVh$Sx2$BNsc_Up6}hDPgX4OyJ8JXfUY=hBzau>QcuI5mW-^+&a6C^M^R=oyuBiak z$F0#dZL_*!7XJEFdna7aOt*!%o`9v{K)vh!q%f*Kb%LTY+_SN+(2h1|$-uvx;-vv* zFY<^z5zb?r7HsTU;j>d)%M+O6NXB_~_i9U4w()ja-J+m;^gh|-vHCu2;nj+F6lh3e z@X!<84pPrN6(;Iy)vbE1@R7-8*tIj@m;UdzsqMh}j{t)L##s3CMteha*RJ2JKNy2KeR-{UTQDoS zs`TCRSUuBTtI_P^d!j$z#Vt_>I~SVyY_aGYNr%gpP|(}(pdfnmFJgUyFK*=hV=Q>5 z#$CmN`_w;l`E`~Kwd7b9C(?AbZ%KD$kDh3vBK8A)xXEllaoO=wh0eW!dNw({ ze(5oQks6>Oy?T^Qrva@cT?{0s5uXcEY^`Zq6qA>0duHnY;%Y9jUWhSF%5; zRBBB=9v)hBl*E&2ryUmkY;ii@8MYOCG@3k5D{?MWtJX{LN@Eu8@OHR5>n-+>1iM!$ zLvIXyi1jiamR-=Nbhz_VNy2|zp=qa{@~JYf&Qx{Pe%g}V-zvM&#ymclKQx=V>!?cJ zDsxEALPEKTE$?Nq)|jdggdyqf>F@4vCF-|j>|jZpSX{mN0ZbW*=>${AAK~2Mq7*b8 z4?+Nh%qu!S=2pZ9hsydVHg)?MKg6$rYK32$LM>%lRFz6&c5+E3Pb{42-~NlBl#M9- zj-@9egZ)!!h1>d0qAD(>YGl}uMOVD4~zK9i=hBKH~=S688wFR|W;mhc-BQ&AggvQpSNFTWs-ZUx41>JSn zGW6XeTSZHt2Yx66ov3ep2s5Cxxs986ZclgkTYjLr!}BP4o=9C#EE;PFc-}y%Hql}T zpSX3P(uz3P`MU(}93qSbERfLE-v|u*9`Be(S#2-X1+&bAWjaKt%#zx#ljoLGc&FRLi7Qs^V_TLHq(C*B@I)^xv39ru(=m%Lo+NH-B)e;u8y!t6!iW6)S-gh7tZ}jIygZ#QnKeQ zl=Z^3bXfJ15iYgKk=vDb+KErd8l?PE{{Y^<1#0 zhq{I*M^^LY*fo8`MXBGD9`<%$kse@V!<`ZikM@` z8GgZFxk4>N2C>Q9g$$ZBs{PimLjt^BN^PNyEuq@T&vMx!7Dr&xu~G>UZ~fnU?T*uM z*{q7CErL3@PpcaC&SY^aaF)&T%pH)%!G*D}L!ecgF(hf%OdN!n$Pyn^8J-YRT)%eg-nZ?anP`<#v9}3X zE~0b2uL%E1z1JZsTBDD*b5i+pRbs>g&0~F>F?ae>lpT2Oyq4X6r@|C=6WaT?PmNaT zaQz=WYI0P+>C?55D?94LKMiW2wL|HeGd-5GU!ID~FxNh&j)L!Ea6wDWZgbD+Q7VCd z6sT6lUmp;_=9kmpG$&hKuuf3z>y+R|(97}87 z`4msDSmI12VNv;2$m?&3Vo!oHLz8RALoou8op1u1-E^4r-J46Ri?|h`3h^g;I3-8Q z-G94PRql>Xcy~VHORBIF%e(F}*zLI~_9xOB62#2(AdedY{Q3h-L7{QM;kF+Ih_F>2 zf_lN;OgEwt zbdnw(x%FriKrXnwLJm5!-_4n1cp`QF8Q?`3MBeC>RQSV+N7G9I{W{I5h99wUEn|OG zlwwyS0ix~AlR}~%kS4acfaxDSj+6=%N4_B*tl3p5;*ul_Cebh;8phn~NKSurP30A#(RE@W z4bTCzN^xRvjNXHVYCF>iA`ljzVm=kwGc~c}d9S!*=iTDop71H=y95^>r##b;M4p2f z&u#6%+<&&UGPo-`IP;ynT{^C7N;S6amDZ-4E;!Zjt*8X?@MCZ?>xaDh$^{0}10ES4 zrtr^)dbm7f0xZc9dW=tT&`pLTo6?lp&KC%>k*1m7^Xzw9JT={3D%CgH{t<*PG7=7Y zOMGq`o9S4$|86qcJCAjhxbB9s9#!4LW)DW{4Whi0hlW^gl7I(~yy|vc+<%!T|C?e6 zL`MHAhT`evUoSS?>$rrS@K&V3$`hX3P-Am3g=V{$(IKN)mvZ3`m9M33yZ*dN6o3!- z6~+r+1T}(d|I6z&hEL&=#dbZrBK|P3#Q9VHk>q}t(Nl`Y-Kxgx{T$_oxN+crT=SDk z09o{w)yZSj16u1c9^_Luf@%fLn)Wjp9%hned+PA5`FssJhsCTIIgs7cNAT5wx0$GR z?pzv$12Z_1;Y&5VV|=89+T+YP|DLfR+^}|@We09mN))8cuE#mkrGPFii;ItsvRhHD zwj@ScQ1KsH^aNxz_Zzcr-Q&X~P1g8?1mD9$%i8e-APxl$=~cz=MF^E4s2@3KDD|ByGQzwE839kHlub15`X?XuQwJ%c*gY}jAZ zRMk4RcAL5TiE`PIWodZcKarF=_SoPV%YMKr%KeeSD`&1snradDC{k7M1jY2Y?(9SJ z=fC$*HzG5dj8voT<0t2hfTQvq)a4DkC!pheLT|7~X*aN5nMbIxzC_5LV;6`h@C=fX zLW5pOg_te5qlx8n*QkdwKB*)G;SfhwC4_gSJA!AN-S1SPA0MxYpwGXfuh@z2D200& z{AyxXa3fOaauqr$id<J4ReW+H0MPLDNwR=Y^VII>L~d z1W-#`dHs6zWE+I^XYH7m2EAzZhWg6Ei!*Qm+!na7v^AFh9kuT#q-mC)=i{vk7}|?* z0tU&%dkslDY=2`+Qa_CuBK)NGQF^jWU*rfmN9gH!L;YIucAb1_GD;!5SQUag{o@u7 z^TbkWG8-9Dz!5o-8mnbr5XY^nEwarz$oxr^sz?2j#BZM36U_?6)427_X{NUyu%t#atGKRr_dTi5bBRV)A0;!fVKrLv{Ncn9_Yr!|MhWGxI$p%K}%}?=v55 zqz`+S2Q$fNAz$LH%NS#49&45OG1#@;2#YwYDmKceD|ao1>m`ev(v-9V+77zv6jzdh zb)tPJX5aU8XQJ^Ro1A$z_SPs0r?2spRf(bGPSTCbI~!J)%pVWB)e%6YxBIIe9q#!0 zljZF(E6EDsP8~7cZQaxcpDQ;@GxV{xolg3;*3Ty=EQ?+fTG1U_NaVp|cU$Z+y3jW{ z(|z?DI^gPItLj?&0GX8mdf8NJGsyE|Uf_CS=&}_lF!j(6sK@Bq-np$zt`&S6Enrwy1(O1sO9M$C(puV<YGW1|+kJwqpW=b+ zw}Hl!ktQv5CK>q3_X|Fquv(7iw<54~>#}E;d*gsHKN`#Shi#}TmeRp>cR8f``GA-%pQX7F3Y3!`lsn-HcGIUqP8_0n3V)*yzTDuXD zgJ_@4ztdfq;4D2xs5wml2pv8F;C5clGV1{W=c%s7<4LQ*KZ+1*Z%vw!aJN7);!RG| zgMdJ%kpm%SCmblCSnv1JOAjE<=F*`#IhYaru5fo7<*Zgiu5G6-WjcXFogdk9?bF?# zz2OBf$}d;*FW}N(FUl>+`K0h;UyqW^k3@)FV5?{vVzpxS$(A`78OcPF_6X171(NWE zUWno1&Yf7U?CMsh<=s{5Z*D!*C&`a7I*l^>8W5h^a45SM1uZG12pgZ#9xZ2C% z5858r#1^`TT7;RziI1_57v*fI6oEu`n0#Nbef}zH+rU`fT||U^$X(jr+!iK5e`c`>Jc7s|@>x@X}_4PsyuBUEKuZk9^Im+^+c zwE7}@=|3UDayl3-r=>Kvt>q!RPm#YQ6E49dDl&CAEqhMf(MIuTeXYN2l4{C%c_opl zvya{N4B)`h$gI;r&1+SbF7$2Ah|UZ&jbqMPzvYCL>dXrjOL|v(i?wj@1k+&L$i(k8 zuSniJ{8q?WUhNF?kC2(+bw54EZZ?8CrFz!G>K|$I4Ih2#@JJ8DeW_S0ZF&q(cn8UwW{S(Q6r3`$PoV)l!TN5y0*>^<`8h%1*#$LgR@mC|Qf46TFwFV5%R@<@I0qKSR_AsGN3DdNai))~xMq$FdRV463W zza5e#@qe{W7CCn=C+tgq3|(r-<#B7DRx;d$1yo+-M2Mpi>mQ)N2LOk_H^ix{Gu04~ zD}GLYuHXfvmL~f{mYT0;lAZRkqRrhzyR_d)d1Q0yqr|Ekl&vo9wY?r3ocBw+m!DM% zMTkmq?-!{0*L}!0yf;;hO1a40AiKe^X!B3NLeUpb|Jg>@c^m#W5+4SGeoQw4_n*bv z3H9Z_Asfo9KorCMIJ*vg-{uzLn*+D}J2gc1H#IbZK>~mItrJ~Y$7SWt{1(djW?rzR zZ_5jsDY^X^Pm{~(6=RZz?~da?nN=R2hx_k$NWulso=;y+N^j+w=`5W+W(Kz;mQeZm z`Af{E81X4aXun15Lfr;`qfPojmpDQYM20OZTI;pR>1>2ZCW98FJEgYlG&k1iab#m<>^ykUuR;r!ZKF=y4r zP9l^E0jv`2D59+7XR$Wq3u?~mWZ6LI!FRyz%I|V`soljv#r$C6WCIvxs&Q7IPce3-ZhpHv_+z`s_Zpp%u0G@X%9{ho_&&hW#tB4%}N^B$0 z-Up#dQ!WRhU!}c8ZY~FPDPdpkH;%$J)CFBW&+3{wKyJs6(Ikb2W=rKHliCY#dqqtl z0dg(TQ}aD-$n@?+i-0xW?6S3<<1nDwbL}t{!Wd{(tR#6{cLD961viBY<6aHGpP1q1 zyG2S>C(N+UUtTnS#X0cdLddCW{&Pwz468%p-Z-4PEzaTG-p$Qf7{5oZliWV8wk6g*-sgm3Y(Q|-&a zb=Xu)?u}O0Yg|7-Hf|R~EfUbYZkj(e#PTA$twiYf%!rV1S-`L8HIDE5~NfX~SFs`TG0(TOm2$Lxg zI1W@TGz@47{j!|Pq2hH)Jf9b7V!S6mmcmAe98Y0=T2Ug9ekTJYAoMT~8OvZU7oe@T zJeIchYHErXVXxNbJ}EH5&OejU{O$=3iX_*TcwcF*$Cx3q zPtDDRzjf+PR0bcciGQ`_)qZ z=3t|jkUIV!7G8M}ed1ZR{#~0+p}&n*{)bxZvt&VGG(_aO9-)bDh& zVr;hgJsPiZExD&?t(UZvau;hmb9MBcl!fnZpP04Gd7xiE(B@k;BcyI_sA4g)0jXk~ zui0KTgbepn9zM!vzs|caUrC-@-lkQ)YIku2o!PAMbmEGK+m%;K| zwF>-{oIfE@MuoCqJ#L-I(!%!VRg!`~KL;rE4+XO)(O7z}z0{UZ6O#;Bx7~1iubKeo zM%nz2oXDCy#>c1BuyzNQ7{c=vS~7vqzHa`ym*y~6nO78PBQVfz1%HIzcfqG#z8b%< z>k%b>{Re~DV%EQTse*4sq~MLV{iVaLZB>s+yUok}Flg z(ni?t+k5QMfe?RS0Eg@HC$7iiPt!JI0xJTU?WYH|GzgL;o{IZxA*|;0eHFuYeO!G< zT^a$>D4Pbthxsw+hdh7ldn(<|a|tIBeKNrLTcEzG8*S$+H|NfeE9Xibv$Z$e#UVs@wuOP7t4)f_30HW}c zot*BH!;hq(3gaku(Wd0>KGPy`!|$N9xm@=NqiUBR`v#H~zWmXb-veGzo*D>@s!gq= z5#cY;|6uUrzzEW(MN#nk;MK_$*DB9B&Oq`7y<=4W|2^VA5IP_7`Te}%!^4AnXn15~ zFSk#frJiNg_y1K2vO6R_Z8ji5B&t{uthLeg!{C!((l2dbDd z!Dl#)&JWzL4L0{a5o+J$NS;sS81=+hGlKyXQ2;m0N5iq?32|(`2UV^YIDaX7`QxHS&<7fBgF0;PIL}uSOFQDxI0`G`aQ{Z<-y-MP|{1P-- zphhu;Mh9jKx6TYD@U_>HLKDk*rV>F$)u{b_jP>DR*YAu6d)Pt$d!^2#S%+grC~zu? zOJskrI=2ib!$UA?5bmS8chiVTBczH05e)C+dt#)FkVkX$DL6s%aEly>^ocQ z|EIz|kM^+mlQ(+#bUxIb}?BuK{p@~Q+!+J%)ZW$6k@9CCDA2Oz< zqNC~yef0LIOF-3gMw*a?n9iU}+tRg7cwT_!m>Y*R@882tT8T+w(aaJ92i4)Z!qcq0 z$<(jwo79?hZ*%(<@7u~zx2B8AzSj7`iVeEdf5)DQ4S;^d*gamapnBCT!(v041w0cm zDxe|-x;3cAf1rGGii-g03BU!-a?`fEj1gxOFQ;LipU?{X!|vgnn_XdYSkA*Ia#*Na z$4WpB!G%b^tdfCx56pj8>h_Axm=^IxzPW`tm8Qss@3@ZwE1>EoOTN(<`CS>V1^45^ zA>d~fQ6P}h3oriCw&}!n4~0eeZy|rIMju^NNDR0a&eV0|{{J>f<x6gP?8 z3r{H)fX5O>(_=Xr+8nOgxpJ0wS&x$J!GO?cJD$fe&!u+&xTsh3l$V&$X)g9y?SPEiM9K9z^3sXSzYky8udsFaC(kNy$+4=hFNu? z^vlsWXG3jZ(+#g%uZ;9rV*I_QAa2s5G*Gi1VBj)6x^gA`o4jj!Y}o~KZhN^3T{;~t zevn0bD6^JNKb3*G3)D&qoBQ=SzLRj-%$&QS5a!=K_!*$RR~^@Aa$00xu(a9IN5A}2 z07AK3%Iwac;svg%zrYxEo6Aj9yw*s|5XpSL%WstsxYn1_Qb@C)J$Osz4Fo2Uwi+w0 z%dq!9Qm7Pk&^tw)3OcKR6uSaj|^O~;)BzGnZ% zeR28_I=wabg-oOUQ;kuQFvj;v8N||@m>i@K_jwKbH7kxTkY4&C@|gLVs^#ZRGAQ1_ z=`D4aPv>d!J}adHxo2h3F9X+4+6~~0_HOL2En4LXr4BmwZjt;NlRP6o5xAC9$-}x> zVV>Fa?+yd>tL|6h=WCswL-xhtTT^a=O9aoYQuHIh77WtiuSWH}DEDCYTLEbOmBv@0 z$Nk#Q7ds%3=Zzw2|M;UK#L+=TLF7m38)OQZeaeVW4aD-@AYpy(9`*;_H$ALWJuzDb-tCS)TUM`OCtw4M zm#W~89XzW1HVrz8$1drvT}Y8l8>hK8Ba#T0L!`Z9-ph}gi*1CKv z{S{2>4R&D8357@!~(C>nkS+zT74Up=i)=?AA%K?e#h2 zm}fX683$cbD*2_XqP4wZ26qpM$TaAa#lR`96wJJi(fcCGFX z8a4|s+|2dv)(rkm5&)xXlgL`R?RV=%5x?Wpp3&YrS{~QS`zqyzq8u$lhY=PLpL#e^ zq0;oHjYZb&hLGMpIUqCP@^eT4x@`Ti63!zbqRxotiQ#{9{pehO{e9gkUKE zvpd5J?ab&8V9}T?`!@0BOXs~0yh)UzFmF)b2Go6g6rX*JRc|Z>Tt^ix-vUaZyfK|2 z2(DLOX-)ofn9ygnx7DJmo_tmsd~%tw!da$*AGB?oW6F4=9sc-iN%GaZ^z=gYl@=Oo zMHLs~Rv4D0P26zQ#Qoem;p^#nqj}2Oa&dV+$<;*S(Hz4%UMccfHb499U9sPd_ZMzx z*d%3L!5C!MSu*7XR{$sY0WOwh@{D1^jnc^;o0!UI&9O;#w zL&z;+tmg*{l*%it<7q|pRf=V8byx!}pWck29{{j`KcdIDZr2&sK_S5hH#`ULE!nqr zSRts}1v(AYF%|*GDURz!Ozuyx9eRR;)4fG84(};E!ilw{6a{TM$<^2&76MS6XSz*h z8C_Utq42W>F_cN1A}c{BV>} z{K+;;`V*tG%a-Eucv|E9X-cqxX>M2y{U1pzcM1jv*1=I8l=T8OSHL-P!8{w!r%C(Ija7RjYFpT2>Y)E!dxIchW0LgWLZ(`kr! z%&h@7yjGTXO?}(M#y7bFm#Yjd@=nBWq7kFrfu5-J{5pIERoUuuQ81Eg-kJAtI(!S3wU z`o`H0j}4*?>#^cFLLUm&ce|^@zQKC_wzptz>HD($d9bYx|o#TU-FoMJ`K3*rT>EF=13GFJ| zX-*+au7rs{HSJj5sr_CK%9!R2sFo1%dG!rERLP0v9}=3LP(cqYBnh1a#ss#4+rC&T zuDPOQJDbf#TVan~mWsNhktCb5_bE!W;$c*F`US7wTNZW0!VoMa3pQyHEff0E>;>i1 z7Bxo@^FKzkGGkV(CPHCXoKMD27jsu`I*S&ME4NzI3K%_haZ8?PeOGoWb||XglEBCT zs~vRf34_(LGUf%b@tFQpe~8xWd0S#bKAHQhlgbtcJK~-Ueii1h5I^h2+N4YOCQ+|A zGeGtwo$Xp*rzGNa3=eW$=yuz3EZ?%Uj9B;!FcTIzVj%-i(H$?jzN0$`H&-oLr?)y# zjEN5)hT}VkE8e`AKnFj}JLg+>o5pvSiGCr(ZQ zwc0S_4tzqEac{xrd>{DH&kDZl7NxiA{h4GUOYBlttKD~M;rIM}yQ=I2-|Sw{oJu;8q;MWhDq4BF{M$_yc*~N%X47JUa~#*1qbDU7W)#~f z&Yo@dA}c(e36WMctgOp=>w4cenO>V%R>(g0p_} z#@sCOY6d^>dj$OxefQw^@JNlTgP*y-Fvgv*U#`I zT0IjDtMXVDLF;h;{v3^ZiMh+C+vxWXD}WuCSx|x(V>vZ-gF9a|39~b}lUKA)WdEQK zS{jxZeh_;?`+){%MfW`n^rZ$8Kw!{B#kKl(0H6TG{x>Jh!{`h5cbJhJo&`WCqM_7c zjzhb6`+tfa2`)msh(S&XZL|*;bHLgwG(;H!iE*A}IMn7-@jtfL$Ol5_s%;B$IF(*c z`ue7zcaSHy*3LpUPr+krGkr~%Q+V@vSHAT|pxMf3{~7&YSRVJO*0eDH<_Z+9FDVWz z)=8Z>sJ#LGnaGH)`~l1gOgAuR3V(eewuwFd*AWeN9R5lWs2xiAOj`<8-@nCSXpxDl zd(<9%AQYH{c!+=>5kC&JqFePa!Hltg+L90k@p?b!?j7kZkY7HBm!gbQ?L~w4qtA7x zKxHpNhQj|DV-55=bO>xI-ytr9@|Ha>!0z+$=F2k`srMNtP+JED*;j!G1@xe43OfP+ z0q|C)9WnWNS9ym($Z6>>o5&Fr42k6XKHsV3EoR5PH);y! z4Eeu*(@fV*G&)_Bb9#Bp8K8!M@4F2m&I@0g1n z!h!h5?kyII)sYYD&jtbJ&zW(bSAPoef3HN~3vzzy>2ztWLJc~Tp||V-nBD(>h>XJU zX7!+bHp^Rn(D49WWLq7inUL@axiZ;g!`dx(=e4MMc}Fs%Ooh&iKswAP35DE4-08E@w@=kW{U?v z&Hlm*uvsF``AQznUOt-0H)n19m-tDNklQwNwJv7`#iFN<=So5C+55jDdVu zD0RhpqY1PFC*$7wf{{;p4>+{^t1KX?=S_vded5{kWK$I^n3nMvhN2O4BJ{7_la2LD zA%tCfdVVkY6_R~D0EatM`IZ2J%Tbk06DMx3Z9+Xw^RwaEb?<1EDoXB*O0e=<GrQq{;yRVg=UZV>*F`l)XBQgp)3b*u+|2&n?JD3T9rk1h##AsPusTPaQy#!SbE@ zl<~@$#*wcac5(!EH)_wl8uREMTO!89J4w378Q+~(8BL$88MgFu{;pzncKD3;<=ny? zPw{N{NKe@UD=6(JL!z>$zGrEzkXmDmDh0ztLlLWP7k3>ucZzXTtdX64`3j@T_Qv)>l@k&&VgQjBq6utTy{tg+X3Bt<{1;xUqx`s% z4fCZ{?23>foYMltm=YhN`*(H3?@bTpOQI1ik6!D!sizM!UG$mC0E&(k{Thjnv0BoJCxqf-G0XZR2I>A8{ZsybQ)2EtZ~S(59Q1ZJeMfkcDVV=j@9FiDop*)NqY z>2Jh_Q)EW5tHQjN}ciZR%tdR(Wtm8N^ z;yu%R-?09QeoC4DQk#WJZb~gnxjcB+#6*F0j%t~S&z1Mvh`A5m&2l-yucpwni)DCj< zGz4S&UzHX!o>x=1VWlYE1R4$R7~+xSW<<{;2c3n-xU9|QwKx~PXeh)v`ZA^2HTQY2 zFOQA#9hKwFjtWV=fTWS%k9sevbU81N^*-WoA;@bzQf>K0bRq~CU84-?$m#!GFep;{ z{&u+AK35zJjgfO60^Jfv;Io{+U_RL`Dl#0&2PiUrZS$a{)deAy_@?zwc!G=+l+<-3 zd5)s)VM@R3D$1EXx@yToB`gC%)U@Qk%Env>?bi~%Hoj~*=pOJ$-|HI$$?h9ey}Zg< z5B097OiK0*sTmQGEw!ve+w<+v^haNk8!hPpN^JlQ9RA%^XI@o6z7UExU{Q6@4pL|% zYGr-(;1{tkw|JxG2>}Av)~}#04ENu?SKSP8e15`k@ViM>q8;rI>W*=s85iF8S2t(k zF2KQ&>A74?c(2MMzlL+$ur-^Ff&-jT;Xy_%x@2WAhc#O-h;}|bOpJ6=!p%N-y~G!7 zPW`(dEUufCyFT-mn>B&}w-lOjqUA70wn@AQPv^5T(bjPz|6YCFz*#UlfzWmrE^q$B zkU?QhigAAxs;)V(<+Y{ayYw-`$K;TQ1ciM0m`bDe@9@u#FQ6-0K7Zcwa~&j!Lc*UV z*((5ow%h^uxk_}n%4*(YK}w8|@kGroXwZ7bwze35nZW{*S75;J<8vjp(MT}xLdJwS zUPVjWvE}mj(DB8HGfLgtNa|H>jDKklrzx={@%j`i5ShU&41K6R#Bgp2sH}}v=D58N zc~FUF$zt(LqJ#L%zZhu&Vun;j87t3<@*tHDpfhM>s&^-lz}QyDvzFNXD(({+=!1C! zl+h9bHiuVye>jSes7dGvTuPS@{N6*i?GTljDc02-J0BVp)k~!#A_+7HknqB;z}kIV zBD4wLbE@Uk9DE12V2?pXO$9r!C${qr*rF#@P3-R2#~Ma_R#paYpiw6O?wdBd)z z8w>+?=iFUHt`Xv7aVZOUOS_kK9`}Ms%Wj|gR+DnQuRmzQF__&(fcF6Z5@S7Xdm^S_ zD8WmrMPpZLkvtMzdses$ANcUA3~+ryvxN?<@aebr@cL0>J5j1iAE<1qFR#iILu_s~ z{$dIMP2rbE7k0&@WcSKiImLi4fa;=xxzwjfX=n9SwJs4B173Xa+O5Vwh5~i@Z=F)W7ky2 zIziQ^d=L`&AsJNr?J?@0$B#7FVy?=j-5X@B2DkO8L-4o-imyPeT%rg8ya?urT>g4~ zFGByagivUKYphL5v;fUe=V&`ybcu)l!}DV$Ybu~F2w=e~S3Uc0EJQs+K(8y7-)hyB zuX5cPtDD3F&s{qh@dnGNZf2EX&c@!|EHz}U1xPAjRNRs7&yf+nI6Z9-oF}^7$yn6sfGSd-8%Q~d_cJ}R zKs7%s3by@dk4b{q;JNOg8{GOBSr%k*oPAa4?Pp(k-JY8Q(H)Y<;~+#!d5D9@7kHk0 zgB-K<|Ac{G&LFlp;`+y(-0^{uAj0;)U|ZSTUOypcXb&obtaR_kOs;B?la&>Aa;nz+ zIzR#Ddj&YP*T_@;8h{|ENyGFp;16qjy6~$1PU3~p?$XI`6JQR{ z-2k(>AsfnPZUmN?Kf5fq>f_k;#QC}D6Wi}|)iB9IAT9+N%3E*usF0u8;=gMCBvZa*ZI_D%Z;t`#R&5ha&r5#64Kujj zp6LzxpR9R33X%iLfi03`zEEe>d%YnvxqTCZfWwE-7LERSA+bBKHN%y=_nT5L-%ie& z%{>FY?$odTOkjY&|Dwb82dfQ^YLM6rt=K3< zp`@lPC9r(hJYJf%2arFZL*sFOt$h2$kssSSXjh8!#^j87BD7-QofW zJIN+{s5Qh7KDX>u+ep_x7W}Z%0yboy(39W^U6J!ghzcNuX<&MN)1O89d5%7Q5oDHY zJ6*EAay(y@xHo}5m)M5~eOHRs*BNLnSY{YxDKq~dxg^n*Uqd9xE}%rOK31QF01#(@ zZElTUU!KAI3po=oMMvc>n_x=j{s4SUy@^@{qLuW9#5(PDD>m(1t4bWcsx-l_%K>uQ zeK|*WgXQkK0gTs)+$B^>5)y zgQXXEj=IyaKg*}X;~l|Re2-QtDlJfe@ztMT_vm~WFE`yD02bB_!3Pjjm@xPAn&OS@ z4s+scHD~V3bf)k=xadZNXJs#Znxgw^&OQNh@v&K1l zEYrwv1zC7O#pVYtoNu~RH{n)vQ`^m^Z(64I41HBof?Y+^{#EKr@QD%8p{+;?XfTPK z?xDs{Zai<3BUlyq&i(4G+?2RG0O9Qfl@dE?*j8q5_J!UcdADg_k$R|R$L-Z_^`}8=;8ckXt!sM&72jr4K5u#dvkv>rN{}*jJ7C62E6_X zx2CP{AXNAwE6G~d3L^x9U4(q8sV+--c%`s25V>gTn=`wth?$gxiGR;?UM8Ux&cAJ^kR-rkO zEv^AFQh&RG2X7La$VEY_g1+x2>&kI)6EGRD<&pw#rYcgc?>-B(h)Xw-Kso>A`+B`q zKajgPP!MZ=m&}J!#BB3UJ-4!IwX=@2^_QqgJ0xDKi}Z%}T4Lh;bVoWb1m3IqUPz^H ztAl8zo77ZQjlw-cL*f7Tks%(B)Gc=cXtmK9D)URcXxMp2=4CgUo|=B z&OLYLn>G2v%7WEhRbBnoe)hYiTaZNS1iYws{s<@sS!M|^)fPYuRe|L3J`LPUI$`hW zVscPtR1=x?;Q{rMY%<+V-dj?`)s&q4-O+b+PXxHB7xZ!V#d6EjTtc)dEEABCRBjgb z%?QxRTle}(k9>D@!aZHzhhgIQ*YiQE!zmzBA4M7FmFT;;{mAhw_4|J7GA1SG`;DE` zLhJa0p{pi>1+2i@)qL$oIu4fU%zOV$T1cP3#q^0j`vH+h$C&$y^I3hh0n`=TD5p4c zR~7NYn-O?uvbfX!%j7=Bl~PQ<-Sf` zpHM`9_Vs=FV1Iy(eCb>}QywbxQp++%Kst^3!tn>X{O|>;QE%C@0)Y;bK-l2@nX80i z((xWOO)R$$dm}~PH*p*_ZHUXWV9fnUEiWEZ49%*JE$12|+WSyOz9#i}KfNM$Frt9C zH@mAxnDnlV&qNj=iMPXG+l}A^bXivM9@z?>^||YG4u~0n&oG4!v*HK*CB*zAK7oMuW#rD%&=_P>&>!F=F4-O&v&N z;2(&Ya@=RT6p#_cgO+7K|wxn<>~`xbCsfeHUU2ZtqdbbjC4I9aGMcxvu3} z-s+wg+C&4%=%C?pSj7Rg0k28L(xt0LEi5eT=(rxj?kKf>u+M-VRA_EQUZHmg5Kav_ z`g)!H->NkxWg_M)1EbxrVRbgwvIV!mj444Pc~B8thHr2n5bU>HZ&#qU9_&~U;*m&u z>>A(o56kKdl1?~YS4`PG%-d#QfzrGHXAlpj6~Y-c5ce?i~e{;6kjQa!iM}Lp}|aMeqK5%K5M!`WS7-JPRdT z-lzCx(eMJrs&IeCW&JqII z5)PI}q}L^0*{{g-q!iMEf9xg1KVqZ3YNelFmu2{j44oeGf7neh#s0G>u7h%xUP>a& zsDS1W+2(l0ckK+Cz|#M+lkt1V8}=r82jbt0#85Vt*3=6P&~(4vWHA5RAJ&fk?dMs} zJ9}R1s~kOoO&9~*es7*P<#fp-A5|ZbYN>7+mi>qWd~+t~{!M)KVVgY?B-}Gt?G|Cf z;4Jk42l;c~jT*i3*cyzFX;R&7e7f5|nbi$zyFK6j^5Tjm0SJAvmlDqQKw`f*>f%~& z$ueG*UiNg*D_Q{!(XpKIlh)ft0wlS~%6M%jgmF%lg6GC}adFZ5qL%_v zG+Z|b0F?-h8H^3T3BI2k3sjeI?;w8vMtqKfmnlo%3;`bs>jV{vywVRlgYy;PEyDvK zylPgjxSn^DH^yI9gHlhbvEP%{qM0WdzAiuxx=^rdy=PLz4MC zUA5!)l5@g<0%#-m?n>RwXxEF?Qhx3}l8&sxaL*8Sqg)s&YX1yMTjl^X1e z646pAmgX|rI%(XwOWF=>!S{N$HTqsQH4ex&blOB%t*N7yxv%l#H+L)NnD7G*JO$Kg zUV2GlaKBvPb(W3Zq}t|F$V`_pq$8WR^)$5dpA6buLq)1 zu?Z8#;{0&sv`yR56+x2w20fT2icTihcP*S3AzfxVgU83^F?vpIxYRgWh;ok(&LPf6 z)rUGku{KTu^Zc^J=MK-@KU^UpCo2jw>R%y(HIT|3pW!pw<$om$g1UdEf z?F_5@ckB`i14)2+C{xyg1yaf>%##V`+qdloxB$u})J|iVLTFFSkFw)AHhExwZ=;6TeiB45H1})l(LeFK>36(UcAmlCl%V)(s z6D2koc5%jPzQWo`hdq~7p^A&&#nVQYpy#j!0b)JBix-&;7eI0%%qR2viW%A4BL^NTt% zyHox$DBw+0GNgp?t8pj-jPLnAsgJ($RadIfZYv&?{P!1U@wWJgPN5taN78Hk%<6YSJFK1 zLVsra#1^qM<`H8?1k7sgmUdQ{sTbD~$BOiHRQR(A;uB_=bQ7%QOwK34w(}3RKd3g= z%TJksWGp>mPQ9c(i^5>Gp~v9cyShfk5PrpUD#RnPLS~L-G*O^hfESNuTFGzUaK@Q1 zVCGn*&lc!*RhKz2gKBsh7562;+g`7elg4!|3Mli_sfxazIr9Sv^#SC6^WTxbOm0Jf zLp21O8N^@R^f_$Tx~Hp3BHRSI0eV4MnksKPH4f*`KYJ6qwnJsfkk4-0kvvbf5QY>qsl) zzW3ha3D}>o2HFqJEzA{Q|5!Vf+K!i+0LSGlidg44%n$UvWKd`*Apf>TUolePiX%#z zJvG27+fWDf$j}gx-7sR@6)W?(<_E_Ta|Jl1Ifj9DwdOR;g-|-ZJ=-sVibDiyJHVT9 zN|dbhZnG+&kZ9$#4n#OigvvnX5; z#WA6W*m2j*ECFpK!IUk<@<#gXVJSfJLkeL1{O|S+p#uEsn>;6rnDVrK|0Q0+fvU@a4-ul@_izt@lX#>B z-zE!olWZ&-UBn+aE8qzXYYT!C>rVL|3b?$DP-R1>l^UpGvo zm`<4*#IpjB6a6$#?)9HS1*_TfnEy!=uTk*(3(x|H*;wI6Y6&`zZiQhcUZo^-TdfTr9pJCx8FOpS&Z3TtBGe~yn(xQ-fOp@6m%MA5`Gq-|lS-vttw5!O zar%46+>7KlvdY5PS?C%8?Wtjei1cwc;QM=ppV=o0B&vd3sQV>f+PggR+mACdck|$; zt+z3fCx$jkL$9$C4W{0`wh6AW$e?rCH1j4BzhtHyp*9(80YY79njK`Y9Tzn-^ zMExbgI`d_yqHii&T2dqWHbeEMi>Hy)l`2^Ycx0 z*l+LN8{qh;3oN;8J!K=CDIytuN3|=)*;+FeL?Pin9Ak&J3iJ2)%k_cBXJc5(MfC8~0NN2`yuoDORvLef3GYxR_=h z{r}Yz>>A`C#FE$eckSBC6reN=)D)x?Am6FQ?>}{9_h8Br$60!8K4hHq!!H|55CJ~q zCohlEJCJP1D(L>N3{j(Rmt5ZjUZx0GojQS+l7n+0a&^O#DaN}>m{otihgEMpIp7_( zyqgHs;ArCDhrU*|?vFwMjfb~j>KA|yW{di-z@Ew#x{!as`YtEb=Po%u$$oALg~#dl zO0hSuHQ&SPSdALNKLFhpwhj&hanm3xHK;g*ZmqBMBTAyJr%Tir=^acmDi~cXE z8oaX;sx8X+g3dtpLaA1h*QyWuRESpC#5OAW>7P;)mA^1`ofpABG4=QM<7FB@MIeQz z>ofUXdD2KoGm*2iv(`+pI+Ji(B!(NJZh*d3r;EQ7UUARr&1Sy- zuk)`MLq*gOS8Z38_vjP}E5az!>@v{T72DgDd?m|z;thjRp|S(ZyDyk{CHFvMhCtJz zsgwo?-?8a;$a>i*|2z1C_oAWctU|uLm;!^TQ#{mKD_n>Dj`{#6xOx~wL#iXX%Pwe7kKXwV&~|JaQ71g z?;W`aa-I4j%Jm+Tj`Z#c6!*@$Ste6o>!NK5rZcMhe5f9EXyEWSR_>kl+q&J-jsA>>iw9XY z*?NCJS4QiqQPa3yuJWw3y%{W!Is8ot(B58d&Ju)+P8ene#Q-gQ@wUlVg~zy3FX6RC z9TTLasbAk&j5D+o5`xga_8+t#vi%u^_MxsUM2Xeb*KG2jNX2S2s1|_gZBw@p<3PaG*Z|K)>EDIOPwi935k7MDRoCC z2V#RcG}=MAa%c$q^B*dF{c|C?M55=MGWx<33bOJayt}kZa`1_U9d>RHo8nqt1ciN@ z|HG_7Qy!eRW%urqeZw-NitZ)2p8?^*H%OO6P9m%EO#qv{)Qn5tRznx<6fju|alzd> zqNl@j=8p6r3x%+|I47E0weU2^76!59kp71Kk^POxGU-5A7rZ-Pc?YAPio1+(M>NJ0 zZ^?@AVmkn3f00K$oI%KrAUhv!XYFoL@0ptqD`IKSAx}?PSZPUxK}Q`fS3>+FV^(eG z%6zaKDplzGwECG+ts|1kOb)bmrU(sN2HOppxsho|PxQs2j zOWYr-YZVnyJ9gso*WX3I5jE1{j5^ET6%~FHdUL)Nd}#?~(RBNhDf7pt{briY3C+Cz zGxWnJd+ZdiH*)b>TBjSuf`!*zZAN1qXL6p} z6lJpYeB`06fGe|L0uo@wD@1etxcm@&8PB5@oOxOmGeus`1oRxH7J80>cThXBSpcnC z(@eqTcJJzh3uPbJ2EYV`SC#bmx~QB8Q+%mP7JxgQt$&YB5L1)WTd7-1p5$2Mk30Kz z`2OZXFr`z^|Be(8)7+FnS6sd=Ku#Cv32V< z>6m`30E)&r&O-8zaLC18ZkPgep?! zLIvnAoVsowg&2owZktsOr7CB{!G{Np>I2^(`Rt+<5$g2uPt+bmC6;zIapQVsN(C#=u3G_p`A8Pc+`YYfl{l`dKz}-W44Rs&*WWqv* zTmfhEm+Q|RA@1h?h1e@=B_$-<{|Yu#XbOWdm}L#}P`1Q6#`f3^QC#guoN3RB-&R(G zt<@7Q3ugJjAZL797FC)3L0ROx$2|i=!8FzrmyQKq!JXQ%igi zaC|^kl2Gacw%y30l-8P=4GVYyFAo%4P4T;f-2gVyuDY>`xc`Vw5}>YuW-S2{$Eg=( ztWV6SxK3lj#QzdxSR= zKdN6>m4po59+Cl?@x)dGo`M)*9zKokZiM9kzWt`Xw$0ZTo#jS7P!B+64=9#VsF4&a z-cz#$)idA#KLrpzuZ+zm$16gKI{nos#2fy26t2OL`LD8+KGBmsj0K%)HjY{uQU zVCt4X!xTHDaE1l#eD7;eJJtBhl85v|QiB{Ix1~ot&J&PNO7(|u>-?0QW*-pGvrP3BHMCz)@;pAItb) zIOvpEcvmD|N_UFUEC#fCtjrmtMBB8@mFtO$!Z#A&;}=ieyx}ZqdE(^0n$@*@dT?T* z0?D*MDMgVISt4G|S3LLHhf{8)M|%lMH;`&hLm@N^t?fOlNkD3yK2f8|x`yLE`}Q|b zohlVS0;8gu6;z6jTV?n%87gqDZGfR$0I-HVC>(TdV z{e@h);!6k##H;PghC-uQoPI0gTdqYA4usWYZynC&`VcOA&Z?W;wqH!Si~)i}qtft= z$RI~t9R{dJ;$5)@Snsuq{DS!hxlyyeSYYF1?MD@0It26G9VSEs{FrV$TuGjHR(y71 zFr|Udbup}O8X(>qSbe_wEW6}QQ0Shp>10v?P!BVh0fZ=|8mi;=_!Uc2FBOH-nT5J- z*yny>mORjI{q;aeVdMRw)H#*lTO#&O5Lxe_hN==`l*^CN{eF=Aqi#KPpZT2Xo7ZJx z;(aB6B-|9N|N_{V&85Uob&B~z&GgL7-~*b~V495l@# z?hILi$Fm#_|JP^L@X9sNfo+5x@#9~h_R>@}4)jr-z)a)u{msz_-3e(W#WKH+;Ed7+ z%EwbW(xry7umm!zvorKUGPS?e!}gW%bwd6KRz=8kiEqtot2AgD=#&CknN2NwDTJNL zdIJg$u4mxG0pUh`cYuRnIhz@_DK46BI0ZUb_QiXC2qpB3%N3-#C;zYERR?^~b<&l0 z2>*?=|I)#4A29in5sIbCoxK0${ho;PEiU^Bt`1f(e&-l1Vi1v7>3}{5+tLH5Vbm57 zD}Sv-Irf@rK&zg~pPq@K#K!*IXNN<BFIoac}Rcu4o7X9*<#E1@Cud1+gG=MCRabbcVOZxO- z#DQjd|GHYQ0W%eY2Pcp%r)ty5B@1Eh#nAlCPD)OxJ*of4XOp|t^7xv)C!JJ_87*0t zB_yHhi;tRT6v0FW@cCWtNG%@2sfJ&#Ud{BGv%J?T{N<~WR@jc#v8)Mh?%3lripVDL zea7>BRkrueSVWOBFd4e>sDj!l7|2z(Ao*Ezry*vJ_(pu( z2*+X>2Zx8xv_MY6dBoZ0QB2ujVIZLT8Xo|03GG)m9Y73=i*+enoZ}*f4~zvT^*$Wp zSK&)y$TB)prvM;%=)EeE7$maorcx8}f}H;Trw@yykNshP(vrAaVunktfoVagwhClN zwNXZ#ZGKkqY3W+-J@akgr9HFz=)*JQ1k^ov%f*b~#-K2aqE&6e#5OVbbcvx^jF~8F|dq&O`_g)G8v= z++Ew3?TD21I#qdvG<+`@K^()Ng#7tco^HyF?*sF)6H$u$PE@Taumj-z*drh{!z4`- z3`zwJ<)v8=i8~?WbAx@-K~CTanx1;mvLsLbSQ9Mv2ePa%QST>*(@z=@ot1fE>sws` zYlUS!;Var?&oF#(F4bZA#Qy%dSN@@kuM(70`G*{e2g{w!R2Q5FU1O`vJ`4WHzzf_1 zwsLzZyvbt{zU_|^qxq5T2rG0T6LvYL2hBVJL8ENiHQoOR8pThJqK^5uQQ`3GFs?cvR_mPoRrmIm0 z+HwoYdH93$MERVEEETc;H5(K$g9^6u;0n0DC;TJ8)c&sk)3UCb6tL+#y%*D0@rAi8 z!KqXi-_d`DCc?ienT`HYCH*~32G8}~q2rNA^P9=hMy=+vO=NGNzx!$*O9X|Qu#kvh zN9lh=|E${W4r^&t2ea=9+yAYIoULQ6_}(|86!|MC50(G!C-W$g`%4m&(>GD~H@NGEs^V=X+mix_8)1fuVDxf`IcG+(r5;tOwlPVQvByg-i+{F zB^-`?sWHP+ZKMZRnmP?>E)bpW_XPQZl$`(S%i44S_}yC;{56v&T$i_Ln-uL0I5q|7 zV=dD4gOEqf17>_Ts3y?Hjc>3Nu7jV-sOsll`XN-DB>+ESJfKXv>1GGgRf}5cAtl}R zn;QFD^LR_>3aqFic&t7wzI&X`U_6@ViD&QnyLUW0;1gC1xe!(mw>S!X<-r`3x+cS7 z{*902x$T#YqKjj~22nQb*(>&?JF)_wPXBBTy-!%b4rNnT_tUK`R)@+qX&KyZGR8<| z*?9I3mXGA7LrH*%!nfq#Ckmwf#W75~f?qQzwlmS@lpKsZyQ1Jq&2H`6kO{d@$Df@6 zbMQ_W>#hn|$?~RLj2^hlkvMJ-To~%r!unaF?ZPx|7*y~zl!mBt2`g>x-|4GV>+%kc zry_$`e<@1r+y7D9g)yN%%tKD2XF2M3x}>KfjW+PhAjM5#7|LKEhPKpvk@KcK_J?JU zNA0KX*GL|h*sez-Hr9RdGI^ajH4Eb-IlVw{qP0Y7@%`@^Va$cvafQ*fragEu%M8yG znL_|7;+E!cD$s^FyEg`h;518ncDJ2@|A}JVra8GI0_bay2t{2#H38AB@hgf~pMFL7 z*Q{E@83%?$P}8L+i>6~e!;jtFAjot&v9F>kv57h6D+ z8qLXUyFR-S24A>(U6HAdQAIeWBOefA|EpnfC$&_QEgTAPdAxiF$2s5|p-U1y&^7)) zshi$G_LWWRFaFq7>yM$W*%6N90k@zg2)|G6%7G4$_x>qGk&Xc7Ru%y42*d$Sf2CSA z)1JIQdr(`Q@=G{3=)e7d*)1pzNV(QX#5&a!yZj%8D;bh5DDF2MM3MXeg4YRru`=X8 zP>jwr8}Jo2)gw=qUc;4L1rWjh=IPFpEZIAh_z z8tIINAtpfZJIR0_@p~B@th_w10Ajd)55Z`<8{ThZ7qk;m2 zDqjMG{!K@|G-7e@cM9hftc$4UN09I)95;B<#80H@z+{U=WM%pgh#abw;QJVS#QKW`P?s$~Z> zG9SjX>IwbVV+(#64U0BGpKz9i*7(fN2Mb2O3dqG<{aYh5aOW)d7jZ7o#XQIG92oU9nI~(x)*1Mbl<;+%1=^v+TG9}V8D6KgPk2#iTW5dW zG{Cs7zMybop0~JnzZCom$4^o+`Ef8&x17d6(0VdLHrkFRc!yLu!!az3Kc&1lF%JBc zt{aiHgo*6TN>DA!WzM|^!)ob82_xoI%93poeh?Z2g{~X_D^io-u6vDbZ1eAc`e=lY zb2mwkgcgIq=#cAJ?FYA;X8t&o!W$EGe}y^A`kN2v3~w|%bw(@=10*q$bhmVZAOix> zm1>SW-aLCW<3lBzq;{H11N`1MSom~W&@Ovk+?3dTh_ZKjnyBAFwjaSzx+1e z2ZVZF4oUV@pExa^g#vDWT>yV~j=x(Rz*S+5yF#Z!q`2B9k*-DxjU~i+rM_GPL;zia zlZmdU^M<{kYo!ys{|#Nc5^x_pxSl+ySC`X}gUV*E`p+Z%d=60Z{)l4axViAwtH6VQ z~bqjM!Yl3f_zC!veoO9GzYhr(0FU9OH0pn-Ac(Cw~_e|2w~(!~&=TECGdz8*0ncFcPl0 zjHBE4=H&@eDf-FTbzI$!$2T*Oj-Xg8aUbn@ORRw*LTvMs@9lCnMSn!>K6Yb2M9Ch5qt2(8_r zt}RBL_Y{Mv&QT6X(-4SoWziHIVA&n8T--U`-D6dMzYAS#%FH9lT&X@3=xRW~(2R$p>ZWIa-ydxN)TT3A!T44Sa^j z@mMsgK627iW2M$nD~>k)VG{fqd6pE+g0iBN#s!)VPRc+-aH3CQi2 zqq#5Pa&%*0L+B81&i{H$n%~0Ada_M$AU{~8hzxOxs>RD2Yk_icoQ1wm?;)DtFQ(!C zrfYqcgC4|R%Zx(}j05@nBM(wzKdz6hDF&=x;eF~)DAu+Q=xlngZZL{0&IeML$Z>m! zvXhO(KUm^WgV!9=Ix3A&Lxhhl-_#xY&`SsoP05?wwwbu-JZY_|-={pEdl)a@P1oF9 z9M&wym^9vY@ny6AGswl)S6lqv<4AW^^w*WgbCvz-DIZe~2p0XNxL#_Z1QgeaXh3qk zFsOj<`Dyui-hl#BnP);sc|bshdU7*8Gf{6O#8jD%M5n=&Ew6@Nn^ChcS@okTJKR}A;y}5nRA|%( zVY{MmmXX-aICe8?*m0Qdj{{I<`Agn!F9o?Ox*R@j+h!W09ukl9)@?=w(y8zgmJwOSC} zbrTb|Bi1mX_`9}0)Y{d(jNJJTEsjjIm0a!m7f$ZQozKr6E*5xrJylz`JhbEGJlz51 zRe_{R0=F?}&G??%o|Pf+^pL{<66~vb#1_m}`Jv0z2JA!l&Sh zH5*vhJN9R7Ie3pyO3Z-5(R@AZOXd@@Va|pl>PG3anB5qM9CI! za!z2aOJIbKU|_QxcYP3H*f-b*a`(%w7u*ESd#uTk%fjX|ta&oWMY~BJ&pEame3~0Z zV67V3# z(Jj?I+*HCBXxwM&a}XeWejk=$DkZLw$0MCST(2bLg#IciO>D}kt1P6EvrZ>F{+m|} z9tj}_R<#CMdNCT z!xQ<&kdeNW{fb+=<7@%5w!aLQ=1<4Lqc@?L-ot~<@;*&Gf3@)NIBnTw)+9gHGd|+W zE-Pc?yg#VO?rb|Is|g}+7LA&oYNcyp*zqc!jxX?!(UTW(x%}p_@0fta>$AnU=Tg39 z;DgU`*o+m@7*TWST`+R}uBA#nZ?neYaKyrie}C$Cbx&z?PU!wz@sT^_b!zc67hj_! z-faWC@iKiY1d&gY*|Kt@h{CZd1J`2KR;aoKz6|eIy?iOgu1#YfW5t@jlUvHKSoD_S z{+!X-1uQo13mZ@qVaCSUqV9M#l1=slSNL%%4iCz|5`Ur)#&4^WgWV-8^V;@`9fFl7 zg}$LZa~D;|$wiznW@qbwX;ztO6rikb++O~y7vjJuxhZ`wlxwH1pH#Ee?~w8M$^*I5EGQK-70L9?IdWO=94HPm=7Y`SHrxA0-H(r8%(bj}1O^!407 z9UaC`CPgRYhBpicd4$VSlivS|Lj2S-bJEQyP|-NHk(89}f__q9qE9Jo$gTO_p+%!b z$hEgLW)tSRj%m1{&FxI0VcZ&AYr=f4F)ioEPmK+0<`T|5SdTP;sZ|c15r-tO9mEZb zhv($y1moYQjiMU;1S&a0of6WjX8zl?IjZ;(eWQ_!_B8td4 zNGmEDdywFX&>WY4QPS@`+8D<%P07#rXtuCO?&2)bmwd>9v|D@IpO@6~!Mgvag|d6( zYnyT+i;5OxHTn@HXE?hq=YU3V)Xf66}Vt%9JZ~`=%DD`*Q#r zCPXX>?MGhM-N`KF*M{_ZVd`j>q)4kO)#kmDp{M2v=Q-V75|v^VhCW%N{6aMu57DEk z*XIr`8>%(a*Xm(JWlCuFXxHIT31Lb zpH34Jk=q@U>dZ1wH|+AzEZ9kmWM}5e=%WqmIR!)6j_IVk;Xd*a-$M;Cmn_O{C1EBu z&TegGmw%>FPt|cAI}lAoL9BbN?`uHwM!doJcOCfqdxE<196@rGPiApf1C`uUxYcEq zQrQofFkZ0R=tJAT*iZa$GS*iN$*V>5#kuN!DB7D($MPm9K5sd;C@NIpEFb5oDy^$y z=LiEAMFVS}tgHSkE#>w5^TVj*T(Vuc-&Q|Ml@t|KHeVN_ZqO3SbvK`ldmoy@sg$^H zp<~3n3l=I?I9X2o9&_Tb{_J+7ScujvL3S%tHct6aP~!zGYKz9pbapF`O|IotSjRHW zr-!k&H#^LgW$qyZYdT%D_7{`i^GxWhLNF6zJL&}z^ai>I{fG2tky1YVY*;Y^*Wx2- zfF#8vXq*TQe|C5tIL^P|yPuD=n1=IpZ0XNPc9F7usGx2Z9*FTDase1F)ETdHV2+Y(aM!=VupJ^N(+1!e?1lge6!AK7r~?j5#4ZJ<{`#h7|5M3&&PQtai@2F z5tUZcO5WtkN?U+m6WbqwBUG9lNdpjM|NK33Zd~wKIpbqY-x96w(YC+ozgRu98l}m* zi@({zrxN_;ZZas-uy!#zf%g?5@SIa}v0FjJJdW&_aMn7}j_xKG+>M5Fvy@pPGuS3x zLbqwPQI|Q~bH?V7WX4JH*?|~yPke(+sq=9Jjb62ZAaR-V)hJ%CdFv8}P||d7+n5+9 z#i>c7?w2}kxyB)9Ra0|eC!3D=G6_0^BLnmIx=xcFm9a{*`Dcj(P25wxNZtXuw&4so z*M9Z5$Ma%NC}u4=bm`54k8Y6ZiTLU$+(Y* z;qzzMpDI4&?ZMM1-xTUiS6_UTAr!JqfL*#HgaVzJoQs{g_l4+vbtw`+Q=D_te$JsltC zd8ax)Eki1aeG0m_=z_y4zuKo#EB|a=HZ`Simh>}7&Jfb(l0Asl|1zz-qk$sIZPG{${73}p4ZdZkTzqc8I-a96l7M(sY`g+ ztu&$^gSS={u!XkyOD5omdzo5|G{>+DPWwxyTyU-XH{ISV?>8ZOR5_}W6u$z_Kd$*E zxa}6drRfM#leTRR3&i-^K zaw|l}PQSRTt_-80#0a<8sUs+oC1#yIV^d$YuD>sE`+L}PZZ%EHlwm6=m(TQo1r3k) zhm3{eFHjBV7G&3Uy~pp!x$dYYa~B#9Rcq9VTuK|EZdJ>ZCD0~?C33}k6qfp+wnZ3;% zn2>>++oD*PuAyOo`)c#A)_MfUJ{&x6Rwx!bWlUZExW$zmM(IsC!mgwdJl+(M23to5iO0bJwe zvc#jP@eFCsG{*h-+Feqd>-_0x`O!kIS?vi6A!}Z-!a+e!PJm5kJ)(-Y2GcQB(Tyb@JIzK1s<$$Iv5>3VoGVATaN#0X+gd)^5`FeQGE$V4+nI0H`Rf7^O{I4k?&g%Er!gS@r_@mh4h27LL zl!e{L&b>3^!aOcQ1(Wl*`%S{Ml9{cTmM;jlP?l0DfFvO66qvb0zAz^8tT=Ioc zcVD=Qkc`Z9hCMAFAX|n*J-id9zNACjrwyX*9YEu@pt}_L?lgTK(}<>DUEgM13S7?>w7G~)?lz{C?!u4=p4kMVl}y^R2g_J${YQL^#ecG3pI>62YE zljJb`Nc|UcW54_fGYKTZ0I_rVMbL?YxxEG+;Q_xjzTYHqIqXaqsoGxdO?`f=0e6A4 z##8RR?0w}bDWOjp5x0?e2**B=wME@_X;PP^CSW~SP-GVClK)Y5_pNwk{Z_(f!{A*} zG4{*-5gd{IMpL7}ugW<|{Ou+iRpS7V2mXx~fM8|r;it@G9+#LwYZZAo_l4eh&93KQ6l~M(GS;^Ox}w1pM~7uvA!Z zMR@VJv4|pj&`}o)2K}tLb#`-q(K*Y}&iOa5>@y6Nz`Gp<91$lkNto~NRC0&InT0^_ z2Hai1Bc#)e{w;69(0H2%iV#44!)+zaUnJ~)<{=Z&}mIFg%@Zm%V2Sa z0hS)TW%n=sVZ4HP`!lts^bwiuiQjvb!b-%F(^<9`c4D0avj<{Cc)|P1@W&pY>KPhLXTmle?2K>lD4Ra+9l|n{2j{G6w2700&(U7tvU)Kdry;n}Hix2LD zC1ojCTN)BC+~YVNp7KO_ocnwuUN5$JA=kM*1pzwR15NwQPZE!Qt~F<{eV^Bo>dp(K zIjsdUi%<`F*VM;Hrs*c4Bt0Z^fMs&?v19z3H)c29Mx8&VC(kR54M;Gs)cF7ibl~y{ znbB)rM39QS4RrA3%y|ufjC^DB-y)xH5Y089fcN>BQbrBlOr*O4kfDOx!%6T!=LBu9 zPgg_oNMOPhgxw{+BZfP(zlaFvTb-5vSx$l=y}1%LOj zMZa6YS~g(oa`<}jX+v=O5Hb2aG!ZkROA;A?{jNN4%8o&&w!?)2T65+hbpYl7%oY!r zwZGNOznrz_6M!0c1{Y1}ca}dr&*YtRDNjTqa61E<3@mv8GE#t7NZ8eE7<733MC8UY}qL_ zOoMALn!Z@R+HrDaN%F^+cOG4Snb^)-3q}~$+?c<+Yo_;oce>9jr-|Ovj{!dYa{lvq zVtRRFH?Mq}iHVW%Z?!dr)hiQWJ{RQsQMA%LxfUOk?)AlIce&t8ORxdM|d1lBdJqH8pF__u2q! z-Nm23arS=Sw*EaeYM;Z&zOsmVxkWw$vm5{9)!WYFg*w3+^TqT6#S-B+r(aVYP>v&} z?lCLL-K?2R+Br-|>f`BH1$oPj{eFhY#8b(MS=D{-BI}_L8UEshx!<9iL!qv*@>?K8 zfy#(;bH@QAfBk#J>?-@x>1;2z@)A&jcNxcBx!b}z*`uK-{QLXsQ$`D)%ZtT&F@uBT zOB|f-s2pIS3|79LDK~_xkWS+lNZ16Of9f&lLQBsFt#G)kHw5E~}t@%PQauLWdDUloHp zlDaqtZp$`cL$(Vlsiah!sF%eX6!B%x=9Dn|kS^FzD_b+?JUJat#BjcY5 zlFB;VUwreXQ8Kf9nKpCCSUyj4eLAoEW#9z5dv-)XS3U6x1_?iaX6;ihW!lm|7u%Q$ zLotkr%Go#U$#Ae{+7Yfx6vC&3QK%cdwQEYCF=UUAwGhf$^r7KL*vLdJsZbQuuYRsI z%~{UmTR2)B!N8f+ry{A8EMKb4Y-^^E!y>S!5xo5wMadp$=f|!+fn!Ya3m9j`$naNs z+nwzJj<@EE1sI~0Qb{D2RWtNsuJ0selPtc14)r4u7_uwES~V7G%8>ruQn0G$8~lNBBAs53LcU!SPW~9fnCl^x!W7q@Eg&h$k@*s+5<}7 zH?J%O-Gs=t4NZm4sO8Yo3X5?+XQ3k+$Q{1_nwo$@Y?oo-vt`(hHXdoQlt?wbYwB|! zpU{Urau1u7l1Ek2q(+jr)m?~213D@&M9_12UW5B+U|^uKtSpWD6e#Usvw6^dBu_Ct z>}vRF;d=j$fcFl;tWa~kTwOSD{cQ+l(dVC;oo!fohCMB!IMIC}*m<#r^`=gPHQ{Ls z3rw_;J^PEHtxr*8+vw+Lp`T-1qcQ0UdvW|whdA+j-DO6`ec#G2pb(3fmx{4suE^Js zX~)bVBp7wb^u5M-Q{vIp#FQpszePXlduuzfPPc6IUZ@3hs5|g~KJ2$k?@WcckAWYF z!rW(G9|U+lHi}XuFL|~3%hy+Yc5Q&eu~Hv>>&IMJb9m#N*YhRlh9FHDjW@krT<*Ye zy8xWD;=TPsQ(Xl?+aq+qb;u?i=VuAGFy5fBwjF(7l<0lZx**x^IZIO!)Lw_3_RQ1V22Vh}*K|mWP8{ zp7@(poxXn~I~`uQouVM%AYmE~uqQgD+chwW-R;Y1$(bnB{`S|_A*`L+r>=O}(HCd#iVy;a-K-T8vZ)Jn73|MOH9LB5VFvb&u;lwnX?O|W6 z<6z8tS^cakn;+Vs&S8=X!{BaXX|rZeXGlyL z;%tdxrR{6YAUC3LlLpou7hs@!d42(lZ@KI`mY4fZ-ptNu89pL`OY|WIr|W}Wb?mH0 zW{+ekfk$%khg1B;XZ`=z-gibd@vi%#sDP-52uMeYbdcUbK&2N6NE1+y-jv=u(gdUv zs-gGZTL39iLX|E-LI)v2=n%LQ`0su8Id|`U&pP+pT{mBn1av-|e9<#%q7V^-|jdMOGd;TU**B1EP<-aCDu{3Nx`C(NW| z^4KFkk(q)IdRH+PE*RLyBaZ$~p+paT`6G`8XEh>!16F)(pKftdi}bV(zLYGdWIv?; za-Sx5UL?M9P)NFUVVvA!Vzoa%vGOrI?(&${W7;0zlFpmaj?09&=s!7Dd2gOOp|+@I zca~vJUm0^#*OomN<$Q5aeS0Q)M=YL{{ie2I4y&g5xw-?({y3}2C(x6_uYY!B`{N9k zoOC(WdKR{cmu^_ZnMeEJ9CMJ@ywlxE_80W`^kcSD@GlrCU@@cQ)u7s9I9V1gONM5> zP#|ThO7Gx}N#PX;jNKW%0fn*7&$J032xq260;;xO?mfj0_0)YUHKN(qp5 zfiPp|i#UqS+#iE#lY=(OHoa_O>cVQC$Ihv+_nF^zSqSl@MWqAlj^G( zrP>!NeLTXWk_$k&XM<%V79{3|9tjR50lW(ftC8UUgzd8dY_B{Ow520B#%MPc`1iio zY48tykNtK({u{mg5d}u&JW6z_w3B0o5$w-hq^tG&bauN+lVfiP<<^Pa-TjKm_-FwL zLT)B7y_$WDtjWylW%uz?fgBNs@dUbtT~}K3r&`=22&aK(k7-5qv*k0PetVn@liIUx zpfC@P)sOj}W@v*mr@3QsfUR$<#nk1@TGAbdgWozL?tA8Zgnv_{L-MMByQ>G?)(l>) zPtj3q6E2rCAk$)^i|7*53?tQUj2N~yj^0(#9xSd_7%iw?j5etlRJUViF_>X33HxP5 z7{YD|dZD0r6uwu~A^7{q9=a3qRilEbxp_KanaeKp&|=<4F`po+Ao;Q2fNUvwp#3@* zMwEPY2+MtK$l;J~|3oP?Saxjt_VgzGygs0>7vw%A89LUm!W|uz2JeC%kTYziWgfqQ zRW&nL)1-vykVdz*K`UlIHks@St!j7l%Tr`L8_7hSen8`GUwAJ0VM+ll-JiA|T9s35 zoO{nncIcAh)R44rij>12?-$P}FrNo|7cXLMC=mOylE`0{{whj($4N&qZV6&IYdNe!>Y_M^H?E0S7bhJINi5` z5x-wIJBsU%n8Sl{TQH(4gEl$##Cj3m{rCRpjSB&X$J;5GbFVGn`u}}bu$Ds*ryi1p9(kr-c_aX5TPZ~BZycrb>jo=sl2!%sdiFr zXNW^d2hX^+uhw!*ppGf8b?#k7Mm7z(=5yl1zCe*_F!UMe%9t{;&NB~uAAM`Y)>_fN zCm^7+Iwi$_mYvs)RhihSMw3ZzVjUifxC|dbgYovt2Vus_oZI2g7x_wGi^K3bZe=NkE3+nvgQ+kQRZbOon|hr ztWSBYjCw@fT>?(Eq#H(?>1dBF8)oc-o+a>qW1?rV7!uGmd9~qMQep;C6pA64bqAjX z)uTK!+$8P8UZ<)hJXh!%ZQ?%LxRI~4T#eS3ua6L`te7q{tZT0()3c1vO=}LbaG|D| zF$L3CY4pPcp+pinGwv6c&9XN3MvA(ZDA)N3&av$>VN7(VsKcsOmg7?3cOm*2ug<3I zj1v7^ri}A+l?=3RKhWm<_V=B5iK8Hp$0xmdjP8r4WhoC}v&a@z$@5q3OTb>)BSJh2 zxCG$+q+Uzkqva6#kii1~uBPn5Fqd=(__D9~%_|VsoE`o4)j=1GU@ctLr+a;9 z9aUpEyejA;pHUL3pF3-%wRXTnQ)z3L&&Pd~WPyuW5tch~XB#$Fn}FXVz*NSXdr8>= zoRe?=CroqP;Km6g&mc>t$DYsew`Q%@+Mk`oX#*pVXlluJ=QB5VM5lw}MGF7e?aLMK z@wnbrzT;fn^51FhO@|E&I-5@Cm%n@q#Z+wPAJ{ZkwlSRyFF$(V!~Sb@=mV*5SHb`n zfS1}M-F|%wb4kCKGtcpt_50xAWyfl3y^hh{txpH9#HYZ?_ZId%irbq!%q;L6DH_b`pJiYw4zS&8yK0Cz`EMXDWsq=eRz)_;*ULUZ z;YKBizXGtJ@D*Zo4OwBN2setZ6~vcOwC-kIwSh*DngVtGd0vGaAIIGUPBre9Dc#93 z_77lxaS6=wFWEiD6CkWq$OpJ%1kA&-^5ccoAkHg@k%C7ZsEdz-ll1#IG7gfOwX#{H zks}r%svxZMwZJpzwWXLo^f@YCOqn>DgSb$+>Y~#e%sNU7K!9CllPytGbf14hL3uZ( z?_mx1U{H;1ja_2xa4%}`KRarfZbX|0u9c|j{1bsErA{P>elc-bB3St&C=cehSod!O z0A#r2U`rimqJFn`!k}64xVz49bRlbKxch{kbMtyHC@zua~1Uhws8p)452lxOD3V5~L#)v#`Q=Z)c&Q4$3 zfJaA3znwiU|1}J4!-fVocx>H7H?3WWIC(Q!>BjiUs*b9iWcC50xCPv09@ta?V9oFI zy1A~She2f{5MyC-kptFQHpio*erv9Z7P+X5x1#4_;vW&hjTf+F3yfd^Onox3peMIP z1-zHvCK9-He3p;joQp-^T>?xjFKnQuOmP!5pWLB`3(Bk=GA73frZy(zsLu_Ag`u8| zTZd|pPNZlOg~}T|xLn*6CvXU*0Hqnp`(@*CXA@_vCle1J$SVKi57Uq^qL;q1{;D@# zVgRsr0)AX^BD1JM^>;4?XvECZ66yBKX=_aZj01oso0DZ@@oZY=4xk$@Le;+xL!2dn z1P5fV=|$z!7sq{K`eDmKL&G2XlqO#1$B;c?>Zby|>r}d2gl{Q^=Kyf-vG?jA6%dCa z(Qk3*j|tJb-V)#%RSd7AUEl}u5d#7;Z#%2DKXoyfs}n1DxSZQL&R6{75 z@a`Q6=}j7F?=fw%V1=csN8&q(q+l#}`XQl+Bq(QHUEl4rsDXR){bd)$>cqI4fHX~g zxV&sKGc~1_egs@OoFaVA90ABQ|FmE<5I)_1pq$7N)eKYbb*D5*JoH6`H=`!jeBc za>}x>Ot-HQpgxTTRU38KKL~vYC{IrW(g`aDnXWJI)sMgKupwd5|G|xd)nCd>Soc3+ zfWRD)Ph0qZ)tJlviN=iO+tPM&(g+Ug86LimUMhLevV)#f4qe$ggy+#*YA{>QT3{Stv3Hf$o~@k(~soJKV1AjS#6Yr?39T6 z)eCG*Ur3*X&Q3rmye`ktJtoX#us!{LNG7*`AEBQp-%3Q5T)_WB$ddPY7k~g{{sRF3 z%HU*~VIG@S>F`P}?)C@sb|m4JHzF-BE1iM?9~4(MFviG?!975r?Gi)%YlBKUO<~&9 z6}A+^Vyid!Lm`fTSx1y47tXHA@T6cmUf*Z@;nk7J|I2);{+H&HqP^**7o=;U%Y z(6atxO`vm*|IaMWKgdPFqx}ji$nA;d0D?C4zU%0fB6(Buo6INE6{XqekA0x{*Etqm z@p;Mpa-S0lD%Ho9!DJ$KDp(pvk?B|6i4YSx0ql&BA=4_yKfk0H5q3Z8->uyEr=Yr)wA(eI-dn0*W@pE$$i30 zQRH8EOnDxcsSzU!_2A~DVR9;g*zAs7x}0zp7X!1QGhA5VDo9|KL4%&tZ~)|{k*KV8 z@9|Y9XJWX~^*c|1^{sQmd)mEYWTG?JJj-)4Yw*=T5vC9n&q|4s^OK9S4X ze99Mkm1%1=6|FPplT{(-X64o&lwB}lL)(q%QNxCq=_<5UW(ZZ$Dt!ZiDHHx&81|p1 zpFwwuss@iDNv?!6N4ySF%$nXBUi>@lDt!qk%FMF(?UXIkgqCzEN>@liD7 zG@Z_ouQRB!LuzMlGshQ5cRfr5-_z@GJtMs=9p!eIi3S)nU&Q`}LBlt}QfYEkI~bl@ zJ9ox~o2LUg$=xe8${nZONK_Lj6L=K`fJt4gzlML6`L?z_aI;82Dixn>Fx*RK`ZCB&svvf`0?|o;aQxZL-GQ%$Zu2DgGE|d z^VeN1DJIz~EL!+(#BJ>^7@xb&)`$v7s%d1${YcS<@QDHXI)LN3A6P5wcai#hCEA_q zqi3KGby@j~#nk`LSxhvB#bnkda-DpSrjPDyl1>BN40n;&O;#6XSIH&ll8!18x)m5F` z?SrBwc*Md?4eiKV7O|~auuoG@M%rY=7SjvIe^uT}v>3BVGjT1Udbfc|S9ll>vrY8> zA81h|j=_y)>#{+C+0VHSF6|`hxtj!3)R}eX>rHz&l1HNMB#AVSJd@zwtEy`~7e_Sq zX-Ez5OGzWm4~Imbo-TNdK2Z|KdS-{1v)jAg(x@7{?+?sPz)YV`x+lI*P9>6%1u-tG zY>^I*f({%!m<``M!mC{z8UvnDl65*?41SH}isGEJE+@e;n&ve-qQ?Q zP5jMaFN%G4{Do;CNuvQS&H@8)9@VAoS#V^) z#;CBw2eCso+H&u20tN3fXAW2y8Cwch=t<%cArdpq8%jUFu#SGIza!3*p113tlZ%lS zZo>>M!*)(A<9WWZ#2RlfCYP?T7^XP~weEp*3f4crvw$cae{?G<{sIB(I^3yJ;RXcR z8hx1z0D?XJca^oMP^x@5T@B%tVBI3dqnAY{>zRk~+!Ig<< zgGtCwH<662+~Gv;KK%E`OBRq+CM_uTaNc)frW8|wR1p^|w_2C9t!j({FwFKB01KIK za0s@YYkZ+qW)Q)E7?)}Ya77lw!GPPbyU2mikIe>IESdnqMC6M6<_C_6;2xD%GsKJh zx&_(maYgef{u08u51UCYMpbi_N_l+%f4jB+*4MfbriFH9LK+3=sU{CPcnULv)~GPV z_s0RkN%Zf9J2Ai>LkhQ|hZCK%Kk=F>gu88hFsm4}_huKCUOWcu0iMI#J12|@r|Q9Z zdYwKo-S%XKg)iZM$RN^PaYWdX7H%8Y)@ZEFnv<*Xn~mmRyMe#&VPahfL<=460qH-2 zzZnlESu4Hr*)b8DzmYVTGS*z7PW5Wztzg0jpJ+3IZ0$kyskV~nw94ionFg-Hu0_0T2bB5i+OBTYb?9? zW?pKvS2XWktTm3`Hccj?hqkB~B>(2SE9Os!sG4S{5_44xJpvwwoFshBaktsQ8+{TEe9=Uh9{q%GoCqIR*UfdgZ=7N;9xK5EmTkSLr%rtzv{z~ztSto~C zTUV;!?K4xVa>*~oekbGQD7bfLKV!NJArcWv8r2+f;(WFbr2=tT+JGDmq+=I|`12)6eb zKh6s-X}vM$Y@#5k^HOp@R~if^=h%#Vv<_V6JJ)(`O@9JvL-l)GD`w3_1?d)hFBv)kS-)#!qx_UaiMl%l>Buw@eaMUd*il)^{b z4X?~*BG$%Gcl27i^8sF^2jRZN<;XJBB zI^ApT8!H9mIdT!t5co-!Bt-J4eSYQks6Ro6XXW`|*Wp^m*%~yf3Cd0F?LwTA7CzPn zAL0|B@El%gCX3P~xwzOHQ$7Cb4duG$3gk^Iz4|XmT*nf;hLPvn$ii6X8tBf%W-knS z`1&^W5e}`T$8ly9rSJp!X0{)n7-@ho1xD+C$pDa}=`R%bkwB_TtGXy+%o-9SL{T(T z%8_au!IF5Oo-MH-NH~L|{gsI7m&VY2M=E~9C-ns2vS!qos@O+M1@JYe)h7tCemf<+o2*|6Vabd(ydjs2`&|c3~7h|@DJ9YEpK;9R~-{vIA%>cSbM^ozyRe-S`ZYrL0h*8CwuJ%=F zuzwbD!_Lp}=b3No(VkiAd8&lrX;9<4{eO(Y)l?|_C5ryW8+fHr>lrHUwHV<~GMwsi z9ZLhB#@BYwUT2giG(LfUQx5c22%4QKr1{RFsdtN}hd_%)TbU@+Hpz-P?rR z-GzddOK}EmxI%_hzFdEFr#4a9Ygcw`@1VHO!q^tQ()w+GAf@>v?n2!9G>FV?v*mGd zNa8pMT7I$sS*}%NVjOPvXnKwiH=RH!QGTRUsu)q z*;r`P({=$uKP1=ZPoxuzrE|@ix9UlWnUIZ_)5dSp~Oqk+WjUE)o73 zy|H}vkDQ~|s$N4wZSG7VKXQBHw0sL6*RN{jBQEbb&N_|ny&Gq4Ze}%SHOY6+*7H;g zhee#ofALM>r!3c2Kwl4%AZzpMr0$$yU&fkWeW7yI-W14Hg-?gckszCtNL`uGdeD8n zK1EKaC5xwYl{Z(DSaGyRR`j@yW*H$fAwoXpe`sm295Y;y-pZ2b_0P$IZAJ#cf8-+d zP>(2+`-!rFXRveq5-csBAUk$KfY0w{f(<2=QHD5Etpd}|(`V<@&Go4IP+q9c|?AiNUf#~nwOQGHGB?SH#*acY&ZO*&_<2et|8q+W?pRmI8H0JkiSJOE-$kl z&Psqa6*g^uef?njyr^tKGY=u|vj&l3{B?0o;FF&~pNW3#Mt>1go9a>RUnUAsee zE#+5oK0XFjh+ASS*N~r9$pgMWU%YR_e0r-+2^N97pMXSFTT2-qE@mV)S#Uw58nzN z3YOg=VGkXMf3qlDD{S+#(ZklsmLuWIA@Awzyc zDU%*hgFDPz@1^{_U(|fsZ0LH3XyOwURYW$U1?HeGszKv-D8G=t=&dzN#%~1iPjjRa z-qP`*g@)I_&mc<6I_32%aa|RrlJ4&kgiRg~Z1-4s?*|k+iO)Xr2|2DozMmcOQPkr; zH=l%q^ESHpfe${OW3GwDi@)ufZPHHW@<3%JC{eF6&X@%V&iFi6h`9?p`=y}j(IZMi zUZdPATkbk(5<~E^(*p>pzbGvdcfPBe{YuL->ho$r^V@>;6IRUvX;fk|Yh$Z!&cKJh zr6eHqUF6oMm8W09f!26!DPpXx%M9{<17~IXu4kBHoa7XCZHn_f3fFk{S-)RkBIJBq z=R?0#9B<)NdYQ$&T$Zga#|CjNFA=Jwa|WkVL6co+Ch&xpTtl3|TH7^?;?3_GbpxbT z<~UGiQDfzbQQeiKc`-XM)TUk6Fz7^F%<#GFZ-Lt5U!X3#RBw_%Lo}_!#ewd`B#%|A z;i-yg-D*^cDeTY+X=Xcne{1XbjBu{_z#A=@-_Xy^^sz8i@`osJ*M1(bsl#mjMC4aD zZ^uF;uOUG`$6%7l**#mZNsAKF{nxS`;0n|+rz0#3BX7CZ-5*}{C#(jVkD=ECyF6|*5dZ<&mzx&-f!jy6+jXYP$DW0;y z0LWxn2vazAxu#*_#W1Z}1**QZJe08IZLjsb=4T12=_Gw__WPn(Uj7bPAMeH7hHEd= z7T(~ugDOxqqD&|RDIEF*U=C?U@yT!{#Mc9|+!l9@)Z~d=lDirA@@>4h)27hE6RECPN;E23wfsySL=7zk ziy9F|uux9KLEXOH%P&9hAh8j{X?YU0wHD}8`vE;OiinFZDHpn{>jbJgilsU;MSI0K ztv~{S?FnKcpMIh(Ft2(|Y@P0-Z z=atmGOqcDS5a2ExBjZI{^r5cfJ~)F6dLdX?*m3gDr8IVIxr#Vyhzpl`^g5fK$mflA z_X8dfB`kJgLARJ7DlM~`t=p>Rkn+beO)PnD;# zvK_e1YEiD*@B&|K?1S^z9P0@pXZi)<=@<{hwP*Md$PT^9XqzevylL5bH@McHTB~sD zo;}dJrDs-&_?1I3)o!%$MAtrMvMq`?5-AqWYWK(T@Tw|_A$Q-W!eFO>G%my1{BowQ z<{FJv!MDXbh^|m&pjzr8$E^-_z53qkq|QJa*cHzu0%6K-D3sK` zy5QtBmVAxw8OpjPG)#(odIGOSwTc5$+`v`kG3jM5o>i2JPHZ9oZKaxsPW*1NXbJZ; ztejY(t>g{C@oswI89>nO9!#<`l^smMY z-gg%#C~j7dV9@&FyCF|XRvwh6ZE>Gj70=msuatZm>z$AGhu0#{SJ>heuxk#Vp6VP|H$8144a)XR)kG1{NGRE%M?5fUQQ6!G z!JUmBx$`X4g>Nf*Met4L>e|6B#ABi#6w5jIre=QemeFoUp2s1w0Nbno>qGTl>z$c8 z`bb$lt2#SUygXxhSKXiseCGxgK6qCn@75=Sz1Eg#RmCWhlI2FGCP^@Ieg2MiB*VF! zSC2IVvN~GhTm&}%3a44oa>b;tx~^$Q;Dd$ew}AO1B|Uz&w*%XB9i08`X5up=m7jfY zrJYm;n~&Sf4iwUOZ~0p~8|c{GjZY+iub4Dx9sbJqc)xdGS10#frvV=QfhBLd*pw9_v>3zuH$1poj5 literal 0 HcmV?d00001 diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index a31b464390..f3ee9ec120 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -19,7 +19,12 @@ Per-user services are services that are created when a user signs into Windows o > [!NOTE] > Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. -You can't prevent per-user services from being created, but you can configure the template service to create them in a stopped and disabled state. You do this by setting the template service's **Startup Type** to **Disabled**. +There are two ways to control the creation of per-user services: + +- Set the template service's **Startup Type** to **Disabled** to create them in a stopped and disabled state. +- Create a new entry named **Start** under the service configuration in the registry as a DWORD (32-bit) value set to 4. This creates the per-user service in a stopped and disabled state. Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can create a new entry named **UserServiceFlags** under the same service configuration in the registry as a DWORD (32-bit) value set to 0 to prevent the per-user service from being created, as shown in the following example: + + ![Create per-user services in disabled state](media/user-service-flag.png) > [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. From 2db24561a2dc1cf21aa5438c71d9b909f361943e Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Sep 2017 14:59:37 -0700 Subject: [PATCH 59/76] added user-service-flags --- .../per-user-services-in-windows.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index f3ee9ec120..eaee98039e 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -19,12 +19,7 @@ Per-user services are services that are created when a user signs into Windows o > [!NOTE] > Per-user services are only in available in Windows Server if you have installed the Desktop Experience. If you are running a Server Core or Nano Server installation, you won't see these services. -There are two ways to control the creation of per-user services: - -- Set the template service's **Startup Type** to **Disabled** to create them in a stopped and disabled state. -- Create a new entry named **Start** under the service configuration in the registry as a DWORD (32-bit) value set to 4. This creates the per-user service in a stopped and disabled state. Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can create a new entry named **UserServiceFlags** under the same service configuration in the registry as a DWORD (32-bit) value set to 0 to prevent the per-user service from being created, as shown in the following example: - - ![Create per-user services in disabled state](media/user-service-flag.png) +You can set the template service's **Startup Type** to **Disabled** to create per-user services in a stopped and disabled state. > [!IMPORTANT] > If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. @@ -136,13 +131,18 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t RE ### Managing Template Services with regedit.exe -If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the Template Services change the Startup Type for each service to 4 (disabled), as shown in the following example: +If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled), as shown in the following example: ![Using Regedit to change servive Starup Type](media/regedit-change-service-startup-type.png) > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. +Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by creating a new entry named **UserServiceFlags** under the same service configuration in the registry as a DWORD (32-bit) value set to 0, as shown in the following example: + +![Create per-user services in disabled state](media/user-service-flag.png) + + ### Manage template services by modifying the Windows image If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. From 719f36b9a7dee07d77ae783954664b7724eb9248 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Sep 2017 09:42:11 -0700 Subject: [PATCH 60/76] copyedits --- .../per-user-services-in-windows.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index eaee98039e..fadfcdb39f 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -22,14 +22,14 @@ Per-user services are services that are created when a user signs into Windows o You can set the template service's **Startup Type** to **Disabled** to create per-user services in a stopped and disabled state. > [!IMPORTANT] -> If you change the template service's Startup Type, make sure you carefully test that change prior to rolling it out in your production environment. +> Carefully test any changes to the template service's Startup Type before deploying to a production environment. Use the following information to understand per-user services, change the template service Startup Type, and manage per-user services through Group Policy and security templates. For more information about disabling system services for Windows Server, see [Guidance on disabling system services on Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server). ## Per-user services -Windows 10 and Windows Server 2016 (with the Desktop Experience) have the following per-user services. The template services are located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. +Windows 10 and Windows Server (with the Desktop Experience) have the following per-user services. The template services are located in the registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Before you disable any of these services, review the **Description** column in this table to understand the implications, including dependent apps that will no longer work correctly. @@ -131,18 +131,17 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t RE ### Managing Template Services with regedit.exe -If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled), as shown in the following example: +If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled): ![Using Regedit to change servive Starup Type](media/regedit-change-service-startup-type.png) > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. -Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by creating a new entry named **UserServiceFlags** under the same service configuration in the registry as a DWORD (32-bit) value set to 0, as shown in the following example: +Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: ![Create per-user services in disabled state](media/user-service-flag.png) - ### Manage template services by modifying the Windows image If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. From d72f07b9461112474ddc1089b1bcd00f78314444 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Sep 2017 09:44:44 -0700 Subject: [PATCH 61/76] removed userserviceflag info --- .../application-management/per-user-services-in-windows.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index fadfcdb39f..8def5b6bb7 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -138,10 +138,6 @@ If you cannot use Group Policy preferences to manage the per-user services, you > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. -Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: - -![Create per-user services in disabled state](media/user-service-flag.png) - ### Manage template services by modifying the Windows image If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. From 26ef02168746f926e84dfafc91c46ac8203f5734 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 13 Sep 2017 09:55:04 -0700 Subject: [PATCH 62/76] adding UserServiceFlag --- .../media/user-service-flag.png | Bin 0 -> 66480 bytes .../per-user-services-in-windows.md | 4 ++++ 2 files changed, 4 insertions(+) create mode 100644 windows/application-management/media/user-service-flag.png diff --git a/windows/application-management/media/user-service-flag.png b/windows/application-management/media/user-service-flag.png new file mode 100644 index 0000000000000000000000000000000000000000..56e03d1bc557ac17f2fa990fcf58dbacc25cf291 GIT binary patch literal 66480 zcmb5V1ymeSyDf;jyK91LaCdhI?he7dad!(4B)B9%a7mEHwQ&g^+#$F-Oq1mP@4k66 z>&~pzy^8LpPMtckzy0m~RkW(I3@Q>45(ESUs+_E(Is^pNDfkVG00;i&``zFK_yFmq zE+Y<6HAb=z{s3bwrX&UdQJaYTXbKDdjOZ+@>jnXV*8Td1#HEuDf`EAWDkmxS9$<9% zg#L+G`}1zRNOD{BE{N5$vmRUU4cwwStK%>vLr3=WRR)*JgM@=?d}qQOGoVeCOU z8zzNw{nRSw%Yj#(uao97gJx=3+05_2aZtOVX5;S_V3|l``^~qK<9LXmekd^vm_ILt zpweutzkkBi!mu%&W=cl@LMRZxFEh&x8N?!It+VpnoSzGu7}bxx*F=(3YIU91|4u-% zD8az-)hiKPI(Hyt-I4vTA0&xukezwN(Dv@S+l;3vCZ^Ut!M7h(EE$PH<^E|pgu;L= zjMKQTu*yyEBo1eT43Vk)7U}^zn&4d?jNre%eaG$rI)dn{aK&58zZ-Uvmn#qR{q0$Z z4$@x8qLZrWuxD3-PnOIeFW-z67k9b6wF&NCrA>Lz%S}-tVer38rNJ23`-ahc!nNdsl?o0cuDf8(~U+`DsdB)te?Jx|GNvk@1o?+oL|-c}L1!oEF? z6d6hP4mfNaX@A1QKN=T)K=Ip?AWz%23NEoE@NRfs_DQB2p3}x&>(50e46Z*YvNFk+ z1v$HJJQ%cYzE5;3hJtR@G>Zt1F~E(G##B$j!6A0_HagX}T2fB?O1(|>I<+A>!ubPN zNXQYJRi96-GEcwdJ;JCD;s`#B)Sq%=9}z_6177x3^1^ez<(#JEJyN$`&FZrW2n^4; z#0k1cqmRy;FYbtk&R!D(XWfPclwB6G-r)Q`xA;`AI)uWuPn@iSM)N~%pl{0+JEk-j zTmG{yf!weS57YJsZNfj7r-*9!`3r)@`RBYMcHwrL&-t6fUv0>_zQ^9pP;2`oxgjEt zp(0_l0go_#w-V$LGv(S6)5qdPyS7_)tHIGmBMpcE7^xOAsHEd?rfHMRUgp0`rWPZg zAB}1YGdJSNbUl>(7DDi>H<2<`zH2<-ngg)2U$VaXm=y^9a+~-vuxzck>a}E~I1=RY zAuO6<_sZKC>UlldIT|*gfFKJG8GB7_+ZqaezEQ^n<-!aWmg@ZLaWl<@jUlJ~Oa%KPoj-O2zTB*=^hVf?1)VhR8#~dbIM|GEg;e4pGb#M-+{Z>nzfxC{9eKO;?3ngO`!Wa`;cnzS!OdiV;TA* zLdrHu$97#$pf#S))l;u4TSg_+^ZQ_R;XjBF6@<|ClOKaw)TIg@*HRaMPetU3)9x>(mo&g_QrP?YabaZgy8)Rs7~rV=DjNCyM5KwU zYjP|A=bG+(@?EvwK@Zjv{PP^X?!|^K$K&j;o$a9f8UCab{A21`7Fp3jnms}SWEJ-*|foq}iMM(Huf7&#}cF@QVwBFYtrr$R}^iTwwRwWVSb z9G=K`BOK$WiQ0Ye<>VWV98T?bG>={6kC1|QTPZbeyUHx59-Eg2h{w?6F9=J3McQ}> z;ti$YE-_?Y(ROkX5~UtlQv8k9@NQ_HqI$r}@|UQCNMUPj+(!t_;@Dkmwt)v{MG2?b zYshb;?xu2|@;?z=?j@*S1%uGFYF*aq4U{Y~I_hbrq?%Sc+=nUuVoJdt|1dKX&E-2& zo@5*Em#5Vif3n0hPnOXX-o~ zn+2Ur&{@vt38wug7ey^8pf=lt@4aaM;)RxAX`Y8z0(o^IBPz>gE6c3fNYMjIm4saz z*(#F6=X$~=1LJEUtOK(z@3JF5)Dd^jKah&y%BmNB;-7yTkE=D|2MK;<`%PztQ zWdJWIx9##)rc<%cQW7Mfpt! zm0oE5Cr0*?ATTcFOkTK-r~D`4!ARmC9bueUkzKcDU(i7Q3q%-{8RWyhcK-4`u3ifwkIh}YGIgG9BcJ8 z05U60)Q0&)NsHSj$cP=LsOhHzDwLa)NJ-s8Yn=X!sP8Eem|8&<$3{PY-t@;3TwcB{ z;ARepT^F7TyEu`-&rYs-{(M{g7P6m4(kMQfJ?NM>4?XdMPd;(Lb4h{&G&$FW+2qa?QhMv3{ME9(0Q$~?N^^IPZe57AdVu|e^O zq#biq!`28U@1Ly(ZWufMB75P5$<2xMNB^#J!*2NN;2RvHc-zu%-3%HZ&PmY|fPwU6 zE+T_aB%ds!x8XiVWgD9b`IiC%Rb-C40OfC8$p{dVWP=XH#ZVzneFR^=wS?O!@veMm#qi{tSe51jBIiLtR( zUpt3G%obO?s`v+YYi~2)$#0oHX{vE~X&h`oEZdl%&@f;hI*~Wo=|-+rmpJ5`SlLcB z3Bq1Um$&Xf023`l)4rmGe~GhJ$`1`EYLw=Qkx)H2z})yz$x90Tc#6B4cIhUzjESGw zIY-4kw#D>kY4uWlZG#e?g+-+M(dAGK+m!c#EaEGIB;~I|@hQiNcsPo@!J@$>-Amwe zK$2&LG5$!CLFm~!{Y~qRygyRepyL`VQcZ#Cb}h*nw<$pc2#c-sMu&RX5inN+*QuI; z?xAl0{R;HDcH&+#nLK{Rv6?+OawN3(ynn_&s!u74`P7zRJ)qZRAK2BMtyCF941?Sa z8+ufd9j-3jdnJ*#&u>bJ+NS%t9hJryr(I4(8|!9uT#5sG(nrsrD)qzjl6v|?sPQ!?7|lVAE$;|%Ky}}n zH^sgB!3ZyKo#Re4e*v9$g50Qw(4CzkDpd*=j!I&}(0DK4@h_t4g?js|9wNy!<3x)fgh`){417C}!xLeJ>wxS!a#R@&nQS)enBt27cY zkqHb5qeO>tZ7oHMUAiktuoTM=i|Cz{4=%#DKd?x|`s;t}nA`T^jG=Eh*=fzbDc{s` zY;^s0##^1I-B`EKsD0hnEh;tI6S3VC>!6pbpU!EOO(-d>Y`H<${74q;T_H3yu6uZM zX2w8Hrm&sq#+&|(;HfnF8O-1lZsZA;hFGd)sOcV%+g`Nhs)!pdwutYD^;R_Abw@Xl z9Y}Ti8Kl67jS#OuH-V%Osdyiz_yuJq-&s`!8=}I1gQ>DMk^eHjuafHL_?_7z%1qtIO4QM_ z^^~wL=47}8W7^xTA#(wX0Xe1%@6;h$Oht@Y=HSwpp;c#xHBTaJ8{&7HJrp>o(to_O zNPSY-F?*M|V<)?|tK)01=pfSW*0tWAlYSnK>&0y__Eq3_K&YXH8%M@?;6RadMdQ;9VV=T#4ga}vO`1b$Jjj#>sbM}AmJ=q-NxASQ3WLe&{@FCB-T(N%x3nHSX1gt$Hhzr z0rZ{#0{jC+Kh4hdd$~6x=cREH^uu95gK3x5lScz<|IkB0blCb0ek0;5`cj$}N*4Th zSMMDCMozcR@mkOJ2K)#A)`4LjkQ?D%rk=&^H%9Yju>mcRNrL8J2*#IZy=$f_ccUSr60gLT3%QrNA}M_3**;TAHSI!rbR8M2 zImykM5Cz8OUGxogdbq2^z1^12>G7~lyxGZ4PLz;-nh3Sk&ImZeZX%4$Tn|WJ<^41G{@a~ z6fjDmYD+?^C6P!6L(U$;3Jd3l*j7X>@80lj#a35FQRX6T8-()j5fIWYhJ46h6=Cj8 z-`fwTm8ZpMENHc+IGjz$_C)=T=%)UDo6!INRr(7Kme zp;l|!Iiwx#kYX+Fzy@-yEh?U4w3Jpv7+j~qW>5`cTj3y?b5jfd2F$(^G)BQun1EN5 ziH+pY&&=8$xz02kHU2sipr5)p*KA88q;7?7(`Yxi@5g6I45&o(db>1x{?S#ak<3=m zr8$B(AmPXGkLB}QpMn*EYs(W~7Lggo&8vsy{dUWdAGv2OdBt_U+vS^{EI9$bOQs!S zRrDer^KTT<>h9my#%cHG{CN7iz&!O`QZToEtK*DpOn3#8#bxN83vZeD}9N)mZ~Xx!5fk(aCq||{AfijU4O|9 zwoPivy<;)MPH59hM9K1INV{*{z~|W$9O&pfJP4l0em3EJz$K{WBY;zl)2e5)xtViY zlzHWpaibx_&P*+zg>zNrC2Nrcc-r$I8CZ64hI2Us8NF69>&ZZ92M|FhcBc}2TSAt8 zOZ%3br{1Iuyr3%YrnIgj9azB^l1MwO3wPk`(m5?cp?MQB;QJ?)7|MasbzPWS`CL%!Y+Ht3|j1uow8%xl*8uj36~N2M%`r*mk86k zU(@z=w7u?|Rf$nIJl^4;4Z+*QUW9{Kbc29;E*Ftq27TDa>0CDNDwvd0eP0*CO}6P> zVxiQxAH(qp+rLcEJui~Qjh`9b=>O>L{&FT2YtCG2v{;$o6y!Ui-03^^8E@OpPN-;& z$GFjrFa5q4)jP&XF2WSRv~CZZidt0Ms&`18mSy3gkM$wu4xsE|DbQ7?J=zcRXO24* zfMfa9QD2{@ZCzBpk$at6V<)1jbRI-t7o&)ccgW;y11g)hRWKw$r=A6-;+lau#ri7L zPY^$zTXc(L|myUQT_IBXzpMfIl2TRRnAvR!0<{1hd0I(KWe z%0S9MXual?v1$$fqqz%yJLsQ<7JZwIWne@{E{;3eSW;=SJdrT{>Fh@mm}u@`($OH4 zSUo2+8xwRx0t#3)oA#ULKzpcN<1n6c+rM5kygoR{L~<5n7oq8uk6zh%=Qi)X{k&>r zM8%lyPryRd&D`(mKU!O5PhN3od7*b?EhFkr#`(fRBdOvh^^G1Nku=SYU0KOs@ z^mt!FfjNIK1lq;HDno%B@6i6wV3kDGbUqY`4excU1_uvdxX{ z_NjMp@BK3JW7>8TpTicz=q)r!8@$p~n{~FjVASqpCAiHxVjL!E?2Ui%+?n@)7NMR>dTrsHwAqZjd?%#0EHvC))k>1OUG z6Y6=TgMKaSRUfrjIwN;XatrA(7NXe&^VO)--owT8wHKaS>n&(-VqTkZ*PR}d0QKw^ zn46*i=B>T*P#_~64Dwrn<0gqQW)!#O7x5BW1T$MU4i1hI(F%j-ySx|OG0b61{tii- zm4Gaj0jQ2B@29(iK5xvIzV{+3LxRd$PqQ>S>9p8@_ zO;+TscAG|k1D;(AhQB$onJyOQ(*#pgkci)HO}0M44)7%*HII1yY`lW4e)Ch-ii1Xb zuF_wM9%YHHyCyNgjx6|cAk#X2KXJml;Sd&hOCgRFgWAl1kP4Y3tQi)OyDKVHHQjal z@$R29koyr<7{+u8{&@_7=Z11ciiD++3NakmKdi*#nFg{zGZSP% z9Mpr$4*?+IIw4tGQPV_@;bFJp|6c(l7-*)#p18`;Twm6$O8pGM(ski zg#*wlR&s1`C@q`jP=eS>ks0s6X??$SK8)r7i29?t((V}v3eEY%iIuX`5b*`q#RtzW z%BbylmX)U{fafCTI*zqixhOYL@LsTtWmp)9wqV{yB1epg0E8}S>Hh)s8%O3V#|eRdmn^>*dzTOd&%CEeSH{K$u{njtD-IRBq* z(u~k3gsD=vAC`-#aw`Yqd9nwyo%1K<5yzD^ZdML zga$7k3dMUHP9mM&&G_MPALO&D(e^>>AB_Q{X>A|zoM!W*cCl4wpXQ0DR5fO$-n}hV zp7BPikh~8YauOqw9zq;IUt}N{Z$&h-EQq-hFQC}nQRxlDT3&3|3A)hH1aA>Z)A2bU z$XA(W5>fp9o<%Ua*!(5khQ>D>1J4CZgWfzoH|eUg{M79n=5Yf6npUL|G>1q>Ik2gp+S=-JS44T*Vnm8{6W0A!wkg*OMc$TfYu|k(@AU_aRNWO6x&Z0XZ;5`pRFu{N1m}^xku@_3a z&T`3Qrn^Yv_`ssHi1}tk0bnt=6R0TK65{oKXoOkdAMRtF-X#S*3Sb0fMCPd#uBH-Bj`%4Fb=-RL@J_rS z8TZD56IzDrYIvU1d2gPy2C?XRsq?Ag;o1?a+?nu$s>tx~+ej)HD@V3^%*bZVa%quR zCmB2nmHKc4Un3}X(uKSv)jxTM z*5{bjqo}XpttEqh`dNF`67X~{x{=d!p#8W>xw7!d$x0EdnAl4;bXq6kuHTIq_539J zHkY5N2*H1DYfZb>qDe*?HIT;Z-lOK)tRrc^(n4N{?vMC-?#oCNzP!7a10JAZily!$v_nKKf16_Q|-s$#b$Sv4Q0SQIfYL+DLQE>D84<7M8e z1ML&TEW5G;&t6vuCu5d}(;vDeqR7|cF}Kaf9U9v&eJQpD%b3qdig}hC8y(pn4khaX z%U2<_-;(bvg3;o1WMpKZ*||c$5iR1FvD@0IL#iL4{qcu68^BAM1#>tl@Od{dV)bcx zHC3Ujb0wUt-33n`xYm;!uH_Hepj2d6#PB;h+>B*6U1xu!PI|d49P?EiXN1H$mDK4* z5`1i+^cZG(Ji_*#ddY!#EDVJa#3Z9!8-y2zLC*POOEV1wtZDa=hdqH@$H=R(U~26t zkRPdbu6C=PJk!}9ZAQGaEAA_mYFN&2+Z8c-H-ebJEf0vdv=&?_gheu)7VN*jQ_HXR z9}m#+^&qckxu?MshSWB4qekYbIduW-O5;^6z@PkT!e6;Zy`m8Pt88NB8`+3Y)SkOR z3p{s`S#AAK0T`FyqhVO|M1}=XwF`;<7 z$)TED)Z>CIK%U8m+~z4pb`acdfm&Sa^6}UbHC*sA@_ddGfeN8SB@Yb;56JQ=V|I(- z-D1EfC2n}#952_H_C%Oak$E(;o>i$lO@Yll`UQBQZge=fKQet6Sf)qmG7Q(dDUGsb ztow;-t@?cM$H#HLflN^ds6n>>x; zHO6IJ-kP8?Y=k4DA~W~4a6i!G&8*yW>0gWMjH}6lE)eMs0uI5#I{g9FXRP<(_f~HT zR7(A<%QW(xY^6MYM2k6MJ*^_E4u6cIjk*(`CVXz%h+(|NLB;xe3B3RBVbnCBx6GE> zqDq>-CsZN z>KY)J8GZ~(-r(L$C)k1m7Xy?UN)!qxlYx~*P7DUAuPsAxigB8hwwXJKAv&VhM~k4I zD#I3wxYYV^97%M+q2Hg8EQ-!ib5Op8jCXA^=(hX2TVsx0@H12Rt;%U7a?%P1Q2g#7 z8Agn}NSa|Zt@c2vbRkGiDy^;B_DGd$}r4Ke{lw7pIS#UwS8q)LYXdn?0 zDo5dU*K8A~MD|1I{vvah;K*U)4L%%m+9cgb;{PVwAT6=c)&FttDvT;aBn{|D?pDcx z??{#Q340i^j+4*6A+)_8C}}Z~_Zp4v1-mI(2jC=_XKdvWl6roU`Ao;!Wcj=2kzR8@ zO!!I(IgoHHO_;{qQ?wvK$f%azx&dYJ_}5Rpnu3f&J}7vd9JYr|68o5e+nV{_$6R$% z$AG=5gpGi^qU^+TNZy~+y+1^CLE>`ls(o(2`UA0fRTnlmpc1wn14Hs zv8i(-r|Vz?ZzD&AT`vz9LY`8#EcENujH~?U{nb=uGZ{Vx@V4?tdl%=mA0jx_zw~vu zm>&m-s`i>^CvfGCbGsb-qKj`8ALK}Rg)PrbNy!F0QA%+FYoQzZ^c`^$2Ji+}>rwx( z1heqET{vC{uF||K-mzc0x97}!^W4E6P2TEL#>`^Xjj|CejjRw zZXt3i-dDe?o$M@!s36Gc8T%tS+J%*w_rJY7yL)vo2ak0^VuZg*j(#>)?8jj)56-|~ z%Mrhqn)A-xh>^LoDa+(o&uDNc9txdfOriVo3`SW|>7Np36tM*uFzFj`6zZ1N1TJV2 z@)qWV`7OD7h&AG$Nh`ZF*XYh>r4eHCIu5F+l=oquCUIDIH}5jxC%ll7C>=*0G&V8X z95DrCxf5R=Ct(JdpoT7%dEdUDTvpn*cR@&4@mZ=l$3B8sR#NLI@^cbpw>)@+gjfAk zR8XW49U#Kj!PltY?J%5RC|f>o6uT4k8xJ2(!KW=dqyNwo*le)DqdR5ty^V?GuD69! zH*2RO@T~+Gz{2D@{2x49#_Qiht*-k;Liv&ir8FFTQbR&wO1*awpPev0Kw zcf*jYH(v>QLU&kSENj0+;Ql4-hTmDx@*>-haa4e&AuWS(uFvuHBJ$PA4K2iPzKjBF z_P2Pmpwf#kqaU_=9Et0NBkp}OYF5H4yBCcY^e4kQgxWj+sJH=y*0a3o7x#;KPEt*e zl^KUBJAQaEC@k@jKRS;8fNxEO{>#p_f`U!(&lq>f!?lfWg|nU^jD&B{PtWhjyA*cW z1mW<XHrO7KtD3` z`U^eLAEKHLDt}gcrMEwVJPN4|Yq(~*{VjBw1n{J+ z?1uT?F2RJX&{L~I3 zn(^^RN^gLnwkgIr1922bmm(TRKg^^jvAx;dyb@#mpwBubc zOI+LQ>Gs&SKjZiq3H5lB4X76%p|$1JDRnvEMeEj?^52}?4!a=^zA+$0l52Mn6?dl; z(%$0nDw-JY1MZt{HZuJtj!8uZPgBjrJ~%Wkv5^HphNj|aIUK)B2|bRcUIH@qu20TV zso&9I5kst2#sHR#sl2h2=e{DyWedVhb;lXu`UkkF#icMYvMs#5W8p_cmTeDj1k z;DtJ0adm8y+GCabOE&{hiX_m`cX!uu!h(uM+G2hzgp7&Csh?pk_48}q$#sT}#2`-{1r>fA;6j{61SjIPru|I=UfzES`y*4BG>bo36tGI*;Gfead$ zuS?8@CV^C-U!ra0w@?Fo5_8Q7O)-AEmyt9@%(#a;LW9zHCOONHk?nT@^NlMW$Ia=! zt=yIZ2=954_|7sF74}J%%}J%rTxjR8A8>$Qkws%wr1l~_D+~r6myfk-r(3g?jQX1>=iy^dpxW zOyn&zMJN<1w1(?+tr-s64O$_O zJO<jWLCNADG`spKe!^hIX~Mxek6-mz!U>e|WgNJRfG|*>Jz~7#J9c+CHKHwtR8? z9Nyti)dA?M^~6JJ5r$4O7oiccH}eiYW^L@i0&b-bA1M=8HM4Z==HN_g!W01qYkErxs9W8tx+ z3yT!69FTWau*%4muQk?szy?;#?#o$M;K8QJ8w4|>`348#>gvm&VSe63s^?&MvNhAu zOfJ`WM4$n$e;iP!lZ77N?Jf;v-tfyg_7 zuz|E^91*&lu#c2Caz-D1o*>mOQCO6l=Lb-4CcbfR@w+D#R{2*)#rn!WCobuFS&do| zSle%@1fOp=gCzy=_n3QqO|Fh5r!e{vfCFHadq{_`m;EEQ^Y7|?+{ZrUzE)_|Y z*k$>3;p_;5{v*{^kZDCV%S{n_r6PtThH{=TDIL>y_HeL_iva&RL^S@KM5s&~Y6GqX zE8?wo^-kxyN0r9)maHSDF|{W%b;qD%zAzW8dqt_^Acb6#x0Q1rhy5U8D)@L|#V`sw zec+ycJ%z;+^K=(0Wy$t}B}yi-S5cy7|7<;`P56J%vP=V<87ejyOd~a}hf*k_l&OfG z{xSLk4y->U8~MLT_NHufI*Z{(+HIwN8~h92xS7*g!ddzX0Jmz%nb{!IJGU>~q^gJh zq04T-lEjpSZ~TEa3O8gD!R!B-w=4SKoa}Ljrg?!6%At7PD)Z2dsQ?hYaE5ked$vjs z``r4cr!}rER}|M2OIf;yl0+Ruv*(3ICvx-_&!c2^tjJ*h%k^7)9HXi?IK=XX+Jh0S zC7BIM(D-MV_C>e;D#Y*Hde$E;uK1_yNTG+*<0Rufz|tD;iPrni+Lu8WCPvoC^ik($ zB06x&yVCJ)I)RTtx@cUdZUYVEQ7C{s?8u8qOZAJNp^HvB*-^?A72M1vyzl^POyLGQ zo_hjz!97w_j0?oq8RQf~I{3p{EB}kNf`jJ{`=v7zJXrl%R;M+vIRuM8<-8T(HI|Fk z$aA9t7Oi@hczrM6<4j~4dpFx6`on+N%?)ue2;{4RSUxNW@##l6csc0$QAHs(+3b8* zAA>s#w25WKOceLDPK3jDg(zCshnY_F)hcZ7#I&cit_{dKQTzDmLPHor#%CHXsxBcs zxkBa6>DUM3dTy0_R>@ujb!9ADzyvhihPOUy3iZ(5QszoY!i#~=3g6O>COPs>Wrt^& zdC5f}koPv@c@ba&f}?_8^ZknZZVf+h3@DV2nTHxoVNyg1T}!<$X=Irh_*!wgtP4-n9mFq^fNa2f8tumQ8ux(yUc!7An)j(9An*jvGw2R`c zPZ;$^-W-#@`dsLF4BYw$ZA0F^p0r-Xax_JFb2!i3Cf1ll^`Ocss`-g|dN5k6Y&Ip< z&J=1QLvqxkNeroXtmP)E}N*m=VE%3 zvBirqeB7}gOdAucLk>pH3{bRn=h*cmjgB{)2b$bjEf$*h8Z)l?+L@1Q_N-EV%Gj0E z8t)+e0cjzlFTo}%o7!U{NY$;U{@hQHt$xSkYugthA?ahL02G#N0Z9BY;V$=<{*t7b zlaGjCxc-a~e$`D|y*+i~zpE>JC650XY+~k_e;`oI*bmc*k4ou*bskvRwQAOWMb&AT zhiBFxmD!@aO0h8vpYJo5jxs4Yks2zg+oTmIO%_&^shc=P(@2P?lS+q8S8{Og$>J^Z zQ`JYmX~|@{;{Ky=>c#sT9#gHXu;06mp+)FfEK(qHVWh_8l+cV1Nz!NSjBw~H?pj-Y zQ1~gi52wfiV=j{rQNoXi8BZ=~+=P++1|{5R)0kGOKt0}$pv!5 ztg1WIb0;l=txeqB;Iu;7(T{9rKO@b;*km6-wJNZc#AISr!f8E_YBTE957Wkc<@@+C1lgA%z`CQ2>Cq}nw3 zUbXQ0jJe6k_=x^n+xl#N;LJmA_Dsp5FL?l_@TShS)f~;$1MHN)q>#~)wqL{HBJ7U2 z7l-LhAJog*)#O9QS_`d{Lj@BI+HNBCa`@UaJpUWs{#J>4VLXA}&*v>#Cyrzmn zfW+)$E@@e;@&6ncw461Q$qP%%SANRxUOK5IRGT!e! zHKh*>)^AV)JxlwUclXL%%AE4dAf1$25@6H7xx}|LyvILkwyl$hH~Q^a#7Q@GYLD~D z=Z7pJMhL@+obO~1_N9tl4WheLDAyNW4Yz~?5|Ga=mFwT#O?DaRtv#9m%A(pBql^Lx z1mOWJO^chwAx`ci2Mx9(1P$Y0TS9MT%DF~$Q_F|sTifhh5z3|P2=1Th-!~3?_PL#L zdsx#JS%l{x2mqoR`Fd6(j30(;=N+%Fr>k6bDjum=f{jqEcm1JUCa03XI~2RRHExuAa-yd)Ucv$!T00grEps&mI%ABEbqQo zLUX>BnXEKB>*hFePr^9l;ThCG!zfV5^X||)oDa`vEi2l=%YSGQH-d}zxLpM5t_shP z1K5?|^_=VQ@nBF4te|8OGul5rH0Fj0IPuxLD@3Q=|E}a29ftqnxQkvL{BZm;u2EDW zg~0u7*~gQ)r@l$z2-0DD)|B3^=xv&UF-ecgLCNt`qN2V8@RX+(Zn#bbMb|RCY3ZY_ ztj!e;sx>7bQ^>&cB6|4B{3nZH5D|Vq*KRFR(FR1HHT1_u&I@9!ZcYj(*16?v1?$vv zhoN2$OUO=7#X{&%U_FzCS9Ph@90Vwx3k6!ttNB$FNz^#_%svvRUdtCP6Jl5YbRjN^ z9VD&s|IIhx?M2Q9ba+Z zkt>P!rX}xvA3yff*RWr=`CudutAIMI+OB72W|IW{vCuB}ENEpF&)oSgCEd=#5p`aw zhwXDIqWZc=M&h!OK|qfKlf8B-zw2v#i@3F6V*$8OuidR=j<4#`Di8m+gl1p~{5&6Q zU3q(FZvgGR7`S|2Cz$OBKe~zv*^hwVDtI?gKh`T7f6+%R7_zNzB=kO&uSz3*myoD7 zo?<7*o*Vhw`xs<5ls#bNFhO-SF)1nP95QNcYiC5d!{scWm%{=Jp4$R~nHWYt=J_8R zHh9%_ZAZAbC8}pzYoMxVzTuHMW5alk-KLj2WRC!>Y;VHB3$4|mjTJ=&t_8ybbn30* z4J0afCp6{m^3&kI-ekgBvZu#W;9B!X?y7FLD2 z0aKD9`}ipTriGYp!y{HOg0H7fD|N{ltkCZezBXawgR_CpY7~ZV?1xDf_;?mnUA~Y4 z3Ei421W^tD(uYE~|1*8?uS-kz&rclhl<^>jBCx#E zk?}C6YWv%QDgW!Ry;>!O%YTfLpE5<0om6Cf4EVqQH^si2L=3g%6N5^j=&YQ$>3f#) zBH$gt*HITv-q!~B$M&a6pu@wfV!`@Gl=EN9r6>xN*w4~(_>N^`Jlll`W=WcHSU^9w z`IMwWuMN&BAb?f>y8AIob86|{+ktjoBdA>j?{&;Gv}+Q?Iy^;8H~ZsjY^P}crUppU zfnWkCHGgU20t(h*F$DH9pXoO`rrKq%6M?H3K(`7`tw`FAO?WJ$g5w*%6hEr{djDqz zc{eI^M5>xLkc6c|VWPqHF;QP(|D;0yn*nV1nHH#egK@&!7kLdffZ=@r53~bx4h)=T z#9~Y^{lu)1svY~#f~A7z1JoALuZz;`^)AJxHbXgT0M^cY;B@MOUiv^o`*c%{gj9`1 zuco@58RW`l8wHVgBsf*uX=vk2?3WykD zVwRnr$N1Y6G0atS+>`eNrhI7woynL542g`bhAIro#QT-+uLYBRN+Yzn-L%MX9@6QTy z1^V`aHw=$R1;!=AZ9)R4fc_sS6*rZm09FbkLQ>mZ&%x z*#u|dJ=$}@9IN;xpkb^c%a$Z0q$?s~$Db8H+Y$@6da+oe1(o(xV;eXWQ8$2p?naBtS-E}9ePHX0nZyfR%Gi8n+a=AYr^Y zE|jD*qq~Mo(wAvYlC53Yyp!PQX*PEyhMTf#w*{m|J3E&73ww|-$@!&QTulP;amZkU z(ZJEI5cl^+3alr5@OthMPtT)3=tku1u^~zr5gdjEvi!u1n^N0VYkd$8P^}7>Sm9L7 z`cA~%QRW!~g4aiagFBt!F2*13R)4$8xFZ~fj1I2V`QoKE%%MKT&a|yQOws5@3~;2^ zAZ(03SPwc(ZnT7lVMu^J(Oox>vA|VeorJ3ig`fN^Q8e!q7y2%vRJ<@YXX{doZu-(O z9ZV*iP&OVjtx&&-y?=bFD6q1#fhUuk3>fEM_C*2tu$9~?t#HD4dW+^|PiNAum=4;?;3-*{LE#qEfsm(U8_Uim^) zYhVhOs~;n)7KHBgyv|K@PLQ_Q-&8 zsrsz};jcd0-;&}t^ohp(?N$b3)0ZaB_%GotvKRC&{OM$&bll6s$~UI#>aTr z>rObmp4YzPM|#)5yyaQGIn3t-OtM6nI3+qB$tf2d7|8LR=!UB+S>CmUyTGVwFW-U z+qY^9`Wa50x$53*Gv+LTes&%3v^=taE-=;zPA|pT5S1*rN8;R+z9V`X!9hq%ZyXY2 zIg-V1Kqy|u)wqR&R(75#zoC3FxnFy8srZE=A%G{YV!3V5mF0|xAkrwnu*Q3NM$*x| zIsIrZcB%Lq83E*?hh@juw58=r0JDHWeg6~5jn15Vwf>o~G*jieV~?{C8nV~Oanz_d zXI%`_sp;PP`&)%MiNkK;sJ15b29w)e|C+m(1;*}|Hhk_U4RrLAhYp`LFXKmz&oQt1 z{4cYWo1>Df5Dmfp{erhku+)&ZaK>wFs#%BLA8_t-m>UXgJKdGWu(amc$x}nuyt_d= zY?Tec>kpIgD-xtX(Y@(9ODW$+HFV3+Xfq#yAIV7XrP~9r>H+oB*j#vFLJe>P0=|DU z=Syb^rMquW*GHKrfa#b!H?Z-J`#F&{&{Om5OPbgtPR_A@BP)DLx%d9=thefau3LES z`|9=%7hF?8{C?9k1RwVfsHfMm1ot6j?cg^*HUigsvI2PX^33YGr+cSJQh;ML_Ash= zNDILrf{d#B+5}0Af)b+v_zu_+RS9McNu#c*d?dSkY5Z%@`F@aVKlFBZ+p5(TQcRt*d2xd~D)Ix!q#2`RMu5_N87S}DxXlcOo?QboA)I3kJ zQl))s{@gj4_h09l06kB<-uQg@nPOKvX}*MLXh95BpVELuXpYi5uOJ-q32u&YtyIpa=8pM zKl%AASf&%Z@Za-q*%=e>&oB1P&OeEOivdFdmI;R)Vvq5UoIYhfZ@x48+S3d8aG$?1 zyfP9(%0cr)HHiRL;W4=V*QBu=k0n}Tc?}$4V?0rFoAbMF+aO-9RANt62%g$W{5HGQ zF~7^*wsA?2&g;nX9a<*^qb7@(&b<*R0T|_Z*AYL@C2sMX zNu`WhfuH(!F-?FxU^eIn_%GL*7g72aP^RI}n9i!xmce`(brSCE$>g%zA~M@fiolGO&897oWqMb`Lp-Y^af5xI+eI6@o>6d3O@6Bi zR>)J=|9cT@{*Uq>0BZr0spfpWtnJ6dnA4M0(qQ!3(>`*<8=P#=>4}0ex$%JeSIFI? z33dBkm0{WFx?_nGvLHFnP(QosWHLj^>!C*2IHeaC46{6PtHu4Aqm$~c!23k-b3$z1 zs^cl)p+M%r^+xVg!p+I$QlytFYWZKqu2d@>i}fguAo=G2e^Ro*gsJBj2UfeN?ez<^ z{do7NZ35tyN(Jvv*{ZT#SR- zB`NsZ)p+CoqU^1M;%c;Q-z0c&_r??4g1bWk1QOgmKyY_=?T`d_2ol`gJ-EBOyX##| zzP-;r=e~FEdsS5N54CD_vt-UW#`sOG)Z4Ap52DA%L3g^bnRE!4MORSsVT|}oy>0DY z7(PSoxz;1PeM1@@<*%hxjvS^V5hlUwWS0ypn>I}0G)>nvC?2Dob;eCF))mmlZa*y+z2x_>e?A~s zHXwr2H6DSNKA;LDrk3oGZaB z(uvv|ZtIJAS|It8{YIy#^~n~ioqoaVCzIC1fp%PAR}kVcJ`GmwU1S{g-cQ?=?zo|; z6NC3}Wa6b7*B0=-t=PSO#@~WrOy-&Bdw)E^nGspre1$3;obN60Y%uH2>UY%a3vpgw zQ3ujgodgte#w%3?g{DWfUT>zGyF0Fb?8lXK;ozRcZ9%O`K<$>kJH4(4@(d7dXjPH| z(cPpiTM`{CkQ1xrh>v?>JeU+^#%E&WV%+x*H^omWf2!pc@v02+p~e|%EVh6D^3WZk zajjLg-qyd+_G58gl@#a73sb=E>rQsKmK%Ul2>e%y#7hU|u#uC7;mGv5zmeTC ztGk*ZV$V&Jz^udem83p02F`4p2yiO?&kpWH5X0fL+}VG+kJ{+EG#U)f9=5Ve^%2#oxF7eX&c1Aud(I!NldL=w_vBFjQjzJ zxprq2dO^>hiNDUv9ds*$OQ3mW_;UHIEhsU_Pv+<0fY92a-?#5E>%2d~s>qKA!q;*n zjy7b`;X*uNO7ibBRnrhjRL&fcNIU5bgm^wQ~%AJ zYViPyyYb4)NcTa){zr@58vUZp?PzWHa^3*R#@JKN-X|P6G&?_7+pnm}pdQn&Uwh96 zwAVIKPfhRBx315lBta_*>-RTjh?bfV9)!AIa^^qHqK|g7XQNkNJ&Kir3oykv9SElZ zbXUP=|JNbJ|Ml^#Mc~%@J_&-W`HAPkEd7f62$)Ibi|7D;NE`ggIAYt=OzLh0eez}B_;kJbREET<{ z9uEjh$&MzA0w=y=i1GUavj@iwgcZJMgHELpH|`<4o7`1Vey3jfBkDz)7X(IH+$=Cf zN0ZifNJ46s`4jbe2?vxhiEN{1Etf+<*Eu%VbHRAb)B@}#{F8nPXw~oouaN+|R&p^D z6w-SiFhzjKjO!uspb_(Ce)_%xLr|;sN5O7tR9e$os%w7R=BrR1$U& zeFko$V{%WG^?JdSdI#rxa}Qq5vcm)UA#Qza2`HCiUMM=*+0S$8@dvab#dElan9|f! z@3i1`&IA=-n zNoW?z3A4{22T~B5)odhie0fC$agRz^TD*ixQ0YY|-BTJO&rv1JmPN zrF)_&*P1q)cIv>0`?9HM!*SR>d=yTtanut=(CQoNJzv@_GG>RZkNdLUm?_Ein1aIb zqt`^|*3iKdTI#O3=P^FT$K`pEprXllc;?`|o%}=y`ZgS^%sU2E6ZOO;QC@mX=OSqlT zQrMBFO1TNYsL(#l&i%^9(fv;ECy7@>QMcPk6Z6#Cr>!j^?e<%C{&{xOMM0t*yWfjr zti3fcuDWfuItKY7@4vYX?5TfIJ;lAjGjh;;>zUJ-^xSNDdVjiDES<7) z*aoRj8#p37a%zIqfEgDvz5NX^VoE{}#8b+xex+rij!e7t9sv3vT6X{m; zgVh$Sx2$BNsc_Up6}hDPgX4OyJ8JXfUY=hBzau>QcuI5mW-^+&a6C^M^R=oyuBiak z$F0#dZL_*!7XJEFdna7aOt*!%o`9v{K)vh!q%f*Kb%LTY+_SN+(2h1|$-uvx;-vv* zFY<^z5zb?r7HsTU;j>d)%M+O6NXB_~_i9U4w()ja-J+m;^gh|-vHCu2;nj+F6lh3e z@X!<84pPrN6(;Iy)vbE1@R7-8*tIj@m;UdzsqMh}j{t)L##s3CMteha*RJ2JKNy2KeR-{UTQDoS zs`TCRSUuBTtI_P^d!j$z#Vt_>I~SVyY_aGYNr%gpP|(}(pdfnmFJgUyFK*=hV=Q>5 z#$CmN`_w;l`E`~Kwd7b9C(?AbZ%KD$kDh3vBK8A)xXEllaoO=wh0eW!dNw({ ze(5oQks6>Oy?T^Qrva@cT?{0s5uXcEY^`Zq6qA>0duHnY;%Y9jUWhSF%5; zRBBB=9v)hBl*E&2ryUmkY;ii@8MYOCG@3k5D{?MWtJX{LN@Eu8@OHR5>n-+>1iM!$ zLvIXyi1jiamR-=Nbhz_VNy2|zp=qa{@~JYf&Qx{Pe%g}V-zvM&#ymclKQx=V>!?cJ zDsxEALPEKTE$?Nq)|jdggdyqf>F@4vCF-|j>|jZpSX{mN0ZbW*=>${AAK~2Mq7*b8 z4?+Nh%qu!S=2pZ9hsydVHg)?MKg6$rYK32$LM>%lRFz6&c5+E3Pb{42-~NlBl#M9- zj-@9egZ)!!h1>d0qAD(>YGl}uMOVD4~zK9i=hBKH~=S688wFR|W;mhc-BQ&AggvQpSNFTWs-ZUx41>JSn zGW6XeTSZHt2Yx66ov3ep2s5Cxxs986ZclgkTYjLr!}BP4o=9C#EE;PFc-}y%Hql}T zpSX3P(uz3P`MU(}93qSbERfLE-v|u*9`Be(S#2-X1+&bAWjaKt%#zx#ljoLGc&FRLi7Qs^V_TLHq(C*B@I)^xv39ru(=m%Lo+NH-B)e;u8y!t6!iW6)S-gh7tZ}jIygZ#QnKeQ zl=Z^3bXfJ15iYgKk=vDb+KErd8l?PE{{Y^<1#0 zhq{I*M^^LY*fo8`MXBGD9`<%$kse@V!<`ZikM@` z8GgZFxk4>N2C>Q9g$$ZBs{PimLjt^BN^PNyEuq@T&vMx!7Dr&xu~G>UZ~fnU?T*uM z*{q7CErL3@PpcaC&SY^aaF)&T%pH)%!G*D}L!ecgF(hf%OdN!n$Pyn^8J-YRT)%eg-nZ?anP`<#v9}3X zE~0b2uL%E1z1JZsTBDD*b5i+pRbs>g&0~F>F?ae>lpT2Oyq4X6r@|C=6WaT?PmNaT zaQz=WYI0P+>C?55D?94LKMiW2wL|HeGd-5GU!ID~FxNh&j)L!Ea6wDWZgbD+Q7VCd z6sT6lUmp;_=9kmpG$&hKuuf3z>y+R|(97}87 z`4msDSmI12VNv;2$m?&3Vo!oHLz8RALoou8op1u1-E^4r-J46Ri?|h`3h^g;I3-8Q z-G94PRql>Xcy~VHORBIF%e(F}*zLI~_9xOB62#2(AdedY{Q3h-L7{QM;kF+Ih_F>2 zf_lN;OgEwt zbdnw(x%FriKrXnwLJm5!-_4n1cp`QF8Q?`3MBeC>RQSV+N7G9I{W{I5h99wUEn|OG zlwwyS0ix~AlR}~%kS4acfaxDSj+6=%N4_B*tl3p5;*ul_Cebh;8phn~NKSurP30A#(RE@W z4bTCzN^xRvjNXHVYCF>iA`ljzVm=kwGc~c}d9S!*=iTDop71H=y95^>r##b;M4p2f z&u#6%+<&&UGPo-`IP;ynT{^C7N;S6amDZ-4E;!Zjt*8X?@MCZ?>xaDh$^{0}10ES4 zrtr^)dbm7f0xZc9dW=tT&`pLTo6?lp&KC%>k*1m7^Xzw9JT={3D%CgH{t<*PG7=7Y zOMGq`o9S4$|86qcJCAjhxbB9s9#!4LW)DW{4Whi0hlW^gl7I(~yy|vc+<%!T|C?e6 zL`MHAhT`evUoSS?>$rrS@K&V3$`hX3P-Am3g=V{$(IKN)mvZ3`m9M33yZ*dN6o3!- z6~+r+1T}(d|I6z&hEL&=#dbZrBK|P3#Q9VHk>q}t(Nl`Y-Kxgx{T$_oxN+crT=SDk z09o{w)yZSj16u1c9^_Luf@%fLn)Wjp9%hned+PA5`FssJhsCTIIgs7cNAT5wx0$GR z?pzv$12Z_1;Y&5VV|=89+T+YP|DLfR+^}|@We09mN))8cuE#mkrGPFii;ItsvRhHD zwj@ScQ1KsH^aNxz_Zzcr-Q&X~P1g8?1mD9$%i8e-APxl$=~cz=MF^E4s2@3KDD|ByGQzwE839kHlub15`X?XuQwJ%c*gY}jAZ zRMk4RcAL5TiE`PIWodZcKarF=_SoPV%YMKr%KeeSD`&1snradDC{k7M1jY2Y?(9SJ z=fC$*HzG5dj8voT<0t2hfTQvq)a4DkC!pheLT|7~X*aN5nMbIxzC_5LV;6`h@C=fX zLW5pOg_te5qlx8n*QkdwKB*)G;SfhwC4_gSJA!AN-S1SPA0MxYpwGXfuh@z2D200& z{AyxXa3fOaauqr$id<J4ReW+H0MPLDNwR=Y^VII>L~d z1W-#`dHs6zWE+I^XYH7m2EAzZhWg6Ei!*Qm+!na7v^AFh9kuT#q-mC)=i{vk7}|?* z0tU&%dkslDY=2`+Qa_CuBK)NGQF^jWU*rfmN9gH!L;YIucAb1_GD;!5SQUag{o@u7 z^TbkWG8-9Dz!5o-8mnbr5XY^nEwarz$oxr^sz?2j#BZM36U_?6)427_X{NUyu%t#atGKRr_dTi5bBRV)A0;!fVKrLv{Ncn9_Yr!|MhWGxI$p%K}%}?=v55 zqz`+S2Q$fNAz$LH%NS#49&45OG1#@;2#YwYDmKceD|ao1>m`ev(v-9V+77zv6jzdh zb)tPJX5aU8XQJ^Ro1A$z_SPs0r?2spRf(bGPSTCbI~!J)%pVWB)e%6YxBIIe9q#!0 zljZF(E6EDsP8~7cZQaxcpDQ;@GxV{xolg3;*3Ty=EQ?+fTG1U_NaVp|cU$Z+y3jW{ z(|z?DI^gPItLj?&0GX8mdf8NJGsyE|Uf_CS=&}_lF!j(6sK@Bq-np$zt`&S6Enrwy1(O1sO9M$C(puV<YGW1|+kJwqpW=b+ zw}Hl!ktQv5CK>q3_X|Fquv(7iw<54~>#}E;d*gsHKN`#Shi#}TmeRp>cR8f``GA-%pQX7F3Y3!`lsn-HcGIUqP8_0n3V)*yzTDuXD zgJ_@4ztdfq;4D2xs5wml2pv8F;C5clGV1{W=c%s7<4LQ*KZ+1*Z%vw!aJN7);!RG| zgMdJ%kpm%SCmblCSnv1JOAjE<=F*`#IhYaru5fo7<*Zgiu5G6-WjcXFogdk9?bF?# zz2OBf$}d;*FW}N(FUl>+`K0h;UyqW^k3@)FV5?{vVzpxS$(A`78OcPF_6X171(NWE zUWno1&Yf7U?CMsh<=s{5Z*D!*C&`a7I*l^>8W5h^a45SM1uZG12pgZ#9xZ2C% z5858r#1^`TT7;RziI1_57v*fI6oEu`n0#Nbef}zH+rU`fT||U^$X(jr+!iK5e`c`>Jc7s|@>x@X}_4PsyuBUEKuZk9^Im+^+c zwE7}@=|3UDayl3-r=>Kvt>q!RPm#YQ6E49dDl&CAEqhMf(MIuTeXYN2l4{C%c_opl zvya{N4B)`h$gI;r&1+SbF7$2Ah|UZ&jbqMPzvYCL>dXrjOL|v(i?wj@1k+&L$i(k8 zuSniJ{8q?WUhNF?kC2(+bw54EZZ?8CrFz!G>K|$I4Ih2#@JJ8DeW_S0ZF&q(cn8UwW{S(Q6r3`$PoV)l!TN5y0*>^<`8h%1*#$LgR@mC|Qf46TFwFV5%R@<@I0qKSR_AsGN3DdNai))~xMq$FdRV463W zza5e#@qe{W7CCn=C+tgq3|(r-<#B7DRx;d$1yo+-M2Mpi>mQ)N2LOk_H^ix{Gu04~ zD}GLYuHXfvmL~f{mYT0;lAZRkqRrhzyR_d)d1Q0yqr|Ekl&vo9wY?r3ocBw+m!DM% zMTkmq?-!{0*L}!0yf;;hO1a40AiKe^X!B3NLeUpb|Jg>@c^m#W5+4SGeoQw4_n*bv z3H9Z_Asfo9KorCMIJ*vg-{uzLn*+D}J2gc1H#IbZK>~mItrJ~Y$7SWt{1(djW?rzR zZ_5jsDY^X^Pm{~(6=RZz?~da?nN=R2hx_k$NWulso=;y+N^j+w=`5W+W(Kz;mQeZm z`Af{E81X4aXun15Lfr;`qfPojmpDQYM20OZTI;pR>1>2ZCW98FJEgYlG&k1iab#m<>^ykUuR;r!ZKF=y4r zP9l^E0jv`2D59+7XR$Wq3u?~mWZ6LI!FRyz%I|V`soljv#r$C6WCIvxs&Q7IPce3-ZhpHv_+z`s_Zpp%u0G@X%9{ho_&&hW#tB4%}N^B$0 z-Up#dQ!WRhU!}c8ZY~FPDPdpkH;%$J)CFBW&+3{wKyJs6(Ikb2W=rKHliCY#dqqtl z0dg(TQ}aD-$n@?+i-0xW?6S3<<1nDwbL}t{!Wd{(tR#6{cLD961viBY<6aHGpP1q1 zyG2S>C(N+UUtTnS#X0cdLddCW{&Pwz468%p-Z-4PEzaTG-p$Qf7{5oZliWV8wk6g*-sgm3Y(Q|-&a zb=Xu)?u}O0Yg|7-Hf|R~EfUbYZkj(e#PTA$twiYf%!rV1S-`L8HIDE5~NfX~SFs`TG0(TOm2$Lxg zI1W@TGz@47{j!|Pq2hH)Jf9b7V!S6mmcmAe98Y0=T2Ug9ekTJYAoMT~8OvZU7oe@T zJeIchYHErXVXxNbJ}EH5&OejU{O$=3iX_*TcwcF*$Cx3q zPtDDRzjf+PR0bcciGQ`_)qZ z=3t|jkUIV!7G8M}ed1ZR{#~0+p}&n*{)bxZvt&VGG(_aO9-)bDh& zVr;hgJsPiZExD&?t(UZvau;hmb9MBcl!fnZpP04Gd7xiE(B@k;BcyI_sA4g)0jXk~ zui0KTgbepn9zM!vzs|caUrC-@-lkQ)YIku2o!PAMbmEGK+m%;K| zwF>-{oIfE@MuoCqJ#L-I(!%!VRg!`~KL;rE4+XO)(O7z}z0{UZ6O#;Bx7~1iubKeo zM%nz2oXDCy#>c1BuyzNQ7{c=vS~7vqzHa`ym*y~6nO78PBQVfz1%HIzcfqG#z8b%< z>k%b>{Re~DV%EQTse*4sq~MLV{iVaLZB>s+yUok}Flg z(ni?t+k5QMfe?RS0Eg@HC$7iiPt!JI0xJTU?WYH|GzgL;o{IZxA*|;0eHFuYeO!G< zT^a$>D4Pbthxsw+hdh7ldn(<|a|tIBeKNrLTcEzG8*S$+H|NfeE9Xibv$Z$e#UVs@wuOP7t4)f_30HW}c zot*BH!;hq(3gaku(Wd0>KGPy`!|$N9xm@=NqiUBR`v#H~zWmXb-veGzo*D>@s!gq= z5#cY;|6uUrzzEW(MN#nk;MK_$*DB9B&Oq`7y<=4W|2^VA5IP_7`Te}%!^4AnXn15~ zFSk#frJiNg_y1K2vO6R_Z8ji5B&t{uthLeg!{C!((l2dbDd z!Dl#)&JWzL4L0{a5o+J$NS;sS81=+hGlKyXQ2;m0N5iq?32|(`2UV^YIDaX7`QxHS&<7fBgF0;PIL}uSOFQDxI0`G`aQ{Z<-y-MP|{1P-- zphhu;Mh9jKx6TYD@U_>HLKDk*rV>F$)u{b_jP>DR*YAu6d)Pt$d!^2#S%+grC~zu? zOJskrI=2ib!$UA?5bmS8chiVTBczH05e)C+dt#)FkVkX$DL6s%aEly>^ocQ z|EIz|kM^+mlQ(+#bUxIb}?BuK{p@~Q+!+J%)ZW$6k@9CCDA2Oz< zqNC~yef0LIOF-3gMw*a?n9iU}+tRg7cwT_!m>Y*R@882tT8T+w(aaJ92i4)Z!qcq0 z$<(jwo79?hZ*%(<@7u~zx2B8AzSj7`iVeEdf5)DQ4S;^d*gamapnBCT!(v041w0cm zDxe|-x;3cAf1rGGii-g03BU!-a?`fEj1gxOFQ;LipU?{X!|vgnn_XdYSkA*Ia#*Na z$4WpB!G%b^tdfCx56pj8>h_Axm=^IxzPW`tm8Qss@3@ZwE1>EoOTN(<`CS>V1^45^ zA>d~fQ6P}h3oriCw&}!n4~0eeZy|rIMju^NNDR0a&eV0|{{J>f<x6gP?8 z3r{H)fX5O>(_=Xr+8nOgxpJ0wS&x$J!GO?cJD$fe&!u+&xTsh3l$V&$X)g9y?SPEiM9K9z^3sXSzYky8udsFaC(kNy$+4=hFNu? z^vlsWXG3jZ(+#g%uZ;9rV*I_QAa2s5G*Gi1VBj)6x^gA`o4jj!Y}o~KZhN^3T{;~t zevn0bD6^JNKb3*G3)D&qoBQ=SzLRj-%$&QS5a!=K_!*$RR~^@Aa$00xu(a9IN5A}2 z07AK3%Iwac;svg%zrYxEo6Aj9yw*s|5XpSL%WstsxYn1_Qb@C)J$Osz4Fo2Uwi+w0 z%dq!9Qm7Pk&^tw)3OcKR6uSaj|^O~;)BzGnZ% zeR28_I=wabg-oOUQ;kuQFvj;v8N||@m>i@K_jwKbH7kxTkY4&C@|gLVs^#ZRGAQ1_ z=`D4aPv>d!J}adHxo2h3F9X+4+6~~0_HOL2En4LXr4BmwZjt;NlRP6o5xAC9$-}x> zVV>Fa?+yd>tL|6h=WCswL-xhtTT^a=O9aoYQuHIh77WtiuSWH}DEDCYTLEbOmBv@0 z$Nk#Q7ds%3=Zzw2|M;UK#L+=TLF7m38)OQZeaeVW4aD-@AYpy(9`*;_H$ALWJuzDb-tCS)TUM`OCtw4M zm#W~89XzW1HVrz8$1drvT}Y8l8>hK8Ba#T0L!`Z9-ph}gi*1CKv z{S{2>4R&D8357@!~(C>nkS+zT74Up=i)=?AA%K?e#h2 zm}fX683$cbD*2_XqP4wZ26qpM$TaAa#lR`96wJJi(fcCGFX z8a4|s+|2dv)(rkm5&)xXlgL`R?RV=%5x?Wpp3&YrS{~QS`zqyzq8u$lhY=PLpL#e^ zq0;oHjYZb&hLGMpIUqCP@^eT4x@`Ti63!zbqRxotiQ#{9{pehO{e9gkUKE zvpd5J?ab&8V9}T?`!@0BOXs~0yh)UzFmF)b2Go6g6rX*JRc|Z>Tt^ix-vUaZyfK|2 z2(DLOX-)ofn9ygnx7DJmo_tmsd~%tw!da$*AGB?oW6F4=9sc-iN%GaZ^z=gYl@=Oo zMHLs~Rv4D0P26zQ#Qoem;p^#nqj}2Oa&dV+$<;*S(Hz4%UMccfHb499U9sPd_ZMzx z*d%3L!5C!MSu*7XR{$sY0WOwh@{D1^jnc^;o0!UI&9O;#w zL&z;+tmg*{l*%it<7q|pRf=V8byx!}pWck29{{j`KcdIDZr2&sK_S5hH#`ULE!nqr zSRts}1v(AYF%|*GDURz!Ozuyx9eRR;)4fG84(};E!ilw{6a{TM$<^2&76MS6XSz*h z8C_Utq42W>F_cN1A}c{BV>} z{K+;;`V*tG%a-Eucv|E9X-cqxX>M2y{U1pzcM1jv*1=I8l=T8OSHL-P!8{w!r%C(Ija7RjYFpT2>Y)E!dxIchW0LgWLZ(`kr! z%&h@7yjGTXO?}(M#y7bFm#Yjd@=nBWq7kFrfu5-J{5pIERoUuuQ81Eg-kJAtI(!S3wU z`o`H0j}4*?>#^cFLLUm&ce|^@zQKC_wzptz>HD($d9bYx|o#TU-FoMJ`K3*rT>EF=13GFJ| zX-*+au7rs{HSJj5sr_CK%9!R2sFo1%dG!rERLP0v9}=3LP(cqYBnh1a#ss#4+rC&T zuDPOQJDbf#TVan~mWsNhktCb5_bE!W;$c*F`US7wTNZW0!VoMa3pQyHEff0E>;>i1 z7Bxo@^FKzkGGkV(CPHCXoKMD27jsu`I*S&ME4NzI3K%_haZ8?PeOGoWb||XglEBCT zs~vRf34_(LGUf%b@tFQpe~8xWd0S#bKAHQhlgbtcJK~-Ueii1h5I^h2+N4YOCQ+|A zGeGtwo$Xp*rzGNa3=eW$=yuz3EZ?%Uj9B;!FcTIzVj%-i(H$?jzN0$`H&-oLr?)y# zjEN5)hT}VkE8e`AKnFj}JLg+>o5pvSiGCr(ZQ zwc0S_4tzqEac{xrd>{DH&kDZl7NxiA{h4GUOYBlttKD~M;rIM}yQ=I2-|Sw{oJu;8q;MWhDq4BF{M$_yc*~N%X47JUa~#*1qbDU7W)#~f z&Yo@dA}c(e36WMctgOp=>w4cenO>V%R>(g0p_} z#@sCOY6d^>dj$OxefQw^@JNlTgP*y-Fvgv*U#`I zT0IjDtMXVDLF;h;{v3^ZiMh+C+vxWXD}WuCSx|x(V>vZ-gF9a|39~b}lUKA)WdEQK zS{jxZeh_;?`+){%MfW`n^rZ$8Kw!{B#kKl(0H6TG{x>Jh!{`h5cbJhJo&`WCqM_7c zjzhb6`+tfa2`)msh(S&XZL|*;bHLgwG(;H!iE*A}IMn7-@jtfL$Ol5_s%;B$IF(*c z`ue7zcaSHy*3LpUPr+krGkr~%Q+V@vSHAT|pxMf3{~7&YSRVJO*0eDH<_Z+9FDVWz z)=8Z>sJ#LGnaGH)`~l1gOgAuR3V(eewuwFd*AWeN9R5lWs2xiAOj`<8-@nCSXpxDl zd(<9%AQYH{c!+=>5kC&JqFePa!Hltg+L90k@p?b!?j7kZkY7HBm!gbQ?L~w4qtA7x zKxHpNhQj|DV-55=bO>xI-ytr9@|Ha>!0z+$=F2k`srMNtP+JED*;j!G1@xe43OfP+ z0q|C)9WnWNS9ym($Z6>>o5&Fr42k6XKHsV3EoR5PH);y! z4Eeu*(@fV*G&)_Bb9#Bp8K8!M@4F2m&I@0g1n z!h!h5?kyII)sYYD&jtbJ&zW(bSAPoef3HN~3vzzy>2ztWLJc~Tp||V-nBD(>h>XJU zX7!+bHp^Rn(D49WWLq7inUL@axiZ;g!`dx(=e4MMc}Fs%Ooh&iKswAP35DE4-08E@w@=kW{U?v z&Hlm*uvsF``AQznUOt-0H)n19m-tDNklQwNwJv7`#iFN<=So5C+55jDdVu zD0RhpqY1PFC*$7wf{{;p4>+{^t1KX?=S_vded5{kWK$I^n3nMvhN2O4BJ{7_la2LD zA%tCfdVVkY6_R~D0EatM`IZ2J%Tbk06DMx3Z9+Xw^RwaEb?<1EDoXB*O0e=<GrQq{;yRVg=UZV>*F`l)XBQgp)3b*u+|2&n?JD3T9rk1h##AsPusTPaQy#!SbE@ zl<~@$#*wcac5(!EH)_wl8uREMTO!89J4w378Q+~(8BL$88MgFu{;pzncKD3;<=ny? zPw{N{NKe@UD=6(JL!z>$zGrEzkXmDmDh0ztLlLWP7k3>ucZzXTtdX64`3j@T_Qv)>l@k&&VgQjBq6utTy{tg+X3Bt<{1;xUqx`s% z4fCZ{?23>foYMltm=YhN`*(H3?@bTpOQI1ik6!D!sizM!UG$mC0E&(k{Thjnv0BoJCxqf-G0XZR2I>A8{ZsybQ)2EtZ~S(59Q1ZJeMfkcDVV=j@9FiDop*)NqY z>2Jh_Q)EW5tHQjN}ciZR%tdR(Wtm8N^ z;yu%R-?09QeoC4DQk#WJZb~gnxjcB+#6*F0j%t~S&z1Mvh`A5m&2l-yucpwni)DCj< zGz4S&UzHX!o>x=1VWlYE1R4$R7~+xSW<<{;2c3n-xU9|QwKx~PXeh)v`ZA^2HTQY2 zFOQA#9hKwFjtWV=fTWS%k9sevbU81N^*-WoA;@bzQf>K0bRq~CU84-?$m#!GFep;{ z{&u+AK35zJjgfO60^Jfv;Io{+U_RL`Dl#0&2PiUrZS$a{)deAy_@?zwc!G=+l+<-3 zd5)s)VM@R3D$1EXx@yToB`gC%)U@Qk%Env>?bi~%Hoj~*=pOJ$-|HI$$?h9ey}Zg< z5B097OiK0*sTmQGEw!ve+w<+v^haNk8!hPpN^JlQ9RA%^XI@o6z7UExU{Q6@4pL|% zYGr-(;1{tkw|JxG2>}Av)~}#04ENu?SKSP8e15`k@ViM>q8;rI>W*=s85iF8S2t(k zF2KQ&>A74?c(2MMzlL+$ur-^Ff&-jT;Xy_%x@2WAhc#O-h;}|bOpJ6=!p%N-y~G!7 zPW`(dEUufCyFT-mn>B&}w-lOjqUA70wn@AQPv^5T(bjPz|6YCFz*#UlfzWmrE^q$B zkU?QhigAAxs;)V(<+Y{ayYw-`$K;TQ1ciM0m`bDe@9@u#FQ6-0K7Zcwa~&j!Lc*UV z*((5ow%h^uxk_}n%4*(YK}w8|@kGroXwZ7bwze35nZW{*S75;J<8vjp(MT}xLdJwS zUPVjWvE}mj(DB8HGfLgtNa|H>jDKklrzx={@%j`i5ShU&41K6R#Bgp2sH}}v=D58N zc~FUF$zt(LqJ#L%zZhu&Vun;j87t3<@*tHDpfhM>s&^-lz}QyDvzFNXD(({+=!1C! zl+h9bHiuVye>jSes7dGvTuPS@{N6*i?GTljDc02-J0BVp)k~!#A_+7HknqB;z}kIV zBD4wLbE@Uk9DE12V2?pXO$9r!C${qr*rF#@P3-R2#~Ma_R#paYpiw6O?wdBd)z z8w>+?=iFUHt`Xv7aVZOUOS_kK9`}Ms%Wj|gR+DnQuRmzQF__&(fcF6Z5@S7Xdm^S_ zD8WmrMPpZLkvtMzdses$ANcUA3~+ryvxN?<@aebr@cL0>J5j1iAE<1qFR#iILu_s~ z{$dIMP2rbE7k0&@WcSKiImLi4fa;=xxzwjfX=n9SwJs4B173Xa+O5Vwh5~i@Z=F)W7ky2 zIziQ^d=L`&AsJNr?J?@0$B#7FVy?=j-5X@B2DkO8L-4o-imyPeT%rg8ya?urT>g4~ zFGByagivUKYphL5v;fUe=V&`ybcu)l!}DV$Ybu~F2w=e~S3Uc0EJQs+K(8y7-)hyB zuX5cPtDD3F&s{qh@dnGNZf2EX&c@!|EHz}U1xPAjRNRs7&yf+nI6Z9-oF}^7$yn6sfGSd-8%Q~d_cJ}R zKs7%s3by@dk4b{q;JNOg8{GOBSr%k*oPAa4?Pp(k-JY8Q(H)Y<;~+#!d5D9@7kHk0 zgB-K<|Ac{G&LFlp;`+y(-0^{uAj0;)U|ZSTUOypcXb&obtaR_kOs;B?la&>Aa;nz+ zIzR#Ddj&YP*T_@;8h{|ENyGFp;16qjy6~$1PU3~p?$XI`6JQR{ z-2k(>AsfnPZUmN?Kf5fq>f_k;#QC}D6Wi}|)iB9IAT9+N%3E*usF0u8;=gMCBvZa*ZI_D%Z;t`#R&5ha&r5#64Kujj zp6LzxpR9R33X%iLfi03`zEEe>d%YnvxqTCZfWwE-7LERSA+bBKHN%y=_nT5L-%ie& z%{>FY?$odTOkjY&|Dwb82dfQ^YLM6rt=K3< zp`@lPC9r(hJYJf%2arFZL*sFOt$h2$kssSSXjh8!#^j87BD7-QofW zJIN+{s5Qh7KDX>u+ep_x7W}Z%0yboy(39W^U6J!ghzcNuX<&MN)1O89d5%7Q5oDHY zJ6*EAay(y@xHo}5m)M5~eOHRs*BNLnSY{YxDKq~dxg^n*Uqd9xE}%rOK31QF01#(@ zZElTUU!KAI3po=oMMvc>n_x=j{s4SUy@^@{qLuW9#5(PDD>m(1t4bWcsx-l_%K>uQ zeK|*WgXQkK0gTs)+$B^>5)y zgQXXEj=IyaKg*}X;~l|Re2-QtDlJfe@ztMT_vm~WFE`yD02bB_!3Pjjm@xPAn&OS@ z4s+scHD~V3bf)k=xadZNXJs#Znxgw^&OQNh@v&K1l zEYrwv1zC7O#pVYtoNu~RH{n)vQ`^m^Z(64I41HBof?Y+^{#EKr@QD%8p{+;?XfTPK z?xDs{Zai<3BUlyq&i(4G+?2RG0O9Qfl@dE?*j8q5_J!UcdADg_k$R|R$L-Z_^`}8=;8ckXt!sM&72jr4K5u#dvkv>rN{}*jJ7C62E6_X zx2CP{AXNAwE6G~d3L^x9U4(q8sV+--c%`s25V>gTn=`wth?$gxiGR;?UM8Ux&cAJ^kR-rkO zEv^AFQh&RG2X7La$VEY_g1+x2>&kI)6EGRD<&pw#rYcgc?>-B(h)Xw-Kso>A`+B`q zKajgPP!MZ=m&}J!#BB3UJ-4!IwX=@2^_QqgJ0xDKi}Z%}T4Lh;bVoWb1m3IqUPz^H ztAl8zo77ZQjlw-cL*f7Tks%(B)Gc=cXtmK9D)URcXxMp2=4CgUo|=B z&OLYLn>G2v%7WEhRbBnoe)hYiTaZNS1iYws{s<@sS!M|^)fPYuRe|L3J`LPUI$`hW zVscPtR1=x?;Q{rMY%<+V-dj?`)s&q4-O+b+PXxHB7xZ!V#d6EjTtc)dEEABCRBjgb z%?QxRTle}(k9>D@!aZHzhhgIQ*YiQE!zmzBA4M7FmFT;;{mAhw_4|J7GA1SG`;DE` zLhJa0p{pi>1+2i@)qL$oIu4fU%zOV$T1cP3#q^0j`vH+h$C&$y^I3hh0n`=TD5p4c zR~7NYn-O?uvbfX!%j7=Bl~PQ<-Sf` zpHM`9_Vs=FV1Iy(eCb>}QywbxQp++%Kst^3!tn>X{O|>;QE%C@0)Y;bK-l2@nX80i z((xWOO)R$$dm}~PH*p*_ZHUXWV9fnUEiWEZ49%*JE$12|+WSyOz9#i}KfNM$Frt9C zH@mAxnDnlV&qNj=iMPXG+l}A^bXivM9@z?>^||YG4u~0n&oG4!v*HK*CB*zAK7oMuW#rD%&=_P>&>!F=F4-O&v&N z;2(&Ya@=RT6p#_cgO+7K|wxn<>~`xbCsfeHUU2ZtqdbbjC4I9aGMcxvu3} z-s+wg+C&4%=%C?pSj7Rg0k28L(xt0LEi5eT=(rxj?kKf>u+M-VRA_EQUZHmg5Kav_ z`g)!H->NkxWg_M)1EbxrVRbgwvIV!mj444Pc~B8thHr2n5bU>HZ&#qU9_&~U;*m&u z>>A(o56kKdl1?~YS4`PG%-d#QfzrGHXAlpj6~Y-c5ce?i~e{;6kjQa!iM}Lp}|aMeqK5%K5M!`WS7-JPRdT z-lzCx(eMJrs&IeCW&JqII z5)PI}q}L^0*{{g-q!iMEf9xg1KVqZ3YNelFmu2{j44oeGf7neh#s0G>u7h%xUP>a& zsDS1W+2(l0ckK+Cz|#M+lkt1V8}=r82jbt0#85Vt*3=6P&~(4vWHA5RAJ&fk?dMs} zJ9}R1s~kOoO&9~*es7*P<#fp-A5|ZbYN>7+mi>qWd~+t~{!M)KVVgY?B-}Gt?G|Cf z;4Jk42l;c~jT*i3*cyzFX;R&7e7f5|nbi$zyFK6j^5Tjm0SJAvmlDqQKw`f*>f%~& z$ueG*UiNg*D_Q{!(XpKIlh)ft0wlS~%6M%jgmF%lg6GC}adFZ5qL%_v zG+Z|b0F?-h8H^3T3BI2k3sjeI?;w8vMtqKfmnlo%3;`bs>jV{vywVRlgYy;PEyDvK zylPgjxSn^DH^yI9gHlhbvEP%{qM0WdzAiuxx=^rdy=PLz4MC zUA5!)l5@g<0%#-m?n>RwXxEF?Qhx3}l8&sxaL*8Sqg)s&YX1yMTjl^X1e z646pAmgX|rI%(XwOWF=>!S{N$HTqsQH4ex&blOB%t*N7yxv%l#H+L)NnD7G*JO$Kg zUV2GlaKBvPb(W3Zq}t|F$V`_pq$8WR^)$5dpA6buLq)1 zu?Z8#;{0&sv`yR56+x2w20fT2icTihcP*S3AzfxVgU83^F?vpIxYRgWh;ok(&LPf6 z)rUGku{KTu^Zc^J=MK-@KU^UpCo2jw>R%y(HIT|3pW!pw<$om$g1UdEf z?F_5@ckB`i14)2+C{xyg1yaf>%##V`+qdloxB$u})J|iVLTFFSkFw)AHhExwZ=;6TeiB45H1})l(LeFK>36(UcAmlCl%V)(s z6D2koc5%jPzQWo`hdq~7p^A&&#nVQYpy#j!0b)JBix-&;7eI0%%qR2viW%A4BL^NTt% zyHox$DBw+0GNgp?t8pj-jPLnAsgJ($RadIfZYv&?{P!1U@wWJgPN5taN78Hk%<6YSJFK1 zLVsra#1^qM<`H8?1k7sgmUdQ{sTbD~$BOiHRQR(A;uB_=bQ7%QOwK34w(}3RKd3g= z%TJksWGp>mPQ9c(i^5>Gp~v9cyShfk5PrpUD#RnPLS~L-G*O^hfESNuTFGzUaK@Q1 zVCGn*&lc!*RhKz2gKBsh7562;+g`7elg4!|3Mli_sfxazIr9Sv^#SC6^WTxbOm0Jf zLp21O8N^@R^f_$Tx~Hp3BHRSI0eV4MnksKPH4f*`KYJ6qwnJsfkk4-0kvvbf5QY>qsl) zzW3ha3D}>o2HFqJEzA{Q|5!Vf+K!i+0LSGlidg44%n$UvWKd`*Apf>TUolePiX%#z zJvG27+fWDf$j}gx-7sR@6)W?(<_E_Ta|Jl1Ifj9DwdOR;g-|-ZJ=-sVibDiyJHVT9 zN|dbhZnG+&kZ9$#4n#OigvvnX5; z#WA6W*m2j*ECFpK!IUk<@<#gXVJSfJLkeL1{O|S+p#uEsn>;6rnDVrK|0Q0+fvU@a4-ul@_izt@lX#>B z-zE!olWZ&-UBn+aE8qzXYYT!C>rVL|3b?$DP-R1>l^UpGvo zm`<4*#IpjB6a6$#?)9HS1*_TfnEy!=uTk*(3(x|H*;wI6Y6&`zZiQhcUZo^-TdfTr9pJCx8FOpS&Z3TtBGe~yn(xQ-fOp@6m%MA5`Gq-|lS-vttw5!O zar%46+>7KlvdY5PS?C%8?Wtjei1cwc;QM=ppV=o0B&vd3sQV>f+PggR+mACdck|$; zt+z3fCx$jkL$9$C4W{0`wh6AW$e?rCH1j4BzhtHyp*9(80YY79njK`Y9Tzn-^ zMExbgI`d_yqHii&T2dqWHbeEMi>Hy)l`2^Ycx0 z*l+LN8{qh;3oN;8J!K=CDIytuN3|=)*;+FeL?Pin9Ak&J3iJ2)%k_cBXJc5(MfC8~0NN2`yuoDORvLef3GYxR_=h z{r}Yz>>A`C#FE$eckSBC6reN=)D)x?Am6FQ?>}{9_h8Br$60!8K4hHq!!H|55CJ~q zCohlEJCJP1D(L>N3{j(Rmt5ZjUZx0GojQS+l7n+0a&^O#DaN}>m{otihgEMpIp7_( zyqgHs;ArCDhrU*|?vFwMjfb~j>KA|yW{di-z@Ew#x{!as`YtEb=Po%u$$oALg~#dl zO0hSuHQ&SPSdALNKLFhpwhj&hanm3xHK;g*ZmqBMBTAyJr%Tir=^acmDi~cXE z8oaX;sx8X+g3dtpLaA1h*QyWuRESpC#5OAW>7P;)mA^1`ofpABG4=QM<7FB@MIeQz z>ofUXdD2KoGm*2iv(`+pI+Ji(B!(NJZh*d3r;EQ7UUARr&1Sy- zuk)`MLq*gOS8Z38_vjP}E5az!>@v{T72DgDd?m|z;thjRp|S(ZyDyk{CHFvMhCtJz zsgwo?-?8a;$a>i*|2z1C_oAWctU|uLm;!^TQ#{mKD_n>Dj`{#6xOx~wL#iXX%Pwe7kKXwV&~|JaQ71g z?;W`aa-I4j%Jm+Tj`Z#c6!*@$Ste6o>!NK5rZcMhe5f9EXyEWSR_>kl+q&J-jsA>>iw9XY z*?NCJS4QiqQPa3yuJWw3y%{W!Is8ot(B58d&Ju)+P8ene#Q-gQ@wUlVg~zy3FX6RC z9TTLasbAk&j5D+o5`xga_8+t#vi%u^_MxsUM2Xeb*KG2jNX2S2s1|_gZBw@p<3PaG*Z|K)>EDIOPwi935k7MDRoCC z2V#RcG}=MAa%c$q^B*dF{c|C?M55=MGWx<33bOJayt}kZa`1_U9d>RHo8nqt1ciN@ z|HG_7Qy!eRW%urqeZw-NitZ)2p8?^*H%OO6P9m%EO#qv{)Qn5tRznx<6fju|alzd> zqNl@j=8p6r3x%+|I47E0weU2^76!59kp71Kk^POxGU-5A7rZ-Pc?YAPio1+(M>NJ0 zZ^?@AVmkn3f00K$oI%KrAUhv!XYFoL@0ptqD`IKSAx}?PSZPUxK}Q`fS3>+FV^(eG z%6zaKDplzGwECG+ts|1kOb)bmrU(sN2HOppxsho|PxQs2j zOWYr-YZVnyJ9gso*WX3I5jE1{j5^ET6%~FHdUL)Nd}#?~(RBNhDf7pt{briY3C+Cz zGxWnJd+ZdiH*)b>TBjSuf`!*zZAN1qXL6p} z6lJpYeB`06fGe|L0uo@wD@1etxcm@&8PB5@oOxOmGeus`1oRxH7J80>cThXBSpcnC z(@eqTcJJzh3uPbJ2EYV`SC#bmx~QB8Q+%mP7JxgQt$&YB5L1)WTd7-1p5$2Mk30Kz z`2OZXFr`z^|Be(8)7+FnS6sd=Ku#Cv32V< z>6m`30E)&r&O-8zaLC18ZkPgep?! zLIvnAoVsowg&2owZktsOr7CB{!G{Np>I2^(`Rt+<5$g2uPt+bmC6;zIapQVsN(C#=u3G_p`A8Pc+`YYfl{l`dKz}-W44Rs&*WWqv* zTmfhEm+Q|RA@1h?h1e@=B_$-<{|Yu#XbOWdm}L#}P`1Q6#`f3^QC#guoN3RB-&R(G zt<@7Q3ugJjAZL797FC)3L0ROx$2|i=!8FzrmyQKq!JXQ%igi zaC|^kl2Gacw%y30l-8P=4GVYyFAo%4P4T;f-2gVyuDY>`xc`Vw5}>YuW-S2{$Eg=( ztWV6SxK3lj#QzdxSR= zKdN6>m4po59+Cl?@x)dGo`M)*9zKokZiM9kzWt`Xw$0ZTo#jS7P!B+64=9#VsF4&a z-cz#$)idA#KLrpzuZ+zm$16gKI{nos#2fy26t2OL`LD8+KGBmsj0K%)HjY{uQU zVCt4X!xTHDaE1l#eD7;eJJtBhl85v|QiB{Ix1~ot&J&PNO7(|u>-?0QW*-pGvrP3BHMCz)@;pAItb) zIOvpEcvmD|N_UFUEC#fCtjrmtMBB8@mFtO$!Z#A&;}=ieyx}ZqdE(^0n$@*@dT?T* z0?D*MDMgVISt4G|S3LLHhf{8)M|%lMH;`&hLm@N^t?fOlNkD3yK2f8|x`yLE`}Q|b zohlVS0;8gu6;z6jTV?n%87gqDZGfR$0I-HVC>(TdV z{e@h);!6k##H;PghC-uQoPI0gTdqYA4usWYZynC&`VcOA&Z?W;wqH!Si~)i}qtft= z$RI~t9R{dJ;$5)@Snsuq{DS!hxlyyeSYYF1?MD@0It26G9VSEs{FrV$TuGjHR(y71 zFr|Udbup}O8X(>qSbe_wEW6}QQ0Shp>10v?P!BVh0fZ=|8mi;=_!Uc2FBOH-nT5J- z*yny>mORjI{q;aeVdMRw)H#*lTO#&O5Lxe_hN==`l*^CN{eF=Aqi#KPpZT2Xo7ZJx z;(aB6B-|9N|N_{V&85Uob&B~z&GgL7-~*b~V495l@# z?hILi$Fm#_|JP^L@X9sNfo+5x@#9~h_R>@}4)jr-z)a)u{msz_-3e(W#WKH+;Ed7+ z%EwbW(xry7umm!zvorKUGPS?e!}gW%bwd6KRz=8kiEqtot2AgD=#&CknN2NwDTJNL zdIJg$u4mxG0pUh`cYuRnIhz@_DK46BI0ZUb_QiXC2qpB3%N3-#C;zYERR?^~b<&l0 z2>*?=|I)#4A29in5sIbCoxK0${ho;PEiU^Bt`1f(e&-l1Vi1v7>3}{5+tLH5Vbm57 zD}Sv-Irf@rK&zg~pPq@K#K!*IXNN<BFIoac}Rcu4o7X9*<#E1@Cud1+gG=MCRabbcVOZxO- z#DQjd|GHYQ0W%eY2Pcp%r)ty5B@1Eh#nAlCPD)OxJ*of4XOp|t^7xv)C!JJ_87*0t zB_yHhi;tRT6v0FW@cCWtNG%@2sfJ&#Ud{BGv%J?T{N<~WR@jc#v8)Mh?%3lripVDL zea7>BRkrueSVWOBFd4e>sDj!l7|2z(Ao*Ezry*vJ_(pu( z2*+X>2Zx8xv_MY6dBoZ0QB2ujVIZLT8Xo|03GG)m9Y73=i*+enoZ}*f4~zvT^*$Wp zSK&)y$TB)prvM;%=)EeE7$maorcx8}f}H;Trw@yykNshP(vrAaVunktfoVagwhClN zwNXZ#ZGKkqY3W+-J@akgr9HFz=)*JQ1k^ov%f*b~#-K2aqE&6e#5OVbbcvx^jF~8F|dq&O`_g)G8v= z++Ew3?TD21I#qdvG<+`@K^()Ng#7tco^HyF?*sF)6H$u$PE@Taumj-z*drh{!z4`- z3`zwJ<)v8=i8~?WbAx@-K~CTanx1;mvLsLbSQ9Mv2ePa%QST>*(@z=@ot1fE>sws` zYlUS!;Var?&oF#(F4bZA#Qy%dSN@@kuM(70`G*{e2g{w!R2Q5FU1O`vJ`4WHzzf_1 zwsLzZyvbt{zU_|^qxq5T2rG0T6LvYL2hBVJL8ENiHQoOR8pThJqK^5uQQ`3GFs?cvR_mPoRrmIm0 z+HwoYdH93$MERVEEETc;H5(K$g9^6u;0n0DC;TJ8)c&sk)3UCb6tL+#y%*D0@rAi8 z!KqXi-_d`DCc?ienT`HYCH*~32G8}~q2rNA^P9=hMy=+vO=NGNzx!$*O9X|Qu#kvh zN9lh=|E${W4r^&t2ea=9+yAYIoULQ6_}(|86!|MC50(G!C-W$g`%4m&(>GD~H@NGEs^V=X+mix_8)1fuVDxf`IcG+(r5;tOwlPVQvByg-i+{F zB^-`?sWHP+ZKMZRnmP?>E)bpW_XPQZl$`(S%i44S_}yC;{56v&T$i_Ln-uL0I5q|7 zV=dD4gOEqf17>_Ts3y?Hjc>3Nu7jV-sOsll`XN-DB>+ESJfKXv>1GGgRf}5cAtl}R zn;QFD^LR_>3aqFic&t7wzI&X`U_6@ViD&QnyLUW0;1gC1xe!(mw>S!X<-r`3x+cS7 z{*902x$T#YqKjj~22nQb*(>&?JF)_wPXBBTy-!%b4rNnT_tUK`R)@+qX&KyZGR8<| z*?9I3mXGA7LrH*%!nfq#Ckmwf#W75~f?qQzwlmS@lpKsZyQ1Jq&2H`6kO{d@$Df@6 zbMQ_W>#hn|$?~RLj2^hlkvMJ-To~%r!unaF?ZPx|7*y~zl!mBt2`g>x-|4GV>+%kc zry_$`e<@1r+y7D9g)yN%%tKD2XF2M3x}>KfjW+PhAjM5#7|LKEhPKpvk@KcK_J?JU zNA0KX*GL|h*sez-Hr9RdGI^ajH4Eb-IlVw{qP0Y7@%`@^Va$cvafQ*fragEu%M8yG znL_|7;+E!cD$s^FyEg`h;518ncDJ2@|A}JVra8GI0_bay2t{2#H38AB@hgf~pMFL7 z*Q{E@83%?$P}8L+i>6~e!;jtFAjot&v9F>kv57h6D+ z8qLXUyFR-S24A>(U6HAdQAIeWBOefA|EpnfC$&_QEgTAPdAxiF$2s5|p-U1y&^7)) zshi$G_LWWRFaFq7>yM$W*%6N90k@zg2)|G6%7G4$_x>qGk&Xc7Ru%y42*d$Sf2CSA z)1JIQdr(`Q@=G{3=)e7d*)1pzNV(QX#5&a!yZj%8D;bh5DDF2MM3MXeg4YRru`=X8 zP>jwr8}Jo2)gw=qUc;4L1rWjh=IPFpEZIAh_z z8tIINAtpfZJIR0_@p~B@th_w10Ajd)55Z`<8{ThZ7qk;m2 zDqjMG{!K@|G-7e@cM9hftc$4UN09I)95;B<#80H@z+{U=WM%pgh#abw;QJVS#QKW`P?s$~Z> zG9SjX>IwbVV+(#64U0BGpKz9i*7(fN2Mb2O3dqG<{aYh5aOW)d7jZ7o#XQIG92oU9nI~(x)*1Mbl<;+%1=^v+TG9}V8D6KgPk2#iTW5dW zG{Cs7zMybop0~JnzZCom$4^o+`Ef8&x17d6(0VdLHrkFRc!yLu!!az3Kc&1lF%JBc zt{aiHgo*6TN>DA!WzM|^!)ob82_xoI%93poeh?Z2g{~X_D^io-u6vDbZ1eAc`e=lY zb2mwkgcgIq=#cAJ?FYA;X8t&o!W$EGe}y^A`kN2v3~w|%bw(@=10*q$bhmVZAOix> zm1>SW-aLCW<3lBzq;{H11N`1MSom~W&@Ovk+?3dTh_ZKjnyBAFwjaSzx+1e z2ZVZF4oUV@pExa^g#vDWT>yV~j=x(Rz*S+5yF#Z!q`2B9k*-DxjU~i+rM_GPL;zia zlZmdU^M<{kYo!ys{|#Nc5^x_pxSl+ySC`X}gUV*E`p+Z%d=60Z{)l4axViAwtH6VQ z~bqjM!Yl3f_zC!veoO9GzYhr(0FU9OH0pn-Ac(Cw~_e|2w~(!~&=TECGdz8*0ncFcPl0 zjHBE4=H&@eDf-FTbzI$!$2T*Oj-Xg8aUbn@ORRw*LTvMs@9lCnMSn!>K6Yb2M9Ch5qt2(8_r zt}RBL_Y{Mv&QT6X(-4SoWziHIVA&n8T--U`-D6dMzYAS#%FH9lT&X@3=xRW~(2R$p>ZWIa-ydxN)TT3A!T44Sa^j z@mMsgK627iW2M$nD~>k)VG{fqd6pE+g0iBN#s!)VPRc+-aH3CQi2 zqq#5Pa&%*0L+B81&i{H$n%~0Ada_M$AU{~8hzxOxs>RD2Yk_icoQ1wm?;)DtFQ(!C zrfYqcgC4|R%Zx(}j05@nBM(wzKdz6hDF&=x;eF~)DAu+Q=xlngZZL{0&IeML$Z>m! zvXhO(KUm^WgV!9=Ix3A&Lxhhl-_#xY&`SsoP05?wwwbu-JZY_|-={pEdl)a@P1oF9 z9M&wym^9vY@ny6AGswl)S6lqv<4AW^^w*WgbCvz-DIZe~2p0XNxL#_Z1QgeaXh3qk zFsOj<`Dyui-hl#BnP);sc|bshdU7*8Gf{6O#8jD%M5n=&Ew6@Nn^ChcS@okTJKR}A;y}5nRA|%( zVY{MmmXX-aICe8?*m0Qdj{{I<`Agn!F9o?Ox*R@j+h!W09ukl9)@?=w(y8zgmJwOSC} zbrTb|Bi1mX_`9}0)Y{d(jNJJTEsjjIm0a!m7f$ZQozKr6E*5xrJylz`JhbEGJlz51 zRe_{R0=F?}&G??%o|Pf+^pL{<66~vb#1_m}`Jv0z2JA!l&Sh zH5*vhJN9R7Ie3pyO3Z-5(R@AZOXd@@Va|pl>PG3anB5qM9CI! za!z2aOJIbKU|_QxcYP3H*f-b*a`(%w7u*ESd#uTk%fjX|ta&oWMY~BJ&pEame3~0Z zV67V3# z(Jj?I+*HCBXxwM&a}XeWejk=$DkZLw$0MCST(2bLg#IciO>D}kt1P6EvrZ>F{+m|} z9tj}_R<#CMdNCT z!xQ<&kdeNW{fb+=<7@%5w!aLQ=1<4Lqc@?L-ot~<@;*&Gf3@)NIBnTw)+9gHGd|+W zE-Pc?yg#VO?rb|Is|g}+7LA&oYNcyp*zqc!jxX?!(UTW(x%}p_@0fta>$AnU=Tg39 z;DgU`*o+m@7*TWST`+R}uBA#nZ?neYaKyrie}C$Cbx&z?PU!wz@sT^_b!zc67hj_! z-faWC@iKiY1d&gY*|Kt@h{CZd1J`2KR;aoKz6|eIy?iOgu1#YfW5t@jlUvHKSoD_S z{+!X-1uQo13mZ@qVaCSUqV9M#l1=slSNL%%4iCz|5`Ur)#&4^WgWV-8^V;@`9fFl7 zg}$LZa~D;|$wiznW@qbwX;ztO6rikb++O~y7vjJuxhZ`wlxwH1pH#Ee?~w8M$^*I5EGQK-70L9?IdWO=94HPm=7Y`SHrxA0-H(r8%(bj}1O^!407 z9UaC`CPgRYhBpicd4$VSlivS|Lj2S-bJEQyP|-NHk(89}f__q9qE9Jo$gTO_p+%!b z$hEgLW)tSRj%m1{&FxI0VcZ&AYr=f4F)ioEPmK+0<`T|5SdTP;sZ|c15r-tO9mEZb zhv($y1moYQjiMU;1S&a0of6WjX8zl?IjZ;(eWQ_!_B8td4 zNGmEDdywFX&>WY4QPS@`+8D<%P07#rXtuCO?&2)bmwd>9v|D@IpO@6~!Mgvag|d6( zYnyT+i;5OxHTn@HXE?hq=YU3V)Xf66}Vt%9JZ~`=%DD`*Q#r zCPXX>?MGhM-N`KF*M{_ZVd`j>q)4kO)#kmDp{M2v=Q-V75|v^VhCW%N{6aMu57DEk z*XIr`8>%(a*Xm(JWlCuFXxHIT31Lb zpH34Jk=q@U>dZ1wH|+AzEZ9kmWM}5e=%WqmIR!)6j_IVk;Xd*a-$M;Cmn_O{C1EBu z&TegGmw%>FPt|cAI}lAoL9BbN?`uHwM!doJcOCfqdxE<196@rGPiApf1C`uUxYcEq zQrQofFkZ0R=tJAT*iZa$GS*iN$*V>5#kuN!DB7D($MPm9K5sd;C@NIpEFb5oDy^$y z=LiEAMFVS}tgHSkE#>w5^TVj*T(Vuc-&Q|Ml@t|KHeVN_ZqO3SbvK`ldmoy@sg$^H zp<~3n3l=I?I9X2o9&_Tb{_J+7ScujvL3S%tHct6aP~!zGYKz9pbapF`O|IotSjRHW zr-!k&H#^LgW$qyZYdT%D_7{`i^GxWhLNF6zJL&}z^ai>I{fG2tky1YVY*;Y^*Wx2- zfF#8vXq*TQe|C5tIL^P|yPuD=n1=IpZ0XNPc9F7usGx2Z9*FTDase1F)ETdHV2+Y(aM!=VupJ^N(+1!e?1lge6!AK7r~?j5#4ZJ<{`#h7|5M3&&PQtai@2F z5tUZcO5WtkN?U+m6WbqwBUG9lNdpjM|NK33Zd~wKIpbqY-x96w(YC+ozgRu98l}m* zi@({zrxN_;ZZas-uy!#zf%g?5@SIa}v0FjJJdW&_aMn7}j_xKG+>M5Fvy@pPGuS3x zLbqwPQI|Q~bH?V7WX4JH*?|~yPke(+sq=9Jjb62ZAaR-V)hJ%CdFv8}P||d7+n5+9 z#i>c7?w2}kxyB)9Ra0|eC!3D=G6_0^BLnmIx=xcFm9a{*`Dcj(P25wxNZtXuw&4so z*M9Z5$Ma%NC}u4=bm`54k8Y6ZiTLU$+(Y* z;qzzMpDI4&?ZMM1-xTUiS6_UTAr!JqfL*#HgaVzJoQs{g_l4+vbtw`+Q=D_te$JsltC zd8ax)Eki1aeG0m_=z_y4zuKo#EB|a=HZ`Simh>}7&Jfb(l0Asl|1zz-qk$sIZPG{${73}p4ZdZkTzqc8I-a96l7M(sY`g+ ztu&$^gSS={u!XkyOD5omdzo5|G{>+DPWwxyTyU-XH{ISV?>8ZOR5_}W6u$z_Kd$*E zxa}6drRfM#leTRR3&i-^K zaw|l}PQSRTt_-80#0a<8sUs+oC1#yIV^d$YuD>sE`+L}PZZ%EHlwm6=m(TQo1r3k) zhm3{eFHjBV7G&3Uy~pp!x$dYYa~B#9Rcq9VTuK|EZdJ>ZCD0~?C33}k6qfp+wnZ3;% zn2>>++oD*PuAyOo`)c#A)_MfUJ{&x6Rwx!bWlUZExW$zmM(IsC!mgwdJl+(M23to5iO0bJwe zvc#jP@eFCsG{*h-+Feqd>-_0x`O!kIS?vi6A!}Z-!a+e!PJm5kJ)(-Y2GcQB(Tyb@JIzK1s<$$Iv5>3VoGVATaN#0X+gd)^5`FeQGE$V4+nI0H`Rf7^O{I4k?&g%Er!gS@r_@mh4h27LL zl!e{L&b>3^!aOcQ1(Wl*`%S{Ml9{cTmM;jlP?l0DfFvO66qvb0zAz^8tT=Ioc zcVD=Qkc`Z9hCMAFAX|n*J-id9zNACjrwyX*9YEu@pt}_L?lgTK(}<>DUEgM13S7?>w7G~)?lz{C?!u4=p4kMVl}y^R2g_J${YQL^#ecG3pI>62YE zljJb`Nc|UcW54_fGYKTZ0I_rVMbL?YxxEG+;Q_xjzTYHqIqXaqsoGxdO?`f=0e6A4 z##8RR?0w}bDWOjp5x0?e2**B=wME@_X;PP^CSW~SP-GVClK)Y5_pNwk{Z_(f!{A*} zG4{*-5gd{IMpL7}ugW<|{Ou+iRpS7V2mXx~fM8|r;it@G9+#LwYZZAo_l4eh&93KQ6l~M(GS;^Ox}w1pM~7uvA!Z zMR@VJv4|pj&`}o)2K}tLb#`-q(K*Y}&iOa5>@y6Nz`Gp<91$lkNto~NRC0&InT0^_ z2Hai1Bc#)e{w;69(0H2%iV#44!)+zaUnJ~)<{=Z&}mIFg%@Zm%V2Sa z0hS)TW%n=sVZ4HP`!lts^bwiuiQjvb!b-%F(^<9`c4D0avj<{Cc)|P1@W&pY>KPhLXTmle?2K>lD4Ra+9l|n{2j{G6w2700&(U7tvU)Kdry;n}Hix2LD zC1ojCTN)BC+~YVNp7KO_ocnwuUN5$JA=kM*1pzwR15NwQPZE!Qt~F<{eV^Bo>dp(K zIjsdUi%<`F*VM;Hrs*c4Bt0Z^fMs&?v19z3H)c29Mx8&VC(kR54M;Gs)cF7ibl~y{ znbB)rM39QS4RrA3%y|ufjC^DB-y)xH5Y089fcN>BQbrBlOr*O4kfDOx!%6T!=LBu9 zPgg_oNMOPhgxw{+BZfP(zlaFvTb-5vSx$l=y}1%LOj zMZa6YS~g(oa`<}jX+v=O5Hb2aG!ZkROA;A?{jNN4%8o&&w!?)2T65+hbpYl7%oY!r zwZGNOznrz_6M!0c1{Y1}ca}dr&*YtRDNjTqa61E<3@mv8GE#t7NZ8eE7<733MC8UY}qL_ zOoMALn!Z@R+HrDaN%F^+cOG4Snb^)-3q}~$+?c<+Yo_;oce>9jr-|Ovj{!dYa{lvq zVtRRFH?Mq}iHVW%Z?!dr)hiQWJ{RQsQMA%LxfUOk?)AlIce&t8ORxdM|d1lBdJqH8pF__u2q! z-Nm23arS=Sw*EaeYM;Z&zOsmVxkWw$vm5{9)!WYFg*w3+^TqT6#S-B+r(aVYP>v&} z?lCLL-K?2R+Br-|>f`BH1$oPj{eFhY#8b(MS=D{-BI}_L8UEshx!<9iL!qv*@>?K8 zfy#(;bH@QAfBk#J>?-@x>1;2z@)A&jcNxcBx!b}z*`uK-{QLXsQ$`D)%ZtT&F@uBT zOB|f-s2pIS3|79LDK~_xkWS+lNZ16Of9f&lLQBsFt#G)kHw5E~}t@%PQauLWdDUloHp zlDaqtZp$`cL$(Vlsiah!sF%eX6!B%x=9Dn|kS^FzD_b+?JUJat#BjcY5 zlFB;VUwreXQ8Kf9nKpCCSUyj4eLAoEW#9z5dv-)XS3U6x1_?iaX6;ihW!lm|7u%Q$ zLotkr%Go#U$#Ae{+7Yfx6vC&3QK%cdwQEYCF=UUAwGhf$^r7KL*vLdJsZbQuuYRsI z%~{UmTR2)B!N8f+ry{A8EMKb4Y-^^E!y>S!5xo5wMadp$=f|!+fn!Ya3m9j`$naNs z+nwzJj<@EE1sI~0Qb{D2RWtNsuJ0selPtc14)r4u7_uwES~V7G%8>ruQn0G$8~lNBBAs53LcU!SPW~9fnCl^x!W7q@Eg&h$k@*s+5<}7 zH?J%O-Gs=t4NZm4sO8Yo3X5?+XQ3k+$Q{1_nwo$@Y?oo-vt`(hHXdoQlt?wbYwB|! zpU{Urau1u7l1Ek2q(+jr)m?~213D@&M9_12UW5B+U|^uKtSpWD6e#Usvw6^dBu_Ct z>}vRF;d=j$fcFl;tWa~kTwOSD{cQ+l(dVC;oo!fohCMB!IMIC}*m<#r^`=gPHQ{Ls z3rw_;J^PEHtxr*8+vw+Lp`T-1qcQ0UdvW|whdA+j-DO6`ec#G2pb(3fmx{4suE^Js zX~)bVBp7wb^u5M-Q{vIp#FQpszePXlduuzfPPc6IUZ@3hs5|g~KJ2$k?@WcckAWYF z!rW(G9|U+lHi}XuFL|~3%hy+Yc5Q&eu~Hv>>&IMJb9m#N*YhRlh9FHDjW@krT<*Ye zy8xWD;=TPsQ(Xl?+aq+qb;u?i=VuAGFy5fBwjF(7l<0lZx**x^IZIO!)Lw_3_RQ1V22Vh}*K|mWP8{ zp7@(poxXn~I~`uQouVM%AYmE~uqQgD+chwW-R;Y1$(bnB{`S|_A*`L+r>=O}(HCd#iVy;a-K-T8vZ)Jn73|MOH9LB5VFvb&u;lwnX?O|W6 z<6z8tS^cakn;+Vs&S8=X!{BaXX|rZeXGlyL z;%tdxrR{6YAUC3LlLpou7hs@!d42(lZ@KI`mY4fZ-ptNu89pL`OY|WIr|W}Wb?mH0 zW{+ekfk$%khg1B;XZ`=z-gibd@vi%#sDP-52uMeYbdcUbK&2N6NE1+y-jv=u(gdUv zs-gGZTL39iLX|E-LI)v2=n%LQ`0su8Id|`U&pP+pT{mBn1av-|e9<#%q7V^-|jdMOGd;TU**B1EP<-aCDu{3Nx`C(NW| z^4KFkk(q)IdRH+PE*RLyBaZ$~p+paT`6G`8XEh>!16F)(pKftdi}bV(zLYGdWIv?; za-Sx5UL?M9P)NFUVVvA!Vzoa%vGOrI?(&${W7;0zlFpmaj?09&=s!7Dd2gOOp|+@I zca~vJUm0^#*OomN<$Q5aeS0Q)M=YL{{ie2I4y&g5xw-?({y3}2C(x6_uYY!B`{N9k zoOC(WdKR{cmu^_ZnMeEJ9CMJ@ywlxE_80W`^kcSD@GlrCU@@cQ)u7s9I9V1gONM5> zP#|ThO7Gx}N#PX;jNKW%0fn*7&$J032xq260;;xO?mfj0_0)YUHKN(qp5 zfiPp|i#UqS+#iE#lY=(OHoa_O>cVQC$Ihv+_nF^zSqSl@MWqAlj^G( zrP>!NeLTXWk_$k&XM<%V79{3|9tjR50lW(ftC8UUgzd8dY_B{Ow520B#%MPc`1iio zY48tykNtK({u{mg5d}u&JW6z_w3B0o5$w-hq^tG&bauN+lVfiP<<^Pa-TjKm_-FwL zLT)B7y_$WDtjWylW%uz?fgBNs@dUbtT~}K3r&`=22&aK(k7-5qv*k0PetVn@liIUx zpfC@P)sOj}W@v*mr@3QsfUR$<#nk1@TGAbdgWozL?tA8Zgnv_{L-MMByQ>G?)(l>) zPtj3q6E2rCAk$)^i|7*53?tQUj2N~yj^0(#9xSd_7%iw?j5etlRJUViF_>X33HxP5 z7{YD|dZD0r6uwu~A^7{q9=a3qRilEbxp_KanaeKp&|=<4F`po+Ao;Q2fNUvwp#3@* zMwEPY2+MtK$l;J~|3oP?Saxjt_VgzGygs0>7vw%A89LUm!W|uz2JeC%kTYziWgfqQ zRW&nL)1-vykVdz*K`UlIHks@St!j7l%Tr`L8_7hSen8`GUwAJ0VM+ll-JiA|T9s35 zoO{nncIcAh)R44rij>12?-$P}FrNo|7cXLMC=mOylE`0{{whj($4N&qZV6&IYdNe!>Y_M^H?E0S7bhJINi5` z5x-wIJBsU%n8Sl{TQH(4gEl$##Cj3m{rCRpjSB&X$J;5GbFVGn`u}}bu$Ds*ryi1p9(kr-c_aX5TPZ~BZycrb>jo=sl2!%sdiFr zXNW^d2hX^+uhw!*ppGf8b?#k7Mm7z(=5yl1zCe*_F!UMe%9t{;&NB~uAAM`Y)>_fN zCm^7+Iwi$_mYvs)RhihSMw3ZzVjUifxC|dbgYovt2Vus_oZI2g7x_wGi^K3bZe=NkE3+nvgQ+kQRZbOon|hr ztWSBYjCw@fT>?(Eq#H(?>1dBF8)oc-o+a>qW1?rV7!uGmd9~qMQep;C6pA64bqAjX z)uTK!+$8P8UZ<)hJXh!%ZQ?%LxRI~4T#eS3ua6L`te7q{tZT0()3c1vO=}LbaG|D| zF$L3CY4pPcp+pinGwv6c&9XN3MvA(ZDA)N3&av$>VN7(VsKcsOmg7?3cOm*2ug<3I zj1v7^ri}A+l?=3RKhWm<_V=B5iK8Hp$0xmdjP8r4WhoC}v&a@z$@5q3OTb>)BSJh2 zxCG$+q+Uzkqva6#kii1~uBPn5Fqd=(__D9~%_|VsoE`o4)j=1GU@ctLr+a;9 z9aUpEyejA;pHUL3pF3-%wRXTnQ)z3L&&Pd~WPyuW5tch~XB#$Fn}FXVz*NSXdr8>= zoRe?=CroqP;Km6g&mc>t$DYsew`Q%@+Mk`oX#*pVXlluJ=QB5VM5lw}MGF7e?aLMK z@wnbrzT;fn^51FhO@|E&I-5@Cm%n@q#Z+wPAJ{ZkwlSRyFF$(V!~Sb@=mV*5SHb`n zfS1}M-F|%wb4kCKGtcpt_50xAWyfl3y^hh{txpH9#HYZ?_ZId%irbq!%q;L6DH_b`pJiYw4zS&8yK0Cz`EMXDWsq=eRz)_;*ULUZ z;YKBizXGtJ@D*Zo4OwBN2setZ6~vcOwC-kIwSh*DngVtGd0vGaAIIGUPBre9Dc#93 z_77lxaS6=wFWEiD6CkWq$OpJ%1kA&-^5ccoAkHg@k%C7ZsEdz-ll1#IG7gfOwX#{H zks}r%svxZMwZJpzwWXLo^f@YCOqn>DgSb$+>Y~#e%sNU7K!9CllPytGbf14hL3uZ( z?_mx1U{H;1ja_2xa4%}`KRarfZbX|0u9c|j{1bsErA{P>elc-bB3St&C=cehSod!O z0A#r2U`rimqJFn`!k}64xVz49bRlbKxch{kbMtyHC@zua~1Uhws8p)452lxOD3V5~L#)v#`Q=Z)c&Q4$3 zfJaA3znwiU|1}J4!-fVocx>H7H?3WWIC(Q!>BjiUs*b9iWcC50xCPv09@ta?V9oFI zy1A~She2f{5MyC-kptFQHpio*erv9Z7P+X5x1#4_;vW&hjTf+F3yfd^Onox3peMIP z1-zHvCK9-He3p;joQp-^T>?xjFKnQuOmP!5pWLB`3(Bk=GA73frZy(zsLu_Ag`u8| zTZd|pPNZlOg~}T|xLn*6CvXU*0Hqnp`(@*CXA@_vCle1J$SVKi57Uq^qL;q1{;D@# zVgRsr0)AX^BD1JM^>;4?XvECZ66yBKX=_aZj01oso0DZ@@oZY=4xk$@Le;+xL!2dn z1P5fV=|$z!7sq{K`eDmKL&G2XlqO#1$B;c?>Zby|>r}d2gl{Q^=Kyf-vG?jA6%dCa z(Qk3*j|tJb-V)#%RSd7AUEl}u5d#7;Z#%2DKXoyfs}n1DxSZQL&R6{75 z@a`Q6=}j7F?=fw%V1=csN8&q(q+l#}`XQl+Bq(QHUEl4rsDXR){bd)$>cqI4fHX~g zxV&sKGc~1_egs@OoFaVA90ABQ|FmE<5I)_1pq$7N)eKYbb*D5*JoH6`H=`!jeBc za>}x>Ot-HQpgxTTRU38KKL~vYC{IrW(g`aDnXWJI)sMgKupwd5|G|xd)nCd>Soc3+ zfWRD)Ph0qZ)tJlviN=iO+tPM&(g+Ug86LimUMhLevV)#f4qe$ggy+#*YA{>QT3{Stv3Hf$o~@k(~soJKV1AjS#6Yr?39T6 z)eCG*Ur3*X&Q3rmye`ktJtoX#us!{LNG7*`AEBQp-%3Q5T)_WB$ddPY7k~g{{sRF3 z%HU*~VIG@S>F`P}?)C@sb|m4JHzF-BE1iM?9~4(MFviG?!975r?Gi)%YlBKUO<~&9 z6}A+^Vyid!Lm`fTSx1y47tXHA@T6cmUf*Z@;nk7J|I2);{+H&HqP^**7o=;U%Y z(6atxO`vm*|IaMWKgdPFqx}ji$nA;d0D?C4zU%0fB6(Buo6INE6{XqekA0x{*Etqm z@p;Mpa-S0lD%Ho9!DJ$KDp(pvk?B|6i4YSx0ql&BA=4_yKfk0H5q3Z8->uyEr=Yr)wA(eI-dn0*W@pE$$i30 zQRH8EOnDxcsSzU!_2A~DVR9;g*zAs7x}0zp7X!1QGhA5VDo9|KL4%&tZ~)|{k*KV8 z@9|Y9XJWX~^*c|1^{sQmd)mEYWTG?JJj-)4Yw*=T5vC9n&q|4s^OK9S4X ze99Mkm1%1=6|FPplT{(-X64o&lwB}lL)(q%QNxCq=_<5UW(ZZ$Dt!ZiDHHx&81|p1 zpFwwuss@iDNv?!6N4ySF%$nXBUi>@lDt!qk%FMF(?UXIkgqCzEN>@liD7 zG@Z_ouQRB!LuzMlGshQ5cRfr5-_z@GJtMs=9p!eIi3S)nU&Q`}LBlt}QfYEkI~bl@ zJ9ox~o2LUg$=xe8${nZONK_Lj6L=K`fJt4gzlML6`L?z_aI;82Dixn>Fx*RK`ZCB&svvf`0?|o;aQxZL-GQ%$Zu2DgGE|d z^VeN1DJIz~EL!+(#BJ>^7@xb&)`$v7s%d1${YcS<@QDHXI)LN3A6P5wcai#hCEA_q zqi3KGby@j~#nk`LSxhvB#bnkda-DpSrjPDyl1>BN40n;&O;#6XSIH&ll8!18x)m5F` z?SrBwc*Md?4eiKV7O|~auuoG@M%rY=7SjvIe^uT}v>3BVGjT1Udbfc|S9ll>vrY8> zA81h|j=_y)>#{+C+0VHSF6|`hxtj!3)R}eX>rHz&l1HNMB#AVSJd@zwtEy`~7e_Sq zX-Ez5OGzWm4~Imbo-TNdK2Z|KdS-{1v)jAg(x@7{?+?sPz)YV`x+lI*P9>6%1u-tG zY>^I*f({%!m<``M!mC{z8UvnDl65*?41SH}isGEJE+@e;n&ve-qQ?Q zP5jMaFN%G4{Do;CNuvQS&H@8)9@VAoS#V^) z#;CBw2eCso+H&u20tN3fXAW2y8Cwch=t<%cArdpq8%jUFu#SGIza!3*p113tlZ%lS zZo>>M!*)(A<9WWZ#2RlfCYP?T7^XP~weEp*3f4crvw$cae{?G<{sIB(I^3yJ;RXcR z8hx1z0D?XJca^oMP^x@5T@B%tVBI3dqnAY{>zRk~+!Ig<< zgGtCwH<662+~Gv;KK%E`OBRq+CM_uTaNc)frW8|wR1p^|w_2C9t!j({FwFKB01KIK za0s@YYkZ+qW)Q)E7?)}Ya77lw!GPPbyU2mikIe>IESdnqMC6M6<_C_6;2xD%GsKJh zx&_(maYgef{u08u51UCYMpbi_N_l+%f4jB+*4MfbriFH9LK+3=sU{CPcnULv)~GPV z_s0RkN%Zf9J2Ai>LkhQ|hZCK%Kk=F>gu88hFsm4}_huKCUOWcu0iMI#J12|@r|Q9Z zdYwKo-S%XKg)iZM$RN^PaYWdX7H%8Y)@ZEFnv<*Xn~mmRyMe#&VPahfL<=460qH-2 zzZnlESu4Hr*)b8DzmYVTGS*z7PW5Wztzg0jpJ+3IZ0$kyskV~nw94ionFg-Hu0_0T2bB5i+OBTYb?9? zW?pKvS2XWktTm3`Hccj?hqkB~B>(2SE9Os!sG4S{5_44xJpvwwoFshBaktsQ8+{TEe9=Uh9{q%GoCqIR*UfdgZ=7N;9xK5EmTkSLr%rtzv{z~ztSto~C zTUV;!?K4xVa>*~oekbGQD7bfLKV!NJArcWv8r2+f;(WFbr2=tT+JGDmq+=I|`12)6eb zKh6s-X}vM$Y@#5k^HOp@R~if^=h%#Vv<_V6JJ)(`O@9JvL-l)GD`w3_1?d)hFBv)kS-)#!qx_UaiMl%l>Buw@eaMUd*il)^{b z4X?~*BG$%Gcl27i^8sF^2jRZN<;XJBB zI^ApT8!H9mIdT!t5co-!Bt-J4eSYQks6Ro6XXW`|*Wp^m*%~yf3Cd0F?LwTA7CzPn zAL0|B@El%gCX3P~xwzOHQ$7Cb4duG$3gk^Iz4|XmT*nf;hLPvn$ii6X8tBf%W-knS z`1&^W5e}`T$8ly9rSJp!X0{)n7-@ho1xD+C$pDa}=`R%bkwB_TtGXy+%o-9SL{T(T z%8_au!IF5Oo-MH-NH~L|{gsI7m&VY2M=E~9C-ns2vS!qos@O+M1@JYe)h7tCemf<+o2*|6Vabd(ydjs2`&|c3~7h|@DJ9YEpK;9R~-{vIA%>cSbM^ozyRe-S`ZYrL0h*8CwuJ%=F zuzwbD!_Lp}=b3No(VkiAd8&lrX;9<4{eO(Y)l?|_C5ryW8+fHr>lrHUwHV<~GMwsi z9ZLhB#@BYwUT2giG(LfUQx5c22%4QKr1{RFsdtN}hd_%)TbU@+Hpz-P?rR z-GzddOK}EmxI%_hzFdEFr#4a9Ygcw`@1VHO!q^tQ()w+GAf@>v?n2!9G>FV?v*mGd zNa8pMT7I$sS*}%NVjOPvXnKwiH=RH!QGTRUsu)q z*;r`P({=$uKP1=ZPoxuzrE|@ix9UlWnUIZ_)5dSp~Oqk+WjUE)o73 zy|H}vkDQ~|s$N4wZSG7VKXQBHw0sL6*RN{jBQEbb&N_|ny&Gq4Ze}%SHOY6+*7H;g zhee#ofALM>r!3c2Kwl4%AZzpMr0$$yU&fkWeW7yI-W14Hg-?gckszCtNL`uGdeD8n zK1EKaC5xwYl{Z(DSaGyRR`j@yW*H$fAwoXpe`sm295Y;y-pZ2b_0P$IZAJ#cf8-+d zP>(2+`-!rFXRveq5-csBAUk$KfY0w{f(<2=QHD5Etpd}|(`V<@&Go4IP+q9c|?AiNUf#~nwOQGHGB?SH#*acY&ZO*&_<2et|8q+W?pRmI8H0JkiSJOE-$kl z&Psqa6*g^uef?njyr^tKGY=u|vj&l3{B?0o;FF&~pNW3#Mt>1go9a>RUnUAsee zE#+5oK0XFjh+ASS*N~r9$pgMWU%YR_e0r-+2^N97pMXSFTT2-qE@mV)S#Uw58nzN z3YOg=VGkXMf3qlDD{S+#(ZklsmLuWIA@Awzyc zDU%*hgFDPz@1^{_U(|fsZ0LH3XyOwURYW$U1?HeGszKv-D8G=t=&dzN#%~1iPjjRa z-qP`*g@)I_&mc<6I_32%aa|RrlJ4&kgiRg~Z1-4s?*|k+iO)Xr2|2DozMmcOQPkr; zH=l%q^ESHpfe${OW3GwDi@)ufZPHHW@<3%JC{eF6&X@%V&iFi6h`9?p`=y}j(IZMi zUZdPATkbk(5<~E^(*p>pzbGvdcfPBe{YuL->ho$r^V@>;6IRUvX;fk|Yh$Z!&cKJh zr6eHqUF6oMm8W09f!26!DPpXx%M9{<17~IXu4kBHoa7XCZHn_f3fFk{S-)RkBIJBq z=R?0#9B<)NdYQ$&T$Zga#|CjNFA=Jwa|WkVL6co+Ch&xpTtl3|TH7^?;?3_GbpxbT z<~UGiQDfzbQQeiKc`-XM)TUk6Fz7^F%<#GFZ-Lt5U!X3#RBw_%Lo}_!#ewd`B#%|A z;i-yg-D*^cDeTY+X=Xcne{1XbjBu{_z#A=@-_Xy^^sz8i@`osJ*M1(bsl#mjMC4aD zZ^uF;uOUG`$6%7l**#mZNsAKF{nxS`;0n|+rz0#3BX7CZ-5*}{C#(jVkD=ECyF6|*5dZ<&mzx&-f!jy6+jXYP$DW0;y z0LWxn2vazAxu#*_#W1Z}1**QZJe08IZLjsb=4T12=_Gw__WPn(Uj7bPAMeH7hHEd= z7T(~ugDOxqqD&|RDIEF*U=C?U@yT!{#Mc9|+!l9@)Z~d=lDirA@@>4h)27hE6RECPN;E23wfsySL=7zk ziy9F|uux9KLEXOH%P&9hAh8j{X?YU0wHD}8`vE;OiinFZDHpn{>jbJgilsU;MSI0K ztv~{S?FnKcpMIh(Ft2(|Y@P0-Z z=atmGOqcDS5a2ExBjZI{^r5cfJ~)F6dLdX?*m3gDr8IVIxr#Vyhzpl`^g5fK$mflA z_X8dfB`kJgLARJ7DlM~`t=p>Rkn+beO)PnD;# zvK_e1YEiD*@B&|K?1S^z9P0@pXZi)<=@<{hwP*Md$PT^9XqzevylL5bH@McHTB~sD zo;}dJrDs-&_?1I3)o!%$MAtrMvMq`?5-AqWYWK(T@Tw|_A$Q-W!eFO>G%my1{BowQ z<{FJv!MDXbh^|m&pjzr8$E^-_z53qkq|QJa*cHzu0%6K-D3sK` zy5QtBmVAxw8OpjPG)#(odIGOSwTc5$+`v`kG3jM5o>i2JPHZ9oZKaxsPW*1NXbJZ; ztejY(t>g{C@oswI89>nO9!#<`l^smMY z-gg%#C~j7dV9@&FyCF|XRvwh6ZE>Gj70=msuatZm>z$AGhu0#{SJ>heuxk#Vp6VP|H$8144a)XR)kG1{NGRE%M?5fUQQ6!G z!JUmBx$`X4g>Nf*Met4L>e|6B#ABi#6w5jIre=QemeFoUp2s1w0Nbno>qGTl>z$c8 z`bb$lt2#SUygXxhSKXiseCGxgK6qCn@75=Sz1Eg#RmCWhlI2FGCP^@Ieg2MiB*VF! zSC2IVvN~GhTm&}%3a44oa>b;tx~^$Q;Dd$ew}AO1B|Uz&w*%XB9i08`X5up=m7jfY zrJYm;n~&Sf4iwUOZ~0p~8|c{GjZY+iub4Dx9sbJqc)xdGS10#frvV=QfhBLd*pw9_v>3zuH$1poj5 literal 0 HcmV?d00001 diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 8def5b6bb7..fadfcdb39f 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -138,6 +138,10 @@ If you cannot use Group Policy preferences to manage the per-user services, you > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. +Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: + +![Create per-user services in disabled state](media/user-service-flag.png) + ### Manage template services by modifying the Windows image If you're using custom images to deploy Windows, you can modify the Startup Type for the template services as part of the normal imaging process. From 06c86694feda96e93adbda65c6e42b9aa905ccbc Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 21 Sep 2017 12:18:59 -0700 Subject: [PATCH 63/76] change Store in Surface --- ...ploy-surface-app-with-windows-store-for-business.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md index 52626b026e..a9d29612a7 100644 --- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md +++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md @@ -19,7 +19,7 @@ author: miladCA >[!NOTE] >The Surface app ships in Surface Studio. -The Surface app is a lightweight Windows Store app that provides control of many Surface-specific settings and options, including: +The Surface app is a lightweight Microsoft Store app that provides control of many Surface-specific settings and options, including: * Enable or disable the Windows button on the Surface device @@ -31,11 +31,11 @@ The Surface app is a lightweight Windows Store app that provides control of many * Quick access to support documentation and information for your device -If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Windows Store or your Microsoft Store for Business. +If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business. ##Surface app overview -The Surface app is available as a free download from the [Windows Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Windows Store, but if your organization uses Microsoft Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Microsoft Store for Business, see [Microsoft Store for Business](https://technet.microsoft.com/windows/store-for-business) in the Windows TechCenter. +The Surface app is available as a free download from the [Microsoft Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Microsoft Store, but if your organization uses Microsoft Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Microsoft Store for Business, see [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/) in the Windows TechCenter. ##Add Surface app to a Microsoft Store for Business account @@ -45,7 +45,7 @@ Before users can install or deploy an app from a company’s Microsoft Store for 2. Log on to the portal. -3. Enable offline licensing: click **Manage->Store settings**, and then select the **Show offline licensed apps to people shopping in the store** checkbox, as shown in Figure 1. For more information about Microsoft Store for Business app licensing models, see [Apps in Microsoft Store for Business](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing_model).

+3. Enable offline licensing: click **Manage->Store settings**, and then select the **Show offline licensed apps to people shopping in the store** checkbox, as shown in Figure 1. For more information about Microsoft Store for Business app licensing models, see [Apps in Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/).

![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")
*Figure 1. Enable apps for offline use* @@ -113,7 +113,7 @@ The following procedure provisions the Surface app onto your computer and makes Add-AppxProvisionedPackage –Online –PackagePath \ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath \ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml ``` - Where `` is the folder where you downloaded the AppxBundle and license file from the Windows Store for Business account. + Where `` is the folder where you downloaded the AppxBundle and license file from the Microsoft Store for Business account. For example, if you downloaded the files to c:\Temp, the command you run is: ```` From 995995766e299fa67b38ea7ce0cc893e68970551 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Thu, 21 Sep 2017 12:26:00 -0700 Subject: [PATCH 64/76] Store --- ...ows-10-mobile-to-azure-active-directory.md | 8 +-- .../manage-corporate-devices.md | 2 +- ...-in-your-organization-modern-management.md | 2 +- .../windows-10-mobile-and-mdm.md | 50 +++++++++---------- 4 files changed, 31 insertions(+), 31 deletions(-) diff --git a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md index 3536562d23..588cc4a26f 100644 --- a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md @@ -34,7 +34,7 @@ When a device running Windows 10 Mobile is joined to Azure AD, the device can e - Enable enterprise roaming of settings. (Not currently supported but on roadmap) -- Use Windows Store for Business to target applications to users. +- Use Microsoft Store for Business to target applications to users. ## Are you upgrading current devices to Windows 10 Mobile? @@ -58,7 +58,7 @@ Even though Azure AD Join on Windows 10 Mobile provides the best overall experi - You can add access to Azure AD-backed resources on the device without resetting the device. -However, neither of these methods provides SSO in the Windows Store or SSO to resources on-premises, and does not provide the ability to roam settings based on the Azure AD account using enterprise roaming. [Learn about enterprise state roaming in Azure AD.](https://go.microsoft.com/fwlink/p/?LinkId=734996) +However, neither of these methods provides SSO in the Microsoft Store or SSO to resources on-premises, and does not provide the ability to roam settings based on the Azure AD account using enterprise roaming. [Learn about enterprise state roaming in Azure AD.](https://go.microsoft.com/fwlink/p/?LinkId=734996) Using **Settings** > **Accounts** > **Your email and accounts** > **Add work or school account**, users can add their Azure AD account to the device. Alternatively, a work account can be added when the user signs in to an application like Mail, Word, etc. If you [enable auto-enrollment in your MDM settings](https://go.microsoft.com/fwlink/p/?LinkID=691615), the device will automatically be enrolled in MDM. @@ -188,10 +188,10 @@ To see the Notebooks that your Azure AD account has access to, tap **More Notebo ![see more notebooks](images/aadjonenote3.jpg) -## Use Windows Store for Business +## Use Microsoft Store for Business -[Microsoft Store for Business](/microsoft-store/index) allows you to specify applications to be available to your users in the Windows Store application. These applications show up on a tab titled for your company. Applications approved in the Microsoft Store for Business portal can be installed by users. +[Microsoft Store for Business](/microsoft-store/index) allows you to specify applications to be available to your users in the Microsoft Store application. These applications show up on a tab titled for your company. Applications approved in the Microsoft Store for Business portal can be installed by users. ![company tab on store](images/aadjwsfb.jpg) diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index 78ca7c8d39..f946781086 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -27,7 +27,7 @@ You can use the same management tools to manage all device types running Windows | --- | --- | | [Manage Windows 10 in your organization - transitioning to modern management](manage-windows-10-in-your-organization-modern-management.md) | Strategies for deploying and managing Windows 10, including deploying Windows 10 in a mixed environment | | [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) | How to use Remote Desktop Connection to connect to an Azure AD-joined PC | -| [Manage Windows 10 and Windows Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | +| [Manage Windows 10 and Microsoft Store tips, tricks, and suggestions](/windows/configuration/manage-tips-and-suggestions) | Options to manage user experiences to provide a consistent and predictable experience for employees | | [New policies for Windows 10](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | | [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | | [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) | Changes to the Group Policy settings that you use to manage Start | diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 396ee16956..34b1af8c9f 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -38,7 +38,7 @@ Windows 10 offers a range of management options, as shown in the following diagr The path to modern IT -As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Windows Store for Business. +As indicated in the diagram, Microsoft continues to provide support for deep manageability and security through technologies like Group Policy, Active Directory, and System Center Configuration Manager. It also delivers a “mobile-first, cloud-first” approach of simplified, modern management using cloud-based device management solutions such as Microsoft Enterprise Mobility + Security (EMS). Future Windows innovations, delivered through Windows as a Service, are complemented by cloud services like Microsoft Intune, Azure Active Directory, Azure Information Protection, Office 365, and the Microsoft Store for Business. ## Deployment and Provisioning diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index 390d23a40e..2672e10bc4 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -40,7 +40,7 @@ Windows 10 includes comprehensive MDM capabilities that can be managed by Micros The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. -Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Windows Store for Business, or by using their MDM system, which can also work with the Windows Store for Business for public store apps. +Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps. Knowing who owns the device and what the employee will use it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. @@ -200,8 +200,8 @@ For more information about health attestation in Windows 10 Mobile, see the [Win **Windows Update for Business** Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. -**Windows Store for Business** -The Windows Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps. +**Microsoft Store for Business** +The Microsoft Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps. ## Configure @@ -216,7 +216,7 @@ Not all MDM systems support every setting described in this guide. Some support Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization will reduce the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. -- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Windows Store, Xbox, or Groove. +- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove. - **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than Microsoft accounts. ### Email accounts @@ -304,7 +304,7 @@ In addition to SCEP certificate management, Windows 10 Mobile supports deploymen Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. ->**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Windows Store. This Windows 10 Mobile app can help you: +>**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: - View a summary of all personal certificates - View the details of individual certificates - View the certificates used for VPN, Wi-Fi, and email authentication @@ -403,7 +403,7 @@ For more details on proxy settings, see [CM_ProxyEntries CSP](https://msdn.micro *Applies to: Corporate and personal devices* -Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Windows Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Windows Store using your MDM system (see App Management). +Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point to Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management). You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: @@ -421,11 +421,11 @@ To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such a >**Note:** The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard will walk you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. -Windows Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: +Microsoft Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: - **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address - **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (e.g., authentication information) that the plugin provider requires -- **Windows Store VPN plugin family name** Specifies the Windows Store package family name for the Windows Store–based VPN plugin +- **Microsoft Store VPN plugin family name** Specifies the Microsoft Store package family name for the Microsoft Store–based VPN plugin In addition, you can specify per VPN Profile: @@ -491,36 +491,36 @@ Windows 10 makes it possible to develop apps that work seamlessly across multipl For compatibility with existing apps, Windows Phone 8.1 apps still run on Windows 10 Mobile devices, easing the migration to the newest platform. Microsoft recommend migrating your apps to UWP to take full advantage of the improvements in Windows 10 Mobile. In addition, bridges have been developed to easily and quickly update existing Windows Phone 8.1 (Silverlight) and iOS apps to the UWP. -Microsoft also made it easier for organizations to license and purchase UWP apps via Windows Store for Business and deploy them to employee devices using the Windows Store, or an MDM system, that can be integrated with the Windows Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security. +Microsoft also made it easier for organizations to license and purchase UWP apps via Microsoft Store for Business and deploy them to employee devices using the Microsoft Store, or an MDM system, that can be integrated with the Microsoft Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security. To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/en-us/library/windows/apps/dn894631.aspx) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](https://msdn.microsoft.com/en-us/windows/uwp/porting/index). -### Windows Store for Business: Sourcing the right app +### Microsoft Store for Business: Sourcing the right app *Applies to: Corporate and personal devices* -The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Windows Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Windows Store. With the Windows Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Windows Store, without the need for MSAs on Windows 10 devices. +The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Microsoft Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Microsoft Store. With the Microsoft Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Microsoft Store, without the need for MSAs on Windows 10 devices. -Windows Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices. +Microsoft Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices. -Azure AD authenticated managers have access to Windows Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Windows Store for Business here). Windows Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Windows Store for Business by request. You can also integrate their Windows Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Windows Store for Business. +Azure AD authenticated managers have access to Microsoft Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Microsoft Store for Business here). Microsoft Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Microsoft Store for Business by request. You can also integrate their Microsoft Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Microsoft Store for Business. -Windows Store for Business supports app distribution under two licensing models: online and offline. +Microsoft Store for Business supports app distribution under two licensing models: online and offline. The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. Corporate device users will find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system app catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. -Online licensed apps do not need to be transferred or downloaded from the Windows Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Windows Store for Business reclaims the license so it can be used for another user or on another device. +Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it will automatically be installed from the cloud. Also, apps will be automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device. -To distribute an app offline (organization-managed), the app must be downloaded from the Windows Store for Business. This can be accomplished in the Windows Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Windows Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Windows Store, then you must obtain the files directly from the developer or use the online licensing method. +To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method. -To install acquired Windows Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Windows Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. +To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Microsoft Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. -Windows Store apps or LOB apps that have been uploaded to the Windows Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Windows Store certificates. LOB apps that are uploaded to the Windows Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. +Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 Mobile Enterprise edition. -Learn more about the [Windows Store for Business](/microsoft-store/index). +Learn more about the [Microsoft Store for Business](/microsoft-store/index). ### Managing apps @@ -528,19 +528,19 @@ Learn more about the [Windows Store for Business](/microsoft-store/index). IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. -Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Windows Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Windows Store. +Windows 10 Mobile includes AppLocker, which enables administrators to create allow or disallow (sometimes also called whitelist/blacklist) lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allow or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store. For more details, see [AppLocker CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn920019(v=vs.85).aspx). In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM. - **Allow All Trusted Apps** Whether users can sideload apps on the device. -- **Allow App Store Auto Update** Whether automatic updates of apps from Windows Store are allowed. +- **Allow App Store Auto Update** Whether automatic updates of apps from Microsoft Store are allowed. - **Allow Developer Unlock** Whether developer unlock is allowed. - **Allow Shared User App Data** Whether multiple users of the same app can share data. -- **Allow Store** Whether Windows Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. +- **Allow Store** Whether Microsoft Store app is allowed to run. This will completely block the user from installing apps from the Store, but will still allow app distribution through an MDM system. - **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allow or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. -- **Disable Store Originated Apps** Disables the launch of all apps from Windows Store that came pre-installed or were downloaded before the policy was applied. +- **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied. - **Require Private Store Only** Whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. - **Restrict App Data to System Volume** Whether app data is allowed only on the system drive or can be stored on an SD card. - **Restrict App to System Volume** Whether app installation is allowed only to the system drive or can be installed on an SD card. @@ -1035,7 +1035,7 @@ The remote assistance features in Windows 10 Mobile help resolve issues that use These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. ->**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Windows Store. +>**Remote control software** Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store. ## Retire @@ -1065,7 +1065,7 @@ A better option than wiping the entire device is to use Windows Information Prot - [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050) - [Enterprise Mobility + Security](https://go.microsoft.com/fwlink/p/?LinkId=723984) - [Overview of Mobile Device Management for Office 365](https://go.microsoft.com/fwlink/p/?LinkId=734052) -- [Windows Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=722910) +- [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=722910) ## Revision History From 36fce8140b5c5d2cd53a4d13b77870349d7be215 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 22 Sep 2017 13:36:36 -0700 Subject: [PATCH 65/76] update Store in /mdm --- .../client-management/mdm/applocker-csp.md | 2 +- .../mdm/device-update-management.md | 6 +- .../mdm/enterprise-app-management.md | 34 ++-- .../mdm/enterprisemodernappmanagement-csp.md | 12 +- windows/client-management/mdm/firewall-csp.md | 2 +- .../mdm/firewall-ddf-file.md | 2 +- ...ent-tool-for-windows-store-for-business.md | 6 +- ...ew-in-windows-mdm-enrollment-management.md | 2 +- .../mdm/policy-csp-applicationmanagement.md | 6 +- .../mdm/policy-csp-privacy.md | 90 ++++----- .../mdm/policy-csp-system.md | 2 +- .../mdm/policy-csp-update.md | 6 +- .../client-management/mdm/policy-ddf-file.md | 172 +++++++++--------- .../mdm/push-notification-windows-mdm.md | 4 +- windows/client-management/mdm/vpnv2-csp.md | 6 +- 15 files changed, 176 insertions(+), 176 deletions(-) diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 2737a54616..e0eb928b60 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -120,7 +120,7 @@ In addition, each **Grouping** node contains one or more of the following nodes:

StoreApps

-

Defines restrictions for running apps from the Windows Store.

+

Defines restrictions for running apps from the Microsoft Store.

Supported operations are Get, Add, Delete, and Replace.

diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 1edda04b19..68de7f9bb2 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -230,11 +230,11 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise -

Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Windows Store. +

Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft. -

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Windows Store +

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft -

Enabling this policy will disable that functionality, and may cause connection to public services such as the Windows Store to stop working. +

Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft to stop working.

The following list shows the supported values: diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index fd6c08650e..f210212445 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -31,8 +31,8 @@ Windows 10 offers the ability for management servers to: Windows 10 lets you inventory all apps deployed to a user and all apps for all users of a device on Windows 10 for desktop editions. The [EnterpriseModernAppManagement](enterprisemodernappmanagement-csp.md) configuration service provider (CSP) inventories packaged apps and does not include traditional Win32 apps installed via MSI or executables. When the apps are inventoried they are separated based on the following app classifications: -- Store - Apps that are from the Windows Store. Apps can be directly installed from the Store or delivered with the enterprise from the Store for Business -- nonStore - Apps that were not acquired from the Windows Store. +- Store - Apps that are from the Microsoft Store. Apps can be directly installed from the Store or delivered with the enterprise from the Store for Business +- nonStore - Apps that were not acquired from the Microsoft Store. - System - Apps that are part of the OS. You cannot uninstall these apps. This classification is read-only and can only be inventoried. These classifications are represented as nodes in the EnterpriseModernAppManagement CSP. @@ -151,9 +151,9 @@ There are two basic types of apps you can deploy: Store apps and enterprise sign ### Unlock the device for non-Store apps -To deploy app that are not from the Windows Store, you must configure the ApplicationManagement/AllowAllTrustedApps policy. This policy allows the installation of non-Store apps on the device provided that there is a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. For more information about deploying user license, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). +To deploy app that are not from the Microsoft Store, you must configure the ApplicationManagement/AllowAllTrustedApps policy. This policy allows the installation of non-Store apps on the device provided that there is a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. For more information about deploying user license, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). -The AllowAllTrustedApps policy enables the installation apps that are trusted by a certificate in the Trusted People on the device or a root certificate in the Trusted Root of the device. The policy is not configured by default, which means only apps from the Windows Store can be installed. If the management server implicitly sets the value to off, the setting is disabled in the settings panel on the device. +The AllowAllTrustedApps policy enables the installation apps that are trusted by a certificate in the Trusted People on the device or a root certificate in the Trusted Root of the device. The policy is not configured by default, which means only apps from the Microsoft Store can be installed. If the management server implicitly sets the value to off, the setting is disabled in the settings panel on the device. For more information about the AllowAllTrustedApps policy, see [Policy CSP](policy-configuration-service-provider.md). @@ -189,7 +189,7 @@ Here are some examples. Development of apps on Windows 10 no longer requires a special license. You can enable debugging and deployment of non-packaged apps using ApplicationManagement/AllowDeveloperUnlock policy in Policy CSP. -AllowDeveloperUnlock policy enables the development mode on the device. The AllowDeveloperUnlock is not configured by default, which means only Windows Store apps can be installed. If the management server explicitly sets the value to off, the setting is disabled in the settings panel on the device. +AllowDeveloperUnlock policy enables the development mode on the device. The AllowDeveloperUnlock is not configured by default, which means only Microsoft Store apps can be installed. If the management server explicitly sets the value to off, the setting is disabled in the settings panel on the device. Deployment of apps to Windows 10 for desktop editions requires that there is a chain to a certificate on the device. The app can be signed with a root certificate on the device (such as Symantec Enterprise), an enterprise owned root certificate, or a peer trust certificate deployed on the device. Deployment to Windows 10 Mobile does not validate whether the non-Store apps have a valid root of trust on the device. @@ -225,19 +225,19 @@ Here is an example. ## Install your apps -You can install apps to a specific user or to all users of a device. Apps are installed directly from the Windows Store or in some cases from a host location, such as a local disk, UNC path, or HTTPS location. Use the AppInstallation node of the [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) to install apps. +You can install apps to a specific user or to all users of a device. Apps are installed directly from the Microsoft Store or in some cases from a host location, such as a local disk, UNC path, or HTTPS location. Use the AppInstallation node of the [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) to install apps. ### Deploy apps to user from the Store -To deploy an app to a user directly from the Windows Store, the management server performs an Add and Exec commands on the AppInstallation node of the EnterpriseModernAppManagement CSP. This is only supported in the user context and not supported in the device context. +To deploy an app to a user directly from the Microsoft Store, the management server performs an Add and Exec commands on the AppInstallation node of the EnterpriseModernAppManagement CSP. This is only supported in the user context and not supported in the device context. -If you purchased an app from the Store for Business and the app is specified for an online license, the app and license must be acquired directly from the Windows Store. +If you purchased an app from the Store for Business and the app is specified for an online license, the app and license must be acquired directly from the Microsoft Store. Here are the requirements for this scenario: - The app is assigned to a user Azure Active Directory (AAD) identity in the Store for Business. You can do this directly in the Store for Business or through a management server. -- The device requires connectivity to the Windows Store. -- Windows Store services must be enabled on the device. Note that the UI for the Windows Store can be disabled by the enterprise admin. +- The device requires connectivity to the Microsoft Store. +- Microsoft Store services must be enabled on the device. Note that the UI for the Microsoft Store can be disabled by the enterprise admin. - The user must be signed in with their AAD identity. Here are some examples. @@ -303,7 +303,7 @@ Here are the requirements for this scenario: - The location of the app can be a local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_ - The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. -- The device does not need to have connectivity to the Windows Store, store services, or the have the Windows Store UI be enabled. +- The device does not need to have connectivity to the Microsoft Store, store services, or the have the Microsoft Store UI be enabled. - The user must be logged in, but association with AAD identity is not required. > **Note**  You must unlock the device to deploy nonStore apps or you must deploy the app license before deploying the offline apps. For details, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). @@ -420,7 +420,7 @@ Here are the requirements for this scenario: - The location of the app can be the local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_ - The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. -- The device does not need to have connectivity to the Windows Store, or store services enabled. +- The device does not need to have connectivity to the Microsoft Store, or store services enabled. - The device does not need any AAD identity or domain membership. - For nonStore app, your device must be unlocked. - For Store offline apps, the required licenses must be deployed prior to deploying the apps. @@ -584,8 +584,8 @@ The Data field value of 0 (zero) indicates sucess, otherwise it is an error code You can uninstall apps from users from Windows 10 devices. To uninstall an app, you delete it from the AppManagement node of the CSP. Within the AppManagement node, packages are organized based on their origin according to the following nodes: -- AppStore - These apps are for the Windows Store. Apps can be directly installed from the store or delivered to the enterprise from the Store for Business. -- nonStore - These apps that were not acquired from the Windows Store. +- AppStore - These apps are for the Microsoft Store. Apps can be directly installed from the store or delivered to the enterprise from the Store for Business. +- nonStore - These apps that were not acquired from the Microsoft Store. - System - These apps are part of the OS. You cannot uninstall these apps. To uninstall an app, you delete it under the origin node, package family name, and package full name. To uninstall a XAP, use the product ID in place of the package family nane and package full name. @@ -717,7 +717,7 @@ Apps installed on a device can be updated using the management server. Apps can ### Update apps directly from the store -To update an app from Windows Store, the device requires contact with the store services. +To update an app from Microsoft Store, the device requires contact with the store services. Here is an example of an update scan. @@ -760,7 +760,7 @@ A provisioned app automatically updates when an app update is sent to the user. You can prevent specific apps from being automatically updated. This allows you to turn on auto-updates for apps, with specific apps excluded as defined by the IT admin. -Turning off updates only applies to updates from the Windows Store at the device level. This feature is not available at a user level. You can still update an app if the offline packages is pushed from hosted install location. +Turning off updates only applies to updates from the Microsoft Store at the device level. This feature is not available at a user level. You can still update an app if the offline packages is pushed from hosted install location. Here is an example. @@ -821,7 +821,7 @@ Here is an example. ### Restrict AppData to the system volume -In Windows 10 Mobile IT administrators can set a policy to restrict user application data for a Windows Store app to the system volume, regardless of where the package is installed or moved. +In Windows 10 Mobile IT administrators can set a policy to restrict user application data for a Microsoft Store app to the system volume, regardless of where the package is installed or moved. > **Note**  The feature is only for Windows 10 Mobile. diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index f8a14b5289..42aced1bad 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -68,8 +68,8 @@ The following image shows the EnterpriseModernAppManagement configuration servic - PackageDetails - returns all inventory attributes of the package. This includes all information from PackageNames parameter, but does not validate RequiresReinstall. - RequiredReinstall - Validates the app status of the apps in the inventory query to determine if they require a reinstallation. This attribute may impact system performance depending on the number of apps installed. Requiring reinstall occurs when resource package updates or when the app is in a tampered state. - Source - specifies the app classification that aligns to the existing inventory nodes. You can use a specific filter or if no filter is specified then all sources will be returned. If no value is specified, all classifications are returned. Valid values are: - - AppStore - This classification is for apps that were acquired from Windows Store. These were apps directly installed from Windows Store or enterprise apps from Microsoft Store for Business. - - nonStore - This classification is for apps that were not acquired from the Windows Store. + - AppStore - This classification is for apps that were acquired from Microsoft Store. These were apps directly installed from Microsoft Store or enterprise apps from Microsoft Store for Business. + - nonStore - This classification is for apps that were not acquired from the Microsoft Store. - System - Apps that are part of the OS. You cannot uninstall these apps. This classification is read-only and can only be inventoried. - PackageTypeFilter - Specifies one or multiple types of packages you can use to query the user or device. Multiple values must be separated by |. Valid values are: @@ -163,7 +163,7 @@ The following image shows the EnterpriseModernAppManagement configuration servic ```` **AppManagement/nonStore** -

Used to manage enterprise apps or developer apps that were not acquired from the Windows Store. +

Used to manage enterprise apps or developer apps that were not acquired from the Microsoft Store.

Supported operation is Get. @@ -173,7 +173,7 @@ The following image shows the EnterpriseModernAppManagement configuration servic

Supported operation is Get. **AppManagement/AppStore** -

Required. Used for managing apps from the Windows Store. +

Required. Used for managing apps from the Microsoft Store.

Supported operations are Get and Delete. @@ -372,7 +372,7 @@ The following image shows the EnterpriseModernAppManagement configuration servic   **AppInstallation/*PackageFamilyName*/StoreInstall** -

Required. Command to perform an install of an app and a license from the Windows Store. +

Required. Command to perform an install of an app and a license from the Microsoft Store.

Supported operation is Execute, Add, Delete, and Get. @@ -438,7 +438,7 @@ The following image shows the EnterpriseModernAppManagement configuration servic

Added in Windows 10, version 1511. Required. Category of license that is used to classify various license sources. Valid value: - Unknown - unknown license category -- Retail - license sold through retail channels, typically from the Windows Store +- Retail - license sold through retail channels, typically from the Microsoft Store - Enterprise - license sold through the enterprise sales channel, typically from the Store for Business - OEM - license issued to an OEM - Developer - developer license, typically installed during the app development or side-loading scernarios. diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index ea9ebb3cb7..99740e166c 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -193,7 +193,7 @@ The following diagram shows the Firewall configuration service provider in tree

Supported operation is Get.

**FirewallRules/_FirewallRuleName_/App/PackageFamilyName** -

This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Windows Store application.

+

This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application.

Value type is string. Supported operations are Add, Get, Replace, and Delete.

**FirewallRules/_FirewallRuleName_/App/FilePath** diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index 7a8de5174f..72944197b3 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1341,7 +1341,7 @@ ServiceName - PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Windows Store application. + PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 02d281e49f..90364628ea 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -21,8 +21,8 @@ Here's the list of the available capabilities: - Support for enterprise identities – Enables end users within an organization to use the identity that has been provided to them within the organization. This enables an organization to retain control of the application and eliminates the need for an organization to maintain another set of identities for their users. - Bulk acquisition support of applications – Enables an IT administrator to acquire applications in bulk. IT departments can now take control over the procurement and distribution of applications. Previously, users acquire applications manually. -- License reclaim and re-use – Enables an enterprise to retain value in their purchases by allowing the ability to un-assign access to an application, and then reassign the application to another user. In Windows Store today, when a user with a Microsoft account leaves the organization he retains ownership of the application. -- Flexible distribution models for Windows Store apps – Allows the enterprise to integrate with an organization's infrastructure the processes to distribute applications to devices that are connected to Store for Business services and to devices without connectivity to the Store for Business services. +- License reclaim and re-use – Enables an enterprise to retain value in their purchases by allowing the ability to un-assign access to an application, and then reassign the application to another user. In Microsoft Store today, when a user with a Microsoft account leaves the organization he retains ownership of the application. +- Flexible distribution models for Microsoft Store apps – Allows the enterprise to integrate with an organization's infrastructure the processes to distribute applications to devices that are connected to Store for Business services and to devices without connectivity to the Store for Business services. - Custom Line of Business app support –Enables management and distribution of enterprise applications through the Store for Business. - Support for Windows desktop and mobile devices - The Store for Business supports both desktop and mobile devices. @@ -45,7 +45,7 @@ The Store for Business provides services that enable a management tool to synchr

Licensing models

Offline vs. Online

-

Online-licensed applications require connectivity to the Windows Store. Users require an Azure Active Directory identity and rely on the store services on the device to be able to acquire an application from the store. It is similar to how applications are acquired from the Windows Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.

+

Online-licensed applications require connectivity to the Microsoft Store. Users require an Azure Active Directory identity and rely on the store services on the device to be able to acquire an application from the store. It is similar to how applications are acquired from the Microsoft Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.

Offline-licensed applications enable an organization to use the application for imaging and for devices that may not have connectivity to the store or may not have Azure Active Directory. Offline-licensed application do not require connectivity to the store, however it can be updated directly from the store if the device has connectivity and the app update policies allow updates to be distributed via the store.

diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 50d3253a38..f186cb0be6 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1148,7 +1148,7 @@ The software version information from **DevDetail/SwV** does not match the versi To workaround this issue, remove the Windows Phone 8.1 publisher rule and add the specific product ID for each Silverlight app you want to allow to the allowed app list. -- Some apps (specifically those that are published in Windows Store as AppX Bundles) are blocked from installing even when they are included in the app list. +- Some apps (specifically those that are published in Microsoft Store as AppX Bundles) are blocked from installing even when they are included in the app list. No workaround is available at this time. An OS update to fix this issue is coming soon. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index db13ecc123..bb72e071a6 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -46,7 +46,7 @@ ms.date: 08/30/2017 -

Specifies whether non Windows Store apps are allowed. +

Specifies whether non Microsoft Store apps are allowed.

The following list shows the supported values: @@ -85,7 +85,7 @@ ms.date: 08/30/2017 -

Specifies whether automatic update of apps from Windows Store are allowed. +

Specifies whether automatic update of apps from Microsoft Store are allowed.

The following list shows the supported values: @@ -332,7 +332,7 @@ ms.date: 08/30/2017 -

Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Windows Store that came pre-installed or were downloaded. +

Added in Windows 10, version 1607. Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded.

The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index fae39d1341..2db8de6070 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -636,7 +636,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -667,7 +667,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -698,7 +698,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -768,7 +768,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -799,7 +799,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -830,7 +830,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -900,7 +900,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -931,7 +931,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -962,7 +962,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -1032,7 +1032,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -1063,7 +1063,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -1094,7 +1094,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -1164,7 +1164,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -1195,7 +1195,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -1226,7 +1226,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -1296,7 +1296,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -1327,7 +1327,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -1358,7 +1358,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -1428,7 +1428,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -1459,7 +1459,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -1490,7 +1490,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -1560,7 +1560,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -1591,7 +1591,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -1622,7 +1622,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -1692,7 +1692,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -1723,7 +1723,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -1754,7 +1754,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -1824,7 +1824,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -1855,7 +1855,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -1886,7 +1886,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -1948,7 +1948,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -1979,7 +1979,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -2010,7 +2010,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -2080,7 +2080,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -2111,7 +2111,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -2142,7 +2142,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -2212,7 +2212,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. @@ -2243,7 +2243,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. @@ -2274,7 +2274,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. @@ -2346,7 +2346,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. @@ -2377,7 +2377,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. @@ -2408,7 +2408,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. +

Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. @@ -2478,7 +2478,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -2509,7 +2509,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -2540,7 +2540,7 @@ The following list shows the supported values: -

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. +

Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index d077ea3454..b29a625a24 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -477,7 +477,7 @@ ADMX Info:

Added in Windows 10, version 1703. Allows IT Admins to prevent apps and features from working with files on OneDrive. If you enable this policy setting: * Users cannot access OneDrive from the OneDrive app or file picker. -* Windows Store apps cannot access OneDrive using the WinRT API. +* Microsoft Store apps cannot access OneDrive using the WinRT API. * OneDrive does not appear in the navigation pane in File Explorer. * OneDrive files are not kept in sync with the cloud. * Users cannot automatically upload photos and videos from the camera roll folder. diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 1bf1c34365..3d9957239d 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -318,11 +318,11 @@ This policy is accessible through the Update setting in the user interface or Gr -

Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Windows Store. +

Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. -

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Windows Store +

Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft Store -

Enabling this policy will disable that functionality, and may cause connection to public services such as the Windows Store to stop working. +

Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft Store to stop working.

The following list shows the supported values: diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 3e242783d4..3049402086 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -19470,7 +19470,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19494,7 +19494,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19518,7 +19518,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -31512,7 +31512,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -31536,7 +31536,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -31560,7 +31560,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -31608,7 +31608,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31632,7 +31632,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31656,7 +31656,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31704,7 +31704,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31728,7 +31728,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31752,7 +31752,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31800,7 +31800,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31824,7 +31824,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31848,7 +31848,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31896,7 +31896,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31920,7 +31920,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31944,7 +31944,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31992,7 +31992,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -32016,7 +32016,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -32040,7 +32040,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -32088,7 +32088,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -32112,7 +32112,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -32136,7 +32136,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -32184,7 +32184,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -32208,7 +32208,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -32232,7 +32232,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -32280,7 +32280,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -32304,7 +32304,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -32328,7 +32328,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -32376,7 +32376,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -32400,7 +32400,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -32424,7 +32424,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -32472,7 +32472,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -32496,7 +32496,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -32520,7 +32520,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -32568,7 +32568,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32592,7 +32592,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32616,7 +32616,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32856,7 +32856,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32880,7 +32880,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32904,7 +32904,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -35902,7 +35902,7 @@ The options are: - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. @@ -41148,7 +41148,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -41172,7 +41172,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -41196,7 +41196,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -53941,7 +53941,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53965,7 +53965,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53989,7 +53989,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -54036,7 +54036,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -54060,7 +54060,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -54084,7 +54084,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -54131,7 +54131,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -54155,7 +54155,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -54179,7 +54179,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -54226,7 +54226,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -54250,7 +54250,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -54274,7 +54274,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -54321,7 +54321,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -54345,7 +54345,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -54369,7 +54369,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -54416,7 +54416,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -54440,7 +54440,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -54464,7 +54464,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -54511,7 +54511,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -54535,7 +54535,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -54559,7 +54559,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -54606,7 +54606,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -54630,7 +54630,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -54654,7 +54654,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -54701,7 +54701,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -54725,7 +54725,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -54749,7 +54749,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -54796,7 +54796,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -54820,7 +54820,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -54844,7 +54844,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -54891,7 +54891,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54915,7 +54915,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54939,7 +54939,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54986,7 +54986,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -55010,7 +55010,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -55034,7 +55034,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -55271,7 +55271,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -55295,7 +55295,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -55319,7 +55319,7 @@ The options are: - List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -58356,7 +58356,7 @@ The options are: - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. 0 diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index d2734f6e16..4fbc202163 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -46,7 +46,7 @@ Note the following restrictions related to push notifications and WNS: ## Get WNS credentials and PFN for MDM push notification -To get a PFN and WNS credentials, you must create an Windows Store app. +To get a PFN and WNS credentials, you must create an Microsoft Store app. 1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. @@ -69,7 +69,7 @@ To get a PFN and WNS credentials, you must create an Windows Store app. 7. In the **Application Registration Portal** page, you will see the properties for the app that you created, such as: - Application Id - Application Secrets - - Windows Store Package SID, Application Identity, and Publisher. + - Microsoft Store Package SID, Application Identity, and Publisher. ![mdm push notification](images/push-notification7.png) 8. Click **Save**. diff --git a/windows/client-management/mdm/vpnv2-csp.md b/windows/client-management/mdm/vpnv2-csp.md index aa98ff54c0..ede7194396 100644 --- a/windows/client-management/mdm/vpnv2-csp.md +++ b/windows/client-management/mdm/vpnv2-csp.md @@ -64,7 +64,7 @@ App identity, which is either an app’s package family name or file path. The t **VPNv2/***ProfileName***/AppTriggerList/***appTriggerRowId***/App/Type** Returns the type of **App/Id**. This value can be either of the following: -- PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Windows Store application. +- PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. - FilePath - When this is returned, the App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. Value type is chr. Supported operation is Get. @@ -183,7 +183,7 @@ App identity for the app-based traffic filter. The value for this node can be one of the following: -- PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Windows Store application. +- PackageFamilyName - This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application. - FilePath - This App/Id value represents the full file path of the app. For example, `C:\Windows\System\Notepad.exe`. - SYSTEM – This value enables Kernel Drivers to send traffic through VPN (for example, PING or SMB). @@ -393,7 +393,7 @@ Added in Windows 10, version 1607. Comma Separated list of EKUs for the VPN Cli Value type is chr. Supported operations include Get, Add, Replace, and Delete. **VPNv2/***ProfileName***/PluginProfile** -Nodes under the PluginProfile are required when using a Windows Store based VPN plugin. +Nodes under the PluginProfile are required when using a Microsoft Store based VPN plugin. **VPNv2/***ProfileName***/PluginProfile/ServerUrlList** Required for plug-in profiles. Comma separated list of servers in URL, hostname, or IP format. From 4da484eedec2aa56353b951d3e85ff08c0ade30c Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 25 Sep 2017 13:51:57 -0700 Subject: [PATCH 66/76] fix typo --- windows/configuration/lock-down-windows-10-to-specific-apps.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 64859ceeb0..e2064f0f7a 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -40,7 +40,7 @@ If you don't want to use a provisioning package, you can deploy the configuratio ## Prerequisites -- (latest version of WCD -- is Store version okay at GA?) +- Windows Configuration Designer (Windows 10, version 1709) - The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 From 1bd800e88d7a212aa486177301e149e45766be95 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 25 Sep 2017 13:58:17 -0700 Subject: [PATCH 67/76] update art --- .../configuration/images/profile-config.png | Bin 42858 -> 36516 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/configuration/images/profile-config.png b/windows/configuration/images/profile-config.png index 473ad156eca9a18e94f3bd559a93019408431dfd..aa96f01058abc1507e77d14c39a5a76860728729 100644 GIT binary patch literal 36516 zcmagFV{~T0)-@WZW81dvPRF+GJh9WUZQHi3j%}l3v-8BhIp=-9A9sxJjyuQLs2{cW zu3EEdty;Bbgrd9z0xT{p2nYy*l%%LK2nZPK_kGU~sPA({OPbI31=Lwt;ulEm4F1`7 z0m4F9P8bBFAr9`{2=coO;~=T!3<82U^q&JXg$@x91SFP6N>o_&xBgWQv_HAn^61X- zZ?CR2XZbBhi5cO-!)z4MVfsSfNEE5UaN}Q~7#PBk5ERlgJSPr3C-rBXCpRDZay$1^ zGd8^;e`|#9%y8h%A^H(=sbDg|Gws#WPO4B z=JI0iznHf`IUu{6S$F^*X2~4slwA?=pha0=rAPr>i;6uY43Xl3Emw|{GjeGquDQvb zN>A!Li{|Lyc%m>HnSI8?-&QVL>w!+1M96dS z-Jn@^qNQ-rF|Hofl zx3;5$MYeNab4c?<4Il*!bN2J48|O`e*Qa-)P|ESAr_;aoJUAYvzk5mKF;AcRAhNNz zg2F6ozXnbX)zooi%XXhwN-uW}xCOelpNh)OYyNWp zXX7BSsaftwC+lX~r8Q;-VQnC@DCmdKZV^I}A)M2~gXHpn^k2-GS?QJum7O(wn)KS? zn>jaZ$O)(Wyc~Y9PnT=iml30bBaJeJG@nv*?0^h5PJ_pEen~p1%F+_C$_uEe4n7UrQ;+Wfc+%UT|0oiS^>(X(r^-me9q23ui4rwIXaX zO*P?WW*wrjMIO#D%_a~L@vU#n*w3aHfCsP>@E4C$nPXbLy8Nq;nR2ON__pleDBae; zAH~TupUh6Q*+*FDD8IWVy&U>EgH|c(IR`s)D^tb#j|-|Hay|h)yN?0H6(paJx!cx2 zr#Pt><*Fc1sEtL5LoI8n>68{Zr{UYA!$LC3iKT=MB3o+_A`afPSV0-nv73=&^p3|V z93Y=St&l}3YJ`^4-*vX5bCt4ji$?+mlc+{A(^9Y5$U;}_sL9X8DAScw{ue{Nl=q_! zSErlJEHe?0oM`N1k~Bgtsots-a)Ss=03`#Uf^id&PDq#|v3g!90%Trpke0CPlET#;VXsL@+6Ui0}h zehQV40HE^y^AZOr@mi?hIF(GNkZmOs0e8ph;s7Unv)xn}j*z7AfWQDOQHY-Zq}0MK#mh2P5$icLvpD_fm96WsV0x8B{CO?Efr2;ppq{l&cnX#P@Pas+yW2}m zHJ|)#@oB}0%G}B<(#Wb@qAn5P-rcH2=vk+ETvwM$qHPqL&8JGYjGn>DKMHH*70~{a zr*65Yqt^e+*v{9ehkjkxmi(mU2t!$SIlq{$+%3I-@Mg_JagUzq)nWMV`Sj;U!8JrA z{6DUV%jUmflSr|d#EUL2tp(lspKqbo8hEWMletN7Q~TUj4r{LsKKNiw97SxaOu4j7nh#ansz>}L0b>U<`-!zsmnMKv=uh-Tqh8*k&4(eO2;RqTgb+k(3v!~bg7WK+oV2$TiPA_ev?OIJG~TitxJ_) zvPlXzeA+N#i>s@za$*8rBs51cP%g9Lff`dNR%K+0Q`#FtvJk<*xZN#u_)v zuA(lUX-j6HvO}&R)UDg=aOYiNoxk7iwMnX8oYYP%T+Gl5ib|O~fZx_t#r8lISH~q> zhI~kMrcliPyb0uVLQr9OiQ<15*on9%Q6L?*C3n;LJbn570@Cj@Mj@lHBic;p#)-e= z!Fj?sVFtT$BqgGfBp2puRj0Ia>H9T=`?4T(Jb6_K|MmFJ`*JRXH754$Od>O($S{l? zgl-{@By&~7BY+zdg39LCf*KaM_j58V`T8nplg77t&@A;Do3#tl z3+Zi!q`Nk@H!AH2s5LGwP7$#&l!yuXO?r2n_a7%8RYNFjD?fy&^=WzWUD-buqW#v#ROPER~=5gjm5KTR{1e=WoKrAMs zIJOcr0a=Bse{fWnPEJ1mD7DzV zqqW$*IRwVmgg8B^T37~%BcBG!`-PppBm^}!FYr0Bnwa+XUJz$UcAWZklQs4W_&5H6 zhHXr*jB&C^$>Vd2k9E`K?`H%1$CcWd0IAhD84R}WIzZgCM1nW8&XrL8*o?4^vk;}c z;U!(5>vAaivV6u?T)5&&oqjdDZQVTn`FP6#9D~*&H`s(dAwlH9so*s%PxyL!Le+LCSP$^sS%X+|@O?$nx!ZK_7M zM$s?R3vDvE$tP!ytg^DX$#q6B%{T8n9*M6?%mI2u2vD#q+iC{|jB@yyMYipV=74v! zd;ROOm_oXAaX$AOC8q}(m7_U=P;8z`!1L)jbPhxg$wM-4SJ`<9&7ku%>F~?5%k3w( zE27$qRuRx_Rw~FWv6rdw&=vd8TE#h%$N!qA;-?#amOVJ*OxOX1EZ%{8rC?TLM&V0J zt?lN$qGYN=>Pj4dj6Fs>HXs&kD=#t8s?#mFwcmd#o^daL3V4H1=Q@34x@~%B6bn<34m!?SqsgZYG?H}yY!>^i) z(P=zNzd3HCEP)|lNb^1%xFzmHSGB^#ikph^GBMYgA;=sN1~o~MeG$X{C$pzRYLBzJ zXJ^V@ZKY692=S0k$&v6!sm~RA?a!NWrx$d90sa``GJj_2i*y$Wf{AKur#vn(Ie${` zj~wjQ5z&H#;8%BGtNI&ewd~z}2iv{=D?c#V0&KzoSZ|Z%`8m~VVwyZ6_Yt(@f)ufk zh7U-iAvIdp)TWtSO`8yOrWBnS+8>8383D2*k^K;=wiuu$1A>&uK=PPxEAo8#vp9`a zlbWPG_4bHKm~)8p1Di>SYF4@EzUXL?2z8n)x_6mJB?Zoe@zIR93?r2uHnCfE<#WCsz6&8 za8ABIaB!l^u1de2`G`+oA!1kUp^wis&ub|+RHWP2Rw{O|J70bz(@yFbY#Ro{4>-?F zk*Yj;2PbvNB(tWJ>eEeoyv43O5!B2QS`nVS$>LN`Q0eGvtJ|fpQBcU4W!11GT?d(C z-~u$eE5yHjl#X_JQ3D2tBR6p*2Li9v^28ZXH?EzTI3{AhxZ2W%>W1}~VAqZ%k9k?a zv7-3K(+bKbGKH&sb$PRk(hETK>uDUOv9I(a0@Ca_`thtsVuFfYA$~{a?j_+#hTd)> zku`+g_bnVoxm?s-%`wMYVzBIzb0C}lY302j$W!~E(D|1KF#EjIykmFQ(P^f)=#crU zSaK26GyW11ud?P-)S&Fai^oM!)>ly>ZWEw+s5@(<=2+8R{;;Jbx}kt%8?hj=rv~u7 zi}NpD|Q+vuIn!Kx6u+(=hzmE0%TwgOa+TCP>P#;2B?NU(^X zb& z7Q@+{w-VMNEx)tKDR}~)kyAweAu%euFvC83zC*5-o=h^U+1l~#@*94geLc62E9?KY z6tv2;xvEy}u!4S_9vq#d>57d9XJ=TFC>=q}Rw9>}Ca|)F^%3uGZV_m9F8fsSy{WBe z<~4O4+Fou{L7CokNIyyFJB7C9LivkM>tix{W)dd z*c8;3w{G@cNvYaa6yENrtQC9A(kC_$ujXMh@{sCQcCchKdq>13xK?KHddvs z50A<>T67n^gxVFe1v5{r0N-Y)My*d$3y$7?CTCL;{UYpO+?zeii84s`gw%6z>HmH7qjacVwh+JUT zLd2bS8Pyd0B`&Ko@lf!bds~8*MDb`#LM+``_U`#N*WlE6jPUYtJOR7j+_L>jQR>x~ zZ+l7Ya}v~iy@;ih7e$AsdZUrmTLG|4-pS<{oFF2Y1Thjy;gh}KG|l@2kD7?dTknUO zxUnQu5kLJsk>QoAr(0S)`EaAV_;rLTw=>>_kT!S*r?#VP5&kwzaimR@j^W>2tl4o@ z_(A0A8jW~*Mm72Thy5c#+O=2+HVmM`7c<)iXk_M0Rvn8(FstE~{tgX;I6kjH(M@_< zEzuupGgL=>TyZEzNM&|+dRKMV zyHq7x?akokSm#hi0&|uzR)pb~T@sERHxiWhc9z9M%mPOq`d_8-hFNh9ha5Mn@M`vy z5=hK6QNc)q0;?3kTo*0e=b-o`w^!dhb~I9LTjnWau+2ZtflgjTxl$!w)~+SJGOe-Z zKv|Tjm7OD<^Wtu(yzEq4X(lBzVI#K8K=ka+P06k=?CC6p8A2-p8RTOfEb8i#4aa(` zVYM+!ZKLWlbso@rLD|2UUw*M;Jgkcy0V9te zf(x`bHw2~mhP+7fXlJSI+i8u^y?Qyv(A?+ce>;S3eH>#pA zqr!d@I?1eNY+tiQtMP6hl0cfwU~A_`aiOX5P5+^DjBo!)lv@&l9FeAiza(tx>$H!q za?XE2vy4<%1vcWu>M9zm#j}#OjI;OCBA*>;$EZAI6`p|$oiiw2LXf&O)-7?x(R)LG zfm7lgnOI$R-cCzc46kHSPe(M_6-T0-Czf5M zcb-)J%W%dndDu`1;Q>r+pp-Ub)&lxF3re5@2d zp!)Q);oWO#=5ki{27B+}J$!D^;w>pNvWTI9sSuo!+{2q%^?XM+oRLFDP@vsJN0avl zRIdILq^SGjOPtPcRau7%UTKr+(ng8z${&(2JeNqq7nHwa z-yj<$x6`8#ykuERgP&Q!e{LE1;~qb|O9KpEi>MQ5Ryoz|A6Viz?<;UtC=C|hz8)5! zw8}e^1(P^gH5X;SB=f{Gw!iEm5*uLg##E^0IHs)r>7LVrC!Ov#e7sZD2zP|c2Z@%B zV`quH!JJ#BPmQUEx}R1TIQ5g59R0WoR%D&EwD5ZnscQB=^WG|tpCUG){^vh7*D&}9 z*sbrFrM51;^K%?mr+_%xtR{h`t-`M&4;=VB8mu~eEnBf9qf0L4L1-pTR;JA6BsLBu3bg>bSUNAn(x>Ws_bhE)T_s~BS8&DF^5=2(w}J#eUfV#r zN;QjJZ8h5qQnN6dA3T}huSLz|G(c)<%!bsQIU0?jPjQAh4kXKm*ry_m6q_{dk3|}0 zTyKk%V?XknK{Mzbajot`@(cI4I`t#1lE@1AT#b^*g@FDznyIC3`W5a)8&SV}LFdC= zdh2(gZtIG~yy?nh+Lr3cD*|!aqMbqln4*}aWOkgyJi8+AsmbiO83LJ0kNCXrg+49} z9w)WPWcdPbKE4kVI_ur}PPb2ln{P{|#sl!*8-?`mwn#*Hy@|FS@r!rIQ}1-|zrCX7 zRU@-(No4_@;e}f!P6f2J3FeSSIH%5)<+XmEF^N_u)KS04kxu_uO2~r$B*nC?Y~(!# zQb`*J8ldY1#SS3ms#&^vM5K;$*&C48m7|uvEA1D9iVaQlV5O;Jla%D{NsR<3sB_OjAl5wvx#veD;wgOdWt0 z{=%O`HRRdzThmN-^`N3!u01Viyl|y0*S^+G2&ku)b2R?)>Fmv?ews3Xs5eUiGxA=k zO_bE}a#AQpf5L%#c|PMa+qu{|xpycd-dp!o)itkSG@LgLzf;wE)sK%7*G4Cqm}Bc0 z*IxL;)AoAao<2l4?MQ@R%^FCl=g^f~DlGJ@ckmlq7GTJcQxpQP%2Cr>Tq|JntGidJ zcI90s-{Yb3Tyz7>BZ`7fY;j0qv%$Y03XtaB(=onZd|>7PB|Px@*6dcU>Bv!KmN){J zP=MH7I~4U4@~-@uOaTEu3HEYR+L&2G7OX3xSnK<{WGmlw;XEc0hu%YT(z0pNMKM%9 z?2uU?h~llcE%HbsuBO?uQyhlDlT(*colC7wvCM<(90n6*6GH|Pv)jZqUq*-chDpizel~4&Qb1d1UZb5qyW>Q15n#}1R#4g}J1*72FW9Gf z;gVDWXhijc0xaoFzz9S>1ouB7UF%z2g@J+uslO72!#B|)w<; z#Tw)Zx)&|I^-;;p9au|txNty)_f`^5jEh74Ip(9P?62(SD^;Oh3xCpFLcoa;1eQOj z(^|6Pt#=BaLFnP97lJ{K;9A?bV6JxPLam8eKJ~o}TtEbui58I0!{BEEIcZRb*kz45 z4__CNqY*5Q9AnW;CSPDM4}@GyIfIfPKLmHKj4sFV_;@c!aXRyvv^{iQLlgrZm{5(U zr6eb`-2y<0vFPR=6l#{=QpYi#m=u1$Kj)gY9xhLf(+G<)A`r_-kf|;pt*Gmmh#INL zr>AR3s3-r#1s~7}B<`sr(s76REZc_nI3Rck#RQaB`e z&C%cYW7NcdjeC{ekFlM|hN)Oq*7Ww5MLxL_#6YprG(40u1$e`AZLTq|XO|YSmFh6^ z8h6vIjJiO4eta>eSm$X{OuCA4lh2||5F?$sP@bP+|C~cxPGfGb?$koe;2HY-Tx`0y z@9=)$ljFNm#VLmU?6bF90opX9JSOk0SDqHR5`L$vA6j7}TE*}xRT9BbAUm{NBpEWr zHO#5C{PAsb0s^x3tq^#b=*bOZ5Fsp!T=F$(13Ni{$K$fV93Ma^qJ52mU*pnNvbH-O zBRCSPWCYMwx`74zvBS6iJrTKn?<{&R09_>knoD7_6l2^GdI&znr? zW_B>91xb|JDvmkB2Pr_x=FP~2L^_rHEu)sx(xW@=wO*dL+ z!?bk>cl%>;%_BVQZvL(ktO ztu#>ahhI};y==9g`~G>xi*gEdT5lz&s)%D(4R@gv7*w*UWGC<(1FN~dXRy4lp(Md7 z^K3@6P`=3Ar1R~DrC&bIMOs8t2bml6>1XX>gA{m2Fopv={5IXR*D$=V_+}UxC<9z} z1~!XG)DWLREr=_Dkksy6p1a*{p0Duqpu3P1JTs0_g933q^tn3w=zHbAuF?;r!3U6+ zofGcQgoQ`R%Dep$38TVQlu5&8%nhP%Iqlzv!AH}P#%IvrWZj;L(;lhIMdg+5>~2n} z_d?4wHk;9J+{#gL(GA$^iWE4Vt8+(5gO9>0@|{H14m!j%4&y2W95c-X zgwe4CDXF*_L2XwzEEP1M(?wRO09UdDBOgR+YcaVJK^a1VX^Iv0rXjF`VU4+{0q*|TG%Nsmb zvV{mkTQVCNnM?Q^9rI1r7C69ZY&8<{E|68r!I+$8rJkVt;*NCr<2OA0)vW?7yLxP`Zc(QUl|vC(A{I~2r|S1In3Pi8m=cB*K}r1ZU}&3+xa zpH1RD@6nXvS22jk#={0n^+*kH01s3Z==(5=FMp?e{_4wz^#B97PGa>Z zaZ(irOoHGPWWVI^&0Cth4X@%U?6YtNaJ5(H(t~>R{Jiu=r|^;S2^#N_`h1&t&({YX ztjVwKb>j~d*CZE6-t7Pv-VaEJk&tfhr?Cj9%tV^fK9aM%K92$|W?dX^twLkNs1^aa zN#sV5dUvCb6E%_)VFR4*3k3BAd^U5u${`Y?gC%Ade8)%T^;v|1yFyLNxJHZHH`>V0s$=b5CestRNewHkGpZ!1nk1i-W>(HJfu# zlED?e?9XXc7kp8zi89pl9JvN;0{n^rFlQ!&=M|m7PqHD14sL?x^!YS--+6Ol9(F2) z%YlKCFrLzV`z+u&-B{Sd>8neJ-h01x@NiBmMEVC*MhmDl19%A}o&&5KnFh2(Gcg~( ziN)1!ug9}!$73}Pt12|MEEzLcEH(c)XBUPigM0i@rRCWZpV;$`YGkN2F@mDU zYVDVawuw)R#joFoh(~fM51=-R1o?tNhVN{z<3#C#TTap(`jqSFWR0`Gn@`5M$M=o< z^A`;&@fseJ8cMINyIH>0*Rn+SVHdWkmW2S!5>0cIJFaCnBgAYIXt9a*ppYxdi z>PY98*td6wz1_r`ZRfml2~tZW%E=uAnM~}XYzPR6HsWyZ7*>noN4z}=@2^obud@u$%Cu4&>U7x+=694?{Sm!M#AdPCCZeTGGBe+J4SU`>Y z9uo7Aq-b^#0%-Cwwkv7&3Ev4(dB$ZWWW*xsq{-MkS|NV(#*ES13G)9g=a4MI(m78$^` z7JPS|KMjR`>iq<%HaY4>-wH#B+tOQT{-7eHWK*1yTC_{SFXN#5{aLCN3XR-xobGXN5Ss=m0v ziJY2iB5xXIyvsnKae`iE>grQ+C(3KT@JxjGXwMuEkFtt{^3pd7)eH&yolLVP*yQ@# z&2EP3arZ!Zx#dr;qIbzhntc%~A!^}>%JYfMoXSm7wQ3@m1EQ17VpakmNNW;Asee}VVw$w$ih7b!YQg;Z<7x}&kptBK1`ktxlm(4i z(HO_;f5Fh1WL_03y7nfvSgeGx+i&Q1$+ER8>sx{&C|l!DUgkBs3eeOHIo$u_ zh+XuvooWAh{0kq)+rqU3Mc8z{0;9!_*>l^sNOe_~6Z*-RK=tEud>P1=GK!OPp2?2X z8DJUp9xhCxvUV9h$^YQt_cqsElkp|O^M0$+WYZEvN0NpXAfL}#c$mIuF299>Eh!Oi zGUEaWe-9Rh{Bs+LLjR`%!TjdhJ%>6bV3`LbOrUJBkYb_y30m4@)92A1yJnU-aHKF8 z)#z{{993c`=4c)qjUIZwC|1$)-90*%_3Pzj9k~86x;BP#GNSPH0Djk0z|z5ED$%=UXy%yn&%A zypEYCgF+vgQTDP#!cNg*OYlu`yJRmxMRAN1WPt2;aPVt>y3Wd z{6!8%UJ`Oh@|nA7an;Ff8fuxd@SRX}%Gk|f>R0~4JZI{wdRhS8*C?&Lr^3PVg?Gc? zXccy~Z6GsPG=2aQ!8qwG$XjbWC&14RPJ!UM6n)KRNlQhA-Ogg~d*rzRa4UyxvpLf% zjKuB}3c~EcPqbG-c}>qV^;QkWAPrw(dd440Dr~n{P8JT+mYMvWc3_Z zdL+0B&$(VhFJxMTI?oF*oaS?)rf)Nb;rjS(GvAND-T8xQ4ar#fkGYytr_w7+o#PEd zDa0~9e8j;VD#UX*pY{4~csi9Z_DL-Lh)2j))m;af%8bGml~Ssv7CkGuxjy3^rpT2O zOROava}ZXwFq^eXPu&Z{!q2f6td9HmI*S{gU!M;lJWl&FgSP(Q>o2dia7XJQ^jxE? zc$!6tJzm%m3t9Lz)^id+SWzfM_6{T*OIZ7EwmL*}vkihMhw z`|wvPNr`2JyJpx>((m;2bxn*O322t)p=0Byjm3q2UmPe-ZT!~c{Di7i#4mTCCWFpB z6i4q?Ko{O9+{L7&nY?Zvprx9b?^jVMuUCh$49;|uAY3>sqmt(swd95A-kN=x^#1s3 z89AQ7vmgh$;xrutgJ@bsDYO|HtQp2 zzdZZc{G|dWB6js&zkBjY_j8)XB$w7*XkLdkvtPZg{wXaF8;F@4vzqc*RCz*%(F|3? zufw#+{~iWMHV82^cO1r!4gDy?QC%$}P{;DgtPobmgN=%pBS$kv$eLgguQ0Q!49MVE zr*Lpa&Bd#cQNr;b5-FxZzyF0u1xUP8YmNs4KR*4i@LJ-H%K}P3@%t8;Dd2Guy6qQ0m71;u zIILY_drcx=;O0?4-#OMm5`cSYGso#3gE20XzGyW!y`wF|xezd3<*9HQu1}v4To_j#Ytu}Abu3J!kRRFe@G9J zgG~-x?7%#sj!cC=Nqm7k@o>4&y4-U+`1ChlBUf-WzJ>)Eg0vE!4v+9zoY4*)5R$4Z z#P3_b+btIR{?UN`S-~vM>8`Q0tZ#Ln+A3%TrK5ZQN5_r@n{tE!>T$i2a!cirf{`L&vWQIMDd~9{6WtRKKo@fmddQ4G+ z_+2S@a6F#6XB=hbEDq8VAD`N&yIuou;&PQ_Z4em4MmvbZ-j zY6A>~gv~?qR#P;7cGLBJSJg=k$HBjG<=^=W8}*&C{AB%_NKQWz^Hxp-;b}58E7?%~ z<=%|A82{aOG4U!cZkKuBjNHGg@e4&EjBl5NMzp}m1@;2_=?E{derkR0FIBW=Y)f?^ zw$OmM<(T50z6>9&fM}kWdQt=5Kbj9-UT9RVcr>wmeIx0xrc$4gL4jv{dD(_DfarS1 zPeF@3B~D1FTa#L$!p&FWu_=cSdp_B}Lxq2&p@APG7OUeWPmF9ApqR3y1T;FpgEPpI zRw~Gc(|r@FO>xt_O}}Ucf*#SycB4fVH$KwrYdwJM^e*@_`#+sTtc+Y4G}wcs&~r zp)o$0c2FJVdMR=<(QRGd0aG4@$%t4KIw(vTdgRNNU_@ggM)knln%5gIUjO_%V-A{B z-E)x9^99dMyb$lc%jfY{3&dC8=&1Zwt2U)RS8Ga5KgSPUhdhC@Ap};yq>a<>?$}qP z>=|RIsz@nhDU%4D34>Bo>hdteE$r+cSn}+b??GF;nE{v&;88dqDC9YxKPGGf;g3zCCSBbvW>-hOZ(ec`ks>UP;o0M~Q^^y(c$2wsuL|Zcx)s4m-Z+W>|OhSGR z9a^{JO!Umfbe|rZ;8K|@qoDE$%*y_Ab7OTLE+tnXf2e8T#nFGXL01zT zxeb5N#i;Fj%=`%DQSxnoVxE2a)1?z_3Yq)JpCm0}HZXLtu=`mOa0UpXljTKF-(8~# zk%>ZBU=KgTLvqE3dXc7?2u8Sw%`VCb+m1F8JP-6az<#P3q}n*PzI^#ZD3Cr{QvjuOT4$aYpk_u*-y1gkxKgc~)mJOs z`;jnm+CjAL<|`on3K8T8wl zHCJ<2Ip{vd8h?85i|O$Z&vl+Dj0e3f<71B2L=)ARgm~Q&YvSLB2dk#`vDrzt@dSW9 zUyLh{%77Jew~1k-a37s*Z7rI(*`30d>()TSubdtJ)`<-?zI|o!vTM!(H^Y*c#(umn zqn@t&+@sb!xFFE6uQnkb{h2M3;uk!F;i&cKZFX)t}z<{HA+s4<>2YwwrK}8 zqvlXKHh=v&=9~r+V?Uj}7&`jU-2^uqNLF; z6!L9}ry&$2k2TEdCQ8Rj5WxHoW{>Ol=B>ovrSut`dpQ36%=to23NS)duGo06jr~hG z;H%jx%u#B+u5Y9lXqJALukW@5`2;LwW7TUy?>EY}Q5dB}K`x1{m@!G6*+nOVDl*9| zyIKkH}x#RWMboh6z}WOm*c`ejB{UQ5B|OJCrv7xE4&lIy$)h5bir8KIfENg zAK~NXQ9Rls{fnC;t?*~a%J-11e{cWa`UyBe|KU@})}uc)!iBB&YZOV$ef&E<3c=I$ z>2)SBEFt^p6qW=?DWP)9&$u-DOWaAFGpwBQoGivxU@Gic?hPMbP6E$AO%)S@xEtb` zuS5fkkAqTF!pX6ksJfO5A+}XQg3hqTW@z(aMA)XiN7*Hqfy9i*4GpUGLkOi&>zUKN znj_;o%^3Tx3ht5p{W*?n+eW@Gc=2_1R^d0{%$|lWFZ+qCa$Z3(^y6r5Pe%glbtg`0 z3-JkPU;kn`2K1Vp`<1Zo7~U-7M`zF@?zEd^2@gVHTZOD-cR`Jg zorfO&C+>na4=N%`Aw?|_DFEC7qG-;U*!n>@R@IlX%#`SP-r|e^2r{)p4};!45uXxS zr9zpOY7J|x12br#Q+XZ60 zm!@^>BdKf`mt;Nyo(H%>K5i~KyZ3uU^YM?{p2=xh`4b6Q`oYfysu7%uVfPTEH%PA~ z2wP?zU0#At+~c&9Tev{y*Sc05!Q!zIujkW-G|Y!rk;mEv{_Jl_!&fbrbzx5&Cb7pz zGEo=FEOvs)NydoDsLrFW<40wZS!8(3xOwzc>qq%ouJKu^_C@>{xIPh2%z`-3yDcoo z`>Z$(;K3{q!Z^@~zQV)!_gOw-iXhEG1^7Hyo&U}u&_#>0U3@g~ao@It@%}Q0W^;Jv z!tCMSmwK0EI-8P0;o7LRX~X;jmL6W#9&z=pBko>fwM*^`zwqU3cmJp-(2jrOT9_NZ zx9y{Tv0sy4k_h0wgOF9~ieh}ziuGe(9$u301I{z2*WZ0BwFTFH*E-l5vf46GN0~LPTQDLG)HsQrs?v z#*Y{ECd+{2HaMy*g(r%&yE<+~(@3c06k>X>>Nixzx^@%RZ-s5opiiaH*Q3ib;hVsQ z=o307I{40O_H%+o#G0>dBD*_Ld=MQmBrFjDH(mtU?N%8@F?p%1kXA9P2 zw?{FUe%3rMaPjLocLJga)uNCpFUXrzKN)ML``I}^diH(Mi&JhNe|k$GS-~6J=|wVg zYm4{g^hfkZg@aSX_HcpqUhgkcZ8G&x0ZD4CkDdHsoNdj!%4%L59|xjA+=?G45F+kut~2+=OEJ>o^Ja{?JDZHqicBkR9dAf!c$mc;}56MEBR(z~Vtc6LNr*6^6d^ zeuqLdX>d3x52iGUZ~%b6@I|6n- zIO}yqYHVC1C6l`f7e(s2y9$<*>BjXa)B*Gi{jgN(J#B~0Pu3>T;Zz22JO#`BMrWMK zL+w7+#b%6_NwR1Df$tNpFhDrA%%DMIiI?3vifLHPqsZ4G%gdNaQ?*mk=H(u{Js;;f z=r}tVUG3Ayg+ur3?;rSbA)Fv5ET1UJ3+v3xJ$J0?Apzk<%h=mxI~sY)==|Ir7>P|l zf7_`-kLrueD(@5mqI#KbJ9wqKXK;~w5C=Ta2rWS$%F#n*n?x>LZDiRwCCi9=oIk)?;*m`HA|Z3(;H+SD2nqML6@Dk z9x8~T(ZLIXZ2Q2&2Q|)<80>E&`{#4|+cR-^9qr~$iS%7x58+N`6XuJ67+*fsULYe( zSeKv6J9yKLRrE$|y^f|PVMnN8qcr2$_@9uVkc1tNU+mW7FwcL~MhPJoRflh1T2`9` z?Ew-F5T`Nj@bT1B_N+On<=y*72lFe=2RB#YvfiHi^XvRkX*Xle!WP?b&1towxBjug z;4Y7Ug^`i^^g4u41{@QS_WFW$cD<49;DkF-k31w$eA{BXElzUhp~Isk{6LGsLr2hc zaz~#;uzgxI^l<*}7Qcm2X-v8*)Nua#)-z&rvz2XPWxZUlF_99HzZVg5cYWRm9623< z(`}{Ra2m&K9e;}w%f6o`tGNlW$1Ec2LO>2TT2y0wRlxV;hIu!m$yuM&n6q$eLG$ylhwl&%QNX>jc`J%pr?_X6~$f@pBmS$DSno zmxF=Cc3anveOMtnrSu(B05N_lobRUcfvrH=j>9`af)plV{Hd-^cp8#W8{Z9vpS{$+Rxz2~ZgPKiICY!4*I#~pcS z&|c$OA=n{1V&nJo|D6%v(pm|faE%coimPw4?)=xRIFSE8X5Ez0NiU&FypqQKrhiJi zp!|19_CF`;jllOJjDf$Y-A z;7O2!&X0u@>RGcudpSyZa+{mwEN#~nTLtf-kp$3dP zcH3$y0$Ot??YTc=$H?KJC0%M6h9<-EHgldL``UV3DE>1w;paEqAO`+^zMA-mK#pZo z!b8eK8n7ji)F|Y?p&qzdNqD;4V&iQg+5Y~+z;rXIDRn16CkXmcJ$;9H5<-}}9T7ET zuMJSq$hG@R~Lx!(&Q6PL&h(3YtvrQM+ zG=R5n%LH+I=WF|2KmVIrZ4v~QOjGuSCxOKHpOD`(6JA|cB1t^VHMp>M1hTJq<4Nca zOLXiAQsDDXWW=w)>)-K_g2=+Y z%c(!5RSP2|Vf{b4aU#gqe^jvlM^cVDh=zmoU&IN*DVY8rp*cN&!tMV^yic3{iH;2Z z7e%wiU3J=4E2kP5tI}qs>(p_Rk_ss}WX@!$0#t(?DFg{LN*QAo?`>^Uv?&#q8m01P zxI(xY>?t@HsR@#qUJ~Xl6E;_+@YcB=>d~@WUEt>m7G?`-=H_0vLuC^4BsdGYi>>fC z`rA?&E-4x7CagT36rEdL7pwwFgcCAfTcO*@T1Bj8dWqvo8Rc`C$|)7GDH*k_?*zo+ z;$Jcfa^xyytO%RJlwxL1n`t-&tdCc;VJ);O8;}_Q+N2dJoVb99IGYz&IiIHY!*4NT zOp4BxNx)@@aLN1NIvW`(?P5ObQyY_W$wW6{Do!nHUgX45#S{ifhImRwA?s?0sa3>D zz!7i*cs;(vb>4K}vyrs-*8pK$Rz2fFXS`Z9qp{VDP%*=7+zeOsSUSbSBTF{wTbRbM zn#V>*IxmbP;9gSta%6V2X-Zi!g+PKclOV*zaMe4dpmsbgKOw7{Arxwwd5=FEnSfKt zdJ<~docX1C_wqtflDLe3lL>c(k(!au>IXaiv(vAXb+(mav6>aBVyckSR5ik&WAOxGhTEM3un*snOo4N}6X6FZNC$XrG)tgX@-fJTJY+%POU=oMebUgXz|= zdP8=xv6_&vW{_kUlusQvvi?6@opo4LZP)eq!-pzeK&+)$B=RbG|$Bc9B&A!&P&hz}OTK6+Lp)eC7^)yst)8EDmz`qxd z7@va8$Kwv8c2idUZ~xLJ(YS%NbNZ0nz}#tB2~FD&H6ZBLdu2E(w0%vRu#`QbMVo+? zbXzyX_W@#PJfOr^qL&6llS|X$iIY8LO;;lmxK&K6^T0%JF^Lz>tS|7f(vZ7gck-o# z-I_ma_t{~affp@!7!q*kg4>aYk*q-3L3Tqh0}_Tv#ysNi*mz4+iS(a$(f_stuKtKO3LmBTT{tqhf{>8;nf;5Q(R6o^#vS zzLNjqhMRV2DrrL>SaqVYI}wpn_T%E!Ct9RD;b)w^EHcc8x>c7s^|#g zC#=mlWy$jV>*FK*-T8H&0^G7qEkw+86yjvX555d>shE>sB5L?Arbt;!d~q(z-g*ib zmN3bkja%0$%b8%fJYk41bO%mSKUOh$O6`;s4xlK>BOV=w9c-+d5LOsGM4Ne z$X7+d%&E)8<-jVbK#N73TV>^})71C&s%0amUBKDONu36iNK{k6^0#UDsw|!Ul$FyI zkCh&cWTr>mH2rg~6}u0cROARAncCdJfCXQbx|tkm5ysKjo@gQG*O4|wy|4S{V@o<` zobC#zT_qy9ve8a8FH1RRfN7_*k$y(|tLr875{s85c`t#>pF(nGEG*&kM8MNI>fowR zgb5qkOW?A#wu!>4E(YP@v1>rcT?p;7=Yc36}~1>Yc0BuzL|6yq)?D*Zh+1fGH) z+X+n-^P}Fk$y%o=Cw*t#ci_7t9)svXB0SX%fIAIcu+=YRI|RJj{nIr_p2+B9vatE& z>KpQ}RQj++ou7+;Y{J7BiKY!=-07x4D{FyM{h=>CAjhC$> zCzR^H8-_1-_P~EgAs1Tz-w*fqzq*WO0Agj-!yI$-?&aBfs%C3Xo?eD&e0ATZV|K+6 z{@Hb2KL`M?M*MpI@}i)?w7RuXJ=vx-xwx6K$leNK^;lMFU5|Rs&VC>X5 z9$9?kf+BrZjam^%-vZBAx^PnLlIV^Nu+IxVqoT%YR&Jg?;vAEM{G9%X&>j{(2hhmv4cK`q|UD z(G7fWqVi-CmdvNf+v9?)awxSOptj7T{EfCI=>j(6Sp835pTgMtN)`hnwy_&9qOmN| z7Js_u0$0U-9k@Ue6@e%tA3OQ$1xeo1>)G2(`po^65F_wlyoV_$D3n&RYepIzPRtx} z0o6{!l|$rXvjgn)-lD%;#0!kl%}M<-mg>^x19(myVz=-w89K`O)w4&#Dv231n_(tt z@A8Ywo8}OLK`LaR_u#E1ATMeypTpQ8Xx*&qF~B9IW|WWwA@i2SGugW^DWqCIcOW4v zMF7f%dJq9*g2lK2F51xas2jzuxKLipNX)hdAVqjI?L&*4wxm=5&o$+6#ds>?8kbLN zeqp|}p2$u65u#iY)=i2ai?~~MoP7rI>g6^zh1O`XkB-Ueys*;*1apg5Lbg&49RS4e zpuUtSUI;}u1NjA#+6_8-sR+o+4l2%U%aid&?Nn3Z(7{K89J;Vk#(0*{G;upCd>xyU ztYCBO!O@%yiYf7JNf8yUv7Y3tZ1{xoi)qybN1OH$0|N>Tfl6gNZ`WYm$G_4=mWqLr z;MwHah_5tVdsf6~#;X$`p`EkwJb#kqvzL#`TG_{TvHOd6ITAUFS%ul>kKz2cTH7g> zXt_}^kRR6d84HN5J2I{VHBOV9z*nLlIW zvNd-h6hoMJ>#TT!Q3 zj&kH~b2X2po!u(O7H%uuIIa5apCQ<`*gS!=rEjN0(G4i*%k~{+XYGn$AlgD z_+T*}Ug}aW1cp(vlxO=iIXGR%uEc?b7|@Mq=QkVi8{wLQ>w`5zk5^W-OmuoN%T{EiI-OY%)(k+tH~D8SVKm)QUovqI#|N)9oRwVlwJC z!7!DA+TvCJ+;2Hu{<*(^XVe?@;tK-B)z^0#xbanWg;KovY}~F5kh8FwANUbk#W352 zJ9ERa$J(^Fi#o=)sr(#s$6kPANtLsaCetH7zY>N=OezWk*Y|?}4b>r7*3aXDJj2dQ zJ>m~=mN$KBrcL8zH1PA@W=mrM&y^C)Pc>3eP4#-O0{Q1NOiC$N-vqvL@)rurA$x%k zBe!3?iFtmyT48&WlD?)kVXI|_Rk^;wXp^7#0O|kk<%Sf_vobKB@hDpfy$V2 zzqUfQXIcC!5$<=B0`*Y6cY`V$^=qSp&VT_JTE?5Dz(z{s(WIJdJk#svwGN!&I)zfm zLAEx7pzr4bzB}Ov^z51|0#Zv$O{ZnwPMpDO)!bkEdBZ0LnZj8cj3DC zxYQ>B3L`+<2IAk*JP1VXO$&6-cWG~XK_w;|u$*mJi6(`%i38c3qhR4Fc2muINa`A2 zyZQ@9=izQ*=4?6$3^Gz+q)vKnuUde|RIxl5vI62f<%z`9RV~k1qt*B1>YwD|45*9J z*w`e75|KV#0dOq3mqXbu#qar4vt5BSgtfJfF0(-k8SDNOlirB7-TxfS)@9$c}Ie_m08}do&`f3Qhw^ia`wWjzix8rr4-y9-|VXzY-t!*?`03P3xPOZ|48l{ zt@jTd#i8Vt8(W;Z?QE^g*OhPC;P-SkZGu{b#caJXsu{fm2|-0;fY_)k;X^0W_6K@m zn)qTzS%U3SF8lJ*xXcmNbE*wV1(o=oTQw{<{uDhA9e~y0yi-x84BjXVX{1s)p(!)s zuNyKiNMnb~ue6Vbd`NjS*0M8SWGfkK@^**L3ZH?GdWnICs;zFw!7O&H=G?BCn&7pi z;-@^O?6Q!;?@bG(GHdta%FfJ0>|84Hi>9gE?AQKCFxA`Wv6a}sfqFjXGmN~%vTsO| z>+}1mL1P3@Xs{7)%??!fEK=piQsU@rx>-%sXU%Y2ZX`_&^^|GtM#TtOdMS9Gli$dA zCald>p$praeVbgq4-1$esJPhnw!XoEjXA>t+fpe8%E?ol6c*^DL9ck2tm40ojUX z+NJu<0buPAcL8oX&_6dFdn3w^dlebLmU^6d=a)M6aSei>qeo}Z=-J-dYEyC)K0N!x znaQd`i99^PXH!)$-YJW42GAv{|E6})M|a<5)WY8OdA1dUH94GENoh#p+&dm3pAmlA z2YqWi7q-%}8g*XwM9BzkdBwUAfIv0m#;3!g^Ut2s8{#t<6hOvL2P+fSGD8U>%>w1ox zZY+Wqm316(J7B{kBYV4ih6_%GV3aFlO5N``cS5 z@fG`kaLw05B-wgPnyUhCw^in*yF^Ru6Oj{pNcH|*IB_)DS+^=m&$JS@--8EiuK*wJnv*FL-}T(6Y6Wn?lF?Ph&OY4+`oO`%u;ERcN0;eo!qw^Z1wXv z<#5&lKnyxr{4t}5s_^H$b?DYf5e@yNU479H0ImeK)T}>xjxQ7aY^zlUiI}0FZ5eHj zH=2^i`~n?lBu%Tf5GnhhF_Wd;0dOdm8yg*y>;R6_-^P6c3hC+NBRLT#ikgt#`*%Fsxb0w4ZpJ z*Q{z7&Z2P)uqwTkUo5IF&R0h;6$|NU^mv6BbTf;d!=+h44v*2@7QP;P-tzzkDL)YQ zARy3ISWeyyneLf2OndK~-hzusfE+uvZK?XF1hbMP2S@)}hAH|iv(Ch)SwkfK); zY-0W(R01?y$&-Eb|2!y@gS3yPtLyT5(WmlQ;dxBaQ2O7*zY?w*-Kae`zf>y3z$hi# zJ1lG|%ZYTmiHoDB;JVpxAT}h3&a3`4=p-Nmch~v8z@Z<3C6HR|hZ_Of=-B7HHit}@ zbh2^Ewo&XIX$omB!g1Ury8aVB)jn)f%f%^^o^P@X?$R6e(Qk-z3~ao|xO#Tv90VpV zpJD?cu&IT3TOu3lT0R z3BU}}YGiUPwC6r{8&eMcen8TRZ*x(p(=vVObH5Z*?3(VySxH9~+Y?eDAH}_GKtBAq z-@_QNNVteIt(nG{cl) z&tQrjXM(Uvp4L-$IiklX=p2||8X)DnU&8;lkfBJu`nyZNNQQ6vvL0}(XVu(g8sNPh0C$@Tf#LV7XT+}Z>pPZquX--!QWSDtC%$Lz}kfM^^uRrD+ zF$>CAPiE&>;#Oxs0WbZDHkd0SOFOG%q)bXazId1BA=43e*aKO8_2M$+&6JMQyuia7 zJm?1cKTVxB7y@}mq27(T3hjORElu*FnWmv za8UA+Z!;yX>^?rn{-tYh_#bD9XuyI#%f6{SWtkq4($b#3;moHU)wJO4dz78EB&Ih|q9>gg~Ini4Y;|86^ibZ1Y*3e9FK3 z@arK<<-cqFdM&JV#HGm6CcYfcWS$qs+%S2y*_b4B1>dGMyd~UjGBvm2iLQx=Ap-#z#^S^{JY#Xa`>K@9xKcHa-~(3#%$r zc-oY`+8QR9@Oz*IvM8aJ^^7tg^eHUMx8xwhHYSIu(aXbw9FC5%ct71%VwRZ%1njoT z0N->AaLxiG#xxx4l);>AJ-Vhezo)fs(8u~&jv@Q;OhW^t>s2Qwt>2DbC zqPV*DSD@h}TCZSlu$uQAK(=EML(sVfbSGCNIKz?3;$|=_KcnQHZN!Q+7KGYI|2AxP zP^Hw>xAbCwM4`Gf$gaA5GgqF-UO{7ekR^7rV2Ka7H&Ah|xsUrsMCvXib`q+`qn)om z-1fan3iZ*}N*&=kP$YRKVT`)@iJtfhH(UtQ{cZaxw~tR3bsvvfa%sFo;4B+kx-uLC zgB**Y$&`vpemjkqfKnzv2acm(enN4Vocg|PmT%d=HReie_zBwmt%+OAYCoe+Kk~zt z>0n%|?BFC{MUi_**Y|@{cS_k7qe^BjPQCWWK?J8AjqOFp+f$X&qk%y$OaIN%J<=&7}b9;tcqy{SN} z-DO>K!F&I+r?pxr-;I7%qAEM?<%;nn$%~~N8YI#u$v!gN-JLhJo6BRW+FfQC%FNtN zt?*&z0^RehF1UY~69u1Yjo&GVcH-2jv(wl#Y~og$EEB03MbA4~ zzn@*(G>xOw6b~d9nk8_Ak(aK`Frh&@$T-p|-;Fm0rV9RujYGjLOOb>k3E64V^<>!6 z-^XC=;XI7zy&S|b^y4f9d%Hl&%c{Asd2sdBQ_u``F$_-$v(G#!fqcwRv-sfPHzcni z@~O1u_ji7{D9R;RoSbwbgHhY9X1>PGUjdPm;-!D{1$8L#MHpAH^Dv0%I40!YR3IMM z=y|841lk3dCyNKQ*tV|cK6j}H( zMUgoUmG=rPtZy%^T(0wSHMBMgGq!uD={lW&Z+pAxw%XX$uC&7F5`RbGB^H2$sU-M1 z(VqeTlh8xm%|U>Ymatv3$!<-ueG!XT#2Zu2dsPbN>vk3T4u7M%fN39h?RRGbw6slp&|QFAzSxEb zwqb#i+hi7vg0|@Fth!8lZccNBI5~$xq?Yi7*zDfkuC%n}WJ_GPNSSv!NjYqdXDiJm zNH^ohof%x2fGE_$RAEq0aVY5S@*4{C>JV`)O&8)1H63UoQ^r*G?2XAomq98jI;aQ0T1Z9zIm9Q z1R%677&bS-15tMQZn`d%6h6 z^l^&#IZb|$>85fgAZxH(Zt!)CIb*lWjNX*Z!~NJNFn|re{^ti-@$)$;nKsrT|+|D$Ot5%VwLBx2@V9@vF4f#@ zT?`9pf3vB4^VG6DyADtG(+~)~sdN^7K z{{uNcb3Mt(!FghAksoSk(Kl#UlP*3OVd^Cf$BdMyf#B~~a<^JP{5TR&e)2d*vNqSD z#W%6lYO7oDEksFv_A!mg9%p|;oNo^OM*lHBgE42-zE;=ujIHLXl%|B0zv}s-^Xy>i z$DVU-v~{O+)iL+C1YPIx-eg!k;|kszHHDbs1TpF2j`p8knk#3kDI#E#SaG~D0S6n4A(tR zONIoQqQUMVDd7)m@5aL$DW~??>pE#%J0H8Uhu!0XvtKQ}+6pR3Y>jH4F~3$HtzKfO z%JbX%_kz5VIbJmhx?US{NHzhaq_fc_oMFJ-MZVVLT*PQfaQjz)nm#q1F1Vg;`P2WtNf~NBgIzE+3WQ+)9bHNp=yhk(Fl|!Bngy%0 zN?3Yr@Bc*X)h-1MG8H*J^vfK`Jsr(po%QNq&(95Mq)g8zVs4xLGSfw&*;Ys>43psp zan7}Y@Axg$ArB`j422&4XB}H-b^Z*=ILV10xp_pSa40=_Aa{M@P4}at#TF@pm&FdZ zE&|)v_+x3L{bTrM=MPcuL3bU*phcq8`tbhQbjqf!-pjMT;`bod7``i*T-OT0kfLBs z!=G#ZJnn@U50Dof_2H^Y?aY{h8MQ;h3cIhBUNWl2hQ;l3I-Ct-MZ*<7AY^b(0>qNU z2_;?>mf^h@=GRGC8QX!8p?o?dqNA;Hbzpcz$rEg?dd%?#^A(0O&^EqY7&S}MQd4Fa zXQFAa4tDr7YyJ(qsZoe4(V7$_H7UFZ?PJ zngC~TYXVjJf~N#2QFEFz?Ni@~Z!ku{{n`S3!OSSFhPk{i(BKT}y*}c_9v=E*1tKG; zDEkTSde!drSCdYt0HIn*B3Co^)sTa;SewnFcEu^L>B+;pE{Aq*>Vx(7{;{};j8w;9 z*^{yaLB6WRQjQr{yyscG+c~=QzGB#x@@5rd2N@Zqd>{DJQ`E?<{DU=!AYW78AD-uc z38(RQ=Qba0l4-R$i;>;oA8BM)dHu;BQi=R3G|T6dSbMIa2Wts6PY>CARo_&vvQnEZ^QZ7MTSVoI%oK5%k^ zheK41cHhB1jvW=OhpDvN(p zm>g8({ed`(SEhjY{x{9!g=+X~6Ec-e1qi@Fvk84$O)VbNDhn~qC^3!1z)1!wa?@0- zh}T5<@PC8p+j(ec%7bm?Ofm_^5dymC|GfUHk*s0CQ%x=*k#H!@!zL(WrPh>Er4?%xz3l4aUE`={`6$&tj{ZjR ziw}&;XXhSqhzu3uZvjAEj&+A{YElt@M2Yih<8=~UM4ku>(7u8Y4HyR%NJ&*8AN|IW zeQPKlQx3B}CpRo)^(HsqV=79UBJVS&hS~t~cxm0%JTSyUd}J`dl0sZfK5&EJU;u*e z8BOOzNJvMbY1kRg`U*Q4%)4d+s$>bZv0e4sq*&GDI(R*fbWBOaG4U3dUL^W-v8Q#` z?`$>*0Ov{P_8cF%r%cZ(3A|CS3LUi!xrKg-$7%+1k(iClY}&u2P3#R>%R3>x%eD=~ zVnds5EBt^*Q#x5~iZhpzk~COBq(uWvDv>Ji0uy&RUOqCrik8GYY%Q>#t?;G{lngfv zp=;xuDzrf72bI4aAvzIowYcrc#7%-0OD$*lH1*B<^%@)t zY?^3PQvG)kSPnHPb||Sz7H2!e%;JEkS3i2qIO*eKZyVZHB64u;x~pIq8yLcf@evQ5 z(6}-1D)#TUL)DB=K+AkfTtJ}V*`n#7#MyT3>-XEVVxg6Ii|g-V0m?4P9~>4QhoK{a z{-68V7ajS(=Q)+)0$Mx#*S~xYZ)h!Vyip zn52z=whxRayZ{?+l@DfXNB!dVlD(H<*25(?KcHy%d;7KNUPJM2Uy#%@$vpUV7^r&= z_)hHjx7`)HedlIFoi$&f!F6g*ogLVNAmYSDKEE~Crd5v0v5mLqFBrx(0ah8JRtNK@ zEuZAM7_fhYe_OS_-+ihxFu5jVxK1#n%40HD+0<03tgag%jpSceDZ8l~`D}XDKyenE z#tBn?ct*1}S$hLiI0o1;g^$@(b(g|gr!uW*#D&f@Aak)5&DGDgOa_BWLSJ=#<<*+7 z)7TdwUWMkm_|b2w@oc$KN?*a0GiWMqw41|{$RGPSuq+a3uE5|n`kd^ZZUC6Ss3+R|c;AlZ1C^_Dye*3RK0L zd#8J-`7T`9>H6JQL~{Xgd9kKFbgDL06%+XgnD--)FY82b*Am)Rk@O3P;wkj!BT5ul zL@c=>5gDEy$>(6=XFtHjolxdg|4&0NyV z(yEf75Oyv@f1thP>q$(1WKo76oii39qE{!y=^k_o={X$$S(0t#oGu39g}8}jB}X+axZ?Dvc8Bg)>|h5tzfdXWoicW z=YT{TYWKpek9lXMm{99kO$Dx-^h>rQBrT^lN9(dg_08Ybe+IwL=_m-+Wov(WT|w_i zzJHVTMantBxfGhUt9n!CP3DefE-YWD>$d#i<$Pyz5?zpC1^v^KGK376TR1gr*~wB2 zmwwidm9)dHc50OpV1y>%z=pVlyD4j4{L$!iA>8meirrAHG5bRmG`oN0C|s%0CLY}*!H|S?3}Mvvyb!=!xFBdyMeZ{S;*&S z%h38CnC;9qAAcpk73A^C?Tw&t)YB@f3udnTN}Uz{u!WZBb2zPBE5M9JfX7Lldwnjf zVFGEoFJsuoxsLAcTbgE6|EV*U!@%k5R`2t;ei~oq`C8c6b;b@8c5r%w+i4Cz!?x(E zjHyB+>-T5!LcO-%Oz1k4L~q|BG*8Clc4*)>h$hTPQKzLOCl5*aduaIG-&o;)%xcDu z@$m6s=uS?}5uxm3-j$!ml4>xh=IwteyS5Ao}n_`B|W#f32 z=Jg#^nkMA}>=J_Ra9u^)6))`{m(v)cW-6Y+(OxVKHJ99Ul^(FyH8zQmefBbsf0I_f@rD`O6` zR!{|LgsGSSnqm{Q-PCE!K!ELl>MiP-^FlHn_vZLXh5>TB){F70oX@csFx{yxapU~B zY*}5-oui}RL^M)m5N!5N(?WtgMq+&NW=f?KRK*AeJ&rP!rz{z)pcVC(XThLc-qg{Q zH8=!(ejnlXTG%OklCWj&Y2M8Ye_>#heBA{l1ev(eNN$d9czDDd7Kaml<$Fyev~c{0 z#P};XntA26kCJ=q?s_XZWp2-V`XhSR;M$fRm+xCr0wPThB=UT{!tfANW6J`10|VOo z5l0#S&CcmJ-pO44k&=kZSBQ58xGTYLx|C3qYgCh{r|76V)F@o*U3uniMV~`R7sTJp zrocUcutlJp@8MzOo5K#7d&IvyPe8~^NC&_sS&Fnx4WyO}XUSb_OiVZr&y0 zPF>A-Gd9P$pvx;inmXyoWtPyUF!qtGMto<;Zwhf#x*Pj6>Wb*Ta{laX{PpT0?d{Gm zzD*vdc%7NHM(@dL)>>ut>kYm=x{X&G?v@OQTBK{SQ>|9-+O95g!8JXE%xwchWvrTN zx^zs8uBJr3ZU<~!7vs!5seX9MBKj?6;=Xw+T;Qjm*~eS_V%rEdl>$U|*_MZ$;SA_r zD8&+eWUb|un^AFMCqm9iKuE{W>V}Sbsh5Eat}96ibnb=u^FixJGf5nJTQ@&J+BSS) zTW7# z7?54JwrOP>sM^u3raBp|eN^Xc%IX2hRFthWx$tOqfpFms*WC;SE$7e+$NBDX{&$=N zAhsY=?v}o}IAI>@SLgl-t5;n#HnM2xHA%py7R)kf)-QkMEL_A@8v`dH&N%g3vDyyn z)3<<3B**q=}L zsc^lxyZicHE6;?Ie>5%I89XKD2}eh&tTI_pTd2RPsb#3sc`lC`W~PIOZC|Vu+T459 z`W=%rCY~0akghuDMDE=_@!ms z&o~?{_$K(uV+IBcK&3b_DdQ=!Jfw!5+jaa0i9^3W5b3l|u#7uyJwo@+S{!(8oz@AmFJ zvm>7gw`c&Y#M+7MT%atQKGcE4WRHyzYv3C^DZjkZm#xzl2aq^?gwDcejSIY`#+H+E zhl(X1x^!5m6L=nNqzz~Mi{z<*-9i&<$+`aVt<52p&mu|sm)VW^RwoOYr%eL+3&yfQ zQzY>1KQlKYa>aQCGu6||TXrRPf+s%y*LJUkkh`~@auN81Z70~li}D9~k%ffdgkXsM zEO{rWeiA$67WvPv4Of(^t-0O!PyD*$-&f_{PIdI3H~DQlzL8MrmGgL34+4E1nUO_N zo!Fqp?vsJKK5tw@V^OER@%z~O^+2X?B+BmP_ zv&8tiu63h#)0kv5`dd($=ov@)R3iy_X-L-|P6@n~ zeM=vDey8m*mT$#6UOP+adKV|`5B=5gv`WZ6ywQ2FJ!qnZ9FYpv6dB@TAcXqoTr!44 zfj55VD71U$)h)4q^x7(YibMJ`*eUbc-n&=Js6Ef*dS9h*kfL8MaabXhzJuF1y>7Fk zqjI&>dF)O4E+7cQVmAw$_~ap=p#`t+!t>A)Cpm}wDDz%y&fe9|b$;D7w>*J?Om#TT zPY}N&l@(J>8Xr|}{6nlc*r9*PpqoE5re_UuLEh59OCk?Tw&%3Qo3Rz<&Xgo5&?XNE z!VIP}a)2qkZn+p{=lNKZ9JQmP7nu@6{rgy9N5>a_SPbCJVU-IItfNSlXYZ*F@_D8_ zd;7=Nj#k!IFJtn#=`m5lHs#4P;0cos5G|PegB;G>N2k%*c)KX~0vF#+`Ie#Ebv-g< zQY*CJZF9DxgjKxjI0e6s4{ZrvZ~9dbRvhT+zE^1F>GOnrJ8Dd~RSmGwPl$9FUSQI< zlgz!=eW|v4yYhEHJ!MQnTFT8APgd#>u5{i{v`YvNdQ@Egw*Br4O^YK2eQ9EBAn+UgwLLdKmdp2Nt-O~DB@+tBp+rx(s@Eb_Lp&yH3Ui~Ec0?k5rQgIQraeyz{qh}tt zDKF;Tl_Zp>oPv0_1kZDk(oMYWsGIe3jF?!sxSj*_=^!dF;U~>tn2mZoIdJq8soV$Q z+?%DAjaD9XUSn7kX&(H8eh z*3^d(#Q@Q7)AS8FqB~rtvvBT3Z5RpRij==UvNsaB2iX*92$l?*UC9Kwis;}N)u;b` z8wJ`gqK;Q;wJCx}9UyUBbzj>uM1}7z1ae1M_8nppXRU1xH@X2g))6N4RDW{j7F>Gf z23O^u`#+>3>s5JpUFhBTngH=T9Fzej3k4zO z1O8qfWofiwZF6cpH8OkOelYn#u`KbW={wzX!zaAUWB~d~z`fx3ccmgnpm8~Qvms0V zcTU&C8RxD%*GC?*1f=Eu$8R+Nd4`v0 z_BG)VGhw_NH`1zX=dr^q3=F6=ia-tapuk8*$SXT1QQ{+c;OhcRARCqR@J}eeXK!zu zN#bH-dFR=XLN=pN!%kjDWKZCr`K3TVp9@{BY=HbvcgMbX2-6*<=7fax|AHl+jyi5V zoG^HqCH&-GFDa!aVzEcu@P+s16CUgXVaV%faxHU|H@7j_sA!oxoB~fC3!;+bbLyES z^u+d#@WcHeAlm%BtaTqK0Zwl*@eA3jY#%;)$GH6H{v8R-ELe7vcmj?NHdDecv0Okc zUlRR-ikchn;{AX#z>4*=9}XOscsToxRbP2Cxmnnl@K45y@KXa|RFML#B>m_LMz4sE zOD)&WVcP%6d|iCtk$s8wHis1^V=vXs__i&+1bXwR*4c|+tS33RF?W5G&hL+rQj7l} z9ssX*l$Tr2f^mimznfT70VI#+I;FqL9P7;%sL8AYTsEgm5FLeJ!qyz{qY;YwQ`FB7 zT?8Lls9Bx*@;bgPy`;T}R^H+-p0;I{x$5CF{BaM?krQtgeAtLJfqTmI6I=fU-2H%Y zDTH3F(ub9bp}=|+WhTlGrSRu+=NjPH5M2IlJHn0=`x@roz)z`Wv86?P>qxeR+X%e# zxBABoRR6~AdkC`Vzdo6P!Oy+Q>C+q>GS1WNWr*Qa%&&dsJHrTJoq)$e=f9~cJ(bA( z!peK54*fk8(O(9^FDqdFuVsjopIyufzq0RwJOaW0j&zy#4jB0hih5TrKipo_q=lEh zj82d1+EZwJD!S2)GWeo8|7+#h9RW{G*{HN01s_vCJz;+NP^o~LU)9_$ReX@nK+xi@ za1u)6?&iGeY7_|ABrLdnW0k7spq*qiMU%hhjoMW%qrLj;b$Gz8fBv7B)l}$=QZ`oE z;p{oz#T}U4zr!9Jl1zB1GXaFwCqT_fB&ZjG9R1W)S~3Aw72Ds3l2XZyl7)>EkqL5n zv;0cXw25|)4S0?ucF^rSfeW;R9))9#pH42pyTCU4 z)$4+qB+Q1#<6*2DdXlpu-0rci$?aXC>yVKt$%Ux7NFf-lG1yVt92b z!()<3Wq$V;c6mxtGPRpKm?*^~%F0^+zb|F{m{VK21P}WC`s)^FY+1ZDkro9|?*Oyp zrib=gV&k%?pi6TPdGmgTrGoFc_ptqJ#hO%SIV^sPaU{>Bg&ucb&YZ2c^q&1NpOrbT zC(KBYOQ}WS-1VOB^=Z!Cyym(1&x7~HGsn>*vQSuXWm1FKKhx1|mrf~GKg%|_e&_iK|D0p?KObdCiNQ_-tRz=i+9Vn5 zcI63_sIh@x9AsXCgE7B~5{e447tol58h7?{3=7S7YY#HgDMWam$BzZI|LIevJ&NnV zjk`vD1aPfG(C3Ro9xXLpP;j-%=$k%BP7>wTkaD)JB4w{ybUh-yN#K})cA^c`bSQ8N z@kPEKD#v_p68^M;wmA$P=>8c*{}L2R9yfl6mz+ate!{K{bPCBu*kyU76e9c53VZq7 z4@nZ>y5EC=F|O~b@AEswds1QX6O$O>#;6k~f@?0cj=7h|>vZMLi7*kN=WtO~dsV>j zP?Me0cVK7L@+g8t%MdeN!+M{CzX(o`KgK0cz`DG3G%Jo#!iX=c!0 ze~oOMk&)$Ks4>?D7{EGp_|R~ond@FZ-%!-$$fJf6O^m{-95J|qipy}`x3#1dE>~H6 zSkB3LP&Fv0W2x(-bQ^C>HEfpvI|$fzl10psA>792vK+rohzuB*=xOE@BS$_aFr^R( zdM;sh-yEDDY-Kla3~khe4TgrrBmh%~hGI{&tU_cAG^ErZK99evD0S3Vs6)|9EEWIH-tW%ovNf~{TcOXiRvGW)Peb4K4*=6Sz!)_^c);&+*Q)6dXww>L zMuc1%*@YZVG7LpkD6bm(3kCf1 z6#2RGX<{ZFM9I#PreNpGEd(M_(e8#XaNt->XV=6 zp1RyMxakalF4S#p#Y2*552@a2%Dqe1R*tF_G9qDqi3c#Yo2SKRnr>eQV{HRNfs)qv z3PaST6fD)+;+NE%_S%NGILG(-~yGp=5X-QiD zPI%)HA1}k?geLfCIjh3H+I>Y=slu`(4nJE9NS4sh6jl4kWXb7mm?tDaa>vW#GYoX; zb{=ip`P#n8y5VL~tqB;l>Uz&2r5Wz+v;|*CtmQqw6ypC0hsFLaE0A@*JEEzje1qc4 zDoa$wy__?aWr_`X>FnX4R>V6$^BAmZHmRAWNBN&SA>*LU6F{?$~@GAlmZWl)(6 zQq~_CIee&HpKWXvsV22oR0L+5E080$oKjC468e*}wqyQdpYZS%J(v$np{z7V{n65L z8zF)`#fmDK^L7Z`CFqCq29)|&7~X?ezo52 z%I+9m^QV$v^-oM9YR@a9Y9pEG$I)%CI3zT1E^a6Mli6NFM$lx#{FU_bRFzYCnSH&B zh(oeOHm|iwIU5_hw5e@E!D*b9m>ZEG3BB~hh-7p=NNfsXwo%58Y&OWk(!0Lwf}Btp zQ_$a?$MkQ>@n(voF4|6n?*x>9s|jBB0E`8iK-S!DIMUy5=)>*I$0<`ErTW{kN-r8| zm@HQ_sr+-MkpfUGMr?>hU_kAB@i*y_50rR`VJ)#8%P#Tp=`IxSvA>eFrqgg$h6gOu zhrin)n4mfN)h^uW0)p=L7Hn-tI$yLJI`tx`Y#p{q3|7eJkOJ;T<#-jk3i|F2O6lBG zuu)SZL&xkhkWR~gIDg{8KQ`edQL%Fwcob!||B9d%l8AC*LMi@)7#CV7(r4SPm#=cdS>>NzCGbW;v zX6SITWy}y|%@|u`8O0bzB-@Z(IbYT5JpJ-qf5CmfUf=t5f3NHMyg#2;;kV)em&`wf z$J@Kz6U+sCxI7M`X%-@;kIa2A%Bl6~WnaIIHxJL8PH;KXjf{WGirO9yP5YvMi|a_r zPH9lp49QY$gfbbYL+HJNPChPv^^j=z1&Nq#Y3RbWoyWgDY}L%R^BjdN|GDFgiP4=$ z+%7-oTVIPVL41S2LyLK-R=6UOY+8prAur~c;#gJ$I)Ullkr7CHdyBYv#QR-n-6|Fn zu!fOp2aATe2p2m1%&+fbq^nH?Lf*1ncB-&(wA)AJ`fme;$EW(Xv#A$GWO^W3sv=Tw zvlG^aaNjxUDnm7u79JUb>yiNig+qM+wYujhLYz9Jqf;cig#Fo^@0-pESG!}HEz zJESz7+AdZAydO}aXpcTWJfQ%}p&ovnh_X-Df|e5aNY7w3>|=^`2eT@3O~@>A^>V%r zZl=PnA>z$-D(9F8m47wq6R|V(Fe0Lc5wHp5U^`z;?MHUMbZV2C52pgAKa0B|ujMk2 zDJCyL_|qb}%dGVPF-?@Y=3?cWBw|9UncYU2-n8keSZxl*F28Xf>;Me9vTtc=xuU|_ zP1KM**S^8@MEY@}P8uED5LX{pe0*%~-V=>?+5HqBFj?fDd$!1g%4o%F@u!4e<33{$ zl90)!e9}kgW#GD~N^BsUNo$=VUgs)$uO`jQ;%Ya%WTGZKa5|d%@lH!r0jJdcro5od zF>9fz7o(=_?ENXs7Dtozv8)3au;W2?5$T=Z`gx{G!O=|r5JU#)QUQ&?FCJ(NumYzP zMX509uI=(WI=g;1QF+KleVTB_@|8TVa zML*xeT9S3=Bag5U3e$9ba@!gNH1O@e-m3fiv0NxOSokL@1?w0c&D5BAKAuaiENoV z#i9Y&setBwubPOPZ!0hGXWQ(~HDdQPM^{MEQ~l2X*khFK`y2}r2+f}Nd6{b}W|&z4 zeEpSfO?L>*@rr|&Id=Vlh8@KwR(Hv#Vuu-x1#TSztVEPzwY~MlBI6)$k9@oW8)_{9 zHJhmC2-yR zX{WS2I(8I!#+J1Zt)O~apjb7MCF$Rf6yQekb2`s*Of(e%E1Z)P5Ea3|rtS-du5xE~ zV}r)6V!0j+B5a~wVd_Lm{&>&OBoQv3!&D+1|Jo#zY;6~0hol{X#Z>zpH=6t&^}kg4 z*c=0kAFy*dP{kZ_?@Wh@mw2yVM;?4DebsSDj&o7XxM79Dy*$_S`{wFo$y^qPkFJ=V z)03WH)N_`29Hnmj&RydaKy~RS{GhscFX7dynVK!1J@3<_TG+Iw*(|XJ=a<|YrJD|0 z1?!nssUMSZPHsOWG~v$~m$)3ICVd&dZ@+BZYU?3L%HWy2jfsnch|2Njh-m36QQqt0_eFZJO)P-21s`x!YpZ4pAA1%i@EIHR4z zHb)t{JWVLtFDFMpdE4y;WR$bDu!zxalw8$NoDf?o5Hbxllrd~UD12txQ%wqR7V>XT zb?+Z)8XCP#$eCF58Vj-V_x{vV5E&j*vp`hTDqT&ye~m{Un!2=d zNA_z33}{||^yLKwA8=V*ZUT-pr3xE51veUQn-f>#JHTX_gAXRxR zqyW*x&w+;W`>EIr;b6WDxL&ler0`4{Dl#kBfwC~~X^KN?XyJgv5qGF2A0^#FBfLSO zkAC^znS-odebYyDS=q4CsZ|EP1vK&yh+{Nepr^S|gw;L!U-A|MOVmLdSl04Vsp%fj zKyRHp8cRwY<~aZOE5vBR|>>UuE?}MDz~s-W^uX3 z-iq-HTZb75SXn(~m*e4NRR^EuT6Ze9U;f+agLT3-A8Si8(>rMzfJ<*oqd+1`2S_z@ z0~n^#7>APf&bX{kqm$FVh$H9E`Qw?M8ZqT7+bAqUBdfy+iSKf>{H8=X|POKC_ z2Tw5B)>{*^^f-fHJz4lfFE-kSpWj{6jJby!D__ao>hBYccNepS_Q1fUP=gk-#hy_R|2r(0dCzE+8%)hK8XvPgQU^TNFP3&YHQ8VWwpUw{ zdza=4B literal 42858 zcmZs?cQ{;8*EdWWQ6oefB}k(8UMC145+!<#&Jadt7)GKddhbNE=)E%%6TSCNMjO41 zHpAd`KhOPr-}}e6uj|xnon6k^Ypvf|YyZA!s=p;Aq9?+`!y{EydGiqu4}bCQe30y=#RlO9~3hTjmRY8M9FQZ}Fq*O7na3Kjkme z8=a>A-o=*=ORT)SxQD%YcJc1*+ajy~6?sEK;#8vc$-kQg4NsBbSA0x$5O#ZLgk5*k zND}lEjs9jcJJYv z5WxRDT1`{sPIf_=@`)eZ@y{Sl(jwUEh1SYA%LgaZk0yyMchY;*n)lV}ETb4cCg<)2 zlr1g4Dya5jq^MpPn|mqL)}q7J@2giO48*xNZ%Bjta64h0?R(R@ZX1Y<{F=5Gir>P+ zXBoFf>7|`?l1y$|Bh*MF~j9HKTN}1e_a(V z|8e;`j(OaN?0WAI`UL&wrk5Nf6BclZ;4fnbgeDU_=*^|I_^m8_nnJE1H_MD=i9(Hz z+zb=2Fz?0SV!Pe9iaKzz4;^{Dbj@NDyX1^mVC-grpKk8hetnzupsv$>rao5o+FsjJnu9`Xp?Bc}Y`CmLL z=l@Owm>^zA1_MIc|=i44kEncLVk2%4^b)o$?XQH`h25bXbM8FVmy z*BHRJ8a0}KK)zz{MR1LBG>vbFb_RK-SRX7!cQX~6l6C-b2M4UW=}JNlD$SWxxoIdew@3SEI%JtTrD{hCs^9%XJSfX2~2_YJ+XM?ME1o) zILkV~AGWS2?7LN@d6TUybnvC$QKa?CO@qC*zTG%|p=ELE=Lm;b<-p~62Rn9uo{XfJ zBSDyqmhVv7J-*FscWp9mN?okdJK{9W+hzFKCXi$z8@Yc7RqPeNyy*?IJss76VM16= zP4NgNB)`3XlBmO%eT5LG_g1{cn3gn^aDU%8;#6G!Rjjyv)HmgpD92np)AnuZqp2C| z2PZ~(oB8(RFzC&A0+XRO*QbDE4@jlnL4xf}pIS66FAXzLT^iri?H`5Pixz|u!0SZ1)pBWkq-gvn%N?op)n!>$k)a) zJ%p6cN!w3~w>ZiaUrqHFjby#bk+DmMZnkZsRsC-g&6xFf(QEvfKcB&Zxt4}sZ->(Q z;F$0~F}I4u3zIRhusQUv10xy-W-3izt+WL+n_SN-&*Z_kW(D2m7o{W*N8=o}sr}Lx zH&s^D(9=$D{=)J550kse>Y3g;v}bTJk4g2Y3@x1buB0W@-)IpOy-V_fY6bWKNZ2~| zddGxZeL{E)COAIb%zVUtDv#-Cw=35vW|cE7Ulu;|UFcgYP+i(&tuq-fOTEtO=wQ1V zjvS1n|M=?V{43%4>Y`DN5VerU8tJQP3g7>k$XtYx4}lmi2J*lG`uf$o-%`=R!VsTk zzW^`)1nAo3Gjs}pc&}`Pw+aMQJ;(NOP&_|OU$U}s^Ycq)qiU5XhAw>Rijf*4CUV)gM_6)GFL z9F@ECNBD&kAy#>X89N%ubjg|6(Krf&w6^-UpXBjpD@(35&5%1>`_6zUt#MUEh8=mP z6;SIu9IiqX{jbKCu9$Jes*p4(B8HiJX#N+(Ak&M$0@oU*;mOmv+^T6@$GC9=KuQ!!_F1O;RUQsNZfi2{*lWdzL|JWxK8>r?ss+)ET4J-;pg3^RPJ2{4W| zh(6UDP*d__E%^8|-rMeGPIFXyKB(PpOb@%}zq=m4o7@k&y^38d{Z5nVe?*uj)HWze zKU@^rlbKM-L0{Uy1Qkeye4_f1+uEwlo#?%bz2SiGu@dw1cRbEh6n6OPg*UHTNZl^M zMq{WJp{9eR9@r;t>;(keq{!fuZoAmm^ErK^A9Zaz@Yfb%`5(&^+LcvlW{b@imc2P2CZjVm zWmV*g5M@-&U`^5Em$Xa-$myk^vjFP|Mr@9E7rS6Xcf z)}ktSQ;t2K8NDW?d>3~$Byi8YbgHC}JjaAPOr3tmN3IrUSymJOluo$LgiKqGT6n~X zPZ65CW|>Rn`kv9S;2^@(;^kg38@Ekn|GPDfMNuxmaU`?eK>%fnUyxb+mnvhCGA{p0 zy1ddUBidJMlkrE2%z6~xMR?z=6n*6LJ2PqISpV^OkbKs z?BB(IXvUUe((!&kZspOLD>6q(7onpyH0kDYs`II$k8Kl*kU`u0?Ct8Ye6#ZuD_v7) zvI&x8k1_O7FlTlnxz@ORzx?)+%tcsdp#KkjD6fOaXmqPonS~}QCQXlh zLbR-JzVJPh7N_=G9aUXO8Xz=a3~9Akor!Xoj|3QPFGoCTWxrHES?as+jK1J>6Ji#v z*NaXU8Z2Phr`)GGWWEQi(y2@ae-SeQTPjP9I2{e3#AeJ9j zC^F5i!1}Kz<_alI#5K?xwk;2a#>8iqf!>?#XZj8tLHMSJpJD~n2VObLGOl$`?A8U% zRKy9bhE+)TSe7^7>sF{Q#0nw>?kSkEGfA;_In=)&6Uz{A(a3DxrYdZe4XcBX#ndM1 z58Oe?slk6KN`d+w4XO{a61fw}eZ=Jc&7Jf?L(9}NMRmB(2_?Ox`ZX7;Mq`{mm6HnU znZ&gj_|4HUO6yhlxz*x!4(ip9fBt^o=YQ5EY_pllwg06u-Y>;@EQK%retmp9_V2N? z#5T=*>-FdfdvSb;E8XpywB7*Y$mgkh3om=#Gry{o@r~4*wyZa)7Xoe1&QG#vR5&NX zWZK4LX=p%*+^7L*jjVq{j&DAs4ZNVX(flSZ-Y{SzUYR(xFu$IusNBCB&CER`16RFq zx%DmP;B^h_hwZe1D)8V}-Wsivg3Dh78bFxAi)>kNzL?5Jh2TO}-iPUJ&yeoh;C^{& zWvNNMRW*6}<)bHnyU%%p8I4Aj2cOkq1B^Ss?}lLD#L2PLmDC@%Re1P$#3 z;a&58lCNHsbwi*SdxL_yXL`2@ru#Alrz!#y_@qVr#iknvIwtR3Ui@^Lmq?LlG}t)= zTGd1{8NK?{YTK-bGip9M(yCaEMeQ~=_L=V7Fq1oZY|9tqiu=Zjk%6T^Z9H?cJSi*H zddt3O3CVzN0df6Cr3u&eLb|Bi@4V&nTLyH;@6H(0y?a&i$X)zqI-T6gjU3)9#r7B; z?X8TkU1a&GO)O(X@Dko8g7Vr?a%L{eHZcy8-0p{&8gl8u-FmwAitn<%%6fHcru~ZI z!kkA9Ed8QDW)^y)mx?|l+Llv-Z>H|`*uCiqs@hKzPz5tH>k)744zYjGw9(s0NB(6eGrM|H+JNgRd?~+%GQPY)Je>Fnao*~-s z&dhyJ!XG6xgZ~n&4|ep-;^Zq8FT+)g$@t9_C)DjFx3tN#eHNiExZPZwyHu~O4{VSxSj);xP1oN?C(JNzHMm}{SBTcQxkn5r zE~i9K{YmFP9It7Fx|iOetPSVC_iUv6b(*0!U+F5G3Q5}c*B=ibv8s1MEp_vfb4b(0 zoj&Goix)QN$U&!dbVujO98u&25%1gB*y2Am`!;uv)d?Te$rOXPxiCB%@%&sqP1sx| zx5>qCLO-d?mnq3B?PHa80j6J#3(up!oPbue>NwI>@BSJi(tT){4rpWrfT#ZT23lpO z%il$HX`lYE3#l<_s!(Mzp8J(nCde_uY4YLs3=sS^;YzRkxyba38690`ei@(qf&8^P zt?Z&3ReN9a(#D4V4jOR62^rnSCal=yG&%KfZhVr{y-suZW0&h{nG|+r4RGefp|gZ; zGeqQn!AM| z6X6T=$@e}f8NxYVn!89NO`H8K2z;?V=jr^1M(-b;QJlv31uUDo#%@|1 zlIETmPoDEV^4Y+zzk_4C^VqG}u)42;G0GBF^@0+X{ZE?xkzV2tVhnnf7xP4yitKHg zkHW|1k(^^hbxTXz{zCJ=uY{t0w^~JwS>!4P;fhK!Pe(y`IVMX#WIdfEM3>BdFw)Q~ zNQzNcb+{sNi#;TU>HLdr|RQsT{ZOA73}f zh5#2Ehee;aZ%8|}Ins)fN<=c+V34)193=s(%76-(TZD<*lAFFb6sr|dN-AZucdSe5 z)}uhbW{sJafLttoyWhW2nNfP?70x|#B1)dKG+OpOw{v6vv2a-5bhmn1M}xd{zJd6T z;`OKe?|2d4+hjlTiha%OXy{AgmU<_AI{c)%Huh{qX2`wsWI{?w{qdM*K1Ijbwo`@N zN9E{rsY%frZwD-^9F_3dO<9m~OO4+~-aLyAlk0ezGCr^F!=om#L~CIby}g(g&Uc?;BUl}Smblb%yL9XzN4l#{L?}oY02|) z;V>m><@l(8L&Wu#&Acxdb9683~J;^>+;D3v_+0)KW@)Zn^M3bow!X`Elds9 z)Hj6(!=D=0<*G7GzGt(2`i%+DPxZ1|-ETzPAx|Dm`{PZqy+PEeGu&n4Y4cvPE}Few zig~8LG0U& zs@8NN9u9~0X`#*I&%6@vJzQ0ZN>F0xeK%53_l7&HTb?D?+leUUebMT8M4lk#C?_W= zLp1wkMtbH{NT;0EGo0W&;g1((f(5HpK9NjJ$%`IN!DO`h`#f*P?XjC;7m}QzMrGn@ zgKSi<%c;dSQL!n?5nua{B-)jfiGR3SjDelEVjs@qB|4z~ge8#1v~f+fmCSf_oE9ck z-~oSatFT?2w9fR$X*<;8|MEz}+fXKWP?|POOezp{|Jk)uhvD-W`!G~YI*^2YtV)pQ z_LtZ>Y3h$1;*fWU*Fk?`H&ZH%N|Fy88eeZZe9-6lH&$;`G1f-;Fc&G|h#KsxQGV7( zAR3i3-q!Pu^}52xK-$Ye(%5R-VneE&#QhM~zO`eEsrTXMFagrXMl$bGz7%y(3E@hk zKzGbmj~>6<+rXlO}7hN8C4%%9W`8SI44T zN;p74yc+~F`n3V6H8#P_5QsNX@P-0ovh}#VfvpI}M?r(Z1D!oc(E_7SY8weKW1bX; zr53f5II>CX{FnkY52vy}R~=*XewtIXcO(}#8s`c8^c?1Eo@G+X=(YFAOX4V-BY@|n z)SSrVz1O-jy#qSBs#SvJqH| z@Z2gUo;y8g7(nH5nqpb)$Iy>h**-yF*; z^%V(XWlFPU$8GyF#EYE^Ku1Fs{>SWT-Ash*XM^7y1fKnLDHo%{i+JMFXjl1LX0Q1P z{Lh3YmA1~8YQbx6{%j;qFMB-!mULgY<0586f;;4Us3i;1AMq#YVS7?BTS?YaYiEMp zNGJJ!woX*j_V=#dYs0<}-hINn+Qe>qt3A0FWw!qwJ2Y#lf}pq9-bXV{!h0bk?@KDHqt1$ zc*q-U$&A?z|84tl0nj+Zw-xS*a4VO{$h7%~KxSwCX611b-k>jUI(_igK1j9Yh-?oC zw?c}cqAfgqv3x9NN?bziUox`ixl&e|`*j7B$*Qa?pg!$Jg?m?JvDN8zBpQ}u0^gC` zVZAfD&iy1r$ykQ6FUHx+dp_*NLNhP)LDdhSL53Bw*GT8y`dNRKbZDvN!3b%{rGPBY z&>mT*o73r{$XRdC3ZOSCN2u>!vOa^T9{d=chQ35ax%cC5Tm+PR1Dma)xV<^<192+p zn((fuI=oO+4f5;J+;aJZp%Mw0NzgMq54UwLs;*_R@$s$7$wKyW$wo`x@rbNXuwy>r z=ok0rUBf08?N9a5Vs&0kW8}Xx%bJTawV2}o@5h852;x;7tu0yyhUQ%^y0B%bW`5!&1SYJ`VWxLBg-zd?-OK@7JJT(`n5`TpqxtBGecqh zkB+$CczTjk`Dy&wV1?Rgr^NFZsNuzpEYygNoM(qrD^A(tH63H8ImEUdMzE=3X!6F` zeR9&mIoJ|gNZo8IEtpSnh^V{ArontU!RmA&mAN;ei`8IWOBy&lFfH;7C(C1ww<);r z2AdQ=GHUl@-{A=*#lY!Bc12|$Pt1=O%!6{B9)Y3D4~j5X73Aj?Ol{oTv1(^}sGge^ zgD7HVW+!aRrQXajp6)!|A4(x~cCRAf17LL_@}oYV@K7wPc$DmAyf7oE;6M`Joo$eD zH0Uq=b+_lhy8FDepE;<#RtWUK9RTNv?5`Rq8qQ+9i_4Zk&)Y!g2JKf8m*7J~l;INGCe@qm`G*38p;4l}O8B;^sYLg-j&0ZO{ncIPq2J7|ggMlf z=C8E4hN#(vnrdyr1@F%_LA-u$buB(*d!&=S%;y_gXKIL5l$7~}hCh>I8l{e7p%Il5KVf)TzoD0^pBzMDTv zi{;r#t87-a>hNt5)>Ouh%JnB%T!!ps2r-KOlOAXI7$o|bmT8c8CV=dzlFHHAH!#We2tXa3cG<|R5Ug6Gc+ ztfMOavb&dQA3wRg%i%_qxy&JuwdnfnEdIhuv=PQ0pTsFeO{?oTYmn=4=`Y>CLBlvU zmJ2_YV{^b!J@K)&X?L`1H&*8K&vbh)a97X>{FdKMaAJhRL#%fpqOG2r?e zII?8q^ez+ddgJAZmL}COaH**M6ev^co;tnDepbY}Pva~B4sd2?qt|*uCM))OL#*H* zvgf2x%+rD8JegsdAEC|CtJ$IQ_&3|V0qdYKcX>^ctXz*j(&||pInuBe>A^K^lzP&L zz1>&!hwgfT<>Y-L?By!8$>*#^I71l^WNx0x%Lk72wf`o9F6z3&B2Z7+=@61b^F{ym z4Cz0GUg2t2V0~S+qV`PZa&t5`^&&)jvELNe2`baLVF5iX=(Pyc9m3Dy29J1r|E!w) zw$Z2yuKSZMowTo&#XofdKhmMeIbO;#d&!tQv8arH`CI=7NsAz9^9O+v+gR9f$wmc~ zK>}_h=fA9joys6fw5roa93|5ru8yl*5Jw1av6ivd|H;jK&Ylpc)e8)za(Oyote(B4 z_h&+7!W?1AT%keGK1sf93Hg1L6;_~aG%xTK32>D9PC_BXo4BBrcSAj}N($HdOTW<= zLS#RhRj?1+-jE(k)CkMcx)L%e-uTUms)=Zmd<9uTFi%9s@pp6vTab7$@Zr}C`7Lu|Exck| z7F(8b7>*I^XKQ4#Y8GqsY=x{Gwz)OnkmV=qMU}wU0mt3Wm^?&<(cjRD`MSSEkA^`JTfr`XC_@7XEE)W`o zs&&~~xl2&!<1n1frsedZszBd!Dr`?Hd7QQ_xqG`Xubol2YZkA8(R=T6sXG_03^~)t zP87d!gG0~K3(zTH(>AXb`tZ!20ZUF#`8TG7s2}d!1+g{e79-#Gj`T9M-6L+}@L}mS zpywuERo?tPp^mxt{PjmlzQ@zU!}k zh!z_jEp$$W3MTx6Bm18F)OlA&Xpy4lYUcGnIz`sIOg7f_Io2%-^t36Io6}!v*!OJ0 zJ_#ZUf>r`-zpx+vMn6d(LqK^GJBs2W0Ux7HmP*J36>KC4k7u6oiVw_yDzRm(PH{S+kD0Zxq`tQ?z0Zq6~ z)$-tJ3;gbQyD4~oWX+xqq2k0|)Ah1!h1JvH+i~{kM5>>42=}fK+y&{;e11QyAGqS5 z3f(UdHdVYS2k7-CD{r13_c8a=AW{SL70SJ)R|3#4ns@xe`qW|=)|S6r`VD(CCnXtY z)DIdi&WRvp@CtR|$2Dn2MP$>%Tk>hX;u^b4G8ZKK7bOy~QcrNFO9LVpl>UKuGf1`Z z5bluNhB{Rh^3*8+d@#R8#MBS-_L4*ZOm-4*L@O+=iGxeyF|9F(ar&-INdF>)ALoJ( zBf~%Nk{Ws(!w0t2sGEsSi+f2t(z>)g^`}#vbw-!E`IxST5xT6pKqN+LquH8O!$ds|K$~8`Yd`tV z`R5uOPr8@qioSV}zM8Zn-5QWCC6}EM>{wsaT>QuQpzQA(dDB~+kq9L=k_)`};M_6_(XwvFgYi8@ z{?t|97#=8Qc7?hX@|^zJW`2!pn9x>jD58p?KmOv!($Vt~>nw2;1cU0`Db!PJy%%eRcEQN%Hxr)@Jr;Y9;zYeBNa1LW6!mAF zhe(qWq1Sr5GFaJg6S@69;WBPO^S?U&0VZk(!FBJMpXKOfpzPWvAw)w@OBi}c{tyW+dS0~t`Iw2n6N8;q#F z{$BVEYFb_2g@xUGVXHS&s1*^%*!A*+zW`VLNEOaE)3SzE%QNM4c>JpVfrn^#IsE+; zx!#E?{X-Aq(Yf7%S=r2QQ8J#Fy`W-TukxE`fG$V?q?}QAnP5s~+z2dmR*x}dB`@~XE%gawyL$iUq zp7f1vNl~Tujvjw@ZuP;}=s;$%5jYI<-YBO4(s?91!2!MHk2tB!bc{LI0+0J<;bypN|&QdW8dZ8VbQ?Clj zm#cz8v_{)sF8(BKr2}pfKWU^BZpzCV;u?K%uciNxlz#;di6w&TV7$7`Z*bB!6fM=L z*lBT|Y5Dt4gPFv+9~kbP)H|lMCV38O!#DE39YC$A6~Ecqf>rn8!b`o^-zV{eipE?f&U0+d9NmOHCwvY3vS*|m&qbIv!Xe%pUGSUhfjKP4dj zqO9(LF@1e*U{Tc55=m|HrDXhuMjxfVT)-;Xa|^SS?g%A|iZ4@b)?-gV>hm>bfm4N_ z|J>t|;1qDY0L7vr!(FO}R(EGWX=9f?dhsY`5rsRyPUVdOx^D(}{4i!Rgd_H?2r7XV zU%6}NLVVVrMZJQ|?CUWhEHSZ2rQg&^ds6o*88|1z+9YA3SIh+InBdY4wNHZzTih>} znV$p02Jom)aFs^2Il4AyU8Tu8CvM{8st|#T{D&LZcDwiS8jkILV-$JT5nQP&pe1ZW z%UcU=xwM%*;$Xwd(7)c3F~$tfCIwp=K1c_Z^_XX&sUvd4xqPpNgFu+ZiAF+h$&0HxVFe$ER`KLbeL<~`!(h)1a~aj06qU~ z_U*;`>YRQX4~{`TNenXxKy|jR@guUSOsFZ_Fh_z1qeMJiyz>;PI{KVoNl2SJmV5t? z6wrc-h$su3igz3vx9aQOtfE04`W`$~RwAq9x4=QWNi{dFz0xVSp{_4ao+k5VUf1Hu zOg?f0y-CU5q(syRVh`b^VW{o-`GATQF|4GdcN{kuOlI@^`kHd#Q8E~moaE4V>Q((c zLuAPR_Op);Lz${eYX7^SXx7EW(e1Ly87ArJV+G(k?bQ)p#>I+jzfa?ty|H#{+5G&g zyVV`mJ$`N<@{Dy=5sIggRcQs+NSgOvCr-}p?cG3Ml{9182U{xUFJs@b578f}-~0^I zn6K#yCwsOa@O!#Y?}Kp;teq{2=D#bqd{e@3KZWb^3QVP2jMs_vd9}K#6&&jLgqVH) zQt^U~_*LBL{Toj3q(VNmxP&GLvDWLQIxC(CQlxf1w{@fk7bcR_PI!O zJj$(oHPHA;a^XW*W)UM$ec@-@(Tx$031U#C|D@i%=Z{Dv{q<>usPl{MlDA?~O2IGp z%DIAxR$gATXMSGF;v1SBZgg|>D~vuK>~e2itFBBI8zg&r+$(nicbp_OH-5P={L6j4 zuX;XBVrA1s*z6avH_s`ycbZy#&|$nGq_~E3ezU4@v!^m+O_?-8Oux zNKv*=Ga|d-UqX&2F?@^@_a_n(fj_T^@||wuSb2zM`a9VWgr*a zpv8g6bFx;CD^LB)ZEAS_w_l9mJe2y`U4mSQ(@RKz|8^!!OrkM4Y4R;KdMscR@&o=c z>|jFuL6)LaMVX{|{uW{Vs3hiV%f-8LKjV5_^$H_}#Gi;DX}MFBQVB_hDDay8{t6jO zUV%Gd-k%GQx?PjO#`)QM_byWz)D7SCB}#huZlEV|7u?CZmvWg;yQSMMX9W+gSMr@` zJ%5@_B-OlL_**5(4G}b>E&qX=Kthr(C9N&Xcd3pg6_sJLR)dz>&;DfT{@#Y=lQSAB z3z)f{((W5Xd7ouE896qJOYcIkg?iq9U!6^7i4}Ne1bLYG?MX-q*Pa~%W-4L}GBT7( zf58EVhI{85AF~Y--`WwVr4Ey$mrf^bz0L0Dab-Fv&5u^NOED4znLl5`?&+m)!TmpW zl@TSYOWfobF1#R~aaVaN6-s6sma%CL7K98YcKWI3@Mx5kjMO3X-NmA0Wuh3fLJkm& zft^DthvpO)p-`Mi(+hMA(bEX!uV0l}ayzSZL;Alem=l`gs@~b*k1v?jeMxdRa7)8u z=wuFfCfqJ66d9TkH9=yUD!rO#;iKT^c4YW?Ad_jD5BYO8?bFS5yJMD#$s?hxXMYUd zGc*NGtpgraZgKu#cq5;8RA(#oFhoH$=+7#D=h=yAKsb59a>?O$lF#}I7PT6YkYXjH zKFMX5GqFVVZ(<5re5Ac>^knP(VpWf>vXUfeau-DMk0C%VpoJ0Jza`1Jgpy*)v3EN z^J$$@c69|{k{3fYKV*a&+q|jxIy!OpnjyB(@h~?PNGHGXYx~6O9z2#lxtkACug_tl~0N`)UkXX{oExH_Q!3q~%Vlse z-)8KTp$C%m;x0C4f;L0diF-O~QWB+l#1w}8Zzk^VF5$o4V=F|AAQ?S+U27E<>UGoM z9QwZrsZJ{Egd^9-4v-aZR^rwiRP9J;l-X?U7gRDLAKr|Fi8oE;Zc&X&7RfB0lVs6# zLe+#{_CmZbHDjg0N|BIX-%ldF9#2?NNZF&dA(f~+CWgtEgxsUbg(Xd z>w&*O8Z&kN(2&`rFiXDE&EnFnbJ+@=p{O-WwzZ(*4@)9ui#}m?c?&7pXJ-P)9X`$> zsGAAlS`5f6Xj873Se7G&@O3Is$N?@98jA5FwP2pu%r}LBRgbf~YG6=chJY9F2xEB)iyxB z0|Ug5-c1=X0Lvyx%NUN+Z)UxD1>tu%#PXxGMRC&Kv9~ODZm^PpoCnWB~$V|^~mNADNF%wu~ zr0ijRCS_odDZ*q>U|v6RE0t0*|&x}Vj-|3!4`Ri*|{?qc8tooY!q5moN zv%4$9sQlc?g28*bOG#C!l66@&dk#+eJ$^HRA;#>Ju?`+LHdceaz?$#3BcCLel0@MG z9#eUMEY@RCT$%oJ+)|EjYWGOFesh4^wKhrxM(s7e{pPWI9XIH0y9GW=78~$mAaG?F z>#N&VD_1odH^#0ES>$v{v-mu3+5kWkZ%9^GEM{E>8}HEjc1pczD$MKbWwaO%1@Sde zG({P)Z$Ho)aeI3|wugT>Kd48Bk4?wpuVx@e!2AOqXQ0i-wMF?y_1F{^k5%>#q*v*a z;6JW443vXEc^2+H$f?>oY7MbUr|ngfR`T`v$Cc5|w3Hqll2h=RB|ae$POuo@pWmEQ~7y+driGWbD1L2Z^rsbT3Gx> zV%kQAvB{eH$TEcZwZ(erOCBzB`+*@|Ya)&xCf**N_OwGKpE@L3 zV7y=O@q8u%QscFMOe6@Is z!&(KFXfqK#o=wYuMdO!nVUa}Ars2vJN3{)z9sszRSIlHKM~~Zi8y!{$fpEPDP}L5- z36D7y8t4hiJ+`EwCU6^FustTECRRMX6Wo)85P(2Wm325^U<>^X(ez`<>%kbJTmial zrDj2@q86QjU!Te-FRfJQFV+WGc}FHciPPt+<%BHD?E3DvOo{ew15K zP!d>ZuCyr(_U9L`ZU(r)7w-`OYF<}cXvPB9DV=D0iY)~&Rjx@_!|Tj> zuz6gIPzZB&T6`z@S>h4{1_4A*eCsUVKdQoQhC18O$79-SLe|#S1g#5g9xI!7WK!T`#@XFQZy*X*LrV2Dj<6p3qkS63>-w!8Hdw~iw!z`rP~AYmJMDZLx}Lvd;j1t0E`f^dd54Ce?$N_LDv{MhsRN_G)eruC8*5e zeXGG(66Kq**xF?FjEqka627vG|GRdj5A!8uBFHV)0}x6xj!xlR&hkRc0LEufVQSvj z`{~bV3PTQ0{*M2hdAO5Nkkxfx#ObVZBNq$+1u=@cWWg1JzUIjdFT>8go za>U1ThaxR%{`4ktUQ`4}7+>@(K{|mOQQl}9o-1`FqwWtWF4gK?5{BNOGqLw6a0~D( z`7CkZ(cI|W&$a@*J$wln!cTJPMy_xH!o5KErSP|jKzs-C;TV=qfe9QS#}AA|>_#z% zGRpzb$Gp(k5m>mU+&`E$h}IAfj{netw)r5cXOvm-(C`I`L|qE<&%Oh7bw9nLy`P${@f(xVj?}|BxKggrD8)n+6$w@CBjI_5dXw9o}Om-lk}D znovVS=P?{tS#VIr)bCIs6Fg&#%N14shQ|1#P>cBznl1;-(? z2Nn&AqF1_wPoG5}D_lHU3%S{E213jUvFDl8V5vtxT-aF888})7m#UhAC>trr{DyYj=2){X+c!Dl}-D)f0{!-~+sGY?lr(2x1oF5y1TojV>N@J@h z8+q16ZebC69CmYZocm`0#T-0xH}Qy>*H4&P6Uog5T@Jmtl`Em2^Na(LVP2hg*&aL+ zf*QL9guhcLIN|adiYJZ{Z2VnjPTUilNDzGEs|fdIB7|xDXp|se{X|dtVxp??l=wO$ zW7Nrr$)$%`U+8eW^Zw`+5ilR}!()4`+9BJ@7M$8KXZktU0-h$+zvw(R%+jaH)TtH< z>QGEeKnEQ$j&~AY2RoCplxqgi2B_T6^~*a85xHo`BAhUCpaWi+1OG0tj5~A72jZFR ztNtKO_-N&^{8ocNepf0%Zi?oQx|H4?@$@Bp+pw!*}op|9vrVv)?`zJ|RsS zib4U4n+g1%OhD-1jtN}R@wbUpQk!=tIWalZ0pX(^vKQ2_JNzoV4p6vNCdcO9!ZFHf za7Cj`mht7eQGF;&{K1{Jf}XL z<-g9M+&lxY7J@v}rMO%TIbMtA&VgcA-zBi)vNnNH8h7f*p`CsUy)y%f!FNj9h?&4x zq_V6$xfGZ3KA~Awg#W=P6R+I|xrVB=kW+Ni^vAu~;%f`46M4MSta-EiyQ0@l<_S7# zST-$mQ4x-R3)=p?6=i2ZyAn_oLckv>9NfI&?5xm;lm^H~veChWoE2$pw_csD=wnzE z%)n^6yKfmt-JO9WP0hw3qpXb~j&BewrhvtmH2)De%1JYXspufRt z{EJ~X`*WR-SeTC%_32dHS7_o7LMKw|&0pdX*&9dIrvZrKnKo{sWbS z5qo4U%bi6Bk37c$ULe#Ig(B;GZB_ho@?rN+msiDsxiI$(>g+M!f&1<>o1iW6i!|+9 zIrke8Nt=e-9}3~?s@e~^7p1A4li2k{n?4|#DdNo+@jc9b-uZ<&%=2x6U}qv%X4Y-F zU@R%Ik{tGuh&(%FDkDea*8iCI{lSk8=#z0YHjJh}Cx-ma$6#bKVCEL-(kD6jfX*X% z%mU7ZK(+CClx?6o6oftveX-IhK#zlu^Q4R%=dguQ4U|UHp#lycA4P%G_t0B8P+4rC z-P-+=g!hOSOTXRYsXK9Dgdo*`Psp=p)E5ftYAtG^Y19OSh{sF$*h6lpd0oD-xyS+D zf0f6-f;KOIvV#Lveoc{|f%jUZKwa zGxBNS#jbZ}mF_HgaVhNX zJ*CSPVk|sR;F-keft_645)7dC-4A9R?#NM#(wZXmp8W}2Fl_+y-wQX_@SEz1P+PhF zz3KqJ44LN8>%r{lVlwuaU-5=kHE2cSA82qHcqPrY?eGs}SZ~$8qpyrZTpitWbKAg! z_nD%X0X_DaEYx887du&hl<8@4ww zGBb|Dv-B4gp|&ZgsPSLkt8e(wnWq=brbn|sY;tO{5>N=yk)Bs4ZK@|S8Mb^Q?DpCE zs6O{{_MR6zeeqF4HJ{zZMj&Bn>1GMaIxQ=K9nNG0IrnFOX$ZmAZocz9N#_I#VjZ!w&(=`ClWs5_i0eBP4Jl$B>}PujFjGSNBwBl?cnz;cK)NO>u<1RVxZr+v^Y5iv9|3lYXKt=U_?cXY2MF~-95Jo_yL%K&rK)SoTyIVv`y1N9V zJBJjI8e*iS1!ial7$gP;_#gBa&-<+RajjW8t{FIU=A8T9``Xw3?2vzGRhE2FXTXb4 z7l8d%?ec-yyQX;xruLh#l;kSl!D*GmvBb(dClOWhW#fUnh z1_~zdr@^h_NvG^ceP(8!BZdPaJRID+5MdR|E*0&r4)?v6go$W=TEENpNjoB-Sn zK<{&UzM~Qw&`6}s%d2Pn3hb>v&)-|_Mvb6RsIV%zucrK3b3#dZ8dl+cRxnTCW+3k~TT;2*+G_do&I zK#5be*+aNa@5=LfF3T$#<P;Qur(Vd?OaP113g==@-H0A4>#qJc8V51DrRkXC7=Z!$9N0*H;y@!t{27 zN7aXR)56y~Vw95=>yR?~Mb6K{osKtOZ;97v7if|W)mD)|-!4k&R_SdDB(XEG z2^$u&P^D&_dYWsX;DFryMms~ahoR!N3j6BDD=(O7FeO|y0$kb>*`YWyC`{$M?11wH zD*>Dt1lq1FQ|ZaNSFK&!&g>p)-e;zib95a&FP|2h@3^DW0zW;iaFHHDWu9hSa*nw8 zIrPLw0nLmRNV;o*&`79SGaQ|u0}r7W2;@lENWTY~7A7EO3&C10K9NXKs3T|ex;jAJ zLocxoxu7uk;lh&9oubWesCBb5HVmG_u!37TkL1>(M{ToBFwc)L>u4RsXUQO84aAY? z$kAeexw zrG8tm?xm)kjqPM!*?lCu_6#d!Bb@&M`zP4Z!YMp^*o7tcEoxyZ;hiQ!{G)h67Mka82-*RtDEWF#J|_iO61|3Tho$EF}bw{nd}QbOO{*HFM2aM^|w1_n>rr0=1dU>&rdDLCk!i+UfP+^wuz&>orPD~riy zM|wL%Q|m)=0~scsBt}hyiVx5*4J8@C(O1$64>^B^n)xCjd2uVEqd>oP@ic!cmv1X) z{<+Yb!rW)B9z9LmYXYQ1k+gDLF&x9XXVmPjF7p#|;p&;naE~vV>BpaJez){AvkbGG zsau+bBfNM=O+C3;dM9m3O9;3`zGM@2k52?P@{sfk-BEv50Bc4D1Wht^$$UF z-j&F3fyd+7M_LlBk{#a%_49qGGdi5)l7|;%d!BJjtW8#<-~!Tt)PDBar>>G%Ss5E! zPU^G)+5A?yGO=KX?6sGa2E4;841$P({j>HB0i0ZhBH)!+o5F}87m2a~ml%!_=jHAc zt!w|QZN`9_@gcqW`}ZS?vbWyoNw0fR;0(Id*0Rt9qzl1GNsA7BT5ea`!3ZrNU%|_z zqd6M|T4W$}9Il{k@U%-5k5Y(t%g}a0ImW7Xk4=-s2d}`%&nA?+-u1noOe-ac)#Ngs zR*2=^ZhVM3tV*K^e>(&n|2!4T`iJB8NS6NaMaVN-%zmWGCC4r_Qz|T(ccH;-;jw)v zW$pX!-jbEa2JNCkXd#y#`Cox}YldP)-XkChNBLM1`%>8zL(quECVE@Bx0O}3dL z2#eIv`k!g$Or%!HpJce`1NyS`?IH>8z5WMwWF?Wx21~G-&K_{V=i`BK33vbYS}L(h z-l<$1UmiqEu&}~dM|^#~OXjJ)D&MrCey#qt59iWSi1$LS%Cgpd66bHG8BG+Pscsiy z2Rof}5AhFtIOq}XC+JzFxi7%n88b1M6P8dLA2rbm%h+hvXtMG`c01ReW^Yu43)8pN z3)APwUFjb!Y(H3eRMb+KC2b1fZV`5HIiyJ$av5oTG?~yROR*~(;5J{EZ85&wJL{7U z@$44%Ky8E|5cGKL;Qh4Z4Y~R#HaWj^CxvwZ4lj&I`*5R@Kc{a_V>=uoQ)lbjF}&Wg zQ())RwjjJ82LwHJs0(2QE6S-(cG4w1?X<(($tbN!mH^V51bSc07_)k-q3@N3+4%7zVwFhTpw&o0YfB>{0C^1C1|KQA9=jeJ#! zPQ~mK0axXyojCIM@KBBF4~y8EqC>j%_mt=zRIZ^($8UhkYMvP;h8pfugZO+ zT<5qAQDWco7;^2GM=#-{D<{J)BtfdJUPf5ZAaMiLxeiq3U4|ITOrvZCP*&>?f=*a- zuz7{h&4ptX3zC9+%^AlM>u8(Ctp~#BOFiR;f!$~0tL5-}jn3vDp}|S-vI(04g##?n z59vu?UrF^aFHl50D)AE4KN8j~8~YN)E&J>```&e%K-iJvm}-;GQ5S9PqX=GZh-Z&5SnuC7xbu?YN`KK|9Y=?2-nX)S3W#aEKq<_<< z-Mjz!r!aQdAB6$X7}%dNE&N4AwSOoE^t+osCwIPdNB#NFpSb_$3r~y=9)Cb&Xv5d< z>cA~LD&zK->Xq3b_Q9B6(`qQd8w%B^)MCS(;W5*deD_W`B@EjDKuTfdrdKYEZ_C5H ze9hX0yuzwjomw8|(7@Z)YM)$a-m+LfBXs9S?+&r2Z^_TDe98fiViC8Lm?uK8PfCqu zRZ8XYwn_m|Gv)RsIK!c${h1U zArI62h5?_yqB{#3`i|Fvd<+vELE|6k_Q_1?dZ^pXGa%~xm~n_nC0;08dzc6V-` zuXf)1+Bh-!?>E54HFcmr07y=g4tg&oJ;eWpxO6t~Nm$M%&doJC@MgR2TWxRAI>!h@ay~-w2Vwl@i*N`{%3PoaM(WoJ5ir2 zS8^4dyjr)R*w36LB@Ai}A1GFWNyU{X1li)_2<0B zEH5s;0Ek$e?wXKHQIAwz*9CsB>oh{dUXg4fDHX5w!)(nxA`p(iPL2gGAD+u83LSyt zxid(pT3Ms4p+bAp^L>^_%xR>Vwo~AD^|1t%=28Uxt(0Va?7pg{^#1JMgr&_J*jF&! z&7Jh-VW}Yf&qQJ!b|GU0Eb+NY!R_x_Zm7e$BB&26^*JduuXJ=Kr>cCqh%B3^QKl~t zRXZOZt}O)8HdeBd8u=F@7QdmdUMDCETz*)oZHI`lwOb|m?xmZd7Be&k#^qR%lQjSl z&Fp-Wi5y%`yTOsjg6i$;%nz_a*4S8)0D8ywXOd~!&6NR**XN74<#U9&cPV)9qR%Ai zgnsg&8Pp{nrq2(5JcKp^h%MqBMfB#Zis|YB4rHZ-6$Q8)2QRLh6_+kTgG+y^ONZa{ zTFRp{8y}G7GuS>gqwqvJ8##H|6w@ycbx$S41ZRz&I@hH>95$F>fR#HWCr8USIL|K( zN+Jqr0e}-HdTFE#zCwJA{8W3@yDzEs9-GDUl=?x(K8`crt_>#JYRMxVzP2H$i35Cv z_h_oKHP6Q9-eA=-b6j&1eOQ*F_@n7|b@WOG)|Y*JJIe_}x2*M-jvx0_GNhwwm4WXv zVR3&MW08e9n4UsSZc6|FrKv05L+YTlhb+i*(e?xz;Ss*3fp7Dk4@o+PDzU%<*sm=TSA~qFQ}-f zMyn*RxJTQAx&RK_37*3<4Cc?>2)ZT7nT&L{D;&e$r+KR_>Q8Y(C0gc5soi2a9%k)z z_&6U?s{u(MAH^;u$p!Wo=5)XU_PDW_0+ zbrovFm9VFRl6zU=oEEYTnSvIdGF=831Wtb`Ib((e$$1JEdTUfHtaKR$XHBf(AA2Oq z)U?Z?@}@UU<2$)=&Pz1;2mppws7ee%Ix1iXI_h&c6g=h5>kHRCmoN5S8zqDY zpL9`xsiObV#+#?am^Y${{zRYptI0D=Y-1U4N-P*9ft75bAnF{3)MqvD9m5lF%ycll zzzs-t)>>yVyYfV=z9Ib3U9HXy0v*`;emnZLZop~AvN)r%E=f*F9*|M>>iqRu%{2+q z6D7mP^M~URQ*P6vK2C)8Y6zleo&Rxqake(JhxW%u5 zlBthEbpOW~>MLQtkpC0FRzJVrssT#9TWSq;S>7Z+GgP|Qq-x% zLwSDNg$i;4 zeayOd$btw9yS&T2pec_(_X|l;zEbTI7MmQC6Vf%|G>FABn(JV01RVRl~3gl=Y<5qpUr*BCu~PF3RiwL zm^Wr(IaIF-r&)g*d#3d&p0duateaPP`PLns!qX+tgH$%Ej8$>VOLe2LJ@Y$zlc!Zb zPTx9tSkee;SIjhJ3U@L7AShGz>vtd>Ag$EhCedHnWGApy3~qnh$lcHy?9Er^b{*Hr zG9KN}M4q?h76?5Js7j;T7jcQVE#7y`3HVLI{&+6qcgW2R)(VBi+{7^V1RA;PArd)N zm%9{idvBj*6$An$=vgW}QBf!$aH2TXKCQt)`vRK!rPCJSOz{Rw?GmGq->=XYVmoTH z^)~0{?2NB81pHis>lU=9q!*?q3qSXF^X~Mm9(T5L?j)z>mo0GE*J+PAoFnc)EDqHz zrbOE-r9{t)EZ{~Bw&c8`M;}@uonfCctm>33!Rj(6K=0xg5~~Ev)l~zkmpMgX30>+~ zqa6{^lI7fHb@fuKEpPBp-QM1*XNiy5&O|J9p5E5*tPM-A6jo^M2YTfdmLGsNkjb*0 z&k)SIdkF+rn`K0UZ4ahUKWeG$HPgMUNJ3s=`_6x?uuuG_x1***FFW9uBV?;5wDlpL zL6z}9ix8LXo)L_u!h%}l6ccL>JGj>ki@AbC1B}ic!_+6t6;hN7i&(g!=KK?L`~N;& zY@*V!Dyh-gys~VqmdS0X)K{DVcKMi<4mVWxGMG+7q(h2WJbY61EQp0{$xZZ__v>^( zRJgcI=C4n*C)L;y9`s^IMepU)xQ0cpFZ1w6Q6`$HG}}0P^iid(2?p0bQEOm_X%2Gb z!8U7#&H+1^txHdX+tiEgqIV(1wo#?K({>Inn0VTdG^LM=qn}wvG?!j@Z+P70Mg(tt zOwumrX8D2Bt}w(>|AlZP1UBW6biNj$n){AtS23hpt%i`4ih#&LO@OMy8FE!3hoWhS zBwzJ+b_>eD>iqp>)_J%-Fa6#Mre4I_~0OTIW>oqv-+Pj${nnb?G?+N7Hkmvk|wRz#5_@&`v9ZF9xF?}|a|`qf)E+>R?o zWr~ZHe9Lk48wz_FtDlswziS@iZDjnTe!m4H(>{I6XOkF zVCm!mII6Mv9grTLasQQ3HGI!CAvE7IFK%f_4;(hAWL|Z^VF^fT)V+&px zo5$xnB7N0$8pdb)?mE`fGd_i?O4=+vHqZsfl2EHexC2;2(CuBJim_aU|K`m8*l>%H z0c%gUVVHK@?5qw!r&}nlR*R~6r{HXrB1ztI(r+wTikJlhsVEVvSTqLMgD}S;P5d%tX5Hn} zbNZ&|`RZrE2Gkr6*j>5F&fwVGY}sPqU=%KP3B}{bufn<(vU%KF?@>H8jQZz4F>+V0 zq*b-r#;lthswD@O0=sglv9;fI?16xNdTu)p4p|It(jZF7diR9(w);M_xF>Ivj0|H=u^UV;0pAijT!toK(S^@55{8=CkLpQdU^P zZcO5kaDs&adg>HCWd%GfAi}H6YH7Lg)WcLqSToDMXj=%XJ+wuB-~d3ewQ85oh|~yh zefdZL=7y2bty}ctS2%w@*KiPgFP|+U>t62))u_^XS#@?uh&n6vo?+zH5@|C-zVYOM zP~O8@w(R>G>lfI*0|L7~UOOxDB~y8a8N((QuvOEyq>={1R zRLP^dOYCdmD)ONl{vpQLt9Q)AbS2~^I@101mE*EDWV=SrUjM=*K#!#pVi5(+)=TXd zs@t@#)b6el@Gtk>|Du(y-eYgQTPdKh;;D<|5m274QFpv2}XQAdA* zYQI~WVw$fWV_~_}FqGfaM1frMZHL>Xb5q#%_gOboO&$FZJuGdVhz2LR7YuH*YdG>4 z{;lmb8<)Qz%+%AxU`|A5FEsVd3q6)^)>q7Aaci;3we`qlJ5#Xf(IBH@V#PY;#2pLj zFqFB0T@a-^QU{FwN-mzoJ})A)_}J|0#9&vfYg}Y8W5OKtNvHC~@(x0Xk1Zu-p?d&5DKB|C;CM1kq&^^<4f-kBPWxd0Ua$vunr~Q-~ z8kN#TKdErKsyQQyMBSED)mmQEn(MSy_Z}l8V_cZMyRvYbATBX-f@{$_H&2G77wz+s~AVd)D_0Ow=~o{ZqZK$uBd6Y}PS zS{7CaZzu_v-6-q<0(~yYCI9Vr4e2uQ90G@UY&9>9WRIZ`Dm&C30Oy>ut8o5tMu9%o zc^Iz)_Ws0FAA}g8kMbzXncY9nWfJM6nBAa9-I~cmQK;RHYpvkFt7{3(&H2l(`vl_T+?0x?f1#8SZE@i3Nto=1?>ZFcb z1Hv{jzl?dERxKg0?-i0!-lN4OYN2qN38$jD`8#93+q}-=ZBmA!3OTCUk~}eWTl-`m zo@;;q84AA05yf(YySv2dY1XOiJ+Uz^sN|agc<-=Rdy3~_qh93S%$+sDT zGvd2UO_Pw498E9ONJ|n_IEI=C*OW@R*SimBUS1+d-kI*AiHY4FowsY%}!kHnSh zvNw82Y-h2WV%sS>iFzZ*G13NQI*3 zHy@-X=Yxw!jko232LX_!X9tu2D@!Mf#B{t~vpRJ>)r??x&eFN<+)2=)lEfy~CdP!( z2x^O8L-o{u=#?nHe}W``vi^=)KE(Jg$DvbNTjo2p=VDCl!SqrdTw~n>1kNonPyJ8QuOXo1HO$BG>-;u^4pm^9;#J&hC@)zLu{j;e~%L zMzX%fkS!u<2oC0%k1{qK)NER106eFxKe`VK0rVNgxe!n>?hCrbW3DQ$GPeK)7s&G} z+{$V%zc2&^+tfPIM;~~2V&`Fk(g;TWiZMOTF92C6_KOnh<8s1~haULTmUANS{^(id!0Xh<83nu=O)>9_QS2*dyL19UO~sQha0&5tAV(NSXx>far?Yi zHWxJjqHYW5BL~pPgMc9V(%>8bTSKRY7M8S0lq#0yR@dWPNF~L0+5W!u&04>FG;hGd z7~8k<#Da!9f3$&nbjyhnsE6fSxK{0lQPjLCR&o}i{tPC{OIOVVh*vF(a{5qd{^z@) z&1vlBo@wpvAEqd1`Z?O>$s+eZ)(>hTB)PW>19`afFT$B8)pFEJG~t=QAC>o%D_ zYm_5MU}Ly=`}5!{gaF`{o5Rj{0Mp{Y{j8zCzvua45J$(2*(wwk!tL*{Lg~E*c=19x z@&CJ)-Xwk}kH6O?0)N^4J(*oy4|e;%k5e)5yDo!%eN#(>glgPe0j>9#JDCw4D3rnW z)*!*<3oon{y8J^~{fJh+(?N@cjQJl5a~C?g?t3`k!8MeD$o8dl0%P0F%}d-@WN$Va z1C8(;R|VoR?0Fu4-wP)6q}K#|fU$wx`uZT*fYnj*1&aR7Wj(?9Y4Ar9xdvFQj(&X@4ls@IMvkaL714AS7pJ$M*XB>e`-o1@q-TOiDoD0GnKXnOD z;Vu;TpW2ozSMH8)x(9N%=sk={>=gICr2dab`&c(_!Pwp%E7#W76pL)J z5>5YkYQX&n6%RZj)%m|bC?3}k^>KC zp!Bgn$)Du4-|yFFcUJ21Zl+)WHJC;Zw5o(WD^wlodaY{O*;F2|;!`m8_D^}{k^g>i z1$4J((eA>^4$L0>4d-ohKi|KK5n!1eB+~hFMMeIE-ejIG_#|>U`|9)`P}juA_?Stac*fPu{!7Tro#Wy`vIG7N?1kLHy`B>rUbd{qVI9q|26re zy{BlDr{3Lalz8x9Tbb|O?1H?$yH)S8Z>N5iJ{LF1R-$wYXG`}l+7m%-T~T}tpzZ|* zd4Idw>}#|qH_)I7Rj5p&`-Y*FLo)Vg~^h$xX41P*|L8m}*GhYSR^*juf@@!{cRQniCWgm2p*3tYu(WE)6qfHh! zIBW6#$b{uK^eqV7tPVc0A(x<#Eu`juFb6@A`?@QZ8q?B{2`;+?nW{Us20+W9&`ZPX{K-CZs z`*!Dj%f*?tA8>8MFGxp{mOIR{G4NyT0rq9rSYR9t7FyyzOmyvce z*2aXRt1HQ%O*9oVpjJx&1~qsbF@7!J>IK-P>Sax0Ne8+&^rC5~P~YHWg;63&ie=%k zOGsAfC)_9)9sFh=11@=PpOBQ891vYdVynD%gnPO>0n1aOPR47F-9IwqZmX|gLYAHo zv&p(gQ)D@#hudkAwnOPqgqe$2E9PR>uGUqh&RtOmahBEt53S0g!;Y?+#=N@zWVI6N zGV46S*|9JxL+5{oBwi=71{1J%l8p^{AKhj`JI>lUR z?Gd{;r@l9lIN~dN5%EG?oSCV%S_~d@bAnj$9R7QPqF6PXX%T*Q(|e@jM1Fr(mX5)G zl!>*Osa&v1?T1d;lz`pf1XF03v{qw@c!%SZvez1WPO`&NweHe&XfPo4jHCpJ)+&*d zp#U&?_;0+n}aHV{>c5MJg`(JYxr!LW#f8gm=qN>;sYdB}6o5~@Ku zG~|C)&~~j5k@=R5c?{QgoZT@zJ{e{S=a5r)dta<5&4vABQ~W z>7H2%-ZHTs(u?u9j8@kmw_(EQ+PQg^_}(w=LG&b1-uWb?H6)ue@B--M*v1Lp7S0H8&< zy-|u-H+-`6PH7pNTh;~uRF?1XnPAd_G)zsAV&Oz8Ft%XHsG^B&?xBY7eC6i0n(vw< z%yJ+yYuDkrFi^?I1Tja`NU0*}gwQ35b)a~q&#VOO_K!)8C zwAn?D{cwhw(chP1EZ@%7>_tJ7Y)P&vj^*^cS@X=Q{p7vwv*yC?C!L`n`E{9Btb0`U zao9bEn6I_3`pZkFwB#w>>jwd8Iq7(Qo-@iPJYgH zt-H+Ngbj*dV3-7uWc#F3J}jj5;WP4{b9s*&f#~SI*{9e+V6Y{JUiN-t61x%5*L732 zyT=DYh)I%(kN+5_!5`5>b#T!SUALPzwjKP6vwx#XA71XITy?y)y4Eik0C36^Ev9)& zjy2;;C~v)hhKZFh74vFTeU7-Fb3R>Y)~>VUa&C$~5_*^nYIm>1Y_1BRQak{je1?E7 zfZP`f-dNGd?p*O&gF{cLndnM~3d`%ivwk?Aq9jP%Z}*M{Ry7Ex8Zmg|m==6|6~@?r z+5s?S9;KZB6oEK&{V&&p;0hGWH$(`x$B2uIrjeUlx^Yo9{dbp)ik z8%@Xd?)mMA0g7Ay%^)(Crw~a=)3|E&NdPmA`nf^CmMq{$!k<#ar4fO$Y0$j!k_u=3 zrJ05(>{V7%e+jE}a3#*se-%O5qAH~{tJDGVy?QQSJFZyqY!&C6z`!N9ZEw=4QbW#X zeraqa5zV58s+#!hjqb&U>c~^?cc{NIw=7g2c$m~hfU5%1_vrq|3r4Pz$)Z`eKQ4V< z;!-q(4vlsvVYxVsP7{?C^|*3PUCZi&O-%q6+u(< zx%Kp&zgsrkFIAI>GC=&s&+Jgqip$KM#(HeY0r4I}8eN_E@Rn8FpP&R!UNrdg5;Ms(x>MWJc6@7@h3w~~N)e<$C8JyEs77Pz8immIq_z4o^fOi=?ke~R2c z&aC$!?gPz6N!m_D12g)9V)~`hm2KskNgMCInp!TQGGDC<$+lSZx4CMwL>!u*icA5S z)m+U)Xv@kjq4~6QFjJ3t6q%XV$377c+oZDM_fi&MJ2EnvNjWN7 z6$#a1V-S5xn{9}$Z@1?R%}SC?M12LJ*CTC}8ZZONAc=cbN;|HIWD@jG15$wi0BpwP z+{Eq&V15xx;5oy1&(`i^S`aeSL_TEkN1dd1gCu{P@{sx!F>M zTcE06!g+ZDXdPk!`p;)XJ9;68shGvi00~~88hhFH&v8sB-@tspMI>hH z>X^x(OxN>_0exj-KIj!189&&=tm}8Wf3N^|BEed@386F?Is<-+2e)2hnSJBH16_+6 zP2adx5*B~pTr49!%`<%0TFg*-to1P!<)qg%FRo0vN)ngM*3+s5k716i2R$~@R8chg z;QqHk+n0xWy#V%&vB~DlpxwMg*Z+coPvITx?9xKs)#tXB6=td|WpJkIc*afJC`3IO z3J^_m+vhk*XF|^1(bM?MaO|e@&w~e3W=-YJ$N;BPZ9aOH@^;q@9c!2>X6b{c8WRxl zr_q{(stxR;O&2njW{Of*9ymB(S=mje?3W#Q#H`E(`@lM&$w-oQ2$G7wy?1a~a3Phk*5Xah` z)6EZAlj)?LueR@@5sN#S7hDgECt9>u6OF=x(`S|^&s$7Q>X^h&pdQd;1zY!I-o3l6 z__uIhDIurQ68ejUb{l%%TJX40#Kzr?FE75wC)}X5NFu~>X$d<-F!4?sRKHAww~~^*&9OwjB+~(>!^;v;bRRH`?Glxa*!jTivm@8pMae9+wzifjRaRX$y&qZ)4SLkt9b*38 zr`8Yy#2pa7P5fk&d$Um~eZv=UO=;Jd7oR`4+BTGB8Gzh5_^IT`5;m+QZB!hyq)&DG zAJ>>P&@d+J)N5SMU{4RBSnVn`Mn9GTgM0?nY}Y##M+-n=PHJ=aZ5^yrGDvNc*$vv? z0oJWTRjU{NS8sX{;~KDW`R}HD2D=2F)n)8Ag5eG*=jk_ZGm%?4s~7WPl-ya#z;b#~ ze^cpj-kH!r{CXe;46EWH2esmqoxrOQHDmv(kdWp$543IL5>V6J*vSNW{5tcbPx7rr z^pDQWjb0H+f2LW9w4Z&@xt*$O9EIg&MtYyh;wa90h=HitVbHy(S?05E5k;^Zm8Y>= zyN;}Y5^)RV`p5$rU_6J=g1g89?VYUSktn-bbDxYgu9#hu->6)M+c;VLseOZT*z7Z- zqviLY#e|M3g5FI>w;HW4|6w6B`M|_Xu0YZ8m2kpnSEj?Qix=IUB!lP)(1JtvfVK}; zU;@Ut*+&)4`?Im<8KDr5YWhFbc4Fv0sQbrxU;)SFV~#)R6QBho{@yzJIy7S-*t6&1 z^P2g4MnJ=B%C6p8W0eS!pKN@52~#qOyBxl8bq^^D+rKedlPfs+I96SJGaBvItFBaH z?L4k@G%@><88VZ&=@MsK?vQY;VkUF9lwpdxR-11a3nVzk*Bszu7MayP6Fx_|!Mh&C<;Z;HoZl7~8f3s-PsTWA2KEKEL+FRewmoNr z8?~U^PggCLioUkJL#mtABwx1AQDqC(jx*}5){C2duMpHhdb^jkt%fQxz5WEzTw z7k(@+xm7714jncr$G?1Wzt*@cAQgiOi;?O>N6l7l@@YwB)CHCs6sDqJMcti- ztJ~|tp=AvlN%2!Q*{u6{hx5!lJCE#awiHPdeG>BT0qYE4xV@)J{%t+P&R$t6@% ztVEhTQ{xKn9t7N;zreI$N6hqiM9Q%N-eqp0sF}U{%1=nHjrW?d=3dxAxP_}eE&D?~ zB`s9T8^jRHg^WC&|rr*EeTk+A@?Q|r)- ziLiD@xOM19qc~GsRfT_lpcR#7vah#?(F^73R6Rn!xdDq-?o&A{uY*Vw%Unshd30ss z#QMXO1dEwLqlAzFPW%mEHj)4{P>&~33j5&5Q2$|x-bIo@nu!&^=e}AW%L+CwAGcuP zR(>CT`wH#e0~IaJQ3H5LFN)ys%)`u*kra>Tf_OND%}%NBA+w9~+knHk{DydWXIush zPnVkZsGIo9hf@Q6$h9}}nDkxdM(&|w1#}+E>!3ACqDRn<3zRDil^5*m^U^>{HviC; zcot?f;g!x?Dm_FQv1yrmiK9f(B&mi*cA#})haG^1T%cUvd{$s!<&>g(`f0iWaCC|d zZ6oTjwii~o9E7~Sltsv{)HkXa9IhP2q6SO-EE82o7`$*_Rp7m*(^ri$n3TwJIUWrs zgu)j!lL``&zPl4O=w$XHdL&Y`L$isYS7WOR-K#?=MwtPEqV{~1Z0$8-WN>Iq;%W9P zC17+)rp|BA-QPx)cIWdwl#}s=zUFVVA9?s##O zo&E7P3!k5)e+pNhmie4j8kc{n1!D7Q@?a)f)rag99FiEVYy6}u@L2F2!qE@~11+C^ zIR!iSo{vB(JgmhIj0jD`ppXsrVZ=k+vHHVxd=wQX~|SO{ejvO5_)zmmm5f}q{4I~8~eiVs=$G1rc70W=9wz@J7+?6 zWv;cE0RLW6hCk3)ujyZ&)@-x#XOl-|OP~FeI07<-LF~~?mQY#hRf$?fhS8Yh z*@pQ!U9G~0uM%M&8Mt+89bIaTu&44ZFm3=fC&uM=r(j?z*UQt8>tMB}WwO^#;@VAxJaANhs;$kQ z4x^6nX~1~%2MdQ<1>H}#fNl*|(A7|#eB2MNuWvA;%;v57d3KgC>cBpK5%4e$Ln;C5 zd>*vm4T+tl`p^{nIK!S3N+zyO)~DM-$;O-+-|&og{?-}xw4g?DKm(QDT21=MnN=6! zb&onr2MlNYgmV-#%2i`%QX0#p>Mm?GU+zzJcTBdo_xAc-rxj;H=y8Bg#)VLMM<@ znEil-yANiihq(H7I*)M9F8p{&UlM$R1_~4}*t1rkw8tUNorNWG$#&N6SA!9cdCctR zf*GHvd~l7=&1)+r{N5w&`>h{~jJ!_-k<$WQunRWl6vE!l5Yi=^t&pIuylVYCB0jq! z?{#SDv?JmP9ee-1kk?` zb=!eeO^eD!`&WS*3d!v4o*|h9R)KdqRf&&oIK|PB0>XhWrMV^d0qTs%D>5{V-7`#w z5$jv<>*ocPi#_^$u)d*wzE2nq+a8zxB1bNkyW!nu0EamF^vXZ)B%X316WMRT-%EuI z_&u3tFFFwbWy6cnw~8Y%R=;zO(@TqIV8z0Q1rolGxFgzTT+u#UVGA3U6j5Nc4KNfm zr0ydi9m!B!TUVF`Njgvlv2Z)xaE)Szy2_`%3)K`tn#LIsP2$Z9_>Ft>Zc>wEWal6hdx_tL@8-8m`U z^+fn>ZHF6ZcxA%-nhNFKv%&yY57DBS%0ve%K(ZMQBhu6UO^g26;Mwc*Fo|$u64G)F zljIWslTwRnN2ltRai6Skdd%&qGY1@YlSg0oWAmNuNr*$T>^;;Q%lO)G%_L1Ga+3EV z9R>U{8CZFem=ZdkNl#sjpsWI*ocYRaLL@Aok4)y=v-oYAp9*>vM=FgZ2D zbyNP8kVtb-F(||0glyzJHNl*A<8TbDGx=uNoQu!WnfJhs0@+46mjO+!;n>Hj`y}>c z{*`O>UR2-i;4$reW@Sa5YGFsYip37o*L@32Fbh#l98ANGcI{d|n^d1ULbm#i_E9mZ z6YM>=6h{$H1yxhb3&P`){9kbUJScHwasFcTriPY|bXsU1FN=6)*$ZLY)bDs1%?r8Q zsz3q8+jxUZizpeLM$W^fSx8O+OD>F52~VPfQAcd^rGY2Ju$6=)G=p-1m1FiktQ!w8 za)YPoGF-oCEgRB~CD*1>(qoFLT%gIpTo?oG0RB2TS{|BCBX)bz23zYc8g$QJCIfelS|AtERs`h0n@{vb4IfPi&z zMX*O)yko*lyfZ{?pz`*L-ZO8TxjCYysZp@t4>r?4I{(nE+|I<|r)&{jmh4xhRC)`} zt}iA8K>RN8n0>$!c*>T}yc}@M;Z_RMJuh@G@urq3~+6~n1G zc7^(O@6>nUw-G9iRCa0!rI;pID{UTAk(^*bkl>LesI*j|UM{4g-Ch^=`SPQxw)a5F zVvF)}-bfZ<29;>^05*l$eC3l@kKiP{@#C!is=ZD#b@L6jm9F_>ePZaPlH`RKfZ(h{ zV(a$VW9d7ESJxXlxM_nW`e49K!G8R_Q?~+6Qjt?=Uy5KSD4!XHYkM>v&K^lXDYN z!e2<0yH-{@-@elpF7^xBNj?Ak+U58OU)9L@htATek$M;;H1ft(4kagRg8_3`S+9LP zgH*mH*;_7!?!-Oz%@H3RGJOPKm-i{fOP}eM`mLgN5PPIgnYrjA9V4InyPr}(kcV=W zzu*#|JT9pIP#b#;SC3>1e~YMu=xP3Zo7XpP=jg)NVd#P)EaJOFE;VQy^4YYk(BXwz zur13Ni*62MNi^q^rjd4>StvlLYdqE#RcIs$N@5+_e81}ai2IHjVRfEmWzKprT&nTy zB=42j5S(+bOPP83v_IG$RJ9z_FS_>7V`&>;ZvZ{<(@^3VTh)jS%BKg4})N#tpPRkY^26JlmxNgnYrX=%r!8m3UOY`os=WdZ8M zhVg!fa$#&eMINt9QDox+#ot-zgZhp|l@R_1TRK&#YyR|Iq6;9Kp3`95uVxg(S8HuU z)JZL+k%(b?7n5oY$TqFrQmPd>mwGsn`8k*dvBW932T_-+n@b7?nj0 zNSeSxGvn!(H${{CFBzPTa)l51WQT+=Ot+rbI7Y;QqLn{w%{V**;WSK4nQfDPPIYWI ze&HWbM3w8ORhY~@71^x#WdNA=Rx-W9#&=#&!w5?efEydpA%9ZzGP?E4mL(`;a)~3g z+Qj@l=cTQzEtq3cGA8+r%(Ju)Rdj{A14RdR${GST^k6`%%)SCdVeMi+{HDXs`O8;> zCl>x^8_q)>OY!K!JU^wbo)H4p`22PG#K#S4(Q)5A7T)I-XGdZHn3IH^g{iazLlY;{EdaXIWWJJtLvpz%vQWgqOs+JZzmW4^Bt zHHoy3P>rnfGVs$sbyRv@*5uZF83@elJRsIzGop6yUFY@EWko0H%w@6+ytl~6t1HX- zNsFs`Po1tVD;#U7%Evi^GNko#i`Bm4!KrqN9*lgJe0nYoPvF<3;V0Sg{%>`K#P+`4 zrmr;57NQ(D^!JZHO2iQc@GtY?Ybp}3EYi>qm%4z0$nNvk!a$?(G{3_YuinPNU@n89 zGajuf@O2dz^pE0?z!G9)=H$2jh*Ca}i3z7j?7hx$z6Yjyqp?P9(yx^pQUcmbEN!*z zPi)nwoD>l3AS<7I90NQJmYPr8-+6Y`X6uSnYIOa1pEsk4NvsB3A4=TUEV)v*eEGp? z3YnXUonq&aWxvg3_u&Mgw~@}3D`2^{T$)(pc=@A=fG0z=eWf!FMmxnO;N+flk!bQi z#y-YzVSN;rHNW%UqCr+?-ERR!GR9pZT_&u~<0_V=pDY@pjZ(M{E`90TngGbE<5!(? zyudT{$8)~Ql|G&EY2xw;vQ_%=YNZ2*dM|)o#0)#xFJAoF= zk8mN<+~wX7WcY~v&tbLKh>5^vi$Pw9)s^{7!ij(JX0P&B{3eMP3Kdq4oYkl!?4}Ck z;ErC#7#cORG*#5+tkb4?DM<=C*&LCqqSgo?nmLg_5yGPz@mqej*NwIF|2jMKXei(R z|Gy(qwl;eR*@+O!Rz{Rvl6{RdvTs8MshCodJ$oXu@5@+5*|O6}mS#*7gOFi_!QgvM z-tYJK_xpZ7fBeqxKF2xEF$XjEeP8!=y{^ae@q#f!@dvZfyXvY^r)Z&uyT?YFdKL!Di)ZOSpLU&fPzxFqvz^NtnhHQRwm&_w-YcmG+2Fd?`$MGMz0}>g{jrhS zK&ggZ&rNKLVANd}O2`Qr{7D(ecq|mbogr5+XrN=jV@W{8D^!-nMtyImBrH)>({ff2a2? zv*5z#GWD8wBN(JkUwyXeKaJ?92z!eAPIJfVgu6 zZ$P*K%=iRnzl2&bZe|=)YK&#CAg_VO2+2dXvbO4eQ~og5_o?M{yFVk=eLuB%@T-D5Mul3oRGJY3}z(Ii24Dk63P3 z{&h)e9tsa~Bp(UsYK`RYJwv*hrh1kOrG_90V-c%|7~8{W{Z4H&6XY)sMXl_{sB=;& zx%@*6?Z8Q<#5wxiAt6F2@%dbh;TgQ&dMAkfuF1dN`b#M)Vg`y*?f=BO7@;PV-eZ0} z^+LTPxn*mpi(^oye6s6u9N4c-=^HDvU0|QF-I_l#fgYd5ki{!xOPt9csA*h5jl2o@ zX3ec#2QeFUY(o6Apu@si_zt3!o)L_N1AfXG_jJmTi_D zJPsux@H}l~CdZ5qm?vTFD+!K|z$XjJndHH<{t3WqNoK2{MRcYn>rgjLalj#`KE5Sz zB)(vaB+IXn*pn4EFvGZYR$A4MhxA}An};9Lp-*?Ay#F_=b^2=-Cj*8iqu03`YyCO; z0&OcV_#3}*Y*Ax5)Iwq4AH&xYvus}fMm)%c)Ayb_rdZf7v~e2zBp=Wq)bO*zY`YLR z8Nwl{c;fL{`f=VoHvbUAC=Z5gW=F+I`8{wY&AtK*UYjx`uLtPa7^dZ)_|W`06M9ic zr3RU_w;6Q+4IQJ?8mH1rq$xlmlHT%F~&UVuw~R*|VyX&<^8 zxqPT~1e2a#vl8*St%5pERJ#U6l6KYn!fx4hB;;=o%yFd&^cd|Jq^-}2{^a|e!XL$& z`N)I;*H)>*fQ`rtH-5Tfd}O(0i++oIgIda-zNG&ch2`)^fAJ`uspim6fQXLXeZSjY zh=X@$T6FOF{8+xdRaF3oOt-(ZJWsDo79E z;IDVocu~me5VDe9wQRM3^DY5hb)FgNLmCTr_|Sw%ur>&dqTA}>k5a6O z?W(^|j@vUzTZ>dFOo!C(@Z$uI)Y6Ri#>&=sB9^$DG;+TYeWb9 zj)M2#s2W~~b?%Kd*-F9}<2s_8DoPPK(k35F7PR;psz}i!4Y$oL6K0FAWO@DkWM|v9 z?(6IDa>!IqhGk;h3>7`&76q)Ab4pc^HC4>3yIrD8=r(f4$EKyQusR#=Y#2=!>quhc zUBFEEc6SKK<&@2dd(+--fV;njlvrYCJLxcSU16tA!#VN<|Bl@{%pzI`Y`t2q#&==S z9YIj&k$wY|0(1MZYzRPsj|bl5d*$!dicE(KXzp)hFy+de!%lh~k791C_~`I`Gg&l{ zsKyEQ{Jz3G7le1p`F!$Wl3OqXiXc!)}a7K&7w(DupBs&=M6osEFuL6&!LZ& z5dXDP6|o$kfjrcAI_S(EfONzW+F_9ia73tYSXMq*)1PYlJtRQGEz{(stY@8 zjV^#$e;^-ACr|D^PdqwIQ#+>skkbDLe3Xii{?D%mxsm@Tq52ODO66Bk_s-4;L(k4| zm3kjQ(vAgZf1$9!UoGBrBirT_z`opMEx;Hj_Xdrc{s4XeHT@f>Ht{=ysSlB|p}A4K zp}-df{F>T~mDJaUs~q?-z;r-~stzHSw|joZfRnMSb-){+ks`8uC59s!Ir7YQjE@$G z&%kvb01&L^V~^{Aq$x`&ZzdW&B@AZ}s%H6${T2KMzZpa2Ua3pIgES^t2IEhpxb>8^ z(`Y_UXJ<{P30Xd{Jj4;9^Cg32f@W^mwz0?t@*^X2SX%f!s#roJo1A+0eX&G}kO*rM z*e()2wOEvw*D(J1+hsEPc-3^H2A(=xZtDEItl!%KXLG!GzTZN;X{fFCA;TCV)2!`7 z)&Zj)J_AD5-K`0ZXsL zxjtljUQ3>w{?zwrC`*Excao@slBhLmQ1UYaW`NVFDs^3!ajEJiG`lxO_Ewt|+PKZ~ zywqIY0)n*%=)acY1McEj1DwL3n8_Lu$0PVr@^!aUt7Xe(=@*LLv zs1{%eRksW?)b!OUk9y?%{NMR2Gs?Y4nA04o*{75(pM<@lqOhVv8vK?rpntb*Sui}e zWNNbL*lp(!(*l*Res@BftbZ;$;v;JCCezU9fSuU#ok6X6psdBE{LcV^()#kQR$$N`I%kvaOojv@izQd#oReid*qdKLqi6<;> zN{ydxY-03h;@uR|_mFzaFdbLKi$ZC?)-mEev(0O6KiOT>-&uk1jh5ZoNCBqSJ2c@Q zPJs6CDg>?m(i0Z&Q=W8^pGf4e4(O{WI=Km21?c$hF{`(zzCg*4a=6s~0Nn?7S!Kv3 z{!vZTqa)bk>OAOs0vpomjM-`5np`Hk-H>GRDyh`GKX5IpOT|+=Q=i+eu(!?(Sa*;$ z#fsb}rc$+T6D+2EzDvVE=+QGkT5Xk1y0*yuu15J=;@c103MJ_HlT^T1=)Uq7loq#j zLh#f0(bj7vS2m-oY^Ocl7JYs6OHBJL1KdMImzyaKpSWGSgBqe3=j9WNt4eQ`>fSg+ z;k}U8A@0KRMQQ)9EsM`KrY0f@I=6aX=MW}SCF7#2oRprtlroH1B*tc{jlLVgREF8T z#;-{QdS(6Y@cYOLr3JV4f6l!nySv39l8LWOXPL&LP^yq${2)hq+2hr7EG(d!`I=V@ z{gA>$%PR8@U$y|6cYs$8xT%_#fxRF)_Y=4mqZ)F?B>A!Pvk(()DNRk}6v{gtv%aJ# zE+dYv>60)^JlEwc?!P<0c{n`%TVrN?X#3G=Kwq(@09YrH3b^JLjP^bHV0zSni6?|3H4G4bLjPLN#d_ zOSVn1T(WX!2szK{QYPI^GZ)f$?-6G6nPQn#fi)2pYL{b|5YzO08uG?bJlY(c}zOxR{E|C%)#h%V$1m zL#uK;j=`BmKrpxW(-!vHZ8sPrFHe5&V@H!cO#t5(D%&5wp+G-8`*o@B1z` z>*(`JfcSV+M)0urC9NdhuM5Vtw}Zp5NAD1XWL^u7dXCCERwC;3K)UZsv94j3nP`fw zg7u)X!xPi!X@r?_nR>3(l2SL6aa6r*m839#ky8{Z=r)YNfWwJ>}e}#6nH!KvOPU zvm=rMnmNAHR-qA_^FqP%ty)awcsZi-s&~RdoW2LouG;*euKo_4zHDISV0uC{=a!$j z+?;Qt9=hyLWiD^``91k&xT8Dn8P|uQ0|5#a; z{TFCy2~x0pQJoC{Hnq5NbSXtTN`2zEpzBkchysFHiiQ9%L%`?u4%f1qyyvy;vP(5ckjU(|iq24oY7%4Wl@qHL!q_h_T`b>bKKw;W%T^cHXbz~I#)A4i zl00YB(-;2x31z8lbWm5(g<~Ej8t=hO5$lxj_(;t{<(ZuJB;i^n?elb%+EdIz^q_D~n)pjwgEFF=tH>27*| z#agM%d)Z#uNP5w&#IS7u)&7>*0Oy$ zCE+>S2{np!LrYbWjh~qv_m@C=)t6s1cb)f{(AXq)H@MN243^*9;)(Xkf81xr zuWufr3cMAAt~ME+dUkCSj4{_utqb7z-gl%V0E>Z#s(*1{>SO&trxjCEJX;y!VofOR zwSg6x2H2`%ZIFS1{26R%Z&|na7j3hwTsN*N7Xeex@y+vvu=X0Mr!@XFbycMWIRm@r z%@^xrp;cwFSuJ#>jte_he_K(G7)O-`Wl76$r{XNz4;a|Q&R`BRVFW2n`N&cd=Yd4N|40zZYp17c& zJsfO!$jieGHe`XYNNreSNbg&j$kq-Z&j>7Yy?YjaG4eX&G-E;4a;fQ+2asF! zsew(6G#a4!v$Nivri5>;2$&K5L&l1jXQQ7(g;Itj7H%dnO00ba6O{qW!gAFIH8y+O zw1iz({WuNOv;$CcT^{3Vpln>6>{;oZLUg{BZH-|_&42kmQKt1Cm?)Lf_Y?xMwc4#V zd?Q+zG@@euocsGiEUXqjo_hQk)kMSo?~L;xdbdGQ$JA)6<`Jd~@W{E`W{EznWOsL< z*trvD^I%Ok_$HeS!V*4b<~M^aF!Hx{7=Qa%PP4};xNK^2R_gYwQf!*l;_R@2fNMl; zp?KkBTC?M6C!|#@(*#SQ^VLMf~4?v<>*l;a0U2yt1%2wjPx=u9<*{(An6 zb#_mCVwO+FAsNd33$iG^hy{dMcN%T^5r>T9vWzU zAdE>+mkDwbeiTc63Ji26RauU6 z9H)Z#XOzR9R-fB%2|}#-?d1qz`6i`f0Bst-J!?2I`9+vY!hdR=eKt^)i!9X%tGiIw zV#+MkYVMrx{8O2HD)%Ix->W`9#&)@h($4E(zBu!6^&;t`d_hAyH%qEDdEY&Xj^|L;(9rRyf1 z=Khfq{9#AXi-j7_dz>^>?cs;-cMNwLY45A=OAkk0LA__6s^&?<_PU^>q%SZRg`&a+ zeCr=Z2V-!cS2}V#6wxg#lP--5A2@>~0joClLTYKPMS{!19k`c0`R5ttNa;dBnOc)DiE)xTV|{en}sZn#P^2C476N0V+sP`7%@%au zFykWNDvWGiAc+#<*i>u~k&p{PUi==M_FjZzoYIK_75{sP!Xg+;a%N!hN2p6Ao>1KP zTrp#jGXXu~`fFo~-8%bK!T$OW;5jp`NBv%d0_dVBAZ{tVf+18Ie4T5D%1%`UM15MJGI zSNo|k*tBG#6#J7$&nkrbc?BVli-D)#xi}3}49Zu7S-|&cL5uNhKY|E%=-R)aUGOJ` zm`lX$3UxXAE)+kZh#mH8GL=Kvz4>x!Dvnkm+0!lXYpuBTk2|gB5f1u1W{+(YY_>D87|y=JuQs!EN}*%+v%yaAd@W7 z!6HBQC0adLH-NeQLlO>oK27N~-e3EXTBVN-pKfHUDn(*jtcf37yElo6dW>=Y*$3;E zX?dpoe=0ULQiGJ0Awn{-S$M54r3%yxuD(!fWgSa9MBT;$EkQt0fezK85`9Q%xB;T1 zF{P#>AP0}GtJ%Vb&*}XYkpN&g50GoYDokT!;(wmdiJMm}~U2 zx8pq zO=~V}+KlbIQvYH4w`>?T9>mRCpZ9F*=+6bKBul7IVR}KQri)9}j_xZ7EiV&amtD|qb5aa9iK?oc=8nMxHR=N=33O}#JOi@Pvc zi+|^6f!1tPb(#Fr9q*9}Ns6=Pk7R`#+m*O3`j(3*P~fi7+(lGH?v0Q|t>Vo%=)QnN#pU-SnN=%lw_~*NOx~FJhTkWX4ZeroPWj44MiBnBY zJ$5*h`ycl4&%E&IxEDT&<{RvF!rlPbJQ5z0PT6A2ldgc_=Z{5)z*FJn4{z#{a(48pEo&?|3=ClLLKhoxhiT+h{ty z-v;a%P1B-si%&~yt&J)40@dw%U)zFXL76t|<043(y+9C>vy{M2f%aS;kSTTj=bs!_ z&rLI)Xau_-2RTJ;xk#!>hAVJL9a9nE9N=aJIXW=^&$zuqldX;B?tSIiUj1R2Jqk3K z(#VVSgzQ5-cSu8ia$z8=l!|Pth=+gQ9f96qX)Ma1vw^b}>XF~to2BvxYJa|4`b}2< zILe5`(jV%X!KeL=tHJ4i4U&<++Of6QOdZ=9+M-0=Ee0|_U#Y^=Q8V2q`Jc45|CW8g zsokx_8PkO9^qSZ3PtZyWe|6B232r#O`Fn`|n8oiTTXK?CJUhyW`$dXKD^+O5_;((B z$1v&mL1D0>^zpHQj~*ZgUjg!kiatzUs~ z#a~B*ZcwszX%yg5<^1Pf*&I=iJe#G!2EzN__dTr%h73Pe;D(pdjLik)Ki%pB?o+w@ z{z)rHG;+EK^GqxC#65cTkD%*Hr0V{+*oHey6XiYT4$)dz7u2WTM^g22X4%yS`2~?f zEo*AvnX;DRI?Zi6qCFy%!oGJgY@R=jNFjp_H^E4HelMARjTq&vJA0u|H!}J*<$_T? zV>}uIttmsGdzs8{+NBi4oG3I=TGI5!zV;etGX>KMh2Q&-g}q@aGjm^8Ex?tOSNNw) zeZshMs{}K$$m47piuk7VjD*ecFS_8mAfkb<%Y6q4+szO59eZ0^7QFJ@sV0^9gW)O; z;uRGX0aMa3Sv;yseyzqN(BunzY)4mHltsE*UNeH|b zM0VHEwkVylVwKX?%A;1BEr#qQlHH+qYpY)Pg4NJe`TaBGtBB)Sdqd6DIMfp!LyN^2 zR{dGq=`~xY%RF61dTX*qAtWyE%OO(?zgD&rnl-64wo3koRv=zbr&O<(D`6StXXmAd zP&~U`Zd-ebncE(A$w{~LMVa&v`2`qZPQ77yi-8 Date: Mon, 25 Sep 2017 14:09:14 -0700 Subject: [PATCH 68/76] tweak art --- .../configuration/images/profile-config.png | Bin 36516 -> 38384 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/configuration/images/profile-config.png b/windows/configuration/images/profile-config.png index aa96f01058abc1507e77d14c39a5a76860728729..30a7468dcfd192d5ee070c1c456739f81acda295 100644 GIT binary patch literal 38384 zcmaI7byOU&_dbji_d@XniWir~y?AkHad#*VOL4d2?(W6i9g6Fsixt7_w_y9g^c)qUbZxpd%wUst4e=` zshT7`e9wHa5K|C?fvJr_dp1IN&!afVXgR~cU=IA}fK6h=B!PiR3YL`+Q~#w8%|h}6 ze7|{{y3ICq11BihQwObkvd-ctWB&|`(#QMssqAPf1oii$22L!kYN3ou`t>?o;oW+D z=iAi&Dv!X`dRKG1y<2_kj!(jJtNq^Ude_}52T>*J#rc2B5@H-tyXUX}mY>e&62txf zB_MY;J~IY6(&t{*&46 z;WJiYeFhs6VwXw@40Pd#KhNUDyc z-BSOnLb>#x?;_dA?*F4){lVqjQZa;9%K%KB<^yO9mHq~7Y#1%A^BRGme=>Vb*B-h3 zH2to90mcL~CDk`)8oF}l&dCdnRob__pc3Iu&{CZNa+rW^h+EaX&mZ zRGOipdf}VgF6ewi5kNi)qR(l8a6aEv>*CGEJB5S*mu=#=? zL3(&}vhr9|V%~8=N+E(VN{x6o*5pGcmx1_*dlYf(tn2M~QzH3PB>07Kl-v1a zekdf@muY{Uk@P5S0xJ9)l|vz|%) z34dG8^KGQ8)6K>9&VGqv?9?f{1aZ3db(V~lQI(Y+GAn}HUG2+GI_}U2iU7v!T}9GC zcK3VJp38Db=h(6o;*w$87c(u`EU##;(3dlkoM;y;{)NyoCR}{zv>#7$op3rxbZXtK z*N#ynr0W*6%_ptzrzo2r6)zBJ;nnza6xb-acGdshqQdUxqh=1l_oivbje<@RA$s#w z-MzY6i-o(uQh~$Pv??OsZ;b}6mrJ#m2}&_3$BM+P8v^DPcsr(+|jt%PjpFDz`GSW{^SK?3MOv z@yF|_bcUm?VtT9R+AeIJD}lw*byC2k<)=uUrg?Qm++yR@CW36!MiA`6{wnAe#9!l| z8k@|*j%4MXZ!dtxYBPIHqZ zoK5`+kCmUU zi)JwTqGCMFha6yTYpP&_=;JX3C@?;f2(tgP)UH9_aRY_FhS#+tv+2q3CD?qp;+mg= zYgtRH?&aKAtF~6`DI?ekN`_4S{<_K-`9=JVxKF{O^@B?$e!TzhH`XcE1Owq# znJRb7E?t*JCU-a4B*62pqpH9n-W+!o=Wzy7ZPHW!G)dF&tHe}C65lvk?wApK^+fTf zR@|UP>)_$05L2-)|J0u5aOYQvst2rxr2Hvr;Zy&yU>^yCslZpC@wX zov7d>rvZ=|x1WQ9n=?=Ho-T{XNmBlVDDp|xn4H_i%4PF}qI%aLu_aKHvSYtU3JZV>pnt_JD!gVX7xJsFg@PUeYU5Y zX}F>wQb{L=s0<+|$e~#%E|3{v&Zc=`UQz`mZ0h+|k{iynX_FWd*a&UrzqzX&pP51S zSD#N*p@Fez(wH~tr7YgR@E53_QJ$gJ>CzMaUe}f4ULBBj=Hkuo9>vAz&_!dl$RN%M zwrf1Ak9qe}md+VgX?#oWgDh0bdIccU*)Wmt{7_Cq7Ou_PR)_t{q{ckWg+AN}% zbJz++X|YBY(LsNHRBZ|JaDCsHW1xB9l8-m z(Ft~0E4@odmkOlm_m9{HJ?aRqo_cJ}!1LKF?&j!IU@MNr%fZA1d z4LkBybGcZRf2GabOzjWZ(MiJz6Mp#7Pj$a*T|GkZcieQtL?fiW3&;Z6FaCRihD3KW&kB)7w5(UWo~r9tCnob10?9 zzuq7I+X;O1|2e%7D;?xNR)mpjXZ32;rQ$0JTw_DBTS}B;67&Z!!XJ?tU8&0-rXu!8&B@DBbs~&^UY1Z+@Y@pcb>k$y(plbKt6+1h`oj5n? zbSn}Vr#W0oF_Fny9q5RZB?S7PVuNyrbF->v+8Px{W_=S0g+x39I|V$RI1~(|U4SX$ z%n-ICz35_iZ%lWSvztD^C6%<<<8J$H?6vXV-lBx7jG8?we{#K3MP+@x<-*fe$)PG% z7uO^%xqEVJUrIKyyUcr4f&=mqf>8|-+xD`YM4HeYt54|#Q(K#};0JL7xz~ind!n98 z&F#N<_ioW-REwFs`cha-YyyShlI>u&Yf>!{)q!!Recz2FPRup-TShYS%F;MDd=28` z6YZWhd)g}=D|l`nWq;DXZyVVl8MXjw!VZJXG~?b=4+z?iIyqbqrW7}#Sk)YBM~fdqSDnxTCVHsRu&|f z^MOLeoT|8cq& zZxPGXJeTtD7VD3;{`D3PZ@M@`QyisJ*QLn#y*{{8|12k6Sb1{EIjp0*K^shI(B(dj zTwi~8|C*dU#yzJaDYc&Wy{qHQA>s_pnR{3TJi40+A2RknrA*WVV*RxWRcfWqT*_0O znO0P97Ve(H=JSrpbDCudG`*{(DOS*|*km_`;Ah=lI2~lCT?@J|iY++aaNGI12fOBC z=517ofpID-jSg6IW;k93y+hMZwmBEt;tHfv_i-EK*{wU?D!I5t&Mp^REr&mlv!KuB zWa+rX7v7b8N$~&(H_8`dvMN6<-+tDV^89hyz{K|F>A?!OLb29o(`Di~0Yp{-LehRH zj%LwRE64{nX-hZw_{v_nnSRM~EIz4nH6gE*4pm}KdD_r7*?k>*!bsV6Bd(CBT*o*2 z_ydthz_Rl>zDqz7{A7x;Xs6wMN4ltlIRo0HU}h~ZCox_BqwU!=6$IlACJ!b2!q|`$s>I0URz^~Bk;-48OpEztwocV#hkXTTPgJZ@C?u$2W>Hx>-vGXj zp&`zK`X?X_2Z#O`p1rxLlQ?GC%oA$c(p=>BY3cZJ)v|gS#s(Gq-2{}oiuX8}Mdz7Z z_HAj5LKkIhU?OEJQ%8|(ZA@Tngrb)yXKwhXbps_r<-a6}ePesQxwW=Q(5?GWmutdl zn?@y?=9K$5(P#WfaQW|*M?)tgZzjn~d(SduL$^hC&w81zV<62Tk+F8oT|FG?^E`!g z4Al!MzPq7|X?Ch@`yMig4Fco@Sc`7=ov}zTbS^5BaM^$45R)dwzWkMHx zAC?sQa1t73c@2MGy81deg|sTjwz5sg-nFsGQ}QxPDXP}zqEhmEa*Q^xGDlqHe0&^3 zDw0T9+5GeNHCKuCx|h`0;w!`_l3@&7!+n%n*o!Fm8B#)GC%*{%thWw+P5Z(J!JbXH z?6qrTJ>eW*xC6BJiykxn_-Wmcm6!NHC!%XHigxL2`6gJ2Wwy|T4(`w`F|&R6>v1)- zD`H8Gc!|+0n=t9HuXZ+iD9ft|OeSZP;YB6+5EgKQ0i~#(hjZz`$6nfE&Cz6P?riuf zUF~8FF|_H^gjM&{6}vPnW+%b}&&_dLe^KK@y>?)h!N%vGAB(P--f&l~q}l>Bezu;I zN{eaoRzjP}(=OAzN4%iq{Pp%7>QzR1q6i`K6LpJDBYfA@1?iLCet9t&(lj!6@wZpMB^PN^M)S$~80!Sa ztksN(qxlfocPNETaa6#0g}PO>1P9N3~L|>XuQ)TM$)2UhR_taGfO44JUI}Pyf{#7R$gIb95j*a zaz21`T(SE1w;jp-#HR+nM7~P1%M~!)h=q%?sC!7_l#X6`ltFlMg3*Hij3%Phw`CHo zbXIWEwXWkhA)g`%{V;zPyG?AVbWjXG9Q{+`RR`(*7cgaHSgU~Q3WGp&;nf#5w=m8i z4?6F^w82>oc3s7RR5Fx1Hu=ePv!<=wTMZ<0og2c953y5iY+yrFY5dJ2G zbkKcVg_l6=U*;pF@P$xRKF>FtZv)bV{z||cHyO!_)4>X<)z7Qwsa<6^(84UF^dHb# zA{)~XOk}C+sT8W>q!AvMSSgE7!v(SrZOIQ)P_BWkn>26D@MHVeXxh<hAGp0bbyILZcVk1mA*PfSN^>fMpJQne# zQ8#M3gS66?3KTE?B#uFH_$n90N*zE$d&jV;Q@E4M7XnQC&R2;wx!orC-4HKR zctm&;M6;`;=h<$(YUmBiH^PEk1>fsVuFC{p)>uA%KZphj(F?>ahOA(hVyc*4Ae-Zu zh`&VHQAP#T1DRNtQfAQXTB!i$hh7IfEBtpPpNShxv*A$K=di^!A z8>SAzu)0~=Jd>lY>6e;28sxitdSpmc*qxsCNy;0}&6kj2-we{4#Xy8w##HF2m;~Cz zD+XF-XmTSgi!C3%d`eH_7PWDX<(2^$wdV!%f2;r%)HVHp;h7_S^4`c`+%1dYUb4j5 zQ$%*wUz7UfDz z-1hN#=~7QhN31-8tuoNcdK`S>?(&8@(Xi-jecHGA8A)^VkP{; z_LXxrW;W}l5>f;d@(Jtg&KsEyg^55~GVFnRlLD*rwrKUY^Kn(JvWFP_1Sg4yK2yVNq%Kv&$V@y?2yt#0zl1bDjS(ftN5 z0MOk}@6E?POYruUn1(PanO5;L{)9#`Fg>aRfrN@5&PI}ulsD*<4bI-$mVN8W88BD5 zUg)0dE}j*N{B;rp02>@T$Bi4PRo~=EDo*p}!)kZs>32QcX%V~e!-3v*h-WO0K1|=f z95q}Nm$hz+MC{5|l3SkgdB8w904TSXHq)To;DRcB&=e_H9e3XYdeZ&p!@q$nM2O!e z-CK4wNZ03YhoigwKgF-DPRNnf4ZR_33y99%ck6uIrPMKhu^8eFa)f8_Pt=NQ-VWMr zcKn-vj68e;VuAf9+}`*!%qu18V>d?~XnlgMWZ5XHe<|qo=#6uI^P0iqn2)%PxDDxW zm=|h@A@XdHO@ww15fD8X&9K_2ll`)3d{$WTUEL)*1Q+AP@QI~khcMlQ3c$BcEq%3$ zD>1K%VW#*YPzzj9Skaz6IBxbf)wUYtxgp4J3ygona{cGDMs+2xGem*FJaj{+5St}U zFs1@V8r?9^|H25Yp6q;~V&3=W&BCy4j~Ma$TY zH=zKhIn_52#L%PU#h6V@_VVAGaUy8{bN{CQ^EZU)l1^US0>mQa-yEA9(NMMh+J9CN z_jdQp;T+2G7HBe*zK1?NL>ZHuvgS~s;$<``MY6};rdGZ5PIt?x4@;T6CiN0 zc}O%|37i(lmJ)-N%IK4U{^g`4TF$M_oq2hLa@vmmk&s2@s1p6lq)puNt!Jy@A`mqS zk1Yvt`$LS4m{_B^nd;`BlHv4GsaBP>vuY}NLT&`hLR!Hzarg^2ny-;EsLom@`SKvw ztO;0n^-w%RmSNnaPs-R2QGgP$nLZ*<0>7HsVd3=sTqH;0bKmP zL`Gr(VX#m*qrcr)Nrk$%G0PAK<_5`S?C=e1@&0Sv3pqZ9=?0SzJ#bg#FE;wK$JX9= zS9JJa(j;~P^%f2&qnylVm(v0^ws}s-kuifLvr5?e{`xWbq;E*0nO8@D5Hs)*N+b08*Ye$s$cTG`2orvc z`}d1k(L;zEnLpaC&BwmVL!&t`h{1s_3>y#oqz{|$RqQn0aE(Hs>0DLrUR3CH;9(TD z;-tTG%RvLG*%``WP+=83jaV`EfIt$ zp9oGYZFr_m(S%Tbq_#5I0r933!@97S?hUm;FgF+mZDC>QUx2F^HaxzLNsKF^|3btU zw%GtK)M}PhdV*uaZ36A84Q)-c508r_O7UtSBFn7ea+aAEpiSCDyl+R>pZ+$dq^@>d zfpdDI$N&e^;~W74oiYIT!#1M)K*HhRApd>uUeA^wm2@yMU9nJ)0z}2ktV!D&tGKVb z$TgdbVh60Ry+5KdJRrta6qb5+;S=+I)1}U|7n?GuGDE$2@k3t$etGfk?gtp8L8AZO*hXk}U)AA0Kp8+*wvK=*Ffn zxLLOW@TN*B(V2VlwW-Scmw%FwU&w4xHI+^x3ZkgIp4#7P_g`ItJT`&57gLI9xu)(x zMb4u>l^G7LkL&@_So7r0sj=Y($6+CrelgwMlN`ZP@5xHGzdcHS5HVJRM+Nx`&yj|r z*de}Zu zal)IFF=o^8I-Ik2u6zT;2D6t&L^MP|Xn}d6x|I6YLkUH$E~1eKIPF3$CJ6Y-<1SAO z#;K~bYf@RpwjB<+8M9A7-5TGZ5Iie=0y<#}uSzL&bQSk55Q%%%|3 zK&q{_u41jVpX|06DOR1vxs~}Q#xIEX%402+JmK@7X4jdOK~_TzA4S1Kr`p-={98Z< zriI`{QEn|ySYb{5Pa`BHdZw|r3tQGCG7@epAOyQuB739Gq#DE_53J4?U=3z%tm062MkxY+7QBox&}XMmb;pjEeLVrPV;=In(2mREPu=) zjwk%F5@m+fPY?vKlUpOJx-if6(|KZW7yQNH9j)&nV*TX5pszYfnA_w|N{pxCEI3S+ z9A@ZSknC&@3TO)abwP%q$wARCNiM2qCbT_8W>8va868*Ro%pY=xXL^G7X6*>W>fJ* z!yEpdzG*2Owi+Dzeb|*Qnx`1!z)<{C&Q(sgD}){~Y9Z2We!*(vV)Pr>&}(n+E@`)_ z37u}U^7CBxJijU;(5uC2R{}TTFOO#U6eQsO1L)7F;S9dOQU%-!Yf>c9y~yPxeEc9YOUrvkIuFD!2m)g;0HTXsHqkK;_6p#3vK}jyF)h8p*We! z@;e}{U(aeKr9NsRkK(P(e@nCq8a}QOge4#dU1yWdx#7-SIU)A&Eu$)njDCGC`f~Zu z86xY>ZX=NSXB}u=+mJ6-q1yK`Hdc)0wDje^hLYsjd?Su%w^A>)s&rFt4Ia{SY|yteOmDYrP%joZazH*EC*T`!9%Of!aBJ*pR^I`1OAyMZ zl30=86Y^^J2Mv=3`8D-+u<_#R^8j_4^LG4QO+Pi=Cr)=3L5D`a;ge@rlG4{%W)k*_ zUzTyok4a6mgwh5|2{Y-()s&~*Mzz#VLO)m1Vd?!lLfuWkv9GXB^&UpH!Jat{9*GtO z`pJto54VU_Rhr@=AL34wP+-)ir6if94=_N)oEc)b6@AP`9~pR5S!bMfgDAtEh;I5T zuN+%RDN7UlnOZBEohoqAaCX$OGuiHK5fPx}<@@EpY+nz%G(g7X+v`3Hx7G*gvU7nJ z&VTt{gY8L11GrF*cAS~`mtC}#kS;nX&>Pc&BcyaNTK#Hrj514fHvjxHvUmfVdLrVH+QpBDdsTsad{g& z(k|zaX~`|13EC58{&$YU7X^r=b-no;9;(jMT2V&eeB*)hPW^q__Lk zk7erJjnPCDc%{Qbm`sVBcf`g=-k`WznPiobyZNjnHb+J_SmR`W&^LLj)$7)92%%Dw zWPq;9Rg|^)1v5ZlT1KGdx8+26@)kKjL@|1!Y_+&O)xPU>2El1J@am_Et)OZV#?*3F zV%gz|l)(56(q$EqTQPR*3_jpHUsN7cw03ez0k%`nK2X=InPfMPR=_IlapDly7!r|+ zt3yGbjvYyJOtSMVV6jXj8oLg@C8X?r9{)uJc3I-W$ZXx6jR6|{`BS$p>GgyoS^J1L zfi*7nXuV(lrmPd_V5^BdOkJ2jMeV1fzN|m_dAwVc(sB;N8WWK#GPb`ic|gcJC2b@z z7T4H%N68?S()an`FiiFQ9s;Rh+jo%$JjluQeQDLRewfiAtq9s680Gq z;|`XV_Fn5p+qv}I*CfK|*uyVWs!g^JrO=%@kCV$w4w&(NQXEWsSgF`aX(Z{rR`d)~ z6NzRD28k_Y2i)_YH~#ts(fqnNF0U4OB?Jzdg9bVb$t2=YHBl?U z)UyvY=S_OBzk5g;lrE+>!ec)Ak;F16-XWCUk2n;2<`bYbsG!YWV3VO@St#mOQ18CG z*+3@wo2Crj4!%Cr;{V&XsOE`6jTqa;K|}__-4HY{n}`31Vzl;=PUAV8g}IPZJuQtb zBml6gIr9iNYG&UXR@yQT>VXQWDUo3zA3*XSAVl#UInf@Pi!cl7gX+)Ln2iXEjmIY~ zI3Ttnl(=BRS>%gszF!S;cioNJ;X8uvS|}V~l!_8R(ZP=I4McdIM$y76f`$x%bv?It z`{q^6f}zhGl;#o7F-l~t1_BO+yBS=$>0y@IdsR+m&tYY|KZM~f$^C$N=yk$={3GV@ ze#zLCCh7?xQsGwtgtc*#WhBMte4EI`c09~mVK{}fsl?8v+~=VlgpeUm;5R0GVY?wG zchG`I>&~f`(-<1#PL6#=ZNgd_nfZmw^t5rwpDvZr-_E;#wueTOhN2oPZ|3UHo}H_b zv>HZ0!b&=%`4jnIh6Ioc@fk~5a&x18jl#VU^R|DQ$5nhXJ0(#F?*}v2tynmnex#B6 zUihnu`n_10;#Ih)`axZQUuj(>Ve@pGRQx(bsN|*qirzSXB2hpUK6<(0ni-8AUxFT8 zN@rP3S|k2qm1Ok|57stYLChLv`rAA2GbiHro&WN_(I|+U_(?_-j|ESW6ArEtFm+E5 zL`N}LCYnltCI8@PaUPUV!Be1HTS)n9F}Y~Z6NZ5GF>16;N{3{i=iFhK2 zftfQFzd^Lh)<%RY89n?Jw!Hh1yn6*={xSi#d+V*3q+p-mW0aU5O?yFsxD&V*)6hB> zMj^OL-`?=u&qw4J(nXLT2g&8Ol2VPo5PSx?2>-^ywGij~lBAks)#QsS;jAQ2n6l0v zdXFi2TF$Tk(yN0G-pF)vsUG>brFqRX~j2Jw;6Lf~0c5ZiXvj@X~5Pvx_+C6JC2V@R9M>kc^5B7nBfhQFIGCz&- z1cx(P;wmp2o9_>OX-7|9>Ef6Vql{3heq4m(JDW^{5Zc$F_5*{D9coB1#4Y!P(0XQ8 zbxWv>r3T;s4d1aQz>4N+bJnbcu7j}5^5sw`SUE0ImwcCLV6uD)LLn{8!;cCKJVQMK zusb&8f(HBiNR#1$p$d-HPX)X%v0VM#`Y-C_P4)3e6U=F#J#@pU5b(zu{K)>z)wwSP z4h%1H-{wT0W)v>358r(WemeI)h-HmTIog=&r*?{U-KSvvi~o;~+L-IWR%w*9?WJ3n|J6Zs2b?vF!vB z^Gp_t34C4GQBlrFWF=nM@V1LT$#W%{?W>~Zh8x$Jcrdmjag++NNd>@h8g1gjX*CH) zDfv<_#PvijBm-hkD4lM%w*5uW2`zE=4*mu7qN{bzh5OUE+k&?TqJVz7bvSS}Yn|Fx zp_BbUR^pBk@d#=v@O<-Pg94mqG}K~$ib8H>uqRjjm||t~GclJnK_B9hmG&YGtl6D< z#N#4Es2xww@LcG(`=uj!O)I*Ezr|z48hAtewLgvr-2NQUm7MH>zO|OI8=~0Pq{ceh z9?H_MmTtVDzP3fj2a5E@zAiW2qWe-HV_qD-do;L9YC2K{IWMlEXkD9G7OR;}H>iv~ z=v7z6g5P+>Pd!bN60OL4s%VNIKa&N)-_3~9N#{S^147d3GK_L^9i~!+P54;}{hXx; zTmxQ1%J^otf;3;!YYRt*vAxNW5!ZIa7??>RUykXh&Xx{DpOA2hqKeR+yilZBl&eSn zQI~$NvaMm|M{dS^QrV`c~^(-7DJBHOjBT#Z3YQ>iUCCGIkZHiX+ z-;gpy=5q8C))wa`CqIS=PAfw6!pv^y%P9-Q6^)#yl-CrGsMW>0vW%Q)m;G`pNNLG8 zwUHWum|~)0sTvzP0mY+cH_RE#Efwf>rBkS}&CGPKT{$pry&hHpVG{!SeMK}a)Of1` z7>#*&j^G4ydu-@dlda0cq+gmorrx;}jtu)r`Uq$wE*Yt9BjQ7}cu9HP&J$r540lZ% zA!WU23v(mY*}6Y120NNv61Z~lbcutSYKS1Ay`3Oxf5gZ}P9WmxZ=Mx6;n(G@d6+7r zUSVkz7<{riXuO&=U(4nD;5=f9VSyLKNchE&z!o2A|6+m{b9Ji&rw6%vI;;rIGdB7s zXV+`th13tLAXYx(LhpwhmrXy>d7Ae)Q}ZJwS}1kEHGWh7Y5! z{ktV4kY!bMObbuhS*(${$5-hxb9c6USmQ+K9n%=r?6rz7Kh`Nh|Xs!W})%za=<+ zo6%3wCVrhm$xCTcg-<1JMD&YgD;3Kyn{)4LLIt3AR(SG^KS-DjJmVY6)R`l8w053;!MeVU&Z z71n6LP68i%0!o)*Rlku2^6an=BvMJhAmuvMoHQ6AfJ{-4l$|u`iJMpSwT!3<1wxjx zZr2;fpfB6X<1(`(n&{QK0}!;!sI1sTt>?Y-Z%q~8vlC#QgyOsyAJVUUGr8bDaeA1 zcQ62JV$4q_wKPp>G3bGT1;RUHE zc|S?=3Z~?{6H*+c;%y1$g_BZQ^7ypt~UA88h-=G?2a8{%`q<=l@RGRZWxJvDYnHhF(#^vKBs|D z`#Md<11kd!f!_lAWa1UW;Tw5P_E?~?LzaP~Wp$R!O9%+B*Q=`T&MM~$Uv9*!P2QK9 zM+xpWiY=08K_W~JC3%MGlV4S4d!LmrhcE6)5#9aTreupOAIOyJ2GXQR`*Ro+g%AL6 zC8Xlio+M?8$$v?A5*U5+%?hOS=Q#qCKR_{}c&+#?l2-n7UX}VZ5t0Qcbvf=cz?E9y@qp5a#Hf~va2>)kP#^|!<%660gKI) zIrY%$Y@B(UG=^xCTc^5XmE~6nvYT|;vSJ-^oI2i{*KmHEpeiuoHvt`;>xqFD*xHH| zL_NnTy^G~@(i&$j{SoR(S=ls>v8X)wg^o}UlTxEUZ%quhp*f!m%$%5BS1WQ-51K)wm3i zymi2V(DqICMkFE?|3^rd#C_FJJRVen2eM{^#VF{J3@ z*P6Wuy<=5Q<1cTIB|E97&#CJ<6~OEt;A2^zp{=V&Rba82i^EW!YIL-GiS<5foyaEpsZecGnBhjRVoGEsz7mjA|N|OQDm;J zU+%^Wgh8vLY5nL7jX(A;c^?XjhsU0W0Aj#|bd>?s`gNxNn?IkIRO{j4$ShI1R*NO? zsb}+u_+rkdr%zZ5+N-0V1B?4GD?Y%&b($$+PKYyV;;Eae)T^l=PrmIP49iL z$3l~)nA1!Het>XxpaK4H`|Dpwin)$j)A4~ZQORM8`Up&DCOb1;6$$dz#{rD%)ee1u z#+9iw>y;%>66v*b&`%!e{mpPiaTW9aeLHQmD0qwTTy_&4#E;dJ)#`9MHd!@X=Z`ht zIrH>)XMUX&eMk_4JDfymIkOU~1TW@52R4@t4 zK+Y}8{cKi3ZxJm)qED=i2xr1oQGJZ;m;@sBj3S}f;I~f9V*jg6(lF%r*#BcYCyQGa z(JHe_C14x|AsRn(%nY_}32vMP9hzgZhdL@ELkr(#p3*3cz01K&63W0wmnAEXn0n$N z4&Ud2G5Up=`iSpgz=J@Tu5M`QV_Id_pbq4rved;ioExFWQ(iL4Fqa*W56_PngUz(g z2lWr3On%$>1fYPX+)`ckazK|FsZ7KgTWt={wgQ;4Fi0>CIuI>G`#qw}Alw``f3>4| z@YSt#4uyBW0*Xv_Q*nk-K8Ah`ARm;oldY9 z^%$B)RX`KvYVD^UuW7~?FKVVlg-HiWAolXgr%H*{;^+^Nk2Q-#rq6j3UMwN<*%VX!U7e&aHF02 z+SrS`Yo?0BUubW@ZHIk5xf@$0zB9^odv-2b+40pr`1lKwj>06agv{+PHfYYk=&B7$ zk!JAi19UJ0^7x&=4OC-(K*1*s0uu$rAMH zOh@kHySLM1V#(k4|6;;E<3LD}DN#O7h#7%`@j?_2^ae3ZRhM0Dq)H1J$f(3FIMnI= zNTX2Qh*g#<8PCQ1KTNVtXOU2tT!ai&}|Bj_Z97jgcs$pGt7HdzmhFD>dvu1JjNZXk?Z>??gRq)sB>{fa(~? zw3a5Oj}J&F=Wqv7oE0eLlti@=)3f}-G$%DZkPc0$h~^f8t-{g1|z z4f6!ZR)*D$pA^W3L|gRa{5M!)G}X`eJ&p*o7{DSqki1n)oLy?y;#Qd5Fjv-YK9f4{ zl<+lH&ZLIcUa5cPz%!nbw01c;q`OEUMJAKf9tPn1v|}tc3s$Tf$XyYV!0lxhz(Lx? zC8nn$TOMlXjd!Xn;t9Qa0m2V4|wmBh0;0I zH43N*@VcCDO9D3vj4=6ynoRY-WdzU}gE*hB*8#a$|bsE(QgZ3F{7B)%Inz@DSPsAe#C zS(=m|Y1@`FlSi3iz=8dY)}DB=nb9WY8@@y&DvSypieU#fjRdDKCYFpR6w9l$d0FS& zR*~_?2en(8`~*wrww93bwf_=-$%{hi_a_+{V+94=jyL$#viY z;2s6n_dA;o9}isj0!DE*(f=J4I*TxnClYOaBpsJ?&yBo@bSvv4<>LHjgqqHQjo{;m z;4Q8k>MrHJPqZstBrohO(GTX-WSbQSPG|J5YV{%2sR$fWBpC=|vBcA`x#5#d>v6h0 zBTs+wEjUvhaWUl))tFe?Kl<%uvFRp(9fW~$r#={Kr%7^>%Jhleg)!}EO$-}zn&dxm zmccH4@E<3#ij3w+8%ZWM4z66*!iAAqNCf4~bJ~whwRj&^Pi~q(fj1zm%=SP*$C1g) z`$2)Reu5Ljjh$@)Pp{K}IOn;=odcPC=M?~zwTN|evB{h~X*i>Xy0BKdU(dKudI-gZ z8=gutZd_HT<$XcmR4GaLX^|6Mtekms0h{zjkxerz4u&*?bKQBM%XU1I5H1vyytfL* zaMtjDQ9pJ4v{suyS}1`P%XA^CG+y?Rj_p78uSw3moQ5E|ERGB5`NoAqu%HT|T`(R8b0)TeG(hkwf%_a>sUgD{*e ztO&W>1}FZ@@~q(Sb{&EtnRwfN5%2M=w3~lA<j(aCp)8Y+w?l>?w6 zu99%MX3>*a`(_3rCUKL@k*10p9~Y`2$t|dHyJb02#2Yy&!kvUETSeK4Usf=uBl0l* zkELpJnM}_VYb_K6OR{D>Y3O0X5fE9kXb6<$WB)?)0V2-hFZfmGpNE?pPX3QsfhRt% z17BAzGZN-6JUIE;|15Q{YuV-~)-o5`(s1)XMy89{-CrgN&&t*RWQKpxPS(74ABz~< zb(>;p#7c1b$`)~*wj~bO;6s6|E`1#98~U`DecxVG=xh*D&*)?OuuUQ-pw~+vA z0l@Y)KA9UGEqx%|wq?%$|9~a7PQ9n%SK7*GSA48^&6mscVM=v5CbZI1nPVWGW)zX& zn50iKTjh=atF)7zE7hm`+jeW(N!^+KvRP_2=a}NpVGtz=>9db(;go5eE`3B4X#!bE z{#AeJ^xD0{EqPVb5`xJKNm5J?(=40of&1BZsqGO}e;I$DF3Do5<|D}@|H`G?oBSvo z8wELJ$v<`D5zK8jKRtYmke~DMt4dXSn2#fR(mjMgzYzxP&sc2H0@Upyp6LyWuS!vP0H2)UfWiWHJ zI(mF*|J$OSMjy6djIi8?Gq_fDJE@67%J28>Ht$;tx-xWv6f>EM9-#lhy?+Q2b^TOl zfrE=_Gv_;`-y6LxAi9r~Vn)6NcRPbY-#^V0h#@xTL&@)va`3;<9$7uCKzHF1es4fI ziT=3J{{}X-+>}JSP^BAeKIs3xMl=g~>90i_#$BZ;mZZKG_)jRqLq?d`g4>w+Ivp2e!`FS}@uErgaoaLb3Gls>@MrGa7s9Q=)Zu6pw-z*SJa-~@MjtB@4j2F zZq?(zRG?w+UVHUiV~+8g7~>eNf8R6;{vp~Oz!!TT`3KcqAN~QJSB6#Mm^fuQ(y#@% zIWh<(2dDV3*8ar;M3`fvhbx>Nr8Q>?oHwn-N%&cao2h<@kWQQc$yq!;R=b3+pX< zNQuM}!jJYF_hm!<+ZJ~B(F>b5iZuFl=r(ok5v=4D{f|FhAP#>M;uJi{L7{~lHsk<) zlv~)udre&RcO01URJ~@Ec)m6=dWh)Pd1dnJ&N#l~w{nRXv$s762(HdSgcu|*m;vA` zis57XO(@F0|3HhXfcbwh5B@Je243{D|M(5Y)$=Y9(^DLav$?lV@;|vMeT1BsT=L9u zl?wIF2QCy-PUv=WkJFSH<6k#T#(-6q{{BGT9Rh*^;*(L1$cCz zYF#V8CzsjMJu72is+1BDdQ^y|n5w3?6eCO{6Y06qDqug7ae2^P@ zN?|gOcEam{%T#bBRI~xXX9?sv%OId2J}7@eo`Agd{tqS*TvwH&5if5`Sd`WM!|*75 zoQIAs37kfBnx+Qes+aJ#+Y`lMCuX7~c>y{=G5{_7cQV*bA@bp%E)>K|dj9;>2!48! zrdBKk2?#j(g;NhlNrgPz`V4MesV0_yRnmr@OTc2H+lf0#gR44UaVoTiaW7v7(mFt4 zag?#34~M;5KywZ~#Sj0s1RBnWW@PPU7WiUpwF3#|2%ANz5_Xb zp>_y{J}4L!ANUSk(z5WAI?R@p0nu&jV9K7U9xsMfS!FJo|rM;N+mrNwZr?XMc`|SAE3Ix}jvOR)I7H05)G-_0h zYF6L_6ti>)Eeem0M&eVDi^<-=MeG<`#UHN<^uPT8 za{M-MKp1nodJtjX>valR<#7)`U}lVWQ!rvwP4PxgIW8T_L{CZDwvM$~ z9rq>7HM2KQz$*c6fmoYIGSavVl2tDA@B==QcsHvj%I3|?FO(85FX6ReNULmYOr7WL zrD=4P_6ge7@x|yU)6577C*-&>3YXzt9{+uuEhuT3PjgVE(Damf;<+ME9P&C&8n_iU z^j}hZh8o&LDP@*#XVCLDe?fAPO*pl4kLn=BJV}IH(x`IL%}PcCgM!;1oOYsVa)uTM zign);eNDp7J1 zH|_pZua`F?A%U;9nK-B|h-MK60qy5Fjmu)`7C$7bHm{`b=+7BLw zd}Xm{($NuteBsD>;HrJhBD5;EiYQ1OR=UWx<_HkDU!z44{xMkOm+w~4NUq2yUz9|k z+L+)Je=TJmr*QVQ5Ie#EGZfT>L4X586^B6;=lY5u0uz>okvAsjO)`%H4qGFdgG!q2 z(%_HU4RI%8U8A2w1AkN<^Wk#!*m2qyS}~YJ?l!l2f~gex9`=R^5~T3WxNy9P26hvu z{aayjLAaR@0VnU}Jyy4q3gvlRKnsRiI{DF|@mV0?mF1Nvd9X6C^dh0r{BWUqkv)S; z3eN*s)YJ$HE+KeEyg!`1&0IeijY;-28-PyNat``>WvcSm#;=`8%CP+dsTUx-1hLp~ zmkhLuiK0R7!k!{7u|0G`eG^}#Br&&D{df+$MV1Uelt~7#9Ef`YquO`9hVkhVuYK)r zG2_OOP{5c0Cg10y1{}8|R~DP&h()|99Qs!zHi=ghl6km^&Ev*v7IY|8*e~q8DU;s) zo>WeG9q0+kszL}bJ&p|G>h#iizg?`AiyTnybKqs0Q0G7u8s4(MR?UU3i^u`?X`Lxw>9}7LsOk;1!k9%<-&Hy%n`iK&IGbl-r@% z7!lb81r&0H8b-O4s;f@!YP|;dW<|>RiZeLI8fH+ z&y8`RePuL(Jmanf(Pl9Xu5ch(ZQCLq&;#NM0w{FNtlrg$Qsk~@untY097UPk%~fsn z15}B065nG!NV4sXOKRLr0`X)zu}C(L167Ic;cxsq<#}JQraD`SxEVNFh|-FziH z0Y$PwuGMGcKVWfWvP5y1TNPYlA(o{!rg0_Gq$0CAC8vnXQdm`LxDA0+Zf&$u-61?E z5JOvu)uOY(f~cV2Ys$$EOHLOp9as>GY$&MuV*Gl9$%#q`K6+LmszX78 zO2&auLl@#&Eu%yU!y8IW(70JXBgE2jtc+jBI2tNiNTE`Utf#LnoMZ%IF>1T}n6aQ< z0+QjFns5C=scR(6b}fx^JaKsn+E5CjX?vBw8XE#u8Oo3|f-eD!_R8xpsLxg-yLE61 z8K*;k>d^iI!WHUul??_dvK~z> ze^U)*K*E7*y@Sp6Ps^ZItOUi-M7!cx71sq@QsrfA9wcN84ymhKxV?+kt01yCeKR&c zBBv@|HI7>~Vkln11IB<8G#)9{C<^?c=jfIRJz>^Hz}gs9SGIC{Ppl9m_Lwg(aYP=6 zQvd?Tzo2sF7`O$-%3EKan!+n;=5M z<-q5eq%tt<6eq$h5FKzAa9ttK>px+_e+Z>K}Ad zVAIG$2*Pmv@g?d=*rV9J?%|2H`h4ee%7_et6tX91azP}~0nU*;7cX0dPN`mA-k z&M&g{2T}mC6x2D8o&7~sPArVQY=IThG;RukZ?%uGDc}BCG z9YU?Yr&#i@{2!A-N5298aUl8Zfn6OqkaS4YeFPY9bK%)p{(YjCB!tA! zS1mR{-zqE2WBK|~q5%)8inrsETJ!oGvpFHvDxZ5D80a7?UwV~!31QT|B>np`0TPdZ zCSg{!4!?#1ga7>&t)4|f8LOqhlx^f!P|v&qa2LGL?mnt$Kc!pAWtN^X*^}deN??(Q z-(q8JH5|`H}zk*Mw=YZfXF$zLhQzs!Y2>q9GPpa&}Az>Z6&FUNQ1amb!MQ+*DdBE%7v&X-Qjdpgq%YHbw^b+bH6i|cR(&E zrmA3nKfc^ZN~MsD@AmGYE^Rd_>?oB1X?DiKvqi4%1jN$ati3p=9{{lL@;qJ+eR)y8 zuA_)W_;@5t7hwtbEId_|*`b66cK|~sGA^b7jyGppVSfyTc!>Ai+#3M3q;uvV z29LEP`RoSf#cnW4yet#m|b5ubfZ!1aK{>JPAsYFbK#APT1F96u$r zW=ehDx9;|y_iba*3=GE~RA$%2?hRyxVy zX_AHg=%ZOde(fjN&|o~!lOtw-o}##UmL~xLKz@gSer7&>O}aw>`fbVk^rVqepQ{3q z3o--0%7-~qEECn+D&(dhh_n=>ls++U-jvQ~NO{kzZLSj~i#ibo$9bQw^&DUu> zl453=m^(%QFlPDQNa{?Zurz_ANh`K^L zrv)BvuElstR+n7jHAgdPyAd$e0IbgnO)JX8&tu|XS%$dsaC#&T#Xw-e|F?5&5f(J{D{5~WR`EXBtH8QS)1}zw;R2*?1 zek~i)QXm6XHZ<1B>8crXli0KwIs{_Vs;C$i*GEm6(5>WgOYgAx=OilcQ`f~RWQu`Z zvaG&`8qiW&DaF`fk@#>Pp zxe9n=h4kG~@T&?79D75j=k+eLxL+alt?QrR>9h9x9f(bq20a}In`C4K`Ue`ip~N>7 z0w}}QEr?&oaoB04xSq#iCUg&<&WDxlheeP!i=r4}iJm=j9@ay}oNw0N@u0;{{Klss z7(w;+Dn+uM1pu7$o9!Bz^s8?j=lh|elXvq+Xx1YM*( zGsajDW>Wch>ji%J$j`7YXiFjKY|U7sTdO5q{RHz0z3XzGn}J9OtbQFZm#*?|1Ccn;L3%bx6noM zgJ&Y2Z`JX_m5>=B2{MuR6j{p##g^qp3alC!7-lf!rqhM+nnbY7G?39FrSmS*eP(If zUw5hE6otvZ3!~xs=?(jaz2WAouXFMu$4-9%r+D2_q-+@S0su1rZGL1 zE#>qqqn`E5SrupkkiYJ1ZyMs4=}Hlr&El1VNLQl2of|yP(lK{N%hI5wI$|A|!Oo%Z z^R(4foF<iTtx-f2j4vtyMCEty9pyUIP52v7c)M9BBs{EcAZ@A2GsZr9{+uc7AvPPZL$7o| z!=X{l;*@hHnv@5!r9zb+t{o2#p@Ggn*pMn}Yiq)H-9But#o)f2doIwW5o^Gj-<`8f zLaxj;Kgy)dAl)J(*|MJF>*LdYTVY(vl|;rrm(>dKQy)udzEX{Hh!;#{L`^L zuh8C_w>hSb(ypt0SUXoV4342_=nF;q+SH%?L9@;4DTC!u&DSMSX&y(|T7m27qORP{ z)$;M*t^bSSs^uhRs3OB(vV~?V+3hLY)?82my&*Na293$;nJ)q304wg|z&(xn-K7r} zL{^@me$+zHkdd=a*xU8s(+jSRLeLE)@(yO_R1kB{@A=*&X+h=o1BDVmu#>aq@km{A z?IXwG;auha0iB9JTmcE^sDdkmuX-)ilC3Qga@*)Ne-4v`gT-DKR@wS9948YjwF(Bo z%^w`ahJ)t;^exhC6M;q5&>}U{uoJd!xryc@8Y{oaA=}V_z3~K`%WxtQKc}jSmAT{J zJZzq0;U2iD?rySoAPq8IWZwTVylnwxcbe7A#uy5f%WwpAx*g4_7LtL?w z+!#Ekz4U`^7F&8xD7vDiM#D6+Y+9qxA*`mGu1QlhR8=RoL~)x^)A)hxnTza0-y1FpF!BxruL^`o=s1_Pi%9iCroh*}0L)mc50(BWOTgVnL&)6Oo93I(MO%Wk zJ@ZoF{=m2EaJhsOr!UJ1_22!#Ps&siZM}MaEhI)q+jN_lrt8wqceIL^%OHc`hb!Ro z2NFI}NdU8p4qztec)LSkxeQysYH~ONZP5z)K*N_klj^_cE;-3)Urudvfko8gR|RD0 zBRSM%(>j|u)Lbri6u4GAh3h=)e0zZ=i9-qmSY#`bBIzub;QR6cgX5~Wg8jX%Ws2#u zD4>P2bv;sDagpwN=zJluEW6DVk_vp1#&-R4Sbu{+TXUJpM#Lvl8fh)V;Q|+WM$nA+ zK9E{3g#Q>Z*IINrswD>c_=m7QDP)Xsfld*t^d{U$`7CKC33B^nKz#uJ?}7bEu=iETkhV~+r^FHbUwql)-SbM~J@Ki>V!VTd`WTRD}YEi674(P1a&jdI6E>2#g7*lw*R=5UTd>SWKlrL;6to~a9a|6Sb%(w?f#GKuf9BJ}g zO~+DJw@LT(VmGa14)3pj;Xj}n=38IDDSly~V8SpMn49+oEu+2fAh_CT+6$-T}G~H}AVMNrVokOF#m;Sn>SwWS zW(sl#sv$-E8caT3dMR37zd7$~Tw87~j#m<12Och8o}Ad4nwrOWQC%ce5wU`p#ovYHwj>Ch~Rs73V>ubJ2+Gar>Pc`)Tw*71NT zm$E>Ll_RR7v9E(PQoJ~q-iy?63gvyy_iqIP?N<;u9#6lUf9Ul21|y$I9slINwtvb2 zp5(gVRsQ3(Q@gx+69n2I+lZ$b2eFNf;gu!8V+BZT|5a_u&(#+6wMDB7AtF;149f>E zBIfn(Yjngp4i}p%W1Aynu&_u_jr%3WtMO%K%~GxfWUCASd=C~vA87okF@?`4x!aMp zf=~Qev8qJ{n~yg)B(acHP_LWT1yT3QtM=QtZ`R`~4Fzl>c#BgYdX$a!R&JNcv{wD2 zPX{fA8sSxA9-`>7t-#r(P|Cu&jlI6E2invgx-7JsToQ#cJgg$kNvvg&9vEDvkbKc5}orBl_SR}*5#JZuW2?6tu6y+eC zRO3e>ISrnJYW1!Lcb{y1P(I@%NsDnIz9PaNp4gA`8YA0IUSLW=QK#miWlAT` znwjMXF1w;G`~CUJ&4wy)T&I^?DVRu|lntcfXSPjHf5n74DmMgiqbbP(edFYl*mY>gd4H$Ad&8C3CER4Tdk(ql8gW@9^S3-89b zh!HOJGN3pfs0kKwpP1BXH+G}@w?)UaTy_M-qDF+Y7r!i0OIYbLu0Bptw~G&=MG}yy z7T*G@8Kg4rUdqTzF>9*-Rk}rOf0OrFb9>MLRQB?0?tXuBULDUeJ2ozXM3q25+}oAD zpJsDj*!>>?5-s#gi>22-i-;eheJ!95C3t$8mje|(=WS$arw@P@)Z6iu=8O+X-fQ(Z z;&HTWP$;^yn*z|%;}^S2;oEVn;c`?$e)ct>gq!d<2h>lD0Gl>ueCxI_ z5RaXB6m|YS@SwS?CXpXaFh%qGe)X$7G={16;~q4QAF~DOs&tV-EN_IuH08 zM5QD;KE#mDSLdqncV2(Kz2{Qg+RQ*u&)dPJA4@=7c49fgGWB=wnRSU%e1iK>GZy)_dC7l*@-3Ii>AI-)Hm@eLjLDm!r#JIzS8$w zZfTncXpGTxMCmrO0xN1(qw=c`A?#xmR?fCmr@upg;ft9ZzmBS@WB#1{r}FWy?B~Syw#qsXWC7x}Ue4BD6@6 zLr}fIvTA9HT0)*F4j8*YMF#&lV~RdPqtIons~>P&)Kr!#4Bow|fRP0z5%lv*fr`mh zvC1nFEb35sFRr*DgLVW|x8ID^_RoPc`{YpF-m%kk#I~w_im}4EyHgU44U~6sb*{JG z=`Q__Afc+#W~#vtcK}nptbF39O|hB1^Hi+%U4s-ueS{QdQ&-pbrcf@r$=lvzCyhpq zQasb|NDlu1#38e2_XXU+=#feSJVAwGQ zNMF0&m1~oA0|vi!t8*Hpuqw)83h?#}kM?kH?_~zJRzBfy8_jlc+dF8G9E`onLp5Oy zUA!4DClkmtFb;q^Jp6Hc9~5M~IV1(g(?hJ!T3TW4Sd2pLwz=fOHC-;UjFvc?%AEeI(Z{HC$^FV180g|VQ(}zdQXd;@L%=0Y$m`>QqnK%vN@7UZ>1xt^ z)N?9sNi25lZQyZx_&3h*i(O^kcs<%pSkP@`6__RBi~+aO$J5KBm5|p4;dXIe(aM)? za_N10cTpl_l?^#-#V8uR4jx5BO*O9QaK_^0K_4gV#M_nfT?P#SVVTb;`$=Rb2h5Uq zgEYV}fUTJ^&VW3wLS8_lwz?xzg(x_y6aolBgX18yfrOfN8yw?_d%X8;NM!gb^76RJx9l!)%%Mt$bF1Xnb)r&Svtoe(3`xS zn_A%)*>tz6>pU-E#$B<;Q=c5*1{JYSJ!eQH3}kgSWq3aRLFXoA8m|-9+~!7$a?Qru zeT4bg2roL>okAl}A7Q;bdIf0OFU`9bxhc>M=WJ}zV(Z-J=?m~^D#XT-N zu2wYK#<57xc>`D!lIRt;K2v ze7P@WINfboTlOq45zTFuZ0$2rYDM<{hpc?t3haMC#C+ zpbsGy^0-V?$J}b$m8CHPysb(rx*7)Oj|y|t^v2Gn%)f=<*igb^k#So+txBSnbHL67 z+N4Ev&38bYH^FdofblM^&nXYp?mA0}ayFAwZe-j=H#= zeSy#2y}82b*OR&jin2YMN*@X>$cN+`9XmVZGKw*}5laP|)P*vh<6Z30=Ys)!}x{jB?Rw+>=R z8kQzqYRRn0#h1~9r?)6gtw41QS0SST{7(~S>m#Zv(CgzYIsv6dpPOI2x3?Q%}9}60ze8TKY9x%iE;VK=I*2MU^P#R?@R)2<|<$J`W^r-erBw9Z?sqR*E%12 zqh1ma@*3UgDaS=+5ba2p*hi)L)?#lHfSV`0oE)IzKCPxD6|%zr0ZV?Yw_K!XmH&F@-bec7dg|=Jn_e^TWMv}i-O5{ydNt9YC9~BzHCPEDV-L< zn%@q%p4ue@S&My!L3WZkz`Pu#+aIw%q|CR=9(5lECC)}UR3J4dPN_lZabmc+VrDU~ zxz!+(HACt`o)Sqg{ z&#UdARPoypft^(2B3=I5dD`c+_7x~M&(tTw&wum`-ULu7!u0%ljY5BBsT1PooGZ4` z<+b@;>u**T0|1ePtY6kQWaE06CaPMNClSy|TQX#mOX<>G{H?it*l@--H8&l2mH+Lk zRAbTZcO5oh#e)ra>-RZdw*z?wK2c;zZq6-ac+p=#pmQk%C8Ci%tid0Nm&d_>>1Imb zLX-=}$jhnLQ|~zE>PW}xChNhrA`-Q}dTJ&Cea%T)@-5ZgLrt!h)l#bLV0SUoD`Re5 zT>iGTAETz&$KUetzFYNLc1k3Svg=|QPZYD$ge&b= zpg+wBY!3kNI>0Xq2Ml_$GQlm6fkB+E`t&Z0?6qc^I*$Ma_jOx?w8YNf76RH(0@Kr_ z2-j1e%O(>OJATd^@kt_wT|lX z0R?M%`sf-b4I8?BylF9qt>`nXZ^1KG8N!Vuazy1q19)8WrLdNpABvSgIVw z`iKmZP%M~o=mMn!-yW8t_kiM#ZgRWS$iq1@MYKi1m&uKCuOOg<>unj<0X(gw>-YUu z`1DX-r`az1Ge&=>O?4&#Z%1DzV;iQ@n!_Epd25Ysww_9Z{!gADz0vB&gYR{~hZGsG z*Q#_hjec=B7q=QvFyl$!i$Ev;T|U6TL_e#b-{9r*!zcVH=)!?utL&U^SoeUr)NmNR zB^f&*`W5$-vDF36NAcN=Ih%wXbSoerMHx^4LyVwcpw#B5-Ok>W8^AbNUZD`>l#r04E2bMMP_$5GZgHdcW)9Q?J_ooB?rUF{`ziUK*yMZ{Uc=KFa$1YN-*y1pgaO#EF&!tqly_GB5h`|iO4N}z)<-@ zl;W<>ji~=M*XiA%v}b1T4v}^BcbuQ!xD@;)+*S+`a@iO44JCh+HKGpmyT-vJyxKE> zMUE@OpZh-c+3RDj7vDDmQasW*l}=9s{~=v%x{pS;_6tY;vi?1P_6{C{AirYq7gM0? zHs_#iv~S>UR`ym-wB#juZ}&4;f`Np^R-evRxfvC<;(O$tH~G?84D$zPUEO5bqB4pc z?<@XjcHsQ>ok2h*il*v6<{XfG7l9f9PWwvs#^OL<5gh)8t2t3IT|i@P<^!|QWhWP2 zxsYQ-(m6|UrKwH1!j>;$yoEvkonK!e7MX$E`6h24C7I}m)N2g*kIBY`WPhko7%WhQ zn?7^uZwn%HFA#pVw)K4gaKC4*EL4L;ou9?5c@1J8*2*FFd)EGkd~0Dg)=R?jjg-_P z()H(@wiB;-AlR1W)-~e%SW+I_KMRuc%$8z2gECegOa8(zFpwl{9=3*+Z5Em&&N(8w z?Zv!RO{Fd~^;*&XS|aM+uyir?73kYr?AYaK^O|ck7yeunk4nT87JYm>^XG)2QSWii ztGCtk9m+6oe-`a_=f^1-D%=DYMVl$Kku~!wsqs}S=P727W9S=YXa>UO0c?ITS(9%h z687P1I~bEAHYIERusaT+caA=ja?hvp6wJdl=ZSlx@x)G^6Vas2YZp>y6~NS?ix@HX zZ+B<90$=qzq;ZwUrn_Egmd$sQc{LI8GJIL{_rtE(1m1?ra}1W51wBiknZJTX{Hz1{ z_2P@>iQ1#WS@@Q-7HWgtt!*Ih`BSCC?H=5kT;#Lv?<5}nr8V!$*)|b|BVAh}7MT0B zK%5)6R_}qmlR`rLx%@uVZJETD=WU+90}D4>ALv-^p7zCWX7k)C>iwA2%WieO|IC=U zy8DPNPhVs5qE=7(e|NQwMB1;EK%@Ve!R|9Iw;#U@KaZNSPpD2T;A-2kh=ZZ({3}sE zl2WJtjBUZLM(r{Pz)lPJ*p)6l*8jEt8p`=TK8XC^$Tn>%Cl z@h^-f{ZRavYQ5$1>Ga`NHss*j&^Tr=Z`}fpATla36M~IuX{F%Q#(9vvIV_Zw38$t3 zik_46=#-sz^=7>%!b$q0k()~2PL&-`Tkf|~C<*=OfEvL}mNkRUH<~W{*3}Vt)hG?4 zj4W zf_~{~!HNhd!A53?)3D3D!xk?GjI5ny;7AQF(LGIge+#5PlK|n{YV{ zYV+yvl;tV0kjJ;-SzJ+WeP3unq;48kA{Az6_S1+IH^$J|`LF0Z_Qi^@Eu?$o1VACN zG}{>|I+cWjB1$Lx)@nT3Sp#aV>v&ioM`0vRI?7`h07yD&WkiMVl|hdEbacZ<{2TX! zCeB2_oW+vH3n8=+v9hkkVpHIyy+a;6H$>l@z^D@h?fz>LvPf8Z> zxoR=N$m^H2;NGVyZpQsXI{hykBnG`2s=s#6cp0dM8)DWIv6BWDkvQfTNZyj1sp(ms zPQysxzShS@f8%&5a=z79ggq!u5p1o&wD2T4xIAM@smu-bM2pG?VuC-g8j3F~`qMK2 zk9v`K#?r;b2gS+GeDd!AlgxEV?RGf@quy>Pl8olN6R7w|M3m0x1pjNSYch#3t4xaX zn8sL4&Gy@APXmWSS)S9&g9j~KGmfpE$`6yj`)}t7qZ3`%x4dCfDSlDMIf2tl2jw_$ zRk-127@Mtb&FQvL?efPdpOOgprM)lbLmSw#B6sf5hU(db-&0~$*BJMib!*{oOd85C zOLS+JzlKkC%i?BI+vrsnc1$Hy5S=9BxB7&Sxnr^@S0S;gONYJ6C-Zc*j<~-mgLEz_ z3z@!yIxajL+th))pw=Rrvl^6KPp_@s!Co|GWstA(yT@lpiJmd(=u#ci>6wiEM(tmY zCs%j|h{}V&7#g-SZV#i1wh~ePv3Ph}McwZ|%`?mV8}x*qF?42V;ZCzf>qw3y-u9HJ z&Zo?8ujV>A0fvvSlj6^pVT%wiz`BK|+Z4CteZ}fkc?n+h#iDTVEV3L0B&fa#TCU^B z`LmrJu9-Y(X~)mll`=ovTk6xA`;&;!qAH1t$CpLx#;mlB7wVTRr^Zrh9KG7Ta@W^e zO$G(Wf0<}#`;&hKBQN|v;*(rfmKx%7&J06}N4 z@Qqsj!=!vvqsxoB9#hi8@BsORspk1byXk{VM77R3)}i669qdEy!Yr#TBkZB9-u8e?$#)4?g+Sy(?dWC8`nITCBf z!47Ly9eA8_VC*C4A5Xg68c1F*B8yS z4RDHh?ZI%I&`Y~dP~iPJHEW?0YI!9cb){iz?vz85B4S;=I92rqp87ugBbh0WsU7g4#K zh(_PI`MmQOiW7YF3BZ|PJ=@EL@BeDd@RQg;;93Kxqb!`Xak}^qO$CLTk>m1;Ujy^K zphwcUpCIiW*%P=8YH2vH(bDhI`}PJ72P=fOEioV7ZqBdux{;vBlD;sB&Bd!#GpJW#FjS)YMZF(%Fcdf;{Ka6X58nG5ds*@=Xj|m?eun>JXNz%00 z(c0?!umV6ov|2iZ5FKiUY@9t0L8WsYOI}k~M)vWMKe_Budy|?5>tJ>=mQMF*)hqQF zM+TWWLS&jK%`K?u7>|E9iEd!p7^C2rh~y}Md(xHb&z@?exeTRC%t$AC0kPLqlX_9% zlQ1x)*Y!&!@hq3d42+fW7n>%B_-T+nInXcwfsUshU`o!~Tm80q~ z9%QW*tsb+9Y3CdgcQFKRw9eX@X{Is^#`Y2!dd}_i+}UZq8S*vwr#;=prC%%y1HIg~ zh%3ym)GJ0;b+k$h3r8TD$?yCJ?ougv8bhKgL5EJj*ryj`ACPC$plR%A($djvl6pE{ zb9Xb|c28+96-S-$MIb+l2t3-qJeVY2sT{Ub^;BO@97?ZrcljW`| zC;!{dT{6IrXHH|7gjjT8dyb3LQ;OF#oP@#i&xMm!`kX!?tKZ@BTBBwajGMalv?)qH zpA#0QwbJd{4|6x~D|j+pV4z`sVYO6dTC%>^^_ED_(u zLl4i&)B1)RsC$G6(77?{gn!*0zOO%#Vn-l8=%Gr`DlC+B2o~MVC{VVK{s2au1Y>J5 zp-aP0a5<^xlvB(wYnoO#edkqc$x+xYudM&e@b)c2M6N<^B<#1bU-EL*nT;)d{BpcL zvK2F-;*hWN+1@Y@ew;$d$->U5*ei-hDMv$}D^Mo?cC`|FBF#?Yjpr-`UM>*?cd1KR z%9+mG#5Uruc6AkWK8=!|GYRm>EW(T+eO0#xcz#U zQB6X;`*01Nv{(_p%h!4D4^6?@;3zn@EP++m>4B3?{_}^6RkT?MP_}`r603rN_N_nR zha6McC5_>6IXVEP;IDM{mtP*PsMjt8S_IngHaVh161h-U9and4QXFb>5PO{aIwYj^ zvhmkmTc?7aY-OT8djV5hR}$L(hH{WXetlhP9Hp~1!GCi3 zq-8mB*|x6vESlx?F(WY8Vm7^cgr0MMHg zy}_CX1`m%w$10={2Iq)u!P zKDXZ9f=vQ%^B2As+E+-?J@3bXLP18_ENJ+BMspfH^0iP$- zMC6S2Y;v?K9sl=7hGV7SkrSKcle9Bjf26Bx{>vgUBqRUH zmXeo1`@dI74NY{||7VpTtnK``t1d|PZxYR-5HUISU}x)d1JUPOS(-P*g)i5$C5I}W z@O*Yi8uo@es*%DcEC*(kW!sQQ| z65wb(xiRc&8~~ywKaP%Z&tF3GyI%jq5`uS+Dw#XXj{!3QSFx^Bgtofk-?g=|t=%!~tGtw2 zz`MbK^6!7R`vCD3lK11TmhHwW1}$j*S3?=^|MMaIm$PZ-VS}F|O}Caf1?(C;c_b}| zZu`u$=jh4|uT0_g(^3~AzkI8bZqlWYj%lAK(XI`axck>6HRhpcpx`L_`Hdybb|#Em z7XpU`o@RbcrF!Y!<%EZqq6`=h1LHtM$>LK3o(g#qKEFnl!r3%Hcn$%2dLjW;l?tN% zJ8NsF%>Ps+91d;2FR0w7GB)S?JEu{m;E~~%?86YykAHvvcyE#j5fbo_iM&5-JsTQw`l=I8 zK_+u!RkoIG zGLPhOB6i~7WfXlp;G&cVrdb5q10(&wWG*v0B9^K2=uLR-u_UKn7cLiWue`T+45d2# zEX`&FM>Q46M5Jp9biEq_Ukf{T$H{Ca$ETf2n+ zn8nC$N~&LlZjThDXlSx5c910Gobo#y=e(r$VspS`;C3i2z7M4<52StAiy@>v_q(>sRiZh7|klNONrDLw;M-@1Oe$m=p@T5w6=C8 z#cTcJ9EBV&8Q3YpS0F$(t4uQ>hnh(SkYqoTX#ma^c9fmp=|4=Zk^b=um}kDkw}P{9 zk)lnHTvJ2kIxDNyfe6$<%wp0Yfo=vZ)giCs5Bn53^F$4=YhYGp>VYCrWfJy|b@aNY z1gm{~fS{*+jfN5Aj{7AW_5XBr?(t0Tk00+soJ7by%$;FmikRDSzciU!ibQk2Wo{{w zdnt3j%`MkV=pZzeioz`9QbwYcxkPA{%&qTx`ku%4{C@BM_t<0mJU;Ks>-~DZUQX5c z_$38No6nV!iP%XT4a=~pm|+H$BW(|uIoaTNaRRae-O5WBDwm7y?x5@K2ehJW*8*|_r5Xpw8N7nT59!L4^9y!4xjRgQBlz`@heSgcmDq%sIuP0ReXUh`nOt4H-55x8lpfGVF-AKVcTWNxiXImL62R zHlzD1gyiu%ALdG=84_3e-vTR$X~(r6Lhr9a?y`DTpENM}UluLdON7l0 zb#-;i0j-Pq*@_G83xro#hW=dduhA(G`VAlV@@mL?;CEK=!N?UwWE8jp+M<(QeOYsM zYHC1n6`oTBmwqRi{hn6wuOM<^a^hgm)`l2kx+tvGQ%>{faJt(}nJY5)bbO=kb;E!x-T}-|zpW2M!vbMEm&Jwz8t4{%nmc;79fYyh{3n`vDA(z8 zssZwOVos8V7WCI&S3jD7U7@bd@E^>GWlVp>dou|kj^le{ZJ2-j2M`Vda<@#9Xf5C>sD;4s*xc6Oik3sB{*I6ML?S0ZxgVuoV?IRBy(;SWDJe>r9 zfq)gK!+e2l5$oQOshOGDP?A@lk|7-n_W+J6f4lN7K9P}&k2=rETvw+Vdo${zPH$7A z=jC3e&U5Ga^BZu{vnsGpKF6(MJWoZw?EK=sxHNvPr6=%Vi+w7+9uRB5VVvJe(K z@R)&$e)}m4defx@Icu2v-EiWO-;Nr;qIB#PKxVM{x5UWMXrxTF9oddj54?!`z`U8i3@z=Oh z_B`58aC;HrvzJAxqatzc7>s`px-(Fvv!_nf$k?#fv6`p!3Mc>U`l=SZqEf!u82JCw zf3~E;-3>adgwPj*@7D%p0-I5+cV#b4Yok z=NHI3B9=*JwYenMPaJobQ7CzMQFA%AtmQ4KfkKf8Qm)Asm9^C@p`wa+fB^{5zlwL3 zT(;lrgZ7c{5EnX)@T0!vhZK4ddW_9Ogi7nl z|9d70#g0K5lS8O5OU*^qZNfJ3wd;B5>6ptUAe+aSK9H#hjGRb1c|?xHU~^QE?92Fh zqF;lS;O-e_Uom?8A?4wCL&fdXNg2h&bx!kOe8nNebM9=xX4cYQl8wk_bkSh$rqz3F zsaf5p6FQQs!^cmF>^$H6IK>n9_bG3=Ln?M~Tg4UMB4%&k>CFH%@Avt~i~h(T6JHLD zoXrTNT$&R;5_E4x?X`eeX+$r3Ve951AR2*`N&>Mxx9Me+P?ykp+gcsUaKE_t!hi8| zu!W0-Jw4(L*|~Gas_??6Psd)C>b9N%98WCFe<}za!=QP|^+n*sVGQC#6!fS!x*FSa zpWMI9Gty@jf?+$PxZs9|om@}f&!*IO&?<1**EHdz;Y~5;UIQZui($N^Z8FiPD$$RU z=-I7dB&f~CPPcoSzF|^hUhCW)xP>@*5Cw11h%}2$oa;}_VTM5UMXVGmjd@T0UY&F= zXl|dlDR6NkEv9Gb*coukR}R)LhWxlTspPe#r1F^drBAFNX|IJm@QldXgm;w|ZQqQO7OgN<2LLn0s6h7W2jRR3az zOHq)i#J&aze^g|Sva$`l^+dtHW&by||LSPSaEtgARpm4{? z!N0c6r~J+#JyUL z;?9vaRC{@iOWx8otn(~`zS9L<4;9h16*0&LB3m3(E&P^joTDfuzsk|pR)|9;a$vd1 z4lg_)3V*D)`hqSJdC8_qS5=ji;kNx9)05)<{!7e@GSMF=-*H{__oZeX?WgAn=90jD zc?L+K@bIfl$?h$4OJQx_Z1gu5!R}?_r>w5;3f$T1bhs#9~4|)0>>ywh>Wyky|93ch!ZfnfBt%I|vwuy-!=D|Yn z^yAaw?K^c8Rd6btdI_p?b7Gz}q8oIBpV(#7UX_H4f!J(d?Kd%`YNNrDF=;Q6rpt}@ zA)VFi(uU~SzraHD5)RrRKX*FmpyDx~9f4ry9Kb-}91 z`y%#?L?}}Z)P4JF8z{#|15!U*Zy`0hs;Bc6Jz$6Z%JUDtcf;H&V$2-|&F41T*wUrv zJM`3_^k?LVX4sE09UWH(fB(!SGq>aL+zzFvh~ZYT?Fq z0YGPYGq0C49;pefh*w3T-sdOV%dMaTgBd%lGPNd%UlZK|S{`j>Yk}iQR}p3SkmUBX_0{Bm&wu;GFe}4%1M2s)qgC*61hjgA zmE!mw(hRx)u@8Hzi8T2aeGpb^s{V8M3Fq2OXO~G|5UNxrPfW`~Mc?-!sCXk`sb$L? zyY%Om9HExM?fI;LdVfHBK>j(-kDYZy%vx(_X0W7ta}C4nlOZ|Qa$Qg5mreVNiCz5B zC9jJ=K1Gb

6l{oK;;Pe>IHs3eMr1^%!4x+fgU~wJgMyiY!9ovTs*ktR1zI%d*fgfD`RzaW|aH{oxUD zTek;I-@(5bM~BA|Rj1o5d?fwy_VLclOh|7?Riy*h&b~iem}4h$31W7a#ZM0oy~Q!I za2T1rGWhsV%ePchS{CW@%B@YC5U=IS#-;Kh@>d`^9I@|`12#}uLXZ9`4>ZmY`v1T3 zV14~CerRItg>~AVA>30CuWIHf=klv!J_WJRKAvZ$xph8;d5T(>1Hxw7F^oZpvWufC z=>3@FnqJguZQ+s-Vni4pO}CQE@xOt=5?+h#B^r%mmRT5M=Na>)*ksc`V$;0g7Ij>f zKHI72)Iqoa=w#DTT^^vA$7*a8Zk|LBwj= zcrLO+@Vfqw(O@wc+U0Z5Vm0%-OIby2gOeTzaQN;x*88Q_#Hqbw3dPwFh_R=$>8XA_x(Miao*m|63t{`jb=9?YjT22_4eFl(i0x=tH$;rQ8CMEaC3q-Z0 zr1|6u&h>uGbS5Z}(;kDAPo_#I&3T1)CWDLl)OQEPlgBhc=QhwPn1hnb-DcuF{e4HG zE$SB^p^lKI3pR5>^d%!R^ LMj17nx)}E#@0z>U literal 36516 zcmagFV{~T0)-@WZW81dvPRF+GJh9WUZQHi3j%}l3v-8BhIp=-9A9sxJjyuQLs2{cW zu3EEdty;Bbgrd9z0xT{p2nYy*l%%LK2nZPK_kGU~sPA({OPbI31=Lwt;ulEm4F1`7 z0m4F9P8bBFAr9`{2=coO;~=T!3<82U^q&JXg$@x91SFP6N>o_&xBgWQv_HAn^61X- zZ?CR2XZbBhi5cO-!)z4MVfsSfNEE5UaN}Q~7#PBk5ERlgJSPr3C-rBXCpRDZay$1^ zGd8^;e`|#9%y8h%A^H(=sbDg|Gws#WPO4B z=JI0iznHf`IUu{6S$F^*X2~4slwA?=pha0=rAPr>i;6uY43Xl3Emw|{GjeGquDQvb zN>A!Li{|Lyc%m>HnSI8?-&QVL>w!+1M96dS z-Jn@^qNQ-rF|Hofl zx3;5$MYeNab4c?<4Il*!bN2J48|O`e*Qa-)P|ESAr_;aoJUAYvzk5mKF;AcRAhNNz zg2F6ozXnbX)zooi%XXhwN-uW}xCOelpNh)OYyNWp zXX7BSsaftwC+lX~r8Q;-VQnC@DCmdKZV^I}A)M2~gXHpn^k2-GS?QJum7O(wn)KS? zn>jaZ$O)(Wyc~Y9PnT=iml30bBaJeJG@nv*?0^h5PJ_pEen~p1%F+_C$_uEe4n7UrQ;+Wfc+%UT|0oiS^>(X(r^-me9q23ui4rwIXaX zO*P?WW*wrjMIO#D%_a~L@vU#n*w3aHfCsP>@E4C$nPXbLy8Nq;nR2ON__pleDBae; zAH~TupUh6Q*+*FDD8IWVy&U>EgH|c(IR`s)D^tb#j|-|Hay|h)yN?0H6(paJx!cx2 zr#Pt><*Fc1sEtL5LoI8n>68{Zr{UYA!$LC3iKT=MB3o+_A`afPSV0-nv73=&^p3|V z93Y=St&l}3YJ`^4-*vX5bCt4ji$?+mlc+{A(^9Y5$U;}_sL9X8DAScw{ue{Nl=q_! zSErlJEHe?0oM`N1k~Bgtsots-a)Ss=03`#Uf^id&PDq#|v3g!90%Trpke0CPlET#;VXsL@+6Ui0}h zehQV40HE^y^AZOr@mi?hIF(GNkZmOs0e8ph;s7Unv)xn}j*z7AfWQDOQHY-Zq}0MK#mh2P5$icLvpD_fm96WsV0x8B{CO?Efr2;ppq{l&cnX#P@Pas+yW2}m zHJ|)#@oB}0%G}B<(#Wb@qAn5P-rcH2=vk+ETvwM$qHPqL&8JGYjGn>DKMHH*70~{a zr*65Yqt^e+*v{9ehkjkxmi(mU2t!$SIlq{$+%3I-@Mg_JagUzq)nWMV`Sj;U!8JrA z{6DUV%jUmflSr|d#EUL2tp(lspKqbo8hEWMletN7Q~TUj4r{LsKKNiw97SxaOu4j7nh#ansz>}L0b>U<`-!zsmnMKv=uh-Tqh8*k&4(eO2;RqTgb+k(3v!~bg7WK+oV2$TiPA_ev?OIJG~TitxJ_) zvPlXzeA+N#i>s@za$*8rBs51cP%g9Lff`dNR%K+0Q`#FtvJk<*xZN#u_)v zuA(lUX-j6HvO}&R)UDg=aOYiNoxk7iwMnX8oYYP%T+Gl5ib|O~fZx_t#r8lISH~q> zhI~kMrcliPyb0uVLQr9OiQ<15*on9%Q6L?*C3n;LJbn570@Cj@Mj@lHBic;p#)-e= z!Fj?sVFtT$BqgGfBp2puRj0Ia>H9T=`?4T(Jb6_K|MmFJ`*JRXH754$Od>O($S{l? zgl-{@By&~7BY+zdg39LCf*KaM_j58V`T8nplg77t&@A;Do3#tl z3+Zi!q`Nk@H!AH2s5LGwP7$#&l!yuXO?r2n_a7%8RYNFjD?fy&^=WzWUD-buqW#v#ROPER~=5gjm5KTR{1e=WoKrAMs zIJOcr0a=Bse{fWnPEJ1mD7DzV zqqW$*IRwVmgg8B^T37~%BcBG!`-PppBm^}!FYr0Bnwa+XUJz$UcAWZklQs4W_&5H6 zhHXr*jB&C^$>Vd2k9E`K?`H%1$CcWd0IAhD84R}WIzZgCM1nW8&XrL8*o?4^vk;}c z;U!(5>vAaivV6u?T)5&&oqjdDZQVTn`FP6#9D~*&H`s(dAwlH9so*s%PxyL!Le+LCSP$^sS%X+|@O?$nx!ZK_7M zM$s?R3vDvE$tP!ytg^DX$#q6B%{T8n9*M6?%mI2u2vD#q+iC{|jB@yyMYipV=74v! zd;ROOm_oXAaX$AOC8q}(m7_U=P;8z`!1L)jbPhxg$wM-4SJ`<9&7ku%>F~?5%k3w( zE27$qRuRx_Rw~FWv6rdw&=vd8TE#h%$N!qA;-?#amOVJ*OxOX1EZ%{8rC?TLM&V0J zt?lN$qGYN=>Pj4dj6Fs>HXs&kD=#t8s?#mFwcmd#o^daL3V4H1=Q@34x@~%B6bn<34m!?SqsgZYG?H}yY!>^i) z(P=zNzd3HCEP)|lNb^1%xFzmHSGB^#ikph^GBMYgA;=sN1~o~MeG$X{C$pzRYLBzJ zXJ^V@ZKY692=S0k$&v6!sm~RA?a!NWrx$d90sa``GJj_2i*y$Wf{AKur#vn(Ie${` zj~wjQ5z&H#;8%BGtNI&ewd~z}2iv{=D?c#V0&KzoSZ|Z%`8m~VVwyZ6_Yt(@f)ufk zh7U-iAvIdp)TWtSO`8yOrWBnS+8>8383D2*k^K;=wiuu$1A>&uK=PPxEAo8#vp9`a zlbWPG_4bHKm~)8p1Di>SYF4@EzUXL?2z8n)x_6mJB?Zoe@zIR93?r2uHnCfE<#WCsz6&8 za8ABIaB!l^u1de2`G`+oA!1kUp^wis&ub|+RHWP2Rw{O|J70bz(@yFbY#Ro{4>-?F zk*Yj;2PbvNB(tWJ>eEeoyv43O5!B2QS`nVS$>LN`Q0eGvtJ|fpQBcU4W!11GT?d(C z-~u$eE5yHjl#X_JQ3D2tBR6p*2Li9v^28ZXH?EzTI3{AhxZ2W%>W1}~VAqZ%k9k?a zv7-3K(+bKbGKH&sb$PRk(hETK>uDUOv9I(a0@Ca_`thtsVuFfYA$~{a?j_+#hTd)> zku`+g_bnVoxm?s-%`wMYVzBIzb0C}lY302j$W!~E(D|1KF#EjIykmFQ(P^f)=#crU zSaK26GyW11ud?P-)S&Fai^oM!)>ly>ZWEw+s5@(<=2+8R{;;Jbx}kt%8?hj=rv~u7 zi}NpD|Q+vuIn!Kx6u+(=hzmE0%TwgOa+TCP>P#;2B?NU(^X zb& z7Q@+{w-VMNEx)tKDR}~)kyAweAu%euFvC83zC*5-o=h^U+1l~#@*94geLc62E9?KY z6tv2;xvEy}u!4S_9vq#d>57d9XJ=TFC>=q}Rw9>}Ca|)F^%3uGZV_m9F8fsSy{WBe z<~4O4+Fou{L7CokNIyyFJB7C9LivkM>tix{W)dd z*c8;3w{G@cNvYaa6yENrtQC9A(kC_$ujXMh@{sCQcCchKdq>13xK?KHddvs z50A<>T67n^gxVFe1v5{r0N-Y)My*d$3y$7?CTCL;{UYpO+?zeii84s`gw%6z>HmH7qjacVwh+JUT zLd2bS8Pyd0B`&Ko@lf!bds~8*MDb`#LM+``_U`#N*WlE6jPUYtJOR7j+_L>jQR>x~ zZ+l7Ya}v~iy@;ih7e$AsdZUrmTLG|4-pS<{oFF2Y1Thjy;gh}KG|l@2kD7?dTknUO zxUnQu5kLJsk>QoAr(0S)`EaAV_;rLTw=>>_kT!S*r?#VP5&kwzaimR@j^W>2tl4o@ z_(A0A8jW~*Mm72Thy5c#+O=2+HVmM`7c<)iXk_M0Rvn8(FstE~{tgX;I6kjH(M@_< zEzuupGgL=>TyZEzNM&|+dRKMV zyHq7x?akokSm#hi0&|uzR)pb~T@sERHxiWhc9z9M%mPOq`d_8-hFNh9ha5Mn@M`vy z5=hK6QNc)q0;?3kTo*0e=b-o`w^!dhb~I9LTjnWau+2ZtflgjTxl$!w)~+SJGOe-Z zKv|Tjm7OD<^Wtu(yzEq4X(lBzVI#K8K=ka+P06k=?CC6p8A2-p8RTOfEb8i#4aa(` zVYM+!ZKLWlbso@rLD|2UUw*M;Jgkcy0V9te zf(x`bHw2~mhP+7fXlJSI+i8u^y?Qyv(A?+ce>;S3eH>#pA zqr!d@I?1eNY+tiQtMP6hl0cfwU~A_`aiOX5P5+^DjBo!)lv@&l9FeAiza(tx>$H!q za?XE2vy4<%1vcWu>M9zm#j}#OjI;OCBA*>;$EZAI6`p|$oiiw2LXf&O)-7?x(R)LG zfm7lgnOI$R-cCzc46kHSPe(M_6-T0-Czf5M zcb-)J%W%dndDu`1;Q>r+pp-Ub)&lxF3re5@2d zp!)Q);oWO#=5ki{27B+}J$!D^;w>pNvWTI9sSuo!+{2q%^?XM+oRLFDP@vsJN0avl zRIdILq^SGjOPtPcRau7%UTKr+(ng8z${&(2JeNqq7nHwa z-yj<$x6`8#ykuERgP&Q!e{LE1;~qb|O9KpEi>MQ5Ryoz|A6Viz?<;UtC=C|hz8)5! zw8}e^1(P^gH5X;SB=f{Gw!iEm5*uLg##E^0IHs)r>7LVrC!Ov#e7sZD2zP|c2Z@%B zV`quH!JJ#BPmQUEx}R1TIQ5g59R0WoR%D&EwD5ZnscQB=^WG|tpCUG){^vh7*D&}9 z*sbrFrM51;^K%?mr+_%xtR{h`t-`M&4;=VB8mu~eEnBf9qf0L4L1-pTR;JA6BsLBu3bg>bSUNAn(x>Ws_bhE)T_s~BS8&DF^5=2(w}J#eUfV#r zN;QjJZ8h5qQnN6dA3T}huSLz|G(c)<%!bsQIU0?jPjQAh4kXKm*ry_m6q_{dk3|}0 zTyKk%V?XknK{Mzbajot`@(cI4I`t#1lE@1AT#b^*g@FDznyIC3`W5a)8&SV}LFdC= zdh2(gZtIG~yy?nh+Lr3cD*|!aqMbqln4*}aWOkgyJi8+AsmbiO83LJ0kNCXrg+49} z9w)WPWcdPbKE4kVI_ur}PPb2ln{P{|#sl!*8-?`mwn#*Hy@|FS@r!rIQ}1-|zrCX7 zRU@-(No4_@;e}f!P6f2J3FeSSIH%5)<+XmEF^N_u)KS04kxu_uO2~r$B*nC?Y~(!# zQb`*J8ldY1#SS3ms#&^vM5K;$*&C48m7|uvEA1D9iVaQlV5O;Jla%D{NsR<3sB_OjAl5wvx#veD;wgOdWt0 z{=%O`HRRdzThmN-^`N3!u01Viyl|y0*S^+G2&ku)b2R?)>Fmv?ews3Xs5eUiGxA=k zO_bE}a#AQpf5L%#c|PMa+qu{|xpycd-dp!o)itkSG@LgLzf;wE)sK%7*G4Cqm}Bc0 z*IxL;)AoAao<2l4?MQ@R%^FCl=g^f~DlGJ@ckmlq7GTJcQxpQP%2Cr>Tq|JntGidJ zcI90s-{Yb3Tyz7>BZ`7fY;j0qv%$Y03XtaB(=onZd|>7PB|Px@*6dcU>Bv!KmN){J zP=MH7I~4U4@~-@uOaTEu3HEYR+L&2G7OX3xSnK<{WGmlw;XEc0hu%YT(z0pNMKM%9 z?2uU?h~llcE%HbsuBO?uQyhlDlT(*colC7wvCM<(90n6*6GH|Pv)jZqUq*-chDpizel~4&Qb1d1UZb5qyW>Q15n#}1R#4g}J1*72FW9Gf z;gVDWXhijc0xaoFzz9S>1ouB7UF%z2g@J+uslO72!#B|)w<; z#Tw)Zx)&|I^-;;p9au|txNty)_f`^5jEh74Ip(9P?62(SD^;Oh3xCpFLcoa;1eQOj z(^|6Pt#=BaLFnP97lJ{K;9A?bV6JxPLam8eKJ~o}TtEbui58I0!{BEEIcZRb*kz45 z4__CNqY*5Q9AnW;CSPDM4}@GyIfIfPKLmHKj4sFV_;@c!aXRyvv^{iQLlgrZm{5(U zr6eb`-2y<0vFPR=6l#{=QpYi#m=u1$Kj)gY9xhLf(+G<)A`r_-kf|;pt*Gmmh#INL zr>AR3s3-r#1s~7}B<`sr(s76REZc_nI3Rck#RQaB`e z&C%cYW7NcdjeC{ekFlM|hN)Oq*7Ww5MLxL_#6YprG(40u1$e`AZLTq|XO|YSmFh6^ z8h6vIjJiO4eta>eSm$X{OuCA4lh2||5F?$sP@bP+|C~cxPGfGb?$koe;2HY-Tx`0y z@9=)$ljFNm#VLmU?6bF90opX9JSOk0SDqHR5`L$vA6j7}TE*}xRT9BbAUm{NBpEWr zHO#5C{PAsb0s^x3tq^#b=*bOZ5Fsp!T=F$(13Ni{$K$fV93Ma^qJ52mU*pnNvbH-O zBRCSPWCYMwx`74zvBS6iJrTKn?<{&R09_>knoD7_6l2^GdI&znr? zW_B>91xb|JDvmkB2Pr_x=FP~2L^_rHEu)sx(xW@=wO*dL+ z!?bk>cl%>;%_BVQZvL(ktO ztu#>ahhI};y==9g`~G>xi*gEdT5lz&s)%D(4R@gv7*w*UWGC<(1FN~dXRy4lp(Md7 z^K3@6P`=3Ar1R~DrC&bIMOs8t2bml6>1XX>gA{m2Fopv={5IXR*D$=V_+}UxC<9z} z1~!XG)DWLREr=_Dkksy6p1a*{p0Duqpu3P1JTs0_g933q^tn3w=zHbAuF?;r!3U6+ zofGcQgoQ`R%Dep$38TVQlu5&8%nhP%Iqlzv!AH}P#%IvrWZj;L(;lhIMdg+5>~2n} z_d?4wHk;9J+{#gL(GA$^iWE4Vt8+(5gO9>0@|{H14m!j%4&y2W95c-X zgwe4CDXF*_L2XwzEEP1M(?wRO09UdDBOgR+YcaVJK^a1VX^Iv0rXjF`VU4+{0q*|TG%Nsmb zvV{mkTQVCNnM?Q^9rI1r7C69ZY&8<{E|68r!I+$8rJkVt;*NCr<2OA0)vW?7yLxP`Zc(QUl|vC(A{I~2r|S1In3Pi8m=cB*K}r1ZU}&3+xa zpH1RD@6nXvS22jk#={0n^+*kH01s3Z==(5=FMp?e{_4wz^#B97PGa>Z zaZ(irOoHGPWWVI^&0Cth4X@%U?6YtNaJ5(H(t~>R{Jiu=r|^;S2^#N_`h1&t&({YX ztjVwKb>j~d*CZE6-t7Pv-VaEJk&tfhr?Cj9%tV^fK9aM%K92$|W?dX^twLkNs1^aa zN#sV5dUvCb6E%_)VFR4*3k3BAd^U5u${`Y?gC%Ade8)%T^;v|1yFyLNxJHZHH`>V0s$=b5CestRNewHkGpZ!1nk1i-W>(HJfu# zlED?e?9XXc7kp8zi89pl9JvN;0{n^rFlQ!&=M|m7PqHD14sL?x^!YS--+6Ol9(F2) z%YlKCFrLzV`z+u&-B{Sd>8neJ-h01x@NiBmMEVC*MhmDl19%A}o&&5KnFh2(Gcg~( ziN)1!ug9}!$73}Pt12|MEEzLcEH(c)XBUPigM0i@rRCWZpV;$`YGkN2F@mDU zYVDVawuw)R#joFoh(~fM51=-R1o?tNhVN{z<3#C#TTap(`jqSFWR0`Gn@`5M$M=o< z^A`;&@fseJ8cMINyIH>0*Rn+SVHdWkmW2S!5>0cIJFaCnBgAYIXt9a*ppYxdi z>PY98*td6wz1_r`ZRfml2~tZW%E=uAnM~}XYzPR6HsWyZ7*>noN4z}=@2^obud@u$%Cu4&>U7x+=694?{Sm!M#AdPCCZeTGGBe+J4SU`>Y z9uo7Aq-b^#0%-Cwwkv7&3Ev4(dB$ZWWW*xsq{-MkS|NV(#*ES13G)9g=a4MI(m78$^` z7JPS|KMjR`>iq<%HaY4>-wH#B+tOQT{-7eHWK*1yTC_{SFXN#5{aLCN3XR-xobGXN5Ss=m0v ziJY2iB5xXIyvsnKae`iE>grQ+C(3KT@JxjGXwMuEkFtt{^3pd7)eH&yolLVP*yQ@# z&2EP3arZ!Zx#dr;qIbzhntc%~A!^}>%JYfMoXSm7wQ3@m1EQ17VpakmNNW;Asee}VVw$w$ih7b!YQg;Z<7x}&kptBK1`ktxlm(4i z(HO_;f5Fh1WL_03y7nfvSgeGx+i&Q1$+ER8>sx{&C|l!DUgkBs3eeOHIo$u_ zh+XuvooWAh{0kq)+rqU3Mc8z{0;9!_*>l^sNOe_~6Z*-RK=tEud>P1=GK!OPp2?2X z8DJUp9xhCxvUV9h$^YQt_cqsElkp|O^M0$+WYZEvN0NpXAfL}#c$mIuF299>Eh!Oi zGUEaWe-9Rh{Bs+LLjR`%!TjdhJ%>6bV3`LbOrUJBkYb_y30m4@)92A1yJnU-aHKF8 z)#z{{993c`=4c)qjUIZwC|1$)-90*%_3Pzj9k~86x;BP#GNSPH0Djk0z|z5ED$%=UXy%yn&%A zypEYCgF+vgQTDP#!cNg*OYlu`yJRmxMRAN1WPt2;aPVt>y3Wd z{6!8%UJ`Oh@|nA7an;Ff8fuxd@SRX}%Gk|f>R0~4JZI{wdRhS8*C?&Lr^3PVg?Gc? zXccy~Z6GsPG=2aQ!8qwG$XjbWC&14RPJ!UM6n)KRNlQhA-Ogg~d*rzRa4UyxvpLf% zjKuB}3c~EcPqbG-c}>qV^;QkWAPrw(dd440Dr~n{P8JT+mYMvWc3_Z zdL+0B&$(VhFJxMTI?oF*oaS?)rf)Nb;rjS(GvAND-T8xQ4ar#fkGYytr_w7+o#PEd zDa0~9e8j;VD#UX*pY{4~csi9Z_DL-Lh)2j))m;af%8bGml~Ssv7CkGuxjy3^rpT2O zOROava}ZXwFq^eXPu&Z{!q2f6td9HmI*S{gU!M;lJWl&FgSP(Q>o2dia7XJQ^jxE? zc$!6tJzm%m3t9Lz)^id+SWzfM_6{T*OIZ7EwmL*}vkihMhw z`|wvPNr`2JyJpx>((m;2bxn*O322t)p=0Byjm3q2UmPe-ZT!~c{Di7i#4mTCCWFpB z6i4q?Ko{O9+{L7&nY?Zvprx9b?^jVMuUCh$49;|uAY3>sqmt(swd95A-kN=x^#1s3 z89AQ7vmgh$;xrutgJ@bsDYO|HtQp2 zzdZZc{G|dWB6js&zkBjY_j8)XB$w7*XkLdkvtPZg{wXaF8;F@4vzqc*RCz*%(F|3? zufw#+{~iWMHV82^cO1r!4gDy?QC%$}P{;DgtPobmgN=%pBS$kv$eLgguQ0Q!49MVE zr*Lpa&Bd#cQNr;b5-FxZzyF0u1xUP8YmNs4KR*4i@LJ-H%K}P3@%t8;Dd2Guy6qQ0m71;u zIILY_drcx=;O0?4-#OMm5`cSYGso#3gE20XzGyW!y`wF|xezd3<*9HQu1}v4To_j#Ytu}Abu3J!kRRFe@G9J zgG~-x?7%#sj!cC=Nqm7k@o>4&y4-U+`1ChlBUf-WzJ>)Eg0vE!4v+9zoY4*)5R$4Z z#P3_b+btIR{?UN`S-~vM>8`Q0tZ#Ln+A3%TrK5ZQN5_r@n{tE!>T$i2a!cirf{`L&vWQIMDd~9{6WtRKKo@fmddQ4G+ z_+2S@a6F#6XB=hbEDq8VAD`N&yIuou;&PQ_Z4em4MmvbZ-j zY6A>~gv~?qR#P;7cGLBJSJg=k$HBjG<=^=W8}*&C{AB%_NKQWz^Hxp-;b}58E7?%~ z<=%|A82{aOG4U!cZkKuBjNHGg@e4&EjBl5NMzp}m1@;2_=?E{derkR0FIBW=Y)f?^ zw$OmM<(T50z6>9&fM}kWdQt=5Kbj9-UT9RVcr>wmeIx0xrc$4gL4jv{dD(_DfarS1 zPeF@3B~D1FTa#L$!p&FWu_=cSdp_B}Lxq2&p@APG7OUeWPmF9ApqR3y1T;FpgEPpI zRw~Gc(|r@FO>xt_O}}Ucf*#SycB4fVH$KwrYdwJM^e*@_`#+sTtc+Y4G}wcs&~r zp)o$0c2FJVdMR=<(QRGd0aG4@$%t4KIw(vTdgRNNU_@ggM)knln%5gIUjO_%V-A{B z-E)x9^99dMyb$lc%jfY{3&dC8=&1Zwt2U)RS8Ga5KgSPUhdhC@Ap};yq>a<>?$}qP z>=|RIsz@nhDU%4D34>Bo>hdteE$r+cSn}+b??GF;nE{v&;88dqDC9YxKPGGf;g3zCCSBbvW>-hOZ(ec`ks>UP;o0M~Q^^y(c$2wsuL|Zcx)s4m-Z+W>|OhSGR z9a^{JO!Umfbe|rZ;8K|@qoDE$%*y_Ab7OTLE+tnXf2e8T#nFGXL01zT zxeb5N#i;Fj%=`%DQSxnoVxE2a)1?z_3Yq)JpCm0}HZXLtu=`mOa0UpXljTKF-(8~# zk%>ZBU=KgTLvqE3dXc7?2u8Sw%`VCb+m1F8JP-6az<#P3q}n*PzI^#ZD3Cr{QvjuOT4$aYpk_u*-y1gkxKgc~)mJOs z`;jnm+CjAL<|`on3K8T8wl zHCJ<2Ip{vd8h?85i|O$Z&vl+Dj0e3f<71B2L=)ARgm~Q&YvSLB2dk#`vDrzt@dSW9 zUyLh{%77Jew~1k-a37s*Z7rI(*`30d>()TSubdtJ)`<-?zI|o!vTM!(H^Y*c#(umn zqn@t&+@sb!xFFE6uQnkb{h2M3;uk!F;i&cKZFX)t}z<{HA+s4<>2YwwrK}8 zqvlXKHh=v&=9~r+V?Uj}7&`jU-2^uqNLF; z6!L9}ry&$2k2TEdCQ8Rj5WxHoW{>Ol=B>ovrSut`dpQ36%=to23NS)duGo06jr~hG z;H%jx%u#B+u5Y9lXqJALukW@5`2;LwW7TUy?>EY}Q5dB}K`x1{m@!G6*+nOVDl*9| zyIKkH}x#RWMboh6z}WOm*c`ejB{UQ5B|OJCrv7xE4&lIy$)h5bir8KIfENg zAK~NXQ9Rls{fnC;t?*~a%J-11e{cWa`UyBe|KU@})}uc)!iBB&YZOV$ef&E<3c=I$ z>2)SBEFt^p6qW=?DWP)9&$u-DOWaAFGpwBQoGivxU@Gic?hPMbP6E$AO%)S@xEtb` zuS5fkkAqTF!pX6ksJfO5A+}XQg3hqTW@z(aMA)XiN7*Hqfy9i*4GpUGLkOi&>zUKN znj_;o%^3Tx3ht5p{W*?n+eW@Gc=2_1R^d0{%$|lWFZ+qCa$Z3(^y6r5Pe%glbtg`0 z3-JkPU;kn`2K1Vp`<1Zo7~U-7M`zF@?zEd^2@gVHTZOD-cR`Jg zorfO&C+>na4=N%`Aw?|_DFEC7qG-;U*!n>@R@IlX%#`SP-r|e^2r{)p4};!45uXxS zr9zpOY7J|x12br#Q+XZ60 zm!@^>BdKf`mt;Nyo(H%>K5i~KyZ3uU^YM?{p2=xh`4b6Q`oYfysu7%uVfPTEH%PA~ z2wP?zU0#At+~c&9Tev{y*Sc05!Q!zIujkW-G|Y!rk;mEv{_Jl_!&fbrbzx5&Cb7pz zGEo=FEOvs)NydoDsLrFW<40wZS!8(3xOwzc>qq%ouJKu^_C@>{xIPh2%z`-3yDcoo z`>Z$(;K3{q!Z^@~zQV)!_gOw-iXhEG1^7Hyo&U}u&_#>0U3@g~ao@It@%}Q0W^;Jv z!tCMSmwK0EI-8P0;o7LRX~X;jmL6W#9&z=pBko>fwM*^`zwqU3cmJp-(2jrOT9_NZ zx9y{Tv0sy4k_h0wgOF9~ieh}ziuGe(9$u301I{z2*WZ0BwFTFH*E-l5vf46GN0~LPTQDLG)HsQrs?v z#*Y{ECd+{2HaMy*g(r%&yE<+~(@3c06k>X>>Nixzx^@%RZ-s5opiiaH*Q3ib;hVsQ z=o307I{40O_H%+o#G0>dBD*_Ld=MQmBrFjDH(mtU?N%8@F?p%1kXA9P2 zw?{FUe%3rMaPjLocLJga)uNCpFUXrzKN)ML``I}^diH(Mi&JhNe|k$GS-~6J=|wVg zYm4{g^hfkZg@aSX_HcpqUhgkcZ8G&x0ZD4CkDdHsoNdj!%4%L59|xjA+=?G45F+kut~2+=OEJ>o^Ja{?JDZHqicBkR9dAf!c$mc;}56MEBR(z~Vtc6LNr*6^6d^ zeuqLdX>d3x52iGUZ~%b6@I|6n- zIO}yqYHVC1C6l`f7e(s2y9$<*>BjXa)B*Gi{jgN(J#B~0Pu3>T;Zz22JO#`BMrWMK zL+w7+#b%6_NwR1Df$tNpFhDrA%%DMIiI?3vifLHPqsZ4G%gdNaQ?*mk=H(u{Js;;f z=r}tVUG3Ayg+ur3?;rSbA)Fv5ET1UJ3+v3xJ$J0?Apzk<%h=mxI~sY)==|Ir7>P|l zf7_`-kLrueD(@5mqI#KbJ9wqKXK;~w5C=Ta2rWS$%F#n*n?x>LZDiRwCCi9=oIk)?;*m`HA|Z3(;H+SD2nqML6@Dk z9x8~T(ZLIXZ2Q2&2Q|)<80>E&`{#4|+cR-^9qr~$iS%7x58+N`6XuJ67+*fsULYe( zSeKv6J9yKLRrE$|y^f|PVMnN8qcr2$_@9uVkc1tNU+mW7FwcL~MhPJoRflh1T2`9` z?Ew-F5T`Nj@bT1B_N+On<=y*72lFe=2RB#YvfiHi^XvRkX*Xle!WP?b&1towxBjug z;4Y7Ug^`i^^g4u41{@QS_WFW$cD<49;DkF-k31w$eA{BXElzUhp~Isk{6LGsLr2hc zaz~#;uzgxI^l<*}7Qcm2X-v8*)Nua#)-z&rvz2XPWxZUlF_99HzZVg5cYWRm9623< z(`}{Ra2m&K9e;}w%f6o`tGNlW$1Ec2LO>2TT2y0wRlxV;hIu!m$yuM&n6q$eLG$ylhwl&%QNX>jc`J%pr?_X6~$f@pBmS$DSno zmxF=Cc3anveOMtnrSu(B05N_lobRUcfvrH=j>9`af)plV{Hd-^cp8#W8{Z9vpS{$+Rxz2~ZgPKiICY!4*I#~pcS z&|c$OA=n{1V&nJo|D6%v(pm|faE%coimPw4?)=xRIFSE8X5Ez0NiU&FypqQKrhiJi zp!|19_CF`;jllOJjDf$Y-A z;7O2!&X0u@>RGcudpSyZa+{mwEN#~nTLtf-kp$3dP zcH3$y0$Ot??YTc=$H?KJC0%M6h9<-EHgldL``UV3DE>1w;paEqAO`+^zMA-mK#pZo z!b8eK8n7ji)F|Y?p&qzdNqD;4V&iQg+5Y~+z;rXIDRn16CkXmcJ$;9H5<-}}9T7ET zuMJSq$hG@R~Lx!(&Q6PL&h(3YtvrQM+ zG=R5n%LH+I=WF|2KmVIrZ4v~QOjGuSCxOKHpOD`(6JA|cB1t^VHMp>M1hTJq<4Nca zOLXiAQsDDXWW=w)>)-K_g2=+Y z%c(!5RSP2|Vf{b4aU#gqe^jvlM^cVDh=zmoU&IN*DVY8rp*cN&!tMV^yic3{iH;2Z z7e%wiU3J=4E2kP5tI}qs>(p_Rk_ss}WX@!$0#t(?DFg{LN*QAo?`>^Uv?&#q8m01P zxI(xY>?t@HsR@#qUJ~Xl6E;_+@YcB=>d~@WUEt>m7G?`-=H_0vLuC^4BsdGYi>>fC z`rA?&E-4x7CagT36rEdL7pwwFgcCAfTcO*@T1Bj8dWqvo8Rc`C$|)7GDH*k_?*zo+ z;$Jcfa^xyytO%RJlwxL1n`t-&tdCc;VJ);O8;}_Q+N2dJoVb99IGYz&IiIHY!*4NT zOp4BxNx)@@aLN1NIvW`(?P5ObQyY_W$wW6{Do!nHUgX45#S{ifhImRwA?s?0sa3>D zz!7i*cs;(vb>4K}vyrs-*8pK$Rz2fFXS`Z9qp{VDP%*=7+zeOsSUSbSBTF{wTbRbM zn#V>*IxmbP;9gSta%6V2X-Zi!g+PKclOV*zaMe4dpmsbgKOw7{Arxwwd5=FEnSfKt zdJ<~docX1C_wqtflDLe3lL>c(k(!au>IXaiv(vAXb+(mav6>aBVyckSR5ik&WAOxGhTEM3un*snOo4N}6X6FZNC$XrG)tgX@-fJTJY+%POU=oMebUgXz|= zdP8=xv6_&vW{_kUlusQvvi?6@opo4LZP)eq!-pzeK&+)$B=RbG|$Bc9B&A!&P&hz}OTK6+Lp)eC7^)yst)8EDmz`qxd z7@va8$Kwv8c2idUZ~xLJ(YS%NbNZ0nz}#tB2~FD&H6ZBLdu2E(w0%vRu#`QbMVo+? zbXzyX_W@#PJfOr^qL&6llS|X$iIY8LO;;lmxK&K6^T0%JF^Lz>tS|7f(vZ7gck-o# z-I_ma_t{~affp@!7!q*kg4>aYk*q-3L3Tqh0}_Tv#ysNi*mz4+iS(a$(f_stuKtKO3LmBTT{tqhf{>8;nf;5Q(R6o^#vS zzLNjqhMRV2DrrL>SaqVYI}wpn_T%E!Ct9RD;b)w^EHcc8x>c7s^|#g zC#=mlWy$jV>*FK*-T8H&0^G7qEkw+86yjvX555d>shE>sB5L?Arbt;!d~q(z-g*ib zmN3bkja%0$%b8%fJYk41bO%mSKUOh$O6`;s4xlK>BOV=w9c-+d5LOsGM4Ne z$X7+d%&E)8<-jVbK#N73TV>^})71C&s%0amUBKDONu36iNK{k6^0#UDsw|!Ul$FyI zkCh&cWTr>mH2rg~6}u0cROARAncCdJfCXQbx|tkm5ysKjo@gQG*O4|wy|4S{V@o<` zobC#zT_qy9ve8a8FH1RRfN7_*k$y(|tLr875{s85c`t#>pF(nGEG*&kM8MNI>fowR zgb5qkOW?A#wu!>4E(YP@v1>rcT?p;7=Yc36}~1>Yc0BuzL|6yq)?D*Zh+1fGH) z+X+n-^P}Fk$y%o=Cw*t#ci_7t9)svXB0SX%fIAIcu+=YRI|RJj{nIr_p2+B9vatE& z>KpQ}RQj++ou7+;Y{J7BiKY!=-07x4D{FyM{h=>CAjhC$> zCzR^H8-_1-_P~EgAs1Tz-w*fqzq*WO0Agj-!yI$-?&aBfs%C3Xo?eD&e0ATZV|K+6 z{@Hb2KL`M?M*MpI@}i)?w7RuXJ=vx-xwx6K$leNK^;lMFU5|Rs&VC>X5 z9$9?kf+BrZjam^%-vZBAx^PnLlIV^Nu+IxVqoT%YR&Jg?;vAEM{G9%X&>j{(2hhmv4cK`q|UD z(G7fWqVi-CmdvNf+v9?)awxSOptj7T{EfCI=>j(6Sp835pTgMtN)`hnwy_&9qOmN| z7Js_u0$0U-9k@Ue6@e%tA3OQ$1xeo1>)G2(`po^65F_wlyoV_$D3n&RYepIzPRtx} z0o6{!l|$rXvjgn)-lD%;#0!kl%}M<-mg>^x19(myVz=-w89K`O)w4&#Dv231n_(tt z@A8Ywo8}OLK`LaR_u#E1ATMeypTpQ8Xx*&qF~B9IW|WWwA@i2SGugW^DWqCIcOW4v zMF7f%dJq9*g2lK2F51xas2jzuxKLipNX)hdAVqjI?L&*4wxm=5&o$+6#ds>?8kbLN zeqp|}p2$u65u#iY)=i2ai?~~MoP7rI>g6^zh1O`XkB-Ueys*;*1apg5Lbg&49RS4e zpuUtSUI;}u1NjA#+6_8-sR+o+4l2%U%aid&?Nn3Z(7{K89J;Vk#(0*{G;upCd>xyU ztYCBO!O@%yiYf7JNf8yUv7Y3tZ1{xoi)qybN1OH$0|N>Tfl6gNZ`WYm$G_4=mWqLr z;MwHah_5tVdsf6~#;X$`p`EkwJb#kqvzL#`TG_{TvHOd6ITAUFS%ul>kKz2cTH7g> zXt_}^kRR6d84HN5J2I{VHBOV9z*nLlIW zvNd-h6hoMJ>#TT!Q3 zj&kH~b2X2po!u(O7H%uuIIa5apCQ<`*gS!=rEjN0(G4i*%k~{+XYGn$AlgD z_+T*}Ug}aW1cp(vlxO=iIXGR%uEc?b7|@Mq=QkVi8{wLQ>w`5zk5^W-OmuoN%T{EiI-OY%)(k+tH~D8SVKm)QUovqI#|N)9oRwVlwJC z!7!DA+TvCJ+;2Hu{<*(^XVe?@;tK-B)z^0#xbanWg;KovY}~F5kh8FwANUbk#W352 zJ9ERa$J(^Fi#o=)sr(#s$6kPANtLsaCetH7zY>N=OezWk*Y|?}4b>r7*3aXDJj2dQ zJ>m~=mN$KBrcL8zH1PA@W=mrM&y^C)Pc>3eP4#-O0{Q1NOiC$N-vqvL@)rurA$x%k zBe!3?iFtmyT48&WlD?)kVXI|_Rk^;wXp^7#0O|kk<%Sf_vobKB@hDpfy$V2 zzqUfQXIcC!5$<=B0`*Y6cY`V$^=qSp&VT_JTE?5Dz(z{s(WIJdJk#svwGN!&I)zfm zLAEx7pzr4bzB}Ov^z51|0#Zv$O{ZnwPMpDO)!bkEdBZ0LnZj8cj3DC zxYQ>B3L`+<2IAk*JP1VXO$&6-cWG~XK_w;|u$*mJi6(`%i38c3qhR4Fc2muINa`A2 zyZQ@9=izQ*=4?6$3^Gz+q)vKnuUde|RIxl5vI62f<%z`9RV~k1qt*B1>YwD|45*9J z*w`e75|KV#0dOq3mqXbu#qar4vt5BSgtfJfF0(-k8SDNOlirB7-TxfS)@9$c}Ie_m08}do&`f3Qhw^ia`wWjzix8rr4-y9-|VXzY-t!*?`03P3xPOZ|48l{ zt@jTd#i8Vt8(W;Z?QE^g*OhPC;P-SkZGu{b#caJXsu{fm2|-0;fY_)k;X^0W_6K@m zn)qTzS%U3SF8lJ*xXcmNbE*wV1(o=oTQw{<{uDhA9e~y0yi-x84BjXVX{1s)p(!)s zuNyKiNMnb~ue6Vbd`NjS*0M8SWGfkK@^**L3ZH?GdWnICs;zFw!7O&H=G?BCn&7pi z;-@^O?6Q!;?@bG(GHdta%FfJ0>|84Hi>9gE?AQKCFxA`Wv6a}sfqFjXGmN~%vTsO| z>+}1mL1P3@Xs{7)%??!fEK=piQsU@rx>-%sXU%Y2ZX`_&^^|GtM#TtOdMS9Gli$dA zCald>p$praeVbgq4-1$esJPhnw!XoEjXA>t+fpe8%E?ol6c*^DL9ck2tm40ojUX z+NJu<0buPAcL8oX&_6dFdn3w^dlebLmU^6d=a)M6aSei>qeo}Z=-J-dYEyC)K0N!x znaQd`i99^PXH!)$-YJW42GAv{|E6})M|a<5)WY8OdA1dUH94GENoh#p+&dm3pAmlA z2YqWi7q-%}8g*XwM9BzkdBwUAfIv0m#;3!g^Ut2s8{#t<6hOvL2P+fSGD8U>%>w1ox zZY+Wqm316(J7B{kBYV4ih6_%GV3aFlO5N``cS5 z@fG`kaLw05B-wgPnyUhCw^in*yF^Ru6Oj{pNcH|*IB_)DS+^=m&$JS@--8EiuK*wJnv*FL-}T(6Y6Wn?lF?Ph&OY4+`oO`%u;ERcN0;eo!qw^Z1wXv z<#5&lKnyxr{4t}5s_^H$b?DYf5e@yNU479H0ImeK)T}>xjxQ7aY^zlUiI}0FZ5eHj zH=2^i`~n?lBu%Tf5GnhhF_Wd;0dOdm8yg*y>;R6_-^P6c3hC+NBRLT#ikgt#`*%Fsxb0w4ZpJ z*Q{z7&Z2P)uqwTkUo5IF&R0h;6$|NU^mv6BbTf;d!=+h44v*2@7QP;P-tzzkDL)YQ zARy3ISWeyyneLf2OndK~-hzusfE+uvZK?XF1hbMP2S@)}hAH|iv(Ch)SwkfK); zY-0W(R01?y$&-Eb|2!y@gS3yPtLyT5(WmlQ;dxBaQ2O7*zY?w*-Kae`zf>y3z$hi# zJ1lG|%ZYTmiHoDB;JVpxAT}h3&a3`4=p-Nmch~v8z@Z<3C6HR|hZ_Of=-B7HHit}@ zbh2^Ewo&XIX$omB!g1Ury8aVB)jn)f%f%^^o^P@X?$R6e(Qk-z3~ao|xO#Tv90VpV zpJD?cu&IT3TOu3lT0R z3BU}}YGiUPwC6r{8&eMcen8TRZ*x(p(=vVObH5Z*?3(VySxH9~+Y?eDAH}_GKtBAq z-@_QNNVteIt(nG{cl) z&tQrjXM(Uvp4L-$IiklX=p2||8X)DnU&8;lkfBJu`nyZNNQQ6vvL0}(XVu(g8sNPh0C$@Tf#LV7XT+}Z>pPZquX--!QWSDtC%$Lz}kfM^^uRrD+ zF$>CAPiE&>;#Oxs0WbZDHkd0SOFOG%q)bXazId1BA=43e*aKO8_2M$+&6JMQyuia7 zJm?1cKTVxB7y@}mq27(T3hjORElu*FnWmv za8UA+Z!;yX>^?rn{-tYh_#bD9XuyI#%f6{SWtkq4($b#3;moHU)wJO4dz78EB&Ih|q9>gg~Ini4Y;|86^ibZ1Y*3e9FK3 z@arK<<-cqFdM&JV#HGm6CcYfcWS$qs+%S2y*_b4B1>dGMyd~UjGBvm2iLQx=Ap-#z#^S^{JY#Xa`>K@9xKcHa-~(3#%$r zc-oY`+8QR9@Oz*IvM8aJ^^7tg^eHUMx8xwhHYSIu(aXbw9FC5%ct71%VwRZ%1njoT z0N->AaLxiG#xxx4l);>AJ-Vhezo)fs(8u~&jv@Q;OhW^t>s2Qwt>2DbC zqPV*DSD@h}TCZSlu$uQAK(=EML(sVfbSGCNIKz?3;$|=_KcnQHZN!Q+7KGYI|2AxP zP^Hw>xAbCwM4`Gf$gaA5GgqF-UO{7ekR^7rV2Ka7H&Ah|xsUrsMCvXib`q+`qn)om z-1fan3iZ*}N*&=kP$YRKVT`)@iJtfhH(UtQ{cZaxw~tR3bsvvfa%sFo;4B+kx-uLC zgB**Y$&`vpemjkqfKnzv2acm(enN4Vocg|PmT%d=HReie_zBwmt%+OAYCoe+Kk~zt z>0n%|?BFC{MUi_**Y|@{cS_k7qe^BjPQCWWK?J8AjqOFp+f$X&qk%y$OaIN%J<=&7}b9;tcqy{SN} z-DO>K!F&I+r?pxr-;I7%qAEM?<%;nn$%~~N8YI#u$v!gN-JLhJo6BRW+FfQC%FNtN zt?*&z0^RehF1UY~69u1Yjo&GVcH-2jv(wl#Y~og$EEB03MbA4~ zzn@*(G>xOw6b~d9nk8_Ak(aK`Frh&@$T-p|-;Fm0rV9RujYGjLOOb>k3E64V^<>!6 z-^XC=;XI7zy&S|b^y4f9d%Hl&%c{Asd2sdBQ_u``F$_-$v(G#!fqcwRv-sfPHzcni z@~O1u_ji7{D9R;RoSbwbgHhY9X1>PGUjdPm;-!D{1$8L#MHpAH^Dv0%I40!YR3IMM z=y|841lk3dCyNKQ*tV|cK6j}H( zMUgoUmG=rPtZy%^T(0wSHMBMgGq!uD={lW&Z+pAxw%XX$uC&7F5`RbGB^H2$sU-M1 z(VqeTlh8xm%|U>Ymatv3$!<-ueG!XT#2Zu2dsPbN>vk3T4u7M%fN39h?RRGbw6slp&|QFAzSxEb zwqb#i+hi7vg0|@Fth!8lZccNBI5~$xq?Yi7*zDfkuC%n}WJ_GPNSSv!NjYqdXDiJm zNH^ohof%x2fGE_$RAEq0aVY5S@*4{C>JV`)O&8)1H63UoQ^r*G?2XAomq98jI;aQ0T1Z9zIm9Q z1R%677&bS-15tMQZn`d%6h6 z^l^&#IZb|$>85fgAZxH(Zt!)CIb*lWjNX*Z!~NJNFn|re{^ti-@$)$;nKsrT|+|D$Ot5%VwLBx2@V9@vF4f#@ zT?`9pf3vB4^VG6DyADtG(+~)~sdN^7K z{{uNcb3Mt(!FghAksoSk(Kl#UlP*3OVd^Cf$BdMyf#B~~a<^JP{5TR&e)2d*vNqSD z#W%6lYO7oDEksFv_A!mg9%p|;oNo^OM*lHBgE42-zE;=ujIHLXl%|B0zv}s-^Xy>i z$DVU-v~{O+)iL+C1YPIx-eg!k;|kszHHDbs1TpF2j`p8knk#3kDI#E#SaG~D0S6n4A(tR zONIoQqQUMVDd7)m@5aL$DW~??>pE#%J0H8Uhu!0XvtKQ}+6pR3Y>jH4F~3$HtzKfO z%JbX%_kz5VIbJmhx?US{NHzhaq_fc_oMFJ-MZVVLT*PQfaQjz)nm#q1F1Vg;`P2WtNf~NBgIzE+3WQ+)9bHNp=yhk(Fl|!Bngy%0 zN?3Yr@Bc*X)h-1MG8H*J^vfK`Jsr(po%QNq&(95Mq)g8zVs4xLGSfw&*;Ys>43psp zan7}Y@Axg$ArB`j422&4XB}H-b^Z*=ILV10xp_pSa40=_Aa{M@P4}at#TF@pm&FdZ zE&|)v_+x3L{bTrM=MPcuL3bU*phcq8`tbhQbjqf!-pjMT;`bod7``i*T-OT0kfLBs z!=G#ZJnn@U50Dof_2H^Y?aY{h8MQ;h3cIhBUNWl2hQ;l3I-Ct-MZ*<7AY^b(0>qNU z2_;?>mf^h@=GRGC8QX!8p?o?dqNA;Hbzpcz$rEg?dd%?#^A(0O&^EqY7&S}MQd4Fa zXQFAa4tDr7YyJ(qsZoe4(V7$_H7UFZ?PJ zngC~TYXVjJf~N#2QFEFz?Ni@~Z!ku{{n`S3!OSSFhPk{i(BKT}y*}c_9v=E*1tKG; zDEkTSde!drSCdYt0HIn*B3Co^)sTa;SewnFcEu^L>B+;pE{Aq*>Vx(7{;{};j8w;9 z*^{yaLB6WRQjQr{yyscG+c~=QzGB#x@@5rd2N@Zqd>{DJQ`E?<{DU=!AYW78AD-uc z38(RQ=Qba0l4-R$i;>;oA8BM)dHu;BQi=R3G|T6dSbMIa2Wts6PY>CARo_&vvQnEZ^QZ7MTSVoI%oK5%k^ zheK41cHhB1jvW=OhpDvN(p zm>g8({ed`(SEhjY{x{9!g=+X~6Ec-e1qi@Fvk84$O)VbNDhn~qC^3!1z)1!wa?@0- zh}T5<@PC8p+j(ec%7bm?Ofm_^5dymC|GfUHk*s0CQ%x=*k#H!@!zL(WrPh>Er4?%xz3l4aUE`={`6$&tj{ZjR ziw}&;XXhSqhzu3uZvjAEj&+A{YElt@M2Yih<8=~UM4ku>(7u8Y4HyR%NJ&*8AN|IW zeQPKlQx3B}CpRo)^(HsqV=79UBJVS&hS~t~cxm0%JTSyUd}J`dl0sZfK5&EJU;u*e z8BOOzNJvMbY1kRg`U*Q4%)4d+s$>bZv0e4sq*&GDI(R*fbWBOaG4U3dUL^W-v8Q#` z?`$>*0Ov{P_8cF%r%cZ(3A|CS3LUi!xrKg-$7%+1k(iClY}&u2P3#R>%R3>x%eD=~ zVnds5EBt^*Q#x5~iZhpzk~COBq(uWvDv>Ji0uy&RUOqCrik8GYY%Q>#t?;G{lngfv zp=;xuDzrf72bI4aAvzIowYcrc#7%-0OD$*lH1*B<^%@)t zY?^3PQvG)kSPnHPb||Sz7H2!e%;JEkS3i2qIO*eKZyVZHB64u;x~pIq8yLcf@evQ5 z(6}-1D)#TUL)DB=K+AkfTtJ}V*`n#7#MyT3>-XEVVxg6Ii|g-V0m?4P9~>4QhoK{a z{-68V7ajS(=Q)+)0$Mx#*S~xYZ)h!Vyip zn52z=whxRayZ{?+l@DfXNB!dVlD(H<*25(?KcHy%d;7KNUPJM2Uy#%@$vpUV7^r&= z_)hHjx7`)HedlIFoi$&f!F6g*ogLVNAmYSDKEE~Crd5v0v5mLqFBrx(0ah8JRtNK@ zEuZAM7_fhYe_OS_-+ihxFu5jVxK1#n%40HD+0<03tgag%jpSceDZ8l~`D}XDKyenE z#tBn?ct*1}S$hLiI0o1;g^$@(b(g|gr!uW*#D&f@Aak)5&DGDgOa_BWLSJ=#<<*+7 z)7TdwUWMkm_|b2w@oc$KN?*a0GiWMqw41|{$RGPSuq+a3uE5|n`kd^ZZUC6Ss3+R|c;AlZ1C^_Dye*3RK0L zd#8J-`7T`9>H6JQL~{Xgd9kKFbgDL06%+XgnD--)FY82b*Am)Rk@O3P;wkj!BT5ul zL@c=>5gDEy$>(6=XFtHjolxdg|4&0NyV z(yEf75Oyv@f1thP>q$(1WKo76oii39qE{!y=^k_o={X$$S(0t#oGu39g}8}jB}X+axZ?Dvc8Bg)>|h5tzfdXWoicW z=YT{TYWKpek9lXMm{99kO$Dx-^h>rQBrT^lN9(dg_08Ybe+IwL=_m-+Wov(WT|w_i zzJHVTMantBxfGhUt9n!CP3DefE-YWD>$d#i<$Pyz5?zpC1^v^KGK376TR1gr*~wB2 zmwwidm9)dHc50OpV1y>%z=pVlyD4j4{L$!iA>8meirrAHG5bRmG`oN0C|s%0CLY}*!H|S?3}Mvvyb!=!xFBdyMeZ{S;*&S z%h38CnC;9qAAcpk73A^C?Tw&t)YB@f3udnTN}Uz{u!WZBb2zPBE5M9JfX7Lldwnjf zVFGEoFJsuoxsLAcTbgE6|EV*U!@%k5R`2t;ei~oq`C8c6b;b@8c5r%w+i4Cz!?x(E zjHyB+>-T5!LcO-%Oz1k4L~q|BG*8Clc4*)>h$hTPQKzLOCl5*aduaIG-&o;)%xcDu z@$m6s=uS?}5uxm3-j$!ml4>xh=IwteyS5Ao}n_`B|W#f32 z=Jg#^nkMA}>=J_Ra9u^)6))`{m(v)cW-6Y+(OxVKHJ99Ul^(FyH8zQmefBbsf0I_f@rD`O6` zR!{|LgsGSSnqm{Q-PCE!K!ELl>MiP-^FlHn_vZLXh5>TB){F70oX@csFx{yxapU~B zY*}5-oui}RL^M)m5N!5N(?WtgMq+&NW=f?KRK*AeJ&rP!rz{z)pcVC(XThLc-qg{Q zH8=!(ejnlXTG%OklCWj&Y2M8Ye_>#heBA{l1ev(eNN$d9czDDd7Kaml<$Fyev~c{0 z#P};XntA26kCJ=q?s_XZWp2-V`XhSR;M$fRm+xCr0wPThB=UT{!tfANW6J`10|VOo z5l0#S&CcmJ-pO44k&=kZSBQ58xGTYLx|C3qYgCh{r|76V)F@o*U3uniMV~`R7sTJp zrocUcutlJp@8MzOo5K#7d&IvyPe8~^NC&_sS&Fnx4WyO}XUSb_OiVZr&y0 zPF>A-Gd9P$pvx;inmXyoWtPyUF!qtGMto<;Zwhf#x*Pj6>Wb*Ta{laX{PpT0?d{Gm zzD*vdc%7NHM(@dL)>>ut>kYm=x{X&G?v@OQTBK{SQ>|9-+O95g!8JXE%xwchWvrTN zx^zs8uBJr3ZU<~!7vs!5seX9MBKj?6;=Xw+T;Qjm*~eS_V%rEdl>$U|*_MZ$;SA_r zD8&+eWUb|un^AFMCqm9iKuE{W>V}Sbsh5Eat}96ibnb=u^FixJGf5nJTQ@&J+BSS) zTW7# z7?54JwrOP>sM^u3raBp|eN^Xc%IX2hRFthWx$tOqfpFms*WC;SE$7e+$NBDX{&$=N zAhsY=?v}o}IAI>@SLgl-t5;n#HnM2xHA%py7R)kf)-QkMEL_A@8v`dH&N%g3vDyyn z)3<<3B**q=}L zsc^lxyZicHE6;?Ie>5%I89XKD2}eh&tTI_pTd2RPsb#3sc`lC`W~PIOZC|Vu+T459 z`W=%rCY~0akghuDMDE=_@!ms z&o~?{_$K(uV+IBcK&3b_DdQ=!Jfw!5+jaa0i9^3W5b3l|u#7uyJwo@+S{!(8oz@AmFJ zvm>7gw`c&Y#M+7MT%atQKGcE4WRHyzYv3C^DZjkZm#xzl2aq^?gwDcejSIY`#+H+E zhl(X1x^!5m6L=nNqzz~Mi{z<*-9i&<$+`aVt<52p&mu|sm)VW^RwoOYr%eL+3&yfQ zQzY>1KQlKYa>aQCGu6||TXrRPf+s%y*LJUkkh`~@auN81Z70~li}D9~k%ffdgkXsM zEO{rWeiA$67WvPv4Of(^t-0O!PyD*$-&f_{PIdI3H~DQlzL8MrmGgL34+4E1nUO_N zo!Fqp?vsJKK5tw@V^OER@%z~O^+2X?B+BmP_ zv&8tiu63h#)0kv5`dd($=ov@)R3iy_X-L-|P6@n~ zeM=vDey8m*mT$#6UOP+adKV|`5B=5gv`WZ6ywQ2FJ!qnZ9FYpv6dB@TAcXqoTr!44 zfj55VD71U$)h)4q^x7(YibMJ`*eUbc-n&=Js6Ef*dS9h*kfL8MaabXhzJuF1y>7Fk zqjI&>dF)O4E+7cQVmAw$_~ap=p#`t+!t>A)Cpm}wDDz%y&fe9|b$;D7w>*J?Om#TT zPY}N&l@(J>8Xr|}{6nlc*r9*PpqoE5re_UuLEh59OCk?Tw&%3Qo3Rz<&Xgo5&?XNE z!VIP}a)2qkZn+p{=lNKZ9JQmP7nu@6{rgy9N5>a_SPbCJVU-IItfNSlXYZ*F@_D8_ zd;7=Nj#k!IFJtn#=`m5lHs#4P;0cos5G|PegB;G>N2k%*c)KX~0vF#+`Ie#Ebv-g< zQY*CJZF9DxgjKxjI0e6s4{ZrvZ~9dbRvhT+zE^1F>GOnrJ8Dd~RSmGwPl$9FUSQI< zlgz!=eW|v4yYhEHJ!MQnTFT8APgd#>u5{i{v`YvNdQ@Egw*Br4O^YK2eQ9EBAn+UgwLLdKmdp2Nt-O~DB@+tBp+rx(s@Eb_Lp&yH3Ui~Ec0?k5rQgIQraeyz{qh}tt zDKF;Tl_Zp>oPv0_1kZDk(oMYWsGIe3jF?!sxSj*_=^!dF;U~>tn2mZoIdJq8soV$Q z+?%DAjaD9XUSn7kX&(H8eh z*3^d(#Q@Q7)AS8FqB~rtvvBT3Z5RpRij==UvNsaB2iX*92$l?*UC9Kwis;}N)u;b` z8wJ`gqK;Q;wJCx}9UyUBbzj>uM1}7z1ae1M_8nppXRU1xH@X2g))6N4RDW{j7F>Gf z23O^u`#+>3>s5JpUFhBTngH=T9Fzej3k4zO z1O8qfWofiwZF6cpH8OkOelYn#u`KbW={wzX!zaAUWB~d~z`fx3ccmgnpm8~Qvms0V zcTU&C8RxD%*GC?*1f=Eu$8R+Nd4`v0 z_BG)VGhw_NH`1zX=dr^q3=F6=ia-tapuk8*$SXT1QQ{+c;OhcRARCqR@J}eeXK!zu zN#bH-dFR=XLN=pN!%kjDWKZCr`K3TVp9@{BY=HbvcgMbX2-6*<=7fax|AHl+jyi5V zoG^HqCH&-GFDa!aVzEcu@P+s16CUgXVaV%faxHU|H@7j_sA!oxoB~fC3!;+bbLyES z^u+d#@WcHeAlm%BtaTqK0Zwl*@eA3jY#%;)$GH6H{v8R-ELe7vcmj?NHdDecv0Okc zUlRR-ikchn;{AX#z>4*=9}XOscsToxRbP2Cxmnnl@K45y@KXa|RFML#B>m_LMz4sE zOD)&WVcP%6d|iCtk$s8wHis1^V=vXs__i&+1bXwR*4c|+tS33RF?W5G&hL+rQj7l} z9ssX*l$Tr2f^mimznfT70VI#+I;FqL9P7;%sL8AYTsEgm5FLeJ!qyz{qY;YwQ`FB7 zT?8Lls9Bx*@;bgPy`;T}R^H+-p0;I{x$5CF{BaM?krQtgeAtLJfqTmI6I=fU-2H%Y zDTH3F(ub9bp}=|+WhTlGrSRu+=NjPH5M2IlJHn0=`x@roz)z`Wv86?P>qxeR+X%e# zxBABoRR6~AdkC`Vzdo6P!Oy+Q>C+q>GS1WNWr*Qa%&&dsJHrTJoq)$e=f9~cJ(bA( z!peK54*fk8(O(9^FDqdFuVsjopIyufzq0RwJOaW0j&zy#4jB0hih5TrKipo_q=lEh zj82d1+EZwJD!S2)GWeo8|7+#h9RW{G*{HN01s_vCJz;+NP^o~LU)9_$ReX@nK+xi@ za1u)6?&iGeY7_|ABrLdnW0k7spq*qiMU%hhjoMW%qrLj;b$Gz8fBv7B)l}$=QZ`oE z;p{oz#T}U4zr!9Jl1zB1GXaFwCqT_fB&ZjG9R1W)S~3Aw72Ds3l2XZyl7)>EkqL5n zv;0cXw25|)4S0?ucF^rSfeW;R9))9#pH42pyTCU4 z)$4+qB+Q1#<6*2DdXlpu-0rci$?aXC>yVKt$%Ux7NFf-lG1yVt92b z!()<3Wq$V;c6mxtGPRpKm?*^~%F0^+zb|F{m{VK21P}WC`s)^FY+1ZDkro9|?*Oyp zrib=gV&k%?pi6TPdGmgTrGoFc_ptqJ#hO%SIV^sPaU{>Bg&ucb&YZ2c^q&1NpOrbT zC(KBYOQ}WS-1VOB^=Z!Cyym(1&x7~HGsn>*vQSuXWm1FKKhx1|mrf~GKg%|_e&_iK|D0p?KObdCiNQ_-tRz=i+9Vn5 zcI63_sIh@x9AsXCgE7B~5{e447tol58h7?{3=7S7YY#HgDMWam$BzZI|LIevJ&NnV zjk`vD1aPfG(C3Ro9xXLpP;j-%=$k%BP7>wTkaD)JB4w{ybUh-yN#K})cA^c`bSQ8N z@kPEKD#v_p68^M;wmA$P=>8c*{}L2R9yfl6mz+ate!{K{bPCBu*kyU76e9c53VZq7 z4@nZ>y5EC=F|O~b@AEswds1QX6O$O>#;6k~f@?0cj=7h|>vZMLi7*kN=WtO~dsV>j zP?Me0cVK7L@+g8t%MdeN!+M{CzX(o`KgK0cz`DG3G%Jo#!iX=c!0 ze~oOMk&)$Ks4>?D7{EGp_|R~ond@FZ-%!-$$fJf6O^m{-95J|qipy}`x3#1dE>~H6 zSkB3LP&Fv0W2x(-bQ^C>HEfpvI|$fzl10psA>792vK+rohzuB*=xOE@BS$_aFr^R( zdM;sh-yEDDY-Kla3~khe4TgrrBmh%~hGI{&tU_cAG^ErZK99evD0S3Vs6)|9EEWIH-tW%ovNf~{TcOXiRvGW)Peb4K4*=6Sz!)_^c);&+*Q)6dXww>L zMuc1%*@YZVG7LpkD6bm(3kCf1 z6#2RGX<{ZFM9I#PreNpGEd(M_(e8#XaNt->XV=6 zp1RyMxakalF4S#p#Y2*552@a2%Dqe1R*tF_G9qDqi3c#Yo2SKRnr>eQV{HRNfs)qv z3PaST6fD)+;+NE%_S%NGILG(-~yGp=5X-QiD zPI%)HA1}k?geLfCIjh3H+I>Y=slu`(4nJE9NS4sh6jl4kWXb7mm?tDaa>vW#GYoX; zb{=ip`P#n8y5VL~tqB;l>Uz&2r5Wz+v;|*CtmQqw6ypC0hsFLaE0A@*JEEzje1qc4 zDoa$wy__?aWr_`X>FnX4R>V6$^BAmZHmRAWNBN&SA>*LU6F{?$~@GAlmZWl)(6 zQq~_CIee&HpKWXvsV22oR0L+5E080$oKjC468e*}wqyQdpYZS%J(v$np{z7V{n65L z8zF)`#fmDK^L7Z`CFqCq29)|&7~X?ezo52 z%I+9m^QV$v^-oM9YR@a9Y9pEG$I)%CI3zT1E^a6Mli6NFM$lx#{FU_bRFzYCnSH&B zh(oeOHm|iwIU5_hw5e@E!D*b9m>ZEG3BB~hh-7p=NNfsXwo%58Y&OWk(!0Lwf}Btp zQ_$a?$MkQ>@n(voF4|6n?*x>9s|jBB0E`8iK-S!DIMUy5=)>*I$0<`ErTW{kN-r8| zm@HQ_sr+-MkpfUGMr?>hU_kAB@i*y_50rR`VJ)#8%P#Tp=`IxSvA>eFrqgg$h6gOu zhrin)n4mfN)h^uW0)p=L7Hn-tI$yLJI`tx`Y#p{q3|7eJkOJ;T<#-jk3i|F2O6lBG zuu)SZL&xkhkWR~gIDg{8KQ`edQL%Fwcob!||B9d%l8AC*LMi@)7#CV7(r4SPm#=cdS>>NzCGbW;v zX6SITWy}y|%@|u`8O0bzB-@Z(IbYT5JpJ-qf5CmfUf=t5f3NHMyg#2;;kV)em&`wf z$J@Kz6U+sCxI7M`X%-@;kIa2A%Bl6~WnaIIHxJL8PH;KXjf{WGirO9yP5YvMi|a_r zPH9lp49QY$gfbbYL+HJNPChPv^^j=z1&Nq#Y3RbWoyWgDY}L%R^BjdN|GDFgiP4=$ z+%7-oTVIPVL41S2LyLK-R=6UOY+8prAur~c;#gJ$I)Ullkr7CHdyBYv#QR-n-6|Fn zu!fOp2aATe2p2m1%&+fbq^nH?Lf*1ncB-&(wA)AJ`fme;$EW(Xv#A$GWO^W3sv=Tw zvlG^aaNjxUDnm7u79JUb>yiNig+qM+wYujhLYz9Jqf;cig#Fo^@0-pESG!}HEz zJESz7+AdZAydO}aXpcTWJfQ%}p&ovnh_X-Df|e5aNY7w3>|=^`2eT@3O~@>A^>V%r zZl=PnA>z$-D(9F8m47wq6R|V(Fe0Lc5wHp5U^`z;?MHUMbZV2C52pgAKa0B|ujMk2 zDJCyL_|qb}%dGVPF-?@Y=3?cWBw|9UncYU2-n8keSZxl*F28Xf>;Me9vTtc=xuU|_ zP1KM**S^8@MEY@}P8uED5LX{pe0*%~-V=>?+5HqBFj?fDd$!1g%4o%F@u!4e<33{$ zl90)!e9}kgW#GD~N^BsUNo$=VUgs)$uO`jQ;%Ya%WTGZKa5|d%@lH!r0jJdcro5od zF>9fz7o(=_?ENXs7Dtozv8)3au;W2?5$T=Z`gx{G!O=|r5JU#)QUQ&?FCJ(NumYzP zMX509uI=(WI=g;1QF+KleVTB_@|8TVa zML*xeT9S3=Bag5U3e$9ba@!gNH1O@e-m3fiv0NxOSokL@1?w0c&D5BAKAuaiENoV z#i9Y&setBwubPOPZ!0hGXWQ(~HDdQPM^{MEQ~l2X*khFK`y2}r2+f}Nd6{b}W|&z4 zeEpSfO?L>*@rr|&Id=Vlh8@KwR(Hv#Vuu-x1#TSztVEPzwY~MlBI6)$k9@oW8)_{9 zHJhmC2-yR zX{WS2I(8I!#+J1Zt)O~apjb7MCF$Rf6yQekb2`s*Of(e%E1Z)P5Ea3|rtS-du5xE~ zV}r)6V!0j+B5a~wVd_Lm{&>&OBoQv3!&D+1|Jo#zY;6~0hol{X#Z>zpH=6t&^}kg4 z*c=0kAFy*dP{kZ_?@Wh@mw2yVM;?4DebsSDj&o7XxM79Dy*$_S`{wFo$y^qPkFJ=V z)03WH)N_`29Hnmj&RydaKy~RS{GhscFX7dynVK!1J@3<_TG+Iw*(|XJ=a<|YrJD|0 z1?!nssUMSZPHsOWG~v$~m$)3ICVd&dZ@+BZYU?3L%HWy2jfsnch|2Njh-m36QQqt0_eFZJO)P-21s`x!YpZ4pAA1%i@EIHR4z zHb)t{JWVLtFDFMpdE4y;WR$bDu!zxalw8$NoDf?o5Hbxllrd~UD12txQ%wqR7V>XT zb?+Z)8XCP#$eCF58Vj-V_x{vV5E&j*vp`hTDqT&ye~m{Un!2=d zNA_z33}{||^yLKwA8=V*ZUT-pr3xE51veUQn-f>#JHTX_gAXRxR zqyW*x&w+;W`>EIr;b6WDxL&ler0`4{Dl#kBfwC~~X^KN?XyJgv5qGF2A0^#FBfLSO zkAC^znS-odebYyDS=q4CsZ|EP1vK&yh+{Nepr^S|gw;L!U-A|MOVmLdSl04Vsp%fj zKyRHp8cRwY<~aZOE5vBR|>>UuE?}MDz~s-W^uX3 z-iq-HTZb75SXn(~m*e4NRR^EuT6Ze9U;f+agLT3-A8Si8(>rMzfJ<*oqd+1`2S_z@ z0~n^#7>APf&bX{kqm$FVh$H9E`Qw?M8ZqT7+bAqUBdfy+iSKf>{H8=X|POKC_ z2Tw5B)>{*^^f-fHJz4lfFE-kSpWj{6jJby!D__ao>hBYccNepS_Q1fUP=gk-#hy_R|2r(0dCzE+8%)hK8XvPgQU^TNFP3&YHQ8VWwpUw{ zdza=4B From 15c00e0375058b735c4a782f42aa8763ab067978 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 27 Sep 2017 06:30:08 -0700 Subject: [PATCH 69/76] remove Edge note in Start by GP --- ...customize-windows-10-start-screens-by-using-group-policy.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 16c8908aff..943ccf53c8 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -63,9 +63,6 @@ Three features enable Start and taskbar layout control: To apply the Start and taskbar layout to users in a domain, use the Group Policy Management Console (GPMC) to configure a domain-based Group Policy Object (GPO) that sets **Start Layout** policy settings in the **Start Menu and Taskbar** administrative template for users in a domain. ->[!IMPORTANT] ->In Windows 10, version 1709, Edge is pinned to the desktop automatically during Windows 10 installation or upgrade. When you apply a custom Start layout using this policy, Edge will not be pinned to the desktop. - The GPO applies the Start and taskbar layout at the next user sign-in. Each time the user signs in, the timestamp of the .xml file with the Start and taskbar layout is checked and if a newer version of the file is available, the settings in the latest version of the file are applied. The GPO can be configured from any computer on which the necessary ADMX and ADML files (StartMenu.admx and StartMenu.adml) for Windows 10 are installed. From 2078db5b31f874740e8f98b3f344c625015cdce5 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 27 Sep 2017 06:43:14 -0700 Subject: [PATCH 70/76] Lily feedback --- .../configuration/lock-down-windows-10-to-specific-apps.md | 6 +++--- windows/configuration/multi-app-kiosk-troubleshoot.md | 6 +----- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index e2064f0f7a..cb4884a6d9 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -23,7 +23,7 @@ ms.author: jdecker A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. >[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. Avoid applying AppLocker rules to devices running the multi-app kiosk configuration described in this topic. +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. @@ -361,7 +361,7 @@ Provisioning packages can be applied to a device during the first-run experience Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML. -If your test device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely. +If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely. The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`. @@ -573,7 +573,7 @@ Remove Task Manager | Enabled Remove Change Password option in Security Options UI | Enabled Remove Sign Out option in Security Options UI | Enabled Remove All Programs list from the Start Menu | Enabled – Remove and disable setting -Prevent access to drives from My Computer | Enabled - Restrict all drivers +Prevent access to drives from My Computer | Enabled - Restrict all drivers

**Note:** Users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears expalining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics. diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index def3c5d507..a4d6530849 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -33,11 +33,7 @@ For example: 1. [Verify that the provisioning package is applied successfully](lock-down-windows-10-to-specific-apps.md#validate-provisioning). 2. Verify that the account (config) is mapped to a profile in the configuration XML file. 3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. -4. If the issue persists, [capture traces](https://msdn.microsoft.com/library/windows/desktop/dn904629.aspx) for components with the following GUIDs: - - 94097d3d-2a5a-5b8a-cdbd-194dd2e51a00 - - ab84611c-2678-5cd7-d292-c940f9be6c6d - - f9f7f27c-5e5d-5273-468f-038e61965660 - - 3e8fb07b-3e10-5981-01a9-fbd924fd5436 + ## Apps configured in AllowedList are blocked From 09ee898c8d232529aa9aae2698a6503f99e69ce0 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 27 Sep 2017 07:01:29 -0700 Subject: [PATCH 71/76] remove link --- windows/configuration/multi-app-kiosk-troubleshoot.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index a4d6530849..d321398a01 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -49,4 +49,4 @@ For example: ## Feedback -Feedback and bugs can be submitted in the Feedback Hub. You can use the [Problems Steps Recorder](https://support.microsoft.com/help/22878/windows-10-record-steps) to reproduce the issue, and attach the resulting .zip file to your feedback. \ No newline at end of file +Feedback and bugs can be submitted in the Feedback Hub. \ No newline at end of file From ebd1e4f04264d995603c8e9133c3788748fa3bac Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Wed, 27 Sep 2017 07:34:01 -0700 Subject: [PATCH 72/76] remove feedback note --- windows/configuration/multi-app-kiosk-troubleshoot.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index d321398a01..6885f2b2f7 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -47,6 +47,3 @@ For example: - Check if the apps included in the Start layout are installed for the assigned access user. - Check if the shortcut exists on the target device, if a desktop app is missing on Start. -## Feedback - -Feedback and bugs can be submitted in the Feedback Hub. \ No newline at end of file From ccebaccde1256e58c195dd61191b2f9a8a471b79 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 29 Sep 2017 09:38:57 -0700 Subject: [PATCH 73/76] add Pro/S to kiosk --- .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index 99ceb249ab..8cd9cce9a5 100644 --- a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -21,7 +21,7 @@ ms.localizationpriority: high A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions. -- Use the [Provision kiosk devices wizard](#wizard) in Windows Configuration Designer (Windows 10, version 1607 or later) to create a provisioning package that configures a kiosk device running either a Universal Windows app or a Classic Windows application (Windows 10 Enterprise or Education only). +- Use the [Provision kiosk devices wizard](#wizard) in Windows Configuration Designer (Windows 10, version 1607 or later) to create a provisioning package that configures a kiosk device running either a Universal Windows app or a Classic Windows application (Windows 10 Enterprise or Education only). In Windows 10, version 1709, you can use the [Provision kiosk devices wizard](#wizard) to configure a kiosk device running a Universal Windows app for Windows 10 Pro or S. or @@ -86,7 +86,7 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo | --- | --- | --- | | [Use Settings on the PC](#set-up-assigned-access-in-pc-settings) | Local standard | Pro, Enterprise, Education | | [Apply a mobile device management (MDM) policy](#set-up-assigned-access-in-mdm) | All (domain, local standard, local administrator, etc) | Enterprise, Education | -| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Enterprise, Education | +| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Pro, S, Enterprise, Education | | [Run a PowerShell script](#set-up-assigned-access-using-windows-powershell) | Local standard | Pro, Enterprise, Education | From 6639d92027b7df43c8b9db25feb41af6c530f5bd Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Fri, 29 Sep 2017 11:58:40 -0700 Subject: [PATCH 74/76] remove S --- .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index 8cd9cce9a5..90222df996 100644 --- a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -21,7 +21,7 @@ ms.localizationpriority: high A single-use or *kiosk* device is easy to set up in Windows 10 for desktop editions. -- Use the [Provision kiosk devices wizard](#wizard) in Windows Configuration Designer (Windows 10, version 1607 or later) to create a provisioning package that configures a kiosk device running either a Universal Windows app or a Classic Windows application (Windows 10 Enterprise or Education only). In Windows 10, version 1709, you can use the [Provision kiosk devices wizard](#wizard) to configure a kiosk device running a Universal Windows app for Windows 10 Pro or S. +- Use the [Provision kiosk devices wizard](#wizard) in Windows Configuration Designer (Windows 10, version 1607 or later) to create a provisioning package that configures a kiosk device running either a Universal Windows app or a Classic Windows application (Windows 10 Enterprise or Education only). In Windows 10, version 1709, you can use the [Provision kiosk devices wizard](#wizard) to configure a kiosk device running a Universal Windows app for Windows 10 Pro. or @@ -86,7 +86,7 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo | --- | --- | --- | | [Use Settings on the PC](#set-up-assigned-access-in-pc-settings) | Local standard | Pro, Enterprise, Education | | [Apply a mobile device management (MDM) policy](#set-up-assigned-access-in-mdm) | All (domain, local standard, local administrator, etc) | Enterprise, Education | -| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Pro, S, Enterprise, Education | +| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Pro, Enterprise, Education | | [Run a PowerShell script](#set-up-assigned-access-using-windows-powershell) | Local standard | Pro, Enterprise, Education | From 2d503dd596fd4a3911784f5ab9a2e7043f719721 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 2 Oct 2017 06:35:38 -0700 Subject: [PATCH 75/76] sync --- .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index 90222df996..e87d834124 100644 --- a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -85,7 +85,7 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo | Method | Account type | Windows 10 edition | | --- | --- | --- | | [Use Settings on the PC](#set-up-assigned-access-in-pc-settings) | Local standard | Pro, Enterprise, Education | -| [Apply a mobile device management (MDM) policy](#set-up-assigned-access-in-mdm) | All (domain, local standard, local administrator, etc) | Enterprise, Education | +| [Apply a mobile device management (MDM) policy](#set-up-assigned-access-in-mdm) | All (domain, local standard, local administrator, etc) | Pro (1709 only), Enterprise, Education | | [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Pro, Enterprise, Education | | [Run a PowerShell script](#set-up-assigned-access-using-windows-powershell) | Local standard | Pro, Enterprise, Education | From 02d7e9715779ead31ac64678a11cf4845b9bffd7 Mon Sep 17 00:00:00 2001 From: jdeckerMS Date: Mon, 2 Oct 2017 13:20:06 -0700 Subject: [PATCH 76/76] fix --- .../set-up-a-kiosk-for-windows-10-for-desktop-editions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md index e87d834124..e26d7208df 100644 --- a/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md +++ b/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md @@ -86,7 +86,7 @@ Using assigned access, Windows 10 runs the designated Universal Windows app abo | --- | --- | --- | | [Use Settings on the PC](#set-up-assigned-access-in-pc-settings) | Local standard | Pro, Enterprise, Education | | [Apply a mobile device management (MDM) policy](#set-up-assigned-access-in-mdm) | All (domain, local standard, local administrator, etc) | Pro (1709 only), Enterprise, Education | -| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Pro, Enterprise, Education | +| [Create a provisioning package using Windows Configuration Designer](#wizard) | All (domain, local standard, local administrator, etc) | Pro (1709 only), Enterprise, Education | | [Run a PowerShell script](#set-up-assigned-access-using-windows-powershell) | Local standard | Pro, Enterprise, Education |