From 1f6af493121b8e4132737c5c8a4506d0bab6e8f8 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Mon, 3 Oct 2022 15:16:23 -0700 Subject: [PATCH 01/16] Update configure-md-app-guard.md fixed a minor glitch --- .../configure-md-app-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md index 382528bfa0..ce6c3c7ddf 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/configure-md-app-guard.md @@ -60,7 +60,7 @@ These settings, located at `Computer Configuration\Administrative Templates\Wind |Configure Microsoft Defender Application Guard print settings|Windows 10 Enterprise, 1709 or higher

Windows 11 Enterprise|Determines whether Application Guard can use the print functionality.|**Enabled.** This is effective only in managed mode. Turns on the print functionality and lets you choose whether to additionally:
- Enable Application Guard to print into the XPS format.
- Enable Application Guard to print into the PDF format.
- Enable Application Guard to print to locally attached printers.
- Enable Application Guard to print from previously connected network printers. Employees can't search for other printers.

**Disabled or not configured.** Completely turns Off the print functionality for Application Guard.| |Allow Persistence|Windows 10 Enterprise, 1709 or higher

Windows 11 Enterprise|Determines whether data persists across different sessions in Microsoft Defender Application Guard.|**Enabled.** This is effective only in managed mode. Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions.

**Disabled or not configured.** All user data within Application Guard is reset between sessions.

**NOTE**: If you later decide to stop supporting data persistence for your employees, you can use our Windows-provided utility to reset the container and to discard any personal data.

**To reset the container:**
1. Open a command-line program and navigate to `Windows/System32`.
2. Type `wdagtool.exe cleanup`. The container environment is reset, retaining only the employee-generated data.
3. Type `wdagtool.exe cleanup RESET_PERSISTENCE_LAYER`. The container environment is reset, including discarding all employee-generated data.| |Turn on Microsoft Defender Application Guard in Managed Mode|Windows 10 Enterprise, 1809 or higher

Windows 11 Enterprise|Determines whether to turn on Application Guard for Microsoft Edge and Microsoft Office.|**Enabled.** Turns on Application Guard for Microsoft Edge and/or Microsoft Office, honoring the network isolation settings, rendering untrusted content in the Application Guard container. Application Guard won't actually be turned on unless the required prerequisites and network isolation settings are already set on the device. Available options:
- Enable Microsoft Defender Application Guard only for Microsoft Edge
- Enable Microsoft Defender Application Guard only for Microsoft Office
- Enable Microsoft Defender Application Guard for both Microsoft Edge and Microsoft Office

**Disabled.** Turns off Application Guard, allowing all apps to run in Microsoft Edge and Microsoft Office.

**Note:** For Windows 10, if you have KB5014666 installed, and for Windows 11, if you have KB5014668 installed, you are no longer required to configure network isolation policy to enable Application Guard for Edge.| -|Allow files to download to host operating system|Windows 10 Enterprise or Pro, 1803 or higher

Windows 11 Enterprise or Pro|Determines whether to save downloaded files to the host operating system from the Microsoft Defender Application Guard container.|**Enabled.** This is effective only in managed mode. Allows users to save downloaded files from the Microsoft Defender Application Guard container to the host operating system. This action creates a share between the host and container that also allows for uploads from the host to the Application Guard container.

**Disabled or not configured.** Users aren't able to save downloaded files from Application Guard to the host operating system.| +|Allow files to download to host operating system|Windows 10 Enterprise or Pro, 1803 or higher

Windows 11 Enterprise or Pro|Determines whether to save downloaded files to the host operating system from the Microsoft Defender Application Guard container.|**Enabled.** Allows users to save downloaded files from the Microsoft Defender Application Guard container to the host operating system. This action creates a share between the host and container that also allows for uploads from the host to the Application Guard container.

**Disabled or not configured.** Users aren't able to save downloaded files from Application Guard to the host operating system.| |Allow hardware-accelerated rendering for Microsoft Defender Application Guard|Windows 10 Enterprise, 1803 or higher

Windows 11 Enterprise|Determines whether Microsoft Defender Application Guard renders graphics using hardware or software acceleration.|**Enabled.** This is effective only in managed mode. Microsoft Defender Application Guard uses Hyper-V to access supported, high-security rendering graphics hardware (GPUs). These GPUs improve rendering performance and battery life while using Microsoft Defender Application Guard, particularly for video playback and other graphics-intensive use cases. If this setting is enabled without connecting any high-security rendering graphics hardware, Microsoft Defender Application Guard will automatically revert to software-based (CPU) rendering. **Important:** Enabling this setting with potentially compromised graphics devices or drivers might pose a risk to the host device.

**Disabled or not configured.** Microsoft Defender Application Guard uses software-based (CPU) rendering and won’t load any third-party graphics drivers or interact with any connected graphics hardware.| |Allow camera and microphone access in Microsoft Defender Application Guard|Windows 10 Enterprise, 1809 or higher

Windows 11 Enterprise|Determines whether to allow camera and microphone access inside Microsoft Defender Application Guard.|**Enabled.** This is effective only in managed mode. Applications inside Microsoft Defender Application Guard are able to access the camera and microphone on the user's device. **Important:** Enabling this policy with a potentially compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge.

**Disabled or not configured.** Applications inside Microsoft Defender Application Guard are unable to access the camera and microphone on the user's device.| |Allow Microsoft Defender Application Guard to use Root Certificate Authorities from a user's device|Windows 10 Enterprise or Pro, 1809 or higher

Windows 11 Enterprise or Pro|Determines whether Root Certificates are shared with Microsoft Defender Application Guard.|**Enabled.** Certificates matching the specified thumbprint are transferred into the container. Use a comma to separate multiple certificates.

**Disabled or not configured.** Certificates aren't shared with Microsoft Defender Application Guard.| From 675c0e151f3a3a9442267df27eec4db855594468 Mon Sep 17 00:00:00 2001 From: Rafal Sosnowski <51166236+rafals2@users.noreply.github.com> Date: Tue, 4 Oct 2022 10:05:57 -0700 Subject: [PATCH 02/16] Update bitlocker-countermeasures.md added info about the rogue OS attack --- .../bitlocker/bitlocker-countermeasures.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 4f129193e8..b4a4825f7b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -155,6 +155,12 @@ It also blocks automatic or manual attempts to move the paging file. Enable secure boot and mandatorily prompt a password to change BIOS settings. For customers requiring protection against these advanced attacks, configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user. +### Tricking BitLocker to pass the key to a rogue Operating system + +An attacker can modify the boot manager (BootMgr) configuration database (BCD) which is stored on a non-encrypted partition and add an entry point to a rogue OS on a different partition. During the boot process, BitLocker code will make sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, Microsoft doesn’t recommend storing a hash of a disk partition table in Platform Configuration Register (PCR) 5. + +Also, an attacker can replace the entire OS disk while preserving the platform hardware and firmware and then could extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This will not succeeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0 and to successfully unseal the blob, PCR 11 in the TPM must have value of 0. However, when boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the Bitlocker key. + ## Attacker countermeasures The following sections cover mitigations for different types of attackers. From 360a60f5e407a360b769f66bb1d62a32712ae7e9 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 19:32:11 +0530 Subject: [PATCH 03/16] Update servicing-stack-updates.md Made changes to the document as we can now deploy Windows SSUs and LCUs together with one cumulative update reference https://techcommunity.microsoft.com/t5/windows-it-pro-blog/deploy-windows-ssus-and-lcus-together-with-one-cumulative-update/ba-p/1967887 per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10582 --- windows/deployment/update/servicing-stack-updates.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index b1549aa4b9..7a2066d26d 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -40,7 +40,10 @@ Servicing stack update are released depending on new issues or vulnerabilities. Both Windows client and Windows Server use the cumulative update mechanism, in which many fixes to improve the quality and security of Windows are packaged into a single update. Each cumulative update includes the changes and fixes from all previous updates. -Servicing stack updates must ship separately from the cumulative updates because they modify the component that installs Windows updates. The servicing stack is released separately because the servicing stack itself requires an update. For example, the cumulative update [KB4284880](https://support.microsoft.com/help/4284880/windows-10-update-kb4284880) requires the [May 17, 2018 servicing stack update](https://support.microsoft.com/help/4132216), which includes updates to Windows Update. +Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. + +Beginning with the February 2021 LCU, microsoft will publish all future cumulative updates and SSUs for Windows 10, version 2004 and above together as one cumulative monthly update to the normal release category in WSUS. + ## Is there any special guidance? From 9c8f2a8333d2d3cfd6b2f21b4899be317cff8732 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 20:17:47 +0530 Subject: [PATCH 04/16] Update update-terminology.png Made changes to the Image (typo) --- .../update/images/update-terminology.png | Bin 62261 -> 50871 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/deployment/update/images/update-terminology.png b/windows/deployment/update/images/update-terminology.png index 803c35d44742e0cce10e3a2ccd0108b8f9e9164b..81e1b28320f36056994826e4f4c33257f149920a 100644 GIT binary patch literal 50871 zcmeFZcT`hb7cUw`EGQt-6o@DY(yMf&C`G!|1d-kZq!W5OsPrNogaFb@=)Fsqu0TQ! zy$1-rm%CBVIp6*6yYIcf-@9YPk;Lq^_nLjq-<*qp*NW2kcocXb5C~u9m4pfigu4v_ zUHyFXD)2vA=Tx1*+ZB5i=@+1aKB^Vq%QaJR1#u9lIPCVRJ}&V6mdz_odk~1AVMnYW8S!eyMIB5RW{)Jor)PPh!g$1i6PucJ@ivphZ0V(bxb&Z`*$)k6= z3D!wSZY#9hkL5uzra|Y5+18`VH+wr+8S+x#aunovU94_auO7tb`12FlzIgC8s$|kH zwpc4oP4;m{)Y4$Yw%-(EU@F7kuWVehVggBJlD}U=G(k|me}85$50^x|{P$;)^6xaL zum7xO2z+Bign9kXY7$A-5`P%*b2j}R&fmA(>+8R|^lY@)rp_Wj9NB!sv)u7^K2|QBY(KCzpugl#Oi`uQaMZAeV&ko+h{W9 zCcOIu*%Ap(Yd{f(kxxDYAxpsC-qvDSQc}%BwUnR%x_2!E{ zAg~|sv!DxIjUy)T@aOQesC`)_iAc+l_+V;&>-l6QcWqH^DmQ+RvbomGVNx#-uhzM= z=R@P`-9n^rpKiCE`l$l_k{Yjk(hGeBG$?WEm9>KtR^j@v<#60+(<)}h45q%Ret5cS zd#0yb!+2a^m|7X%YWA=onm@N6T`HVwzx?u}z}sn-zkL7_%(8tya?mb;(No zggK8!79`Z5W)5JMI5uwUp7`Z^Vy&MYsvR57taJ5#wCa1!4jiO?1-8)%zT5_T)6Rcx zL$Ek>2$zwPdL~1)Y(W3R1MS)OL6zE*J}!zn(N}{OESFPhP+PKN8H0PrEa4j;OA}0m zQ_sJvR&#w=fCrKx+#Gzg3kS9v{lFuj(>_|t2!EL3o%-GN{z2@2NwT#%#6@rSx7+sN1qdC66tK zeN}~48><1_qZ6BFwRd|_z=H_$ZuMqyA0nBCWn-W#!ZB#Y5U$+f_7Od8)O{z(iRn$| zck-5d76Xh^4s5y_iR}f9Ixpj;i*gFIz6{?oMgw-Spo4LYt18kczz} z!=6nt_xYT+@l895l5!5VrjU-pky36x-`ImNOHfbj&uKo@h{pC3s%M}dG$=rIs4itz z`AxZ=%K$79*HVstV)c9&x^#e@>Qf8jV_Ughz9alXU6zon>Z{!9%?I5?lPbD_y=P}` zmBZr~i|R%6GhKb0sQ5j4%{TEsfoFEpdM2#N!g%ZsFqAWVUwy7m8~p@{1wl>kW!YS^ za`L+LUY9@YuKsVr-W!4~;jh9VW<35d^I^mR``ID^B#qsA)`rOdPR!2jI+^p%tQG5% zNpK?g3P%hF^xOb0!*X#c{Cd*R)o3Ejqh_jtb$Z(%=u_3F19R$c@D1Q&JeadQBYQt) zgD$OD8;XB!q)&5^?Y4Z78$jVb9+a@Rs_$Ihn3J^!_zeZP#resS!kxyWJ?=&o{620o z5bw)p(1$`2pXS)#%bvYnii>xGP`@`n+jM|W;>8}AxSBP(zCj~Y`HEWK?%(E^2(QsZ zCu2=uudP*gRBb$6ygW>GES3f!e9We1Hi*G5{ zcB@pRL9JkM9`r2kVTMi1JrS8MVFzd9vD~G*eGDU{46eymB7N@@#k0#OIwpT?3zGF@ zY%{_2ml zL!RgLUL7U3A~SC6u3bl4=~XSoNJnPwaO_O7FwFmK#IFtewTJ{XPnl-Qn&6`I zo(E1!vYp%>(o{F6@av2y%5w6}sdQaRx`13>WC7>JM-hFTyLZ}5xGc#^yIQF~ER~YQ z4l+pbW>jSkKw%--XJK6`@A=Wfz0JWG%e9YRx}F*0cD`w{;uX3r`j**Njhqmd3VA?5 zjSS)SYhaRIan*|aV57QdV>vvWpV2CKZge)mlMj8*83E25N@-_0Dp`KSp!Kc6z;ZtG z*@w;J?pVE_1NI?9w!CE~q_tL~eJ^sqq@};1%JPw99&MU8&aSvfmwhvM$RWqPpqPK` zO=apVr=z0(HEp~#S@}R`yT`BevrYyy6U{;rBx=XbRk#bd4jRues)OjE!GbFc7m6{5 zf^@u~8taP$yz^VGt+OHTDnlng5+xC@+A2*(-F><`1h=Sh>^gGS#*Z3QgjT;=#Gc;g zJtui0XFJ;Vmi6S)T;XZQ4Vj|3l$Hb@<)H)R6()0VUd`JgH!+tcpj{b5iD3{7SLi%@ zRnkH=I+s&}DhM3wD@gsIDV(JpVm=sJ^tJI_<&Ij~Gjo#-_n{Lj-5IW-ajyaOvg)>I zyDWlOp~UfU-^zK*vrlYpjh3A_EB%-?t@oY27^()@YI(GLSrGMxUm#cErC+4+Vh`}# zVR+PA{Q~Fi3Ur(F$d1Z0)-LI43d6KHkLfRkjA! ziD9Y1-Y0To`YDIbDn zrMEgh8PyM6+lttkKvt;}`IQ<8oKYatd);0tam&)0F0s7%DO_iqU3D>^`_5htGtcVE zFT-C+i*Ma2H}UCV^|wrd@e98~k!jVm+R=P=GZ%Yfokbu#J{f=vAGZHUzw-G4-^Qb| zp=!bdQxl?1&g!Wu|Md1*Vx_9oMa~b(0#!G>m#+T4{p|cJcnV6+G!sZ-#Q<*v6)|st~E)(c^(t>|)oF=oZHczc(m|myc zD@tj&Y2D$J{V5D@;NiOtiizO5dtzhp3h-=blW1mIIPFL zXZY-gJOyY5Ogk0V!uTnl(L)`dKIr|Hd|HW@f$>E*%Ot!0y68>Cf_Y+5_Sx$pr!96> zK6Y+Jj4leyUU=!a{%Fw>7yfsb79AvVY0*pBBH3nPtE_|`$gqL-@A;kL&i4R&mTt-a z)FIeBC*4-Tmzb8>vc{CiHaX6)nDbV<*J1Ya@=5EV`4ibMqfaQ`e9>6TKFcuUkUcx8 z32}SfT+%tGR^k<}5}N8-;~yC7bstzT^D;Z)|!e}O4=~p-hh^B zNLAR5RyHKV7n`TPlYvjsC!A<$)YBpvJ;m3MsGT{du!f0ssXsD~xn?$!(H2vi@;x)G zOny5t&kOIPQ(l6)F~e7}}_$qvD7t>wl0 zysUl)pN?Gcy2&WBY*d_N%_L}c?%gP?d&#Z7ndy0pUEO;5yPN-DpI%hWzy=@PNo-Yc z@eJWpb*pS~Mk)5KH1(OlccKnQ=G=7&1C5z_*j1)PTmI@Q@-KKh82y04d$AHpjgAAS z(?`ZS^YFkJLuGvLU2WDQr1W7fiDxBoBeJdGs$+Ua{&BSO(jmULu&vTwugLoh16pEv z&5>-i(PUOLWOGlp1IB+a=tTWY>918oJFXb_%M7MZ*#jE+5J~y)7;iarpq>+O)|+ZT zr9t4Q)g1zx1^aSz+vt~pO=NWA;92IK6{J1AE^{T1A)$5^U6V-01sW38oHBmy`xymg zCkmbCbga`OXVU5en`UyZm1{R7v=w}ZV~%-@-C`Nr2oDa(}%>k zgaG+u=qsGh^=0B|jyR7z&Sc$h@T8aD*2s6Rm>vERsQVx~6b(vmbO^jSUayyUfV%J3 zCb$AmkIL1*&uP#V`zkU6!g0d*neb{LHHS_*9ra}b7~3C{=Bn#Qjg;%P%>=sPBj@vSqz4Vh{E#0u#&e`2mfDcC67@c^Ktl*zT*X0~-K z{eW6srX`R0C_gYpRP#3}Gasw>IvZacac<>KtJ2nqzyJC#A#^;T0jI9-3$t3ya_>M0 z97^xqN~lX)y)s^1vdSdr>^v43UgYpT=)z4bocV0ep-A4Zc{@!S|{zd@&l{JY& z%j_t_DYo$?glc^!?*voZ0aUN6PT^+@Q|R@VtUd|E;WG>%a7kA%TM?SV5*R@_%Gj|-&c_B&C&IqBE!RSCum+RG|m$XM9a z;af7jEu7iKmu5VF6%Xw!Wg6ueSdNXdlUvU_#Q!86N636|WptR+*GX$^_-0xpcxJ7x zqesnE-GS%!q~1hHm9fqoU@sr8dtcXs?oohxXFCUl3A`R@oR^O|rqv&XhYzT<3C4T% zA@_LmMR0$5F+UvIH2oTD@sA*Q7L@DJU#(O6l*gE+zEFM4G6a;U7yXYCStSi{L=Wj% zb?J|*13D!8=EI!jJJlIi{4DEdvZK0zWOANM5%{zro-&M;Lk-WYN3><^9rx*uTGYq8 zJj8fmh#7RuK2P(qku<*$mXkYLhg7@QhwpwRi&gxvb5<&DfP3V355mFh3DB!p^)Lns z5M~))OnOI>H+xx&ntyBw64uORVO|5xLS~6g<-I#6_2?t>_+!_vRUab9!N&+!X|udv zF)b8`X)s63a(?oxsF4#R{xXvpU}C)m{;}C29H%a=Zqmil3msst0(Td)rLR! zowXMhHPaMI=z5q0rs?v+ne^?!)-QuvI1(*BC`U|g`3;-uHh5fY$mf7J0jbm-0KN(m zKf_vJV|-Q(w!b7vVP(>o=_0~*oZnsDK?d(Xv`FGu$~d<QWpDGor)9>K z`$JLqVuicOI@k?jW`57IwhUx!mNj6JzM&0@(MOu$)N@qyDrCjt&O?sZyZ*l92mF2XgY>j-Ca|DH~dlo}-wRxw^?UIbR$zT3Mo#+BQ z)C1jbFmXuYd_HN&wow7h+?ynLDek)1SY{Ig=~?NL>i)2fbXdjV3)Qm^cdXD!vTsbh z>hZqhJy*9LTvfeWwQlA3%7Gm>f3c3`-$YnAw^C?VT~t}4J0|4o zWCnc5~*-@CqpsP?@8Zf7qjW->%IcbE9DXU)QYJ ziq+2~I7J5=MvPQu53`c)Qg^86%<;gz1pZw(XYH$>k(ByC`-`HpMN zVWm02RR~n?w`p|`Emw=YymQeY|HzC+cJo(Lt7Jbx5`uilPovvTts{DY7U5KMD_Z4z z9{j;SvCD60rM1RVw$5aSfvBo(FeoANq1mA9h{R}Fw7azO@K;IR2$1`Q3W;y_L4$v{ zoL}~!{e3U5kfrZ=n$wHlG$Re*uYv}Vivd}VOoJ@$*ki7*oZRX^f+e0J0mU8Y0?Ubq zWqrvKmMzpxJ|g_I-oA2DX|3DGYe-jTVWeTA=;(u;Y7QS!cjvLAYb?y+rF4ayt*xtt zPkplzksX-0zQcu~(&Vxol@GvRSSGA8PI7_rNbXJ5Y`f>{nPxY8q2o^tXli`w%UWbG=jO*|&R5rzLpI3trjXEKv@+1X#HseLtaGM0WpmYS$?e(to~)~`V6 zT`_f$9-q+Fuj{GrkWY&*=5XLIkF{bvvT$7u_^xT#km7{r3UXO)4p{Ku;cYf(9EvVt z9Cyd#`dF^$DP^(-!2Uqei=NHicxR`^_Xd1SL6yNL^&UWXR5=0sx4=q07?%1xwB}yE z>96=v0?y2DaTV52Y97dujYEph!SAoVSE%`VTXy0jOxo;pf`%EM{Pmz=5x0gh^5 z1rLFO&trSeo#=Y-0;iCf)}T~k^2iGpl-le{Gg|fjx|&s6EYlb$4)2C&342aMrrX|T z*<`ibTlBF9W^2hNMkU9@P%&o5YZ&kK!kH7TsW9c_S<1pj(*$&1W%r%PTi0u>Ln&J1a>i?wY1 z_m;q3l}n5FD-2|_YoZL+BCG7N0ASsF84dGiR$o>(I_R$tP9^E)LkKtI#`r+nd_@IG z^8H>L?iP*D8|w~|8<{;I7ULj^27GK|$^qdm#Vk_BpI25IXmxb)y{IL|j80@d#N{_A z6WG(n84Y!FG9E`aK3HNtj)czI0SM)Y({7VvbzP(4=`5mZ&oH6=L4oreI(DQ4bxv~U zB*TiJ@9Fc3+0pAJ1&VXO0PELONN`B#Dtu&{+Hu*!E{eC^vbRfUeMj&&4x(Af)FGJJ zAZ^9}N~6Y_Oa0Q15J~!tLS(|S;8|7v)qy>-JXxOM^%>m+E(Mw6KXPi*E25KZk;;LS zH=bp0z{alhvnFmfyPhbOq*p!w_?08_NSb=mhB0lYg0zuGzM%E=V}^RL^I>kpjDLMo zm9cGiUAqt|>(B_Vn-=ji&<(cvU3{@^>L*TgPFTTs>!li5Q)<6PNh4hK546K@o7$MF z#1-|@dmd4l^Z8!i#w?jD4Ass^7}yfK2(OWn1y*I|~PZucsU{*habR7vSLH91Q?;pjgD14eKZCe=fIA9&k**G>0y~A8_ z6o}fG*`hgo^vo=g0Lwryt{sN?_{$maU0T8>U}||XzBAh?RW<8NAhhYBTCXX6 zVye232Zcq^aFT4Le)`Ddn{JV7(8tSEtqpC92@US4ELDpd(g!r?*f%@T&*Q$r#4-nC8{=E8 zmpZ{_ulCwp(b{w*2xkL~G*;KfVvsh+H39x6*{6B&3A(R$GT>LY$6oEAOfVPwAB2tr zDp1>H#S;Q!$SqU3Y?yX4?OfSclnfdc9qBL7DL|on*9Z8LdI@vxFz>^5wkO>L#YFq{ zxF8quSA;w&jpkXT$37cgTJ_Hx*B;92q2%1jFY+pi7=s=%#h-^ZoZPUv7z|&TY9{niRmwZ- z?!D1;US61mnFv*0QvKlpT7TBrrF)gb>#6f)4X~jwH=S(-B+)f_onH%km5;pv?4s(j z?82-A{cD~)peda_$oPw%r)k)1>e{KtB^dMWQ)5`AV=~(L$=Tc;g^Ow7upep%u^q^e z1Nk3@_htjmZzT0_xT-!}K9!v`ALr~mO;TgnQJOlVzaQ#V>2??vvU{uYe)tWTdB}T~OaQNEfC@xZ024N#W*MRnRT9Yz3 zy9dan8&>|CvTuwzQ=nH56zEam1*lGK2;m{nw!U6Wuy|Qc|8FiQF@3iEfpAs0{%Zd% zKZ|dVP)(-*u#4sc3cs%=>OfN*CTJ}34QSr-(+$4OHLSh>JkVQpAms|f>2pX<70zwi|K(Dhz4dO4e$meHUaa+g z<7<-gA}(tEUnJAxdmnadtiIVPG74^L$a&Mp$0$-X1ArIpr$BuvpfSGMJy_(jG|uzcoNW(kf`8^7oj><-~@$h_NbV zrRav|FP@dV#0y$j)<3=Xw~_` zaJBBm3q&O6=y}m`r%ReT#}&|!Nhsfc-Tw9PW@b9Ir}I`uRqgrdLbQi1q?AzBA2yIV zPF*lLVpc=3B?WrjLuK{ed=Bs&pp<}(R^r4EPzsv?*xE(w+3?XL)D@fN zo|*Rl+T1G8@uz>+0?v3Kni~(j@$DA3A7#QAfYRZB-lYm{T{EQxWd}h!5>kLxE~uEm zyEDEeM8Oh(A+H!%v2P@y_6_w{%{(ea4zjM?1+>ejln68=iI`LPalKg48@S&*@W}m4 ztB@d=RUzE*;9!b6Ndr>ZWTXsWKbRXQ0}4Mm-1@8^!im_jJA(AA?$4Yqc7`q&ZEVzc zf?6G(CQZM;27(b`oQccC5ySuu90K-L#g;i*X$J7_^3VLj%l7f(7JP#%n3dy!gf)R$ z-BJAq%E3mYvpR3el5zUAe@p2#d2uM8IAyEg6+odQ0TRb!Y9tZda&GsEL0CD!*EAHE}Ehn(a{=?vcoUz0H6XCYx#hpsssX9*{XfT9br}1KC+`P5W zJ3;fzfj1FJc#a4(gsY48AF%5XLU#P9d#)~#ZO_HSHPj2edh@L-pKOTbkfq%L7)xwI zz*oTv1Df+O1c9)s#B_qBd>pFmKO(RwftqrRCRmS)ItqL`OH(WKJkHck>OmZ@r6s6< zG4AJ{d+kAX^R9bR56h5BIqJ8WZEy9j&cz-mexX%+&xr@3GVOhnx9`SD<7URXQ1nM}HO&ZW*> zvWAz^=8`r4(}Oq-z*&x!((9S0i!3UToS@e}({p<#VSQXrHuO|l1)F9q<40XBqFnEm z)E;+9)1S-?2eCt%`Q010>ATbQ%vuFOig5xHBk#ZE)3pgM#U5M^7%i1AUWgP}ZS;53 zeEl<*;1!Z%r7>)xao(EI(?jiKuOlj~t?NR}z#@PWXxwhEpdQH^SH=-KVI@U6bP6Td zR&Z~0g_iQg%N}&PKBLuJ8j3w?%uCplYg^sCl5GjLO^-fT%wA;mc7kyR&}w%qoPDh~hn$3VwTs>^{fl~eO6 zPif2y=akQW(`UGd&XII>9MSy(9~X<0A&?E`s!q_d-rS zPcvJihifysEHfi+mn;@#uwl^?^9Ot93%2Dk!XkYp85%RqSlJ!%k=4@2CpGV2e?hod zbIZH<1^(8PjvyEpb^-l{PPb?-Lv)3owr+=+v~~GiX}~tLL%Vz}Uwy-o%B$%g9jUgn zxKiBrDb=tn`t5af-m*fY9+Fe3f!x|3FW(lXhL7e_U`8N9q?$r29`$z^;$}=V(1V}W zsUyl&-YRm%vcmS>U5I3#FDS3a3Rj5N%l5itO-GU@>$j=5udMubv8#d_h)Az%!LxWI ze8)xyd=)rJ*Zy zM*im}WD#j6P4w)y@CwCjz074}f0A_2nT>H|JVV)PShm`PoXfBP{^#kXyH;I5)fs{X z(67|eqgj*sD`=SM$|jt)&iB6;D9#(z>bF@Gaw#hPZFa$i@QF5lt8^}tq|y+Wl(y>};>)54`>nq%HN(yVRUA6v z?x?gpqU3@Rp^~^GGH)UCYZ6L(%3_grN{(i~-B^3epI*Z%uA^PB*e!J8w&TZczI3{N z#L09{{nD27H;Lx(c*`6gsOc&lcBu}|fe6x$&TprQsmY9s((cc7zD`dBUcirLM8k0G6EyjB^#^M{5CV z(mT_&`~(xo)ZSjt5eRdLR;kr`Xt_p>?>2gd8es9f#cWsF(*TK`R1W4)!LS9Zvxq~R zV+J||2idAQOkMoKt(_v4SgeRze1)126o~)eQlcST-iDiroFN3(aL^bg(qnZ`of&1z z*Od)~G;eRf9e8%-3v>v+;JaU~K_l*32$*JX?mkzlLcU>>Dp9puzXsDmcydMw7;hm% zP|6)mi)Gup7$d<}Y018^Gb2oN=%oD_Q0I}6LHdDL|4PJ{|9JRi5Nhf>$V=|?&C6sk z00X*Uf9dt%b{6`8)U!fVbU&74xDLL9zUH_oLu&}1&y`#ptxq?KqQN9B542G|j=Q*1 z8O4Q)x9LM*g}@aO1>r zZ?!izFKi0ZWKij1wB0n?b%lP6TFOcU#Qzasv&kCjDfWnWy< z@gd$~#kJ=66ctui7r8=;0s$*VZ3OpB1ocDAJ5g7&5RC^}S%1P}kL6tXU)`bmOWEzM zg7FT9YM`(Fu!)BV^^x$9^SAO~94k{hGll9rErn}aswoY0sPcz&Kz)of2*~z6?Kvl zmGIbmV|m1!1czwd(V{|%(%tLZ#fr)WKN(Oz`zrqWpC3F~9O|y^t=mHF=Ge={^5e51 zd|+QIs$TDD#$*tSp)OXbk5cEMTHQxQ8(^x2$L2o zS|#Nhz(15k<0zDf-UYIWtAMTcMrrMY!GeJ}Db2XJ$^6QZX)jrPpm-Vj)ai;EeOf#W zq3R^3@Bot?b6REq*ZcQT$8}b3-G;;5iscv8brkiP(4Bb(kNA8#wUKsv?OMGpg{Unu zF-lDOPN>dkE|RD1TnvFTeG^C}c~z}gf%!b`Nu7yXtThm;VeL7qaK8?lCNe5aIy-Vy ztz^oI7}H}Xr{G8&4^#HWI5Fu@&W3w&HROG0(XsPl+q3v=nqZiGz5nx&5#6Mb z9^{peu@NKpOcNSqzvC^%-{ivEP%Np7Y7LI&`)m0!!wWu#?ZEd>Z~%8o%K;>iO4aJ@ zD8`%M){56h+v7WV9kA5A9zR^t=J2+5!7g86Qfff1tt_1~R3_CK?Hz(4F?9+E)w;6$ zf7SP0OXE;#9)!KmbI%ibvUBMebUqQuRIri*xSUQSpEYNk-5zJ63OF`yHP(e+A&!4d zHuT}Cuq2en?6Cq}%wWIwL?v$;lM&}6tKke3-<>aL*Ykwzcsw)p4fY?EI9WhtL#3?< z?CZ~TK22_)ZhO)_CFwH=KBO}V`2=X3K{simo~Z87i!u?Cn}60B7Si8 zblAM?U#(|uie_IO*qv8I>>MM5rt5WHd95)yU4)Z}#c|ma&-(IB6d$V()=?jNA<@jv-*EjYCTqK z&H#Lr8uqegK_c{StnQth3l=Mbmp4A)QYaX}zvJ_7yGcT%-#V?hAl(KuHgy5V#3O<- zE1UNNrdcW&&@jsUf870#*R#zr(0bP$1?1=2;=aP<=$s}Cg%@A%JmL)!OyqY>d%ZhG z(+HGqmY=U=U?U@}uZ^o4DKxGZG$}*aZmL>T{nxgt1%{rdzw9#@s1{SJ09s@Bk92V4 zf?@Z%-~l|mWUibIbK z>3RG`T%WqP^8+jjW`M?1LyM@oK{lJjhg8VHh9 ze*w;OqdPwwh~>laU6qd8w>!>N8#(x#G!)p}1Xx&pWH*e=-f?OQId$BokTie~+-HEs zKCogm(+POM=<$p@a)y z4JK2&>G7`mZfwvCtV| z4=$3Nyx6rI@?SwtQrEdFc!UswsJ>BIzsD}1Mxamaeum^A)t`;7Bssp%vXg6org#PU zbp&-U-^u8fKb^Fj|0H=vXdMs4(A>5*!P!T5$f2ULKcO9J{PlG-+u40qa*T%Xm6$py z1o6qdRE%Tg{mB;<(0>eFFFqBhg+YTHPaloDRPzX;0(6Q7k-%s%ay_M~_Icx*!iNU7 zVl4UhC+l{~YO0;KfkO-yTL*nD?OZj9XyJai$kG1k_W5l4Sq3YkouCRL4WTF8Mzo1y z-VU9S%`gC~YTv1ZbH&WI%?4CkGQtqt$OuRPY*wr2V#Mm{xVy=^7w5taPW*ov45bHx z(6{h-;?L_@6M~OWosNe!fd?bA+?rf;eF_aFVw%X7t05nNqFtsnkNczdBQ9CbR}P0# zN^f&G3t2P5VDxXc1&bApV!x|ZA#?vt`-=Awum@@(t#2qzT=!S`aY)w+VQS_e$N1$_GDC3dP&v(-vD5I2|Q873tSoX?aIe1 zR(!gjPFYykH>-+e5bpHf=!0s zTPd$~(EP*RYL|Ao#KdQv#XWSrdD?+VaYhZgUvqS$JU}mF*sgQ9laBCS%#EGu&CD%^ z7Y~;H5-Ksz3yvK8UF)+D19~$3z30~V3Uw>>Kv+dz;YK0$;V>aO49#zRzP&jjxCIrjQIr#+ zbtxPAKU!$Iwi64{PASb9ZoCJG2`|px?>DXodiL|TaYP-So~>rFV|D91_fl`axDMC@ z5VP4K)QuR;Smu0xdAmfG; zKe(QqXN~Gs@6;KmYn{4||N#^``YBq$}*8%yG#PR8qXziYoK;giQs|N5z zf?!zHn+w^!cg#nucaFH{GyP$ zG3-RYknJajz5R6wBGa3^VVV1o9VBJxmjRq$b6gs~_nG}ug^A(8F`Bn+ofo8?I+&xO zu-osS%0+30pAvo}bV?$3?CkwA)_BL_ME6P})y}O-bR=Mn=F;nlZ5`odx5Wv7(_yhc z^7hc1S31w^qtMU)f|{lSsN{BEPbp0Ck87W_O7u?oc>3KTgs04uA*}&ns&e&Cnj@%Rd_d@u^eXoK7VLe2T4(SkXY)Ao_ z-{#`oQHz7|PROc@(Rpu0xE`WTuDfeo}zcr4#2WS-dr^ZJlv z^_9!0W`>y2u1N&F+u3UGsGD5Z+(-Pgv*9MWH6xFD*W#0tK0Y(i05%(^{75f8RD%lT z7&tOd!sH3I2BheH^l_Z53us017=Y=_Qc7w&j(X>67DU7lgKxzVAC~^KDQsLcd%g=5 z@z!y?ko6~64LLIfjRx|rHeIbM?mJ2LxtpFGeKw`IFj&ALy}Y4(yfTiIo(qb4C$aS4 zt;sLPcIMt-xzSnT#k*i#i1*hk(=`){J1@LCMyEyB5h69Ui6ZhcN&)(L5Sh(-WKv5P`ACcEwM-AgFW*R9gD&P}-EiOT-{mF~QY8yz8!S zm_zD=b0{refw!;J+kQ^?=+x`X$ChCT*FSn7F|wH@-QG{6;~#d&8MLHG@AuBimGqV_ zuajFwjJet)gAla*8Nb7z1Wp>h(|PnT4fIe?^Z_1Qa3Ed6b{xaQE}UtHIHh{avWYkD zh(Xchw)(GgGr(!tio>MPZlFx>*lS5S@^XHIzLSK@U1Q%+$7k<%0Zu^%kicZt9H%~|%w4bj_26US?SSLrP1;Nw^ zXE{l|q^-MJ)j7UgaY8*S{vxoUf&@+;O5N`(h^Vs2ac8ZAzYbS(h5RMSHbT_?#N#R0 zd(cqiutM9`0#G!h>+{4z{rZ!mteqaEcNqKB4H@cv$rpQPrSXV5`;C~_(7_Y~{CVRo ztV~ADG8>)@0vPp5wxbbcuO2`O&Zx$Ga&^Y*;3mQtIi~wb8}FiWM8B6i_30(Qoyric zJ{Y!gN39oZORIx14oa$ai`AiL2(8mO>(CcD&&6wz11*&74>u8i@<{$|arppu6V4L8 zeYTwMjYfNeqnl3?5u519Fmc-(PmePA*XWh{^*4; zg8)id>48;wuh9VN4zo~m8})#=q#Z-mZ)Xhh+Eqo6krG2h9Fg5$!N96n2GZKQVVTrH+n2#e;6n^nmv$S8@nn8Og- zMZ$N0KLntiS(?+TA!Oqm08{(3vyN~>u(7pp351XzTcD{aX*9=@UCbSENa#Oo~lt-c<2*NkE@>}WUB2F^d^bqW;d-B zivsEU*AVmKNb1GvLaI(%_KmAB1Q6s?(tzZYe4i23qSs&h&S)=Hmaf8K|T~ zU}e@2=UCOZTeU*yhWnUzbGQ5=$&S+IC7GHdzryfvh@{as=XMT|OW6I`x{8W^(J?gu z=N?s;Er4}--CYg6znHz`|Q>YWfn;^-H>5Z8N6QrKXK5a zb;XA9-SiXHl5TjS|LZgv>yhQ!##gn^;Su!&sm~??f^8$?l(MP~Q9J!X{ z!RGZ36Xr{A-4Wa@NR3GLyzqSnQ>U8xSJW=f6`_j1WA?O7?P&9&=ns07ZDD%0qppfA zf>x(&cJZcZW6g}D1byx%uPg+ec)JDOEY_<0xcPAMLL;_Rv^5W?6g?rGx{Ip%@*o!Y z(c!pfYd#%tgi5IW*h_zu2J-Twf*w=)cZWW!jcFosF{=->b9WP*m8K%QLkc_-YSItz zS7nao^<1d^SrhP`PSK3Tw6}0*vY5gT)0!SB729uEgctXTYbiiMjAyriBVQU4ep(mU2KLs_nh#)a z0a9wi_hJit+#idT)enV}@z~jS#6hLsEY8b)ToBO1ZOf<1JG>rE<4sig%^xT3jgWET zPlL}|8;MWv0w*bv&Eo!+C3;=+(8qt0ysC*TB5IN^Bo~Qyixv4~b2_%%_mjluqBd`D zyfpsH-{Sp8qDhhc->`fObMVCdPYFdJ7N6hyk!%;tX<*xC-=CC|`uE_`fI?20Hi4_J z|Gv{QA05G>KPfqBm~U0&jWl2VBPoBV~hU6TO@=h`9}rXgV9?7cIoxb(MkbU@BrzRx4n%y0fTzK!?VZ zuA)lE;;EEqe397HlzDjwEFIP}@q(uANr^Bn8+K4>AFNR%gGMSNa%x zg#`%uX;1<9)`z#irP$}De`hQ8t&85C>M+saxXCIV2bI%}BZ*EABfB)HDQ2hgK)i}r zL9pv8(eU@1Ee$D!J$YlTf`JZFnIj!ifU&9?h@4lj+hVR6f{V=@$gS0&DOhXmB?!{j10fldK2mAHC!JZt0|G0Dc*lUzRL~?JI?K z{Ym*nuc5s3a&@->p{G@;={z8>O`>W_KKh&lXF z*L-w6glZt%@al9_Tv+3}+=O5o^l77WTC>jpwBxMa(h~j-QEEG>T^;#=*y&Zq?Jr4& z2vy6aC#V3${Z0N;ao3~srtclZoWFS@_RX!XFZ;cL8Y*Qyq+@^euUV)54#ACOg`xF4 zHX^1w5>&LbcTRi?41~UEqyfVpBDMD^bHVTD<3Rj$i*weL#6St;sLltK^{>$%!CT>c&t@TOZX=R68nzNF2C|+=6PYP z;t)X^i~n^IbUS$)w?x=Wogv+wb+IFwt<0AA0lWtlb|u2k{GgG>?nr&8Hs zA7QK}?e6B0r%Me9ueaU8@jf=abEEUcRxPsuSX4SLb;ij6j7AC?AD}`ep95g~6zzf;!-Hsa*a+tDf~;Aw_QGsc9(xQF*`@l9KOm`+)Kiphm7S-X zG+S&_g==9xH+HP=VXg_hFdw~ML(NX;g|3t1)Tuwxu*s2oCc#W7;V5NAZ%y^l>8%G< zp9>@>e`P)1O2l~oo6VgzxB!)k8CD_q9?-A2WdMJ_R1Nu26&e6b&-`h*-imvld%UPI zM3NL!yVtgmKmI^AUUD2N-55eo6!49!xG%drjsqoNbLswoIiA90uDmQ{bXmjeKNC#` zb<76u0a$%u7-;V)5?h>O`51q2Mq4;_9JJ5OUQSEZUd_08Y;&TkfV*Q&g1Ht3pJdT` z@`&U1k+IV!e=p1Lp0{)xFJ$nXM7(ymf({j=Xs?FnhbJ)hsOlV?^aIl$Q=U9R!56wt z(Rj_L5`~4pWDPdvHN_PdQ(k1f&E}h|0T&>r_O2-oogi5d?63FH@c#a6J&=$<~0B0kdoN2U*qool@r^Tx;ej@ zdagsfOqKb&vFLw7W$6pcScVaX!EuTn zacIXp4}aR#@X6&~5;m`NowH{>Sp&m-w;)q@@wa{{S5nl{j1r4u;$CLmv2!6?>E~dBoL)@yu-cgnu zx?@%X{5hCwZrZ!VfiM3=Mzbleawm>xWFB9Qn>zs}1RZ2MK&sQtJ&WEe4pok$bs%MX zN#AV4E5iyL!=1dhMd}p9ewciw zTu-bo0n5CN7{QYz?&n0^$^sfYfB5-bi&T4Mb9QaDG?jUhzm89XMQb-l%+e72(tYIf z+bwDGoM!)t9jA(RT$&r!^rg4Yj@#=$u1Y$+MCm~|^UN-SHmXGv5{7+g=XyCZy}nj* zn1E`#Q=YL;anYLT){HIzcu}Ir&QT?6uoloZFY&Z~<*8q$9$D+E8qUVY}5lCt6EV5u1tvV|6uQ}qoQovzESK#kOnCQ0V(MkVpJ56RB{CA#-SNPN(JeVk_J&i zV2Gi6q@|^X20=m?7`p2_5$@;R@AJHSuf5mWf9!9q?OONpkJ~w~^E$5Mtm79aDHDmQ zl$K62W?LV@_!BDgW54nt8NnyZOr2w5E@m?_Y!T&jff{Bxq56GwZe2n&5!T^#14&r? z*#Ow6(H-&_RHCY&b{S7Vbd9d+hO1-?;gr4joNC+ck`CDT|qYUec`;YJ$NwN3u6F%|d#(St2;$QO4_B9+yQvRn&b!zp?97;FY z-=qNVNW1VVD%6)c9-p$p+Wf>|UNI`w=z0<3S zoXSM~6`k4OFN}B6?smI>p6Dovu-xL=*OgZw$MRE63yPX@ky|W!F1Jv(ehA`2$7e0U6PQVBB6F+YzRjzx#3po>YX~w0WmP%q2VH{%C3&||iq9G$ zTRd8=)B!$!U%$|POBSkZd<8-!UhBt@lVXC5ZmXH**gQvl7@*J z)!bonded*5tF8{e$V79_Q!c-6W0-mtU~%8VDZh5qF2JXcwUFP z&%8CBxHbw2V7&Dd~v$tQG*lX3k`tg|~G1a53cdYfwN0Dl(wMQRa3JT;>#D5h8V*i8}rz4l&lqd z4HsZVY;s`%*0xCJZ8XbFXJnVG0y~2Uf(;XM*4cZniaSE-4NXgOa6-mS2cP9zG=53$;C;(UMjIHp}5Uo7Jk8>(|Cij$Os=5+>)RkysoekQv@91rx|fVtM)r6h^oMd zag<;D*YofkQojadl__TYA8-}8_IMuM^}58(vAy^8iXvwjmDU8Y<{Dt%eo2{*wo8Iv z$738j(N#GqVSO`xy=Wby*KopO*>itVg`RfL7}KS8Jj&~?21o1n^sQSGa{8&0BO8DMkm) ztZhx1aO%7$=5BzDFkl`5zAgxwp5pCBh~2}_oZIhd4H9dHn;`~+w&6-WcQHd42UN() zuXTSqiVwh+4E)=-BIZO`KZU#;kp5G4Kk;5UhAMC6Veeu@WRZ-B*V);61tbrVg*h#N za;)O^#dV;C@h^-yo9cliahH&r_WyxdNe71ou&wI)w#tkd0wnpf#l&7&6hlNko2#1n zWcz~Tqe5w9F9k|b{J(c~0ni{v@(30{H3~S_W%|NQLD~Mk)Zee){;VG`88SQHld6-sKaE=dEOt9KZ*HEwTua7AQU!mZEf}|KZXefLsV%RTS*mbXvSMam zZmO@A%Z0hwygUeW&itIQz``%I<4#8Vkb!`Kwmj`Yjm2kP>vnaCP-|fU3V1-asV!-_4vLS`M)NFWGFWxT!2*bE7CV^ePVmFG|^2YoqO89I3O%k?#yC*&0+@ey6 zht}SRC?HAvMOrUcIlrjRb=~-5$!5nC{j+wwk$V3_Bjl;Sk?!gxb_K$EV(9JPrdUo3 z7aB$mr7!gJRkJM;U7{7G7p0l;=Wd1sm3GY`6L7!-V^H z3pYFk{~HP8Qyz^fq2InXK@@Lp1+4E>!`DoLnMmthW|MIDmg*;mU8wu25R1&b*0%^e zOB836zLkkoG_ML*Vr_ml(blqsq^M1DQ))%4iz;6~UH{~YVbVw2<3yZJce=Z-R(p?r zd6KIimdkwq>g&|vh-g7U0>RN$3N8}tli~a+`DUgEE*42o2TU82lGwHLBd~g$GBZN1$bAuO>pX<}uwQ;L2@xUD^;pL2tXB!L-0n9T5k+LC&JePoK3!Rdg z`N2?txQh!hST3eLHS>rZBL&6{!-*`3NrN9-EGj1c2E?}paqW2RitAGwGh=0PnteZV zVI@wMeaGHx5_KxQA(N55wbvZ)oxNETN-?|aZa10q?NGgE0jBJ^UqwfFs=O<_?qz2GVCF5|l@>7u!KIYqz${2RiQ&Ps zDEAhK9Wr8wi9Z`^au5}5O=?Ds<=^pc{f$vuyC%#@3j`LJkP|Kv7@|GGm`vNd&*D9p z3%;k#AU_Lt@t^|xUW-4225EEl^2pv^MxDc)Ln%t|^~5_Nzm_q-?%N4nYU=t+=+PiF zAtWsc)CD#P}SLJX(W6|=q_t5$w;2<2OA*1QHAe&pj9VTy;cD|CeUp6 z>#R5WE*GDh&7u@NRvRw;2=+7=!W~^kmzdCD|46*5pSS^)spd&o;fA?Nho4Yh0Q03U z0AbM46Z5>jH$9nX{li*o6XcS9ZPK1aV%R!G6#sYwWb3IHBok;j7GA(EE2sq`G~FHx z6}@|5t~!}1>SIaZ^|wdgr@;SdDB+x_Wha`68caT7-1;RfIkHBCHl#X!TH4S zrg&I$joI@IVyxeCZk`27F;M9nc5Umit#4lpZC)*;9qf9-cIv(R5U7@bQ^ zab-gFxGYx7N$#1ep^*m1L^`KL%9jzG73*YmiCR*731$5ht@(j|erHJJ=@NS~G5a$S zTyZk6+>3qUz&kvc&-hVO5H*(<_6EGZ;ecwXIe47%)XC$f+Oh#xaKZKKJ)P1hDh4&7 z2UbIa2_RnJDXc)=!!9z)dU#cc>g*w{A(8*g{ydm4(Tggv%y&)eJkpCi*MsN7?zQ-+ zTiqsHb`HF4ZL3h2lek0PdP9m}H1O5aV5f)j7}=?yjfdtQuyDJ5qNbtrUD`D-?=0X%=9u2i04y3za?j`S$EQ*CjFfpUbMhiBsyoT`R_e& zD@q~z8r;6bX3)g}Z!KV=dK#qYP&)D>(G%Vk=H%Z;z_GbIxsmppe#rEo@e^~P=Y8M` z242ghC;rott7X&k+uzlFYp;tc1I-P1;&VB$Gr@4iD@!C#*^P}|ncSkw*`q3liY&%a zxFqeSZSFMzdf?3)1g#RSx0hv{qBZdl7etuP-)DLdlr9>jOF7nn;w0OD@+6(mv8_N{ zAt<2YI;QkaW|;36qp5bY(j9M;Yi+Ry2iL*778w?a;?vbI8lPppY6!w$%tM0^8>s5U zzoT}$^tWYyS5S@7*W+`v>*UHTB;}H91NE+jU_^8uu~n|v8hrkERfU0Q{A*Pdqo|MY zaSsy}Q$bpVP=MgKu|mX&Cq~@XkBY(TLh4451S7qm1i}_mSf+dJne1s1q!^lV_*^VT zo4>-JjJ_JlY&f{cJ!mG~`p@2n7Mr?1IFT%fzQh-E^tYs8qdVnD+OZcalRebmyD)n+ z>Jm7z-nJh|y-i_XG^U|T7&@?DrB{gALdUR$BEHQX$_6{4mF0y+*_I)QObY%`ks+9*1AT{Ihkru|MD`8AKTM&Sj z1HU}Gd%y?)EP-rYe4Ez8sM}y2q>vC1wq>k~tQT}}5Mc>GFj%W<&R-He;GDX-9wXkt zu0QKvB&QNa7-wf*%o9;?@WFpvGV&XbsE!v8+=UWe$jJ0hRmC46pPY~WnpIUrkYWrq zr1{y?FiTa=efNb9_FE8QVLU*9O`b~pjgr4esAhN=fqXi#6Wo&KHa1nrxI1ZU#hIw# zrm~Pufx>b^U}r^u$4>{zyH!{Py6+1%#aLs7**S8bo6a`y+lY`^7$LXD%EcAFCU3>BPXx-yI^l&$M+_PhU0D8Q4Wq<7f zzj>t30XEt5ctrPT&lgJIQ`bj-yy1&J*t9-gU*6ahsDRB)c$TOP-sU02dn;~#uedrL zoZ=o{0{{Iu?WO8(BX;P)bJ7kPa-oB{<^A>}cniDDx)rH<8kfRq zSIW8L*~$l5lFQqLF}ArEltBx7p?c?%mir-I=ME%iQy$|zj~Ce({EtT1?0Tu(-%R;1 z$Fr3UHU~$fQgjMnY^}uEv+k621G-Lu%8f^(3iZA3@#NcRoZ)#V{t?g5p$KmAnvwwL z1w4Ur3a^IxOVLi-nDmWq|NZnSV~IjQ(vY7c^gO^$9PR3wjvlQ~cpk1Vdv4K{kxWyx z!sa%>NEK$b|AqRGK=twCRv|};kK%iLxU7sAC)D`Su;xU4-JTq^+(|}fKg5Z^vDt_~ ztYp9eke9y!3Ha66LVqW=^KY}NiXLzN`Lt3CiSIEc$@*?=g$k(@)1F`U-BUUaG_3t~ z3%dbwK~Hn`yP@leFT~s14+gTY>|Y!1+p}`VDO?can}ts$1^{h4SN?Oc-9fqcm($F< z$FN=owoUB@w97+1YRZ(Lq5vufe`8U45(~V~*X#v>F&EzR*axOV_UXs#$HKdTQwH>N zmvhZ@__ATmXw{55PVLK}Rsu3S-Ize^9|^veJSX%HspOw#8d#E}3cDqOd&Ak@cAIWLWiM0BGwXH&FCd=WD>)R<7uY+N4sBln%I3B zHjTkQm)Ns4YK3=SEIbk`^hb>D2E7cAxr_>N(htkTZGA%@u1_3uAI;@; zCaS~-u)MZHu5WX5?nyeyMFZ-c|N24K#PLBiTC+2|o!IKQX1&Y83m;Dc&m8 z!on>hN}9zU`b`1h&M2-Hc3u+_taEhiHxE3W3`gW|U4?bu<1o60!rkJ{M~#>twBH|X zD$P;J?}7o^7|+W$j7uozzVf}O{ay1vb_Zv1=Dcqh`KuN}-6~c6i&f0tA5n!gauXv} zo)s`;#@59(_+>umTr(-l9OR2X^e5>~g7N^E(LDA-=s(XQOo}GT_ZjNeWvof07j}Vkkxh9K3X=M*A@3EsfBVw> z;nh=3{+b6?VxC@6N41d4;MXPv?<+@23JTR8j3+@f?SyXr&o86dqHW8!IO6qMsGz!n zM4WV-39w(~k~lo)gYQHauu@nnxeKT}YMguP^Pd6DF`~=kYd7{zXuN6gKF~eE?cNqv z4wTom0$N7Ja9p0t9-U(B(K$5a*i^xjSpH8vj|h59Oo$nh(czogI0#Tof|;^IV@1`! zf;Iblq5gjiNHdo1Sa!SE1`-{D_NyTj*s_=XJG)mS4a1XzK&@lrKl^yIF|X{I1gtp# z$}ePpLF1bpl21a^rhu(u$ zJD0QVvWK$7W#>C33~8hI2JPVuU`r$QM2`W?eHkra7C!UhIGcHXM!GdBY=NW;3v~Cn ziDtg@rwkRcr6!6CCq=t`r@96B6Mo>-#jhZG6$GdkOrHNX`po27ulAJ(4WdLn`*fD3 z#QV~VcA*;v$>*HZH*xjKv&;c4Q>C4>56hiTa1HX>|Lno1NFp;jWZ~V7txo*SSig}2 z3LjP+li(Gd?^B%5a_&8jjW=Vq#|ig7;lAG5I0AMb`B%X#{15v+=5zvYs>{{d)=Lat zF-V@&m3_0b>I8Ms*rPdESF_UVRtsh~U~7WlnAwBAGeicKN`sl4=s)9`vwOJ9&D0`& z?3_D?A>z_Xf3!B>UYTpYoR|$i+L(LLov-G`7wK86=y*=>Tx-5X+T|k>NBP4^FbPYW z%pM;$A1_LE>4wLl6mN+gKB6!=JlQ!EZeVAnDq$HoPCLBkO*Bsb{sncMZ38$JV866Q z3i5ca1s2`&Tv(4hCh+p{JOo>d{kG(~?HnqqCzx!l7*EKJb21A2JVH`fDccwleSoKV294yVEz zT>#gR;B~|p2L0RQ$9#A6Fm--OD78(>L1XU;Lg`)i3~PY&IL(6Y@d1`Tat=S!wdzbBnsX?OuCGh_Rlhy@bT{*LSq5$IrMZ~RpyEl zhsB~-(E!8Hebb8<^Zs-lj%k7(C$xd(M$EfCSEJ8+#%)ZxAldD6 z4T*CViQ#mse6Q-DThCN}s}g)KG$9ZuX#v(IbKbAShZTfRE*Tm!kGQP=SMl*#{B%nJ zPTEbGG}wd*vD~HUSb({J?rR8P1LZWaO@0V)_}3FWMKLrNnjqWkqL#LZ(o12>{Ev|* z>pqy+j`$#J!7L%c1!VCG|~#g zvT{Mo zoN>l-HnpQ^C*Fxc4fs>s4j60ITiX-MxIap`9d8Wof)TqKZPat4V;iqquV*Ur!U(=aLa zi4Gm%9sU6oKc=FoHEq4_(g)hAJc4!+_C`)CGpQ0wxXrU&EV#{MY9 zmY8_u<#D`{vsPw7D-{mA;Q=!FUvhqpKS0HX>Toh#V$yE3qKf#0iFYZ(tNjhx4e-1t}{W8_}y`O(HLjX_fT7M7oK&|^=pWE{U^rW)I`~L68UJU6Ca z>mO7-Y$XM~u-os-J=lyI*DOnVDl(KLJgk4-;EzG#rwiE`V2i+!g=0cR1{huWb_UrR zyPy|EfMQX~$xC=*9ETfddeD z@Hb-}U?(x}8$slkDa(5__%n@g_ci2TS1jlKgtcA$`6YMp<`Bd%0TPs#kM?l3n=7e% zL{6S*Qk+=;%v!9kd;=UXZhQxm2WadeXJ8;AHCsg0I>l9AkbSlHU31_HQ~f3Ko{J)H zg&mQ-&U!+EXgW2`EEr4aw^kU7ZEfdgAG8qR=QEl@Ta^KA`B%q^Jqr*lyBz1hT`BuKo!lye`YZx;Emo{iJRM+_i||bDR^w`iC+qZ!3N`qW#4eS z01sKH%TTpg!tN~e+Ka~y{2{bhewx9-G{_-|h1HnCotrgmm=?|jKUj0ck`+D4xUJTj z&c!=tB_(4)(3xRb&gvAxN7HXJU2n{T6K=G(9Fu}I+geByAR=`d_}PbOPk-@8Okd=- z?{D9MHAB!wj9d{#-iSNzq1xZ9FZi|s7BT44`Jlu{hAb4 z$Wht8muJwgS{bWkrS3I{A~bKpTlyhW`1SrXPlIo2IP|IpAj0FXJp{-6le9cpUv^Kl z(h#~o4pA~B3>w>FI(}oDenkv+T_GxuFt@5_&9r8mt|?Gsi*Cbs)WWs`vVT|y++Zhb z8T0)1+nMy)^>B(# z2Rkfr6GQpE`}PXWGzN)M7uYkNYQHH+oLxJDtg1{cL@iiw19y&gDSXF5{qvirYX8B< zCfiJSz##^Zs<@w2aV&@#d?)E0b8ZO;6RUttpQTrasAF2sHH4`p+cY}b(NUjb#^X2o$91T(b16&%)^;-dHng; z{qNn6XX;?a@Mz*AEhb8;vvo13i#2Xi0h1;R_OEpOh=j2*n?%4#V~dq zK=A-RdrqMPK#kgH9`gHuZT-)TB_dRo6<$~A!1yY0b0vklX8-lPQ^$T$T|BSNeBO^e z{lqG3EXK1hkV=^cd2JTyUwRuKp8s8O$*N{uGHuc8Q+S&>x%IZ)vgtrlZvCX}A^%9e zYU%a!x6amXQ27r5Vc(mzC40i=?p#!pet|w`@B0=Zoetrb2rKnQ|M)z@l!Onjpki^2 z)FLAtT*c*W<`#t*|B06KpU-wfc5Gmaqj&dg0X+HZe?yPTPX+(&I@N$UrJ=qi&Rno) zoM@~6e+SP0+n+SyTi3*RJYzymVRl#T#VauPBP(ami+wf6dv&-t=)ua~q4YA^s(94* z9KWGN{y)d&Gi%O#w`6qHLfoW6^-;09+`%ebc*IPSAQgW-j$Y@G)c-2=Qa#=H$*J1^W0qrmE zSVH7K$Ffts{@bJx$4~q#id`6umPU!)c4M$n6~3Cz3|AN_YG8Ud_AC4wMaHfksX-#@ zf9{mvsNUm=;);}(^y?KEx5`RySo4j>l78mL;rtfCAf`|WLKTA}EnPbKq+3q-qg$wSQ$E73iVmA9rUBmyf9kR>8)5U4CC zaIe2BwoE-?hzC|?6eqf=02%B4x*o3?Ehnb@rqGOR(7k(eLMOJQ1vTwf`5umyCx!I0 z=yI0w4T$SBS0i5QR^+z3H_M=fwqecw_3cx^R83yA)l7~9aj<4-WFbHSeig+KA}txm zZd06a;fm_tgj)^qXJt+U(y^omuvPVYrW_F|7k+(Gx(3_e?A zZ*Y^6sY#2kt98^lp2g=Q$7ZeVTZ=$V5(s@Ig-+;HUyuH|E36udFsT{A%jk5IfK$(7 z>_ZWq)}s^L3)riPKyqgXvgAyQM`?FE|J5=ip^VTrVO(G!#yoF1#vb_JXxt#l&6)gS zHL%g@ez}m-nx^4XnYGi>gg39dwblLb#1f|$$|b}vn-+fmitc0FTu`v;4W$!L^gnSb z?BFHb9)tx`-&$|(drt9zVwV;kL01xhAV>Y}ks#<17zQXs5L6~Gp8QVTTZFH#T}`3w z*|ZiHB9*D?2A+&hf@VrqhlOtX^o`MYtu@_+`$Lm%4nQ=m!=snH3u%uuoM;QlT6il+ z>lMTDj7p(zHXPD{hn>6H3*+SH+Qi$CD9F-%ielFZFcb_NsekpwcKLwRV!+(RTnmI{ z0QT@%hT{1im2=m#mgZ@qxmKu9cqt@KGIB>}^M#GyE553I?LfE4NE3+&L0bDu1i_Bgl*XuVPe|Fw54z zPAHnK9iLTmx!L?igvOP2K}-ws{fLW6p2VN>K*+a&WvCU!sU_OMeg-jDkx<=Y`T_Z9 zDY34gX~}{d9WS**7uvajzrRi^W)r~@_~GqWX(iKP7|WoIR(9x-g_N{bwFdJ2>&hPb zh&yUjK{i~ru6>iJ&Vs)oBn$*0gm@tBJ&JY2@e8B=-a8xBN7kIEJFYtsOELU%qrbxx zVegsrDhq<@oH=al`1sKJg=y|g?@L)zsrQ}o|YpabukRo{orSuCY;5@OwrZXH~Y zQXveD+d2Z~u_01z@%?FK2blqz<71U9>iQZ(4=0BjAe&OiC6E5f>M{~#wB_bxNGuY8 z?3MoHxZs?#Y&RJ)gz5BKDk&(UrN>;6ehLhFKmXo(9ClkM~%|hMcAcSh>OpP*@jEcvW5wMp- zPCvy(QVnwaN`X8j75)Upyr{O9CP0wC9)u`qm2lzu!(DucKCXjTicUTDnO?(QHu~NY z#ZTR+t!I8oIy5PS!jwkYmn(*il5>n*HJX&nH)>o!6jZ+2Ml9c|m`d=M=-Ok2Q6ah8 zyYZo*AJhu#8+HdR?l!$)N9BvCsfvbnJ63UA_+-R~_HjL=WkH z;!6JIwB#JoQa8hdiD&1BK6E3y&w;6+Ve8@HY$0iif2AB&LZN~~s<7zB=--YCo^D$F^2&?l>{dSRnm?5*EW>}+LaJZluD=%ncmPA%-b0}~ZMn$wLb70&luG#2_XX4V zu|E$iAI#d2!<+-bg0K!srKZi~P*&W2$WSkVKjKr_-{iG{qh~ST9Iv0Vyw%klJYmg{ zia!OfYz|zEo-FY+%RN-W$rHGhC{mi1b^R20U>IubuhVXDy#HD8J}`4I2;Rz8@B0XQvC;v4d-I}>diyfj|C{#nSJ7^lMaUuA0X6moKm4liVv{zc3gHXA)%+T|8cW2 zwEFlx3=uRQcO=FP1Kh}$Q&txeAnUcL!#J(xAcXg<3hrCIh@3*6Q*vMDtbgHx9HqRm zO88+vO$*C@0EIivZ43wR$s1ULH<(sVw2_~lHdX)rqSCqd`Aa0x`?^O{ z(fQAxo_>LQR?#?wLH$qZRi!u3aLLdo15KQE?_I~*i{ij5GHESOCj5K=v*V3ib z(>?1Q28o5_G zPF&?ElSsa$eUlNqF0P{N6Aq-jiJ*sJejA&y_8r5wK$Rfrj=#HIW2XslQXcVVlPZtM9#I0d?QR5Qf zyYXz`;hNO&>UnLBnwlfxv&?B;e@SJQO>8R@&ss7}gtECl&hzS!zMS+T*vxw*Av9MK zqBRslQ9%^tJQ?LtGBq2bl17|%GAyyM=CK!iZJtP&sj7@7=YI{t-~_F}U<5J6BEH3r zv@F)!MhuTAX8~0PAt^p%$GfcH{bZHxP2L@w62s^>`s4Gj z541v6!i%~)%`8vG*&4_VL13mnSpB>sG_p5T!5$Mjp5T<%CwH=$1d_d}smynVjgUAu zw&(x7A2&h}8#isHhVFlL9b3I&psHj5HdIqM7F-!Rp6GC3#UWJ?}qE9zE)JA zMxCJZ4u!U4*`yR7Qy!vn!dWhJ>VeeDifO@i6wcPccixIs;m_v^!6#_3$=oT0U#sM0 zaBfBrkj_-#;rlRz92;pZ?4%^hfqD7sY*so6NXUtcFSQ!%mYieLX2n!?(I$ss;@^P{ zNrACY7TH!pY|gg0_jWAD^JCiqgbU3fGz=@)YLPQ7(r7KKb{N_eIA={IYmga&zP_7O zZsb?xIG_q~T1gL8KV`e*9- zQC_?O%W!gWO(`puUes&esIVjbl50u{@Ca0IFrvZuJ`z~|-UrdCKF!-yVf}`{!tMPe z+1}$aA>AsGky52JZCjfY5Lli5iuJ&Ne)Phh+w&KNc0SH=SJZEqjt>M5@;Ox_MDlyb zZG=9W?7vBgf2nDGzI)CZT@&V!K5RCcECjY)*_y;{%hol(h`_z+_5)K5UmRTSbafXl z3A4unECX9o*}>9He5EvvlJSl9DpUI2+|Fo)_1&9&>wwf91dBhErB%JDK!m+tD%0wx zO)LETG_AuAZs<6s&8JV-boRw~Kh+FB^#MNGJ@Wxx)}pyro-l4bJw`u1cK@+8Sc5jm zt#$Jz;#aBU%lCGSKXzEM)v(_9#6n9J8_dApKmOKR4%|*vHocan9K62{oUU)du3GC~ zel+|Og!^&RuqVE6uXoBqEguIy0t+&E65{539z4v!Qio$(H?Kzd7g={@z~HP#is4+x=iG zn^Ju^4lL4q>MCQi1Qcr>rP;MLFOGZiwL9!e&nYH?Wk9Mkha?E`X83+e)qom{0MPJ% zZSfNr&TBZlyQP;N{60D;6cL`Cu2PeI!S__u{7`De`nR?@K)yB8wdZm1AMfR!_XA@2 z34(Tq14kz}nd#!MwZcIsonEY1U7qAqNPR=wLQ&HCiAA0%A)soY^w&ZP{OPAuThDO` zjK8~%_nXb$(pobmI_x(-Oh<;bux&7`8P@(^BPruH)=cZql#YgGmGcO2%(H0FT+--S z2`F8DxrRqaiUpTKer398Kr5ej>NFryhi=El)6Y-zBTk_7(3a=Lk(1ST8Ou9L1bf1r zsbVL_Lr=OlN?^@=K2XBN^s|GD1WVjfL)-rT?4nUDxKu{Y0Y$w%r_unCvcTWxbw!j~ z)L)$i+qtl@TF2xXz|KPbvszJ$lqRVGMW40pjT}V_d>%$;D^R39+1s^TAdWBGdGrTt z{N_Ff6F)_I&7V39+`*3I;SNOs>W-|!v>_#wR@8RU+>J)Dr+Km4B7bP7I+p!NKPF>a|$NikP zvt67R5$A@u#t&1n{uGN((igFx0Tkqy-1k(H`cSDZwx4t&5q6~)`(Ijk7IG{;#V>P& z{qnRZ5bsSbCkASx5?;qRI*Cg5vQ3ET;FAmY*b%1tbAC@x(nj_gfz}~wSDgf4zX0*J zbg2IwO3{I8uljKGWe1>_yA}pQ(C0E}fe5nb%o5eE4i!?uKnq`p3)B|Tep57q=|7z_ z>S5BQa;ey#FqTgrSOJZ4{mgWAZPAdn{N1wOQm$@io80hGW%2QA>{NIH0O|A^G=Wr6 z-yhgOKFxnY5Q-p>jV@vY%FchVWJL}P>!LFsAyZ2i=bs+6@}51gJx$oP4?+aBGGYWV zJO+e&s}_Z?1^mHM&{u7~N<8-rWWiZ&zb_bZ7uVmt#lmwhMsNpg)s%{{tMn3ATJHwM z@S-nBoe7Kp>!SVXw%G5@1zd}Z4tyX_BB$a=J>bGr=l+##h)84oi4YS)gm0%5K2 zv1YhN5tJ4TOU@E@ZQM&4VM^Eeb<{mJ7Vb=>baFME!sWVmr|zWyiUr= z>+#LSiDJNH_N0!qVB&7;g6){@1FPowXl%dNSY;J2eGxXhJGo#4Tbc30ch7%}^7kpJ z?$;jw;;O;s@3v@Yjr%^XK0~+W4HuND0TSa=m=PN%c+tEt+4J_R^L_mzx>ewr*MW5? zXWWS&?0!^YNm<2yxT3(sUCbl<-O%xG+PEzUF_~rH$Tc3HQ_d6tnyR-?uJ=RIlsh?S z(|aYwb$8w2oq5FJK`Eh?@<~zr0ci0s_VhljHRVJz#H1qkNE##N(d(>G9ovic9>2v% zWV14`z5Cz4objG$48d8j+HHHXp$;gxO&6j|D{mg#y*FjMNpD%0eQmq+w{8yK>e~z7 z+T0v0J!dgtfRv39%0LVOb&}xw{nRXRF|F-x_EBs>^nycUQV`K;ux*?>2HT>?4%G?v zb*JC#PI`xf*5_J=a8Q0U{X(zkzM_@F_6v)mWY5Ew)EIfOUwCYM^sh#e$`S3b=Duf4 zq79Hg{uJoGA(BY?>Ppw+57!jFFnl)rOW1u|?~fpMdhd3))a(0bL=YKKKJp$m=Mu+n zeAP;QxZh}7pVl1;=rW%=+-xjeXVn{F(q(j$2SC8iyyrcjkf>N7iS!z8Ky?luzC5hC zj*G1*E6f{;;+Nbq3Oc0(zm=rM!rc$=d5f~xbr7IB*ZGZGf8h+RCyvaHO?62w(SV#K zFpwxK5x38_L>4-^&=Wc-&Y*x#_a8uU7)934-OujrS)pnV9a#EA-xYNF0YkurLoBas zZLU{SoiwT6y0Te+rkdrQz4mq6 zE1@}7n8Jg}{E>Bb(|7w%72uZ&m)bWR4OGhKNtlOkE(TQ=RK636HQNIg#oMYBwI5tQ zzU*9W^K`KmL=|agE!F$NDWqqfk~#hey8$EwEX&X!$D}cq)d~f;>FI|wgd+`ipnnQ? zw!jToE^!>jA04^p_7cq{o}2}Ei@HjSq#1%5V53`m1N;zJ9O89A-STEv|C<<&gQNU$ zPDcvmL3BVAHbNT6mp!A{dTpdC8(d2V1dN%t(yxuVvc}I-Ci-B4q7J#-&6{Omo$GxN zW(@mJ4;jT!pgxqP0+sNxLZ|djb7sLlV<0S zt`|?U6t^ZP-Wea`n!W;Hhv9;Olwp~FWy%V<1S+{%LZb2-@#Qwg17h{1bJj(oGtz|L z-GI@;`FAzSDbF6*tg?x)qm9SpkxL!Q=NkNAEMu8KnjcZYHJ`KY9=DODPkxJvy?klg zB7dsi16ny_rAP6w&|)p2QQ;%fZIL(t)U%q|N-tbxA2Gc-b?1rD^99sPJ0|t2BS)&N zif`3ZR0OgTdLJrPC-PVHj##jjC z;Kfq@lz4fv%xqQ@8B?dPaal`3*XJV%4)cdT`V%!(UBzX|rV_3V>Uk|KzStQsyq`^!v_B0O@_+Uq(sw~Gv)c5Y;z2v=BBYn5!T zUi@&oEVLvx&9aKxK}$B87S1*}BF&-G-SyGB!7y=ZOlg=ue!kK6qp5%+eF!J)aH&AW z^@ZG)B`Wo)B|1V{83BSILlB6l3gI6+giypxv&ClNYZXXfcK2Ar9^tc9zi+AGR~^i3 z`f`iwwhCesr*$Rpb`dh`=@_BnfppoGG`Y{iaEC)#L_J-5>-|dSR4L@|s;`ylzS6FT zZ=LCz++8Z&%aYll64nv5W_!O?Outj(6o059;sD`r{E%iFi2?U%_eoe(bYRe;ta``iH&7dl_O> zNZF%69|uu&gCGW6OLx#6tq9BLoNMI8$hsl$oi&_RtND2&E}ZIxehG79Rx68lIPd8X z^o{*mnT%FS4oaSY2zA5R=xp${czZ3bFS$F3`iy2aMRWH?R~RVhZP%bmL-@1D*Vu_K z3OQaYjT(L$0=P|y9lS6@x-+pyWSy1B98gEYw0+rVpQ z$M_e)9^bhAj2(xeh_0N?@wCZ1y3gxS-rH3A zc8!_j!TXOU*c?R$=V6-+3dmB!4t^eG_~qtZFQ;Xg@W}KRy4PQQ>yyfl8WZh5+_1l> zXhTx-ff_cwUJzo!?zxl{GCcuJqkA?_SAU&8+4h3O7%q}d9FH#$G3~*)$WGc_uYNQf z5v-ccC{I7%-$*V)kM$#xUo;6AEOb6Bd7i-W#>to=(4vf^YXZdR)6990IVhjt`f0u0&OBJwnU}42C~V)?JT34n4?HR2r&rjB@)a zZzCD8f-^?jEfIt*R+R2Rh$2UMapIY|R1(gxX(cI!& zAM~hH;ScYJN;LVM+x}GEjZ3Ba`^pV;%rRb(q<$`~KHN$vwSlFOu$gFz|JB}iMm4>B z?FJhv0xBvB1P*W%5g`K7n~kD0DM|$CO?nNziWI2=LI_o<(wh(<^cJZ~RZ8eR^d9P+ zfd0>U-+SLr_tRbLuH^^U@(0fB*|TTQ?EO5?3u9;sYs%0Ixd%)O_VVZpI+8TA7hdSn z(y}=!OnTqHiS8R~O-YHf0Q8piimI?ci*O}86%^J*1nE*RCUZmqpCbhi*H z{N+rJmhKTJM{*Z{mti(~!&{=g2vjhi74x4HCK$0A3JBB!EIL)%r<& zPsdAFaHw>6P7ka1_^B3QCFd+E5~67oIp#X}$}o^3C7(y_wcm6z{Uk+deWY`y z_qT1ENnQMLPX(MHk=OB3OJVat-tjNHLN;znQi`O%xQ2Y9%Bsy}wSJlXwIuSCkpx25 zbjkQmuNL)%ZXbRMZM49s`9)10M^oLd0B(7XLRIs+r<}fdC*OsW8+K|DiX4@?77~+G zyDcHQ<5V)NP~%&JO_*jnGvi}4WA*5|bhJSyG6)eH|J>%rTUt6P_SoSt{ekjJhaL?0 zmF9t^5nRecOG8@u7s~8becKLd_XvwVLTlg7#MMaH=ej@DCyizld1robTAGv`*<_anC&v!`oYV+>|A{sTW zS;gW${VjSCT?-1>I^*X9kZ~RW*?D&m%QQ~aE(?!4XTN%qG%f0PS_+gTi_;MNBD~VGd>K4c#SALto*3yQ+Aa0R@+&_*_f(0SD)>Ej{ZFZFF-R~HQj!Q^Ic5yE3{T0j*4tu$iZ%=B>A>fFiFIg3WX8K zn8x-kN4G&A3YbKXqrbH>mK9Zs37?2ec6db7AKhb!X_S1>zUtC7z?1ko zgDJ=2S3|lEl(pqKdEBb^Y6&^@W3dz7x;HC%@`C|cRb1=+TK5f=at8uzDR(mAjC`+x zPMm7Moyw)U@n!6{$pmTYNRZn*G)hcgQJaNh7tTn&$Ogkhr7SavsfpXrelBgrsz1`E zF*{J?7cJ6_Lz%A6Tbm2mw5MGVZ*J^W59{WlZ8%xLGw01CDypV`QZz~TtVcXBbMCR3 z%>|cf=s6p1=NeMupX9Ljhh%p@_Q7|u(Pe@z6H_~{u)M@m!N~asZdo`Z+&%;PdIAnLyQo9l+v*w<}$6O^!g2 za+g@Vc`X;pzyK<|wKC1mlWl!hd^k$k{Ymvqhy_20DeA~>zyQ$FAS+DQvuwE^Ay>D8 z8Vhvd)<0&vuD(N;c>^oxyL3i;kOdW_Ja14YwCDs8T(^?pu-wTI*rL~^ZPT$r^jUhKDG0Ws0S0K}ZB z?M9>Z)N7vJ6;UW`xWYANr4uT+!R&ee$bg_mGY5SPV1;RoZrS$u>%`9UT*pi+-P$_c zUl*@!1^JXzuLU6{@Mq`4&XV0w->=O#26E8`e9y6@5_NW}suvg|0@$S;9BZ~&OTms(3bgxLX}dQEkOSR%?e5R2 z5Tn~)gAl>R9fd8WldYu&S>vvPjmkRf60YY3lQj52f$t0UB1B{@Jzo=#6MO_{L>+6K z9gQSDy%^-9K@CJJhM$)GSfWvS`d&RJWl~De_6d{4nm$&#OyG;U^Jkj3KmE*$i@f%@ z?AJ4T^ox>>lo!uAs`ydqMB260UR?V9fwHbQnEP;LPJ{tQE?%D=s zZbx6E{MH*q{gSY4dX-|^G?)>>du(QtRk);E_7DE2v)`?NW3XHhs+iS&y0elYnZ zOW(+>AIPEl?8bG9ORX4QgLZVxB_KBuRVf+wEa zHVAe42`t6nWPpW5dQn&jF@SF6C0R$Zl$8d6O;%6F=IWBwNs`dSdCEgylxNeVLQSbr z5UrEg5%KHFQ`V=v2j4EM#pzMqEOH!MFM~@~KEC6|qAV{X(>#F73tLkArOWpoachvg z8Oz<-%4eFE(%=^;arY6lo3TYR?{6PoxKV+62F#eh?wgdctV0%n5=`lvW{q#Qrs|j# z4%F&jCckMB@84kOJTFC^HoGp7EvJ2bLhpeq*+QV*6vf@7JpF72{QcpXXwf||_opAG z*F;~F&gU>$;AIFaeYc^O7M>x6LL|R96KHmehO$AtZ>i61e4@cWrhcXVWm=|G^(B;s z>IMBQ=3JEmTt?(6LWDV#%y}Mk2-;#E7QxdLkVB!@n0cpXaw@Zbaj;b0i-N~=+tx$j z(Istm=@nmAU;2q$dZk?!7YiqiLMi0SeV9$&VNwrKtv6YdNkI{DIfff@QqvVKuIn#<( zi2s6#-i_4-)UQv15vEZAf95m*XA!izWW<^1si610@1;IWIQFHK{Pv&nOR*H0xiUZJhH6&oq;ce|#HWXsJNi1z^U|`Y zzUB%PGNXP#NI)02~*np8}aIwOl7W_39wne131vc?w}qc62D z>zu`vQ4*X>?)#3B^sO2WsjQEWXSdWaB*+mw7~Jhos0#A+)w7=V8r( zAa4Yx3qHgnuV>M|!hw`CWP*~XgHE-1PxFgKYN zkBPnK>B$E)q*2teS!)}33r#W9nOVutv@%~EPcF*RrMkK7&Z4DYhC}#i^(#!if9YuU zM~JC$XKFP&JpQt5C)SwG{w~bXYl)vQZn*oVg9Pr-P4EW@5 zvO*|x$Adt$d+Ly2Gp&fW3^?an)XH7YF)+YBX05DnHeT4yw`YL}O)2SC^=fv8!(=(Mjb} zmlg*bCC&_Ou#T>VP~7r?x$G7q^K5(e#<|U_LookrP0*qPz%V=aO_NcfOeWvZ=Ei0fK|g!X)9V4 z?GW}#m25aRN{erqWq>UZp~zg7eJ-c>J%@yGQ@|Lc=d%`0J>l}*_q^}F6sc!$%#onv zH1i{jE5g%4q&9x%|JSMTww}SOOwbTpO~qu5%6$PE+NbQO?H>uQMvuOX$;l5>hFs_P zywu}E=FQg0)yqj^zMfn=DKlw%)2ym6Hbd=-F4va!RdA3ldk<&})M5=MJQz&=*>gZm zx9eVgywLc|!}=dRxbdPx2S1%@6_g~5lI;@x&7H>eXB+$R+-$@8dGGwMNK|O-GxNSh zP6Np$1^x3XCesAye)X+L#_QE-8?tw{e+e%jG!0am*k5Gh{u+eieGzvG$#%^OzoIAv z!si2x^Y$CyhFhFQXqlXJ$EN+c8fRqvNOHIzt|HRSk9En@3@x249&wpTjHQA|4gFSk zNI^K`Z&43+d%$>|+jdM^f?QrleJYFL8mizC>5OuCw7k*v9T)CYPAkH@v^t7(F}PyZ z}=61YMN~HkFKz2B!4JBp>senM1G6;{-y!r5RREewq>tz zSzc07SjO_j*!3a{ov+d5S{a40al$o6_VAc=<~ZyWy};F~GCq&sgh0L;$VnBmTACQ; zx7YYDt-=NKQCOD@#91QorOKEpW&5) z=iX%SCxtTP-=AxG)^c1!4fNFt3|Z`V8a~yUojj{da2hf~j&mpk0${ zgyQZ91jWGL)xAcz5Pif#k>|p~fahm>Q+Z`APY+Tp6V(;AaQkSGiC~ajQ@{>%5(j!l zCi}wlk>$swnd;Rzr>wOm!s#p}SBHxbt@o|(n|QAt*`h7^u?w8bUW>#x+`>Y++XnNp z{kP49R)DaIx($8g1)>V0L4m9H(YQdroSRSI74Q>?*Z*PW9wVsVJ}ysGuew6dFf572 z!L!DFUJBp60lCLAHK>OnLxUE9wN2{^Yla~0{%oakkIBuQ_5}fe(&O8DopDkb;S5^Q zaUuY=_g0eC-u*Q$J2yApBGUMnZU%7k^Z(B^&;JW0R_Rw+kN?qIy&~S0Mx?$_0cGK6 zB4du`bqIvJev}4sjflLx$GUS00zXCZ6Osp*oQy3dq-8q+y3B^#|D3Dhg(#@&Pi*qa*Hebnaw~G1<#xFC9PqT+z z4V9s8F5kat*Um0#UFo87#oM0DNE4NTgbfF^2SRv2RTe-kfkQo@I*Ngj!SLx*7xArR zD)?5f8%|5G2fFQ(naw+(1~mFfWbs?N&;eVM<_1a-z-u-&I@b|=@ad&Wjh>I&GYJ2kqfjUufKzMaxPqqwsC!*G6e?(X!4fFEb-Opku)WTmew?H3&0bk)I zkN*S24b%eo1^#Uj2xDQLqdQ5z<##XFCiF{ka)ugi-riYPgd9ogm?4Qp^I-Ta-_}Q~ zK?xfJi?85!9`_vB!R3DgGduPgnxkBzh1OV(I>wI{;CAIGQ)PL+G>3%h%&-nbVwa z$muz4QDh0Woa@%IlcFUlIR>uH)#OyC1_QZ3u+S`6V#My~yo8U15XtxK_`xD006AMx zaJ9FjoCW7Z+9+tn$Z4f8VuqmOodM`)d@rLrHTVOOtoM&m%roGImTOgFZBv9$uhQ}> z^xWwyAlF}NHCcFFa5ZP%l97};A5=GBc?k7G)?g=B4YtiQ2^9=s%7AnrbZ7#QM|;vz>wl()ZdPyQ*_(? z7%QLr7FJp3JxJj#Z1_2RDYAy30Zm6*^mxVINT_6AO1%s8@-ziPGqnW5je$-dFPFPa zwj7s_4bQL8%N0rkU<9Sa5yXNKa7}L;h|10>ixB(bxGJ`|;a8E@_yhYG%ubCEac&fl z`@c6VXd#voYq|4c_GjPQW~|_l%BHKM^d!aG#4Cr1nX!iGzkwd1g0;eEf{hwhux4q) ze?xcsF}EkLkmA!UB@6YybiVbysEyTw6Wx<^&Um-r^C7W|VI?Yu3xu?Y@Vyb;_pL*3 zz(V;Espx)__etBw!X=G0F_=e#7O?~Vu8$YqWp9UAi0$pocEJ)v_veQiJAZ<$Qt66b zVcgqzg>GAP|Ma)w;sfx06aqtAtiLSxXW{PFKx<{vCN59?Wk1-NFIVyfhZA9FwL~!A zV$Wdmd}d68KdZw1{&DvUC-LY7DZnE#RA!qx{9{e`W%DlC^N6*lOQH?F^uuSGgJTyf zv{oim1bT>>VmF)JfeA6WTi2|&8n#TfMk3IQ z#uP(L@VM;Uggq2XPU%@E>%$oPv8m`MS>tI&F!xCM-2y@l?qP~fQF+1C-_jM#-bk;M z6S+P@VH~|yb9o4XPM>&&!e>L8fVL5c!0w;AN+;k;xyBU{|I7XQa~0UIzwcQsE(5-= z`^9RYFF&&=yjVDEtBU*TZ+zKCz<`fbl}iItNM zeZiQ1b;>ce{|#pLydd|@K_^G=jr@WYJ)kN}ZNKTh3p&4qEsl?aMR>kk@qqGc$xrk7 zLUkX$d}_;aTX|ckxcUb9T5fo)@{=U5C%0N#)g8=u!mtLX#&lA8_gKWD)FPC0^^6&Y zd3Fm;gSRdx7ZEc+fK!V{_B#Id9jA@VyK9-Jy=_iX=xz!Om|zg^;D!srPgyiq#W|4p zTCK@XM+mbIq1o`xj@!Mg^eJZIkxG7u#WAm^{~Fuve7W)t=xX%Ph~NqFCk5l{WgW2L zQhVXomELx0_Ofa@a}#lW!Pnh!(topq(yrnpY1&F~GTghu5 z-*TRekmvZSqBnDf-SCM`m{abU*~I)P8Q|{tsozgDni_F%dA9Oxo+Gf_!Had4g<7G(E1Z>unD*A zYM}72WdEm5zsW~s03HUzXf^Ve)f{5f(jYt1x;crVTvQb2S1XnS1y9m7x@+FwRJ5QblE!%)l7k>1_BMim z7>+EzABafA-n5CFm1C<5Sx#-HPTdW~T8g@|et%N^24o@?Xf;XjR7ZHrb^g+|zhWBv z8XE*->hg3aSOgA5&%IIu}afOx`R~AJ=R=S37 zPfE%ij*GcDRvxVK@`uI#2qodxv*R4_z#u-tCF46UFV(FkT_mJ)W^V64=LA53E0mbU z%3`Uk@OW+y!{0M6)jUNBsQHKYByQd+g-fnw_aCOl?3fE0Gdhp=&%S=nlK`Kd{GN0$ ziY^4&LsCMD`v`%lKhYv1wq+~P7irZAGx!!Y~x=Vq~ zsHCN@rv+_r!)=$Qm2vmUfC8hGc9xApv7$~lO+!z}Bi`VA<{nL?uK5gs^YO_3=`YQM zvoUwXJR5@qt(~y>b&*)I?D*Z4Q?e+L*3A)fc5umO890(+PIhPsciMOALlJm z&{p12b9Ua|r?2z4zl>6T37}|Z<*mwpp$aa!@uWu?YQQwl*OcLBI9TXPuB+~4sx2Y? zU-e~cE&}ro``|9&tGTKffW52N_j3l+KIHBhd;%}KyOj&d6f`tX7$pZnX@19}OW@9? zJVk%VEE%QH2o(rumlRke@r9F;{~iQ?Z-+1S`!v>&cGmV>`fwy!gNZ*}a`3?<2-qW# zKXTg(AxsHxvOY_}@m}w$$w1V!e_>9euBUT2^*mwN^D$T?qFn@gIfx0kVd+=Q=z0Zl!$_?qyK{Xcr#yS|^7Kd{iJcJ?=|Rs|G-{;nNk< ztf`ult`F}=9K_Gb!eoS7;4EvC116CAhRxKbyNzk+q2d5<6aB($(6U(eVdG~5e?M^p z?En`!v!|rp=eYFO0r&eP*H?SP?keu0#*(%~Ys`c7 z4J4%n^&< zHvZ)KTMmTrf!2cksoaiHU-Q2j=Jkrt+2cO~_}bp8+f84g+TFXMk;R=gImMA(Y~D=!F3gn_WH;^bFmg~rt;o}eMV%jhGE<6mo?q$ z($|!>rxF3TC*VSg0f{i7+E5=OWv$pjGHDJSyu!k`7LcUtqI_{_bn%O~D+5z6# z_S`s9L5ejdUG#O{p|hriJK_E>yZ3O(vb&kNpn-qkL_pAJ(pxj2*)o6U%eV32+vf$E zgS!F5wVCK(kAQ>OF*OC})P}^belt2OR2h3JV6EEpay9mZvbNp*fp-`L&`{<*xZTd0 z+z@cs+1sH5wJNBGy=4Wr_aEFurf^%u%RfEp@AM2(oQ7s`i0^RX49_6r*fL-0Fz(fj<81zD#(hxt-bS;=y-z**b57Xjv!_&o!QE6}w&?Z*h>J0ZzGx?+oteSb zQ>yZ&6jJIAu}JaSoME1BL3g;nVbv_3Ur>E;)xfY&wnXha5OE$t^B>$URh5h;fDR%4 zK+<7f5R)E!KRU3RF2Sa+Nw3U%h@^Y9B};X%ESVCrx2Nb)3lV2`-M@c5>|d!7##ZnR!E&$^=#PL5d}#3vHhVy-J~&@=-bA`CklM~ z>E`vnHz4Djl5%ZNUsX7yImlF-qD0z>;pu+w>{31u>nsVJg7y2h%!E@*zqZ$I$F0RI zxFbxW;ga+ugi`R{V%X3c7C@AL`x7lP+{Yw_yX=OS?0R_6OQKO0i7CUIiO?*^B>Q$u z6ne&Dd${W56wV-Q*58-%V&6wg=m$cj$)WDnzC%4<|KjI!xKDkKwv)N-BMKigNZU;5 zUAf9NQ-@Ct*>AZ*K9*J*eQPb%RMn=6F-WQn_u`wFK0hg~5jx7d^RO@|)?EyF@M6z_ zczlP-e*J8S%}U;)*5ayiEtvk%Hf^T1`#p}&^?~!mSMIyQtoDZ22zkrJ?(`qTM1Fki zBbZVh9pOYRsU+e;f+Z5kMAo1$jYd zKcdXW_fJFaJ)W{Oi?Kw<%VshAu!?YIEVnq8-Z@u*KySL6xz@tdOcg2stjqHH&bxeo zVVfJCz1~+hZkx{>cdw9`8$%4f(dC#OPr3Fh)7k^n-r!r(wlCHx8@PQ({eNRq#9LZN~$k#Fn~^E#6j0G)k@3i|grKn{9{am)ZHw4Jkc30XF?nmGk- za2EFvRzF7i_;({Ct3y@iB{*xT5PhK z@M1XwkfQX~8J-h(m+d%{YeK^RV*Q+Mk6Ur@78_&f@GDBU%TgO9IIjh*KMWaycgn z&v01I#WqR$cnTJh88de2q{k^>HSo5xcmch!ibe0|I=J-jEN{lG>*nxWgQR&vXZ29z z6Mt4g%>fNGbs>-`e^Ko$koV>vzF103yy^>#bRT8*pU?jAe*a(z>;dJU%7fKWGY4|< zEVovij@Pt5boLaAee%!m{MW}D8^{`NnIYE<7gQanu?%lMjgFHfdlg*3T6r;^8Ml42-;rVfK zaX?EiAE!$f4CjykJ;uD#A^v+*pKufR?^}oDMs)ukL7u^h{vOTB!@pbyy$H_FXDz+# z?-Pds&|TnLZ&WojHKk@w4c0**R?RtsZM)H5{@?W6;x1LOsjg8It{+I|o>U07!;}faC)O>%=akNOn;dD>o#BKYU z|D7)pK0ovG^V1!CIo(Q_bVl9TDT<0IQ6K%I^-f=kCEfD|?X3x!q&3#`%0EHA_A=Q& zuEk2ceLn5|bppCkRgke&MR==(2Fnw@{sJ}d@)1PLuUpUbyzp7=Ur3bOTnqz;pB}I4 zEoNMoMau9PS#n%Lmar;u|T zA0y}VM-e-xNegFRd$TE*n$#%^73ZaGn)mY;+DtcNu_Jjw^nOP&E>M|uPPSJen|DRa zM0rZK+r+r!jE|eJ(b%_7?~TkAg?BU*lJVcfEi|Tm&e@T8>;Olt)%#<6epy&caXd&s z`l9R$4GP;z5--Ge;*3lJpr4>A#esJPaG1S`KHow#cT&lD$x;nb9~QGLH?;Hq71=}p zWfT8%YoUlbTEk5~D>P!^kP5ACUq>QP!H*u+qRFR1v6{V4o6+Rovy(Gc4}?|~XxAuu zYA=rv)3_O>TwNUT^r;q3_x%XDALJSll{kgVeorStbWx)zghRor5b=rZfaFanDA{EtOp6 z<)KE>YYl#N3}+Yg;j7x`sJ^yVtOLO%+xEF85s^hNJ+@RL#LV7*B^(za!XNhm41qH) zZ4}fQ=6WuF@D9VWd^=t%G$sW_vTdw^_#+i-$VcY6=)ZBK5D&cg3=g5gxZ?Wd#xtZV zInPc{R#zX=hu=EeHZ(5w}yHPg3 z-C!>p=WpmjFVug`@A$U9pn>*TFwz>No}i|jFz*N@-%Pa^7GR-28_anhYbtkY;~OuA zs$=IT{N!@*f6f)gfy}(Y&THSv!CD|#E}B#k{7ax zzCt=M>M6)nvIaE49C>H*bUxtWET7{q@~gtt8pS8TSOu+Y$2Sf@T-8Ii&)e@y^pfw^ zoPOPvcTw;4nzvS-H9DX2uP){K^Qto#tIompicC35_daN+9!yu?Ql=}7E5F#&($=BM zA#(?NJqJfi?{uQUhId9=ulW?8q2p!YArB3)Ruls5cL#aE?$=pO7mtO@#PhB-)xFJBSC@u;Z+4h*l+y!=Wsk; zo0(Z^RD;hG3Bo;~n*aWWaRLLjA+S}}G+_*P)*S@2S{!ZP@ujrB3m6vovejUr-S>}>3HOc+i1WV0oTCEmgf+CKqW@QR=?R8 zR(Pj%+`5rqgKNtq6Du-E?JyJ!!+RG=c9Zr|WRquVb7Un4i@UgY@TG9$uH8X)x^LDr z_8#){XlA0Wr3Z^8>FuapM9b%8Qi8Rh{A<4@q|=d!3~YIe3x{ajUG1kjRCak2l_%Hb zQ6w)8sF<@;1@E{;l8i{|zmpyyrs&Nzt16!SZuq^ER&L+Z>5Q6vA?FvjPUQtb#X}xx zpJj?y={WmJ7&z7fcC}L&$}I?0!?3ZY`(UNWuuC8EbYtKv>c`|4QsuvPndTXM_i!8Q z;J1hSh$NIX&TSP*h+kN}B~PM6M;v&p?>LCp9L>H}t30iI{c*F>!TmyP+{qWF?*84e z$_7nN;`(S2)3@WYr=onlh!MGXwjJ?!s`luO{-VA}PCw@?u$ff7(4D5rR>4cR3@*l_ zv3u6Ib|HbEI~oqY36gAOBTb=FZV+Srh}N1>2j{sW`8pTjhc5@0M(rcgon$t{vlH@* z35Q3BEpHuWFA?&X(Ba-~)U40}o&N{$Oljl>O~pv!#mk>~=EV=-Wn5b0m=<2soF0P{ zIjln(m2i}wFS2Ac&G$Cx6VnV_?_Af(q?{Kpb)g;_TrE{pXN~JjXj5|otrz5$B3BDD zo@qUsM?4sojHpX)yxR3KG0^VVmd-kbb}-?U=$Pb0bP8M%Y-N!NHE${^9Qup}AjXvSt!Vh%OHS4_@-eVwp}k#?Q(%EL zt0_kw>|o=Y+xF0W7MW$0Pa0~A zUXO^gN^Kc(54IDs3o_tq(ISA zY^ncpcH$cxGWTOo7)bw8Rp6rCo8IOQ)pW9lU9Xm>+OT%M&q-SM1xoL?{boj4?tGbn z;D_A4Vhv&5jg@qst-p&BD}@Fn?>&75msPhjlZ&47P+%y$zo@f+8>wx!>X%rR_oZ!- ztI4oA1{nKJv;^KEco|-9t>)cntehQ*%%tn=Yjum>pwbUsO8a>IDjBB4@S*{k8m#_v zt$UlHj&(}13_=z*GPGVCq)HAQewZ2{N3lPd)eHX4gJJ zeC9TUY|x7XLjzccDT>zm$(xMwmfmVr`|59we#WX?8OFtR>PP(ywE0uC{iB*yeP=yl zDA+~&w97_-+LQQ$pdjAdO;+$4%?-4hKi_a5_@d^4waXD+JY!#G|0#{GhO4`Lx{yy7 z7;dUrrD%8*hUfAY3fHwh%EKZ`QL_9Gq@LAG3|8(!-Ey*>X;eGj8i`;39Z)I4>!BgC zu|_#LT*iV0gEcetA>11SoU%ns0&_dtHaZrw{y2=%&eCJHeBt!{boihMqU4rtDAZdl zdggXAbS9^8R*#31ByQ9v>uN>nr|2+umf?=s>u|$fXHt~qXp>^S=juis* zQrw~T9Z%8QIyO@Mscr4v8DIqRv37Em)Hu)cWlSVjrWpzhm-Xc;6bA070^uKCEb~ET z+qFZxX3HAa=gbozC>z7^XBAq2F(OkgH1xvvi_@h>J;=tm)$NUHqZYFW!+gf-U|ots z^dGdTT;`{uAs-?7$Nmvq7kUHp>Jdmox&%|goOX?# zTCakaG0|h)bgJgUEXNv^fp{`5uYiz2YYcPEP5jzL_RW#n+(l?OA8Ov>%)>vL;&^?W@kUmGjH|!oE}S!_r*P)64N!56Rb>YE(szYLp%jXF6%S*Mmh-J{xON zwS)&-oGAyF`-PSm8P1X}s=dI56lv>FC*)bcR#rG)EsQwpGR^ibLl}!197bajR_$1r zbvL#3&6o4-!9Vchx*`bI0(R!@!w7-G$KQ(d*GfkU=0n$IFs5)uLKhQb!h7;j79S2| zT^hQ0rAj%Q)J*4v<%t`?V+29XgMbT^*y1~f8c49dB&*wtk7WaV7AS^U)Co)bQ3=Fl z3RKTsq$c^andguy{TccRoZw@t{l(>>iTPkR@2>T+NxD~Bo0*BC_+3WNRi+S}j^BB{ zDPM|R{BJ6jMevaqH7PpY(H~z=LXBtpL1^3U6?2^`ow+vTur|V|XUbQM(7-?yK1QoN zCtXxv$#%F{dOQGD;ekZG5?<53;6{Fq8vBR*0LjA^6nK0ds`*D z_vDgK+paO+HcgB`vwk>XiR?<(9Pkto3?F7OA$T!5fcc}Q_Y0!m z1mUW}DWSRr(RjQ?Puq+n7tEVtqQG_|93gBaH6vq02}dr;DLiU1cqn^APdiZG09F~} zccR?sQ^uROC8Zo};#odpUTu7I&)r3!T`0TWeEidfwBGMM2`~ONstx$OSGM^?kK)gV zofRPbDFWX3A#wMaqJ6ZQeVboBWF;G^luB zbvW}ozJaHw7@;gR4+l08()6d@^0w^)3wiKjyog!}#OoZnodLP(sCdna zSVps_Nj@0(3h{>|ScXoE2kOLr`MZ8O7D5esC+lNWr?b=WWnpv^KBJyeY~B+u?GSq$ zsOXvgHPo3FWA#s_@Rq zwii(x!#|@{;=k}3N!qO&n@*lT)t#&%SGFUH_EQ(o!XRUwDAtc*=@FA^BJfp{q_lcf z6C3dIb~Xn4^EZ~>Bx8K_**$iX`^H%N8n=0-d{$v}G>a(C+7<;@!rEzjg zk8G}^KP529rjamw42{~Ie@dZgy%Sq%lP}RNT)ZcFBSJuORU4EPAA+h;NOOQm)ygN3 z2^et!QXjn)H!&)fCrL?Xco@o3CKvPkYqh%u7we~P?ChmxP~a>RAM9TzTh}%M=pA}m zehaoieEN08ToJxMIzh?sNBT)OyoY?>F&^9tCa}odHiOu{9-8kKH@C+P0_sqQsw|>6Om>Gwr-nW?oSA(-hy7hY zrO<;1;V2>g%sbG8C8p%ShA&W47gA@4yTz-;=$G!%bQI08ZpB0MwHaC0az3zd^LwZJ35hY>A%V+t^*^gn{a96CLX;ni;ssnI zwrNW`cicuOOyf$mvb+>IMLQqUGeHd&Dxm?k<*z+F*K)Uzy!-m{&;AtYv&CrlmOIQC z?&Zn?ch*-{8-iDy1TMN4?I%g@8M4Dfcy$c8cyf#)LZ(o;xy>R*qL#*`gG-(3z27L zX71!_T7#cNPqXA`I`68K`Bg4R&n~nr1f^L79Wicxd~T)B(WVm=4I_zP$~ISSVpb+h zbVU~wPeGg{#7lxvHOfclf9=Qbe@(ORbrPKI#racN_lq}`E`AW9d1E4JsA=6M+3B&f z(mcoWKtz~MD3r>!6z2@|Y3y-3PKKwVaY&Ic1(O7I0ic8@s>n&4eX!JQH43aU6yG(#OFs;&u@Y8qlg{EBlKPj_BgqU?Y2(DY3yH z#d-tDd-wLL&b7O}nFGv=sn~wSJjIcAi>#-RCkaL}3EZ-C%I6mN_>xBIl%lJfYp*3M zNQBMtJ=ut(_5n-X%y5W1j_nj&^Q-Dsf<_vXku2)O+E3hgV%3Lz^S#4DuF{jf^8iNX zZ+3mpNZZpgVW+JL48(Bmxa7FScg(#TCG?P=0nI?4yg1qeIxXb|7Y&z{h#Y}U=rpYy z2rSB>V@4r zJ82&QK&|SWI%=7HKb~|B18>0J;i+CgwArt(B}I>Vh}uw zu&%TUsh(ubFe}e~&+u8RiAe%#xCYSH5dnPbceCha*G1`3w0W$1_hNa#D|?A~fxYWi z#PKQLkx2$vz34j$g1?00y?XT8Mc5agCo#Fzt5hLlMkq?oG=3qpi?tD*X_$}4vM+t^ z4HY~&d+2&LNoEBX5Lgu&{4uW6HMM~MAOT_L@vUtOqA?{JlIU0Ys>t>-(ytYIx;h{_ zmeBd;m)M@x2p^B0L?ELHp&QaymM7+;FfH}XN4{Np}391?)4312KS{5R0Dsy0xxZ&=i-k8Q_m z+r{U|-c1%QF$o+;b^#JFE}>n>91vP3wx*KzQw^hivZLFtAcIG6G8r42uN`OC-((j( z|9m?WCWovbgVS5Ie!Lp!%F_W&8w{ihj6Ya6n_6fXiROhPeAx-fqD{2C2rJ_&5_3K0 zda3%k{`j1$acD0z;)p$yE6^ii57j0&1;wqkgc~{Ba}&qs&oC7?JxW(1g4v|E9)uoz zX;`D`;23Vk$8-v_a(c16EsXq3#qa>Zl#5SLEzYJGtG6Ybn8`y5@QM5t{CDW%PIHqw z8|GG*jEa1cAdt8(#@|VwT$tDHb~Lvgjx$tPIO3gZ^NP_ur7V=O?4&_2T5+Cfb~Wu^3mH9QWteE) zG^IAkzN^;ntAFe;ME~@(G8CGVkGQ#Z*mPRvexIMzdL+ucuiF;(!#XJv)`NYv^O`;ENds+Q{)8PHNZw){M$eD8LjEF6 z9YUw)%{v;9A#5TVjnwpa~7x~88C)XD$QTDLrD*2p6*ULy&`)#9; zUaHGZe-`H^S_v8Rs@lp+a8-^~p?A{EhY^f+_?GhN#oX7skebCmv?(?1*9#d7X*Tm; z$A~A~rihA+sB=;Q#?P|@g8rG;-Km%eE&t;XaBn|=TfmLWexh4Tc-UIt%~?Y!e{}j{ zN54uH#uak*HBUF`omK(toJ}tkqTTQ_rPR_+Rr^M}()pm-F{xK}^4dYIB|a)SXHmKP zCjwtROb?72&FLT4_GpH(qCsmtOUV0X6c(1HMGn#N<5jvXJNU+2vv7EN`<>D#;wT*B zYd9||Oy-SW89!aKhjWg)6z>Hevh;<2ILw?#_HaJcy_N9uZFp4y)pd6Q?NC#!kOC0g7QOB}880pu^+Hx-1k0Sx&l@Q_6;#SzT z!5KKBl_GY1Jgnz%1MFa0=S*)Ofeci<+on!(h~WejarrGqhEbh2)$A}g zaqqaL-Optvz1?Ap3vI4WqxWT5Hp69ih1tP%Mz55g7c8ZW#VA%;jFLtDP|chIkw#b~ z=!HhK`DInI?&kdZMEUD2APa@~qiPxfVdy^wiMALRBpy~D9qBSO7{5~t7a8z60~>X^ z-ohtx7A9O+nwjmaCAuw(slP{!M-3;5n9QIxgq;JZ3O0>ANjY9TJr`8me-yR|RRZ%Q zw089!f2t88?=9+Ql})b@h=J8|!X@-ir@lqZ`r>=H7L# z_NaB&K?l0FyGbxM4-;X=|X6^P;e-OOHSoH%{3JM-kDQGQ&5&@3io zP7S3DE~*?z33pCw4b!CLg&XkNb5%;W(|q$QZ7XD_8CEl1na*o6zAI{H)-oq=Xv6`I zP>xs{Qk9+VwUYGmU24I!9WQeAJ`g3Bh^Yqi5l;3jFVNEl@njHsy!%0x)>#LA<&i2k z_QR`+nFp;>`n75_!x924-LZ**IROURgwwM73>${YYD&$bXXS?V${$@7&AhEuU6RH= z?f}6MknXbET%(q%COlZ?OgXt!HuyEy5}>8GVrS+%ml%t_mtH*t@-mux-M!5{E%)F- zm~%wu9*Lawb|a0P@$?QO54O*pJ;l`}>=?S+0yo9Fm2jSQ5Gv&#yYSC_zgtp@oYP6# zKHMKVZx2iri+S9qro@=#^U%-yLaHo#_pmeIZ9kA;sXFG(oySKz2VV!;6F^aB@+0+Ps4866vjS9FlFbD_?K6wlD z2%kTcBrEvzvz^x#aaE`vbS(Bqd5_Z3yf*??J+aCK#%;v9zLk6vjp(-@<#f_sE-F$_ zM%AdQ0_Ln*e%T4IW>gVgsQ4R>H*vqx?~PpH55MzpM0fZheB#0j?9oZ8x1+b6{9cxW zt(Pk9BqX)^ETsGWyP@NTLE>vy5bvtIqv?Uy2B^?;QrljEt81)Ie$S&RnP`A^ zklWhsQDu<>&u&TKthiqGiRv5&u3I*_=R4|WXxN^%AFz=Ze;e;q3}^d#bnU@{`Y*an zx0(3y$c;(OM6#2noVXpqj=`lnI5?0H1!B)K){eqr8TVD6ODpy437iN5JZ))dUc-rU z5w0NTr_}i|i>-F6p@qg@pe1Pll%XL7WE!uVQ;o1F*QvB+*{-BK{;V>ukZ<&nfJvL;0W;BfP=P z1E2W%_p{%6@^m%_oxX|&V44e{B_NQ>l_jbe1i?UpfDDYNFsOb=4e{P9Z%W5m2@_(! z{4tYq1c7F~zd%(~E9!h+z_cQ^l1nAD;ljHAEslwf_QfOoRE4TP|1~lM&6oP ziN6x8M%X*=D4-6hKp_5_yfO74vr>Fi^mnn}S9L%jTd}_Y32XBt7F}^3*d7}=8_tu_ zbiz!XLj4lL55EY!O!g90SuzpKrJx9{~Lh06v$GS^58aS)2dEmeoI|hlFUO zu_>OCJ>vIzuY&lw|8hwF;v!yqlD5~cwvR1GG&6xd?EcF=&D6Z2)ultLK^;95L~w@I z>$Uc$oqR2IhX(EAje`>b0$!{?Z}<-|{Dq|IyhIKvGqJa?ZJgstH_BHv^xWSXr&R`|$6Hh~^mTyi%LSsLwVyzXGmr z(mgZu-ai_hRoBw&-Em|D@L<~-_idkF47ys0a%A1A8t1OtM1E>g9=@f|1?*U z?I}IqEGoPx#LUV%A1-}to6sb7h^Rgjw8X0j5bp(&e3QsBdHjdPT`gkswoO{H%<=a| z<>=!og(tr#J&=)&30cy<$EP2$&WuNGV!XS1zZZA6U1dWbEM`9h`P<&a9kv;tPMYfP zx7xm|rT0vvIe8{l2LC2HjNsYb8tVIm1&m+P*dXx~@t_k)DVNK^(npy|sq$w~!HKki zQZj+Sj=sB9872)B9Z@J@C;ovcnDlz#M2%Sjwj+cR99-+?hP~GvB}2t<68RY9f8B_# zzUR^*2_krmq3=tO-W~=P(#M=ihNuJL(6=#L({^)cWBuj!v9_)6*mxRYhvYx8X>@k_ zI_svnfx#DEc72hbh5ZopFKgW)+JPQAoq~NvVbu6ztJDqUrWh;l%0kh){VKwJU5b^S z5=t<+u+`ekK3xr;j~>hb5&L}Xq~dw~HIU=K2%n?FpEnCjdb!UgomNH`hU1Ehm3(QF zPIaa{mbGU1w;dXqis^2oO;U@!Waod?K$r6v27^io>)EPJeHVe{nc)4Gsx@?1gGZeR zpFAuVHOOpk=7|WNI4sF(Pbe3iwY!t8LMHdlkP?NWblq5XY6zP zF`9eo0h@rqmcq+?qXWGNZyo(3>@~`CXp7>d7M{23m$SnR9Ao3rf%LG`aktV83!lW2 zLYu=@Z3v%Vo~Ec$gxWvCKVX%Z4NIyCucbz}J9Q@R^^X$+(7Ee!1$UTgs8?Q}p;Fh! zH#BHCd%^bK+`cCK@>Ci)Ou$`%;sbCN;MQ&mDOal6%<5Q*)?{L!BKIAm zQho&f(ABI0{_o^xW%{vwg|)7%kCU;&^if2`rl7G8I@-g-SRp|r8$eGK{Wj!8&e_%T zZ4+3$7wo}|26=yp6;69{6}6DZ!Qz$LxzQ7&WnOBlpUm9YCw=Z|Wtm9q2X@GCM1=dz zQE;#hv6wVIg%ka{)w z+a*C-d{C)MY zW8B=(KK*f?iGnmzv_@MyIw+#8ga}lm>7^r$Z)!2vd-(O(dg7wCg1qV()j4m`jNLn6r}a_)h$IwQOyD z>f{XGC~Am5^bEwZe`3B^b;~M*-_D^t&skcR2o4=4dSn^e z^eES|^;Usloem>@Z)EF~Vc{=H(F`HR>cxVl8(?CZa2=($vM$LL^8Oe~F--AKQA-?wgPM^~fznT?H-a_S@1XkGgg0KbEORvDUqv3+he zec{nI;P#iiNHaAppeJRwzdiSuQdmIk}g~;8- z4Xw}Et@`wch;U~@_N=Y!*K{3x5FCTo6*=Ss!YcycCbE|--=)ls{QlJ|dF=i&z1}k0 zSGQ3wI^AE_fAUO?pRaltJGoApU=|wmYs5I|O3GYdVzIWlN&`0S$k@g*n`-Ft(y%;3 zo?4tweYjt-hLt?V%e1tBt^yJzpjN%9v$ldanLeUFVJLP;pR`yeaBXr+Yp1y?^V}}mU)K6^ z1!XdhzGEI?=oLRvafW5xa>|r|0tr^^mvWv|xJx!;mmI7V2#B;JHYYd4uxN&z^RYSR z=5JE~BQKeiqriX5Zu_-6gN_Y&rPbecM3WtIAok8oY2$~XN6uKtBFq1APO{D5)pRr_)lQi(^y;=L1U%jbO%7vOv` z4wh$`-m(vs&?8aMUq;O@`9oUkY*Bk?ThiQw_qQg9Knw8bMxmJ(@m=g`mLW+G5Tk8~ zU7hThhi%iYoutNWq$f|w;@*h;Vz_5-vsQL@IMEY}Gg}FcK5P)0Rnt$-*g zb(#qMI5M-r_IP36kI{_X{Zytp9&#Pzf1m4qN~YR{ZZ7sL3r8TqDyHOmDo5Bz0H~{ z)#O-Bv(U^!5?9J`>W%=k85bECEq}Y6XKH9Pp!;(0#R)^b?zaUjL!Qd;Z2s^foTJqk zIXp3@NBIaz)8{_W4!{d--fh5UFXp=Gv}7#(eofyh=&f{xib@%b;eE_n~FyVY4WJem_d#aUH5Hm$F?oZC7E? zJ@k}EChZj&28vMp{v#Rxl%G_9{H_g6A*-v8^~RBav3##e!M`nXdM#}V=dWiW0$}XI zw`U&rdr3{GTm4Qmn z&@UNQ;mYvt+BD7Kw51g7OA?(XJ?Yumnz2ZkZ4ADV2^H2e`TZGniODQ9H=Go4^!5d@ z>?3C&inp`bO+y>2zY-B;sxY8FkrXeBT$Yck^9$nvSw*$&?UBh!Q-mdqBgc<5gT& zop#5C9XoP;o0(Tk3*;ZHcHta@l}mchq)5F0!By$HWJs(mH; zq=I+O&${CIOyPxh@s)4Fjl_G`dwO^zb0u%*#IK*l}v zA-aLyU(z`cZAwo?AVrgsZPQZj`tjK#Hg}=N?kh2V#X~LDCPlUlfPtitK2Z+!^b4HX z#4zyFiLQiC4n-Jm2%Y@EnMM3e4r`)g5YE0PFrfO1FmsV(2Mo_P&L&*ke40Ak^+Qx(6vLA`Xb$OXG&H$hpoUL#tvD{1s3~ zwzZj=lx-2<5C>z9sP&m_(Ey2WBWQcx+_0EB%3BdIZC!v&xe*Ph zk)tC;J%iqD{rB61;6q}<{P=h$W%K{P(i7)2# z6?Y1u>ufu6?ZI|O6Ke63r9ZRmT2$Ke0p(BlP94OmHoih9Cp3(Cdzy_60(l?|QZXQ_ zf$+L@YI;{f&jt_t9u$_t1 zE0rG`i0xulujz9Hd*Y*c&g zp3W-k`yYgasfvmHYc#LmM5xub%Gfsgzf;?>kXaKJaR937UOAEFtaVkSaw zZhosR^d&Qd)uJ=z%{gHn89+2=vl&OLHS38hc5(=Nq)DFH*>DC4E;4B6G zBOLJucdk*a<}cp>tl+ZEeT~_-D`OMKeYyCROPBaiL7#fy^Vj^^nMuNf_zP6!o`!ybfu=J zhAH0lC*bdMjN)TVcXgGNxPrQQFAQ1y;!amxWIyF^**knLJG|`M&R;3@KNMdD7BOck}9{E}fbeldC2;9*cI(}s>D)WcMYmFP&jt=>D5xD(|)YH;N zZoDx!p2|2PfUNpX@%ogzY+*V3$CsmWV}N1waaKrV$BpJ)T)%~mgL34LMB36vR>!0U znn|VlNb*D2Deg!$FJ=E@>mkptvHV_0QQ^|LNICA~<|1;t`#2`>W9D4uo7p5TMM2|J z?<^n9oocJGbmyMV)ax`ixZdB+sQlXpZP-bBczbcN7~mS`nWXwwXpHj{5{obrm6sd3 zkeg;|0~4{{&>Qaz&PG(OLs~NveO{~IFx11CppqaoBu>?vH;^S-NM~J`t6#aU2YXv( z6#_fLO>i}7F%7;ALm%se7I`GDw0i|F+WDn2rl--VQ>ck#w9{_6@0WhZ7h|%2P6Zza zt~SUN$+V{F>qQk6`Aj;sz_O~<%J)n7s(f?NGhVv3SKd%B#PaBxB>4yc42&>iL_d&_ zMMKL+qHke;VEGu%C_gqI-eKhC68`|`?}(xpL1@7`-)g%wE-}sw5UfWbVgm+rG76~= zU)7;D)tKbj-aBeEA?W@g|C00{fJ=Vehz+R z;}XgA>W3=4|H_en${TzX{3u!k$U=_yVt{RPN3%VlXeQFohPlIKS94WLY4*1B)-!G6o1CLa+yNjIOeT(e=-z|=gJMJWXfvkzxxK3?LEn+0e@WPEz8o0; zJI`iH!maHuH+u;#w6I-dPu?LM?@A7&B*Fq^wWH|p{&u?a*Ch^=!d`6L%~dsz^{De{ z>7Lw6UwtiS?Ue4{7=D#hz?n4ODwL5sb<>$=`zyGcSuAciqTrFb_o41ppN=jGLOM$3 z$behh+V^Q9Pq{VTA?1->zr4Mnn1X{Zx7G3O?D&*)=G|VUWS4(pWjVsb6;d5$wV$hYdJ=VAFy>8I<}m$SWaIopX~`;@DJ(2_Y%rA5*Y zWq_pqfd~*{KrhPDGZk(CBg+3dA*m_AS~~*^0{vS5SMlyyo8U44AL)q{VLDWR`r@p= z2_xXk{~KwE=`KYsCUs+BiA3E~TSMEw70mw8|1TvF1ZtB7D!a5W7*;pn^q_^bfAy?p z%m2Ri`F}0#@EkI0@Sh168LHO_fzZDdzyHH4S?L7I0%7ju9IC z#LxEkO1ZRorMuhtZ6`$WD&d8w`xe5};mLK~Z7IR&U}^3eR>LC6cX28=Kri_J{rc_k zCn=R=w^4UjR-OksYqU8^v9>v@0`5->0B4H4BS{~$3_s#0aRo);UtV|1$fZv6;+oww%$xF%q<^H(ON zcxbPE?4$Rbm#OLQc z6s&1ZH*kC0ba8r(Cwk2ls)`zRw~yl;|4l=E81(A13tIhhq9lGS#P2zWbb~2KXKi4P z#}i3QTANUIe|7yS91SFTs7e+T>y;jkt)To=kM76mx;$ndl5OXw6XYn#VZLJCS6 z1p-)l$|P!VV`)KgFdkl!8alOhZ-TmgT0AUB5wK^knT*n2>j7Bwy8tYNKW#~cISs8? zfblB8UIp0-nOvAB`wlye!xWe^&Kg!ZOB1=b`{{t6Q>brwuhYu>=?*O0%BD0s_pp*g zW7NHTL|uWoP)Jh8Vo;8w%=H$?R*OuG=l1ZJJ6l3+19|ln zE+@qqUP9yjBP08i#2O(2`$PKM^fT2Qg594R*Q`3oABwIRdXI(F7&Pb49gIel9DjSQ zfp8jB0OWG$B`AvscE!*wr3h@2tfa1rEg9DyA zkgnjc`l&it)U6+r)Zvoln!}^gx2Iq{eJ8)ok|H}y2n1pjpahB+oCk?nJ04sn^v1#~ z3k*Zuy>D)0O1$L4z<#;E^DEEP3OI0=6xrV${GH88a4pZEj=!buKKzI7TP+ysh}{_4 z1G+p__|v>qvE6DqMMc>q(CbGwLKMasmNh0ThWM$+s*YY&uM+&=Wg}pr>dyo3H|EqF z&#D&um4fu(mq5Kqe_q7tetw4xw0>{o?eAf{4W+)<Bchc06@`G^rwSIvPV8XI_28G}y~*<1KDWdD!IOAK0H%Ae*UZ4WsyM zK0`xawze|lcagfcTk`YNVx%N|9J=}PT3m8i%4R%axAN;jK3QoQli(@l`O2>Y%j}cp zgRr!iy)*#+Uk_B9q8_>W%$V73v*I$G2v9DFkf%FQU{u)0*m-y5RQe6syzX{v#mKMD zPd*ZJ&67}T&_wx;R~8pYh}`Bgo)y z&HeP`MZf1~2sBgaut%DRo3|doPU*l=itU6TX}0OV-rCy<^1F$hoS96(MkSKMIG0!S zxD_3wFpa+g_^7|ny82IAdGlFD@)L)^J98HtW zYMrs${IHl;<}qb~1Nc>vzKh(uq?^Nt?uEW@T$*`0=a=m1*JTYNrIYU#R=EzWJU|si z|Kfm`C>*ej)2`tNiZ+=TKhD?VxK>?A=g@Nd2=bjRi>Ap?37alMnvG$Xg)dKY18Z&0 z`6*mNck?7SvZR;?ns#sPX1V>S`b#K4-qp&#gIepFJJk>}O)Y!VTK68xzm1eKNs!h; zd&>C$2{tUpa2U~NJ!VtsdwQJAR-!sKrBlqCvv+YXF`gKz5QkJ1z-txT5%{BItY80Yc<<8eKbwe&+UW49lW>)^bEg76v3)%iO;gI9OpWtB7qQ!E+pfJEE<53bEv$QoYE+5j;KhXT|7 zS@m15YCt*9mcN!T*A;B@y~{A-RqDkRBq0`kEpP_^bio-eQxK5$S1w<3pST2xjNYKA zT^SFBi&1B_)#fuXa$_$JI7o)^l&BVrfD!gS-EqP*tWY8FO+cXtc`I0(L*tgPm^q9~`-z zCZF?(@E-4#?ly0anr(&YKc>0-oz1h-SM|^&Y{LXyoM>~H{oRt}Q)>K4%=|5-poKmo zn<)0cNa9C))B1U2q!ge(0O-mrT&J)?V5*hVd_rf3Weer5-H=J3t0~4leS4t;Y0oHa zY}N`jZ7Bnj&3n?phZ)`Gl?BTxziNo_oo@cCWoMJX>Wvxae_|J%>5x5>ygQxzYVO;A z;M!k=Bo0s4{QHk2h6u)#Cp0NVE~=X9oJXQIA*RA*%sG$a_0BqpCpvS!Zigv3Z~Fzs z)WC^R`0LDjS$JeT4b+%4(z>oBb!~;R_eaT{Am3E>z3W7kMmcP~u>jcl@l-s5QXLe~ zfURF*5`5fs`!cNi%o8p;eKDi%EGP9HG9{9i?FG%1wYA=Y+j6a@EqMRQpME$=l!%#n z*3I4)(WyU!7@Z|Kx}ck;GyP}RE|J|b6MNz&R{Wxs_SUpheaB1_h-G^FroCo%6_I^| zT4z?WnPbeqH?!O7Mj2%3XGe2YMNrY2G4Z8O68};jOZtV=Fzxv zGDH&D3`;2v0j1fbY0>EC4|AtKi^ZoGivgXuxwr~T4wEcj^Ip7OS|`GP6g`-0P;g$yTI(xm@VsZLyvtB{z}fzSJY&@Ysv?E9e$|WvSR_qQ|xM zE3GX?OVOU5*&n7t*ibporDpMMVSfV+2TE)MRER#mE$Piu|wG3a%tpU zR+@J9#R>PX)-K)qAb3MsYWgQ6pFm0~kGqdHb5k>BG!u7IyelW$=o6MyPV_(5oKm(C zh@ACYHWSDMkOJ6KyPa_w1kMIy`^3{x30^BMNreH&Jxe=`L-Gx3fc=qn6;bU^G#$KozEZLj^x5 zhOXspt!uAgsW@aE@7-^rr$#-&<(G~1Y%foZwiHf+9F;v|FSspFfmEj*Vux^LezF&T zPFmP6#mg3qR;P_E%%!oORWJ+K@c;mBDNoluC6JPbU)mR_jO?gTQv$KO{f)N6RTj_F z7vyNTzWSs1*bfL+E=&~)yV7d0Ro=1rp6l6`y5a2}N0gRn#c{U85j7HK;&_Ae3dJ#C z-(v+lW#Bz>5nuiFy_3eq0IXX4d5v5n%DxA3?^|v|A%IoWs#{Wazpr)i^-;F%4gNj& z+fnmZdgn=$*+tF%X7T!888hy$bn}j5{~b-1w_7&Qk@9Y_m%IX2Axb?GkTlYu*h$owf{7GpuTtISu}s)Jgp`xd^jN;bG8|x{DlrDg$C&&{NTg9!>>(CcP<-gMC^{T{ zZQMH#IkD-=78zrt-tHDO*oq({qwv-V;h_9K0BmD$z>%0Knq`R`M@Rzl5om7D0ia<7 zYA5b$|A8L0^Ta&$oEMq4`nvknRUji5$vg5wF!)l3IIdk>b?z7Keqj!wP2wRx14U!gd-aM1Lnm3ylIxKr#tr~qvqmmdX#ZfsofFt_tMp+58txfR#RF1tT0F2KPSUGkD(`NvW#XtYRkx z)^2qmbBsH~)3*y{V4~e-)so+XD}r@R*lqw|;qP`Pt=+P^>X*ghJWTunt3Tg3eQm^V z+NqoQyq!*Vl3k097%LjkQENT|bkx`nDmY)wy4fGJYt`bHY$Tc+lWPyI%sqgV5*x>^ zoXBd+7L|cFUPV3^XMYs)^>>8bfl<%Tkk>|%j>J$$`pBm_<|fYcG2e7KnHvhi$8HZ= zY;^0A?gu1HhY~kNyMMCX!Uj=M>edlGpLn-H+;H+I+7HHz9c#r~X_siLf@bFrH9bJO z+aF7R68zYNI#!o~`Gx3DFeG(-U;t=-X!Jd#jyN#*UIAk>CXz9jW6S#(1GmcYMP8Y{ zX((-RrIY_iEuYBkmi~qwX}pwM#Gq)0?LzH_`vmDp6K$-)sZE*nNoi%X_V}Ik|$6}Ko#$?LdQ9+Vzmq=e; z=Ch5!5nQPu`LERbJajVV$N5hCM?wse=?3l}*_xC|7!OW%ns|IJMpgyaO%zGscpMQj z`g7zU)+-{o9c7W|z%ooi6%SX<6!V`0cQ{ zh2iw`UBJ>z*1||#f#C;H{10Lh%YaJVr-mY=PeDpbf$GTzI?9)be)((0NZ2oOli~{I z;yMQzxGwE%-A?0$qwN|nqOM7w1aTh?A_*gVr8W<8(JPbTudW7ryT~mK=Apij4s1V8 zdRM193StmmSf(odY?QlWof`6ay%u4y3O{g#jU&K+t}KNo?L4}`UNLnjhW#XfyY~X9N*Ccc=+tJv0x%DbZ|VZGAJzN&%Ur`Nkb!` z;%0&Y`7aOD)}K2MJD(La8T$;}c7$1Z$4;)V%$AzPi6#X|&T^DiRG<7xN-MyVg*f=y zIcZS_v-I!LshZ^oc}6?IhC6c4Go z)5))vzuUBJQvFQMGaciVNbXC_p5PdmKeNPih{)Rlx#;N9fuN)03_SxY)pwQIxlzD~ z>rs`cdZ1jq$l}dl$GIDQ+VI2PHx@bxb_t6EbyG^5%)}AT#qCu^N?C?4ARtijHbaX8 zQ3Y-i|NFgKWT94J-=jtN&?3{G68S(GAGlp(roFt}{Ia|oMVehnl--wAyFR^@ro?kr zuKmZEZ=-v5^jKRGB&;w8Wo6qGJK;)V8Ixb98ry1NPmS*Yee-yX#M7w&^b~X9Tu~+U ztJ*e|9&NY)1~L8CZR=oCj*}1w zLI407!jkCywP-55gpR14_!*Ln=q+R(a=Q?MZcv-r|GsCQf22 zbpvrYXD+6JY$y=)P>^t!B9=bH)m;wbkIU{KAkh(q$Wh%6*%q6*m>I(A@a7sGAs4v) z$#bz%$@@-6YaZ0be<<=(8r=M=v&U?E5|m z7ILbpb@&aAM37%7&Bs<-V$xIq=@z@k%*3j!bl##-VXi8&Wg6wPNfDj8#60VdO{+8^ zU*JXEU+}Ookr>t6ql!dD_rGB}JwbLmKX2OgB;ccw&UR#TCPus%Lqm;7lwcHDvJmGH zD`$&ZYliVJO%{$%TRo+@ZN|(DoyuV{>;@}eo(bFQe6jbe@dsyU@$l4+S8-MIgSqD2 zb_{mo#x@T?AH=L%_96tTvK#MEWb$YrjkIOpUC{K1^&Yu;{cd{CKZ-3nlYUDzj(J*C z0#`RrONI8k-)u*-PhDQ9#M@^fH3j9=^W)iK*k{j|b|$1&jq*+wL?MqQyXk@)C|;7k z5$vkNCi>2-@G%UP;ky0304r2a)X+qjxXkf9jF;PwW3Z%|k9JXV*c$v?38{m+Ys%U; z{23HVctaEZGOzf>VGz2b*Rx541h!23Ta* zCejwVb?^RR32~foMn35(8YakZYy3)3Xogdq90XG}sh;!U`_mT58R5gyU=_|yI5H14 zfvgnFTI!e@$fi`s5v2;_Oh$fhbT_d&0p9}{$AuRs7@CyF+p#{%{WiPJvay<>gk#dP zuC50zi6XgWd$gXK-d|zrOA%wDY)d|5&`o<+B8DpK4B8-uhZ>a95GvcC!cMs!bG1gA zq#;gSDpMq+g?pe>)!LPgR~`Vj_W`Li006`8pnI6L$0;nxUOSR?tr9rRKhEAdLtwC7 z&H~$^sa(rHO6&~*uB)H%TJ5mHO~&5HTc+k@TRmyw$B;1Gso56Ly|7JLTdm3R=4J41 z8s5>FJ!tArqDj47LySLRbo5uYE$w@b!}1E@((rTn3;PrLaK|t1lfk7VpA;X3g-sAB-UJ1COQ$M8=W5HA+$ntLltVr~*LBywo|2eG?YUQjs{#76 z9e%+zhF^tAL})RDdd!|!qkpjzEu?6dFtgij)@A>PcvkUdDyy;NO)mFzu{!|%3$jqQ z)QWFeYygjVjOca2H^y{N^E-OA0(dB@Ml`sZ!L*Mb5_uI1>ju@na?x@+i&=8UM~vTs`z)J@TNqsp?ptNOlOIAjN{X8IyRhOWMZ zG$?`?yJX2*!^DXq$7?6goAmW4Up++(XH0{zBWMV0nHhNeLdQI5(ir(9Ioa1VynMCm z>7Tb<*~LadA5^A`0H2HI<_oK{qudDJCD?4gVe+`;$qsT;@Y?ENvv(56hQph%zx{Fg zV?P_;H!rGM3mmJqkz53FY?hjfS-LjSB0KztMLb&H{7*j=yE|OLFLYfVRCjXKwp`3i zM3$GyWi*dlmhwSIYh7K*8iB(?c6s`fhU*|K zYQBx`(q0B&wKNj+0I-i>k;P%67jq*#!Y<6?-^ON58Xr4R5&a< z0*)|6bXaXvTDEcp{l!I}R7&yv7_UAHSXy7t7bnwx-jNcW`;8~&C}lY8KpCDeH$hf*awj=k#S zigfL~wf#u!g|`JHi4G+Yh!4KQEePb+R$U0b&>~C8)Ly&u-V%o4BWiK0|_Sq1;scGX6K6)VYW&O zyYC^}{4|WXCIM*wxlVg=$Eayc(MD=Br>+qPS4B#_{Z^vpv`hfNC zUEMOJh8nF1`*ceiB8x~l@-thE@_QG)Su75TT-Slpb$Pv5*+kQKa6nmJOPyw-f|*sauz>MMu&(GR<011^-Z3w5O6}*X&ip z?;tJBW)`C(%y-Q5yq2T0BxoB5gfNR%IY=T44hj|kVXoHJ+$+gDbL;?>y%BIqL#6kA zNsG6j_8o;mB3fl3{@8Xbp=?pfjE2w_@W!M$xF_>awYR`5`6Vg0%;W);r^Jrur46=%1($sjq0Zy*aX z8H_YFMR;9hrP^12zuwx-+C)i{z2H^qb>jzek%MN~=-PC<-eg7DDgGz+t(V@xom3~Z z<17=qS(IgPJIA&F3yFf&?>vKH0S21!g%bL?E51I88Ajb~UGZnA-h9hBz(N+RcUmYO zi5`vSPc(+wNR7MEOSsu^fMxlmF;eOgNQJ@xcM7iRG C^HyZYt;rz@Hdf<$vUCdO9Oi^9bq% zWr>Gz_KONe=W2`rC@Z27zo~dVgM+zqOj9Lv{dnXEP?hGL%CHG`HlXhD)@jy=m&s$% zfWa@c0QqCT8(>yN3bojZ7}+RC!zrvGMyA+%KNUY+D4Xtd-?Tec z(V_+-4rTkE8ptY%JF^_cn4ecIUuERaG^u^ZvH$=ikS$3S+L`!B!Y?gVONe~7#|t(s zTssGnFen+^QtCMYgG}Qf396wf6d`0RiI1Z+9;XNexUSvVePrj;5$F$fl;zXnarE_| zT78X!65x0OGs6%sRY2K-B7?~EAp!7*4>E7G9{sf7dgaYr$yzI{0z_yn5C-ZSbO6u9 z$T^v`X%c?>GWp=y9Eyx{OAG9;z(*~G8CkXQAIQg?(DsiY!4o8xUcq&-dr-zeurR1w z8)cAQISu{o|AR;pV|eps3)OJ9_*pLHyEd>~>m70Hznl2~)m6Xne^ZQqJ=Dat z!zQ1;7At7h5yH{ZP+6qyiXX~LSa0VBMTG*u7;Ved=PA^jj0)P56|H#qUM(IEj?Q~T zjuC+D$dHj{qU_A1YhQRc4s6mIx^`CAaRA7()(+??S*kiu^6I`rsVgn>X!8`q*n-K= zq)}814`Btu$2kO24*dq1gx((n(X8Ix4gLqQN(>~P&vOkF|6$`l{0C$t;O({|pI+)3 zzHI*dzX%XYwhr%f-I0JIYf}m3TSce|Xx3Ox00Ed4AeF$l8P&1;6H>ehX#-4mN#6$t zJ^&u#>Ism5=k!Wb$73}N$!*GneOxx;L!*JU;UfMB;scn7X^eY( zOTXcAX*Gl@82e5(mm4(>#|H= z-$mty7!<=u(f8_nphc zOa)>moT&ts*?QqqGZp^sP=whSKGA!ALymC_Jn-|<0X=dkN$kpLnRobo8B!Y=0et`U zoeQ{2X9+jfvEAr>Xy-V*7~+8FgB23LD*xuNIhTP z&#og0jlKvPQc*mLGV3=wnmW{?S*V=|FyhcHa_yUd1gY$BluYWr!TbI+-JB$5i8smq zU53Nw4#+!j@Tq~c-}xhev;*l=ioFu2{(Wc(j;!*6oH7)VC)MqDqI`c=aAFqI5j3OeOUAD!<0HxVaIB? zb{#%DGE1OhH;D8*n?lX&enMn1L>izZM+U$ZWndBe{SAG~Ocbr0#WKWjYda#_vCPot zk)nNiU96>(ZIANly{^`h?8fvJ=;KIDF`O5?SKx5EL>;pDKWdkzp^U+AQ_kPqU?`{VZO$Swz z9LG*z_(^9^JD-ud``y^?qP z4c~h^5e0Tw+$JD|T*fW!1; zIGS#TXWqn1hN4{T-tg#v7qopv#v9H9km9E^Z{J&L@8exn5j#eaHEek5XBAp9Xj~@e zKaWwcaC&Mira2p*lI+dl8yC*mYj@c(VaK+_c1F?kR8Oa>-4y^atqpYdB|;hTDbX0ZS(5t z2FSDZ=%nz7dpfm)(HsC@<(h7VsY`~e=JT2+j#0tlC=`^GI-2KxT&nY_J2+{$wqd z>obDPMgR0T#I+NiL^lVZ_wZvl2hBNO4~cqf@?sUm;4k4adw;AwQ*(SFD504%`&$z7 z4w$q**VPc&t_KXV4_DKEYbSDuD>v4zh^0CRTH|EYv zjEbU>AE{|*Cj@z4=#AR(x^_Dk+zKFHsK%E*&QvH!`fLj=jK7(Zj79n zm9)CdBVm|1Js)gL329bNuzTJmZ!u^UKz|zWztDdEP8OomxYj=@4Jm(rk2P8BsaKKh zfqivWZhXxRsV*Sc;5+U(!R$OC62%#%JHg0h%v7>wCzbcz24dj~;VC9XImAVjWf;me zVXR?(Muplv8N$tr?ALZ>}5LP9;$2#2}_1gDXqcVWUn$29Z0JK~L zoFW|A9y+f58EhMXE_p%GWF+0r!h{m{QZ|8;9E))DuNAD3Pd-&X+Cc&Ks4)Ze{(@+A zSzL&(olJ$2d>UbzdcNBSuc5NxINIav8J&EcacAS}Mq$rxiuqkDbGTjUB%l$X*P_Io z!sXW5_)0;jW_USm+?h?_ZrQyaIUcmoTYiY1gwh2%sl`Z7CemgO z=OXtJ9%2dWJ&bsEJpxtLS)0#*CO%+$K1EKgjvQ6_xJpaI+xJCg4FEX1o)kZ;SNR|m5 z2JJX6i(khwhuX|GNCIi4pK7wBY8qK=3PG+oY$`o3G`O+7^V=;N@Exgo=B~sX^it%f zky7=o$l-5R{~ia{p25*+MdH_v*j(FxmA3mLD-yRpqFauNsAT15vFRtSD?AJ|g5X@XdoqDCJJFLZ^DbGaJUY*8X!4P`F&|hQ zY||4cCF*~I{o2HqjJRpIqn0| z@{bislj&f+0RKEY<_&w#zU7+qD--TSHrPS*HWV-ziOG;KlI+P4nx(xCerd>>n)OUZ zjB{x3V0hF9Y$|vdLf$=UI;{~vSoXcv#EuY$B0To zYx%H>=36OB3lLgiP}N32JT{Gh_@3nr9(%l5FQL(N${aL`6`UUMi2bJ$eQBadv!NVn z0aGkEshseNz3I+Wv5#Y0`nv6sx;H`q-6%I;)vwd28D){mWg%nh406)h5SeF&e>c)$ zFciTP1LJk)U9Fq)Vj9>+V{uf`3`D8_uiSICSk1n9@xZHj1v$=NV*X-d+76o&^fO!; zBA=EF;zY`mTpy-w#Lt9i1W738{M|VF|8J>(DZrLQdbb+}5Ph3PzGheYM$%nX3eETr zx%s@Ucrz-T;Wl$?Xf7V)K)=_2w`nuNZ%=c zj@Q7h*lYrKP|T|2g`|N1A?t13ODI;lo=!^e>Tlq_b&g40dH$_|wG=9ZcKro@tbZi5 zK${q-`320njyitdC6xYmRtNBFE7Frf=FkP^t#I?2y6FMwz64v72pu(qS(?yPE|1%H zq0?a+ome6-#?%mV!HweI2L-UT)pzWb`K>9WO@xW^bk6d^p@`+O_i-u<&}}wvTkFD( zdY3PW!2?G;4a5@7jP+jzUh~o*AJ@O|5rcKxp%t4<7)Rsf|D7hqKU%>yqSTx&yFj*C zl%LeRGmBCe6Ck#XWecEX#hm75Kd(u)Vz>}?iH(~h6g8-)PCu|n-LLswGjmARD$5pe zvdCi3(++JPHnYcaJ!W;XDhAMv9Wi{HTWvmDc`-X{nw=-*;UBmoPpYyERITfW#$tSprcM| zzrk^Sj88mCS!KjgxjiM`yX-S2eA^!eWS;|G!xDO3!htNpT~bmsRi`)mkvjjc6f0S) z#T`Pik2Y*gnO`=}!Pz`jlUsKu0Ij2qT}?Z-P(NG&bH9Ogo(71;ncn(88_} zzUq$E`j|-uS=cvJ&Hyfo@!i8z=j97aMAI9_v_TtIE4J0tRbM)945n@dHNkh=&1_KW z`NBdC(If-Wm5314pbpizK(jZ1>EzV6_1lB$*bNapK?k4r+dtYs2j%OxMK`;3pZyc3 z(Lk%cf78`J*H;C`*ecM0B=rX@8^5C<29ENGg!$u8$bE(!_i9p&z{3>x$9^%ZoKb_t2mC>N+6v*acA}=G{bjqIWjEDgI6nd6g#E}^s?&|M* zv37xx*X&~vera}S>!x8_*m2pm_~e=K$mQlv0OiRSL$K$L=A_8Q`;(8H67!!6rz1sv zxSe+~U|UmDXb<N{-fW9T&iQ|4cG+&o)o3ISXTCH=eWPW8^ibco%?7PlzTS4KB zUb7SGqicKd#*1uN^yVO&X`X4y`{i*@ga5cB_ZorbMN=t9a4FVXzNn&&R!h0sM@l$< z8+AX~5qwcQI)@#S>~9fl?LoYCSXX}3rkm2dmMQnso#Se6wEeg_G%=-E4$2>lfv+_lp*_&M64Cs@zYpW{<6I@Vl$ejh^)rO$mBCc-A^laUH07dhK zVO{uG1W$Dt1K9UORP?!S3g66C%>Ah-n1}jU84Ux+&AHA&pJ<7&{muDIhoO&yX0eAv z=jX154vtSj{$nj(tA6h48aUtEswo8wj!RsMVh)QZtTv(OQORLABRQ1 zO7-b=DK^e@eJMZB!@ir3i&uy4&30dFujcDMFAD5)+`qjETFvx7mqgBJk%C^Y{Y?T< zUYv;j$fHzSW`_Y*R0@H8zeMud!C6sLMOOagKk93VJUdA#^+?YK7Ffr+nqj9`EvJiD zzgNp%8%>@#1T)+N#RpY9RRTGWh4#cv4Jug>^khE*z2-!t5go>6aEv|IiqT?dn=qnW zc~GV=diF?^7T$2VRF1jv14%eJHxzWybbTwdw?_F;;idl*5Hq1M`L}1N+cLxKV5z7A zrf@3mEg+^0S>836&Cd)vKC`YhRKs*k-c3IbU}s*nsE9QFM{^8Peoi&DKl$rcGZT|> z*z16>-3nx6iW235K>l3p&NsiYZ&_s5O?~y&yZr@hwLS`78d0`AVE1RWv!^IJ1i0Vq zOOLb9Tdr8E3F^Dnezv6C_Wf>gyMAxSVMulq1SMHdcD*_^4)d0JFv}w z=*OjIe!q-6M@cjP)u?ovOD(p41Ioow)4n+H-fN1#6D>ciFU_*grzEn^DpYIxmc!wz zuzc+=kxq2IX04gIdV9@p$E(q!>mKllsjZcKlfE8JcPW23?oC(hhTn0|XD0F2GV{KB zOHk)q53Z{=fAWEZMXzh$e7Ht)<|MhmVVI=wmQ>5dT9*G-gArlG`KCi;M*>Sj8OcLX z!@mZeTx`xa6S$Rh*^zxbzTT-9ErA6}2|y3p!Kfa@Q8u>5-n%}o_TRqfGBmgu2Amj^ zE>;gjy~ywmCw7|*zzC1k=}14L!aGnnq}iN7U-Aap>kn%w@a#pM@FCj zzTQRP=|nF1W^wrLy1;BYYMu{tAeuw!rq8`ygYI%x^WyExkBKDAyu`zrExQ+$en!e; z$=GFdx3Jr*VE>!J8`$Q`p2Lm#@5S3FZ9CrqDN)|_f#_7&Rq?Ua$loQ3-NSMD=mzHh zyHAw%_NtFBY~*|7!YvGXeKjBKFL0aMztTcNqC0lmaB+39A}G>b|G+5wZ})D2*=H}h z+?fU}0wVk>$}MO2W%0_~8R)gHNpVbaOlwV`m`U+yf8>q(wN=Wl{+08s@$~bp85^WO zT*^&EfFYfiZt|$}(d0wF!=b>6zPi(l+f#_;QFKZngtC$B!2=Nf=exM$)6cWKeqv`0 z$M@BvkJVzJnfiwDWE%MK$I)k|*3K&>oY3+3l$G=9+blza&2Vh8M?ZWnGyRubwY}uW zl0{E569YoVAHF}U5fP3JH9xrbt@REr{g9cQAdtu|krUZRG)d1#uWz8s-}Ae?jsY%C zdjrfKzOcSdOT*$mqK>|1Rv6Ik1-76b*UBd=R&%tU?tfRnB(MVdB;OM)bLBa*1RB76 zDk2ZG5`Cr!Wm7K$9op^agO>s3$7rh(mVqxwro*mf7SFfK@q_U|mKE1|JJawP7X zSzWxSWtXEOEiry9d}d5KDsvAyM%QnQ-+{*QJiJahGR^&o2<`}@_D*PDqOereZPij|n4zmd6xo6Xst=>1Y0 z@S>AkrjyFd{SL5^pT(~#YdiyuAK)^Xf{fb!M%+bbBFB{^;Qyj{Ci$l}91Ke%v6#9> z*99!Ccsq-D|IB^QBEtk<2n z+O2J-t>vjU6vojlL)@1>f0^^it%1Np`&Ih+A!UrAm)8*`{RGYj`N+Fz!V5|@FTx6T z6{D^+HFq`U~>eqH_PEWrb1A%t#I{!0}DijCx zwZL~~eQEy3E%xO@K~Aum22QcnS4jtn`-<%eosDEogqOES;uWD1XVKz{dx8o*MfX5u zck>TufY@<`8F-0~V#A3;&0J5@_A6={tWRPSje0d(ZjE3+?W@nHxI2r~C~pqL%+04b zX+d6l#kb0iE5V>|%YS>(X#_OFRjJTzrxft;NGaXxnbP!G;a>J z7dd&vU9rG_JtV;X8M?WvaFy8@JL+?^k}(4PGOX?EdfJNZ|BQW^h*I@8A{P7MHMddF ztCf3d5ASB_6csSb{RJE+^i9Zr)%2g=CTV51tT|dAI@}&c9-pT|je4;g)9w@KfYuU` z#rB0diWE#gxfH#J{EhknnlS7tQkd}Jt_8ZZkE{EUrSOvf)tZ!QN4R0qKZ@9Xt|R)7 zZErX}--2~Eqoq0>wJz|-0DqjjzXY>M==^n zEksXnmHJK+-#~>#mHM2uHN88`o(K)tP*-FYLTOLrZ&HH!U@ix9pT^({^b_EXp2qM{H$~mzj9zs zl3EO}L3YbR92>i;GlgEhZ7xCU+uLgFWa*{ncn-pQ4NwbErr~$A zC!>{@<(uizuYlQQjZ>^HP{wt$?N4!b$gvnjJ}iwqWhVgVWnVPmUh|2bWl*m~3N}Tg z{m{PR?{N1!3<{N!6Aw|V#um9+&7KGn$jeR`kZsLwJv$M-Z529VdX}UUjsU$D_&bXq znsocH*1s!>HP&foZaW@b*H~QezF92SzY6H{kQpOwIa?d>zfIi51Lwu=yI)}7B0tsifVq134UDGRvjrHjs{Pl6Tv{Xg|G-l5UJ~*BC84W#Z zNzu<_8oPjn-qs=X&q^3JV`OVO5wV};t!FK1OJpIy- z+oDr-yHNkL!8%#OoHO8fz|aM46-pW%>X#wRvtDej1^(n0)Y^Z$X2~$QE(hEH1wA|< zL>j_@4Q<2Lz+!)5eq{Fc@PyI~Kb~FJ%72)1bhXL@d2=z{ae3Vz-3H;m)S7^~7xk~CDsLyIa8b(^sceb~8jw~RMlj_fkL6o6(>b_$UK;2e~VcLJf@X7gSfw|d=eAE(FPxd_-ikNAp#&Pl@SVh^+fk9Fja1sR6>n!cQye>9kJty zWu}3un12h3)2(-?isWYeuB@HeyO=J_KaqFRYY>6bW>k#L@c04dwB^js9S@P;*<3H( zAYJ3Hl7u3N0sEaV5joh5|4~8{u5$&&sDAzSrdH)akE{+UWEp}VGX}yTP=Mm?z z8^4<9|LpF;51#oU9>GBoMeWAqO)XdtP(FKXU+o%z`~9DHHN2NIn>M2USD^-;&vH-& zJAzWfjYHcBpZeaQm@=3SMa>2RoEC=T@W5ZSQS9JnN-Dig`Jj2C8}h!T@?y%nBl-EAWCa>e1*Gn38d!Vmhik9S>foyoKyhPB1-mQZ2g{? zNUJrWlok(`wK6O|xdrqko!(of zU}ih@GhwtrakYw&33T{z#|zDf#;=HiO$c^zS3jV-7Pbfl>`2t_s#qWLrgC`sL~1Bh zS}K-$uA|>krkE9p3HTL#iWmXQV6Yisg_RwNON4v(mlW|Tg&V#QT4!fF`id7gCGoKG zYvg^`%ajgyCV@Udo^k`WC|%P%@=H!|CoNVo{SjR4bznRHkz8 zD#6yT#GI(ihBug|b$1h`qV8FsZ_neXOK_76rceZuZ z@-z`Bt9DhY{>E1_$#rQyudOTwX3)@5FLGa&ejI=pVwJsfsAO9S>rDa*Jm1IaF7eJP zDIe7fQK}kz!gBB|aK2j~%*q0-;EyQKlnsU|X$@}#C@@uTg>+uT2jyP?*G6*+ptc2p zIn9TEKCY+d8B;lr#b^e)P0E-)8JXu57p+y3HC&u}fo{V%R81Q(lFz7N5qGxfIh`H{ zoRJfs7*<-p;;_TfEtY$fW{b>>7<%^t@)5uFZ9FJu&2a=`l0hdWHAQ&j_9c@WRzD3S z$24G-6Acn&5-*Qwf+RqKqB_vsF_a5y`kTd(q2jrUGGOEFfW(9T3e~WXi9i3iz1T7V zf77`|;lowAJ8RW@-^*p&0DjHcmd^LJhC)l&K0+CrIw|G4iA@ub`~*{vH53P>1GFLl zso%1o|7-q4r;$-HI0p!f6EXyRr2&Vm6plF`7G*lzdtDL6NSX+i{kOb6a- zuq#&%=VNV?^yGl8;?KD~nvfXFq}n0zRhejJjoA8fn2NNJP%cK3mh>S@PhM+Jks3>p z>i{$t>F9YTy^aO}Z>;*JP7M5&rH+-G1J`(fj$zKIsMUpU4dfr^-V^hxAGqK3 zN<=xMLLu9wBAA+`l&5IfX;0RzDs2G3we|fMgjB5stPNUv&b+i66G~)L6U7}_;5n7h zvO^D50J$(iffrwQD!Ew=mcM9hF z=+N9hlba~7T}5kJtG%vAY0G8ldTz0-dYDO+AmLD2-OfaouMscr$fEHW?n*Ja%&!@- zBQ&Q+T2>C{Sk9m%lyDW#2=$V8E%4lk&*=WWAISLYZY*BsGAn9Hfg9-ed>UL#b#waC zkfUo!xX6B1+7d@BeI;?On}QdXM)9u!%Y36D0L2XmS;3PvVZ2QF1K0(XFmO!`*4)uX zU(*3AM5@^ay3EWXll9ISG`RyAuuYOpG8pbniMHH6u4)J8hN-BBp_pkAG6!UuIsd}0 z+}!}|N?mmqY6?)^7u|$UIgaD#tnKwHd!Y?qUSx*4mhMleSJH8(>ap83X90fdAsQD{ zl-_59~ns!ZZ29=13KMx zp;-2=A7v*qF3f#GtkDKiF#;+P;;KqzmS2~`q5xn1jrOH8 zL^9(DIS}ljCLx^OYh0i;Em!lJN`TAL1XZ@Y=Q555!L>S(WwQ3t02M)SGKD5?m15kb z%?yz&*K_ z8>?36HdfwObVWgGM3*htiK6(i2V2M)aI5<mdmbsfl9y*ZwolbH$$KZ{I9?~~sjk8*0FUuB5#K1YFyNzJ(e zhAsk4DG!WLHpo33w^Vnh*H!APQS6d?Wa`11tYb?0CyEX1kqmBD)c%Jt^bLLc? zs#7&J^I`e})ij&#ZGG>1Uu#{zWo!E$_+_0lPdtG_l%Lf&S|)~_QM^N%nk1AfgHv&} zHVej)sUP&%h$7tWkhB<~^>{kH76MdjlXvRMF=GhHJ=g#^)mIUs2 z)TYFCxgv|uD1b5RyV&G&JQ^nxyGT6+h)aLKM${k8g;c@3WelnpA zSG7J@UZb)bw1YEQQC{3l1S?lgF6c;RJ^2!Famb#Iw=X0Z7;L23(U4Bel{=S&U5QB7 zIBfz=9!o)LS))rMH-Bpa<$^+kIB+ub@LYzZ!nlQlVj{`MsQhs^o_I5cs0Jn}38ezF zi31Jk3a2rPBYWJ&@%uGbUoBn(gXl>RULo=X+I~3 z#Zi{)>pd0*xI|z)?7FwIhk=Ti7cL*_v(zM{ld_3-8g2D~hS@b>V!W)PUfB3s+?1K? z!Fe0ir|Zi$5;NnjZYor3o6lmzceJgim$LD6Ep!fuO9R^dr`DlI>OlEz3Hx7DdL9Iz z#y&o}v4K8<$H)KgzJdRxrhkS10vtXBDLp(CKtS9J1t#pv;*AE-fABlA#1LIgquklncj%{9OSmbyb=hi0oBAxViMy`g zCRX&Ot9c3H*>(pV^~poW*^bKS88m3C9YE}SkQWjOb(4F6=Ea~rf+l=bSG3NA^p(Zn zxh5pIyeirJaa?oD+H}}0prBaKf zyXX%g(Au_6TCCh+^s4cn7JLt%H2~ECk{9N(?}w@0sIGD+>Gm)DJqS_mh$+V32>0VT z+s;4gnf5&PT=@kl(p?Qx{0?wEK@_?g8@%cda;k`W`_4oRV9x1bpX%cD?n{+O3}L_ZT>H?Sar~s4r<9qv^&aG9J**mQuWBhbMRX|Y3hF#d196uvP52BAITvr zlY!LDH9*Z!|AQ!lCfR%n3kSf%bw0A_%J%@EpAKvFiB8E%;}G=SPw%xdzdav7&b5BL ze)hIk_t(g4;k#=Xg8%e}64#z^4+0~_FYrxG`DOAp0-z(FA4gs-Ll-*vdh(JFF}4Nu zr+E{$J&tY>gp766or-}0oEu=)tP$Fx>|OyC*&>XiVUEORAaVf^QY~-4;3CzsLWG&y zr4z2I+ygApQeAqKBb~6b(T6~f=4Z?X8oj%3K#c-v%Th4Ayb{Qz; zd?P4B;sL&1@1fhqCV1)|D{d&+HZuE4Zj-LImHG|XBtZDZ7Oa4FW;I!~EufY=N$wTE znkec>Y$Xn`l*;$S0mAp(jXgaIgqpr7zqLN!2(y(U{CoSoYXUVsz((~v`=FS=>CU(c zcWTaW!NKGrIXX;VS*8(sx5IF1vmpo^hf_E7v`!5D1pJygvtmJrR&_xnY4K#50}_>t zHcLBQO42O{hp$;m(gc7wDMzVLqm*$ZSbeM789PtF|A#0i8;cE6!EDnk0UPM&4WrZk zNYsqkO9};=%(sH}MkwePSn{?PF1Wt1 zgB0rKl*Tjv52zmMI8B`>qeUNE2rF_;TcDU(IDg;o^?suFcMypoG}}=?CD)29JK-uK zQR17H9+g1&^b3D-vy#+MPa04Zf>EY1fx$|9X1R;41TE)n{1?NdfM~w^@&*9yK*_kP zmb|RkbUQH#q%02z)1+H$3%Cv7%j8)#y>$Hu!Q?^$$TvWq8GZHmI_p&n`L(4~=U_dJ z$%~y!Y3ZH1E$n9+16WwLg$=f1VbNphFCvxc@hm5xnnwH{T`#9?em01At91Y=5K>+B zuE$lCZR&EdjN2JB*@V*asPUGDSIy$y!{#8*4<0Hx6)i6HZsUd^Rx^KtIe9b(ddF^8vdTtk+;oG*!Ih&!@G% z8ZjE{n^@4~t9wXKFLc2rJF@pz^V+fg_*w$*ZLC+Th(ZY=t! zNjeKh&O&*6Dby)HZj`L=D9Dt#ob~Ux%ARfo(*sYU42RMf;LPJJ0tVD=yVrFHr{6KF z*rHa(L7KD2-V}*nlzuv^?8G)VIu`Z1 z6iz?H7?xeP?G-!BjmFY59l=J6;rdC|<7{+9gJp&QD&)A<%|orIB6cFOEPR43LW6H% zvI5stT|4pSDj!$MIu}LiHomO3IVm7}eV8V=OF>}SfqF=awS!xl=Oe4WPS(qtd2=tR z%q`vIPI}W=6?3y4p?GjM;p_xP*^HEw0JWkv5o~&FdkRt6bzV8N$WhcHFMvB6mW>Rn zUw{j$(~XmUH~@bd6%d$sCZZ-nl?F7FJSDHBWMXSLiTa-`YO)c zn&S}rvgit1KQ{Jff5m6e(3zz$>CFUKiivbval{GeOL*(?KeEmmvf94W0VoAX2sM*D z=E@X|J->KxlSlHQiItXoe%b->5Cd^a4jCTojS=H2pJx=+q>TDCO<+RGq0qoRA2SPE zoC=Mcl-R_d6SZ45dO$+0L#Hm~-_&Y!8-lT!HUGgh-k77UaLZdl0S1eGTLMOTf$3w7 z9QP^)&a-%n%r3&87V6pW#fzS?y#9InPR}72X|U3*k)~_rm~0aV_7tzM^`a$qXpcpM zQ<-^Mna9HtpD+d!SbZXc=dd3$8fOixreR_M=0K?mZvETsu|>^fWIly^7S@^wwv>2b z3Sru#DSYQc449}jo`_5YoFa}T?O6u01xbNE5f~8L0G=KdAHq}5Vwh+T;1G$4&R!u% zSCj5@BDn5hc!ml=Id`v$i_Z)hTQ~1i#0k>H)zVSUD9|nfvZ%Q0bGs|5mL)U{zlPg?dQX~fMS*9rqvSo*yZHv-OltwE-L^siyFO4iW{VN68wL0^?eb5& zJDl9kuA+YKXC*>UjE~;&6q3QL(?=dAwf z7y%Tn6>Six!zignN2{ZUA1L$L@dtI;d19;6bj6AJx$IaXD|Hquve7Xq?9@n0S8{j& zI93g*HR{(wM9+B%w%qSOiJk?J$sdTEUp!8+UeV9PXL;UP9WYJ!TUNl~rT+FoL57GI zV$-eMYNTLEfv1!fchdny+-Hm`WBZf`j6dlk|7n?9@!QR&+-Jj#l@2NGSMuisEdLuS`Y{)Dhtj4f>G3l zB+7<)(kBYNyFTlRQ@&4_e(1%{oBU7)L~Njsv26M;?j>WvzT-zS5FM-H``2FBnAlA| zoCs{&HYB+0X%Ad8(%pqu&i6o)0t%2$_=%wx8ybGzFvfE0iOoTL9pNwWZ%df^-iz6I z?HDBL;OSV7U%&`~FrzqJ?&G8;UPFdyM|aZOg|JSgVm1Ixvd8Bqk5^D3wzRpm5u-l9 znEvqv0hG1Ew9?58>~pf5V4D(|9f3(tUPi#kb7^SoaX70rj|OS*yxzL8u3BBKx+l|0 zWVYU}q{F7?op$I6ppKt&as!0p)s0VC7);Eeu}8`1v*unX3Na;vwze}4_5O9Cw;X{6 zcM>iWnOGtY-)!Jk%IsW;`;0UG3L8LXbYfR5rYb=U&g~C2*6FSm3p#V>6XfGUAa@%d zaOy;~0P(|jos2Tv#W`^x{@(VmiZ;^7YLFWFJ+RDHE(@q{A0e(t1yt)7tG4G@T zA!L%5ZHL^U(~~-0qnfo|i1eev-n^s9#YskwV?P^{iArkY_h8aaI50}!6eiVx;eYxj z(y{+ZGJId{t6?$!PF12Wj%n6>uv%R0?z_RohD1(D=*{XbDA2 zwUD_gaQKQl^iG=2HYy9ij2J}%<3xcLiVtHwa3Ek|6KNrB5(ku#vx4C*I?^S2}VxyDk8_rc-ljDcU4}dT9KE5(h3{6?Ms~~e)rb!GV*8kBBRuR`%!z`#i zE{SL$)fgmXXYtRqO?(*}aMd))R`~rOmBwiPy!YEoi#!QFLs9`gEO{Bx4}UdAqzu8W ztxGrg1Z8aOs9g`5^;2*prd7n@0YuM5(^H7bGp>@yr%m~a1#}T&&>qqU2ztep_5imS zw|h81n0LL}LB84?%v#JwE0qe#wvH+=PfRr6Z`z{_-^i}(#Y~??E=~&HmcJ6&7X&}t_{RpRgV%M{js|pj zV=JH6nzTT${yzP%SXpOn$^|4Wpb&Wg-&K$0^AhQq$1Bfl%{Fj3$Ix7{R`*SO|5x?v zWU~@At9ZTVRTSBEe;bS68Ew#z*{)x#c(m(mN}suCLD&TyOdY|Cksv~qmjM4P=Fq7N zV_pX4NQDd)e6g_l{2`#P&W@%+Ko!ii;J(+gnsdddp7%Hc2P+FNXnXPuR7%7is>s8f_Vu_w+iK8S&!?{0@MF{4pY8)=&tiuXeV;g^>!}%3L%pethUTD{Q?iVK zS@I3Aosveu@ll6FiGpKJO?W=uBL6S|Gu%>C#_%7pP-_-sSr9M$;X7{-ylwoR8G6$7 zZ8yv0^TfO8NZ_i~=Kmb_{QuR9h_sbDxw}YD;1uy6z+!tp9xCZXoPE~e&bO~^+|Cds z4A3DTP@{oqbg)SZ>=yS>NA?vJM0Vz>6Ht_oZu~JD1D-U?5HFUkhJhQ*EHW~u z?)x+Qzd(K=uRb@z7#bvrbtF#jdq+aRDZFPYW7)kk^yDG72#U}R023pr?0E2k3X5+C zUq*|`FOD;#jd(2Y6k_yg=VcM6;H$W+ge_4sM~0aTTes&p(s+ zkU7__n2JgXQCxjRlh|2&p%H#};ypjZ}(K zCPw1WmDfQXuC!i_B2(kcB+b_M+a{N*h{h4bvBZo*9dL%v}}1cR7WG+(D$u1xBihjI=P8-%<9 zqJkCLU3Y|$!MYJ!h-&4x+i6w~#j!=pl({VE{GL?-^tnz>V$*%x8xLPe!BgPy8N!ZS;jDw_y`{~HqHjpaP>KbBzYA&C;y~AT~ z22YMI25KJry#i*EZ~u_mG!)XNRy1qh7MXDRn{<58d~H6$*%>giMpQq~-C(1915iO2PcO>#oHDZe%!4sM+Uo{h zUkznF>lmy#)0ie4$Jte93__1ZqqXC~AR5`RHeeyHn=1%A*kaJgrks?gv$}Ro9R9_h zyOS?S*i_*WN<1yHWpXqU()*NwEd|l;5{y}5NrA?BV`0xx7K0y5c=BB_-ivb zy^Flmu(aWUX~<4isa(MxLRyG3Yu0a-L&fLV6HcU_xDdgxP0v>i!S4zG+9OGEUTiO< zHai*^A*PLVEH&$56C|hKVWLd4{WWiqDH^~hc7FWCUMwm908gZ&A3Lpxtk5zc2>!2_ z#orBekWRQUmlrC)lX*ym{ucw4k5^ZS@FrRYXn`E77=K_D|D)LkA%j=Ve89kUVS9|U1zonQR4qt3^HtzLw>Fz0t9voOy|D69 zC*XSvs$@>S>DkcD>iccE7vi5L#1_)RUGWR!Kg7b`#66u44>DGB=U)U$T}6PiGIo^w z)9GZFcaBco#YBUBRM$hc)?DdgYX@PX$hQ3KCqvmUsn|MpXk->BF=oirTs(Yzmi_fb z@5sCUhS9`?5D7h9n!*Zg)dG&a5!)=IoS82a&UuegDbaj(PoaL@$td9aq6i|5$M+YQ z0$*ntzP>btB?ba-wS9#y%;MiCZOY95E=YZy3dl+vcywlXfr0s)TZYrlQFfGkWsU6< zAX(`9o&b@urCKeCr?F=FsCc}yld18Dke5yyTs>q!fQNad2w$y{h{O4(?H{F?lP$@! zxC}*jqlFnDI{`KO_W)cK*nN`JCNThCi&eF9rpDx$j*6nJ zn6%=x=g8LQ0unYil8o8MJRNuw;B!%44r%8}cCqTNi`YV_JJ%kUbB8RKGYiLk8)IMT z)h72wt39)bj)O?m7!CAVG?VlI_9KuGK7)pvHSlMNO)1GCi=rE=i|1AA~cRl`t+D! zBlVLHG^GIq?ZFQ?tOAKa*6^kr~94Z#6K?vrN8uvdVArc`ASKAy%5p0)XI*`{LOC2i*756_V!V&O0E3^NtUl0{YjUx zl9cf$*JN~&3CT%Zn`=YPwu5%kaBtnqMNo6f2oJ|JGqF$oFoPz>qRFPd+r^IH1r|@X z5SlP!>e{+K2xJ|4G4nB7=(R*v`djlg+_7I%l5}8NT5$<_&>!>_)QO;?54`FHyCIEges;zCRhFag*)A6~bT~4`4jpsylD^RieSVOyYC~29cM@+H39~}x zRw~B1-|;NjOvua*^sr`yOwNb0{0zj-1I3=O z7});CB>#)(YsAZ&u12+P3*X(^mc8r_^r|fffre4%c27^{%XccT+@j}VNGVqXb=8Ha z9qD6)cUVC|G_WD|H6bgIx0p0OK#(-dtwt6!;AHs z(3|HE&U|i#K5=OtoO)AdTl9PPZxtm$Hi96~7KP_qUJCTtn8<{s(BGX|@$&oy-u zuplpK1m>^NUesL@BoGO7ewzD$_PVuiZ&o4^`#jL4CHd`;Dyh#CubJ6~dbjb9uhG?m zV?sS##raLA`kJD{06Rp}MH}A6DCVmD_nfFY|Jz^$Nk!De!dwhTOP8x8c=Y@F&UOya zAww0euA+k#<1YzyIN!{07Onm&oEbD#abC9(jl;{Qx6Ot_5Yj7(u3p#FBMR)7uqW~f z-J$1IaD=T&aWd^FOm}{UtB}Qesi;ucTW%Ck3iwOi-eows=!NH+?eD#_VJx)aqIW$T780M~x_39-RXL)W?qlmsFQ2U^GhSBJH8sq+Gu~&puZEY> zV)q_TO5f$*sOv7St%XMxGlX?_p~nI(y_dzWh-QswQfT^ojREXi^Fteg?tM-D@|hLfIzqzXhXPkjAZ zc>a_e604>9(n#PLoBP4ib^}LP{}mdkK-H%qDA~H38)P2-Oyu%#t12gp;d51xzI%0~ zLmH=sf=B?}!ES|oNlcLgd?qNIG%q#29_zSxfp@2MD5|yT{>Tli*oX*H({nH^y`1=! zs41;ol7yY{J0vT5vG!u^xTeHy_v=K3LVC@y{f9<3N0iIY7>N1vb<-iL#E@DK+HkWD zmpP|br}e3IO3R>O9M;k}b}ymoH_(x5Pxr>cl`odc{DvsOTDSa8+fgp%d2$OhceF;F zOTU5(C7&jSBP~iho0!yT?H+aaq%!uczQHZCu}#z^Hgz-jLg*50Stj}`!x7gfu#~~( zwGD42w1w7{yLt58$x`ix*lnsIRLmn#PJD74z z3XKJ3MhAH|nQcc7Bi4}Izq!+`-z3;8J8jl z$t=c&ZnN5Hbi++%iT5L@=<5eJ1un!pph#bp?e*wfplf*@72|qDGHS2N`ht8kE@#Az zCoogRhbk&1a|6v7Q!G%jL<(%kEO+NRwyjz{4B34GtM6cCH~zIOIqz_3MS6Nflr2!RstYiRwt^M&_^3RMHDOt%SZKz6m-0dT2 zTkD77NfkQuEaF}EKhw5;OpjJ}=b9Sh@p8i>-%$lAD8qF_G?Xi*KZt-SqK~Cv^5MZ` zLk7V`vZqd(^Sj6`SJH}WqgwOhVZ<*-7j7V|&psB!_dgBenu>LpRS94tfqv|TTEgl= zguO?2GTpy=GUb+MXOPE=kwS+e_TB0}aH)+G+O}HrFcYtgf3O>JrQ+c-(avXq&6aLU z$3F#y9m(8^HH1a6qZ*=?=C7!+vqg$!+I@eyKp6IF%~G~I3;S2R0@R*wGRNYwS@~+} zc~0ajlQShryA7zxq?CjaDZ!g;!%V6Hi{Dh~3}UtE=$Co&1hVHf0yKAweRUej_fF8C z+a(`%jIQNx{#*N}EF2ZM?ivKH_+6hEH$$*} zmtKyjmog@Q#oG@lqLYzybY;V2M1B1zn%^xV>^p{%(|N7@b;UDK1c|vd!%dY&3}&>y zkIQOg_t!G7px$AMF$5A}!cCPoiK=LyRNjRwqKW3ywaB;h`%r4hbLl8-kAxqf(RvFM zrl`M{N_r)gO(k~3IG})0xV7$rtwJosPEuS9oA+vP3iM05d~YXdDRDTZ3=hZtQRNDk z9UED~$!O%hnKwD@*jOYSj2p}Ecx!&HyRZ<{9q(Y%n44)e%b)gZ-_e#oG!CPA>5ph8 zWyWIQN7IN_6u3Jdg{~hO`6=?6q#|=?rU_p^Yo6cAtS@)7Pa~d|v z3wcGA-dj@x1sQ{dQ@`|AkyW}TDL-`wB)|*#Nxj?z?3?T-q*||Wi&bauAc-Li6HUwU zJ#iZO4woqr_ZKfNyV+LEI);=KBK?M>dqpEcjP~|vl@pzfPOydz?%>oYHD;ye*WR)L zH1$FAdABn_<}+q1cVjP!oig3onqTu&prJt|5_F6SQ@D7FXftler!?I`)1lJ}MbtO` zBG*l$t4MBj?{~TS+pm2eJy>r(qI!6C!smXZNi2p<$K!n>kI@*ytLeBH- zo{E&szA5rrI#nS{?g_{$Lo`!F{qpCuS-vcGmsIC!-uH+(LudXkIXVm*SOh_1xTegg zifHfJZSt|9QA${&)KU0{{Fc+JlHVS~ zmfbz!C2az2 zejFb&SaYOjy=9P9kGv{$;Z2Nh{WlM~{l?hEN-$%{x77I4U6D%`l`!RrI2+9hIoGEm z#ad~$CnaJp>`5laq@Rf#Xy{7Y4Z{R29erow*E4J6XmA~{bH#b`2Q2mbIn~jLU|Ey( zpP+r>#o`2*mMHXxquigQd2l07EQ}Ow=!wle1yy%HJ1@08xJKidtL!}Il zI=kBjX`~u3$R#~;jvI^nI&Xm>vpdN4<=_BivGyN1D>0gtD|k9w*Tq>xL1qSPW!0YK zx2f*!XEmJ6VX0YNuBy;0+is+zGQ6A#Wd$5o%#TNuohFL0`U#qT9`)R%7`opCdfGLr zk93sQt@%4lDHZ)+@0p+n%@l}CD)D3lMs2Y=Qu#7Qe-gcZJ>EAgXh`rYTB%5>y|uX5 zU7%k!FBSsLEblz@Hsw!1WK2DynQPepuHgzA7N`N6-W?o!yJgy&i`^#Lz3;}~{EZ+P zinf=aA9s81=UB!OIFpB>bnavsfy{o8@KtV6xzdV}Sz5xLTQ>l#c{;MX7aM3}csshk z9rc;*l`orWn+~y(D{ToOM)zCK%J`y+zt_fJ-Fg$eCrYZmFcj8A$Cc0W9jEWq2z;E| zLk?l>b2O7`)?mL-k7vZ2E}VQ1pb$f!2H}%T2N9XL3jo;FH;<$_T}#RNN&PF5WWLx zBfOhszRc|~M^eHz3oE=8EmrZ1dc)h0GoNmJ&P;pOqV{vsl;bz@=nQMwvD++$q!f>%11qGZ}{vpFLSVZKl!%gGX#E=_!;`S z{AsIQzD_%1WrSt!a4h-2(=m&I;M#EW;>Z7Zo{B)amYsm2sWhlD3#60d>1z zLrcFTUbk)b5#40=cc&JfVu5xRFogSE5?X z&Fe!uMc#5u5Yh<^GM@#0jSf<-9Jh-zstrb#1}poC8$7DYzoyFIz4&x?`-I>@eoI|> zE_!|w-ECaoL|_=G9!{Pq;sY7)ES6yCpBpTGo;DV2iTz7?rfajMf-Alo&w{l<7k3tL z0)ep*D;(UP#V}V1mth1E-0IS`=|T%D*f^0f^~alrs?O^=J~Uw9)p_fp+vCPrqnrKx zMHytRvrF|%NvEb0drxnUN~-!&OLXw&gc+)i@P_1y2(+Ds_$>RF&a|ntud7y}<$0gL zlG(S|)m28qumFSnTy!%A{|U{aZ5);0bzZ{kQ|v#JBVXmo)`Tc&`}VKWMz${*xtFOp zRLofv-}IiTQSnbGiNAFOzBJn|j;3|MOgGQ7jeBOXtw(1=CL;`K4|5eaKG-Ba-fM=0 z`)`rNLCziS#vHB``#ZA{Qs^LbudrqNxt+WNI$mANC!M`t+2ZxB&)-!qUipexU6GhI zaiJ^oTq>yw{6GgG<~+>V-gDW^$-VwUz-eu4>P3TJI=_+r=E_!3Tm9B~(Je2*G}bJ+ zI@A;?#xFM%>8?21j#*N6QtqnTN%SC0BnMV+M8`ou9PpR3E0gSXY9)(RfhIB%@Me8U_e3$17ZH7z2MBdnEl7T|*ftZMiKH22j~c6($;XAb%0uVGR0AdSJ3|0N z^1Dq^6cPi;uP{^$oM_n|V4CF@>Gr2)!6GiK>tyP~ON#VXLLF0P0FX8&x<4 zncZaeI(}^0olmZ8cT1SaMJh0Y!sDQKD3Fw`RFMNdbt&AG>`~>q258Sua^U3u!-L=? zY}Lx$?pKmP063`qb== zXiHBz3&%1y_g`z)xwvoGS~|QVEo1klRDFLU5kJl5+yBw;A4U0vFml)NSJ`hk!^OgI zy$I6mWBGUbJ9|~_Gtd?l-wRmDu~byNSu*z*zd(#<8=(pVU==Mj@Aag%33N25F0+

I&euoDz)D%Y@kD{6FLZRcH@S`id{ zCC?E^NKnDiXIQ{Fw4n4R`3-1>qH*DOm}zGykw3V4dVONEpwe<1^_J(I9ls4-12bzw zA6rFImxx-b7Ey^vmC)(VhiLYvEo(~YlNhD!Qap1QHjYoWT=|~Em}0!e=+>5}QI;1FW@g2Tsn}3<+}IkI}cP&x2KNw!^RHaS!%<#xpFJ$ogMP zhx8YaN^% zuKVskUBW2}06)6~0v z3g%eCh(-Gqn`=38V0y0d+w?(>^tzkuWwmJ=#5d=>okBMZWoG|PRMlAuKQP0ouhC?R z!}62H09oV}-3z+g>1AQ0$syGxm?-)!lokw>b6QY^R`Ak5)dPf!n*&9Xw01Xg8%<79 zu!w)|l*rMY{s2yN_B7x`|Iw$Lyj-9hCl8K`|58EMZ)y^tm--gh&}Y+u6@fXxniA=4 z+!*>vUo*+Xefghx%jqCj9dI5I+Uql=b5qx*s-^)%+K~gLBZvE4qLCFRS+-?aYLmgn zL-_n|ge~$w;`Cgds0acv;?^2SC;jkUPLg-);Mt0Rhai7M3HzDDGrmqso@Xx`(xOl4 za|^=)5#{lK(5ZB0)i!n7lB=u{*FY_Aws?g?G?r?5`D@+N4sN;tE&jdFj!zDsbF^`{ zx$(OFiVyLL{u)&g(an1^lJa&)bHY9BJEfDQ0AZ^J*~DC~*fYCYZ&`x443|!=LHDL7 zeFK(E-=@^($GE4>6Dw#+XjO-JHl1YS0aS?>utOabq4Fj!`GaBd{VKlqX6yOsbEsYV zKohYq+n6^Au)3a=s10JhJGkTdCQ>)5ZRTCN>mr+{J%l7`-il+VA_tzpj6{7lChx3m zXP=u+S)1QN5LjE}DuC}W!h^buv;n7GT)<+DG+y_56}RLYD5L%iU9*;@6AcoaIyq=f z2KoMEw566|5x9f)wIT?AOa8|2O?W9w{=qqp3R{r_qEWq(ADT~>21ypHk-01|SZ0ke zxb)!=H%v)OZLs_3W(sixdNFSB+1_y8}-D@C~tuAL(T!~K3avi3{ zoQ*V6U-G1H-Ex?%*5*eMvwFZp4+7&v#bmEE}!w zkXhgo==A_kqKi{K^C~I`j8~Av89O@asoTxt#&S^%|H$)J-(*{^q9jGLthW0rVS?e8 zGo9k!QjiaQv(x5y6YCd0I@Cpc`%TFtWXx6~kF&8kT8*M%B}yc`hjSzB)rx!DeVb7+i* zpBua|WO2XvqT%(Qip$-s-x07#66W}SZCmx0y}Rkbq5kn&i<6=-qJ-~v3}BO;3jEkv z*E9HZT=(Ob3#)jx1rpV2=MCxa)oi~bee}2url z{msbXtJFqM}OtXtdjmV%W14VUeY`_20`9!YQJ zWTyc7XO~nIZRmRM-ENWwN9j>31F;jzN=tcLugS~b|sWb$*HtWJa&czroVR< za@R7L%qDXvow2fe;Lf9(=uAYn$YW}24sS@$sMn^k67_MoY&M$mkU2!YDzZmxQ!_Yo zP9EJ+@JlecWi1KRwI=ahD4Jw_v2oww#9PodyJT3$sjVO()nBQYWMtv6Kj@nLxz5q| z@W7K-TQm9qFg3Tu3{ zu(oF{-;Z^w`sIsTjcl3Ej4iA31$Hj9!L?Ic*?0yyNxL&K34cdIci(OQ88XburPHIV z%AwfBA07)*&CMVJa^CdCGXM zJni@IJLx6*5tw7_YOluoid+=4Z>H5M{W0BhEHGPBU)^oWMfoMeSo$ve=cg=5wd@=2 zCvtd1^Qw1wPx%lfS}jHGPEa6~cmu$6w6+ohcA;>k8{v4lKBnd8n$3goM#;ht9A_p; z$CZm@&u(Nl>r>JEK-zWAJ_8l{kOrn87yj#` zNd{3i5<~J;T{%s5Jej=FcIZ@p{VXPML_<*|HI2HqO?Q7FZ{esAe@{6(bmu`u;w>*Jn4Z$rGN-s777#hV)Q}tM80C0&_c3?2S4)d+ zfijDYP-4=5%U_t@vr<4^Tpmr%yiHYkG!x6B>iYrTSQ z2UN+9`Ez9bzCk3BVt-NJwc1ee7vB;yjqdA}J?hT8TYcDwA+OmxFU7C4yXKqOR=r0K z8Zkx8oGlFG5c|$h8@)!W zNtq17+TGbk9vqKEGK+}%C$;1Z0S&$!?H8#`-nI%SHGR@{a~VmCx-8M#&&iU>fDGEw zjy^Raf~U2+`~`Zuy;6Wr^+NY_REriC^TAO8?Tt;d@;lkDjjmg7+|?)#%nlqrSrl(9 zQo!w%HfO>Ff#yG1MeMD?rURA=2;K3O&~=pD|1^yRi*wa%XiHmf8LG zRQI^C1$fq=O|&pkk)kA$7bM4*q514R+#e1udQ;DPtYSGrttwZQT^m!Lsia}AGqZCzy2mrbL1md5;#V{O1*#V6@Glq`{FuLDfJ;bP!IRwa~YdLMZJ?89>5|C}4hzHto|A6~<{-T)f7@J^SKBI@)rlg}8mKUR9`+FzSpf&P^d@n=iF~sIf0dh1DbjphpEIt(mjCg48Vy>}KkRmjb0WwV+*V&)aJi46F$*TUUB=*Mk;+`yQ zLK^JYhuE+SRVX7tH#*yI{27+KgdmFq@ZB||gzIOPlHcxo+- zf#;$A`KR~`1gp2l)+?_UF5Aapy?r{VvZ&S2EBMb@EOb-%-4FQK?z?P{EbaqIpJOav zyUkL&Vkx@{uSGf!0pbftBYyIm&oTH9N9chG$Il|tlRR#4o~?WmRhFf>nP~Y~CvFS~ z7vAsmv$`2_hDYDo+wEl~mz-~7o*XID>#U#TuOLqhBC=fiw8GZF2)wYK^tZ>f06^Ze(379wu&Hi7153x29E$$sIBCa*4wMsb(l$46R<)gM0IjoJA7*#IBtK(v$? z+l8FGTMop$w*G8w8Nv4>i}&?xyJCkvryy0RP_%N4ED}m5^qsINHQNc4wAjh=%S3b&`avM^*J0YD@qm?BI zxCm*1NgTM(3lt}+(zu%MG?%*etsYIBZT5gZr)QahT`q=i6tk_yBL7uX!qnx`1;uhs z&5}b<8k+*%n4fIx_gB8MORUyC=Ob$qsXXh>7HU%c_oXZt3@2ORhZ#K6D$VKI_A{O!X^$%`36kJ27;-Ah{M36NXuJf zm(Qs-@Nyc835m{Q_lT}ZLN%qadpT^~e-8N@jgA{j(&UgbnTP%k3inMf|9q&1mZuUN!reZnT`wxsZ?;I+=it`cnDkKiW;LND$y11H%Jr17--*jZ^+F=A71jCrjzU>38kO%Q?tjy^nVE)6WNdf5ktYHQ5k2&phHu@LySFyQ0i?0nD4AKzdtCxccsCf79=OPT8r%KdsaG(U(_!ykJ$&e%$`TwTnZeal+m zB9SBHP90YznS8;b&ae(2UUyr$r>TtNM^Co} zuL5fZ9naTwoeBv|(q$iBVv$B3ehtyTS0NL+CVD0XV4thO(#vHm;}QoY0a><$$S;A8 zbRrP8TQylRWX4aUZ=scJ@$dmaH8#8~jNpXV0y}K2ISUu`pDZx;N}OUL6@BqFMO5>% z!Ei_$mK^J5*>7K)mqKS83m5+CdzuezL+nE}uiowdY6XJtc?Uj{hMgc)hbMJ>i2w#= z9|i|9&fgRqT|(V=$w>M4oKp0Wm&qG10s;oHJ*b0VztL99&VD#7PNb44CI|d+~8H z;BC@}J5KSVY>#|tpPNr=u7J=(J3kjFB6BP$DX{Mc-Jp1;0o z&6R49_rM6HsY6U1+F4{(k`S@PsiaEJp&unTs)Im)iu45*Gkar+eM>^xP?s0M2#NGd z8F!Hv+V#Jov zQs4*0uH3~nl02|%lV~_c{HdsrPk07@bir<@X{g0?`{;mo9 zG4}JfA0dxRA{I{GKhuBxhh6L!m+~SdrC9ROX6h{BB4vErh$tEcR_S(qXm+O5xaK)O z&!?uA?MMu-@$4Cpep?hRsj=pt)4=#l#ByH!Q)S_~$mK%=!|_ z3V}z|c#fEYjqntW>rYkC5k`QOw+*pBX(pbUaJ4#2P3LqM(1r|y?{f|sOSyH>>aBjS zKUR{&404SOuF7j3mAh!}L!Ed>QR$AU-0zcHd(cULh~Jvl1cC<(9>Oqu5RXi=mp*i- zDbM$+49c+qB+VhKKx1tfhWbQ)Q&%n~r|@gdUG7~qi4x5VoKQ9<20k)Df0yMXKWq$) z*ixl;332Ylr#mAJuB@0dBN!$!|MU#%67)b71a(ey4kw0E`e){C zo^;g|V)culTLn6Y+gVGu#>IDoI_A z#v(N(S9<9k-ses|s86BqTXX%ken$ANj7_||ij$X>ZQq_Lkcqd`DyVX4GX&5L}vE!#Mj3^1TmL#QrZZtr6 zo`HtfF{Hzy8p+8qp3{ezmpM7om7|P|Qi25s8&eXi62nbr@Q+oUK&HrKEN9-y8M-b1 z<@ud9F6NpeDm^xEn&TFdNYZ8Ot@IUBP|s?Q?C{S zagr&9vbJTmsr~xV9E_0NQD#Z(vOOVh0c3q&6_|r(Lp^W|)wSdbKcNz(rb^Fm$ivgi zi5pF@Ez~a$Hxu_}_Di}|BgiiMI#V@wf2%HQkH`p|P0{9AN&7ETwQBsMlnC~>i1xT> zqun$yR_Ng7#^8sZWgjgcx_~S2`-wxk?Rdv>E(@1pxm_8C3{&c>(|S!D=#QbpT@ZD@ z8v+!K*Bj-GyAK|PFEnA8d&CZ zt%9^2l9w)9t8tUsFhtkVm;=?3surj&G9)NP?rEL^qK_3I`e5X4-~Z)CxtmDWL9?SV z!$NwM|3=tb9s$;JX3hLU67}=@)5)h1c2Q9_Ype{aOuR}{x`Y;G5_oe86arr~A$-3V zX5SZ4399>!j9`Sxckab0B7?d5=hi<|z2O7VIvf@e%}whnn(}~-r2uNblcuaBY?g0E zN4%olRPcG~~!L`6Ow=P@Y zyy^?=8pEeX=G1(>l{&kw}!dWxEsM{Qd z-!HSLTL!Kte+TipAl)tps`<87@GEgkl>Ek+el$+?`)uheb5gt$osEeW7^`LZ%?tT> zA~xKxK{dA{*28gupgoxh;^Pj2Yi{$UZ_^kNr+pDAjsB5z7+5FJ{evo9<52`@3kbsv z#_qc9CYCTSL+x`Hpix>6JpI}`sKy(^)n{F*%jng!~lvAS_dvnn`e z27>dhfV8VoRJWt$~ zKS${%p3bQ@9*2B=v2!LT>p}`_%Sw~B`5rI3$642@5)sT^h&er0G|EaM*q&Rc#|YYg zqZ^jpAmehEINLA1wANnvwCZ?`3;8cMC0*xin8`7(=!!7a=4^{b22@m2>=fURG z%P7l4Vq=)(PA@Fz*1N(#$ysa`GnYxdMxIz|2}$>Z(hZ8Oar+)iZ&CFzdRE}PW+|~7 zPV!B>q=yd-kGnqWS`O;?HnXvz(45FTO2fV#6^p{)<_?O|oaMRT^`V?pYr~wn5kq_! zR-fe+JoSEHlCAR%0_jW6484n`nd{ms=6+|vg6~F4ota|c&CkEM*}n2|gEo5t875qE zh+xp}ZcIy^tAOQi?RU_dKZnu_3%Dg!y=-BrKD^E+GS_~Jk!iL|$;RZA zocbr?h>w>+ztPP2rY8Ww<3E--jPbbdk_?wMH9l%jNp zhI@OuP7%tB9=%~)*OCg1B1(_U3LKcDB-pZ{^Zgk~<@pN>37OeH=)FfUF`rB%>~^rX zW*W_8b?6MfelG}we%F`&hd^;1nTGqJ${ll)udrH?Lyj)wN#=Yt}Gb61Ru?Zzr(s_ z%d&mi+7vubfF%r)j5Wj$7_WR+BOl2PAJx2ni|yS@Og&z;H<)iwhs$R;5jtLOv=-q28;;4PP*9){(c zu6sVf#Ndy<((p`$!%JY#l@h)>P+SVbpImZfkM!t(xy&JcV{giUzTgd)JYRsks+Gc^ zJpfe^e3Azw3SIJ!oNY~MLu*B8_yBkf{AKyiaOpN8R5JnmnHJe${PrC+S7XLXJr*Mg zmgy&F4T2LnX8tBjdEnmW=M>LosVMuz+nnA6Nz!v92c)6OfeFGAeph)m{8}fcQ>}fs zWt|5Q(K_hS`3@+~?*Z*+OkwUKQ_9cpYpg2zeYK_Ny%a^S)C5KxTSM|WA%eiq}5qxnnHWndoNxWcSqFe$*(OkV=KMav|Fl>_`*HxN$RLR_b+f_Mw@>3^F45!svsRf%)33 zfsY{we0jL|rc4X!tH8HVjF_&O;3lg;n;8qP4g$`k=xaW4Ps=BuuO;_#oDf1Cbq+}w zj2wf3!`E)My$s>C>`3=0XR1y+PFr1wj6id>us(pIraO zE8C2;&D&o|z4EB$LCE+EsDtIbZQGK&?M_0y8k&u4hsv>?=OQ)$=8&}5U`JMFM-cy; zPtQ7dO7+HcZ9q)2LGED;Wvg|(;}aYCukYyzQ40t0$t&Ft!-9-0-GR1FqKEvAL#jyxtaG>>Ujmie z=W#hD!DyW_J#ez{?*_fmff%9%KyIQHWvUsg8k>O5+Oy7aGX>55vzO9_+k>Sjno}Jc>s-dAM0%sApx&kYIkV%R**u;wm7Kc`2ssue2bLNDMd(Xfg>gQ1 zxi%}6{qwQswYvP6#BQ$uuGc{- z@Y-B*+q1HTciWAgZpS74N4GE^Bedx+^xbh27@WAGi~tJEFLalHvXfU&#)|E~zC~r0hMJ+o`K>?cx|2NdWRT7aG1y@XOGoVK3CIIqg?-$^KT3we0tY>urm-Er>=H z(72b$am(KOQ4Ps*-2O4|cGO}D6>^-x4p~DhOESzRd@_5unyM~_*!wjm8t8jbnj2Tb zw#nrW>vtjuc(#iq#R$4rpy-%7&II2i;(bdUu=9P=diX`^-la%ez_s(```o!r$rY)4 zCLFo6cq|2q4>9&1SbKH>e~v1lxq=Mr{sXRiD4vfWH5WZ&gT_vhSu1bn1GE zv}HveQKKuG340JJI-JCh$RPmK7hC*#$JsXi8Jw`usgGAGz(NmMxOj`~pyHdv6D3kqHS0S3myfBxS&uI$alHaog%xi^9KziBl98BP9|cjw-k{-2rjBedTwfp2n&PyLgy Q#XI~XC#@`1Az>2yKZ`RS5&!@I From 92dd269296098e288c35837e66dc9c577a388c70 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 22:35:58 +0530 Subject: [PATCH 05/16] Update windows/deployment/update/servicing-stack-updates.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/servicing-stack-updates.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 7a2066d26d..1321e36c9b 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -44,7 +44,6 @@ Servicing stack updates improve the reliability of the update process to mitigat Beginning with the February 2021 LCU, microsoft will publish all future cumulative updates and SSUs for Windows 10, version 2004 and above together as one cumulative monthly update to the normal release category in WSUS. - ## Is there any special guidance? Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update. From b6afa82e9427d0ffa7559754c1035dd8d9925944 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 9 Nov 2022 11:18:56 +0530 Subject: [PATCH 06/16] Update windows/deployment/update/servicing-stack-updates.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/update/servicing-stack-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 1321e36c9b..69b46485fc 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -42,7 +42,7 @@ Both Windows client and Windows Server use the cumulative update mechanism, in w Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don't install the latest servicing stack update, there's a risk that your device can't be updated with the latest Microsoft security fixes. -Beginning with the February 2021 LCU, microsoft will publish all future cumulative updates and SSUs for Windows 10, version 2004 and above together as one cumulative monthly update to the normal release category in WSUS. +Beginning with the February 2021 LCU, Microsoft will publish all future cumulative updates and SSUs for Windows 10, version 2004 and later together as one cumulative monthly update to the normal release category in WSUS. ## Is there any special guidance? From c08d6afdf908f68679baf4f8a60751deeecea6ae Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 16 Nov 2022 20:10:15 +0530 Subject: [PATCH 07/16] Update demonstrate-deployment-on-vm.md Added a note about hardware best practices for VM Reference https://learn.microsoft.com/en-us/mem/autopilot/autopilot-device-guidelines Fixes # https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10459 --- .../windows-autopilot/demonstrate-deployment-on-vm.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 14d1e1698a..070cc21f7d 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -44,9 +44,12 @@ You'll need the following components to complete this lab: |:---|:---| |**Windows 10 installation media**|Windows 10 Enterprise ISO file for a supported version of Windows 10, general availability channel. If you don't already have an ISO to use, download an [evaluation version of Windows 10 Enterprise](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise).| |**Internet access**|If you're behind a firewall, see the detailed [networking requirements](/mem/autopilot/software-requirements#networking-requirements). Otherwise, just make sure that you have a connection to the internet.| -|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.| +|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V. | |**An account with Azure Active Directory (Azure AD) Premium license**|This guide will describe how to get a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| +> [!NOTE] +> When using a VM for Autopilot testing, assign at least 2 processors and 4gb of memory. *Note: The [minimum system requirements](/windows/whats-new/windows-11-requirements#virtual-machine-support) for Windows 11 are 2 processors and 4gb memory. + ## Procedures A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that don't apply to you. Optional procedures are provided in the appendices. From c7b6afe99fd8ac293d74ff04330a63fa8e9fade6 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 16 Nov 2022 20:14:48 +0530 Subject: [PATCH 08/16] Update demonstrate-deployment-on-vm.md --- .../windows-autopilot/demonstrate-deployment-on-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 070cc21f7d..563c4e237d 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -44,7 +44,7 @@ You'll need the following components to complete this lab: |:---|:---| |**Windows 10 installation media**|Windows 10 Enterprise ISO file for a supported version of Windows 10, general availability channel. If you don't already have an ISO to use, download an [evaluation version of Windows 10 Enterprise](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise).| |**Internet access**|If you're behind a firewall, see the detailed [networking requirements](/mem/autopilot/software-requirements#networking-requirements). Otherwise, just make sure that you have a connection to the internet.| -|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V. | +|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.| |**An account with Azure Active Directory (Azure AD) Premium license**|This guide will describe how to get a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| > [!NOTE] From ca2948b5e36e0955c885c4c69a127a79a5585888 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 16 Nov 2022 20:58:16 +0530 Subject: [PATCH 09/16] Update windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../windows-autopilot/demonstrate-deployment-on-vm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 563c4e237d..28d817ea6d 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -48,7 +48,7 @@ You'll need the following components to complete this lab: |**An account with Azure Active Directory (Azure AD) Premium license**|This guide will describe how to get a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| > [!NOTE] -> When using a VM for Autopilot testing, assign at least 2 processors and 4gb of memory. *Note: The [minimum system requirements](/windows/whats-new/windows-11-requirements#virtual-machine-support) for Windows 11 are 2 processors and 4gb memory. +> When using a VM for Autopilot testing, assign at least two processors and 4 GB of memory. ## Procedures From 422af7550e40f213ac829674ebb50b32b41e3b02 Mon Sep 17 00:00:00 2001 From: mounicabattula <95552440+mounicabattula@users.noreply.github.com> Date: Wed, 16 Nov 2022 10:54:26 -0800 Subject: [PATCH 10/16] Update windows-autopatch-fix-issues.md --- .../prepare/windows-autopatch-fix-issues.md | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index 4b87f046dd..03a37a5dc7 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -70,3 +70,27 @@ Windows Autopatch requires the following licenses: | Result | Meaning | | ----- | ----- | | Not ready | Windows Autopatch requires Windows 10/11 Enterprise E3 (or higher) to be assigned to your users. Additionally, Azure Active Directory Premium, and Microsoft Intune are required. For more information, see [more about licenses](../prepare/windows-autopatch-prerequisites.md#more-about-licenses). | + +## Submit a support request + +> [!IMPORTANT] +> Make sure you've verified the admin contacts. The Windows Autopatch Service Engineering Team will contact these individuals for assistance with troubleshooting issues. + +You can submit support tickets to Microsoft on the Windows Autopatch enrollment tool. Email is the recommended approach to interact with the Windows Autopatch Service Engineering Team. + +**To submit a new support request:** + +1. If the Readiness assessment tool fails, remediation steps can be found by clicking on **View details** under **Management settings** and then clicking on the individual check. **Contact Support** button will be available below remediation instructions in the fly-in-pane. +2. Enter your question(s) and/or a description of the problem. +1. Review all the information you provided for accuracy. +1. When you're ready, select **Create**. + +### Manage an active support request + +The primary contact for the support request will receive email notifications when a case is created, assigned to a service engineer to investigate, and mitigated. If, at any point, you have a question about the case, the best way to get in touch is to reply directly to one of those emails. If we have questions about your request or need more details, we'll email the primary contact listed on the support requests. + +**To view all your active pre-enrollment support requests:** + +1. Sign into the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and navigate to the **Tenant Administration** menu. +1. In the **Windows Autopatch** section, select **Tenant Enrollment**. +1. On the **Support history** tab, you can view the list of call support cases, or select individual case to view the details. From d0bdd53a2ce1c5bfb6a496a2170dec9f9e7fca42 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 16 Nov 2022 11:28:05 -0800 Subject: [PATCH 11/16] Update windows-autopatch-fix-issues.md Reviewed for grammar and style. --- .../prepare/windows-autopatch-fix-issues.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index 03a37a5dc7..e465726766 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -14,7 +14,9 @@ msreviewer: hathind # Fix issues found by the Readiness assessment tool -Seeing issues with your tenant? This article details how to remediate issues found with your tenant. +Seeing issues with your tenant? This article details how to remediate issues found with your tenant. + +If you need more assistance with tenant enrollment, you can submit a [tenant enrollment support request](#submit-a-support-request). ## Check results @@ -74,23 +76,23 @@ Windows Autopatch requires the following licenses: ## Submit a support request > [!IMPORTANT] -> Make sure you've verified the admin contacts. The Windows Autopatch Service Engineering Team will contact these individuals for assistance with troubleshooting issues. +> Make sure you've [added and verified your admin contacts](../deploy/windows-autopatch-admin-contacts.md). The Windows Autopatch Service Engineering Team will contact these individuals for assistance with troubleshooting issues. -You can submit support tickets to Microsoft on the Windows Autopatch enrollment tool. Email is the recommended approach to interact with the Windows Autopatch Service Engineering Team. +If you need more assistance with tenant enrollment, you can submit support tickets to the Windows Autopatch Service Engineering Team in the Windows Autopatch enrollment tool. Email is the recommended approach to interact with the Windows Autopatch Service Engineering Team. **To submit a new support request:** -1. If the Readiness assessment tool fails, remediation steps can be found by clicking on **View details** under **Management settings** and then clicking on the individual check. **Contact Support** button will be available below remediation instructions in the fly-in-pane. +1. If the Readiness assessment tool fails, remediation steps can be found by selecting **View details** under **Management settings** and then selecting the individual check. The **Contact Support** button will be available below remediation instructions in the fly-in-pane. 2. Enter your question(s) and/or a description of the problem. -1. Review all the information you provided for accuracy. -1. When you're ready, select **Create**. +3. Review all the information you provided for accuracy. +4. When you're ready, select **Create**. ### Manage an active support request -The primary contact for the support request will receive email notifications when a case is created, assigned to a service engineer to investigate, and mitigated. If, at any point, you have a question about the case, the best way to get in touch is to reply directly to one of those emails. If we have questions about your request or need more details, we'll email the primary contact listed on the support requests. +The primary contact for the support request will receive email notifications when a case is created, assigned to a service engineer to investigate, and mitigated. If you have a question about the case, the best way to get in touch is to reply directly to one of the emails. If we have questions about your request or need more details, we'll email the primary contact listed in the support request. **To view all your active pre-enrollment support requests:** 1. Sign into the [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431) and navigate to the **Tenant Administration** menu. 1. In the **Windows Autopatch** section, select **Tenant Enrollment**. -1. On the **Support history** tab, you can view the list of call support cases, or select individual case to view the details. +1. Select the **Support history** tab. You can view the list of all support cases, or select an individual case to view the details. From 6f477dd589205adc5d6afec446aacc8728bb541e Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 16 Nov 2022 11:29:39 -0800 Subject: [PATCH 12/16] Update windows-autopatch-fix-issues.md Updated the date. --- .../windows-autopatch/prepare/windows-autopatch-fix-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md index e465726766..01a4100390 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-fix-issues.md @@ -1,7 +1,7 @@ --- title: Fix issues found by the Readiness assessment tool description: This article details how to fix issues found by the Readiness assessment tool -ms.date: 05/30/2022 +ms.date: 11/17/2022 ms.prod: windows-client ms.technology: itpro-updates ms.topic: how-to From fe021353e07859a57e47cb4fb6a476cfd4cc34a9 Mon Sep 17 00:00:00 2001 From: Dario Woitasen <33589238+dariomws@users.noreply.github.com> Date: Wed, 16 Nov 2022 21:28:16 +0100 Subject: [PATCH 13/16] Update waas-manage-updates-wufb.md --- windows/deployment/update/waas-manage-updates-wufb.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index 2737ca60d1..ce28b14f14 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -48,7 +48,7 @@ Windows Update for Business enables an IT administrator to receive and manage a Windows Update for Business provides management policies for several types of updates to Windows 10 devices: - **Feature updates:** Previously referred to as "upgrades," feature updates contain not only security and quality revisions, but also significant feature additions and changes. Feature updates are released as soon as they become available. -- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as updates for Microsoft Office or Visual Studio) as quality updates. These non-Windows Updates are known as "Microsoft updates" and you can set devices to receive such updates (or not) along with their Windows updates. +- **Quality updates:** Quality updates are traditional operating system updates, typically released on the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. - **Driver updates:** Updates for non-Microsoft drivers that are relevant to your devices. Driver updates are on by default, but you can use Windows Update for Business policies to turn them off if you prefer. - **Microsoft product updates**: Updates for other Microsoft products, such as versions of Office that are installed by using Windows Installer (MSI). Versions of Office that are installed by using Click-to-Run can't be updated by using Windows Update for Business. Product updates are off by default. You can turn them on by using Windows Update for Business policies. From 6bf97be24fa5298e1ef93aa343f9422703d6f4db Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 17 Nov 2022 08:21:37 -0500 Subject: [PATCH 14/16] updates --- .../hello-deployment-rdp-certs.md | 354 +++++++++--------- 1 file changed, 174 insertions(+), 180 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 85e91958b3..282264de1e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -1,207 +1,201 @@ --- -title: Deploying Certificates to Key Trust Users to Enable RDP -description: Learn how to deploy certificates to a Key Trust user to enable remote desktop with supplied credentials +title: Deploy certificates for remote desktop sign-in +description: Learn how to deploy certificates to cloud Kerberos trust and key trust users, to enable remote desktop sign-in with supplied credentials. ms.prod: windows-client author: paolomatarazzo ms.author: paoloma manager: aaroncz -ms.reviewer: prsriva +ms.reviewer: erikdau ms.collection: - M365-identity-device-management - ContentEngagementFY23 -ms.topic: article +ms.topic: how-to localizationpriority: medium -ms.date: 02/22/2021 -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Hybrid deployment - - ✅ Key trust - - ✅ Cloud Kerberos trust +ms.date: 11/15/2022 +appliesto: + - ✅ Windows 10 and later ms.technology: itpro-security --- -# Deploy Certificates to Key Trust and Cloud Kerberos Trust Users to Enable RDP +# Deploy certificates for remote desktop (RDP) sign-in -Windows Hello for Business supports using a certificate as the supplied credential when establishing a remote desktop connection to a server or other device. For certificate trust deployments, creation of this certificate occurs at container creation time. +This document describes Windows Hello for Business functionalities or scenarios that apply to:\ +✅ **Deployment type:** [hybrid](hello-how-it-works-technology.md#hybrid-deployment)\ +✅ **Trust type:** [cloud Kerberos trust](hello-hybrid-cloud-kerberos-trust.md), [ key trust](hello-how-it-works-technology.md#key-trust)\ +✅ **Device registration type:** [Azure AD join](hello-how-it-works-technology.md#azure-active-directory-join), [Hybrid Azure AD join](hello-how-it-works-technology.md#hybrid-azure-ad-join) -This document discusses an approach for key trust and cloud Kerberos trust deployments where authentication certificates can be deployed to an existing WHFB user. +
-Three approaches are documented here: +--- -1. Deploying a certificate to hybrid joined devices using an on-premises Active Directory certificate enrollment policy. +Windows Hello for Business supports using a certificate as the supplied credential, when establishing a remote desktop connection to another Windows device. This document discusses three approaches for *cloud Kerberos trust* and *key trust* deployments, where authentication certificates can be deployed to an existing Windows Hello for Business user: -1. Deploying a certificate to hybrid or Azure AD-joined devices using Simple Certificate Enrollment Protocol (SCEP) and Intune. +- Deploy certificates to hybrid joined devices using an on-premises Active Directory Certificate Services enrollment policy +- Deploy certificates to hybrid or Azure AD-joined devices using Intune +- Work with third-party PKIs -1. Working with non-Microsoft enterprise certificate authorities. - -## Deploying a certificate to a hybrid joined device using an on-premises Active Directory Certificate enrollment policy - -### Create a Windows Hello for Business certificate template - -1. Sign in to your issuing certificate authority (CA). - -1. Open the **Certificate Authority** Console (%windir%\system32\certsrv.msc). - -1. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. - -1. Right-click **Certificate Templates** and then click **Manage** to open the **Certificate Templates** console. - -1. Right-click the **Smartcard Logon** template and click **Duplicate Template** - - ![Duplicating Smartcard Template.](images/rdpcert/duplicatetemplate.png) - -1. On the **Compatibility** tab: - 1. Clear the **Show resulting changes** check box - 1. Select **Windows Server 2012 or Windows Server 2012 R2** from the Certification Authority list - 1. Select **Windows Server 2012 or Windows Server 2012 R2** from the Certification Recipient list - -1. On the **General** tab: - 1. Specify a Template display name, such as **WHfB Certificate Authentication** - 1. Set the validity period to the desired value - 1. Take note of the Template name for later, which should be the same as the Template display name minus spaces (**WHfBCertificateAuthentication** in this example). - -1. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. - -1. On the **Subject Name** tab: - 1. Select the **Build from this Active Directory** information button if it is not already selected - 1. Select **Fully distinguished name** from the **Subject name format** list if Fully distinguished name is not already selected - 1. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name** -1. On the **Request Handling** tab: - 1. Select the **Renew with same key** check box - 1. Set the Purpose to **Signature and smartcard logon** - 1. Click **Yes** when prompted to change the certificate purpose - 1. Click **Prompt the user during enrollment** - -1. On the **Cryptography** tab: - 1. Set the Provider Category to **Key Storage Provider** - 1. Set the Algorithm name to **RSA** - 1. Set the minimum key size to **2048** - 1. Select **Requests must use one of the following providers** - 1. Tick **Microsoft Software Key Storage Provider** - 1. Set the Request hash to **SHA256** - -1. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated** users group, and then select Enroll permissions for them. - -1. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. - -1. Close the Certificate Templates console. - -1. Open an elevated command prompt and change to a temporary working directory. - -1. Execute the following command: - - `certutil -dstemplate \ \> \.txt` - - Replace \ with the Template name you took note of earlier in step 7. - -1. Open the text file created by the command above. - 1. Delete the last line of the output from the file that reads **CertUtil: -dsTemplate command completed successfully.** - 1. Modify the line that reads **pKIDefaultCSPs = "1,Microsoft Software Key Storage Provider"** to **pKIDefaultCSPs = "1,Microsoft Passport Key Storage Provider"** - -1. Save the text file. - -1. Update the certificate template by executing the following command: - - certutil -dsaddtemplate \.txt - -1. In the Certificate Authority console, right-click **Certificate Templates**, select **New**, and select **Certificate Template to Issue** - - ![Selecting Certificate Template to Issue.](images/rdpcert/certificatetemplatetoissue.png) - -1. From the list of templates, select the template you previously created (**WHFB Certificate Authentication**) and click **OK**. It can take some time for the template to replicate to all servers and become available in this list. - -1. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks** and then click **Stop Service**. Right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. - -### Requesting a Certificate - -1. Ensure the hybrid Azure AD joined device has network line of sight to Active Directory domain controllers and the issuing certificate authority. - -1. Start the **Certificates – Current User** console (%windir%\system32\certmgr.msc). - -1. In the left pane of the MMC, right-click **Personal**, click **All Tasks**, and then click **Request New Certificate…** - - ![Request a new certificate.](images/rdpcert/requestnewcertificate.png) - -1. On the Certificate Enrollment screen, click **Next**. - -1. Under Select Certificate Enrollment Policy, ensure **Active Directory Enrollment Policy** is selected and then click **Next**. - -1. Under Request Certificates, click the check-box next to the certificate template you created in the previous section (WHfB Certificate Authentication) and then click **Enroll**. - -1. After a successful certificate request, click Finish on the Certificate Installation Results screen - -## Deploying a certificate to Hybrid or Azure AD Joined Devices using Simple Certificate Enrollment Protocol (SCEP) via Intune - -Deploying a certificate to Azure AD Joined Devices may be achieved with the Simple Certificate Enrollment Protocol (SCEP) via Intune. For guidance deploying the required infrastructure, refer to [Configure infrastructure to support SCEP certificate profiles with Microsoft Intune](/mem/intune/protect/certificates-scep-configure). - -Next you should deploy the root CA certificate (and any other intermediate certificate authority certificates) to Azure AD Joined Devices using a Trusted root certificate profile with Intune. For guidance, refer to [Create trusted certificate profiles in Microsoft Intune](/mem/intune/protect/certificates-trusted-root). - -Once these requirements have been met, a new device configuration profile may be configured from Intune that provisions a certificate for the user of the device. Proceed as follows: - -1. Sign in to the Microsoft [Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). - -1. Navigate to Devices \> Configuration Profiles \> Create profile. - -1. Enter the following properties: - 1. For Platform, select **Windows 10 and later**. - 1. For Profile, select **SCEP Certificate**. - 1. Click **Create**. - -1. In **Basics**, enter the following parameters: - 1. **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is SCEP profile for entire company. - 1. **Description**: Enter a description for the profile. This setting is optional, but recommended. - 1. Select **Next**. - -1. In the **Configuration settings**, complete the following: - 1. For Certificate Type, choose **User**. - 1. For Subject name format, set it to **CN={{UserPrincipalName}}**. - 1. Under Subject alternative name, select **User principal name (UPN)** from the drop-down menu and set the value to **CN={{UserPrincipalName}}**. - 1. For Certificate validity period, set a value of your choosing. - 1. For Key storage provider (KSP), choose **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)**. - 1. For Key usage, choose **Digital Signature**. - 1. For Key size (bits), choose **2048**. - 1. For Hash algorithm, choose **SHA-2**. - 1. Under Root Certificate, click **+Root Certificate** and select the trusted certificate profile you created earlier for the Root CA Certificate. - 1. Under Extended key usage, add the following: - - | Name | Object Identifier | Predefined Values | - |------|-------------------|-------------------| - | Smart Card Logon | 1.3.6.1.4.1.311.20.2.2 | Smart Card Logon | - | Client Authentication | 1.3.6.1.5.5.7.3.2 | Client Authentication | - - 1. For Renewal threshold (%), set a value of your choosing. - 1. For SCEP Server URLs, provide the public endpoint that you configured during the deployment of your SCEP infrastructure. - 1. Click **Next** -1. In Assignments, target the devices or users who should receive a certificate and click **Next** - -1. In Applicability Rules, provide additional issuance restrictions if required and click **Next** - -1. In Review + create, click **Create** - -Once the configuration profile has been created, targeted clients will receive the profile from Intune on their next refresh cycle. You should find a new certificate in the user store. To validate the certificate is present, do the following steps: - -1. Open the Certificates - Current User console (%windir%\system32\certmgr.msc) - -1. In the left pane of the MMC, expand **Personal** and select **Certificates** - -1. In the right-hand pane of the MMC, check for the new certificate +## Deploy certificates via Active Directory Certificate Services (AD CS) > [!NOTE] -> This infrastructure may also deploy the same certificates to co-managed or modern-managed Hybrid Azure Active Directory-Joined devices using Intune Policies. +> This process is applicable to *hybrid Azure AD joined* devices only. -## Using non-Microsoft Enterprise Certificate Authorities +To deploy certificates using an on-premises Active Directory Certificate Services enrollment policy, you must first create a *certificate template*, and then deploy certificates based on that template. -If you are using a Public Key Infrastructure that uses non-Microsoft services, the certificate templates published to the on-premises Active Directory may not be available. For guidance with integration of Intune/SCEP with non-Microsoft PKI deployments, refer to [Use third-party certification authorities (CA) with SCEP in Microsoft Intune](/mem/intune/protect/certificate-authority-add-scep-overview). +Expand the following sections to learn more about the process. -As an alternative to using SCEP or if none of the previously covered solutions will work in your environment, you can manually generate Certificate Signing Requests (CSR) for submission to your PKI. To assist with this approach, you can use the [Generate-CertificateRequest](https://www.powershellgallery.com/packages/Generate-CertificateRequest) PowerShell commandlet. +
+

+Create a Windows Hello for Business certificate template -The Generate-CertificateRequest commandlet will generate an .inf file for a pre-existing Windows Hello for Business key. The .inf can be used to generate a certificate request manually using certreq.exe. The commandlet will also generate a .req file, which can be submitted to your PKI for a certificate. +Follow these steps to create a certificate template: -## RDP Sign-in with Windows Hello for Business Certificate Authentication +1. Sign in to your issuing certificate authority (CA) and open *Server Manager* +1. Select **Tools > Certification Authority**. The Certification Authority Microsoft Management Console (MMC) opens +1. In the MMC, expand the CA name and right-click **Certificate Templates > Manage** +1. The Certificate Templates console opens. All of the certificate templates are displayed in the details pane +1. Right-click the **Smartcard Logon** template and select **Duplicate Template** +1. Use the following table to configure the template: -After adding the certificate using an approach from any of the previous sections, you should be able to RDP to any Windows device or server in the same Forest as the user’s on-premises Active Directory account, provided the PKI certificate chain for the issuing certificate authority is deployed to that target server. + | Tab Name | Configurations | + | --- | --- | + | *Compatibility* | | + | *General* | | + | *Extensions* | Verify the **Application Policies** extension includes **Smart Card Logon**| + | *Subject Name* | | + |*Request Handling*|| + |*Cryptography*|| + |*Security*|Add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated** users group, and then select Enroll permissions for them| -1. Open the Remote Desktop Client (%windir%\system32\mstsc.exe) on the Hybrid Azure Active Directory-Joined client where the authentication certificate has been deployed. -1. Attempt an RDP session to a target server. -1. Use the certificate credential protected by your Windows Hello for Business gesture. +1. Select **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates +1. Close the Certificate Templates console +1. Open an elevated command prompt and change to a temporary working directory +1. Execute the following command, replacing `` with the **Template display name** noted above + + ```cmd + certutil.exe -dstemplate > + ``` + +1. Open the text file created by the command above. + - Delete the last line of the output from the file that reads\ + `CertUtil: -dsTemplate command completed successfully.` + - Modify the line that reads\ + `pKIDefaultCSPs = "1,Microsoft Software Key Storage Provider"` to\ + `pKIDefaultCSPs = "1,Microsoft Passport Key Storage Provider"` +1. Save the text file +1. Update the certificate template by executing the following command: + + ```cmd + certutil.exe -dsaddtemplate + ``` + +1. In the Certificate Authority console, right-click **Certificate Templates**, select **New > Certificate Template to Issue** +1. From the list of templates, select the template you previously created (**WHFB Certificate Authentication**) and select **OK**. It can take some time for the template to replicate to all servers and become available in this list +1. After the template replicates, in the MMC, right-click in the Certification Authority list, select **All Tasks > Stop Service**. Right-click the name of the CA again, select **All Tasks > Start Service** + +
+ +
+
+Request a certificate + +1. Sign in to a client that is hybrid Azure AD joined, ensuring that the client has line of sight to a domain controller and the issuing CA +1. Open the **Certificates - Current User** Microsoft Management Console (MMC). To do so, you can execute the command `certmgr.msc` +1. In the left pane of the MMC, right-click **Personal > All Tasks > Request New Certificate…** +1. On the Certificate Enrollment screen, select **Next** +1. Under *Select Certificate Enrollment Policy*, select **Active Directory Enrollment Policy > Next** +1. Under *Request Certificates*, select the check-box for the certificate template you created in the previous section (*WHfB Certificate Authentication*) and then select **Enroll** +1. After a successful certificate request, select **Finish** on the Certificate Installation Results screen + +
+ +## Deploy certificates via Intune + +> [!NOTE] +> This process is applicable to both *Azure AD joined* and *hybrid Azure AD joined* devices that are managed via Intune. + +Deploying a certificate to Azure AD joined or hybrid Azure AD joined devices may be achieved using the Simple Certificate Enrollment Protocol (SCEP) or PKCS (PFX) via Intune. For guidance deploying the required infrastructure, refer to: + +- [Configure infrastructure to support SCEP certificate profiles with Microsoft Intune][MEM-1] +- [Configure and use PKCS certificates with Intune][MEM-2] + +Next, you should deploy the root CA certificate (and any other intermediate certificate authority certificates) to Azure AD joined Devices using a *Trusted root certificate* policy with Intune. For guidance, refer to [Create trusted certificate profiles in Microsoft Intune][MEM-5]. + +Once these requirements are met, a policy can be configured in Intune that provisions certificates for the users on the targeted device. + +
+
+Create a policy in Intune + +This section describes how to configure a SCEP policy in Intune. Similar steps can be followed to configure a PKCS policy. + +1. Go to the Microsoft Endpoint Manager admin center +1. Select **Devices > Configuration profiles > Create profile** +1. Select **Platform > Windows 10 and later** and **Profile type > Templates > SCEP Certificate** +1. Select **Create** +1. In the *Basics* panel, provide a **Name** and, optionally, a **Description > Next** +1. In the *Configuration settings* panel, use the following table to configure the policy: + + | Setting| Configurations | + | --- | --- | + |*Certificate Type*| User | + |*Subject name format* | `CN={{UserPrincipalName}}` | + |*Subject alternative name* |From the dropdown, select **User principal name (UPN)** with a value of `CN={{UserPrincipalName}}` + |*Certificate validity period* | Configure a value of your choosing| + |*Key storage provider (KSP)* | **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** + |*Key usage*| **Digital Signature**| + |*Key size (bits)* | **2048**| + |*For Hash algorithm*|**SHA-2**| + |*Root Certificate*| Select **+Root Certificate** and select the trusted certificate profile created earlier for the Root CA Certificate| + |*Extended key usage*| | + |*Renewal threshold (%)*|Configure a value of your choosing| + |*SCEP Server URLs*|Provide the public endpoint(s) that you configured during the deployment of your SCEP infrastructure| + +1. Select **Next** +1. In the *Assignments* panel, assign the policy to a security group that contains as members the devices or users that you want to configure and select **Next** +1. In the *Applicability Rules* panel, configure issuance restrictions, if needed, and select **Next** +1. In the *Review + create* panel, review the policy configuration and select **Create** + +For more information how to configure SCEP policies, see [Configure SCEP certificate profiles in Intune][MEM-3]. +To configure PKCS policies, see [Configure and use PKCS certificate with Intune][MEM-4]. + +
+ +
+
+Request a certificate +Once the Intune policy is created, targeted clients will request a certificate during their next policy refresh cycle. To validate that the certificate is present in the user store, follow these steps: + +1. Sign in to a client targeted by the Intune policy +1. Open the **Certificates - Current User** Microsoft Management Console (MMC). To do so, you can execute the command `certmgr.msc` +1. In the left pane of the MMC, expand **Personal** and select **Certificates** +1. In the right-hand pane of the MMC, check for the new certificate + +
+ +## Use third-party certification authorities + +If you're using a non-Microsoft PKI, the certificate templates published to the on-premises Active Directory may not be available. For guidance with integration of Intune/SCEP with non-Microsoft PKI deployments, refer to [Use third-party certification authorities (CA) with SCEP in Microsoft Intune][MEM-6]. + +As an alternative to using SCEP or if none of the previously covered solutions will work in your environment, you can manually generate Certificate Signing Requests (CSR) for submission to your PKI. To assist with this approach, you can use the [Generate-CertificateRequest][HTTP-1] PowerShell commandlet. + +The `Generate-CertificateRequest` commandlet will generate an *.inf* file for a pre-existing Windows Hello for Business key. The *.inf* can be used to generate a certificate request manually using `certreq.exe`. The commandlet will also generate a *.req* file, which can be submitted to your PKI for a certificate. + +## RDP sign-in with Windows Hello for Business certificate authentication + +After obtaining a certificate, users can RDP to any Windows devices in the same Active Directory forest as the user's Active Directory account. + +> [!NOTE] +> The certificate chain of the issuing CA must be trusted by the target server. + +1. Open the Remote Desktop Client (`mstsc.exe`) on the client where the authentication certificate has been deployed +1. Attempt an RDP session to a target server +1. Use the certificate credential protected by your Windows Hello for Business gesture to authenticate + +[MEM-1]: /mem/intune/protect/certificates-scep-configure +[MEM-2]: /mem/intune/protect/certificates-pfx-configure +[MEM-3]: /mem/intune/protect/certificates-profile-scep +[MEM-4]: /mem/intune/protect/certificates-pfx-configure +[MEM-5]: /mem/intune/protect/certificates-trusted-root +[MEM-6]: /mem/intune/protect/certificate-authority-add-scep-overview + +[HTTP-1]: https://www.powershellgallery.com/packages/Generate-CertificateRequest \ No newline at end of file From cf74c4bcf71030de1c3401be24073937125a61d0 Mon Sep 17 00:00:00 2001 From: Aaron Czechowski Date: Thu, 17 Nov 2022 11:12:02 -0800 Subject: [PATCH 15/16] Apply suggestions from code review Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../bitlocker/bitlocker-countermeasures.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index b4a4825f7b..039978c46a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -155,11 +155,11 @@ It also blocks automatic or manual attempts to move the paging file. Enable secure boot and mandatorily prompt a password to change BIOS settings. For customers requiring protection against these advanced attacks, configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user. -### Tricking BitLocker to pass the key to a rogue Operating system +### Tricking BitLocker to pass the key to a rogue operating system -An attacker can modify the boot manager (BootMgr) configuration database (BCD) which is stored on a non-encrypted partition and add an entry point to a rogue OS on a different partition. During the boot process, BitLocker code will make sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, Microsoft doesn’t recommend storing a hash of a disk partition table in Platform Configuration Register (PCR) 5. +An attacker might modify the boot manager configuration database (BCD) which is stored on a non-encrypted partition and add an entry point to a rogue operating system on a different partition. During the boot process, BitLocker code will make sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, we don’t recommend storing a hash of a disk partition table in Platform Configuration Register (PCR) 5. -Also, an attacker can replace the entire OS disk while preserving the platform hardware and firmware and then could extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This will not succeeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0 and to successfully unseal the blob, PCR 11 in the TPM must have value of 0. However, when boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the Bitlocker key. +An attacker might also replace the entire operating system disk while preserving the platform hardware and firmware and could then extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This will not succeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0, and to successfully unseal the blob, PCR 11 in the TPM must have a value of 0. However, when the boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR 11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the Bitlocker key. ## Attacker countermeasures From b0273ae8a6e96341887a7ca0a79f85c976d7ab51 Mon Sep 17 00:00:00 2001 From: Stephanie Savell <101299710+v-stsavell@users.noreply.github.com> Date: Thu, 17 Nov 2022 13:27:15 -0600 Subject: [PATCH 16/16] Update windows/security/information-protection/bitlocker/bitlocker-countermeasures.md --- .../bitlocker/bitlocker-countermeasures.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 813daa0b78..03c95bbdde 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -159,7 +159,7 @@ For customers requiring protection against these advanced attacks, configure a T An attacker might modify the boot manager configuration database (BCD) which is stored on a non-encrypted partition and add an entry point to a rogue operating system on a different partition. During the boot process, BitLocker code will make sure that the operating system that the encryption key obtained from the TPM is given to, is cryptographically verified to be the intended recipient. Because this strong cryptographic verification already exists, we don’t recommend storing a hash of a disk partition table in Platform Configuration Register (PCR) 5. -An attacker might also replace the entire operating system disk while preserving the platform hardware and firmware and could then extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This will not succeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0, and to successfully unseal the blob, PCR 11 in the TPM must have a value of 0. However, when the boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR 11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the Bitlocker key. +An attacker might also replace the entire operating system disk while preserving the platform hardware and firmware and could then extract a protected BitLocker key blob from the metadata of the victim OS partition. The attacker could then attempt to unseal that BitLocker key blob by calling the TPM API from an operating system under their control. This will not succeed because when Windows seals the BitLocker key to the TPM, it does it with a PCR 11 value of 0, and to successfully unseal the blob, PCR 11 in the TPM must have a value of 0. However, when the boot manager passes the control to any boot loader (legitimate or rogue) it always changes PCR 11 to a value of 1. Since the PCR 11 value is guaranteed to be different after exiting the boot manager, the attacker can't unlock the BitLocker key. ## Attacker countermeasures