From eea61a40e36132c2de9b9190c4127a0d07da5a3d Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Fri, 29 Dec 2023 09:09:48 -0500 Subject: [PATCH] Delete network-unlock-diagram.png --- .../hello-for-business/configure.md | 2 - .../deploy/hybrid-cloud-kerberos-trust.md | 51 +++-------------- .../deploy/hybrid-key-trust-enroll.md | 54 +----------------- .../deploy/hybrid-key-trust.md | 2 +- .../deploy/includes/gpo-enable-whfb.md | 20 +++++++ .../intune-account-protection-policy.md | 31 ++++++++++ .../deploy/includes/user-experience.md | 14 +++++ .../images/network-unlock-diagram.png | Bin 21459 -> 0 bytes 8 files changed, 77 insertions(+), 97 deletions(-) create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/gpo-enable-whfb.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/intune-account-protection-policy.md create mode 100644 windows/security/identity-protection/hello-for-business/deploy/includes/user-experience.md delete mode 100644 windows/security/operating-system-security/data-protection/bitlocker/images/network-unlock-diagram.png diff --git a/windows/security/identity-protection/hello-for-business/configure.md b/windows/security/identity-protection/hello-for-business/configure.md index 2228e84a82..6f96951e37 100644 --- a/windows/security/identity-protection/hello-for-business/configure.md +++ b/windows/security/identity-protection/hello-for-business/configure.md @@ -96,12 +96,10 @@ Windows Hello for Business is designed to be managed by group policy or MDM, but You can create a Group Policy or mobile device management (MDM) policy to configure Windows Hello for Business on Windows devices. - ## Disable Windows Hello for Business enrollment Windows Hello for Business is enabled by default for devices that are Microsoft Entra joined. If you need to disable the automatic enablement, there are different options to configure them. - ### Use Intune to disable Windows Hello for Business enrollment We recommend that you disable or manage Windows Hello for Business provisioning behavior through an Intune policy. For more specific information, see [Integrate Windows Hello for Business with Microsoft Intune](/mem/intune/protect/windows-hello). diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md index 01f4ae3f76..9e27af90ea 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust.md @@ -1,11 +1,11 @@ --- title: Windows Hello for Business cloud Kerberos trust deployment description: Learn how to deploy Windows Hello for Business in a cloud Kerberos trust scenario. -ms.date: 02/24/2023 +ms.date: 12/29/2023 ms.topic: tutorial --- -# Cloud Kerberos trust deployment +# Cloud Kerberos trust deployment guide [!INCLUDE [apply-to-hybrid-cloud-kerberos-trust](includes/apply-to-hybrid-cloud-kerberos-trust.md)] @@ -30,7 +30,7 @@ ms.topic: tutorial ## Deploy Microsoft Entra Kerberos -If you've already deployed on-premises SSO for passwordless security key sign-in, then you've already deployed Microsoft Entra Kerberos in your organization. You don't need to redeploy or change your existing Microsoft Entra Kerberos deployment to support Windows Hello for Business and you can skip to the [Configure Windows Hello for Business settings](#configure-windows-hello-for-business-policy) section. +If you've already deployed on-premises SSO for passwordless security key sign-in, then you've already deployed Microsoft Entra Kerberos in your organization. You don't need to redeploy or change your existing Microsoft Entra Kerberos deployment to support Windows Hello for Business and you can skip to the [Configure Windows Hello for Business policy settings](#configure-windows-hello-for-business-policy-settings) section. If you haven't deployed Microsoft Entra Kerberos, follow the instructions in the [Enable passwordless security key sign-in][ENTRA-1] documentation. This page includes information on how to install and use the Microsoft Entra Kerberos PowerShell module. Use the module to create a Microsoft Entra Kerberos server object for the domains where you want to use Windows Hello for Business cloud Kerberos trust. @@ -65,31 +65,7 @@ Review the article [Configure Windows Hello for Business using Microsoft Intune] If the Intune tenant-wide policy is enabled and configured to your needs, you can skip to [Configure cloud Kerberos trust policy](#configure-the-cloud-kerberos-trust-policy). Otherwise, follow the instructions below to enable Windows Hello for Business a policy using an *account protection* policy. -### Enable Windows Hello for Business - -To configure Windows Hello for Business using an account protection policy: - -1. Sign in to the Microsoft Intune admin center -1. Select **Endpoint security** > **Account protection** -1. Select **+ Create Policy** -1. For **Platform**, select **Windows 10 and later** and for **Profile** select **Account protection** -1. Select **Create** -1. Specify a **Name** and, optionally, a **Description** > **Next** -1. Under **Block Windows Hello for Business**, select **Disabled** and multiple policies become available - - These policies are optional to configure, but it's recommended to configure **Enable to use a Trusted Platform Module (TPM)** to **Yes** - - For more information about these policies, see [Windows Hello for Business policy settings](../policy-settings) -1. Under **Enable to certificate for on-premises resources**, select **Not configured** -1. Select **Next** -1. Optionally, add **scope tags** and select **Next** -1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** -1. Review the policy configuration and select **Create** - -> [!TIP] -> If you want to enforce the use of digits for your Windows Hello for Business PIN, use the settings catalog and choose **Digits** or **Digits (User)** instead of using the Account protection template. - -:::image type="content" source="images/whfb-intune-account-protection-enable.png" alt-text="Screenshot of the enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-enable.png"::: - -Assign the policy to a security group that contains as members the devices or users that you want to configure. +[!INCLUDE [intune-account-protection-policy](includes/intune-account-protection-policy.md)] ### Configure the cloud Kerberos trust policy @@ -111,13 +87,10 @@ For more information about the cloud Kerberos trust policy, see [Windows Hello f # [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) -Microsoft Entra hybrid joined organizations can use Windows Hello for Business Group Policy to manage the feature. Group Policy can be configured to enable users to enroll and use Windows Hello for Business. +[!INCLUDE [gpo-enable-whfb](includes/gpo-enable-whfb.md)] -The Enable Windows Hello for Business Group Policy setting is used by Windows to determine if a user should attempt to enroll a credential. A user will only attempt enrollment if this policy is configured to enabled. - -You can configure the Enable Windows Hello for Business Group Policy setting for computers or users. Deploying this policy setting to computers results in all users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. You can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. - -Cloud Kerberos trust requires setting a dedicated policy for it to be enabled. This policy is only available as a computer configuration. +> [!NOTE] +> Cloud Kerberos trust requires setting a dedicated policy for it to be enabled. This policy is only available as a computer configuration. #### Update administrative templates @@ -157,15 +130,7 @@ The cloud Kerberos trust prerequisite check detects whether the user has a parti ### User experience -After a user signs in, the Windows Hello for Business enrollment process begins: - -1. If the device supports biometric authentication, the user is prompted to set up a biometric gesture. This gesture can be used to unlock the device and authenticate to resources that require Windows Hello for Business. The user can skip this step if they don't want to set up a biometric gesture -1. The user is prompted to use Windows Hello with the organization account. The user selects **OK** -1. The provisioning flow proceeds to the multi-factor authentication portion of the enrollment. Provisioning informs the user that it's actively attempting to contact the user through their configured form of MFA. The provisioning process doesn't proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry -1. After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity policies configured on the device -1. The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Microsoft Entra ID to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and access their desktop - -> [!VIDEO https://learn-video.azurefd.net/vod/player?id=36dc8679-0fcc-4abf-868d-97ec8b749da7 alt-text="Video showing the Windows Hello for Business enrollment steps after signing in with a password."] +[!INCLUDE [user-experience](includes/user-experience.md)] Once a user completes enrollment with cloud Kerberos trust, the Windows Hello gesture can be used **immediately** for sign-in. On a Microsoft Entra hybrid joined device, the first use of the PIN requires line of sight to a DC. Once the user has signed in or unlocked with the DC, cached sign-in can be used for subsequent unlocks without line of sight or network connectivity. diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md index b0391e9508..db7b0939a9 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust-enroll.md @@ -17,51 +17,11 @@ Review the article [Configure Windows Hello for Business using Microsoft Intune] If the Intune tenant-wide policy is enabled and configured to your needs, you can skip to [Configure cloud Kerberos trust policy](#configure-the-cloud-kerberos-trust-policy). Otherwise, follow the instructions below to enable Windows Hello for Business a policy using an *account protection* policy. -## Enable Windows Hello for Business - -To configure Windows Hello for Business using an account protection policy: - -1. Sign in to the Microsoft Intune admin center -1. Select **Endpoint security** > **Account protection** -1. Select **+ Create Policy** -1. For **Platform**, select **Windows 10 and later** and for **Profile** select **Account protection** -1. Select **Create** -1. Specify a **Name** and, optionally, a **Description** > **Next** -1. Under **Block Windows Hello for Business**, select **Disabled** and multiple policies become available - - These policies are optional to configure, but it's recommended to configure **Enable to use a Trusted Platform Module (TPM)** to **Yes** - - For more information about these policies, see [Windows Hello for Business policy settings](../policy-settings) -1. Under **Enable to certificate for on-premises resources**, select **Not configured** -1. Select **Next** -1. Optionally, add **scope tags** and select **Next** -1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** -1. Review the policy configuration and select **Create** - -> [!TIP] -> If you want to enforce the use of digits for your Windows Hello for Business PIN, use the settings catalog and choose **Digits** or **Digits (User)** instead of using the Account protection template. - -:::image type="content" source="images/whfb-intune-account-protection-enable.png" alt-text="Screenshot of the enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="images/whfb-intune-account-protection-enable.png"::: - -Assign the policy to a security group that contains as members the devices or users that you want to configure. +[!INCLUDE [intune-account-protection-policy](includes/intune-account-protection-policy.md)] # [:::image type="icon" source="images/group-policy.svg"::: **GPO**](#tab/gpo) -For Microsoft Entra hybrid joined devices, you can use group policies to configure Windows Hello for Business. -It's suggested to create a security group (for example, *Windows Hello for Business Users*) to make it easy to deploy Windows Hello for Business in phases. You assign **Group Policy permissions** to this group to simplify the deployment by adding the users to the group. - -The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory - -> [!NOTE] -> If you deployed Windows Hello for Business configuration using both Group Policy and Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about policy conflicts, see [Policy conflicts from multiple policy sources](../configure.md#policy-conflicts-from-multiple-policy-sources) - -### Enable Windows Hello for Business group policy setting - -The *Enable Windows Hello for Business* group policy setting is the configuration needed for Windows to determine if a user should attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to **enabled**.\ -You can configure the *Enable Windows Hello for Business* setting for computer or users: - -- Deploying this policy setting to computers (or group of computers) results in all users that sign-in that computer to attempt a Windows Hello for Business enrollment -- Deploying this policy setting to a user (or group of users), results in only that user attempting a Windows Hello for Business enrollment - -If both user and computer policy settings are deployed, the user policy setting has precedence. +[!INCLUDE [gpo-enable-whfb](includes/gpo-enable-whfb.md)] ### Enable and configure Windows Hello for Business @@ -118,15 +78,7 @@ This information is also available using the `dsregcmd /status` command from a c ### User experience -After a user signs in, the Windows Hello for Business enrollment process begins: - -1. If the device supports biometric authentication, the user is prompted to set up a biometric gesture. This gesture can be used to unlock the device and authenticate to resources that require Windows Hello for Business. The user can skip this step if they don't want to set up a biometric gesture -1. The user is prompted to use Windows Hello with the organization account. The user selects **OK** -1. The provisioning flow proceeds to the multi-factor authentication portion of the enrollment. Provisioning informs the user that it's actively attempting to contact the user through their configured form of MFA. The provisioning process doesn't proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry -1. After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity policies configured on the device -1. The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Microsoft Entra ID to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and access their desktop - -> [!VIDEO https://learn-video.azurefd.net/vod/player?id=36dc8679-0fcc-4abf-868d-97ec8b749da7 alt-text="Video showing the Windows Hello for Business enrollment steps after signing in with a password."] +[!INCLUDE [user-experience](includes/user-experience.md)] While the user has completed provisioning, Microsoft Entra Connect synchronizes the user's key from Microsoft Entra ID to Active Directory. diff --git a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md index bd5f24cd52..383f79cd18 100644 --- a/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/deploy/hybrid-key-trust.md @@ -1,7 +1,7 @@ --- title: Windows Hello for Business hybrid key trust deployment description: Learn how to deploy Windows Hello for Business in a hybrid key trust scenario. -ms.date: 12/18/2023 +ms.date: 12/29/2023 ms.topic: tutorial --- diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/gpo-enable-whfb.md b/windows/security/identity-protection/hello-for-business/deploy/includes/gpo-enable-whfb.md new file mode 100644 index 0000000000..2a8d2f6fac --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/gpo-enable-whfb.md @@ -0,0 +1,20 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +For Microsoft Entra hybrid joined devices, you can use group policies to configure Windows Hello for Business. + +> [!TIP] +> Create a security group (for example, *Windows Hello for Business users* or *Windows Hello for Business devices*) to make it easy to deploy Windows Hello for Business in phases. You assign **Group Policy permissions** to this group to simplify the deployment by adding the users or devices to the groups. + +The *Enable Windows Hello for Business* policy setting is the configuration needed for Windows to determine if a user should attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to **enabled**.\ +You can configure the *Enable Windows Hello for Business* setting for computer or users: + +- Deploying this policy setting to computers (or group of computers) results in all users that sign-in that computer to attempt a Windows Hello for Business enrollment +- Deploying this policy setting to a user (or group of users), results in only that user attempting a Windows Hello for Business enrollment + +If both user and computer policy settings are deployed, the user policy setting has precedence. + +> [!NOTE] +> If you deployed Windows Hello for Business configuration using both Group Policy and Intune, Group Policy settings will take precedence and Intune settings will be ignored. For more information about policy conflicts, see [Policy conflicts from multiple policy sources](../../configure.md#policy-conflicts-from-multiple-policy-sources) diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/intune-account-protection-policy.md b/windows/security/identity-protection/hello-for-business/deploy/includes/intune-account-protection-policy.md new file mode 100644 index 0000000000..c10b360b64 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/intune-account-protection-policy.md @@ -0,0 +1,31 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + + +## Enable Windows Hello for Business + +To configure Windows Hello for Business using an account protection policy: + +1. Sign in to the Microsoft Intune admin center +1. Select **Endpoint security** > **Account protection** +1. Select **+ Create Policy** +1. For **Platform**, select **Windows 10 and later** and for **Profile** select **Account protection** +1. Select **Create** +1. Specify a **Name** and, optionally, a **Description** > **Next** +1. Under **Block Windows Hello for Business**, select **Disabled** and multiple policies become available + - These policies are optional to configure, but it's recommended to configure **Enable to use a Trusted Platform Module (TPM)** to **Yes** + - For more information about these policies, see [Windows Hello for Business policy settings](../../policy-settings) +1. Under **Enable to certificate for on-premises resources**, select **Not configured** +1. Select **Next** +1. Optionally, add **scope tags** and select **Next** +1. Assign the policy to a security group that contains as members the devices or users that you want to configure > **Next** +1. Review the policy configuration and select **Create** + +> [!TIP] +> If you want to enforce the use of digits for your Windows Hello for Business PIN, use the settings catalog and choose **Digits** or **Digits (User)** instead of using the Account protection template. + +:::image type="content" source="../images/whfb-intune-account-protection-enable.png" alt-text="Screenshot of the enablement of Windows Hello for Business from Microsoft Intune admin center using an account protection policy." lightbox="../images/whfb-intune-account-protection-enable.png"::: + +Assign the policy to a security group that contains as members the devices or users that you want to configure. \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/deploy/includes/user-experience.md b/windows/security/identity-protection/hello-for-business/deploy/includes/user-experience.md new file mode 100644 index 0000000000..a41168cc3e --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/deploy/includes/user-experience.md @@ -0,0 +1,14 @@ +--- +ms.date: 12/15/2023 +ms.topic: include +--- + +After a user signs in, the Windows Hello for Business enrollment process begins: + +1. If the device supports biometric authentication, the user is prompted to set up a biometric gesture. This gesture can be used to unlock the device and authenticate to resources that require Windows Hello for Business. The user can skip this step if they don't want to set up a biometric gesture +1. The user is prompted to use Windows Hello with the organization account. The user selects **OK** +1. The provisioning flow proceeds to the multi-factor authentication portion of the enrollment. Provisioning informs the user that it's actively attempting to contact the user through their configured form of MFA. The provisioning process doesn't proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry +1. After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity policies configured on the device +1. The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Microsoft Entra ID to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and access their desktop + +> [!VIDEO https://learn-video.azurefd.net/vod/player?id=36dc8679-0fcc-4abf-868d-97ec8b749da7 alt-text="Video showing the Windows Hello for Business enrollment steps after signing in with a password."] diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/network-unlock-diagram.png b/windows/security/operating-system-security/data-protection/bitlocker/images/network-unlock-diagram.png deleted file mode 100644 index f158bc4c6757d0e36451c19a7dba4428a32c85c9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21459 zcmdSBcT`hb_bwddC>{{dBSk?#M5TjBlOP}~`CsHimQ(xfAy z8j2DSrMEyrlMW%&&_erGz@wh`yuUlf{k}22JMJG26ZYOKYp*irGoSg)^;GMI8a*u= zEd&Cgzk21e4g^9)fk7qP<%#ya{ydAN$HS9@8{{A^|N4MblpfvKc%jO5LC^;}od^7zyhtR{omZjc^!g*!aaA!I@PuGk`_B7PiS2}! z34)=mgB~NHRRX!u3bqhPqR3kr=kdAjJd2&EfpA){f+*iYqsE=GwOL+z2&6M)#9!&V zF4oMwf5GM}+Ng2vd@$(Vvg$Yre+}lfoPSuNK|yUO0z*A87Ae{cdxdc1zla9iBP|g#Q}L(UgG_f3jC)AnmI|$ zHwl5^V3% zx;s1XsK1#%QDDSOyPutlE8HBV8tdm#Ty_l3INZNtO6!F{RJgjiv9-3h|Al@dY;sR6 zoD*f7)WkjBHEvlXSNjof-o(Y>Ty`RqeL^d?l`oCO#`!{m@oobXBW)}1#(7*M=X;zt z4iJ;98GAi$f6ZSbxfJ!}nrzIh2&3ETV_r5+EE&LyWNJU+OrI48M!Dl7V!~S``wt^F z{Xa|0st73<2SH1XtgKSH_Q4s%@}yW(h}`4-E48jA0oyc|57gc6t4E5Uj8mFwDw;4h zh^NOqY zdr5k`Z-wz$GxQzT6&`H+Exc52Fs^HWS}nO{*+qgCf4kmOVYP0^gXD?k>Zo6T@h5^u zL7o63wAkZ&IFO8Sin+yax#G?VIZO}cPQ{fe-XN+G1$w2VSn*hW%*uz=q35BjH`EeB z@Izc7RgS&|!WfbaQUfI(=bWpMl84Iau^x}H{;KV}fM|rLluFQg(b{G2jK!Ly5Efo; z593AE==BqJE-&N^SPXXDTWPy1#bwdke$=dHwTCV+C5$Bm>+ZI>+V*+0&T)HCdm@uz z@kK>$h>r$Q6SF3WDRvsnAO4qHNoQ-sr?Y?z@1G3$axfCTLZ*dKaGRrl$9nkq8ZW zsIm)36C;m@BE)oM+pj-Yy^LkzV(RjA7<5sY!YT}69oCWl84*k<1>_CA>Mp9RIC;|< z8_AGYuyyB+>6DF`c=qngRlGhYwI;5MskN^L!za3iuaA(2ZIFfq=LVferfrJM9csD~ zFJnwo7HHzVguP_@t()WblRMEn))EJGxUy&-CJ?_l!_4*@Dd#N1`PveC5aDCD!P@Jc=}Z@rmuyFTLx0XrP2YDwnSq7mFN z+FV|1x%B{NBGmYo=<+1IZ)I31w`EzaBUzl|wnW$V1KBOR2dB??UD0C?$?QON zQmdRNs;blWT}khIvM#JLhQ00%CY1%oZy8o>1axV?*!em>U}NUu^Pm_v4iCcAq3oV6g5) zmOA5Ggy=$brjm#;Sv$7FWrJiM3jP=y6Gk&0Ot;>5Mj6G^^v6?N>v-+G#?b_Ht4>NS z<9@On&gj`!EifeE&mBa=;w9Mx+?kHD&M!ReNVPqS%vmE)jp257LNBK*{J}IQ1jb{J^0>*lOgoc5 zu$s7I8=vD&Z&^Z_NVJ)^>q2#50|oV%83I5^^GW5x6!40Am;qLW2JIP-?y3g_FfY}<~P_q@i#9;Zo*FKf6LVcgO! zu(Os=SMN@?G}&iZ+0uv?ndcTKf%oR3za!B5DBiUD>52!_#yMoRq$k`vglK)h$((PJ zKZEC)bXNb;LdSdP7mv8f$G)??G|8r3CwST!F$3qjhkaMB$&(+o*ZrmOxt>Feg;(yf zyhnY&B$C;^P3Oi(5uZvLd6Wja^G27gowD^s+V+_jZs_`0(PaYTMc3AcQMka2t=g&h zYi7`M9%y>WAgNbt7n2Tlg9{!PcifFZA#_gU)%zlQ30@Z4vM zL!n&XpRfAUkPC6#f&cHE=))LR(g*97Hv{2wZJ6P%jy8MX{FGm+#fG%4JRj`^zH9&1 zXhTHmDp%ja@ztG2Mi)A3rixR0YA<`bHy8#>1x6WCZauu@fY4dOcgMuW=9H9RAC?6K z1lW6jB)eC1jNj)***S~hI7Qxd!!_;Xm9V-ElYEigR#K>^#*z-W6V2&w;3BH{&+8sV zau05fw(Ue^X7a;eu#os$1s80Q51gFN+cEkp!SklyH7Q=i0|!a-XWNRM{8-rWiq+7| zj_wXq64lgjhNRY&%_An%!0Ua{zkuuMuzbjiJE4?BT(|m4K^(Wf_O}uI{3rK&0ME^Y zi&vm6Pw`tOT-(9Wt!ceGGpq33{n{P5K=s`96UdOfn z6aEC{$o$s0J^kJr91&yiNcp?_zxD24K*|#KTjP7966NH6`5EtQ9MjO7aPIY4zhbq3)Koall{a{V(%+z%wlWb$(zAaKpx^?vE(F2g>dkz*Q zE>k*)j66}YBpIr}L=w=gF|YJ4LzR?72Cw@2B=|typ-^2=DAeB0PQY#^B_&0Bgyx}t zaHYfdq(sA~Y&mSx!OVg}IROC&D06LYWo0Gd2BBj>_J2}Q%-biI>gMJazw`=fegWP> z-0@px4C`h0<1*T|Nm?t*oWwc_(|30aSjxpU6~nDc;Io9H_^|Qz1bt;kTid5>C!n_Ag17MAM(k z_9Q*IoUF(ow_ii<4EvfDhCe+pUPcdfK!j{ejv?1Po%-|UAUot@E4GW3*2~|itS{U3 zwB-C9S*qbegS(1f967C>p_5l9p&Wh*)vgH&ZKT zLW&XvLT#bJyoRP#H_xbZax}Ng7 z{XkpHP}}f9UQvDrwo8=O>v(5%1mP-zf#D{fmtB`wNb+*(C?gl-v@Lnd(Y*?$IVU&= zIR<*Hswk?w_~f*PqJNrrgjMrrF7X1DA*J?KJ?HOEWk6c$Yq1U|!I zcZ1RsPb(PbOLVV}&Ip9JF=DD{aASWzWhIhNSh zeml!ae9Hvv3VI`l!FE}K^B`i}g4keTP|2xjVR#(8;XTR4lqt5d;L>J+?($ay3E>w~ z_=BBmCtRsn7rW2N_KU@)4eIw*d2i8fv@ds5e93CV@~dqF5dEOsyVa?QekFEp&}Ox- z6soV7fXCXd53LV!e(*}6A%voZ-8`+}ycmA)=J!sHXt2GW7L~Vk*c=y~nPr#1yV_sg zJkAsSXV<+KPSPJCmtLj~B&>C9tSni+=(IuSIc_84R96;k9m~e=rnaPtmE>*QU$pOE zagX`4*ZeJWnX@{P;p=Vs{-nioVum7v(E0ziQf5u?0cIQ$lH`A zzZil$Lvt)CQgL;$E`?lz7bT7%|XZ{rI;7Ds+*vD9ujXrNnN zVpj6W%^|MRyu=t8w{j>mY9eMwsQfCi4C(i#uCMZj@1Pf9P9kgmYb@_I_9Lq+;k~%m zp{aMn?2;2BxqH7La3Vd6U@ff12wB4=hyrt$`!nWgwinYNjv43Tu)0$r) zj^BuX+pFcG;n=KH@!slerI;i}LjK{R8NS1QCqG46;Jh>4HA!;0SxK(o8PCeXRNmlR z+c_<^o6`gdIwyDwX@?U&D|=xrNuQmEbpHDF>qamFX+J9gfq$Gw10U=$^YV3aYJW(_ zT^tZ4bvHA}Vx}%Ns-iMaZFM^VSMcN0*a#2H{aS()1NYdRN^<_ii|7z7 zm+#dgfs$wAw&G1Sb*LwvGLLE5hfcBys8|>#1m);Yt}TqTg+QKZ$ecUWhVl{# z6LqKb0(#iS!4LSHQ_{Q&yFORBk?ZQ}`a11h(TkD5!8KEtfPz`-0mRUiGZyFV`o1Cs z1YW+&0MoVIyNjU%m#h6^U8AjI%b1092f8BTe$h<$<~5Rl7vR8 zZCV!2#2)D=0u{emFLXAK_LYZKaCaf(Tj;kDeLictLqv;(=YhY=^ZVQ?4$)gU0E@YTM~EYGZJ~9yam&Z zFF2$Z+{1RUkw_T5RZvB6fCbIo4g`ZA#xPFTMmMiyPoFeHxS6&<()V9T%B@WHRPh1FpO@8Y zyN5!1*p#@7$HOUj?$*mav2VJuwOtSo!N4 zcmYe;yeb%i!zTa6mA4`*{&Cs;vOWDkP!2bfC2Zo_EIAJ|6!v?!q++*)S2)>3kst5f zP0?rH-+!b)(u1csKr1Mx$wSTpfScn&$d3Zp!@^hf@OP=Hskx$47kJ9j2AV1=}pU{HkhKdb6F+q*sMK>9zc zggS7Dd8ukAA@}`NG1ijDHvm;Bq?+aQ%^pvd+5ko=CD~liVgJ@sU!N+y#$|=cVuC@> zN{djg*>h#gnFCww_A@!#xIgd9=lOmN@DzqKG@E-a`Pt+cO~qrbt23a4hOdgiCIu`h zAR{&0myFGVNsU1u)s~}+J&C-io^HvUkm9JLzXmn(vCpXjeoI&SLigpzzozMh@_!JM zLryGeePF)(zz~(fo4CM$mE_d0mw*9wFj=a9^*;_i!1IuY?>kb3azbAn)7*qnL*CEU zHdrb;S{}{k-Q_i_MSd=q-trZvip`eExr^GZe^32bF#%6sNkQp*6Z*<LMkvL(t$u%IE1nwv`-wcT(3PpsbUU#||<^7gSLtd_I$2T4gu z6-RbZ;4t|_Tlh&bdFpRm!b}R%==f-uZGQX;3t`H> z7|vb+ceY3eENJ9*HnjK6n>QH|99&$|Csh&D_vM*Lp3~FQQ0rGkJM$TG+n+9xR+Kv1 zR#@w@6%_6v7!Ii<;QtO$J`jWCyAQsvsE{>grTdO31MJ_b=ZT9#mj!%qut+TPa1 z>u4LAWP#9SKx-~2XWgXJ*{1w!(OU+?IGB^Lb4v|3oeIxcjs<>W{B^fYqbLb>Qc1<2 zFh{Nnf06VZD&THr_anLG3o<_=hoWofZhYotB(;*PZJ>FwX;#pJd5YbQi!y3H_RYVLGR> z7Vk#?&dNZx?V1N!cQIwZ`beb-wpYQ&Ijg@iRoZJudT{4kMs@mvs?WW2d7d=#y97Tv z;Z?m9G=?;^7RSLp0~quVFfW`CJ&s+A%hbUH1~+9h`?Ba~f#yPHXV%MMZ0mDiChGnJ z-=3aN-;@-7AGtkXVd0Z%wzc4(VRkh-fML3ol-Ye+(vtig?aRr$YN-1b!!hBfqJ3%$ zku0AXnpx_*PG(+7C8WE*Xc3rHn=ov3XXfHWK*y!u=dP|4r)4!rojt%j4>m~xemS#* zSvIR=K*1KVk)E(3Dd4$XQg5H6JF(mnXc3y$p#N}$Ug@Bc5HJlOG+kXc>Bk z^CtUimc?f@A{q*GnoL}7zUG^rJ!Pq%$>e*qnz)s-F;qISNQc2&B&i&sq7wbG1Nh1$ z;d0^;c_tG-QS3(RT-AE;B#pX?99&-d31ILI=)L$_T`FuQ3Zcd)ZSUsRyjRpEhWDZP zV~#Ige10!U$2TQ#DXAdSQlS%`A&2Si926HHu16()YtD&V8EYxVKdNC&*%=y;5Y(Ez zfsm}l=bGFeEZ_Q2{L$6xs~OKsQOa2khDF7N7Q3&=jXDRwYissKRApbZdJBu5BDK7g z`J7=z_5KbMdx`j#ebDU5aLv2w_yLzH&)l+_ctq+2=pa-MYWTvpOTe&&sG&dzPOqa5 zLT_0W7ngdoh&m>^F`3}YP@i*&w|P=oS09T^S8s3OG%t%f8h;QWh; zU9)$JiLr#DIHw*hG+W-jUi`sG5{EbBLZ*_o4TA|2#>!aagzcRqwC&2s^5*3Q{h;PQ zE*QP#?qj=kiK_Fj{aaRE#)D;L9S$2aWx5Xl9hS=AhIBM}uiYFFKjzj#pOq4s5tWXX zQ}0+VXlU?{Ce*LnYH0JQp1COUj*Te1o`0;KhjFaK>{!I>mE!UXUAd1%pp1Tx!?KeS z@$2bw5fYZc{gpEPSJd3E6H*Vht<`pZloEj77{zw2TYV3~HlTb*b#&2PHjY=l?!Rs6 z%DQRmm~*|L;uNrR+N>@b2)m-9dv`ljd=sDr9%j1iPb7w~vdhHIDRSeqSSNxdw{G$^ z&JmJUigO%8hHY@++F^FZCF{v(ZeieaS;ly>(&Tn-tL4dg*LOtb!u}r5B&u73X)Wg9;W{Ox6`KYXd=RngH)`*!~s4`(Oil|6(a62~-udpY8z@1avy@OymMyRBDuI9q4^NlPWLORa-B$rVO@_o25Ez(( zNHQ@_OF!N9=XBppy~T+rEYawy@#j8C>v!+G3;%X&z+gXX)%5~V-o3b()Tvh1s;&L_ z;s@KIMzS%>sF!hBg$?W8W4r;}>^6=WApF=glR9^9{slKGH&?`@z;fk50f^QvV-2R= zP}ef7^v8|FQcr6j&g(pG9cb@Z&Rj^9DHjV<549savOZ7-Z#u3!yYwzhlP5hai~(j7 zC4ccU$2)T<^9^geIhi%yZ{gQ_xWZYk>As5@{`ek^>0TXAUMhF3wO)+5_EcKMmV@~) zaPM@0ZG9v~ZyT%=XD<>dh%_%qz?T$VmNwJBmh$e7{hvW?1CY0XK)m*o0 zM2Yu~=#>qBzD!EC!eCklAdP^MEi6r8CSEg8!-I7Bw>QEeP*bx~?&(X*?WD}+FJXiG zUMHe&CxKNM{@7f3`rMSncmI_D|0f{00YP2ZGtFLtC)9KeWUJ^vWJ7_~Z8bHIi88gB zCi5RAT8#h={{SDO@UQ%TMIT4bSIHif+<{WvnPv8)F3c z{vYy)nY~y*#Bns5_&bRx7m;$b3Nh6dh-w z0mc-JYSD;p9_)DP=c^}f(urL&G%uK zt0`tt3xK566NW^)6}0E4ctFq674j(5P|1F|Kns27sh%4ls^`@Mp0SfS2?Gy~(wZu*Vhsg86w;4f+YA8P<=lkFO;lRfl{yTfb|UcTbfkRLDtpcMv|^sV>- z1xv=cq3Zp5fwU`&W8ZSnXtdtPZy?BHW?pG)Ys+Xgyha%J(m$_L<*Xj)Y0}?i6B`U0 zzy4u^j0+zKW{6D6*tq?Kp_7|=4%kGKf>T>TACi)4a5!8twx`Dkm*;aObxWQ%av;mY>C-#Bn=vwBgD4%4C$9`F1=B$Tu% z38i52n#X!zO|~5@sQaCM2AAiQCT4lrrDF|3*%F;Ea&vQ?RmUhy+=%F*%Z{R#{n1tD z?rp7$;hk^sk^5FO`rTIPvqCUPFE&%2mD$-@n=K^BHwh$t%AM+x3#?1-pL=`wz}l{* z2`G|at6Kajn4;|>qyW9mcySr0Lbr~|$S0(J+8zpPd8Inzb*r_m+*_Uto|aV$j9?pV zRgh<86IL$}T*Pf+B)eLlb|I0$6uI2h#<0>uNku)-^C^``mA8m_Ip_*Y=+`|_P+xTW zhKgJc57(gCb5jf7saV3HOYnSR$BQ)X*WdRGB-yUq5%bNyfZlEu4}5RXsA8dRq09KE zSkr+?L^^X`-VQ0xP~6z$iILj^*x0pjScaZRWGw1lu4TMXd6yK$&BBfjcxUAAkO)~s z6KPj=7DnLpL6Ve(53ZvtA_iI66@pTxTxQl`c5ORwA>5L) zW3_#iDegj~cRnQloObJ@{a5@=JBS5yavK%zbE7SSDm`=WL$#p~ao>46f!Tj0 zD06DS*Q0iY^Md67Q=q!)@VK)82Md>!5*ZAx4s}&Tim3L1v1%*L%FQtUWNMh@QvZoS zjKA{_!>KHz*BAkt*v&q%B@wRNY%}&+RHQCF=2p6~H#<(JHT^nV5H?UQ`82EBkDLHS zSKpRby)Qy22Eq7_E6(?>dP{cr;IR`W+urM}d9^OR>em_B>%+OEA#}iN7~LA4a%%`r zvq<(F%_ZDJW_x?aJl<9vZaJq!!y-Zp&980*0Zj)pDL!n<7QwubK#Y|SM|z*?Ct1H$ zi@Z>7psB6~vUc`Xjv;0PUuby>LwD($uP+)A_3Z5euVK;aZI$m+dd)RFdGMsc+vAFt z*helKzUw|pEbhMQ>hAFU;R(^7=GYwQPvWMKB{v2g(lR$Fnl2rUGV4cD*0u(U?7DMR z(c)ure8mSWfD@S317=1WDx&26ygtPxw5a1*yMAdEc~Y=#BX$FtlBLb{(Moy2c_Uk= z+*s0WyfJzbj(+Ci%C#Zr7|%y69>6QygBeQUB6BC6zcuctl1Xu)w93YD5$#*cIZzWJ zC?a&TbvKElwVq+zF}lF-=#}+29=0v6o|0~L7U4rCkv?OZp)t1Qt097Lu;MWZ=qcau ze$3coIA+SdyAwu$DR|+{$>UHzE@O%O>bDm?3rX9OXc_fgvDUmM4bU+~- zj5tEuI|jOokt2;UOQWOjy0W?itxvf-(qrd#7>1OhoM>30Mh|X*G~o)^IN3T1KI_EE z)U}vlyQQ*BxbtA6m*?W`l!2o2n6PIl{=jtyIAz$_ahMfx6PJ)v(uub28{Wa|#Txyo z*DKQSbo*ydUGg*-J0|M&WASmwx@D8LktHiP`C@XzwHvjcCioyjYgl(#$|Tc<$GNEa z^=IuJ?UNT}`sJa<7J&^Xg+%WC*ra@sX?+nYTQ4f4nxI=b-6VA72P@^Nk%EE(ojde= zfq-;Yq3poWpb?Zyj@4W_Mzo`X(Czx6yZLw=H60L07$xd8s;S<)=R%3(TrOSDnJVoW z#gzriq&VOD4xkoY)GTKLTG7EwBZSDItr;6DMGPuBa2He&kYmgPA*|{cSsNj8zLVcwh^BHouj?=N|FA z_HM{{E;y2FWco6#_jok*av<0``0jHS0!3_@?k+Ay%AZMHuLQn$P3c{T>#dv^N)S>w zf7|z>F`q^Q?Aq4*6&91h*pTKx?2Ez%nD&{0C+V(;Ta^x8E)Ve(!W6g|4ZE1X47FRv z?m1X>1Z}Mddo3HMN(gAyjY2xPXrWqxujsh|#177^C;fr-AGD+`^#L& zd5Vw&(AnBwj?e;6{z92zj3Ez=lM-czizPjD5kM{S2c~-{oicxr+LO6l@K-l%w^N)TU%N{sroHaWS~q1f{eG)cz-AxC>_~x7j!S7A06cp$sA<(cqs* z_+KD@cTm7>6mib4oX|7M+fqY1X@B8;0O9@>dF&1f<+cLJ-y!u8O15Wj#(rz_Uume_ zK>@b`m`$1Q9}^>{L}B>BEbhM7&%D&n$<|LDQz0IIEc#;#e%$VFoV3oy%OGE>wUBXk?Yb@LU9(B-+r@S7qJlp|j=~wLF^5gmGt<+p4eH4w7M1W4?;UKW zZ1-u`{5?Yco{n`GCImEY2^zQgDn1}A6waIu874x(x2+b!mOtP2C08g>bIrQ2_7j2v&U%|zPQiu4@GIfyd2+MXyL3>8^ zGPW65zp?Yk+Bj#ZY1vv{n! zOc<0rf#^mj{e9-&w7e*VmamAmia8KB7i2q^B=-4}N-VY3pR``lFH<6bAj=+@=5dXR z=m^=Ej`+hXUX_P60_7IlpWptT+(eb}2apJS9j%M^Ugw}w2@I?i=+AiPnxke;)^#~O zLh#%F`I9Q8HHJ6*e$ehw=y<%}ch%!;!c!hCKyzYart4dx-XFF6ee@;*u)Z@BRdQ_T zaQ|?rK(DkO+-G+Zo41$}kP)3@)IbKLeJHnrCNEi1!mi4Kja3k09^`;=BsJ*|{)wv+ zWOiM%d}1DOho*S-Qu&K^;G^Hb;MQyJnbFbizP6XDm)VZnmLFZtVuRn{1X3mn8Bb=j^M(E?5-lof zh%PAu45_M$s)SQt527ro7?>bBoz^a@6GHNsDoOA5=^A%zt}r@}z}K+`q~O=)90z;g zi~|Kpr6Ocrbsm{d*Xn}eMZ&@a%s%L;J@ZdzgUrcq5(bIaZH zquDq8i0n>oo;+EhUpQAE=cccDnY17$bECO@;0)JzWWJVf)M+*mo~$X4-p{ zRXO#@l{1~(R^KyKWAT+!!5KLhZ=QIORhrcV*!EMA*+pe=g0tJin;X=HUr>oz)IIpB zQpPu0^=z6*gKvj*O)iA533Lu_)>l1KomfO$Z=;NcCb%ADl}M!@S#NHNbHiJAj7>iB z8Zu}_1-up-$F4}=V_s{xiY=#ZB#zjss<^j@MUBR@r#qgE(LBUI`*y4`S{%b)TRfTC z%ZL^@F4Z*{-O})LFUHV7G99t7?rXdU-WIoquwD=U$!?tKlUk;i(WQtA9|%*&-Yp_*?6d^WA$9Dp;t1_WBm*b9AjotLuL32=JC zXhU=p0!tbf$|17n1r5wbTOXQwU+b`*nc2&eq7SEc+i5cF(cJNJm7se}rZl+qTrP1Mxa)z#g@ z1h%(Ad09koC#H{!p9f41bL-@3b8KhK9t90lUa_dKXt#Gy$V#!wa(kX^-?R~c#v*T8 zGaV~VbW1VIT+6k3ZxuIp<5i8PUE$5FV$6&cx%E3iJV(lSRd=rwxAf{ z8ssGZAx1_uccqe|>zZossr8yy7g%Y=U7HavyG7lbj-TO=&7KRz1On5qb1W&H1mJNK zR7_nrseIECU#Bl+fosandp%?HTD^H_vFQvVSUQiZjj)J9V zF7ZuDzH2_;ds{V~S5Ev`oGpFlr#`9lF_DJh^Q;eh0e)*Yn>WFlJ3t_M>;O6f5fMl- zH7kf8dPVq#Eny!D#dm+Y^<;LkcJw%6tm)_hkGAaR<_`f%-d?-vP6Ga9qb6@ay87D^ z#iKwp`v92HoxKzg7j-%~;M^X8_p7Mw2VMfo$sd^WFfbuCyI}c;6lZ;e_aE0@$v(gR zgSUM4yE6O-fXm*6$`nn~z5>*_J>dMeLTU3I1xEjU4Me2ppZ!oP9r?Yu4q#^rewX}7 z@16v&unVGpqR51QT%)|+Pt^HCH1qI%d*fk*^yY#n1wTK;4AnM>cjGR5F4VD6-kG9d z;BaIL2{)!H^y+Mr*-WW)c{kZH*D=4<*DCb z_K$!9woA<8SC-)iJWM_mw#{zsE0A>DjW_&Cfb|DTxpy^y&i;+1r%dCIsXAEO{mDpz z$3>MN@=(Y`V*l2Q$bcCNM-q0B=Wx;+2r5iWq{4X6T1n?&LNClP*{q3SoE7nEw&44e=qn+h14K$2)`;j#b zOrBnIPt5d(CG2)76A6Yex#oVpO5P|xeKi!Plu~8*W!W{6g~^1coU&v;-M^`fC4Fla zj!Wg0(r}&Q4`VCNg$py2{gqOVGp~xWVzE_v-c%4R#y%;GEp<%V?Uj{qH7*#_=B8tK zuhP3J{83C`cmnH=575E%6w})a?Slx}=T`KAY&@;WYgkaQ7y3FZuQ7E{>-TyGlM0ti z;*L9evV|;SB|8r4`t?SFJUk*I!hny--qP|D1af7h@X@13;f>K!fgHy+TL;|wP8v3p zqu)?DR5f5c0fqd{Hl+pU4xThqb-!hRK{TyD!0|nBK+5H$r<9Sb@i<&| zYU&w*X-ZV{?uc4<56wQ!1)oer)tB$*<5`f3*qBPTIJds^wyrMM<_zzh@7kd1^wA{I zKO=wjzsZqGH51ISt*y8E`}^C-8}sw|RIg7J?yism8#=F#H@1OVAw9U+R>Fr8_oPhz zjC)uXL$q&W)%~}C4v9asXSq5t)OFok9(SDvQf(SinCNIS$bxAb|Dc_bp3aM_;oMjd z9TW-s${3l}Iiaj##<;)2f%pLt%;VO!+D`o>7+5oB;rEZ_6I>ThYkc4hS+~MWxiT-= zwfofoX;L9$FafYB$-NMyW7;4UxHZOX78>nhm=WGcX{23e>ayp#}AStq1z(WsrT`0N<+n{bCh_98|#9YL9}e=3a}4-O`QWQ zmKf1Hk8~O;BoB0kl+C56!l&zW`Qy%f5K-=a?MK@Q#QDDrb96!R{4z+Wp8cJ%h9)sU zAW4alikORKZh)qG?w@?5JnR*7PAV@KsK^chs_H`x9YYfRoH5OT;ZsINLrTSYjv?j` z(7(O>}FtKnHFeHtZ1`lCZ$Z#l2<|vFFQH{l^GnA4>QPnedw=TpVq4wi{L>d!zjfR z2Oj}w2Be{sq6UhkNjBHiYmHD5A9!w%so-P!1eCd&3w+5-`}kTo+80}Q0Rl0lCG%7r zD@1RFAaI)2m9Styaps1|cgsyep)8Pxb{U?EgIixGvn_MkTU>7W#>jqAZi}8;;FH4^ z3U%?BSr_EZ*$Q&7W_>f@>?^3@^eSHbFyt&Ot`31>LFHHsi%WlLgwS}opD8x7JNAy^ zoULQQ_9qXFg)(6*_@ms)Ld`k0oIwzd=_}4nMK#1H$j3SS2??QovA2|BSV&kJI=9gg z4Vf$_de@tcW1xPh8;4^<`)WAmUNAHFRKzk>s7?a4`1y*)KbpNDnP>o}dclPW(x7T@d8q&j_Lz&c+dIq1h(3W1txh+$@p`CG> z9ZOsL!3)k@8-S&zVg-6??!zW@pW%@Rxt!>h)FWOqfTPZwy=3UKC0e<)!<7Ebwj2Qy|6XLel|(6b6Ddtx?7sLgsOY2cMrZ z|3yWMor0B~cGz1%6mP?fVYT}$GOHA`I%b?-fVpB-!idu08+h9(fa@7r(dTHqHHzPDyIKpF$*nUt$uN> z@{Zn@*AEPZM6PzsJZq$auqrDi@G={RcFIDb$tYKC#cp-pPeg@_b_j;;hDDyEEA=V< z?XNzjb>`VQ7A&L7CcQm4_+vk^=nrdn7?;qrpWL&?fYsRt*Xejw8tkHx#kR2QzLLn|G2SLb|e|+#1ZiXlWejN^!`t8jvh^h-a ze%2420Ny;vjxbJU^#-yAAcnNcW4ytnHkEV0<0P0V8~5Ai#%3o!H+<;3^oJqEkTRJd zyat0PSnA|wzyMP~2gs}aItSqgJ)Ix$w=#iZr}hYC$J)Td`-mckeo65ud+u55E+XB- z>%X5{u}3z4`UP{r?(+M=nR6)}EUGy7OU?YF8@o7s4`u&`^y19$cza3|0gAR4&a5x81tPjJ zaPbHTLxOXTL{d~D?;?ivI;lh*84{kEKjg)9GmP^ds{DrtM7E+hkivMAL0Q7gciCL2 zYKkfXc)mll<>COjQ|6EIO8oBDfL676$oj(~F#Q_Yf1KFi4xm0niw-DOz=!xBW3Sa3 z2jmgFKOO~B%Ts(n^T&4No7@d2_9oyrjm|8HRv?Kipj+U>Malx$o1)(y1ta^9ANe^& zioc8E`;Svn5yC+413q|wyvg3q{{2y~dj9bv)W<0S%kE769(#cC0K_{G*#AB-kAHs@ z)E58aNA_Ya%3S{=g#JCZ7;4)j{<-hzG{x;sK2k zJ+^toL_LW@x{K`q)LCp&xkKp0T)e7c280jdY4k2$4$WtIS zCbg42Bqw20F!}9I-`gihkfb?!VDG^h3(voe-OGv2isB7%Ks9ZV$pg426qK8t6nQna zlSw1Q_S(lcn2Tx2+fU!z-4%_7FT1xkyLWeJGf=jR8|wj3Cz$#CeMX2>wI|ckUe#`G z*{I+C`(j|1oB2uO%#MX5C$_A1b1^$nsQvKVM{aW_D#>y+&8z zG*rNA;Zv{F_DE7ps-6n+lBNG+PTJs(+iJxMsdDlBh`@LQYDtbJP>3nC)%9Jrjj-H$ zA{E4_uaA}-7(r)kxbn0?95CruBrK~s$zF?);~FJ_X-nU&pe!s9NT#hl97x)0JSkBl z8zpM=(cCHR_th=QfwmAYH6)j+QGu=Ntik}^a*9eI*SrZq(p>SzTBV?J>l}*607mU zOsfETX(w6ONNnW}Z;ycxIWjk4Kt(<)kxRp{mFwe(c-xmv0H>Tt3yzh(Dg8)L>F9yI zc7|(TQ0{k~AH$ome)Rz;NF6bmODIBbb?~TbI4kVnt%|j#=2kB+P>oJts!~)5NTm24 z;st#4t25zhYh)-sq+`yO*6aLEZs>z*3?;ls?DzlfL?UcSTO84_%F0M@dK{R)co8;j zJ2~Lo@4P+4!JZuMEd0&hd-xUbt-=o0U{r9n7Tfj}dqM2LNkfOr8bwU^@vef&Re6(* zBo8}Tfm(jmsjsMI@&Nr-1+zGqw{@AcsOO-FU3}QR z89~@+csu}#@wfaRWW7qmIj)CSi6Fh_+jb6z;yPLnRP;=BOmTt}#CkzRwF-rrkHaWc z7L<&=wU7m+D5&BadDLbdv4SkaU+Ku?__xT)3uCz&t|g9@P_`)w_uO9k-fDdAf~3B} zH`arGYlkWCU64Un-n~4xHT=~EyX6lGYG2WUO(wO`TlrDnZX-?59-D(~+laBl-YYd^ zjI26zjsSzth@cf@%H|8VjEsU9x&NSSpu)s@!YGiV=y~7ZA@vYr5xT_d*tqd>1+$9& zj(fdUI8#;-4c!;p0|(DQ-APH#&f0ub@uFLPmQ5XD68AhUb4elvhG`l{j7@{25Jr+T z#qX|B!b-b@xNvFZ$Q~GAX=*ra%)1lFfd+(q|6SIlo&qcJvh@x5cqpS{#i$jNGvrcx z^06dez`KJ&f~IyI#qhbyhMPh}KBT+^RP#njco^Bo7gGJHm``@bx%*j}K# z)?-&i-JUkJ`a?zix(VpH2(UBhy%gXqr~ty;e2@Hq_{ZHHgUD4g!t`_@v!KD{gpM>6 zm(PfE@y`4e7lA&&UJIl@lQ>{3J55_?$%ZvA6LPc zs>nrtyD4d-7yqn*$`&nu0X;Z^Tk1P~u#;5)w@4L6A^pUP((kYf@}~Q*X$%CM4q)A$7`&7)3$JbyxnRSg*uHY!EGJJ(#2s z&d{SiNRqwF5Q49{$RW7dHv8!$&_w(^9<5xw{~LfNsDgkWsO?)FXZN}9;lN)MNLuGj z&|$Qpp@5n&17HgQur~EaK6xg!Ac!acq!h%(|J%3UG_w?72FciO32O$5ilYnMPcBu^ z0oCRY;PV6A$nP3Pprt&-^Y_Q!j%@n@072~_1@a9m@A@#%r#;B?1J>*rYjF14an+w6 ze;ot&1Ns4Sei!WR;ql!*0dDdUK%x}Xw72~M(mVg`=f~dw{vPN9!jfHtxVOuJ+=0JP zNIoRJYYp6<`+TuwK2a@0-z!o0U67+i5=WNqw%pTbT$L8gOk{)Wi zP&ZZv9v2$kvn@S_+u_nJ>zge**qvq($2;uQ@8`a(y+RVz99zhJAeDSx{7H<|l_<k@9+FtybPc4 z{(trkxM@}*z`OYNTrQip=lHWB(M+B{T^*;qDIqz?lXK?Uk#%mXW?b_)5@%!uk+Ux$jvfQrp4{+wU zAK3j|;qL$Pzw5@Wk2L-ox&epTuFSnJe*Jv?qVh#e>jJAj3f~7F*b`tLvU@$~9LLvx zFC8?R|L@CkQ?K+_z;2+`hl}p=wsAVo>^trE<-E(6kdU~be=ikye&fQbth>8P>!@Px+1ODAgb45xpd_w?TN>*eue?wO(_(ohc_L?celL^M}6_14F^rLdE($0U9=CcT2Cw8cZykId$cZZU2@&691F* z@viStrTrVBCsckdWUSx*$fFgrt^&{CWbkzLb6Mw< G&;$S}