From 6be3a4be57ef40c9bed07ece516562229e5e48a4 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Tue, 12 Sep 2017 13:22:41 -0700 Subject: [PATCH 01/90] rs3 deprecation --- .../windows-10-fall-creators-deprecation.md | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 windows/deployment/planning/windows-10-fall-creators-deprecation.md diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md new file mode 100644 index 0000000000..89ed59862a --- /dev/null +++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md @@ -0,0 +1,43 @@ +--- +title: Windows 10 Fall Creators Update Deprecated Features +description: Learn about features that will be removed in Windows 10 Fall Creators Update (version 1709) +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: high +ms.sitesec: library +author: lizap +ms.date: 09/12/2017 +--- +# Features that are removed or deprecated in Windows 10 Fall Creators Update + +The following features and functionalities in the Windows 10 Fall Creators Update are either removed from the product in the current release (*Removed*) or are not in active development and might be removed in future releases (*Deprecated*). + +This list is intended to help customers consider these removals and deprecations for their own planning. The list is subject to change and may not include every deprecated feature or functionality. + +For more information about a listed feature or functionality and its replacement, see the documentation for that feature. You can also follow the provided links in this table to see additional resources.  + +| Feature | Removed | Deprecated | +|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|------------| +|**3D Builder app**
No longer installed by default. Consider using Print 3D and Paint 3D in its place. However, 3D Builder is still available for download from the Windows Store. | X | | +|**Apndatabase.xml**
For more information about the replacement database, see the following Hardware Dev Center articles:
[MO Process to update COSA](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission)
[COSA FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) | X | | +|**Enhanced Mitigation Experience Toolkit (EMET)**
Use will be blocked. Consider using the [Exploit Protection](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/#fMH3bUDAb5HEstZ5.97) feature of Windows Defender Exploit Guard as a replacement.| X | | +|**IIS 6 Management Compatibility**
We recommend that users use alternative scripting tools and a newer management console. | | X | +|**IIS Digest Authentication**
We recommend that users use alternative authentication methods.| | X | +|**Microsoft Paint**
Will be available through the Windows Store. Functionality integrated into Paint 3D.| | X | +|**Outlook Express**
Removing this non-functional legacy code.| X | | +|**Reader app**
Functionality to be integrated into Microsoft Edge.| X | | +|**Reading List** Functionality to be integrated into Microsoft Edge.| X | | +|**Resilient File System (ReFS)**
Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability.
(added: August 17, 2017)| | X | +|**RSA/AES Encryption for IIS**
We recommend that users use CNG encryption provider.| | X | +|**Screen saver functionality in Themes**
To be disabled in Themes (classified as **Removed** in this table). Screen saver functionality in Group Policies, Control Panel, and Sysprep is now deprecated but continues to be functional. Lockscreen features and policies are preferred. | X | X | +|**Sync your settings**
Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work.
(updated: August 17, 2017) | | X | +|**Syskey.exe**
Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see the following Knowledge Base article: [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window)| X | | +|**System Image Backup (SIB) Solution**
We recommend that users use full-disk backup solutions from other vendors.| | X | +|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || +|**Tile Data Layer**
To be replaced by the Tile Store.| X || +|**TLS RC4 Ciphers**
To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)|| X| +|**Trusted Platform Module (TPM) Owner Password Management**
This legacy code to be removed.|| X | +|**Trusted Platform Module (TPM): TPM.msc and TPM Remote Management**
To be replaced by a new user interface in a future release.| | X | +|**Trusted Platform Module (TPM) Remote Management**
This legacy code to be removed in a future release.|| X | +|**Windows Hello for Business deployment that uses System Center Configuration Manager**
Windows Server 2016 Active Directory Federation Services – Registration Authority (ADFS RA) deployment is simpler and provides a better user experience and a more deterministic certificate enrollment experience.|| X | +|**Windows PowerShell 2.0**
Applications and components should be migrated to PowerShell 5.0+.| | X | \ No newline at end of file From eb2a357ba1c0e1712223f998b28260c81155a33e Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Tue, 12 Sep 2017 15:31:15 -0700 Subject: [PATCH 02/90] link formatting fix --- .../planning/windows-10-fall-creators-deprecation.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md index 89ed59862a..cf91f03e40 100644 --- a/windows/deployment/planning/windows-10-fall-creators-deprecation.md +++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md @@ -10,14 +10,16 @@ ms.date: 09/12/2017 --- # Features that are removed or deprecated in Windows 10 Fall Creators Update +> Applies to: Windows 10 + The following features and functionalities in the Windows 10 Fall Creators Update are either removed from the product in the current release (*Removed*) or are not in active development and might be removed in future releases (*Deprecated*). This list is intended to help customers consider these removals and deprecations for their own planning. The list is subject to change and may not include every deprecated feature or functionality. For more information about a listed feature or functionality and its replacement, see the documentation for that feature. You can also follow the provided links in this table to see additional resources.  -| Feature | Removed | Deprecated | -|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------|------------| +| Feature | Removed | Deprecated | +|----------|---------|------------| |**3D Builder app**
No longer installed by default. Consider using Print 3D and Paint 3D in its place. However, 3D Builder is still available for download from the Windows Store. | X | | |**Apndatabase.xml**
For more information about the replacement database, see the following Hardware Dev Center articles:
[MO Process to update COSA](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission)
[COSA FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) | X | | |**Enhanced Mitigation Experience Toolkit (EMET)**
Use will be blocked. Consider using the [Exploit Protection](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/#fMH3bUDAb5HEstZ5.97) feature of Windows Defender Exploit Guard as a replacement.| X | | @@ -33,7 +35,7 @@ For more information about a listed feature or functionality and its replacemen |**Sync your settings**
Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work.
(updated: August 17, 2017) | | X | |**Syskey.exe**
Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see the following Knowledge Base article: [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window)| X | | |**System Image Backup (SIB) Solution**
We recommend that users use full-disk backup solutions from other vendors.| | X | -|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || +|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features /(KB4014193/)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || |**Tile Data Layer**
To be replaced by the Tile Store.| X || |**TLS RC4 Ciphers**
To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)|| X| |**Trusted Platform Module (TPM) Owner Password Management**
This legacy code to be removed.|| X | From 6c48d88993264be38a4ed79dc21043f6ac93d16f Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Tue, 12 Sep 2017 15:44:35 -0700 Subject: [PATCH 03/90] added 1703 deprecation article --- .../windows-10-creators-update-deprecation.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 windows/deployment/planning/windows-10-creators-update-deprecation.md diff --git a/windows/deployment/planning/windows-10-creators-update-deprecation.md b/windows/deployment/planning/windows-10-creators-update-deprecation.md new file mode 100644 index 0000000000..498586ef5c --- /dev/null +++ b/windows/deployment/planning/windows-10-creators-update-deprecation.md @@ -0,0 +1,33 @@ +--- +title: Windows 10 Creators Update Deprecated Features +description: Learn about features that were removed in Windows 10 Creators Update (version 1703) +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: high +ms.sitesec: library +author: lizap +ms.date: 09/12/2017 +--- +# Features that are removed or deprecated in Windows 10 Creators Update + +> Applies to: Windows 10 + +The following features and functionalities in the Windows 10 Creators Update edition (version 1703) have either been removed from the product in the current release (*Removed*) or are not in active development and are planned for potential removal in subsequent releases (*Deprecated*). + +This list is intended for IT professionals who are updating operating systems in a commercial environment. The plan and list are subject to change and may not include every deprecated feature or functionality. For more details about a listed feature or functionality and its replacement, see the documentation for that feature. + +| Feature | Removed | Deprecated | +|------------|---------|------------| +|Apndatabase.xml is being replaced by the COSA database. Therefore, some constructs will no longer function. This includes Hardware ID, incoming SMS messaging rules in mobile apps, a list of privileged apps in mobile apps, autoconnect order, APN parser, and CDMAProvider ID. | | X | +|Apps Corner| | X | +|By default, Flash autorun in Edge is turned off. Use the Click-to-Run (C2R) option instead. (This setting can be changed by the user.)| X | | +|Interactive Service Detection Service| X | | +|Microsoft Paint for languages that are not on the full localization list| | | +|NPN support in TLS (superseded by ALPN)| X | | +|Reading List | | X | +|Tile Data Layer | | X | +|TLS DHE_DSS ciphers DisabledByDefault| | X | +|Windows Information Protection "AllowUserDecryption" policy | X | | +|WSUS for Windows Mobile, updates are being transitioned to the new Unified Update Platform (UUP) | X | | +|TCPChimney | | X | +|IPsec task offload| | X | \ No newline at end of file From 7dd1acc44f5b60dec8b91edf6c209a5c346aa6ba Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Tue, 12 Sep 2017 15:50:42 -0700 Subject: [PATCH 04/90] escaping paren in link --- .../deployment/planning/windows-10-fall-creators-deprecation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md index cf91f03e40..c76e66297a 100644 --- a/windows/deployment/planning/windows-10-fall-creators-deprecation.md +++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md @@ -35,7 +35,7 @@ For more information about a listed feature or functionality and its replacemen |**Sync your settings**
Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work.
(updated: August 17, 2017) | | X | |**Syskey.exe**
Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see the following Knowledge Base article: [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window)| X | | |**System Image Backup (SIB) Solution**
We recommend that users use full-disk backup solutions from other vendors.| | X | -|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features /(KB4014193/)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || +|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features \\(KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || |**Tile Data Layer**
To be replaced by the Tile Store.| X || |**TLS RC4 Ciphers**
To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)|| X| |**Trusted Platform Module (TPM) Owner Password Management**
This legacy code to be removed.|| X | From 09a229a71415859233cc4ff06acaeeed47c53679 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Tue, 12 Sep 2017 17:17:29 -0700 Subject: [PATCH 05/90] added files to TOC --- windows/deployment/planning/TOC.md | 3 +++ .../planning/windows-10-creators-update-deprecation.md | 2 +- .../planning/windows-10-fall-creators-deprecation.md | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/deployment/planning/TOC.md b/windows/deployment/planning/TOC.md index 08c2baded5..539ad2854f 100644 --- a/windows/deployment/planning/TOC.md +++ b/windows/deployment/planning/TOC.md @@ -3,6 +3,9 @@ ## [Windows 10 deployment considerations](windows-10-deployment-considerations.md) ## [Windows 10 compatibility](windows-10-compatibility.md) ## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) +## [Creators update (version 1703) - deprecated features](windows-10-creators-update-deprecation.md) +## [Fall Creators update (version 1703) - deprecated features](windows-10-fall-creators-deprecation.md) + ## [Windows To Go: feature overview](windows-to-go-overview.md) ### [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) ### [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) diff --git a/windows/deployment/planning/windows-10-creators-update-deprecation.md b/windows/deployment/planning/windows-10-creators-update-deprecation.md index 498586ef5c..c9a255d4a7 100644 --- a/windows/deployment/planning/windows-10-creators-update-deprecation.md +++ b/windows/deployment/planning/windows-10-creators-update-deprecation.md @@ -22,7 +22,7 @@ This list is intended for IT professionals who are updating operating systems in |Apps Corner| | X | |By default, Flash autorun in Edge is turned off. Use the Click-to-Run (C2R) option instead. (This setting can be changed by the user.)| X | | |Interactive Service Detection Service| X | | -|Microsoft Paint for languages that are not on the full localization list| | | +|Microsoft Paint for languages that are not on the [full localization list](https://www.microsoft.com/windows/windows-10-specifications#Windows-10-localization)| | | |NPN support in TLS (superseded by ALPN)| X | | |Reading List | | X | |Tile Data Layer | | X | diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md index c76e66297a..ad993aec80 100644 --- a/windows/deployment/planning/windows-10-fall-creators-deprecation.md +++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md @@ -35,7 +35,7 @@ For more information about a listed feature or functionality and its replacemen |**Sync your settings**
Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work.
(updated: August 17, 2017) | | X | |**Syskey.exe**
Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see the following Knowledge Base article: [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window)| X | | |**System Image Backup (SIB) Solution**
We recommend that users use full-disk backup solutions from other vendors.| | X | -|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features \\(KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || +|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || |**Tile Data Layer**
To be replaced by the Tile Store.| X || |**TLS RC4 Ciphers**
To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)|| X| |**Trusted Platform Module (TPM) Owner Password Management**
This legacy code to be removed.|| X | From b14315fa94cfd989954e9d0ba50cf8d1ab77fe6a Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 3 Oct 2017 11:40:54 -0700 Subject: [PATCH 06/90] revised intro topic --- .../device-guard/device-guard-deployment-guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/device-guard/device-guard-deployment-guide.md b/windows/device-security/device-guard/device-guard-deployment-guide.md index 2b460c583b..b88e38310e 100644 --- a/windows/device-security/device-guard/device-guard-deployment-guide.md +++ b/windows/device-security/device-guard/device-guard-deployment-guide.md @@ -15,7 +15,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Windows Defender Device Guard can use the new virtualization-based security in Windows 10 (available in Enterprise and Education desktop SKUs and in all Server SKUs) to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. +Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, the ability to run malicious executable code is much less likely. With appropriate hardware, Windows Defender Device Guard can use the virtualization-based security in Windows 10 (available in Enterprise and Education desktop SKUs and Windows Server SKUs) to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. This guide explores the individual features in Windows Defender Device Guard as well as how to plan for, configure, and deploy them. It includes: From c19c5efeb06e8cb1175fc833093a920c5456059d Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Thu, 5 Oct 2017 13:19:40 -0700 Subject: [PATCH 07/90] new formatting for 1709 deprecation article --- ...ndows-10-fall-creators-removed-features.md | 83 +++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100644 windows/deployment/planning/windows-10-fall-creators-removed-features.md diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md new file mode 100644 index 0000000000..f23190efab --- /dev/null +++ b/windows/deployment/planning/windows-10-fall-creators-removed-features.md @@ -0,0 +1,83 @@ +--- +title: Windows 10 Fall Creators Update - Features removed or planned for removal +description: Learn about features that will be removed in Windows 10 Fall Creators Update (version 1709) +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: high +ms.sitesec: library +author: lizap +ms.date: 10/17/2017 +--- +# Features removed or planned for replacement in Windows 10 Fall Creators Update (version 1709) + +> Applies to: Windows 10, version 1709 + +The following features and functionalities in the Windows 10 Fall Creators Update (version 1709) are either removed from the product in the current release or are not in active development and are being considered for potential replacement in subsequent releases. + +This list is intended to help customers consider these removals and planned replacements for their own planning. **The list is subject to change and may not include every affected feature or functionality.** + +For more information about a listed feature or functionality and its replacement, see the documentation for that feature. You can also follow the provided links to see additional resources. + +## Features removed from Windows 10 Fall Creators Update +The following features and functionalities have been removed from the installed product image in this release of Windows 10, version 1709. Applications, code, or usage that depend on these features will not function in this release unless you employ an alternate method. + +### 3D Builder +No longer installed by default. Consider using Print 3D and Paint 3D in its place. However, [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) is still available for download from the Microsoft Store. + +### Apndatabase.xml +For more information about the replacement database, see the following Hardware Dev Center articles: +- [Planning your COSA/APN database submission](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission) +- [COSA – FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) + +### Enhanced Mitigation Experience Toolkit (EMET) +Use will be blocked. Consider using the [Exploit Protection feature of Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) as a replacement. See the blog post [Announcing Windows 10 Insider Preview Build 16232 for PC + Build 15228 for Mobile](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/) for details. + +### Outlook Express +Removing this non-functional legacy code. + +### Reader app +Functionality to be integrated into Microsoft Edge. + +### Reading list +Functionality to be integrated into Microsoft Edge. + +### Resilient File System (ReFS) +Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. + +Creation ability will be removed from all other editions. All other editions will have Read and Write ability. + +### Syskey.exe +Removing this nonsecure security feature. We recommend that users use [BitLocker](/device-security/bitlocker/bitlocker-overview) instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). + +### TCP Offload Engine +Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) + +### TPM Owner Password Management +This legacy code to be removed. + +## Features being considered for replacement starting with Windows Fall Creators Update +The following features and functionalities are being considered for replacement starting with Windows 10, version 1709. Eventually, they may be completely removed from the installed product image and replaced by other features or functionality (or installable from other sources), but they are still available in this release, sometimes with certain functionality removed. **You should begin planning now to employ alternate methods or to, in the future, replace any applications, code, or usage that depend on these features.** + +If you have feedback to share about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). + +### IIS 6 Management Compatibility +Specific DISM features being considered for replacement are: + +- IIS 6 Metabase Compatibility (Web-Metabase) +- IIS 6 Management Console (Web-Lgcy-Mgmt-Console) +- IIS 6 Scripting Tools (Web-Lgcy-Scripting) +- IIS 6 WMI Compatibility (Web-WMI) + +Instead, you should start migration to IIS 7.0, which offers superior console and scripting tools. See [Installing IIS 7.0](https://docs.microsoft.com/en-us/iis/install/installing-iis-7/installing-iis-from-the-command-line) for details about installing and using IIS 7.0. + +### IIS Digest Authentication +This authentication method is planned for replacement because it has security issues. Instead, you should start using other authentication methods such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). + +### Microsoft Paint +The Microsoft Paint app is being considered for removal from the basic installed product image. **You'll still be able to get the app separately from the [Microsoft Store](https://www.microsoft.com/store/b/home) for free.** Alternately, you can get [Paint 3D](https://www.microsoft.com/store/p/paint-3d/9nblggh5fv99) and [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) from the Microsoft Store today; both of these offer the same functionality as Microsoft Paint, plus additional features. + +### RSA/AES Encryption for IIS +We recommend that users use [CNG encryption provider](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). + +### Sync your settings +Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for [Enterprise State Roaming](/azure/active-directory/active-directory-windows-enterprise-state-roaming-overview) and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work. From 4e6e4125729c976e877e5294795ffe102b84ffb3 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Thu, 5 Oct 2017 15:21:05 -0700 Subject: [PATCH 08/90] edited 1709 deprecation article --- ...ndows-10-fall-creators-removed-features.md | 50 +++++++++---------- 1 file changed, 24 insertions(+), 26 deletions(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md index f23190efab..1bb81314cf 100644 --- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md +++ b/windows/deployment/planning/windows-10-fall-creators-removed-features.md @@ -1,6 +1,6 @@ --- title: Windows 10 Fall Creators Update - Features removed or planned for removal -description: Learn about features that will be removed in Windows 10 Fall Creators Update (version 1709) +description: Which features were removed in Windows 10 Fall Creators Update (version 1709)? Which features are we thinking of removing in the future? ms.prod: w10 ms.mktglfcycl: plan ms.localizationpriority: high @@ -12,72 +12,70 @@ ms.date: 10/17/2017 > Applies to: Windows 10, version 1709 -The following features and functionalities in the Windows 10 Fall Creators Update (version 1709) are either removed from the product in the current release or are not in active development and are being considered for potential replacement in subsequent releases. - -This list is intended to help customers consider these removals and planned replacements for their own planning. **The list is subject to change and may not include every affected feature or functionality.** - -For more information about a listed feature or functionality and its replacement, see the documentation for that feature. You can also follow the provided links to see additional resources. +Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Read on for details about the features and functionalities that we removed in Windows 10 Fall Creators Update (version 1709). This list also includes information about features and functionality that we're considering removing in a future release of Windows 10. This list is intended to make you aware of current and future changes and inform your planning. **The list is subject to change and may not include every affected feature or functionality.** ## Features removed from Windows 10 Fall Creators Update -The following features and functionalities have been removed from the installed product image in this release of Windows 10, version 1709. Applications, code, or usage that depend on these features will not function in this release unless you employ an alternate method. +We've removed the following features and functionalities from the installed product image in Windows 10, version 1709. Applications, code, or usage that depend on these features won't function in this release unless you employ an alternate method. ### 3D Builder -No longer installed by default. Consider using Print 3D and Paint 3D in its place. However, [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) is still available for download from the Microsoft Store. +No longer installed by default, [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) is still available for download from the Microsoft Store. You can also consider using Print 3D and Paint 3D in its place. -### Apndatabase.xml -For more information about the replacement database, see the following Hardware Dev Center articles: +### APN database (Apndatabase.xml) +Replaced by the COSA database. For more information, see the following Hardware Dev Center articles: - [Planning your COSA/APN database submission](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission) - [COSA – FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) ### Enhanced Mitigation Experience Toolkit (EMET) -Use will be blocked. Consider using the [Exploit Protection feature of Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) as a replacement. See the blog post [Announcing Windows 10 Insider Preview Build 16232 for PC + Build 15228 for Mobile](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/) for details. +Removed from the image, and you're blocked from using it. Consider using the [Exploit Protection feature of Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) as a replacement. See the [Announcing Windows 10 Insider Preview Build 16232 for PC + Build 15228 for Mobile](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/) for details. ### Outlook Express -Removing this non-functional legacy code. +Removed this non-functional legacy code. ### Reader app -Functionality to be integrated into Microsoft Edge. +Integrated the Reader functionality into Microsoft Edge. ### Reading list -Functionality to be integrated into Microsoft Edge. +Integrated the Reading functionality into Microsoft Edge. ### Resilient File System (ReFS) -Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. +We changed the way that ReFS works, based on the edition of Windows 10 you have. We didn't **remove** ReFS, but how you can use ReFS depends on your edition. -Creation ability will be removed from all other editions. All other editions will have Read and Write ability. +If you have Windows 10 Enterprise or Windows 10 Pro for Workstations: You can create, read, and write volumes. + +If you have any other edition of Windows 10: You can read and write volumes, but you can't create volumes. If you need to create volumes, upgrade to the Enterprise or Pro for Workstations edition. ### Syskey.exe -Removing this nonsecure security feature. We recommend that users use [BitLocker](/device-security/bitlocker/bitlocker-overview) instead. For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). +Removed this nonsecure security feature. Intead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). ### TCP Offload Engine -Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) +Removed this legacy code. The TCP Offload Engine fuctionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) ### TPM Owner Password Management -This legacy code to be removed. +Removed this legacy code. ## Features being considered for replacement starting with Windows Fall Creators Update -The following features and functionalities are being considered for replacement starting with Windows 10, version 1709. Eventually, they may be completely removed from the installed product image and replaced by other features or functionality (or installable from other sources), but they are still available in this release, sometimes with certain functionality removed. **You should begin planning now to employ alternate methods or to, in the future, replace any applications, code, or usage that depend on these features.** +We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and fuctionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** If you have feedback to share about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). ### IIS 6 Management Compatibility -Specific DISM features being considered for replacement are: +We're considering replacing the following specific DISM features: - IIS 6 Metabase Compatibility (Web-Metabase) - IIS 6 Management Console (Web-Lgcy-Mgmt-Console) - IIS 6 Scripting Tools (Web-Lgcy-Scripting) - IIS 6 WMI Compatibility (Web-WMI) -Instead, you should start migration to IIS 7.0, which offers superior console and scripting tools. See [Installing IIS 7.0](https://docs.microsoft.com/en-us/iis/install/installing-iis-7/installing-iis-from-the-command-line) for details about installing and using IIS 7.0. +Instead, you should start migrating to IIS 7.0, which offers superior console and scripting tools. See [Installing IIS 7.0](https://docs.microsoft.com/en-us/iis/install/installing-iis-7/installing-iis-from-the-command-line) for details about installing and using IIS 7.0. ### IIS Digest Authentication -This authentication method is planned for replacement because it has security issues. Instead, you should start using other authentication methods such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). +We're considering removing the IIS Digest Authentication method because it has security issues. Instead, you should start using other authentication methods, such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). ### Microsoft Paint -The Microsoft Paint app is being considered for removal from the basic installed product image. **You'll still be able to get the app separately from the [Microsoft Store](https://www.microsoft.com/store/b/home) for free.** Alternately, you can get [Paint 3D](https://www.microsoft.com/store/p/paint-3d/9nblggh5fv99) and [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) from the Microsoft Store today; both of these offer the same functionality as Microsoft Paint, plus additional features. +We're considering removing MS Paint from the basic installed product image - that means it won't be installed by default. **You'll still be able to get the app separately from the [Microsoft Store](https://www.microsoft.com/store/b/home) for free.** Alternately, you can get [Paint 3D](https://www.microsoft.com/store/p/paint-3d/9nblggh5fv99) and [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) from the Microsoft Store today; both of these offer the same functionality as Microsoft Paint, plus additional features. ### RSA/AES Encryption for IIS -We recommend that users use [CNG encryption provider](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). +We're considering removing RSA/AES encryption because the superior [Cryptography API: Next Generation (CNG)](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx) method is already available. ### Sync your settings -Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for [Enterprise State Roaming](/azure/active-directory/active-directory-windows-enterprise-state-roaming-overview) and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work. +We're considering making changes to the back-end storage that will affect the sync process: [Enterprise State Roaming](/azure/active-directory/active-directory-windows-enterprise-state-roaming-overview) and all other users will use a single cloud storage system. Both the "Sync your settings" options and the Enterprise State Roaming feature will continue to work. From 1ef5e46e08c1a1c1a727b31348eaebf17cf12835 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Fri, 6 Oct 2017 17:42:19 -0700 Subject: [PATCH 09/90] Starting hybrid key trust deployment guide --- .../hello-adequate-domain-controllers.md | 100 ++++ .../hello-hybrid-key-new-install.md | 144 ++++++ .../hello-hybrid-key-trust-devreg.md | 482 ++++++++++++++++++ .../hello-hybrid-key-trust-prereqs.md | 138 +++++ .../hello-hybrid-key-trust.md | 51 ++ .../hello-hybrid-key-whfb-provision.md | 75 +++ .../hello-hybrid-key-whfb-settings-ad.md | 81 +++ .../hello-hybrid-key-whfb-settings-adfs.md | 89 ++++ ...hello-hybrid-key-whfb-settings-dir-sync.md | 86 ++++ .../hello-hybrid-key-whfb-settings-pki.md | 199 ++++++++ .../hello-hybrid-key-whfb-settings-policy.md | 204 ++++++++ .../hello-hybrid-key-whfb-settings.md | 50 ++ .../hello-for-business/images/dc-chart1.png | Bin 0 -> 3978 bytes .../hello-for-business/images/dc-chart2.png | Bin 0 -> 3701 bytes .../hello-for-business/images/dc-chart3.png | Bin 0 -> 3773 bytes .../hello-for-business/images/dc-chart4.png | Bin 0 -> 3770 bytes .../hello-for-business/images/dc-chart5.png | Bin 0 -> 3784 bytes 17 files changed, 1699 insertions(+) create mode 100644 windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-trust.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md create mode 100644 windows/access-protection/hello-for-business/images/dc-chart1.png create mode 100644 windows/access-protection/hello-for-business/images/dc-chart2.png create mode 100644 windows/access-protection/hello-for-business/images/dc-chart3.png create mode 100644 windows/access-protection/hello-for-business/images/dc-chart4.png create mode 100644 windows/access-protection/hello-for-business/images/dc-chart5.png diff --git a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md new file mode 100644 index 0000000000..040fb7e850 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -0,0 +1,100 @@ +--- +title: Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments +description: Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/09/2017 +--- +# Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments + +**Applies to** +- Windows10 + + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +## One size does not fit all + +How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 includes the KDC AS Requests performance counter. You can use these counters to determine how much of a domain controllers load is due to initial Kerberos authentication. Its important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authenticationit remains unchanged. + +Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, user in a key trust deployment user must authenticate to a Windows Server 2016 domain controller. + +Determining an adequate number of Windows Server 2016 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2016) to a deployment of existing domain controllers (Windows Server 2008R2 or Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as piling on. To illustrate the piling on concept, consider the following scenario. + +Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following. + +![dc-chart1](images/dc-chart1.png) + +The environment changes. The first change includes DC1 upgraded to Windows Server 2016 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following. + +![dc-chart2](images/dc-chart2.png) + +The Windows Server 2016 domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of the password authentication. Why? This behavior occurs because domain controllers 2- 10 only support password and certificate trust authentication; only a Windows Server 2016 domain controller supports authentication public key trust authentication. The Windows Server 2016 domain controller understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will be bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 domain controller is added, but without deploying Windows Hello for Business to anymore clients. + +![dc-chart3](images/dc-chart3.png) + +Upgrading another Windows Server 2016 domain controller distributes the public key trust authentication across two domain controllerseach supporting 50 percent of the load. But it doesnt change the distribution of password and certificate trust authentication. Both Windows Server 2016 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016, but the number of WHFB clients remains the same. + +![dc-chart4](images/dc-chart4.png) + +Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. + +![dc-chart5](images/dc-chart5.png) + +Youll notice the distribution did not change. Each Windows Server 2016 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentication decreased across the older domain controllers. + +There are several conclusions here: +* Upgrading domain controllers changes the distribution of new authentication, but doesnt change the distribution of older authentication. +* Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication. +* Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication. +* Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers +* Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication. + +The preceding was an example to show why its unrealistic to have a one-size-fits-all number to describe what an adequate amount means. In the real world, authentication is not evenly distributed across domain controllers. + +## Determining total AS Request load + +Each organization needs to have an baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this. + +Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significantMonday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: +* A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant +* The hour you believe initial authentication to be significant +* And a half-hour after you expect initial authentication to be significant + +For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward. + +> [!NOTE] +> To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power upyou need to consider this authentication in your evaluation). + +Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experience the highest amount of authentication. + +Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controllers authentication number for the median time by the total authentication. Multiple the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. + +Review the distribution of authentication. Hopefully, none of these are above 70 percent. Its always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller is to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. + +## Monitoring Authentication +Using the same methods previously described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016. This delta is representative of authentication resulting from the first phase of your Windows Hello for Busines clients. This gives you a baseline for your environment to where you can form a statement such as + +```Every n Windows Hello for Business clients results in x percentage of key-trust authentication.``` + +Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment. + +Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 domain controllers. If there is only one Windows Server 2016 domain controller, theres no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. + +Increasing the number of number of domain controllers distributes the volume of authentication, but doesnt change it. Therefore, as you add more domain controllers, the burden of authentication for which each domain controller is responsible decrease. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on. + +## Strategy +The simplest strategy you can employ is to upgrade one domain controller and monitor the single domain controller as you continue to phase in new Windows Hello for Business key-trust clients until it reaches a 70 or 80 percent threshold. + +Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environments designated capacity, then upgrade another domain controller. + +Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume. + +However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. Its not the best load balancer, however, its a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application. + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md new file mode 100644 index 0000000000..304f4fe766 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -0,0 +1,144 @@ +--- +title: Windows Hello for Business Key Trust New Installation (Windows Hello for Business) +description: Windows Hello for Business Hybrid baseline deployment +keywords: identity, PIN, biometric, Hello, passport, WHFB +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/09/2017 +--- +# Windows Hello for Business Key Trust New Installation + +**Applies to** +- Windows 10 + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +Windows Hello for Business involves configuring distributed technologies that may or may not exist in your current infrastructure. Hybrid key trust deployments of Windows Hello for Business rely on these technolgies + +* [Active Directory](#active-directory) +* [Public Key Infrastructure](#public-key-infrastructure) +* [Azure Active Directory](#azure-active-directory) +* [Directory Synchronization](#directory-synchronization) +* [Active Directory Federation Services](#active-directory-federation-services) + + +New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your exsting envrionment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) section to prepare your Windows Hello for Business deployment by configuring Azure device registration. + +The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. This document expects you have Active Directory deployed with an adeqate number of Windows Server 2016 domain controllers for each site. + +## Active Directory ## +Production environments should follow Active Directory best practices regarding the number and placement of domain controllers to ensure adequate authentication throughout the organization. + +Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal. + +### Section Review + +> [!div class="checklist"] +> * An adequate number of Windows Server 2016 R2 domain controllers +> * Minimum Windows Server 2008 R2 domain and forest functional level +> * Functional networking, name resolution, and Active Directory replication + +## Public Key Infrastructure + +Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller. + +This guide assumes most enterprises have an existing public key infrastructure. Windows Hello for Business depends on a Windows enterprise public key infrastructure running the Active Directory Certificate Services role from Windows Server 2012 or later. + +### Lab-based public key infrastructure + +The following instructions may be used to deploy simple public key infrastructure that is suitable for a lab environment. + +Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 or later server where you want the certificate authority installed. + +>[!NOTE] +>Never install a certificate authority on a domain controller in a production environment. + +1. Open an elevated Windows PowerShell prompt. +2. Use the following command to install the Active Directory Certificate Services role. + ```PowerShell + Add-WindowsFeature Adcs-Cert-Authority -IncludeManageTools + ``` + +3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration. + ```PowerShell + Install-AdcsCertificateAuthority + ``` + +## Configure a Production Public Key Infrastructure + +If you do have an existing public key infrastructure, please review [Certification Authority Guidance](https://technet.microsoft.com/library/hh831574.aspx) from Microsoft TechNet to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](https://technet.microsoft.com/library/hh831348.aspx) for instructions on how to configure your public key infrastructure using the information from your design session. + +### Section Review ### + +> [!div class="checklist"] +> * Miniumum Windows Server 2012 Certificate Authority. +> * Enterprise Certificate Authority. +> * Functioning public key infrastructure. + +## Azure Active Directory ## +You’ve prepared your Active Directory. Hybrid Windows Hello for Business deployment needs Azure Active Directory to host your cloud-based identities. + +The next step of the deployment is to follow the [Creating an Azure AD tenant](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-howto-tenant) process to provision an Azure tenant for your organization. + +### Section Review + +> [!div class="checklist"] +> * Review the different ways to establish an Azure Active Directory tenant. +> * Create an Azure Active Directory Tenant. +> * Purchase the appropriate Azure Active Directory subscription or licenses, if necessary. + +## Multifactor Authentication Services ## +Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA + +Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. + +### Azure Multi-Factor Authentication (MFA) Cloud ### +> [!IMPORTANT] +As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure Multi-Factor Authentication +> * Azure Active Directory Premium +> * Enterprise Mobility + Security +> +> If you have one of these subscriptions or licenses, skip the Azure MFA Adapter section. + +#### Azure MFA Provider #### +If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant. + +#### Configure Azure MFA Settings #### +Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. + +#### Azure MFA User States #### +After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. + +### Azure MFA via ADFS ### +Alternatively, you can configure Windows Server 2016 Active Directory Federation Services (AD FS) to provide additional multi-factor authentication. To configure, read the [Configure AD FS 2016 and Azure MFA](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa) section. + +### Section Review + +> [!div class="checklist"] +> * Review the overview and uses of Azure Multifactor Authentication. +> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. +> * Create an Azure Multifactor Authentication Provider, if necessary. +> * Configure Azure Multufactor Authentiation features and settings. +> * Understand the different User States and their effect on Azure Multifactor Authentication. +> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. + +> [!div class="nextstepaction"] +> [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid key trust deployment guide +1. [Overview](hello-hybrid-key-trust.md) +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. New Installation Baseline (*You are here*) +4. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +5. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md new file mode 100644 index 0000000000..51dc7b8538 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -0,0 +1,482 @@ +--- +title: Configure Device Registration for Hybrid Windows Hello for Business +description: Azure Device Registration for Hybrid Certificate Key Deployment (Windows Hello for Business) +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, device, registration +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/09/2017 +--- +# Configure Device Registration for Hybrid Windows Hello for Business + +**Applies to** +- Windows 10 + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You're environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. + +> [!IMPORTANT] +> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. + +Use this three phased approach for configuring device registration. +1. [Configure devices to register in Azure](#configure-azure-for-device-registration) +2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-syncrhonization) +3. [Configure AD FS to use cloud devices](#configure-ad-fs-to-use-azure-registered-devices) + +> [!NOTE] +> Before proceeding, you should familiarize yourself with device regisration concepts such as: +> * Azure AD registered devices +> * Azure AD joined devices +> * Hybrid Azure AD joined devices +> +> You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](https://docs.microsoft.com/en-us/azure/active-directory/device-management-introduction) + +## Configure Azure for Device Registration +Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. + +To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/) + +## Configure Active Directory to support Azure device syncrhonization + +Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema + +### Setup Active Directory Federation Services +If you are new to AD FS and federation services, you should review [Understanding Key AD FS Concepts](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts) to prior to designing and deploying your federation service. +Review the [AD FS Design guide](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/design/ad-fs-design-guide-in-windows-server-2012-r2) to plan your federation service. + +Once you have your AD FS design ready, review [Deploying a Federation Server farm](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) to configure AD FS in your environment. +> [!IMPORTANT] +> During your AD FS deployment, skip the **Configure a federation server with Device Registration Service** and the **Configure Corporate DNS for the Federation Service and DRS** procedures. + + +#### ADFS Web Proxy ### +Federation server proxies are computers that run AD FS software that have been configured manually to act in the proxy role. You can use federation server proxies in your organization to provide intermediary services between an Internet client and a federation server that is behind a firewall on your corporate network. +Use the [Setting of a Federation Proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment. + +### Deploy Azure AD Connect +Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). + +When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**. + +### Create AD objects for AD FS Device Authentication +If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration. + +![Device Registration](images/hybridct/device1.png) + +> [!NOTE] +> The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1. + +1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**. + +![Device Registration](images/hybridct/device2.png) + +2. On your AD FS primary server, ensure you are logged in as AD DS user with Enterprise Admin (EA ) privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: + + `Import-module activedirectory` + `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "" ` +3. On the pop-up window click **Yes**. + +> [!NOTE] +> If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$" + +![Device Registration](images/hybridct/device3.png) + +The above PSH creates the following objects: + + +- RegisteredDevices container under the AD domain partition +- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration +- Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration + +![Device Registration](images/hybridct/device4.png) + +4. Once this is done, you will see a successful completion message. + +![Device Registration](images/hybridct/device5.png) + +### Create Service Connection Point (SCP) in Active Directory +If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS +1. Open Windows PowerShell and execute the following: + + `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" ` + +> [!NOTE] +> If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep + +![Device Registration](images/hybridct/device6.png) + +2. Provide your Azure AD global administrator credentials + + `PS C:>$aadAdminCred = Get-Credential` + +![Device Registration](images/hybridct/device7.png) + +3. Run the following PowerShell command + + `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred ` + +Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory. + +The above commands enable Windows 10 clients to find the correct Azure AD domain to join by creating the serviceConnectionpoint object in AD DS. + +### Prepare AD for Device Write Back +To ensure AD DS objects and containers are in the correct state for write back of devices from Azure AD, do the following. + +1. Open Windows PowerShell and execute the following: + + `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name] ` + +Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format + +The above command creates the following objects for device write back to AD DS, if they do not exist already, and allows access to the specified AD connector account name + +- RegisteredDevices container in the AD domain partition +- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration + +### Enable Device Write Back in Azure AD Connect +If you have not done so before, enable device write back in Azure AD Connect by running the wizard a second time and selecting **"Customize Synchronization Options"**, then checking the box for device write back and selecting the forest in which you have run the above cmdlets + +## Configure AD FS to use Azure registered devices + +### Configure issuance of claims + +In a federated Azure AD configuration, devices rely on Active Directory Federation Services (AD FS) or a 3rd party on-premises federation service to authenticate to Azure AD. Devices authenticate to get an access token to register against the Azure Active Directory Device Registration Service (Azure DRS). + +Windows current devices authenticate using Integrated Windows Authentication to an active WS-Trust endpoint (either 1.3 or 2005 versions) hosted by the on-premises federation service. + +> [!NOTE] +> When using AD FS, either **adfs/services/trust/13/windowstransport** or **adfs/services/trust/2005/windowstransport** must be enabled. If you are using the Web Authentication Proxy, also ensure that this endpoint is published through the proxy. You can see what end-points are enabled through the AD FS management console under **Service > Endpoints**. +> +> If you don't have AD FS as your on-premises federation service, follow the instructions of your vendor to make sure they support WS-Trust 1.3 or 2005 end-points and that these are published through the Metadata Exchange file (MEX). + +The following claims must exist in the token received by Azure DRS for device registration to complete. Azure DRS will create a device object in Azure AD with some of this information which is then used by Azure AD Connect to associate the newly created device object with the computer account on-premises. + +* `http://schemas.microsoft.com/ws/2012/01/accounttype` +* `http://schemas.microsoft.com/identity/claims/onpremobjectguid` +* `http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid` + +If you have more than one verified domain name, you need to provide the following claim for computers: + +* `http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid` + +If you are already issuing an ImmutableID claim (e.g., alternate login ID) you need to provide one corresponding claim for computers: + +* `http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID` + +In the following sections, you find information about: + +- The values each claim should have +- How a definition would look like in AD FS + +The definition helps you to verify whether the values are present or if you need to create them. + +> [!NOTE] +> If you don't use AD FS for your on-premises federation server, follow your vendor's instructions to create the appropriate configuration to issue these claims. + +#### Issue account type claim + +**`http://schemas.microsoft.com/ws/2012/01/accounttype`** - This claim must contain a value of **DJ**, which identifies the device as a domain-joined computer. In AD FS, you can add an issuance transform rule that looks like this: + + @RuleName = "Issue account type for domain-joined computers" + c:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value = "DJ" + ); + +#### Issue objectGUID of the computer account on-premises + +**`http://schemas.microsoft.com/identity/claims/onpremobjectguid`** - This claim must contain the **objectGUID** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this: + + @RuleName = "Issue object GUID for domain-joined computers" + c1:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + store = "Active Directory", + types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"), + query = ";objectguid;{0}", + param = c2.Value + ); + +#### Issue objectSID of the computer account on-premises + +**`http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid`** - This claim must contain the the **objectSid** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this: + + @RuleName = "Issue objectSID for domain-joined computers" + c1:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue(claim = c2); + +#### Issue issuerID for computer when multiple verified domain names in Azure AD + +**`http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid`** - This claim must contain the Uniform Resource Identifier (URI) of any of the verified domain names that connect with the on-premises federation service (AD FS or 3rd party) issuing the token. In AD FS, you can add issuance transform rules that look like the ones below in that specific order after the ones above. Please note that one rule to explicitly issue the rule for users is necessary. In the rules below, a first rule identifying user vs. computer authentication is added. + + @RuleName = "Issue account type with the value User when its not a computer" + NOT EXISTS( + [ + Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value == "DJ" + ] + ) + => add( + Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value = "User" + ); + + @RuleName = "Capture UPN when AccountType is User and issue the IssuerID" + c1:[ + Type == "http://schemas.xmlsoap.org/claims/UPN" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value == "User" + ] + => issue( + Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", + Value = regexreplace( + c1.Value, + ".+@(?.+)", + "http://${domain}/adfs/services/trust/" + ) + ); + + @RuleName = "Issue issuerID for domain-joined computers" + c:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", + Value = "http:///adfs/services/trust/" + ); + + +In the claim above, + +- `$` is the AD FS service URL +- `` is a placeholder you need to replace with one of your verified domain names in Azure AD + +For more details about verified domain names, see [Add a custom domain name to Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-add-domain). +To get a list of your verified company domains, you can use the [Get-MsolDomain](https://docs.microsoft.com/en-us/powershell/module/msonline/get-msoldomain?view=azureadps-1.0) cmdlet. + +#### Issue ImmutableID for computer when one for users exist (e.g. alternate login ID is set) + +**`http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID`** - This claim must contain a valid value for computers. In AD FS, you can create an issuance transform rule as follows: + + @RuleName = "Issue ImmutableID for computers" + c1:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + store = "Active Directory", + types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"), + query = ";objectguid;{0}", + param = c2.Value + ); + +#### Helper script to create the AD FS issuance transform rules + +The following script helps you with the creation of the issuance transform rules described above. + + $multipleVerifiedDomainNames = $false + $immutableIDAlreadyIssuedforUsers = $false + $oneOfVerifiedDomainNames = 'example.com' # Replace example.com with one of your verified domains + + $rule1 = '@RuleName = "Issue account type for domain-joined computers" + c:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value = "DJ" + );' + + $rule2 = '@RuleName = "Issue object GUID for domain-joined computers" + c1:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + store = "Active Directory", + types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"), + query = ";objectguid;{0}", + param = c2.Value + );' + + $rule3 = '@RuleName = "Issue objectSID for domain-joined computers" + c1:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue(claim = c2);' + + $rule4 = '' + if ($multipleVerifiedDomainNames -eq $true) { + $rule4 = '@RuleName = "Issue account type with the value User when it is not a computer" + NOT EXISTS( + [ + Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value == "DJ" + ] + ) + => add( + Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value = "User" + ); + + @RuleName = "Capture UPN when AccountType is User and issue the IssuerID" + c1:[ + Type == "http://schemas.xmlsoap.org/claims/UPN" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", + Value == "User" + ] + => issue( + Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", + Value = regexreplace( + c1.Value, + ".+@(?.+)", + "http://${domain}/adfs/services/trust/" + ) + ); + + @RuleName = "Issue issuerID for domain-joined computers" + c:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", + Value = "http://' + $oneOfVerifiedDomainNames + '/adfs/services/trust/" + );' + } + + $rule5 = '' + if ($immutableIDAlreadyIssuedforUsers -eq $true) { + $rule5 = '@RuleName = "Issue ImmutableID for computers" + c1:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", + Value =~ "-515$", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + && + c2:[ + Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", + Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" + ] + => issue( + store = "Active Directory", + types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"), + query = ";objectguid;{0}", + param = c2.Value + );' + } + + $existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules + + $updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5 + + $crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules + + Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString + +#### Remarks + +- This script appends the rules to the existing rules. Do not run the script twice because the set of rules would be added twice. Make sure that no corresponding rules exist for these claims (under the corresponding conditions) before running the script again. + +- If you have multiple verified domain names (as shown in the Azure AD portal or via the Get-MsolDomains cmdlet), set the value of **$multipleVerifiedDomainNames** in the script to **$true**. Also make sure that you remove any existing issuerid claim that might have been created by Azure AD Connect or via other means. Here is an example for this rule: + + + c:[Type == "http://schemas.xmlsoap.org/claims/UPN"] + => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?.+)", "http://${domain}/adfs/services/trust/")); + +- If you have already issued an **ImmutableID** claim for user accounts, set the value of **$immutableIDAlreadyIssuedforUsers** in the script to **$true**. + +#### Configure Device Authentication in AD FS +Using an elevated PowerShell command window, configure AD FS policy by executing the following command + +`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod All` + +#### Check your configuration +For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work + +- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain> + - read access to the AD FS service account + - read/write access to the Azure AD Connect sync AD connector account +- Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> +- Container Device Registration Service DKM under the above container + +![Device Registration](images/hybridct/device8.png) + +- object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration +- Configuration,CN=Services,CN=Configuration,DC=<domain> + - read/write access to the specified AD connector account name on the new object +- object of type msDS-DeviceRegistrationServiceContainer at CN=Device Registration Services,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> +- object of type msDS-DeviceRegistrationService in the above container + +>[!div class="nextstepaction"] +[Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. Configure Azure Device Registration (*You are here*) +5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md new file mode 100644 index 0000000000..c4c4dd6085 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -0,0 +1,138 @@ +--- +title: Hybrid Windows Hello for Business Prerequistes (Windows Hello for Business) +description: Prerequisites for Hybrid Windows Hello for Business Deployments +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/09/2017 +--- +# Hybrid Windows Hello for Business Prerequisites + +**Applies to** +- Windows 10 + + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +Hybrid environments are distributed systems that enable organizations to use on-premises and Azure-based identities and resources. Windows Hello for Business uses the existing distributed system as a foundation on which organizations can provide two-factor authentication that provides a single sign-in like experience to modern resources. + +The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: +* [Directories](#directories) +* [Public Key Infrastucture](#public-key-infastructure) +* [Directory Synchronization](#directory-synchronization) +* [Federation](#federation) +* [MultiFactor Authetication](#multifactor-authentication) +* [Device Registration](#device-registration) + +## Directories ## +Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. + +A hybrid Windows Hello for Busines deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, may not require Azure Active Directory premium subscription. + +Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. In addition to the Windows Server 2016 Active Directory schema, key trust deployments need an adequate number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. + +Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. + +### Section Review ### + +> [!div class="checklist"] +> * Active Directory Domain Functional Level +> * Active Directory Forest Functional Level +> * Domain Controller version +> * Windows Server 2016 Schema +> * Azure Active Directory subscription +> * Correct subscription for desired features and outcomes + +
+ +## Public Key Infrastructure ## +The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows 10 devices to trust the domain controller. + +Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Diretory object. + +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. + +### Section Review +> [!div class="checklist"] +> * Windows Server 2012 Issuing Certificate Authority +> * Windows Server 2016 Active Directory Federation Services + +
+ +## Directory Synchronization ## +The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. + +Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect + +### Section Review +> [!div class="checklist"] +> * Azure Active Directory Connect directory synchronization +> * [Upgrade from DirSync](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-dirsync-upgrade-get-started) +> * [Upgrade from Azure AD Sync](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-upgrade-previous-version) + +
+ +## Federation ## +Federating your on-premises Active Directory with Azure Active Directory ensures all identities have access to all resources regardless if they reside in cloud or on-premises. Windows Hello for Business hybrid certificate trust needs Windows Server 2016 Active Directory Federation Services. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. + +The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658), which is automatically downloaded and installed through Windows Update. If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) + +### Section Review ### +> [!div class="checklist"] +> * Windows Server 2016 Active Directory Federation Services +> * Minimum update of [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658) + +
+ +## Multifactor Authentication ## +Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication. + +Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. + +### Section Review +> [!div class="checklist"] +> * Azure MFA Service +> * Windows Server 2016 AD FS and Azure +> * Windows Server 2016 AD FS and third party MFA Adapter + +
+ +## Device Registration ## +Organizations wanting to deploy hybrid key trust need thier domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. + + +### Section Checklist ### +> [!div class="checklist"] +> * Azure Active Directory Device writeback +> * Azure Active Directory Premium subscription + +
+ +### Next Steps ### +Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. + +If your environment is already federated, but does not include Azure device registration, choose **Configure Azure Device Registration**. + +If your environment is already federated and supports Azure device registration, choose **Configure Windows Hello for Business settings**. + +> [!div class="op_single_selector"] +> - [New Installation Baseline](hello-hybrid-key-new-install.md) +> - [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +> - [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-key-trust.md) +2. Prerequistes (*You are here*) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +5. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md new file mode 100644 index 0000000000..dbded7ce90 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md @@ -0,0 +1,51 @@ +--- +title: Hybrid Key Trust Deployment (Windows Hello for Business) +description: Hybrid Key Trust Deployment Overview +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/09/2017 +--- +# Hybrid Azure AD joined Key Trust Deployment + +**Applies to** +- Windows 10 + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + + +Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid key trust scenario. + +It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](https://docs.microsoft.com/en-us/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). + +This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. + +## New Deployment Baseline ## +The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. + +This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. + +## Federated Baseline ## +The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. + +Regardless of the baseline you choose, you’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. + +> [!div class="nextstepaction"] +> [Prerequistes](hello-hybrid-key-trust-prereqs.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid key trust deployment guide +1. Overview (*You are here*) +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Device Registration](hello-hybrid-key-trust-devreg.md) +5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +6. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md new file mode 100644 index 0000000000..744f4930a3 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -0,0 +1,75 @@ +--- +title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) +description: Provisioning for Hybrid Windows Hello for Business Deployments +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 09/08/2017 +--- +# Hybrid Windows Hello for Business Provisioning + +**Applies to** +- Windows 10 + + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +## Provisioning +The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. + +![Event358](images/Event358.png) + +The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **EnterpriseJoined** reads **Yes**. + +![dsreg output](images/dsregcmd.png) + + +Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. + +![Setup a PIN Provisioning](images/setupapin.png) + +The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. + +![MFA prompt during provisioning](images/mfa.png) + +After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. + + + +The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. +* A successful single factor authentication (username and password at sign-in) +* A device that has successfully completed device registration +* A fresh, successful multi-factor authentication +* A validated PIN that meets the PIN complexity requirements + +The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. AAD Connect syncrhonizes the user's key to the on-prem Active Directory. + +> [!IMPORTANT] +> The minimum time needed to syncrhonize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. This synchronization latency delays the certificate enrollment for the user. After the user's public key has synchronized to Active Directory, the user's certificate enrolls automatically as long as the user's session is active (actively working or locked, but still signed-in). Also, the Action Center notifies the user thier PIN is ready for use. + +> [!NOTE] +> Microsoft is actively investigating ways to reduce the syncrhonization latency and delays in certificate enrollment with the goal to make certificate enrollment occur real-time. + +After a successful key registration, Windows creates a certificate request using the same key pair to request a certificate. Windows send the certificate request to the AD FS server for certificate enrollment. + +The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. + +The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center. + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md) +6. Sign-in and Provision(*You are here*)  + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md new file mode 100644 index 0000000000..27eba8dd44 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -0,0 +1,81 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Active Directory (AD) +description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, ad +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configuring Windows Hello for Business: Active Directory + +**Applies to** +- Windows 10 + +>[!div class="step-by-step"] +[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) +[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) + +The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +### Creating Security Groups + +Windows Hello for Business uses several security groups to simplify the deployment and managment. + +> [!Important] +> If your environment has one or more Windows Server 2016 domain controllers in the domain to which you are deploying Windows Hello for Business, then skip the **Create the KeyCredentials Admins Security Group**. Domains that include Windows Server 2016 domain controllers use the KeyAdmins group, which is created during the installation of the first Windows Server 2016 domain controller. + +#### Create the KeyCredential Admins Security Group + +Azure Active Directory Connect synchronizes the public key on the user object created during provisioning. You assign write and read permission to this group to the Active Directory attribute to ensure the Azure AD Connect service can add and remove keys as part of its normal workflow. + +Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advance Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **KeyCredential Admins** in the **Group Name** text box. +6. Click **OK**. + +#### Create the Windows Hello for Business Users Security Group + +The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy and Certificate template permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business and to enroll in the Windows Hello for Business authentication certificate. + +Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. + +### Section Review + +> [!div class="checklist"] +> * Create the KeyCredential Admins Security group (optional) +> * Create the Windows Hello for Business Users group + +>[!div class="step-by-step"] +[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) +[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: Active Directory (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md new file mode 100644 index 0000000000..e68276a09e --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md @@ -0,0 +1,89 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Active Directory Federation Services (ADFS) +description: Discussing the configuration of Active Directory Federation Services (ADFS) in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, adfs +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Windows Hello for Business: Active Directory Federation Services + +**Applies to** +- Windows10 + +## Federation Services + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +>[!div class="step-by-step"] +[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) + + +The Windows Server 2016 Active Directory Fedeartion Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. + +The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. + +### Configure the Registration Authority + +Sign-in the AD FS server with *Domain Admin* equivalent credentials. + +1. Open a **Windows PowerShell** prompt. +2. Type the following command + + ```PowerShell + Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication + ``` + + +The `Set-AdfsCertificateAuthority` cmdlet should show the following warning: +>WARNING: PS0343: Issuing Windows Hello certificates requires enabling a permitted strong authentication provider, but no usable providers are currently configured. These authentication providers are not supported for Windows Hello certificates: CertificateAuthentication,MicrosoftPassportAuthentication. Windows Hello certificates will not be issued until a permitted strong authentication provider is configured. + +This warning indicates that you have not configured multi-factor authentication in AD FS and until it is configured, the AD FS server will not issue Windows Hello certificates. Windows 10, version 1703 clients check this configuration during prerequisite checks. If detected, the prerequisite check will not succeed and the user will not provision Windows Hello for Business on sign-in. + +>[!NOTE] +> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. + + +### Group Memberships for the AD FS Service Account + +The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. + +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click the **Users** container in the navigation pane. +3. Right-click **Windows Hello for Business Users** group +4. Click the **Members** tab and click **Add** +5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. +6. Click **OK** to return to **Active Directory Users and Computers**. +7. Restart the AD FS server. + +### Section Review +> [!div class="checklist"] +> * Configure the registration authority +> * Update group memberships for the AD FS service account + + +>[!div class="step-by-step"] +[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: AD FS (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md new file mode 100644 index 0000000000..084999e656 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -0,0 +1,86 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Directory Synchronization +description: Discussing Directory Synchronization in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Hybrid Windows Hello for Business: Directory Synchronization + +**Applies to** +- Windows 10 + +>[!div class="step-by-step"] +[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) + +## Directory Syncrhonization + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. + +The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. + +> [!IMPORTANT] +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. + +### Configure Permissions for Key Syncrhonization + +Sign-in a domain controller or management workstations with *Domain Admin* equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Right-click your domain name from the navigation pane and click **Properties**. +3. Click **Security** (if the Security tab is missing, turn on Advanced Features from the View menu). +4. Click **Advanced**. Click **Add**. Click **Select a principal**. +5. The **Select User, Computer, Service Account, or Group** dialog box appears. In the **Enter the object name to select** text box, type **KeyCredential Admins**. Click **OK**. +6. In the **Applies to** list box, select **Descendant User objects**. +7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**. +8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCrendentialLink**. +9. Click **OK** three times to complete the task. + + +### Group Memberships for the Azure AD Connect Service Account + +The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. + +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click the **Users** container in the navigation pane. +>[!IMPORTANT] +> If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created. + +3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**. +4. Click the **Members** tab and click **Add** +5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. +6. Click **OK** to return to **Active Directory Users and Computers**. + +### Section Review + +> [!div class="checklist"] +> * Configure Permissions for Key Synchronization +> * Configure group membership for Azure AD Connect + +>[!div class="step-by-step"] +[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: Directory Syncrhonization (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md new file mode 100644 index 0000000000..27ea8e8a47 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -0,0 +1,199 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Public Key Infrastructure (PKI) +description: Discussing the configuration of the Public Key Infrastructure (PKI) in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- + +# Configure Hybrid Windows Hello for Business: Public Key Infrastructure + +**Applies to** +- Windows 10 + +> [!div class="step-by-step"] +[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) +[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certifcates to validate the name of the server to which they are connecting and to encyrpt the data that flows them and the client computer. + +All deployments use enterprise issed certificates for domain controllers as a root of trust. Hybrid certificate trust deployments issue users sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to non-Windows Server 2016 domain controllers. Additionally, hybrid certificate trust deployments issue certificate to registration authorites to provide defenese-in-depth security for issueing user authentication certificates. + +## Certifcate Templates + +This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authtority. + +### Domain Controller certificate template + +Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain - namely the enterprise certificate authority. + +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the *Domain Controller* and *Domain Controller Authentication* certificate templates do not include the **KDC Authentication** object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. + +By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the **Kerberos Authentication** certificate template a baseline to create an updated domain controller certificate template. + +#### Create a Domain Controller Authentication (Kerberos) Certificate Template + +Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. + **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. + +#### Configure Certificate Suspeding for the Domain Controller Authentication (Kerberos) Certificate Template + +Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. + +The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). + +The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. + +Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. + +The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. + +### Enrollment Agent certificate template + +Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate lifecycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts. + +Approximately 60 days prior to enrollment agent certificate's expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. + +> [!IMPORTANT] +> Follow the procedures below based on the AD FS service account used in your environment. + +#### Creating an Enrollment Agent certificate for Group Managed Service Accounts + +Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. + +1. Open the **Certificate Authority Management** console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right click on the **Exchange Enrollment Agent (Offline request)** template details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. +6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. + **Note:** The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. + +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +8. On the **Security** tab, click **Add**. +9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. +10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. +11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +12. Close the console. + +#### Creating an Enrollment Agent certificate for typical Service Acconts + +Sign-in a certificate authority or management workstations with *Domain Admin* equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. +9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +10. Close the console. + +### Creating Windows Hello for Business authentication certificate template + +During Windows Hello for Business provisioning, the Windows 10, version 1703 client requests an authentication certificate from the Active Directory Federation Service, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring. + +Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. + +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. + **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. +6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. +7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. +8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. + * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. +9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. +10. On the **Request Handling** tab, select the **Renew with same key** check box. +11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. +14. Click on the **Apply** to save changes and close the console. + +#### Mark the template as the Windows Hello Sign-in template + +Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials. +1. Open an elevated command prompt. +2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` + +>[!NOTE] +>If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. +Publish Templates + +### Publish Certificate Templates to a Certificate Authority + +The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. + +### Unpublish Superseded Certificate Templates + +The certificate authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. + +The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. + +Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. + +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. + +### Section Review +> [!div class="checklist"] +> * Domain Controller certificate template +> * Configure superseded domain controller certificate templates +> * Enrollment Agent certifcate template +> * Windows Hello for Business Authentication certificate template +> * Mark the certifcate template as Windows Hello for Business sign-in template +> * Publish Certificate templates to certificate authorities +> * Unpublish superseded certificate templates + + +> [!div class="step-by-step"] +[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) +[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings: PKI (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md new file mode 100644 index 0000000000..2c0b6759f9 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -0,0 +1,204 @@ +--- +title: Configuring Hybrid Windows Hello for Business - Group Policy +description: Discussing the configuration of Group Policy in a Hybrid deployment of Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport, WHFB +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Hybrid Windows Hello for Business: Group Policy + +**Applies to** +- Windows 10 + +> [!div class="step-by-step"] +[< Configure AD FS](hello-hybrid-cert-whfb-settings-adfs.md) + + +## Policy Configuration + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. + +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. + +Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) autoamtically request and renew the correct domain controller certifcate. + +Domain joined clients of hybrid certificate-based deployments of Windows Hello for Business needs three Group Policy settings: +* Enable Windows Hello for Business +* Use certificate for on-premises authentication +* Enable automatic enrollment of certificates + +### Configure Domain Controllers for Automatic Certificate Enrollment + +Domain controllers automatically request a certificate from the *Domain Controller* certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. + +To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. + +#### Create a Domain Controller Automatic Certifiacte Enrollment Group Policy object + +Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. + +#### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object + +Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. + +### Windows Hello for Business Group Policy + +The Windows Hello for Business Group Policy object delivers the correct Group Policy settings to the user, which enables them to enroll and use Windows Hello for Business to authenticate to Azure and Active Directory + +#### Enable Windows Hello for Business + +The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. + +You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. + +#### Use certificate for on-premises authentication + +The Use certificate for on-premises authentication Group Policy setting determines if the on-premises deployment uses the key-trust or certificate trust on-premises authentication model. You must configure this Group Policy setting to configure Windows to enroll for a Windows Hello for Business authentication certificate. If you do not configure this policy setting, Windows considers the deployment to use key-trust on-premises authentication, which requires a sufficient number of Windows Server 2016 domain controllers to handle the Windows Hello for Business key-trust authentication requests. + +You can configure this Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users requesting a Windows Hello for Business authentication certificate. Deploying this policy setting to a user results in only that user requesting a Windows Hello for Business authentication certificate. Additionally, you can deploy the policy setting to a group of users so only those users request a Windows Hello for Business authentication certificate. If both user and computer policy settings are deployed, the user policy setting has precedence. + +#### Enable automatic enrollment of certificates + +Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business authentication certificate template. The Windows 10, version 1703 certificate auto enrollment was updated to renew these certificates before they expire, which significantly reduces user authentication failures from expired user certificates. + +The process requires no user interaction provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. + +#### Create the Windows Hello for Business Group Policy object + +The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. + +Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New**. +4. Type *Enable Windows Hello for Business* in the name box and click **OK**. +5. In the content pane, right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **User Configuration**. +7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. +8. In the content pane, double-click **Use Windows Hello for Business**. Click **Enable** and click **OK**. +9. Double-click **Use certificate for on-premises authentication**. Click **Enable** and click **OK**. Close the **Group Policy Management Editor**. + +#### Configure Automatic Certificate Enrollment + +1. Start the **Group Policy Management Console** (gpmc.msc). +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. +4. In the navigation pane, expand **Policies** under **User Configuration**. +5. Expand **Windows Settings > Security Settings**, and click **Public Key Policies**. +6. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +7. Select **Enabled** from the **Configuration Model** list. +8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +9. Select the **Update certificates that use certificate templates** check box. +10. Click **OK**. Close the **Group Policy Management Editor**. + +#### Configure Security in the Windows Hello for Business Group Policy object + +The best way to deploy the Windows Hello for Business Group Policy object is to use security group filtering. The enables you to easily manage the users that should receive Windows Hello for Business by simply adding them to a group. This enables you to deploy Windows Hello for Business in phases. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Double-click the **Enable Windows Hello for Business** Group Policy object. +4. In the **Security Filtering** section of the content pane, click **Add**. Type *Windows Hello for Business Users* or the name of the security group you previously created and click **OK**. +5. Click the **Delegation** tab. Select **Authenticated Users** and click **Advanced**. +6. In the **Group or User names** list, select **Authenticated Users**. In the **Permissions for Authenticated Users** list, clear the **Allow** check box for the **Apply Group Policy** permission. Click **OK**. + +#### Deploy the Windows Hello for Business Group Policy object + +The application of the Windows Hello for Business Group Policy object uses security group filtering. This enables you to link the Group Policy object at the domain, ensuring the Group Policy object is within scope to all users. However, the security group filtering ensures only the users included in the *Windows Hello for Business Users* global group receive and apply the Group Policy object, which results in the provisioning of Windows Hello for Business. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO�** +3. In the **Select GPO** dialog box, select **Enable Windows Hello for Business** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. + +Just to reassure, linking the **Windows Hello for Business** Group Policy object to the domain ensures the Group Policy object is in scope for all domain users. However, not all users will have the policy settings applied to them. Only users who are members of the Windows Hello for Business group receive the policy settings. All others users ignore the Group Policy object. + +## Other Related Group Policy settings + +### Windows Hello for Business + +There are other Windows Hello for Business policy settings you can configure to manage your Windows Hello for Business deployment. These policy settings are computer-based policy setting; so they are applicable to any user that sign-in from a computer with these policy settings. + +#### Use a hardware security device + +The default configuration for Windows Hello for Business is to prefer hardware protected credentials; however, not all computers are able to create hardware protected credentials. When Windows Hello for Business enrollment encounters a computer that cannot create a hardware protected credential, it will create a software-based credential. + +You can enable and deploy the **Use a hardware security device** Group Policy Setting to force Windows Hello for Business to only create hardware protected credentials. Users that sign-in from a computer incapable of creating a hardware protected credential do not enroll for Windows Hello for Business. + +Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiven during anti-hammering and PIN lockout activities. Therefore, some organization may want not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. + +#### Use biometrics + +Windows Hello for Business provides a great user experience when combined with the use of biometrics. Rather than providing a PIN to sign-in, a user can use a fingerprint or facial recognition to sign-in to Windows, without sacrificing security. + +The default Windows Hello for Business enables users to enroll and use biometrics. However, some organization may want more time before using biometrics and want to disable their use until they are ready. To not allow users to use biometrics, configure the **Use biometrics** Group Policy setting to disabled and apply it to your computers. The policy setting disabled all biometrics. Currently, Windows does not provide granular policy setting that enable you to disable specific modalities of biometrics such as allow facial recognition, but disallow fingerprint. + +### PIN Complexity + +PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed. + +Windows 10 provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are: +* Require digits +* Require lowercase letters +* Maximum PIN length +* Minimum PIN length +* Expiration +* History +* Require special characters +* Require uppercase letters + +Starting with Windows 10, version 1703, the PIN complexity Group Policy settings have moved to remove misunderstanding that PIN complexity policy settings were exclusive to Windows Hello for Business. The new location of these Group Policy settings is under **Computer Configuration\Administrative Templates\System\PIN Complexity** of the Group Policy editor. + +## Add users to the Windows Hello for Business Users group + +Users must receive the Windows Hello for Business group policy settings and have the proper permission to enroll for the Wwindows Hello for Business Authentication certificate. You can provide users with these settings and permissions by adding the group used synchronize users to the Windows Hello for Business Users group. Users and groups who are not members of this group will not attempt to enroll for Windows Hello for Business. + +### Section Review +> [!div class="checklist"] +> * Configure domain controllers for automatic certificate enrollment. +> * Create Windows Hello for Business Group Policy object. +> * Enable the Use Windows Hello for Business policy setting. +> * Enable the Use certificate for on-premises authentication policy setting. +> * Enable user automatic certificate enrollment. +> * Add users or groups to the Windows Hello for Business group + + +> [!div class="nextstepaction"] +[Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business policy settings (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md new file mode 100644 index 0000000000..2dbfc5fda4 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -0,0 +1,50 @@ +--- +title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) +description: Configuring Windows Hello for Business Settings in Hybrid deployment +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +ms.date: 09/08/2017 +--- +# Configure Windows Hello for Business + +**Applies to** +- Windows 10 + +> [!div class="step-by-step"] +[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) + +>[!IMPORTANT] +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You're environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. +> [!IMPORTANT] +> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. + +The configuration for Windows Hello for Business is grouped in four categories. These categories are: +* [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +* [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) +* [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) +* [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) + +For the most efficent deployment, configure these technologies in order beginning with the Active Directory configuration + +> [!div class="step-by-step"] +[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) + +

+ +
+ +## Follow the Windows Hello for Business hybrid certificate trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +5. Configure Windows Hello for Business settings (*You are here*) +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/images/dc-chart1.png b/windows/access-protection/hello-for-business/images/dc-chart1.png new file mode 100644 index 0000000000000000000000000000000000000000..52e0f0500e43baab14570268c7479e6a417e4c18 GIT binary patch literal 3978 zcmcIndpuNY+n$s#h;kSy4Mh%#lpO7e5w-d$^!srSDdciU&)6-??We3|3B36!^=E#|md$ z4}`;DI!Tgy5owrx90pTCx;gFK7v(peQ(nqw)krkg9Ym+yO|nqpDR>MiD=l#yXph}( z6@r*tR}(hS?0l!9uic@_@5N0uednqz{p}Zn5?gLNzEdLUpW3SKVhhR%zP#DevK$&n zvvKKc;LC_n|Lg0?<|0OUFUzlMf{NL5!8*5xwz#OJv3DleuZ|w@VZvHRC0K1{`Bwh9 zk}j=y}OT8ghZWBps{i{Pshu4m)1r=tdq4h?YD<%)up*piJdKyVB$R6N* zhbNfry_J7=yOIJY5Uj}~XYTSds`)|*Q{eeT-NTw?e^|Tr{Mn9_@Nc9y+?8F;VJC^N zE7`+Q(GiT__>pjG9(PoeEA;k(1ZX z&Xr*=4`_d1vR0x&ufn-jKrd=KqZ}c#Tq2>`mG3JW`*@@#(dNn@ODp)Ylo4B2H~Fl!EqD6L~&deDKa=Y*RFTcJ8uf$*VM z?F_00lf`QF9o zF;vhat_VL7jml!ha45q5L(vawmpx_dz8wxc-^wn+`6x!nusmzdRAl*`d$t3?LF~-d zjTk~;KAH4`y|_f4HG=l1DPocp;;;f4vI~35sIOAg;v-z;ju@jsWP_`bb1DH&!L)+S zOc0?!dpZ)J;S25b*mS!VA|`A;tk^mM9VTr+#G9QQfHNmav40F#w{%d zedkVj`$ISTv}lj66F{(6b$Eo=Lu?KfwP<0(-vwxh4L}LLb4S}+A9)`ygN~sJ8|=j- z=&<@i3UJR~K|?}JX_5)up=qXcXa~7A&3;R1j>~QUb6m&$XdaMZoD6WRc(iU~_0Q;> z7yNs8YxXO%Yu^LRvgh}|2gp6ga!)L4=OO2(Z`4}Y?lKVYEd+ZaR}q`3JZxt8<9!sq z(7g@?G5ZpN_9t`9(<3HLgTUe&(6n|`s!DQp$zv#fEH;RUwv>wo#*zUpf%2rr(F~di z+~n)H0M{m?p!iJ!S9uXq)^A4+1KwI?E$wO=gzy{TjVb5>1`Xg_3E z0|Ik8^JPSZ4ajxZ>Hf!sRC>%`XYBSBije|{@tWk?NeeqRg0@Z_9#nwokNseteQ$Gi z7Hk6oBQzPt_vyC#s*^mMI7oe~R2$IfZ0{JJK%RcB{Om-Sh&7v6fBTQ_50LSS5f3Kx z74Fm_lpt@j>L@`Eml52o$9&~vg}Z^1CCOYtA1=8RAsdKd{eFkXjQbdL3GKhJQ=uOF zQPBkx7gNAd)J>@+-ZZrwZZ5_f2$C$|hgC`Y7eQ?{X<3fbtp_UMrI6oJp&>_?9OI)~o8m;;?iSG2)dWT1xa|1};=J}-=7~Gs zm~jH@r#iF9s-N!DH?(rDYg0zt&{aGYMSgw7{OPF(0CMxa5~};@;fuMv3Oo1oZ~I!I z2ZkHfH(NtixsX}%mGh}fnv}W-LRRFnW|XM1Mq>a89qhR}Ng`|vapo1_GOyWO@=72GsAElceoj&W z&FZxRPouw_a~wAOuR=j#zpi5`n-CE)kL4jAeNdwGpY=SnzuEUC2bYW3Wv_l+2Rw{c z-?9HP;YV_01cC|gBp>(nVRY^}+lrL2XWiA*_sny)Rs7x>uqNl>*Se}Fg#76lFQ=Rr zuVy}G&5}>r+e4U94otGGm@sk6qoPD?60~0!xqIc+_>oPPYw(dDYO&w>N0MHWod{l( zO&eiTLTplO-J8}!%OhkmK7rk|I=XOZj2p+VGk?CFS0emgR1Z!`cFub$ZrLP)fZNTZ zLRUpQ3V&NM`@{I6ZD6M6BBG+~SFicfi#C_8J;ZC_E5K#t+;Q)`QqTQ^5@YsCje%5K z#2SEG5XLxQGZ4g0vhW8RCO$g(*|Sx!Ypx>TUwIqEDV09Y9;0<-V8II1G7A8g25uzA~3Y8)nJTVwm5>_XlDj**Mys`C%Op`nO@>b z=lm*iS{y&eBhB|XwiZKlHO-aY>ukE;Hq&`)oxgj6Z|8xqNu{XWm z)_gu&5_gRy5>W=~v_usDmSC8}hA^(c{1#2sKpA`q?)9;mNcCs~f=gr$DrHy_TkKav zvB1I>y=Op$6L&Fpe~s?{k3c4vsvlb{Jz3}_WFJ}j*$@s@H37ksp{oSlOQEXr3Bop0 z_3nOf8?Rbf6nvS`-H$xcgf9QtUzqmS{6AkA7#@~HeNNVO@i{fS!p)!ZMXdcFpzTEr zN^p#0{)w{n@3W4KqX&4;$Cy#v=->R9=e|_eZDIC%bjz4--zH*%7ha%5u`e%6x#}e~ zR1EPD=ChBH<@i9Tt7L-YAj7d=9yW@%}nHW8_S@uY1?twd!YEl9c!_U zYI=26IX1G4|I&NVpI)(N_Rh+KC0c{qb6p5AjO}Umr9KNF#bFnu0U-9Lik^T0l~6bG z%tz-IaV&J02Py9j`yAsZR9xrh7q5AX#IM4$d$cm>Y6Va2)R%U|&9PId>JJ}(`}6vB zs~_YPZ%@km3(Kg?Du#VVSI?|WKVj#8s1EHRxY1NHNu$;uUmmKO(eFYnmv^hx@9EgN zBP7-REYi;Zq&A(7^h8;F4Z^IqeK}R6Qfddf_!W$xn+8U@W@Q6OK*u6Ou;_i@U9I zZ`7z>xwZ_{#<*6{CZjbF@UT4h;E)T8CIQ`r3Punlsfw&7fO|~2zo_T31<7c6m1((8 zm2c=#G5M%HPYUsIPr?~-hu}*hO^@0ON_V;n%iRE&e79-v$VK!EW^RiQGm`0L2v1WhO{BRp+c|y zVc+%s)`_^iZTfBOM?~~&g#P*Qhj3zl(B#UEiBg+yX;;hrU3XQ*1+sob0~PNnE0@&5uu@g*Yw literal 0 HcmV?d00001 diff --git a/windows/access-protection/hello-for-business/images/dc-chart2.png b/windows/access-protection/hello-for-business/images/dc-chart2.png new file mode 100644 index 0000000000000000000000000000000000000000..748a6a4c411c69cc5284eec12d7fd15d250514bb GIT binary patch literal 3701 zcmb_fdpMNa8XrmQ5u=?{#;vrOin6z1*oKMRN=$Siw;@Ri<5Di8W_BdqTw+HFQ=TTxOWdnPKm9p7YOn&hwnJp66R@z2En&_g%l=?_KM8zx$^h zY~+B-KmY(Bcf!`v2>_53&z)qpiTWiuO)b$N5$0rL0VwWNnHCva{mkvn0f2W&vOI4o zk^Muk?S(J^Ks8?cNF+@z`T_v*z!R3{XCpo5vT72Ct(ERdYy5l#`U#}DXJKbR3EIo+ zww#LbX!m_53G7yFc@?AJ(t=%kU7EKj`Zr~r`b|?ZvHC5g09tm1Nl8v(-UcPQE8menE2zl*K_S`jAzjzPt4jI?lj|u%baO(9cMQ5Boz;89! z-xY{ju`vnstLNp72(J%JBgMXc|9g{#%^rNX3al+skg%fzL0x)3q6P zv7z3%3$rV8D-+kwH2L7d>%u5+NRr~EvoTSQ0rgl#ftp314n$ur7QLNCA;i^N(A-Qz zY*&5yW#CkZdlmosXu5KoyTe8_4=?P@JSk@!IPb2n0Nw7b`O+3IlP4E{xL*H_1-61$ zp3ta2gcm#_VJ5OKwS%Rsf-abD1bcC#6e*EeA0-na6}6BW-8@@({6y0}20`v_awn%}tJmsc2w)kCe!m(08 z7<<`TvQfo-TJ&X|{d`iJxLP`@du(o;fr5q~T?31&#aF z|K=}Y(9iDDZP;e_P|}Brg?vYsxZ#EoVqI`3tZwXbL{LVxOyd^+{dK`_Dvn`q91rQ` zy9DIA97#rv{C4R>&ECMbr)wF!%Ap>0onGiI9_&1X_GC0j^J%3jMFrP;AYd{Rq#G%4 zBX|#X@Vk_LU#u=ETNgqp6X{(fS0?VK&eb@KjhS#3Q=ToGg6tfi)K)Bz!nsqM{8p`J zp^QFqwpLOyO~%%~Jq_B97%Qy{c18mEJM=cKJZ8CutG~Rc}vqP?Q+_Htp(kokFS%bQnq#p2i6lDTNDFo*X zt5l9a+|x&ceDuli_s6g%!s&+>Y*GV=o)k~vC(JYM@`VK+p0iM&U_G6|E9)|;R(k`N z24*v#Vf+l0O53HVo!2r*4wLY-Ml-$+MNx1FPr-NoC4?ya4@bj|3xcYHXDYq0gyBnu z`rCY2HNMcvpzTM|_j#AW^jAaHxxsdVdv?W74%H$^?J%-%I6k;2%}9`wDeY#w`h>tD zQyUDiwt2%tT-3r%bdjS>iw0?!9Y<;-b-N4~=*D^97m25T=WKXT^`fu0IPzuUY|Q5vxLvDmV!vf08xReDm3d2yWTByv8wRA30CTTBU` zG+#2M;Sr`Z)*x!9f!lYE$<$CGB_=9tIq_5(rZ0AsWolYvL};we!OLS;Lh#~S5u zu{cO8%T~jTt-b@}csF8@-9-8|T3J>IBpJaMG5c`l=Iz>;J`-@&?#wz*zk!tfh)g0` zQ>_bxKN~JW+a{+XzN{`%2A%e#wf=Vohba`O>=3uryv;<|C-zbC_Wxj*k_G1WDmCOk zI^e1p)48uN)sve14Lx+Dl@oo4Y18uKUg^eiO_ASu7{QGI+-dgg+T+FbBCDXWlWRjm z#2Yji8qvbW;$ZbZw2VK;AIYRXh;FSqz->cfS*dv51lmxjG((y;z36_XTYaSc>$@`Lmw!|H<;aOm$5dh)Qb1?fwX87^ZoufvQqe5MW7*L5=f5>3#ME}`tPf6XD}Jj! zrTxH+Gn$CdqI~ZR@y~u<5we;ba$;j^5xuRVO;$b|y;N8&C?k}Rce6(#jn-o7qTzqW z)$;xvHH(7KAP0s}slyFVZeVl1lO0iYU>rrK42tX@{qQfCs8^5iydpZ@&+Q|r<;xc* zBdxWQkNJn3aJI@aFprEaQCpJr0~IaC?;gnBjr;5`#@TP@@H>L6E)1EsTx3ry_m3QJ z`ROmpu*%%F(aVAjSmZm14w!xH!KJ2cjl7<+gRJFW33$j>`{uz8i=eTOt~eX+;QYSv zlnHHwnDMeQppz3r-(huY%}q?J zuos8d69)@x3Yn102R1yw5_l8ZxaVB^iVQKWU5{~E=caMD2b9=t*PHF2!09s&%Uk8# zFX(GO;CF;aEaay8_V+q$i^#>THJuctAFAuAhKR1w^8z<^ zv6)i6<9G6Su=1@PBlP{GPI2y_z2M#^lj)z1LUw`jixVR7Arq zt8=z{AXaukftbudt>wXqQtfye3U}&Krt4LjIGM%lJBtrS8hbRO^1(Yj6NcK62rnb;VTwiHgebT(1>P zxI{bl4L=)yRxAIJhitOQwK&U&Vu|IZNCxO#KKo1#OYj&scLZk3-0?_0+R*XiFB;CL z(!ZHSHg>OKPcI+)iMdxksfxtHyCUqUry}BN)V7x+dPM?_!I-(!caj9@Kv$Sb zUdaxb=kofnpaXr34CT1wev_Fgu{wWWK&C=MRN)@kfq{~zpid_LO|Pl1y79Zel)8Ul zr#rxi1oPAD`(wRv)CMJi9a6E+jIJD)frs3A%75Q+W+B3~Yrae+UTNRo4#$y#el|+X zZPi;xJ*je3f9-j;`(jbk(~G>p>9um*g_kHFMc$|+fyIz|6P&B@?RP>Em)&YpIt#UlLMFnFD7&90H`F|vIe^aQ_# zGWOU}p9F@RYFu@#MHeqbtZ}QY&A(O}7#nOSzmVvWeS0k9c&O|m50jDMw4s%7$yrw< zm!C_kC>>a%sg=uNn`h$CBvZ&+ef|FErukP?u3I&-cf7z3+Rj>pAD#&-I*p`Q5+!zRq*o z!_8SmNlOU?0;!z(!O;r@l9TPd6#gNdmsIu|N|#MBUd|4nsvaGlRM-+~?`jVMRc9!R z5%N-5G3tl&F(A;MblI~hW0D^N0&Vv?ZP1?&yIJzMFA&dM@Gf@p3g=YGRIr%E`eWjF`~PVQu4g7Vf>s zBpPEQO8#nHDaUe2x{c7?0w?<{zjI%WUB=Iy0hJ?l9WL1Gil_V!i#~ZUqdHMxDf&+Z z$Ov#x1l-`4(><0-4)co2GD|1=9v!S|`_p$_rzel|ijL%^zVh_wYYj;{^T4!|VX0oV z>xThsSj*_;6Zw0)@yET-|D-NERvgCUbh2q$61BbF*XYrsuTFVPXvzD$Czpe~-lwm% zj%rA<*AaEtUNJAJRdV0~f$}nm$kGCgQ|LC&S0&;anG(>;?_F@)Hg0Q!cjJcv+KZV`=aI2Z%M~s&3`EPWaSznZ~s zw$4?AaFX&(MOzbFuZEdV`kB({SvJ7H+KV(I!KMRM4ebcK$W0Mut+&|;n_ z%D*zVlgM^z+>y?DJLa8ECyFv6?!)?AyV|cE|^@xVOub%5u4Yv>Kouo*k z$TyI?5n#IfVug0*k8!XPoZ6i@yd>6dEhVI|EJH$7dPiPlM{E()1r>0Sg*Pi72_DNc zuoV_Rk{cyM$>zs3Vq+!5O9kRZq0j6(sa@FOvCuh9yhs{|v0tQFp$nuguuLT10FI*w zl%01I$6^a&wq6L(>BEgXqq7XyFW8%fsz|Z|tL7RoOTCihG6|z6CayY9LUNw(TVxC0 zrhke(lnFnOV=kzuYv=FCao9iP-#ki$H*@IWwUM85>81&@fS3$l@M=C{v$A;hNe!AS z3^Ev!7wWha?oFL=BQ$-9U>g1AAk7L4JMIW&mO@2S#|?7i1%BKjx6kT50X!VPDP*x| z@`H+J8|mi^2q zUXkWSyHm`CBj$zCuryY^Bc@g*rZ1wzvtb{$eIM(z+9)w#s)&o7KiP23MF;EIlT!Ie z)a51Qh6id>47}z)i%sKO>IaOr1Z4)yPquO<0xln#@Bc=?jZkmd{TkUA^=VaY5$0jU z$q5LrhgIi64@^xNbu{6e##gwe!qpgYNyvv+r|+gT$!AEsr%xHHcbW>8kItxv zmX}=HBPb5^KW{QPa0rb;K5Ne_N{+Y64)y<1p1=+N)d`^%Ew@3U?U?wIBhVAJu6W4^RMqK21Eiznew>G)1Q=eBtuP=;M-m1!e;FV@OQ@mA6?1wTM9!? z*~N#@;+WYF5x2$B-RQa_+vOL_iIVZ_o_JEGPbMl%HAN1e^Mk zFP^bfp~0xLGXecZ@3n7STkqqW#nM&=q*0Pe_U8z;u21vnVYb7xr8ZVye&S(_DE!TE z?g$$Aqj}PGAAG~iENcR3MhO<5XW5yATbSla_(4G~2*z)L?u5;q*=Y%?9u1zEtb!1T zYvh=JN26Xu7jlB{YNeKn58lHWr`omT zFHqZhHReVH`X&>TFkpptlJBHH1QbsEWB$6u);A z`0}I~g7*H6(X!pbl_h8^EB>XVxa?HWcYsFzfF3Mrho>ZjyuQ}0OQ~&`7Nc!PA5TD~ z*e{f25yh2Lu%Rao*!>bEDeB`^i^NmjYw*CjcZuc~`C2%Kwf>)tqvck$TGkH$^y|yV zXmR&}`dJh(7d+I0W4@S}BL0$0LOTS`nk{+u(Q>c~N_c$(yFwfw{Ym%uMib5KE zJxE4fQs|GF(ySs6N-7h4Aj%x0CGOQ@xRzUyg7&lhOr!j4>Ox9_amQPoy!ix$sY)`X zRR1gCvpEz)xRCuG8$Nn~>JaM?>+7mbuvtdd1eGNylpnm`Oa%HNBm&{!$I10!kqhj@ z9;&|P+1K|D`?5^fc916*JkzQmA|)+(yPl)jsEFvH?2`*5xS_e5u_baN8PeLVU`;@= zbRn|a@11Wxep&u?VVNB7XSC+^@rX9s_O2Sk8>Tbq)5jH(gx3<_iYBBGkG5sz`m!i^ zt8KjFUUtl^0o#x4X(rl509}HAz%bkoWS^l{$#;Hj3ll67%^gS+a0=`1RA=HJf`IES zw~o4RX*KE87`vpnJM&laT6qlZkkf+;%dvm!M_Nma6Dl;7IhyU8S~pv7*I;B!3nO`jys9Wx%Hx&L zkAS_Jcq(bhI<|PJ*mX871$=Zfq7N}e#oa_*JX5lhiE>{5?r$ul%&eTISRmDc^lh}& z1^Osxgy!-`@S0$=U#?3Wz~oK6woted5NtNb(Hd;U@@^-8?6^?kAy7@-Sxc--P{Ird z=8n^^Uf%V!is3>lU;=3;DU~{Sm#!s$#zPd+9d5}`<5=I@PbJ~20@#}=vt_Hb|7=Nk zU{-m=HP8O4DA4B6ZVT90qm#bS`ax5iD=v8=nu`b^57TH&t-l>jm!gVUe^V`HO;rAT zC>Yw)Tunq;U~TkpDPZ0?VWs3@pW3*n;ccJXld^ZBDJ5(8X`L{Z0m{{P}+QjpphOzarIX*XAH?jX4rRQzdcZw*cg^Um|8kmC?n(+e z3IG5=$XOOJM+jvahF$`>krrdNgRXp@uZnbHJ{!ov8nS9zZdi(<~ z)2C3GyRFbR@9ni5?*sSVsj3{Z)?FlR*3;IDIs(Pcxqtdy=s#-qut-in`~>X9%A-H# zn0BM*X5=Lz|6@8GmW_a3r1V>g65niB7WxShUoU;jbi?hp=|;Rf6}O<`JRh^8?qmb5 z@51NV#tl;3B((KL?|$-4{&UZWrl&x~^Zo(G1@hSSW|5tPcK((AgiwF^BJ8%IF;6ULe!U*7n|p;3#I&_fKX%OCta=>amr zF@m$*?H13q37;JhT^e5Ul}f!Tv{dIhPAnjs^fj4%o8FV5es^(3`H0fhn459Ofd_(h z9_-i6IL3i-(eq~J8CsP?v=Vp6Il{h1@t;Dfc(U7 z{ek3mHRi`1l-SC^NJ5LAfeP*0o?mlzkx=FF|B=~4RB5-sX5E8kfk`X5QC=YdMxYDz z{PUM^)Ufwm%_{7eG0}P22?zX^v6OlIWlnN@%IENpz$z~XyazK!EDU6(xMJXAs)tL3hvQP{uz~TCk_j(ZEIvc6(X-_6P{ZNEIEH=Sa-tbKK!ML~-Q&l7am8PB=>VEwCUro+ zW;Uv(tE6d$U^;f2_b@)^Gg)hj1dS;sC5JZPAuJ3c4->l`O#ty^sEtQ&{#X^fq8Ez& z;e^tHNx`jsDs}rf4;xuow6``$kCKsLLAUK#RFqnal?R-YIss={SZjbI|IR*4+l4gw zGsZn2O&=cJ5G9+zI>M_>LhZQBbLkk-n=YjFngpRlzlo7l)XS<9M6=XY&*?}K*?^OI67ybcAmT81sf)~1C;zUu&c~C96MvbHg&?Y8{ zUGHaku0X7*ku!bivWR=7D>T{rL39}#3K zM6~)Ip!@!N-)3%*;@`i8wRpffKvVIn8t|`#cO8mt#IhP+oMb4#MgJF^8zOXFmY(Vm{3^j&6uESfOrSlr_fDj@Lc= zz@g1A{X%35-5)-73poOl$+|9~fY)_unZNyqjEIlNZ!81nr2mN_ zK1IM3vt}BxNA;VJT3k+z%yLE*njah1=ePG%#1zDSW7rVefK8nTx(_JF*ws=Upq5u! zYb7yj6)>`JX;$2|b8sOOo@wDz^}>afgB9>8z=ryknki!_??tx-M__^EZmkadC?2oT z4&HG#QsGPcn^&mVG8vd_>nU5Ku5>4HrCSIc@V*0y{1uup&{6i)$XBU z-wjhanJKDw8~yGQZ^Qt-BgggsGSfS|@f*p&HJz1S6m&%V;F@5{SnR-NE?wc@#|oy# zJdru(5o(WEI7^#4wWNkKZQ4!gyN58dd-qID8;e$RvKG)zZ^R%^r4i@lU4M$c|HbL= zoSLfema5cD#&@w9o=8>>%7QohSps4u0a2E3gPq0S97yt$u`1; z+)NPky*6d7B*dfs8V9LIffXe{^>gp}IUx>^nVc89NWMrG6D+2)I@bZcL@9Npf~ebQ z^9<*pUb=FX+2FZgIi1|@g0vQN+KFB08)6H~D#yt2#q&WsBU*8Wd12x41Kh_4emWaB z8b}Y2PVGqWSF#x*m`J^|^ARCo3hQ~KDfo0<$CWohad+GdMFVHdB_AjtMINgze}au! z>_405{YYmglt;pk3ED1q>3T{11LRQpycM}Z1Z@r3fUWYoKJtla z@=etNm|hM?g63E7X+~WPeC9T0XxDux+5G-kr7>!h7s`1Aek2JWs)OhK4$gvIs^`aIz6rwWIV%^N^ZpD?k37R$V@>6M)g_KzG_u$n-e-7dRvy1Vr&{C7yNXfRfd9LH6Ct5^Q} zBClj0By1t_>Q8iEq%cn~g|ijcrrgp}gapWs>zCh(VBfepCfm4iB-&6W{$0H3Vymy# zmqDcp{b%1mLdSjclvmt-xmpKgc1!0Mbea+O&oKKUw=myBdKq6~kZias?#&_cch;ljSGq?iD!_ ze3PK8y;4b6ex;$r?Opk5_8REJPj5>xqq1eE?&3-tN}U?Rs*Ec-n4{_M7u> zCAiCpJ5w0YryF!RQ>2IywV_*0D2lnE;KRS)Th`Jc9rF=@J1RQY9Hfu_Qurh58YBZ3l zD_X*xVC4kkUP@$urt!bQ83{j&LSY&!Uh97HM&&0Pp|)NgZ=H2E=}3Pk0f4-JHs})W dYE(+<8uZ|3KdN-Cs#^Nq)78hN+Ua!K{{aaea$x`f literal 0 HcmV?d00001 diff --git a/windows/access-protection/hello-for-business/images/dc-chart5.png b/windows/access-protection/hello-for-business/images/dc-chart5.png new file mode 100644 index 0000000000000000000000000000000000000000..19d10509165061d015ec6a57172ce59689ae611a GIT binary patch literal 3784 zcmcInXH-+!_K#9j7(^68m7*hwKB~e{B_bF=Iv5dYqQd|p1nD(V5EzuEC@3INDawch zbRb9zMGY801StYZs6lE%LJLW5{t2%4KD_n+@ZN{F*ShDPbJpGE{B}9}raL)UNr)+k zfj}S$8*57!5J*TcciAh-AJ-&~s`FpF!dm%ejw0(FB?nq3o+iyPaCtw;o#Igs=5IYB`R>83CPG5O6#rL5=ust zzI2yeDB)xKr460lR>;U#U)^>0?@0&s*895%p5WIGq)T3jujRq_D0>oe3UE}PrZuAu z<@sHFjsG!S@y$x>s9sb~UB#Agt6@rm6ios* z&;8PC@g6!V(aqcOI-2Lkp|1kj-ZB$at9vn?&<^z@F=4tP{;=hI?@zs_*!Qnn_6GZG z_=k=6Ca|2}@mAkXV|I=+)&|}(pIkyUD9h6Ng+Fv-pq*~_*XmrxhCbGJXAk9z&bGrR zmo|DfW`bPP2*6C-%RB^nkAQVVnEB!on%l`cedn3Gle&WFuv}^WJ@LepCS2Uq0UDuF z%5WI!ST0THmYs`tSnqkX>Ch(!M-PgfAd-*@`pC_I(g0jBIjsKGpdQTSx{ z1_9QARsIfm}&ou<6!F(m1=T`Rc~t^H-BO>rat3@MM3i*=~gSp!&67WwKLnb9-ifq`ggpDs1r52we3tZ=4fY zqKwKijOJW8hSLzRof-H5yKj&S8F$OL@Kuv&G_7ua|GM-IT_k3=wJvQ@EZ&Wiz0vp` z5MdHFS9yriK-3>>E$mmGmuO*h#3*loxLY8lHEBjcUN8ZTK=lMc4Fc&T!~YdQLv1jC zOSttXpX!gk_Cqfsb@;s84C__JE?eY`xj2A~>euTQKDdm2_07DvA`(YN;zM%~ss=wpcRP{lVqADIu)7;@H- z?Zk$hIY}aCT)YS+M*@Yx_9`0Ff6s4WE1jDDf&ZRrfIOXN1T@%OA{x;==p2Ld9e+Pz zV~#^R!hNr8@^0q!YGcr~WZwBA+LJgdGhTOGZL#pA&y|5n7!41?5Y>XGz11WtruMUIlv@|))jXAUy*K4bG^x9MdJ$iY=hDGgZ`v0X3T?L58y7{K&2NfC10;-r8?8I5+4Rw?C34KR zoK2Lu8Q}%hTJ3!aL_4HVPwZZfLOt8w$FMCuV!o@TL2{p88|M?f+_f=<=@xg*H24W8 zE;iEQVc~RxV#*?;Fu0QXm<{ekQelaMi*}Y{uZQ0bqpQ8Iq7uQTJS#I)K#6mMI&X>T zP?dJ#%k8AO_!s0SnJF6KZMDn?#^bUGGvSob#WTKU{Qb3 zRtfFgn_OGO{_Mi)2)c3@_Nz#|>(-Qx)UJG@PNYE~l$W+*vBok$G57~IB0hb6O;Z{`H~ zTChsk#g+K1r1yO+w4bhf_U2r6Hm)gZ*s=#~3=FY07T#VVUuZr$&>a_NvQ82omQwN{qXq)?N+=M!<|MMM10-IJE9-zmjFvJ z_#lbWtP6Wf@1r1kh{eU#2CgkOSZWR^=}sreNv8@ji96D$Z(<^1QAmFv`)Rt5ye0n zpxZTn@3uiPa`CI2CwA{S;u)F8Qw~=>rlpd|GE1asEsdF32te(!ScR*N0uT5oRBoSP zr?js{-a(Ro!5_=(>d9RnKK2s2oq6? zlGQ&D)u1QB5LWdYhi;`x*cfVa{u&UVTgenU4U-2H$SCxJH#=P8LE$-g9gPMp|$%)Wvdh*=>~2bM(BsENj5H31) z&hg&=h8Ws|^%C9HnZSkSqi@&fmeG}1{w|MJWFOn>s@S`kT9q7t)n2;$t@RN?<;OE8 zdINDjGBj+4`o@`&i{Xs*V8X=Z!v+3C8u7+x9q0<{#Kg|i$2(`ytQ}#SXviHO?oA2H zORcg&(nrRC!y<{T1l-=gMJ(vZSvZe_2q9nRLv$=Tm*dfe{`5~jk~prnwOR0F?4e95 z15Y2xpb5=cODGBYfUCrxSJ;1>kN;{tc6yP2AD$T!I($bW7x3*XsU)Bi86zb4;)9?| zMLV4f55NcEZdH{zhq5QX)0P3H&Bo_UYHgHVCqGW&zdxG6$qR68jGgg`2I3i7X5cF4 zA8Fi4!!6&-Cb}Z|HCb>q{oXLo2117(t$tCKLg~-pg9hQp22$O<(-9bAPzrE&YjU3E z@H;dU)2M|n0fY$VgrnP1ya9=prS()Rd2Ubs<~y1;=>kr1zw4=^Y>l|Z0>4IrSI$2= z`_?T~n&%Gw?pPFvCh2x*HeM9i#dpw*L9PZr!Gc)G9*>Wgih`ue+sD8^;`aEtA8wUd zOCxwkpK)`@-^`t0jQ%D{j#~v95>JxyH~)m!`46Ypx!IQJ0FiaD0lCLq1lG@8z7ed- zx7ZO_#li*BuPd|0i0B~liBDI(V~9br?N%_UKIV-SV0}baC)eC{T+L6E@YAt-Tz#_!ytQcjWgAbf8f8_lu(bi7ZFz$!_S}?*=R#SaE@gN;27&dJCcXK z?EFN5UOhwui?HPWCgGiQc;@^wD Date: Mon, 9 Oct 2017 09:44:56 -0700 Subject: [PATCH 10/90] edited in advance of review --- windows/deployment/planning/TOC.md | 2 +- .../planning/windows-10-creators-update-deprecation.md | 4 ++-- .../planning/windows-10-fall-creators-deprecation.md | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/deployment/planning/TOC.md b/windows/deployment/planning/TOC.md index 539ad2854f..72286c9cd2 100644 --- a/windows/deployment/planning/TOC.md +++ b/windows/deployment/planning/TOC.md @@ -4,7 +4,7 @@ ## [Windows 10 compatibility](windows-10-compatibility.md) ## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) ## [Creators update (version 1703) - deprecated features](windows-10-creators-update-deprecation.md) -## [Fall Creators update (version 1703) - deprecated features](windows-10-fall-creators-deprecation.md) +## [Fall Creators update (version 1709) - deprecated features](windows-10-fall-creators-deprecation.md) ## [Windows To Go: feature overview](windows-to-go-overview.md) ### [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) diff --git a/windows/deployment/planning/windows-10-creators-update-deprecation.md b/windows/deployment/planning/windows-10-creators-update-deprecation.md index c9a255d4a7..97ffa2b763 100644 --- a/windows/deployment/planning/windows-10-creators-update-deprecation.md +++ b/windows/deployment/planning/windows-10-creators-update-deprecation.md @@ -6,13 +6,13 @@ ms.mktglfcycl: plan ms.localizationpriority: high ms.sitesec: library author: lizap -ms.date: 09/12/2017 +ms.date: 10/17/2017 --- # Features that are removed or deprecated in Windows 10 Creators Update > Applies to: Windows 10 -The following features and functionalities in the Windows 10 Creators Update edition (version 1703) have either been removed from the product in the current release (*Removed*) or are not in active development and are planned for potential removal in subsequent releases (*Deprecated*). +The following features and functionalities in the Windows 10 Creators Update edition (Windows 10, version 1703) have either been removed from the product in the current release (*Removed*) or are not in active development and are planned for potential removal in subsequent releases (*Deprecated*). This list is intended for IT professionals who are updating operating systems in a commercial environment. The plan and list are subject to change and may not include every deprecated feature or functionality. For more details about a listed feature or functionality and its replacement, see the documentation for that feature. diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md index ad993aec80..a9e19b6f07 100644 --- a/windows/deployment/planning/windows-10-fall-creators-deprecation.md +++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md @@ -6,13 +6,13 @@ ms.mktglfcycl: plan ms.localizationpriority: high ms.sitesec: library author: lizap -ms.date: 09/12/2017 +ms.date: 10/17/2017 --- # Features that are removed or deprecated in Windows 10 Fall Creators Update > Applies to: Windows 10 -The following features and functionalities in the Windows 10 Fall Creators Update are either removed from the product in the current release (*Removed*) or are not in active development and might be removed in future releases (*Deprecated*). +The following features and functionalities in the Windows 10 Fall Creators Update (Windows 10, version 1709) are either removed from the product in the current release (*Removed*) or are not in active development and might be removed in future releases (*Deprecated*). This list is intended to help customers consider these removals and deprecations for their own planning. The list is subject to change and may not include every deprecated feature or functionality. From 6ad2788abaaa79bec5660c303c129800426a312e Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Mon, 9 Oct 2017 10:02:15 -0700 Subject: [PATCH 11/90] format fix, broken link fix --- .../planning/windows-10-fall-creators-deprecation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-deprecation.md b/windows/deployment/planning/windows-10-fall-creators-deprecation.md index a9e19b6f07..109a612947 100644 --- a/windows/deployment/planning/windows-10-fall-creators-deprecation.md +++ b/windows/deployment/planning/windows-10-fall-creators-deprecation.md @@ -28,14 +28,14 @@ For more information about a listed feature or functionality and its replacemen |**Microsoft Paint**
Will be available through the Windows Store. Functionality integrated into Paint 3D.| | X | |**Outlook Express**
Removing this non-functional legacy code.| X | | |**Reader app**
Functionality to be integrated into Microsoft Edge.| X | | -|**Reading List** Functionality to be integrated into Microsoft Edge.| X | | +|**Reading List**
Functionality to be integrated into Microsoft Edge.| X | | |**Resilient File System (ReFS)**
Creation ability will be available in the following editions only: Windows 10 Enterprise and Windows 10 Pro for Workstations. Creation ability will be removed from all other editions. All other editions will have Read and Write ability.
(added: August 17, 2017)| | X | |**RSA/AES Encryption for IIS**
We recommend that users use CNG encryption provider.| | X | |**Screen saver functionality in Themes**
To be disabled in Themes (classified as **Removed** in this table). Screen saver functionality in Group Policies, Control Panel, and Sysprep is now deprecated but continues to be functional. Lockscreen features and policies are preferred. | X | X | |**Sync your settings**
Back-end changes: In future releases, the back-end storage for the current sync process will change. A single cloud storage system will be used for Enterprise State Roaming and all other users. The "Sync your settings" options and the Enterprise State Roaming feature will continue to work.
(updated: August 17, 2017) | | X | |**Syskey.exe**
Removing this nonsecure security feature. We recommend that users use BitLocker instead. For more information, see the following Knowledge Base article: [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window)| X | | |**System Image Backup (SIB) Solution**
We recommend that users use full-disk backup solutions from other vendors.| | X | -|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/| X || +|**TCP Offload Engine**
Removing this legacy code. This functionality was previously transitioned to the Stack TCP Engine. For more information, see the following PFE Platform Blog article: [Why Are We Deprecating Network Performance Features?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193)| X || |**Tile Data Layer**
To be replaced by the Tile Store.| X || |**TLS RC4 Ciphers**
To be disabled by default. For more information, see the following Windows IT Center topic: [TLS (Schannel SSP) changes in Windows 10 and Windows Server 2016](/windows-server/security/tls/tls-schannel-ssp-changes-in-windows-10-and-windows-server)|| X| |**Trusted Platform Module (TPM) Owner Password Management**
This legacy code to be removed.|| X | From d8e059458f825855ea8e4010bbe55ac935b1469d Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Mon, 9 Oct 2017 10:08:23 -0700 Subject: [PATCH 12/90] changed dep section title wording --- .../planning/windows-10-fall-creators-removed-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md index 1bb81314cf..d64a3d5f44 100644 --- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md +++ b/windows/deployment/planning/windows-10-fall-creators-removed-features.md @@ -53,7 +53,7 @@ Removed this legacy code. The TCP Offload Engine fuctionality is now available i ### TPM Owner Password Management Removed this legacy code. -## Features being considered for replacement starting with Windows Fall Creators Update +## Features being considered for replacement starting after Windows Fall Creators Update We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and fuctionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** If you have feedback to share about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). From 19f87b79f72b19829be5a71a7e11ba47368b79d9 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Mon, 9 Oct 2017 11:05:56 -0700 Subject: [PATCH 13/90] edited version, language identical with server version --- ...ndows-10-fall-creators-removed-features.md | 22 ++++++++++--------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md index d64a3d5f44..a64cf613f5 100644 --- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md +++ b/windows/deployment/planning/windows-10-fall-creators-removed-features.md @@ -8,11 +8,11 @@ ms.sitesec: library author: lizap ms.date: 10/17/2017 --- -# Features removed or planned for replacement in Windows 10 Fall Creators Update (version 1709) +# Features removed or planned for replacement starting with Windows 10 Fall Creators Update (version 1709) > Applies to: Windows 10, version 1709 -Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Read on for details about the features and functionalities that we removed in Windows 10 Fall Creators Update (version 1709). This list also includes information about features and functionality that we're considering removing in a future release of Windows 10. This list is intended to make you aware of current and future changes and inform your planning. **The list is subject to change and may not include every affected feature or functionality.** +Each release of Windows 10 adds new features and functionality; we also occasionally remove features and functionality, usually because we've added a better option. Read on for details about the features and functionalities that we removed in Windows 10 Fall Creators Update (version 1709). This list also includes information about features and functionality that we're considering removing in a future release of Windows 10. This list is intended to make you aware of current and future changes and inform your planning. **The list is subject to change and might not include every affected feature or functionality.** ## Features removed from Windows 10 Fall Creators Update We've removed the following features and functionalities from the installed product image in Windows 10, version 1709. Applications, code, or usage that depend on these features won't function in this release unless you employ an alternate method. @@ -21,7 +21,7 @@ We've removed the following features and functionalities from the installed prod No longer installed by default, [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) is still available for download from the Microsoft Store. You can also consider using Print 3D and Paint 3D in its place. ### APN database (Apndatabase.xml) -Replaced by the COSA database. For more information, see the following Hardware Dev Center articles: +Replaced by the Country and Operator Settings Asset (COSA) database. For more information, see the following Hardware Dev Center articles: - [Planning your COSA/APN database submission](/windows-hardware/drivers/mobilebroadband/planning-your-apn-database-submission) - [COSA – FAQ](/windows-hardware/drivers/mobilebroadband/cosa---faq) @@ -29,13 +29,13 @@ Replaced by the COSA database. For more information, see the following Hardware Removed from the image, and you're blocked from using it. Consider using the [Exploit Protection feature of Windows Defender Exploit Guard](/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) as a replacement. See the [Announcing Windows 10 Insider Preview Build 16232 for PC + Build 15228 for Mobile](https://blogs.windows.com/windowsexperience/2017/06/28/announcing-windows-10-insider-preview-build-16232-pc-build-15228-mobile/) for details. ### Outlook Express -Removed this non-functional legacy code. +Removed this non-functional code. ### Reader app Integrated the Reader functionality into Microsoft Edge. ### Reading list -Integrated the Reading functionality into Microsoft Edge. +Integrated the Reading list functionality into Microsoft Edge. ### Resilient File System (ReFS) We changed the way that ReFS works, based on the edition of Windows 10 you have. We didn't **remove** ReFS, but how you can use ReFS depends on your edition. @@ -45,13 +45,13 @@ If you have Windows 10 Enterprise or Windows 10 Pro for Workstations: You can cr If you have any other edition of Windows 10: You can read and write volumes, but you can't create volumes. If you need to create volumes, upgrade to the Enterprise or Pro for Workstations edition. ### Syskey.exe -Removed this nonsecure security feature. Intead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). +Removed this security feature. Intead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). ### TCP Offload Engine -Removed this legacy code. The TCP Offload Engine fuctionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) +Removed this code. The TCP Offload Engine fuctionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) ### TPM Owner Password Management -Removed this legacy code. +Removed this code. ## Features being considered for replacement starting after Windows Fall Creators Update We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and fuctionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** @@ -66,10 +66,12 @@ We're considering replacing the following specific DISM features: - IIS 6 Scripting Tools (Web-Lgcy-Scripting) - IIS 6 WMI Compatibility (Web-WMI) -Instead, you should start migrating to IIS 7.0, which offers superior console and scripting tools. See [Installing IIS 7.0](https://docs.microsoft.com/en-us/iis/install/installing-iis-7/installing-iis-from-the-command-line) for details about installing and using IIS 7.0. +Instead of IIS 6 Metabase Compatibility (which acts as an emulation layer between IIS 6-based metabase scripts and the file-based configuration used by IIS 7 or newer versions) you should start migrating management scripts to target IIS file-based configuration directly, by using tools such as the Microsoft.Web.Administration namespace. + +You should also start migration from IIS 6.0 or earlier versions, and move to the [latest version of IIS](/iis/get-started/whats-new-in-iis-10/new-features-introduced-in-iis-10). ### IIS Digest Authentication -We're considering removing the IIS Digest Authentication method because it has security issues. Instead, you should start using other authentication methods, such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). +We're considering removing the IIS Digest Authentication method. Instead, you should start using other authentication methods, such as [Client Certificate Mapping](/iis/manage/configuring-security/configuring-one-to-one-client-certificate-mappings) or [Windows Authentication](/iis/configuration/system.webServer/security/authentication/windowsAuthentication/). ### Microsoft Paint We're considering removing MS Paint from the basic installed product image - that means it won't be installed by default. **You'll still be able to get the app separately from the [Microsoft Store](https://www.microsoft.com/store/b/home) for free.** Alternately, you can get [Paint 3D](https://www.microsoft.com/store/p/paint-3d/9nblggh5fv99) and [3D Builder](https://www.microsoft.com/store/p/3d-builder/9wzdncrfj3t6) from the Microsoft Store today; both of these offer the same functionality as Microsoft Paint, plus additional features. From 857224fd9b67da1eb89715da940e7a6c278e0d88 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Mon, 9 Oct 2017 11:28:33 -0700 Subject: [PATCH 14/90] final typo fixes --- .../planning/windows-10-fall-creators-removed-features.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/planning/windows-10-fall-creators-removed-features.md b/windows/deployment/planning/windows-10-fall-creators-removed-features.md index a64cf613f5..24c6a90c98 100644 --- a/windows/deployment/planning/windows-10-fall-creators-removed-features.md +++ b/windows/deployment/planning/windows-10-fall-creators-removed-features.md @@ -45,16 +45,16 @@ If you have Windows 10 Enterprise or Windows 10 Pro for Workstations: You can cr If you have any other edition of Windows 10: You can read and write volumes, but you can't create volumes. If you need to create volumes, upgrade to the Enterprise or Pro for Workstations edition. ### Syskey.exe -Removed this security feature. Intead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). +Removed this security feature. Instead, we recommend using [BitLocker](/device-security/bitlocker/bitlocker-overview). For more information, see [4025993 Syskey.exe utility is no longer supported in Windows 10 RS3 and Windows Server 2016 RS3](https://support.microsoft.com/help/4025993/syskey-exe-utility-is-no-longer-supported-in-windows-10-rs3-and-window). ### TCP Offload Engine -Removed this code. The TCP Offload Engine fuctionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) +Removed this code. The TCP Offload Engine functionality is now available in the Stack TCP Engine. For more information, see [Why Are We Deprecating Network Performance Features (KB4014193)?](https://blogs.technet.microsoft.com/askpfeplat/2017/06/13/why-are-we-deprecating-network-performance-features-kb4014193/) ### TPM Owner Password Management Removed this code. ## Features being considered for replacement starting after Windows Fall Creators Update -We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and fuctionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** +We are considering removing the following features and functionalities from the installed product image, starting with releases after Windows 10, version 1709. Eventually, we might completely remove them and replace them with other features or functionality (or, in some instances, make them available from different sources). These features and functionalities are *still available* in this release, but **you should begin planning now to either use alternate methods or to replace any applications, code, or usage that depend on these features.** If you have feedback to share about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). From 224e4060c127e4f8a7f66d63b63ccf0263abc149 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 9 Oct 2017 15:11:41 -0700 Subject: [PATCH 15/90] revised configurable CI policies --- ...n-based-security-and-code-integrity-policies.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md index e5593fe7b8..e599163d32 100644 --- a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md +++ b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -14,9 +14,11 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. You designate these trusted apps by creating *code integrity policies*. +With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. -Like the operating system, code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been available in previous versions of the Windows operating system, and protects the kernel mode from running unsigned drivers. In Windows 10 and Windows Server 2016, UMCI is also available, to help protect against viruses and malware. +Beginning with Windows 10, verwsion 1709, you designate these trusted apps by using Windows Defender Application Control (Windows Defender AC). On previous versions of Windows 10, this is done by creating code integrity policies. + +Like the operating system, code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI protects the kernel mode from running unsigned drivers. Beginning with Windows 10 and Windows Server 2016, UMCI is also available to help protect against viruses and malware. To increase the security level offered by code integrity policies, Windows Defender Device Guard can leverage advanced hardware features on hardware that supports them. These features include CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT). In addition, hardware that includes input/output memory management units (IOMMUs) provides even stronger protections. When you enable the features associated with CPU virtualization extensions and SLAT, the Code Integrity service can run alongside the kernel in a Windows hypervisor-protected container. The following table provides more information about how Windows Defender Device Guard and these hardware features can help protect against various threats. @@ -28,11 +30,11 @@ The following table lists security threats and describes the corresponding Windo | Security threat in the enterprise | How a Windows Defender Device Guard feature helps protect against the threat | | --------------------------------- | ----------------------------------------------------------- | -| **Exposure to new malware**, for which the "signature" is not yet known | **Code integrity policies**:  You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than trying to stay ahead of attackers by maintaining a constantly-updated list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.
Only code that is verified by Code Integrity, usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.

**Specialized hardware required?** No security-related hardware features are required, although code integrity policies are strengthened by such features, as described in the last three rows of this table. | -| **Exposure to unsigned code** (most malware is unsigned) | **Code integrity policies, plus catalog files as needed**:  Because most malware is unsigned, using a code integrity policy (which in most cases requires signed code) can immediately help protect against a large number of threats. However, many organizations use unsigned line-of-business (LOB) applications, for which the process of signing might be difficult. This has changed in Windows 10, because you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by code integrity policies in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.

**Specialized hardware required?** No security-related hardware features are required for creating and using code integrity policies and catalogs. However, code integrity policies and catalogs are strengthened by the hardware features, as described in later rows of this table. | -| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**:  This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy.
With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code. The hypervisor, the most privileged level of system software, enforces R/W/X permissions across system memory. Code integrity checks are performed in a secure environment which is resistant to attack from kernel mode software, and page permissions for kernel mode are set and maintained by the hypervisor. Even if there are vulnerabilities that allow memory modification, like a buffer overflow, the modified memory cannot be executed.

**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). | +| **Exposure to new malware**, for which the "signature" is not yet known | **Windows Defender Application Control**:  You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than constantly update a list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.
Only code that is verified by Windows Defender Application Control (AC), usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.

**Specialized hardware required?** No security-related hardware features are required, but Windows Defender AC is strengthened by such features, as described in the next rows. | +| **Exposure to unsigned code** (most malware is unsigned) | **Windows Defender AC plus catalog files as needed**:  Because most malware is unsigned, Windows Defender AC (which in most cases requires signed code) can immediately help protect against a large number of threats. For organizations that use unsigned line-of-business (LOB) applications, you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by Windows Defender AC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.

**Specialized hardware required?** No, but Windows Defender AC and catalogs are strengthened by the hardware features, as described in the next rows. | +| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**:  This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy.
With VBS, even if malware gains access to the kernel, the effects can be severely limited because the hypervisor can prevent the malware from executing code. The hypervisor, the most privileged level of system software, enforces R/W/X permissions across system memory. Code integrity checks are performed in a secure environment which is resistant to attack from kernel mode software, and page permissions for kernel mode are set and maintained by the hypervisor. Even if there are vulnerabilities that allow memory modification, like a buffer overflow, the modified memory cannot be executed.

**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). | | **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**:  With this type of VBS protection, when the DMA-based attack makes a memory request, input/output memory management units (IOMMUs) will evaluate the request and deny access.

**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. | -| **Exposure to boot kits or to a physically present attacker at boot time** | **Universal Extensible Firmware Interface (UEFI) Secure Boot**:   Secure Boot and related methods protect the boot process and firmware from tampering. This tampering can come from a physically present attacker or from forms of malware that run early in the boot process or in kernel after startup. UEFI is locked down (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA), so the settings in UEFI cannot be changed to compromise Windows Defender Device Guard security.

**Specialized hardware required?** With UEFI Secure Boot, the requirements are firmware requirements. For more information, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). | +| **Exposure to boot kits or to a physically present attacker at boot time** | **Universal Extensible Firmware Interface (UEFI) Secure Boot**:   Secure Boot and related methods protect the boot process and firmware from tampering. This tampering can come from a physically present attacker or from forms of malware that run early in the boot process or in the kernel after startup. UEFI is locked down (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA), so the settings in UEFI cannot be changed to compromise Windows Defender Device Guard security.

**Specialized hardware required?** UEFI Secure Boot has firmware requirements. For more information, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). | In this guide, you learn about the individual features found within Windows Defender Device Guard as well as how to plan for, configure, and deploy them. Windows Defender Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as [Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard) and [AppLocker](/windows/device-security/applocker/applocker-overview). From ba8a0e48205c7f59380f2e6d5db1de28f3f798af Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 10 Oct 2017 10:25:35 -0700 Subject: [PATCH 16/90] Preparing for on-prem Key trust --- .../hello-deployment-key-trust.md | 40 ++ .../hello-key-trust-adfs.md | 341 +++++++++++ .../hello-key-trust-deploy-mfa.md | 543 ++++++++++++++++++ .../hello-key-trust-policy-settings.md | 155 +++++ .../hello-key-trust-validate-ad-prereq.md | 46 ++ .../hello-key-trust-validate-deploy-mfa.md | 49 ++ .../hello-key-trust-validate-pki.md | 197 +++++++ 7 files changed, 1371 insertions(+) create mode 100644 windows/access-protection/hello-for-business/hello-deployment-key-trust.md create mode 100644 windows/access-protection/hello-for-business/hello-key-trust-adfs.md create mode 100644 windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md create mode 100644 windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md create mode 100644 windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md create mode 100644 windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md create mode 100644 windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md diff --git a/windows/access-protection/hello-for-business/hello-deployment-key-trust.md b/windows/access-protection/hello-for-business/hello-deployment-key-trust.md new file mode 100644 index 0000000000..2d64b3973b --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-deployment-key-trust.md @@ -0,0 +1,40 @@ +--- +title: Windows Hello for Business Deployment Guide - On Premises Certificate Key Deployment +description: A guide to an On Premises, Certificate trust Windows Hello for Business deployment +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/08/2017 +--- +# On Premises Certificate Trust Deployment + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. + +Below, you can find all the infromation you will need to deploy Windows Hello for Business in a Certificate Key Model in your on-premises environment: +1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) +2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) + + + + + + + + + + + + diff --git a/windows/access-protection/hello-for-business/hello-key-trust-adfs.md b/windows/access-protection/hello-for-business/hello-key-trust-adfs.md new file mode 100644 index 0000000000..986dbacd66 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-key-trust-adfs.md @@ -0,0 +1,341 @@ +--- +title: Prepare and Deploy Windows Server 2016 Active Directory Federation Services (Windows Hello for Business) +description: How toPrepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/08/2017 +--- +# Prepare and Deploy Windows Server 2016 Active Directory Federation Services + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +Windows Hello for Business works exclusively with the Active Directory Federation Service role included with Windows Server 2016 and requires an additional server update. The on-prem key trust deployment uses Active Directory Federation Services roles for key registration and device registration. + +The following guidance describes deploying a new instance of Active Directory Federation Services 2016 using the Windows Information Database as the configuration database, which is ideal for environments with no more than 30 federation servers and no more than 100 relying party trusts. + +If your environment exceeds either of these factors or needs to provide SAML artifact resolution, token replay detection, or needs Active Directory Federation Services to operate in a federated provider role, then your deployment needs to use a SQL for your configuration database. To deploy the Active Directory Federation Services using SQL as its configuration database, please review the [Deploying a Federation Server Farm](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) checklist. + +If your environment has an existing instance of Active Directory Federation Services, then you’ll need to upgrade all nodes in the farm to Windows Server 2016 along with the Windows Server 2016 update. If your environment uses Windows Internal Database (WID) for the configuration database, please read [Upgrading to AD FS in Windows Server 2016 using a WID database](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) to upgrade your environment. If your environment uses SQL for the configuration database, please read [Upgrading to AD FS in Windows Server 2016 with SQL Server](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016-sql) to upgrade your environment. + +Ensure you apply the Windows Server 2016 Update to all nodes in the farm after you have successfully completed the upgrade. + +A new Active Directory Federation Services farm should have a minimum of two federation servers for proper load balancing, which can be accomplished with an external networking peripherals, or with using the Network Load Balancing Role included in Windows Server. + +Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. + +## Update Windows Server 2016 + +Sign-in the federation server with _local admin_ equivalent credentials. +1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. +2. Ensure the latest server updates to the federation server includes [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658). + +>[!IMPORTANT] +>The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers. + +## Enroll for a TLS Server Authentication Certificate + +Key trust Windows Hello for Business on-premises deployments need a federation server for device registration and key registration. Typically, a federation service is an edge facing role. However, the federation services and instance used with the on-premises deployment of Windows Hello for Business does not need Internet connectivity. + +The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm: +* Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) +* Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) + +You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com. + +You can, however, issue one certificate for all hosts in the farm. If you chose this option, then leave the subject name blank, and include all the names in the subject alternate name when creating the certificate request. All names should include the FQDN of each host in the farm and the federation service name. + +When creating a wildcard certificate, it is recommended that you mark the private key as exportable so that the same certificate can be deployed across each federation server and web application proxy within your AD FS farm. Note that the certificate must be trusted (chain to a trusted root CA). Once you have successfully requested and enrolled the server authentication certificate on one node, you can export the certificate and private key to a PFX file using the Certificate Manager console. You can then import the certificate on the remaining nodes in the AD FS farm. + +Be sure to enroll or import the certificate into the AD FS server’s computer certificate store. Also, ensure all nodes in the farm have the proper TLS server authentication certificate. + +### Internal Server Authentication Certificate Enrollment + +Sign-in the federation server with domain admin equivalent credentials. +1. Start the Local Computer **Certificate Manager** (certlm.msc). +2. Expand the **Personal** node in the navigation pane. +3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. +4. Click **Next** on the **Before You Begin** page. +5. Click **Next** on the **Select Certificate Enrollment Policy** page. +6. On the **Request Certificates** page, Select the **Internal Web Server** check box. +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. +9. Click **Enroll**. + +A server authentication certificate should appear in the computer’s Personal certificate store. + +## Deploy the Active Directory Federation Service Role + +The Active Directory Federation Service (AD FS) role provides the following services to support Windows Hello for Business on-premises deployments. +* Device registration +* Key registration + +>[!IMPORTANT] +> Finish the entire AD FS configuration on the first server in the farm before adding the second server to the AD FS farm. Once complete, the second server receives the configuration through the shared configuration database when it is added the AD FS farm. + +Windows Hello for Business depends on proper device registration. For on-premises key trust deployments, Windows Server 2016 AD FS handles device and key registration. + +Sign-in the federation server with _Enterprise Admin_ equivalent credentials. +1. Start **Server Manager**. Click **Local Server** in the navigation pane. +2. Click **Manage** and then click **Add Roles and Features**. +3. Click **Next** on the **Before you begin** page. +4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. +5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. +6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. +7. Click **Next** on the **Select features** page. +8. Click **Next** on the **Active Directory Federation Service** page. +9. Click **Install** to start the role installation. + +## Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm the AD FS farm uses the correct database configuration. +* Confirm the AD FS farm has an adequate number of nodes and is properly load balanced for the anticipated load. +* Confirm **all** AD FS servers in the farm have the latest updates. +* Confirm all AD FS servers have a valid server authentication certificate + * The subject of the certificate is the common name (FQDN) of the host or a wildcard name. + * The alternate name of the certificate contains a wildcard or the FQDN of the federation service + +## Device Registration Service Account Prerequisite + +The service account used for the device registration server depends on the domain controllers in the environment. + +>[!NOTE] +>Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. + +### Windows Server 2012 or later Domain Controllers + +Windows Server 2012 or later domain controllers support Group Managed Service Accounts—the preferred way to deploy service accounts for services that support them. Group Managed Service Accounts, or GMSA have security advantages over normal user accounts because Windows handles password management. This means the password is long, complex, and changes periodically. The best part of GMSA is all this happens automatically. AD FS supports GMSA and should be configured using them for additional defense in depth security. + +GSMA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GSMA. Before you can create a GSMA, you must first create a root key for the service. You can skip this if your environment already uses GSMA. + +#### Create KDS Root Key + +Sign-in a domain controller with _Enterprise Admin_ equivalent credentials. +1. Start an elevated Windows PowerShell console. +2. Type `Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)` + +### Windows Server 2008 or 2008 R2 Domain Controllers + +Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key Distribution Service, nor do they support Group Managed Service Accounts. Therefore, you must use create a normal user account as a service account where you are responsible for changing the password on a regular basis. + +#### Create an AD FS Service Account + +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. +1. Open **Active Directory Users and Computers**. +2. Right-click the **Users** container, Click **New**. Click **User**. +3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. +4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** checkbox. +5. Click **Next** and then click **Finish**. + +## Configure the Active Directory Federation Service Role + +>[!IMPORTANT] +>Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. + +### Windows Server 2016, 2012 R2 or later Domain Controllers + +Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008R2-domain-controllers) section. + +Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. +1. Start **Server Manager**. +2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. + ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) + +3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. +4. Click **Next** on the **Connect to Active Directory Domain Services** page. +5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as *fs.corp.contoso.com* or *fs.contoso.com*. +6. Select the federation service name from the **Federation Service Name** list. +7. Type the Federation Service Display Name in the text box. This is the name users see when signing in. Click **Next**. +8. On the **Specify Service Account** page, select **Create a Group Managed Service Account**. In the **Account Name** box, type **adfssvc**. +9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. +10. On the **Review Options** page, click **Next**. +11. On the **Pre-requisite Checks** page, click **Configure**. +12. When the process completes, click **Close**. + +### Windows Server 2008 or 2008 R2 Domain Controllers + +Use the following procedures to configure AD FS when your environment uses **Windows Server 2008 or 2008 R2 Domain Controllers**. If you are not using Windows Server 2008 or 2008 R2 Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2012 or later Domain Controllers)](#windows-server-2012-or-later-domain-controllers) section. + +Sign-in the federation server with _Domain Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. +1. Start **Server Manager**. +2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. + ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) + +3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. +4. Click **Next** on the **Connect to Active Directory Domain Services** page. +5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as fs.corp.mstepdemo.net or fs.mstepdemo.net. +6. Select the federation service name from the **Federation Service Name** list. +7. Type the Federation Service Display Name in the text box. This is the name users see when signing in. Click **Next**. +8. On the **Specify Service Account** page, Select **Use an existing domain user account or group Managed Service Account** and click **Select**. + * In the **Select User or Service Account** dialog box, type the name of the previously created AD FS service account (example adfssvc) and click **OK**. Type the password for the AD FS service account and click **Next**. +9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. +10. On the **Review Options** page, click **Next**. +11. On the **Pre-requisite Checks** page, click **Configure**. +12. When the process completes, click **Close**. +13. Do not restart the AD FS server. You will do this later. + + +### Add the AD FS Service account to the KeyAdmins group + +The KeyAdmins global group provides the AD FS service with the permissions needed to perform key registration. + +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. +1. Open **Active Directory Users and Computers**. +2. Click the **Users** container in the navigation pane. +3. Right-click **KeyAdmins** in the details pane and click **Properties**. +4. Click the **Members** tab and click **Add…** +5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. +6. Click **OK** to return to **Active Directory Users and Computers**. +7. Click **OK** to return to **Active Directory Users and Computers**. +8. Change to server hosting the AD FS role and restart it. + + +## Configure the Device Registration Service + +Sign-in the federation server with _Enterprise Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. +1. Open the **AD FS management** console. +2. In the navigation pane, expand **Service**. Click **Device Registration**. +3. In the details pane, click **Configure Device Registration**. +4. In the **Configure Device Registration** dialog, click **OK**. + +## Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm you followed the correct procedures based on the domain controllers used in your deployment + * Windows Server 2016, 2012 R2 or Windows Server 2012 R2 + * Windows Server 2008 or Windows Server 2008 R2 +* Confirm you have the correct service account based on your domain controller version. +* Confirm you properly installed the AD FS role on your Windows Server 2016 based on the proper sizing of your federation, the number of relying parties, and database needs. +* Confirm you used a certificate with the correct names as the server authentication certificate + * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: + * Certificate serial number + * Certificate thumbprint + * Common name of the certificate + * Subject alternate name of the certificate + * Name of the physical host server + * The issued date + * The expiration date + * Issuing CA Vendor (if a third-party certificate) +* Confirm you added the AD FS service account to the KeyAdmins group. +* Confirm you enabled the Device Registration service. + + +## Additional Federation Servers + +Organizations should deploy more than one federation server in their federation farm for high-availability. You should have a minimum of two federation services in your AD FS farm, however most organizations are likely to have more. This largely depends on the number of devices and users using the services provided by the AD FS farm. + +### Server Authentication Certificate + +Each server you add to the AD FS farm must have a proper server authentication certificate. Refer to the [Enroll for a TLS Server Authentication Certificate](#enroll-for-a-tls-server-authentication-certificate) section of this document to determine the requirements for your server authentication certificate. As previously stated, AD FS servers used exclusively for on-premises deployments of Windows Hello for Business can use enterprise server authentication certificates rather than server authentication certificates issued by public certificate authorities. + +### Install Additional Servers + +Adding federation servers to the existing AD FS farm begins with ensuring the server are fully patched, to include Windows Server 2016 Update needed to support Windows Hello for Business deployments (https://aka.ms/whfbadfs1703). Next, install the Active Directory Federation Service role on the additional servers and then configure the server as an additional server in an existing farm. + +## Load Balance AD FS Federation Servers + +Many environments load balance using hardware devices. Environments without hardware load-balancing capabilities can take advantage the network load-balancing feature included in Windows Server to load balance the AD FS servers in the federation farm. Install the Windows Network Load Balancing feature on all nodes participating in the AD FS farm that should be load balanced. + +### Install Network Load Balancing Feature on AD FS Servers + +Sign-in the federation server with _Enterprise Admin_ equivalent credentials. +1. Start **Server Manager**. Click **Local Server** in the navigation pane. +2. Click **Manage** and then click **Add Roles and Features**. +3. Click **Next** On the **Before you begin** page. +4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. +5. On the **Select destination server** page, chosoe **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. +6. On the **Select server roles** page, click **Next**. +7. Select **Network Load Balancing** on the **Select features** page. +8. Click **Install** to start the feature installation + ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) + +### Configure Network Load Balancing for AD FS + +Before you can load balance all the nodes in the AD FS farm, you must first create a new load balance cluster. Once you have created the cluster, then you can add new nodes to that cluster. + +Sign-in a node of the federation farm with _Admin_ equivalent credentials. +1. Open **Network Load Balancing Manager** from **Administrative Tools**. + ![NLB Manager user interface](images/hello-nlb-manager.png) +2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. +3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. + ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) +4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) +5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. +6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. + ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) +7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. + ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) +8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. +9. In Port Rules, click Edit to modify the default port rules to use port 443. + ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) + +### Additional AD FS Servers + +1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. +2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. + ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) + +## Configure DNS for Device Registration + +Sign-in the domain controller or administrative workstation with Domain Admin equivalent credentials. You’ll need the Federation service name to complete this task. You can view the federation service name by clicking **Edit Federation Service Properties** from the **Action** pan of the **AD FS** management console, or by using `(Get-AdfsProperties).Hostname.` (PowerShell) on the AD FS server. +1. Open the **DNS Management** console. +2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. +3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. +4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. +5. In the **name** box, type the name of the federation service. In the **IP address** box, type the IP address of your federation server. Click **Add Host**. +6. Close the DNS Management console + +## Configure the Intranet Zone to include the federation service + +The Windows Hello provisioning presents web pages from the federation service. Configuring the intranet zone to include the federation service enables the user to authenticate to the federation service using integrated authentication. Without this setting, the connection to the federation service during Windows Hello provisioning prompts the user for authentication. + +### Create an Intranet Zone Group Policy + +Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type **Intranet Zone Settings** in the name box and click **OK**. +5. In the content pane, right-click the **Intranet Zone Settings** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Administrative Templates > Windows Component > Internet Explorer > Internet Control Panel**, and select **Security Page**. +8. In the content pane, double-click **Site to Zone Assignment List**. Click **Enable**. +9. Click **Show**. In the **Value Name** column, type the url of the federation service beginning with https. In the **Value** column, type the number **1**. Click OK twice, then close the Group Policy Management Editor. + +### Deploy the Intranet Zone Group Policy object + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. + +## Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm all AD FS servers have a valid server authentication certificate + * The subject of the certificate is the common name (FQDN) of the host or a wildcard name. + * The alternate name of the certificate contains a wildcard or the FQDN of the federation service +* Confirm the AD FS farm has an adequate number of nodes and is properly load balanced for the anticipated load. +* Confirm **all** AD FS servers in the farm have the latest updates. +* Confirm you restarted the AD FS service. +* Confirm you created a DNS A Record for the federation service and the IP address used is the load-balanced IP address +* Confirm you created and deployed the Intranet Zone settings to prevent double authentication to the federation server. + + +## Follow the Windows Hello for Business on premises certificate trust deployment guide +1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) +2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) +3. Prepare and Deploy Windows Server 2016 Active Directory Federation Services (*You are here*) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) + + diff --git a/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md new file mode 100644 index 0000000000..2c31ffcc05 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md @@ -0,0 +1,543 @@ +--- +title: Configure or Deploy Multifactor Authentication Services (Windows Hello for Business) +description: How to Configure or Deploy Multifactor Authentication Services for Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/08/2017 +--- +# Configure or Deploy Multifactor Authentication Services + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +On-premises deployments must use the On-premises Azure MFA Server using the AD FS adapter model Optionally, you can use a third-party MFA server that provides an AD FS Multifactor authentication adapter. + +>[!TIP] +>Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. + +## Prerequisites + +The Azure MFA Server and User Portal servers have several perquisites and must have connectivity to the Internet. + +### Primary MFA Server + +The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writeable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. + +For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. + +The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. + +#### Enroll for Server Authentication + +The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. + +Sign-in the primary MFA server with _domain admin_ equivalent credentials. +1. Start the Local Computer **Certificate Manager** (certlm.msc). +2. Expand the **Personal** node in the navigation pane. +3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. +4. Click **Next** on the **Before You Begin** page. +5. Click **Next** on the **Select Certificate Enrollment Policy** page. +6. On the **Request Certificates** page, Select the **Internal Web Server** check box. +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. +9. Click **Enroll**. + +A server authentication certificate should appear in the computer’s Personal certificate store. + +#### Install the Web Server Role + +The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile App server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. + +To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. + +The following services are required: +* Common Parameters > Default Document. +* Common Parameters > Directory Browsing. +* Common Parameters > HTTP Errors. +* Common Parameters > Static Content. +* Health and Diagnostics > HTTP Logging. +* Performance > Static Content Compression. +* Security > Request Filtering. +* Security > Basic Authentication. +* Management Tools > IIS Management Console. +* Management Tools > IIS 6 Management Compatibility. +* Application Development > ASP.NET 4.5. + +#### Update the Server + +Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. + +#### Configure the IIS Server’s Certificate + +The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. + +Sign in the primary MFA server with _administrator_ equivalent credentials. +1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console +2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. +3. In the **Actions** pane, click **Bindings**. +4. In the **Site Bindings** dialog, Click **Add**. +5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. +6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. + +#### Configure the Web Service’s Security + +The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the Phonefactor Admins security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile App servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the Phonefactor Admins security group. + +Sign in the domain controller with _domain administrator_ equivalent credentials. + +##### Create Phonefactor Admin group + +1. Open **Active Directory Users and Computers** +2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. +3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. +4. Click **OK**. + +##### Add accounts to the Phonefactor Admins group + +1. Open **Active Directory Users and Computers**. +2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactors Admin** security group and select **Properties**. +3. Click the **Members** tab. +4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. + * The computer account for the primary MFA Server + * Group or user account that will manage the User Portal server. + + +#### Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: + +* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. + * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: + * Certificate serial number + * Certificate thumbprint + * Common name of the certificate + * Subject alternate name of the certificate + * Name of the physical host server + * The issued date + * The expiration date + * Issuing CA Vendor (if a third-party certificate) + +* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). +* Confirm the host has all the available updates from Windows Update. +* Confirm you bound the server authentication certificate to the IIS web site. +* Confirm you created the Phonefactor Admins group. +* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. + +### User Portal Server + +The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. + +The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. + +#### Enroll for Server Authentication + +Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. + +For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. + +Sign-in the User Portal server with _domain admin_ equivalent credentials. +1. Start the Local Computer **Certificate Manager** (certlm.msc). +2. Expand the **Personal** node in the navigation pane. +3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. +4. Click **Next** on the **Before You Begin** page. +5. Click **Next** on the **Select Certificate Enrollment Policy** page. +6. On the **Request Certificates** page, Select the **Internal Web Server** check box. +7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. +8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). +9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). +10. Click **Add**. Click **OK** when finished. +11. Click **Enroll**. + +A server authentication certificate should appear in the computer’s Personal certificate store. + +#### Install the Web Server Role + +To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not requiret this. + +#### Update the Server + +Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. + +#### Configure the IIS Server’s Certificate + +To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-server’s-certificate) section. + +#### Create WebServices SDK user account + +The User Portal and Mobile App web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. + +1. Open **Active Directory Users and Computers**. +2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. +3. In the **New Object – User** dialog box, type **PFWSDK_** in the **First name** and **User logon name** boxes, where ** is the name of the primary MFA server running the Web Services SDK. Click **Next**. +4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. + +#### Add the MFA SDK user account to the Phonefactor Admins group + +Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. + +1. Open **Active Directory Users and Computers**. +2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactors Admin** security group and select Properties. +3. Click the Members tab. +4. Click **Add**. Click **Object Types..** Type the PFWSDK_ user name in the **Enter the object names to select** box and then click **OK**. + * The computer account for the primary MFA Server + * The Webservices SDK user account + * Group or user account that will manage the User Portal server. + + +#### Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: + +* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. +* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. + * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: + * Certificate serial number + * Certificate thumbprint + * Common name of the certificate + * Subject alternate name of the certificate + * Name of the physical host server + * The issued date + * The expiration date + * Issuing CA Vendor (if a third-party certificate) + +* Confirm the Web Server Role was properly configured on all servers. +* Confirm all the hosts have the latest updates from Windows Update. +* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. + +## Installing Primary Azure MFA Server + +When you install Azure Multi-Factor Authentication Server, you have the following options: +1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS +2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) + +See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. + +Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. + +>[!IMPORTANT] +>Only follow the above mention article to install Azure MFA Server. Once it is intstalled, continue configuration using this article. + +### Configuring Company Settings + +You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. + +Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. +1. Start the **Multi-Factor Server** application +2. Click **Company Settings**. +3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. +4. In **User defaults**, select **Phone Call** or **Text Message** + **Note:** You can use mobile app; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile app multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. +5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. +6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. +7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. +8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. +9. Under default PIN rules, Select the User can change PIN checkbox to enable users to change their PIN during multi-factor authentication and through the user portal. +10. Configure the minimum length for the PIN. +11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. +12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. +13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. + +![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) + +### Configuring Email Settings and Content + +If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. + +Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. + +With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. + +The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile app). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. + +If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile app for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. + +#### Settings + +By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. + +#### Content + +On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. + +##### Edit the Content Settings + +The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. + +Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. +1. Open the **Multi-Factor Authentication Server** console. +2. Click **Email** from the list of icons and click the **Email Content** tab. +3. Select an email template from the list of templates. Click **Edit**. +4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. + ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) + +5. Optionally, customize other options in the email template. +6. When finished editing the template, Click **Apply**. +7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. +8. Click **Close** when you are done editing the email templates. + +### Configuring Directory Integration Settings and Synchronization + +Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. + +It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). + +#### MultiFactorAuthAdSync Service + +The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. + +The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. + +#### Settings + +Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. + +Sign in the primary MFA server with _MFA administrator_ equivalent credentials. +1. Open the **Multi-Factor Authentication Server** console. +2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. +3. Click the **Synchronization** tab. +4. Select **Use Active Directory**. +5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the checkbox to improve performance. + +#### Synchronization + +The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. + +You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. + +See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. + +##### To add a synchronization item + +Sign in the primary MFA server with _MFA administrator_ equivalent credentials. +1. Open the **Multi-Factor Authentication Server** console. +2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. +3. Select the **Synchronization** tab. +4. On the **Synchronization** tab, click **Add**. + ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) + +5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. +6. Select the group you are using for replication from the list of groups +7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. +8. Select **Add new users and Update existing users**. +9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. +10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. +11. Select **Enabled** and select **Only New Users with Phone Number** from the list. +12. Select **Send email** and select **New and Updated Users**. + +##### Configure synchronization item defaults + +1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. +2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). + +##### Configure synchronization language defaults + +1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. +2. Select the appropriate default language for these groups of users synchronized by these synchronization item. +3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. + +>[!TIP] +>For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). + +### Installing the MFA Web Services SDK + +The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. + +Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. + +Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to intall the MFA Web Services SDK. + +## Install Secondary MFA Servers + +Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. + +Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. + +Sign in the secondary MFA server with _domain administrator_ equivalent credentials. +1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. + **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. +2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. +3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. +4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. +5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. + +### Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. +* Confirm the server has Internet connectivity. +* Confirm you installed and activated the Azure MFA Server. +* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). +* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. + * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. + +* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. +* Confirm you installed the Web Service SDK on the primary MFA server. +* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. + + +## Installing the User Portal Server + +You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. + +### Copying the User Portal Installation file + +Sign in the primary MFA server with _local administrator_ equivalent credentials. +1. Open Windows Explorer. +2. Browse to the C:\Progam Files\MultiFactor Authentication Server folder. +3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. + +### Configure Virtual Directory name + +Sign in the User Portal server with _local administrator_ equivalent credentials. +1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. +2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. +3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. +4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. +5. Click **Close**. + +### Edit MFA User Portal config file + +Sign in the User Portal server with _local administrator_ equivalent credentials. +1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. +2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. +3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. +4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. +5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“http://localhost:4898/PfWsSdk.asmx”** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. https://computer1.domain.local/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. + +### Create a DNS entry for the User Portal web site + +Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. +1. Open the **DNS Management** console. +2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. +3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. +4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. +5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. +6. Close the **DNS Management** console. + +### Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm the user portal application is properly installed on all user portal hosts +* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. +* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME +* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. +* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. +* Confirm you saved the changes to the web.config file. + +### Validating your work + +Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. + +Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. + +### Configuring the User Portal + +The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. +User Portal Administrators may be set up and granted permission to add new users and update existing users. + +#### Settings + +Sign in the primary MFA server with _MFA administrator_ equivalent credentials. +1. Open the Multi-Factor Authentication Server console. +2. From the Multi-Factor Authentication Server window, click the User Portal icon. + ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) + +3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. +The Multi-Factor Authentication Server uses this information when sending emails to users. +4. Select Allow users to log in and Allow user enrollment check boxes. +5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile app later once you have deployed the Mobile app web service). Select Automatically trigger user’s default method. +6. Select Allow users to select language. +7. Select Use security questions for fallback and select 4 from the Questions to answer list. + +>[!TIP] +>For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). + +#### Administrators + +The User Portal Settings tab allows the administrator to install and configure the User Portal. +1. Open the Multi-Factor Authentication Server console. +2. From the Multi-Factor Authentication Server window, click the User Portal icon. +3. On the Administrators tab, Click Add +4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. +5. Click Add. + +>[!TIP] +>For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. + +#### Security Questions + +[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. + +#### Trusted IPs + +The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. + +## Configure the AD FS Server to use the MFA for multifactor authentication + +You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. + +### Install the MFA AD FS Adapter + +Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. + +### Edit the MFA AD FS Adapter config file on all ADFS Servers + +Sign in the primary AD FS server with _local administrator_ equivalent credentials. +1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. +2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. +3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. +4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. +5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “http://localhost:4898/PfWsSdk.asmx” to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. https://computer1.domain.local/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. + +### Edit the AD FS Adapter Windows PowerShell cmdlet + +Sign in the primary AD FS server with _local administrator_ equivalent credentials. + +Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. + +### Run the AD FS Adapter PowerShell cmdlet + +Sign in the primary AD FS server with local administrator equivalent credentials. + +Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. + +>[!NOTE] +>You must restart the AD FS service for the registration to take effect. + +### Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm the user portal application is properly installed on all user portal hosts +* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. +* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME +* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. +* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. +* Confirm you saved the changes to the web.config file. +* Confirm you restarted the AD FS Service after completing the configuration. + +## Test AD FS with the Multifactor Authentication connector + +Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. + +1. In the **Multi-Factor Authentication** server, on the left, click **Users**. +2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. +3. Click **Test**. +4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. + +The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. + + +## Follow the Windows Hello for Business on premises certificate trust deployment guide +1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) +2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) +5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md new file mode 100644 index 0000000000..80a40bc364 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -0,0 +1,155 @@ +--- +title: Configure Windows Hello for Business Policy settings (Windows Hello for Business) +description: Configure Windows Hello for Business Policy settings for Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: DaniHalfin +ms.localizationpriority: high +ms.author: daniha +ms.date: 07/07/2017 +--- +# Configure Windows Hello for Business Policy settings + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. + +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. + +On-premises certificate-based deployments of Windows Hello for Business needs three Group Policy settings: +* Enable Windows Hello for Business +* Use certificate for on-premises authentication +* Enable automatic enrollment of certificates + +## Enable Windows Hello for Business Group Policy + +The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. + +You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. + +## Use certificate for on-premises authentication + +The Use certificate for on-premises authentication Group Policy setting determines if the on-premises deployment uses the key-trust or certificate trust on-premises authentication model. You must configure this Group Policy setting to configure Windows to enroll for a Windows Hello for Business authentication certificate. If you do not configure this policy setting, Windows considers the deployment to use key-trust on-premises authentication, which requires a sufficient number of Windows Server 2016 domain controllers to handle the Windows Hello for Business key-trust authentication requests. + +You can configure this Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users requesting a Windows Hello for Business authentication certificate. Deploying this policy setting to a user results in only that user requesting a Windows Hello for Business authentication certificate. Additionally, you can deploy the policy setting to a group of users so only those users request a Windows Hello for Business authentication certificate. If both user and computer policy settings are deployed, the user policy setting has precedence. + +## Enable automatic enrollment of certificates + +Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business authentication certificate template. The Windows 10, version 1703 certificate auto enrollment was updated to renew these certificates before they expire, which significantly reduces user authentication failures from expired user certificates. + +The process requires no user interaction provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. + +## Create the Windows Hello for Business Group Policy object + +The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New**. +4. Type *Enable Windows Hello for Business* in the name box and click **OK**. +5. In the content pane, right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **User Configuration**. +7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. +8. In the content pane, double-click **Use Windows Hello for Business**. Click **Enable** and click **OK**. +9. Double-click **Use certificate for on-premises authentication**. Click **Enable** and click **OK**. Close the **Group Policy Management Editor**. + +## Configure Automatic Certificate Enrollment + +1. Start the **Group Policy Management Console** (gpmc.msc). +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. +4. In the navigation pane, expand **Policies** under **User Configuration**. +5. Expand **Windows Settings > Security Settings**, and click **Public Key Policies**. +6. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. +7. Select **Enabled** from the **Configuration Model** list. +8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +9. Select the **Update certificates that use certificate templates** check box. +10. Click **OK**. Close the **Group Policy Management Editor**. + +## Configure Security in the Windows Hello for Business Group Policy object + +The best way to deploy the Windows Hello for Business Group Policy object is to use security group filtering. The enables you to easily manage the users that should receive Windows Hello for Business by simply adding them to a group. This enables you to deploy Windows Hello for Business in phases. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Double-click the **Enable Windows Hello for Business** Group Policy object. +4. In the **Security Filtering** section of the content pane, click **Add**. Type *Windows Hello for Business Users* or the name of the security group you previously created and click **OK**. +5. Click the **Delegation** tab. Select **Authenticated Users** and click **Advanced**. +6. In the **Group or User names** list, select **Authenticated Users**. In the **Permissions for Authenticated Users** list, clear the **Allow** check box for the **Apply Group Policy** permission. Click **OK**. + +## Deploy the Windows Hello for Business Group Policy object + +The application of the Windows Hello for Business Group Policy object uses security group filtering. This enables you to link the Group Policy object at the domain, ensuring the Group Policy object is within scope to all users. However, the security group filtering ensures only the users included in the *Windows Hello for Business Users* global group receive and apply the Group Policy object, which results in the provisioning of Windows Hello for Business. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Enable Windows Hello for Business** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. + +Just to reassure, linking the **Windows Hello for Business** Group Policy object to the domain ensures the Group Policy object is in scope for all domain users. However, not all users will have the policy settings applied to them. Only users who are members of the Windows Hello for Business group receive the policy settings. All others users ignore the Group Policy object. + +## Other Related Group Policy settings + +### Windows Hello for Business + +There are other Windows Hello for Business policy settings you can configure to manage your Windows Hello for Business deployment. These policy settings are computer-based policy setting; so they are applicable to any user that sign-in from a computer with these policy settings. + +### Use a hardware security device + +The default configuration for Windows Hello for Business is to prefer hardware protected credentials; however, not all computers are able to create hardware protected credentials. When Windows Hello for Business enrollment encounters a computer that cannot create a hardware protected credential, it will create a software-based credential. + +You can enable and deploy the **Use a hardware security device** Group Policy Setting to force Windows Hello for Business to only create hardware protected credentials. Users that sign-in from a computer incapable of creating a hardware protected credential do not enroll for Windows Hello for Business. + +Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiven during anti-hammering and PIN lockout activities. Therefore, some organization may want not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. + +### Use biometrics + +Windows Hello for Business provides a great user experience when combined with the use of biometrics. Rather than providing a PIN to sign-in, a user can use a fingerprint or facial recognition to sign-in to Windows, without sacrificing security. + +The default Windows Hello for Business enables users to enroll and use biometrics. However, some organization may want more time before using biometrics and want to disable their use until they are ready. To not allow users to use biometrics, configure the **Use biometrics** Group Policy setting to disabled and apply it to your computers. The policy setting disabled all biometrics. Currently, Windows does not provide granular policy setting that enable you to disable specific modalities of biometrics such as allow facial recognition, but disallow fingerprint. + +### PIN Complexity + +PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed. + +Windows 10 provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are: +* Require digits +* Require lowercase letters +* Maximum PIN length +* Minimum PIN length +* Expiration +* History +* Require special characters +* Require uppercase letters + +In the Windows 10, version 1703, the PIN complexity Group Policy settings have moved to remove misunderstanding that PIN complexity policy settings were exclusive to Windows Hello for Business. The new location of these Group Policy settings is under Administrative Templates\System\PIN Complexity under both the Computer and User Configuration nodes of the Group Policy editor. + +## Review + +Before you continue with the deployment, validate your deployment progress by reviewing the following items: +* Confirm you authored Group Policy settings using the latest ADMX/ADML files (from the Widows 10 Creators Editions) +* Confirm you configured the Enable Windows Hello for Business to the scope that matches your deployment (Computer vs. User) +* Confirm you configure the Use Certificate enrollment for on-prem authentication policy setting. +* Confirm you configure automatic certificate enrollment to the scope that matches your deployment (Computer vs. User) +* Confirm you configured the proper security settings for the Group Policy object + * Removed the allow permission for Apply Group Policy for Domain Users (Domain Users must always have the read permissions) + * Add the Windows Hello for Business Users group to the Group Policy object and gave the group the allow permission for Apply Group Policy + +* Linked the Group Policy object to the correct locations within Active Directory +* Deploy any additional Windows Hello for Business Group Policy setting is a policy separate from the one that enables it for users + + +## Add users to the Windows Hello for Business Users group + +Users must receive the Windows Hello for Business group policy settings and have the proper permission to enroll for the WHFB Authentication certificate. You can provide users with these settings and permissions by adding the group used synchronize users to the Windows Hello for Business Users group. Users and groups that are not members of this group will not attempt to enroll for Windows Hello for Business. + + +## Follow the Windows Hello for Business on premises certificate trust deployment guide +1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) +2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) +5. Configure Windows Hello for Business Policy settings (*You are here*) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md new file mode 100644 index 0000000000..2b2c06183a --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -0,0 +1,46 @@ +--- +title: Validate Active Directory prerequisites (Windows Hello for Business) +description: How to Validate Active Directory prerequisites for Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: DaniHalfin +ms.localizationpriority: high +ms.author: daniha +ms.date: 07/07/2017 +--- +# Validate Active Directory prerequisites + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +Key trust deployments need an adequate number of 2016 domain controllers to ensure successful user authentication with Windows Hello for Business. To learn more about domain controller planning for key trust deployments, read the [Windows Hello for Business planning guide](hello-planning-guide.md), the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) section. + +The key registration process for the On-prem deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. + +Ensure each site where you plan to deploy key trust Windows Hello for Business has an adequate number of Windows Server 2016 domain controllers/ + +## Create the Windows Hello for Business Users Security Global Group + +The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. + +Sign-in a domain controller or management workstation with Domain Admin equivalent credentials. + +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. + + +## Follow the Windows Hello for Business on premises certificate trust deployment guide +1. Validate Active Directory prerequisites (*You are here*) +2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md new file mode 100644 index 0000000000..f6c81560d1 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -0,0 +1,49 @@ +--- +title: Validate and Deploy Multifactor Authentication Services (MFA) (Windows Hello for Business) +description: How to Validate and Deploy Multifactor Authentication Services for Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/08/2017 +--- +# Validate and Deploy Multifactor Authentication Services (MFA) + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +Windows Hello for Business requires all users perform an additional factor of authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. + +Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. +* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. +* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom apps. This protection is even extended to your high-volume, mission-critical scenarios. +* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. +* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. + +## On-Premises Azure MFA Server + +On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. + +### Infrastructure + +A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. + +Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. + +>[!IMPORTANT] +>Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use instllation instructions provided in the article. + +Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-key-trust-deploy-mfa.md). + +## Follow the Windows Hello for Business on premises certificate trust deployment guide +1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) +2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) +4. Validate and Deploy Multifactor Authentication Services (MFA) (*You are here*) +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md new file mode 100644 index 0000000000..2cf39d14ab --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -0,0 +1,197 @@ +--- +title: Validate Public Key Infrastructure (Windows Hello for Business) +description: How to Validate Public Key Infrastructure for Windows Hello for Business +keywords: identity, PIN, biometric, Hello, passport +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/08/2017 +--- +# Validate and Configure Public Key Infrastructure + +**Applies to** +- Windows 10 + +> This guide only applies to Windows 10, version 1703 or higher. + +Windows Hello for Business must have a public key infrastructure regardless of the deployment or trust model. All trust models depend on the domain controllers having a certificate. The certificate serves as a root of trust for clients to ensure they are not communicating with a rogue domain controller. + +## Deploy an enterprise certificate authority + +This guide assumes most enterprise have an existing public key infrastructure. Windows Hello for Business depends on a Windows enterprise public key infrastructure running the Active Directory Certificate Services role from Windows Server 2012 or later. + +### Lab-based public key infrastructure + +The following instructions may be used to deploy simple public key infrastructure that is suitable for a lab environment. + +Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 or later server where you want the certificate authority installed. + +>[!NOTE] +>Never install a certificate authority on a domain controller in a production environment. + +1. Open an elevated Windows PowerShell prompt. +2. Use the following command to install the Active Directory Certificate Services role. + ```PowerShell + Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools + ``` + +3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration. + ```PowerShell + Install-AdcsCertificationAuthority + ``` + +## Configure a Production Public Key Infrastructure + +If you do have an existing public key infrastructure, please review [Certification Authority Guidance](https://technet.microsoft.com/library/hh831574.aspx) from Microsoft TechNet to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](https://technet.microsoft.com/library/hh831348.aspx) for instructions on how to configure your public key infrastructure using the information from your design session. + +### Configure Domain Controller Certificates + +Clients need to trust domain controllers and the best way to do this is to ensure each domain controller has a Kerberos Authentication certificate. Installing a certificate on the domain controller enables the Key Distribution Center (KDC) to prove its identity to other members of the domain. This provides clients a root of trust external to the domain—namely the enterprise certificate authority. + +Domain controllers automatically request a domain controller certificate (if published) when they discover an enterprise certificate authority is added to Active Directory. However, certificates based on the Domain Controller and Domain Controller Authentication certificate templates do not include the KDC Authentication object identifier (OID), which was later added to the Kerberos RFC. Therefore, domain controllers need to request a certificate based on the Kerberos Authentication certificate template. + +By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template. + +Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. + **Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. + +### Superseding the existing Domain Controller certificate + +Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template from domain controllers—the domain controller certificate template. Later releases provided a new certificate template—the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the KDC Authentication extension. + +The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. + +Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. + +The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. + +### Configure an Internal Web Server Certificate template + +Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. + +Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. + **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. +6. On the **Request Handling** tab, select **Allow private key to be exported**. +7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. +8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. +9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +10. Close the console. + +### Unpublish Superseded Certificate Templates + +The certificate authority only issues certificates based on published certificate templates. For defense in depth security, it is a good practice to unpublish certificate templates that the certificate authority is not configured to issue. This includes the pre-published certificate template from the role installation and any superseded certificate templates. + +The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. + +Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. + +### Publish Certificate Templates to the Certificate Authority + +The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. + +Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. + * To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. + +7. Close the console. + +### Configure Domain Controllers for Automatic Certificate Enrollment + +Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. + +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. + +### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object + +Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. + +### Validating your work + +Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. + +You want to confirm your domain controllers enroll the correct certificates and not any unnecessary (superseded) certificate templates. You need to check each domain controller that autoenrollment for the computer occurred. + +#### Use the Event Logs + +Windows Server 2012 and later include Certificate Lifecycle events to determine the lifecycles of certificates for both users and computers. Using the Event Viewer, navigate to the CertificateServices-Lifecycles-System event log under Application and Services/Microsoft/Windows. + +Look for an event indicating a new certificate enrollment (autoenrollment). The details of the event include the certificate template on which the certificate was issued. The name of the certificate template used to issue the certificate should match the certificate template name included in the event. The certificate thumbprint and EKUs for the certificate are also included in the event. The EKU needed for proper Windows Hello for Business authentication is Kerberos Authentication, in addition to other EKUs provide by the certificate template. + +Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. + + +#### Certificate Manager + +You can use the Certificate Manager console to validate the domain controller has the properly enrolled certificate based on the correct certificate template with the proper EKUs. Use **certlm.msc** to view certificate in the local computers certificate stores. Expand the **Personal** store and view the certificates enrolled for the computer. Archived certificates do not appear in Certificate Manager. + +#### Certutil.exe + +You can use **certutil.exe** to view enrolled certificates in the local computer. Certutil shows enrolled and archived certificates for the local computer. From an elevated command prompt, run `certutil -q -store my` to view locally enrolled certificates. + +To view detailed information about each certificate in the store, use `certutil -q -v -store my` to validate automatic certificate enrollment enrolled the proper certificates. + +#### Troubleshooting + +Windows triggers automatic certificate enrollment for the computer during boot, and when Group Policy updates. You can refresh Group Policy from an elevated command prompt using `gpupdate /force`. + +Alternatively, you can forcefully trigger automatic certificate enrollment using `certreq -autoenroll -q` from an elevated command prompt. + +Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. + + +## Follow the Windows Hello for Business on premises certificate trust deployment guide +1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) +2. Validate and Configure Public Key Infrastructure (*You are here*) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) From 46c9160d9657e3f15997c6d35e6015f3d74cb9bb Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 10 Oct 2017 11:28:47 -0700 Subject: [PATCH 17/90] Updates to on-prem key trust --- .../hello-for-business/hello-key-trust-deploy-mfa.md | 10 +++++----- .../hello-key-trust-policy-settings.md | 8 ++++---- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md index 2c31ffcc05..cbdd626558 100644 --- a/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md +++ b/windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md @@ -536,8 +536,8 @@ The Multi-Factor Authentication server communicates with the Azure MFA cloud ser ## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file +1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) +2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) +3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) +4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md index 80a40bc364..830ac3fe78 100644 --- a/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfin -ms.localizationpriority: high -ms.author: daniha -ms.date: 07/07/2017 +author: DaniHalfinauthor: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/08/2017 --- # Configure Windows Hello for Business Policy settings From 533dad125cb390c662b2b0474a13fa73cca10819 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 10 Oct 2017 18:01:28 -0700 Subject: [PATCH 18/90] First round of edits for On-prem Key trust --- .../hello-key-trust-policy-settings.md | 33 ++----------------- 1 file changed, 3 insertions(+), 30 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md index 830ac3fe78..d98896852a 100644 --- a/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfinauthor: mikestephens-MS +author: mikestephens-MS ms.author: mstephen localizationpriority: high ms.date: 10/08/2017 @@ -23,10 +23,7 @@ Install the Remote Server Administration Tools for Windows 10 on a computer runn Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. -On-premises certificate-based deployments of Windows Hello for Business needs three Group Policy settings: -* Enable Windows Hello for Business -* Use certificate for on-premises authentication -* Enable automatic enrollment of certificates +On-premises certificate-based deployments of Windows Hello for Business needs one Group Policy setting: Enable Windows Hello for Business ## Enable Windows Hello for Business Group Policy @@ -34,17 +31,6 @@ The Enable Windows Hello for Business Group Policy setting is the configuration You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. -## Use certificate for on-premises authentication - -The Use certificate for on-premises authentication Group Policy setting determines if the on-premises deployment uses the key-trust or certificate trust on-premises authentication model. You must configure this Group Policy setting to configure Windows to enroll for a Windows Hello for Business authentication certificate. If you do not configure this policy setting, Windows considers the deployment to use key-trust on-premises authentication, which requires a sufficient number of Windows Server 2016 domain controllers to handle the Windows Hello for Business key-trust authentication requests. - -You can configure this Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users requesting a Windows Hello for Business authentication certificate. Deploying this policy setting to a user results in only that user requesting a Windows Hello for Business authentication certificate. Additionally, you can deploy the policy setting to a group of users so only those users request a Windows Hello for Business authentication certificate. If both user and computer policy settings are deployed, the user policy setting has precedence. - -## Enable automatic enrollment of certificates - -Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business authentication certificate template. The Windows 10, version 1703 certificate auto enrollment was updated to renew these certificates before they expire, which significantly reduces user authentication failures from expired user certificates. - -The process requires no user interaction provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. ## Create the Windows Hello for Business Group Policy object @@ -57,20 +43,7 @@ The Group Policy object contains the policy settings needed to trigger Windows H 6. In the navigation pane, expand **Policies** under **User Configuration**. 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. 8. In the content pane, double-click **Use Windows Hello for Business**. Click **Enable** and click **OK**. -9. Double-click **Use certificate for on-premises authentication**. Click **Enable** and click **OK**. Close the **Group Policy Management Editor**. - -## Configure Automatic Certificate Enrollment - -1. Start the **Group Policy Management Console** (gpmc.msc). -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. -4. In the navigation pane, expand **Policies** under **User Configuration**. -5. Expand **Windows Settings > Security Settings**, and click **Public Key Policies**. -6. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. -7. Select **Enabled** from the **Configuration Model** list. -8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -9. Select the **Update certificates that use certificate templates** check box. -10. Click **OK**. Close the **Group Policy Management Editor**. +9. Close the **Group Policy Management Editor**. ## Configure Security in the Windows Hello for Business Group Policy object From 842bb4e3ebdb6f296a0960a5861843a885eedbb0 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 11 Oct 2017 10:52:14 -0700 Subject: [PATCH 19/90] revised procedures --- ...rd-enable-virtualization-based-security.md | 18 +++++------------- .../device-guard-deployment-guide.md | 4 +++- .../device-guard/images/dg-fig3-enablevbs.png | Bin 30708 -> 32382 bytes ...ed-security-and-code-integrity-policies.md | 4 ++-- 4 files changed, 10 insertions(+), 16 deletions(-) diff --git a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md index 7f3deced86..b607eaf180 100644 --- a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md @@ -70,22 +70,14 @@ There are multiple ways to configure VBS features for Windows Defender Device Gu Figure 3. Enable VBS -5. Select the **Enabled** button, and then choose a secure boot option, such as **Secure Boot**, from the **Select Platform Security Level** list. +5. Select the **Enabled** button, and for **Select Platform Security Level**, choose a secure boot option. - ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) + - **Secure Boot** provides as much protection as a computer’s hardware can support. If the computer does not have input/output memory management units (IOMMUs), enable **Secure Boot**. + - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have Windows Defender Application Control enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats). - Figure 4. Configure VBS, Secure Boot setting (in Windows 10, version 1607) + For **Virtualization Based Protection of Code Integrity**, select an option as follows: - > **Important**  These settings include **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats). - -6. For **Virtualization Based Protection of Code Integrity**, select the appropriate option. - - > [!WARNING] - > Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). - - Select an option as follows: - - - With Windows 10, version 1607 or Windows Server 2016, choose an appropriate option:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + - Beginning with Windows 10, version 1607 and Windows Server 2016:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. - With earlier versions of Windows 10:
Select the **Enable Virtualization Based Protection of Code Integrity** check box. diff --git a/windows/device-security/device-guard/device-guard-deployment-guide.md b/windows/device-security/device-guard/device-guard-deployment-guide.md index b88e38310e..6bda41bc15 100644 --- a/windows/device-security/device-guard/device-guard-deployment-guide.md +++ b/windows/device-security/device-guard/device-guard-deployment-guide.md @@ -15,7 +15,9 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, the ability to run malicious executable code is much less likely. With appropriate hardware, Windows Defender Device Guard can use the virtualization-based security in Windows 10 (available in Enterprise and Education desktop SKUs and Windows Server SKUs) to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. +Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that run on Windows 10 Enterprise edition and Windows Server. When these features are configured together, Windows Defender Device Guard will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted, it can’t run, period. + +With hardware that meets basic qualifications, Windows Defender Device Guard can also use virtualization-based security to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. Even if an attacker manages to get control of the Windows kernel itself, the ability to run malicious executable code is much less likely. This guide explores the individual features in Windows Defender Device Guard as well as how to plan for, configure, and deploy them. It includes: diff --git a/windows/device-security/device-guard/images/dg-fig3-enablevbs.png b/windows/device-security/device-guard/images/dg-fig3-enablevbs.png index d457c0bb969900dd36847291c4ac979467da6357..782c2017ae0aad63ac15766e8a3fbf9f9a7b624a 100644 GIT binary patch literal 32382 zcma%j1z1$u`Zp3%0xBR%stD4kG$SC5bcaX?(#^ooAPo{DAw6_=!_Y|A0McE;&^2^^ z1D<=obK{)*=XrdbSbObvz4?1%PoTW4I35lu4hjki-g^lVMHCdYITVyT>{zJCPijI) zz{vmZ02RfBPzqt>Ysfd~MuIYeC@3Xh+>1{b$oJUR5*k1h6#SN(e|I{pvOlAsxD&n? z5ma{6-l})8`>5i+vsPg^n$Ka@7Z+Qx0(QC#%ZEk?7;gV6l=b`e?#=t^X!hwB)9LRW zTqC$mhSsr!jL*7c^bzH=l?Gj$GE0?r0QZH5?^eBjn0yq}&JLzMdDb=B(n-KnjQzM? z(n_VzYUgqajL81UulU_A{mgw7ywBfwdAIOHKc9LnZQ0;sMX^7fp(20L$I#Z`aas=9B@S!Ta3Sqm*7V75aUR?h5%fR7j!#)8AfONOHNv407D-;d zXP!-UyHEO~94qWO2Ns!EbY7mGk6}Yt@428up^-j!N$ie@xlsz*DurJZ)RJ1r2Jn!6 z5N2K2R-+28S;`FH#O8s|CcOyo4*h1-$Vpv0{OWA}mRn!SQ_YJW7eR1w?P8+u*5WXZ zDg}*)HSi{SG@lL#Pu&Uljy?d4)p9$hF7-_Z~J=wGh2gN1D zKOrIlhBmp&luQvT{TAX+Y|U3z%QTJDckeEwe)e(DD_6Yd#aNr+iKdHJAx5gnL)9AY z33xniWvs;jnj2Eo;F+sBYb6JIUbf3j_}{2G3Q9T!4P5lPVBoZ_jHZS_oXOXcA=qvs zWE|}kBQ#I!_#1jj^%P~Tj+?8cP4(*sgZeDRI&3s|4+uRWztyMb&axG7l1E)z1VVYc zArqP|obloKt;RK#qJtWqdqU7|zG0Hmh2O3~Nyqs8H42K!9T5KQXYW3I`MnC|+oN%q z&fVV&nK;bhX-jNa=%}9Wp5Dho*E8|nO3-=FN&re=5c<7D-mZHXHdkAk{KxfQ6u+4Q z=IWf-z+WXFY}JW~XVa}Miaxs($GTZxT&J!8O6)UqQvTLfg3!l^jf-2Xxgcsd*Etz# z0k$`uBXq3oP5#)5h(rf)y^1K|Dg^Pd*s z$$3;d^&4p>LPt+};qk|=SH1$*JZjN*e{<%Y&0Z;@AusLv*g>b-VCmDW_G6vPb+yLx znVmDNn#PNeU_1fq-3Ed4)17+jYG0*O4RU~h^8wwIll%aXt;MS0bY*;eJVn^w&)*-) z8~VfHT5T*rd2g3cEf3^o`-|kscYzVM68QXX`%Kc~Y$S*MB`PRd3;NSpPh=>JYYR zWCet@S0FMi1f+?sK<+2I3lnSoi|CghTwDNrsOWgrxAfzBTmgwkD52;k)Vvm1K9lh{?Gv|b+&C|3=DW3yWtnFHf#X0&;hw75lM6p@??%Mrqq?(pW&Zpf55&c%h3y7vjYy_gVrTM zwod_0^Z=WM5jEWUNAvlP`f>8eKyv3 z@s%NzX3Y)G>HkCgWY{waLItb0+ovW3^Si8`YbHUfjxarr2Udza8n+ulzyf1e2!Wgn z?eq8@8-km2zjKNhgY|cFmAh^jjad?zCZ1llC~;B5H>|B5>`=vB)T?z^y?u4C(XVs) zU5jLl3cA1C5ek&MU%CrVbO}YboT{`CxL6=aaz9(EcR8*sFCW<2o~cc8UZvkwBU*!3uj@4-a3DtSeSW<2LqGJyq5pdG!7&BTw zE$>)S{1}7l;RH`?RVjjXc3<3X>gcCjmHBi_iHRI2_1e3CGLiS=D*mH}^Tw+zOqF52 zQ;kcdG0GXIt!Ao^E>*zrOl{Mhy30@*htY)dkf}t)wvre1JJT!jCs=_U9@Ddc7{D~( z#J1ym$CRA!X2S4AWs%46#Aw<_yc@2_AGJm>>*Fl`Gpfp?>oE?kW6C=9CYZ-T8r8_~@V6F=nVQ3r4$5=SmZPny`1p7(i^+ov zL_eJH;K%;hwW@{XiLPZbj|22{HE-@@Wi@HeW#MRx)t!&)B$aGSu5kITOef5vJgbfE z;e?Z!*+y@=>(BoKtb61e8=~dsDKhegu4_cw;Pq*&+4W^8_-ZN>ajmiyt3pucv2%sM*mUhrT8uc)XvJUo1{ zn7;ID87y$cJ%iMokm=Cr%Vta}Wh{VY|*pR z;IukB?XO8kzxZP%Eb)wI%T;K|;nV!=dDX5MdEn;7e6u%OM3Q2!EDlE!73Db9Hu0sSajfe@Zb|(eQ8;@oz#@;MV zILPT-4i#B`ybK{}ROQ$m$tCdEsI>S<;qNjhEJF3wX^N-h5~?OZ-gkL0Q&>aAcMX}O z`UZ)JyKdI;Seoz#UVM0UYg5n%R&Wx2vh&6EmU!Nm5`9*@Z!R|kAXfs~aVI(-#ICYD zE;c9mnPV>-~eB%Vx92nw{8+*zL2;)4qu- znX)%xe4DPWt`}DE_}2=D8;%Y z+WEknAFjCs&JQcBuG)2|t}7bd5o466zpU~w8%kEjuU#zZR)`Off%0q$lv{1JQDMd9 z;k>gVM|Y~X!P;PZjL^w@a*~J1dIh(?jT=x_&MWn%K|y@i>XnU&Q`T(ygXEP9P@Xp`el8#3}ZfsaG?a z0-}RTNo$4iLohbdjC51iy&--@AWlUN(s{Gi?V{$K_MUuS3-pZLlVa0{8+E`gFMbvl zU2SqT01ItrIvjQqXSLa!cfjpjBZ;-Zz7kgJ_#23$=~1rH#>J_1c^-1@takamy*|l( z!*fOldYsYdxVorDS-rcADR2VOY-|~^sXo5!|8PB%RJWfe&O)gizb%}io(v(B>94Fu zG{ZfvS5*(=lOtmjV-=KcR1f7{*cdF(vw5%RV!rQOR`%NJ{LOKF#4}uQ$d$)(e>1kt z>OjglVqkJo($xK6Re`keWHD&^eoFBL#PzUQ$x3C*-S#k)LML&vkW4^RN}GRZ=+%T4 zz@}1G%wlD88pO}byWRkjjYoGnJ?@_otuj>#>x3O|O>yyE?e$j6Bi2f;VoMrgrH^Z) zlP==NJTCJDYLRg;;H24TgNn-ao9pGY_2L-J>ZHY#*h9@Dqx8sDw6973oc}VbQc4H9 zQ_m{kcqO;9alW*305gHRb{t$@2B~>SS;YAZ@x5V39^I&HVynOLY#TG_dPZ30Gu-2< z57X&4KIbMX1up*Nc(yv{;;;$m@Rw-iseRSi>9HS?M9yRDbN5u6Lk%f-LJIM6Ki3iYYT)!!aFhq^?ZDeu77l4JXhsdF(Wl zTkb0k4Rql#1c&AIHAjHE#|LWk@wkj#wE$8cU+k?Q%0H)GG$qTFkhc~Ua`)3T=kDa&gJIT&cPlICj<;f5z*KFR(7)o$DiRk z@OAF#bIMerBFObnj{r4b=VZ4`c*p)4Zncnhej5h$c99wuu@FcyTi;2ByR?>-bff@G zExw>|&-@v3G(&7rJ4)%O*VnL>cWeoDbGWns2_0>n6c)Yt<8rW^gH?=ckB{ z3dE@|7{Zzm&Z159)5GVMdp$wQQ%-?TtF#?&-=fIdjl=qX=bR`}q?HK4-yi>vk_PG~ z`R%$d&QcrU7UW>vs;PQIUoqjuYOn%QMGs}FW`u5vf>rTN6HJnkm> zZL-_C*il-AnAP9tI485EwxFF%`Ur3=Wgzn1tSbno@>Th6k$}pGS7~mQjR6Y%ogMFa zSJ<6Sp0+ux`$Q6$6WbVQZm)wTr?1CNZ4Z{1k7GK`;BGQpkLh>JO!t2Rf1Z-XojIa0 z;f|Nqr#u?xxy`Wy+Q96SPMq<}VYG3t4;oeC$@pW)jA2@qkE%YyiM(0;ygoz7gnB#5 zKf!wlDmR~+jTJ5{pqpw`LmCgy*amexxov-Sq`dhfVJFNfLu4UgG}YAtRc2O}6CgV6 zwSffK5g;)~HUdq#gi2|0vv4i*N21wF*?dAs$hm0)qIb+}K2EtY&p1{~FfdGs@TIL! zzaJWEe=iy9^!V~2lBw@Z3+K0<4u=oJlCHbl`*l3AIG+C&PK^9)%p*WjZ0xfKNMLmB zM!hQ8r{ZU*5-W9Ff;Z9pNO5=iv~Tf9DDCS%fduXZPxDo;qAaN3Fu`9|?D=K9%+!-A zmF@=y<$(ZU9{haNM}(E;ctKFVGW?rcUV30WAAU>%zO3Y?iPbqfYnBkaIvG56HyLTX z>;^w~O1fVkr*o>UVhrLJboktW>3t&_5skYZ)Uy3%a3v)rv5t=R_TF(fj+u;&UFr$5 zenSD{&crEhsllnkyp~8I>`PA#fbqK5b8rk;d zTeRO=B2p@^7+ZJ@i685^J^^1>7snB1>9`oLL}X<;uhY@iu2m-1xn^d4Dy;=AnnQvo zdo>6EYMIOx33q=DuB*yC=x(WK*myFe?+M9zP-*^NqC+?y$Mn4^{HhW4foX71@-U7S z%U4E{0B@bs?<$R#5_HhrFA(Y*@q{r&CS>)%u#fSWF@_Vk2alQ#zEkLHaV%+7=tCAk zi_$Z#v6Iq97MW?ZLkf_!e9EodE;G1=%w&wOaT!1E>!SR7ozQpZ&Ye)>!f1e@Nt6j{WdN!>NxeU-mHA^?d_H+ZHj#*J{vA=jk{V%Jj(Q37O6>m4l!&z4fZb z6Duc;`e>y1j=dbvf14Zmvqs;{ei(N6KA+2xw2aIih;r7&>2kQ~C~QcDs3j{`43H}h zFkJEq5`HWe#w>nO019*Q;wfOUw9*wV|pGlr+jH$ccSIS<-Di> zUf&o+yJ)9(SJ`r=+p^~Kx&($1vsv&Z=SIbLNCP?L(6%hJZ3ShT+NS+L=?)=1P()z- z4==JkZ&lng1|twqS`$0p{#vPJM)0=8aPDZtrE0pN_No%1QpJC@+cz~j*NVr#T2=go z80}vVE11KvPEKrjdUn9-c9~rB{mBd&bEw(agP+D_Yb$At8&qV|Z{mD^E5++M^&^nB z`S7{&{K{`{Mw0_Mzs3>Ce$65zYd-strM;OekB;o>r`7e>LCYbsb6Au_E&eG>@TirMj17OOzn_8SX8PnuO~7_L=s5CKEZW;|CJrS_dm)ESo+>KJ1L+SN`_SB z_=svW`%w&S`?xiJrQV}GZDWOYv)mUT&JM0sn(~^%fjDF%kfHqDlhg+PAFyT|f95H& zf9kr(Q=t^u56IxLjJ-)7iE-n)r4#|j*Tezx)Tj%7y!tnEAVb6-vEuy}xu?2g_7E|0 zKOQtd)#oD0b(dupE@#c1UiTwTIq&6rH(W#oh%?z{18-KvDm8%k_xEy^m>p^dJ$^N$ zBx;$0ewUc!;vrkddH2*u{|G~^&;5DTZtlmkYzD9I7zH15{Sup$E*F4;c0a4ot&{`z zpeaF@&7yiqeytvt3KxSCNttz2mT{Xb=i7zl|FMg?qk%D;WG;tLk-u1_^}7W$Z^{IC zt)JI52(FseN0!M*k~EbypyNqeznsh155q4UzjeTZK+%Xv4|?66Bfk&2@PM{^_Ng}z zRua}T2s@w4?Zcz$#bbxFa0O|W0>3ts2n&|N@NBS@EY_8(5p;uKkB(c{Q(;3X<(ebua-JUfW)x}QfSq;e$GjY7y++73T$`uLP z1S|`2HEV3A0ywe5^4*%tw9|B4@A1rzQJkI8#x z#`2z*80)e=bP?Z@V26s6O|rXmMHA?TvjA{&R2;RD*}+jXm|{?ub787Y19+j{#rlX}WOA@*wWwZokp%+2pf z{`3B_jYk8$FXdzohZUqjLl%5ar_ypQpB=VZCwQM!#Fk-fPOqnn)qJWGgnbXA8(}9* zk?~I+iyP643IR_4C^aL&-xhrrd%u#;t{i5l3puIddk93gjHaA=Bf}o?UydtV&iBgA zphI1)&rxklJ*yhRt;A)M$vLDEzn0x)r)VtT<|W1g)TG9y?%YigU)hMwB0vh)^{YUmLxK1E$IWV$fM1W(5I&E6l%judnb z256gL({*C^?^26gSI~BMnotaNZLYkS??xXEEWi{mLkKa5fjYic9OoBB{5`WN81lJ# zwvghoK;D5FW6oeE96oQa!(BwECq?CdsTooeggf)PB~N5Wi2M(Phcs_fPslkMK!@`$ zeL6}M+kdVm|G$9pCR@K7h4zGamlK`}yl*(*n5$lIUun9=Mnhp@i)!bFyG>{)BD*o^ z$PjLoZNLK9v8W4ebY&XjINIM7vQazMRI%r-pdI|MP#=J4SmDc5n=BmO7nM50cKAi5 zeBW^LfnPx*;E02(!y_r(D!u*3%xe_gi8A!|C%_4M*H7#%SG(@O8Xoz%*S5v%Xr{OCFr z>Gg~nr#`7QY!>@L3u!4{8u+w|wji1i#RGo!N_SXK*2~&-*v?T$meX!Gmw6jWg0OY? zKu|oy__NUWc>58(H*5EziT7PHPGn7VqQe7}6Rko(wUCxD?T%7RN19VsRqs~4* zk>0pBS&8ye6BWW*PDjKNarL|tozDm@m8|)zmCD+Na{EQEt?oH6^T!zYo)n7Dt)Ebl z9FrMsarkB{mgqT2_DC&wclz&)hC~ z!%3KxELWjxpaHdOK-+-Rwo@b}b3m4dv1&>`3Mbzn>H}pthndNvxr1L^@6N;?E1HZI z=y#lkAGt8iPN2Tyy-~}?%~dI%Cvjc7#O;<$Z;BBH!aF60OP6@iFit{bt()Sl2Ju&( zt!Z~E&Bx`k^T@`&OP71+N6%XY#w`J6ID#HC*qSbGD)nt7)V@}uPTBXQFB3`^rx_QA zv>gs`j)!S5m*;D76*5}tc#2M=*1JToOGzb|0IYDSnVqRjg{XuID_*OU$H@vTPPW9D z`IeiA(L(9oW`5c{mgQSfoNTx9Mg682^@IB`!*d{-LN-vw?M_Wesp2&Ow-M(GYK3tV zEIQGgvnS2#qidF|#A%c21GUQKLd&eaOK<_LxWKF}IFM(vu4wJ<`2qshTlN$DGoGcV z?`=BUI|Qrv6_|ceA@<27C6#AWNmtFrh>sN74jBZIj)4Lw%5h#SCT1 zQSmw3fk07Jh@n5V7Br^AAxife9^-`DTLuVsIw>X9EDzVEsBAh2b~=Uqb~Rh%UxluKL}#uD4sU0thZR8uYH2`Js-xVC)-+i8>AyC`M$w7@RYAI?k|r7E;vE!{6fK$-3rHRQdO-4x*xNWdN+f9co-_a+IkZ}c>JvBPG zpTtUXO**KRZ+&o?59BznESjxdKAJhK+RCpv-1E1Zt-PYO+{FMT{tg;ETW`0$Z6$r3 zLnv?I0~oV1!^W*S_lz`zz5kkksHt|tp0!B#DI7cx zQ{J?5r?XbQv)o#8LC)vQ9?@k@ffTMmz=eBb=_dIXx*IsqGYz8LS@;<fbe{Vr2=%7aI#AB<5VSuV}(tB{w+k3FNc~6uRASD=YcfMV_Q(0A|LwfQ}3YjJ_ zaUrQg1>vi5-s~6zhA^t#Y1COVuH>IplYpti`SK~5L;!voff z^@8h_Xm_3$t5kURK5~2T!(e?}#j90YJh3~+0_$vm@Jd6~lmZ{dN0%!(>?oitslIPWm*9SO+GNd``FT{F|C(k zzFQvwb)0tFAP`P>pqh@Gy`HPNtzN=#f}XSKx^L7GGud&#c)2(a?}#-A;l*9rU-W~= zeW&i%K=K5??=lBTlLc%GQuLe6h}RnPh47(5%4Dav(&48R)+Lk+LIfF9fuZT@{`Eh; z5lGDsb>Irfi+VgJ*>ckGeEH?VT_@`QmV*K(Ps5)dlG|z*mRDAWfl(*l4kyLoCESkJ^&SY?^guqgbJA2R&6)utH5eC_Lb=`A-m(6a0=o4*NrmJs zyTVJ&gT{x@wDBz39fZMMk=}+UB^Ff&nU>{lD|E}|2P}*tZmZkIbx~h=9-iM{)_mrO z)%2DLmbP@Sg@9VdJUc)-5<&R$BgFYO%mc zDEFO~EZa{9u`gxwQQ;Bl>SaDz5QIwgZd%L|OZ5F4yPz2X;q$Os;Zwflj_L{q8@OLw zm}!zG4tlZ71+t)P)eZWZR>!@bLl7 zFhQ{LYqcQJ5jveW?8U$bsck9g?iWG;yg7vsm(DvE(WzlBFAS;YaQ4m_t$JG?0(M;= zZ?Fvg7AOy;PSGwg+K7W$P*TykZJM zly4WImxW*6b7HTG?<&_b@YjWn>>+CF@Lrh%_OE;;)4#$KoEGz*orv-XDDM6CQ0ZqC zK>69a-5R3QFk@*xt#D2fSqX6Y8aiydLuMw3ajCo+R0Jpk+{!VW4I=hG1=WfhX|NS@fA=+- z@h&$5bP3hpmGqO>vMkZavsNTXt*v}QiV=jd_xs?Csep)o9(=ncm698>=kYkL{}*bK zh-npoUVV*LpMcsB@*T}%COQRjT(1Bjn@p-L_g%78+7{-KuOcGh1Ro5Olmp#Bzxbqt z;89Qa#TaWw&|&rC_N~eDQ#)Ak%b&R)Ook3Kitv6L_yxGjQh6-?Vl!&?p1@O|*^mUh zI-3IHKQPj_4@elp#rsy;tMJM&=)T<^ryb4eq80R8vJ##e8%!3ES#Ojegd_F6!-I=P?aSz| zGPyPj#9yAB6bJbCxIQ@(2-f3`fs`Q&z%)>C$}q`E-(RlgwKLyZ3(IWp_Y*7lfo9#z zg+ax>L~kA3%c|=KvY)%S11mj-@`DF|fMku(lL$aWJW0dcN9?vnGC|F>qPPTYyfwpx zYs%ae!DZFX3V{!&X|XLxr_YI=+TCkzV>ay0!G4j3$r_$uzY>J{2Tsdb?s}O-{)CcN zP|c&vfQjvF39iGjW3J#O%kiZ8BF2`bztSh8DsmWgGY526k2HFPENiLpN zjMsNV10#}cb>%z=PvbeU%e`&O=@RW{wyvNb@YmSe5`>BN?arrf#VM;wU&K9>so_4# z>AH4>1`Wo98Jx){P~}xWx6?g}naR-Wz~AQMK+H-FO5Epts27T4)J1WpxU7*LrP%Rn zhXwX#wgx#p^PhzzCp80IDhEpT(zUfpZsa8!`9#B7jN*VD-V2GN$+8Io(o#4lO!0st zU*oZGAfX<0 z3{gNZnoM`_jE?cpeXXz96yDwpRhWg{3C?WzEHF$eO^p|Spi#O9uBtSi0FJ)CK5AiM z>K5U3;)CAR0LP%96F!AQoHK50WH7bYTR9!cYWya+7T{+3)wKd$H>@-7NpkSk#eo?? zpX>gxvK&R*XRevii0J+Uc4^R7JFy$%GX}p)ldwEiU%<`ImPiW7AFlUuWX=s0!On`=8$O zC2UwGA*au7)R5Qo4aG<-Y<;jWt`0=mKuJ1h*E*EwtoJ#cV?Wi_k-013eQjo$+-sc5 zz|vJA^zSvN1DWs2*R}2+g?M}FW7);NcX^uP91%?EYHnbo+p%|3+)WnQ)%cFSJ)Dp5 z&LfOC$dhx$TbkNTy?;JTbZUzIj$R=e*Y^n{vdlwzdFAvD+^@;iZAw(pkZJB7wm6-P~kW=9q}^$tB-wHsDb8ulAY1aoy3mon4HV%#S8 zZF4pfi$5>C34+iYIqtt{JL>U>PE7L9G5#w(aM6=gFtYU*5Q&NG4xs((wWKv5DgcP- z=xB8?&92A(;iL$%N7!nMgFFr9ziz`J*=l5%xdsA({4C2RG=NjHv$9nmaRB1ToefBk z%?148CC8gawEXjvd`VOX)742nK0eVZ1wju)AJ^I_u^s8{+%ylye^L?G;!iNN3`k0D zJX_DRlkzJ3Y9g&LkyFX!CVnnNqY9F?)z&Y8GN;m zF5Q`hnqYYU1^I?9-89Mt1Lw;au%~lU%#MeDq0hK4s99x9Whd)!dn8)Qln}OEand%N z$6=hu3+xfvWh^;IeCBKHge`p`$)e#*u=fci5`|EAtQ1aPm;i0u?^>s+gYW8@2)_lp zB~|Nu^i7&b71$})EpZoPCTH9WX4d>4-FPOme-p*}$X-{VP0b}&<3W$zxloWJV^36w z%j#&|4d*sRY#KwbDF|GT50!tudqSb;8RbO2yI9`pS1U_D8Yw6+<%;BjVcCg7KD9WL zMJId@DtEp)p?DI@e1>Q+e)&`Kt$xoa%mrLPwPV#8QXXsUVY@Zol`G$C0EdYi&|Vq$ zV7QWJj$1U$@&iwE5#2>r!)Wfc+0?1RU&vCRzw>YbI(`9 zg+3*Q4QMCmm+8O8dOOyqXOoE-YLe5Txz0gRn4UM9aH5WNnoWaOp4TCq^3s~tOl1k6 zw(}c5ShBfVYC$jyqtVc|cS#90MvlF_jC4eQ*M>^{29aW`qVkv<8~)sHNflmGWK@q# zTTw|nJbW5otUVCZIKgT2te+zIGkcIITq1gBujJm0rHP}TrMDN$?5Yq)ZcMvu^&Ez9 z{5F^9@f7sRQpVP>PwuXp!@Z5T!ELXQIg<8#&_Z1S&D1 z_KEbZr2(si>-c*87MFEX0eoR^8(F3?`o=2(aL{abXV=;_M`^F{4T|`S5*QZs^xL9Q z=dj_Ad>e2k+($$;RJaZszD3BgQ0=As8}xs8xh%iJ86?KG%NuqTYVazY9W6D8s8-n# z;cEMRVng!ydm#n^JAKbEGj^7JNd}t@t=8$KH5z8$>VHD}DqpKf71>kA4C8j(v2*#D zQHcFHzgh(JGLw8MEdG%qxx4jqGe05DuW4Vko~^vZEDL>d{-VNU!57%*ND%otCF0YS zLM3SSA2YCzLVIMO1k3Mc6hDr?{i&2R217^|><)HIUgp-gx@n~b*{}Fz(wY@6yrHjP zXAKjL91M79RuA$z*3C>kR~^?51j^|VP+wtLwAWKNdzWZBv(?0D$inV!+rIv^b0pk# zAL-?OyXQC(ZAVX*xhM3i$jBbJx2yRvTa0*U99ykUDE{;p6DVJ(uF&v%^bg5T3t~8H z%X?N|`^Lz)DqVuFbmxZwMR!QdZQ2E!Wz69#&4CjTtV8#BT~GY(lX2*W7o%-yu_x3? zZ1f;O0f}tQ?}9}5ishf=qncnr@BVtsWXh>d2#02bEfid-(j69~!q0%A($^ks1KG0f zM%DN2TD^0b*T*H1twtWeWVe6x%FFC-W~xK${jtXq>%xS6oF+TQiNZ--n=|foPrM-B z51WltzAbft=UjH`?RusJtCfVuwg(qJ)u?!s(a_ysWjaBmh|ybnNMD4sZPa1}GqaCA zs|m(X6r8>e47C_`Ugu7t?-?U=C})>{&gjZMyp2z;!aTefYLe_=WWZJV(8h0|on9~pxWi;YochS=4ZZ9r~D}CpdarRyEJW92~Bve%*tBLfpBZao$GZCK2 z#qG9)~+u6|0$FhTML2W?hHEPMXrvL}{ZK2)=#fUfe4ue}@ zK}~^`n3+YJk2i9k?Br5x5dGIFQyF(aH2&IG*6Y5gZw7wsN}q$9cv)YGBjqfu@xsJb z4{99S6jMrD9ty?POUQZyVz3pLcDiUrS6za9mE;I6U?TlP%UfVlNGSYJt#7CPSeqjN zhu6W>)XZ#cUrT);2WicZJ!3oq94ceDnyFXt$DN+|Ik)>lJmB>zbAXcdM!Wno|3Z~H z0YYA`hd!zIwl3$Lsd%(RU%Td-mZv$Fr}%P9l|2MnnoAD8%M*j+4lx9=zO zt49o72+fpSCT$fchkP=i%_=oFIC0U`OGaJ)<&SQy`B!z@5(m0=DzhWKceu+uZESRJ zoX^19t&eqJQEM&zv_usHyFBbVY%%BE#*Yn!`}Hc{ceIXe{e~7VUpyC9*kffd2%b=Z zOE2A3qHV8<*+xKB$XEd4aMf;~nKr0u32lGjq*L<~57OD49{8~Gfqaq6X(>?mDXXh0 z#)vCor7to?v*O7^yY1nD3YVE0d*E!G9=e`(%4`IovksnK=od)zr);B-<4((rc~@7f zxmMRgSiGCAlz-i8-hZYHI6!;1etVK{Nf5F~o1kFQ_fig9(-hSb%&Mdoa|_Jjp~C*@ z)AxL=HKk}fJALJFKREDa%5p0`EDMMU58{qJd5srY)HC8U1XSG0K3;~YRO0^f?ays) z{uamhQ4p@&3L|{buu6SDK=JNo-92Hxr5~`y{np$@CvB`V2f5DZ{+29%E4uE1|J&@* zQ-Z~jz2}WTwOnr_9y>CcyzjDj&ajLewjyO_taxR++<>|@QApDxSS&51^dSz7H37jm zT~gE+gjFXd+ZwtQULHCVrirru!)Rnaxzt*%k63KLi3~X>$CUIB4xW1CKlIW*{puKm zoXce59dxKkC%tt;%)XF~s?6RwSR3wm`aJS!R{Z_ttr#tdY3e|V4w_H!u7xtmNhjq# zV#xs~{ZGiIfV%XfL70avwFk+g>G4h3oQaLbax2%3hLFbmyPg^%uaWFH80O;Q+L@{< z%F8n|Ha0di^y?4&wHtwRQ(?coX-i9duDizeB~W6=3eo#~PMKXs;6bX2o3KhgX_Z7EP5 zbel9I1wr}SS$%@z3Sk@nXY=?1)BxlVaP(rGz9!9bbKJUOeX&^_pxx&>h9%_iqVB$c zA|uwVIyCh>k!j4AM^@$_YG21me z2Gg>ywBk<@ko9s{=S{R>Bu*}lqg z2xKP$kP3wf()RnUJo2cMe_4+^9fwBDK|ci3rDS{{kU>sn=GvssysL1Y%B>g&eYinq z15Fwqq-sAhAgc%dNbn_OM3iLeF3;zHR1SjQuI%?|{^vw5O$iX1(-!*xNBVoWPl)A) zwnBcN)`Ou!Y?631YjEq6p>KhaYu?|hf1hcT90_=Cr2JQBaz3l@H{^FR&CLqcD~-3@ z=;|?YCZ(-4dkGuu%I-@ztOTaP6c$F`Y|@o%hdk=2FcTuR;GA)_Gbq!{>g9>-EJeMs z%6y(bK&9Ycoa;bj3T;RY6l^~d>@X5)|8**m&7RQ6lnqi58yY7qZl77^T%On74>K`O z_z>Ju$!P9)xX$``i?d!R)w|7Ri&Vj4hOZdQNXDU;Qd%;kpl%7m{Os=!cJ_A-Vg>{F z%*;$~k04edt#Os2aLx^RQX|1jjgsu~d|@sL#@zTaxtf0ahZIP_v$;q!3!Q%Dnx#OL8a zOTTi>U_))H#n>d8T>eCr+uSilugdB~-(*CjiCy6?x)K~RILhzu-| zSpP;B?xw3?u_x_XV69ahHFL%q<@O?c)Oje|6ucgmw<@p^4qTrf)DtLGsntJA7zM*p^U@r79^Z*QyHoEhFlwN*S zAu1)^chR}n4{av>8#2irf+UQ=DTT(FC?##$i~+SDCfdn@THaDU58>9spyDzMrLx0F zew8#N3QR+OzGH5mI*He;ax>Y#`O{sOeO(JwP;_UF-7 zToEJP3D#eaZ!uQ7ot?PF1c^)#xn6zhCw_(+0 zSLsnjo!BCsC;Hi64DNpNVpt>nloQasanU=z73YHS3@&r?n;zI|)^r~ejB_qpnOowP zFtzUF(CnGP#q8S1l!?wp>>$v>5{0q0I5%B+1wk2G-(9cL{O=KwZxDuUCyyqfB2fxr z)RJC!EAQT6|JmielqrJLq88kAcxUPn4i#27im!&c_DxQG;0>T|cLd_^;wN#grHSU$S(VkGS=wK74ws-Y12j zT2^=+R|2qBwehokVF(f8V{Q)(64&hg{4o|tg36Y>I`E_|D~?LJAA*dh5taY~6Nmgy z;_K!=3cy>;X1Z|E^u|okbL_-p{REB)kk( z=S{~!gZ`WFD0Jj6maL6hn(25)$;Z7JwF^0_xgwL{EgQsGa)Fds1w}+MXQDO&eH9!~HRw<5=U@Jl(h zgIAy1HQ1|hk@LuJEH#XZ&~JW5#efLvFw*;n0(nBDpcQFNc>~+z4~*Jhzc=En(RD3i zJF>8eKpo7|QNzse{(KfH)3YuKn@UBeGCJkYz~CoGLK`}3T%9F^#SkFd|V`6 z5#eM1*E4@u8}b=;lse1GRc~n{7hwv&P3tJUYQITkG5V`gM zq>t^$Ead^oZooJ3%_wg@;XnBiq{l)=1rpD{?eid?WD*|0_a!tXFJix<43lavFfhk` zFeuMOxczhL2>fhPZ#IJtICigyYF0IPVKDYkAjC%c#U4SUz&A+uZgB_XcA&0fTBaP*6gXQhr|NnKjeZM~ksM~YlzkBmX zP&=7|o|yTpv%Y+k+PTA>wVdE~mqZPCB=;8fJ`61LPU;O%fF1Yc7Fg{5pRE`Paggxh zp8mq9mwmbvwG(HWxkv-tm2cHQw*x9`6QMTCrO*_l}xC(6o} zl^Nk=@6nM}$*4&7c4T+#Jr6RnIrd&rI`+s)sNd%pmFHW})6buHea3xX_ch+v`+9$p zg1@P`#@vz}9mk2m;UEoX_eEgu+q`M4B{@&~%Ap-APtRQtLU37VU z4K%uJVi0s%_ZTtQe8<-Kq53k=~BsBo~B`k;$ePg^zI* z)MA)pd1rlavrIDz%G9}?s@l&wIQ8H`tG4t7oPj1oigF!+wN?|cd_3lctJhgOk_n#t z;`@NYau^N7B?-)Ls)%t`t1+jz8)QCb8+Fhu?fvwvNh36w#-)>I19joLhx00Zs7gKdvz!pPf6O_$E#45PD1 z8z5bTJicypCrg`}n!12)?A!K#^1bj0GsZD8wt-_N5~F|vqU@YcjB+Oqs4Z|GY1#EVKO59=%6a8|LR%;MUGyi)wXmu9#JB9SWW8O<0(x~W^7(-{=`@^q8?xku_+_wy5} z;^$Jw#1GDkA8^GO2+lwdHHdZbf8{_!1EHXu5;^W9@8tYi@^0e3VHtP>yCiycqY*5! z&n;MRK}&&0`06{Qa@i^xw?#TK(fF_<2WqSYa^|>gNTg&&W!SF#KFnV@0Med`C z_Y$Tl6eiGiD-?I2nd25?N0wSdX(Jidg{T4t`WznP<4xTycFdCu!t9)SJ9pxYG!#4f ztLxG?b^lMwj>HUBOCHjDE?2U2GZhizLT)!+fCUl70w#`kx0dL|-e5gfBlwSrt_g@u z5kKn~k96w12Gg{$CjMYfH&5K8uap2=RcNVYjKtMKS7lfu*(lFx7U-Yapk@y9};z_@H6_N-ft$oX(o+3j`unV zpN!y5CiY1A<=JF$UH(@sSrEhkxyJA{ zmg7$dg#f^7IjT=kY?u?*Zbvl8By4C^-O9#~-kWZ-MvJiWghjrUB5wx4?MRAtdEj== zZ<@vwV4DhxPN+M%tbKPwK6{<+l-pG|$9797D1{<%>9x5>!8kfi;3_fK4_r}3X0@^EN351NNU zr&@sa0}2k9Hbj2THPloWd@TNMPl$lLrc>Rt>q};Q=EUg&@Wsf6mAIIL|%MrKCxPJ z*&+E*r*5533z6r%dkl>LEm*>`BOnO}D2-mayU#yt8@Jh@DYu20M#kuEi!Vortn`|g z?(VaqNALsSH>w!_WQbhGUjbq59I#yuVe*3%_IC(`<2MFHpZ$jlYbr7MG!feGCHQ7k zrvfpE8>Xm7@WQUdT_Ei!eRc_(vJ=}IU^)P3Qk(l?Tv%LFn0K7l!(;sVI70_C%g$Y) z8DgDoEg9=yDk}e;-~VwI$h^2!x)1^5J%TBND%eALQ592|&ZqShzGD_nL1lPLTdLF2 z>ZA>?*j;DC2ViFuyaZIIPfHk-u%DbdxtRVpe~$>4UseDHuNg@P*3qu9zZr?K$y=`w z%wuPifJeFI?)-Y?3DlPT^SP@9G8`p#9V1KZ?%K3^uwczc9EfJQ-UF2;S$+O&Y%P2B zwwKUk6QP#3-r-u>@(z| zm3Bu|1J(?S}) z`<>Qtsk4^&rO0cF+t(Df2X3ou^qE#HgbbCd=n3JAE^0jA!(DsJO>Sp2*P`T0`ij>+ z-~ahMo7w4GkOp;O_*Jk=d&G51F6kqS{y~^RnGhhAW4rRz*LZL=Zc~zvdC3q~{3+G3 zGWc0d{)>4>u7117+q-}mr~aA$4gs42L7Ek8%-&qj9&M|AD1rHiM|Z({a3Q&;t#r0j zbrllfI3kF`3G63_26q5o{y27JkQ{!2bjwh-!Nrj~yf@^xiq_rvOHjh;6cEr~;o?bhAMxxBMs1w( z{W=qMx*kRXH;A{+eg{cm{OtKazGbBjEp}3N-OIl_kr9oEi!nJt>ye0bT_wgE(|Z^e z?dkLfv*{m$qh@298INAa` zJ#Nv*I#o|%42P(2wtT;+1&riMy&sPpP}H{|7cLj`;dUq%diYs|j6%mbYYOFY5540r z490`h)6$54XG!m}m`PR`+?7*PO;T^wB_W(M z+SV_EnKoRV;?^w|NO(V&ULCKllr6-xmfR*Rr3uYfOB&3g5M7+bHb;#zA4idYp1B6b z0biuX{fy_q>%i&y!~e|~BLN}0wgrr3LZCQ1_Z$A>Z`{Wf3XtZCq-X4370AD{3tbQv z&Yy5?$KCE&?|p{O%GV2I-)?r{FPl2$q+FO&ICm7He%G)apX!edl@ho0UJR_!GWokBqI>j@@)zb|@@k1iiWB&P~LyFow@$R$rHk zgY)2#+pD=$b=7`fDCyIGxy+xNhuKE4mF{A93EO*Vzw`()(i!DuDn^FVFOHblE1Jb> z;!!CK|IVKR`fmJ+R>W~nJ3eG&M>|OFkjC`a zsXe&LMn3@~dVR|L#cZjzd3R+TvGp67mvrlhIujNXbhlnCHOP^Fmo-Dqhc8NX0n)bx z&yMrP_r*u(-@hsK-04E#=B!!pm#klQi}*}se?OXEu-63IDz`9MGNR#-I20RSomkMb zXI7KfA4zd^1PDjVGm%CxMe=;8`C3G< zW+{TlsRbiUIdvSt4^QY1zbS7767Zv>pF~Tabubcz*tkx!df}*Evt^VyeKPg?k&s7t zqe`}BBg%!k``wLcUKsgIOIhH3kS!x1Rh=4(j-qq{(+$V@*G~@*m=>-WlGrcn@|_YN zo%i)u24eue^2c1i7@pJ4e%5c=mboil@j@I84r$^)66c>@7ij#Yd&=c1oIC~C9=zw@Tm&=okiKLfP2=KF+jaPYMq)=SuV!l+lwm1mo={yz5yBD{fd z-ErMOGK#p}ckl5&mGj*dY$tutAOqp@=i>G4$;Xd3=lf|qHVAAxF@TG2Q0v~9m<*yY z=k5OXaili%PGYkya_fV@x!rQHX)o`+8&b{gPgqzue&fC4rAh#~{Y~aRjyDF#1~9-C z`}Pz?H2gPjPLUsxCi=Rw8KAfj{_c_h2$4N=TI99~vZ!`-6l}&JFqM<0n)sCX)!PJs zBlzbUKsl>H{?j_@1k)Wk$%ZzBZt`PRd;PM@lKKCSj$|JU1EToR33~bSg8LSuf7@SekHKnF-iK z0k?mUnXAf$>WT=s1gi|WQy`t*=y~6I3BzlBWTr_gbo9cXfMs*hX?3HZAWcDHenw!# zJQBTrXOv^z>V=mM6izUP%^g_9t|b5Sj~dw@km;4@W`oquSl>Pkj6j~)Nz zExL{CUtG)8@xF z;!NR?y;iT$AXM{&5@uvv4I!7i;!K3YdOw#wY>L=Og8?RHi|Hn%Ve(1vn%gOd%dbhq z!&*A|`az`6=_b-#K&ov~5nPXgBOSJyck{vI-1ZAyHPi%`EuV5g*eXfigbr#H28J%FJq0gW$W!~<B6jA;` zNQd%a=ciL=)r1E1#lhq}iI7r#tD$H7w*I^%+l*b8fsa-AV;?(o?aD!fSnHF&=mmPQ zb-l9V)p*xZJg(l{iXlctYB{T#hksPrGUPdCy5zLa-Bmt~(f!i;rCNQItEbHRZ4As- z6@OR7*hb=P*2`(vHD9qgHaQlRHG8aIIERgT!m<4EvEV2F^l{5e?jb zwE_)1)=SHSaMNLB?TfvAwlf^uHfBE+accSzrr)@f!U&Z=-j;D84KEjy#L{w&E2Ngh zSpj|AWSde~`yU~S)blS`L-zIJvNp)CBHRX3M=8-7P>PjNfdf?c3z9?W!%|tT80jxI zqUljNH6{{^k8=)4dx1N{XX2>cO3IAI(6DYswcfXk>ghiFet`;4a^>eIDXQT+)QY<*vy%W0hvd_sv^pVGI_^t2>$Y{0zh=%B15) z=I>yOfBdbz4RJb(;t#3F383LHO<}z3wy8YH=3L%A>T0@GSn5K~Zu-aD=%4v79igK% zff_O~|BdR#=JqL4g)z|J(j&j3i*$RXct|>P4>Y66td$+SN1X*uKj1$(3#6$St4gQf zpF;Jt<8|CETbc@*h83^u*PTto9a7c&o6@0#%ax9=6&{wZ#Fy8pGQ*)d`td9I`$Ipg*C0Fe8ivmLgT74aB zs>Z0-lBIR zDbBi1WyWB8(I~jJH6dOtr=Vx|Y6SJslD90z`F_Q)A?Jz9r;(24GUOTLzjn(>EsOM8 z*DUr_SZ1~fJLczPg>*^AhG~TcC7oJ!QmvZ?CE%?NZ`1oY`LpSfqnve;trK`Y$D*?P5o^LMARAzt(GV7Lo+JIb&Bh9l9D7UCntd8=W#$ zJ})jy4@9@)Dk>_$-w8VhMO{ygL%+Dok73a&Qc_fZSoopxSVOhqN3!2BnW$E*vb%`y z(iQV Af0M$cj=(GGp;8_FLFUMiAhMlRAnjC9hzFMd%=I&$8Nq+U5TJ<{01Y~>j! z6Vr%A8j^keg67DN#OL6&#FK_N0PQEylFOhWaqM`|TkSD@GxcDRw?d!H{FG>jtzU z!RE1q(dVwDj1>i$s5UBrEPaCl>g2$h%?s7bL(J&|h6IoA6+2DMXqc=9aG< zD1&f31dzG{zMnXb9h z)9T*;T{FXRKT5^iYk{oig9XeZVl#V|HIu1yrc2n8aQ$Q^nA+(a=B^b!a$4J{BfSPF z?8WCoW8+%PiteaNHM2-HUb4JjpkiCGdzM%V!o+J;Trx%(2ZDsov#_xyIZ(5z`FPU7 zDHO++6%f<~y=H+UeL{sVnz>2meY{;fLG-eO$iE$ezjhP9A74VAx?pk>EU zunCC9qLhL#IKLxNR=hnnnOF)jX~k{stW6H8A9A0c!ig2=185hR$-X_8q{Klv**&?Z z7YIG=Rb;Ctv5hy-xY;C~!Gy%bujXPJmZESrr;U0So0AsGW1bWF1hy{Mkx5h22r)j^ zyz`#YXL-}LY|JB->ZEsfSyOkM{@2MIjHR*nav2Z}(8>_MZMnW>qY>@nJL;NO+JzC5 zGWHQhSf=W?O5g2i!0N2+ksZ}z=s{R%{;=NmvYn!O)Y=2Be@&*3<=hTM=qBd|T57IQX7{9NyL%yLZ*|gC^O%p_5bc>8AEe*Zq>;%T;cV zUzW~+F0dM|R-9+Qgo0@gZg~QvO_?rs1mvbAD_xgI%9oOGH+zJ&1P?%2)XJV{rpN|B zpJjmt5a9Wm%HP-32XB4y@^y#?T0T+%3?VL70GPk}A7Zz^d2K^vtw5>d#IQpX)%9}% zTy(%yy44YkC&t>HuW77BWuNw!y`=>J6qf$=DYX{lkS4}oDQI?}ts zE9!5zdgUoWAMeDt=CcdmqyuqfjhmF*)Se=a;C44$ z|3xU_7vSd4w3T4uT)s&0PIE5cC2Ia>eGelqUDqE*X;&e9A2$P`w&)l@8&GF5*v6~7b6-B0|!WLyrb84`0)aos!f^rY|H zJ>S6@@1dSdf0}dZ$=bE&llYgh)7nMUq4uWez)PM`Y4`!Z{X6yYq@)P|`dyYn2Plc| ziGM3(OVxB@6Z6I{QByC^&AIH%L^>~z4Udf}Y+-6#-C*x^RO}QKSpiZ~cS43Y?n{(m z#3<2?wm8UyPX2sFqy7Y~89a#}m=)H$Dspe*^SZ8`*fTMBNtXvJ=9IL&!M0io6kp11 zPyT3_ti}OsWwls;;fDJ{cB#w=phvU~&Pz%(jgGf;ZRCwU53nkQ4%ARSJzBauSH@IE zOovcJ8rbU?*$)sD=n_46MHvfsumyv=H^!8+q?5lKg%5TCK%~*v*H>oH)z!74qC&XV z&o|!KHD`|O4N@ewL83NQzBFdMp8{~X^iop({PAe1S$S+$6Gg6ezCqc-! zIA66r%3vZWfOlrFh*mIp_%JF3H_K{Po0@_m85r+#2AsNM4Qkhb50T`=hhmQehlq2- zU}ZM_835Mu7SRV1ylYu>h_>8ZY^VJv+H&i|Mo-tAp&)p$Bl0R)d12S1cdk=<(wb-A z90)uFUEmLgrD(;a56QAc&7k3&9kb?*U(acvgxxp_X>GWwd{6HNM4e`%+LX*>hIT%2 zshu=9Q0YTG*2AH4JHF&+BRwytx@#WZ%R=*Q#4Z)#Q|>a6ISU35lgy}VE!w8~^rq2W zM2VVdkI_Sgxt>)#l}~A(*Tw12-8-m-I40;|c@c>p8Tx3*PZD<$WZp#(1a+CU%x>Jc6imZ^U}Q8 zdt}@-->~>93gdW0F&ji-A5OyjVV*mctgxW>iU3Cu#kR_eVgFkPst2_~4`mmFcNzMH zt@iQkt3JzE8SZ%sVVpZk+D|2%e{U-Q$XL+RycV8tD5cn!UZ$8IPBj^<3W6JV?iLLX zKYH8x#26PPO*3tb6z|QkvF3|S zZe`KsVUp=L@tu>TLrv-zjTTeYJDH$^ec)`o#KX{Rqw)ukqcQz%oOfCH;{mcm(t)Zb z_MlJVRb@kbAcq&6W;|(^oea94G8~=ZQ_7gD&QXB0(H~3S6rDM>dlq*9IqRdjm^GpW zWqFUtLwg%U)be<~bQNXQLpwUer&!Qi2N8ebh+Z5PO1<>R^f@d&t5VD+({+s#f43xf zmAu+=o}4$ri;43=1U_7?*+zSyv3xcD3`)$FS}%@=Jl|&Z>c&?-FvOOm5LyeD_-&2md_P|=uMd#=bEX*$qO!V-(FvVox8dT;XpWzZ zTbkr!13Te?1iVwazNEss)6zpXaygxSv3oByD3tTtsM7dc$_Ne`c<)fq4)Mkt4R-*w z777N8p~20ZW}V2!NQ4p|Z`KLmJ0L{Pz8FmE zD9S4X`X~S0GOa32(#BW)MIYjQ zU2@4Hi>iEw^wELwkgXxk?9T6%BkK6K$BH|WF z29cDb0q(zfMZnf3|E*&>vt8|I{7jsB#+Q2~NK)q+Q3p5Im#cKUiV|F0-N!wS3 z6&~s?=@vCOcgy5jhOC7n%HB)dp8*MSj!DhBh_xrP9@rM)h>PV%E=&@-FWVANt1Of% zwMQIl@58rfD-61w2^eajdgp#Ix*ovj-u~$mC(7#0oa<%`Eay;R-TxUBj)>{HmkwyE z?PW{##_a|A6X`*daY#H!rI`1n&3?LHmV2NZdkU!(OK`RkNVdr8yBLpA&6RP7-DTiQ ze;VUoztjuZ>OQ_GKol&xzh$1Mb+BBi#g0w2=33n{->+!j=0rA-_Rc2XbR*SkAi87gJKeis*}M_h(}hZZZK zvUIl9GjOU1j>CmyXK9lh&{!b%QEP#{gq4QhW&9q!`^vw-54+W4W?_efAUjy1;9Re9 z1W%jttz-voy(>R;%bvXTtVPte`l8Y!*>5A|z}K|Zm1c>GG@?{7I$G%BuYNa!@>LlL z!S(MmNcCwrls03MrcmJ*ykcsoQSc#HkUX1X@~mJe%Q8?B_noryy!swp1*@G*lK(}| zhK_m6Dzw1lUvGEQW6}reMU02C;gB%|Jvh-9@AOL8oiLTsk*NOcc#Zn&Y_V~%PFuCW zG{EJSgK2;X&ZYOu0GX#UL+5tH8NVf^9Z`A7R*tr}GP6PN(lUr0j9O0l;Kl22$$GMgOmY$w*S6MYpSoyVE58m;&KgrrZS`sp)j_W+xU%Qv z1(){efZ3ShmTIvxMf7|ZJ~O~x_S{jX_5n=B=8PY|5>GXo)K4Rm5da3b!w+6W^$dvA z>r!wZ3(f=hS#ZcQ-5OgaiY7lt&Wby}U8Jr)OPa->L>pwk4YT7(iix<2Vf3cb(0QIA z`h85L%m#wzYtTF4U^gPph_aTU9HOIQ92IPxfSd#M6NIgi{q_6l@-w#sBvc&}P`{Fu LQj*LOH+cGgv1Ln= literal 30708 zcmYg%bzB?G_ciXW#Y*r7FBEqV-iFYYV1;6(xVt;F1T7AQ01aBacxiEWcXxMv)93s9 zHVse!;Mm)09I&sffkDH^D@H$8`YdIisKuwg1~tlemcJP*B_>RTbqR9<%#~ zPxcgBsf-It4p+|FMU-zcp@zYggn0?Vg^fD75HYsqbxxIx!5=1viN%5W)?iVukjZI$ zwy!H-Oh(k093Op9;x7%cs1-7&$k9zI5-hRj4lhG7pr#VSj}5h3Sy#S`SDEe>Q)>$s zWzCIelC-f)o?Drz3zjlx{enYxJ})mx2jr-;{GrAKHGdh7`e-u(T5s1SE!$BY^U8KT zOdQgRRrtI4eKMT7u-$Ez;vODwb;S6UUJ;|L*hjn|J{6t#&|dxc%D50>*?>ulc+Xux zs8s`J=>g`hid~%Q?|txHYl+6M9?F(E(js14EH7_zxfzT6%~Z}P)$F#nSJRIue{`}Q zkP!JkGBHu(b^x8f+WS~Mv~P>@{EJgiRsx6i^IE;okvzIv>CCX2`_ixi zL-ViUg}Nagx;D&tC{r84_n_;8ZDUza62z+RBzb1@Ss11__uuLnoW9j3gF?bd_PLGK z58oI*pFD3II1v?U9v@#?D!0EpcKxi4YWaSlXEI2qu6&=DynyqIj#9$Wp@c)u+9acx z^1i`R`U*}Q2Tp)6b*!DkpRSGleT{>8Uy%0wXBEU?v8d~6dt^@}ZjYYALW-@2V3kDX z!mLBOgf08$6snRADI;+-y`V~YU###RYR82jvC#9j6KeHtppS&{;^Eu7_+XvX#)G_f zwY}MYOy}LBwjh?4mh6I|)ZVd2L1A+o!V+Mcz)tTn`r&VDI+ukVMiY5bEsW{jsR_#j zLxmmK9@2)~g=*ec_3;w5yI3T*~5aR~&_2 zY7QB#q%{QXGR6JI5F%9V{M4i_HJ^34ic9{)j{##^yL3 zejbkMc}F3?7K6CUiyTk1-2R($bhzu@q*8=V2*Ol!!@!D+{dKs$gst%3!O5>FIU@CM zCTM0 zI6_ByU~B_R8wUQvP(2_|4BUK*w0_=hn>EK^?fj8!9UQ_pEY zr)kP@f_wnC9T>l@m%$8e@$vK^sidmNr0JKI);kI%v4k2r~IfeEs& zVwpr8N=Mo98TbEiO2QE7NlpoT-WM1-6BdTGO7SKzLyeUzko4K~SI6$EG4!j$1qqL1 zK(+tvCS%J@fBo;}^>mKiDZ4Urt%q$EsyYAr>yyh%xA~Kf%u5Y>GKHz^y9tpvow2pL zTIu(}8Mk!@{`bWklL~7F{v66J=)OK5VWxA<({Ae&9kt{G55j`t*Nr>hpL7kA3GAtz zdARKiF{(a-ihOu#lW@mPqa&O}YJg)qYVg6;+yYhKm_s z6?H@zEy z9J9+G^e!#w`VV_Mgi)K2z1m=s#WMLRlZBVdc6RO}R}~SiI6Rh8K$^dYm4;<8p5Z^7 zpEcc=P~&7%P8(_1+*#0AEoB=yw7aPiWO-?)qRmkjLPs$jip*}vU>5c^>ARY0s6*%I zE(0i(f$HuO0KGqAx==hPPTgmPoZVkreq}%j>K^7Z{+Qu%|JBP$U+U5iYJg0 zoyaQH<)$p${8~_oqOn2H8--VZ(epc3_TC1>o*&^<^y_yn+X@A(1(S(tTDiU%?`TKM zUCaHsX8g9Dv|~5k!ceaG;XL5C)Sug{dpzg%*!~Z4AFIYKqt0#Zd#M zMNG_#LcHG6YL_%i>z#j0Zpn}z5Y(S&ueFS-c9M z$L}$8j&F){;x@x>m?beDd_r|& z$oLl+KF^aWeHBoD-%wSJ^3KKtc3>?#X z-u&v1TC6i3{g&%4yAa6G zm${z?JN3BHLE}4Pg_Z>^RttU~jHiegz{D~Osq-QzSTQPDWK$EwQ+(qR>vm!;m!XU` z!$%Mu@NWJ$BfN8sMK417$hKU+B40LnYeg1J#OCH^|8Y|PFs9Wu40>WVRz>G`<-X)C z@z{<(9gJNzGmN+QyGEMMbw`ESFe(DjQAo>c+_FC?nZoc?0ws7l-YJYcRkyEBDLe%T zU3P3VH~Poj1cNq%-+bZ^=G_{$7l>3!q0BL>TGI2=wkC(ll z3qhpqlSa8HKNx%d+MosV9QJ&e!4Dco=oGSZa1;~@4*xcBke8G(AjT)CoW`HSN9%-h zzGg#N|3Q-C!%y|R-SGOv0nXCoqp5@YVXDHWaMVwo6t63r=elPiFYH}a#YniKuSB1~ z#1#)dya=LZI}TzjvCLRmk-SOB!~Q;$x%?ZU#kAT_XKKs~GI^El(&jza{6Oo`)@v^@gq@5Jlef3#xIfysk>GMAR30 zl8+=WQ;J5CzTp_qS~(koRu$y7hUmWUFf($!_+p0RiOVy_?aSt8{1D9zgdgs^sMu_L z9EdNOZAeSfnXmP9589xbC zN0}gWXK?3%xez50i{5jcKOqqUs_GDP{mS<0N~zu4zIY(!F#mUUf9q#p$ziEwrath~ zu3=j5*B72_B0e7r=9Ay8*Q%Aa2lr;mJPd>1hs7p$a!_sZ6%i`?EHyvG}?;BM@dMZ7f3BGkr_y-#EA*NFVI@(P2JK^e}qB1A_2N< zFlHT&H#CesEZN3beTDjvRPi7RIZkZDY7sf$#9-b#>;VX( zP(^@!qB5)?ghC=kE!M--h#HLB05O?Jz&<_A9kJqud5N#Xy22TGb5?x=xaT3-i2gyf@OW&3(c1Z?vkB&3`S3IT(Kz$#x-*_3MNi3|9Vqcdm%iM z+mknG+-tMl+ zGa1f6{5cX1LfNRypG21(Uv60+&UGJ`=@@s=fk}@CJr0pzdQ`P-j>ueICB^Dt70!x) zAKb9qs3t`SZ~6~f0NdDge$Jp`uMCmk!%8{_L3BmaTuPXJ;Vbotfh&16x=AaX3=7cn zKJa2YRSJF9k0`*zhxKmzkmKL+?890c;tV;g^juDSjfy1{H)xUDZ6c7<_5wu=Aal_8 z{P}B@qc3-5E!@ZG43Zu&zogl~@u|t|?yK;l{S<0&RVu2xmxGNBx5NI_J0mpehy#Y; z6`0q<_D*K2Xw9dsz$4pfAHnt0pMX`AqA{ z*V4rW5g;0tE?%d5#??wKoEDJrL05a#3yV+V-@OMfq{cxw)*L4oIi7xzr*1z4Hy&n zQHjehb)pmR{kF=*n=R}2HJ1@zDh&%Pi9iR^P3~9UHQ3kif2|=%URrX6;LkM`JQoJg zFe}cTFwVEZOr^R4|9lb0?MlucZJjlGq+%7(ChOrVxdFfGIq2L$}+S{OvZ z{kv`QxqQNXjXsTnI4M}F)I5YjrXCw{C!)R3Qt7=lm^qQJPHM_|+xE^7bswJf&KRZf zr0{9Md8|3{QTAP_6WHT`sgIWrULcq{GeeW2+Mg;DVFhHWNhQB*xj$7mzKIqwo*#em z&(3f+FYqJ)J_rHq_x>Z z#BIk`{1Tcs zQ5x9l-?f;30}qwRpzVGA+Uo__3>n|_2_BTQnY1@M(ogg@13vnBC^6 z^}v7VXKb$m^}id3rc4 zoD>frS2HS&>6KY5Mwn9OWd>%TFR@>=G_?jbEE5yauy!PO8IL`Bg~!g0&!wjP!>Xj` zaYVCRmn674e<&Z1S}qLGx>ZThut~ig2lKaGnfB?)1PoeSBrH{YHgzTNINkIN=nfDK_M@m>K%H@DF8)n(TP0rg4KEO~Tpa4Z86mG$sPBtm6+>|Hw#0G`?SjGu9`dKe&`8MZ<+Gh`bTtPf9{JQUdVDbu4XaK3siBiOI5L@)t6%aj*-lSs2khB$QZbX_63sNmPuEgCz&#)sKuC>Z zq8?};qKgjX_s-p@y6eXZLe^B0x2DR?u&`+F{AS-+XNCfueohwH@u+4vzejemG#bdeXChvg*T| zbj>5tz~;wJmD>;hgop?nMVYZ@ptDnXChUpmkWjV=;i!EeZ{6;8^uUoKmG5k zox-uVE$0px2#_pi-+0gH2fS>J;jsbX8FmmU{FFt&m6smub-g%Wv#0uv8AOQ(JfzY1 zr_H3Uss4^5@Car&2|AP7_@|MoH0i9cw}q!FKwQ$g^KIGpVRn!b8dy$;qg*#cub`=a zc3$wk`Gr}q22CArri|`%qhvBA>#82*`!pv>{Tc=9PmwMNsQ0l_I1X5GMA)@#O%YZk z1Y%gFFx_n@adkvR#PIoSrT{2$fk|WIxYj~a*Z<~+RF@V0dw<6LFq}@C42}cNXU^(O zD8&@xmRFvjC3p+1%WpAvq<%ee8AT+%STU>si(-a%mf2 ze!Ka42d#*bA#p>zZ8NfC1{c}*NO0^wfmB? zSn8S?4>3bG2T0h0ly_GWi<59$ZMpcsOgCRoSJ!WbJo^)qSwOq)$@VMdXTm?Z7&t)A zosCRl4*zSqf#QvlJaUzxxFO^kbVbj(=H=`5X}bE2XHd;(szDhP*I#N8-Q?J(6Gn&x zlN5}q!;!|t^QI2uQtu@Ojp$n~a?f#TbV4Z)3?8J zXrgncFnA4HhYD-kJgbapj0)laDXFUgA($GOR_luG?+fxfezMF|+H$2AT7$};355YD zd$5i5BLAU`O)A3gJ;^*UL=3ugk0E)Bj;pZuzS&5Y9* zXgPna6MOT6;XxSvYbFNpU%)^rzg*6Maik$q@P%TYysrAsQplJFWl~a9RD_S6ZuC+6 z#V2jn@k&0OqkZFN+W1P`km}eXyLOgvH#x?qqNpg3hr{hBHW!KqtY)U-LyF#17`aBNa4*&E&~mo7?=4ggr&yT%$Xp$XmDphn~MAlkf@5%Mb7UnqI>F zvuR3^RUdl>BEj~!$lF`dEJ;%8Z&ZaFf3JI1cLiB*W+qZFWCUOB?j|_i^h|_bW#dVk z$QwZJrjJW;dle^?!m_ED;iqESzhK~1pn+B>K9D_qzD?(snQ!kej>uozCUv~jMlZ|> zTJRME*hd^#d(ndX;(oEi<6WIZB3NwAGUF#p214Iux*5I?h6ffOpI!4Yz+zUR(w=Z% z%xu`Gc7D6n@<(#gk-f$E=EH;O76s#|2Uy2^4`3~-<>?KzI!Sv(gthV=3l#||sctxI zw)twftQiQk`W~7b1@%cAN1i5q6Z$3vX3cLp`?iQJbBg9;Mc8l9ljmsxBv@2Zw|`_e zx5F2onK{>*4BXUacl2yfWRORAl;>s5R~o`w&uQ_6_;{zTJ%R*x9-fy+@0&zl$qrWk zj7=bl6Kx?b|GKe+=AKVWaC;LOQKS!=;G{&%AiIo%F(Y4iT`j;cu`q~k7-i)2NPLglg0a!po=$hlexH8vzqftN=D!O;@<9Em;i~3>qkphT zs{)xTQ)DKU#yVYj`1PQ=x2dxyICMF`?RhWTaM%A-<$l=qhW>^jyXZd2zwFeQ(;psR z^aA+gth=?=Bxbvyw8bhd;Rfz>qi1YyTjiX+##F9l67JkIQEkLh;yy*k493TYT?2{~D6797a|gMjpqaODze#dL_!g@mQD!g4WdE)l;j{ zK?lE;%-)=JeeOUTxqM#QR{5n-ed@?(;OeCRU9#lOJ)Pu=Pf(7TY}7KauJ*32a|Jv7 zuUIzWJ$&^xJF$9T;Ux3D?cXp$Ha0e{w%!nN_{&)$dPf!GgF!@lx?# zmG{4k!|l4p+6OZwsJY)S8(3W5?tY&niw~Pqledggu#9GAnpj%W1}G(G)`@2=I{V8c z@xUib^{I(m!xY*oH|UZ}3|;O|@6NQPoK|<+tTY^D8WQ0%ePwYd(CFUS$Gy)Ct$yp~ z`0(zQN9Um>5u+j&E)1~E(M$U)-b>C2LKO#ExnZdQ2^Pz~Tl=OiK zlPtgY8HJoq$wYLR50yGBM7al5yKZEKgHB_vGixR_-EcjZ1`^>`+hHD;SH0&wo$e<; z>m7S23|zW)4>b?E?dmADrs@JAhNzz9KY4p&6S+241+d_`ku3>O7!YRtu2s`c&ju9Q z&{A474c2|rTxRNgJ(=YoY7-jmnQ2h>XWolF0;WlCE!oxHn3LUn%T?W9=Iq*&=2}Gt z)hzX`G)u59CYMt_Z?9IF<(drnQ@F~WH$akj^pKA_jgqcwmHT&T^Nz{nR1uYL(B&G9*@m z1Hc50M5ku*+kiSA=P1`VcNu&54P195~Az@MsO zpZ|tku*!25L7N`j#@_@TctEj^v)cXxcr zS+1t0CfAS0eLj)<^_B#EX~v>ODMtZhmPzBUhI|8q>Sf=qc!hq|=h$Zf-LzFAdz&13 zRpKL10Unl}TI(5`+O033YSP%`yqThLi(j8KL~Ib6-qofyD!HU;Has^l<|8I#YW{w} z_~GLEdb+*+`r`9cw|7L-I~O3^X^edJNmtp6z68Hp6P+;E6#6c!Sb-eTY$7F3B9<=C zFfXzj4i4>w9set)j^k>N6VouxvfbTX4x>`P{roRW8IPyqJqm&3*jhf#Pwgk{E1$it zL)(bRJCfV*GiiNvhVx|Ds|;YPsXR18SXc+S9sc7N0eJB8y&c& zrY89N>x<5XIq8R>rVT-1Dt0ku_&6^XVP1=hw;955#=}ciZfyjW^wXN9_Oqbd9V<_I z6K7DUC2iB&brWj$-ba&eVPf5wvRy1`F&rwfGkJd^mdExCmirINHbPGtM6H<%N9kIy z%87dCtwrdrajU1h^BJ{}e(_YPzQW-hnSlIKseh?U346~c*T$`@ySqEP@Y_3V1$2er zV3xlMtX(T^Lo3@Of){1Ls5uo=iHmN)8#2lTa}GoMs~j_VJY;~AD>8mtRtmOjX4;)(&7X1Wc?sRgB?jiuQz6_=qsm8;^#RZarY{^(RwO#DfL|c6% zuNSXxC|8Jy&n2FP})Me3Do$(!#h-@lK<#W{E+ zt}Dt%8Q*iO7%0p4%HvhmRL#BMv)fQN8hKGQ^nw2K64>KJsnK^NDcQFmi^TD5d{TFx zy~S_H2glH{I*ZgyRH2!y$>MkAU!OK6HZ2f!S0X)XJ+K`IT$MR50tWxM{t$}9XK+x! z*yCIs_U)}a`hx-!r7kOWo%c%}OZRb2Jt9Omy8L5ie}B|0pSiey+CqJ&tMm*>>o1Dux3v?cZnpl)Vi$`Kke62z@L zsotve(4oKuMlhM;bvQPZf=fGsEu+Kdn!Z=Dc6yG;ey(^Q&?OnUidOXNQ#)ELtqa>I zj}BQj73a9VT8=K93(=FBAn9O+*@Fj28i4ht%t^^|CQz&s(>pd|gHXW%6a-rV5Nr7& zvA;nFXyC{nXI$mGTb_9tqCR9>z|GxHyBNOeL7qxVtp`z4X9+hZk$h+xH^rU-kWD$x z?61X!ivj9R7nhSB=wBzSPxVY>ITdWcrC-$9c}X~iHdsR?7U>R-LuZ>U9zC}A67edC zPquMt`Bb5cNf&}LmpP`cckq`e+x7~q%97i$J&6QS*2L7qq#*T@6gEaG(`*Hu-4pEckgo1`r1~Z@rB2*HZF=aHQ zqdEiU-XXDa)-D38wzF6(=T)NNl^j1LJfSwbri!m;LzqvdzgHR)$Q9Nh#Qb+lE9{=h z0a1ancrdk*xJ29kTDz@bIPW%f(bSjGDAs2etcxyiYy@P41aJ?g*;IU;Q^ugw+_$q% zn?ieMog&!4RI5CRiXix@`ZAqdBx4TvyW~x~f$m4Y&2M2oNjQ`Fgg^H*ShHTL5CaD}mGn8hm4TCl^awF(}urIKgGTwiOir=t|2 zY;=n;KhrcbV;cuRb{7wUb?!g>vfjP3Cd&S%#xvIcBbh~-qjA#}Az|GcCZtxOm40YK z#kFIkp@<7Yav&W7{R+1s+*+ZdR48R*C9ETr8Co5l$pwL4qMSsIQ$Co`J1TSBo2t)! z8aq0KxBNpFWd01kZ%FbXAqWL1%b8@0^c@T&MhHTL;-;lYV!uav0K`H;jj&I3$*89e zYpdEHc(iz%w&cF#D`Gc~0+0WGy=7VFx;(zfD12wOcy=@M4^oQgepLuLA^2QVs=QCh zc-FZhB?G$L2yaTH#zmxy*rS1aNHWBj<_}lgh=u>r3=NKgP{g#SJ6of@Ys=N`bE$m<)lO&Aq84M!T$>(Rh* zqT(%d;}xL=%n93e`4W~ZpsLy?wDabA#$>t zHVHs-uiq*Z)j0OFW3H~(XTTl0yz>}ZUN^qumX+kX8P&{lPkUGGkO|GvS|CnP(frWP zJMr4jOpZrpWm)}0RafHz^M^>QFp)(VppNg4N7{li zL(!UNJzb%5l$*!6|CvmN_ndoFQnGy5rM~1TV+gF68M07%3yypawwuTv8`@WU?tAF! zOv4jXI5*wvqj;lnSTu&d0N>*B0%2*I;uleBWS1#Z0x;$DP!S2IxowlHZB-qAZ5N02 zR(JJY4I{&sR0nw=b|8-PwV52wFERa;r``Yx1p-0XS?Y{XtXrD|WJL2c%8uQV)s)Ty zf0msGRzVl$jMK{u$}dOx2kU>k!x~cwXR=r|YqnFBldhOcvTVZ^A+*Ac1=%eu9!zAF zUOZ5T%jUXYdX#CV{ld?JF1!(7*e%7D<&-Cd*-huG!`kOrn}BSj^O$48NB^b@S_#IW z!vQb207)%q$m1E)#K_3W-wr;OOtHJeIFSE;-D#DuoCa^XOeasx-Y&fS}#L*vRhCkNMR2j}$QGOfRlK2l_b8Mi#u+6GiBqur%L@%V@cRIl+y7{qAiPOh$)3OZ%{!3XNm#0vC@Qa4J#7PfJ7(4AjP@{@U%N%g2~k#gTf+Yq8Yy+qXBsYuuSg){;8z>U7{XDa}r?RRjNHZ$l`$Z zk6fRkXi{~28oC(&R?ti%RP|S2rim+Vj!FP>;>+C58-iQ0ZVKmLCRb(!SN|X8|3V4U zRT`$$rc=krWOM|4()K9@7uo-_{tNp?e~*Dk>IO*2!Gk6?f+--1@(%efPg3@>(kg!$l4*zp+3wJy|?cOw{={lLHAP3Zgm` zGM8HW`{Z|AunKKDt$SbN$(aHPK#4Uqi60I!Y|+2~hrCwvh$wg-Kbickj3+%%5Cs{1 zNj2Qj5FR)i7(ju5+>l!%ng$Sf=M+36f68kPg$6fN`Uuv+%(ivSxMF2VDw7U zT?JL`PUn68MWD@k=uX+$c(UdCNCBRwE2(l5a8y2PQNLm?-hl-0q8Q-1Rp(8w{Zfq5 z6}z2C=>$%uw(}_l4fsV-GMuCx4Jf5UhxgKfB#57tM8E;$c)al@=sKiALu-&A&s+_- z_)Az^Cn?V<=ADVLRQYS}WR<>cmC0Fca(GAqK@7B!P;SPfk-GJ;Y{eiH5*x*lZ&`P` z=7taV5p=>s>cBB9+7LdM7mySc5!Kb7>Slq^FrzbiR6!@!MK7bTskEVVixWt z0&+Osna{3~)B7s8z0Xwg3fJh~I765gZ$@pOoUg%3cZg zX1@mrdFl_ba#1a|1&(w{AgO773W|E)+mQ(POct1^t>yz;O?c%^j?6AFi#p3A%jHOr z)F;6(7lrpuO#qmfnDU_lfC+p#l0>h6?EJR{9iqXln^4yjTGpeAn*&6aHk_<1$)x(q z-*9cI?6 zlVFt_3I_^ZN7*PBE%e+s-zuX~IDaQQ%12EJwS>04#t9mw1g92Z*qZ&bAL%mxrCk0U zhsPDHKUfjqBA09vqvNq~VY_)z#3{8MaPU(lp*%^*Tr&pK#Mqc18*JA8Z9ngWjaMGq zN_coqb@;f*H$R{5IuVNpy()`|si`h>#AlH*X;)TzHGmN5;oGtIbpn&l*T*Zqcb8)B zr-egV(EF2tf;A?kH^So=l;zE1d6#X;Uh$9i3I~-F6Zmf-Ek8XrN~V@NdNAaAg2#7` z{8HS1TumKKB3s_vw20G*)2MfR?EYTLHz@viT($H#7HzA|H(xd{T{nq_5ZvO8+_@2X z7gt^BQ^N!ARB3e4T1dlL`sMl1>nT^UN;h30<#D^3h6o$ykd% zbQXQ#Ytn%(III&(&^ZXmy^aT5sHsntU!FfXt6x)Ju=uxB+-bk_J8rB-;m$vKgrdDl_&3pZn$Bz1!;E{Ge2{zV6=4g zLei&e*WDLoa~wp*<Zp!|ZR%6k ziwv_qtqp!h6_fAOrCCE}e-&d|l3}nBgO`jBI6u)nMQ8rCXCNN1-|8!UUUb zj}H$IPf!1HKQclqDJWpCBqIb{(tT^vy&3i|Nf#c5(jR)*SO2B9zJdZMbD3exeT7%^ zL(7=(ACo&8?6TWnzd=sk^Q$I5Gvc|@B;(`Y^Dn6kX8KbD9d8R(>0!v9KU-v-*^*L8&V zZTS^4v7!*QeScBL(M#Np4vc$U3quOJl>?nV(5}P-uij-AbXGligsFp)5S)ijt$a79 ze5V!W-AZt^&$##ar#_)Rmg>Q7q@$23>**Uct-nOwMcX&1EmH@D4E*u^oX@7(lwf&N z@E9_pp~A_ikoq2{_XX%-;g)FYUmyg8QpYg;FXAD^Pmll=xUb0%v!Ra}JC)vr-Wn(B zDIOJGV6<-DX>~&n&dkh2re%}TI25AJd$GWVhKA&M553np0*f-Fhr8DW8)G%)K@!M_ z0?NmOw>;kNMOFkB3C$Hv+AuJ-G&ybbj&<$E>~U{jbt5xWHvYa|tnQNED)di9U#$Wr zrHk!2W*A>J^iG;LC$GP4%~70su>{tvphV$))y3bFaIbrfK&7N3?|T;INvkS*Trf=l}A=~pj4 z<}h(Pq`zzj1$jm$Cp=KrdaOfDW7vF-luj zCBLj7@k}*WObZY~{q!iF=-0R=+{{~#_Zkya5m&1?L>Q>{G_*MLIQ?e9-3M|(Y&9YC z{fC-ybySE8S1d&;H8PiVS^#{TR;J@VdI>H2K5^&u~168rxpTGWII+JZ|h^fw!75XSf)tp{I>we zv-#~gDM~_BDpn@*f%v8rYqo;!Qy#&EmM1VvRv={fm?xthMwUJr@gZ)O43oH(R8&77 z9#kos7|jB-RC1b&uk+4wZlsIv%Xg>!*taw`h@kT56p=g?>~cz&7^T{x@_lhaY)J6gU6YsR|@dr%~ueIvS@ zql}eIuOiL`Izr|;FWb}KYc==@fANmh^(>N+v!u?Pq=7sHS_0Bn>;QIXWI#g48K=LlSzALM> z!ux87P}3&nSz*41yL^lV;o7wg3UvNWD28{7Z#xj9{Wc*yg==9p`7oYH@~ zF3+C#97@fUa5Izbb%H{hesZVv=;1C|%qGypTF$B@r8iN+*>{V~I$D}PSlIRvBWCud zw(R;BGt$YKCjOMdba>&+YbkB+XeYO(!{DuauM3W&AW}y$qn~zioOd;WVO5FDEz|tE z7QK3iX1W9X0BL$1r=&QhvNz#|wjL&}zjKJQAMg~b1<6MOT0Rt(wI8PPsZUmYwMW=p zjfRkkJFR!$RYh}XH=SHYejKR#`f5r1e)6e_J?)1EYTurf1Wy9&bOW<)WU%hjNv{5# zmDv%*?Zj;0RQr$i^P-s9WJd5*>+S9ew)_0Am&M}ZluWvKU_aU=($&mpxoZWeE#I>i zcqDZA;$*7Ih;EnvhQYPmwA(3td+fzu8hPF;GP%w zeEuMQ6_9zA$I zfE*qnI`}GooEi@O+elWl8QU4~meZOg1}eP4h+GN7`JI^|FF=OP$Cvhge&x>wn{Rzj zE?TIA`i`Ut;o|bUm!$**1P5V(a=U*;*n_m66H5DX|C;r3Uu>r~dR$7(fj`EqBuerHfOQh;&OemdN?PS3nw)Ffvppx}TK4_*RqCP= zw4L5G({|ct=hYz@w4(5R89z!I%&kAq%z}wtPQI@OcW7*UPJ7v*XzQknTkwNahdpMq zWWa%H#8J=GkTZVvL-rMRMsG(a2i429g5S>6g0MnA*QQQqsx%!1z6Y(vil)EA7wZYy zX=Ch;0c7NJ^l>9L30`L%cf8rZj0xT?K2}_3h@Bh>avT<}_&kFN6sGyMRkI*mM9<~} zBTVaI@%WtLtg^=@FzD;9&sY(v{e~`_6p0jU1HPsfF@Q-*Y8(MT(lt7{Ygtb#J{H)* zea2g&f_RQGjx>aV_V6If=GP~5#E;*B``*0H;%VfsY>vgZAaq~f!=j+=ykR-GGKG0c z{WlEj?WXe9#kqKz31ih6TV>Zm?zX2vr~C)LsMkKAU>s0z%iCf~lyfs|a?!4Da5|BumBmBkMDOcD`McCx=SU zXYDM`+4@t#(7>6@2nREp+pn97-31l=@o3;YOrYEk!$vnAZf;gfgGKUNNf|#@0Uy7g zdcQ_XXDYUS4<4~O*(mS4ay@*tz*Si3Vd3^CYrENS1GjjuI-?~aL~!sz=)=?t7^fra z#Ch5+7mRiQq(;Iyfar*ppbj0XVw=xO-yG6f^l={zg@hC~`D8Hz-zk{!kPXKpqBH2z z?M{V5pEq7zW;Es4N&l2{q!+3OLi+;e;o?Q0!cd*+X)?$u5 z?V8-I=K~=u2Ic3@7F%Z&1f(QyvUljyg^fp>>yS6{nWv^u#4zD%IEWF?25k6k{X)9L zQ^ct!ZSmG)=@M@@?=xj-e&iGcKxSwM@ewN<=;&ZsJP;){7zdPu2hL*$ga%L`(aOUC z_GcgqP!Xnesx>0c!e(PNm#FJf=6jQ{R1-o5hdM7=YYHYI20fBAa`J)Hm*tZ!)t6i- zh)U$0Qb9}gg2YqZBYVdz1i@5((!`jf$E;m{h!8|iOsY};-PqLU4;TG*4I!A|iIBt( z32`Bbf*q5JJb!cs=+MC%(ePVAXT0ALa_wMKoY@B6gF%mv;g-E$5GCL3%3B${EUuaZ zU9qs?YV@kA!g{dy>@hUuF(JZIsO_KJiE58nWr`FmaDEsBThMZzT3?}gIsT|2W+ChA zU!6czbdKT4*L7o;L{e475?aVVZ-IJ4A+zpkbl@6lfCPIA! zMLk1F`@Lp8^bR;ne&QFQ640};j)1586F9A{n+nm>?pldaSQl)3WBJfKMTGS!H#>?< zm7SydbCe3%K+N*ntA)Z{&B@!yfIV1*WdDe7>i=MA#Ia$_9ZpIfgUR<`0m zup`$a2#^AX?*vw!Ha+o{eiVkOAfJ_#@ZL`UBnd(9{V__}_sb>5zuyjHFQL}4T6K54 zi8C;0MSkPmQuw%*^Y;MzrD#FQaZRGawNw2((fX5D9&Qau-}J0$hbeC(&ubCX!&(z! zLD)E*29`ns{Xs~hj-gb-fZJ-@r4TaPDtx5O1L|Ed?kF*4J<(W^j_GylB+ZWW`WpJUQuPQk z5vLk81$$*aVJ9U6*#ZXmhV3fV!2HOt)Oe-%pQ1D%B^`ALxar%9np9cqnaSF#ZVdE- z|2*>7^315qUvsyq?~g|#kpfCK$a_Hc0`n5e7HDaD05L%T*76?m1rNW|M4y-$(duc< zo#${OR@lj*2A|nO6|@je+9wB zei7HUWE3UlDKu6#9aok5pES(fhAQYku-3HWkNJ>W6cDAup%tjK!~+6~AT%}`>dPb{ z-DbyB?J#Hk;VPp(#aFF6+K-EUcN>!+_TnSODHT$vatenMP~LmkI*9$OO|Z861L7ab zk;3RuY$AMGhL#w~*02|12~DA-UiOU1^OY@-$J&dv9ot99|L0>0C6@HI5CG!>-WNKg zH$QUcr|58 QYpkEr?}bPSG8>@-Sm^5qCH^SNUdSS43#Z^y+g>-{G~Z2q8*MlCnAal}C@QeO|>s0)KnHLiyEeR^jkXYWvy zm~co2(Zz!%i@$gZ8YOLh4`XK;ZA=k7SV&LrQabv{$?2p1eAuFtXYK3PZld^DIx0vs z4a!!mR0LHo;wFNiEqDd5ORFH*iFH3ALma--Y=cHf4#wmdkJa{;E*pG(*9*s1ud8Zki@;%t4)3u9GWapr6~5 zi0s>Dl9w$I?Hd?y{`2jXlar<&w-NZrVl_&~r6U%W_2CF%8V@060gV>pr%{9u`#g2) zfgzi6^~~;Uwg*$iQpsBd!*YED+{V<0Z0^G4ZQVhmRYqp7pvicEcCfnJsC!t}v4C`O zz?pdu5v>RP+kHBZuW=wO_$cD+!v7ui#ly>)Fh|_!E$y2g_u1!4*Q6Bip@g~w(4>

46yLPj@q!9cW72eXkH87>`A0e+q4kZKjPn`@GPw=^`Y}){IU|N-CkO!b)Iy-9EeO zBjBa41+w;gi~ULq2M$CvYq^+;c+t7^=dx-kD0z{}!!*G$$npVI3AbTy4F$d^FQiI! z$u5^uz*8+-@6fJ5_suQf{)EtjOs90I%l8kRkoTnrqQ^C(CE#&rVO?HIT4{E^sK()% zoz9Wk7PT|a$2`$Ctc`i`Wy1$~i(I`0dRF&t0}^gS-PV|2NNc@5nr=RtYM(0x^y;Zp zP0+ytbAu4zLwwXE*0ZwqmVL+$e)vCWT9ThOWnvUk-rZ}uli z(v0C)y-udf7F?{ovIUJP6;|}kp%Oow+w^+hD!O+&*^CPrif-!Vbxww$L8B4TnW-v6 zb1ywsGvZ5h)_M=HGhG&l#}l`DxT}w8jl)0QhN9V8ze4QpBKc7liZ(kb>(5pmWkQI* z+RGJuNYTlXo7-XcHBADC`inML6QCR@t=&o1kEi(Yc=7~KqTJJm^fmxm77(C;oU!d? zg?LXTpI{fyT|Ls!xgJ7zLsM)7ao; zm!5vEUJ>q#ZYPu9h;MV00k!Q|ue)Mz(HjiYxTVBuU4!#`auStld@#20TUD*ygbqp} z`xHf$)AkWphp#9E8;A+y=;wkqXP#PdHeMR{c|s!PUx0a%Eo#_8KoO< zz5rF#)+Rr#Qn2ptT~3+FkFAqs70*i;VQ;{>Aq+*xWYwGTmKJ$e<#4Al!8n@&my~(c zzR_+Gjb|F9;P`xP>wV6Jjj1TDSSLLkT-Y;?BhS zeB_Mgt|4Fk@esY}L#LB_J=i;2h-FV0jNDpt=2m^`&Upr-YAB9?rc0n&;y@6>YNS%) znP=k{EcooB@hLjD)N4E0ivBUK>awN{lW*dF+1x_mHNxbTFspW0>C_1OLkBHludSnrxwQkUeY%da5!TxhZ+{l}!93yf05w7@e1a0zj-Vy_1 zsUf6ez3aauSAKzRIH3y#r2S7B-3O5RpwO=QFp-znY%q0HIcO7Z#r$zwPPy0EVttE5h ze*Tc#<0+FF{!9Mt<9FwA{(zW`DI|AWArKLf%!5EDdjm|;QF<;^2QQ=B* z6?4&xH|t2HIC}U42s<5W(ph&AVzuKa&lhs9KreFShptlv=BGY+SkTC5F40$aP?gN- zVrVrV^pm>B*yy-p<io76>)Q0<6x%|(=h~?g+T*Z2k3iq)A z)dy~RW7bpqle0dis0JEzZ}G-~HY*mp0t3*f-w`G|x|6c?=L1pZi+2BWuNmLf<)76- zu=40u`_OX!lCn=dskVs`%qdC(BhUVL4Ha8-_qZABPzc)yF-fI;UfWu9IZrhC>W!03 z+lh*7H+Gqt@oKmg(dd$ni!OQaX>9dExsz=rv7&}MFV54K9&lO^tQ{A8U(oc-_Bu2^ z?J?4ClJ>K6z(rYSS|=HC9!6lNW2Nztjj%G`nil(oEa6vs0w@>XeF(KBDCUNm+L^3C zn!oY>{~owqK*Are6b*Uy35d&(d-5OuJ>=gF8aYf(K$VFMBJDIsmaknC>1dN%5~4M{ zjGxWMy#ixM+P%uWTg{zUd!}~&{$wTr+7gmJf*a*V)_l}b^w_8<-KGt0N$ytkmS?8&=3`&=-x!_oZL)SZ)B`m&)%65uren`ofG*;I?_B4D2yCN42 zZ5ubLe3|$ATcMP54UzTsTO0j%*6oV=fV#ic?m)e_S$*2dYnVsG{H)P#cj7b7$-5%snT~p4`TGHnf}B9v_}4RcH^>7`Ue3Kz0DJC5YW;V4$Rh*o~UD` z06pga9N6d~mlW9VgdR|FBb4XXpQqn@uD5_Eu*_lgp$f&{S&cseKk}JJ!bWk?CxOho zRv`F|Ulc*33ZSD|&gQw}p7kJypNV|NWo1fAvGqT=JCJ+-de| zrB#Ce%Ca-3Z|brCrE?6~y3l{`tPAqEm|hFKYMj}OF~fAknA3I9_^nCI-47Z$JKCHI z(UCIElWF=pn0sYW6D zM1PS@uXe^2(y=(ON%W$E)MXZDI4qC!!=O9QeSJBzus@&X7j1_Q7Ye{(PqT-FdEC zXcgj(kwKr>bi;{8-xD6X$!f=`&x{fbWZ^WLDRr7&B9`_1%Yjo+1ZF+*py2w=7^ZV> z$t=}>ReyI(s%(DA+~kVe?H>n`Pt~a>M{@T4=Y`M1*a5Z(?QA~?o=51np^XD}Nt;hn z=Y}^=OpaqrN90un`!bJFrcoCIX9v>T1K_6Ww;JP%(I3`I--hH|od%}Onhg022%aCw z^+2bJ$KDPnkxI2*WK{S=d1sBzXH$p7>zEs>-nP^4uJoBV1!<3z3eL{xjDKXK3q9v}S)DU7M?OOfZL1W<7#_1pS zYlE7(8Sl#7><1gWPM1w!0eJn|xUR*r1Dyd(2#(qN(r5?Fr7p`NwHoU$a=eZkW2d}! zmo^WvNU*8XmP|BV?>`A#KhxH2MYnItWF}QeFMS9WogLsLJo;yM)v-YG{c8#=3c~QS zsnNiPXqgYOoi607S+meZAAK;%bd@xG#gKz4}~WMRD6-x9&A4Yu?uh4 z71(JsRt+@|<=(4_`g7bRt2Q#Z{~^7mmYu$5Z6!eQ9{2Y8xY~)(yln`uOb<$lQuH`F zl4(5dx~Q0*)30C6e0%?;h4NHRT5tQw*2F%DqutI_s5mD z!SdihNonBSv;FDqI+HblIj>)mjCHTKy@R?us@7hg1fxB)eXVXb_gHCg{Ndu!U`x~qJ3@6`xEYAv6LQnH$+**H!moj0xC!~LYgqH>x zp3e3(C&v079pyA`@;EzIm3qMyj=svmv-G}MGqML;c=-P)hD5N*WfE2M`D*> zA01-|Py~1Gj3Xwr%pUr^S+K{24)kMi!dbByVG+b$aJj)3tm8&UP$i(Hr!@cRA}jhX zwINsG__~g-U}NK^vQdTV-5N`YffcaU9tTv*~VXN5Ck|UOFY3 zqwl}(x>CRPOHax)?po31xR=zBytvO#mKn8pSlD=bmCEIS=+VseukpJUtMq3e>T&aJ zu>0X*4L#4MneXFkOdW}6g8qUwmMOXSAnXQDmY?sJ-uJ^U@C3c5GBdghECmH#a3K7E z7cO>XDDct{fE&f>f0RWjL*_gji1BfQWZNW#JIIzcz(Hn>Gg`UE7iL)ON%OMiS$fcJR1ap%Nrrq&7bS>r&YSaZB7%Y!<1B3O-Q zEA>xdnG_o=;jXX6_=6=~D7|o{?z%^}sL;_TAM&n(hofc`>RCx+e~z}!@N;{r@29Z( z@%NKqt$X|4Q5Y;&fJWOnET7eSef(}SzP3*9Wqw#UaIP%TrLK8V;;dh4=3iXexqI@) zbUQmcd_G6W8WwLGm#t6xb0a0v)=_u09wzu^hf;m?b^mh?HTE~f%6Za30^6Z>3&B=z zKCwYOic(*t=`zxp>-I^S71&Hz7j0{n8Y<89Xq<{x`mGRCK5}8oBHw>VoI7EY)UV=GvpOc3y?YP3$Q;5w3W47#37H@N#-g6 zQimk_o`-UTc=Jz1!vpV2C#}hWRfBDjcSd=(v11%BMD#Rr2>em`w-HC= zyyHBP|A(= zH4xDb%EVLl0>2)j`ZHzBwYA}yna$4?8oYLo-${Z9ZCx=C_GfQo zx!KPL%I|}zV=>+jU4f)8EIBlGdPR;7OnK^ zZ*Mz(!RLAfQu<~6;tvTnK@``1pjyb|Ggfn`Hmz>9t-RD-W8TNKI$rdbo|Y?LRS*QM zBu!7O=KA{<3MFcCaBATx>Fc81?oXAogn2wa-cEi8XBD}W{(OL`-E(0kY7Ru=W0LM_ zWk`Z+k59~Q-DIJ`V8o=WPHTvcwwKq*LTk9{HFsPnYiq*}fAf+vkAoKzW-W8>&*tCp z^ks77JbnLP>Z2yXK9%N+tT^vJt*E2g2-~78<+zm39F>1zIN<$kSm}7HiuSa@)YEIlOmT!8fnWXMB1+E2aO~|CGyj|H9G&q#hQSG zrKOvI{h^DBcm=2$^kTmXh58lnd+p9PhGcd{VrKnMOa&e-$()@GTrHQXUvKq?jjx%T zl)1dztDm}^ro6U1Yb!mYUG2!TRQYDKTSu7N>!|XD@|^uOZZ38Fq;cN9UEceZ|V;4%fGdeTV8knc6pV%~vCPT6WRb`@@tnNSD(?bl8B* zoW*hQtDoIEBpf5sli%&qG=`x3+0@@SoB?$i-!K_tJw1Jcz28(i!3{ zL!LSREp%z~RqA`#=9iP$nrbnIs_;!RrhmkWcl$W%g;=|bC6f*<81GbXFEQ+XbC)`=eYyPha~jdN z3*$0YZ{}Vrc3k@KjlL6)nXf6)CkaxiY$4{2M z?)<6{P6+Xze7m6U7Ru=b3~4w2`A5t zNdd_%1|}Nj?fb|AE*X&2_zMffY{r*+=6WdcRast<~O7!aG_9>akHkQQ_ea8DMF3 zD$dOy;|tXt@b%GT$))qqVBPM?)z#7;Zya>nhmn}bdxXG1gHTx@7-pl8+u%zpW090) z?RNHi!a=EW^m}Rid{oNiU8Eh95!F=_!a%fqLfOmWZOlv?aqv+AJ468ii|EIYk})g$ zt)qUe4#s z`YW@O(cOlQl#((6t;}QMBK|POSIH-!aMcM;)%#WxH^{EjM*Ae}g>626Y58Q>_613t z@tsbnkSo`U2CY^yuWtW3Fe7>|3IC~_-0@P*t%;vG%{H%_=2U||PvTcm&HX|Bf*88) zJ4n_3_FB@}_40ls$!M88;K6_3U(-7rD>0Vw;G>DYZ$@1d)ny33z&S163F98H1zABi z8FYCZFgPIn!F%o)L^f;bbo|?%yO6@C_kn|l-Dj_Di6f zb`r80o5xP{L_#Z`G?0OgLj@R|SYjEY#vI;&+EpB6UXQ!ay*eF{ zjR!WCOxF~6RK02`M)Lz~!ODJ@q#7b#U@NO8H3$-J!ABEspSKe)m|>Lc0}83(Eb5Sm z_H~Sv_v3A)mZkkM)yT~nb(gA_<4^v+NDj&8QM^|zPv1H3B=PNwHjgz?f$8f2a~_U} z6|o|11R+$xWpDs03RScm-(=J)+O7V1@?`Nf{!_zeY2yjjzhCI=*Zb@EjB-BKFY#@1 z7#(KEXi?b=Ov8_UPxjuyp}|2L1W}d6#4&B(cXPXyH|?|@o0*(0fCnw_h3mqJ`4ZZD z5D$3`sGd^|rcf)uEk^Xz;ZVQhWeJtDBVb7 z)#^l}jtZCu(MD&{>Pc0RX%J81>mU1}+yNk6b7wq=h8}$A)F}<)Y9yw7FP;o2mfQm= zO^dN3S)Gu$nso@V(Einr$sqxpBJZhW)kvYaO^?bpRX*ZCq&H~SP_0R_~}gN5(5-d_CQ#0 zpo2X2oLaLE*DfyAZ3fy((>YSq#fp0o4{dwwgXIb)M5Nx*rDkyYbAKjm{W9c;g9a9{ zG+nEfSl&U8jp;4&_qijXTt=K)701X`QkmCsFFM*eze!^gNH9o=%f7zY5QFx?rv(G5 zbAy2m>Zop^%gY56kP(yJ@ktD1^4-k-^jc;ML$t_*KOVU`s#h74#~Fulu7z43xWU$A zxZsI;R6V*AmxnL`F|A1k2nOo3Xu+@4d_tehA~}(taiBP0TY(@1SLwL1p`q&Ag5qKg zK`-j!_&f$PLg>Rk@3=dZ>?zj6qHO-KM-eBnX+Zzz&>oOfsMXVg`I3s@&9)CGEWL{? zs~-aO)i_{xkvqTv{mu$yv9OHZh(Xybsq#_wZ~uO$D41xVtQlTOg^@tka}1E$#aDr0@z}Slo8Bg(}K9@2RZ>l5D*=nQi z0|X$Bb;gtB5CBbJ#*72~jUYgCk&3f-OC%S{2#rTW<_H97VBw<+Oa2C1tEPBY@exa(j{EoJThC zL_?Z1jW(4|GYW0j{U^`2t z4UoBFqrZRua6w)hlqd3+02XK9LfCIXNZSvnpSH*ZVGKOi_T{5ipT|bgUr4jVC7~6$n>dSu78e&U7-stb|IM z_pGd}!o;v?B$xczQ8{gjVNSJ-jjjEkyg1Wf4oKN7&Fg+TM4pBiwlepIT_XhG7iOh3 zz%#dbn6Yu1^$s_X78z~2|5}EP)_!fwb0L}(e-zJ@LBN5f?Z3%@7CaLLLuh7D)#jgp zLpe95jO^>)&?SEPAZ;)BoY7=hU;$h7hDA+IhXU1m5*r-9W_kZ6a+pz{sR#Pe8^qE5 z{LsAOj1G6)DOVMYII@s0uSt zTB5AVzw6&66V!c1sX*EFQJ~6_5W4R@GMW*B;ReFT9!eaBwNhSLO_Q@8Cu^CKC@24R z>$@D`SX|ICn|vgwJzwO;47nHduFz`S1@PWZY5I55764A66glo{i{QwoeGtQ&#F_ep z{Wo0jhmhx_hFZ9*#ckP}7>BD#!6`C3a$wFb*gKYUyM!U{N^m90AtrYOEbp@WA!ypZ z!Pnz+Q#h-h&_>U~82{_yTPPvKJq68Y;*a8@RU6b}Qx#iSmuNk^C590xdC|Yesam-H zFTuhntWjAa%P?sx5-}6|3Dcq3w0-@0F0);Wv0j~OY?qA96}Q1$;#fjze0$kN1RMb_ zS)zc*_;2p{S7Yo$JZx?P8f{!pHTcd{mkHst)*~BnA2dZ%*)1s_%?ABK^(x`pEqa>p z!4bxNIC2Fu{6F}=kvx)x_Ts7{i>@F{8O-}#Sq>=y8LVtC9x2`akn*7OFmFN-t^)~z z%R^XD1E|&j=-U>Ss{VYB6`||zN|54=ElJ;Dq~P?u495oW%69i)Z6KhM6Sew!KM3g?278tz$S^-~ zt(Nk(JP%F*B?OD6HB2zDcnP$%Ya?k80R2zr;0grZPTIj*`&l~C>3xO5jbR|Tf9ZK|7@=A*G}DRtw}~_U%3gt z7BA}f`nx=_H7$T27Liy2S8G=mhHCLj8__y9QCDtB1?%@~PP<2~$1i;MgACS94R#(i zsI0J;{T!gb3nHx!uc#2&ZIJru;|8uM`M-Om1b}QF(wIJ}#1m6F&z-3iU#@4Io^W8M zoln^;K8)smTtrWARKuDe?x>&I_wb}0<9$lhGAz=$#;*l91Mns~-YqH!*`T3u-(iQz zKG0zNSM19H^U!a$=8--*LO&{M%tp83uMFOvwg_;F2V%+>ReZbcmgu`$o|_1%J8w3g z2ZpBnqJ-iAf?k8x6j)F=_W+vw_f4ML0<`vl5Z$~=2*wE+Nq^QDgoK46sIgyOTwGw> z+|@S;@x)b3=T2<<#6$l5q0Pz3$*j@G!`r*=?4UD-xsb0=W{R&+e^?=xxr;XH%d}K4 zdCqgD@L}N(v?((W(VdNp?ASYceT~jr8^{cQk>C*mn8Xs-7>n4`?r{%ZF|d|8^Wc@4 z#FK^0*l7a)fx2^kvfJ9g2xwetd&yPzsX#Qm!nHmZ@H}9MjvK(yK?^E*VjL{LaYC@4 zLPo$(yLBM9K&TK{0uhI|({!i7hj{`_`<2(X(%sLc;`#5qE&`bAyd_v}zlW#BC~$g< z#KOtcYUAO=vrhzr7YKJ<|EkbnD=&n@oH&%t;46Ca3+7HzXJ1cy{xBybua(22U+D7Spsh(HAQIY1^!*bc( zTbDKV{r*?`R)_Z^nZ1`6L#c4&?L9vWbjJ%|?+C>Af8HpdI@qZC*Zgz(F50W1=^syW z_Ze5bxN8|NzZKrQv8=W^2su%PyG~Tz{MKunNVxrrR&&)I0FU%+(q&!^2FM-L)z$mU z^4tdXMwy(+A85&R{y1ego!UGl&wle!*(Z0G2kXfSw<16eyobELh!lO%aTPqsAD+u_ zWoQ)3ZKe>YexC9lJ;mS^8bvFv6UH(T1g4&Ae;Sj|trNc1Z10#8pCH{&ZQeO}l})@c zs07zcc-Kkp`aipYksMEaHyMsA3nZ2Qz7e6(54*tFTgw;pDB_8er|5hCaL@nxDkD2@ z`?6_azC@?L^oAT5v3H=gg#+%BK19#u8+q=ts)nI8F-cUt;0?q57@olo5)Zh;Io*yu zNy5MgPMB3(j<v=VtA3zxV!Aj@%0H#c5f(1sf*6^=gRz58RU zL?Gjyu0bqaZB(NSWYr=B>l0}*hOUWCgw(38HK$u{!^(rq;JWnf4tE^uZ>$NKm4;W( zmV&z5nnzgU-2RexVAZ5*ho7Y$G{-dO;E7*fj5n0V zL}8)8m;+lFjgl|(9(If>JsI2IYG?LE^)Nr~KbFi2+}fT!dV~3JsCgslDoKz6dW0ul zc=mcm^nre-DfhD>U#w^Zd{Pj#amRJ+NX1zE=W$`=QTAvUM__9Bw)FZW%=O(VS>J)R zq5Zk!_qf`KV7^WE%AJwO86`)}n-G?_&x98+ch${Bz?>#*(`4lcg*$U4$cvvT#Zu8g zDWEgnlQpECB>e3W04QpZZAPpP`VxVdeXGAr=qpz3cl5*j5h7{zvJpd^70!V=SB}1X zl~dQOCYzI6?k=%mu(w?kkq@wtu%nJi&}Tu&!u0FQxq*N;T3B*(eU_2EAvskZ1bbZF z0#>plk}Y3g)_1S0vA9NL0Bu4ki<%2-boX)^g94i*=MFxuGA4}=`<;!Vs~`N97VEf8 zf=zHA_OC9_YnCQK3}xVMMM{$+$px+)MCb+i0wQ#M#|@(<4A@7wQD)5nQmHzC zHJfTVeCU_wN3NG#|75PdYS5}5iD$?F{@{{@!O1sqtJ3mvTEwwVz439*+t&xuGgWIP zDp*aK@}1|JfZZ92T{l|8$#eVx7w7@|AHAr{L626CmQ2a`-T>(k%96mL>2}DvUblnX zW`9&ARH?NW9M8{S)cG&Hi*5)I4qKo>JN7%=E)>1QCHlpNg;EK^o;TrWAoHgGU6ViGyD+X_Sz3HI5vv^-1G|*fyw1>&$EtIK;=fRiz_3FH9H8IRT`|BDkF4Mc=M>>9 zZzWlLy&sPXZWum!cpK64)V-I5$=B|`X zc#1~mSMihugS-pBf&!x+%`1~fIwE&Ef{3xaj($zL%#aGN6O$Pz0fmM;Xi+(S8Y>*~ z;c;|=@>DFHe($p*!n($f!4YI*CvP2iXyv!5v+Mo6^RE{{IG$vKRnfb8Ygf5YaB92D z7c5PbT4nnsIIt%EPp@XrP2h^X9|B(Bs)i??w)EL8sRoXV!y;TpN!OJk?&&8#()1N* zB@5A5bqBh7`XVrT3m)wB-ufF(A}M;P9SD_s&^uyZgOCb5(52UcY044Saz}SuJ07rM zTQSZf2wXiA;>BP2W~>N^id39j`t>!iCbNfx%D=f Date: Wed, 11 Oct 2017 15:58:37 -0700 Subject: [PATCH 20/90] revised vbs steps --- ...iles-to-support-code-integrity-policies.md | 1 + ...ty-policies-policy-rules-and-file-rules.md | 1 + .../deploy-code-integrity-policies-steps.md | 1 + ...ce-guard-deploy-code-integrity-policies.md | 1 + ...rd-enable-virtualization-based-security.md | 227 ++++++++---------- ...ploy-managed-installer-for-device-guard.md | 1 + .../device-guard-deployment-guide.md | 1 + .../images/dg-fig7-enablevbsofkmci.png | Bin 33488 -> 38468 bytes ...ed-security-and-code-integrity-policies.md | 1 + ...certificate-for-code-integrity-policies.md | 1 + ...-on-the-device-guard-deployment-process.md | 1 + ...nt-planning-guidelines-for-device-guard.md | 1 + 12 files changed, 110 insertions(+), 127 deletions(-) diff --git a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md index 198770fcb7..f37226da6a 100644 --- a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md +++ b/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft +ms.date: 10/11/2017 --- # Deploy catalog files to support code integrity policies diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md b/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md index 71f007b12c..178a8f9855 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft +ms.date: 10/11/2017 --- # Deploy code integrity policies: policy rules and file rules diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index cef4895ba6..ab0c065444 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft +ms.date: 10/11/2017 --- # Deploy code integrity policies: steps diff --git a/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md b/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md index 886d093664..4b645887c8 100644 --- a/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md +++ b/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft +ms.date: 10/11/2017 --- # Deploy Windows Defender Device Guard: deploy code integrity policies diff --git a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md index b607eaf180..11452fddd2 100644 --- a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft +ms.date: 10/11/2017 --- # Deploy Windows Defender Device Guard: enable virtualization-based security @@ -14,70 +15,61 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Windows Defender Device Guard security offerings. VBS reinforces the most important feature of Windows Defender Device Guard: configurable code integrity. There are a few steps to configure hardware-based security features in Windows Defender Device Guard: +Hardware-based security features, also called virtualization-based security or VBS, reinforce Windows Defender Application Control. There are a few steps to configure virtualization-based security: -1. **Decide whether to use the procedures in this topic, or to use the Windows Defender Device Guard readiness tool**. To enable VBS, you can download and use [the hardware readiness tool on the Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or follow the procedures in this topic. +1. **Decide whether to use the procedures in this topic, or to use the Windows Defender Device Guard readiness tool**. To enable VBS, you can use [the Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or follow the procedures in this topic. -2. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). +2. **Verify that hardware and firmware requirements are met**. Verify that your client computers have the hardware and firmware to run VBS. For a list of requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). -3. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. You can use the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security-and-device-guard). +3. **Enable the necessary Windows features**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security-and-device-guard). -4. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. You can use the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs-and-device-guard), later in this topic. - -For information about enabling Windows Defender Credential Guard, see [Protect derived domain credentials with Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard). +4. **Enable additional features as desired**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Enable virtualization-based security (VBS)](#enable-virtualization-based-security-vbs-and-device-guard). ## Windows feature requirements for virtualization-based security and Windows Defender Device Guard -In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard), you must confirm that certain operating system features are enabled before you can enable VBS: +Make sure these operating system features are enabled before you can enable VBS: - Beginning with Windows 10, version 1607 or Windows Server 2016:
Hyper-V Hypervisor, which is enabled automatically. No further action is needed. - With an earlier version of Windows 10:
Hyper-V Hypervisor and Isolated User Mode (shown in Figure 1). - -> **Note**  You can configure these features by using Group Policy or Deployment Image Servicing and Management, or manually by using Windows PowerShell or the Windows Features dialog box.   ![Turn Windows features on or off](images/dg-fig1-enableos.png) **Figure 1. Enable operating system features for VBS, Windows 10, version 1511** +> [!NOTE] +> You can configure these features by using Group Policy or Dism.exe, or manually by using Windows PowerShell or the Windows Features dialog box. + ## Enable Virtualization Based Security (VBS) and Windows Defender Device Guard -There are multiple ways to configure VBS features for Windows Defender Device Guard: - -- You can use the [readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) rather than the procedures in this topic. -- You can use Group Policy, as described in the procedure that follows. -- You can configure VBS manually, as described in [Use registry keys to enable VBS and Windows Defender Device Guard](#use-registry-keys-to-enable-vbs-and-device-guard), later in this topic. - -> **Note**  We recommend that you test-enable these features on a group of test computers before you enable them on users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. +If you don't want to use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337), you can use Group Policy or the Registry to enable VBS. ### Use Group Policy to enable VBS and Windows Defender Device Guard -1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. +1. To create a new GPO, right-click the OU where you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. ![Group Policy Management, create a GPO](images/dg-fig2-createou.png) Figure 2. Create a new OU-linked GPO -2. Give the new GPO a name, for example, **Contoso VBS settings GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. +2. Give the new GPO a name, then right-click the new GPO, and click **Edit**. -3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - -4. Within the selected GPO, navigate to Computer Configuration\\Policies\\Administrative Templates\\System\\Windows Defender Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. +4. Within the selected GPO, navigate to Computer Configuration\\Policies\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. ![Edit the group policy for Virtualization Based Security](images/dg-fig3-enablevbs.png) Figure 3. Enable VBS -5. Select the **Enabled** button, and for **Select Platform Security Level**, choose a secure boot option. +5. Select the **Enabled** button. For **Select Platform Security Level**: - **Secure Boot** provides as much protection as a computer’s hardware can support. If the computer does not have input/output memory management units (IOMMUs), enable **Secure Boot**. - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can have Windows Defender Application Control enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats). - For **Virtualization Based Protection of Code Integrity**, select an option as follows: + For **Virtualization Based Protection of Code Integrity**: - - Beginning with Windows 10, version 1607 and Windows Server 2016:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable in your environment, we recommend changing to **Enabled with lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. + - Beginning with Windows 10, version 1607 and Windows Server 2016:
For an initial deployment or test deployment, we recommend **Enabled without lock**.
When your deployment is stable, we recommend changing to **Enabled with UEFI lock**. This option helps protect the registry from tampering, either through malware or by an unauthorized person. - With earlier versions of Windows 10:
Select the **Enable Virtualization Based Protection of Code Integrity** check box. @@ -87,23 +79,16 @@ There are multiple ways to configure VBS features for Windows Defender Device Gu 7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. The settings will take effect upon restart. -8. Check the test computer’s event log for Windows Defender Device Guard GPOs. - - Processed Windows Defender Device Guard policies are logged in event viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. - ->**Note**  Events will be logged in this event channel only when Group Policy is used to enable Windows Defender Device Guard features, not through other methods. If other methods such as registry keys are used, Windows Defender Device Guard features will be enabled but the events won’t be logged in this event channel. +8. Check Device Guard logs in Event Viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational** for Event ID 7000, which contains the selected settings within a GPO that has been successfully processed. This event is logged only when Group Policy is used. ### Use registry keys to enable VBS and Windows Defender Device Guard Set the following registry keys to enable VBS and Windows Defender Device Guard. This provides exactly the same set of configuration options provided by Group Policy. -> [!WARNING] -> Virtualization-based protection of code integrity (controlled through the registry key **HypervisorEnforcedCodeIntegrity**) may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). - -> **Important**   -> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations we recommend that you simply choose **Secure Boot**. This option provides secure boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have secure boot with DMA protection. A computer without IOMMUs will simply have secure boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable secure boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+> [!IMPORTANT] +> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS (hardware-based) protection, although it can still have code integrity policies enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by a code integrity policy, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-windows-defender-device-guard-features-help-protect-against-threats).
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. #### For Windows 1607 and above @@ -204,104 +189,92 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG ### Validate enabled Windows Defender Device Guard hardware-based security features -Windows 10 and Windows Server 2016 and later have a WMI class for Windows Defender Device Guard–related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: +Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: ` Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` -> **Note**  The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. +> [!NOTE] +> The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. -The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. For detailed information about what each property means, refer to Table 1. +The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. -Table 1. Win32\_DeviceGuard properties +#### AvailableSecurityProperties - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PropertiesDescriptionValid values
AvailableSecurityPropertiesThis field helps to enumerate and report state on the relevant security properties for Windows Defender Device Guard.
    -

  • 0. If present, no relevant properties exist on the device.

    • -

  • 1. If present, hypervisor support is available.

    • -

  • 2. If present, Secure Boot is available.

    • -

  • 3. If present, DMA protection is available.

    • -

  • 4. If present, Secure Memory Overwrite is available.

    • -

  • 5. If present, NX protections are available.

    • -

  • 6. If present, SMM mitigations are available.

    • -
-

Note: 4, 5, and 6 were added as of Windows 10, version 1607.

-
InstanceIdentifierA string that is unique to a particular device.Determined by WMI.
RequiredSecurityPropertiesThis field describes the required security properties to enable virtualization-based security.
    -

  • 0. Nothing is required.

    • -

  • 1. If present, hypervisor support is needed.

    • -

  • 2. If present, Secure Boot is needed.

    • -

  • 3. If present, DMA protection is needed.

    • -

  • 4. If present, Secure Memory Overwrite is needed.

    • -

  • 5. If present, NX protections are needed.

    • -

  • 6. If present, SMM mitigations are needed.

    • -
-

Note: 4, 5, and 6 were added as of Windows 10, version 1607.

-
SecurityServicesConfiguredThis field indicates whether the Windows Defender Credential Guard or HVCI service has been configured.
    -

  • 0. No services configured.

    • -

  • 1. If present, Windows Defender Credential Guard is configured.

    • -

  • 2. If present, HVCI is configured.

    • -
SecurityServicesRunningThis field indicates whether the Windows Defender Credential Guard or HVCI service is running.
    -

  • 0. No services running.

    • -

  • 1. If present, Windows Defender Credential Guard is running.

    • -

  • 2. If present, HVCI is running.

    • -
VersionThis field lists the version of this WMI class.The only valid value now is 1.0.
VirtualizationBasedSecurityStatusThis field indicates whether VBS is enabled and running.
    -

  • 0. VBS is not enabled.

    • -

  • 1. VBS is enabled but not running.

    • -

  • 2. VBS is enabled and running.

    • -
PSComputerNameThis field lists the computer name.All valid values for computer name.
+This field helps to enumerate and report state on the relevant security properties for Windows Defender Device Guard. + +| Value | Description | +|--------|-------------| +| **0.** | If present, no relevant properties exist on the device. | +| **1.** | If present, hypervisor support is available. | +| **2.** | If present, Secure Boot is available. | +| **3.** | If present, DMA protection is available. | +| **4.** | If present, Secure Memory Overwrite is available. | +| **5.** | If present, NX protections are available. | +| **6.** | If present, SMM mitigations are available. | + +> [!NOTE] +> 4, 5, and 6 were added as of Windows 10, version 1607. + +#### InstanceIdentifier + +A string that is unique to a particular device. Valid values are determined by WMI. + +#### RequiredSecurityProperties + +This field describes the required security properties to enable virtualization-based security. + +| Value | Description | +|--------|-------------| +| **0.** | Nothing is required. | +| **1.** | If present, hypervisor support is needed. | +| **2.** | If present, Secure Boot is needed. | +| **3.** | If present, DMA protection is needed. | +| **4.** | If present, Secure Memory Overwrite is needed. | +| **5.** | If present, NX protections are needed. | +| **6.** | If present, SMM mitigations are needed. | + +> [!NOTE] +> 4, 5, and 6 were added as of Windows 10, version 1607. + +#### SecurityServicesConfigured + +This field indicates whether the Windows Defender Credential Guard or HVCI service has been configured. + +| Value | Description | +|--------|-------------| +| **0.** | No services configured. | +| **1.** | If present, Windows Defender Credential Guard is configured. | +| **2.** | If present, HVCI is configured. | + +#### SecurityServicesRunning + +This field indicates whether the Windows Defender Credential Guard or HVCI service is running. + +| Value | Description | +|--------|-------------| +| **0.** | No services running. | +| **1.** | If present, Windows Defender Credential Guard is running. | +| **2.** | If present, HVCI is running. | + + +#### Version + +This field lists the version of this WMI class. The only valid value now is **1.0**. + +#### VirtualizationBasedSecurityStatus + +This field indicates whether VBS is enabled and running. + +| Value | Description | +|--------|-------------| +| **0.** | VBS is not enabled. | +| **1.** | VBS is enabled but not running. | +| **2.** | VBS is enabled and running. | + + +#### PSComputerName + +This field lists the computer name. All valid values for computer name. Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 6. diff --git a/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md b/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md index 53d92d3c77..d21bd16a25 100644 --- a/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md +++ b/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md @@ -6,6 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: mdsakibMSFT +ms.date: 10/11/2017 --- # Deploy Managed Installer for Windows Defender Device Guard diff --git a/windows/device-security/device-guard/device-guard-deployment-guide.md b/windows/device-security/device-guard/device-guard-deployment-guide.md index 6bda41bc15..b322bd2f63 100644 --- a/windows/device-security/device-guard/device-guard-deployment-guide.md +++ b/windows/device-security/device-guard/device-guard-deployment-guide.md @@ -7,6 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft +ms.date: 10/11/2017 --- # Windows Defender Device Guard deployment guide diff --git a/windows/device-security/device-guard/images/dg-fig7-enablevbsofkmci.png b/windows/device-security/device-guard/images/dg-fig7-enablevbsofkmci.png index 34c1565f670a443e2bbae834bbef63ec49523b9b..25f73eb1908c9d0dbbd5dd6d11367eebb9e6503e 100644 GIT binary patch literal 38468 zcmeFZ2UJtt+AbPIMWv}IAXP*_0qN30QBV-+Qk5=Eq(o|@1`8t6q}PB*lMVtwYEVFW z3rGtj(rbux2qd`+bnpNB_CEKFbN=(+GwwL!j9~_gMdn&_zV&&Z`A$Q0v{Y%&u$%#b zK(uQ2?mPg2jt7E3$NEkk1Mb+zrZxgUDBK^YDuIf7*cO3bj@#eXybS`CMN%JFodAA6 z{p{XDcMyoK>F`6*3i)IM0>zE0-MOv*+#E-AF13B=KMysOwj0~%ul+51d?~#Y6Ve%{f+cG<;>=l&`ranqe@>5+_>D<{ zNre&=c=K`~MWdi3l}Ni8#JiK0j1?w*GYQx-g6;LI!fjra{FHb) zq0QH&0UUM`1aiCuq6~aUbFy?k9Y%^o?kbX3Sg{9Eu-zA&#D32D^8L``2`c{YbKVs$-o&U!k7a{A!s4D-O8#@x6Lh5k@WnFNS1pQ zyiM>JGl&iQb3Rg$+ygvq8SnQ4ON5d8=t)1xIK_P=xpjxsY(}od0&m&hBu^tr8^Zp$ zAjMr2HS9p!Vz)!ee0M|-_!C1FY(t8ZcHm>Ec#)GC7|F0|7JXg5ET`+5O2^h{3pKQ- z1ZS^TcHnYCxH5doHr{?LnDFC)H(dV4mF;Z;Wg|s9tHqO>DlY6Vj~9_=ktAfaMN{Pf zF7@8FHXwxQ0ddbK@uUMZ_Mj<6aidj=lT z_kV66_W^-ytT8G4%45Q~E(*giRb?*t#`q;33Zx>*C;U|LT5 z`w4lO!r#qNy5&+Pdp&!5nDfS;ON=N%+YlKF4Sm;wnsLTMn-OJhY#?qLHSDGZlV^r{ z{TA#4c7sV9NJ9ESZpp3`dEI1{P=(op9Hc93_4N|Vs}#23Qe*;>@B`~ZnzSHoXv?o< zSnO9;1v^v{(~6ugJWGyfc%10uVADazs?ZZFWHNvDCfxrbhsUoIAWQquGnQ9^iU&_g zAyog^f+CS%1e@n1Ng?;eVasNUYZeN-7Q{;Of+7h|owju~uaX zFkMQ0V&Bm?o-b*+kSNheH)PmXz)fo==xW_@eJ|g_tYx6NaB^yD)AhtSzmC2uAvzo@^!ld3>-WsOt_URjEMKZTSNSw0}8zQN4|H z+7k54&u5jk8yc?p9&;H+E25)~EKk-ON2HH&?~%*X@_ zzx7~purQX4B@S?sIMe;x>HSGDkyt{u#X*ZmQM?u=tzN@f{$;DVbFlaq$qfh7_S0BK zJ)echR^nucUH*93PS)tetw+|MaHER`O);HMStp_p;#z&J9q^{!+0~OjZk!Y7#J6;h z;FDeNFn<)7ujeTSm-HL9fg`#S$A^N}yT%;|T`V|m3TgJp$TP3#v@wL=E1OvZmQ-r) zlTX+ET`%4H0DmwKo8=>=!)B5DFKS_HIDFl*u)N2xSqb33Qp6H+J(fUE8lxf;9jnNZ zFx)h3PtlLe$4PD!KKN$xEj3xjM8G#`Y@#P0Hy+|35L3K%MVC48d#Hrdlhs=$$+vG# zL=1=44S&6!W2Ru1ieXJk;(&9YQS4bAb~&|OHkbDEJq$y}?@Sm}y&SC@nAnTevfw)o z1|=rcwFenm&kRk<^;BIx*4VMQCnKSb^f(;JhF7LC)!k3#4kX0aKWRext^1t>qy8md^A_9>&g{8mANlsy_TfL~t;J2+u^N#(&%TaohfI;N@` zI79nyb6?*^lMmL)@x)zi(wvdv+M=S*R1y=AI$+y9kz_JQ^;R62#H6^_$BOyYr(9C& zI^B)k{Vw&bPjq(l(Za)V8SpY389b(vZ~1W~E5z-yFkztdvEQ}ysmKIqfq_2VX-~L> znu991r8qigevEe_vGy*yTs_;Q+s#|w@9VnKRtz2SY{cdIDd!-sq`|U9Yxa}hr+kta zj|D!guFAdrJ4NigjQ3bYFeKeQjJ~V~2W!(vLI`XZQ$pHqB`@~YlO5@i`1HCpC~}h? zL!=_7TaYvNVY}q525j|S53~Vy15)ieujQ&mwXJlFd5;=I7Y;fJDrcs#Snu}$eYw7KiEloOdvMO zKQXvjaet^P{rNh5z?)r1|aMeKh{Oze)RzZ-VZi|Ie~M z@KPC7{)-37lH3yv)M4tgP=V)3&Ld3LoRJ?7LK%dPO=MQ3(|;^48Rk^q(Q@Lhdm3&s zqVoKQ$bHPf?|7a=hi}$BW640K9(a@W{4+g^w8rs7pVuYZeWA?l+xru^LuiOSE(eWx+cMjnVS;EXLPPU$poxF-@`Js-X-@dHZ|LBI#cnwu+cI{5RJ!$TP)Z zqX#$M`pTI?l~iIF3GXz+dPf70wQ`eb<`*}vF<69jCoB0LoT8IHIFrag;Us%(#Qba{ z?-d|)2!1~{LVwUqZ$OscAt7T)`vbjXdJ`%UUqr7n`&wy$Fx<4Ze?3%>v%`1ZW6|AK zg^y8h;9H(HYXGJ2eQZCUGNCrkkomj-qi2?t%BjV?+_o>b9CH@y$4D-zXTdR#OJ zx9Qr~*of03n!;mxj#v zCjiTA&7H^m(qbbrrL@KRQ>^^3vZeE^=i3z#JiaeJ?+pfA4rR>cjI_Q;5$7O4ZUAS{m zwwnigo!*S(%N#g|XNL{zb5bRn`F)K$i^t2E@qpmF2Z&Y)F` z7BtwuWW2QQoI$WBpmU@oRlQzRas_Itg3#2*M((VWG!H}4z=r#CzKE-V^=o|O$z0Me zhIH>qN^NS8!#E^0$aD{^qv$Z+3wMcI4Q z%jW)%n1V1Z57Uw`Nbtq!jl0k)H?Y_DsCrp17yEbYEGaqa&BqSsnSY}OEtdaKYXNs5 zy+h13$KFx$V4U_Mn+b0fu4^1oFJ?GKGBTw-Ub=Y7()ad14YyR0u)x=_2H@ocZNIH{ zCYR+;Fj6=ZX}1Zv(;rFL+&XZ_9$=si1STx$K)7ztzKYt?=bYA*j}51MtdY3<;{C;M z!*7)(HS|%$k4#DK{w#)JQcSWLV?~nRoU4~poZ0m<63dJE3D_T<@Fa z)SCXJzCbNw7m=cm@n3nNf0bs%=$dbZ&Vr~Ej(Y}y`_WJ6ZFZv?iU3KnQ#c8qvSc`_ zf{38)tr9;?RKmeda}1KaU4#5bOwLgliH&C+X&2?uvqK+!=;IvaDvGvtPVVzcS?e^My!Jag2(z zSP}fOk=j6LQjUORC}P-O^g-MgQz7)jHto(JS;f~)g(#tDLbAb0^LotmZnafdPk~pU z0V|y)r}xB8t>TrXeT$u_zS`_6_=M;1DEeEAt%E28OHLt?@eg~?)Q~2hnj8*u=PdDbRasifgFnUNWar? zFxsm?tjzt!-l-)Ry3m!^iGK}}JStB6=`CUFeAr)AihKL%F`HYX+OQ=lc(r0=!NH*8ZM7g@ntFPbp9-qko`dDoYBU~2FTax=V;%hT!9M&=JYwCWyS zhyn-D4!@mVA8ti;sX{P*%Lpu%8Ho1LijlyQq!r}pUqh$v9UF-}Xp0=L-stZ2n+sAT zw8DfaRx*VT2#|nHO(_WGpc_h_0|(%S0~Qkk7BwT~)-e|3^i!4~$>a--SJPkT@W%C3 zthLW3|0=k@^EiQ*2Rv5k9Au{wY1kjDf8)xOAQ)Ytr^n*jAVKt~m8wsFH$=zO*swjg zFYHp+c~>MvS}3rc{j{{UKMuT}_p_7J4V$$awNt+#rLZ3-T;sIa0%^Eh&OvV82aKh2 zbs)%`Cw+gn*7W}R*F3%a#NEYl(q^slfxDWzN{6gi3+#oK-na=QpvT`m(*yH77hP@g znDsD^MDhc;CPF)sWfCq8XiSRKiCn9KZK^8nevO2!agqf%8!?;iifg?{LUAtg*8q06 zNh*Mtw~>C(4k$Gk^Xqd${Y%hE%kd|mfvU^)mj{hmOs33|SX5d##I;{9*f8int+k~R ze~${PG`6Q~k!5xICg(%1zEsErTs;oq3b5-LY*GFJ} zmXTicmMo^p6ew>mulU;O-N&UK1h1!??~<|y(LJa*y7*Ac$(5@ETHP3;j?nhan=zDB zBGo=vFl^e4Yj0s^Up_fNBAD9@Qok1^9H8LGl(BTYbVo6n)E+xY(|L|AH5-+iF$V8xM#ir`_iIs?Ob;S%ut&lZ*01m$vmz z7rk?bK_TLIP@sDaeGHNY9UJioK4s}RjWp;-&vsh8{1bTrTJV|i-!u84xCMc)A1|#3 z(#Jmv2R6okf~g~P39JCn&fhXB@V;Q4jAH{qMnzmlKWH=mtP=#vJwms@qe0K!{r~r7 z{1l!7M0dHaUGn!FN50AJ{R-W*{>brMa1(w?hUc|n94Jtp3xLP2lxe^6OKW^%rMy>R_vfn}ER5WpB84Pvl_>6vyRR2iWUCU=z2}ld=n{q^ zWmw`LR5f40dhNB{aTTVtpIT z*l50$Z&VLF5=PpaZ~Ar5hr?%qtD5z@?P?dN)~dNeJEYZM9g)U4*CD6L1iqozVxFnC zu~9SoiNjzd>jti3aO{X*WY zYR|lx&Hp1U-`=XT5f2oyKYcB0PPf6Xd>E9|J6?BwwxB#6#OQkk9fyX$pi%+AvFjwx zO)N)HeoEvY;+yXdiUq#LBnhn1jXR*_{`8Be%1jTg-O--NIN?i5# zo~*h0`^`Szff6&k77q~REWgIxdnep`<*hv4Yc0D4XwyP-hMl75))$NA*QtnL&6`> z9xCs=k>}!XXX!Qu)%x#m6L+xWdc41I*bO!0IF5MXPK?^-(p|34PrTHsu8vl?^2KOv zbo&nkumw4!U`7TPbA+|&Z)$pr*BTEl4u9o1bTvSR9%Ek)2^|AwYRjpcCEnf2^zss$ zNJ?I4(-)0n_oLJ#N-u=)yfrH;KP~3+kqPgalTvCkmLnzQetV-y{K0%E$MX*x7e%;? zqLA34SDoB}6pdegdC4Sc9C`nf2mnpX_sVT_y`oomP6lRN=e@C*n;rnT@{Ey#dgNy3 zgoul6$J-#=!!41&jC49>i2*FW!~z+BuiwD{x&)jw1ur+wH=(Ef#ovLzBiQh)Qtt1b zlI(vn#a0}9zbygD_^OhwGtD|uRT3!E_FmYT&@Q`Ra^qThHru7E&Ci`EO{{QKuk}fp5 zU>p1aLrkcf;Q?Y_koQe|vdBsHX{V#m0~Ovln}u;&#p8+z2lC!OOnM*lEVxKN!sqZ}i#{2}&O%B8un;_I|Kwc(x(+QT7cvUSCw zKMwunFXDfqbq0uL{sAWnogJT^c~>~w%wIM@W9U`_W&?Plzu8&8Gy^7tbr^6J?~NQ9 z0vx*sKU?<^OTuB}1FFH3*uc?GHpdLuY-`5u{HV{fxn(as6!v!u7iT;&3cx>McwcOc zYxEZq!GgRD+bSU$?ET0UUQDQE2srbRRy)IaDrR#xM^fY3Mz^#PU#zY3v2wk#NB^b- zUh|FQVY$sdWo0th(oHI?Q-YaC=wi#+><1>|F&mAP8R`&uHolZ6wt9v?n+(lEIKR2_ z{ELf8Ab~P1%|6Y0?kg2%9htNb!PM<-4ru>JzMgeqrZQ#uyB6$}K^uSU+ZWJbn(u0q zMfQZ>yw!(UmPrngcYj~E@~v5>!0k zR&z=A-=u${{*fRRTto7m|0J|Gpltv;EdkJpxY4V~`9>AB(Wgw`J|QCHyFSU}(7o`Y zRf%j(pBSnu_L+SI=hVI=?6cec?1kqauelU7crnOa`FC)ZxEl2DaOujiY6*n%l`Dbp zYkz`(N}D-A>-;mp*RRKw)P4DKiqdyxb!&OJY2ib}t>mvc{<8vq8Izsy*Acq_(%Bxh zZ)!{fG8zHni>J+e#d|C$BKCtsl=rHv#rM~V4Imvq2l@(t`d zy;_T>%RC8iEbhQRZDw|-GnTw+ai}{?xo)fcxufe1+8f3zsL9zSWBPxKU*I;QMhW3K zE;T(p9h)0`@u6_L(rDj_Nn@_Re>FTO@i3$Y5D5V6Z31v#?HV>vO@aS>?DT`g+K8&V zZ2g-06DjxAE1Sxc{>_~a&0rsoBm)GmIkQPL5LHNeXL*EL{C-^J8@8H?i3q>c`9=&I zHsGmrsm$pxBuM_-GyXj!(A&zmw;a#D)V{HU+M=YNIY(%cP=Z7l=3Lq*3 zZ@$Ssr6_y}RBAM-i8##tz|K+pRWd|F7zfiLv~wQ_n|5C3I>2IP*qy znENngWKd`;hr<11G0h3_Y@T%>Mj;R=n;pYtdxSUNfDp_vO?@1PF!zSn^WfOub-=L^ zw*{%ojMrOp(#E|q)LLb^6g|O2qaQCva=AH&R+;LrO>D$%Sc*$}w1x2o(q7O;pMq~+ zS2=u2Gadf@?~*E$YW9~_*j|vvK!{K^Ze5c(!+Chc^J$rcg{;2`ehky|s9{)3m{+E$ zMY(0rULf*N6mS1IGZjq0X-oA?QQoVcE||HQtiI{H`WRYLzOWqG#f187^Q6QEQT<%z z@yjScZwXk>;ZE#1p_A>O@V+>P$*J|M)Q9DQt9bdfF?>qRRN78XmQCqic6D7gl10hl zy<21th2gO|(M>uTrQe>s8F(HOQpToGH!>K5p0FHT7G%(Y+B96FqP~QU?~-JK@VkgH zH_q6Q{e@wBJEN~Wc8r%D~Z0ESKs(Yfw=R-^;Uc%mG)MUXNtTXIzJuB~fk4cBi`8^xWP1$h^|5 zdCdfaHkCuz+Q@je>3}xo_t#^w@&*=jpC(cq<74MKEd3~Ax^@4Nv zMwuHm+=Gb}orC_t7phz)&J?}*4UYkPQ5M%c%b>pG(@#m?%$)i4JMjXo?fD1j#Tss~ z*aSW01D|((su-P};Ac+PIM4~SmTL#8z5Q-qBBr>|qOCrcOe5Od-JI^RE1wvMZiu4W zLQGP9`R>|-t$|kwfSayp2{v`5)G}xZ{rRa zi6v_Y$e3)I^Y@EzDEEOVM_q&Df**Y-UMQ|T5u}LAHF-43M#8=G(paKVHjAqfR}9C# z+4HJRK+5?g@%K|8=GjZajUKg3pgLv+YXvNnmd3gxBk+Bd@w-otKe*w-YgC>>F;wIe z>@NFNaGWR3o=o2@sTc?`!{U+QoO;fK-_ir~>e$ie3`yBoY?gY_W z0^H+a)M^U5*v>NZa>PIb((2IrrjRN% zrypcUVi$u2haz1wB9V_lSG=tcQPtYwSHU_4@Wk}P6%W^p9H+OPA%JP3#+ zm;EW5mc_FReMsH7Ura5exYMu{lm-8WR8M7PyM-tys!kcu1h9{Dl?fA4&wozF&CcDw zrQYMcczxMJ#t?32h*M|1N9^%Fqt+b18?YEboF=UQ9WvPSG>A_dBMty)pgGWv8sD78 zdxarQU$%Oy*BxjG2z}v@g)35Tm+S&!76HvTv%HQ^j;UEf+TH~QMgpL&{K>IIaAi`7 zTJ^IFTCUp>6=()ar==|YE8!B9p@?a)^wneRTNYt{W(Q^)C<`G637FNMz{$%;NKlqS zVW{s6ZUByJwNd>(5kT(($2TUE{c0iWdrz{)05Y(1T_JjmOxY_Gs z__z$xYq)X)T#R$Ivk3&H@tpm@c8{7jLs>*jcw8w|&a?$Fk z9=7@3Ve9#yoA_IkP_|1Wil7A43hpwjqR_vd1-$HHIaO?j^~2r+`R;XEa6J0QhL1@3 zjbkIXdtL;CO;?}Q)HmC`dv?WBXxu@X_z3lF>6b~s8SEF)B1LRtu z8UV?*00#$k0kuk(6EGvHuS-`KBHl1X%j-8}J2b1yWG$`R-@ma?T|M{Vq0xf=1u-u3 zc=yWTEvFF^OrU^-?YllJdwUcUlacH-(@x^}x-IGgcMgCPB5?yqZ&-mjXvX4s4Yl?KBN%gY`$tl%V=+m{IE2jKe zZg(l-iouRlTkKNV-dpR@Rt>C%9^3BK zf4Q`8CLVE0*<-e@s@Ze?=GYnU)~HJ{=o+20B(P@s!%V*{>B8!B7d@x?){KOmFS`^x zpDlPJX(lkt^1OO(_+;t(8q?J?Mg26q!iN+{gtp=YL24=hRO@M``YAzSJ-g2+`rI%i zXxpV>vrWB;#V)ShwrNFuHKSrL5BlM5)o8Zdh`Ay1fa+9mr7g&PJgN^)*ZsBM?1{bf zJyle;JU7*VJ{MyDqEE2SBDCJ;Y5gzU$jvf0XrePD@$u`pfs=PwsvY9;Z*+f1c4=L{ z8}N`SHxZ$rF4|{z0r=umF&2otP#EKRQ8 zuynrvX&uT1w$PoWowFNLQPC^p7mP_Zu9oUTNNJRfk8x4?ILzc2IDtzNIdY6tlN~Iq z^)$frdS$mDHg>*K2R&|+SNsAyg7ig8&3LHwYA@!ek$R-O-qc?JpINfnO0Np>ZEHeZ z@iMNNh=@eV8LT{&si6?8I4t7@-`5f8s7lpTcW^yB_5G3#S=+`BeId28xg)Tav5JeQ zEOP-@_HuR6e!qI}nrhQ?$*$mg1DCSa)MWL>nzC_)->F)v2m3iTx`XZQ7YkSz1fapA z+quxVRn$H<< z;ntQHvj}qwoJAiVc5Mxom}63%(OO9Ly;lzy^=3sBOPOO6LVP;28|rMuMe(xX;!sMQ zgL$z;z_~FH;>MwqKb8nw9If9YL5GV=0p_wZPSd5sR@vA*D=uC~lj z(JO`MqF|npD}mL@R_`P0_w3bQD@^u;y^y)=Tg=VQgG)kH6rB0tB#`dfx!v5cYVM?+ z`Zzf59qn6*&xu!<%JggAca}@@7AGhxnek~p80*(6E67^he)u@D-lRglR=?(lV1nvi z?o*2jIlG16XUEHK+_3eJ!lQ|mP<_s3E zaxMvrLy#+N1Z2AW zvcT+RU)4H%P-Eezp;>;D)>m=Yt=3qp#=ln4>%*dk_Yy+2^EHQiInt->W7rUkHy(VY zy3ADRbHDq&pm99y5rxu z9c%sWYMmq>MA0v z5d9A&G#zq=t*2_lN~>t>4w326I$}8nh^(Tj^+{*LwAd+V8tINCcf7QEA|IA^MT_yMPLzh0*A~OE zro_U`!Dq~LSl^@tv>r?UI}atlAHH%+Iq#YNSV?dR8FB>KVaJx6jchB0+^cB13Y zOHmsQFm4VSOP>dk8I!L{0=7h_-m58iZRK@ssyi%?a4;o(8>+C7cono5YhS(Ju)kzw zURa*9HQc-IlIHc;}BLot#+d= zemlEQIDA_0B?qafBmqrvzEkqmt2(MnuAv6YPwIUZ5lR!b+wthJXTp^*CWibEn!Wq&d>F4PDtY?L5=VnPJh zojJ|i8wOXwuk%g6IN?`BZd#Qmgor<%0_kqRm*fq3MjPKK^KO& z3Js3e^-MDc4JgAEuXechrk$_`_}!eID1?2k5v{gR0j13mKH8*71}g(SUDdU>J=L2# z)_q;Yw`=X#&b|3E0I5p}Qg#&__}3Fov)oBmd1mxt)(78{`E?C$xTvQDDCu>)H5lk* z3J7(~u6`sm?D%NzM-P0jGPXfl`C}v}pHyX(%a01J%)y?n)0)p@O!WL?-C7%m>(>rlAU#&4Xm@(z88W%V6%|q$!WA4tB*>;g=~O3gQ)k)AJV;j_X5ZNFmbF%XKNGMP$s^TJ)+wOFYs8)P<3Aq zbo%tji9YtsIB7;(kC`ihK#Xzz3Wx(@DYNLw6!0lhw&wd?(P2#%Um@Y0-O-#k?1e2A z`Uex&o<=Z=n(!~TU54t?L}=K} zA0op-3GdIj@@eM6UDTj`PP~=bmT6-{c|NEGpBhsma9L2NnXj0b+D@0-Y$~FG)v^uO zBWCCK6jEqf5qZP5)P-<9m#Ohve_tvIRo2UK#u?3aG8?^mLDJNM2Gc|KHlyKXE0Hyw+FSRu*^u~ z5p6Cd^-=or;%YO3N?oSrlDh>}$~BwNO#!JAuhk0re6%Fi?>VoqhT!~S;K$bDg(MDk zXA2WE3DcRon)W(FGX{X{Vv^MT+S+;t4+2am3%?$4=jslfQH-#Yl2Req>T;70N z(NJ3%mo8=#<~|7yUDV~cUSubp2X`6kDO_p4sfSE~abHv;qCU+ygK>|(dCXPDj(anx#n;^T<|h&V4g)`rz0Bj&{3JO<_qOXJ zYGoyVCoBo05#v`W$9wV8r^3u1jr5Zuo;WcCyMP3^T)^jUWRJkkb=dtSrL9*+Hz#o0 zR+SY%cT(CX{)?~k0?h6I7{zAHtD^)WWzJ5I_0fm&xynQtsjhnnh|Uw_>STwE^v;V5 zG7YU|SQg6QzU8{LqiL)Y|nfIZ4=AEYKV()u(fyGqzw30oC zA#{fGq%p@V_^w>}W7xr)9uefHORcl%z4cWv3ok?RQ65UzJ1&oMNXsvIvRKKyyTyp~7a zN_eHUR(LZ|K?Pw-V%wQa@CeQY0|%V-R9}sold@JEA-+d^3k!{9Go-#E(1x4r3{ZQg%-i}Ows2>7rNPzG!OF{D zW$z8|J!993p1XCa)dH*t0jCJxG>}^PDp6^cS=F9XK2g*cwdxu+Me$O{rtsy2-^M+- zeJa7D>=xFz*2U8#8Fc7o3E@E7yRB?67ydqnh^0(xBS3YSof@(xP(KyL3IFID$qC z5c|>P0|jsR5`G|RxSj1&bprhUn@NA6!y7_<#JQn*b^kD4ouGL7muoZ*vRj`Ld*kc^ z@fxoDT59&c^7XLHA5BZ--z8_eqrH~y*0&GJd_f~}Y-Od4-sZ!rdX3}VYQRaT#pNs` z@Yt7NTFJPTPx14L<8<_J;`9$0D~v(tEcdy2EU?UJKgm!A#D1Yp8)^~zP!Y;xxJU%{<> z`jZ%|a9J!O<{7-1HKHOgBA;%Qew0!;NRo;}IRTod2G4E@T9UZz6W3E#{ zcM5-af49?Fx|UvSc8w;ia_jR*c}za->Q_dlRj*=eykuqmgDqmdTUNOf3^<5J-|~P* z7|H93V*@YCIz*!)yxy7dXjb)J^j(?wh#SpD71>qG@z({|Wf0W%xY$5}L{zWPA45Zf z5RI=a^J?1-R{S6{4%5{f(uZwGhqY4TC5n~&YKDd)TIs{?oqyaqvxaR|Irw&TmiIUN z3moA(`%fJ zO7DWeyGa{Qg2((5t;)UH+2gVM5%a|7?5nOh`U+#^P^RQB1S=`E!#a_L-g5g>GF>Zh zL^g7PN!gr$+QdB(%Ss1lU3}C0?k>AS;yERsrR!oseaQ|!B?u%dUvp2^h~c=C3C|9V z=ZyTKKokdBywcr7YR*EU-f2i<>l;(r*u~B?w>n11o6-7+I^N8bvdr!)K|SwsUih zQSr1RH>ZYP0*CE@)y*wN)sY@oNzYMPt9&DiouMAh>W3>=E=uw3^l)r`g}Yt9m>?dS zR~P!cQ>cjAuru+rH@#gd+&tn`Cqf|EN{u5unb?714$zcz;r*P_Q8VD2E5rfDHGcG| z$<0I;%}qK-tv<@JwcmME_OZxM5Pe+a936D6(4OuklYMbEWruP)K#-$E#NBfj#T}b- zhT#R8!>HPTI<%vnOqFw!zNn_Nnrd~OYo8GSAc1OQI}1K}r9^V@;n1>r)3{s1{o(|Z zxmnGzdCl*gyg3DaseLPoT2JYKoW3s!0Y{lF_!IQ|(o+c`HTx^gLrn8jK>w88pauXHV zmv+-UIwk!o`xRe1q!zo(gnK|n&*a?bzKqLwc+C@Go1M#?CVbTT1`wcP2dry-y1neW zvwmY7Hr+Bq<|E~W@~2ySq(2+A_TV(il&uFmLW~;$0q9rWg_@|`>^xnM+tAbF?b&qF zEWw@2x&Kfkyk~;dkVf|6{^8T^33~*Bka(I9jty>5q|yt5?o9 zqHaqa*j324Top03`k4AJs(0^6uv_4O)h--|9(cAs9+sH5{>uU9?h2I!Hn6v<7@t;1 zr$+*{-;2jwtzE7$9kpI@T~0aIt`Rffs+&fIj>+%JMoXMdGCJE&+tDma)b66Vhy6#M z<~Zh#K3eUHQFrUbe(s#}a;dyqNUN#bicy`C+cxkA+?^zE%u*{@^Y8_BC z1UJi#bI|J5$_X#&uCElz6NcPzY#H*4G^~&ayj7j$2Xq;c%I{|W^^i;P)XTd%BEuX@ zY}W))-5=dp(#NVl(-l(BwSNWTM6t!HT!eruT2^@=B`U9^TvXhAm5#&}_Nr#Tu(GO) zKMziLXV&5h=Mw`q1lC@8Joj`jISLUB0MzZBqjXegV4OFW>PRhPCyG){N-sk~fu7Zh z8ZDN|wu+;qD{PlsJR&$|KK9{WD^8zBD52AfaecszYhRi7EofSoCL;O@BMW;Q->-sj0 z_NMM3PFb!xF}+rHk)Az~Ax>Wa?&<0JD#}jl4yFlf*%G@EJ6c^&`@?cnUokx_Kh zldlqGnEMS;_?5{Y3yf=B?}%%xvQ2(@4}}(*Ps>0?Zs)K=MSqENOyNp*+HGTcdOQ>N zxp?^NuUhfcOM0Hnk-|lVkFNRX23(M1A8=_e#B}9DMhza+A`9%e#H-A7U1Sf=(t&Oz z1VjU*SrY|~F;hydWHPr~9OATPD=%OB(%D)bcda1TMW*exxdZ89T%|0>A2ea4xyMta zd9|=R70JlfxT=rcsG>Y(JiH{<;>X!4f527u`AGQ3MNDZ)=ri>p7Nm7-g*4I8Hu!TJ zXbxGlw9aR7Y~+VXXRE6P>{Q9&f1yh)i%GS9Wc}YRbc4g*>%qTU7jvELXpf=J+0dfk_T_;mM8ECVSUl)TDWO zCb(_cU50u*`mp^p4%IvQ2TLhZ2*xmY%8HG7ITG5Y7wldpV@^^s&{ z?^%$rhK9+)J^0-t+7X(tntVh%B032Be*RwN6~puVhpi_7{T-O3NpI;BKxc7TtkqCP z!LbA%Wsy1P%@yoskmjBnK1f;5WJGu1W>9-cUU~wvzOx>X>_0{aXKYnR9whU3-oVCu z-%mU6ZI1xb^*xuUZfK` zp$gbQDI&cF1S!&cAcUp}NEH%#2uLSDKzfI}6O{M;P8sLiJI)>B{E40=6EO$~G^kuxSTqFkI$cm<;0yE8wp+p`gz_C|S(M*49h!q=J3;`JNm z`O1C>v2Roc)yC<@2hOB|+c^3E(RKD@hPLPsO9 z*TiW;j_-kHh!o7Gz!va+IyZry&=zmoNrYRdxy@M#-dk&PK&SxN*@U8*o(yAr#YdQR zEnHU6dT5M9Ipd?K@8=TFF*G>9NlHywwXHFJD24nxtm{g1U~-!I_wQS}QHdc^<*?ux zlI$pJrrq`KE5!w6F6eTUkCsG#Sc5a>z7iE$$>lvU4aVY72Lo-W7^`o+diflP{aUQM z88+8?+yP2st`J)$-`Eojh9AYCQaYY4DkQP~Ub$ayTXz~suE&=xk~kB}014;ssc73L zr-@JZwm^g?_K*Y&FWxn4%GzjZZTvorF|#}y|C3w!)TTF5fp!kF-qhBLU$g0~2T9qx z#}wy&JNlY!+!rilQrP-gq3@=>p5tvoNXfRpHa7Y;7qnq+3?i|s17?M>$=SoYMU({c zyKKv{%d_5%`=LFrrn_*?MJ1B3xw3HF6leSrSCGil!Fbk8Uz~zd&xYbBHHZb;nNDy} z!WaY2yNaRXpoR$g{7Nzk;g1H_xf&d-%eyJhG-cf(`wY+0W`PT8at+yg)OhoKM23oq zhA#9iVew*(Vn<<=PCo&8;JHF*&ROHdS*zOZUki7ill5!~m)LmI$trwGrihoa;$u&C zkj98Jj3~^j7(?@r)=VmuEcOVM?6h-r^gr1 z-`kP_T0*1F88@EogLjZT4GVnqBceCESc2c45!adZP$)^pq-3p`DKFLw)fJB0?i;uW z>0arwB~#2-7hkI=cl}~|NvbWrv-7sw>y-?VOV=04M+vwP9it>%v~fixNo@RbVc2dl z1^Wow4Cmsy{KC(X`{R#SrG%8q_eyVqValgwhCkA|v z(`f+s;~d|?8av!@{!d2ZYW)VFbw48iWMfan&3n3Sb$)YI^?LQ|d64};sMaWcXPgJD zT<6vmJUVdQTYug3Y5X;^XsWXQ&F_Uz=kl~Ff;Y}>D6&{Q%XdxCECdI19>N(DhxaMpMit_(s>)@ccc`}LMaLkubQ$0mFo6WrosU0a7gJ^x-s zuB^Xrl{oxKU=eXd6Z-sf^eqsoj`O{KM=_N5QaWD52mDHYE{}G|HDAAND$b)nGSR6K z`3A|_F#dSd#HPvyfyCNdDguZwg?B}Mq+U2v;l9bQaSfV0Wk7olH#%7aTbS2@=0;i= zSkQr|7w7K@&JnhfpCBs{3ljY$GX(OOHk;=zcAdjGwYf|n+M_lr?hZBA>u)N`ECIuj z$)+B)PnHV;%IRuhx6{8sH46=7Zs0iKlsiLeEmp7+boa9RrthQg5gF(E{7rIwV?AY zc;9*HX}?Rq8MjI@ZBIp&qOHT_bFS39NNcSSalGy4l`a0%I*Ly^W*_DD&{milhHD1A zLa5z?Zr2C25GHr3yeW)FFONDeH-xo~-6HZeh~XL9 zZOB2QdP(9iH27w`t_iiJz^J<{mcdCta5!czufU^O%+b@a{Y#F8|YeC!BD%b zEGvv@-B3(^+G&x0t}5e)yFroxg?;*PD7ZS+2B8z8DnQD|TT!lVHD`a{HNeX}%OO6& z09U}l$OMN>_1_9lbW&d(A1KjaZfTsiT(D!-yg*@xcAUE1o1N=aIs%^sQ39$ z^x|f@fN$lMt06vNBN62NbQ3`^I?FqLqFlWPmoJ)=s$79OcRYEJ8~yRDF@*rs>GE=|qkc0^&-t7(pPJu7PvqPiheW4|-mjd^j9S=y zA(c2C1VnWGE7h! z!?or|N~n~8#N3cn>61CTw#?YaR4%>OxF4yjJk_JZEf%p4q|lKoej4sxISOdN(LgHT zqVa5VaDYied<-2BvG^nL0?AP|E2xUBnh6l)-RqH z8~rI5K%2F zx~2fw=1i;f_TA+7G|!z9bk_41QBF^`AGt~Lo7f}MhF$Li_Jh#%9N4!YYf?QbYxe=l z^Zi~=+j|dq%$1MU^p@}cT+?l}lH*?4&$NVVnY_93Ge{d3Oz?ySNFFA(K)T_k|CRc+ zT*22}h`fzPLRy4C#SkE_Eh?h^+e=Bzz8$7mZVAH8+VJ?3Fn?vDTxeiB#RKw|BK*u8 z84pMn`0t33as)vBGj4ANpufdHMqi}Xx_#j-$%0S|z*r#~7ZUlbc5R?(KS%gEqs~?a9JxN%WD?Rr=)9zv zp4Uqc8t{{(#oJpdiQ#GlS61FWPSir0R`cu#XV9#4UUW>ksC7)9XaY%n^wAR35OmC^ zv~If75c-&sPHs;bf4*kB_5zUab3krIi0m?(71B65P3vMs7`t@_fH5I#@3#sot?j;OBKJy7L4T*Sr zbycSG*8LM18&53bCenhJ_{U_H+_PrLv-DVTzzo3q&buSCp$U@Zj z5;9uA<0?XCo&7|j|MfnJlGU$YkCdF^o8&zkEW&ygq0?TCVa;!0?l9PTCPsQfqRK5| z5et92q_CZ<&5zH1?%1y}TH*47gTQU#$jG8Pl+iy`)J5ADvW;Tq?zI^Kfa1-o_6DN` z??WmY+$0yPu-X+f8DT#1Sswr8F*?{ZnO2B1+C=>5iAV4>DU#TUmruV zV9ftxa+cJ1j5vn9)HWQx?Vd4SZqLtJo?yz(b@3T`J*dr7oF#unL?MbaOh&WLx2BbS zBVKSSj?=kwG2E)5eG!kam42zrq0;TGp{BqF4GU6uuhsskK#{`_OYc3QeJ_(MlDUp6j1|^TbcG;p9=V! z0A4Kyoj8&%eD#R@&Z6wu6+*}_gAQ_Lsv6@X#ZYVxMsa75RXcg`A1K;4Pk zmXfC2yGq2IUbya;&{xv&DLu zA+d^n!*WOrM0DaNloQ=4m0{ijqS37RrCBU@59_wM@j(PrzE_zG1mC~8?&7mRMxWhZ zzAK_~ijP3Ya0Kx+FN{~`udR(F*LSF+7d5QU(ZYk|Vm0apa+(F~-#CDJE^IA!s_g8Z z?{N0X1I9#_{+5vWq;T<>jl`;w-wU*x^|8rZHJ zk=il>JqfP_&$fVh(f#M|ib2zzGhQ)$qu?xxr8~loGyD_*@iaIw`-{_%hf?zy6h2Q& z5=soh3gXXYl?>@A-`llIY}`_B458qaImE@_mRp}%csVtfA+abq(GSp}2eYMg?W>|; zG*b@)a6Q?noHe!Cp(BjL9pU8#{Kx&?bRzB-AtnaMuo|+9^`m`e@L1n7fjE9iPoCs9 zmj>X*5%71WaI`90MNX4Xbmz`QzrECLN$OSzA0~{O(YtenfD6EazCiki%3DqW=ep z@!z6A|JePIS^%@;f3^hu3v~3~JqZoO+k*!EolCFDZ}eMIa{~eiP3RJP%xM144EPO2 z%N3>FCw010?B1S@_Xjb7O}{R6XXgZ;0{7b)rNx8{qRG!nWD~9)y-kBUJ2L#T%>!tNy&}hKZ+O6NiNa)46nI6WCMcf9W|x2z{hgOD5bZfq zF<3+o_XT)&>%Z}u@gz5S18q$E!whr(B|w8wx~CnO(GevQJl#3Y(#o8xR`Pkt+C6cT zBA`rK#MT}DUiH}*t8wCAB0fFU&oH3e(gcx`{L!K1eI*B51}&} z-mVNb-cYaJUz5B{?_i5^7#h~uZBh3CLl;SB_g8ZL((&nN_H)SKFa3AJt$O?&Jqit& zo1XfJ7@Al>(vSk??>@o?SKt2*4A}h}(Qt9sO_gHs5bAsm4q9zEDfR0oCAzN^`kyEX z_BA5P8fy>2SftBhDwq{7t7Ww7s3#@xZzyp4p(}nf9L;w;99`s@& z_f}@<-8+KAjXy!X8T=?B;(BLe=7lH^t0{Qvj zhyA`ctQxvC<31I;?jE=rIcTCG4fNT~nFDbC@v>@X_h+VFYRf&bvE=E@??0cj4l`0^ z)esb&KZl9Wy0lcy-fdUFxP$?-$C}?)z2|C2fA_2EL;9S{xiGg# zfBET+x?S>!>DKCSvg+zr*P4?dboIj~eaXtZS=xvv+dX*hALG~EZ(Z9?*Xx&$jDnVd z7uc=63LqCJr|r8p7SwQ>rTUChDXm=UlDJHOL=**s!I~p(%bzr%UWd1PfPLospG`zX zV6|yc-bs~`xVeMN@7MH`LsY_g2W9R|2NK4z^5+TeV8};evolgw0LuO5=b4p95-p=% z&vNzoE*l42c$}-?pdKv*#6q%rvkQmL+;8n&xVwvNhjIfO2Sxlzaz72)1wUp13{cAn zcBPs&V*Umza(-nX=tq6@;$aEROv$P&Lz&RUKu`dOYF%1%?P7U&dO7ZuDls^=;rCxx zT^rhc>wDw-8;VVq8>|_; z2j8$bN~d$DU49eWrQPbD`E_xqM?nx3v=5t)s{G;AqOVVuIF8=X%zHa=(|;_8cCWU{ z#P{5??N#Dl*VlB-;T!&`!%w9G*3B*l*)6_0#!WLV+JTEMn_mZw5-en{T=n6T)0oqP zR~IZmv(6LR`lS z0)H-`Ea-gtBWd;mdR}EEKIvyL+wzmqiyR6wa2#i1_H1)h?Z?tu!^H zeqBF6Fw}~7$jwZS4!4Bo0dFRDGHs>4ltjRmqAFfFi#ol>cRwUG>^NOD%o@KdZSplaEYzg_loF^Z%AurQMxVSLfw}t|LlVH#ymY7+KWztsa?T!8L^ ze*Id#4096T+jXoLBu_J1A8&i|PyN8aLi^^Km8rr=U}y2Wi<5TX=<9C3q=adY8+7T!3T zrfIeb(=_0Vj_+RsUDF^#lEPN)2469;2;%I2IwFTsSDZ3k8OGh>Y#jnUVjc%oEVCC@ zE|p)}xl1rs`Wquo{D^$ffVT;31=Ns0#9&fT!!WKBVZYp!ZL~Lp>94JRB@z5bAwk%d z1F0{ASwYoz9?YRmqZ(6D&25==vmbEXgYnjFUFw4Zoedq;soKrh(p}d%^Ihqc6%!Zx zfuDSE^TaIhP&{|Tg8E}%Z|szi^{InBlQX}5k*6v@{8P3;KLsY>9Hr0Ag&Hc~p_@;hpXR$wZ&%I8~UIOWmS}^eiz>*V!sW{G{SudELpWNF3=GEPCvydZGp^WYwL;&Wg;<~N zbrm(_-t)3?46>f@45n#}45-x~W%C-R>_4Yw&R4LTMrEFvXDTANSdC1JA0N;#^){PI z!`mfCRI2Q^CL?<7-5e1EBRo@o9W_24Ai#v3F2brkb|3#{gXFZa#8*R>coS8*5P@$9 zrOMT^~yE^R>Jp*|0hiCG&|U;{9sA~F?f zcu!-lH{3$k*DlC<#)SRaY-l?mWE<7t(m(I}E%*gmvlwRn5OGi9LAiJ%dvQ&%b2s$9 zs=R5|UUH_=FhP3he3=-b66`nJ3@lb#ST=cHxdR0yQq9$2KnIFE0#P_iEHIuns|zVq z3C5Pd#d~NvQ@w6>kc!plLDz%QB{;|QEKDVEnNHIH(WPg|4GQIiMFT0hKKQDaC(N~O zzy!m?x>C#r=L{9%EF5NtpN;B@&P;#miFhC~TpmwlMF>fhby&D3Fm&#QRFL~xVViii z=r-QOtXl~5f=pJd6n@y=+o$y*F*b*i8yC#zDZn9OG2pT@Gm=A7H64>v1 z$n9%pw&2toEN!k!uddl;ILcfnlU-_vWn>j_6izpA1)*p z8L`x@hhu&AjUf@CF<2QWcHc$H#hu+W2N5hLs)0_C<%LUOrCNgzXzgLezx3jD{lb#@z z2k5n6f`AVcvvuBN{Pq1@zfY)+1cMdc%#7Qe^9fJ^cF!ID$uX_2Ri4<+wR=@X9h&%U~xqC zj7~|^m!nj`e9mbe;UX8)x<_Y>gNfK9YGHzyW^mrKatU9$i&ml2LW%Wq%{lCH$H?#2 z(s}yO+F7m-O{Jmq?AX@IGa|Z0%(Ix?^-tthQU4%P^noE+1&FQ=?%&m?I$6|6425xQ zEp=Cn?)zs*blj+&8V_WOZIGw61hC)tfR6f2e!PVn#`A1x#<24y zMy+L9WGacLR?l|qmY3U6m-L=92EBhx3~%rGn{&wxJP046l^i~ER;E_gq2-h~HYo^MOYhUQ3s$beu*aFpo<@(g~>{gJhMl9#KyqrjOmAHqNI+bK9<7spR% zhv?LLLb(oSHskCU%mIL|HrdsvYB#>JCESF}t6eHeyi4;E5tsa(eJzK8MC+LAh6?+) zl0Be3Ym}28DMSllDVs7e@8ovLcu`Zq^UPa}6_)X1mDVVV?HiErPF-EuN7-}}Mr3-j zB~gPf>X^9hX3slp1%xOjDuvq4P+PBSe;P@p(-c#`S#gsA!#OL`aDO;-Z*ruG1Y8m2 zPB9&}lvQE8z$UR+uKtB{HfsZ_?Q;@CU9|h8F{prb(dcvrP0h{Jpg9TYn&C&pTVLY~ zIbI_nO!aFOjyzG3rnA2+Wv%1%l(R&&GgU^rEbN3+Eo_+@*JGFpD3tliQNQ4Fj9LZe zO;al9nHkCs-Rfw~b9IepQ6=O%hSpOW8J}s}KgG42<*q|qVSq|YmyGM*{vtcI zTOm%-;3pk53&g$grZKhD)AR}&+fGZbC>Ttk z=Y1Z?oa?Tcr1niblDWpK`*~2OGdaO?7a;6#AB0v4&yffP5ajd1hUpU%_F3(zpQh?- z_9-u|uKY~+EfK(4`g?xiK^Sf|s-PS=! zY})17VvhtLuZlzE`1WO5-*e-JL2dc`_b$leb4uCM#B0i%<}14!e{iuaoi2Fxw6*rM zRId7)s)mSEWVV57cPKSW=J`9auG9+8ce;Rdla1y2JpzHvTH;#%lN(gDccMkA@XKr? z={Lt3bi|BzDTj14jEI8RD8_qxboT(JcjJ3N^%pWGrn828m2TGg!7F{u0Gq;Z{8Gkr zX-Htc0216b>$;&V?JP>k7dZZxvU9sG#oSg~^#xHDbg$CpFG_TQyAaP^RDv0^8FL7Q zCs}6`2}K1Z*_3`x#jxtvC&i!RMW@V6V$ZcwDf3+)HW_409EWIpYX`QPwkt-VjlXpU ze=-=#AgOfONzV68&h3W39_|GFl$PNAo6BWKw&O;=Y94aoR=zS*2t#QsG;L$|C z$_p3ZQUM^%V^SA{qJEfU`KC`~EWI3h(|gLy?BE)YpE1@(L1c0+uapm03++hGnJ2Y* zDmEhTf~~Hq91iutdNpWh35+Zl8)IgUSX)1*P-6iqOZe)9{t=u0j`D{4r=f|lw*9t( zm%WEgm$%avC-@7SkCeJ4+ZAHu^cEJ#rbd4 zqrKH;^GR*5t4aMN_3xfJiU<1tA-5q<1d?;16#p_=jKT1eo98Ke<@v{E_1W9U<+1$hiURhT2!b%IEE`7e#I8`(<9NLJv5DS2A z3U;bPP}+EJa^73NHapg!X7V$dfRWeGtbH3vj)Aln>Skk5_}ZzC(`w#Q;Ukn7d-v$F zu%FTUYI59FnConeGwbf=qW^&AjIJFGnt&CDZvdEjZTF&aBf<^ChMMPE`0n_Uv$OaG zL(IAO&d^5S_wj6+@9?3~!Eic52As<&>+Nt01xvc8Gn($$FE-8%1|eMic==#T4iO+a zv26af;Ss(_Y{7+L4rIm$L*RL7inY%#wL;-UjxEIuRVj7ApH~I`1C)8e<+XZb=4%RD ziRz*7gF9Z(KH;}>!(EsZWN~Ho<=M)TELs8rM{T}#W5KN|g*q=YcC~avQ=r%g;#z^t zT3p+T7pbbjiJoR+b-PH71H>^f!;Y3U3m>H`fN}B0Msf|dNzMroeH#k&Lhj8Ww4QDC zdphi)SslUun`k6dT64O{vFZF;5280}QI4g5?7Uu=$s#MwXOFrh4BKMPS(iH(AH8!l z+PX-HL5uJM1;H#%z7o$cIBcl&dj3e&tKOmTWc|}7_8`|L>F27P` zjINn1We&nDnFgASooHZ&FFOk!-IGk`MCsT*V(`7ooy$Y8LFsZY~+O->c zR|RR0Z*@Ne;IRM$?=J8i&|M(8{a>0YZ7|f2*R`SinotMKG1iARxsscXGVX2*9r}j5 zLb2P;&X|sT**2i0>w#f|HbF)+6mS=Y#|2Vs7-FhB4}4FIn;e`cR7c5JizJ2yB&9;? zpm{oksD#tfg0rmQ5C+e#j+c!y600#-`+f^PuW5HFHoxp8DxFy<%cRkyKj z^G^lPtfDuDOXRta=nAhbM7ZJ%K$pJt*$&C!^bex}s}yqLrifq5 z@?r)>vhW;E9pD;?xy4YdYEvbzvh%b46do8`|@783$b>9e<9g6>`ak&QDCNUKJ@#m|F~}RoC7bpNPw}oWmf7 z)<`@2i(V*c$~APHLp)B_$wNVoaEcP2mj^_gg6Ybt5A3DA6w8h{}v05kNFN71{sUP$3=w}RXFY`&G~>YRdo$fYNcA5F`iVNl6r zd`skhx~YwE^X3r#^tpmbX?Mj$b_}!z?9%o=)?%n_fD+x=pnkWDE`BgssIFAM@{FI{ zf9Q8Kbo$S0YL^R|es2eq=N;eXW|&!fq7D0H$4r0SEozBA(F)^PK!;1jhQCueYhbNF zTW*5L!S{-*eWJfXI{x;Hvb|4`O>cF#m5-0%BTG#|{8lwde_xn|fVR4AIRsqPjQ?`6 zhyr8t)sCZAWpmv^0DFIY;_W{`iMV8SvGu8`6S%j`Igf@W`qA?19jhMJ{hv<@1S67n zdfO69AsC$d;65o2QSM6cYO_OvrZ0tVf1Br$mS|dk?}b|Xw4%yj#oF{#cep*2w1cf@ zm~$w3L++_0>!Rz5GwG>vR;A0^+YAg{dD?wAG3mS+)=84=$2B7X%T8Nem&UB1pIswr z-nZ+D2x{`-I|DA%*lvEfJ!AuocD)g6>7=C3?AJ5*59#48B@W==Iq-_d9ciQV=BVpZsU-T27&K6i273HHi%CeYs@ z-~vjMu70s+ROubs86gS!vzYLm7|6)K=fCY>%j^rw6W=2_ruiEnK&O9RC%zGc9Og0J zPGHOb3#JS=03jVEza{vIoJxS61jP_){Sc#OxGiWk zoE>FFRk+@4^V){ z<(Aquu`-k;8Y5o1eq@aJD~xtw;uF`LR<6D|cj3V8z^&35rnGDY;?C9G?P!X;C+;uZ z%T_Ax`rejQJ7MvnmtM*nBwbu(F8{&`iQRY*9X_}7af!ZH3q&+R0>$k7#9$~vg}Fns3G z*y3rWK`1Lh(Ayg3k1N!7>z~%dSL+w3 zImpkv7U31E$mzH)a{EHjt8&6}-e6ZWXnKcEBiC+Igq%++!9wM-R|0h@PENc=QiZ@O zkl8x}7yY4khNFz*+Ob^aRbk73#n2bxOZQw4NJRVvs8y48CmT)Juk^}}LLYRupyAg|JG)o&(U(A=osUY4SRZ9Y!pX?bheZs|B7&kU+ zb(UBBrW0^--uo9q-=O94X=ctxm;A9r{L#f=Es6~5s}_n!(y3QG&bwPjEofF}+jPa` zZ9&rJ^whGak-b6zYSc5wY{*0!%r*<88tA<{_N}ZG5V}OB9ZL22Z-o&P$z6jcc=AZd zT%6YDoE9ZNov0G#HI*mtT_?ZhYbyPiG}L`aVUsiS>cGdD$tte_&6HU*wH6U&uunvB-<&#V}$$ z-KF^&i|3mFF$#eMknvl|aObE^!l&pWRR1xSNF`eza zt|@FFL*1xRnl@KBl4y?^>B9Dm2tB~HPJb_i4u-JuVJq~f6Rjt^)(k}*>VH=z$I$;f zWh|iXgDj;zYkprQd>a+7Tl~u_eU?`viK&fhtFp{)55YOJ?Imr?&3lTJ50FtdW00uwn?sgP~q?q#5Go4UW? zTTJ3vSC3_djBqKmx2WpTviwy{fZ#Y&jQ@0R4=j?SvD&}m$QXrTgsVs7*9MpUbL zdo)+5GF6Dl!+5w;6^I(Ygz4%z)#+9|$Vkzr3|H>MF z3DPt#rytuJjH`hf&!v+i#DbXvGn=6a5f#@Ub@2~ahxDwU-DAlUt6Z)0*)A>(J+3mo z^vmjx^$WL!;b&izGGP6}CMqf##`1h0+GwF?QO#DnZd>A{a6~|KSp7Y)c0mDOnAsdf z{+`#1@W8rASYZG*Am9XG=Y5jLA6PJK|10?9pW-?Ihiq4EOy1#6&D{IMMnmD-v~hro zp*|>t->!bV!S>8!eW&mz4NQE& z(YD}d0ar1~NN}c)x(7Uo;uc25{O%|+v9(~wGU`Dt{@U5K@LeKjhd7zt^bein-i*G- z9rhO1-}z(Ji6<;ip(VU~v$FJ4yW=oF?%m!8xSSWri5WZ=Nz((bhb4hIZM}jdQ7v5)Wzh@>t@Epb z8FC|~d$bvyJL{X7p>`>=SBcMX$Fu(To|d{khxysZz&gi|Xo_T}C{b)Sw_DRyYD@Eb zh^fH&$7rQ|{%X#M=4jh^Cj@$JTUZ)B-`SgKi^J-3hxR~gmR3%^bF&le52*{o=Ws@c zj3}2s6CSe{Wcnd=??ORK=vLVjnMmI|Dt)kCrn+6`J&}9E^nTIf?Vr&`m*mY(V^DH6 zLl;-e<8`-dZKu4a!*n8+G`Us4!V$?Hx!WJV*Qnp%oXnZ}YF^&K+~NQ0aV*gYC8ELz zcxSTkC$yhWyR`ZWPvNA+ophLClu4AxqUFzHoVM^;`ZLkXP>Ia1Y7^m5Lclue6`Qno2?nb zPd;&4?x&mo=GnMl?27O;M{{M#6(ZwwUA`75W!vo) z6wbT~0*qNvCs1b++4_1GccSb$vaB=tVq1Nlf<@kQlPNkF1Fxj{>lMloYjf{u7Ui2~R`jW_vczHwZw9~VZwTrC(vcgb2Pv*(DmA@hSf~?% z>n|g%!i({vlB?V1G7+}d7Bo9ucd?fg7{%06^WjeE{By#wf4^T`{%74c&ZDdWXpS^F zdDAC$``sz1mr#Khuh&95ZBYEG!-w0#y_d!Yo-`X>!~9wph9Z2Y(y-nST{*k`UYklY z2*Yzt9iv3uyzbb}206t*vhve!QA`Ktyym*`s?~eSVs0kL01-ixLY8>W+U*^4ZQY1! zaoR{89QRt@Iw02On)K-*eCaolMBg*bnXT_sird^y2MV~6(&a!Hf#*yti_3tG+g)$XpBSM3~6nOb-KTbz7?L;kXcIK42;hHR@3Q-I?)~|Nl?_D@>9i{gz%?;D#(e)}Yw|B)E-<6D z?{PQnDDKnI+pR{WHI|K2K9rQuHuk!(vcP=EDe<0IvS3nDh_c(D~^Kal#8I-%G z_IfQTa7jsNGhOh^*w+idmPuOd5?}9{=xlYIjA>Y|;azt0_{Wl$8#|2K0t&G8IcT@x z7vJn}AqzcMdYLnp3yh!U+$$>{zmgLgy3~w?NGR279?e_0(W7}wpUa=+z;4OQnU8Vn z72sFLGuq?v;ZIK4`sPtiIl*!BnRe2wsFJc4r+WnkC{YE6Seh=u-JCgACdwtxGxl(P zhAHFA$S{n_i{2g2jXC}iC{*c#6j^TClu zF!-%IM=HH-LG`~A$)fb?c9y)lSqrX{?-h+T+-+BzP-ieS7(FrSB8KB3^MxQ&;`ynE zqH3Oc{h=uy`C?=1p-6QVP6RK=lnmQ;(5Hl3B=kaNSlVNp+prFbEQ#|`E?>9o^VKRo zLId7OTe8OtNuiOk_!R*kX9;!2b2gPdJ1N8VgrGiY=oUUp-cb}0RgnOD!|#aV6KFaMFjFmN63Nk9shSZ z;)KjRp%ygJG9Nhqv7EuvSq4I+eEh|az^C606Hx%e0jLmh)E^)y4`uzgs5KU#;e?vY zM|}Wfy#aynKR!4{Qvc)o%K<*N7(2WO{|W)khW{8J>o8>{v|IY3F$nb2m2md|qcu3L zyY!E4f7RIM7BiWEX=!(+Nd zu`ohk*I!T3`0BZl^OwH{@Kyg$gp;nH7>Ird%KdZ8*QG#6-ZREj!0SZt?FX5iG1fXw zl1GR!2nj);?!!Xs(dmTV2Zh}5H=sFLM5qQvr~u)AkL-dmlP7j_9$DnR0q@GijviKp zrNe8=nSi?G)7cv}%M~z#w8=5jI0?_4?+~0?*nPr4AWu*Es{yEm{n4osqzUVr0x_!o z6!w>&DInXq7f5cbVd#UI-$3q~lks?Nm6jS1oqoZ@>jj=OPEgMwb#FCD?WQSVB_lT` zlfTlGMjAI=Sb?vW2AW7}d;)M8U7L2?mM;j|$c$Q4sp@#Uwr! zxan8GiS5FokrWm4F04xx^5>8X+uq+_oY3A(jmix9c#Z~v?Gz}Ds=bc?$Vm^7jv2G< zrXLH8(9n5*HzLdcH}})80X57)p;D)KgbfqHm60mL(@KV6gJDvqiaMnbS#KZSvo9NZp4OYtc+JcD6IIk z*w*0uMtB`CvWgx9?Yr($3A)X1`gr*PrdAw3YptUh7W^}tz{B^H@rtc|mp z`%5S)pp~FLdqpo)0E^R*pW9wC2nZ`j=?`}X zt`S=LfY4IHn4dmlOqh!5PY@>G|7w(l97O6B@K+X?I)Fd^ zgzP==w>}(r1AybF9MJo~;dl#p0Kg$cpt%Fb|3CfzcO79I{GSe+@i){5hZE(tf{JWH Rbc7$0msWXP@W}Y({{pIDBnSWi literal 33488 zcmdRV1yr2Nwq_GF5G28!KnNia2qBGIh(LlRxVr}n?oJ49!GZ_Z#@&LuySuy7w9HS= zIrpA>XWqP#HM7=ZtzPv1ch#<{T~+)0_O4w4AEm``u_>@YAQ0|*@i(#{&>aZyalyI+ zyb&!pJO%!t*vN{Bf{F&Hwt)vUqgPU|K%kN^9GDI|@O;-wT*U?idSH9|L0K@Qbp(OD z4c@OR#VPl(a8OvkXrZM z^&^9gI=Uj&tiSZ0Zwziy2VFuVR$V|uGwCWOoi9P;;JVv=_2=3TX+%BU?nX4Hg@ikj zG0`if&g%7XY{cmaP0V~QY`73|fxwZ`wu8!gp_8hcbG*pSM7Kd+RG^=K`?Dgxeen0+ z0ljj&{l@c19usTlwovoKG(M4!w6`zu?vA5)Lu;K@c0FJGe~kCn2N>#NqY z#cbh=co~ng(G+NdjK>K>3KC`nrns$k<9RD}J{-%jm2#lh!x9$44I4OwO$c7rpD(x^ zUeDhgx^40wdK|h)3&Febn@(HYC~$##o^B#`o~ez2M#)YaL0ZtNCi_mHVe~3k-yp0n zp3@=a8YgxDmMQGI%&zH%G=em)Gbnl7jErj`o5!^pH@9U3&vaxleqaEiSg{0I`G-;q zMfPc2k6txch1<+LTE?T_$-g>~lbOG%tkZ&(Av;e!_Bs)pO_xou`CX6WK9BPvP7k;o za#zOnau}isZ%J2bx;iX!zur|6hIU;FpATg^)UVP=1tn6MxUJ6E#M+rlsc(CMnHhpI zcGIKsV+S?(2S1j;%Dq2_L^DFqiuo?glWK=nIH>x$1W+ZTdyzc_X~e0j_|2Yc!e>t@LUO`u{s2E-E?9^i&mAh$cSj%~z z+kJU_v2lL@c_f24?4*UZVY=T`xyy}y2n<=!`qAGpJY2DyKlIBvMS&DkD zxY5tSjAngeR34s=JFd^wKIG$(&-Gz(IDM#nT30Pu_$)u^a^1SymN(E@cAm}ONwn-I z{v?aqB=LvXglE%c`iHx{>gv3FV#EcB1^K`@veC??O%={q&A(&%;3>;t6X&y#3-#B{CLsj80ikzf>S!cDv*c)^(_Dj|RP{Oqx_6NfvK}@U#ELE+K<(Nm@1hg_#_~jCl7BwU--#$+CA5E9CXn$JQ zXBD5yg~)wb`$m*rX1rkOEB;F++LiBoc`rbqCEGM9>DxWjf4mgaBzH6xoxN~_8MX+O zv8*}&+H`f|agNh;HUNRa0PFDEGP#|MyiU0q0zONxQye{QLCDLSLl3|(eO3)v+zNQ; z|7w(kE!Ifd`i$uTk@J2{)JDl<^lYhI=f~#~4#)a4scy^z(mIl?LxGZxGJTfiqd3kE zni#Rri?V}^b$qsgwBaz@>c?|?i<(>GK1RAvb9H?UKysc?couic1gp)EcTWJC5M zvJqe4sHh6QE3w$PyL{NNyy^iZ6h^XKE_xhlI5b@MTSAi-5lM^C{zd0iN{?0CN9aP( z;lL_^6w5$T4Vt!7vstJj|i2Bzkz9DSEz$K5nP{LUN}N(b1tj*rpwCj z(wHT|0YjvWMg~~O3I~rpg~O|!PT_NZe8Dg0U|Kjn@CsRXx)O_QrxgA&%cA8pYtAn0 zfjHMfLMOrHVXo;+SK3%q)D?I>Y_mGViEL!w#XBW8s)|`PduLTxGfZl*qofN;Lm4^t za^ze|C1fh*KkX`VsvQ-Y<(kI+TtSrx>EYjZCQj3psW19i#nG8}S%J~9;%X8COu78s zSve+(a^jqMpF+8m#L>rh9S8t>$qpOn^f;f_a+>T!%zs`)j?XUMh&j|B4r?_Y;vgqy z5l0)OurZfKo8^PLMc7yF#3ol>{+FOQbXima0OyKLZUHa}wCopSEw0yH5Z8n7xn0dmRp=qErK8(rFFGi$$Dm#x0GUd!Tbz5=c)ouq zaCSthX}4+Fbartnd?^7zUMnG>V#0`}Q5oUFUQl1K>kW$P?=Dhl1cqF=bJS6UmgN@0o@mYt$qEi&Dk~m*>o?mtvoO2T=Civ1Y4O z3_}!CZMxf8+C-5 z9$gpbJdP@!C2=gY0zW09sVz^`KivlqYtLlPIw;CTeUPnL2o?OCD#uI3lY;EqK?5)o zNNwWp;3|sZ*2h%14`i~?FTkxh!L?*KztcJ3pp%u3d{40Tp7JYLld5U_2NI z{RT|>LKAcxB7~%DLJV9Y4>plo=`zCb1~KG*I<3c`o5KR47ch{`m_kQhmkoz*hwhhk zi`N4V$%%>e@O{h4a<&n~f{m#1n^@``DzxakjSFwyC0U^1^sbD)b(tZ!e>Y;E&(?rk zArL>rFqxXt*^=g0bxGG5Bg5Vbql03d!dH^g7K9=WPZX+>Jl55V?u#$o_6x=rk|-Cr zIbO>mxP5oVnni5!Nyj$nz*e34?&nb+N5?W+@MeZV*n+}J?x8xoRU+kT%OB!?xVY;f zgY4#9gwJdWpDwY(TG)+MN!^jOHll0xp0e07c_RsASek*5*3v86;l!Ajbk28`J6Ch> zfWBqf+%NIG+_*2vp{tyglSlol*FI*`KsRgYv!eJxAU2BD<7pwz=>>@r{oWL9@_*`( z{)Nb=6rZtXTKBb8EhLN-0e`LKbhX2%i0W~2p05QPI&@oOphr)xISDxwK92_YwN2A8 zREshj<4QCPT}aqj<{P~nT`aYoEW_6Vas4j0dAoz~l48~c4J%QOXOy*)`MMK!>LK=l zVc)V`=zlR+vag$aS?hi<8#T)o_bT|*yzZOfdX7*l_=Zu*vPQ#}K~uG5`EYuncNjL} zy#~6$`?tj|j_bPLtHsDHf)qSEI&4~hW_i75Bn0nsXuM9tciW23Zh}K67tWztE~mR5 z`%*Fo^IBnQVue_^DY8 zmzRdVMSD^xeXPMM*lSy4Y*;zuN~XwIDPcev^5_|{X?@_3U2Z}gWM|~~Otp%khN9J} z9Zegut%yqNevR*se}BVY3!!r!y4EjdG(gp$!am^_bXRXP-Y6JY5cpb-qt~aG^;(d) z%f%=y886c(mbFJZ=eRzclNL>Pa=g5@FzZr8gyd)3LA+q7LG^&Z5*5NZ|P;oWhe#nW({(j;5CNo+1Az zQ)K_qMyx{@3g3lXc$txooaqwm8sGguVrS{}YRyKeNoNxNvK%$GeiN<*#qe0a+R;n7 z?pxJzd!r;E#KGPY|9V#D&R@1h92a&>>mgX50C8Wr6qb-(;!J_A@zc~fTQ9dMM~6Xj3>_p5dG!Nz=TJv4@nOlV9uw-OfzS0)CH$BrD+<|1Nf-O9Kw zU8TuNYfLV=fV?*YfG%+n}skpMTl?xcbWQd;xyvz`@v+fjn>-nm+I9= zStW~KKLVEOCv6m96f-b1uUbeo8(|?b9?%_HM8aVt#Z}jMRl_O+q|R!&h5x{%Q^V42 z*AlT|*?2I(zX-4NKnH_B%H4Ee5&z5|u4Z}LgC|y9J1N11Z%Juqh4`i#MWctk^9c+H z=?$;Vj1u0z>tm7|ft%G^yp`a}#%P3g-N+0qQl5d5s$Ss^VJB6Fxt=p4oROHVmk)$s z3w4W#cygfeWZ-qr)n4ZTu2^N_N{Fn=N_HeX_eMU*S1*M= z7eBKrmQ7i?lB>XP8>obDKi=rXbLe41{7Rq|1#YDW#Z3==JK; zOjG%@Y5~!~FCK{r)HC)pUH7;*bVE=|g$B6FDh}MHB^eXsQ6Hg74|p5}J;IU4oibW( z(V)HIN*d0<>}m|FXwG9l8C@P^x^NLb5K1EzWlq^L<7^LCA_#{sbSjs0UDCZlalLBM zxOCl^{fJ8WMz|RLoL3xo40a}iJPU(Qg;7&e3nH%vn~pmuJz$+4Fe8r(Baag%Efio< zwv2`*F&-2WPCRUU_mQR`)6Ku0QezlHIXX<<{NABWWqgR;fkC5gXkvdJijdZJ*>Tve z6IIwMnpi}vkb#F}*s&0pK-=$liaR4?GZ&(19Z>WwzOi^FrQs-Rt@kl4CV(1mFrEN` z6VLwV8n{Qys_5ZSLhSDk$WqXwAjm`hUv%2P66;6jn^0 zit!cTNjM)-Q9u2`vAIzH72R%ono5XwPb@_hJ;_R&2RbIg{vQzY|63OQKj8ZR*CMTE zU{ruxft#9O=65@0Z868Ii`_Fpn~j*8aR<5~|2+kO+n3z|7ki*FhQDlvS1lrne`Evy z&D26gfT)LvaIFU3SJ_mIi_ra)Cb!#H%|&Um>)KBYq`_9(BblqKt46{%(?)~InZn(V z!-~9Ww)osB7x}T$&itXeZFVOWz6b@ak2}{_YqC#*R-QRT{Y~t~CsY}s>op0@lgI?i z#_JY89Icy~$s+X{QIAL|niJvUHbM%_i7dB`lWubhzVvoHe>o`zJ;IxnPh5xJMS&O<5Meu;*3J#;h&tz*WE5i`G(e^IaYf8fD zO1qJvT4D#mo292*eG3ZCtIO7GUDFG7)Tw}*ok}~;hWVPAGsjB;@P`ha2BYr&7&5(n zhWZKh0H&FXA+333v@;6Dfw+<+t;g6Q_aTTD!bK7nEcw%~NRF~knsHG9^9F)%+4GWph<}A!zx9@#kC!(Bki2tzT=EWQ+0*qL4naiF!VP$v zm~ygTt_;chmCX>a72-D|qGKyz!z#>LFILHDDYnsuL4=K?-(F$i>p`m2>G5IiStQ*wRL%Aog(91-K^UQHg{<;Z|q8Df^okkuNaP*gLl} z*feTwPy4w&kT;9553##s^3R)?k1!ummrQCnBvI{~DQWF6nSw>aIU6FE0@xF8m^NwL zuN3+ZiSEgxYU=n7Ue$c3^$EKk8lF7n#Odd|b;tf#ji~3-P0V1C`m;>-hW*OfTK5G| zp=shLx7xmJvvVka3y~+^d_ESswES6H;i!K;N@-!L$9W2`#~He?iif%9k<@w+IUvvN zFL}V~KF#rBN_K235=PMP$fzVpx8cfg>Fdw*&B z*GKFz&=lw2y6_QId+={kL~uO?QU426w#mD-3)Hl0d%=If@R6~IcM9hO1OYjTjuWqey_i?`b|NZ z$BuwE4o}<^*aY_68PoJi#`umJMijnbj@N6? zVpv!hSQU^<_^+~)&kKwMuh*jFcXYE@6IxoX45c8Kx4paI!phJHyB`%?8b6omy3dLARmFXChK)2_~w62mkh%!-l!3bo{eZLRj# zi66__DgWBtKen?-#lmUwWe)bY`dy7fdf`Gm$9YfTs`+i2^u&Cjg@mAc=r3D-0b!QE zTW0lI+wF}6O9bMwNoIZP3h9qLqD2hh!wKNbvYxPVzNJN?t0;AIhnOfaNv=du0?rL< zQO${7load>l7Fss!1Q@KZUav8ta+6kydFh$yc#WKn?)qsJxeoV)u7`3r>iK59>PZ>hh`-z|)Y;bO(M95Pn} z)_pKpP{L#7lF0L43drGtiqZe;@3{Yop?G0+yz;h!zQSL2LmoAjO@mKJ$o--$#qDBG z1sY{`vPA*n{EbQg@RFyNEz%;}Gev&ez7*FJMs}y}eqehpxA;Na_CG5Xsiy(_2md<7 zapi6ZsZTG(h1 zp49n@B3Ljv4Fiwp&ow0BkL?vhM0Z>G=qG8z*4o;e$Ht=hot>Q&h2J+haJ+T22)~Ko zQa$-gIIo7RXX ze6;rjMXN9FGyLduv58ogwd0w3{g>+hLBr-*j24x4+>CVCCpEp(C*i_Os?1!j_(jV76cWHuQHr9TQKz zo^}1uShSW1Tv9^K<4!sq2=3}mQ3af-n|rrAv2Q@YbSZ!-xj5zR)vYRT&3D@%Jz9dN zkUl`U`a&&AiEllLb8BW;viB~e3Gv(By35@90mX;^J4XWl;wCJW4|`w(YerkqHmdOV z$-&;8ZA_N^nZb|FjyS>-0Yduc{surBad&gP+**;})-C5fZWPx%Z|;Y|&17)5fGh{k z#Jl{D#+qqfTVM*+=m0%_;EH-3EO?39yx~Q`Be3@9T+FI8A=|b$p0=~U%Qga&kVq?5vVcuf zLH%tuMXKB~re*CmCj9Z-9DI`ZfojcKS(&Fy7SS)lklpeDvuBRUJaezvUE+m(HyMem z)QUHClaFjIYP(Yo^DU=(2 z?(Jq6eVD{nx+Fs7eZ1~B-kvTM;bcmxVJb5473OPv(6wteTBtr5*_WXC4%s^#KKSBW zO<1@bPvnY*+^*vr#X}+o`ywjKSX#)+LC$Fr$`p-;>C#Gjkg0+Q?jD0{^V8$2my>o? za}NgPg$!DILF5kVlLJekSK?}uApRbP6>(Is*4yfzj^&dIs9z4HT%Mcv-RE~Bb9nU8 ziYCH(BtkE=$a_Ne9zQ|-LzG{RD(BH_Q;!P9%c9rSe-U&n5K-%)1=@!AzKF@6w9*{E;Ij8IQ_-;P0l7Iiyi%v>VV$|4j&zl(dniS04{n3X(9iO~hJc!ww_o{P zpRy$KGRu}tCy-`fy!kd-SCNU4X3E#`L|*nabs?ojk@QQKRTkEnCdvZEW{v6(G0KF5 z_NT`WOlod!6?Bf5D@ylM6A0^g^Rj}M9CQ{I>`1fVJmv!tTWdUG0(Z|w+N&S*dw*Gs z6<&RA@u>G?d)WR<{Aki6Ri1YzUmRnnhTD((yXhZ_1a0ABOesh*x}EoF5FajoR7(va z(pMmNSca=ehO)MUa`$#dz2gjd>Jl0FG&rA8F?0%RJ`?#qFG~oj6f1e1hlWKjQuu*D z1eZ0=M;5jGkfe)?$^jX?)fa~L*r`-QFcH0Uh&5-~*4vo3cJ0toEyLj2miyh)>Ew|5 zWl_=f#0?q;gPMoT3r-<1W85^t(HG)=O6_8@Umy5CJ^@!P_4Tn~UGu{n^}Oc#%7B4O zfm2DxGXXAe5%!hhTY{_a<$f_!EDnlIWCZ&xHt7?Vue*k?M5VFSR(cMWj;P&&dBHE` znUl6H^zU81-Ak|-ky*mUJ4&w8B!N_aP+sYAib?tK;iHDIt7W~2P%lAsT6Lf!t*Hca zEjr|2WmO?ZmFls=X)CB$!4#aT2v~GhFIC*Jo1*>h`dz{=5WH%u&>$A51GcZNlmkmbiz=!ro@j7uZEWm7xfVi+^SVbwRo_RqZ)elDl(Lu6Cm%obW$WCy zmRz&L>m|}k=W6{lFz6?T+k4zSuwiV78m5$Luo?EN|0AeUug{zud$y5HDE z1BiR|n^6G<%hLyR3sug*FPMK2vHynx)21G>Yu4u|W?TRb!+*n-bI!P@Fd|3-==>h- z@6NxL!zJ+B2Z-$r=5J#7@i6=;3jL1VKdTrYgg-@7mGuPr{AZb=ir4nlhJ^8|DO-C*KfI4t>m0_ zle3Zy@>zNd3dkq5DPnRSQLIU@ZifK}w=If-noZBX1BZv&%uDt^qL~CPXh2-Ih_CH_ z8))QI#vxLBe>mXNfaw`>>m0<<-X4SpPe_Y47N7fqp|7!Y?1|~sU*uym)|Q^}g$lCx zVuJkNLnykCcr{I}(~CUk%MdaU-OmJ{)JAa|$hU!F$QH+deaYpcs46Cw*U}{#wU_Ps z7;3~I+$&3YFT~qp4}&wyD0rr|$EtV#V?-bdh`u!b$qr}WDz6Bo_>sZq%6uNnm#6d` zBQEJupDQ6KpqcMRj{RofniyG$Pi>l5{+qlzYIoE&} ze5eBk?}w#zmLJ>>uBVA?y5gpeB=LeYB;@4Js-?V7b|`)KUw}O4F+FrpKyJ4@i5ts| z4YYUv3I_+Y_4+og@Rha=igsADmNH0$_P)FKW zpYNF_DIYdilqcKlaLN(t?u87(?r)jQThFR+J~x{MS}T6?E(c|SWmVekHYE}7D|wa2 zpl_jlhb=CBF@MX^bPS8y?Z*|) zzeDsuXXSK#DWQl>3EXfZg0ou6+noq_2Rw|o{fQ1VXWo-zvL$$75)k(87hZb{BPA6nk!aEEc@K6- zAR1#^uRv_WuQJ`rmm*JIKJr^CPG>l2-?)dl4K8Go=ur-AWp!;VyP&Z-0y#*NTf+;-9&N>WZEv zyYDPB)$cNok4iiP3;RaXsusD;KX+CQ`^;pVheCYk{<%HD0sBuO0Gy-)I7~f|#%^->g#=$6TpPmZ-^48#xJR;IMcq%q_ z{`CF2Z1nee1011-=V-O8$r79+{Cc7n2@hfJHv8)X0<@AIDt=q$ot8}9^467wSQX=IkH0U2jWSc5l zwPOB=!vFGtTF{Z2gVmOuG{8Bp)VjP|zHPPjie8c+sXw8=WwiZZC==uCXKlgo4e{9I zoWoUWh0oeb(tf(hoX%*VeW&Kml+pwwLU1*p|6c8G1=&Rx;3N4ln~GFItXYB^ued(B z$o_;Zad*-u>s0ME-#z&hXtt|QoAk{m7DLg(&&lO&Ak&%RCwk?zJhlaC>U~31yRPyY zsBB_VOPq2lar{wo+@f(dDHN}Vl0!v%o-r-AAKNcm@cKjcK%`X0cb)al*=BOtIPkGf zrFy3rYgl*I4D}CFk-{!XQ|%$%7YD^AZ*TMl_Zmyx&DC!n_Gy*qD`NsNJRM(Pe{WWm z6$=jw5p(C2r}Jj(9)C5ra?d^;px5l?>IS*YU1EiX?wvMxMJMPi9LRJp-Sm08-M4W` z;5?%$7OETwdRxmqcRd`tV*Wx`b!RU4WnyPw0(*sA*L{XS(Y*-wM0vIgcVlLSvL)se zO^Sip1!lPs%nzEu-K~$F<9sluFSOr~V5n<*S&YBxUH2`>5x(fFEY0=hagE^bx9EJJzA0@lH~mrW)I{(dkV$br zlU*Uy4+mdkg8P%h;D)e}y_VmSv;D8Dz=#5qn24WcWTH1*yIvaFz7$ye-y<)U&Q^HN z@9Ut-%~?D{^WXpM?qg&BDXr@w1DCrBQxWg;FiqS_t92;~R#2bp7JW=9POU&7M~N0+ zNe^F4TXFhrCd&Mx#M#w&ABiiATHZ|NlbU>JT4r34(*36;BI%;@9aP)f5xs#-YN&c& z8q41WkU@su5X(zPtMb%23+d!S6IQG-1=$vN&!z##=ge$at~2GywrxIMLb-ghFvra5 z3%PgHaV;>_QYTqquPObwSo44lWxKLz3X^q>1ePVeNDbRb=V!f}IMLZO>CzBA)|>;7 zy$^?Js$o?n69_|;wi=fM)KP2zrW*=)AVY$m!ggGo8@m#iy`HZ3A!-lSe@DaM%Qb!X zfJA2*gnCwoWC&pLRiPV&*JWJOLTu9ml>Hr_G-{qqv<9(hJiTc1)IbMlG1XZBkC55q zhWwa_KqUo}gsp;vt>}2?$6aI7L|>KZYU7$l@zMrvV)IV>IO0;pw=XUF7vGe+8J0H0 z>UPHn+qkxifH596+M8rXW7yvXIJJ0}(%SJWepEGiRMN10vb6MoK_d4k+E4aVV-g`t z8^iL{F2NY4TIV_2L67)9i&>P+mQWjNcWF%0u%**fO&uiLWf;4gys~~{tYaYeURa3B zf#I=z{*D*5jvxSNJRkKvuG+|KjRJ02!sLR(mD#5~y0lit2d)RkEV1=WVcnsb8yp4( zg=o~yC4nruUxM2W;b!yG=5l1#lMCt7F&z**$ye0#ywbWngHWD1vXHD8+00mu5_a^; z8Be*}aQJgC^E{MdbgK`vd;snCybCySIM6X_-KFB&m@)va+8kY%cTOzjJX>#x`g0V( zjFX_>(#1PKc~)%Tu^A1(BxRyMs{?2WJc0=S7ohs~v;=5B$EyxyiuNqs-tu>o+7hNq z9H5KahMIMNfQra%F{?NLhr@62p6W5s(4*TX{O~Uco%;>d|}tStSTFX8dZe|%ZMS4`^R%GwHcN`5W?=*N?Wkot;_)Q5sC3m^C2pvnyz zK7EZdk#z4vEXYz^{mAFSCQCui;3W~fw*Q$UF*EbLa~3pCeWftr9@c!y7Psd-^(v;?T->D zGyB$Tg(exA7)cH7$=7uCi}OBYooV7D=b>+Dp809jsSd51#zuM>fY*<-@ab;B~ zt%UflQ7kiuqjdVlXtjfqna%fQAQoF}-#g6Mk9^DzW#!Rb+8M$GPJkq&%TWGa3zF44A7GW*EF6oB{(H>JT=!-0}KVT*j-g~|r8fRAPaPQ*uQ__oGdJO-!d*Vjfni&=v1NAghGT5&^N}#MP zje#sVD>JbxF|Vmjqm%6O|Ga^~H4(eAN7T`Fr?AWSvJLi*zaiD_A^tagFS}UZEG`zJ z<>nYNyFUbXk#~`KsmoADDH7pvEIuwQH6(W9a-(6Cml-POW~vJvF_8 z(xr3ZV-8xPC*qa)%RV(^v4NJ&;3WnVU`2X{X^vyuw=U@n zHUCB1ZOCt=@#vE;I=|(s`(Gk^wnu*@>v^X#qkn6aL#>smDeStSYkKW8yDzy$(o}e= z8*zYJ6>y&Em=GKn!^h2lyIHcbA+b+n-S+J#flCH0Q*_YgO6K7wG=+ZeY*%L!9!r;O zNhe!<`GI&~y~q6!XWrMcA+Jm@s8GeWICl3tRd|Bgx8S zC9-i$jlQ{Tj5Mps)y&8m$Xx?hh`W`2pbFTPcaX=xtS^fPb7p5_>>c$FYG+;Oi%?N4YV&1>#}`p@w{#Z@2ymWx0wyJhjpkVsiWb-LHp|-Sq1^ z)Uc+UV3NW?{=4i;g%b)D&N4f&6++SDxxZda=1ln;vf6YV6T_?QIG{5utr$Pz8jm&#sE!eq+&E5Jk(T30b6P^%yVzQ6*2Rd!&VOG^|h}X{_PBqQV4v+rCr{G00InRgL zw#?rmKz?hUZcNzs8pDM6XSpb#3v_tSyjm(otx0G(yUhU?;1Zr*CjKBiu;6Ewa!ryN zn|oN920)&gUN8k#o$Pgj+BCU4f!frNQ>@Y+-~L%`Va@!r4hI-d%}V$a5*V9_{d3jV ziUZE7-VFPjJhKXD{)Q%<;e%LK08oAlcQ z=a9v1gNIc;Et%TB5N@hNcW7k7h+4=}SGlK_!YkKcjIN&R86?RyDbGn;y3Lx6D_x>4 z73NS>K=4p&a?Lr6Sy=YvgIUr`>CK>!L~>*G>;mlwrdkR+)m!ey3s#2ndE=HU(=7k>PpXl`q|phm;6P2SXhvLpV`sg5DsMMI z_E&y z`Ck_N1T<Qy?Z7RGQ|zPUgD zNBi%72*~K0%D6;EOBcN%J;|=6a^oz>AynFJd&m5B9-3_Wz;v}r&*=Bfu2RB30u*^( z)z32F`BPM@MH}2a3p1grP4(b*n`)a2OZPANwt}*e5;D6<(o%zo6LYig?hk3D`TlI7 zVA^<+R?Ow20(Jjaf?{oJ&`CXIEt#kIbQH{JDdW%5Se zZnzHjNDAOOK^L1ANd7y|iS+>EmKO#Bu5d#oi$#&e4MWQW@zIUaQP%ua=1~^YaKF-h zXaP|oSV`<+);$4Or5oi`CQ+ZAgkRGXmwNy7`=*@#B}^fl*YH}SL$S~XLn{%hH#bzP z(3Ci{=lrL&Z(03fOR3{C!)RY0#QqfjZL~T_w}4{mmj-h-@0zBh5T$L^aX5;$+;7DI z@o@~d7$=b)%tVUYj$!9`p+D5J_(}qr{bSj_1ENWu0L}dGqDjpcW6kZWoPgtxC*Zt^ z3wVrAYH*M*3xGSbyTPxxe^v<(7Ct|*I-_5zBa)!hEpiBXZTT~A$HGFn6M8*%FCe}T zgJwW7SPqqGyeU|f7GZd4;+pRQZ%lBcaLaIS!-M5}B{_jR1ZYL=`ClJ={(QM$_OkfK z(0?wOLVUAgs7{Hr1eGj><5~8rT0)_*4PN@4>{S81nc#-b_~iGLPc@qcuPxLEgBfa2osvIz|Afe0zPah{M<;B@(OBuJTAmb)49{*dH)wTtAg{FlN%OB z;_HR;E@i{b2MN^HL8f$zTsKua$NYQW1)Z|o=H`3CUz-xxJv<~IHrx{&IFpF%AI_Fmwbog$)EG=0n zwu@fdw$6yZdOu~3Q)FN21Z0D|s+^ZQLz$iCIWE_L8-m!UWfuZb3p%dlpCgC2wmw{K z$}N5u#o1;iPS4V*O_oe2oeYrSAM4wpqOF5WSqat_->>Wf)RG`kQFp|Y>+P1OS`CZQ z=b~KpN0t4?Q&U~K!hH&zn*a^3x_?Vx*ReOWB{iGV@hp}7lzCsRnvZF_j-h=$a(Zj& z!3QSBH-UK(L}@5#8t{ARH z`mS-_N6ji{rYMp!=7MVecNCmm^Mp<;k1K8Z<6gd1KPjxy8SY@rAXiV68DuCopC9%k zXI|*DH+WH-(%qv&@1FC9bDqD($rjpNP+R!LR?rk167brN+GeEg!kkkG(-rOMb}EX z%~1DGLa0fJgR`IUAupEo(lG?;9)c+SYO`LIZg^wgcOZSZt4tJ((GXHHK-4wNFT3id z#OjCbleJ@_kCE`}Lj}*AB6qX>xX2v){9_Y-%pW~wd5Na-=%N*D85%m+|M5!!YPWg~Nl~_g@l4LeRqh3>y z3yB%lU5#<`JVc9SfxBAh0NHfjstqNx(90hKZ`N8PW;b2do=c59nI)~cy9>v z7)^^pH;$^UHDoL2<P&0hJ_MLGsrZlMf@uW=g$LvR6@x_bLFm)V1};_O`MfIQ*cKkhY&SWog!J#jl8c zdGmexdZYbD6_#X4{6L!zXx?JhxX9=VU#SJNO`qA_TC zKR53kTh)Phke5LNaAgeM8sr(B*m0f0`3~2Na%Lis+U}9XC|YO*?OqIT|K)0U1+7i< zb(D)s+05U}2)-~|Fka=yuJ~Dkm9F=d_O5%>YA!EsjHS3PT`LFPB@a69Es5j(rji1t zbgyRX_O%v@$Z2Y*e_+aSWV|g-=`zAYLA*2OmO)z8(<#uDZQeM2ea_|1+UQ;lpH3cp z*|Bgq<#-#rx;?sj^Mi9uTBvHhTF=8NG=d#2^6)Eu-Nj%9qwBii?&DSlzmj9U?%ly_ z*Q}DygGSxIIm}mJbM>9e8CCg@Xbxx|52f6O z*;M*)shmv49Xk4SG}4h(Q()UXH0)(U$dS*c==8zE3Ulluy}0~u4%EFpZT{IW=Y z6`J2|<@$|C7`}~37}g%d)X;x7qHuAo4u3HF^8gvK;6W#P?LqfIaHDtjA6%=NVu|`a zR|+9CLx$UGCf57Yp_XoENL0V>rYiaNou0*qN^2Mi3x?FtQ9V}6g3_(e6n;_ZuYW?f zrSj54$!KXqs;HP>gfvU{8r3<78|~uOe)z!Im|yC0WFJd0={HVPt=^~a@l=Fm=iBj4 zH!J4b4x#wU7? z$uI^o*U&j!e)dhsM329=)V!A~hfPhHnB2bSP369QM?w{QQtSwL-5*D5^hx44{GFIa zn`ryMCexFVV(_HJdN|cm>iRoMQp<~;9u@tQ$|Dst#;(kKf`thUR{1^aqk8Kk%{5yz z9^;zf4u^n03h}91*#v*riztNlkJm0SmoS2l$UxMAQk5j}1Id65rdSh(L#FgpGDC&B=+_h6$}XjB!(lkEd?w-PRBRI$$2r4=o(;&`87sGCjU~ zQN+b^n9}X(9k`&0iCy^hAfyV5{h}lEzw_R&Vo?0_rELHGCZm*0bOEH3UnAzSY*q_x zbd$qEJ2M!|k!fjn4Tp2zg3Yq+sNf^wsJi}~Q_GPmg`J-3>80uDFNUa+qtK2$)nG;1eO zJkZW(Xf@2;k|rP4Kk1CkP3RPL85xyb^ldb5M7`0@GZ-J&nq2uheNSUQv5e!9*mK#u zFFv)>-&))2R#+^AXF_yMB1HnH+D`9667*I+Bv;uCb{_pIzSk+YDXYz@(>b2!14zv| zO2fC8Nnq60JNR?X{b%pe$<%BJITM9GqMqKS{lzus=6IQisd9eNt}u~un^-IHv-`?D zk*FgE%mL|boB;@vJ0Gb;b&^bwFDTo5m0N1OIgso9#FK`x0US;Mk#LQVsK0FT-BEu{ zbmebV5sFS-t3mEIl5ON2D_!|r!Tq=Hj+bS9C-FJK-Xq3`lXDnN&vTm-o5j9R*H6d$ zG#A85jJVTW_rS$Kt9$_#s-DZXf5ehtlI; zF%<(0)RA=+4l1{vfEuOsyNfRyk#e6V2uH&rJ# z=CH5-iuIX@gs^?t^s8yNM%XM__w0hn)p)IRDgA>%ciaW1-$6p)hOcHS#$%4j2FZLq zmEB;DM-D}^>hJ$-NeY&D^TLKU`zJ=A&9F;izgPxcGHV1|O8{At>l;4f5CIj(TJ4pm zESS*X6myAU?UeD-Q=9nuY4M$W3GxOzYa`E9h)F}+mspNhL*MV9jWySc;7aNixx_1W zmQIlWx8A-wE~;-|n-EY06dAgtrMp9Z%Fx~2IUpTU5>k?qA|XiUICLZ3A>AO|T?(S_ zoz?mx;V@1fQ1^qwUlpymlhjh?i$!R z6)>@!&i9l}=QB2*@(b!o>-~4lmtKl>>cNH~GoETEmNbQ**euQ_d()A1?>T2W9*R)k zO@UL4lHZL$GOwE2*EG($vz)YV=Ct;^p(D;ezT4O<<-op@YnNUT+jRyOr|lV6zLK%` zRf8JxmEO3D&}9TtgU&-&)<3nr5W#!>$Vb>!Sa@e7Ov z7W$75B$St~AT2&VPr~tsp1qM{$VHSTA9XBunmS$`;?BR!_VEii;$BrZfR+LxCHi`c)Zmgwj3b3Lh+$-pV! zU%4vYR&6;?Qmt-rqZ+dah}nl=!$t)g!XHVM;Q+cGgRPK%X=gH{ScX z>KT~}P>$D6)sqW(c;UM?$xNs4>%>s&Mx&uEoQB=Kz&wLx~9U2W!Tc>7{= zTBu0oaLZQ@dA#psK7&r!KG2BuD1)?T z)kd&5ueljysUEAb9pKJ}7Dwk7lG_9j>e9FX6IBi+;h=QzGsQQlXFTybJ6+st#`^Gz z`@|pOJ`%+2g0#77nHHz-rF-ZK@!F`|Sd31NQR{%@z5R$U2rGI%bkW|+1PX}_|CBN> zSVvdID2uDF(4pSe#ds=jVq9MxvZ|Uu3F)S)kmp* zYLH#$CZ&s2;)QRr&;*Op9ziG4$oT+cDwy(#T`xCMyMUK%5x$6s7k0QdS2OBLL3ReZ zI1wR_f5xs>GP}Bm%Z)MaUo~)n|o3fe*l)vW?h1YQ!2t8Y{Ssj`7F58#lNC0N# zjX1K4qcq%plLC@&B>&RCQ;`t$O+>-86Tp&WzFlfe^(k2`&0or18)0y4XrQE~~GWA!2|p*}DB3m=~6AMg)BQ0>O47DnwsflHk00^U8TT|L1bY;43#4 z&xDu6F>A>Oud>pf!UipAew5UI$w|r5=pNA@3_k*wSiHEQ)#x8pK|_LBBdWAO-cR}R zyNujs?o)D$*z_HR-Jj;X!mObc<7xXnTW-i#5lbmRpMHVmDmFIB%6Vu^9Pt<|*9jTzCA@ zfM?#4HLb*}95qsaX9JxCn`YiW#IeuC+lw{|MKYeb1uqK%9H(<%Cw@HTqIk9Kf3{gR zV*v1>HVXt6Wcqgp&s=e>Cpm%PV_^gAieEOMjGGhW{bxv1#-Gco7opG!UGWtd#)Iy*rhFhh@JSe>rpkj1bK?ih zy_OU^^XbJKRoRGX!^Xi zH6eh)OQbG7J50pUR{3&ub>-{XW#f)Axzm>7(+n+hzIXW^dg#Jg=-n zD4>gQ7a7UB72sR>RmYWjqv2ix*d$IYK<8~i0&Sa27$9?H!Vwz$PeK%%XGbgY;0m@mITE8=0ZD{U!# z#1Y{T{aDKT)O4schcB~LzN(mbqfIH;d!op3iKxY$!%T5umjg}=kT-re;lKawK>hfw z@Z7pt_*3+_7a!U3*`BeF^98DFwmb*q{p zbu{v3Op|xP8AR*%y1+L=q7NP)bkXh$P7JJ?oe#(<*1vt~@`Qy!@|%wp|H2|MMwp8L zVf?d-oI9QMjAY==a$`+4K07vwhj7DjZ|^n9-B2`#y&scl0kv&k4l<%Ov0aGW1!~o@ z*tP&RP?|YiM1m8=flY8Ji+2Qw-|7Y6lRGPD?A|^XxRw=6$Zcw_OD{14ww&_j#4~eucA~eqf(2zMDSQ6#bOqQSV*g zehRC{&=wgPzZb}V?rutYTkkFW$j5#tZ+nH*2`ff-;4jc$cRYFIA${O--;f!*N~1EO zo}Xx71HR0vMAHI)H#3&;pBA+2THLj1>LQC@kpasEgvLWf0r$qOjsjj|I0L#Z1bq{x zzr}4P5_8Kc31BS@pt3%5%|yrg9_YJkduY6kI1GjjoIVW)?%~Xo|66Lwe}}6QQXCMU z%{}#@p@i^`0cE;=lh48IylA5KE8SLr0x@|H(HT>7(ISbVI(%l47pLxxq=tPS*1pcu zERyi|+vKVhZ#G?|5!VI`WomV>kRNJyhBhZ-v$At^kF)<+Z8%B9Ec#>FrN9)o&9hED zC59&fYoC1%<}(=t%+d< zx($a>7BL-hY~n;yAXS0O3^u& ziRKgYDRivIZ99X`bAWybr$Lrr$|<@TyP!}4riA!>+{)(*oG$psP&1wPcZ<`9a~zUc zlH2W)(pIHJb7~1Mz=cMR!|@CvR?~rKA}>0yz7N5`^T{yLaXz; z6vnFM7d2Klwl7E6^p3WJslHguW}psAA4cBuA)?Ly7qvQCvgb}3GRHR1w{b<43^hVS zlhM$)(a6IhvL<`c(Zo0p8tbYPG@;b+cwaZ2Cid4!qhUil{cXF{jBJPND{*7rX&Jcx zLPgBU6W)h4ul!IdtH-JM-pj@wtbV87?@4DI+K77Ef0yu|%5!jng*#z8J&W$8;^N+x zDoV3MrIzNR z!u*@qoXP1Tt2cCi24LRI&V2cI9Ed1pI0xd!0BdvL{^+yXEi7Y*(j?t1GqaVuv0L~E zQJ{_HV=JbI#crUx9YZ>{73mcSbW?Glzx=QJh#LctYj=ZRj3?o~NsiY%b)62ojoLZh z?fZwmjEnR%dAUP_((Rrlwck~RgUL9vo^()bcgu8|X0tD+Gd6jjWJ&Pq6SH5u?ely; z!H5$b)f)6OH4uskDI1QODw6x6x-h%frUNojD%SE#e>lj_+7l5FURoR=b=dfq*)ZS@ zmpGoBh6qzmM8xWg9N0<8mE!YnzUPj=_7d92_$kiv?!?R9(U(t`Y+yhexK7Q_D%CaW z^~R&PkKajg((esR%)0*@LPGxQzY`MT8cu+IiU#LQ&uBdO=ws*>%JQ~A>)LFK_>?#D znt5yAT3K@3gq_5k0ezSCC7p8Rf~FZ3D?OE4tRw(=u5po~@=O;2c2i48lWkFO=k30L zLc_Me=6zk2&SQ_`m(dk4&R<>+g1Xbd`8>oIXDvgVx_}+=fGHC>HO9mHTJ`cxw4`kI zPmZ^Q;LLdabbB!GcIrK2?F179hyyFj!{__VD9lvb93tQRXR=7FDcSd$;-7+X7%aY- z3qE{qV?YkVR~qADNr;Z!P!(Xj0~5CB!l?!ol7&AVj9*|&KIqvvI=wF%#nV0c+?s_> zk(mr?z^Vs}-tQHp8`7zk?-ZQIr{vR{#I*x30+_PU=bJB4IpX)ROuZqQtNvfjByPl> z;XD@e&gw_mg~9SLaNo1h2$yxJm&n$w^}GB+@(xFf~5uc>o>gVibh93ZC1?cTds(|KY9?r13b7CzHrg9vn62quuy zDWbBooVJKOC3nwMW-(N=d77d&vs`rSGgH(^yMGQdxZepBR&`~mMymTl}*BW$} zS`wV`bjRXwFqm%$`}q%}i3>3AjW3U_CEIztI#NkWBEIO*kb|}h;m~esj7_XMx1QC> zjs&o^VIx$UQTZI$+ry-RrB+dO&?8AaICRsK=0c#e0Bn2e&;fcdAR#TL_Lfc?3X+ z|K(4j&GO?M$tUpD%Re5EWB%RAad5zExGMPn7m;!c{8YJx?ACey4S@tOE(Blm77tv8 zd|i|NHA@0GJ+k@b(#?}PTiZ<*JE${dskfc56xZB-he;lwi-;8b@Vu8E5^au0Y2&JQ z{7Io>iLpk+#g&@Sw&K|8?(b}l7>Z8a$yV`Eq5Iv!x8~~b4W!gm$g}nR9G;mD7lG0l zJ|}i`{7=JI<4y;Qq)miCW`oE_fhI`)|Kd=|idv!X{U{Z_8sgJiO&ot9OhA2p&o3%I z>^=cr^Ecw2%lf_y!6%~5u4{IfReh}j`4Kjm+6*P%1yL>L++)WLL+_iUUuwTAJ%~23 zsvoywZtEIRk;fC5b#vm=3D4k|q@qy}4@wrHGe|Vh&znq|xKd#@sqzs33uk%JpFa=( zFnJA~2~J=B7>v2TW^-p>*<(N-?6W0s{Qe9(9-~_b{Ki=wC&FWPq&`t~n3v|yMG6A^ zzWC_@4{9&w=)h6R)z`$_rE+8R?QX>-Fn-;nuRA$xZbc@?RPypr+o3k&cvfdn;+@Ty zJoc5MsXfS82^&L)+2 z;0Z6|<>zeQhUd911;`CN!X%CO)fYK!lx%p7pLzSe8rE}!Hu_Oe+8f>$hA}XM2~AL= zhwAN|Jl-VBhOp^bESdT%xL@MR*SE4epZ^z~|-Im$s$HDd8(E98M9b zh7BEcrEu>7%Kp=G9o~m;)0y_8W7mc~hQ%vNYV;I~%$ivqbHL;_#Jy}kw>fz)yt?olP4auusZuDOmm zdQt4Sq`Ld{Nlv5jJ`}0h;eTis)foOtm?|j!^LfhG2oorYU$9Zwl3&;dWl>vM8_p-6 zT5gL(NejMXnyv1P?O?v0hn=iCK2MSpXTcPnYq0<`wa#PSDbx^SD=w`vXG$5>r9y{S z+yQ@qG;wy=+l2NTPfn%Ty7^jl$f(=RXi2?Xg*4WRnVv|aIs0)0Uc-ErT^dy<{WEK4 zJzOnT{T#dEF7|@G)Gws}tS*>V6HO~h=cDO+NdI{ZP#0V@-4E+pE6brBCoeA3Z)6s` zdS4>X$;Du>r6CB>61KX`wF~+m#Gkv014IM(r4~+Fe^wk2wIZgzZ(G)8GG!+j+}d3}p@@r>h&7xxJEDsyo5& zemV!fxT_siNr&`#;>^Uy7?_tsG;lI1aJr{X63LU#x|m5oW7naw;{SInR|jw~Fgisr zHf>wsh7y0pcNQ#MSJ{ZrcU#miS7)|e%+P82%QSA7o^@qZ&-A83Ajr@SlB(2M$c}di ztz>pWS&MgRjJ`Ol}nl~f9lUs)L5?0-9Ix(ZktBmcQz zbcyNzafzKmHO-Xo!V87Mv+uI{^!-W0mny0nzHrUf#8aiFR%9Lr$FByLL4!Z%gA@`L zz7&uGP7&c4xKy$A<<`6j1m6UZ&cImNp9Hvy8;W_@e?b<@5$HTC2ryYKwKOMxs$T0M zmse~&%$3Z}HI+UDcKHzS{37VZ79YQg`}1u3hksx`ZQi%9UPg&GpQ$-%a+&w9p29Xe z4lJdeC_FX+7079)h>+B;{>W;Me&gmIeGehRK~Hp?8NBL`bMq22*irR=0Z||V5j2}< zsp~(>|0S;};zYBWtuK>r?`rwfj19ce&3!G5vv(eG${NNnkanZ1eIh}7n<%vn_hb`! z;xyxs@7bg1Ox=Glk%-3mWGI9u`&jRF@xABT?rP|)V1a5K4gt4F*xLhrZDJ1B9G<9+ z%i%Eyk?72IQwLK}NZf1+hxdcY2QW`Ho$jx1PSxI8REAsQ=XnxZG>`*XI6w^~-B=vG)puQbvwr)|ksur#v8t(+LLu?eOtIdfIevgt7R z;^Fn2V0X%C?mWWVN#)XSlyJw-sR0*p2|P~bbnTI*k{{Sh*F)5QoDU;NWY*qJ*BUU@ zk&N-FWl7z8v*Kb2>vy*GIXfWGQ$T$f^pLUbSe3>93^Cj4p zma&NKVCgh7#2m8QECJX^r6uj|dBv`k&H%u}!@M0;H?s@onJ6kAHssI$eP7Ndm3 zNaRsdP<9b6b4pklB*BY9Jj!MWUC*V^yl707t7w|xAGC2#~ zoK(21$!<1js%qG+WKd22RMinq2G5zXwMb8XXE7CI;gvNT$M(Ge%gw?{P2Mwg&?FM7 zQBeV6Gop|zMnR8GXzMA`n{y_oEEAzmWeQCSB!lhMt0yg%YvtTs4S)NNJ;h_hx+WWu z_tO^!80QV+3=SJE^p55wrR}-IayC(el!UW@EK4VRERIe$Y$mwkN!tg_Pd|mIguIU} znu~(sbQphO)z^c9Q%oeMie@Y@AACq8dh}L`hxC1ngD%Uvo}m@rHBI~rbzssgz0i!iv%6L%Ob0Yg5=0o%25|Yxxe3 z@>UCg=OpdGaiyK}IHlUEE$1Z4Qfy;HVsxzwX$``iGwVU*Cb-ZULSpPFn$bG}iO8r@ z;eW}{9;?1&q{NG;pQk#!za-l$ETp!b#!+*v8l(c&XDcnXJu-?)2WkrdVj+p`fA?^T z=E7$7)Z?X=(cPCldIrpnEyj5upYp3eVs5%}KKQc`?E7c8B-)QjBJ zXtn_|J66&(;Q=I15Nwi26;zWNk}F$1i%YUZQ(-o%;0*b9H<8~VH3Q+@`2EfgNFkUCWlK=e)qguKwHz>JFoy0HGqc>ki8d*Y(f{Xm@l{;I89^DTqXR$=PGa=4H{cY;MQFaPYstDjQwQN7=T*3^p*Pdvty#i5E#D&tQa6nAJWj6|G2<4%9oKd*MtBJjWmMfZz>8>gQ$Sy_Ce|4~(%9|HFJkWuh1 zyu%&1(NvFxBWZf6sfd-WMsgQ-LYw@Tsbdjoci6k;Xp=4?U>>)$q7sNWzesRRiwfhQ zbO_Y#`QTUBktz#4bh9pMy4OtYRCb!@MR|W&i?zY&klf6bAm7^iPE=uKa?m)KqzQdI zw%;!D_moOvr;${$R=a~g=c2$)5x|It&-5WC;PhF-MU_!2L#rS70@#Go(dJeAQ)A($ zdmivEk_4Uh#mL`_Y^U;oOwc{!N*IHA`xk5pAF)^)N`Z7+7%r#--u8c=?1tA(i2pDY z^V_ZX*|iBfJgafxmpW9Rqps{LdW0DbmWP12CVpE|9Q##Q* z5I!T%EeCUoPJN}e5*k8}1`94u4Ah2yuoc3GCj(6;n} znOml~HuhS^!%l zxBhvh)Km;DAxv)`X7XR7k>J0Vi3A~FShg7;UA(e)hFtq%JuVhy_Phu?u5rj zFuVL1HAg%iW8R0=k+psTYOwtr8*9hu_HcvzX!f)+Tn2_)6js()mea>V&zW&Q&?IV+ zfH_=lI5ZMle}v^R)LYNb!a&r^&j-@_9t_de$iSyJY9zP9gfcgP>){s_C|M@a(RaqD7x~k;>n^rUQ-0W2MbRBho0YH# z89sj5_r2RbP$^$I=37&%jA}FH$bj@c!L;E`2sut<=>@G&>Sa@<0$^AGCH#AaygPES z6Hsa$ug6|Oe23J*Y<*N(i{OH^%ykhu7?T(&mBAgZ7*cUv^-WKLrSe^55uwP8-tdwl z{pmj5H5r#2jl?Dc#hoM{k@tLZMgTNNgm)jf zy+yoJ(*3h%Po+;Jd^=prBV@5MsAO$fNi{+M7xhwD!YI6^H_WEcg?rSIg4w=#T#-sD z@(E^{)RmKJ-AgvZD+;jk1k205{C6Rz)gFBbgAe@wLO5}NTs6}=dO^zerZT_sf}D$v zsmZQLF;Yc;e!WY)hOQpanomCm(=jLt)f!0sbzzMXd+@XcS);pAah1(fR7M(EGi$Gg zS}eq)DIAvacA3_X+^I=`U(?0i%oyX-6*0?*)~Uf>AX|*7{9f#$tp&N9>9k7zH@2jM z%@~T$DKmi%7IGR5Abd*MKLR)JBDdiBD8bP&ns@k0)wg@}NFtOTKqcLs^7B3W(0z|I zY!crc9i*fdAxb2;#RK#qRWo|L;u)?7#gWJ^utf|+R}mm)d2ykF-J_N95e+AaSPbaJ z1W2AE)PTh3wm6TdK>mwXB=>%a-CMFp|N8Y$NKt~;^}{=-$+t`t$rvADV`Cx4Mh>N}7Y&U?lFGio|HNnr+LY!Ih5&Z;D*t4ey=lU-Q z(jz2)I86j_b}HDgbT%TrHJ2u#y&IbhRqy+j#XzT;TbHka-SeGd*+tB-#_xTJ!553u zchE^RK$Heo*a33^5DSoy0NCa~pxy$<{P#8C|DD3!|H^=piLftl_%uoD(Enx}(lXi(<@PeO$Kh~fy02%1 zjkQ-BSGR)|G&@6c=^o@WlxT!6pX>uD0`D6MO^VUJXxWrI3qlu-_j6)L5ygwdLouBR~%w7tc!q#)XsJXq$qE<9i?S)i%W! zn;R6%X9R?@ia;YQ8cU8jWb{>X8hx<>QoG78%fn5`$jp$%l38;#Lb3Rbd9#wDKn7i+ zR&BSHNc9I5&dK@b%WL(tsZrl3N*I)AtV8R~Hkeiny34t6HH9-|mN?uv5SNDo)b%j= zEasdzPjoyOz`To5D}10IXM6|df=SYnWd0QhhGN8OuKD!U3M3VjMtHcrwSVAxTz@WI z5nUt5;5EZ07psz>&SJVgO$@UASOx<-4#j$ul@&3g2B0;_8pdr5UQ%;jU4rE``D|+KtgKhFZ zbxTt9LYnNR4VR5G>v+AgJ~nQB`hqAwrhT>$1?|d%^v0Qy+&ex?)}Kn!W&$P{i4m40 zsxZK`eTVu}(j)Gt4HoJMHXoXcr!wY2576KupaIxH_G8|8xxn z$b3T8Z{w&J+-VN2tn*iFT~3GSl6DiTxg%Tvei&_7dqij4?e#7?li_(dd-y>reyvWfSfCE559QO!Xfd1nW`5sxMu zE#QIpriErcz_Q!*-KnPq;DN!fk|h(p3(hV9{@nksLgjyGu(3Mfe~qE^{Ij>%8tFbL`qq;7c={c7W>BvnatS3NeN* zydZ5b$G9n#!j^0meXt8UbP~p@YgKp}R4Qt|RPcHGsK@h`_N9Vaf=2KAQ_S2Ui>Ls( zNxL&L_ac^xzjiwmRu#HOdd^QyAqX@U1o8!3NTw84&?n-%jMPFE86!#55vrAbZy4;% zXV?wslq8<*ATrw@9pd4!gCkRdQul1&xLDif%@&xzf=NtUA)xPYFZ7lOC0~T2&`V=JYUV z@r|p;^1ftX9Jk$H8b^R6^L}a( zz#E3@vO=VS)^~1*@mOnv2v!z04!5)!H1E>uLDhL!L-5?neld0qNVgk>Xv^m-gm}(O z`tS|P?zYO>9<&cg7k9Q7GD-E|y({v-EY(4?1r_DCc~(utvWXvBv;KaL;&sSq&QD(m z`rvw0ZQUm%+wKXsF|4+tn-lzdvh3O#%xh_{>CTs*;~nt=eKK;{T-&6xJHeJ&bCqT# z>uT=qf?75f-OIL@8uzG+{nyb7y`}_|jurtJp=kl+)$#JV|l_~lh&;6)@-do=9-xvZ?hTvRa+$o1Yqm4EgjkQVf&+SmgA(y$2^fM~SS1f@+09Ah%pI9}4-! za$U=7&$!P__O270-WuX!6!BHZi~%AalCB*X9^>mBCV+s;fL1ecWjOjGCdO=Bd|La* zy^p{0{F`>&-Wq2yt3*IgV6XCu|%ljs}$XBJTb61lJaow=y;x&}e&~ATbw}Mwc8~VQ-c_HXH1+RLQIxt0L|+U-uEvM08U8DO){u%{B!p}@{}9@=NpkD?@_a6 zx4|Wy5A)U_Guz4I&I*H=izrkM283lfA8)Co$$u{Zo2|?fvptz^6KW@Q`*8&^9=t{| zCW9XWgzm8=+>I*T&u=$VKwy)g%4nVw_0OLZ8^b@iQk9%XI8CgvyWT&x1_<_6Eh@TL zeatW|5x7n8{k&JD0W;`xjExeKaFQdS#I($1sz>j)|43Bg_W`Ecl!`TmA7NX7+V;-8QrDy zbHd2l2;|lj-~=k(Pn-XGhFEAoe`qS80{<^R{AYb4{|jdeEU5oJ|Dui>gc+cr>W}D!evJcc^2DD6o}~MW zWugLVz~yqaobr-_|2^5d=f^{L?io7IK; z`6?MadPN#&4;lBLJHxBI!7vg)UzCqCUTDvZz%C5fP~h}gW9)qMZck{+g7XK*PA0CM zI(DT!Bmda(;$dVLmMMUnAR$?rszLlOygX>{*j;;INDy;BNL59RO2zcRRjPXVWv2Jt zo@7ysDhYJiP8Iu$v7nG8AI$sng<$XVq#t!a4G3iq9c0Pc`VN<5U3#$Oeb5+~DleK;JQm~fb_F9!uBTO8|kxGYY(BU@0 zm>yV`?Eq>2JD=PyEgVTWZyM Date: Fri, 13 Oct 2017 15:33:24 -0700 Subject: [PATCH 21/90] edits --- ...n-based-security-and-code-integrity-policies.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md index d948e2c391..14f89fa9e5 100644 --- a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md +++ b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -15,15 +15,11 @@ ms.date: 10/11/2017 - Windows 10 - Windows Server 2016 -With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. +With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. You designate these trusted apps by creating *code integrity policies*. -Beginning with Windows 10, version 1709, you designate these trusted apps by using Windows Defender Application Control (Windows Defender AC). On previous versions of Windows 10, this is done by creating code integrity policies. +On hardware that includes CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT), Windows Defender Device Guard can also use Virtualization Based Security (VBS) to run the Code Integrity service alongside the kernel in a Windows hypervisor-protected container, which increases the security of code integrity policies. On hardware that includes input/output memory management units (IOMMUs), Windows Defender Device Guard can also help protect against DMA attacks. The following table provides more information about how Windows Defender Device Guard and these hardware features can help protect against various threats. -Like the operating system, code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI protects the kernel mode from running unsigned drivers. Beginning with Windows 10 and Windows Server 2016, UMCI is also available to help protect against viruses and malware. - -To increase the security level offered by code integrity policies, Windows Defender Device Guard can leverage advanced hardware features on hardware that supports them. These features include CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT). In addition, hardware that includes input/output memory management units (IOMMUs) provides even stronger protections. When you enable the features associated with CPU virtualization extensions and SLAT, the Code Integrity service can run alongside the kernel in a Windows hypervisor-protected container. The following table provides more information about how Windows Defender Device Guard and these hardware features can help protect against various threats. - -For an overview of the process of deploying Windows Defender Device Guard features, see [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). +When configurable code integrity policies and hardware-based security features are combined, Windows Defender Device Guard provides a locked-down configuration for computers. But they can also be deployed independently. To help distinguish the value of each offering, beginning with Windows 10 version 1709, configurable code integrity policies are known as Windows Defender Application Control. The virtualization-based security of code integrity policies is part of Windows Defender Exploit Guard. Windows Defender Device Guard is the locked-down configuration you can achieve by using Windows Defender Application Control, Windows Defender Exploit Guard, and other Hardware and BIOS configuration options. ## How Windows Defender Device Guard features help protect against threats @@ -34,13 +30,15 @@ The following table lists security threats and describes the corresponding Windo | **Exposure to new malware**, for which the "signature" is not yet known | **Windows Defender Application Control**:  You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than constantly update a list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.
Only code that is verified by Windows Defender Application Control (AC), usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.

**Specialized hardware required?** No security-related hardware features are required, but Windows Defender AC is strengthened by such features, as described in the next rows. | | **Exposure to unsigned code** (most malware is unsigned) | **Windows Defender AC plus catalog files as needed**:  Because most malware is unsigned, Windows Defender AC (which in most cases requires signed code) can immediately help protect against a large number of threats. For organizations that use unsigned line-of-business (LOB) applications, you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by Windows Defender AC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.

**Specialized hardware required?** No, but Windows Defender AC and catalogs are strengthened by the hardware features, as described in the next rows. | | **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**:  This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy.
With VBS, even if malware gains access to the kernel, the effects can be severely limited because the hypervisor can prevent the malware from executing code. The hypervisor, the most privileged level of system software, enforces R/W/X permissions across system memory. Code integrity checks are performed in a secure environment which is resistant to attack from kernel mode software, and page permissions for kernel mode are set and maintained by the hypervisor. Even if there are vulnerabilities that allow memory modification, like a buffer overflow, the modified memory cannot be executed.

**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). | -| **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**:  With this type of VBS protection, when the DMA-based attack makes a memory request, input/output memory management units (IOMMUs) will evaluate the request and deny access.

**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. | +| **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**:  With this type of VBS protection, when the DMA-based attack makes a memory request, IOMMUs will evaluate the request and deny access.

**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. | | **Exposure to boot kits or to a physically present attacker at boot time** | **Universal Extensible Firmware Interface (UEFI) Secure Boot**:   Secure Boot and related methods protect the boot process and firmware from tampering. This tampering can come from a physically present attacker or from forms of malware that run early in the boot process or in the kernel after startup. UEFI is locked down (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA), so the settings in UEFI cannot be changed to compromise Windows Defender Device Guard security.

**Specialized hardware required?** UEFI Secure Boot has firmware requirements. For more information, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). | In this guide, you learn about the individual features found within Windows Defender Device Guard as well as how to plan for, configure, and deploy them. Windows Defender Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as [Windows Defender Credential Guard](/windows/access-protection/credential-guard/credential-guard) and [AppLocker](/windows/device-security/applocker/applocker-overview). ## New and changed functionality +As of Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control. + As of Windows 10, version 1703, you can use code integrity policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser). For more information, see [Use a code integrity policy to control specific plug-ins, add-ins, and modules](deploy-code-integrity-policies-steps.md#plug-ins). ## Tools for managing Windows Defender Device Guard features From 59025bed04802e10fd211401f57f0100eab85ae7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 19 Oct 2017 13:12:03 -0700 Subject: [PATCH 22/90] minor fixes --- ...nts-mdm-windows-defender-advanced-threat-protection.md | 2 +- ...essages-windows-defender-advanced-threat-protection.md | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index a87b04e519..b9ebce1508 100644 --- a/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -48,7 +48,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file. - ![Endpoint onboarding](images/atp-mdm-onboarding-package.png) + ![Endpoint onboarding](images/atp-mdm-onboarding-package.png) 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP.onboarding*. diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md index 10a3c85cee..88fd5b5c34 100644 --- a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md @@ -13,7 +13,7 @@ ms.localizationpriority: high ms.date: 09/10/2017 --- -# Troubleshoot onboarding and error messages +# Troubleshoot subscription and portal access issues **Applies to:** @@ -26,10 +26,10 @@ ms.date: 09/10/2017 >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troublshootonboarding-abovefoldlink) -You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues. -This page provides detailed steps to troubleshoot onboarding issues that might occur when setting up your Windows Defender ATP service. -If you receive an error message, the Windows Defender ATP portal will provide detailed explanation on what the issue is and relevant links will be supplied. +This page provides detailed steps to troubleshoot issues that might occur when setting up your Windows Defender ATP service. + +If you receive an error message, the Windows Defender ATP portal will provide a detailed explanation on what the issue is and relevant links will be supplied. ## No subscriptions found From ff3ffa2d4569c48f05114cb41f73e2a2edfceeb0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 19 Oct 2017 13:18:38 -0700 Subject: [PATCH 23/90] add note re: generate new tokens 90 days --- ...ntegration-windows-defender-advanced-threat-protection.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md index 237d8c2a56..3e23f243aa 100644 --- a/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md @@ -51,9 +51,14 @@ Enable security information and event management (SIEM) integration so you can p 4. Copy the individual values or select **Save details to file** to download a file that contains all the values. 5. Select **Generate tokens** to get an access and refresh token. + + > [!NOTE] + > You'll need to generate new Access token every 90 days. You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from the Windows Defender ATP portal. + + ## Related topics - [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md) - [Configure HP ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) From 79c94581fe698964824d0556e3412b3b5e67173c Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 19 Oct 2017 20:31:45 +0000 Subject: [PATCH 24/90] Changed PS arg for importing EMET converted policy --- .../import-export-exploit-protection-emet-xml.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md index 91c62efd69..e4969fa310 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md +++ b/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md @@ -108,7 +108,7 @@ After importing, the settings will be instantly applied and can be reviewed in t 2. Enter the following cmdlet: ```PowerShell - Set-ProcessMitigation -RegistryConfigFilePath filename.xml + Set-ProcessMitigation -PolicyFilePath filename.xml ``` Change `filename` to the location and name of the Exploit protection XML file. From f9077885bebe72189da2e8749d4872a3a68dd061 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Fri, 20 Oct 2017 15:16:31 +0000 Subject: [PATCH 25/90] Merged PR 3980: Remove guidelines for Remote Desktop in kiosk --- devices/surface-hub/install-apps-on-surface-hub.md | 4 ++-- .../change-history-for-configure-windows-10.md | 8 +++++++- .../configuration/guidelines-for-assigned-access-app.md | 6 +----- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md index 6a29b16f19..8449690b59 100644 --- a/devices/surface-hub/install-apps-on-surface-hub.md +++ b/devices/surface-hub/install-apps-on-surface-hub.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub, store author: jdeckerms ms.author: jdecker -ms.date: 10/05/2017 +ms.date: 10/20/2017 ms.localizationpriority: medium --- @@ -127,7 +127,7 @@ To deploy apps to a large number of Surface Hubs in your organization, use a sup |-----------------------------|----------------------------------------| | On-premises MDM with System Center Configuration Manager (beginning in version 1602) | Yes | | Hybrid MDM with System Center Configuration Manager and Microsoft Intune | Yes | -| Microsoft Intune standalone | Yes | +| [Microsoft Intune standalone](https://docs.microsoft.com/intune/windows-store-for-business) | Yes | | Third-party MDM provider | Check to make sure your MDM provider supports deploying offline-licensed app packages. | **To deploy apps remotely using System Center Configuration Manager (either on-prem MDM or hybrid MDM)** diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 072c72fd15..f2d6cf6527 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -8,13 +8,19 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: high author: jdeckerms -ms.date: 09/25/2017 +ms.date: 10/20/2017 --- # Change history for Configure Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## October 2017 + +New or changed topic | Description +--- | --- +[Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access | Removed **Guidelines for using Remote Desktop app**; the behavior for Remote Desktop has changed so that it's no longer necessary to turn off **Start connections in full screen** for assigned access. + ## RELEASE: Windows 10, version 1709 diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 963f69e6ae..2a03f2bf72 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -8,7 +8,7 @@ ms.sitesec: library author: jdeckerms ms.localizationpriority: high ms.author: jdecker -ms.date: 06/29/2017 +ms.date: 10/20/2017 --- # Guidelines for choosing an app for assigned access (kiosk mode) @@ -31,11 +31,7 @@ The following guidelines may help you choose an appropriate Windows app for your - Apps that are generated using the [Desktop App Converter (Desktop Bridge)](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) cannot be used as kiosk apps. -## Guidelines for using Remote Desktop app -Kiosk apps open in full screen. When you assign [Remote Desktop](https://www.microsoft.com/store/apps/9wzdncrfj3ps) as the kiosk app, make sure the **Start connections in full screen** setting in the Remote Desktop app is set to **Off**. - -![Toggle Start connections in full screen to off](images/rdc.png) ## Guidelines for Windows apps that launch other apps From 8879c1e48a19238ed85a32af634752e182d1b5c1 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Fri, 20 Oct 2017 09:46:58 -0700 Subject: [PATCH 26/90] prereq updates for hybrid key trust First attempt at creating tables for adequate DC content --- .../hello-adequate-domain-controllers.md | 12 ++++++++---- .../hello-hybrid-key-trust-prereqs.md | 6 +++--- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md index 040fb7e850..63aef15839 100644 --- a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -17,19 +17,23 @@ ms.date: 10/09/2017 - Windows10 ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. +>This section only applies to Hybrid and On-premises key trust deployments. -## One size does not fit all +## How many is adequate How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 includes the KDC AS Requests performance counter. You can use these counters to determine how much of a domain controllers load is due to initial Kerberos authentication. Its important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authenticationit remains unchanged. -Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, user in a key trust deployment user must authenticate to a Windows Server 2016 domain controller. +Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 domain controller. -Determining an adequate number of Windows Server 2016 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2016) to a deployment of existing domain controllers (Windows Server 2008R2 or Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as piling on. To illustrate the piling on concept, consider the following scenario. +Determining an adequate number of Windows Server 2016 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2016) to a deployment of existing domain controllers (Windows Server 2008R2 or Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as piling on. To illustrate the piling on concept, consider the following scenario. Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following. ![dc-chart1](images/dc-chart1.png) +|: Kerberos AS Requests :| +| |:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:| +|:WHFB|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:| +|:Pasword|:100:|100:|100:|100:|100:|100:|100:|100:|100:|100:|100:|1000:| The environment changes. The first change includes DC1 upgraded to Windows Server 2016 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index c4c4dd6085..56f1759320 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 10/09/2017 +ms.date: 10/20/2017 --- # Hybrid Windows Hello for Business Prerequisites @@ -30,11 +30,11 @@ The distributed systems on which these technologies were built involved several * [Device Registration](#device-registration) ## Directories ## -Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. +Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. The A hybrid Windows Hello for Busines deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, may not require Azure Active Directory premium subscription. -Windows Hello for Business can be deployed in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. In addition to the Windows Server 2016 Active Directory schema, key trust deployments need an adequate number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. +You can deploye Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. In addition to the Windows Server 2016 Active Directory schema, key trust deployments need an adequate number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. From 4997d166328da9c80244642004619efb066b2db7 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Fri, 20 Oct 2017 10:26:11 -0700 Subject: [PATCH 27/90] tables for adequate dc page fixed formatting issues --- .../hello-adequate-domain-controllers.md | 34 ++++++++---------- .../hello-for-business/images/dc-chart1.png | Bin 3978 -> 10613 bytes .../hello-for-business/images/dc-chart2.png | Bin 3701 -> 10679 bytes .../hello-for-business/images/dc-chart3.png | Bin 3773 -> 10847 bytes .../hello-for-business/images/dc-chart4.png | Bin 3770 -> 10851 bytes .../hello-for-business/images/dc-chart5.png | Bin 3784 -> 10982 bytes 6 files changed, 15 insertions(+), 19 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md index 63aef15839..6c241b2434 100644 --- a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -14,26 +14,22 @@ ms.date: 10/09/2017 # Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments **Applies to** -- Windows10 +- Windows 10 >This section only applies to Hybrid and On-premises key trust deployments. ## How many is adequate -How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 includes the KDC AS Requests performance counter. You can use these counters to determine how much of a domain controllers load is due to initial Kerberos authentication. Its important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authenticationit remains unchanged. +How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 includes the KDC AS Requests performance counter. You can use these counters to determine how much of a domain controllers load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication--it remains unchanged. Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 domain controller. -Determining an adequate number of Windows Server 2016 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2016) to a deployment of existing domain controllers (Windows Server 2008R2 or Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as piling on. To illustrate the piling on concept, consider the following scenario. +Determining an adequate number of Windows Server 2016 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2016) to a deployment of existing domain controllers (Windows Server 2008R2 or Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario. Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following. ![dc-chart1](images/dc-chart1.png) -|: Kerberos AS Requests :| -| |:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:|:DC1:| -|:WHFB|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:|:0:| -|:Pasword|:100:|100:|100:|100:|100:|100:|100:|100:|100:|100:|100:|1000:| The environment changes. The first change includes DC1 upgraded to Windows Server 2016 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following. @@ -43,7 +39,7 @@ The Windows Server 2016 domain controller is handling 100 percent of all public ![dc-chart3](images/dc-chart3.png) -Upgrading another Windows Server 2016 domain controller distributes the public key trust authentication across two domain controllerseach supporting 50 percent of the load. But it doesnt change the distribution of password and certificate trust authentication. Both Windows Server 2016 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016, but the number of WHFB clients remains the same. +Upgrading another Windows Server 2016 domain controller distributes the public key trust authentication across two domain controllers--each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2016 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016, but the number of WHFB clients remains the same. ![dc-chart4](images/dc-chart4.png) @@ -51,22 +47,22 @@ Domain controllers 1 through 5 now share the public key trust authentication loa ![dc-chart5](images/dc-chart5.png) -Youll notice the distribution did not change. Each Windows Server 2016 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentication decreased across the older domain controllers. +You'll notice the distribution did not change. Each Windows Server 2016 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentication decreased across the older domain controllers. There are several conclusions here: -* Upgrading domain controllers changes the distribution of new authentication, but doesnt change the distribution of older authentication. +* Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication. * Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication. * Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication. * Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers * Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication. -The preceding was an example to show why its unrealistic to have a one-size-fits-all number to describe what an adequate amount means. In the real world, authentication is not evenly distributed across domain controllers. +The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers. ## Determining total AS Request load Each organization needs to have an baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this. -Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significantMonday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: +Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: * A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant * The hour you believe initial authentication to be significant * And a half-hour after you expect initial authentication to be significant @@ -74,24 +70,24 @@ Pick a site where you plan to upgrade the clients to Windows Hello for Business For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward. > [!NOTE] -> To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power upyou need to consider this authentication in your evaluation). +> To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power up--you need to consider this authentication in your evaluation). Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experience the highest amount of authentication. -Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controllers authentication number for the median time by the total authentication. Multiple the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. +Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiple the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. -Review the distribution of authentication. Hopefully, none of these are above 70 percent. Its always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller is to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. +Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller is to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. ## Monitoring Authentication Using the same methods previously described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016. This delta is representative of authentication resulting from the first phase of your Windows Hello for Busines clients. This gives you a baseline for your environment to where you can form a statement such as -```Every n Windows Hello for Business clients results in x percentage of key-trust authentication.``` +```"Every n Windows Hello for Business clients results in x percentage of key-trust authentication."``` Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment. -Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 domain controllers. If there is only one Windows Server 2016 domain controller, theres no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. +Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 domain controllers. If there is only one Windows Server 2016 domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. -Increasing the number of number of domain controllers distributes the volume of authentication, but doesnt change it. Therefore, as you add more domain controllers, the burden of authentication for which each domain controller is responsible decrease. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on. +Increasing the number of number of domain controllers distributes the volume of authentication, but doesn't change it. Therefore, as you add more domain controllers, the burden of authentication for which each domain controller is responsible decrease. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on. ## Strategy The simplest strategy you can employ is to upgrade one domain controller and monitor the single domain controller as you continue to phase in new Windows Hello for Business key-trust clients until it reaches a 70 or 80 percent threshold. @@ -100,5 +96,5 @@ Then, upgrade a second domain controller. Monitor the authentication on both do Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume. -However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. Its not the best load balancer, however, its a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application. +However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. It's not the best load balancer, however, it is a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application. diff --git a/windows/access-protection/hello-for-business/images/dc-chart1.png b/windows/access-protection/hello-for-business/images/dc-chart1.png index 52e0f0500e43baab14570268c7479e6a417e4c18..f5c8d3f2f353a774a0fad46bd25a7dfb133790c5 100644 GIT binary patch literal 10613 zcmeHt2UL?w*De-NMC6DdD9r{+jiMwVP0%P9n)D(GNK=qbsDXH-2?(eN0TCimM5Kcd zg#ZH5oAeSQ0s;X-4LyY11oa%x_vty`fB(DIz5iM_Ye6!TdH3vj_Otiw*_kjMtt;$% z4)0-NVq#ZUyQIs+#DbuIezto%{eQZQ!6yA}o4f86Ri^9~{t0?xr=5zX3KLUaG~0$H zGri5~qGsaG#3T^P_}dmeI&Z_oB)Uial8U}JbUNv1^p~2%P;x9rZCfPA0O%gq#DzKu zWnRwW_D4fUx3L`z;y?7@nHtvn1@Zl+3^63@4e>?wJ1jnD8rv}HwxWTh7El$|w>g(w zm!c%(mkh#N5oBfhq+eeya$w)o8uK7j~(CI@w>vE4w za}mCe9{U}Gk9tOA`PM$o!A0=g`5#PeaZ+JGfK)c<_7=I&bH&^DZMpmjGya*G86lA( zX~CHh!);UVi_kL+u@)u0iN|1KDs7H>oi=o}-Wz(ql{YB!oe@MdKX{{r((TK%%zb{p z%9l0J{u7oqevI?emR$~6c9^ik?3STokbQ) zi>XQ3#as<4>eUmM(z!g;rzJfE#q_B{^XG=Os%AF)Feit}w*DY>fegna*(qsnMDD1Hgg|l@oZ6^wgqX!bfRay#iQ(knujju^N&8oGdO#jwS@d5dWJ1(0-}%a zvMi;BY^>$Q;k;#zcqm$|ez=|m59K(cpUzUXd#ZAqFkBMZJmEEfEw?^xGSXI#{Ow63 z$Ix!13S+rEz2<|ct90IT!Tabl!2np3gDyR>(NbevIewOgV;$7EJHvs|Ws7lVKKs*&z6cMS9-@4)wp8SiL! z(=VL_W=f}WGz*)d4aU#Ep>nY~u#durx)2`$lEsCAx9A=M=xn|bW8c;sKg00kq96j% zKYb?{t9cE@aAk)v+!M2uAcG@|2F}n->1toY0i59#J{^baP@_H!)FV+)Lv{0lMK9tt zaZG=U9FmqRK0m@9E{7en)lfEp+s@y7W67`KO(i)+2i2Hd6YFdoe!c3}?*EPo4m`wp zei~H%s`Um3ebQWE5^xqGe5%+ny!bY~Z48JRP5$`I!4)y>;)SHmEp{3eCJU-Y+P~&M zSA>69Y|Q^*sKs+C2hWn`3>CDG)CPZ};w40S>Poo%Q3%iW6FmHhER% zgJ59Y!hV67l5qmdbnD?JZyzbD9$V_Rb4gDJxA?ZJr0Xw=U4>1^4H${Zrc`#u#Y7E0 z$H{+yO*&7t=cpK_Pru78i5r_rbj?}LS%Air%UMK5!TR@dXX3_RI>2saL?;Qt9I-dc zUmliqI30NTx!tYPOwR5BTTpY8qJD(>j)9K&R!Fb2a5hBzK!n^qTcQ5FST0EX2evU8 zGjBz03+~=T?jOv~l(~H?_UG;)HHZJ;uFoP$P3BWM>Dvm}97u0( zy{@zU{mx)nOk_!{u>QW0yjSr4J!_|SvE!Z?sxxhE@RFo=+g|9oK%VB$;Isew(F%$? zrpNFU3r>3$z>|sy+d0f3+|7Uc*c4%8z2%u2sy`F+UHE;U`EU)!UT|0a)z8Fy7k&l+ zeJIMPDu!3_bx>n`eGb zVj&n! z)N&*u24p4;@lIG$a@!oQ117PHvhR#YN!e*L>=QEW({m^XY=JqLp4< zOQs2ynwGAeEt69_)HDwAbXK5g&zA-VLC8X<4Fxs8{B3AX5-JiQQS zhoEd*d9w8ULGoJbL$A34I}~~J3_|1T!*`FT>)F6qlug{4E)r4$&wP+tT6g_}1YM(P zr5lm08ym*&KKPq|LHgRRNK2-U2G5!fdJaR$=w>d01+W|5aem?5X}Q78Y4KX(pfHZI znCBw!f@oMjUD_ETuW(eiWdZ6B2(XOXx}SvH)16Y09NRs6#C@8?;bbv7|G+;~Ns~W-hYzIkITR)R&x1=f~z} z<{cOOA8d3#@+Tqowaz3blN_Oo5w;+3R$pj_Mi1T^292WmqZGDniioewrM!B8_meYK zLpLE&N>$M))v>oxK9#db>ZvuGwIrX3!5fpEJ>h+Lg!*Cpc(xZo!S_v#(58kj^t60w zRBD*wy{6~pK4Fp<3#@3HlaDL<^2Gsp_c}m+Jj*3hH;DW_8Ei_*HFliQUQfrWzfj2= zF*hgHIPG1G)=3xI*bQs;IGJibs(n3@CH%=P{6J0iy9sbX>2|1H@h1^Kvb09-Mc1@= z8{7+LkvZum1hiQ0Mo#ET6c-^pp@ME99%~jrN?wz22JZ~uNxtW(&4yvSm#&N~jLtEf z#r~@-^2=^yAIrSav&zaL>Reu^DC^}Zd^>rRgfZL9Fk&l*0iM$CyHpM)twe~57FXQP z9D5l{jlR@#M2XX&|MjDFuzMe=4-)gj>=S|~|32!AW>ur_Ta{&ED*nqkc~$HmdVE=i zs#@WmCXLQgj&bj7%*F)?UY=q;M!u;H6{BjCd^aVAY-XkmmdIAA#axEXn}&`PYi?R? z(`S^fB_1dfP%!s^h-JyubKjou+C5h71!F``<2Ft4TOV6`W#^@mB)JGJjRVjpCs3Vi z&Y{@GvQqx?aBe573Hb$Zfil4Vq$Xu9`4PtK%vtZS*)+e6oV3wMR8uzYrdH$)Pvjtn zzng&g_%bxV_U@Bi8pF;7_9f;Deha!2NVgt$J5~TziRM#TR3&cUc)E+-IWcv-(W6cB zu&ACJsy*Oz7 z9V#(E@M-=>M8Y|ZxZ(OVB1=Ku>%?xCyTO_vdQM`66U83Oq-xId{Dg^PeQ4BM_1d23 zDp*AB&E?Tlq(eLCB@q~VXbiIO?$w>9@h)>8^%)UxCCV_axonn_v%VM6L28Te|0r<1 zIr+-+TYWmWbXX--=*iotuMAQ0g{cRdplGphdQ!qeJ<|dm4PshO&NVtjy(5WXKpyR$ zLv(B={MaOAC}d7h{gBtpV>fpIVQhXw&m*xxfjl~|NgI5y>1$=kQo z)JOJLUIRV|iIS3ETo6%G=APK(dVaxk%w|# zex^x7II@93#&-+|Z-yn)5-jNU$$`amz$-}I5L4GgO7gh`#a5oi#MKD%s8_rDAEIWc zD(huI7`*<$cz|YQ&!=GYfy%fFT=A>7s)M_v`cW8jjaBeN{(o93?UNqJ{!l})9 zTewp$Q%3QvU>2pRN9yp2+v!?8!3ElYVQx@k@;D^%#ewkMfdk!;^H;>wu6M)(YKe-K z1>%5MzS4fbJJc4G>=hg+h1Ag48zWnv6*^^{>@yB|R5mV9E|f^wFq#!8tdQ{T_{xp9 zb)kjAfm9zhe6p82po4FV6PQFp+^82et_R0qJl79OQ1lIRE)f=Yic@SwN!2%#Qj@NO zDD#irWF9>eNS{4O+^mP3-xrH=DQ!3jCWd0n;^f8~3tw|!8(Ni*0VXGA0LK_^ zFpG2d*lj*zHfLB|a}@4G;lv)qsfPScgnD=c8MWeHHW~+ z!F6=#my1`4X+4^4?6y|Spe(Nm^ao% %|s%6(}Bjb5+cn8{mnc#|v`sF?jN!Y%8=9Kg}M2MAiq?X15HOR5l`d zGDIw^+8q_C(L2j0;wwJ&Y)5<0fz+cl#y)+sIe)I;x4k0cl9S|!SnUUM9v%g}fp6up_HNZT>lauTEo!h(Bjp~Dr$uh{@~`5{ZOfo)4rK~LoRPi0QZq2y$|iyjZn$~ zev~S&LD0cS=W@!#_@H0`Fe5@hZMk9c?oSWr^rPnOF2=!|o>OS2gmXt&XuW#Jo#CY3 z?6jDw<^$)y{CgSkV6EOWW8MKN&kqTk@X;P2$^>d|WY(k+ULAGB&&K>GzWViW4?;3!@Jj5Nl+MNYz)*mA#JhTl!@&g() z-vtWCN%O$^|7uOJ>5s*&q9M=7<%?%J!<24k_hYwb11)-7-XD#P3Ba`q>EoQn{in{B>E?eXzzU4jS+p0sPGEDa5YH*L0l!Pu;SrB5Z^!@uiiJxw z12XVY4Njh!37fG&5zl{F0!oyr36NhTA~sh?DKW3n z0RoxpJ2~ni$=hh4$(hMltMKk2CBAM!Rw(iWL>%2Jep-3Ic-} zi3XNzim8epueC;2J< zb%YbanleTa3UC-7f|X+d*{ddc5s}J%Hj2Nb9dL%>6ZT-N7dNPC zpKM3@>y6Ee@}tr$qjRy<`;PkA82nO9(N@TM4aR1^^5iuv&u3XlT`-36h-V{-CHJVx z1BC#TAH1@gHMDAIW^?G4HZ%6P=a+=d!qNF2SipJ_I(!gG8NtJhC|xsBo+tXm9oT+V z7A-Jg6ezC&iYppU_ay{ie)~yD^m~N*pRjNJpQ>g4*D|RvtF~s-?^SH3_uy}JY5GqX z#(Qu#@A7EQVOXK(Dk4O@+vwr>Gx)$(=On$R#whsywf8SWJ4?S-P=799YiPP(%GWyY zcd>sFu+^!%Lf=Ig73hD};Lo8iW`e)g#($;k97df$FK{sm&p#~TPXSwpuG~)82OAo(2HLNTxlu~k$MmC})l)Re1+uMs! z=lJ>D5-r1fIuU)mi1bV8M4+zw)LT{8-KL(`Jf=iO!y1}2`oUN6*E_vUZtIktV1~}! z_&lmHcb8`e!0s*&j@Mi60PZvWgqZNz#uc!A&rbio7XS1QkZ`AvPtk*>eTcT{2_^Ia zD`f>jy6mFOWPp~P-8iNu!s_CJ@S(XIy$=xTEI3}^3D~1;fDrb2l=b@v%m3u7TdZ7M zH`nvcDY{|l7&EVfXwqJa!2URk1OooM^0b6>{$LVOJGemOD1x# zRIU^M(UNp#T!t?%Le{`EYk%6h?#FV~}% zh9QT0+m`Gy6g!6%US;t&Wkwtp|8HpdZIP*c*L03dZ7C}yR$REt?S*1|ulI%GCF2fn zXm;Dn(+vk)ORT~9>b&H<%VRnFllFr;JB0dO-c$>kRu%^Y_ELS! zp5Ak~9N;Zgu{D{MX6uEj%OZGQAU}-r7a=L4;Qn@VSdke_?2Lhjc#P2496;2=Ba~!U z$66i)aLEGB|AxpUh*M?pDNBl;fdWoKqFL-!hmE67o`abTcBC2u%1)^Hy$U2-txoXC zG55tWU=8^vSUnlA>UcCpxnkh5U)s^avID85<{6s224}bPSkvrL3o`R{EQx7czzNu4 zr~STs8+SUp%^4)V`zF*>?)iTWKV~qN1j5R!x<g>|?`04*(QQFx>vGdx49 zXgx#)D$6_(#kU7PuKP6Sm0MWkSSy8qbKKWV1VTi>Dz2jd3<+m7}FWY$P z?W_6B-T=D2z(_SqwNo-C9Wz8#j_Q3I96}zCwVE98CxY`lFK7lj85qYn@$WlQMta<> z>yh|^?vc?!=<)@*xmZF7kBs5pvhtv=%e4`?JnFh`SOz!Y(GCtp{qwSEUE=*gd4$5~ zYMCht`?^fRyMU3D_T2IS^Ii+tkMo~YVO0X((5p4&GBKM-%TcED-|#)lmtXV$pzb%v z&R%(8=I3!7Ikwn)Yn|Fj|6Oq8WmjSUxerw?!xqwRazk~uk%WtgiMHTKRf_EHv|jxD z8Aasu2kro+uf9DMOtyOCu*)vx%`m2Bd+)u!;k@o1DSL(EMRqW;`38)cuBKSKr;Z~r zGP|oLtkx9+I&CbY@X<2n>7|>zJM(F#@f;9nmFJtcXYv`ovztJsU{cU zvUVro;>xp62P2#gRM%9f^UDpT>bYMV3C_E=_Gq`aoaOTc;r(-Nm6t~$$3Bk+MK+)= zy>DdYiv@(;K^*{!!8o@8PTtlpJFy+A)%yyez7zK}_m2lt*REZAMr>T3fe43#v6~)( zGaY(HUqsjRFrig>W4-V;G)1rAORL~s8vkTrzpQ$SxMEz{VSD|31$~KF`F2us&+;NQ z(km|M)NC3)Kc}mVmmcWO@d6$Kt0|Ug0=slk?2zAok+{uas>*4#NccaeUPSuUx3s@ayy&;xv@AL8e-%t-_IG`4jSolZYdnaOUyBX`A z)IU0mLjJhr$Miln<&QgkOfEKmULIt+e(2Auf=s`D#9(u6oVHC_{mFHvn5Z_!9O_`L KOWCRxcmEenpHhMV literal 3978 zcmcIndpuNY+n$s#h;kSy4Mh%#lpO7e5w-d$^!srSDdciU&)6-??We3|3B36!^=E#|md$ z4}`;DI!Tgy5owrx90pTCx;gFK7v(peQ(nqw)krkg9Ym+yO|nqpDR>MiD=l#yXph}( z6@r*tR}(hS?0l!9uic@_@5N0uednqz{p}Zn5?gLNzEdLUpW3SKVhhR%zP#DevK$&n zvvKKc;LC_n|Lg0?<|0OUFUzlMf{NL5!8*5xwz#OJv3DleuZ|w@VZvHRC0K1{`Bwh9 zk}j=y}OT8ghZWBps{i{Pshu4m)1r=tdq4h?YD<%)up*piJdKyVB$R6N* zhbNfry_J7=yOIJY5Uj}~XYTSds`)|*Q{eeT-NTw?e^|Tr{Mn9_@Nc9y+?8F;VJC^N zE7`+Q(GiT__>pjG9(PoeEA;k(1ZX z&Xr*=4`_d1vR0x&ufn-jKrd=KqZ}c#Tq2>`mG3JW`*@@#(dNn@ODp)Ylo4B2H~Fl!EqD6L~&deDKa=Y*RFTcJ8uf$*VM z?F_00lf`QF9o zF;vhat_VL7jml!ha45q5L(vawmpx_dz8wxc-^wn+`6x!nusmzdRAl*`d$t3?LF~-d zjTk~;KAH4`y|_f4HG=l1DPocp;;;f4vI~35sIOAg;v-z;ju@jsWP_`bb1DH&!L)+S zOc0?!dpZ)J;S25b*mS!VA|`A;tk^mM9VTr+#G9QQfHNmav40F#w{%d zedkVj`$ISTv}lj66F{(6b$Eo=Lu?KfwP<0(-vwxh4L}LLb4S}+A9)`ygN~sJ8|=j- z=&<@i3UJR~K|?}JX_5)up=qXcXa~7A&3;R1j>~QUb6m&$XdaMZoD6WRc(iU~_0Q;> z7yNs8YxXO%Yu^LRvgh}|2gp6ga!)L4=OO2(Z`4}Y?lKVYEd+ZaR}q`3JZxt8<9!sq z(7g@?G5ZpN_9t`9(<3HLgTUe&(6n|`s!DQp$zv#fEH;RUwv>wo#*zUpf%2rr(F~di z+~n)H0M{m?p!iJ!S9uXq)^A4+1KwI?E$wO=gzy{TjVb5>1`Xg_3E z0|Ik8^JPSZ4ajxZ>Hf!sRC>%`XYBSBije|{@tWk?NeeqRg0@Z_9#nwokNseteQ$Gi z7Hk6oBQzPt_vyC#s*^mMI7oe~R2$IfZ0{JJK%RcB{Om-Sh&7v6fBTQ_50LSS5f3Kx z74Fm_lpt@j>L@`Eml52o$9&~vg}Z^1CCOYtA1=8RAsdKd{eFkXjQbdL3GKhJQ=uOF zQPBkx7gNAd)J>@+-ZZrwZZ5_f2$C$|hgC`Y7eQ?{X<3fbtp_UMrI6oJp&>_?9OI)~o8m;;?iSG2)dWT1xa|1};=J}-=7~Gs zm~jH@r#iF9s-N!DH?(rDYg0zt&{aGYMSgw7{OPF(0CMxa5~};@;fuMv3Oo1oZ~I!I z2ZkHfH(NtixsX}%mGh}fnv}W-LRRFnW|XM1Mq>a89qhR}Ng`|vapo1_GOyWO@=72GsAElceoj&W z&FZxRPouw_a~wAOuR=j#zpi5`n-CE)kL4jAeNdwGpY=SnzuEUC2bYW3Wv_l+2Rw{c z-?9HP;YV_01cC|gBp>(nVRY^}+lrL2XWiA*_sny)Rs7x>uqNl>*Se}Fg#76lFQ=Rr zuVy}G&5}>r+e4U94otGGm@sk6qoPD?60~0!xqIc+_>oPPYw(dDYO&w>N0MHWod{l( zO&eiTLTplO-J8}!%OhkmK7rk|I=XOZj2p+VGk?CFS0emgR1Z!`cFub$ZrLP)fZNTZ zLRUpQ3V&NM`@{I6ZD6M6BBG+~SFicfi#C_8J;ZC_E5K#t+;Q)`QqTQ^5@YsCje%5K z#2SEG5XLxQGZ4g0vhW8RCO$g(*|Sx!Ypx>TUwIqEDV09Y9;0<-V8II1G7A8g25uzA~3Y8)nJTVwm5>_XlDj**Mys`C%Op`nO@>b z=lm*iS{y&eBhB|XwiZKlHO-aY>ukE;Hq&`)oxgj6Z|8xqNu{XWm z)_gu&5_gRy5>W=~v_usDmSC8}hA^(c{1#2sKpA`q?)9;mNcCs~f=gr$DrHy_TkKav zvB1I>y=Op$6L&Fpe~s?{k3c4vsvlb{Jz3}_WFJ}j*$@s@H37ksp{oSlOQEXr3Bop0 z_3nOf8?Rbf6nvS`-H$xcgf9QtUzqmS{6AkA7#@~HeNNVO@i{fS!p)!ZMXdcFpzTEr zN^p#0{)w{n@3W4KqX&4;$Cy#v=->R9=e|_eZDIC%bjz4--zH*%7ha%5u`e%6x#}e~ zR1EPD=ChBH<@i9Tt7L-YAj7d=9yW@%}nHW8_S@uY1?twd!YEl9c!_U zYI=26IX1G4|I&NVpI)(N_Rh+KC0c{qb6p5AjO}Umr9KNF#bFnu0U-9Lik^T0l~6bG z%tz-IaV&J02Py9j`yAsZR9xrh7q5AX#IM4$d$cm>Y6Va2)R%U|&9PId>JJ}(`}6vB zs~_YPZ%@km3(Kg?Du#VVSI?|WKVj#8s1EHRxY1NHNu$;uUmmKO(eFYnmv^hx@9EgN zBP7-REYi;Zq&A(7^h8;F4Z^IqeK}R6Qfddf_!W$xn+8U@W@Q6OK*u6Ou;_i@U9I zZ`7z>xwZ_{#<*6{CZjbF@UT4h;E)T8CIQ`r3Punlsfw&7fO|~2zo_T31<7c6m1((8 zm2c=#G5M%HPYUsIPr?~-hu}*hO^@0ON_V;n%iRE&e79-v$VK!EW^RiQGm`0L2v1WhO{BRp+c|y zVc+%s)`_^iZTfBOM?~~&g#P*Qhj3zl(B#UEiBg+yX;;hrU3XQ*1+sob0~PNnE0@&5uu@g*Yw diff --git a/windows/access-protection/hello-for-business/images/dc-chart2.png b/windows/access-protection/hello-for-business/images/dc-chart2.png index 748a6a4c411c69cc5284eec12d7fd15d250514bb..ff99966521ec7e584f24cc7aafbf0ec09a2c400a 100644 GIT binary patch literal 10679 zcmeHtc|4Ts->}oZkP0E8)5%VgvSqE9oRVGEF_VOZv1d1xP$Wf+U8d~W_pu!m$KD__ zmdS3$mfbAO%zIB~tMk)2@8|Qp??2D;+@BBb>vCP+eY?K*^+ZoclkLFq11u~oY*&BQ zFkoTX;}5*Q+P4Gvoh^HV4*dDS-9Ym)OMcgh8DOx>?vnN;7M7yOgIiX+f$@HqpUvD^ zSolMkKR-lHE!(iLh+V&`ammOVx{xd#IZ>V%x*GG4MGOLS9XWaNzC=&QhDpZN>R;qO z_rAg13YWoNe_`~)ne`nFTomh^MEHZeLpVj!V8$CHC)n(KIXRlFOy)9wg0fdtZwzYlNni=t(Bf#rW6-uHY(>_7bfd-JO!0)mI`jVvmhNNuF=PZ5Y@4<$Zr zYHC_`otB(fCU(1-?!8C%-^-+F^F5R^IPU}}{vOy&4j9h|w}iS+IgE};pWx-d5^f#H zwB%9IYqTm4wUq8V$=;HYq5!PAUBtcHN@6d#!csq$$*Izhh6fTw168yG3>F%5!{N>I zE%WytB|a<9i2(ll{5_Q8(bqU0raiys&7=B0R%!<&VW1%(d2MDZpw|X0kKGWXu0hmq z$cMp!eWOL#U0-AI`{m>CGu$7h&9t$2 zIIn9qakpS~!kIiau8gcK8OtQ}s9$`Jfe(a`Pl*9n%)#r&-BU z3uA&%L;0fZdw_B0`Iq;ovr&M2xiZgJ8GMKuOq?6OkrkpgZcpCp$+~%OrGUCbhCgw zf9v7=1zm1KfG2ES0dD3HWLc-d||Efg$jwVk?UEPe}M|upRkLY~J^mQ*% z&T_ZJ0;R`O;ZCS-a>~X%I}ezlCqy<*|8=X`aki7Czau($ujOk*_qFxJ(M+TN^(M%; z@hhXh$?+xN-`D;x&nvSb>K~}l_5(=JxbT>-6adTsCT(#EllP!ZVA+Lx) zl=$)#9$E#<YpJQ6_fn#akf%FA_bIqf$>&(FL5S+Cgx<81J2Bn>fW=6Z4NACUy zO@Ax`i2iRuUQ~BAfuMJUvNA>^5^2`Z#tFi|N<6B2vpenNO1B!qz$2&{Rl1KsUlMyN zK1S(9sv#Jgoz-t>qKm3^G+K%5q0D5Rt*tRyOX+~nBAvcuGP1HdG|}giw&ty`U=^J< zkx0rU$)=^b@^)kmD4OBhJ-K}*dfht(Z-&7Oj~mG6sWrV4_Mtnh++CmcVvL`(ElnB0 zmC2r{zKF?tzUjxSI-J;`NaF9;wtx=jiK^p=ZYRkVSQDPY`uACO9$!7TdUTaSdSbGa zo7uX)f~nOGdr|eWY%&-%)Lz`?D^`DcLNWHL6X+bbv=$pE7q9ttIc8DtAhHs4gPv*U z30gH!gpzaCoj{*u83WfbY{u3W@_8Jo=fYPPU}K}4O}US}5RCY$Lk1oalXPg?dw$g) zqjUp6HRLXvm^oAAa5y+E*UTDfJG&3k;$~)7%lYxw8kke-L2w1qCV2ha=3&okdnQJO zE>ANu9lXt~=*U_`(wrQk-?9XaoIA79tmWJQkAg|3a^i2wYB-zIrXFgGy`c=ytT zP_%5m^^c!P^>i_c4W+q;6(sFB>o8DS4n;L@)XiDeKT|cIV6WFyF}eO4Tcl98_l0NQ zOYV^#S*3NsjV@k@l(x?@I4NyFiBzf0t&XjPN_jJgYSG^43CO)G1*uq=Mj19dw*gPA z-3bI39==L@%cB8r2S?1eq(rK3&L{A}WU3`bonq$#dJ>SXN&I0-1AWU!>*IcDSD5pe z!9HH_D&QAG+mt-y4ugY!JphGR$7>nO4Z~z?WT$MX#^*c?WGbQNE9Wc=U4(){YKH?X zO&vGeNRjX(l+bX^V(NO{hHn*`7)zi1*s+LpUrikq-oks<$3>y|-ZtC9&085iud!`u zqTKAb4C?OmYqvwsJV8&r_Y(H3(EuHX_BZkOppf*JtFtb61CMsw-5^dp6tFVah-Ej= z*%1<0d|zxvO{IYF-0o9zSwf&-x}AV8t#7G#V?BpVFVeGg3pGY$8~fEl3_Ui9YWj)e zb^OXOk8trkF$~w+4T)W=M+H=w5t+;9V=2LgIN9^5HscL3w(|gVYi{Pj61KOeS+@5jcW3$w?Nw3$Rs>t*|9Me} zV)|ifr!c+3%oA^{s|7tk>sDPG%pRNiw3^zStW;+Zv&T?*xh}gFIvo!G^m9s5b=>EO zCk0uyF44M7yEc^1TSgoqtAuN@a1{iU*blUeEi?3ust(!qrf`!)Q*={3#o@92HLRYG zJ_CuR(`GlQjuyvlxqmS_qeerXI_W2IYyCs>;wHUUR8i2qq|^_wzY@`AG%P9QvmCJ? zFS5L|Zswvowt=Je; zm=^y<-VXQ7r^sQ*wf3@m<{P(M`E^w9!~g*+wP$szd$|Cdl~4}Yvvx=`Cw{uP(f7$G zZky*m^@A^wM0nKu0Q+?KVBKQ9vU)kBt zbW;y^0WmaKth3|Y%UH?V6I9+=2d4L#`%7bNmfb9+rTm`2Ebe66cZaJ91&>rkx8rNq zGB+uiL^-5qe|w936C!s|qGpZz<4=4WVjeL{WpCF>>DZ?}9+Q~bujTZ=Nm-rZzK_D&aJTy+UGXidS+2)TJqmjjQnOaTK8_UvxHqt>g^a^x#64#-YTm6f zNQwCYYkcBE0VRqtG1zve{=wv)IPMYp+D!Q>A9ktxy!gXG3lOrtnWsxSMORjjlq1Rb z;E)-DEL&Uzok3S|V4<3TTPH5LnMv8X#8o%|2IRcwcgi3^g|jGdnMWBX(qXD}23#|4 zYwuI*@kBB0@!7V3+IJ3b?!S|bSa%Eir0JcoVo-_6t=)6StClQ#)R*I$Av8nv2?yS{ z@>#l>SFHxGFPyxN8(f9ec)i?XxSV0=S6jKi8#0N|poPhD`xdRf;z#ce+^S6)&vy*y_5^&!tM(dq z@LVX$B1#t9o|nT;y2kVrKkc{3(??0%FUky?+5z z%#IqdYX%Or8sJ&vy31ES@q>?HCBv{yxe*u;h(k=pV=R5>Q-M9e!qU6m_gi=Tl65YznZLj zi*Gr-tv}9RSTdm(O)|+J%F*Q zMVA#=BP$stT<8SZsi`+NOQGXxZ$7LfqO#xmBW4)ALsSH%<;3TgKtiRzY!u4BWxg^_ zt*~A6<6rho`#IS*cn&ursDqFVtgJs>Z*5|?0J!$2_1U9dw?3B(Ff=b$&crn|m;`$% z0vrr8+`!Rt{>q(_3PG3}pMbGjT*n@7`Va*qK8K?C`Yx_z+&EccT%b@?-PLS@V?9O6 z%c$wNCcSj7t+tlTxRiV{kYXU6XW7!61~^)^UwrMeCq`LP!z63bkY^oYf}ft#ak} zwB9?Sf2~_lg!Vd2jCMI0p`t%wprB(2&G&f`iqsePi=VH#VqX0$LLK9D#*1{6_Ari< z5&wc}?_A4iejuP6-7ptd-_Duu?AaTKjIXFuOc(^xl!qT(D{I^~d(0+c?qe}25`z$V zXO#229||e~%WJg;^LCW7@AX6T`3BPK*ObK2mv+B_n{#+kLEWjUnu65iUlV&X3qrX( z$9s{4deq`(2UG?O)s>k_C)>*2N9y;Rf}B68r4Ew!DwfTtN`a#LYo4B$MCo>O;@!+_ zY9WJ_dwuDg2y5_9+WE*x=TC@ZCO|Z2#LkrHte?LcG&i;N9_@NQ&jR62LYBOAS$p^X z@in$mT{e(I2V;d4NdQ$`kxw=ZbxmA1_>$9@-|q4g{yk16aq|e; zBI8KeDEPcLh7~Fk#NGM#*QY-Fx#F44xZUA;-(3W3wT4~>3p4AFhEsjpL;7tt4ypH| zmDxNf+$XyYx<9v03mM&ZW41LVFaHNke=hRI{7)oLS{$vSirddEAduSF^+3dH%jJZi z7r`r&-S1FK%WBHwmWdxvl%H=@ZCdF1ptfdI(loZ@((x2Qz@67!o13hF1(K=r)77vZ zb=7*>%0{(wor=8j^18g*7P-CUjdm(HLZZ1jc76a-e(q!VE#1=tB~^bn3Z?>(F}>tX z8lX%jIaT7ZpohC5ol+K_;dk#vS1VJR0(p2tP>F)NA&yoq^|sE@d*v9 zBlIm=A?j2eL)PBjtgjO8sMng}WTS3aE4slNr80D2J4-Z^tr>xl*9~CJ$GKXgj$^al zOx?AiRow`ON5tUgDZXb;MYuTx*4) zh;=b)kG<9nc|Y_MI+{1O4LI~{v4sR`#bQTwgtZa2XHAgr*q-@)=zLQQ7U|`8yUX(j`OW45xf50c4DTIKCPiek~&ye zvyM3JU}o9cjvYp!aFv&~g1bz(@y)F4XL~7QV>qLM&J;HkOq3H}&J8!;zDc!y8RPWu z3Cbd4wtun8s3v4j+77uJ?z!e3N)u?j(uN}k?Q$Biyw;_+=c`Ee*K0O#Lgl#5g@<6~ z48~@?Ja!k9&cp-_)-0Xb?OoDH!1Dq(6cfX#0#BYoQjmjQ6h6pj-| zQ*yA`w`I3VByM)f5xqSzQeMU_8kmJgbKV|~1vq!@wS(!U``RT$PAnMXQO!q-mQVZ1 zMJ;Hrqj00qDt!C5bI5FD`N(1@V6m+z3j@|UhOE&qsGK2>PA61Of3%uE&`v9}oZs)4 z^FE<=F98JHZAMoLth3F`b?r zB6v;%$fJ7N+5%;iT`lquZ4N2e6_ET}?e=Z3?NAAEP^<@~_)aycM2HtB9S z3U8M<(~Z&b&a1RQpqVMkh4&wmIBZhT%;qL2W|2*l(>|Z-KIDPPgQ>v+Ht`^Q4|M_y zw{z=9HLqK%11>DW$8_Okz=b)sb72E9r}`0gASb7zhAOjSW9x1ClCms39DrI7$Dy-k zqC;LHaJCY_2wJ`cc>n7Iq@Ly&>(>BWaf<{1Zszm(0i(Z{PRyQXyZIQ6enBn=hF=42+yMkk*gM;ST8^G%q zwu~%Qqi^-H!`O4@h6?Hto2!!*W!$p)ynK*iJBNV|BT$%1^zH8c?IYkmW&~_tMnE?V zn_Nh%&KgJXc6sObp#48F@&DhJO-W(!{y#nsv#=aHa=`Hd`3>_^UWoZ97%-}b+}cYh zz^5C+0qX@E@XMsZ1`tP>RoOSQ-zUKKJ@Rj6{{Zl1^6CK4fMnKy-^_l4E4mnn zZ_JMTH?!Z8WdnpQX2tpK>|ewJxZ0q<_5Z(O;qPRDW`kT1_AOMiI4QK$BD6z}u zP$=*LZTVyHk4rKT4?kaJ)f2ohtNE>``fARArd|8O0PK8-h8aw zZ4yWxvK1+OoT0B?V^E0h9 zB-#{v_InUj2ng$9$BO{OkKhW9vG`P1UB=9c_R!dACB*x!tt)F^@yZEb)WGn72i#QdkA7f<8^u9TR!=L*Qr@krXVY=xU<+Qn{!YL{1yaj z&c$bgI|>BE?G)@;HL~Tb6U!#*IAv<&F_$v>i(3V;TA;VX zmoS=s#w&@@*;>2|+*Sw=gVQgPPBa;&+)@}xP5K~@*5{KKmZy{7{rW;lCh6>I2kS_S z(cFiOv$H9DTR0|XNVs@X!UK=pTzrw{?YI634Jnba@EaNs-Phi0w2!ir zMCiIaZ_^~(BWs$`8^*Jl(^I}tjmxEP5Uh_y*~ZY3QK0i4iWcedN^L_*TO}K&~girEB0h%o8J&ZyIye0H5Ur8f6tRcDI+P8 zd^)(cqF2Ow@wJmap_Dk`l(3Q)F1JSooQ8kVsjfz(yju_LIu;tDlau(6`~Y;j>#6{# zab1quAjWU;3}934T3mDBfp!V;6SWQR@VtDtaf71Y^UmC9gkQ0vGT@ykwKr#lJEnL^ zU?^6-JZLGD-Pes{V^FT?gQK(jE3F{iaN2l*(fWE1i)%pu&aw&x|6Sm-rJC`Bs!H4qg*TdxCj_mlB@iQ%< z93ekF!Hi87-6eT9NqaSVzv`{6s%vI1J;B5hbyhcUNA>=;0rpPkv(BXEE4<}$-^oX_ zD}$7gBuPF!T$^jPF50sjy-9_?nj7u2-=g(pPPnY3f6N<%Eb0C_UY+z^V>t&IR_tQX? zQHn#OVf2UaU$Lt0B~qag=l{VMTGkv&b;mf4iqA@V?~TtpU4C^X}~ZIY>RhXklh)53Vzlm_oh0VMcemc z87Y||)mp3%-0m7c4W0D~wJyKUxynfs!!(Ti0ct-C)9-bv~hWZyHJ-+wjd$m z+4|lINX>%_IuHS=6Z|~X#LtrPSs!!}(|Sz-Ozcs@$ws~L$wr!PZCm>daF72XAJq~N z=ZhU(tRyt^iF*>$CHd|?*fu^eC!6XSEr|7hFAs>o$720|svrLA3;N!35BmRmx#M~D zu2aDO>t)+C4mq#=*-3=6{&|g%=TTxOWdnPKm9p7YOn&hwnJp66R@z2En&_g%l=?_KM8zx$^h zY~+B-KmY(Bcf!`v2>_53&z)qpiTWiuO)b$N5$0rL0VwWNnHCva{mkvn0f2W&vOI4o zk^Muk?S(J^Ks8?cNF+@z`T_v*z!R3{XCpo5vT72Ct(ERdYy5l#`U#}DXJKbR3EIo+ zww#LbX!m_53G7yFc@?AJ(t=%kU7EKj`Zr~r`b|?ZvHC5g09tm1Nl8v(-UcPQE8menE2zl*K_S`jAzjzPt4jI?lj|u%baO(9cMQ5Boz;89! z-xY{ju`vnstLNp72(J%JBgMXc|9g{#%^rNX3al+skg%fzL0x)3q6P zv7z3%3$rV8D-+kwH2L7d>%u5+NRr~EvoTSQ0rgl#ftp314n$ur7QLNCA;i^N(A-Qz zY*&5yW#CkZdlmosXu5KoyTe8_4=?P@JSk@!IPb2n0Nw7b`O+3IlP4E{xL*H_1-61$ zp3ta2gcm#_VJ5OKwS%Rsf-abD1bcC#6e*EeA0-na6}6BW-8@@({6y0}20`v_awn%}tJmsc2w)kCe!m(08 z7<<`TvQfo-TJ&X|{d`iJxLP`@du(o;fr5q~T?31&#aF z|K=}Y(9iDDZP;e_P|}Brg?vYsxZ#EoVqI`3tZwXbL{LVxOyd^+{dK`_Dvn`q91rQ` zy9DIA97#rv{C4R>&ECMbr)wF!%Ap>0onGiI9_&1X_GC0j^J%3jMFrP;AYd{Rq#G%4 zBX|#X@Vk_LU#u=ETNgqp6X{(fS0?VK&eb@KjhS#3Q=ToGg6tfi)K)Bz!nsqM{8p`J zp^QFqwpLOyO~%%~Jq_B97%Qy{c18mEJM=cKJZ8CutG~Rc}vqP?Q+_Htp(kokFS%bQnq#p2i6lDTNDFo*X zt5l9a+|x&ceDuli_s6g%!s&+>Y*GV=o)k~vC(JYM@`VK+p0iM&U_G6|E9)|;R(k`N z24*v#Vf+l0O53HVo!2r*4wLY-Ml-$+MNx1FPr-NoC4?ya4@bj|3xcYHXDYq0gyBnu z`rCY2HNMcvpzTM|_j#AW^jAaHxxsdVdv?W74%H$^?J%-%I6k;2%}9`wDeY#w`h>tD zQyUDiwt2%tT-3r%bdjS>iw0?!9Y<;-b-N4~=*D^97m25T=WKXT^`fu0IPzuUY|Q5vxLvDmV!vf08xReDm3d2yWTByv8wRA30CTTBU` zG+#2M;Sr`Z)*x!9f!lYE$<$CGB_=9tIq_5(rZ0AsWolYvL};we!OLS;Lh#~S5u zu{cO8%T~jTt-b@}csF8@-9-8|T3J>IBpJaMG5c`l=Iz>;J`-@&?#wz*zk!tfh)g0` zQ>_bxKN~JW+a{+XzN{`%2A%e#wf=Vohba`O>=3uryv;<|C-zbC_Wxj*k_G1WDmCOk zI^e1p)48uN)sve14Lx+Dl@oo4Y18uKUg^eiO_ASu7{QGI+-dgg+T+FbBCDXWlWRjm z#2Yji8qvbW;$ZbZw2VK;AIYRXh;FSqz->cfS*dv51lmxjG((y;z36_XTYaSc>$@`Lmw!|H<;aOm$5dh)Qb1?fwX87^ZoufvQqe5MW7*L5=f5>3#ME}`tPf6XD}Jj! zrTxH+Gn$CdqI~ZR@y~u<5we;ba$;j^5xuRVO;$b|y;N8&C?k}Rce6(#jn-o7qTzqW z)$;xvHH(7KAP0s}slyFVZeVl1lO0iYU>rrK42tX@{qQfCs8^5iydpZ@&+Q|r<;xc* zBdxWQkNJn3aJI@aFprEaQCpJr0~IaC?;gnBjr;5`#@TP@@H>L6E)1EsTx3ry_m3QJ z`ROmpu*%%F(aVAjSmZm14w!xH!KJ2cjl7<+gRJFW33$j>`{uz8i=eTOt~eX+;QYSv zlnHHwnDMeQppz3r-(huY%}q?J zuos8d69)@x3Yn102R1yw5_l8ZxaVB^iVQKWU5{~E=caMD2b9=t*PHF2!09s&%Uk8# zFX(GO;CF;aEaay8_V+q$i^#>THJuctAFAuAhKR1w^8z<^ zv6)i6<9G6Su=1@PBlP{GPI2y_z2M#^lj)z1LUw`jixVR7Arq zt8=z{AXaukftbudt>wXqQtfye3U}&Krt4LjIGM%lJBtrS8hbRO^1(Yj6NcK62rnb;VTwiHgebT(1>P zxI{bl4L=)yRxAIJhitOQwK&U&Vu|IZNCxO#KKo1#OYj&scLZk3-0?_0+R*XiFB;CL z(!ZHSHg>OKPcI+)iMdxksfxtHyCUqUry}BN)V7x+dPM?_!I-(!caj9@Kv$Sb zUdaxb=kofnpaXr34CT1wev_Fgu{wWWK&C=MRN)@kfq{~zpid_LO|Pl1y79Zel)8Ul zr#rxi1oPAD`(wRv)CMJi9a6E+jIJD)frs3A%75Q+W+B3~Yrae+UTNRo4#$y#el|+X zZPi;xJ*je3f9-j;`(jbk(~G>p>9um*g_kHFMc$|+fyIz|6P&B@?RP>Em)&YpIt#UlLMFnFD7&90H`F|vIe^aQ_# zGWOU}p9F@RYFu@#MHeqbtZ}QY&A(O}7#nOSzmVvWeS0k9c&O|m50jDMw4s%7$yrw< zm!C_kC>>a%sg=uNn`h$CBvZ&+ef|FErukP?u3H?q>1#NNC{1dNC};&s3?diC=nu{0YRnL zKnP6)gaD!UP=x@Yw*Z0U?pWsNQP27Paqs=(K6gJ4BztA=ue|H~-nG`Z*1by?H8^(j z?`C6Tu?dB;{B$hSLoiXx-&cq*!?7NWfKmqZw3mzF5+6vjm-hDX= zSvLH4G`~AGaR1KV1$A;YcP2Pprxe|&+_Tx-LT$L7v_p^t)q*UVEad*}t^Gk`Q7~|u zE|2z0W$R=w8E@t?4AA=NazDv@(8fh>6_ZX(4Bn7%+xEG=Lgsas%@KUY?l8ocN83)f zxShS^_3P*Rr|e+}fty%?FE7Yn^6LA8i~Qy3lpEN-JI^QBKi?na;36w-hbVo%z3%*c zqVTUH_%G^oeudyT&a`lR{`oTh5xm=P{{z((=ZnhwdVElDE zA8_QO1)yT8l(U!gd{|<$q0UYn+(8^3xWV=VJK5N-{}G`7uuv30A`I^eNHN=WM#43DZRNzOX2BtlES^ss?0^&P z_i|0^{SEl}uhqCe-5{5|EV;dVSUPuasQ1ohGPx|xwl6B=#nY81M~CStXl}AqU+r|8 zr@$M${zpI~OT{i&?&BhxK&%yk_tLkSdiH@k(@rxy5hSVo5v#DdjT{N$I=+8csp4hG z4s*jRzD`|1kxOf&UuWxLA}1pE3Xe}$w)5lf9hq0C)lOjHEG<$(PR#&NOvB2uddcLp ziKog!j}(kAV1Uw6QzD|)+8*C}BWn2I+rp9(dQe}9O0^nh0c*MN2ZghS^h8`iC20bQ z1wddk6G5ixePy3?B6i$FDxA;n^#q?t2|p-fg*zqvl|1yB@<;$*nt`7cC38I%f?L{Y z$XB1!;%hp&Pj3|v!$z$_EIUix#P+>;MFb+_dUYEbiJyv++6m`Q{Z(ILBB~cd?Kgh4 z0UmK)+v&}TE)(~!KnUWDp}$iU+JIaK5xTNd(H}D8hmsGg*RV0bk;-1bMr`VJZE}?-@fgAwDz>m^7oBm2o8BvLwJsMhTNd^ znumP9?Xxg}Z-mu7Gxgk~WwtFd%YP}m{sYyVv1}pab~@u)V7kZo(g~#hQNFRAzmO+W z!w~nhKEr&__asH&!lNZ?AGB9gR_Y8a#Y}Snnffn^St*PLHX6}L*B>0cggW;uDw^q z1vp@H z`Z`6;tO^{{uSfIVic>3-;~CYq_$w(=#lTx-{h=Ks|5)z6gljjiq8OLo2+_rbZQv&&<1BL!tdH{E>IGbosSz7efxy(4XUz1v&aDHL-NQ#!*p(`6*&$l=iJ zjk%_ITqh`-Xt%ynQVvPjP=nh!p;88Au)dy@m+dj6NZC|xL{1sws z;nzR1zVt5vIZjqO>3+HRf~-y!yux&Jfp&?n{+6AU09YEvUal5mlJnvo*^)r7-MwR5lkT%0S1 z9l=-X>Ra4`frGS@Bz-qlM~N`lU>T^FbCEGjh7D$1Q_eWKKu?Y2gy-1}pthFvx)$jr zBNP2S3A|U9mdE-cSHXh(E*lQ@;{?Ipp|L2P0HM6VX$EGt0w*4y)>A`Jy|4D}kvWuf zyJyl=>LLGc)OXsIpa|CbVuQI@dhUjN#`mo@XX4uo~4XZ^jf6 z8Hi~dZxDovl}0{eG8SfP$AffToCJ3scT&_9qj?NK2G&;PDV#?kN>BH`#&n|PU+E_> z_)0BGw}|B@-t(nXa7Z`Z+6R}s(mt$0H#lkRW|XojzdRYxtO?iAIX5|yVwPR#URdXE z){TneWAC&ZQp?XnEAhcXevHUm)|nm4e;ngj<`UF(FQ5*kXy_GEXV$5kHf))FVsI<^_XjQITE5H` zZFiyM36r{+()MtbK=r?yHle-?LhvZ68D^py+uY%52ff(7ujm0J)}hp><2?aJj^YhN zkciuUE-kX z0GL25<1`qs2*bte&E}Pa>a7a+tmmze$+wRD0K3SGQ98h?$@+IzmXzY*Y^gS0g=* zfYvUq37_k1Ng=GoWSY03dIRc*?0X*b!ro0{N_`?rCT%CUy3+OxfHz2gEBZVeZJJ(L zS`K%bT^Vt4H}#(bh>NG@7lcKvy-3*U~ z&nsv3v;O=f#jU9^J+)$+XpDdX$VN7)l(Wu4iAol|d1_7p{*}@@a zcT6c`1obzbopDIN#r#P-C~nDt2z^k8AFK9x=tr;z@h5auapXckWQov@Vf@Pp9*198 zf%2#?;9A6j2Xef8F5Ku3Y0Tn?|G^C2yXi?Xey^8NBQH`(g3y#QsPQ1!6NaF`T|l+= z==MEVLvh5yQh8Xl2QFumdp*4;0bLet7eI@P!dgDvMOf=e)3HdzMi_rI8-N4KOY> z95HY~=Ywo&kll#Xn{9|i34Eo!^i+z%Cg_)P%ER=hws9)N0skLigZ|L(0q~rnLg_%%Qs+KRtwO$*U1S-RcnsAcWf(B9i5Q-flW@Z4k ze>PE$TM6i~wVKtaB1@rAQ1eT&BofHAm6bQEjGPVcKYT_!WuriK{nTn*-?b3_82XII zGUGKGQ!b(kA6|nS;LP6ErB1L%=e)vny5A@^yrVs9WEd(WAvHB@;9-VV|6Po%^2;1iE&i}FQNe^_K`$}`ER2elhi9*>Emr~p-P#P zi93z9yIn06Wb)f7*ZR7+JfAf--)uH?{2gRCIGAYdJT2Uwng0LZ0BNB*S6zO`bCFu=q3?S7lwfosV}vW z#{&@JU5!YBz08#h>3?==AMk-w{S%ac49+wi!@6%>@{*Dp^Dj1888+#OLTfRh2dFRa zzT1M>&om6fr`EH|Q0YeKsoSZ24znu;s9DlUWkltcYWIuTGSZw^h@W|bE)fOoD)(wy zg%w^tf{#aQ5(1aYPoK*lap+m}cOFFq&yEoZJrB|8iq zDE}rJ*hUc#-Bi#$d+rg7P3Ep{^~1s%yit#$ZDXs500b!J!~=Y2-kOHsgQc3-fYN70 z!w)XTRX1W#ZO0HVn11gEl8b`<$sfURZ}U%NYPudOH(JNZ7n+oBt`xu;=0qNpM~F&u ze55-|XwB?hf56vq_Vwi%)(oJmQat$B<~^MtA(fh~#0+4#GKBK)2w90@{&icXT!NqY zj)tBEmu4_2sD|P5J>%XDi3Y{*8lTGeUE8wEi;RB|Sb8a0_IRcDG&OZRtA<8HkN8Ya zrN^Hn==hW>*Tf$rcP=q6Tu>4^-c64ij&JIxj&Ja_4S zP9josp;&>28xy)|>e(iw6FH?#|+|>v{kCz&Klzi?C=M)R!bFCvPT&9VV-*ZTZ_i z&>lXDS@dWMS0(I~%R{#`QQmiE+ErchQh9<2s0%)$bC22ZezRx5|8+jshU*G@mK{UZ zu(+%d6XADqq0>~Otq>Tq$O(*nZ;DtGjp~&tV5ILsiGOG?`YRsjRcXAri)_Q?=2Jq` zPFE)uHklJh1FsOihj{0R{z;T-5IrGi!sqX+7(EzG>dkOpWGX6mj{c0`6h=tsevF>N zbZm#R$J&+>w$|G77dYGVoxw7o=nOx;6xg}Jgd=!JtbM6qU(rtgjTn?2z-mEurvoI9m3Y!MBd8%nd3Yr9&>?{i}QHMiYCZB ziseLCLr&4s6fN&fJGnLsy2Ws`r1?#l48_Jb2naalXdL%7zhrWhX_vFW8^FW$y~fAu zn*kfwEo;qMW<){6D5tYp+_86ueDKA}Cg$1vkKcw#S{Qi-__fF=r@aLCMXVg7w@${q zL9BZ1*@`PpE?T0Hbo*>ZLkA5Mwz|N%TVXl+JOT0{=rMbaB`}XbP>$otAHa()lV2q! zCNhIfxBMp|P#&=s_Qya)16Z&V2Dk$^rLX=GQ;`C~^HCDY<)(XhHWWOAuccbov|u;p zsl&~fL58s4{_u$0?j$~f^kM2#W={7+xSIB^?@}CI-|bqyF-8`tT~FsB1O0g7p5k+$ zAAusq=ng4Ukt=mt)?4?2Y5fq~W(7Vcm4)Vdb-W$%(clQ!gc%dg@wJYjAL}SI3PTkn${h**Uz6XNacRmbprX!=z zGu?NE!(fMN`nckimYM5RW90y=*G0z6?lYD&t zhIt*N4M4-(XdWB$AJI61k2q@LwPc)?V&B2clerx4+PpY|we&I}UTDdv^j1AlXu^_; zezHo9AP=%KID)m09T}as+kIBFBa&Acl+Zn*%qCGlFv*kA2S> z4Ns8cqon87AK=dW-Od38Mtv##`dd@cEGUP-IS~oWs|m#>hf|cohgeHPT<{k4s)%sE z@&f8`-YZ8Obt+W}jB-Nv526ZH3Qn0Q^RSrlsIR$E=VxY&Iq*F*>Hw=s*`?g0_Y{)> z%6P?1z5^-9-So~qQ$+yw361;r2E4r;T$wMz6XCl>6{)N}$J{Kow%!p^k8^T;RV`dO z1a~&yWQ{TEIga|@JEZeu8BRJDMslZ~h24i3R z>O*rLT*`sA@*KJGHFn>;_YtL7zy7&~<{MN&7Tb*Tp`9cw#|bwXwtwrj&$1eb92As9uB)rF zl&B;=qP<@^^OE4rm({Ku?3KGyQ| zj_&iZg|~hx(SyM&Mq~#hHp$`@k{yF9)V69zmE7pj(-ZH}ZW+$&-h*dK(1kf?ov%*5 zLfMuC4Zi}XZZfW|bBsNrAm?U8nkJb&k0N?EauEIYoWWSxT7ON;x5>p1V(Q%83YI*f zSBzaBJ8K{O8O$@|sB5{dr=6unuvkm_c7a~;NdeCHB;hMl6e_>lO?}~c3Vdg-VgFMM zzj?1p@>-NfR}})h_~NIWQ z@9l{%s4v`}&g>SS^LGnOGVs)6w%xA;P!*0>2%IBZ;;~W1H+O z^_b4{DJk)#ffsk=0LtJ$Q-+KCqRbG2d%8Hu$&6ChP~wh%^y?v1#E_QTrr`yDjzadFc)qF`Dp?y~fEY!xqZST@s7cQu2W2a-e_#ebAFv~01ay*o&;+5U43iGda;)I6 zJ&HrO6_Mn9TqpB0|nhX8+G}UYqhI=lv7Ct|WTX zSIFo3&a^o*w%TihP>VSo1-*g`dWVL08eY=!BsBNagf%kf zJ?%=9GsbM%_UWFbx*SzW+POW)CM9F+$HNHPuefFtq#F})#0^5oo`^AyR`31&4ToXU zl>*H*%C+Z8$4|%yVynas$2uuxo-wVd^OMV*4*@jDz+L%f^I)95YjN}4e|w3J^g7D- zd32v>i;?>e{PNbm=OMr^+TjTE(F6u>MuE_~8Gcv(NZriNl$TD_QZyuc-VX^rwrwma z9$1fDY$pfN&Xf+5#;REy6Wg-;L-*eMVMT8r>)zy0aFYo6;m`>9G_wiPjERtRgWQ7P zf)|nW?CX!0o^DCBkTYLHkk-rGug>NTi$phyO<}*GU?Yz*SHv>kZOvX|(t< zk7TQWB>!T${WfsC^V4-*>g+$~71@UB|8+2utw`=)#~|4<_x^L}k?lXcBFSXXncF5; WtS;BjU;a3I)r4F;m#KdF=KlgYs1Sny literal 3773 zcmb_fc{rO{+fS?BTB^&4rKm7f(Zy1wsjVsXGOe+;N=J(fs%nVRS`v~DMYj~C)+W&^ z+8R={mIj%kAyP6zg$7|_ODPkvG!jp~L_6>I&-cf7z3+Rj>pAD#&-I*p`Q5+!zRq*o z!_8SmNlOU?0;!z(!O;r@l9TPd6#gNdmsIu|N|#MBUd|4nsvaGlRM-+~?`jVMRc9!R z5%N-5G3tl&F(A;MblI~hW0D^N0&Vv?ZP1?&yIJzMFA&dM@Gf@p3g=YGRIr%E`eWjF`~PVQu4g7Vf>s zBpPEQO8#nHDaUe2x{c7?0w?<{zjI%WUB=Iy0hJ?l9WL1Gil_V!i#~ZUqdHMxDf&+Z z$Ov#x1l-`4(><0-4)co2GD|1=9v!S|`_p$_rzel|ijL%^zVh_wYYj;{^T4!|VX0oV z>xThsSj*_;6Zw0)@yET-|D-NERvgCUbh2q$61BbF*XYrsuTFVPXvzD$Czpe~-lwm% zj%rA<*AaEtUNJAJRdV0~f$}nm$kGCgQ|LC&S0&;anG(>;?_F@)Hg0Q!cjJcv+KZV`=aI2Z%M~s&3`EPWaSznZ~s zw$4?AaFX&(MOzbFuZEdV`kB({SvJ7H+KV(I!KMRM4ebcK$W0Mut+&|;n_ z%D*zVlgM^z+>y?DJLa8ECyFv6?!)?AyV|cE|^@xVOub%5u4Yv>Kouo*k z$TyI?5n#IfVug0*k8!XPoZ6i@yd>6dEhVI|EJH$7dPiPlM{E()1r>0Sg*Pi72_DNc zuoV_Rk{cyM$>zs3Vq+!5O9kRZq0j6(sa@FOvCuh9yhs{|v0tQFp$nuguuLT10FI*w zl%01I$6^a&wq6L(>BEgXqq7XyFW8%fsz|Z|tL7RoOTCihG6|z6CayY9LUNw(TVxC0 zrhke(lnFnOV=kzuYv=FCao9iP-#ki$H*@IWwUM85>81&@fS3$l@M=C{v$A;hNe!AS z3^Ev!7wWha?oFL=BQ$-9U>g1AAk7L4JMIW&mO@2S#|?7i1%BKjx6kT50X!VPDP*x| z@`H+J8|mi^2q zUXkWSyHm`CBj$zCuryY^Bc@g*rZ1wzvtb{$eIM(z+9)w#s)&o7KiP23MF;EIlT!Ie z)a51Qh6id>47}z)i%sKO>IaOr1Z4)yPquO<0xln#@Bc=?jZkmd{TkUA^=VaY5$0jU z$q5LrhgIi64@^xNbu{6e##gwe!qpgYNyvv+r|+gT$!AEsr%xHHcbW>8kItxv zmX}=HBPb5^KW{QPa0rb;K5Ne_N{+Y64)y<1p1=+N)d`^%Ew@3U?U?wIBhVAJu6W4^RMqK21Eiznew>G)1Q=eBtuP=;M-m1!e;FV@OQ@mA6?1wTM9!? z*~N#@;+WYF5x2$B-RQa_+vOL_iIVZ_o_JEGPbMl%HAN1e^Mk zFP^bfp~0xLGXecZ@3n7STkqqW#nM&=q*0Pe_U8z;u21vnVYb7xr8ZVye&S(_DE!TE z?g$$Aqj}PGAAG~iENcR3MhO<5XW5yATbSla_(4G~2*z)L?u5;q*=Y%?9u1zEtb!1T zYvh=JN26Xu7jlB{YNeKn58lHWr`omT zFHqZhHReVH`X&>TFkpptlJBHH1QbsEWB$6u);A z`0}I~g7*H6(X!pbl_h8^EB>XVxa?HWcYsFzfF3Mrho>ZjyuQ}0OQ~&`7Nc!PA5TD~ z*e{f25yh2Lu%Rao*!>bEDeB`^i^NmjYw*CjcZuc~`C2%Kwf>)tqvck$TGkH$^y|yV zXmR&}`dJh(7d+I0W4@S}BL0$0LOTS`nk{+u(Q>c~N_c$(yFwfw{Ym%uMib5KE zJxE4fQs|GF(ySs6N-7h4Aj%x0CGOQ@xRzUyg7&lhOr!j4>Ox9_amQPoy!ix$sY)`X zRR1gCvpEz)xRCuG8$Nn~>JaM?>+7mbuvtdd1eGNylpnm`Oa%HNBm&{!$I10!kqhj@ z9;&|P+1K|D`?5^fc916*JkzQmA|)+(yPl)jsEFvH?2`*5xS_e5u_baN8PeLVU`;@= zbRn|a@11Wxep&u?VVNB7XSC+^@rX9s_O2Sk8>Tbq)5jH(gx3<_iYBBGkG5sz`m!i^ zt8KjFUUtl^0o#x4X(rl509}HAz%bkoWS^l{$#;Hj3ll67%^gS+a0=`1RA=HJf`IES zw~o4RX*KE87`vpnJM&laT6qlZkkf+;%dvm!M_Nma6Dl;7IhyU8S~pv7*I;B!3nO`jys9Wx%Hx&L zkAS_Jcq(bhI<|PJ*mX871$=Zfq7N}e#oa_*JX5lhiE>{5?r$ul%&eTISRmDc^lh}& z1^Osxgy!-`@S0$=U#?3Wz~oK6woted5NtNb(Hd;U@@^-8?6^?kAy7@-Sxc--P{Ird z=8n^^Uf%V!is3>lU;=3;DU~{Sm#!s$#zPd+9d5}`<5=I@PbJ~20@#}=vt_Hb|7=Nk zU{-m=HP8O4DA4B6ZVT90qm#bS`ax5iD=v8=nu`b^57TH&t-l>jm!gVUe^V`HO;rAT zC>Yw)Tunq;U~TkpDPZ0?VWs3@pW3*n;ccJXld^ZBDJ5(8X`L{Z0m{{P}+QjpphOzarIX*XAH?jX4rRQzdcZw*cg^Um|8RpD1Bxh8lsaQWYCr^}MudnMDIy361d*mvh0vRdf`Y(E3q?R9MLMzCTG1Jmj~m-OG@f@p<5@kE+vy4{&i3{+wW9>VAkc zRo8>>`D<*vFVu-m4bS%1@Rq1kbE-QxX`Gh>USNLS;19u(Jo44Jm-zi>Xu<>w@LKuqL-@ywIPkn7|2Uq_^s z&z?fz>NyW8$#^3l*WG5XxcyE|FhaY^1z7dzwliz(jf0_16-aSDVC-=*gH!H0#V4`i z`fN*1m{Y^3qlZ$hwx(&+3^_o#p>upxUI~v8<0OtK5=ptJ>cD%5z<$%{KBbk`nTbCb57aUIMq zN#*!MvhRa4J?hrabsX3FvU>hgzKswcc!ro9V2FLq8dX+B`>1!|5{@Nz=L?*nTK3tlt6o*`vMG8S-X%IH$fM)}fXTOLjVw+|rR z1FEIbW`1lCasYJ(yG>f_o>O{Z{9!~W%w?d<@2=xJDF`H;Jlc6|2x}JGJf`T`3KB<~ ztH#&rwS`Yqu;R*k8BsICUhz5PI~N$>jQfveLs9&khA(x#UQz4m{9;B#U6iFA)~y3) z`Jxw8@JDC?MFmN3Bf3g;oVDGmD%v{EcJ~@qQ`>J17Dq_bc|xdeHko4|(^UZSA5!w6 zf!}F-VYaNj&Dc!z27w}dI3(oi0LwK?am|(IeIv=oloGko?W}QuCoMFfSmSc!fNan+ zv<|QDApE3ySurDEdXIRFvzscMLC=O3IsoIhFB24_#P(`WLG9YN8hzSFyMF0eeLN}P zmfpR`@+soNbW^buwaW_!N6e*mDnhGG1p8@|U7H z-@Eog7w7(4d!kvpAD8hPqR`qoR~NP2@OYlC@`L{1zS{l-ij|YIA_>7w*sOW!?W1fv zWm~OPK(ZBI2ZUnst(9D{6x#0#lU9lAwavquqVl*K34SVAAz1bs?K84% z;2Y>LpcZ|}M>JTlv=IZ_Ah!Be|yOO`Go$wE9BkElv?WKxIYXX81jg6U^1=*`BqSWOC)(+|Q zW`Bg`N6UMlSqAE@JvN`H`!1ui>kWM;SkK>Adpj^DX65atC5D|@ZZjZor@Eq^%4wdf z-G6Xl79@1Fz=~cg!-h*X8{7`%Un|=F;mT04$rc_LKLT+u+n6PE+C+vk#cLC8=NkCY z?PNf^pUKREl*fw$XX&8_8%F|4wYI{TWh_#{=$#jxn20)(^V^aInNNK$nW)XX75<1P ztPwdjuZruE8qdB|i?)3LG6x6zRb zkbD(ZWy11ZS~1u#l>xg9@1t!fWDGwj>cQ=Q4RvBXGd|P#X7C`wt-`-Ity=;YA4=@= zM9;EDQ|UB%AjkV*h>REh0PI{4PwT%vKKEwfN?^eL-Y~tNE&^V)f?b51W@JIl@y;Jp z`g1lOq4%PR0oD1x%Km`e&Z`rr46L_JDSq+aWZGHeh5w%+-jeq^g3m?E>;xz}3cMF2|ptqmO*P)?Ruo zaoP1=5W>E2&bwtPV8a=GBsJB&%{JVde14tNPR<*Q&@P%DZ=FQXcVl}{i=)@y#l}^N zi^qK!N^Lk;3XPsV<=8C|he;i37Uzc6!7e5poTgJ7dSl86P@Go0-oGXyp93L{e*Ta-4sI==dlNvfyo zKfP?expWafYhz+l6*CldUl40;4>~I>jpc^jsE9Bg+YbhF>)f}HC#R-#Rf$6mm~?828k#FB@G=?5a4sKKa2MoAyIW5jIa&3pY3iVh&`~Kp(fzb)83So{%wf z%VYYbhIm~(#j!7uSddI}9)8rr7?l4xpdv-6yvn{4~C+~(5G zANN*v%O!f;C$)GyeQUmgbZ|jlt2~4qk}x;~wfntVhHmc14u+jI8B^vS4WLh3L|Mc+ zw_rE8uV+@rY1>bqy62Eu@r7-g^hTDppxL<`e0N2eyK()u!idDBQB$<7Io)zTs-~+w zhR5RLv7{+eg1qY8HMy6$dSFbg;g4f&cXDcCec zEY0n~)KG;4pT|r(>Z|aPAN8sskY}Z-h+8Ax-7Pyk3*m9t{qK**`~w6;a(S(jMKq+Z;A+ zSpowLb8|_b6gZOAgX4yEt6FdYVUrD=d)+mZ?N|kq6hZs1cy?x#Iqw7U5Rg~wufUlH zHU%Dev*@NWs=l`*B$q77=$(aE4~jd~31Q<1B5GuIih)Abp#v~<-tBU%F(tyUqnKzj z^L6k`Rpy^op=?dQSm^0!Z!pae0VP6DBu(UPp>*4<$bgewO+S;FkI)C+Z92*8LSd{_ zkm_oGUoEzZ2o6{B@W~Km%kUcZFIx36kwkl+@OGWMy~%#M8ktz5t;&e&Y{{D)^y3S@ zD9K$8UUQ~bu`u*Ux@JL>w^Y(vWtrWg9}Ri^eo^s+&ASsTx&T^>h%7}dZnHl zKZX7*JY;$}CqyoQu=){k&ueI2oUy+} z;H&Nu1x5QqZJ}K z3CI{*TiYv8?!x=j=c}>|2_&i$NN%gH=F$?r&xTCzWZlJuflodeDv!nzfRNcDXOc={ z+`F-j@?(KH{YsT9JTXrPiw7orM5LEH#WKgI16CY=V-ry4U0G@v0*@b~alX00yIi=E zs>lqHw~AfvN|Waabt1=vIf1;3tw&-yQeTDB{T$gL^1TlL-_WAmV7CHrUBtZlakORP zDu>ZvclBwBjPcdm-eZ9U(2&qq!IcN**+gYb!vM*BhovPs{L2^ zL`IL+W%+UFtF>+{IZry+>Nyd`JoP1ZJk@8`VZ>&3 zdMhl zCXcvZJZu@Y<@2oP@~&rYywmAnUnG>Zy+zDOU0?PTSHLK|ELAM&A|N-9WatiQ>zBLeZ(hUFR8N1w^jHV1Xw0FX3uezB6QJ?xOu zllCZtsiDvuuwij-t|uCUv`(Tx$L;O*gY0pEi_2E8(FT&r1bNdu#FBkr)0<`PL0pi^ zIkRGa5ojq*~^K*sN&YmR6p zq0lIY_b}w~Rjf~$cmLAatvDYn4%~MR4WlS%t7}AU3xEhffwW4{)t|Hq7FO8z)9&a+wu>sSo5Bc&ckiI}x7S zg`sVnlbrAr!ePRXoARDXJy)u23Y$PZ1&|Z!`OuF>8L!)ltghJ?AWga0ts0p;M#J48 zIdsP$bZV@tJ_cTXJ;9=tJ&4Zb_8EXM{ZO&=s+N4>A6U345l3#m)P6J;ymT33*D0qHJ+&|zxt$#n}* z^-1Yd9m}==+)#;hG%gZ4pGsA5$#tlL#f3WY_>nH-loKF_vt5lUh28+$>$M(8&X&@Z z$!nQufd+&n8nvz-C7vF5U7U3(R(a~0ZTAtg>|>Y(x#V*AiOq4#=C>yuY!6TfwM@ZM^w)j zd9`zTgYhwl(U2}C*l821s!DJA;QK}0&i9k^aR@DYSjI6PJkc)Hsr+3btj%%oh)Q4t zrU3ckbPoVd^O&bO0CLektw1t26Vhr{T{mwNiW9oiG3C=(tt(!|V-6bW%!<}P8nn=>I+K4ICnG|94Zy#AI}s)j^@G!_g>yhE7YRpSt(&HUGCxV3|Yo z?0@bN?le?B4!z1aetQIY`?E%ZK~x&_`gk;>RJnEd-VeKtzc{x*-+ub~ic}(I{P+hg z$^UBctn}f&e))Ual$BMVB%jcoTdcdkS*BDC_8W9NubQ%^p)ANgVySd|MrLsCK;3nm ztP=l0_QsYC&xooe4U9toeRUQSK%os3p(5rn)Wy;v;nrZ|Eurcy)ne*Ik~3y&(gG83 zwf|EC^UIkRY&)%bmY5-qZZ`Aeq;K~Aokh&(vuKws@}K!MRq5~9VKzB%{Ku2~mDNjNvR zgpC}#61K5enwDDkrrn$)XxOZg*5~?M0BLB{7Xh`T zkI>-L2O{v5Ny{V%mR)T=#mkfZP?`WpDa$#PO2Kz2vi~W4y7zm zG03FDGe-;>temQ_Od2_?ynZ{BU}}J&!F|q< z52bH2LVjaZGh_7^BaUy3Y#mB;hosI^i;UqF%}{p^#|uF2p12NA0vVTY8tWQN@v^T} zluDxO*=P8C%b(Fg+d;W^sFbC#yF*`<)G}MTFyps_uC5ty?vOkl@83cC$;>IeBGBlztgtqpbz$arnpDkL1DXWst{Hr%iTM>sX-;LQFuvgkfM$gdd5d59>`kl$ zW=5nV-u{0$aWy4YVheWyum~8lgI&ilM_u1IFsa_Vm_0nkOMJ`EZmA3C`?lGwXT%mBc|7f(z`(Ji~>$0uzGMI)mojZUe<6k6QN%&zY{%o70y!9G`Z$zmJa22$$}=uDK&!*d33vbhm;6VP8>} zo$T$C|8sGo<~nyIm3@&EaKeV-zJeaAOl`x>AgHcDH{!W1A<7w@}-x zPuPMyQ~Fa{u5Z$kekg4_W*$k3lQM!Y8|I;`WobpATM}|4Z+E~Ileq^SW;ac!Ww_~mGJOA#QkN%=R#9Oy{1BnfUQr9PM_R~Ys4mqu=PLg2 z+e}v~_bv7K|v$sl!uV(WD^%!3<-=nM9kuQW>TP?o#tq?yCZe*kl6VF)7^ zz<0~F725i%g}iz)AWUs(+RSCd@wbubsCh4e_o=iN;q=_4gi zVzkCh&&hRKN8a9{0kz2r01_GWd*5}#ok{FX6R+vj#C3C7t>SA>0C(KRONe9(WOU`F z)kqr&@=f3FYZPjf^rJ_zQ|J8hc6q`-j<|T8S5Xm}~}4@fb(e|D65D(wHj7-H7)K4`8FP_s>c#~yT4ib zAFGEU(S-;Hd@I)@<&e6Ok&TV1+CyHvk^nLRSNn6qtpSy+U~{c$bO5*G2g{t@|MKo% zVi!tyzNFu@?(40+5n+aR%$SgK2^u}La_%O48Em!hghM~L(4x@aFP{9Ovc|}@=ffr5 zl8-;OKDK1gjV2al6U1t&0Mm!dh>{cDG0FGMauPO&tUMRorz}smd%Lh7XiW{~GKR49 zHXJKS`zfXSwCN}tb$}Ak!mGQ_PEH=RUD4nIN68MK-ePvU2bjfj6QS&1Wr=TKxAx?% zYcbT@RdOv@!t!TYuD_%=TlYNxv;+>i1V&<0T|o3niuSJr{dDjZ@ zs2ma)Z5ZtORQpAw2@w+_c(5_SbT`56`Nq78u$2!>H?+4sz2^^8wT{NxcjLs2jaM9U zpYqdz>i}3-?Z-sKdbN%S*2etr*cZmFSD40v9^)mWVXt;2$O@Uglg!xZRn?&EV?(+gn%M(~t z9QexKk5)UrkVsfp$}DoIXaKncJ3rg3b{c5FFoAvQv|MLHCaT%(2f&6)IkUFD>{h<4 zMI0*qkxErB=9s~9fRY>;sn72(U8=RJGf1OHOr9F|iK=ZlTJrcuTAr%`;?9va9c@zw zT#ic8)miI65=z$so}faiEsMpJyi4uJ_|g+K8xV2=jwK<2>%CqN=4pi|bT%|?1Ky%) z04FvdaEm?4pYuo7`-H4XJ5b7XHHYVxP@rf25rjBkt0pk2CUP(HW394Cal-!O4osSq z)YbZ1Uq7~3oG81-N9U+D4pA99zx6s?ai zW4a}&eOj6Bw)Zxhl3L1mlNIr={fqP)bvgD3|$ zfQ*qs2oLgjo3r;FtQAr{`boRje&D%!Q5E$;8(VP5;EBbWxxE{Nhl6jNPM-#qcbbwD zQ1yT(-J?*gmbw8>8Lbc?VsjOLWJ^ZCRJzh~qHV^2fN{D34?F#FRgW|rbtCW2Si{=q zA#TqAKjm9~C#4kyl?`W8oc&q^qy$KQ&ZxY}Bj%B-93|N&TcT4x1UzzGQ(xw58K^3_ z7Mv^kQ&t`fR(k*>bMnkIrDt#D%`DSE#S~Y2j?-N)$?vaseHi3(G{Yt>BQ?}6y2BLf8h|HZErUF&q7pU0wZT4 zhs=*1i-nZFO^ivOf7L5>4sDq9AW%T~l1y|+1_<7N@)XBxgY0Cp@k`+`X7G6+O7t7z zMx-}aA7tjS;IwOhJ8rSn(pthV*Os3SblyKwa2sM0#QF4rxa>!oc6wP;Aol+I$Q}Z6 z;l$JO_8rm1t6w^f8?U(^1WO-lw=+G1Zq@0m8*_Q{WretOj{!3+4trglm~A10x0-L% z1oM`}{D{wXl6%tZqio&)hAf1X-d{S{=&(y61ALlKyEnK0 z7vx1F%FPDRtZQBgM7#a7ifuS!+n% z`n^x<;?DgHzI}0lvV{&VmSR9V%-p3P$7cHQC)LmbvJOMt3Ow+i>lxAoeC{>iIPIqe z&;S1dhcHkv`9Bw5C8x69v;Aj*9iaO5eE+!!>x)b4mP?yS7ekxu-zg@`LiKK8)n0S{ zJu%$y?FW%eWzye%@5tnIVCT1xOb__fcYY_y^#6FJ8BC`LxkXTyj9kl07%a3PIvS{p Hw;uf$P;>}m literal 3770 zcmbtXdpwhU|6fUNgzlUV8S2iVgfg?6EN5=vF&z{oiR82pqP7(`I!ykmC?n(+e z3IG5=$XOOJM+jvahF$`>krrdNgRXp@uZnbHJ{!ov8nS9zZdi(<~ z)2C3GyRFbR@9ni5?*sSVsj3{Z)?FlR*3;IDIs(Pcxqtdy=s#-qut-in`~>X9%A-H# zn0BM*X5=Lz|6@8GmW_a3r1V>g65niB7WxShUoU;jbi?hp=|;Rf6}O<`JRh^8?qmb5 z@51NV#tl;3B((KL?|$-4{&UZWrl&x~^Zo(G1@hSSW|5tPcK((AgiwF^BJ8%IF;6ULe!U*7n|p;3#I&_fKX%OCta=>amr zF@m$*?H13q37;JhT^e5Ul}f!Tv{dIhPAnjs^fj4%o8FV5es^(3`H0fhn459Ofd_(h z9_-i6IL3i-(eq~J8CsP?v=Vp6Il{h1@t;Dfc(U7 z{ek3mHRi`1l-SC^NJ5LAfeP*0o?mlzkx=FF|B=~4RB5-sX5E8kfk`X5QC=YdMxYDz z{PUM^)Ufwm%_{7eG0}P22?zX^v6OlIWlnN@%IENpz$z~XyazK!EDU6(xMJXAs)tL3hvQP{uz~TCk_j(ZEIvc6(X-_6P{ZNEIEH=Sa-tbKK!ML~-Q&l7am8PB=>VEwCUro+ zW;Uv(tE6d$U^;f2_b@)^Gg)hj1dS;sC5JZPAuJ3c4->l`O#ty^sEtQ&{#X^fq8Ez& z;e^tHNx`jsDs}rf4;xuow6``$kCKsLLAUK#RFqnal?R-YIss={SZjbI|IR*4+l4gw zGsZn2O&=cJ5G9+zI>M_>LhZQBbLkk-n=YjFngpRlzlo7l)XS<9M6=XY&*?}K*?^OI67ybcAmT81sf)~1C;zUu&c~C96MvbHg&?Y8{ zUGHaku0X7*ku!bivWR=7D>T{rL39}#3K zM6~)Ip!@!N-)3%*;@`i8wRpffKvVIn8t|`#cO8mt#IhP+oMb4#MgJF^8zOXFmY(Vm{3^j&6uESfOrSlr_fDj@Lc= zz@g1A{X%35-5)-73poOl$+|9~fY)_unZNyqjEIlNZ!81nr2mN_ zK1IM3vt}BxNA;VJT3k+z%yLE*njah1=ePG%#1zDSW7rVefK8nTx(_JF*ws=Upq5u! zYb7yj6)>`JX;$2|b8sOOo@wDz^}>afgB9>8z=ryknki!_??tx-M__^EZmkadC?2oT z4&HG#QsGPcn^&mVG8vd_>nU5Ku5>4HrCSIc@V*0y{1uup&{6i)$XBU z-wjhanJKDw8~yGQZ^Qt-BgggsGSfS|@f*p&HJz1S6m&%V;F@5{SnR-NE?wc@#|oy# zJdru(5o(WEI7^#4wWNkKZQ4!gyN58dd-qID8;e$RvKG)zZ^R%^r4i@lU4M$c|HbL= zoSLfema5cD#&@w9o=8>>%7QohSps4u0a2E3gPq0S97yt$u`1; z+)NPky*6d7B*dfs8V9LIffXe{^>gp}IUx>^nVc89NWMrG6D+2)I@bZcL@9Npf~ebQ z^9<*pUb=FX+2FZgIi1|@g0vQN+KFB08)6H~D#yt2#q&WsBU*8Wd12x41Kh_4emWaB z8b}Y2PVGqWSF#x*m`J^|^ARCo3hQ~KDfo0<$CWohad+GdMFVHdB_AjtMINgze}au! z>_405{YYmglt;pk3ED1q>3T{11LRQpycM}Z1Z@r3fUWYoKJtla z@=etNm|hM?g63E7X+~WPeC9T0XxDux+5G-kr7>!h7s`1Aek2JWs)OhK4$gvIs^`aIz6rwWIV%^N^ZpD?k37R$V@>6M)g_KzG_u$n-e-7dRvy1Vr&{C7yNXfRfd9LH6Ct5^Q} zBClj0By1t_>Q8iEq%cn~g|ijcrrgp}gapWs>zCh(VBfepCfm4iB-&6W{$0H3Vymy# zmqDcp{b%1mLdSjclvmt-xmpKgc1!0Mbea+O&oKKUw=myBdKq6~kZias?#&_cch;ljSGq?iD!_ ze3PK8y;4b6ex;$r?Opk5_8REJPj5>xqq1eE?&3-tN}U?Rs*Ec-n4{_M7u> zCAiCpJ5w0YryF!RQ>2IywV_*0D2lnE;KRS)Th`Jc9rF=@J1RQY9Hfu_Qurh58YBZ3l zD_X*xVC4kkUP@$urt!bQ83{j&LSY&!Uh97HM&&0Pp|)NgZ=H2E=}3Pk0f4-JHs})W dYE(+<8uZ|3KdN-Cs#^Nq)78hN+Ua!K{{aaea$x`f diff --git a/windows/access-protection/hello-for-business/images/dc-chart5.png b/windows/access-protection/hello-for-business/images/dc-chart5.png index 19d10509165061d015ec6a57172ce59689ae611a..5671c2ecf7c99077c8583d57a8de866366b1a14f 100644 GIT binary patch literal 10982 zcmeHtcT|&E_bygO5NseyRS}RHREi+QmO(&@AVo?L=>nnmIwCL3lLd$RXF&))la&)MfZ)YepCVd7+B zU|?WTy?#xHfnl#d@cr3uJAwaSNb6C7KReuXRIV@-yyu<;8oO;SYg}evD2is@Hs1rZ z_c>p`?Z&{s6HfoPBYJw-ih)7IPxad6Ti%fQl(W%8zgHHl!tXN(-x{6R4q?~<9k<4g zp3^Ye1ufT_YzT!(RSYz|*!i@Zd3V;EdVQOVy9y-6KT6Tmv$j58`g6-SoTXZ*y9<#oc|2!tK__0;0m707?v-O@9>;K&Hokw{VI%b z3FD}u?Y`?v+mJB=dhtGz>r3;MJfQl}|Ay+|lqF}cLPB82I8}HKF+Mv^T{y_&QdwOc zbiwV(vh!lJt0AN3Hi?xkw;Wa@%w#Ng2IUx0>;Sa;nGSemwf4QiUiG$AGeN+FxqHw0 zARjai@X9n9hA0d#ehdZ7yL8k~_h7jz9SW-f;8%r*&SexPPV{vRr`+RtDS;V=zAA>3LFKyl~DqtMbutT%^o`EOJ9){Gk-ompKQ8gO>3$xs%4 zp^8Tj`w6n(mXRY5^10ctGT_@XfEI@x25!|sA_jkK2S7ohhueu}3tO{>@v9zHT~5Kw z2L!KaoSO(j323>H?rfX*Tq$9WfZF&1qJrnm z4Yms7LXbn5XWD=W2qvoDgJu*b9D+wcoQHb+?HuzY!Qc$i#I5i}s{*xYmz3%mj-yx! zz8mIeOw&jO4d+wm>5)+$Zi;WzXN`a+BgN>>PO=f3-`^u(z#1WJlGevm34g7%2X&(kbAmY*>-k;AT_%eKtEG>mJ>#5$ppsCdmiX~%B(F3Je5(6|{-kK@Smx+;K;ssS(fYl8BG#335a zrdkOjXASNt9t^|h+=?}?Y#C;b_-JHqcE^9Bh!RtOI?{$l{li{H`2qj-9w60&P45^` zeuT07ZCt!&<$bM{>({m_q@$k-S2ty(KUk~s=W$GRzExY;>k^3^Le?LvDxR8xUXtbM zdRU#!2$<4;*t6`w53y{Uba#it9i955gYdLgy$ZWH;aWQh`7NY;-}6NwV?)9l^H6<44u`Khz6!&8+8#Tqb&oE!8UFa$k(Z4_8+q*wh zC{@W+Wg*%->a|u92*$I}ED>{g#tbtaSUKw0Nk!JbgX1QY%l_iJ)c1B;5fJ&xvrs*t zzx6W4QTK@zoqWQo2G@JZ4-X3TCogYS2}((! z>Te|F$M)2ic*e-qD)epd$i(l>J?Vkj65W3<9#?16q3=Xna$>zJNFe2>7<*uwj|1 zYT(N=Bl~-+77L-o=_b>NbKNyJng?(`b5CZ6IG>jcyhlIvfswXb-d)`6DQR0@!7B+i zy?NS7oC-w_wH3Ge3fBotD#WWgg3bw@Rc8U^nyTb2ha&ixvnrkRs9821AY8^8ddZYf zeRw9BdUkI$kf=?6q%^MiO=7O~>oMnXh>QyEuF@Mk@e>CcU?c zTQx)sCxbs*@q*u(x6LYLUFR16s*i^j|a`gkLFfXT&7AO5Smt)>?;))J#kj-c@+r``O z(T|+YdVI7Wm~*VT7CGgkCG@8^3x~6FGPP4U%hXxKd9gD{n)*M zI1aPd$CGQkI;shG@tnBaJqSLE;=>kE&5HBBG&J>8P7TC_WkC%AEKx68NI7FZ9>(g= zgT$#Zv8Ixq?<2L6D94xN+ty_UlHqnwc_J>s&MUw#~o3A#T6t-1H2g;qDMeV4yqfjk2ji zOizbXSzlWdxMI!VrFCFkYBFuN?D!&x-1LMEdq+B{%2t5Je^zR#;@WhSNV|u|#R zspv;3?(<&!S|sO zht*#sG)feN={XG}cdB9M$S7J)$1B-(-kN?!?Aw7kpPA$KRt6BkxDUW~;gQ~ZgV+(1 z2(T>fG1B-+=eu_|?A~6HDL@p}{*GbMw}^HU+!BKnh+20*CN_>5-2>Q?FQ#E}`0exz zB&?CLtqXwS(c3mTv|Oh*&jZ6A{p4e>a zKH52u2zR5su+VltuP>J$d=p$;ohcHQbU{>Hyp?{DR zVI5{RaQmjYUUd@}V{($aj2{FPUqR)l=DvBTlpoYc4%rOY2d;2?Q3yd*GDoVV_!>Ya zNHm<|sL~co9GOxm50C3>^XMInEItpar7SO$cQN)YbsQ17Ppp8T>Y9&5olT9F*4`)( zqjlS7g~7{SE`lUbRlE8iDrJ4J^01eT-`d2er@H>I7y!vtBy2$aVilA)DRA%hmAiY2AW<$h z<4;Yi~c>AtqIoC6iDsc5#XjU+>m>gfW|sZX=U)oqfBv`s}gQlZI% zgpBP$vlTpg&&KMV11x<3fmvML8Hup?II@SdtAZ(Ix^>+A=$F%E+Z;&ZlP0 zg+qCRm;v>i63Efu7`u8i#)u#wqEnX_o@-+Uu^!dw+un|C*X)BSXW9LE9e8VoQYje- zf_jWmABUW9JisWav=yAnMz)_kEU0<*g45GM!t}d6UY?y|(2?!%C?Dp@j;m`Yo7T^N zq`xRJufT+WZK0yb&0EvTo&81>LUd4b(>Aq;?8r9Id5M&MTb2yq4DN1AMRSAx>M*Mf z+}gx*`A={(BHj+-iX;|j4x#U@t5;laN!|u6^Xc@jh9j%;`~!|tyN0%cNRF(stx6ph z)V~^p3+@u9n%14#m00B`)~`I4Z)d_41u5~+?rnPqs0OwaydQiqZdJ3Y$KiEnp_rGZ za-|ZVP>(SP)shFOr;0WmA?S!!Y!|x_faDUSW zyWS<&8#;%1h@zpZhC3Hq1gj{%%K{ID6H{|D!r((4wBn9v+=w#SZOrIJ4dgvLR$}wR z<5Zt>uv53DkD~d~=rHzz37cL|I@2^&Y1wyM3$;7y5ZNvwPpu6g5Rsbat-3xU+?ZD!LgwIX0GlR^)pdCTX zdc$JU=scHNBO>YS*5ZQ%HTF)xrw*8Q9ar8QrNK1cIt5CCyG)k za3Hg^!b`JgXmk8j`w``uES?gZ0fXx zROxZz9{kkvE(3kWhZX^jVjThGYZw-2L?;;b=$BiF|Jfb-;2rlA?nX{AlwoSAO^{09~9e=_% z5|CP2A-2*PagECu*v2QYVN*@m+c@fX7R19BGmu=B+{;~s96AMJQ7ye38gV0Pwog6axV_G4^?N3zA?^GetxYi|mR0?*h(nwoZ-Gw*2ap_`>6el$SSE{ccWvEIKLRm%|7;%B54B<-2tE zCrwT@W8IoFGE_^gtKWGjH$xOtjob9G(qJw=`Od(zqBZ(&@eEBZLF zt}5$~RH}=Vz-IDT-JW&`6j=vt&RAJpM9}>E0_2lO+G}L3EEORFZW->((U?5ioB{w5 z&2nZySJr#>?k+WAHwy&S9~`6T5dxQxd1k4F9m{|LkGnKElL6OYg!~5gecQg@2B}9t zVQ48q%-&B1fh$P91~bHx%FE@u%L6g(m1~=k<}YP1X0pWRcrs#?Ld4A?nht;|Em^}8 zq@|g)57Bk*6fuXqgIwChSf&~i{>2N;qRYdg7*J&_&) zCQbLwIP)wlx|K>RlTieOP1=(_%`>eH4}Rf#WuqwaUuQ30qD@f*9Zh87mZOZV0<@D{I^EoWzc zn3liTm>U6=W0mRr;LO)=ulZRK+BHV6g0AGkPn1L|{$0twiu8bu$qnT-5~&@;$1CKO z4ZxOqjZ2db8wb{3JQw6cN;1C1mMrsU-3QV~$5zxe(p~9?O??{#_dmIX8^vm#` z4Ib4Vb3KAvp$*}uz88hQ0Q4WW50bXC5FcAQ_(t3pTla4?J3NLHPY*g@0SmU6VA|Ph zP)vP=X&~a;ht)4!MKIw6DfXf6`+ z_SPiu7YL+xB_EV7&@b($Eb(#}l+A z_6R84vq)er13*bbiZWyn30d8YmN?aebNQjVUMNsau_*tOamnZJTIYJSp(neeFoKh+SLpWn?uQCCto`D=H&5n<+doOcArvhJ| z7LjZYx_~j08=vWri}BbbYf(hh5^hz(WeT{t^op}wms}$vMFw=`yycpHkDGhJjedGJ zO^tYq6{1;mQ@}4tO&uU~;^7!Yjql~@yvJ1aXL5nwtHv_~1duPMF~73|`4Ry{L$+sv zeqGGojjEM?Lyk5js-)*QIjEB0h4W*nOyg$_Z^Tj>yHc5;Dsyo{TZGI~*67oG5n|DG zl&u-Eiw9+s(y{2;R@R1WmbM5{|4iv)Unsru3#ChZW_;jrX}oo&@6EZm(|$(G-w5$G zKSCKzo(<*6@*A4}tm|4pfT8q5v-(rr z-+AMo#oq)t5I_I5LJU4XBLD;d{rFYv%6G>2XGQsu51pxj1Jpe*?Vr|~zgYTz)w~vD za@p5KGD9%eC_=QFnTkyTtuZ_AVy#_=1ti?$CxP8id2PT3UiAey*WFYP&? z>wc_lP^*y%-H?an<+ADT1P+^i=4Ov7>~@7fTNqop>r+t_OHWx=7P;%e-lWaP4m)HA z3=(t+0uFX1mM)%-S&`w1_Rn@Yr0q8z{F$Vru?z{>WLmT3KyZV86buGcX%JN&hfsAl zG=`Q>__@!tmG^cB3CRvElsV2lFO>C=sx52`n6Ootk?<*)vVTolHe?*3&L%7)c44yf z`3TJ#L@VW7a2~ucLqiq|M~?*ty29>31wNYps|884na>u0!4=d!yt8KMP6{WLd<$M6 zUfP$weYEmGS;F^({Od@PAwRQU7PocgjI*+v`ZK?%$04Hnf)>8}de!?oGm~NJ5a)z4 z|E`G;wf+^gII=S02sfBSCH!dj+6TZOTA zqUZhj-14s`H)JywELqUw%n>z!8Uw0vGYawz>1O5=&_^ui9PC1Vn)7hfur+lk)@l+s zC53FScT)ebm|S3nH`;rSE^=qxom*SWZ!Ih#*JdmdP>$QoOKGxCPxl4dE|3e$DY^o6 zgV6E~$?_~oQA`@8vWsi>s|8!63nO@rN?2f+@0G^H7qbG9oY#uZhKW0Vi`O4%XGsS> z^e)J+*x`b?Xv=iab@R;(E1}kxAJ#v}KJv5@TJ&}FPpiL0Ta}coEuFP3QCzERY2M|( z0q1dPP(HVMwQM&%n9e^wJErzRWzg8^w!S(GMmu7#fO94J!D1g*e zmo6!J13WkR7tMaR!M#bdE5`_hHrzJKr9~~~ge zg_G_t@5-`ZxI^ty5|aW~1kV?QMV@td`%9GX&{1xrqpa<&4k0J@VyK~S@wV{7BY*cJT|)I)D_sXj3*lS`73NE_j(RvX{%?T-grwF2Yfn8 z_)kP7zuS!!|3d{8Zx3kB7EK$1%yTuiZgXcAqLB@01__m179snM9e>Wma1ZK<8_UG%~;Jb=Edk5jY>>FPw6;K z+ZaUvd^(tph;(6UM9<&^6})G{Z!vIL_TT#jCwEWBt&TnwrHd*%Vw8A{9}xe3$A} z`4AN7v2dbq&TK6Eg1#drtj|#R<4N>Dw~M z!njFbb(@{^BxCVezoZmOKRGyvN9gzSvEi8@_rcQwhv%E6XIn2^)M{oAbOyLg;GK(g z*XRK}tyT40P{^PD^XFxUT>CFH#!LQ6kvOjI>}{EJKv5Z>X!*@1tapobWj?B3%2T7D zH&e)t05h^XBu18RLBNG)OHzbU?V8=#M(4DV)Cj0szrUrRx&CYROb2#{Y;*Nvzsk1e z)zKI+F1`NN$Kt5SJ?V`B<-u&LY!qQkqg`OQL^D(Oi`#292Re)K>w~+Id?A}|8GY@&;PomgR5T z%Tew+6#@MqW;O6HD<2-}WDsrii~NAAD@r!H_gwz_RvVuT?TIz<%3P&dsLwt)pQ7w>y{&!J=2c-MC~J tYyEz|lA-e4_uG^Vzy3+iHhGc8ILFIUD;l5gN?)p~f;F!dT)A`qe*v@EYnlK6 literal 3784 zcmcInXH-+!_K#9j7(^68m7*hwKB~e{B_bF=Iv5dYqQd|p1nD(V5EzuEC@3INDawch zbRb9zMGY801StYZs6lE%LJLW5{t2%4KD_n+@ZN{F*ShDPbJpGE{B}9}raL)UNr)+k zfj}S$8*57!5J*TcciAh-AJ-&~s`FpF!dm%ejw0(FB?nq3o+iyPaCtw;o#Igs=5IYB`R>83CPG5O6#rL5=ust zzI2yeDB)xKr460lR>;U#U)^>0?@0&s*895%p5WIGq)T3jujRq_D0>oe3UE}PrZuAu z<@sHFjsG!S@y$x>s9sb~UB#Agt6@rm6ios* z&;8PC@g6!V(aqcOI-2Lkp|1kj-ZB$at9vn?&<^z@F=4tP{;=hI?@zs_*!Qnn_6GZG z_=k=6Ca|2}@mAkXV|I=+)&|}(pIkyUD9h6Ng+Fv-pq*~_*XmrxhCbGJXAk9z&bGrR zmo|DfW`bPP2*6C-%RB^nkAQVVnEB!on%l`cedn3Gle&WFuv}^WJ@LepCS2Uq0UDuF z%5WI!ST0THmYs`tSnqkX>Ch(!M-PgfAd-*@`pC_I(g0jBIjsKGpdQTSx{ z1_9QARsIfm}&ou<6!F(m1=T`Rc~t^H-BO>rat3@MM3i*=~gSp!&67WwKLnb9-ifq`ggpDs1r52we3tZ=4fY zqKwKijOJW8hSLzRof-H5yKj&S8F$OL@Kuv&G_7ua|GM-IT_k3=wJvQ@EZ&Wiz0vp` z5MdHFS9yriK-3>>E$mmGmuO*h#3*loxLY8lHEBjcUN8ZTK=lMc4Fc&T!~YdQLv1jC zOSttXpX!gk_Cqfsb@;s84C__JE?eY`xj2A~>euTQKDdm2_07DvA`(YN;zM%~ss=wpcRP{lVqADIu)7;@H- z?Zk$hIY}aCT)YS+M*@Yx_9`0Ff6s4WE1jDDf&ZRrfIOXN1T@%OA{x;==p2Ld9e+Pz zV~#^R!hNr8@^0q!YGcr~WZwBA+LJgdGhTOGZL#pA&y|5n7!41?5Y>XGz11WtruMUIlv@|))jXAUy*K4bG^x9MdJ$iY=hDGgZ`v0X3T?L58y7{K&2NfC10;-r8?8I5+4Rw?C34KR zoK2Lu8Q}%hTJ3!aL_4HVPwZZfLOt8w$FMCuV!o@TL2{p88|M?f+_f=<=@xg*H24W8 zE;iEQVc~RxV#*?;Fu0QXm<{ekQelaMi*}Y{uZQ0bqpQ8Iq7uQTJS#I)K#6mMI&X>T zP?dJ#%k8AO_!s0SnJF6KZMDn?#^bUGGvSob#WTKU{Qb3 zRtfFgn_OGO{_Mi)2)c3@_Nz#|>(-Qx)UJG@PNYE~l$W+*vBok$G57~IB0hb6O;Z{`H~ zTChsk#g+K1r1yO+w4bhf_U2r6Hm)gZ*s=#~3=FY07T#VVUuZr$&>a_NvQ82omQwN{qXq)?N+=M!<|MMM10-IJE9-zmjFvJ z_#lbWtP6Wf@1r1kh{eU#2CgkOSZWR^=}sreNv8@ji96D$Z(<^1QAmFv`)Rt5ye0n zpxZTn@3uiPa`CI2CwA{S;u)F8Qw~=>rlpd|GE1asEsdF32te(!ScR*N0uT5oRBoSP zr?js{-a(Ro!5_=(>d9RnKK2s2oq6? zlGQ&D)u1QB5LWdYhi;`x*cfVa{u&UVTgenU4U-2H$SCxJH#=P8LE$-g9gPMp|$%)Wvdh*=>~2bM(BsENj5H31) z&hg&=h8Ws|^%C9HnZSkSqi@&fmeG}1{w|MJWFOn>s@S`kT9q7t)n2;$t@RN?<;OE8 zdINDjGBj+4`o@`&i{Xs*V8X=Z!v+3C8u7+x9q0<{#Kg|i$2(`ytQ}#SXviHO?oA2H zORcg&(nrRC!y<{T1l-=gMJ(vZSvZe_2q9nRLv$=Tm*dfe{`5~jk~prnwOR0F?4e95 z15Y2xpb5=cODGBYfUCrxSJ;1>kN;{tc6yP2AD$T!I($bW7x3*XsU)Bi86zb4;)9?| zMLV4f55NcEZdH{zhq5QX)0P3H&Bo_UYHgHVCqGW&zdxG6$qR68jGgg`2I3i7X5cF4 zA8Fi4!!6&-Cb}Z|HCb>q{oXLo2117(t$tCKLg~-pg9hQp22$O<(-9bAPzrE&YjU3E z@H;dU)2M|n0fY$VgrnP1ya9=prS()Rd2Ubs<~y1;=>kr1zw4=^Y>l|Z0>4IrSI$2= z`_?T~n&%Gw?pPFvCh2x*HeM9i#dpw*L9PZr!Gc)G9*>Wgih`ue+sD8^;`aEtA8wUd zOCxwkpK)`@-^`t0jQ%D{j#~v95>JxyH~)m!`46Ypx!IQJ0FiaD0lCLq1lG@8z7ed- zx7ZO_#li*BuPd|0i0B~liBDI(V~9br?N%_UKIV-SV0}baC)eC{T+L6E@YAt-Tz#_!ytQcjWgAbf8f8_lu(bi7ZFz$!_S}?*=R#SaE@gN;27&dJCcXK z?EFN5UOhwui?HPWCgGiQc;@^wD Date: Fri, 20 Oct 2017 18:08:40 +0000 Subject: [PATCH 28/90] Merged PR 3986: Update account info for Surface Hub --- .../surface-hub/change-history-surface-hub.md | 5 +- ...reate-a-device-account-using-office-365.md | 44 ++++----------- ...-deployment-surface-hub-device-accounts.md | 50 ++++++++++-------- devices/surface-hub/images/room-add.png | Bin 0 -> 35811 bytes devices/surface-hub/images/room-equipment.png | Bin 0 -> 54940 bytes 5 files changed, 41 insertions(+), 58 deletions(-) create mode 100644 devices/surface-hub/images/room-add.png create mode 100644 devices/surface-hub/images/room-equipment.png diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index 2515c3e821..c66f87f8a8 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 10/19/2017 +ms.date: 10/20/2017 ms.localizationpriority: medium --- @@ -21,8 +21,11 @@ This topic lists new and updated topics in the [Surface Hub Admin Guide]( surfac New or changed topic | Description | --- | --- [Install apps on your Microsoft Surface Hub](install-apps-on-surface-hub.md) | Updated instructions to use Windows Team device family +[Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated the instructions for Exchange on-premises +[Create a device account using UI](create-a-device-account-using-office-365.md) | Updated the instructions [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | Clarified user sign-in on Surface Hub + ## September 2017 New or changed topic | Description diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md index b6d74e9b2f..47f53254f6 100644 --- a/devices/surface-hub/create-a-device-account-using-office-365.md +++ b/devices/surface-hub/create-a-device-account-using-office-365.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 06/19/2017 +ms.date: 10/20/2017 ms.localizationpriority: medium --- @@ -34,29 +34,17 @@ If you prefer to use a graphical user interface, you can create a device account ![Office 365 admin center.](images/setupdeviceaccto365-02.png) -3. Once you are at the Office 365 Admin Center, navigate to **Users** in the left panel, and then click **Active Users**. +3. In the Office 365 Admin Center, navigate to **Resources** in the left panel, and then click **Rooms & equipment**. - ![office 365 admin center dashboard shwoing active users.](images/setupdeviceaccto365-03.png) + ![Rooms & equipment option in Office 365 admin center](images/room-equipment.png) + +4. Click **Add** to create a new Room account. Enter a display name and email address for the account, and then click **Add**. -4. On the controls above the list of users, click **+** to create a new user. You'll need to enter a **Display name**, **User name**, **Password** and an email address for the recipient of the password. Optionally you can change the password manually, but we recommend that you use the auto-generated option. You also need to assign this account a license that gives the account access to Exchange and Skype for Business services. + ![Create new room account window](images/room-add.png) - ![screen to create a new user account.](images/setupdeviceaccto365-04.png) +5. Select the Room account you just created in the Active Users list. In the right panel, you can see the account properties and several optional actions. Click **Reset password** to change the password, and unselect **Make this user change their password when they first sign in**, because it is not possible to change the password from the Surface Hub sign-in flow. - Click **Create**. - -5. Once the account has been successfully created, click **Close** on the resulting dialog box, and you will see the admin center Active Users list again. - - ![Confirmation screen for creating a new account.](images/setupdeviceaccto365-05.png) - -6. Select the user you just created from the **Active Users** list. You need to disable the Skype for Business license, because you can’t create a Skype Meeting Room with this option. - - ![office 365 admin center showing properties for the new user account. ](images/setupdeviceaccto365-06.png) - - In the right panel you can see the account properties and several optional actions. The process so far has created a regular Skype account for this user, which you need to disable. Click **Edit** for the **Assigned license** section, then click the dropdown arrow next to the license to expand the details. - - ![assign license for Skype for Business online.](images/setupdeviceaccto365-07.png) - - From the list, select **Skype for Business Online (Plan 2)**, and then click **SAVE**. The license may vary depending on your organization (for example, you might have Plan 2, or Plan 3). +6. In the **Assigned license** section, click **Edit**, and then click the dropdown arrow next to the appropriate license to expand the details. Select a user location, and in the list of licenses, toggle on **Skype for Business Online (Plan 2)**, and then click **Save**. The license may vary depending on your organization (for example, you might have Plan 2 or Plan 3). ### Create a mobile device mailbox (ActiveSync) policy from the Exchange Admin Center @@ -70,7 +58,7 @@ If you prefer to use a graphical user interface, you can create a device account 3. To create a Mobile Device Mailbox Policy, click **Mobile** from the left panel and then click **Mobile device mailbox policies**. Surface Hubs require an account with a mobile device mailbox policy that does not require a password, so if you already have an existing policy that matches this requirement, you can apply that policy to the account. Otherwise use the following steps to create a new one to be used only for Surface Hub device accounts. - ![Excahnge admin center - creating a mobile device mailbox policy.](images/setupdeviceaccto365-10.png) + ![Exchange admin center - creating a mobile device mailbox policy.](images/setupdeviceaccto365-10.png) 4. To create a New Surface Hub mobile device mailbox policy, click the **+** button from the controls above the list of policies to add a new policy. For the name, provide a name that will help you distinguish this policy from other device accounts (for example, *SurfaceHubDeviceMobilePolicy*). Make sure the policy does not require a password for the devices assigned to, so make sure **Require a Password** remains unchecked, then click **Save**. @@ -184,21 +172,7 @@ Now that you're connected to the online services, you can finish setting up the ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-23.png) -2. You need to convert the account into to a room mailbox, so run: - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-24.png) - - ``` syntax - Set-Mailbox $strEmail -Type Room - ``` - -3. In order for the device account to be authenticated on a Surface Hub, you need to enable the room mailbox account and set a password, so the account can be used by the device to get meeting information using ActiveSync and log in to Skype for Business. - - ``` syntax - Set-Mailbox $strEmail -RoomMailboxPassword (ConvertTo-SecureString -String "" -AsPlainText -Force) -EnableRoomMailboxAccount $true - ``` - - ![Image showing PowerShell cmdlet.](images/setupdeviceaccto365-25.png) 4. Various Exchange properties can be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section. diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index 41b4b78342..1281d6ae51 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -9,17 +9,17 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 06/19/2017 +ms.date: 10/20/2017 ms.localizationpriority: medium --- # Hybrid deployment (Surface Hub) -A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-prem](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-prem, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) +A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).) -## Exchange on-prem -Use this procedure if you use Exchange on-prem. +## Exchange on-premises +Use this procedure if you use Exchange on-premises. -1. For this procedure, you'll be using AD admin tools to add an email address for your on-prem domain account. This account will be synced to Office 365. +1. For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365. - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.

@@ -36,15 +36,25 @@ Use this procedure if you use Exchange on-prem. ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png) -2. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online. + 3. Enable the remote mailbox. - Open your on-prem Exchange Management Shell with administrator permissions, and run this cmdlet. + Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet. ```ps1 Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room ``` + >[!NOTE] + >If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account. + > + >msExchRemoteRecipientType = 33 + > + >msExchRecipientDisplayType = -2147481850 + > + >msExchRecipientTypeDetails = 8589934592 + +2. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online. 4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365. @@ -71,14 +81,10 @@ Use this procedure if you use Exchange on-prem. $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false ``` - Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not to resource mailboxes. You'll need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox; you may need to re-enable it and set the password again too. + Once you have a compatible policy, then you will need to apply the policy to the device account. ```ps1 - Set-Mailbox 'HUB01@contoso.com' -Type Regular Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id - Set-Mailbox 'HUB01@contoso.com' -Type Room - $credNewAccount = Get-Credential -Message “Please provide the Surface Hub username and password” - Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true ``` 6. Set Exchange properties. @@ -112,7 +118,7 @@ Use this procedure if you use Exchange on-prem. Set-MsolUserLicense -UserPrincipalName 'HUB01@contoso.com' -AddLicenses $strLicense ``` -Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-prem](#skype-for-business-on-prem), or [Skype for Business hybrid](#skype-for-business-hybrid). +Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid). ### Skype for Business Online @@ -177,7 +183,7 @@ The following table lists the Office 365 plans and Skype for Business options. For validation, you should be able to use any Skype for Business client (PC, Android, etc.) to sign in to this account. -### Skype for Business on-prem +### Skype for Business on-premises To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: @@ -191,9 +197,9 @@ If your organization has set up [hybrid connectivity between Skype for Business The Surface Hub requires a Skype account of the type `meetingroom`, while a normal user would use a user type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. -In a hybrid Skype environment, you have to create the user on-prem first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-prem to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet, unfortunately this will not work between the on-prem Skype server and Office 365 - it only works across on-prem Skype pools. +In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet, unfortunately this will not work between the on-preisesm Skype server and Office 365 - it only works across on-premises Skype pools. -To have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. Enable the account on the on-prem Skype server first: +To have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. Enable the account on the on-premises Skype server first: ``` Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName @@ -263,9 +269,9 @@ Use this procedure if you use Exchange online. Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!" ``` -5. Add email address for your on-prem domain account. +5. Add email address for your on-premises domain account. - For this procedure, you'll be using AD admin tools to add an email address for your on-prem domain account. + For this procedure, you'll be using AD admin tools to add an email address for your on-preises domain account. - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**. @@ -308,7 +314,7 @@ Use this procedure if you use Exchange online. Set-MsolUserLicense -UserPrincipalName 'HUB01@contoso.com' -AddLicenses $strLicense ``` -Next, you enable the device account with [Skype for Business Online](#sfb-online), [Skype for Business on-prem](#sfb-onprem), or [Skype for Business hybrid](#sfb-hybrid). +Next, you enable the device account with [Skype for Business Online](#sfb-online), [Skype for Business on-premises](#sfb-onprem), or [Skype for Business hybrid](#sfb-hybrid). ### Skype for Business Online @@ -358,7 +364,7 @@ In order to enable Skype for Business, your environment will need to meet the [p For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account. -### Skype for Business on-prem +### Skype for Business on-premises To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run: @@ -373,9 +379,9 @@ If your organization has set up [hybrid connectivity between Skype for Business The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account. -In a hybrid Skype environment, you have to create the user on-prem first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-prem to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&MSPPError=-2147217396) cmdlet, unfortunately this will not work between the on-prem Skype server and Office 365 - it only works across on-prem Skype pools. +In a hybrid Skype environment, you have to create the user on-premises first, then move the user to the cloud. This means that your user is present in both environments (which makes SIP routing possible). The move from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet which can only be used against user type accounts, not meetingroom type accounts. Because of this, you will not be able to move a Surface Hub account that has a meetingroom type of account. You might think of using the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&MSPPError=-2147217396) cmdlet, unfortunately this will not work between the on-premises Skype server and Office 365 - it only works across on-premises Skype pools. -In order to have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. First follow the Exchange steps - either [online](#exchange-online) or [on-prem](#exchange-on-prem) - and, instead of enabling the user for Skype for Business Online as described, [enable the account](https://technet.microsoft.com/library/gg398711.aspx) on the on-prem Skype server: +In order to have a functional Surface Hub account in a Skype hybrid configuration, create the Skype account as a normal user type account, instead of creating the account as a meetingroom. First follow the Exchange steps - either [online](#exchange-online) or [on-premises](#exchange-on-premises) - and, instead of enabling the user for Skype for Business Online as described, [enable the account](https://technet.microsoft.com/library/gg398711.aspx) on the on-premises Skype server: ``` Enable-CsUser -Identity 'HUB01@contoso.com' -RegistrarPool "registrarpoolfqdn" -SipAddressType UserPrincipalName diff --git a/devices/surface-hub/images/room-add.png b/devices/surface-hub/images/room-add.png new file mode 100644 index 0000000000000000000000000000000000000000..6b0597c41aa7c9641e65eeda2aabe5d15f4bfc9d GIT binary patch literal 35811 zcmXV1bzD>L+omKWHbCjvXeEVFqXt7lQbiF&5Ev!h-GhPD2tgVILBA>`5{k4ix~02B z>5c*K+3)lIu@4MRJm=i^bH{aEcdVhlChbkOn?yuJwAxzgkBEqf4S`Q2B{}eyU^T60 zzz<^2N1AFxW&Io*z!x$*RXtTAqRJ#{yyXqxJC&Q3i6;>eT`S>3d|T*27!gsNpSHTH zk)Qe2Pl_w>eTVIcP)}SerozL!~r(nLA$}tYNHo@*xnGVmo-IBmJb-W$dHd zr>hgAKi@N@1{A-Fgd-qed$!5foRnlF;R4C>%kffbq_n{A^bpt}@IMx)6&(yrNv09w zUKF0*vzjFUe37{=BNv|jfM3d?&SHv)vhuf*u1xk9hX{4j@aB?Mff2-rX))uv8|s<>EB_sLNNBHSa0B&vav4?Mt1*=zjUJjzzg}(3gww=4YKB=s!4SIy*btB4g^H zT5xg~oa@owu`0hkt4v9o*SdL%CN-0`?Ecf!a{@oMzkkxrmg#H#R$H4rJ3cPx+OQY> z*{uFiUdXvarnF;v!};G&RY7MSCf{DYNfwOW#YM#k>b`yH5IOW0o7PuKjZMggb#dG9 zaLzQaxQ+8t?~jj-NgobFcF;(2@8~_RSHz*MPuoV?Af(wrDVhctW+rhdnvKB5Pm5=} z`<8)z3n94nE&uysmRd>YB%_#G>Y0rO`t+*flapzsnGh8)i#W>@lJ~rW@(m*-g6P}A zPoH5Tg-&LDE#%Mt6xm#C)n680q$>;<@v;H@aD{t{6ti z;L}A+UvHk$G+cafctye#!fh_rJv=$-;19`9qo1~5uvo3at5Qq?Ge8WKl$3n>dSWhC-ZNS5@%-K1t~vA<8@*FNm$Rug&=bBH z%P2S{Z3E?UfMx_ND*LzT)w=~=LZ)pNcN}hzEZ-=qxoMzTNIKZ^2f}h#^|hZJ;KnlVKbXQ&NJ2dq+KK4p?inV&k|aYHIyHz?{49e6&&&wY zxr7og7*nr&WIIi!pp0)I*$-#;2;BNME~2#ZhzrG71E&=iU-VNh6Af&5ual8Qi`5J= ze~n(Ysrbe8d_wvpX5j0>WHR&LB)lP}%sGV%l`#De3T822xlOQ+cEtvYrf7o&JLNO& zEV!N*Se6rVzVVyY_4|eZZ=Ya(&~PjLKo?G$4bDO?cL$Ok$O7l}NRnS;k;2sh4z|kN zbQfHr@fb#E{hb`t7grk;W#wNbg4a<(LTxs(0&<%I?L+g}==7wkn+!yg-vLqif?cj1EMp_G&fX@OvAPQUZR4UgRxik^?9d9U`b4pgomyEN=+ z@IHZ`oJT0W%xQ;`3hM6P=)%fIcYtqO;w-Xgc6n83oJ-pcu=`x^ng4g&pEAgkIS%F)oxK)uKh0wg1 zSyvY1zCP`=S?kU87<*#eMJqe=k~1n%JBSiPr-g}dy61JbRSp~10(!)wn9C|#j3^~M z{m%D)Vv~S>$y;=~*69Uhx& z{rYC13D@ghC?+55{zx4?4tVc5Sev+8voSe}Mx3I<<`HJQLqqH_KLv+dSi?c?4oudY zv=Ewv&-LiOlTNX(`?J)BXa%{wp5vLw;XV4$qfdJLtw7IAHE1OHpfvQnl<9h}lUtU7 zZ%6s>%i_Hm&jAxtT%>vzsfX`;u&+FRw=F@}pBP@43hFk^%}2caTvU@KMe|3*OMngT z;shtlCGJZtJTh)Ne?mwkD^1rIP0r5}(r+vdZ79;Yz(MUg6w7R(@JG^?3mB-PK4D+g-`@(&nye(F=;f zQDG$ISyhc_7Gp!_{MRS-DTpdP^3S7Y2Jy)|?a{g`$*z>+R3rI1S&FebA&{2qqo%72 z4)=EY<5oVp;)a8Mg`O_Kd?ycy{Ig!W&;7AIU*(P`tnXV)q|5$IP_%sfbcLK`nO2Wp zh%%Y&`k7(?zGS37N;Q$tHY&P{Aer1%itB9>{ga)Wjd7JB~*3uSO|%lQp@Lf9y0) z&-9*IBH2c7pfu~dKxb-nD{cLx_#uX_>*@I`A9k^({chp(d8OkCBydv|-rK`yFNiwK zaeJ%j`l=?TBUtc#@bRSP@sy)DuVT0MivwMVQmbnB>0R#RzLZGr0yD%y>JgJCwi zhh5AA-aVqV)u$`j_>?*KPENZs&FR(ms`5i0Vz2*MTu<#+oXiD255eBA_uq5-dGz~v zw%(kd%v;+jHHZWgHv68n#$%)(j2|Y-rpShMeBcGHW`K98T#l%8F&ZdZ1}aj0g)Z_T zG!GY5INAEPPnVNq)xHB)Ns!YVeh9tUP1%wIEY<@EuWZ_gyST!j_59GrD^k9qqt`k zR(ywaipO7h1&dsn-3h6ElWS+7RIu??I704ZKD6nl$cLn)pcP)3zYFz-uDae5C&4W@ zn4c+!ocx%dJn%@EHr|dzkS^2fITn;953&By#S(23wuh`Uh@JKZLxDByzpaE@U@|_9 zJP3I;*Kl;u)mi@aeuo23Hu?m3I7-#%_=ea0u`cqd5Fml061h zDOl?tiDPdc5!E9b>inP1l+xWHRoC-RzHGWaxt7^F(6KmA5!HC8zxJc)`f?}RiIS=B zjr>xEc|eyrLjw&?n6JBsOz+lkl)e9CvVqg^doFj^KQ#=L@iJ8nN9@utujr4xFA9SP z_n=fv@q_>cdGRIc`tRzt7WLv_Dio{u-V*m(9)kt{}$SgMWcm&_p9L;nJnFCuwD-}Xb%f3@w&2^o z)yrF9+yh}S{~>7PnaOZx{;6eayx>SR`GZaY9yTgkZaoZi_I-x=tK7suW%Z)RU^`@Z z^G*nIj&0){{=I zPHTxQ0h8=Opyi+HJ=e2T$l4D{{O@11MH@Xkw0sL{d5FQ@V}tNfhO5PcxzUk|Ghnbg z3mfufLo<%|EaLF(_5I}^ORt4j1Xa#r={e63OdD2;J6L7!^_5PYSjB|_o$x@g;Oern z`;fh42OoG>@id%K&H${+-x_b z#Y6OPAfE67GslQDs3@L_!cy`Lu@<+X!Ktbbx@`+h>|X(H-_20^9JgdQi z*t1-|d6B@m*(fid8x@<(>W+Jfi@C&BQ!E9%@P|LxtHRATHoZ)l;JAy6`RkB>3#XPy zqK#9B1q{<_oDoe%y@tS)$P|x@6OhBGpN@ZIuC~rUI4G2qq(Z)M2kj%s(G+(o-y+Ro zURz3g#%_K@{n6+2OecDL6MW0R8PryD&)j|t!KhBRFC^?AMmZVMev8;2#h-upQJmXW zYGvNJcGjs_HA~TP4Hg@xE9h0ihu!;RaoJsMv^1!UUsa#{sbu)u^uv=Apt?bfeA@N$ z;T8zFI>@i}mw<6c4_V(R^H*K)GTkTNKs>`U%`>}DQY6dQm65C8ATDSrw7i#(;}8-a zz1|nUwlclrnT)e>kF{V?)xd%SHK1bEQp1{bWWC+eY}``Xwa2IQaKzLf0j?XoE?vLnzAIJ4 z9m1)|=5A^QctjQ~B6)gq3-u&UVtt}~G$}d;{V6f-qNPlKj1phfvTGiB^8z89&daNs zCx)y-nnJ=WiYCYJFR>c2GDox@cGX?zhhqpfIyFx`2MdZJBk^2pe)V>#6mR5s4yTHE&VSkO>1s5|oahGpH3yAZVp zvA60R4&;JzOOn7rUW}jbl?Kf?9?O%HShIRl!SwFdIpA5~)J@WMi$r~0sw^~|?XeMb zrqt*?eQkk*SZLAn#HDuq|d^7o;BO*s@#c4D0EjXyY=Z})n8pc#h}N2ov(i0VF) zBYM@r`6jzc_s)h#g34m-y62bTsC-7~S!6?4D$f;`1!=wC`)wXc=O5MJ#+V^thCCkS zU0Lid>k4If&={iwpCD3c<&CTI9r*4yT;H--J|yRWfu zrvGCW!lPF$|Aa%hVkAfR7i96P}Sd?X^TOcn4 zMYz{^Frv!%VT|Y_rxDAtH-%185b-?U7}iMc@#3DH7U-*P691(nD!!=zQASF#x%lr* zQ50BgDu)bN=M{oUnWz}!^M`Lbp4dxwT(VOBG$KE0{|>m(yFKLo+Ray5mKC5-&Eb0N4F}bib>Taus0q4otD^Ap-S3%RSiMfoAAHK=E4kHg zUpH$Mt=(Vn{EVK@Q9b+k$<)@fJR4EK6#aw~`UY0H5Un_As$NRsB1?@bjH+5Cmu%|` z=LU08r0r(EIu;M0Am`m^Z~vIsNgaMTk+Nz-!?%0>pG-Jnp$`WSH_A3`&JPX&gNw=c z{3pC-G-%kM>hbK72YSoQ7D1Jln@L4erAH?MnqQhw*4#R6U&C*xAcaU#^7vwrJ zy26i&e2T*|KZ;bRmwa^UMMU;mktVxtlINEyGY6_={SJ#qxdD8vfTMv@D6WT7?<^eg z@}Rlm)9x6;5w#apDBiv<{HFkZ^*z3_wmT9x(Lt7}T3k1z0oBuIwkpK9@oE=M5usE^ z@rl{~W+$ZIme5p;0=h~g736=}*fhVW27o`fMsrieP&k}xD~qflUV(*>ejy3%CBfGT zXIdj4$vq&3Yvv}^@63$awbnfVG;%HO`)9I`r&n4{Yerm+OkJ5+Fg=@4+io%zMzHe2sNJ643qT`-Bt#tL z{Nc}FOQa6=1)CJBjgG~ADIAMXN!0EqNR7JtBL<8A)Ja!&=eVzSF(u*q7Za& z19-BAp+nzAC_H+q?(8YtlvmwY82_C{G6$VZ9jiKc`n9=@gwgX2*vosyn-weIjUPmv zy-yAGX{6Q1{c8TbU(xrZf!A|=u%aX z>|oB-((Q|}S@Y}PS+O;@^;h2?go`M@jc%BB`O!DL(8vh9WlC6N??!3@OIm8p%csHlgbL869hkZ}aWklI`2?t1Z4y#jk@k;4Lia{#XMIOvnjrtK>30vS1m zu`^=j4?Y!xlGWY?ah+n3bd{bO{!|jzu_`t<-vN=U@7+dUl6@K&G#w}Q^YD@UMsaF1 zoszy|PFVu{%te>9UW%V+2pNBxteM#J1AyV2FBr0q&vKPkHm2;pap(e1Hj3%69Ch&SgL8zWJ3q_wAISOQw-MZRZi*$CV%tm2dMo+ed88QYk=>K zcmFHt4h0bT3wu*i8%qj?DBaA*`10#>@e8M2OAM!NG5UAs>+g(Zpe@-NOFN=C4XogN z#Jpqq&z1S>%lW>fhQfPac|iVFyPx<40TBN$^Znjj8GsI-I6GEA`YO|V4Bcm@)f2}i_Iy~S11JLx>>1FU zOx|)Vs8^M7K$v0~DZ(Y%fmSnA+(79lZFYHzIdxD2DvQJJCPdVsJM~jJ&LAo?2lB=+ z6jR;lOOEN!T04YZfc`GE=8<7i9k9{@F3C7%ajx6ns7b8t2cW!oe9D*$?4ed-8v-I} zaa)txiD|5uHYe?Dj3E%tTIDH6nY}9Bu&bt%bVDrqZ@VDK{u98XNU-6As1nZWZqtI7 z0sstiwN&NuBRwY@muFI)3GUt4|H!=JR{Rrx%7Gtvr49PzBTOS z%)C#hCk3XAXOetySC8IaX(@7n2z}$DYPx+^lG5>8PUQ$%_o`;HS9>xcSo0!?IF<+9 zr};-;>BvZ-g-ZpdC+JiH9&Tp`!a`AaJVW0Huuz*FW$Hy^MI;jr%+9d9OV@u2pbG2G zp(O*D?}~z>uV{xZsi+~ZXo_Qk=zOnmn#w#PU^n(fD~SH@FOgP8RJWG?BNslfe>)SY&iaTHmr|&> zf-~fBPIDldq1&b>_fTI(8z!$yLJeZxT3UpM`A&l8l}aKXgTOh z*n{Xl4v6nq(KfHA(^Md;uiXZC(}OJ40^oS-myu4^4@e_O!5qcp^{Nr4MN03UsHM!< zP0%J=UAX0JT2g{qmVEY)F6fp{y=fMKbQ9e{E;x8Nm{+VQUwg^52rf_RmCDr;0!9?tA>^TTWs9y0H zkn_QA8%TC*zgKD?ZA4$8FM88HKPc()+qiiu0LhFm0f9I5SkH$ko&fM(EO1N-BfT3_ z+bg(enIxM2e=&m<-Rtegz;&_(y6mKPt(9+)sQ*Ll#gtn&0x7B5e{d&gUBLr@Y9{}} z=Uvw0G6}rd)&+j#xu#`Ln6=_0Ivo9mrG!2ZbDf+RzayZTI;4o0Td^E~_%B{#E^=eakYakm?^*aPIy@T=Zf3dy3ze!YjRtCW#@2ECZUt<@$-v}qD=O&%K zp>KK+p_^-@q!_5hc`A)tBzQu};4TkC3(Ifh>!2RWgEHTrJ&Bb_($$qS02iObCAT3Z z+Esu8OqYFiR3PMMdzT)EVuT`%X90cQ{n@ay}mpB0-ajI094U@Q&kM?>qYTF4@%6 z&CcFTDQCJvpgc<^P>Z6I1^P0C=pG4CVmOx0e>L}$%|Ce@>!?DEdcemPYG*>>N!QPpu#K!D!);MBA$Vkqul^bo}j15k@%!1 z#WKWU|1}n{QS&njJbA6O6oqL9;@{#MWAo%4fJZp?)`J-|8_2OvkxGVX)ekiW^2s*e-f9_K0+CuuSZ9+AjU_hcqtFqK&85K=C3x#}Z%{}Y1 zS)nWe!;nP(>&ufK0yO!RnvMgXA5 zU~3Y(x)ynIL`gq%Ch}|80ge6BJM7XVN4?>Bd0ar!Rpt%7s0|gyaEH_>?lzN_XunIC z1Gv}Y4Ujk`svGlnZ6M#Z%`^H4E6Uf+T6C(~>?Do&%FpFWpEz1%l~WBk1%$Sagln-{ z?lktHa85W0`GA{kC1!esEbBLU7hf^OP^D|yfeLh>N4&{wyKb4T9zgq@{6G_F*9ZC6 zW-dREo}MLLpMoBL3*C#ezyVd66Dn}yeMWbA=%wS?GWWGmhM7lf7cy>jOSKS5PzoJ2 z%T5_K0#zW_RHkUFblHyCt&i zg0IwmJLZEBAdp}au4|V5*I)25(@xeh6Tv65&O!uEh|VT!M_9E{m)HpiOB&rlTZ|0R z618&yj_msiCaFH6l0aFOEk0a~6S|#nu=#bM#-X)5LY%?Y%bqi#ulAu+nlmQmsMlq@>P8+q{(f#q2J1 zs`~H^zWTGZ?A6El=V_v14_R<2W5+7j2Pzq!14`qgPSF>=?&mcm)h1=caXP08;fWeI z0N1V+F#Nj!rFk&1(v_NEu^?zX^_#gZkHYkew@2RtIcjC@^Fd5B4Cyq$XZh@mC$(<9 zFWWBjIFRO`(uB%7kYR7|Zt#7sFDZ`0b|fsaiw|q%l?P@w4gq68`ZRYVrm_4oc#`~P zVImtEF8}k5QX4>5BV+uRV^m1vKIxIJ6%Lj!FJO%#-$zmI9F&0hv+kJk9~7ZmKv?%y z_XKu^UwW#!hL_e}#ckL*VNpQfH5W#m1DhpxqX;6~k;`{eVq0gN0NVyWHQwBY-S&0(eNQV^{@ryac z^K!9Eor7F{Ga5sK;oW2{5d3O}MLN)4KkbMA6JghvA|q7pd*m8Fg}i#h#a?_jN>tdE zdwlbSsuLM4qmUErHF zTi#ToKPz)NaXO4`8s^to%E%DlF$y%!GiC&}ksXcRw}2n}O0)ifep z>`wEOvZ$(WDMu`2xjSt4krxQ66aoF2kok3bdw3b7w$3^xrh;WKenrUbX z)nXvzd#biMW&GA~%(Q(*$Zr<4Y#+K!%}#6t@^X6E!S2LqXYs|| z`JzoocO5tXG6<33UVmp_zy!JB?zyC2O_FvGdFj7J|4On{e4Zl_w!2aIGt@*%lp>A# ze%GxDnK!AuFNbhaaZbFCsIAfoJ9Pcrvv`fJ{^;tjJOAH*klrt zH);vhNC1lur3ENwx$DkB*iL+%Z7kEqyl*EW-u_caT5jlnk#6|tJW%_Ywh-4CWlm{g%Dv2?oxL2LN{cE7;Bkg#XleeipoJpjFEt4?+2oy|VI{I!ol z{xO8kC9!E)C$~4w1AS{g>>B73?+WJmz3YlZQ;?s(fB#eTOwpsB@5L-*@%t}hu%{>^ zDO<2T@TSsm!N`a1U0CBnCa}Z*u9xa;eP#T9d6$*&KDf>#t2-T0QF@%!?AF zOgnqj7>_CGcDn`?Ij}y@?zB6|{L4Sa3{i$}eE73_Cd}+)@>4&yqY#fj4B;6>2~ z1qxG;eIyHx?({C4Tyiy)9elSfNS%=`Vc4MjWWcMyod;uZyXei5t&oLLmWZRt{^ZJ^ z;P=j=9RGQ!l{nr$(BlGpqr#_`Hmo%W3n#(#7bO!jy@u!tKG{B#CZkqW%bURR zLE6y7*#AULKjx@Dd)Pzfu9kIcKtAQx_+8u2JivybFUUI9_%B>WPenhBkCMt`E3;*7 z3TLfHq%IHGF$d3! z?6VLj*lPwMajyD&OUX&s6c@<^~&NBZTTpjqxYRFQ#&+PeWAP&#UK9eHW2WuG4c+842V z@W{yI{mpx8MjQ+#h<&R`*VR-M11fbM@cdu7HR1CHyukyr5K(HQPVY$|n&3%8JfbA} zNE56k5)Q{8l{(@-jcTS{6nK?mz=#iML0*SeKBRux7=(j;(?mVO2>M)R1!O;imKhHd zwlFfKzT0H5Toti{N>qG$X;RH&(R}bLcz?y8tev0x^xn6@krAnCqUgO};xi4m(nU;o z0E*y)i3)Jvpzx4^a{kM>oPO&Bt7jx%Y*A&Cih$hd;fr*SBC6M4%Veq0f6h*J z^O&`m$SSj$U>=Pee*q-~0kOeF!$aVvpN2z#GRYaN3m%)P^ z6Tkb3+#}}S6u0{e_AeMy527o5r{V;TyF{6JfIiK?%`Lwnnc}2~XDDnax{KKz`>UEX z+Oaj2spH!ya1Ui-mBCW(kWuJ}-m3*rteQGO6kD%}*D4xP11BDy zu_&YS#9pu8z%sYO>6en&`-U-_L@N7jAQH$UK`VS+C&!&tf%!ZD2a>oVG9C=w=mZ4A z`JDD-;c!jZYfEH`7N7yAPz!&C3j;aVhy49mx?*v)YOx{?2m`k26qZg6Gu=>hwTvu? ze-{9DU{@;TA5L^KveKb6KqGcL5II)KX8LXKAz%wBl3r zp@)RBTxNS`<%Vi~Iu+~Q#W5fkvmj`_{09Q(tg}9VzF7KF(#RJ7dLXZ|-T)UpKCc5^G%Lu`~BHA^}mZi zU7ZGm&)-@dlWZvw1rVittak#IR7382V!XLW7k^bJS0K)N{Ds{jM0K+?KV&MgAyUz# zIN*5F&ZZ-tRU^W_s`rPQJq34A#SBox?*Ev-?AQ0J>sK z_&C4L0Ismp@YO8z@@RipN4#q}Nkz5yIP%dTZAmH#Lc(Sf8RrMyLZfa6U{d*L&A|7v^Zsz3SwEMzKJDw=#p z|J4#%DX{Y1)c<_df4-J=Prt5tjJRo8aC-nBoT&UBd z^3d7icOI=urgzl;#VOdQVYwUt$YHpnPw@`lH9%4rC?8iQv1+TeujE^w62$f+G4gq! zcg2z*g-r?e?#C_m`MpUz<(UrvfWuWU{w6iT49v9R2V{>fKr83YYY0<|i4GK*Kxly{ zp%@OU&UxZ~a1_cUNA&>cHyQ;%N{3j7?^vFF$ipR1?qM{_u0O}2y=#ea#kYgiZesEs zm}{kTn#_ufX6Oa4hJuE|uOz(MJM7&vKC$uMqVrMGGX(&y&RPp^M6vREI7*%fL#PyG>WyrIY_JN@PiAYxb#%T1 z#i`HC19Z+N$1p)QnhFa3gVe~eM}r}zf}Xi`P!!5a3U9|2=Kt{N?=uc6?v@`LCD~3_ zx4vXp@D$XmE#*`X1PL8{Bw`SlU&&BRCST!bI{`A6xo1JyA~EHSK3WFUB1IoPgBm-! zy$-Zk2_~JC45iA1)8FIsZMDXMD%~Xx0QuibG{w-qr*I5--}(=23rV%wn#qtPRBkC% zbH6i3P(9J|6;Z*j{ye4U{eWW?ZauJXUx`yJ+LJVn(={hrNe+6GtJUoq0^TyN^Lge35mr@T$a#gSlzskc3~e03S6G9*gC4y))PKG zQXI6>*Rx<5^H>z1tKtnRetWdjYqEq7ufI@zMfOh`?OWA?xXYI(b9xW|#YR!Nc+IkM z2m&>xnX)iVw6KoBaG&H%gw6AQ?%AziX|NqWIV+^mOTtGNTj$>NiZqt&|2l;%h@;YlV7&83Gv;3r|z5bUsS-7QqZ~beh|<2E;OYA|g}RJ>O+x73ZKN$N41X6S{V6=ro<26;Tt;dL z0INx?Z{z)?Swi2>N))qDYPAJDPnY>v7`O z!Cs@6ML_ZX3G>nH;2#eqV~N1Md?Z@ye;6Rq68g%JX7Zq~nlC3>U`mJpg>yfAHA{d? z_GoGzsud@^yFBBY_uY-=-#D9nMzV@v(l(6gvAL( z+nu3X!m6*pf;EhvFUF!$UaFy~sMz?`^7uoZ-WmSS9crLeW%TGdEjn9Zz;=$3a7N{z zM0nQk54&v`lWhv11}bN>c{4XY?uxDp7<SkrrBcE?_xCe%;`l{OBrB1(>Yb}}e*9`zfAFipN|3(^xUB{MTx z5)qDNqIeR`P&!=PEv&6$fWf|Y_@tTxJUUGgl!QM9G!4~jG;XiqpW#q{&1CAjbIbi^ z6gPQ3QSa{p z;|wEX*EcFST9U}39#8s^kA>vR0De&e~bCEVqL4HAy&x_MRab>{jJO#bD_i22=%j3@qCIkGR8HPGsKKTX|63_XXnZ(gu_&b%|7t?50o_Bc+f>~#j`Y~ zG1IuRC;!<_-?MqQ>D_KA8QkGgVRJi}z++6PkC46g>58DA;%^I3rrN{^d-ig+xyIaT z8<#o(nyks-+F8`(@cWXVl3qJoI~kAoS0iq{H@o|1P)RtFG`K5G)kB!j5yJp9R+*GW z-rRrn&2hbD^+RQGn#?5)+6eQ{eJOF~pLY83#o73k zgKMgXOexz&0qXg4qhET%1g^F+F?tO_-2O+EwZ?k)fKfN7vU7m^m#wQ^s6{^Q_;i{O zRc%0l#kbK0+GY92X^X+;RP}Ol5a%yjNC%_Hy8oFOV5;`?Q<=s$F95ow&u~_D9Qlq* z*||v1wmX(4f3iBzjIkfjNT%e%wafjYc$#SoHx1qrrp4P^SIauJE_KXLVY~O_wvDOV zW*y0kGx{&S8;Z{krHqLDeXn4;-%0&}bShySz9bIs^1 zJUOyvS=?fZW(&tIcA}^&O}Uf6fvB4!A6dK%k*0jCDw?M zHd>~wW}dojQ>s+|KX99^%px#q+_Cxy(GcLS^;JK84sE*{|MYu!a`?I3RCGYJ#81(o zGNO}Nqqfrc2EBkHifxRUud5JjTI1E58}Y?o#!|kU>XeSjA-YjrT(*`k8 z6wh($$^Eh@JnViPlZhr&guJ$=#b=9`Gr!IY-n!3@_wqy4Y3Rz`?OJ8PxVfZij-wS_ z;6I!H@aUz$Ohfak@BGa^Fa2VPXJw4Om|MKZRsOVeU3nlUuv*j!G@!JSLgzB2ZfXn9 z!5k^R(UcTD6 zsP-*q&qz(bkM~kEn7%X#+9Q(Azy|u$7h3`5(g*u6O-N;id z*IICqM3DPyp%UrZq@(?2Iy>Bw+>~h%#Jk9J_T~y&KO3S}dd#VPTf0r0^2vr1zyr1J zX|&{H;+te4x^U;a6U%{lq(#)BA&}V+KXOHjwb9DU$@ir(yQPtl0iA+8^ZD$kd;a?< z9gJPi0Yw>6aenza^)xNyb1ldTA6&+SoK{nIacaf7?tEU!ti!cz*|dXX_uLqnk#hS9 zdouA&ovX^^XYB_ydOsI1PTQnQ^!bWs(nqm{%Kr2V6j;?pZN_>tYa+`Txw`cuOtxP! zl1uisVv>2jxz9{LX>-r2%wo8OY$QFsJsaO^C?kqN7KA0Idq{jUd@tTA5bFOH?JYXI z3I-q~U-_`W(?TClZqnp{kh-0Yk>lup34`;;bM|#RE=lYYatkJg*Ax0T6{+)t2a@`m z4&MC&Z93r>d4ecEt{L#$Kb}jHrHn|kB0s;mS!`|fqO#0_ za`V8!3hJ-F_t$%>jl&L00t4GS&TTypX~hGjSnh=f+(^DN0CNc)d0Ys)3)1Y^)sYS2 zngiH$;jgxRDS3H$PM@ldhL z#6zN0U;mXziERwjWh&oqqrrv7&vcY{m0v|M6p=@CMmoc*`vvd+R^y%($qiJqlxkG+ zJ+0JQF_(B_p@~eIKq&Nl9I2@a&w^zsPLj)Zd@Tzj?qJ6`0@R^Yz~1k(RlfX(}_> zZqRN7fePyt=(UHO(BA(w3kEu4yZpU^rD0ZbYG$!C3;Yr@Q}h>o`}Aq2uL)l~_Q==z z^jiGdl=s>hJ%9na3DPNm%M;xuaA|=D?krTaq!D<4=y@4vVAuN=YM^piZRS1pMB_V$ zend&@YmtPvbXAwf)9eo)sW$wSU&$nIVb78yG^yYR*3 zz%@SUTOlx!*9jNe%2I?^s%oLb@$!BgXVpanP2=xv-)U#r9)+!2lhvyGYSX0&Jk-M_ zv#M4}Dpz%QK&w-Gj4M=HaRBCJpW0RLSX}LA`0O~l24=rE_~||fa%ml`2?fU6OgM*C zgcMHXO;f~?hMGBVHLh}F{4MX16o7_9le_GRtV(uLo1VM=96RUqRx_y+=-U`61ts5G zop~0Fsn%kyDy8wA_0Bl5%Oeh%A!uvfaEBC%`upYaD!>)X(ayK@GWxX{v2w9iNLyGt zFeupu%wc7`rT`1kqU#jh*t&@+I9@LL;b1hafWRmA_e*;`Os01(aK~BF0nL%*3yi@( zx8B8Qvgm&&NO^P}3y1$m7?D(Q1#aH+EQ%VW`T!f~At*0X9T-o#flF%$aT%!xaH_U5WCEXeFBD z1ZMVrmxu$P7w;f}SC*3G+q%XNTvszw$k@C$o4?%l{gR`ry_bSH{9{lDtw++yw@=CK zck!yns9c6KleUv7HK=KddbXW14<6K?C^5Hwhj;O+!>cXxujy9Rd&?hxE1 zIAm}Q7KRDI-GU4RcbA;z-RH|b|KNOtxnR1hs-LQ^wbor%YtFBZ2`$z#Sp?s07$NxG zaPprPiToo^J_Z+mrrx&84jKVafo>q5*n}wa$?;3N1UoO>lEynO4pMf^RONahA+z=K=*#m+ zqIcq#rI%-^Qa6M)d1k&vYhpgO?0{>w%Feob(XJF^6m<|{y1=7}y(!@rlcsBlSTb(hEF z_4lO+qO%mspY@+|qF2LMMrw6Q{BOIGKi_vZ`=+~NFZP|Yan6FPiri90<1Ykunq~4l$t__V zx6G-sJV)V3656%Mi^OL_+Et;cycZJN<)M@E1kF?6JWHVV3t`ep6^Kfj5pn4g0#TSh zdKbTF&!u`7X8g!)% z4}g7u-y}zVU?l&rOnAnHvZny&CALBCvXk9Ohb}kD%{^V72;=qpy5h~f8*34%+sth? zw)i^%0E|(GuI4?U(GX!^Qk#W%;6i|g8S6{Bt6KF3Fx@P1iG4|F<4H*Km3iAgiR=_6 z^D7tcIE0sMAp$y%NcazUwlj!bx~JZvnsK1neC>zZu7j*3BTCDXlRA^KdnnqbqwV>2 zP1}AgH8YMY#&q$Twj|BurSlDU-2cF(ALaTQb>_a9s@f5AQah~=6=)Kp1r|>v==oC! z%h>r@zm@%Gxj2h{){uJL4u z86(4?yd3EEHQx-3M)N3>kr&z;tiQ8!`4u<)`)hD%{&XS(aapXpSmh1B>X?{;bj?sw z;_pThiEU{Nxk3AJGWTRbo~^io}^e><*zFWxs(TK z9xvZlwt(XU>3wm-iylx^SglEjnTU<>EdKK5hw`?hCN-6i8e>LuLN0F?W~I-g zZ}cD1b2}~E^a0M=3Y>R|k7!_edP(vpa>41n0$unEIn)GvUUa&W>Da6~*p34LmvoGGer^jaOsDINn+e$ttoZ+aX0HhYSvLpI3H zALR7~cc3JpDMTs&7jYSX48d%_D4FY?R_HjPy#R9+Bss7tyJQC$B_~OT*`mtzRw^ux zze2c35}MvE?~jXSH`MfgAl*z(LR;ptDiKO1n}C&&dIWOoY*#oJ{gBWn^6 zgjv<<7EW*$oGy?-FkjKr`5^C&ea!S)aJyviH{pm8m!}}W3a723N0`28k^30-tkx%J z-5a?QUf}AfdhMxG0pWHVd8iW(3|Y^}VC&26~YQm~ElJrD#a>%5kkh9nJr% z9Ji@^)D$z?kNJ?l>^&m!#SQ}_(GyD*2EZd?$d6o32xatB-dTxL%K`N<)ZP4gy>EFjs$T*F*s?|OKBRUO_0YYzCLeW9w!~a_F;JknmHmQ zvkpulHjL${y+JEevCcKPEx(uc=pStP4fcPMgjBN*^*7hpSlCFAwxL5Cmz$e2XAWaK z`|Uz~DqSS|4t=Ll4oaP56@_zA5?&&J!c}SiCwli6ee{Lq?KNK&e$-sUy8@mN#4=_l zbW+}ouyb}H_T*mg+fFpIl!R6LZ8=>GTdBmZCgI*_1TBIWE%G2NI;-in+WTn2z-`xy z3-9eSn{Bfhw`u3#L{d_%pFdIdy#t>*uZ#tG_l#9)){4A^(wiR-NS?XY|oXqlW@nTyE53;L$=GsRms zT&PQ4bVi1~7EwQ+e&LBZ(TQmNOt{o*h%3PwI$QJA&)q(7wqtS6t55=Aok(zyucXtKpaA&*X^Dz>ih) z;hZUzcpT@DxZF%tk-t?}RH=J<^8~PCK5SiPdX}AT-*EU401^PwJQ)a2fF1P%bD3BX zvqEQ|s6|^(%H@Z%LEuOIMgq;}rx}jvs-XEGBPM3sA+k1zJfvZybJ`w$aF~SEY0Fn+ zAtPyXhbz`ofINR5*pyLDCR@gLN~REU!X5@!(hSf~NWCzF3l0~((rJ*_&?J5Vy9Rf;Tf+p{UM7+Pdkz8NIbf=6t!Vi`kV9v2I z$oB9NbNnNQJ-Rtxg98l$&v^w(dXJ~0Caf(wDXs9+8WsUK+y!^EUyU?`c8uGF>hxFW zRH&%z`UNDD<+~HlQ$*Iyh;VR$@u^DAswC?0cq?VWyTLoZ;}U!!#}*^hby|Cvf1ZYY z_0n8(W+dsQnE?ay5M7pF%h}XzU-^y8yV5D$6zv9=vde7mg|WQ~crPhI^LOC3Kwp0c zVDky^Lp9yOq7wcI?O(O13nPlu4c+T|5MUQ5GWPA7X|-kJ`gF4|5dkXYnjXh)!@)RT z%mv#EoN%?9)T|-SCwKHSlEG`Kwzhuuvq2yL zi2hU!yNsJl5moWpD{=i5<1FgABPN^t9pF|qAD8{OKZU-KXzL$(E$(ID*+qz^STyH4 zt+a6|W5N^wWG)UWMeRN4^Hi!Q2(X8+$4J}9V3V!!*1}FeBY`*S@w=XM zGpLPdCgbY4PnRk9O%Ub4@wdjXz*7HG?lVU6x(4olnhxMK`;qryEsBdml}`Q(dyhbD zVOPy&SzLk;h6muEwJh=~121xC02V3&CflzWQFSG#Xmv zASee%s>81kY}lrjRIP+>0Tx z*Z`S7fU6`UO~o(EF55OGFLp2tdzm`oucbcYN4A`Io*JW^RC?e&F7+;^X~E>YnWd#E z3L>S^QOw{g3;tt}rd704TZTjvGYdb-hy#8?)T>k?hT}TY?_EOtdySdMSjye$;%4PE z_2h*0(ML;Hw-Vbz51-Z0l&mt$aN}`ZGehe8je3KffpQiCL>Ew+&nqv+Y8u9rdDm!3 zNRHh{>`pTx8`v@qUD{PzSIuJqfXWodBj8V~iR$Zk;;o({Wo{S`))slFeE)YcC|l^} z&cglR+o^F)CUFD3qBDHla6gBx9Rh?8M9N5L^i48Y6L z&dA)4QGkoYDK}%8>Kj$LTWdJ-Ov<_&+VR=J?F2>@&H#Fd-i(f}e?tt4B zoTe)L&GOMWyL*_+_Za#fnkeX;g_(B^)A7{Sm+_f2xLZirA=AD*4`YL|j>VT>Ox~-p z{butWIhA9ALhNgb%R&5Gv0)r3!5m{@opMmTCub^yT|_nCp}tq<_uU`DPYb) z=`j@Uu~3&FQpr-$HD=V z1=3Y847jn=75Yr53jE`WCN71Zs(*DlC?PtvsVsD=$s#%j*L6)kU=EU(4O##SS5h%$ zq$j0Nh0RNxpUQzhmydS5M&>BuoVlASOK@_&Z``+6NWO|vz4jIVx=OidRkE%V&jKvL{B!yl z99Gj(G>YSTHa0ao84)X8omwlu7!j;3Aq+T{+Ae*d7E55znK-wfATHV0d?RW#h*jv; zdSi9rUgu^L^`f3PKH;P~sMP+m)Sr4nXf>fdd+Mq)v$-=HjXNzuzW=H)da%z-fs3m) zl$IV6yKcPF2gauv#bx;#SvFv*-nqPDxipr+(b2V%Gh%9|re9`K`th^;2oB`0Xel9y z`*u}`ugX^uNJH9HfqlJoX=X1&4N-#>Um+ZKXpF~q*ULsGFNc27)oqCKidQ~L@RL|O zPHkaV9)qHKO*_0>^-7U*aLP62*%GOcUZZmww&=$Ow-*^0(>`U9aDEi@2&rTwa=I?1>b&a{(LN{+29S2iwsVASF0Rh-qZLJ+Q3QM?$*ciAh=k z41mjG=MjPSO>YkwmH07mQ&TuAq`4(ph3hs;;SZ&Yuxy(6s))+vy0CW+Yfx_v$px<@ z!Re7j>vKIa6=}5I3MRqwgXgG}Pzc9mnu|)9_RWD3>>~os%Rc>?Wu4;%?MFgxc;H*a zxU;m>rc+p{_A zf~P#JvOA&p7hBy~RuGoTQAV0s4i9uEv^{wrCz)F5BKmX`Djgg7!G%$4{=s?1IakiI zzK&G->n$tH&td0(G2(fujPR3}wW3Qi6HIVFVg2nF`+@(1e`Z^=@TJU=|C{WElJbFC z@c0M2uxm=Su(Pf!M;^Od}jTeKNyF}4D{ixEdmeGNG>sPgy0X`PNZv0 z#Lq-|-(g%l_c$-w{@uXc@BI9o#ZsZfUT@zf89$$>o+TEC2TRkQQdWt<6(BFX=r`mH z;kmwxb9w$Ga{Da_oVivvUGJ!SbecAw=zV`plLgM}0Co-ofIcpABUi1;NPwXqdYyeg z!W=fjhHD^xq~**dfO67|8hf?c7X{z_PJ+%9-hELzwkCTl0yS+{zP(0H-x$Y?sT);M zLcppT9AFU4W%sgyD0R{nu8%s5X1;Yu3()zVC>|Dv2Dm4`CRl}>rxR&nEK%xdsA#Oa z2Zz7QjaEzwT|iGuQE|-|GgC(J)^1CUCbIqH{_5RejN)TZmOSw8_2abR{;4ZTy-NQ{ zh&TV!k7|4*($~b^?w5+Cq)oxDNAc#_f7TeU#`uph>J_!L$g|oj+~0Cl89A?Y=3gBi znx-rYVMS+Ew2VE5k{07lhXN>EHUF@{j6&Wz(MNeDb}Du% z3uBJ|OByZlRXDb4P!3tuKp&#{<+>_o%dZfU-ene6Vy4HYj_)#^&-2W!6#JhOIR?(`6;)7CffBsZD4^78WB%7q)~1pzHR>IwZBaqYWj~DIu8aMb zjZo2_(mDB68>;>-)6ki`ERc=vi9EYy3ltkI^KI1!w}8Ao$HMLvkB)j643sl!?aMoq zrhY52eyfb5PH;`C&)o}0Kf}Deb1(g23imW9?B{%txgpv7H$U&EI)9!KO4Cg_Wd+wWc*><_}X-X)g0j9`{_pl_Jk5 zOXeC$R}G}ei8nf6d=zzlG!t$O5n02Icm z%G4MYbFp_spH|v{h)cUzXJ^-Ory;$Z3V0^^H00Zu{@`6F{FwZ>l=q;k5y^$_##3v+ z17~4+9i10sT4X$L{lFO__pJ!URtW8f#|U9^MvWXkK(ZvgQw+CQLU%C!;Z zWs_9-Gp#|YI5!~)iies%p}U5;xdXJwK4-1Y>0gMpJgS8h4jNAWQ}$ zZaW51fD#tL4i+luZqoI41ByfTuS)6Ev8hyI6hoeRNul`^c8v|NcJSa8Y5IU=2i_QO z{W5>*yRVDe89)_fz!6w3XID#Cp;^5KVsGS{DrI|zxh8kJx0VfX7_Fy+dtCP#W@;CV zZJMVUo_7Td@5>E`bfPBGt?X+45*Ja@zy4=R{S5A|w^(aLR*4@!K51*HIB2f>T}{bC zao#_DQ#x@@)2?~2)G!dqj?${-4Rv2Z(b8Yu89^dVRZ^^B)@#+*_k1c)_uJDP0-Pv0 z;xA1cg&#iutoRp(Xv+0Ex{2||1kW@pO8g`w!AiE!Jad|=7-6I8s9oqExSO=h%x>I= zx6^Ya#)mbb*gryZO%bjcTU$Qi6ZBpRE3JM}PCZwm?H6r-wcsn98JYfBjc{{T_^V|p zhSxt3l4>Jcd7iIoRR2D7dDZ5vQvc0+h=vBgH^jU-uA142aK394S9DWpH0!WLqek;w z4Obc{^HKlRTptgMa9274W!~U?W*j)tZ*|Ky--O8Z(DTHV5svKk7SghLB&dxU{0v25 z=hQw}*o1P6uW;H2w`T+lP<1FGu8C4iMx4Huo^4n}$c2|_%O)M!Kt)lxlGJf%p&EiQDe{OX%z4 z^S2Ww)7K4iYgS-_5pWlwpJxth!_G}zMNz16FYzKYP&+qw>{WzaVF#2(Vtn>+cEkc! zWFv^1>u;Q)bi|}JD<6j(9FC}Sp4Cq*UcS56gsGEHO2PbYB=$m<*HZlaMeLbvsTqED zdmQDpfJ8-KB)wxqBvly2rXM7fErxY}-xjHMQe!>&?p+lX#k2zAYIdrsoKzRNBj(mf zgD~2ra3o07x&PYLY#_h=8<}HBaQn|J!8I4)%IUkV!y-#|FmKP4z29waKW#nJC#j!! z5ZVF06uWkwoMgsmnyj)<%<`;RE#?0L6jk)~^(~9o=~+7RY7Ki71Ox@k8u~W2nwms5 zmd)A1x}yN-cDi|}PhIM`jnl$E(-ibO>7L(^gSndWt}X*V-MZ9F9rRL;d#7p}&&9Wj zdAS+?t6M({`w)n=M=W9g+uYLL9#7Ygyiz0W`ouh1BJCn)KrF>aPLh9&Z*6KSCeK<* zEkN$1;K!s}%Qaxx_2#y@n)mkRW-KJtz9!YyUpAWg6T1n1U(+ZuPS_DIp&ppYtl6z_ zVA17*<+{vtGwA!uyA$~B@dT0+^zC{i%NlFIDguVdL)N+5ioWpLK`qCfpc0&Qp zJf#~0Y!Y~_oh|se{@regbllGCw!U5YtCD*JaA;+^BLX)g-^Vjk{2q>b4|zocpOafI zguM>w+W&NEBOKeHeTt_GC`4It^_2nWBkX_Um<>pv-GC2acilXW#S+k7IRNlRS07+} zhfpO6nTsw)i&4lTzb}cTJ`bmVeHqbfGLP&AD6$nX#(?8L{Zn|I}D(*dTvsw z68Q$A&POFLg@Ane4j@T$FA$? z#Y_rG97qOCf~2Evl5J&WqwUHJMFAi&mE3s^R!=O8#Jb>ct>VU|lT7Kn(=ROG9G zxl<$AJioo7I03!d;*=x3ux+`?CHp0?%U*pG#6OJOhVhyoPr4u?k4F~zw6`wpn~1Ms zdIB1S#*@FFpCw>fZZmrVqLNPSy{Em8V_^uWN{Hu#%@bcgT6{^)X7UnibOu)2rkbx& zmwI2=u;M@tM;n+g!_=!mt7%Ts8oWWw4`M+>su1y+p>bi$`)Z-hDLI&+WU9;B`cU&^ z1N5gEUw|zXDx)6#kfZTC$C?Z|37(u+uC5Q*hR!hKT}Y-f%Trn!gLivyB{tt73g*%s z#Sz^SG@}e3rj^6vFLnZKh*L5wuywN4*OR!R5|*|F$)r3(DDOD3Q0ye)0mnMiP?RY+ z{S=P|jR(puahyM-yPN;8r^a+n%B1rC|3gJc>|(jlbc zEzBizK|9zlS!XJVShQ{_*(x|b|Dh%|s`Z*unMyo#V9fZt&`06Uey$u3@oYOrf)oBOuiyIg>Dcray!B zH%__$ImhiQ6Lx7k{)GONG&+F7-5>jSHR zOyLfIqI1lVi+MQXU3}i56nSw(hyp(TXf8F!0iM#ESAS;(;!X_y1CUL@cvtnv3pf>l z6j_l{dr4?T3?~R+L9ml<=8e=-nq<4+mX`4FfPcK2C#{opUUHz#1fO4<0QnvKs~ek2 z>NV(w9FO&imLX@CfDZ-!y%@sy3GLfgzi{YVb37no2hW2Y_PPsY8iD-ZZ{L|q!5`q% z&Ar~cqY4msoJ;!_G=3^|4f8ST}w6Gu9DedEAB1fIo zH1z5NlzSv9jotz<=Gl3))_)}et~ZR2UyQK8pxdYEl>zP@Z^V7d|EEv?1%Ow7YBUY? z^z>YGyCXoxoyC6L>9KfsMx3`>x?k6}zWj7Jx%n51zV~@)&kg+*GU%hlnMh0Z$te`f-ree9(!J^ zA|&K{9({JyPy*r@#kmNJUL1Zd<>cm{9Qq-YhsQ^U>YgIfZ#=n2t~>F}bgpk>j)~m7 ziVw>L^PYe|u8OQc!7Xu54Qrv8(*M=nl){SW>yi5N_!X-mgQJX7g(N%Z5RrEfL&hTE zald#{|IHrhwcXW6zHm))5sH`H-Ps&RrP1KZtDL)oO_L8%7TUdSo0JeadXC z?=l>s&Q&al-;QII?J*dEyzo4jl_Y@0nK~Rw<$n)Y?vB zEk-2x1Bxb<=&oI)?MZ06mS8f(Is#Eg-aB2$ka5=kTsttBlo?gHfHW3hRF@o|zu>vpGCq#Ns6; z{~5jU#O3fxpND4XVt{4ltF>#6NEbpJ+T@eE`IpRfvtDbeJ;keMsRus~ZRU?3FzLwf zy+Z1&fTJvAs-9?rpko;_-f48It$|tq+A8c7J}|wu=G65#r9rU*h|tEgDtYuqMn)IF z`3j@2lg>~S8GNhx@Y}TeF{Xx5V6ZW+xb*cr>)^reya0(mYG9YH92^WxY6)5?0?ONNkAHpeh>_T3P4S)SN*fzclr=USz9u#vUoJQ%ouc}3O| znD)2_^jjUX?V^(LrN-C`Bg+BPlksbUwF8*VlnwHP{af$9yLism>dBZVZ_R$wRK}tC z1!S|GsmB9HT~1azWZbbXNj|TdnWdmEt@-Zd%XE&?i1gX@oR1KX_X6${D*&&>PAQ9M zmonjdxeJ!W1kN)+j_z})G~NY-7(hw@@^s1Lc)EsWIn>l+4730ipe7H%gUh(uRt-sC z3IZJXgs;eotDL|2B>&4f>Vwpgzw)iF05vAz6Je)hFWFr`QoJRF76yB0)s*#=K7h|r zrTQ_WD!MlM7y^gUcxU_FwmNz172r4Ho^9{*8k`3P!N**ov|S)YPLD+DQ&f(`|KH%X zp1PvMj%Wp9jSv9REYH6gfup2(#jiA);lL#+_ZsHnEP0*vl@u+%ss=>;MH@^Kd9Y1$ zdqsEabw-W47MR_n(kLpO;2SuaQODDQK`|)NL9R@q?Ippn3iEB zV!b!R@LC4haafF??eFh5*};NzFT~paOEKd~c(V{_tpKG{4b$s3R0oHCfq6^J9OH?c zUGBR;0MX!@qD9#zQGzb|R)-PWiyQ#s4{bt!=)Mg;-997M^c}yt2VCYd(NX*41SswE zF*i}fqDtSTH1mDiX6!09?b?qk@TWJY$(4=Yw8R>!>Hq*B2iU~Y4auCjfZ1163i22K zkjHk4S-&A&RLfL8fQ(kL)*`mtKXY^TRsYO&?rgZkem3njTI3f(_DS&kIOUDALne}p zR1x*Bz^D_dNIK#nJfIl9{gh;;T&51Jt&>TZ4yi*BW5i3tKjlt|iF1dVTO?~MS4T*T z@Z4WC64W~s>yOC&*$3{VjWkcQv2EF&X`9>oUDKaed;4UrORrvqYN2yX``ceV0_F!L zIe&zLgtsmq_dSuj>d)rnCO(&`vjqshGB^X^5R&UM;;R9xj?E(t75wtA(N5OT`9XkT zB65WS3~?-i(?8K-vZTH{lbF70Z;7P=9di9QP}f#x*F0xwhk<(6PaB!kxCsIlaON}E z|4n7@`;AnJ;;T17DOi82YLnqpfGa(ZxLQU$x$;xxB)~)G8sB}L>k9fOhWI(dhpF&K za`iS)=7GdeuCPq?8y*q}j>KVY8xrt}2+R_HIJi_Nk6MQ-P(a{!|3!p|xgahdBVIR; z-ccg|&mlyw&m(Xq5pe$p&zg4s@p$NFY1DKUYtT(AMVQVFANl=y!+?f{-G*VtFaM04 z;OQ2yIPxbeUK^ORr2sQ%$%;NtA#KFkQmT8^ifuE}PLb zllDa?#@dDn%-MVRgTi~l80X(kVwQ+p{hsq+#s8Nm`7B)Bpl3qC%_u{hqcdQYGbq-j-e3)c(*uJ*VzV^za)yXReG}?gPkF|6?%}IBZ-eqF((nt{9j~A-&%6Xc%{&`5F;9b0x?b~ z{tNAUhJG)GDJocvM_uNO)&gf1_-onnzYY~e8Coa0oK<#~!(( z$Sk)sL!PC~&$7>nAyydY$K$Du zc)rlz+QKY>J_i5BqIViEu&`4zS??|hU2j3E;s+;MW59+!u)~(0&+HgFyn%y*ONH#E zOL;8&Ks3}Y%C=q+5PT)3%p|`|hu>Gbd)T&%}U&?p5N)WwE9Vsqp<}uL}yRPbjgUIE;(m<;^-y zpX*s}%J?9t|9!g8G4!ZwTgQELr8To&qp$j@I>tUIPM;T=iIM%?w0G4NlFuQ2*deKy zG8IsJaGGK0UvtIORMKQU#{XQioN3)t=F4VPl;#CDUTdkU+oIsFT&;NchFAAQ<#DAv z$Nr!GN$nV`f_QmNpZpM(%w;^jttP>~P00o1ff8JjLg)U05Vgx&@kaxDm6cixF@tZ< z$-LjD)#o#qM@Zs|a+_?nxHgnPPR!t%_247tIkwH~TpBVSbN3j%RC^RV}y=Lg`@Uk&S^;9S6NmZX? zlV!?1w7QukI+UTMSz0@~7orixme+`k-s&x4GdA-wDwlTK%hzurRI;s#Ob!{TSb$f& zsSo_8>7_dkh5X_b2hUG`6o`ZLMGU&2nLi8Cb59Exev-LWc|u!02<);RJoiqA%(Jm! zm8;<8@nUOpGzBNTqmTKE!)|c@yDu$l<@V=hUgInBIRH#XrK z;jJ@rhpyd1927IbmFxb^=-Q8{GD>RdgQ$~tYnuyC$0S=OPJMQwwGJZOK~G_1Rzo6 z8QR-S`>v_HqPF1HzgU`<<@T<_KaBS$Y|@GS%RjreV4NaZW?(=vYpk1;jx+3U8RYRm zzVDZtH71K|mkv3I67d+K4)x}cKPpkUqRU%PdUFX9k_>Qs?3WU6sv{3Sezt$msQ8?) zuQn64=3@3}pg7&IytynRXkF@CYs2+os;ClsufhPOlcShnofeVjAi=SeW`i?2-WVh8 zHk|zRbv;ByKtRy4vBBiws=A?%`na3!syqZ=0fhpYSA{wu6>AfbD>XJFsO7P7&h-5i z(SWz)3;XD2Nk8W&f#alrUDuDyw2Zfq5c^3u1xuP;KTWfl3Vi#>K_5Q^y!nP3dzQ%y zD3hfaj#BjZDL5we(0&;yBiP9H<{KV5H3?l$E@D5gR(Y3G1(K1&Gm>{Ki&)0S{}_oG zmU3uAoazj=v0V5p)>3|War9TfNo*yf5E*r_le2^)?5in%EFD}?I(4_B@l;3phA^k* z^)*XVnXfc|Au2rn`0rHBLwXr4b*=dN*F#UZzdj;QwHXaE36k7OQEm4hBv*sL4#tWC zWpwZv`I^c(_Y;(wWV1E+4btCBJek(2eXX^R9p@gMaw>JolX&X-G2)}_W@3M^tFC5p z7`8clT)lhNL5Fx%Ofr?vG0oLob2sXrVpcJX{W;JcQwYrTHjW~FzD20^R4^W zJs%i1vMo^Qd?{^Z_?jAo7(mWRix zdosQ|X^eSQ+35~UftCf8{fX4fS?fPBIHl2o|5S%r>a;*2T8*SKKP%`$5;crxDeIUz zJ@16%^&jXMidD0E-y_lRvMcNRYg2ugrD)wX;VR4yt4OG`!^~}qTGfBA&%3;mVf&Dd z>s3`>(W0f6s$NP%T{yr>~rDn9Nx~O?>&T0fqMtS?dtPDO> zxE`K9<;D1Q2lZw~h8PYj$sdT^j(U)>+!8*%qA4WM$#rBD8LF(c&*nMoY?k5JClSs2 z&;Rmz(HQ)VWk0;Y!VYW5aNkk$)#0QSRHFc(%p7|!chP#r&_$IfPThNc4A^ zWrWAc#@|MF5c9^rMf8jxuYZ%7u2ZjHp`X{Ae8JLM*xX=pS*`yu%FHb;krq)KC-N6y zdAaVzt{52 z@$Id@{UKA7m6B5P*s1uHiL@2~9Z(N`7c>8j_mkMbk7c&Q{+}5^oh$ zp2HPHI`DxVSxu(6s^k*yf>5P6Mg)a01xj1iL&u{W)|&CZ7Bc-rNWLtseA?;e8;mri zVIM#nLGB~px<)_udX-=8Px>@^Im~GoSe_GKTA5yBcl^1u0Z*65K~K60QmquTz#$jT zstdTjzzJjwpVu!z-6D+|58NyQKFwY-Guk>#&D#OOA=LJA9KsK6M)JOqSLx}snZHvw z6IUgBADXDFV&^4PApJ7;C8?@$yN^*wq-h;&-QR+Hu)y*f4t-}MY zag*@U1Xx^2NZ9f(ht}#3#;~)vQH`sW&#uo;0Hdast{@o)*boWq*hiLXkh}@W| zM5UDDh~QvUi*5~7pdr!ctkFK1RhciBiH^+Bs~__GhD^d(L#+9`s)x07Q$a5y_c-;3 zVHU3Y8b|V>Qar|{Af4*mJNGtE<&)I8WmW4V&cUeu$Z2f7<}3cCf0IVgMvGhRLg@68 zQTl?3zeMZ03iresEkr!}h&RPMQxa?~`Ky782tqdu2!a+QS zd$8xwu!>8k{N@N!n5!jNW?bZ~QE19QKnO@?G4-oErMb4CV0Ft{JgmAMv;U(WyE#&i zqWLk1%-BPC|_`iwdI@`BR$U-a*+;FsvWjDNQflhn3jVM(2uWItIg)QX4qqW@Fi5bW~XV-B-5WPpGwgmRbvuF8gxR_ahtto zx!#GgOT3uX(@y1KBb!`cB zY;~?!?rv9u8|cR*zZ<9Lp5!qsthyBnecYo7{OqY%(V`gJ!42IkPyS`f*!U|+J(ifp z2OWXD8W1ElVEuBT}eL-W}9foyHh|jSalzg04B1ocxlWo(x1Y zT!Nu4R#Uam=}wR`tI#2=o`8P}&`P~5@Bgi6H)}ugOqVaSc%)@Bqf*p>=o+{*8JRUD z4z+V;u0BHFwZ}BvyRg)y#_#GiuT8HAXlIrdJD@YLF?WX_T!43CM!>YN~vX27R~wVLE~PT#){UqL2HT0a)uma%v$&X z>)t8ov+?D$ZmOMuYVx*}C>q*dnwY+~H<3kr z>Z^vqw}sVlHh>ACn-J92!9#UF?72n z&^hg=bsr;6>q$zT_li0<70oH>T$omz?@@N8)%1K?xhe{Dcmc7@w#KNe)CebScph}g zBIDl5Q6Kfhb*!^B`J*G%xDS-^$<10Mu`}WUnU%^J(Dstxo_!Sg#$ld%4X6}FT%;i4vjUyzd82So0=sS`(p7SFjiD@PD=P zSuW1Oy$o^`JkT0ARGXH{J zxiOcqAKJUOJ4!O~D-}*vKmjoWzT&hup}W`q8*|=c?NR&Qe6!CV zZoS1eDQ{s@Sv}AlcQ(6I2}ntw1%jl@RDpF)`K1dwuFR7yVUTCK#vl z_#3FIHr_tBhbarPweUVih`p&x(tE|upMTrv=P2E}M{SK6u@xaC%YR z+SI$al7-fn7SFVrvgpuL%jjMAMCXMIPejl)ntn_tdZ3`rkmVViQ$L-xylR=8n^D^5 zoAfKdtpnugQmk*DbWwoOa&h#LSx%*eHPK<_pMaG1@wfD}Zfr9NxVKbM56+-E7~0>A z2F8m@zhhhILvKK>a=923fR%+ZT;bCP#*cwDb{s{LV5>NMu!`WZ?WH+zfOJ&i7-y@t z&GP(=Rqp=E=ywm}7G5Q2b?x4xhlQyG?xKOKT-TWKhI!ycog-96R^ZPwZ zXe>0<#V&*Jk(3;PW{RKf*Y~L*d`&uVtEK?7<^Iy@qD-EnsmExS%_@kGYKHD+^gEzM zHn17e<9PD*9oBapT(UrF_l(n1$G-A7G1)mROyAxrsNP0ct`P5YFpdr z#n3Ubf^TrBEX5k`8R$^WvrJx)_{B^TqfftQMYjCxM{U#4MBzt*B_{PkN#{YCh947| z{QR_Cck!niFZD2oIot^+EwD(T=pOr#n}78aSQ!B=hbN^;(gi05FYX52zMXIj!u3#2wS@o6Nk5N~=jR-#UkF9znCX%1SokxF#NZsELDS zp`cd|7QMe1p`>BZJ)ZlY74Nh`Ku5?Wa5;&=J2S8t#Yvz`P^upeTH-Lh>HquD|wJN%FXe&n(dDR42d!v6YTn;3vSF>M835X+HjZF34)u_C( zqO0batCNZO=H;NbzClx-xu3dXuB(@wO&xhtS01?1V`*pIeATL)CUM(3y&|HlUvWaK zsO@ZWD8=CI#Lz>S@ogX7y34VCe%Ij=r_5yVs%H1=SHxAK2GJG0k9eO|F7;;J+q|gb zONe}0wP(cgH74uQtXd+lC{T{#?Oj*5hX>iBccCRSs~+{fRQu_LrSFWWxR2|OWElGkMeIbyM~#H=Andtp}B!rm{iTOaHM zPp%RYQkO)@l2U$?2hG8<*?Z9iV^cFA!V+V8q2Lz5@TqCq)$p)oIi+Y<=hJH*1Rq=a zjsHolqeWYb%kDO|0C7SM=0J3`3+f9-9BuXmc|@z#0_t%&-NfbZuG!jbD}Vg;`X(J6 z?mH)gqys((otri|(!4mxlCV~LTYZe1j{a64g4Gh$Pq=D%HDp)z@)xCsF$(KOg>&25 zTESPDRlTH2T8QwGP8|ZxhxrCU&SYY zut$way|#mj$z%-3a<)IPOAjH57}=3|mSo^Ph^iPkl&6EWNvveZ=W4^44)ZTo@9J{h z&{Db7k6mB9vN9_VPoATSG-?B{F#&3m@Z#Nus!bg{+O$mziWoGc9CVWPwf%aF4O5Mz zonLA+9?EG&c_EgB-=7-$OL^Rz)2?$!A`ES%;KNedmv)fvmN1=Z(tf{0-f$3_j&O34 z*C`gJqb6-=_qx5fai~9Nd1wsK@0CYBjN9zg(-mgvd6=Xm_1^N$D9u!<)nMq{B?d#IGnW1>1@ISWWgnOU{rB2HEk}A1NIU(@88tw{PN3jYj^tP%vNge`UkaWR{ zkl1E-_6A9vIZA_67N+SwN`7u6Wf|g+g-c>9rZ8cMiJ;BVFB?h*u}dP?(E_O}L&{-w z6lzE(c^InaTXZ=no3@?$)FQt}WM>Fsn*|E6=qUubl_a#8HO^|Xtk)_Gi}SUg()bnY zm}rJsJOXv-8dfHZq-n4FXiu}Js0#Tn3G5_sSPvWd2UX=cr;BrT6EH<+`}!VemrAJU zI>c!LwNVAT{Iv#kkM$w{Crkvh`;?sg&Sv@58iTnbQSyh8P+}SKM+DZPC zO4XXv45KmXUGq)@4VAM4IJqC2A$5^m6KKpTkb|%*A=U6alf2_j47H&zWcBlqX^_u1 zLDQVn)@H~1E$&^dHBgqei4*KOoc8XMQfAE8(r&*+ zU!hKZNol{+)(AbS)X{8RjB8KmdbK)CEhOnCHt=i_KW*^i9&XofiAQ>Fr^CA8nt0q_ zUw9tVuzcz0om1`>X=410u~SFr+qVr!XW@1AC`vJ>dT6#s$%Wi#ooS?(maeulGdX(` z8BB#_+d3*5JaUV6CMPzpwAvI@8*Az^iIZG2s&Jhig2s!XI4?dWN4+zoT$8@JHHO~H zTD~=mHXB}+TrzYgp9nX*lGd7fuDp2kpAGd1*Z>I6FVlDx_h~!`w3N?FdwaWm{-jNl z;XF}GEeJHQ380FZwoH)pCIbzhSvhV%plo&F#2)7BI{M#`Y|ljPKy6aabxJ=SLR)Zh zSekEH$`}b?vzgp_R)Z)>d!-w!fw|Sw?IGZXsj*4UBc{q?eiTs&%9d-HUojEixw_F2@T}uQRv`msAYy~Qix!2@A zF_nDSu(BBt4+9Xa1`$?1+!*yh4M(M}YiY#i~NG!Q* z9%OS}anoTMan}Q3s8?rfoj{p0R?1@`g}P8O z%yGn>k*aDPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!TO|D1qOL-cxxCbsWF({R zsrsap*Oy97Nr?=oe_Lk!`$w{L;yaQ|CM6@KlE~LeIxmt*XzWC}B&1%_xtyjY!e4b> z1`Q@=udpWMeqZ7mN8MC6!7^Nok4H)+~{9ijrwlWwUlor_<7q zZO~9rIFQL`T{Jz~12@8wUU_-Bl_jTjvN9K3i^0orzySxy>#x5q^XAR7bU_pk+w$@o zypA!q$dj-VoMxdxZ0O`PzeH9?s=7CJLO?*9L$b1>kCJRBNv66=S*l7Ww~ps*y;N4D zq`r2xWR^~rbo(XB5tF4PF;`OUbTVYBRd6iUX{?ji2$2~9$tvwJ@$J772$RF;e9gf0 zs;yJv)bx@%*&x-%Ty5@^ltuy~tz=)Sc7%cXDY>OnX%%)#Kx)S=saNfH)5JjT2&e`nQH%=#3$H@Og+YBr+e-hHrc1PJDv&i_%8jt9t*td; z|6-u!)fS29TKi80nF$E(<8(!Z_Ib7SZ$-H-2(&&Xs2l5^S0RF1ef3i7lmzvr9*hMW z2WHha(5pJTfbjOgx7a^TsnLHqXfM)ij#*Oyv0`Z2T35!W<)?MC#fbHzUe{{g0Rd|l zDcSRiD{GfFNPSjUcDfqO=m2NczI4HKC5Cbh(V&C8PV&`rRLjtn;F85su4K?omr6C+ z8Wk!^usR7!G7%{>Bz00i1X+ZM+LZ`9XJ^Wi4@OGE!kIQ%a~dF_(uk=O(IK=Htu{e1 zVqg`n)6c>)5dnV@L=a6@^R}y!uxT3*3I4j0#gElI#1xSRX=sjF{i9hy-pg0DCcrIa)gAP7wlLODDRsawhvLV;F+iEAECY90nSIW~m>0|v;n zY15>prlx58<%ri2c!_8;`XTbSn3P5P)Jm<|0fHD|NPWsurRty`UA)!GWzk+O;H6V%sU8g0N~`x^$7`bkUGV=?z}^ zH(uR}0F9u1%C?lYU8(kES_KXv5KR`P@yhUtv_CCt%uv?mm=&Qg?WRlu%~6v=WZ7bc zYb@zy@&L=Sn}C3}jbyTRzLcevkm}}1dj16Inwu#b%M9t1pCySIuS%ctsnWgrE$LPF zzI0mpp;Xq-l@6+1bS}+GWxie&4b>!SGdh{GN&q@Dn2-r2P9+rPRFkuXU|bsiSTwa7 zH9#abA>H7kMby05s$naqwqCUxb!(`P1VmMb_D06G^`Y*WMv`5;c(E2GB^^6;k~+4m zl*}9I)u14eRU>IFCls~&KfgEQcEYP&I@JU-+TPu|b(QM6jFgw8wLY4M{wvjmL}O<9-w8d+ zz()hZJf*@OAQVl5u_&Jv0Lvm4ARcCQjiRVQRjaPx6FI4?RVktP>{b)7 z0;yR>1&!A@5|Y+>A(YCs?Rxj#RE7>2CY$x`C-djem-?81utRYr+YVLjWt*Yf$iM*u zB%>?n>gsCK7JByFSOyOsESqn>xz?}0^y<}17A{<9LWZ_t)gHgD2u*D_MOKfiSFKV+ z#*OXVc+KUr(xb~pQrWJ;v>nQsOsg)T?V4vRP1P?1T4iOGmakfN-R(>AtLv|k7oL4e z<}X+r<)E3RwBNEE*lM~F@iW-i#?tOBDL22aUAw7(=`N)zcxVgCiF{1tDVN8g>~5m+ z$FFW&u=+Lb=l&}?=ZOnu4@bN>{NBo`SNhkroh*HAb*0BOY~w%D)!=rp&3!;XTST&b zMVYR)mq@z~U1ibSnKEKfCmGVQR0eO>MN-)%viZgxWQUGbvQ_W)QkBR^mvpV{+N(@< z?o=v0JC#er5}n`;I$g50$_cCnb#<68W#;JAVQ;$W$yp5cRFV=!I#p&Q%69Z#U)oRJ zdh=ZwJN6U#$6fcxqyKwcrc9nDKfdxRsjaQE?V3z|Mh-amAo=F`-;y)VI!iA5!4IV0 z<^$z+6&PoqbB|pMdm6b}AX(Rp|d*xccEwO&19{t)aUXmejqbu&ywx88!j1yb0)8KQK6WI+?4>6rAB<9qOzUr zvDUUS5NJ@uAMs?xu(-86$Ta3pw+0WtF^eDI(CtF-+4!lIQ(c$ zFKbVAm6unjmQtc^g8){IMf=B|u2O=Hgh)j8QJQJnMg#~h+Kempp&#)l4q>@==+MFX z&Er&6Rhb=s+L^Q|Lr3j*(!!3vZv~Ps>9+6CQFX1nYOWomLet2nlG3?TXUikQ;k~9^ zsc}ompZ2r1uq*=t+9Z-QbdoIX&_xz?=qA-w9p$ADr^}=7Oq7S;TOzep1LTzt7s;bz z=E$>e*T~G;p0Z$mtvvtEI2rlDIGHhZs#I09*9pPIgYuNrG(E{TJ|vi6wcflLl2Q`N zD#27$wbQ$t?7sV+a>w8PCQm-~r1aRRw`{(}=C>--W5@2Y+ittc(gpM6h$FsYVbkQD$3%Qbc^5C5XMTAtqgJXsuQs;W(Eg<7ub0s_`KlDRrv z-j%jjc5W}zXU&rv@BFV^eBE7g{hwcuadWfs?C5cF(G|DJ71#Ys=GS+W|K9&U`Q@+v zEZ6?(7J2iH*K`G+mHJwqo7EL>LepYW*faP#i;~fnPEn{gB*|ps4_B-?{l^nDiSoDN9ugLK9&t3Sj^_b?n$lYU`@izEtzd+BpH+Balz@ z4nw^W0*Aeh>C>k*+C(0I{Bg}n{Tqqp9MxhTeDFc}+nsmXJ!cb>r%sU)C6`JiP_~-L z1CR$K(^<>!+5^P2GP5!eBnlh5YCCg&;>2CoP$T>Aw;$p{zW@EpWZ1Bw(q7A#N+*@T z>m-+L(DKzvL%kAWxsDgb!ljV7_L&OS`g*ohGBR(G61}dVJ9Ub}EM2^?@!TjWNe;9% zhfIzqx$5PkkKdPhDv&t*FE8amgPiprf*K;H4ZMC3J#FJFezxQQb)nsG6F`r<9X=_G0{olv=ipv-0{8aV%+x&cf z$1DGy|Jh@&5do{6yCY4^!g zNxrnKy}Fm=yKlT{e*EMa`91d9KVMeSAus8Qd?Hn@eyMy_$8HvP)acRq6Hhxef7W^5 z%ukvzEkAF`qWrTjznK5?U4P4u8TV;^`n=is566Cz|NfOf%Afy#-_Cz9=KXxP?j0@e zkRgNf@4x?U{+)N;&A;)+8~KqVpUH2uQBPeUm*xL_+a397(`M#p&6<^e^UXK%d+xcX z#i^`pr~c`DGEtImS4ldld_{SOe0h2M{3gBo=3jj7#ry@|{!SFOydwYFs8{nR9)Cjq zs3VTdpZWDO^2Z!?wD~D1<~z0TsCmDWzw55M@~5AEdj88_{&HT)P}9=(VIy9{HOCxq zzyWzBHnS_?nJElo(p+%oRmQZIJ!jXI= zE&trJ&*r~;*b({XUw9!uX3U5AX_F`A&pz{;me!!nhvdhPo18!XtEbrgzy5h|{>dkw z%0KYH1KQ@(^GlX2%%6Y$x%rZkw6z88(y3D?3roGQj~X>9KV!y>{0AR=kXMZ{KVrlP z^H;%~pFVwh{?kuC&5s*5E`QWfM`=1G`M!Po=3jg5wfxghKb?Q+rI+&a=g-einlvfD z^Ugcx+qZ9@zvrHN@+wTU>{Ij4KmUBbSFc`{@6Uh!a~#A$=x8HJWzGs(iHjcYhcF0#Ic=fKZ{euanZJA_+EKps2uE^q< zGJo19(kWdlY#8(|&B)Su^Q4UJ7rn3IV6K5Jg{0lHPR?fXs&d!MlBIRJ3RBugldyCN z!952P+;hZN0KB<0{vkSH%5}9E9aKk;hVsaz9pu(5vXysUSAmsP9c0O(#TrI*^_G*~ zy?V(lH{C4PTyu@Q`|i8)mBS8`ub*^^eEsy(Z3Vg8uDi<5uKbCvWRqInYF+haq;uB} z^3X#M=_>yr+gdsJ;DhBCzxajBnL9_WzUnI3V~;)MxZ{qKK7IO#l92rLr$4iOZMH-x z7o{g{UgSId^wZ>zfB2)k^2)0!>yq-D-~HCg#>#h-O*XOZrISuNN%q}$U%Ba~o8w)2WFed$Z`uYdhZe)5x_*veNq$yUj$Vpax%L}C5vaq^~>>DpMf9=x?| z)^}66@4kPDDu*)al~?4DLk_Y~yt>$@doTIjZ+|BbJn&!HZ|}Y2-~$hoX)~tV_8$)^ zRaZAik3PL+&a9bo&NsdxBSvg19XoZA-~RTua__(ImEps;lVAPjxAKc?uhn+kNb5XR z+PAMX%?wnkCWlsaySB&18~2v)eeZj6*=3iiMl;;nf|Wm-7T^r&pa1-)YH-tK|NZxu z-FDkePC4Zi`S|0HP z`}UQ$-+o(m-+edRW<*mdOP9)`>P0%<(vnUxR+hJWFu}AnldQ`wkbIe{(H%=Amuir1 z-FY%e$(KXOWP2&C+}Q3bb-B2-CM|q^fFn*$A^24NSiHyMGKe8S!bLrixw@EOE0}lbhRn7XU~>LAALl+ zbnYsroO-gHc;fN$!VAwDVPA6brP9BDKk3)6pEerhF) zZCe?Cy!j87U*FC8+V%&Z%1})~PB`gA`M>}BKl$Y^e<@u$bvDxb!yo^sWw_MNBX-|? zcM~XF0pz&$zzc>YTHa{eWrrPhkW77pJoxYjGb{ue53d6P+9;9>QvD@g*Ih~$S4nNUj~sL5J+l8V?vV?xeoS;NB)_`vLD}J_ zH_FjJ{=3X9^a}W%PXu0;L$J7zP`M>pdt*0cq@)r;dUo%wZgpaB>#7jok=2Y6MmJsE zZoAD8`QJkiTHH(>FU+a%K*?8>wrj5wxkO6J(T&KfRO)LZ0k%o6KJw06@0qD;kOetG@1^2B3L$P3RuBlrB{uhLMn)C2|l<{2h`rdG1KdQCGU<0g)mr=A%p zH~;Z>a@4U$8{zM|^DeS@$zuDC5`?u#?Evis&4I)BdaWBmh?OxCd-Ukh^4MdK$v*q+ zV_};Mgo+CmUwua{?yU`QqYZdUh^Km@zB&I}-;nM-y2wba$D@z`PcBly)v0?=+3%o( z&A;z}{_@(ZubG|CnSi`%0W)XJmGQaGuc@B>WUxoX2CII#te%G5G=s86wV>M4G{#~ zU!|HQ8U*Q$eEMmrUcAIM>`+YFEq!+OhBy*o+Iij)lL-&=-m(NFdmv4wQV*UKh7H$7%jYm_?r%L05(Tls=jglnykT4;tl;Bb4 z@4N4Qx%`Khs|%0A=4?{))KMl|D@Px3l*N1Rt+z?U?8Hs8cctK|C*F%#)VMWOq8d*W zLZrH;+DHJDsetf9$r@ep68`tUze&zI>kPS2SB@8a`$9SNkb|u(?JA?gP|93d%F|H@ z7Z^jNT+2Lr)=b-S;4pmbxUoij2mwduE}iZ1OFm}-Siy2|?F8AocWRAQc_^0Ot8nJFF0>*SaNM#y;w?JgIdyt7o)E|x=g7%sm!=1@83z!B0%$#Ll5 zt>la&cav{@c?TIZa7*D0R94<4DnQbSdYxqTYHv_+QKu59=|^Ch(2)<8$VB(LqEsQU z#GY=-$e;gwyOG#+*Z#&2I~+PeNYBsSyF>R1iQs8~5mG`{dhizrCEIq{u2CGTM6ZU?ut4^8EA9%Q43sE0ZQql2_k& z%bu=+MA}zXDj})h(flEGwy)YN;q&62E_J1L>0-I^%AeS3m3?aJgBEe&g%{fP65w43 zRQKC6f6RuvhLqJ$3@{v!EG-AH| z^2_bXDTL2XJM1V6R8Tzs>~q$y2wK{4%$PAIl&LeM?t;j{782V{EE33Vl84cT?qU1jdvxz?v#T__-IIH%$T%BE1*?!g4p)=aWN$-OpJD~T#y!B>>(3Og(F zGC7%FlaWkaTIy@^!e+r@od=cq_Buhj$`V~@%~ZFV>N+L2dRe?^zOE|KBeE(W>U4r> zdPy~WTD+Oy#VYo%d1SJpyh`4A_jTEKzkTdraN@*qN*Y<2tmJ+1#ov>YPCh~YbML)6 z@gs6cD*;TJIKd9HL8p!#W!|hg%l5LNCf*BJtiJ$fPNgEzckQ=ts6E&f)h9&pj{4fAx6z>Q}!iHFdSNHG(^57QD-G$t9N< zVZZg(TNZb10znHAbD+x$e4LBa>Pnk0=9aZnvaf0#x2o4?gsu_I*xfOr0(~*_uq3$ozTp?R^IqTNxckb`HeJwj!(HvpKfGqL=4pY2R?3 z01%RH=hGjMG%I`_Ax*1*$f`yH!Sj;hC*wXfO@i}+H{X0yUU>F-JIEfq$I1^#J>e*+XwKJ%TF1kpz-g;{jHu#YrhvI;R z0&U16%K-uFD-!9;-^u5A`7PTZ>AGpscjFFHp=6)dh5V8^Go?Ge>wFlKC_?DAeq#@N_2G+eV)Bb&h)J}XC z-9`0_q$D*A+qHH&kz!@0_t`oV4Ar$uq+^G!vQULjSxJSi6nT#zsjJ0Zg!d@;RP{UW zyrZkY1(M5W?9JS|+Ircf&nD8Ta~ByqeuC80M63M1{rkzgZ)?6SI|>f=87M9FW4J*5Td0zS#Xp7?FN5?xh-8 zMy9GTSfZNckRijRL;H@hVBrFpq4n6Ldl#89{u3krtyB~HPz7eauI_6ZGP30s15}Gh z%Lng$q{1iq9QsyU4wjEU<}4v^TU@O8S)KEK0zzTRlu4>xMCU^T2W~DiXH1i7b+2Ws zinA*nG!Qd2-l$u5iD zkgI0pb%fiOJCh}KlASe0Njop?O4_NKk+Vl$8)}u-lf3Z6j|0t;dKCnjM48m7$(K|~ zCRrlM3KbNrB6XFRS3=h5q!U^Hr7C3e+7D!^3W*vO5{Z=v3EsHoYp;ANBKj^r-~3VH zvW;yfVMK_0wu1x`3HHIWI;q(Ts*b)$t9h`BEw8MU+NDb*UB(_X2hLe77jNMiF<4cvEg?a82pd5O*#Wd9J{4kTGpGhC@H@6^Z|5_m z=~5->I_cb@v&>yIuTg-{QSG5Za+w+xysB}kP~fv0X{{DpN@#QZ(2{1M;WSCrCeRLR ztJywEDDigCIxbXF);82SL##D5OI5?sMS-?0nhs^*MLpV$vBYn3@YpcF5kh#jnc|?v zj2*OF>PMYuOU8xQm%4i!BOtNcfMr%0!$UpaJMCXFTglGMVPFRiG16bqgkGGLez;hWQ#SBfO~HkWhkAvd-&7 zPo(*bv`&ipT3fYSWVVo1fNZ|_Et&qnRZ>6UU3-K!qkTZ}0k7xuEfZTsm+QFn_%crsB3 zwOXENVR`kWy}2iER`1y3hH|0RXh2&iaPRKR{9|^5m2Y{NI6OQk^aF))C>MQ<(6D^>r#XnG8PuY-DA5%gO&)@R zkYFt)rTylC{t+zK&%2g z*Uyk8W1f@j!dXTjrYWel0&J?Gktn^GR-pf)Pb+&`O&k95yU7Mkmw$~nQMrNoFAKt? z)m6Uz%xY{BV~T+sEKS02-)D%gtSRTZ(Gz+{)yQwm*2<)$OV9Pd% zllY3#Axt5GQB$ie1tY4ONYJZb(7%o1+f3BN`WKQ^U)+HENB7hvx}uHwXUPF&E6g9n z-4XavO3TApzo>s<-3U>vJ=X;BJlyW(`&`=f>KQYrvaoFgc7 z?A!a(iHwx004UMbUrDaPo?J@se7};p35KNFb9HKX>20ZqY9HLERRE-U4Aw}$d58## z3Ab_+{fUrJ;%9H4-#$PyKxQS-EcBmi6aWDMrG3ueUSK#A$!mJfQ|c5!CqJu4TS4O4 zXt0}mK{}XXup%{z6}4w!9;;&Fb;Wo(fUS}fU8ND3m(n6<=U70)BY^82DtjwC6 z<15ATcxr=O8jT-*oA%H+k;%6Z#Ba&~yEaB#9zPxeEVsK)JVYe2mj7GkLOEjw!hu{? z)i^kuMNq_1EIcL-&$qEi5%fx^=vMs;{%M5BaHq{`wD77b;GAbN0`4U}4M#g@{O((T|YJ(?~xatZssjI1^x~G`%In_uq4U%iXUvKSi znvfcXRenA5*~3`noL$RglryIKT>Xt;d9Ao`InJi zRNJP2Z``a1#R#V<tO}$k-#XPql-Sw2FhW^5EZfHH;3SHZXK!g4ppL?nC^M_j z=72a+{i00mf8$Mb$t9HnE$Jvg@$`$kHs#zLAQ0I0h?5l^yej7spF>oIWzYfA*tXnx zKifs2D{O7^#!o;kN0DTkk7!%Z%jk9FsiR0srE?LFuSb z(i(-=<9O99FVVM;I3!Q&710#Xd^kZmQ59a>GW?x|rVy`pKtMptBC*l;Us=W3rE78( z5GAS|@byr4b7}JV6+6%sX2W8sSTaQ>zIdP1e(;o3O7u*9g9fil@XK91*_4seT)n+k zfso)`ih$;!*nT;HK-bkudToGu`HOLYx^V7-<`4u!K)~8ZqSJtFS9zwf-p`5>yV3c| zqw(H#eTUvsky5Q54yTFT#D6gd)}7i5l%BUue+71Sk0P>nj}?Pwq1t7Z zs{*@E^-?DF$#Tu3M9T6t zw)GT*L;z^6kOFl2reI^%DpJe)5ymzyB;KkFRp& zU56kj0s>ke_%xdmc{2<@W0~OmAUZ=>ksW=(bORLvXb`4FXe!u9i*pEEtROt^WKTG$ zkO*5%>m}GW;$=8qg5%9;gaX2X-kMosO`bei&N}NXIsg3g<>Zr3miOO(U%Gbfy6ktk*A%1? zOfbQ;oC!iAV67ppvI4f5PC4ZiIqImR6H)f1z8kFu>j2ukhYccwY=Fid$&n z?v6sg_!Y$6;_krRnsRrn$iFaLQ)X=-2#J8T0yG1@+zMEY@FBj#4m(UPy67UgH%Z~x8lOeSMt zNrUjj#g0E|u?>eiZALs#7kAI!^CKFEcfLJskar zKlK6RM_8|$+bIjCuw3r%Wg>0jkv92x{uul{zNg`N_(B3ZhHx0-;Lf!eJYSCoJbjF( z$rVGMl#45Mro4nB3}qotp3ox<NSZ-`?_YLL*P&Q78Ij(V|7m9#O_lSv`LYX}BA4X&XR!X$#zl zOZpzhiIsCG!XR+*$Bi^S9%)fG;$gfU7(bMi_M-m8B_3glfjESxtfWWUZipYR1IF8d zD``^>?353KAMPHPaxs=k+v8xTUbG{2%)*5Wtt|-8m3AOM+7*xn>5(64WAG;~AP!-0 z=Mi%9!k;*}0m?^z(jF~|ROil}uWYmj1hfbkq&^t{SIpF@Q)T4Hk#ff!cNiJI_~MJw zty?!EBqoQGOdO=eL!! zPMs_+`4Wcmvkgc-)CqS?d^OA!H^Pu7WuvT~CtT`q=UhYxR?$d zI#?O;=gBzyDK|ob_>==Th|}BEfgL|@57Gd*W4s@o&;f2<7VNlFPx9fOHel@HM*h?d z!G%9%A};mxyr?&6;14`+{E3SpT?n4Ar0a2sgWcPXcz}C%^KyF}?!BE`3W*!pa1+v?!W(jx%%p>Ws^-du?gW5DGuT?0Z0#j2y9(^yUEic zZLZXXIz0B+V@6u1opzd)g~<)cy!z^^=DzQ~``RSM5Qn%JCN)>Dr>E&ehoKG-Bz8a; z@^?@s!gyO?D3hY98QxDuo`-vx>kPkliK&DTh zZVx*gaKHhw*=Czrc?eHCkVhO|M#7Ljd3l=L1L}*Nd?^=pCt+_h(#4;;{o^11kezng zNd^xdY<0tre2C-ukv@j_l#9Nh4PC%^n~^s6o(6G96F2-Q8-fWt8X#pL9m;__>AwB; z+x8nPj6?dzgIH6yV>g9aHnK{|vbUjR`#kzu%Jbx+wSGkr{XC@*n{Pub{O{BeiWa3lS=#zk2C zNDILaQIZB_rfq18r=EIBcHD7CIsNq0E&k}yqh_fVOAM(&xAlo;)Z!@koz+C^J{`c0bz2!{AO`y$?y3^eBtB2WeAp z{3r{4^fQLEX(QsJk&|A}o;|HBUcZ(yK}ZCw6)?#d%n$*Sfh&Xpk#Z(6VZsFY_~Vc5 zr$|}VvU2r_7zdMpfeN^;Oh|axH38``nMsQY$|MF%%t@0bSsixSWf!X>{?v~;P)Ep? zaxsBlfBkiN3x|h=H=Q5~kemzWc6eAP^31LfGe@f8OFc`BDy6kk38$oCzq> z#@&S~gi2Tl8h_fHRi&4^usvKDA=Frvvm%Cw$e;e;jreW1-PQ<+K6&=pXXVW|-!wa0 zP!OJ{J8RY~dGg68<)e>2vNnUH0A-=fAAb0u2_EiApXKFt_c6RbLU!~XUn7taXrztiGk*Md zdHU(6Wy+K(rVY~{v?q0@UbH#=fFJoFxG4|y95rf`yz|aGrcF~9>htFveavCsTfRQes{^Wt6dgPHuj4&W&$P|L1d>G1wKtix!r~M&a(xXlg zI$KT<5M{sNh8rwT7a%;c%+?@vhV%$e8Nqw+y=R0tY}ha(u3!K9*VaEOfew9tRE_XyvB92pjT1c+l4Xfk6L~Cxl6So|Z!>(pHQw!Z1FlD+CIe zB9v%n1Oh^vv?()oh?=_N##R<2f5;(+SYQ78-~X1q_S(zF0cH8`fB$Q3O#SHt`X2kO zx87>?A%C{O5c0EU&o)6zd;RKHzq0nDEf6U5{U@J%V#0zlA*|W9qE8TJl$msKf8~`| zhps3Sd+OCghaqv0Rz$pW_*A$ zaNRKZFg~b@4dl2R*L5Kz0BHfz_H-#L6PrC?R^O02BnKIw1t9n!T?mFc9ewoCMgaZ# z^|Of%(GDFt)Z#!YU;gr!jld8N2nk*;M93ga{`R-O$$ABw~XK*7Q#WM)PZnLz>p$wDHpO znw>sJ^E~IAbCxX-2+!9BMvNF?_XtnQhTx-aoOMC|7z7!4Qcr}~2`8LjeZrVQh)@su z2BC(4K#N64Fh^()AGbc1v9AuI*%c757T|-@uMAcQ1QPHS8iP7Mkk=HX(-J0*_~b&R zXO+t2gfLjau`*@#2jN0a5E0uTtom?+SP9Pxle8fr$Q0scLPMgEIakQrx2EtzJ0U)+ zamWecfix)-LXz|$Me-tj%JH?YeNFb>dv9Bz|NZZOH^Lc-X>ZA{xxPY9m&!;kjFpL(NdQ5W){ zA1Nd4OL+)Oo6^p#+-U=EGyEtYpezVG>Oy|>9qEt<<)O}mrEdsJThO=olRj;PKiUOx zDGLG=;wL`@pf3RETl$_bv=jYC`B<<}KFUp59r1As@LwGhghaqPhfin*KLZ&%gRyW> zw>D5dCN~7gN{?0cZoBPft4LOHOn!))x;SAmd6~qxGwC5m;6#r=f$Rv+XI9au9}i5F2okVO- zARK5r2$uR2j;)~+Pdw4Kk#-_RzM zi}KJ`e{W~Xh&xv=TT3AbiGXzq1~FhDV`s3pBzyv|sVN4^>jVTKCCG)z%|ykWi45^T zluTMklzUdJo-Pxc$qtAMF%#BTfvhee28e|;*&9FNh$H0CLl3p>6Si$2TZjWvBQE5_ z7Srvw-);np7C=~5piU}ICX|`7K;YyL$s;V-&T-P@%F3SAHf10@Lzc}rJQ~x zUr3+u#Dj=k=&;(33m3}c{ZAaWk2tSjTMCVV{3$Q~81kUa$ODb$?6c3d6*t-yTX7ID zc_MVlpEf34wvT8B&KlU#LU2+B`ib=EAKC*!?ShPaXkXftKA_xaKpxM>Frci|ojfs= zkG5g^2M`y3;&3HD>O&s5d3v-f+6|8&Q%?H&^wUo_jg4|(NZ;cUkFs(lP5cPs=@x^J z?dF;wBm&kM7;p?~1~d~ceviGW!QEOw8GX_N2-<}PgaeTfhP`zTY1!8%EL$TS>_WtZ zrOtp!4N(&p;$*Tzs`x`#*x9bQ^Uga>AfZ{X(q?}e;)O6s!!;4gw%>mH*(cZ`90-F| zxDyBj%IcHwq|Fu+d12V+ru}((27=}LT6f%WhaJjNF31==B#RKE?!4#1m9nzO4=F>g z)W?OS_cLWD9j_;(4#{z4D~Ky$i9?#S8-~0P3T$PeX;2S{nKaO>Fr-6!_;~}MU)a*S z>#n=3Eco#$82W^*Km2)U!Znfm?z_+0kM^M+l$nEV%1ylyz_btfV;tno*^c+uLk~S< z+8_N&T+*aI_;DpKZv)aHK7B`75z6!}ao9$qOw=`=AL#(fM_uV#%7tJe9&Omt2nW{z zUkFyT+KGd3?#7h~!$e-&2iJhK;^{Fd5d>^`U?5W_C*^=7SYfjQhGZZ%whkaBo+4tk z3lTubtgsm!$1I#B$K77H?Cb^tSyialaf4HxiL|h=;VtXevE z3CBGvO9&Q&A0)_?NlhB~Qy<6<5{GbHfRMfu1O!T5ok(dP2#zr1j~i%;6etVnU??A; z9Jo_A?D%1aEXfPQJ!DUPr~^brAK*vb$q!)(ff5d3PJO&BAVCP3^8@ZlgK*TJx>E<- zynfV&yu5yHfV(@qjDWIJZmzgN$b|QFX&>5~d+#d<{oZ@;wQVVg*4u&bb~ z>c#a>fBKU>ic4P+hw$XZ_#iA-+L-zwFesDzQGV>CO+4ab+>Nk=;YxVg8sSR5l*Pk& zzmbNQxg`;{n*!E382E1D_bmY?&)PIT!CC1$*)S=wLu%B+i2}n4ohx86lLo+@uuj5| z2v>*%@`X?l5Tpx9ktbmgk`NSE%7UMljrd%>E!{nCNRRZ1OCFw{lOpAUlt>p6<(|3{ zhpi7MeLz~2%gaL=vNNDpux18Kf;<7Erm9qiTqpsvfIO5{RJ$X_W7ub~1g$;fPJ#S~q z;bo)Eh)>?6=j8@o7RpB$@+KYP;ph3`=Y8((Txm1LhHp*b-jXH=iGYA+fQbuO%|UET zbSFV3FjwvY0)SN{lNvX!5EqjjKjJg7@q+}2B%O0`Tn!t=V>V72+qTo#cG9p>W81c^ z#!5HoG`rNkQc1$3%znT=wCV|Hh5-AWW1l>Am!5Oqu z=c@Hnb}6XB+(vHL+(?}n!%{yD+|?Uig&M<5LQvwlsQ;36IwJ_-K@RZ@gLl{`=--2W z5)u!h>_Q_jxq9*Bmc&&FbMtg4lHKe5<}wn?CY9-BPpMG77kSNBH>}Yj|0`*ho%pRa zbWJk!wU1?BeBZ>y_ogq}EorttkzznHyHLinl~99`)c!Xmp83G**eRlc$bz2D$=>tM zP;zrmmPbMiII)74E#?~)l06lg$(2iQbZy}%)>bwP$QlfqE!tZrLDD!oWDT^>HD8zv zo~#TBFq(r-fFvfth8sA5QBb;2(0^c^$xF(5a0Ue`Ufo&~&IGV&qM$+vI}7X>5mD_3 zv&erz#29OQiaw^jUaWwhJj z5?EhJ_rh_(f_czl`z^sKzg zem}$Q1$3cA7_)h^YKrL@G%}(eA`(+%VE=9zqQD(3cCFQPK>ZI1!GMFMAb_Fq>cI?V z)RKI{3o9slR;056Hfa)xtP!KbyLz%P1ha-SxJ%9gW z6-KpynC8bWl9&N8dGW&9C;Jrw$|i3be1W`+O0G{T=Z;TTpDkX4xU1A%=sVNk&1T$z zMIHaO%ktDp@30MCWADk|=zQUTC^w;COo244j$D7gEt5DvwO=65pe57tu<~g81FmOG z!!g}q1sKgp)w$}Q#o-8NZy1qoiVcvFL96iN9x`wwywnaV>VyO1`Yt1xPhtF?zM&!Z zDw%arDOMZ)6cMd+>9LZeQuqCn@gqIX&U{w`Vjzb1f~xy%pK-tKw7MZjagUdnA$@0i zy{pZPrb_rRd7T&T5*$n&n!gtrHJ3exdH}7P07cvrqD|8DlLfKI%bw&dve)!vqcyCz ztF4w57Iix^;zNYeirKpTy!j@z`%TQI<63<6@qOd5i*oa2q2(;~*AodbEnOG*<)*&v zNo7Ez{bQ^mX!p)v0#@_f-*ykZ2ETpvv-z$b8Cg-YDWzZz%@g9m!@phcgtpU-CcfmTg}g2yv;oyM%+rM6R* z(*@HD#SfBCt<6*x%C9R9{o) zFh$L@ZvIYScpyRhl%?$x5l5(SXbJ|Tw<(^NCw+bzN5!??&B(|VY(08B!}8}e_E4(g z>4Ctkbq7iE`+$smGdGfu+5YkC4q3C66{M8Rl=vw=M8H8Zqp*J-7u5Fx1$n7EEF5>L z-Yi-;zsXOD&>LE9Z=Z8$1ehnOcyfyJlNiTuzFS+fTJshmXB|t^jrCzSkx&s~!$h(X z=^I^%!v)0Yun7+QNYAx{?xuvqgn~0$>!Y!cFNO`FDjIU4MsnXSd>HZ?McPhQ6Amhc z6;>aRE&EnvGLS85J9ZoRjT()HhLEh}=R@T(i($J#{UkxVdD^ce8gmME9r6D7izd!D zy{&_dPL6o;NKC2M2(*$l-GD0a1(A?MQcln|Avj6(d9 zy5u5}Z+WdHdIZ)1*IVCQ<2~@9k!kKHPuwJFM>nnxyGMke@yXsj?i<-qkWd_(ycIFU zPe>WN$yq5C;$~xb^QDNDU~)8Q1K=uR;YzfVq!BL&rWio^@3)j+N|f zHs?dt=ks-QeDm|eb=h(9TWZxpW(F5}j}&2l?4s{3?q+Qc+TJ0U)NXk)xafhEJLinEbnIRZ0t}XrI(Zsi;r=Bcq z8{LoqOU_R&&}Zqw;yC1lph7Ei>Rea0|ECO2x!^3KtOO=W>O2V+Ql!G>5$lXQSv;fD zjCFPX9BVa4ODu6Z3fb^pYvHJkrQJd^+Jt2gx~!B!BQ^0?Im*g6bz8-Iu{EQZlg}06AUqfg zV-^Le_0OME8(E90qzIxWn9l#*zM2P8Z-r4zeqr73=eFa6nEG^^?-#E70q_iABu5a! zrE7ru|H08Cs6Zv6SL3$w?RUcB-SMo+$z0jP-CPp23Y|dEpR4WubLw(n;dNL%;dH(- zKQ_?&obz!<`3$Uus7$k*Q*?Zu_y1Yj$CV`TO#=Lxf+XC$-%s^9LD3Maz&Wt6um!DP z%@q^q7-`v~^My1f&Mppb@Bn;=)DDrLHIS;mE>QM!j4Ca($nRDc;1pyO z&#;IVmRMA+zg9A7+SOWAv|US*6>rCjvqFF$aSBK2h6NilJ@*$1oZE9=&Mr7x_Mk18 z2j|tWrj_N0eHiku8{#w&#LcG>oLc(L(dIZgf4(qO=hEO3)n2x~sy?2)$WcPz-Z`1b zc%HIL7Qr^n#^qZC$riCdt%hnHucgg)!}wFK*)S2AhHUaA6Wkmo6N31T;G0L99~U60 zo|%KNkkVDS{v`|BJ%k+G+J@a_+{u&5tlNc%JmtYE_Zv7L(^aXG1dtAXacgHAdJ5 zK0-g_UxM_1&P974D(kXqq$EqK1y|=bjgVKWs`d9&s~c9BchvEeO}FZt#iFVRuXD?i zPw-?-p8b%`wT$jpw{QkrcPqbV!YG&MEo?`a@# z*rI=x2XpgIEPk4puZ|Uj&SIF*@UUg~oorB1FGGzu7KECbln zH7&vULsPJw1HpcaLxtyZWVyy~cYm0#HP|>2<&F5JvzC!XZ&@anZhX?2fvRqa7UXfombAL+%JcYHuuS9ISnyb=j2ae$l2nT* zq(WfGuF{&;1YgYqi!K(W^R~`JAcs|Sgww@9c|i%|TLd7K}~kkA_lo%ur$e(QP( zp0Q(U4TS<(z>auU)!(XzIqoiE0c6>c$p^5&rRNfD0LC1;EWJ*TbUR@X;RZPfq^XeV_^4divPZvianri3u0SquS~MAmT`% zgcsr%51b)$5+bC@>B)0>bf<6KOw^@t$Yc^9Mv54w+2wS} zPa~SM&q*er5yaf(hoW<6b}8iIu^SF?(ihA#sP9AH653wmQ`JURFJt^CigZI=lnb!u z<`0dhl^2fYgru}b)e6MnWgNp#T064eh#M&ik^_TFg$B?Ek>`19oQvthF3Wxh`t&tzl$dH(diou`-vEPS^frq_6tt@3OFlVe9W(Hf}RPYc^U~SVzu8s*vMaW#M zdA2(eyr=9$2Gb9FFqYxz4(aSi;C=amyfndy`COGm0sccIy4E zL_@0YBjV$|Ykl)h>qFtXaZ7l-R#0M1z5X~g>oCvWouX~?SrL`Pq%O;0j+0z@wftyX zsvZ#%!i}e{D@+?=pe;*VQsi2PIzQ5!`(qaCN|!-rO5Ti+Ts_)Piptl(4I9bnXzF{h zTqZT4H=jHY)%Vo0Eln=lyr}0bv}j$!XVs&Kk8{q=#1?@!$*<)L(|S^P{%@mC;WsO* zm(tGGSr!z|H{FyuDM&+JG~_hDl*eMtw9Ktr&_ke|8>clP7&SXY3Ea;~%fFAw$QW#3V2jsVSF(nP2A*Dks~NocD!f!cDL3b&i$*( zT{ql^*`N_u05_hm%<282ev891fsH{r*vi)(?~!CN*vrGKIed7ip;XIXL4)$G?Cd?~ z*$k1yla{&#Wp#g~3EF;DIGT?onb%KDRox?!%+-rv6AV{lnV>sbkjarV_mMDB$Y)W1 zzDohek+{r@3pCAn#8P8VdY5oj*fEXHo9RBGZ(sMgB}2$hr91(ee4f zn=nac@}qk~w!ig|@Nx8xI?-gOb(FJd>^5Eu*GCl(GOPXabEzd=6!PiRG6#%t1|rQ`9C}`V*w}pp zRW4#wA1~Hx_CN+l333C38fD>{-C89q1>=~cU_uQ75al>{J*?VhB5(iMZCcc0^%wpAR*N?QWgzH-)d;&o>@_l8S3d^b z=rb^kv6u`So^s--03X=N4g)LE5rfRff18X)p^!x(5^B}?C+Gc@EUJ(Vj5q@~&sv|5 zSjdYF!C9leY}~j=SFH%uTH$!5Ds;|L`*E$b-Kx_>;JD#3E|mv)V;1aB7}k z0r8q&T#SX>_5F5}M*-LPB^d}x<-~8^ z9u;v@S2kfWac%~4mi2?`nU)_}Y~&jyQy)$DEerZ4h{A?D1K2J{+2ebK+9fvXAFi7O zq$16Dm0$(pU+FaqX`hw3pOXrVhtHdnu~kfE)W^9T7p#_nq&2rw_xj#5re11UV#(OT z3KD=Y%9GW2WmrX;wlj=JwDj>V zfE{54MnsO8heG}iTpNYx3nx4H?~ zPGrWiput2LZt?*=UEVQ<)h{VoAzv0wiLg7qBVo4<7T5RJRz`d@GE-MB%O3r3Q^v65K~*=A!MzRvfn?2~+aY@5+}q+bYG__+ z8|R|s=R`xRLeasPRUxgqHMjDh!2dmu_E@?7AaUP?>(2u`^db!V_OBptYs8j&f;xZk zBqa(PFC5ipVaK_L?JLZrWXqS|QAuJ=3mCs|FgN*>FUe+ty=rPkC{9-kr_7n*Hr6Ehmlw%qwTljF2U^JJnsg=HgIL#` zyWkjvu4t)l7j@RNnauepMu$zb1;HHzHGhJ7UQi4ZdPnJeMp~Mz1)1Mu3cQKEk`W(f zd1l|8Ez5DMd&-S#XV5U8=LM;_&dldGIEUEG`xWC?Uea|-Yy5f#NsYduK4i5K@ z-@0mK0STVz`KHtA=Jn>4Inw|88v&GSALwKt?S&r`pdzE~+>#*%i8`4u7z~S@i^t$( zyMsl7j7-5O&GsoEgidt`rYHyIZYe2ezlR2>DoiC?HhoM;2fmnt7{(>cSPAo}yVMSU zqg2Qy(ndU@1o&4$cy~p*d%su};vjE-jti47XRoi06MlNN@Uc52S-ee3$xV1IJI!9) zJnfS1UqBP2n&!BRA53H$1eD|#3a2d0NoW0xR}jpD@kcGv)%z~9+Do^|Ja!DHWob5m zRR_|v@Vnb;qaS-NhBbO5y12oXO{}Y}RZa$uo-9WhSoH)B8)N>-qy?x$)b|MNH+zY( z<6-zABLQN!sz-G3)$6=trHgtg&+z3Y*E?G2Y$o}4M|JUYrcKtW4JY$W(rwPiWca*| zsqc^La)^9CY*(9w_4C%xb)hllI#knUuF8Vo>@mJdos;qpxlL`fkGpTa6??sQ+*-Hn z^}%;l^)<)_=M34d@oIA*c9g@d_-VH-x3`f`Q@N4?J5LU*-K&6VIy@>_R)P{H{zrQ> zSI2>Me0yH14x}Z!t;h&=c57%J0i2p?r_9ZnmNYV?Vf#3F<0TzOGzQ^UODGLE>`_E z`^%X;8n3bcG`SbYgd0heIc2lJz}N|LQpRUv^PI;i?qa?D`%Wo9@fq*$=7#KX--LX`!|4rTG!QPo$-Vam#t=sPp2R>|dUD%=Z7|t;tAs?|rkRa55Z z<8SI6=pD(dh%A~FEi9hPK%CV?46$|j8>(b8&bBRwnsvpy&~qdNxa}ys8?%SA-KAc| z_x!%OBty}&-Iq}*A&3^Fln&Q?I#uA+Uh37~`}r%^w83g~n9E2)(j1p&U2Klrr%bt8fb}`NA)JEe&;bsaF@ZX46U60A-l4 zp|Hv;6lEA|{uU*DZOSGKqPi|z+k6N;(uZlGqO>-vChKEkN9isYQ1Z&)$U{pOgbeis z^?SaL(F`7y8sp;UBw(Bt{MfTJ(Up7ZYri(sfFP10QFPM>Cpm;CF4}(?USln%FNINm zyeOBeO$hDab*{AVN()6jJZGgcr*HU1tfs<H-NNaTvfe%x`ZAFP0($p#2=;9 z!~{=<^8DGyXBRYoXDUs>UbS%Ccr-z*oVql}WN0~5ITzLNHNvGWA%sTF?dquF!2icj z@~nB5A1VHP)CD1fn%st0?WO!EaO+V?_kS;0Y0_}qDy3%SPfrNtKm-V=tIMj?5hQLG zg%{_pF;;$ks~`WWBlTU&;(m;@r%@vv4xIpfixu~+M{+8V4D9 zYOGhf!Ojr3Ot{{HQ7ZY!qC+?wABo(nS)PqbVQ#6Uc7ExD5@HZU<|~v6xDthv z`#6U0jF9F)bTBD_FMW1O9=dg*>dYt{`2fv5eew;9PptUt7&Xf3qp?h~EG@mP-r}F| zAd4?!Q%V`=G3R{Jr8v>*UqrH)^z?k_Mq0kQ=ZAArYHBtl=&RzsTL}iDa@G!uVsw}e zHpeD^ryb|O#sMNtlqEM->suu@9mLs+De}|?Mlh+00Se_`2UdyWoTR>&S$F3pi?P+% zPeWBQgsq#s&W?xYtXpoR#D;81OSW?oV|Qu^KIc6ExOMOZy)HJok zvGQKF^h(*FxNHe`x}#e#)2_I;Np>`4f&l|*{LF-=V=VD_QiqxRM8T(HWEf55=VDOp z>jU}Y2e_aV21L29c?90yTV|Jwc{8o+DtXqGujVU?8KIP2kQa~?%=TQ=1}romNyYpp*tejK{uyS4Ohuq|@&?PVy>d|vG`v)J8& zIxP9WmKDdd=JghIdVNabirTauKhAWC@E$KWgu>Mp&T)!%gId#zZn&#&E2TgCRO~Nk z{w)nqvM!BG4Vys;Y^JWnbXjSf!apZHJ>~#&RUS;QC|WxjGU}d&Pb@U$34JM3+8+2W zEgX#heARSoZ$v2*Ym>ECxEou`9OVGvQIpxMj;7c4qp5w~T!o}5rymUUiU zDu7C(lHnrXbTX9_$Ff_+2$5;ZPpOIqF-x5E;u`wbY zH)^c|R$*)4GW+*sS~; zvG*!LdOjLnXZ;?&iRu4fZg$Ci>c~o znxa`bUqt}mq|{;u3=Qh8O{y>oksaDKaU<|KjUhG`Y6VAg3?5dAEt$*Nx#VeU6%q*J zy=^PAV1VoMKFLSJSk31T@wyuinONc$mj4;n%o|DCGUqlw5!6tjgDIS?72 ze=2!@i%mEvDoiQ~O!`U;Gp5k0nW*?;Xgr4w8%G<$Wsf>+W6rtazZx0r%C@fu)2GSx z;U?H567gnS9s@wL(R`iSR5c0|*rN28j!BT4A%15FaXHN{a`R+D(cf|!~t zTE*CDKjo6ot9}!lD?f<-B_RK}_9oVnFKKzDa~jdE<(#x>H;Pj)dLyR^Ef=K{0f)1P zt@_l0#;V>6T-q{S>PQU}j-BSq>>so&)|1QK$J@xrgMUum|G$`SVJvsHdI?qezS;mQ zGN@M260jJmR(5n!&_4U--e-~9Tkj4GJM4jHki**KZp+onHCh_dbT zv*5@A*-w((Cu+219IKn2Sx=+W74X+|F>zfFBd~!|J5Wp%C%)Tt+v_fj1T-<{tp5Du zwK>BThb(4_3Jpw}l@^>}y-Ke>!Ie{a2*T<6s!-6%ykHxI&#uj_Mx{6jQG%YqaR|S` z|FZ)>-;>mcwqWB`4J~G|eJYL6Aj61H?+kelyW3FGGGVyfK*?jH&}t&0TZEDcUg_(;6(mi!$}cRTCL?vK2SPN;(IRC&Xdo( zlS$s@^Y{2;UqBUON3^?bXx3aN3=Q1GmO8*} z;_6)R%R}>mDLp7*!^YQZ4s&VE(~tnS9P84nj|clx>zxbB zh(eisVQM_r$XATE!FK@0P1!hDhaiRicTufMg0FH_JJTGF_69uoxRTDxQIYQ4*<>Nu zPBtO@a|Mqv?MfAz(eTQH`>I5y^+nt3>9%lqXE5^Iv8xptqS7|3X246i8B)>a!14{2 zKBrq}mkg~YHFQ7Q(vp49ul-TOAk9sOGw9x<23E3v^*oZr5?2ah;B2`e_5F-e!-pYh zGv}bmmR~p0z-}Uwb8=&E;BP_b8wYzVnU7K|BoqV$IGBF+$atN1v z{#px#$`@KVl_QO#O;oCs;WnmIu<(se&%E%4v@%=~i6!{9C-C_k`vsRnRy+oe`k&x!)ikgE zAMy5I5U;yix_@p_f^c+25lT()6gsh)Tvi(zVx*Z#~eM&KU4#WAlY5X!z3Sk$2f;)q4M`AE{*o=-o&RhR0li8}E|D z3KA29540a`bs*7Bwbe;vFpJCxO5`&!g?Cp|T=E%sbkQf=HnNnf_U3k=MrMk#<{C_3vcFS37aAIh4AZm3+ntChlKyS#Lx=_R3~K9S@s>F zT$=$IHS^~?a*oQWBO#Zmy>)f1W)_z>r!aD*;S1HFTmBTY*fqae*FqW zxc-H3XKM5Xa0Oc%>igK()9hU3g87hXDy^2vNeFEC)Pmz~?qC8legCG`Vj)i08%2KM zP4r_?-T>Mw#(>q2Y#K@m;uo^pL4SUbyVtMUR>c3TU9vLHt}jp`Ik!Is$WwI;k%U_X z-WR*PJsU!OtoXecr1kk!H5?k4`fI6#L6@)=54iFmN!x*7y!K zGnM3$#14Z=zFS#t0Q_AweGGCY@VY!n$B-p~ZRXSn#{+G!lL2AjSfke|D>y}5D8z?J z;6!APLb5mf{=zh}N^=DNVm6g4L@_c==B9iBpa2`Xve_+DqB$W3!ca)}fR9n)XdHSFxdwo%SA_%Aw6(Sg_5U=Z35V5zYAwSBGMl+IA#?Meg<$7ndF zsSdikPSXbn@5<%&&_DId!9cFK{$s@gVGV7Z0U<#mDiCV|PHPk?nt{R~RdYHrGU$af zwHO?B>HmyJw!W|04Wvx+{LjYP(a0%Kj(v;^AWn$Ul3ag)-M_JD>_D;qF}h?BA}Rhz zwiAkUQfR9aO%Tu$)-v|Z&n!%0m>Klt?$~HmE-CQEPM46vQyVf8i2@-5-zdWVKh|e< zO#4m*?b%0pMRom$z-eWJ72lOAekA(Y9jmuI&P2M7{Eel>0;Zd8nt~5~WyNb%&5ySp z+POqX$^Zkv?8sVgTFK16O*w=cgw#@7(3gU`df^K=rcC;RU;%;TLutd~lpYNSNFV23 zZvp#Nq8zWAaM(m31UJwMFC^q~3NM>@rG~44v%3??m;%HES5%o)X__6)@YKD`u;PAS zZoBIcM%iyEl+@n);UABm#Lts#ujlYxwC*CRfD;1U2&8YjF}#0yAp3V)okjpmH)jKB zBeJ>^LDqdB;ad+6B0X3yXdMJ_a?vOD6x0`a>JoDUyhoYhy>2)x#$jIPminv{N%kX# zq}ANDc0^T%MitbxKL8)m!nXBSOpsP3&J{MBh0qrc$P-yyMTP1sjCNFjOb6+?A#mS|r(ok6>DW)vJ`1NIXkQ0Xp4Pl4z)~v}O`c2WpTP=^ z=U;0GEYi-@C=CA0Fq>MjUlaTaL9gH|DHg~sh@5};z?1tQ)v zl87Dx?4wW!PhZFA0a&i_Vh(PudYhcDef_a%6QHS76&Lcar^I>_Yd##xq`sj$Qwh zZ@3j_asex{TfZJihyz{W3GoF%>r0{BZr!BoALik-l_7Oh z)L$jKM^rZjiOp*cGOHm^fN9t?0H!KHe$}iXTGmo9@<%)Dc>o)6`l6oa#8^~uZ!;FY zXo*U7^AhnX+L7l=?$SI;ckE+o``|7UC^qNaZJS$qjF(jGwHQH^J*D3QqOAadw(0e- zm%#^zn$Oy@-u9T6h~SUdM=5QH_amcWNGRw9EBBe4t4sl6*kOA+gy((SxvRE3Un>TFimpoCw5UIOX{&7#5qYPF+k5Uj^<1Q6a3w$ys zYy3i(WWOb@14a4cGsgQHA{~lkp*?T~FbW(>3k7JeeOmoGTM=R^E+m8Y;~`wzMqBY| z`$92^T;?~xJI!VgoYW2ExvCtgkP3T=D6Q&PAS-#NpyhPe2QGK14w`BHSt$MHN4wd3 zPkVnsG6;5B?+$H83WFe_H_K?VUbopR;9gxpbU-uK_4khVU%{OZaAPB>^aQUpL`VDO z>Uun0Shu6Y0I?z)JIZTdBW$|*)%8MXZ$w#6$H3 zBI0q{{K5|aJOu|251gR@5;T#+gxI@~FR+(VOmHg`K2JwB7GcPI7kYnjYA9Q( z>cYq&uyoen@3H}i*AiOsYZoCYTLV1>4M|AR{y^5kT@q~q%sS+6k=L2$Y}wwj>Tj?W zD6CNaZFMop$}osbaA5LX&5yfs*~PW`gH0)FTfx;4V>QdtqRHl<@T;%Z8iC*D*V8s_ z^;|6N2SEr2DW0FU8Lh2^piXOSYb)9&B-AzjQ8&1fhP@w=6>F^>uo3p-s7&pW7CZF{;3Cz_kXixIhQYMXr;3~ws zY>tOMH1YL!H*V^J)Y(I{+o0!wtOrngPrMDEKTU2}Cz~mU==ZsA8}d54&JLe$-n%vg ze^HPQ&k-Vmb@gjy6RE6{T5+j}mTqNdEW8AahtZttwqfMO#dm4fP2OWKdArz8Cv90_0l%zF^WJ$dGn>UA0|v zHj{`!*q{AOfL;W_2FeDrwE~V-+|21Uyb#6} z@0kt{^!WXhll^aQg;U#~XSaXyw!}aO+;M3Cs2CblWUs*g&>i7nmK6U#C_n6L_i^b6 zK7rc&OU3|-4Oj$GHTM8}c&n$N;4Brtyq)eo${beh@9jvVWR+*UfH)W!s(?wnwZTUC zi&Zc;mPl7=kWE`HHF_9gNgd9P$`*bSh9`5v9?qH!VU_dL2{Emo*1Cb-gE(`G^Cz3X z_U1c_J;Hy_&nGhXglkOiNsw@mk5Qpcu1 zAGhp&%_8!NI=JFr@^nRO^Z)12%4FxMje_hq?D7mlIS^Fq$Mkf^&q(N?Z$`vb-BCA@ z+?D`E_@-+33Hyg8aMU8DOhi->)SyHM7&AEj~ihN;s>%vdr(I}6!?fg9(@%K?oQy6_Y66|F5 zieppil47M2FcKP(m6!G|e;--R?+IEOUt#CUii_nTCFRGYpXH)UZGvcj_L*`6ik%h9 z(SQju>r?ul)16hhJu#0D5`47CNrwU7$Xt3q7yqYc`jljI$i@as)Hi9eZFBGyLvIM@ z{YQ2vm+c?cqhc?xM(wV&}VZlB_*_r||NP1>0 zGqJ5mrjd#~fnod6Kc9JmLdDv;Q#DCEC+E7&->tiZ$MwRiXc^$25vTF-yZvVIf5zwo z3UWq$wx@h~L0gHgLAxm^vI&07)CybCt}-U2Hs^a!p)SGY>A`dwT0^wHTrQA)ftBE4 zpjxDy;<%&qe*1^Q2g3TqHJuL`u&O?xIc-K)&>LTS)^pEpB3QoHH;R9}UwWE6{K1}S zcV)ytJ|`l;uhyc7){xUEN>T}YZQEfhpP%xJYfxwVYDkAp8O zm%AEKNOOJ%{w^Z9b&Lqu!gul!ak|VRczr0b7|m$=FEA&P-uiCaknZxMc<1Qbg1E$F zx@jJ-)BGD8Hg=0&6Q%)EmgC{yc)-cGLKx=XhFTVmCshgp94e8=^{ z>CJ$O!pN1us$?+SGb9ZWvWIQwZ3@)Xb*_EV%|1|6l?2E>WxA^15zU!q@UnH>sV4x1 z%pCP>62%V;cvuxdrQRM6jsM!xEsk8Z5qLSE*1}UR6<@n zd{H)59lWz*e+~W%^`u;S9rD%#a@IJ|%%+BRWNl;%7$9#d^xviRJdVjNIU!&M{s9I~ zY2Fc@|6xpk!oVszoqAQ9kNzCvvyz;V1MpXw&yRQZj^>gfcd=ap$Fn*Xw=3jyHurjb z9i(N4IN5Z55nw&>)BWVwRF$c)=<;W#7A|n5x9V_vX{(%fn{jth7w>ekpquUafbD)5 z$o$VCws^yk^q_XW4=vCt8!RKuv246M#2@VGcypJiAh{UbHohH-PthNOlo;LSn!4Oz zI!Z|x9slidg_5U#iiPj?4=asibMi$e2ZtP44OqzAIu{l^Q8@CC9p>%04C9l;-kg{v z09qs~>GgI!d;EHM2&*86 zn7-OR!4wa)k5rWF$6)m9K~$9=%=IWiOASn813diBkA*{SZjU>&WslRUWGl{aM0e-u zzNLTq&fD9eKq@#ApCTg95s~{*UML;i?gPNM2@Ku@GB0d@CJRj;ZCJdX?3RIf&g6(g zq)2qwyE#uU<%ah)V(3S zuTSI~5M)m#jpbA3SZ{23+mGoU*?Df*D^TE17$)#m?s8Z{QID~#>6B+^zk~kQHk4i~ zT_R($@TY9WoqO4HvvV)KL}JX^_c`-V7U$$iX{VV&b?4LBEQ@q7@ErJl_SLB#5{zeQ zRXNseZ+Co2=qeAaH78T0udbw+!nx|cXgjS0`xo5#hcaYn-2$r`DNe!e3u>+4L5?(# z+ktA7f75909BXiyiQ3#MsB&U zM7n8RtZgct+bG4_yyK4*&CpQd|gQuiZE zOqG(|B|_FI0A%IBDv0>nN(iNK@n{_K&qv=+(~LomRVyR33~*+B?@AgNnJ#3ZLI!$` zWAGLJG%Hy_3izvGYHa-n-uX0+wo)IS71r*lGY)L!Pns^xz-AaSOTRbV__Ve7Ww5aYWf;QnHjg+qk@KbDMu(qa~e}tm)e$p^>7iT{~BHL=4 z5278@5azt)FoJf`njeGrwO zONNp3XLviV-LF~ISDP)&&ww~H_Aj2HE&oqtx31{^csXr852{V$_ih_B!8BPo`!2l! zi-GPu6E^`2yvb_kav*!od93z3qEf}EV|kqbI|eZx;9No1Z~AzS&y~&Y%}-yBS=x3m z#tMA2o^{MtvjE+K?k00GHy6CNBaxHes0n@9#GA33qyJ>FYOse428;-6%1*a}fHHgj zm32sn7;~uy?0@bT$HPr;HKQfFl%s$*2IzLSjBV{Z{;|FGJ;AcHAsFWn*_p=OZCZgc z{h2d3Nq&r$*qj0?dH`Zmay}JEtFE1$4dMfpa4w2&z&0M!@g zsC&5lvvE4u;5zwPfmQqjzTr{*tw$&-7`2Z2gOyr1CQuYv#c+Rr59l&AdF;;`wg+-v z_TSP>esULbJjdFQ&}NQ8U4MV<_c%|5DWR2s0X zc|YmWb5cM0rnpo?JaKf(04eoLTG4W;E$U=&L+k#v)OP397B|g-$2sF;+BrwA(kGMG zNi*UlR+o+@9hqobMg)Xk+_oslaXy-NhksT(^IuZCIrM6`C%OS5ha`mfW|S$>SPI<} z%!)GgkWbv^yDS+tx>7MxKLk^_Yw)Su0F|vys=Z96fK{}rCHgU9oayDH;}ft1SjKK&rR26am3~)gqg0_HC@g+|3zm?mS)m!44!- z=r5)T4vsWBGpC;rF$87p?+|C@yd|BKca*Y$V zTz}7RBL_Eu;|v1_dcH#EhBfph-`_c?UT7$uEcamL!yZBH7WtTWBzQ6*@b0zm=_)Y4 z5)r28bon7XmyxFMPUd=0JJtY-R-#HVkM)|DK(6xwy#$^nF9E?klp{a0Cp(keK#7YF zur8FPn>3YD^G6I!Jtdr$#l){SlO5HgPgbp;YZ+*{;q{R-DKBc~s@4$?#GFYv4s~9g z97N6H{SN)kZ1u5%uTC&VzCEG&?Gs2}m{SWbiipPilqL=i3l&kQBlW-q_(vFDyn<_c z>)n>GEc`lSeHM8X`UP5oAqTUW|IUbGo79KU(?L4+sN_&7Lo9S((`+b?k)URM;q?zXX*(4s zsxoIB6hR6_UhDXhn<`o+1-S$-#rg_ry@MQ*sz)6?%3?0$n6}LvOT^?EI8vu(kGhe1 zMyGfJ?>6W(gA!?XYM%s?c1mA>lF$MkBAJEF$%rS9T(TBQ1_s zuvSJ#7;l2x7z1qn1u;<~zf{*yfumtWIbauZ$5M;yB9>X%9jlrOtX3?d)@a5QL7KQs z%bCYG5(C-&ZDI{8z|=1G*he~#k4I`;V4iY4x{3kknn7%SNh#U*sASa=U zCX5PW2fjsNHQ5oT|C>OHlfzziI9TN47y;yrtY>2p`O^44N#ka`KNXu`{cUgVF>)Ek zV!TM~QnsD;@(yrfwlYT*;hN6`CS0n(lecn_o}V*Nj{pMAGuc*U8f6@(^^1v;+vFrU z)E6p%S$FL1B%)f=P@4trsGGhAlFp?(9ce@!?oy;625s_I@ykRhjQN(1{(9mp?1Yt? zFgUCcJO&PsvJa{eVorD`Z@>xm6qnfirYa>Gfe%cBP4XNkH1Htgf}5JL!Thq`E6^(< z#|4#ECcwiBj^R(Yl58Mu6Z66`p{pvO{mTjJtSJ+iSm!E}^R0Pnhp=XllWRa&ctU~) zyI#j?q+BVQQus{@Ok@}*0w?59yJf!e8+w;KxcMHosLa1r6Wmi}Y#7Zb!&MsAHkE_I ziJq9V`sp;GHQQ#VIUB}06jNK>wIe=FuI*KPP(3Q0v)26D&c~o2j~J#<+R3mWanv9U z0!j_S0ji=mC`~uNs1wmos5R_p0~Pra>EuJ}uG1j!1e%Q_dD&x!FytXj@d7KCfRJOC zil8&^5fT|VjZcwWfxlTPo}(iPdDXjP{<@DWFc>W4-j5w^$c_rdT6pXNiiY!m4+tM9%xv{%aNX)%v)xW)btP2*Tj#iz;6u%po!x6VfR_4>M$8 zMH{}r4G5?or%sgKfw`*?nFrIjm}xF*09%Sf4f(FZA3b3hTe46X+T8~+IR0A30Q}@F z#^Gn89o;u*@N`rnDEO+f8xPZWKgPj)8)ioTMy0`pd5g2@#Upe77x=cx5p>bXy!vp| zO}xTnGM|PjdG(;P!R)FAdZtKqiDgvY;<-oAJP9+G4NAncQ&#qGqPyHGeDqu5^J+)15SW6|UQQOXP{@A3o+@Zt#+6$A^F~0}rNLu?>CE z_%6O5a?fmg*UZ<=u`6MRv(FnE@{5n9&F;f^VYAa{XlRNM)&@ZSL=!yhW&{NVLH?Va zn!T)M)&PG1nr{<3u(&TnHr{v{en<;G-bKK-E^|UiIf}|B2sY>f}BQw#3-3GQD!k18wrlGqrP<-VQi$HpaaZeT!{~J z+`Z()0+;Q$L?XGgpLgE&D19L0AE)VcwEO=21R92XsA=lPkaooB&m7>MJhWHY&V$GY zKHHrc4lu-%BO;^5W0A&KE7A0u?8GhX8cSn{y|UF=PZqHy_QlI}_h+WSuoeF1#)Y$I z6CEoh^+0}jPdP3%?o{3|AyIv6us&p9wmgy}J{1t2mcGUp+xf9C(VoyaicSas=N=I$ zTJxMf^q5m%bqWF(>>W-|MC`#N31P3E1Y{cOM=Pxdp?1J^`wM2IHUJ?Oc>DQvV(uS= ziD(1!4HD7iBdRn!Phq(5M~4ucffA^ePzjkRw<@IMN!I40u#?BgYtX zhaVaI-J}eEfB&ehUd2xO2z(4t__U&Yfv>VrOIP}iQBAwb*p!kPJbed6M3D)smYZ9& z>qc`Whk+A@wfIrX-%TJgt-{<#K?|KdZvS_$?bNtM>H{VyKR|kJY8W3I`W*~w{dRUX zZC*f*4V%9D`_XW;#iW4J*83@nI_ASf zNfeYC>*@{zGY8?B*;viV&Oj?`Lhc#U5+cM=^?{&NxG}$;M(<5gHX^bNRp3&aCCl%D-_)3f3*tJaeG0Oh@5Gm+<%iv z#B3+;-7fnz!c6P&yR)j3C%=fX9!(a}EjwFfDXL!>A{^0DFzB6FkZyZ4o{!Q7{LTI~ z?}J8^pz79z$vObkoxEU{_WeKBgWC+4oOoVAkYS2BmNCJp3}tfwp4B4zTKhvb@6 z^^d@Lj31#4kjZ>SRM@t}kSJh=P?gHEK zUv-QtNRV+dQUy-UMLH}TB06)0B;ylnn82yPUsh{L;*tz>O!+x(=qosZcLAENm} zA`x8G+Xw@1w7(_ES^`B2R_P|2;ONt^c^YKn#eb8F1E+4T5rC}K#lr3=tL)6Euhx-} zJH@UKoCEC_ABCX&AkZX2D2-o1qE5y(7_oYs<$hm&oPngV zoFIKOP@inDQ~kI{9QjC5b~o^5Dt|4V6=9%KCI?}ZLzO@0?gQ8k+ zu(Dwti-;HkffG@VfN>QM!o~+=v-_?r$%<7!>PyzQVeC=HmUB7w=IN1roYAqV-Z(F< z@K>%`_V#+ztBnyHZYd_(?tl;0W*v~qXUj6+bfL>3-qUk>btT(qBqLv_IxLWiN_oLu zBD2Rh+6-NUxW5{q27RdpKo|Qu!9GCKtoCRuL++L_KB3~plj_s|dBr7KGNbFfjU37B z1TzmdvRB@P66t3R^OS5Y)djI8c~|iicnY_jIzz=&N3V5l3Hr6VwPIQlIL_i7J2j7hA6gB6g~% z0$PblA^geJA+?m6;>U?|AQ0otxdQAbs1VXbc8We<8LIM?IoZhEq`3yelm%PCU_?{B zKzm-Kq+KjQ-mI$kx;FoQqz-G@L`+CuHppVjkOooB(GRNS^cxuZ)b5537#Bbg{=Ze2CIp?;b3CxZte$n>a&Fo<__SZhFia-RQ%;Wfw)clKe71w)kV)9hTAwdNRkcgm_W_n{Kj_y`;31G?84 z^ZTr|%%}@Qv<#0l?!3q~mBw`*FVJemkid?TM(XW|E8t5!RmCNIVFx9~4NvUGVIZ@pgcub>M)E3r7wIRId z10jQ>BypjB-c6Cdfg@=ZJoQO1yivMi>vqbJkJJ!?{RRT`;BKm4DO7S@0U}-KHP*l} zjuEV-G!wfKiESDafiwoZcehE;C1i)O5i- z!XdN6m>!u0dfB_0Ja-TzmEi|r+ShQHM1qI47`|9P;?x?FBj+t9f|yI?He{#&mk62!CqMFiCXeF9YO^13w9|_V}bBrul_DMEYYOw?RsZaqE60Im)^Yr?c1=pR5gW6 zx*#k3M79-vF$%`nM}kLVRX^+O3id&$S#Xiy&|o?@Gph*;T|~IFj$tQ3Jm-?mJa#bE zN#?4CzJsPG=OCQfpq?V zV2TbsGQWg)v8HTOgWPFA*z=8&76Ad~S}`o_b@arqm3YW-6O~;j;8%R@OBv=F^s`&k zin_;@=(xA*HmD5S8K+(*T%^n37_{(eDK>+)3t9!tgx5lu%?5>(XpDoz*yzlgJ_ zO8M@FCKHMq*ES4NYaW&R%DzjaLK_fn``Po%#pXMgfw95W#Z&blp~tQDRX;ah&u`0- z4QS~+`{ijij3JI*&KMx=?rQISA2%yIM^^Y?6^0y=<-g3CF~ zvKpCmBpR3Pcf4VeDc=vllX^v@2597M|3u2|4Nm3TLQIGaJDR42a0k;FiBlma(OFEG zJ%RCD&wmpEc?)3z({H_+AU)6m-u^#5DU`4bvo2iTqLX_y=Fv;tUbxp=O)w#Vd$2J1 zdDIu#KMN>e_vLSBPritrBU}b@c0-*9i@-+SL2dlIFL)_+5Q;%|xF{ z2l2PGLG`ih^D^DNk&sN1E@Fe#$dwUya$QokrBmHl??Z#{s|KPs0AG23P`@-PEwXJs zkj$AM4QomNmN-3_E+*B48L2FJ?9F^a#${mUL(qr2�!ny)Sh^_Fn#~xkLD;G8zuhG4yL) zLm4*1B*RZ(W^YDwY~?%mZlWZ92>!o)6N2; zakjr1Cj%TF72)icM6(c(e$_wV43-e7h!jE~>2SLKE!xhGK$?pHCeUgHHtVKJC5ik_ zp&0mS2(=4X-CM$|X7pZC_?#xE0yDD$|IGtX=Lz2i%_Rq- zH`)q)>b|DpL*LUdZih+efX&8&q{qZ$gq8OOF+&Xt&f5EX?zCm`3DN5vEC5DEpKXF}+GalFKk5QY%ZWQaj0 z5SD2s0zT$f5^(FAk9;K0>bPINnjp3g$>e_>zU2W3`YbbYL`c&)qPYl>#l(4AX^e&--CD(}HDlrJfff?wz>rs?Dpy+N9#{@`_5(PZ*o_dE!FNBA- z$ml1X;&N*8u42amWEcec6cI(#a?(e23N#su7sO?O_3%#^lvr6vSvWnKKCa5yji7Xy%19<4H0>1JA(?cp<0%8_H-&Q0gjymY2wJMM7g{;xI^vmWhN^6wX&mLB z`zJRIGf>a0fw%~!GQr2$X*9xj*Rr#D{V z+c8hPtRVy*@=^wZaVnqTGLJjR_;eg49G}iqvdsbkA?gR zlJ%2yil>a-D8KS$QDHn2Ei>m2TRV7#x~U3s>X6=%1bj(TKBA)3Y;D@}e|6w<&giPy zbJcnHIH1^+^k1K4gHe;6UPuoZPPAfm>d`@2N-zfHj-j+YgUQkxeQ~vpbOSV9{dC=i zC}>f#!6OrFFbutaIhZaio%Q&(jAAhNK#6E?=-0{zAwC+(C zu=TT;R|^?eC0b|2DH$z9a8wHFF@pGa(B}@UjUuaMfpyGZrBa{xW5%o&XhI_7GIW)N zc!xA;ZA5}@bOI)kN}A~tnL~43*RrTCr*kg~4r~P%nQ6m4Z9iXta0o2e9mUJoxS(_L zDta_5KZv-3eBCfLRbe+{nU**6`EHwpySo%mLY6~pR%p);W~?3aNc{Xgm04e!OH31} zEyFcaLTjn8cg{j|F%We$4diL8|9A;FjfsZsGPvebIB4GKu}^v}?+6mjU2Y5NWmG0<@35;4pP zpbcx<6i~jLllu*n*M@aU-H#Qp{#kB#dklTAy6MO9qzQyz(uAq~Zc>@F zw=D8DOnurEtCKt{@aF~NZ=nMzlqZ5elB=_fi{V3y{=_V$k5<)mCm_z0_AgYBSSX1o zegv!bJx-c#?DD6B<$R2Q!FtU-IF3`tLi42@R`x+8@i%^-{bLpMT z6mq1@T3zcG3H6}N7q^U+ToO!V_mS-=?@~pTtxAm6_FPY-yG}&Uiob29y0&2Dc_?{u z1DfuuTherFiaTRTSAk2hWre#}qL-|^T`tT#hp)VLpQW$>%!C+&MLV@!b3chdNF(7Z&vSABO+<5@uYgi&1ifs9)+g z8Bg=sRX2WBs>o`6($6FeV+d-AwE3XRx%2{)1g&YhE>Xv)_=zJ^-?FApFU~e)LnS%* z$I9BY)%3|W7}Hw~OzY1k?fQi*WsdGeG1J*4l)m{w$HGe{RhIcAi;UJK8yAGEcYPEdZdzo1_aazVzZgY@ta^9$>C1{XikO#00pEnxHL}f})l#W7O~}&K?e>vB zr9`9Q(eK)Om}785vFA>o~XBYr9QCp2%U2Zy~X+360d!5k(YL zX=|CT+&L|-GW}oXFsZ%v2*GJu ztLpWOdxnKe)qT}@Kd{$2mt08ss(o=4`eWCo`y!&$l$u)@S5^G(Q?cdv_?p{P{$XN5 zpLW`*=a#OK4m+kvjtz>ge!tZCN&c6_uT zER8fn?eIN}g0!eSYKS7a?4pWFYC=mmCDj}~zL8?SG92X%lS)3rB-h}pn1GSY?F!;n6LMR2=+w zaH6arlt_%E#>_S@tipCc{TBd*W%IRa<_?!s3|}Z`es74^-*O*`;VM@jV14#xaD@5% zJvY1lWeV3*xkP<)oeKHa`)A?;{sG^xKEj1c)JsZQ6o2!6O*M*>v^tchkSUuT5|pd_ zYxi9Cvv01QXjVnZ1QRH88n^T8J+L7*6+v|bgbv*FV&2r(pop&jOFIhp%Z}#^f%Dm8 zX-5bl`@D7P)zj~|iHV#iz>im|PjHyn_&iZz{yD4t*JU`)qD7E{OhYl|BPARiFI`lnY@jYlt)yP?a{cG58cH1Yo9T@dauKheSknlQN4?Bj!h~-Oy6i;;43O_vxF?*q^jlAaKf|TJa%B! zTp^l#WPJBp{Bmh~*y-hElKsO)WXnaLt3Y4{bL)13K4j?@(cwtDBK~)F`c7p^z!Rqt@8cS&RZzsE!G^ZlriW`%R*bCFlUTY zhvLZTpMKk%9?5Sv=<~ZOL|E|mqhm}piG6n9Eta9=HIeX4$pdV82#occI;q+VL!+=B zrJD0q?hnAgQ z!gDKZWPwM1J0H8xe=+__`TpzvDbMvq6i2LLfcw@rx8Js`D!(*uRle&cO_sOkeW!M% zPuiU-9ZS`Kn}yiMp(A&YTore<3=AA4$Sx*+$N${`24zd*RP&`960C$$i6t~g`pzJ2jMvX5%_sck?fr2 zcc(qcb`4q5&XRxG>`1xgBRm@MD(6i7wd)t&VJ|od7X`7Y`_(im_ z`5smm+aftwX_8ACPN}K;(%cgDX(m4QTvwjZ?HcSVW;9K@I2f{${inGVmc%;{aC>C8 zWJ1)hozz(SW*|=zcU#WD=V2k;s%N}&(zjTvK8(~c#^3Xh?=XEK6Viz`Wu!?RcG>%s zJkUe4BRnROl4>o#W<1b^B?iru&84ltm{*;Qx2hEGT~^3boE51wXz8Z=by3lXIk+{r zLO$I6876K1OoN?u#>}k!-3M%|-4a(8w2S4&_Bvke;lPK#8SZ;2DNZy?gMZZ?YCn#p z4sKWvEIGHZzr^{&Ea|+Y{Jv4b=WxNx@?`n?bhK2^^5m|OGO%IO4%{anUkQBkS^H7$ z@KJ9!{q&Td_tcJ}j7;58Gp>N>S-gs@qC9eFP~=!JVwyj<`yDaGMQh749~bbRpdM$s zQsd21Jlnrn5RJ>j@Fblf7+eGW0tzAax$Q*fF{cq9e1iV&s}T>O5kK(lSZ z!IwzRVMeY5t?nJRX6}>|!Kw+*6@OdrP&3$9e=5JnGPxy>s#>uk<=zi4KYzBvLDV0>!P|b;WJmIPE2#A%#pL_)^WVIm)7XTLqJb-;EP*L0K;o{7BEPY7`=1V5S zKgxrGNW<};v#_E4$UgRabOpk|s_>=VSUNq4fgartQe$xzpX*M|fR82MVROiK7BH#LcHzDWI``-M{Nn;m8{bSmm25Kobt`ZLQj1*$8*_^ z21sN|93u%E?J+i9*>%Qe%1UuO{Mg-Zd%l`L~Ux{K!>GO zQeQ2M#WZV7H5FaMHYeo<#D1hZacE3ZRwnn^k3X7G;(!^?237B%c8L6l7xeLC8I4=pa?bzdS zxTxq`h1_f({EYSd;_->F(C1iAmOD6&wa{D_K6T}gCs2x|nd3aylo+&mk4Y@;)=#pA z^z>Kt-xkT+5tdwGhn65>^6#=(R4nA!XRX@00LC*QJFX_9dn=6>r;(a1q4({Xu3q!X zUj;db4MmL3cQeO5=gM{j6n^WBYD8qDoeq`T1G3)9ev}Kcf^^JYma+-nDuPk8POzfoiM~{jQ!1(m{}p!QSj4zd7^$J|E4IVEiXEl|G7DtuhaJxKtgo2&Kzh-(is+?rg>1O=I#pJ*~zd4@3+YR8XI?^x<_Xj1SG`$dsg% zOi8>N`SqZzuhH|Wd|6nkUHvB;ZBfZp_q;HfaIE-O%F#QT!*&Lu-fu1XcCsbfir0ap zug1Q;bHSZgvT!?ThL8uC#Q&=LjhPDUyRv0unBY{&bo6Vkjc!L5W+GhA8j1`_prr;z zh`Yp`Mee zxS3U;1(2px`IT;e0?IE$AWD1wi>H`q${jaxS7sgvZT%HPhYEatfpVQ~-q^wK%TFiQ zI2_)u6let5KlnAJ16D+(^5eZ2!x#W%mz+tC3)-UvRo$t=5|7Y+7#@J=4QCaX>oUU530~w6P z_r4Rz6+~yQf3|~W(Y@ITkrM^WkCd*lWQ4Ee?^)0b_zlQj%W?g#fzB^WIx!$uMfaWF zm&0rpp|5)l_OwM$^tdo4OLN?!{ZkIW{vsU^K{LzVG8UTyNdg|b&l^FpYFV1=DS*2H zM4+ia)iIRkduY4ZRaV)?0gPrkYkuYa?s$JDz5(K4uhDBC{_m#Jqv2#VQl6sEU6-Nj zJ4%nRS!@$Q46|jSSFE}1r>T_#fbd|Ix$4A^{j(sl9!-~p77;H+D+vUi*8qs+22{|e zWq_~L0N`iPtL-n%6!jHXS63LerUCJ=AmX|hQe%z({{&vuEdEz+BIZDqe{do#g9`=z z7Mb9*AQ8l-W)L`aaUurs4oy2BSq$cj)-l<-Ml$#n&~Yg(U+R;uy8w%YcD`R`v-nfS zU3h?zMXTe|ZGCs%R5Q`WtA5=-1cu#?$qxvA2PoL);k}YaEsS*jXGxE-ZUO(O z46rzc?r>Z|P2{*>F-RB?3yjs6b)u*zgu2w{LCGHm9QgK1k&P)tjrA|`6r~Qc$hF6& z@Qzf`96qT4tk9xjcUD8_RYvGB0jY)nT8K<5T&Xiy#4;g`-|KMMN}I3nNfk+NNf`Nj zw0xDz6BRgS^Fw!3R&_@z2HCg>V7}TH=gs}DW*HR^OI8SBk0;T&RLH&7IIEDUD2<$y zgpnb%nn9R-8|9CEFN7qMY1ge!J@#gQprLgfq9B{gd*=mNxDn2pj$or$bfbm<0@v)P zMFp*KGqSN^run*4$4{x)rTaF69PbRXS<@+FV)fS^2s#?>!N3Go{T^}o_~rix?{-OC zPZXMk7@C07{# z)o*j#wr?r9Z0W@7c1U*K`|6X%aC>k>^V}T5Y9l*XJ1uB7%)4ET!or)HqBEWfw`{A%%=Unh-sbYFdh-Hg^r}D$#6KQ>J@Xe-1rg0HcKY$sp=FlS$-{pFb0P zPrF>S$pb5~B%P2%13?=2>2bIF*Hc&MP zZshFW)#y|SU0x6bzZa1`mwo}`o@But!oI_*dOgs8&@q_HdC)Zz*Gv{(>eLYiyFA3# zr2=S?(d|TGP*55YYFg)TYH)iI;C8X{N=tuOV)0IqL|o$PlcAGeh6d5YSZNoh!!SJ| z$=ZjqU*VkzoQ_&jU5V&x#a9Fq&5|r?%7d-0Qp79CdWtQ>Q;)RXH&PpE#9g=&vsl?C zYES>0@Y;ZiO^|)U9K#>`FqI@5ay&TPAJx9S<FD-_9iFYaLEWBmyBR#yQ|39{fiW$e{%G8684p-D!GD) zS${b)^ygp3ywH+yLXFo?JD&j2)G}s&v(dM29`7nq)b59du3NLw;^B2Yo%A77EB%XkZ%d1F&Iq4Yf!0?D(;@P;+%(vS-(%BTiKmmE9;KAR)2ZorQU=T;o%SdcJQ`z80fE-K8drthFAi7x0#bD_<3S z_NHij@0EhSsp)^6x!wC)SqhrFrYLi}@6>Vd>eXsU&r(Ls>R9Tr@inC=n37W;_QZ@e z!E)yHsSBvJsuDTS zVqgqXYYiyNzkg&~pJxE^|KhgY6Q~Arn)LOvH`2N{Kza7XWpD`arED9lTH^xTLXIJ4 zs>u>bq&~?<4Xzve&2NFG^lNHadHHge8+xtfpoMz2RAj$!D#wIK_Gib=O4r}d8SS0T zuV%D{5~`T#(5Ty2RkP~24>T6;hlv}KWzJcbf%-eGaYF0CKL5^wZOvAD5sGR&j&$2$ zTI?Shrao!WcRx#vgEYw@#GQ0;gLj01&O`L($&x1bLS7zg!9Twzq)-|+37FzyM15iF ziuVR?^Jz9;!(aR4I_7qYzhDPD2zW(J*nglhkBP)Ejn~~w9bP02y;}z|2AjB^k#XL; zcZZGJ8iI0FF5^FVU!n{l`IrJx_eJ4T=`Dq}J6hbX-(WYKR;Un>MS2W&zrz3&U>TG7 z*MiXa2h7JN#6AGryxRRFAE4}u%7X~sk^{-QWX*S%Gsg4zV=psR(@!01f4E!&MV!@I zNEizjczGKlVBXk2*B|E*0I_2gpkIf9#?;KJH16uX$M$HhN9=Fm{5dXa(~j_R@E!|X zj8JF&vf2oE#qu2ZR;?nybGc`o5IP8l>R!@|>S+XfEAVE7+@28)N;!}4v6LC_YcZpR zJ!jF%VG9Jx=*_KkQxRl@2V5hNk{>*PJfUQOum22~iZI1wetar7e(Wzai9X!hi;hE? zg3kWNDB3-PsaK=p3uB%B9`aw5?p@-w)eQ=Zkn*ceK9v(7FQ^O)+^hJ$3HGO{0A4mk z@PM(_G?;HrK?cyJl{pt{>jz+?or0B~y%$P+BfOjO7U<4BPR7+tQ;hqImA z4AJqZ+4NueeDFs)1tK1iLYJQ&bN^B12t*z86F_d2ShVvTEd3@`Sr;gV0GQ2nyI-5& z&xzNG%%-5KIt0gR{}BkR`i7K#HfKxHu{{P-2o15P+Cx9^OLg?})M z#K0qqrWecTpw_qIyjM9%1>)7sfF4;<%1*UhKSDlejM8%;D&vcZP8HMlA%C!$@2d`8cg2wL^4Q+cQDda55ltrxY`rq7Lq9Jq z9|AlntECM|U1qZO!xWd_>~D#i1b5)5K^)9t61cY?`0rjkyG4*XE+24ExxK8XSo{Gkck||GRPn`Hnz4 zIr9_>99iR~!Om+pn^VD%G`d7|bNXDqs9=IRZ#WudFpcCF-v^sux4{_B@PPHG!1sL# z2Rya`b=Sqq`nu+$e<-#D&AE;0*h~OE5f<;gGK?`mC&y@FYqoy6g+G^Kez7mU1BB=7 zzYD(En+}9{xXqgJXeCIUsu)#UJRuRS$$;(l3Qp7AG*%TRY$01kim^f0Iq;toNr zgD9<~KDm{h)}cA*@$jVNRAS8?ZT={x;F@cLHPxiu)G4sfLaE@&jgH>8v&8pa-;}&L ziCqv<8{5wD#>fKQ@Vk=<#UQ0&_Q;0`PKR~arro&EN+O!Ewb*!T&b{p$W9DI~$MM`XrN$vya9 zx{Er0J@ncZcro8>`j&t4SChv}fNhi2q#Zl){2i#Xn)>ZmL0(26{g?EIEdVf{n3>(I z`}7~STd50Al(*R+9p-zlN1XwyA2K zn=gFPQgmo4j2i`7f#~Fk7-0sQn9<#xaOhnoKFYOOeA!0iouJ9KzgfYhhs>XrN*RTp zyoY;Z!J}TQuUPlau-(J);ejoCe&G%H=Fi%<8Gg^S-)|?JePQUEN7u4 z-A78or+r=stc&_I$uoMkDrq%aEHqdWOSSV~jYyGCfdn@r4eH+nELwLP0upbUt+Bdf z9kpsryHYcwDb%lqd78^JocRnibZ+@BtA41D{aYiFRyzC52mBk>yVx=dG=hq|d0D(C zL@?;v(MHJHufnFA?X9zN#p=xcCw1+Du4ocHf1!j13guWj4lZ zJ@(Kg4d^dD-wQO-&_DHFv`vnd)zRJ!F;s0`0U`mbq@cUq=2Q8XX0I5at&HvvY!46M z!$C}`5p?>AcII=FYkR&Z?zYU7s$zeVZPZ|pTB6TGNg?|5g1Znd3C-9GsiR={=8*#P z0lc3Jj%=IMa#vFLH+h?+Zt6R~_S(K!$y+M9nLQ4NywomU!GLoL-JBwy zvi-Dq3GJ&bn^C?{Gb*$X=giFJKztkXxkNr0~b^5#eRhdrrMJ3^87jOWSVkWi|4^E_Z-sAi-)qNRHs&a zvlz((TFC607rFsLeO5W?uuN2g>I@ zIVQPlPpoBZ{xh_0ocNW&86WxkIUA(fwD@DDI;`oPl0x&|B;~VIxtqxXEu}V?G@-t^ ziN|x-6k$p=iVw`%U%Ou9R_<2We7_Q!jsr{1lB0|q`}7W4@lO#fe~t>`r(=M|+GV9o zR4b!lo8yg={cxnAt^0nF{Itz@ zw^@0pA6PGg{Mbk_C8_;r_C?-u`f2=XyP)7j^wGd~zjtZYUE1?sv`)KGBI@@f-alns+V zU_y^_K|SB#>ba`p$}hsJ%POrbB!>I!CPIKj_CZr~B<>z$1~bKEgP~*O7&xX(V-P+H z%r9(e;<{I;_>jF9pFcnEq)l~_Hlai?h%2mns&AwtFVYszvwUIhR7Up%h*2ylt8xhy z>F7wFh2f~X1c~wlt(h}tmNcoI5f8m+h!*`L+EP6c3fi$fmgC4F>b~wEuAqLRom@M^ zbDwUX>~9}JW|H33-2owSAf4)h304!ymER}nM|=4u-N$o1+@ZQ)wheP})WwpYC?b2>d^aWFz7usn_gvIh9ZlgXS3JtKFwnXq4D!{`dVl!BVhM;A|BB>#MVih5g?;QcsyQ?>i99>x>#%2ML z0~Pbs`0fLP(YQi?Wh=C6bplZy2s)lQ_nnBaCCs_!p4*(#VSogD#Iyj*!mKi|j+n5p z&Q}G6nu@VoyLtLMcLzB)Prl}JNh*AN2eZtSXVbm$VbKeVwdI1FTY%NC@xsApp43C2DYzX zc;SWRJ;v!!p5ZLGtWFz z)>VsV7T?J8+H0>ZD;#JiGzBXKydyBIF~07)>xwxEGmt)dv>U4r2%K57W|f_ametwD zk8!9(44W@cHQRR~OB{0J^(i^gkRv(tyvk*nu}X%dI4KI`-V z1GDf_lBh{h>Q;*6hlN{8R2gI&tN+RkVK~-VN0?(Fj!ak_ANOxzaVEPW$2S zzDR*0=BoFjM|G7W$TO#|`WFA(pGKJk&(E29`ryOglzzQs+txA=GC6(vX{YA?mw8Pl zmBmkvZvKNcLw}@sRE`jlJ!Y=xxAlD2+p%7bsIyL2@|3R?rD1{ujQlX&FtOP50hp@g zZ$3Wr0+zoCZ-j2gqV42_i6wO=nn^#}z)d&ZRG2g-PGDfPgphTq6e%iUs?741Y? zc6VZ6u?E@(73L+{hjf)qIB{H+Nts);IF_N0Ho2n--*UL4fv5xDJ~ql^j@R|>?#+Ur zyBwf5vTwwW?^P!CO~tw}f6)7 z%Ykj)+x~}bncny!Ak0f_+VoN7@;fWC2&Wx8{!r2}$BNg48*E)g8xO0HkSTV0Oqp3= z&YU^L>|}F@9fg>t$}>t2(~LO>>v|QC20@tcN5efKfbp6De&v-{_OD)|kq|mYn2sRE z_>JJ1m@s@=g?R~#UBg(V^!D3t7dlK>v=3ou4#E&z(vxo*4igxS;?`SlEuBFaOrF#a zAtoJ~6EhVJ#=Hd6m3ojDWgsj$2nl|)I(my1hk{^;o$hGDw-fG2BfeLo_upj(@31{* zPtBV*uMBRVe_?f+ef8DFpAf-=SQwn?bpL(#6`?@Ecrt4Wc9P$9*InfpkbnO1kJFp~ z`DR+ZW=(qY?YGk6C5y9W@qSwWv-Rn3Z@wX|TJ?i8fBtQ0-Ag~r^*=iO>-wLjMfcs4 z?!9kOx@Xbfr{~t#Y`8ToUAnC7)38yG#RmV3_Uf#!{@Rg$@TXxtmO}!VKS_!~Q=cxm ztW#bL|Jti!(7%NlI8*jW(HtR42-F)-S`^`5_X#|tb z1O$_nQw^sW=n@Xjd~rAzrx7(822T)x{0T#_F>RR}p%vKqNFXR9 zDGl;=<&{^K(Ezzg3h{YUF8OgCK^L=En4)4djB{s z4|EMmosYEY2Tv7~I;#d#Gk(GBjJG)V={w7pmpMx(&;HZ8m(qLhzMGbR_q%0h`n~tw zTQ<-AdFFfWr=4|nPAH`veG77Iu$y=5yuzQH*t%`orm}l|)?dv^-(L1u8b5A);c3#e z-@=Y+e2|8MKhaw7o1tJ>S2rmf#*g9B3J45LyV%_FJ@XN>kSndgsNQIuxrhd08@&Q5 zsAaDNg;O0(Ae&1tGS?V12@0ZmVerZRZ~n|v;s`pvRFa`J-Zc|kxZHk zkD=2f&>@)Q#};;GuB-D1fgmCz&{6p`A~1(S%b^MBEVL!%atwivL?{vz>O@{?OG9nA z&l3n#eMwzu^LBO9XAFaBwqxLPiN44&|GfI@&&pwfe{|gVvU1Zv(dwjM{pzi<1Dx6V zz4!jR9Otoh%jR^>*S}sgho8UpS`i}n2A(o)>a_Ig#tnrxo$}?A)Av_BnR(V6+QsWPVcp9|tp&o!c8;-B<*Zfp#qJC}y#~ zJVRU$1;e_!35@bFQq0?ycyk0kZYCcR7sGeY`2b@D5@5dW2^mbAX$d`a2oVLvB$#!W zf2>d?(~Irb<<}IgINr9416xp&$umHK1%m2y1Q5x{C~uf zCErRn+;DxGbn2wEaN(Wl?z`_Pi)cG;-gbVh;cIvK3hfy_FVZf2ZQIQkYjAKkkI| zy~n?kA;{xDp&eIJ*JUyPDK;735nc-ZuX z=f{qZ0bs(I0>*52wMsZ2@oavC z_CO#J6v9c%d-;*3yt|?)-|o@$p1@L8f=8aj=g$v~XdwBDGPkaOH&`^$7>a9g1QFHk zda(Or3^oE)BK_j^*NX}IonQYt zJ^bK9>G741r}gXCmx1be=g&xMo?D%Mmo*1G3}5;1gWr^UFrN|UE#Z?)_p6?KqF5`A zKYl{`#lO9tmMvXYEHC(&!LWU1j!+-!fOJ@o<-iazQV2$BG>$#KBdi za52hP;ht$CaU6#@Xc9b80U8T^GzkS)%VMR4S%Y{OJ=z3JXadqPA3-C*+~os(d6xzn zn0;MS;1{D!`9ml2E}nN$Zt$L;_s}w=gF_vuH&=D4ZTd4e9nShhFKBBo?cSQ3h5=2& zV4(Y>4E>^VM%k&Dv!_k%Nn>+=JTdc+GtQWj`{Bs4kY&Pz6Usq<2FSnt@V9Al9@S6# zT2DIegbC^Fsb4Mh41&$GnqQrinLoaD`st^o)3Y}6)w9peJn2j2$Z*<-qsqC-XP%YL zJI{fF<8y{aq*1wFo_WUPGUxIB`yUjVmh4NHFtK{G{v8eGJ2@f;{Q1BzO7PM7*y1@d zUcZk5)cwIT*U1zj9Mr=$(X0E_uh8@^5McsMVW2a9Jxr5di-Do8v^OEE&I|&KklF+O zS{yCt7hLqss*mV@)iZz4Un5-fBk;UWU+wVI$Al~WUEj-B@zLQdg>`i-2|;2R|7)-P zJjbav!MBj*h z37xzt`eXE^aGsmOhF`>sD;#)V(K1-kCs|f3(qX=$J&0mcT@xbRaEFQ!=bUrS;rp^0 zQ2)pR{OZpwTJ#5fMTb6AP2zAN`e=-}T1}!wKwqmf@ZfPr68fe*=%38uOz6G^X8c3> z4hECwVV}5;3a$GoME$vSt?SR#KgL5r6OEy`7A^Y2vCvnf8;qU?;hBISC}LnWkQ)q+ zijaW%bL(2ypBpTiXbi=*XfY7#eI zt|v8RYOtAX(E{3j)8ey?;FWbZkXeWTArxp5@gF+FfmTSg_SU* literal 0 HcmV?d00001 From e3ecce83e64b3fdbf601825937854cfda1a188f4 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Fri, 20 Oct 2017 18:28:55 +0000 Subject: [PATCH 29/90] Merged PR 3979: Add new topic about Windows media changes New topic --- windows/deployment/TOC.md | 1 + windows/deployment/deploy.md | 2 + windows/deployment/images/download-media1.png | Bin 0 -> 16840 bytes windows/deployment/images/lang-pack-1709.png | Bin 0 -> 451232 bytes windows/deployment/images/table01.png | Bin 0 -> 38401 bytes windows/deployment/index.md | 3 +- ...s-10-enterprise-subscription-activation.md | 2 +- windows/deployment/windows-10-media.md | 90 ++++++++++++++++++ 8 files changed, 96 insertions(+), 2 deletions(-) create mode 100644 windows/deployment/images/download-media1.png create mode 100644 windows/deployment/images/lang-pack-1709.png create mode 100644 windows/deployment/images/table01.png create mode 100644 windows/deployment/windows-10-media.md diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index 0ce495c54d..0040ed7390 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -13,6 +13,7 @@ ### [Overview of Windows AutoPilot](windows-10-auto-pilot.md) ### [Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) ### [Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) +### [Windows 10 volume license media](windows-10-media.md) ### [Windows 10 deployment test lab](windows-10-poc.md) #### [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md) diff --git a/windows/deployment/deploy.md b/windows/deployment/deploy.md index d493765134..81aabe9b28 100644 --- a/windows/deployment/deploy.md +++ b/windows/deployment/deploy.md @@ -17,8 +17,10 @@ Windows 10 upgrade options are discussed and information is provided about plann |Topic |Description | |------|------------| +|[Overview of Windows AutoPilot](windows-10-auto-pilot.md) |This topic provides an overview of Windows AutoPilot deployment, a new zero-touch method for deploying Windows 10 in the enterprise. | |[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. | |[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. | +|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about updates to volume licensing media in the current version of Windows 10. | |[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | |[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). | |[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. | diff --git a/windows/deployment/images/download-media1.png b/windows/deployment/images/download-media1.png new file mode 100644 index 0000000000000000000000000000000000000000..ba4c3c2f1379ca50b0c27638de3200bdcca896dc GIT binary patch literal 16840 zcmV)+K#0GIP)(V400004XF*Lt006O% z3;baP00009a7bBm000ie000ie0hKEb8vp=7YDq*vRCr$Pod;l4#n#9F+e>!Sd!;1= z3=n!RA|N1QLAnaqpJG=m&-PSMpIt!#>8OB62kE_s7D5Uk3F(3Kw!MC5?rtDd2}Ymt z%}qu` z6?9@qWMYbcfZb#RYxQngY*4ulkpv2b2y!ZdmBRMN(vbae9~VZWh#sLlit)6MD%!`( zOSD?)cvFmGbN;O3&AF7{5m(n%!hf0yu4i=23jWwu>eat~S@pL;T(U1Wv;BJO-0X4r zBRwE&&AK%l4r=6$dN}M>nnrU(WeLj4bg+r!@D2=uMlGSF zmXcZL_4h|8Ln47(LJQII78@ObKXL%5I5t8d7CGrKSD>U)Prv0*C`BYB&9I6T(E9qr zTSf7Tos-|GAE$A+j<{kcfgFR3NJYNkYMzDjNR5ddR+goU8@Umo6VEaNC1nI6hdZ+& zE4Z0$)H#8SDlc(o6@nA9{UX63lZ&CGoidqdU)Zv2JIwIN=#}J<6576z<~gpqkL=jE zzcQ$iW$VE1fXV7`mF1pwBRFYWtOrCPqwnNsCi;k32{%}XYfowOHWMsH6PzTh*fguv z0wevl+wG9cslLqSh*!`t9o3bQXcrHI9cmtf7FG(--655r?b(35Xm zVjCA=2l}crt~=`@Zri=^>uRgeG8AANwtcpa`zwdjXfQjZII569WiG{mW#41g@)OW2 zoG{sa5P#PrcyLU2G}B06Wj^Cxt3FI{xZ?Pw+=#odbwy4)^wsBKQ-mSF$ApZXzv8#w z?CAZ*BZ&7TQNv>OC0x&cSedk4_dY2qlCbFW@38h*5o~fbI*oY^4-apTaFw0nw@b8L zt?mpqPi!-wLT{#|%nP2>5ILv~xLJhAK<$)5Y(ehMS(rL+2PzD9SgP%iX#qv>ZMbvN zYnae209G4`*~@qPDqQmzv*YUi%DFz*5LYaSi%B~cH9+ou8a1~ z#jw8i*aw51O1;@e_DIv&;ilh|KL{Afk1XUzB8e1gnkS`c zHrFgVZ)E!vG+8&lf!4QEvcr-BlEl!{dNK;iYS*G*9sWimEkl1Law<#W65OmTW=R%m zz-;755=xdd?o5e!zR~pO^c-;hKjRiCWbbNeC6bnZgPH5)81V8W^pDm;Q=5SWpDe<$ zu>N@Y`C*7AyJt-a>tJX0&rH!k_H7j=QcNaisq-Z>C7wn*CC1EGXhF6t=><4wMRGae zH}f|$+rFs+8^3!V=evJ}XL|aA*AoacqCqp8WSx~+f~ys5d4|x88Zr{rxi7m~s`4&HoUee7zVuPp06+!F|}iHyzdT z5X80$gq#TtQrygr>pl#2;Oo9$=f?%=rii5yXzgdPbjETVDD_7B4k1v`31tliTjpXh zRF2@imriFHLEUtrH%Xzx_D?^=?h+p~X%_`wu|wz?lUU1;F#9FExv&Uf{d*u*D}sYI zBBI7hl(rdPzWf=s%9^8F$8c!K$S&DF6IM^3KZ&+;30UysT%2@vME@8q z%t~IU>E0LBVk8qGv znT1$b1m!rG&#&h4W`BD99IL&!Lkjs&YW% z>jy3CT{V{@`N)18Idv8_4hgC&DX_{UkeN!5Txfu&Rs*%jg6iTzWYtI!=;1)|=|t>1 znu7GR=b^Ky;Tx!djDoSVDjP==jv(oDE{tL|DoRX{YE`ry67fZ+vE{&VBxe@GtO!7W zpG@d2~l1c_>qS5|@i++5_G&WB#3fHC_t zjwB=@EvE?83SR_!$x)uV1MAnXLzW>50YSbbQY@$~vqKpqMQwfs#qe_EojZfW$1-4+ zQBq4jBA1aL)aGE{-lIs(D?*iB0oyqp96o9&mI->$%K>_gd zSHW6z3I`4yM^e^#=oLW-^%28VRe`*MS{O=CVP9e?oIbu#8FP`a^(ap1obdJcgGNe8 zn7bVoQW;Q^`hJWgz`Ma-x^XzQmy4IQhD0vohpbX-YQ>IzRIzt~I(oDo%KBPw$; z>DZq_T0Y?4#1ASGRZMIZCGW=mW2cc_YKF)w2!W&!S>n&*#qV=XaU~)RD-r9EwL1ag zP80CLThC(RJwwr2d<4tpY=f;wf86G)pzJ{m4>oj24ULjM3JUHfYG6F5!C>F5B*EG6 ziH7DmoGgfw@+T3)t^<-YRZP>>?sX+hjhjnx?BE&byj!4CyI^uIF+8b!HlKai#lx&j zHjL&~Z#pIGq^!xvB(yD-(bI3rd62btGfF&LBaXzC7dfh(_Df_llEbdWq4Oe0{koxB zEam@{v1p|>B<$Xaz1uSpeOGU^jt+%~mG+JHrLK-rN|zLrdt~ohjL%a1Ft!8LQJ;(b zC(&4JeI#Rbj`!M0;pzVp}5@8=$XNJ<8hl8iGA&cyVu8~S1 zOZa_pMN81}aX2U&F&SZ}6wcKX#*U=~!NI|3*RCC!H*b#f=g%W0B?aEz-e}gW8SMu( zwB(R7xs1wir)iu9A&9H|lSs`eg?FnuaYY$13UPGBYHZrF4@qYe=;MR-U0Oh1vj^Wj zHUkO9Z0!8?N9;P32}{iF=ot>2+%yNDe)|mt&`g}qPsG}-=i$?`1;R^K;e}rd(XVSe z1j;IKeEnQ}mEwi_+IZm1j%8S|B>@FT6L7p#jPQ1GXezJ5ruow_eeo|imXuBnP!iT` zt3>PGaR{^LVc+)6ShICEl8&81k<|lXF-@pk*RTW+n4CsI$obecMP^iFQUZ_=jJ^}Q zB7}sC$!Ld(Vxy;{3P+jn@NI+8{F#`wd?OC+O2d&|>##l{3)*%a5f`XNP1YXl+PWHB z_nyGX)O1)hZPCTQ5X%!LYGs0v4P`&MWo%Ez`JKF7yP*CF{# zGSZVzyS+|i|3omCLwr~9nsrfo6e4`LXNw%tJGhX>{8&tQoLx&I* zN>8o9*I({}GSU~BD`sKA&OJDoUX5U1HL8-gV%fG6D9bAYg5nVyR)N#I*I@nDJxDy2 zjI&kV=+HJ0wTY|n;j|UVD>;Bws}pdx{5%PzwrvT9b4NLc?f=KL@hGgs`yfdVJIsS!v%mV(5bYGHi3D&r7# zC1;}AE``KVg4BewC@edNtP_byOHahoxeG9N)pner@|a3u%ASb>cIrG#1=zD`C8p0> zfO$V{!Kn%nlqA-ix=d_bxEQl%&&2|As^cXNQrl8^lL=%T-h%IDFU0)4`%q$%!ILs} zW_g0~u|jQjNc=*e4Ddxcm7QUv{ZP>4!h<+jTL@`ncSIS?LXVYNWkBlo^;kG_F6J!V zh0_&)KI<^H>^Y9SJu9(vODeKzmGJb{z+Oz*#ftfu^~-)7FET>mA%&;fj?`^yv3T}8 z%=&Q!Hl^2)u#rMdf=g;C!sdkwFniHPtlN_dyN{N{V*?CUNL56FV=-YROd_La$1XB5 z5*<5s6nd(Xl9G^_nF(KCUqnSk3ELMMQ#%u7W~R`Dbvb_w!M>by9u&jT3`R2@g!nUz?wAqidHI*g60mgBX-;gA?} zU|=^Nuya!WzGk9&n{TOc{V({>>cyM4iau3YGg3WnQQj#N#4X|!h4yTb2vzu#77MMIe zp%$^;6<4ScvB0YJfxk=xjnNE)#EF6 zJ9aGkhnsMC(bw3XCx@h@9A5Dc;e$EvV|-kD3?4H9BcB?DLA~3p0(?i)7|lRlq~*GIL)iRsT^_D(Ze4V;Mk z`nH5&!>3rDU=S`BsnS~zHD(?*&zk`6qsy_!a1Vaiv=g&>t8jY9A)Gc*vw0yu79xf4 zuW+oL4w&GDj{Q3!u1PAkAEp_#2{>9Fitz435FesPQA!c~hrWwBD>vhpZ(8HvcN=gb z^#s;_|2p;>dSU3O2hq*D1jiPAi)}@$iKb)0!^Q9NyW)z$?m(kX@itl% z2oLXz;XQ+dII*aapsX20zE6S)d< zr2^*4Jna5;29{BVy)!i%hEj(xgqT)jKzs+v`a^`G5Zmh>+(wCnof^4nOEvs#McB7x zBeotp2al-UXcw*&wn1$lhtoK)mYv!OyF>*gC7nKHCsC*;LBlSR5`2XI*z_=|tx)@U zLqoAC?w%p&8p-AZO*#ytb;?m#TL67+0G!1~v3bKb94~YrqDMD`icGLX#-L@p<_M(a zYfH{x&FUYqeB~zWJ$M$ino5|h6yuG0Sj<)!bu1EFDAuuUvu)U5Fh!tW&)$d&pq~mK zw3Ja@Nf4!079sB5K4>GO=|p6o0q92lCZTwG!9_^5u&C+Paxh-_?@D}jj}H#5T7!ex z60{lG7W$k*8j z7A!iXK=Wt^B)UA5RHh--*$m2j2WoU>IG>daOUqbhx?ND8oS=1P>r4a2jO?#69nUctLB3_-^LE2_(MkcZ!n z7eASYA6{q+TTvpCGEQN|Psb2G`b|uq|1D;H`58ugC1KIdlgP|ChTU7ucwqjI_+jRI zczSd^RHX*tLdJ$cE6~2NEQL|OtJY*P2^Y4@WHNN^+7;cpbrUXZXTnQZP9(@!&L4n< z84=m4S|gkWXsF@H-~J8eo|0q2M_*yaXD^^$f^hFt(If?r5;w2Vr}&);vx8PXB#x<4%{uwm{J96L|#M68;GzY|&K3Q=ozty!3U z0M%X^_$dM)^YTQ~F|XsRPd~;tGiKt0r|(6pa5LGul@fj?8-UDh(=q3S9pk2bMQy~3 z=o9V*yO9zTyA@`;O}Oy`6wQU}Tpg|e%aT!+V6y&x_ShQXGFh^JjZ}`xyed=*OW9F! z>NwI!{5dEg6`-VFW-LJ3snf_PV-2Vrt?uX#kD4l^<(-3n{AhI5A4Ou)CY% z@Cs;$QByv~dt-f(PD$6|g~wr+iRk!HTPJ5KP9fYJqw4h#rv7&tzWnMNd^PPY42h#e z+irr5#SE&b)k+DmFeJxnZKLVeON`laEaK2^(PCy*1mat@M9a!w@y#JC!Xi4Orw?GH z9k0kek5UUO%YiCtmy&}65i0kC%Et$BkGv@y`>(&Aj*nlRfOtPUOjatDgengg*XM@B z70bxkMbi=r&{8^6MQ0LV3-yFrriN$eQ1pq_3U@%jzX_U$M5FSI1uc4nqS{)3!|PI@ zj_HSf{Uj(W$swbYp>KyK)Zi}5u&Muq0)8I*fxu+DiD2Vcl3yI z-LGKxZHbOu%3&y|K=Of2n6YXPva)Mop}ML3sc||}gxcU>wC>kI=!tU3qS38YI3ksG z&Lb24PwdoiYtQtR{o7-!`KW%4V$)-={sOjfLDV5^`@qmq+S9b~yTVi4yL(a7g?R)1@1V z&ZnTPuo~vjyU{mXkVo*3Y>U_~euBd{6fvC~DLFlJCMKNfdasy(V#9+yd-g=@)~$s{ zF|Zyiww##uPa>AkIVIz{@>rqnygm>$QHen_Bamw?U`pKu5y(tN$W~E@R>WGf$ z>)4J@-uXACP5lg;(yCBvl)@(<23lt(ewsQJUwt+M8od$=p8>t#J7yRxu2|_CP6Dnf2@Br)1Rs975c^5> zSScpT6hE9Q^PMcCbhwP$x>{>Lxjy^lV^2UAwV+WI!MiuH#==129`W6#Pw zXu7vRsHYg^Is35a!~f#T^(pWUk3_V;H%ug8qHJfe?URqNJfRG+BL+jAItL%V{vJN~ z@Doh^atku3K1@g%^dzvDo^e=VGU{Qpuv)NVV1SW{O!{@9X(QONXM)kFV|NZxtf84! z(qqBY7OHA;k(Q!IaHlw-t#Xi<6xF0*{mf7C$-8gkov#xSI&L7k-PQr|JwlK)V+#KB z!H0PFoo_K?*)f#JB#=|AaLG2#_4s{pMcIc`Ng|3eXEro(ded}#z9JX#-Qy8JilHih z1NLUr3KwOgEQd0XRH#FP5!$*F{G0|H+@Fu2@EF`V)EBASS7XbWaI_8ef?8~b*j7^t9sS&RNKdc?561@d{qN zuLCsHf;hajaAp-F|75nXyx5X~!zl&GrN&4YR=Hpg%u>nG408C##vwW?0}H<0ghFjM z3{=QqqKt^$L1mMxptPA0cgMqc^`%$v)|)Tk<)>~(bGZ{1GI+Z}CG0nIJO_yui^)|_ zyM+v%EMDU837^d0u;*wVSW+gom*dQ_!wB=6v?Q4H*QtFkf*IBsFZjxlL35(c!MjAc&TQEmp7IBO!iq5sg) zXdk8^K`w*TVI#5h5JnCegb1w&vfyqQ{oF+Kh}1%*iN&4&8h~gIvN5upkoJ8sa6}yZ z5rMn!9*@Co11apwaa&9~_(X<5Nj9qRYlFLA9EFblYACc37&!7JjPKkUe$l;g*W-iH ziXx;qyaz^2cmzXk(?X{0j0q#|Mf+x??j>r($8{90EmYYh@ar@fPd#%NV%g9;i9#s_ zN(r5Ne)c(y4h0$ZKux_>44?MH@Zt*(p?jo8=tYtGx5KDspTmRHc(bTwCZA~@)*L}3 zI!L*o!_a3jqDxcA$v)!;Jder4x=@14dWa>Ev1eC#G)3P#24irnH?0eVbRLV5!-gVC z>x3k*Ge$i(34NnIArW~X?#^d$XB&Sw%nAgx>4m{#I>VDv?7?r7>Q>>s;{N+uVBL!1`Zg6zOlX}^7M#o zHx83W--o9Da$$J|wYOG>5~oP$qH2%P6j;ZQ_l;+InpzIQRcUb-HIo+R+7 zQK>$fjwbiNfQjR~Ay`C?A)b8zEzCCP=EN? zb5W=aK(8_H;HmDOs1b&0C_w#=A+s|jVj9_Qf!UxF9>c&M6v_k_8xq{UeLD&Z3(>D% zKeTDnM!1-rbu%;ZrP632k=H#biPKQn5CeOr6dMYx4|~QAyDy>sWD7+ymT;;`%UUe# zL9u{>-BC-+8BLVoE9tv?+1zEX;=h^gF>ca0^bDcQo|dV5)=V8Wq~lfOV@w*?!2&FM z?u}Z(F4=W)@YC^_uYMBmPV9pqb{jRBO8v6f)1leW08{F}XKNfzgP~+jxP+W+-NQYp zjvA9wcw9rul9#Z$tScrxJDMbi3%$iI+!fBQVbqYF*H1awkT-kI73nQuNSh7Sv1RIC zt;$TAJtvAiM7l1*u>_a-i_t)Ss}>2u#~?f#P6`k54VIU(=U}n2U4CW4j+v9O+&&TS zKHf{X+no6e?GPkN+Gf2O)%jwrk=<3#uJgT!i2{b54d>H#bnJoFBraL}U`nZ$9Ru1owhv}H2G$F01s!iE z6GOC3T9)0h&PM!Ld=cet!#8u+z}|TZ-n=^kMq2v(mQV0iN*ErT_#iqn1xJ|ZxUpwg zUhUZHh390sl6TJax$Z+mC1NWovJ!DDF&$+l!KR>TH3-AI218Df+$IyjuFFHhy1mHK znPB&8hPIu13XdbGB_lNy96?%@0#QxdB2=YAUg9BC`FBMN%Hl=3bI49DfIPY#sdX82 zg_+1LvLUopII6PpV9Wq7P$B+}{;n>=J$kWE4 zW9O!@m*v3X(+Y7RY8Xm0kXCF(AZ@>ej}8YmY{uz=Dp*xsi0U#3eJHDvi7Bfq&ce2h zyHRZMLsXMc_%+v(h-`-F0J-4AH};x>I(fyq;f*jEjBwc4IFLx_sj8}~60XJZ@$rF& zhX;u+ksu1#6WZm>yV-az=O$r+%yo_~aUvF_-6xLydxe9!dk=*akg{`i#c6C@xfJtu z=fF>GK$SEKBOZJaL%WAU%I@gA>?yj!n*`W|dXrf_#N?04{6m;?)aC4dT26NwA{h2=%@82#i^ z=-^|AUbyzk*5CtNTsy zT`j7`nH@{;(VX4z>VF@e9Ww&Wy+kDXL@3(uAAEe=4-bra5_d++P(|WNXc2^M(m$^M zFVs_rJyf>4bk247-Phm9NgdZcS+))#t6)-{4!%?_xg>LEHc(}t6GUf7rjiO-gYXnt zY9N%9r7)$<)UT7W4VEFW;Wr}*HTK8`_HiEUZYK2Eaw5tQwDr!Uopm*n^NHkQ zXzOJIY$r^tUL>BFVy}}7Y&uigCLu#{i4dpQ_0mn2HPoC%?!7>B3zpUR_XQn(zPMHwZjlFWm;FQ3d0!aP!S+A6Xy;_K} z3C(3zYNg|$r?gAxfW2(qHDLx%qKO$kyI|UC(veeJ1&3p=yw9#RDTZ1De1^B)01wKA*9nFvZZAtySfjud3BdbTtdA9F0Rjd`{|p$ z2&a?Majx0`C&kF%xW4ETE`fn!ws2RiusmD6e!1jVw63Hk7yA=)ppNN@&QS{3%oK~M z-MiunB`QOhR&V0f>*}hT@a;l9gLQf*3Dq zqp97KP#bKm&c}J96y838@S--+b&VFQpHRppbriTTkMnz6M_e&n2ltBO%RZN!?2F4> zoJZ5@of+5CZrJ?#^Dg~)k$N-gW(y_PE9{c#^|)d>m384em036cx^-dexR<@SM7=Tz zHogAu%bkSHtG~W$S>_y<9^1>yXfUjxy44(360H_kEfzskvAfdPv%}h>Mr{8xJ9Wk5`mdpKO?4&UEVy2;UV`tjgqvmMgzFC6zk$!O_(Ca_Od%GA7g?tW z>l_i@&_VOW?v4eEAOuN^@gUJ?{EoQd{L^43)8!r%EF3Iguqm!?W7hS}{t6dn3d?Z* z_t41@{%2>T?(DI@>?@r!*S8zQ)j(V<<6>D{OmqI0kiojG-9>|KzA^a&{&QhJ8nDh^ z#kJ~o*|Fy_qH*Ek>J~(BnYyg0&SBUjSLC=biSu`%E~wXoPSVYtrYpzkW91iEthg~bnxg{YX z#j=rl9}b7Z;cz&AKG*HJs^68!;oOS+5z)#0gLA9H{e#1~KG*V*Ylth?xU)hjh47wB z4(Aqw-B!&Wu*cppb~6nKYd9nl36yf~Ae>th_Bxmg?;&j<%s<$Jj1>woA0FY{vIq}) zwcD@iBUceuOjxn!BS}zHSSWnht7$l#TLtC_K|#TYh=>3+9Ss&(E@35w!JtECMmo%9 z*K3bBoLdF0hXyTL#zHEUP~&kk{vj5gtCw>&3l&urm;K5|`g_1(-L(56)kdiU+? zp3C9<^C`&7!;edU!PAqUfmo^{an#x7T z{iDYsGAaT_(@lsg@{e-`#aQ~|JiPkKtHL`?Ihka&9%OHuid^8*ePG2Fpl9?)NluIJXkaKLq>!V=h7k(1!|Quj1lxZZ%l%6≠ zRtxaE*BbKSK+dfObBe}5Xgl~&2j><;u<6FKYoRFaBb-|dvgzMTtbbQrT}WOW7Ub;x z0V@usp+-nVoX}*1^z#7}Tq9XAQhp1rT>S{QJ4 z*K&OQ@(XzS*=O*tr=GxbuYQO9`9}AA4(IQP4P_^P!#8hC#Se|eiRV62|Zt83tB*(g{G}LEe?aGbVlve4Uz~TH&vE*RwmlHAR zp-Fgi(KZxbZqSZm9G*K9+Y&2bc29Dl!F6vEW1{WWoz9 z9k7}VFc?i28U%gr0sQ>MCY;e*;Ix{B+u^UI2B%iez={oL;UC`Kd$_Vo%2FGmL1f#(Oo5Sw5VJFhIe}lPO zPQauJN3%|?5$q`yoYrYI!C)}LL^dv%xb8H5UA7(@Qp>0o7TQ;Cog5bx6&2XDX%j4# zYv0wnW5*6;XJ@;A{fX41W62j&F*hX?JqEXhaqVKv`({7RyJs_!e|iSbzV-r^C+RPX zu{xw~+<+y^Podgop?Gg`$9D)!k zF#6qn2ZHEl(e~MR>yZaAYRovy+?hx643K;IBO*+T{NLWkgAYH9$#2X>#udF>2+Cc<8~0@$a|CAS5{h*=1F*oln5b*FVI|&p&~eKG-B=F~x@#10(K$cx^?St?AS5) zl#7&=m0|AOxxyV#3WdTw_0L19P$T;Gk$CF)iFkOzBs})SlX&dWiRj);1AEmeEPwq| z%$oi-CX648N8kJ$n{wR7uS>@4_a|b+=$G;37a!xD6?>3b?m%#G7y`Yu5L?Pon39Vc z2Pw3wWGsJs62^`mi3eZ%FAi4G`YJ7gBcfnCF(1=jegI=0nu)DBLdwJWe-5+zbLY+p zesDE`wVD#*qeqXz!^6Wp<+1E{vQANT3OdK$s%~D`r2B`|o=SpD#Nuv?~(BIi%+oB7OIK{Jf_E$Cl5*tgY!h z0p{Eg%tw|iS%OoiPPwOCq_D6M%a<>Q$z*EKjTsH-xe`Iysy7B{&Z4lm8m8KF$V~~s z@H_jWbxb18lv`1A<~S+}bm$VVgfnG6-dVLDngNsX@&mEh@ZYJJv8Nm=l^B&ZTk&gJ z1PPZR2&vwHcfU_S>16_oT`X+XSK++T0h`rB&GOJRy0jR!`= zqdIXGru};<(C=|P+TVt4v){m+i5Ew;fH8j+)-o-2dJ*1TxetndPh;|ZEwJs&k1%6*DeN_w*tudZN`mjk z@O!%;OxA$I$NAG}+qNzG^y!0Dt5#hiu=4Wq@a?zXB0fGI{rmTKPyI7-y=F+T+jC}^ zjXKoU*3!o;^e%~wXRv(UTr4@)3Qs(E2RstjV*0Fo)BxykV8(20&uEU(FW&{p!Bvw{*!P@tJglF_XbZHU>snsF~r;8||l4W5>$`Ryhhhg$? ze;iyn7mJgPFqIy}&)bio(ys^l#Rns%OCR)U721#nj`RN*)I|w)a#D%D=s)CP48MCKo_x43RO>b%sl5J>jTkbe z2HD$Y;n~sm<31|mv3K&&;l6=r<0XaFEQVK5I}92*40m)0LD?P>e98fM`nh{>?~6}k zh+hp3{8o;jP97+$NyS;+IaEZA#2DXloX;sjR@P~#?(c_Y;wn^BsL{D|PxKxC7+!h# zS==6A!0`=hsO~M%_uioxF!Biu_Dw?i$#m3Oz2W2E3jOXKg`qv8;ln-mZvhiD{rdI8 zkRd~`cI{duB_-kf`SU`i9vvMmG%PaLIQ5^57*Y>!l<)WfuTL6dhb53QPcK*Z8+Qe{k- ziKKFP_<2Ka*Q2DY687d@(X-24cw)+{m^8L2V4?=5#v2js2jlKOcj1{w<4N3AqFg6b zjPw5-Pft%g^2j5?#pTQ|j7B5YtXYH9)KpBII8k_@?w^kca#1dJB&DJ{a5O&nU?Thy zR^f+P2f#XCD-$w#zNa&qsjaX|l(^Ju*`*&21VwhjefQsm!T)**nSu zrw{zKYWOs5k4~`xXwk7dy0y@{*W+-m4{Jku_3DM8Lx*D7vSmn4PDVjN0p`!2kM`}` z+N9nhtfS}0Mf^g)1G2c5Nk2d)D)iwQv;?!t5Le2kB# z{TI{z(+{@!-(%Ua^MJ$;N_k88`>js@gjKb~P zaV{hTQL%F58g{O6q!XyxmK$t;4Wx+QK4lhCrYaLPU5>!C(XQ4R{Nwa^B*8UuBR z9|b+f^t$ zy$fmShw<~u8bo&PfC=Veoc)%|(~Yv8QXDqPgitrM#_vDyRiN*;`<+e z#!qkegDLS#d_v+)Ez%<9E~@+VS(rKF2h5wh7*ika4V9Rj+b*XAEo_MMH-tF{>%JX1 zawP7#=bpd#;e`%3Ef%Pw+Tr#);?bsE2XyM(5gpn`!ILs0;f{2%3StTS;-p5-PWEJj z)-M=-axIKCuHIWyWi3oKcK5Tm>Rucof|$y%naIk0V=&>vAMxXo*?2sx3JWIxf>MJ5 zYK;V9_sc*XcB%{842M$>FE20Lci(-&5C}^={+b@EIwbJ+^MHRuC2HK413Dyj*qwHi zWu_n{a|?ca=P8VO@Lep<$iZ)O-@uB5Dr!yYkV7J^KuLK%N`>EL$SN*HDJ3XssnEYG zOa+N7nL3I)IJoZ773qU54lr z=mncC6**ZR=-8U26h3I(BNXMb(%etc}aCKC1*_y*tnxUqm=hV*Tzc7^&W2w?)J2$Tk$T?Tpr8TI6m23Gcr!AE^=& zXdZI-dWhhuia~7mFsgeRatobMI#aRuqj&Jr)*M(xQW$G%VYKpA>+cK`R|5tN5W0H* zYV39k%Cl2&Q z3_?Aul*H(buwB~u#o-_%Bt#f0|Lc0JE)o{o6<(1x{I=y3s?%3v@#YdZBf28K|9E^d zcPW_3u=!X4YNSFb{oZmke3sX|$e z5zMtjHWNw;&LX#z8$ajf=-9C%?!NnOD3wb0l!nt_aV60Nq1)Iv_{aB0GdZ;ggeoc! z;qC8$r8W>Py@g2#81NR}?;ng^Q|`i`(QhKR>rx2OCR< zVdjTJ5uvKz5GoLKTQ{i7cHsR-$71Y*WAOC5OA+wYyLhxu1Y{nbXc6BO-V&GdG#UIH z{{2=jB)mBqquxwJ^D&>{ym+1Yq#Uc2G(ri0pSKhITxH zH%AS_oiA>HuGtg#S8K|Tdc1=72L@x`+jnEwxOb7>?h#D5uN5>}4>XH!27kFkxDJN% z_k=w)_kROr<}JD+w0IA`oiYgzPkaQECOm|P9(fX9Y|n&M8H`q)V-TofU9NI?MKncB z3r|WVf-wA@m(X3k60eM#i)^(ALfdL6!EnMetSwrFQ9_~gLs-iQG;7@kcMTd2^EZ<* zsQ(Cjo#nuY{|+FJQ6nO{37Yx4f`QVn1v*BDL-SW$YR37;@xSsBQTXkc@~=k_ylFgc zAN3BZyFQ9fUmHa6UjeUxNJK@3qGfCwbnMn09on`=;3d6JR%jyc#`wPRsNDD*hCX`; z(ImiL?duDLJOpvgLgB4ZqDdP{td1?k_nVV0JeG&UX($rX2!8}o)#cqVLhq^wUP=kR zpZx=3nl;580|vO}xpCU`s5Z->Rm+8E_pp_$MicZl2|Ts(i;9i1=Ss@V4Gsx3{z33! zf!<+(K@Uh}I+RyhAy@gr&-?NgzzLh#2z{*{CYv1&rxPNv6rKV8P>V&B#ha)M2b5lF zT<|@I2^A&fFgexm_VNa%d23tOW@%j2roG;?Jz@EYlp&94cTAcDZ*(a&Sqxf*VSwAELFn6 zUh&j`^T{p>)~ICIx9T{sUfyzm@UlrUVx4nyU6R2an2`UOy1bJ_Tv(+Xpa0Zx?` zD!I6xYdT<~y0BNW*&Q{gs+Gehz#Z$!?`o_fcrbgXm|s~{3kSt{Kjt_bPGdtxK6}5CAWexyY|HWco30{{721&6{q1S6$(hCB+xIoMMM4LqGyREV)8fF%}W=NK`ALa|}j@$L? z)?w)I`_Q9%SJWD>^pUHIE1FD=hXlKK??X~jBBXU=k37(G{^^kYv)jR&HgASI1`Z;V zmI!z4HMH@NQ^sA8n~#m_*1E1=VXNP)f6%tYzLx zt8m|lkYpzfI&GI~~X(z+$cGDR*N(1}YOl3+rcsqQ!wuVU9J}=0Ve6`0h zKhbG*;-OW1&*XJpehApn_N_wt(9Wv~;t4Nubt3og>W>MHF`QAnK{W5sdW$*rEIREg zHh*qAgf!&-d17{#Hd}P(;hj@=&TL!E_fCFJwCp>18Q|3NwEmdzm_qPT0}l(N+FtL= vg$&@!_$@wgR1|!M0MN6C=*e8n_(z_%zh2*3aOEf9Q49>8u6{1-oD!MwdlN*X#OxKG$`l0Kq%WY3;G z($=@GJM7uBuY1p)y}gGH?!I}y&uoZDDBy^^TYc3)%y{y9I<4Bi(`mxQgZ3ygY*lvZJ|8;f6kW- z74F?JcoJoQ=+)+}=l?!Ev-kKl-LF%}{@y=uC*-JtXUtwtCC?G~#{@6yv>`bD0f8qp z)ek7EN;Yd$OVldcUS^M6M8LS%F_3tPH9g;Ad!l1Bz_13e{ z<|^o@$4>abju%Je>rUa8XREku%Em3UKdGf~RqPmAU8qu2T9WMvHvr3ybqn0Sa)<5? z2^iPgrS63IIkTQaPZ?+bG;<5ZSueOr(YDx-7R z4J|I{S07rtg$w+ID_z_v)Jvg%%1BXd*DV}XOMvaK&coF8sc&pMdRQD6j~y4;H!Z#) z=bAKHt%!JUOdlrNiH+*{O%Dt&ne~rcaeI}?)>5sn<{AXNMS~eW|1GHdIjHO3amc=0 zXqT;>IhY-?uao!kU&oo0q!y$`wb(TJw#vl7SGDspLyY*(A^vvs9OWx@hUr$VS~m#P za|pD3q*X|EXu4v*h2PN;CybOKYjArI8*Li$efGTD`bm|-W!;d=2dzW?l%0g1FkkzI zDOWLgwh2>_EFAtZqG+jP;eW?-+V-4+gYU&`y;~nqD)p9>-r2|BpY%hD9TO z@3{-w;L(6vcK*+@KYhpWHQc7oi8JO$Mwhgce>G`~R5l-Gl^Pz0mTU_qucVrz8`rUj z$IGMD=%PtlYe3R|}QpmH5J6$Q@TezA~NcCmW$88u+1io%DsUA&!p&Q%zdO{_2o zJukm@=^62>PJG?(nxO7%lYn4Q-^npWtE1W+h~oLQpXf4=s@4B2I?Dc}9H*eCY#0Le z2$%awMS*_A{O4==A4%fL6eE(?NROf-o@F_flpb2owzy$+coWuRr*b%yYySvVsk#K3 zDZ@3rcUJ;bK)e`i?82J0eo%&xXuDe8n0s~U)>2?b%(4=FeZ^iLJ4 zR4WZFGd?9|M^@lctx>m`YiG)|Svc;XH~OqV&g!;>gU7-aG>cOp8|k6%YkJUFoAu5? z(=bv+oi$ujtW^lgF}Zo%+apB_>xm2dup8g=HEZe`hT@9+z&d&X(Ypb&MJ>}_xHXcr zp6ET6$3yHn$mq$$Z^-LxH{>#OC%L2M>LpYBSI206EB-O$T*%i%QR|o*mkTO1Jnn z)Twr~0FUDYXMVU%wpmX>rLE&jSU$`(4Yap!-ksZb=HF=iaAR0NTT(9Dd0bZ2h9+NU zfTQj0!v+%Txsc4^Vr=dhravdRi;1IjHTc=xu65bJn9RJ75Al;y5CnK%H(tR}5FDGn4|N?q$Me-Ty>;=)KvHF21)-@rnwN5PC$^|C^U z7JAxoHG}vk#sBkt(o@g2-AeM^YK2F%MqS8hF)xJJAZ$m$ShsHLod+t~{O^kQ7H&bt z6m917ZN4SlXN0$eUjP`; zZ(()39k^D%JO`<`QesL)?%J*G@3^Ghm>z1#=hAKsru3&F92jMw;y{z*B7>n%RbsvM zj1>Q^q}h3-N|E4ReppS##12Y>=r;VP6trqt2u`kX#tHa#b-vFIzO z8o3~r^=P#JJUchSfsr<7O8|n28b3yc-_I+2=eC|spf8i&j^<;6xmnzr@4HxL4@RqF zJ<;A{#}v;K1^*y!aZTn&AP8H?QElk1qYm@)HM2Ew&I@G_{E-C)^K*Q zWEVbFdiL_W{p4;^JR73iFuB#JV>tNWuz%~xVx?0iLyoNTkFc+t|3Q3PXmUBxCo`-n z;pvVvMP7Z^=*4wYJ&QI_vp#n1+G(4~fYU93vNGzP6Thv{=o7d<*4U&IQH6DL{|s)v zOHiO*`!AF;)brm`q5u35BQ6$wf1<_VpzeZ7-K6F12I0*<7zN0B z@XTD$eSBGzE(shl~&u*yHDQb-!|ME?TdS_5t=eDIZHK$Yw z{o4MB%cJn6q}4Ag-KB3-9PaLiK7UDE37Rkw*fDy{3rhl8XMYa~-r2|mm;NYqduPSn z$ar%g#RPKyoj-W~76dWvxbkgi!T~U!p}1|3Pxbeo_KT^@&ODH|uV!9?*Oqc^Tp_{P zzr(t9?}^P#<&Pkb|J_{S!2W{-Ow^m+zdvE(|NKApdj$vL;oPX)H~mcXpMqeA&G*+F zGgE#p{QM#Hoc|%bSOxRF96AMQomH@**3CJjp~Zt*eRjW=PY#7S|5JXf?zrMP?BEH# z-J-U+8;>e}7vOI)0uFh0{}_Kji1B)cX}hRHl<9cbgu+}2LYa<#n3zPmmTxihee z%UeU$$*|SMn6R~i;f(?|{H&ssh%{9+NAQf^QQ=qn!E1ICI&$ay8tR;V|BhEEM3$oJyS<5Kb&fY}RF6WkAW|BOl?SM?R*JY|dr$w+D*vtu zJp5s{lazbxpY;=8h{^vJro`;{p8M0;vNTZLP57AJ?GQw6hd3<6r+Vkc;bib3`M5<*u~(!|9Lu zVYTL-{dY_){^zK|dD~p7_-2**_Qq$}`nr+JshcC#evk5UGG9o0v-#^M&0jeHL@jd7 z&bN<%-Y++sUwYd;0*13)BlUTRD?f=W?1ogRhW zJCo-DSbpUz8C82-1?gIA8&YJh^@k*jFmyln**MjdcuvE!rYyL{SH_^@MCv}t$@5vl zzsMB(h(Ep2rIFGhDzb{E0Uyg2GM(%qU4Qq5#S#E*cN=mG9@Q@Z?Ob^u2GX3?=8_xP zzo_EJ>1cx~*HHMdvO>2dweQuB>|Y&m0`^w2LhrGEF7S_~r{sS1FmE>09x^3VGw$zByl;9KfM6-2cPVZ`))k}|Q>YP)LLn{x=co8{jbEWG`!LKcaHVN0yO)L9P!K8d-FuY0@QAwGy4PjQ?X^mo%u=@^xtB( zGxlW|Gdg-rcz08=0{P^p?($q>?xCLwMs>+|ekz%4=6#IJPY$gq=I`s=U~PBd=U6tM z%@auhCo$`1!jDPo&b^Vnu$fpARyj+Pjc!>pQNA}nSkt$!Q_Uq^W3%R&y}~LBF&lFQ z)|#FWZI*T~Cme|k>naUDg>jN|HBWZcm7JQfbWNsxlGGjE_ZmPhaN2)Z&anHuX>m;C ztX1h1|0}HR(;a``-mm>&`pe$`Y?MT$!&edRw1TGT$Mz}PYqzE*Ni+RTKjqhJj>n)S zS8mQgD~_q@T{f=~)g~*hwiC^!3KN|7LgQgCo#&RLWo|obw#dc@oz2lgWc6`aKeq-8 z;9V|P+Lx9rBCn~O__j9P@eSkScRDVq>b0zr7kkk8-1YU8W2z&Nan?GimSzPWI_%cy z_S+isN$UvTJc4*X51n|b4DI8PRFGrizOhdT9FHnf`sP*EI@1D5%4_j>|DnjqU1)BM zXy7$I$T=?SH2?X3oAYf$o@~XA?-E{i->*GQ?Oo{q3qxJnM?|>4`*>8@1oo&X`LveS z0e9*X-@(fVN$VMxRap+2U98R&J*V^&UlU77dkPMj%dF0XO)rNs8`$q&=SdLrO)kyM z*Q1@>Po%(-KPm{al?xg#rHcQYI~TF-rR5#$c4;D7tbb61wnIej|AGF-ZiV(+ag*-8 z9v=)baGBBjcw!G}AWhyw;X8SR8Qf;xl-fEjt4ArPLZ85t{R*-|sz}g`Hb#d(AN`Qai=(y8;3;czz1jukNNLQy83qV)fO&Go)0#C-+>| z4o9DsFqV35r}sSmUzHh&<;00oveuyo6cNjowB|$K8bf<$5ws5Fe{afZ#|eMT2z7t< zV$b!+4)0l{?4keu`p{zESO1OlsNlbE>ODAtYEV}ZJymVvzD-CMyq(;bH7yTiJByV4 zN@vxsJB2}D4GBGBde_bGrc=(Mh$#n;E48!+xx~MN4GAux%IK!x-mR;Pi7}e86zeh> zZ(^Q-{|mZMYVZ9iem6+}CehN;_VqtLe_iWqkeU1=e^B`E&1)x9<`puZ>5-58eIxd$ zDa0Y~>I=12oBI33rrC$q^e}p`#f$vbxm(iO@oN%YSYJ zHbf)e*&n>L*}wR_?Z!!rLJEfyrd$ONy8!xV6=tPU{?%t6P;kp$BMj3VMus-tH%IZI z7g=?C4Vr;3->yV8$Al&GBGmK|ErkwyWYv?dt??73g53O)O-FXZA;zu3Ewrp{d81t~<%*-_ zNUQ;rJ01CtFl>vG^|{ z;Jbk$dd?2YQB3jt$+hNE&(70XnnNM?0!emsBuZJZbv^OD79c)=j50D+faAZ`96 zYk>sMyTnpGsF{O+)K9sRmQ=#np1;YZ4`@Z=?KoOE+m;mnT<&xbLsi?2sP&_iIJjIl zZM)O*p>E=y-O<81`&q6w<$eyz@*j7n8GBp4!oHEK1{tAfZ$jbg8SPc{_#~G?3e+1d zD9xZeO#LM+T1nG558ABHz1PwHSqsu`T}2thd0T{Vsy$Qu;SK<22griYE~$L~vlH_j z)oq8|0um8_Tb+^$gxzDJsIFe3^*s|xt ztJD`CE}f?CDM~A=SdcHPMELT2NZd-PKS7mos;=(U7Z_e}a*lU0Gd!O^d2ov@nMVCk z!r~<6g=5LlVh7L_gsf;V!Mg*XPngb) z(}rVg^%C>{`7{+`DFIt(@Wxf-rX*=RhjgSC!urqDgLJ2q_bwYOztmHGm=t2x;|z3% zR4)duwXKIl963#IXxg6MDgtlgP75|HOuID$l}dG%M%x^V9_f?yRl`wI@;W$1I-h}w z<3J>Pvi<_}*e&X3_#--`g@7}ZXAZs%YxCa^4st961 z-b!D3Q)L0m{e}FIZ=SM;CXQQuh&txMFL84(+hz~pM2#YP92r?qKb3@jSC(qKFX?B}Z6;cgp*|Dj6I>k8y#@1d*2lSJUfx%jW|czXv|NdNyr7aQ zuw%Bg9lMf|X!Q%5eBINXlu@vwN_Xw5;vULBKaoM#H}e9JLH@EOJPOo*{(C%(%B(`Muwzo{MO{ao|wRPFw8&^|QFCK3$J zHqJCpHfUrfd`<_X`y`|nm)EBS5z$2fT6{izyQW9Aigd-<*NR|Ot5w+E*Vdz?9hst! zh~Ti`w5`{IWD9(|z&>Jn%L#3o0FqjBXkwbk{7G)sfK^UPaGD} z4p}_n+|GVre%v7P<~;^mtdfvfrM}#X31%1;R~DrS8Ge$yue`moVER)^7YIU9#wBx2 zUI^i}Oxv!Wb$-rIzFld+rO|e-4m2;3`5%!x2tXj8!nFc3;KWta?x7p8#|blkGK~$G zRBy}Y`O835*2TyrBwS2ze!3Ifr!t%@Jrocl$V)&4>F#XZ5PVHota5)6wFzMOHVV(f z2f|BnA2TI6Zx`5f6tny{?g?RSJhogOZLif}geKXZlj2AJJOC&F_S(+sgBroL;uWGK zxGCezw2#X6;XUHuv@@|fpWa1&)0RoDV(lYpvkUeE%k^`&nu!X5LBvue*838{fSa2y zYFpQ$ny^0qBUW^EI_K3h0)8?IK2d=5(A`>3=5p-CUFO0f5%?A6y=7!bhIG&)-`wrR zAkN7p3lVFEA!V_m4(A$EsKjH)a|sxAUD9v8P#q_UX>8F$nmp>+XM|t{4y{=B@`jA0 z7N^@c{Q{8UVmqFFwd+|=eI4i4M9K$(THQkiO3FHD&*Sx+ptDhvm_k2L}DI_YOy?Nv>YjtN|x3KzoT!#=aVw#H#3~ z7y+)#*-KZvMdln(Gabtje$J(>nj^lt)a~&k-q?EyU0EorJ6M2!G#o1pT@x~b0zU^4 zP)}Y6tZK*i#dumZI@oX41|{L~nv)Y{5k}9RT!EEdD~Y+28|ZmB`kowgm#&$4{Z4Mpb_W(D1KKO<8>iay_5QO`-PW+94r<|6UU$`0MS>0KkIhducHP6= zl_5mA{yv#fa~Bh8-||Vr%H>bo#W3#yBkktcRjAjK1aW7wPPN)dd0S~M&)t+qq0l?c zLmCmwZzUoB>mf9_PMlp?K=)h~`ZhEqO~Lno8p%spXOG!i5QB#UM2mW(nj`~sqgmgo z$v1TnUIoc(VJ(9@z`F)Rs258 zPe(P~&Hvb&p{K=&=l6K4Jwo~Ze7+KQg~4V(r6@}QwTf~toJ~vLyXE0si5GZEPg|y= zH<*9$`wwD6#3uD8C?eA|@ZkF0a~^w&j281W5pwlQPI)hN18%Bboc6G30KCx&YXpU4 zG#rz7Dm)X5Yx#kXCz&SDveNU+~TkmAwFk z7x%wLdq~z9>Aibq%W}MEXEguBG?;z8KB(^qsKL8snB~K(hztM|QXpGr}o# z4ixH)`D;yDdy-vz=t2vTPyK?rFJn;-4&L|$g~=~60Y{J0ei;Nn7C#u^yboFaYg_l` zD4(&VQN&^X0Ac1f!7DAU;D2+TL@2iGD*;tA7ZDL3f#n`}zHCr4`f+lJOTDU|BQ2xE zvQFCt=YbtfQWpO_?dY5-x%CGN0$<}9fnu_RIPa`U3A6~7n>p^mj@f3()=?C9x-fWgjX*zycsCKBm`9!u}fMG z<5V+`%6qlARKsFMW1{3so8)Tjn5v++%cGbGG(=UoJT9#Si>^7Gv(tM!vpzZoeH4Nb z#k=9H!#Wn4-VOyUw^a4x)?^v`*tt~+h=t~$a)$Zlwam9?{#RV$RNKS$$Z;Cj!$!;J z=Da@xkEo?Iz&gJ)J}gJWufm&!Z-*22{yR%_Ub*Pr^00UXn?Z=qHn*Mb7P8TqoWSCt zx3&_vV=K;sb&9eNi&M00-NGJOI^o!arE9(Om@LmJF!{Q58f8lpr?N zb)6PpF;Dy`dI?>oK*>>mSP+K&n74f6yaJ=f|A&|*TZVZ6T4o#dCSzSnppR=q0!E@& z=}Cv1k*?)lSYpF7@$>l%qpuXr$z2A$QpZ=~=w#VQJ%mgy_Kg_KYpD$9@hZp!l`sjKy4D`nCT{8;YZ8` zAQW1(w5u)|3`fnk&E1>UHWUrA=B?IX;xFjbi;rmY zE;#|X|AF3*0%c^o>EwT7Ngvm5r$Z0tqHBKnWu=Cge~~>l<4}edP21yi35(VOu8`1z z+-cP3`pUcd=hlWEQ)Py@wD3b0^3kw`m(w+_;FX2LZ`?jQy$xGU+vwy>KtW=9%c>lu zM^e>wuUV-DC^i_$dR!Np2cb347G0}4aNtaTUBrr>p|5`~UlxpwdkATP!uRmto!q3j z$a}4s-ypD^Ee+VjMJev)#`)lE1{hH(D5qq>YPx5e`F|NCjv2mMMg16E89y>bg8xshF#6QOQ$lcpW%^kOVmgO?fA$*G1KhLlSG$kkM0h~>0zUN_ZSa?))E?V zud^;f-&!e6_s;Os7Y>_mH-Bj=0fl(h)7V`Zf%nRPUYRfam?eL*{XtC9i~KvePXKPH zY8Sjewa0wpl2Ub4JYsr9l5;n1F<|vnad|=R@;^$CSIQAA`T;=|$znJs{7x=#)pmwT zS#%93iyYa7$Xpknpp7Q9A@8fV;I&jKrpzUhaB+@@DNx3z)6)0?nwo1MZ+qK75JbSs z0SudK9*ua}n=I=IzDsD)g39XJnF6(RhObT?tq0FW)+6-5B$cP(Bf%;7&GYGxc%^XK zKr+3RDJG9$!`+^hWy4nVaGe>gf)%nGxJaw33bC2a2q1(OA|}$SserNuvVayI1m`r? zQ~&m{ViDzfiyu{TrVCU&0!{(Fs>@U{l$;F(hUZ(FS}9?u5z*`bAF9lGrCd)RukeN~ za?f-0;#9nnEuP3P%%pRIV+=2sx9hAoJA-KYt*&94cX5ofxm(?t6k1$k=zGK#KuC>| zN~gsk*CkDPu?Gx2g)~FNz&?00r4+Xvp8{!Z?&R1+RBV%GRDuWu_CvS`pj&D0`m9L2 z9xDlJqjgEl3M1El1U^ zKkQmCGZnmP=F|X*yMeYE03VB_(9=<21uh}H%ck@15Re@g&G~&zz$T?0P*7v1PF+x5 z_QpDk^BrF>d9^h-M9CMm-i#I;>Eb&g!|JocN6kQhe%}I>+Je!jZd<`hnX3<=+s)ge zZc9_NrW;tDnI2e0Qj2`f9R_$)F|?~rS2pQ$-Fcl$ ztL8a*lTGISTL2M;T}7XFs>+!4eM}VF9j3SCD*iY|Cp7W4lx7(0WjXGYr4Ivlae-50 zv7IgE?=p;?^-(-*0JzF!$&Uu&>v=w8^JqZ5c(|Tp>n27c<|jd%=wi}ROT2(8AsnZC zTJy7%EzJ)|*RAHcRsZ(kVbg&-QwWF;@12-4ABpqcJPPOM2`iFw!Z3JY9ECyH5$K3U z#pl61yr5iNnB~9l@Ip1pL|82l&bauxZB3WJg!!uQ#R+}Rc>0jkfxLANvz(!hiRe z_*sB9$76OE;tHW$bauB8i(L$n!(h{pu|h%S`M`2}mr&Wjq;xtWf?&Gw2C-~j*A%1f>|oOz02)fk>V z8owYo8GaFyP}(>U=mzM?3GG^hE!uBCNw=u#d05H-HygIf&>%7RRT}`cut3>e9|yse zW$&1ZPBEo|n!EYQWetq{MQnjeJ>`DAfX?9DlOOdEUU2qK9~C@D2!Dw$Y8D*x6mk}cG}a&RO@(qMfE&aceM?@Qf~Sfgn$pgs6;I_ z!rD|*xSL9))fCj+Wzk4kQ1wp3A~Lf+^e>*Y$X)U%BOMh{h@X+9P}5O}f>A6u<)Ry* zHOXx4FZlfXdX}paz>D!Yp>Oqmi2+&8pu?|hTE{R{z`)$I18o-QfULHE9Y|8kkS=v~ zx5%h&mzi^Op8;O-*jeis0EcH4Y)wT@jz5Mo2-_XoOXKH6Lwq5%|GhP=>q2EXN*roB zIco{&sWQ(rt7>9yPTN4rEM+QULQs0Ctbc05oSQ0d4yBp|qt!RDC4nl9B@dJ3F1wwl z1hq=+Rjq<1{2WJWm7D?`Zn#w_TkF^0elw;4I)6;RlWgbf(Eb5_Lg zRr9M~17kWDUBRpAB~{((cv$~L$8QzvMN~% z_av97A+&%g6J78o2p~M@bfmAEZ@HLmLB=W^5i^>oNk!$B!&NjNwP)qo zBDx&7z5k?u-?>=jB5Ou8-&jcjui&nlPE4`5bOP!{H|elwk>~0iQ@-?$SA8+HW> zgch6l(T06RaRnpYKWBWyOEE0j(N0+Ah-aoqa=Eu+L={T(gEfJ2pRgz;7<;#flx`5< zjU2QWCo_4I*V77XIRj^u$`L(*n-KMbgwuS~@tRgfKApncxMnJZ7SOi`h_oQ2SW+}T z9kCR-!s2KJ8IK-JGxt*4>O;h+)jz@TF}y*RtkCR)cU`kRr^1 z*wgTmtBjz`jT6adGjXA6(%M>D8Di-X$1jETT@_@)oUx!t)|_m|@NU^Y8FVYWRJr{8 zPH=*FKz9*K%HDb^+NkfT`fT)(;$b1f@^X6-S09dCy$#a$#EF-Hx>b%UgT87c%Rg%D zGEz)i;D@PjWY= zfe{h&)nxJbWf7g<$!#T@3?YSm>9mF9TrT5?=jTCR*s=zNN*HVG$U)Gp1sztrBr)Kn zO(|JhFT+jD-lzQfT{`|?sb)j9+1%@o79jb==;nu>Umclmx-Yl*sV7C8Qx7cELp&-d zUnFS>4#vdBEMyK(sSAe_Rh;=(?c7>O8g~NzBxJIplU61())ToSnCZ<^8{T9i|J1^% zOb|N8e97FEbn>&|_@hsv+N7^uWcFbx^ROssXx@=5BST`l!R(vUQPW3qBI3>6R`PN% zelgdK|CbJ^)|T1N*VkI^=!}&xW=(JY6QnNhN;;@@lJGm-;21FkZ6UmJ;?LdW1*w~_ zIp1zE}jx4U`>;NO1|K+!VR#nvN!A={GYsCbj5FJw~^3F9gv| zp5o=Ybi|`j*v2n&(V$Y!4`($v^Sz*!=jtaL`0pL(W;G|Emo8%1Phc=8_=CSo;ju{@ z?TMcx@4RBaa9%wgCXo}wq4P5A4ck^;A7xH78)aB^K|Kl`FI;qavVcGCj0x5C?t1!| zbi}6AiFr#!^jhpB)J$5u)v;j{c}V_G_oppZ(nx1M3ju5YRe}rN{vUiNytK+xQj-yG zvE(3HJfDnB(5a^}#kl}FQbfi`Cx{fFV`7##%{Hxx8rRV&%#6y>4~wIl-K5 zLmA9)&|>xL%$po>89X){Z(k;6XTUiCsp0v1;FBhS4YsOGFOMz^1VU{KNGN3d-r zd(8I9PEJryZ9lujfZ;uSrvU|QMe@Ua83{6xn?4k&Il^Q zv%QmZ`aG3_<=eE|jN3PgGlw&y4F55*_+Fv9Mlm}shnTMoemi3uGOK{Vg}Mx8RCA9d zT%#%Vz4AnkR~Xt)VBWmwDzoe%pc=*88?tmOH+ZbdMP_5)W6Nelic85f)Dw_EF+(Y*z z10T$LcP_VxV#sovMo+uEb=u<(o0h-wRi6+@-&#wJx$m>j?z*-UnDq(CCRwv@JtWDsNlPhbY_=q!Z}=mxnr-_v9$^+Xo~=X;F>z6D%}TyXQ1M&Fjj$Y9JxT0^&M z6#X!a__dOwVGr!H8-c$a4JBV&_}o~e0)W50=+-z~TIc@Nb|lPkmkbVY7vXAEj8kQ} zocMaG-1~)Inm$;(2^H`N4Sj*m<{pwfyp-l&F>h%T>_3q{F)_8le`gpY???>)ds%7c z@qRxCd)>esiJ1K0Lsvrj&zg#<65LuXRsUp*U`N`qKbp3mp6bH?9D{A9B$YSo=_)Oq zZBAKxKAJyw&BS}&3!I}36E@tyd373saNt7xYSwwq2T2Np{$O|P*56&T%(;rJ+~L2~ z=Qa?`n^g^bkE`B{g(Tx;$_dE+y|7JfE9yN#j!(dFAZ~ggwpf0B?}ZU1*Y!K~Q$e|b z$wU+P$NckMjfYdXpNt0}{0;*_8KI_+9k^K8>?@$RhU*Ma4(SjUW#E)Z0KLJs*$}mS z98@PW9XbnEKCeLfkw@ggpOQZha5ou?m@?AZsBpSaBf4cew&(YSR-b-Q*xQY`=R3^UpEg3se*13NEj{STEDt#18 znH%7AWG+^eiRbM=v9+|==%Nr$_yR(f#%?++aMU$wwKMj2gRlBY&UVJGfi9uqN2^2H zhD)5hd7_?a*fu@@BB%PlK$i-7l!2;q@Fh()OSq&KF?&YzJG`_!6Cj{vlFdh%VeGFL zS~NXIk?WaC91z9a>t67LE5@g&q{VUoyXwd|Be@u)7BR65>oTw8p4L(U-AJWO}E~}aMg9qnVZ#<-=}Md7U?mE2X9;;TevD1`z(#1TGL>`v^VP3vN~h$~+8gOQ{2ZE^Q+G%aIe+ScV#;y1p}8oJ;5VDm$$vGc!Is)mY|Uv}rGnSCxv@?8 zm^A7#@w}TW*vaD45=(o;j1-Yl3;*eFfTO_r`#85pGA zOk3~z8hzzUq0Wr=BGqK2@&a>gT<`%;TK@%0!3Ap~-k zYmUt=fe$XB~G^=S` z#EI-gum?Gj_b=IFLW%~POM}5eKt}P0>3bOotyHtJCnYF() z@8kp~j|QccjFu0V5=8FxC_GJSi5aT3sLj6k$lX%TmzpAz<1Mk(xPM=66lWqL`LicE zl9N+IQm8mt6#E}ApjlmWr36&fU;4)+J8J8zU@}EeS&$Q43>41NU}GPqVZvYhi1iHr z@NTy!W9viRhT)@cY)=P8+yVtTl3m_-UzYcrEJ& z%{Q-JTt%r`NjIuoRyx(t&)OymsEBaWXrVQX3tZ*=iZf)SB+(d~nzogm!VLE?`3n_e zW7Qop<`EVQCHrGh4!$aXZ#Um1$7lX?mR;cA@S@FnQjIh&yh^*Z)e*y%h3@%YU)%)DCg-#SY7mI}j(Q!d42;ce^^=FiuzujF2-X({h^ zhkNQpl@H6pJJ#j|N%Ce*<|6t4r=&pTXWd5GE$aq7E!%4`8EQ@o_WjG!006+^Jx@)c zf+cG)!d&L0a1pw@O&DL=9xKPbGc@oCZMg{4oGAQ^+LSS#Xyb(keEmv&o*)sl!WRS4 z?kzH-2ms^xf`LWW(ESxT=LYxaC33E3ZWQybVVBn2&iY3&Z;b5d0<3AWSXd@eO?#rU z5Ns^DJQ=?pVhG)O!&Vo*(P2g`tKA+~Rgyhm^k}#k6OQ6~)O$_5!Ee{vSEVasilqOF z%gP8~-}IFVT|&oaeu@%DTFh>Y8hAwJ*JFFIpmegQg~VU>ez;vXo;3Q^m^r&#RwS1&$ghZB4jYKjq6t!vVaY< z<+y`!4=iN`2h@U{jEseHGXX2F4&$VlhaQ&Ep01`rhD{7+6hR0X9}6h13Ze{Glm26bsm^cu=Y)dX7W~Cd3M+Lo^A%%69|HSn19P@vB6DwxEO<3xfn4LtP?7DaEU>RQUC(t_i*8~;$_npsPWooM^GsNmGEpQI0gmVD8?Y2? zlDHtLR%4@@lle|dz@LvYYzxq{zwfH~JF-?IN9|NO%(cjH!sHK6YgO@VHkkSMJU)qH zZBhuMA4{M_5RT2jU6PshkuKwo%!tZty_;@QX34^^Z7O~Jv7;w_6Eg+l;B@$&*;ZH` z5j4QlnXSySTKz8kVBV1aPnuL z&yu~~@tVI(_;Q&EJ57Ir5>LBPYr_EafSizD_^le?#sYj|o!M1(VJY|T51W|7vpd5*bsvu_})|#e7L8JTwH%sAEEmzU?`W1j9ol+Lrwy7E1 z)x7c<=$XOQLsW20!ea3o#sze}dV8#;ERBr22uh3_<-)9y>LN{>Q~%Q0ls&$KAlL$S->ft_|HPXVCq-plpj zPb#usXf2gQJZA5bcZ-gCzoF+qk)CMbp5NxY2TAIsq2|72kNrIXN1~7|2Nq@#zO-Ej zIGyrt0W&+uQpCne9QZH!{H6(2)6I7h+`r7;M$fzr;EE_Zzh*)D|W-#KfumSEzE zN-c{h3r4vIR=mFW1J8*GBp_SW0?zJA#PIEYR+_(rw|QA+5E8x3R`)0L<2X>G~JV@qF3UW)y!x-lgS z0Q!iA5+5&Y+?F0Q89zHe8IkTxX9GHGfQ6$NldEJl(G1~MVF%Wi|<%J_Sl zRC9ez`md7#oGptH$XLT#6#VHz1n@Wb_v_GB_L+qPYuk~l+!cmQA~O8qNqSAHxLLjuDm-Ro%*32cTW z0fiS&vL!hp$8M~&-fTO(2V+06H!xzz0lr|IPV?vJng6@q;KPc3F|$!{6KMGzNG1>7 z>p_-ik<&t+kj52VI?L1p*GwlJaW7>vCw(|o1zFqfjw83z%!v;?QVK3Uquq93X2o*NNc9`nP*obJJ4s0pQJktnLhu>QB%#GM4it;sg8B?rHM4(MvQc{!H=n24tV;ixin}^C^kO*>=L>fBj^iq0rP4iO0y%nCIsmPs{WFT z^#qmbnfs#lj}$5Zx$`AEtmy}AqeB(mcQ`HprA)R68P~CsC23^L$9584f|P%CT9Boz)o4RyeM{R4=%2`8unvsy9~=1!|HW^P2{n@+ohQHOS#jhX zW^DBzrU3RcuMH>2Y!7NYiW6!YEea3mSd=|!r z1FX2_qru5>)+(5f0U`G)U&tpxaP9-Alw7N=$3lFH`M;GoN(V_a{oJLea6YE;(wrlG zfm}&Cd3<+tWrrix;sXyQVOaY?b(hCViYw-mZ-eQ9H-hAp zvR7^3z(aV%M013qxDdb2vZzQ$Ez9Gca!)0y=uy-)AI8Xc4e9BEByWOq#e#}-jDsg5i@E)sb9`gw9(E$(=2T-+wt(Q)L7uUKp>AoLKr?IH&! z1d~>3{`N-vvv5&+7-yxZw9*$bTQ5lCxde0qgbV1`tSM(bUVe8(CAFb-n`@zqsodGH z5>zB_|JFeU|8|8=Zo>xn)zq=9@C4iD?$u#zCPe=rbIjsN=5SyIHsbi#o#AcdAg+CQ z9JBK#FS%R@NFl%k+i|SArZpds7N%xxih;y&CyL++2+cs4khqYU75| z++D-RJd^O_HF%D!HTn4Je)>GhJD0OivWx>aCdw6 z;|I%)!$-p`MB_H9{|Br}E*FS7;_}q`|d7u87U2^YgKUpw7jS=%TfSOlezE^GR z*FNWWkE!Rw+)2kAV#iH4`_j3;v2*U+YIDYKv?Zu%xNnlZ@%c}*mmD?&7xyddWuN@9 zU3}kK%-@J&End074mk2C`}4=_VT*6S%ijCrTWssFPR5ekf2{_ty;bV~i~ZIqOKRlw z7bg7FubS{|wAGE4s$aiot6RA~q%QFCO`SBI{dR20p`*R%lXsq{MK0^r@|CV?)w=4H z_;yb6Y^6_J@Wis7VvklZ$?JIs?>fGWlQ{K4#}+>H)hl9lj3+SC=c|>wt|ec^9c9oI0$&6b$3i{pBXhts!y{)hJD51(s)`ITSUO&ccJ zr(W|U+h-~sfXDUOU!3`9`~9Vt+i8DyuATjf^X-B=m*E86XkYumFYIX_`ktNf@!#5u z&pOfOOq^&he)g$0aq)fj!jFF6Uh=u0+0TIGr}`e&#>z%|E)`UUKHi_P1vq ziTT@RbN1NHrjHxK{l-#gG||dw*BQv zbL`$b@3Fr*_iF3u>$3s8zplZX!(&f4PVYC@U306w;hUFR&(z5_ya_h0b*^p4Ja87G zpYu`lDbuHJl|C_gg{^~Em~5pVxWuGi>JukUOxjZy_Y;`6m7Dr)^X6gO>(ImPeNQ{s zKKrd-+9eNcwl}@tNp}C$SJ*TE;d}O+kDq5>`~7|Tt7rWqJ@(uu9%(n+wM75N!+6Bu z2e>7+;xixf*8P;Dv8Hz2(gz>ah^brZxqn;!Q4h)gbCWe|?ZP`&+R^*ZvE8Om(I?1! z$|8nOZ3K(c0WT+CTz=B~9bR}_@TRT|7@+^|kSJy3gn;8QU#{I$+T^chrsm)nj~HxY$qJ`wEwh}l2HKWEoxvv=vS5#;;$SASw3zh%As>sy{{FF1M+ zeNu!6Uk!k@^H-|VqdJqG_Y zlKW=f61#(QV`Ln!vy*7^Sed5rWlU7bK7762&Rk7g66LgIOo1I6Wi+vAcAq9r)=Of( z9AoCA6>{XtppB*;BRTDC8JGKoV}ev-dW?oBdo9e*zs$n*_VhK5ejX>uYb9r|j+=6h zMM_XT#?WBHc#MpdeOZNZq8v`5x=*Xg|mK95=D*{Y&b4 zEuel>JW?H-)YzJ}>^$d6OmM!J=>0wJAE+bo`pyrBhWKWWG4{qiKt|`+V7R87SAMNy z3T`I&X*Iuk$KPIZ-|)SS*H_-G@o(ZY2S4cQM_k6^`w_ny$WI(6W9^t~GuDNFGIS!| zh!{_Vnt1)^R~;weJr&C?9o$rpuHo1hQ?PI7!|StV8ph1W56hbBNtD|Ubyr*-{{T%T3 zK(3=A!igWA^8Yv3y5Mem;kggmci;I;o6*DfekSi6@Ah~zu9{Mp+-1hp{epZ|Mk^-! z&HRz`&sfe|vIh4`zyPTK5%A}?t+XR}(>!f5N{xl%4qzfO5=0Sq0Kb?m&ORDpbfF-d zt4S=zF)Yd_+6%^_6JCHBBf1dy{Z48Wf&-vcJCil?;^}?;U;hpwTv+!b7P(je>@Yb- zeh?W!vD_{mW)b5?o+h`ONWN_&E+q&Vo+gK;!pS9$Jz}ccnhQ`98(e`ymwrkF7USpl z`?lex`5ABjjy*X0U|aC97vZVfH?N#^l42|rsZvZv_ctU$NbNC6fXelxTtA60U`^#u zM1W}u9YJ+WNBNw)Os(U2^T4&+uyUDw@CR4gwrMl1XX{4$-QA0A_JIf5S6=rtJ9H+$ zW+Df8gW;e!%twko!}6_+dx&qg^B%a}K6d^+HhuO?+puPpT`_m1o$>g`+NWQBiav$c zH_q_GnBlINiY28}saZd1rvr*&{lIuFuwZ^m9L-O+I{5%WFZ4aEY&@i&uN{?a%tIZ! zZgVkpXbM6?hx@y1EH{?A2~5A*k#)=DelAONB1{Shk}FIK)Tfax2gfd`ncJdpF5i$z zrH@wPk|=~P8MQn5kqm@88DNvQ{ikC%!=&I1pO zL#{q3vDR-Ayo8Lr&5;&+CutDRFJ{ zTy=|^9ZwqH+iNQyzSrLOy}9;JZ+W)u%|DuiFkS<(MEO2ZB=te=4vKvN;tjZJ(Vhyd z=7zfDZX#(E(pSnBWrz|Z19XGKo^xH`H7*U3{h)pC9oNJP7_a~0Wy3j-{+VJ3@-SglAJLhND*wIgWy1nr+d+O^;{D*!D z#~40g9y(%{6ckl6*Sen1!~`&LVfQFFdXfgKuJ0S~Q-P}k82?81w8>GwI|QD@A~T4X z_nFfBbc@YLNjBa{QFaUq%;pOHcncNdDkg1VlqvfZ6~p_?;Xgbu4{g41svc@J$h@h` zS_Dr&_0>^Nw;TLPY{p5VoOa5DN#}j$(Y6Vk4y=hPij(=s1^sO~XhNQ7y5Ja)#v}nvx;T$WI>(9OL6Y#<7h^{`ef%P+d|!xITZWVqB`74*Hwn}Fhs=jW&U zxt(*5`6;=a$)>qbB^U}n6`Nv@!F6du590HB$CyOZSL5_`q{?+*C9aYxm!Ji^liWn3fO z;5xFbLs-{H=U5upmlh2BLV7UZJ6x!z4nAqqnhD@zlc=%t6I;hIM~S6t5MzMIvrnV^ zsHcfGa@T1Nco~$N43NmtsLLGehKU`XUA(rFl$C(EUNMfs0Nnglp#U?0Vi4&4tVKjy zj8ie$gbAZK$3;B}wse+`HZjGi{p3S2?HNxt)K2##)&SD{3Cj)}W6;mXT5KJ$D6sEi z;Crl}gWGJVf50xhX09E2;>q@=6XxK(oxj=kTplapfJ&XRqmk9N>bm7QL$CVSaoKHb zSu+C#X&gC&?pMYfuyG?e^EaQ7uw-iE=nfV zK50)IsU5SMAE}PrrnK>CmtR+y$gfL4$s1+<+RXpe^4PI!YUk0fjwbq_fTEFK9pTq6 znv31o@!Ga-eG+wJ#i=nnN^PI9V*e?$Be7~sUCZ|BYTJ@(%=Tz3|38&7Z@0MJYT90% zwXKfZj!7CTM$#ks?P#1fr5}mD-TLjA-E>K{ZAWoq(O8(&w{wvmDP}j?o^LzHSQt_p z$6rC~D;ER9{)P-1D@M{EV}B$pX)Ju(m;IXBwsxNF=`vQ@+t|9lJzG-h$dktMCw0>$ z)wYb+&7ZU*F?N)8ByXE`B+s9MY1gtNwv^j=Qa2rGEd3u#j6>pYfhY4jxwxO+jB|>V zwjHgB)V5{6)_2p5MQuO+6}JbLt+A;SM{v`O$LGy!;--23IkxL|Zkl(}PTEO3X(#QZ zowSp7(oXt+g?Mv6k2lSe__ZJ2PveKT$))k*X*KpkrYDHMxo9wLxzgb!EEVFZcdBDb z&%RnWo$GOI*<9wYMx+lcZ~Dnev`M7SS;N&rkC%^)cxouaKkd?0whEJ6jrvf^Q$HTt zCDsRtaRXbqxW4p4FRZ$b6^6D%Hg=L@B*{*^&qL$kHMor=S(1~mp(yKE0X&ujaUCW2 z{JXKR22VL8U#HY`&I|R@RyuVGy3$J*dcnf3m)m$q8->)5ilM&qrasyN6AB)4UK)(! z*q1)~vbnMYD;_w>fo5KP`kgi$JP+5=^JZ?Z(IdzuB=>X9BO#fq^d(cDHrJEXkB(zJ zcM~J^jgHjlQxh1zz_mB1i@tnAM@p$PX2>1BuB9rmYIQ%j2!hT5h?+C0aFo!A4;46G z5V#gv59wWKu)$lt6ts>INm?`N11|}Jp!7}uxvAHK3w3A~ST#~S1RLyC}A@z=N zPAaiO$v!m=KKj9PeFSIY3qrGBT$g);%G9w>xvou|LM77@s<2V-8XnV^)G2#?StChS z{sfMuP8ls_;r)^s7_8=MCTAAQGp%l*=}^N<)d8be2*y5zD~ zFWG!N#V2&clH7-lda0bFan9JB5J$&oIF#6-qn)2VmwyO&;cf9r^Yke;!hhYM??3qs zwIYm*f8c}{Z?yT%8GToTTK;p$p7@=&zT*N>Dg65(jsrzVaelvr->#-Y82X}1pM)bW zzZN9o|Ln!@927i6bt&X<7z11?$cj%;PsBoB_6mnsB}|Et3J4iTIyCiL;}Q|juu>Pl zBSU4zOTWY^Xu~uwG^4%}p4jw}E`$<`dB8PSp%0OVGIml&EFRD_7vUE^9)o)JL6M6a ziBRw7JP3dmeadCwKvd;^BE!6B7fF{f&|*#a-9i0FH@SzzL8VU45x8_{DSIdE?$^vC z^^r$1nq*KNBlmI{SNMV4lX@BgUuuayYvsTEWqNmr1N0s9EJGy|%o983CG4c^idX)~ z?Iy@2Mq~GNk3v*a*h?)Cg(u@&u}3|1RJvJqQppXu%wGUf^aD~r!PM;2#zR08;x(Zb zDROUxF~%SV$q1HfBOQN;&xuZgkLHCV2|tYmdhIbsmDs|EQsW7Hu_FuW^z#ROs%Wcg z$ryxm#B-KZwxy`{0nhbNxDd)52XU&Dl74aok;fbczRaWQpbm^Sk{Ix%&w0l_VPO4( zQF7*Xv(GUl9I{4I8BEKE_T=&*jy!bbx*U{a1gvAf)VlQ5f$M>qI<99fc3!KgWB_tD zD5)o@)^PH{Ik8q^WzR81Uol|MIY<=`Avfn6DAy>*Ps;I#(~)`M{~UdXB`uq6)1 z$MY7QGUrr#+>U)slOWkA&)Dcgr)xlsEA`M09igJ=6#t-%i(35}kWSJquk&tt7}$cV36%J+WR#X`H!Du#$q; z6S;a}XzY;3egux6G(WI(jm_X+&(L?8*R88=nkPA)E)X>FD%`(FPZ}H=H2$x3Ou?2p zQszOv(a(4cRcz|8sMM2O=RC8 zvS~3%j%#AqeV6%@aXP8SB^5A;GLFs^zmbV?fA8yvelsUwD)D7=Mc@J`t)m&QBbJMC z$cRpfbuLh$x{gW^Z}4p$MdX#f(=B}%H%az1l4DIu>d~pzYUe|ThEs8oL zS&0_*I$qniv3Xun+8_n5YH~q3w>MlSNU4^kYwT*SJ8UwdpJQ$E*5fC6KV|3M&oz@M z@)!+osKzFkvI`BKhe%T7;05n}`9znpL@7W8+qQMqJj$;k#jkxRL+7EE-#P^!e4PFyh>+n8%?b`#PjCIF4YA@Al@iibt&f zIF>fN9OgI|-Rk5z&*z-v_0gMA^3dQq4c=+S6(DiPblRvR6~XNkcmPBZTME~W9!K#d z6(6StE9U8IKZ*)0RZuDuPsw$4zoQPw3L{(iQ3yrJCE0n#Nh;%jp(A$G;#g&gc(tt| zy6(7*a#H8`I{Jh|XzFsEs~c<*bsaT!!AfLLa&#P(%HTyC)aXeRNeP!6hv*jH3`rcG6Dz{}bX3^Ry`w?J-9l zV8h$Ss%OqV2qpV@wjW|KLl)Un(M#QtgmO_E*?+T{x>*r=N-RF(M|L4 zh%H=jACgV5{(-^xgYr9RC+(!2w3BwyPTEO3X(#>PPrNOjI(3TexBr2*QGaPHe+LPP z-`|LDSKzi+U(XozNi+X?hTk;vuV=tZ#GB@Eegn;L=<@D-!Tft|*BO&-*O}9l+3&{x z2vSupc2G-Ckso-o=sLqFeammG{wTi|$zJiKvGj$~*dpO!8!KP>W!w&4`K7*4C_8X% zE?{?(U-B;gG9IVNBsY3zsfFuDM6`7 z>eBC;CpjR5laKNZO1pUab;E|Pjce!YpztBduM2OJ^e}YPpZzwc!x*%qejT`Wzs>2; zjmE;$0bEqer07%C%}-pw?$p)KO`Sv~!9hFh*P^lfI`jl?kJ5ou%Sl~y?fC8fC<>5p zE_TO}5>S!w&~JAARa8#9IvDX+ch-^NLwys~%bsi>(-oTQA?F}^mw zi~lIUE|@}ps_l=VKPJZxlxGHJIw&`E7kfx zba2<5-}Ru4H_bDF+iUhLn?8Mt{?B%OgTpiIq@A>rcG6DTNjqsL?WCRbe;rMnIKl3m z`=Iqsm|zDUaFA`-s{b*~zn%f^pE)N{-_!gvT9UWiNpZ8B|G;#? zyty`W`ed84$1Iz*%QWkWFHt*Gcig&T7kSrXNTE(={5DlS3KV=)>>%p(-D~f7?8-+I z(DLa@9^OR-BeiOk!Qfh0oUtM3j=Cl`F z1n9uI2#Vkxn9=J|Q;A#29eyG6hZ6fGXR%YRY6M9Ry$F4|WFORt4=6a1o}-FQ9bTj2 z24&6k7A|AdRFX90epEv*(J@(D$;acUaE)&Vp0UQDPCNV=qK#Kv>b#buuCWtJq95(y zpL3S>Qg5XbL0!+6^5CT?9k_^}RQDkZPk9uELZkCKkfCwqQF6Nm{mNv^rAW*RQW9d>59DyO*hG?T6*_$T~LQZP^D|~RXEBF!fscreqi=h%kk4r zs{1J?xsJTSwQC;b2fMFJk8SDi*I&%I=Yd7dP4ku!ejCH|5C15n6Fhhm-HV&)&aY>* zZkk7UXBY35Dy%w48hZ*OlYvQ@jwp`ca&j8W)V3t`TR7(s5TL{=2T)*?yXc}WQsuP8B)-B?Z? zI1uA0CUjIMw#JbSbFP`63OLl`OPp+63-;TXYL0UZUC%>;!jH1{dh{A`;KzlIGN9sm zQ57(eb7&F_k@nHlIj$(b#A2UjAv*S_Bh-cLA!06da3ZY1G=@qHK(kMrAZMUt;KSG` z)aM?cE6YlZD01d?m~xtR9pl9Y*Tj5pN_z*6y{rXsxKBuFCrM5P2MRnx*BDY6Qcz-; zubvkj1IuvYI(Wx%^&CM5lYe8?$;*hjtJaHL`vkl`f5bbT#nNpQE--vQA*!y0q+aG# z9K7VxT8G*V09IVvlX#Cuf05!9Q3l494+mCx(?@<#H74Ns)dV?*oj77#1&X-~1?$v% zCuKDHWbN%S5TTHgX?K8*>4U~=9r0;*&rTdU|NUL=b%MI(jZ})k&gRWqCF`cS&u^Of zoo0?(e_k)&$Q1)R`0x|x{G^%I4&n_nlW0(^Br^Ju6xFqeL33iYNLmFBIy?}E8chO! zVpN>Mys?*`bUhwR5cmb2gVNVTq=k-~g`74u;#o_N`c#N3p)=PJN}BaRZ2 z$GO2C^^}84CNB1f??1V@O+0E;ywtm#`$>&sB_>S7XkEqK#m`e3IY;zKc*JLi>j)5W zxnAlM#*PAoFXh0Ny~$3%9ON=ZSB9E<2gLPC93837v67e`)dt1`dl-%ZjCt7w2|{RK z)Mq>fp{xVmTxpB(Dpu8Z2*wfTSn4^qIlm<~1;o~Vr>HJ*G-hjJ`FdcCG^7u)ZIYii zxe({G;7yYRNqGn;O!cZRnUI@W;#50oW0RjC(sBO@23cJ}34lK8Q!J{~!4Kn6!~|=c&F5}R(Fm!Bw9bw~o`MPV(Dx#JpFqeFZ zrG$Rg=I0`HKvN7`#v;m*!3k205gRz)(=_=wiWB?9b=cTTy!#TMwZa@}lo+e9#HF84 zt9-Igl1@dyGi@9WAsl$>hy#~6N{>bz7m9t=9P1T0Hg$^+)&E-@tHn77PbQk9G%eL6VLgN##QJzb^9fpXG`mnlZ& z0odxyPSQpKXPoYa7}xb$y5O!a|Bw&><$!^)sP!n0?;zNHv9cRz^mCwPz#zfcM`KKl zv$B)il34KQaPlNZG9JA;r_Lx&KHjhd*M7tu z@LsQ^$WhC}xw}YnO%-biEJ;|#qTXG+@8&|qk3pD&D0Q=*$N`w=YHP~u2F1vq$DA!!#T_Y{e;uu(f=^EW0MADl9tkCt-g1wL$|kW-^v=y<(sie7RM z==FI#<)e))4??LM zhO}v%1rKfQ8~dn^SGcPR>3S40W5f_kJoPD7bEEaD<5Y6a3v)Lf#7Df~ZPK-YL_di2 zKh&m$ajD6Dr{64wKHtpCoIoWX9@!6lU7LtqiGiU?F3sGMG8V_6aX`WP9IuWXo3EjP z5zDRu1}Dj%bK`v;1*!6pM$fUwt8wjdFsAF8v650JJ&vr?t9M(CEkqywRCdZ9OD5&h zi+a3-3Ojuq>lhJntyJtbs>sE>;FLSh8DJ5BkX#4V6gCpoo;BjiNGacYOEn+`F#qo^ zAo9TAlo<#ly*S4Mu0xzR71r_8iOEl~iKC4es$lRv%!VUnft^w$mUi{&4uLq;kCycb zKz&Rs^~9BHfGahhB*AG9cT&Eu)KvCJs6DRd_A{@TGKuF2oD;_m#x6ra@3RmTcxi-j zTmI)>iIiX1GBWKxuWpwDBpkbZNlXu^OAe12xX|YudpBx>BF7*u_hv4Lp^H990;v}2 z!l&LR!lTa{*xYl%kz&0P%USW+f?huXj65Qx^7!coA(0)F_vlJ00?HjBqY83Og=8r^ zlNACAxB0@drx^5$#Nc|0WqhRN1W-qK!NRDUb;9vVKdnGee&?ioN~H~{vOPBaqdvt< zqK%Ish?|R&q>U@AZ(@z2%1K)}Q7B7bzL*om4I9Ux9*FvQL*nN399+{tM4vrMM0$SL zCHWH)YpbPPKZcvU_wur%W^ibaL z)e-UtD?>+kncXLI3!me{oaur?StiHS_`-#V3l{c<;)B?4_MN{dbN`T%`&uQ!Uks9S zmpSWvoPm0q6e0$G@}v)AfpX51G9GccZeA!bfveZpD*@4#ov;-Oo9{8|IbL6@PI6sZ zN^DZZQ*Ll>BM}G7HI8nbSJl&|KwM+DmHE>#sMt9FkTVW>6_c6x(pY428)NFz4q_DE zaV$@WDh4hXoqZy>&d}A3VK@fGC`a@2#^aDQ4T$BR z07ne8%&Y4^I_!7mh(0-5eU0*vK5wcq=dciBMt)Mp5owM+Kee>wUhlw3jyjdF@sUk_ ztf?VkLzC-YQ}HK-P;gbetb>-aKa#>GD`da93M#gU5wSHFgtL=1S2>8)3=qcUbcCp5 zPM|NjK)Tk_C-SgX$1{SzM9>kTvCxiI;%fb2XPIV)T423wLcImudyWJTmWaB#IVmj!w`W< z9Vdj#%jOdle_<%6QJv*9qkLGhf!kW9I{q$4iXjN#l6MkmOY7^DK2^m57)7l(@)C zdx=x&GZu9o!6WhL@k7_bmsx;XIiXKn!DcJ@ymm^`h3v#YXwufk}90%iayiLv~Uiv4oOxB~CU{meX>)46+h?PBT>Eq;k zPUko437w9CZz8&Hog=R~8Iu-D%A5X};}T2Un`=NBuZk;NsgpIj4|N_tFhSDt2ddl| ztf}0HgUB@_90TovBT=WOp3iS$J(rJx{chxXACu#o*fkMHOWV%AzhXX>+hgS%CwWCA z;1MQkQf$VlV%L)1@F~@~BX)jplIIG0nWZ6Sh7~_e4Wo$>WJN5;c};n3cXIAEOAx-M zoGT^dkr40_Bk&pzbdG1vY7BwRIi#NFVuSM-q2$=UXbzD;EM;!Jt z9yujp7)uzLq!+G=Ctq^nBy|$?In#0l=R9T&?Q05cjH9ocF=nn4oXdEMKl=oRK4LgE zHpZmH zNc{Au@c<>J#s|+$!xw$qnAD?(9L?BhlN@;W?aZ6=TgN0`E%t!VrjszxD^{)zeL2^l z4n4^8<_Q5kLlVz8L5=}uhkK9iZA|c(c*XH7eyp)1_A+KZq-9<;>b0&xtgSdzIJAaZ zc(RDqkn2hMgdOA|J7cC#&Xq9jwLnW>POlHW$(A_nv6z1b-lhp`@{)vuk*i-~lCxFo z1w(1=HT8=LJC&X|MN!8&NEft1kQI+|lZ!D6N^yjQ2n>E)h8|7pSJkPk)JH#wx+Lv& z0EEF<($+CvB+C7%s1cJ~a_l#MdCX=S93y@7Jy5exI?n%)6+d3m<3*h03J<|;ExFi( zYCNxDd;{x<1L_=erLXsKh0nb!>VnZRWFIT5OWEx;-sjQRyB>pZQCsl=z%fk?iH87O z%n7^op2(QsKA(vTUr>pY#CUAcrGxUuA~)|R9-A<|`#H{yI63_lpbLJ*RUiLccgv_oA@ft`uCrLVcT9|q) z)ORD*z?QNk%FWo*MiLL1ykJ`U#PMl$Hs*PlGCH!ef$A|zLp?xVBU|-;A~TM{2#f$O zCq~-jI)Z2;1GdJb?0azZJk}WTkmFr8f65w^ctLevbDjGMde10t9i1AP5tT()>dB!& zuEcb#eG>2)rSW&7TrxtYAJh!1%A9qQOH8&e{UwL~QEWMO~bHU}TlA*FaL0 z9H+GILgKhm7K-ypr#e^E!5-1_S6X0btC|Qg`J#XM^+jS}ZpPq5EDfnIamdj!Z*zkM zuJs7K=9Yr{$%8ifa!w$Z+_VF)+W7e9cSIuANPFU4$uSVeaIT}BaZ5b(rRPd9Plcnu zVxnAUM@*@8q&X!LGo#Oa!hhibJgr$DvDC0foX%Ss zhzkr!Z!W-UKDDM^gZzmFPkibf1%jSBwp7 zQ!g;Wvo^+!n3U5lJo|J(^Xho+vE#U!N?yEJr{V@y`mmRCl_nfBiso88auUzJS1mmM zL6T~t92|mkUKemZ@oNBd;ZMq#jE0VLRtgN~j%y(;YU3(VramuE=_fqbh4DkL7qPm| zx;`<=qI^yqqjYFmGhmc2WT&QX<>k02MNE&-v}P|lCeItrZN^b;9Cn2+@+Ht~Fq z!YljastI^uq4B-W9Eb!A^XBz9WsQqmNfZo2z&>M~i0PHZIALeMzTRl=L*{-85pgMd zZKNEF5-~sTA9$GqM(YX-@pjB)sH3&W2HY2)Q6^He2PcCW>|Sy4=Kl` ze36TIxB9+yxgzQCVt$qtY7+Nx`e!3)Z^Mtix<4cavd8C|a{hg7O1!91M45Y+HDV3M zAu&0^cv>n)0Bx+M3AO~ea5bnRg~xsdlxKY^TuzyT8~=oLn&ji5|u%FU^Fl` z?>V+{SKZt=8Cxd>0pxN1NrT1hg}rzDc;9HQ6^=gghmCcr1T@;noBA5PT2jhxl&E=y zKIfI3lEz40xsOGDf7>F0jT933gZlr@3R-fej{PS~v!h|KkXkX;&_CSLjHY>RhWf zrM8|=4qCPMQ^|0t?@`ztY%*F;@6eI1MAOd+JO(&qzA`3l ziV-9|@l>TgFa;}pHXb8x*lJu1r%>YD(}{h;*d)iimN=nzIqaZ%zB>rGj7LgdsEV6w zni%OTJ2`8nj%k%T`m*a7IB<_cZD7zc7Re=#Ni4@eyF5ZC3ZD`a3!*xbD3^YNEfltb zKwow!a!phhT4I`b4Y^OHujCvhqBu#*cfY?8;wc%F z=5g7A+w5!q`USgr-b(#pYTAhAld!+Fw)i zeqx-ML&b#ypSp%NF0=1{^XvBWD{sL?cRVmciF~At<9)^{^GIDlC8v%QoP9pA@mbQ9 ztS4~dJXD-cN|?>@Bbit3nMIYfGZbNuEdcY zj)?(hZr5D{a!Ks8^K6~ODn51BXDc{Og!oQgwLf~6%6UCuuhv95Jaiu~LpuRG1J z>%ATi#ez8>%*NKNOE#Y;nfyQiNJn90D0s)w&Q0g=tc{KHr*#(jJSNp+h@ooDi1OS?Qdzi8+k%>wQiKDOQU~Spx=cTw!a_CA;1d>6UZ?sOa zuB3=ZPA`uc#;`Tb$3VMk(n$@4;>jRf##b#wgdj${a6C}f$QiNBpU)kQu+Wa$l^Yt} zqrv3EVI6`fZqBb*NE#CrRnz?V_v2_yN99l;aAI8R#A^@N(f3cx0|9C{K$rOx68;KB zJuxcY;r>BZHLk$XnClA3V}Z&v6T)D`p}|{foUsRaoMsya+2m0hO|o!fh92+U(s>@z-UgOP`y+L=CPZ# z;K6---dwNo62qGn*9sRaC4Z6+!+ogZdl5}4$Gtp{#!O7C4&AAv$ni;qk;vc2$~fdQ zicyGbBZ4U(E(Tr;3lYrE2RL%Ss5ZPZUX4pZ^H)>Y>rdvXs_%nqD%ZF|A**ejL=u<~8>HfBTfZ=4CIiXPo&od-54iwGV#w`?dveZm9g~fj$}s zUg;FmV>1qKMstHPsWt*M^dHYVa?o9W_@%x7eSd4`{~9-vvf^Ho7;Fmv^&wG1cJ+ln zvX6iIb9U#vHB>OOjl)gpxGgK}6YqPYz4Z0(vbn1U+)p_WiM0u-^oph2#3;V$6YMn) zFR%-K^c}nMrbV#jc z5nllIA#&4F-`M<+7d}E6iXCmx)U&eKGX(_ZJ`^ZB_lr=}0vNCH3JFr)Z0Jz$W60RF zK@NYnqtPTx+C7$Xu*HBdQ{qh=mxW{f=tze+%$Kf|Ypn7JMg{FYCJ{Mx(M>Kr4DyHM zdKOOZqWdzwk6E_lIB-Xk5-O}XTFk%JL=*=6us+#C#dj->K|bIlLJ`lK%fjOzOwma| z4UFOQLY0allTB`F`R2r2B>IRGMP0;Goz#V#IYjKIznHHLDy3L*1=@W>haayq_L=6D zo{AqfO0Wy7hNC(@-)$cqsG z6qEZ93Rdkk02}irytoU(gO^(<;n0FHmfrLnB&F9GO;ptak=Fp>z_iZfQsF>OV!S$r z#IU1jK9x83dW;J??c>Cg$Rj6llyW|3qs;xMF@VU_3Wf~_{typ=*9ev_o6Ig`jq;_y zdcsFoGV}$bo068gBDQ*=Mr za}Q@-Ro<+XV-YDP6%{t}c&rBR`I3jsRJ5VSj7=h@IbYdvUA~XzzNB3I5~uwM$}to( z^LZZsN*41%FCV!UJTYY-m$mSE^LxI`?YcN`gpt@u(5X%j>1^ zoq4@UB{^%;dk;A8Q#4+X-!Ov;gAlSr%GoDDp)`2KuIez0m@AZI!lxpr?)i*V#DVx= z*#pNc(w_;X>5SD7R!528$axo9*(s2Fgx~-4tM<>I{Gv@bwa|~X`HeX@GIXdxI&9#V)a#_78%z`#hdDeJxu0AvJ0^uZfk}SBqRIVq;$iLtK}_nz`NJ-s zYQfcKWdt&faA=@Bp*=PlH>7Nwihi1lg zu!w!-W1li!Ty=H@AvA34&@McQ@pZn&I#3Utqr3+86blEMGnQj{Ag|^Nf{UTxvEW@J z8G^EaH)C}SmA=kgtEhmT^7rdNjKwZZXyqb{WLyTuq94Q2Pgv=EZ@Hd0j+A4SCgM51 z%ri~gA7tRHO?`0~W%qH=MWM)96GcLCP+qO2jOYm#VYn^~Kr;*D8Seb1yz#&pg5JZ5v-z*TU1pA4Pol(_leG~~f-)j? zZ~}x6tYX2Ju{5XdDqWQ40)99TB^DhhV2)!dJRT+fNKx_3S6+h2uBK!lV2ESWG=dx# zeu)boMasgZ#E)!E9Mw-bZD>L>Cgq5kN6xO|sz>tpiWOXY0pxQ6LZ5q;o}O179|XkA zRmb((oby8&{d!thZ@jJ6dC0X0FJYnLb(2BZSIiuvLh{J>Dd_k^P8=8=$i044?+{VO z%o@cM5I#Ach@*4MO=!I3GEej#(3Be=p;`PxvraV!>j1 zi?^l_2feSVHpdabxTG8t4H_%gfn6Rl9uJUx{-wc?V$DKBlW-K!G`{HOb)T;?Z;0ph zp|AV_4v~$uc|7#s$30JXKPUJCr%Ch6p2HcEIR)UHfq88(C{_S7VG_DIFFu*fp&1H2 z^2q3<`Z@`4oIM2VO+Y%{IJ3bSHlKh_(#3>=22rO_4aH~aq6citz&1PZsK?rg#~o#l zJN+s4(icD7roi?u?|X$k_vLT4fB(i8?ayC!w!P%#e{Sbqa=i^9XO9iq)xZ3az3!DS zvgbVaY?gmy zPkGP#*H7B3UwXDZ_qk`;U%&s8cH4veWEppuEGs802|7(1KXJtkIsdE0{(F9HPk+X9 z?IZv4@Al7s`zCwA*{I`{=oL?==_LD_-<0`@1iH+dlR;Z?G@@=au%8FMq(Eedbf_=B0?!Gi+aZ z&s*$euYIT8vurCW7_r-a|8sluYhP|>J@e`I7w`CpU3~F*_O~DVH``^Gsdn>EzGQ#? z?oZoYcV1_o{LlyOKfZsFp&Z+^dZB&q-#%$Cdj50ltmnSK-utmH+Wm_+XqXp%?L&4p z=HScU`Juh@^{=oOzx>tqA3y!QmTcv`TkJC*dY3)-InT0Zo%MYC*>(O2xu%5c7t`cx znR7|(p=D6~E?97$p@e3(B>bpJ3`wrAg;aGpn5v9x@0a+niqi(SB zR}AW;a;5O}bGfdAwejUD51O&{W zNg6)%K9vy%JVF)nt>`1-gDuA}qIZF$^zivi3scdODODQlM?dF|CaHrb<(O3>u|x=j zIy?}XtkHMU4HiwH5+mk_M?L74ISG7FGdJMOsV;;FU(8921?DqC7B%~&Pfi^3 zqZ7eK#RQ7;UF%hEP6Xr2pX-8XC614aq&Im2yekr_3Q94;cs-gow>R_YeT|7Rp(c!0 zmeb%G()jp-jpiCt*XYP5XDNov(>XzKh|i+pS23w6eNGZ{cu)EQ^$B#Ml0UK`B5cHR zpZNU)V|qr_Sb~r|9~*ZkO@98+A@uOibrI2oMWsz$*?e4%m)a?6kJcVCnVb_ze;LWDSOD?fJ0Ve$=8U+!Hv4Fu8rdUMCXvq( zZD~L~A(4D{RhlebgYD2q2uwy6-4G|i0rEjY_h(0nD8lUcQ=Ve`&7N)-e)YrliZ{H| zetN~N(vy}fxXwtn?8yXB^v?cr7Y;>RYNJAbV` z;W;n2KYQ^r?V2C|tNp{jd=GkFSbVHWDfx)_0tB#;E$i)`d+)TLe)l^z<&YC>*WOL` z!*Bj?yX40CHvjVP+WSBKb+i2*Yj1qz3$1Txlg&BmWIO%QhuiSrh&}4mXWH|g_Bh*s znjX0Se*5M3{>{Gs^FP??4O?vWk_C3h?YG+|{^$58X6b_u*gf|>Xu~$%=3RY(z3s2x zX*WGIY|nY=EA99LXWFFQ53y&Sexhw17_xnieZ0NotS8&#;q`XMt+&{`Ma%dYVCQ`L zefIv3e%TIv;`8nKPde6qan2X)1E2U;+YH-=l@Hn6d+xDcT=F|Rp6GLoRGMVxwhV@^*6WF`8$ex>1kIHsG|lL zzMv=8_k|3Q#R85)Q=u+^y6h9$H#Fss8&wOF8EP;ZymCZ z{&X*j7~XR39Lc`))jE)PU7?&Y(oQdL?nha?*qZV4f=FB4go!cg(}{@7ntXpURNxp} zoFacs7&3@h-T;aM?|xo;Qs&J|E$4+|j?XE4saGFwQoQ;zUtk=Yvfdgf`AhLTG3EP% zphoXDmPZx!9X8H|=7cEMC5EluCvGV3>?>wJ)ak$9ptUx+$v(9KGmE!cM?8c86zokX3WG;cJe@pNm+9oGQHT+oIC%>8n0@HU81-@8ptWsaL&~y-@0qmr^-L6i-t4HSryn zm`3mO#y)!~k8YX()`gd%)i&uW5}wR)NsbMIoN;+t*6$~7c3IaVzNn6v-f9eFdDV7r zq~<%p&?%Pl?1zzE=hPLOACpGMcdJB=!DY9lfrN2Dmfja4FxiA?UOIQci+^G$L9XItsIq} zv_c+>^eF=ef;`QeNKQC6fZ5ScdWC)GyWg#zQ`-FfAC zcHYg4?Cdvx#6I_-ciCIt{XYA%XFoX&nE7-AIoe|D4y`JKy|9d*>TpViUIY+q?yftRI8pcY~KNTwt>f zf1JJL&t7B);fD6i#~p10{R8&6Ghb@YJmnA@8XiW(5j*hs=i06J-DUsum(Q@x{lhk4 z!UTUx!s7Jy_M(rvZO|_K!MAMg!XEqDh3DJb-}IOEo_D{)o^tYI?fFkT%{Fb?Y6m|0 z$#&KmC)y0mTTkBv>zgpq`umsI55N0M+xzs_+2=m+R{LM?|G2&JS;yIRm;Kysn!C~_ zPMm1NL;d#W@BNJZ)!+QRz36d=+xnFYY{|0q+8RCM2W`4*CX5SvW< zh_iyHh}<9S`)u)78JIsl;W=ESeS=L!Jogrn+$RM4+%pzq`=%8RKKulhIBj0^9h-R1 z$u#8?UUd9KjT!=zq@FO94sw1fk!oasjNG_6@?ZV<81rVypNd%$aq;V$5|bA=%GB`( zFV-R(74%`F=rYMGkQoDUTvFD@y&<#a2=&ESG6rv|T=ss3V0OycCx$UO8d&1xq`8i2 zGA_yYChP$$tRvsUeEr>*HRhXJ&Ik1|8jr`#7vuAJ zV-D(7o-lOn*@m@IOxit;bJQy-u;84hW`8ts`QrIQ*WB|yx1L}95=9E&qj>mRwH^J#V;ebUT{ z1yMs;(FMv_j)mYdeK;n?X+8x@@_Z2wFW*lYC)PkRZ`wHqg)X|Z``G*~++#)kfz3wp zu{yCfU7NyI6UWCFgL1zT$A<>WxmS3tDEl{meJ=}TO0FZ`Yr{A~$KTjAwM7mJ#8DUL zG)Ch7F?D4Mp({9abx#qLaY(tUQo&hu&@b|nm_sjYa_V^QxQ#l;h;yzu2hg)#Kfio@ zjFR}0Bj+}7PL9!g411hs=8N|Q-vb_#t;CC*{F)43NvcZ%58cN{qHhSkuEb;<;a$ve zP@!?5+l;Rv*Eul`dx8U&<8vOdg!8eHScB$WW>=C+moLsSIrNERd{&}SAR%$8L>t57 z^AgJOla!bK@e%;s&&ABkTG)3IQn=JHZk}K6Q_C4AiLR{8ubr#_zJhe(yuykc!()|L zTJo`pr8NaLNT0aud(8cgIn6%%)otP#oVl9pdfeus&NuZ9wsljV?Y?U>AG_=_0dF1y){lBvJ@MnseJ4%!3)={uLf-KH zkJ-E5{6hQPx&LCXdFc!6W8eC%P5{PbjhO~wp=NEt6H@~~4W=R1kn!ZpW8$EfJ#+;I zYR2kbwT;wHMSsO8@fgGPq`C%=#}m!_iFfiCA&SZ#Dj?=ciLpEeW0o|aGER_UqR*GY zSGF3*h>8JSH(VJH`-)ZLvNa@3$T9)!aiXS*bPfu{j@u$#A!(&+89+^aZp-MMSsEgW zHqBp-BPhqII$`I_*9?lVIaPAWox0Juj9b^l6!su+p`-Hqxz~4b&cd%f>cHBK8|iV9p`a81W}#!jUHzci}To6Jyt_*%h=l^ z;=JSrnYHCu6iX7gObwPqT(Jjt|FFe49Otd}Ng}=>`XOGu2&0Iz;BnfqI!H#x);_F( zO;*VcZP!tg>du4$w(UAf?yL&BYCS8lp@4Xu9xLmr$z2;|jZu9rD2|`!PIVlL8K?Mw z>a}t`k#6_j=6Ijfxi%q#<=E)&TnyA;Nbc`>Mw9CpD?icCni_mJzlJ!L`W(_2T=c+Q z{5vpVuX83JAqsMi!Ko8N(tZb2*W%E0!%-)@%-!SB>c%>{!T(msh7ce^p6wud|YoH#m~tyH)uV6g!Ks`0PZ*wbOMHiYquTuUTm4ES^tI zzdG;B_Jf~XZcA6K( zf81kjWYtQW^QfoUd*Al~d(-P)WzTx*Gwp<@JlSUT4B1b=caB|s$9!9O|2=l^f>qXs z8)?=x9yhjk-*UYzTsLHoJ^4wt|E}9??n6sEp15lAsU3TyWnAEtdd6?FCG+pJM?L#5 z?A(hkwPze+cKr?4+1mbXHhq_=HXh?!IR7r&fcxkC%N}*~J@?+-#`li5>#w@m7T#?HU=e%trp$JmjF?4^I;=WFHp#j&*82DjRx zr5o%eZ~h1S-ZwsL`}MB3Yp%Ridw@^LUUO4-ezK;GTLoP6*T}hP? zF-Vy|%E8=G^e18>JT}R3+=t|Rr5*}N{?&ohlQ<^leujEoj^S86hZAGhYXD8iopFJ| z9Oa&HtozlJbK^M1ajbuW44uPhbs_vSj?YhwlKzq!3|r2j+a;iRKH756mHLG97qLDy zE+@vjj+Gw!$76ZS%uUJ)vzL03&l%Q}b6RG@DRG(4<1zxV6sYGUdxnNk1ARhAAIJMV zWKPDVtgHlqGqzJRj(S~bB}N%xt1(Rsz5)1LjHpJ(G_g9#_k8Ld!?-F}_>!@VAt~e1 z-x1D}xU`93BN4+N)&?bh+=F)27dRmyGG+Qw$0nVm%;)jDe$9Zg1fK^|V{dXh%3Dee zIlkaDuWY&yp`JM3qqzsyff=IM$X{b<;@oi$@I25>ScUP%N%RnmrL`tb>?A%j{Kec#A!D{|WZgSNxT|;#tSp*Z$#+ z_PA3{wzFRH7k1U{^UbCoV;}qAn{E2~JM7gje1@HQ*30aIYwoq4;Q?E{YL%_u+;7L6 z@OV3DrrD?7`#SrpfB346^z_=Qwd+;S<_+s?&6+j(I){kmbNC}ewqgBRTMgXcFh3#Q zig>GS!=|l*4fb!g)vMQ7KWcv9svp}~XFky$`G5ov2q?4ZfEIayuJ?xWjf4RN=OXu1I)VpTwI@{boWY2l^ z+w3o1@^riKOYgO(o^iUp;XR+Uhc^z|^ur%#XC6PtuKwX??S*gnpgpvHvu#+nR)6V( zv;5Z|_=ugp?~uLXtTXJ4=e^cePe0iH=G}j7`%Ez()9O{WbQ^TzM>0GUrk-~-JUW@M#n+$xeGn0%z=Q07dZ zyf_L6?sMYY--NRf>lZpb<7iQ-1nHTsO>oO-VzN%^3rF7^yi)tN}{Z3_yt$xCYzAa3bEdRFxY$aF-av$4Sb) zR%&YkiyYgiSr+HOpV7i6Vi4g$zZ)GcU2k(SeuMqGpWf@Tf6T4jsp$d%TMBs|-o14|O)V{Ot3D z$r!iBkY{U-;Zi8)MPmxPbaHU7=3MiBQm((x5_n~9(zKVVGTyMZN^R0g?Fs9 zqxYL*yH1-N06w+CLDgYfg7Y&cy4vPG zxY+jG??~Hs_EcN4@Bv%0db91d&jB{LZm})h+Gi&pd#Ej4aKH5XAAE%EI%A@52tGj% z588qU@3oBsy>{4>9o=x0kwjFf9KKdT_`qj&A{=&sr#Xj3>zXNQ}ZqrrI@!x}=)CpvCS zZ4GS}Y(wo2aBdsCbb}K(u08jFF2dYJFyS5@7~1KtL&W8q5i!7m%Xd6;^Lu&uJyh-| z&!eo6m76_Xs2I<4Cw^G(aM&weuxy^o?Ic3@M=kknE7vo&k0r<8PtCBym;ZG)v+`XN z7RB)JtcFHtQ4c?<=O4#Y9sqn!e5~AS!y)s#bbJF~-Ut*ma<1Y{44i+>j5z+{LUR>k z)&-4Y*E~CMU3yqMW3sNu#Xs#dfNkcVUD zT%e1e7>3U^X_&cS;B|syQY{fD=a!=z(f1RfM~|Oq#S%rlTnp|^L>CTqBX87I<_=xX zCqK2~znRe7um%PIF;|GnfvM0w;Y#~Hsprsf!`u^y!#7w|qiYOnal4P1=QP)<>;dFy z=9o1)NzTAbuDk&hp(fQ8buc%zfanxfT%QQvC#W3&{V6m~3Tojn7>9eAp|uaPHgeef zPlkGKaU>gILdg7{Eq7h60q4~Tbs@h-!=zj@A$?4gRFB3>JL^RZ)kfl4a;)AXj`_8R z`JzdsqOZB(+=@DB!rRgexA1bD#mBA=kEH2I9XhYGTw}6U;bV zCy2f`n=x~&8gu&L#dF-x!>AvkLV>di9~y0*C-+hIwNGdVS04EBi>Hnwk~)k|cJ33e z)BmkZ6OZ#mN$bzOhCtkN96Q{AV;P>8{_>+vo;9Y*4Vm>RFWi_xUyl{8UXSAFdVu+7 zaI-cRk^4k;#L@YKanb5^L4cqBJ%pF2ed1?e&K=`8*7K9Y%Jotlu7%^Yfbb-a`-J|C z%Q5J^Am#vOC^^TTkNzANzuwA{?zw-F^-h>z2OM~iZQ1I-ulGfDKXx+?_rd*3*VxpF z=tH?})0(w*;hlcdyxa6CnwTVaf|rPc*=Fq;5 zSHuT^<|`Avi8ykes0@}q8VC9rk2P5@-i+9R$VKTG5_Ryws5I89tR@C>YhKXGuxbGO zwO?UO6^S(x$G^K=>yvmRPU1~aU6VFHsJ?jfW=;QFBKv6Vcw861p^Hrn9ZSwVK{-h~ z270||GBIp*{+vVB!5XyYtr$s~el*{P@B_YMenAXJo8GK}Qx``cpN}R|iWo{4Cn#8p zYS4+ACs>}Sz$rKc{~1-I$^yk#%CQ!Xt4SEv#giD}aMWI4QOuP&nMz9|9QrYac0A%# z7GtnZFwQe|b$!h1`&V7r+vgjJbDR5CwQ%0ZJ8EN6;5h#r3mxH5ha-gfId?QDH}!!_ zdlK`~R*#`3;%Oi*{iw?^)bW%m_L2Mo(+cTxf|fDscr|GZB-pg4uqOVd*-64_QS1Hd zb=1WDrnv)@KHJ+TbQK1_UYTR!HC*nQuJu9B^-LUNQUE2KYs-C?WC{h- z&nTivP~Xh>Y0kB*kvX)dqBc>)quR;w%p3Q7(&crlCeH^eP4LgL<&9cWeh`x97!wlF z9tU-K(@b}j+5#yQfuyLf+3WRKaV8^<&QXoQW6_t88e6ZcDB{&56A!WPaENo3hB_7% zkb&d1xZY2ho5Y+H^IRltZ~cj-+-(n&atxXeDj;_Whg7T|g2n*6)`~o%dLY$@06J%( zY0ojoqGgJ_^&Gc}HeTzLf$1P<>Z&!MOkx8=%9w!ZeDQcYD`jlGXu6tv&4Ru{Jl?@m`7--@TmE zw@Ho=eu$hR$X(JZ-&nYgb%Q;x6PnIyKWTo|@p!uIK-k2869&5HfrZxFH?hl2GdP{e zr1cx_ylM72GI$X2?Zyb&SPbfl4nllQ6ptQ{1B1Ry8ZRO|k+z_Drg8q{e62E_|n@=|M`4s}<3y-@NP6TfjhlYTM%$xoZ`UaN%{0Dcu;pBhj z!JA&{SsV2Q$6y*8$H15#k1GDBD#YbYDgPrA&j~;3t2nwyYrGy~Xb=sx>83p56v7zz zpSTP%9`u96#kd(`SYtvS_|Yy;97f>7e_-f2vvI7-+~kchkTf@eph)q+|!Bs zkFxg}OIF6`n0U5Tc-=sQORKod?J>MeuTeS)yhu=ReQhro5oM3eOdgxQj&PRvti6d- z>qri7a(1f$t0&HNamqLz%g0U%9CLw3Nu?&wAF_C-AJ?y71ED=5!TsCw$J%lXsUdab zlHA1Xq=?_5TtE6bd5mm6`(CqCWUuC^@%P-};m3k=()x9*1HHY^^2>O@Gg8h?#>(@C zekE79B{5FMqJQF*K66A|B7_g#kmDO%bM6r9ys_zs^MqQqI%hrRntPnc9kNsMtfA3} zqT`>g#k^*0jscCjQF}J#uIwjDFmb$Y_o5GgGu9xHhip!a zqlKyLSS zMPBH&|0uvjt6#r-4;JFs1;LzYSUI*juQwh`-WDlUv3U&76~4Y89n|2HB14ro=fF$$ ze#R>6pL-W-;__-td`B#CQs4_Nc|(rID@>W+8>w@wqj@`Tvu;iqCn@wf7W93cnmE}! zj+PDNak5VD!h#>phvtiFhZUaWH_dqq56VgOhEtPS7zC|sDC%0oG(3^@WFr7KzuQQ; zXpZBrAdnVVU&J2WRDSGx*W02ye{Co3HA6SHjKWVC_%!7dzb=S^%l{sP7mt}!dpcc| z&AExV1SUV3H3jH%jJ&bcuiwNSn>fXw3S!#Sh26*C#6IiGG3vQ|4{A-1n=R4}Z1IH#v{!IfMz`nqIX>tW!q-h5**t!J!XTOW#4tK? z``iGHFgfNj4~R`E^`4V+mr?wsSQV)zknm`Za6i5I#kmz`HAc(&a__PdlJ7wubH?Ef zlMt%KKlMtS`#R;h&-fn0d14ra>A3ee2Z<|VjPoW|T{+~d7*2%xJo3Eunpu}3>4FmL z6LIjW&ut$g@j2F*QS^PEFi-3KOR-75vW%+nav#UIRTt|Om}B;9L2(6fZ}|QsXIA(z z21Hd6z8pt02H?3dVRIZtMOWgZF}IJ@@iK$!sC+(F)fjrBSv#E?JLfNO`0?nDZ*t|@ z``X3q=^RYi=e5b@YVXU}FY*+8j?nemI1bnQd%sg&OL9&kAc$iK32@G-k0s(WIJYiq z6VAajdtTzH&B}QUU+|7t^38MG*N-Oo#~eHPT5uh7gR8*AdIlc?WscqR=De#fm|tUb zo#b9*KIoYuE9I%}HDqk&&ubI#za-3+Ik&Tqn{T(RQJ(t z1BX^o^%XXqJ3wGCtdl6&wFn-EIO$nmz86YfRGaR=qjLjg9&o3vF38b+w$7S%gi2EDeP`A8GX2)!9=l{jRa4SJ2Rb zvD?(-+^IQ%x}C{&{V6J^Br06lIo@VJ>YNR^O{$4JM9l+;}t*eCnhi4R7nHD z;|Ns9-QB0Qq`uUM=63Isy3KVRE3Lc@M-Fk%%MR_? zNaAQ=4!l!h+Bw=(<0v)fK6M$*smUEaI(A}e(g!f$Y7X`X0P@I7qBK^l8kf{jL)QWN z%_MJ$HLeQZ5a-QxoMTbMa+dg*k%-geYhva@g4POLkZ|w*-sx-VxK4Yw@p`Z>IQ%GI zhfmZ(bEPLvhtRp$*z=k!oOtIsO47cDkLUBII8j?2FMqR7%01=e`dTw8lTQvnd;-uW z^wz|05_J;w^rPr0RB*)00$H{m5`>LGxl@sSXhgU#LyyywsN<8geGg^%W%+%Y~BR)(A4=+jOY*4I28 zI-YT`lG1nHyk;zkEL!U-|6<4(WNFL%86n{iY2PyUp(_*Y?NuWy)mU~Y#7KK!yK#$pW`YrK&V;<;Vc zUJ9hvO_-{NkQGVwLIx<$!_gO4$1^UYOT&KTZ_7{W?!#uO7#=KSf%bB&T}VsoH#$B?t1wKX>Sxg+N| zYa=Db*Eahgbu*Uh+Zc|Gvh0e%>#{t`Ig>Xz;VG=76hIWcJnCG}{h}WI1MAG?hTI;I z3g7anFjl@< za?K$Me4P-+ob7*XQSg&ntU60FyYMAL>YM zZ|0T|j}sIzscW=czowV*yb7Q5(d+5t{X{y|I3Eh=jb_ z(AIH;I^&QszV@d!d1Ff=#v9#z?W6 zqN`Bu*VPf!nKOxKS~6!hRMBU?Dn+L2%p3DttAd&w{zTfHx>e!fa=ab+Lgrd&9O{ih zFw&mmb@HHf%%%e0Biu{P${;?u- z5b=uVL3NC}+IuN`tTbbH6^u z-@FMuYibSEYmHZP4PgBt24!SNdVclWz=}rO;0s-=Oaem~gDO0s?Qt@$*WT#cx&4aL z{ZrQT%Lg5j*Qr?vO+#Ko%IvsIYR6|cRduvhc_N)VEFo;Zk7{h=#7~YHtNlrxQ=?-& zjaMTjb@Oh|9eb+HyW1sV>M=AVi^o#G$uoLABd3ei_&X`bCLGraoeY&9!t5xOT6A=3 zmsQt^vn{02lnNZ|OcwboWlbnlSBCQkqv2Y!>NUgjs zmKe=%q{KQLOT~4tAo}ZT9y>%>D}=}~bY6E$7LK5!#twpkWt8(tAj;m?2QJOMc=yVD z(Hoi0$r&+Bqlg$KuMi%``%R3|GP`_8kX|+tD-Btg2JahyPe9aVy^diG>V+H#Duk=; z?(amk+Z%min!cF&icNgzsmn1Gy`yz>78+sF3La0Hl$&2)cpOsdoXJDvwNjs&w8kJo zbuLoL3$BZBiPqq1A90S=d+19jb`ivmJ{2)P)axJC$SwsqFHGdoRb20j2*WGaiURG$ z2mbo>n2oR0i)Wlh&oKU7Du$}@>7$DD@^z)o_2dC@J%3W6$W6cK!4*$%zJNrByvC{( zghnM_>bb{DJQ4LFCceyzYo!jHY*G>fEe?*C((4n#6&@#yAj#?{PD=HY8XwmsQu8f6 zc_Ry#dcF!K?I6e=CH0NWZkZQ-5A~4u5={PBkXw;Bn+j z67<QV2Y1q&4gb1DVR!jgAaf`SIeFlDkR5SH zzg#EA!n4sR4;uI*s^B1BZxVSEOM?<+Jk_S=m?oEcRG=PO{YCQY30?&!7?0)La9`?W zPz-S$LB+R;)0vwT`iLdDvUkXw795)EQvIGt9LMUTE#+1IBw@k*9TAlKi=Gk_PaWg( z-a)%SHqWi--H8suG_k~EZWxnC$+9zM%2G;p9I097hTKmth%#50f(Q3`$huuw&!0#< zomeUz>DlNcCqC*O6(>kK^0?UqY81|8;(Yuf&5?I#r(RsBKt~M!UVYU^lf9BjHKxWo z4>U1&)#C}MY=rn2eD5U*6F|>NO2c|{a`a?-|FW&v8*?*~kCs8kI00Jg#P7t=95yoIdk`a*g^l_ zVsie`ujioT3z?t2cux20PK*(DF1{v zg2v|$uGIMzuc5>_=U8}bYIA+gkyCO~UI*N-+1KFu>9jZ0j_0jGP|DG{p1nrPPp+xw zuQ(eVn{YXY(vzBe&S`6L=+jp3J8E+7*e4~fH2UJju{yS?BeDJ!CC51>C)F~Eee5*F z&3;IXQ_i1SucKPMN5pY#a%XE1e7tt|Xk@*qNUHZio`X%i&X)7gG$)+{9b+JM!+O4k zY8jO2LHT#78}c|B2gIzIRL`C7bGNA`eWL39%$=TcE92++oECDQBj$6VNFcwC>G~~1 z1MtK?*d3!Ky1Nc6HoFoL?N%*6b1WqX}DbwlL9WEOn(x zTPIIkO{uS2n=;-gTr?j83j~XLk|@jHyCqipd`KLL;W*Ff(^#C?%Oz|qE@eDY+EkwO z6fb-bGD>lkfnI5ai42u5PkjdB~tT2nW6bsk^& z0+o%FxeHHB0zg@Nw>pI;wz8G6hE91)LdNdgQzV%wM>xv0T{1Xr+Mj5QnV7nfgiE0d zhAm@h&2b|*)*dEl4C3DFhLa6k*9pb!w6kdtByeIfr+YVXBU(c(9WiD7bzr}dYbx)> zUC48FCysb5vsVj>2TbPHm|Ik9BzM6uN2j*wb&J`iN5YgfE>y*D@tmuAUUKbSX1(64 z&kHs0dOl)G496#qJ=cKPS8c6xf~}&?3Y@tvTN2ldg>`^GQS6kr!Qpn zK0qkQf0a0zsN=5;h~^jMS-f;nHShXq^XCgb3G#$sWC%)tgBlrqRhj$oB#d~3kn2bp z%;#HH9D&6M`Rf|W)bfk$;#KW#3%p_@7_F4Sm{YZfjWH81|ENd5B10~o+_d>W5Q;ev z-urr~cKS0m8M(*PtSAPp;32Dr+`1ri)DRp$N3(D2h1~o8$EVS;%qzd<}$b z5^&($V+Sy4=!oN*@$adU+=txPPyXsVmn(D%N6yDU{AirSc`~Y03vrAgoUmT2uf5yD zWptwjJZtj41nKn;WYlNOIHFHgetJO+M@Bn|bLTfFzIT*I&Hb{k^^<~qa-Tbj@(X7& z{R0Eq%J`_HkL&f6OcN$YHXL=12;zAE4_cZguL zD;xhtx2x1wPR!2J5HHr?1pU;A-HVRsMj6=#G)alS0@~f+9!A^F2iY#!3FXhJSUVvF&W1r&`$DlIEM5MyJ~CTs-GRLXXw$&JgV#C zCDz|hh(%AFPM$+!f~>hf&Aw3;04-#7oAq)fV}!jl+Nr}#pcYME=$(fQrpyq0tYH^H zC^!kSGcV_qD*DI-D!w?dLSM3|H6}+K^$@0iurEZ!&&0v0=TS2JC^0S7TvyNIaLp|` zoHEBU7rpTkC&f{HuSILXfb^pgeZDB`ydYTl{3_(@hp};A0V^%-Oe{afa(`7!|A;3& z1fI8ixexUY^Su8bWA6cARdM}~f3`0yyX>;`-g}iM_TIZjlbERKCNZX)ZjVMyV(h&l zC?aA-~Z=x&dhyx5x>9x*_}5tr=K(B&b{yLTkR(9i~e9-0sDXX zl&rKzU3#&WHH}|-oM8N>QDbj1>>EnBAZe_&;!L;lr~e=t=V$cSWQ@~`iA6Am49+ac z&!Ag-gnt5{DW6XP^^Cy~CMbn+z>Dbqc8O_n9ZjGq$~dW3f`Sk@!D|`u$}&p`{u`*7 z6u#JGO5p@bQUs|<(`>-Q#}6E$KN-HryFVCBFDdafzqb{S^!dQp#=~MbCOKVeln)d` zECTs!z6lZd1eu%#9A9GF3Iz;r?NEnelD5I8bnwO5TrToOyweCa;LI_pX+E{0KCx)R zrax8^Yr9xGn?d~Mg2*EBs?gYgA6lW$Ujo=^nQ&q&YkW_SdOY=3!^VPLRe$h_T8+^FP>CLv_?=bC8we zqD`;$8dkRRTHlKx*2Wj~MVuhh7BSQW=@cZnPYJ2%eu2CN^H~ zno1n6G@sWQdjiD}_d7cbsJ2(H9q*0UHwYJO$9XMi!b6CCm3ZMae#sJ<;f1=2h}PzZfd9O2_jv^ z*P6GLVB1G@U_O9O`4jsB!;wE;|IMB;xJNejYzP%hTRYBw!$+m8lC{9vXt4wz1raB( zwXPC~NxY#LSUes}5+9Q+y0s$^5#@wU~J2;Cjrl7XzlV*bXX->G5 zo!TWxoG|ux)IJnnVfw^OlS*9h31av49@kK zX_ImvoyTioU0y$ua7&_l5g4y(7U?woeD&OFLb4wc?0kH+23yW-MR=PF{Ec%V=D?;Q z=a=x#LtH2VsS&5CBTjYHkrXG|c$pmg$D+eH(24-^wp;j8eW7)rX0>fAO5tnXm+DzHi^h&CP{PpC~-96y<105%-1)pV&X9U2{*?L=YdVh?7=(&_j@)MquBE%w?S_U_Y>!9kVGN^2Hbkx{0K>p&w&1n?cq{ zWJuyQVcBF&oemzK_H?7^m3=GhxLr}$;ICwD|Bxs__Fdk{1h?n50**v=6^B2?4tN=3 z%Q?N}V&d`qsjch0{%yF;F*3Mc!B^vPF!`kApxR@RMvvXzDG^W5r%GUTxPgiDA&G^* z_B51jo5R9MhtYjsj+)Fb(oKvnPP0f@bM+|q{B>C|=~p^bvt#)ZQa!IN7uJ`5>I81- zA;Q;X2E-zoxNK}fTVr6ltz+7y#l}T^mLK9QztSsN)%-CXd|}suG+(SKWkI(Z)(tqd zq(f~_jN8|*>fnbOX3q|?WTZcF?isTuzqtey&@S3*)GHuJMV!IcLxz z@z6Fq;-Ptq)riE3&vXR5&;;Ah*mIxd9x3__y8N8UI`qw66efsj8YHWDrNp#EKLZFI zz|Ohh`XhEL>gwrrkc*(~FWSVI9{N2U)eiCsLsC z$5e%W8k&4tO|(ZgHA6T}A*^6pJM}*5t|P^aG_Jvp=|<{Xu?N zUQ&MQqGl4T4Q=(;{d1Dfi)bhAuddU1GOu0>GA;QX!F8m;)?0wIOoXOhr69;9>y<_A zBu;zH)M@w{E+F>Dr}rJvlmp|5Hmw9!@PsT72PHMGW zR{%CFj(`ZG5hW9d{kVpFwMo|3>weK0EwK?GbBH`JL=B0%UNwRJap}I!0XCoGJQFlw zV9`*JDX#Sc>TBY-bJ$q!&%7Uq?4s!$@^!zBRXj09foD=cihO6+#yI$4*W}QSARbBC z-e{~*N3283m|WQBjo-i|>)ecq&F4gv7G7-=H%y=fhDftw`>EO*LFZ1*umo)0nelW& zO!5Gh1Y^=mKoV@@6{|__Z#3XcL@p`0!Z}`dQ1;|H$a=`8%xmI(vbePM zTZ6mWqS`Ss+%4m{K=Jqe$UqVuWPWVW_wk7hb}SY{;CFj$hw+bn z<1ruIMia0*GHZAx`Jh+vo7Qx!%1Pk2ezHk=ZF!Zy>{}cmU;2?wleJo(ohFy*q7B`} z1|I!Luk*XSwGU9oMWq=1IwLjSu zurC`S4wJPjiR3&M=TYB_D)Uv1K#P2iR~i|g##A|DG3{~wMt!V3-q2Msod1}t2nOwTOS!CPvsWyDzvsxP6rT}3;p1&2-;ccVEoVf<) z6j7{OY<4-sRp*E%r zziMZuoY@M3ELQ2q{8Gn#N#t!0kY?64-<{3&Sv5s;BYX+6-i%dBkC4JRpXG^mRU1w^ z0zDR2ueKo5m+pA2vLCexiGAx+F4Rs>*$Cs{5{`HO6l>GH!s^&C5U*70kS3Yfk5U<+ zk3=;QX4m&Qk5z(7LTZ4Us!=;C(5Q!z4{b}Io!%oZ)Hb0reNUR#&ZoB5R%FJa2z0fr zRzFir4+F^PQOj%b8eOkuJ44rNMqluowf-2+#v;(2&x^GW5JS{sZHWB$LNNsWvXkK>NLD_`7vW^q zbm~`}Y-j6L{K5x4a)NTwXa3sz@R`19|4J^mtsg}uumg?e6N`DnzOF6u#r(34bf_Ke zMJ>Yf)p!HVYU&dYb)|VEp|;hD@1m0?9WrG&lL&`o?;8(`@}X9uC;Fsbh&dMjN&Du- ze4;UnFN~-0+2m4Nx_r}*{fs`3&Fw|Ks+B75D`jp&wguicT}1eJYYb#wuR%_j{bEqD zJf`9_J^XP!9$%chUX#c4cst_#4=jn7pGp3uGT@?Yq^ZqXwye)NEL!wG<7=#Ak&JlN z6HVauqwXYZHWZ)dLA-3+Awiyc-*7ChE9#dY(VlvlzG`u3Jlt3H2-XjF%oo=ibqX>z zSZvH#2`4eut|{`TYVx|Q7n}cPPh`nE-gBu}wnHwApRZBQYrXF8U%K72Ryf8lMIo2I zenjVMh()z*C%FsuJb%<+KD%DuuhfoqoaTO0LUGZE#T{(M{KYYK8cSR&k|EaGrrUEN zy;^V9mi}m0ZJQ6G`Hy65B+OU!3FKG2QJ2Xk#r2w9Uh8bHVc&U!kBU`v!?TV)o4=A& zEvxd6WaFiM`6nLntHgX5J(G{9SNv)@E*AMAa30IA{GmRz{S7tgiFW0K=R1yHoHv$t z(-Lsh{_T@#eq# zAzb2{ zzRqVVl(Vp2{b8BJMDzH>=QSw-ALUgiv~Q?0B%<}s$LFd^!BBF3`9I> zoxzp`$s*e>_4T4V%-rl8>Irx0`xW1KQ@E%zjbl-qS=5uqqP~9Y?kl!gj90$VXW0~Q zwtN>|PvL?s{Rrm+Eq?v-#bPu|#w%Y;hRO5K@u}u(D8_E!EgQ4IXC?S&sECg~1e$PG zlkB|2+sR8fr;Di9gqI~dCkHt!;!~`4*B0pdG3|6RmpoFXomu&?Hed3D=Z}Ny^lwk_ zV)3gEKkh+>W`EeHZs_YL#$c~W3?6ra4|O2fm&JKaFdFoJ&=sEwM!B4vY%A7}@hNus znVJtl8AW3b+-s*hEtAJEU)d65XXW^O2sGm{zg#A2l6{x=ti-k#`l+=OY`88j%0hsO_XBa~}<(K>5Yb@K|l6RV$X)5R05O|*f@|8dP$H}70SGuo#PvfCE zoD=4r@UAn%tMS#({<+J^)n1X=A7brX89tS??WoWC$^55%>7x&R(arEWJ!<6-eYSl# zjD0faQzgAm7>(kpUhqS?Nj(7aCOsd}s|Bf(C(PWWQ(LSHof7%AZP zFGde_Z12yjzQ#>sY`o0JH|YzLJ+ZCY)&tjk^fl6aKXYCZ)Y1#VbE6;OeXll7=Sz6i zU@dv$kWRM3cnORY`NR>{f_m<1ly!t_@gK+Q+8XA#jgiZH2KW!zb|dFL0d3!cy3T zPsMdczxC5}-w{Mz-wZBK(Ar7HBLjXM)jW)#F8gxK22k93V#$UpBO$FJfs8ZyY|(*S z6VB7cAK3{`S+ZE{qNcVCh|X4heLeRC9y5s7+j4bvbymxlv<;UFu8AgHY&u?nM`+~X z8`!jFDOPW($;paadnE1UcEc*tc^t7A#%m7Y)&ZU;f8AA%BdM^BrH! zn~gbNEJGbNiYxOuvlzFYG`gO|{}78ULg}=Fs3>}+a^cO0^Lk6KqOqb48#|#X-C6ZebL19I$T}?IIk#v;dB|*YnLs=x^26e3t;uiCD^)aZ?c&D^PFnbVdb*L z*j`zKoQ5iV@#SLF@le%Rvj>Y7Eylij+9RX%DO9;@{>WzVC-!68epp-PWly*iJ#$cG zW!`!`CL8chH%;E<9Pm4D&%e<_tZEz1lz2Zl>Ucq{1?000Pr9t@wZWkOnVXd1N<$2wTMOar+WoyFX zldb5xY{s^&Mrm-J!p7ojk#oyxj9N$@-J4fCzGXp+``q4{9`8gI<4O9(H%s8>A7UW`M3ovt-vI>NX) zg+PCoEdB}=duvJ3MONk`H63dJ`M}CAg`7{hxykYno(@!G={UuxjHDo4Y0v_|y&&T3-==BH7e)0CMpw_(18Iij`^)sFm;$8ZGs zC_WW+Sw!(#=pYklh7CA9H_`po#+A#kZY!@Tnn3bXG-+Y2ZBv4YJwp70F|uOu!Y{C6 zUk&+!_CPZm^exI{fI>l+a%MTEjG0kiG&8DI>A8=#Ef(Ma-@Hx%(uCLmO58rDu{W04fQZAn9Lz6oT02U{I=ZZdymHQT{QlNQtRLz7LvC&sK7Hju z{OyK2@x}-9dEu9SS7NVe<7}&&oQANRU!x5H|wvIKPbz zafTN^i=o)mLaf`j6JIS|gFLoHzW2(XOHp*_7Is|5$#rnZt`6Pno zY-pN2L0nw+>dg#~^&BESj*CFESA1#Sv~GcaX3^=9SCHI{vC<~LY0YYE*}2CK35Hf) zt;M#jWN{D_WI5osbyyl}0%sV!(#oEm~>gF}8uys$B z%`buYl$-j>E%@8zm*V|pTP^=?nm(DHwB`V$xla1mSjz*(V$}2C9L)(7QS8gcvUi`u zziypsV>kDeyK&p3S$=>Qm;WaGnj7E^@{%RXQLlNIRgb4`zZ$nrdY3#2m-%S5y`~@_ z(icjLNe$w%YBu7}m;DNFFWgL?FpncmRcPljXV2e%3vT+~eV8+UsU5~dwDDCfK0+ML zXf8ee!bQA5Yf}BhCc)xJ@%aI?4l7nH$KGmxt9bQ?lkkhb+=1P6A`G9&n4I?v6mv4a z0>OrncCE6$TTb$)D*C`5&9JX#K7`A!eHc~j%bvw+e6&G^S01|w*FNx^x*VzJUYq7ww;Bk1}Y+jeuIp7>a$$4Pn& zZOrmL1C9&o+4gQg3W9n0VehchPUGG!xbvz%;i0Er!dELc+nSDgRLQS+Hps*+MS3T( z0V|g*#hw~{tit^_8RHHh2W3y9j!D4Rg+~yhPsgLZVEyN_aLf2txR(V!vGFC%XZi4^ zLDZFi+887we)mrcT2kV1 z8x~8G;xSmhSQ6PLG|!WsJej@Vo4ut^{E`o+;;MTmn1>q5>&Cy1KVNtR$C)P^+HR6x z%84tdxD)Pr>IHoJh~B8Ltv7ljtKwcq227eS||gEU%<0 z&-MgOeZ%>WB9*bF>>t1o1MkDNfSQm)D42{*pKC1 zx`I9O2=8M{U7ADW$Ecb4yPy1i;l6^!eU{&bE-)|hJyEa&9Q&&jp%5@-x; ztgN4l@9~0o*A?gZhCy61N1{F{w1)v6Pp;-0@~PML8Ay~mCGS}G*6dJ^-qJQ*;v?RC zHk!ZPEgwx#_5)2&kmm<5FaGLo`dYKxv8Zk9OuA}z;eY?W8Vfh=j%!RiQ)7JtnzbK-7eD?KBU%CV4MEO|^V?cx?RF@uoCICA9@OUe z<|#JPlv~Y*m=m+Bx0mRg)>rgTc)`>6U4u#QEjC%t19c^1#(8Ap;`VI*NuPL(Mm-5ffjYg_8z%uzl9-N{4*o9Fi`}BKtNM%%=NRzhx;d z{mnlu=N5PH$9O^v0?9|P_*DoNhxldFirQJ&y$y`~HEAIiZijhfTYklT-SmmiWV2AUZ4v%;{lBoI zI+uJvpA#>`tfy{9DQ^xN8iSvvSGD#wX`{Yi*K~$FBqKm3KO5SmN5URpEB-X=+lOM zOp*F5A0Y-^BQ!VUyBz?7jCgF`D@UYRe%V&;w2tJrKzp;tF8f+@l2Kdc-G%(KvHCwEd zN_6>{xh}q#e`bSppG)qq<%M&~;-e0eC0(Ppb;Ue9vnme{{O<;wbZ}qu#q^jC_eEAU zuFCfqsi-k#g788Av!IMIJ(Ei!L4UW1D)_CEXid8CLu@ zm%MhZPBq8rgzwuNmx*dv(q+)Maq`F0#RY7qUZ$J;MIgGZlu5;Nca7zJ&+ zqg%U{$gbOqXP)d`|$G1(|M4s!GHmMuzTGc-1hGW@#XTB*t~8V z%K8k!vbUyUMQs_nw=2ebZ@!AM&V4X<#$-&K@)GtIv_s!+?U3ED7c-uljM|c3XjiZo zPd@h+PXF%NDB820F};lTojc=|$M3=`Z+?t*t5;!9Wdmk^`Y~E|>V@*60>+w!k6(WV z3pN9NySB9rU*m0yO=HI#RWU~o+;bP6ec@GXtZRwkeL7*rl=0Y{+ZEm0Hm48Ocy97D zs44A?cKN&U)WcJdTb74O58jU#xw$rL(-mFYm7;q4YD{=+28!BL{Q2_AmtJ>=|Lf;%6Zh0R}0$Fw)+ zVD-wS*uJ|C{RZ^sSjuT`E*zt0UU<zxq>rv?hx=F1LC5;p@-g;YXju8}EIB zeR-|WkGZm&uKH@c{_F%i`qWgc+fae^s~4iU|1lWdv(z^W@@U;yVOvkg=D+tE9(ee1 z%y{En?9FM7{yjL3*;SbMz{99*ti|{TAH=NLi_xj~0JJVHFu&J)`2ikz=uy1>!2;A& z?ZTqvRXF|Jqmb*nrj3^_O#3RfhcXRLtqv@f9rWX{P;w?J$n(_cI%C{Tz~5p zeTbJnT7ez&r{R%l^D$=3LC8~l+^-sIw`0UV3^e>I!o3cpJWhX$^*SEo$C z!xNvyhjYF}n;rwW4-}$)?@q=y1$Fzj%`QMIVh@8f1yfSGD_HxsG^1-|D(i^kUru$%YD9vJ@Yvhd&uxj-(?5Zok zfWAFA?iw}jv$d6YcJdT7>(n33tJmP!m)}C|&UJX~k;m}nr%Ta)@Gz7V=Fp#Acy;PT zJU($U<}R;5?>=4e_-$9?{dvo=e)C$|ZHu1mn&J6LkJ#S%{+zGSs%sy#Eh)sN#k0Bp zWZ}${M`P9JuVdl9PB?koKx|*P2opJ;&%Q7X^H*+1zo7%MbLAY|bH~H@Y|#oV`*IDs z9yAoI-GS*q|&PEOo{oOmX;vCtB7aqS4y9?T2`jhwJ*;hY6 zi}pRxrEQ6=dA~k!4Q1`alt-UI9`~EJ&6umFC-T0%mTU8F%>3vJbm})0t@C!_v3u^o z%=hPF?Xo2(=rkO?+ZSQZ+b`jfN1wp-S?{2xupN4LZNvFgk2j}G#+uzVcy+=9SX$Kz zjhjBj!gbs6*7Hx{nOELI%N~Pyn&G~9_x*Th?lN@g)sJhx0JXcf@>;|BJmm$v`^lH+ zKIkBnHrt1PUv&dM`C<{4bHA)<-X7g^H{s#w^D%62FI&$m=D&vr9(V-PIR5K*WnozV z9?863uwp0XeJ~A=PkIrXs|qo+UzcR9+I5a?J22)n;>Ga~qN1P^y0tAf`7hsl5$`Om zM!W1ac>3MtIH+GYRPEkKA0NfU$9Jg=*JTXaLGR?RW{jTiCI;}h@(uR*)B zOVPhO_X*><169Sn(Xmw#*B!4(6CXfcw=rm&y%G0JcokLKSK`qL&!NMBgV3fp-(s@^ z9cu8#^H1X8C#GQ4rtR3VatX3~jKjhG+uFYL)=N*3_B7_L*os~Q2V&RKk1%P*e2g5{ zm-1O0i!FGH>$Ppq{+KcKF%-1xhc+bzsIS_A7oK_yPfVVQcV~Zz5eFY^53)X*F$Ir2 zHWBa5TZt~c`=eD+zFl9GVjWKRZ1@UOpM4v5XaIs-L! zjcaRr!Dny1!0YiO%-}lTl~sm*J==3#?!>c?KZL4+QatzAy?FVp&rsgAH#(FRVeP_q zG4-vbIB0NBI}k<^?(FmH z-Iwsm%DouSqXXW4{&}p}&1=dN58?CO%`uYK&3W&>g1aAh3?Fh&XwN)qe6}xn4^O|n z5bNj7!b=}7N6${Jv8kpI$BrI|hRQ8?@a{YC49_QPcjscz0M28rRVGmnbaV@5^EOFH#_P{o<7uZZ%}_*#V)%MDlIKT zEeAU4cUF@&KJ$m&?R%O zOH>fmM?GxM)NAqqt>x@&8z3yH7{o32HhwT0r?3(C& z-M0-l|NRPly14+SoPGudb!~>N74^t3D8Rd~K8@Ozy>aB|UKoG-jd*|2R?5}k;Tx~O zXFJMp_P5T#hL4}Y9TTRT*%?pViW?t$9mk$}7LGiqJ1TZnTUr>6#o4Eygi<|jCrrKfIy^G{3mkFM88~)q zAKZP_?=kJOb45PIXIg(f2RGGaqii8K)hOFQ?s)2VVNrbS!;u z2LAP*yRoxbcbsJgZD%ir+KJ6yOqb$DmSb6B>1 zw+6`cD~AocH{wcJ{d_-?tclzv^GuQbP}SZoq`c@4>9k*5iny4#DWLN1=1uwitZy5jb?z5N>dE z!48is4K;Y{nm6*fDtU+COmo){t0>hi<+eA8pLRdFPyp9iKgi|4w*c z5n%SriMai~N$Ajj3`Py?f~6n6hBxM{G?mjHxDNL``ymcK?o=E$qC1}W*A;eSryI>@ zZvQ(by}uI2o_s1w8aCpCkLMvT*WVF{>rY@c2S%SYU$>TqBKF8J9-$yKA`$GKc4>zGj?@>5*+yKme{|#)mkJf?(7V|N{OZ?NVQXC$Mjv@NIV&S$r z&})+)!u5AQjl)hk8v{%C;F@dyiOsxFjvjjmy0mVC5zNon!G2?HW2P8+xS#gob6B^# zmIwCDm~_uAc;>y;)PFjPwtS3#-13+>G3}un@%op$aN3z?pXEBaF@vjYhQ!Sn>M0Vk0Chkyt8eLZhLGx+IQ=Z zabpIeWxF0Y;gl25xwHWD-kyc`zt9{9UcLW1JUnYT#vOke4jtMN_uYIYrq5l^!$$+& ze{~Y>e0VAk+Q(opb9&45|H2BcKRtD{r7t(K_G0>!=dr4yik*5q`^c@h>#4VJ-05ed zZS4|Vcm4mcC#M{v#~p^&<)s*V)bSY7y%Zlje=q*~*h~yN>SUaJ%xFAw=aqPz2U$)| z%;io0Jr6#Pmi-RKm_gmJ;N2JSj~nkruQA7Cc*ks9b@`8Q$E0^Liu-Ezx({&e?N7=Z zRBT;~?9%SMc3gk~Ew|vB8}8-ID8k`KAB;BTZE^T9$J?Q|YV86%^~wk4{=#>r;L4jH zL64C~;*{eL!Ms=Q#Vr%wGJVTGn~585{2yw|`{4wxrDyKE7O#D^+pY%!&1KsJ?Rt}q ziuDWdByW-&YVZ^fSG%%Huy^$wJTvoS!#;S^75H*@8O}QMRCF%qL6)LR=DvfOAAf;% zUHf6=p#D58_rZxL9D{ac&Ftf{;wdUBz+10O#wW`+*)(g|y8=&4cp1fQ%JJrtH{$ju z-@<6-^2pJ>G3B-^@$76~g9vZDG673A?6h`v{XWcmX%cTp*lDQ1y?5P)>7TB|p+_Et zHbr@UohOO+(|F;YYcPK1VjO+Ssc4(C9W!UowI`^8S0B0oPrtJgC!T&53bxF_Rkw^s zt5$`WH2zU+<{m8nR)78)UU_pNTJoUx3U7Aww;QP2jelSLSG>Qr0jHjECWdy(!w#Ys zz5WR9eC`t*ddj)z)qD$X{MW76TCFF(I?L$RjN8PHm3a7`+wk$)YMgS$$$01S8*uTD zev9lb2jQ6E9dXYs*J18P?TuUqTXtd8QK#UPBZgoKZ@y>q#z*fCz0Sk?gOg@q;9)1B zYtDMyaN`}e2W?yN8D51-vOAbMQzMmbJ&pCmxMXt`^TK@n&peY!1yR`HGgyjRL8$yAwq^ff}dDb zBAMpfRW7oRf~i@n?P?hw$!o?(%imv+^TMe0MYcc-i+baKI3pf9@Ihl6T=7cWlMe z&%cRZ|NWmh^59W8@vQIThylg0PZ(5JV8Z{d#rDpp;kuunisF23=*+!bm;b$njY9j9 zd<+^p8r|Es#MFl#$H;G8j_;m+3=Tg0Sp4hXf5mj(-EE{yE~UElKNuICe+Gv4>&ATh z4S-^K|K$nTQ9cfT|K)cv`ryOxi;K=h<;MAVX4X<%apga7^dVz#)Jf;!2d53klowuO zLh~rgJHYRJ4+oDLiJ$!L=V;ip9%p>_`xrCsXk2vm;h6pLTxurp06TEp@%Z-X$KsG9 zPrzS)eIY)1VTvv2!H1uUu>(4zdhZ^Tw`qxmUw+O_yE#S->w^|;I%3$cK`16)Zf?H4 zwWY|bYqBu%)C+LZVPi1*@RRWCi;lpXug^ezeJ%W&9vIebsYF?u zb{NIO_o>H>BDNNJ`33aN=Y=MA9&eibZK-VJ^5)~L3opgdhjFoAbUBXc%)`oi3sFFx zJkq}PgP-Dvaij3k*W+B_V3!6i89$b)g%v1i~%=M2Yd zZ+?g^i@9+w-Ght2_bm(+}UfBGwq8aD=Ke($He`Rj|CT4k0H z)=l(F`ORrohEvWyjq{hf3yV=yvm0M5T1{#W3d%a-0^UfC9X%R9`RT=IT=y}ylJerC z_n`L~m*dChos4mZ9fKcz_dFE)JC_E!57tF-F4yLkg8ul+<(!YBM&tZTuSC~9ALF$T zSD@dxL(qC|AZsP z491CPoQD?sR^pR|8&Q~_hwY7R@avy^3rCC|Opl`n3N;6XoQH9*D&>Lh%x|5Cv4zMy%PnQTe}F^BjKqMxys>UyiY|SJVd#*) zD9FpfNoSmojxFwFJ#pIcN1`yR0Y$X8?DKg_Sd)D_4Fe83 z5=V_5f;w)Dt;(9?{W)_uRhnbeh+b&kssoNXVmOMj^O4OPHLVluUWVJA{1E@X<7ymx z=olP-#)Y`#xW0I5svcAnn$Ba-`w@=gK61g2euA#~Td{nNyiY?Gebzf1@~RPqMeT6@ zMVDaIK_l_=UtEekTfW5lUBEzICrVou@kZ=e#<~lSJUt6P{PUGK^~iBJl!v|F{NNP4 z$iuhv<>c%`kAu#{x6e8OJv)@3j_Ymgai`<3(Zg`wPcKDjeKm$2btaBJbSy5q=v!E` zc(!@cw#RUseDoN5N2ht4PT0Qa1FYWz96W9$O3Qd)Kjct!Z(T&rY!nvcLAR^VOn3-~ zedls~>*S+&Lv=i^zwUQ<@5zU;jWq3(Lk>L|-#YOK9L4?g%#q#jF%P!}VLHcmaRtYp zaypiM_?E4Uor~Yca&*F3M|J1aV2-#R1Y0(*Ltcwg3>|$aPCoW<6f$iZ582A$d>h)o zCyLwlz?h*!(3%HMJpj`6te~t1&N`$AUVZH&)ARW&Q_$+r@1Rd{10H_#EnM`6zjF^8 zXE%S>{_-8(6jrc%VD;+dsf@hmS_9<~epi_XEsUjDKMP zF8$-5aSX3(r=I^4oG@kpYU&j9PCW4RY_6w^Fml*XoPGXT*!b2|>}fX~r}l2Z^Y5;d zCCr-sCdQq0KAN+g%l*Hgpcxjw{{p_)(;8R)8)N%^_ku0B{hsG>&QCAHp(6(3 z1j;nqvJi6?Z8AObMpkunZq>dkzIDOr7&ZC`o*hP@rgeW@aMF=D?z|skR9QCWezD4A zPCWMl^x>(oJ|`c!yLV&$nvGlsxyWY!wD10eXNZxw_-8*xN#zQx-_pSAQ+_f&f*f5- zbGgSdPX`SjirkWN3>`cGt+-?kV-6dO zlTJMohmGxz0fUF3IIjd_jyM7xi@5`4@j8*Rlbct7{5ltMzj1}ZqfU&dE-X3G&aId%~SSw3r6r=#$ox3?jf2v}qlB4(J0NC-ix@+F-t+ zz8-D5cJmImn1VcR&=lIUdpmL}*Woumy$CHRMTV0d#gsr@txfPc{UsEtuzgED`t@)<4xvilDC9ON6s%|f1^3O5H5!!F61Vnwvmn95+#~y>0yO-lj zUMoL-_NrWo#@wZn2?M~ug%cA zbqO}Dt>D=6F1WlGFINB^TqzzxV?_UAz_h>T5Y4 z>e01N*dwIBY2q_Le11s@O6)T;%tLMgdiThzg@WQ@n_FVcD=bInPOS_tXu~mR+_eWg zH*H2y`~E1^ybSs5-=i0Htlfe-?(~JNTcblO&y_&2)pPv_>UM9!Eq}Tcw@-W-^A|2g zRlPpT=sC{KZ;3XoblDeVp*dsr4L0m4zNt9uH+}*=%_(cu+TMN^)G}|)xgAtU73kO__#n8b;cH>Bm36r;S@_dKmx9SCh9axU37FtM)PxeN82zrEYE2z*?3ow{)@ zt+jStT_O7R>0)gI9$?zFc0V*Ot%_Qsoa^0s*@YY@_i6Em&*8G){u$HXnT<6YcrD52 zNRlL*+AC{o!VPN5=N)@@qi^@l*4B2K*J>cji#A}#ZgOSib3fuuV}Ry5;P_;;{6#IY zE^LRs2cdi83Vgy7_h;|TLf26z@X8qXD2Jc^<{Iq&^l5ziyFb9x_r5Y*DuZEP_kB8k z1BEQe#^EQPfQ|Ft21gdJ&iVwWoqHx*>#!%g3%Yd-dtK{reTqxeE`HnBV|!^gbZ!&pJ};9+#b}Uh-8QVK*op^l{1bk_YxJ-G@^5Uf z+KLJqJME04@ZOA9P`_^-=B%p02}k%IEzrkEw{Bd6?mhZJqi)~IrFu^#b~V)EiJPv# zB^O_epI>$b7H-*zy7-usAdmI=`NG21C<>R_Y+hTtbk)oiG@u2?MjtC+265%jet_E^ zo{YsS)^N;u&6EZUyAd7R`97mD$>*uqo~|?Se z_tjGDtI{8|xEM1& zTf>+v=mSEGFLFfIi2Iss=*C}2vqNRK26!F>XYIN=30XV-j&ZC!Zb;JHZ`j(B6D;Zoj07wya2V(p?u*4CZ7@I@u9 zxhU6R!xly8uyoN9v>B+2KJC+w7-t-xu;;puQ8_Jb+~gMw!IJs&kX1GU*}S`a;K2`Y z*Mqm=mp}Uf?|hiv-F1* zg2K)?_qaZI_TjrR<*@cG~S~p!fIQZI<0v<$I^%{8`9(r;LZoc$z-0;WWVHYo) z%{V6eDnpKHDzSC@_ON+t)7pVGo7prydoX`-6}tCquX7r0tiw9({2C{2*7MizLDydG zP};f_E0^i5T+Id1wqx=3D)jE#j)x&S@B3mVER8|7A69K#l>-s!d~W3~EZ^iedxCij zK1a7M9nrFRb95PW3?7|0!RF$mNzY@-lm7`9LFGNs?x4S@Y}OX7D>q@;I(_||zpXfT z&L`;Iryok%v_s9tjaa))Z(|ecE3tux>39*V*XC?v<3+L`yz&fIv>1b%ul^H$c=32x#;?7kWB-RhxcXZRMrAZ7Ay>S-nee$MYX2Z(rZ#-&a~oTV8g~mb^(q)e6eB+ zy7uPn25o3N$mV=;;2xs=#6@M}zy=8P#;yVlP}WkWx-Etbu6Ebe<$*r4^Q9ZZwEM)Zci^S@ z)wtk{!;IGguxtXI2OWl+?|uy9Z~O@!yWuL#+f<7@+r%8C-M>qi{)Bf9RdkLn?|%$N zwW-Df_dkfm7>v{VYeZY2W!6TlSmpb@G%fmk4q6WG=i|*A>b+Hd0Il6yfoGi%!X39igtlYOK|edkOQGk#v~_!|U%L#uiPD}UH?s1Z@%qpbS3NutPja7q zYSLs(f8_<7GP-kS9oj1keRXYYla_gC?)a?2piX|K{aol4U#>Kd+F>cn6;?@ciwsfe*B}KV0bTH|9QPBDrtj? zZOfspUHgxHti&AEnAamW&voSF(9Z7gF-5}0HLFQ?JN`N27#+~2%V7NWpZ9WKeUf>8 z8n4ZI5ho8UMzwDI$mYKLe4(%%3p(~0jr%4%gC}pf1ULTq_n5z>+TQIFU3^-x85^!d zS_?l#2vQ~)Ji}8lU9}t2j@fv?<6Yodw z4A8s+3OxaxiXRCug4(G;^Fc_1Xc>$?PaJ!G(w8n_giq;Jp>D&Oeil2zXZTg3wVIkL z)M}?EDD+V$eit>LJ&k|-=RwSxIUU#j?yo2wbu7m8vR#tFOI=36DOEXJ>titY+vjRWHHF zXU)?tI16t)_AlH$ekxvjc?y2|`+wnVUM%(es-~KL@qi%+(pD_y6V61{{O9oZ|2%-# zc{hFiU5}%v-C&$FrUS12+h6hgwAb<6lMmpr*T2G9ryR*^ST(AtPfw){c)+QqAF*4{ z1AldRnyWv``gGQ_xOe=snD*Qgxas~^ankuGqg9I%loaj3{S#lr^yeqyfywWpDr~5w zWo@wa^AGXj%nz}hsg%B$)2#Y^cvJpC+@&Jl~z?% zTWpPub>^%4mW#5+eR$@{37GrkDx(iS{6u^)Z6bDc9*53hFM0X#|Khbzm)iy*&|B{N zwyog}&!d?3`Wtxbqc2d>v8%nyaMa;LG5Piz@xqK*c;L=EFn5_w$&7=dnk$dqb`zd| zbtdll*R}YvwiS*!s5|GIo)A>yo}2%TmpSIQU3(2SHS2#o7JlAajXuPx)N!M=UfHgYz9a|+SEMJ=X1H36T@`;wbswicez1^M~)c;%5h zFzLnVc>c-zF!{YLIPr+lXw&Z?^u%)f{_i(q`s*_>Y5YT&`q~_msjcRE2u~^nb+ta$ zKrzlgp%-qu<}aB1;tWikcpt8Q=zUyz@mak2=!WBZ)#IjXuf;UZ?FVna4IeF7$91QK z?!v!syd7(I)+UD+L7R5%v2np0cy2UuDSQ9`|MW>jK~&mnc;vpD@FB;;HL~^`QEEG^BE68x)HAC7)GeAskSGj8qMtb zy_odi?Re?+H!=C4oAJ`ZI-GLML1@`|B!+a@iNE~$TDx}$o*@RP%D!$D%{60Td`#qx^(V{}m>$GDiRmFJsF@D!!`L1^H)#5^V{G% zCy&DauKqKgeBo8R^4vt+_QXt_diKc_s^=Qs$MuyNuUf{JzFt%Se?Wl0b6oTk+44tti;0mB%s2Ijb<%xzaXrt(^tV4n^Rm{QM|qs%)ElllW$oHv)90^a z@@sEn!}iLsA82k#dlrs8egvjGHXg%|;x)#g28xSOjD`-@5o`fc;uOPaqQ9hXr7?a=7-9_u_vHx z=RExF>RU16_1Ez5T{mK7V>?`O{t*22N0(vpOZ5NQC-Ddme)_C)+^3a+2HWHOdL^i< zbv$;@jd)|uVxueG8qVj;a@Kt2-a;K+`wmCVvNv$w zGu*?TeH;^~e~voN5wmOaOM5%7xt+S9cGWyQ%=P)~Z~t&5 zUYs@qPmO;V@6Of7=sI%T7UIb#p2Sxh_h9JAvDoJ^C8!H~gZ8=1 z90yK4_AuOW^&c?h<>`3&xk_*Y#09b_TR_Uh&3Mfq8_ z*a}KJVOYN|_~NbUXgTsM3~E_{*^9Q|+n4?xr;O^!i%ThvK4uK&yfFiNn)k#HzI!6d z%G;q&uWl&o*qe6p@z%$S(0hnJJ5`VNy#}F2yB4ToT24LZ9BldgJu(% zfBeqdIO@DhFt}?ubFvqA+e)ePh>~FupSMN+iLz|)a!|yLchZa15 z?^uHuUtWpdUVjljo%SjUdK`*BQeU|~1ejl9e}uAk&0KuSgK&>Ar{T9h`!0%ev+Ph) zpVI=PMh=4gd*!59+gB{W*4iQr9?*-o1sq$hEq%kui*LM-bG~;GDi?o>#akQk z*BfrYpbka6t1iG1#~z2Aoon#%oCT;aYKv1&IhOg!=6cwNE`5ifTN^z}@r$XxVWeNT z*62UxI1KID44-`X5q4#_#$|u}3x;(rw&^(T*ppFGy9u9szRdoZ?T`_@(Yeo16s?_s zNuTb;1!o+JZ01tD+7#RO8jN8b3+ykjha7nd4ja$|9s2g?I&6-;`)V+FA(v|E)E(!7|l4w^>*+n#o&Ybp?!}L7~8KD zb7y~o4Lcif@Zm?Gce^q>*yR?r!HB`V?Qkrcw$o^TVT5|ia^RRTXu-L+x1j*ThYUjV zJgy5KnhRTYz_5Y-5h`5_J853GDZs30AL3iT_!(Az@;cVnw83Al`78Rh;o9Pe9(LSG zXrEJoS?_*|qHd$`mn(jWcFm}dxzT4a2M-x;-&#@6y{-4)QOK@X&I42pjz9BE96PK% zUY`CgdLDcVjvvzl?Yj0ykM=EjQLRDGK|{EH3vHj;Th)jG!v>?gsF1M_!KOu@VK4Wa zfxWwM&*X?HHU?Y8JM?~(D=p-F%xXs4gHg!2Y2(Dh-4L#?+KRQ9J$o*;)HKJBfB9=1 z)Sb8Oc`b4D;X^QM`Wq-|-v?)%a~`rPmSNuV?Ktz>-$UnituS)bP~KQDw=LUaD08HX zZBd(^+_O3`2Zv+Lf=^Jv1KT<0oP;*5+hHW220XlY5VS5Su!FF! zNqSII#k;kBLx-YuQ8o{wbr?8g1TWaU8t`DUw>}R;7=H`KuY=ES{hI`tidF5%-FwY61f)44Btb<#&A8hFFTeRUZ3uoeZD z)5e_U7|n4RbHw4;vvMA+`x%%3v{&Dt^UjxAA>SH?Nl z3mtn5#W7?1WBw-}V#VevocW_)J-fH%HB<+)YP98gZN6$6o?lXc z^G_PZ9B94R%(iu#o!1(r1+^G??CBWLsgvx5vo--LZZBV$7a957mX8aoO)L zNB7b^JG`}Q-wgx0bwFw70q9v;i%)q-?LBBXS{LgN^rT(qfh@G(weYR?=HbF0|IGeY zM{n2n8+9y3^eka6Kf?BgQe67`D=@l8D;uK$V~#+p#_gEH8}36-JO@Mjwnwjlqfnk- zXJa#Jgx0k79NMr@v_E8F%(17Sb>lXC{MjN5I^t9uJF-8@yY=C^D8cX}PDGc2Dtzz> z=S)^9jyd)Sv~B4hGC+>~idJVzoo<+PK&qn{l&cKl)`lD0tKImFr#67G514bN-mOM-9dR$wdi@pN} zp-sCkIPu64c$Wvx`d0n$y>pL7c{y)-dUxeoqg`Ha#tk2c+~UqSct~f=`S>H0^cst^ zPCNwV?K-1hm$n#vEce-l&CJ(4UN?C@IdUwo^SKx`ihJ>F9%8!H9Gj=%lw*XY=S*9KirG(TBvGTQh`iZhz?$_4iwm}52p3Gb4p%f~u}O)Es3WENZN$p~8eAPb0X-`6b&f#OSp*;PYV?5Kmx_MN8$+n|CjeJ(Y! z2y~cE6?xM3BbLl^kTqJcG6*`&xVMKsh^6C7o?+1(``*EZ5$GaicF7kW?j~SQS%gp7jiAp{ z#ize%kgwVd<&%8SSMtdp+0i|ywV4OGy8qa&`}}46<@VQc;~oD+r{<(=ormk6Sb*RC z=DR3Rtd!B>${h?z7drD4S2b?E#KITgw)8Ja>oM&{LzcGjQR+I%vT=h2m{C9uEw}1Ih962z4 zKF)Kcp!A)X>D*g>Xx`Qw!E(ylzb7`x(X%+8BRKxRV=4IP*$1$;!-+U|TvybRHIk0uNh;lfM#Dj`quKTxW4SG(VIpt=IHAws=UFtu)vg4Y}9BTkAKj9qG}Y7-f{( zxE~4hJ*i~04>-hep_g{Cu~->*`m>FKxaXwTUL3A8q;spa5WlZg`PzSf62!S@J`t3M z7_H@)KJUMe)GANpm+y_-H?>#9{Z&53y-5!00g1-n_Z0arU5q`@;@IkaBYicOty5hk z>G%F~+kB<1IG?OfJ@NX}WE^CJH$$2)icGnP^D+%_Ud1&lknidlP5U7Ar9E*!e0?PS zl#Vx_xE+3XT$izj{Ui=Zd!`lB;}?`_Oy++R#oX_G@e*AlkogRHi zgZ_rm<}>qYBNpdo@bf@xM>*6rKzQ5h*x3KtC@`P)%ZY!qN3mzLX7=r-pqo)YD`et3 z(7IIq;^(b34ywhg{W`A02*TSrA(g|-#8-zryaw1oSmVUn&z!__{56(ozPPuUP4cNv z7fhe#yxCw|wLs!gulpx{-SGOmz+Wv}gPgp4-jMddK7H<-iZzbW*-#nC$0Zwfpjp1o zbEY&<2=17U1Dfn!t8YJ|kzLCEFR+P9kfauJRPRnW&7L@WBU1#H1qW;Cg?6=B*(4^P zd=|F`H{$DRwfVSBf$^|dqBzi+a2n*=T25F_TFFYzc&IJWPY_+76EgiQIxx$w@MeoN z;nmi`$Tw241b&u)@R~umjQ8YyqFc2N*nw3WnEVW^9#7Oq(4gxt(=~bHW=RLl7xRho z^4Bs%`{pnEra^~x^4Ml3F}Af>WLy%ulNRW0UGX`EHiHi3SQj(t)EFywmQ&eP5uXJa zd@;F9F<_32mqoG22TACyFY)-{-hE@rP`|eV5B={d{Py|@IPH5swga=pUeXu8z4Tis z2!2G+7)1SUmvM;BzQ)vKt=1Da@sq})Z$Z&!X7hl&(&&0g(<^bxTZ}_?^iML9xxk{Q z=mHxfj%ge<(~{zg?z(!uu=saJYEyC_l6f3tRBEU{q{rIAMS1g0x}yvO(!7#?%BA8L z=&6OzITq!@VrsyUlfH}7$8@%_HonL&T`J0%$ppK~3)^wLEEmKxE%ec2_4(!T*f`Tq z^H4q$xDQ&c8itD{Y3hj|m-=dyC@v6^0uX|&0ryok$a z<`3r^i;cNz%_-SoB25QzYReDNWkd7c)>x1++tew4#qawY=Z3+9^{+!@^v^9xxANYAQD^@MCk$$3 zJ}EfSbzxV$YFiHC1&5$NI*svZjBNj~TzD>RPb6J-sU#T(*|VJRptg6*68!5Azr>xd zEWsr|{=PkJRXR)}*57x37m1=&A9`*^{$Qdtr6hj<$n=7A2D zKb>`=jQq2hnPX-ptWV$f1U9DfM`J2p7U_)o0+ZJUjf}VHnE7a?A;=NrwXO4%4*R$A zq3z(~8gcQuBuHB}5R-I~C#^$#X|4Oqsju4=YehJ~uX2R#f1{`Qb@( zNplNA#ShR;K@)Dt(#0tKrYFs+*-6!k%!MENS8szgefaV$oAE^D_c@)HAbED6UitiH|Jy2PVpW zDhAsyRisD7?1@et+&EV(TVihq=^uV*{>g;-BbVfdbg~omMNmHt@orNh_8BNL>nrM3 zFI$I>{rVtJS2rmYh_9v+D_3kr*8x3|t3e`|y%2A-Yj?K+Z*hpv$ew@stVL;aSa=rA zWr^qTz_)VE8kDu^h?2qr(-WqY=?LBgdn{3bKrv8H1o4=R6bHP!72^)$8f**a8yEe~ zVF@uxR(wWx1vZZb@-2>41lhDTnE2Lo`~~7M5d9ls5RY0$3S%X#eASeZ9|}lwM72>h z*{MU5UU8a^6kWPhC$bIXvyXqUW?!|9oggk8`e$oA#9%swZ>+<*RqN2AT_=<_&*L>J z*fS>AA)SV!UOhpyx#0o1UlD>`;f$_4$O?s%y^fIBCfGhJ z0W4PWuwpWI%$}`DU!0b2Nf?_AL`KH+h(FY7SO$V`rpI)I8G6KnYbPaB{2vs zkRbW>q%YwiI{o)P0vmfZq7KV7`_Z0CX!{@*e%|D=6(yD*IHXoh>t7Zqwvh+^U1f)=%-7 zZ-gWk_367kT@<%<)pni;rXu9n=7AWk?eBPK-_;yW_I>_H+UI~j4wS8UZM18h;iyYF zw2yWW7wC~swe9Vq$v6JQkElkF4Km6p<1t)_HO48D#~|mW+ga`U8tCS$SV*^64N1C~ z3F&eRM-e%@6sd zzGj65DnHq$O;bl&JTRLb`DDKN7{vJ$!SX`>1H}+&#us_bBss{JdD6VvzH+a7_a3OJ z@q@P6rmV$gJ_}*Z%#&uKoHKx%5~PrB+Dh={06>BaF-ZGPXtvF8C`sGE>oh$UQ?E98 z^rPA%4mtuTFdqa#;7j*XylI;J)MVe^w%OGP7>9<_lNgKfrE7w3t}biXsLz_AEf)QR z7!q0lwPj5h!<)(wm-?bB>B5D+QG-5PgeqiD=fnCY<`{um>YL426Q{e|R-L+|LwS+k zK?b~Pfq1>)mB95YE=89D>try>sL2PNripE{O~n5G86S&XB#3F?X5Fj*ARd@o+0zmo z=v|-R(c3DJX1gl7ycL2DfwHMu823sor<<+pLhAPevx~WJ(wmiEgg!hl=g_W6iJv9< zY~w;uFXq890hja$Y6dygPS-5UMvv}2QQRz#v1xP3*sx;kd}Z+{1eul~^2R*7v5*he zasG%N+wPk3!v<|O#tWdy2c4{q%|Jb;iO+y}4cS-6ULA-D^6|-lcvON014+xD=)cLZ zSp4xveg1eY7U#=AXsZ&B^aYy-lu@i!1zfy1s;#wY*NJOoDt*+5Hfv=Ux{>k>wFLbEy(vyBAXkvHbY>7gbu#;S2OzX*v; z1nq|bBbwq!c!It}LSrJ3J#|Glo&d6`xJgP!DqOl+G;@tS&TIVdlzGHcDeGd}qmo3S(j=}mO*m)}SeG}a?0zZipt z4YSWN>nWn4$&=_be!(~7C0(0dmIKO*66HA8$q;#B+-5h;ueQyB46o`$cN!RDTJ~!^ zrc1SVqhDrQZI+CT;_-Q8ki;kPfK9GVA-|Fjy4(-P87PK8i?|G5pk=HXB)mbl@z`7< z(NNBBIwIXL2Y_S_Nu6$<6l?IuEC+e@Q**_^dA#YhUSrJ8&)V9N%2(MWP5vc5k{11z zP2ts##R+LX7BdrM#ODn!%tu%ijyLdebG%v^O47DDCD{z55AO+>4IbaMamcvmQ5%Pd zYJUSTa9tbX9j?GG9xO8C3sS+zP2s}bp5$2BT~jQ9E*JgtEo{4El5m-Dfs!uC`{0BL zO3)Kjd!kIdZ!21Z8X#*Lm`u>Af6r}qTk7)GCWaeJ2H2B*HMywGFBa)iymnV5ohsz= z3!V2(CIu!FXu7cKvsWr6DH@C2F|$tMH+{Y)ba!TVXhiF?M*bP3pfg^miHQ@_KzUP} zwLaIFpGO_s1nrv;0+0D6KFtB)Oo>rK#X9)muK{Q#GXfetr+b_Mf{lpRxFgRJ}J<0MY6SOd1x{#tYmp7(W-WR7qms-klKjaA z`iIVZ*SuUc~;%1EE{GKa#cFTVoa6i8OQTo1;tTC{){ zuk8!eW07d@~)r+ZF9<6 z@=a~cDAH(4V-V+ntVKTQuz1awkCQ+=2Bt?NN{~sn>^YQ9*3y~iGkYu%N1iwbWZ!%t z+Kb0!Abo=1V}{51qu;8 zj}6zO+)595q8_8El0Mcpu98#uVJzgAED7v-qMAkNuoSrh%ZY(%s?;tDoRUiQ=%FN^JUHlM^0cD`WKZZ2LQ{ojnbq5{N93NQ8rd5)ceM4%TnD3A?L833zmUGu&IQ3(^K8CK>e6z08 z92exIpXa%zkrD#gE76_e=dIuq^#-;CoRVl!5;H7u5yqG-fc-V>52Rae1EiY4xYDMd z(5J%xQ>7UU9A@A7(7=>i&R>M&>FPE^$Bt+Z$}qrqhM18w9xcT{5b!b&?x37XhU#gH_jnizB7Nr0W0 z>m(QU>JW2hZ(EX(&_aGiP4hd(A!$Y4{bI5|9AO+%o%lzHdL!g;c`W>D2UhH;wNET}+bjpmtf;uWze7%F8y4Us+ip43L+Jj~G_D|sA|SD^p2 zsEU1u&A*t&Ne?LEx@zQDuv`{4)_OqRC3)F8yj~fiZ@xg%r@-2GN zM2htckzbWbp}~S z$6iur#v+rKaFsAnOS%kWy47H16F15_B=bY|t<@AnjrvTN^#dn~X>A9Rk6>{qzG#od zE_&8W=_Cl3IyGj{S`G$mf`dk2W&&jPA&ze!?Gge+^uX19_s3 zjBmuS5tpxUu?S+l|ENXC(7mmLo(sswojy-|2z7#s&*TMCe zLF02qKYXYmd<-Js1ez${pg3;YDkedmG*_~Lnz;0buG(4kcxn89F#U_|!56>Ju%{0M z;lwVAz7+#?m6-g<9hmX)Qs^)1*DwDPUoKsb?A-W2^9YpjNfHK2JuNUDGR%g9c+|6v zGUc1>8I66zrDXhR9WZ0kt$6t(eXpbI$Z)v4D@suqkH%h7rC*tqDvj!Jk`8iJi>*x5-i<|5QL4L&?$XDy9d~x%^Lc|BVnJq+h z;MoscJi{f3IP;%6g%vJn4}4CGIG-2$TM<1xg$TSsG9$+yw-XR49TAlP*Tnug6;Jx9 zz7V=bSSrY5^C_XZM)xE$r%jjq6Fu-axNq7THEz+SAj3s1q**^Asl(aqtkRCg6X$~nq{-84YB)(`n0d<3H;+NX7-k+Z!jLiq> z(~~jl$LCT3Vy?a>uX*Av(ZqEid#<~wY??=;gi2eUKgXGDY=>grX!?1}@xez?)sHa+ z7Ry_lBP0Yps)PPO62zu-`d9^SbCmonrZy!MtqV+}{0Y}8%_-}%*w#&4d{@|JhIAUI zgUuNh;jEZ^Ccman5Mqw9&ZjYPO!7qEUISeHze><4V&t*7h}Sx|LYx)xl4Nrs;G(=DFkIuQ;lsz>WWW?;RT~FKe zRX_3Tc7svE>>oeK z&C5+}N;HDSz#`E9jh8vI$d~9}{FsR1)B#lfOG3OR&wOgZ>FaRZhMtDHoW{Yw+NtT7 ziqCQpYT47%HN%HuxhAjS6}R|<4e5-&$%hz{-V)TCD{sEB4c&&fLfb;+-ECVu^h;wb z#ga!sKK}OW0r>gh`tD+V1&`;*#>isu#U>H?6KyriXD$E2_*h;v7Qr8dB)e+MSAqFU zg5@}&x!xFu#$Ps9EZTxU-@ObozpTWDy}n$7KFxc}!}@##D3Fk^X@ z+4tPbwvU0lw)rBRiid6KP%h+=4%_0jF`|8QGv!;%MI47@Y@|;~2#_9EwMDWG*!o_Z zYUPo|=!VUJvT8ikFPa_RjN-Dc)nR{G^_|BdO^<#EtWEt6lt@S}9c}xVDrWLZguO&h zls|wTNkx^`mLAGEF7gMClwX=(4qkh5I)XF)z%L>9ilG|kyoI7!f1RE zHu6Od$E9^S7$(@VW~c>;wGgZA5!RB3=Q{Ir%PDpN47pV;Y+9$98B}k-7#wQZiT5p$hLrN%1C3t~&P zO2VIlXgggWh|eJMG_iLeaR1^Qj^NUil^#{X1)aA352V*nj`!vPcp{`|-^_J@6-+td ztVoBuXOP|>)N*f|g2fSH&Cp%WG)E+L?JsZHHl$uOzRr=1Ly$?YFVh_S(wR=YX+KSX z-Sobf))gU+bOsk&UYp9GB2v7Y*39eVRaakib!}C({d1FcrNwAg=!Z-}!blA|m`GHH zw|~PwH!&x5w`F~QVvxQN3Zz5d&uT%FRh97>&B1CWr+Viy{QIVR(R<`!Xjzzz4_E!{RMfT`iVbf+ ziCgb|9BcRFW5}T1C?IXuhDEsX`s*PiZ(3@@a0>tVDh_5uzley{O9(&v1n^HMhxv|el*nV#`LEj!A-Z{kEPqPP`PO? z3c4PGvHd&S(@q^;)-K(SyIZU9ZK)9l1E} z;8NsgHDJ|}ZMbp58ccqB3)b&##GsxKfYCjQ&{(?< z|9xyN`VK6`iuqe`+myAK^!|3VEGtCMHu-T)*nw;1(rvi?=`|St#uluuY{a-eE%a~R z@bKhScwqWwy#3`av~S-G9ZK@CZ~IM^!g3)8R7s(#lV{P%@z`1!dVaNiRv&}~o|T5){VEZKy+r|-mwLCjrN9qxa81&X>9 z#(hr3CGYa(l~0S~cRX2UlZXb_1rqvKEi< zMxvSrP91~N?^ z+v~&=d^1@m8$R((m7c)KF5AiHCsnH-Y?(SsulE!E!N*Lj;vukYPgcYuI#EV46nhC@ zutPnDSFMYl=s`$-o$fLwobbeP*1qpg5rd8ZF@~s04a2Boa;jKIz0{$~Vz!?UW3Xco z$AVqi)O@l0hkQhx;$urp#&5R6Hy)ThLC_iVB#}5zlxpJ&c`?1}2K#K;tI^04=YYl` z^O<+Y8w5VprduXuOKu9-7H5*PSc}gZZriS>A^&M;GM`MqZ3)a?ux)Emi1-(D#CbQ^ zW6_IACJ19=+vlbG?|IO-XPBh;f=d>=>_s2N%eJp=@)B+8f=`(s9o!QZ|FshBI)89q zxie(Y6ZI)StmE2YMR^~KuJ7(TlAK)%;N-p{4A`adiTLOPn`u<|hsV);oP%n9zL171>IWZ;Xi-;6+YkD3V-;+<)~l!8m_r>3OTZopI?ACo_z`h zJ;&klpMM`;ynG)IVDIvvwgErC#@ubtx5chlv=hsTZ^6U#Tpl`iaz4~m z)#IIaH)7_>2K?Zh&S<-L53YN11G%#>@00cT-Gt5f*6E#b(ILfn>%&S^=4K(E)cLbF z;IfA{;Dlp4;Sc9^!1{TcaP?Cgkk`5h8+e#ryp+r@W+cEY1Z8o)bEZu>RD;iO> zb0_s~!ZF8m#LtdzjgmZ{cmh4CT=eM%T=Dn@3>w)Mzdf@(IutQR9=QMdpT$^PP=w3R z?~G%*=iuslmSG<4po0dQiY!7z@o*wv1WH2U2Mes zuXbVLI~5pvXa}6qCkHn@wi@er!%(?(Cw}$sW#~Ah4gSb{tf9=Joej`a{>tsU@T*&v zps+_d{_vg7=#DD<>An@H;OV1!$3A?tWFM_J;C0^Q&6vHFH*EFTx1$R0E#8avtr+JW zi;>%<6n{9UJ^HrJ;X-cYjYf0yY**-CWfqnJlZ2&ftI@Y3Z(eLRG@@tcJXCJ0$Hvv$ z@Q?8uar`M=@S8K*p}95+(m(!WD;|5d0%Hzoj~^UXf=9+L!#nFVTWWFDT}!dGSrLAJ zUPr87unD)%*v3(6#Ds}UF>!t!&OfyiEbKY=eD>4pOv69no&=>RlDwtKFP_J+4j)P7t#F> ztU_(hyIcZkTxg3wz6xRtqS_%?NEu3jsIp{IA$PhUnT*<2v(L2>xDsgE3w->EV_+8@ z)=`%r#_Zr4RfM-V7{4IH5n93Th<83|<{aP&Aa)%?GHvhgpI`Xhp3OmZVqOTUHJNi(E!2TrIx>eS75n{ZI;*; z$UoT@&a9GwT{60Sv>C@Nv1?|%Eiif6HgL-(uh(GTu<|Xo3Bs!wkfwF#av6MFN6Fze z5QMi{azU?w`l>Cbv~6=D@Ct1$)`}r9p0XEegMhU030-SbpN(xwucyQN2DGj9nE3Bl z&l3^SnCLW0surCF6qaz2&teMgxTbYrHXiD=eJl9n;8tZR@(9c?YdMETS#c%6wt6aY zPl-4Ks!7X7n~F_58SQCEq%FRr&w(%>H2;ZGTX9El%^6uj>~I^8%_tBQ>?h!$K!Skg zk}|BGCWv9}f}R2*b&^kOO60>!R(>%K8qfvv7cEEqwpFO{0$tj)MC*3l(WgrX>{>P(FE8MM<4-?CpYGl9 z!=GG?P4hp&mOa`eJtO+U`SM-|vuvL0Bx$x%bTHhNh7}8Sc{4c zmB?>ff}W_xMxG0ouHJ*bJxlE0|K{>ACwDZ!b@}=D#krj@uxl|cII$gSd63)9gV38F z?Z7Fgbj9KQiZNtBYy9;1mdLKvMGScD-R(H})UG&oP%--UD8=tC=!A7kc3^#V4u*Hj z!y+EuDmGW5WrybIl2wbfk}r$7GB5>gw1wHl#+!JOxx z-XSz1hq=)|)zNoL?z5cdV(5TY7}ZPv@|Rw_?;o6^e$H9GyF?Luv4(e5aU3>fs@;kI|h9gF{ zLFeLJ_GQ97RQB9MZwve`T@A0brjueAk#zA;!!Zdy)B-)RGO&HbwWsOnwr!yip?xSc z_Xoo#j!Guw6H6pHxX%fM{VTy)?ed0EKyj}NAbomb;_Zy~$e+lm5y`JyOlwX7b8flQZZLn4ZKhWrg1K-O+L-ipJO(=HGXT5mFoYOGODB5jHkIlt5iuDuOc*Jp>|H3x7_u)mj@LykH_S!1gzv~RK zY~u|^pZ0p9udgjqUK_A`cOBYy5st3eX)Fs}N^-Gfm;WcB`sTT4ZGWOnslsfuZJq}| zJ2oOe&!5f-R`FoJyfzQV^wZN=;E=K9SjXIaGG{C5I~C)i!;10om%H%g@_jg{e@o+W zYYv)nD&hRM^ zA_pbSdC1-uZls8-+*6Oj7CGqJyA5u>xION7DXjRXxmJ8*8Y`J%EKw&?v2yh*5mts z`3zS+wHDj<`X4~*CeSu7vnCTh5}K?23L2ATjcIkt)#n=QGiwSx@W1ba5e7fR?3o!+06L5(7ZT}7i6mERtW>T^p z^tvQzfzSG~!xHTY=N9Fg;{>rC|1ih)ej=P#w5Z>~a>ZhA--q#!pnMozZPxPE$a*m) z!G<7QOANv_Mv}JGn4r%kDr~|V&AAU^(_6?+v$vTo0XCDwML)!3n#`Y!O<6NyqEw=0 zmo&T9Ihy3aU=YSUrAPhrxU#9175nG|A>j|;+Cz+Lk7y)aXnd<)JzmcdoW=amD0HG_39=>5Epx5vwVov`63t>{jmAVmv{{_ zF7qR!GmN0cpms9PRm3Zs!UbMErMEepidD2YM+7FqAKO>dCoPVtYRzl$7?4GHb#1QO z91HdXUJZAHG|3C+Xd|evB6GHH2!a8_3uk@#<9JujHjB}tT=ZEab=3~FAf6Nb(CTry z%9IYR3*iOC8J4w{s;(1ePpH7-;)=`jDF~W~_PnZ}_{nRZ*(JzNqse9pQkoq!kin(k z5SgSbDELMo(LR49R<)%w>Qy3C>qSafn;r3KnzAo+0)bD*gf9IDqIUIiyuWA>diCgu zeglVLa8)j>Qvg9 zf(QTe5438o!?jP0hT1Kd@Zc0&{m6J+{?m(b@*xAD&x(6s;ro6AD0cni<(8wWdJ{HR z_+dw|WaTdVY^y*R%Nt(@^=pA0JP3ZUx()-nv_Ox}&9G$ldThvPj^1taVE>BKm|c&3 zm#hINMx3QQ@f7j!xqQ9es&~GPE32@F=Ctfu@!+^Zo;dg>XY@|Zk^4?fzCZvD$p zlI#D{7p27*lv9I=Z|%b1zNP5Xp%9x^?8H~wsxhz|2TcnoDk4agbjOZbQeDae{NlyD z$s%ZZR_>_9=Dk|jS!h$9kA(~Mq?_kuZ3Z>9SXtSC?#y8^Zw`89)nU>{mFU^EIeIa7 zyVq>Tdu!@3y0?GKqIJhoT=nZgxb^(jcwyQ`tlL{}>%qn)@lA~!^zV_6FP7|P+vEN8 ztG(#gzu4LXhPB5d*AByPN9NofsbfNM;2$ZHgT=L!Cc=47Y*tT#pUio5=?JIIiRpyTd z?JmRJWo>WcCox#IeN$3yl`GLqzd(Y7kbip(dJI&n5NBhqu5^VxNgJXgS=1MwA)Mb> z49^#d`AfnSc@3qPh+*3gQ%;LuR4EK>0@v?+k=J~Uu?j?BTllm-qbCS&Xa_d-=)bkS zVaEj_44G*fh@Uv0M{KCWcBl-Zec`+jXrUd^HfHLx;~Dl>4?T6Uu}zZ=DP%F*rptY4 z0_>arJ|O~MQjtF+VB@5&h?Ym`qh;GC0z`TQ@x&%eJOtSIkS~tC--o*%HLWWM9ceMD zbX(t{iK)=hT=ek|T#8GTy%HF!{l`K!oi9W4HK7K*iF3u|<*9j_fyifAmMClam(s{D znl&8M7GDaK$K=pO2C1@fN%5uUUIOfxskA=XW#954JRAD4Sted%3Z(ENeqX~8=}pTe zi!NOvyO0PPd-1r>k>oVD=iOl2i0m^r32%U?*Y|suGo%q%60~I9uE2a#!}>8-x=y;R z_;jeWxB|ostJu2mW&*}*a`aqlLIUhteu8uYl5D7cgmuL~)vnqp8Q1)RN} zFlR`~9RPwJ$!enzMt3hn+moUwEP7~1oOrZQ><%%-*I3_xqIUf-reg)3`(!r{j_uI7 zM}KTz_z|i*3_~076%E4$qk+Ht{vUYy*{OKso;&d5jJYJ}TPSky?#qwi9v);LzwcJu z_v&I?{-f`pa?^6$d)Hl%;%z zkI=w&O-&6wY>9J@9f9kv_zj++FL(a;KUlnJn%{i>WX4L|_QD1{`}$h^b;5d_a6$*P&(A{3jz#F+ScwmI7GO}jJap+) zg4N6RpsZUfv$6K8jri{~YcTcQ&G>9>J^J)+0c_cdGyn1hR_$rPCFgX*hp(-|P5MK@ z>1%MybL-H1Xj`1swH_D$cL^rHxf!=UycjFP^|BcTWd^i}F;$uGqrOyBx zY3D9XThoB^4k;58i;y`O-Irs(q#6fxDL_G+BDAlo#s?Mo7}Sx`az5)Hir9z$$shl@ zh`@8zfNI`596Y)W+Ei5F&l6W;>f7sa>vNm1yDm%TV~ic!7K5|);IjKxV(L4aaOK_0 z(5hcK#&#|M@(XZOuY63Ivm3*@G)H;+B2;ay!m`GEjA+9fv4*|4aER~v0yLS zb}U3mzBU8*K~H)$UJi{Idq_v*Z`_7!CauFmla^yvWj=m#XbIMRxe0enVb0&)jJKCE z)?R*));l1RUs;3kuWiKbk1fOWjXC)F;iYKVyBs6)_Tdlob;_HYaQ8DSFm3J*v}j+9 z%Z@I=<+pr^$6nuvM>sEL&fbL?oC^<5--zel+=8m?eDr9o+?feGFfV)WS)6;xAF!ME zLb?sIZG!pB(iim82gRecZo690Y>tRdu!jSotqEwC zM)p0w&S(166ppol=?rr~9t1wwbe(LdCK#T@dZ(wpr|BX6&enHvo}t`8In& zmkFtsjPrWo3sEv@IhBlnZM{=&N?66Qu`9fILfn~gi2EYJXxii4wu+fIbeQu5U;m+V zATZxV_c1b%N*U3M8FR?FnowI+m3(_fVSb)7yF5$amK>2nAMo2V%#xT?(^-?Vjweaj z;EiqEL2vv+I;Xpwtk{R_RcGg+eVa0L>^lM@`gTH2UNaPzw!!Gb4n@~CB|KmNqYgU` zrPza|E7zg0yekerWE4t^@{paAhoeqA8wC}suwi!|zVqWtF}80zv%7Q4S}a|)0d0Ga z!H+LF4~4mn$l+n9YoEU8*s3|&cN>V(oPF55yB_@p4#ucMk3d=d4y;(c7KN?4;*fEp zP*zlEKIaI|7w!7h-F5Go1aM@1TG8j_B3B2l8`sQQol&`u6BxwzJr8-Ju(L zc5jD)2OWye#dY{%`9=&q;#8bCZU8!V>xWLQi!EOhsz&2Ze1Vk}!ziEUL`IPKUDIAy4E%=manYSSVQJ^Qr8!1e{m<3YN# zWg!k3R*d!~xr~vAsI_~sxuPC}hql7^4lB2Xkd;S2x-~=F_RVov-)309sRlc0vM_dV z8M>4gV&w2vD6X%?ip{lX*QEqMKdl2w3-q+15k-t=NY^6H0nLkSl+n*#o%8KbsQ=8@ zi?oFwY{dE&CHVHJmZ;-o@VNz)l@y{&mlhb&t2y#>veC9A2R(YW#9;cad91JF>)xdZ z?V9H>mR$6vu2RONHCkB6ey8RrEo+9Oh8APv`YQAJ{FB-<_Cj=LuA0-g!-tomc4swK zZLhI0+8sBnC30)(uwq*s%33$WA@r%ZfVu2j z3Vl(^N{&NLvwR#jye0HEm6|6zYqIg3(>h^P*8=lLAzG4|$L1~DU||1VL}+pQI(E7? zSH7_LX2s(~XnQRtSL175Qd&p!Q#jIHqw@<)A0cjjQIBH@+HKiWq*CH^*2GJ{Z8d>A z>aH7rqcw4H46K#)AJH^$&SfJ9_NleHTBP5RS|16>jojqv)aZl9LGT{(diV} zo*#YlUoR#vJ={^HC#BEw-GnEo7EaRo6;gfHP78e25`-KG=v=%w+uQo4!1>A}v0le*gWh@He^NDt7&{|FC>bjq1P6+)P-gTLsKv(52s>ArPm`b67Tqef^ z?VtK6WYp1wpGad1x}q;?3!And_#D`YN{ry`u=)tD&wXJLQXsV!p0Sf>#9Wk>mDz(ysc;J}tXCfgx3?{Pdj`)Bjg6HR6?k#}Rt)8#uACRy zc;n=exdMT0W;_TjTDq8r(n34TmbPr+-}Ych;6Ui^&Ws4b1;o1tB|}D~*YO#h5){86 z%Gw}nu-MiU#=Lz0Ze|Zw-x=%t>TBS07Z(!}p= z`o!!^!gOT9kwQBV6)rSI|e2r?jF1mg4YaJoH( zWv#HB=DCtmeRGBQfzsx7R=%GwS-N zU*o7BwY4DRj}CwOZe#tS-K|fo!okOO#<(tpsAYUHU*eZ3jggeaPY}ch{x&x>)+C$X z^s$CSG{aj>(^sTaBOob}_#9+W|PDtKLHp z)F*M9ekIa?ndRhB4s>C)?*X?gkwP0Xo{7Dl<0Zd*JqzMIR*vhn&XsdL72xw!oflL z^su5X)&4Y7O(PNQPeBFdks7Tk)R&CCit?nGMB`X0F7_>d=7S(JuM&OA6>ZvzcP6tTTEN=HFup}A zyuxt5U7uW%Ez>7k!Jt)%jL$(C5zbr|4~ZV5%g3?PyOF|M?)c+*PT6CABx5^(4s;wt z%|GpPvg32vbqS2$&6rMi(dUml!#;8Ga4mkNDx*QPjDJQ~gUqrU4~L@fKkw+G?E%VR z+!x|}kc=jnJq@)s3t42w6AZm-ld3(z6M7K(kNT1wXUSADNoG5azbsv zjr18Of{B=2()i=oivTSP_UM6{nhbAK zkbYigX>aj{9VpCGE&|A96)D!DRxULNnKlbKtX^_;m1GEhk<(UY>@jx7DN~YR6eAZE32P)CcpN4un%tpF@ zN1qNf>T3g~Z>Ez61>)Fb-*u}meUjHG$!A;GCgXa=qrqhHSW6bm_6F}e7KzWJPztjVsQU7Q!RgND(@r*+ZqqXALfGfLr(ci zknhAxk2$8v?zT0rG#_movU2g;AM~*Uvp&-;nr}$V3FZ92?enXyHgjOMzWk(&+MY*c zTYZBm8B;A5wrz;kIaFe$PnoNZvDQD?0_ zFT=L{lTz{51b*ewCIpE-Rw|}J%qVWbn@H)@+zK>vj3thn+orq>a7}5`Q{Up$nxQ=( zZ;h44OzV=oI=IF7gKcw>RE=jCK6bT+os!v5rNb~BL(*wm=6%cX@w4%EF|#LIq6;mI z^93!EwHEt^V=+dj8&$FKN1J}ciq-X{!8N(8Md~fvs2wMs#8>f9iStCdiX>HJ&y9%e zdVJ0}1m0jadS?e_jV&P)yXzBwCJN$${kTTF2m)W|ntLg_`Ku=FC^vDhj$m<-$J7Qe zY0gjKMDv&r3_iBfBVKwUbH;C3vpQac%?&f;YgZ+sTi$u(5!W<-4sllbq0rmWuIW?X zid%Q*tP#dj@vt(7)prn1zNtvJz}mrgfey@)QA84V|D~6G(rpXon8xd3w5N-=AexMY z7<(lr^+=9*DRc*o5_4&LfZ=qV_OX##!7Grq+! zv%H77A;|Ekqdc&mP%0sfR^v9GeV?nf`>B1yQBbWZxnBALl{3IL+H$OJAU| zl8D=2Co$y>vB$Ab;xV8u$s3z;qS!_Ed8`{cjhp4i=9?JZTk|LIiQmRXRO9h+a*ze% zupjFPtG&#aLNWjR$3eW(9s2@OtxMT3roj}#A zwZ?`_YHU^Hhb#)8iIx5IKnvVNP-GZ_6vz?1q=eHTEmp*5b;Lv*Unm>W>LtySDwbU` zH^BwFQQko<@r47aP>Fx!qyC6DA7o#PfN@0IdX0WbRDDmhcdQk4vR3lMo9H%ySjbI; zWK2#x#_z=kIVEq!X)fzDHG(>$sifN`7y1U#u7pGjKaLRHOSEae8QpaVi}+id}-pFcvRTY z-1Q%!jB5O9c~5nQM~aMQ#)vb!Y^U_Am_e((7@wM-n!2Aw!QC`f^zs!&5u0U0WN{skZedE3w_n$Icr z660iB&4kVuBU@W7r@3Ce_?&Q`6~EJ>oJy39ePc2Cz?0}ziG0jY;EB9~NYfS9+FFa! z&5r2_xiKF^7cJ~jrpHR)39qX46a7wjBx`i*THAHGgxC@uQ=XxDoyK@S`W3mG)Fc>R zVpnrSemGA?&Ku&B+00cY&5^X;dTGS2Jr zP3Cnh!iS#ov*%UB2HDU~$yrH$93KUpM}5Nvjx=61vDR^FTuY+4AGB+9$2pI8O)l`b zOw5&ovIr-6Zt0TY{Xpc? zi+qv($RBBTx5}b>CmFE5-a4~5+2oHvw(TuF)siGycWBaU`i(ooZ|88c#SVq^7LRUO z^dMg-fxOUH&xteU#RkWJ+1C?Uw#;_CR9V+HT-`-lPrvc*j5x_?;zgVy@o3zR=_H?} z$!tl1d<*^(q}ya-e)N`%Q6%rR`OlV0P(-`L%T&}88me7RQfiCYbtz_lBFnxhBnO@I zKdSV*V2fXPc_p7Dr(%9chinI*trk{I>5^*lv9=;3N{#W!S=H7haMZ*kuvmP~xJmuU zko#j#+1U3dM668%dFZFbWiLk3uhETz>@GnW(?yE%OQL%ty_zTL1sn23J&Qxd<1(ML zjtHX5H{qlk*|b7rZ5`0DLo+nXlaIukobwqdID+P8%tM3CRhRemBu}K1ee+qhGy8vi zQq%Q`##d{{Cr=gw`}SY|%y$(r=-2i6m=i}v%ddVk1%xs_k=UcX1`?t@jgf7LVGc_| zxej5OzY4+aNuKmLpV_rotnG3}P$eHjC!km;p!~D;7^K+yw(giW!~5bi32*s$YFxc9 zdCG9o$}c-W2`!xQNz#ApX??OU@I?yLrVZEWV7hHk6pH**Y$jxU7N770%QbCEt%LlJ zW2G^2FD*WTp34}kbXuOHZN_ITt~be_wSy1pC zJG17W@WB(dnJXc*R-{33$&v{RX;@zVgqN%c@}GSq={g?V#GYY~P8tj5q3$hitQ9y2O`^C-q9inQTr;k2GjH#yO#R z6Pg6&m2J^2ZpX`}zuB$a5XTqS=NR+JVq;si|4Io_v`2-qm-wch3{lYX9AY*e$q_7v z?AY2h1JWs+B-}TXCD=Sr9Lm3%w5PZKMHOGftM4EElCR!3n)F#QwE3)XBcHnRO);4c z^+HGS*qE^^X3Yulic7YWc_!?x-0=e)|C+ffptZed(rytaPmh+&P#8~)A#b#TH< z&Jr1XkmIta{lV4_QMQi|G#`Rh{`k6gKdq5~IBcXSZ%^Q9%(OEPhEIWOmZkt{a^@|M zfDK7MAkbm|99vUx!)ejPdJEb(XS+}N_fS?Nu+*Ek5?8;lCv}f236M7E)#_a_LdhBDO3R0CH($ceIZCs zh7vNB0g+k6A>T|<6k+YdoRK${z$4IfQy#yT>DXlLs)FTcjJ5ppQ4Gd1TyED;P%41?=nk)MOD$5V1PZ zLy&~%_HLVU$Qa@%3*v>5(~>+_XV(+B5NJOy;c}hV0gyUp30kK3x!Y)Mc zDA44KHT9x)lwlpsB;tf<+p0L0>KMPr;;76#)oVIW-p_!ohoD1XdaMpo(I-OGWA@`k zfj^!%0)6tPbGoSO^Dzm{)Eu|hfKPz^s4{{i#BJ+HEzy0UC15D|B(iJ-vc)GN`^rlb zsbI%OCbT1Hd?I*0Tu&1=+R>czOgkj`kbjY1FNr@YnH<=<4k89&B1DwcDW{_>nb_jtGRzd>6kXo7geD zx20Pg77rW7Z7)FwArouF`I~1r)hLBKlrPCJ*Y4+4)s$wXY^KPeg?1Oe6tNn zhJ-UzGM3^LI!Mx<`=ruz{l;rz&@Bi$;)4i*#Y&vAllX3^&{0K#^AT&l1zH4l)0iYK zg6vo*tm7DoSzd*nH%!DanfzzKq9ED#$-tg@u~(y+E^<2}F=P=C=Z9!7#$@d@4vA0M2tVrN=5LlBnceM>xD#`g;jS2Fu2MBw*p24Yd0{@VSXF{gPQEKx#JPvTQ}HE#1OB*=6ULSjvVc=Iu# zggaR!RwVCO8+5@zWWkBH80MAjK8g6UCBe$DIv#x9^v+gq9l5#)n#AvBqG zBSD|~Mh}x;JbH;fs~PZajB_bGVRa5evSJS9gWB?g#SeKA6dZqpjyMm}5Ti04ljl6- zYDw(x2fjE1zv%KyczczDEQ(t{jK>b7M%7$%yxR7JNO`p`d03lnKiRshwe+Gq2RYHz zG_&HMUOV)9JNjo&qomh>_|P&)WC_e+=0c%W=d0EPD4*C1?DEP}ECfpuFTs59I#AWg z#A40~v($GndJz)&^43IzIj4y)O4e@H+^e8Scm~F|ZVLH`_pa^YrlD?YevB@a+ zY(%orLc?(ESzg#t+<{M3e3}#a^f1EaoIt(>6Y(`xN!RSgJOz-r#gzyr{+Z_BfM;BD zSINlm7@zX5rm>31V);{7ec?q34MDWYVo!CfO%O|z6R48U#!s-mO|YPsw3H2_Cw+AY z)(#BPMYMYyfF!2|oa8kxHORD^jIZHB6hbBONgH#M5Qrkp@?!g%8!$cc-C~i9bZJc} z2bno*I%LOk?D??=1E$*TS=-dQ4$p}{C5vq4kmO8ObfXabaHU>YjmBzi{#qP-F%Pw0 zv2R@QMKu+KOO1yk9&TkYb>&x0y7}rGhlMYpIK#5 z$kvUg!i)6LCr1&XU*W}XNnj@gU?&RcO#4m<86{+p(S(s$Y^=0j1fIArd!Hp?rlfoi zIy2Wdy;$NR!eReD+xE_Z^eH#&dp-eC zu3?CC%XsZNXDTva9a(g&jUt;(_H~hL4K4X5v$3?72rKYbgl0q*5b{uK1tUn%DKj#n^(;MBF(t{iSOcyx~~w3DvKf2%6zbTTEfZs;kht0Iy%V%oQkZJ zR=SC6q&Ii21rGp27pdyu)z6wpR%Y0DF!?Z=lWLK5ETG8qyv~~UQuF4fQSlC=ITl%3 zzj|_>{OIVJi?TQTBvn3oF`@Pj+Agfi3#&5k$S8|+q66OD9E)w!l}Lg6xDv#kt?ox=DIBnO}hcm z(GR#TL{UEY!_ac1O+$7rAbfx;ST;3c<7i>B&(xY#J=;E(BujUzua?}>W0Gf(x`MHv z)WM>qM=FWIojY|H3480Rg~S7Wz-Lk|mX8EC6NC=UZ#~ePq%9uY zLVW!Igo}W(HbCt5Z*{6xiK&uW9 z#qBqG&7|+vvI&!d3@HXUNk6UteC-(xKk<{c%rNl<6S+qx#g5lwD=Yt1}eI zpkZkHc+ZU|8d%z*hi!F1P+rBPEazH>u0M3PZFq>fR4%DAi(&G}Tsvs!Gpm4FNgBW5TF#MSG9TMgOwE|5hknAW(y6(JV111vuNOb2^2_jDPg5z~ zI6zYCi^|M#nz|8v))G1%trsVlLkxFO)Lz2#%b@BGXVhJ#*>VPYPr@~Q0V++?U0{YH< zNL}oTg+~*L9@ORu7G-Y!zK~?jnDEHK8I#7%g)D5M`t$cN>7v62{&X}i4Y3S8(CR9j;%}>Aahg~XZ%+jLL$!nr~ z=Fvt~eAB5Jt`&6hPa`s>_@U42wtb{|<Y&Vpp4)6B=zmO=E-7k!}(~AhU-LoD!g*@ER;`MAhyh+#F;WS?vZ33 zb@b{2;gy%&$mtMS9Jq4ST^AZ-dw3xxb>%gTBXX*3-9R};$e(Bz-{IA^oKl&6=b;}@ zHwT!8gNBYupKNEZ!?s1~5r??Z1DPIBEonZh!KRn7#f+w`)e)esch;w;v$syWxuD+3 ziI__@y?p4TsHc!^E+bV{iTEC5goO4x!9gWz1CexIm)UPpi!sNK7>~ED1zvP@be8C_ zVXkWJb$d?5v)o{M>C@}LXgt|L0wkmFxTyNXenc?j(i>yeUQ;LXJT^VNT~j02v=N{? zw=7u0`gK{DC(~>Un1VT34V^updE5|+dIHkiF-fa2>dh(+onONsE69G`+@4yCIJ$X|`7EXSwA9|b|f z3(4Q-X1L|gFj@~m9sO{Dw2O~-#cdNYuuV99w=%Q?Niy+tC9*v@$&qDR!+O|8=l1ZA zuF1WCoJaL*8Ra2+M9s`c#kZVz*b+-}j95q|cftts$A>*oe||hqLN!~uHot#5B}X5A0aKu9e7Hkn^OTZ|ohL`In53R7t=lnYRyNXvy7ma6OzUOzLr8 zBG9ZSzSo#`+6XMKqjJU{t0i;9f#0{|qN98>)rcCh-i4vARh`| z-bUqd!O{cgWTd4*C1F;rbi%YbHLnvarJ!bfH=MP>AL1ktt6~a=+q#&OCn!yQYL{cF zc|&0k{;@$e9E1OGr}FSYV7kh~xk!k4+r!Yi-iEfd1Enm7iI3)2aWpWSv_VSm+K43w zJFpmDFRE}RDFDFKab_J`gbF!hW8BDaDu(JZ7~hXaE1pr(?;^pZd1+wahWiV8T3*gs3gjfgS7R5Yck2STzR3ECG}LG7_-$hF+w|Bv z2zpC8%1u0RiBG;8GA%yUb|NvucPrJZ$-1ev&ql?m$vO%M#&$Y8FNtW7XE&|r+m|vd zd4383SAw$ZlXK`R8lKknCAW)`i`qQ<4Nt`>l~Bq;vaE4Rx>~ze96IcpA>_f~lC~6u z>!>+GCS0xg5;vvVX5-lF$f*^9JHJ)C4krRb9u}ot4yla9*L9SV$~~$0P6R^?k>jf0 z+4k%_ZW{6{UijjCP9GdTl>jRLYQ5&H#|EBmVH0G6&2<7NJICaJvSqv$+is|*R`_(y zq_Y%1StJwwhU)+VO`a2LZEgat$-2`7pT$|!YGtVe=G@X4;d2Q(KPFeHC|efhLE;|t*Z zRRUxdm0Z+`bY`6PQI4~w=E@(W_`Y^@RNN%;(itDkqXapp**6w_XOkLc&3PNvn?vKu zR^)YK`B2tkC09I+aSfkGc`gB@UX7t?n6>sva8k`!%$*;_y>7Xm*Z^(-L=aVUU~fmH=AkiK)lSA%zbxLbMo?_2V@H z`amKd>8u=Loe+M+T4hk_#nW|8v_N%oNC}*CQ@E+N$%}HV=z4mQtJ*nkc4?Sm^?C4D zTVhkj;XsI&d^jJ{5L~XambOd#cJ$oV*E4#Q?(;0 z0Z)Dhfu46!># z{%>VCz#n772A(rT&D>g^Hll^Z`(3KTN?SR$7QgubU3kmWr`cVppe3dUn6UX3kbB)1O#2IGwu%GUoBR~9pE zd_hsumbcExU9-YkZl|_Eoxk$NB5}5LUOt&}3Nl~n=U=H|tUha$@AXaml{#@4J-O(> z9=|$r{h+4bsKsQB*0Z&o>x zC*CCFHNz)Mvazp>llvz*N+?l|H9zO^jIcM8chxg}4_nqH*I&6452J&HVIP?nhv(CI zDvEKE5+9{b#uhl;X)MCGm;Ffx&gA-1yKJy)^F*evac*@Z- zA4OtZ!@}Y_=Z<`YPUk}c;_EUo&7a4_7^oE`ZmnbI8cVeBh;QhQY&Res1uYX_@z%UH!DL>7^nu`89(g)?V4=cxV;dIdbUScq!qjq%RgLWn+I} z7;9m57*XLnhzFv6Me@Abm*lPfs2me%`P4dcg@mUbZU4&}V=9UItiLV?>DUiF9<@ZF zM=rR}XNQdMu`@m)oErcgu01?NUXa!RNT10WuGTw2atzq0B`8257=vHnRiDZW%3S1) zbq}o7#WY+GsN9oRV?Gw z+Ul;gx-N)oG7e<5!lR)yw2Um{8d}siBePWv^8TP7<-(rq>&3Vv$uRiul#47)TI(3= z5<303P!LT&64aTmda#kz9T4NnE97Wl9T6PR|GD0fSy zXc$u7J76d4@O`tY6X*&4$d!6lx2vZb=h=hyL#4i-TXJoYPNboeZtNmLO_=LGU-W=^ z5h3gHwC`cetbE!`uxuT*-8^+P97VTQME%(OO4KnW0*$8M@1Qu+G4z=2(35CFr$=_0 zEJQiFdUlOwyzGZH=n*zGJm;^Uc40z|@B9L$QCn`4sx$nmM^W8~hTwJd5HU;dO;S9$ z`hly}tn)#or1PK zvHWyYz8ZNQRiAteuT$qoH2igLYZKpW+pi!y15uAP&JXU5Y?sE~wNP;&YDXg%phxtz z1{rUEeI`n0$-EZbUx%8or|fFpr|M@FlDr&zl(NTz!%t~Cdk7EtAx@u~54FRRCN|l! z>p6ndrS21?%{9J?w=LbKTbHcM)zY#aX5TYHAQB9hPc{8B!Z>qyF{R8U8owsaux$@TkK--oP1iGl+M7s!(4klN zhM_Rsy7U>!{M-76eBS^+1ohdD7?WYFjXt1a^(nniP^3kRlNW7voIt7{K!_czmmr%7 zUFui&OOvnD;(Z~~>Yz1Pb_pMTMrUQssr?}v8fBB(?p+A__RhD$nVQc;>i{ci7-xit z{EPLGN%>^=!$D+&+_|gI%}`c05!klf4Kf!i1Eot9^a4y{zurKLy=;&wDl zHEwfFXFSH~g;;AU{ggw4%eLxlxr>!KCf*v4hpO{xl=>QG#Xy_?OitNx63|$8(g)+R zFB|9pV11EoY?ZD2W5Wj*^!;h3_3~AlKsoLFG!_($*C(wzDReH>Nv(%2-YQteqz<)2 zmo-fpPTjA0L||{uFOM`%xKRkpXOneu;v#pBV(g&RX-L-7X14`0!Fn#rhGV!XXEj|r zcT>)Tt>?DEAl8F&NKxg`{Nl9cnyNTPc53aYj^HdzN(^WCY|FW+^HHs1;6o?(Iq7Ki zr%U7}@vYXCOt_|1JYD7bTR+&sGLs3g#EF0xOr({qwdepbvpOGB_y_1kU?Vx0#B+%H#G z0%^-fUbCt957&nrAa@A5X;J>#J;|%Ya-WPdKbNVNpM?qo-q#~MCkELJMdoxGemd;Wd26(J>OKiA z@_f+x)x(O&0{6~FKVaLQO)TSd%CY8=ry-x~nx4GqqRa3JvS0hlen-ZLN}QRQ5%EUO zMwT0bT=yw>vrQ%evbN8fln++<0;aRDu6eakt6=lj^0vP;Ec>Q|se^vW`t{9gGvk!d zFq?FEofIJBqj9%$ZIZIt^!KsEv~w!5S8>F!X4}}>K*%ZcP(PWB;kwa5)^WDz;(o!{kN7;!KR^opAKAt6XyXR9n96$NIvd<0LXqi>>C7bISFSqK(fO9j$Fg8>{D> zmYRxLx3-YyOlRu^>c-*R+B~&a@|IN&-iR&F17GN&AufZZPjh-@ZV=>9h@2t8saie$5-1O1%ywXIOW^bL&;~(^oI4Ng=jsu;As(JPb=!$@<$8N zlOHe<^lcG$Sl+4-eayU+J))D9?Pe!xv&g!->6Bwq$Mwag#v!slq17MSK;-I38l8w_S}RZLn{Lu zF|PWMYo>%VXZg|+ODwn=1AU`u+qi6&xpI^cJLHi4*l+Sa;{G1*_mKyOSE@A#-m z`bdBF@7Rg*;GPB zr53Pjt5c3Qb>5JR&oSh9`*qGSsD2pPhauK=W2lzcxiA1|#xFX~q^qd@-I6`k>2S>V|&uI+0G- zL5^Fx!kDi-+ejwlEhcf!(DMG#$YbXyzunD^xYP)FZY+{#q;Bn)Cx2RtQtzYL^z#!Z zwv7whlyhW!=PI4A6EICzxb&Jlha4rZQ>(FKl+JT!U6SXle+X}kbi~U_XWPXWDF54I za49p+X;uran5>)Fs#E%DN6Kt(f8cZi-}z|==$!v%@4DFrZM9;W4M=1_^BQQ_oV{V2 z)a>kEj5XLgW|H-pt}&cw@ZMy!oZPnzgUl70P!kEedC8MR)LcZ@xwt2p>>7?fdkuIw z@U?}{2dtA`T=U>cr&D6`)%mb2DI*VM6Lnda;dQNpS~VZtI>`g)_-p-!v%P-0fA*9- zQ*?0Llk$>fLVl>!bQEk%x{WcMJF+~LkFkv8i5`o5%cA-cp>G20@}WypTBNoUL`lC{Mjdj zgnY7X`Ox>T#P!1rr5!GE0i$Z)tIGA2OPe)gTZ7fs#8o#Lcfe(B;oO%WAZ=cgYMtnX z$YR+8$+4z?H2&vwcmO0X>2sanTe(#p_=3X^vFVdEDIp{ZFRw}mNnAU7H}uzA(x2Bu zay}2glk1ap&fQ}IgS~!eaAADbF-J*1TYO;AU5kqCakbdsT?4RLA1F6#wNfP#nLU=@ z3=5M;p}^WM*9>-Ob6vtiwn`j79smMqlw0l`8PlKG$`9+s^Cx}&9e{?RA`!uUJum6E zHN6Cd%E&%*a$H&gz_=q4pKRqU&hzK_rA<(qTVDf+z_?G2DRNAS z^7UWj`;&-2hRytt(bq`cc*`G}vn;VZ2BQjm#Y$WSujn zvd=rY5Xym!3u%sm@`76Zh|#3&+GGz(b@r{Lrk#zth4s1-L++_f>iC|}L&>yrTx~!) zhWFg09CeTE9z^eG2CaQ?s=<+UkLY_K#WO)8lPATLDIF2OGINtKLv~fTRf3E*EUp}IXf_9QT7?fRQa4Xc_hWcPZ&dUrfxTeRApUYTHkl| zJUl$~jd!=rZSwBuWRna`>ejF+>*>D7molGm*34jyYdZQppY>|g@oJ2#F4hxpen9X0G}}?P zK6+%4O}cDS#tA_R-8SDzJw>m9yzcu@b^2Y#(B(E^+#EVTNbJ-!1th-Mw9}!$S>}cj zN#PKPtjpGj)`#F*F7VdzV3B>EDrg{3nTyE6&WrlGe*FZJ=nhxZ@AZc6+98nMt0pv!C_ssGo=^*Km^U zx;Y;D?+Cv7LpSm-S>J1Chg?9L)T!00>3VL6o-oL|)+2_Ht&5Kim|e*C8u-rXkOkfo zo0?sk^m2hp`9NK74DfpO_sce3&J+BZdP$3{Zy?%rkD~l~M&Gs-LkGb#zGMzgOaDPg zPhNg!QSSuuMZUt+&U#g-i7yIiiQyOa#k(tZW0$ z_)so*J!VuML*`~gAV#;+|L87O`Cm^CmW{xv_E|C zk+-v$$qCz9hcl2zxu&fm&t)*7= zi2+^w2n5!@9wlb^#m05VL6L9Ju1nR6-vBVK$}jVPC%@u#v^TkQa}6^CS$_jD(JMdE zr$aCE?CLHRwdi8mHVLdBTHMK6+XkL7mI~tEtxpF!P}!fr#*h`J?x?LOTq`AO>mHrw zM)Ld>yyU8HTNAF6_(CuhCa*nIU{heC*Yz8t)+{#3IF3Vb^zwo#bdI8Oo2v~p8XF#0_2g^xVsEs47keg9Mjnpx$e2VhUpq#u`#gP|d zu@qgt9FKZBua@T!N1mD1PzKqbI^{txYAl_hiyQFb+)c#tzW*gdu)`)nM> z*n+7VW_}uj+BUa2_PX!jFoifVflV)OwrJoWj;>g1fiMQ_ezwx5Io*R4Z zxn~^oxu3;q?7`5=$E3-VGjB;JYr?L$@Raz$&yI|{7q0e$_~??kal%o*j6a=tmi$I6 zTX1Xq{>UH3Z;$;~ELpWy57~Ot;qg*u>d^ZHn)<6{49;5)Mi`F)Mr|SH$?A@*vvVkG^B2aa$8&ZGlN%rPlIQyo?XBhdwnGX8!B7Aqa zir0vc&Kr5h_W&Y4h`1gi`%%9^I)5dohOxNL#<%hHa#5UCFE@p=q|b}oZ5K%J0^dv3HeJ%N_n>P}Md*tlk25Dp zKbdF_qw#bKvkoD_o|oqXVFk#2VrbXKyKY{dtEyYuA|U4_ny^j`%6-Dn^4ZAU=A#27 zh;x7R_@#$;=g^!X?D^!U@5I&`-A>ny#Rp_X+L+^OJxHO)-uzo;|%OPU(?hkWLac>4I52W~NO+VZtnd*sNMXE*0F(WA)&0c&JDsqhS6#9 zF?5jDy?#f%i$S*e9U!$@#Bf<8+K4r)m&Xo!yfMzbW>);`xL?F0rp}Mw|M)BM>2Dt& zs|4TykWW>|R;`NVD_6v*9Q$hs+JTm>SQ;xwN9!SWZLD0rEY^&U`+;w4bX6={wnEZD ztX{b+makqTU+cvx`B*cy)?de9^O!bmMy$WV3=bZ=sltqpu89>Zgc~3DYY*f)Nin60 z)vH#Lo*v`l!pJ{6<9$%YcKfj8n>!rnHBGVvqBSw(K zOw;3{^(TK|a5jX+0vKJpZtk+_~Mm~ zc?dai+=CZKZn;W}$^q8-0Iy?c;MVU-Cy;cgb=bVi&nF4+$DI@&DOq(|G2&!XX(k36 z#m`MftDBJ0Q~!KdoKTZ(k!S63WB>KeIjK2^#M7;MLOyrcq|CDP!V%l^KwmFda?JS^ zu3~p2QPxU~a-^I&jI4S7vxI;ELm7*{*N}elvxx%Km_emfUch;-kzgY!H3B5w|G^1j zb-Pc=i}Dj5bAF{PMOjC6NRhr?-P(p%<9RkjAjCykH<8D{k=+VqjymR=z;CBW|Aimc zn_O~)O$X&~5QYNy%rpC3PvAWk)`FcSCWqB*)ng5*9=!aCo#hp^a%$_oE1_$R+Y&Tf z_Ux9vbLt|dZ%mAn-axg6dpwLmJ*JKtkazi}X`b4B26>kPYkHW0$sa&fjP$_?+0d`Y ztyi17N}~==_#BQT^%$$B@E2U#>blNlLTEANX1GN?oUt+4hIUhZ&8jGNg5kdv> zH7>%&@zqwwI%h7pvP61H)9!b^j$Dr%XU0+M=Op6ugRnf}-}w<&e0q19ASTX3@~#i| z60&wPvO0*_AN=eh8wW^T+E>z5J9NaP_C#=AqQs(BUs%TzRmSG33MTlhlUlIFd;ie@ zY|WfgkBX7|vVR=IJcF&;70l!s0H{1@JT~HbGqQQvWHtI^oeAd<4)9ZTWm?2L(;>J+ zcQO~CFzqmjG4BLA>5wdk@IV;3F4?fSP!?;-v<+gbO{d2bciStz^_{QAlOM5Job|8c zV%FR>F}`$8{QR4rjn}^7Me(BNzbM{zzz5^P*^6Sz_}uv58(tZ2JLs#iL<73Nl|d%yjVIP&Wsil*k2k;i-sos`EShsqj82*sn{BaaY_`e9 z@yN&Q7%zSK^JBvi&B=;+@q;gZEME1J=f}%l_Nw^O5B?ZSmoJKMfBHjl=CuoB%F;XH zy{~;yeC~Tk#G!}(AV&4Df7vO&h<#u3=D6|p+v1Z4?jMJI^B1b?+W6@~?~Hw4zkmGT z+uw@UzWhb;vX{Rq{&@OKf9gECWKR6#ONYe1FMdJ1X1}+`K?fcXFMaj?arU)yW99r= zarmJJ#y)$$AohCRi{snJoTi6;29gWi7dwkjgXtEFC@+TO+e0ZM_KShn8f_1$S?ol3 zvEvuHPR-hwnixvxhef??ic=W*t@N^Alwm4EyCDB^r(E-GQ1zW$`Xdh~RQgK0sVhwB z9Ro_n79K2ZNei0)MSOOL!t~@ns_1+rrDjNWTkFVYooM+a26OwfqU>4&PAA6M#?pN+ z&iK}F=BRmSO5D0|*>%5oqs`Y9PPxIB`)sOHWO&oJyN;-(-{?@i1V&?q}ZcxhLtUCRZ7tZZ#GTruyaAK6r`u(n0Taq_&4oWOdt# zpG*`+DduAKewm=I4uvwoPjKBx0%XHaxUzv@-IZZ#$+^W6;jkLx$gA^{bwrMy`7-Z8 z>!`UTSJ$${CG{Ed4N*V&Z~&{eTL+1wYptPtnpLxrCgKx77dh7~F}uEw_QyVXHe>Sq zmmd>rptlY)pXBYw2X(S2$JPL%_DN>qYSz@DPwZARmq@M8%^bTlOtBZft?ZXi+DqlL zv2CLM45JoJvx@n|;OJ2>T-ZC#Xg?NgPi9Cka4yPaik zd~Lm1Y4Jp#-I{9SmJ&TH1fS-cK`MHb7|5!+R_LVP>Wdl6N|V`O6e)P1si^QfWo0@fzK$(j@#$Xi)${wCYG*U5f@*4OKkX%ZDN}(Hj4T4 z?~6HCoDuW4+&y0PqTOQVx&Mx1j{m1hI;G8txQGi*{CRxtt3Qg7N9-P7`qCF-!~3s| zFMjO3anam}@zu*>!$&+NKK zef*@j>5gT3Ky9N>Vr;wY{hHWuvxxJK`&qnhzXReYfB07{Qz=G-`qPgNkDvYd!g%HT z4vY7`?iq37kG~K{oqb!p@qqWo&X3$EVxw*1y$63G_Iu^a;w`Uvc}!h97EgHU|HNlL zcW`Vtz9jCu_nw%yaEYQ!ie-xy#T_@#j4SS38E<{_Ya$lk5{@R#x-~5QF>&2_9$AXImsO6`!=#oa$G5jWJIt8G=Lf&wnq5+6lk=Xrr6eh(IiH;rUp-74smCT= zKHBALBDFkI<8!7~)U47DdGkP>hPt7?D&~G`JDiNt#}LmvG+*tE9G(MR_gffI)(nKL zE#Q?hNWFr)hAuvQ?&V1Z5V=O_luiZDJQ}rn;){InlUGj?_Ld1^yBv_HVbb0qeDqfh z@?pt)k9DUzIhhyp-T zdrUYspQJsY*AwL%CIwT=J01r`22V@Bhwn%UWKmGtt7Pi&SWYWP%?wN<@)-=qW1O!~ zj7*D3^KXtn{`;bM#O^PR!#;grylTI9$A{jsZ`^X(`Ek}&_r{C%-8)t+xIJ#Z<>t8b z%A4Z_&)GBP-*bIjdHzLl%gRAK^VxgGW*g|8qZZfdEq9GizH7hu@PY4$hiyJN?wxyA ztQyS=HNW#ah<}}QMvQN^Lmd3M&&SJO_KG;4K4klN{%%ih6COk&)(tDv2@;?STT1_{OzQRV$;X(9-sN_C*##`d~dwtfA@;D<65Aa zv*{ab7*plzvUC3vt2cghylU?~a|q0q=Pl>1O?{iaHk;hA;k-n|akKI&z+5tPUjBBK z?*qFBG}wbeK%Kp zLPwvoPOO)dNbi$)4?=u)bqsT}-hE=zRST$x@poeF0=&-PjDf)PKW#`Z{lTYiFfBJ6 zI3^dDbJHP6>Q!4OkhZRgUaS|}0$0<8hrpAUrPv_M9(_3fmWo>8r}6@mnSkMd@=Q({ zvEjX}a_w3QL>OGAI%T?kI({7=_Je_mtl;xt{dg*6Xsp=$@HKs~Q#7B+G^}toOdc$C z1Ym5Dc{{{N0(^-0bvvIPW)(!jc}xNfV<+)&lJhW>rCnazSqmFCrE>xd-ea&~Dl$I_ z;1P?+JtHdyDr=DFY`iTT%Th3HTp}R;RNBz;p^mk+uDU5;GEE3_41A@|KI~6CO~KM- z=Hi@XpE+t}&}L9k8u_2`(hE8Ne3(C(E;Si}%1^<`NnWHxZwZTyT=dHMRQ-)}Ap7t* zU}-@*zAz-^HGxknJvPTdDpA%MBEQ}rtx5^fS~bZf(j6LMG8QwMe%hPKhOOPMv&rZg z7ls}t$ky||j6AIxCdW^HbdcdY{WuOk>M)It@6h-a&)!Z~&Mel6bz)Z-xo8N{^3U_N z40T9`n5{i+eNK{twrpH0bR0HKAKkr9ue1jO7MLYPSuN(&I*$RID`0yFR9YE?!Zs~F zDC@0iHpwSEdxa8fP4f1s#$yJYc_YMs8%JmAUrU&)qvZw_*9oL!Kcrwf{L41xgBA?e zN8{;c(<2l*7=(GXh5i2}Uq7DY%D1RQoeY2cnt8HXzB7FPy|d%mS$D_gTW%LyZ?RFV z8Xt=(GiJo(5yNBZl<8WqgIK+4MLgn3d&D*)E8>!?E{s`sjKv$?{`y!m@4h%k4}Ig4 zHi;+iyn`MtM-@vizOx}38tg(-=)vJRD>uwEF46Sx`m>)G?>*>{c-;%05@TzZ$0!fA zinVqv9wOGPS>v?5U`5oFh}laTA>Nu%acg2~{ZZf~<+^xmJZ5aTNlc%X8S+PmB)fX$ zXuR~jUy85k&B?~gXT?Vkcw-#+g`av+_#zW|80H>?P!yoj61y&Xc=;uCs3%UY8FxFP z+l_0T1cq^v`s%F5I?e=G$HkB&MBc_~-dwir8fY?@p)YZrLiAsQK&7Y#s7d|gJ4ugv z&XixPk(*}MAnHu?Fsw3i_%_BNSz70$#13)I7V67QQa;$cO%%1PCa%*)>ux@NL$Z!f z2vORv>*YbfjUFsuQRi z;HF;G&$CDWJyzUZ%3Tj3))pmPt(J+%97=mr0YGJu4x{s*f4N_v0WqpB& zuMw<^GqB%wG;s$(&3tquLF;ET!K-QAuPs1G`k@-XuH5uMa}i_cAz^#CzDYO#eZBDg zJ)rrrr03RsPCZ$pCT@FyKQKwQlR*z|jS&k+hDZb*P^6 zhH-0c^vV4uti{%q&dkt)E)XOWA`c-Qq3`^NvOf`+eso^f-u-ojNe__r1hCHQ0igCK zC&%CAUd%daB}ry%2X1bA0uj9l#pbrA;%JKt-ni@N#sMG4vk>KjYSWoYgR3Z+wNHyS6*;x zeBgZ_i7W0|8Snh)LGhT!?i|m0!Xx6g3(tr@{^h*5>Du$-n7{u!9{PkGW0%Km7u#(2 z#CY0H4~^4~`c*93Vu#rM`LB$pZ@M7<@wby>>NZb^r|htmo|$>j9Bwgg`(x0Gyw%+wQzAjy~p(F?Vcwyl|gAV)kWM#MtBwV}~a`E|%PUdEC83 z52Azd*!39RKRYS-<^WeD~;o#ErM# z8}k=0ie<}J#Iy}Iify-hLOfxIZDQfV1+mrkPm4Fd`AxCw&b!64U$ART)@C$g{f%Sw z!g+D!l~=_w`PyU)J@k$Y;@-P&j%)5%9OEOr<;Z#RlnIj~YK9fp+ zVB9S{fHp=cEX%I>^a*6>mvQ^o+bBJ5`f6=h395D1!m`uR`Pa!~b0@L(B)|N@QqEUl z64K>^Ao;Ab<0Et(u_qsZkYwsp*Y-bnLHP*`a_lk&M}9i#+0yv1RqI11>pE>7lBWyB zwN^ICSXMut3u2-J58)-(2_ETr6qQ@@fN|I63(EgwL%ygLf+|wxptE%T1gF*&RH=9V zJciPHF4c7o>B_cH7qdH6gPI)lvOk?{XCFxE^n8?&Eyxd1%bNqW&TT%K+eB3;&iECO z7~s>6z!v)OI#i1YqDlMgB@aM9m}zfr8o76_Tn-)+7`0wyFgmd^TW)D7GA?toueMVr1{u93>%RXfyw_Agvv!H~HDGDl`4d}fhSc@suf>48 z{(Qf}XUaJ;uk7S?Q}G)@WAQ&>3aj8wvyw<(*yyahy_(6Ng^4f5X=K(1F?gE;;YFwX zw!FMki1C`JSdgy|0HUlbhCIb6A{oC@?Qti7F@Q#%<4LrLoKPu#=gWs@ zsO#o_f^SKcR}DpkKbu#Zk%$1skysGTpL{r^=Y;iwFElMbUb!wDt6`+_Uypl40{`M$s+)CKS!n_!R28Qv{kehzs?T>t%i#vAU+DWpO2L`TZA+r)G z_nA7F(x3gP0o|T6Ag|@(p`NNph7`pU?0$E$v!uR@BwrMafCo}Wiw|{kp=eu^46AYe zg^Q)j;-XW36MOIel-TzT?~XZB9u*(`(huTYd+%t>dq4e!*!wA)$G1NA#(3e&-W1m^ z**FgS@)u&KZD&Nx*dn%n{3GIqtFMhMAG1TOFZ@nV*)C>Yd1Y+z=-uLBQ~4IdXe?eZ zFBU9ZEUjXWt%*eo7RKWHm&NG#cr0DKFy_x&5UZqn#oIp=Z+^ud@s}TcGWOi#*>TcU zOXD4%{ARr15gWyB&wEj9Ja%V%^ewN8pPzn1OdVew^W<~tmOI2d-~09$n{!dTdEftu zAN=L|*mTpexNkwmYa0%ewBh<|# zT^_n#eC2(wji>JVwD`bb-;ev2u8bJjI9~Dcm&VAV8{-47c|rW*tUKbNPue}6_pF`b z(tjKguX^bl;@&mWV(FpBj#B(!g+LXBLU%!rh_IgI_{;dCrc^mB#2fgR5jKFi4M~)@e z0P~vtTq9~r-yNxRr!8(1>jOEg&t=;>jncF*tQo!NG+Qh1OKuI7)E2klmWa9l5A>B5 zMV6(#k?JBzI32KRoK~UhyrFyOdV;`aEc*@cu3m%wlBZZL1mJDdX%`N?+&=n-ZFcMB*=`h{UW+ko!RBEZZM$QNTw}XYJd0(~u=FrZ zK*{K3AL?+-hr}&MaI_$OG#xGe%P{MMed>A^rBk#tPLg3mG|HIGW=I)d@*0opR(-e} zTiQcz{geLet8D0J9_YT)2}j$_KkDR6o)cu{AhG0@qt6I=;1dpC zo!of{2}{$}(IWe8a{@7@T-)VK;N+WCQu`oc0(qPnyRD@O>s6%qgTZn=VEyBo`SIk( zY!h2;GQjx zPy*wtSH(ibJ{o)1lW7XJt zvDxOE#?l4%#oDPG#zVH)MEbR{Xufo#gV<#A&0}=wf>=5>IUc_CmKuY`!Pxk6%=l<5 zS+qD-kB$ZZrt}Q?-(;g1F;Kzy_nB8MUmA<`CSrViy_mNC2C>=38@N^@ioHNNuUx$* zHr{fZ*m%a|SiN$2EL^li{-?x49=e(0&yAR}K|Ey3P2&D}_r>zjh|RX#GGNR7r-uR06u^!_8aLJ1J`R|X3r*Ato<}SS7^Rd3_ys6^*)783p zapwP^=f=k(N5DI7W|gIj+;22pFHfm;`DvL1ss(k(g^iyC8mA*hcth0|3qBPamW#*l zLg{$geOTb$#+bL-_=ARGFD#sKAHj=!+MmxxnvVcJTOG{c*V)qzQ~`J zarpsNesL{3Z1Q`r)Pfk=(U5`V z2Os>1H;MNrCu*G+;}GA}5cy-^vAWo~Ca9z5Phi?)@RxXe@ixW@NyoKdJW%Xw448SW zlH)%8wU)T58@Pn$T&VR}&B2Ov*tjK z!F74z6(6h}$1DsvfWaTe>Wa<%!@0ATr>ucRXUGVGGRQf!aHsqcFKH`xQH>aE_nEmiCX&dCk$C|jrpNQ_!^2R zJ&xmpb=$3z(%J`kh>^Wm=RpACt~Y`|gcvXqjX^9m%ej_q+2GeTz}~s&aH5G%dm5ah zOqu^<6*TyebIj?IsaYHK*Bs6TSI*>{4`aji;q~MMH5clmwH@vfY8)w980ci@366@ArI{L+-V?CMCx)ZBw{G8kNW-=s}r?b$8t_$ zhqWdr;oV*9f8H0m{^mPk^0aC3*hfDm#@3GKIP~(hk26}2iLbt{7dPC!D5gzDFXEy3 z?|Nw7RS(Tu>Y0D+q2yrs=iXYMMEUoRp)vo#o9wE;R__S>pPtBm zY)q?^1e6c|*$2ch_#QECSmgY>$Ck@?yHVOFHX0;;JU;OtNAYQ=jDu9tH#o=-dh(Hr zj2QXFZTms4!?l+n|1E0dYc;95m>IW%AX}@4Zg0B!8COjHO=;qfjj^@lc){_Fk!wyp zI(~W54YAXc9vwGba$1~t@`drr4}Lv9f6#uhfsBk74oe>9{l7<%KRQxTk45L2OW+4f zjo0%8u4)b;VMA{ZevHK!)hPeSB(V+0$;(4Bq`au5A1c{^L1y5r5k8v_++*dwe3PuO z5<5>5AiU7nT8u+fG~uWl=mDEZUDcWirKVQ>b`d!?e)(Zs6sV1li%mIDMS}U)qQ3Bn zp|N5s-g(#c;0)}ma@MOo_-7hvn=z!9zv?En#HGy}ls!rhh}q1V zT{Yg~%E%AWW-X-5w&&z|f#r~UN3VHk_03?!rSZuf*9+eBWkv@ZbLQ9Orhab5=;RUJsQU5Vc+r z#P=A>Q*>z7cx<+F&5# z+Bg&An1<*iXG+yRJ?B6aD}4&bT2%}lvb|%K-*!z%i?o|BlFz!)w?uKMuX^&qn>wV# zBvkGpT$^gJsQCVO$F&|=PZ_toB|wxhJs#Euc^a2({^%qVzd>mEW{M(VOWr(s9&7_h zV|3n`FLB#wyZKj>`w4?ZYnWTeZ(3b1Vxi-NB4x07pTIt6yKMs=reJL<^Mflf9;*i~ zOy=Zk+CDLn7mR(ckj``59F=pAOO59MUcRlzsf5UVy@~8cbuuzt<)W6I0mRe#V7~B) z6DeHRggK9lDH*wYURlTK8#fNknK6-=@@e~(zy3r_+&_UNI#mzNkMhH}i9xl*xk&tn@qCCWydIjT>Y-WTl7K-B1RDl` zY}n?}8LUe(Vq(2eCRlh}&IN`6@vlmZa*U4q!Ie*t(YxSaf$HJ5;l}wG+baAKLl2S2 zdAP-n{+cmAFtcdzz=PztKQdR(F|$t`cpiK~I-Z2&K|U=Ph=zW~qLrNj`Zd8u@kYn| z$9uVW$usk1jS!dbS%c?OaBnJ}7|l!bOB}{oNr71_IW^z`85s}!V>(9Hq!05tyugIR zM_%~(W?_6Z-)L;O`Ia&F=8NK}U;Qd>UN}8I{H5>3VISHr)*s0+wD`oy@D!UI)RaFc zM@}Yfe3>p69r<`cdk#wJrkHixq1&O#Bws$~Voz0*q>lA8ktDB0{~#(II`xyPmfSMG zJUBB3N0Yx?w}~}I3cE=}afxqzx1QT|51MNGeSXSs`azUJUk_Gf>-w72$*6kKRhzVK z+bC@~a_#kS9xLPM$y%!)YQVKkryFnQqj%KCMov(+I(qROgCB3kVqD*$4&UC~+IXFu zg~lWndFGO&Hj{GC*a`S-4XHl7kKrOSWyFl!$aZX?kejAci?U+1Yr2tDocWP1^Hsn; z&dzDj=bYyy*D&k0ka#=q>x%EgiiUa7+OW8idu&4;G#r0x{|immUzjBB7Z$jkc9FVuJ)6XH!g znr#=8Yu9)Y*A61R@+V*JaFkzO&c%d0rP*t8i+!eU-QMK!wJ23vWYh!yUQlVHCXZ(O z0BZ7yZOf0IW4L(qGOjv)IB>5D(eccIC3$}E_P^`OT}KRu1BBg+^BX(~GQ*Um4w~q* zVOra#PGV=-YkoRA@6A1|2zWo%gZb_(%5PHR)yhG;R)=c=-#y-E^-JW3U4)F^0u&AZ z-&(lhYtJ51&U5q09NI1!QQC18Llf?gB^$PVT30u0oeO#EaM;ozZ}GF8kZ4E#)`F?u z)=_@jcsUQfB*){nAGj5yAz8OBC4JU!FZ6>v17i%Rj^@k`nq|*JBZ$YK`np#7`FA^;qXvD7?9d z@P^kU$s7nXa*~7`tk1Ze6*|A&(OC5^%5qK~3%R4Oz8iTF@7AwI;sx-#W(l1iS{pl3 z`A!S>VSU11%JFE=0`mspk-NPl{`ikmtr+49s3 z=d|}vHU&p{GEB z0+|l__##i<1h$QmWtDTBV>J;6wOS;8XHKgFRB}*CTHhY95x!N|gnK9x^hF-sVzzeNdkCZ6w3z@nPB#P zRzLrV)bx;%aG^eUCFIK60AJDzXiO^%RDOBc6Ff8LlhodRTfHFAx)?aR~=2)6lf*}TyBoIWL{=d}Uv zq?2r7tr-1yosb~@JTJu8EX$TDMV>n-COD%mpv*KkrdHQJA>nWh9ETshXnoR;^U$nT z%&b?EKU~d);yAX&h+I;f1P*(AdXQDK!Xh?H!@kU7lDvi_VnoULD=Rh-xg}7;;kPW@ z2|ya`kYBVntL-zwU=Ax+?#jqr&#K4m| zt>eI(bgjx7(b1lLu9NYenAB>Got6=*Ka2 z8pf5li=Q;q!DLQ!^SjJY$=s2m;^mDb$t*|t$*St8Nz5}ciF_87zitL(TbwBE%iK`A zHo>GKb1I#9Ntr z(OZ@oaPZUFWhZTDJ6*#UiJ{I7-vS`^9ZJkYQ zt`jcQ4zpBiUGeC7A!`upe6pyC-GUdBTIOLQF;96PAY#6Ze_j#UY0x35)A~KR^U|5td0Ce^ zwl~I!Nor&1uQ-VH+}_N!ap(1u70d`jvTFxXYh04MIxI=1qn01y)Fq}pkL2}-uKMo6 zAsWW;{!Z&xqfR?~;Q&bsnn@>%!m$(qe-aFRi5fnWNPWXp{E62V1~l>q&Rw!^vx)^e z;?YHyG}ldXkE7F$@?im7g%L3iP62m4m-O?GJH%%)u9Y`?`{ax;b!1FkJRf=`2K&NG z-adh|6kj$k=kx{3koKHF)FjLLuqN$Th>2BP)YywBKKw+Yk8_&jos%-2;1e13b3FW^ zApyiSKCioSRjoLmAwuWe;1fBmJQ=Hg(}C5=@3O@c#-Acr?vBe`(G`%^2VHRDSxZLq z>4W`Jd5Ckyg$37SNfp1ktSi?byUqoC)HI_at@pz@4emi`vWA2F-+Bpd8Jw>g$__H;!tR{yV zId073B&C*ME49}NF)YVZ`l3g~tV_>MM>i7b7-j+?d~p^!)t!|gS|jNTZ}MwpGgc={ zmKb#8#!ngx(SkKUnYaJI%{X*ixcV6guQu0R#zO6Tf#VX7v56yYCSxDOX>XDsR+M1r zM=kpa@#v8iLgfA}i2Q@|8me{G?n~(}@wPF`EB*VoQ80yMxOqQ8E*~D6T5NR~r4zN} zY>ekpJsu)N`S&6k5jK`ItVRgN@{G&4?TdWz>pdxBxxVNMm(=Q#I$AzCw1Ej62E@TL zaX{8M6~_zK?#ie7{`8TxLSHA(t6(W;P0Di2%tOWM9j%_83mDRn23L^B=xc?f-LWq) zLnLiVOlDK&dI)cnPVKtL`GACDjK~<5x;o1wZCE>a!PfPFipgr&Kn-iay~IlE=O`<)M?x^pmcpA(at|CvQhOKe5smhBXhYc01 z%dh?Qx?@g70$uZ>MS-4rFLrcZ=l z#+v>eCxhDnE@PH#U24#tzX{m3fXXLl&qFfyU5Jj>?c=(S>*q*2A-@){QD;L<$mPW{|7QqO@e>#|SR*OXe{&thx4UpqAfon|TvY;vID0S&mnJ{!@#ykLQA63P&gz9m+o5$49%_GO&Y==G) zM^&3;pZo{F))I}A&dG4<*)*=?o&O=iG)%a6y*D9k35m;3HViMx?|vYp!x3bjA~mgi zNhxnD0_u2*-8O;YW?)*k8sy3YrTH?W*Np*TGSv>L?}6 zu5l;-|M3GAq<@bhH+*L;5@K~5Kp7d!1GDq3yJt6_qJEuiG8A-Sys2*X-6%?JHj6TUr=iE!V=R|>8_nbO^|t+nyN<);kJV&uxDwa-+jWf z4mP!n!6@_81#O=D@6wX;uZ)>5X*77(m|Civf90FF7OHE9!A;@IK6>9ts3 zn{Cz#N(9EXbnL_yzRv5;$*|Tnb@I#3lxwwg__Q2B_I*u@cN!jR^TWAkD}qlN>T@xd zPo%8hUVWj?&OuOD%gJk3T-er#%3Fp0wk z@-|IubZ+Q_vclWM9?y zzYYOdZS!GWmxJW3Zve8ITg*zFN9(08Fiq!}9CYCDDc)Up9j*cUDbTV=u84h12DbGz zAf9U;CvFni+9de&m9VDE)$U-b8JV_Rync)kb=OXHI}cfde9$S08e}Q2z7nQ>dH`VBY4ZU*sh8n|*nMg}+a_!3RoYaKSEjb!m}9t>{e!L_ zheh77Esk=llq@S#c>iiU8OvI{VXOQ&QCD87U%pw8Pu4_oIR*tW-m>Aiz-1Vui8m*q z)AAhfTO6e5N?tvvKBE++0EIw$zb<2=OTE`XGIA%**8?4^tF@(GY2&158b;)qt&P&# zke+OvkL#~Kxr#Tg4$ke&v=%sFRPUVl7<+3Opv@GcRjRq!A8`UCxN>VXeHc2_27Pl&3%2|{afaV%`_pd*|+bJA-lNhec6j+AG+%qy_ z^W_+7C$7-sTMp@mqv~kt0(OmMRnxS|NXSy!sLi}koo!}`9n*_`xNgNYAdUB?%o|9{ zu*IM{^vlB3&j7DEvgRL}h@Q~)R6`5tByTg6Ga_l5SPh~+!7@rB=K5GEiFfq zkXoNyAI7={>Dd^anD=Ho^sczrh|6m$J(s4IRrx4F?lBcU=d=7-&b5HfUL{gnd$}X` zt`W|84d~#O|kQI|kQHz}%F}Sr_nr;kjBWd_<80xoFbFIpQ+UA~h(hWtFX3bZhWR#04oeYov zMj51iQqz!a$xmDkjrxyE`5xEbKkj+>K36J+)ch&G z{({6JE1HK*q;IBO&BS2VYTF@dyng6wiJFF&Oj7nLLfTZDgeG4k*nADgI%F znjyMJxHc%y&A>hT($NeF-lKKr!Rx6oUV{x@t*?*^z5Y=<>VzXtbO z|2xT0b5~3oxg+CCg0?sJ$?LUpcGC9$iQvc7v=IjO6WqbK-ygf$;1q_)`#Mk}xhE`9Du#ThIN>rZAav<_`HCpLG5Xs~{c& zjC?r_@Tvvz>F33R2gaO!d_zD<3J#XOpnOM}{%EKZJ!b(9e2ohY7eM=lPHX# ztpk&q%tz$OX*&F6-vLE5=}BkgwyV}j$+pSi?WSgwTAE8Jx#vH4&zL0882rb2`H`N8 z`1msm*9=qOLdm|Z!)l4*2XJh3B43ZhkQ$lgWZ(`b9jz5Hm(+@`*KoJ`!i>lPvVuvqkpKB=BJ-8OPkuy&}4yk_gS30+?Fs?!2C2&(*<|RbzDDpxkuL1R1|xwlC$ zZ>7fslWSjC8M8n5Q=Ce@TbDWTG&)8+;}^X8dA zfH&gSwF~85j43{qAAYc|{1Yjj9Ejt7kvdrmcxsTJ!C8(!*?8`;75PIHWC?L(q8dk* z;A-9y(TL0vXN(Tkw)f`LxCQ6E1bG(4Qt!)f*dc&`us1_;mgU!pVcTCF^5?Z>+nPT+ zNq>ZMm9QlWII8MC2X$#db9mNCP;*GIPRO3y(I0+pGx&3iu{E24>Fl8Z+D!M=UhC$cHpHw3n5@W2K zJL;Tw@?p3kNm&VIle{NDTFdlm7Z*MMbbOW}2g=0(&Vtgl;t?HL>b%(-lQBHmUL+Z( z^X~)73(qdxl5gdN0}+$e{P|>D+Hn|VId;SXlH(Ld$ITE!CuJ=r68pEVEf%mjLFCkG z0Hn*smK-#t=zM0C%I_5woY0dED}J^<8e1zY~7|~zdBAf3;JbHpxS=}7whrD319iX_ zB6C4jnBL(EGPX_+m%M!8@zFqOW1adLv-By{ zGSZ=bCv&5IVd>`yS-(q1J{e;hzbM!K&>p`zCb~K~9Qf>eA4+J+u?Ix0=#~sWb^Q#- z4G!OQQjR<0-6o$MsCakn(fuxe>#&wUP0RFI{VLz3aeEE$hUwOjIKM`6a!xsl3s5e6uOOXd#V3z8b9 z2#iJ0(7==r%{|*hg5uqJsVIm=4cIqmBmiO;kFKUzyx;7h#;^5N5W2`*G#a(_>1`XV zUl=<+eCmgOV2P(g$>wG!HUlcI;@Cf9;r$%G4ek8cy;_TeAtoPhpyrPg_+tm+_}6Uw zNR~;7)F)ST$elAez$;K2BfiM7lclxerf=S;mYGPTy>2PN(+F5}O|L?6ACl`pW?ubYrg zmX@z$T8lCtto=;Px zul3O`*7YE7q!5a8OStI zWlh8@hTo|hj~#riAHT!Lo=+d7H(nCPQ**}A|Lq8$O89^NtFe2|a9O$XsV5k|!wkT0 zrN|LZejJH0WpX0&z_k1!7LJAxFd0udfYTySWz(K`@J7=mPn+Zk8@0an91{#V;ZJha z#q+I>x*gsGwmSJxsVE+^T8X>({A$mH!kN z{miqicRaG!_&0BQIq9w;cS*tdq-Bo+d%=EoEzb#kCJk*a+trgf7>m>r94~2R0^mKq{u? zxn8m2{3t481ThE(aoK>5m$Cw?mK2 zd88hn{;hj#WPKJX0LcOwR_YdtH% z`o$g$Jy*6P?a}FA0!@$=-;#rM78A*NHO2@9(oaj!G6oN@G zYW~`bg@ddHW)yv$bRc82Zp$}b4denZ;&#Ek-;snL)`2|L=y0a|+8`Cxl40eCog@X< zNpdmB(i<2%>SX+Tll@nYK^zXa!P!x=rq)+}ys}Vf<9z%pM&%}XK|TNOV56hEIEuPF zU_6G@ip`S_O67&DJn+FVe4+GO>b+RDK;5M7i##k}AhI13E>Lry6a@0@x6mMUd z3nwnXu7AL^6aim$1Lq16ejZvc*iE@g08Pjd)souEs3rz@Vk zZCg2eY)z?t=AK>u>YcdYIQWsm`J}`LlzWt&q`Y!%wLwa586o>_IQe3Onmsy>CQqW9 zbL3x?57kUaTGb7!i;(%6OI!COOVhTd^7=-aOBM^gBr?`M)XKSrQ}%dB8@Jeb!^wHY zxZNy42HQ5=smA^e@F z`%v?jZQ8Vl5%NuWu1ow-7yBxkwcd|2lD{tJUQ+h-qBQ9t^E4$c^Or4$`uS!dy`(il zI%)5bG@+R8I-*6CFb~D+rIa?oA7e5&V;hbhr`X$h#%;Gd!?_-^TiQBfqc$IsXv@eo zOAE(D%pn8gRg;`E{3H%a9C>A)Xxfqac3!I$r<{{#Pt3VVi_8VC9atx}QA&7`J3U(W zC$%wn!H6U!DG|Ch-n=f|;pCb)_p-@3Qd_mP%ktwrQvNY*dwTw>E%Y;b=96Yn^OrSB zDK)@Ht|$65I#nD&MV7eD`BDpx6Z0XXv`d*sua>^|ubMlI^7^*ZqP*tPXB#tzfg-g^ z5LwPUr=)IP$pfmG*myi5`;m>!%1@${C5;61UBA+#CBBQ-^=X|9T;oF67ALk%EV$e! zlKQ?fI#l+w{J5K5WokZ!R&=B{pUpv%)e?dABGf2cBnewlCR+5U^VJI?5oT@Z6cKG3 zaDPGhy{Q=Dku(@48cRRusP)N39~P5B=i*I&xq)@sEC8$*PGJyOElxt;5R@pQR3x=G zF3opR=3LHFDT(Jzhiwp{D_1OX-l_S*qAjzQi($Yk7i4*n=GaoHAHHkT-a#Wpmv6yv zMkjq0<#!@&ZQphEScVVFnuYAMj(T}2dU??ZYhB}EdSrht08WHs%nf5l5W3{j6Zq_V zbzp#9ZSr}8RvzSIR;Y5C?@Ak`thpo&zr#l)JhslyxusRU6E)lzI9s?x)Kv9QAyQXB za%9aI4xajAl^Znq8H-;1%pkdx>o7)aHYVfLH`)(kvQQ8(z`Z_GT5Y+~9VQPJlz**f25ajHMiv&OmgU&HS+-)k7?J{kbM-C3SSL3ejtwt=#Ivn5nLwhDS1!c2ie51}?93&3u+l3Z#?;21>$ByOGI+ZwUxe{q zA|`*UfFd!@8iqGtnsDN$5An`VobAjiM)|f5r*uRT=3Kd&vcXa3sq72vj!}8k2Iu_L zPdlC(7{7QWWe9AZL~YdRD@l=b@!5;S#7zX1QNN(*TYA=X_s#@xDR{m+OK~+eC@YwJ zBj&*~AhE9-oFG?_VJ@_pb@EW==5h4SV+k~mh^g+n}vgn|PiPAEl zl4`@qjiRJtQ>U|MY&fa-=>8FRpR-u~BET72@d4z*$f@YaDsbXCjM5=_ZjLQ3r5u~Y9n&UBy_`I828)^~(A&rWE44 z@gA%C{N#wmh){FGfh=qDD?GDff3yito-;l*PdR${DiCYFurTdSle2fd@BjfStdisn z60!ZqwjOKw^*P6pHzO!*{UR0jp=|wC0jNSHQvM`HljB8cVCmN1{VHK}K{j z+aUqA4w15!f_1J5Bhn11n^6+ry85ox8HhAqy13;~pKLlZ9wtHUW{V5Y7x7H3O-dgE zVxx0DQ0Dx4ZRp_D_9NuE#xnj8Llk%rDQ6yxZ)cLJ`C_dbEx-APSL!Io{ECkbnY7`9 zVem8ticgzdjcLr8wjJC?F;FI8X?cmwyw%!Yl5ZpUwJjdf8kx~<$)SxLzF{-BywYeL z$!X+=1!)VloV=DK!c(WC;gZP>R+Mp|`~)reydK4K9XTd=ovqH;o(;QUjiI0;yINPx z3Q_CjA5UjSP~IP;QBM4wb^1UC20qsWLi<)h-{{v}f1qeqD- zL3K^h(P1nrI(2!Eb0s8hhLwvFlGm+);P^B@DOOs_CA2>Bw$4y5@ZXr6U}4 zPFgFp7fB1YE_sG^pvFc_erJpV(JwJ=!b2yvFcJoAM+TM*@pbz;F!j zwmoWr+hL%7hOtbg_or9zklThUVXFuA8R6mrUpCDr&BTOLuft=MZFAFL-7q>qj-|g; zU|Kzrnyxv^CgV?(S(I$YWCZ+iln~ygw8$;Ye#1f%nWN@qYMK1B#b*IL2flRpCQBDp ze=LS`F+n=RsNc+4*#5P1_4CNb0Zwks;*(ezJaWCvu@q8HZYl4Qp42P z8@5sBYn`K`vhVzGRGfxWlHN?aIY^n=%CU`u9&GA3RbRMvO|hAbU@w1JqYj#WgiU0h zB%9#8+Llw_K-Y~c)L~QE*|%0q;@nY-qK;-;IMal>B(5|i%hqdy@im!HlP7b1wwk4k zW{45>YGirg64*s*q1Ul3xN+jxFFoMwrjZEVqjg*7hUm)wOuTOb&ZZ#oB_g!GR#%a1Mrkm1rJ{hBH zp#zy(&w9boS>1oawax}GNlm7jILyD@34tZ zd>1s;lBt&6n=}ZWF-?}X_9ZgwILHwsTWV3&3XFWD?QV> zT)mtiv+eqoZ~rS0USGILCte~PQ1dOzv>mGOgU%1cYLRElY-b%gSza+MYgBgjET;MJ z!&)B*U$yke(i44xUte2b8eHCgfeBX^@XPtb?Az3AiHvrj{fiW0U8S?h>kT zl*VW4WS6xod(#6dJhVq)d=KTm##6ddcd6%^!(O$pn?&TEmOc{Kd?vP3%C^-Yug6A1 zwt$^P5$c*Uz8y3Y_?g%9pO(5Vi|eQyz-h!~D;jbWGHHa!el*46vCVx|Q{N^?luNt{ z&v(eEl+^5%$UyRrrfqa1lc&UtDI+n$Dg}pLXS7^MGbWG3WT__Uv}V=n7?&K^o?PN8 zzBfJ-KG^i|Vs|;I#!A;}frFX^|ACWzAVk?H`@H;ad%cmEq8#pDvLsfn)|fJc$=htz zAuF1GTF>BIi6XU5DkIYRX2d#R;}DA-N~dVQm{_WV`X*uT3s1WC)t5ZL@-7OUP!!+6 zxZ%>`TMXm&m6-VUjz87UId2cI>=?f9w{v2u(BOh0V_rawB!Xz{65x_qNT zOywk&InVF3%R+$@Jt@|#)SNS?_ARaJXagVlJum93zKv81*OPgZ0J)3X0E`=*6=`NW zCQqIm>ucRjpE^ayNK6xNICYWza4u}7mKRPu8%RxdYie^Q36841Kw)j8;FAVp zv3$kK7-%C;8E4sgx2w1q(8G_fnH;a{ZWWFhqs+$F#PXG^bdlwJ`IB%s+0D=xr|PIO zh>FoVpQh_^st%&(Mom7nIZDRkmYa(do&#Q<8?Glc&QnZts}}2gL<5~?&#MmeylktV zHqS-*W+ElIKDCBM*TkyTYsA}9^EML8mfjyL*Noezt8QP#G_r4viDgmiP$wberR6R1 z-vwweUETFlB~+U^r!Vm~AxDnF<1a55Q~p7h)kVb!)BXsriB_y!5u@YEDBVb`7}|I# z!^#!QVthR3SU)0vJ`<}n*JH97k!{YpcXsKMx()v;=H%-BYD>-u8Lk4|#wN{D4tc%jp-fKdxGhjpvViw=RwTdp86R7tv8>KoV2c`616Q9f!=5j$G?0B9bIZ zk6B=Tz4jO<07(ArRq-eTKJk(JqR28Gm~dEBj1*bZk~Y2M*bv9w>;N1F!np>rv>afL z#>OUPYh3#EbAw*FFQd)++tiuD(P7P{Z+{!G3N5ZGv_J=(!!XnsSw+PHoN*z24vbSfcs#+%a2}CWOnE2*Kwq=m=et?N2xdy}7 z6NeSUspQQyQaa_vUb`3~7>PzkCdcAAH^))GJR;_-niP|DL1z&ZV`L;&FPj&CJnG1} zXQgiBgGKS>Lq8s;UUr)vUb&$|4?Hu#EU12%eCMT(nufF5{ai>4BXz@Za5Q^*lVdb4 zIPsV9o&(+&e?9B!n5x{TPR@6vRDd7X5f%gS%@60+_p9fZvsK)nCCdrJW4^2tWnSR( zB25}{6~O)OBC502xslfStd{tdgUL|FoZSkSb7&k+u}L2-AKplu_va(xs8eTZK8N#S zJ5w72h6sCoA4;%dWvN+=KPsDL&-|UAt$G4TvIN`v^!F2E=nb#*+I|P;y zlQK@Jq`_Otz>Q3q9JgO{Zv5nDN5qeR`qMb#$lt|j7hV%nB%eBEO8V3>^a!tBjiFKc zOuvmX6P{#pEyxUm{78soMI+(_|(|k+IPut9Yqy)`{hz zv+*ev-?}Ds^q@O^uq=N4gKx!!vlqwYDc;_tLZ>$dql@Eb-~Vb{Gk0Z7aWd&~@?fR* z(I3XS*WVNCExjiWJMe(GYJSAjvAJ>h*S;UOEMBc8Mtzk>jUg>LieS+R;QEW_4di6) zbw*`zIxDVGM8=lJt#Kt$Gotyq_Uz;0SI3{M^`tjy@=LASe6r6bUNV-d{pn>Kq%%-1 zZ1+-cov`#LYaQQl*@^M3-~Cf{$~O_d@dCn}IGEG78|E_W(N-V+JwuXD)4q20vA>OD zPQ841{fLO0KRB@?H@>eD0Eb1%4R@bh!`d^oHZMHs_wk#P&eMHFxvIX@nWWj~j{eT4 z2mI-lvE zbULK^d41v$VCB`g!gewQ9*>QbW^{2z)n_qKd+p#n=U1pPfzWbxzqt zLgvHyi9Dus#9BmG8dI&p9;s6KYoQF3e$;O*)c4THU~srp>mLc#=BGgTYtzW!)c369 zrk|e(im{)Rae*$p{p$G1H@*-*`Tf}v@ar`%k(jFX!hifW4*l3camP{#CT|!o-Dlr; z;-j|qyFx;aXrq~;W7^co%7J&$lYBGf!H1TZ{ECDN6U-DgA=&xUBsl;#RX7e}@-CYP zhpAJiXw#e=BV1VW%O_a(-+4uR{>ang*MB)S-uAMm#U+0^A`buczhk<5Xv@OdL*ue! z6J%qYJTgVLQ=BV)rznT1?1MEvMx3ue0Fk%!A8IX!S)O#uVkIKGSF{x$x;?))8BB;8(zt_ zZ?&s@@w)Kd*>UH6OI-)XMPAdU^2vPKV3Nhr+LK>C?eHg4#8!=XI5RPa%%=`N5R6QX zXYKu}c-jt{^YNVT$<)#LsP1-=Yl$&TRZPzZ^%o}Bl6n~Q3J}c zHm0h3?YV!66VJIircIw7W6S5qpMUy=c-0#YjLT;)@WZpg^2S_FXAb0tNSN}r}Pk!~+ibHOB?M~K%!adiW79aokA#v8V zx5i}oqBe|!Pu!;{W^O#JIo1&KH6>;!2d))g?s%*@YBfei)Wn~8*jWRmW{4;KGZxPf~kmNYL1*2 zaY=(iM0dJ!z4D|Z;>$nzd(5Ezl2IVlDo#Dg@@Z!i|>sa?wIR&!vTJnd&ZIL zP@63p`JmQqPM9MHRKr|N(;F4`%7u5`9(T@NY@6ICvN+yD7?*14@nvD0AAPSa;%hwi z&!X}=NIUk)1^3+%cig*xsB!yw$H$>xKgM}7zNbBZpLq6@9~n%$s73b7npn3wu+pN7f2Nm6y2hMxGcygjne&dmwkn2ePxt=rz)t^r; z9Z~)1D#yt`|8|V-_=Y&)|2`Lwd(!Ul(!HM*8_4$l`S--E+wZd<-%qtBs4HvDYn@Dq z@9gT&VPSH3tNy1`WK4Xi=*xhH~CQnJox5MM{acn5b`bFGvA zi1y^#QWQtIFg|Kp{ZuG^v1+^)P|`8PS#ybLL=<%eO3nvUSorL1qzqn?;BTqLIQH-XSOspP$IVYw&`NE!^r z<8jY?LCikw=$O4|jV@AQbODTy-5+P3eQ7*)`$uNMwDmrGyGO+)GjhY{VPlOhw$o2L zCC<6^3BIX7Pw7hQ3S7wL5EDA!(ke*F8iv*MOHOJaQ%wKwyTSajE{ zIOUYn;*@z*|hz~o}O@IPn9DW{zsbM!8ehlRDHOXJLcpBUKi({ zcR^fxQi-iy6W3pJMclt?O!$#oEm3cc&#^Q>b7j*-Eq^+cgL#x=fr8JoF3QTwJ2uPCPpr6mduT_&N@A2 z-g38Yyz6Vj%K4uz-R(0kkAMIBw7Bt3Z9Lw_M68$)}znKUyam_sXUB z#8p?$)LP0-aPDmy+noFTz!PJu;+ku&iRGi?aoyFI#hTHvxa7Pu|(|jYq&FHRMX2z+foEn#3cdO@eJ=MW;x^}tO*#%eK z6oY9qyh%ejKGvLjvBhH^A92e$ap^+65hJGRGg;ftzfb&UY_sFjv?jpmnwYX)+;rt7 zak64v=TD~D$VXz%?CWCAqLnds_O)@!>F30K%f@4U>A1EAtCz-A7oVqjJSXm6u%i6u zS3>5@x;jod^|ZL-zQr+H4}bHPtkk*~@mI9w-*%nHbnD!uzLD@N=v!~RCYG!kjjPT( zD{j7HzWwK3GKdW~-zpyYu&rX{s{6GMoE>B1D}7Dgw|KcqsR3wB+&|~Gxcr*gJdrsE zei3@pRaeE_C99Q>uCqmV#~G)c8vnWE8qIs&&?isfI=?uUu4YO`^iXksTzkdku~KhE zleMRC`nWm-eJF4nAwOLhHdu)gUpxN}zAaNAs8PgB-gll3^`Ke{GY`UcDc zz?@mv#Vxw7h{3hNesSmgmClts{9qyie=qZW=DBhAyyY={#*D58{#B)6JT#Tfq#5z( zM?EH{dk%RRN6v#_#634(85dv6zQKdQNZfSAg>l-M7sLXEouN0^8Bu;2!<^Z1=2;iS z4ced1)4sQ0<(TJbbosnE=giaN>c$@l|n-=I!E{w|PGzZ$F6p;aKZdu_muw85inWIQ4ACw^rk2{#ZX_aq~5o zYprSjnmxyR0Esh?YnI%tefNyGZuT89b;bsrzxF1Jx-6b^d(67^zF2tgtT^qgb7SF( zfqYMjncA2BqrG;l9_E%WxI3=CdbZc%B#mL&g1h26y&2_RkfaW!#YfEF8 zd-K)0PEUz@7OnQ0$v3#DqH|)P3;Z+S6{IvpAm>h@`x_Pw9EsW5V3cfiaJ5Msi)G znr!ox1d1QBY`g>mL^;P)!33b4XXIv#cd0 z5ntnKI54dL=B16b3sIEoKM4rqwtxNj{vZN@Ziv*Je?c_5YE|5H--_5~^NnHyO>l>> zQw^4wEhEvq1@nD#+;D>#F@5?}FA_g%6PP#a#&gm;5VgD$a>l&lA~E^R??RikJ z{E3L|_l%t$zHwaq@88DfzV@?NykdD=cKU^}&7Ql*?I#@_zd7OLxa5M1V)2xR#vYH~ zFur=|!Ewe_vt#kx+v9}a{W?}`wR7zD*sbEcKmRPg{qsM^;>GvHb+^okop*aiOj>wD z9Cpyban&6Qb6Vee3n{s~`MdZ2hcP#r9jxh&!)7GY&rVOL5o2 z<#EGh=f!_6xHz`j<)!h0CvO{n{Nd;0*MGk#mdv{=X3bq4yY9MUOwDEBUzwlx=by)M z7c7aF?X|NvuQQJMcAR~~NIZ9s$HvdU`l&eaoS89S57u|AoF04b{D}DJVPA~-+wK%k zec06a_UAqvXI^!8%${{qocFIk#hKSFh`siDMob^SKaM>7kT~k}Yjty&8z=qwsQBx@ zuZ!orc<(s=0lYvSi$_+b3wnzixr7wi)AZn-GF_me-x^I!Io_{K+G9skid z?!NP`IQ_(<;)2`Pi;Hd zC&iJ+o*0jN>T_cIhiw|yo_v*HXM@}zk3qc@MEzxV0*>%T6H%Vypf z8*lxD*x`{6)%LMg`HsYuryLzWJMory`E$07e;)t0xN_FrF_^M`Y`?<}vDK#Qvoprh zyRVMJ4*zNF`I48#W;664Gw)9Pl*+CuZypI@$0ecOJ5&bOv_KXr^)vzzx#HaaqHB0;nN-; zcV2g9y!$Qhil@Kr1MzU(D1Z0uPsE+;KRKSZ%~%}r!4JfRH_g?X^c&;1NB%B0-f@rE z{-K-1zmNPv{Ab=)@w{ChGl(;l}`obva7#CA`AaqP6shVhr5e=ffN zyOU$N=I#75&Wvj`&gbv@hIrJbQ?zciY?aFtJz$-2#wqd8?VlApKYTns_0|u@4*R`1 z9=hIQt@Cr@g|B)|jL$wLKKjX@#IAeq6OY|;avb^X!{WFzu8R40To*?l{g-(13tkah zZjj$^WN)5xZ;K2zhdJMR|rulQRW_J!~H&BClJ&WYb1dwM+MMgJ3< z^1e2=ct0>Nntf>;a`30L2P})bufH%(KI2j?sVButp1F%2?#_=xKk+%~md4!MuZ`dR z=D2wHuFs393$KXp{NjXo_TDdw^+)H%S3da8m>E083wPNrW}fq>IO<`?mP&Z;yz3CO-4-&Z6fA_1S z;}OqzaXfnS>2cA?zlo!cJ6+e$ocPNh{}5vj*)eu~%vP~*)_HNj`#u}76<_?;@8aHtbK}|zPmg0yx*}HId0w1(;SF)Y zseg|1XRVCq@3~9de#zhCd%w9bUbWAj-s^6<==k{6AFhlSz4V#7hR=#Q>unoP*=lY4 z?Qj2xJM?CVhyTYu@yT(QLSiN##{ORbUV}nQR8js&@bI+w7d1Kka z+vBu<{VT3e-6oIBh$lR8yEx%TUyU`}JTrFOay*Xt%USWVH@rGFA6ctC@>B7flP-<> z@0%UR9{Z1Y{L`KjTf}|wmCqa&m)(4?-pJ03l^Z=Qp8A-F#n>2sKadabw_R~seBx7I zjyo1Ei(9oP9Qpgd$1`8_^4Ma!e185@@n^lExc0KkW8;TEDW34CEqxvH;63+-OXHF| z2C>ioJR@#A=dbbOqy8R?7u^?s|NZY`;YQo*{<(Er_4ogaul(|#ar3oT#fp*5V#kL~ zkI#JMqjAaXc`^U4>*KiJ{wmI!JsSV}lHFs?+?(RikAEs=-n}qxzVwth`SN-3>}T^q zfF7Cj5TlTB{bgtCP3(EGaOHSxu-UdTb-^X^tAAb;FM8gyx>&eiUYzjDpT@n@9~=8V`$_SizZ@A~``Mpj*<#6m{j-?5 z!`|_vZ8nJSe(D2p(j~LwKHcNzteh6RKKb$fMAsJ=M?KB*DCGxLzhOmA!yb>8{Icb@ zWu^(wW4WHq;zuV-{7fi0#`ce_KJDiIK|Bm_>KiK(oht<>{Uz^UIO(1ZvzrgFwD}@W z8`1DU>^7e}@!{u5kE`P07fg!GgX5ui?bw*k>*+amiQj~5vH51{FG0q257g#4BIe(} zN--qY#157%S~NKJoSO$X-m`45c=_7F!ewJR#s>@3E?7EVe75uNA03>1(Y1psuDxY& z@7#rhm8;ea){Kn}R;?KuEFT>mtX$18Hdr~@KSl>D)cTNqxv(pBtf&@!AHQNv`dFjf zt~>ka!G7=m>fqjMPaVAJz|RckAsk;c_}qKmIymw2S%Xi#@!5mZZetY72cLNL>jrqbsAU*`Y-|MW>jK~!t5JM}k%XFTgAgNyE1=Ki0)e&FE4-~F@s?;g1C;J~lv zSnj|5lEF)!_0+*{&brn8^Z)$)!Tuln+F+&lUwrN3gD)O=s^!p!-n8%Ft(~7}Y-n-A>Q@_1f{KCN-_j%>uFIO+H zW~|mln|E#CgOiRteDHzKA8kGT<9~SY;EUh?`(XKk+XioZ)$0f6-a%G_!J2VR(qP%( zOYeNo;8*9}q_Qm;eBh0H4ZiuOORZme&lQ6=yl(%&b@#0vTzkgv1}}T#LESuGefsYP zFW>io!OiovcI9U!>rL@jjjkQ69K)|x)1rF@AAj!~21lH9nfqRsmE)g(ddT1-Km1F| zwSHI0WcAX!2XB4b>jvlCaM$4X-#KLP{xAQ=dg#)B9x-_1yAK=Ow`|GaiywOD;J6F# z7%ZQA{ot@qynpb9w|r!9mlo&wCwzPGv2Xmz_}9PS34@>h^J??+Z#-l0YK{9ACBOE@ ze+~BB|I=O%zyF5T;^Dv6YDv2Lnm-TzXP@^E?$okiOymijef$pxd%pP)^GAR6eS?pw zmW}@S{f}uKe#iWZ(KR09Y8fuP`^Ldr-u14*?ep&%?7z=z1{c@*IpQk^4Sx9Na|gfu z;im^*`@@-*aV*4Dk{NKUbKKEFpk$7-kcVlY@ zOaqb}%C2L=az_XPV{Ma|cY z55@q8KzP5`t{Qy*umcC5{pmjvB>LeY`wu?!b*`B;gToJc`{1j;J3SSmzy9RYgLi%I zr-LO6?-+dWo$nr8q(y$$b>|E|@!_`*-txh(d!PElH$FW0)^QgP##hZ6ykw7O4*qsU z&f5)V{ATc)H+_7-vby@D?+;%8>7QBtmG`}JaQLr>``U#kd~@*H_k7d1)wKsG)4?Bq z@QJ~jK84My!6Ey5`}eeU2R z-#^j4#hRbjz3%PWH^&Dv&pv9f|GU0w8>)HPX+Iyl@4#>QnmO)>&kqj%zvD3(T>1B( z4&MH`-au1OH{{2 zw+vqXiZ>4!`3+|(=L5gct&6|vnm_Ewe+}-s;$MS(_WQtKZeH4Y9?1Q~hpsd3O&@*p zYX(Q0d`$vG$9(PmTKk#%m-gRh@PTjs!L@+=oFH4*F#b*Zlef;~05iM8oR^NI4VDC4*e{jeBRWQ;0 zcU~}fgW;+9NWT6|+ws?E9844#rm8I(Yu`Up2V+-kgCowQu(i zp2L>252}XDt?zGbKI(akXDl$(*s|I;CmbbbkGCHkD^|;o`padHj}`6N4V~j8@9P0x zI`6gcrE^UC8tRSdwG(mpniz*?M`ACpb>e49aPZ*PJ&0w@n!(~F%La>dTyXi!!NphK zGFYUobN*7EdGmR9!Lrf8LiHCcRm*d)WQ&)N4=%iM{@~(S_xVdE6G>0hJay-jw>mtV zH$ndR>H9$mCAdVH{07|2L^&+~Jt^d~`uR@?O(a5%jjoBUciJ-^y6m>N?A9f5@74c_ z8`eHNUb^ceV{~+^A%&gfcMePMye?L*zf(MOmxslg@wKsfJp3KbaY3K7$DXl%8pO>v z-x*Ka>$x#a{3>C#*$N0$f*m0L#VyZZ=%+v9uVLJN z&wVkbrSq7_?iAZ?Vw2cz+ihd8a#@V8xF=?z z{Bh4&Cmb0c{qTq56QBBATz=~!&CjUy{?3(JAH(!=xr^40tz9rw=HI(fe3 ztdqw-?b)&M>U(3+%4zYW9Uc+a-!Logx#fn~e3yM`9tFa zAN)}K>bO%Cm)Z~Fnk(nT3;$;?T=<%M+z#8vhEs9?d963nHLv+vJ7e2;(K8+rXPtjV ztXgnWTyfiIym-%DV%2JDlK3UFFN{MD`bd26Lm!M|Pq{osR488snzyGu?Ww-*n5RcR zY{OW&VugE`pZwc6_@f_*gAP6{F1r49&Cww4yJvQ+e)yAO$Bh}!+E{;!?c&jo-Nt#% zzxU3VzkFf*__K$_$F&Z>^NYX6t+VclMJrau$czo+InREY{jM4v^(Pf=PROw>uazp` zxaM-j@`zDgHx@IglQ)c4y!7dD{;B5}ciP!k$6ousB4XYZaqs3&jc4q%wbl&(#=%Iu z_yy01YpAi8+ih(X?*7xue7henZ?oeLui?2H` zra$S~@q~xX@Y>$=VULQfAGTTOp6z6)$2vtZk*|GePZ?c&XZ-LRKZ>Wn;h@;}>DyU< z`z_bTy|-NzpFZ@H@rgq}6@NPY%DC(H+jZS#Y!23t9*$ykHB!;oEphjXN5!+AzP-jj z(3KGJyca(|?z!sP;LlDV|0Y9odG~^4@!UP1QPPMVpZb)TK4q=uXI{)-G$mf}oTqE= zOdq@L^@3P)`)#pygNMdrAGSfvy!lptnz{4K-xFJ{ygu$;xG1iE`hFNvx5UKxutlzVSDH$Hdh zLGhsvd^AothI{#PvI*Y`L4t1jb{&Gs8Jj?pY>u(xcPMsdQfqVV|Wh7<}JK8zH``T;^0FLjh`NSdfYPW&RD7i<7KO) z8Pcj1t932%FIC8w*1SKV>=8Y_GBx+E>*8~t{*>0mp>e{gSHulB%#JO$-z|38az%Xf zfCJ-%Gp~yE_^Jy=6hyf$zwgeNx896+{?&=tN zlc#eM=6pJcGrkb9;I=E`E1x+uKB&FzsDGRnW6M+YUc-y?V>&|(O#kG=`%DC>|qp@aH zt!+`eFL_85Zfrr^eDC5o|F|Fd{&?^qUyd7Zy)EvYvnWQWogDG6k397`FN>*nofGdr z_)Bs2)px}D`HeXH^CzF;S1-FeK6~(24s?r{myH91@@Z z@$tI%-xhNxZ5OZJW1INuhYpA%jypZZ_+B%9R8#V@Hz!C(j9R+P0oxsY+FU&#{=ilTZuoJ0M4vXiD)Lh$g{vYJ3vKVsctS$QOyUNXvJxj@co*M;; z=OStw0t9ZbmWyb5ynX-Y#tBFKIDUD;S+V!)-lzu@J*f68WaqM<#2) ztXllwe8-4i7xeNF@%-PuC&)+rjI1LGC(9SaSl8+S<(V&eeZ28aZ;IFKw|{)& zdq0f*p8F&}@Q>AlI2RbcMwI`^*lItFwVUX&Wy@lNO?0JI4((S9Y<%i;HS!nQdmCYU z%Y>R*`KvXwB#&p=PMNwv?EZp%;>~YrB zy@!1#j`+bBBhv?x+^XvzwT$6nFi|?r2 zd+8tJdw;qj-uL-$$B%#di+J^3+xypxQ19M0AzSSDe(!~+{v*aV+94kIh^;6_{!?cn zO1xIVr1&H*lmwpAyRYj?xga*Ijv?Sl`B89VJ8KmNZT#kW8I(b$Z4U9#j_;JeZg zd2vIid%mbQK=E9Mx*TGk*Y6)!pLJ6F;pn4ct0zA%wtvV5t_g2WW5u2Ekwd>3FM7wp z@#7!;UmX6?H^lf#R;D~CNsd}lzCI>R)*Wr(74fle|1xPvb2wc}5I)L#P2x zYPDvPH0z`MlT1pB;Z50WyLj_k-xhCp{eJP*_kS$D|E*8P*3?EbhzO~fab%K|0bmjdqK6SI$V*0B1)PbLionG<&`0Jm+z)v9pvxQCRo#5F8dT4Ft81j|*K6N$y2?kOwhi+~>#&TIYiCUU(#N`#yXi!o zM_OME0ij)B(Sn$yf zhulOW#>02qBi{6uw`yIyK0fr>!{aL-eoaiC@sRk^|NSaH|B*MusYe_ZhyCb8f0rGi zMC=#q>At|0#RDaprAzORX)`vhH`aWwn7>ELyjvC8nUS)dzVg{aVykDpPJ73Xl*HF z^#6s7s6@xtTR--G&3>`}8{ZhOf8*QZn?L$-?6vbYexuD@pY_OBqJDSmaq*@XJ}$oX z;Wx$cS1$1%Cqn+9PwVRFAAK(d&v;wB_Nfo)_RLMUeN6oC>-LW~yzve3nl~O8Kl#NM zV)9Yva(Uk%ke8DEriN!BbQb9Z2ahcGId}N!`7T?Ka+vpa*~ypl zu?I8R_w!9j7)aS?)2jMFq8`qy>}{$swC^=LAv;Yf>5yzt1TI6DFf*M9YEJ!}a#t{d>C zkKQFVU2#Pm{pSn)F6{oh?u@y*0rEW@@DS%cp1E6`{>R_NEsI8d;hz2H-^S>sPmUe8 z+c<8!ZFY=L-!%4n$GhSY8?1bN9aC^-~6{T z$s}UxG(Hu+*PE;-MT4OZ&|2ZvRvt03aXfSPUE}gguZqV!X_t7$ZcmLZH{U3xO`94! zKly2K?(x5g8y2kb_kHiaV^&PxcBgpad5BVpLb6aIBkj7^!Wq45dsyx3~n$HzO~_S#r<_bnh? z#~eq_e;X5T6zGqwofMDX`LS`;zmAPtG;wU!|NPS*V)o({eu%6oF)f)tKc;WERcy1x z)L3xK#mf6K8RW+Ab*Ymh(bl!_|1tI!fO1t=)bM&Pad%fjAR&-Ia4$}wg$hukK#P>N z&{8N?+}+*XgS)#2Pk;o8yFbmp*4pRHOn~qE{ylT=IcNLcNA9_I=FMwdz7Wsce;v-e z_9^W7yM555t{$V;8HT&Ay&Q`ekjKfbx1eg!81&?QO^+dKqs@%Z@Z8je7&5RMh722l z_g;7qtJ;pjKz{@xznhDGsSlOsFzlzK8dDoh*c6Z4c0ImX+Jb7{?L2nlMW`IMGX`=a zId5*G|5!-y@ZEP~)`FF;Z?I8++?jW;ws297}YhPn8zxeMpu`dDZ9 zAhfBk^$m-1rEw^*_kO1}#%o8O3^5lRU+E#)>VDX2R6VY`0!W7)ft@a$XDJhoqZ@?m`R#SAa_j*k}`x@5mf=ZD9b zD$Gkma|L!k@JMXj`Fs51m5bDZTpPG1m=8rzwW54s*OuPTB`-sH8q&= z{Wq?oyg$bETY#HydB{)y8kfz&^|w8YEq2__pYG}R)U~!$x9N&OJ=@^UTki52p(l2? z-T63Hwv?f^p6kc3dfa&J&CsY-w0GQm8wQNuz`tBDbltI-`OZuDVr32bcPqoF5ySE1 z{dc4DuuY(?qBcez6IyTCR`8xbu5w-TCtkq#^#|g%8*joA4v)&# zU4BI~`k{q4RUJC_z>F_n$2ZcydI{&_lUR}dXi?)Quhlio@rqgBc}*0pxOSJLs%1W} zLl3&oT2{=)?USCzgb8DrQ{BkL9PT%49n>$Gf%%m^-Ir?*?uWWIwXw8OP5$FCT}gHG z7Z7WJ#*K3*U9658y8#w`{TV8{4YRHxy}I*8vJDo`pNkm_mt(}(&GD;UHpW*|ze-v( z_ghideK5EU9T;#xtnN9m#yG>)1S3f zxc9*aFmE}pACh5C3Uj@(JvJEH3HRT2I~KE9-ntBT-gQ5g`xAnCj2qMwpME+GYw4QC z7`n8n;We$s{ibj=x&>=oBh{zL2l**~nFMS!q%9_YF_$-R>+#w>1|8ehqK3NkNsq=! z1=r>o-+zZitIDwHj=#mu;|JoCPp6Z{wU9ZjS37XQ5oeXwSD^DK)Pt^bsokgrtRY8y?*CZB zLLy$`jZ)a~PX}MDn5NiOH!lz8qBypHsoiQ?$#wV4vUbgYCE9 z5&hbi`AKZ29(@Xb$=|74ci!Dnwz4aZJNsnJc;<5KwDYbw=%{lre`O2mJ9b8=_I~V! z1`gPXzdRHN>@ouX-TxQZdG|dq>GM{cdDgLLPkm3_d=~bk>@W8D2S)Ak7fc-09b51F zcl=?C?$~GNov`z+d*bWb(fIEXfA$^lYF$}S?t>FAJRh^4xCDFdx-0fS@*He+z|q)oy}oFmOy_PrQC$&}yS%CnUAroG zFHd;JW%@AW%0_E;CgIHvrBhT~3SS0A~K++lxg(rq?=L;p^>@i|P`dMmWm&tMSp zlOr9SI&{RFx1YyxxE=Q1_s_WRweNAx^|#^Y6NjOJ%C_J4Z`gnP0r>rHJ7K3?cEgmK z^>NHU{)B1@*L3KQEhqFuRrfLI%T09GA#0&?+m6_9tBIafy0~`j-UqyPI*!%l>>G}2 zZ5~@HYtg4$XD^al@AG%;vqca5bH6>X+a7!4(W#wq(RqKRL>c~a%wI9->_f2Ez6W7R zm$k6&NNxZKKR@hLY}9TV_T6&#@n&q9D~}O zx}hyE5EX;B$Db#Z?@7^@gIM zVHGMn48p~io`%~_-XFVi%=G<{>t^iCalHSLXJX?&oq#xaoiR`QE?7)RpZpe#}UBm~JNYiI)DFyNSxz*=Pc)o6E7$7V%YpvFlGn z_n{*(tY-&~dti&-9gV%lRl6T|-{Uu!jCJt8f9+=*<9>NK`|C^W^|PIE?me$z{KO5> zu~re3p%eS3u2NC=!Ubm?j=RtK2X@=@H+W-C1vcJfeN^#c?e$d=Ym75jojP~*FJQFt zMzU+KUZ_y;t1Hm0OGnQ6b~x~a3o*Rm4V-l0T^P3Eo;YH^&2anydvMb$Gaan1|aW0zg=n?L^>J+?m>f8B8%|FaCq z=%UiFx(dHL>{yJc{{lPhxHI-U>`ZLE_rB=cS)UyO`yPHgHt8`RdvTrJkz=9Fgx}+D z`|a$n5OnT88tV{I~)>VI0#%f)A zbnn#O>+?Pw|C{t&$TfEt?7sJ(@O`H(aPnb0k{(#pL_J|hSluw ze(Ud!fB$}SocNbtU>ElB5vN>^x!eUWoBcWdd+@%zF8&;Myw`|h|M`2y5n0jAiu(MJ zlg>i#1+U^aoWsA}|6l07-CuFgj{1sV6WVi)Ym?@2&St*xsjlO-hWXS8I{4s&aQz8? z#IN`NH_E%OgOLNfJ6~08nXeA@=FxR)*Mt9qE&49QZ+YGN?Lo(3Gq(tmaM zF<7_mTkN^Z&e(OgpW}wd-sTMfjp-qZ=ZZ#oE82GA8rCMBgICFijvee@bsMfL`a@#E zUrs$2wVzGG?z}GTw#Qz$=eZ9lt2t+~e-&l=dr#p{d+%iWr*-3S_;1!lb5j|5_UM7K z<#Tc4jdx?#_n+hMzuODD@3sr}JNz`1cN>oX9(xF0xaN3XLw3b4xt4#ma5ZYnmUB1u@8%U2R;6|l6=>* z-I(c;j;k}<(#O7xJsMHeAqc*xMV(Ss&uL3DO|`UfyQMiNf@}9U%h(y z!bN!aqj^|wXfJf{Q0KcODT&0eq|yA-MY`kq_|q@Yo_DG}x$)@Op)D#ZIkDuF5-MMv z%P=GrP6%=StI7yD^vQsC<>8oldDw7z`lzJp22%edLqYqAxqDwyoZNc4SyAnD=*}&E zs-_J7-AU?MwWU(+AS(olM^%b_V@>cRUv8?vb z%1O5dntsAeI<=_O*Hxiacl2_XRNbZPuY|R+&~I?AZq@giTWLcRPf?Rkovu4r>XIL; zDI;DzplhIB;cIFnOCI{FAF!8y(p_1tFKo4P1Ers}S?%v>R&cYf7@C`8)%Vl&@v3;WP{_}QRgI{w(VxxhsRu7RA~KJSv|Yix*3?wcZ#~VB?^Hqq z`bj`(Ped@L;c>VI9>)gRmpk?x;aqpZK`#zUTc z`~Jf?=8~6i`bB4;TaDsSZrHnum8oi2(SRyFPUl5QpCJ3YXX;~}G+vcg9=5}As{T@b z8|h#C<#0J~T*?^#D%vdLrj9vNexyv}Gxfj5g8d{de|KB@^mIr*TNnGodDhn!+^R13Dr-h z>F4&yw}PADx>{}?TKutSIp;`SIN*M&STPd^9()w`{m(hrbVPTw$PfC|z*s7(t7AMg z=?R`DYy2ElN>`K$LOEw!{&nWN zv4-e7?+xl>jS13LGgeM-&WS2C>3iPP?J<(|tD><(zcshCg;FwgW29dNXyw?}&uMv0 zVO(@E`jN&xmPxDN&UPhpRa0Nb;n+kx^Uh$^Kk<9Jnj4j9X_7CzsMb`YNnh9CI4bv` z&A#ZXESf9KzvP=Z-!(VLqr50b`dwT9*GbOXy1Kg5pIjR`ZmVjzhEk9I!yF6hSDYLZ zlB3>L8b|&)J^dDgzH-9tFJtyk(6OIly>&u3_O&K)&eD$+%&q^Pz;mT^;C&zmBxksL~%A6|25$Mc1LNQXWh(7NBuJbGl%t@!Qt zwAN_8u0~=*hU|y=3wYs(jEIrat%j z!@7R%($_7?(`VbFevcKt^0?LYL+g*n7H#W$>-tGH{hElr+T`mEW7EyDf7+1X->hbt z*ZilhKLz)H-wzia`+NGzt|goMp8EBvuI2{KGH!s!rWi#bYx--lM?vXl42YOVuuWuj%z7v+z7>4TzU#eJxg@+-)E z&Nu0CBgImiPj4(aUL|K-44+N?)_EN=bfAAbJ8Msz z2E`|Rx@LXmpZ}z!H_eL{VbbJz*kBkp&Ahu+hsu{c-YrF^wLmK&AAjyI9k69MxQCPRP3KsM=@AH<7Q-=oy4;Gfuu&+!;7o7tW`kWZ%TAXO8ARr%(pV$xUO zlU(=^T|%l+qBD2ol}zXg`>Oe@d@Hvaydp@(x?)HK!#*n!n?(SV^;w>@zPeDQ|*2 zm&7N1krQhqulj^C>OXB>|RLeBoNE=jqU?M3daltk7AY*RHaJaHj1*(58l z?+r`m;-j};$JN)~il6`EOzgJNAa9Zc(Kjsfg(tnrej>-tqj*%0WTo8cW}}3b{BUkP zU`W$A@W!7RvqFI?vQIC(hf)6r+SsHs^Lb3EWn9ogy)HbOxoPZ}-xAapW1`@@@T^Ny z8qtX!dNodj3kLC%rXeE~`#IL9Ajjr~ZQ_hf8^*{9n{K2&A&5ifd^HbXYSy{o~H2?LIyiS%AA3@q&b?#zaQjYC2{iti4hrj&g2>k3HCu5KG`eT*G zxngh}Aul^5#e zx}wdN`qWWaR;p6oq%yBJBzO%?bIi14&vwLb41Hn#7-{4m~}x){R; z_raID1Tz7XEF_-a@(2TRJ@qg#g> zuXUa;(kB)6OR{>C-$rOpk#Z9su_iwEp-OVnH*v|X$A)bMziQH^_~f@-v|~a@%DhET zHuO+PEZU$e6pqB8Fv;c(Wsz`U)EBZFEow;W1&$%WW8K=wOGlhH`IJig?#{IaD&oz# zzF1HA^viEKR;n?4=wPC`n2<$WhHNx}zRLN@_X}C_rn2;Rn)`HVkG8eElU2~NBjYS% z0STuBv**qCU1I6)G|TtMxdqb^dVI3aZba3Qiyoz&OjXx2pH3OcxBJEz%JStwo^Y9( z#K}Zjkj*WKb19gSqGFWRj7fs2^hL?lXnRADwXujgX-1_wp*WVzWC)6puBmV|CS-id zoq#A0a^uNYz?b;TlLv}18FD=Y%q_+QK@Gc+&%gvrdUrkE6)a+jZ$$%26Q=V4EHLbl<#Mz9UhjVF~wb!{z{&Y6l= zUV9tUW-h|sfBiRh+j1S=m1|R;v#L{gXld&YYUtDV5Y5D+igG4CpXjfmNOYd% zdmcOHBRa-#wo@_*Xuw+39Cn%?G59N|Gy$CFFvQ+~VQe$Jp=>ZwV^>ZN%8nHMp2+IJYe^{;Tyem_TD z1+8=QL1W}(skh?rcoHPLrbpWZH#5#yAChuOetn9ve8Dt4{NS_L>i36ZrwxbtkHbV) zFBCusL9(mTI&^YHg}h)XGRrs#pZrw3vYD`ENIb&EI1wVzcx0VM@lcV^#WKmLX_V$o z=!$*~BXJgpDP(f3v=Z5|B7?b7-x+d0sMK3Yh_?@o=C}-IjF?jCy0AG9KLk=zp0X#A zHAJ?g|-`N7h+9?+Ef;vsL6A}H*o(qWUaN(wM~tmT$(GbAq74|st9Mt z9FpT+8yr0HQA+*!`vm?7GZK^t!2QXZr^@@}L#<4P87wSv`(O!3@fY`mJd zp7WR#n^qcw)N?FtzTF-sVS0BHP_dfU-3mWS2_x~P;aYMTLQ;*P<`K6COvaLxT-~heJ}`g55`W^O z-)Rna8cpRKl|pK2o;mM7-!~}-D2)q>2UIh>n+Ea0&r)sVAUxrBtzQd z3){(V-f;df$D+HxSoO!f6=nXoPN3%u`ncC3GN!mJ6E@uvQ5Bz}9{sPT`dH2=#VRD z6gz$6au}F=GM^e^DDsudc+N-WwaqBA&Adi9hJu<@aqLBzh#|EJ9>b9U#~S}+fgVRN zt`}^U&S#h^KC;F1w`p$rSbEPj3`_e4kN_)GNDmTEo%}>vY3;$m_pO<`bUr zBo?wu4ti9e zyfL(`%uf)r`apavoC^D7Dm`Fann=crH^xcCN|cHmgCNBrvSM(bsqVZ`P@t+$CfkT0*xwjKBoAiu|TvPY0M?;TPue>6@cpM?`T_7mcZ zb~vE^X4O0)S6nBABSCzbo^#_elu2|Ohqa5EF*rO9HTBjAAPp~6%~w4 z&Lx^5+zOPE;<|W}6R!TBz((b_rHyhayiV@C1O*n+MH7=s;dIK`Qj(Ynp=dl*sM92( zhGclSn&j-amITpQHCWKJ;-F4AfpC^jWm4@^^4oHW#qJ58RU}>dXh{D8SBzPmLG{F2 zytC4wItK^uc&e)_jEeuQuWw?pCAtbJV;Vf1b85uQrUxafdHh8mvcXYM+%OBJJf=EF znO(L_QkZ-RNM+)W7VBnVON+EX^?Vgq-dV~Y&moUORnm9N3LBr$sUpToKrB+KkWay6 zd4t+oB30_iWTn67ZgNpYk|BaRJa1X*qnB09O<3O8f|cAD`Dvnjr5JxLNR18sJ8{R5$0zCf4{7>$vThKi?_uj-IQzFg z#VUW8k7|8qG^2P}y?k&SGAX`9%)aHp!nPM1;dq1(0c(ztbPyspsWecRJ2o}tmvg5^ z0U73PS3ZayJX+v`rjz*NurK6M2K1fbl}*jie_HgSE+AP|`@xF%?X%sE_|%`)p7e$& zF{un&R#L2subK9EF>TPN4w+55JRW3EZxMJX4l+ePvJQcKP}>@LQeNa-fVmQ@`^$5R zJSwEq73$@jDoINKNzSF)7O)NbP=d2Qw|yeezH*cM%U4o0)uxP&WGpVs5tY>mOwx&X z{p|2eV^)Ha%u^h;}OrRG0* zMNJ}P=7}Z*`4du2)gTf`6HAIVz$BiGQX^;;T#x;)sGY-f-7tx#EJKKmBkL+v=#=?b zw;Rl{zALTovPTT^PxTb1`9ePHaiVp&zr^EHDk(==Bge14(_Q3CJWg4@1t>zOR)VrF zv570o2TpqQRYv320QpWF6&0_qib1$6&y&Pd&!}{c{z*BpjCgq@vP}})KPi4atjpu6 zJY9F}vKKVvfraFyCq@G=Pg?6ax6_)RH_Tox?7v&7O!lcyxluK)U8<-glggZ*oR>sW zOJ_BUV^|P;UK30e1WrzKM5T5rO1nk*7u}*f<@F@73kn-%;k*_L%ZBmhh(mK<_Q(={ z>?g>Ia(@<@ViGnrbP$S34w{;BN!92~LMVxcNnt1Q87o$C0%c=@qTZbvNh%%IlS{Gq#3S4`2$dk7(ubZv+haEAyRHWzYT&ve#i>OITY*rS>jt%1 z0pIp+kAflNE>WM7By!9$(SuWXmRGEHTY z(Ggy7Ggng;lU;c8r_yyc5~pg>7b@fb@5j%!DNY{ACxJG8y0EFK3(reW-S3~}()Zux zeCQB=(&s}Ki#P?lCM_0EJr(`R}SM&X(CHSbbkQ22_WaXIVM5c2vuy8$m30~2~ zEq#F0xU;NpG(66lLJ0RP~DLGJN#PQ}|%&9Q$uNsj5$T`vttt zF{3{`(;xB8pZ*c9zTz@WnWI0LR9t%E(u~)hegt34X`qZ0hX(@3C%euMZ%}x#*AuMp zA#x^8ox?vK%9(K)FBK)F70U*F6jC|Uk$6PN_ClYN;8L4=t&e6izYfVu4ZSsA!t14Q znpfbtNAAY#RY^AcCj$oY>l`@ORnnfkwEf^J$i%o5CI)x7NSbXM#a4<*FF7X2vG`?# zc?B*UK&JDRZlFX9y(up?pLnS=>#KB0J2 z>JNw1*J_!MZ?##se9~jQbl9Gnfj6ID$v5$czq|sC%Vyw-hn~U;{k)odlN#$NkrykK zD0TXSK>e{;))D-Y<4X)`tFVsXG0u#B+c%9n`(@vAj=7oO4gWjOKaJ17S%h+KoI}6( zeo&e}h=uEkXpS*x#W9<I<|~CzFqilYBu=hj1}pf?r2sl7Hqa;-f5%X)$E>I232ZDj*kGs6_Ze4un-b^Q+Ce z*v!v!#$|r-`UrY(mK>R{pjRM9;o=;5X5D=pJmxc7;&ZUkbE^PCabi`QaJJ{neJs;VYuw*hsDc&LoM~-CI z7}k@O7>)_FLWs8rX>rkoD?@y=l7M*mxdyQ9jk<1lwJUc?bHWwMBCd>d-2=O=z;xSa zx&jN(A5nOtBU(#*lo0&Fk5^2NW2C_MG*4{8?An1ZKYd7rLEhshs*FH$_xBmX34 z{ZY4V*4+oHi;r!6^d-Cg^vfr{lW%$gvuw`Sc<9;JeX-M%vbP?)15ds-nQSTf@=ap4 zFFhd}HX_ODoJHIy-F(v{SVh!#lV8B~_dafY5pywzAnV^f8fa=0kZQO8pr=u(WP9cmX2v zl}R_?iTA%p6@Autk_yKyk&+l>N3k=@&YA5fcPw=e?9zH!*H1J^mNqJROZ&zX_hZuQ zpZKTvq%(XBUO(K?XJzU~AJSFKf&BKb(1@LU`hAyI?!Ok#zxyq9OP4Z8J7vvy=jlm! z_@&9LQ+EF6IN(o5V9p8&N|rd{TN{_)>3eU+dtc1s6lK2M4>6t!vC?c+RSRB!@)=B@ zyTX4k;#i%76r0N!4|%@2&O@bjr5Iw4Moi|_AuDXhd{ms`k{!(*j;Yoryull!@0RdJ zjO56fbjuIfl)T!3*WqW(jPI_?&%`&&IDYJRmQxx2WL=&QQlol`LH$t5o9CHaSLrb# zzgc%4=tsm5@d>T|FXK25JCvs#$0{Mo2rsoBCn+z+MQpaK(o8HBEA6UoyTtpC2(3#o zupg3~j0;=uxOb+KGfI}UJG~VRSfRr7R_;DB}*SGn1pwpc^+RbRG(`;WdFjx zbi3QsPC6Z1p)cq^WnzqkP8rlo7lM`Zzs60MUGLvC_6?NuiEe$7pU^4xGJN^=^LY1* z1*qaU4VrXX8|}n6QK_8d*bC!Wea|xHzUsuMxFd(kObedA;|9F_*&MGY(TAZY_d~HA z`rH@xSNQbwOTIgv7(3Q49@^7yoxJ?u)p+*ZuS@2?VqmHK>iff?tRa1L2a-R>F6#)2<#AMm#Y-L@f4$Y-N4PkHT0; za?;NXir3@GveKs@!-vR`PSsMAKj&r8t9Ts5_os3Tt;QFA|e5;s5fKI*E<{L@9+WatkA z+ElBo^r3x=z7C+D=#kzwHPWx2!Kt7w*2$xGb!FJlPuPj4UUo^Ztk6>-VBuHq;EH>n z_6Aq*yW=m%@dxheFPrPn-fN{N9s2pWa^mW2k2u+)UZq#Q=qGhlkDo&djpF0b2_Dkb z)>E7SE&clOd&ZRVQBU0pu9|iI#&BEus-Mhryk+!Xwzt9m2-_&X)K^b^wbb$C1J~p8*(?3iXS!JCuP@ZlzmJ}N7*D+Y zwSVGFP@$jJs@BgF!Sb>ZLx6q69NRD1pUwNDSwAgB`}z-+@?AD->6dO8wN<_C+$%7rp_XHdc48x?QI2(JAy7Ql zp**nEIM?r8=lLLgZ5dboH|HLE^ie)P0iV_KigD4&|Mb#3bHXG)#H-4@jV$C7gG*fkgQwSl6IJdXT{hD4Y; zHd3sVVd*^34{gphF7%Ix+Dfm+kNuNi*w9x1+@u}rb?(Ypk2OMieG|k%r8TJ#Cw2O% zMO@ueT+(Edk$=TNUg_1kR=avRuDa=FG*{N4o_(ivE5n=|4mWzTX8zaF$Z%FWK%zj7&>S#t%u=A(Vo7(Cc1J~ zRZf4XOLIwF`pHiFuQ+HY<^pq(_@z&ue5ud;l`i_OPh&J5syXIj%%{HNp-*=NlJQN5 zBxt|RInfwl-Q$E8Rnn`dOYtiP>58EjU&jicxoPJ3u9nYy$)7^rC|gUP6{*ItK-bL- zTC3uTSNIf==`5YBpvC$t2n}kLXo?~s{mq5~WI5Jo(Ce}f4HPl*ATlyRbb+0C*7Xp^ zn@IA@vV4`4TB2w6!q*ZF5mBrJMc+MNivp=4R9piEp~brk*96{NlAg4|5kQ zK`l$`5W+fiq)#P}BqChSwIx`MDZ*3o(O=0h#suReqw((8 zgw|nwdS^dFuk2YT{V(V!KrtriGgy}e+!REM_NX$nk~fhyZ~Zj&}gzn;Mbp!C->xRDo=Ejnn`{pL&8eb$|hG$}p4(xMmqN-S%s zvxL`0c-h=9am|Hi;_M5r!h=t}ih-lYV_>(oc>VtKanl=%vFW(s-aI{W&HwP?ybh?H z`6~W*#?|<8%BOhbzNfI^p1(l%isiWLnu~D8ITzxN`yR%s+Fn>|Xn)jT87@BVY)o0P z5O-gCE-t_A5e!;q0=|3mejIVsiFop@X&AHNhUnV13Uj8sf#Z)o0oQVa`SM4zu=e^B zuII~8TU#$W(*p#QL?h4|@P&cc1~&cqw{T!dTRUW7fi7=yQ;z6(b& zhI<}+9<{wjV&s4>C~I1Vn=UznwlBe?=Rd-@wTI*UQ;)?nZ@!N=UU?eRR<^}98w|lU zXP$`jFS`VY32k_xzkK(ac-o^*7y^N2iuflp0 z*YgEd7lRk?z5u6Pdq2MZv)%oP5(`Xr2BBPB{5Yy!6RjtUY!NI@MRekWDaQtzNu&=Xhs)x_CcMKcD-i4Z5zJjH6FHA76d`2_AX&LrmOp8+6b|!<-A1 zEh})z=|^FHmyI#HcMDEB_!!J?T!9-eJ`>m8`2_0wu7kBZH{*;`{)4CA`VjBD_9Q-D z+7>%*I1)2He+x$+c?7P$?LMrm?t!(};@Dg`6Q`Yd9u}}X{=^H=f5WwL+yBnSv_*4p z>DlL_rBff=fAN3OVf>!x)vgSU3#Z}iGtNPmk(;31!jJGbj?3=t7vc01PQuOiJ%cvA zM`BoyTAX*xKk?){U*e7DU&m()fUPzfh3`Lp1*e_(KU{swefWB54K~|gq&G~9zWoU2 zpK&rSz4~^1J#PuVpYkCl?7lyG)$6C}@_L{n)(CBoXHIz&r=4&juDt$cyzt)F7(RME z^ypNBuU~&0m)`yYzI^i`Ty)EeSbx)v(Se(r)wENwYzAXIAI;TGxc=PJIsWd%it1h% zJ#qjlS2y9+M{dW7C!K+t@3;@&t*FO_>yJP^ZzhjA;2`u`e+TrU{uQ%6!YL=7hGCoS zgzi-1YwhzImr7Rj zo4rjd7U0gS&c_+&UW`Xy`2yp&S|4ZZ|7(uzZ}IX|Ph#e(4p@Jkfw=Xe<8k&ySK{7D z&!D{fV5~i;2flyjN!~y`ie=xugk#Qs0&_pP3zJ@+jCWsp8lTQwiSZkZ9qwo{Af8y%V3zY{JBi#-J_7=NZTS71NghcV2!LF1z7=v~(VfvBP@#hGXg* zPvG=ZPsa^+KZXS>R^Z#IbFuBOcSl>UIf_FUw@TW0{qehTD*0}_=Mi)mG#*nPIuDoM z^D;hp|7E=K=}e5oecm^>R>ZZ#3Q&wcaRd(hl-BW$vEU#wU%3-?@eF-|(`LfrrGvp}c* zSZi=^Z>ryZ{C1pn`q{XiYy6b?!20X0%^QPqG%WZQXP4i@B>gspSH>LHo`uu6J;u@3p{N4}PuBwOYqhW=WzFf>ZKXYiXl@njnlREOv~=i6WzwZ5k>#SREh(A_Hnvn(DNRv?R?}ExY5zrV zPFN;gdK&3JT+_n|`Ilmd)JlhP!)=#z@hv~3Ek2nQvlyfAY)@3h>UPk@Z{4iPPUJy# z@u^CVl#|G(unx+;*p^h8TfV6#{}WDc`@)vxL#Mb^3gN!up-{6fKSfnMVqu*cEu%lM zi_O1maKuqwQN$P_T6vKkDawAyM&`1S&}9guLllvx*9Tmw?QXtQ$JNLgG zjW{i78%ZYXl78dFs#DA=bEIQKbPVPyt+%jo}n?m#vcM^0mZA0 zuoz40_J@b#_&u}0He}$_~KMB*9GKP3Ok@CTG zZ~}B5I08*mp2thm8~wxgGe3VDpU!H*;C|gXs5vk-aLK!D;VeA+=wlf9vjcJLfqUYO zN3X-#H@}ACF1!-QAG9-WIrk)d#Kru*hc3dSU)JKZi?6~z57-mcZM)#0Ll4FH5uM4%{}OFEm^5dbnt%yA{2ssEZZnME`S&>OzyCzxbVFHVcu(Z;g(0^FGk%42cw`wKB*#2~!${ImY|vyHRf z!L!f2jdv!;zu$iKrS~vk;6QF(7I6c8Cl+>@h;uK$5^cYKnwz^v%_Hz)g%(`Sar4g7 zUO4uQi*VwR`{VhW&%~`yeBe(HmNeDkZ^xd4Yp=Z&WuHHaTONJaPuQu!bf&N>#|s(7Q677dN_S>H^> zqE)eYeE#N(cy97c{P{m;;?Fyd#Hs%|5i8ns#i2+46Qg?!!2bU_4M%Vu%=qk89Cggu z*z;fK;HnEx!CQCnqW}CC+^kc_+t1O>p1n?Td>`q{>u&E!FcWV^YQe@vv^Y*7h83s^a%7|@wr>h#q-~_!CAaHJ^YV9 zM@3^L4mtLJ7%*fQj^YM>zdbhR&EPWhU1tlNb;))3*B?1&F1rNt8kmlT<#^|nN3p2Q z7@T#|->~og|H1|Xhho3~oP@vseox-K>Q_g!q|z??s-dDQ4nKkYf7uyW@y^}2^ZA$q z-+ufW9_G#2zW+ECNB(gu+;G-$_>zlj<>3~m)-gp_CMxaoPPYj(7$69HvjD**m2@eY`@RHaq_TIOCXqV0y)9 zTyn(~jAMITbIQ?p_T#yJ!aC)xXK>fkALGa~F2<=x?u+{_IuTF2Kf_Pn1-ijN!+e}` z!qHgJc|6W#zwfecSG@e*7wijmM(a|XckDm$HHP5y3ogg;hyND0oplr@y*Cqshxf%> zZ@=MR%bE7s$Cx~MGG2Y_6YG8Lr5Dk$&k&R~%)wI+KZ2&-8{wi0&qVFihj7Wg@0%yW zjrn@nNk`!I1zm9drB~pDzyBH!UUUNPedSA3RWQqKdf?z=&cx*xo`e}M+(G}pLv`Z< zoOSe(Xc@61F1+MQtkZoJrhGXaRW-F(H04$N_tYD3$eCB*;tNm1;0~33021RpK%?KA zMZJ8%UlX5OrKMc;#)x%2anweq0IG^jI?Y}xtE;l`JZnt~1w@zfs7V5=eoCE4aS2yL zNY<@fm}mzOSC|0B!&YrmZPNADj=TUwIRBwbdl5e+RZ}G4yvtyNx_v!lJ)Qz5od$1- z2uZie;tO5=4PnY?BN{-Y?S_xuXo_EW^7#)W<+GYe#$P!RA_M8#YRh)u?R*^S8x`h@ zlU|A?YzU>B)5Mf)iANQk-3P{4LCAQcs_U>7BxHa$xzrQx=9~-9I+dw!wLg{yiRDy; zHEk3%o7b@t!zD49-!~VX*To6?!&PtOb;?uL0^S zCoH}6Hc|pQoRJiQ?}|i@ltg;erldvVA0hM}JQC{<>xJhYe*mw3@Ff<`pN7RPyrl8! zTKw-`YU`t~(9xxHJ5<)UL;qe~uxj?Fc=_W6IP~yCFrt5V3>~>1e*dfO@%nSGkh78( z!y0V$^Sv;8{TGwv+7qoTg+_63CiO@%?`lFoX3#Z}vcjw@sBmaRB{koy=@b$3KI{nbTYhP@% z?jU^p>NA-1^lMnQaxoSzZD8KR_YCphyEaTjjB+Ek(Ux?5mW*JXI)U2YKSYOrATH<-Vy73+=} zi(Xx7(Yb3^)KyoZOOIaYqW=b2*8|&ZG8|LheIAcK`8pOYT!00OSNbF9m34jbr{8Ri zfxWwR4+-dBy7S!usz_x9J`u3gCwNw0?=9bDf*x~2Dz&e9^ zV*D06Vy!;hgv|veKY1Tk_umRzj317=4!yAHh9mLD>u*@biy!;AX~9%H|M6@baPXlR z(YHG`*nDSfz46*KSB93kAK=ZY%kkI455+L%dF^pq;IF^h0#DxmIQp-<32IkP$Fya@ zM=!pFiND$p^QM1>#uan$-HI}d8Q$OjwW`g4vDjya4bZD=H|)6cHds9GYkyTjU81ig zG|riVCqG?`|NQIE7~a1JMy@*%`|P$6UVK4g2-tYDtR-qaJkC=O>Z9L0DZ6*ocxr>beY^O(;7Wn#4C#8} z?z?}=)wJt|U3TBoV|wH5cfi2rx%ig5gSK_uxe=^Hm!5t73CWwhX{cU%TTC3>8I|q& zV9SjLVe*^rps|eOw5AJo`{iC3Vq2A1T~m*3cGwkThV?-keS$=LGUutvO8nQjxB!)v zb-{1`v4wdA`VGc)uff}&e}k?)d!eSP4BdLRLDzP*c<x~f{7r)qM z9A16nT_&{-n{P1@^S^o*4?X;ppFYg`ZZ;(}kJT@+KB?4yYEwS+Rgifzrt=1-0%O-( z7k%4R;*BTnM#puw!-NsN(5}aDY&o_&o_b}nKkD~5=1N;!>)@y6^JaX9rQ9r!88aHa z+ShOn_TbGy6}tE8jZW?A(56F2Y`DR?nDWkxcuCf}PIETCIU)%d)E#M5PsK+K-ZidIqi!tZ>?@cYQ>4=~0@e8aq zum?8UVh0T7+V|bu2E6s)UFfsLpRm`qTu=HAz@B^Ui9YmC4}U#wnFGb3uUxHIIuGB@ zT7+T4*YeZd`gUE=zOEAOJM}=_$i;##$k%NUw()$7Iwy8_um_RdvwLb?SG9e zNB1JV9CN3+Q$lnHOKjh%pn<$ho|9MGHQk`W?sEZusim zx9E8jrhHS5(WCnMpBoKXXA|tY{dn~5Hw=63v?XsQVq>jwqxHOL`4oKcSt|}Z^gxc) zt{BNRc;6ky;+1D!p{6oyxanpnTQUvzJ@6>z%=rd0XE$Q@7jNV3CEf6!{dYmH9-XlL z9>3+->*N2f$O{*5e3oI_w{y{J5U+3aqqU{Q_LN&ER|75OI|y1W>=8>bh{(4#aC)aB zuC9s4@5~+J(E3=9Eqb(73wz>GgH_>$v%UnRiCa9D;yY9An`I>z?XX9lH12iExR4Z2 zXb8WgHSu~3=Xy~tu9HbF$(oa!?XW9}z$-Pefh^)IVn%WXs;HNU@Pk#oSa&{23wyzv zAy-vqz2PS@CAl*x9Z`3-tjl)T%6iv`Ph92^Z*Yc&Bqy5iNjUftU7|TBq)V^))${T* zz09pPX~9Ems4zXsIPzvQm`P!813CpZOZTNx{$nF1f@4AF9`UC~Lnc+#$V_QA$}0K67t$p8hA9q`8jtoly({|AJe z4y|}mlW0y@!tg~pFD4N%-L(G9!!uWCiKAFVCpFess zsFE7~QaW`g0jsz;)wJn~j&)W3*OPis)`^Svs^tqfSZ}sn_WlIoeYGqEFmn}n6eMj`9K5dlz zlQ)!k_puxByZ!%(DGORKcEYCU)`6Q9swl)!fY7$*9}mFiFWie+3%Uh7Ez4u|Y%Ivq=O1iOpc@JOwzqhj*$?_YtH#!{RRMSuLooWgdBxW1XItngdRUH;tZcdW+V+ z7nHR|$5w{gsv6&bu;XJ~q^@sTz7&&Ro`ioN_E#Kw&;hvm>F+RZ?H-svdk#8w>Wez+ z^FQF@?nqA_V=AfNZH?_@m#}=ra`fiStW-DCZfkiB{jI{{#k?zG61w;5_uZEF!6UM z;INsx8qm)9D)zNU5fD=Z^oO`defEM+MWZ@S^h8& zF&8=OSZX=SPbPKKvtssVIC$T^amONHq+R&9Z@=NEtSlXqQt^SqijSPd%|;lN+* zifbpmfnlRJz*@X1)BISrY%wak@dlE-jrw$e+HN>$bTM3TJzjoQ>Fs>s(63~sgagCwy8ALj)13vVuq@a2Y1 zy7q>QJ3N7E{t8ASX=0hrgVtKzwup7|;FuB7|Kq_Jf#iZ7KmnTxf3)6+<_uU_&V}US zT9ukSG-gWT&c<~GVl~zdfr+lUupDWgCyAD91#f`7H&`_MC|JyL1WQmpS_IKj!~6vT zJ!2yz^EvAY`NB`15lj=m@+!7KCcfNM-crLz>102#n$jO&J*vp}EJw6)*&FewkK@6J z``9l+3=maP$yz8Z@g-$UZIT=dd2G+T;c3!HkUfqKHzh0H;4>JXc?tAK6mOQr$A&c) z_~MDMGN`?)wU955nQS+rb)^VS7QINg@FryRDrJqYXOx1QWLKFxyRm3nVgC^CCTe!BRhstKf3?&Gb23 z_>(R!Ji0h)`RmZB2U?fTz|@(G{0D1Xn()O(pQ88R5v-Akj`=SuEvULSd(l>I%D8b} zyySDd{_YH%b?K?tbH}aGt-8URrx4*qt0C$+5?#P*I(9Y#;dBLZkr%Fx&q0ld#*Tn{1m*KV>ZbIdd30S93wHJCD%ls@0 z7eaP^7j7PQI^a0ma?8!Q{kB_i(^Z#Xr;SFSfh^nYbr9~jZxT9w{}LX3aWcxdd2McK z;zdErJMj1e_hFMipN4r7gjK*QYU+DJ9K6rF2$5@7yBpX zDw>z$tEu0b*rr=wv@p+KOkd?cs#O2J{rX$zH)?{%#<A|Arm6+z2(zjnpZ99Cxd~#`Ias+5gJJ5_~dkzQ2Dj@V<;-n^867wsDzIK+@NQ zke}L|3OrtwsFd!O7TyeTeh4~r=!l`4?unajy2<&y_2wIK@ZMW;QEBj4*LR0AsDJV} z(o9jGYItfPTCsQ@X3bmbjfx-tEu4aB+&$DXww5Jx@cF#C7}%3Bb4)0oWpUq$w%vPR z?AE-gNd0@;EwsPKR_M{AE54onA?B~54)QKrFcZ@`N400slXpGUmIEGF1bNkyVJcox~_#Ax) z^uv1F?28+f=UZ>#IKBmk?llpuT(0y7VP5A_EdI;)s%mV%*8#Yb^R2_2m+<84pFls+ z*s5J&O}$xPdiXJJu8+sxITy#TH2^KE^gR?(=$`T%qn4m?Aw%4vX|t`IX&CG2`!^rF zf%zTA55XV9*JFZ{9?)c=x_*w&(EzJF98s;o#?8$!v zc^fG@eC%ep;M&{qhfTV2j6EDAZQ_%aHa!NSao)%Heu2gc`<1wN-~SB#*BXi%+H71n z57X!9S9QGVPGO54yHGx_xo(RJN*(D=pk_@;Iu&N<=l*k-d$P`$d@Pm?=# z?24wTA7L(eb;GcdbL9K)XLC~+7vR3b#^J(i@4zX4TpyQRemzzar@sf$-|?sevlk`q z5YlzZwHQtXy2?^sB}W}boY5tGmJvw`$d@-{nZ>Y1LqLQEe`3ydGh49?o8cVau505G z?ZWXBU^GvKm<)T7MS%`&D%(07NK9cIp_kV*m zc&Ok&p++&5gE;&_GQ_3>?Md z^2&OwGjj$DMTvE;#o*y#Mt~f6q=ZV6FAB z_|*q+>e*LeN&CS#bpM@j@qZ7&S(jXe^Upd3_rARtf81|3+Tg}P3uah!sm(}Erpgw5 zeBXWmMh)$NQ;t3h*Kh-R*HfRMoSRKuw0aF3fvz*(!l{?uiqGfj$t^GD+=SM(>w`b+ zy)CXf;c%RH>D9R4tdns2b6;b^Hk;s?8_&Vz*Ia|+{&x{pw`tEjsMnKiRlSIZ4|=Mx z!;V|vuG=5RR=e)(Cl_Y7&%smJG!a@j2zUR@ukgzCr{IhWF2`k;T#D1ry%4ijHsh5$ zuf@sdT#Re4xe{|KyJGEOeR=KfgueZ1aLvW1niG7MdJ2tI!DI$VFxBUns-cUsW)S|o&sI49Kl|fc=J~9XkHNj4)Z@_KZ{>^r;B_{|>?!Y{ z-`b;Xdz;PI#uJadgwbQixzFPXUHIiOK$VeC`N>$Cn^4|v0RDCG?l|$_-{WkKp>s|> z9#4GMf5pY3BQm!U7`ApbuDkGL-1qXQ z*m{rOpxg8(@z0aa!{t|A$^4#%*FIl>DjK&A+YnGbZJ4PJ)opv=7kli6^Z&I!F1z}A zTztiiSlUt<-tb-Bt{&I^?^s-N<+V8S$fMC=-JP)M=pNh*w#T~bj>h@N{SOcDrfkC< ze~Y%WU&h~#IR#f5te!uXto3MlvN*leVX)ocA zhaQ6kjrt`LTBM)437)v~@6mVpn>g&Kler#TiKG8@EQW0RC#=`M&QF(}4+c~Cgv`+d zRJZSdr>;NUW8~Ch|ACJh24e5+#-aC+QCRiaGdSzwt8n%?XJRUE%ruS#J8V4xm!5JI z^L7=ky6qt}lvSacv?p)B3a6ic39h{I5-eEV2Wt)NiE+F95tSd`g?}7-Ca%8v3LJIJ zY50^Ixf$;~fCCRd3l;i=O#Q~(>Q^0}y5)SFeD)={g7b48dSld(z9?_o2^(~-z`3WM zhUea$$~A5iyl~t3xa^u6arT8*a4xE^)X&lX29-4(vEGDkxaI7Vaqm;Fp>ef-A%p$P zob?>GHfk2UgOks@6z83H2HyK>mY?QXlzL*lE7ltunz8QQhoOGTgE*2gTz>f_xc=U! zcx{VMc4SZERi6}n`|&e4`NUIj#no5i`HyB}gNf^yW%PO*GQM+h{e91(tou6n_4Y$> z++lwq-*q_osKfAO+i}=;=k>Xc^M<6X0ry^YF0Q=hIvo4=1F*2yX87fHV@P9M%ynz? zYIGmEA$HrS2mX8b;kf)-&ZYmI#+-Ekc!S!m-+K7t&THX>za5MVueb(hpL7h~T-Xi2 z-EC8^&l5J^6raEL1Ud~JhdQ=L4e5mkpPh~!w;gU@^IDX_bCHLplIvW{%d2~0zr8oZ zS^xSgF1`9%oOQwxcws?z&i^gYrtjM5wCFXitC!*2b56tCQ}orICUhCO8TQ(|8xH#8 z;kbgaoqHkIT;B8O7h=BsTlQLCyxV&!(BeR~QSjV|8rEE0NM)52)v5tkb^jNRQ z31wL1KDIv&R_&ns;9E3{B%D+@W-73K#~oCi3jGm6hWHdizEDPZ$0#k9S_6Lk>lyw7 z8uKSmFm#^y^rGB@KGg^c##H*$)Hy4@7;N zdVjn;pno4;RNJ6;|3Mhow^!t9#az5GWf}gs&z^qLq7-ZJcGUJunR zD^S~|4>!%*VQ|+fELmBGt#|(oHW@ntef#%AyS8o6qZe~Apsz0~tz{J$w${4nT-%J* z^<6P!Q19qz`Nr|nW8g>(>(w5M8>>hgimqL|VbHLVXjfNbzdLm4g+YUdpuVOGn{B-{ z+VbMLf}7}(V<%$#y2Hs4LqTIgd%3}5Ho>TYov>)p3ar2NuK3wj6VacW_HG^O(SNN8 z7&odvmMmC^E`!G6z=QWk_quX_3|`%)Ed~xAhVkofz!+-Ku4_-`b_6!y*zr?qZvOi) z*Ms`?@y4vGrXGFz4nm)vJyF}X9R>{?jGpYvKEucP*FF|6T!c>jM&VBf{t10MRHL#@ zH*B)e7|fe92ZP6Lg;05B z`mqdkZ91X<;GyW%tvyy()S*|Off(GUyXTRYJrlcbYbwYp?(U!_WB#5rfCK0*qAIXNV@CGnf>Dl6%*D{b z15l&C4X7+bd+HoKVhGw+Gk4@2%D(8^wiU~pDzVdE`*02oL;pd8fhE&$_w(Q4wA25F zdDFhdu!%c!Q?U~_C98R(Qi-wSC!%HPY_#j%7ej{)!6ut-g6ihw)KiXO>urUN$Mi*W zQyC_1wYA63%GGt);pe}?M&m|f(9q$S{MfBn*mVo+GI5Z9UN6=ME>?9Nu*J69qqcb| zmNk@Nqn&<(U+p}>UrQ;kszpzZhyHzfcwP0p;i-%_Ulpqs23#BF&0mW3Hs2B3Z8{!(nUhW&S8J`mDSEakLqkP-?ELdzVC<;j z=r>?6x^}F?oLO_Z5$=p%@BbH!?%x5ctJ`CT>&M5j9>olK#U&H2~DllSZ{;%(6oFp$7w%owB_~~+N~N3 zmo#CgefG!rwTEJ0zkaB#;~44NpJTI+$5Cr*1=bq30cx9;p}Ip4^7Q0r;U$b0srX2BbKUFShBrEu zZMl{X!kCF$V4XpoFmui#3>dow4*31v;MAe)GCcm$EBMRdN1$=uOmtgoV;uCSU!#4c zzH*|Am^zYilviQw##^FKTMj*LJU7|tSJ-yLwK$jhqXXBpVdFN%+5e!0))mFcGy~u;KX8Sh`>VMs2(U zcG`Mlu8{-LmDkcS8*Pd1)lFEs68PEPzsJVo*5dl!4_!O7LrVkaL&Iu}*=kShwZk~> zeJjwRdvA;w&N*Ghb)9kh>jfIeJiJtR?D(8;s*|F68d`4Xt<)vDuFnM?U6X^zs*w3Q zErhlcvP-mfX{;m`>+zFb>hg4CRRr6Jw-jb%fSa;sDnWIzv6ODTlI?hk9DD`-%twQ! z3!QXJ%J%G&kRcN_@romGj+0QJv8MQ9osjjSAASdWk_%k;>}t}g?VMWTr@Uy%j%-Lr z&W%oak0We^8v4|B*4Zxn>PZ&!osW1~4d#$@87FU4^LJWk!?wNm3w!pPG~xADLvG3+ z+a+7#blAd3m?geuuSiRtDi+)6R%t01Jews6nF+B~io<@)=d&Yi5l=B!3~B%fRm zH*s^)uV?V4X!UAsJSR<_hY7=aqdPAMT5J_d@vgF*T|wpaT_C{;Foi@E(oP27eFKhEu=a-Pk_W%&dpg>b);Kg<<Wd`(yp_kp3O7!Z5EM_7L>FwEU|C`mN$tDsI-!j1x&e71X4E;mf9E zD!B{M6A}GEh&HSOZLZ`;qrZ%)--r!cTBH@D!fa}y49o1JKws%lxA`yX+0OAabM@B1 z6QAW|SNd7k?+0K0-~BPS-_P-%zwC*C8|G^T=M*WmZYuNX{<)*)^@?uOI zP0jv}Bh>|td2-CsB|LeRa&0t~6QxRI8ET=Ut(?I6s<(2Z%t?vab9pc3~fWt3;{J$PuM>MJ7p zu3e@2TgC|bcr;&hbvLQM#BZTcvv|3wtEmYaiqCyaoelmzZj32?LMpoIO0oV`tzwG* zfSB?p8$7hA=)d?eWgforJLrle#+QZ-)%jZudYY^6bbFC8gkCMd>TgYA^@Vb#T#8NC zFC{_oYm?N>SgPw36MfKlXFio{k6Uu;dztP}Hl!zy1*y@^tzuIzX&e@EO`?AO&V5ZA zd9l>5Y^YzT+OcbnFZ%Rl?D>!D@Z{sy`RSeejAPg%gSupo_d;nrY3}In6JjjL)+**k z-`&(7Sys_+Tlp2l)S!1r5{t! zI3$`P5tP5`vG`l;ci=Jj=jB&o!|uFcA;oKe9Hg+urpADLP+Lz$n&o%$Pi}e6)2N@0 zru@pT=DdDOTTdw}DyzK4h+jED<4R1r|3M7cVEfn<+W>8{Q}qXb8Z!d*r{;zH)*m=a zw_?+GbUm(#*BmZ>Uz>gr8L<}Ql$^p=&V7+iYk|h6))s~95XmIJ{dEwHArTl&RSoAP zWwkcy533c6Vsz}3*SaftBPpV_xjL=QF|PFQ=}9DWjULGp>?57fCr4T;B(L0S1zWv* z9u7S8KpcMR%@{wRjcHnckdko4zjar8qs`?We|gasF#usISxyS_pCs%9e7hJn0%&nqTSAKiN=U%UfN$G*VMO9dYocNlW&a8pN@Krm|A)wSTMz!aE>AD38V2BKB+-_)Eze;Vit%d zqvB;#VY7*7W*%sXcUOeIziy2a3G0{{{{hN6VYDhvn+ygNWV2V3|4K$E|VpzDlB-y=CPDwQB(gcqLn)}e|NtyhBB{k%Ilg7TPS8d z^QJ;KWEIP2;9tj_i$9$3KdjxkKJ=E@T_bNknZUOcn&_rZvg(VhOceN3CLqCCOJhUd zQ`J`t{QZAH_ElALigyjP2x~xYn(hlpvll{#i_0`@w)07A@iG8d^}heN|4doeXU-(0LPtl9QHf>46NO!t#3q46QAd*Dr&Lf z7+C($rhFGI$6^J+qq@UWTc|8AmLEWta+!5zM3Rfyz!8vq_(^@Pr=F!xF(<@Bf@l`i zDR|uScv7wtgLo57_2`GdTPoYv7#65$^^#*VZ#1k%gpkd?I<%oVhG`A1>rpu^t+2qY#nGj1Mr~C65xm0`4ac zd1yH{j4RRU!?CRiZfCyayDyxs1m4w>(l%0Q_yJ!&1ciy1W8jhL>h@wiAlLN-s9ldi z*#B=Q;KXAOL$ADHE&=oMWZ8lbMc<+w^n7Hx1>FkB{ibv2A;^A4U7Lnn|9>1=XYwt| zV$6bEcRTT|;T!Xo?d9mjRl?zOJ~EWzGCoTcZte)KrEw8QG1gX%gF*~0iew1mCX(#^!<=hOWtzeQ1fr3~%1g>ZM$#$u40#(&FdU{;=Dub|;EA+k4oKpo|C5NEE zmu%<{nu+ikWBWQ-ft8uTdDUYCZ&_6>#z=*LetpDc0A7Qheqs<;iUyJh{~7N|nUjJmUSL79x@(4=tJ`y7P=DtrpDj$h#zMNOnGNq)*Iq;G7@i3I~{a+3lDwNWZ zpg@<>1oE|1MrW0UJ}0bkt!Jf_&!v1$b_%7>QTmX6^M$Ve*C8m{%15?Y0%_ehE|uo9 zEzw0Ng6SqCzLMD1fD*ajBIHHFx)UzJkA6KvU-r&>c}Zxe9Z$L>mL2$M5L?{gL|veE zEGl`kr5_SkQy-h;fK}2CM~rCdMDO**XMZTmyTfoj{8P&Vj67<4f8!HZ3-ZdYFMgDl zoK*SlMfS+2yEXgEmp&s1A5|tlWFg%Ji4rAWZsdWM?oV`=r&2`4#M1htOL8pDC%g8s z$S*e4b+)IZ+b7n`E9=l_;2_kL>!}-^w`h8iMSg~?Fd=VkR2o0F?y4dBkbD%3@sR8p z%T}83I_t2m=nNMIC7k~0zcOXLQISp6i}G<0r4wuZ!ar}5<*{;;KXy|(3<{5Q*|Lwx zfJ%RaBi&Xe25NU*b`^Wj@*QVjT!}W>{Bf;7e5NM*JoG_P=o3GE6Dyl8HHM@lNySE* zI#?)1RTQcHR$F{&`~-+sa?%r6X_CC`d+-QLoiYng zkUT6r-dHMs0zI9T2l_Zuc#jDl3SD+3Bi~d}cR6J$C968+ZNIV>y?S=@)8McvDajOb z$`;GWbq$se9lza$H!vt(NziD!SqE%MRt zZr!`1+A<>YO*`(_v<|4A`^@fHUtsJ*f?Ri`DGdKNF;P+s%0t#BoZKjlM|n5a>`7n3 zxqoDuX!nnV9YdJY$Dra8S~bPlnud^9${>UtmaYEWlx_OtCpY5b;kd;^gvT41g%QoU zb_}6IehV)#(0F*l*G=I*&Yh977l*Z}h8O7hax7P`n8zsr-jqdRS|H>{j=^C8Csb;#EDb*<>%X$q;q&Dh9r?AL=Pzr`ZsTb0fU@#Ve3LDOO22QEZZJI_+2!UB0-VDDSU_aoh?TZ%Pg6r^9O znpUi9NUNQuwQ~^piFL0qk9e40c`Zllxu~|wv6E5EI-y!0AE0$zks5F zoT$Lrd7oJl=TApiQQ*#ms2XJieRs)p9@e3%f+jsCeI#Dsuj3@%FdYr&M(V6HeDT0A zkLuCcO0;F^ga2o{`OFc#$yW9w1`WY{p;w@Kjy*5xu`DX-#*&8>%eYId*A(#+XN2{r z9#qAlpP*7{l;r(VUGJoabYl}w=rMx~=oBR7g>~nb=$sSzkaJ`)9`Q#B0Wp4b3Yzpt zt>d@R5jwaA4XdX>ngKe z7VO``*fAf01j`9jx*alVc-+dMY^yh|h+0K29JJ3;xaddXG9I#h zjhQ@OGOs77<<(BSw3Wx3L43j~&eRr!4!+YIlZZ7d&%%>0Y||h1leuh%Jk;lq=y;3^ zH6kant*;zNLVc6gmt@ZsxAT$d9#byamU4k?si}iF#o?A^d2$)_V#$ifO6XJO@>npa zB38!c2BS#xwmCvWXr_xMOEcDAw3R6aWj{ElWzVr z9|EGD=UqXLJbD?WIE5#!=pWk>W!+=TaSA0q;qy_Hv0v7uY>CV@&ju(ZnskzGnrs=z zH;+8_A~rEZp-PMk_duk`{J|^PuqB+3vBu^xt-5}mPW~x7_SH1$RYkl~>d1_D-8Awm zZq_Ady=D?GD~^@=*f+UPP1ZTJGseDChwTgHQ_u?iWgFzPzNlwEq%Lx3PM740c0Qy= zcQ;~7J{59g9@V2yyxygkK>3#~@k&>YH`cVsY3B2M6k0g(NJpZpB|Ogsok0sb=BH1E zSnOZ$O3?mkbFI2~M3+5@OV;|5tg5M0hQ*TU#`BOKH*7~Zl0;Dw5`VL-rHgs2J zn@PY4Qk#cd%_Q?HnQ9wbh?G^?RPPZZ9y0}R=oYZ03r5r;orJ6@2pSSim@sNUnIoog4AMQ=F3gX z(69Vdc}!ea917t~KM|2(`Zm|BS*hU7s>l`L&+B7+xtXp;@r`VIucp{Uv27~;z zZ8eQo89bIVNSH^OX9axhZVd6%nK37Oe(IxxSU>$H&0;)dse-hWMkSC*E-ulQDnhcU z-qYDFiHVIUW!(`m|5>a1(yA00nIy^tnl}icjr73EclUgYZVYl>&it6GG zYY{8k?j*`bVfnbi$x><)iVM4>bfOGdtVT?h3m!crh&9Ts;5UdbDKs|M6J(m$bP`Ll zt2{;9(JFK9LwiXctue*TTjEKw`6;UP(=Vrqb&;*t_DC|1#A#g(Cnazyt41=xtWZIX(>^^1*1qN^AsrMPY9h#@+2{H7Wu4GCsx(h zQ4bz}S{Ah^DWo!FiOpq+FDjG=&mN{jSZOQtCr^^|x|3y`x3G~c6RF&*%<)sF8OSFz zc`UDnL6NZ?A_Oz5k_wFtkLm;|CYQk{d#=f@DoM9viE7{p#nq))w?3spb)nR!G?~JP zc=8xwvI`nAjY7t;tvMH?&dsQaPwm7XPlki4WXopcDD?;1+Lz`Hr`tTm=9V$3Ply)P z^PDt~Tk;ulnQf>{*I>u&cVcqE7X8v6C_9`?O)P>~R|TR)&1sJo4F?L|4l{UzGADKG`lbQsLaCdZEZl2)0oIwqsQ8&>os=2G$rn-9$?>GRbCftjK3d^A z>ogT|MXt;vSOZPJ?15#9x&-+Xo{TEF`6s$W39I>r$~ILcZwZH#xd=89f9M~fFg8o@ zshaysP^7X(z1}2w?usY!nzO9<@&-AM;P?2D3WB8EKZ&R4mr7|0y@EKG@YrnTOE?vx z>+MppiZM8fe8H1EDCkbefDj9mD@1vamhuw{A_<#h3MN>Ii=yIZ+b13hJJ12L$HIq@ zz{yLRB);gEL)irdcn25{K<-%i04ZdT&RUE|W2ucBd)Xyn~ zeEk;$f6}S57eewC7R016oHT2=TGZjNG?(~F(mb;!yv3sJHP?`o6ler15sI&jBM7Ts z_!1~ueZXNb!DbUgCA+CP<@ghScw5wKVAE-{U%4R&K0Rg5AX zjU|0NNycT;r7`8$2+2(|hPIIL&mgIuaCWz(lqyl|ebV8~q`Jon6(yIfQ;^51K^4RW>0NAiE_z#_(0b8&BxOSK_0EnJpnwJqf$-Juc-R+tF(( zqb(8fWe+^JLLt$7XUY5#@Yl#po@#eV4^)g=Z6wOpJo8R;R&pXp2FFJf8L*~`n zPl6m4UvT7SE zA9+fR(4j_*zu?uOvlvK8yvZRsPTiq1>&_cn>n7MXQNk8{6p&tMk->RoHRJ3LPih;N zSmj+(?J{JDW2gn)^eG|_J;LX4X;l_7wlIGqR^e4oLgLNWPcbEM%tU*CASUTBA!kpb zAy+y+Y)5F8c`oH~DtBbpe>-AA)+C5{vX3$ESn?Ej0nZe)KFuNdEkce@hxr85M1!*9 ze>~$da&4;OW0^g0j8Q3;R2bI_nI$6UAf1zh!Tah`j0`0m1WB^(&3Xi;lgpn18`L2O z$e$QJI2E`9i~BC~C4ON<$%)i=VFaSNWJT69zd_1{h(;&xN$HC%OALm4e zqpF1;{@xay2`@5V#2+TJM&hW**XwjAlqvB?D4{QlXuzr-oPrV=D$akrC%oebiqEAv z6Q~G!_#Q*WJ!Z(V1`4}B=wrxBCO9&e*Q0DiKo;j*vV4U^2HI0B{>X(`CDYj8%KRlB z7+0|6isZ?sJHaGx8Pmc~Rn;}huMR;f3eI@a5?l~xRf(4El!hfx-L$0J<1hK(B*XwB zjy~oKEDz@+m4OkcE(@v!Rnh0M6_fxiz_IR=&bY-R@j_-;*J3GVT0jy{be+jz8QM{wiZ@N%g7#DiF2yDb>id8~-;hw6BdbjyjS*)& z5z754Fh7|yzw|_}1+4(~EBh9H2A%w@=ZjK87C?G+n40R+u2PW4P}ZGe$o`4jc_lew zWXW@+JW9(@k;?2CbVft+Ehjl%}%cInB0bKM@*RlFi&^ zvd^sBjtiDLCt#H#Ax{QRM~MkZVsJ{5Eh{R@%YLAu6xK~O3cLZuRy?(n4)=kjSlaIZ zkA0O%xU}@z%sfZ`1tIK)kiXs|Tq?CLXL)ZjRHi3prI4n)A^)h9<&CFrS)cnjddDWY zK13XALRcas<9U5?L0q;M%srbS zwf3wp*-5NkI%;UZUvhq|~Cs`u5#k0qvCz9D%MkQ-g(>%#u z6p^Fi?W6o7R(#q|u(WO-UUzwvg6BO;ubsi}c`IBp!!pUpH&t_dVp73URma3bbzgE4 zUE1_=U3OSa8j6r~T2^I})x#0xQ*%UfF5^|^z86Y|ZD%|Wf!fxmmrd|QMvb}RxD#Ko z;r zlXT>|bW@2ZBg@bw(3Fz$kV;ow^IKjekKk8bSQV+lL;V@{qYvW38n&fMutsip3bY$> z7J`+0Q49M4#wB!S&i;FBsZ6>g=XOz?ZDNd%h1fo2dQmLtv3BFsE(OJ4oXO$}J{R<( zpd+C(IS|TW))Br0o)RAO@yZv(kQEPPeFN4u4SuvlGM7WO= zpQ_;zfsDahgo141w_L6>p3EP4QmjR3`7B#m_D8yT_&Q+)MiHWK1oBw6LxJ=ZOWSd~ zm=Ddx!g@r|I;V5!6P^|ES~T^GX-T(bL$_>)h!|AKkp!uXIEGS{+Jk)@L&!ElCP+y)eN$U}9+xT;pY^3f@^J)cSonJELkM9* zw?8QmXDV~v*T{7Ns8dRlO|KnNZaqc*up8$L*}sqs7oucM@)Wj&ol@@92pw@IIA1D> zQ$;gSDi`-y3CVzpT*Is1Ph`UY_)}^G0ZjxwKv~$&&14Y3uXi;NC6)`apy^ zvu+;oOen0!#U#Gf>n_n)F>moHhW%1S17pi#d-aGaKi~jSF+`v-DIcOZq#CYVcHeDL^Zuo-A)3`5>LKs0vcrtW!ww#aDwO z_OKN3`<(jH`l#GEHG~tVedkLk^RXg*riU!w#zz@CgcZhWQ(KU4hNZ^A@SUF^M3MBU zMMBi$$a6p43I$FG=E_|b3WCnLBps0%t~L(7s5>+TWUM*qnES;H#HDIzOK2yTt%5yO z!l(Ftd=Y{rGfH#JROKkfA?xmIm12@6wo;zO8J;PU7*pcT<2jy^1wH(d9`%a@R*Q#t zbp$=?k-s>RSL2Y7H;PeDWS-sEwCNe3`D8xfBQw!AS%2VE1}E!QnecjBv2?bwn?;OV z2t@O^6W)9R(%lTM$R9P+Z)2=Og0U`#KUNefd?GIC^Sst~N0ocl#U1%&-OlBF#uy6E zldeLX1g~=e1^+Z?Btt!(dzpctzR7(jP)$w8nlyzK)^$B#wU`;NW`$BUTTD4H#;iIi ze-@7u8!GIha!xrsZgf~t;X&li1*dt{KUY(+ULT5-C>z8~=gwQ1{1w5{ek9yV-W0(XX zgpU@Fv;vx>I0aGWl}H){szo*A)qnYq)SXM}PLT(1p(Xv230t|H^;rWO#&})Up?JiR zBs6YZ2Brw&6FJs+`5YdF51~sC_F@khn1INA@+O@LVsZaC(`?6FHK)dVW=yKGO@osu zRT_L^6y8T>2=xC6LL>rUz!6t|ds_HB$V_OQw@4%Ta(cDfizXK^L2d0{u zMcu-PiASmpn@3lGj4|$Q#7q&oT*@cmkt3s{+ZnU}+YW zi6=9OV2o&?D_#Ma>Y8~~3qOhzEOR729|9-CI&+yR2@`EM0^=sd3VJQ0Qn@Y3iFjLS z-@L(-Nx7eX3?Wy1t;wglHyc!<2-W*V`#Os!Vs|UK*oX(`JDR_9Df1mmnv zKCsk6Z<0>IP{?8M8Wp8v{EAW#tUtoI<(K5rOSJ&;WbB%h0*)*(FG{JbkzhI%>t)7d zGxKWE4{G9}p3qRhxc);hjp$M?>2`Q-=X?ePCOAcLDP~U`9jV}9f9-RsmyF4TbQ$Zi zv1^v1=T%#>iJ}w*&6GH@UY~;&z*eGVsHiI0wEn()1eyJ%OebdES zl1Ay3^yQn008`l1rbI77N^Wq3OhD$9OQE^&%DR)@;yH5^A;(^XV%z=4YUZ&9o@CEG zYvK=i^omVY)YpW-1SM+4R`yrA<3>H>)W=1AQL^T@FeyoHmAptQjC(hDcn>5&$we%x zW}X7CA(g4)qQ$evasl~aF@+*AiE%2yqK9K^a zhReide&L*=WZSPK&v;3fYFKOLob4OWMB0Jl9Bb`&=C&$m2IXR1y|xJfxs2Pa)~YCO>NPH4ufd~ zCnh!W&RYLAP#4xHdC!)3d|2qmpl^3sq3+tFXPrFPD5wwuVj&TzRQQ&YLo#4Y%n5&7 zU?tixr2Efwa=~-fsxtKQ?7Jd*Bzc`0YMMD1y(jA zHu=iJa;c)Td||HD3bxeevaRu{ss!1NJ8L7z?+mzE^iOz!BX%u4I%3HlwjNRQOKMrF zVs^=;QhtySbChirEFEJ>%u&q&nF%m4xSu1DbZ3te? zDV;@-&x(&2IwNUQNlHCK8rLT_JXeU(S&(le%*4`jKh3k?i@B#(#sn+Ril2v~3JIap zXr@ngzwlz6x~++LYhqlXnJopypq*c1d1j%*<4J*dPS7LzCyspbTqaNWt%GOb44Mz> z?@W^|;Z;w5%ZADXK?z%)ORVKJu>h*_2;Z|N`K6b!J`|Jt(y=Ng35i!NQN$%%LTf&- z@2JpJ#pyAlei5hDgl_7{`E>47QQt~l`Vzm!kNr?9$wVBK&2vQSE9bW4M2lEMw>(s7 z5hl`m2B{JcE5RG!uxL7uALq_Uf|T$Gt&-1D#HFzkjlxL;y{)+TU3oH^w-|?8VvH^$ zZ}=ozrYiRm%RHtsuWHLbH3?o*qgwQvn6SWD6&p|Ct7MrS>X4MDgW1%7!i4USC74fE zc{XqKy|2l#mHm={6|qm0Yc~p6TSH%Nn}-#({IFbYVTIQC38s)?KZ_;nRbTm9DS3|_ zF(>r~Rzwqnfj)cONQTic){rUE1*Lkl&s9!bl3YP~;Wc*TO9hXt-tHHGNZ~!mQaw&I zDq-Q&Htr|D9YJ6w^zz3p@_?P_kAch-OPrL%rbJ3J&fP$YIznen*`!mziU+&pH2>t6 z+BO-uDVtJGQ8GO8O#Ug>vRhGmb3@YbbBgJ$t0YJSS;k22-2Ix}?S zC6X=N%$;zwvA_@I75-;g!jf#6M^`MEp$p=Q_%fniGXN@u>MLtFAUPJ zQ6nF0Q+D_^KB}qDnLE*x7ZRO+(%hy_<;HEbh|3#W%gbSviaTnu=u&58)A{9MY%wAo zcj61*g4?AI`9g62lR^CUz&?s1Y4K2p+N|2PWqG7BWaV?-rYE`%)p_KLv;8nGX)d%w znSEEOd}W@*?|Aig-?L(zK>ZPl93SOf3Xw{&J4XqtLr7`K!5Obu)H&>b^;IDr;!ESP zd_?V9v~8q>PF?zrh5d2U;E!jiFZY@Jh(E~9-m&dr6z$@IZ&e{fkZ&O#d>S*#pHd;u z?7eW7l^!1QPcE4!&%%h)9!c1BVP#i7Mx4?T_yCU|>5(wUU04yH=Amq{9vvDl^5#v5 z8WQtbmi=;EiC488zh1H>V4=1=ieHN0JLMxd17ustiOrJP?3sVfCi6=_4eRH!lnM2B zjx%aeXJL@PwxG3yjmT9H!#`8gnfxq7&26>}Uonncmt6Fj%n>IYq$zemUPB@uqOqia z+K$_X#Ud$JtT~U1ID+D_C|}srd~x5i9x;Ypk4H8gpYX!cFW1GJ{L{Jk3V!>flj@d? z!@89Z)d|L%hqZV|e)Z zNi{n=>r>k_`(Vqq9rB^qrN)QW=JaxI%`F|`kC+58CSo3nONV>FBH@#H91Ba?vmc=~ zgZ(Q&x;dbnav)!{57y0^`_8@vuo{pNx^Rlg{OOSIE~EPY1JZ!t5d$OSY&<7I=af{R zMDtsSd_`nT%av$ ztS4orCn&Y&)n66qiW?3Ohk~zClcvg-zG zs_^gzNuYMhg-MbMmKZNAbt?Luh=NpRRYasicBGakb)4FPvWRqrh%myLV*SC8+X9`# zzQ(Qu^VpNz8vUlew>%LRqYfpI@x_HEXi<-50nbA>CqWT`MV>3klVA%Dfoz7P&^qVd zkX;wiP7Tk!B#}9zNP2VR32(*w1S1fY$ ztTYeiiB@shwdSB@x{4G_v=xI;awhzc|Dx*bu|ZINV;#%HRIV|{qOd7eO!khLHR_36 zCVQ@CX3<&5?+_-0jEcadN;Fa_UzLXf!lhiY73xwvSuEx&PqslhFW8wHht4iD-lZT) znQ|^%&oSvB6m%u{VVhuo9H!O}(ZYY(@#Jy~FlFExahjz9-kgr^dBBwbvK zjZN)Rp9%JX_Sp`$)NcZ@dVNTB6&}=K-#!^DP>n|_%%AEZnko^5kBl$X6E&XY9}|?v zi+Nq<$Vpe5hnC+=H`=d+R7JQj#!5mEq$_xHI{|sj#WLbd{lm6$rTMT%ZcB6qs_3r{ zZ)I4G^}=ih>2gUUS%1VVCLPHmi}OWPOe@iZmS9A$SGKFe`HNZ{(qTP160QJIw^`LC zMzB`xuwhz;)K>zLl5zKas;>b*z&Y#E$3w4pbeb6wEvm^0@s=u4TYSa3*{CM> z=^8QSd>F{9q$y`kc+eyz$hLJ39i*rvB1onryxIYUuFANWVgYhW?}AIRtK#<9oZBA)$Kjcu_LLQYAGy5&vd zuwf&%YpUq!glOc_h%_hBYr2vMR``j|%K_9u#RN zi5wrXsTOxbUW>)YQfl%?Ki+t$lwF}@*XqQmG73R76`vF+hLDy2uBDSj$*e=Dh>f5S zRPrPV>rvkIO1kvKDdG&-+?OgGPXuCF#o(6vjWse`Ps){E0a1o3^6ILt{3w5>5L9Qw zhuh+#KBp;iDJ#Ymq(lsVr8}@v5Ut=#rTwzm@STeD#M9Ykq+ghHvb5{s7f;p~>U=$= zV7N$xd=`HO=OZLy{0J2z)gQN;C+HbuC+p5n&nz!uK{?y}=!b5)BwTMwq5(+mKW>%eLX`WoNo&558sHV}%NePeWY5GFDDtN%Rv|O5nRe8@$!c)aah0RqD4uUpYqGG5ox?GbgGA( zEICTYCAxs^JRhagI19TG-6RhaPDtsbNMQM5{^fDbU@Z z#bLwV-4j^No0Gt#c)~f>8CfVzrRXeGb)qQ8GV;qeQS!MkZVC{-IX|phd*K=(0t*jy z?>n`lLq;;*9{PGieHLRAe~ zH2w(4kporBS9^jrMfLv*nJ0+}BB1{}#A2F3^+-TfbtS5+D|}S(a581X>_wSaNE0Mo zfeJ^YzoN1dZR;v2o|3!o)cO{5ns1y8Q632bLw-aM$}p`OT~ zi<_WeGqveU3>ZSep|bFyA`cMq@-1@i7K7r*w#=1u8gl=Y3P>ciQw|D{O=q-hsgZ36 zmHbp$S;agtrxBxKU}4oIdP}NB_<^4V-I4c-3K>rNR4w8Ckqs8|B|<6DSpo%l%9fQ^ zpuV;O6?ujv2%ap@(h5_%gl`QXPkBWp>T4=}5evB>3Ch@aibvzFczO9DB$;Gm&Aj}C zVWNs0tcm4EY+5wfPxL9~R^t1=Leg3qcZMYE{$}n(U(-+4)s(+$h_dlRl)$*4Wr$Eq zI7Ked*Tf6THJ>?8Gs~L&M|xGzJ$uCD{wV>)DHM;eljvn3r|-C#M{KT^Mx4f`pmcr< zN4`p~8`YI%sIH2mLK}(TFuhdIPlD_gK=o)_@`oY?#XvRvuB~1J<%^7<6ep0bpUiKr zlU7?(jvD$OP_l-IMd%Wxx<*xV-d0yBcA%=Nl&pC|9CK1?Gq3xa?>efPH}QD0RH9po z%v*|+e5z##OetRphj44;m5|460ZJRJ|Ab7T4-(C7*27=6)?^R9wC-o#A3;g5j#Ebg z_d|sQv1DD=UF7)*Zh{3$AT>&TvEzZa?llDnC2h*dz2GZCF^nRrqDDcodQ$-%26z z`J92cHIi3SUxP95k=GI)RZE%ysrS}2WGL;|BDsi-{Hj*M_Y=4^m6zfP=1;f+o7yFO zrvE^$w8?rgj|m)msvATP#1A+NP|#sE#;Gxpb(H8z-6ElZpZ#w(o0s8<+porv zNBs})f3*OW6}&JraCskA^xd&26=I5rKGQ2dX%dMRxG`1TKC+_N<4%Y;ZeoR#f96pm z>5uOyakEuZhVza+60dwVlNTahaU58D$e{-Tg}zk3(RO?g6xiHy{MsN(znn?L>E~b^p`8riz=G=f>$7$spgQBN5?C!6tfO(n7?}S5uADHJ-q4Qj!2BA z$)AYC7@qVoyG4~p^JNR^Bw}7$NHR*VWG`MhH)4-@Vz)HD*pG9jypF#geGbZbQzG?x z!s_A0c*-j)u;lZn@vl>_!;03pp=oU)6BR^k@-cL4-ukH^GbR9gZu zZVNvJnLH7{qq5H_UM8ZFo4&87FUOmoFTtCiEx~(Jmtp3DM&7iu7d`#en-o*h+)7&6 zwC;HGq)IvxSK3a7?;=H7O|If*`PFB>!ELXu;0Ba9%P}ux7Jt5JaL(nq$gZoxe$rS; zGU~D#^4$N>H+bNaW!^aJ?;CuxO}}FtMh*nJIa{%;5g$%niZ?%H+@CJR+g~h4D`OVu zreX2I27LB?1AUP^^Y3vHHxx|`O_=iaGQ9E0Vth1hCD(bb*^I&Ky4|8Rt$7r&zgBAx z{L1q~ap;hYM^BhHkCNcOH(^z*TGJ(=L(v6a&~*6c*d%Ga7`Q zLo)hOwlub5eP+w^%pQ&#lV<*&EBP-VLJPRqm^?hHli#PLAyXoSSqohbiH04L7 zUZQ6oN!J=_>k^f`IISY|*+=_HF6kvPc|^RqiBhhk?KM#*#N}!UubBxN$`X(|f?ZCp zXt+j*IDBno%(83c1kv+%o`rH)%B?9jz*^|>-+-t>M(_LFP#n$z&2bH+f|&aOT9;k= zM7_G^8b@8SC;e6%UJ1f_)*iW4f7%k0VZI!jN>zM{8126DE(F(Rugh!*6FBN(CG3gW z0;v^x+(iTxvg~-1P>dtuT~~hwuYjhcEK~+WazY8QiCI;*-H4(T#1-z=f~#s}g+9_s za#U7c&J8hjm2=aOeYQRGl%svyI@{Fd*dI+uk2biTIAy4+DaRMDJ%n4H`~W-bzB~GM zsfV_Rx|mvq_6n(x9qZA;uPjq9eNzXhoq6>n(skO;@lhc!qH)N!pQ=}tWAf9F;E~rp z;f7hf&8V&I^8;7=J~jbVrV) z%8QpuvB-bY-IwL7@b2rcVnvhsFk*K8luxw4CDEcQ|@?GOfb~R?hg|MloY0b;#;e&TS!YWQO{}sG!kf)BD znCI`j7_WTYid}cx8Eq<+&*&c=u_24Tk-s_b&Y^tbp?bt4R@K8#;R=x2Isf9TtZ2q_ z58lKL+kDjO6B@pv-(`a(#WZdNo+t71O zi2e{M%kt2lA8R~Fx93XoL43+`j?wWeA0m(%xu%rq@-y-CrS8zFV|_gu&8@b44POMU zt>x(0u8sX}UNQrB-+VXbuA)1R*An)>Vs!%^x%Vb~F=H{RtIJTidI?^8>0RDjvwx|t zf;pEC`EToNDA#(@O|)ZHfQpe$puVyZ=U@Ce&U;`s?t5`AZn%FM4nO-d-0;$ZxIm^= zSQ)S$kJWI=JA08Yw_;T7(e6^s7Jc>K)*;fjB&8Mj5N)_|=$$NA0&nu?luIK0B?q}!V z!B-Zc*-wqRp)YU6-4A|+zn(J{-z;l|@3E<;l1ApuScDTV{Q_s+`7Q2!VID5OZ7TkA z^>j>I(8_TvyD}*6Vy;9C#hUTXf3yT~LsHV#NjUQ4{0A;{W>IH><~#;jjkX%97xR=4 zpM~R*L=3s*m+h$}j_;O@verIa6e-z%P2})7v`DC|Xeb$64e}sU#m|B%6G)u0#?8xqMb=?S^9PINRZ>QC#V?B`Ki!D!n0Gu` zkBIT+$(mF%6k6esYT*-QBlav9U@rNshUTwJ9>!_ymc2yhx!`jFqmy`2-8@#{S3ur4 z6C0$|mOb&aD2c;oHyO2bv0k9CnN;vdXR*i!(d)=mb?IXV*{*Qz7$O@tysEfE|x6k<&-$7YH4mk-!a?bcfZ;J^%bkp(6AhhEzM|L zu>^DG&c({6R_kbKXu;=GzCgD@!!dgFD0J#j=ZnjVWeYK9&TK4Q-r$X{F7hqS4Q#JO zE6X`^=X+sTzI+8*<=ebDSWMoUnhG?nT1wfuXrNzus^W>z+=PYm=U~q4+4Pqe59(}M zxft)h{5;^(ybQ}5s_@&x4#k*3-O$Xtu}WT~8&@sE?Af!haM2P!>6IU=TbrRRWe#KFGQqU1i`25kjAia@ELpa~IyLE5)8}O?xua-Vg?ZGm zm~mC;>2~TdCz1LW%$$nHo_Yq~&YXiK4dGLDZ7o__S}>P#OINI7ex#G;w1HXOgn4sj zVbPLhy5hQztjc48FWT0VIr%hq-Xb(|2-H%azu(Dz*2mn-7SE^dxmZm9s(7`nEN{W$ zMT^nGJh~s6R?#l~WqjKFuAr_)j@yRi%b2$oEMGDo^A;@f9k%Q%-m2;X1beA?3l)@DMbd|t9>9`m?_daKya)z+sWuX&*QipC~Po$?*} zt-C%(jTnadI&EfwMGNNI*2>0~WJ^!lRw@$a!Y6-rCfFCG5wtR`PRK55B}&WA3EMr@l@UKyD{aCh=iv=;uSJD>Sa~C&aG4IwStMuq* z#2Zc4wVuhwf+dZZzoZFG^pRv~Gk)>1M$B2&iZJ- zg6rl&>XE;zC}Z%_pmD@Hb*!~^C!BfkAe?pZ5S;M4-l*n!s+*>HvzBA(sw!+Zs2oqe zw~ThkPG9QLfTPa;5?w}h$L0STfiwOx7#ANk3Y&Ln#y_w6nz@q0k=1y@75$b*tIxS5 z|CKZM1xv-rYS45UOL*s#*Ba$K%`)7-MsR9DI1Fhz&LbL6N$LfMF>kba$L{EHv%E`lih(|c{Bng({6`eye1i2nOMO?JQ|ESADoib-gv7|$;CkA~g>TGHW~&;?wHl#>^xh#`YE zG7F}Eh!-X=!moDQQV+pW5an1k{|lUT;t6>4nHTWF(~si$*T2A+jW$8gHjTLIzyHCc zx2E8QNjG6h?I^6fR!?p~xVhs7bJi<&;PA^|!k#-%#Pc_wh^udZ0bhLdHtxIa7Cid= zyVz*^?XdX0$8rAEcjBAr)A7}e1sJozdidz^8*%0Z*W#_$UcsY}Jc<=Hy)b62zL@py zlla^JuEmn?UcN`9=>2}<!$W`?(mm$wZua*v`O! zZLv=O4tVF;yKw$_SK#HBU&Ip++=E%IJuqhUKs3$x6i5B%cubxC4W54Z9^7=pO{nQN z4kHJ3=Y>_-W>$F>uHwc1l?SiKd6!;~*I#)Vk3Y&->Uv`A$bR_d{l{>^X_sN<_l^g6B3*3B`H{U!qsrGCX|US-9$kyYb4)FW`}fA46-$!B}S)$4$!&oO{Fxc=DB3 z@W=yq0^sm3fthtpKzwr>q}#{nZTyl*GGdheCE;ky>X+kYWC;2?ve{J>9J?<=>2!&yA>U<$p*vFJZ}n4 zJob1z_ri;K;idP`fAo0t?^27$Zn+p&U3WWPeC|m+|MoOY+Y!k zFsdK!Dw{dJ7Gltt&KS~J>th+(cdSRZmKAv5qgB{tVkaz}xdi9mG#!t=w*)V}GZ(Ki zr(;LA$Ggvcja%Pq!q($DpmF{({N=!uw=#(9ChiJc>d#Mc<<9i`1t!q3>w)18}_Qe z1CzeRwUT+8Hd@NC@$fdh;g5@o9wdDC^P^7vBp`O6y3O4E~BlC(kg^-Qv}gfCYc0^C)As8l zOJU<36e$TG5{}hUpOcv7BK9O_TGY*N6>KLS*|P@e6Uj7N=b?JU<~C(=4CWWXJi?iQ zr|g5!I+l%@^m*vc4Znsq^g~pgEXha9yWx|P3IucT4(N8JO zG*ROmD#DilF{i5Q*-!b-X09YYk6-z3-K<-THRDp#xriv#628dGIgrPk1+rWkC(c*) zoi*ivb!!VogQ|rbrqViH4cTZ=zjWq75$Z&cb~o&=Py$s7@;tLpO`@up0AWC$zmjq* zpH_44A=>KoW=|9k$>I= z4{{^-<@^?3&=-FFF8Xc$XIy&j(Wq-_@p6*FT8u|8ykIIQM*<`~NZa7XX$WMf*QqyE8kpZgF?_1cHR%?(Pl= zAtAtvyF(x(0YV_bU4p+zf&>W?AVS>TWwTk|9o_vspQozNy|d)|{{MAvpRO+N>OOt? zoO|ca=RO+$_||dpm&@+dMQKJXz4O*sxbva$krTfV#~u5m_}bUL5zE%G*(J9;86Ak5 zF8E!1_IrPiw}1S^IF7!&{<+%xof?;F12#N7J+8m#@;LD6ua1v>=8N(2M{gHD{@zbx zoyO7m+AtYI^LL0>ANBg!VYgl54IlVqyyQuT#Q4NmTz|zi@!;nl5yzeUrFhPv3*$#W zJX72Ah+lsFbFpTthsG&iIxSB6@X_&)UwkVrziTY`8V2LdQ|}uU(+~c5Z5;FdPsJyW zKQ5m8;GN>O>^WIOW&!3I=zWMp_&Ewt|*N@DOgLRR={cnE~SFX?n z-e;Co2`082LtG}nlCqMnEc+kFE#;UbzJ$sqW%-;!3xJN(#sCeR``^4eT zJu2SymgmH|KloDo@1-O1^ZEGHXHJP1JZi`I=BZzgCCc%Pf${jyzb}awzUTOO*BhQ6 z(>0gwzWttf;FDe!C!Ks!>^XRCeDO!;#!KJwA@$|$am&BYh%0Vd8pE?TiO0S8b@9p1 zo*bur<@mVycRz@8uUiw(JL;G?{NP>V*{^+Py!FUu#hvH;BK~vhy!hZ}PmL3f|F|}Q zo5aNAdYuyz;Ji&OZI?aoy4hk6n}d<99z3*G}#k zpE~8sangw&ihIxfRh)D29Wj5i?c;^7dwU%Jxl`h!?|M~SaOQV(gBNkZFTN4?Ej%nf z`T5i0BOiWC?50io%@>{#KmE&1@#ar_E>8L4=VHgP3*yIrxk7V#&~b5pbZB$MTn7d_9(J{czoUofaSe@VjH%1q0HZh!LGX z0}Hl^Hy(3D?6KN|rtztxcaD?Zyhkivxjepg*3#I0w}o-< z-K%5e`1-i*jy3+HzJFi3(#9^mW;Ax&Wp3zHjXUofj~({eG){QqZteeK&f#kB1g#c@aP634$`*Vt>ry7=60@71}vAr3fn>v-RhyT<3e} z;gI>jTXKAF`EM63kH7q9d0cSgTF;kZ`8(_URq+6A*!SLjLChH)jmvM*SStTl-Ly_O z_j6;O&UbFk$<@S!&i^?xW8ZCt;*wid>&7~-4;)(mxDYZPzIK@4w~?Bjh6=6pk*}Cb z8iubA;9Ml?!j(_0lAfmqwB!K_9b#Tr$_aLg-G^u0u5E2oPe0M4g&kLJW&F)%qXMnA zQ|qhJ%|tZ|kZ(Eg!GdWISu2@mJ@+l2(xsdg{7x+WQzs8!$#?v!n{Vp=^`xhlH^3OM zAJLq*Bo#DU=?{ke=-6_X8odhW{;5SLpLk+DK}R45O@?mR;BP?a1`j8UggTcViQxD~81rUAfDLY7tpYEfIu|!>R-Go1tvHY`KSbHiv79LuM(@>T_Vgdd&wlj7IQyK-V)?zd#^pEM9WQ*@(__)x z;h4K<(|E=+pAvUmaCUHMnLaQS4|>F7Vuvjj`9j9WPuO)rbYK$+Ffk82>=Ci+Hd@5z zZyty2x1}ytcUg9(F4zNuGh&`LRagA$+}QDNYVE^S9kO9=zY4F>}U@c;F$2#Nr+Hi-Y#rI_53hHul|ZZY;fb zb?^<-HFsVcr+@v+as0mWS^AyX?*PIu#79SXo ze#q|HPz=SUo9!A;ICT5C^nz<*Qi2P%-Xjh>?1BC`b^ixGG}f(H9;?T6!D~5I$1b_( z{Mh}GPm6uFUZ_p-aO`#PBVy0(rpM*i+~j_5y3YgSVS8>FGlvIb_e1uJ!L@g5Q<1sz zBvS73s}ri{%=X25Vtg{T+yC%*@Xnh%Z~HvxfS7*oy)h>FfBfg77+k+9e*UAM#9uDH zHpcI|Gp@ew4u8}S@HFa*3;q#1AE29*T{hDOaCRK?*Ge`LWgShnX|B8Jc_O#f4 z$4#|~9*#W@d1CCbXe2JY>YjM$BOe|&Uv*L3cIyqXa@O|oiYM+9fBpN-ao*ql8hbtX zNwHA&rw`4IhaCQ>*m~Y@Y`*huvHPNFvE;t`ij1<$A5NY7+q2@JC%h;Q+Ep8b88hR6 zhd(uTn=u*}U3HsAV_IBs-dXXDQ%{aBeeLwPZP~rCesm-*Isfw5_i@jRofplDp_#++ zzz01%wwOCBpOPtAPPyin%=?#528U;9yRddwJ>FZteb&x2y-+NSUbrrwd~4 zJZ+x;_a|}YS^tccBg^B;>u+>Sm!JRF_}VF-i7$QQXR&1EeX&9}8@nI+&{%fGneo-H zpB~Fc2V$X;a_K*R7pn$m#if5cGk*5Jzl#xV7B4*Kk{DGScv-I--GMo~#^L)8$KTJt zQk%DH;<^>n;_(kXD8|MoJQsnz4|-TEzvztk@;81OOV>`1`7=%SlNQ#_S+jdOEmiy~0SFIh;JeaM1ua9lEoD&b(W1heM zb>N^M~VEk6jcuU%Dz*=|a46`Dpy+54Xli zKe#pidDBR&TsCgk;(+aE#@NJ$n5)5h)OIuCli#^H{(1dK zEYf;MKigUkFceGg9*JN4ZE5`M?0e(vtJW&l(_`&zOX9rML$S^LX|Z%HiBT%{10CGJd z2Dg)*Hu9NNkp~-5SX^y#Q8GZoQZGx=(l!9aPb_KZ&}Kq@wJ2k4TZpEX)cXPKRG$+h zMZU_e`_}TRMlY^@odT_;nG0`~OUlpS)lWCF7J_#E@nb?o?O4)>#T|zMyIS9D6+Ed~ zPw8AD9Melbl#s~wVm6J!Yfa#K;$T$rmJTYC51H z!)~5#HNc;FDtxbV-foYG&z*E)oObGI@s6XP8G{pRw8-+)M98Ebf1Hv}tYuHV9@a*I zC!Mxm*81aVz#q3vY8;WxuOQ^f!}odEY%?Jzv~Uk=lM3XiqG^N43Ud0qx&EUlU1#M( zHf(c4+MLM0;>QQyOytgL#?WxwbNxB-@e{rpTkZFtc-||IiANr=g9NZH9|*}o%RvLa z(lDSK0=t$Ur1_(#w(()5VuRrekT&lus(feFPh=#*xile!r_z9F^hGxO{U!NjgU7=o zHh+`4F!PlTJ4C)}|J8Hp0zwss^x&zm+4Drlqz)6~W3g`Snz(Q2cs$`%uZaV9SY#P& z0Fz_m8p~l@|-wH04t^ci8KI7{B+9xcrj;#K0zd$5Wp8;JD;( ze~5D~xFZgG%)yczPai6}=G!OnF?Q7z!-P6KJfs@|;pvyJjPR3L8{(YPzYstE>kV;$ zZj@g2nwQ6po6M2T_1Z*CY8*2z@|wD-4YYFyf9+iI#ap^VgM&qvp7PW-ef$;jTy1pG zB>y1rHfUbuTxMS5 z=}wNvT8;0j)obHHk9$Ep?!kM-@4off`1xP1h(jOq)Oh79UmDvio)sFh*y^CC#wR}T zrkJ(-ig^D!-w_ww&L5bupskOQwQFP5%9WCNe7x{U2j@H%kR9gMVGln%uDa;rxZ2KO-zYgFA2m0Zzh%P&f zPj7CJH@>Pi>D-Ugf6WPalT6adF~z$kmaQ6z!=Cosc*OoY#<(V#$DN!@&V?0Lh50l~ z<>Jd%#1`Akj#-1OSDbqpg2xtF#W*x)D0W(`8`&FH$L-4|V)ui$h@E02{&vyIn7!Go z*kPgOfaH83lpfy;XN^KXV{bq#x-k@ku>5pL>m-}|nd{cZd%u2btY0`cp8w=+;_>^= ziUHZ=s}z%piBQ`4W;5c=&`sfcj@mU2-FzTU|LKi!+F48e6*^?_ix2d7*?VDp{@C5( z)VJ&&Z-2^WifuB^`lmMitH%%SlM_qH z(Y9VASAKw!DVBMzn}GGPNdy&}q#EB}ApozO7rW}DWb8nnjKJq7ENUY?UMJY^m*UR3 zr=3jWcQTX?@Y!Ol0yr6s*T+!hCUgM*9Sxx2cY=|WY0%7NZ+pI}0OzdH1x-Gyq-VZ2 z0_Zw48OxVYFTNyrZ-PwGTOWG9)4pl8M5FY26w{iG9HX=g*i+-t0!PLIePiURY$nU` zSl=8S8(meq1{;c=oJJH@vK`w{IWw>P3+&5rRhxrwpBqBl7I+My(=fkuY3tbbE9f;| z_7`?9XX#mmxA?rwL#bE>c&&|@!qX=N^zaU&9g*v`U5KYBu9KK@$uM|rygzWl?GJal zq)D;P53ZH}2V^3M*v>HHw%+L4KphBr_76DcIpGs?qYVj1y0EZ3Az7ISw zuKxQkcWlv&L$T%Q@IZIaQo7g^3I#DiPiJA ziDy0P(AaUafw=VYYh%4OFTjkU^|9>kB{AAXqyA_|zQgVZ$Lb~L$3Omai-%yi z7v3HRKX|{GHo*ol<$WXuAPJLkmckRW0j~nhDh=casRehOo z+~`lqhYv}^CO_R5qoZ-}(&e@ZG~WO?8x$_$`|rL-%-eF8c-bpo5wCdV%i;--c|>fx zg+@t=*rOji?zK-`dj45){oRUbQWw+T{yc78J0x7Wf5^dc*9%{t=JVIY&wg}9?EBz{#x@5(CMGU8J^r?0lX&P(+T3~@L>^jfnUlhV zulGjo&?g)o=l=G4apkQm#8@9!p7Yzde%icv=)POW`4?Oodq48&@rXnAiZ%D%5_jCI zI0lAe&)v3-^UnC+SUM^%ngi#Y{oA;6#X3JZmuYpb^6qBFz?N(OJ@$$}{NiV^jNeVv zygBzzXU5q4J!8kM=Xz7mTtcT`kC?r98Ltu5!8Vnoo36Pb7VYy8#kfxluel?xyJsXf ze~N)8UiU6t>hV~$bXm;aa<_Qd>)#$PdiZwno4=f=c`*{#UU!?U+p6X!UNy#pGveM$ z{-sUrI>&M0-+vqTtz8tm?y$MynOuhT>7r ze2H#MUKP)J%G2YJ2kaWt{I#kC?aO2ThdnMv@47I4{EM^V!H<2SbUa)n!ZP>XyEL}h z^MUcE_k1WGuy|Gc{oJcH2k|Pt-rO8cjIM|k%T{@faDHIP2A^ngW56HwaX(TSPhEpr zH8zLp99loHNj&FeuZ&l`>J{;{XFMr(--fTcaI=`_aLeboHiF~2`CPeTB>wp4o8tRd zM!fv7o5rF|XU0}D*T)&!OpdZq9iNCZ{=F>r-F0CMPalkj?maL5bk037qMNzxX3dBL zcO8uH{O0c1|G>pDk65xxuJJ^vG!&1r#Ks@KE z+s0d-x+pIA&kAjH^8rGO1FsY6?`rjD)#yZw=tg4AeQV=ee_I*fIPSnW{R4Z&cUAuP zV|&E|=1;_r&R-e3K4_cRb7FOzaQf|W=c)-mU0%L)b)0tkt+C@nwu}SkMJ!)78aLge zNuU91>nsoZ@R_}B=S5NgZ@=|sj2)XN3vFxHO;p|p(TB7Hr);P~msQGh1(K&z*`YML z4&=*J=9Ycx)#-6#YGYpXkhhHGu*YhZbVKnR5Eg7Z!S+-LquXoHrWRtp=BneNT?HHb z6dE_;ZPN$cy_U1Oj9K5Yh+a~zfvoYA!fxw8AJP^F@yw81npRUBXpls}LVFtTBQn;f zm40nR#5P9Yej!5NEt`IUE?#U^-+|1mU3d+mCUI#q#V9Rbwn1=5tJZu8TYYMHVh)VuE&Fs3*07v>oMs=LbF|Uh$+o z;{(UMCf;<^5%H<7oDolX=@GHRqG^t8bgXP(Uz-@)gdo5lZJw0iWnz3ZMn*(tsCd(x-WLyf**kTC-6Y1w6#Lj{UI-k_dc`%SHXFxG1W%54dcYIoRZrM0 z-u;FnmZRbu zzxhuL4^Fp#yVZdw;`EumJo^=|i97%Py?D*bUlqq3{f79)4}KeC3a5r%o0!Si`>kvBw-0pZdn{<2kQ+V{9{LFrNCn=f^+3_Re_K>)se=o^wSE z4G(JkCgOm{KQErJ$3(pHB`=A$y!D-N`5hB6ch-=f__dQfmmubq{AgbBvuKAs^QCdv z7R%$P*SuO|cx3$OuQ$cZwDDS~gp4Ux-?%u|%r!AOr`XXvn9z<6ocJe{^U;ZE@u0^( zF4kS}qj=?!Z-_7cp@w(T)DbD=o)iF3cT{jdP;_^TL zC|bD*_p*5Xk*|yQzVF1iZIw3uwK_3w>$Q=a zz4dKE#4FXmqvNJod&iR>vA1$G>dhV- z;kjGw68r5kJwBni^z*YX@uxJ|+YK==XJH(Ez<%1;y*obto!@DW@@pnz-drQYoMw)X z2!HYsZ;QC%^f>BOuZ%Ywc~qSIduFv}s%)JM1_+MwhIMMLW*- zS8I0Ner{Z|TpRYCX2vMzqv9GHQ(lxC<_Di-@f8ZzwMo_Vm#n<{h19g0x6)`i8e$=8E-gZGea^86S&+%8shktlStd!1lK3SSMJKp~CZQ|Qsy*iFQ>Du_l zAMcGBGx^+SKr@7^Ahd~zVW%n83_pL}P=p}R8A@4hx)&FR{z>;5KfSr(=>t8H!y z+K+Jcm9H`s$A?tYfeEX+t+yt(qC+cObzL{Wp4w~;GY0so(~QBtgLvF5Khy|0pmrRrVlh!aG^G&{8U?g!3h-F;M73HY@24QO>SV}Lr89j$ZZywP91gg zX*|I?ZWTrCuIP}y$ZtvbkbaF9!*W8(W#T%bN!|UNBm88z?Y@JQdchx$^MdhE`BBSYDSMS%j;Hi z;_e8qmh0|@fOhdXHW>r?wNQ?M=L0nF!zjW$v9=8-r0wLaFa9f_H<=ST;Cqp?<3xjA!Z(QWxu zyaTgh&a7eo#Mtr`D`RN(0&ViN3F7vYvyv}j?hTeDmjuK6)TG4OrT zb*opzYJL`Ncy=sWI8Qm6@I`&?$Y{)(HOD#RC$Uzp8I9RteaaiO-^E&zTqeW-!0#QBy>8<$wLS?D6D!M$BI@FUHoc zjv?9RW9{kFCdFH!O~Pah&sDtglV4BBpPCzyui4~R#zv*LUh`qru=1$6w{F$in9lc! z{W1N9Si5R<%$PgZzap~6<22V}J6%aywR}a4$j2=Cm^)`!{h0JuYgVsRu0)@=V4*hQ zBQZEM+yAjlorq=kEmK|xW5I&?8rzW=*0=)v0Rl6b-&7u1yQ=16{noL3FPGl9ChOe! zixlgi#*a<#x)`0DuDQ;iP3fi0;5x-Hdlr4uCTZ=un4CT%X7P_aG#qQ!u8kS=ZFs;x zt+#UZXv|%>fJqhunj8LyJj%gJ<&~%7^JdM6Roa+vPRyFC8;p5_@vRTNAqJlGk$B+) zH__%(8$ZqALCIZn_UZAyA6y*2I_=|e%N_T`@NCU_=D6kwIaoKoLFd3Mg`vf1VnjY< zS2**}-yK#?*Q{FZb8Y^-dAeyBi6L#AG#O&W%GDbC=`l}zpE;y?rZr)@ZqOKGp3Kfr zf9K8CT=Kf3x916K2|tCl);XFxi?3fPSj~ggn)eImYtCprShZTVbso)~KVNy}$?|Bd z){PnK6|pj>SFY4KH*3ECi)H?Ugj`dmX=A=pb3g(3?-N$79Emye=I{_h^G)l9&U3dp z!{|r#dG?&S>cv}eXDPSX z;p;~$bbiv9FMZY#O;7Er*T?d;{HoCOm^sKsdzx~lv5?8tt0p|gvvv15NKES3On%02 zt!`3uqsDJpFVIaTH>6_o_86^~%@NJ(Im$iP3Rd(9&8yM%1ED2T@|?D!Dk*%bwOSkh zd9$>lsE@1(E0r^u@Y?fLRcN^dgOLW{tKbEuSJxcN*kwz1*PU*qR?5GA(+kO(ZC!WqJ%v z7&hovvTfW?eX#)v6s8<(@W0kq!@|&1B+vY@fAXk4J8IjKF8P%q+V*O??2s_&W6FP^ zg_Z^-bD(P}=OBvERQXeGY+wRC*Vq=_W2m|Xg1j90Cm-=8-Q0I1&-uY`cHRcPl%Q-(?wsN#>%)DM2(oTM-JL7Sj*s}~iiATc3 zh#4Qso^1*z*W_G=xhZjE_LcGR6MO1;jiKzjR^O%SC+jt#J-2IYoYu-so`;gPKlYTO z$xoi+l}8!PpWm(6q;KD9ItL1f^>sZD7sa{i+FN2^XgK!RZD-L%@mR^Glt_O+us&US z^L_TM7<1G7Yi*hzq)qddi)Q&rLHE%BhNR>K$Pt~m@Y4I=G;`9@+5GY~vZ?PNM4@<& zVM`59EH^d+cq-{rIvQ9mNNGfecEV^Ej7XZ(iv>qYUic)}#Ek$XS()_aSqroW!*VGA z4`DB`JR+gx0T5tUe(g&%F4#U{k+X;n*s^~O91~b1GziDj5IIi(awQaN*pxl=Jk`>S zzavb8IP-hfvY-nNA?8QU(uGQ&r9hscv-!deT(?^sBJ{>H`$C>l9t~n(S~JPA&53Rq z`C#U;PDseM+%Nhrdd_eDaE`JZsa}3Qu>v9J68O>yrCgh*~YrMUGol2 z9e5(Hx~&IIhffcDe#*9Elz#gP24Of>+P;y%M}DVXZ^zP*ws!dUqcuj{NHT~ymoR}H z`O-~$UV!N@b0gAS7` zGdSRM83AO8-89+497@b7_g7FZGDgwcKQd`CV~5z7a?S&>qG4u%4OARL8C`Nz)4;jQ zO^%rw^Hgc`$Z<9sdTFS16VHu@HsRX5qel1I1=UU{*0GWsL`D#9HmKb8peKU~A3dHz zEsKkuJnd3ZPSlUqN$AC+b{MVgoT;70%tMAbZP~2sFO~Xe*_@)&Z2NptqTEJ1SUkqPQMX$pYcfr$$lkW_L_|pK)(@HD;9U7lQF5rgx(04qcml&tzBlQ zVyg^E7oyRhIxo6dK!y8yC&UjW>QnKnuDw;8<{@vI2Nkf_ zrwW#uD<(B@^LHVa+>)E-jlvNStX@+gBXFQCp!)-of`H|8aI!(^TsHk*fh^VIxsx1{ zm8#_fJU3ctqe3x*%?lSRHfvlUn+-nJM!d;cr}X&49_#_=;vZFbeAJsKCb)QFmap#pWk&k|&mwW8xAQIYA`l+E_X_6}$T^d!A?#CWo!!Y>&%E+mvN2!pnEsp`H4vi0hmS?F8fxC9ST5 zH*L+9b0QyX9L7X!%;=-=SDrFFAIdqd)=zry{ThlyNk`>)IU{K1g9ht7$Z)H`y z$;q74ZT@v@R2BYM4-@|5I+e^#ulQUM9lQRWdyO$RJR9KiM78BYbpM={jicWBgp^2sq+I;Q9Q@7&82ci2sfJA&S;K|lFJSo~drl>`;4zZLE_!cM}Uz}I%-|f;) z8u1Hv5FmYVqKh2%RnwO-K6RKeJ?8Q>9bU;wD|I-eNrz${^!q8!Dmb7zH#*eW_J*@? zLu(uFnu;rw<$#jYUB)=*Ys5kRq3}b{Ki}1kZUt| z>aarOH9hAoInc5d`36*b z|6!TzJ7QB}?|4F5yFtr)*+e%xn#J>}Pr-bkkk(E;YG1is1KrI{L2jC{ZA8GGo!dMi zNH&wq1B7l>_Y0E24$kb*kI>b2LehipVr@$js`KM40a3OnaMy6Axy1P{5OtCr9f-kC z7qRbKLkP&G1yoW#ab(R~s5BptqG(8?N`^S~Uy zmTFr-4p5C6fDU-;i|2wFqT2>~P(*jGnWLf=pLtg9eMtF?-A{HMC*I4ZPuT27msfDt z)0w?#$D}5w19pwc8sVsoY(70suqbsZo6vCP4L$AUm)OC4&<3M~u}hqw7UND?2yNl{ zooO`+kXb)I9@`!GxH#cG$HeLp-4Hk-^t1Xd8P9dRVG4Gcuqid%3-MYT+#RAoSH;0{ zGRPci=O57O2Kl5ti9TnLuXY;52A2V6ApHPk$d&!WuLgM8^4QcW?Tmvau7*`JD5TwlsuS4-`x0 z(Lw-ibHG!MHX=Un+|kBQ8D5=d1aV%0_SO{EWl1HuYHYbFG~;aN4B+`G9rBd&j@T-W z8EEF!BnD1V)YC-Dwl&E6h>~{?WFyau3ZwK8Y3GYUcqeC)Y#~@Q+VCA?sTlEqp_|0y z`wVx#nru^RF+s?@^*yC>@F~}PCsf~>E$f1)?-te^w}Z6Qa>1B6W?1kgjNLNh{N@_( z(a*LyIUcz-=e+OcgJS}(F`}u1zXo6g95#q-s`iu2lr&`Q=_PArA;r6XRh9a}ZBL!? z3%Z0I9`T8V9kNFodY&6PsA0R9AiqYC0U=K|t2%Sx^;R!Ta)6I-_7e6Zz-&9E6SC3Y zN5^GEeH1&}J*CV$EST8CnMzfFrGNH5Go7hwrNOqX2(~v`SnS6eInXNcm?Fa@=xG znCbP4T8Hw9F~*BLbn~Y0{~M4>d+AAlAD5}R#Am^Naw;L+gX~(tRMr%5pu8+of*5Z> z!+_j6**O-HN}VWey3)xuX!?fI(W_g0I-a16nbdHy4rCzF7nXw8NX!V$G!lS?n-vnVQMie~G3oeqYM53l^D zR8JmAcAgQ=L7xqyP1b@&+@$XMDPFn|0UC{_SK$2gk(}RV-?{}Q=2*<@F&jNGa92eK z<2<2;mh;_s(bD#YnAFC3_1gRcy96ssZq3qd}8tI?YMLr_g%5sdJ-hXsw^6 z(^MPy+>@aD-^Zjsd7eUU^vpxY6HJ{OCFe?XSkN{eH{m(2i`K>vQnQDA7keH|GC?rK zM#&Z}DaA*rprJYbVDtw`Y#Cy6Ndvm}_eP|E*8ii)A1v29E(0Eor(z0~2 z%}kSPdMz#(eXcC0HdTwUji3A4g^+rt359Mc_@-yuwEu#nX8sd;n0T#$5y11Jh$i8{ zts0}kIW(OH?kBX3=w+|#M?W95XI4-)ps7MO$F(GiX0)SaUd&8a1)Y&z{~N#QHt6@U zu?<1SRQ#q&U3QzQYaLvP)pO^bl$|01&97*!Uk0I&p|sdre6D(i`|850cDOEmJZv>u zN9qOC&1K;Jd=xEX##Zt?M#g|P9$-}qaSo{a{K0R$e%Ih#f02Smu>vJ|ju+HC9jJj; zr}4z6(5e>FJJ%(Wq^UsPiiUK9{_$uwdNiUgoP*fOD>*Dd1GjA1rJ^94%%T-v&}CY@ zZtN_ZXal?JAR8^FsR~mBYt!5ZxX7ovQpc&<KcM1AVky-UXXoH#dGNqndzp6*igZTh}rulM?2H)titjk`@lV~pZNLdzBF;- z;CSjGTxdSiKn1$Re4xrakgPt4s4<2fKK^#Q&d&HKNc;c6hUv~(;WvL zT}iHJe0V8pY&LfSm;Y?Q+ezZqrZ!e21BFTck%^d!D$bVt(rj# zm@j!U`b8X#?Y0ygQg*lu2y8Q(*aop?J8=Z?bDB2Ww5_06S}vrm03BanHWH-c`K&kn zb|2k@;JL@sQ^qU#89mlo_e{qhN-EQRzDmM@HIP*XmDrHu;4wg!rjwd|0hfG@wp4_H zs!ofUt8?DJyYi^j|643dnyl=y_ovFi;zK^W&Y zewaT{a6?U_#jA#SwFUlJnjINus1;(i4^2T0d!&kuD++GsKby#L6`+Ww<_J*K4!oXw+!B z6VzE5gl7&?Cs`UF*>wCmq%9@Q0l=q+QeonX&nnj4bjX-jHKERg4YnSDr3WVv@s<~p zY79-QwOKAJYRh+eMa3S)1`1=9nwD3FXraj8LIKfu3XxBH}sGA16%%f;6)RQoeVt;guMf z3yz@EWn}vR6TV2(*M2GC-bA;-t7>C_%;wrQ7;M#`a7-(`q){s%ZxWLL-52+sK%Pt_ z#ZBngrA3$f=z3?X{6fcc0Wyd=QM_H!LfTD8ilmCx^x&B0ch;p0)6FS0dV1yJ*NGVc z&1Ut%eH2A?PpmNaop@*qvCud1bKe&kB}qwv@^92U^VrP1IbsZ z3O!4zwj8t$Xf!W0Q?7T>ga)bP+<%=dv}-P7)okfBIclF%*ujkHt!_E+*#lL_mMax^ zwdk&#CBJ%hR9Z@KlT{)rmUWw0Nh>CYC-&RPiPh$_=`NC}}TtuM_XRbG^`4<^%pTL%}-^Su-Z z!7o9{!!ni#6b^3UJ9TR`ir@JH@J&^O&R18Zd=qe=)3DnqXM&fB9zA=Gez)ctGT+(K zQS@Zd>yq<%ZvnT{zZ$IZpm~7nm*rHv#0VS)<7yG=J{yqar!t&iy5dF7ZPnQ{w7S!G z-Ma#L3~3d;6Yu0}L^}q>hmHg|M(Qcl5``uNG{5eGKegKYbn+3iaGvk(M3G#ipX{ui zBaoD1iUamif>gdZ_qAR3gbi-_9C0)K3p)9(t(rIIxRvk*Qlp|!^iH|z8sK@SM!rh5 zPaszuHQRNa7VqLyw~^tTN~k(TZK_79+Ubi!g_Q+pH*@w?aX{;QHvw?bD88nO z(5@4VMT@Z6E!nJVtX#~td`1S(Btz>1a@NrV?WsxDuCrym3dJ%MGdNHcQs8l`kh7hl z`0*b@CRy!XA3$BFV9J+dlTT(<$_3isG_&7*c-iv}w&z^t%{*c0tF0let%l{1vk4>C z&={~byOnQ)`(XK^(Dy{FV|^EqkV|Htem|npWL2<~c3YgSZFWKPC#+&mNCbI5Jkz_` z1>Cm=ZC!xdug_4?Zp#?Pun+~3e<4Wxsh}P^1cLgPy(ATgT9k`1HMN~a;X8~2M zW4`;Ovu?LL4Zl@Nz92;rL;!oLR7hB_zZiu#^1YZ!qCRp9)`pUc@ z;B$m0leL(esTva*jt^Xc8Qo;l7{4~_}mf4gr@)i|MW>j zK~zdrXSel@%Fd`01@ft2HKtbOL(mX27<=L_A_?$YZ5eI4olcTV7f7TvEhby7of}G? zDw0#i+w27AM5VO_=(Rt9>^p6nVbzu6DhV}Snoqgu%(y$Y0Co0nq_aC0>PU#TC5K$! zdVVV~3D6_wNln`|3q`$43?t_0kmJB1nN!A%gWj1FtLdQg0Yg&6kK<(dNQbzP;9D+089S|v<4t_Tq@RWPYBb0LsKg|s)KF7>Sc{8%rP~nVW#@Ixx;YNXNsm;4ixSVS#+W`&q zp@ZwdI)W_pJg7Kq(X+c{gg#^sX%(vg!N-Bk5(-z>1B^-y6G|Ne^Yq`J8PRn^O{syg; z{HbH_t6`sb<}oewB2JHf(jaKmluOA3@X{>O)VxqKFF?v5o0P072bw31J{3eGMBMZN zv6ea46i3pxYT2Iqkj4FJI~PNfwY2pUa9H+RZ%|FL?X+0AXmhda#<4xw>H=2&o2*`m zW*g`*F>+CFmU=!i66_RCvpcVn3;3&S>YCd+5EV93qS-F_Dfv!YDcNWRmVw&*37XzU zqAAxeO$6CaUn==FY+M^-j7&hsM1yT4Bac4Fi-bVCkT}=e%hoGEE%U`w4ZX9bM$YL5 z&{NK>s{fmib;lO8_zcLoxS^6>{lqM>stfv%-na+~WjbY)eLQS14@9C5>4B0qD4qk* ztd_dS7)86nSK+bIh=q`KOg~s2S_i zYuEnne3wuzS8PatmSKVBL{BsGfpC*coEDxc$U1+Up1-bAQb4Ya)pC*&Z~VsXX(aUg z5EFW>hN*)Gra*0ToB58FHoXqHsiOs2-8N;ar3}eqVgoG~NTifiTqA*81LS+{)bGhp zfr{Jn4vl4I7i9Pl4)@zX#Qd+Lr0OP6Z@CQH{9dZk)zA$1is}LZW6JjBvqSA0Mzy*#o!vHh6~&kXi2xN zs`DzzWy)oq&`+Djkp}JB9$n+M#ssBqVA-^7Mc<)i zGY_iT2|``{=eMUjLHtllx8}ay_NE>}Al{OJ(k(<;kW5rZquY)GMK?(zf*-cfX8@3AUYWo8+LJBrWO1Hpq&>{)>mNOsRYp z&E)>t#?i-u38v+<6E|J_^oUq1cL}mv&73zWXHkfKc($=!cpuYk^towl?Xm!LK#RZa zCx*}RaZ@0%^0FDOjsa$(C60 zvbMaHlVBg<)@gWO!2mTNnQlJ0t+$GO0JPPi?!33XX0s{f8b`bTsU=+7;R&VvRJ*BJ z2PAWEl!J=DTL^*-7^rNwFaWa*=`7pA8^6~JLHaLqh8DB^Agg!Bw+x)LO|dv+psjIM zVD{+M_#CFJ%@C>&mg&Xibvw0SxUk-KB-a&KTf>B>%^q$WC2N+8op`4P}+4N`+$w&)wz@&Rr2k&HA=6D0{W=Zl3^NA6{-XAwvZEO!>Fbp{a0SvJn4?) zrG!=Gd75}qyJ!Ye2FXuy_P~ohNNn=!MLE%7^G;dGmW zB&?2Jk{m_rDeS*!@?shuKFvCl%;;)TvZeW@m3 ze}!Am@~$L~V8)zE6{Bku1U#`p-qVbDaty3fLX0Y9gJ zG=Ypp`W3HpVLh0YTbgEyr-i!XyWoe|@zXQxr`p)$#XPr8&3|NCUm(*qEi(mbq{*6q zZ6m2eq}lYvD90`7?T_nvy0Dq=X&)jI=>nSkIHzDedI!QY?~Sa3-d>lItwLVZAP6jA z#B?fKbQ^;6WVC!jw@4~Adu%RjSOc^>Gb+dLhhf<%t| zWK0bapxIZ+w>2@@o9Ydy3bDPXWOJ&J5m=~&I#s9#+y1sj9=WQ zE%d1Kd<43@0;OXy)%;#JVw^*kqQP71vab~)<@tmfc`#cAp&A#6lJOroOVIND=22SOq^C;;0cVMnoA&p}a@vV=X?Tf6#{W28E%X%a*3JJ%3mhE@`i zCo1PPE#%vNp=TdZO4~`#F|#JFOAcE36w!JVQC#WB8c-K9Q#<=;HRnKe%Q}shJyV@aZgW8-Zd0cZ71^~oHq3>;5x{5(%t1*|OUF{{ zk*5HIWaC|QIWg!?nUn?bXjr!B0&CDPuTcd;lSjf#5h?ZZ&MYIt7JifBW+EM^!P`c# zRke93@Aw-lV89MVGSWEMnG z!;`{1H@kQdad@SVyiwJih841IsE;&yEEig?if%C)=vE#!2J1CCfiwdgi|N|xC1`ey zr$wsoZUFGm6Xw1P0T%%Y7xOIYhF!zxhyoL^lrgl6o1tVK6S!rPL5*mWX0b8dxP`z< z9xUk{OJH1jt~x^2&1dpBru`g8pggCT4vp9A3jucG4XM6kGuNy8R$7h)_9e$%5 ztR{|$rU=Tq-VW1r=@s8~;r%?O0ZsCm{d3C|7zKbs!KwB1>ZJpDl_GHL<_>nDnWa9K z-2@Tgm*3>^0;UM2t>SUP>3Gy;+JP%$tz)2_)5@#xG?4;bzG+)8Il0N~^G5+_S|PPO z7u5$^c7=SlV7u=&LFtSnw^HU9%qcbF>BPF^sMCjOfrP1ZghS4z)XqNiVnQ}C!15+F zWU3y{Ge!$JmZsDnbBn4rb%fx3F1|!`pg)5*=u!ymC;E_>!~2sFPWR>W=&vb-<^hmEjdZSh})+A zHx!fLvy&2(9p_SQ>UQ#^96(!`=zc7&R!b01D@@VBcM?30RueaBcl`tS6j*Nh0( z>kbvGy}MMKu^*&#go3~ z$z9(pH!67vfVLl=w@ewZb(%%0rs(467T!_GSgLYJLASwu+h2VuXsGYJ6Y2Db%Xx!m zo8=2Z3n$Grz6&=G*|OoM3!R)mcz)fAc~P_^cX^|~&?&@F>Ne!DMo!8ZA9NMlgzrZB z05vOf4&9b{i=8Ra0Zu!$lpxMK)3H(HHiv+WNiXb>d+d`~a_FhytDj}Q1f6XcK(e=?fioD(HiIuMNNK;O`D|4b84vh5Qo zTTd6NYi%|zHi!>tyGL&_*iv0*sq-UgI(FwWTvfuoUfZx5@B|i7SwG#$ zcEcKy>tfKM^)Ih+rKNXiiIS7b@=(#CQKHCIH%dkT&vrB4e&S9oVe8T&7s8mQ7B6MI zA>HPmW9@=Yd3GcmI0}EV+(AIQ)QhtoiTECkwYpt9X2h2vG-Z@0xjZM{Ao@5D3z zNt>$geip6S%DJ0$`lOjWN*l{QlKEYnl*Y6ic-bm)(%akuQoqH~@^2anyiJ3UybRNf zK3d{kANu)CMl~;=Tc)RMS9rV7uDM&pu5Yct>BBdkFV>S*<~ez3H+e1py^<=on`qlioAI0m6+P%3ik`7KqH=nd>xGr5vC*QNj3ut5A@%m+|-S9TYyvP^N`B2@{ zRU0|;s)p2PWh(`1jEYBrNAWnM@zkkTm*&Y~$#X*QbeR=T$NLUouTODDlqrqZXNd{F^G|P569Y8oAMxay)(4rZgj^G3NhD(O{+Cj;zGsDuO-c2Em5?lF`J?N6 zUxYS1SN{c_nTAwt@umyfFc4-%pIq_;Mij6TlfjFSGpOX%#zg62pYJqvcRq!{?(S~X z0QW${kcsv5t>{4eXcV^Fjw2!enim~Z$XvF0!tJ{z#~>ZA;GG3w4Nqz-HqD`&`1?A@ z=UMMqc+o(_-w`kI*6-|x_^K;Be_xXR*ld&Y-8XF!pb@i$)I<(Y?Ri)_evk`ZZTJ8o=f$B>#!=S#Q&LMsM&uklNT?6nW%MT{1opISgy z?J-XA%$o{zZZ?x|{WcH0u9R(#^+d=y5?Bp91q#&*#4;tIKH8t1%R$qtV*li=0d4$J zL`IyW<5$VpQ@!V_udfv0Mb7S2A9>=^zE4`o(r_jZ4SPXReQ*6^8a8Rxk(QqH0H^wF zG;KALoYy9|V5luCsu^mk&D;jkb`us;`n@Ml_)&v+QmK=q#+(7u*jK=fZ=_F{s4{mn zm7zOCo_@$6ARo-VwhzC|)qYx0y zr+Gn_+Xjv2I%hI|430bd*Om&81B3!!FI&5ElzpwH4py;@?5m^pA|g@Pm*t3=2Ds=I zVwV?cU3)CkXtL=XT95HnrIJk@g+roknTn5d-BA%6=RGYoiM zNWC=M4MJZVii7=sf?U`sD1y_oVuFL{?KO@Oq+OBtiMHAvzLGO&;u=L?GPXh5xSJ5} z7j%ruCT-&7<4cRGZGUjEZ}sxyI{VWG!vB$|ol%m9X9ggZl+^(lRZKXD8CLqhs=q3N zFbsGuB}Z|;;fdyx6TKW*Up%DiKM3(Eg%@OXFXaG4Z?>u7Q`xv$4o$YwtYs{!R}G9` z{=+$s13VqXGY#AlC0Ts;O)?5E@v@uFt7>!_syz<8s1de8>C;!*7?cd}Ji}7Qu?cdj zls-89a^Fw@$eZ}GL(QhewiK(!0+EU_zrtf?ErY{H}FAPRbJ;X7%q2Aba{!^?RWJ9C)vFcZ|Df;<%DQ#lTH6s`5@eVOi25!KeWZPjw6S_(SCaC3$iWN zjD_6ra+lJPB|Xm-o6QSvbIdPl#7wiv;tAx+IDLRm?n~E9;f#{k8Z^wOV{SPP&Od;5 zj(OTl#GP~v1w6Ya8`#N{x8pHB#DTPJG`}UAV^TWh!ybxG$s0pxDP!BDN|-BLi|#PU zVF|#qMR=x39wNDiV+8>*;hQ$&pGuCKM#h3*`u5oX4U%&wiUnF}F(hO^MC-^o|2eNy zqx`F2wauw6X4kZ3$Khoh8NZAa6jey;n4oa%w*7AoFs0-RraRFaL(h`~@SwT%e?xPD zNo#YEqT_*PVnSQw%@Xb~El|XkTrGmWD}`;@hWqv-#SAIXwT0*1EC)C9fM1pT?rN{y z`Ge%6>O!0&y^{-M+cb@Zvja(TCi}o5Uyc9rr&<;Ey1qe1zib%H>slS83`(+r5gqKN zWOK4$kOCzI$#bfu51Qt>kvPyINE_st@iD{H)GGy5UZhK)LNGo1pOPk*zl6p}qGKv$ z@@cFo(MikFrWVra(QN){WKO-1D*ZSo1dxtVjk z>E(F01*X%1uF7CzAjD*fjaW>F?wsKOpEf}4HU|~U(5KeMcgay1uZF;O?MDa=-dQCL z1gJXa0By36_8Tqp$XMYUbJS&{zgS#7w^)vq$GVeAeHyLbt$&E+#;13#7}7{J1a1K9&Ez`K>CiKf$|Gv6U&yF#>jNdvsnR7?G zbIj2C!FeUV#|mgMmrn{+KFRF^n!Yi)vwVe8S>)Lj9{pC|Oo- z+Ll5Ef>j-t|Io?uB4CrZbyC-{+Lzw=rBp;F0@y$f4kTodHy?v;WWS6+Mw%wJaj5ud zbCAC8@CaNuGN~(&trn9%rWT!_`{Iv7IBC|epUeVIlBbJT{cQ20FD?7eg{@~Z`^hw2bX=)dE*O2}_43a& zy8r3ZHe3HYXg0l4Se|tFqKTLT6;EyYZ$ic0YOf6jgwf0XVb6NV;=p1#R;|CDL%hkK zU8;?LMYF$28DvR}mxUpJdQuUB(9US~hG~bk=7364NF{OMkSP z8>l58jJ~9;lxzO-+<+7J`fw`P#~x1vNl`BHmHS2&gW_KgDAEn>zKsLv6Czk@DPGW zUdyKQs?u^qY}U}hzfYctw?CUg)`S8P@z?U<7%fvc_DZJ9J^JngacAtlW{Z|%s)D>_ z^E~rf1xts_0ZuC>6?`(60Ov)(dh5PIPjTy-pM#+qNgagy(}%K&j_08RN_+PQuyei4 zek!BJ8?RqApEOUgm4bk6=+M|@b0hhw&`BdKaKN3-tQD5gmJ}M`4z{aPZi=gFG;0uS z3t8JMvY=-=rBe=K`T#odLXwL-10vj+EH(!bU0J4Ar_DlZ_Z*KG}ps9G6F^ zWT{KHr_+ngwL9Li?iW%f^NMhn-^vYMvYOg<|7??SXil=O84%8_% zEd~b%n`WsxVh}^h!RxSY?l~TywF@%-tovgCdRBS>?*3>lScf(`Amz868$HFcN!4Pj zx(l^zSxAUe=DKVFw5x7%)b1~Dm%>S&xz;efi?gc%QJtIWPm_bv$xMZmFDc`;Xh4Nx zTVO4I)l=u9O0P0Man(&m#TAFX+P1s?q)l1|%cOpja~s_3Gy=WZ%R2SbW@`Z{XCJPM zTx~zm7BpK8Nxum_ETNl|aP;>2rz%}ujmi@7AlijEd zkOTZqpFR*X6x-mSVpHE6&gQB4$7<#ZzdbtouHmb8M2RF+-Q`irZG-BztEsieM&j7S zYPPE`xWBpVJ)&gNQ^wmgns|%5+Xq-qO!HHyL=%x*J2xtts$uC^!fC(gCEwc3dE(6{ zcv|Zq#hQ2_;!lywx+jyxsiE%Vnxvp)D4rkW$U4+UI=aQn_{Kg>LB{NqX|j2o3dQOm z=ev&3yWq-ahp{QIKzcxMOw_u&BVbXHvgrMJZ(vjG&pp^DK*?4oORCL#6(z zaLOH=XoY!!acmie?fZ_bgJS4_pXoedEizy`JdqXCBpCzip2#5V0I`Dv_sdD5g{=Qz zQaJZ%P|I|J8cn?e*~vS)rdOsb4y>kMl|H@ZBR$|*{`zKF-WjWn{fY4yTeB)g)~ty! zHqB$&JWou-#Q0c@u3Z~zSFMcoBkQc0ck<;5pDH#(TL)znOgKW8>hhAC@64AYu_$o~ zZ-Zif^_3WtWFGRRX&IivqHZW({z)CrDK{knz1dD13Cf>sdQ@He$s_>7_EhA;O*1kc zFMi}6apoLE1gNV@l3wHp;3)#omoN8Ib|%MG#~rucuH2@u&FJ9TP32v&VbA&L?U=?L$;TZQl7D?gPe! z{yQJkg674Z=$;UNw-QviP0;KvCV(A^PW;se)-j9dK;Kkj#!oh&bMC;_ktgq%%_E@_ zg*cU~7Gp+-UPhTw2@ozHfS-!m2KLOY z1sXE4L)!vwThP4SCrSDPzmR+HCNk*XUR#*Jdn02P_Xk2R3V?YgWW{S6v>LUwUcWe8)W+ zlL2io2?RxaDH1862MJH^uj(|^i~iuxu&!gbHAx51nCyRZ6teC&j; zh8m)i$I`ROw3Q0@Q!T!K3Jz3U><|||MA9aFFviv{j~lPODlWh5(zx!1TVh-jgn0@d zEo!f&l|HAj+yVoNoljl*X}+FShpkUoD&PiWeJvy+HJcnf!2E$&dCx6z$;Fq%6<1sl z*I#>0TygnjajEe8R*$5QI`6Q}THDg-C#=*ymN|KFy2z^#uOk3)f{I=#(>X#w zN*>WW25{tMCfDVnVcRnJfC5o1;ck_W>_fFRZ~LE++n(ovt(c5YAT1}Dlbw-^oJ0Pn zLPEe{HR)!)gA5XhCQ<=n%x!@Q_X84WEYvBv4%QX}S{f6c!LW9CV8ygcXz&K)SIX4f z;RBq2hzP5im~1&|9{jSSLgf=3nqR`I?V$m6EXieHhK6(pPt2A|9cGYgLDB_%`7lif zFEYem?NHo9GiTVY!MR98y^3l4b8|t;=TPJTsqfe?nsuy4tyqL3=caHkZ(3Z2hP8-# zHA`q}sgFI{8MkxX@McS@(+7r}gVqnzRcaQLY{meivj@59XyWo@d35#4n9#Z!*!Xx%jE=_I)vIEBbggta@zYXPnfvbOZrQqGP(x#ld~TQ%T>H!i zQ!vOBy~ChYoc(_KBsx6+8T>d`;Lu#?cjg30IZAJ?H^|xMh%~NK=Mv$ zD2O&c2q^OpEp3%{9xV&4aLXmn(0DF-DF*Pg*y!{V1geU4dSgewQqInk-o{>q8?USr zOt(-`gg06nvxM}OrD=m#9F$5HnMs~22z_z&V&Q-csWlC}+__DGXT!3p%5B%#6Z^0Z zNY*)b%Z~+GX?>7hr<1t_+E`cxI{jCJ-f^T?DUp;E%eu9FWPTMS&0?b4sR^_x8qLHZ zJKun)iF9(-aRhjWHZ5ih4aBwQ{5;-z^ilDd&z&4!|I!!YgKs-FPB`sHv1W2024v6Y z0I}D+^}N=*jRWTd7jR$K@Zs|z&$;QGhtzhOa)Y8lKz~-Oji3JTyK%$PvC#fDCdVgY zWPB27`(YDgQimFtlp-RX9TBd6Fza@jq$;^z9ByS>CePhzxcWM@W+pj z+wNJd8wKJ*7Go;d!6`tT?x)DwypJrsA%673U&m^#0d=`HOm|H9l@%u#GpXmeD%a4a z4@ypWN+B;>Gp5B&7oHVg{K6OFYhOGrUiqw-#L1_8F~0njug4WPFNvWU>R08MLO;>N z=Ky_{UEkPLzvamYp6ru+3HsM%$Djs72r=hy)~s<(3TquSNxNHCZu3g~(!pQS&=;HHLgf|Zn@E75kQk*Yo|`y1xco*rIUUTRk=&y8@D%L8x^$#+Yy%>K!y{b#(||Nu)}k?JwA-Ko$|o&kfShGU z`T)H&#Cc*Ho&W_+S&*5VqTGXgvee`iW}o8!Z;;W7qcbmW?W2UoZ^fn+te@JbHL`YX ztkH&Q_3AaTZbXYkeQcC>=4rPFN$a4G*-)yK>X!vqkxkz%O^(LzfA{OSch$J>oKdnm zVm6ezzB`ppcbB>`AgU8`V$I$0yPuyKYo}@PNsf68%Eb6cj806ZpFSXt^^@9Qj!kxb zO&#V?J2^OLQP85szMIX*$nrbmcW3=M){dq9e(-c-q#;*AHWG2j-e_HYUi|6rmuUee z=IWnUiaw}2undDS>oX?%6JujBu8r~JzyE!F>s#N7uYBbz@$GMaJO2Ie zf7>TxIe3gpq2ZxkS_JLFIkHCQ7I~Kr z7Zv8+_}Hk&b!=o!tXZq^5Z%`sO)@?b9oLP}sx@mJcr7gw!YqHcD6@bYoTER!u&%`ngkN`(nxSCu5)wX@diRAVMli zXwIc%a{PaF%@_jil%UyD-7Y@;@w7S8=4#HbmIF0t)1dAz5M3u5@Hli0<)Pty&`6p8 zsyBwRYuJdN@ilT2R3^3KCu&WpyJ}pl9+;Oq);-AN-zwzsst4;O#$uTX9+D5D&*L+_YcC}#x*P(CPs9=@zhlMTKiY6UgaAi`n+z`eHrlJZSZxEb%S+5(Zuk~8Cw6>#%laY zhGhg`9#6{t{*QZkeBn!9icg>P&e(OUed4{J{z9Dc*-yuV_t;A7(U^1OJnJwzG6JHt zOzVkkjjdY~tF+GXfWSG|o11|Ry4J6f|29tP56E+aK6`DhTqQR-rgij0z427x1#CR; zOS7Z9YDA#b$sM=!wLQT{=DaAz7bkfeb8qMsgzJDde@Jx zBMAc^5{&D@bYu85C)^nJ0{L!K7fE}q5p zU$fM~Nxtk+(*|f~<T0n!&x^o=?XC7?xidR%?x*Wz1euZSl;>EM{I1;vvP zf2u7?U6$Q%+a!mylf&j}VuHnVdaTsKdcg%3#6=ff6g%#?V;p$kfw64avbf}uOZ*+W zO*h>%hKGif8!g5|Gc|TtAU@UDw8a*0FK*M-Xya>&bs=Xw<~y#G>2wgvuxTcgFYBr% z$4LXAr!4kN0oTiB5K2cyPoia;PK%8=gqmbZ%D3D(*Sy@QI+NQel`9{zR&g`u2~Xd- zP_MrCy7=2auZ>4O`N=VRfK9u`c=~w!{g>a5Q@{L;`0bg$ivK<1@9~f)J~6hKIW10j z$8+P4m)sNQ|LK?U-EV$7&bx74Jo%9a$FSz?@4s_$ob>sx#MyuQM_hKn-{W&1`+hw6 zh-b(8YtD){e(Y=U@W(tc=4&3_@ULIQn@{{NpZ$+&WvCD;^#56 z)&8;9&YQ*f%6sCQpZ!F9?YlpYfBp0Pxae=cjbHxhrg-#|9~{$Hh90;H@tF*Gzi&N%fGanJV8h#R7es`Sy^IymBese}FSwBAx*>C5#U(kR>bY_F zLA%GKt}BfGpzcs_JnyXd*R9jyNl$oa%-1zwV8(DvAG4LrDz@0buwc$G- zKRV7|wqg#U2KCZap(iqxow>V(uMe(JNzc0S` zlV8S}I*;#IJrsu=vPay0!5MMnM^26DcU>Ld{>E41%zs=HGh;@OPy6-rEuLRBY=%0YvKB_b+OqVhsK9bI3_RTGLt zN#e=#tl`0!qfI`46u~B*r_{s3d7=eOS3O%Y1Nqo1hK0}2W|prp%#_?L-QmKYGb``t zNzSZUv+~YUjY08d56_4>)U#&zqaXt1Q_~sf*@kQhZ}Ia-BG6|_6kBs<&uU|8J}71S zjGa)LtCKel8;-51-5VPcK=IlA@(~x8A#!8C` zv3DRQx(&QRFWThzs5Uqg+5~fxu--Y?Yp=cH=}&)pJo?d(jt4y80kOv(dw4T_{q@(! z_&85MrfCtE4!B)T@g`DluJm(=vH#{^DonMJZ56-MUiTzjz$SpX2lUeo^sP_;F9f)BUUqwI$J%QMZ?PvGQh%t3w*GZ`eG-m0 zg*qT-tT!Eq?|<-7cvtCAO+lZ$z&84?K?1u#r_Tlwy__ZR^v)aW z?YOvg)}e9SDPN9{zxSB9;lz+;L;99b+Stz_npa*V9M8>aDTU zx_`&Zp7)aY%|Ea5^=;O?&EnvFwvIpl`JbW7lI$&yv(H-^4|({0@w@MQG3Fik>^S+f zFUMPseqn5~&7Sc;N53+5-R;nL=SMyfPd;pq_{Zrd$AxRQj*ooii}C4?yd^F_`xkNX z&3xr!AXZ#`aqRfGSH}sbem%BZ{rC9%cmEvEIre?=sgJ)s?)k^}j#j4s{fMj1LQV7 zS2l*$Pp>^K2tjWxs$FCs&p=#7oU$%&>`!JOH9s^`Iw}3@6PMt&q2JhDgMK<{{r#JA z3E#-TfBjA~lavXX$t;Ju_3}$JE{+>tq#C3t?Zgoh?u!LD8|QqhTYUY3h;&jwpa8{h z_2AIVSh#R*ELyl(Y_rp@@!k_Y6GPYkCH{EHZ81kD-fdU^D?ak}H^&jLc~!hw7v{fT zbW;pYu85O9@b>uQ#ka&vZF1LL^}BffYu^`lubURLrmc-H9sl9@!-Y4;8Q=V5eEyq1 zj8i`To_NKJUlO1B=C5K@PW`2E0dcd@zU|6$;}h?BTO9G~SI4n$epmecl3Tqwjj`47 ztM8l~#~k_Ecv z8ZUUx!{f(a`AV$T0>GX0u=v0E$xmbZ2ReLuI|WwwEb z=ci=MhvLHFj&x!yH_QO@W#-J8vHkYj#{mZ%5cB8Hk87{JHZHyNQh#&^eRy~{ggvPf4ot4O~cGz!PZGblQaw zdn%PL3AFRhU*ka*#Xj&;JB|6o+I!(Pc5A;r-V+7sq3t^}N`A(|NIA@fPue0YC|xs z6^vGcd6K?uRKPiz{jxt~T$2Zg$kWdzpOxo_lgAux^b!!{oa5Zgw$FTvw=wZMeHG2) z1)X!l{PYXYV$e(%_)4dmb4nEGFccMBk1MF@v`a7j7g4~uOq`@6V@b27H5+;n8+`0Q zM$``(9Akk5^1t%+-@2!)H}@O(3RJ|n=I?}UuT`E4c^VMdUQ!#dEL#jFgu9D-L{VT^Je=&#y!_w5~qLTi}A&; zeLwEL=8jmQScm4!^TUl&b$X2je% zvlZivn73d-%$i&qzdq|9vDwy}#|3BqKF+=ThM0Em-Epz{GpL*m@BE;6?<5d^N&1*Kq=+YbGx4%9! zmJG~_CI9+&+@*_f^NB4A%Q(Q=&RS!r^}^Fc&}!l{U1C1}8(%N4jL9mVDbiCR^bch+L?07l5FHUpo8Ul`fZ-G+OS^aI;t}`6RhPa`{i?6B+H{} z;7mup*`wzC%(Jf1noMs^%Y)aV3_Iyk;GFil>~`ujS$yLWI(*tjBtrjK6Rjg6WY$*a z-+jqEc>RLucA+V43~1{LkloIwz$u;rG4}B`OdD!#fo$vo>JmJ7a zaq{t>ihCw!#im2+sybGIb-+59m`kg zWURjH&<0{+Y&>>3>}j!R>4kC8jZ0&ueBXE7-{RuC7sg``-_PF}1(scXc6{#JzmF%p z;?42)H@q~?|MfTHFPGgF&wcf4VvkKXix{9JEuDcv4@=cZ(s zfB5zHqrLr&_|B(4692quZ9M2vPmLG7=$SEZ+Js{qmk~Za!3w3f$>d4ic&u1_Al zPK)!;{Cb@Bqd&*C`#mIH{L&Z4&RZ??=7^mPapmf|F~AuNR#14HxBSfjKl3>-FdReE zgqKq5Th?v;Ql8Y;@rmiN-@~64-}=sJvEiz}#2Np*E;ir!fOydM>*Fuy-xX(RL;AR< zJ zICS@|E>gI@Tl`dZ{SnOGCf0%13TjS_Zf$Idi9$a-RZG$)H4o?9k<^$p7P=&D(3v@!Ria%c!any?*5LaGtZQQEO^Yq2r#;#k>igE2E4}0pfU47xBF=p?gj^k;?jTrA*SteSiJnXkBOak+CCof)R)BJJ4gKU{3~PL z{6(?bj@!p=*IXFq{Oh7vwR&0Hao=d1`|}^h)(?GYyx_@)#V)(-8qa#}vt#=Ov%N61 zF1aEt>ve}eck6iKWA=%k|L^aEKiT;C_fL;~p7es)Wzj%PWP0LPKm1N?f7r8Qmn~++ z(88@^ug&Ji-~M@7Y_;9aF-Hr-);sSM+ip59HfW)kzs=t9yyrhFcHVx+c)^RF7kAu# zgBPYh{_KzOn3o?LkAL9avBPeA#hX9;-njm(Gvkg`E8>s8K0luRnq%W(`|TS0AN&NpuKMXogNGlXA#zfCV648^u(~MOz$4-LnDI>t*=Y>eJ{L#hLS6}Tv3S`5~ zS2Y$bT4XuT6>1FNOn%X2&SBSg(5ijnX@}4}fTcT>kWF8`?@Hx@lFGbGw$%PkL^6@K&a^|xzz51SUwWs&3jmf?C+c&QN z`>*0!&2hedap`&gh+CGfwA`Epo5q?Y_r%Tjtn}A%Ek{^>8VMsZDyu8y^ttob&tN z#x%|4?WfI*-S^ov=4^9Fy!L25fjl~1^t@;5I<&BEOmjob*Ep`e^xv`5p^u5DKJ1Vf zo>(4tE?ePfxFa1H9g7t!`NO%4HG4{!nKN4Oh?}R+a~EwJv)3<+v(M9JU-GM#-xKHj z<3F)}+Kk?as)K{m#^Q3Fv$ro@9&1O|>xP!EFX~(*wiu4*zxb)~v(JAx{=I7Jc^m-ui*C3}H{`=HF|s1otQv`FL-XR0-FAsNo9z^@IO_H8 z^NU~d!q|IbK-!#_l~W%-61xcw=fQS^7G>jZ#X87eBBZ8 z*hf7i<_~kN${1Q95N3_%Iy^be(Q30-wVF^M@U>LaH4vr=a@NsKN^j1lF70N`G#x3d zVP3}?AZtCcARNB+afhB>K6jG{2F(vO6uc>Rh`y9vTd22gsOqlYsxmT;KG_gVp2sUW zd_B*$i(>!Os@(EPTWhmW$L<^y&RQ!5{jrYxr#%|@cjcx5nuuP{&_e>#h$p*bXo0K1 zb317nCt@XIC)$N5sx^7AxCw-M| z4;*+C6QIYzo7s{3;*uNI#y)#&8>?2Xj4d|Z(lY!t?}V0|O&01hy>xZ#xX&Rm|Gul^ z9~WH}8@Adx9&ylqamUR!#Fdv`7+dc0fS4~GqMSQ($al9CMxjeGAat!xv`rQ-a4N>e z@DVY8@thdtiRlGr#{1s;;kf#am9f(vd&Opp=WFsz#!g3k^JAWcA&ED?Nc-ldm#&K^s zGT!m-568u~EZ3apY*`R5de$NFnK!>K-t@M2$Db~}C*}@K#JZ7)C%*icn7r<{am*1% z#`{0;>9|YVj(G~0-{5%KD_;!U??4e+XstZnuA?eX%}ptV~hp6m42 z@(q&bd^B4W%Qe5MS)?6D(Nyfe(|6RZRqdi6k8Yp5b!|sAzF1!@ldpDuRVyzc680vQ zmvx(+^i3n>d4Y?h6B0SVI^`=bzD2WvtWz&}Ks$FEpl6@$WgYaPrEHdzHC{I0Pfm=- ztgZHsk9^?G@t>ca5=X!GwQ=lGuZ#D7^t0Ney((Vw%)`8HvXBgpu8FUn@V&`qajyUGc z@q^#|OVmNH@f&7t8IL)5%Q*GDN5`o@{dde5oE~GNsb?En)WPZJ_~f{ML1NnA{5bN6 zm&RYd_EBwGkB#F``eF<$-aZDVvl*uEw`Bl8_ZyucA@v#`6(6!8M z-QcqZ(dh!lA!~|sb#3(b%8}O1$-t}yap(hgk28LMaXjNW4`&DI>&n2QO=H!Se~fqk z&l}@tt#xC&Ju#mCi2Y;kw)@5NpLjr={JuBD>tBCNyzPJ99%o;0lg2#Hr<@o0;`~eB z&@&E^jZ-zbHrD}jY{N4=DSdWLDO>ibxy`r%)SmCu(&^->TU@61_?@jr=Y_w*vu<=Z zvt9B)lP@XTY<zW0xHl=$c7DT?pq$ezT)0^=pI|gmJ4U)1eTDWD6;XQ z)=I)%0Dskb!KGKn+}Sf@%gq+W!Uc1^F6rJ&OFr_sc=T@bX&my1r^d?;-y%Nxxv$2$+wY3UzVWzt z%6^;1smHw`R&4*wc-u=JODOT#cRfF*Klq(-?2~tkS0C}}IQHY;i&;1QGCumP^Wuch zek!(}Gc88ft%!FWb!0s0?O%#jXMHd(jYr2v-~5bNv*g-1;)tW;<)8U=Y=6a<;yu4y z9bY;1J+WA6yZr1Q##`U_!}!vle-T?~G2>(D>C*;daB@|A;{9)meV+N=c+ugz#Wz2G zZ2a`{HF3~kkB|2q^TIgqm#4<({<!&a-i(NhC+>5!Xwiy?K)Qpd5KZM0j?im;V`$Stv95 zgjs!TxE0XuGU=&_4fhGj>SA--HTvdJYo|MUkhtbhLPjC zV47?~_1J=|#w{l40tlau`nrRjZ1}nZOM=L{tJy`DObZqu2G@q&3`ulFxY{NW4ljX#e*BHn)Fp|N7g%9y83+k!c>bVEAfpJ*Fd zvrKE>O7&+T=4npPoij7W*R75<+CMIuKi7HSryW<_w6I*Tn2i7RC(u zpPbM+cK5w8Fn3XGGG{QBty~w2H(4wjt74UQw~H1p@H#g>vN~34>0P{Vp5t1xYDFwx zxi%JTvPqo&$zx;fUN4O|zTj}(3~M`2|K)Sq`iWR}-%|fH+>BZCeD3nBXSz1$!y888 z4KICRJoVkD#$)!`D#mp)y>`Vi*<3Aw8L{aWTgGtxk?zR4m9cc`@|e4Lvsj?@WPB~{ zWm-9=$K3ggbsj4pI`5aQ8HvpnEpocoDKFz2hGYJ`nYOWF+0q!AvnXcCH)BtJ+us_6 zu20MET^$QHTdW~hzGQdy@bozMmtTn!e}8ZM^ptnUD&2idA6XLr^X~V>bB}m;?7jJL ztQKvHt+rMkb+u5R2d1x&VQ$Dg=TF2`AXWr6hl;~eK6`9D$dP1wTdE02++_jOU zHLxhM$k6ON&wLWVXPv8Ss9wmJ(QH{p73Y-n@>3=ogIuQy=bI4YIX1SYw$E)#rmSO; zU0-AMLe4xNp~J_I@aDe&4aW;pGB)RY3)4Ht%%0OW?c$-z{%5`RCbAG$UVDo_A=zv9 zonwa9j=biQR2$;$@g_H%50~7cYZCKO5>tb6ujnj6Yl!VkDUgf@lBSRU4XG)<1|t{! zB;dStM$^LuVA7aZipY3A2(G{I?D*7&J{BK-|9j(&uYGy^``*pt{qK8g%$3gW4}DrZ zaj)rd%n@&j<3D+PyzhgbitP@6Rvfb9CNZK7z+n&FJ^u9jb7J?scaNEiwvA0kZj4Ls z8IA+?+|*B7M@QD?q9MTbs1~nL?)a4;eoK>o!m;~T4-|ZamhlmuO zbn=vWx=LFQ@?>dIq+dHNyv;=xAujb9iNHLGmMjyzZ9s&X)(pWjrUQLRn?5bG^vz@Q zVPoG)(8b|AksLox zXv>(%FT_Zh#c{#n&0|;>-Z9;j{`@y*#ofzR#eKJ39bY-^Yq95JA0G?lXT2_o8>Y{U zE#zmbEjQDKdsb|^Xo0_1$S-wlvGumG^;Vn9?#x)YXt8dv2jYfH{uzJ#>-n)-lk?j1 ze-mH)?%(3c&whLiPwJvSJ`sbn=EOGJ?Vua0tz*7!&Nqne{_4Pb1WG^ouT%8Zpaisy zpmSIG_8Nws3bG#4WC<#lU5@*CkZV?uOcv;FOa-0<5Gn!|@un;iWMXWjZvLtQ_aBY| zZIK2T@6z-9hs3L$6xHU7L9Y_v7)JD?%Eq_33Q@U76C!@?4;3F+8T7TL@ic(=bZop+-8Shh03Xek!L*V_I65mr z^7cwx<=k^T?sF7DvW**b4_i0yaSJ{HZJ?f-7dQ%~f0;yXSu zsdH&zY^QT;-t1woYuK9{ACIBg3#_~Cw%f!!oo`%gX3U!F&28I=v3Ad2yoJuy?PB&! z-GFLy=!-mGGcyEVzxHG+it&oY_sjwF*JZIU;SDi!?Wi5yj?JR$lp&M9GnV6(-GGB+BTnR6D#{Q0vy-`bipv+ujep0~yr(;2bJ7K+c5X}V!p5f}ga zukoFqogL43?z4Su_xu*0C)RuwWy`I%j%~NuO4n6lq`%6O`tCgMuw!h!<>vlAw%;17 zyprV1!i$@l9G=S}ut8%EwGAKB#Xdc6G|#e1y*{AHd7T?e^~(B!zVn|W=U=noxysb& zi6ouMj+_6ArSaRmHU*jFT2?Qwp=HN?YYKpgS*KQklo_8c7V}evBP3X&k1RBP;=pc+9 zXg0`Z=C=pabi!^}yL?6b`to|xyom4M@>oYqZ}s&?gA+~d_1c_Wc*)fqVZS&gp*XETFh*dlhNcubFn4--jI3M|mtJ(C?wCo&pzbWUh<*3lS9hQJ$6|a1 zVEy>2xa`6UW66E1W6?Id#NK=Ds*_Ep;rfA?Tz7X|c-eyzH+39ifmFGq*+%7}v5uKVduStt3(s<`6f zi?vx;9rHHbIu1B+-g|TfxbB+EW8Rj###W2wYC&8dmtA~C?6Ai^igzHE z-+4paxO5^8*>`v4G-BmlH^t>wY4Ot?^QPPE7<=rxqc$^xF}7++{Oe!m$Gq+KjJ>yA z7+2qPTkO93-r^0!`nC7O1=lW#1NYs_8=+=}FRytVH7CqwIH z+@btjbHg1mf6MJ-yM=>s@48vB#~$189S@I=$C3pn5w#gFMi$_r!U!^UwA4%fcypa@ z3UnjF1%ZtVo93Hty2-!Myz|aG#}->`VY)ZWg9CobJe{Y^Ww)Ci)nJdo58@L;HI0VmffnWyi9w*!PA(eTUvN=L2`C-oVp_ z#8rR=(RLtUhcg73JR@M)rZ$%uH0_R)eydN84Jdowz}Z>$p`)Q!eI*}=b46l_a&8=7 z#VbA6oae~vm3P{1%A~aTKIPcGaoXoTA6MOUM{F3F69*jj_;}{i9~X;f=~5({9%Fl! zWgLjs;q*(q)`#gcX2cy={v*Eo-Jis5_pXka^EZn}J@q;9ghw7y-yLGC<(EF_ou4EK zaUR6ZgN|x*q$wU1PfuLy<-W*&%Q+15+||k%6y||*j(})s7GpXj?k2J5kQ+Pc6OUsQ zq0djwEfi9>)j3|OONDg!f`TcD_sS3N8?jA$Ms(aT&XCbf_H@Iq1bo79krW_p&!I6miL4ejTU(?02zp-FmI<+s5->{@U1omo0P+ z=ZjU?ld{B(GZCemF7(>4I)3e-wjSu=F{i94R8=p z$$tLwL|K;4l$Hf`lC_GEJOAXGe2GL7+(r6ItcLW#zy4lw#oyz^FMK=pdi3+-MbCIl z4Dr#(V_iD5EUPEa^a{pVO~R(dQ0o zxD?HwAXFbShcL^wLb1MldVZua-j>Mg0$#+oN>XVkt)|vXv8)kLB{wJn@b52XaDK z>;`A3h|W)FG1%yEC(Bb+ey)zLO-|4!zPHu;nI9O$$Zsg~RTuI}KJ1sfZ~ln`Phh1t zHa3wdQvBLix(}>(eD4(Se^%3t1Rq^bDE>h?o0!P&q_)_38baFmsXS}|*x+MBgJKzw zZ+Or>u{BAsAfSuD(*XyIQTR5%IOaHY#HyN3 zvk$$u==RKXI1TZ;i$=1F0mx6qCJ7(B80eL9X(#guq4*-2MjJZ9s*!Ebvnd22%M?z` z5_Yrf0nN`8QDn&n0>-IZdmv^FX^w&mm^owP`QOECgo_&kg>VHlRlm=tRQMGS-5YuV zL(HH4jOKi-uuI=03lU#OfZ4_ep4ScG__K(J7)q?PvQNIC=#~90c`+CbgtM(e-H%Hq zF9rg48)3aG;JkblphE*WvD2^Gh!)@BQqWcIJnqfc{Q)}Sc`lS(ip9m8C{Y_J+wD3)3sP=WdjPFdcf37y+cFNf8uW{1ku29@ zGo74J(H9XchhWO*^<9ldvu!|m?BkWV4jpFsWH%YrirM`WqtYZu+qC&qp>3M4x}Kj9 z9_nqH5$$48jYS2I4fcQ+-`xN8j48nKpD%kVARu1%qfmf+c8=N;8=BvR3%X8J+p!_5 zH@Ni`*yzZF{|JeTDR+u_7XXus6AS%%|1req2>(nWH@Q7K;_(#&FAmxaYLn)Z2N2DF z8O(;+FfBK{S`>InksIywwL!bl3AKsEe|X^-)Emk1ksEY2g!sx0J>MHu+i~*;R`ToE ziA%*mHrSNPHg{VNm<>5kWf>%K%O)%i{^)OPJVxXXJ>&uI6vwn!jEm1F0DOdqFS8XZ zU$bB|0pc7T8Miz!k_S7G+@x|dvTj^`RSdGlA1I~`!j?>iXnERL^n~pC)F647o;ENe z24~KRnKNf=@ttWp@$pA0jNJ@P*5O&=&zbALJWov(40oWhrazEnGZ)e1({>A{FT96Jgrzq$UXU~aVO8OB3obY)CI3`O0w{r*PT%L z<=RgF+CmO1OB?5EH~&;-R2#lJljmcyym`tbq^NCC)G`l>US`r>AL}$fR%!06)Es1E zz(usn4Xc~=6TCo*XP0H8f8AjIt(A=xvb9?0?+E8=>07*VWvgYYGY*l1+Pyxh28CSy z>>L>r3WwDMtAcI)4w8WuC54O#>+vv8+i{za67-#U+T@DiSo7kNJRfyH-y2ZBfYfWH zzuo3X(*?&~w$nzd&C(&~g@vKI?Yt#PApdDB`_W{nOz#9!U!_M*#A9ohJ=rGI$}wXH8dY&0j@X zSJ#xl{)^{I z&}hx34pLaJ>&a@ZA>`ecvjVP#d@Yh62}l!pOvp_7?SgOmTR>Y?w)^}6O{m%&vDIP+ zTvt0w$~q@jNG+Jz?DH+KFW4r+YbD#c1|*(X`fo9r-e+^l*r;l}a+Aakz_X1_$5Oem zy}q{fbx3KTVd7dCK&V$|E{qgZe^4tHcGu6`qPN=>yurZZTE{9tpgwbd3Wzn z9begF9=Z=0Et{b50eFRGjuKjr>?;Wp^&#cU3?C8o`U_n?)Xp0?i<#jZnGc0=(@}>; zDle}6!X9mSDB{=Qj0Iyhz;qRSLE+*|TvRb@``cf(+#k`dEO2mPl;pO-&2WWJgxZP8OjSo(2Y z!(kAQC&QelOlI&*V%i`#=+Ux@`R+v>)mFv1nkmS$ig)@%P&IFzOO6||=c;A^?UJN8 zc980WO%dy3pLhMb;u_V#fBYsna>Dw>w7`u>G?DE=TMtBI zph$_K+G1g^X<*NBq#^TjEt5Z!u$F#JcaSODatCBLSRWNXeUvg%Xv51;%7(xnC0kjA zSm{rlBqdQbdf0`BZB;6K1&=xAr)soqB7JtcG@20_mPMGclq|Rea&!QAQqUwu%^XkY zw3|mv_G6vYnbwv%r@g#znF>+Jhbc`D+ zucBK@jn*gUh4DuPA;y3jCWUcuU8R^lx10;L;3H(;i4%YR(Kvpx#+PHqM|Y9~)nDvG zf>m?Db5}YUZIhRXomLzWI#!dTPgnqz72&p10lVL2!!aSMLI@qeR-f?QdXZnrNW3}@ zqL+BKBTR+d!)7>}n0*Q|jlv1BP9)Z4)|s|017Hpp>s9-qVH;LKuEj7pw{i{e`9*)_ zAoo^%kj@=TUZWtYBtL5eR67H`wu|0OJfM?Tl@TT1rNFi`lj+w@ z9qhU#OCFR=x?s!Y*M)Z}GCtJ)2+SQp#-u!0Kj}$QovLobvv2F+yI(#9?TdEFb$z#v zfH+Obw&#GY2=RENEHc&;)JC-?Ulw#yhDnOmPDlK_&btb4ZHH><&=0MvNM@xyK# ziTn;Q7E(UPwJbI{8itZ9ncloj`Nrqi+UsC9uJEKo22-y}=D*HW<5jB=cMiYW^6BuYq3O^z zS)QCtCn>5erMmRsh@Uw^D(S}2VoX4*fQJp*C*GTSuk!AunQx zq#x|L7FOeu@jr;A6 z-%TDX;EqkXON~4N#;TF2CAQ+bF8Lbk7Aplxi_;wFs{7>}d!wU}lTgi~d#sa>rM|2Q zdNxt>JiAvRvtT15j;qso=hs$<_LxRuST;?zv1-5#_a;zOlWZ?<-g_K2WlTPg05e!Hrmr| zc-GvVwfpLXer~VDp~>VOb594X;R*iZG+%uZl3%0UCpu-G8S)M+N4E)9zf_#pKFE9N zT9?oeJ14K8CQ+VH?PO8y#V{dr+iY?{EpT74m$vdk3}jrLoWN$A4XRXW6ho&j=%H;+ zL21+;w?7B=>ATaCRX>s^3*`?dP1|?!swsK5-JoQovoST>%^2pUo_*~uKkw9gzPt%B zkL7@K2U^-}klTUE8tRU}2TeX{8C>>PHZk2V+%|)1Nzx-(kYOvpLP`F`p{hU+exb&(<1rE{8h78aUOvvmTqnv(n3Gvj4FC{ zi&$-UqnLY|{WeNhrDY|#{W7xAHgMe$z)N0Qvfs^919DSnL4UKeBVwC+-GdhG_*-sz z`6a^an|-!S(m-Ew)28S8U^`;uS(Ex6UpeBeZ?t>@1fK1VE@*f!Gi?s{Y^L*yOr)N6 zg4?yG02y7Q(>FH-vWUL=U=jz~S(R2o(l}0qq?CR?^sUQ4i@y18y_;gQje}__6%PQ~ zGLco{7HM<0pc_xikV!Fls}O1LTbwmgO+3Xgko30eG$anaLH9&bZcR)c=L&5wFNEKl*tMAU-1c2r=KpI zkQ%AaX5X|;KqiU3DM)`w$VTVd{Xp*m(`wez#QW(SWr;*!+zBa<;0~Zq-g0VmbZe{P zm~9um^GotMNR8Y0+!4d}X3GYJd%!$=ZZ{2TUcRG27T?r;39tvztl>IkTc4%~!}T2; zanLL|YZF)L&=mNuacN85n?&S`>ALA!Mpb=eLg5H>7=19#W=D1Nqq^(4cOu2(DRaxM zWy*G&*G?%nyS+KSQ{_72`>4{9Te!UYw`{|`AEA@$iNmjCW`Zf zaN`pXfEI0{RZmNfd6M*$Fk%U0@P{qEQ$&z5Wi4Ya8ff!L+#WxQ`3atv0^7Ff4FVqF-WjKZ?H_(v0GH2=prCy&X0^MKWdoxust!nflPx{ zH(}M{nS;Duz6rK5Q%wWB_L@u%RM{i}0Q9V4HNR}*s|tKvHhb2WpVpWD`Gj`T@{F`U z^P4uN@RKyhn{O44%5fX#vNi=E7vwqKbOq!?s&3Qi);B=t?iSjXA3H*OcPK!0+;rW0!Kxa$jH^#R8P2`AR_Ft-8mtM((e}aeK;GR6uu--e z)03cs<{6o+9gppqWE%SJZSj&@`D+d9U_9j;^xtt~!}ni3b{~{qmGnUkxi8Nm@Etkp zmrM`(>~=cHcEqX$9;@Veu0zVIp!f#jNM9LWkK4wQDW5NaQeb)0lLurT5>I{!h}PvO z2?%7}*~+o)x8aEUf^Ie(ld%T9y!iWg7%IQ%tvANswc8T?=Z9(h(1z1Gh> zwiq%ei6h_N0`lpB7;brv^iNRa_0A{00)L;dK)hbw1pT<|^~VP=gF6Xa*mhAY+rxcO z+hJLj(kCyNl4Z-bd?G%T2RL$}{<@cFP@5F3P6u0wnd0e=e9yRLEJqFadk+~ZWolpg zA?4a92AxUTBrF@bW~jaKTB&yccN)kfLY?cF z8Wh`amkQM2W$EE&AlN}R=~waH5~yt&sE;Y@@0T}1>jrJ)JB9!wU7w3*dn#UFdiEP+ zj)f>c|COQQQCW++FOSe%m=qSWRNARHoShWvit|aG;srhb-L;~D@toJ)crhnLE;myk zHxB(avbL;QeRPQQ-J}+Qg~T(nN zDe=B_!T??|8SCp;Umvm2o!^G!wK-%kzo*k;2JqRs+ky2&cYwlqOQ`L;@(aevvbDax z@dx#^yOzrb* z6C~fg5bFL)sJmNLm3K$TrCxDN^WBEz^A0qrXyC(lO#=8{T*13T#*vVB?yXHu(_ix} zIxO2zTUD8Je+a^rrNu+vok^jj>y^Tm!4CG-{Qubd4|v~anbz|MSm54=>oS{IH zfJjb?Vrs?EcAIUR_f-ttMpS5R5yafuhJH;AC=w({5+zC&DX4-fswgTz<)Wy3^R4gs zKhGFz&$H{?qUi4T_x-+4#@=(yk;j;0&bijw>+ExmJ7k#$2SMuK>1upv%# zhz59`Y!tB0P>Q+qg;=;~2r{=B7xL5y=j7lgG4=8SX%N}pWn;Zy&3sk;^!sX&yv6oNxy%q%is&G3;7dwmO&-tKUV>h>|h=5Io4)$g^WA`=$ zlPvoVTnFo0WI#VviLZ!6LDqP}lb!L{Qv-VEUOKU+;i2clmKc<-y;~>h$=DWJ(A3dN z>VqxXo)-vaGr1)9Xi2~7>v{;aFB^9z0CBWO5UHoxiXu5;=iFWc(PEE9iYyt34^MN% zbQ2mQvS0bA`G-~<=NF-Yb&B^`fK)F!7Y5P9DE+9d{5T~Yh%jdyML5v|D3Q<2ra7#} zlDJb4i;)Y8ZC}Ejj^oG1f4>-k#Whw8!cwa!N&q^520R}ZR=x{r>o8`yqL4$@U^wL& z?y5}e8T>$(B3iZ7WHbsVR~D!=Izk~LEu_=EYhbri`u`~HDCuf+Sw0;NK_(5mp(oP4jQ1gtW5TM zxQeNq{Sdi4JGYA6@f=6Z=PZlJQ%4=}SsBM?`(~Wz5MP@N)6PDb!84OAJQw)zdaAlW z8%K@07*B4AvdSYC$cd{+S^)UMN9vLsz;cc0Mn2IY18}Z^oZI}A7ZnaRj(+M`d>Po% zYd-M+#=3ZvA98Y*xBz(ED}Rt#^DO|AcgNQ}ikgDi;>#n?V{N1USkHwl*?i`SK= zRt!?D3l)D#!YWEgdVXr*)JPhE`mNiRztJ4&%>#VQx)pVSFV^2WI7hYrT_4zXE;r?G zeLOb@Zpvme88rNx3+;oR+`kyx88);3VslxC_W6IRp6KEWXutofV{V)E`16=MfBHT9 z`16Ru6f_qWP7vBVIs;fAmRju`Z7ZENr04C1wtD_1_KqE`5x-w7wC#~<`o9bK&*=Wo z`Ja8!-`w1Ltn@Ri^N-|nj@xh~pAG1@>`3yrNw!j@cKmwm#q4JxoN&BD2iA>!tNfAC{D?MREH{Qx)exls(*zXXeH zvN3NqXeIgv(PkHqF>#~owK?f8ap+M5%Er)4bkzAW&3Q+@x=scQgRYo@@->SM5MtWL zny*E-bm%Q_1weG$S_ddSXzP|eti`m6(p~ryY|s}halqB)nl^ti>K-WE4_4JLJ}3EN zh8(*4;sY}t*G@tR8*uS2tnm{9q5hZ4u!qH`t-AXDC|M9I(`b+R7_}2#PukZSvfA2rmFCtGG*n8}$X>ak9Ikt$Om}qbDw1ZoM zE!taKj@mY^{QMQ;ZEyX1|0A3)?W8Zkzb4=VXz8F2==I8=9$M4M@!_C$ELU42aHQZdiBY|xB$82}M&;9+uF%M?6Z{(QY zXW*+0YzyDQ!DUZ*vn8-~>%Nb#VECu7>V5OAJ;tBQL_aA?4}`s^jp>J~<_m}+!e;c7 zZ+Bx-%>2?Zn;E&t+%)g=wQ|Evv!7f?%?Gx-?6d6|=a%u&bFYwZ zeRxo?)syB8H_ap;2OgH+NBN(Ce3*Zuy=#-3W^|NrF6<(5ev%6Yh%*5^p&o--WSQgk zZQI7_pZNHA%`5(TJmtwx_6hb2cyk-2}@BhC4=?A;QA6z*Z zv02zV>=Z8YoIMcbV7B+2UOZ*~%xBIYfAK&5a6Ij)PmxdxU)o1sf`0|TMRVW2z2k3R z{p#`CfAq)xXHLG>u>5@?)FzTnF0!?Md|}KM>HBK7-Bw-K&Oh&*arp(G8MnCQEwbmn z1Yd%G4WRYUgUm}VzIZ(BD<400?A+-M!VX}IxUYk+I>LRa604PR-v?a+c=8E~zi zx@l(HXiu?C0H34)P7?Zr$|r5k58j@QXzy;_w%s?)ulbvoji33MpTXiw@FnRjn8l--C1ulx?#2jT5tB(u$kRW^)s~X&5;AMPRoEJ$-!qI zGu|-U0P8fcnU97e`2~)|pJ6i{cumjo=2%C9&2pISj^r0u*J+sfv%j0_8@Pcy>#Q@! z$q#*$Zkl)G{tmI9;L2~`(4yQo#)R{aa6}l7U%3_U3z z^P^>GUF)pERHGDcv-0ubXDRo*|x}h$|istGK#) z7!qw)E~lKAn`ULT5j^$|E+CM9OA}l#OIG5I&;#-rNzHoosa}vz0J(+E6Ero(Fvt=GJf|+0Egt^JjdsHp`EMZ^pYhc+>o=b5X|gQCm%W#IM?0Y#WQ&MC>Is z@5{NR<2B6uhFNFsZ>lw{^S&5*y{*eSgZ5;0q^SHM9 zSo-WE_-ryiHVRMk%y$_(4vo1-?!R;*n!O9peypRlQF?&)HZlPh-o{&ZqkN9FvTyz( zSHDp=4d}d(ciW8aw$AT-=Dy`~uHZo1%{H`kpEC{2yjj+L<3P*XX7<@J*X8tW3$)Lc zH9p%nA823Q=6FEcwtds>qg&fIPT%%(Yv1kvru?>i_Sg2U)2(@}OAlg+()`WiZfKi^b-P)9 zBwpjdk#rh1lLIro&c6|`4!jm5V{i1HSys)8_8yz}(W0{vuD|MY4|A z->~>7d>mbOSkmkJ)?;a9YGvhywx^+1rnrE{DeH91I-N2nmO09SI8l~nX{ADCxs|q+ zTT`5%nNYcN-~!Z-8y60StRLUsKl}&R=K|j6d7t~aM?C^*eu^c1-WR^&3liE8aI7%@ zTMS>3Pjorlv(J61cqOK7da}(chtahhUUz%4aHx=LQEy6~$>0Ei`nU27eDH#m^q6o_ zK)ELO+(Ag@Gq{1@piB9x##6^f4qxGK6 z%N5Sm;l`{4jKiMcXjSn6)|? zexM=N{N}#V)x3B+FVhT{5cP$QdHY}qA0913_XD{w{1{x?Bm5~>+;9^JBODR~I{`2_ z_$9-PkdOv7zmWNO1e&`H0vAq%`U^+$36XYO3>m`T5}BIPek6V)WODOdzOVra6WcP7 z)G;Ytxy53dCRy_(VK^&|0Ex5I5xoDpxZhPCfEBS8&G9@fjt+Zg9&ZwYOs&99hMU&k z&YXff{AUxC)vshu!cQt{1#@0`tOKo5=X`-<6;m7~bBXMu9lj-C;eec@t3FZPk<=f) zvSF2SLnZRsWTo|=sr;+o-ozD!EK_%A(D;Ks)rePmD@mpb%ZGWqjW*zBveZ6GLoVm$gMb!_J41p`rhN`O&<)`C%9Hg5(sc;1QhE)2-&|2gpq<(G};M*(&D zVb|N+N~@nQ4wXk@r(4x`BJ*iCm(6?;mYPV{HZ2^)Z?>;9oIJ65x;t5g%QqoUy%kTk zX-wneGbkBYsH5jXZJS7?jq7HE@ccORG2CDf(GvTS>3R+*H$!tvW9Ur(-s4kHfksX~L2F?r|GOcG(10#~@p4{nox! zt6w}>2g&^B>K`^oxVBjB1#Irg2H(fR-R*zbmmFTo$|7OVuzWcE@;T--g*KF;TA z!%L7I;a-a}yGJS!hPYO%(T83st`5_=+#+6{T$OoVI;w)%CC)@$-G^4VYKJpDyd)2` z9Sv(q?Avwoo&BZUs{hR;$n20`3GNw0`KSPo9+r7T>NDoqK{mntGXB!k%cVCF!p=t2 zad_MFV*nD&YN9Pf2g#eb8Xf3Ak`2M;VfqzWg3$Tr5R&naVRxsT9VPMw9tl{$_VbN+qQvjm;cHtaZ zAE829qVFUu3}uCv;~1uequQ!@?8_a}?^V;k{23K4pvb7D6nY{-;aQ1tS+-vsgc3Qp zq_xnk|Uvghz-wA)w zQX|fb%tsab$5;>wgZ6zt&XU9xL=F6b`8t_)tCQ(odmEWS*kD*?UFOV|K3|Ft7Y$ni z;3sMU@f|i2dIIJrUj{vF%B z6Zy*Zwx%fR93D>=l+M}dB+))4l%5(R!njca0zRG+oxu=ec$$^&LIk!Qaf+4gx^PbB& z;0M!xBdo=@Ha;A*>O+m`%L(j!!%KOhP;zy9iTSI)>WAt2Q$Gux#=t2WDz{cFu9wdlC7t z67kQ~qwX!gTEj=qn|WY{Rxg=%az2dJ9y&tCv|L4)J2w!;jL5f#KW=087(n7B4V%b& zA94$t_f7X_HNH`)88vZBTjce^msWu7#%?D)#9G#G@WMreC3Vz4*CtmoZcNI?ZOVX41x^60iH-mNMQ!8Z>wPW!@L) zJv;uB4qdaT722(`#jk&bNsX|^;$JF%5I?)VUa7nEXTRcoCSf9qC}nK zJUiYK;GU!6vw;rr43EWGB9JbN9<}?M>C$B8aI0L&d*ftdnCLSgmrcMci&0WzdJ|Z% z%Bz}>v2N0(mRfMr75;5h+C2rzie9CO(E=gWz<^dWfgpzsR=?s6+coIwyL0~Ev!`1S$9 zfN-=JPe*g}1f-my@VJ^lan=~SO{K`WWRVEgnaJ`X9Yq#nJX+or>V;sEMoEuqV%fh!xIq7#I@@Dq61VI-I% zpYP~_^}?c7_cKU}q&NJQb`RVdSjOayGvIi;34bc8Zb^r5$8OY?5af37XXDWh1KRRC zj(P4|E61o`-3(Iwh~o**Z4ehsJ=<@IIR*BMb_e_6xt%tuh2ecs4G3D1(vJpcIR{%&k)tc>}_-F<~t0M_Yr= znc{}Zy}8l-_dN=m1qo)OZdt$f{k@Txe{`9(fMxJT%xWLOJ{f`3gw1;h!M67U2B==c zQ$-X5ij7Y#ER21e2=ig~n`Wu3$NWeZO%<^rL8!44z?b}DqXZHg8bsrMLN&i)CIiSQ zF7F41g`X?f>lQlk3it-KPqw|tv`$Hx-4y27dfBWttZp$Wl!3Wo>zj=qeN_|1KB+l9 zIsJ}I{SR^pL$6Llm=|>?G?1Q5T5DCh+ukRVJ{kItzmtwJIjI!wOakR#^eHu%Q#sY2O+R_r%NdXZ=${`fLS&DMXS@?3bT=m zsA*rE=Tv(Rupcb?A?#(TIMF+8xaJi zY%~5OIa7ZB0?uY)aM!%>p$nempy>JAEWR=t!#lD089EuW-xG23gQJObtFWRs3`l(Z zRlf5x|6|;$DNCzEzluV(v_h8H{dOf|;N+N<`og4?KTghETE2LC2k5_8g32{nwt;r1 z4(7<0U&i+=b8LM6SU$98?B*B+v}n~XX+7^H_f;I=m0`FpN1I2;P&jm@ibh2n2#R~*M7x2uXq|4!eUC_#s0w|Mr z3-fjG9AS!%By&G{&OUH0r2--CkfYqfi;?>BRhbr%Qn%{FNKiOL0gfCLzlwi-(GV^+ zDAuQ~%|<2*2qWhJ9U3ssEN?WD zdOw>#2sd053O@k9N%bhnFETZ}ZsY?}Prh2jBw^g5_*M?SeZWgLSvu%Q)S9nmph;tO za%i!ht)n=f_m-J$N$;{Jsl#w|w6Gi>Q6~m_Sb)L>+Lv07BgaJ>IwdgWyKnNyy!gsM z_CFNldU$Po+gPUxH%zQL=rq)UimeQ+o8dFdCY8<5jp}q;j;Nj2N1^tfidj&^j*J^j zlBEM=BT98!;BKkvpAr9JH+GmwO5Ia*j5oJfm86xNLEKqti&?Z?pw6=t*NSKfx*Lu= z)tV2pX|G#<&s!3+QKI08bj15vTtSuOAzl9L;`~yh6xbbE-z2O@2#Zj~zLExEJ_k<> z+R7(!1q-#;hR4BPl;j!?QG2UXX zUG*CAcXlB5qN@>aPsJwQAo}9N^CM$ZC9BL2WLR@b6H>)hr zh>8Bq`A4%gOgvBZKD`pt7f1`$Y7JXaLTlLnzUK!kM1JZd2M%(M`C}{dlxZ?94dx+R zP9teyM^qAF$sCj@ktR&!{qF_%uI)H{d_mRi&pX$i{!A%w`HZzVcWrkL(bv%F>Gs~G z*n^JqA3|Z6F0|nD6cN?R1KzW2C0Rm>?QII7`l>$u7dBX2gc|D_qBly_=r_cSs@|eN zFEjYw=hDNzJPYDwhS(8~bVIMPOK<38$B6~RZn#*4BH5Bp5eMiN|DFloL+J^9)pEu? zgDQbV8jxz3mw**=?HxCC8;ESI`Ag9Lj$|aTnGvESrHteR7B|964HIA2!n9efns)W2 z&bZ~p_96Y`4a1S=uBa#wG483>h_8GWe?%ixv)qB(Q4^@uihaH2OE@i_&CXJ5l`%1% zM&x^*?P|BuAclwAYoH~$`=OzNBwsr(?Cf>2K3Fy{XUu?viT)qC5&OKz*x7A=~m$&>6LJg-Z96J|>G%&`B zQWy~Ea?m7vj!VVZjX&%lMG}^N^IjUmu-LJ8dC7@z+@zH(NDHJ@FV+QDqmv*sejAWa z9d-TW46BE^!`9-R4<2;_2m*?M=}`KE?ED(vS16vVmTC8 zNZmv)(ul!cxdb@Kh4H-Cu0|7xuQeegdanL;3e4ov+hYG365?ypp&pblQhw33V~g- z@^LdSvN{dbB-XOHU5e0%v6cXFx;@;-aG7+Jl8jhyN+V6l8=QtFyL}PIBj!6VVHV%; zIu@}lRUJTVfFH`227l?Im=Q>_)iC{Po%)_%-KGj(dC>q zyEpe7BK^~6+VgQr*ct*a5n;!cOhQNyDld65M`6VVOc7*L40VL?8;XP(_KKrs@A|`~ z`iDt6eEv&^nIY=r_B3JGV1Hlg57*t;2k0Fa7aKHc>DS4!eqJes+FT%@EqenVjI4gLi<;R5l!K)WRl<02(xP}>ZGd4;1rq3K+{s)F zW){X+b+an>qMOOPIErv2b{-Mxgs^TGuX=kaP9zxd>a3I? zTnlfcmV-B>%D$i$b}m&1a4vAEG&yU91j}R!B zwq?$d<~h!heOcm4XObhwZaT<3thEm*iq=vL^Uy$Zu=(&#B$Sk)^>u4{RH0glN7Xg_ zdN+B&f16`Y3)g|odwLd5e|<(m3C121{FSoU;zSyDImoc*57V4)lKq@;a9KMWxe9rpR*RaUpY z@xN*_pMz0gd+m`mO;!Ba4id|F_9>;I4>epg4}3XVtWUyzOQBc$V!t_lxe~nuNkZa; zISf~X{0r}?z{7?rc3n6M!IC4h2r7dON+~aa=VBQYBmHZ3w_CS*1XvM}6ubsvg&?eD zQ%FgxaJE>y&N~O^hXSlT?B8DfU#y|WHRs{KIHj-1Ja4|&U`?~+s>g1gEb|s|rdyj#>p8E zT%1xlDSom-vy<94p9KfLTC?Yh=OKxsc%to1}r>V5uQXBx7P$q*0LN8IBQT6 z*j4j>&a1sGd)OPFzCs^;tnZtUtnhaE^u}M=Fx;;LJ%fZJu`DK@C44TIr~`^v-^c0s z+P^D}x&{2^sp8FU?{GMD3vYkNUmJ!Zh%B3~6yN)lr;~^Shu6;`u`}pC2sBhu3zpF6 zi_)2V2GzutVTr4f4Nrxg3mFc}?QDBOI94TJM@=-E0D~Rw1r~&LtN9+sB$hGUTT<(5 zcVz#|ArG~NlOI2unin&_C8=bI(%-CgWzA3G>DS{!{kR(Uft$r|DQ*(r+SIQS450*m)ms@hb z(XM2=KYI9Ec8%PB>-AC7li19((%_X+U%4_)Xm{T*bhRDDbbIp2dWV(zS8t7U zcdVQ`cfYJ`BQiR*kh|t`kLCbr4I8RJ-VIb^@yq4(EI7Bq9pY)8vtK#dJ?rDpR5VZ56AD;m&|FgIvNC*u@=N(a)$9i-`lR+L}gTcd7sC{+_}GtCBoZ( zs;Z9t*e@CxSifW5w+tj0&jt3NG-=Bea!vcH<2|o~4UXZ{NKfGUysEJQ=U`E2g7Czt z4<2!EE*-rzY3kwa^k9oaOq-JY(U;lY;;Wv|)nmzS=GU6pJB1x4-QMADgar)4wxcS@ zZehEYp)qST2&g0Bz7ZzA1q;8R)_sc%jdQ}jRkhU9u*1Qu8Nh@fr=lokgzx`Dn@+Nq ze#4E@IFsX}Q@^o)Of~CngihqBsn0(g8jhHQt#=BSjF;7M4H;l4ZkVswuznACH>JMKb@>~g`R2~_>LLfR(=gjDd_)&X$V8lvZjY0I8yIUof zm(Mxnz;fkdG((PHg=Xy`f|wc6R$R?MkygU3b(Yvxu~L zfGA*FfcU)}D1M<@K}HbNA@n<>15-)HcFW4S1+BQZ{A^`&swTv#crJQUl$)ZAal zaLqGt>8s0_wD*LsU58INNa7So3a}7Kt7Z1uv~u4#*)Lx5JbP|u+%sw8k=mIb4Q9zi zR6cK9jeJTbag=#xV_KyQmGF7?)S^=JD6i%d_(x9s?nx?Ypu(wT{z7p(0&E#e>_1%U zVW4Xs+-K`yDO;USBXT6&X(YKQk8mnizQ04?^-|q%1WW0-?8$GVMJ%b*dvOLR7xn$< zkDNFUyiGLYIdl@;Yo$5AX;-(rHq7mI5nrmJ} zldbbY;et@$CZ*<;$b{3%RAnFA9dr$HT8C{Q@|3ZKz!^bJcNM^^dBfcD%S?H}h_Ns@DlPF(upDkw0S24wMUKCD zy&6=Pub2JT$7?x3!!D3+#{8gl#I!0VzukzjnwDei+2Kwj6ccv*J)F-s>~xS=a;)<2 z^aZzjRxp&t%r#vU1z`1gn2+CpPt8a<)+p$2aC+cWpLIa$Wy(hbOMo*hJl)baWYcQh z7P1uX%pmj3==l1!k_=OYyMHwZI&;Z!*=!}WsTF4P!)f^txE#7|v$ei+L-g?(^pkdr zmZY!Yh(s;cHOnCQtg&--IC;2p6!d+|2iJ#lg>U<$zntE!3>a=o({;N(ekRE8n;3*f z?Zabc&Q`oZv6{u#6JJ(c@3@}5lcn>cV&Acm`=7gBZ86ZN$#`XOjRPKswrj85StE7% z_`OhH9ROqG!o)Obn=n7EK1?#Ho@-0xJHt;>*QPw|K#>%808f%bfKp0r7*U*%EBW5WuoDkfBBAe(Coun(ffbCjU-BoMnK=2~zG>0TsWGkYIQbuyQ zB7fyqX{LQl1jXLC^aLN=4=0vV1n1jiD;!cYLzGn_iSgo41g3-h}plgOe* zUm|d&ZoVJioB`}Y3dOuhCN)eltS%$-MEOM^H44}kFNEV4(JhOzJf1y4I>_^-@m7Fc zi?zXe@Mpg{$N7sx071G13oz~c6r?VR2rY4fvsPvG7zqU$Nk(U(#`tl-B1c%m6Ck5m z!WlA#>e%Tt1Ct#mT=MLgwf!LZJ-&wF6AKx`cd!E{l_ZKxnnj1#O{@Vi$3eFU7&KHgu7ElEi#pF|ADwA68=G5@-XXjO2VM|vw@t@bl zKhp&JtTgrw@BbDn71P=EvI}xFohGW`J>`hz6*m|{#mtW~RkAQCfkcxon(3Nh+6)xc zbS8~q+}@jf1n7Ij#+sHB@a|;^hO@yC9K@z zRPIj!s6(~@1{Y%h1G=Mp)hxN(^i{5E6ip2tVTj??GFAwS2Z3+sA%usrvDWO9_WLU-kH_XIfz}Q3ROkb2WbCR5769faqT8Vv<6K?73RCj29Xs^(YGZIQ8QrI@oCZFg~ zmB*~(E3p|K3@D*2P^$_mB;~xw0g}PtOueBaVR`sHQx9Vp4zHY(IR^04F zx^Japq`6+7MT8DTP*$-QYPGqqYv5Oh?RbGrrl;`3a@U3MzjTlqpB%aMn zfu?DMI%L6%V^vpc8W*X|AFV?L7O%UN2$hSW-sgrawcKB?O;WuZqLbqF$Zw>c_Hn9% zj#H4P=sJ+%LJ9ldX0@Fb7|SPlhy$~nEyeeY#!m%hSA%eEOl(_n?r}&!L+=6aG(XbL z=Cun*?qR5(x7Wmk|IU~G)x5h7@nG=%Xr@Wt+Fd`yO=fKE71E|kqYK}m6Y**km*Kjr zZ}ti*o{8I+&ujkNzdAfX$qY>Hqdwa|`z<9X^yrhq4sF9ujUneW5BNgJZxqn~j+wjT zbC*4IDI*aEi3s3W5?S^BhPYMDjU#DVFICo;k(|o;y4J^}8gq#E`AxsaXQum5q7P{z zxfDM8oRmb30iT;6B1o$wFB0j^ItUxh`Ko4NC0N4a;SlolfBT`it1t7Cq-ojKFyV7^ zIu5*&tN=44oMiWilJMc#?*QE$wDgSk-5wqsFjR&ao~=}@*x(cQfcM%fui_1eHqmzD zw-KCyWrtP&00n+do33=z;*|$;cF>?=@x+5*FRJF}B=8*z#mrh3zV{u%J^cv=Yj7bWQe=0C4 zpmD7LFR;EZf&YcK#u3l)dhCazve8os$+n>46z&rWSPQ>YFU|4)5;a%2Xa!pKY$kk< zqvttFm#o~4CllZbXRXND`01*Yg_8;s(cb=u7TaWZj461^y&i{M=?2-c`LfG&ioCYi zAhMcqj^P9wAp$S8>IvC`Y84=Zv+@oQ(-yWnXS)*hNKpzwFv@2c$JK0vYmNK^0p+i~_d0iOIK{xrFN;dXe#Bnf;>$&SarE<@l zO<(Z;UhIhG+19TxWx!Eue$!=3Cj_q73IOtm3>d%ETg?zesp+m~#4SWlm2$tQgaN1) zUQ)5R2IcDB$_vf6WnV9=O{#?nyMXuaia=n=l0D;Gt_;b5z-Dd(3yLjB)kK%;SBoGE z(0WM%(Vaq_vbwz}0NzZaZ$Lk|eico!HH2T03XK`sWPTEAeL%6|UN_-b24QMzlM3W7WSe}NO^er|dNd^}|9N9w*(UrXb@?ti&Fo*yxV9qLdpvrHt z6mTU6E4)@o2nbc+>}Y_9AlnlYSmHk5-5_VsLlNKJ;7DAIp8fgjukvRf>RPW;;xj%X z5ZANTxXaZQ(wc(XlWl?JRp#u@DzmNrl4^_M+ve8CySbSAia4fo_#fmJWAXHtqiRfs_7$tf(rPp7n~-M4 zeE-R!>YzodPyXG|Mf4ErsJpEYFX7MI-o^A2WJ@tYo+7mawUtP)ZRETm1r}fY;z#3d z_Y@*W5vyXim)dKBJh2dx1z<~!Pojoj8bmPWd%_QYR<-MUhmEU8cB}!Nl{tV%WYyYi zb^&+Vgamb|4)EFptVN;MqNf@#fman!H4o1s>QG zACGiF-Q34NypU>G_}}0c4N8ziGsk;+4}%<>cB$S@*!btTf^+hrzASK<-$z+8`}Nk} zcFv(N8m)tc3=8=HWt)h40#X1vbbrep{rzvRfDI}%xgt(0!# zF>ObyKKPx%&}WxVIv?GXbsd&^#^u|S!y!{UVo$&8`DY27l%D?oH1iHyIm&Lzp0M)` zz~2+J;l%)J`?zfNI%FoRQD@m?^nvdKA!EO-LEfIEzk~`9rlA%MD(rsriTwwqfQS+ zB!y%7)eHU$r1#xCA4Iw4sX&EEz`RzvcOXTtb=_$3_hmC9Gg-0@Nx^hK57a;YP@KBdmejl*jM#g@ww5Lus@g!W)%oU9MHIBADQeP5YF5WB)e! zFUMr0xP8%pBx57=I4fV(l4)W9p;v5$n?g5}Wz6Ta2)tL-=bm<~0Fmq~XQq+Jm{DYs z+VEI|P&y?OR*gP^o8v_oFhbuT)=g=7Ab@?(T=T1Di3i}Us@ZzV%CdaH2NvV3lfI_^ ztWD;kPSAByR_1bcsvrW)jWdAnU`wxYz6jBLZ{?zz*y)F3rNKGcKs3giN7?r?(SiM$OT-r1cm|DBQ*?cA9{-8bv`(e1IB5eK!Sn`iDJ z3t?DZ(&V1Acn6afbR-qpMkJ*yVg#lBuFLm4C70`uBwTN=zhh_@_KBMN22x~D`d%{$mY+9e;d>ye9UkUcdF6NX^)Kn@P=3?jD6_XRvAj6oTTvdKjHqeaDTGY-CV4$w|mIDubm zrlG$Z_>6q~w^raq^OB^273d3-ww4Gm2(t6Qv^{~d9ht5iGJ~D8-Z)YWlxr5w`?8$1 z((kQ@v)Zsqmasf7x6dD1E}5FsWRQH8(5?>(`kDGYBxPUG8cV!jKK1!6_(B(mkmflXp z(0PN5UJdiGQ|Hd4Rdgsn-~S%uPSyZl#kw_K+rbW&zH&;Y+0HNXgwemZenqKhj+9>F z$j$80zyI+J?8H9EC7b%|T09BxB>dU=x}UKxbW|r`h#H=apS=ed$(K@jVElA~!oIS_ zOSSb`1WhmCknIauE6ti}Kzxt6URfT%!q=+>5er5?-qpzdOT=Tzq$1NDvJ()Gd1xtaDeg!4_m(&k0hGiaD&w zN0Q|wps9%*Z%6|D@ICeJ{$Yu#xTTRd8l^V;Xido5aLqBDN}<{|$=EJJRP5rt&@1a_ zWyGB-Ro4tF`ZijoSPUEH#Ak4X&%kuuR1*7aArtU zT;ztCM|Y_c0wuFZX?s7d7=Nef5>Y|1*;QmhU7hXDb9VFp&I|vyCgD-ZO+`@~00xhm zfhjbp(bp@ppDk>%l+unYI)rV>tVDRWu}?l5vtXI}h}ZDSUDIY|!I0%IYC+>oPal2D zbMhAz)HYt}T)*7u@H&v#gH$bVwW=S~Sq?p*2Ms=;CrzI1EGx0>*>G!4UoB%?mB*ad z_rb*NiZku3n}sCa>pD~>J8m9Vtn%;RoGeK7Py9NnFN18Th5znFkC4C0q&{g*jYpcE z9Xz*Bicy{w?a9=-FT964{a*%(Je?leuOG99D@=qJMOEj0{dZX>{vKT83heYuZ+Fnk zYzmF?CR2E+d?D(uY!u&@o*HONS5Z_iRBOcQ*gO9o3unUbIxG~>$n$`KoFHww6?>tV z!b1`?L7+w3i6qoq(L0DV`ohz*CB1ugXLn(auSVBSmYuP;lnhW-+N~q&W+%*69uhXo zIBEpsMckxaomr!tGNMWVuT;}kF9S6=NsUo$!a!FpkG=h)XmCvHeZae=^eTg|kgg5B zaVxdTW`v()e~hSI|EIj;>=n&-+UAT< z)8VVR1h44*+Cl&N-{oEdekYn5>SRX}XfCZO(N;>@}FYidR3=eAZpLvGkmEu1{8$Mk+E@s2&0AQZ0}+-BeS(eKk8 zampMru8iPxZN7J_@=(pDALp#o9jGZ~;fWtZ?ZTMYJ9D@06N_^%hfKwP3blBNPfgVsd3ZFlOmulAp_ ziLrVeb|A)szXz3i;)Y$U;E>X}%7j-tIrEN&lEy2~+#t={aJS547iVWbip*>7P1?3a z8q`*{ywGhgRymMI6|fZIxG2^sM?}Zz&8JZje*qswxSD&gh?K0!bJNy4)PjA!hU}g{ zBl0Y@C)>-mrfcsC8;cnH6!>ub0q8jQi4pGMxPQ-%5{-zXnRW+BPuYpzw%jB-ybai0 zIpGyg?6x`jNf9c8vn;^sRG;zYnP9z&#?mu*e|Nq%U7V*7n1G?p@{mq`#m2Gkp z?fUo|xti1H%g`gT8e&f6KW3qZuGyOJA@GG@zZN2&ro)>S{t;T*g z2|bN&(chh+~oa$hgSVa{;M~C?p`8}bI}Ua zJ`=Z2MvSWDN>I{pkEiw@{V3qaDl07Q575~_GfSVbRh)Y-YWLssTi!AV;4!e^6-bXs`B1+ut^NAEiZ+Q5t z1bdFJc6F}cC>4cuafgi#o$xyQ_VJx>39$tG$>buvu}{jKMfS~Kb61pfz!n=luLz^* zds(N>1)_i3;h-vh+0da*NL!Zdr}ftC^w+%Ax6R@?2g%RsV-62aObdTlmE`@Mq#v|a zdGAHzIX`Q^9ZM-GJNvGVDLk)Ud_JDKvM}(h4ibbvWfFLZet&iF-=y#*S_kfc!rjtwFcRK3iXpvtqGhe zO(bU9rJlx~_p#02;kb4e`rn<;8hPPL8Fo%?Q%~RA34ObH+kWGXwK2s$ypRU^L&vWU z5xK;f$KzWaU(2?2eP0^(94`*|+y2xFXH7Y}Ey|&ZGOdcc8bRkzsUU}5;Wn;nBsJiF znSslUYO#-8Gj2L)Uc*d*qb9N5iLI4M@20M{Iloci>@M3MHiI_${%%cIZRNBBw!7zM zJM&Z2lg;PNz&~yT2p{rYo}NOL%vOzgn*nN&9}iu%_CoPxFwDIDe>EGNz)w7i)CQku zfxnB@vf9;cm9?OCBvgJJGv?r{;#G&xhE(1_p3PABUDQO2|F{3z4Str6_poJuWxP>2 z;eU)By36eC^t-t-Agg{lZTeToua5)pOYCF>q3)sm<9kQp1sk6S-){f+AevHS+&oiZ{Q`i(V) zOMhTjqt77D{yeGv$HnhU$KrNf9*!vi8w5;IJa!pJdn3cVk%(xi#+WPNka(0b~Yu+5xU320o$nP>Uxr~Wyrc@M__*^5q}P1LJz-^^b8nzN%Z zv1Yr~%AbZezu|s|?b-1lRh56rO#j4zO1-bVKjPH~Am<^%cUpL_XD>DaUeBwA-~ZhZ zJ>F%r!@2K7ATs-G)i3Atqyp%X8?ts7rA#kzez-7DE- z3my)0J8-O_|7hmJR>xNx5?6~Z*L8}1D($2`PB55 zW+v7Sx&O`<9H15~W-sM?v@PuH#eiOx`o4)e+OO#>Izu|(oF??Do7`*vQ&w@8IV3Mdm~vZ|t$MxXK{UzPqxdoq#%+%ghK{`Kn0~{%H(4T6!6r ztNr{|#GfAyosRmNqxr(jt59Est>tsyp}`BgX%knH;&ke0(e-a>A!mZJroC~SAh&n@ z;X9L2w0<9Z%Tv9BA7NPEu5|(1`Cuq5G%mqt6Z_8h?N{#dIQmhCGj-jME*-pb_0(9x zu#q8Rc2oX|+ME0j)+fwFC6i5gfZsnkTaTRX@44dP?{IhP&%L4}MVRJh??MyiX5+Wg zQRl{imhlm+NfKFg>=|TNUXUJydU-OHTj(Fh88h|>i=ABAc2a!fAzO5HKaSLWvG;A* zC+!?%f^!so=mJ!B2D;lt6obso7CyDsD7iLtO=sKUrR4`d(Ac0y`-o9*d+K~XurEKg zqUN41bsBjy7@mSFx_n$$E%W?hG4$ z7HW=_II$m0xb=HkK3miTAu4n)1=8X(Jzx$TA z%S7RMT)4UZRwOPp*l#vy!_Fcl^3$oo)SxZMgLVC?FRc2^N=$*B9fAY+gJw#E4CDGA z87S*qbcONK6T@lU_O{tVd+Et5_h(mo%IGuuxuwmQ&!ywY+;@|2mGLb~V{IjVLBY9fY$qQZ23_p1C&I0Pq(q>?=ZF>blRfJtS(IME!VcF zudh0jSN*1lh&&Ub=A8TT?QM_^OrJcJqmAlp-6NaVd>ev5qr=)V!JtQ%@z4jqBEP6i ztZcqjwUXnRp~BpMvLlY61itOJZW(!SH+!e+EfO?&c<{)d4IL7_ac142#BAjKOmg057~$-^yWmcD=#t%Qi^FJ* z|4d%zXop;>NMg8LC%YYUpX~BkDD(y2H@UvGxVf**CWSf79+6N%k*&3p`q)>2>vl4s^xol$km21M}a=`v-=Ra9@JWLL6I?8{+d7I}^ zuzKNdRn3>MvLxrnC~a>?V&?O{d>+q2x1qu$17%*@;y0YBHfC|lu7YYD>?Mz}(hA<| zaqh9nX3a8Xt#|zkY5J&_FXS!RUF@`QucI|mVcyz!!_t8Rcd&a9ISe~XfrHNJXUHu_ zq}jMP|N4r8%_{VrvM-wIzdviRZQvE{&<5h20S6b5%AY6obOn3=4{AV_zg=4Ne6H;A zO>1+dCsD;{8F4eDF!I1Nxml-rf71cmums7GD$LMaz&R0c#_eRkbHnIVr-Zx8%=^Kdh zS06~Mk2fLJ)4XB~j$>KJ6>fF>l?)atfa4bpzXt7Gol`3c%tA@NCbk&WIHIK9q(>$a zWo%Y<(H4*sV=5b4v>v@WK5HWPr!p9Bxwy~Z54at`^%IRru@;N+A6+TYnP&u4cw+X& zBfvbPuVy^@&W9fN9#5gL-3QC~nO|Jw)24mHmwnefxUBf}>2acj$jZinj_*-P&yrr3 zI-uS|%vUPp7n~k;t-Vrli$T-L#R|f}9TS>{Gc+r&emcY3V@6c-fTxVr5<}+^yle~@ zRF06gX(_8IF_tFi8hMyChK3#??Do0fwWgvIzIzVjAco_Wyu=e?H5)Ki%J12?yp&Xc zRSupl^%;?KzyYy5=4xVPeU^{1_mdm+J5fQNfH*KzbyNgTibs5jorCPq%=#qH$^mV3 zbTwMe0kpN;c>BQ>puV4)!3WamSovlC!9zQa#j#uBk|PRBoaisE;Df-2XJrn}Q)||e zVCD{q$B_sI$5jeGXRr@!E?xE3>T%8WkWyFGP672|Ko$pys26S#GC(pz- zE15QlEJrcS>>3)4Kk-AWXFbA$=4f6NnTMna->iWBlDha#47!?R{3NGg<(powmQ|dd zU;D1QdTp|f&9{|aWp85v2G|rMb-~{RmP?_2is)Qed*E&rLjpgwhevGdVX>ymxbauH zdD&Z!nHGWE49OfaYk4J$FOH4@;cLz+jzdIMxDd5v2p~0Igz2aIodfT_W_xScqYWW+ zWQ>d>EKBJzaV+(9odo)R&N(c$@Sx!c+KC|Fqc>XXGmTgD)QBhA*06id5mX#vc+6$s z{DieXaNqED^2G96`ltv}84=dYIx~r^;xz3U0$D(U2{uxqW#4Tx=+6NgfQ2v{EgPZW z#uh8EZWVc60N{3qU+MV7w9K~z7PehJH5k;Bql;g({i&z3+%duNlTQHtaV-jJnDE7S zljzD<{`j?uUHZUsF@iR#L$kf4C`m=~J(K0@M`Rf5h(b<-V9p6HSLdb^`UW zeJRkn{zMf4YFXKp-zW;j9(|AB78cR>Tra<5;qL}`G*<8kQK_8x@wEXpk2icE5;M)^ zPoY`QXJNCW!$E%h<74A`6WeQm=YpjpSmxNY78fT0 zuTjyf6M_yNgPI}oa$B~%eF#YC`T$iECucdm5Y;4O5QwB^o(swP|L%kPWaK>2fsdUF zki6iikFDPcWxD+LeiP}v!00l8ejChJ!>8jga$ds3&W)u26YKabRq_MF0v`hTG6&Lr zskv8tjC4rHIuQn;N$Heqqn^tiJpa8+o>59^!X`6KuKK(mZ`m2Ch!GV z9AxlRnoNgsLs7EqDH?T4H-k?b$V;F2UiSi@Q|N8ac+xvJjP&j&%Q@f2-g0z1FN<_g zTa6zk@1A$bDlSj<;zu-ZPjYOnYd`em--E@*1g_j0sqx~=?sKqD)M&k)xf!*(n9`PN z`_h5FTpG$3WX>Tl3RE|0W{wPe%VuAR6G!T7r-O9x>oKA4TCH+1R6O&`r$rb7#J3Y# z$5V&6*sHa$k~^j$_Td!`E2Xbohz(iiMlh6FROpt@3WyPJ{)IStldY^CcAJRjS?M`z zxr{sxF8azF9Y6hL%*rqO7d_GHVPgm@zQVUVWUXuG1=(dCv3;)rt+>7?D%I6~E85CJ zP^T$hd{vbeyNG<8>{s(>0Ckg|_}p&hS}CU9zQ3`aj=175*?V3M;f2z?*4Hrn3%}B* zHhsODp_a!+XoGcV-YWb$AW?IItyR6cl}Gt+@d6WX7Owd+X-7glMu@}9eY$PM?**Tf z<71g1cok!jFTP5L4xQ5VB0$IbrDq*8tkdk}CZSj$OF0oiKuc%NZ}yRa3M>ao$E}#9 zVrYFs=}oMJDMp!xm&2qg0aQ31i=lW~S2qIRtm`%V?0UlsAD*zVQ-`Idf_V(qZMqZ| zF-XNy4;5YUCY@ZCKana-PC_ z;fv1&s>T31CF*?Qa@H4!hO^35x{Hbs>o)`c@TAo&K{AIw$LA2q!n0wch0D=u4Mo4f z<6QHZvCKXNoD9v5zMCY3vji#KYBXF#t$ z@ocz0qHOyDRFKygmUDRN0V`c}3UBU03$cx$V-;*X4+=qb#aPa_)ZHa39bj@Zv)7=w z)y0PZpOb}siCo=_Z1f-9jlNc8Xru%)O#YBlL(V(%{cqDV@o)xi(#wj6Ak%++mDm&@^R$zRZ%AU(?NZ!r6$==Gt~E5SQSTc z^Vq^~_>t&XpWytd9DRSfLSDT(f0D8-t@QbEW80{q?QxYn09{}DcjDHPF@9)xSPCR_ zedf$ZS*vE!=HGMX1!ts59wLsenJt(agf5j*b;NGCPP2HZtbO z@=Cx7mb^4E^}bKRe8Qk4MG9J5y?Fg2X)g!a`RgN*TGf#VqXbzyhp7+zqWwhN#%jwL z#WzoSs-Yd5=>*`F@}rp$0$4h|G~q#UUS_G;9!duPyjlp%V& zYXK6%CLROpgE0!XT<@xvf02;=-#OWKg`-SZY_i5^#8hn2_~!iQ5mIA%=P6VN?~5X9 zOD~~3r`VXrPxeBZ&LM?*KBKh6bPnJiB&5dY+Q5_C;^gLlG>;h^b$MyNz~@34*|%)_ z)R}#qyB~%9 z(dgQzjv}F)ha1eG@FS#Os;1bbKwNVG)unv^(yyhTIv_UVA6S68jaF&{(i{` z>&zyCWi3IIkAovnPVjl6hme7JI@FgjN6KWX{8X6|lr^V1I1`lQ!)5i}sq->m8S_j1 zLo!%@^{Z_GuLB4**ACo)j5~Juq*fV<{HPC`bz&vc{nG=ya9++&ZSk900USAhcs+y_ zaQtF8^|q~?rgLkw7+Y}a!MM=0v9S7$C4;}-QNFDOsh<6j`vZ8)Wzbyz(3X#g%!h|P zD40#D2Zh489pGKUWWZSC!0SYd&9%U>z*CBz-rld`&*$dl8i6g$#^I}ZXt1kAokQwC z-^HKg8+!ruTj0j>DzZu3L0E()6oQbPV-Ii@s3~&Bt^Bp>=#0F|M&)~a%VwOa&ix_*IH+Mry0pg*kLSa)OJ zbG9C7W9BQpBl%hN0->9pA8TG$YgE17t61T$h8>!(9|Vf_5eU8X%eq;C=X3*m&E^Pw z=U8V}1O0mJ8|}ljwY&WCc(bc6Ay<{y6mGP(n_kx!t@k3W9Be+RCX>~83>%0e!-muJ zkzn$*7J8~%fPFh>vT?mMKmBt3EqZ-@Eb4*@UBOx*$R!jWZ+sotm}~LZ=JiPZCbuO8 z#n)mCHtV+yy>gw_@rLWA_>s)|Q!n{Embs!Eq4aB@?R90*biumVFvYTb%|W^U z){ece>qQ1u8sOAn!{}L%lgg&&n+fLl8y=i>KZi54PR6;4y;xK)*brJ87L|N)yy|mK zm`76%T4fDp_e;&^eoB7h&8_$w)_&b*7~2S;>sbD7bl*F{#_MoF2VcL#o)g?0q|Zs7 zPD%7rcm`ex!oT70T0I#!^u za-KTyR3}dknI818!PsQ%ViKDK0;{o-;bG~>vQ7}_CvT1>((Ewy9%})9EcQVlS;Tx| zgh@_#5)*-1+^l@yuj|@*@(Is2_EMKa&sDfy9MZ#0GBp=t>v;RXswIOLhk(F8xKYoZ zW$|gQT3up^M-Um9CQ;G-M9h8|klvURC+ko>^K2sk9^<0l;t${4Eb$4yRp>o^E(UrI z8y{+xncGN>U$|FYOeCt&i7u>qv=}XR+0yodld>gu&ktTa#^4EuL&>+~+4^Fq7EK6Y zBvdE6j_)}%D+ZJyc~(3e^ixX9)bMXC49_tv9pGj?v~tjXTFu_TzrWWUj`nL*ZC(7t z$TLbifO5xgy=Q)VtpV)~jQVuSxU@uiJ+8K`NYYoYcR0w&CM(nKi34Rvg2i_Y3M>1N zFYgbtYK&I2jLxp?M|#d59A$Gd?$S$+&ekpSu5mE9Wu26b0YA{>jU4^9mI$@D_jZY| z#zn~wKO#*E!fTxPk4ld-H4HaCd_d2N1QJp_s zaM6dsomA3ne`wBxx&Z4 z$BxK+#src4kl3$U90j+``XJQ|LMoTYqvQE;qKe!o{=hBAHawPh&HQpiy!;-E{QIX4 z6~{T#+o_NO{F)To@+hxB!ahIbCpoIP_f`N5F$%nLPSn9pVNW;`Xyp>i92akvDStMT za6cinZLONZb6(DFw+Wy==RDa9NuDsOm4oFTffw=`oadn9i$(n-TG{4*mzZ#DVqgJy z{|h1&u=ZsOZ5{j+jc>0sz4KG8l4IlAh{wEje7!l)RV5N%sP|BV6lymJAvRz4(QDO%clkJ`;)aa?Ts%q~7(DCx^waI(RhNWyq&tK*{CiS#j1LU{o$iOwK9a=?|{#VV@_sSf7X zj|p5@$o3_DP}7-6=TUn861iOx2Y&hM+%YyBC^gxYQ%ZLFQXoMa)3gP&S zWZsIk0XT6ATv3~cwl1bR_(Tl{rdADkI4{e~4BR&i#azJBpk-%peX7yfKFu@dI;HQK zG+@{I&4<>(c>#5@(E@W`{i92I56`h-;UA>z?6Yt|l|pXdWu2z}R!rYdyabtF2Y^!7 zy6W{dB!S?_mPst%YRh;_)b-E0YTxSZ2AoQivhdUaCJIPO=2*1OS-5?MvO4y#t7gRU z+*aPOvd?G&=M%6VeYzEtU;C2K`IKMdW`dO^v0ZZkvYt9;P^%+x^t=ye|_@y zf!<>PWFyqIkAh{(k30=JXL&AZ?X>CQc^$Nzu?aV5RLVbNo5omu^WE%Pz4ok6;I_*e zb_gM>+NZf14vj7+`euODDV*H6!1kCd$7hYJ^pcA(8v)R$N8g~Fl!cJ!)o=yL#b4tQ z)4s}&&sDZDRsG7RWgb^3L+2{Ux&&A2x|VPHES2!HR;wq5g+2d@H0L6*?^~)KE1%_L z1H|dF|LqP>!mB>WHtr1$R!ncd6KI~DSFxA8iq0>}3UD!*TFWuHf@4q9dD;2I2l~zp zQt~_n6y5bhv(Ws+q2vb9HAX85^#~D*A3XA`&$26jXfId zH^DMDrlmvgy5pWWE$bYbmbdCntL0oI#Af~V3@bTKp#4-ok1eVwdkI4Rnc8r_D@ealKhee8$R-{ag$!T`*0hhC zLF51?p-3^G#KOp@4*He0z)qV}y(hBzUI>)~;1dpc8s~(Rn)Pv&C>kp}(Bx2(`e?GM z&!h|Om|3u?g~re!YG-n^sSg2LNpYEgZj+Av%E#i*uZl0G*{%cQ3?KW%WsYJ~=Gs7t z$3kD^RiDmVv_F7|o_)*3QZ}H+1=9}+7Anwx+Q)R&M@CRa;XvAp52AZM1!!iRD<0nB zBICA>4pjxK`sAyGuyUtovb#Q$lYMn%)CX!4ReX&yQ zZa~H0RV?eH+YAAJn#|sp7zNVtIA@>gmYRs@96Anweku@HVdMvMbPOO* z?m{nXw|wM#Yu#oLP26H)+A=2V+dAGNF+7_o57kCEK~CsqgM7!pp$utR%(Np=iB~Kita`i zJvXHTYjL}(G5s>vmRCLo^?H*-$0((ZfCJI?=a^AV1G z(CLuerW~ema%b(i4_kO*N1m2Lc;;IH3|Os!cvZCW(||nJe#vO&0>KcW-+9wE%(;wR zk9rj7_3w*$;pltax5tVQbwli$^doHiJi5>lwgD&dm!)uT>Vk?o4ErJ_xRJb|e+R?o1wrlyD&7S8fJDF!A86&d0rq9TH+HnZA`&89 zYQ%8zNi$1%^)(C*D41&#VmWu>T0u;1?V){rOJ z^tkZPk9y3t-l{LmzD1|AiGTS;G;`O#$YDX=(s)&i$tFfD_?}mB39>R30b|OAH zLixlPU-+;F7OsPzcFJddAu4gKk}$4;{dpkhfn(csLos#sI0e+kLzWHWT+}##qXg@Jrt4!SH1lQ{gI=FKf8(+_4e2;Plb$o|52C2nKz8!y9desWck=b z`>nyybuRhNa;OX^Ism@;q`UX%{-+&PGZ4bZZ&Z@u#4Re@~%Vhnomi;ecJq#Yj@&_bZ| zWQmxJsze2-=Hfwo{I7gt79361dHBv7q4~+lsK9t7kq?wS*^wO$g$_>VblSf}SqRdV zfO;*PlpcF#DLjYp0Z`l)ySnJ?zXm=5`xg%HQYmsf#*eBEkQA z*B^0j2mw0GwMV0bynlpKDz6>c`n=dRL{smSQgcNu?9(3HQGe%yZ}a2FKAkMNfNMwD zXKIBXQgjCPgHVe25YAF5bq|3UsR22v(_!@io&A~~`_y6rkzU&NjV;*)=bVl2K=N)` z>Z@@QAH3EHG7h#v&luyRp$EwUNn|z=*neLG#q_Y9Pn~lXP4zaV#|ycY92FInoP17| z9;$$|@>_G#1s5=WpO-1Rpg$;i&hYPbUileEu7(VBt)w%gPVwtJtG>%QfKG8-N7n^f zI*h?Gtcp*ZgbfrMovbU_;YS0qNMr0V_`J-RoqOtHoP7l@pe}PC_r;Sz#uB{mJ!W79 z*lJxgD}(pMMDfOs49#wR1}U<8_&_#?py(Kemj&TzUm9}r3tZ%q#I|)gVh@MIssM=E zq9=$#+pc9oq7xr>Q;_)O)10zdv~Yq^NvE-P?y;ujwX#LMq_$s;-*^>%RRi?eCq1&V z=(yE5rUa#5apFzKuvawzq_eV*e$Y~OFP+6EI?18P1r(?BL#YXEZRfw}uSU4&*PNuG z8~v2I^b2o-u35G>pMw#Br8S(HC%o$K^=s}*7tM@CPt`=ReVi>o6 zq~*XJ8TQ`j8o+ms0!%ssYSMgQshQ=$?ay>7U=(VlQsao%X3lsh@aVKp`?c-j)-uQG z+#5s^bK|_O?5yA}9M_sYRF2p$)MAm|`pU%vD_ni&i9gFauU=1!6Im={;Z<>#e9P8k z8

lCAMu0trLC<-Z0lJxO*cylqqCtsTdNj##FM7=Nw~Hrlr}wGoFBW)`z3k6Hzda z2Uuz5W!?r8cw*>nY3Jhlmf~D@0sbSC$Epj*w8lJgndz7Usx>z(YxX>f-x{rJki98- zAsH?;pciAxYh|kp+YURs^zj)R4sDNSl}EOPpt;z= z>pashTBuo%9*2>_vVW1`aBN$o!pjc4I}f8sbOYp9lw~V@*H0pR#&;q$%xlnb^Ilv; zf^Ga1d!tf;JrK|O^)f9$)dQ;NJqUFj-B{j5Bdi|%#UwtRFTHdcH%QkSOf-su>eM%u zbz)7cg`X8rAhh{BL`V$!;#$>80uHfF^jQyF8WP*T@=A{|U|lP(*xeUfZe&H$f@Qu1 zGY;rOah$gUVE#UH76k#7Na=2LF@f*!tCtq)eoi6Ucjp!hcY%bL-^HW#qZ3Hn0x*1cE33hb}PXfX^*_TA{BLVh4e~D1TxC zV$a7lmq9Azk3K`_IQ|iw#+y<>ug2sLNaQ5kH6Ry#63dhK$Q{G}(7}J=1t$kjzj(@y zI(uAt*+x?7IS2K|@#$Oy=<5xIJ-%pOZ5<0g_{J91_8E#GrfF8T4*_E{1zS9HEW>yF z+c$F03)PJec=l(AExn%%x;|yA1E0k)W72ur@7VTZFNr7c*GCv*oLiRfUU|e~QJBtA z9GFNw4*XSbW;!cL?ls{Wfk)S#<1)CKW$4%+NR2~S)@$+)FY6Ljgh-fI3unzpwsuihi-56h!;oR4(CyI!4(i5@#{1o?*$ zSg{|iY5f!ss&w&f8|2`M>2c7f3IK7OqI4Vwo(^a@pI#$T5lNn<#~AeTe#bs3WGpm@ zI0rHAbs;_0OlOW4uOarW$He^L!(zwB);ZxuFGp5xe&9k)9H!%{O?k#Y$I8>b%tD=(rh=xyL14=grY|qz2(R zS7Mr%v3f0$3%zx4BAf+m*EN3Y=;d70bDn1%pd+5`&{ZOt+i(EeGhpd^KIUAp@43RB zb>f)u;FzLaN9E+0@H}BP&y15MHRAVA5zuqZoR50WRRk@b_YW`mz?*v^UEhpZpxF3M zveXt&g2RGVg2o$rwS=MTOC?XzV%$LnU-yFTM7xq^8{LQ?#Fw z7r*PAYaM**FPh$d65j(he>G!X3somy&xJ!G;hmqB5TkttQU}#m&F2@?W9T*EIjVU0 zCbzf*H=3B88+sg+KSLm%uf_PrhSoan;N;!{o^SLp$G&*zvxXc4nc0k(yrIM-7xt^j zUJD+RlZb7P-A}dgMU5o$%X!9|V|)Fmmp0xU1-|VC#1mqD;yI@5RTRbm-wJ~KG%mW~ z3DcW%jOX0U0%5NPp6hvR z8mC6FDtn>U7qqXAvJqM;Oh(-M&iBDHY^2s8n`PBEtlX~wCqlqid9+GXNq8XQ+m%m9 zY90|X2GYFf2j*UFu?31ZomCef6s~WMB zSwU!M%ghT+hedR1ord7x0LvOspC7+5w$d>lylRB6mKnld^eyaeu2I{Uj>#&-G)Eie z&un^e+jsMQ;t4M|L_p|t!SRD;>awv_B_ynMx2(~E))C9&Yab1@b~)sfT5`2zAJN&S zW#(p_YUB>S+S7DhD?!^9Yc*E|_JVmIPR-*Jnkg&( z9H-ZhAh`+3CIa-ESG03j5-Gl{?V#n5${hA&=eTvh=5bl1g9^7?qYQ;3Gb?mL6u;!D zxs}vUYfghmY(dq>Zj2SO^noMY@2-P}5QVxKH}n^xF{XJz7LEFmT_REAlMg1?t8?-2 zQr3=(@@xVHCFvQEYGCs&~Q zu0M9m_+st8YvoU=9&qC4(<6G->SK@n*p3b!GKk1~*xtklt6mQ|{kg@3~JJ%BuISLkq=h=3=j4U9` zJb;*y+nCyzZ!~?q@>V{rV1Q7o+^t=)*NUgEbgQj$5O5Qqg8AuD%YC-0@dIKb_jmTa z`O04LmUD>S%!T(4V)1-oln(Lm7=IPZCMYtl@>zNH5xd^c;K@5SiAIhk)64!#FY_xP zKi3x`V>C+*3P6NCwoBa|3& z%u?CepUsIU9z8X;Ol>hr3?Mbo(PI~nHK<%x=i20)@x;fmkG_9e4$m>2QR$>J zNEH`8Cy1H-3Xvz}j^!~VP(410U%=}~Dm4ZObeHO4Cwm0gtbTGNu!vl#aOEnDxL#NA zJQU(%Y?jS2%hO`wa}-x{`;mNE4|Me9J5R`MTuofZiri}Ib8P+$;c@RvPV_Wk|9bj11om?C!nzaI)GSqNw3ao z^d*lQz5LOuPeN$UvJmDc7?^?Dk4*v4zm$(3cyBd}Qv1N|n*-1$o&-^i-dV72k$IjKZU*@TOL1#VMD2L=tOmGh9 zTEB3t=wz4=zXIDZPT|FK47I+l&}>J1w^}oT3TK{I3c4_Kup7Nla>kxK9NAfp_~#YE zFV;`Ft)A5wn<%QO_qvW@Nt0a)!&fcT_1I|WVrP4FHbQoBiz;GF(lgZ}?27B6JxL(O zG6u%#ykNqBS8}1$DeJ;Bn^z1y9@bo&VMi8y0}t+@c}%TjHC(wjUa-Pf4mmfIwatr7 z4*2$mL}DocN5p{^xj$f6Qhn{fhF3s6wc&+Og-6oov7DFTsKFCPB3NztI?lC%^ znry|&915@laun45TWm-i0|PVKYp3nhGbZWz{A;8%oO@JbLo%y_YY>laD4Fo3S@kBDK!4l%Q`iY-X{m?DM#ktV+PDekNszcUl67}CLwk_U3V>1 z-k{3Db46;p>qgZ3-}xff(Y<&c0{Uj6Y@uL546%tX!2SeHuQUP~lXz9m1u(>D-BIi} z2Hgl!;Elf3YLJ$#gUePBY$M(B6?Xx%R2)qVi)V(61zyRFM#nObiSa?KLuC15(Ad`ri* zX)bey7j7eyl^;HhQBvNZz8%9s1hNwSM(Mid!3D|>Lgmcq8A^i`m6=FB*1op|D!7e5X8iHBOHU>bK8 zau9H`)Yv0Kap_`*9y$#rbiS}9v($duu)zv-oMmwA!I*W7G%YZKjS$aGk&90IQ*Sx* z){@Aa&oUSd#VEY?SS(l3z{4`MCKnYf54!r^^ z6_;as4qn6rab&-lFhe|uwmx+TxxkXZMu$1ytyaVgt1;4Vlr6ljb=PZyUSxrmH>YIk z<}-DmeIRUE*GQl`XYVS1b(UDIG{p4$iCjNrRF`$q0bK)>Bh8RnC}<-=zCzJZ6-p>0 z^ual{E()92>A2#8g?l5I=Go)1+N@jnhBE(Ut8n|2ZUoFbW}+!J7e&eF=RLBeRGm_8cx?VP@J zinnohw1?#ap#~?ndj^{}zq?q4Q+#YygFY{B0NMArJx03|?Y!%{mb3!Y(zFii<1Rmj z66buWW|0jSSlw44%$f!k?vlqw*MVYGd0Z7K&G)+Vz3)1tijqy`G+^LDsP!XjCnCko zU3D-a1oWd)5#+7|PYwDJJ`?PhFDzCs8Os7bc6Q_s9>MeiDL@%I&#{R%rP^6#{p}QWv4;O#btcT{H#^QMA_tEVO9=x-g4`-#9Ml5vvi!dzFX? zJdWh$@md3W@~*7Fm4jcl!Kq~ON7!C>t)CZrGd?g%U1Thpy7_!!X92|QJaiBN_>2zy zDnBa&?psbo;%c!hHa$*k=ws;l)4UdGJ8bg60;ZbYkXgg{C4TW`n_mz?M#lj=K)MX0 zd_tocLt-dT_-gjL*ovaYrlHiT<{kw$ju{*C;UTlRaOIlwFfpkka%LfU`pLA<&9KqI zvtA^O3tspDw`s|+>4;6sVLF|9P zF;Ff2zF9*D6d}`3FGj{ipL)Pgp7g;@L`z3$Q6u9V(`TQ{F*4HPnd>Qi)`!QeS7&RT zUeh9+n`J^K&CrZ9R3JGro|_Eqirq>2I~a=-VHC>CyXoj3>#qDvrF# zCv^0kOWTvSZNgvj!dCi@PtR+scuP+BT*;jq{-tBz__3bsY_rw1@;S%;y!hjT{9J$0 zytU9gf0n`G2w14bj9{Z9cA~r{BUhjF_TkMT`%0|~XU@k2L^_nvabICj_3<94^X#W?YVW5+fX zYR|zj4oS}!B{ob(q;aq%RtYD=1}nKk$KU5;Hr0Ex_xH~zBy<_$u^lz$7{qHH)$*na zjUW~RWQ<9jy?T5t-B@UQL{-d8cXat1fy>E|i%iFfbmb1NCp&TCTVgr$VzDA)P43or zJ}a5g4L%Dth@#)~wRrO)7ZBS>#$-M7b08I;z?iRI*K>aAJ7=aNAfCjrb>(7jp91TN z=h%_OTln;RQZ+_U7QJ3eev5B?h%g=*n=?=2uxopKipLm0eYCbu5c#Yugf)g!aD1vf z{zUFICWgoE(|+uPBx|ve`(nU{$l7EcZ1Sc+)|7vS<9h^DJP13kMhBfZd{-@A;ybBu z5NU^zt{}B^y(L=Km2*i~Raq=?2L-K)xEj1IqxUj_C#0F>f&Bej``F33U1|N31B5## zAh0vx)f2~g+ILid)TDF;h`@TSxH@v2s+F#^dOiE=5;X_-LX-Nf=7ic3Te`}%%*?}| zd#U+6;rgo=9v)+5%*n)lC1^X|4WJnTc&$yidONQrKSwATbiDbkh31n!sTAL&?SSOR zE2Ox->Y<-`={119$AC~s?5t?oe`i>>wj&P-E24DJv|^1Hh`qnd&4ozf-cMFVy3{5X z2+ArXG7OCt-xDi6*C?7xy{t!1JQRVf%l7JCy7udfTt4)>w)m+0`K4Wd7qr(6)=NAy z3IQZVwMjz}@@G3WC1G8inRUGm}rDfh97y>XjN?Sr+J|~IiQP>x{%mrO?TgKNi zyUBS0mcyZDC`$eh9XdD;?B72NSFq7&BYh-%9d1entos2r({H^m#$Usc{I2UxH1o7$ z=MJs2%sKVXhad2hIxo@faCZ5 z%jP%D4obotNYRV9Mj~(`R$wUR_zfgc6`@XU*3jD(-;;q##&PXS=tF^GJ3*6pRE zfC=XlvDjrPrf9vB16sm~sd%}bt|Va8hm(;h>!F_uQa(*e!LB8+JBT`oxyG>tA_=|1 zMM;-`YLG3F8W|rqlIe`)vehILEwq?M%i-Ta50T>|43M~td+_FAH z+y6qZyexC1gt9Cm!*}0^_4@JH5Wp+&dO=&f)%r9c0X+&aSVb35Z|kaWpH4tT5`n=% zpz#RLDwmD&%6^gtInr2%HO7WMAB1m?{Paa#4BWFO=mA(>XCUIMvzd*SdKS zlDa2Hj79alSv|a%XRd5v|D}WqIeN`SH}e!7v;g0HG7qJbb+__^4Sqc@E)KGIz``-e z!Sbq}8uDj1D^=d{U27*CGlj13q$@9FY`2A2CaSbO7AV)c6isj0IxfE8{Bh>T zKRR~q+$Gca`qvH2%OO|d!4G@X*nRAAu3z?_RuQ$=D>tzd;B(X|F#??S|1 z?NvPWJW08(d**8rna6EffroX|%nY7>mTsDN>>MZSrg_)4#O-@uTK0n2wN5tPG=E+< z&8KaC(@Z}*Iwbu4|MJPPd)LlQZ<@ORPSpE<6__L#5=Y)Xtuq)n#Ph&<*pcyM%b!ZT zP2+3cl$iO%OnwL}PGtCYC_`^($3bG7_;C(;*|a7rcAN;fxgx$M+h&Qu#n2}Z_sX~Q zGfq$)?Veni5ZNSo^XC&|{6<6^W*ZTI>(CciyFp2fN0`3*Ax_l=(mMEo;KUS9H5}g7 zb*;6a@a+?rea1!K2=TUFxYaM28H2OrX37;bMvZ-wYXZPW))5L}PgX*F!{$1oD`^H} z+*T>xEUX z3-Yv$Uc@9THf4ALe{i7w>T?s6`ov~ctK^yd7O<>h(|b+;>Z{Ej1^@v6^hrcPRL4z} zc-SbUW!9Cl(#S9F36BeP4x+KimLlP(W$y8hewdD+{G791)H6m|7pWc44uoP}I?LG5 za9&wMsRMfPODtmKMjx79va<1w;LO*{^%RM$pO(6wCBvsvqUVDn{IKoIwNrlH)5y31 zRo~~KR%X?>R9@#IvasCq;n6l?ArfleD6oco9zq%WdSy@XvX=VP5ooR_Pmmi!HT=vu zNR2TsKLx`B14E`{vW_LQO~y)Is9;Qr{?B;JlXmeKZ^^JHGbuO@`Ncmq>s;_<3(=(u zMLqFX_PFiyAAG>$CdZ;Z$F75Vcqudzy%-WPTPJ>~qxU}?=TkafbCUJ7&Hl=h=&F|N z$j|20OXhu1>z0>!vQUltKXY~tn8Z&0SYNIID#((TDRrsGO25|!w8x^_Sc8Qm99^`? z-9y04JY-s}tX0(YTAi0Grj%_%fo-%f)T_~1kUU+h-Uo8wyhb8IX{_&|#ojo4-sU6H zoW63(a=Do^A2_ae zz-}ZcE7K5OxbjQyc>vUNA+|3REvWh_E#G*GpFfGy@-?t>d>C^lA5H{1Ha;Q*p@!(0 znd;a~c$OGBTG9FWB5ev&*>aLLPHq-Swm8JvoHU?%<rQu4g4-yyual zH#6SnI>ZQ}%@8fQlqfW7RI3wxjmdt*^)ZOMGI6YC(1D=qC1NG*tzL8suV{@C?fgPg zPCX1e++>p~C?`zRpgFzuFQIu)xwzVI)i1@CEVV$BqnaFOIy`>BxSZ!l=+QJdV9_>{ zUnft4tCt5!HkcBpV`(f!`!7czFB#zP%mQ{N?Sv?Xa?!eTI%=tY+mb`Z4xQCS6NtfB z*(Mo&*)S%L3k7v*P^8c`Mbq_w>Gc5-n_9tY0_UCjMv4rOjZnsoujK}(*1vr(^}!Mb ze$|4SxFC90K9#0;|Vply!y>pIc+&TZ-Zxr>y8YSph zxsz_ToCL%d&oRhX3Z26W3*P4l)9ysOC$58dt~*~cbG8x5hU-?=diYtZjNdApo3+l8 znsh9{H=M)`2JVbDa4O8yD~jhLn&gZt_$_x&?ixGwkFJ&M6Hd;{BH- zz|&Y%j9i~3(RkQTHWcsh7R@(%1Sz!b$d@ajY$&8lD-B{d2=$0@s+#!&y4Na@^^l4H ziEWS{xT`r)ubknL7MMfg&)h(1WO)djixg`Z;bBOvi4n1&^HB4fm#S+aSuj>0GvQ2e z$aqWtm}7R2UAvA^+qFqQw-xW`qmSN{Pusb3=R`*q{hRiAW8U1a^fvlBW*mJZU38+m zbJMt+(czK1%j)^*bA>rIf2n^1(yR;3T_(hk55MAi!FfiObrAc)1wQkYsn5$3y@F`> zG3ND1WcFn>v)7dXUz8Z3;KtGkG}um^LAofA?sGbXVP9(gq$!V_kQ#a$ z23CczzN0rU^eP^`e0ekW;G*q?jeQb8yg=~wgMFezl1;)5nQH*I;#lr?^=|MLgqaQ7 ze1JYVnJb?r4CF@~MD|nMSjeYxS}umw`x8a5>f1^^sA}sQNjbC)PexGi8H4=Li;s-6 z?4^`in%dB1+>o7b+i!%GxsW2-e{YBud2W2vCAiiD#R(r#>FTA$3B&JP%w?@46=2i>RHrmaGRA+^~4X)?|{}N^~r@+b`o@!)W}bE%YS6Cq_oZ+vTSl; zZ~Lq*wmDIepjE>gvj8Gp5{DBU22c_$smK@~Imdaf^@CP$+CGM=p*o0Y$O{l zzhzs#+6QQQ6g3a>nYrsdRdy2Fx^PbuQfQx>u~%oT?N)TJS9;WI1O>$FGtc5?fu#;Y z?3-S3p}bb;+zOAC$M0IoalFfh;C{!4CAPx~8Z>(>dF90$9lAhC>?3@;un$EhoDTTT zd_u1pylEQ6BGw94_XzUmd0t7mR|v(CkANj}E;R;Y)E$Bx)GHqQ&pb4&4~8Z;*xHEz zeL#Z0Uu5IHYcoD=GgfcVNhHH6pD(R_5S>6f*(2FYj*GLSTkXGh5;^g6&roL~vq zTV@%9dM~S5WCnO@m@(Ln-LiIPj)`0#4D_HyE_^_!Qp&48oi-3#>;)Rt(sGXtM~A@AS`N;;hHqWyhThQTMbLg1kODl{ z*o-M|-V5N1MQ=WMGie2UiqCwBC_bIz>TR~$JnkTiKhYc4Oyw+c8Do8-v<*<~UMG=C zUJC6SIo|R#rNBJ$vxm|XsyXyLnjKrC9n^CHr{Z8_!-84^X4@|%aCGwx_Dg=*?2#AP z7j~Kd^c`FfQS1~e8#^KorF=#&JrJGZPt4SLR!S}@L2`o=Exk(BVEgn)c>~Mb30jn~ znp015jOxuHk<6IDx3%RUa-)X!=lKEYNl!+W9cI0>+y{Z(lwY$f1d(WCo!wy{)G@7s zt?S;B>LoKvhs;^a8wjpucI9Sv#unSOcD)QsOpmz*u@pqXX7*=nkpialCW`qsNktub zRu(Mt2j8aBH6H&<4$Y(Qr#;w~*nrS_g;&1Kx0U&Hy&j7->3AKoaKtk%bag|UuEE^0 z133S#>Sh-uqm>Up=p5e`Z8yz>U&YSNX5+DG|GZek5ze`STT@v0nUdJB4l|bl_d2xy zhJFGEKTn~-OHqLD&|$U5tRu4p;o8KEaLFe;#z0s6>J25QpSS_@^pd=L&lv*CQDCge z+c1eT4|ZbOAO{|@dF5O5ay~IAU+BJ>n8EA7=JA0paoU0Pdwr2Y}Q18n9qG%e%G_=GvH z_Qeri^=kc7ivH$;#dTgU(%^Z-XSJ0i5cSM$V52-R+i!$*-g48tuF8Ph35|igPX3P`E=tPuptj>Lx&EwD8|%J0~Q{iR`ZF; zAb#iJPw(LJhu9h9ZGNR;U4Ps%VMaA<>B38|Ijq=_u7(iLAN6u!E3O8M4lFME&KY|T zOdy8pzNE%*GbB zGA>`8u79+Mt=`zcPpszgOhJfqgGW!6HNKi}G#QL}B;lCxr}q*A`>X`L%u0`}KP3bH z8iIMSIFe`UgQV_T94GS!w6AXcw3V3Vk#FJHMIVADS4^sA_G5Rk=h~Hn|$hc^%C#^}?rl;JTjA*mqF^b-wVv>*-Cv^uZ zb_mBx9OU#RQ_Itl`0TH;B?dZB9fua1t_^ZRH@`1Hd=Hnk?5F9@i+mY3{*}2{S?lPL zn^5$y6#;Es_von4MpolZ9Iq6yG8;ZOW6SK@u;PKjr^lk~v;QoDA&z`{V`o2j-C2gu z#!V8{I?O#WyiF{J7k%gKwUHd`LoH8mL6ZX?maSh!MYjyx=m3||jKuH_E%vp(ZK4*N z)FL@1exIw72P4p{eAtYGFz0Q1jf+$f5QC?5LSd12@j`!8?1Rj0cwPhA zOVBw-M8@v&d0D*q+#CkZAmOVomUFfqv~+{mAM@%O+rGvv+}A=Gk}I}lZhfzf;)5(> zfyM?!9Zfq>=vBJyFE#6P2XkdM5(%g=H*4tP%YSi(TFcJoW|S?X^Pvet-!st~Ux(&# zF5k9o>o~CQ`femVUxDsvH#z{|ZRVii#%>BQL8t;?&LUs5LE)9($OVp7 zeC(v38wJ_v9T^7I3ZkzF#WQInhhhhVs5r(e4v=^RDpBdsEeW_Uegq3$hXu_Okk~l} z0%BVp-9qX<^cfJH_e@*-|zJ{HeP)7tfhxBu{>6Sa~qyws$6I&k?~ z_IJr)FFmjzKoQ8DKQ6F~0i0d~@Tx;A*&s4AcpX*%X(x* z8N5hLmCSl@jEk?{ZmUnt)X<|duj7O^Rx&p_m_^$T)HDpb#HSV|Ui^2gj*}cp){U-x z;mXG8jd3vI>^xrkD|yaGCavO|&ejJ3uik9PI<#J5;tyZgm27blo}t!;EzGNUB~RDK z$(I?a(W)MiL$$9caA=+IdLAQJGe7>UYd(keE8Mk;$T|i|+b-%-6_PhZ5Zfb{t_1>5 z5Hvk+1d&^(cq{!?@A<@E_49cX`Lc{5t#2%}k5Z^y+?+UXUMQJ}9U}P-AEL)VY^_ww zif6mf$m^X$BMT0!?6UtIEN(d9rgZ>V*6}<1Zb0!pzl(26(l@{9>aABP1Cdvp=7Af@ zVTG5>2Vzo}MN~W(H7;t_!Qcy)`zmBN(Xi2d?KtCK{%QQp-@IbH@l9_UuYc{U#w%a_ zhH>7-SNiKCfO8S7?7-b^knwkyFFp5@<8ANy=W$Rs&fB(b9cO?1L*w;tecw392NY{Y zx9#A@XZsC}yz$6aF!OJ!m2&z86c?U4pPz}VSft~oSLQpsSq{F;cjars`i)1r@S9xN zg_LB67}5s&d6l3d5S?D|9*f7nbp`f&tQIK&`dFBy z6&Ge_qCw(VkX-oeny2|)pPJFdB{3uuzse+Ngj`%5p%{eE6SQ*Xm*>&>lhxwbkXVWj z+dc%;#PdUrXmmqwm1lrh#6Z_h-0TS*A;>ztNUGUI31nU~ttP_pQIOp8B)Z5|9qAL> znk%4DDwvow*U4ndLpt;(7~bKWh;Q+ z=d#u@1kaiXo{9*^pK#Jn?C@9@9yY$!^CT+QGi$>z9_t1qifB2KK3-pBS) zJ%t6(5u>$o4hhdP1m!0$1R9}uwuvY>QX%9}K~xVTaUm3YP}6|Nun;2U+l3MzXL@%{ zu+J}HO0PB)A{t&jB-9X<5C4S8fw4gW=pG=WSw5ea@d1KUHN?g8901~bZ(@rNl11G* zLA?KYNzVF6?Qn)}JA{^Avtw<7Se|R?M75N_eTa|XiBpt-NE(q?$yu~>mRvkk`?_J1 z#dm}}orFTT7pK>B`L@hR+$TiLK)F`NS~_Vmq@!5G&^;<{G;iOXD_3 zZC3lc{0qF6D&E}BZQHgj<5M4g=XmqGKQZqA6;B%9{%y}1-})`zG;Vjyp>h5tmyM&g zZF5QY@835L96U6(`k#o1A>aH>XztYx9@sw)O2$7JA&o09ybckaU^nCu%ioLbFoBTZc|z@wS%x zW@7?kCcig!xq@Y*-W=GVx@ITRoF3$wc!A=tPKeb2+ph5!S$AuU2J42m;pF39NV8hD zFsAyf#m(F+a${~wodG%qW z1Ddzq&-P+gr`~+}5_WeZ9Sz$o4PHF94!lj{RKGzMvn+Iwh^9WgC0_HYXTL;N@~N@k zXSm52(&iyv0YgrZ@0&&@sHof_Gc-XjU(%A^;X|5JtDflitQ&2zb-LqC3fM ziq~Kg`DW`4exoay&(RzB=w&_5V3|ef(>N4NXq_`BXoG^qR&8Q$fD&7eo;(4_j=Lcj zb0%3eV9^U>HHOfO96t$*W67tHMS_$FrsLDxt8jWt-| zt8vqE^I|Aj>>$!DFxjnqtMBE%unK7~*}`=6e6?_6E|vsfTUN}?e3pEbOS7QWfL4&(@pfu0Tq~{KrclBXbH~BH@*1~iP z&+|sFv;HCzQu^(y>DU!29zWJ^o^@xvsgG<$2M=$St>UFiZ-I_2YawWAdZfl(+rjHU zH$HgE>EnKneEfLC1Mcqsuy^z^CyvKG{Tbt7_rCKuwCCFK!FRrOyyi8p8LxfK>&AON za^^T{>-KTrx=Y4CzV$8ReeZwYc*E;nGhX%D*N-#KyKL;g>e6w>S?7$s*IqvU{*|vB zZ+zEB#x<9IcARp?IojWc#%b?;=Xl5aJ~aOE&95J?eB~>~yFYyT*e}Vx&s{j)`qp=j zE3W6y!EG7a_Fghx|N6I%&tG?g|F-d`PW|WchS$G-yzX_c9dG)__l$jG`?B7?P@BPI zv({uw2{)-_3+<1$``|0}1<4vU-mPSU&9E;9_=boBCGVDMUkEstG|1M ziR=y=&65lkKM&{t$AlKbmgny+#>46^-%mgA5x17QiRU_G1a8FO$SdQiPa*hHpYJ89 zCka%ohpci5sskPZn35Iwcue>pU*#GdqPDgG1A)IUXPQehap4(ttoTco0oBKJDHYg< zXvY@ty&i1s9UtW8%RijxV6}R}QQz+|6`nK4hw4Br+A8{LE;OTx-byF()<>SN(n!0Q zc|rmaA7E}%ocJX(d$5AngiSb_w8zW99sdZ@)Pv>Cpei@^J!l^iQR zdfaq=(8ri~S)4gwUm40gWX21NW_#ETVlJQLnH0x_2SX!;B?i7+2RFu=D)2(Le`zQ> z=^aN0@5u%!qmk@ePaM7BL}sr=4S4b4nn6>4F;;$Seb74xTI?JUGX?Qj zObWNFlA(vdb-^lpj{r7uyIhSWPvj)zSb4cdnW%`umi-D~Ep@Uy>%;RPKR&0@6RG3| zCmuT=T>@LGC9eH0xkNXyMTu>WdSXOcc3{{EuW!Oz4~g@F5Mal7*Vsl9Zm$i2NWAqgcIOC0o^lB1P49gxus=Yy zeGY*oKg;=@IMgNuNE`&R#aEu`nW07^(!j5CiHFE&tNQrdtiG>^fgZagVv%=yfPqWs zcnEktVLD%XhOi#Twx`e2JznZHUi_FQ-x{CwbwG+Q=+squ4pchyLL#Z=ItjsD(Zq1I zHD}8?!}1yriUQ`^{v`9?xUg#UlWB4>E1RR@L9NaqYez!Z0LkIWUFHevU9vb7AW44WtzWc4?)C;a3k9h18 z#-kp5k8$P){$YIh)0ZmD!EwR4XOHtPxn|t|p^qAOIev_{zvG|A*nQh^-+SL}>^|YP z<4Irt4ddxw_2uKr&s{n$yzC04cf+{)a~F?KeEgH+R(E;8_{v8D`QXOckZ0M{ z(SD#bh7^{bjl8NGCd;2sGmU;c*c;Pp$p>NOr}X;6=yFxL@WEc8*cpj7+2SF1m*WO8L^UYNZPg6L zvei7P^*ZSIOCIEhHmz!k6Q4t%;lp80B3;HWfJFu&s)_EQbWO>{skKhY0mfa@1uUNQ zSRamCv5hK6tQZ?bKax?^Sx%2r02n62v-o>APhz>zoDHRJ`mvBe9`(JhKd)8Qh#_5v+8&Hu&{^ zD8u-v^;*6F(B5NoR;SiNk^?mgjnL;psaOw|ha$g()#c56LAf-YeN{fpld|l*#*r_2 z@RC3J&WrdN?aC*u@nWw0P!qG%2U+H!#zGM@9+)0L#eggwXm_j&6e4eMo~TIIDcA=P zJ5ImF2yJBLqi+`bzG=RB?3*&ie{k=9;YW?5x0d&kG0z9C`uzC#xtENGeC6ZEy}s-Y zu==y=ov?mW&o_4Kj#(AKeI_wnO#kAK2=;C=5kPJZYE$D!-5@Dk+TRga^#j$@A9 zJ$COpT3JzRiX#8I)4cb?9ycES&+_U5rAdwWO2&5G7oYmk z({wL>hjG-tYsO_)?;W>3=@#RhvpzYlKXAw;=$wz#7AUmWaPJG>Whq{+!^}n$$t4;9 zqlk^PYhEJFd?NEIG;Sa^K47V>rnq&c+{!0FPwU**?}t}8tw9gC9TYRcL){4SiIgGn zDwuAz-E7Q(Pu1;DaoCXJ`n=P|Hf=)Ee1s3X!SSNyvI_AB&1QD)>f6ryh_MLxWQUK8 zv2(55fvWj?RcSs=_tI|0r_-2dLXE%S;aaK)fS&3J3l9wcpMF;rApti z?LxFK(hAn`(2+28FQ0rON54>f`+L*|dbMfdD_mHPv#J&5y~k*&Yp)M0rwL~SEe*n< zQuSR81oaHFr`oDkg4C;U52KQcCqa$PXtf-1l-}mTdkwGRMNYL+|M>P_gAmN)&Jhqc z%@vp_&qed7JuLN#ll4=3%m?b08)f@3>~_kV6{Fv!(xJ$&y*vMVR>)WfIU9lCzK_O3PBITh_MZ@PRw;5 zd6K9mUFQNSa0>F7=sF6ov;xrRx^*0BENDfkTnxyB_M9=c<%3s2uU}xk@oN5|Lx;!q zV|M8#?9jM+-$A*HGi0=bhxU&{>USNp-Tz(i;K9RV_wL=}@czBy5dUmYehwZyFb*6z z=>OF08%lC?EUhQ`C$8g(jffbB4;>l@u-m^sH_8kKp~uu?g%o4UzOiS|fpN`c7mSae z`myoRQ%)J5z2eZg=UsFYtqGXN=-3kw8`;cX@C_5d{07XXj;^Je7|us{Uqc)(irr}* zqGixveJ(+*Cw7@&j-|H-M;gaEY)rn#Ey)l>rXz(HCzE>6zL0b^W=l9mWh@be}9la2W7Fjkx}>9gqI(i zkw=)k(9Gwv_$44;o1iB4E7tO(FKVfmO9|h`98CIXzn=@aWp*FP!M!53C6 z)T8AomCVDVSC>EOBaF9Y$w#FylxlSFhFHn*L??A(93GuzzOX8gMOfL9@)px$YHtt@ zmHcR)KYTZv9$hfS^IBsR%r$=1tmD9`M+&Hu6k!Chi8I$=IZ0|P;+3>rBsOytA@67q zv(~v!#PWtp>X@e!9=CKo+vJ1&@artM38ZgN;N(9*AD7@JR8{0A{A#v)3J!3@Gih_zR+wzNywJa1G(puD? zI8fy?V?%&_BID02TuIq6MVdwrjbb3nIABMw=b80jKEPTbY4OnUSEs=G35Z9Kb)SnW zHqs!baK|MMJ^!hc#E>&iSy$vzR>P;{?ayLj_a4EoW$2S0F;#Enh&3kkWCvc_CbHJT z%U{^Af?TTSU9{~nobP%L7_YS2mo}JQjSQt2ZLYMNY5$>?LIjPhg(W3fQ(B z#KK*M%K3~Kv2-3F!Q41EGgZ{aVOCI4mi%42%7}wo<$;!LI4|SQbTqwIz27HY))sq&@sKJk z=WQ02dQps8yX2+tFsx(W%rQ1Ntu^KI0c(sGdb>{k zIC12WkRgR=jHFi~!V{1WPkNn~TJzCA?iP0(w>@_2_}E8I^H(9Z`_IMg9DA<0VqA0m z{;_lGQRB)huN~XAZy#HQUw*|EW5=#z$JTB5ikm$Pu*(3iH00!<-X9JT zE$8KSp3eKCp!1#QZkexw)hH)uL;4y2Lg2;KgA(-SAS99u3{GTDC@MZ!2R9K3c3N{_k7tDg5J#)4lbnY4R|9)YA}UZ@`Y=i6+k&pT1ysx>0__gqF4S} zk3;dTtAj=mR~L5UHzK)fVOQ5j@^Ax)r$QlTHGP;jVP;Gxn_KWxPutS!z+V4db}S zk+A^qBU^k!3SaVHbfKEA?4=Cpm+^fp zE_)BTm_1$`3DeM3haVM0{`PlgIN6#4Bwr&}RbVKZ$dSd$Nvq+8Qu=qTA z-hTY?~|L*bne|Z1kZ{hKD`+g^%JkC4i-Q$gKeb+eitTV^E|KSbe zE${xwIGCqj%XrpX!;FinZdFH`*93atdKpEw)YydQrYzMgF@(RuQ78+&OA$4mkc1p`nTWqJHB9O1>NoJi+9z9Y1H0Ln+#EcEi zzVLwsbT=uLPk*OL1#?`9{JlF=bnq9<`J~}bvOHmTAa%M^#e!!kzin7eIScl^%A28l^xHYl6t%<&u-5m;><6-}Sb({NbZN z;|s9Y+fPC&u1A0a`=}-!-k2J6XtSL4;aniBug*Po)=qBz)M>W*!bSKKDfTWxc+4SV z$*WI-pSL+1`L29Gaaf7b(eM)bXu(CBdp0eAiyA z4Rfx(^YGJTy^{m70_=jQTzSsnr!&Q6p7D(yR+-QEbk%KNb?l-EdVhJHOn@{`^{5{* z^vFGR_Al6oPLGU?7`rXiM0;P7Ph_@N?yLuoxAfT^WR~ZX(#6Fz_UI%&8X2LE&Us}= z>FiU^`^UABu)c%<&I(t?z#S@#u%%ZJhRj_lbQRI3(Pz~Yw3m? zuKWCz;|-@>J|1`S9mefWJSK_Nz?Y;&V|+-TJl=Q8C&#h7c8=TK<`(0`6OQ#KnLP)U z7&fSDRBSXa=(w>TZ$@O?#1O+;n1I!VKsM;;U|F$N2QCO!N{ReuWnf2JOz14g{GHH5 z$p)%I5}Sn%?amt3!`{ApVzHCZwuF{%$d7tZ_+PR%xsD>9DQQ3go5_(uWV z#O4CY2{JcHvXqFQ;`+kkoUs8W44D9X-1*#TK3v7s9NJ#cGW5FMwiDJrYVL7Zh|JE= z0eVp<*Ip~8>!jd=Y?*ss%;L!TMD8W7E|EF(X#AB9qkY4TEwOZTz7-d#-_!&hBw`4) zy?tXu#?%j)Fy_&|tYn;gtPKuG zhN+R)j)S0#PI}TN4xSNb82?78hZitq=-N z9>~qLarE)1@mt0l+>?UTIf1(d%nyprx%|O*4AI!vn$I}pTLZEhc=_@*f&I!v%Zcm5 zTCis7mpLRi8|lbcR1JdF{sVylo*+>59OPKeM{guH%~HjSoq#cXqS=*M@9#3CFVUQV~;V8 z9j|fwuDCYOp~l5n5%oA&1~tSeFqNOMt95O08GL59XpHW?>uj_4{CAn&|&42 zzX5%S(%^raWKJ*NrA7zvdAe!~%rrfJ5BjXL&KeJV=vR#0yN~tvuMvCxr0Zp)m(TAS zWA?!bt>5g$Oec(!%`G=g>4EwEPC`Z@LFgLrj322h0gMGOk%WQ zDVh(jJi*UNIT{o=l9G!VOV5O$r6M$V;~onQs(Q!aDU?VP3oc5;iVgD2JpK6ylnOw_k4PaGccWu#+A77kU5a4=w zZOI=(P6Kg@VV`VZRSrF0pwNQWFf2S?f>Odh@s%^JW(5HWV$d0XGx+!-JFEp>eb~0D4e&}Ex9;F%YyWWL1#o>m`4SU5NeRDOk>6# zQ0K5poH5|fCp)X46kRIob#3Sz;COVXtU&gyNlwn9{G&*`oQpPC`3825lMjnLv4+zg z%U_$K15HfoM14xuV=0T6P`GwQu@o@&j3~6RWel}4>~u9wQxwT~$)tm=|N4oI1mNUh zRh-v;^MME}J9zmpqL>LTu3m_sId51=Zv~OZ zw9OH%lDQTQNXZyr6l$({?M4YawiG~q%UcAJaGlV~Fu&~WKYFQ_Jy>RtJSzpi>NMuW zh18+!GX`NwyU&Ss;aCx3*WSYiO&rLI7$_f!CW&Y)Ov}bG#J0>i7Kq=!bd1h&#>Iuk zky5}*i&tvR7$eJk#vv3{G*i~*E~KN&|_?w>tZx(EEQDm zd(4_wpJ$L~4P`|HjNuPlAu_vh>M3)aiq)G)5DgAFF9%Am)H)hKzO386_cd*71+)GF zz1X_|z%uyiHUr%IRfEgZFZn9}-fSS^$DcT=78l0+=rScksrCGH(lYh7;CM)IjHydcgFj!HOCy| z8D)++*Lv4l``vqk^}_dMgmIjQ^T7{}%++TsebvmSzQ0Wc~{Ws&9F;%zoABr`s5@XW<&-u@ILFY;sBt zR*Es&7?B3*4{_;`^Kz>gT%b=iM=lJ#tVJ#$)o1fX3?CFBrW{2s;JNceh$#Mvou6uu zFY6f&8_DT}WgokA(gzP)KC%wPOBL_RLwFy<=#Z<=D>1>!DHDtj#=)8c$Yvx_2po~u zNe!OMH@mj7#^{upBTnd&Gmi41URglMu@Nhr*ONsI_GOd8;CE$C&QUKv zX)0f=-HwGlY<3ZaA!ck*`ND?HcJk%9&H8IG#;HO0n!Pj@B9k2nK+Y5Yl1oJE2VP)| zMO`hM;u+w8*u+obd2c)CEwz^n{NRhFa1Kfc9NPy34h%$+*UnO1Ln;+7q}>o39{&U2FS62Wn7 zufF22E*OvfQafW6&11u*y@_Pw*m_TK)LKoSHx~G!J}AQ5wPM8%JU(iSC{4uE3zrgE zgHL!d`@uHyJ^W~qxls=8qsE6Dk4{4Mss>@> z!)a^doDg1e-X)I{D7Guk%j`Ta8lia0;jL0zSbVxp=&j8>+Mb}&^VJqwzsLb`;Tad_ zWhnCyU-smr%T_GIVr)4t3oBLX;$Vg4?MU|LF`HCtAb762@fpvYSLuQer%f2-%+ulrSTtkQ=O71DvCY0ury+ORSt6~Qtl7B?n`E%71fu?*C$FbzgvgpFk zV{i;n)=f}u<*Re$+PB9SpEJ##CW_&5us#uWYf*<;N$r}GLk-`Qw9{kBm%GTo5=Tic zZT3b!;K)ns<8GLK~p_}N!Bpy7KTE+nO0$&R?Z@KG*}T!dOd9oCDy z^XpjJ(sgG(xq#|1X_LI|LY%VF&V+-swwYeFepu1epp%B^s_6|%K8>k%s&8++(n4sx zF0|!<3qHq3Y7M2W-ZXG1_$F&4a;@1c(@RXZj2!tKL+v6S>)Xc#4p znS)dvn<*cS8=pCc*n>}uGbNta<`f!~Y+~ZA_bb#9cazmo4hL@Y}ra$QkX0*zW;9E4Ketd$wJ^xVg}saY!v zVf)a0KAUS5Bjzs_t2f9k^SdB>&12i@&v?lGHNKAHp(;q@dJI$Rc_Kgc+Nda)yj&B% z=CPQnmQeh%NrqTD`dPH`l3m$U;~FgdcwHMf%bNG+AFS7PXH>qYHo5t`@FrzMjPeVn zktWApZiv+C-G1rBw$?vHy?!PIH2>pX@!5 z2uYM5%IKcKxJjj>#m8*j-Ks%qKuqHoLXwiDwQP!IKukGc6{lsSX5I%*7C6EQUetWB zO&yC9d2;uUW|HVkmce8k4$6U7;c$^A{t`m~j>g6tL*}9QF=M^$I9Mx=$vj zkzmDvGqHek)h?U(T-GWpCjq!%%a5j}C^C<1@+U&$JZl^#&wa*?q(Z0_(mt_Bq)sV$ zbflH!+IZ{&`r;cOvFVr{E$eRKM_uL(#uugziZ3&(;?4G8m@m!){wh+B?T3iCY{X0! zp*hb)k|r?Y7&uRcqbp3sNx$qdL%EPm>5K5|xCkebgb*zg-9$#osU|Nly$GR z&N6ySXP*GsBzN8LH3gd}`9RW5$8cUgi*pdtPCnx!KXro-vSmD&?VCHp*(u*fqTo2{ z^D>{O!D~~jenRSO1?NoH=VoMf33*;%;s>mMS|r{Vo5Zwz2_esuIyI+#?BcVkH$$~e z^HX>lH1=U}b`B=-*vVFUwoc5h_$C`B;#@!CP-Pp9=AY+!)=X9vQ z)2wso?mb(sxN^lsvp>)a=mcw!@c)yGX3+k7du8JTSREuecuQX~5WphueJ@$|9KilD zYmvNIpVOSH8Cm%NnS&WVp4vLzTavb{QFyE!D_D_a^vK;^@1fWymx`pft>q(il+7}D zh0O&+azl_1$(g$31yEygKGJEXIhl|J8ME(pJ~?S?qCYn?RxcJLd_L@o#Q5e#diKuG zYdAJphyZ6labrU`@pXcZ!g8v^JT0>I9thmzN96jemwJ{@!Rcw)M%yrc4 zeQu`y72Dy=iI?xJOG(LBY|DJ2Z=l=cxB3{Hor%SM5~`ICUu1fGNbu3~hF~&M8#{kc zk%)&T3+IK5d@}y&!^(!Ni$t}(V7T`2?aZo{Oe@!lR3; zM0FbOvrn|h#YyO2^79-cW5Q~j+H*{;Jf6f!frnlJ_Cp(|^2r5`E2F(^-GsN#%D}Zo z;&<}SPW?qpyDfctaIg%>lH^rh3?wdVmTrzQlXV=4o?zo`RsO*Fm%Xr|{zz~so9Us* zgcnD>#8fJk#=;K@uG(aZjPQ_KYDEOEtA(tcSu)oFay;Q(cWm)08z1++;7sgTrZvuj zmIURWO2}r#8HfRhNEu2~ow6-ttkiKSqOx#_X2U-@fc4l4i(Q{Vz3&@+k;kJp@E%jm zJH5P9k1j4GyL=ACvlVK53?>0dQq$>NQ*EiOgJ|3B!o4u@OozG45`YI)y2+xs&Sqsi zq}HoHSxAx3%h?L9Z#p_cA9t=W6JWcnjE)*h$Vt{FoNArV5O*zZZ2L_ul&>zTcJAcA z{FMjGCo|KMhgS3#9hxdvXlW!`?FZh_R{RLNA2KW=XWy5IU+v3HEA~Q&yJ|61qfWyS z@%N|w6(|d|_q@fa_a%$E<*I7WuS7Yw1drZRSuafeRXDZ2(P4fC$hcy&ylDQ`x6d7G z*KZhi)kX7u>w-^Qv5P#KpD&tq3%BL6E60bwamhG*)syDs#d8yj_}CLp8wYIK_lGZ< z>mrc>Kv=@zVmh$BH{&=+rxGA@9|mic z!xT7i+%IepkTecd9@(`MNUOrX%`QRmOniQUq7O2g`+`I=bvhTvv2&;b$Y1iLj_KP+ zJA(1tO73ESHY`LOHU0+}#F0L6PzIX|Eb;1e3JqasM2w6bc7^Fq`GJgACuwEu)`EAP zdaQ93-|QjKaOst0dNnqaeaViR^Fbl`6pNkW@S)|t%v_6wIf`63&v|$rx{hK}r(hjR zZRe@!)irn-qVTx1A@F>K_@K!Le&jP@h(U6uH#5i*oAFI^BTe5B0`mutYml65=e%%* zto`5!PJDgH;~Z@=u-fHKKX&wqnK3JJ+@#-1fWmUV5jtg+DEc_g4O{M}YQ!~jfDCG6V9XY6vZ9m0F+nK-T|Sp39e zTG+}-jl0AQ5v10PoY_JjwBpdlAE zo;pkPn&#Q+>d&p`9Rp-waAk_TeL+*5oeL%4xJgd<&Z(ovz8GscaBfJPh&G=DQQCts z2GOWyK0mh2q>q28CV6{U;RikgG|o@;6^;p~o;gOr^7#QewL|3j!v$1KFrrBj97W3z zl1Gl&;OBK&_6u7G9iqlUHC6E?hCXCl0m-Z@Yms&?B^{`Im6@s6g@-V;qlBHQZsMm9-dFXSVWmQ6cv)`+U#tw+U& zaP_T&R<=H1%@cKHJK2>lq_iF`{Ro0_zj!>jWiYge7JY5gcw5KDgiNcj+FCk3sEEbl zhffm0O}=Vte=Vae9EKBCt$A+}v0Kz5a&4VU<6GA_^xo9#{H-f0KfKJ7yZfbUISAU? zd@*F|xZ%C6%5%yK-_FHB!b5Ir152OQA9D0jsdYnJoA`Omydw)mKCPi8c3Fpxtv0c$ z-?&MyX3=M#Sk+&|ajfQLIPr~dejzgk-|Aa5kvi?Wb6MS|o*20=vL3>hcyH=TKi4bU z3Vrv}iM(3m9*Jd;_(dFY@K;W#llx`UJ~~(IkkMbZ%dIiR(ddT?2T_ zgEPP>7gnwL!c20g_({*Ux{mnl+>C>0v#nU`k@&S@jLWup+jTec7lc^95`b$qu=xx1_KYQ6ib^pJT`)gz}n@tvDLHs=1E*MbVaBJOf) zneEsVME$JCmTA9g%)HD`^;GMA^yaH?+m=_Z-s}^x+OkQW9%#1qRc#*^9e>5RNZqkA zhDl!7VYwoTt8h6_LI>jKbx>1SKTs$7Ve7_AEynq!b# zVcaH9LZE@zb0Zudk;cCT>9eO^Y_2M8IQFwlo97vJ(Q2FK5r^i}a$a_)`r-X)HTARJ z%%!b09Gdk@VhpRLx#C+TO##U&)P2kH{?Q~1cP(-0=PZcavhRXZz+k{v0$d=Kci*LA z2&xuLQ0yh(?%8~#@rxu<=Rt$i{)NY%W;#}d6XDx!>4MPWw0?k8zzoH z)powIXKODW7ZW5~>y#hZ#L-6IGU@HO>R5a1nP7h>&QfB=XXZV!L~N@pWcazZC8;?{ zKV+?(I8D8< z4;9-#W`uWsA^LfmQv%zwCBAw4Nu0?}eN>Lm{MxRYIk$|DIH?DANaIJX62Qc2h~o}f z&ug`_|K!RM;d+nRx5{KiQw_jcQ0dbJp9p$TwfECijB-`1bcGAu58o~PA>!F zeYw^=UuuGv)LZ3-Oq3XKos0IZuj4E0F1*L)MgUbns=vMsl^mZMESj#3IRO>OyUJ3MHE+Q8j$q!mw zVq!cDEi7@2i4S9C8!_WzV+1%vi&Rp1qP$#RjH`teF^B;lHiMh+z%5F4CcJom#JB!>u-~XuXwh$1ynZ=Fh0)YyaNp_1Mz4Lb5rVjxbBIeuO1& zyH4LZFLC1S4-9fotXj*6Ej1}R*{V`wk=S{yUHVAvqtO|gv3^Nr8wj~xisheDil1!V z&T~cHQ%w5+TlTzEZ^mal>aqk+Zy9shGaFRX@y&vsxCNL?M zjoOY!-(KK^ZinhyB)-_}ONY3+E(D8_WU9D}#1hZ!EDIG6R-1ExZJCJj+gy1NjvTE@ zN3A-2msvLO`A!v}$i2AAuqVzo63t#e4Hu=+mA)9m_5Gvazr_khBEgOBc>e~($ zY3tpFtwYRPNEXT`GVN!@4^dEpsBs*JC8m2KwH^y6;K(vY{9=TMjG289>e;4z_>qKo z`=!s;7Rf&fpAz+=j`V_QKYl_}eA_!u*H(Szv+AC;ATq4%`X@j!v63HMS}-*hi0G7G zx8ZDu^PcmGK@=0B})r&aS?;E zcUQS%FvHZ!N5d?uPUD)2UvctmneDWjzKYWdiCh+B3pv!alg!dN0X0a(yF1$?bZqip zjVzT!GAZYC9p@=(xTLZ(cJ8N+n3oQ<7elN&W@f#}afFG|!7iX2^E+u1={;M%5?pqkX6f`K9p-o*8R8bX@r zI4(9Y5)fBx&!kCXaAhh^$L6W>^x4tmwOqW&to>JQ)wY_}GBG(OdTUZG6`L5|q(ke^ z-=4doUe__lq4Mxa&lc4-FPa7@8Tm<`9H8)1rfxdAsK(%@>h7y2S-hw%y$!qg?OMzn zM?@YTW4a~{#^=^1Dd#SXHobjb_Avt$pbOzvHIRNf{^31)`AnRGwu>h6Z~LP8Pd2Lc zxjBApYd7U<6-5dtgkP`i<@gpfN8Afx+zy;z1>d_X)B;%9h_tSSboA!>fu<81+cM2I~|WDL0E*2gbzZ}iQ(Q+Ki%=VYfG{DDvyL&B=z6|XS1E8gUZ zu1?vG>ON6#t=Howsu}eG_=@DXwyPU=6LWCWb-(oZo~CmvTLFosYhxjsi6!2-_nJx z{2&Jwv5O?iiqD>Y5nS$|XT7ttLR+uZvhOkZ7j>$BzUYQWA)adrG`4Y`vGd#Yt&eu; z+{@r?^MAaG=(B`XYmwIr2d*PAcL7OLRwZ&r~*Se!Ahl+OjjL!E2Mzo=1^# zu}y@L#kj4*xFfl1MV}q`wm}}5$wEks-j;^d7AE+nQW7Ep<9=wastukkJWJJMoN~Z6 zM@(CoCL02Q54I`uB!;>muUdeb2|#Qz>uQ0j^*q_9Y}A?7Udfv6<0d$d37gW*6%vowa%YusM35ZY&Z78R!CS9*m1{|IZthOp z6(t*XKXhyn&&BKUgmN4ZL#@QDc^@%AF_Fw+ti*y&hvo$bPa8f2p1gChYqZtu;>a=D zPKhk8WkZrRrd1u!RKjVFO_jSuRu`se>a%HZ9-r$W0r6N&zwi21D|tK>{{yjWk7{T-Z`0-4YA9D1SQ7@6`Dwe}z*2+6?7GICYF+sT=v7vq73#9Z4bs9@>poO7?RhD+ z`)Ls_=Lz&=O@3lLpL(~C?1DGZcb7UhF7FSO@sCV!sUekHA04TO-j0o#PZUL*Wr ziz0Ars#XRTADK7=+LO31)unSBOt8`Yg%jjU*KVeZJH)<8t`8($ctwOMpCpm$)P(=3 zU$o4Dn6yoGDQRC zn|)l8zZZs5^1@5xxI75}3jjQjct8>$Hc2Ka8jNrHWdjd{xiZDhi%G6op&7xN$|Goj!7=11Qf=4gaeX~(fv=|IM4=T?+D^Be!CK3I5%6Tch+elO`7&2g?+oPjrnqYut47ygC|g!YY8Z`@8cmIsTs>Q#%K8XQv(VU4fy z_!9>w;O$2(A$p$Bn`JCLD>jrp3Me^cD(k!~{p6PpqMEawYkH|h5ZI?C98;3xpL4VL zJ{KD)T(3S8@uqxx3xQ|NAt7Hp_u7eXyAz4`_=FXXSN`6RumISm@zRa0*Nh!FlG_MWv`?tHm?RGeYN&mTgOoA8u$bf zA6d}SOXioc3?{b5RIE_s9n)j8zWfvqg^SEOZH|Zgdd*nm+IOz>?Y%MC9FLZy>RzK8a^j zIdE(`s-V~D- z0ylMnnd)XgIl}}Kx#to+trfI>hwt;GUe4X`GeXeG}^H2=6BFj``eul;1>v&}US z!gJYjw(1*?KXB&hMHa5~C}{0WGJKUDuJdRt@n)?N6Yn^2sHQKP=8czqXndW2kIz_I z=Pm`e_ij!8@1o5vsgu<27Nm4>tWi-lK=q zw(aE4Nbhsp!^emFRtdpYIAfhJI0A~Xw)IWo8JoCy48hF%@h{yc)TMq*m96~v8H%p{5!C}T-B3toJuP;Y+OBS%EVEX(W%=GB z9%;ijmppZ!!yTw3Ik9U;A0LKS=Ipo=ks?3VmPo#RqvOB=VDFt7i;XWGP2CU~VuAa# zvh*M_7T;K_h58pe(u#18U*lVl#`kapmM-RMD+U$KU7r=P-=n3imMon+^14e47C(5> zUO4Wy9m7bGpgxhQMdrJ9$DT9V)IzD#sFW=bNj})|Q9nwUeYN)T# zmA7%~Q(DKBk9GX~Z&Lh+GnQ+`Yr8`OVqHUp8Rf_f$Bow22!jIZYgXJA}owKZhNa6C}zc+E?K zya~NG^7jD6JJ-aH9hmk6I85uUL!rRdyH70jY#VHh;;CHJj-H6TNzPkjE=3tQJ^Ypr z`|i9Un%c<3%Ro8BTrYIOQmy6FPgBpKgMo=7&dtVk4G;@Q4<9xU)SEBpUFVXS7sFe4 z`$z~=)+JpD7{6O^=omdYrHGkty*jR`v68@$TP=V_vG32X%&i2jL+p%72nK*5pTViNnUei_=PQH8`h+IL*b7K(#<+#pCtvXe8 zF-&|gyv?Zvk5ASt`8W^TAu}+%w(>MR%yE_cRut;%pxVr$5MMO{$C1uC%D$A3hXRfy zfYusG{qbsX@F>7R#kXItVNqi8u6)E%S{(Q~47U57t2U=D&VQoKlG&c#>Nq~uI+k)y zE4_ST1`HoA6Pu1ByiMoS+Gv;;AXLXB2Z(#ly%`wZR803XmbCoUo$jxuL?E`AkOx=o za%)nrxV?~8s6#2}N|bt)gZ~>Hqy`b|kQRJwNLoCdf&!p;OP|Ig!?*}vVc4|OyT1Z~ z2rMnm+%J5$1h(EgSzT~EsNq~sj z;in-}Y;Cw%#;{JECC0c($8O=L`UsGjZ5h^3I>d(~(w&NJmc4=liB&G8&eVB2#e5Rd9e0&#HfT`xR zV&EtDBG(dK8u@4@WV{`SD(Ch;9oyBmZ^jRje(u=AyFhj?8FFo|BRVl@(=Vtu$Uf9@ zo(n~vFt25IIyY`n_ zQ46(ozOW5`F{7bH<5o1)%6pSl%B@4UuKkfWZThjF@`T8z+^szSVO(~d0L^N7#WSMw zD@xr(RqKEXVO~AuX2!IvF_zI^)T3z{|DpxsKgn196{JFR{!>g*fBrNXweSgbtmS;P4dLLI zIrp~o)#v5v&T@9(O?9r&Mmv2zLoE~Av1i`_S*~5z343I07PYU|r%`{dP2(ZA)JIJ6 zY1slJq0=l~uR-hCEheq!v8O18*f@o>65EWn;$$6_61nWac0FdfcF4*vA28UnZ=W5U z^D=#6L|)e;@YVL*_Bjq(-i&lSx3HCmu?;I9J!W|OgjIFo52s!hBnmF|+ zE8jDmYw0H)#Yd19KYmi=cl+-1R(u3oBz||tC<}wZm`z=hH{ZpN(v6d5D+A9jTU5z4 zV}_gy48{eu8)PEm<5(rYL1}922`wKQd#j?0qhyK#KPVyei`K5%e~rWDV${#^D3Ajv zBf1?-;8e8iL>>|Lvp^l~@C`3tq=?qO3J1I5DIL^4`kbR~eB`s#^{Hbt&^#puSK^Rs zQe-(hK+C>1iO7F?WztOkiKcvGlJ(?(l2r={;z(r^N>0ls-nMXEn=cb#9Ct;!>JX#M zZK1x;%l47AT<)Bf=YviQr=)tri`tS0+vgl@Q}L`3;W6zrUTk3{a$`VH_RVHL4l*^y z2NrbgrYVx6jA0QSS@%%LZ{X@o^B~?yl*Wq;U5;3|{wYM(>+GY?C7Et~R87pMHCO)o z$#d3aa`Q#0#U)dYu}Q=pjbp0obC1ti>6e#4O~g@m>KEl?8<@;n4Hk{hN7zlqQTTX7 z1lD^t2w&lIEt7HNe4wuFN)E_TM2LEw*tK}YbSnt0@jzUdR6Q; zhuWxGs8s&^sIB`8l&S6)RuTp3lNN11sz#JJD-&$Oef&w!0&|i%_3{+QPjYN3jBfO09+bOjD)1OnQV;5O~t^e?X|6`la5}MQ4xCC zc|n%Q6kk$FY{U42!MA++&RPjsY-4l~EpzKatCx8$OEKZnoAc>7T?aaRxcWI~4;-vy zAh5HI@a+LUm#ML%ViQ(w5-a-T6<)tZdsSbIX)t=O;JF+-r~8 z%YD{$KaI;igMf$0Q)vJ4i$q8hrAb`nNgOaliw3{g31fLSI&MAQmLkJm7Q*LP>p1Ll zDd6#F>~1HWwCZGZ$r;LQgwH4d#b>P9h>7nSLnPX_mNsk564n9@%0fohy@dy36xZKj zQttF^nEX2z`f$Axcxq`+2_lC4%7(>bdHF=Ge*0l-uj%unXKXN)MstPUBSl^O6S{tI<~VL+n*h{8C}G^o2}Xpyvh{cp6Raas_o*LUJQ6#8 z8Lr=n<1=yeA~Z(WGM=C^ zj(C~KYl)b`MjqTuvFGJFvQ8Mgw!{ktnoh&sG4`cCT=TrrQmfX1CyFwV$m_@hX(SYZ z%g|K$u=P)0CSL85N;~yBx@MhUR5bLu}?M zlG3mU+Ri@Eq)!COOPoxK8133CzN`e6kyXX_uVo#fh=L zk|-Nv;&Z;{!nZ4-t@ly#?^B%!ViQbtyhy8Sk#@oYcPw&dDw;uJTLg<2OGV6 zZu{=ca&5M(F;Q~_$rp|Ah8tB4JM=A0UXwTMP&ijH5_eWTM7tFA(=5K{X}07Yn?1b8 zYFCmiagMtn+tF%sO=5?5x@XdsSkalvzX|8gCsAB$gl!jba!0eY6DW3>w|*ejd3j&< zko{WP^Cezy)>PIIe!@4ha|u;E8!svTtSVi@$k$^JGwDL*uLIaX8{LVgQ+itR^NVis z<$LM0He=0+qYpm6b5M5WuP-JtPWsq&xY#8EA3G_kG3`_P#dM2oDSs`%J{lUwkS!AX z5eM(S1jrz_)v;c@51#^0xGta?+fTJk)W~E~cK+AT@N~%oIC$&?2-^l0d6z7kIOhmM zJ6}g#lscX9S z5x3#Rq4P!#?g!1@KvAC_Am*D~gKC{PokVQoUKtXDtsRI*JAd{Cnba3L<3z~41!opt z&K*A3a&Y)Gb@ezud9NLkDbmb#QZ|ScGJk%;SCBK?~cwhYZLZNq9WUf&3g(Ja|qLbh*3Dn1N#lubz14AU5BL;{ah? z$uWLpi6J(a2t!V@A8eJ5k63Fh=N%i2e2ZWmEh>+hoZShYC$9AsdQ^oF61%3t zI39JZHRPx1__a^jkhlH7s=jF~eKDsV@{Y1 zi;-8`Pg8gi+{ZtUVH9!tT>w;KIZEh|4_SGChL(0JuP8a&GH;Rg#K9h*wybFepjPAJ9N;yiI$}c%uf@u(k12n@&ud-%UN1I) zN#y1nk8lXI^M#<~UQ<>#FJt`Ugcy=_ovg=++VGHagtbkE|9oa3&3U^x_TMYYMi$~QlCB)a2Py5-xkgfUM&&AaQh-5u(JKWvjr`?p#o-h+sL4_gYa z334vKSfw`hBr|daS7VTG>(zQ##tP@pOm#|@bq1wAISz<}PP~hQe|*|RUHL#}W3}2m zXEDke^!$N?$SrWz5LUh3`yW!lU~=P>LPx9?I|7@cFM6JYQZNuZJ;sJ8sOm5c>7jTO0g^vPcY#!U6y zV$g_{+HkR7juXno7WoF#e!2#yz08;X{cUv25IA^$aR7i7#lYlB4*mw zl|XFgudU|KIl+on+j&7Zra_|2eQ3#pX&>|YXo8f5ydK`WbD15+&aIyZMd z9)mC}fVOpw+CMr|+U(<(rn}45nBu9WS?#)=$TFdoKW%Cw!a?)Z_Ib~1(TZd;XVh&| z6$T}1G zsHR-iW;7NSABtU$1`_Cgf~cM5iB=wMTDtb*@pgZ);YK=ZX<;nKk2~t=)iK~LPpr=0 zI?UXYP8j&PmZkH0=}yIkos1oAl69;SsD(j~98zmmvPqY|$>W~4NN2ys8pHa8!V|Eu zj52FDp1Yj~*KJ#{Yd^3n`DGuHZwd5nH&BCUm*4MLc{2H7ie3CI6T>c7{;f|Uxp8Sc z7NvKm76EpA%1n11=(!RGRCvj{Q1s~$!|6)L%LeHC6U(x+)13okwig%pmf4lMXrl8; ziaU|%L>f$JA*`%`E5rNd5lb$1IX5M1Ad8=#@E+3f2!Sgmo?9%Vqxw#>UbM%W)fB{EPH13N<60Sk|jk?^>fq z#xdL2sY#|#Ul=BybV`UPj(&Dr(*Lb@w zjbRX+m+j2<@MYt%$J!E)-9|CTHp&pZ$bV9{AQ1BuvpzT1=K2@!!3afck2iA@wfvEb zMbgI^iflBPI(Kv>FN|O6^3Tw6#H*vme#GWUHjEl6cxvlq<(!af?j&&ESO|GN-({!G zIZ`8!QMu4pH)>>XJud8#6`5xaBO~WxCK+pXItN=GHs@S0>R6^ewS}j3?&3}HmHkZp zyLb3n$iz}o#V7-_T+tu`}ns1DgPoRlXFaUwb`q7llOLy z*8CiCQi&>phL9Ge?dvrY(wb%E)|z>JFJz5d?9qjzg<~I^mGWw(XnFj0PgH|j%BOnR zPMqK5G21bo;5x3_={z#$zmnR1_5<0z>VT&GWL*W@T>f;KUJ|%1d8oN%{Kk}SRunb1 zT3?LJx%9aiL9gTfk#~}iXLaZ5lupz&Yq{IS`kOVlpE5MJ{9Nk%iU~CzW3{phTyGdi zwxkH_R$RB%R%>61=~h%N+UXc7tdHN~JHO?58Tj(tOin?8Go;;{VuvC`;bT*u0*`|}o>IjHBk_ueLm{J^UwhM5|xR*R#dtH(~S&yjU>ikne=98cb? zkiRKbdG@iVp3UQ@&oNMAGxPT3))bMOmbSjz{@Tk@zhXVtzV&vgPCrOmO%tA6wN2N# z9)K>$xd~X%npP}nwGsW6k-^?WLls_)O|_$Saj?g*j$W%Jb8A7B(74(dh@_s9%7r`C zav@5gcr|5wlB?yumTn$wN`}&I%Rlkiq(_8J%<&uQrviO9&(qbJxFd;;H~IG{-a$lLdbsI3duITNbPi&!HN36r`c?sP#A ziS?+BD893HN|vDw-gTnZaao?#O3-m!j>#9Y;Ji1J@%qUPIMH;>crJJ$17DVHCnj;A zJmK*Z3&~vr182XM+b#*&GfJ=N`0+1{nQ0?DK*9G~ZY`~E;w-Ct`e1;!Z&>Y6c^rNQ z5g*Pa>OQg5a|aWq92530P_JRqb}Z+^c;f@|I;K+t&o9%6M^^Z3R=bI^c7OCEDySc8Ohjp832TFauQ$Ij^?;E5d)yKyaxKCUzX z#*lRoJq}@^tR0T?_{&XsDe>cdL|`G$eNoqF`V(zH3@a=?)lMc}SKw;HR(<<-8>I6` zh|KkI^(}NQ-4O|%-?0!z&GNiC#SqyyV)N{@ulP-ljaa;Y@)dEpNDg#XocjyKKDB@o z#{SW;n~z5*d1!}FGM^GFUTSM_fHan~7bV5`Pz-p+>$x$cZ~_>|9-TJhmdAiFmT6m3 zc`$X@c$;w^pX0~(Y?Xf7Ay*0EtrE|8BkfVH_^ zYMrZXjKWbiaH>)NBQsYJMr2cMK2u;)>&gDmlRt7=0A6FUntl=0T^MkRBcXf1(V1AQ zeS`+fXI$svjrB=Ak!DcSR_=wa36h{hqQaIcx#Kt0i_eOK+G7dz@n|#ek+~XEOk25A zd6dHCElW7ZAvSV?S=uzm%oA#;+CZz9PS3H|W%XB6-488E>Ffn)O13|m(91Mm;ud2+ z$dtJ4Q1<0VO)&{tg70Yhmy@Q%%}b)4-Bz49WeDn+ue->aEZ&w$O~L%c(D6}}4I6jD zwGjKci!EvFunVt@EflF0T#Z_ZlAFNRvw`J@b0{U(J0)rVj9#4Z(}xCSQ!dLt-(qj} z4Q~te8%5b5Igm*!}5W~@mg1|+SAelnq zV`F$*@w|am&#BO|!-n~GAB?cX#~m@mkX6Es|{R@Vv!bFY_>O&3iliaM$1nNZ{;5_n-)pz(3 z`i+Ku`4^aVX}&bpAz&!-%UC=e*-6I|poI zH~(^q2p=j!EK@VukXj2EI}LM0g+YtgafK#1illdzWlmOj&W{PR<{Y>3zz2M8rb1ma z^Ss1*gc-<$i$z7Y5Dfj65wp+r|gje3--+dvb}7;4(-H+|D09 zAkeEel6fv|f}U});DTjVxzYs3lgbinKG?LA4qvRh#D%D#vQf8d>UhX)ubo@)%*7nv z`PBHbmStZy;2ekZGD7k}ZewidC05psHs*%8^7&aJj{!`M6UPSMGPU?30rc*f*Q#P& z%NM?RK^Doe^Q0)XP&yaLHMD zM$;ugr#B*x&3(q|5zD5ZQ%4WEDsefto*UM&FyQbHtH#HMnB-S{lD7H8Ii_lCh+YJ) zT)@*!4V5JgX%JR6`3a6}r#D|D>IXEs3YUdNqEr2fXId1^HmVyNG?AqSJ~jL z5-4kw#;4`n5?gYLC^+1F}PI_#-{zLxkND=1zs>P0h#VftwdL8?k2f1CR4vyG< zJV^2Y5DAn#izqIQZ2G}Uuc2<6G(R}6o+$+|S6~+e8U5Ap1?87eNSC2BA&VV@=0nqw#cr70v}tYA z&aE22diOz7Lb2ti?I)eE=C#w?OQQO7Jv1WtO39=)K4Dnk*rB9v<-A!XA32gDw6C&* zrg;Es&|XOLQh6Ovo1UAN*8)rzowlsQBJ{zu9pf;WYIS{)fRwdX^`;m2c=Dh9V zeo?cY3-t?SyAU>3r51LG5*%L342q(zr zZg#d5#jfK`RN?~JZ^kBKFtA{pL-E?NKFPJsL*bIQ_}O5A5wDJ)XgU!)U!b)4Ey;=x zkjT9LjVm%F^_azB3@rlImB_gKvE>$AK3`xE!p`$koW~5C^RlR03CpGRlaIjlfrpV8 zcfgU!LgtNKH8?9D?X$F*o5sKb0874-(RaRJXn>V(W1JLo+Yuo40d77g*Vp8CM@IIUQ9ZjLX^CR%n-f^r*tNO@XT^@5{cxTd}) zikm{FgvPe@;>;qFth%n9?FvB`C(1HlP%+#NMuLb~G{FF>&Guz-pn^^i(&g(`pYvm`d8rQyqhCBww>M=q% zTXl{lwq!{m@z`aq+OGUnp1q&?YL{bJP5FApUi6lW+Sox$)l<(@~e>$1s#kP{D<-wC9696p*m$BW7%>_LU6$7D; zU_WT!B&~9G`GrSH zE_Taayz|A6_}(V3)Rlasw=KN%j_s#NNP&TmS6HJ_7iD?NT1?l(8_1gilS7X@(qNGKkMVn8 z!s1svcy#1y7#8T1EHlF|!oX1iG6u^}V_ZKBY(KYIF_17`&#H%wH3~I3-aHzwC(z^& zE9%)g?fhj>Vq=I@-fPX;LRinel8+Cf>qynwvqS8}IDd~rTD6pbL)KJ2n#?j$X4)gX zv(hUyrl#4#kdfs3l!$ zXTmiNI`HE2OH!!RQvlKh4qjHWv8|mYr#Kw^kyS7?$n_~O!XNT@ko(?kaa{5IX=}(94OrRiM0(fL~1iBsA#oS zp^_moS_oaST5xrWs||{z&bEF*Y3EGmg%UYbmOcqM#x$|BcP0X!)UjmOF?z9P2f340 z<7xkKUgSKHIADC$*f}pjX@bkLg1SGCDQ(N4u8(|q(VCrdw=MOxf;jCd_S52UD-7eK ztMN^7wR6_pDa=gq-O?J8DIaL9Zz^jQ(|*%ig;EcJ6J*PQ2l?P*J=K^Xk4x{wjyyTX zHaAcJu$I2$T|21PdKblWjjditTn*KQ9{bj&PP3nGGjw8v;zJ~vmk+H4WuaXz2;&_p zb+w6=UL#89`AWwcwNp-3h$}$;8=T~>NfUfF=j$E)MJAY7)*8Je^N9yxLq*f!QG@Rq zU>OertTr;0XEkUXqgw0QrdnoTq8^Wfb5eF^8cVMc`>Mi|KjdBtq{CH0E7In|1ES3w zptaP;cJ#4`j%^yWVy(nlyO*{}{jyzw=yOKG`2%JeK(`?E?hiKRW*!fC_Be>GS7+JI zd+Amj3$-Q+k&gHpPnW$P9;AbB>DBFa(wVwa$Y>XY|JAB$t#aO|?c5yXbXL%8JfHV6 z637x6wJsUUM&rPebFP90x*q$40bB@x^X@b(~cJJIa zc5T}-c52(P?b@+t*G|DXwlHMpTM9a&w4L!xtxtG}yizx~2;o3RB3ZeKjWl}0x+`JV z#WL;4DcE_oZDZjinaFnaTIwSY&6?#rccu`r$ff$r1yC7I5*WkS$(Ps8By`^|x9E9y zOj!UcXOmA6<1@;;@-?-Pa%{5Uh+*&%#jJV#WPlax0NL2%j=fHPV=WcdH|ABC)W)dT5Z$Vt%%-PX?;0Q>|7Jc zXq*7^D4kkErtyJ=RU0^3ZLAeG@pPrgkGc}WT;<6=PhnxygNdVz&xqP9r__Z?VUzlK zJqybrg52bUig)tDSCaU39#uEnGG2J^Ma&IwVWOeK22Y*SwNBWK4|Qrf6v958te5Zr zY){_qTjjW}i~9h;z$?0d94oHRL>XDw)GTezv;8FBj<{0hjelyPHkXxZom+A;2ZneU zcs@|Xmyb=`(;*(3*~grNHlGg?3mxx}bnX^z+O%fC$ftjjW>y^qOC2oWt$49;T$FO? zylL^HtxE1TwTQ=DIKkoxS(7jVd#%`4K}7Z?-fNy#@%=f5dEEBS)EscvgRSPS^T<;} zZ3?<;$JViZ%hhB1wc6C~xb_-to7LYuc5L0Oi|6f_*l#xGk7I!IvwCvl&kOrYzVsm0 zn4gAI0~BskFK=BB`(&TCKl|EOY!PTDANX~BJU(H49e^#_WiF@B5$(*|1`JWiy@>&^ z$4A=vyoE3Ec7z{6@nfCglP)#rHCJNtDge1TUpnmQCZOeg{_G{qStcoFrC`lsnX%OP7Cya(Y!iFOkHq7h=Ejj{!WQyaY~skS za~0Y#9jZ1Ttq^*AN`^frgJ7AX!ieB}5eH{`p=d?^oP11R)@M(WJsSu6|I4n3! z0r$ADLoO-n#X9YcwL;!H4rb9zV?hdE%PV@p-C8-iCE!69dSv=DMz%vANwaZ0`Eh4*nlK>I7dqWtJwqL{i4 z9uNAeS*e_w$72SaEnR0g1Mv+?eC9>HbjSk3Y?B^CQTbXyt95SG)Vk@`Qm`JAHuG@G zL%DjLf9VHK#3sY$JSjXOO6O2;05Cys3B=e$^4ax> zu42;e-l2=)YjbhDecRZvgD1-w6m!3G=gx8MHP?)7TQ=*$dYepSStls(JuW``k50tx29!A?TXfokEq|;rqX}$3?GNE19}9wY%G&7B_XsQZj7gjA z!DOF$A+EM^hr%M2u6&zl?La$^$(@jDl5-Wl%O7udcuON2Ua^fl7?{Yi=0MY72Ryp6 zmNGPX%L1A^BpT~;>~{JueKE=jcil@wkf~xdfV^9 zxl{J5sjMXMP<*Qg!v?n69w#^;c0i|jId`1GN$6Ttujh|_qyo3Cy7nn@cy-(*Up2i9 z@|Q29fcJTUVHBD-65MuyUkuyeOFYIOSrbmMs%Z~qI8Ief=UyR4vC70N>dR*Iz&LJ zh8B8sqaZ>OiqeaUG^qhXCnzPM2%(1_AoS2eO-MWWZ~n8+)vRx=Z>^b|nR(}Z+SPZ4 zg~ISpFCvoS15g+FFJcfev#~PjK+msx&b&oLwCXpAS8#jh9pRVi%-XNGDo}s60?~*;9w$Dc}_)iyb zdeFXE17Wvj!81Pprt-F=?5A|O{keQ!ql?5-uOoS8)vkqo8yHt#yJ~KI^dLF5yYr$L ztyuf{ht4S{*(Sd>%ig>HzJCzx`h?OREzsP$2f02YSO)Wjc>IF+d(BU@LpDZ3=WMt7 zhXeJR6q*{&8K?o(gB1BRHO9+!JD$N^By+;v+zKkn-Z>xb*nR1ZcADwF#OR8!d-Q7+ za=LLydW>@4RUqwq>_xK!vT4@^tHEE=)9HZ8{ksLTTFG|YJsehb67X2;Pzusp7IwSw zATG=HmQV8ozh)0lA_|-doe3rt<|0IMj)n`c%OExlaxm^jx2^S9=Cjjv*pTfT?#kK7 z?~XiLbJocb=)**M7=f0L=b~dvri0o$qPwy5y(O1Bx)ZO-&plOMts0)_iF?#RA$>kw zd&PVC)yp-JYmj{mDp(rptvA&YD%~WXbmZI5JtZv^-nu!BE%W#wdEx|b+CydP+owI*CE>DPdOAt<&qWcQ9@G-W2D+IPU4#4*-6f*IJ?M*9uqAn*G(qlCRn)&Hh$h zEKx_;(f+9O{nA&EKx$P#n_m$wFt17S9_rFWyCvk0O{7*eJUow1)9UGN0a0AIeh1&_ zZnQ#SFk{LukbCTkCTysYE!5E3-tXXAUY zUFZFH`15y~$?0c=U=Lr5Yo{YbGo&WaVCPR;4j)!eB=BmhbSmqIhg7TtwHXR|98DD5 zcv-5teRK4uK6gF-==J;iL!#g9-0vZbOiSNpQ^v_9e)yoP0!E;KcUR+u#nwD0fwA@e zcaMDHcryUa|5>=mx8AVrj8y5SK-X<3yX{siWNo2 z68Af#>lUsIDwA#34X)Z^UVKZgblln@>63mN>zJLEz?tZtFr|gamd{ekyb)bv)G%;X z@6{jXC(uJfZyW=yweitv6a@*jTWE);2!do)qJgJ|x+s}YE(gj zN%@A!fG80zrZOP){-(y7d9p6q_lJd4=F*;sezs!Yms(_ssF?%9Kke=T++oNcf^V8j za^{`C*_sr4qs}U_Sd#Q78QA#C+&rvuJU3*eHP30|3J2+kDO?*<^k&0idwt!G3mU~b}ubVn{1hCzw+fA zvC)RDrUKEf7V;gFB+I|;DK?FW$4&8LRWAqso$0g-h`AOoP2h9%8u}>jG~)UxPX9U1 z;IGhw@HlO^GpqToomuMCRChO?GUGnIv99RI6YnbEBKJRheCF#ZX8w(PWB*YV|1XQ3 zua$tB_bP8x5qc{2rxjxYLb2K=^M5i%k&%aXI()x2ew%3jftQlL2($ndo95F|_T0>+ z7zas17;PBkHf>FNI3U60AQRSo_-iVp(A+jCumWx&koNJdcLKUOfYUUFE$O7lXnR`y z%Gyl6?<(ksk~45>i15t1GM9Rg?52O=ccw?+Wg;%w8cyyEwY zk6%`=%VTxUSE^VK>wd|bP>5vYV5a_5v= z?wh}t+jW*NbmaRhc>c<~ZlkB5|Buk3k!^)M;w z38+3}^yT<~W^K&5=Pg3M`y0I;O?x{r@Ed>0wALvM6dXN8!g}L$z4=c9{gvdZV{^b&SdKONv+kWz4TBaH9d$;?I*??6-~4 z20(4;0fP&X7KA#I=o1yIR|6))2i~rB&KJiOlvAH=pbICsl>hts^DR8<;T7BRfuMt8 z)Gd2#a||!PNcMhd60R1{eD86Ac!^`FJea}A-;nIK+8=Yv(zGfzDyXe0^E3PuG#9#Y zdsJmhOe}hpJEb9C%+uMkkhbgQ1`lt62RJ?75e(63VRFLh0+ z8!1|+8pjUA@p5&ijk+%0YUs-=!e455Yr)tx1qF*U^UCAo0&@N=stjXPOJkKo&*iBa zL~Y$42}lmhX7&nT2XGPLo|7GLV|ecR68Pn$u1ON0CoA;H-8N1e>{qPZrDc~vqiO92 zp&$5fdB}~$r`DSb_P6FoUQ9kxMzrg{SgSmkseI&=?p`r=D0;Zu`=3Li_ry|ldb~ml z-nd00tl(T|?$N0vlYfhTPu}_@ngTI5tY$~e?$oD>+;ToE zLOJf<=g$PQJMkOIS<5|F;4bO>=!ywtQJAd?ZsDv?miPrrtA^q6mi})DmwlterkAm0 z8Q$BvfVBm0aV66Upe^{V60jm89%gQ;Wv-EGge_VGSwtS|&*X+v$AutYN+SR5_e}E5>i3%FOAmefA zGG781ce4kAyG8J_(oh6#{iRe20XfD|-}yxkF~mrmkM6z}sW7QU=ip^+pAa%bNe9|Q z2HC4i(vl7VhYibmxJb!eDutD6Dn?)X(X)Ij_;2!)c4dpr%+P-6Y}{px`$KOaXtoXf zx#cwfhphWC`sfu8d8)c1$8va+`#{_fsfx#7tC(xNxC{r@JjD+gGFC@u-qecN89<5| zhOJJL(*0W0vkzjC5-kT`+~B(!Te%tB;}e?8XTpxA67JiAM$H(psXYEymY*v7i6_O} zbf~}Gw|hC6);(A}^?vex_=!g%umLS4+rlWybG4zRARzXlnXXWQLoiMb%Oy$uP5H*7 z_jYO-cqj^rK=Q=FXulztx7mo`#I|I{MIn%Q5{*yO?_y4$fp58G0!7B@Qx7CcVfm52 zq(JF361@XuK}`WT$$d1+CHm?|QW2%k%l0-BWhB%urtT?xSclWY3S@78fNX^lC(oB* zj@)4d!KE^8S)&CY9{(pB6MfK(`qamY=zI5fOv>gfUleI+@0j)IEZ4+|DDTdZY#-ZW zFn6Of8*Z}HK$-!%i_5SO-EAp;k;CS#X3plMzoXcgF?T67{1FlB{SDjbbFK#_Mt|pv zr2BpaC`?BeqASofB|BQDolWNmad0tg&@xCD%-F)|dS||6ybvPVU5;bi{T=H~t|<)N3X*S_ z2yy$`FR6V`CL`#JWby3R+~9u`Q?B0Xb4$pWfkSxGba>;A1oBS`d!0I?ZKiS5#dF^Q zzM!55_eUwg;5X{uIP)6GV_j^m5kg7+lBA0^CH_BE2gJi34`q10LbhDPTnDQPxP#GN zcvo}5qR!l#Zdk_?s^|Z!{$?x2kQYeZ{$uT?);Mp8e0qnB916}UFJ0P~14wl>nTi7B z!SJ68-tNHa+R!DxfYx}%wGaNq%g4BBb><4*Q)Xge{_UvKKk|#Rd71yddl+60+e4>K zq~YYBhSwOdACg50GvAO(_V}dyfMM3S(KzS~3&Up8$37Na+uhaX# zT|ofw^&(y?BRkbw-Bo6icy>|&90ogd!m5>P#RpOev-qs=NoD@x`mXHAu(q@_y4}Al+ZAePsZ^DfQZU_?Iz65D>Xwatgbt!#@jhW`FpB}&eyZ@Ac zOVp4ymi##L(jo8LzV6R0s}7r}GE_2o*O8D+$tE-fHBlXintVqno;RG34rECGG`2>; z5)tXc6d=*q2RWo`c=|3Ri3>YM1Wo^SGi3WG;oH>cB@$wXHadLc&@2#Wl)U>7dr0ff z!s{VE>*>$Jen>IMh`^7uwfi=Kd~=vWs`U*)w@q395AM_?FCn|2uDT69Nnkc(&n>P% zZ~qY~0u&gFGPk@&_D3zs=8N{QM9Co$kLAQL2c70Y*_qyzoN~AjZxV6g_~tQ!OBQUc z;_eRDN3AE!fTMU9CS`c%SXZG~!&&M`4LfRsL^GqekZ4LYJjxu!G>`2whguDzlpY)% z-d1d3_=4aF;(WlA{NlV)h%2-V(iHerh3)Q96MnE#@Xk^?nn_`ZYn_(oN%)ztHpECs4eha)Q zGZ=l-ymG-~yr)w%|a`A&>l9u2_FS+1>-|m2u__LBIF}dTTgkP-o9@y+&_3Ojpyn>y^#G{<2SAY z;_ZWJXe8gK@URMXzERq&;Ykb>VI=*GC`o8k|w=od^1~m`HQluMoq2OLDA_Gq-&p&Kg8Wk6xUPSmNsU@6Lf_JR9sE_ z#(2C`E*D=UBL3+y^7?UUW^BP*X?m?=tUOES4&JiIC^yzv?K_?({C z;UgYA%FE#&7gOOL?-A$T^Z;;Mx&&!M2{so*#n3)V z4}gey6=w+C!;mD(8Fa`*a46PjhE+zPMo;5khnHo}I=OC(d3-jUcnJ2MJyt zy06JjC&S&Cy+*il=3XSu49G|znbu;)>y8q)5d6*LW)h>f5$9B^=ikJj;U#>+4ta1m z5T%GhL59By+o>DEg>SOIp(2)DNJEBA!3tz?YoX~L zYbdBx8gSK7?W`B&4RUVgu;V7*9 zWV7`)LvrY}*7epQGjX2?rUwp&S=}IwCE-O0EgeXBhEJ0#gG>a$!gf-VaEL5Rq`9eX zfGvCUP`Gv!-QFiLiR;Unv~9B|XPbK!Wcqef7i2+Nd_d|frPC1TJ4Ne*9wfQ$6bQzJ zO=C@}vJS6w|Fq1JqZUYC9QGrrC8_<5tIL0CBzc3}Cpq=`rr>gugpHyk0Jg=09gXzS zv!^C5!=pi*lI@qwi1z z5Z>#DEkcS@59go=Sj2cSwrkl-!Uj)2(xfrMu|BMsawOR+K2K;)H*ih4RAb4|w$JY(zrm%1 zfL}?LfZ}Y+F6Vdka-JF;G4627zcj0d>-QrM6BejOpxX}~M)6NvCV@P-acliP^))5` z+`1ag@$Rn1{$|YX6j!^BBE*Q>Aq`JmbuWBgHy2xIGT2jUnzu%Vj(k3IeEpyA-W{)b z>C%rdVZL0J$IXSGP6k@aHY*U>OVlx0pcZF4LXksC(|R?w{-c^Z%q=kooyAEo^5pP8 z(1~RtkdqBs0Qa%4_7Jb!{6(=eqr)jnW?3qx^!W^|dCuN21s)q1N8W1m3!@Y}97-e) z_5Y(&LY4oJn6`X}^iCQrnz1kLvg)hc&neR`w>Ns&dm&G^K8RpK9~!jZP4e&Pky2B&@9Kai>$( z^a8I*B@(WMei>K&`q<~9=aa2H!&U*-n}Qij0zJ>wvTyj_7jdr8E64n{X*Eb|5x-g# z9%fZCN_$u3k6k`t^Ek5KQt_H~LU|BgB-qBYdVK^!$uo13`4zpDpX$5w{wZvbwsQKL z-yftk&NEAx&ULR>UWvPXs&JBg`HQ^lO=E$UpZBjj{8YLAYGlH4)Xk*V9l!PWJ+jmRV&K~uHy@P*mDI0_=O@#xj#eP}_}!7r1#tZx@&pnEb-g9JlwnHF^P38npKva?oLejheQ> z%H^=DDVeaa-MRr2A9al1Ume_*-l`dHJjGjrd?Zd%md&{eE?VwfzSGs&EyR2lTG85{ zdi7A*-JIqrRP7#S+eZ2z=r}WRK`bFW{WRqj~1MZDuqw;Fa)NRU<+QPF>|~a zq2-ShiHc<4f(EzP19f3JT-f7uuR#Nx_F`4UdM%L!-e}PFwg3Tic(1@PReuS}n?X1o zgrV;IdGC71B^eQ|YJM}i5NY4Ie>ucRiO|9QgHZY?Rh-fOhP? z?ZgBe+6GtWx-4AV)We07-h>e#BQDFxD#f~>u;rdDK+A41+pTGNmncloaonJ;h_PH5 zo8~Of%jRzJk7YVgLetRg@0e=_I?c4NV74@(z+ zaJ8n~jSx`!H0Jm<`@lEZ-dV?OgQRocpO8-e7Ijk82FJHd|ZSC~gThH~2%nV7Z{dl-E^7CM`L-6JIAD2%u z2gz&I4#A&!FZGfBeJZ4M$p(G9F5cQHzj1oX;+pLI_)iq2wIdfdCsC?U&1L(vByo7i z<85;reFPQMC8QKL{ds42;=x1+pMG%mG;=n~>;j=qmH+3LSb7}ysO-bJ!o04)+j~{C zh53~~#@EUkptkL4NehFpEB%-aegSJI7mqlBn7jn=G}Q*82HNEp4zzJ^g4q!0T$lO~9Lt0*HkfdNtNiZ|=3f zBwrBBG>6 z9o5hFNASFHua;Tjc`cu+0PlC@6H-RZh5~h;LzPhu^2aJk2iJPZUw-95*bs4GQ75qu zpyih&AA5!pX+5?~I41-@iA_sc*RW?q)gocE6quM&5LN(t*mBT8N#LAc4zRIrv8Zq# z{|w3wG$N#Fg$?A8n!fW|l)?=`b0VZmY*s#msDCJt;zPW}+U92KvRJ_|74L|)NNjyU zj7C>|oq&Yk=4z8i=sY?%55wcrKloZLLNGjw{j*Q&vdU}iK8Y)8wK>*if_L6$XliVTc;F&GX*HiAYp6PHfVA9z~ z>EH(_n`*g{smzw3)gT(E#h)?F%ksB{EgxbVi3f8i=I;!o5M#OpL1coEoQNqr7uJLm zHk|3pI87Ri?Gpj8#|m(FYccqsRS%-3J@W{Ppild5jMd1Y?Xr_9ThA3rKBI?S`Rc({ zENbogk1ygsYF7?h|3o_8-6-Xhhp`^)nSaxbvP(ZcBCPSti;lCE8E?8xb{CBEcb|0P zz8kn7E;%9)N$y_^mgW9)Sp8ZxZeM5?um0^8TB|U91zU-K@%K)3IP5mo z*y(sPwq+4XW?C+pfqmR0jV-_Ju}ZsIXzWiZ#q`>Z30=j8oyQi=lbWS}bW4 z8romiwLcoi1KNB;s)aFONLA2&1Ene&^jh~2K=b}8Sm4)Td6uKhK^bph^nZ;0iJ`cE zKO2##n%xk4uR|Eslf-Z8f68fNOlI9TCF)FQnAFm%^|ncYvoiRbw+8bKz{Jh2kjhJs zp`(2@hgyP_l%{G_nz6{l#Z;2@4vMXIhLtWxqrz|H_nvYUq+^SZe}`X@jK zo8-r})wDPS(J}Ka!0Tu|SF5%pKfCWErY5OocIkrM{p{B#N-Od@u-G?xvY+JA!wt7g zyqVH|A?f(%(%CY^QCzZjvOhgfs%2$t`9#fwk7nx^XJ$@C3Y;KzT3p*usyKY)KopJEI~g zc28shx~aoK`v;GIV{2%$HGW%HlP=eP9$u>ZKB6mZ2C!)!+1`VzC0vrZIcar6GHDq2 z=K>)dJt}Pmbo`~GF6rA0SvkuuOz^~ngl#pIvb@RZ0S&2`c^*=0sU?z&53{OyN9b7e z6m^u8ro^bFbl_pmx)d1bRc1KD4GU}9lptAOTcF4x?ThV|7B%w7$ukwW1N@uMt32Q2Vtbd+N@hzQv;J1 ziDCfyZywy6lyy=5I)WZfX0dZ3pjXdxLsKbMTE&lSyMLfuc#l@~JNTMp2=YvVI{T+U zQtK<=qWQUUBVGcv!tL+Nt{`UsC)<>$TH^yCu^E&eTo+L{JdC!&52q71XCZyTLUDFH zGa*xpqZztFwat@AWMqwxh)^apjnmX!J}4!5A2QP@@toG!)ZR%R8i$uapCtos?g7C= z7~N*j+o{=iOdR$seJu(+Jyvfa)b0_8Yzbd0k0XY!0gy?34MFQI?Dq|sQ+j37$t}Kr zbRF^84!*luZg9o)08%UTJ6(A3zf{>?oMh;F5ZQ*fR{q9wvZl8|*Ck(g9vyf%U{H%Z zKhi!rT!(W&?@jgJlte=}RGj>Kvid%`7^Q{3P*=RHWCV4sG{RUm?GHk*BFo6LJmMAD-$^k>5s&*D#x46-Il`nB{k~*U{UP51OOdS@o1Oh7-H2zSfBXL zJKNJCuIYUUhTc*3_HERO6I=DB{_5$ISPmnRNnI^_sw4yU(I{kKNttf|((Jc<0NJpx zL>QHi>6Ss6jR+gS1(*hCFC;zb%&le9N6nafe_;_$Y9ng*x-+?Uf-hWX4TuZx>sfg& ztHTQ{zI@GKdiesNZI41)Nh5qXU(kg@A89G+%-<`2ap6^V=neV*{Idgiq#xGPs6}He zm-#-h&s7N$#jI9PbGLZ?SuNilND2(Q{}%c4;d^nT#*0~Zjh^uE1FtKZ>3`eM38W0Q zH(!X2Xq#Z-q{K8nPr?`nRqQuSTj7RrmYDfVq>p%N7Rn`uiK}8Ad?hirK+d{rn;OD7 zp+p#Bw>sVmpePrS758tMI?r2fKhv+pi?6uxrmy@q&b%A0I{PEB$i-B@b1)5Of;2v| z_@Ebssd|<}t%h3)@q69vNlg1x*YvjPOEHg#Tu$ciB?FnXBN6?kTKxL16#wFz>OB`D ziT;-!Sv9TJh2CLBBute+Irm0!!Pt_cK-;4qjF)9+uOOz24ZN@Lk?t(jU@xx;s5rX2 zzGz6sU3#qQcR68qq*2!;*PPlapgu`F7{8S$lTs(|uU!vG3m;4+G@7Np@;p4&je9PnpG-+?*?oZ*ZM&+G z44+BtwtRYdBC=RrO<-%{-Fpo&l``FqtFNNY@(*@P`WS`le{%VfWo4thq$^*0S8Za^ z`F!HLbFw2(kj=h;#PGK=u=-SUy>ZG{L=-GgnOBj=q7kMdC- z4T!i14x!H~xuHFsep9IveKx7&_l}eo&!5nuaaXMMa+!{AT6$i&N!Z`<`b411Po)o> zG)Av_|FF3#LwIZr0LaP;&PZwA%p{L zrLO_nO|8C~SAWMH1PxC4np3$gI6EKtk&*9xpzw)pPZF zw*BjRZzBb{y|s&fcV%+|PFVvQu}%v1%O*zar@YIK?N6XRmdB(b8iBg?PcdC4{*+MK z8`1~W8hRV^Cm11-;yrfT8`_vbqqhq0_@vekPg@8*tJ}oS0omKUVTJV+`zmkdSj5~T zQnQ0@Femdb!h^900EJJ@ACW&Ml-iX5#1=!z2rn=bxHx>6u z_#KyN9c2MkOy~v{lAB@cprMr#=aYSO7QZ+yo1@vs{If{Pht|}+Jb(hBC`1hvLTSD<4r^0;BGv02e{rqQ1!Da8RY#*S1F*1tHstVqrEf+5g&iQ)*8?w#;a;S-C6SqX+*k&xiKJ z%%b^z30w*~kG``d5M^L&mj9{u=kd}aUIXIdPJ0n$f?DO0{C;3Wuao*uj`+4RQ}))H zCALdR81|BgHn?U(IG-j$<1YB!5=i%V}HxI-VNNZuGZy$=IW`fSkQhwxQzdm&;19EqBHBUM5 zLwih0K#ZQ(QTuK3b1MQ%JMwrOze0UNt;$vtBoPX?LFt}6J?4sK5iVk3pC4)+w_931 z;^jKi6n!ObxkmY`&{3KGU_ak4Ob*uiLspo(S6LCi*R8+70G=d}S4lVwZ*dd5QIGrf z4RH;$8Hr-AT*h6k3GO?8IWdyS<$C684*q>eXqadTj-zLe@y&M9w`AS#zQ^plcIoYm z=69~a5@(|=?H7Vgc1B*wtC@eScbdp!JE|U(Nobi!3-!w~!i~vNiYvz)=3v`k^D`vi zA!eCMhJ_L}8K?2$Fbb|kO`XHs%Tj{%1ucX}I8SY{4kcPx1xg}3Gb|vi@QiO)Sapq9=7ol_6`G)mgM6E%A97VQ*@5-E)-tt zO`H?m80}DPiDQ2#&iQxL!-UulN`A zNxeYN$zOOvZ^UbE+U~)chwng>AARhHFu}IU#Zz}dkknTT^bcEtD~a;MhQYXK#8EQC zwpdI-ah#t+^ICBteO3jkvIzPB<(bgo!yO50xLdC_>mDv2714%KJcTAX^ybv%t{|Au(ob4s6TQOXsWfj zf&#NMkfFr=sQZIw*Onk7YJ?z+CWxZcUOrxFfF9^Yj;>o++UwP<$ZQv6Z~vs!wQZ@) zP=62sha(daI}XjhQ``0}n%T53Ig+(?tEE_}j4}y)=sXx}#w;g_rL1BPMSDlyYcxz# zKRVFzP;?$yI6IF4V0Ai3q-@Ukcs`A@ckny=T<+I%75lQPPrA!TpFX%P?pwaL0%_TE z-Rg_IiD4KD$#0RevNDH)h7hB;b1$Z&vX+&@+1XYdzS*v?MPfgqdr~uV)R7`T($@9$ zYHlB_P*C<28J?C2I}=sQ>2hVl0N`RGggWi5?(N$dk#t5xnOB+@e8N}42r;EiAVLM826YVm*Casv{;Q(^6Z4MyR4fOhG zNHQwga5cLaAjW^{5qS4tn)E=UaifkM3DEWS?Z=`b&5m^jC+NHVPMsY&*q$2cix<3i z!x4C0x>kqOBv9HOT_{yI?mZfFu1JUe-<5?ctwIMb$ps==&7Bo%BV+Me%=I5~>CVR5 z@JGd;`6Y7R>biY8{xMal({-Z2byJ>$lMzk&ck8~twi3g0WgT1JMqfL<9L}@rp=uz>%-4WbzWLF?^I1(IPZ}W^gGV* zlp6R;=er64wC8A^<;=dTgjS%F%7cADzvqqIBGs2^+tJByLzJ3EIHFjTzfGm}7cH62 zYoR;aNHo+|2LakFgkYg~k;%YviQ1+OCsG7|6I(MVSMhUzsV?a!7<+?wv{~ogQ-fOl zO-6=JEx#vKOcKTONF-#iJG<}K(Zi#l*wL<7)K|aMHFH1nW2pcckqY}C=&!-_Kc-oa z@)fd4XKCqrjo6n&T_5?fUHlrMXuG_=uc}MtV1IyMlIA>aEqQLyj+~w0pWD3$ifrQDJF|w463uP4lY%^ zztmKJt}|7IUkV2FmA8OlHLf`<=$R+SWHIk2`#s?G$ed9K>yF>D&SAsLogLRW! z0KLu7!%4WFDE}yVv|J=5Vk?d^t|XyWHdE;*9#Y(fjg(~khUDsxB6rO|!C~`5hVTsH z{x+q8hfTFAk8Sq}+vg>%2;jvJVSkm7^cl(#sk4?r*K{MC#p2lvwq!9ZV08YxkAWzayVyx zCKXa(BRO9laZBC%R^efvmkm~t1&P7-i-EyG9<-a$iX{Yhl7~cRgY}G z^4iG}`Is9u3JKmhXfQ4r5Qlef60*w`J6ne;E#nF^R9WgiMhuZ1{gc*~Ejy3YRC z%GO5E*G`ivi)-LwGxK~Tr)ZF|P(>!;Ktw1zxRtuMj1VKxQFM4t@NhWxBazWf9d>I` z;lnVwuq4>H8*Su%nYX8<+KhC$`NE_F^n`8@dt&>7XqmauG*^b=!%>*gqPWjk-fFfF=jSi^OhnlC!`q+p7@lp%MVvu+@fB zD*$LIPAucFkO{p7xAls85eC0cPJ{cTVv;e{p>3 z-q#e(9N&`UIHzA##xV}jQ_Xf7@Od-(K|Q$l=&bgrkA`|F5-;iCpsPO}!CdcY$`AP7 z5{gfjD-#C{80_i`3H3gywbiW^FcrsTzdh1)EEnoMv70M^nQhHA;g|k$_i0uq4LmP4 z>gG7Lcyz_|?WS>n^sh$KX_Kv~#g>>)BkFd~{mR=Oy)OsOiP%KUz2j~%Raa;$YXN_K zRy3l+{ZweDU-OH9x^J1Ex7_*(+xR0ntYvDt!sFz~^TdIu8@9Z0(fYsVPFnEgRjIzB zUK0B2JLgN2iphC#IInUY*xe1POgW2kwhR^woVRQTU))0vR8%&nyPd}{@BT9FFG-ks zJs#NbL`69Mp#)nhVByqld!F)Fbx8r1I_v8>$i#*FIadFmMI{mWk0MG1)Ssscr{*hb zh}?X?q(=JQV~?@Q$SR-lV;UUXh!f0K8V>uZvgsb0RcE7q+7&irnCItG665r$ZLizF zEldRbav~(d(+zd?EBgy?eS*g$aEGdiyS3fqpdiT#-Ir<;X0rQU0_@qglD|JhN#0K{ zq_;m&rS+?u+_|owU{d{8`yaT{)ihU{{;$Ni22>S zE0yC;;=LT!^Z3=Jn#G>{36$vMs}CBjvs!^wxt7scEOZEnW9>1sap0M}ZsfZ1-y3cdj9#Pc#k>r3s%ZESxuerKU4p zn%;=DRuFU;z)8=~Oxi>0<6kx^KKo0r;>z7`c=$VB`M~YIK-<2+i|~jQ`&__H{xT4X z=*2Et*9DFOgOi@PzcYWrcN;x1^-BI=uA$m^_b+N*_)59qt<-C-U+>j*hI?w&EWH5F ze9MHsDAP0aWZVFT$H^G{fo={P6bl|_Yb8J`C8;T+=h!tO<9!m1A16sIvc_K|Cef0G zIY6IB;n6@C;ie;OBlRt#ub*#y?`2O;LI=MxYJc~plkb^N7Hu>~eAx!g-2XFP?IXLW zE9z`|2K+Owqf+kc)MS&6XlTR2Rr`QFDV~?-N8@5G8P&jRT%^-?9Ui=po^Zw!i43Zz7+ArU@CR5~1Pdw&*jZE;R|?cGB?R&Zn2K%T>XOsIFj@;pJ20jS`a7Di)C>Agq2; zL>fK4#qhYe@Euh7wWYRg>tqo>+gBBfl>Zgb6!TrT-ZQK+PLrH zSJFef+n^G~^zVz{HJL-T1Y9Q7!S1%(6UjT=svH+8V=Mj!?s%~;6y@_;C5o@pjDu)+ zr8R|HM(NuI2j8=7{-HX^f4($)xdtn5)5SZV-@9R1-GKbIy{?iqmz(6E^FGD1lGh~P z<<09fQ>&n))L(Ra+mD`>@32Z;`$}nqNI{FUgMu$C6_Y=|7<+BgV0&P>G7JG67ejwM zVbzfNZF{Kf>d7k}_sY_be*ffe5gn@DdwMK(?5>u~(H+LzkD9*^&NHtk=Fo0T+J6%7 zFFRI9g2;c^z`b2q_~zC61)!m4w&K1K(&p+qeQ&X#^a)DUxbbUS^^4~xCZo=luE?JX zp8V{ILtR=f(rDI-wtcwXo3kJe^4R;nrn14UI{u$Uqv-sx>OUp#zLZI^)k^Q@8M18m zluAnb5rXwR#eC;_goCG#^>6)XJU+a8{pKYdht!v&9xb=t&4#xMUYhZZZHEfgObVvI zwxk)n!YCWq`B;1AL%tOU-gr{ceo3kEO+&<|37J4359QdO{kzW}*mBSPZ14J*jxxRK zPpdHRv3S6pyY?hx?75q$+5X|_oT#0T8h-oY0d?)&%fds ztIvh*8sypERhY~$y$GSr9Tg~Mzli5CI@=yPeYxZw$6+W|Z@X+V((yZ&K76t(&EZ5>-^Eb*FOG&MHNWsUZGL+@6mfGLj*b9H#6w)Mo2+8Jrngn!vi{Eup2@C zYLUfn33IJDSr^YzQc6F*|MAb7AP#gy7WwzLMAS@J^KXxBg3DUL<^XmPL#|5ancPUU=KG_xYdcNM z(A&#hU<({=`A&!_>`rGeVX`(8`k`$~MU?QrcV{i>wi}TV1b(LP2Fr3dbwoKm`3PWO z)Of(9K)a?E@rI|RHq#QE9LN@sP^h-9i5v0dba>P-%OtiMzIk8}gX$mTsa}WjDdbL1 zDi3+>_ONEQ+2wl<;~OT2#JR?7&;GTe8s;;0?pnn{#ssS+_kcLY?&h1G89iQIZL?Dy z+NOc_4){C5`UV(@PKLZr*|*-{&Grh=ONq$vnaJRO-KAelXPdWrr>Tmm6ov=3FqOcZ zl`)~}=fZ0?HA+X5#D>T6GHXsx`)1vibZ@+d_Ka~bfjikq`1t%2v9DZ}o(wr0tyI{6 zUG#p$&N?G$?L5nN*zt@QXR|f%F1)2n-5{x~!S6l`+mExH<9_s*ngKk~lk z|EICQ`^i-j&$Y%{pCl%bWJ3f(OYB;{E2dv7$L;j^yjVzw9(KpN+MS{6^!Ajy-G+Q` zN@tN{T`!pD2fRN!Zg5}n6zt@x4UxJOMC)O_dAz3GfGEo)ul(=8l5Njh9I>=ln+a`i z#9p$2u3|qHbTl|FO^E#RFauRAiasZ#hv|WjO#Q<3a&vBTSx2<}Xvse=WfMFQM!Q66 zD=1?a{Jw@3u*Qh(=VFG|xAsd0KEAysqBF6;PhpQDb&l#NKZ$g&E?NR9K&Y265a2Ii zXZZgI_LqaW9>vBm+pvL;0Rx#lwJhm>w;NQJPH49zwR2O1$)oa$>4!V9?~0YuQ}!Hy zZ#HqmMx?+8&v2_hg3Ha))lTK%_I+P-7M!5P6%UFbl-uYW*a&t0-&r_c%$7k5&R-2* zJWR^;>Q63)4ux4}mpf7M`lHZJOU8cO*2<6I>97HLA-OW>_r;I9Z0e8TM|;qXDLn-9 z2zg|1hg%Svg0+=MsyJXyyB^9D6fKA5Oe)>QuiykpwLvXINItYSFKCROBJ)iXg>de; zDzs6PtI_evggt1m?fx-C>Y_taAk*gCkkZnu|=e+us8e;W$!KEwVI`*l;6*fRXASAv|p_C_1snBee5VG zy&>0;{U_u9fZtWFh~ljYwPutXC5-dsd%b@WVm=(-y#sNNb{B&aq1B_Yp8KI_;| zGt3_RgwOM^v6)k<$9iS9Zv9cW3fFJTICqEFZrzB;v7J_$b@3pY18k{UKJ5eJvJvs% zf{4)=?il!)56pJmldJx^#X5Z7K06tIsW~gjm!^jguXcvV{b#pxT|y_fw_rm&uF^If z%KOR|o2GY;@jn!ucRbYpAHe%2Bt=rrR)k7c)>(HAlB}eXdA738+0I=hE8~(-)>X3i z-Y4tMK6`UG9L_rXIPT~7_xthq{PlUf->>z2zQU^-{3PNGzTFX;A1pABuBts62<-mF z!Nk4^HMxB49%MjMBWu36s^yEV`21A2vKIm9JI7#Or53ZMRb<~idnMs-@lDAG9;FJk zJN>MIW-M{GCZ5NaAm={2l`ios3qJvBcO37h2?6K zaOly9+*8WAf8X7{5TUuGnBqm;D-{L_2;2u$S*D_bN5AfWv_pBSp@an(9fe3)T^}iG zf20~2XZOg)868mPs5?$=Xt(|itDR4O{D_>E6u5QA#*TNT zhHu;7cJS&6wmu7Q-MXoHk`WNF#yW5L<*Tf&zGg?5vX1E2X64PKy2mP+-WyLR6b}#J z`WXJ8SXHsP3CB$fR`xq~*F#&&^p-d;n8Ae;hcNQzZ4%YWs=v*vgH#RdD4(oJMaH;S zI(D}A)7`U=c2y3ZkM8IwDf~M>v0foz#sb$Jf|Dd(b_m-xOSf;Wsc?Z#SnD~h6EUt6 zS?h9&lX4JnXfrf14fA_{52~TrWb4sFn2*yOAbQplvCjYnS$*Vda%Etg*&4W^WKf>$_}Mvrpz&@RSRCz1GW5ZsXDQ_ z1fhPKV`MOx8TtpheIFuN)D9vxnZ>wMEW@tiAf60l{L9fBx11{c`69m}ahErvT7B*p zxvnhh`K=toV+^{+OWKnaMz2SW#>15%EcZTpEq2|xpuT_jNX2zxE?Rd5XmAGRN^hh; z=ew*BZejFP-l(^Sh1XzAV_;Mmq?G(w^h^ZwXo9baKjEUevy~$YN4p#*OF_d^_-hF} zyD}d@_~g@38AEgPo5jvx4Jm?0gQS{niuNUJ0#Q|8&4-F!6=#{N_vzC~aK5RPCOZ?h zwTP&BmJncX9q&5AMgn$uHC-M7kb2@0Cuki{;kPXGzSTaxwOuLT+L1Kk_aZMFE$=(| z!{=dcVAk`j;j#Bt)I4z~9bKVRx@Sa_wsY-Uz`2Nw3B$EBdc(YUxxRvZK^SxX+u_Ub z_06hTSY@8@ATM9iV1$0}fPrZ#Ss2S27`U)rlF-WC8qJ}N^N!g0rMj{d7x9QA0_R!JYmDHg9c&O77dQShcg+#K14N_bFb4{*e{)^{!dYrp)$} zn5=;TnWph>+Chjap}cD?7Uv*EKjS+n!_V#=r3OqprX2}EPUrd1dgou_leF&S`@k*b-!yy7_UG1q>ULJU zC&y)9PMvy*fBVQq;<2vENsV|?5ns4`QSdpN_7q+z$14r=$!f{1kjYu)F6l?rm4c74SZOX_g#uA~%k2heT#PDiUg%LiX{$A7%|_=Lc9V5F7n(*K z`jL|4Ym^L4h?=U9B`rlJtxtIQbeMrYh#0F1=&!>bvD~P6V&@TuL^HGpLSG)-4So}0 zI&IYtPy2HDPC)Wa&jFJYdArApS$-p_|7zc>1Y zUR3`G%@{ zX(lwTZ;1LxnPwhg73(jQv}929(%|}(i*eVZ?FBje;Ck8x4zt~q#JIpUkMmyNhCf9q zHQe4m;>sm)%!^BwFigq`dZsMh-rv<{4I0@~ZV_y-?2z8)DhZBfqpMqHS!dj5C{Rp@ zyNEQx3wCE%dUTZIK!z)ym<&_STEFj7p(~%Cy*v>tfMNS&-^GSzrELsIAdbw9Bh3;q zFAg-~CqkD!UTXkk`iQb&0?`!iQaZY!i>{j%kD-vlYr$Gpxv z#h;P@CG!aZ&&DUH*4(BlA}2di)vts?$!Ba#+MrA}Gpbi=rtn~iF*?h06G_Q0Z)eI-eUUv-iivzVU(2pVX-NQa(X?~@~ zvnC(RAZX8T4NqSKzLVr^yA2%Jebj8ytR|NYKdcLM4>;w-X-Q-D{0thKoY=kV^VaIiW0_u?iz zcJ2;qVj^KxSRq07gLJiI{$HlNB|N6>1!+F3+Nt5~dNN(D(kb zu2ys6#tx2%Z>s7IW9+CuwiF(Q+2en(q%%0ht?tYuf?@S5t*%5zp#sM$ra31K*HC3qh3U_-qHSxGTH)i1ftM zgYAZYvf3qYrbkv*5cQ;K)0B)&h`ZXtOjQ>$Nka?q{kkPt@^Fidpk}G253PJMaj#T#O{iDqo8ypc|A?)U zTs-Wu=Swdm^Q#JP_pDG~zK3RDW z$hd^Av=-63WeSnp%+_EM1IU$6)P&CSBwp&`HZgp-8zTXeS^nY+HFb7ee@5)K%M6c0D}4U;0q-k7Pt5`3i5`aJlP~7ibQfB#>b705WjsICvMl+Nc64{I z(Bdg=b|4R%RN;*KtyDj=RVEiJ^!0W3jgmHqUt5K#V!oM9J>*f%)^y~2A7^vb66>!naGM=M`5oKd@d%lMyD} zz{S0|AwGRQIm>g5QvTigV=;r~;*+EDbddb%*4;+%>56?3w>Wb1+T1}& z5iAB|Q@^H%=JyTyCxQc!g8olTTdEdLOA;zW_Ida!=xbp!@|eJWhsB=nzlPq8+%brT z5dt10M#{Xu;hruvkTZzMZF(Br6*-{17}0=UecotUt43WScyD{5yMuQcceUhx)&NM^$P=~^iuj-*oDHTT~7S=B2UeC z5DA`3IrhU|U<%o<`MuonKIa^-63@1VcLBX8*Kd4#x1Y|ArgAoJiqQ&2UwSxH_gmVU z*9F3tf;RaHbw1NTkM%-I273c^t)?RgI~R6#b(fMqQGDry9qbt|S%K>gSQKYm&a65Ae zU*}2-^_i30Mj_;Gz9VY1aj(U;%>o*9IN!k0T-Tz z#mIrPBIo6*j+1SKvh&rG1$ z$GkuWl%xQXtf8D5H+t3Yt82yN6;2n(8n!Il+^gPBF~S-`)P1K&TUs%yGj?Y*B!EUe z9H^2SrrI`AK7$cWhl^TM_RCiVa6!wj&#r9s_iI_nlNAg2r0oxDJw-!mk2hDoydih* z{I+`OJk=ZqmU#{VO%+S5xtuxI*BK^5q|&$ocUQRnd)i0x^fwU{3MokE`99hHxI^81 z>@d9E3*O$}d22(Q&uRSR3wZBVv!c6Gql4xgRIcg1bdsM`m4g&WSk{qQrrucPe5BnM ziRTsxKy3Vo87jleqW$nZU#grex+i;^6XUJdp?+;WL=V%>RbrJqfuT>KQXN!kA0y4M+in8?Ea2s+5a`vi&IBqoKiJ1&Kh_s06g z+^)6yzxC;5tvt+0_32Qm71dT`5cezym=Zg>an^Nd$vWFzjmt}C>~|H_Yv58@cy?Ao zho;%8(`LdAlIThkb?Be%J;66*Hsfy(vnimcD=oO65aj^#3LT*YThf^?5v+>Xj%DZ1 zO7ozNu`G4&U}XuIcWO(rs8|H9+KH?v`B{Njx?>;&0neEcyNxg^GdsN^SU}84sFaOY z)34EhmBzqrV{9NHsP%BIABS@G@hpkI<@ulI#(Rj6mLO$@GIN0Rg74%D9sW69bLUrz z0TYk+Dn3pV^B{*)z|AkNn70kPDef`0ji&+@U-NlLaPntpYu(HlmAiq8mJF zBUjUEW7lbA1eN{NL2W-x>41=zdBM4;0Zt<&&nO_MKap~X(|&dy1NtB-O2AP_Nned@ zW3fEM`27uo!bC9?LUM1eplwWfwgFFB(Pu>2D90JChkWlcQ;7p)8AJSz4hJF#yo3y< zO+P$vm7Mkd@15`8E=#iP=O0UU326DImEy56fgBBZyoh;SP$%=91RR z0=s}mKWwq~$*)H%0fRGJnCU5~rJWf1ZY5_MxssiCB+4z`)hT~~sI{I*+`Xy^9 zE0RtAin}@V4CS)zv`s9oQ>0tLPdT+>d>e@2ltrW7eKjAr6jn-=G(>4Lk``<{Vg;-F ztWVscBtbXBPKzi;D8z!_5$rTzYOk*gJF2hz#HZH3->1|`OAm~k(l(8E4*IaLHE7ur zs!)gfDK6;TEsoiWFM;V{JYnm@iBajGJ=ubegR>Bj;%v+6Y(Om-Y+EluA20YFOcE48 z#~E>0H|v^yReE=v{JscQ3xpV|_9|P_0N~7Tx?|RkiO-^s8-z}yHe7t)xqV|;u#J$r z_t$|K8Vyq3m^s_uw$p)+?lDcAy1h}mKR{Vb$EX#~bnb~Ny|X9AE?lVbnZ`n&SkOG@ zs$I#$w)kiSoYsa`hfQtIp1?~daDd4`EZ^ygBr%b`&_*0R9Zkm(k#qDYbik}DE{(xW zEp4wG!dDd30j3`A{XPe6HmQ5BHt&eAR@=xD1R+)(1(gs>X;u7LNTRB3-H`Y-6A3PTyW3 zW(iWlDXIqaXlRgtE&PScY?hKxAQ^bNnj954jYxm0asE|Uh4@TdrNh+PzON7}Xrbjy zR&gqaeX?2ZmO@+Ksn~!0vB1nC7-m4n9u5Iw&g2kFgG2^2Fu=SdI?^5f9u^EX_1W_5 z4g**ibwp`1MYu|l!jsgH=YD7zgC-JPoq~&D5Y^cYoa2|&tQ-^8Z-Wn^1xn}TCOi@E zV>j(YBa|-4zn|V6>Ak6R8qUSxem*1ht!5hbPW|yUUD9VO8v|R9S%)r;Xd$^b_o?kY z-7b8cVd(^fjkY@Lpu+ue!M${wwL1$%sEiE&=wa_1zhpSS{Y#T~O}Z4GOU8;(I=WJS z%ZI-bTW2D_CtkS?gO@a`2x^e8SbQ#UlGPibNyUt=e6C+lqMVfV@}If;0NB{gK)N3;c}8u9not#k zLToXdVIx6MIK9qsmA~45tqvapEtbk;w;OERJv}@<*LYOri>exN4A}ihJU_q^_`3s!*kQO zN6&0$s;)a@5I|)X{78~0WVt^99q|XmaH5XRo`Vu`sxU10PukH+6$;R}8&8aaN%t|% z8{;BR=YJB1grcAwIcR~RfNADk>!R+;6uHw?b|ezMHa3V8+iN^5G>*n2i1pBoQILw| z_7|ln9jQjI6vTWYPSfnc>wA|1A-BP^v5hipjgxw~URPChr%w3Z4H7C+YFc&!F&0e| zr;Z4Ev{z3*;=>;F*1ZJWR_R1PYupO;nAKY zY+nnAl0~Os(0TvSBdv{NmpYsJB?W0A#}lhEsZuE(E#w?4@%*^??z%Jzpia*qHuuzi z7_0HGr$SC0>epK!+=&)mr-#dRmddBw(sUpArl*DeMtwm2;vy0ZqGb?qqMdVSG(82{ z$v6p{+l1~~m50(&%U9QDG9uHW3kinklQH1&Cmrl~7W_S}1zhi9?zh)l0$q=RE+8>p z^+&E+F+0+=eklR-vczM+=C#2%k_y}A17zI2*8#&d}sTbpVeO@GCPKJKi-wh`$2 zz!g46vhaXmImN=fAo0vf#OLOj2;Ct^my}^Ns(cz8-Oc^`Yl!m_qfyC(g%>1PcOX5e z{zy`Y2VA|zOiXt_O{8QV2&oGZCn!7N#27fyuZ>KQ>~16OY{J|8);S=&&VPZMlMp_L z`rLQucm@E)-f$-FFayC;3?2&ww&-B%KzqZ`6;Tq(JpUyd> z{c(q*#*N-CMwn#0s(1Y%{WucZ{F8)Y#ZyQ82&x3IqWdVLsCM^azJ|@~*bRP6`J1I~%l|9+!yYpMPD4Ww zQ`H@}_+E=(?%nz}oz~T;jDZbb!6ijDDq7O2&U_Ha)-2p>^OKD+xkBHubX>IJ8G z^p&;er;mH1PYQKsz&J4h9eR-WzM`7ArAMRnjcZ()2g2vK6@WlhKWDiQ#P}WMqBp3H(zlk@*-`o9nY$sn*&te zp0_x?jzWvGQ5M?LVYeelJw|nDnX>Lq=3SkS#10!nlnbkArO-J>5=yQY7{m|TH6+5& zCu_jD&z#soi=+Faj+3StiIGpDhaP=%ce3%xy;9sOLUpojxKHl4+k5Pm=IW35@ST3? zhl&cbxB8UA=qow5w&y(>60K3Rki9GiypgAEF?!OBuz88drne5i-Y`W6tudp+KS_bBFN{jlsUG780}8m zI$RM4`_kIVPOa34D73-`EGwDH5P*j6`As7+?rN*PXt}f<98xCjBoWVNaGWz4V~jaU zB^HL!r^a@I<8c19S243g>A1a3+8J8yt8YByj2p#|s|y~7*F_Ja=$&KU|4^tb@Lmql zA9+B7CZG6>7lCaRK%Heze9zZPSw2$r!c`H^&|5_E=jn>TwE^bSQ@*O`JgLdml3nzi z$u+5*WBoaI#8@ykE{zgJacINT+kS&uj5b8-*3>dKwiG~C% zOX9?1)S+u5ZG(I>Gz{f00OO!`{L?@HPit{Ji=$Q&3VDoEllP|~0P&vyseAiIHqPFk zU4UDeL}T<}7_ka*tc2a9HKC)u0dVUSpN$(tntKr9EM~JH)<~b?C}GIMAqvUh#FaYc z>oQfm2|O7S!Hr@XHxCCJX%fRnc$~WsB9byv6$D=^ERyx(&t)anKLz|CP|p@Z$O$2i z{cr%hz!{Cuf>Ze~ZR>j@w*f7cAV>#yo-*_n<^~9bq3s+V#LY0g|NM|w^!M%GzKohl zZ_gQW+<5e;rCGDjJr2AOZxs+^*Mhyr~PcR;XoH%kKf5}z&CL29nkB^GqC-M zyrPN&WnVOG@@`hjr%vx38Sin^`#)*C8$mvo3TxNJXtXu-dOm;pL1)#yIWL+Aq+h}X93uOhBB=_9j z%_!H)Bh43~8Y4J+k0g6RqlpGh>e3^OTK5o5vll`;%-=QmSOVXP(!e4mI`_w{TQ% ze}c$_qUV!wYmt@a*E1_pzHJN0jlQY7U<&k|JwN0vZgG;tCIDP`Ily%lC(0qf89%%{ zSp>#qjl;@f;;MkXZKSsGP)0e~_r164l@TgFrvR2`(v1 zeWXf_c64CjK;9d@wjx9?ajgnq4a42y24$n9?|bX_;Yt*x&|!H+^;g1D{dj%WIzr@a z^DUJ5kVyYq800pF&AO=^Pr*hO{lc`I+ubbZNlXdi%`6O&))1`TakxBo@ODk^Pa{fo zF-NtAs*&|}mm`fwNIe9G@VbQX9hQ7+G|n@<`;+a+i3HOY4P7r`XCnmO@loC4PB~2_ z_SHSfkiN64_-^dw`atRpHz)5fV}4lb4;m;2U8oFPZ_g#a{0+wm3s4cO^l0#8~cDR%&cYMy+*yxlEj=!Hj%IaY*E! z4|njWHr(se$U3)}rS zxiz}XKB9^JAy zPgN#nL9eT!Yyw|$bMJMhDzT%3_J4XSy3e>A%fD}=W>FR7UOu!%nRJlxpjH9TbrTCZPj zd3qbKm~6si$_D(^-FuV4MB6pR!*2ZgU{&ba6HfE$y-(M5-Hz6>HWVv2YbE!&N7y%! zhb)=;wChi_)+4^KP1;nY{R>3vHT}KID&v4|SSwUpNLW%FbL;c)B0VloI{~Q&{>u2x zR*}bLW1`2tRx-$j$(zh9RX;jdC;#VU-f*tVxz={AUBHmg_sKM7aE5suWl{!u6n2^} z^Y@8>SP+QWy+N6SFlS@G7!~oh^c|O?u`h04J==FdslSTyB*kY*`EVz_h+5XEBB(=s z@YHRk`tC1R%^Ot#QXlR<$wV|4l>8Q{-Opb77oK@^TjWCGor!@nZ%JUB$<(Hv}vGqQX7&z=;(e8$i8$)<)dTc6D>aBAm}eb7Jlk6OTrb_ zgZHMqdp14x6pZKDeP^Og%>Tj!fq97)n^??0(5b61k5dI?>yV~%pMKT6#p|VqF6&A5%R`vBW~iE8bo7{i_pLEs zd}?1|t;o};DIS4ktMyL*cT@FT$QtU)l)w#l53)M_-%+jPY1OUq0UW<#!P_tKU2ljT z$8P1_8KdeSGWYdPKTZD~rAOpRHH6!G3kV|T1YDf@+F#A9HmYzEH;xo~L7SKA_r|X= z6|=DdBwNI#K~X!sCkj$^M~dBM^@0+k1ue9Aonri0f9+i|p7%fyIEEe`QGWHSEk~a< zEl}+H)7P$PanO3PpPn-6XId0_r4qf;#pe95TC=32zW2$g9!!9LIDw$cQuSNLZ?}8X ze{{6vC7`Eky&kC>jC`7Zo7EEv3Y;C!N^9PcuK%p=lu1k?&?9!ruQ=sS+ANl{Z`JKc zKPn2=Z!;0!cp@a(XM9Nvvv=v<)1d!a{Jqo7o%kl_zZN0c31A9$N&r?FxcCckh-;i_ z%A;3b88qAfmm@A1o>^;({+{grftr5xOH)U2_Z2;E@8ul7`3Ui?=14qI=j6@oALk7R zeyCe#yt7@5p5B#O{|!JvA4+jy0J?7bT58^ow_0%{J9&}Sl!qW>_$)}E?vdPG57*Xs zov4C$F7J(lQq3+YbL8VJIO2Q)#CYc1MbHeic6(5eEaHuyGCHW(8b~)-5Xb1wPmt-(BKnDMKyiJH&3eEGoL* zO}r-U`bU%x+k?VfR3^5>>Zs#dRH`eu{lBrH|vPV*-H}`f%lCT1c8a{6C^-XSfRI^>s zTs0R+wi!Av(UHsc@kW4&?12abEB^ELrg>bHPe@Ab)E}w$8+Sq5@<=bXaH`lngPNY6 z!{v08jCJ#cSH{M+c=dzU-(iAZN^Eg9t>GNp^6#!Pu?t3>tpj2ST(1DIfoUFVnBxsg zHRt|()!r)s4bL&Qr&^;0^BE$j2ofAS2-J>ACV9_v?!v^kZVTNp6IAWg`$79*kYapm z$#MKXq>=^R?FrNA!vK|T;OxR>>z}0M7eE5``uh||5M6jm?@xn&RtqxLsw@7F?J6O_f zD(?LJ#*YoF*S~8j6C&HhhPG~4a28bhq}vweu6$7R-W&U;`L@o-^|vo+R0{H?Ftzqr z#c}t?t;6MvELne7Kx4ex#jdS^K%@S^V~*u+0Hu(@w@FiJCK`Z1Unh+pbqcGmlh7yXUcav#|4J&%Od2erX%BfY-RBPJ>SkG^Se?l?ua$VjO=eq%_`ji-m{m(5-@Y3jFNy|>>f z|6(H>O;5ggV~b1OZ(DJsUvi`^=+agP%y@_$*#pB?;nl8x39`78a|bl4pgF9^9%wam zlMstOY;HL8Yf(I0WK1OHN=V_BIVL?R1D|~O^D6j8-a;VPhZ6hcwfX!@%1KR-reBJ3 z(9P<*+1W0^35x4mi|+L6O7zo!%S9$%Sfw!Ic{RYM&vYq^z~2dx62n@snw;N)bsGov z{JzcXTj@kCVy|-%*2ePcE92o`dIzV#b#XAxp!bNUmp1GU-Kj{l@)*4|B3$S(S)TVW zOYj8RoZ~p(jZTXmyz4vI<7=}}$>)L7W4G<5Wc|M?)nr1T^QydQJ!Vr~r@x*Gz@-9x zx)rPUCL(2E(HOOHE{F!$ZUw$lf>6zB}tKo7jy*f#?)8^jVJw6`RBDd07pR=>roQx>1ef5Q_`DPX8j+)}y z;t2mTjOje!+QT;~)Pk0^7V%1^APnL>oATi~Jm8zG)$xDOtK!Q8C8~_P{J?G&SYF(2ad05YJ-AhSj9qKVRd zP3J+L?5ij^{VCJujzkZ)+A9_gO>a7BA(o2Ib@H|So(DZ|9mhTju_%3lx;-E3eg2rU z-QaDd<}Ljf&mN{Ie{#%k6<&yHM%!1jvL@_XzEEKhJ-&R;GSc(@h5Z7<>pufJtmVrk z6_o-V1eLX<*_wX^Sc@M&|6%X?tYIs5kMW~~)b<@NkpzX;j-c?)$E`eX=M=|ZUT|XwrSdDp^JN}&2dOHTyVZgclbd_vdh`-VGTfe27oh9X6S6}HS$w!o$$v6$& ziQ-qj7Id`xNKY@iap$G6F)5iZ*S5}Qy|2!9^Ra&9A|6biGULQ2ntCkRsysrYlrXR)Q7wo=e7k;5tUd-bb7pj*GFG;pYAj zz@eL`v+~Fp|AiT5VqDfHE@4Gq$KZcZaZKU^qWc{#$hJQW)r9~x4HT2iP z#9gN9l~bJ4sqF^i52Uf_j3vVPt60X7M7Dp^#*ip>F?+*e-mILY)r?D;yRd_ob+S#5q-IY1 zLhS*1e5eXNi)sfwmJEPSH0m_qWnVL+)e~MV3rY7gT2%+o?U-_4OUo)d@gKD~pgstY z^1m^vwk4dYpZclFGKgoVCUj=tRha%HYOdNGC0+<(@C6+SCXtQjdZ6yMlvUH+b%Id+ z<8V|v@PgFWakeRI$NN7iHH7#V6fc`>lD0-Tm9wMRlO{ z{}F`z&*wSE)4A$TR?U7iyc0dzT}M^+M2`(%lwy>(FUGW>OI$2c8y^ClHy%s1JA3@I z44nH}=hifd?rCi`z!IeoP6eFFws83TOIq^CY&ts_Ys-GZ=&c}9O#J7T?bIk4ipp*d z@>P%M7<8PEZ3KN#mQeC5T%OOB?YR-HjhK86!&jrEdm#$nhiSuj+KLF@jUcQQp{a|4 zQx$9`8D-9HfTyAh>jWczt5@7~YyBjeS7JeT%`S{nmF~HBudmvT#S*b3s!N0410`?W z+NdFMtSKJJco9GD7lmy+*(`x*98a|U*rH?|E)xxk;X&#NcwW?9vdVmMLuh&$OkLQQN~q2OQlpGK4jL_6$nN!_xHNx3_L&1_7qFeo#?h$7a_`4c z&A(WXCA`vVx-;Yl(Er{H0>)ohzbDP@-&eA%sc&n`pMH%zkfE9h-)0ljgS4|=8E%ck zCHGn!fxhPwmAizgUl&<)Jymd2B0zN$tI#c*g$_dM>co)kHcMgJ{EJPlQR4r_H*axyV@F$UM+CJ{@rZ2`LreV z`Fwp%m;6e5k-5%4xRH(;u`=<&0Q^?fTMZ*TheLXT6z9~78cYNr7f55f~S9F zPnVCA9D0r|e8w47H|yo_?=5H>A$ELxe3Z2^{Cv(?=7f#rJ4wCz2qmaq|88X3Q8GKr zbFSfMrOO)-|Krwq|9GLX2c);=&qlIGUXye_a^Ygw*HQ{}m z^6qFv)_4rd%b_(3Qm2}37-)!H)Wo5?e; zGsQGPm8TnmZrBH8K%0ip!U$^i0Y zt{!YsCxTmVd@kjJ4j9RfZ=^BZ3oHg#18Q9xnSI88Gy9C$%bUK@Z-L=KC_L$Y%PB7H z3z3btw~g&Z5C2k+S$Ghe>a{0KyASbFul-1IqQFx=T)J`Az3!|Y5^S--;Qtedm6ew^Gib zo_^mlaGhb7uR^-k=Y5!A;98`GR?NR6Wg=x^$Nl%-Sf+0+HRee?1pRK{m{RKQ)G zejAjc#$Fe+!uoc1+iwlpEjtE1UN1hWw4f}p8q8Hx5!y=k%!&_AkAJ7rThzr;H-rn{ z0{Nl^j;!%#+0A2JYNdRYCVJhs`RM)T?9W8V6I4^+FJqKGcjaW-n04KMV?o__qL8O( zKVpw>ab=CV4*_N{B$fPeBIzU0YWL1%zA+X&Sb^=y0e1w8G$_>3(vL^y?2@YkpMsbU zRy#FSNJ(OXq$I@RdUPTLD|L)yna)d=ao%=ZuA1Z+D|8ga8^v>1yBgH*bV`gZvO=1g zjyGZquqS-dsK6V8q=J7jbsHZa1=ZR1cjNmD@%m%_hv(Ale6aN_MdPG}l^t1^gNDAw zO-1gZMv)o64Q)8aios_RcKx1;PaDVa#+L&K;yenpe_u@MZE#THFh+!&mZTygS7BgT^ov z)gIpeP$&l%egancO?2{z&BmX-F*wxXQy`B{rgFu)c0-2SaHM7w1fXAbkm{_z{pD2w%AkC;oWSU#O?<5VU_w zEJ%?>2yyryXlcLc&_H>=MfSKttJr?o@Nj-?J!tMPqifM=%USJNAdP-t`{MzUA?9=g z@6jhU`3v*NcUTz{W$Zhjg-;4AITrXLH4NR}jrd+4dZlY?iO=1p^REGAGexICH%U(kVCFa!*17`q}+hwiXh2f*Ytu?W$mB5pjko__MTk6>q3!cSt0H0 z_P)7N<-j`{8H-5OKyDAn_Ino&9Eg2S!sF$CLjwB&xqDJ^mS3I2eZSUYrn*Xo6E$E- zu70PRk1u;Zhb8-**pYD)0})j(!c9?@;!qKoQ6`f+~qVoy0XbT5D$YLMf)zMLtd@^*xl{5 zX7JB7Vjj`^$qCQrlVcTJgZ>&HYOjh%m0$Re;KJ+G6^4^C-H z7R>={5{Stgyx|94UkCK7?QEkwwXX-;$2p|wga|ebDym++x(DQl_P?QKv|BE{XES5c zs~A2Rll=(rtdIdV4CvoI-b(@t0L8bb2FXbzZu^s+Km3vA#`Fb=JyWlpXP7v{V;{o! zb}TF&0{WJ6=Rtlof1KUpHnVq`i2tmg;Jgci5A6SJXQZx+9dBEG&E~hC(rZt$Qx{p{ z(T%$`x1E=p^<(;5{GpRZA_o~z7p~-DU;FDyf>aXfr<~)_MhRDwsZ6p6-&FaJ)7fD5 z7iMOW7QWNNLWFiD0q?b(MwjsiLvAxsu1EWtVZ9b2Ov+HfImqncn(8u(=o2~c!a~^( z5jEpB;8QiM-NTZI%tHSuanr&`!013MaAm%3E|U`1*monI8-2Q5WdHYi`3tezQvhgB zZN&(a#NgRmWVEl^^Qj&|Ns7P8xk@6ucW^PQbTO^tGB7ZY2-ezfshn21-t4qPDtMsx zd^1Sxiom3??c~gKe}S_&-R?U`Yi;Mlr&2p0%-{lJlh${!j|S$@p2@y;K+A389!?%S z{@nuW-_{`CKhJ%`{X8AiOz$hLw8g237VzcN?ySb$UR)zoa&sDdhQ1tiKdy`^_$}o! z2J)Bee&nmUHy6;MIO0ARsUL}CyKnK!!~jZt9@;zd<@V{NWdyekFC`Mh=2(>U>@j z>vdy88+pW)w^o|Nd+}8qQ%pe&py!6Pq9(h~d6ul%i{Ijr zlIGqitaiqYkA=VLEt)kt+$ua-rvlgN>pc2?@k%LjKlwIVVw7X6qI}Inne3^}%84gg zDJRt04?>$ntB5$`=`T$Jra+|VT{fbdF|XOMJ`7B7jgOis_}U|eB};En;Me}eF4|<6 z?&zp1|BV$Jd9q^!xi-}C9O?Hz0Cqr$zocVFpO;tNG`?!(Gm4cI4f30V;YOYt-62v= z(v$l#m5`9A^jg_V|zQ1AK$_=RL zu|59pcNbtlk80GdUx{b``4^0PXCj&^J7Ax~Pr?sRJP7sai?cc&>sQXg)i?baKRN#j zY+JnnFFpDQo*DNJ);IHl^cUyi@ZAQZUUQnVZB|dkkAHC~zV@?g@RfZAd436We5{=C zIDY;6=W)Z`ccEtmYszpHvwk~#(sO^tjgL>q^|xM&9=wp6K5Z)c4&Di!xKNdh>tIW{ zE>c#y?57f1Mr7_PInE2Gyp2EI_Yf8@-+(RycEVY|{3S1*JJ3QiCcph09{k6@v2sH* zMt|{Z_|bQc@*m`AtY-6K@S(r{3-gz)M!&s|!wtVY3G3G^#@)BxhDoy)p`t@C9Q(a9 z@P#qM`9d4{$+s5Of4%lccyjhOxZ#>hu}w$aG@?x|5;|~!{I8qN#ZwD=;>Ig~iw^5% z5xL6(G7rOOsQ*GKk^?C-GI!G*5D6 z3vKO$yO8Y5Ziu+eQ{6ZpVUzJ>0|dR6+;RSIFz9PP#j*Pg#>xe=@Q;Td#0Qh6a*@`8 zT@L*Q&i>H}=)}Wq?b11T;%^V*-Or|AGhYJ-kJtmpoNyBM9x(v*^{j1nCZs&~oP&LG zM?7j_g@7DWS!@wA34G?mM;9vbod6Pe+~(^~>xr6buTth?*>=Qtd9z^o*kl7yf9tU8 zHGw(ol*t!yCCE~O5;fV{3bv3Qt0i@)$9O(^?`=$(JjtI`)?McI?c1B}@g(TA>466x zaC_p3C!%xb&dyVt)^?jVZSofawe8A9_pW=4wGT&C3dnKhxJwZe)De&nxe!g~M1d}d zOXp?DC^uTlGRc_7G&#)U5MvXyXkE9YR6uz@Myo;qK_6KKrp{d8kF<^) zu>&vkTF2mbtP}$`y#uS)#!u$1j`g7>{tGzp)Rr4l4yCZR2GPrT#5IGAiY~lNhA(st z^-Vr#vOmr6`dZTcA}?q1-^`P;-Zm!1ZyN=GvF`mNX)cWx+97C~EoiVs3d?9Fu20Z=1A8^qX*W;#JZpClT zy98ZF9)vMFaKX%li#}!`+YPcSd&K?rD18YRt)ad#>c$)!)-J{$uDS@9Uw;d(zwT=M z^ujyvtuszX-_8|L6UQf=*tFmkL@iQ1D5tlGBF~^H{}x`M)bmO!YRcTHuZ548S|mG8 z+f5&LksWTb-I!{k+PXHBbB!D1N6+MowP|drz~Nv07KZky^zU{zGG>LTLr8mlX4vyj zILE(MwvykbG_TY)=_*EX^TNcnatt9OSBl9r>l63*=!>60)7X2=CGjI>meUgaQ?kI&Qd2wT@jGPeFJit_5>JE8`b0)}oj3 zV&_(5)vURq0}emoG+cPeB{;a>YW(h|`~AI;^~;xFU7KF`$^Tt~Gfz1Z&))Gne7Kkw z>we+V9baJD+y6#G*IlrE_qKTIuB-9Nv|7qvjB|hXLk#TRk@b@={T}`nJpbh1@ae>9 zTmbP!B-bTv@ptL%d{NvEq zJ{#wsdm3iHa33CfbGC2FES~f#et*wDvCmh3go`e@2uJL_vp?Fkc+oIi(9Jhs`qIt3@GOmu(yiOL3X|V|8}Ck}Jrz-OUd%S|!sD^0-^9kc&7LA{n(HuY zaU*_q$rbc-8TxLTfLs6guzzCGci2)sX;;>k{6($;w(7e{c;=}|^h6=#d6PCniJKHk zcoGk~n#41m@i<;nh{uKTnq`Zzk&FK}4eN2&^_OEo+wJhH^DoEwzx@sNAGxD1k~b}% zj?2&cH70N9g42I>0WP}mLhRJD4p;r(FY)PuTF#TGUpDRcR+9hX5LBD%C8nP0n=hK0 z#LJN4rM2K0Ng&+vWvy%_G}_!DWOIL;1v~RfjOcQgY)1BJUw&Q|A$EzE zc3O|IS-WNp&tLWE*|R6>*sfTo>CUqC6NsK~fQqMcr$9RT{Ig#BR;^miQ;2MHld9D- z;!asN^}}8CGq3!dC?L<`Wg=0MkSpcsj&=nv3NJ`9-jsXh6AHSv%;Tm;z&1iEBe;pS z)tcGx9heIjyUp23?0-T19lvV zvo5^_-}>UN*un*d59^RWK)!sLk7i> z{p(6udAKiIY^BG>pI@_r>LFVZzi4U&u9HFjWkUo>q+`HEO<*)Dq`7A_XntEz)57CM zoW><%-!`qh^cEUbvRNC^Mm)zZkO?E&o5?18sw-RF2keaFj!AbZ=}!^Mey)E^2-TB~ zFuuCRywDbic(PTcUw9d`jen^_Iz{DdhqAuYz(#6nW!JdkN_CZ(3Sjw=$vNo}x#?pH zb{aHMs1oC&XUZXpUD%3(2_aZF)q)_uz9X-`L}WjS3IdINsFc|vo^!Fiyyb>O*DVvc z6>=t~I0XsS1>m+_(%=rw33oO0^-u8L0>d7afvT+gq_4W$<{G6X-*P%OL_pzffd^^3ca=f^}ng7u% zczBA)*D>sY^b8Sc8_ zdQ6$V05@OyYdrqy47AZ7Or;z>{FW}4j?~0vv+ZShl?+85g)N{7>%)kDI{l9)Djy+^|Y(Hct9J=2q-*DM> z)DbxCTSsH)jstPy8WbvkIjJ<*vLFE2cJJ2r275H7p;Z0xn$&KSBA=i<*U#A#m~gxmgbKQ`-p zSsbs~wmovw=#%c_P{%kau2JjysEu<*kc#uMJ8E^Fh)hKcGFy_=(?eW|%AY$<*i;|d z>WNl*-L#OX1jR!+cJswh_zRpwi#VH9XYKPjC+H@V5w8KJ*|BV}uh*QMH$lD4TmWm) ztUJj5qbt@){rBI0-ygfMTpW~c*Km>j)?06R;VjU*M*2vH^wzCi%T{$@O!)$pJ(XUx zh*+e|Q#6UDd>v8f#A~=P(p+THspk)JkY%oEYT4)j^B4;#MV=orM|#*U&z=l1#dj}p zWQ+5|bDjRIFI$!i8>KcNOsLk(fi+T_KNB8!Yxy`Wx29P^%K6G9w?*-Dq+3CJ21Q)* zL6`aJLyP*10@lW#81bFZAsX+`H&4)Lo%`>TKL!S!~r1? zT{KFP=vFpJ3n!BB6gB2pg{fF7oNTexu_`(HciiGpM>ZuYQ}(YdY?&v$a$RvOtCkGg zN;Jn!3H6neq^+w~ywDSbyySwfW3lJJVL0~d-^5AZ`X=@pyECdQT6_oHUviL5+1Eq5 zu3569TpeHZ?XOK0hVQvAzIMVl@U^cWjon5Jj61a!C7<%z=UClWW84;syzMjbEn}QC z#UMe-Ngt<*%5rg65(mie-+m^_#4v53!`WYqWg^VC!1q*hIgwQ;w}j&k)erMBeX zy4I1Wq${>05*~KLOV}aNwq%2SaYWa+$Z5h|EVcHh%TCo(Z@b4OXj>Y$FWZ)_6szPl zUg`;#-8@$EM}~O$BPN1eClh2xwiCy6#gS_y^NusbQ;7of!Xsbo=VRStZvVW%Q#r_&jL1)pg>9;f^!!>zaNZ<`ogkKM36B7S7cqJ6h+n>uq!2?#zA}%v z>XvP@jTm|E5=pVtZ@}xXJdXz+ydT%y{|?Uk#ZS>eZ#`1BMdtw;UAtlyKATyKu_N@6 zE!|~qgURo_fK{DFnS^Iwc@LxZKODUpXW{I#&i8qvcIgbf{^|$V(ygOrFTgi`a;g`TVUhW09=KI%VZS)nGfy!z_MQ_y7K3h@ z<`MTnr>^DM_Y0^H(a4isH3sSkmko6(XB!ryoXv)TJ`!Cy2(^6u&^u20b)BP+{~G2_`2dU7a&9SZ z`=_4$u`geCO1feZ>X?W)r(pRwa1GgtulOXT`IBtsx@CFuJ(rT6R791$$i@{zj8e?S z%nu);$9b8!_^v-UGP7^{N-}08QK8v{3Rb1LRZy)3_ z?>sF;b08rty3eDYONw3cB8EN7@_5R}c`-)n+m3LxlJ_eNTiJ0r!k*`0*bBLUe0)ZH z@|A39E2I*LM38&8^1oH9+9=&}$S(c^Vlf&6QQk^C%J`okYH%b(DMj4MerT4o$+KC> zgj}Sr$&e%CUbfhl^a4y%0W%ntynAetZkeJ{p6E+?2j&6Jqy+gcR34HfX*^7(g?5>u zikx|Ztm7~Xv68&!tX4!!NHx4>)taeyYy%^0^*ok})xga(Uc zS)roqC)(m|dEJH4g4y*fi%VG4C+tMzgt8jjw~dBeu4i&*a3v`cb=um#=;W8xIbW^k z8n`L3186^6l5UI@4~Q~58FXdZs@{^Zn0B#g9};E|*mDl4Uvd^(2GVWYF$9>K@(;fu zA9tIwDbcuPr39LnMGcFVkj6}pIAvs7wjchjD?h{o5>GYY04ScQmFNMs#(w-+M$jY9 zl1u>msV4Sn8(F5*`YzAbs)QhAoruMPg)C_fTsER|<%TjAIh5iH+|tZb*~n&z7odLH z6rXYRf~LKW?=(p*6JsHI8q8K8Uf5{uBU|IBa@S7Z1!!1>-(PVB`hMXIjM;{ZKfXd%G&kUlw!-d>(Oqsb5(^od&Tc@3kLwD_t+b_Qui|e_#=8LPoFu8frbXM8PMKm3CA!EZ>rt)p`WAlKc)`X; zq7af$(NfI1rM`KEy`bB7I$kp^T6qimK^2~Q%%_+uvgaV!rwuLc^wV*9(X4*QjvcXL z#R|Of#vA^4r1B(NjEnAt4e0r@anR+tyVLd0w_BnvW1EvXueRti>28C(sGi zGCKZ5Hp!Maidj9^+`=OQHCUIMgsA*vq0$QOfyZnyIRuYCfp}@+liAy z%%x;Y7Si}-n%?q>IUDjtaKvRV`t+mL^F*=&##7YHLS-NsjfM2cPxHf?ss$0-NwK&` z2YF7IMj=@!?(%Y9cyZlD%kq*89oY_$y};t_mj#EXRtdBT!u=FFlU|X_ik01w=KT5j$J)xfLgD^39PgnNmGl z*&v>3>^m2tSx>tpVck?e^-bi?;%dbsxE4YPY#jn=dWfJlY-AyVYN^IDo}KQciV~GZ z&^$&y7m6P=i*d7SJ4_uj(q3bi1-V5GQlJ-!mVx^EjDMTz9{BqA&%`B{Uya8fzZtjw z@^pN*xXzy$p7YT-oO9N>81&_{an-pe_?zj{WUvn-d&fkpQL&o6Fd+))po*cnmJK?mGjzarwdV}w_lET|N48pH+8iy z9wIx|PI*bgjb;%aY{OyTwwP(@b;CYV>%0BNxOwiYjjpIhxr=jA=xB?(a0JPvIcR#? z%ae~Qi)kL`Sst@9`#?oC4m|F=c=(Bbv%IRdbIf+juc(QV5wA>JU|39b$)SJC5h6#$5dM5#cFe(5g!%j{85PF$Q*0J;qy_G$d8t+DM9j40E4EUuIsp`VV)5Zo z`VT)zUO^>&l|05E#h;*%4}k<_e9D$@TSNR#^Z$TYY;6S^+Z0YYC=ey0K$KQcH0a?t zKg3ZQLfn$(y-l)oE(Vjf9kym98O3UP@LW*aHaB$4Cxy=_9b4x}+4P7*gO3oCL=mG5 zWZ&UgJduNM8T$1BM4pGlykwI+>uKWW_@uAR_TnLswqub@Xr%+JOfSn?h7a;v=at$- zFU2XJxx#!XFNw)dj#oC54S{|m)Uv4`xl4|5swn1UJ$WPU1D!nE32h(X%0Ye-Jy}cq z9DCTZt~TW$e7k1ILMA;TW*f7e{D|Chb@@m>Ok=U)E^RuRq^tTdAK8!3 z;tR^>kM`kBrh-F|o^aDbBI2W6cGJ;X^1)WIS=+JLVyhT}qKA%o>B|mfBx^Zt?8>ei z`v}|dkOzGMH1Z=k`IBEdu?@+S%GP#lGi_xL`!p>_Esw#oE|0m&cJb*$Eq>9aCpzlG z2yM7voj(!xJoq$@|K-*A!I67d#=p2y34HYW3+Ot0EVk_oa2<%jyX}mX^A}<>Q_(tS z(}uNZ)42xgmn_D>-j%rf`YUnk&39qe%GG%7`N#43yk&7yMLq?LWBvNI;98msNakI; z9Fu1?W5}Qi=$DK#NM1j0r@#Ew&%yaznC6M=qKER;{9uCW=Y_Q^kQ}z-1%Yh|@7NtR zT(s&VX>!$}cYplwjI(gYNk?G(Yj0xDee^f&Juq;aS}a+y#&u|Eti@(t0QBzN6Dy~` zia$L!6TiCV_c&_IcDC7;vBkK^YmBfX@E;0w!-4w_!9zElhxygJVxN)Q_|9I8iyLD> z;ew`p2QJxTu@ZBPc9^4b&+{VaQYH}BIgzeyC*C?Imi5$1kDKe~`JrwYaJ3Und)wAS zG|RXbkHnMHIOj;!J3dKs?bU|Qn1g~g{-SgfWi(&fRJ6m_PyZ1r7Jh>HD}XN^aRA0W z_D?M5eCXW1676fM&<^!@=z)i^$3aJ-7uRpPF&{P+MDpX~jrdmnoT-o3QYxbTt#dX$D-5n!`TMSJ=wBGaC{C(eLZD^kk2KyD}oG)#TrF7*%aNjWk)jMM^uj` zk%%S0Qlv{)Ps!v3U&&V3)uTuE?r7hkgFlX;j~`{wXPo!jZ$B@b^(8<3!HK@`x9`6D zqC0i++Dp2&hU1vXIt`6;&ly6!E5;&+;- zZS_0N`Ob1V?jmq@FI>9nzx+;f1QiY=G`)qEuVO`Z&WW$dU0E4F9hRi&L*kUNq#1aV!CCL|KvHY2nE7P&HC;~d@Qi#l#62WD~#k6gYhJ**p-Uha30tW zJARbMYaSoMrDtPio1UIYSN;Q!*c40dM=ru6uc%`To@BUl9mF>!blp$#v|sQ|W-sR> zlFeDdv?34pxoN(OE`s!AQgqQ$p7x>Gb+^^*L`%46I!jo`hLVhM=~+g7k<3Xv;i<1y zIVk`aihb*bj`@l`P~*YlPCO#6g!J5!>|9Od!(vI!sQ0qt{GEiTNmsy}Vm^e0Y{?JP z2)T90vPBi;;M&Qkj!A0jIAb^aViR_phb%!UAR5l+hqFP#1a-^vq zwjZ@J&yTjKY~GCLAO9OZ_-r;7&zXvc{&*959()SEariEH|DSi_rHPxd^A24x@w3k` zY2qZTs;|VLZjHF@_9yW5Gk%JJT`K+g@@{>1!mO9?#H*jI#O5{g@V9?HkAqJ>9j6@s zH5~J`uj0!`9fjkL`Z7Lx;xQcYv#W9J-rJ+DvDtaGt!#_B<x& zeD&2MQo)>`{l`Br;q%#;KWjQ3`O_cKb@#91_`~?#?c|2kk?!g z!Ozgm9oCUEFYX8?yV9{e;igNRc$#;inC4fG!H<}uZc{uQYK;5m-_c{t7csocI$V3< z1(+~<6_ziWg@63%UbNlua2)%kF&MtfXe^uXj4#?Y)i+?y)X(teTW-Lds!_P=|4!u? z#svjb!3JX84p1sR$^bYcbiBm`UbpUrtMP zpsv<3zPX?f)zILp5HO-)VyC&3vrW_TgJ z+its~ZFP-f&ht*`+pYXN4o2nJBM#xt$@wc{$>a!ShZ}i${b-^rAU7HF%*LhxdlIVw8k8|ic7tS~7>UWy;Q=7eebqAMfabmvMHj}MPD`fmkt!12z?X=SIJPTa)6sn#iUBe`+Hjj&9CZWJBuNR3# z&;Ha(Alje_qSopsz8*qlpAUg`f>VmykDz85W7(Ea+VGcZL?PYh1!+r$B9T)*_G8N@ z!;lF}ZX@9s4=WS*e3hQ?Xic}SjTz4}Zq?Tu)}xGP9X^V_@G_dIS>ACcI^$9e?aMME zW<1*5&-KsexQMSzK4B7cU0g3dC{)xg<>_81yC26|sqb3xL9)k7^3FTghv&}DxKDmmAN>V-!={y(%oqQqE7oGjUSGngCw~Q1;_+&J?(~V6I&(gH z58WH5|L8mD#6?PD6EI-tZWz$D1)qL08C|yD6F>aHx6!FxTQs+=!lvc(uz1NbtXjDO z%a?L7(q}L)HnxcyFnUzz*lmmc%&~v(Zm90m9lZt&!(j*Q={v3Z=s^1}Ju!Ufa8xmu z_SL|=8MCo$ zVvB#WbAS!o>*Y<#(|t=Oc_|Qlp)Iat`1EmCHXg32>}E>FEnd!x z7(|V8i&@-Cyu98D9c4}L`Peqi%yhg5UQ=Dg7%^f51`HU8mbR6}f|!BITReno+yyD_I6pG-To30I zGC?7(VY424<-C-Gj$u*qJamt3(uk>+9&sLs8ij1g$xvY23lC!1Bg;D+o@3IYc}*;u ztq|%?8lnbgY2Pyr3|G7zenSBK#<`#1 zhd(?WqfWjOSDkSXRj$Jk!l1L1edzLN%bYX2vV{}N3Lh8zpNz_3X%u2#R=q5Jgh42G}~y~ zDbZdUUh|v-A9~x1!x2W6t7SqbjYjBNj=k)IxbI?; zDnVfqFq(8jz%riK+*%l9|yW_Ti*xA?AurA=x&! zcp9=z$z*$;*Oup8A}?Z&JY9QITuJH4zT=Z1JF1HwWcoO=X$uv$C9hj_w(Vm?)-96k zsZHZn6i`jnH<>f;n@=Rzw#G$9<<~OA#pA>ENacvWLZuJskRcmkOL2yrg@|jD75yGE zpJs~hKgN*=UmW=Q8o1;M6-{-x;ey{{*oo)jsNJ}Lu5Yv-$>>j`^tn@sYRvSC5Hf8l%5dHWQs)&y}KV?mIig}Wz z6yxA=Amie)?>{I~&IGy8Z9~XHidb{*@N_U{D$Z{YjAG6i=V2)}mOy5TZZ3 z5s>T%nj7_T4`okCMExm_#zS|Xm85LNZ+~m7D(I8rr>hIb=@=qh%F7qylO4(Op^uzs zailpce|C^+U_wrupnc55n77gw#GGYML^HG_N}BuJ8Ktc#U7mko!}^+6*$*4h*O^^_my$=dktyyBu$|LIYxw_?(tyOcii#JsdqjFNYJ3XW}> z{{p!!awT2oouH~QH)MREh!lM7p2AesMk}KD79K~J{ zsD{K9ifb10!%x!V=i;QVV@(Tx_DQ!ziKd*>E?$p(rmVC(4CMu6v`50>co z^Ke8fu?hdY?M}>Cy1{oV`t5osp5TI+Yh)*0TU!?gW>nXpkB7vo#Q}5UGybKFsBG!vLcS(XRsP#K^867MwxSF7 zgw=z^$RA(P!0Uw}#}Ex==sWzWrpitb_4TCAI5%NQJ%PB%SEA^|9KGy8QmRdvW4j}nyRl!H&$ER*6CN1JOw z138Xjh}cRhh9%F(Y%kgv_rP=OCY+aOY@M#@iI(lVqgI40AGWRJxg^;fp&-WImu$$379Hhsj>S;cCKsYa&4f|AEU;2tL(g;EvReUZp+>pHFXAf} zIeAQzJ$CYp7p1(`c|Il+^c%c5{vw-F?MYFc9jkyXyG>1vh(Fg+8w+MB>UXg93pk~% z85^6b@vCcZ#*w4?`{NaPVIuIK4^dxV7WAL;$dx^DPI0gEg8wi{6SK(3Le_1fKmXB> zd^K>vt;MR0Y)O9_H9u<85K@M5^GbYzZzZm3S4T{)YM*|~Zr@65)7WtykmVQP}7d8PiGQ%H=%e7C~5(N^%pD1qk^>5)p74=5IYqMMv}Wwp%mQCH$+_G6X` zI7f>Ua;9m1#bQ&o^RX@nOg?2*J_N~=c4a;cDIPI3zw~$5TJ-8~vi0u$haZ0EU(L|J z{LPy;&tDSMraQ|MCr-q;apN$4{CKQgyB53bvJ3XvXCE)H9g^ll1V9KsZFTEeV85l; zD2c`Ef5=JSJjyvoKh&2*jyWKD+&gF4(Js>kntLLuUO_FdSxJ&@1Vq@HCiya2f|8XI zO?YwsRZOgdHoqpd@|)eYru_%_WS4{Z}Zxjc>S|g7`xZ*{tZ$6?ctxVI32Igu0uO5UK=;y?prRzJCm27nu|~U z1$Jdi18%36el(Nei`y>yDNg$O@i_V9 zQ}F!9bNsVL`d!coFFk}aPW~FccghcN=bbm<$}6wMx|X)6scwspUw9B_p7Kq6=UXS^ zfv4Zq3Y)n^^rRvLJYzs z8-&6y^+gRU;W&Hsmsn)OJjrB^Y)O@^HsUcffjbzt>C|mJ`qAai1a?y(iZxtOM=av$ zcq?qE8}l;T> zXJ4(1XuL^uiAZyNwy6%iv2UMAM_@Tanj11B6>S8`+k)k+?S8z5g|cHH)%H!It&~d= z2_VU7+5-2KNfuJyod7eqqrsRLnI@p1Rl<^dMq~nYw8=KNl$7LBS&h3+iknZLasv%0 z>XYKr&Pd4kE_af)P4aSoYtW1gRY_1L1(DYPid*5@lT2h>L=(!;gg93fL^-PQPLd(- zIZiaU1teU#OTlwU_R`&%;yCt$B#jSksHb-p^skBf*hO(nNXA*K}(oYwjAOXQon4ZLf!nB z3*6KcH07WA)|3C}2_#|@LQ0JTvF{|Sy=x(T?u{lhK9)qt$|+9svoF!CNUP?vB`d5& z8)HQ*+m%3Y(nCa%vW^WH3kuECzUD%VjUXA5L=rb&Sjs2tx)Ug_4#=A_19< z&(l!>3y*{fcGg#;nDfO)h$O)>6}PrgqJ)Nr!;m>)n-P`EGX;yOFMsT3mR)lvJN|;Q z;_?+wrWH|&^Y8;XlP;_<~{^0cUxuX>o|oQvaybn$IUOm)>y-N0ly*)%Qjw*r|6GvZ5- z8wnm3KGKmwf|v2vAFl2ph74(x85SX?7?-CzFJO-hPGXB z(rKsSt$+R*OE&{G?SOy(c9M>1X1Q({I3&&pnA_M|H!C zFTIJ{Mh4Qj8MEn6S4=8bbNyy4ShN^Tsv&A{#COl*q?uz_6f0?b>O%$* z7ipAtjcCUqN6%Xvf|la*vxG6q7Z?mF^jPv-9iG@hMR;;PWd@k zs)cFm6fyA`wM@WRg!`>Pw)uCbqfVj(&*0*Vu2|GpH|1yf6q_8d?>Uz2dwj_&9~<|H zd7MQd&kG~jmp1eD3n6($E|z6S^G~)STqzqZucL6&NbvESbluWmj0yRg=akE!N+`dG znK?OG(ll=2*m)J8`pS_8fwh;kWbEIvGA1IyOpTdp=m=<%$_iSjYAm<(?bjOlRjf`* zxTHkaBim-RN(Tn1Iv&EF^N_r{eDQaf;+eorwKh(mEt$7v%{AKeanENQuLS3vd4W4N z#hC5#X(;AliI)94e)&_};wf#9yJSN?QcbwWNJyGjR!Th6)Tc%fi&$yz{1VT6k=3eC z$9%@QTlt739b-vFbn!_P>R2>>?8J%CeL;+aYASzOPYrR`*Ul*?Tja4ZE}xbsxF+hm zVaqsNOKLkHq1qALsBU4`AE8o6GD(U)#~!b9;<1%jGHhGwvhOd8S)b!-Q!$5>hr}X3 z8Wvx4KO`T%WYVcyF7e5*UJAzN5!qIUkk7TQi{jD1ism{A*SLmEd~YP?hhOtdCf_;e zyhj32y=$S54#|SPv$fy;2jb{skHdZk9Eib#cR<&!-AJ!SbxjSrckh8ALx$tPgAT?~ zM<0WO4>^SN_&$PcG;yx`{3Czz%e`VyK63AUiY5DZM=~Z$Ho9?sC6YiTiF2}K!?Np0 zDXF-a^e;X6*Lm6NG#jP_apx|QWu>G(*`l-l4YQ>5vgkvJAw z;}J&*IDeCY{{fkw71hh-{NEs{q8tWmxXX~)3T#%s*1Z?WDH%>Tkdw-c^ zw}Xzt-n;boTaWrB4}ELZpb!|JuJ{Dqw%HaP8^*?^;73_J; z4=`p(H?&mM;48;|1--kp_rEB;`R|v}Z`ZxCcJ61GG=ClXcB{wuNps_~d$gajBm|~f zdmg7Pij~@emilQjNUK!445H_j8|B2aU126=8A5?tAY`>=y8WjPTRp@taE%}FOyjPQ zFKh*qIO#Mj|4GBLwvoEVGtanGvUJ!ME(_kvWU>}pNJb1HFH)lVz!c=Z`9TVt5O%mp zRl24Z7Sf)rb<;+$eCn6t(3av4G2$tIDu|vfhpjR^F+xTU%4a^oR;-frk{@qAIf|Y( z0h`SC93YbWc`u>Bq$g_l6*xb0xlupHkv$eEuwVtGSSaII#CIH`OP@O8WtlVq!oFnH z%QhvSP_}tYM6yYN5b@k8?UUI|DuH|!x~V0UX(oEI%Wg?N8B0wBp?oA7@`9pndQjQo zwj(Ub5w%_sPY|4EnXL@AQEpegvif*jGssSo$+0Jm(&i^0=1V@uk#$RbJq5{P!ZV1O zXi2WMf8k}V_}a4{{<9LPVyZ8a+7Kp)W+Lr`-2yb9L?@c-UXm{}K`3J2&N@jZ&*zd( zXn8E;Ph|1Rwx9*w(#2SWZtA4A47Yr;85pT$bx3VkDd7=|NZz@%4mZmdb>PE=EVrSJ zebR#_T>Q|@`KO);!FNlU<@;T-tZ=1p;?|x{SPH?Uws{21;X)P~HQ3qE&(H%o-v%Rn_vyvy4Wb2x? zpqAUFhGuN!R?qcMyAEA3aEGB7z2AZO;*rPT*sq;{qmMtq_#S)jhXI3!qNYYJ79#`3sOFs%fhdt1>2ThqJK zhBJuofi^;2FJhw~>)E)5Gh0^{)tzzFk%!`$C!WJcul*bCxQHG(sHd-dGWg2^j7jSH z2#3uWBK!dQ^2g%JuWth6D|VLRz5*TF0hga~5}p`89|s+E0**WKAXK&0uW8aB<7(fz zlO=UQs?R$s^SaHo=-#WJz4~f~3;AMUu3RZ)9yfhaQGx19Ambjq5$9ijABK%R4B!3k ziRjU}hJ)CQ^{Z>qXWPD(SGtu|RlXQdew#NpV&Sy$cO6H8Z}@pe?$jy7r^;~zd;V-BdU zh4r+ovzM-zcyMD>1HsLZYpRSwqXvDD*95?kW&0W|NA|1&ld)$0)fPC9f z-**<|JM2rr{E8o1RJJZbVDu_S-uN#Ai$ zQugJCJ@Y9mTOMQkjy#>O=%U$1^fQFbh+U7859uhLBy1Vcq(fUApKM5aQRC3J9s5%! z$yqjH7VcQova5SVWHA1SLAb0qAJ4fgn|T^r;rPLtraCkF&aIBgsg9d*12N zZj5b`p>gqD7Y9m^tSu^b(N%-sW&e&@B-vAwXws2A5lp8O+u$Q9kRUwQJ@W&XZ}W?! z1>%Jt;c;w)n8eEj2~ltPvrQ+K*V7_&lV#WvF`jH`9%-J)zWtLf%W)1+45{kO&vhXhv87JhA{^F2wj?e* z^JUvpEX`-*@}J{~e)v<5I>ZHGH*o7pPIKI0vCqxNjQr{~$TGyW$*)_+qH#(32F|B^ zuC$J1g5hV5-Cq`0{U{i<3me*EoKh$X)CR;$^-licycjapCEc}6Q!Q#kNA{zE0E8qwdPszuC{!duh<2$MF?W< zQB3;u%T2gHDS0mFUnB=u};S&h6XM#{!I>v;}AU@+|B#az`|*UxT^^MJ9PZ=|6YmL*4Fuw!wm_ z?_xRmow(>;vv?L}&R^m2(}b*9vjU5mPe=9_Px}uVc*@DJXh4+f7u64zdR6>hrz8r*#2jX3^* zolxJPKP*)}9UOs(4m#CY8!6hvPT9oU8b+ci=$4AZAcOU@fb~2r6JD4AfIxr0h~t1; z*vNVzA8&(E&qARiO6X>Pnh(^`*tjn|*-5;Tj%)`n64zGZ`K=;C$Yf1H9C(F|t+y1X zAjgy;>M3ia2{%u1<@`cMP+o%!_MFFseQ#mP;4}!SM2Q}G#}=6wC@b;Ii(YHUF-Sm| z<++Qv$!E;M%KepZ0^=!W_gR$Shm9=j8i>YD*o(MD3Q2+yj!itmt?&!Z)wl(feNC{-Oww=m*b6jA$nNNwsQWN7F)@- z`-!1OU_PHE*;3p^n@m_I9Y?k&JIPjgEG4{5hI*n2igXF4X9ndRfqZDpiAQa@E30L+ zVI+}5RvUM=m*R8`$%b`E&vh!!0d4~K+>vkDVc(|GRu0*JmWli#<}6(BiUcFSh%M>I z3fF=;7x^!6%c-B_^Jaf#eQuH~uX8Itcd{V9z_hYBf>MIgc|;I)-HJxkZJA6Vr;VMc z54U7KK6WT1`Z=GXEhQW_NKT?LU-FnF+u~(@E7|N&ZCNd}^2lIwMeOQ@Y=%5PJx{pF zrggZt|5OX@TOH%cU$$iVWUT!7(8p|KJMtl4BB^h?vd=BPtjRSM+lZ4(R?Em1Y4Rt1 zg2FInel&hvFkWf}NhDg5%3}*!_|qfTtwhfdGI?ACYPR0waqAidU<=bU~HuDw^+*Ikc09)6aK;wm)O17nXn4K=f# z!8yOW2v=NjIi7v{b1uHC(9i%JeB$ZY_|Dxp^Vb*Q>Z`BB&(6OBb60Hi#e(nJ7*yLx z(pRzs-_;@-VZKg)pAg5p^rCMt9x+KN`^`bc-7;EDIyNaGwxZ>3*oZ4~;l4vcM%J?fDf1~( z&M|{7n3O@jgArCNX?|cqwGC}VW0SwAgC=CyR!=mIMLKDTPl%Yj<36=)!a_&|7In$? z@_0%lPK>e@r?6tWP$%j_LKKUe@Wiu009iKe)dm*+GdbjFqZN%Zd_DQ5gQGzBLR%2g0$&ePurD~`f1VnS)bF3yNd)kz7 zVPBhUD8KM;S&AgAkh6bLGEedQVOENftrQ6Pi^PuC6vd-h11zRGSWgB-41Tr|{p2T& zMVv#}S~T$sz1Sqz3M4O{{F#^SN>_E0JrD_7Qqk3daQ7CC@b`SvtjWDtj5vb|`0@I;I!(u%TkiEthf+e&8iwpV2x8 zYh)lbb%Q4;@rC6r(g^zk$4Xk(_jx&WqQ*2fd_t?3NHeR5_7?@pM8PXFU~nw3X{uS^69PlaGAv|WLw zjjJ(f<{}K+Wfyd;u0-3~75IE<8|*Z=7uvKmV&>`J%-}IoqFSqPiEubeMh5l^J;wX z{)gDGxxsmCY10n7jy(X|_1J=UUV9yFdJe&e0Ua@CSuOS&ITTYreGllfD|YPDfpIru z+LTFX-+Oy(-?uy3b6x$;>n~yH#&+0y%uw9IMfl-oUx$Ns>E%1zuf6yTHdXY-UZaO& z*6g_$vC}AYs%e9%AHR)RE4El!%vsoB#3=OWT!}4p8}R1qZ=j;raBPRExa<$F z;o7@yKo1&gs$Gu{-gy_RYk}dT#$a&2?lBp)r7JFvizdA4uH5+0I7Qht209sPa!Xhm zYBVtd4`6nY`VK3mb8SIEYk z3w{vvO!>8v5yG8hb#Mz6Q;ZZ>J~0`$A;oX00(8LpYPj$jZPYjcb>g5di$gw=d{Hx# z63w`5WGmtmcQ<5;_}$mh%`xS}ZzYN^Ail*XDQ@;t0+WO&KIy4fB1Ue)Z8|igb{XfX zG>Y&1{I)9jwiF`KC+_^ha70$-+Z{b~e2yVbifz*gR(a<66PkI!z|D0EdJ$i;;jwjy zArm%i(6j*ghzKpGuJhGqt8Sf02HUV^pxLJLWt+}j#e7L@Bf^ETFH-5aP(4L)CmKF< ztY#?HUv|{84jco2Nhu$%g-9mk2%6aCxl2aJh4hr45aD`K z%3{I@MIM%LYPu+lsn3q>M4LqfR!M}6$5@J@j-N%}xX=P5KuR%(f|hk$LMd1&Yl}gg zj0idKq#WA$93F(ElEzr15Dm3f_EJ3*ll7Cb>nv2VmI!hI$smd0hp5XXB+VTYiTJ7d zm*{E}l>~O=E~Zq{6C`<|*;e6?{pfl35p-eL1el zX3R(1cGcKr#180KMQf7%Z=hT`X!&=V+i*f|*}Qfgo|?20hmtC4b8zMt%8MbY6?I4@p%0Ld>k<8_mM@SAN5=GL-j=U zQ+18?`rS{u^Oy1HgMsKX!d1i@8pUgi>gt#*0=d%iIPEbF^N-souOo7>Zydq7bh8`+WdB~#gz<+`XT!^EgGB94LwWQz9*^1 zP8cUQMS|y@ctP-=4|wn?mu798*o>CBw5GVE5$7|)(oSP9A4x{>I7fBDW^sV2?+>)m zvX8FNk%-V_fe(2J+xpC4{uP1P$HL8VnjW@oM0>eltGB~c7ZDVb9tOr1{G?Z2A0EUu zOW9IQgBh`f{i0UMulMN$pkvFGml}PA@sN|_bPjS?jbhMR$O{Fwk&A$>$BY$8LpEaXNW{2v1o1jFpq3JZ|OBY9^yS{~oQY~de$BII-Y34wAvn-~!H`${t z)2SE#6eczw@A4gGEBCfxG9S)^oAT7T&|{=rM0Ej^H7f-Ob-h`; zh)5Q~lKhC`yKoH3^O^lLBV2FUl&&Gwz_HjDH|C|W)X@~bgg{(5kSn?%c#(1F5hx%# zdJWMrAPs#CPPrvf(kN?j3%jq_JWeLti^o&Pz2}xFQX|WCv8?1sv|%x6Nyof(L{V+S zx1#m=g9EKlOXmPBN}q7RR4M5Y&MOS=B7 z0p*pI_eEVJPx***W8@b$*^(jmm)Wu^+ELuXCHu&7E_*1E+tGMHE zk~P(bF_EEgiy^TyA#CGG+p*8{DbA5nNaq+8nsoQ98+!5~;bM`@+?{LchXu-7p9nXf z=cGoG4exa0A)uYCiLe_D@=uDS&MI&l$9zB1I0=r=Sn zCdU?wdHL55>H7!WX-hwZ?@8RS7Qa95hxpnzPs9l){Qz}CkH_!MIGVDNo9gep8FR5< zR)j)ZjYq_3Ty!^4XU!wMFnTN%jCLAq*=Hl%wG5OyV#%hDGjm0Xk+Tf}Wn`PxvUnah z&w)6C4f>p&dh(FR%m=v+RC5H8S3a4=gFEf7L9$)3&j$(2%Z9!x_Yt~{={d_WcWpoeV?dv zer_y8g`~$Vafx#tdk}(WNxh=jQK~zM`WY*y;($UnzrZ+Vu}F+LLwlZE(HA0`YcDyD zolaWuLZnvKNS7V*^pj4mACvKgv3L$5jgH(Ak#=wiDMyWsqLX;8gUzc?g{Uh#lJ_{s zpV;&nUFuRuF{%tHJKJ$Ad6O4`a!FJLBv9R?WL*9|ONd529XP>}lAx}A@KMC3`tac? zOc1W8WVClV=rD95M%nROkp%O_Q(rM8J2oSy@wA@W$TQ|$+$l?WIerOhr@kWzTzQc% z8#?yF4j**pxuO^%P}{Ja>?OINaIfQu4{1rx=M~K#K4d=^LHS8bi)T?{{@9Zl;)x-i zUht$E?kOiE1y!6oMB`Id+@*7Ni&#_(#bX&6V@#ehnwN@EJo8gdB=~36vM;?TW?!nC z{YjT1Dd*rNdr~FS;j)!0pI0p;X?qEtY)CelNUYqDPJ8s>u(gvFIdC%Khke(awNee@ zm~_?I6R014Wx_|FZAByBl9YyyHM99JUo;&@NyawhOKhEAQq{$aHqCV>L_`U?*lL6C zxkr+swGXs_VO^9r0 zzN=NA&g3u4sP@9*EXFPS(};!g83lUjc~LrQT#%Xr{w zHJI;B_+NjcofZhxi8479?wB+?ag~;Nw9ThV7bhRmoH)sv0D2aE2SHRX_Q4aF?MjFc zHiKsC#5s|T2Tvu50g0l<0mSK$t7%=~;XryGNV%k6<<@3P6V|O;&jY3cUAlJnpQmWC zFMFXIV2_EGrh@CD<&96)w52PW#=4EzxVa7$l{M(nt+NKi^^baohT`(1N}1T8kEA>u z2tq_s6OI#C6Rx~2u7X9gicUFR+@@H!9zUImf+l&{k}*;oV?lLmDIYv+(}5rLO;)KB zb(Dr`uaiw2l8!_Nz0kDtn7frb?rkeLvL~KmR8O?v5*%CHy%1H^kGKYVPCCH%7+<}x8;2 zC=lINHTWr}5aveTBI`WpdQ;b#x_FYICCci&qWNANZ?dmxmFBVJVn%9ABc4o+oO6t- zSHvdsF)k6W7d@s?hCbtNxuTM8u1ogM)^_DR=8X%{;?>-i(u|Xwno;n&gF2$GEi}W!MQ7<6$}NNmmR$ zUr2~l?Tf4_p!#ThU0ExHcE~9{BBa@#Qf7R%E>Y#_UgWC@pVv!*Fy~!J5w*PY4W4xq zt~MlNj4G&*?=x)VhS{w)LH6J1#+1QoHr`{|1E{ZDG-aWh9Dd5HBQ4 zv=Ug}BFP%t_%(}C3@T*EMPCX&Cl#QiR7kbt5syI(`FP^S=0?O6eb+~A7SM~dvB)oYVK;V+ zQ;UjBQ!7MrdU19~F)0h;>SrFE$4OcGv6ruGNpkk;R;uikjj>`6-#Mp3ld^%e+N+_C z8`USpCeRB)RF^h9M|5Iz&mukrn9QC0IuFT)PC&FKB|Xb)K8Z-&StdM2ihKHr7fw;q zc<7`YR?--eDw86JPMUv;v5?Z9xVlo14RtgT{32@xH|@m>%;OMeKxOEfX!92?gi}WG z*o^o|(>#f|ANx4z(7MN#6n6cBCRxWI1+~Tu@x_k3B`nLRrJf!#7ycs$y+vwS=IVH@ z5B1E->dd%%3q`fE=g*tH;nOpJ~aVlbwN;(0O z3!RY5S<#;IG0yy)h{jkDw*9tbOuC?Pa}A6qI-BSPUwR&5GZhm%DNfQha2#<*dLh%gP`(@ziJRsY>1pG*vtsC2kOp_242UpVvfFD~|hq>U=L& zPz93kM+s8Tdk&b!(tg!aUMiYV*<#EC(b7DloW@44BdS>R#gkNm%(MRt>dT@za-MRC zO*@?d9gXD@hcaQEL_bNReU;2T=al%NVZJRWHt~vcNa$M1;%ps%riCr>Y(K@HmObR8 zF$%IILpHa}DNo6WPi^?mc1??>BqWMt+>QL@+NU+^u_|hU>sH6JKMExgLhw{U5$RKY zNsF4NybM7%kmPuszgj(AF~%ci5EYkVu@&Mm6G->L6qa2h$yg`XOXo`^VIub-@5Vlb z>vdi@i3UbM8ATC-Y(0MTD!NH*9Z#AWOhTAEg=YaVn~4qen}b;5Hd5v*Y}VK8x>J5WR9a11GZn0=zl>^{n{OCfq`? zFV!&mQS9>i5a+1s*Ed>PWRD9=t7s=Kuh zyY>=@E!MV4*EBWJ`k*PNam#UN{DNC9OGx5|6l0L2>rs!sY$ZcPx4{NJhNi8>4L81t3|E8}SH42x4iDaVz4>t>z$+ z!a%g467k7b9HH^h^S?rluaL2HK(gQJ+?;4hxB!17gP?s5z04AUxW|)Ekrf}4%rR#u zUOO`6+7x6N$i&bqX(zCKZIVs=)7Q zR)Z;#k_x-*WSeF5k_-|1P9TI^t8<$A+!b>$;f~i`wcJu(F()#Ro@6B!IfP!;Z#C{^ zxH0bhnw0yQpJ}P9gDxbvnU?hvt=P(-P!3+fC1Oe|eyNSS;mLQbpb3$2nUz)`Tcy_l z>9&^hjd8($Q!iHxoLi9oKOu_CE!!wI9RlPkm}D~U(x{&Z6x0<!(<)D_ZtTFH}uv=<$lv zp2CoEna^Nul8uWZYa5Jlr->+B;n|}NCcNOu4zW}N`}SRGVNysVA~}KeY{4?7CR((% znl|m#22WdPME&B-LV6xhb4p-JL7*jx@)6z~Y0$ZsShR`iyflgtzjnesCnyqQZ%IBi zZt4@Kob&Q{s2>rR<}rJw3D+iOL#Ib@uo zWS(O%5J`C4)d}x$cRN6%ZXF8}PxTW7g&dP|OgRIN5W9K)m5*(F{6Ri#(R7tWW21h& zLm*`nxeHYL=teK!VNqYUJVph?F;Kz-WWOkYj~m9yZnh){8e_Du`lKWokA-j=^qp`k zQa%jR50PYFvOW&g5jh%yFm9@uj1jkrgN$5UA_pQoKnd=_SAFn;&B%2@Q{WmXS>wkymTkb^@zKU(yDr5wST>(PTf@ zlCAx)buA^w&Bu3&Lm+DQndzY^iu&5pKI@qrnpv-qGLn2J$hj0W*|8Z>C0kaLXxMTW zVut(?sUU}36Hf19O6CtHPiUy;`pST0 z-J~A-3`(zg`q*p+;mKkFX~qjFK~~NSEGY)gEuQ}alprlxHisKYYx$brj&R{!weaJj z$fxLW#^Ttfi1Gm^d9l^ats!hg!GkW#LW=sOR*42Nk?Y#4q|Kc|opG zgv2X5EN0gC)(^lRJhWpCKx)GSVZBpFnd$4=NV=#9|g}ffzBl*2bxC9gEqv#x3;Z zm&Du&i*Xp)zd&uyOZt*k1ky9fJ}DAi@^$j@3nB@jrd`CWITE(gCMCbg1}94 zTyiBr?PbFhA0sA*t#s0of6Z_~=6m5OTeRu9X9Ln#J_PS%H*1O%J|*L~Q$0_UP0g9Y zxNzB|h71dr2#XmXR}sk+Kc(w2GJ{P>dvlEBMN}Gn@dA9Di|%?WPEwSY9)(Xya>u@9 z+op4tY2wMMc;P3sQr_g}<0eF`26eA0d@S(ueax|1zw zYU~{ow?s?kh)GdZ5Fxg>;E_D}B#D~+=e=#P)fiZghSlbseYvA7q!l(3$>8&;;^O87 zZlXtGsiR{jl1`K`;M!`u6lV!>hTFZ!; z;uBxTg(XOHzQuY+e9>ZTeO?w{I-;}h*HaTLk>-SKX`gt4Jf{;cYzqn7ibvgey{Fxz zCYsO9q&h>NuYxY~O2aRQ;;SQ3Gt^3#@+Ql^?6Ok|g$&6iVL~z+r$Y6)bDS38&b6VP zluwG@;B%&(wT@p<8lBjON!3stQfV$eW|I}=M{TMX1t`tA;Eou{5-}Ptf2|9>(ip~O zj@#I?we#{mZ6-SzR~zTV5^y}Svl9F_n!vi&Z*8O%v~oaPPi_j>lU5HFUOzXNPmbZP z4XUat$zvzE*WXv`ONRP$lA4+d7dA#C1hlt38VLKMsK|0iA5~TU*|}scf%Kyd{jDMR zr9C%y0+;E?Cu^FSK(R2+RKL8}AClS;X#P}GFb>+OYRB== zeDh$2o;2Mi69Ns1{sx( zjB%~x7Oj33QuALto#IQ;#khLYvB10(qiSov$vzW`c|!dF)h$_}n0``H3!2Q;`9Z#Q zE|HWaQ?1QY5oBH*8__NnemU++*4J?)epR*XF?aR3DOV|nej>YL!{!C3PwCtxE>=j2 z7ksx_#%=1DmG}wNOWf2d!>|^(_R$Z1s-r<|sqejyuf&&R0$S6yw#$u1yli#LhmRd`*oL?vau1no zM^K#KsUNT9l;M`gUVF#sF12MeC!1<$8Ffw1V=Y^u7O{lqkkKY6;qfkxY(-zvg%lO7 zTYz}2ZN!;DP}0jF-SWIcLR+3&Ip%nnM^T4rm25$^DfQh5EU4B`NpVl<-1k68KFg&x zD=PI341ku@wUeQvI zIdc|ZbA5BXU@^&xw#}F~Yd#uV_@d~jD$uxj4dyLch1w;b;jX_tg^f)SQyv)kiepRh zMVu6{pQ^T7@X0Gr;I)a%yx?+vir?ZPBUM2jO4$t>1CUM91eWCsZO+LTd&IRE(Zsh~ z`p^QWxqbuIZ?5ADvt+1A`j&>xm@#EC7A#%sg+=(%UTq6$Ram@WCN|YITHbzSlySxt zT}X!pTRwgD!>98%C=1rNbSAgH;`5krr*U!ImJVF%*Li4%#%kl5<(M&b8m3H{f*CXCqnUcT5Ryoa!N0m9(~4CSUp5j?hV{GIpTGYs zo_~L;$5L0`67#~3LcV(-S(i$BVv^2*($%-VF}q~m0yI%>^^*CRI^}aroje7z<}KEb zd6Q4MG*9hO>S{@o?~h-79PfNO#}{v25+vE;%N~3R%dPc^M@>t$vyL_jmI}wjQ_bQsw-39w#ThXQ&bEnV5n)S75et1@xsfFy)xwEih^=8hc@DzFk21DxTZ!6r%kcTc$sE_I ztmhO=pE4bD=PtyC^=q(X#X4SOR5`~uNyl8#LUv1I9i~tH98;!FM?(u2uB@->q6KW@ zh837hoAZ~fa$oT&YS~dP^_$jV(Xv$@?{*xwy7enDW%6Xqn!5yTBrk886Y|GnPUo0L z>C!-qEjx_8VdH8{{d_8>G47c&=b>Q>=K$wbMN2K7|Hni4VCqtiHT#Us3vX*i{frAy z-4vVmF*e3nQ1ji__^MB-q~qhzv5>F6Wb_d(shX;}EW7NR7WOob`F!Jf4P5(G{q#tuoxjCOCCsD`a00fyPTe7UVlw|BZ{8)|;%{RxUSS4=TRxpU< zW6cRE;gGY8ZBT}FlO==VHWGESnC@cnp^GouqMbOtB*VVKQbXMU#Sn7AC!GhS=Z1Wf z6aFJUC9J;vX`{Y#vC-(eD5S-hhMe9tP~3{ct&LhCKz==jBuBl1Vw%HhIyVkx82`mU$s*}4o$AlHjezmuhU(14?5>wG;fY<*fIUw!Jh25OT` z#vNzcq84(dp8U&aG;XDL~1 z`WiR2WXPX{ldNPUqACdFMV^&&_8s*QFUG*NBc_Mng_D3{VPjPFRFmX{=Xz&cbGE#W zionwJ@u6l-|*P1K`OeSrm zgP%Y&5A=V4V)LYG4N_+a!6V+jrWt>};{Wi?B<;n>-^+#u7;)2zDp=yij z8eqb||A5;bc^NIWEAh#s>3k7qoYap6Jr`eWeN!sg)y{M-Osi?*v)3NO8@zmZze5+*OjN1)uT{nshiN7)ML}W=whi1^o2%v+(Mt^L%%* ztzK|9EyAV0{weOb`yO0z-Y@ajXUF@GPKtWdNPEV2_qAu^quDFD*pU5XJI9w|&cm%( zeAkbg@5JZi#G_d7wb&t#xNA>(TipehjK`F@x{mCN&qvf#GJ1p^@s(dC4P-nbd8biVLj|UwjZ3TyQ?_y8Tw%aM^Eg-tVr(vW+din`pb#)m=yHDGsL? z2e%i<92~BXFzx;4@Y49HTr5Rgk+Vb@qvKYtPTn>YkNEmio0%Uxhr9p&JUX@m9{c0P zxZ=tiapxay!R5a_8(07Suh`6kyiy9P3+?Kzzv`w;iQ<#jAH(|-=Q2*_Z?n0+T&PJW zTorXvYfvlWi+t)sbu!V_i9aBA$F<92b7dF?4k|wqu)hxcJB4 z!wvU7ffm1GV`bW^M0MSK{QT5Y@yN>`qq3cN(v6rLubkNp`||5Hd1tJW*|2;z?)u}+ zSl_7m)dm|^F2bL0_$_{S?cJp5ZfqN@nDRPqy5V~K@s^u$*B!Ux+KYdV%WixaO?4}9 z%hlImJ!@6mF=mZ4_t3NvkN<`8ci)YBZn+A-z36JpU){h3c?G7w`!p{4?Qijy`~QSX z&;2PLeC`7uCkDpXj^p_D<9Ff7*FHge`k(aXlep-D3vl1PcjB50Z@}70)=haZpAI!` z@czGkk8>`%4r^-Tu6QI(yj>eC`}k>`_49LZ#~*LUb(frjb1%3a>zjaf70sAA=~FCQ zTaTKmHkkbOvv}*HS6aBl z9EY+(y8M~Oo$YW(JiJ63`>;{SC7bGIC~O)Jzow^QvvQbEdKyO~)-B|T=1qcb>^s}G zlph&Ple+vW1{)}sD%p;f^o(0VI_|hke7UUHxcHOLFR3&NU8MtF;o;JYgGR0qL9=c7*7eW0oK9O*1>x+2`g? zl1*~fvTi^LPx-lyNir>t3h==!d+8X*9Rbx>oWPuQxiMYu!?%mM>s>9nkA{F>YLS+8=R| z0`~bovn4aQ_RUnfbb-p#n@)P{jm)R^{t)oY)6!2Ll4s2 zOS>S|rutfZ`sq~NN<&5C2E6vxB#hX36nYIm3|C)t7P?WesiDDt zTGDn)6V|R?i-u;ti2Fs6I$Tgxv@~Jenzg8r(DsH~*_qh0%C*tV`{)m|?Hghs-kYeDpG}yRq73v$) z0CPdAwr!hAG&j^@&FVGSu$ggiQ6zdxLmf6NW;BtvR=-r|#b?CAg=TXj>8sJu)Pm;v zdNk3luGear8%bfC!kag3;1wlt)<(Z&x?cIMUGD=;^-yej8@s7)6V{NfgDeLLg16SrP}DHgo-Fkb#(MtZAWej8Z3 z7zdU#Oy4N+fFs4c$AEGzb)-tZusH<<{oRmBldyKh-^IGFkTg!Q? zy68fIscu}m2DO|kKAACho#?6=$EI~_IL~OKradn(t96jlRvbG%_&67v8n)omw_n86 zdFxR{dzy_@#mkR8gw>Uu(5ANDwP?$^8FOfr=TJN4NJcYbs%4H_8a81A$5h9yf7GAQ z!g;@HjC{_}mf<&L{>+b!2)u#ssIB1I%vp&WH|9*>!#9UR;R3Ft(88&dv_8)UJet*XwaK|5RLYqlX;`tAj z@__AvAO7Ytd}-`hZRy)nRIDXtWof7d3U8-d$d}^=bPkaR33Nev(sTo6<4GeLX@)n}lL);`47>%Nf(4z*od)+aWz|}^pMRAH z4$CR8sGqWp<4Jc;BVX}7H7!e?I&wmYTqEXu%t=WiG3)eNs(2g)Ss^c;bVS$dwBAY8 zO(UKEV{zODjXb}v<7>{cC5y3e!CWkyKOf7NF5((y71slGzDcBy9O~n%T0gbZnoGXu z!f|-VO}RQ}%@<{;SmfUYFP&=?BU_;g+EVPemP*KsL<@}C#A!yj__5Pe&kw$ic1KM^>vuBd@}}Z z(;1y=^tLJ;rYl2%CW?b6O%4|=S?RY&J9TW2nwoZ$ZR5q5(^ur&oQ_8z`Y{@b&Oxeb z*@%~3{}}rpegryiS&#egxDR`N=?Ki7vkZqGx)E?@SK{CU_rUlk?!e=p)Z*Z=L(p8e0ayRu&#`6T z80@-TH;jMgUOYLe9%Bbr<1csKihn)+6kd3G9Ckb6D0I_*m8Y~++nxhQ;KXly1=C)A z5*0h{hcUypMg8gpxaa=A;)I`HhV8ll-Ft0=@y|YucEk6oJpJNJc=^Rw(0Sml7&fpQ=8b;>*RTewrhR}%{`ObA z_R$RNy5|`5=u(BcWwUX^RhQtI7hc2U8Po9Q6HlPN*Dly?U_0D?!zE}LbO3hj-Ja`- zmAL-*w_w|0qtU1RW<36vJMr*8p1>wN4<3VwuRVdg{(L`PeEwO?Ue_6i>@~#y z2&uWJJB*8_yn|OiU5k@XJ`$B&G{5=OBiMG|?_!s2E6}lPSA6*9Gw8U(J{ZgK+OT2< zZo1}LJpa;5c#D3w9kM$H_Nc+fZ#;$i?z>^X-3DR9k{P(07eG%w^DJI{{Vnv}WgiS+ zJ?DM)8t(eT9eC;Gm+|V`elci+XLh0C#eOAU@V}%^ci*{|gwib3e3n-W~^x8Hy#-xxoCxAMh;a&x@Q# zy@rg%kiMNT{<(W`?{gnw%Bzpz-GvRqLGL~HM%{w>*#FDN zMGTIYi+IlIRntGjyGuLZTZiq=bZhbAvu|McFCCAawrPv|IR0z9?T8hhJc9=xdjX3V zFTm{OYq86yJky0)-9ntYA{mGtMnH1 zx*Aj5FP~F!Oaw36$yIvd$ZMX`Q}g-sEPw!{lNxgIgkeIda%%c?ELKq^Vri*2qCxaVuf zdfz2nr%LN#n$ zidSEK6aDr&4p&@$5&EnjkNcna6dm|t{r6ih$AapixbX6;@$Ii3fK`j0PytlA3uDSVETy*|V(XpsaZ2G)Tm+rm5x$6a+Ksj&Tv=X)J+oNx9=Fr%TE!FMN zw{r_tEZxXO5H)E-!{Mds{l9|WU2z?*z4F(1^}d_%`NGZEv}`JFzw1HldEAe2 z`DGVlukHKEa*$J%%ry`fFUrMS6z?{BuR#YZrG$$B)enTM-?cQFPZb}D|$vHHpPzlk0l z;>xpKbrt4*{3PyrY6`yj?GsS3b~f(0?-3mOtzY8mYp%l42knab##mfxT=db3g;OV> z>(JeKkwXfvAa#&zSiKUf*R8`#k3NWnbpx>f=w1Bz`CBi(4BPJa9b9wMZ8&nbPPq5( zd$Ea@ydKfr+?IOWbK6bWvg2X6_U2pg!^4N-=4)@mT9&X=&q4Us8Rz0MF1q#`(1d#* zeg^G09`{~*4YvE@k8t(%H{z6Ue1QvIVBBAB#DsMN@Y^eI!B4+?5T1JY9xPtJ1yf#o z6n}dBW1Ms8^|?&PJX%ncrt`zkuqY z`(a4;YVxE0?K*FR<4!#rS6qE9PS~dp?z{J4)RDe<)m*&(`nwp*vHi&jU*?F$U)FDF zX-3EH{c+6kU*|E^gtk>R=t+BZb@egl`PBK!GnZ{U+Ir@(N3rVxM}pS~XymH5O^5y% z)N3d6#_h-_ZYVpv6kK?!>d>`%UZ}zN7ST^k)oO8za@srcOhjTB#8x_@U(SeKO51)M) z^O^?YtB35)x!n+TD?3&NdN*bU>vqXi*WedFzW}`tISGf1>`rzQmdu%jWgD8X|1saj zm-ZTg1HOC;esTIK=+RzxkK%aE$G*>J#MSdcL>L{G?j**sZ3!a9Im1uk(qO&Z6EU3+ z%Jef`k2sc0aXm#>qXCg#^x68wBlu=pHz2pNV-dHK%PqlkhnxLoDA^DmXF1U#`qIk- z@&Bq9w0v}0%kim=NZ`*o2jqI{p*H(7h-Z`>s>YqTA^^*W-|#6At{6)c_QR;-@Czha zVI|emy)s*lGw#A>x>CqG=89mxAY>#YEc^v6=d8Uk-z_5|P%LU47rUf;aUyxQW|lS+ zN`3he<~y00#w}u1n`N~x;kh0;zpdrG0CPZ$zfe(Yo-iq}Z#kpl1kHqeCpYL}FJ_E3 z%`<1}3)&Ej(%FL~OcT$`BI@hmFbMvW5lcxgTB(=jmD;$`Cwftr#P^nL3Xe68Yy~&= z@)z-h-z1;>Ik-$qTjUr1eAZB&B8cubH1e3rmg|vi7UPy$#hBQ|v643u^<5kBSFBip zciw#$=re2-1`HUE-don;^ZCm$`Qy*9%RUGAMbdYW^p-u1=%W)O z_c{cJj@=R6w;6z=57`%srq4j*rUiIqMkBs+%6HMXXJ-uGZ9g1#z*v8D0UKvy+{`+B z|Fj=syFOjfXYerm=B#hw`KSJYzPlZUj`a&LeL)>Q=0y6^_kW7{(>_Dvh9#I$-vN6M zABe8K`(V?8Pw>jy6VRdmFl^IFc_~2x^Yh(%PP~|UWx$1ROLHYBwd7-nye|ZGA_%&H zNS4{cMNy}&U9e&4RQ&ycd-2AEnOMJS1~yo?4Tg?69Ea>P6g~S4#6bt_fjLW;VAJBs z_+VlKesALB-auuaeR2E|yQ5>5t~m7g?_pR?6&F&~nEuWSShZzav|YadAAB|q0|)fR zd(Xd!&8oMo`oPcv1^D!ZM{w@1&c%;TIR(pl9f-5OeYkn;+t%ZaXa0pppLm8>z-zFg zz8+IQcmWH$?u|2!9*yq23LZRU7xZSm^)Z7fuRntGu73*G-+LeS-mx26DmyUG3cUI9 z^O(P;1;d7J%khp`rsGO)H!WT~2YveVbDrYVbm)YKZ~O&*aKbUT=&o0A&NbI#=RTEK zH0vXLu%r%yyVT z>^GzA*gv6EEV(qmSXmn@)T&m-JWfYv)hK-#CZf{%j6bt)7Qk8>+xAV-LrE zV}_zjM;>KN1}tiYOiAK>0+rr@k!pTT34 ztM4}P@tru2mFlO3P3Kxj>gl5jT&SltWl0WOwWn3)n!1O6hp6wm4Yz} z!ebL9=1ht&jJcli+96$LXmZ47b?FIDdFlM?HiK-_mh}pMffq3(bD8Eb5>PfT9J7vT z?(>{&qf+MPcm=+PWgD7bp`GnS{1IyO?N2&sZpQpj4#BroqOqV+eS+XQk!qfzCflAY zVTef@<7gRz$5O4t6$t5MOCrBU>%~E1;i)W+V^wUnU_8cKJkgSE(UNhK$&XA@-0X)5 z#hGMu$I)O06HT^?o%#-hIV%RezOqlld4Z%aqZdGWNGrBzLP(uxR1g0KKlO6XajY?> zbO+SpvL$)R*pLL-B#?~sH4gc>lbpxKW2!E9D!F;Gr7awoZ9QS~%T}m%qLHbo5ET(k zb4xLs6*O&p`g=Tt1q&A7jW^!Fym|A`qel;n9zB}p*h6sm;fLecV~_QA&_fS3 zuS=IMSiXEY7tU{4r?g0nc!asNKZ06s@>_J=_x#AZrun{a%FiMM?o=QbgubLFy1Moj zn?+^LE%z2@G3+DNfa6%q0okF5rg~9RwuUgmEe66}LNSy{E{hA|{6kd-7m#TgqT*YD zgtB19-S?(vYag<0<+t(nzy5&JzW*aEuIHhVPE2uvEETvMs@io%Rfo0U`jatok;;pObzF$|>f6ER z__%UUH4zXo&bX^8x8TXUuEhgSy@y?Rk#NKp_GfzWnO+S;C3E4L+;zww=V+>{V?KS+ znKF&MT4-Xc1z#QpO*AbE)YX^9v{0$4Zikug{u`HGa|gO@w==$c>jt z;WfDA|9*^a)xfH0uj03t-HxVC{qd!vj>e7ydReD-<0ka&-Pa~`=dsD3g{3J@;`J++ zV|{%Ew(Th%bL+S*etyB#7}0eduKK?-as2}?p>vI*mFt*?K7fk@K=#+;^vmwYzn*yk zCy(unzdiDAhuqT0T$}3g(FgBx(fk%BOr48;5Bvf;w~NnE$wD(1lDb>|`KRMKN4Z#h z`(x~V)Jf>qyDjdy>{od1!+99F&!IT7oAmnhub)xVUlSmnikYHRpRjDj^g;e zh}o0JVMfyq7_&1|9-X}tZ?v)Fd@q1diFBhtGp)R!rpFErm&`dof}F0Ha_e;jqpk@)(F zr{FtBkHU-3J&8K1Rc+af2d+2=AFSz#-(7nJ26b(Vx(3SA$9UFhSDx$@tH!iTzn(bY zkb`_d-BR5H#~gYfCXRa=S6+ApDtZmXgqNSj-=BCHt5+|_6KuC|3?zxao3P}s9|3$`S)=vUdk_nWjshczoj1IBY*i;#^T15OP5&Gy@!G@cn{BaBj{s zKv>Sf)La8L#-eK(9dr3LL^RI@;S|oXWyt5jWIEX>1F^kmBAvOH^MvOThhP#fi@O!% zxGa=3BGJ-TrmNVBF2!0$9{#No4WZR2+n04n4A~^9IMg?AIj9)QYesM#`3M^c7>{X0 z^L%DEK)T$b*6I8w$jXuwz3^$8i!Jfs$HF<=OtcUP89v=N&_{@bWFqJD zaE{G$#1zGpZLmqY7Ed(qMbOjyR99n3hKecdh$)D<3F$~6LHLb&mf4aIX>rb}Z(fSs zI;meiR)YUH)+B3Vi7K^(Se3inZxxqZ`;kB<)U%yLb-mhf{nLUqYu4bSk3RBUE71f(-L+2I zlD_saH=`e~1|&1)88{Dg^I7`8#X9z!s&X)RuUX98-fIC&V_6aRV&d+l?$ z-!9+x3y0(F2XDjt?z>}j|2{Zyrxx6F_Y2r*_c2^F0rd@Su;>1Vkt~>O>zn^&@Tzg~L^p7#OZF`K_u^$&UlvkNjQd%6=S;+$xy#V5vIU>M@g91PITqhIe1GiJzXb~x zaU^)c=)J=rESdZo=B;BcHN2YrF`aG2n0JfEt?Q!ZaFTj%5@5SREEJDA5!+3$y5#KodTwKI_ zF23k@_}OXS#-FTL)?ZhO{f!W*w*{U(k@I@v^KZVb&04cLCq!!fecLj3Rt7vY;f{Xg*1 z!}03(k{jz+*G`%3FP^mKzNdC zsa=j|UYvwuzJ4SsI7Ys^N~ZQpRxL;G9^FgFsqU6EHn1*@zKbiFh4U7nQ`g?;SOq-w zmm4stdSBdp-VZTin~wgRUVD!Jrj>K>#`r}z=1cqgipLpx!TLqX51s`G+;`Ys?9bVt>4#AQuC znP(NV7|iO;r$=lifJZ`vXrb_tqysh?W+lO4+lp{=m5SC~OR6Bpu%6yxl>f!2#$9lv;_ zXp@6Dbi$5X$*YyBa?g^Yr`9^}hQDyr{s zeC73*-g_g3B!tj=2SGuwD~h5hqI3|Yi3o@VK`f{s(tAgwcM^IHfj|<{LkfiS_LA50 zUu*4|b8o=U_xIoTo-=!PpFMNt%sKbobE9Tn1SGpGXu!vejx9HmrDz)OHg0w96nnDb z{*rt$&bMwXxMn#ci5K;p0>`J4gpkml6%ReNM+_YYB6Fv_NGG>j@`_7F<4v*fZN1b# z5eKQx4Rxv0($a!A-gv`zi?vAJV~;&BYSbvy)$xQ)(0S|Kci+X-sZ-I|7$>Egni_1q z_16ATb)P3SvQnAtI|P-=x#c9D zWC-QBK%rz?TR>i2OF_65wFUWqgX~aNQ)GsGqLDeNimRZ#m>Mz~z3WzB$%f7tF|Zr- z_1aoKTho8EZzCLDj4-~--P90I;}EoLuEmkZ{utBmy97Ty`DZx)vKz4P;orf4p0)nIk+N@n!iG=g<8K$7 zj^j@_5yu>J9IkovT^#(m9dX@-C*#a>&&Q)LO+_7gjd3U=w8rPS_tmIcyu8aqRbT@@c2zyo>&TdCT<_kOr(=+lT|d{WBaqY(36C z^8zecIuC#Q729+A8Tj>|@4(()`4T$Qr*fpRsPQs*^tM@e#UbyP_zeRJO(Kzv&`{LIp9)nX(`x(d38MyO_*L?}lv}pr2ZrX_Y?nCj7 zFYk$KE;xa)oq>~2ITd$2`T|-o00-{b8<(E`L!9}`i!f>G0<>_kPfgtRm-BHv`~H-l zU4(wy?2mE7df~f2Jq;88aWZ~#^65DB)YI_CtM0^Vt_BbJ%8}@_@EQD&{9l}NE~YHj zH`qDO*ba{`zCB*pjt%QJphD{8RkUOQu5{SbUCZBdTh9Vz=E!;L3B4 z$C>9{fG6La!TxS?ewsIJLc^w}IF7i}5gWGsF1Eba6E!yY$th7sWe2QUI14k@S7J=x zy7(@?W)m((E1DK#!Lp7RHn_Z19!&O13KDAE7Q8y5l5rjsyA@r zPfx~)C!UT)op;93N9=$jk3IospM4g7b?#X><@h7fwR10=cIq*xXx3fIn0fT>(AJDs zAG!`dJ?Uip=!f6OJ#THmaXr-&sgZJ}V^3;@Px6)D^p(NT3A(C&GLv&J zQU}{n4)x?3{i%|Ea20V#HFRT%B#dREX^S|G6cE+4cV`IE&K`;8c*qmNEmQK?2_JeT z`@v3-awC~UFWAYS*(~GFf#jDu-0L~PQu;3Qaau7%O&Wdh=pV3Q^qxRF(g7 zNIg|*PljlOUx^vqw3A-&f|T2?ZS|Tp{w{Nm9z8H-%oud<-o1!jbAcAkx|6Is(ap`x z9_yls*SmLbY_rWa=-5#=tyW(E*EQ&O$|x{ut1wYb+R=)?&`b>oIDp zq1d!$DORlm1`h2{du?b~{xMdy)MN0#p8hCz*`oPaymU4C4jqB|b}nFRda+IQj&a?} zkFnsxC4RKj@R6g?g)8D#-8rS5#k|_;(swYrcj6+mZ3Et){V_(28i_i_vwqDoeE8vF zv{h8o?Yoc2&wdxHHfSME8e{4?Xe34q=z=*jKR`o!Ert#0gEcGHVZhK~Xj``w zOV$Hh4eH0(fwe0ZV@+#E3?J0XKcxC-{v3R?q5)ft9)hdSISa$T^Gkg106kR#STgSe zEM3)rVWY>OVa;;%>@x^mJJn#tlKJ@Xqcs>bY8=|vEig%mJ@VKb$uQYc@2YOV57TYS=*cp--;53)Z0u>sBnmhPFBk?#Bfb z8=EH#9lR@-a8dN}DhwI1HCooMMt!e-=+TKj*^eL2nStf28_>1)K(>7#)-V4M4d{X) z{d=Ny(>i=Gb3PZuTVuo0h4^IkdUWp54r5QB z(;zIE{Q>IwjzW))x)Pi_wq=XvVeuy`dE(^7-l)-(sX}XW1Ln_~g_i2>jIkS*ui1o=!v|pbq6JvAbS0`g zcf%--IsMvMPmfv0ar@z-kI+_Gi$Oz_>rOuTv^1>3^yza^-L*ISw#V$6yDnS^6P1RdmC^{yosn3#h{Q4J#I5E&F8%`$b=a(O8YiA?_skqdG4nVzO&(T!$sg*JIG&fzaQP zXaZ^@ZSm4I7{)v~=^TyvUh*^lIv;OzJRIlzU@u-MwXjcUhX)If6pph+w6hYGHJvbO z>v8B@&wk*s^a*piY}JNhQQpqJ8{EGOuDs|X?0M>6aKv_fcrn_dUiE^cWh3W=Idjoo z)fFQ~kMIwHTev`1?221|GPG#PG7K6%+;^1YyhQEFYP76dhMDsg`&jExU5_EdN1_kM zdMmHyK3?!4YI+VtPaePeb@?KWhxI)EMvWT5MHflbiTiDuH~3;6^r5iY=*L^J5A|`P z<=km*j#8rzbl&14N!@u-YxwfXHReQ7WL;Cf=M}QVjh#(suTEhh|BQ)pT72txYu>OD zGp5hL>V{@??KKcP?>G*dTa}m1SjOXR_S{9-T+Q5%n}ET+I--$0MoEyNX8%#m&@tPg zTgNJ_{^&!zH)9T(dBHty`|Z(>=LQc8=C^wDCcHi6ee@f#4f=CFR1AD`(Nu*svtGcJ zcfX2L&prp;s@nYZADsiVm|Xbk1GwhN1vvNDXP|RMJ5S^-rfZD(T%q%f=hJ8=GiF}u zKxZcBB&SxOy5{%~XS|1v^?fjA*Z|I>O+21wV!`5NsHp3PvEwJ8Zx3GJ>BqvJoS8rN z`Hc6cqUVq?7|^p5+o0cmbl^NblVfBdD(iY;!uH$wYhQ{_2cj-Mmdtz$A2)Ww_S=p@ zrN?YUqs8=!dGBN4x++Wxr^}o)$#5wo+MwRWSL?%>YPUBZH8cT7^vy{B%Yy}zOnVQbs z>K8eayrqoJW83Nnj>N!TU8vNGCG%%t?t;Z=Y3+diTaCrmBL~H^>uKZT4`*Y}{Dr*O z2l@{kiP0msLJh}&zDnr3t{&X7T{?c$|7x?k-xptuS9grnG^t45ZBp0{nmgw&3L%Q# zpm9ZGZY6m>4q5k+myRWeU}HpNLwQe0RxU_!Y@TQ6Fmi4SRFhsfcKnv%n|YO6qXe0x+|flX|=TJ zDFI46e1)o$l6<)bc|z1L-rIC%O$Q*e( zB%a8v=}xiee8=4hCOX=nN3g_zld7I$ti_V-Z>C*+k4T4}K;5lDK$gM3WYwaWcH-kH z^0+|Mf?fm33lz%b12!s}sF?>{n5)XIO@6rP5m^$8!N8bWxLDWskxA5K;|P4xA=auB z*;Mo!J_fznk5itw1%JQiE&TS1zhY#MTC~uH^60cE(L{77P=|;5P~%E~T0)Ne5~Rd;VP$MI}w<<1m}<#FfO zrOx{5d9UNoS3Qbz|9UaHGCqB>U7oB?dL-WQK?ETH7 zaoEmV`_m2GeO~nPz4-c1F2b4rco5$`Xp}!)Q>eOwxcuD*aqbmQ;7|Yl7kcSrl*Y2= zxQ}PNf@i0$z&F12Wz@E;!*$nOi7$Tt7Z}=|7c=ZfpBtDkwMmV1W}Hjn>SOkuX--W{ol^|4lk(Z;m%v{z^bMStodXCR<`%SrGNQ7x@zuXqpNsf zu=veK@bw>@h133aH-7Z_?R+ABf zb;iN?>x;Fx?e06U^YE@*{Iii9b6x6MaMqCr;Z^L6dvCb{otIC;H@|lx#_oFnI<;-Y z2k+0rA;+GLAADsGUZccCpgT|f&x1*0(F-!QO8rjE4RlkLAB}}jk$hZWXuK#VQRckp zZMz(+`k|Y0<}s?{A@ z$G>pfQ*UF?pniUSf8C%Rar!C8pnF9N9wYDWC*I^@d5FJ0`O%{J=(Ww~aM4-Ep@RLc zxk+vH<(6AKuJWQ;pt=^9`XqkVtXX*R#TPM}=lNat z+|P5M=D+fb0P7I-$jtLxiqH$(vfw>_QiFtsHuq%6To5Fe#+600JZ(|VUt5zQ%W{|6 z`zX_t7`}1H=N`;RWhgQ zALgl*xz#k$LBva?Z8vNtU5G|FqG>{`HBH zEJ3^cd#rK%(Wmr__SjM2${lOAr}3bR4UbhGpY8PRJR||#?bRnETBH_>e8uQ|TgdIQ z>2yGNTo84C3KXy8H82De4jb|%S!$5qdB8R}`@(b4l{9??Mn*i=t)}*{ZEUl~xQ~ma-^8o%nx0$XJ6tf=(+}V7A0IX>eJraFxY@tJ@dvJ4=O=)u4JyUcVpiY( zmk;?;KHBvA0xNMmDNk-s)RniKYmaC1)Sk$bWFl`YrBtSCb_6VhpcarRz6vSwUBs_( z5QV`%_!A+N3%Uv&O6Hm6-eP;(F>04X@QVvC#)TJLh(Dk6ZQOD9eQ0O`YI_XCk4`@y z7hH56{_w{?VMK>_@yOe&d2yjc}z`WV{?iPYPo2;&wuhQbg2cVy>J(oxBm`QvmnKlDbz zGM?-NTXpeCV925wXQ>9HuUT2xFWRQ3#AIQ9wi0$#8d#BR(Kgyp9P!Zt-(?e` zdf2R&!Y!!FXQrn^(u6_zWLvUL{o9zt~h9W)^d?jwa1cI+tOIGpe z;~9Z+sF#dtX#4J8s;dy*#sSj3XAkO#E+RJ@O~z79Ag|81d77jMibs}YoAPd}@<|u& z2i@IZC2}B2m~|~1wq41R$4SFizT`z;$Q3JLJmo}nRfC_wp%WY*!Tl&5(UPv>GB-Jo zV@;(Cml6oBN@a<)WZSK`O=9#P&0$rBwX7OUAokHa<(Yx`O4q184Gpc z?lTj@zmF>_na6RhMXe@8{fH*}@;oVAIV9?;464+N71zV9WwVgw9gmLTJWp^VO~;b+ zAdny-n-E!~XcKofk@CY=)+>%*($#wQ=*GXH%lJdE!;s!+(FsN2DZW(dQ;DXv z%W(U@ufX}|{2V|1!FTc7YaT%7nhsd>(#<&T*bA^?%}2QQ&zE8Tf@S#2`KRLkXJ;^Y zeex9Zk{>4~TS`bA*v<_}1R@ejpubq3@ydgEb5RF;c~c+H5pA57zX zHUe7@jHlD+Yiti+`xi8hI0T>Hl@|mYXZir-rT^TBfqNWhwJEyY77gdwuy!sB2ym=Ox9?4ryWFy1<+NQ3J;9 zw2Qw^5fLVEY;ip3_|PyC#N13^ zDNOUNQXMEFWHi=a+2+ulNd5pe$I3L#Do&OsAs^=p$Re}-Dqp96$s)B=O8jia-wsmT;w%{ zjxr@XWJAVtvk`8huAutXkei18jp}UICd_CMXHYdah4^t7nix zHj?WB|4W)6F^>dxvi01(_F1sf)vV5Z<+1o8#Dd8-ix{L5RfRm4A|^!_@(>V7;GT}s z&@3))#EAd|B8IGM4up92ElBL3BwjL>^C3GjnOYPel$!>CsS+ig!_IdUKMii4WF5Oe zMr_FbY|9`cQR>&=mUAue=EgRxYix~eQ{2fc=}^}GRZkWbn_mQz=qnn(JhQPN7@ zlc-E+ti_e6u1-U$)Q5yHXStwrV{CRG97DuwEN!xwXym!iBiQImf~&HnLIx!+I|=pO z305R;8NN&s*dM7hQjB9O=^aR_7PxlGN^Ykh?pQ{yWWZln_!OAL&227Y8%^@QfC(%W zDpSu|k+vDD?l=dCmT-yEj&ms7JJ!{px;A?VnhWt{E_houN0smyR_&I% z=v%cRUJ1&=lfNxX?PcEvVxxSxPver6Vtx{cn9vNahElGvs^gc4#+(Voj{Att@&$=ADfAb`a=|*#;e=>6-9-6!Y-#_vTXm8q>`WTqEXc^{AeF8V% zd?#Lb;$ED4<~ew8@f!cQG9e{{--~asQamYdY;?CDr;cMSI6ij6t`?*P!&Eq+8AS^LWPCSuJPUBKWo7-Da*|9fH`^A}<_taH5 z`uiv2>9-c3i|!zk|H-Omj2bc6pUU|YUPjc&3z;D!#-eHUTCCWxsaW(lEZY`HHbKgX ze2Sgt!z`IgW8zCU3lWcVW%w|#?q+dkip|Tp%BV&h(F@9nhgA`qARWV`N8Eu2P`uaWnpd>i8u_Y2$3}R63^|5wh(86 z#j{$HHP|L`k5>t1Ma_vqNKby%TVh*XWts~tV;w=za(t=g9Apr#t!P6TRAj+&R#wP7 zB|Qwdx`pf(Pz27&jH=T1^|25t$3Fo_-3L5Ne|Lyw{Fi%liQKA;VI5b>Cgv*?$08$S zTavD+>+4eWgdNGY{1YTP(a}TRiOLD5 zmw-8lcBlSKJ`{a?XEUxc6}v(WQ2%Q$qvX+_RY^iFbCj>$8h4RI`D$$lOK+7oyG3b%lCea*{P@FX1#A&+CsK1@peWl8a5TXj)G zDEdrormRe-SG;MNHmst9U41Amc4U$wO?=5k&WpC%Zs_K#b4MYBP{GcYZ`pKTxt+Ec z$AUK1ln-vM5w(oRxbVoc!uOqL(KLVvKFK-~#w|arW&0)vCk2-136;qpiN=kkKfVey zwTFls6V7GJUriyHSLjM!z6p}&J1%R~PF5urWXpz5%A4B4i&G_#VPvC;@ZiAov;8*x~Jx_==m8e1^ z9=PsL_}ks@;?LLo8(sCg4xVr~F8>gd-dl*T9CncJ!fsf#9+f?Z z2jJSPZorDQ3-Pn_|Bg#;y%IyJJJEZk?=hvuV@V1dN=Gg zwi$0sZ}M*y1d7*BtkChDe?&k~W^;}TkbPBI7GsYp{-JN<8vOM)zsI=m{R)SV@8fY( zT~p^psqVt<^VL&v_e0O(=70VgFJF5;{`<~K)HbfdrI+1`W6u5^M)m7KTa~D*(^J2J zwGC_0XV|W|=nuccrGNP+j@-E`uDbw*6VJYYlMWq$i+=G7%vr7{8Dv{(PaFp^Po#Ew)4U*x zs>)0GIVa|2Qz@go`A($7b!YynQUp<#Km?k>hzltSxx3* z&XpXu+z#&2C}(JjRa8+J7sYkl`FJob%_$m_)R&g(ZaZW3acCMjlu_)G5mEXktD5Az zG$HOM-SF+>lm46ld3ElvU~ue4Tmm2y_ExVq@YqQfjhHo%d|j> z-DjZmh!vKW&s%`nA@{Tzge2pTObVP~7PvrlbxPI?nPkJDgCqt~fOpfa8Co4}+JFCg2J)c@v*R@f-`N9B+z=MUKlh zi(Kc-mFj}nt1Qt%Mi7Te+&2i>Y$e81>YFg>Eo6iTFXz9YlO`K_MP2kV1Ez=9h$qpA zmIiU?Moql%AqYI`Aw!(+EE^M82Kvy1SP~#)Bo0%VE9HftI;*yuYz05}tw8kPi5hLm zawVQ1=h1kX4N=T;$r|6*XFfHtMqXpvGB2VD&HP-H>dsMCF_d^)$ax?2l6b0u)mZhznzym;5&8Pn;w z{*kvZ`H`FO&--6SO&u>3bcdKWM{ctRzP$G^yz%Or_|J8J#M5uiz-@m$4=0~|B3_$3 z8+ZQW512H4IReBIc+IcQh$J)wUeFArU|xQ5|v3OxoT@9F2cp|5r@8=L*bP z2aFrl4^t*jv$%d3tsf9~DCEtc5pM4j+RJaWi zNO{P43V|eKdMvQTjXa1Zkbb#b=4Wtr45p`w`;nD6U(+^Ajd_2K(jZ%s&)VTT`bJpt zTO21@FL<$)pjYqSUI6QlO|$?OXk6*>bNUk#Evj2v<99Rq8pih9Z;$cg$9rKd&|T-H zOP5lo0=;_mbX?KafS8wKoCE}aOW-&(u{^$LXN*fVM|Mj6ni?zzNh0fJed%~_JmM!Qv{0{|z5)%kf zUP+`{aWz17S<;n+E*pHu#(sFE!n#qhG9m@(5_kK2WT`HYd<;tA$$VUKv(%R3)?H}H zDmt0=RTBrXRI@dKc)oh~1ra&C$_kmVuiL>9JFkTqi`yqTA6$}`71g-~W}E8Xe78UY z(08LK>{x;vg0h+7k08iYn}bktMZ_=i)E33$rY2Eo#$5x+vzBeyj!^Mfu|Hkc^JgSOQlPKgVl-(G1fi z;|8$wU4dkS{zMAh5DA(z!;5Mei(i)qX!22vg_I3xM>!HjSN_@+NNR)5g`ztYi7HOo z3|)c{DwoE%tZAeQ52G5hqH5F2&cskZvhI1rcEVottavN~4NZx-nM7PhoW(KjzOWH* z#W+(AB%96AklN`fNwy3*mXPs5<~FD#$d&@o_!mf7CRxO%OA)p6Ekw7yRL^Y_&eHbv z$gjl*{b|Yo<}Tl?GOyv zb`Ko1`*^Hfz8njeeC%h=FIq4iFTTGN(Qy$lahHr|SDIgd@ImFs?fH6bw4( z7;HPB(m!HW8{JcC68mNCnoU@@b|YSW?h$;lxf=%c)8iqfuSQ8ws1Wrfo%qf9)nkx8 z)yLc<64^^M_q&pojHpnqL=up%aqRP$MYv<`!m8|%CozvN@>C=-m!^fWSfZz~n~njW z!`UHCYnI~aC!WHGOIBdjnhjXGWC{DXho`b{9D5q(KYcx}{m=7QwRSzn<{G^8#ND{; z#^-UuDJP&auN~aQ@|^MU;FWg3?oBl)GfhMkFVmJj#ZEG{5X5<^c6g085H0M!oEm`aUO6MjB*W&Nj*O zL30(cC5$z`Sbm+e(n!~7S0nUOu%lt?dBf{s;)=U=`M5r!Ju-W z#kT%}Tc5P(&r$TJPm0|+urK1Ah`f+jECh$5+-fX17LHRYXuKLMpgcsJ+MDP$OUD8M zLY+?m^@Z4Wv@hCAM7n8EyKh9Y3_Hp8f+mO?C~2IM7W25oLO^;3HIR_08GK9>YhLLk zBthkc7hZT#OH&hOFWZP={kr(Mw4VkKK1EN^xLC4uC2Fdx(797RlU?J4>2Xjw${2tu zrJ-F4lBkCQ`TCKDA9Bx^9_174B*%{P!||Drc%nkGsW?>2_E}rEW<6>+0A@g$zi8w` z@*%+nYocn{gt}VB$H}=)e~0XWLN>v1gtb&BPW!F}DaD@=#Sm4;pJlWQRqt%U6G{vh zl~J>WI9Mzvh+!yLs`f@tRFqsBofoDvP`}U89_J@&1??Rm}p#)fHYX8-!y)mQIblw zrL2lT_N7ZXmL(bGG=!q2UD(NW+1L2ib+L&_-ZDwfI1A^_xcr$Db(!SO_L7W*lSGm= zF$!+++{(a1*GQ1km@uSqohkP1SJsyvOSd7w{`i)Jk6*ru<0gVFWQ7aj&UI>o<3*Ywq{6i%FI_1qXDUUM&0xnd6};rd zb!9`XQ8Nlzv8pghs`RDM$+aKc8Utfsv{X61=SDwb> zlitGAw_n6lPdtIA9(x2!n(DDt{U^BdnUC?~@>U&RxFu?DYF}J;1~8r$Lboan?DVA-+Mo*`)`jiBYKyeKnba> z>OePBJGD7j$`I;1b;E$cgD{BOuz>@xX5QOa)qMvXb@29BIQ=#J`>HGP%(D|Q>BToN zc()^P%vbk9$Ijg`XwX0m95N6?2KK|$DKBI6USGxTTlYrizN64#>D##Hz6UUI;tS|B zVmJKg+lQl?ZR6R4e&aEO@4fyMI`rEGJC7TT?!9_o^6T&62WRMq(!iQe7UG>*3$gD3 zhoH8J3&crJ;KfNV;JGIs!CTWm!I3BY40~=fFn&<2_PL#ERcfQhUq0_?FPY%QO$kBl zHLe6DYEa7WqIvwMTG$JSc|h+>ls{RZoE5pLKeT|*7_$&%6bR)ixtMxu;&bS;{XQ5w zpcYTvdkgNl{~=78_zYf~@*%!++PTi8ubHZgZ>~rY zgIO#?I_i-eLFhQ=?i}%>2P78CA*-C3Bl$8Jb90QsIq$oqjLVWW%ehFn7K|NhtFdy$ z3Vig@M_%9PAO3U~Sw6Jz(~~i@NY-Cw=R3^y&$#rJjyK22bcOSiH4BF z2#--GlXX*cfO`zkiWYCayOnJ!F5(iCoK!6tc*JN;no(TQUO`xwP~ZaFv_i6LS?Vya z%A;jc3bJL}HbzG37w_GM#32dbHGoE*m>TjZzsBoudJG;fkEvLX0IK2zRpPkx+pSz=l6*pG!x`Jg6+qE)1` z9Tj@sc+)1H4A-HRF?8YD2ePy|}>D&5brP<&Tl`B(rYyT2yuHg8EuL<6c(PmP)j@HezE_ z8|rJSuzK|>)O6~Oo?ScndzGy%jkMW{E?qlE?Cnihv3wQky7oesdVR$sHB6=Wwi)#} z`2|&BD9@4Kly{bm4eQX1YIN95=CJEK>Ru72F0pXsf6+j;JQ4I9>? zvbGcBWjmnfk+);j$`xp8t3~m^`kE-t6tF9-?V-WHv92*)$~gn4GrkjnJZ?- z*Tyz(*wlnBT%0p&j-jzhKehsM&OYf}=f@bTS7p;J;#kxTB(>UYCN0LE8q7^?m8gy< z={XmYi!mgYcM_GRk5Ac;s6!^oVq985risaq>v3GE9yu0Sw!&}V>Jw&y{DyUFQO(@y z=2UxIGuEtL?H`wR>e?MWy4LwIl4^tgk+FH>My%qP;bj@R_3VQ#95;ScseBOPP)u6b3^GnP*XGkI_?39}{GE7g4O6DrXX>Dhj(Z^^lj#=`hXuE+VNn7*VGPI>WQU5AC z&adL6345lVY=(;R7CO>ZyM4Z3OycT7FF&Vw#+-$ytggj`u_I9bspm8cLYH)I%4L2| zbLB;Zmd3^{?lk8lXQhn0&W>FCf81$SVO5~TcSa?^wofAkT2b-EW^q*c?V?rbQnxV#+! z;0lG6GvewqwO6w473r%gF&j`_5+N(5O(!{vh)4T6m#H7)4h3Th_0Y3i8D8is4)>gC z0_)jCxr}gbE^MnVepzX<^dzLbXN4S_WNBMK)CZYL?i{CyDp)EOk+d@_`wDr} zv{PGH7b)mrOMM(|Pi2G=puP!5K_hA#e5qe;M>Uq}*WgKx`(!IbB%?wyL5y&f0rIjx zISDn}kv*MGRGQ{e`mPi*#>C^MvT$6`RF5Qvo$yg0WNnedR2ogT1s1mf*&?DhbL5Fy zxsrglB%Dgy76>O%ES>E92(3hqGIm95!dY;h;M z3f*H^%}S;6T;hc;M<+`QnP(G{H!hw{7d$N%1gzRdj$id0heMNUbu~J7>B0qD7cP8( z7S2bqSy^32dS`UuW`5T$sO1TyVRLUBbkHvGuZfbB4cgRPSX1AL@}2yLQ1MA35pS9X zJD{$<-alsZ1vzQb*Sn&kn&*XD&w-t~bmL;Q+6!j4r?MLL_3_S^Iks_JqU{=#`pT}RaDX(f&rocp6qlGUFf)z;QgI8OBS zw9}mhE7Jcv4?TbLdCt(X2(aCoyp5u%Di8dNZCUpLbe3~bkb0uBY zin3%U-WpdSUz$55t4*N1q?&B-?HE#yf)Rb>W0Nu_X)na%Q&v11kS0D~q~-CPnr_|D z(Z1C{U&DOz*nut{5?5 zgk@UNH-^H8VpJKM$!?#vkP$6ph^V!uv7)h`jx*6jvWQqLJPuW%jK`DmK-=QwaTZBX z@Y?v`hO8MkPN-q>6yUTsCSu82PKZ1xD>k>_y(zEZqt%UUu>QfTN`DxLw_bk&@6MWwwMX@zn876txbb4lA~W<>n_K8uTH|fcioS-KUl;?t?n{x#;hr?V&Uo* z%zyV4Jn)~#v0`I8Ct}4{iLM>1FpKfrd-nsF`|%3Qd~Y(At!+X3rd4?6#W%d@)j(}p zyBx2*`8Jx`IIuZ^EMG7K_uq9l9)0Ew|67+PJ9SuXMGIbk`f)t`_={Mv{9{ahb23^s za}mv>p{AkslyCc6MvE*CqxJ$xurn*ny!B#1{G@KijQi|g@!17K`_$%m^j{25< zBX(Pjw`~ZCSW22c$*XjG1Gg2+hMgQ!K&ciO!Tv}Qk(=fT>Dou~YpW!bv{U;?(5W=r zvYzf-Si=%U8G5-$8kyyKwn8iq$kYY{Nj~Wk4V#e%K`|Z@1XugmO0jUGT;`e1yz5oU z7fZ?TWU0l7PMSV9h~~c3AGfsoD*edw>Zt4@wO^D> z$}|t|_;V&(6Hec)Y_GqXCrRf`EJa``^Yl_wqG(eN{pUX+;v&3+ozM};irP@L(6&7W z$C-F$9E0VzDUamDwr!I?61yWtn*DizKg7 z^(}p}Z!ExfIa#!lqY{|L5xAv^5@h4bnbkQtI)B1N6OSU|>ENpFJqF+V+Ag^5x*O0$ zyVW%vFzvb9@KNj(xbynUF?rTf*17PNecD~U zd<7agF|Ap-6w6j`K*LAVaprF>15J7YHaL%pNq3Vw;LRs*!~Ks;!irB8;)?T6!nF@h zMrSULpT6s_`1#qt#Dh=0ifOMsjGrER9A=CEq3!Wg_$(UI6iH3;VEL+mG&Cm(C)GqPtC&|h#As$38dCD|P>_rL>f@nkV+(xTQffKlC z@}Br<+76v;H{vlan__Y2Tvm?KBbdN z{|HdLutE{pigDq5nkOHgvh2^#^d#9aq+I)AP&f@sS89=8(fQ6f%5kx((zr_URYaG| zU$lXiL~u@hCsslP+ZC|XO$145v61DSH^&sE#YLyEd6Fy3vDzxC<5L?nz$DLCpPwIl?Pp|Mz8Hz|M z+cJSXz5IM#*@y<(zIZB?L%qb8DceiAjbk|3R^5D!8Ohs}>y{zzzObD9C7r~R&0L0z zi;xRa>Pv2l(?o8B@SpP{g6wjWE#baNB%X9bHjmMK90=FZrTL_MUKYeBN8}Ngxcz!# zW*n&9SUmDTA@*~mQ#OMaI^i#Jp#0LSb%m4fF_`VdvEm^bcQj1nE=tnl63neF@~c<= zDw1iG*DS5^s86zo4YgXgEsZ;SnS};$Y`mXOn4<0ngGLqeD ztF3&aPe4nC>@WA3wwRZNM;nYNekmjw(Oc(b#s-KpcA1$@uZ%yP=6!_Z|K5T3K8YXGQVruZs6P z;wQM|l8f-eV}F7#?ll^3ygAuoRn^rPF@8UsdG0T8@gFY3`2MY!G5=$%oc9*)eq%MR zzV7ch>x|QJ-Z^JtL|=W>#7?WIMko4Hy95;#Rp?k>@A!IewIeS2{pC2}_+xSG501j> z1(UIK12FCBJFs@h=ke#iUW{Lyc@9qa-dEA3t`0S|z$^FNh`Qa6#ovDSOI&!#6*y?{ z226Tu9%JJoEagxQEAP+}rl!UqGvAEpHPIDhj?;aTL4E8p_&%wr^gcrxM1G4OesW(6 zJYI!tspz;xE6C+InI#K}uAL`|GB87u8jpedkfHyw2>gmN>H*TRQX)lrOC-KzDlFP& z0O=Y1UtlAFN=~TkWY{9d2?~!XH?+1Lo{x|3Ps~(?F%!im+=Xu`~}5PP_BIJTP4{l&wUXD z1%yh%TawjyD2bC6?<7Q>q@*ItecHaNnyZSjrJ{%}wQCC~#jd?0uuziCIk6ofq$`#{ zi*^QN`yc`P%Cw1^oVaFNMJM{L^Bxw6r{jK7xo!`89_Gn66Ac8kkHRisF9db7?2Pb+U3OM+!w+nYvD83 zGtN!EGda=JHJ`!x_PCI3;Ubqo(I#tjUA7keFs`+Q?qQe(^f3ilT((e zWv8iRJyWCa1er&0e@ETy#QOByT&6(?9ns3?WtYZ-S#H^XDhOLzm0ajEr(&h0 zL~5mNxQvSBeEcMOhELbE+}mPc3GAe7`~M%JAxeVWiwyJ?1nx#c(>7L)_f(XIgc^b={3HFCOcV9rCZGfZL}}=`jJi2 z4R*-uMH$U0&ZlFxQMX5e?jz~B-__RKPvKX3E@jL5VybGPRG45~H(wNoXzm4tNjj~V z=8xm)pj=0Fk8jEHC9sZUy{WF9X9d@V2R-o&G9XXV4T|lFrZHh*wa1Q1x_o=5xT5ja zRT+6!P9n!9Qzq=QpOsG13p)vqImFdyyOYniKl6d7z@pPsnI)ww!vw;@ZU>JKIn+DelN| z=-X1la~YL9?`0vqa~_0gAHImB^MdU9P1oA9q=4?Y*;cL#rF`lJ2^V%`HOu5O#+r`( z=o{xY@xqynNWnDgdA{Y*rMhhu4(b6Dg@^4V4~ z2Gc7azs{Ou%oPZeA`1@ynlzoLa}u&yC(85+0mmY``!xB(Cj-P;0W5%H0 zz#&}E^u*@M8Z=9u3uSMu?a*&Bog6nvUKD@$j&>O{YK*(+cYRY>D(nTVg($G)d?ZV> zrI%@%^C_E-QMb?e)4ZW}hi&aFpGxI3a>|@bULuCTEn`1E>TE|_ zP2X!)>Ek=`Gi3QKpnPTh=~cGi(?&9QB9J@>o=-kXrQ4}8;Z$Z3K$`maz%Lwz>CZln z2OfDCWA`}(J?pE}LR27c`mPlG&r=;Xx1e!jb2P~QLQ1figFtt9#!PETy_Tz{_!ty#b5t~Q@(!$7s+{{P7Mxl>22N|-?vk@RM*s?VdEM{ zk-cGq{=+@^o165DXn$oH?X8=9H@lMf!#7`v*1`MZZ&&;US6p%)dUvWq8_$@v9V@YJ z{d#wTeowe*!$uBV`lU|Cx>{_v-&b+ssb}E$6HdZKmtTjY58fV4dY&mGv(G#crab6l z4#ljo6?F2IcS9}-qDfVyoU^c)MG}u7{e04idI{uOgHI~<=Z>|3kQ1tUQPNt*C19Ee zX%Na@;(JghUg$(M9h#>5tYi_^ZI4>E>1-I{V`vK*tk1V6BbBz1_$<}lB1Y#{W$@!8 ztHeuoq;5Mdh`6qP5i{kDs3wIZYPul>skDis@oWL>niRm&F$wHQ1XU7IeuR1>&Oz?+ z%J@BhCAr*J{^%?lB<|x|Rh5!)x#c(t9yh+FZ(fphGf0p>iFs~Po$ZmnY4(}uNn4e` zXui9)h@ zl9N8ceZY6*j(+mkQ?+bgPRz$ql-yh-n)hs@2eW1jwOM{sABPxe>aWOI#1M=auR=&? z<3!GLfwt`1#tKly887JBk4hg0d}Y3KS=3XkEOUQT8EG$qG+xWtscm8piWR zV89hR7-c!>=DAeW&)!?S0H#aCfhF{N+?As0Fs6?|qqN-)_LDE~rj$D8_??eSHk z+M{tBw3ss@d$yrQD-J2US*cxSrz}U6kUZHA!D_P03lT1u^v|6B4msB$`Z{cj{^W#p zf8X0W8aHtaIX31kY=?u=nN&cUodh@9CSNWJNsm3*O+tC-WxnH6jb)5eQDwy3D3u=> z6%>5&l)I>_FO?qGwJVd?f<4BR{BR*&_zB2p_Tj8j$NBx#rm<9}YADZ20Y2d+BN^8g z%wqSy!5)0w=dz?HTGEsZ8`IL-;tuUMc314#cR6l(?h_n*;2z|W&JKIs8kfZOZwKO+jV?!es zxeeSllG{vLyBEcR!4^O%ZFG;^Nhpft}ULx*nY~c; z!*}8Bc`H0|cJ9>=qnZ}szSkC_rD+o$zx!@{vR+qC^wiwUg>V)9HRJwUZ^6Q)Yth!y z0XrYOFJ8Uxdb}}f1vaes828@)U#w|lyV;<94%rjaUz>#1j(sq4#BeUMoBgZs;#z{2 z?2$|5!4yInEwCub7spid2&6@SL|rCyqS2bb6gNL%r3;?y z%MiB0looVhNircWTxCEWKdBc=yh2_wmhM=G z9akifAk#zJSm7tEZy_$JM95^XzgTN`UzYd+u~g0NSMv%#+Osa)xlp`rze-IkvL`%v z`6o+RTaZJQNa5G*E-MMXd#KVTlzZAwc1nF&9PP_Fb z199?F2wOtdH4w3k2oYmu`n%CZBEw$DmfBH_C+Vg3`J^6fLtH|OCN5trBdaNP%Sta9 zlWegM$j60rO=mUtOewF*PDv}W7j$hlk=r0UiX$1xwj`H4$Z(W`gsQikW7$ay^^~5V z2@=64CDW2`VJz)|bn^w2ce~1tHRpw;W##WvAWBvj_c!tmrNyIjz8yGeVpw^zwvZfN@5C5lF1f*CKF|TQal9PkUhm?LfTl%{T6zXi84uU zkvH*5VT4~n(UqxfMGg`~t3=E6WSzFPkVwvRk+~Mndj8(OaRrh1t`i&=aT_SK1Dwmx zP)Sd>T~gm#PPe*EE0azQmP=8?PehtDg;7?*`Y z;*+PjIm*maY%Zddy{INoAE$ODpWcL1R#wa{;^*F`1K$G5V=KogTZ%`u?2|H-Q!|p~ zB0dGH(!PROG&ha`ktIxARV9FBp7*uoPbl&^zbsuPkZ8869r0rBB*fgTl6BfLkAj-# z;+#!L=W>OTn_0|{lnJpUORxA?N?vIfA6{-|9#+oJpAah=rQ(- zIAZUvxbYu1G@MMZSkUo=sSEHj2|-^`|r6O zZurZ^xaWb#&~wC2=-##lL$=!=TW>WGJMXkLuD|R;Jn+QJ7_-lz7{q*Tzx^(luGzWK6(O%)GfpH|GE;-zA+2C?6Mt}ezX$%AM!;EY-qJ^2>oIP=#wEZ{ao zRwG94bW&wovL8VVAqglhmh!8%OWb1KI|i$SnuIK%uNT<97^0c4(nMlmD}$R%f=F?W z6eb^ZEmSlbjJA~cstI*9>m(T>K}$U6jkqRwi%OQp{g0Fu_ujbLZ^x;B4J;)R$9(ve z3E7J=A|;857cvs?aS;g>GfS|@GKxX&q%TgUyGmY(R@hCx9HVJbb;-Il*e;Ky+y<*i zJ{5GDkBNex;?X|iX810c>;z99?1y#5z6DQu$|-&82^ZEa#tC;e=N3^u>h6D+q}WJ^ zhL0FaBAR9|>a)yaN%@FF7Bii`Sr#hXNk2YKpn`KpG8L_r#zAhALXv=wLfaKj;$cVe zXtTU=n_``{s0J=g`z#x03QZ(eMa}xAn3in?VzLO<^HFI&5kab?Xzh*!ZaM$C4MFn{ zJk_PLpJel~oa6CcGAbz-x{_B6v1Pjk%Enlg9n!ps5jw(yOkXC+hT0c0Sts(X`7F03 z>1P?2q2^B+)XyPFIZ>sjx&(xgtW9Z<9-Z3^As<^#F?ZH;V#0!#=jAfS<9z2Xl}W`Q zV`VlxFY_&i?MT-0s+Ho*eUokrhl+WjqeS@=8`4x2QSpa;$|)Xi(zAr?(icA{1XXQU zWgHW(+Hc||JHb?3Vbl3%@WGRzs0$(oZc%`RWQ#mICD%0ZqL6Iy=O(My(N$&HpPS@( zqMaF{&;CFD+(eU2b|wYgy3aHzz4rD@bgHlY?4O(1xV5;sdn0(AiQKZF2gGw4D?K5` zAZ??Z{<2X?(c^hK=!+Iot*D}Un}6I_S6l5n$V!$vRCrZ&jpNj_j$2xqs9xm<(o4Rk zvWhk~`_8o{ai@a24vbkpCe+wW9^J=Sbn7}EZ`Zk6hkdkU zC_Cq>5rnaUgv~{TVKM*z&ucSTYPhaIwU+IrmTAG^GC{)(a9-FB9 z;rjmc4!+o@UVyl6OD^3a=RQ-ymwGKA z{F&o%At~{QThADIY^RPXOA4|bm6Wr1wlArWP?DYB5pt0Md~u*vSD$XPki zhx<=DB~Lj5-4)U_CthxMDJoeD*#MR)hBRnNE6Ik9=y&PJPIfDC#h2S1Th`Bzc>>{K zHCq4w=H)RXh!BZ8DbfnB!rW)+xE3ueN0g*HK!r4juhmtnK~cMBzd;X!$nOmGuM)b<^(Ab826 zaqlH4+|}U4UWC-{qLqSZQTQ!Uv;F8(;>m0Y%EnfiViwc7B45lqc8xoOBm~l?yq6Bf@g82cECnG+oU;DoszO?HA03WbgSu!Zg(9wim|MjU+j&&kmggMN1=5Omq8?t9 zqwp)a;K-A(s0mV>MMRYLfkt4Fk25Jck3KI_(jm)Fj+dp+f1#^>(LP(xWk6stmZG0? zd;-bpY4GjMP3C+scM;cnHSy;rT!8sp#x1XR1sPYF|J)=N&8yeo;rCbIfd9uo0t!U` ze=VBZJg_928!f!lHKmCu?8W3op8QcSQY)Z#s1k_Kt_G!vk}U~3Ha~ic^|&$#-!^HC zK)qNnl|VlA%2z)Ah*`Q!kS9a(qunyZxI1uxy?P<8``3-A=+zG$D_il#^OG?Ch?8*A z(FdWekqde1<;7yw_oHX%p_Ie$BYO=CUd8YK@gPQzAC0D!AL8Z7b8*V=ufV=r_eN7o zt79+XQzsfx4&5q3iZ7Kx<=!NZL?I%U_DW1b1(GNodV;j4AEi75ZP2Bqn9tlcB3UEs zSX3nux7j`KF4I7bp&VmE5M{}J0YvS~V&yX2l-o=uM6Mld=y0>A6rUjb3yEaIZAfJi zWyFxBg@sL7h%#g)!MeqXr?w`l%iyt4E@(O|WQl(0F?K~J_r#)hn0v_&@g3JPVcD66Gd!$Q>a;v=6! zNBl`{c*c;ls-$;w7HY$dKM8YUruY+#YpmoJhRod}a-wXUgh1zp9ms#xeF;9k)Ln zo8{xC%wic5V2K!PYyxYvtua+G2Vrw_eD^xqklT?u!EgDOPqjsb;@FIi1IFWvpWnk@iRm|L zXIyaEU$EC`E|_Ug7QB-^`c}>qZ&`G*%3aih%=q2jkWLsykV_!O8bc^3BTR|4r3&fLREA*97C*D1vn z5>{6wF|u6ND?oB(y2h1bme%n>9X87aiyRZ;t}7*Mn|13j<}$mbN|er-P;MceZG>nR z*YYLP1eWp`2tDr;&p9d}^aRBnrDC6QAaXYBm`#YWsEt)o3t2&u_n0pclU#sfbeZI` z4?;{4W%ZaW3S9%)(h2(|AKGNf>j~;v$GHek8LU^Tx-FKsPQ>bv%47mf1Qx=iXB}2- zqQv&z)+EcF`P#CMYr*@!Amk}2os6gPW+>COkHoWe@feVFbJ!&$%8*M{Cf;>B3cQg2 zbd0R#JXuF&KH;)(-&p0-dSTP@bfkXxbbs4gs!A?^IzEO7d9j#eB7gFy_J>YBzPwk? zgq5`+qbhQrl{5kmKOQMtfb&}9IdsB@=q33rHG^kazZ7rDUj}KoJw_5v$Wn!VBuxUA zQyZLfl5%?t;<3p3VNSb}P@bDDXL-E{wq24lq`D+BC+u@yE?TCisLJOTm#i0l{s&k* zc1bQ|V+$>}x7;T|_3|;WWiGZ9&M6c<+Yca?Y)3{jluIOe`{GOEA&G9`rVLk~g>1Iu znlXWV72=kWEMs#cLNYey-oce=*r^tIQMC_k!bLDUWV4R7jjH{WOYwO(mW69y=#h|P{H#Vf zgmvkZL$qZ}=+Ms9+r~9(@yL5Cuz%UtGt8s`Ddk(#s>hw?574Q;?tk2ArmS?NT-q5F zimvXo2-H=t?xd-w@&ToBrzG36XsSy*nJD65>GX+C1@WclhlFcg$_%;TWLT1Qe{{;4 z??jWHzh`L^+{aQjq{jbK0082INklh1>;C96Vq<;Mm2j3w^$D-P*IZWNd&C&kH^>BJQ;m-?iK zQDWW;bg`h1xuoyAC93ZJUK4!e`V}aJ*#5RQ@R4@ufHwy%VIjP&<$f`ISX(q-{=LE%HK-s6TFUPLf~8 zM2v-UqdUCzNs{`(AD6N$mydC+99v0FL(X{-PkvPoS!bJg{{F4Ue72*ya?N%*F>EL~ zsr`~;Nmd+_+H8R~BL5Qf4~6*lN9c^-Rwb{7$UAZC)1U7A#rSeHyHtcBr&8@Ay%;Ns zLpm~HS(#6M6btt;c3EmHs3zOC8cy=ZmfE5}X;+$#T^0i5%hAw2JyPD5DaJ98a-rNP z)*`o(O)-TDXiRnizo_~HsKaBCLLeVU!f4X z8e`EUIdnAMr))?l{0Mb>8J`Xs`AzMUFSSAA#>Xe%6ndryz(Pa0&5I0&nMB>j>T;cKmJ=`yCa|a zF{jdx+aVn)(4hNMELJ?F*ie!aYBAQ05TlF^X-CW)>FZw=9=s8++u%-(yg6q1p+m*% z98gGkwwT1(mN?(0_L5c_6Vc9yF#0X>7O})vEU6J z{@M@qog?Qe)ybAmwY@YZ)Eny8EYG?aP6~+*Qu3k^Nq%gLTf`FWG|&39Ehp)?lVr3) zbC!4{iKg~N^0}Gl+$ccxgJl$gW0Z(=BA*@;6p@%b#JCh8K{nSf+ZZR5*6 zNvopK_U2}{E#GM#KXwE<>HD#gq5Ztx6$sDg%;HXS?&42FOt4Yfj zz_?Fw=L0Ve-q3f%tZLwDQQO$qhD{sWpnucSq>^KcK`nXN;+AYiJn|uXlw--hAhh`p zUK)7C(bPnowj)~Z6&#I)|D;bxIlpe35RDeTH6R4eH%m|265?B?bikyP8C1GX#0R8_ z+{=DCNM&Dr6?b_g5&5^YZK@z5*{E91xhwdIVL9$;)N*dW5N@<@8uz7~#m?hSsBrEr z9#z{YgrRO-!&4TNs!IBXA!tVwXSRL^^r+RKy`*$>h80*!@)kr+)S z-vTP768+;`$%=Kg3#%5D4VT;zw@EWpY8N(3vcc2%i9S#L<;0Me_=P-a;>QA8#Nb;l zp_<}yj@9pl9N)1JQ4FN2Zh0cPgSdI>v9c^lUbuED$>J6tH7kaQ!?s8&@}7-big?m@ z^ujYcDJotQxh0ELxA#&R5{P{s>pnPwq+h{-My z#u7d#C%$}3h^3`d8TmDXTR@RxnKwV|cwuOqd*_!pD?+7XzapqqU4_9GS#Y0L9=UxX zD_~aL))FOjVy6-3@kbjXg%i}wo1-(G3!oj=y~oDqIM-y z8S#a%^d+trWsF=_ zWgoUFkf7fop{g5^HM9?&!A?F4F|O!`Tg;h>k-%XIa?FCPkhcsnAdPa_EkRBSGzA*q z1*I|B6p!38*|Ne&;npR0>JMTbAbiV@STSG%)L%)#g;+ibSciTKmx)FQUX;Phah7;# zXMPM-0!j9lI>h!>4K%h?&%7dNZlZe=&qBe{&Sip}&w`ffF61OZ_9=Q$OZ&)K)Flvd zVMuLEoJ1*s)y$1H3iC;bka>CXPRWm2;+aoE&ROunV$v#=F+-RqFg-H`1uw>!uRJrz zCTX$gDS>Tj5)hB5Hc4129p6T2(7ZyO_SC?@w$O8penK|5g_;azVM1645U$0kAex$T znuS=ZF1z6|>OMfNoXwI;#C@8^p4hoGKN~HKlb_m{c^-ExQ`$q9yTW#sOLQ@;VO+#i zq`C^P1*m6FJR^JlWxdq@;-!&iIZ}clLKG~s`-o5woX9Wb97_Ts?u*=+ehE}AO33mDYACtq?jsJYp4gy2Ojg~3|b%t9hZyOVqhqNsCc z`4XkTl)o^gNaK7Xa7}vVX%~7Pb3(*)JzI=YdYO=Uwqde%!IYiS@heLB6Po=ca?nyG zH7$U&;uDTU%09JInQaO@7EMU`%}m-T;!cJAX-kEV7j2xErJGKRMgJEz1(H({PW;v` zj#uSg-b5tDg$1maIojEbugn5uu2c&UP5!;M6i6TmnZlj{jSa3|Gw2sr9P(8 zft38lk?tgjr^(58mPL*c88Iaj8Br{X-8}n>xE-JP)b|y-#9108(s!!WMBPeo??wgN6xb^Q%Zg616!r4-h|VFjxpBV z=Zakk(_39h|85I6`!p7GA5V#972761j9JdQM7`-%rX!k8%+gaY$ew7Dbbe@5FDG{TAHSo(XjGN!y}OiDtcX{=bE?amiL;%gHgHtf#1i#BJUB1BGtDbM0b zmvq{6U3}Wk`SUnZ7y`*EKH0NPwL_)$%1Q9DfJbI~TtYuv;@HQVjy<~F<0;@O$es7F2=qv-O*m*~;} zw?Ih0CuVw94;8kNWidyQ=y{pMXa{lmVclsJU8=$pA{~V+o|$$eG{tV+@Spk8kK-lf z%sgu7;Int9EHlk$dJ|F*yAa zCrvq%u2{AqJ;`R9R*A9ZF-6F+sAhknGfd|{#}}w~F`gNR@RnQ zg*#iZEp5>jsoAG^(j!Z_yHvRPorv>jyWvZ1he)r3lJxlIIp3a*{i_qG*7-%3PNA3oD)S<0x?)fs7%LO z9AS<@Rkw?QdirE8#EqC!di6?mfziTds!LZO1w(3k!nL{0Su?WIcnwY zOewbg+z#6m&FxcN8!fQ^(}#7jUZS!m5y{z}w&YJV@kKCCeq~>q@N~b0Z}H;Ji1dO+ zlIz}!rt#OI(s+(P^I{^iHPhrqZX?8~TV9*O5;IAgS7>VEp6`f>NM!{o^p}zb2bD1^ zyCgB1Mr|V|8sa1SVzjtf_~DF(en5-kdY^Q4j+iPrNO zPh0e)Ww}LP$d}4c5x7h{7l|iZ&LcM$q}!Nmh!#ms@@A$jfzgnWnnM+hNa&{gd#uQy z1S1C11-TT+h8&aTLnj|UtZyOjdLAnTA$BfY{3udr2^342jD=WN4zj!yh(rw8eUi&M zMeem1Pa7-Av=G@-dtFytxgEq=BZPueLfbBbZJta@vSeBeRnojZ*LAJ9^OS^q#0tGLj;-%m`Mv|;cyAX{p;wlZ&w}J3wKjIPBOT37IGFFMU6me0{ z7s_G8?-*yvPNG|tkjJ3H^wQ0`$uvRS@*KELlHtn{8P5>3K!a|5ZRz;Yg@-9Da+^g8 z*{~=3s>S?T2E}p9EmU(YTM9h4(S}74CwZf7nJ?vno9b2}V&4Kwr#(UB%(qCiPtD4b z_M6m$rWi`NbnVwA=}A6Rw2v(o(}EZSb}1bxvGn{QOJ;-(+cH0N451ikj;%~5AR(!L zT(hGRL<}Jpxh(->`0R6m*!JRfSrv8JadVVCkAB^zGHnwtR)3gIcr~ma2)4u% zFqFb-Hll{5>P^jh9(8InZRGD3*49;_twsNmsH-wjBrOn5U{zO*4oT|LbD5nB0(X3_ zCp(2mP;)hx$y|a$I3VY(OkWUvohk&QmL-bi9AsI<&F3NIH zUv6Bx5=|ZI(W8sTCyhA&y5^ISFy}q1IzFN<9uG7wxNEBEx3L}7_3R__f~)`PZ&6<* zpK*Za1V??tx)o@z=!~wN>*zcDiI>c$ev~9j8;XNHdFMVLi*E^}76A)qL1h(fjSX14 zsRcc|caNNin4qGHd1af@r6k*-ACYq4Q7)plAx}1GiCWlB2)BeXb`53!pp{Tv&kF<{ zoBGEhfyQ+$ZP7<-o1ULu!SPyw^n2I>6ob;%MmzCLaZYyh=dnf8idp?2Jy~vS(p`PY zbwHJlkx04!C`sS(&ta?doKahW=4R?J-&Hk~PvfeYv9{>nLsjvvgX7bKb@U{fOtmSt zrLKA zD0wbfkeu)M3qCW}rCVMvATv}-FUDG-T+S{p1$3g^l}^TFB*zhPrZKqk`7cCDkkU{b z+iH{BlIz>O7i89D zqC|^XCFWOdg<{=1Z0RlG~DKMJXWes@a^=xfMSIEPqaORk9%!*(11* zotL2J9|BfhL}=O6h*`@vVtD#TKtZuMAjB^SO9N%`$N$Ga0#Y{FFM;aT6Uqu@>)O}g znt$AYngOHHzh^xMWCc36EyeHucpZjryAyiwq}_oh*dc2Z4bR?kCsuYE zgh9PK(N_iPE8Fq(L;uBEbits$-O;@9W8C!TKjEf(AH-8nJ%y*Aeg;oH{Tgce55SC< zordmlYi_`!&%A`@ zy8almRbL;o(G12=*M=MZ_7C(Pvord1tH!K1C*taV{TmNH{Ss>XY=sendZvp}UTC8M zcU<=`EN$z9QA2u>9&zYLX_c+(aQk)t#Lc(gi$@=M9J7`-V)&@hycny*YyZ6pm)-aZ zzWmkwP{HxJdi5H%zn+I_sn5J%WzHN|d0(c5T|QZP{HSwJah@1-0r$KZUDqxCw91_>lDq-<^EnzjtH7@&@!B z_XS*X{z>Rw!$$MuTgwHi?qJq)F(up)rNu(fD^SBlchiQ|SiedC1SpPpRb1qUUNskV zqE?coe+Kjdm}j?|8ro*t6}l2yLwk~|CS7{r7lP=4lfci{3{CSt#@9F6X)r{H&g{3q5nOP%`ERX6I+=SxrBjfE>3=(}WB6OaA! zB0}v{pNOjkh;zU;I0uv|b+qmZN{5RFCQ-a9#+T{(2gdNg_@w8BJD7*ai`u784n&kS z{RxYFDF)@Nnle8A=uZpM8p=zrO8>kl%c=8q(CM26bEmzDg)Lq1ts}pKJ;wFMl^30X z|GqGr?W*)YEY?Y%v8oRoi0@#fc9W<6lI6w?Yq54iBYo=bHR-k0^hO_)Ri1MmeDEj+ zH;Z;UwBXUZZo{gYUg%cYf>$2D3q8jljw6pe62m*M!Eeqw3-2yi!-FRJS$8mHtB!3} z&U9kgxNa318k^%no9*@(Q+_GuSxfF5b0s>aysLXXPPpk)1hu6;-x}r4ZKrHK{Z#m` zCnIkf-)eJ5nQm*w>b2|4@j^lE;+X8PY7Wjg{cL>Pp+CO#wQpj_@q@9kp@BYSM`Jj} z$1=yDoK>=q+?R~Sjl!uh9SJ_85aXv!F>K&OpzoEf zT(KNIhU|cE9{F`tEP4*VyZi<;@mOzMyA+Q;ISJeB`$ZhG$JV&{cR$B-(^t?&I!0?M zu;QIZ@Wgb^1$}BT`H7qG=j$KDg#8Z3A^Y#f1@0!NMq{p~7Wm+e$8hzPS7FBdWlC3C z^v1+q(Y67To}Y*jyC06Dj`}9%PrL~i|Mey`a{8FC|F`k0U;My#PC8dC#yO|{0qb?F zDGs$oX1H^az?Ql5ur;o`NFor=?I%bp>YArQ&)sEEEfr#`v_Kgi4I~nJfe8ZpbW|bE zoo&ROtt^=#V=kGak_W`^UAG{|R%WGWPRWYV`2J=BI}tzpyV zC}+uPp_hR5uu|G0FoF}bWkv+*Bb#8`giBxxzr-_L^K!u~ml0T|MD)dB!UJ?Z@=WAf zK7YDKw9uqX#wDUH%NWEjgv&v~B{AvPl7v$%EDYx5ypV4^D;lJi{0hQE%%OyAr-URh zztAdy$azlWIoVb2TvEPREkuc9I{p)R}j1p`Wc3P+}P^eI+5|wrD>F7Ku`T#}sA#y=d1< zW_6CxIVyiEKz*(Mm+;os?wbmEPS6FR*AvvSZm8In+LR7|6LM(gaUbQUfW*?LSuD%* zPbm5$!>8plD423c@mhpiku&8W>scq^guL#w3U^j#nI*EGzb#M(`8ZWsexvx)Po)$@c}!7Dlu#nv}`24>Qxn}+^`sv-u?&& z9k<7u&h!lBc~f7V_UF)!H-c-CfYZXR~=!=D1 z{5|;46L{zS4>4lGHeBesC2o=0wqW)&4BqXl=(%<(Du?fZUAFEIG_AouFZ&}7Jn7H) z#$Kba!;Ta1;B7af|IYhiWS=hn7+d+OW!z6bcr!-r{cVgM&^6s@u0UJUI!t+aBA$Bo zCCpvC8bgK-^@3;3!uRpY2cMvQ^*lWE@UvLmQj4L3`!W{Y8LhzkuRMdto|uT0OK#LS;~KpD^kaDLm8q!cR)^UyOh)a1A?QjQZJSn`H}Tb}Xs_?ae0DGH=nK>zGpD?S z4L!HTPrq>p#&5R^>OYx+2j6SJ5r^!A58r*UV0N7+Ph%* z;9fqkH0HDbUAtsD?tbW1{NVT#dC}E`7aqO~+kNvw9JcFF?7Zi`nD+dg*w|w{b{#j+ zAIDF9`6)c{^b7c8LkA2SI>286c!w86%{_L&?%NOJBE17jY%)OhQ%v4VepVa)a8P|Lo;4sj-HwLB0gT-j^QH*a}id7k2n?|f9y%j zSg;!X1`I|=E|hig)wpso9=z{9yglna|-TZPO2 zcqYbfH4Njo-vPr1^g%1fQw?oTdEs$9`OHgL(O88cL;CXqvI5gyn}~I-b(r(^^LXmH zSJ2R*6GjZ}jTN)s!3{Uxj+qOWqNQ;&`ivNa`LDl@E)({`_#xde`@MIt^?}Erdg;^X zI_3-5Zg_9B@-n9Xu%Q?^ayYggJ_H}U@(9|79)xdxVFwHvJOoeQ_D}TM^II6uQD48{ z!ND=EuPpT%FdP%M8_hl%f(b)vaofW$;&X?75uI!5u#oPP!Ta3r=KJsJc0_3>9zDw)5QRSR*; zy$_&$T`LCecmQ_WcCeqN?m3M8RN1^ znlY#|@Ywygeb07UYUvGK8hG=ak7fK7U@JO=*ijhp$JJKYJuv6 z6(sLCY#E{}21&|Z7Lh$2lgWaK8F!kEu_Th~rMWxn2Sav+1Ut#76q@*jE;rTnLo7k* z*W@fE8->A(+)xgm+NB%>D_Uf-c2P6cL}4rw%k=z}7UAKGJBDIgo8w&LUFLZUT3|u5 zZf1FxxGtO>pUYfh%%W+`gsgIBq_C0iu&GaqxKuYU)w#)1uv8C-e&80JZrsu$NwZ8g znQ~BFC0B6XX~ZJ=&}-+8m!u z1Vub&(r?koQ(xv*?@sK>-i!pj>pWWY+*-!&9rT|Szc2=%fCHQ zMq;ifJCV=u>z0Wx(a;E6sm)R6<~3B@byr{8Rdr?a{*aBBI%E&>+1>sjd{E40L z%=cIhVvvHao>UA;I-7QBYv~ir6|2|z24vi67NZ3JYwcUyY0kv*3xRUMa@>$|_dh|A zFxn91uIvtjnx{?Uj{S;}+wG3VWpnY#>dk1|uoSOwA$8obU*SS(8a9%@YVm9=U)KdY zZQmI!OWwwxuD=JZ^!?EXFW`^AIv@8x_cj-8EAfx>PQo)Y8_>D764Rf#9T#5mPpoQc z#f(=T$0L*8^c_px$^BsBo%q#7f5y`FtysJGef;vY+V8gt(aMP`iyIt)~OK|Bq zKf|+c&V_CwzVzSg@Wz5QSoFpt`0bysLx-9gEaM{Mqjmm`R%#d9!^O(32Ynr1+-(#W z9`P5AN247%2( zPPz-{opBc4n7tBp6)kw+wtr#z(ncR(6)kIV>+LsU@v2Q|W&WRd;z=&ixDZ}39l!qd zrTBOQ55)Ec+;rImxb@N3QQ5u`58U_{Typ7^Y=5hHH~#4&Joxeqv^OwsXPtrfm$&&2 zX0*c%A(YxD=%7y)D&s3aPd@ShRyP6b7rl$iet$XprX3wQ2|Rq`CHTt?4>KNK1WkJ# z3qEe~9rDU5-Cb_NAI~`xAFOOe$IT7+*QLL~OVgL|0%bMco3X%ypV{-E*Im)YA52C? z@9`MYGx|yS^}k3G)~);mE7o;D|Gs^FH~aO6uEOQlKMMUXz!NuKit8SD#S@8|BAbeO z@*~&cva9YwI~gzD@n>9l?@JtGz}%_NB^hY!uD}lp=M`)uQ43Oi1wrk7;qE`-A9p+Cr%c+1Jp)Cn>JM98)uz|gU0v8rlxl6aoBh9 zxg7_@cZLb>P0F@5x1g~_$IMdP^W+CO=<^41K}tKFdgHL&hvD(3C!>S!6cc#qFTHji z_zfF*F}v&|+;ZDv*z=HYqF24x>|3^xhYlC1?f7Kr8Vu^w*LNo>IioM1{|;VT-V0yf zsWTS8JqfMdM{y!}3zuDb8SbC>E*J*$TLFEu?D2c9Mcv4~u=}_{{{ER9dnl$Dq6M4L zxM>5Ld2+e;;is|N=MP4A>VEj{v-sD2PoR#+x&Nq1iwCw_V<{Gcp3+^)q(%h|8#5?i zJL6_tMD7%W&pr`Bro|?GeZM%!qQ!(CZ0}h2;|fy@qJ@a|p_}b%ocfDKUf?I5H}Q2` zuwqIS)?ln|k>27v0Jc?rXd~hYn(QbGmN%rl>h_M})7^{Aqk+Po8z@vf>9EW^*Houa zRIO{ttjAiJWrK8NF20>j$hVjXx!vZb^H9lxy(LIAwNo`WI_U0m8`2#*(Nqu1*2PyB zCD!Jonrvy_$R_&(jeX3eKF@r!c+YxSHEyu0Gwrt$FQ=V)g z2Vuq3*OKEFcgRzmI9zG&!})6~>TbCn$RJNQzoANzjwXHHYhyS}n~#m@ysCKJ_GCe10O{ ze{U)l%$tjk7B9rYg&$(h>{)nk>N|LT(nLJ>%+q-1ZO+kbqxAJ*r*0alE=UC-<%U~X z_^y`;5z-vuz>;9L<+5B^<1a8z7p`QPgp=lDF@eUbs?I0b{%?WA_IQ?_<~-GX+$r~F zlR&!hAf#;OYA$TM=^vSQH{<3(h`;ymKzZg-7pf`2~{l?;iGf%}y zr=N}E4jYZfUw9L3>lfl5*FJ#rue}{VJN_7)`>Wqz?+Jss0H8r05c*0$Jl08GxCmsu z1Ea3*IT&Yfp>*Vz55?i%Jq|TXCSk^hEAio!r||0HTKxH{%W&L}kHsG^{J9sUHMRAa zHt8O`wYncJ{p0yK@#J6NtncoCYw5d%i(>mo<3@L8moNALFTVOF?z#0!-2Ci99QB<; zQN?up>{plI2jBi04n6z`w5^$knM+q;;oFbk+J|Q1`dj{qlaBil&OPru>^zK%d75ip zw+Mea>jd;Z?3eiU@rPs6st+-J?h+jGKazPS4kESt{@vuh{e&(~am6OR26F249|y!*s$ zSj<(fCllss!?HQ}_ua4HXMgycWv;mP@0fh+6_~la6}ukzEu4GqFYtv!zlhK6F$$BO zeTLpz@#=GLdExofpZpZRIQ>WH*}4{gzVJeP_1x=m=1D)o@BVlx+84cs_vb9blXu^Q zx}AT3OU^j~$Nl7FociO#d2!R^iA8;;W3-(Ex_ZbixcRzEG2_8M<6GbSKK}E}WNc>M zSIv73SKj?TF2DM6oN(N+`0a&f;Pv~j!%_~+4veMWcAvvpCm+i(a~6Jk`r)|is_W5l z#C9CxyI`vw_QkQ^{W1o0uSe$|J<*XDYRaP)(i-Y{;`Ctk_^I#@5ud#IO7z(IE7)^v z4==2BTx_@N_L%klYracNBM#hSqHzVT|NYPLqaXehFMreld+$7!4Wc>n^kdDAyvVrc zs^4OA+x9r>;IU|=F@53Yd0x=%eAu`A)sc@DEWzw4Z{o?<-^Iu=Bk|V3m83&svE(ONy zkamL2{K{Zj{v}&E*YYJVs#=#ZO5AcR=qf<^q6eH<2DO?jUW#glA`ErKh z9GCp+&!_B5AXyp`TR+bd!!Ef~y#5e`yW)?Ym<0J%#P(0nU7|pxDNM1;BC#Z+J92?U zyBu>OiK1K^QsIp7?eAYINsJ-eEI)UV%a{U}gjy!4yl~7Pjr&nr4o~$8|DIF+qZaw_ zW^uPJSyCL?rUNoP{tYl}mKKN6N0w0^v2GRdm_IKDWJ}^HW*3e_eXE27U2cWhvV^3o zm{QI>{?fS5i($EzzmR095Nt$#SsK(fX{DS5(c?`2(C4=CWjE#%lVMTaUh2zMQuM$2 z$(zMUbPyUl=DKQ|3WRiLn$B#?xa6E&=8mnBZ3}XfuIo`1U4?A=BX$W$lw}eNzY<8Y z+UXxRMG?rJ#<@QwW1ol~ZHlbq{ARzhrC9YCH3vaiAG2-```ff=4~3)DIYoMUd7@Ig z!l3y1>j9D%)%K|qIa6Qd*f}C7+t9%E${TOsl~-QDM<0KT&Rx1-yY05aAzV9r=cuFb zo$q`HhaP$;w%>kxbne_4ix)4(JMX-M*Is`e>({S$8x4+AUfFJz^5J8NrQ=j=D%duS zbWyJ!Be%fg{s1Y&Y|8FVh zgh5ny?uBiJ_r-hfe}DzN0vfsXHe8MM!MI+V@!s@#n6uy$cJTPJX2u|CZ>zw-0Ygwj zMkDK8I(B5@+tIXoDb{uAhtY$2qoH{-Pu^Tu_Udi@7VxZ#J`eI{qJ2voSK4GVw zIk;w_s_!_A=-7n0^A_WcH)rA--~RztESQZ|%NC-gzB~GL?SkFDcq9h4O~KcX{2{J> z@HKxg)Gd|q|B=58`aW<)1yA1er(vU^*Ve*CNp~*c3N>Xcfg0$Fo(@ofxoO6B z6Fs-}OPAoix1PoEM<0!EfA@R1^!i7zfs5EC-S*4vU@7s%Gv3C3?z;zX&uhTR7yKUk zZqpZ=TQ=a5Gf%`XFSr=@{`X<5T-D@--_k|%F@zUO-Kf64vDJ%Unbh6!m+rj|FRvMi z-yFLi^SBwcJxAimuYC^xzThV~0X?C!il)*s%!Al!zw@mLB3dNi zWn)u2dW_l)m;CEi{PMUj;r^?BgS(!Yj<%+?Xl5Ur@%`^b8-9K<7OdNVhK*eKS9QX; zQ6o4eXq)4)%b?-t)cOfFFuBdliSn|EKK0cgeg7>^?DCiW3X2I`m_F9pylE94nfL(? zKH_uW&@^8|tyj0cXl!ZZajtQe2LpBL`rs$O`Wx=N?*aV&w8QYXi++O{OW9{Nm8fpt zfa`wubG-CPPh4>R&(M|QMiXq~h81{w=3?x(*N(m@)x~MAt+v4_r=5&%eDxbR_ZP?G z-It%oidFOR&pTejFMf9(dQz^ssv7kjJArFy8Y*i855^81d*Zx*-iiAkd<++ycsOqV z>mMjZBK3Xk+l?6}CKSTb6s$b#m~8?~`xPOOSL-id=~8Drfr0 zYYNPnKD-m#KXTJN?DD?UkHY2?x^wJLdhzj%#Ud{8ui?+$g_ZwDQ4F!9`X^F zsI0Rz-7M`A&5{X{aqYuq$e3nb`pf}v1`?`Txeb?+HBX!*<6}w{*2s_k3w|!M=~N^r zm$9Wnu3*`d&L^_1x^_7~#Eq0PCQvTQ+ZT{3c0g`+L@}GSg`^i%iiV8$+$GLu`ZnaW zNrENow&PrhR%n{%!t#PNkW^S!5TzwbyVyI|jMHrl$nIU(T(aW@7$KXrLZOxRv}S(T zbKhkVE2?fOmzGN*TibDjf}~UP41r5C>jLk;|Gu}Hni@=)Fadk-y|)+5BSwtCfB^%% z2^Vd@{r1DSapO>3U5yztW>~MSHO_Ma?S;#4j5|h>jxW>FUiHv$guZZE{{ZrRbu0Z$Ao#k0tu1Oi8MShix5xf_V%o$<@WT5Gu-9%oo4enE zd*GRSZo;%>o3YnUF*~4VN1*$# z@wnvgH{hR_{2VV|{WIM1>T>_+%n``|W6*dnk54D~&OL^3;ogWD^ERTcmP`BfYcQ{+ z24jc!iaXC#@W3~8@DH{0wIqF|q`JKc*I)5(?D3tmap`Z*$IpLqBs$Vp>3FrWyCYJ- zHrH}7-n;^9S*!CS!8T(ZuR!xeCOIu?^cyX-bCJYc)iPJl-g-6WR_};^{pAu|@T+q% zxKmtoRMl0ZVeLvsSnbuvdaRKVZWYxXvCHR<#8o%nhJRmsBW{1}Ra||^X{hm{D+Zck z)!oLO4m%ou{qvu2@r7q&ukA}7Z;zKQCHsytCxRF zUt0Ju57m|aibM-1)V;s_J&fJ_9{zOStJuuN@#YS-_~KC~EVv+81B=>i2QM>EFP07oU&W>%ctJ@|s{AuDI?tTzmb^ zxbF4`@WlN$VNCBT=&^{NI;yMCec%LK@V6Uq-Ho^4-#6TWCmw$sI}KcmKV5t?zW%d6 z;1c%LvEM!vwO;B2+wA)l+< z=#KdN^|#}i>u*k(f4aQwH_4fcQT>$|$Tx~ZbixO1v( zIfVxK)#f=N;rbfN!uMXm(wZUIckAAaQ#qmxZ7f^41f6O-r@>j$*AFQ5L)fm0w z0qC;k6D(WPgbuub`tz^P!s?-4#+AQ06=Mc6V1mB(GV`Seu%Yu#*nVVJ|5$JEh#{!u zWUq@c9b>iiop}*kjW?dT4|8VE!1+J=D!%lUFX7e~r{MO#{SsF{`eyo3XT*?ZQtEZ` zv9{eV`=EE*S}a_?(Vr+}h&vSebf$uBjk_SyS3hVkpcx(tDO+TQeabSQ!hNXtgf0C5 z>!-zmIm(d_YHpTIb~s;}O!=_ElI_?0n)@fL3Fp2bNtUsu@vmbc4q4qLi#s@3RE)Sw z8~rNKT@~@YoT4o+V%6_DTajvD(fOBHkNu;@8g0z7 ztXsFvccRrFwOk_%95~Q&yY04{Z$jvf^IMZAqp6v5vBwrOrUuZdQ_M!orT^%Lfr*yy zk~>ZZM_K03;=wWKxOa|KiG+Dm9+m52ZNfQ44`K*O87&i!ozh8~6hkWf8{c9-)1=J%Ms+V`ac&XiI{?f&}q0-(?cbu0IX=c$Zk*VaT#c zF#{W*?==q@vm-jMdIzs90LE=S2u&0ozte8`c=D6@q{9GgHAs)pqC6MbEgT#&<^^~9 zex*Q<4{2#>MrEfV*mFn+Tz~by@ZPKic=o|N@$BpG(=(N7hv4%Qdg1E7UXC~4pNn^1 zorphP{V0z7&QV@OjGC|;W=?t-7&ZZ1BV(W4hvC-SAHnEx+n}DQnEBS5c>c|4XlScM z_ilfH(w3(AA@m&dZF3hnUGH8 zy0v)|KAiIb-k<&frcIrOCCk@y5d_SeGXo#YoQ9ijyALZiwz&Uvw@f*Z1#SASXfqds zod%4>j-xl@@=I>TjJY4;v3qaEtJCKD2?D6-jO~W?$A53X8Sl+oj7RRe6*E6v;mM+o zj#hj$AG1DOh(~q7va}JKTU#)EyS=b!;q$oVzDbz(!F1gC&+E7#XPe0zwcCDZoih;+ zKKUw^F8v6TC*F%$pJ)PPL@60U6 zmoanR$LQ3xCohI#(o;^9Cta8HA374t=gzW!9fhroy}79wT%Tj)9$&`pLpI^c8y>{q zvAbe?xAnN@wg<8Bqa~O*^)0+Qd75o$k=oMSf}TUhVN{=uxc&C~DDyGq&w3XxzWz2P zYEf0$j5#x>W7_-g;;y^?i*?O$5WhI_MZ7ojLsZvyLv2+x$7xS|;dA@qroa6WQ|Bzi z!nyBb(u=QSLt8a=+hr#_bIX-@W!eHvr~ljUd=w2WN@lc4d;Jh_(HjrrvdgZ)>u*oP zo3Fow`<{3UTW>!Wy@qXzp>-eOrn?`*;*UPUjHz$pwRfg_gmvi9isv4>9WT5+3)9|t z8Q0wKDE9c$5$Hr-x6WPh;nXRZ#xdH^q&p5p7Z#wr>EgljBSDMiY45y--Xq8JB9$%W z#Hg{XAC*j-G9AOW-qDNFI6io!kU#mQC-LHI?_$meAK;cNevhWnJ7B`d?pQqSc}$+& z%!}k9c<22YoW$S5>;+5wRE#H{dIfub<;$q089m2*!1f2DZ`*WScm0F-;DZ^s>83j{ zVXu8~&{s~uH8gk^rjkQ(4|QL-0{A<2ePYEFPIUI>u`mT62W_qiVgqDoSwL`9E_(~uX>mb?p^ z^H|_H>m^D-O<_A$zSNeGVM(Nl3rgc#6)wTm=4^|l zA^YuyhGh$|s<8`p-fcV&K4A5tIapOS z5Ia$JyIpp{$5Wrj{SQ2b%D!VTVN@S<9=tuqkL-mpJMIZApMiVtxffGre~iz4=M;Qx z|Iu8;F^-OPSTKJ9_B`YWj2zSh{d(5p`L`C~Ti^MHpER*>`m4D0hMV#H8&fg%b4TL` zU);%e1r2IvYO^NA`P1J;kI}ne?2z96KJ`}H?t<2jCgaZA??OwjZE^fhe}vwhYuHE1 ztFDzg_=yM8UV9R+z4<;~edR^GFmVzZyN<#4zp)=);Nt&)qcFD|Bg^WtDf z%zEiRc<9lI7`F3)=+>nM+ikxmw%>6AHqL(yH{bgNdW<~~Bf74_(D4Ug?C22~yH!6t z`@kK{$879=#35Mt+}qgch$Ap+gr1zx3(q`o7an_RB9?Bb#(oFvgHC!#xSFQ^=HOn= z{%Pts5W9{a$pcu4VyoLK(0}Ci*f9Hf-2IlNs?9k4*|IUZFz}^XOJ$e`J`R{}Hq^Ubj_}NJq z+@muWxf*B+p#mK_K3{nHNsQj@5cIC!j5*WZ!JzFvk72zkvAL=SBL?@y#77>+_(Q&e zFYLbu-hPU?d+1S2U$6q>cG&~N`*Tq@`+d~(8ISQ}hhV~vJ7VGFr*Zea58$2YA7cAG z_Q#+BeVC7)ceMW49aifM{=&11++GQiI{nz!FzGMRq`NBa!HT#@CtJu-LD(4K^ zscSs-<*|n!#v4=TaPj*?9P_pPQB~aud(ihAkKcud9(o)fEMAH2ciRWU`gXxv&pm-5 z+wP0GuRV-MpLr9zf90n*`pdhsPk`S22V(8aSMl)kQ!#F*J49vpe<>F8I}ZabRHB){Z? zH*xnJcj1K>Uqfq;aX91WCt_gNYOMKaE}on83f`UkDqeo^1-$&iBz(BK6@4pK;qf=u z;^b4lii##(B=X{^vJSiKv@NDidJzA8WFm&_@g*Gp-7oo*g3g`0piAe@ya?!wk9h&p zeeB-Yd2IjqR7XQXUzcic!i;w(^qe@W)s(2 z-o-qUaLZ}OP43dXDJ|dWq_E^eK}g`06;&Mn&Au?ygZuS$CC%A-l8hc_*|=$=5!t(#V3!J?1RxqC04 zE`4{9pcoq0EW`YT%h0_?PpSHoB#kqH?5nZPjT6APSqb+p;f!6!gM90zNsBLd+I)fQ z?;w({1%mABt4EE^t*EK1)%Ou?UysJWPGnhBTj-CN2rQ@Ejyjv_~<^&U8BjCAKKj30X zNiN*gH1ObSRTF8m+D{_b$P=gj^h9^C8aK81;{tz`frGZOv4sh!_Alsl|3kyV_UNaP zle>NZR9hQQKoB&O9{)O~wpOFQR(BLhk0#TjW*V3u8Lh5o4k)ydouH_?>-IRItzj{aKki(7PuwFU+Uc#h&PC zg^km5oz*V)os4iC#mSC7Q-8>(T z{ztlI_McKK-x{|yT*Nt#!ZXira3 z(KjxnqFno*1vTdEOV;)Ei|8|r$*gA{bKi-BM`KG6If{Q2)HB<4yfviu=sDc#yGHW0 z2nujxJRhc`KR1uYG`8b};E6{WC9Y{SJ_Cumj{zg09W^ad6eDrkFsLe?Mded-6?tLM z{N&8EN*)X!zWY4xy5}J*-_VQ>bv)aUUk^Cb{QVJ=N3$!z6fp1!MHtnv2oOa z9(OXPG0?bX9ObyntAqdShYQ-qmAL+@KjYoGE4T>bB9(d@ zHg3WZ$DWOEAFvH(yfq28-TffeY;48gZT7}VKlu*m3d`n9#XWc5hj~j^p|u z#a8_~(?%=qzxE$^ZQ6V^wb$W*uN;lT_uGyqTFtG_6wg_ec<{=z@aX@qz5f84F00DC z@%_fm0h(?yP17_qSp*3Kk_00LK*fY8<~WWCk--FlU>L&~$1y7^jEn)s5hF%mKr(cb zX+k%h^V@Iy-@p4_>(s7#pXcpHzq$V3b$z|6&e?0Pb+543-sjY*^VC!IzT1r-eC~IR zGf&E&n;~?6@?U>&{LN+3J^S0n@z;KE{Md_LJU)7z&Jj9*PPxN<$1}g~YsbCrc$&_~ zI+na9vCR0)vyN)1gql+ZQuLit*8{%oye`b3t#0>goz|Wdo%=tN?;poINu{Xd%vLJu zBj=piDwWD9Ny=#=R8Gxl!&oJ!j3q^KSOFfIs+}BU{ z`??;__v>(WjK4hGFt{Oq(13FOl#s^iIjfFHf^QvD08qhg4gi`Uze+euP(>2G)(e%S zaVDd=BOw!Kp&lr%CQiem_xAE<5j>)9SpJZX;*4MgUyFLnXh%w2sCi-}A> zB&GZQ1|%Wo7g^Nr*1nke%Y{$cg#uOXM!vuS0*7i{p0#9Yk3TaQbXag8KWrwaON9oE zD7Dn(nLkLy&L25heI|1Mv@}qg;Q7PvHrGH!S;dXKv`=uFvPRuF)! z#G_uPm#ePueo=OmD=pDGePPkV)H^361{};7bWCO4tTM1y1l3)|R}6a#ya%2;2A9W} z`}DURrb`@)-Y3|7TgXZO{?>`{#G3AH6ZPd=8G~mQzTH}F0P*H;kO{neaXDW))~Zv4 zYxef~Ow3;5G4iPz-U!ZDHW+nD&9;t}k z|-ic}|aF+<9X(7OKQ$BJq+raOsLs9-2l~aoj`Ejp|0sYNj zb!e8-cbTQvQY(Aq(jC@b&VJuRzMX|5xTBexs--@;tq2kG$m_|LcmH%e&05 zt7fgn4#Ii#K#cYh<&215E~Nhb5W80O>Dx>zfp;?_-S-kSxiynh*b|iDwUQ+Lp9wqo|xy=PbUz=g2cE?h7k}6<;DTI=yf8& z76k|q`x>U~2^khW1`owJ3bT!Aa)hX32&W%cx7t<|GLHN96V_?b>NXODjuyz4&P9m; z*-7%(KK(B(H1lbCQ=O)hi-v;Aw}?KD+>DFK(#JmuS=9z5o`wt0V35@?f)l@Q)Vu^> zR37(S`!e@-^X~`{Nss!uA0D>15UF#~WcB`eUl;eVcg8BcACoqijR`_0!tX~XoiSud zxm~y z{z@QLKjr4nM8jVgRulqyu+=y13FF`T(vjY63CR9b0~qEr9%L0kn3!?MdrY#gV?0FN zA+UN3i+{Rrq;0FKxG0y4bRb_H-yhc{=^OmzLRTn&90IFv{>CqQa+eJkF!W*AdO1*w z<1W+l5OwaHR!cr%NR{&u%paBnkb@&JKU5PuG(Ir95(17qe8lIs@rFfWY_yjY-m$zQbZ}%h)BcP#UFNQ;jBwh+kN(9-f zN!Si2lCfAm*OW+W*jeGVj;q#9Rs-D`VC_t9Iu)~9CV;G)kw8;m2v)K!Z-?20uJS^) zR6;yZ1J)od-Ub;RQpbw0RYiCDsnJB7pm4kW8)0EYF0Y|Jg?W32w6Z$O&6=xtc4@Z)rQ`=={IOD zzWen?=Z-;wtHR%h0Sn^g*#R!`lfzphr3rVEI;-D^>tx`x#@b|ovl0!S4&hv0F=H|i zkO-fS1ipuoq$pcP{9qIn!Of+wu`>aKPPS?&ZsH1xS~XeIMh6)boPtTGgF!Y5t6-n?E{S)koQSw@td8!A!b=-U=m8h5U_fDo>Y`@xwOO1%$>P>^C zGXuFFCW?L(mEFz>7G>BiD=4qBoQ*^>oTc{hpZ?7_g{fYQMo{WNAnys5-@UnjedUE6 z)qUCztVq4HjzS^%*5Rf$PW}O`IMGi8Wwa zZo*jUI1rTm+E2F6bm?1EOc9chl2ALo`T?F+JBFy6 zujB_9E@`f6CNSlVpWOvpudhk2L_Y|n6P|vLRgt>VXnL>w3r%0mol%g~YZKSJL~z9+ z%Ntl(HC67jX*&0alsO-Ofm=^?Rh4))+XkWgI_%7kXrJ`%Z{>9q{{H2EjQ-f|#bACh z_=rqd?!TJwAr;pExsBhU;Nn{p)NmzLK2Z7AWSr4fSoE>oy%w$88P+AdiguzQW&2v%}zK&Aq&} z?DAy;W#nnFR^DhA+`j&J`X8bHc4PR>BMYQ|`&6xY$gUdbfao6ZjN0_?p31T!D9M-i z{1&f())xRXeU3g~e>LVabFC+MWhCBi^k=9OB=k>L$?hQ z1fkQKL|3pM0Xc2}&54_H3{f995{5CR=%MJ19J&}~?W5~W zqD&Tf@E$Y)&K6*?E8vgquVh z?+X3H-1S!70BltG0DP^a5`)KYr~nJFof$Z}b}SgxLN@f24e!e*2v)f-P^$lz3*{+KCgfg5!4i zV)|CMQ-So+Je5q%iwK-Za`lewN1Cv{jgGox3&Ohh` zn=Cy7pCjK4VLC7UwYu=#w97c?5q!P{X)curoJuE;Jh9x@tenAq&%nB)F1b<$z%ml3 zjkok+9J?CeQ76395j-yOJBU6B|CzJlhTnJ%U(2)vLFr8tja4+S8YrZuYi82TNpd9a zG#g9BuXzwR-vXqUqPU04hduAX>NHO&xOV5z_3(M&lLbn_Nbkrt@zh|#cwGggg7c?~ z_W-+bImqi_T=M-DhrWNWNQuqMjKf%c(hjo1cX;4N0WD~f=%36;fTrMQUP`K#=@p$6 zg6WLC;0{&#;%KKeCB|NS<0H`92;f_s%6fSkHd`L@mcD3<9|03zG7t4F-**)P{q3{N{%nu#4uQ$Qg)kx5t4*~bP7IR`+RSa1JEcFg!kALA{L6aN+tr)c zc2FuagFTMaXc4r9I0T@|v}S%Zh8Ww10Gk)a<#Dak3go@0)$UcJ6&1iA$IAxtGdD5x zcMRIJflsw&g3Z9Sex9R95dEavK!ikFZ92aVh{I1S5mF4f41%6V=A^+ikAeB&?JALa zIJ9O&L;F^7+ee4qK#tbWs0y|ob;x9 zvCFw~=hLG<;|w1zPxk~xZXWsD5EB1NddXb!a{T2+h2QEceV`xFHHp6OyhCK|Bm_mU zp+?KGe+@Rybe=-Ac~I&PeQ-XsAX_$ zqR7)Sg}iR$c$%t=NG(N>7bJ!V^Ub_ z<$zZO?`1%hzzxqG0tXV|95@k+MQ^y=HjehG3ULTpC=dS{;4^bN6I(b=ox*}EYk9u_ zFa_NWZW=*v-T-J5el5seQIO#l-3YtKW(_z+N7t_p0B)+>6*`p1E1_e2SwG?JK6%-+ z-Rvr_cVu;V-B#(K`1+1en!}6t;gVD57t7`B_9Q8f%nyr-+C2B7_mst_qs^dGm{1HU zoLNs0!c#{HI8H}x;2GtrHPoBMPG2+y*$;qMWG|6p}}$r^OkooT?s`bve3JT~IkRI0U#q)1fo3QW-hky+M65oB;y$zaVW; zPehtIdq;kmfbSW?X(AY|>nNj9ofGvkegL zs1@~F8#>{#f9m)NTFLUR>*bMBn%D#R+3uLCdrJ<9|J7K03fGCXK>4{kG!iA1jE=if zIaw0gG;JYIEnvwZCh{G^Ibqpbc2MZ0$_JJ%F`Q@UEu|pYGDws6K5Z{O9n)yayZ+|x zl@`EqkiFp&+ILKF^RMaqgLdPHH%C84b+&Kq*CRO>yuh#C46Y8+smAXeq+0IPfZksMrarlgefV=ZlGx}$4i>+zLj^|Z=6%E7tj zh5ctGlRm2Hb!A+r=r5jm7rgWw?{#C4xzNRZW4gRH+oV1-oboKd@l<3tmc z8eP7}X;lMnBPR3H*eA)E<%6dA9MKdw|yKHRK3_S_6(dpNXEFR1&aTgF}wwHf&WevP}E*RfqH zzTffw;B7rzN*MLm;OFgoZm7g+_$9a4uE><*l*5PGm-t^Ebfp;W8tJg%#6CiY(>jh| z-7q6VtW}xYwq!|?B`b}T`Ob6cmlZe}sF9V8oG1LMg+JlM@^{C@6p7F7Bu70; zl{UFVl?x_(V9cR@{Z6kf`|VS0$Jp_&2^+rtX``4p)wz^#{+Pb@sv6_F z0;klu?`r+4DWwIbcxs=8k#e!sJJF>kIfN(b?p%}Wtx80jl?yJV4P1QCqnaV%E5?0> zV%~hUw_#u-nJjWcNlRNnOE2YTxe_wKS>TCU*uUTQslUn}E*3H*o0NpO8m`VnG6GA=-9_! zfe#{a0zmN4xN?`w;*jYmQ|PTR$mec$xBcD*9?%6KIWW3<^~CK7uR0kWN$YajH# zrLq{B?iFca@7g0AFqmX6N(t|7Ogq+~Q-Ioc%M*NDzqIqm`DopniI1hMwcmfYC`2BC zKsvTZia$G?eOK{Zs!sdw{R?rYJKju=IYUkpPb_s-^&j)=>bmH6cGAkW{#s+&^x(Gw z-}2{%kf6Y^8k$M#!zbz|8ZT4~za0mHaLLLLL%w@iu@W?&rL?!1iD`lY`(cn{75DmC z#e#rE?+fqVauK#wbjTyZgRQ^ryc>0YaL6?J4bo0By@|x{`9FjiqZ_EAx~kURr*W|9 zv|xaOk*HtuAcR5KOGE@}Hi>YIEzG_~e=pJyh?=jd2c|@-a`B(xG`Q;+d-o!@4A}@H zPAGd&R zZon7mH8;meir8&Tp9Mv;a8pD;%wqIagy2C+=9MMzyGH?zYnP{<*V#n8ET@lEdoJVW zrs*}64wpgfA(I_&XH|^RYL<~Jzj0~*?D(HeHZjqL=W!73W^tbi?#40m)}*85XczzygIn3x7*jRNMhT9@Uy zpiA$LUU;&-d@`5pG$?KVYP3~jW3hJNX8dPWsQDw4r_Qer<*k%^Shej6EoJe&L`C}( z`U3%YangP;UjXnxujmkMAzKN6AfJK7bY$tzW}OATVZ#kQvp8!~J6QA#7ib>M)b+dVxH~tXx%Z+#^2Tq?QOE+y{G<|Y)nnH=QDX>)`=NQsO zC}&CpjA&qF5Y2VQp9I4m;)3T=c~hbd$->u&j?Y%L8S2N_LBelm#-#kISC(gLk2}V- zrbe;a#+c=vQX+nB?PA{wzMtIi)UNPx5k0?h-BF2l!+ogy&Cl!yreU5=ow--%bB-U8 zP?4Bd3Qy9=j!O|!9~#!}=ZGKtrgEI-9;|qE%IhpV;C(7dPC)pST|nzGou)4XI~gyo zH*|Pha;oxuZ6-GoN!+gpI|2)vc-EZ+f%F^CITy#J{H=%2_@po`Tv=kQ3r z9lv0kDTtUG*9*)B9>`K}*DL^^kX&jqr!=Wqqgf6iZd?6=TE6@gNq2~}|NUU=_5SaJ zusua4Bu#I>AOC7#Jj2ZDUv;6fhv@TTV<$fvdX^bAwCmKo&+`aH**Z3gdbG6-{X?@~ z7#==JmY=H46suhRVqWX1}Ylpna$NB>f2WQh^ zbmvNa--9Bo$e+)NHzw%08CnSj0pFK{;yWn(BEUABOWM8KxGW$a$BBWzRk36KcXhR! z*TLtN!bcfkt<{jU4Bib=D1_Mv{ESnTCQp2V7Qw;>Y+R|{7E&noByd0R z7$vF%f#~vgG&ndw%}7?RkygE)5zuJ}*~zTLm}1klK`7q%LFl3DkGdMjTq2vocz|x| zy#3dKIYLeth0G*H7gC4`fQ1ZhlLgalm|eoDZ#l7EsjqHz!xL22S%Q6Rqvc{irhzU) z^e|dp1@=ogYJ=9lFu3TwnIhEr)*28*HwgD)kXgomF~KaCKvS824vR=*!&@^r1Adxq zKUHdMut}CuwM%OAoK(n7(y+Y`CJ67(4=>4q>#zPNp@ZY?P zQX^s~6d~U`j!3*BCNR!_(wffi6vlWK)pvmxYU3xK8g1rh>Iv6vmjh>0;^~iYj4XO( z5i^3`pd^e*N}w277(OQJ28@dVw&)cEu?e^F0UlcaNbe!>Jz4j( z?$4WAG@;L5W6+%MkmJy=+(wb`ZnSz0kg+Im6RI2Y+V2&{wI7h^TaInNo-|>PX{RbLcGR3m3k}9 zQ9XQM`}XA}xmJ!*r{o?dfy55KsO2UJSjFu2<%pd5U0bN%SP8;UdQW8AwR7sc4SVmY zs)uh}-u_b&&+Pv+4c>)MnT{dkL&5Qvh9xnGv&#&M)=(!Jy0Z`MAhNB;ZuGr0J z_gaTv`qlWvCrPt<`}2#x2d(y3wT79DRsVqe{*rFEb-Cv}bPg*n=UtYS4hSy|6u%uE zsG8rC7{hnL=(969quYz8(9^7_*DkXYC>Vt!_u(9j$ z7~T15oPV2_gq>OHOJzg%c$4Yo@ATOID4q9KtA&G-;4( ziEpYWggS94L`uWLS)c^#sOCh^MQeiC8$}=z=dY@?C4X9V_v4G!yW?vz4^T$0zum>8 zY)#;zNbOP;9Ez46yujM&F;$VpZ};-`3hP!Ut2U-Z5}>>YiWGa5*GxZ#V|Bynp%c2i z#Xv9^$LhCah}`Cm;~Kmi))MoH3m%z9U51QP{M3&?rj?slo5_zMI7=gF(PXoNEdCu>?tr{K3Y0Wxomv^(EIrb-o1PT?%#BAlorKZt zT`?b;Y2u2Tz*MF-9vqSu4G`r}7_>8~{3Z*!GG(SaZ?t zp+>9&IIgBsg?jJ?UH$k3MEy0DnNJo|bHEHmth|g-lqers864r|r*L0Q#2CWI*kzss zQp0>Cut{TfBWa-%dc2uzRk_fv;Av*MC3?P!%o33WbIDLJo&n{#ID`z(0xQ1ZP0S_= zX8_()$W8!rCW>ThMP}1Ve*7wxr|Bu|-}p;SHJO?D3t{aP%CiOzXK|fJs3!}K55=)d zZb}HH=e4nXhkK@t|J^B!Lbe$9xCvi4uUs1?>BC>kILmZiw-d15n(Ju&)c)t~zouB? z$|jTpul!U?^hk$C@z1>TtOBsm@G;(2<+evE%cRkg+i$s<;eLpFwZ1x(JxbYqbWLpU z$g}r~ASZ`PZE3Ow2h^2Rigf0z9v40f5`E{;reyf{D+q*3ywzQcf3sZUv5R)TP+7pHJ)9fJ)78! zfNn%U111S+1c8(ZwN)pH&a|5wY45_Hq=9v=df2apO#jVU)BA6X9KP0JJ+?3@L}E?2 zs0v1C-8}Y$w7L=I`dSG8pWQ@;hZium@K{8a*g;g`mz6&y78cXqiX>3j zIJ6Ond7HE65Wlm&@clSVb~bJN?OjHAe)m1#3Mvz#9&vlMCzSKFzP0`KIq8Gt z7cmaQsz)l-28s;rZd6(#8+V(feC#;IRwaYVdbX5|c9Lt1FIMEMm{^fr6-L?RT&4#x z_QhZ|Oh1IDEy~N90WCUTc*A%jMo^sDgK3kzYj+``Y7uD`JCl8+Nre<8lLTtG^up<& z@;S$WA7UL3Z~QO|{O0-AbGaSA#c0DH)+-T~5q-H(n|8=VN+De_@H}`}aie>@w z7P{_6SUHLGDlMremRpTATT8CZvpUtX;=W=P7Iu3&>i*_JF3@fE!``XXbT3Xr2B+_) zl_>m8>k)0fqwrtol7mAg^Q|mw6~LAENB9{wnHRrWv+8yCw%5oR@;A6DTyL3pG zVKT@_$+)~_qj_wiYA1=#(c?}w|zF&q63+=3$BFKzoqUIcl$0RtLNNzbohP3mSf7*!h ztlm|&TbeUt@)JE^vP+2S;f8bmcod3omIh_2csBHXM*oxvWk$9-0?VN|sE>d9;jZ)F zA3&t}k31*{)Or|Af5N{}07%$o_0zRT$hUYq41*P0S>IPhH6mG|X;sv55=a6)9|n}w zj`@yl3g<2e#0NIdpT>TYx2+Uw@Ac{|b}}uj-l>6a3mWb&;)t54tCJ;i=n-UVE~>YR zV=R%Nw6!9K+ZKcAfKa4S;nnXB=#~~>oW`CU3Z9lDN`%kaVg)Avvv^tz4T-mwsI+wm z?PJamq27io{vgeu4zTNYrjuw$rwezSmClYg$PC^Y3T^i$tdJmR!&P;Wt=ua=cCGpo zKIsTjXx^3q;V^MU*48P6RmF>vAq0!C|Iuw=TV?Qer&$%W(dDO*o4W;~hkCNoeoHw! z-ujY#I>g1BK$4}>Wz;=)dyJE-V;nQm9*ebV?<<251#6C9St*~}eMzza;TqlArqs%T zv@9$}si+!0#=VM_fieE&#wQ^>9hdbV8*cPqWJ61GtHV^x6~jj zoLPSQb$V1m!MZ#@&?nV0Nhat3_E)IIsj8im-Hu-UBlV|NK{4MaREMgaP- z#KW=>VE#CW__P~m*2i?H=F%gs6bAz`l=(Q1aPzf7MD3{V82R>r^G?*SCeH_}uQV0} zXqQR)7ddtj*Fbkq!7qaD5i0_gUVpv($|J=>JeGd`(Uxr5*q=vFe!^|_8h*8UW~zMd zaSV40ADa=bdAgccQ;ADOHP1Q2_O?);_j?OlBT9-@Tmtv8s5(w+ z7Lci`@941u24<0GQG+^H@BOfd1#4E#jTgyThOhS#jPVN|L{;>*^-}clD&sm&hmb}} zLN028oRG_Jrp42O+nYE|2h(%voS#Jk&@vGxdLez*a;J-)+)cQ=16fs6r%Oz|b5^iZf~P%A|;YN=-XD{c_m`HC5A>XYI(}GxfePcPUG^FRQPI1`EUEZZrMW=h6-7cwjekYoY zibuI6{Bu$>kyd~YcR%ZJG&mK|8^BH3Ehd-PXX<#tV1}`HvX&ba5&is7;aA5y&StEG zpIi;(XoH@&|D-jdarrhc7)pa&&(mz-8i*7INpBg7>&fSuU!cQ5Xq6cI}*U zy4$3i<%2Aj^78Vt+LB62f;d$F_Z%C;=gCuFehjr3fF6RLb3Zz~?|YZI;?ywmk4C zE;AJ8`~~U6)*WorE!;DpcA$1C{n^K&rKebHw-;Xrc^H+)Q^=ZgrzCE(_UwHFW)4|z z3;&>-v#(I2_Q7Js^Scwy3KCTt<^_NWOKt`IQ)s68)(SZ;b`J!*JhVc}ShozXd9Wp* zReY<3x-WQI<}A}RlYjNof#0qieLMs2-%L##dCF=%z)vT|ouXVKirBsIuBBFu^I{J1 zOPA4^)-MM>H|E_kS8@LD=zn@En<6WTqV1Wq^Ol*HJj0ixX>o)HWbuYI4{y4$(jCg2 z;1H2$y=u6T}jjB={ccA72)SIPO> z|GH?8*jaYJy>>vhVib87Uc6Voi8-|Ns_&l1zs9Lk>i&aEry0kOM~Rs@UfuiR)-ZXo z?z$ws?au`;&gF2Nx}9in#QhYs%B=qaO5SaIBE#6)mvR&f)@?I6rVGg$Ep76hT>JZ8 zZ&H6|vpX||x%xD&&i}^`X=6L3MO|m-LV;=lFMC>ZsM&OfYuD6?haRHjJMwEYd1Ljf zmnKs~F2OuaJ?s45Uz|FV#r&S>L|l8Dg02&P;I|=J?G|TBT-`eg4WnPF6RrcDD|A+T z_G>*bjB|f$H)(kutW!;{U)Aa|+IFBguEu%9=p;E@VnirN%y(WwLZ~QOC?(WzJrUbq zT;kzC()&}bAu^MyZm^eJu#V}FjV=o~XZGw))Vu0(jj-i4q1T5%QXyJKMJr9O0%Ro* z=ZH={tFvoM7kX%RU&6V;>5>7iHe>X}z+&qD-KY^CHvqlh8F9Y5>*1euExJgp zGi`JxE)?w!9?1`{TaahoUkFl?N8F6JIT&#&Ezmf;o|Yb(p{auE%;594@xWxvHv^dd9I%~gVCRoYu6{NAruwRTo*KK(g5aL!5P z#|@kO7JJs3K)%2kPFCcbl-^)h($KvNqY-*P@>6z$qN3Au&geGSIzFou=b{K zVmboZ1m=5RZUgqdR^)<{@MxIqs>_Sj7;Dqd0GjT_?+4D zApA!(=@8pfwODc1n4^09&tgvsm!2X^XF`zv{Mc z56%(4RXGQBX6esVNl~uO?iQZTSXR!Y#K$?id|mof)h#11oD_PLm3sxXr=MwK5N;?W z3yr#-@nb)5PJ(h+u(N8iJvxuL7&|wtYqUrFU$wK>Jz0iT2q(%#`R35aM=Ut;=TPBw zxHtRI)A}~y-A49)4WHHSh%XA5M6k-YprfL&t*^o`c5ud^0yL|+C~@w!9qGuP%fO#P zzvPnZLV9@Z(<1A3S5{8PXFRkNs8wAO0L!=gE$eh^OKvhs+Rq=acn&0p)j-< zN;>Owr|fx$;FAwWjiMu!Rs6s1?7X)46m2+jrhz$|rZ%xNSeZcH&1!8>;|&oZ+Jy}} z&wWv82PNA18({C32&PkT3{PgNx?zzjYRv-T5z4Q|n_`UgdF!U?tOj#c3hGvUS zsXTb?lqsRJR2g1*X5!K8UWn-PwEyn%dygrSMl;ym^q5jChQf>>@9Z0dz325*V)&a; z`J9${cEGhc4-pvimn8_zNmvT}S`gR0-xdoF-_pU@a&aQHq>Q-n=xr=6v=I@HubIpM zJQ`>nL>(TJhTRViWgw?*!_&|{Au2D0etBcPD2yH31R8Uv2xJ-DZcWf^V6lk?(2#N6 z+Y$htV@y%YWbbkZ)$r9ytRlLLngC|8Qm|psEG%Ulc#FUX87_4+yg)TtH#{-ij#LFv zcH&_=JbH$0LYhiQ)2@QGVE`)j&oKjwUjh?Ld3~kCS$0tTF5sMGrc%+{$VF?MK4kkM zOrN*rJCST~Da32##qq}Rk|viQkOZ3+@?IEKHxXkWp3EH4J);b$r25wXQN!lg-5=?h!@gT5)fx!E zWq-_FLa2VS*Xb2>m0W7l*ew5f$$zq}^&zwlye4y;)eOFr->rPhqHN|-p1$^rz$4R_ zPS{25MS3PFA{M4KwVjC1y?qtnzsxVJTS*)jXQH5z3B9J;%% z(QcwSofiBe{*q|kih9-DN4yN`zMos<-Nn{-H{T6T_j+c{D*a|1sHyRMqj8ZKt!7cO z<5Ql-2~FC2vPkN1dhQbTR3axP(CqrWSB%Cn{Z{SX*#y~r8X}~Lh9Anx^CkP8>+Yhm zguuyDg(y3$tfdxo!_McUc3RhNRYq^QDp{Ra9Cl+$f2Zrr^NvnTJ*N&F_lR`fH*KTZ zUZbC({wxe7shkP}J3B!42&^VEL?O-W1eu4KKJu37KLrj+8e4TwC5Rx6j(*EPop~K| z!acF)-p2yP5Gh-#2Rhpy5>hf)=kupRae5nm7J^VrG9KOh{DS+Jg?gvr`K9^tb3_P4 zNsulZ5j2y$@QNIDf-WbjrD4^v{!cP779m`+4f}Tor)8HG^h$P%o(5deSZ?ggwdtaN ztaup6>9+{Zr_-OE`E;~D@C2&})+|2NM0I7pXe5X7A~!3sim$$zt`#Tqr8&!h3f>o~KjU_5UL4+&o( zhkMs?+*Dk@V&$ z^*6EEZP=pwp#9Bhr|Gu%Cv+N-a;C{$I%XY8qi_fOI-IH}ENSf<8duIszxC z=>`oPC~uyb=*#&FZ`#zscox?C*rZsrmwtI>W1axz76SQrMl=!4U!h20t2^R>N*M1s zdW$v5lOY&P?23;TV4Gopq7%~y_=^u)K#oVIV47^vPdRI7UJw0KQOE?d8pdm(S228b zCW0H;<=3ks!=5^Xj&C~YLZ*I@a93r6sBqu}j{6aiKm*%EERUFrf$sd`YpWQj5!`4Y zo6JZGdIdSR%^O0t2{oY8b94@X>o?kqsZ4d15H4R9Pp3*?e0LIYGSE#9O`3)ppe3NI z*QSdRJ13Dv3i90_swD7ysg5_0s`=+i4mFwCB^O!OHZ*BY-Oduw@l&w=LgU5D4HhRK ziS8Y?_3f$Z%uF8g$9?S`tibpuDPZ!D#6`%s{^2a^e+nPRD%R3DI>m9KP|mf7VZP%< z6~x{e8@W4UWifWe=AQVUH&`&1i!E=;9u|~XH2>pyg`+npJB(PUCG^Oo@AGZ@5>TjX za@@}I*y3jOypPTwmAuLJ_gyx&%t!B@n+{Vb`E5T`ri8zdGyz#)l%-c!zISY0bRIc) zM>#Q9M0qLa#!=T^e;<)y*BA3L#s(S9w!~|qK|P2DD~TM=2SgxaA6f4^>2Z7E6LZm= zPrIo%)2`X}sB2;CQRh~fKH~Ui3JU!@M?D9y@SX4qhc{kl74h8_Sgp4cTbn!G*9Vi& zrlA5mP@j_uwS*sE^8W0$@qRn4<3jnbU%8n^Cm@aFVE@QhZ;J?2cPp~t@W#Qw(fiyk zYes}Q;;S34|8L+?FXgYE8KCF&;>RwI5vuhh(B_fqV)z4C{CP+SV?4TIUMNYZ{l@zW z&O55U4YiZcUd_oWU`Ivo91p-sqh2vgSWyQ7@Voxf(M3{{v- z)BW5e7}gs>1VH>Z^lnSm2Y8p!s=5ziF16;$E~5xpdC(%Jfj!t~C=%=*s+4ribze5>jZ%|~%EizTEy{hy2>E}U#4$021?uXS#dQVn( z=5|i^DtlX9O@B}MXci;&^FY zsOvt}h0Go~{apw))nF;PtxxZzf7Yo(%hv5Q0hX{`1;YnY=-3c^GN;7$JxW*3-fUnk zHEHGzzFD8e)FjY%iyEzcL)q}bi?zfvj%DkS<0hg^BxK0~A*188(?ExY(-4FuN>C%S zy9HdDE;0z^XyTEEGj#^>jMeQJI4Lw;Po;LcojxVRBUMdj3C4Sb??ez%Jto`@cQhdg zLuTD5wh0BYP^{n;Io2_Ja-cH)>kA$UqZz+l>vpiaxAx2cUrnWc`d))ZKpoGfNP3%H z;E|wcxRD8LA*z>{btL{j_^9aij%OxsPK@t4M(1IriQuZ;n3nl0_?CB}41c|dCR4ja zb#U~IWXOE;QSzHB;RW9iSc>=xEzQoh(oa?jSy_2kEAZS(`ZJ4q`3VO6W#e6unPQwd zW{rok7AVbazxW`v=!OD2OH}!T*1l*9L&>T5e9m!Z*FIKvUXRZ%a6Tn>5(Nf;Q(RT~QRi97>| z%?mV}nWeb;b$q(fuMkh1W(gYOT|}exH^*NxKRC&W^h|!5$(Li9RO`woeKdCXPed^R zR&IjK6ThiCnHOCCx2NQ}%cr3(QP81Z8O z+_ExeK`Do-UH|mGE~+{hlOo5Do0KdpB4iD&V*bk*DlBpXdE1(;Tn15w8;gmt;1k|s zyX(cq>efNm-Tt|Iu%kxqm3f*CSGJ)hpL3Ootaj6VllGE=?k|fqg-F*f$fmF42{GTO z{FI!ZZ);Xb)m$$oeMS%pw6$8JwzG1)#_p`@O<#3*eoxOD`ebMrTIbm6qjl;)0ohs4 z2QCj1{eAF6<@&XU{yy*IT)+JQ>Aaf}J8HR-^(FiMe5g;n;!*W-M%Cn)&Jedue(juT z#u3wa|JEtdo}UVXr3W)4?6U$ia{Jo|>-kofZzA=-7-hcobd>YW!=ETl0S{gazb7S? zCGJJnQ!q51W2=kmT=@+#oT+BH3`|8aj%@HmhM^ARf&kDyjW7IUx!93gUv+WGT z9}5b}o`3T6_pc{miJIYgwq3OwQU+~q%gk!}~WWLGy`Mrxo5$?PMu}jDuMZx5=>6-N=M1L(iH{$IM$UmW_+fxr`?0Jj$YBer zJMnq~!l>;He51Nis(P(T<1V)>`R&S5Wy4kmTl2<$5sxsMFa2vBen?lXX0@S@*tpas z2`7KG^-TR6e2)I-^-%S8GhGVD`b5XWHmN`-pZOC$t%sGQQdru&#qSE2)(6hYxBRwD z?7*FfVU9@O76$*MH6L|9v;KAJ3`}uV3Q%ldcoI!v+$eY@8?}y{X@WeHt<2{w7zfKC z*6AvSIE3rH+uR(PB5-a-;cm44-q_S1Mzui~g;)v|F7Jfx33%7#@lw~iIX9?I=C&*T za)JTiRo@gkrt8>1>@o&w@`W*@6I+<(o&>b?l#lB9X-ya{ltIBz*uP*hc$Oz#yHJmA z$nW=R?-d;sHIHm8#gxPo?8tWbzUnkiiWC~dn6v`%X&bok}a?2gzU%F12$XqPv zmQ;34TvmDf_x9w!vh(meo%$YS@0+niX^g*UOj7aE;TXL?GJBCnlCY{5O-6;9y2=ZO zl;ig6yCj)D&o_VAt@M!K@$HO+Uw2>dV^>PEdBH}6gh#bK$jP?fYVo{yg;;{Q+@(n? zNmrrYWezSW0ZzGM2E1VGz>W2l$2*oHlJV`^OE zMP}Q83t=&NQ>0)$qDV4T=TJwx%;8`e@b8w7k_FVV^jC}}(c`jY)Wc{qmENL+R(LU0 zK;_3fAX%9X&vjZ(9XQ+(;>f9xl@f2;+Xep;GIel?for}WQ#|t>EL&cveRJ9+u9{Tu zHFMTj4O6(Oz!*AVll9HsmJwsTU2b~RgW9RGe829aW;U-vEU}1qO7Q{H;ocr>g8ny? zCwR9ADd1&pcmJw>3HZ*vBl1Few|-*GHXw9l&XALO?E9TSgca#Uh}y!FdrBq*?;91;bA#6A}Es+&70p+~*hynfas+~56` z!=X}7ozcSL&}|S}OpeZtTE7LcC$R>~7vMJL8p$*7r6)xm{qnS0Ja=3Cy?6SVn{(F) znyT@EfBts=Tmn8ZuE#Fh^77)z`B&B9-apz-8aF5rUoO_Uod|#0*nO?B;#lVKPI9f6 zxGg%TD)H(+a@&m`-Z{U1E3h()OD_3jh#W3>QpK#}pT((dHPEyGDu13v_zqd2yH+an ziY`9c74n8|C17EG*?iGZeqc(x2x?7(a-+i1>7tq4q3EsrR=acOAITKV5ao0T^iWpa zZ;OM`P&KFR3iSq7DBcrA$PI7Tbt6A^{IRP5K?eR37U412+LZ?Wb$rJnu+FWJ5|x@F z{PcVJga|byVQYEZAPBa*OLC|Y?Z3i8NGc5Zyrj2Jg4L{2ZICEn`{`NNm+aB=e;)9>A47{ve}d*VRfa-{ z1K(w{XS3VupSLWWeno4j{>lEpjaDYWIxXtfOT zjiuHr`?XvpnI^H1)22=hnP1>09n^jH&a2}hDQIG_iJ$Xg2k)&tMdvn6aM&$^Zi*pi zVOkBj$CDRk9-KR7fT%RFFIiLnb*u^flCS5?Y{_X$K#iPBVc{FR>C?FOQTU06R-TG4 zn>CsQn9k>Yx10W|8{Yc}iq>*5r?$>}Ye?3$1hdY499{i%KNY}h5o!0$n^DY&y;&<_4H8y9b0L^-D097?qj-)PGj-mwacaJKepn;t zqOH`n4I6oFO%6d@^O-HW2Cn%6&(=y&b8fL;)5WGbM^QvuC`7B733YzkQ9jeW1*ORA zn|9H8e>Amx%?45eaF)3p`Pw%v`a=f~j1$f{XMFt^ebTt((EY{}9)9jPd~m;x6=Atj z)nK0Wwf||n;>BMxp8Z2F8b9?j|7~1-NLQHH3X^wB+-E*vJmj(GjNkmpXOEx$AOA2; z&_%5O6ody|)n0Yc1>?tm;CbUY&w0*x?)SfNyy0V~jmJG?_juv=eCK%n3tv3`{GZ=3 z_UK|7A}`;ycCs9|d{xW-an}ca#`uOO-eElbi@tvR$ctV){>y*;)p6*!Q^%1*2gb>F zx&Qd)C*N~C>r1|I{OFJU*!YcC{L?t@)DyJ)c8!NU_CJh2`|mFp&zH^5{>C4Tnt*1Wd5*y?dD|3pguZR2yLc-6w|+<9Sx z97+TpoEDne-sHIChf(Zp=lsN3S3X?_F&;M?a`v{UHbnmB70MWrRbwenl-U`y{OJlZ z12Xz0hH4O*bZYXaOYy|07wY5}EKuX{ZMhUK6e@fWBW=O8LnZ0HN>k zX>UN~*f#8X&i$wyfg`nle2Vw&i_+uDV~&1{W$DbZlj7yr^3!o?yzxJ>@5m z&FiqE6T8*1MtIPGI`l_K_7*lr3+(u{X9zz-tIg|_# zIr+SXz)x!{a&*{~Zk?nPIGD05kdGVAZw^(y@S$CPsy;P9Qzpr!SRW^z+t!ok#EUV{ zT7`EGk>R&Jt!g2O*2FUQ+NZzD8_IcEBJB`+56qqTK;QYgjzV-D~HF?oYY& zd5?XMxz>Yiu_G?|XyZ5yzOc09!eOO4n6NL~rdUz3_=5U;RIU`a*Ll2~SAO>8W3;_6 z8Q8_pGOr_Xu1n+ap?>9@zBrx;%wi|rzBImcw22r;V|ZAnKIal)ko9rV{hXI`kouq8 zgeyPEwd^V;dRP$Is-uS7K>M7w_(H9RW!75PIZ!8DW_;+Q>l7Rh!rp!S1{Kn| z87rSs%bt|lp4!r>Tr8_?{k&>RVd|i%zVouJdgwY&D?tUm@(?~m+qT8aJaaf>R&9+| zVZvbx?=jnMo%AL#-_!icw_Y|LQ{U6fLE2Z_vk`qhF#a$9`mS-(3CC~wJ31AwpLH95 zj`v;v`nvHET{ND3@B58$!=>Y-+nqDcI%SMEz5ZR}UXOgpI8h7prt7a5Z+_F8#*y3H zeLVcUGskP+{(r9fVL#=Sr3;p2=w*N!*6>1|`@DR&rm zJL|-8>Gem(gYJFKc<(#jICh+IuW|P6PVj<%-+SIQj=Sw$#$9iJ`q-ld@rKv_)42Mk zJ>y>Io;iO0hktlH@!NlVJmLOlj+^#fFWtY4eLGGa_rBNJ$`9b?yNcOJLf_m1)WU-;Ycl3)F) zaa*nLYcK!kc>6mp95<-8cev}hN}GMvE^F zd>f|@9*C6&^Poax{2}_F;j|pq$QcU$Tq2k@G_-Y(cPeP)y4>OS?i76n7Xw;_mD8N+S z=@`UXj4F1`!l$eKq$5abC{|mG9X!k=oJ^fe$Difd`Qt=%^xV|xMZ;?%whgdy(OD_o za-1RHDYi>%u?b&_S2-JlOn#Fl2DJtZ(atfE$0qTxrLPbcwuGRQi_46K4N!3OT9#8x=?jqaOXg_Fr;Q~gpX3TG$BM~%;oL>39HevCfjf5u z5Ps{th)x5q!r>Hh?k7k^e*F^LPF z&*ku)$Nq@1-0~wU#N#`X`MyktlTUt0Q11L6p}Y6+%QqPCh5E^>i7!^?g?ASp^O3Fp zmk;^jLypDgG026J0smo&>4EF79B+Nc`^H_*J$IbAcZ|P!>CcTT#Yfun%2#@%WV=d*0afDPKRH z_pB$38}=y=zD`d`v6i{%evt1O72k8hqDr)oPcHn~MS-YuK7%BZ7$06&93Zx5wD16A zBN<;`Wq+Qd@IFYmBSK%BV^qg~)?`p_?KXMYKUn-Sf5f7%hje_FEN`&NCobj3e_>NR zyC-(}p$Fx{C%QgS^Rk6j-Ne>|NJ%Jj41qDWF?u@nLM-bQj2^64MKA`!V|45bQ>_y& zvW&c3fAtBaJ~1*pAqp6P+;hl`nr?kUJ!0_zdCw`Cs>Ld$txFbEkg%Ti1P0Bm14S4o15uWJV>uJ(*(m7iJ-2F+@eT9?!uS;go#EXZ7OyN-PaUX6wEl?)5l zUwt;M3ID2=*w|v11;AOE_2^|pUcl9Ij^U!hF2H$RCDw9$I^K#hF13`)+t#wr=3x&z?&T9@wEf^^T=tF>iq@uOXc?Z)&zz1{71B?;cxviR% zb>`7J#z5?{Lum}hQN~H}a)E?>$Ybi)8tH5;HF5kJ!;mS3%{rfICDU{1L$0Ol`EjJ> zbqJm9X(TD1nN~^g>$z%Od^OQy?J-CA=b2$}T_K5&1)0?ttS63*qs#iN-05rMPIsT1 zNzM^`9`xX`j?I!EuI<%(N!(`bz~ILjE`VH|mY<4ce+e0l>{j*9ngP?r2g^SW;+c8D zu(jmOKDkJ$XZ!AR!V(iGD2%IS#P9QW)`ua&a{Oz+#1@b>c>r>9{WtlmLE6Sbl)@^&CWvW z4p)S{H?W0swdm>53tI&^zy+nd!X7!~FQ51N5sojV?+a##i{Je>7KL__8@cGY? z6@!aae_Ui79PfGkUyc|2z;nj)p8KE2n=UzieA|EgmT|`Mxrk@M@CELCu|59xdwg1+ zlJkpNH_0zQXM5AZ10MH|gV&E&{q8Ty-}jFfzvSn}iTC@w@eN<}IQigXDVki_?^kZ* zen`BNsg2zHc_j1M$e0s>^H!ZbZ`$%TJhVoj6)~QSk(QMJ1FnwyBFVkpjFNU`ADe0+ z8g=8jhy$Wnn8cTtGQl4QMCWIar6Pf7vq{dFthY)ezI@WRNW=+*wLu$!J9^45^*|&8 z=4J`$U2ob8lTo@x6%u_SmW(*~v~n7YABLOE zYnSop;r!HA9X-Z!v)UwsAy&8A5~W6@*jc;oW#10yEp{_m7(48(FRZp?9-DP@XI{K| zV5tYKa|ptF3B!fl<9HS>cC}e2LJrT1GhK@sE18w?=|YjW^+uYv6;0Dpd@3n^zTh+2 zn~8r3vkS*z%NXc*9>gvAlne@@<(;ousUypVbGJpt8iNhGY&@f{R%0h$VlQtDOPTYS zWVG1X++LP;A!9I<)b<)f)ok_kk&u*~EAcD|ZaF^L%2#yQL>{I#`{_-#9Y-x38|Oxt zAWFYbjk|iwiQ9oB_56f<9L?sXL*!vt*ZGPZmU)D20Fv%2U!S`Wv|en2Aicj@B z*KGB`q;Sh-36$2?AmFSMO|Mbzdk4jtqnC_a187}!=gm@UL;+=tX0p!UkHSiX%w4ix z$v4TG<$_$S^V*(rr}?U@$Dh9SvhlbrKAr*3e>Qf@#o@oaahs24aK-CaYNkbapTO#! zp58_t*1HU!;FTZ)u^PCOt@nfSPvL#{nHLD&naIZPY&kMyz@Ty$gGg%WFMhJb$lZgt z$P%laqEQ9Mt$dPKNj+9_=pPK>9kA=+$Dwik^?d*G&T-<&r}!sp4{{N&7`ZEkPvwAf z#w(e>CMF6!!9-4sLkISaef##0oxAsrQ%*U-zewfZ;@6{3ysis1Q;t*#^6?@z??|f# z9s_sab1|6gGb&Cr_G2l2)GCLa^1J-mMC0Ye@7U~JZ=Sp}mrwcNeJcp$Mma7~5{)#I zQ(_U5VUSPHL%-X^8!;5pe$ac(*$O-SK*R}l2cKu76{_#N1Ok$r84JGLwJ+)heyK{$ zHERJg;I?%%I*eO*L4EhbVt`a7#GAI{P4yWGacf@X5V_seT5@4b!TXM$YhPob4rJSM z{P5XAtrvfL1J81qbma#|0_HM5UVv|W&^FK`7J*lO9k9;zg*f;nqs)6UMu{ZJIRs;5{y~eUUgX@z zf9@Dt?KnPX(c+i5d^L0TL|)~ zI@%t;Wn(V@%q3};1X1T~ZERQTnjBRjZCqqHhH$~BW}Y;y8?OsFL=?iC(c zk0*T6Cd(Rx`ogQ8neJK#RgXMDr{4CapgtcF+&<7UKJnx&KE;~Wi`wNQSZqFa9Ld>Y zgPEsyoWAESl2^OLM2x$pqewlyjDrVct|2QoZux_<9g`f zzcTAsaH~h3QyqYDino8_B3I#7=Vp8cZHV(z9sAs2|M*G0^(>!GK*QNFcFWhH{d}GA zj`7ZSUo>{@-CG~e04zKEQcM>T_m!{OqwX}5dXpz;qIO`SMrE@}DNa209`aOFm&uDf zh$>T~6@+}Y0EY#(5H;*+t)qr8~sQDfAYa$yDbus>6C@~Nke6HhqK zcg7DKA|j92daz(MzE0N*19F?}Qay4MZ<~thg_hW8sTRaR=Y`D*upe12HKaxEk;$CA zL8xW%3GaU}tb9V81k{rceA}grz!RDEjgVA0DCp9s*2QM0&3OlbP2Q9RmrmylvZ2iUw$5McaKJgfvW+y%D)$?EUy!IsUGmqv&!bRj= zysfnKQ#V$R9Nl-Fl5Q zarz-E+uJlT=NLIY69FgA!*di_X^PioePlUBQ=dd31J5$+mabk%?c09wgkMN{hiLCO zl~f&{XOUY`b(G%j5Q(rt&$-!nWb*GdE=n%#8=&`+XO1{GtC8;@dj33?$xr`fi|nW+ zPWpUC0{EhqUbdEjWFv#L^jWK369$*qdJ*H(ljt6518`WmAWp8x+4HEbd{cktC!$&9 z0@HD*M~(o}=<(FxUHjyk3nF}@^0~rT*&2hH4eb+aM(f&P14x^p>ihhXo~Sd3EvaRE zj6ovBroO!LFju_MNF~$ShD}tXvgb$$hhNaTfYai{r!8GrY8j{G41$~y zYr(|?k0LotwmNPlqnE#&sNZh9uUg>~4~)s@Pg|(pj>$ueapXd1^cubEh7Jfmz_UXj zG;rLY!nfx;WRw6NACnDXAPq7OOXkTMfhj?53gDO4T-v1%DUJ&xu3E_JyZEMUzdd6) zU^iOVVjJSFQw~}!POlURaZg}xO4sqqSLx`x(T)}^m_e6rHK$OZ?U~UMq-q9*6mGHGOD~Z~r1pVZGslJX;|WZ%+RBXvkqcY5k8y~6ll@W!s=R=lM@;hOKc$}uMyNFV&RJEXxgPeX?q==_FS{k2@r^}?5WWE|qn>Q&=tsQdw#?OPe95u4%HL!hGW=Cv zwD?|H?Tlr^FFvc^)ck^z7o6HZifXkbAF=JrJS`Y{jn$48GH*o4{XQSn=CNmdJqFj* zR^?M|)`@m*k+aQxaPYN3YCUFApGWN0^6K~2B))CpYn4N{oSVrRS8ULljoY5HAkZfi zJNe*@rm?TDe{hS(lB*Jyi=E9GPc3rsX!Dwq zzNyD#41Bg6Ba*MxogE5zcJam77ki5%k4^VunL0&I-(*ZNJc-}F+ON0nujf=1Sov1G zg)d#rpeX%Nt|6#N=5$4kZqmhnJ6sVm9C*Q3A6oj}Z$VP{nwob8fCMMsRwSX)d9{i` zRuJrXH{v^<6%+Y#2Zwh)1hAiKaf96b;NnX=+Ieu3+__Yo*z!!@K`gJn-x;Ofxdf9* zVobmyhEK;aWa&vNJ(N2&)vVuhgP}o+sMcS?mqF z)O(rBZp${fB@^r711xp)$kgwE*CcIFeDtlj4e1j`w)`86RSAO7GDl)wsOL5@uxVb(2J>_T6~Guw$zL9 z3WvYg;v+Hb(+}j?@Ks^cw=6yobd92?-)tE8d7U(FJ~u~~T!~k#w}99Pm^{PNt~ReR z*MvTu)^&cdcV6@zBf90hiaiWZ_u0{qUp90ezt;^~wUF`cXLWwThj|`!tMDEtQ1RsL z{K>_B+YTA^@zXZhm%to+;*!_exmnL_LfIL7yx6kz@lofSt!!sG=;CW-wAgaCUdx1} zrY75Ts~n_EmpZBSyhZPNIbZo;{1&5}YrQlm)mCi$QnK=E^9DKylp5pB9+%)%8~nNM z>PxV8o)(|K9Dy`gJN(6Gi{X1+B^P{VLzZI`T;QhegH>y2*)8g2JSb^cGcAkXc@3a< zzv99c(7rNP5!sh{I+mtYKaKW`K>_U--mf>Ela2 z<{WdJYe#I?g-zJzOTN6mBSzyK8J|app!_61Skg^Qwz6ewnmy<>oFT0ZVQ-mgqnSM>PXuTzteL$sJz4L&gO-?Mlw4t(I98?rz z3TFWnroAo1WG{WZH9`-s0_o(>aSbbc$8gbM;iF%z9`}|lI~sdf$b3zlvGPT)Hz;$n zvP#Tg7pa8lwPb~#smIvf-S4^dzV++&seKcCaL%Ds68V5pKZwRP09yG+>dm>QW2qd* z%2IQ&n(`#5151W|C6R-mcyr+mH(&i~0mUa6$!rhJ3K$%ytvK#408z6*s)N6-_u|$x z`RHPq;HNPzBwli0hAugXX2)~xP~#SST09|gub`MZ0(~~(ZP+2}lMJfWT7p&>c=n#v zu3hU_0qkpuF}p%nTnK;VCxO?gU69-2v+%97hnA^b;?B;HSJQeCQ?zQOB!(s0o9T8N za?Zr*97Gj2($FF?qut^YCR&pd(N_AnqMtdV%T}oE_cF{JwIrKoPfxqWIlSv(iS~)G zpowb@G)0bs@Z@DsAtydwq0))$(Tc_dl}PfXZstf^Ad3!iO#-S;f#jz-x9qfG+w!LN z(Q>*V-L??_3m+R-)wzk(x9>U*d}nMixEZ2g_6OfPY~9g*)6aU}In?5HSm~=*w(W0| zqGR9qe)M?biEZU0S&2OMY{|jWf>r$%0#hu!A0mT#rAbqu5{t^H>uG)XKug}Ft|ONS zE#5O}?DN8}(ySwAK-U;i*xAwJij$_9a?7*DpTiws>Kd`Yd|pNixLR zvZfl-sPwzu9ctD!Vc)r|Vuf?A7`mFe{wGSIst1V4zSAAuQJ$xL>vClrm3v2(_k&`u%!O+*1yrYj1veLWJo^iXC z&h{F$WPF^#W*xH$y=1N9SfbPM8flK)$I}3Wlx{HoxA1n6_Om7$C1q#T0hDS8)O0Xp+Z&nX~S#S@=Hf8 z4@{#>VO=d3<1(SiGj0$``HIkv)db zJn3owvcs>9YYve^#<6u5pOv#1`z@Jw=F@6dveH5584Im8&dog}!_#O-UNA)~g`Qa_ z?#kG;!U1!NUAF*``tIro{4-`htj@VPzU(eOVGOr2UTR)4W;1CG1kf=yHc@$S ztc6;q);=fN?B_Ghc^*X#<~H@ZAxn5GN;=EN2i9#y;aZ*|LfMP7g1zn-1w6%Zf6^D* z{+c2`vUbZn{#P;MOVaYm0h5?2vOB?bJllBJ)EO6!-DKwg^z|f@#m^$EzL@pgrW`lg zqhvM1-N&ze%c*4*XW6t{boAl!oMbpr>pZE4I&QTU$Th>R1hy}~JrOQOxn~9UJtR>iL6tu_D$=)c3l@@!*`B_!O8NFqJ8S6PHk)pXCanqL8olhXNU;NJ1LlKV@wIkcc|m^EH{;$ zjh&SCFP39#H5ZcDcLPIkt1b-K&?0WTs<|QBTtnK5vEW7U%h;=h(ynrD!sUW-?Tc_- zZ6A*dPMht-c(bfyu6#x(TXMvYHgwLJSm==(3({JV^y;_I0)&V4dML4Na2%~=_Stya zmFLLRnu*jli>BAwidMBwYrMNV?IFiRym?F*iQErsnssQg1GCuH=JjK_wc?Y{jDec> zF=xK>?)vCqAH-sd%f-$$t6JB%QW$vmmYlP7K13)!jbw$FABVJ$V6CaRi5EQn(((wc zbV%kH<sSmV$S%>dl zqt+EIa(ri8i%yij_I@T_=dn=vZR(rDY|e4oX417w65MdNMw>?4V{yc$VOJX&&8mf^ zLMS4LeWRtcsm!(s&&j4pG~SaNR5Zw zr|CZ1X3nu=l|)wZH5-c-UFYD-H)J%6t~dIy>9dw$dp_v6E}Uj7_vnL9zw+=l`|q)5 zEIb-REf%cCwzAKbe(Te2#-LATiBUQ`kKS^z!P2B2bMD&t$!;wNBx>8no~*NCwOQV> zH1XeKho^Ssr~0vp9iqjD=Qr*0`OF2Ab+yWqGe-MN+<9!7ulTTkcGk^4X8B6CimBGk zG+(WgV0~Pbd*Q6}x@q}p^QjHq!5SYvb>l@ra;qY@aE{?xA@41AZJ)OARadhU)}89N za>=bQ$rF2OP<8^XFlnQp&w4hyp_7jY*X4R<-cV0|3)@YY!qAn!#ctLuTaA6LS#6D3 z$$Oq?wQeLtwbIXh@o}=~7P%TmY2INs*9|TG!jzo8>)y6CUkHq`yqX0c!Q4;nYYgf$ z653S_*4KV)#3Ya#+O?Pq-^U*!@04X)`s+FOxTg)WzRnFLg2{0VkDT0Ly$b+2tobw+ z%zAOlcxsz@_l=Fo3Oo5)c(uwZuLIt>^@ta2#!H_Ke}QQSvRZCT^*2W>c=Pe?N7qCf zGH=Grc48rSt5evvTeVh3zk*ecoojUNyD2+w?aNh|`s;0Swi7*riw$kPu1VbS==(Uc zg=EDo1kO$Viof~!=9$)e@oD>8{*jDz;+8l`^@VnoMZP_PMNcrs;9Kz^s?D7+Gtv8z zKDt=e&c2#wi=NNU5TDq@BSvBY7O7p`y6^bN?JYXd3SYS@zC{KjP7LcKk&b=hMi((e zIhX(BT;j%e{uY6_ZCynWj+5LHKed%!bL5tqN#q;~$G+{!&m=Z7@L=T6Z6V7RydRy5 z68BQ*+;Id`uAtPc_4L!W01Nx6T(~RjdPonJw(m+UrlO2hCu8R%%0xJC^31xyFFDeW z4|2`ga!-AhdTeXw*6wNyFofezgiywi+TaF%=BazRbq;QW&m5<9>P!6OhbZ$2&H%Sw z+s=8Vvu7v49gs@W?r^UC5`!IRTE?I@3dt}?9sF3v%Fb1Htc*2dfn8+UlBXFp_^+C< z2Pe5b8KRwI1hM#Y8yUdWabEetqKCC3nianN_olrzgS5vxd>V*Udkh`7vkrcPPzj$k zh_UvzPmJ89s9a%bmyLB%^Cw-_U~(>SaD3wp6Cgaq{F$W7$=w}W+Dazz6M1yl;e)PP z%sSV@I!+9gJ$>w@qs3Xzqp@n;H;=zWab$`42ON`*8y{mpjpLa-uyqStGRM++qYn|k zQ0bYxFac08;XMB^@ogIf)I+j){@7<+l7O*cYTqb}L|wOz%PzA*TOb=$9`cd7PRx$s z@!+In^+!;3TR|rtlSjqi{Kokczt#nT1Ns?%G+8ehKjZP7*-j7VAfKg+e{z%nol}61 z+@x;Ki!ksuE_qmY3LZa|OTXE2PCZKGz+&u=7Kk#2x;vZyOqYN46`R#V4#^!k{;)CF znDmlouM=;gDyPx-wPnQ@2ZQ(0|?77D_4nWMsf!g*+Bgx@q?}H zz_PBIGDiDGSH2jNInPm1tMTI|0`i9SYa0rCk1pe>Xkg-%R896&{3<8(4X73pZ_mt& zc-qVh{nWg^9YL~Mi=4v>$FbP4GJ;J4uN7Tu8|w4wLgj+B?NI>ORks*Yd<=RcNm`Uf zu-k$Z)F9cb$$>a81$-A1NSLWjY)J8@HYH;VXTG5etqW#f+0$w(dH0iNWF~hr_Ue=g z7GgZ0STmj;XZB6iOY&}-Sdtxk85>XeDOW{ZgV5S|P#A0miE5wL`l6-YBEK+O2W~kn zuf=E&9Lq2pB~SyCai0oSr-Y1c zg$vDN$U&!8PYWTOcx}lgvN_kdE&1jk)a|&fp}rwZI$u%vW&zW(G}< zXKi_?lYE%d_*iX_+UnZ8#LM}(cynM$$I|n>jA7XlcZF5ob62tj4;5aDRgTdwH4-gzZ;EGNo`*%F*6a$|tX&n& z_^r=HlJwY1yE-qYMD4?0gIMIHx<>LJH-%3PEa)+~DQ(wtA*3|1$ykeOK-A2&OJ~u0 z-7et56`x8*iAA94A2kN``@$ZK=RthVX;v>b_Ep?bRPj@RisgOKmM?y?+w>KVeYlh&H{*L(ZW)kYN$D zZ7l&CvNn>pfj)n5EROMsEZ*;a(Fd~r3u z%t9`_FXY`0F`Q9u_&JNnT!Lg<=@zc!yz4-=lUwdacu4k}E_l$fgZ%DH4}ZabB!2ka zEHf=%3?Y`<>d4PKEc6H&gL>rV)krS#YI|*!vnRsc#K0F}!xvWZ{OeuDWT|4!xZu;n zhjbEnjx5U9k+FbiT?Y%~tK>desLyZWtlpVsjQMk!p5%>Fa^i_EDR4zis41WECPV7P zUnJ}sXBdcf@=IEdua5mnPCOA)ZiCc&8zE-y8QD<&Cp|CH4z?jan?~!*Mu&1 zQN)*8*T8kgO==Wba$_!1v-mZTi50~4fT=wChY9?TC*+J)BCl6HoL=dPkrzySr5+xW zD0hO=%dd6XlV#K?wSyQ>{Mx@`M%Fd(UnSJRJ3xgIS@HHpIa|E^4s^u7Q zj%tD0fBRt5&UK%BVNLx!4(zSd=47j1^3^dS8%;>=ToPA%=1X$U8Tc~Rxly0w2!Prp zZ}HekoVgWe|44$*KRe-<=;Dc2zK|_)c+XwdOLECrjm9mTdc=wi;eum5dd}=)6~nbg zhmFUDj3*w1BR~8K!??1}$VGd}TpxVUIO8hO6yIjWRyOlLzwnRu4Zl2BdzSfD=A37#n&a>_7cJFS9u<`xlSWV@|rx z-~K9w=TxF4pYZ;Rx#u}8I$DB_`gTuz`gVXeb@2MooS9EVYb~pDGh_1Wy5uIp z*f*?N=1CimtY!J}aU`H@eJ|eYhd9Y+Ij4~aHnR_5!{bVLYN!@lYLRn_e0Y(yjpW*S zwrpGZI`@prn6lt?$Mwc9$B!+*s~)r!Bk1CBAVNZDAA{J7x6C+#fFlx=@$m??|H`#| z_BjAqNG&eBu0>fG8Kc;&3F+L%kJp&}Xlx2XOdmJagVScJ7~QDlx^{Kl+dS92@YIm& zW35)TI@ih*5*rJl7q;q(IuZg+l^pR{qHR!(OC%|4GZ&0r0YwtO{yacW)rPMa5O^x0PPAANUSaSsY={5nzd z+`)}*o;zO{${D>?2*xK#3E*QBeA@=#8Lc{0PqDfeicKKS#-?7k)W;6ct;lP^YjQ>5 z^HSqYSUXjrh zr>8xHhh3T=;2Ht-yaZ90T3b-KmA)S#eC5#?le#Mp@N>+S?TUxi`R-x2=Bw6EWa4?M z04s}%2S6ft`!h5c=Zj6%FYB)Sh|kAFD(9Xz%MCJbaz8N=2Z~>MbB;bYyDKarV_N6k ziU-ry)~(uJKaQto&dcFF_r^&t99-*qtpt}Gh+)6WMw52IwM$4$tH~}kUga81?;C>y zG36`A`qW2Ra~hq59-~NN;)POE3yW;-U5J`AD!A|yr1UMHvC*xx(r3b}Gvgx#-REI? zj->hZDQ&?}Cej|=ljQt|e zCWY6Hl1i=6gGHCd7@JBPN3mb}@X?p+#vU z6D@UWxuqtLlU-q#>mNw6X8X9xyeCIEn_D@r{O{c-1=$ zwH}Nfd{)Zu*09&$kS5_|;5&VAdYToXCu+Tkw!Lw(XT2sPb=$ykefwN(y_0MmceyMV zqC|pZrzh_h@QIEZ_^y~pCd)Vg`A-YNqHQeha<`+_qKP==!&~(ou5y!tJn@b`Z&(oK zJsad)@vZvXNW_~L*9ALj;)j&vi5vXOhPxPk$kZ|LD;Z;B_0&Zz0qL6$W2{&{(}X_j6gf;`G(V{s@$v0ZU=>@##Jk3rp(S>`;gk=LLoEpB z0VIZK-1UYZwYkXv9&9iK@A^9(;+GF2G+t(q^+fHBGYWsaBbUm@GnvVTLc%F#;s^k* z#_?nBc8N)+72QbK_!_B1>angZRrS>1!}Y5?ny~SoMKh7vv`b8Pio&n2?;_8MY^oNC z9~A=T6$7g4*SxAjuQg&Nhn#opAH8gSUUH@OJN0n=*nt$@BdfgeP1kEABF`Ps zc#;#87ajcj2*GRQY1AVR+QcS?eORcL%_*P<7d|&?gqI%w@g8y>0G)gN+_Km-vGp

M*Kz`f3cm_})jjJ|y&g3qz)c5Ts_lPsg93IN<8qtwN57(EZ!$#3Qm zyNurB>{x2iv002%J65pI4Q!GDNOkFDn~z_1mP(ejU%rY*$1xSEn0mNgP><6JGOx8m zRJDAD)IMxyB-ZNF;wL;I?2{9K7|)OOq=5qWNOEV-P;JHf5rTB_ z*kfa7op{?SAIHZw_~6QicDW8{9T`#c%Gc*Ld})U-dVyCXT=l_&MZ>un6OYA|_&m#_ zmWWz`oR_6#Uu!w%zVa)^JmVms1Uq$JvR4NJpK>AVae5qm(D?r$;)~Gz8ex(!$2JaF z_sGc7O8bI$ivx3zqd5+U9xr1uim;YsjJYQ1ISC4lK1Fgzf&EKB24f>M zLDjV-JjtQ!K3Ht^v~D>U7DoQ_?oeV?CV%E4h6Kp8p)-d~8uyc%IOjoIxl&&1zgU)|{!&R65)R3>p$A;K?y(O19yo2u_McKwbhH>Gug(v< z8j~#*$E{?Mwrm;?ek2PkNettFgHA1Z;w(4o?1Qm1n%XYpG)6tTlz@{Z-5 z0mW90Pp`z-f?h!k z@!EmP$N|t-9g6JRrolNR<0e89wr%>+EyuTHnZtF8S&z@oL*?6c=xo^5k}r80s5;5o zb6nWcFJl0U4BH3*rxlq4!x|^&l7UIR$O268?u*5HuhDWP5;EZMD0(e)-vo}jL_#`@ zHg@#OZ+ezze3BX5t<=t2eB;Hgju~=wrU(ULEb1etEff2~MV(75vWFUb+p;Ffg>FC- zsUu(ZlBg+65Px9a|(c2G}9)vDk?%+hZLo$mq$8H33i^<2+t<$(=ZJ z%&;PZ7d9k2+!!P#PQv1!v6k6#eqcUC&e<$DHLaW1s)QMdsK+i{SnU#gvG*u?Y!b8| z_Y5zcTKkpEIGqP!{hCc1sc{IF9OT<~|DA)dv|x=XTVldF2m0+Z@mA-K_ODh7>pgyZ ztiISf2U!}Gdl^f~jiyB@Zow76R2YnkR&!k-Ox4BDG7j5Wl9BxZ_#39Veb}+_>)g>&Kx(N|Sio#r;I(&@Itzg*ld8({}cA|5&>1=>I9q zcJyz_X)F5oHlBj{P)H^mVN6s+nF|H$MW~@p-;r`v9SNQ@|&q+{NKv? zmiV19+u?7CpIbt=B)?mN*`)tl`8BnC)^B2OsqW_J6TxoMv2ytL(7)C1v9SN1{Qj-^ zd?K{zxBHvzzn5;QpBcAlb1WaX#Q(8;AB#SbJfK_Z`&fRr(;dtAv2;zh1oMf|c6mb0 zPwk1ie!bwm9~nFM>>c;fMe{CQaC4{GCc2RIrLT5;HkyCr-Lq@Qc+VwQj~lpX)#w?Uyy|USG~Z>Mdg5`b+wv7P*UoZi2S>)6-o{1q3FGurjvEJVx=|O*haBiux|MFF zTj^H1m2Rb5=~lXx{@+PQ#-81~$F(;c8v76L9OvKbTwOFD(sgd%#V*oyZ|;kav1|7( z-)X*a^P>6D_r1$Fjf>`7B^SZR6?;CO@y55kbKL%nQ^(!!a+a=@J51ZqpY7-Vzefkn z`hP2J#%XH#X53k}m9FU%)y*xmDLWQ^)7Y#?o3x#7EBUefY(<+nKyAP2YwmBQgWAurbWL0Jq1k>bUpJ?tZQ8_c z+WcE-J3q6$^VrOxX%qX2=pbaxL*1XT&?bJ<*X(C2+gT57hi@!2^Ux=vgSNvqZ72Uk zsr_t~1GK4wHnF!v2j7HjyZ%V&bDbdLOAfWF zx{D6^Y-_u@-9iVMFTrMPlVr;nXd^PU48f8IExL%0^4&U*1 z%+x}gvaNK`!Z%akwQ-cLA?RRcIfTx(rQ2%EmepF`s#ccic<}$Ll(6-UZ(8KlLe8zu zDeh~Vb#uIeEWTmP)2hGVCf!Vnexrqs@=+}`^QIEeK-QJfRyi*%dUfVnLz@^nYkstA zy9Szthf0rbJ}*I&$a5jJ)MIP1t^h5zZMS0Z(SkMm22JeJis@Z_iC5BT)c>?;jcGI4Sei?#ElOo7 zrlzK5O$%kyWG*Qsf(U$N)I>|f($vh%)TD&W)Cn!ajV+fTwICN1#SIV{Q(U3k!Ud_9 z-#Nc?-gDmPKX~rB_kQmE+|6Y7v#A>I);Gz>mJl4)Jd*PSJzRX4Jp<{zqUQ%q>~*)@ z1iVhVi(8IrtugqGKj&nu9Au#DuWse*K20AjyV<#-vf?&OmFqenH~%8-KJ!L!~K16;7%5QK)|dISs=LQK2+ zo4GK^O7g>uHs(Y>3WGW0Ii9qI8%4qWzbJ$X7~dv@Et!pTE+>U-D^ZJzyQqP9?d=3VHN zC;8~Iz|uhcAzU7QP7U${kZEaq|^>FtHjsJ03k)jCkTxq>rl6{;AH0G zEwu7J9&sv!!aRo!_MmARD~#`tdj<@>@oT-o#Ih?-FYS-yEEXd#+o(}L1*aY+o6ypv zPtw41DE}ltUJ~ZXq72eSA8Icp5cGp$e)BKuu?!b7P13>NA=%V4y-*QfL|-9ZKlyd{ zQ;hzgO6oB!FgZe(ABVUi94M1?sf}{yV&3D9Y7vf!Mu`SIG9(`C5jz;`1E?B8lIKX7 z4EEl?`{Dd5vNBWycDg)=;)9LE?O%y4KJ-C}NnKoDyLRbTR44w=SFfG<_&9FKc+t|6 zVYSs5;wl{9z1BSgEyC=ZY|Kr+l6q=owQOFr4It}9=WQ(2+HMS;50;}d1QvRIxBpxr z{iHxRyjf8-2!lD=8tTUS7*y?p4XqoI)k09#b`mgyuNCjv-tJnJ>d2fLGv0Z+cY zEukW+&?vRO$bTc!%9Nh*K5R|h!!Sc<-W?gef>8FTW)NJ7{_&FQjx)mP_ny}al~Y{k zf0VzTaR`;sb2o~0>X>ZpVV)@dOJrArd30M^Z!oaD#cb~RI<0R$%YOBKZ6z^bmn*9X zCK6VhaJdjeJ|LcacdfXYpkq$M%@6IX54*ex2xc{&m~_CTkP)VI$`*(#;5@wDDi3XQ zW2^WH&|haH4gY+8`(p8mJwI~s;#%jN5P+~HoZE4%^U^T#O?zUXZI{kPy);>*f*fB8 ze>_rZTEGmU80!Kpb#8{W#(fv+K>oFcxMnEzyCH!~&APi?fsx^g>_r2O51^>ZWYbUL zsSC{}EXyRO(39+o)S}<*Qh0LySX{es4*}wHY%##j0NE?N4@F%*x=0PSkf)x~!1|*~ z^3q3}Qa6nT`~n&8o_2ZAYPl1XQuDYR*XWD*1NvFN=_!h5L}<7w(Io473RTzN=USh? zksYpH&sJ=2dhDP2O(g^cGtjD60l{wqTVF>hW=aEFs{;N;883gS`}N!Hw>K*5qVdoL?D9+h^Vu=FCH zSk4&N>J$6*I0#-839oT$H*^hJG~ki(xX4=d^F9%^QwJ~2uQnF=UOnA5}D?P zP1ih;gm79Wka5v_^eAJml~lBIOdS}Gghd=GBX4phSMu#JX3mDcLn$1Y52DLG4t6TW346>pJlbk;@ zLuKAHCY#>r{Ig3(yP7CBeu7Add}O^y~NHm4NcOa^M4sxMm& z;`-;ADF*_Z>jBl6($@(*FE)~GkDTg;a;xP=(xVh6?0I0*9V2pXN4b~99K(nXrNy|p z60a$u;4)<*G~{EO$v@$!%mHtLNypNl=#E1%~2DTb2{~~8Z zi(N}1teqIGQ#gi;YqSqrU4PAqC4N*r$MyHA!{D;t|NMP=vW!3mE7vwz}A;c$w3{B zsN4n=I`zz3+izYPF?ak#6b8wZ&eN_WnA_fCM@SeDX+bot0)h&t6b#57q=KV=(0cDxN03kNx_#bcXZFKU zLk=6v=xOErE=d-=#k`nY;r1s?B^yqLBkW>rC5@U z_wdW5{ui36@6QTF3lt8-gEJ9Bq2ld1XUJ8xZY*#0v#4;A&2Jhc@LBPWnclOZ-OZP?Qd3ULh#KRw)cpX?@F zVOrrk@zriGs`7`aiI_>2KQf~*87#+;!M1?do}u-r9lc&y6cj?!Kbat8hpE=^Z5&=l z)1XM<0>8PC`o+#b{B{Xf6)JAoSFP%)74ayXuM3F-4?ZwC#=>~9@f!XtghNe25GYI$ z3gkhR(WNa5mP|Q@*HWYA6&bJD#L!sF9$>}Y9k7(qrIVY0S!qGMyHrL;pP$1>dV-0b z%Bj&_kQ4us`(+&=q-{Q5LQ!>R&nFLb8c!a+uYE>P!M2+Toy0| zj&}#v@N4+&elV{(w|+x>AE%1OQ7-0q$2bcI2% zTH@c>PRqyl+A|EqS?QzaDomVlrf;;7cA!hplB$)L)bT#&5UECZ?LR6$!krI%wJ-5r z=n2L;f1~_3pOI?GzV?hcoLR&ySTRk1G|R}(A3@hRgd1`?v7aqL6md<;w0P050g=I+ zzcE}%%k*P&)4`wUtb5ER=1Qr}JrLYicq)Ne0;>a#kRy?ufPhlZ@2!+qRHbL&0?Iqn z9s;{dF%JSe_oO1E;^%<-=}*7;8R2%8wf0?F)>qfa`XS`@*4fostuaF@(_gCxpTEq;{BbQuj_CF;ZM9-LuK!>rq?f-&;4T3diTXLMYu zx3CD;>ZJ6CnD<5um?=PCX0&;3?LmCl|%)@eiW??irXa-8@$Q zjB(3Jhao)=)aK$L%(Yvz0NuWC3B&2}C-J~A?C-hp5^L4=NZUVjNf7}pq1o5@Pmxw? zBEYoO@gFfXGjwhR&)Z4|{Fwu*h2{CqywpSQ5sCr(1o?oZLd#C@xL&ldYCC={#c}`1 zgtC}w^3nC?s5Wb?pKzdHhPJWRvCUdSzl&J0v^N*GBb?PlR^}+Sy@Rq*{L!?G38B@? zI^D@X$TE~cVP0x2#|$y*Fzi9ApfK}hY=N;TiZb%qEo9vfim4N^fI>yp1?mCIVQN2i z&o&1*nSiL>8$o{DK{rEKxdqIOoRQ2bOK0c;pGDEwXn!FSD-rFJAOZ_j_G23;X+KP{ zDiHx34>oIk#0;}?qn2>;0$?wV`)VO>w6{?tn*jNS22YyiZ7Q=BaCYOF=ym%d4QhWS*+WAAVo(4s*KP_X&GWKHk^mkr&`v$UiMdJVE$L_uq;wUdZ_|U06RWipBop!0EFI zop0CLTDiJ5c~#HWblDgO?dox`YB1m@2#go99qLT1mOM_=gA$)!C^AbOLWLVa{|hjn z_UcI<`JeMvwVY$-#f0=PY&&YXN3`aF=Ad~uH{)&Wq(WelR`T$0y~_F3ll>9k(GGT2 zk<=I|-}uTpZ6v;@H%hWJF|;essbczA|Lc^8Eq9|H=&uGMd^K&xAJ-d5Dsr>Ms}A{x z>^gmKPK-=f2+w^j`y931Il}zN#eW~ZLhqseb;E4i%c`;1OnCd@*!^xr)AX|8>m_)3 z0@x?3sWFL1ium`%47@d)H@0ieDdTWQ!Mmm$7Z>$>e_uyH7Vm}mlc=)KuKbg{9C1y? zamUV-nDS>Li|%;f1k)0oeva^oiRs8N1ON!)VQo|tVn z|5%ehH&5Gd^!n~?^zgcZYs#ikU!Q`VrbHKeF0S*H>o#jfhF7FVsCBhJY;Uzm_KsWq zEpbTW%Vy4<(eWmG3%**O3c9+b472lX?8txsSJ-{#VW#NH*Q|#7e_$8ZPhNXyRy3X+ z$JIT+Ya9wK@vqRAz^+#*L;cq406DQqS$*5;iMB-t9KRD4`zFt?GX$U8wUnx70S!6u zvyo18u`$J#Ob)-g%!nMn?xe3i%7zx(LXYn_*x46=M(2OLeFD!3hiCD6 z%sDCY@V^oJx#F3TwVgLE5~jyDHw6yirjnP6TFZ^&R2V#EX;lnIcx-9yA<`G27x&{hZ`?*n8Mg<1_qPvs{0gBZ?9&yQ>+S5ivYv=j^tIR(>U4!nC-UKCXrsADc z#3?}vs+RamH>=|d&<*Ow_Y@lj{u%EHp5}V3_VYi8D_h)k=)%*vZQZk~h6^j=Syj}7_vF*{>HCKx zRl3@7%VJ19d_Hsu9AfwnTo0uBRJ1Rqw^=;nqQ+X3Aub)ZyJ0EuWnBO=!T=B%9NXk@ zlSo~j@ZW)gix~`*pM8$Ti4A>P7%lBO#E`UUAsy-sBb(>}a2XmtS}1C6Aq=sOv3&eA>@oa`*eQy2eZb-fB)$-B=Y4jB0mc-Fk*oS)tIQ{T7dO z4qRY;*(afLX}umfZHhfm=ZWyU4r$QtfbsKsC+ueO3%vA-^%GOUa>3iAZfH_lKgGDx z%q{DaV#hqMk$;|XPT88`YS-8I&aQ!FaBwA<6Wn(*py!_<)-J27K+M+0phU0UV+>*y z8NO~HTUVDK`K$|w#_U8B%$pRPuo;I=9M8wzkj6d4epG!rC43diFmq$|v%v3L>n0sk z&uScmV1W)n`_ZRD|K}n^66;KBD;G25|1IK;eMqCZS66P>4h487DnVx}ma*J=jM)%S zUl>qJ#(6K4N#9&ZZ@wql%=sl9u~7r5M@Ah-$Cp--my3$=0S8G((Ci1$M-`x(G$n54 z&Y{SdH_4WS274XSbo#rSZ-VIZ-haDYTVCaL6-to5TWp!)^2*r}rvHVm z&Wwf={tu5VJ^RyQhih7V*9+;eYYeAp@#m_HoFH5cqPOZ7?K|Uj;bghT^~C=HaOyF0 literal 0 HcmV?d00001 diff --git a/windows/deployment/images/table01.png b/windows/deployment/images/table01.png new file mode 100644 index 0000000000000000000000000000000000000000..2de28e1dd8c7f19994d0219121e8803ec4b86c37 GIT binary patch literal 38401 zcma%?Wl$VVxVDoJBxrDl06~Hi+=IK@vbY6z_YmAIxO)hTJ1j1XySp#2xI2gUeD(c5 zQ#Ccy(_`H={m9k#gexmbp&=6?zkBx%O-5Q=_1(Mons4hnB!ssk`yTq1Z=3hds#2ow zD#l0--U=VhMHEEdy{nEzc`|~3D}Qp3)^>jP4!!rk^?ecpI`O-ANy#$eBI+Lc$64^d zaA)!Rg%?hWTK`-4apiGPm8(8iDWfWXl*hr1`x6)U=g-N>$uaX?&M7!+xB4hS>6KwE z2mNs^qs4i<6`JX7PP2;k9wD&H(1G9p`;`dwZC9kws+#6?k)Q!VY>7s%#pPkXP6J}H z%T)cEN%Rew!GEh8Ze>{H?aWOT+Gh1N8De`(O*!TAzHh!>y~q0N_^S_*yP42^}H-s!eM9_QkfQp2fEn=%EH`OZ;OBZCu^_Cfj>+|LZv_W@bfvV7V^is=Q)Cm8$D8)7<{P1+ErV*?+Zx>C(1^ z?`6yDx=RL|`;6hpEkn?)+^` zYJYOvliB?zoghxG7rx(A+b-dW`Qk#dd#@Jafs8IvvI@n4tVuobS$Qq?LOqXp z%>YKSGe>txk$c#|7O20or<rN&7BMR6He3 z@TZIJ?-q=wEZDXCy&PI&ddOz9i8w#vQP%}$zN%G~QiyCjxI!hxoab78M zpm+Psy$ns;Hn4-X^3pQC&>S8xjpSke{xlQ~9X+Hmh4#DYXn6c(%=%^Rhtz}XhzFCn zrUBEZA!mRi>*rl3?*gOnD4=x5X?sYGCs>7}tmNlIo?JYDdfD{SS&XXs9lK}iz9SbI zM*m4Irh_xyWWw>*mVK^vX_WD&mM%G6w58t^D(4G6-%-8CgJJfJ99ktV^llQho`=}Y zpx;Hr0kd_t-P-+gfRm0=uyGbi zARb}|M27IfizsOzSCf-GvuCL3Ui@z%x9YfaBc?)62g=+%qOayVh)BCH=%dqJGbLbY z>aioITgDRR8hKYBNg+(qK@=>Efmo2_VdghQW3fV#eAD9K{;L6VuGzzKTH9A|vc`r6 z?Y;8nW`mLl?Kr(94ly&|4&h&@s^peUre{u)u$r`@F+NLQRQ&Tb4@U9j*u=v7w1?&m z2G|G6tttg znVG){v22iI&I#Wj=C*}(CAvBv+P}3uo;I=7k7i2AIFjQ@l(G&7Ka!Zc!epb)M3uEV zEMYswLhT0&D=&z|V8D|u!Y-ko7Pj{pU(jT0Y1#5(k$Go)Cj_5pSA-DL$D7VW*tR98 zdAYJ%3wb(wr~Ba{(}ZBMAs6|o1}@;v?-;%?aUJ5;_6@YHm7OwPK`_OEabb2LEik3< zW@^qaq6+xFXnw22ShL77@b4hODj>1nXBDvU**Ur-kgevkNErtqH3gzMN1!~V^+pDtSD?79{1&HUsXehFz8aRMTaT(Wrz{UWD&Zc=TEg8Jfe z2iGGHpW;fSn(?vflYvzx;#!3w5D!7@pY(H8x91v};^F&ty6favs>1g_fXQQp*`$IwY6AQDz$kqeApEAW1xN^xQ6*(c zsHS|UyU^I{wdTkr&$RsZZCiC=8F1ea{aDR!$Yxgd8ay`d)=>Uw+nV2T@6i;7d-z*` za8;Q;WmHv@vbMD<*`${Sir0xJ5?NuAIW?f-9ef1+U2SAy{tp=hezR<-j>h-w! z;4v=x(W5Ra23xh>I}8$jm0qnk9H|G@HD`t=AD&L_amg&3FBooF={%3nWD_iN_UNf` z8%(V)yck#;U2ZioiJ9V@)xAjf`fCEPjdIiPy9ow4F;zv4Ft<4e!R8*nSSxxg;F$nF zo$wEu5oB4onq|yIxFm7pPeiz6UhW z`muN|qQG5V0@T}X!cu<@WuCdN8*#wtqELj{?F8Z$cE84fUdzy}^!+f~N0d2@khz5r z8C=I}sRpK8j95F}?mZ(_MncWp`MVONzh=6)Lsn(;W$5sh&rmK)(q)a89t-otg>8Uf z?5a}4b$lSp%=?J0&X8sf#o+^mYw_Onut!^5oXsDz@2j^e!h)qyPT(DVON8}Q8>u3T zQg)7Lbp(3dLcnP&lU3pf)h^GIsxj8_%+ITRkmNNNqUGH$L>PM5uf2!f-ww8k> z*K2EW4ORZsi5j%!>5@w0zu|i3il3ZIfInxI8iI?9>|#P$ccegsKW?g`*@7HOwu^CJ zSh~Foq(4n{@A^!7N!TVsTc||d2Ds24;%4}HQCmEgyyX??ps&_j(qE;xO}1QCpXrIHS1_M*^o-{QkVjdbwHpl9*!n3 zu?SlX!`WR|;?l8o(*8n37qy{JkvzS3T05C;d|VqjN{l-Zwq>XX*G$8lB4#qm;D(Cc zSGhuUd`BECvKC!`P=ZkccjkWl2_##qa*5rA1&(C$Djp9 z@WVQCWre;*xT(P$10e8UxfUR zQeFM96y}@su#@{Q8Gku(tQ(B=?a?q;^?NOWw!`LglXBhxU~HFB-XCr%jAp=z``*r^v#G11Ygx-X z_fB-LSPyHLN10}UH9o&Ck$p|G?`z-7LX7xY&cU|H91KZ>)XpB3&!(wS*R`GpQD;sj z&+?&uoV75w%)al=Wuq2(p;|hOy2x(8$}a!Ns-Jd&G|K@ zgLus*iCipwua9B$V*dt}*EI2&_mx8e3)`Z3rtY^Aytv8piSPMObPVtRt^Cfc*kJ5EZu}B#|R~tS@Q$9(S^*$^z zR@Qa->}&Cddi^40Fin22v7XOd7jlQr783HI!W_v!zDSfz7mY||iCJZXn9g`VKs!Oy z;(Y&T{qJY>UG_gXprGG0QAc2xGbrBjcu`}mSMXLELneEcB%U^@yL%7tgWw?}<^iP| zG|)STK}!MQ>oCRRh|ee~YJ6VvBLM*3uC2EBcaA+0LBpq@&r#RvLr?}h^0V!SNTRUD zSSIZ=+MD*Eb6J##ov3mxhi^N@-sA*?C3D}zFoj>uG92Sr68WuUmRLSQ!aA3KU)nL_ z7=Bq|X0gbo&6Y&0VmwORiBFXpu^W@R!iD)R?J@8nrg(Na&ob;)dUn@2(93(E4vV<6 z69l=)TxVug5Mgf_X`cwlr0h5rCAL^S_VSj334_;`PFvy5%=7b9bwSFCCYf!=-|+@d zdnJgtlth#cq0uR9{_~vI%qXTe6A#*&4ILyzq2Fp^vgzzUevx94*yw~`emeR_Y+L(r zpw`uS70+M6n&%1OefND5STFi6jQ@voPKRU5Mq*zMRnpFW~Q-ZPrm2 z4@=^sqjaeg z7$xYj=DVeDLSW731E;3pb4KfBvJga`zR1TaC$=C%TgaK1#mwlkdfN`4_Bj$_U4F0G z7T3xWSAv%q0|Arm8gJiKt+6H9V0HO{%99=_gm>TQ9T0Blno1eZl3uGMZf8@g00JxMv@JZSNivI@y-1RF0EGgU5?;%H95 z5B}Yr)$G|!<-sCs#!=TUKcW!8Wq5U?_F1%c@ZQ1^`CVspXI0%+P3)ErV`csyfS%Y| zS<|2HkB)&!qftmxyykJgN*3ZpOyT4OXj@P{Zmo#k0d4h0& z|51n)@=|05v_)}~x&N5MZ5Jui+|FM4TLr<1;y<=I>-h=_od%nMI0`t*0$U6TRz7Ri zLcxV!yiyq$KcVIgS~0q5dxr#n;}jJSu9NQ($-oie;W9+vi}Q1lu}ogaBOkz4qMZwQ zU{_p-A<7&g$ox{($jp1T*lMXvtjUq|Y;PF5)>{}{h4As?LJ+4GGl`&_Q8ahA6>Fi0 zP4{8Y2VQZ&?&aoX-rg8FBIOvLkD#71YiMB5EVl|EHna8Fq9q5)nqGIh4(D#3gPTFwl99rp!yr?1k0q{IP>s-pzqCL7Ks zz9(t`wc~{*in6OVb!#qpas%O}rWTqPCv0wR_q&G&xgG_dt0q#r6S5X^>^({}ei|C& zPv><}3)5 zh@%dJ@g9&6lyj|isH`4KCKLvJbniPM)zRo;qWfp9^&B9gblW>A_Gqt1n|}_;Z}vDy zTSLM?=?cCyKO5?VoUdw`Y#!Wia8noJ=OH1Z_99a0_r^gzTkS8Qsee=w27`r=w-d(RI~P+ZwF`vBMD*q`ByaUj_F$NqeV;u-7Z4EC7?@s) z_SK)V%;a|_5?tc$yi;25IXY15C2C8P1b+TR*>c*!`4R5HRRzZXU4Z1YP4MHhcYTt8 zi)afDNLEXW`)H;86AEUlYG}{#?ryYTr}fqJ)aC_x=|b`*~Iw zUG1FwLgu6OTDVa3BbAgv4mZd)m8bvtiguknPysED8pWK7kMFyJ2V?Aq(!H%V%{>pt z)yNdOK)!1tlchhEeY+jsB4#EfF3k_1&#ms10vzHfimT(;<_-X&v27)^KiODxfI^<% zmFu0{!sDWUZ6KGek#rVMN_Y`LB`GN(s0lqLsuPw6EyHdH`Exrx7Cjyo*sIKdG( z)9c61>GO?ux4fwo759bYKTY zp?c6svZ}8(+a|&sF)Y7gTzK|&qx??!0WG6m(#9srFPrDY+Gf2*f*9VvfYbf_iC4G9 zLnP?u_x7waLiCemU%Bm{!C~Ps{Sied=g)=Jch8M!($Zn`2(}o+uIi>A@mNyJAx5-S zwwDO2F_4X4t1E=UGF0nDl;R6vS}X=pZ^q$FRO46EaWi`ftHuq+C-kX0$*@SpNZ$*s zoMFd~uK2)5H5{!I|MMq8f%7A|)bA#EHD=>UP5lV-1}RUO!q)V%DP>_!xMg3yu#%*( zgycJ21L-ttQ1`|jw5MF5lAp2Af-TL2Zqwi*jrC+X1j>hhtULEL7gm&m2B-?fY*X8Lw8pvmnRSuuyluJ)u* z#O}qq+|HoI!m_>2!R3{1KgFwW%H(eKni zLO{y7f%7t!D@a^G>~^Dehv7^H%T|3#HkL|L!VKNwM64Vf*^`d}n6D}axwp`fd@DTL zmh~m^cE^WAp)JOJ&5Q7~;~ClK*#~aKly1Avv~nO$ z2Y~))!f-p=LkiZ7bhjw-w#OEdj_|!<7D|u6?8ETJB6;?oSCXk7)WdkMA&E}qDpRGS z*)LRhV_A8R5<$V1Be#{VWkoM%y39OZG>@I1TaBBJ#$!%~mDVANg3DWv;oBR-0cwMP zwxuv+wA%{J1{R*Xn>(zY9L|2VH~6&b^gm1GhBer&qSvPt3V^7@? zI3p_`Cij`*sMNUCVpQ>o?^P-4!Q+D_lR@FUwNdjJcln7+Iyy#(vAFX6m9%2p<6RrK z_>-p5eMsA#{)Nj+1e3?nposBxF=UaQ*3n{}EQ;(A%`dwRwWD$^Mo3AZBx`+<9Y3Dm z-p_~coOZ^3~`Qigm5%ooRg<3+n~c#P}$S@)3B zjy$*=d3HfGU_%tl|7KRn3tVJqE`Y;on5{#D=?5@J&wN-pyAa7)^%=Pgd*Ln+_+#Q4eeOJ~gXJIAl30GG_UDyX8W* z$HRyTsG_;fe+-7jA#ggJW$a&j7+}I-IBK_@jpS-MN-~zBK*z&(cR+R&dOOUkuQu`pQRW^C92(i4u6KFe33sx^+(dA}*5t9oplhjCZ8}gA(4J(_tEIlm>`h@dqzK z=HVDpm}dHAxqW8IJIb2GBXdtz9`OIogAj%NSzNOQlNeI!YW7Bw5SuS|wcaa!lA}9C zn3h(l4vX!e@C1kmm$)IxIT(;Xp{^0XAg_@MeWdF99hvM?m{N5!E}U zreA6}1+f7_P)-o^BwnQ2R@+Q6T-1lp4l_;*4CA}gm4t-+2%h@+m%8x20kLXRK;juO ztG4ruqPit^RDy~d8eZ6AQz}i?*(%a);H(5b^!xOnT4yh`Hqfgxd(U?!}S%yc+gEqP?=Z{fB z8i*`qx!L;zA-nl30XgEt(4We}! z#NITTq-?35{A)=ZMZkv?>uMWtUt3~H#8h_bS2YeF69s{U=Ol+Es_~KVyZjI?DMm}S z2o3tUeV62r*+dlJ+~qis%~1I==75yvF2a!QNrdbA$_-z|((H7dzvmpYk~!HW(8dgj zoR32nW{+NOJn1wqkTUGt)|;r+69Zq)8LqBlsby!8n8`Y6IPtnnJN>0Dhx_|gTPFSwVZTnx1#=MG-`Ah8V z?=*a>!k6d-i#o#Cz?HhgMDo+@!>Fz^?k!d$GqbVOK@=gs7rv!--)S%Pzp7&NLZ|uR z688}ro5!%o#SX=;0AK!V{?h^3Qp^>GnMmEO2gHbLViJOXY$E;dR##UYvnZ*T&(2=b zYW8nZdR6zhNUDD_Dxwl(3i`f%My7Me`IOreb!LdV?JgoxIX#r!%9W1Jt{JPktFG@% zV+uR8hi}eqZWQEOo2n^;Z27J`3(3vPtOcO+;~gH~qS#RL-x4e7kXw9U^o*~ypH zJ&2e@ScTO}5eK^{P{-XV3H5)Pau?GLmR1f8X~!fD!I%2jU(0!&_a?7PV#sGzoX}4^ z!(3C+H+uV)erh?K4MeNfBnF?HpFWU+PS;DroaT>UNEYWBbcu`|9%f@R1q8 z(~>l*htX#~x8njxJ$^T_k5&2%CU10cXdZ$$Pm^kckH+%|E9!7EbPJ7!#MH!s%4AO- z=ojJ*`4@^BusD>%&Hym5$z$s2iC;)36%+UPknLy3n#`0PdhhHv8!y$eSa(gH8Wj}zdwI+j#|R3n zriT8ci}sThiNJkODyn6su)AcC;Ez>n{a8+m{+Xp7z77J&SH65eB<;?N5*-O4Y8!a?KS=$q=zchfWaSJk9Gdw=z@id(VDVF3v+Etc+ z`ovv$ITG5f8e+2M3+L^2{O1x9&gu8bzJp7dzcIytn0nXzQdYH>K13&STNrIQqMU50 zn`eZi;eG#7`30K*5BjKxP-d>xsMo_iLPgo5eRE!Xe6=xJ!~8f~jb6Ml^=v}D;pWt} znMq^2a|LNI<0s2-RMH^1U_;_JgDL_;UsdjKl(RGqoGA5FxH?^wJoRSQ%&$|=MCu*B zXEz%RG1n)Ez@nBb5Sh*QsL|4?`>TU)t;sw)=`)6J2IPVJ1u55WZ7-zOWh@$U8iRR( zw~B@+Hx8+Bvo3JUO5+@|VW0!yT;E!v{pET>zWTr6pSC5pWe#+k1SMw3fH~HhOtbva zEsdq2$Ht4;#TnBBG32~|qdS1*Ui;Jj@7f72nfV$)(I>XVhI4h~>OUgzQhZE)@bHdg zh}V`oM*{cP+me`lTR9-Gz#Obe_r4S z*20Fk!@L{YLNxqfE}D7&PmT;(t5 z)qjz&O6_OZ?lqCb?se@NMSdYwQnFBaby4XOW7!R>Qk)ZtKKEV!Vj z!TAQvMZ7ucJ>Qm6R$|n*CnsNal=wAYuFYKW!fU&)@o&CAxnnNewNGUem`;P-l@y8Z z^1{e~4h>8GW1=QN)w|o6%iwaiq3`=kE-OSKzT=0H0=d2Vo%OR-HQ2epF0hy$8RV0~ ztk+p#n<2r$e86j=t?^G)EyhJ{pOJuw$H#%33#3;{X{|uJ^#g_JoMv>1(mEzHeOy2& zr>!&Y9kJ-(_g&=%T{GN{9SHTvFjeTS$?XkOql@IqoYu#rEF#(?XZoeN(I|@38Qx}B zYVv1x)6Xy$E+Q^ViX8UAYo`d{M>m^CIYbgdWFzhGy*=M;roiRdfpaW^fuqD8mr_VI zrlT=fQ+ccyfQk`ldB&XFT9!uj-mmpTv&e}i37umQk4hHanE^~|b081y?0WpyUV`FY zUqY~Rkx50As6+(pT?xu|gZa22Bsm%hxdp-hHHyxlndkzyYV@Vb?lXY;cbBD0=GBc4_?~ek zI=t$DPf9-`gAsQJY_~RXX@0>xmMNLk9$i;rodpQ_a>EYYEpc2PkC=ob%4(aIG6_3F zWIS|{aZSYQLM)mc_{rAS=!+vOE?N7WjBH{dMYw-R7%B!hfY7~mP>|*l6J5nhHgs=y z0$8Kn!Cg5@7E#8jHBV-zSY3l~>7l^Lk)0y7^^T;Hp?(`Hf}xVdlT8mFI}y@wv+HV6 zLi5U2&gib#+vsnTd;HYUI^{9C65~09V8OBiCbN^Wj(hxm)%~3chh1wgnk14<|7FaU zlPMfZ!Duc77w~u)g7Q3C!3>2d({(wutwRuMo~|qE zajHiDvgTXG(*(^LvOd)cgjErpkcJAyzLf}2F+wmk-(a!>t0VyJ4WV}t7`@?d1Voen z&Ltp;`oC1VgNu?X#ol6WeDrK|2~+vZW{ELF>A<3$jLj3GYC*aI8e#Chm) zH|?PK5|@v_9i8+S4uLrU2t5ev;PB`pISW1{=mQuGzN!ug$YUcyXO%ExEmW{jxc6@T zS5?!N-f+nCH_oo&fZBhRgaIUCL<#CQetWyGHr)qV;(#`rZlbT<^a{%a<>}kinqTsXB^Zh0CGak`{GFk+r#qAmy$YC8|REe%| z-6r&^w9j?+dJ?TJ2obuqpZ;jC~}1)YzCjQd5{*;`2HOBAiwMS+E_gw?fJB zwUY7QoJ0GE{i!0k2V?$<*H)u;pl6@E$YM|3x%(;3;Y~-{pTm@tl-5tTykVhunh}Q) zyK;3u`eTW`BY&x?hqiy0pI6AaK@m8bt5zmIeNL@FLHpE|Jer|W?D78UU=iN09fLVU zK;Oj$HHJ(m3R^0+n71rcROB33Z^irc{LIk?nz=bE@_oEL7HOS3b`eaWl!(~84MyRp zNW{XKjkk}LURv`TOy>0dcN$p|rq|>^28kgPu~-m(RP@~IGsB#iE>WTmXSm$kpX{O2 z{)(Ybdhr2^$AaGSsWta+jmf0XP%>Hyv%WNzR`Ef;53~hi&HFYUQ%iq-ZIyqr!uGL{ zFX5XS%@fa?lct5glsuyue+t{G_>X zcIE)SUt;i(=ZlMro9N}_&a284a3mpJ;^>K|LS!?!5gp0AY(*-;@N%&X4Mar$TOUs{ zIQ5mwW-T~4QtR;h>+NnTpGiggzx2SwZ${xu!mGJHzPe{yDC7Bx*AW97wsLU69CFE^ z{Y!vgbv#vg&nfb}S1BwC&J{Eu7rPepiN!r8be`180&`&wO;H+y}_~$<*+?C-aEMuK>8L z%{sejM+A5$Cl#q|$L8_`!g%X1thlrPX61FA6R!@kSYh*)NT^7i?!xk7k1^$wc_s|< zPd{tgIo-EDdcl9g&q!k7EK3$^LqK!2ocPQ3PqVC|Lx&Zkysp?Zs9J67dJ%9)3#wgq`M`pQwoydqH2uD8GV?4z9s`4}m%qBFuaR%V3=aopxJy5K^*EOGSZ7@8 zXt&(1=MP(iI)VT%h`&Dsig!-Q!8xd6?mgZw*Pnh(W^_1S()h!ufneY-s7)+ksQhK< z4|AZIKVu)cTuQFPCgoC?5IH}d(3+jhfpbc~+vbyJo&B^vvHq$T+UL&>8bnPg6|^hK z-R_4wpE&+%8BC`zXxX8XUi{;dbhq@tXU-J6ui0gLxpb6aCMR|rw-cNI%Q*MSnQh;D z#!yG%Q7UDFd3?@(6*S!+*j-FjPe6zL=H#_Kf)^y7c zrJonK!mtK;ZhmlIc+cy&%{qj)x-AlO6qJpPDF2I z*Z(PRD~E{t>-cJ6tpY5bPI)Rd6)-hHjn>J z<_=^XO7Wy6tpPX<-QWMnVLb_ao7ZPAku#BIk>eXlV-o|#j(D6GX}Pv4_?P2jx?z>U zQ`X5{H-0ZdrVtX+N4dPKE+Dc`a?4+@)NK!fc)Rx{K6`DR`zdV|b@iM*Omq=&IOKA0 zER)pKLdWvet9^Jp9E62PxkZ>_m$rZ>i)}qL$WG|)?%Y0{2mI=EdLLCLCsPH?_*&df z!&&-$f9JzHM+B1u`go#*z3Vf)@-En*IFMrrM~ap1JWA^@hQyTfxEOZmue&;G;6DqI zlbw(aFlydZQ_(7y8-EK54%wWp#-3=_Q3B~VlYEn)*xK4sZnkp$!>9*@5>KhN;L6yx z5c7C$eRYbcntU#qsJXm2e<#q^_BoL*!Cmy>TUO)y)%)G--&NZT>HY^grHuJQNm zk_7Lx=+^bb#MiWWT}S+}w0q(^ruDg-1gMt+;YgP`A+c(H3bTn{R8&+fCPCB>vVxCR zTOJ_Y%aobT4*!j#SNLcmuZ*D0o4w_)F-5 z-yeh))AJ7;Nki%UN@O@JDp=O@AiQe0v8=YJ0x9%7v670gaHSPp}AYxZ@ZeSkC?#(dUWnvnI-!mI}_Q zr+4GR63uVnw%s<3%fXzsZaZ75pgkM29yl!AAOe@Md$!)2CFl*!b;h$(k}xk+8D)`$ z;$P19yE@=X#XrvXpSq>`f#=gAEe1`uoe=-$Q1E{~J67Y|sp)>&WBsmppBqLOTA27DHOop^Xc zQQzU!kJIcd@tFt9roiZQXg>9j;@x3A!`;Rzrp0UvshI z`e1Xe`!!nC;O=XFa`}?seEai0%Wk#H;HlSGbFF_8Y%;b~R3-Z^srPo0SW`*#5*1H68vpV%8GwxY@v ztaf;@|EpUR(eDA*Yle=?P+Q$}LLwiT7&yJf>-dyf2>Tq;E~Gn-kB1j+U1M9~#&jjX zkis(Eam?>F+2Q}vjK!g;$*2<{8XRfiVKls_U_7`Q2jeS0A0L{v+HXKLh;x?$2MfCEwgXmR6gOD>_0kHq+k2aY~Y5GJDcP7=WO{o6o#Xd%eF($U<975MNfR zaOF}eXTell7`uFct0Pm8Nd4b|{lalPjwcLhC@v-;#qT98e-xBxNoAh4LQSI6V#Kav zMg$CB?CL4(U}-OD3P)#cgWtbT1YmDw^}W7oEMnVLgc}}1a=CIPRHc7@9<5{a9t{Qm zDTI5?53x@!IpKSAtCndKJ31_;FHuwuQ?{G%T_^_G3?UpEF=qj0h!v;RzIx1X0H$$u zw#aXe3a4F$fBXsQ^CFRnxXWXyQy~MsZ>YQb-udkOTH`k1!+7vq%4kw^9zH=j&qFq+ zPD7#d;vAgWaLRl{uRZQC9yWzr|L=7hO>U;?7}C~%srGAim?8lIfJQqspXX;~4c!qW z%yXZ66vGRp>1x@PR|MC8d6MNz#zuOxO~=pO8~{z)K7RV4y>9H5^-O99DXhwaG+J_O z>njOu{qA8g{eZ^CSfDkIXac9s%~$R?QnbrUzi`ypi4K7VUvaAJ_s%k*tr;jZK7xdv zz1Q~2t@J>S^3eIvcF=Mme&e(LX7U?toEjGr@|jBao4LdpOCii1XtY*KsU{0);HFM ztqBwueVg?kk7BFPu9e-k;H|ljfOjXYhjA!Rrr!)JEj0O+BiX6#j3hCX29!uf1Tz}< zydvdv_H_};5z&b&j%5-#*S?=D`g;DYX+sK~G$gY2xb%nP#dt1$Xc%W3u`@nnU)prZ zWT`cVdWEhAd?wrafttT~X@Z$DSeydaz5ic}>uHQd^NU#-*T!ELI*p;E&c#~uM9Jh+ zLd`=L?l^vTeNuT8G?XNmVHCSyH>Ld-x-Uo)ktxzEcVpt>;CpBUBLraS!aV^QUg#$VBj-HBsiZx|UwBN*Uo?lpKd863$lx%l6BsBweBgJp5i1%> zvYk`>ZoTbSs#3;`PQvp`EL8E(f&==+>DTVe;5Plv`BeV}F5SB~wbMu{7w(jdwb(A* z`NL={N4B<(7Ys0YyT4CtFUtk?9bRQUBTvrAe{Q5?0kW>&7S^&W@KN)=ffIV{DL z*O4O)jf)b&Vk(!0#+O^-l#HJ?f8>4Dj`C*;CA~!M zn8V$;I*oSy6?)6Fzhl~+4GPal=0wYKG|kSpwu(_M_ule{5?lJ2>mXtP*kY5(8UI`U z&P5SQZn39#v$T0FN{Ld|i~u!tuh~cjxA4!gRCJ~LaL=Iw>nIgSIK<&;!D#iQ?N)e> zfUK3HikFo|cI7rnre3+|;cP)#dX3WGN+Jrn|0ie9YVlY0(egifT`~W<-&?Ghp#j2VG**6|Ed@{$?QiDHCh~U?Jo_8C4O}) z7XdYzit1;2?77% z!O&I;5V*g{(+gE}Vv=L^>GfWyvBakFy~j=G{uk&B9nS}_Wta)>-XDSO_mT` z-&j8oOXYp44ZZh2KGcwZvik0q`P7EwJixRybaf^pn$_wCK|GD_&8Tb(S0LuviX5li z9E5mVMP&rWsJJ7cEFGf0(!9iBwM;dx|IFU!eElvf-e_X}JaWKJ zEt{k{-2Xd?S2QU2gQ0H;Cl=YyM@7IbuSEFoUQBCXs=zw;`g2rY2g?uG9$K~Gi>}Yr zIgg;wEp!=!=fLkS%>BGSgNp4YF?QmwzALKNiHv#$5Z50BC{c^Hsn#E(bP&DNw7v4# zWl*1K*gM<{BBGQI5>*CE>z8NRyyh8E5L`}rTP)Ya$2dtzN*EtTc~VyJ?xZ#%=Vr7< z0wQZ&AC%gFNwYOH_5YHjhKsLVvT4ek?~#+(bUr4%{dM4C6HKPJOl49mf9HE3YdV^) za7n}KlqPfLVf$53cd6bk|8Y8@FiFsRjZ(c#ADac;2RN-#Y~v~abc2Y7vHvR}^{&|o z+W!%=MH-!8u-!!X{xj8j_2|Hxyiw!c2w=9;T5$fB@co|7CYrAd;MOOOx-j0|O;IfJ z>*>EU?&jv(1RJed5eT2C3Gko6D;U&eMpm(V+igVB0jgND$+M%NfKP0A>T`jd%%CeSovhX~F_;cdO?~NNB$PX5N$}u^M96#Xb=Qj0x&1%FX z#xMI|KM`zWBPn0T%Pre@`#6e<6KBBa$h-*dxDC-8z7kQeYJvWSy6^RMl()O9N534Hmn)Bs8`JLp;n%3h}Y=R5l}|03&P^^g~vq zG&0zOrMA~&Q}<{Eu&Pc>)CO|)$H^#Ld!na`g}?jC^v@OGqpatdLuT$c|1AL(4G3fH zg4kRSz)DMbG&C;jT(zT?sV8(^jFc>AXaSl#-*Hf6Hi!FKSqW}OZLdhz0>2ClWb9@q z8)CQTK&z)F26i%Jsc}At@~Ul5R!xw;zr6L!fgC#gN1b08Zy7)#kJ}#5DQvF`uFUU1RuI^_L0G7>WK2ZNs}{|_Ql3T=jbV+^E-rnDs%B5Ocw2n~VA z4s(^yswh+HWo2z_?`{zojiz&!wKt^3uD!jlC9%+2D%0#-K3YtOet=j|6941lqcy=V zoiw2dLuv1-_qDcs{EI+30~QlTO-NVhVTqVm6A%9n0300L=I(B=ZnM+o#(}bU|3bF! zTeGL|Y&t8(4pewb8i{@&j)xFY4FsGe9s224&?O8**zg#Flg3R1otRNos?TLAXWshB z5|PUY-<%d_;H0SAYX__Vh^E*fAV9u8cM<6#S-WKf{cK74uOCx6Xh1PAqpZv&2SfOreqnX>1s#9m5WN~_8|N7 zLcKox(VUfU*`nRIa{cVH^%ivKyR%;-4e6-Z#6iUEZv>F=*a8C;9ycEE$e;RNw;pQ` z)*3zzD;4>R@s0kJlw5L!C8$ida?u32ChypNX}&oLIw%_Kt&b^mcL4plWgKcLPn|d0 zmo1W&iz`(?tf;6^lOD=0BI0NzZUI>}?YcIVYX>42ua)>&#;UA1`R9P|(=W+AOvuj{ zs>{^cVZ2`6@Yh`Lc zM*pI{|Bj~bfTi2!yh$M3c8O*vomyr!T&E-RFzuwR*IVVILKV?1B-qtGFps|7AKtrM zGtMUs{sJ+QNbg1pn#gmIruND+P?7$msP;CZc1!18U4k$}6w z=Z5W7-VcGJRO{{`yy>Z1^O+reb;Rx6v2DwnghTp{1XL_Id(XsSdqXzRx{EpMRn}+r zntR}kP`*Tl=zd!(Qb9Qbf#;o9P}QGJ0(QBb=?`V-GQh59cUgEKvG>60p`;Ct@~V5-&r>-eFL|8DTpcXwm=ng_~CL zUiYJ&I(=P(d0WpZV){VdhBXgJ{yuX_;A7477s~o3%KpWC-~IKSTfYOq-IW?O%RnD$inQ4O2h+|4Gd zzKUAE+z%xe+cf~bb;i2f##W9=%YZkF@a&NTDvq@xE%<{4hB?AOR0g{8Jsuo3U5M1N z64_UF{zx-3*%l}BpBwcwTTpzFMT08p0f|uM5oyHv4w<|z8tZmor`}9X8w?SoQ|w8^ zXkk60O)<`{({Q~hw?=LKWq;lPv8LCZNA_FV;$Q|vou?wM7_!K11!W%YfJAZ zhq29cQ8q7wBvgLata6f>NU)?u6;qEY%RsT@fTdazJm|@dH9a11`}Oy5=phI7ezW_f z?;K(&?R!`iK{5jq)>{aYrklj;g@4pc^_~S6N!!dWaIhlE)XJ7S{Ff7{Sa(v6u}G!9 zz;mt2v8nk5qpV}@y*TrkheZ@0_!Kj$`&eUR`Sg#FZt+B~cHQpdK@yBr%kRB?m0opb zEyKDU-i}3H>z+u=5L~aIo2U?D;a)7ILn2-%9njgfL1TQls=c3VS7nJPbu?D`ye|Eq z(g#LkQ_9QgG{bqG6s;>${s>S!`ekL2c_oMHKV1Y76u%MF*~#4gb@_G)Zi>V?*abDk+C2#(6dl=~O z^@^%-pa_$A7RZRynQ0)laWcpJpoysLcu|3j$k|OzGCD^jCao}(=kQc?f9bORGrko- zwJz1Euc>~7xNKQDI~{5~{+o$*&+Q8;nVp-=p_ zw~lJv^oa>LwmRk{_XS^>&ex^vc<2LQhp1GUcCNV#$!dEkJ|*zX;&_Dd$T-=9?UL!V z=xsz+V{viv$cVSOsYQICPB}c!`46_$m+}DcTLgeMx3~1<+VvDIlI$r~R#)q)a2Uq4 zv%Z_M8RxWZja#J7!i9&1_xkW~MYEVWKCU9ORcOx(_a)Jm({`UP*6hdi-$X#obvzsJ zVpXh!dep2p%B;yT?isW7J(n`{XL%&9sZ{B~^AghekyddZR%45l@DP4aY9QvNLMS6Lh*jILQb?Zl4s-gA`YmMA%u*?xTL! zY_^v6r%c@oGN79Jvg3^yJ$5#j60goY(`nF?Ni*C1heFV}twOt25*nUGM%hBZn%{c| zEV5;zA&^bl_YcCxpi=r(sXw>nfb%>HzK9u*OkeM$Xd$EKgyS32B7J1{2mx$R=@kyoJ|f zjg3S6`0u;1IC2_b2%@ZdtYB}L5h+(l!(`JWigrsJ+pBBk@L=v3*8coCE{}x)ScwGM#Ck^84Q$ic zRN^-LQ6c>aVYGiIMUA!$GM})wewHHLu#Z=v;z-f1_=Snu5#H$dm}4nltVX9$q6RlB zl$I)rr(z@TyOn~6fhi$+n8VSsf?(7;ur3Nmn3tffR2HLju)V5wbR}5H3WEV!ww+yM zR4DoVIaB%pHGf!%f6+Gn;-*u%w|qS)412s=V&&$Ska(vQuo>a=bEl8weuOKE2e}V@ z8XD10;`aEM(qQggvn!!LAt943cxX#%-9f_qRkTcr2N7^d0jRkH**|mlinK~IR90a_ zvIC97pP#VnPFLhP3%W_G7)Z<-(w0;qAt6PHB=EMkm`^UpMYMCoYFUkEE5c?9)kR7k z`4Jp5@=T`jV%Q8OfB9!yPomX$wK`tZWevDrrl)nFmCO_cgVtUJX-&OeXdU{G^4@^Y zcVEAX%?J{3j?BIx4$qZh8jl^C13v3C(yIR_BBCG|nvjT)=_DOv6_~p)MHj)c&M(#8 zDWF4t1l%^cHb;-@IHjUphoc)<%$7hYbqRsO!vx!(Q)u)Q3E#IH&Hu{Dv2AScS5|jq zd6$w-bsp`8$+iAbjiXeRq?3@I9{x*${=)QU;*cE}){N0}On1AR7M1|9kdhMgiSJJP zeCdZ3vYO!U^`=$-p^cZNqRCW{V^WG_JX1&BVDTz3j$cO4R7@8Cos<;ob{Fqzk0$uc z;%K|cQ)Y7~B-b@EPOt3#GvtIPCu-Π4OH35!fbLdP5CZX1D#I=#>e|JtX3x>zxd zkga^0!OJN#Ek^Cd5dUD7;Uvm2T^^AA2iSS^JcKRgiXjvjXx2f0FfU4CdurqL>O`R# zG3w4WUWJaTT8_3hrvjk6)V^sL$@KKkqEJ0rg=Grh*~>??X+=wm$K>zR(&cE^*u&Bl z#ucnFmR*J0!_e-B|3>vpenA{h!?Ew+mRkdZXDp$8HsrY``G_vxs4F| z{(KUgKcXP$?3@+|H#jGyZhdutdWw4;O5Xdc9UX&eB$NyTnH5J9Z6xFPv<(~1_qIr2 zF6se7PRhqu*Nc|*h?_LDx#KID`d#=`(unS9i2>=0&sL-*nw$lBf-#)~v4F4d#eDPZ zU^Gosu!{*Mlv-9tsKoP*cUO%iCf+<{vAl}&=yQ469Iw6IKR3L=7Z>W0HiuJ?uWrz} z%1xw}_q!5Z%^FPv?(z!p_)n|!_&2ToN;; zm#DfWk7r90XJ_-V`<|Y(15fEGzvEz!L-r_g7GP`PM!H6%gc#kI#%bQr8R#~80W#hk z*n#cN;6pW7EC!#ZvIRfH$w^R1Hj5}F>c`Fo)KjP z)mCy%b_&VG!ft4!dPAVTZOqey6yCFpd*~D}eHAK3_KdEGeK{OO8z(Qw#TGeH{%e;gSn7rS)9}c z<6K6$$ULKwGYY-akV8I?LV0WUt)UDKnYB+x6<(ZA7Jr7fzWq9gT5)-usrh=^d=uAC zRBCCHdbi5#e>v@hZa)!Ty=1;&C2OJ zJ|Q3u+P9tPod*+pwqsx}U$j@YSm*?O5-+WGXtCt1>TK#ru5~7p|3+LE%Wa_1e2xwd zyLBivODEvtAOh>sr5Qw<8vm;KQ4E9jKDDHuEF>Znw%{_t_;TZl&tg%2Jm7It94H>F z(O}PxU1fJ%;C3de<#Hz0M6a#-f{H~H5TSR7O{MgE_-jX;@|LiZ&;0g2!~EVhiAyGu z1Kx}*gYV{t@l3;m5T{ogYvE_rCe}!0!X+ymO8S{>||v&fUpENymM{cyM*OJVn$!aLrtF=!?MZh7ebpZK!kHr6{S~s>(@!WI2T4qpZI#H3ulecaghEdP z^iy8){Slvgt)3;rvn+P)+e(>({3$yh&Ly09Fy{LU`s!r86uJUUIz0T|m^YW-TF6Aa zOoaXbQnvluiF1xJcHH1@@n=P=4mPC`@2VC3nEYrJ2cLOVBD~P?@}q36-5A^SHdzoF z^u*p~dQ`teAr`~q46FsG{WQ0^LT>1ewl;HxoE&drXGkuzQ26-|qf^uXq}1Bl((x_I z=wQ8o&Th7j$a(28+?VIZVf$%TDQu)it7R)o)-?=eWmDq3lPDL z>3kDKi8!8qU-RyPiEy*bREu_-yO_w8+dZ*2_D&eC09u=QU{ws zQAyKNZA7tm4E&cWR$6`A8)+Xyi`z>&N<#S=_+L8^aEc{Xj=o+rBwgVbh1sW^k`JEt zA#>u;8skLVJlhOoB3+9womD#bQKGunFA5|Haz#u%d{Or-2sQ&PLqd*1|!NbNEN?-i;TSF9fMmf( zQNYEv?!g7}L{)P6v_5;0&2@tbo-_IN5c)0L@J&d;Gz{hZ?RDL4ukK#(in4@?zJ=o;&T#dX)Hx2TrB=Acfq z5j@U#OyjPU_kamIr7O?4f6X#$Hcq=1tquu>X%T`*g0Vt1Rg)r6sL~#IrHsLVR#O=2 z0G0%7&|>UYW{8m!kh|W<0V(OfB<;g3J_yi{y={I=`wli?wFjAyT&v0B+3dZjusN}b z=_^b%H8Fs@e5yqIxzTjVckkxPv+8D?M=|$aNr<&fUBe>edO27Bw}Y&GWsD}Y_rI@AYl z=2ctwf874|IOI}FD+5Iaq~vJX!)=uDoj7K`P~_v@^DFN`N>1mG{aW5e#*w6c zU&VI>HkZFaRqPrnh=FlgRnjTC&I` zqBfB>mHjrOJ7G#UiG3_RDhD$9FGr$b8V$=7dvYUy-{ynrn+-16?C}2oW6b|mr`ySZ z>WFypLyHz5+SZqJzUMLKLAJ0L&a2ZerXXk5u1=Xg4_s7TaA35z=Cc%nd-!O+P*RF! zngh30j%lqJk;ZVPR8)Q>V_k)1O`%nL<6Fg1nH(-Y$R7I?(^`Zd$)`qoAYE!*d4aYG z6cnj)g~pRJ?LWnpPR8yO4m-m?qe-ZYHVsaq$!}obV86(M8ZlLg2HzyyH4#dr>%~Ew z;qiED2S+!*Uc8j$3p13><-C+GE`mwijWj@xDxatbhOI2{Nwbcsyhqm@I zrwn*`{&DDBLxg1K>3SbbLd$%U-5Wo!l}e%h@7_G1H1%{W-UPN^{~=ISiz_j11O9D+ zLuJ|e@}kjBq${%5)6Hy%cI0)hIG2+{SBjpdErzFO1NTVWuM8KL#ktGA zm?*T2koo-iZ@1$Y7kNvzXajX;a6%4!SLD=K+XE48`BU=$!p!BEiT-*z_SlI@-~`04MbIDUZ+2`dsh5|)`~RRA?{9>-$5!B7_&y1uELc~YVoGQVG+|; zq!_ay=V2G`YeXIlUFsm)ck<)lh{(v10St_r^2G6O^{# zx}+l84R7IITb;m`y#tpGD(WBm`#z_>FL~$mg_3!ljSi+V@DZKAV?6OaGUpIoo%XuZ zG10WwhS_Z~n0$s)cXno9b3eu8{zfP&Dr&ryk}CUMI)gnD$s%QQFxoGP(T&7#{897V z_jod&5Q&IAYtG#EB+RU5PgAAQIiLR8OFOcdX-~XxFTa-e3@X6CGSPB5hq2%Nfqset zZsa{R$vDd{k?3Hd3BSf*q@r@bk$JS|Mh`c(&Fy{zv~F0uTXDdtu62RAf4{^#_2Y1w zi-hzC7I0Jl;T-|@cJ`($_x+9L`F;C?t`xt|CrG*K-{jSt?=k&m%ZU4HoBg;(*|1cQ$C2oI*@_4@Ew^yiRwQkn8_iCC*&o|gV zJ@r&yq7+V8PU~7$jm)fJ>B(T%-*VJ2mQzZ=Jfi4T!Eho|Q757Ir^h|4_dp7^DyD@Phgi z_ab?QHBD1}x7)lkm%Ha<9*Y4bK8pO-|FTovy_qoHty4oqEIu5#*( zmuc6>>QZzaJAg{@CBr-ldu|h+#{&kW(1sPVG85LQcuZ%D!@zv_e%_rQit!sf%1jem z-(J-(?;W}pWO#us5Ia;GyWo;$+{=@(#`1e=oce(WKPcLvzNS(7&%SiC7=2Bn-tyh) zlRB6;O26-lueTl{Mm$A}x+6B!+FTN03E<;cAO0&Jca?U6fP&1CJp7?@H}LzV+8!1T zn?48e3b@eN+&)cEXj<)KX}5mkUILj^TH5|6Am1HR2a?P9v&FF#6IogwQrZ<7O^o(~ zrAsJ_> zX?pv^i6d4}#$le$XeOJ4U^OEgHdSa<6+1*wFR(7Fq10?9FqC}7z2Abct4M$SMaeC+ zn}pu}g4W_>DN?;f&cYxZfs=o{=yST*2H#F}SYzdYwf^^Yimag7d{F@Mng?;mSaR;b(NcBT8K23N6Q1kV+bB)K>#)IyY>^I0 zxz+B7a%beJ`c0Z-YD)`#`|A^ao7-Q#m1++We~6%!Z##DrvKRN@;6!NT*zxx-bLEfn zoFw}q(w0dgB2noB*!p~3LHfM0?su>1t={j{$aH02IXOR$snsckS&xq%PT@?C#30!j zj`Hu(CSPtzR315|zNs;go#<3;N<+!o?!JaPl&b}~ZKt1GbiJI*OWqS5qf6nM#SvS;w$+Nn}!7x&r zZdKQ7Wxlf2n=D&ygwq z%$0{KA|e8ut&A>lET+k)s_cyQqswsL($*M`1x^_ZZ-o>-XA30KQ>Tn1 zmdh%;_oqQVye*44KZUFtzh%nIzMM2R zSgn?Ic(82RantK{7$5509IT4aGKlh|g`F;gh8@nj@Oz-P>$4ejSGBq9pDQUmi_-;7 zCv3Nqq1xG1Iy&yhmpQdAiaH$|Bsi0IM-oJXu93F#$5)Sa>NnS{MICgrWxp@ioqCf6 zA#cwV!|UN{VwLW&r-ZRYQ~5Q<{zJUOf(1x0O|hU+j0Z#f4Ai&m_5TC|C24R zrOROVl$>&a5zr>C*oTJ?>t|VPkZ-|q&4?dKJY2uqvW?+;*MLP{wCbzLr&MSR4#aLS zU;8?@h1gUvjrU%rQ66YHaslb$)T{nr*VdSA>k%Ct=~S$8YQnMxTWWH1dJoZjcMxD% zV}HH~-M+P_iWrnLS!IJBheh+AvSX5j>sVHtcu-Q1Y6OO?V<75EJK$ZjwSYA zspugExzTcWPgFR@fe|bj*(zDxI^#uQ0UP(5tS%e&GGfD(mV6lUO$6^AXk_vHDD066 z+=%ZArE&rq>&J}*I3!rdxF(I4dOwwB0;AQ8#KK~gknp1+%X!YsR6Q^th_$tyTNWWQ z;PDfsL@f^>1HVPK8;vE<9cm;@#L;PMMPioDmgp_&k@k+OT%?X26&Ng4>nmekkEOC6 z-Q+q<>39GJz1|d2FgSRBMEgUmS4yPf)*D-qJR*zfZ2zp8GK-~K$9KepS+UE=(B|ly zbow7guq)BMX0Cff1K$t&unk;b8IWCsdV8^ce`&Q;%M|+vxfnn+aC;2<#5S}e85sLA zPNkA3_ljq{+DfuiXYL<(TcW$1AoW|gTFlR-cYR%3^B``6s?3=vY!0|GLP}GyY^RGL zvc{Zji%vS*5ftpz+kp4G>{lmad}@oPOk?2Eaz1lOhqcv|tTLPb#C$id;#g{kI8hKl zS587gvgNXHR@{L_p-ceu{%4xt>BI(^9UeBfTC$i8CvsBot>Rc zA4Ue|MK~`+2D#t)HmeB2LqdeF`yFnX^ux{O%BFDsM4Gqjb!m#6aw00!6}(=dvsP%+ z_%18Z!Ik>t2aJy?KY;`Q-g2 z#rNHy^D4vB;eTG+*0!{ZsjQDrE}N}Qzn$E2MZoR9E4`HbcKduj_ok$O*>Zgk^x6D| zbeggdN10@w&jIgkDO^TL1X*N%7<1$b46wnUEL0=LQ!BUk#kk6v&Xk0GhDO?$$d2VC zJtfC90;a*(9j+Q#XPiyaAK@@iN(YIV3Zx*RD@~+q{oP;pH1WV?nw7kILhFE0$Wlyg zXtdw_RPgqa+dN?~oG|r~Pkh7{(a5V3Ws$(Dif z5XwSk=r~faoXKz~dgg5cjD9EvJ{*;ic$r!?f{}DO8hke-FK@*{vjdak=~4w2^LD(G z-+mPqVQ($^P|MHDCi?EaK23KACuBCn?3s#X{&@z?Y9%3{3|cs&2_M;2J)L;=NMN_e z;M0+rDjl$8gEgA!mqRWt%7IyDVU2vDK@@Tr8pGWB+AkZiXth-L@hqks_$TRkx;3kE znvxHDP&P;jp?dvjifwe-yciQ?^u=5Dqztguf%~fovz4rRYHy4 z)O!#Np47e8)!XHKeARXjG5Hh(XI6)y7BsF|?R8Fcvd|zTqNsYgD9dp%U1cL*je@)h zOko$1Rxndstut^ZypSPYLFoyuKylxHs?cZ-o)1FozcMIgw0)pNaNErnoYYhKK&e)T z!|8AqNbL21<)`g|sLp29-z&DBE3e+K7pD8SF)lg><>UiS#s#{vS4E@vtl7*|qvqWS zhg`8Zru)?-bV}e8BHpniOz4qSta-@wQ9fYaZ271szFUMG z_L$gDDQusjfb9UaCi?{Fu`&V=B#CIow};JV`#rRBCz+BejS|=7l6yW1f7?5!jFn%{DYrpdzbbS|OR_3gAf%oirfxP~%&3o^10?PvN z&EuI&%gv+6(#YAGfV!+&?`{_J80?!noc1n8nk#6}n!6z6NOxpsp3nu9w9JEjjrF8CbZ$dSH5)cIILVGS{^NY;E%^*dTfQU zwIy^V{W=a)R>CAqYs=3set08lN ztdu1h+yjP_=zNDC8#M)STaL7!WR5aPuU_y;i;x?p{A+RVyyMLYamT zG~4#?w#13Hg;_LH!VHbSjJf9z{VxUiE5bwXlqu=oU@o?%E)7 z3FxSO3QKBak@-oy$%5r0D!!`+0x8hOiiA~5mtF;O7@8R;CVVs-l8T9xbkV9Og0eOL z_^^%A?f2q~xj*l58(%%f4MjsbtJqJu*(WnZV5(c7j+cJzyoBST2cn?uzbs!dGAkWJ z>u0yGjpO0hZQC9<#^&a(Wu{dN6GZr0O$qS}C`c@1ux^w`o3xhG z`}%i2;=7;oN^4LOgc9Y`kCojoZR^mQT>o~kElOWD6fknJ!Tw7HvH1E+_tAu`cb7E< zDJdx$A1*=^D{u(?4wD9a8#93qJMnthp?Y$GKuQnaryj|)S=pRF#p+vUz|VsJFAuj@ zE)$e^&65}g;1TLqr&8?gKwUbbT%z!Mbmh3t5~X#M{OwqSE8rvcuU;+^r5#b9GcZvw zF!E%4_CJ#5Y)Aj)*JTL+N+ui+W!^W38_^F7eK5RP2}*xWDk6Vg&8u?K%Qz(lVb67T z^4BZ1ooJB({c(hM1Au+IpTZJ5yI<+C=WL^ecm31vUhvgSOZ!Vv8sy3ALbYO8mU4H5 zl2o{MHXhTV6^W|UJ{c2*$nDOGAy*B&CV|Yb0ka%DaC;X@sO;|aGccu}H=pPKE%#j* zrLR|p@L3iJe#4{dM$8uu;{Vf1Ppt~8MTh%y|67;GcI{i)5Pr*M*M_>NJ7w9F&1&iY zbGAK|RK-~l8#o4(eiF`m+(m*rOckq(uMni-t<=8~(n%oB& zUVGVn^8^<{qs`Y|ub@!qA;qkHcUH54k35NDlvqZFLGz*gdozJk_u^t-LtCQ7<;Bg+ zJuhzJ#9xAP^^n_M&rPl|1Z1$lfC^QK`|C|gyo7A2rT)%vEW_bx9>#2L5R%S(Bwdku z2W*WYIJqtovc>CMnqZ*?o^IJuSi_yb^Wn)3gH{89u;p&@{*?~~<30?STXI{5qEydD z`}X=Bnvv1u_*J~svEA8f^~fLw>~k41myle= zZx&Q>WxB#0pdL=J7PYzzIsjs%JZ-IVqF1$g@pw;HEne5DLWsq79gIqj6F|kfui`Xy zHcRd!$^+?;ngf0gf3{vh#lq$Uj#U2uzOwaQmC}scM+~Xda~VIeLZw978I?E&D;Z_3l%~ z@j9jzk_(onC);%ZWUn~SZYslMp`HB8(={mRu1DFq#)+$y%w;r^EFY@J{at^Oo8#;Y zt@;f<)>vjpB`>kxKudjRW0c4c7F+nP=>#W#5m|S3Q=Gf=#rPa2 zlSaPZm~$;n=~$Pru#}W@3XkH7j86Sv>uoN3bW}fVAQn3Z25PSurL@CJRkkNtohSqg zAZWzY1~jJy$VYgr{;P=R%d;d{vGcq_^=^x%3DVkIBoH=dlvvlMt7YLCAB+Dly+ZPp z$bp&DKVn)wW&h}M>wnedt=rAp14y}I5x@V*bOEwe)k}sue2cW=IYV>#;_}%lOJu!} z(QZ@irNJB>s`UbIZ!9AeGi<+SjOSl`dEt9x01YV1tn!VtidZbDURD6Pp*4?v`R#|) z-9klQ!n`Y8K{Su;#2+|hcp<_|(!`2oKgCoey*_Q|D%TNIW|K+QLzcZj=>4^sYa|V9 z-LZHIwi2bvuukt%Jr}4V9l5`e#5@!gXDk@>YG|o*<-(%Y-f(32CqRE5#rZU}u`7y< z`iBxevxG)pBypb}FHkRTrf>&87Nd*U>`ZtTqmWD;oYHcm!kxJtcDrbLot>EQK!dH2 z`+R{;AXE_Y*}#y#h~UcSnfijki}Yu1ZDV867=AftdhKR!_!?vo$qPOvt`9otUrB6m zPn{OKm-M(7zZY_>cxp^zvv_kNZJOWIE{)#(Bon1-f%{g9;0~wdN@L`Zc7#9|Y2W37 z{O8Tn?NWM?_m2!mRY9F-2#Ycn-N9Z8A+SD z*5||CP~sS}yFK~uO%`v9I6MbkenBunRhJpRj3D5!JC31qlh#z3yFV(&`@NqX5HBdw zm!&tG^5oL9w7bMlrQ%ioF3)%GW{M)6&K-Dd1TM0kB3!$fS6gjwxJkK$z1$*#&JipB zz4hc-Xz4C$jiNR~6D7mz3@@PVissSMz~Az1_To=v1G~FUC6S-+(brFRyGG}^9<`=; z%BK@$P(YfzIy95q5@YLsG})-sGMGJch%}o(zB4ehqw;Kj`#6F%q9n`g*foWyK2%fl zyW3J!^FLK``<5u-w!ran(_E*4ZwC{t-+(vr*LfYTKpr{0>U#_t`{B|2ja=*;KxMzy zG#AEldg!cMV$do59zTy-Sip(+-!3~j+6AAR6*9&~(Gki2QAogPZ{~cmPRYdm@{*Fd zTobPxUtwz8Pd9Z0n_(lJO>55Gh^Ri^?0mMmI`}G+6UNY4K}Q9~RFHtn_Jar#F$&p! zO2b$j!l$0s?Y|n~VPXFk4<(7P+XZsH20MFaC6`k#kZ`$Ny%(< zz|z2^p{D134>KEJCK`CwN8h1?a`W>H}wJi<;NfXKZ5Ll zgut{jl<>p`+)} z)m=-=+WY`7sMCDw`f2rk%W)Vn9P zwY~%YE{%_h$*Irc&W&`|%Cs;3L=ibZF0K_RR@8Wm-Yn5?`OHFY7xxLM$S3}hW7*gy(W_1nQ0-O`%1V;m2_k~S(vS+VR3)B z=DMCf=^<9gjvUV%qEkBp-!@oXS%(QVzbF2K_hKv-72#i8USorJ1S35Z1@Tnc+!;d? zX~WRS!-@@tOw@3H{6VW8%p%>|i9-VTjDm8z9oUm}#|95S0tLQYrP!Sl1+Y~nkA%h( zdGQ%ei!qNEm_278T=~g5MQCQzCA8&+H}ZYN{yoG76yfy1u^pW1B8K_DY}!BVt>lTp zw{CD0G6b`B++`9%BMY8tnE%dve`2yjmSz512HV}>0}|m%m=o{Qr&??)|J2f!Ju9#Re}DmcT6H6a{aKeoT|;#tp$wYx*g zwrHU<3WsK?MQ}bG6>>~H-gV2Y%gkKFqRs{N=+Xty3%&}E-ChGlT^s9nqF0S(Ng@BB z0h1zc^VK>?iYOvEWwuHTdiBWb|P6shsw+bVTNz$LxNc$P6|M1&oN{YVW zH1L9zlrUc9>JbD@SHVe%N~LjF zly0vS&c{qjZ#2rgG{oB>PpuzPRAFA;eQ_9Nxy*e2a(spH`9ma9pyE6$l=? zz@aMC@yhG0W=}c0q{^Z-Jl1gWwB7$Evy)vJ?1vu@IqkZiS{JALIG5-x4e1^pCrjKf zLI#-~Yj+3fu#{lBe~~Kq>G)J@oghp5qlMmvvRrqt?T6oXb5j>}0h zU!gf^hxQf`9z0ddp|!^A#1px>4!isdfRN)KnnI|KgSxWYH3cCi6jx4ffoC9;7=!_l zXZTapMXtS}MC3m4xH)_%_F%$*KZZ1|y8 zl4{cyTNFnE#@$O;iajiYv~}77DFYiP0c>$SSxDh$s6le$Udzt}~nZ^!dqYQr+GKpGv>? zPF8`fOf!VSweDvJQIsw?vi!-->M%Tz`yB^ZIniThNJF2nyQGrUr>nCGBq~W=0zq@* z^?J4xkR`)o+SO_M5I7NSRC|x&}f>Pl$}n;i;lw~lyj`~q78-oWj_o%|z^TP=QR`Ox5!Glug`a5NVv6h&m5<6ySJ zPDUY~xj%H!+Ek%`RJ94eLaRNG?6K_`xf9-2BV*n3BBZJtc4c) z#^IHGT}g0iCW-vFbZSMAt~_uaijNJ>oZjYTI#4`>(3(VD1;W4F#F|a`F*0N7PBL;3 z(;+OQ$9f2f*FhW|^QQc?=hU;Nxk~AQct&lmyJ-JBu||2#l{mfmR#5gg5$+Ue8ZZI6 zjP(f~CT#LM&at4a%G&sN1)ineGaL%pVBaF53?hMVVqoON#Y&s~#5?(d;EG1t->v~n z5)y(+(TV+{iJHR1A$RGF`C?xG04tN--p6N;2^KfO{%uNDR8(D1@CWptPO(fM*?rbM z3GZ`7r&f20{#>17r5%i?BH?iDd_mBqjn(^^ZCHqcPMGUNBjc0tPX?6V7+>#|KIpzUXt(+(WB%{97o+dF| z1*@xdiKXCZsUad)_^@h%65`TB&dlt9x|7Z#`57Gl8?R|?bxc4o$>Ga zP0AvD;SP_05Uy4QGDDe@SR28jRUhI`D+OcVgDf<$!pZ`uW+wApb`R-P;yqU6$!`Ao$SL zl}Dvp--ygYlhSSw~-44T$uXh=|fpixV8&&Siotw%6M}x&I z7A})P_b6^h_iDupRSDUeJG#M0oRGqwJk)t+hzMNA=HvNtp+30y*$+buw+1)Q=Vs<} z!N)z(rcxdA;rSo_jHd~K-uFsjNi%>*F2m#i5P=G=HImk!4dwf@+>7a3ilfcvc^}^{ z-C*36c5!`+-E}E4nbU{*{+A*2k6Ia9S^+t;jKSmPGZkeV8;z$nJ8=*)adSS3alBT$ zJF0`JLT{C_cDEUDqcAZaxIJ&uk(IPFJv*ZOyH4YA8fbXg06A0l`yPe|_ZQ`ZnSA_y z&nFVN;U@YtJ~!pC`=8d)0%waY@IQTgaNhdAYsA#4@7qN4M$9|i49cB~hF29Jsvx-iYI}f z_te{++`YMIoNXp^f31&F5z#n5K1DF1Fp3Nj|AodT>c4**t#8ZarOMrA*~~KsJe!Tl zSoM10?(rv0`k`*6Oj^2T%(zSHHxqvAn-Z7r6R16R5JjwAJJT_`ugyDtKU{{HLve+38WGAhHCg`r_!IUF^0H| z#w7MWYI}?x8@QfAMx~?DnI5Y#OM4_XcfKCFKtO5q?d$VR{;1lx)X>np8UG@%e3VCB2KN>U2ZCEju8oqZLVd3aV`f-pz?K2s=k zQnGS65l*bDfsVZa07A-6se<1TmQ=djU?F$^zbZTLcR2dK4M(|&Xo={82&;u?5xv(C zJyy4@h!)+7E_yG)k|046(aY*(^+gc9cQ)#-8ofW`e&6R0c;@$+V~&|Q=9sy@=jXi2 zVY6h31A18+dtNtr0?yaERD*y$S@L3RbPD0m;JG^!#c?hbl-h3$Z9^_PMXm0ewn2HD zBruG(NS;FHQ5+>UlDbIB!>G)>K3F82OrdD4WGGLC`SSGY1mjuxM4G#)h_(=&QA zP0Ne(#w>nx$)sZ4<-^ITrG4+O)4)*W+wBHUqe33}cJ%%G^fA%!!fg4@-cQo7dviO* z?rLuot9A^^F>0@I?3Ysq4)i=gVfW?INWbxEw4lRpB56=?g zD)|=a1oiJ1RMO^7sx}>uh3hXXW0!E$U2&0taf&$LA@ z&6q&Q2S74f5XpkBF=&6k_$oLrLL~l?7|)X%c3s-;VF&xMAD;~YYoo8<<@Pfg;R9sd zLA~1=wdKhK_78d&%RNz9Yn*k0dl0@^oekF@ivdZxUK&<8j^ih@`;~(Gtb0tD0*Bjk z^Np%AjrjrnMtco!#&C->Ia2)1U8JO$uojT$#bMJY@d%pp7Z)GBz^C&cS<7AyWK6a6 zlb1}rLEs-@L=<lX)aO}nG>xE9+qB;}s9TpmiL z0|9qR0;#}^&?&&A6Zvr4@WX)&xf^Kj2K51J2o@!S^9<{qeE;STaYG4t>)WaLMeZSczOQ8l=YZ zN?ehtMX^U$)MYQ!aO-L;m;By6)cYir-xrq7$T&Vw%lg#|hyqXvJWN9y4zC)hvI{Nm> zr&-ry`8xv;vWZW24t7I8C8yTD_G7_cH z+MR0t8!Tv=C-U!CdqLX4>%Xt50KP;H&~lF*k;WtAZ&mMrtiA_f)tQ6~gz4XwLr-Kb zDUm`VvhgrpHUc~p6jX^iVxRYw`Wa|YVob&-cA8H0G*L{Q`nm1UU53dr8XdTQnOR4@ zkj=xtiyc^*Gk6&Motz!YYk>`cdX0E&9+iEJG`(U)@IG96;zpI^yEF}Ut9@4*A6 zXXw`&^K)9GH&Q1_BF_Khs?N|CZ`JkkTY6nqZ>0;p%C)JEY?@OZCfWVZoU7wAak`Q{Pm6NlB z=b5*N1yB@*By-Hbt~1WoKqpHX&+9GPGPxV5Q0=Tm1|_Y{O^ra;sW+n4%`Wq=rZ$hW z0;;=Wz=`9_U8Qpq<(!AM_V>6*^A)3HIoMD|Mg3eBjN+bDMZOF*yV9YoD)HGbE5T3d zfQiCiEP!y^ay2>^BM9fz(Ul;(HvoJuwN88?9J=YjxfSId?o2$$$;ml!ESWAI1M9X;U_zavg3;bbF{2V1hYZ4(f`eY$u?vGB#U-=mGSxVWVSkvb&6ct1__r?QC9ZzI;M>PxC;R8e%I68Q;jwgfSKi)4eSa z&hS_r1HdGSm*tNeb7NTIU1h&&?6EyZ4Tv=52hD-SN^vUd@hA00@gyLC05;&g(&Nyw zC+sG0JiW0JBFG%RKm_;*wI;~;#Q^=Ree1$r7jXt3x!m85CHe&NF;=j^Zeb|Iq`o9C zcO>Xj;_0JFP6WX$Y@;}fj*wTUu!?d)BPd&9;4CF`R!tNX>TV=9^RBHX!{v)!X7H+s zxZQ?qAJ~!K>z4y2*q}h0;`>4XUWswF!n7OJp;y%>x;+1@{*N1T^$h2S8=>db+}~jb z1ON!!T2@K@I50?3{3t3e3qAS6$bFhmu6S3?ZNx)dA=?dJ7#SO>-B;~*mgKV@9TW4g z=G`^1)*&|Ryt?QcAix~SDMo!7Y`$MqGUPZ~FgGWfYbR~5|1^PKzZYX_u3KR0`rP?7 z1Hg@f)l;8b4|72B!+vu?H5kT+ADn0X97w97epNjpbMSJW9zIm>sJ;ROy0^??T2)$O*apda_VINDrVn3AYWKpscy8_Y zXFc?q_-4#q7_>e!xaHuq>bGbdx5@EVl<$;<;6NlcL%@o?N#twX==sk2dftWZp(qvS zbGFwB{a@3%SE*bo0=&FF8E04Vi_vz#j4Gm6IWI=W_=J8S?lVA;3v6VVtkKl3R#NqR1P>IB)qSF6{!7jD>6;doCh|C`J zHG>f!!rA5h^K!oZdQOtPwnfi*@VWMD=k+e$Z#{nmNo%lm7p_s;Q=0GJ(WVnt{7AV$ ziHHA?r8dWwoMlmLEdfmRW+lAV(ae5bNK*3mA|XJQVT((47JQ9vXe_UP68-Dzd_>M& z9PWGT>&y|jEs^5?ztAh_J8zJckn~|x{(0IP6{(GE-Au<4QHM@+X;)38Q3h0V9xj2=>Z%{;-E*_Z!rlt zNMpH?iK9t6VtBkI=rAdd3~|f!yn)!N-i7`-Md~`)zn-vA)l*Gg(VIQ}CG)~X`dH9N zLPYXzQkma|R2FWR4cEol*&hJlKmSql`?JtuR{7tL?v!9^vMj^F7SmIP$^BvI9Ox{F z1W2t2i=<|lPHcUL>g=+}BmBSWN>1BZ|4PJ>mX@}EH?pyE5WQ<+*wNnpTD#1wG4+rw zkear3`B_vW9k4SiVOSEeQt}|>nu%)NUfU_9J_NGp`w-kmkz4-PZl4ltTpU}itf;u* zObK@C4*B;YCvc~B4MSJuW8m#-4sc>#gXZlJ>`o6f*F{%xy9C^v8d?U}U1>#VM+i+8ZVScJME3@0BsNMHqvhcETsP!^SJXCAihs^gzZKG|nCu zDJ=0c`jUed_J`TNS33|3vY&+glQGFGE-hfg2vN{TzhtS)%0;sFu!SFJx1) z1RcvT+&+cj857uf@$%PU!eYv%K!6wsZzQsF+cEmL&dkO66QLOckR2-ETobmmGd+MX S&_vt;wwFqpily=v!T$m8U$k2Q literal 0 HcmV?d00001 diff --git a/windows/deployment/index.md b/windows/deployment/index.md index 6841274b4c..c43584706f 100644 --- a/windows/deployment/index.md +++ b/windows/deployment/index.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: high -ms.date: 09/05/2017 +ms.date: 10/18/2017 author: greg-lindsay --- @@ -31,6 +31,7 @@ Windows 10 upgrade options are discussed and information is provided about plann |[Overview of Windows AutoPilot](windows-10-auto-pilot.md) |Windows AutoPilot deployment is a new cloud service from Microsoft that provides a zero touch experience for deploying Windows 10 devices. | |[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md) |This topic provides information about support for upgrading directly to Windows 10 from a previous operating system. | |[Windows 10 edition upgrade](upgrade/windows-10-edition-upgrades.md) |This topic provides information about support for upgrading from one edition of Windows 10 to another. | +|[Windows 10 volume license media](windows-10-media.md) |This topic provides information about media available in the Microsoft Volume Licensing Service Center. | |[Manage Windows upgrades with Upgrade Readiness](upgrade/manage-windows-upgrades-with-upgrade-readiness.md) |With Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With Windows telemetry enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. | |[Windows 10 deployment test lab](windows-10-poc.md) |This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, additional guides are provided to deploy Windows 10 in the test lab using [Microsoft Deployment Toolkit](windows-10-poc-mdt.md) or [System Center Configuration Manager](windows-10-poc-sc-config-mgr.md). | |[Plan for Windows 10 deployment](planning/index.md) | This section describes Windows 10 deployment considerations and provides information to assist in Windows 10 deployment planning. | diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md index 012f8fe68e..cfafe38c9a 100644 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ b/windows/deployment/windows-10-enterprise-subscription-activation.md @@ -23,7 +23,7 @@ With Windows 10 version 1703 (also known as the Creator’s Update), both Window Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-whatis). See the following topics in this article: -- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): +- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. - [Requirements](#requirements): Prerequisites to use the Windows 10 Enterprise subscription model. - [Benefits](#benefits): Advantages of Windows 10 Enterprise + subscription-based licensing. - [How it works](#how-it-works): A summary of the subscription-based licensing option. diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md new file mode 100644 index 0000000000..67e3b2e2b4 --- /dev/null +++ b/windows/deployment/windows-10-media.md @@ -0,0 +1,90 @@ +--- +title: Windows 10 volume license media +description: There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. +keywords: deploy, upgrade, update, software, media +ms.prod: w10 +ms.mktglfcycl: plan +ms.localizationpriority: high +ms.date: 10/18/2017 +ms.sitesec: library +author: greg-lindsay +--- + +# Windows 10 volume license media + + +**Applies to** + +- Windows 10 + +With each release of Windows 10, volume license media is made available on the [Volume Licensing Service Center](http://www.microsoft.com/vlsc) (VLSC) and other relevant channels such as Windows Update for Business, Windows Server Update Services (WSUS), and Visual Studio Subscriptions. This topic provides a description of volume license media, and describes some of the changes that have been implemented with the current release of Windows 10. + +## Windows 10 media + +To download Windows 10 installation media from the VLSC, use the product search filter to find “Windows 10.”  A list of products will be displayed. The page then allows you to use your search results to download products, view keys, and view product and key descriptions. + +When you select a product, for example “Windows 10 Enterprise” or “Windows 10 Education”, you can then choose the specific release by clicking **Download** and choosing the **Download Method**, **Language**, and **Operating system Type** (bitness). + +>If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/en-us/windows/release-info.aspx). + +In Windows 10, version 1709 the packaging of volume licensing media and upgrade packages is different than it has been for previous releases. Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. The following section explains this change. + +### Windows 10, version 1709 + +Windows 10, version 1709 is available starting on 10/17/2017 in all relevant distribution channels. Note: An updated [Windows ADK for Windows 10](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) is also available. + +For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: + +![Images](images\table01.png) + +When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or System Center Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. + +For packages published to Windows Server Update Services (WSUS), you’ll also notice the change because, instead of having separate packages for each Windows edition, there will be just one package: + +
+ +| Title | Classification | Description | +| --- | --- | --- | +| Feature update to Windows 10, version 1709, \ | Upgrades | Package to upgrade Windows 10 Pro (VL), Windows 10 Enterprise, or Windows 10 Education to version 1709 | +| Windows 7 and 8.1 upgrade to Windows 10, version 1709, \ | Upgrades | Package to upgrade Windows 7 Professional (VL), Windows 7 Enterprise, Windows 8.1 Professional (VL), or Windows 8.1 Enterprise to Windows 10 1709 | + +
+ +When you approve one of these packages, it applies to all of the editions. + +This Semi-Annual Channel release of Windows 10 continues the Windows as a service methodology.  For more information about implementing Windows as a service in your organization in order to stay up to date with Windows, see [Update Windows 10 in the enterprise](https://aka.ms/waas). + + +### Language packs + +- **Windows 10 versions 1507 and 1511**: you can select **Windows 10 Enterprise Language Pack**, click **Download** and then select **English** and **64-bit** to see these downloads.  +- **Windows 10 1607 and later**: you must select **Multilanguage** from the drop-down list of languages. + +See the following example for Windows 10, version 1709: + +![Windows 10, version 1709 lang pack](images\lang-pack-1709.png) + +### Features on demand + +[Features on demand](https://blogs.technet.microsoft.com/mniehaus/2015/08/31/adding-features-including-net-3-5-to-windows-10/) can be downloaded by searching for "**Windows 10 Enterprise Features on Demand**" and then following the same download process that is described above. + +Features on demand is a method for adding features to your Windows 10 image that aren’t included in the base operating system image. + + +## Related topics + +[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/en-us/download/details.aspx?id=10585) +
[Volume Activation for Windows 10](https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10) +
[Plan for volume activation](https://docs.microsoft.com/en-us/windows/deployment/volume-activation/plan-for-volume-activation-client) +
[VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) +
[Download and burn an ISO file on the volume licensing site (VLSC)](https://support.microsoft.com/help/2472143/download-and-burn-an-iso-file-on-the-volume-licensing-site-vlsc) + + +  + +  + + + + + From 39a794daefe5c4ef3a71f1339a519f02b3571c56 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 20 Oct 2017 13:33:13 -0700 Subject: [PATCH 30/90] added Windows 10 app control --- .../device-guard/device-guard-deployment-guide.md | 3 +++ ...ization-based-security-and-code-integrity-policies.md | 9 ++++++--- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/device-security/device-guard/device-guard-deployment-guide.md b/windows/device-security/device-guard/device-guard-deployment-guide.md index b322bd2f63..f26d463253 100644 --- a/windows/device-security/device-guard/device-guard-deployment-guide.md +++ b/windows/device-security/device-guard/device-guard-deployment-guide.md @@ -18,6 +18,9 @@ ms.date: 10/11/2017 Windows Defender Device Guard is a combination of enterprise-related hardware and software security features that run on Windows 10 Enterprise edition and Windows Server. When these features are configured together, Windows Defender Device Guard will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted, it can’t run, period. +> [!NOTE] +> Beginning with Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control. + With hardware that meets basic qualifications, Windows Defender Device Guard can also use virtualization-based security to isolate the Code Integrity service and run it alongside the Windows kernel in a hypervisor-protected container. Even if an attacker manages to get control of the Windows kernel itself, the ability to run malicious executable code is much less likely. This guide explores the individual features in Windows Defender Device Guard as well as how to plan for, configure, and deploy them. It includes: diff --git a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md index 14f89fa9e5..7489625b93 100644 --- a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md +++ b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -17,9 +17,12 @@ ms.date: 10/11/2017 With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Windows Defender Device Guard changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. You designate these trusted apps by creating *code integrity policies*. +> [!NOTE] +> Beginning with Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control. + On hardware that includes CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT), Windows Defender Device Guard can also use Virtualization Based Security (VBS) to run the Code Integrity service alongside the kernel in a Windows hypervisor-protected container, which increases the security of code integrity policies. On hardware that includes input/output memory management units (IOMMUs), Windows Defender Device Guard can also help protect against DMA attacks. The following table provides more information about how Windows Defender Device Guard and these hardware features can help protect against various threats. -When configurable code integrity policies and hardware-based security features are combined, Windows Defender Device Guard provides a locked-down configuration for computers. But they can also be deployed independently. To help distinguish the value of each offering, beginning with Windows 10 version 1709, configurable code integrity policies are known as Windows Defender Application Control. The virtualization-based security of code integrity policies is part of Windows Defender Exploit Guard. Windows Defender Device Guard is the locked-down configuration you can achieve by using Windows Defender Application Control, Windows Defender Exploit Guard, and other Hardware and BIOS configuration options. +When Windows Defender Application Control and hardware-based security features are combined, Windows Defender Device Guard provides a locked-down configuration for computers. ## How Windows Defender Device Guard features help protect against threats @@ -37,9 +40,9 @@ In this guide, you learn about the individual features found within Windows Defe ## New and changed functionality -As of Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control. +Beginning with Windows 10, version 1709, configurable code integrity policies are known as Windows Defender Application Control. -As of Windows 10, version 1703, you can use code integrity policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser). For more information, see [Use a code integrity policy to control specific plug-ins, add-ins, and modules](deploy-code-integrity-policies-steps.md#plug-ins). +Beginning with Windows 10, version 1703, you can use code integrity policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser). For more information, see [Use a code integrity policy to control specific plug-ins, add-ins, and modules](deploy-code-integrity-policies-steps.md#plug-ins). ## Tools for managing Windows Defender Device Guard features From 39a2cb62961612c9e4517d51129b5dc8a0fba776 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Fri, 20 Oct 2017 21:00:30 +0000 Subject: [PATCH 31/90] Merged PR 3989: Remove Whiteboard CSP references --- .../surface-hub/change-history-surface-hub.md | 6 +++-- ...anage-settings-with-mdm-for-surface-hub.md | 22 +------------------ .../surface-hub/whiteboard-collaboration.md | 18 +-------------- 3 files changed, 6 insertions(+), 40 deletions(-) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index c66f87f8a8..c669a32f82 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -16,7 +16,7 @@ ms.localizationpriority: medium This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md). -## Octoboer 2017 +## October 2017 New or changed topic | Description | --- | --- @@ -24,6 +24,8 @@ New or changed topic | Description | [Hybrid deployment](hybrid-deployment-surface-hub-device-accounts.md) | Updated the instructions for Exchange on-premises [Create a device account using UI](create-a-device-account-using-office-365.md) | Updated the instructions [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | Clarified user sign-in on Surface Hub +[Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Removed **How to control and manage Whiteboard to Whiteboard collaboration** due to issues with the EnterpriseModernAppmanagement CSP losing state during End Session. +| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Removed settings for managing Whiteboard collaboration. | ## September 2017 @@ -59,7 +61,7 @@ New or changed topic | Description | New or changed topic | Description | | --- | --- | | [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | New | -| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md#whiteboard-collaboration-settings) | Added settings for managing Whiteboard collaboration | +| [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Added settings for managing Whiteboard collaboration | ## RELEASE: Windows 10, version 1703 diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md index 0fa469597a..12a1d052f8 100644 --- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md +++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub, mobility author: jdeckerms ms.author: jdecker -ms.date: 06/19/2017 +ms.date: 10/20/2017 ms.localizationpriority: medium --- @@ -183,27 +183,7 @@ The following tables include info on Windows 10 settings that have been validate | Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. -### Whiteboard collaboration settings -MDM settings for Whiteboard collaboration use the **AppManagement/AppStore** node of the [EnterpriseModernAppManagement CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisemodernappmanagement-csp#appmanagement-appstore) to configure an **AppSettingPolicy**. - -The value for each setting can be **True** or **False**. The default value for each setting is **False**. - -The OMA URI for each setting consists of `./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/` and the string from the **OMA URI** column in the table. For example, the full OMA URI for **Enable sign-in** is `./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableSignIn`. - - -| Setting | Details | OMA URI | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML*? | -| --- | ---- | --- |---- | --- | --- | -| Enable sign-in | Users can sign in and authenticate | EnableSignIn | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable sign-in | Users are unable to sign in and access collaboration or education features | DisableSignIn | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Collaboration | Users can sign in but not create or join collaborative sessions | DisableCollaboration | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Sharing | Hide entry points for the Share button, hiding export in the Share charm and Collaboration | DisableSharing | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Export | Users cannot send whiteboards using email, thumb drives, or other mechanisms through the Share charm | DisableExport | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Enable Ink to Shape | **Ink to Shape** is on by default when users open Whiteboard | EnableInkShapes | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Ink to Shape | **Ink to Shape** is off by default when users open Whiteboard | DisableInkShapes | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Enable Ink to Table | **Ink to Table** is on by default when users open Whiteboard | EnableInkTables | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -| Disable Search | Hide entry points for Bing Search | DisableSearch | Yes
[Use a custom policy.](#example-intune) | Yes.
[Use a custom setting.](#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. ### Generate OMA URIs for settings You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager. diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md index 87f6088e2c..e7013de28c 100644 --- a/devices/surface-hub/whiteboard-collaboration.md +++ b/devices/surface-hub/whiteboard-collaboration.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 07/13/2017 +ms.date: 10/20/2017 ms.localizationpriority: medium --- @@ -54,22 +54,6 @@ After you’re done, you can export a copy of the Whiteboard collaboration for y >[!TIP] >When you start a collaboration session, Whiteboard creates a folder named **Whiteboard App Data** in your OneDrive for Business to store your shared whiteboards. After some collaboration sessions, this folder may continue to sync or process changes indefinitely. You can fix this by choosing to not sync the **Whiteboard App Data** folder to your device. Disabling sync for this folder won't limit your ability to use Whiteboard for collaboration sessions. -## How to control and manage Whiteboard to Whiteboard collaboration - -Whiteboard has settings that can be managed via MDM. These allow you to disable or enable collaboration functionality in case your organization can’t meet the prerequisites or you’d rather not have your organization use this feature. - -The value for each setting can be True or False. The default value for each setting is False. - -The OMA URI for each setting consists of `./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/` and the string from the OMA URI column in the table. For example, the full OMA URI for **Enable sign-in** is `./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Microsoft.Office.Whiteboard_8wekyb3d8bbwe/AppSettingPolicy/EnableSignIn`. - -| Setting | Details | OMA URI | Supported with
Intune? | Supported with
Configuration Manager? | Supported with
SyncML*? | -| --- | ---- | --- |---- | --- | --- | -| Enable sign-in | Users can sign in and authenticate | EnableSignIn | Yes
[Use a custom policy.](manage-settings-with-mdm-for-surface-hub.md#example-intune) | Yes.
[Use a custom setting.](manage-settings-with-mdm-for-surface-hub.md#example-sccm) | Yes | -| Disable sign-in | Users are unable to sign in and access collaboration or education features | DisableSignIn | Yes
[Use a custom policy.](manage-settings-with-mdm-for-surface-hub.md#example-intune) | Yes.
[Use a custom setting.](manage-settings-with-mdm-for-surface-hub.md#example-sccm) | Yes | -| Disable Collaboration | Users can sign in but not create or join collaborative sessions | DisableCollaboration | Yes
[Use a custom policy.](manage-settings-with-mdm-for-surface-hub.md#example-intune) | Yes.
[Use a custom setting.](manage-settings-with-mdm-for-surface-hub.md#example-sccm) | Yes | -\*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. - -Whiteboard also has other MDM settings that can be managed and set for defaults, exporting, and sharing. You can see these additional settings in [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md#whiteboard-collaboration-settings). From df69bf5c65aa1ccb26db43d533074b7f1b026818 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 20 Oct 2017 14:20:39 -0700 Subject: [PATCH 32/90] revised app control --- .../deploy-catalog-files-to-support-code-integrity-policies.md | 2 +- ...eploy-code-integrity-policies-policy-rules-and-file-rules.md | 2 +- .../device-guard/deploy-code-integrity-policies-steps.md | 2 +- .../deploy-device-guard-deploy-code-integrity-policies.md | 2 +- .../deploy-device-guard-enable-virtualization-based-security.md | 2 +- .../device-guard/deploy-managed-installer-for-device-guard.md | 2 +- .../device-guard/device-guard-deployment-guide.md | 2 +- ...virtualization-based-security-and-code-integrity-policies.md | 2 +- ...te-a-code-signing-certificate-for-code-integrity-policies.md | 2 +- ...nd-getting-started-on-the-device-guard-deployment-process.md | 2 +- ...ments-and-deployment-planning-guidelines-for-device-guard.md | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md index f37226da6a..72fe5c9576 100644 --- a/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md +++ b/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Deploy catalog files to support code integrity policies diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md b/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md index 178a8f9855..c8016cda8c 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Deploy code integrity policies: policy rules and file rules diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index ab0c065444..47d2848249 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Deploy code integrity policies: steps diff --git a/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md b/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md index 4b645887c8..319f383f40 100644 --- a/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md +++ b/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Deploy Windows Defender Device Guard: deploy code integrity policies diff --git a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md index 11452fddd2..a4823e4143 100644 --- a/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Deploy Windows Defender Device Guard: enable virtualization-based security diff --git a/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md b/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md index d21bd16a25..ae71744549 100644 --- a/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md +++ b/windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: mdsakibMSFT -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Deploy Managed Installer for Windows Defender Device Guard diff --git a/windows/device-security/device-guard/device-guard-deployment-guide.md b/windows/device-security/device-guard/device-guard-deployment-guide.md index f26d463253..4b9c59e523 100644 --- a/windows/device-security/device-guard/device-guard-deployment-guide.md +++ b/windows/device-security/device-guard/device-guard-deployment-guide.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Windows Defender Device Guard deployment guide diff --git a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md index 7489625b93..8e7f7cbde4 100644 --- a/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md +++ b/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Introduction to Windows Defender Device Guard: virtualization-based security and code integrity policies diff --git a/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md b/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md index 8d61303129..b70de832d1 100644 --- a/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md +++ b/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Optional: Create a code signing certificate for code integrity policies diff --git a/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md index 40ef2937d0..d3bb26de08 100644 --- a/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md +++ b/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Planning and getting started on the Windows Defender Device Guard deployment process diff --git a/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md index 7bb8fca767..a655e65478 100644 --- a/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: high author: brianlic-msft -ms.date: 10/11/2017 +ms.date: 10/20/2017 --- # Requirements and deployment planning guidelines for Windows Defender Device Guard From 44916875e1cb2f36527f74759167ef4d97a6c86a Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Fri, 20 Oct 2017 18:47:59 -0700 Subject: [PATCH 33/90] Hybrid key trust On-Prem key trust Deployment Guide landing page TOC update minor types and fixes in existing content --- .../hello-adequate-domain-controllers.md | 2 +- .../hello-deployment-guide.md | 10 +- .../hello-hybrid-cert-new-install.md | 3 +- .../hello-hybrid-cert-whfb-provision.md | 8 +- .../hello-hybrid-key-new-install.md | 34 +- .../hello-hybrid-key-trust-devreg.md | 453 +----------------- .../hello-hybrid-key-trust-dirsync.md | 37 ++ .../hello-hybrid-key-trust-prereqs.md | 46 +- .../hello-hybrid-key-trust.md | 12 +- .../hello-hybrid-key-whfb-provision.md | 34 +- .../hello-hybrid-key-whfb-settings-ad.md | 54 +-- .../hello-hybrid-key-whfb-settings-adfs.md | 89 ---- ...hello-hybrid-key-whfb-settings-dir-sync.md | 58 +-- .../hello-hybrid-key-whfb-settings-pki.md | 111 +---- .../hello-hybrid-key-whfb-settings-policy.md | 71 +-- .../hello-hybrid-key-whfb-settings.md | 26 +- .../hello-planning-guide.md | 8 +- .../hello-for-business/images/createPin.png | Bin 0 -> 28388 bytes .../hello-for-business/toc.md | 15 + 19 files changed, 230 insertions(+), 841 deletions(-) create mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md delete mode 100644 windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md create mode 100644 windows/access-protection/hello-for-business/images/createPin.png diff --git a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md index 6c241b2434..1f5c6f440f 100644 --- a/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/access-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 10/09/2017 +ms.date: 10/20/2017 --- # Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments diff --git a/windows/access-protection/hello-for-business/hello-deployment-guide.md b/windows/access-protection/hello-for-business/hello-deployment-guide.md index 877770ddae..c202596cd4 100644 --- a/windows/access-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/access-protection/hello-for-business/hello-deployment-guide.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfin -ms.localizationpriority: high -ms.author: daniha -ms.date: 09/08/2017 +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/20/2017 --- # Windows Hello for Business Deployment Guide @@ -47,7 +47,9 @@ Hybrid deployments are for enterprises that use Azure Active Directory. On-prem The trust model determines how you want users to authentication to the on-premises Active Directory. Remember hybrid environments use Azure Active Directory and on-premises Active Directory. The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and they have an adequate number of 2016 domain controllers in each site to support the authentication. The certificate-trust model is for enterprise that do want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. The certificate trust model is also enterprise who are not ready to deploy Windows Server 2016 domain controllers. Following are the various deployment guides included in this topic: +* [Hybrid Key Trust Deployment](hello-hybrid-key-trust.md) * [Hybrid Certificate Trust Deployment](hello-hybrid-cert-trust.md) +* [On Premises Key Trust Deployment](hello-deployment-key-trust.md) * [On Premises Certificate Trust Deployment](hello-deployment-cert-trust.md) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md index a60357cfcf..421a89896a 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- # Windows Hello for Business Certificate Trust New Installation @@ -23,7 +23,6 @@ Windows Hello for Business involves configuring distributed technologies that ma * [Active Directory](#active-directory) * [Public Key Infrastructure](#public-key-infrastructure) * [Azure Active Directory](#azure-active-directory) -* [Directory Synchronization](#directory-synchronization) * [Active Directory Federation Services](#active-directory-federation-services) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 744f4930a3..c9a094726b 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- # Hybrid Windows Hello for Business Provisioning @@ -24,9 +24,7 @@ The Windows Hello for Business provisioning begins immediately after the user ha ![Event358](images/Event358.png) -The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **EnterpriseJoined** reads **Yes**. - -![dsreg output](images/dsregcmd.png) +The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. @@ -39,7 +37,7 @@ The provisioning flow proceeds to the Multi-Factor authentication portion of the After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. - +![Create a PIN during provisioning](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md index 304f4fe766..e073f952ce 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 10/09/2017 +ms.date: 10/20/2017 --- # Windows Hello for Business Key Trust New Installation @@ -23,23 +23,22 @@ Windows Hello for Business involves configuring distributed technologies that ma * [Active Directory](#active-directory) * [Public Key Infrastructure](#public-key-infrastructure) * [Azure Active Directory](#azure-active-directory) -* [Directory Synchronization](#directory-synchronization) * [Active Directory Federation Services](#active-directory-federation-services) -New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your exsting envrionment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) section to prepare your Windows Hello for Business deployment by configuring Azure device registration. +New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your exsting envrionment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) section to prepare your Windows Hello for Business deployment by configuring directory synchronization. -The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. This document expects you have Active Directory deployed with an adeqate number of Windows Server 2016 domain controllers for each site. +The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. ## Active Directory ## -Production environments should follow Active Directory best practices regarding the number and placement of domain controllers to ensure adequate authentication throughout the organization. - +This document expects you have Active Directory deployed with an _adequate_ number of Windows Server 2016 domain controllers for each site. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. + Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal. ### Section Review > [!div class="checklist"] -> * An adequate number of Windows Server 2016 R2 domain controllers +> * An adequate number of Windows Server 2016 domain controllers > * Minimum Windows Server 2008 R2 domain and forest functional level > * Functional networking, name resolution, and Active Directory replication @@ -73,12 +72,19 @@ Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 o If you do have an existing public key infrastructure, please review [Certification Authority Guidance](https://technet.microsoft.com/library/hh831574.aspx) from Microsoft TechNet to properly design your infrastructure. Then, consult the [Test Lab Guide: Deploying an AD CS Two-Tier PKI Hierarchy](https://technet.microsoft.com/library/hh831348.aspx) for instructions on how to configure your public key infrastructure using the information from your design session. +> [!IMPORTANT] +> For Azure AD joined device to authenticate to and use on-premises resources, ensure you: +> * Install the root certificate authority certificate for your organization in the user's trusted root certifcate store. +> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based url. + ### Section Review ### > [!div class="checklist"] > * Miniumum Windows Server 2012 Certificate Authority. > * Enterprise Certificate Authority. > * Functioning public key infrastructure. +> * Root certifcate authority certificate (Azure AD Joined devices). +> * Highly availalbe certificate revoication list (Azure AD Joined devices). ## Azure Active Directory ## You’ve prepared your Active Directory. Hybrid Windows Hello for Business deployment needs Azure Active Directory to host your cloud-based identities. @@ -93,7 +99,7 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h > * Purchase the appropriate Azure Active Directory subscription or licenses, if necessary. ## Multifactor Authentication Services ## -Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA +Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. @@ -136,9 +142,11 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation

## Follow the Windows Hello for Business hybrid key trust deployment guide -1. [Overview](hello-hybrid-key-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) 3. New Installation Baseline (*You are here*) -4. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) -5. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) + diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index 51dc7b8538..fb5bc8c75d 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -1,5 +1,5 @@ --- -title: Configure Device Registration for Hybrid Windows Hello for Business +title: Configure Device Registration for Hybrid key trust Windows Hello for Business description: Azure Device Registration for Hybrid Certificate Key Deployment (Windows Hello for Business) keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, device, registration ms.prod: w10 @@ -9,25 +9,17 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 10/09/2017 +ms.date: 10/20/2017 --- -# Configure Device Registration for Hybrid Windows Hello for Business +# Configure Device Registration for Hybrid key trust Windows Hello for Business **Applies to** - Windows 10 ->[!IMPORTANT] + >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. -You're environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. - -> [!IMPORTANT] -> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. - -Use this three phased approach for configuring device registration. -1. [Configure devices to register in Azure](#configure-azure-for-device-registration) -2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-syncrhonization) -3. [Configure AD FS to use cloud devices](#configure-ad-fs-to-use-azure-registered-devices) +You are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration to enable proper device authentication. > [!NOTE] > Before proceeding, you should familiarize yourself with device regisration concepts such as: @@ -42,441 +34,18 @@ Begin configuring device registration to support Hybrid Windows Hello for Busine To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/en-us/documentation/articles/active-directory-azureadjoin-setup/) -## Configure Active Directory to support Azure device syncrhonization +Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/en-us/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) page. In the **Configuration steps** section, identify you configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a checkmark. -Azure Active Directory is now configured for device registration. Next, you need to configure the on-premises Active Directory to support synchronizing hybrid Azure AD joined devices. Begin with upgrading the Active Directory Schema - -### Setup Active Directory Federation Services -If you are new to AD FS and federation services, you should review [Understanding Key AD FS Concepts](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/technical-reference/understanding-key-ad-fs-concepts) to prior to designing and deploying your federation service. -Review the [AD FS Design guide](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/design/ad-fs-design-guide-in-windows-server-2012-r2) to plan your federation service. - -Once you have your AD FS design ready, review [Deploying a Federation Server farm](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/deploying-a-federation-server-farm) to configure AD FS in your environment. -> [!IMPORTANT] -> During your AD FS deployment, skip the **Configure a federation server with Device Registration Service** and the **Configure Corporate DNS for the Federation Service and DRS** procedures. - - -#### ADFS Web Proxy ### -Federation server proxies are computers that run AD FS software that have been configured manually to act in the proxy role. You can use federation server proxies in your organization to provide intermediary services between an Internet client and a federation server that is behind a firewall on your corporate network. -Use the [Setting of a Federation Proxy](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment. - -### Deploy Azure AD Connect -Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). - -When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**. - -### Create AD objects for AD FS Device Authentication -If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration. - -![Device Registration](images/hybridct/device1.png) - -> [!NOTE] -> The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1. - -1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**. - -![Device Registration](images/hybridct/device2.png) - -2. On your AD FS primary server, ensure you are logged in as AD DS user with Enterprise Admin (EA ) privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: - - `Import-module activedirectory` - `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "" ` -3. On the pop-up window click **Yes**. - -> [!NOTE] -> If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$" - -![Device Registration](images/hybridct/device3.png) - -The above PSH creates the following objects: - - -- RegisteredDevices container under the AD domain partition -- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration -- Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration - -![Device Registration](images/hybridct/device4.png) - -4. Once this is done, you will see a successful completion message. - -![Device Registration](images/hybridct/device5.png) - -### Create Service Connection Point (SCP) in Active Directory -If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS -1. Open Windows PowerShell and execute the following: - - `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" ` - -> [!NOTE] -> If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep - -![Device Registration](images/hybridct/device6.png) - -2. Provide your Azure AD global administrator credentials - - `PS C:>$aadAdminCred = Get-Credential` - -![Device Registration](images/hybridct/device7.png) - -3. Run the following PowerShell command - - `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred ` - -Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory. - -The above commands enable Windows 10 clients to find the correct Azure AD domain to join by creating the serviceConnectionpoint object in AD DS. - -### Prepare AD for Device Write Back -To ensure AD DS objects and containers are in the correct state for write back of devices from Azure AD, do the following. - -1. Open Windows PowerShell and execute the following: - - `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name] ` - -Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format - -The above command creates the following objects for device write back to AD DS, if they do not exist already, and allows access to the specified AD connector account name - -- RegisteredDevices container in the AD domain partition -- Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration - -### Enable Device Write Back in Azure AD Connect -If you have not done so before, enable device write back in Azure AD Connect by running the wizard a second time and selecting **"Customize Synchronization Options"**, then checking the box for device write back and selecting the forest in which you have run the above cmdlets - -## Configure AD FS to use Azure registered devices - -### Configure issuance of claims - -In a federated Azure AD configuration, devices rely on Active Directory Federation Services (AD FS) or a 3rd party on-premises federation service to authenticate to Azure AD. Devices authenticate to get an access token to register against the Azure Active Directory Device Registration Service (Azure DRS). - -Windows current devices authenticate using Integrated Windows Authentication to an active WS-Trust endpoint (either 1.3 or 2005 versions) hosted by the on-premises federation service. - -> [!NOTE] -> When using AD FS, either **adfs/services/trust/13/windowstransport** or **adfs/services/trust/2005/windowstransport** must be enabled. If you are using the Web Authentication Proxy, also ensure that this endpoint is published through the proxy. You can see what end-points are enabled through the AD FS management console under **Service > Endpoints**. -> -> If you don't have AD FS as your on-premises federation service, follow the instructions of your vendor to make sure they support WS-Trust 1.3 or 2005 end-points and that these are published through the Metadata Exchange file (MEX). - -The following claims must exist in the token received by Azure DRS for device registration to complete. Azure DRS will create a device object in Azure AD with some of this information which is then used by Azure AD Connect to associate the newly created device object with the computer account on-premises. - -* `http://schemas.microsoft.com/ws/2012/01/accounttype` -* `http://schemas.microsoft.com/identity/claims/onpremobjectguid` -* `http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid` - -If you have more than one verified domain name, you need to provide the following claim for computers: - -* `http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid` - -If you are already issuing an ImmutableID claim (e.g., alternate login ID) you need to provide one corresponding claim for computers: - -* `http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID` - -In the following sections, you find information about: - -- The values each claim should have -- How a definition would look like in AD FS - -The definition helps you to verify whether the values are present or if you need to create them. - -> [!NOTE] -> If you don't use AD FS for your on-premises federation server, follow your vendor's instructions to create the appropriate configuration to issue these claims. - -#### Issue account type claim - -**`http://schemas.microsoft.com/ws/2012/01/accounttype`** - This claim must contain a value of **DJ**, which identifies the device as a domain-joined computer. In AD FS, you can add an issuance transform rule that looks like this: - - @RuleName = "Issue account type for domain-joined computers" - c:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value = "DJ" - ); - -#### Issue objectGUID of the computer account on-premises - -**`http://schemas.microsoft.com/identity/claims/onpremobjectguid`** - This claim must contain the **objectGUID** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this: - - @RuleName = "Issue object GUID for domain-joined computers" - c1:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - store = "Active Directory", - types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"), - query = ";objectguid;{0}", - param = c2.Value - ); - -#### Issue objectSID of the computer account on-premises - -**`http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid`** - This claim must contain the the **objectSid** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this: - - @RuleName = "Issue objectSID for domain-joined computers" - c1:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue(claim = c2); - -#### Issue issuerID for computer when multiple verified domain names in Azure AD - -**`http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid`** - This claim must contain the Uniform Resource Identifier (URI) of any of the verified domain names that connect with the on-premises federation service (AD FS or 3rd party) issuing the token. In AD FS, you can add issuance transform rules that look like the ones below in that specific order after the ones above. Please note that one rule to explicitly issue the rule for users is necessary. In the rules below, a first rule identifying user vs. computer authentication is added. - - @RuleName = "Issue account type with the value User when its not a computer" - NOT EXISTS( - [ - Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value == "DJ" - ] - ) - => add( - Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value = "User" - ); - - @RuleName = "Capture UPN when AccountType is User and issue the IssuerID" - c1:[ - Type == "http://schemas.xmlsoap.org/claims/UPN" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value == "User" - ] - => issue( - Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", - Value = regexreplace( - c1.Value, - ".+@(?.+)", - "http://${domain}/adfs/services/trust/" - ) - ); - - @RuleName = "Issue issuerID for domain-joined computers" - c:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", - Value = "http:///adfs/services/trust/" - ); - - -In the claim above, - -- `$` is the AD FS service URL -- `` is a placeholder you need to replace with one of your verified domain names in Azure AD - -For more details about verified domain names, see [Add a custom domain name to Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-add-domain). -To get a list of your verified company domains, you can use the [Get-MsolDomain](https://docs.microsoft.com/en-us/powershell/module/msonline/get-msoldomain?view=azureadps-1.0) cmdlet. - -#### Issue ImmutableID for computer when one for users exist (e.g. alternate login ID is set) - -**`http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID`** - This claim must contain a valid value for computers. In AD FS, you can create an issuance transform rule as follows: - - @RuleName = "Issue ImmutableID for computers" - c1:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - store = "Active Directory", - types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"), - query = ";objectguid;{0}", - param = c2.Value - ); - -#### Helper script to create the AD FS issuance transform rules - -The following script helps you with the creation of the issuance transform rules described above. - - $multipleVerifiedDomainNames = $false - $immutableIDAlreadyIssuedforUsers = $false - $oneOfVerifiedDomainNames = 'example.com' # Replace example.com with one of your verified domains - - $rule1 = '@RuleName = "Issue account type for domain-joined computers" - c:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value = "DJ" - );' - - $rule2 = '@RuleName = "Issue object GUID for domain-joined computers" - c1:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - store = "Active Directory", - types = ("http://schemas.microsoft.com/identity/claims/onpremobjectguid"), - query = ";objectguid;{0}", - param = c2.Value - );' - - $rule3 = '@RuleName = "Issue objectSID for domain-joined computers" - c1:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue(claim = c2);' - - $rule4 = '' - if ($multipleVerifiedDomainNames -eq $true) { - $rule4 = '@RuleName = "Issue account type with the value User when it is not a computer" - NOT EXISTS( - [ - Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value == "DJ" - ] - ) - => add( - Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value = "User" - ); - - @RuleName = "Capture UPN when AccountType is User and issue the IssuerID" - c1:[ - Type == "http://schemas.xmlsoap.org/claims/UPN" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", - Value == "User" - ] - => issue( - Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", - Value = regexreplace( - c1.Value, - ".+@(?.+)", - "http://${domain}/adfs/services/trust/" - ) - ); - - @RuleName = "Issue issuerID for domain-joined computers" - c:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", - Value = "http://' + $oneOfVerifiedDomainNames + '/adfs/services/trust/" - );' - } - - $rule5 = '' - if ($immutableIDAlreadyIssuedforUsers -eq $true) { - $rule5 = '@RuleName = "Issue ImmutableID for computers" - c1:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", - Value =~ "-515$", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - && - c2:[ - Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", - Issuer =~ "^(AD AUTHORITY|SELF AUTHORITY|LOCAL AUTHORITY)$" - ] - => issue( - store = "Active Directory", - types = ("http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID"), - query = ";objectguid;{0}", - param = c2.Value - );' - } - - $existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules - - $updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5 - - $crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules - - Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString - -#### Remarks - -- This script appends the rules to the existing rules. Do not run the script twice because the set of rules would be added twice. Make sure that no corresponding rules exist for these claims (under the corresponding conditions) before running the script again. - -- If you have multiple verified domain names (as shown in the Azure AD portal or via the Get-MsolDomains cmdlet), set the value of **$multipleVerifiedDomainNames** in the script to **$true**. Also make sure that you remove any existing issuerid claim that might have been created by Azure AD Connect or via other means. Here is an example for this rule: - - - c:[Type == "http://schemas.xmlsoap.org/claims/UPN"] - => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?.+)", "http://${domain}/adfs/services/trust/")); - -- If you have already issued an **ImmutableID** claim for user accounts, set the value of **$immutableIDAlreadyIssuedforUsers** in the script to **$true**. - -#### Configure Device Authentication in AD FS -Using an elevated PowerShell command window, configure AD FS policy by executing the following command - -`PS C:>Set-AdfsGlobalAuthenticationPolicy -DeviceAuthenticationEnabled $true -DeviceAuthenticationMethod All` - -#### Check your configuration -For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work - -- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain> - - read access to the AD FS service account - - read/write access to the Azure AD Connect sync AD connector account -- Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> -- Container Device Registration Service DKM under the above container - -![Device Registration](images/hybridct/device8.png) - -- object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration -- Configuration,CN=Services,CN=Configuration,DC=<domain> - - read/write access to the specified AD connector account name on the new object -- object of type msDS-DeviceRegistrationServiceContainer at CN=Device Registration Services,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> -- object of type msDS-DeviceRegistrationService in the above container - ->[!div class="nextstepaction"] -[Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. Configure Azure Device Registration (*You are here*) -5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. Configure Azure Device Registration (*You are here*) +6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md new file mode 100644 index 0000000000..0605f7fa14 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -0,0 +1,37 @@ +--- +title: Configure Directory Synchronization for Hybrid key trust Windows Hello for Business +description: Azure Directory Syncrhonization for Hybrid Certificate Key Deployment (Windows Hello for Business) +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, directory, syncrhonization, AADConnect +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/20/2017 +--- +# Configure Directory Synchronization for Hybrid key trust Windows Hello for Business + +**Applies to** +- Windows 10 + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. + +You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. + +## Deploy Azure AD Connect +Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). + +

+ +
+ +## Follow the Windows Hello for Business hybrid key trust deployment guide +1. [Overview](hello-hybrid-cert-trust.md) +2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-cert-new-install.md) +4. Configure Directory Synchronization (*You are here*) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 56f1759320..d31a4393af 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -1,5 +1,5 @@ --- -title: Hybrid Windows Hello for Business Prerequistes (Windows Hello for Business) +title: Hybrid Key trust Windows Hello for Business Prerequistes (Windows Hello for Business) description: Prerequisites for Hybrid Windows Hello for Business Deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 @@ -11,7 +11,7 @@ ms.author: mstephen localizationpriority: high ms.date: 10/20/2017 --- -# Hybrid Windows Hello for Business Prerequisites +# Hybrid Key tust Windows Hello for Business Prerequisites **Applies to** - Windows 10 @@ -32,9 +32,9 @@ The distributed systems on which these technologies were built involved several ## Directories ## Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. The -A hybrid Windows Hello for Busines deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, may not require Azure Active Directory premium subscription. +A hybrid Windows Hello for Busines deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription. -You can deploye Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. Azure device registration and Windows Hello for Business require the Windows Server 2016 Active Directory schema. In addition to the Windows Server 2016 Active Directory schema, key trust deployments need an adequate number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. +You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. @@ -44,7 +44,6 @@ Review these requirements and those from the Windows Hello for Business planning > * Active Directory Domain Functional Level > * Active Directory Forest Functional Level > * Domain Controller version -> * Windows Server 2016 Schema > * Azure Active Directory subscription > * Correct subscription for desired features and outcomes @@ -57,6 +56,11 @@ Key trust deployments do not need client issued certificates for on-premises aut The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. +> [!IMPORTANT] +> For Azure AD joined device to authenticate to and use on-premises resources, ensure you: +> * Install the root certificate authority certificate for your organization in the user's trusted root certifcate store. +> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based url. + ### Section Review > [!div class="checklist"] > * Windows Server 2012 Issuing Certificate Authority @@ -67,7 +71,7 @@ The minimum required enterprise certificate authority that can be used with Wind ## Directory Synchronization ## The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. -Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect +Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect. ### Section Review > [!div class="checklist"] @@ -77,22 +81,20 @@ Organizations using older directory synchronization technology, such as DirSync
-## Federation ## -Federating your on-premises Active Directory with Azure Active Directory ensures all identities have access to all resources regardless if they reside in cloud or on-premises. Windows Hello for Business hybrid certificate trust needs Windows Server 2016 Active Directory Federation Services. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. - -The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658), which is automatically downloaded and installed through Windows Update. If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) +## Federation with Azure ## +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated envionments, key trust deployments work in environments that have deployed [Password Syncrhonization with Azure AD Connect](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated envirnonments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. ### Section Review ### > [!div class="checklist"] -> * Windows Server 2016 Active Directory Federation Services -> * Minimum update of [KB4034658 (14393.1593)](https://support.microsoft.com/en-us/help/4034658) +> * Non-federated environments +> * Federated environments
## Multifactor Authentication ## Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication. -Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. +Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service or they can use multifactor authentication provides by Windows Server 2012 R2 or later Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. ### Section Review > [!div class="checklist"] @@ -108,31 +110,31 @@ Organizations wanting to deploy hybrid key trust need thier domain joined device ### Section Checklist ### > [!div class="checklist"] -> * Azure Active Directory Device writeback -> * Azure Active Directory Premium subscription +> * Device Registration with Azure Device Registration
### Next Steps ### Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. -If your environment is already federated, but does not include Azure device registration, choose **Configure Azure Device Registration**. +For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Syncrhonization**. -If your environment is already federated and supports Azure device registration, choose **Configure Windows Hello for Business settings**. +For federerated and non-federated environments, start with **Configure Windows Hello for Business settings**. > [!div class="op_single_selector"] > - [New Installation Baseline](hello-hybrid-key-new-install.md) -> - [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +> - [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) > - [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-key-trust.md) 2. Prerequistes (*You are here*) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) -5. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md index dbded7ce90..96aa0b240d 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-trust.md @@ -30,10 +30,7 @@ The new deployment baseline helps organizations who are moving to Azure and Offi This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. -## Federated Baseline ## -The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. - -Regardless of the baseline you choose, you’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. +You’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] > [Prerequistes](hello-hybrid-key-trust-prereqs.md) @@ -46,6 +43,7 @@ Regardless of the baseline you choose, you’re next step is to familiarize your 1. Overview (*You are here*) 2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) -4. [Device Registration](hello-hybrid-key-trust-devreg.md) -5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 744f4930a3..b37bea59bb 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -1,5 +1,5 @@ --- -title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) +title: Hybrid Windows Hello for Business key trust Provisioning (Windows Hello for Business) description: Provisioning for Hybrid Windows Hello for Business Deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- # Hybrid Windows Hello for Business Provisioning @@ -24,9 +24,7 @@ The Windows Hello for Business provisioning begins immediately after the user ha ![Event358](images/Event358.png) -The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **EnterpriseJoined** reads **Yes**. - -![dsreg output](images/dsregcmd.png) +The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. @@ -39,7 +37,7 @@ The provisioning flow proceeds to the Multi-Factor authentication portion of the After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. - +![Create a PIN during provisioning](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) @@ -47,29 +45,25 @@ The provisioning flow has all the information it needs to complete the Windows H * A fresh, successful multi-factor authentication * A validated PIN that meets the PIN complexity requirements -The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. AAD Connect syncrhonizes the user's key to the on-prem Active Directory. +The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisiong application and see their desktop. While the user has completed provisioning, Azure AD Connect syncrhonizes the user's key to Active Directory. > [!IMPORTANT] -> The minimum time needed to syncrhonize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. This synchronization latency delays the certificate enrollment for the user. After the user's public key has synchronized to Active Directory, the user's certificate enrolls automatically as long as the user's session is active (actively working or locked, but still signed-in). Also, the Action Center notifies the user thier PIN is ready for use. +> The minimum time needed to syncrhonize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. +> **This synchronization latency delays the the user's ability to authenticate and use on-premises resouces until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. +> Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. > [!NOTE] -> Microsoft is actively investigating ways to reduce the syncrhonization latency and delays in certificate enrollment with the goal to make certificate enrollment occur real-time. - -After a successful key registration, Windows creates a certificate request using the same key pair to request a certificate. Windows send the certificate request to the AD FS server for certificate enrollment. - -The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. - -The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center. +> Microsoft is actively investigating ways to reduce the synchronization latency and delays.

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) 2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md) -6. Sign-in and Provision(*You are here*)  - +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) +6. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +7. Sign-in and Provision(*You are here*) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 27eba8dd44..901edef2af 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -1,7 +1,7 @@ --- -title: Configuring Hybrid Windows Hello for Business - Active Directory (AD) -description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport, WHFB, ad +title: Configuring Hybrid key trust Windows Hello for Business - Active Directory (AD) +description: Configuring Hybrid key trust Windows Hello for Business - Active Directory (AD) +keywords: identity, PIN, biometric, Hello, passport, WHFB, ad, key trust, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -9,41 +9,25 @@ ms.pagetype: security, mobile localizationpriority: high author: mikestephens-MS ms.author: mstephen -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- -# Configuring Windows Hello for Business: Active Directory +# Configuring Hybrid key trust Windows Hello for Business: Active Directory **Applies to** - Windows 10 >[!div class="step-by-step"] -[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) -[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) +[< Configure Windows Hello for Business](hello-hybrid-key-whfb-settings.md) +[Configure Azure AD Connect >](hello-hybrid-key-whfb-settings-dir-sync.md) + +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. ->[!IMPORTANT] ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. ### Creating Security Groups -Windows Hello for Business uses several security groups to simplify the deployment and managment. - -> [!Important] -> If your environment has one or more Windows Server 2016 domain controllers in the domain to which you are deploying Windows Hello for Business, then skip the **Create the KeyCredentials Admins Security Group**. Domains that include Windows Server 2016 domain controllers use the KeyAdmins group, which is created during the installation of the first Windows Server 2016 domain controller. - -#### Create the KeyCredential Admins Security Group - -Azure Active Directory Connect synchronizes the public key on the user object created during provisioning. You assign write and read permission to this group to the Active Directory attribute to ensure the Azure AD Connect service can add and remove keys as part of its normal workflow. - -Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. - -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advance Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **KeyCredential Admins** in the **Group Name** text box. -6. Click **OK**. +Windows Hello for Business uses a security group to simplify the deployment and managment. #### Create the Windows Hello for Business Users Security Group @@ -61,21 +45,21 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva ### Section Review > [!div class="checklist"] -> * Create the KeyCredential Admins Security group (optional) > * Create the Windows Hello for Business Users group >[!div class="step-by-step"] -[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) -[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) +[< Configure Windows Hello for Business](hello-hybrid-key-whfb-settings.md) +[Configure Azure AD Connect >](hello-hybrid-key-whfb-settings-dir-sync.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. Configure Windows Hello for Business settings: Active Directory (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. Configure Windows Hello for Business settings: Active Directory (*You are here*) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md deleted file mode 100644 index e68276a09e..0000000000 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-adfs.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: Configuring Hybrid Windows Hello for Business - Active Directory Federation Services (ADFS) -description: Discussing the configuration of Active Directory Federation Services (ADFS) in a Hybrid deployment of Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport, WHFB, adfs -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -localizationpriority: high -author: mikestephens-MS -ms.author: mstephen -ms.date: 09/08/2017 ---- -# Configure Windows Hello for Business: Active Directory Federation Services - -**Applies to** -- Windows10 - -## Federation Services - ->[!IMPORTANT] ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. - ->[!div class="step-by-step"] -[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) -[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) - - -The Windows Server 2016 Active Directory Fedeartion Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. - -The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. - -### Configure the Registration Authority - -Sign-in the AD FS server with *Domain Admin* equivalent credentials. - -1. Open a **Windows PowerShell** prompt. -2. Type the following command - - ```PowerShell - Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication - ``` - - -The `Set-AdfsCertificateAuthority` cmdlet should show the following warning: ->WARNING: PS0343: Issuing Windows Hello certificates requires enabling a permitted strong authentication provider, but no usable providers are currently configured. These authentication providers are not supported for Windows Hello certificates: CertificateAuthentication,MicrosoftPassportAuthentication. Windows Hello certificates will not be issued until a permitted strong authentication provider is configured. - -This warning indicates that you have not configured multi-factor authentication in AD FS and until it is configured, the AD FS server will not issue Windows Hello certificates. Windows 10, version 1703 clients check this configuration during prerequisite checks. If detected, the prerequisite check will not succeed and the user will not provision Windows Hello for Business on sign-in. - ->[!NOTE] -> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. - - -### Group Memberships for the AD FS Service Account - -The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. - -Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. - -1. Open **Active Directory Users and Computers**. -2. Click the **Users** container in the navigation pane. -3. Right-click **Windows Hello for Business Users** group -4. Click the **Members** tab and click **Add** -5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. -6. Click **OK** to return to **Active Directory Users and Computers**. -7. Restart the AD FS server. - -### Section Review -> [!div class="checklist"] -> * Configure the registration authority -> * Update group memberships for the AD FS service account - - ->[!div class="step-by-step"] -[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) -[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) - -

- -
- -## Follow the Windows Hello for Business hybrid certificate trust deployment guide -1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. Configure Windows Hello for Business settings: AD FS (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) - diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 084999e656..69700ebc4b 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -1,7 +1,7 @@ --- -title: Configuring Hybrid Windows Hello for Business - Directory Synchronization -description: Discussing Directory Synchronization in a Hybrid deployment of Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect +title: Configuring Hybrid key trust Windows Hello for Business - Directory Synchronization +description: Configuring Hybrid key trust Windows Hello for Business - Directory Synchronization +keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect, Windows Hello, AD Connect, key trust, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -9,7 +9,7 @@ ms.pagetype: security, mobile localizationpriority: high author: mikestephens-MS ms.author: mstephen -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- # Configure Hybrid Windows Hello for Business: Directory Synchronization @@ -20,45 +20,21 @@ ms.date: 09/08/2017 [< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) [Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) -## Directory Syncrhonization - ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. +## Directory Syncrhonization + In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. -The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. - -> [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. - -### Configure Permissions for Key Syncrhonization - -Sign-in a domain controller or management workstations with *Domain Admin* equivalent credentials. - -1. Open **Active Directory Users and Computers**. -2. Right-click your domain name from the navigation pane and click **Properties**. -3. Click **Security** (if the Security tab is missing, turn on Advanced Features from the View menu). -4. Click **Advanced**. Click **Add**. Click **Select a principal**. -5. The **Select User, Computer, Service Account, or Group** dialog box appears. In the **Enter the object name to select** text box, type **KeyCredential Admins**. Click **OK**. -6. In the **Applies to** list box, select **Descendant User objects**. -7. Using the scroll bar, scroll to the bottom of the page and click **Clear all**. -8. In the **Properties** section, select **Read msDS-KeyCredentialLink** and **Write msDS-KeyCrendentialLink**. -9. Click **OK** three times to complete the task. - - ### Group Memberships for the Azure AD Connect Service Account -The KeyAdmins or KeyCredential Admins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. +The KeyAdmins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. ->[!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created. - -3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**. +3. Right-click **KeyAdmins** in the details pane and click **Properties**. 4. Click the **Members** tab and click **Add** 5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. 6. Click **OK** to return to **Active Directory Users and Computers**. @@ -66,21 +42,21 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ### Section Review > [!div class="checklist"] -> * Configure Permissions for Key Synchronization > * Configure group membership for Azure AD Connect >[!div class="step-by-step"] -[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +[< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md) +[Configure PKI >](hello-hybrid-key-whfb-settings-pki.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. Configure Windows Hello for Business settings: Directory Syncrhonization (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. Configure Windows Hello for Business settings: Directory Syncrhonization (*You are here*) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 27ea8e8a47..cb21c9a8f5 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -1,7 +1,7 @@ --- -title: Configuring Hybrid Windows Hello for Business - Public Key Infrastructure (PKI) -description: Discussing the configuration of the Public Key Infrastructure (PKI) in a Hybrid deployment of Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI +title: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) +description: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) +keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI, Windows Hello, key trust, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -9,7 +9,7 @@ ms.pagetype: security, mobile localizationpriority: high author: mikestephens-MS ms.author: mstephen -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- # Configure Hybrid Windows Hello for Business: Public Key Infrastructure @@ -18,15 +18,14 @@ ms.date: 09/08/2017 - Windows 10 > [!div class="step-by-step"] -[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) -[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) +[< Configure Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) +[Configure policy settings >](hello-hybrid-key-whfb-settings-policy.md) ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certifcates to validate the name of the server to which they are connecting and to encyrpt the data that flows them and the client computer. -All deployments use enterprise issed certificates for domain controllers as a root of trust. Hybrid certificate trust deployments issue users sign-in certificate that enables them to authenticate using Windows Hello for Business credentials to non-Windows Server 2016 domain controllers. Additionally, hybrid certificate trust deployments issue certificate to registration authorites to provide defenese-in-depth security for issueing user authentication certificates. +All deployments use enterprise issued certificates for domain controllers as a root of trust. ## Certifcate Templates @@ -76,81 +75,6 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. -### Enrollment Agent certificate template - -Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate lifecycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts. - -Approximately 60 days prior to enrollment agent certificate's expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. - -> [!IMPORTANT] -> Follow the procedures below based on the AD FS service account used in your environment. - -#### Creating an Enrollment Agent certificate for Group Managed Service Accounts - -Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. - -1. Open the **Certificate Authority Management** console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right click on the **Exchange Enrollment Agent (Offline request)** template details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. -6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. - **Note:** The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. - -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. -8. On the **Security** tab, click **Add**. -9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. -10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. -11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -12. Close the console. - -#### Creating an Enrollment Agent certificate for typical Service Acconts - -Sign-in a certificate authority or management workstations with *Domain Admin* equivalent credentials. - -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. -6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. -8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. -9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Close the console. - -### Creating Windows Hello for Business authentication certificate template - -During Windows Hello for Business provisioning, the Windows 10, version 1703 client requests an authentication certificate from the Active Directory Federation Service, which requests the authentication certificate on behalf of the user. This task configures the Windows Hello for Business authentication certificate template. You use the name of the certificate template when configuring. - -Sign-in a certificate authority or management workstations with _Domain Admin equivalent_ credentials. - -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. Right-click the **Smartcard Logon** template and choose **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **WHFB Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. - **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the deployment. -6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. -7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. -8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. -9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. -10. On the **Request Handling** tab, select the **Renew with same key** check box. -11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. -12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. -14. Click on the **Apply** to save changes and close the console. - -#### Mark the template as the Windows Hello Sign-in template - -Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equivalent credentials. -1. Open an elevated command prompt. -2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` - ->[!NOTE] ->If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. -Publish Templates ### Publish Certificate Templates to a Certificate Authority @@ -174,26 +98,23 @@ Sign-in to the certificate authority or management workstation with _Enterprise > [!div class="checklist"] > * Domain Controller certificate template > * Configure superseded domain controller certificate templates -> * Enrollment Agent certifcate template -> * Windows Hello for Business Authentication certificate template -> * Mark the certifcate template as Windows Hello for Business sign-in template > * Publish Certificate templates to certificate authorities > * Unpublish superseded certificate templates > [!div class="step-by-step"] -[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) -[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) +[< Configure Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) +[Configure policy settings >](hello-hybrid-key-whfb-settings-policy.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. Configure Windows Hello for Business settings: PKI (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) - +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. Configure Windows Hello for Business settings: PKI (*You are here*) +7. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 2c0b6759f9..bd47b15b29 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -1,7 +1,7 @@ --- -title: Configuring Hybrid Windows Hello for Business - Group Policy -description: Discussing the configuration of Group Policy in a Hybrid deployment of Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport, WHFB +title: Configuring Hybrid key trust Windows Hello for Business - Group Policy +description: Configuring Hybrid key trust Windows Hello for Business - Group Policy +keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, key trust, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -9,7 +9,7 @@ ms.pagetype: security, mobile localizationpriority: high author: mikestephens-MS ms.author: mstephen -ms.date: 09/08/2017 +ms.date: 10/20/2017 --- # Configure Hybrid Windows Hello for Business: Group Policy @@ -17,8 +17,7 @@ ms.date: 09/08/2017 - Windows 10 > [!div class="step-by-step"] -[< Configure AD FS](hello-hybrid-cert-whfb-settings-adfs.md) - +[< Configure PKI ](hello-hybrid-key-whfb-settings-pki.md) ## Policy Configuration @@ -32,10 +31,8 @@ Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 C Domain controllers of Windows Hello for Business deployments need one Group Policy setting, which enables automatic certificate enrollment for the newly create domain controller authentication certificate. This policy setting ensures domain controllers (new and existing) autoamtically request and renew the correct domain controller certifcate. -Domain joined clients of hybrid certificate-based deployments of Windows Hello for Business needs three Group Policy settings: +Hybrid Azure AD joined devices needs one Group Policy settings: * Enable Windows Hello for Business -* Use certificate for on-premises authentication -* Enable automatic enrollment of certificates ### Configure Domain Controllers for Automatic Certificate Enrollment @@ -78,21 +75,9 @@ The Enable Windows Hello for Business Group Policy setting is the configuration You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. -#### Use certificate for on-premises authentication - -The Use certificate for on-premises authentication Group Policy setting determines if the on-premises deployment uses the key-trust or certificate trust on-premises authentication model. You must configure this Group Policy setting to configure Windows to enroll for a Windows Hello for Business authentication certificate. If you do not configure this policy setting, Windows considers the deployment to use key-trust on-premises authentication, which requires a sufficient number of Windows Server 2016 domain controllers to handle the Windows Hello for Business key-trust authentication requests. - -You can configure this Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users requesting a Windows Hello for Business authentication certificate. Deploying this policy setting to a user results in only that user requesting a Windows Hello for Business authentication certificate. Additionally, you can deploy the policy setting to a group of users so only those users request a Windows Hello for Business authentication certificate. If both user and computer policy settings are deployed, the user policy setting has precedence. - -#### Enable automatic enrollment of certificates - -Windows Hello for Business provisioning performs the initial enrollment of the Windows Hello for Business authentication certificate. This certificate expires based on the duration configured in the Windows Hello for Business authentication certificate template. The Windows 10, version 1703 certificate auto enrollment was updated to renew these certificates before they expire, which significantly reduces user authentication failures from expired user certificates. - -The process requires no user interaction provided the user signs-in using Windows Hello for Business. The certificate is renewed in the background before it expires. - #### Create the Windows Hello for Business Group Policy object -The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. +The Group Policy object contains the policy setting needed to trigger Windows Hello for Business provisioning. Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. @@ -103,21 +88,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 5. In the content pane, right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. 6. In the navigation pane, expand **Policies** under **User Configuration**. 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. -8. In the content pane, double-click **Use Windows Hello for Business**. Click **Enable** and click **OK**. -9. Double-click **Use certificate for on-premises authentication**. Click **Enable** and click **OK**. Close the **Group Policy Management Editor**. - -#### Configure Automatic Certificate Enrollment - -1. Start the **Group Policy Management Console** (gpmc.msc). -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click the **Enable Windows Hello for Business** Group Policy object and click **Edit**. -4. In the navigation pane, expand **Policies** under **User Configuration**. -5. Expand **Windows Settings > Security Settings**, and click **Public Key Policies**. -6. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. -7. Select **Enabled** from the **Configuration Model** list. -8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -9. Select the **Update certificates that use certificate templates** check box. -10. Click **OK**. Close the **Group Policy Management Editor**. +8. In the content pane, double-click **Use Windows Hello for Business**. Click **Enable** and click **OK**. Close the **Group Policy Management Editor**. #### Configure Security in the Windows Hello for Business Group Policy object @@ -160,7 +131,10 @@ The default Windows Hello for Business enables users to enroll and use biometric ### PIN Complexity -PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed. +PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed. + +>[IMPORTANT] +> Windows 10, version 1703, the PIN complexity Group Policy settings have moved to remove misunderstanding that PIN complexity policy settings were exclusive to Windows Hello for Business. The new location of these Group Policy settings is under **Computer Configuration\Administrative Templates\System\PIN Complexity** of the Group Policy editor. Windows 10 provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are: * Require digits @@ -172,33 +146,30 @@ Windows 10 provides eight PIN Complexity Group Policy settings that give you gra * Require special characters * Require uppercase letters -Starting with Windows 10, version 1703, the PIN complexity Group Policy settings have moved to remove misunderstanding that PIN complexity policy settings were exclusive to Windows Hello for Business. The new location of these Group Policy settings is under **Computer Configuration\Administrative Templates\System\PIN Complexity** of the Group Policy editor. - ## Add users to the Windows Hello for Business Users group -Users must receive the Windows Hello for Business group policy settings and have the proper permission to enroll for the Wwindows Hello for Business Authentication certificate. You can provide users with these settings and permissions by adding the group used synchronize users to the Windows Hello for Business Users group. Users and groups who are not members of this group will not attempt to enroll for Windows Hello for Business. +Users must receive the Windows Hello for Business group policy settings and have the proper permission to provision Windows Hello for Business . You can provide users with these settings and permissions by adding the users or groups to the **Windows Hello for Business Users** group. Users and groups who are not members of this group will not attempt to enroll for Windows Hello for Business. ### Section Review > [!div class="checklist"] > * Configure domain controllers for automatic certificate enrollment. > * Create Windows Hello for Business Group Policy object. > * Enable the Use Windows Hello for Business policy setting. -> * Enable the Use certificate for on-premises authentication policy setting. -> * Enable user automatic certificate enrollment. > * Add users or groups to the Windows Hello for Business group > [!div class="nextstepaction"] -[Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) +[Sign-in and Provision](hello-hybrid-key-whfb-provision.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. Configure Windows Hello for Business policy settings (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. Configure Windows Hello for Business policy settings (*You are here*) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 2dbfc5fda4..38de12b175 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -1,5 +1,5 @@ --- -title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) +title: Configure Hybrid Windows Hello for Business key trust Settings (Windows Hello for Business) description: Configuring Windows Hello for Business Settings in Hybrid deployment keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 @@ -11,20 +11,21 @@ author: mikestephens-MS ms.author: mstephen ms.date: 09/08/2017 --- -# Configure Windows Hello for Business +# Configure Hybrid Windows Hello for Business key trust settings **Applies to** - Windows 10 > [!div class="step-by-step"] -[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) +[Configure Active Directory >](hello-hybrid-key-whfb-settings-ad.md) >[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. -You're environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. +You are ready to configure your hybrid key trust environment for Windows Hello for Business. + > [!IMPORTANT] -> If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. +> Ensure your environmenet meets all the [prerequistes](hello-hybrid-key-trust-prereqs.md) before proceeding. Review the [New Installation baseline](hello-hybrid-key-new-install.md) section of this deployment document to learn how to prepare your environment for your Windows Hello for Business deployment. The configuration for Windows Hello for Business is grouped in four categories. These categories are: * [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) @@ -35,16 +36,17 @@ The configuration for Windows Hello for Business is grouped in four categories. For the most efficent deployment, configure these technologies in order beginning with the Active Directory configuration > [!div class="step-by-step"] -[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) +[Configure Active Directory >](hello-hybrid-key-whfb-settings-ad.md)

-## Follow the Windows Hello for Business hybrid certificate trust deployment guide +## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) -3. [New Installation Baseline](hello-hybrid-cert-new-install.md) -4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) -5. Configure Windows Hello for Business settings (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +3. [New Installation Baseline](hello-hybrid-key-new-install.md) +4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) +5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) +6. Configure Windows Hello for Business settings (*You are here*) +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-planning-guide.md b/windows/access-protection/hello-for-business/hello-planning-guide.md index 1e51ed414b..331d1f28df 100644 --- a/windows/access-protection/hello-for-business/hello-planning-guide.md +++ b/windows/access-protection/hello-for-business/hello-planning-guide.md @@ -6,8 +6,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfin -ms.localizationpriority: high +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/20/2017 --- # Planning a Windows Hello for Business Deployment @@ -70,7 +72,7 @@ It’s fundamentally important to understand which deployment model to use for a A deployments trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trusts types, key trust and certificate trust. -The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during an in-box provisioning experience, which requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. +The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during an in-box provisioning experience, which requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the in-box provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers. Users can authentication using their certificate to any Windows Server 2008 R2 or later domain controller. diff --git a/windows/access-protection/hello-for-business/images/createPin.png b/windows/access-protection/hello-for-business/images/createPin.png new file mode 100644 index 0000000000000000000000000000000000000000..91e079fecaade5d4db80f5aa2c4bd6ce4bc5c729 GIT binary patch literal 28388 zcmeFZc{r8r_ctt32vJFyB`G4A=cyv|Oy(pr+qlV`hz3I?^Gs$oneA-|MVZ-VHc6&! z44Vv_=e)|@egA&%_x&Bm`y9{rc>Z|5e>g6C?`t@(^E}sDpS9L!t>+qQ3KV2?WCR2R z6pD9mYY`9-1rrbu_K=()AUM{*8u1hSaLi3hL5={?#jpTA9JiKLl_el}A9-ruoEUs2 zb-ruhMnFK>4E-Hzb;^B6KmhYnye+Hq$aEQVvi95n{xG0qCNVDK;H;`j82kH{3l_pH z_g-ZXKDnCq_^~YYyL%evbb8XXf?hmUDt>X!R?G1ofu@Yi@dcdg``hdIiw%l8U5E9N zqKP$&A6Dx4V@EI>hD_=nTOINBbN;hsXinXF|6Eyr3%2tFLJyAJ|F<3)fO@b`D(V&(nTTq%r)=fXv9N<_Wm8Bs!Ms_s95iG&CdI z%VSlcF|nT}Ld@B$z7&<{6&c10IgSoTi`n$BXy>RU_mk-vGe|rtvF&^Jyk@ufCaI#d1Rq z#TWSwE$1v^&j&4$%x3wMDN7aXSrz@I51^;=I)3=7bh=Vbe^x4zNpiG))sYD4Z$3?` zri^EI2r8p4dt3j_mGsvuF630OM1$wrr#f%EiU^NmuWA}^NtE;vqIbDr^W5j_EGy%$ z^K6^1v6H|)z60~~T`z9yLXb{nu_=tH@ArH$)Wuvkc;K-*;W*osY)>h^#Jll{)@*oP z#FW`@^Yuj$=lk>JPk&9;+){!5@X`N&O&m0j&~v-ZY95E*lZQR+Oc3NMrQy;Gj)@(} zxbt%OndR$F`Tk-NTGL1AUI#mKxAw&2g&vGmI;yrtFm~QLE&1@Y?b88jp$8Xh!gDF8 z20|$4<=Wfrz-=5pmO9hlqy?kY(J9Sv9jMH3Oy5X)mo)zDD*ZpVY=~&4;v=t!2mj73 zJS!@6KgELR-+kaJq!_;cv8r%*-`2(}K3J7Y;oSa-usg%$uD81!KV&c-`jNQukR{Gt zo>@Avzt((u*}{0N+}48m6VkH%JU?t)1YK&W?AA;n948xe!q0w2?_H5m)#!GKm)aTb zlCY*(QALLjd`H)h*ZZMF=hK25wo5JBJ1QN=R5UeT`w4i(@|ZYy6`R&+ae0`Lf=Bfd zwqJEfiTZfrdM3D!mMKgI??u6-u5WD2V2F_ZZ4m$`F6laou(1alHVMI*c^Xb_z4AN?Q z1+(Rrbc509A(8y6&J%_6wDi1B>Ks29Q$YhFiqRaF;JB6}oaW!sM&t0|dJTn${a|5I z(}@nPO8T{aZFRv+`Eau3*dqQek>+ur;yfhOC4SttVGN}JVt6d}h8awqqXW9~{aI}x z(duIjU$$L!p?l5=v9yIy#LW#q_KNs*U>$TEKVz8ka`>@1Vu9H-CFsvDM<@IrJCIxs zlmEZ*7gs?L=br`7D6n;e$;Un2lpn71+15%md8mE-?YD0ajAq+#2tJ%qgPHK`DkPB8 zS9JuMI&6Xs?m7hnb5yYkY)T30-DqdO^>U2ewho13dklA_!{&UihrSMG0hNCCipo`7 z4OK4*eO zR$;6>R>p0`+~@Bv+UdJ@C5dJOo3^#l^z@YKTvxIx4m+?sSK~G}iW#Q=!Z;bgdITzu)feJ^w$G6HYHI^pf^QW$PiLZp#q;-a-LgVXt3i-h6_d{R9Qw z!CFO-2C^F$XvcIO=oT; z&~*K61vNJA{=J&WKWl}{Y@3)rc}CxJ2w_6pygV91{Cgkq3Ch(;;WyF!bDQ!%yTn)H z#NgOCrD)EP?#Z1l&yL7|eTziB|_A{vU$ic>MnZ<>@z?!( zNZKRi<1U6%-M#Q%|3)B0A$lp3`jR+%xJEHPz{C4dz+3wNdeVQt=s%zTx95kKR`9~> zUe99Y2b0o=4FQR56s^7mhf=ha44=uud1;^eeIcT(g}sem+sZ!lWrA&SrElLjz*~OV zn?HQJYGK|USlC12ra2rdacUC9nttNy-`~`JeD~ByC2RME_Z0pt&F}jK5i>goihC@{ zi0Z-wuDjQLYp@Bv*h7-}d-t-`QNt$dG42a}pFH$|*4LXcfcKWV0o}5LXR`?W{ zydLJS0BhhVO-n-)KUidx$c&#?$n$?{_x_^V8$9RVEe{zs1(WfYp0Wcn_#5y zm-UnRWhIV@nhX5WasL?YQfU0wxmM~OMX5l+-$gC>dxg+l8 zR++yfrrITQnMoLy3Q|&P(_EZEb>k ze`|9vd$^#mC{w2WrM69?uZ`->T;Z@;%_9W_%ZZaDCUu;t#Tq2kP48eNQ7|9coljNg4; zgWvb3vv|jtQ-h#y9na_B+RITf|vp$n| zwgb0VJTd9L$i0Vfxo%oJ%n-2u!wQ&}%IikIS2b9$3Amead#eqT?#rVCOwLZjCFyx) z4fWjm$-oyK@np=`I9{`YTvP#`p+h{~yMmmM^e80!TN$E7Bc5&wxNQz7r`jL#V%deM87|#n^2w*>hA3!0WQr;<~K_FYvL0lq2arwm;9Jz4Xq1+n5jS zf_a`0*O&~d%=qNb9apzUEtR$_;l`rw*A*FM;*XKGyYY9riTz&gCjU51wXF|Cr-y4b zP!7AL+t`8jl{5KWUCH9hsJ4D}RKzH|ZWZFD`?MD2oa^=FzOJ~N%_%OKm@lWL_j}5n zCMQgDau2Liys{k$kZSMMQ>F6wU6}lTPWAsx5O#vmr)Q598u0T69QYcoVhf5Zr*#;G zyHyi~DpD(6F4D!!E|;U#_?2U>D++#a>k@6HghCF9QLxeSFDq~COa&Qd^7E@WelN|^ zLg+<5#pL?|qUQU0gn(eR3>fvxob;SoWU=jwz7TcJ+g8%g;`^XZ`phdZf`5S z)<9)8c7LN|wFw?cqqch0xnd(WMB=$JY*k518}Th;=?0<4?~wwGDyFX;?%-sMDONt9 z>9hB_|JN%)8tA;GZ7}j1>yW9LA1=CPAv>`nC)M9h8co7=0;nhvx^zm_d8!Z?cWi)<2#Vn)ma}U_|cNdEtZ}p>01)5&SvURXT$cs1(^X}DqEE{h0Dc=}@VYFN7 z`lV^<(|s0BKRY_>zS(jF@`g7LQ1vuH@^P|n<$u2RXT;Rk-CtX@`2^mCDvSDwd>p_% zCj|Zn1=U2Cu4d9sQzIfR`$uFA%B*I{{eCpJMZKv<{H5ArRCkdXzg5(Vd@cvmg2~X_ zg6P%)zCFJ-T*I?xa1Y}-={O0WgP9!b1KJne5OAmkZ@=Vc@*AvcP`_UL!jW3O3cTZe zy@pawC$@g(z*Z)ojwH_sudOneTd{nu(dubBfq5fbS@d5IzVBJ?&^JW$3l*L)4|o3b zf=2XKIB%f@sdtafpAi*OU-J1q{6ALjvHS&!-&dW|ce;6p-R#QS)6i$uSG@o8U#a%$ z^EKDo@@%*DHuH@G?%PP;z6Jd+_N`x8ZjY6Yj^wqYI=W z_$o-qO7Ow{xE#UbArcS)E~X|qMqtWDMMzL9&vKmLQMe4re@^^sdSoi;!k&G9B^@bv zc(6Wc<<~oxSGp=pZ&B&HUlWgVu>UgWl&zUpze^z;O-Fgni`jCk0aneuEkBGr$w?JR z^;vJ2d6{pxc+Zs7Kh!gyO7CCygH{oBKFg44#NCjLcCE zdEL0tCbSgbNJgz!{NebJ*9rB`vHP6Dbmw>Lj+fqHx&82z)Ue$Pk8|-r3lr@1Z=E?V zcN_XTo^T3)CYu*8UZ@P@>vjTD>o5Xh)yf0$Qhwff-9D~AKG7zsC5t`XIwiJPSk}=J zPJe5URayequWhxrwY-Jm_ga5AmTVd-^Gt+_gxWyp;*_qwiRECSfd#Aq@3D8%5x-G*_u>Q3qWB0&83=ryxta?k2UK>j?0fxE@xvw)*L z3!GR1fMh~yrX$2VI^y}Yac2HImSqkjeB#E@oVp#r8|+9u*yQl(QvtK0jf(++uNBm) zl-o+pTmpy;j_^^q0pmA%*46#Z)3!*FZzN-@-=oxpK(H)$q}(=2lGPe4Ql1N|G}s8x zd$eDn;@s0BfL`6!)Mr_c{-X{Lh!t|{9s)%z2*r9RbYe|B;=T5kt2)bV(MxL$dze)R zMoSMeE4qUpt;|*M@p2G6FVV^wMaevByOuNTnOx+(HDZ01r=VBn0A}iG;O0dadu2Esh z)iL~9*6!Gp46!}_!j!YMZy%@&@R&s9+7k&oO*lXie5djve`I=1El*x z6|9tr_GmaG4}+1Sl@qv=_l6GgP%hIgTcaO{Po0kgsfRIo*8=0fwFG;_d%XL_r)}aWSc>md%Seg&Eu+C2H*0zlD0DLC z*^?$~wf42KGJ*%MG4k>G*=6UmS5!(?k#8SD@!-U;mmcTJ!;rSsu=9u+9Z3_Xyn{%o z-Q2osfl`Yh-yy&|bPG8pXu>@m%It45w+Q67WX5lAt76+ox5@}cELX&Ak|_G%BZ+t< zhz;{?kGnh(@jk7_b*~$K zvi%91fmkkDdAHiQW-mz%7u22(BW}8%{8eQ9(dJ5s>gsBC>V$f8&5SFWysMz?Z8~bI zFLnsNXsC)IFb7e}Jb%~)cqn&6VhWcV#^uuQ4Rn6yLi)jDq;$W}w7(j~feVJ-GQfPs z^0jS!(?NAB{$zmD#;Z>6f~yOGJW($a^#5A?<4tIFY0QDjP`)mgTfe5li1fRtE2^c^ zPL=jUT?f9x0AFjDS*iN8SFkI`3?J-@YBZl_5a~H^&r7|8GYAOA@u&O0(dj|2(M7i8 zEMcMO*y&@ikPBr(%z~anf&xWx>ZyU%+KsNV zR1*_bBkA-l5D`oYIM}IFnU?tR@$9mCYC_7a;xu)*5gy)A=(RDsb>11--pLjz@nE$) zb1D)f6voVOf@T)25fxSOKI>mNmemWP$SFEe&_2e*j7}bpa$k55z&9Xm6*`>x_V#8-*sl5?lp#z`3>P@fDzDpITU#+`r?xU@F0oZp~&8lvGz(Ml{< zZNKLc&Dv%thLKB~08Pq9=UL~CTiVZ8!Rr(QtF#q)K%;MLo*-y%MTAUL7^vBv@L5J( zb+%=kzn2+fh8ex6@l}&Wi=}^!Os#6%^`#^%_pGzKxLDC?RqKgbudKncUHjx~_a*`k z@g63)70lQPN5)pS_^KF%F~vp=@tbt9gXy!nGYR$Cl2#oT#MQWq2crj5BW@raepEH! zi%k4gjT&{~6+sz{bjxe=@=M-5r4dHR8J<%|yHL}gjyMD8P)HHVv)uj{Iy0UyJ%V;1 zSF<@KP0Lh_GR9x-DZ&D+$oyGSO!i835hvM^5>^S+;7|@Gt}4}Ffpgp!L3u38MUa^~ z-FtnchNC&CI7|G%UJ*j0XNa%}!-{;#JBQPe(v(H&EFH|p<-VT<_TnWMn~nxKS1h<& zm06Tj)AuBKz3}D>Xl~{BhkBz;T1>k}ANZ0TY%egcb)(X@T=F^*LJ}>TEc@uC# z)Mg|iAYnOhSy%JubuG`5OmC^O>?6Oc!}f1rIui8Dhg^x9${qEn|JWtG?}Fl4;8<32 zi1_Wy#99FhG7B_Y6`mycGk^)VV@?HXM5^||A2$H|xy%+gj(g&rXSAsmKd&j{UHb|N z;$2pIHkXDXW#aIQ1;zDzAS+qf%|>2-biKU%XD&RzP*PxqN^cXI_fl>&Djdp1B&Nv#m4nnu$)wL;G!y5SaBDZx#kA-|Bb? zuhL~EzK75JR!1ueF5Y}_JI`D3?j@@FpWj}3BWuBUk;RlYqkRen1{=9wP^)JQ-!iDg`zkadgrH=rS; z0bfH{@*g1LU&;=7NIYIir`}(r#K}ZB_q*hhIO)U4{|}xEi~zlp(;MTYJH};dC+4_Y42=p#JGM z?&~gULNj9VAD{9+p7g&le(+fpXEx1h)o>zVMOYS1Z@$Qsd-u2;i?Vq@dHeipMJ|;e)~SgWW06&<+xoBUMTVD# zG*;O<{SUvKYd}AGH?lrLYxQF{+3GMPQz<<2E99zQq9zHv{uJNKQ}!mT`$TPB)P%yCqge$T

UEX95*xcQP1%+mgNunB{7w!+K}sR?0;}}txUKw$4CzhS^RG5>^|V2=j(obQ zrt}9#Q3Lis=e>waWfrZJ_ft7JCtxst*sY)2XFi|*?fFp=vOa(;4)FYfWuD!GV8Z#p zwRr24_p7UQ+bNLS0TK@p*LZk%baMg@53-~}cfJOl?%1y1u5+SDRKr_$a>f@gkKNj1 zlU7L<8>qJzN3LpssL6ZC@w`qr1)_-#bb@vdLns;T4%TBEex(`u3-r5_oSR514__-V z*%Fxpf`TfrZxEra;|cL82Wesfoc=a&tU5tV-f{b8D}%*^-?j<5*2@izFcB|vU(ovH zaZB${ot_0x5CG1Tp!C6y$WB0u>i|gpeyFVfNUc}dMPSMn0Jp#<;OIRKjyK(Tc|QIm zvu}^F&vL~q2;T?+`kgRjUE5=C2m?}2MWbq<^T%h@kUuB@LhAewOUM$6UVu1v#k6L2 z6-elp`QyDI;u93*-+(e$>z`iICPIva{oSF4%8S8L-5_Z&?m6iPID|qEL%niyb3aP} zeu5S79jEZ5zg=%jY7&~@bG4BBd|0iTDuoGS6d#OP*nm6XJM6heOasEE8`>eATvFv zk|MEV1U-)!!UR9RK;ERfjp#b_(GoG74!&v(pxcvQmi#WTme9%p7;^@|nCrh0PcYaP z01!h#7uKUwOG$!}405r2<9^#1pV~0iu6BBXWQcX((EwNtTP8y^*l)i23bf-W*msV< z=N`mPa;!iQD67q#x)xQx+QHwgf)P?3A~B5ET_+6Ve@I}@rf&{$COsF zIUhU#j2T-2F{?3_Y;WLs@PYK1xm^;O6_RmmZK}Bwcv%UYo`D*)i$j1odQhx?4EJ+LrCrvh<+bEm=FW|8Q<95?v3Jbavc z)V;TEdbh^A(Woj~A=~SVmFe~s?EdnXl$HYA4QxY>BlWoHNZ-$KUhlqV^a1_2GU2~= zXa`BdM)KnZEvsrieqiKfUs{)_AfRwh@HfPbaZx%?Dn;RIcfZY z`fSCJX_@6&4mE*LMvu5SwEV~#x@D?jovrc z?XS1b0&(F3ET_uIVl5enGT;ToYuQh$0tO;?5Ubc}uF4yS^@y8G4VZu;%t9iETU8Ae zi%zp0@p<JVF_r<}^iMU$uETKmSQ>O!XA-if&`tW)3 zHkhgrmaGLRrX+OF7BfE*&WRSGSu*x0WUwb;T;L%ym20#%1Lh^bHh~M@0RQc$EtEYTG z^4x)C9MB{1Y(_ZCV|aY(l{aqAS!n~FY$J-y@7%4j_&yOHyCZBF`d#2wrJWzZ$CM{?y0zOX`=-Hx%LbQHvGM;0m^M*1k(V4~67StsR)wQ%|+Iv+Hv+RiaR0o9-= zEOz82*&{N6jk)fsMV%2u%ExqDuFQUCZ#4@*`g5ex4_Wp&eojV^$?>G0o>1ONmI9UL zT$PLIr-H3h{VENrozs&eut=}L=4e5lDya&KZ%7mQ+?5LZp*Pf*s(>&W!~|*t+{Z90 zaXh-tIc&DN05_>AVE$fudz*=2FkDzfO+R}#LMkWHC^cx>y_t&&DTcT%Qi~Kc<~`+s zYnDQV^+cl_jV{lO&I?o4oeXtL#rW)sG-2oc0Lbt-c}JWR0V`>!UO2H= za{x2_2Ap2Vf?jWzA^8~oTj`HTkp;K$yfvu4ZtwIq`FL5HJ9dtzZa8X_oI^zjo-sNm zuvP9$qqvADY&X$d{L9Xf2Rd&pjik@W0wUwh(~_GSdI37PRzvI8A-J=Q%pK=$Z{FT3 zaaGtzpN1{WBzUZm?r1JAyPoxY(o_F#2JJFbdR#cUf?kh_<_|7QR}1SUw0-1`)>L7*YeW!^z0IXHv=DsHD{E~PAIZc(KV zAShnA?b9yfBymrKROu?5`XP&Z{kl$?NCa(rHt zvHQ0$o|ip0YsFV<(Sva7r!RQSdJJ-qx0{IdxP!Xt`=4{t#kQpTbLk_>8+AFN=lh7l z^<%YjQ+5{}hNS#<-|r$f$eNs%$!}Z{Cf2LKL9w7k zLa{pATVzelV^Wy`Oa9=x|D$!x{y+y26(ry&oYYe6HS}B*d40M#0AC>Kro%C3V+g55 zZCp9!-u9{!gjH`$Y8+~-iGD)ZC(qY@Rd;D8Vour;jC!o4~-GS2BFUji$A#x+?ptjjIrQ+EqO2&hY4> z1*A9}rOZ>#(AIDK!QC2}AMxbQWWC>Vd?qJqF2$z%-lSdN{s#h-WVgsPIsL;5H33!bC=WtJ^*1u3?CzBg-DJOf%U-@} zW!v%cb^s)g+z1U2gGXm0Y|+dQ@ITOZR>{s|b5iBu*!lw&55O}zxT#O2mF7APYyvK% zt#Z>Kz*tw`Aa&*8H^Ruaw+r);6;Gl{@0fg}A`d=w{(8v}K|W%4@qtJ5B8N6Hg~>a_ z*Bq8?F*3R~62a9*ncT>`SalOiNL)qz=Cmt8L>Yn3P@Mpb`JAZhOL> z$cLAT^FrRZ$#%}mWnD82N6Mp&w^1tm8FLGX3kQ6!ix+Y7e)3)2RTVo!5>_ls-qBFA5bK9+;Ajhk(7CU!ef2Gt! zVP>~xWWdu>ZOzU3LY@7%Ii?W_OKQYr!jj9+75>?#4@3-3Ts?g>iod>flL>;FOHR8p@iaAx<^E_8Dh<%z5VMXTNhK=+-=zYWpFc?^h++8!`e& zfje;o2}uZ9*H8TNJE_4gsfGN`8Q@0@3zpdg~XBT1BhpeXSUYUREphhLI;;M!`y;a*i+Q=9bOQkmr79SIQIr3VP~ z{DyjF8&z`~y7eM?Fqs2L-j;4I-I6?W7vs$rl){$|lZ;VRSJ$XYsZC3iM41aj+!xOH z^DLrt(_OEA_@aRa0tJXlSy-iA5j4?MdMJ|}r#`|V)j#dz1ZVETIe*FPdNbbRkxYA; zuEa(ZIV->Ei`%G4!IO;c8g@y~LjHPB@?h@+49MvwV+Y+JepX79lv)J!tkBVv%zRMK z{45Eg?GzB~4osDQ?Q`@ZdJ!_YGDGFI+E9JXJ0x(G?f3Go*VVs^)NVa=AH3#@2E;ve zmfQZ2!+pV@u5J;5f~s6@?TMOCKb<^6;djV`k=3Tfpr|c)%d@HFRKpQMeR+Wdo)`2a zeWH0+{2!-(T0`3i^|jWNJxsXsNxWn0o8xC$@fR;T6+VeKRABxIy3RhxP?G-ft*~_{ z9@E02fJ-W?c__Y&_o4oWt$A_}Wce>oQU)(7AB?ZJ4d{1|Bs!##!OE)t#>slYFUW#3 z6(WUDo?JOoG&3M9KLNcFA$f3ZsShZ^>y!XF+H85*sIT*rY_PUpnM zd9%aa*t)2&Cuy*ducm*^DWF$%avF_-BF>D~|VE6{2*h22U)Pp=g z0Q}`lV4yTa=kR+A$8FY7h6l_;?_j;m?sfK$_?k-V006cC@SO=o8Fb^XHNVR;USb{u zQ74uM)!~RekfJEXKrZ02HGGj=2S24(mGZ231vqd6Dv3hjG8fPI z8iB-erax-`8lDD=MA<4`*?ML`{OMOw-VNoQOXH2)gRf3PNF-gRy6$_VLvO?bpT1MB z>YBZjWo5Y{?qi=o8t9kSmJ6i%TVDS+T)2N|j(@3SVk}wu&oZw$7N$y`@(*Y_3M{l= zqUuTzJmr%n{nPun&OPbLP9Wx+d*A=W9pp3iT+fhfUtjv?cXBM_sFKyFTYtqVE|3N~ zuQt`I1CGP5=o3%{An7UyVlY*<{kgB>MO-rSbPHlYZDm5u!S3R%#Z_fR;wC`f9Uli= z6+lcDO~*HrU*Kgauf6otFO}g)S$a{CoR<1|pWkQ8Va%ioW}*#TNP3dKMRwNbGWVeR znAD0O=XUNYs9Mx;RQ7_Tce(9&^?PVp^9;(e^Yn@mplZgvsja7fkM?>iQF@oeK3MD2 z-9njrIckg>dy|LtI(6?ra))O4Nos*!k)8ieyIF!&XTnIgp)h279JT?ip#$t)1-CEk zu~a0QanPEAJMlGsiQ-6vDpt>P8^&GJ&K?faI93WYS9_FWM!Jv$FD3dnR+72% ze`(mp2~5^y8X0VtIL{~?N-dx8wceUc2rIa>{ClMQRD z?63YUthvV`x?)*+HlnY}p!AbY?FQQhno~G*i^vriMVX{?Bsj5eeTi~=M53WGBrIw? zR9GB_znG$k=sTd@JQle|buf8|Z+D*`ZQcL=_NCk+f#_4{JW%f?9BseN`{@&NVw*mW z{OJ4_&U(p%+3S|ca(l<16aPc=`-|rH&urHJk6Dle1O)0J;sy?nbM69GC;`C-?aP27 zNv`KC*BU7eCgpO&*hRn9D*Lk8QZ_J!#%As=c3$kmR~P!w9ZUu(vdI!;qaM8 zV*DT_Q)7PV+ z-xyeVb9>vQd@|i!{jYOcU-DP0ktlj?jAkm0Hf{ zDzm2^d^tv@NiRQmvcWk8LvS@#}9jBSm&-NE*%qLw4u3iRe^zpr?%Q~$xIe{zI zQSYf|X{*8nrR~H98SY1R)GTgSN1Uc%SrVrtcp4l`CDXTMF9Bvps&{F~A!(%ed)<0? z)T>rb4Db6VVZzc5qMzJTD?Zg$9x%_&R2+8iTaMaoBqwIaE2*a3*g4SoULMpE+ZcSt zd|IZSWG|xCJOE#Wo~*SxD|g64_(AHH90`jHfIy&bLU8Qm3l#wA%luj?zrRlwf5G{& zl5wn4ftfbiSG_Xc5wO?qu&;_&ISGFPD5pS7uu9@aj0rbc2o3XGSe^nh**74-D(wU|=$;BCG#Fx6x5S&9~d|MW}S-Vq10p{Zk zupKNe;2#NSK-OR>?;5L+n!i>P#h>05tuq6TU*39}WVAy1!qe#3&{-!yIZwwEEQzl; zJ)H=`ApES*YKkPszLNvf^!z0&tM7EUa7VPhsV&MH6bg0$h{_L&!OH9gIMI399H_GF z?+#9+3A=TGy#ytG$(POapyGIlD4o0oQpX*Dw`-wDB^Uvf&2`z|3m~Ae2b|n&;6OsX z9E6}m;R*5!_aSO~8DMkRJPTTDBOJ|4Dg7B*c2iJpezICIeP8@zn2J-OYx``WcxwiA!y!^ z0C|P8AftX0RFdB;GOXYO{|uW0mL0?%7v5HaHr_6F#i3f z6FM#Iw|D}zF3q>Sy}nSc3WE8X$?lB@@wxTcuT#Q^+i&B>%W*5&(``Df%PRQ}APbS_ z?XAunDz#{$APawsrbt|-y!LqA#gVtpBqodE4He<%i(n(2p|y~kr?0XgV`%`g@cSzT zIg$_je>NGwW^3es2J&AdhXLsG?mw5&YRl!K@HMD|g|e0Xxs`()agXewSU@Dds;jWN z5)o()kNQ5#RUPK-xhXoV-aM}s+GwdMT{rh_{a8IKkX?R&{x0)`1Zyb1O4;)SEsaL4 zNwGBn-jwM~JjDm`Z_+>o*@*RVPTRIm!3!Xzh=58wmxwlT*PEF4zno=Wv97x^B*!hq#l$wNH(m2ynT7M8hH%Sa20sUk@Q|;)p^qo@|FFsOWc*7Y_9zT zT+K<){HRq*#T0%L2oUoDVrrn+X|jHj&ZF@O@oatpf)51xRiYPI*P(7Fsvl!`OzaT# zyLOPkyForRL^~b_DW|Q*b@PqPQqa*Q4v6K18fdBzV%3{*Coj_{qNS)53gUneNvB7F z1E_hO-9)Qbt$L@`pOF(TJktb)@ufuez;3VVzSh5a`}ByuT<#9J+Q|>~koNkmw8C=2 zqyRM{+qBMm7OKw#^K6679r^wxs*^p|_yMSrOjhc7`&AN9I4X@4)6THNL)o2+Yu8_h z?#^d+f>t(Ka5@2-`}sO~4|0Bh416LKm$X_Luc>TkGxfviCfaZskVh!vq2?Uz14S-% zxIv>?s5Auhe^{x)+SSy9WOW?Kg~ovbow4o7gRLs7-OYu{u9P!PfLa1X3=&yY&$XrMR?Q z%xXFNE_e;pXDhKgGzM#=3f5ahh_*P4lz#Fb+>Dmsys7(OzGeEV?11L&&LOC_;aUL{ zC1+GGNl_-jP|HOV$7-+oD3jm}R_eA*wLyvZ1}LQkyH@luuz6j-tj2{ia_nkK?(h8Z zyFxqKd_thqc}!h6x>vIl1X_m5?FQOFDN75~M`mkRoL%om-R2w7so=9q@L-@z$&*76 ziv2&~oVi&1if4l|Bdd<<4yX?9H=WE`5U?NYVETbx$i*@hl6ZCK6= zsZ~ZX_Y%@6pubM2U!>TIRUu7RX5dgwc+6?Uo63K(A`P}H1D`ICu`}_VPs&NkkAbZX@a-9Lt^$oUW7kc3{JMpEZkXEe;R1_ z;u`$cSSM7QA_X>g53Wx6QY|m##Ce-`wC4hcl!(JqVc_ygJWZKTy*&2|G_E0cG_xSolZ51GX z1;lxN-VRX1GUX~T#`d9};*EwU*iS<7whj|djAc&NK>&Wy>{oTiT=&3$?{j31YN8cX z`L$RNxK17nh%xRV(4NLI{*9zCPiJh~lWdjv2RQ|ol`(X&*m_W}lZCZKg0^uL?UK%4 zWl(O?z&eku0tyCyPKtN_vL4^k?9@|Q)4LSK=02d-BQz0YR83-_);L~1phL}4?NfF| zY_U0D3s_bK#ejZrVzZ#24r&TiwviQl3*HKN7p-|e;Gp+{zq$?rSNQSv#=F%Z`YNO@ zKnRf_dUzT(Ay_zTwo$Zz6;F4u_ug&%1|@Pg_5i14bT^@O$SeR8VGR{%(c3a@nxNMp z3}kYi-E+4-S7nma(VjvYL_fu0E*o=$p`*bqb8XQYAYU4w5ZLFkLHEK_r5>UTU|1$%>V*jfd9oVPJstN*9+l&`^?>}a|GHli_ zRnF7z1ZWdmp;189<;)sP<3U}aW0YKx#Q@sfAJhtt!QV*L8~?4X$w|{aOe@$D{og5y zr(tt4DU}d9LQWGBZg|{KB3NVtsN7xw*{`lJuao^_98`x?E>(`f%EULsb~Qj~wcptl z?4txg%E-#jv9+D^0z5ho1tSFlw5NAPbHNXLe|n(Iqcl2mlt~0@XS_bhzgea5f zGWj;FHJ$1N>1&I(I@sJ76DAFuy7_THLYqBM57WVOJ-qshzAK3j8HPahODp?a$F!um z8)miJ^N!1le}~OYhO2KBy3CWjogKmLbvpT5M4j6C67B>J)Kf%`{oG|81GVYf=q$LU`xxNN#n21?eAvb}63>+3Kny9bP*b3x@K z6jkxW_vTk?>AiT>OM=C_Ou)Vmc}xP#mJNt^9{Y_m z&X|?5dg;;1QU8q9*Z#Mi;cr!J>*2>W#iCVy;7#MmLOpJ0IZG!ROM5ZH!C~c zFV?rak6HD%4v^{D^^kVAsTH2|EyKT-+4!29`bNB{osv;34lq)(bONC8xvIMYfZ#cq zJ1(T@Ed^dZo_cVn>ZucBQUiyeuL-b*kJtY)JIkB)Il9jSJti<+B_4*l2u4@N8jX05 zmS~OnyAXC0pP(CLI-bk?e^Po0?8{R|i@P74aO@rOM zCrVn;X?eyQneP-xlVUU#Q_tkx_v;nYCoKG7%M@K$P=BTvOf0%9HbQT~1~BGq3nl<8 z@j+3JOORjW`*?*DivZoQB8rOuS(&!NIYIxT0Aat_T&^z;1NqV1Xn}ISaZk04 z^kA)x+|`PSXcj?-;T{jLuP(Su4^+AhRG=>6kGA)*y9k-vQCtom zd!C_Mk#Z4N#l>jwBO~>ocb}%Qu+!)u)Sd;-Fwnc67m-anC<&B&+Ert(`+F&Ho(dn!r}NAO3O#J1 zALSy>92;;E|4P?TkmGW~vtHK>t>stuGQbu{3)NgUtbY;R!sN zij&lJu_as`FW@gMC2R(htoea*oXJjy7b9UKLG7Hd3yvJ&?W)SnSvOvW=)TEB8wgVL zuE8#-Dp)4m5Uy?e$eoit6{Fhx!YBZiGBD|PdO%u)NgwgU)&yy5Z&dBLl%4JxZ7UMJ zP!{6Welf{2e8`W|KXstU-%uJ>FQBF`JY0lK&<|I)G~|I77&qG`aSm+?rece~t3OW; z@zhbk-!A+vFvM^f`kx!O42H`|GWIai=?(%OxzDYOCVTJ378kQGBjuHZKlD`Vn29H3`~XC+ME^`0RrO{Ysm(`3 z;lhv3()IezUtyp#6=rc6@>@^?L_Oby7G6Up%&b{ANB^b(tTVNx$P3Mj6n{6{jrnkA z2s9Lc9i;msQd+VSzZ<*v-q~^?&CdZG&mvpw7T!GP=fVjIY_YA46z(%&_}H?$ef?V& zyLhPD9OZz7so(^{LI(0O7Q`3wixtdl5)7F-3tFQ6JL3^f^fw;_i>_2pJDgc)5d zTEiG;LO0F$J5OZ0DC3u{hU~ zE|f9TgPK*GG3-vrp4DAcpYEaX9N(5-Y~+rdRYVVM4f@(A!I-$t{PCi1UJf38jgBaX zeJK{Fushj@!E55-r+hI*TDWq4#K&9WF-V^*51HudYocggr3)2ABcPDK--4h#$PeO& zi_-x>`(w*cWcjweZ{to+S5`|_vXZ2{jQB|70p03F>m>8m%w&Dc%^y&``353b`T5Jl z8v_F-w<^vSdi9r=YZr_ia^37tzKVIYdG$Ev!0ZbaVgRJJ&%wwur}~R5dy_8-IvJ*b z_H-j#L%y~QNH!~H(+VPg(3p1Y;pYK#rhvOJsI_GZO7~B2^0d~$sN7zZMeEiuC8q6o zPV3gJjOXuY@})aw&*)2IWYHLEbniY^EymCT*gI794z*;q3~4TxwqKDjyVB^7p)HM! zbn#%$UXL*q&+L9aEM>VjETv7y>`U@&6<{lDspZn84yMvq%^G;-4G3w(zahnFYEOm| zQHp%H^4Ks{>`lRCnPjk%jNLMJmIz{O-`0&->%lf^9 z8ycdf+P)JwFh+CxDqsc8(E3kaj zMt;Mr$(T+gWp6b+^OB=IyFb{aRlvdYFaUuXw!qQ&mQ2(rHk7*PRJis=@v50KJ<2QZ z?%xXU6_p)_ns_EMydGu$4Qiw2dAx#Xfk`|)`Qh^8{Cbar=yUTnPds=l%5qzotJ&;F zYX;qR#sz?}s7bb6c1J20h>VWtmu4m_OE$@%PhGi{u|vl6wD%GGT(4xl3~BJ2%W#zK zf{rTtbEOw=hiy`#zuPGcFK@nx(I-vcV|X{y*M)4!W8-XPa8t3n$DWPE1eEwYdsR#q zDhO5wYdoK@%}I`-GZkMOy{TW7awF%qE=GxbbN_#}cU@6UU|TfkDCjt%v5lZI4nz@9 z90V!Sj40A;L_}1S4uW(P5*&>pqk;-Z4Mbunlbx5uy}PP)LY?0tqG(c;~8v zz8}|HZ@rKAF?_L-tlZ?@bI(0@?|pWvU-n~)MvD6xWb>{DoQ)jQSKdIZqy3|;3&klq z6u0;Q31^e2XmU78`thcCFB0MKf@>X7DTM4FbPcYZ_Y;3@V~?}#95A$me6iS$5s;^+ z-=mRb)n(qZ(@-pS%3YFGSYu}>)=qr9Q#5Ox>*&A(;;NWu9{iZQ^hoU5%e#7Qapc5} z&9sW*&D}~vA2UdOHAV*%)1}t%CWsy4YjSd5#Z1XZv@KNvv0`gk@kqe^$IZD|!Y#Ar z@a!gwGg&TJ_fWx2sb4099l>0C^8^7q$ z5AO!z@(bKWwc1ncM4aIAJIeb0nJ) zDNAR_)?4@WX;%&k=dmSpf?{?D1SsQfrcl#-Sjs9v4cSmaQco_8b8n`x1&dhxbgijOMgmv-iq>%kn_d$-_Hg#+TX0xw$?FV*IkV{XCRRl|2VuF(y} zhl-68QjaLGH8v7|ajlM0Pqs}OH|8ld7Y=z)D!6?e8LmmP2L6p1 ze5P9WlzTAFTh1y>)$9~AUyiAy#C9GJM?Db(au`x1@?qRJA~3OzMZU$kvzEJlXbVS^bKw%Bd3lhvalvXc!9)Qia631q zh$XmP@b($4r6r}IudjsgPAkc+T!S6Z6MRr-t@^$*D->4Yy4g&(`Hxnt345koH#9#h z?%ZYlCxfcbT8O4$X0)+t?vFL$K8^hYPTu{wVqa5&Ka`ha^JY&Gc;YLI@$XpdcQG0n zkT6zpI_&30kG1McIaOJu2}B21>GHZMJ15_)-6=n3b_8@zsXsmY5Nw}QWSe(Ao0 ze@&s_*5VB445mT1Wr2TGGb*Iw|7KG5pDD>JC!6bUeKOeEdaw3gV4%obz_Bsb7{r)J zL*UPYf3h*~;jyJrSbUJ7TmQq$R@NJA>;qzj-I)fB3LmfGUMg#%lm(|^w5suPF;4Yp3yu}OD?dSZe?i_tA z%P6kXceU0j|D1zC+mE-VpSzVOotRj{Q9br>ksrVviP5GS^;HNp@pA5e*ba>=)(HqP zyw2I{cH*G!6Bzx*95g%K+NNTuM4qh&II++R?7XX02n_OGeNh7AwTTme|0eA{N!be= zfLt-jGK{s1)EJTl-$BDd)JOxTe%#O`Ai`Y^F^eh+fJEs!B`2lixR)-_5wu3VErYA~ zanl{cMV3NzX$`mV{aImE?A&sgEsPun*7N>wKlyQW_ofW2rjxZnf{_^Na}m<~dy|!N zq=UiDrUW6d#US3Y))`(@ImRC!q&4UWC#<%)Kb5s(_>6X!Z&P77HC}%{hI$c!p7~Yf zQkjoQvf6EHe*AC8Jo%s!chUwL%2N2Ls@9$N>55B)x?MVcYLmJ@?TRy2W&IENF5j%l zMlwKgg@{tIwgo?R%QxWqoLb#_sUZ&Fz>d7b-ca=>)vS$0>16s^V-;FnT9} z$DK@{6wl00`1L_BzMmm4K`AT>F-MHhduH*8lvy=*4N`5W{Q21JHVak5*Em9Q^ z4*uq87jX+y;Qz|X4iwqImg0tqE*2!Ia~o#|018Dy)yos181x;R3{3-qp5&iYkn`#2 z=QJ~MGr{ls2qnmhSXs-(yC5P4o0Gr&`qys>7m_AXe)5u$7u6qi?5l!t<8WGinRywq zx=;f2g20VUhiSj>i|xKR8(>$L3`|@kU$FtxcDFF#?~0o8?rgEw7amN=rA_*?^CpxgPnvPt4$F|M`a-p!Ig9r( zbM(cXX|Ce<)Obr0GK~T8<6We%=2DVTbJuV&)3Y=L7UOg9sbTA$n!ZDJr$_`1sF!1J z%Z^daaX@*WNwy~=Zb4uI5a42P6$}F>aY<@ny7ElIq>q`$yG)ENI~Zr!0&l7McqWM*_`y5&VeDfnRVLRg)<1m8|dXI$VJCPXq= zca>SEcR)w*IDarT31u7JVyfZO*YU?9e*=uM@E&`4<*vo*_d8~4#Ysm18FzV<^?DSv zj%K)E$hyiiAMea~gu6lWgdF>0y&37Kb5p!Sl=c?nkP5E(CB3zxQl3En;^C9w4>=g5 z%0sd}O+++7-(E34!EXGY@-~NNH(w-qD-BJp?;AiVzogZ@V&i?qw6+hy?>lWEeSXQ( zgBJL*3`hR?s@o4VHT=$=4CW1BB}E*MM<+~@>U$&7hn)u_DeH&j!)C*FkN|H9Bl(J< z%meH3pAm@PJG9{4{;RVNM}~$i@y(*VOz3AOd4CwWp)gSm-Qgvp4#Gl2BLB@vy}D^z zcv=ZjQ6}??kIewke7-}3=Li%)TG+*c*;m3bi^bzF$U;(B{=?@JO%K0UY$-aG&wR>G zGUVIwS|KH?bx2ic3n0(itT6mpV2z)TL@e9*3GN5tJ?s4BRqq99HPX_1E^S5q zzFHwX<$K}cW<;I7Odrz}&F27o$rOd9LH;mb0;9^n!mUIOYlw+|YkEiC1B{s1(EHf4 zGY|N))hg~WTqfGLGWu6HnPjkxeb45ExlO?H3U?F8uHG|xvddc#U2K#tCkU$l5sQp#KIld1J+c$vqP ze>Gh@H#OT>{{s+R&XwG?mgOI(SsH|P=2bk!D@XbQ@K@V{x_!dg@M9T565BPMVHMD} zSq~DLWm*zh|i`-VcS)}dYex7Or;QG9-9A2WTa zeBm*VCcasy>tA8M6m@aT!tQye!j2ZJ7j(J9UaS8<(0i)Wr**B$YujE4F_`x-*%*vE z`_cyId(_R;C-pYhWy0syaWI&4C|2MZy3Bfo7yPTO9^8t{)F%cu@eRz0AM<|1$V$Pt z!CZ-+vmh;`In3p`s{SI5)>7?7m>Zt3Fc@9ag$80h9vzL|@luptwNN#TF7NZ>0yBJ> z!#!ueCsKLaLGbS`_-VC=T Date: Fri, 20 Oct 2017 19:01:27 -0700 Subject: [PATCH 34/90] fix to the TOC --- windows/access-protection/hello-for-business/toc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/access-protection/hello-for-business/toc.md b/windows/access-protection/hello-for-business/toc.md index 6cd691df62..24e76f57e8 100644 --- a/windows/access-protection/hello-for-business/toc.md +++ b/windows/access-protection/hello-for-business/toc.md @@ -13,7 +13,7 @@ ## [Planning a Windows Hello for Business Deployment](hello-planning-guide.md) ## [Windows Hello for Business Deployment Guide](hello-deployment-guide.md) -### Hybrid Azure AD Joined Key Trust Deployment(hello-hybrid-key-trust.md) +### [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) #### [Prerequistes](hello-hybrid-key-trust-prereqs.md) #### [New Installation Baseline](hello-hybrid-key-new-install.md) #### [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) From 1cddb86f87a4947499cec88e4cf350a8b2134b21 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Fri, 20 Oct 2017 19:14:43 -0700 Subject: [PATCH 35/90] fixed skip level error in toc --- windows/access-protection/hello-for-business/toc.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/access-protection/hello-for-business/toc.md b/windows/access-protection/hello-for-business/toc.md index 24e76f57e8..66af9ca614 100644 --- a/windows/access-protection/hello-for-business/toc.md +++ b/windows/access-protection/hello-for-business/toc.md @@ -28,7 +28,7 @@ #### [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings.md) #### [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) -## [On Premises Key Trust Deployment](hello-deployment-key-trust.md) +### [On Premises Key Trust Deployment](hello-deployment-key-trust.md) #### [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) #### [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) #### [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) From 870b4b8a337a94799c01e70e3b1e68f5c5148631 Mon Sep 17 00:00:00 2001 From: lmasieri <32968351+lmasieri@users.noreply.github.com> Date: Sun, 22 Oct 2017 15:40:20 -0700 Subject: [PATCH 36/90] Update microsoft-store-for-business-education-powershell-module.md --- ...icrosoft-store-for-business-education-powershell-module.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index b36cf701fa..0bb6a6d2d6 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -51,7 +51,7 @@ Install-Module -Name MSStore ``` -## Import MIcrosoft Store for Business and Education PowerShell module into the PowerShell session +## Import Microsoft Store for Business and Education PowerShell module into the PowerShell session Once you install the module on your Windows 10 device, you will need to then import it into each PowerShell session you start. ```powershell @@ -152,4 +152,4 @@ You can remove **Microsoft Store for Business and Education PowerShell** from yo Get-InstalledModule -Name "MSStore" -RequiredVersion 1.0 | Uninstall-Module -``` \ No newline at end of file +``` From 177a114fa6e38e74b22be47821103de45e108dac Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Sun, 22 Oct 2017 19:10:58 -0700 Subject: [PATCH 37/90] a few typo fixed New features page with images --- .../hello-for-business/hello-features.md | 133 ++++++++++++++++++ ...ello-hybrid-cert-whfb-settings-dir-sync.md | 2 +- .../hello-identity-verification.md | 10 +- .../pin-reset-service-application.png | Bin 0 -> 143195 bytes .../pin-reset-service-home-screen.png | Bin 0 -> 105939 bytes 5 files changed, 139 insertions(+), 6 deletions(-) create mode 100644 windows/access-protection/hello-for-business/hello-features.md create mode 100644 windows/access-protection/hello-for-business/images/pinreset/pin-reset-service-application.png create mode 100644 windows/access-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png diff --git a/windows/access-protection/hello-for-business/hello-features.md b/windows/access-protection/hello-for-business/hello-features.md new file mode 100644 index 0000000000..c8e500f815 --- /dev/null +++ b/windows/access-protection/hello-for-business/hello-features.md @@ -0,0 +1,133 @@ +--- +title: Windows Hello for Business Features +description: Windows Hello for Business Features +ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E +keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, PIN Reset, Dynamic Lock, Multifactor Unlock +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/20/2017 +--- +# Windows Hello for Business Features + +Consider these additional features you can use after your organization deploys Windows Hello for Business. + +* [Conditional access](#conditional-access) +* [Dynamic lock](#dynamic-lock) +* [PIN reset](#PIN-reset) +* [Mulitfactor Unlock](#Multifactor-unlock) + + +## Conditional access + +**Requirements:** +* Azure Active Directory +* Hybrid Windows Hello for Business deployment + + +In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, apps, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS apps, IT professionals are faced with two opposing goals:+ +* Empower the end users to be productive wherever and whenever +* Protect the corporate assets at any time + +To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain apps even for the right people? For example, it might be OK for you if the right people are accessing certain apps from a trusted network; however, you might not want them to access these apps from a network you don't trust. You can address these questions using conditional access. + +Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. + + +## Dynamic lock + +**Requirements:** +* Windows 10, version 1703 + +Dynamic lock enables you to configure Windows 10 devices to automatically lock when bluetooth paired device signal falls below the maximum Recieved Signal Stregnth Indicator (RSSI) value. You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Busines**. The name of the policy is **Configure dynamic lock factors**. + +The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: + +>[!IMPORTANT] +>Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. + +>``` +> +> +> +>``` + +For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** attribute defaults Phones and uses the values from the following table + +|:Description:|:Value:| +|-------------|-------| +|:Miscellaneous|:0:| +|:Computer|:256:| +|:Phone|:512:| +|:LAN/Network Access Point|:768:| +|:Audio/Video|:1024:| +|:Peripheral|:1280| +|:Imaging|:1536:| +|:Wearable|:1792:| +|:Toy|:2048:| +|:Health|:2304:| +|:Uncategorized|:7936:| + +The **rssiMin** attribute value signal strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. + +RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. + +## PIN reset + +**Requirements:** +* Azure Active Directory +* Hybrid Windows Hello for Business deployment +* Modern Management - Microsoft Intune, or compatible mobile device management (MDM) +* Remote reset - Windows 10, version 1703 +* Reset above Lock - Windows 10, version 1709 + +The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables you to remotely push a PIN reset or enables users to reset their forgotten PIN above the lock screen. + +## Onboarding the Microsoft PIN reset service to your Intune tenant + +Before you can remotely reset PINs, you must onboard the Microsoft PIN reset service to your Intune or MDM tenant, and configure devices you manage. Follow these instructions to get that set up: + +### Connect Intune with the PIN reset service + +1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Intune tenant. +2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
+![PIN reset service permissions page](images/pinreset/pin-reset-service-application.png) +3. In the Azure portal, you can verify that Intune and the PIN reset service were integrated from the Enterprise applications - All applications blade as shown in the following screenshot:
+![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png) +4. Log in to [this website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent) using your Intune tenant admin credentials and, again, choose **Accept** to give consent for the service to access your account. + +### Configure Windows devices to use PIN reset + +To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/en-us/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): + +- **For devices** - **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** + +*tenant ID* refers to your Azure Active Directory, Directory ID which you can obtain from the **Properties** page of Azure Active Directory. + +Set the value for this CSP to **True**. + +Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/device-windows-pin-reset#steps-to-reset-the-passcode) section to removely reset a PIN on an Intune managed device. + +## Multifactor Unlock + +**Requirements:** +* Windows Hello for Business deployment (Hybrid or On-premises) +* Hybird Azure AD joined or Domain Joined (on-premises deploymentd) +* Windows 10, version 1709 + +Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. + +Windows 10 offers Multifactor device unlock by extending Windows Hello with trusted signals, administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. + +Which organizations can take advanage of Multifactor unlock? Those who: +* Have expressed that PINs alone do not meet their security needs. +* Want to prevent Information Workers from sharing credentials. +* Want their orgs to comply with regulatory two-factor authentication policy. +* Want to retain the familiar Windows logon UX and not settle for a custom solution. + +>[!IMPORTANT] +>Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). \ No newline at end of file diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 84044525a4..36c163ea27 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -32,7 +32,7 @@ The key-trust model needs Windows Server 2016 domain controllers, which configur > [!IMPORTANT] > If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. -### Configure Permissions for Key Syncrhonization +### Configure Permissions for Key Synchronization Sign-in a domain controller or management workstations with *Domain Admin* equivalent credentials. diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index 68f001e2f3..7e3e2523b8 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -7,10 +7,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfin -ms.localizationpriority: high -ms.author: daniha -ms.date: 09/08/2017 +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 10/20/2017 --- # Windows Hello for Business @@ -65,7 +65,7 @@ The table shows the minimum requirements for each deployment. | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | | Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | -| N/A | Windows Server 2016 AD FS with [KB4022723 update](https://support.microsoft.com/en-us/help/4022723) | +| Windows Server 2016 AD FS with [KB4022723 update](https://support.microsoft.com/en-us/help/4022723) | Windows Server 2016 AD FS with [KB4022723 update](https://support.microsoft.com/en-us/help/4022723) | | AD FS with Azure MFA Server, or
AD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, or
AD FS with 3rd Party MFA Adapter | | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | diff --git a/windows/access-protection/hello-for-business/images/pinreset/pin-reset-service-application.png b/windows/access-protection/hello-for-business/images/pinreset/pin-reset-service-application.png new file mode 100644 index 0000000000000000000000000000000000000000..bacdb127eaf67f44d8e68abc2dfbee711fad6754 GIT binary patch literal 143195 zcmYJaWmH>T)UFN1-642!cZy4aqQwf7LW@(ZxVsby8rRx5miG*!h(`_nNZq``WR(+NuP&G`J`zCP^qvnk-r>Pe>O&b zp?d16Dx&-xr`tzfpxY^EDWISL}*+=}~ ze);LV;NJH7$ad>(%xG4A*Y$XTw21F&fe4J&dk3SwzTU_(d1PnZrz1tXYUBL2hgrKN z%RIywkwh(`g6J^$NhrTdjfWSXLAB^a$&iGlBmXG+5F+pM&slty46@SK*Jri(Mw^w7 zIe;7Xo~l}1sU`Lw|zi?<|f}=yFe-7$IukKaKnB0|nuBpFOsp}|z z>v9%iccU47o`0T|48uJ=$qjj>>HN~I*bcrx&5(q_5ubrC8#G4wf7e?of1!6E0NRI& z1&t%yhTIXW{WmRcxPni6R`}k9zQJ?I+rE8a?D=)hi`c%f9@f3Ct64j1`asoDL+W-B zHAx2CrZs(6%PI9s1C}F+xDW_E_upnKtcC1Ex*q$Ye|UL7f9eC&-B$UNb5nsJ6qgj5 z*WMfV9}2eO$HF>y`)x#MsooX!KWnfKmnH)OV51!T!yDq#&51h$=-M?N^7@Sof}Dbs zJ~1hbuvA-Io1WVP(W-jg*IY^{t}ypPbela==*My|&t6 z4V3(y7gpyQ8{r*)viA@uRD}LX>T%dS7QFS5Wh3XDccp-Q6ivI7T)B#p2PGd-hn*if za_gCXTtAKAGxRCf<0^LGG171)cW3nfa~~ zRf*82`3UQDn!meKR%jQw6x%=EfZ+&W(5>pVaga zF(vt$e}0YYWC(uzcPUZDwRCEt5w2s~z9c_mtYX*FA`LY%GP=NDQW*^3%+Z9W*hKHx zZw|ytJl$*wSwrx>#jkG@B+Z2-(kp-cGJe{{6^mB-Wi4bKS}!AQBgIhl!o94ap`o9k ztxwlqPM~EvsGyIBZ7?U7sigfS2O`7E@GP-v~ zyL8VorDwxljCZb*t}Qr`n3$s1B1ZFTnACK5?!^3 zAGHa^KH3IZQ^PUsXa1&Edqc0}ap1g7VfO0ku?&2?yaAZbEM;ZbbN3>4<1>xZQ&Zsw zbzlZndT;Wdt(&--*@6ngwyz&2!II{rGqb7r@rj%~3f%PbXL%IACKo1vZk)Wn!r9Zh zJlCX4dsMiX6RRqXIv^#I*7DA(G_~Kq|K95o#pZP<5qsmrf8;b`wq(;gGt+#1R~gnC8A~u}w!!7#cFM0|J^DV(e-yGpGaVC?t&0~RJBT{Ze$g2;G}Kdc}+qE_n`iA?vr&HNUZmAekH+S+IH*P_qqX!4`%ERPRbH=kc53u>nY@u+k$1Z z<>f2G{&8tguN`A>S$=YMrO|4xteO?MZ;5Q7i)ar-s@z)o+dsXswT)8+34pS&OSYc3t@ z1E%mYt2etZVnIoss}al%)Z*Wx^ehK80zM4!^NbO;r! z|A~h1acj2n;NpL^GpjGPm23D_7!Y}Dn4k6E0~Qq$WC6yl7@}|Q6e;a@Fc-P2C|w?X zih#;Jq3g&zpqC!u7#JADP;4oNG7+K{(V~KB5uqncm_)QcBV{r);cky-XTk&4@9^Q~ z5#pxG(vlKX&)w19qNfWEwu|7qi^)a!n>FI>CM zF`ur%Ft-st@r@PVwZT}9!UQIzyZA@S*MWgN%qcO+57ZJj>q^A@$%h5TPINPK`&0^vuZ55``Gqk~38tj6B zyZHDt@IBfOtO@Ol)5;vXB;+)63rj!(@l|X@$Q90$+lhkTdavrq*!9@(@`#28$=d<% zUAg`=8m0c1QZ!-y{cj9k>)g#*-44pA2Va|^(Cj-oZ%zJ}xY((Fg-tKEQh>jh>b>%c z>P>RYS~dj@$pJ5P03J|Zu|7v0!&=_LY^hej$^m?bxA;91L z4L^uui3|V`@@|5{i*%g~_WdlX*6)(uiIW8-K9x;Yn|(4e8fD~_f8*`_iof$j(ZqMf z+sG#4{e*!LQG`B4G$DOlnzod>x^LZU^4Ec%4Ap*{|LI`-&P{rI7#D zsntIEbJU;v)604DvgYy^97RDgKqA`2R^m;IKZ|v8l+I+q>%A$e^bw&?2O2@Ar$g}7 zs!I9XTz&hRg0VJCPA>PD^Mkr>Aj$WiaS>PYC^ZHQk3fP!!%r@WL~B{#0RcTZS3=CQ`=RlH~ zlzuTaed|;dEvI@vOOac&VSz&ZQ(AAY1WKhQORM3%AwOAi-v5C3$SdHcZX-GGs?K3( z&&p-nD##q29_dT~&DxYE7^`6zElf2(GuY$#aZXXhPv=f&_rwWCuHi7I1+wT=|(_3}02#esQ*?`i;*8B-#+)Ojdx(nYvspD^1X|xh+rJj86cQ91KzuKGd#E5 z6OO^=<_u-77OVksL9K+YKfZnQApK%#Imu%5Oe+n%LZ@YNV4R(s% zO%s-^4FdOYJeG`PzNStgoAF(d-{xc%39jJ=Bg_=I_TXc^?0%hb^AMlpb{h3zy%eu5 za%~!G-qcsf1$=_)^!_?E#|#sSw&%) z_R=BOS^wO7NwD=A@}RM|M;UgFfJ}pn?i2Lu^4 zy&Xphpldn8XhvUB7x1;aiO(F@LXZXatH^-=K17*& z(bRP5Jn1Em+Y|kaC%ePZfBz?C3)C;(UOmO6se08CUZ!pT4 zT&aI$6V+Ebfa@3{xSd%Xs^m51wzL|?)d9w=5x4MTeSzO30o}8;v~2LR=$8si8!JuY zwW~b5Qn@vyRFh5WJd3f}^p4dok4p72OncfYQC&|Ec@CdE_?Z;(?8iB09E#R?v&7@K zo}$`t_lIf0A0~UUb-iYFQT>X<(OFS{i>~v0m$tonl|+^9YZFwGswn6QqjEf#MK8%( zTZSS@=9V}2-weXvx zxVyW6i=%%ZRzSgTx~zstq;VF*=6H$=i(~vVe18@H>Y~2YI+^MZgc_54hx7;$A*8} z2kWf`Eko7bb3;E|HG4Hp}c0Ag~rds8T11D{qInUi9IS-l_C5J~8in zI$Gkg7Q9sqHjOa-y@LI;Xui=}MmR*MS^z4zl0>O04B?;K`w-XkTrZL+bw%#vvA(zv z2sUkq>%5`N13|#%PXb?nwWZ~S@rM}O$kT+SPS*^X8$G*wFpmJ#y7; zqBCZhFA_m>?0Uok3F~IRkF--#j`yYCZjRj>I~4s&&3-f@xrDCkWi8)H&Fx^$A9P_}q7hxb ztK_}9vHW|+lxH~mm|yG$Nw8am{C;?Ekaq0nLFK=)lE~{6#@0&5C_G|?Sp)7qq%-Bj zu*kSoC*PvELkq;+dCBCS&qUt*fvU9(te57!JXnvV`(?B`kzs?q ztNfZ0*Xg*#wB$Dio(G*VYjV2hmAQwVDlT-9xoEnnT81OU*p*V8+SrIU!op^-(Gpv- zmw}Gdc$H-r!Yz zw!ZX9bupv<(;(Ko%MOJ12gXL*PuMV@nO7dw)!xpVI$c~iaN3*;f27Zft&eneamB)G zsSY*OKk171uY4AxocK^f>T>*-WG{afrq5kYd)5)$^|P+xLy6K(@u_Yopr)#=m3ecO zwj1iUVYgShk|rU)X6Fa+1iJ8BdVI&@e#!de^nc30?7Ck6CaQxBq zdoKrDxK}SSk~O-K@1(NP$oc5`tl6#p_zjQPvJ($0Z57jeX5Tk7 z#Z>kN+sK|G&y9*~*^NM_#yOgsk+v-B=YE|*+XGkZkD%U!g=DAVi*$=Md4{jK9s)nx zZh|IbjX!rX9JUO}Ex4caohCIs0~gb(93oJ~e_LBeS?AY8MD(R#&C!v2j#%9)C-oz! zXz~BnJa3n=SaQ@wUg5#W!t#PH zNzre{UmIp~C};v_C8*LU=v!PY>qw%@8h+)XuNipY$9E}qVbGLlj?{@ftTL_qd27U- z_&w7hg?G?>QsWKQ#wm%^H%6uthE#uSOJ9ac2dKBZDLqj;v1c3J-N28Gf~@<232DcM zRX+lxWJe6%J-PSq-4kFKt2a$!xVk%4qlfr+yn6M@^g;xoUw3M{!19L$(J)kam$QDy z$a*&@l?-Y`e?*R|yrF^xY$~pk+SbvyR8!kh)aWBJm*M;NLQrB6+tG=^hiWBz4);j% zOH5ikm>tigK!sm03Y-ki2^>2CP;S{oU|Q1PQ~$&XeCN&IZ{s&(moRk5-sAiE#xUy# z-JbV(mQN?yxBg>UkKW$!3M;p)c>Nq~DB9*RdBKZOPg6QR-b?|2ht8n9H{9U;p}`3q z5Q6)4I3LJ0n17x_fk8-s(0$?AyS&c{A4eO<2;A5KbEuXcs~FL7F_C;Qli7Z=!2J^H z_4{$>!hHTUQpLzr1)Q1T(^NwiD%>^Da-`B&@~V{_cs&;caAXxcbkMR0zIEzYXL|aM z4PVU+RjQ_JPaGiyfd05EW(DSsNA^7MHB zUD_MFWxuR&BjyF1Nt>_OrI^7Az`BRNQd1X)BYTOt!inC`gkQn|pmbJX&@$3QTl>md z@VkuZ3Eh`OP(Kd4438R1I!0}8e{G>GbD~bBn0nb!&__I}!0@-4A$HJ5IlUSIE}5!N zRSx{jSxYZ1EF0(|hP@|>6|#kG;(lW`%@=B9;4UZoTDQ_z>FjiE65lK4aNsI;WZR#o zSFFaMG4160LGlbMC=kZuL>)arNq&w|-ioPQ2xX#m6u4Q+Cxf;h1n%;M@De zyYS-~u1J4iKtu?&-6^(KW&8#iegss64)>DiQ6#7`zI`-uB#`x3Q~F4&GAjfiMk{|xJr9?N_WQZ-vKB;jEtY7k_IBHPp z{XHT|<4y5F|6ZYwf8a%`1cH!3HcIBS3D+)GD66m@}9j}7P zl7>zTf2!>PO|~h9VJwo{lDhD1g!d5#+D%GJ{h7R>=}3e|YxCLlaQ&T3jh?aZ)i@q2RS?ALKRs1sn&CO6XrDzvK+5 zV;a9uE!FZZlLrv02kHd$M~+?WGy7l&@?E&DmMqBe&M9;bsi01)^)v$>hwQQmD~Cis z3O?dZ{h;K*47mP48IdRJb|^a%+g3o*SjgdittJY2QAIAb*Yp!b4;#A%HW~;sM&1dv z!Ehz>MxR$ck#fb@LCac5M;X>%{I$(CR379m2%MdO7K;Bdmw((9?pW~cb3|}`v+m=QXQG`s|Mx0FJB@5O; z8B*SsbgTO~o5F#4;xBhq{Ogm%4sc3ROE_&GudU`|Z+(p&{=40jy9mpZe9P>V>g^noU3#xf~{Gv3Kk5H#Ww!yN%MjMlf-vcdO8!uHbek|_u=g`wH7+TZ&~I5P|;3M zingrd@pQ6Szi-mPXTEToxnzsfPq^yBBjO5rTHqNplgPxE zOqHQWL7wJT zMn)a&&@2i{a0(Jc@4lffq?HfC0y;Kqmie|cThr&I$e*FIm3Qa!M{#p93M*(s#m*T+ ze)cDmJW5HO_|0>0#k{Ey#2Co9WCvZ{hW&7?^p0oz!6k8y7A@zA;qiOBq0x3@J=zSP zk`-u;`>GC4QRavL2-Toth=JIB+` zTh(?LyEv|0#~7t$Y+2GNnVoh2`+FXDyTk@=&$j?xw#i-e;o%6ip|TU@y}q#h z5e}Q-Nt_2+&0A(8|0Wq90lOgI^St^5Vfnb;#&O}X2ceDAKWq6EUmE0u_sp)e=-3%T zlz^<+o==oA!i84il~qP{Mn(^Mf&muBOH<=WBk?~kv3D<6uZT2tdMZv+i#m7Pqw>!` zM6iljLO$Rhoz*54ngqp(wFR=3fG0WeDdmF)*`Y1*8=ts$A6~R#L>Cc@`Z*X(uUDWt ztKlH>=6Gq&Z2cIh1hzZ-W}#b*!U-QUs2xcAb$-=fHAWfV}99 zI?96nNb6p-+^=rmdLq+J3(-i8SHk`^s%{^3dObk2yg!EmsORCL?_i{*C z>b^G@ot?L~0Mi`G*^(torE%Z0<)eg#8>n=^&lk~6Lb|a=(x;`&HG7PG#=3u?!-m`? z3LM%5TnskU;(8-$GV(FJjeKyXX(gPOMDdX_z)H2_jdbcvp3L?u?^v9FqJrdWB6s1R zoCyGeuOF#T#5a5u=s(lo11Rf$gw)@#^&%42zOh~Yuh%(3l{pcIpe{)jKJvdeZoQs% z4gFeYI|^}Px>y^}#nI7{Z^j4*%ufJYx(mXF%pPBm(F`P0M66Mmxp~-=Pq$V8tegWT z?fr;5RZEqVYo`Gm?PLKo(4a&WX#(e~R#MUNcpO<;v_0rWx=;{Mf!Xe=aa%-_HcF5H zUG&dbGA&SHLly}2BqLg>?d?8{0DGPy1{`q}N>yG+$_sr?1dGSAg4x8>PNnw=6raDB zy*|uQlCc@Lhjqq$%j-<@{c9L~0vu-k#uJjg5(ATaphJW{lhNoIZ)*&1@YO-efws;5 zLD>^az-Y5)@~w}kayhRC({^|fD*R(AXm&yX{mO-Um3mD|vVd@#ESqe9R~qy&K^djJ z{b(>=s7SbF@<7@It!eLCQV2FsVS;E&%u+-aKLWh~EPa`B3&byhwJ7*jW;{{zTYAy- zmvlEG4fX$Bdx@(Ym!zdU=rcGikL%xYZX9f7g}(};4}TZ5xKTS4+ih9!h<2`r2jum9 zk|i!mDgw^SJ<-TRwIwx+(*!QDX$Eam=&q_CZ?=+Ta`%5z*2OTS9{D7#}wDSv?;fxme-nWFgTHtA3)e2X;e) zzRG`NeyPXUmU=^!*MrKAgtqNhWujFt@) zAlR`^lBFb)e-LEX$}Nv9gj^!6v{DtR$CS@xyVRt@{A#^!YNh_=4NlmyRanG_rm*1g zevTWuM?o2yBUQ#=QI$lxn#ghD!0EstJL;bf08Tkr6Mj5;PdUhet#0`yio@B1m`C9$cmv;3N|z}j)6q2~8= z`m`V4NxC7Ek?S*=fBDi>jO})aGr4!E>gGv_TuLvNd{DGNXklsBefu~AQ_AN{ad*mj z<{UAbBAdb?q;;fB#kKtc$hw5IC9=eZP5m~aG=7h{4y^$#@#!RVBiM6n+t}4%h`~m! zE+yu1hQO<1&vGKfx%B#ZLQ+56xG7@GQshD#g=PE+dHKV(be2RX`g#B6g+b;1G$!`u=7t zknGJNMwvOykZ6p0xqUe;sZ9(8$Qg|^1nuaNY+^#JYp*h^D6+8l)OmL~^&*d{Q+kc0zs6L+b3)ot} z{}D~77-4bK$@b^2Pp!4HT8Ax}D$qxve3f_$hm4(*%Swj|WX^y?v+>WlrC>aQVyJxkb8-7j-eL(9#bax!{gv=S+IUs0b z6--U(UE25AkH+LrdeCMk?1*FnSCBRckyG=eO6$#L{OlSQV^A0#f9vb$nW<-LyZjOt z(TT;qlZ|M`FJ-8-cmT1L_`flOjYOpKsZtELk0-uQ59d%A&sy*`efQ(lr=aJ@>m_SV zk3V+m3vskrnU3Tn_f~)^x(}0N-NSVSRcslL$ze!|)4f*8k77GF?Sx}x!5+PSCDYML z+nLOEUaUBv=jAqEhQ>8^D%j%P+7_D-Fnpd6~3G(j{X zR|G@+^%&!lx)=efkcJZ0*gXuXHE$M=wEWGX)bgs# z4X8Z{?EinO;Z&*fC1@&g=+kMMTv!V4{Z9B*dV6qmY0#Tt})-f z$^C(ulDeAUACWExUw6Tuk(oNR+9Q43s#LgQ@E1K0F8Mi2_Rh8Q6bR`B;#@7HxCyQV zanKy{ywN$rCA_*I9qjss9!sZAy8`2QFjHSuKlXE>!Mrg&32MW_tB>osRX z#$mEQ`%c#6pUVRjXP``|wNY{sZ^!z0!EmNp9V(nSEHbLRNEU<%ymL3=U;dIj1AuRU;Fa?NAtTxn`98b6Q!D+$jx?> zj*#CT@u-87?i92}_CJ$e?4Oee+t~wQ_buE}bOzd+B>xceU(i=u6jTX2Rp*xKlKiL+-)uv+w8Ef6cG<6g@vsO;Y$;jlELc8e$y!D-HaW;9ur#4rL(VCw^zi<-g0gC8MB)3 zS#?4t1$4u`v9hY&yI)R7z)r4{}EGh{TtNJuYtR|wVk}a2c zuHC)JE(kRBS;YAMvz;3Wsfaxw%aoN`RWeCs!=sOM-_cp=x5gK=F7-m)kGp|CeyjzY z(;wD9YX7kvIHB6yaK9G}S%&&OG;lOP;AMigRig{<4^XB$qCk z4RaqIEh7lTdbVrybvf>=+S3<1ml^rnH^`XIo&z`hYlXgOITL?I+?5w`aObS46)w8p zA5p&y()-!6`o%Hm>M!gYPo;KF;^q9miH5VC6^WhoXvEOQ?K5c5HMEJqXW0^;P-fj? zG+PcYgJQ?X@j@zF)IF};j`V89*Ze34#!0BnayRB0Qs!W@l@v875Nq{#^|nXT;eaqx zU98eud!fYo!^YP)ax9@`Z9e6fniuNKW#ZFZ?=a2;x)z>qoG{f%8ng|Jc$!X=Rco$N z(y+;d+N=TqcKk_m26_nnfDq~bMJ~-5y1+VJZZ|45H~hf|&Ot?qOk~xsm4D;UPEQ%J zO)+9UmS7f*p^t~|QW(^(67A1n-q_7qeKLPFE**sbu)TA>A*RW%PEN24emrvh57BFY z&^T5L^_jV^c0Ao3xIf*(zLP+iZs@F@k2?@nNSb1@t(NX=7!#E+o=xH~13LZOFq9vI z94xTdwJeY#y3YyOwew?Gh@O#+YFtHKFhP&Mlp16Oe!L>xZ%|fJWBPXkULG2d!^I}S zV2A;o@3N3oT+B2^c6U5~yBaO`ZQyB3WBpA9(v+H7s44_4)z&S(giiYW^?D)MQpVLO zS(olFzAPC#&6YdBb~jK!@?s^I1Ljy+V?ESg05p(lrKNs}GWWWOyt=(L0urA(1alWe^)x-8Q~!`k%?gXz4#;03ANq z9byY%?G$&WsTBLoLVV67!3Mkp{zM8EAJODn(5fEqjUzELSmp$2(Hi~fz^6VpkB~?2 z`0uwV0fzZ>+;1bo%I_Yp*M^Wl+`MJ=TEM{%4c$bUGc~q-RwS(CnMBhMD-8U31^3M6 zgN?0)K0j(y0vKXtqnDmTlDd#~luo>KY$B`j)LBxfNhy#ZRss}!)*%0|A^32=_B?mt z#_+V0Wu6EU`}iS{?9W*Ck9^fYX`zbN3xON+F&k}L0-*ZiSk#ycc#I|Ka5@@<8ua<1QHC@8ehq4BB z$9t7F3lpr03VeIS%I^AjqWGAv0<(>cUtXR?sC_=>w~1{JmkP7V|2N_uiN2N>nNyxi z5H`TebOehv}yTd5`4r;p+IW;eblTbpX4h5Hy;nC3G{$79~ zCeU$cPTHmVcOu{bWJuqL=*Fu4X&KVA?D;ClB~4w}RU*LClbp&th(tr9zxAXq)E=z| zNt^xXzh0D>kOqUI1|KYk$EIFhMowyR|LHU3Brfd4>dT_f3m;Zu?1zS4DtAfjzBm^i&;N^?v*w zL#u%_0<7yYDrH=+{@@T!!oFRbj1`I@NlO!2ti8JSc1@~*tx}^r=id~_rcZkm3zHQg z%IrEnOtI@^^~$Hz#h1Pa8GP;fJBe@2Leg5H@Ke`keH`=%hOWF6XyIG1bK76F1b`GV zfk;)c=AV#fI5y@bpVFJ-jCi>k$}-8d)dZtQUMJx%T2B0tg-lrQKaij0!`f;i5w*3@ zLQ(yn)jT23_iG0+^qJm?hfHm@O6%s&@QYl}Va?~ORZm)iYMuqZ6w=M!OVPc$a@OMbgO!l` zqf(CFbCc4@q3vfPwpGAlebboOzdcU0L{19<`RIqHNob#yGWvnK7-hZXB;x$75dVX< zznC5h$EjqNzn>{XI)(-@VdOfA&AKg2=AXVl>xP-h#<|MqFPtn@8UZgm#iecGm-{{) zx+M4qGYT9>Nba)1YH+yjrQ(}_q*y^#roLs@ZZmDLlT)v%`D57Mt;#ZI4Kzb~LAqE! z8k|rDPZReW4OzfK6=~>#O!^2@I$!c?TD0#<=BmHVdCaZZ1%X4dl)WfLjePJCe)rXQ&Tkx4CX7DO4_YuQ0*|m{DrPeUEEW!Z$btU1C2wz6~rdB zsg6#>qga*Vg__@+KWd@9tRmLcF_yJFeQV`#fuuJ-YZ3u< z{&sl$f$PflsN$N}bC4S_Gy7A)R-~Z~4uby*mEW53Jo!IS*nf9bdPzlIFkw7LNig%C zT1(Yz(`x2cF(8|gaMX^l`PZ+PCX|#BgCNJ_P73T;yOhuDe0L>+7m)uIg1P!VQ9E)1 zNvQd0(lUl84-|@YiNF6823WQ*78=lKfiBh9{zZ-cwzwpTsGr3=usR@^>zzo>V_9q_ z$$!szfbcI_cqy=om)mc@_!fH4dTKiRLlkL_pYpuc)^0ikn4idDgPh(W5w7MVIgHRMJ04Y!|#K#7tqj5RF;*2RUjQ zr3-+l0z8KNcrzKRNx0W2!5m`aC%I*^2_;ej6Xrr+*=x!hMqR60x=|~82dwek+f!Ic zS>rm*4~Jx?X_J#LjRY5Winh}Vr-d^wVg~co%gdeoq@Au_FT}r^OZRFsRh;rf;?khq zMUf3?Wy9`C$pVr+t-rrIuznr;iRz!`Z;p4QXW{y8o^1)*|J>CJ+aqU0w08y8qPs5X z7vqH-_BUXOb`~0~FH3qg3CZW?gQA?p91})=?yT4z2Thqxw6fXnrFN!qdZJ1Zdc(d?NLcKA!6z=9uC9_t zGt*zN9v4(=UOa%RglFzn-+2G=cXZSwaHCn(7AW|zoPRGmr4Crw%G8Fj$)bG^>?qK#N-6&Vxt;;j7IYqbbO8r6u50)2DzFJ%4%R}*>N0o@dVZ5KxpLn`Bq zR)D}h64rrGLoZa={P{aLE*wiXs}}#Ste%CQ`z|0U-H$gZwSL=1jAfq^%Mu0O{6l5t zf?C*Z2yfZoP8?$7di!43+=vjwNV=Cz>~}RvHpVx`DZqE|hia?N??S6q_8VA|3Mvva zq}~&}$?uRcAST*e+`cp^ukvAn2uz<84N_Fc(U~&3xxJNjA12%qSxa+>Y(|;`mdFt= zS0C!e#ha9`k06k;ndPW3RqrCnB%nCWNNenebd;wPFr5x?1u|lV4kx{qLU;9X4;-l} zW7WKx8F_CQC!5F8X2BqSSsW-u9rbD0wO%IXZjWwR<|<^ng13X4Rh!JYgbr!vAs4UK zML5M8y;XC7EGG$Gr(S|(ZYd7a@KOhRry<TrL%u2|9a0@dsGSyo^`eszU-ENa`N~CgN~n;N2R~^5 z;b4`!j-pP4DNa{d*A<97i?@^e(R+OvD3Zf$kce+{2^!f!;r z|JK|1!35e+5(dJednCmjw`PsgPp1fyqlQJ&qh5Ei8ae6dRqiZh`8G+StajQ7B{KU9 zbV`EhlyOzT41=bubevSNFPA9O&UjAWE}87eO`4V>>A}+GkN@w%NYzxm8)s_RhB44o zdeE7WOsY7E*?KbYI(W7XXijGX1D@lAYqarxY~$gGkk0}ZB8A2s$jNN|exRK;*r=x!7}%vMzKufhW*4)JfryH0lPr>rfe#+%8>aFv94 zGo8spmEMN0;@ah)f<9`X%1}5Lv;7m=+PN3&3J#%sIZ5R4c~KzELwED4*x=!W@bbl5 zkl0mh`Y_`WU)t-aB$q}nd{q~qz3`Mw8n81Wv>A3N!c=`Rzg+5ZTxAD?4MSqJvaWQwLHi= zhx0Hc6>H-ha!H36t)sl~3&M`7;PqIQsXCkR)Pozi65o0m(#{m@OVDWzx+^-p`ST|} zmNM1x>P#PTl086XXs`Z;j@(v5(aYEuYUpc?1w*g3=% z!uv2P{EkbLRA4d8z6VnwoFHs)U9H!uzIXiQ707oG#OO3?w4fqOMmQ;}Y1ZVPCP+|- z>1CJCZe~Uc9^Bs&RSt(Xc@E}J6BWI3*)5w(<_xf|QkvC9EnkG&C2CMJLai+WB6@sRjXyfhBVu87;&qWD&C30)gv=+!3LVgAsZi5{i+@ zR4@3P${J9{;%(Ad`nJTn4c08ixGYDQ1Do@G;J_4#J{(E;U^0?=?Z55K%!mG(JYghH zRo{_JrW1DAw?pD#E|{&p{rHu5c$k}24lb-()X=NPv`;!NP$DS^ie$ZpB#RMvK&ow2 zUqIU;Fnb~7xS-&zEMOZGC%&g8?InOCR5ea$@0J&;-mF!|z9q81QLWP6)H?`R?6fr^ zARxHwbU4`vFYvOj+e$Z>;vWm=wvJcu`0@UTlPuNr9qMp;)nT3^*z%U(FHVxW)xrZ*a*X z)0g+z!nhJuGn*ms6=YUIl$n@*LjAA+Q=T-)Og|qe$FkCUva+d@;C}l7yTNx-$+QeU zBKiIzT^I?ZD5K>)(Qzp%ysz(U$j_nJ2X*KJ@Lc2)Daftm1X#@?@h)3sNEretTkVt7 z*t1AC`K44o?2a)JpD~$`&cIrqgXh?waUEhf+l^{Ai)8Erq5@oLt&&59%vlDqxtOT| zX>v_!0`Vpy*gtQ=9&=qm8I*~-gh@7Bku_OIB?tRuR*0islVMdFA>`STH1HKP6^2t};OYS)Oq0pDa2e*{mxyxW@aE6h+npBa$G`LNd}MDXP!0 zg5V-oxog~->8*!wLk~Zkd;Pt2G_a7!<-rQ+#90T!6Pklb0FY^n4@}<9nP!4}x#|W2h;t zjnkdD>dLG@0bQa$)x-U@`!oAi186!}hb!m*5q~b6M)X}Zo<6FRC!j*h_WfZgZ^99l z318Yz^9S-^w)V2qE|qkXAlV|;YfX;Fyo-~rQ4w2r9SG8xM8S`%Vnd=Eq=IX7U>(o# zGmCCS1*+0ayybE>egVX+90_sI` z^B*wBMmO>sPcsD?*Y5u91w1kwAYwMsP0KIY=$W99~YJRA&E@-s`T0@ITU`buT2_)zP#dJ})>Kz4Y5Ae7&20 zttlYmOTlc(A-V2md^JN>ner7VNz3S0q#`%1F$I;l<*%edAT2X}@SrrYF*4v5x575b zYrJ4*rQ`UKKIDeq8kI0+=ai|UMdUQ+oSACccGPvvlHupD1K4RNjD7=vlR~^z>b(*GhC$J()BK$f%Zqe%`F_jX8$wO_X@^N^qvjno zmV|siqatc^Pg9r|*)*xW;K_Zd?FK|MsLWm*vsdi}Z7@{x38DJIvMV#YeA1=4sh>lB zq9u{D2R`_gchgKA`{crl=)(KxsWqIWe>taeSY=45sCH)FJ^UZ0&N8aXu8r0zNJw{X zknTo0q`SMNLApDnyHmPFTDrTtJ2ttcyW>2*-#KF(e)EGdSkH=k&UsDJOo1T?me@g5 z#s!{{H5~I!t`IMvi)PyQz_+Mvg%H?=jWV{%zN`Zyz57vv*L+_ph3u#|AOd+PzmsEF zP2xXr7SMGNz5-mric^`Pvu`lmUJR?A7If^Ql?uecWmO$BH1A~DhGAm?k&5h}Az@uD ztT1a)$EF_ZpBh)*e!J4L4hH1^+;;1ir@KKwn#|Ry%?2zM-!s`Nj$L+NYK#ZB0s9H> zDd1`dmhKD|v+F|DLN`qz@m(yoexCWJRl*3axzGG&j6;C`i;7ElaE+}%4?Ad^weN1H zc72$AbGc7KaDdU2=o%&sX1^2x06We1kXq*03s$c)ME^sXg0JUu zxcl6vwA}cKj1RL`5`vyNr@>yGjA`2xXn^+{cg0KW?{8h%=~HFtPcR-hQ^rax+eHO* zgbw)cxdl7n+Hxhx+JAfuQX}-!uxqO&2Xy&7)4X5b(zl1umA%=A@CuZz5o1T`@P+FX zCMZnwy+>FeDEV!5AM(D!iNGMu8>@)a!lZ9lS7sCv8Oj4tZBoY zSt)#-kkfHUn%x#YI*L|NFz2kY>_%UF_k@J~n-)GD*P^(tyJ)ms3=lLuUyjaa4R9c> z;<1^1yFFgM2SnV9*Qc|iZ5NofPG)|?0Zm^(Q&w9tmdN9s?b&b}7}Ot|E|9RA-p9*a&7{}O!ZxNNX0hEP1~Sj7aER< zd#)v_@P&Y`Z5jUrV5F&A``YRqyYhpxJVaN))4=PsIf!N>_|F*BjsNsV5JhKGxf|2n zdR3&Nx6C{eC<^t;!!>W3e~d`6yc>IK9{7Ew?hh2fvQO`KGamy3&1rNcV{=<+!pK+n z#u35~zTYf+%fpp~5%Lo;^-!Rxs;U{?@%x1azS=W4tUK@`8rWb(;qs$fRkD4WhkEKN zD%*!D+B3!Fb4Cq8B#8Pguy+pK$3Iz7(g(NqlPFm9FOdJZ8j>QR`M!$}mAo79tE{ZI z7e%nVec9`zJ{5gE%WVTMl*scJ{wrY*(WgfxvWt`2$uozMoJnCzQwnq&Is4W>aKXKj zCRy^R(Fu|7BFx zbQ6spN-*sHVe;(^&${)+^*pppX%koCtwSy0&a$aFIyVRd{{8|&7HgC|ztGqOD zim?4df9mH%$$STSD89AVgpbCCoh&=C5@c6jFBs&HNR|lR0JFjGw7(3;S)E$}2zAFf zjw3YE=W@Mzn;kyM-Z&DAiI|D^gqv!kJ}}cM;$xZIAO*fB!MTRIogJo*?#Qb4@RS8t zpNVuHkDcvybfOnq|}|QUB;KYyvxje6^y~76}$sbj6dI;VBL3gP-rPZkxHD`x*nH>({2WE8~#t4*MDST-|%STrYO<2`qX%=i5%~EmL z7M9O?WPDd(GV9NBz|pO!=g`v&*z?&IS);TOKU!`ZSD&%VqI5qJdtZ0pC-_)Beon!h zp*6Xxo{j0F@Dm`u5pHWPCb|K0AH0GRspR?r?I*Skm+iF;0`Z5u1VP+}W1HxH=yHXY z<+Qwq3uinx6MGBG9^c=(;tFY>u7D2x^>$+Crve(|Gqc07p?S?7TWvjUK{)HY;yG>K z5$C&KN_2m&ICD75;>;yo3>Y@>3l5ZT$EEQrMRw}Ew=2mf;7ASNJRyD%|=SiG>8e#|%QK87@ld8t=nB6caIU z-C79}?vC$0(c=2Of_3{Wk-OtDXVczFq+)tSzy8x3kssd~ZB#s8xyjj2UVm8qM`#p2 zZ_e!YBfjVJ`Bbj$LK#45ee1(OS^EJ?+@yhZLk39r0}E#CGTvA|We#&_5^fNm*W$T7 z&|^X;lO29dwWjL1PW}vPczwfGABI9-``tP$ben~prI?ghy64WF%kth^UpFjq)N8&> zDY2xyM6^Csfw~S9QL|Y_`mfI)S1*;*2?IzTjP?R=+;v;JiYJdSyqKfEQv0j&F>&O| z2(H(~*`!vEpy*-sf{F@FJ?YVvpE11oECk_da zx8s7vcQ{1pHPy*9_=G%ZE}IiB6!?9YG*H!x?U@3t?Rn%VZRW7Y_etu(=TL0gl$)^W zz;;N+vq!*#nW`nSfVy-LFMTx-ngC{(pWWL5VN{A|?>av>&gfxy^otD z+Vj&t2-01uLbU^&? z;e!qnn-ikBb;38kDmvJvMIU3)$>qeWbSV?GprK-TXJzciC~>I1u%{H%sk@Ge9nPOK z#zk&B`4(o<^<(dO1dv=5OcSRXkj^)BJ%9K(HY!QE?*ya))8CK6M6=-Avb&asbw2E8 z#E^(xeHg`f`9n%#QCPuT*a2rIpMm!%Mh`LqazWbxK~d2W#pM%a9s0UytdC{!o+SMy zUU)1MnXe`#ZW}VS0S&=)Wup8H*+G?LU#*lRUpDWsm5DKY$ohDhV8nfl`PKDY)W#|^ zC}7Ma;cr|x^$Iv-PcpUV5Pu1YI6=8StygNg?7}(N^iY+M8GMl9c5rVSm| zyzcmW;6DtJU)r1VpYQf>xwXcLep;49UgY!0O7Mg$os2+Z5D@J=V4sxrRoe8sT{dsp z|7kVHWhP?pp#Nv_=pTQgFQ=nh?BMOAf&eGBTl+ndZTp2bqSJWKG%U#9@AbgNMB3Z^ z`GS-AHF43QcR6(DS3zvQzYTJCw;vzjw1eH&QZMpAAX8g3T3PG>JXKZz5T?)cn&3vy zLHQBDFrc}t;y%NuWK=k4u=Z?YR3kK7=54M2!ks9HPA163bVY62W78K&A=O_?T zE`UBr!xpw_an~?VBH=Pan%q7~ecuSTQO7VBiB|PH$I1(k{2&a!ZOs38&Xg z+agBcddIouj6n7hvfg4@)8b8%inFHn%sGc4{ApJMGG(~n4=|3P$4^$zQjNVtt5 z+`Kcw;TYr*BrqA8cvZ zv9MHm@W{0Zg3kB1kYLX*%j|Zth!5>Y-awId9a#}}o%hg#&khFFGDW2w*glV{GFu*^ zVwC zjxzl73x>T3k6c~S8~E?8?8WDFBMq~z3nxv8>N;Ca9ihMfZa&`CY1fW-pl6?bf0su= zdnY=HW^>{p+LJGVAebTi!4PZlZ=ZX=+(yt%&fvVIU1d4-1mj0KJ1BM8F+lU_^M>c| zM#&+W*-~_RdLPoYjY+ia}%w@@Vgr(o`KSjX*%f%%Gy4WiO zWm8wSYN#ussN7XkdCwF|tzdKj{uL{fFBsk;*?-Lk0b zBp1zuj@V5HXHDs6Tt40u5jgc7?3q1td#K3`)v8YO+) z^}6!(=9x=1&?xWFpMmsPRka6PvQ{pfhvGi&@5r{nqQ#P8R2ea3t!SV2&>gk;g9DamUjs z*G?3h!$m*NktDvpf#Wa*&&;`k-(#XY@v_I5fbu{?pU)kCcmv0T#@!ZRN13N#KPqpH zS@8xu*6*pZ`iMMA+_Iuwb!7rT9OPZ}1hqwNe+mLy2JczY1birwd5@XP+b33*Oc(Xe z0iP+g2P2xWpy{DCq2rL@{fV7h*MiO&Z3`(ikZg8c_RuJ=AHZL+n3@x9on^TDUGsQI zhL#$@<1s=$Z_c^l99rlErH4VLU9CW-Tx{12hOzEgHe0gTiMAiDXr#-FmBM@3omHs5 zV&pZhs9)%j<6I8{fJ3!e3%+&h*mZ=jyRPcx>Th>ZeSGeYi2j&8 zsnAp;8<8-1Ncg)jD4teQe2sNIM(ZMRyaY5HevMj;MK>Ce7ObGj2#0ThiElN5T9`~g ze#!njG8|UoeOmlG{=HHxI(2M$M0a^m-=(Rdu3J?(^MfczR8MZ5@cO|eNM!TSSGt;e zh6GI}_jj9g%*4j|CPF+Bk4e)I>KAn?`LrPGpMlSMo;i~b{2Lz~6<+b9GGHiYy9b~+ znC&O%tC~?k>uE4OV-iI<0FdfPaS5=B3KwP(Reo6{j2;J!O-!B7qyp}DG_v?_M3v3^ zM%O2T?`Ucg7By|iACuk}nPS}^uAVVlnKAST`AIa1GNuYiH9<#@N7s4R8-}^4Y0gwn zcpl{|xZD>UX@n8nRqNLoVzfp4_L{h+n4r{1=rh##T)!%2BEkm6?-7 zg$1#!U~6(IK)}z974fSMgD_PMbq;Lqj1UXw`lsiRRGOof2nw4e(bw&mju= z2ye>^`>r_*f`6A)_PA|&M-CEsK)bCugmMJLL+7|naNi#pyhWf0ddoR?X=WKUt>Bjd zG5vw<)|>&E$ErSHw?HgRSkWA$5k;f{ou~^&;2!869y;+2ai`M9C9izg@)oK~$>%;E?htYv_s-Fiw(E#2M2C5JuM^ zizml!zLXofs%G)48{k>k9R!cztR#1O+fDN|^Zh^D)Zc(y1MgRsSF*mG=!!a|bO%C` z?seAFjw6`$mz{VC;sIcjVld<@1~cm(YV13hR~&Su-+wz21Q;%Mhz9{3NW;97A$v2BJhh40A3vCcSe{J~cJBY#NQ-Qlt^2I3aZTDQ!m;r9`)!i+A5 zBCzNpsfumQw2ane(^{4jJZ%p!u?u*L_$>h2dNz zyFQ7v>wL!6v2Eb?ZQZkDc{mt`gO5jgXtwhTxAl{_w8IVu9xg+&<};5vif~s16@Wu@ zrEDO(3)o7rXN%=#^{arDtSt2oX+7bOav#A@XXhUoAkuKY1$}e==L4{WGe6nSio}w- z9l#6>d$(6rei})W=)2HFC6^i29T>v18K!$z`dj?%C;pf7wuDn)fUKwnzD7@|j(cbC za{P_lUyfrH6Gz`W9vO*<%Oou!b)kVWYxHoRYqgEQ>H86Tc?(UV!}i6X^wRv2QzHXK zw3e#IO>b2CEOToEmQ|F#96Unw707i-sB;*g!O;!FyFXvqVWywS0hExhLa;4jDE8V& z;U$=lF+`Wdolo!e4O5?Qo7)R$N~RY$f<6eE}I6f zE$F<7j{@6qM?}bgr>c4q0v^&GT7o!w(ZEk{bc!;=IzWz7Tjp6z%v@+DSJQt-ewHxc+yf=r_wSH znf!0Dj)+qvhix_550jiN>d%LYm2(Q6;A(>*FL|$}MqqPBei?W!@*S7a6MYfO8n`45 z4{~0W;rRW>eKJ!3$uG$nV}3rFhgMp`UuK}@BI!)V&*u?(uaO{R)4HYz!emikcmaW_ zMA?3xLGA-Y2lXGQ{SPzmXIJEU^IDbUp^Wqsh9l1(0;;t>)A@lk80~lH9mveWybXgwXdM%mo-CUD93v-&YBO z!bRq5nm&<;@Z3&KVccFC`qMne3NDJkH5_Bh{fF}QQ#*(0j|X{e`Iy5=OA3s!_cn_j z)dF_!PHMPD@M3h&>SpELA$g(IJY8fLk0_U24JM^1=!oCi3?r;w|vFMhjB!V8lCXjw@E+|`R6 zPZlEY!$09X)51$Q_tut z-?n;D3XhvbHSBFD!X~6FV!4KEej)Y)TUQwvBPx>2!yWYLqceyy;oHC<>k5$#PJ5ED zix`D?MKh(*iOovWLP;#!odDr2MECZ@b%_W^&l5hI_$lGndnSDIMbg9+PHfi6d`wi< z*Iu{HBab2o0tZofXSX<9auPMSt(EPn+#KXq0{Tp5rL|o z1FZtrv9ra+OOqm<#8w(j3SwO%+E>zC$u&jfKndjwC`%@`&8UJ?)0fB^fPekM*ay)6=Yn{w6Xzx zcsf};+j{k?>>nVg2>ef3qLAS`Z#%jeBC(D6(Q5b<(FG%>ad1mDhn5Dy_(DAz{f7Gvuw{CTt%#7 z&&9K4lFlxylt%}Um#zi;sap$NuGMzo8HP+3BrnxUWCq>5y`H_D&ubXu`N}6wgj4-X zO8rX_JIB<*@_X$qi%fuzf+`)E3Y~$7rKcU>wx4M}nnNSh+ja3e?|gef0bH)>DLNdF zgg`h#`{k?r$>ZIreTeXu|aKza=@pD+`&4jakeO|Bj`z-T0)zxNcWF z1T`?dP#8^|S~%}KO`&Y2wp7`v!N>6KQ|tQN%>UL|>gvvWZOcjFV=8kNhf<8a1Ub&> z_F^ZgJUYryq8qN zx$5t%##IE2p#jMsV4-3Y`CTh{zy8H>->K(}k0?3sZ4}JaL;S{=bl2-9xIH@AA!@2c zq5V^v+2stvl z$UnO#z82qB*m`Nc2G(|DI+_LAD2_wtJa)4t(cZ zWdNj5$%(%248OIk01!mY=yK%jYcAKHUpMD>u_zTA^S$FO2NH48 zD~)U4ova&Q8hEHOSGQ|2tAJ>T@Jy}rC6GYXpeZ379`?Ak!GApmi`+<7Px~W5c{Aci z|9!py?$boA$A1WJ*PIldAL`iZN_;B5X!Is)=;a~#$*uxJ$%uhsm}hXTUze8oiafxX5oKSrWlsd$4pM{5?U}CqZ*Q{JE3$7eez&gl=b8^X**c@UIsu z^=sw+MRZYu(zMt6D{ zgSMI)tN ze;@2hN`B=t&Ea}EvO%kX-Wy_;gJ&Q_m~4O8Z(VuEZE^k%M0@7{N)r%s&YR=5{r8ho zBby%SWz;@Z*0n7a&ofR8i1`9Ji_OGxf;NqJHp_2^DhFQv3wg+gi>)qSZuIoXdd(*z;1j7vKIRT@e)L( zLD^fV-pDEjPUG{*QwYJDT+Hr=AZ}+GIx+jY=(YJv8n@((uxv-&*84Lq&X%(K;@sA^ zhac_tR+Y`-uz6Gp+hKu-p%18tzjCX1fT`L*0rw)8Tpwsslb*(tlL~>@c+ky&KIqln zcDI(hFL;=$e;t(YyBF5JA!HVY&o8boV?!c90^P}1v&}rnmy0PRII(d3zQiEF_g*Lg zGFwG*u|M<#okO+U7zEH^{<9H(83a7lR@C-ox*d7W>}q5;-aI< zxCVks0t8#rx&rr)bcko%;2=k3re3*^W z>3Vb!=a!U=7?#GhRkA%P78@;8nThaTDc(9UEhCr-PGk$-*WN6R1)dk4=fDrune5(h zCJPCQ{3WD|jSvHS-T8|ifC|jLZ~ZT$rFr{p41?l9Oai}EzKXA(x8I)$XO{HZ%%3$h+!n6*5-fHv&7j}7PQx+(=Y-M)C zG}PiiTMF1=;ICvA-UEZ!nkl*;^qXmSOx1;3Ocp^-OF_B^V%y7YwL-_@8X!o zf>}Wtf*Ap4C5^TC=}eMs@Yv`H4zrJ90TWnO9yTEx1PT56Zdc&=-6Q*WS#ccw&(px# z6FF=C1>J4_*Y*@m7xlkY2MGEPKN3umLa{2ZP?-Z9F<44mmsa;1gV2KSTZ z-D4a{VMF&asWVs$N!Uj>s*ZU4H0j{Yqe3h-SKx0n!uXlD6|b}S;5|Wm8X3b_R43Vz zhsseOTtM}Ugy%*KcHa@w=WXlKb$0O6*w%;GvD7Heiv^FrbN_jE^9GOV1aoJzZPuH# znmYHW>QCX8h7!H>zSwRiU@GW$(#QE3wB&a_Ytr_5fphP9i5XQ@Ht5D?25z;S#hzLi zWuR^%$%aDrx-y*3Lf`^ePnjZT5ApGB7{!CxTMGywyS1pbshfzcRQHHErdAo24m&cnDQ=fnJc_J;mHNeqc|H`sGKOWeQ+{ru9CUdRa>y>G6WsUvbfC;tuNXrI;pNEtQs`LiZjWsQ0h ztr6**lN*l#HnPG7P5PQsBM>#GI%->t%301cU6=6Ddj`UBUZ(W$aoo%pNz$xuu9M>3p-q*s-N7}C$m-0u#Bt$dWn5_CBge9r(Vl9dH+g>qKomYt9F*Ubb6ZM@T(xc+S_+)qY zY^Rc4Um>P&oT@N|>=VhO1pgnHANw%5OAnooWsADFn1pxtAGXP^N-)MACY0h2g?bO* z{jyHuFIuVtQUEt8;!AecteCL8#Boa&TGyr2L6ETt;ngO|k@fizTvmZ+rsFr=CjHF6 z&!Z-p;w;&`c2ha%gAA0Tk|l^0Zd=3@_+y6<8o^u6|CIVo)GzjA2=D5nzptQ9Sp zEWrhtEgFAieeX9*U%nW+>-S3iYA*=^LZPggZW|u|lGx{c7_s2iv(5pV#!Y%RrWqoqaUFI4WoobCjCW0n_U+Z?;P6e-bD6( z$vPo0Gr^wLb49u=D?P##TEo34#gF5se2*)wJ)$Jzr5i{;mj`0lfuZLqHmq#I<;GG1 z3+MJ8xsO-(d3osw-~Cd<dVyaqOt$@?$P=tmqWPlz~`^N@b`2*#x*AFR7e4l*r%3a5#cR#hkOrF z)}dzfp(ZiD6UoS?(aW$Foj9Zseg&aPW*;pn-L`KpOz`)wv@uGfoyft(LT7Mq>Eb9a zGM%7FEU9VBi>nx}NgU#v63(9SJ24(cglydw6hSXSn(d)qynNMYUGO?th*2VLG`X-; zKt<1o&b*kjW>^3dO0-5~+j#Or5Odn9%3z32(1qJ=Ki&)M`p_rwb^9W+R)q*5mhQv* z5|*gf@Pvfw^G}T<-i99_j=OB~=_ij>vl-dA)4cqWgFdkRv0MU~eo-Y?&CTG%XNbO7 zlWwp#8VzzIM!z9;WZN9|H|5&igoV^p^ZbWHT8992UFVX;mNh40K}xnC+*SB!qyS%eIZ3KWh1mu;@DunI=kdG?MI08p;308A(tU9 zmxQ6gk}~J27*r(>Ps*f{nMotc38zf$(;%H|Fu=V~uOVK-74n)L8$3Y*%6%}AKQh}{ z9Ah`THEXh`Nwn~-I0zXjLrOWpNBqSleQ}R1!!<@ZJWZod1p8 zj4(VN{GANN{Jo17cg60rH~6zW&jJ0tbT8LV-RzVBoRdI&SLTBFHL(CLUTH(H>hQrlU#%CBYKBgX|}_wTm+y@-}*bX9$$8*U5YukHaVNsxRoAo4yRMJ_r1ob`_xW z)r!VGACy;Eo0Dj+i+dGvO3pQQu3fU2Sn}H%U~w{kuWx2pSFOCm#!$h*=j(s z+fI;SoMyH-ufFJx^NuvY*(WGe8rdvvZq|Z7Ny+{Y%s$IL=$fS`UHRw ztw5M?)Yhq~JhEY4lgA*3W!l*?-5?ax+!u9Ju484CKXig`jwOM>cV!?9AvF)vRPWBw zhg{ob>m-r&vy)F%h(NjubTOR~b}TKz3w~1uaYS1!Mw? z8Y;1Y!?Yv;f+FyW3y8X~0k4XAjZ86sQ5xYN$_n5UxFb>F@2IJPR6FK4=3rJ06vSwum?Je@*F6AGQ2(Jkut9b3X%S` zN}aaaZ38qevVT;nHNY>=Q_*GJJjj0O!;oU*j9)^>lm;t~$sW}D14-2ug#hzUSbx7H z4illc!ezF3YP0v1nU&PKxN^_89VkP55x4|o0UdSxeX{S7iBlQiJM!xw5;CxTb>I{m ze%39iB{MUbZ;xRP`lBdmIqf!}ybT`HTr*Lgn~1Qerm3C5d_wutzv`cvuh!%?GHa zA#pGf9X6qO@1caXCk!b~=1Z_$LBJ|XPT(*fCk6_C0FZ#GWu%1U!AE7L8+;1|K+8kW z??gF@(ncrnpPGda9@;IvU{5I7!0HyB$vlN;-LA4s?D!!)4rFwXk!#E~A1Yf?1(g3==RWZ`QG zq{D-`i~y5zq)KL-qKvmTcFILWu}y%vU8j+Ca9nR}I$319q~d!>Q(`z2XV`QeAmgy^ zvIrr3EH0*IY`=EY_1L3GWA|VMzGQV>pYhIf0Kb)A-Ubc8_yA7~dJLvxrR&;Tj>P!@ zoq=&z7r1FR=fKGIgk4qbM#%r_ft>F&=D@X4G81pjclPDp@)>%~@#tn~HxYfZ=)RZu z)&Gk+aWIa)`}YnR_&1Dczu~`i5Qy zKx{P2D{MoIpMm?SQ$WoSX<@9ld8tfZZ~`akyGxPNlvyq_Bet#A_F|%*Z|Io5N;A#y z;{)0xf(IwU46}AjouM&aqS#wS#YsNXCo3B`uArQ=3Z#JT&aS8AHP}Gk2cIk}%6@0^ zTg33MHH97)K-Xe7q|U(cp8p2T<#S`C=_LP=(}Le$)erBhP@U0@-Nj55-Qbps52uO_ z*;*#V_|RtSIWM^z83QuL-IbJ9V5dz8H>x3@IiDtRK)NqLBtFG-njTcPS}Qx+dLTyJ z6gU(yF8p$W!;cZk(R(!7eKtx;(ZaxV8&eA)y8iw2&xlnec$(gjZp!}ZjdCXV{dgx* zsv7Xnggaz}>nuH2p2_?wev%oFP6N zlX1>YHkvPVyQ>u9HTcJldYj}y9e;Gkz=+!T1d5D%^>UZ>b$_J!n&Q#0Cl6LvjaHab zWPz^`w!B*=V(>-20 z^jO$L7nF}#N?KT0Ob>`uzOJwVbWF|H8g@w^h1}QS16Ji$Wdc;;!#!!7PF2M!6Hz;^ z)sa8bQwOoXz8enj#M4TYbY^4+h=pj(B_$bz47-cr66S#;;tpy>^ygwKH}fJ*t)Tq- zhRq#qP4rUc{sSG*`&|G2C=Hcmv#WA+bTNJp4-8UG#=`sK;9=sc*(n#Vcz}>0Q)dX zx;#HWnk890`|ZM;feOQ%YGt}kVI*cYimBQo#;mULF0l1NjN0Ka?b`wT{GcyC?4A6I3Oh;sWVxmFE zc~ohXr;5O=t>&KD^DDtyL>G+Mgk0)KyU3a&jaqHQY2TcbYrOD|(YmpeZwwKRR z-&1xvkjdP5$MMyk{YOJ!6L2);xHz1G)|-V<@AKc^!Im z+^$&BdFU#69*(n6J#1Zv;Ed=|##(ss-fp-NL+|OGwO!e&-kgxZv?8Rw9npGUy|{7x z4Kl92+0XdAu@TX@;R#FZdyYn_kP)L}+W`fZlpMZ&4@>9|#PoJ{RTKtb2+Ha1O283x zucb$7s_LrwzOGrPjNKu%0N@nI>-d7#L*d{1Wd=mq^lh)}$4fHANuK`#xZ;Wp^Z7;U zE)+%X);Ch!G$I9y!onS&dqpO{7e}E#$@YX*4k7ntFwSgcG#$23;qj=;PX45FB>TsQ zQ`wP>F?Q|g{K#U@Hf_UkS66^L-f^hK9WCZKYjTK!m&&m+3i)C3LLb~AvAw5%=POmh zOAyLQ&>t>wTpW0^ZuAgVj0F}rjhXoGO;D}*Gmf_0O^Aojx{nsO<%e)$Jdb0I#IjqSl zxOuhK+THYsplissctNYQeO17wL-i~JmE)|=rbuCOD%-1hp~Kv|1NA&aD_vdnq{XsX zKU!LND7FZLXEzooMS1*ld>^~D5{;t2{4;Y{;u2SuWtYE-eul#4ig@#Kkxcz$A zneeYOI)QByNyECU4hSS7=;Gq!O!euMT1Z#{S6I+#-#V*o@-N>rza&JZluugvgEXXB z&__ijLj=M=uWnC|!BZLsy-+SbX3(xd&NsC$+1eiFC2Vo0p1VAYQ?YRVxX0L2_97bxbcLtppQZ0b0uK>yDXJk z>fdE$E)-T1d3(Q`TkPtg^_35CFG2A)n0fdJZ7fyg=^FJmWljhPP;BU3{z2J2Vl}|} zX42zJ*v%^R{#V*rXF2N(Fb6F~!)|50fy^i_w&#Ajz1ce{*sIpby z_4UpvX_qYvxYcn0JUFZ716ePCT`)RI*76GDbvUl*4ZMF0h_tbA3ZeD`_>cL*>?50# zRs#zMqj7Pnt`5+y!s)kJ{(_Ct(VAGX(5Z`LV?E+^D-k`C(Ur^$oBq6Sy7a9_=ko1l z8i2mru)p2>zbo_+GLIjYtfTmS*+1^O!?9x?hoVmkq6s+t=ka z{gQN6l3>#*8y@Wsm(*HcYhFI;I)W5nkmG#E8#I+sKE&k&%{-GWi~ z82N7!IFp0|VgAOwk%)wBwciPJ0ok+yD>?fYgaqJ$7c-dSjw$$Zjp4dv2n%AI%zGsC zoFsa={3G3@r+-|3Ake~3KJ4cqR?2rIB%_1Salef~0m&qO`)3g5dsNc^#VqQ3$w_>u zCi!8dz6L}>cx-wKPk>DAAn#clfU<0oz!}{6iRarXa~iJ4^ccl|)6lrlvyB5iU-DZ~ zB6fc_XQz+s=2O)!WKDf4xlmx|mh|M7n}461>5s=5De;w~v-$eD3E#O{P_}uy%TCP>AsHRqgupIAgSKSSR%j)i5$+Bf_Hy;p=L3L>4 z9?SR0ob7eWt;g=T)&&3S_i+KjhC|b{|9iET+`WSB1HgGGBBu3G-yQ6?(mH7lL{end zyw2L)f%SZo4j_8P8WWuNXF}C*(m-(TgdEmsaqc8A`H7O-%bz8y_40q&{8PSZj4FTD z>-dZZVrrP^3QvHsSc!x_tNn2&E#!|ICX17aC`3aQ`+8ySL~5iGc7F{?D9|`9qWNm_Xl53PsMV;Nx~&YSmvGsobSvtD?WLWZRp0gRKC zuM4&BOD1LCj)MzTjd?6z$>ba&VOSjMIU1Sx7SM$&VQgGb8Qc9tzOiaun{11qrKJ_K z^0?e0N$Hl!e6{y);-!~#4p@f<0J3F40krFehq>NEcJFobwm^4Ch~V49q^5DSl4lOx zwgjoKRBS;Z*9ukE1X((}^k@&Tz(juF;<&fw)79XBR7A72XlHG4{^WZ#Q4nPuVk`Wy z_ds_<7ug`&mJ2J4yE2QrG7-BRS>H=pI^TOeO$(6?8QQto4jb-WRDPac(A zMIsI#B~Z)Yn_ii;R#F$D^#!@!_wJy7B-LH?o!H8nL=cy+vdHSvW*S_Xkv z1v9U{9%O1dAxRXd8nLR`Qtv>54nJzw_l0NsCugRPf*g(OGvBujAE~RUp6$iJY0J)$ z!@KgfT2jJFDhI6FWTmhWbh*!`c+EM9&bvkSf4oQj5;ps-&Kl%XfI}wLDDR%_BQ+|` zI;kZV*7MQ!(uBmFNu<06_SiA(C%ri}x+eGg#fM4bEJc`Squ!ooi&s4IKv)UdgRV6^ zUH|lUqrU}iR>Y;4>+DI~G5Wu|b2aGg74imT2m9oPqT+l~*LFHZe^zX7FJ`1hB+87@ zH&1_aNAo(u7*>VNB7Og4s%x(5>~g}w@LO(P6YQwIuP2#=4A#6q%ML_J*H7=GZd#uZZK=PNghsneUTPpvt%;D|6%DI!{cnbF5D(`e%lt{^o@?)G@3qeL`fP2BJlSAX$C-|z#Uhm9_+qP# zxVaC9_Cy)dlik$x4gVv=#|D&#%2=Gc(WJz{FFL4GnXcD5fLyWTgF5oBIyx%R>^9}! z8a1)Xd|xQYwhqvJ*Jv1H-8p~5`-g@>8qZ%R#~S>;K2Z3*!*7exkiOhBU@)E`xs)dI z{UoWiaW`QFlBP;eEa3#t8$bl1S5*Mt&SDBUtju(BbU$BX&DEA_ zHPO<$Z8xRT)BT94RNv7#6Pak|JKH%D?HsV=Qt@#UH%Ya#`JLIV1CBwV*#ry2w%HWf ztoP|wVPqa+ycsM>>@;r_o6azbx&+Qgvb{2!2X!7)No}@0!t@*stq!wN;F5+F1})zN z+Sy1pGyGCiwYnW;qTAp)N!A`GnqiDm3>6%+g~Wa#y)z5hLKSNQp6Tyc#oO4!9jL!T(&Tj_@0!IcJcgPJ8GJ+rU{D_$6F zi7uYwnM_0_8WA&jDyWT-v(m9qV4S~VY@J<8A4p7$Glb8FEQcoaC5plx#Xn{b>?a{~ z6e{Rn@stYaQuh$)S$yP?Ii;o0Z21&@KbQjNHaoMmbrbu{Cg?mvagi^&MSy~85$i}! z7drwTV{mAiKNTZO6qb@1wZM#>D%Gst~#S{8+8kD3~#67&i+HYJA-HRyHIV#L)w7B>0nV) zp_GEt`KDU5jB(763?XR$bc!1^6i^}dX6q06YBUopxqOqZ>2|fSwnn=-a99Otw`Xnc z$M(Gh2O;gU4;?MbdN;A&zdt6%YphJ(HjBK-HhD&!$rLl{s-r}Sey?)cy-pCN7$op7Z{bHQ&DEu>W>bRpb-D5oOE}ktzBsK1q^aUzPK5^UDWA ziUOF=zM?NRqDXAuqTV}H{evWK+bU3Xx5lcAkS`-s>(;nWKsf0rp~b$pS434Uaow>z)Egd2=fefD`*ssR!&ICPI~f^3HLz0Xc-(%=n6_Cm zEh@pEk+jaAi`u68QN!TWsWKr*&O|t1Hz64LSJEPE%+rn;;ObL_>D1Y zw)3$hqZjMj4GtI?3=Qt{U|OQ9)f{wPbs_auD6C3KY3t!3brb1;_Jg_+GjxIdo`xSS z-6x?7D?bVoGH%p~D)udRrlhC(Fn^rnCPZGmd+hMdJ_|pRrY{nuyHur{*N?op@dGvX zGstG$v?znw@kBixAQSydfJU>t%arOC`Kcm3n#=+TO=OD$krVt=45@0)sLW}BhX}@b zib#I&&o033k#q~6fo?qz3Vueo)Lu0)vFtjwY7d|S{JfW-B90~{ZS68gZ9~I?=u0Se zF3ydVqRif?buX%)>1}(Hr-IM7$It-A?AI`0w$kZNP}2!PoLh&nYP;pkbl)=NznO&O zJ}2Hkg7F(3X1$y*Zo7PUd*eAh08`q<_M-qSdwPfbIHC@r;OS{wfqQ57;6<)(K8fo$u~@PC6?)<~D%O=mwd8M3}M1|DcuRkOkcEuphV zBMcRFVMR#RxtFex#5fJM<_W<4%*V;#+RaoF>TB-*4ph~!Pb!6>VN)`2v0R*y(Va@V z#tD_NCQn}g?SP0M^p7$n^2#$_KP7D?T9815l394?5qVIa)*y*mC-Tz@4r?V8g-Fi5 z3#s2@`dxS$>GrjM<@bhYRmeH`QgWDBS<4a^ATx1m!wY0$5>fmN~c_NQO}F32YF_AF6NNJCHfr4hh57v8G<5w}&RA^PsSd1aSm z^MhGlewR0pyCkt+pGPiL4g`d|%5K?Q#c4)d@tg^w#oAx2suwAw@Jg={H(wlXbol{E zC~A7sy&=ggJ*Ha5+e1*tWkEoS(^g-VRc_tilwX||3Ouw10!;(8Y#CZAz@-U*i%UlR zS+5C5>6VGv34qJQ#0W@;3+NjT1r$IWs_NzoViTFJc*t5bPy1P3sy&9DKT`BvzT2pE za7kK`mVQPInO_^y7t?rI*1N&N(w;J45?mf_PE4TqOG4n&%lkgB{whf4>fQ6Z38T!? zWkk&p*5&qRj6(=vF8a-mGCh`>APrGdbSknu%toOUWj2daXl;I+K#dOR-l4q~5c;9> zO@s1h!>6ujVp!6u5^*gD9@w+;mhzBh-i@HF!o2z_32*_lLA^S9mM0Ht+;?|tXc^SO z!hn@H44Iwoicw3(fqK9Dx^8BRY2J3o$t zA>R^HFzR1V=NezCWiPH4usH~eG90klpI+S3?T=iX52~mpr;}xk}$L%akz_WpCPTc|nIIl6aY;Hd%v)ExNM6<8BE{{<& z&;%)7v0-53G7|3tA@_X+N!sD)irlzN9am(Q9jEKOsar8Y#A0$+`d6ci>JI8c1a=FS z4=*)VHVe{fo2$qJxnDE?zM|x3@*erKRn8T*Y(C_926^eaeH45>usHGT40(7fD&c+} zo$1phO44zq`4`?};m^J4k6t+;=tfhLb*=#RT`TbcVvOlM2?02Zi*(La5l-b*j&&rU z%Ns_D{o!lq3&j-DjHhfXAXF(=W}lx~LGfMkWEII8$E@h{H#v3soQBFtRK@_?85ep+ zDx`yxc;ccJ>$+5mu4;v&6ih*vLm-4g*E`HW`JEzR7FvvG_U72{NU$K8-;```c6_es zJi)Nw_cKtVwB@oGH(fj)&IT^QRJjXIqk+!nJ(tNVw4h0~&}cr$h6C`?5PuI=#u9po z@ez+}7;h3{`zL%?q307eEw9(xe`pVO-IO8%Bg?(`>$UkTFW(l+CZv188*U=!UA7g6 zX9k?;i~u2mN~SZyXVj~Y$Y*XF8m;fccFq^6c2&njZhCF2QJus{d=Nf+A>2=jK^rmq z>%!}A9Nd>XGb|=QywdHbrHdJz%2OHT#vVbRFe6}+Z1<{ zfh>2TGp_>?_q#`9=ZDRA7@BsiY6>PtU6hcYd@{bI>Gs3Y3;Hz-7XxBZojPu(ega+{ z$ajloUfOgU%+fuA&nKk*Ph7xpzOSS`rgxtKh#IVHW|gG2fQei0daWGxv9^7 zDZ=5RQ&rU=y-}wY8n0?}w@$E9Nj*^3YF6bpA)^1(>WO@1nH2quQ2j{1BG_<;!KOPs zgrRRy1_R|@{F_=t!lfkB?yHBUEE}!tDvsdK?6dwZ%6WIr&keG++WzpHHV!U?OSN(o2vv#op&a$eITF0a(4eV=f7v?i2itWz8e}~ zcI*F2TCl9YFoUfGwHDAh9_?CK>o( z0|0`fi}bZK>AMGu`2uZl-x9?e+yi;R_!;?Lu7n#ld<>9ipjU;>DvC znB;IMF?Q@m@>x`nldid)3zSw5)20p($g3$S`3%Js$z*8X^k@K}>r(IJuvz>oeJ~sy z85$0xDz$29X{kN}%U$htDilE!JvsbQf$pV6CQl`^w*fKa zf-Pjefj|G?6s%Y!1H=D-f#ikmzWlXD72d&c0Clp5rXra7Jq>;*b3Q|SO(WZODCG63 zI4)EreLQ4*lhcZ*C@3=nO{;TuAMwY+e_lP#I)NnP?QW$JhIs zswv65p|XS*J8A(w?&5oSzq6MwD<8Y}N4tOX12fzvARGtYWxg#EGGhy_Yl6O39@x`Bt>Q>AYSG;OI&>{0h27#YanCTl#LC_BXOl zr#GVQNlQ<6JI+~Dw3A2feQJP6(qM+*=JYtpePp}S?`{BC-ImggaB*)B@<}ATf4{%zykQKCY_b2CqSOuq5kac zCqXGc3yE|UMTywae233_uyK^+jFQy@#M60PC>REO6@Q4adwO0ocBL6T6YOljRX|OK zOYG1m?6lqd;vDOU)PBC+fDAQvgC2VzMVTSqxsU185WijS4 zz14gHpQ(~{AGS79XkX`Ap=isHfdY~Bck}Mm?CF2erM&qbx{$*hn)>ZoXJ4dEk4< zU}T{K$}s2c2rm0S9CzF`18<#>$h|a0>AwHyffXG${6y{tL@Vwy9haN4+>HG11f}1n z!_|nrK1FqK0fm|e3wR%$f}p$CN#ogvbo(tDb+?K*n@OJ*2nV*ReM`R0iX@#dLPsJ$ zMZtHhf5?kKWPIOa07&x(iP+aaUkDAsU}-1h;aJ0~OL~Afs?5IJg@{FZ8B=XFn8`Ce z@Yu2yQ7kb2sOVwRPjRE9h*-+v6oK&6`c8ME8w$TXYEvvQMy85t~vjIe12a4-+7#sFLcYOBew?2mFfrbwuN4VA>aL?GWHzh9@tN$bGl4y&1E9 z+$uXUz?o(hx;k*;uLf{mgEC#Qx+yS=qv7=JLhdWPUg-kM>hX4xgjo~1uHPTIjO5b- zdlUsf?|M9KFa0SO`R4K&xY|+Y@4Nx7!VpL#?hhT0V^;R+@4jEOp8hMxT{lmmeA$h7CYzi_tjSCumPRyWQi4N(xK0bDBq}`~9xzWxlkL(G9s($4Q zkKrW3HDw7^3cwf799Y(5HWBuUhw@V{XSB>jcig)jqg%0R51f0UDAVw2=u{~hhD1MM?6LPT z3t)+^Y39Q3Ho-M}c*5_7;GIt9jk4`&JGBjGIvb~Y&-@v8-(^8V0ym?XSVfSlEvk79 zfvc5f;xARZ*nQ{{^4{stCF$6f(n}|c76&s$U+;abep!kc1{_#Dii{Gy78d@p zipt5)N0_Qlz6*BqC`DeTAm%2^#$b^~2wH>oQ}B?I%j72nviBIZ4u5=n^hnR*ON{KI zdc=u#+Q#ycZcyw9A=rkM)}EdV^v(~+&wPwCOZ5}4CB*cD4iSpVmp$U}Bo6pwtLQ%7 zp{t&J|1Yytok&l*4RERH>*T*3S9GY_@(W!wVJ6JZJdl+X$^Eeq{@#5*;zq&h;tV13 zvu|=+OR1ZbVLYboh8-)#&c%kLs-aT-G5bb4YKe_$SGB>4JR{-iaL5=HE0?#?D&fHz z9HDvUK6Q9AsDz@C68BU=gvSxz+4z<#cc z-4VY352S(gW+;DIQE>3OH&d80C}5+Rg-R_ToX#61$iL;Am^8$m;!%jcwhWr$mkCy; z5;Gc^9dgt*sah_s?0oug_ql*Zrs58=hFXJ#F&pHUSV1HB=N^GY$2axl44Ax9xudAo z9TnP8_iO?q!zA-1X*us>xWTHX5^3xRJEcR`vC$1VESHj~+A~=Hn8Y7i0bQT@vESBx z_U0txlj45~8r58xIWI78wo>6EaS!NzZEbDgW_I@+4#;}}H9HVyah#nhkshJC;5S*C zM&_21`4*ax(~=ih4}}#Pu06K8FN-|9q_ZC| zrT?Eps#abKLiV0#w0%`#k!Kj zmkb0D=Ifx9{^VMZQR{m&JVF?s;<`Q=;~8qJAqs1?R%S02@>lQAoA8hM;#F=

When disabled or not configured

-

Users can configure a startup PIN of any length between 4 and 20 digits.

+

Users can configure a startup PIN of any length between 6 and 20 digits.

From 8408bc0ef9ccd83ea124ddb020fd49ce86892705 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 25 Oct 2017 19:45:04 +0000 Subject: [PATCH 54/90] Merged PR 4060: Policy DDF updated with latest version --- .../client-management/mdm/policy-ddf-file.md | 1944 +++++------------ 1 file changed, 603 insertions(+), 1341 deletions(-) diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 3049402086..ff7f8c546f 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/23/2017 +ms.date: 10/23/2017 --- # Policy DDF file @@ -50,7 +50,7 @@ The XML below is the DDF for Windows 10, version 1709. - com.microsoft/5.0/MDM/Policy + com.microsoft/6.0/MDM/Policy @@ -2548,30 +2548,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - DisableBlockingOfOutdatedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - DisableBypassOfSmartScreenWarnings @@ -3868,30 +3844,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - InternetZoneRunNETFrameworkReliantComponentsNotSignedWithAuthenticode - - - - - - - - - - - - - - - - - - - text/plain - - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode @@ -3964,30 +3916,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - InternetZoneWebsitesInLessPrivilegedZonesCanNavigateIntoThisZone - - - - - - - - - - - - - - - - - - - text/plain - - - IntranetZoneAllowAccessToDataSources @@ -4252,30 +4180,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - - - text/plain - - - IntranetZoneJavaPermissions @@ -7060,30 +6964,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - RestrictedSitesZoneNavigateWindowsAndFramesAcrossDomains - - - - - - - - - - - - - - - - - - - text/plain - - - RestrictedSitesZoneRunActiveXControlsAndPlugins @@ -7204,30 +7084,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - RestrictedSitesZoneTurnOnCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - - - text/plain - - - RestrictedSitesZoneTurnOnProtectedMode @@ -7612,30 +7468,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - TrustedSitesZoneInitializeAndScriptActiveXControls @@ -7660,54 +7492,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - - - text/plain - - - TrustedSitesZoneJavaPermissions @@ -7916,6 +7700,30 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + HidePeopleBar + + + + + + + + Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. + + + + + + + + + + + text/plain + + + StartLayout @@ -8190,6 +7998,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -8334,6 +8143,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -8358,6 +8168,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -8381,6 +8192,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + desktop LowestValueMostSecure @@ -8428,6 +8240,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -8452,6 +8265,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -8475,6 +8289,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -8499,6 +8314,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -8523,6 +8339,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -8547,6 +8364,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -8574,6 +8392,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + LowestValueMostSecure @@ -8597,6 +8416,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + LowestValueMostSecure @@ -8620,6 +8440,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + phone LowestValueMostSecure @@ -8649,6 +8470,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -8672,6 +8494,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -8695,6 +8518,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -8718,6 +8542,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -8741,6 +8566,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + phone LowestValueMostSecure @@ -8799,6 +8625,7 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain + phone LowestValueMostSecure @@ -8931,6 +8758,7 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + LowestValueMostSecure @@ -8954,6 +8782,7 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + HighestValueMostSecure @@ -8979,6 +8808,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -9005,6 +8835,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -9028,6 +8859,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -9051,6 +8883,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -9074,6 +8907,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -9127,6 +8961,7 @@ If you disable or don't configure this setting, employees will see the favorites text/plain + phone HighestValueMostSecure @@ -9180,6 +9015,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -9204,6 +9040,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -9365,6 +9202,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -9589,6 +9427,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -9612,6 +9451,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -9636,6 +9476,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -9660,6 +9501,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -9684,6 +9526,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -9707,6 +9550,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -10537,33 +10381,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - DisableBlockingOfOutdatedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDisable - LastWrite - - DisableBypassOfSmartScreenWarnings @@ -12022,33 +11839,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - InternetZoneRunNETFrameworkReliantComponentsNotSignedWithAuthenticode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_1 - LastWrite - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode @@ -12130,33 +11920,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - InternetZoneWebsitesInLessPrivilegedZonesCanNavigateIntoThisZone - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyZoneElevationURLaction_1 - LastWrite - - IntranetZoneAllowAccessToDataSources @@ -12454,33 +12217,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyScriptActiveXNotMarkedSafe_3 - LastWrite - - IntranetZoneJavaPermissions @@ -15613,33 +15349,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - RestrictedSitesZoneNavigateWindowsAndFramesAcrossDomains - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNavigateSubframesAcrossDomains_7 - LastWrite - - RestrictedSitesZoneRunActiveXControlsAndPlugins @@ -15775,33 +15484,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - RestrictedSitesZoneTurnOnCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyTurnOnXSSFilter_Both_Restricted - LastWrite - - RestrictedSitesZoneTurnOnProtectedMode @@ -16234,33 +15916,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 - LastWrite - - TrustedSitesZoneInitializeAndScriptActiveXControls @@ -16288,60 +15943,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 - LastWrite - - - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 - LastWrite - - TrustedSitesZoneJavaPermissions @@ -16436,6 +16037,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -16549,6 +16151,31 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + HidePeopleBar + + + + + Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. + 0 + + + + + + + + + + + text/plain + + + phone + LowestValueMostSecure + + StartLayout @@ -16636,7 +16263,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - com.microsoft/5.0/MDM/Policy + com.microsoft/6.0/MDM/Policy @@ -19470,7 +19097,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19494,7 +19121,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19518,7 +19145,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -19986,7 +19613,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - EnableWindowsAutoPilotResetCredentials + DisableAutomaticReDeploymentCredentials @@ -20743,6 +20370,54 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + ControlledFolderAccessAllowedApplications + + + + + + + + + + + + + + + + + + + text/plain + + + + + ControlledFolderAccessProtectedFolders + + + + + + + + + + + + + + + + + + + text/plain + + + DaysToRetainCleanedMalware @@ -20768,7 +20443,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - EnableGuardMyFolders + EnableControlledFolderAccess @@ -20887,54 +20562,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - - GuardedFoldersAllowedApplications - - - - - - - - - - - - - - - - - - - text/plain - - - - - GuardedFoldersList - - - - - - - - - - - - - - - - - - - text/plain - - - PUAProtection @@ -23723,30 +23350,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - DisableBlockingOfOutdatedActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - DisableBypassOfSmartScreenWarnings @@ -25091,30 +24694,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - InternetZoneRunNETFrameworkReliantComponentsNotSignedWithAuthenticode - - - - - - - - - - - - - - - - - - - text/plain - - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode @@ -25187,30 +24766,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - InternetZoneWebsitesInLessPrivilegedZonesCanNavigateIntoThisZone - - - - - - - - - - - - - - - - - - - text/plain - - - IntranetZoneAllowAccessToDataSources @@ -25475,30 +25030,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - - - text/plain - - - IntranetZoneJavaPermissions @@ -28283,30 +27814,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - RestrictedSitesZoneNavigateWindowsAndFramesAcrossDomains - - - - - - - - - - - - - - - - - - - text/plain - - - RestrictedSitesZoneRunActiveXControlsAndPlugins @@ -28427,30 +27934,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - RestrictedSitesZoneTurnOnCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - - - text/plain - - - RestrictedSitesZoneTurnOnProtectedMode @@ -28859,30 +28342,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls - - - - - - - - - - - - - - - - - - - text/plain - - - TrustedSitesZoneInitializeAndScriptActiveXControls @@ -28907,54 +28366,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe - - - - - - - - - - - - - - - - - - - text/plain - - - - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - - - text/plain - - - TrustedSitesZoneJavaPermissions @@ -29753,66 +29164,6 @@ Default: No message. - - NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares - - - - - - - - Network access: Do not allow anonymous enumeration of SAM accounts and shares - -This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed. - -Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy. - -Default: Disabled. - - - - - - - - - - - text/plain - - - - - NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares - - - - - - - - Network access: Restrict anonymous access to Named Pipes and Shares - -When enabled, this security setting restricts anonymous access to shares and pipes to the settings for: - -Network access: Named pipes that can be accessed anonymously -Network access: Shares that can be accessed anonymously -Default: Enabled. - - - - - - - - - - - text/plain - - - NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM @@ -29869,34 +29220,6 @@ This policy will be turned off by default on domain joined machines. This would - - RecoveryConsole_AllowAutomaticAdministrativeLogon - - - - - - - - Recovery console: Allow automatic administrative logon - -This security setting determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system. - -Default: This policy is not defined and automatic administrative logon is not allowed. - - - - - - - - - - - text/plain - - - Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn @@ -30488,7 +29811,7 @@ The options are: - + This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. @@ -30512,7 +29835,7 @@ The options are: - + This policy setting allows you to enable or disable the sending and receiving cellular MMS messages. @@ -30536,7 +29859,7 @@ The options are: - + This policy setting allows you to enable or disable the sending and receiving of cellular RCS (Rich Communication Services) messages. @@ -31512,7 +30835,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -31536,7 +30859,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -31560,7 +30883,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -31608,7 +30931,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31632,7 +30955,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31656,7 +30979,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -31704,7 +31027,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31728,7 +31051,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31752,7 +31075,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -31800,7 +31123,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31824,7 +31147,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31848,7 +31171,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -31896,7 +31219,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31920,7 +31243,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31944,7 +31267,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -31992,7 +31315,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -32016,7 +31339,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -32040,7 +31363,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -32088,7 +31411,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -32112,7 +31435,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -32136,7 +31459,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -32184,7 +31507,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -32208,7 +31531,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -32232,7 +31555,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -32280,7 +31603,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -32304,7 +31627,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -32328,7 +31651,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -32376,7 +31699,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -32400,7 +31723,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -32424,7 +31747,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -32472,7 +31795,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -32496,7 +31819,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -32520,7 +31843,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -32568,7 +31891,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32592,7 +31915,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32616,7 +31939,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -32856,7 +32179,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32880,7 +32203,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -32904,7 +32227,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -34559,6 +33882,30 @@ The options are: + + AllowOnlineTips + + + + + + + + + + + + + + + + + + + text/plain + + + AllowPowerSleep @@ -35273,30 +34620,6 @@ The options are: - - HidePeopleBar - - - - - - - - Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. - - - - - - - - - - - text/plain - - - HidePowerButton @@ -35893,6 +35216,30 @@ The options are: + + DisableEnterpriseAuthProxy + + + + + + + + This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. + + + + + + + + + + + text/plain + + + DisableOneDriveFileSync @@ -35902,7 +35249,7 @@ The options are: - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. @@ -35965,6 +35312,30 @@ The options are: + + LimitEnhancedDiagnosticDataWindowsAnalytics + + + + + + + + This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced) When you configure these policy settings, a Basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: https://go.microsoft.com/fwlink/?linkid=847594. Enabling Enhanced diagnostic data in the Allow Telemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional Enhanced level telemetry data. This setting has no effect on computers configured to send Full, Basic or Security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy. + + + + + + + + + + + text/plain + + + TelemetryProxy @@ -38467,6 +37838,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -38491,6 +37863,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38514,6 +37887,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38557,6 +37931,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38580,6 +37955,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38603,6 +37979,7 @@ The options are: text/plain + LastWrite @@ -38760,6 +38137,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38806,6 +38184,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38829,6 +38208,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -38853,6 +38233,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38876,6 +38257,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -38924,6 +38306,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38947,6 +38330,7 @@ The options are: text/plain + LowestValueMostSecure @@ -38970,6 +38354,7 @@ The options are: text/plain + LowestValueMostSecure @@ -39789,6 +39174,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -39813,6 +39199,7 @@ The options are: text/plain + LowestValueMostSecure @@ -39836,6 +39223,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -39860,6 +39248,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40004,6 +39393,7 @@ The options are: text/plain + LastWrite @@ -40047,6 +39437,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40070,6 +39461,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40093,6 +39485,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40182,6 +39575,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -40206,6 +39600,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40229,6 +39624,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -40276,6 +39672,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -40300,6 +39697,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40323,6 +39721,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -40347,6 +39746,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -40371,6 +39771,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -40395,6 +39796,7 @@ The options are: text/plain + LowestValueMostSecure @@ -40422,6 +39824,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + LowestValueMostSecure @@ -40445,6 +39848,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + LowestValueMostSecure @@ -40468,6 +39872,7 @@ If you disable this setting, the Microsoft Compatibility List will not be used d text/plain + phone LowestValueMostSecure @@ -40497,6 +39902,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -40520,6 +39926,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -40543,6 +39950,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -40566,6 +39974,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + LowestValueMostSecure @@ -40589,6 +39998,7 @@ This policy will only apply on domain joined machines or when the device is MDM text/plain + phone LowestValueMostSecure @@ -40647,6 +40057,7 @@ This setting can only be used with domain-joined or MDM-enrolled devices. For mo text/plain + phone LowestValueMostSecure @@ -40779,6 +40190,7 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + LowestValueMostSecure @@ -40802,6 +40214,7 @@ If you disable or don't configure this setting (default), employees can add, imp text/plain + HighestValueMostSecure @@ -40827,6 +40240,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -40853,6 +40267,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -40876,6 +40291,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -40899,6 +40315,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -40922,6 +40339,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + HighestValueMostSecure @@ -40975,6 +40393,7 @@ If you disable or don't configure this setting, employees will see the favorites text/plain + phone HighestValueMostSecure @@ -41028,6 +40447,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -41052,6 +40472,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -41096,6 +40517,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -41148,7 +40570,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -41172,7 +40594,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to cellular data. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -41196,7 +40618,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the cellular data access setting for the listed apps. This setting overrides the default LetAppsAccessCellularData policy setting for the specified apps. @@ -41280,6 +40702,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -41349,6 +40772,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -41372,6 +40796,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + desktop LowestValueMostSecure @@ -41396,6 +40821,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + desktop LowestValueMostSecure @@ -41420,6 +40846,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -41443,6 +40870,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -41679,13 +41107,13 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - EnableWindowsAutoPilotResetCredentials + DisableAutomaticReDeploymentCredentials - 0 + 1 @@ -41698,7 +41126,8 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain - LowestValueMostSecure + + HighestValueMostSecure @@ -41881,6 +41310,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + LowestValueMostSecure @@ -42431,6 +41861,54 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite + + ControlledFolderAccessAllowedApplications + + + + + + + + + + + + + + + + + text/plain + + phone + LastWrite + + + + ControlledFolderAccessProtectedFolders + + + + + + + + + + + + + + + + + text/plain + + phone + LastWrite + + DaysToRetainCleanedMalware @@ -42456,7 +41934,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - EnableGuardMyFolders + EnableControlledFolderAccess @@ -42575,54 +42053,6 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on LastWrite - - GuardedFoldersAllowedApplications - - - - - - - - - - - - - - - - - text/plain - - phone - LastWrite - - - - GuardedFoldersList - - - - - - - - - - - - - - - - - text/plain - - phone - LastWrite - - PUAProtection @@ -42903,6 +42333,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecure @@ -42951,6 +42382,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LastWrite @@ -43307,6 +42739,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -43331,6 +42764,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone LowestValueMostSecureZeroHasNoLimits @@ -43355,6 +42789,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + phone HighestValueMostSecure @@ -43473,6 +42908,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on text/plain + desktop LowestValueMostSecure @@ -44247,6 +43683,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + desktop LowestValueMostSecure @@ -44271,6 +43708,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44294,6 +43732,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44317,6 +43756,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44340,6 +43780,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44363,6 +43804,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44386,6 +43828,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44409,6 +43852,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44432,6 +43876,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + HighestValueMostSecure @@ -44455,6 +43900,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44478,6 +43924,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + desktop LowestValueMostSecure @@ -44502,6 +43949,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + desktop LowestValueMostSecure @@ -44526,6 +43974,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + phone LowestValueMostSecure @@ -44636,6 +44085,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + LowestValueMostSecure @@ -44679,6 +44129,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + phone LowestValueMostSecure @@ -45486,33 +44937,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - DisableBlockingOfOutdatedActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement - VerMgmtDisable - LastWrite - - DisableBypassOfSmartScreenWarnings @@ -47025,33 +46449,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - InternetZoneRunNETFrameworkReliantComponentsNotSignedWithAuthenticode - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyUnsignedFrameworkComponentsURLaction_1 - LastWrite - - InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode @@ -47133,33 +46530,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - InternetZoneWebsitesInLessPrivilegedZonesCanNavigateIntoThisZone - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_InternetZone - IZ_PolicyZoneElevationURLaction_1 - LastWrite - - IntranetZoneAllowAccessToDataSources @@ -47457,33 +46827,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - IntranetZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_IntranetZone - IZ_PolicyScriptActiveXNotMarkedSafe_3 - LastWrite - - IntranetZoneJavaPermissions @@ -50616,33 +49959,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - RestrictedSitesZoneNavigateWindowsAndFramesAcrossDomains - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyNavigateSubframesAcrossDomains_7 - LastWrite - - RestrictedSitesZoneRunActiveXControlsAndPlugins @@ -50778,33 +50094,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - RestrictedSitesZoneTurnOnCrossSiteScriptingFilter - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_RestrictedSitesZone - IZ_PolicyTurnOnXSSFilter_Both_Restricted - LastWrite - - RestrictedSitesZoneTurnOnProtectedMode @@ -51264,33 +50553,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - TrustedSitesZoneDontRunAntimalwareProgramsAgainstActiveXControls - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyAntiMalwareCheckingOfActiveXControls_5 - LastWrite - - TrustedSitesZoneInitializeAndScriptActiveXControls @@ -51318,60 +50580,6 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedAsSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 - LastWrite - - - - TrustedSitesZoneInitializeAndScriptActiveXControlsNotMarkedSafe - - - - - - - - - - - - - - - - - text/plain - - phone - inetres.admx - inetres~AT~WindowsComponents~InternetExplorer~InternetCPL~IZ_SecurityPage~IZ_TrustedSitesZone - IZ_PolicyScriptActiveXNotMarkedSafe_5 - LastWrite - - TrustedSitesZoneJavaPermissions @@ -51621,6 +50829,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + phone LowestValueMostSecure @@ -51645,6 +50854,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor text/plain + phone LowestValueMostSecure @@ -51695,6 +50905,7 @@ If you disable or do not configure this policy (recommended), users will be able text/plain + phone LastWrite @@ -52186,66 +51397,6 @@ Default: No message. LastWrite - - NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccountsAndShares - - - - - Network access: Do not allow anonymous enumeration of SAM accounts and shares - -This security setting determines whether anonymous enumeration of SAM accounts and shares is allowed. - -Windows allows anonymous users to perform certain activities, such as enumerating the names of domain accounts and network shares. This is convenient, for example, when an administrator wants to grant access to users in a trusted domain that does not maintain a reciprocal trust. If you do not want to allow anonymous enumeration of SAM accounts and shares, then enable this policy. - -Default: Disabled. - 0 - - - - - - - - - - - text/plain - - phone - LastWrite - - - - NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares - - - - - Network access: Restrict anonymous access to Named Pipes and Shares - -When enabled, this security setting restricts anonymous access to shares and pipes to the settings for: - -Network access: Named pipes that can be accessed anonymously -Network access: Shares that can be accessed anonymously -Default: Enabled. - 1 - - - - - - - - - - - text/plain - - phone - LastWrite - - NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM @@ -52302,34 +51453,6 @@ This policy will be turned off by default on domain joined machines. This would LastWrite - - RecoveryConsole_AllowAutomaticAdministrativeLogon - - - - - Recovery console: Allow automatic administrative logon - -This security setting determines if the password for the Administrator account must be given before access to the system is granted. If this option is enabled, the Recovery Console does not require you to provide a password, and it automatically logs on to the system. - -Default: This policy is not defined and automatic administrative logon is not allowed. - 0 - - - - - - - - - - - text/plain - - phone - LastWrite - - Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn @@ -52494,6 +51617,7 @@ The options are: text/plain + phone LastWrite @@ -52811,6 +51935,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -52855,6 +51980,7 @@ The options are: text/plain + LastWrite @@ -52878,6 +52004,7 @@ The options are: text/plain + LastWrite @@ -52907,7 +52034,7 @@ The options are: - + This policy setting allows backup and restore of cellular text messages to Microsoft's cloud services. 1 @@ -52921,7 +52048,6 @@ The options are: text/plain - desktop LowestValueMostSecure @@ -52931,7 +52057,7 @@ The options are: - + This policy setting allows you to enable or disable the sending and receiving cellular MMS messages. 1 @@ -52955,7 +52081,7 @@ The options are: - + This policy setting allows you to enable or disable the sending and receiving of cellular RCS (Rich Communication Services) messages. 1 @@ -53554,6 +52680,7 @@ The options are: text/plain + LowestValueMostSecure @@ -53577,6 +52704,7 @@ The options are: text/plain + 10.0.10240 LowestValueMostSecure @@ -53601,6 +52729,7 @@ The options are: text/plain + LowestValueMostSecureZeroHasNoLimits @@ -53624,6 +52753,7 @@ The options are: text/plain + HighestValueMostSecure @@ -53941,7 +53071,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53965,7 +53095,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -53989,7 +53119,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. @@ -54036,7 +53166,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -54060,7 +53190,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -54084,7 +53214,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. @@ -54131,7 +53261,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -54155,7 +53285,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -54179,7 +53309,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. @@ -54226,7 +53356,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -54250,7 +53380,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -54274,7 +53404,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. @@ -54321,7 +53451,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -54345,7 +53475,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -54369,7 +53499,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. @@ -54416,7 +53546,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -54440,7 +53570,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -54464,7 +53594,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. @@ -54511,7 +53641,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -54535,7 +53665,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -54559,7 +53689,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. @@ -54606,7 +53736,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -54630,7 +53760,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -54654,7 +53784,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. @@ -54701,7 +53831,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -54725,7 +53855,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -54749,7 +53879,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. @@ -54796,7 +53926,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -54820,7 +53950,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -54844,7 +53974,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. @@ -54891,7 +54021,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54915,7 +54045,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54939,7 +54069,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. @@ -54986,7 +54116,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -55010,7 +54140,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -55034,7 +54164,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. @@ -55271,7 +54401,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -55295,7 +54425,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps will not be allowed to communicate with unpaired wireless devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -55319,7 +54449,7 @@ The options are: - List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the 'Communicate with unpaired wireless devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. @@ -55357,6 +54487,7 @@ The options are: text/plain + HighestValueMostSecure @@ -56441,6 +55572,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56464,6 +55596,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56487,6 +55620,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56715,6 +55849,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56738,6 +55873,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -56762,6 +55898,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56785,6 +55922,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -56809,6 +55947,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -56945,6 +56084,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -56969,6 +56109,7 @@ The options are: text/plain + LowestValueMostSecure @@ -56992,6 +56133,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57015,6 +56157,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57038,10 +56181,35 @@ The options are: text/plain + phone LowestValueMostSecure + + AllowOnlineTips + + + + + + 1 + + + + + + + + + + + text/plain + + + LowestValueMostSecure + + AllowPowerSleep @@ -57062,6 +56230,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57086,6 +56255,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57110,6 +56280,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57134,6 +56305,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57157,6 +56329,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57181,6 +56354,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57247,6 +56421,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -57271,6 +56446,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -57295,6 +56471,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -57339,6 +56516,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57382,6 +56560,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57406,6 +56585,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57430,6 +56610,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57454,6 +56635,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57478,6 +56660,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57502,6 +56685,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57526,6 +56710,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57550,6 +56735,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57574,6 +56760,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57598,6 +56785,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57670,6 +56858,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57693,6 +56882,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57717,6 +56907,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57740,30 +56931,7 @@ The options are: text/plain - LowestValueMostSecure - - - - HidePeopleBar - - - - - Enabling this policy removes the people icon from the taskbar as well as the corresponding settings toggle. It also prevents users from pinning people to the taskbar. - 0 - - - - - - - - - - - text/plain - - phone + LowestValueMostSecure @@ -57787,6 +56955,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57810,6 +56979,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57834,6 +57004,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -57858,6 +57029,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57881,6 +57053,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57904,6 +57077,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57927,6 +57101,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57950,6 +57125,7 @@ The options are: text/plain + LowestValueMostSecure @@ -57973,6 +57149,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58020,6 +57197,7 @@ The options are: text/plain + phone HighestValueMostSecure @@ -58182,6 +57360,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58228,6 +57407,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58274,6 +57454,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58320,6 +57501,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58351,12 +57533,12 @@ The options are: - DisableOneDriveFileSync + DisableEnterpriseAuthProxy - This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Microsoft Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + This policy setting blocks the Connected User Experience and Telemetry service from automatically using an authenticated proxy to send data back to Microsoft on Windows 10. If you disable or do not configure this policy setting, the Connected User Experience and Telemetry service will automatically use an authenticated proxy to send data back to Microsoft. Enabling this policy will block the Connected User Experience and Telemetry service from automatically using an authenticated proxy. 0 @@ -58370,6 +57552,30 @@ The options are: text/plain + LastWrite + + + + DisableOneDriveFileSync + + + + + This policy setting lets you prevent apps and features from working with files on OneDrive. If you enable this policy setting: users can’t access OneDrive from the OneDrive app and file picker; Windows Store apps can’t access OneDrive using the WinRT API; OneDrive doesn’t appear in the navigation pane in File Explorer; OneDrive files aren’t kept in sync with the cloud; Users can’t automatically upload photos and videos from the camera roll folder. If you disable or do not configure this policy setting, apps and features can work with OneDrive file storage. + 0 + + + + + + + + + + + text/plain + + HighestValueMostSecure @@ -58423,6 +57629,30 @@ The options are: LastWrite + + LimitEnhancedDiagnosticDataWindowsAnalytics + + + + + This policy setting, in combination with the Allow Telemetry policy setting, enables organizations to send Microsoft a specific set of diagnostic data for IT insights via Windows Analytics services. To enable this behavior you must complete two steps: 1. Enable this policy setting 2. Set Allow Telemetry to level 2 (Enhanced) When you configure these policy settings, a Basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: https://go.microsoft.com/fwlink/?linkid=847594. Enabling Enhanced diagnostic data in the Allow Telemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional Enhanced level telemetry data. This setting has no effect on computers configured to send Full, Basic or Security level diagnostic data to Microsoft. If you disable or do not configure this policy setting, then the level of diagnostic data sent to Microsoft is determined by the Allow Telemetry policy. + 0 + + + + + + + + + + + text/plain + + + LowestValueMostSecure + + TelemetryProxy @@ -58486,6 +57716,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58510,6 +57741,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58534,6 +57766,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58582,6 +57815,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58606,6 +57840,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58630,6 +57865,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58654,6 +57890,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58677,6 +57914,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -58792,6 +58030,7 @@ The options are: text/plain + desktop LowestValueMostSecure @@ -58975,6 +58214,7 @@ The options are: text/plain + LowestValueMostSecure @@ -58998,6 +58238,7 @@ The options are: text/plain + LowestValueMostSecure @@ -59044,6 +58285,7 @@ The options are: text/plain + LastWrite @@ -59090,6 +58332,7 @@ The options are: text/plain + LastWrite @@ -59366,6 +58609,7 @@ The options are: text/plain + LowestValueMostSecure @@ -59389,6 +58633,7 @@ The options are: text/plain + LowestValueMostSecure @@ -59780,6 +59025,7 @@ The options are: text/plain + LastWrite @@ -59803,6 +59049,7 @@ The options are: text/plain + LastWrite @@ -59939,6 +59186,7 @@ The options are: text/plain + LowestValueMostSecure @@ -59962,6 +59210,7 @@ The options are: text/plain + LowestValueMostSecure @@ -59985,6 +59234,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60008,6 +59258,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60031,6 +59282,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60453,6 +59705,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -60575,6 +59828,7 @@ The options are: text/plain + HighestValueMostSecure @@ -60618,6 +59872,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60641,6 +59896,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60666,6 +59922,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60691,6 +59948,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60716,6 +59974,7 @@ The options are: text/plain + phone LowestValueMostSecure @@ -60742,6 +60001,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60765,6 +60025,7 @@ The options are: text/plain + LowestValueMostSecure @@ -60790,6 +60051,7 @@ The options are: text/plain + LowestValueMostSecure From 53990c726051e668e61174a6dca0589c7491405f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 25 Oct 2017 14:30:25 -0700 Subject: [PATCH 55/90] add preview topics --- windows/threat-protection/TOC.md | 1 + ...ows-defender-advanced-threat-protection.md | 70 +++++++++++++++++++ ...ows-defender-advanced-threat-protection.md | 9 +++ 3 files changed, 80 insertions(+) create mode 100644 windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md index ce3a47ceb7..a13dd273a6 100644 --- a/windows/threat-protection/TOC.md +++ b/windows/threat-protection/TOC.md @@ -30,6 +30,7 @@ ###### [Configure endpoints using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) ##### [Configure endpoints using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md) ##### [Configure non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +#### [Configure non-Windows endpoints](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) #### [Configure server endpoints](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md) #### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) #### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..57ac6b4408 --- /dev/null +++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md @@ -0,0 +1,70 @@ +--- +title: Configure non-Windows endpoints in Windows Defender ATP +description: Configure non-Winodws endpoints so that they can send sensor data to the Windows Defender ATP service. +keywords: configure endpoints non-Windows endpoints, macos, linux, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: mjcaparas +localizationpriority: high +ms.date: 10/02/2017 +--- + +# Configure non-Windows endpoints + +**Applies to:** + +- Mac OS X +- Linux +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[!include[Prerelease information](prerelease.md)] + +Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products’ sensor data. + +You'll need to know the exact Linux distros and Mac OS X versions that are compatible with Windows Defender ATP for the integration to work. + +## Onboard non-Windows endpoints +You'll need to take the following steps to onboard non-Windows endpoints: +1. Turn on third-party integration +2. Run a detection test + +### Turn on third-party integration + +1. In Windows Defender Security Center portal, select **Endpoint management** > **Clients** > **Non-Windows**. Make sure the third-party solution is listed. + +2. Toggle the third-party provider switch button to turn on the third-party solution integration. + +3. Click **Generate access token** button and then **Copy**. + +4. Depending on the third-party implementation you're using, the implementation might vary. Refer to the third-party solution documentation for guidance on how to use the token. + + +>[!WARNING] +>The access token has a limited validity period. If needed, regenerate the token close to the time you need to share it with the third-party solution. + +### Run detection test +There are various methods to run a detection test. Follow the specific instructions for each third-party product as described in the portal. The typical way of running a detection test is by creating an EICAR test file. You can create an EICAR file by saving the string displayed on the portal in an empty text file. Then, introduce the test file to a machine running the third-party antivirus solution. + +The file should trigger a detection and a corresponding alert on Windows Defender ATP. + +### Offboard non-Windows endpoints +To effectively offboard the endpoints from the service, you'll need to disable the data push on the third-party portal first then switch the toggle to off in Windows Defender Security Center. The toggle in the portal only blocks the data inbound flow. + + +1. Follow the third-party documentation to opt-out on the third-party service side. + +2. In Windows Defender Security Center portal, select **Endpoint management**> **Non-Windows**. + +3. Toggle the third-party provider switch button to turn stop telemetry from endpoints. + +>[!WARNING] +>If you decide to turn on the third-party integration again after disabling the integration, you'll need to regenerate the token and reapply it on endpoints. + +## Related topics +- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md) +- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) +- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index a9f61d94fe..f57a807c89 100644 --- a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -44,6 +44,14 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
+Windows Defender ATP supports the onboarding of the following servers: + - Windows Server 2012 R2 + - Windows Server 2016 + +- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products sensor data. + - [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
Windows Defender ATP supports the use of Power BI data connectors to enable you to connect and access Windows Defender ATP data using Microsoft Graph. @@ -51,5 +59,6 @@ Windows Defender ATP supports the use of Power BI data connectors to enable you Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs that are part of the Microsoft Intelligence Security Graph. Those APIs will enable you, to automate workflows and innovate based on Windows Defender ATP capabilities. + >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink) From 936311258c2135f088d6c56c59a88513e6c6011c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 25 Oct 2017 14:52:57 -0700 Subject: [PATCH 56/90] update image --- .../images/atp-enable-security-analytics.png | Bin 318767 -> 232675 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png b/windows/threat-protection/windows-defender-atp/images/atp-enable-security-analytics.png index 9d8ae5a5cdf2620b50ef385c4c9d5c337c0648ad..a51dd8d30a6c02085c039f27814dc55785910676 100644 GIT binary patch delta 196313 zcmZsDby!s0`t~5Hl7fJ=peT(9NJ%KA(kLM@gh)$=)Fz~15JgHFMLMO2l9Wbb=@73Tz-QSOan7OE;m+|*Tr^m%`LjS{(lDbd)&t~@5 zSR&poEeV@;cfOr+Uwk|(L=6S_kShscq4ZqnyG1v}#4gWvkJfDk~ zf3I|2F&y=)g~L^Itqd2Y7T#GV_NSx0Fj1mmbFD%{G!17ze#ah*$y%e=n$J}UPA=Ft z?D~(4^_HZA(`C3Rw6#drJD~0HCxiF#LHTQ^9O$vgRc&6H1TiP-82zHDbz$Mlz{npT(n$rt?k z?-y>0Z8wqICyDrKM#)S>r-)N1k)jdJ2NSykOvN;rFR|CktmnRcR{CZBBQd}<*^^RP z{P>N=*AQ6#XbX7sABNhLg4UyVAse#3^s1OsR>}%{e{P|!Pl>sLqaB& z6cou=5t|ZSg%B~)O62jizL(_6Y++%swN}z&w7)v&x|HZrti}b*H9d8CKDE8quiP>H zjk+`kF^xlv!zG~D*h~cvYb24Ndo<`+{pwoLNZ@lwWl%!+f@d)}{&gnNLH5l-$-JFQL^WQkxt4 zb@kr#rx)B(%#rm@D80Z$QI~dDzF9f=a~5CX2&<~P+N7HG##Kj0N0<<))=jJtdQs>4 zGHW`|y*|V-j8{l#S^h_)(vNNMFtZYuyAlg!GPGLJ{*#mXu#Y}(75lf8FQGkUp@U)L z?P))f*^AT7m{S$MsUC?-v3E858kKOnPK3}bfx=foA{*p(z<9EWHlK>sm|*wgLtR2* z;@KqkjRw(8BuhE?k|NJj=bt}+PJ`eu;~wHKB}27VjEfYk5c7X7nz%j*GsKRXI#ZBjhKSlv(xNbeKUwcJ24R`h!j%?- z>=+Z)oh|V6jf@1#gi_A5u|!DoQa2&!MgOstnHhm;f?WXTR|1P{k~ieiwd3!17iZk3 zP8sqm7in}Ix&(w)zI`sVop~}`7GC3iI2!?-vFJnRkQ1j?Vf_QOmpBHv0`UC!2$yeT zR4exfkTt#{vjdxl#%5-1k@vLv`Cq<#Y0wofU}kRKAb`^K10SCgnhSfFVoo#Zv8yO{ zIPP$tgQL+@;#7Ntn?oa4k}pnLP7dGeuzJd{!55b=<+PonVET9|xz&BMCh%d8nEGPq zWQi#Wq>=a9|8%38#5CzWYlh<20N?>)7e{l$l@9l6_w#HFH^wV>v_kfM8&c+6Pd&tu zhm-CV3(-2ZQ=W&Z+1bw-$}cZAFI(UjJ5(NXv{Us7!VYxDpEs*F#dY5=e5sg2h;Ef6 zpA%lE;%@qB-fuvSm-K$|7ADIP;9RNLZlQ%tNcFz)37@W&6q$5T>Ute72%Ycs7r7t4 zJ8P6U!|oQEBcu-SdBIadak&q_^v}~NPb)8{+Fj~t1-IJ*DRX*B;!^lxoAHvYmCk|i zVk=NW=;Z6D9Cy_+^WOgc%-5+iR!UASZ?F(z*w%o$^33-b{a+7S>HKV<(=h^n=!yM= zu5egz(0{J`5_tY3d;*HUrl(UnZ(bK-Op6ZHlEuMome+vsIr&gyaa>6&AGg20*pnPF zb+-8EsLRF+n`w7C|9E$4?mGPF3MPps*tfI6h;fGS@bMq;^M5elUA`YfKzOD8p2YF9 zahEC2;h*N1Pz@Ox(l~-V#66B08C$O2OYr9L+77KanhjlO(<9TRAmLV*V+u`~Gb=AB z^NV-T^b|@Uhz%WYv3Py0pMSfV$BV3$-i6LeJB-= zb8fmh%{%0_EXLoJCC>TFtVVp#PY+p037BpKPwysQigim|LLLc@f1bhkq(BNX+ywGTn4?Jet%q+7F3ygFnvJx6nne16fB+_r!hB1$7L4W&^4cjl8x;Gl6p()tfEp5#k~6^Ht5^3Og3HEQ+_Cu|A)b zM6Slby@b0(p-r($n{C{H4D+MKM|D?0P5=QsH)5LHJYMNwx7|!7D(ihYR(DRz;I@4G zY?i97UKu)3H;WILi;!T*(JYWvR3zG{Tw-{yAWdvkH^qZJ9c?mGJ$24Kl&2GjKoDC^ zRNVw+0XSl#NsL}VD0dY>iD{2>0_|$!4#wmV=C@4O(UX1j`U_17zP<(OqL2Hmlgpko zsWSb1LWe2JY=b}NgUPHg`?ci)uK~5G*%kBzd}4iQod^G z9VuwXeG4QV4waL2YUDtCLzjP1cS=3Kh)>i8wYZX*FIAzsxTICgmZ&&Q{ zRF{9x-xMzcPX_EIZEVcKT{(Y4*J<#Tupe@xmhY1T=CS^{yzv=ay@mZr1j(9i_&gRU z)UZ-AETVUs|1pdpKm;>ENy9Pn53!gmrSr68!^&>@7?R0THmH{7TGYS95s=wZ=~Q=U z4mk;457|dD{1hBr51r03;}GZyII_d{YTmJMBk4nwS$Cvli9FY|f=>iw2BwHp6MGYS zea&F=I}R{p`ttm@b>^|};Cj%ddR7#RN*IyXl13t6X4?G8% z*M3H*n?8@6_A)hXRXkI^#@@T~dDhT!b=gFKdYO3is?kp?_AmBp>NsgKk3Gbb2??^D zUShkYjc<5QnL%Ydz!E=BB*lw71%$YKGgp@_1uEG72n7{~I7!oncoGv43Hx@fmdW(0 zawWsc1mQl9;7-%N)afB_Yd!_G7#YK^7G#rQ(ADclBTtVqIm!NNPTS&itRsUk;q^Zi%ApO zB0hA=;H(Yc*Joipc%Y24JWi6Keps*=>}1oCxFMCuS~hohTH@=Q=D`eOx5uf*9$^^O0ActB{drjWZiN3&ksl9QPxNwmphDN%pJW+Q+ z9XqA+K&M?ibfUJJ=sMTjBm`dR(Ud)OMj{eL6uV4wyE|@%Y1Z-EZlWIZXdWYFciaZM z&g(`Ys*O)V>!^WV>$Qu_Up<~QV5e9HdC*O0o9^95d@ zV*iJ!&E)0Tzm8kOvwdO39IwKx_#xl4HXXY0K0xOA)&Jg{nMNm_(7XC=~ZSa5cALe%AlCqE0v}hTwT8&-Iu*nYH zh{FwVF)@us1v*^Sq4|96|9p@NLGgDtn3+#txAx@?-CfCFyV1bv{{+h6=`{97-nweF z+F0q|-_U7gd}-#Q_}5C((syTpo&H{FB+y6I2#SDpd`EhzG3inM$fO%MRdW?bAniRLv6v%6vma8G`(lIE>i!yo3Zg8i~l+{Nyx*!&c!`R*oxz|s*I;7 zr`U|EggqtJwBn7DZufB~Y$c))e{CKVM4ZtVK{4d%ZQjuI4x$#vuJWSJb(v}i%+MJw zS+YJl_kOo5|2-h(79Rf;Lu@pWV)9kJas%y7ga3UmzrHLZ1s+V%uV=~6daUq|ITLk# zV}#g;OQ%tVZ&*iIYq%*`u~()aC0L8ye@Q(+R|F$7%sJ> z;$Pn?x-ao}F%TKq7lVPTp4b5-RYb!>fd-?2b0yc83>&fnjpvl1hygE&+|;Zs^uz6% zuSQ!$BNc{Sb%wTEw%-m$d2^?=27Lavts(rYDYooi0!-p0>q*RLYR}hgj1Q{?hjO*C z8+i?=MG)dA_c?W`n?EaGPy#rQXFwgxX98Wb8e<3*A^p1^GSx^~dWy1hHYNk3kmE<3 zCj-H;a64wf^R*>vJ~jE%Kh%7mv>Z;^zc~@13Mz?OQt;sIurpQ#PlEUi>@p(RLS{x7 zj0yHkTI!`DD%G3@W_<)PeJ=VNF<`YV?U{bRdim?iBAB#ypck(mlRCzCG=5l(VmT)Gz3Ju~LC9v$U&VjI~f`^^`ax%dKZPI``_7 zKZZVnRh-v+-9Ed{!}LYrNwPToNfaAzzj>@VdAwnL88!9)LXCzao%q@hH8!oXa173Z zPHAl$i5}H&ou=rp{#l{G>@V`-L`UeNV$L9*QsL752%zDx2x^g`f=jlfky?7#bn*l2 z4D(-fbRQ@QBvJgaSrkx8gct9_e|MkEBuwN!9si%qGx!&wmCtf>wfpN^b5D8k`>DmO zNDDbR&z=xwrQW7ipY%7;HmiLvTzmFi#ACC8%C=Ea!iQ&C4loTCW(2+b%RVqG*jo{z z#?3(Ucw-gCzY)*Oe5Hlyz8HYTv^G^_Hk;6`U)JRl*TzJM0($T*m-S$A9u44cPaoNK zbd^tcTuwb1pDM$8G_l7EV|pw^K#j+**Yhm|n6DVtk8^g>M;Y-y2c!VoBiAEN_9KbX zo5y_CMdI@2&lOgyv6kJ-NB$hqaG$6+U!v(i6i;j209Vr?qX*vQDHL#;s?%@CL?HU{ z*411rUTa!V#2G|Psp;-2{A*tR7T}Xfk8BtOU08V?%t(PR1TsFv{^8-luyMNWrWK9b zXo_jhGV83wz0T%{v^>$uu(5!AbRp;UGLr_uha_M8tg)kUyEX&gQWq*bd}#l#KLY&O z(gYk*;%wXaXy$Sx%)srMLdUON*nu3YiWo01Z)Edd zS4k6Vd2>J6TBl;IxWo3>c7NY!6@%r__y-Q2Izsf=1$K_+RID~@qA$q7J*JZVj>FNo zdZum!X;0$_aIo>OG?iH!Z%)>bzq<4HhU^9d$Fyfhq6!_-jWN+ihiK95ZAiFZRgI;0n4eifatP zE>f9DJ*awJjI(?2C*CL-raeuRr@ie}ZcPgyIPAf{cIHl3Vl<3ry|DXzJZyUK1SPOM ziXpe85h#fA8&gAwP+q?R4L(Vi1qI2=MhclH(8b;5XXk3t4ZkWgqUb4PZDNoPG&YP3r(#$il8X@iN&vSJv zZ-7U7e~1ms%gbZoSiWu65zR#oRb4uvhf>SRD8s|U$zLOW-=Pdm{qY0;tDyC#{uZ>5 zCuxsQpP7wK&wD*{D=TStchTAHigd_ks#fo!Aio@tULP6_rPEcV)BBL9?5D4U=$!Y^ zV9WR)Ju=>1?7F*O3I5^e;vzapZZ|RA3rAWf3m!?@;hGKv^$}Q zXZenXre>ftv(LuH#wSQt=J4>4h2k20)2Dy@SCJEgF0YVY^Y5KXKBW|3a>#LZcdz!~ zlHJVe|N8Z7-}rb~bTlP+trds0#pAz`-MjPo8Ehnd z#y+c{K+eUbd`U!4PtVNE>|+5-WDpB!Qci8XPoK+^S}3w&gUrzAjhdWXU~UBJ#KOI@ zBV*`#8-xEMce)U_k+940gf)xopY8-<@`;Iwq}Hb@5wx)PYZIq!Ix!17HmT~M0_$=LoUnVLH8>-gU3;%U}0 zdV@|-=t|6Sd*;xy$CorTG{x=r0b3)7Af!AwIeBwD-ap7wH&9J0t*w!-yK?_?HF1#^ zVPaw;jBi~-RaI532EeXDn;ok3IG&7G7mJaUGmF z@oc`5C^)ZN`m*x~21{^TvUD{>rFi5a+G~~@yu|)^PE&iKb6IScDoYkDAAHgjf=rxA zdkTaYeoP+Iz^0FHwsyP^-B@qV!G5}2?Ug^y14EYdNJD(#*I90VkeL6>;x}k-o}=Fs zmV)R>cBN)mQF*GcgRQoU|Y_%#`Vw?BuWZ`gYBLx>$!F%IZ zV+`HVFE6iRLjQPg;gy)4SBC^9mc-$KQ%_xs%b=E!=a#U#|K=am4X9UTo%+8lId)lv<*g zBjsK33Yr4n6+xGPjgNB>qzwK2k}+8N%Bxqel1@okaD1>^aogx#l%5$?iSk&$;f!y) z;=efMzBHmQq8F$yF>J&WuKE7`E;_a=R&zAVy9VIFuq!_L}Q%D%L1~r?Cb4il3Tw90th@eLNcuyo?Tfw zac#d5?1%P7baZrrPu=$yG0bra?K{nLb|0SHzLi2|egA?ditovK`HbywUkh{4-9;XF z?Ks&0dxrkTjS~?{3|uUXfn{lzeLWp=44k#@`c!)!&sPA*60} zQEBPT($Z3pr4SC^V#T#OOBL7MH@xmf|8_bjA3yKOtEw6;3fC@qE4;XnBL@<@o4fnt zg3IQ1P4NP>BtMN4PAZlGNVY-J%BC`SFgU9=A%893bIws z$Jf*FykDHt8en|aH2Lc3!DquMFFtXHaeiTCoDa=Nn?xs^jg$4MH??rGu+t%Jxi*ux ziVy9}zQj;D6B$Vz^ADFNC)`x<@M_*Z0Hv-8yE;-$(*G30{spt` zxm;_RSYo`}ar7&{Ay>B|!ttKnDHY-aC<=TPnQl%7^7)YAoq2+v*_1trh>JI)k>r)< zl?o~L9XA;Pc=YCY?Q3X^Wp#khHQkGdo7GxGOH8e3WyBsp*)BY5W6I7r9|o(s z;@`FbnA4Z)D>Y*WSTvlD;vH_|F+r=b=mN$5s5;OawTkV#?3Y#{P{kIvnl6w-WE~5y zHP7C~XXv)*)phXH(ZP?~HH*s>`L%=V-+?j)0Sxk3!aIjC43sWX;=m%ixt0eb(48BR zjBUVo=~!Z9KFSfLaOsqBqOpIX1P3EUJ7RcTa{EU|SC0zmgQW{CQQWYRawXK@;O`yl z;X*9nN%j+F{2_o(@A~?PN^dGVo4vAD)b(a)b8&m^o8LEtY3vOQU=K|hs3%m-puIdD zPaK~=(a~NMYKhtqH9UO3JVz-)Hk}}_QCKd$)#w4J_N^Ds^J3Vi zinwHI=YGDM5a|&YR5N~095kIgDkmenTUv@jg2?G{(95&b)T9DKI{H>*R@T+uZ}?18 zz72b6$@A05+^6^j*n5}|Hk1tlC=xD2M@%)Iz#=Uk_dP^Ut@|KY#IR`Q%6R zBSx1|IwuO}TDPEDr1Sb~VR+32RnCB=Pj#NRf`k^*wPIqWlB`cg0KnK z1niCmuzkb@3Qy26Q=g@@VHLaMBfu4VFLYT8kG341c`R0#BUFLpSQl z#HH>QPlO}qfQj`0hB7LuryPkfLZ<4$&t`>m9UgSv|~l8z}&v8wCm zzkeFn$t?1d*Rx3~TImNF0S@eqZzdqs6O|g5I{42qbDFVt)kL5l4KOqS zjhWC|VdGY1k0=BDyM|yo=_3h?HjzR(4VMw=p%yIr`BTv%{ED9; zbjV78VLiWMr83O^F|3!LDB9$=)8J0_7!^9iIuuNComOA2O}I}-+)R7wPhC0K+v^Ro z=dJl?te^RCeJpZ!9J13ZycHzXaJGT9`~d*#QI+~`r9OZ6rq3;=Q%Xa!X$)`$K2DeT z&8t^|_4AIi`WI25s0f;Qtb`Rv6b}#YjqPL&;m50j{QUeW#l^+b>t*@?Q&Mv4F2}N7 zc~w(WWAE<26Z~$fw#FcFqMT>xTIa#uUX*Uc6MOnGwRuscYM0G!c8A*Wa{sUeVHE%_ ziD(5~GcwyyL)h5ZNlSZRCDY{+S2+65h2=um1Do&j@Wf=14M38w`DwoRBp98> zRw-y}#~}saR;~1O2?Cas&YR*}4VAHOSqtkcD-Fda9libiegI7ac*_E6(Rom{&^X&m z*(VA8=jZ1j4(`$y7@ZoVT7IpDDkGkyqLWpYb;;93A6X4g9~GymJO%;B$|x&D!%|5Z zRG%h41)FCW$%nj-XUaed={fKD`iO^PItQ;?CNWg_a$p}68M15s#Y5T^wuVEe-CY$to}v&N{Cb?=)T3VAm#h#&anwyE-R*)L|Kvx>-ku?pk%gt-kT@x&P;JqmfC(^6 z_t4nbbC(`VBQ@69A!d6k3lHz$EuJ{hnt%zUmdMM&6hn5cw5}?-w(f^2WqZD5kdz@a zB+|rt-{WIegBsunLH}8pVzSra-1(vV~2HmwKiV|`Oon*`hff`Vy9MP&Q?(7yJu=ZhlaR^nEA zJeJ>zV$rA>kC5LI`axQC85ykTj>zq7xvT-NB7j{~zxN7L05wBg$Za^{=yzrmdgayi zx3icAtCTP+Iarw228e!@VZ18-zm`af=huGRw<4?s?tSeg$HiL>dgcCF9#4BL`31t9d+bST&P!&^0-^2=SP^vtEx@jP-(|AW8)~9Hz5O zH=QTv;_0~;V5xru*B3vx;`#C%7_xFxl4)ArBo)fPw-{`l%@TsK9&G*a^s%}+DgE<- zNbS}2?m6p&wGoyo+=0i%c4KAM#Y&*yU{G4Ux5%h6Db}#95T`^gkYgp3HzE8n_-rS1 zky*{_&gb8`I%d1uBGJsT8tuzv9<4HAW$M_X$Ff#k3BnK2x3zpxW(6K3GMop)5F%PL zj$}xf?~ema=wqE@V*n9sr`##O7S-SXS>TiQUD@*JPX~s%C$~QeQ-P!;_-=ezp6s^l z@(>E;j(EfAuZ2n^Zk*6>9>~ehS4t{3dJQ(j&CRV4ShN#FwB;q}_O&YQ?}9q~!opN_ zabx3M+@F-(+|CESb=2uAke{#SrG2?+5vtC}di3X2fFAe`9a7yWENBY?ixH0e*_JyQt%W+NH&`#e=RdkPu2Br@Z`;<(m^%>Xj)N30w^i0L1N$ zl)Jm@RsBpA3tuHH<9%EXge5F1#uJk>_u6S=- zsC-sx^gV`%j`i&ITcOQ6cuLZ>rUDgQt2`$uqYRbro>A`5>oAe?-?C;h-JXS-lRR@j zZVTZLTrdY2sMMCdv#@Aibx%9r2_L5rPS-5ZUyn_)`Ea1M|MWH;ae7I~LypH%@81gp zcar-u`V_PrI~})G^_#J6_hy~D-q#5@A;k+toi!$9`27uoJmDsP#clOC~YV>hgz^Q(!ebZvcDj`9{Cvc|6=cV1+d+Y1T^+y;bUYO0iy!%`2q zkFiTO?%<#AFHFS8)!va&u5b?UmHqrVuO}z=OmAK)9~3V}CeY{q#;go2o9Nc*{udK{jnkCag z55H;8V@WCBEfb|xFemznLZ#2_r9Q{*cLg(R>o06dI4?0Skt z`|9EIHn4q-GeA+@Y8nTQ1(@Q{f=iDd3T!DEPh5{a@#*d{(d{<-b#92c2$mgg#s~*@ zJQ2rWrlfS}$!;YEKmoTdQM((oGJB|td6!^av0U_a)JVgpeqph?SyxOyy}p-Mf@o_m zSv%OeYr;3-`?W1NH_wfXO7@BNae#~`U!~teIBAYaw-XZCUbsB@GxszsCF#`xy62*> zQ+4fCIiLbW4(_ShMgcIQCgH{!-U=6JLJpC0P= zaG~MT5+_OQriJ19tz}Ko-MsWXlRu1R)XCo83D#Dti1kq0t2qT}Wo1L#fiW~^`)-nS zFkQRmn@1h+3tu@#PYR${3ci;l$w~PXNR|Mb74Q;b_Xq97*?s}kjFIhPl!);eGjJgG z>l+#h*aZ4TKqy^-A-8^AuK?0oyAhL^8B6#n4Vdb!4(9ar_4!Dg&5*#nfo}E+kUiF8 zlzkxNrh()%I_q}r#eTsYMgq9lop>FruJ&=q?D7djg>Xj|C21MRJLg zzKE9ZiRShzD=W83@CyOSke-)E1Y~tz9fgyEmwTD)*BG83JFT2^fT_R{NMv93NXxgG z?RS-05;~=&9nD;)eeh$&XAQ{B>2M;WrN&n|^(FQP)H8E)o8nB9f-wR?_2d%@j9?g6 z??)mY1dzbE9n?w>#CP);MJYx;xKVfM1&dQ{i8e6=&}T~!!LPa@w70hKnE z*;3i5{a#dXpf%rKvVJ73Y9D~iM--!LADo+&_O3A-V)4BCzG3k#9yV3eGd*o4xmu!)z!2! zwysTVFN0csg~+-59>8)*h6ZqASjW=b-M5?2?hjZpJ6=+OX%tIy%9a%Cm29K=bGinsC0;^B8pq>_LmC~k-W*I;c01&k>LbCj%SA?0_?J_GThl4HVA(<*S zAx{4rJ3yK{EcPZ64g{uyQAs!u8{x+hd|a*KmfHhL=*pejlFY6a)ObK+dFCYn1iLJm zZUd@vw-c2*Bw}T}HO?o>thJ)=${kz8v&tRT0wHg#pfyCpuhCCSx0-IUgg0Za^D9E1D?NWG zC5F6YzuWQ9a)?t5D1rHguhX@8a+cjLyXWQInK=Wbs4Nj;YItdi{Y{_~L;y6b?bXOj zN{CnFvN>sIruTQi%gm1J_iGMF4uySxM#|#=!l>f%;uItx&9()FejLoH2bj=SN?8YY zH6d7z&{Bc}G+$hmpI%c#4+PW^bc3`6IB%w@z0cq{A7yS~q|vPm?u1~cct8nW!pLJ6 zV&KsoA?qQLbs(1k4S3U-O;(^+%M%90Qf83I8peyYG z9Wd~%t((X0n6nN)lD%j&b?qQrc6Ro80yyAf%xUs#4qnHt-UfQw{tU&6Y2WKxS<0Tz z5tQO5%jtlal!e7HZ3C}zk>k}2W2VfamsWA>OOwHftZhM(Fa{j6{mITk#{<)DI^io? zIFZd}MzD(Iw9wwEsfg;0s_RpylZP-E$>TjzqoUY3Lub$(L+k%qvTr^$4_-G}>$uNC zu7@DIu5B|LKKX;p7XUwg9env#MlC(U$XN3wvX=jsMzMVYbax z!e(+H3f-6PHXx&;%wmAG8RVYW3LSbi+pmhmXWag$>yr~VEJ9Xy8qx1J*so$QA`g@y zMmjJcjD2X@EluV3SIVKw;5vNh=rVm4rxT?{$XdLb)oxBmlhX>QVPcZisgdLb_`E~?9#*w z6^T+pP!_OPL>F#((561hl6G~IIR!mg>+X3dcF6a=^N^k6?<}26QS3kS$k1jLb@jPe z%7|7~ZS7z%yZ|U!QRO#lva1*Z5XH!jmztWUrKS&%h(^pDjmW5III|2>!@ygc=C&WO z52n6IXg%&W?9&enDH2fzQ&bOUIUxNH;_{QFN2 z_-3+TX;#HCFhNNL!*(z;CD)637P^@wExjkz0H*kn_}hkANTi4FizgtX24+uGyBGt7 z7r7oG2*NZ@j0B*vY0eHXc`z6lXo{)dZ8Cb$v$8REJtrq;!8&~-QdmFT_ImjA_VbD9 zQhFz-Zey&|(!ydM>0!N^&@>t0|C1GdcWcp)YoEEI6(%WG>uIs1Y8ASV{$_Cac`WXk@GS{Qfy4@)FAm9A+ zv4@{7mTK`b*Vn}b_1C{M_<=>`q64av7ua?3y_oX9_~-j?%uR1Nr0K3YL&%fwqYV04 zgvdY7Dh}7hxi`FCFP|*GijHKUEmf{oPo1ygcB`SPM62BI@^e4d%~BrUWCJwF`vS%d z!QW2$Is48r_onvmQ-%s()Y>urc(UYPwC`N*qdDaa7rkc9f!gmyZzMfg5l5cnzP>b? zRG)C_7>xEG{TbyYCoRoC1W|)&yFG@X1v5fe%J=WMI%QVBU%v%yE{57CApoQ8R2BJ2 zeJ$YiAtBcQ{RDmu3=O5Frp}~H6>Ec_7~aI3`q%~M$k>*?fZ6{UY-Dsa%kBN$a#P3$Z)W;7Xk@Hs~d1sfD?B(H9b9R z(!;@j)9r%6IQPITs(W0NV$;pkl)BKg(l4?*zEx4r?NC_%2R? zQkMq~1wpNIz;Qb*e&}A?M}h81PA8b>ySIW)b%dR%sp;e%Y}P}wpkY;Pe>kYPy8H)& zpBewP`u7uN78dMUWm=rkgCsA3ECFF3@Z@%DDLX@i=t=tWb$!%BCsE8e>7-%|6P@;n z9^=Dev0Q(=WE*fkKHwSR`fjx$ z4%kF>`w`^9(#BWJhpesh2(QQj)ebX629DZ|6zSHUeVPRVj?C8um?r>V1U!0qdAS~x z^MzuJwuEm!NB#C}g34II@OVb$iJ#`J^ggq0o);mh4ET0l!N%3^CaQAhG{ACpM+ZUK z0R)iT=_5fwW}0xfZgLYBn*uPzvm^9gL(8TX0}nI+9khMYDJ0}pqnU{^DX5*+Z^_XG zs7cg$t!;#1HeNgEv?3GLXw-eL+|SNRT7v8CyhZ9E^K^aX%J;guslIoBIAdwo&QH?O zU&?epa_?xZ$N^s z=~f#xHMMP6?@bH|;N#=t_d5UXi|CY^n#Y#kOdv?&)9-I{8Zu6Atl7qWK8%!@QqehO zdTo(0o{ckpn@E2%Uj8SWu?*>ZD^;a!8#2_Yu`a2s9C>(OH|Xe!q{mix>l~Q2YWpx7 zjue~hXc)e-vEg}=sxssT&aiP>G%cC|Wl<{u7hvN|zbmP9XliJ%cCcPaCn6%cJ2e~6 z6Qpl7va?^Q*1lLOQEC%n(v;UY+sYvsl|usi$auCpq0i~72i}VrKP^4g)Pw-3JRkdb zzzmhImvr10x_;?9%IK{i%B5S;TZBCEf0;Ef$8^9kYInFXv4gxJalFAfTBm>Y%ZxTcG_wCAcQj3FO>7p{eDR^N%YgO*04*WD-*WOfi2moMxY@(MhLe-DI zLm%^xNu8{KtDCYz)a6DX`W^ZdYiP~*Ns85b@^qJ$k?(hlYi(blxmMHOS%O_=xe!h7 zJ)Q)aae3)jHvVvLZ@xzMN?Vnn8}8fI6Sw=BY(k%Yzftv+1M&7~vFmG$Kn)Tp#=(?a zpx8`LcC6+_N=8PnAP(!@;r=JokKz<}z8ngLsv0xHXH$n3kAuAKh%2CmhLqxe6h%0V07gqVtq;luj8dGJ?A;R%8(MBF zzWqn#9wwo(=|HW*2lsq%er4KE>0Sv?2(>iz-Jox_?1{hrT#ug3psn-Q8Om)M709uj3(o=i zXO69XIZ(Hldd?#U_b1KRkV6PF3a$FFWV&VY$i^2BxUFv>q!{3@LuU-g7RZ8TULA?OGk|t!8Ta zLst-W92trtc(#8Q``F!C1F9oS-;`}cSA;m?8e0QbyK6m`)BPmhat6%GLTQ9W{}h8+ z8PF?%iYX!+TP5ckGRJ-5qbV9Xr)f1Uq?sspnxxWsJTI8kn({^j}js<`uIGl5`pEi z#A6>^dP)PLONf+AF$I*KbfEbJgsAAQKVjr-#=q}W zy%BigIw8&&E^9I=c4!@P{I2})+H=Is{o6YAJ_l_6uMdEeVee z6hH&w`#z#(v;>LN%@ES6aVs^}2U1e-69u5z$~>dfAW`dpukz-pUYQ3L1s+wHc0cHz zFaK<+Xk}0otA)gkF_B>t2jKGvn3blc<`BMJQP}GYEl!O;@0tD}Dk929CBUKeH(tHK z{&Fe3=P3fJcsxJ|g37a^OImiEg|AB?ybIvcau2jDfF`Vf-(ANn%f?8P&4A)7y`bYp9p`lh8!uAyGPN?{a2&YI8^1LI39a}*Q3$M3w>+m?t238EiKz0Ft%u+sX?#U0+QgLY!*`* z1yZXq_5S&C$N7PPV1_=!y+W;Tp6EQutJb8ywx8(X#If)W@36M{R09lsK{@~=wzI5y86Aw4{-bn@AyeM%mgD?vnFwf%R&l8LbBj;s{pWV>HB~jb(grzE zI!U2}qoeFLaX5TZsO;?QG`Z_QW!f1p@FIVcdkWxz-7V%B{zuA8B!~{#Y!e zBykskhD~w2HZ zQPp5{5Rr!}x@F$}(WrfK0~=cP0$e8WxcMs3%%U3{ym!x3`>))z1Vebl;Wuz=UlIbY zJE-HAnKt3AMQmls?-MQk-_28w3z7E&X>RQsa$vV_18@|?aWQrLCE?J#1gDK_oS%R7g##i z42>!%ulspI7Lm|kA31aBz*R&Q108o%paWhK*Uc|2 z%AAyq_4Sg!u{ucDAE<4e59k{WY@XhY!JP8wJMF_J5#v2c_yq{pG7}aPQ=__rUQ*7; zQK^1|BMo8Vj)ID?(A%|J=;vKM-k6t)U=B~lWK_(_y>wG!iEcdawAJ7SfP~nxMmclHf=IeB2x&IbJ~k#9THoLo z&f4_9vYBuj5Dy~!|JaR3@0|A9))%Ajy;oZ5@A^Cb=MHLCw}uqxycozpA(|Hs&Q$8-7b|No7w5F&&S zLXw@mN0gOBWEUZOZx=#Fl4M1Q60*ydJ(Cq>W^c*LUccwn=bYR3ob%W3+|KPBx$%Bq zuJ`MDy`JO#csx&66?0m?!n3v{@M6L=_CycYlJ*Gh9!YWO6`vaay!m0l&lF>vrHB6Q zn+K+uYP$PlUvcIR1^7wh>H6VYe9d0e-aEg8k$belW978QpMQPibwDKT%4gkneQ9qC zndq}k>{u}9un*;L@Ezg&$Dez8&ZJO{Vr>sfq_+>Y<@;P|Lf~E2Bkg_8NlLCx1rl-l z+gdQ(wSf05jn(5O!>AI`&CzE9`2!7#tg0CsOUzdn+EUy4 zQd{Ki{}l)!(~wI!Bu&4G51On-UW_CGo&W1nj3JI-M+MdZ&iua? z5By)22X4&vy-Y&O{WTMfbFop@SRm3xjAZ;J^b?vGRtVssWR6ugz3Ff|B;*0sO#Jg7 zX!GF6P8wYHx^`9Io`-|9O{2fYz;pF?ytYe}sD%nrm8T&$;JW)%7XF1Dg2h4;Bx;5u z#pv_!bScS#)P*>!`hNawj_0Kln|mhj$3nX2B6x@; z?NZD55RTL9Y~LSens1!ar{d~(SrK?m?QxQ)hZ6M7hp1gA`rsBA{C1tUE{&pis+ zCsZiEty4s`Uf6{5gRT4}MFCU-0lT`Cr)6k(b;POqdw)L@RfJkw4e2=u==6M#O(rYu zyn+zP)5bqcGX4w{P>_&UuUcZB^DdAk77Nlm6wlBOC6nl{XDFUeA^AjFf)#yBq(JtHasb=zyx=`|NkycegKh zuVi)PjJVXg*%#arpSkkETYqV_Vrkh(N0RNg)!z0sa2!B1-uH>dYZ-gnjxX!>4(5O^ zMqVBV`KPEgLyB{E2-;!y^z~bPs+v!6vOVxO&wYAV=4(f#>+&sq{fK|nkS{lyflmlU z#R=r$o|3fI=A79j~dy*s?F> zmZsio0XLi0b*=dbAqrc5xCb3quqW?dzl8K?m>r>=z}kbKt835$|5kLB+@KUx>8YfTA3r9*d(3|e z;S5Y;F6Ri0W$xh&tez^#UxpB}`0FF4@AI4Owy!e55e07FXleJn^HT@y5t&nQim#gm z$#0Dnn&SK}pFVRq!!BKagZ(vYJU)MhJx+i>S08GSGU_&B3*?HWjZG8KC<~SV9O<3` z8w&qirqZiRjKp}eg5<1sGKkW=J1m1k0P*zc_RRIxBt zNQfZeRX(wjTL0g;y2G<&!` zyj(NDJMOvTjsnl69@EYps&&XD0H)eN!riryZU{75YVp9OYODIQt>+AiZw{M%`uBTkd zZjt>RFT-T=K_0djh~@-x7^5FCd};GFMhp!j;i95{=y8|uz$HKd-ug#w(f9Gyod{91 z(*!8LJ}vuV{-q_Qz&SSAftXS1H@8so{{Ep=KCnIDLd5w-d?FSMPWA&r+mt0fK1(%1oKb&uZW9nOdtEQKBjc5 z)z;^B9+KEUZu?oowbSfds}oY0XWZpFBs%`uv%I8Z$WD~Bat>O{uw&XB@kAkhetvQz z=b_UZVwx~bdghu$TU&H$aT|UU?zbqZeFCUQG;R$T^Q3#vPP1aZkT+3Yy4k>SA;U@8 zREfp)`iYuB~yyYco^i=@{1Tqh#C5kasa~~KK$17#s^NnEh)m&6r zDMrjFHR?8Mh2I0|j%LPnsP>^~1GLIY_B5%^ox3P5u0O-)Fd>t43#%zO07#^0Hfd>N zT~5$lW>i+*8#F=TPunDA0#>ZRpfEGnU}C<-f3pNGw{P9Tq;|7!K(!1hQ}ajF*nIB4 z4Ipv9`0N_Iz}vT{pxQk&G}O>gcR35Qp0zSHb-!1dl`>fFB6JWUHdvySZ~u+5+%Ec*U6Q=~vgRpQolqB`4D-Nh)zr%0Y9a^V?gflg?f} zN&G4wxX<8^EXbRrhO!ORR#wt>c6I_0K+7B*TB!5J8lH5unJU+1o!z73mq#(b??KJ~ zW8`w7Y2$W>*jo^kK+l$PGbbyH0GNmwai3j>fz3zO)|y5}XPBgnl|M;5uY}6Y@WxHo zt58uJp7Z9E)y-D{p=M{uJ9t6?wEY+>Ym02``AiL~u@P8^;rHd)CjPmKDH_w%gPo>y znNK^lLe^Q&h{8O8Mj7c8IT#G94w;*uA89gXVh9`W=`m4ZiTFD6@oIrQEN-FbgnZ$> za-YsyqL2`mc2dvpvg@b*dwCL3fv=Z(1i=uMY@cB6y^_=5)`mCccYxUXtkvUVn3`12 zTDCt7=wjys#Oxv)wxeV8FM3QB*-g20`m3t<*L8Kx?CZ;Tx?yj!Oq1mVXZU+?8MP@AxB)1Pm58^*DG5Zjuo{! zwu|vgrO;VO_T3&rN{{37m}b_ao6VQ>D^3WPsB?%2cV5OVsZuc&+Xfvn^p%OQl)m6| zo>N`-*_dfB5`CXvnPG1(r3+2mb^3y>gs3U6vs3LhXH-Af5!lN04v+;&`kPN zTFUk|Oo2J;!v}c~q2@`}oABl-<oZpq^9yL zDY~ZbGY~*0PKbO69O$6(Ot>ibh74i@3g)wLI^;#2CL(H1peJDU!dkDG+}tbl+FCN2 z?d|V3>%b4~mKD9%bAxS@_W~%I3Aei2+v@@0XPQI%dl(E)^%^$pthUld&P{&!kc{47v~cEL_+_tJ%ad%(V;!`s4pDv&$?6Z-A)y_*$tv zZ&^?ZdRBzX&jr+YX+A|FEJq^K3hI4HTZ!mCMiU}hV{#Dsn3(WmF$dAF2xUV^jr=xZ zQe_5Q1+QH*ooS0^cA_3+cffX={GQ0Dh!3#}bEr9^=~=SH1OaSn|InIC0sZGIRGD3L zbmFec>GTQeODd1X+Op0#DHr1Y!WQ|Q`2d*0Px4f6%~c>5LkgYe)&H!HkI(h}qO_Qu zclwlXu2;JM?Z6Bd3j^9tW>V4Ngnjq`i7NAnG{-J;iZ?s%Npfm*-928WOeH*9J#@F+ z-pbCdOPMAv7|V-0b-7w`u-zXE=d4l8M3L=?(9FyXYcfkj18X|lNLn`REO582?D6BH zKbzr`G9)7trmx@tgf3foN);4H^i#{f>vfGJvLz0V>d%aHVzK^V8NwIII7G$lKYsiO zI{rn(c-Nwqm|moZN-gQk+1O;wK3I{=kA#Pk)r3j=fFB5Y9Yn17{S2KDv3{8yE(Sme z)0U^_L2e;$Xm|luL5MQz6z$5@n5BE+3J7z4x|6!PdcpkHx&R#80wN+Jz#vk8j4_|b zzb#zRxtKqz3Jp@1*R_Ht0%3#diuQ9RIVE|*A_bCrl|!jg&Q%mm6;xR51&JoSD9;D- zp|^1~8?-l%ddJ4NQ>yaVH!4BTw&-=0luqbt>9&|H*TQGB**_0`AO8Kg5z}Wpx|C9F zBKAA+!Jk1kMFH(v)Nx|1_T-?}WAR-)6yt@5gA|A2e=K^dMCWZ-tM%E`R1|MvVN8WD zMubs1s>of_)3~))-190nHW=EoQLQmd9x*cXk=KLMR0Da!+Pf?bhl~PF-3m|J^7>p# zGM*(>yvjW!3P%llJ<<~JO}zV^U%C+Xfr9G>QCw8?uDVrnL*6L&dtDXt_N};JtDz`8 zs*s<|Mdrz4{a*tnw{iWDi?vE;8A$IWs9YC2xjkfYce_$j=Q0NeS=k`Yfsgr5ST8CI z5vt9bHFcMhFA(oPVyN^?IUB>Sf!gI^2(Zc_%z)T!5b|F-AF1(U;Rz-!K)j*9|1vHv z^Usnb<=d(_fs3(sw~CaF|0Kq^3_P`ImJuTL?VY!qa^YWi!c)op^VI#nM?XzSJEczS znTxCwXMu(e8DD*plf%KmQP=faya;4}`U+RcsA-{!$me(HadB-FIXMy<2}Q9gG(LEO zF#2(HU2++}spko>&<8iOKa=#xg}797pos;6Iwj zv5a~$p$4j`DQ$*Q)OFZ+Y(Kg8DpC)%Alra~l1=er&|?TPg8S6~?iJFS?w^4G;Z#1( zo6nzrx+S^Vv(P>{bK%tlBXQj}gQBUJy_(zOYCbwzS}*OWFxAZph zhU|L7p#Im~+zcdW>CcB_BMXLmN~bE$*ohpxgYf<0qiZq6$z{!b%VvQqNI;i7M#!5$ z_~y-0M?fKk}1?9Jmn9{-?Cpat6%BI@~`pKsTC9GZ6>>i~_WARy^#Pwb}U~EN2V5b_9(XbhOj(n)rtfx@DAYjFnMM8~Txvkzj|>AIOh~AM4wiyyhJWx``Wk;lE#_i6R>C&(A+JDb_`i(rKt^Ju#&b z0hSivFBC8yPB%EGSPwnQTM#^>932Epu$qD5EvViISN0yUEyKb9yoYOIOu5_=Ne7?m zACi~h`XUfEa!P=|ql zv4p#@>O#yniGB-u5-2=xGg?kQzW<|4;qzZ%0BV{E$zmZedWU=6NDJf1u2Ru@tht_U zt)FCm=1Nk`APNUjZa8h;mY{TkuQ|6m6E~bK*c=}N|CUZqmz;%K7cQ8 zlCXUXys87J3Ydk32j=(=QEyDRinB+5xu@!CdPd}skE;U&_buP=8iTO22!#0n6r7JY z^2*L5o$+e#?b`58MUF*LI3FYiNza= z++_Hbe8`SO(UzWr$WzcwOPJz_&(%d|)Frcyq+K~*tUELMmE!_z{B2!brM46Budr&d z*L1|1P>K;7VbiLsk5tdg%2FO2?9}tid|RB&6msUm5~t;JW$n9neQ*S8x6SgG`KZvM z3Y*=RQmW6{`fTV9XS#vRw4*_NXFU)rnq|;#3EI0V?N0II^{-WW)hGJnnGcZtr*r(# zHYu!C4*`Io5K0+kJiwi=LLh54jN3?sjQUMh4|L8N7pl z(&PPIw%`DLap}+JRbSG(MxK|bc#Mdd7;YSZHS_&1FE1xZ`BpBZrl&I-_^dad-{Bd$ z`+VUT@b1a40^Lo(ojaR`tuGs&&;q!kTkh~isNx}^UmB8aEKu(@>Ce(^Yi}?5 z`LNn%h~Lb@Vr1#E(nCn&BX-2a#Yy+`);E#4&W|PDa6rI1{;l25N=EI&k!qH7J=y_` zI&a;%!zvV+lb;Xn>10X%momWcc=xf6jt(;oFROk%U;Jo=@?XtuIlsi~{W@ePRd z2*#!tve@eIE7-T;VMC+c2Ow!Se(q+I&EQ@>N+W6q0CB^&3$wFJH zw&=z`8Ols#%4AYuM~ROUCw`PA_KZknSf_jg%xzF81m~Nvz(x@mX&6Phy15DAouTL0 zfPArRR(AP0BJm8iPNAfyaQ2T_Jg&Af<$RI%@11x(vKagdmcxg-8Gd{H5+0hf*!|>7 zQH&Z&H{Zs>Ws1Qgkt9#jiCTN#q$r9Tu40FeKg1JPKKII+*Q|}q^e31S!a4HS02){< zITKitb*N_DLByuxNzf$hEa#9bI(59n)!+mTWi<#}8iD=i zUK(mJ#4!El2}1*VfPj4Bv~?)ogO-W>s^7)FivnsCsNcG}#JYmSpC0-26o9(wF1U{d zKmrKX4}M4clf@m}jVop2XE3Ope+1MQ$ls`8I~p1N;|Go$ZKWHZQw$hKR$F1`zM5WE z05;)J^A9GX9u}%dlJXT}(@1%mWLMcvCF=)h{v_pED`W<<}VUp~(zbMx)PAilE zSf|Mxdz43(QgVW|w$+4G6C5YSbpo z-nbuZugExGm3 zfm)kI>Eqo837KK2gb23E!Zl_##_^9`VnmoVIC&?)^!z;ZLm(J)*k62)gF#=-%-kF+ zG@|>HV~PPA#^o=&r*CsgdGTt8T&>@cja(5|f)=XCM?zo~n8GF_M?4@%!Vraz8t{W8 z0#?Lhz%r)6HJ#G0T_ujI9^^@GcS0Lg$7RSflwz0+?%WB21B*)Gp9%w-Ow17kDNf4! zr*jDPu0i4JNjirIgrdPFH{^h(Re=t!gb#RP(}+5~6`_i}KDq8;GsTZcu7X33jt&*v zN_3+}wM!s_LAPi}2oMQJ!vD$Rr$9B+2)5W)o7!`8xkfVWjSB86G@UJ$JT=4y>7y~h zuvs=}XvswINoa#E%7;wATmZ@=nU%LbV1#Yaku(hN80;#~38oMO%O$o9!cH^F9uf?r zh-2%8hLd=q)R^Ecfapx%*wL-=sUW+Xt&weW*4canzc>g!hF6(G!|LWfpfX^VjJ@$d ztzl=P{;?xGeqo{aEvm9oP<4-x{TOjaF)vgq47^uLP~8(LvfKFSsFD6PB_-vckGZpx zlT8^JW0*)DE+ieYWw}tzM-Rvam$&1l5~f})D~6e2}Ug{DVf zgi-_j!a)fKuw!6KS8u1d`z-$*!9!7GL%UCKW`2G;_O4M;Sjx-y`O7r?W&{v?tbtyN z@M6O74cinEN9JlHp5yJZT0lVc|0E48cj}&sIe4BzdO?hGwR-c}+Og|tr~#3l=RcK` zbNY?@(f(G0(hx5(9Mq^8yxcQZ~`->nZ+vd?YbTMVFJ7F@a6J*lc}b#hVC7h4G}c3+zhK2t106?9J|4g z9g&+8H3ch2wXy`+VB|Pfe*dOgL(idEG&IJMw81(4C5dfWoP)g)cc^v!M%hgZ`Wc0Ljbn6G>Cq|*=pvi)r z<(#-XdWYe>(k-)l9XjzDG_gUKz&ak?Ctv~qmbNx3Au|QnN4Z6~2rBTP$o0Iw}CJG2#K75y22fjjvK~ znf)yk{A-;ijMZ(EKf#3Gx<-rxAk)G?0b{26>qit<%qJaSgY@{*tF#UY%QWhbAEO}^ zmMCB`1;I3#5H8fyP>cJpTF@j4)#__&qiW$P1Y+(MI5|usUR=2Lh!O(OTSi9Dz#IQO zJmA0bk6@m_;I9j2jD|zE1FGF1?QyT!yntHHffg8RV`D=>aQWO_11u)HfCtD>Ku6jT5;b#(C5`q0aT z>h#yw;?$|W+vg#TOj{O%hcd-)-wHLP2l0lSCA&A_5YLdH+TjGgbR8IC{FQOSxpxj5 zIqc8Y;&Yr*fL598W4s|ZnKCY-D2WXMHr0gZi+>*c=e?()`|{$FO74}1(p4wt6UKIp zS57dP%<}|JJ8O27Ff;IxQ28@i88q<%2(b8yGPDv?~?wj91qSR`#YNw>)w$$>_-Q!%~B_z|M86`oc2OE`5AV_){{DkbbS>zh5whkN)!4|NfRUy<=T; zL(cgq%4eQl%Z8lDl zT)kr4Jbrg-ta%J9Jpc2m5lFZlo3J7pGQWL{*8iFk`_83x{5QF;>2}$L@t9jqQKUhM z=7|2$U5${Jj)&!MTD-okD!u!^Gw*Mn^Gs_{3jEIhRSx?5#hgf>qUnEr1MLwJPzC?* zZz3$Zl>fJV{e211XC|5n{~xawTF#N1<$oU&j@A6ln}J=XNFBpP5uS-1PN;Yn(}zt- z;*X_Pg87O4lBT-yOahyU)vZ5VGT*03J2BM@qIe!JDbi@fCXf}pKc8>i;W4rDe~6_+ z{3;VuIHB#5g_ri{@bU2GtvfQBlYHkqRA(KwFZ}0igS)1wG^}j;eLBGWmA`4zNe-t( zSlVyO9^*9upe>^g4dxx=`8gE;4;4 z2wWH~?^7CJ4eRY-YQ}#qsjrT~XPCGrI4ND}s6DSXhn_?#VqtR1q*eR;PZJgW=Jxog z%5jtWI>|S5)X($*i$*{?XW@2B&)PiR;lss8fR$*AV(AEmkMNM*AO2*uI~-;N0CdJy zLF#n05<~rg@vnev zZjOIWgCKEQ6oQ~UXC zc6yxj{k(OJq>`!`_Dp|i37-o_-iz-3iNO^6p1do_k6@3j@7fE`+;Contom-Uav7A9 zX-M1)i8`*NvK^sxad&Mzu*d27Y(Yv~qQnsb5**3sdP(xHA;T;*Nl(&~{`U$=zA2r? z@i&Jqlh4*{{F;Z0i@Q>h$uYK1(Fi&LXDwGzyiM`_anYKVd%Qh-q~j1LB=HPO5V7}@pe+QYLwTMQ}@kB8m<_sKeQ4nz6J<}^O8 zqlPKbt^4awaxk1GO&A#*VhSU*X7^f2f@LEF_hck5UFAgV&dSO2*sXJwc^qFU5Eq|9 zTc+QBYv!ue<;0Au`(o*pgg8HWNpN|u`OL0QU5Ub{GctZg{yv$YAP0w!=$6;=YEzLEi9 zh>+D3z4Jd?LnhB6dGODsyVm3KT5obVpXyR(TFGi(t1k9paYNQMl1+X$xj(Vg-D;So zNyL%ZG9H-xvZ=(}k z0m2;-gcR&k$nXgKMO+=&+iqA#2lC$~d8?|h%q|4lLEQYG`=h8-4_0{XJC4zmEK`+; z6YXiE#>{ieLpJ$zDY;xe-`{0S{pLTc!XMmHq&}T#@T6NRVyYEP8DOef&@j@P-}>6! zFVM0q#Iv@7-2Qmw%HfLr>g2{1XUE>=iXP&+3@q=Ax|K`Ly|yiB*|gOs(UHG-PH+L^ zd8Ai(f88tbrp6JMcK)UR-YJOth`wDvEw72ycZv(byNe%;r7<#K3o748JG%A}8#DqY z1Nl4?>mJD3Y>MP=yM|xj_l~*g0DK02rGehzefPuih3g#Qf!=d2jh|GBdq`YdSAq#~ z8GhoZ(GeT=^`6@^u3L_b&(187_@C3m)GOdLhKf=*oKS_2Jc8;8dXC6b2WYKRUW=& z@X?wFBeOcr7-z*q6)C$i1I4lv;Q|tP)Zz!+jL(uD?FUe zt{e;MzL(Q5;n*-Ui#onG)HzTJHFM{wE+p>NrHnIg;JxpkS#JJ}+^EWIQDgaF+g1`aV8nPHVs z_z98!y7Z)=Ke~JcNuiY}G865hb>=rRJm#&*L;|xcn52fbk--nvgC9885?1ebULkFC zpL1VtO20mO&Hdu`(s*DtiT~_*j_)l&=a&OdlQ4ARe3(xSrTHC3Nk!hNBvP3lQJZNc z*C)78$$jd2!2nSsZ_uEn9+lwL-}AZK0ls*I@vky35p>?+euqSNu<*SMSYXi;vG~uY zDj_5GPjo{OP1>VdpY`BOdXvSOW)ObkV;a=c2!tB)02XnEB76i)tVvkE(#fh#sNt)NMh z=#UGpIsq~hy#1V_Kr8{#Hl=yzj!XH6moK1_4f*!3ojqJ!T>N*hq2o~M_qH_vppyx) z_%lIJPXID4NbZePr|@}vB!dM1rj^wqx%<`a5SYIR<@-j%$mti~zTHM!fok)mY^-zw z^I|?(`JFY;8ZqlgfhWr196icv{&m^(kN)K`qp zhgp4qIi^$VmJaOGIFL#)7!DF&O^W)w%U1c4tLe|N{}{={2agLT^@6$OxVRWCZPSa# z{=J)pTy@1{+S5@PSOo)DY-s(<2bb186#iTe`^XTbG^m6r3@bf|NR}SDO%rnQ_{Exv zt4pTz*c-p}Q2Ry%jmfw=mSU9c=GuVns_EVULxv^iX#W~|QbsBINe5jCJYpJu@Jf-o zx~#lcOmjN;IW)|nc4^)bx8-^Kvg}agEFs=w&fNy`IJEVCb8M*H%{{0R4=1|KMu|@Xpa=?ZLp%6=vkedoSw(TI4dAwXffQ;(J_!$7no2JUXO%F zt`0*W`h$DqQ2wEw_bZ<&^lng8#LorVnP5%L0JvCCo9S((L4nKsXQ#GO2-!14sU-NWv$#a$$L;MXFU=EXr zsu11i-BvcJMZ>H_6h^pt6S;Xi^C}024C`6)0@T0Jgf|o(ke9KsSf~~Peb@{P(Aqd= zonQ*+8q7M!cYp;kp+qF$@C<4=_p9QRr!TUzE6v1&-{J@Y?aR8DwDdTe3FWzSrn_sC zKs`{nM)$RqE#YBfIX>;Owz86i_i}w#Ng*mKdN~8}dc8P%936cyI26^s&*)F{7?Npd zB8==;2)|usFY^N4iG79wt^@LHs3Pl&Sx7;<4g!U91+S0bnf8b18)id>3PDL@WdFs! zYzmGbqn6@OruAciNQss%M*ytkn4C-7^`5}SpdTa^yP~rLUkL)6)$+{~sWA|W)wm^@ zY&H740BhbS(-D|a$`!YyMkfa7AYbl?*?hO%qboMDV8C)aQpMEtA~eC84_&RjGdH=l zy|p4gI!nGN&=yYiY+sarLk8u3ULe7u-;a2)%tyz>#B4u#2anF%O(~#_pks&PKcJ!l z2!yR`u`|kX1MzWqCST0wVoh3Tf2L=6Dw(v)wV{IQ+b}4ZXDi3bfE}sx$0`;3R=FbN zXE(t1?tO)f71X&GD<6t>vyA4yHgjhEUdfIK;e=T`RF>RqNsO0xxM5K(kg7UopP4G& zq_bCdVm3E_BDP$Xw(;{ETLq)3U8Q?R$3fNK zO1eEIVz!de-Rv3O{(W|V1n(VYs>u4{DZ1>HpH?{^u^Z>T&z$%SHgqV^587GV zJ$iJr{HOv2_@Gsaz^?%Yd-W_g{h3CvR-NCxq)Ua8PS8w)Ee$|dS#$GuWT(vzg3VSQ z+1Zu8dtY^K6a*uYc?|tg+55(s;PVFlOSPvaRrd))5zh-kHVG?KPJ10(U>p!x;XEHM zBz*1Kkc4+ccsOYAt*UH4gET#_z#f`@BCYetX4oI7jHTOW7sN#0pgVo~w2kkXUkA5q z9(K|~S(b&Jz124IA%wf@T6#^5 z(bsX<(P1E`zCQnJ_v~T1)4^w3^rYAdlw9)IsGKW*la-!QW1zc z5e8yB+xw{~7@dEgT$cGl;i@x`;#?2LR{{gEDXFO=#7F>?a^o5*nf;Lh<+`U|Ufw97 zs?6K5^DXt-dbI0<)ZkQJxpX!x?aiBdp_&b!=Lr2f!7l47-|26Zy0uBCx2Hx3`en}* zQs`N_8-WLbtB^irx8+5q6f}qLUoNgMa!X(G@cXI0< zX`UJ~#7Cx!L%VnHN{mnM<$Cyq3MjDaw*al7?@OW$t2gP=qKCK?+enN zV<@3??0-mDgg8DQ1FIdOI*SawUf~K2M>(u|1qeFB)m} zim-wIUBq=HBOeBxba;MQNfQh)4V`x~oY`EI*sIX@eQ|+>{O4XujM<9A+_Fu?=-u|N zcePHm7PVCu9&D$=M2oxRp=qIpdn!6$tQE?tg7?#jOQ{5G{VCwnu(Y$ge&a?M*}WLZ zHz!`Y+QYxCt*?L$oV9mtc{z%Ulss714fdM9oLbaeFbn2_QbEIHAGs~w&6~MWp2^glIU(Jf!9~8lK zi4joapAk||kr<*9jU!C_gnH?~o0LkW@;$hI^G)Pj`e-IdWx*^2xoA+{`FhNQ4IYw9 z1ZKe0s%FL0n`&sLb}h@o&wLSTJ@P{Wjcwr7vxH~WR&EL@3CMO)hwem=w!C<8cElh` zfw|PReh5MN?$S1ES^GJ|oNckIM#<95?aP`_Mlb&OF(y2_-lRw91Za}DHJo5)?tLFA z)Lhd40HIZ0mKWo|7NPiu-F*gXyQf06;ecO?xny}z$eQ81L99x~^-oDWrfD<~!@K#fVP5g#+-Sv1iKrSB-X_dp=Sl*WiJ?dDCVd z?nTAj&AWaD!l~lW-Ue*~sE}QA>=1`$+q@UjwXkH>zinN6%?J_h>0ldMS8IKHDT-tf zX_l;1GuV;$L=~-B(HxVW=+BL}ys8ur-6=!Jqo{OV?q*tDN3q)fpJun^f3+mXt(4}GMO5r zN8lv_U_AP=u=?qMHHys|SVc~}A=1|W47O!Jn>j#{ZiG2~9_WUqb2$RGM)T_)O)ZE! zwV?|+>aBb+Gs)(GZ2AtU{^3Xnj&}xYBuYhDL0TBmmLTTJ36~!Ud=m?F(X`&HD+<#7ZA_r? z;C9a-()H>Z5o)1`miED)Ok(q^fRM^F2r3RY;%l4e?5hLNzXCDTE#S=qB1jM(5gA&fSdZjI8|z0awXgSF0+v$)|d z&I1kyhr8>gI}kp=iVntb$s3nr2h{o5HVq^lcPq>|+6m5A+lp&TuM8G7mOTCS>sQc@ znJhsl(V-w4$~d3PJM=^D70GiO*W^iR@mn>5CsEKjNY&4@qWJD;l%ut~&U$w7 zJ1I7QaUGL5DLS$PIgOJ~Rf}a&UML?dv_GQ4@OdQO#$q>3V=y;ogO8*umu6@lO8#)vood(Wbq2S>Id?_`M)CAvLu53d?lSN3C zg-?Vwata#Xe+O8@{<@Cq4B%4v@%}PcQff?qxney^=Al+I@OGy#P#Zz0py$6@dr~u) z1$sp2rW&~PDhk<~<=}t63=a$-vn>UFTUR_j8=-EE(npILf2Y}tkMErUjfLjz+kqh= zc&e#V7c#A;(4smtwIUb$-s6NG2-F_@u0jWH3fT-|qFQnOIwv|DZ4FFATl_Iu3xs?+ zhdT&zB8)c9)%pqnmIbl{ieA95h4PJ5dkVm|fFgw#l~(~3K5o3O@wUuduYBu={<`$Z zrZmbH-qCJG^?9JVfPP~8rFg*9fqa;Rt7wMhU1-(EhN*iHB^d$|BeW5XmgprINTEFk z%L@hft&l#pqF$Kg{*zr{4(hNp@*%|a0MKB5Rn6vuB!q%Z)qi0595(+@4DSKHC*P0$ z{y#U&D5JZqh0i4t=qVBP%mhNQrvcT{l)5^*5?NcShv);M4QB4t5Zw+$y?T z+BCg(9F=&A1LP~euYand3(uGTE=beMk(Lwc>Mp-BPWr=fLQh4A@RR0wy=%AL+M=a0 z4&Wq2p-tX|q|GR6ZQNiH4}ppRx|#ufpd>E`$Wjr~C3N0Ba6Ol`GBKeMA*|eB({v66 zJE84qXv-{tFp#2?%?*6Fz5_H3&bW_FY06>Ypgx+Yp(E<->JQ!7Bxa{3UShPEhdR}w zre}cF!#EEVt_Na9WcsOqf@rZV7_gxA0hDzBJ6eXnpPdJ!1<-0w<2a3yf>-j(u}}6= zPe52$=rAdV5Hm>7z(o6q&V%xd3>@${qD=p2N|PXsNTF~QY$o-^ToPc82>}ugbjLA} z()|1x83yHPkX_elX-HlYI`!)xgauND2XyREZi9rUWfhRXk84ycNnwN(Y$l*w@mR`! z|4(Ze2n19ZQ={wZ?v9|c>_&h|itaa`?(Hrc_Y<$#E-9FVA0VS6X}QmL2mlZsMgkl# zcY(}aLwNuNDr#zKNLEb2k3g<4bHSlBTEqd?7HG9zIVA0Yj=&HXOo&T^2q+WZ$UoWM z|KXPifaLovIY>@uz)L1@qSUl85>1k{lrj36^q zwsn`&jBSFGOfg8OxB@aUr=D6ti*I;kf{V&R)P(!kDZfh(%vi-!jaFBweI8XEPOI4? zPaTso4o13EZ4KMH(n?Cc|CsMuKs?pAwyHm5Wsxy_onbuvCw~Ppl~VnZgGXb?yN>sT zg}fJEMKdKuTJ>eV;}WJo0k+=?Sl^8G7o~(}LT#B1S=}<9%NRikWqW)3Z zTuTj|IP5G=uD+mmG|(x1g{!i-o~Z5pO(ytUWU6=W^twmTEhX}gW=Rg<&}@ow_Ygus zxE+DwRX~%Kl1yR_sP)zQ*5;Dzfo7&g-Eo6^a*<^*b?GCQ!=qIMAM=!k58EQeldaV5 zCudV1972=&BtWNiV>2(6~WE*}MvkWmItYIkJ!9_{!PT-*M zKYAkkg{y+oIYhwuxCnGTBZDY(lb+IFTcoS1%MV*SWSCFkB3Z6KEetCJDL@NCZR~R~ z$jxvdc;!@Bhs>e$78I}j#y(k5#hLBK*qTX&i=qe3HAoccz1iy{<-CLoX;7lrDwgS=re) z7WIGG2!#D!%)eU32j;32o9LDW#Vpl(>Y1$itDtFs&D!9qsF|`%+`*-xhX!4HNii`9 zOBX5L<9z2IH*!R$O5J**ayF{b{rf24(HZeXz6W@y*fq7$smi>5*ThEoIu@(b>({B5 zW#&>R?W|*~L(q!S+huf^9cpa|e6Y>obwmd(hS41{%e3uea zFOSu_bLZuH=HE7=Gb@5ZBdU*-MJ^SQ56&|l0!(cJWkb17@3Kt8&$2~?efHj&3ZhUa zn|j20wjQk2_#S?xp$X}o9-{AVoL-**#;6`dCbr2yIC(6*dBO`q8JLZU_TzVZqx{S$ zXn`^vScX&pwPu4S$f5JvKq!ZHPC@?i?!5E~68296A6Rr+CVvC#b;_)uy$ zDxlA4;rV45R<%tpzS_|seY{S}WmHY0A-Q#@A=4WLw*7tO*3q!dd-XH*fPr&lVIGqu zj&z0nqUhc+b{#zE?x^TS1e~3FfBw8${W_ax%zITb*=^V=T^ix)IGZxay3jG!0vP~0 zs1O9XQIg)<1S6-X&_520swE-kQTmj0{9;)BZbRnX+h@;RB_YN(&`X5 zBYU?O;Ei~;?8_Iqh-$(+P=qg!O;&cl@}3UPatfogjl3>(4&%M;pDtzc1Auq)=p8)B zj=phXae7ap<4;T1eGmqxr!E)>U;F?$j_Ig*v^h8jPW{+8%2wi6eu>V78CFXCRG-%k z1!ndX@aqdzE3-WOIm~KLtBq)DU#j+=6|%VJUbd;#`CT=Q@p0BDfTd9U+W8^{p!sQQ z##i(Gt)GL37piMQ;Q)C10K4fxU#bks6hiO!AB~B&CUm*$N8JwFMxRpWqO!7afYQH~ zcD=Z!#WpWGPx0KtdJh=?reXEB`mJpRanI*LOxa=kbm4G#7=coKL_~!51w#^66k-CST<>>1gc+1GG41q@`4h~TZ0e4GTRP3>z-Fpj>-3hs$l6gE~ptpg|n3LF9cu;}qq>$&38%SYa}ocL}L-lcozrEJH8Y;+4vWQ*>|V6`R4EoYO` zZ{2ZNXyV`ag*$bB0swNecSo!JxKe&$&ck{qjS9 zM>gNzor%%-%icruMw+RS`V4(OK^jeU#I_?mYfgg);9@ueQ2U_UKHlE}3K|mYr$9*z zhwSf)c?K|-L8)Vv#qk654dIQ%P&r=GAke)7a+;J-hn_$WCi8g15NLfs-m3qS=ld$0 z?=29$g^D`Q5d_>DThmCfc#?EyEP~is!b#$QP2fosS{kLI`n~hek60dw{&sMXk%Tsl z0QcPK_z;f<=rkdV`f=QbUK8lvIMb$yxzECDIG`xVNtmim7Yq{Xbdy<;^U z15~2h!qXx3F?|C;E_d~s94hcer$OwlPdfs|N-+5{7Y~vi;JU#om-@wdsCAjURYw@**iZ%_`Kw$$k;`q^T_rZ@Aq!4Ma4y(?$Pi;Vy3hrl*Hg)4z zK3x8JxVO0u>FFC7T#e3U8ElK};v>cZ-j$nDk^FuRY_CvH!e-+B0-{FP$c9Qy840tx zinD98k;`g;_5z09l<9-KPj)&D2_P491YskujbBYa)tA(bOQr+7#82r(&!W-Ln8!4U z{z%q1sMnyVzXs;|VA$iBFCnbV>eeOtxAUHG1S4QBW^h>l{TI#L!nD7lsY;Poy8YrC z%&j!toE6zstxDhd3nR~Um8kGe5e98Mv~qIcAZ$d6e_L6G{Tn85xRE}N?&J_PPl4uv zDmuS1|1ZN8h)ZN6Hwid(1hfXJfh?_uudgUPFiBm(j$Qw^VhE010DtWVPc1_#Imo7( z>iR>^(#onHcJ1KTIAP5I%tBkyd4;qBfLm`K*m@ihD4`898$br`ho4e*%nBhy z6Rs@Jb4EgZtLJq=CNqS-40fcC%*&J=Dd>v&&`egE%5HGO6@sI|)k zM}MIPW_xcJ8k1q6w>N%W>g|PqQQCN4C7qWr0%nG`f)NWr?KqFnM>+`)UUUpdQk_>9 zB04{T4k&>vcr7ONP=TNgY8oEhFD!GcXwe!Q9B{Bb3`*FYEY}`)JS+i8QV>)&P+$%- zh5fO0x*o1A4E3FhVN)w69P*dszuPB>R^m0J_E^y&LQtiHk^sO}Qy|A^e0w7X1=}Yf zy=(=No()-&y5B^A4rzgjoP6jL1&vF9*U)%k_eWVxF!)Odc^owJ_yvF{_Rh=f98_Nu z0_iLh1o42St$9d*P@fkjfO5AyVfM@(>sJE$o#H-Mi8(0N%3*E`T3IA_m9*?(LVJ!v z%Nd7e-lQA2Y^0Nihdu}x))S(7M40A69(f%C>fhCy>gzbDRUWU~FI|w+hI#ED`9Xye zA^SmDT~FUg@A;=WZ-BT@e^JOKbK}gK8~Nk|Mg!Wud`W0O2ZS(kaS#HC}RBHQaQSD zW6lnv5R~0IeS_>=fNyV;Q)00NuP1hl2H*F9Z@mZVb#u&szjxFIXx~td-hXh{s^<(>)z^OL%c0g#mU?EL<8@&EDCce*@$Q4 z&PqA|F!obld4HU--)oGKBSYMz-i!5m#+hGIi0v@{=N|s+f1grZz_=xE&rasIVy&(2 z-Xm7ZB@f{`jMn9hD5{gfx-%B^v`KrOPc%KgD?UT1eKT$&w(mtA_IJf+^qG;X3)gH7 zl#*)N%|&nxDs1#9T{GWI7mI*I-aJCY&F;F=N?PaWXj2ygf_W$xEZsO#n|+>j6M<;8 zb=t90<5^qm2+Kg?DHqR=G8Nsg$=kXf6sKwIwaW=h#vd3yqmL6l{dPUglSxUSWB$Lc zn%Ge_h=QSAHkwua%l#~yaVDZS#SUCbr^PcO+mVEg3`_klNvCu;sRu2NCLWT@BIabp z)ZDR3n%U|FhUfKUVp()&r;CGw`h)_Wi8q_QFA1UltV&+vk}_)N*(muam7Y*_wH>=y zLdwZ|hVMwE3Cak!>AEMbFAhO^2}Wl|4i{|i`joF<4Y zSh)}vEdPrvS=3GwNh-!PRe^hz9d;$<_$!!?sue! zGv&+@m|6nt-w0?ud%j>2ZR4F=q8f=C?)RibCga*}l0VNaaBksFmNjMDDUi65TbD6g z630|&j;ts6J5={>gq^@0z44zL*&%Wznn|#~<6GcUMp<)S(&8JQkyQ^Up9NluIW#vn zj+yWX_PO(HQzV94Pqtm?By-It-bY*^HD*pHh9zBQx7!&lz$odP%JX)FExogE_J=X4 zXfk7gF{P0DXP&cwr((GI0Kh`r)VVGF%U!5vSnWk0B!23&d$k_Pg;KzXRu znNz}uZuT&K)tOA^d-MDDyZug;d{OUW`;=lEs4paO{4}$RKr$jUzYq4Bxw+*PxeN%4 zCiAD>adWPZOb2^~k+9s8kw6(@iH`NZ_HhK~7qh;jU3Hh3n` zOeOVu_pW~W=#sTV{qhhBeScqHUz|=R$aTue$q9SVLVXSp-Vz@O38GtFd@XM{ABr$T z^ANdfaI0un7pb*@Px<`i%hqC2hSN)r!ah{l6(ECOPzNQ`k;EU_=UgBogN8^JwRdGw zn~A#K>nqJXDh`mQ`NJldlUnG*WotqKJzoO4lW60TpPpO%`@)N&ZpY)w&at~3Nm0klSFBS}cn zwr8mhDMEUBqYQeMM1uA!deD}^IG^N?^izfL)Xg`KTI@$+sk06KvKVxyWdWaaBJ`5< zZ$&hq`p3t#=e3vq7CgFiPcfdx*dq&}R>R^k#__W9*4AuL5n!D_L%f0kEF%CM{3O3gajxv)yk;rt8#TAFj3$xzPKgr<|YXD(9Trn_HFtPC$B5?XZP-Pc*oeQ-S)SF6DtHJiBt-k z&MxCr{&KEOnid2F%<{xLz0aCbDfusRKRo$b4N(e1ylQvpgf)6xs>iO=hYJ+B4n3;b zt3nKRPTYp57@iw5tgct%3NI|;EbagfSZ%li?soY23Nejq%po;uUlhc&Kmr6nzMeQl zL{w!x^&XPXS~@E~GJ}&g&D+m^!D}yJhl5%%_b$N`8={kqRoBppxj# z@Fma@Y535#TPJT`HW0P<1c3rl8#^s$Zv+rAD7fy6uO{I*H*~s45EBfCWv*pzPvj+F3fyv z(Gre_CtZKdh3UZyX=8HYlde;D&);DT^lkixkjs&fl1ab(K>sS}6t16dV%0Yp0>41! zOO5ey>9*K71eC3TbEFKEae0w>`~wDEKf_jU_2ed|1jwKL?Ya3NyEbp}vuJi~1r&p# zkf0E3Za_%M^8~DdU2r^sjy=sJH>gQw@p}{aSxD6Z1qXMOZFv%#MEfsrI|^Vj5VqOQ zgSmhMsI1W=K)Urn_N{DyNz^@o%u`8`5WQ!}l@GT5+}zwWm-$}6+0=pStvw+)iY3b1 zeNdQ{^$hH@LJ8a>`bK0XFvCjR6Df8r=zu6`!Tpd`As-2SY31Djpt9DI5ZZqWwOgzx zNBS!jIw`M*DoH8`pU=VX93u14kXPD&s#gT>zki}rTjRR$$?DMg1>{{qoKWwuPkA0B1rB6YI4N)O zT3cUB6?1!FOQRZetHX4BCR$T1=*x|-w%e)EsS>M*UKjXgPp{6a((Hh)3~F#Lp`UO( z&V>ur@v-T%1Zvkv;2qfE`hUTxKuC=1)z*B1Dn>}&ju+3^S`%7wEL*$`oU};j(AO<1 zWQ_0f5reV~lEq2IuiX23i=nazA{?sjU;M-Z693GstSlwzhhtSvB|a0?E|wWJh;U_! zjQ2ny_3}(LV3&MXY;UHjrbqv*M1P`;tKEM1k?Rn8_2}``$9WRAk zz80G8t*)*Q-`S5`UT}Du&KjJ~+L`i6hm3IL_&|I5CbB1)$=W%e0tbj2u!EUjP8Ro= zGdkX*2tP08u{w6K_BWN37a{`Ou<7o`tnFldG6)D21|X;6QZ>uZ+MiOegqqlQ!k<^T zdx5rZhF_bc55Sp{DbB$89xOtQ8}Lg;5{<845*q^|Wj@10x^$`*vOOG_NeOzkzSnShx0CH`5sDJNX=l;(II!t!;mVjHK zb*RkzC3uzy1e>#0IKaCI?!6m}+K%VAR~`ud<(5GvJ2nA3K9_t)$Q|3?Joo| zz|8*8DL7eK&gqU%;+1%{EY}D6bkNX2Ru5Of65ylUKXhWO0%X9+;|mXhf{fYSJQZGH zu)GO>&A9P9%FQ}7t3n%&`Vhrq0WNbqnvssJkcTy1yBp+{jnFm;u^O#d;W{@wq~Yy9 zKGJsvA|I9D4S)hx$@t-iK-bxbGjEB}C*{kgSb4GK^W36tG5yxS1GbmD_^{y+iQ}eB@%M6)??aU zRdY8}7Kl@>t0kN{d^%`$@eC(oSF}Fe#t%=8t9m9yS88v%>@Q59D_R;1>yp5i(1gQlamntSv&4m9 z1FPWU^6i6c+Aws~q_aLg(?h03CO>k9+UNIoPN}1_>tnt9t4J+TyJ$XO$1z$(dB8MB zP!+u00+pr#)6VF`^_H~P^em~E^I@mAfeuC=CWRp4hBOp?Ni^HFUtgIio2;8MJ zzO@bcm*HdmFrTq{=!Q5|BA@xqj1X;--)iD3s5gFrxOVxoL4`iW1}GIQ<2DM?(he;iV``*X6!#+!LB`rU z?3LxH|3iNmc0q-%vW>;M@wU((O3`)l(nfW7<5pgsMg*EMXXzubx)8TXb!DpuehrTj*yOgBe&!F>apil=hY%tPu{RF!v9WxPw+VO#mL$=mmM z7kqRVUi$pWsX@H$W@J|AxW}@f*Rx)7wlxSa<4@Sac1p% zeuQk_k}6Zi!(R+a@#~8zk4^I(3F*P=C+Yhn7J;mvPy<$PM24A#7kZSYK;s-zNJZdxSAX5{2)XdZ3Hm*o%2>C4@ zS03B8#ZVGhwUY{sH^W>`gYHI90IUJOg0@eCXwX&w9nn0VdN4$C!R_`mBolU`H?4V{ zSrCAHtrOl$`&g4Gll3^IvTbSnf-imGHcg{fYLA8K&z`*wFV5=z9o*c}iL1BJCG3Cy zNhw2uK2Hn&vobpj$)lo1OO$sGm%XSPHgkA#-YgIoCSzY5&l7|&J}!n9V{ zadZXm$uDwx$KA|K7t7XQgU5jB5xSJaGg9$xf$vuA+oAxMe_b8yGkVKkp3cdAzRs{k73EzuW3{h_0D$MW^LPr{6b zHHB1EUfcw}IV*gMlM{@X9*sM9$j)b6uGIC{9<5+{s@1aK9kHaJV>DAH7xXZNLY1hQ zxNlQ2Q={ZiUe3(3p>oll@S&AG%aGg7qL9Y_?j8J3w0A2lyXA%s^3Lppa>^RC)$PSN z)OVl=|Id90bBH^`RrQ3us1BXHs4`-;e&7D&xl1i*M{cWEHLp*2(9<_%)31;|=b6FP z3F-~sdEE8#>JpE^d(w{kx?1HEcdlNL7hPtLoGM^@q5MvN=;hwW(tInUh~1fI{tH|a zdUnKdrN82;ki@ig_q+eOvcsqEF419~OP>G*+lk+c+6_0a#spW3w7t04+?~J=t1}@8 zCoJG(6u~s$>a}_%dolZE!T|eJHNiwy;3>Jn@2_p#Z;>?8UXt^2!30vKx)T3nSD$cA zz^v+Bd~#dA*}^EnF2bBYK_x$I=Okj`A5ax-PDR5i%=w?I=%aWn??&dNHkNEm3BAqM zyi*|@GzylJ$e-RnAB%)Ghcn3j$<+YG9I94&1+(q7MlS1zZ`T7~63Yz>nUZur#38va z*%vZL61O%%DxAqNaMvdIQx?14;$@r@t7l+rRF)!jaa$}qLAF9vA(M{O&uxX2#gao8 zxmJd$4p|N_gT=r1&xHPa9SAOMDACTZQtGz{j2-P24dUBpMcykm5w$K*(!;U{oez3| zr#j{P1o*l{2V{Sgw?xC_{7l5*Ax#+#V{fO&RJ)sjaA)3ybti|Q=?NQ(BY&IMoZ&@ zw80oZcg3Cl{^|V4A~dW;Q%eheBl+V?9tAX)&4v!oXgXL)DFFg6P3k&P7P3Etm9*y%Hc^6B9YE1XGmfFz!g~nOp zw48iN1tMYQLfzO_Ad7l{cIyKY?eps@H~N{1V0tbt9jibW;s~t?450x(c4N0Kd5I2R zpt&yFB+PN$i)5<)hMH?`)XyPI%NK@r%&Z6@B&(^@$S=qBbv#{&R1_sG`BuX~!8|@4PTciWZ0r`(=IK$V2l89O(crS}er zO4Jr<;|Li~Pm)RQdE%f7Mpu?rbEm1!M{+NO@DXR6bg{r%twC<{;P)8YxX-to-(+^1 z?Lw`ot$pKa3}ejARypU~q7fv^%3<5snJQ5y_JSQnS!l;@rlf^eF!dRWN#)UhuUus2 z+9Rf|ZXg*)M=hi+fOvGWMIV+iKDbM?kC%Djd@KhQH9Es?AT(}wGDNTgLxL;pe(v}d zfAcit2$lA4F?;PxP$W&fHad9}3*sh2`Gj<%z7wUdWjsB{zt6jY0!YCRlKXDrmGO|UYz11w`gI1Yz-4ZtAa2a1qrz5t49 zKg#9zcFq+l9W`EOr5s|GJUm9Rw{J(4-ffmQt-7 zFE6!%_M#J31zGquPoLeGh+0+Cye;vOHY835yZzK8PzUNNz6rIq+wwpGq|7^k?hE=! zUee0fX+(=60A)l$7=l<&)=NTevjx=F)Xwb;C==W-bhMF1mgOUtmWw9jgwv zM!>tA%vB@AAh#7Ehc;S8hCT4Uln7)t!*)K0^3fG`u<)Zlg^dutbQ0KIA%m1Uq%{0! zznSjnJ&^Jx93c=L{Q^Xj5%u2t3cbby7xZDrgS{Ay97FRB!3#W}Xj2%pcPQMjdv3_^ zF(+V`s2~eXo<0D)2tD4MK=sxjc}u*5Ty2%7FlYg6&J*^Y3_Ei%HyELi8!R2=i$6l!ThMq!`KCHnA zo(5WsT|3_GbA^gWUFeO7CXs7PPl8%@#`fTsFVM9GK#P}SW#IDH2N1)oOqZi89k`RO zQWWVXYewa`@`oO+7qsQy~1kOrs!QPah%zEFiA2 zK$a=1!9WEgZfa_3e3Iec&nLQ1lGEa}UaUMAs$e?x8%^$1gO_9hGT%TQVacqJHDK*E zIe+8Y9?9l>pCybjYL77|v$7G^)C-qt{fW$&6>tJ)7okBB41sQNhg@u>3G~y}udV;N zS>WJ(hMrV*6sdIRJH?Vj+!YsN^&EUJH`2}E(*S8hW3R&o7xtw_D;>gG?&zl4jqB1@qy&S-&QDOsYaa!93dZMi6mP}&AWa8opGly znuW2DU}o;U17l+1#ZHS}zW1PsCTI?a+lAnqOX&P$^hs#6LKHj%5BFCpGZp|P4GWsh zy>oTYeE|cOZYyudH+==4)?X31LW_&VlH>@%ZPRokfV&zUE^24+-4a`PZH2KY(*^LK zk`s=3&uJgAhLCfnL&G<84J>(KRo(we&G_F(By$g|yH-e16(cx<85x{F%n#CNF;c?T z{)b=gYNLtos9GmfYR`(E>-S}vwp9GrJ#*ijQs(7xN`vCB`W9EYstUjTl`6*{?^kWk zcagd+XtsNMbsU3^X!No`1$H&~p&}tMi%Gd?PC`C@;3BqY#2s8i5)1QvWh(dOVXXH^ z8y!OZ*2w>E!f|mkVaV3=YVN>~SN&=eM7v0tjJIRh2$dx#VdcmPi}Gvf*n`Dd4VHh) zWH)k{j;0V(`D`LW-O3?CWo;P4l-12_!r9A& zYe>d#G-0YduwzbOfr@`oX3?RhP@YwIN3w%51&Vr*9lnTF+Ah#_IKOMyX$!Em%6s9_ z19T}becmIz-(ArqF}GJ(w{a8QML@(m0v-}LtGnmFOpU|*1&<;BoE#=H<<*B>m9f?J z8zG|*jVDL>50HDFnostih50oPXVVM-sQRC{Fg{6`N~>bJM#MZ`|A{DT`tBS~`q)>P zz&a^KY|DwhZ$x{@6p7%TDGHqPeS*4Og7oVc7cKY_;_0nVr)SCPNMW2vl+x~eWkay- z;kwtoQ(+uPkaC-cR|2=ypC*eByTthwqUY4kie%sE3-3Gi-K;g2%;LF(D;+J$(X@5Z zGU=(gE;RWe>f21;PH3uKssXnjgVrh((x!Ih93cRK$eDL_QNQLUz^;J?tzaY3t#&rI zUAx{@3RO)Sz@6wx0I>?3ub z`_Ae);j#B{0vKptAA{-vlKd~oyTx-kw6FBRHV0LiAEe_4ql@L}A%yvVgMl%f9>Vp2 zxk?%7*tP}8G&;>zmpnt^WpG8Zxo+J?CwsZWWD0st=JojR99u@Na(;E|xv`@v{i&1# z4y|p_Uh0g198rAO7$$5PGb^oT7E3*flQ2VXJ|)v*QFa!(n)Ge5UcDMTR)V$^KnJHZ zakyGGQ^f6)yZrk`e^j^Lsi0|Y;xU6Wc^yovGTRc$%7VJ;5+vITqxze_YIPJ=KJBv0V$trb&;r~ zRJ>4rLHbUt;Hbs+^Ih*WXY)s;$sK1coccQ-w+D4BxQZcz_;Wp{TnrdBSR%GC-mFbk z)vB329rdwpT@?cRbb&z!77dtLjQ5?Kqhlq=T@8S$$!qWngkb&OcOvahk*wWXC+S>e zz%~`aybOB6sGq3YGnFOSs;*84Tn!tMQM3<#*rD%AvoOe7g$wzwU;5teY4S4uJ$}=xX1W8jHo+MdnATR?nh5in5jEXgSE7RUI$XKVC`k`fFZa3LP&R6> z@uLsS!ua8xws=-1x|T%Htnp0r)vEl%DbOuol;l2kBJnCaaGm$Cqe$aZ>a7bC$k^xUQSr_@6ZH|(ALwc_|TAi2vHS$RP^5uO_y6I!9VHq zZMuf7iHDv*=EC2^(EmmV>5TmMLs1Kc_TzI-wp0Wq9B0}_Qb%9^_gyv?UUlaFZ*;SyvLSV&SJHNW z_vgyl6HjA$Zb^v%t!OrGH;BKzvfi_(Z5Yl6B-wJ@g@4M9ZFaDTuly(jzH>cVY^l0>YXdgbzJKgH^-eus?o}hvfBr!_>pm&m z?v-|7s(_t)s-gkO2a{tv#_D-c7+$VI~5>w{ghMA>6x$8o-{PKn27 z>H|}IWNK8^IC|&!U&yjFNQrCtXogPks4R}uF8&_(ApA~GP;6J*53O?_Nd|vi^QIfE zFioXt3!01h+0$oC`QhkFHommffatX_-B8hS(o&XkB-A}kk})2(b- zqznk(-mdR(ShB)Yx?}uH8Vu{Hg}aNcoi&*~xx1OkabacFc(sn=o|@0f?rbJag<0PG zv4Fbdc+~$!FRVQ@iCS;(DSJzb5Dp{cPwCdCQxD<+&e{0FUGY6!*14>1ht~G+#~+84 zkA$@XmlosMG%3?SK71}l>|lB}Y-2c$t8koc4hM>V{rG6|m?>G!1@coMk^DnT(0Qi* z3d_Efh@6C*nQNQX-RP+wAf_t>*n2xa`v7I`g60f;;1V}A$&N;*MF^#dKW5w@0vHjZ zBVNee&Amm8i!1#eWHBQ1NiJx@JLKfs2pCa519aunf~JKf;B(a&>N)VKH+C6j#VG`onk1t4^Q^FhU@L% zb5uw2TZwU=;KVv1viHN3b!FqOg8mu}*QMW+2llBrj9FHk42>NWr9lAOb4N6PM)f=jKH-`C0&G0Xy&2W-^z|LdFj_lg%Un8wJNl z{o#rOKMz?Z=DOB@K%k4C7F>V5GuK5*%$F7yS-H4Ezi_iLW18|uw7!Gs zY#OYoqHw|vspps1(^b&_C`~N4#4m5D+e_w?NmF`GP{{n}_qjg0;a#e8p4^49SFYVS zs*Ai97NBL1G2fUEtD~#@{%fekl6}3m^Ef8sYB&q^Mz4{$(UW9kior(7;!*vC^if$9 zH#dU#@;B+>yIqqL-=SDK-C?Y&ga$dJs>j)xOmVGBI?pT@F4fYf^gAr&&JMC?Sjt&T%S0MkI1ZavqLFij)Q42{9*uH_-rUX4<)4#Q z5l*fmSYfB9W)@@HWStM+TvTXzx+v;lN z-^%nNX>0AUF{ybAgc-6AqN7Wvnz9~proXLwo+PVN5vH3}E;)i|Sn_kpjqvC5_+7Bb zX-*?#Ii3`g(U;MuW^NNcfz2Vq(e&(R^NFStXFN&7_dB|7)?LcMd$5^#Z`gR^vaRQR zPcu$TzWH=yEzbP2YVCKXnm>n!M~F(w=r)38*Merlu{ElnJ-uLp1Z?RTOX_wp*oY3N zr6K{tHOK$jcSEVa-q+Ld{N9&W&|1m~N7O#y22TOuF-HjNIAUOVqDzj8HBuvX zGMPUR@H{9Q91Ui^FSOAawWG)AQ!Lb7f=DpN@}()WBLju^G@``f%2>Ztz%4K zh(sh{!Q6AKf=m>00{&IggJiMtFH|x$A_%Vf=E{kAfm&f6dNP?n3Qt7U)vevl)MJ(7 zqr-KHFqGk!yRP;kMoiKB(e`r3xW^>T7jrnCqg@{E1Gxe=1C-1KZUs({FOtgO&({EZ z_z{W)0=oc!&%b{`VY-2YzSuMJUq+E}IPv~X1)(X*g-ahw{n@Wxt%4>aXc`J+v1FvD z`@$!!H=W^@+xPuOR0ZZtD&$juW-lZ;vD$@Kv2)aSQGzz?knawt{sQ^4>r1!BDlDeQuNAf|^5 zhr+-mfXf0vvdbW;zV|a5AjjsV_0ka}3zIJ5C8$P-RuyHiW2Efoc(3H(AB6&p? zFtqXTXEohpOkRmN|C*XNWDsI-_jA#fsG4A@)|Ts)9$UkeIpSw{85KYkmFdrMS;TBZ z^h0&r^N{B@RUtMd8-*r0FO!;$7nS{Uxz(|wPuRydp5qTkcC|?A@5%)~A;Wq)JL4SC zyf>!&fBOoVxvDfC@;wwM+09TZUJ(NP1KMrj0fpdCoc}?zh-7R{hWa;kbiiRc*qLGGUnUC*F~WJ zR%cgNH9Rj9zk*B+HeY&rOi!d*wi7i=@Qa5isX1ONY>t?tGuE%Ov$Opi2Toa#mDgA6 z>~+BCfIrFDLPrRw?gU8#dfIXM-!SY>fO1R+IxeQw*QcPJvYg)$0#*bw?g&kbn<9bs zFX}^4NAgEfQN5rg^XooyGgFbcR6k#mK45(5PP>9v9?;%qfdrs?oyR?heu zJ%KC%;Z&-FcMBEfxVIx_{1o3-H6<=J$I#{S_EyE;yN~>LS%cbX>W~@hEBJQ&3D89f zzUmZ;pg~_b6M!j80#71N$(^N$`fG3)`0k0 z2U)W`%!DBz!1}>!&p@Wf3FBr z;;kPbHI4SGgPFezF}PbkDhgdT1;4hz*0e#X)?a)#vrK{f~V zMhTk2c@WyOG8@@)BT^f}P7_Yb?};2se@5NRZojSa4L|$=PRb4S-#?S)huzjB=z_nJ zTJTYmSy&CNvi~~%5J&mQg6istYyJY(wr39L{cLJQX3B~-vmao*YL}-Jywm(B$Q4XH zPM>48ruFNXR+sA9?U2Ama^C|&rRdmc_MYRr7f7pLUNyBj|-pOjtXn#H*NQJ8f> zYy^$LTBlKN2J~O4glP(?7p*`-q854;P~U@43hinbk#hi91LSoC!U6ZndIPvhjUZuV zZ+oQ+Fx6R#3HLGUX0ZuggKF-9gef-W|SNKQMq&Y4`I`KODAVLnYN?yH%`3ClQ!cI zkl8Q4KG=T#d9?dDt|CF$uxI-2KkNK#8DmkYl26v~bpA6HV{Vo=uY*I@ZEQ+T6`!)+ zF@JdY7J2Ev-H3ZJu7RsIb>aN8+f(A@xkT&Kbd%@SlAb)`EAO~h&d_5}NjN=gzC*It zdY`U)smN}I-N@PT1m;9TMeH4QC$$%$CoyH|2+6)u7Er?iq)PY2V(2{@AA+D^pv3eB z-^eCvGPEfh>K=zZaC1JE>jYDQZsXlt->Gh}wnGw}PD9CkSjKa1Xv=Njk zF)(5ywgTt7{N60TzU~u+g@sw*1OUP(*uiU>O8ugeIfNm}&p!oh}p5GJa^hGTt z1zX44&C2|x6$dxlANfe_edt|i%_UJ;B+8GJz2RQ7V zV!g>8IEzj>+0u?t-rcYV(#NurT}Ym?zr9I)>Kvn$vk$*UcDN%ej&;S!YTYYK`y40Z z1V*h>rh7K)4|v_Xbrf2Rof_YUR-YVxO5@amEfq;K=bST#S`F|nN!n&$$_^d+EA z^?LhtM?M4GakQ)EzE6HVqYTFTN(4e4`S$D@8f@D#Lr?Gno<3w;zg&dCHk3(!94fYm zc9L6&f5<$wg=$J?qcu&!G%;ZX7+>WpQ6rbz(n=ruQ*tTY?{pBJ!Qbs_6(ysH`!<)V z50RpyPHQ-+?>F^W-h37E38#Ya6^;Y?_d9h-ej;lb7(K>IczpMf*G`6b?Vl|lZpCOP z@NGT)F_<(O{H4otaOV&nvbSn-(>a;^DpS>xl3XfRK2@H1VTVs|$u+$MOiyk<`!PZ~ z_YzzBtHqJR_2z+dbIw`KTD|idxc&=|g!a26h$`hY5ARF0mSne!si;@Jou&9X_sO20 zyrYY5TJ_YAkB*wyfrvcm-xzvux|h~WfvAwykGT#1O+sOgYsXi8-{TEkdCyW@_FL=O zj+8G`{Ud4}U4q4nkDFz?y{rVa4L|u=R~oAE>gpGfvuyHSj&1v_r{Fl-DjC1KcIm^U z0F|#;v3LEW7Gck0CW7Th*y6I+$u$^o$#v}Sgz+4g%HXpju9uR!kH5$Jz9guTeDv$Y z6h#&kDJC$xli;>r*AHwrG#wkz*1in9orO$t^h>#6cqDpL072lLB($ zT$uSJy2HQ*=$@p0{PL3E)q4ty^fC|mSgKJJ1gaWTVdxEKg<&gi zX9fg{p6@kWpcuru#C0$m0l+Bihw!#&Kqe{(b#VswX*`Hwq9F~iNZs}sfkxJoy+<4DVG(MM}Yx>>DHKn$PHh7-7smrn&!k&Awy<2nD zV|B(4KHwt>jCH%>h5uj<8@m0aS1&xfKffs`NhH4V&AbdG&(EoMdZyoRIw}XRU)#Or z12~v-@nZlY3F!$&XU611n`e}wsvU=OCDy)q*{A$I;X{0%BKy<>8`0G&2Z$@81JO1N zo4q{_vJ3r*5}X*Gg;blH0c3dJg1mvuOe7PaH;KLs&?${UK9>3j zoOp;(?HQEHz>|ATqFM!N_hDmnW4Z@|++fL*oatRT>KVfze$qDbc4L-6C4yka(n;N3 z7unMfe2OWmtWD6|W2>57=)Bzk^LlJSmW8JuZcwQCB=|Wh6X?C4^=b;*)S@7G4Z~aA|*8J)`;x zmTpgr#$3ODCS~m3je;=Of=t`P4~Tj7x})Is@7%T>XU}EMdw3c7wqgO z7~uI_gP!8HR=y8ncUb9Zv-IHWY98&Ve0TnbnSdP8H=dt5m?>hW__$n2Y-+yYdX{T* zdC8Xx;GG(HYjzsPBKh^I3?DK?rj}UqJ1*zBtJt`rA{#Rgb1P+8a@N{%4Og6j`$c0) zXILITQ0ps^C~|%6IpSpg(C%7Btx2Y|ouF%&=G^V0rgr{2a&VnI0Mbfj;jiBxkQQm}S5|({3iqWn{7bS(AHBZ8-FfI*E_ay!|hFkAV<mDpl# zQ@`jh3IDxRRsDnDT6+&hjPl^g)Yk@=+a1#SljnPBhW(BiS;U@KRS&SO4L3D7jsy$g zN(XwZ8RNcni$?t4;u^P`Uoe`AY&2kvaSy1rI^Va8eS#~}CHXNn>g9q?3$~+IqB>_pZ#6aQ$c!ba_DIcrX_G|-{l zRY34-Yb$C+%-b`W!gChY_@b&_(1Sb(DR>FRJO+0_G|GaPMDH9ADA@jVD(%U7O6plR(0bh>hGJ}2z8D2(+#n(7`Z zSkp6BIO8{#_u5~@fF^W_)Sp3k;`jN|i&e9+9aZx3X8afRS>lo(k8cgFuQfMhnC=%j z-i~PYBkHvPJq;A4-}Z5hug7n}%k^@Lo~Itnu>AI9D6B6eBot$1A)upI%qm6#(=7%$ zh-<&aN?Xk^YB_t!OGJlknJE-VOeNjSG>O0~_0b*d9#rYYU%wF$Rmi$YVq)bemLM9O zl`&kJulNFXfs&9#fMVa>I$h+;meX$O3DW*Ykg5ACezR|xiA22H?ex?EKOMy_LToca z$GBxC&EJCjygg?v2JDi%*%8T)c;AniCFnk}g-{qBu-DJu*lh%3B&mWg&u-mh()duv zsiuMsFCn_9O1okj0xv@QfoId9`zI%yK;)1cdDIjj6XinWGl*{k5MD}JSZcE zr?pBumRD5&^^N7_xxUm};2(k&{45YUU_pKMl1g|3+<|D`nHi#8yYxgh<@(cSRPqqg z53nwD%IbtlFXN}d&@7l)8Y}D|X))l32m<481RUsX)GlXX??KbW3P}9}W?m&Z7k;Hk z=*!Z)t6z$$&)^p*Q28ZKdo#r7z!!yf;lod?Z^k6;t4I%*a@g0d2%+L9RF#MTba_tT zEDwviQbA+)lekG{65}1M<95}0@N)NqC=D=W0bkc z>fV5xz*s1e%{{-fd;IWQguI!x-@NWaJEK}g+B|3j(QTZU zWCctgD4wRSAS7Uxd&MD=jC9i7jpyz0oo)o9Kc{*L#Lo~4=m`+EN!t{hXhq;}XjaGP zTd43E2nN$o(JS{RZ?Aei%~qJ(E6yD$ThlNg-#ge{)bwG$${Gf@f9 za|42rra(z(Llzfa*H3|q1^I?j&uQFsmf1+EBNFO@EKav%4ci>4N+F&R)WpT2r?-km zSTq_?oqrOD=Fr;v09xtVe?~UULUm&azA*kywBtpTGYLx@I#m12&Yl;jSE3hoH7_1v zo|B5S&Hjgt=uG*T{-vX+sPEKUHN#@OF;@~c;nwI}&4;_QL%ZO9=M^P_ zE4}C=g6us%0A@OrD-zU~KE#f&z&mcX1c7-Y0kres&IV)YNtmuu4#(uAyu$h;P1~B% zYmQ@1ZT;D|=m6AJ17Zb$C#uPVIbqa5ac##l_hy&>%vh5&@ooJ(a^W4<#gaoFS!E8C z?OvE^O&DW!qi0O~Ik2#nAs z%s=J%Y>io6`0gfMHh9E;t&WR3*UE5lf$nA1fT;5p6);I#1_ZGYc&QR!h zK}{<31P{@V0hiTBdMgM6yA3{^){l^J?hC&?3z}}w+vgyE8K}VSB0=h!)_9qdP%Chf zGCw~bWy+upyy!i2FF`FthK9Y+y2gN`YYJs#pp1N&(pKd(P04frI`c2I@`Mgw@YOF? zhx*aq2Lp==M(8DU4jahR=0^E52%F7dQ2_)FxHgoSgH;yHqicxwwa$V{I}DI%C|CEF zGs?33ocUwucaaLfK7^|izwIGg0_iBsAatjM+O^oKKiw)7&_q}qqEILv#K7n~qHZg= z^`MOI-{$1v%F-?})CcGu)D+;d>#g(L)B*pHz{7lrFCZNzMJ-auyeBGkg$4Tls1SHa zB)}yJD8oh9pA*UGn?qzwDyW=!$#q>(fd{Zo#JH#*6g7|mVTUptAh6x4{Kp&~{mxha z0_i=hvK*W7)^=`}=|MMlUf<3={W^Ljqt&u{(l z9LIC?JaOOG^?tv``8r?cImp>4_Tjb0%kr%vj8ly=Yg~5ykz(yJ;x-;67;bTF?@PN@ z`&I7`q3JN8##=l#*6?cdWkvAqvmEjt9Iw5!rS165z}K@?Z{2x}m8Fde`WtP$Sa)w+ zK1-|TTKb@`T`ywOe8J(}af^~>(G4y-QQl8@Httt9NeJ%#sRCp^sb(A<;kEOx!0FEg zS)h5oHi(?SKpP_W7BTObrun#>Tu^~ZD~%Xcm6!{?)my{lkblgEwb8IpS|d- z<`@2zA^p$l>eVAW8BZ-=3kLdczq)UG6_5HprB|%EIqHT#J&1!-i+x||dBSNg{fN)G zG;}LrQ2u5^P|!eSfb{iP>86L!e}g(}QnBZe>s^{IE_pnHGZJ)|VNx5!4?6r(MkCiq z8nlp8zyXH^@l~q$o6AjiKu;zOCBWgiXKftuh~H9qb?j!D6&zV%jjF4w`yTkUD>9rh z0TYiB_n9PYK-G76v}GAar`17CRZEoB3RCWDSjr+f_K-tw&Ne+tc8!XPG-t3R=f-`< z=kjL13iX>KoY~GJt-TOoD#&g?&7*E%k?3xH>CzMyG%({q0{Q0MCrySI45#V5v7aaj z#Z~<2dn|{2AaKY@WvCsK%OB{tLZYH-Fs~_u@CIrgHUsIWkY_&Mk>~!%f}KObD;EBq zmNEQfGQm%_!c`#=5x^bx@Li%Abg8YKlYoj;+nBq58Y*XR49LC|yWN0B)BVvR(%V42 z8p~}T?yP@vr41CK!xA>l1TTo;iqH%sQ_th0H^pGiMOIIE20#1ubYfEOc;m)nnHy>K zjTpm2SFjSH1%p_!lp8f)jX~^bI%ycZ3kBf zA1?Z>dyjdqp`l&3aqHgqsSmiU4NYr=X1&*P5Jwc5cW=1o@L9wbbJ^mR1t}<9sd}ww zUi6d-R14=nU|IPB)p{6qweIQsCd$M3#=$J#QnvUr0S0A)F!-7-h)DTX!^>&VtD7< z0p$vFy)K#TS6CQ=3<GHpGrSrdcV_CKq z?n7x*cXYyf$ts(}!owX*qp&>ZNB-=#CeK;oXS!U>iLc|>N6=YRr5v+-n2VV{67JI< z3P+AaVKYR~vEA7e3)qd2NDmq)KycqcGYT^eMWZHqWO|c#nUvK-*tWrGEQL5Ubip1&Vo85 zXLieSUB0OYpGxJ$-w6t-c4Jy{)OX*v>hLS?xF$d!wEZo^?w0j`sF&g!YGjyt9b*~9 zIC_}<#v}t9EsN!K&-E*f$4bmHW>y?vx?&-h$nv$GK341;)oU8=*hjyc&{@qhKmpk zTk4VFvsI+9>^zTuN%+i?p$8x-2b-u;nmRD6_X!~8&{%_1Bi9j4DGWbaj2 zG!xCuq{dj9O*48e(l2JT2(@QCIw^W@)LXBu8(2wl;(IU&j=wnjmMq$EmnM9)C%A^l zeJY(2)u0YgP?~bBHJrcvMjq3IbRNzE1LQgm0><9Q9FS4b4}L>L=ilzK1noFkax(>r ziRB3^(*pO2z(B*e)*SQh8?~AEyjZUm=GwV)XZ&2Q=Cw4#u@48?Pn!RnbVK9A*Ztm)&jv)tTYgzr zZ08+#EXcg9J!vZ)4Xw%chj({uL08Mlz_w@IkxhvblY~*MDzDO?bUT$V{zv$d(gJ#U zEt|Z)?p4kii#jg1B{5{vbqm_SN7)tw^%CcMX!CxDLX%KR)K#kOy9le^}eq*H!qBMtl^ zu?Bv!e0TA4O}CCQyishMWgZqnu?a=OV?0tH$o#W{_OB&HjfJs-Yye4o76ripY{{MA zf4KX|L$dmTJ%NPNkS+muV%+99w=rBQKkvH_f6oAGW3(AhT;(42NyA?8?#GXsI_w*S z&S5YvBqXGsN4{ljWqH9s+}(7j$Yi$Ykd}VilS+ActiIyJxXNieI!ZzYPZYg??(qFi zJ19#UiT`J<8glL=pkX2p3TBOJ;9dP!o?G_r4nuEoN=OP;uWX=D_EBS@u7+ zOkU?o_!S>)K~y(w|GM?!T8Z(!{rm5944#zM*rQ&t*}go|{v)sUxeW@uzR?l|oG-W& zH<>c1ZV(8N*t#L<;>M$eo0t@qBye51K;`1H!-^p1G2dsQcb9mx3&)JJ z!fzq|q+`JjXrq=}sXS6ICy!fg2scz=cdBmn1_zzAwE@m}Y+xLU1HFIqyH9hAo_%|z z3WJ1`Xb~fhj6gvtsn`mG@j9^3c7zJ0Jl~q8)L&2g9xUL;@URmgK97S|}S6^)2`x;Q2?HyjA6K&i@wuz}78( z4jg{azswi;4wCRGhW%?G^mwti+?SMHB~PS&AYGV3=y4g7Mky_x(2a<`q;d!8J>`wh z6@tT?Sww>=XVTCDBc3zB_V< zT%1o{F=&bJl|3IDKI`bdnXLeY5!6!G;)hRE?)3cgs%DP(-sqJ!wvAa`&cvCiTKNE@ zPN!+v&7oC86V;nT@hRAZztmU#0B6H25|-0V(4&FLm^!L&L)jJGHMu{{1v;IZsbq6R zGS*2O?>t*jWakqAh?Jf3`-TGfA?md+$T@9ZB-8C=FsJYfbYcKY67Z*lz#0;-0RKU~ zyVTRrZ3~yYCbAYw*Z3=T@sjBj^q%{R$ z1CrL3uh>yo3E)WP)O$#CoF2e2=f{e6|NLOW8M8dHX)rc6uGcslY$4jcr-nSP{6~)x zPe7u^v>l7LTg^RZBEvqx#K!L~9TTbBaiaMj7JUJ$WKijc_cuPuC4kTVfj9t)|Fx*g zBp5-wtOcFu6Ep~R6y}8IFZ@!3ip$y!jC;k!gV9h&R4d~)jvI@qy!0uD=Z}p?@=+j77wx6#7W$$2^*BeUypVs03r_WWVZ zBfEUnx4pD2&sG!NwN|8X=~e20jt)Cvk)0ymc+fI_b+bTdnedqWzrV&O+sbr2(W&%| zdxHq~1qzL;^K>%wB|XvfjT$FH3-|`O!rrS^@*a_3Us9(*9Qbqpg2iLjOOf%%LoYoH zm)`YRN^36ESENBmK<`1NvqQ3@nAkJJSWA`h@NUFDY`=(;b+I1Tz6#OgeqS@IC3gjHj1!ACBV|{k8cvC|@=pMKK zN}p$s9yr%Y%zS&cql9 z^k4Y%ZT9>wX%)v`FLz9OzB?b=L%l_0Fh26wM3*Q)yKXMs@7x&o9|65SmGXT@F09FZ z!Qpj-F>rSE?b@<)E|w&dD3gt2b9Dr4&T?8Qx@0s%U({M%1Q=bQHhV0H}CpfdSy6v=obB+ zi`xDl#EQzo_`1S4ZX+fW< zN`Tw`2a_=l;K} zzPi(A&9xRWg(S0z^`5NPr~e1oUP8^ zd8WF9h|sKA9OIRvb~-j%bT}19_45C^S9Gz5!nW7yy#jp-+{8|Q6*@!9FScRJfeN0B z$NBmg*SrWaSo6qy)KZtN;dvlKrRCwom%j9saqEtF9EiB8sPy?eRfoRO?A?-l19#%S z2hu&v0zouBf@|xo(iyffM#LP>v(o?m=7Z#Wq2Q=Z?zG&JNA^k=$>QupiE6g+um&cb zuwT>8cSWG!TZpljuF3pr=u5sPf+fBrmW!_-DT-@kc2kt8JFPG={vd% zLFGpuKl_5E*{$@!7ur?%w((1cCfmC?y10F`YLHjsWiC(KWPR8mms#i=ua(iDTJrKi8$O2l|G|=zT^D-z6BBv`Mn;TYH+l*Bc3I`UD6bVQFFX$dTIoQuwwpXHL5W zOaJpqcL_~Rk$#O~TJeMQA9;C>`B2X>zR%dCVko*+>05qjcqX%TFRoCy^!Qg*6 zk)P*Lgy3Y@q9HqDi)t|%1IM0(K56M6A3RqYvq$5Pa(tQ1HrGG(BhQxb=n{{hTP}2b zvBVZ!)A(*ssqxuHcem-KciGQYo(;v^ADdm}dZ0o`>9A=mTF$s9%6@H`iK@wr! z^h$QBA-Qa2sWD`n%CWpa+`phC9vJ_qYf$Vo-AW@{eS6h(g>QearRSW|>X`^TQPy|o zyTn=>#s2-_8WmS~KVQ&~2H_}48vW)=f~-b|z#IF+m{E4lwnNWWj- zmvfUK3PLywzj;y%c}lpQ$5zLcmXG<>w)###UoE@e|32Xiv1>JMvYb%3Xs((t++LXN zVWv>_?VC|(_JqPzgaxGF66<@nn*k|aNRc&m4u%ShY5LZ8~>V>~rpO9kHaX8QR znah{)sP6uEZvt#$;)@$R^}K%CH@8fOUs;h2YYfxr$ZK1EWF2?OwQg09@X}LSVY4(n z@_y!DU0=hND2HP?EG|4=ZN;eqVI^lSCniEce}dr^g{Ck>yEt0KO@Vk*`e}@ z?a8f?waKjsL~C$_Mq^+K-#}Y~*s@A<}FYMnES*i8`0&w zoH%;C#C$#{>dmqL*uuTZf13V z19j+V$%>QAY%qv9)Mu(E+V+SGlpm&kAKndR$_vp9^0#m5t_x^l3{QlLc{s}jE=X)l5TszipoS3af zdysi5xmrPXH_b|2;_eqk4(mW15r27W-VqvaAL}DUjDf^MCX-h|At9dPK?Q_K1)38= zJbI)exLr2*@*WTf(4NBui9xzMdQ#_k)db7F)9_9K!q3TErNbP+EnXSTuCfwPsM(bo zC{7?FRBl?ewne>OGKgKoIL=+?t3OAro&feMhoQRESVGITGKolB3+ zefRKu4Ez_->I2Drug^vlS!D07UC~_rrjy^H+=jj6m-O2$N$4P6tXfa?@@^x!^sUZD7Y`|FnDn`692`$nPp#RHvu>V zVn?JN4%|ic-(E2sY0nuSzUtmh4c`ltrp3iQA=0r7)3sQ6&lva~!f>dFsL`35vo3w} z#(?sU$IS!#SH`a_*MrYJ(;B7iGQ50tr9FW=2io|)@Z^g@V{^KofTz(DUxM7T0;ol; zy&a#Xtvc7iqU#f8etP44Qf8dd5aJcAK)A;* z_ZOL`IrC@`0wvC#hNl)AJQoU*SuRhyb{=<}ui0QKHY3L%lRellUYMSqJZnV}r=4FJ zd6wfy?N`I|Z*0j~P>N_RNmvuMK+ol+2&E>1c4o_tddsMjF{Gpgi=h?X4dPK#0@+q+>Mn#Yjjew)!{EkF6$<_?u{orO*dbgfHR zrbq`K(fZ~r&SK5f%e8~U5B4rN}GiXkC8m6T9h6{jx%SuF(wy^G^G z6PN+c2g^4(`>;TM~Z!>AND@MwvhN=JE#?9XSUxPUk|F;Ip1vo{oyx ztQv`?O^0_0IPLsGgfA{#c-PIcfR)~Th`^~(rCS4`fzD+8>BH^L=|M7j*LzHtBIPtn zRCk^rRyF3QW&Eez;xr>1N3HJ2yX?C60SO`+EE{M!rYv~Ek0#5``EmPzx?_e(wI{=#bGQrq z7&ZZ{Yd(0XneCy-ol@@|!8QLKF~a3fkNL`gxdh`~65@9n>S=m`BIwO3=YjxkQq&eP z<5fcc!Kdu;)a)K+F|Yr+_BFww!e0c6Eahq}4-DAyt3-MQ%d2JAc4+c16tzd##9X1> zf8j2Bh-Jn|hl+L5mcil|{jW=B^k;Qn**@v-zW~2^N!1H_g)4$^pm+++&AXt)RYuu%JKgFLPB-NMTa@fWrZ@*Q`;YauF@Lb2-F&@JTgv0A(H)T zws1%v!^i`m`ssUylOW^05^d<)Hge>V^Z4O1HeT2K_w{)WYBf4RweKPnbBLekG|YXr z`X|2dNF1>+3=0d3po@E>qoT6G&CLyPVL0ZT?#+?ZA{u4f&W?0v@jsQrQl4}bMV&#(2z5M%YxzjjV}Dvjn&7Aoe_8_?&M1ih+5?1q z!#gu^9wskKgO&CUMW?rBc5$6PH~K<93QVtLg}-8>Zeo>bSqvslY1U^1zYXK^wBub? zjIxefH_K8!>AF;0rCFCFAKW~6ntIFgTG-O?vL-b}e9IzR;LPOl>sL*^rm5;Bb+KwW z2Ujh#&1T=bb$!(152bS}9oxUGKchqTgkt+ma^uVI(d2Dbd0Ivm=RFC`MK}G%Op|w? zv@}XfNpY3C=`)R;&m^8%NC_qv%b0omJtTSXAf(F`?pcsy`k5e%F36$8`_U4(F(-H} z2>JT@-VfrGys!~dpKp1eNOfPq?Mc9(Q6Ejgo=n*C53-ImfuV+|NrCQ8TR?xHnDFbw ze+0g)rmjw|=`-$<@^_W{jO}UA&uJhZnht4tk`7BI==rI^XKDnJL*d`N4ttK8*M_@` zyL2tj7cY!Fa8G6HeuxN1`gKY#i6JmL0q!fy{Q53@CAJn@e zg$;kfdj5rE?&gXfa_+Dp!;EnJM6wzN69{d9o$NA>yr3-nM&+fa@&z^wD(>z@)Lfcq ztinQ0`AkQ*wa9?~wtbjY2g@(`gG2zgY(-JlOsbO^?@j?mgku#t3U3U7{^!RR_G=w)Z8 z3EsqUUglnyLF^R~352XKd=W{RNlJW^=fboFCgbqt4n$#xD6gufMmoNc_VUNdRmoMz z*1S`pO-IKH?h;tlodhv5BsTUVh*P*VTS1#36%3$$Cul{wwZQ*xcZI~|A8#`KIuRJj znI;yWtU3+@Yfni{CCwjD@3}#46_{wmrbCm>8sbghY5-7GmFD;jEd@}hBQa-+hpO~l z@If9LiB^-k&3BpPGl+QoP`bC;oayQ5Enq3)x;|AUB^4%7y@({AmFrNhCiRtZ0>~Y} z0F`9&?V_gJ)sS2J@nb(86fcIDB;x~e8cd+AK!F=`dEm7Nv46XcWk$H%Ti zE)QQi9HSXjr8F7vmLqMQ!G5p;7XnlTkh^r$)i;sik)$ZLdZh51tL+c*=0l^RPF}po zA2LxI4~=EyS@K+yMd>-aLf^G?#Fh!vkKs?AXy8L2tz&+hfQr-sG6=$^i-4TN(KLX* zL+`63w>;f)|0(Ed>q*c*gveLgHWdw$^%ly8y-zmE+1jjU`P}jEsl15PCN!)@O}FhtEcts5>WO298b|mRgWZpdeh|y5GF*fQ^5y% z2{rYz$lmyax=)|1G3x?b3S2*)Uz5`K5>j@Z(HP7J+$HFkBw<)W@~C%7T|S0U1PI;$ z?0v!8e;{7AgcQIW*^SxB6#AJgdks=36SmgdjKxdmczzZ+??bYMdbA@-WGtm)UXR%| z8WvK*+pwEd)rLzwKdSK1P%;=mDS#ZZ)ujz_v^yKWxg5HS$k%E~!L)!8K68k4U}eL? zL5BP-fo$TZdAm`4+#W3=DWTXfc*r4BZoWcgBSqQ4Qy~3O$y11ffWd|Y&O2BK8qyqT z_%%@dSAW2T`W=;?ke)a?Q3#j|e=kDAv{TytY4g!AB6LUGH7^20;fQP4Z}uZS3rP9W zm)I>Jn>h;$?nl;5&y5d4DEL1*;OmPI>aU{3E5KaF4O7Otj~`Ra%e=_`%fLVxS9Bgk zHX4vP*Fa^MWDfE$2ZZ4CnwiDd4?@V8+)@Hx0^Aw$Xa?tJLCa#8e&n;MCMVgG3XcrCE*{Z1A3ri#eHnInPTP058PDEsUnqL_HT*SNyKLvBj zIjnCC?7YD%jx9~dF2`~s@}MrmLefE8J^-Q9|HJ=5|85BZ5DYJk-DWU8+a*0{z5L&d4ABSb z0eA|ThR;|*sO8(f=>SN5Q|_0Xux}sr1l)X-u1k8B7sOEkaF#9dc*j9 zP2Wp>pon`bzh@?g6z>(*R_4!fEmP2s$rw~XISo?4xhlqGWMNkV zisPgjzM%|`UNvTS_igws#YoB&##as~*r&kd!+^CA2Rfk25;U6=RXZa7TO|MucOGWy ziYT@aoiIv%OlCfq7llSdD1*yX^ZIP9c#9ONoB{^L7MvP!fC@0?HEBov=7ar)<`?H6 znqM+=8V}5=h#6?r+2+^!ssk5yM77N4{MT^h``N zy}abxO>S&P3q;Zz$?FP1C}zB4Y~e7sxH7X%h$})oo|YUu+CRSr~KJR$Y$sj7m;v zG-G;zbaX=7Ap6Ha1@BuMHLU8pGB|EgtSp za1254u|kX@qu;MzmfG=hbp*WQS|7DxUQSwS$S+MCM}Wk`UwvOSqT zI^2N|H~`uwYB}g$S0lk1y2Cw^1~tlm3)LiJ0|zVx$*X>AJUSXE-t=Sf@r<<*+FS5D z^;7gnH%L(Mz#-_xZec2ZO$vbm0!IQ`=MAtMK=p(p9+HrtgYdCNP*CtZJ~8?BrEHpg z;4Mh1^GsreTj-Y+_#<*KF5nzLLiyTN|i1p#mZ~ zaG<6^!-yUgAdK-gfWEs|K;UFs&QJmJuq4Vhe0KuOcM<`FD>wcg3T9H&28Njj5oVym zQ3JyflGKJW2^*3`FR#VBdf` zQu<-ClE{wj+b4$86G*Bs*pA9bvDE%LQV)hK2?8)^ywXRb6& zpgzP0_QMIya%sBxca9P>JKo(0f`S_I1&M@$)*l2a)&!a~pT+qD>r<~U!-73%&(TK_5!-S1PDRN6fRJei=LULQdsYbp2)-}s7b^*DAUBOEZwV^d)1b*7-wgIlyxs&9@u`3*4#We+K zHHb^WtgQoFrkxV!y_^4fjXT*?EG^w4W60;tu84<`+5RfY>MPX`_Ylvjf1_Oal4Gub zXii$0?4-EAscAU^uHX8fc&mCjW)$)z;v_ZVMX6&Qhg=RsShqqVBKcr=Td$G0$U+vE zg2ol8`7zkfI5Bb5djRL9u6_-|<;`>i-GQki52QU_9D`x;hTLy&YzUUJxhnD6+S)bD zz5DxR;Zs!Xc98U+(Tb76+A7$w6bwvuT_si*yQgsbGS{zLE$@d(j?MR6KC~-q$^8tH zJk&ohKtnQFL668}z4S=TR9#W=cG#gh{VP|5Nj47JpJKq|Bp(gjOXf|!WZ>+`BW$g( z6mrb+_8{V}t_3$92`NEH1}n6dhz$1_cPe>#mB#qh@;u_~x`+dR3!Mh}UWo!h6=^tRt;aQSJ?fLm3=2Jdy`}q8K%%ppph-94YFKKq$myt%Hfmg`gGPdBDi^ zQ&?jtnjUG>aHCI8OLHXtd^@lP=}!|&vj%%^!hsk83JPXG(RaX?F$L=uL}s-r?qAXa2-f4t$Ak$H?y@#<>3 z7(%_8on7{o1hhxbzR;8Gnb()_EDZ>>IQT%@0+ewE$W9X9Jv=t{&-W}bdybQCKWU|| zcg12y8JcXQ2L`yZ`0Rn;S)!A!c?|N6Bg@ zR}=;v)i^L1`yfYTN#~+%MDTp8g^BF0L&TL7RvGflT-bgdodKL-v}|ksVgnrXn!U^c zTLY9yITjGbbgK(&Vo1g`KA;u*hR2T|3s+XbaRs@Y&Tq?}@;uxBb}LwrTrydCup9(8 z>cJU{P&azEz12ls!Kv}3OH>VP02r1qK?xLiWrl4xPY3bH`V=}Ol$Iw^r;Z#2R@4Vm ziu#Oflq|?va5>B_8WASH1M=|!#=B(bJpX>pi6IxP^^omGk`oG`H=q*(T!I2Cs*Oqq z4m^QOD#<%~d&sQz`tth^_DR}6cm^2`W(L)e`OwQ8J~E2S3&B&!uFGBbfmqO3hL8C*!5Q3YiSjc@gi;> zeha2qKB?b#rnUpNJg3{PqwgTk?!kll58QBitq~25@vy#})>3uN zgcGdhjE&nT_y{4DWUR0R*I>PE(CzQD1|^bG-H|VjW(dUSQ<-{vD9`WPcHogVVUwM2eulQLT|10a|+6=I3PV(FM2o?RUb>s zL*Rx*#;P+qw>#H;1`mt*05N0Kuwb`V5&cR5;0VL+>@zv>BiDQFqtTum1Ql1ag?Hb+ zyKmk|X~#g%_I(Xf#Mn3ri>P&;l9-tqA%Whs%hiKo)-kM1Y_J&M3Ku z7&2j!1DK(kAXZCw@~khBWbgps(&JM~nsXAC?!1p`aO1t-%w)PhM>r`#n^reoxOyk#SXDhdUm$^0fa>4Ay*+V*I!lI%E z?;29Z$chy&Ud|#pWrfC>iTAfNl;;SRlMgvQNHCHy9Y;M<>_L@fR>`_%wp1O}Xn)*? zW-L&?o%)+Tl7QKZ$=QMn6yLYW)}I##R*wi%i<(Pn`;Yv*`bp=)Q2V05hn0Y!)t7Xu zG#c)V+(fC^^b@;irK)tzQI*^BYZk1w4%^IGIn0l$5cd?)5)@8nbc(Mfl9tR)UE8lP z?Xmpo!}Oc!zus)Z`Kz<|T}ypW!(aD2Fcw-J?J{vMdtp{m)O<9F0l>ivMu(A4o(#z*3TlTX|cyX-9ZA`wgXt zq3Wj=>;~B;--(0SYw-80to$*3io($lwrt6v8z{xnN_beFZ=!xB?T1eM27v%br@_zKOC^-)1BF0Vt^^KZi;J{G z^Y+=cgjSk_ld=ple{na=*bC#+#Kepck8emn>^txjO16Ik8lxj3QW%wL95C07IjJ)8 z^@WC-8hxH^OVSAj)FXFCi#TMR{E;|OcW)uvI-I}=fs5F$kaix4pc-+YYe)8pcMB0? zleOU+m_vUR;pdFDn&g5;+^KyW@@&U`<_D;tQul1}BhM zm{L{Gv}$+$UhMW-;3IhMv9iwUpY+M?45m}h{Dv^%K=004A@MEOI#4)gh z_TFew*7&en_+YJzqc>SN0VdkSz!1rCbFA~bzK(2RNMvMcecIr;aSy$(aOX3_Fq^0j z=F&mEI}baqbG_WU3re4Xce$ZAjvO3AVf}fktJT?`uzNOo`1`;8jbLygTexT6G(EG- zKSKZ*GW>^Qkx{I=c)ttG3$~#dBOHiE0)s?64du{byc23|noZ1o#@6Gts+8J)9--aX zbIo)k@LMPQ2o!~!VQ2gl?!D_iopJVU)+MlqpHyV%M=ZO4^P)}Q3%2Y&W! zM60^&zQ48GJ^9~@f8n<#=eKqwFRFBo&rMWV_!j|p%E|s^%<@vA{3M!k+7_SK@GF_` zk-ueB7xYma91&EPlg$zWoJk$J<@3C4FLmILh8Zx4K~n$VUYGM_7ohIj4`?tsW+2sDv>E`qR3L3_@s z)8l3$>Ww%KNwD0~ndwGcJvr-5zrcaBxA_GCW;OrVk>3|AX$Lpb?35UgT~2ZFbW9RC zZ{ZonefQ0Kok#Ug)32Xu&S@dq1(?0|y-8AgC@(Y1!nEK`-}NnC^2?CVoiX~9-Cvcy z)vhyWe5ZMDT1w=;GjF(-rzM|TnA7rVUFNTa{*wZ!sX_KD^pnkIG(sGE->=$5X(iLL z6JB$PKSt6=B_97tkaKHJp6Y*H*~VgZfHU~U^w6mRH~xEf?HGqRZM-juhAu6zjd;!V z(gn-QxlaoM$QqI57IH2TIalJlW@6MMjy;4rq+(}m{P>5`czXcqEu6E;aPyx>UtI4l zy@kh%KK`U_Z{G9DUK_{Uf8=ath8SrBiy@gB6tIBcW{}Nb8L_|M# zBZ?Iqiu;%CP-g4DF4Kv5W6mb=|itqj5Z6BryecG@<0 zHGkGg8cBKf@yX2Eyp(QYC?(vCvqehA;nzAukux)b&gmXW2{JdTTL>`upI7hh$WznN zxdf;c)jOydsnc=9;AcFCaqeCO`821;rO`aIBYwUk1G7=4^-ib2t2t)12QZcI}wrOAXrfmzoaYaAHt!_Xv zs9+@PS?i4xvuZI(BFf?cjPq=I%TzD)cOYRUIeo914z@NH{umm6`h53>{{qftuF10X zl3QzewGu?@31uUJ^Hq1PV7=J?`*-e@HsQvn*}MJHY}~b7qNE0-jN_bUn4H`-HRnx( zF8{otHr6iSzM`+gry%+Gi`s?4uVs4s#}|b2Zy_XR;qaQ#RB-m3Key3t7GU2Vr9hO4wS z4x~3<+s*HGbguk=?^%3#X>lAlaaz1F_RgU#Ve_--5FHce1<7B5`9s0Ue! zLt;Y<>a(ih4!zivh)z>ODDwNV!?XiaLHGiwIyk%%?#4(c;z(wEe0PN%%rRpLjKr|W zCP_xGxy~NY%J)riW)r~(de>0>LA#SlZ4^mgXT;HVF!YIhS1@$=S1HXY*opw$P-y|ErV>2|) zL-O9N5hXc!#L+cl-bS{3{+4y&?D2YylAnhK-e@dh-QpgEp|gN+7P|?X1cdx0(RgsP zPI+ELY9Bc-qsqaK0i7yNG(qoIL86?bw=cGrksbl!kxNsQeDpKIpR+5&BbI7=wTfm3 zF_QiarEyY3yww@S6sNca_r!_QKB{3ZsCzJta#xjGy_2J@G}3Q}NNHT;lo@s#k4=ac z3(e#}0%g8jS5O#NsCeAgHnw=JgAT`xqS`ZQcM~9mgs5YGuj*h993UFVIVePe0FIgr zvvAvDn&(41tL zqmwj0#MpPTW3^_QfaE(VV1rUacyp#z;mN3Tb!C+yhZ*kzKxEvvP4+wj%7~XIO{Kz3 zmsn-?2bk81)P!M9bOToJo9ZZq1WJ&RHImpQdwXREU}b%`)){{r{=5++j&>46O?~Z7 z%v?E}Z>I%nU9KqL(C;Y1Nhd+_QBanZFC>F~fPNAQ)I6hDtt{;7Qs5yk@z4J)rJ?0= zp4-D~nWuhPu!Kv^45%aoG)nx6P4Vj>v*4SX4@L1-*UQGNA6jX_`}@pECWg%a{B$PW_WQ~2g}C7x_Mt9@b57Dko$R0rGPVULRDU?bNY}O zec#j3lRqD}v9(TLO^Ky0AotmPd3rmn1w{{pvD>n@#|@2xq=7tn3D`S{+~^7_qfy>2 zbd7xjwtcW`g}KE2KHl&BW`HACSGWJWe!X#Y=AZ0J)9Otk@&8q`>%d?Yi>-4axDM zp5CuXgD(_u=sWaIDt{@7pKkN;q)qc+Ht3H^cuvbokW1TWUbHbNcf<6#k-;jFr8=y% zzb+v={v@SwL3n@c?#r7iCR{%cZ+JUqalx1s_ymS1Qz8rxPERIH ztDOUO>Hg5#xYMac3zt~M_8{ZNUaShu9zSwHneaFJ=g~35U{^G`j($AQVF1qOd;$VD z0L^8sD$l}b9v|g16lqAtf||BA#=oEhuxqyTg9v<)1Z_Ryvxb*(4R^Rx$$l$Lbt%+ilbQrc(8EkF_nS1v zJ|w9`d&Uea+6Wi=2fP+%$IW}ceJyYxA?D;QdZ2P4;k)^-^L%Akd#yzZrxSPprU&d& zm$$-efuJXk^en0XbX-F}-yH$CasdSl*}Y=usa+QyFK{4*T&=`jYXvGK@Wk0?^J8*v^APy6k@7BPob@rI7H9LNWYJT?Y*NofeL`d_VQi{5VWWvOpX&#u!97Y zE3AC`y|bzHw^BgS!W$gWd66%v&4ixWA-fw`H*6k-3t@ z9w0S2`+Qr0){m@{i_F`%HM64Bf@H}A0s1#dgF-8UT4LY+{aSC$0mTDgkw9grKlKPt zFLUi(-m#o9EwR5P;Ok-;v60;IecVk$%Ku>c0$=fi=o^1eUXEIH4t|TpYLcx$dJ#;J zY$+bydfr$2xLTvVMmg9pg&Z6)(4D< zCzKneLi*77;H`%M0BJZAA;u}^`Z8?os$4dN;mAP@W)qxl{oBZ60;+T+svsmI^4t%c zxas(1rc|3+uff`D(ryjGC9-@c4=@F=Lg2XN>!K zU~)b%|Gih?*fo*!RVH(B#|z$BCL3K11Y5wy!KwHckk@AR!aO7l?nz|QnM{)t|`F5 zIfIS4Q?*+9LA8%%M*O8d=9t@9aE$ExKL;?zhIzGOxo~ofWgh2egmL|wk*q_y&y8~G1SLxzdA6mpjv|#Z861u&YJV#%xlxeDq zHe^W@-%$`%Isy5)sCmo*Nhh72LwlWhW;%%LWdj(#T7P+}STER8;+85V9P`|N@bkW4 zxpIWC%l3+x*GZZ%4f78 zrhMDVpe40;p^}%?K&sSRy;6Wj*)1qZ&VQr-Js$33qT6Uv5B3O_-f7*)ICmw8-C~UL zmssxWdV4AE)8pI9r|K8Hy9|NwcQt=J-QA*SCwab@G8l2pA#V6h-ON znb*RC7Os|1PR8ZT9wdr`+h2IhD@V(Fr>=zQ96O=a8JeLqIO(eEy71I!yhB)njcY4a zLhV>D>kGM0?xhn;y>}(W%&3a%>5rUB+DKH>Slm?K{xDw5Qz=h!`cmr3t>%U(Vo;-J z#?|mqnUjv)`V4~B?`-BsP4bsf3qzZ}fr_d7?WXb{)Y_YFM2{#Et*?!8T29S`|H@p| zp1E7z_vnKOM~;M8V;&iT8(j|RTfj^Kuhn)ZY}1?($i%sWtR-N(gtrDtepHXb%!dPMKL&? zFMK@b*^=49%{$bvvQdIsl=Chyxp<9m{r)Ttr!#9h_xc9fEy<2mZ&*VL!4NA`2?fJx zPn2x^cH0jPr`~#cYhYfj+nMH7u8y`r*RXTUO7N~D_Cs^HJ@%+B_eH8_PI&Ko?Qc@z zeu$*5l6uaGPE!H9DDjbPz8RGBN%0yBuEE*C^#@lJm=cKYDE{NgKMbrrkA4`XVH-|f z2(B;h8AvQUH?g?J0^vD-B|D}4($Bw7;}e!{#%vs%)k$xGpaOU4!iWgw5rW&rS45xx z@eKTua67WDk zda3br2QCpb$HWgW1Rkas4YO1B&Nmz+*jq|m1wOy%uKnT9M7t(~PkVZT)|*)B<4UC4 zoS*%)ac`}dju{4fplqc6`d}_!*tRZV{RVGPwLZ+g);K@3{;rv;kiuMv(3s*@!3K)E z%+t}iiiGClr!H;C%2PB=;Kue5Lr+5)^Vyoc!24WIlgMvxcd!k|8?0nseHR}|m z|Ml2L=-7qMFeGHG6<)aEDH*hIWMtpQk%Wxyw3jnFrXN$sO+S}WQc?om&$`MAkUxK}K0DJ_oa$^JaIm>FNg>ln6!SJ66U*4e#_dbp}$uwk|C zN>saI{7JdhpR0WT720Ux+19kaQ+O+0q_F&X^dM2zo^Zy%ukZ;W zqrQ7UXy8e_dFMiSeNg^p_cQGRr(HXqdg#eCyDb^3oPOahHQZH@#)h?jdQ6k)l;2PBAsjXzE3TrDdf}dsu&uhoqxS) zqr&k5U*TB>Et}NhfpFK(PkYx4sQcFh64bDT3-^!YtTi|@Bs-Gh){!brr6vz<8mDt3 z8U=Rw8;QF3*J?Kk$^RZG7pe+nsJRu(Hghy#yTDM1fBU}Dk@tCjzig6R87r@8c9KsG zZ9h{Kzi@S#;-?Tiv`0s0U+Ue#C-Q2l-AwJPx*S5Ai_Ew;mIqYTU0Tdpa2w$W9t$Ga zxKx|&-j}s~YPq-a(sdi}&zFpbxy!jMJGoxUuStBYEr0d-xylKeeMDx{{%x0!jZ1&# zemyqrSbfQGW~ZB1>^gJG=jmJwY})Q=$YoDcRo5DMZiu6vVf%3V{%r-~14=x8_>Kjj zz$WRA)ue`wiF2D_V$=mYnyM*zVq@;nG8CM2XZ{g4cFMPhEAo%D?LxjfIBxeHQwyMQz*0N9SLMFcmvB>~=rBb=o5$HLmmx5xbgw z&b;Yh1k>3}xdPw);)L0_Act6W^G&gdk;$gM7iE_wE=7q&he+fw^~^8Nd%AfJG#=@4 zagCjxWxxNr^veBriisZtxODZ6A~?;)>yiSPUJi5oU#z_eFxT(?H~h6^i4bMUTGs4I zQud`t3Pn)}DXEktMd2fbP)b6JB@{xG%2wISR#7S~WREDj?A)*G-2d}C=bmStndhE) zW;!#SpM1Zc<+|S2dwDIgY%kvpkF8Z);ZnkQyL}=oT|hVE#l+;gAI$FOgOdz~w2O!D zH?LcI=f@e!Xa7%q=9AKzZpG#gBTfo!-a3+^?loZXW2ekA=VwME9YZ00c?lIg{!%B$ zG~3uKS*E3XgQ60fSBTmdjKAIJYxe;R{^YY2vm8GHe1Gh*S};5`U#iHoOJr=OrmH6S zw8?t2(i7c!Zrg{F*2?!k89(FNdWHMiGn5zsUdt178mJ8UKHFAiZ5`f2&mLS=kntP* zAX7(wee`_uZbeVT*epP(()*)#YWz_}wxyL^a^b3=&-}d?-LA=9GfyHq>$@y%v^}QA zt~LArP%>Xk+aE9>xMx)R+TAev)=_KfwYgTPK-S3(lqN-G8*!2)zBT^*`5Z) z5|gls?&WwJXTLNbPz?PawCIJ$4)mlE}@jkH3e`b4t&(VA2dRuCqXR5MnmVxF8+o!$0mG$wx_Z6ppU3i&MT-}wE zeziF?<8)=$tBnE?`xJ#GJKsOkJUM<|qjV?Vx^ZeUx6W`y>!=l9*~CJSXvA&jP96!1 ziI{i2Zu)$`CRi`Y#0eMs(8MHGS^ib5YRc>_;3)VOnJIcB?o_0h!dQcW@Hl zhV!qf@6y0n44Efd{SA27`y}#5Z=b)=5OZx%ycz$8i*edt)8mpCG}C8iO0EJ#6WUqR zB_J93!NWezXYrcJef;70)v(sgSHMtfy>H^kP{~kezxGMFvv-;>YoxcUX@Wgp;`>c! z{eSvz{m2+?UlL=N)qJbYR&aR6nLp&{g%uRXGrpHC)0>J%R(#r2C%UlHU^+`s(ZU`r z6uBGHXYH7{1VS@<>F0CV%EuEbGJdz}^UbE#Ez8JgIF(e_l3_TZGxJ>Ukbf@n8z$-O zwW%)jiBTKa)o5am0?X=rMK~NPf_!g0yvVvhf0wgyB66>2BRT}^#Ecmw&w1|w>NA05 z7NRmXQ0k_UTKr>Fb73%S1W~d>dW&pO8E6) z0Q6Jt-D7-vXCpX4S`hVw=b$aDrj`=zWO#+j1MJ6v58a9;vfQ)H$#I?wV)65kB8j7x(}~&ukH)xmTcTQZ*Q|{Ypc;!4beA7VN9oXTDCrr&rRtx zzjaM;i`B%qyX%$B>6x2%f1S)^x?g;Em3KqNrwtZC%9QZc%mS+zQ6)J$)vV07TY8pU zZRi+{qMDmluH<~lE|b}Nsp-Bn$r)q8EPk_2jf|%+&fday2jUN~WCEr$uppslL7uE!zWvE2}F% z)n+Jj>{YXxkbIGSbzC?j&*e*$b~MK%M_KLz`JqS&(X7o%vceWayfOFBr#AQ2&Ab-( z4+#^KXOUKv&X(~@QHBw9kKakumJIDz|D9~}ap<*iqRP;mpZvi7z#DTkLVct|Z zWOC&7_dNM$RqI$}{q$FbB+pR_wuM|e)3s($MK@a6fK}xL?d{c~7oU!)QLgpQDnK)G z0!5M~pS(nmi}9a79X|So9S7qv?i1Aw?jZ#AWlgG4JJabb=*E-L0cw^*)KAc$lexUYdMdlJ_JA2Syq8puj$(18RV(V9v!M=C>5751+P)`LBb8xCT;?N3)rvEPD zOVEG*2-RQ8^uC-r8!oS;6ne;}u0Zj?*?Rxue_EgO(T1}Q%$vBeL#bv28k=m7t=Z9* zg);9=B!lQzUj-76gbUgupApKb#kV(MHDw=S@%R_bW|lsbFJ!HDagxmF_i;$3g=YJu z`Ynx(iE%_j2`?$U_>5Gvp2{slf*#zW>~@6Faw@I!&fCHq;zmnAaU^IU9He!cIgJ4i zcLgu^!Po^cUF4V`Xk9Y+u=>C6f`zIUU$a!S>)MfRK@x6{%7n+7MEQ;)QgJk?t_zs+ z0b`-#+FRQ`FEo0{swB%s-n(nW$C&HqoeB5l6UOp~rlmOi7?`=w__uNXQH_s_gA)t1&Aq*|}kkh++G@7qV zx+QG(ra9ZG+)N9@6ul=d4r@aS7#EdWmy6q?%Iwsyl^!tREM*wicJtRetNKo7+r zK*K0LH~Z%FPh~x>i|@K(D{hz-TbBR?2Kc7r(+-CDALzwF+Xf1Z%OH3!o8WiGg}b*l z&-%aCydGENM#B}_uan=t?bBeb%o)gBJioMlf1VUmAdrEgq*OZmE}oTkl%b$r@wur@ z>E{Q#nSqGdL+!~&zv>k%1R`)nOJ}hTt4sW63F=-p!f|P;tY2GbmwH|BlCW}#K4{lS z{@xcG3?5@DnvxRVen69TsxS2_K_z5PVG#f*$AZ5na=ZHeFt=}feJW>wke-y;8Tjl@ zMTHBt^3fDarkwtDCh*Fe|4OHX9kwy1`DuT+^7lVG7+bl++5nqasBJQ4LhejyS?ij{ z*Iq59xxKz*)5959Q4?e&Hj7Ut{`s8PSFb zgJ#QKMm-#*OvLC>A0u~jTieT6vXp4lvq!GCjisW2S#}%W>LhE!5ls_fq!aOJry~R+ zdI25xFv5XYj7jp{yEHWHAx#Yc$pvoL+Gk7!;Zjjw^4-7yTmk}1m1LZ4 z%4m4RcZr*Ev9Uxma`mx;^?CX!ns##kwF4*=T!OE+E4^I7KBe;{pwDNnI(~4dJY8dN z*D3I+%UDdyXh%FsgR`H>1;qzvMtMonmX9-b9C-{$V9b2GLnA}}dzIc@2S(!K6})zJF{BSo6ngTe(sX|uNCL+d})^DpBMGN?;mfT zESiqO*DQIwT+xnjDOX4w`{AbeapCDSHSmQhZl=Y z)vo`&Apd#(WJSscmr4hT1zI?UUlQw8x*^IyYnybuoi?Ls-~Owqsoz&bzJ7CeL6^dn znB;UmmUJ8SZxVEm1QfpwDY%3kldW&H{@XOa_ivN-hDn1H2i3pTz8(HW|7ZOwX_wVP zyR|QS71Vy6+jG%VdHi|8^LGt4EYe=pZ>ji0%C9OnTrV1)w;lD=j-DTFS#s+Be{HFX zD33Wg&uaCYJ9hemzKJuZ?DmFTx@EeDHtK&M>|V}*tmBk*=m!^mCZTH9`K==b@^Ys{ zJl3#O2$>w@VtgdOoptfQ?>op{esyexkpT3;(uZb4t=~|uyF7dnnVVFRL2$1)-({fs zOrEV|s8X4|%E@NCDR;n*CPOa9VSmwlx6o`CGl}i{WVg#6Y*IDL7#AKW+?tZ<&%>EjNrT^(v~hBEA3rxQwm(kp zp8xH}#;O1fPHNcC`W@e;R|jjvSlhFiXuW4*7oNP^ z%+uPSAx$n|)M>Wc@4QslakXEHb(`q2j07gVKrt5m=_+bH zI|B})l3C-se?^`hZ8z>(>1`%!rWG)kXyHgVRnX*KI5k2|4bP6vee9B(u=w|J*70S_ z)?;l9zfP^v4XzPnq_b_dy5PD>S0mD^=I)|(wKBUT6UbrN7m8xC580UL4r`i)byZ)G z9FHn{Sp49PA(wW@ux;5>hgCMo&1!Vj40~PqM&Ew+N?oaFi_Uee(I05e19S;S9sYd7)VU8Pyo$zxAr=p4b3;qJ|5+>*lcCm2 zDNf`F8y=nv|i*(J}*BiAt`U=`tc zcEvW|J?}zuU6L{*Z!taMF1r~f=`%Yda_vaijJ8x*)|FcL84dsKcs;J8JUYLZGK?;gk888u&fJ`9*U^LoMWlB@` z0)?g#knAZ)^+~b-k}yD+M86oc_;uau1!xq(eUoBW$NhJyRmGv-+R&e&^Pz%fDp|I_ddB>BORp+u;vdhCH5=M&z2-f#**o zIY0(wole(^?bzc%VPXn%TYhanb;yFC$M)EJV2|y&KhMxz10OSMpNW}v$kj82EaUL1 zYX{-I0+3&xQBegUyPE2pI|J{WHi^Daep2Gg;2hjxM~lsA32x4>c1(;78oHw^PeW$D zo|pMeJawEF;(9oD%un)1KX1i&sj&0I$_wgTj3U&vX(p^Mwb4M@rI_Kol9PH^fMkkwU;GPV_Jzk zKT~FwKK__J?3Q!z`{_MZ4K_2^54g9tja6@-SDk!N|LTMIW7Rb6D5(Y+ZRacX3USl2 zJa_dQnW%~r=X}1E$Q4F#FC0&u>d(@@x4`=EO(^tS=zDk47ljw)-o;Kc=y&q5d-3oWS8$ zEHO8%9+02vMT7pFDJ^h_`kAeuAb41wsb1wtY{i>J`GTJh!^@=gICN>&`3WlrgJ_Y_ zbnFa(4OD<@bt!#OnWbT_L7}kg-D>0e`^1);IS+Nr+O+Y~xWnLKW4*MVF(-qFz)5{aQ#F_@$G#;^{jb(g7xh@ z7uC$O8>&v@y97G~8$2BEM11=9lOP?hiZ1g?=H$T_0ZS&8-UHToCl{pM1a3^~3zHU2~w<`Cc;4Ob=Gl`TWXKM7r6V zGweAfa&n*j+gH~!+EN)KWR_p5wrJof`56B$_0&L#-h|n5(-J{?YZiy{zrtTi7#P*K zzOZl^1*-2{M^{Pr`o*#vU$*GJHh6Qn@>J8K1kb7StkoO2%0dLp)+oD8<#6gK)8v@= zc^&ZkAq#%|!;WQFUUgJ+D{C^i(=}@{^z7Wg&rJPoXP*_ke5A|ib(uQTr?JL$?(d~& zOdIGIJQaqWEd;Lr@;7$Yz97JWb=qUR#?7*_mHHOWNqgpM_hx?8y2)ccAxjz_IWP&_ z)Z6N|iwG8^qB3}3xfG3&YOvByzsXhAXk7F2-&lev?e-vrwiOC!w4kpdBTLEZgS7^z zO9Uq6L>tBKj6{m;j`5L_F4C8VEKsD(qRzt9!4Z^<(`t&cvbzET)}8>9stl-zFc50w6+h zw0!ub3O}|$OW9!1KLBH40$hY<{n95gJ`;FbApQ|3raW#Ah7UMb#cj{Be6G(piD>OXF0-hpkR)yz7R#5qbajb1$^BKEvhAi*H*tk2KED?GiN*%v+)tNPOgg ztF|uklmwR3pjp^;$~IfFd4*90dOe}2db{A%faAGRI*IZN0)mXTGDY#BYR4ovJM`DQ zwVnb*PrApre*>s-a6c%G&<>g1zHtW+M02MV($udvCK^lR1w8Q=g-Gg*`oF6Q*zk<3 z^}DgU<3<&8tNzWC9MAAUU-GX2ktVac05v)K*dhcMSn(TvfKYyVOq|#755R3q1_g+f z1+6NmpI&smObA0#BNzxYdi zJI0T%1$R9HBif2df3%=FFU?R^RD;#PfqMx2q@EkJ-3{` ziP2B2W_y`gy5p4nXPrl`G`c5HjSP?u%Cuu)q;WB_T;_M!_b9%B#*^Xe&UfO-?o0i$ zDPLz-?fH9Kvn|x|cAuSd*U(TvI3@g8g8MK%^B+;VlB>C;bJQbR;U0F8z>7olX{>B? z^vzowsymp!<_|+mjG*k2|89b$4T4b$RKW_nuW!%Wma=0|#^epX<;l>tXFA_RmztzP zuIf_Vc z#4h0(Y(1e}-Bnhc~$74ai6YW)RF^jpVGFYQt2<8p5(j0MZzP2r7lJMCimMXuCCQ z{VUNmi^Q4({0#ghQE-thTsQZ|ds(i!UVCrp9kx})NK|vR0R>D! zSxOh@hphYvpc( ztf40DSga*VruF`w%h@rN7`oZ}iQtDNx_g}e!uz3JZolK*6T)SArd2#6+1L2RTwca| zHPM&R-{{F3Dpo!&C?E|BK`#rChrwc3lbAZJVpG5ksgyF(`Ne~P>clGIsj)Ru=z*;y zY1tjEEgd}C?(CtZ$D3pOXu_Wo1;BlY2%PdH2Y237ro)ao-|Ne->7%?bp04AFbBN^a z;EF)VBJA2HV*49>woY@!xwDq4ciMN6%VP6ub7ZPoZR&u0eFf&D%OhTqRxD}mBaBv|&riDA zgr-8vOUdl@#fx9f$I()JnK1%l17)f^Y$-S_u5Nn;BsOaRR&!{!=(5T(oKBZarBZDV zqw9?EdMbwPG_Fw(Fn0pcVHKhgfPX4tHWrsw;8Hg2hOtKIM}y$8b}v_VaVPPB30z7i z#X?`0lQkNgy_C3kIbi_64}B8Pl@(p`e&=l0bLQM)7H6Rx80q}FvxDENJG^$}4|JWX z;ZN@jOu8ss5IC+U@iI4RoKwd4ug?6FH=Z}kH_|vND(LuQS#L`DHC4I#1_skuY09=` z?vCYwSF)|y8}#1LWtJOA@sw>iUS=Y$+@#LW?@m`mH?@;CrRLC6{`4RVJww>dP%7Xt z8?p*Z!5i->=VhNN$vtLgvyb=)>2VR@>Jdn{5cv{K7$B3E2fc=6V!taj`xkjuRw}zg z|6nz?H#pYB6_7^cj;3J$m}zT5M5Rs4H?T8c67mZ0a-s@Gq)U9jGg=45IY~wr6@i|u zB;kO!5n+>1WQ>YT28wd5y1{|RZ%YwRZlauro_T$oQZ>+&9lnYE8!@B+#=8;O*vd1T zIh<$J2Nf?opIWzr2L)WFs4WyxPP`b|`tLa}Ao?Tl;?^s=BqJwhpmM7!e5IT_;G+*V zuSX^UQzc#^k_J))HS#hh`k!{!aO;{u@kkYkn(JKbmdAZmy?&a4IIen1n-!fd@&-*V zN!0w&$DD%<2#P zWOKo-NC~a*VW5B?P($6)H>;L-&fevTc*WtNK-Lc7=G+Oz)_ zn_0IDKMio;kDktX4rBhJ01dpxWGxIkLRK$$&N|VvZY{Z2$P8HByg^A^j(Vna{}?ET znSM3>a7;&*fw2Yr>$2X)$e3lw%e0<~->=C)l@T=sEPyWJQw!fZ*f(M_zj}LisSA5$ zV2o**h7VUxoL=@mkrsxZuzPREQL!#s*PukxwW+6tJ+I`BXf z3xMc5k)aBW6#7@epLfLD2bH40lWhef9m$jlOB&jxSW)1RL6pr9`7y!LV5UK(q57}u zkDa0V3o@>D$*mvvEbfWj50o!GF6r5^y_%yn;>mgG+S&;_<&tl=d^K-fi$ViBULmJ8 zKb+|X0w6;f%Bz?0m%Er2qqzZ&nRZU;!r2W)QvbA_g$`VjL1LI3#WZ!xlqvR5xkvo9 zEwbk8rl|BGkmt6_^RlrrO6U%Ld&U-KsLvWtswa@$Sik2#Myg9(r08h22vv2#hO#k4 zK&HJoXVsTnyXSjY*>0I`4Ks1}F#eotyW*!l!>gn!?!4=%PtPTWf{{?B%uck6XgA7C z^i|tdgnjtsYhQCamQk@j&m6~AJOx^V_0uEEX%|P+U%ap_N@!GgvNjTDDLH)wT;k~} zmCd1rMHo!4>hs+sODLF>xeGBv?n>gRM^eoV3Uub#Yuj1t^9ZD$95s4e?O3>50CNIY z+8{^v;-b)o`wrcHPdm+5H+kEtW}l`V5Sn8yx%??8+Jkba9&KM8c>bizvH_b3T7%IB zKaPfpYx&%?z}Cl4Mn0&tj}AQHE%laXdn7Lu$jT6S@S8Htw2gLryIP2_dLZ3gjaJ}I zVFUToCW?~U@=dgM`jXJ67R%HEt)(uo1$?6|j{Q~r^ttee03#itiJ%ZPu(<i`10Sz0&W|TeyCfoSt^Ra>$14-5)+(%P`DC`MPIfgC5sitf~GMF_vq_5|*3# z?mPl#9y4Xr3BeG@yAT^7YKNd_Aep*mDrMj=GqGAid3Pbf6yOXq7}O^RCq|+mD79nE zxSQw5$E*F(=9YVrodj>8B6y({CBe;Vd+PlbV+n3NTC4|c=ag*xIMZzYj9L@VKh3R3 ztt$U2i>(I&gn@UY-C>%4I(}zCdUZ0=JD5c3)$ElBE zL?_hULID!P;>AStDzrHvZe^-KN#{UxQK-6{a7tx%c%=69N?ccuWcZ$M;Kb}k&n)IV zvOPtn&GaN-4eoY)M5HG6wFHaT9r5fzXQ*$k!TVeBVbVEBG?jHRMwwL%;T zs}Rzn$7)>qK_PhzB_(K~^3dEdHg-T*I_jl;V%dBL6)M_ECX#^0={u>1sg9Qp&8pA- ze&YE3?`q!Lwi$vrVYtH>ftV4^d&e8OCV-|PVvx0GM|&|xyECon;=txdZ-&ZD)%Qkz zExxT0o0SWuW7(bUI&Vb0T7Und2{~)DHMiNHm)!mts!BMHR}5Z`){EeMYsDNbqdU7eV z<-Mso^fCuI|EP^U{*zWHoFfy zoUSy~-eg?*zA9yC7X4UC;hpA~DO@PbV)&9SiCb*CWg4OufXM;EfN<)SbpZZdz=BAD zdZ8?5hS~jrsr8o_9UI1mkt6#xzxofDz|V|Cn2tU7gt!k+al4hMei_pwLX2fZKMJ}! z6VDy_`ydX5Lm=ID9TFRW6jDyKQpHpC2Nr?=qIz%+3R26UJV!*g_T?XckX=u_hmq!V z5WEZ&?W}AIPPRpYu$r}4bhGZ^xgs-1kuxV&Z+C3*pKQ&5=o1lDd?)?*qWpmR4AWlc z8kx!YQwmpezelNwuxz4BN zw2O_LEdyGK2|%7d;-XiDVmsi0|AZoPI!7Nxle5#xUi@&Vt`T=Yvwc?E_r*Qo#7 zS;3t*XnrczK_4VI1F36CUQMbavu%qakR7ascZpN;2muEIB%RweR`f`4?=wTUm|uvVr9V71wn8)YaDj9=%(r3cf=1v$6Z&b(TK_t zk~yoOVPsH`@H$fMH25ekeFFEZxt#W3*tTftKf6qr--3d)j9_gJ`&=?Pa z5}3D}$}M&q)3cu-lz&Q=SHsJxcvzw_#q&yF8iiK*iVg|OI#Ty85ul9d3|N0A%u zVV$v^k{Y=Z*9u}<5VSLs3k&&a#HOT^yNs}gd*<8OpK0~RB3}ve24CiG=tfXS z#JBB}ER)_abunUa_sxQ49s$%K5JLQLg^W6-YO)K=@re zVP_ZW7b852eQT8|0C@2ajBP##fWL&H2N5p>MUYsDYR>efD(~PSy?2z1Rtq1-P%!~? z!Dv@}svHnz0uT%1k(QNn++2z+Oq^cOj#>v+qNHVdlPhut5gLJ+0EHriqBwA9mINRG zI3FY`p-&-7ltm~MluS5B$#RyH({NrBIQSL9A$|~&L@`PWBqtYN>C_THmB##6#{4H! z7j}9v{$YE0;Ntp$(8y})&94O!zhbWqJB?tyaJh^T>3ieF7Vdem0-@rirKv_dC5D15 zC%ac1y0wMDW8cy@3MVJVrle^TR07kYgvmhZ*tswH!rZw zJuF8{<&oA8{#e%zU315YozaXXL*lwQi6XCqgL-=V9db^3T-oh;{t%6pPjRu(n%Qam zfw%T9FBQ{GOj_w+SI_9sp1*#(`=Zvy6sEj+>x$MStyXOP93Y19 zTR}%B0(SGdkGV-+@jv*7#ds{5u-Qwg%MNgu4qv&OQssDJ$FcAEql>i)yM1rk9=Y#c zl;l)mA;h;~nn@p5CUUjXyY*Vb!Mww1Z=?DG{JPd~U-WO=+vaU?C)>03Kw62a4d3x? zwmnzdrQ*Y^jtdQiJ2vk{+lj7>HPLcAaJ zK6jpK%TQ%AilXUWTX~Uzaq3Slo5#CNy=5v2lH=bW-^}bv9AXHeTfcWti-O6=18RPG zTzfV;Q-<$e$BC-Z%!*FafMyhG@f*AH$TR&?`)s9wKUMhf7GxvXYY611wYWX0Q zosaU_MvL5+^R}U*`FdIHMv+b@1@p&ix!U+ybd3#v-YJbT-`?T*xHA9GHTUfO??+Xa z+je)mw%-x|HQA9P=riLgpxXB3QoG;_kL7XgIqUj1hp%U?D>k!QNcd3mFlQnUaC<-i zW_Ja=AG*=7LW-}&SHSa(a7BT*@1X2MMpr7aVvMpEyl|d z4&CLW4AudGO`3e^=d}A*C8dNsS*Daf&7Q?1**GeH_b|;`fbTS|EQjgKCx>=1cA+XCg4H{gnS71XPEQp&uHJ#`n5opUs4rT|A*zuW+vD4gxrKo_Z*TLVG)1^iO`J0qDwJa%+<)_VY`e#ORde<6T01Wmqqwp& zjyKgVmoc#OXw!6P#dfQ(AK#9j`pwW>7wz{6EXF#9C3wgNvBS7ud7Xo$&pM}ffPcE zO{4$BvW~*L+k?UaL<+*wPNBtteBL_tev9n2J8UA9mY>_)Y4kU+)?DDO# zJLFzkZ5w~zvz?+>E;#kmynuHnz8KONw1p~z zy68S#&ZVRE3Z~Q1V#k*{+~t*j!b?w!>?)76QKl;l*i-*-Y2Md@d4{5spYp1`nr*ac z3@q$?x->qUtiyt?w7>|)7c}GU+Y}RrU$v16uk(@)v2AB+sQc3Aj2dco==(J+yf;(x zDK(v^pIoj~@gMA`yXKnAj}{?}+Z3HZBpv^-ZZIh}$tXpuk19Pb(F{rp5CWmG*%?2fSn&2q}*b64%gQ(co%Y%ZJQY>lt=cvuNe zykBggVi+bjn9_5y{}Sx!>pF;hW38hhBfmP&V;Iaf@la;hNZ*g~4;7 z_VRwY!!c|vf37?|@b7ob*x|DkU@PWAN$Qqj`{l&``bDf> zZReDheP`?Q+0M1EEj6IIGFzTK;DqH&N+<7x#+gscy&u{ijtNe!j*A#@a-3>4x8U)l z_a9^#YH@nZXxm_rh#EhuJWt-zVAZf@nQ6ru$1ju1r?lCdE;{aeq#((;H(bD(MvJ6w zJ>!y6YF5kRtv&Ctik=prxb?BEdty|aR>L%RzVHQ?_;7|3ftnhEi>J(&<=Z5$-7Wvd zc1E6C^8PAet5bVbXgBIt{c~4(>h{aG1J$_G$FD6ofoIa`^yekCx$LWs{5A(lYr@LY z5?amQOy&)Wz~pAZLFdrMhhx+ey-_AYDb- z%l~Uj!*$JZaz6Eb+E@W%GCWBk&pcY#!Jw)gsAp{9ibPpWQNh@rijLjM z@Jh*PrW%}8La*$$a@-r6J9B1G>QZP{x>2d9jebX?w+jB2fYU@XXG^A zwQ^bU=4QB$Qv>5Od{&|pFFsU8W@cGTcAK~M{K?4F%&ME;^--&jD(2MD$=o^oboi0a zoh(_-@u8SkS$V~R-Y2X&_DpEB`EAU+ybwJrysfC;_uk}wi|I^C+NW)gjmDL_b6Tx4 z{&E^3F$Z2KWoJ{}u36bhjg|KsGK$l?e1EL=-XMErW?dqcZsEVha^Hj($KIjLvmwI2 zo^-k=&8#0Z9z5{X>tW`Cj_lRUvwsIXZq(Z2HFr20{0p_(aWVM$-PJlBPrr)OCK6`Z zdUITas_6n7JyzZ5S3Fs`UrqS>&!rz|)9;J8i< z>$LaJ-l>w@4-K#4WORmaP-jKnp9zlVo9<3@w+Ic8c1&Qq^TKa!Vr19F zx*S=Lu%TtTBV84&ZT#zGb$+S$2!y`7|8#h+(`jW}nH4qJ%xU?QHSy|=y)E?s-IjA>`Aiw#GF!LQ{2D71nnMOlRqaeS8GJqTCQy$ zQ%Ui$@K1hwbZx*Xj-Ho_Det|{7S7zeDZ*Sw1za99XmgFW4+!w}EeaR?v?=@o;D^UA zy`jb;n+;x?wfDU0m|yYg>SWdm=9zcj1x^m!NU}7Nar?;mYr>4u?&~RUs`}3J>`bDF zh}y(ji=2;BW5JVSnmaVFd~_M{Y^qP1j2Pb!fQwe8EKlJBoi4#61Jlrt6zZ2&A1@s& zzS3D!uTT9L_R2i_I<3j|*|rUf2|4#&+%Smn@7@{%tbs1t zgXl;&-adRU*V~_FQW7@Zz7c1$$kkB4NH0gOniCG&nrBLKJG0oNF}r4^w#}8;YPOHu zJE&@H|K#v8XmSLhjTt<8p}mvu)mslC;$~Bhn*V*eS<FOdF zL^4`JUoFc=2UY~cObF}>-cgCJ5Y!^fFFZd^_bB+Q0nO0NTMukS%V6j+nV{s$aV2 zQ#V00OND!h4_xjBo$HK+O6pr7ZIHS6knK*!(wTmKOHjls6R~1)56#jIgaYY z9&!X0gy7%XXSEee=RDE22pzqx_NvD$~ZC?eG4T;S`2nknX!;xF&hf2I`@N&KmlWS~mDCq(C8Y=ti^B%W-bPb0y=d*p&ZN_9n&=X zv|m4IywhKtvL7CJa5>R$bXz=H!Dti%`KSxo&iBL&2ev{qF^y|G(wngESL+2+ z+5jr9j@WTm|4Wm?$!$JePPByW7xn}(^|sV)=et`NBY*ALmszldE;jAdSVp9?CqHfM zk?=5RyB5v#d4*zW;=7K|kBilHJNli%q3*3!Y)-vX=q>bKTbgKiB8aVeJb`f^cS5a` z;?c@Rneynm^B?Z+H}G5@6mh}!4J5_Z0s$0`M*qcr!B^1{W)eI5dEG1oqege^@NEHD z;}X8{VkD;CtcktErDF@3#n}5nBQ0ZZuE?$jH@M9vPK|87%XZjL|H9~%>|Z{s`Y25k z=C;dGY*#Hs`=}G^OnNPZdw94(b3re-5UPNmHegm!iGrN?cQ}Ik+t}fq@a-4r2w@aP zbeS^Wjj##^2#4*kESLymPK=aT{0K-<@tFH-Nc8ABc80#jQ_Y z$$YinSh3+q`jCVwH9E6$!?r3{bQg$l`UiaF&_R$j{$*@4)$##t8HhJ6fj^82ejW+u ztu0{>2!RMK-$q2BYuAkb#C$NF2;85)t7Thu+SF(*zu57F#JD&r#-q&RI(z{WE=ddWKb!mSs2J_IH>$Q{XYQnh zp|>r+KcAohjAU{r!k86}3Duw??6T$`#Mz5Ht4{pcGAvpA)bFE*5cSOT2a3C%)n zwl6?)*C4D>vu%8Q*R**Hb^QBl-0&x@j1oz1R!I)e$Cvt7D)A)l9Hgh!gePkz<_w@q zTl}TqWK!O7#z3sFyBG{W;<|u)H=5#{^?9&-5iQm!kGt))Iw9h7OL$zY!*2EByT(Z^ z!L)=1g|*WXjLG|%cm22?5rWVY`*ZiS>hUjJ1f+nL?qdo9v*v|2MC@p-P=yT`PZfP| z+NgprNjYVpQ2o`Gjj~FLQzNyEnG7%94xf9!p}4Q=VZyfKUEWa@lFKi5njA8o=QU$i zIwrf{e>Ak8i}mb`3B!q^f#Mv`jtYhCMLm<4D3TTsTI(UBrGU(UEmXOBK25P=RMq^) zb#-H^+1#$%?Y5znNqUz$c6n&`#%ErT&{&XY?{|{R&3f_9OU~)X#(~afiHCzG^@`T91Me=kyG+O1>k7By*6thuypO19gJ0s1pUUM(R*I~Q+CXctPe5UoZ*dCS|J!4r#zzw% zscTroc}x=TUEbVWcU1Wsjv;7IFBLz1pP7HFj1ZPUuGUS8iAd<*YvA# z^ry`BMuIzmlSL7CF!2kM+uC(ey`l+EATc=y;qFQ>NUs1~ad5DuXbSqkF}m*fx)deCL>!Yu%C z(%OlYD_KIx5bweu6yob!ar_b4&}xrI=O#~>CTz9}Q^Ji}jr5Ki=$x9m404|WD z7elzqkOCw~Aeag2)~FN%|3q-#kBL&jkwzLqsR0E30K6N)3u35Qy5=KG9*3}Mg?#$XR7vae=XqB z4w%fY$*{b;KRZ20=7R1mK%hop8W0t$K-Lq(H4a5P`oPSCK)Hwz20gQ=9~UOd@Do&p zFdo7Ig0eWAVg$ns>AilwDF+DXf*8vqpn&k6Ni!AN(k!0_fPUb|V_LR~Qe~Mwy(F-7 z{?AGBq^txQ!x^hRhS6qE2FeJKWul9x3~w~6UXWNxKfTY(V*GKnNF^Dz1Ms>k_D~0A zQHGlnUIP>OKb%#%?XmKDcy)M6c;@f(-S%%dU$vwGFVqRzh9;_6$lHkL&!+`S6zX|I zfEu$19zY`*Fxnztj!^~#)68qm3}g8$XQU$rKo@tl?$cnQfARO*u_?4N8_}YU*-J2* zuvc-fm5hT#D`{EFMiSCAxn|rl6g7mQXF#d0@ zgDByJv3DArx~E@l!(9_uw|MW*HdDEaGfHs8VuhBwrRz!XHK9%FuC?*>Z)+jo|G

-t~ zPMbE`nHAB64M$3jz)u(DGQ;vnv>-t&DHBqjj&+n=x+BGoCt=vc_QFrK9@@_kzB<-w zUH#d@;`Ab5WFv84ux&XHHeS*fxZXlRArkab-HxEaMU*moq8ZkZWa@$&ik&SQceQ|y zoF%~SIYf>!Xl~9ZK1uD!BljUqrf3)cUixiFD5`fmbi`_A4N7-iaHE1?XykkeO(L7U zI}6E1@6}>T_2xQo$L}JSW0BrLwyC%0p0QR2V{&CBG!)Jl>CJbNkE8P6n5)8%qGk)Y z((+Df=DWK<*$LA$q4?65@kimP6C~m?`gGJ1*szeGlkrmqG=lorD&jC$B+Jw_QUZ3n zV|>$4_*6KRyYZVCKR+^xD5qk3eUGqfWQ}@EXp!OCNpb1Az1mT35V(dDadPo@ei9X3 z@fiFWz}~||&`2;;s#(oMFTP6G9AJ%|FxH5Dn&;Li>$G)bJbL*-47S(hfR;bDuzIZ%X_^f^--8 zrmNV=?gUNBJv?2OiY}GQhItV-9JdV%QNw&5{9IGr{&ED4l;RLyVq%gH0g&>2KGKiU zjpAyF3cgrvj3$I_2^{+d#2h))Auc70T5s}lenmI0y>MM^7A9Wzd+hGtQ4r07Y8WuX zjvaT79r~oHgHm#oHy<%(H%kobQClJ*rC#ZhN2Wa7_I#768`7FDyB6^{4KRrVAvh`R z3;hfR|LblU? zG@9clL(7oQk|04V*0zJLKSB!Rp-?cfiEb>8Wc=md*SUAOOqvPAfJ(#i=;y>J>S*SJ zLxsm_zdEK~~5VROA%xbZB)gWPTB`E5; zn_?|3-a#0<)?aAUHo*Z)hFav~bKbw^5{Menx2t2U=&Wr)zVvI4|o*0lxrA_zXeR3sYx=q(6txuR0!F&HtpArGp10j{jAipE!oy&7KkY+E8r#^B8&KU(0sQr#m49oYsiUEVWoP-4j=YuW4k*TJ=5J7 zNhRRPuNuJN%UgsI$zIn^Y=`HhWwGdXO$@%t&RDnHLYtyN0!`TO$A|3+0q6~$$fCvK z>Xh7y+={G0n!bRYpm8`fl1M%*vIc%X*B%!y7v%OdI84ZMjI+ztq5T_L z?{JuB-HbYJWf{th7KN0pIGGcQnT5;IwM%Q}T&X*qIR8{4hk#GVNKczc{xSDMO65)Z z?MVVBTS*c0JPN3`cCpTq`0CsiFpT|al5!!Xkb&}O@=6}mqTR!0cky;sE)W+Wl!ZINiY3ZM5)vRVQ1Fax}W#q4q9Cr zIGZ1MehPOgVWtyB??yxV3>p8of5CNB06GVKUrD%#xIXRI%zXg1SC8jKH!SMHoEzosBRm1~8q!oz89#d)N9rE#2A{77b=0Xa*}r_IoNStm!{6k$ShLkR)SR5^ z+yP^A@$9>y-Y7B)W~S|jy=u}6Ccmd9UA06 zcmXE^_a{thAn%7rPX)rE@6-Nj*q1?wB7$nAoV*<-T)D>8DHW_cL7*{2QQN#{IsRk) zBC;=gUAtlFDRrblz9X8lzVYH+Y;_pqNM1{5AL3^(4>2!w6-M(+`rfu>uojEVLG@zT>eHx0d-Bn)|fU{ z)9~cmmz#z}0~!M37?whxo-d{kQ)AL`sN3b9y-Zmwy=h@uOyf!uF0+jp_XWNjp6Rui zFC%=##3A$2Q8OooNaPIB(m4HBlHcBMMF8es|crX$-Y75AS^3U!2qw?J-$%#GV=pN|S& z4sz!|%nw_lqAdY`p(+t$>WpXh_}e7RO`uqT&Ex{S@qZ^qOt`xVNK*572#>Iz7tY|uF;PA{tUO&aoJ zt)={#1GR#U*#>2@hs@DZw4lTKWfj$-5~?MdtUVzl_7tyWjwJUs5J1o$`hC!XoVTB1#ar%CAVyFT)<9 zuRrW>Y`X^koI-zu)2K>d>s|tOp-m4ucq`Szf5a|Vi5MXg z#A!38*Rxv=KtIPzP94{@t3^?{gKLW1!e}*62~oad%(r$MwF)%7f7ibX-lDaoYquJY zxKVA_Na-lWIFLMP(X#z~S4!>gj+9e*7vne5gm|JE5*tmd({bR}haoufZIg+H_2T?p z>D#7An6+CWh}J7McUx{d`F{ey=|Jt*HGrSpMJ5L6Cau;%HK$=rNRdz1eRTg7M4*+0 z!RD@|4Zn0PI2e{AkD${IWJ=N^HlkQX{aSegRsC;uE-W z{q5gb)^>$-@b|EWD*fB}VRd65&-P|5q~t&#Odx?A-$4A!rp{}5x+Zq~^@wq|(q~vE zx1$U*##AY5#`eM*>bAWI-bmLhDJlZH9evZVmLGUC=esC=5a};Ak(7#ZgZ)Xk0Y9cC z=q=wgxYs{;Ns*7rMlx^SE44ngDYB-)ubH*)Pg{o(Z8>Akqm{Q>+AmeqJPB;NOPG(d zM$cnJ^BTt})c-l#NhPrU922OvKie=w%=kil;%*+(WxK5HHWTsV_bAT{deVbT$=Xi( z@hRU@x~cv6zaj*PemE1e;c9_fYcl>Xf4VAr1bd2>U#Kn7s0Q5RJ8P$xq$u{`+r*S| z{eP_5qNuXGa3|VsklJy%&?j0iD0SSA4fx+y=pJm8F__x#NHg)DDRo>=A>D=a@V013 zh4ok5+(}8_^j5QY22RU)4+}F{bf)z&<)t=Tw==gJ_|k6}mty?aG+fqAaW0uv$ts%!N(QOMG5`-=Z$<8X>ZidsfNmRWVo20nls7wsp;~O2SE`14_vJRu3 zjgy0=oD>ae16uwrKlvF?n^Z{**k!b~fqM+jCF83iHtPSMKT&6#sX!5dnA8+FYQr3_ z{w!61qpbcCXfI0{2NNKwAK5aMiNeJaX$R~M8kIAn?G!5^E)vNzFX1<_=a}|4t6{F% zZF`jkNh45quJkB+PD)1%1;CWHgTVqB6V1`F*2*R9zk0i^tgHY&5gVRJ@CWRU=EMGD zn|;Ctz)hz>tK8@Dipv~1Sj*vOSXb3Vy{}Ub;?(=hK_j7 z4MB`VBeHFS!!Depmwg7*G?(NAm*i7xfuYgFw>3uOWCLG1!@~V{QHiYk-(PX%BgSF_ zv9vs=3X*vocp(Idzo+7(Ubs!I%zAq!c&=Vq?cJCHd8-m+SW?`BKF?QgSFgQG2F1Uv zWqG-udLoe5yom4D?2=YSMxH?%F1~M#{nU4P*z`$9$9U zGq`4E^W2)6ny6uYyzTR634x}amFjPovd5rEm?KyM`S@|88@{7O=nh^uDG+!u9%3Q} zHX#O$#?FP}mI%<~A%#eP!cyGP=!hTjj^7tn80O1`$=1$C6yZ@8edN{(QS}dKeZHoN z_xAvU(kS#9ooJBFj{g5C7X(Z&Kw_gmq31eVG5Fz53&GVLI6E5KR6yay+!qctP5k^# z2oR#IeU@1Du%oE@LU&~$&YP!-Q;CCc(uxMaUcQr#sg2<=9-Az+^PlQVP1glg#0%=s zM8I*?2L7b>cBz;qj(gXo!@rNTGPaER4}@ptZ17bzntwp!9cs6xF0sn=cU|2e=yR_R zhgw)(Jl7S}G<4Xav>jO}+s9Uouz+JLFj|YNyk(Cz9pJE1Ga$m{M9`J&o^$*J*S*Zq z7(ZB%b|eSIo3MvQPtbwLz30RsX0|PsWQAr`Ak-wm@7XYv4TUIhaNmlpdT0v@7WO-P zE~1vLIxBN9O)`k2N`$;?`Cy$o^AJgP4L!s0g~S#@@$=LOy@@I3^b&GjNfv$U_Yl74 zofgxVbp|A9g?pvD5h*vZw|aW&zI;xH!thjkkzBN9`3a85XDc(^=jysA1AHa7+FPP4 zG2=bQcZW4%L5Z71(umX*rJbE{z)fuq*&F|C7SiNRzzmtkweGEcr2E#zQ{YZzDA7+H$l<%HI3 ztSvhNhFWT=evr%WOP9ujLKFwsiOz)kUQ_-LE7LDk+p@D$aI{+rb_7TLP+#u zed;neate^gjfsmV!6aF_-K6m9UnKN?$k(RsT9o^5&>vs@CyniU&G5eI5zA1##P`Nw zJ2Fkd@IdRAu{`*LKD`pLysbK)zdDI;HeFu#hNzph-BunAa%>F!rU2lEvbFYUq_ddH;|17mYaP~X1o>USFRdYbK7fe~KvQR2)s>4u;0 zMa;m(5@Z2?`AOL)LdcYeL{(TRA2))iVnjOJVW`q=;oe-A>n;NQ#T7IB^f){w6D`EP zbtu2w^oS!6@qUuGOO5}k2G^AZ@?6r)I}rL2je;E&ZG+wZ<_ZNMJUr7MlR7$29b}1W z$-kma$3WB=bLmfd)5>KnW`BxUrYI@3O;=tL+uFUd^rIoHlu`c~)d_ z#V5X#uBDr6u?r@oIaX4VELel_y^5aa|M{O8r3z!SN%#x*KY}NCaZ=3kiCyIst^jw zOiF@cHaN0hahq6O0H_2T$e%998rI*0+|)jjNZUBBKa7t*WfB`VwzSAvI|XfY!Nz{r zgogO!tLaO{4dU)vT}4J3_s||Ne!p+eT*_Eo{+G=tob05wJoERjq4w?Hdzq@EBQp{i z(dDJY?q_0me}_4Zq@5-LHcG{=@9zBzc}-OTJM%%!PmX}GWx+@G%^lWgeyslqfVlvECTy;C zdvqeV6B{6mOAOE^)Pa{Yt&d8Ia!X2J@7KMAu!z~9fWUzMw2F?%0xaFslvsn*cORil z4ya3F-KEZf9x6_Ow!giP?d$>&~BbldSy5rGHpF?7zlhN!opKkSoRWeWAHao>S5J) z<0w{G+$M0RR8$Yr;KPDaD2yQFo7?GDmSxxl$a}B3fiH<2aCE|5+0rL6m^1?Kd%H1= z_WQ$`${JgA5}>cXKd29G8%zA6)H09`&vUbevsQey`%WWD!xoOYB2L`VOkB{vXzc`^ ziTD!dynK0ieM9Tlp!&{C_}GXgKZWt%>qQL_-;6_10z;|Sy&H9-o%|NCHkQQfxQLv; zGDXeGt|vS?s^at7ezm)vIWKVAuf`Sk;|)tLjs0VmCtwR$b<$;TsNa4O(hiPO6hg=3fK*za4fR^H zV^Vlpy-eoR<3DRXRV8pcsRGsXOijnup7Xn_)3m?*g6g3b`yBEvO_dS;&tk;s@X)v& z*#n5r{KW2;kyGZ3(jCuI7Vg8*tEQ(%wywk!`xEi4B6k~BF)+!Yw_ohuk)cl-q33X$ zL6JhcAOerEzG6JB5Vm_hA~h}hkCd}4FVE+_fRrGFLsd6y9sHBZJ2FzC)->L85QYDG z)GnD@j}}Sj<;!U5ww%O%=$mz6kcp z6eFuZM@f)_o<%+t3mebC+ShXBm2VMX z61l6jNFb&H5%BI~rKaLfE-qRUGJUsuSvs!R0Pt0Py6;bF?$={nCg$e#wbX6C4x`cT zqshF8hB4Ib4>xS)jpMGxS%1wB7u=!*rnvt^J`(k9q<&O)C`hPU!yCzqzl?0Czvheo z&OMx#X4%+PxIgh*b~zSuH-lVP;(8`Umv@$DgBRsn;m@z{_7z^KMH{c=Y1sQr?AOBI zTPz*(Q4e9VYXyR*>n9;}^I8M>q|dfB@P}zUc$M(4d3Q&?7AB znSvd-nLPzn56a6+hvIW-QvdgQucwK90zTp`DPgOrtpl)zX*irUk_CgjiKWc4{aitk z78>74C1j-Fl`w(l!p8;cwqGX==j977MHbe>C2sn4-(D9Clh!vj#O?qfF`;h+rw(9E zOSR0ZR;tlTax5%DJDZ5{j^*AFf2c#%O5c=_b{_#0I!qf~&%~X9$5uaf?q(DP`(N+Z z49rI9XlYU4lCrC-R~(Zj3QN-CfPd&*@3VsJP|$ftR8f{YoSKeJz-eU1n5yQ~S`aUq z5$Y99oKbFB9p<4pn*1%|prP`=^wf(ku@f!N$C8rQ1jF6pl5)w|&0cUJc?|P+Jk6=8 zC7PJs zTwI&`Rj2Jjd@Iml)B@5wnSq_3WPDiOjf6X~_=cetbO5-0xH*xzFOIPG5~o!WO-w;6 zso0=gHy<`(qMX_}^=NoQBI;elFCVgvre(f~usk+5L`@{~Gk z;aI8|GY8T|?J>PjRAF+Gzv1L1I!-@@`KIl?A+`vo|-DqCEK}W%gtElR6C4Ki4Gv2ZBcFlyK2rsS_HHNVN-fogEXsTR1b@Xm-`Mlez{s}P= zj|U-(#UcwZ$`pV$)+5q_jk8>!{!~;^ZpBBO9)gCz5Is<;Bwfs?NcsQ@YQT=E-T#oy zh*XAkZE`mFqZpJPUdU@DYFG~WS|qFrrQT9_2^gr920TWyW8!vZ5Qg6jN5dR}RL4H9 z?IMHK+xZ@$vo>f8!qa5lnwZBI4pmJv`F0f_+U6-qcZ*99kp9}|ydOPk7@e)OR3oy{ z*@M(w8mJM>X63ik*xA0{8t#{xkgH+cqs4x8v|BJ-=yw#$D}S?M%jbo;c)P?QkB$x3 z(KCT;nZG9TNq6Q&Rz?OTOdR#6pfisMHIr*~p_hqYt79Q=hFJ1vH7QQ0(VeS#1o`@B zyd92%^3f`i>k(~>Oz$inX^8a#M0gW^i4disxZBuinC=3-TKoE3Su+xx2CxH-dR&P| za{rbG3dNLm#?&+>uJNWvBau_<5g*nOeI^!2Wn+zi&kcEve36Mj3k55D(j)I`H-QEB z&}FG|^2>(gMW$PS&GqzG=kpckgC-{(%v7Sr8yC+TW4P@HvC;0XzC0=h$MxM^l?vuj z%W-!U&oBIY&NReHIzD@+{+7=WeELXMF#EHa8m(=yX9Y5PH~Cfy&Tmc~>s0*69_QE$ zS_=V2NTau1@2pzw_xJL9=m9CsFjo~xTmf%)uFL}#LRevNIs&Jc9Ys5CU)nF%1kN4z z^%TsK=3P`a9F_ER#tb{G5v%7=;ZxU|0WvA!$G#_uE)Zr`Z;!3Oa~-AbxXV#_ zMwzD9!%*Kp`ecNj8QRu%&Z;sm3VbWqA!(e#Ai{>Tvf#gZ%yv=c-4<(mmR%-Pr`JUk z*CyCgg%5QV-?AN zWP|GP1cYp<2#pf{jr^-lAU&*TJzc~P60xf^3Dc&i9iD(H^Z|nchdD`K8P{};Ojx$? zBbjg=BUtyB#UK;QKRv}Uep4yt{iS;v#e^(4D)`1^_?M*0n^KW_WmV&;&c|&HHWxY2 zn|*3Jy`g_f!K`TF?06y`tMs#z9Y87_u2hySZ6x;|D1J{rxB-G(RU1>6W7Z%j!)YL3 zUprXaX#qE(jv{#qQ|jl#hlgp?{8W{2H|$tcps{x#!#$Yz$6J`Ums!L1gK zOGHH(c35M$5AG{!IGjc}tRj0>(%6AaEC_t3O^`Zn_YNR;)1BHh!R^-ZJ$!Oy6(8-p zb$mA>+YdUP=L{#Flb*?|Q@*^hXwt_DsF|V4wMKClNm9&tbwpmxFZ$-qr&!$2FG9?W z%U66#zvE7zdwxEXrLsSj&uPSUoRhwoE3Z^~OwlI~aSf1N>jWh`{cYO^y=y8uXC-W& z)9cPa*|}C%$}dDQ#I1aNe#>Toig~J>GVd6Q2@gdN%RqHEkinw_$BCPDdQW0OV1TB6 zz*e}2K@`xT=&wD*jP9W*7L5HAFN7=|867k+O>uxa0tF$wjyimfk$#Rg{P89X>jy^` zt-?=TaUhsXdN^TZI-)gxMM#J%t$`LPehnuPZAl(30~0TqnIVx`7$@XB#?iq1=1%fT zQzUGPLAB~+?`o++)1KNhy0=J)uepTQ8YhKeuWdV#WrXqJbSLy)o849M{p8uHB`quk z{st`gr>C|g;wd%Td5SgjmzZWQF7DghUg7lhlHJ-g$+^V$>HHb#uokvZvp~mF9nOWe zaJMswftGnYhjCg$n&DIN{^!#K^Cts8zS<#l{gl!|yxrH)tCm3lfW;yyAw@aFeU!R! zKl`mc-|lKvwjmo`a@6-eMXui{mbOVA*FAhB|SB!Ddt(_dYy*c5xHqAm-4js ze`7lIiZzurx{-G{{`+is@3BQzm7>yjW+0?y@P_i}R$;kw9F&ruVhK-o`)Hf(HY7r~ zy;gSAYL~OF(=@V7Yx{V=qiUqI0c{aKzpxMtxYY0$@whD0QC)9qbsb(4ivKpLlsNL+ zjAcCRq*YYS>AC6mI5hNrpuJ&Qd8gL#Jmg?k+DLc1=HNwz3Q?roSP+X6HZNe|eycU8 zx(k)n-@B1Kv0ur$SRrr7W7V#B%w4!{@ahc4oU4&KLM>a~~|cpEVc)FT;dI$k84gciCA)?zDC+Q0a?1IwmgkG3k@9G_K;PpJ_q@Gbt zC4$RmI?axN&zXKsi2~=3YGu`v{W0O;tc9lj%;RFiCt09o{0?IB8nBi@HN3rY*4EaO zW6(*R3JXyx++eK5De%I2Juk1Dr@l|-)D2UvgW+?dd#MlV#WD~jAN9)s!Epn zSpGW9&c4sfr40>iRz)EC+SOP%IX5+Ik65{VR6Ft>t>=eoAUXcqO2pW0<%$W5p~gBP ziY#8wlU#duoj|SsyRrQ~m7-JF?3Tk@`Q1p7d!e3=YmGLTy#!=}-oT7`jYeq7RjE8X z^-wx2T~8++S)!{gNsDa+kr`+DUPgZE>KB4>X?Vj%e=Z3DTk!3W%Wz1_b}K2h;0jAz zd@J$qL8-Q)NTo`3f=g#J(a(&_pXpbLaCt)~jJ?~^aZXEaWFxKdTGKA~M-(wzX}K>- z{O+^p_Tu@|jEf5ecC5HY(U;25S}Rh!f{9(a?;ePBB-{80vzjmN@vyOZSh{$pFfuMZ zq2XG*600DCj6~RBtkboL;m^9>zVr$dQLHrha%>hK(e#9}=uYFw0X&TtCY}*zjw8w~ zoseBWmGp>p^DsTmJnYX5xaws5R^K_Mo9|+F_`m-QAKIlVJhsJ+8oOph9L%CQ{2u_0 zL2LfC?W(f8gk~Cv;6p*!~%*uvNV`yz}wdGlY_F&QPU`Xd2c=@Gk z+B$mpT_a4e1gB!oY8#Y?r4#*{P;Q z&B`Up(~nv1nJ@ZIa-lC6$Tc!7KV}81m}fw3mg!@@Cs+>kiS^0lt@{Q(b->U+n=;1=aQelGxC8bfDaUyn`)uy$`Syzf+9O9gR1duT>A5;6O{zN#zx(6yzkc`1q&%D()qT6txcoC& zwBV2zDr*WS!Fs5DfviVY@>IQv)c;b_S4+IIBWRzd9P6H+ZKIE}SrSv<++@NJfyJFK z>%z2j`P9L{QrgA1=!xA+-=R!Ug#D6dEYn?TLlnMO-W3n8v%T9ZGa-|!vY}Dlb+Jq` zvhqqD^{!kl3>G-)D!d}}f*L#tIc?Om$tIiN<(FSJdljUwz8-7Gb*Z83=;|<`^X_}^ z;izMdwjG>bdh>O(vB4X>_!tZvJP3R5y%%n}=_WMKnq?JImBGLSfAjIjSbg=?vETmt z;IhA5;@Kw>c<7;rN!<4%dEh+-oWG&C{XQ^ zSX0v(q@0lQqC==WA*M>2p^n>50V%bGf{^vJl#Z8Qd<04Qn%I23)v?V6Yhl@8wb*8( zwfTDuY_;ARSb-#V$4%D9mh0;II#_1pP*hTTh*1KT()iLzGd#K_^pZAM`y-Po8jE1? zkXkD8X>^iQ_^B~9HD@t!P&pzcLA17IF?w{FjWFb>%+}4SM`K-!bwtEUVn`*@h%=75 zA3A6dW;b*oqt1%@Cd{5On~G=}gKBFrV|t^dSLsjlohei5Fl&0V5pL~l-&o&f@3qps zk1dEc=}UGpq5NG{UPYxRfN4`2QOYn!j~If=@=AM8?kcF5i_lAfmw)|U`GwWUdTOa= zX%w#ua#h~h(Q5fTEzDmj+5Vh&wS4APzoi7Ys~YoPdka@Wf*hjG;3o<9Q4#c!#C5Sw zWvFW;JCo$sB+fcpKCfu2vqFR{OL^59kK3LS(rIjSND@RTwK9?`z8w9`-#cU47!5<@ z4?l@0ulnf(p_r|Hvz}Y;V;SolZ*!3n65AjWB!XJ%lG6G7ye3Hg^*Z%dyQ+Jvsewd_ zWuSH-3BAH&Iq<-*osWl=1AF*=$Sah2d0c2Dr$y)m{Z7THz%ovnO_gfzKq?hy{3!24 zco|lVGS=${&WEcbPMEK)jSUDeUwMak3x#1SVeunxWzY;;vwrwf#v9ejd4!QhI<=^L zS6X#JsTY~AHkqUxvBM5EO-s4M@9g96oH|_ey>(Iu<08sFr_nNt93mv@B9gMRc8ae? zSq=gs1^g{SFK7m;0+%dpYG}63)7qL^#$9n@*t}+>XsT{9AJn<)eX)6iMaW2Ipq%-f z*GKiO!_=WOHkv9w=5CaI>WuJH&KnDG&q!EB=o=e5*apR!U!}D5^LGwSO@f?E zP8~OtM@NVE&BeoPR!ukhhUfApU##*_ws~K;59Fr6UGI*xdh&R`yH&b$|}snE({$!6y?5{9V0b; z)@&@c+>+RmZYO>>-p-KDkigGwsKYkfY>nlXTMnR)LMf`aDsi$qk zVDR7pSaY@2@yRD&qH)@EY(;;TUurNLA7IZt_Q0ykFK?q_g3b&-`}b#Jw_SF_aVMOD z@e?)5W{>8L`TZD06wwELdvJe^P!*HPrRAnZ>McunL*ZppiFM$%l*q2MDc90vms_F? z+ikiccHVLs?7aC3Sa}Sv(`L(Hr_EQv_8TvWRhI^K*=kvAx5-M_e$!R4{OEEc^dWi^ z%25eUCaA=xQ5p&$+0kjlHbSMD5+3dCo#<#ySc9r{w*v+YLRiyq84bDX?97_79}Y*X z0n|vIp6Pd4Sp`ig1`e!2M`r?!O&PWuVa%FYhuO2zsBdaUM?8U*R$dkDbl*-lwYAmA zP-%_FJ1~7_8ylxECQqHjhCdB|(1(_mCJY)JF#_Mv)PkCtC^Qm2V`e7_eu#u3iopX0 zAVw0M=t!_JPTS7;wY8NNUo~plRIj?a0;7l5V)W=Cc26A|rBpx_|MJoZh72ylfa(EM zwjxI0LyUJ>ly(DZC@)i%KG{n_E-x)LB}g3!O0)85_Uv}dm^u^9&8?P?LN>)FQ;Ig< z>;J0JFDb`zSG+FhRmMm|&Qn5l)f{`}uV?R(O4Ttn+>TVLN|{>mD;Gb?0}U{!^GjKo zp%R;+@+~D?9r`lTRcs`O%AzkAK$>JOMN+RU_LG!0wKUr?kge2LT3g$U-1$htA`#76 zDeVr&b+(wsOCzE;x9rzZcl?|TLnJhW`p#BXsi2KnGG;b{8z^C1=s`rYmE>NstHm4D z9z19m(yZ483q)UEhRBESkrBa@wFX^#8IgBAQ-#(`y7o4d&`6NXC)!&{h-j4$s+4je zLRk`|3=0IAA1sA##3`Ae0%kKHb4WBdVL(kaWlex`CW)%SgP1r!GE^I*;x;1j48wIq zv7nos{L;OJNheW$$7~{ll!me8R-B@ETDq&BPm0p|9VA6LJ%?r&^Nm2HSSX9?knb#V{4}}#EIwf&SYZe9}lCIHz z%hK-wiyocPp~7YPY-rMq3*M>|glYahIQ`p@FVnd^SyShR;$2=IMQ5UuWx0vJ{cK~H zKaB4pnQ7CZ%`AJ+(WsGol^v4F&Yld=XY`FmHm4Yj;^!U146PDQALVZn-fG%g$^p)2JhnS8=)Os;ltnXP;s16;{O&M;w8_|LrE#Hp=9HZP?V@+=Ac!_P4g< z@*8iwf%>|c7%`*_<3ITfZ@l>qPCM;1?6T8Nc<8|g>^P?|71+m~coL1xS;W}ZKKRf> zxc0j1Z3?ue;_8^GYp%K)4?K7uuD|xL7`504F98n9#KMeRgqd1I5x+)An26BJ*odPn zDT2GmKC(19T54UkFUWcypaPkRBTb!#^cw@qfEwyF)igQs$Xd3CGF569+xR=mXKa(? zE<&lEZO>8>OCq3Yi}YJF7fUJdwM)B3w#ln)daF$rXB#V}u!4$dDFf?lPuu9Tdi6D} zyt2GXd(@$_vKqAmt8J!Ff@B~R($r5X27DGHvCdFwqJD>p>KYr@s-XLdsv7Kfz(E)} zY77wHiIawK%^ z6sGDLXl`jhhNM`&YBN#2pC-X8sjRf$ie0pXvbR-x31p#}>8Yf`VfguIc(LyZ-;z)J zj%II7yYfD)VQdD{(nx;_piwt1&r)ZJba<|cafgK5WKrhp&pK{KH9nutK zT8~Uo3U`@xFdb$gRC@1YC7e1iT%7dJZ(9RojZe&HhvkXHcl0q-C zJ`cEMdR_b;9qsKbw*mO+kMh`0As&l`SXSk|pEADM-f3+Wp$o7c^rYnnL-|Dgf9foc zAjfKJEe=9?nSH@t&~$E_(rw>YdENJZ5rUap%J^mTWKRQ*Ei8X7Z$klZ#_qzvk$N}F zMd6l>X;v;<&{XZv>=zyOXaijKa|1%*0mEs6BVORDbkjgI-JKc0N|?uCAH>c56Lzvg_v>+z8i z%uHv7PntBzrmXF>(=Isc_h++mS0XrQFya(~B_TDx0V<&1;em%A!nS2u4|_P+=Pub+Z<0m`6Qlv{4qR5qxF7e z!-iwu{SU?^7hhnbcAcy|J~rMXN#2#WIx|{vE2B`>y=I0v{Gdb^QN;J)ztR)?Glo*H zx+Re(@*%;jHF;{jv&$aV&K1u&le3RD< z38n27MRF^5nray!N!C=#2o*oAg;d94f{l5syn+g!4{;KHT{Ze0rYx`#F$(`SwslR- ztrYw|+i)c#0-zD}Rw``tR~u)wb!v*dx2Cs_it6k}Z92sFsSHk(PbJZ;Btr$!W+ zhRUico1)*;+{t)_QC>k}5n?!WuZ_7PB&V~ZLO&}PPyC4Ytrs1Qt1aj9KT~o zBM)jZr9jW^DrTa3V0Ojp0$rtvFdtQCG&=0AQX(|XQ_rbV@{1NRH>6lMH6k9MT#%lk z*@8)Rv?bzpN`^Mf3s5IWWYTC&bZCz|w5Q{k*<6PXUK6a7+R;F3>H{P~B9^+Uj>;d^ zC)Ecjy&{yVcV_rU3SWN+^4lfjaol+Ab=Z27E%E+)@7fH4YAX5CU9`;n@B)gfNidZcvzwdo{9{jGpS}0Px@)YCwboh(2OoMQS}1IN z)DbfjRv&)!1?89G%Lwzong^r6{8nb@kL4|eZmc4PF3O|B4munwEw?gOT5%PeeDW!{ z{IaVseR`dj@BD6Qep~sWPKPem4Ubamq355Od^^-__}phpJN4U-=GpaT>|RPDFB2zE zvoK^{e))AAaKIs0fBlWI`yPAXy$?S?b90*)Ox~o~uB0g}{SuaDId{b4%3p73>GTN` z@Sp$u$9{{9ikN>NL>xsBeI%AKo$E@}&zeQudnc^B&U)B%)2*@EYOCQdfB6fh&zx=p z>#>;9%5vVx_Gw{3o%)`C{?q(d-;1HGjd>Ec_M``FJorJoiDAA|MJX(_^Xk*0g$S6I zGN?wDllW3wmHfYeSj_7<7&NGc-=y6L zy>uh-D>r&SFD!H{=Ux2g3(DaXzn^493Cp;jaz-<3eCl9j{(Ggy`wp6duQl~y5q!;- zDS$pzj*64=;Dd3ZhZ#N2W+@1Mz{9|sHUv)lE4+O%nQ%`ih( zS!ER~+!_sEVY%h8-+ud1DNkU~kiqtG-u>tu6Gnqa50@mS5?YEiDg0l1CAM&e%%A|JLk5xv^P4%F`3{Yv1zhNq}VRZ3cN77BNPm#zsqrR0YKNbH- zd714K;@A1}1}Aym2!@Gq+P1p;w0>p zok~+#6^VWc^P6Ns{-qd)(uxwMwZ!rg!60e}M`>4Ket7RP;_4x%(rg_Mmf!O-{-Rk3 zqYf}56wG$->a%jG-%=BFm13+8GX3suznuA>!2+n4Ro+E;rfK!sKumH#1T~ROvn=Nj zj+UUjrV1&47J(@1FKcAd--W87gAk*x5bvULs1B?UWfX;&c42QK32KgaAkF(oX_WP( z!rT0a`Rplj`3&bJJ2zFTt&>U;Wml>TpTGS+hLlxd!e?KjB;!YbdTW^G%eTLPzden% z*$pTq0hm!g3(vjuB0l=;Q_7DNN}?pW3}gDN)^44!7ZeSPlZ=$izDBZG#*1^0y<2ha z?lqk|MA_7ZY2Qw?8Iq@-bvDkw=n|9-8is2wz6|#~@i^+!Nn7%xqX{y6PqUT6rDd2r zbtWEo_z}GL`s=7&Y&g!j;QtsQAD(>SC0y{A%Q3r!Qjld_9atjb5-nb*R*+xAc3II+ zgD>c}4Vh0q^%T7H$}2eOwA1nYOE2T|v0vNl2BW_uY4XDiz4iQ~2j*wqsH4mbKQ4_n zz|&@mn!TmCJoUmWc;L||El=YK&7%Mo8#UZ??zi6i5ZByzJ$Bi1cl_=4Tk*iZAGSDZ z2Yr1HtBcC?fS+C~UHtt$D2*~MM2dR!Yp=bA7hZS)jrnC3-iSB-nFrKSrBT<;jyPId z+HCKE0c=k+kaoZU2jQ7#p1~uJJYqVsX1>1j&O7Gq?Ai4w<2PCuD5+$qMrO6VHP2f$ zB#x@8sLjUchB@{wUQPB&r}tNXdg^z7zkVpXQmlz=r!{)3r4#{vdwmu^%SCoxGb!@% z{XU4)YdwAbuA9)09s7-43yJeL-+Y_@MLi}OT}W~{{}?;=JG)kqFa;i4E6S3&$UQ3`Q)s1nzv~AWdH{ix=uSAO9@QRym z#gD;yj4Ne}4oZ>!*Fhy*BlOV< zkpy)_Q0bS#Nt2{T7%ru<5DB4bK$YEV+h3jWUJ@&1+bnH?oiT`M`T}ucW+fr!nWL%j(ErXDIW(Qj18FW&i z_0g`enO~33%PS+i585&WonNn+6@e0dQ~K)&WxrQ`Z+++Db-}NyJIY5vonFq!-s+UI z<8M38j`^)d(Ic6j{jVNW;?k5KDeY^)@~=+3vf2uaTxtodxcbW8QAn&mY08vPX&57y z9D^~-FM+`$hhpgBBXHswC*#1w55~q@ZiW$KMj*&C-^g60j`7Wbx;q)`* zfB&FE)-CBOLuv1e_dj^|J*>UjTBx8r(2-?>1`Nb0r=NoDw%?pO zEeQ(!XlUucpkWo>cb8GQ;p-|BX885>{WaR|UES|OBjr;@Gd`TrBxvuq*7-|j1xW9Xgy!b`;y~ zv@72K>@&1=Ca~jfd*Gh?ZbzhoLQq-sFqUI^rFutgIkut-`9S zFOTI{S`iZ_O+*KUmfZS6)FpW}qi>S`?GbxtSg*`@`2-RMjripxWBJY(-+qS=KL3KU zkdI19mQ_CJEWx%W&hOsR(T;6**d9wSyOee6th3=ds2)&h;i$t?ZH9tTeCK2Ky`iD8 z0b%OVdmnTV{_uxCpoX%xxv9x^^8Y?)34ms%mBymfbIX}L6(W)L*%&%>D2ba7qehLw zxqmnpTW+}}9((LDn|`mg)eTJz=5|4${OE?-q|#C|8ca3hQE6hfbnBv?AUK{&N=5`)+}$vkD$-f+T!iqFem27k)ICy zZr1Uk|E#PR^82ZfwXwd4+-ugA%8O*UgUyJb`?lFlxccgAZIgA)WO49Lg^_=BG~ZAt zgkF&{sY-6Y3-0xkpVO6JXL>Jtniqb&eE&f{yXp6W)}9qkN$K`7%FJe>RgAk=vZxO5 zr^$8x95Z4u&jHP#frI3N@ZK+_8;#USC?is^K@Ckr!+JqJ7$N< zDy<+k#4#dfnYrS^i!ko)Evydi|GkPqg49%jE#H;{b=dvvJr5NW@|)U zqu+Y2-*O|hNF(%`BA>}o`7we{w^UBz%ro7`%3~I95&X8!E-Jk_ipB`SC1J!apsClx5j341UQnNqMGxklfJ5 zZGP$rZHZ3Svow}mc1i5K_wI;Qm7zV^Vb3&6Wt$zg#+ao?^Sv~x23BEa!))CDulq5( zX%-GW@-Q^FHM8E8lJG^W{%d)Oa$1{Vs^fs4&WvPU*!ENJ15H2DF?=M4+LUjV)mFu* zF{AOxm!G1gjbD=QzV^oJ*m$!|(caNv^>BLqH2n6cqwwM@Z`=1wF>Y61dp*`&e_L#_ z#V&aE#n&n6BG_=Vjd00duEnOC?}*0MMk8%kUvoXy+h8-Sw8~m`tgi+Y6}LCvejnRx zw*&py2>Ty+82$B#{!M?s9h+^rE!JFTJsfrHarkoVMC<4~{IH{KXzdiX} z{syK_pNTcsUKjWL>p$3HhrO}cw!guBk3MSUIKjkfe-Y(LdrK>Z4c! z`_>1aVY^-T!Yb=*h+|GX1D|~}1?OFSB_4k4Nxc8b=U8^N^)24oe_?vv3|oJ_=Gtpu z#;obM@Z$foJk*GvuKFe|OxumO{vE5XvjH~Q`Zu`e;YTSuft#+s9)}-(I8Hj{4>w`1T|fN*`mE@k{#3v*pS!MR-?J8-KL-m%rabj z@nx7WVG0s)9Y+W}{O}|A@{6xc4^jTQtBiD(j`pMtMyA=$mc>e~k3xG!=y^+X8(6im zIO}zWZLgkv{@Iu0G(&8Lz@UKx%w4=QZT{%D!qwF}v3QkX^V&U4-*p`H+6<0xo3;}vI#OOIg^n*3$_G^A!i)ZF`zVz1``rKV{doEHmo44_*69=j)^C~S zHXT2zG%%g~Ci*?Au9bh4AFe|{wseq><7}2iODp5A`?!uE&7-bf8=ulH<=H*)uYcjw zk3O>BopC*38aw2lgG%6!hehtY_l@bTDF@or$0OGU@1Ys*sk`_3iwh&u{oLq3l~ZP< z?#;O}I&bgn9PBxb^GjFvyMGjBb`eEV60~DO zVHpER+9UVMX%T#_|5gcuTQNlFycpD<4iO()0A3wL_h95=qj14F=i;w_zRcUCin6>c zPoi|(qGbD^nkvk0Zo$3x+>ebn+}K7lb+ob0f^TX{W7-rd$2k(CvI^XA!%aBsu)}!0 z0kfOh5MuGQnZjgL(U2dh&Nke7%inPPF-Ky162Qm*{V-NsW=Tw+IvsyJ>r9-Uw{ z+wAwj2OYrg*pBnhy8xSQvN^_n`6-@#=1Dtdw4*bJ%PzYdx8Hsz-h1zLEVcBqc;JBt zamHCEV~3r0#tJ0ApM3NtW;e89>hx(?Y~Vm!{u!nY`^GCTV&;r#SYpXBB%pVi)>+@u zg1hdz%l2t__nkLz|3eSr`kQXVSdv-or}F8ipBk~h_3zi&@y*(AYV24NVqzRgzVc+v zHP^(jVZ+cuztoTM-n;MO=%bIu-h1zBqrQ5sQRiE4z0=6dM<2b1>#n;Fx7~IdKK$@g zBS!{`1r4f+3~G-n#{p-vyso(7iblT6%3_#2c`7csVpqHup^>1!&WnHwa1m9 zvASoUeU=1$TRYwA;)^fFkw+eh7f2K}m0u&kT2rstx$;;0^gT>MFT#D}jW^9Q z>#mOzes>am%i+tBFC*=EQ|29p@Czh3!goO<$U zIP0vl@a?zX;>8zVwDg~O=9w5YXb|qb_g*8gT1xP}kOIPTR7!FuLfly2V8XJztjr5D z59O&wc}q&X4e#D%{)-T57P6rIxMt1rW;TSwep{=~Br}hEOn1VgH$*z!Wk-4I^sknd z4s)wL7G$So$oekoFiEh!MJWU1Pknu}eKYAsrKMp^n&d5I*0KiKYjZsZ#Z4q#a2xR{ zZXbXAv6U^!YY}rTRr%rz<}05sx#ZFqIIxy-BEfGTvAA}2dgNMD@nf;5%_Pu?2$Ewu z?L%eK?DFNx4b(=$UMG%FRZ)ewPP!m;+JozG5E0fIe)UJF`OsDQq;xBNTH7z^netE_ z3==0#H9JA4H8_&&XIxvFlSsB@P+l5Csg9V;4@Ly@z>!i^4vtDjRi$7y! zrFQZ|I}4}fy{3B;-7>Sa0~O`k?A?n?X=#XIXP93Vs!Aw{M)GZ74jrw0hd;B4ECvl5 z!XFtV@~3fxm|yA)lFQlw6*g^HV6ysq#QDJ1?|u|9jrB3T)T87%w9WGjq{q zY!OBL+MpVwwm?gm9({VK#(;tPGXt97zj}HMk-#)+*3+$&SzH z#!TLwGkWHky!*WIccl@aQvXAY-VJ5b2=-(8b1$QJx{cZ8=$_Z=Kj-?hKiSNGtk_ut~<&h97N=wk$+Ki!8 zh_%7)2k*a)ct@L!$W@d^NiwM@Qc3h_xe#TNPfDEhIA*#QQ1lB8n^FiSd>Kq>oQbK; zGqCL*+vDxe-ba1B1^<5bF`RhzsR&er@x`}aP-!HYq+DBaP9li*a9liT(E3 zi}KWuF(az5+Da>$*Cmv%iwzxOX{(<;6>q%!0**c6x9U-~v(HaH?gTvh#D7rY4`Yjs zHo@;tJ{4bn{3$w`IuYvf;Ug0NJ$K#}wdIxOX762h$LH^UfOZn0+A#yrFmnc~f+eWc zj7jE!P8aEzRgYm&DzGE~XzxHd!!98?2{Zj2%}rQx^x`;Z&%N-)M;|e~Q!L-=rc8w| zk;3rW5Nb%S2G>+$IEnKzBdf9D+UsE2cjHk_a-oTmxlR%qzv@F8Z4I+<=)Qa5na3Z+ z%F8T;ryuzjeAJAmeK!stzVQYQ*nLl&_}im!+6gC6Zf8+l62+>^E{lgr0`I!zA84*? z;dcUVz2OFYMG~~{?z>~HRo2C=B%nIRbH=3E$R?8*Npjsm5;3f{97_xvia66z9g88# z#;ht2LD0xhx~BLUYaw41IyWy%z+z4qGJWtW}oUY#8x&YFV! z)KgDk!womZ_S#x6#Y1105Lt@umcePmq8s-1}?|*N{N$<1IK1j%KGDHz1M?AIB zpEl_mGiDgc8n6cQL-C$8_G|03(B`xoZM-SVN*hKjy%cuaeJ^}Db{t}?YhA2An{K)} z8XD7BZ@u;G$jEiqUDy2GdFP!;K4V5GwS++Vr+oWfFiR2*t<01zEH->NUeU<^CR>*FTKY6Xu-)RpN{+PyU+6T)KhVw3{Oe!; zGV-6Lyw@g-+Gu?B)z`Lsefi~AEx&i!Wfz=r#u-MsMczfcHA7n8UZ;bpLq?rIyY04{ zxv8nC!If8Di4#sZ+P=BsR$i|C57L$%k!z)YtF5-f5{oZm9VY4=(2=#f?Y0M2T4^Pl z9idGwzxZ-IKKtSeoOb3pHd~~&x)$$!_&!cQ^9AyE3{K5;b zF#mSMYOAe@OD?&L<#C4X?;v}{uc@icW}$rY$rqM)>V$Yydsz_bq*4dS>Z`AV8?OJm z&2EUqw6R|j?@=D@xA$IHV~y2u#~rtkJa?j%W$B8mufSUCtV8>C`R(2|LVwJ`zeNkn z%MCYNXKw%Wr}J>Yf%{n)nv#F`5l31%`{TKPVtks6%)j!=+c@Z;L$KIlOVRx${3dKm zsZ+MMwIWtghV8f60dKzc26o(LE3C5o3i#|}#$WQD-~G)uU&rQ~?}+s_*cN{{_k2s| z4cA^}9exKNd@znX{sgOgY8jXmTV86g>H8iF{V_22mh%U~M(OPbuQaS-`?M9=XDvx%oqHe~Kt#LGZsg^8Q1SOteu6Zn2%6 z{RxtH>fzyZ8l|jaF`7~~x>4p=ghW2fdKdC#5ux~t@V6%C>&%J>6;J7tGEusl!_Xg@ z5@x#@d$;Qc8^y;Af0yR3&h+Pg4#PB*P|MfWd-}bgSMOb2`|fBT3UnYeJ35GA7 zL}h7&By}1-qjI|Bs1aCh@i7=n;`!xAAD}!;C6e+aMMA&snyX=lt+&SVB>$7Y8H;S9 z0~LH;8t|ia)@+hWl6rmvUouWZp(d37eA zVZgvDOr1I&%PcVlgQ_YqbHaGEH`F6a{l-siu&u5URV6W0m-9`Cl%3rhwuC+e!JiPl*bvg&6t73 zs%j7*c`b=VP)=ofAc@r=n^z4CA5e{4LlXk(xM-+DHr{~&ia&34+^1$M>FE1V8YKS# z)Rctq{>v}p&F7xMe;&94qX(2xn~fvT(T>HaASW7<7(mT7&9n_D37gDL%$~_-6-YNX z!ru{xpWn)cp(A0G`F$8sTZ0fu!?A}Rg!f;46^&D;AjUee8VTYDFTI3+lVrd9!i#vF za2Gj$?Vh%*a8AX!JAQ zi9uySq?$UAX=yRSZ^xkcLN+05=)gf(pJep_62r$HdI-yo9%FU!kOL0FXYapxHr{xBbda<)lPC%0Rb_Uhv`DZvtP?a#Dw zvKcVlWbwrpH}d}3r=MZMgimnpx#yZ&kxm^&Jz>HGlB6~0-a9r=N3d!0={Mha6;oMG zpL+5sewT=i;%eEgHm-Iv1O)!H-z`losN(mQ(Pl1oT1;6fvdv8-^xt5}u;FOs_l~n% zXcNQQ0W1@ljKy(9l1mYJjY=z=4DFStB1!6`m?tCxS#(NjDv)EndG+O2u*@>c;Q42t z!-apk0Jqz4TIhPgDLMeDFbBbkU!z!$Rr%`s=UFPI;qQ z0{VU$fz{}_M!w6+O7PliZ&@dfzL%hpW4YgZ@4b!ii|8v2njN8z1a+>c<3vkJWUrYT zS{5PyE6S^kn7{JMD|q062W+N<$giO9At+uOY_I_iIN$(_yVmV1f3Cm&di?Hpzq8SK zxAVTBk!XESVYAIP!gJ3(jdA0?Cb{1Vx8HudmDT5;f7ars&J%UeEW7ODR%V5Aow`9N zeJ&0vvzj@fnHzuk%cZv5LLER)Jn=Zo_xqOT`c`^JR*V_F1RmkD_U5FOe|1FZIP|yQejDF>_bonR{ZToWfA2BRR3FyccwK7@HC-P92By&O4KF zW-V0tE{|c_ySNmHyt>-iTS$MY}z2Wzgq4(`7H zJ{-$$pgMQc%{SU9Ze=m%8`G_{^E!?wyf8vA*_c5+pX1kt~(@ zA7D!ICQ33;N~7!dnUX#xnvHuV^TV$F#p@Ska!ff~&s$*fcXH>EITb$WBAWsF z!1r+^n(U@;K|bW00z!jpm8tvB%b1;ik(jL1xNiGSGHBbjwXx ze)tgh+Pvwu*`|6dx#}>WjgcW)TxqG1Kz$uLCNs5DYR$)Q zXv7MuuYtwN%5lk=XJgG(NuH-p$FmPSi1JuDN`fIgd+!6(5BV|JE-bgo3i$moN29B5 zHokn}Iqb6G26*ts>(M&lTRvym=xoRM58kogOAn|)z1E5|E@h<=1nHOU_{L|#YyWx# znOU>ZF?9w$di8Z|x&C@+o<0N1lOTWj;fE}5UOjyK^|v$}h`|E}+Ni1!(Gh-Z&xQ;e zW@Jg^MTBdKC6=(~8a?zzb@^>brbYNQk}qQRHOX%-+l8S+hvBB1ZpNfZ(@Cm8KSbh^ zBsL`^SLNuW+ot*!`jIw**xsJTSuTL{}r?-wPEweh)wMXQ{=P#NwkDhd=Bmp{%974_|!o4Z3#Rzk8QTu z*2sKEM~e12Jo)5PSZb-IY>IbFi$=*~SZl4dF>qkDm9M?`-UkyWP9mucGmmSq*Is)Y zVb;|AO(+jUM%A&PJP;B7^Pm50vnw=Q=+B#GO%`#9Y$jU3PWTW%dRkhY( z(9w}0Y4$n=X3VHZU0pNIKKoqkyYK$E?9$8a#00t1x^+#(zwf>WaQ>gpK_b;<P z;AB56!?=%J7UvT07VZ)6##+qxchtp3#!$!}y+in}iv5N$}jpgE|HUpZ3l+Y_Y}W zm^FJQT02_t%(Ktp(I=l~UGb*Zqs{AV(98%;&o3!0!GJ*n?a1_*vu5Gl_upguHo{sY z-+NQ`ws&^en);EW#^9cN@5iLc4g6LKzMr-kb83H50095=NklMVj-S^(cDywWlLcb}lxbiBz{Vrt+ze#Ibi+wjOC74~;W=#Z( zQ18s9`TXLRwB;yLPZ>OJXs-Wxr3`c?35j|X$X z_hsDoJujk&{^5Euf4#`Dfv873*^G{+8R%@Bh4#AXXq_0V4CQ@Y3dI%jWo>)Z!+)m zSKZIe$bDZwEFM!QqIuf*1->>;W&Hc`^Ot3mhKV%ei`O4;ZD#(dtSc{7##9cioY{4{ zjowDsL}|pm7pkhC`EQUCVYLH~Qf&{Xrq!iUu?rUf?N<6Hp(mDeYjZH{3H(3Wkj7p4V2!+H( zsu`FKU3(*1b3>rD6Uz=9imDvH70r-vDYjjEJ?yx_hDMYsvpFm?cqn`#l#yzb@jHI= z!AG`n)c>7(K9(3X1V{hAH*~ZlKA?gk5NkEXB`Sm({bmVgK}z;JFT@Q4&P!^ z45!k4#D!;B{EpmW6CAte9ysIZqj3B|2cl|~<*@Vbj=}aDt&furKNP=Nc||0d4_mLb z2C7$B-2AT+DHUpYEi1!T8?B2MA9?_{Ty}|PUx1n4e8pf`AcqXe+vHJNfy8u{T|O7a zzxNha89odX-=_jhCAV|(1Pmp4Ut*oLnQjv5f@9Y*%`JHSng0MohXdb@$6}gIDVJikZouJ**%WfXak(R>&`fS&)spt0sCS3-)x1U>#l*T z&iwW~;8Ynyo4S>tFwB>)o|?f<`s3zWOSX#%*jm_PXnCWFy6H zv{NW0iK}86)u^b}wXe12IyQnU0{Hj8|D8m#RK<&=X?gQsgi-!!>an<_qJ=(4sZ-ev%lgzc#7 zKroDHGiG6%EjGh$yX=bNPdE{SNa}N$6xv%`Y`U`sxiz{wyKbftRS`2yWmZ0lFlt@D z{5s-@Bl4-92Xv%do&%`!!Rcf}h7Yp)6;@c<@)C z);I~8x7J?YOPv66UtL{>ufF=$$n}5$-b@8S9W&|}VfI)V(8#eym6u#{6vmC4Xrx== zh&XCGzs=CF`~>sA87G}|lFdrE_10T$)Lw42v7$O)G|OU(Ew-?k4BGQRc{Fk2M4O7Q zk@MA8UjrjYE`|5sf8R!`wR~XcP;c|_p+g7YPk;Io^YBO;nZD_!n`}u#Dao&lIu1@b zNmVxMq#P;@1>lo0!7;nD$D#LyY-zdO;GiJG_c(InUYBsxO2k7g0oSsLDtXtG8N$L_$`=NI& zwP%PPqhzAEf9|#7hs= z25M*^Uxt1toJ`Z^S5m~J@D$3r9~Vpy$*q!*q1L~V$K>C{OTTA)*ivo<>g zkq#|apbYT`C}WfGnL95B7auc%3UmXek<2YlVyBTOO|Pw~8DQjQ+}N+Fz%9oh{Fpj* zsvT{v^on2%tQvrhX38~^_(&jTJ8UPrl4!}c;H*#X^deBiuL~r8URC2Cl}pVi5ZR9S z(A3h3Xmzbs%Sc=!dujM$1FfB#HM<#$4XR=>?m()&1C6LaNm&Uhw115492>Oh_$lok zF0fq|0WFV3**=3LuNAem6;}V78rx{E^5{prJ&9G(|TK)=R*32XZ4=S^h zOM*d9H%TP3$fZfUdNS8HA~IDGVTiRGPCLX_Q7%m_BhjHroF*{QIGMuq>TrTonKN^}mWp z3Al)KcXucu(%mH>AV_yNi_+cQ-6h>fN=SDtoeM0nur&Yici&HV%4=tLW3x7w@KqbpnS{i7DMA{IX*s9bP7UaLGY( z*yYtO$WJ%oI0lXo82k{QcX)a>9OFXwUrC(*auT#Is*Lc*e#tf`#g9jx4&s>+m3~R) zb?}03r0Q@v9da7F!`i$WI?CR?T&x?xVI62#aA%(B$Op{m#tjV(#ODibwyshZ#r;## z$^t)6kvCkMj@<}C6ErTwtP4unB?(O z>`tjvd$KTWc|-^f70;(6Ap>W+C!4!$0qb#*=dT%D-8X={?{chpIS~-4pW7b|+**r% z0p~et{5RYaz8;82Wrx0~g-x8nJh#t)E#$_iPc;p4M?wcrT1k1?xcU@uYp zQ%0XKXWF>GGNEhdkPCFDRJ|J<#&A1WZuxA@JrSkQb_q~RxZ#eXYJ z1iLK0MIP%eonwx}rufEdiVM=dGYXk5gJm}>Rn11zk!1wjE@%~CcA;~e5hT^hmVT!X znYZ3Oy!*y!?^AmGvc2b*D^Hr&UH}2G7=Y-h1|AjvwRuOJ&z&u1$rBkp{>Hc{-DvY_ zlhkQQwdE*W{$CHP@tkJLV5w1o<7Vr^<{q*Ax5mm4b`^iprcWfwLhd4T6RCmXgpj^x zFc}z6+g7&%Z+HQSWIsYF0}FT;!Ogy3QhY1F!*j5q&@BQ!iX&fR>rstwn)_GUmw$P- zmCAHKuykN!pkk<$jo?EdpxC1N&7|he?EUq_E;sS&Ov=5Z>bK+O?pY<<08P>O)8z8} z2+@EaZmFskBU+mr`d@|>T55Rw_i0ua)9tdX8CNH#P$}&i&3RmrPYJ69dT8D-Qr!ar zMp<7XLoGUU>rbXUPKPCepaODZc(r2zGDrA#b`b&*zXfa_pXM6B?hkz~xMSGd;3Vrf z-KUgabwd?=A&tziijhkwtxj{>?9Wu~Z^9S`Z7{z)73WO*aM$5y_^~9FhiUo#=TKLA zG2r%7q?Qw_p?$+S@|Jaf>WP?pP`MU!Lkf#5e0aO7FET8F)8{vZ9(@iKT19kHf!&Bp z!$fwJN;+6&hW!d6)*}y&os_4u zSbz0V=9f*1gd8rb1qClI6Xh*QYsk3#pHONSH;8sp_bB>~j0uRsW(U3A@9fAHk3uUkRytKR+QJrimvz6}elyS^ zt-q0$lZ))ID%1=#*iul32WXIGdO-6XTo&w%EMF$zr%R|aZ;P!_kkpQiKXe3tr%bfY z@=M|`?;7LN`wqxVbi-HI?-#-M>#41q!BACQqJiV3dKn?hxCD5LR=!6crThK z^2uKfi9eS|K93@AEn|HD9A%5w0_(c}R+8mbuY)SjUQg3?YbI3Pd1^&{Pi))pq6y;U z{MCJJy>>jk;#)>lQ!iQjiT~p@1VtZia}%3aT3rfsF8dC;V4EI2$k1&Oa5=n<{&d&; z;dUqC-+atv-`p&W)Nua@tXjgcMIQbGoDUI2_5qmle}Gxpnt0uEFz|YB(Yi+X*Ynf8 z5wPF^>dMIiVS~y|urFF5@$d57O^Y__4`%J84y&AhD0|MB@;Pl9Pm&2f8uO6(!q>l; zHYTa^*5M$fg)mpPP{o(wzMg&a`)a`;rW3I=nruYkckI}5ePmrb!c<}Wk5VAd-WAM+ zb0>^gB-gWTWgNTya59@<8y0v`pO=SLko*<>oJm6Acfkh_sF_+xGeHj}j zWrvTvM^NTILmC)F*y^0^7E{d$xm(Ig_9xaHxAT_QRVHy+U-uS<2sHa{Eklc1MPcKF z27p_M99_C^E}^8Gsr96O&yt6mD)VGj74!Uful{}VRS?U)64nDQ^;JCST?wIkH5kTud;kjv_gzNoyq?Jn?O*~wQ!gl2Td-@tn_aA1V zoR%BiGN>v%pK&JgJLJ9u;RV1&S-419oIuH9HOJmX^Y>XN#*ftX3;NX&%3lUuD^qj5 zf#o-jeX@3qrvf3`FZ?fwMY|Op`#0juLjE*hr)0U3w`gTh{fUFjF^5!GD$}$+Kl*Qn zF?HbtVr|YWZ%$rUkA}wF>R%vlQXiVru6w&T#JU6fIwsVndn^{tmrjuZ(-ltwWAmm} z>UwOo<0Dy@1`bu>&74hm#EgC&xtMz#H5eaUL}<|cCXk0sh~i{I``z(z2BlfZJ7`}D zvqzk@UOno5$~%PG+LAW0{~WpoG#Qyrrj;sp%R+kN`qODHIg^Bo(wZp(FO+T+&u(?U1h?HkNcP|b{ZH2ud0jN_I*%RTl#Ziy{?Q5T&+nY&^3+n_%4cDsQH*uz7NH z+0L_Wp2segSdWpqz~pydMb(*R69wJnsu?bANzq6iXX$RYrU-VE zDjYo|IVoSj>~<}tOuhpaj-xYmrS23iI%Gpl9k}F`fm8o5=2FD0_4nV?p9-JKU9rVW zsRIbYVuqScB8S=`n$pI}mS3-;k16C#p=a>5N;#9a~dD8f3*fq<|pB>Rq9xTH6 z^9qF`$5md^cj?evNj}I}*qhG`I*m7_VKyT4tl>)r^;~ZQ@avDig`(%ltGf+SRf16UjH##Xf>vE=*-;Yo`C?#h7 zRs1@qJiBT4iKhsIPiF?tF0sonk}%?w#A~PnA6>uH2}7&<68!KVgYVWyfnH_n3D?Zb zom}xel0+1Q$so)KvnA2 zl8LoOsLo-79MOE%A_^-IO*u!i7~Mo__I^va#76i+YOqAW$FIZoLCrpvH3@GaUQl^A zk8G-TX*b3NLe5)zM09pBV{I1!;I_&AbK++!dfm0%84*ga59p&zq?4~cW#wIv9P2bQ zer?_BVHlPhe5Ek{Vfr+*QwrkhS|}=l?3Y~`QEKw|F}*=w@`%^%Adcop)YE-Aud}rP z)T4H%e%hxqv3lUi!{5;CNu$uOpk6@>w1&P_eFy*gt^M1CDfxZaYh|^gS%+5jAF=d? z5e&Ve-{aG<6KKOyqVv)?L=90%1%_z}B$*O6G*M=)6n#+SecUmIZxvvfp^EBI5@@B8{(g|*`?3_t z8b&FI3ypcfq>y`E-Uu6}&>x>TYIBmEFH#-7DSHLDk8yH&vfd-|QR}ylbb;#>#`?dWMoO!dZj=&zx6 z#8RgzzpnRLr@j)d8`zKYT0=%UP-w`j2)tD#{4J^cb-Qyl%5(JjRyzCOxp~Sx=f6hT zaa0@nJ+!ifJj0ggRHZXz(KgLb7p8^x&2C5R#y@jEMvm}S*at~DXjkleQt#Av*Unnr zbvEbm+S1Y&ihNLmL7sm)I4L3VEQ7j5LQ!Px<9%ETZl-hK)h?_{@11B*a1BX{*tfca z$c+&9RN*&QpL_L%>(ht-nFW_iA3M&hDXy%3crVX)$$iV=fX9b+Tc^&g!S+_sF8X=r zxdxXLd@_e)?&Nip*(e6zLkb>+8^2cgnF^Cxv=}*FsBTBC~|Q+ilo}zZAxy zabp$fx7-~<3O|jTJJDN^HoS!+Thi-wP522o$xhn$uyQzAm+rDHn|t>7VUIkJhX;8s zSY!L4TP#T{XH3y!s>O6p9EuWmm607VZA;l=NZCiEDl=5*L)xsnmWeNH{fw?L*4E{) zSH*9OP`tYLzq4`Nt(Y3V(&w54-E_rb(JnDOS{fkbTs8*y0UwYCy<(E&EuqR!*01y| z?Ew7Tuwp8Xs!eYAy+o+%Us+dIUMs5(Zc)FggOy~j6I*i7Owu7|`tN zj9WWCKvATYYVyfHR$0y`<}=2!0p*J}v~%{gGf3+~XEhj_{$QEQGA|Tlqm7mJ74Oid zI3@0JHA;Z1WBsC!a80m#@6@kXA^D`YLxC>kbb&2Pkuq*Bn`PN2>gmG1oOz5Z?#R?+ zVWF_SuER?zW7bnjdh~q6KGW25_*dqR%(Bz6Mzr=4?Hn-;R}Io(#21GTIBeVHL)ZgU zYDlZOkuE~+NzwFTH9e_a4qkcAH9a6lI#DEH|M7f$^pX>Rm=F^LOOiVBRbx+NZaDhI zl%9XvNQCCAk35GKHQn6Mkeip+qX5cQ0i7hr%{r(Xby{B6sfL6qbZzc9^QJU~X)<61 zW>_}Jz9k+&g^BA%$ZhZ2TO>k=XQpw57=NoJk-`Ao9k}+f7OY?Kp}5a5)y0)~(lcl% z=g7`~!};v?G|nzU#e|?whVu%#gE0Ms7dQgxEc&m875WItdo2wt{Rv@2O6Hb1l4z1z zk>?R6PHy%avr;lYe2+dPJCJ*i$21Q>{ zaPZrQpS6UBpQY=A{(?`X*2lO7+?NQ~?q&QRU%)1(yWF@w9i?*B!Pf037?hkB6C9ZB zLS&n$}x@mS^_$@{nTE^wAbto{6a^;oHCgVdgF&dTcvet95Y~Rn6+(=Q)+tFUO zIf5{PE7?O51-314+PK_p{iC^A=z>00)NLo_y!0Lp>N2C;a1q3WpgxX$oBa_jwPRX{ z6n+L3?ktG&*oQ=ojADysApvXS?*;Cbv>Gy+7N#01k_V>n70|!uMq}^X3wKReMJQNO zGAL^Pd6{yq<|0sPhCIeE5Qh9ZlatB1B``VM#PR_yqVwu;qf6O}*AQFWb@p>)urY=r%V zC9}tbs<%6A6|XJs{9&JcbfW9&I^y4zjr#JvrK^))jEDP zKJ<^+CeJf)$v*bZVZ?c&`RF%lm8;xLu!E29;Oij^s{+O~ueG`rloOESYT8+j&A3+Jz=&cBdiZnvu6US99#vR=q z->ExgW`>xBS5^jB2_eDdQNN9?ZR5VvelE=LCi(%&JhM~G!4}m0-fca2osrPrxq@R& z<8#qOkj}xp=mZ>Kp^-i&A7=0^z2B2v_rU8_q-SA)jbP_-h}`W3ML2^*3?Fd0WOpTY zXGRimozve$St$i;u8yaq6mz9qF!aCH%qyx#rqyTc=W^_yMoTnf;B3Q5B$AbjYH)pj z*FYX(NT*~>F3ptsHzQEL{sm%{TZgdCnNExFGuKMA1EUI#rU_w7oq}&on4P>-2=hHC>E<{JM&_N9q{&>vbEh!Qk>2^q5rix=2pTF{OfLZq z4|pMW_x={@FmpM!`soFRJw6=nmT!$s)SNxS^X8e9 zM9)KT(eT^(&OJ{{c^Z5_E)tQSK1n1h8c~m3eB~~CUeq3044G17Fr$X&-&KEH5OiV} zFo=6*z5nvmtPmT`!)0&2ca(=z&l`9A(M`p2mfz_xG3yj#hK*~@@M+Y*GvEGbJV(=D z1iORU#S6)DhHh$>+3Ua z?PDUcz?D%K8p*G24@XLvwf*&U)n!5jq~YBdt^mveIEhI<=&Ev?etpu$#?y*0{3g?r z;6!1nq7rbLxbd%uBn4~E+T08G^5f@t0#wNmNyO+(vPo$7XK%Nj`Z9y#Q zv^>YLpPv`LIrY2q6@njF-|Vais9%qndmTyb2@mxqP*NqvGsbg9hkoEvl~GzN?O1IE z`HFhepi(Uz{c`WTrYgNyxMg?unukCjYn&8Aejo#WFV>+f)XtsE-f3snC6xz>%J=L` z?Q!m{+8?4F+Oym-_%9sm|C5Ns?V>gq|G-ZLyI8QjI54T{1(LssGY0B$_wXt zJgq_+pHPFc@a|47)Sp_$U!~O4G3TRd7i$`5NNM6}^0g^yLDL#p{y@oCtdRfTRl((? zFD$v@eRfr2m)T5sd4wwr^5rl8H(6+uiaoYb)*VDn+1wXdyN`#4?v<9`cg~f+kjt&1 zpXe`O@A`>C=0~=!B(t3tLe}St5D82%@Fd*sy2o>0cjte4Jm@|Hib%X3(vXCWB3MEL z1&no2LCW;zJd#RWGA1h^_nuCA9B63W>c@|?2YL~is29=`64|`dtf4-@#}}PIzAdUH z*~FikcX1QOcU<5Oq7{_Rk2;=2MHiQXeRN`L0X>Ty7=W4BF0^;nT=T<^NBy+T)-*|R z(dAEfN~TL4b__fz-P;6){01bAhC5e}js!@)wgvUx;GIJQN5TcXR#`xzuew)WHDuq? ztIGecaR~S+;3FMc`i}W^UTGAt$q**`A0%orj#|zBn~)4Scp5(`A0ewss(zjr{1dJm zkB_RFr<|dWbal7HiZ<)I6N?u77PYBootJc%cC57g;CHO3PW+Tsd>`Ho5-VTQ`fqam zw!?`XRR(1V3tD?SK;~Kn>}qTM5Rf98xMCc>#KqNDm|#8&&KAWMvnTB{psV|M+dtf# z|0{O!cBPSN3i~fYNdEMr8jD5XSCtM4|6MJkuwy`YkMMZ9-RJbaws9`-Xz>WojbMNR z&(ZEj*Wi)P-kG@|#v!H6A#DDaFq7KeDK4Z|$3S_N^soCrR-wW{WiG>hh^~$K6=>_R zzIj;hOuOVmTi!)AS6*Eq*Y1%vf8EE7p9R#AdYwZQPv9*MT#A2xh^Oc7(*H}EzPy}x zW{$-!(r2Mz$v!6Owz@gtR}Ij54n=x7>#v4V3iwC7Q<$!xBEgDNFo z4Dq*8l3yJ_y7DoL3XQx7|7J{+1|sbCXVUs87lY)XrLGCmE6D>RW{wy8|k>+ zfZxA2QRmsBfIT7cXw-$#XHz7;H4DeeS|3_IeN&w`1o1swqi+VMBd`ZH%0(y3#-AR7 zB@Mo`c{!RpZG49?>B}h_wG}I71OqnZ$*!3}VtboIykBqQ@D6dO9414%b`tNqe9^iR z^e*fHk9q^C9sjZgwcrcUK&{OY`%YL_4HzoC25sIdV7!Tniu$*r{RJ=wiOR@?y?F2p zeH<@G2lTb$EC%{++5Hlgf(rJRO(voup{=hvvN5VVS}SDQR}TyZZ(-A==KfpI;%jD1 z|J71z@hoyLWg{kKc=U?*XSeVYh~v6gacBvz#aK_8W7i%+MV+nxOgRvZtqyo!NVO=m^FML#^}P6#s8CJGTb3c zjimMj_QPa3WL$-jN9QrQgl;3c1R_B*8#;4M8oX!8Zj?qFLY-y%$E%|Hr*iiL>PZyZ zO`YkYYeK+*G%_X{t?!(aXA^PVtsDnh^j{`@Hs9WV_>}dE>S`$VOEd3z zJGYDod9 zsWeIx^iz%}t@gx26Q?;v9{|Mgm=m0*Pkc2sfbXQ$l=Ql5*Wj+EFD5cZ?V7&I93$f< zDB@l$s2bZoYubR2L1L5NmGc-{9D%K7rF^3Y+#RRQtL`g;+qvu4vAg52AogcGIJzL6 z@#z6`1V+tuMTIgcg3Np9S*afUIzT`-d0dz|fDCFI6o+7i{gxcRXEa$B0KJ)1Itf1Z zO3w@$L>ztt?o@e+(F4=VZZDOOjyAv>a*y=|n8xSf{Ex?G5WdYwd0<$g3h$B9#@`n@ z2=l!ln76@y`wf%U=HL%B7eaHJ_m73`A4zrq{^Np>M7kZn7hC&F`cq(UE|T32iPiVB z!+*urA*SA6gKtxK5@}lYM>wh@5-h)1C^)wfyfi3%Y+&ozKoc1oQ%JcG9&SOMpZcTL z@1@m<*=46a2u(qfXFBvtVHCJ=T1no6M|hRFWg1_o;2yHenW5S2A8j4+uWYHu3tDAv z@&v3ciksO~!Q8YxVv1+eGeVuY_bZVRK%OaS<2_a@+>{cVh z7t6Uu2N=>bAI=(=HOIEX@RrjZ||rp_gb1~T1f!v@@d~|Vw)eP$vUsK z^<9&KO0dHIko%F;bUz80jisBq`8`4n|7}o-8fZjS=m!C=j!`$VD~`P- z?bEUs^e>KTaxE%~&VE25T8Ad@Q{GuwL0RDYyhMl;DF56%;B5bZzecqE&RZdPV%q42 zD^a?PL(YR-apsIjDPeYoq7T(g)hh1Foz`=V6Vl3dSMz=DCdCQUOf1`|G<(xKK8ow9 z!_n@J2w`KVeOZ#joD;!dnG+wxd4%m!T%%talXbu5TyticO25{<=9{O#?rpvYuNRqF z&^PJ;hf+#Q{%~UY-SOtk`!+3y>u1OLt*7bJYmcjyq;-MGKL>>C^W7YZvEW;{{!R!a zj@Xy^NhdGiY+CPzby}MIBW?0#v@~{Mrus$k`W{Fjrhw# zeCx)wiVgLf9cJpndf8LoYh)#5FwMyHUC23bCKjd}O4{wjluay?6n>3Yba8i#)2!Ii zc9-Kam_KT)e~G!2^#5@YJ6NL>;L~+}X|aTaE%bx)```xf9Bc3vEfBRjpcOP}+q7Fn;>%5I**6r|?~I~B zn=v1+wQd$nZ^C0rzg<5$f#`x6x8m9B>|miQnpEYjMOAvimW}pYDZlO|M)Zi83UPq- z2X?y4^t*3dgk2_22iS29^(|L!sHG?lKOn%@`u^+u*?=2yb!hoFJZsi&9x3ed-^PtasY08+Z>rxI z-_oLdKlrWIfjAs3wa*?z@ElFlDVX-xP5rsBssFFe!rDGh2#sRwrJ^I92S_|*HouZ7{LY5Jwlam^z?D%7GjtQE$?a!` zb%kifzZs~i69@#lDb9QFbGD6fVE6{$mxjJ@0aIgYXl-=yrIoR*?SC^zUA+}G-2uJ` z!I$fb53iwdwa=H;_-{e@nn$T>C8li08zJAy}fqTcdjpS&oBP~-B1!# zt2T)ra|hrwWUX&TqhAF`^!r#bbgx|Nl620AI4mYNZ>ppRH0LipVUav!2s)tFgxI*F zV69z`zbx=hKRJN>W&Lo#-+V^;^b`dt+7v{wM_`jEAW-c6xUrI!Htk5-wvj%3yKi?G zdeZhviaZ2KnAzlN4DN$>qS{mR(%A@OG(87foe@D3d!{?~d57nRC`33S2FUtIGSh{& zG>dQiMx!$)Pp`segDTv24YVhePAyVJ`1*dZ|;L zhmFnC58iRFLtfyi*r_-k*?V2hl7U=&W|-%z{01Yc_j-oB$=9U*h3mH|rSj||(eNY} zVTc8toLsV7U<4P9A=xqUMGtoCoxjbYi*f>tCxOVKym;KNWO$min=VJ4&AsSvCyzY) z)5zyR+P_Yful2O%i`7u}>@_mwx)U@8sfmBZ;SxahlO(@W_%p_DG#C@cn)NR4P2- zyHWGB9Qw*-HaVGJ&JOD0Yr2|I%d6n~6M%0AXbhNb8ysV={MN7+y+PSD``4~;=0?3u4(K+ks zM2{DiH-?x<&1JwPh`m8eE?Ao~p@GZZ)VSB&5Es$z+14@yyglM2n;KOZ163ts#P!Tu ztdPhZW)`$|o%$n($E$_y`WTU>eGt?5RXvf4x}G&c&cxF4KU!7aVv=F+h_RcQUeUyM|0&5wFOPtX|I z6q-V7?~-@QGhHoJBnbkTsY=u)^Q)g>YqCR+;^wU73MX}kApeq^zg0ltgM7mT;65qE44Mn2;#?8M zI|_-~A+;Aw6-Gm`sfT)ccAf7pzcbM(zkEFDPhPRHGdfxlgmnaPPYBIO9lsw34orJv zZ!9c1{lP#aYb#mLj?=Rfurn;y|3lC4A>QezoBue@`s;4{LjXDa=61UzMONSDPscbE zS=73XmrOfDT>Qy|K_%YEjpZHiHP8-&?t4wp2d2ohzCwaVJ7r9*IhU*8hvY)7h zuP>L3aSi$i#~m)Hnr6aFcCc!!o@sybjQL@Oo{VM>QcK)EN@eP$7Dx;EI_~s)GIT)6sy8cs-quJ9;}jm{M5n$ z05|#!tUoqxCKdm*daNi$c5P@%7<%0%+l2Zfv~weh#S%{x=L$2*3_mLIOYl&Cuj;$k z{(58-fz&VPpEnEmYI1NCcmC466?msx|1Qxi4vg0RCJCz4e_8NwuH*{xdTXgv;zP6b z_ucEcsdgN%*2QZkHAuJomw2B2%SP| zER4rOlH#odlXyOvNy69}wJQ115%ljTB34OL&HjfBeg2Hw9a7&Scw?j0y8AZN+b>l@v zm8Z+n{C64X2WRQHgWPwFQ-qNPTZHj_$EX!Tutj`Y=H=t{RwqH5Tf&(?R7-YN%v(sm z0_FyYOo_ldfWd2PeN3C-!jc6J5rdqbas|A`tUKIkJ4%Zbm>rCH#v5g8Zg3?~$lx0g z=xI>RE-vDq>@-QwdR8KoiF2k>k@rYllyGAW~_# z1~;}GtFTz`GmXgHIj2{oyOwY5w^E7I%9%u!wnp+F6iX~=RXSMdW4V~Kua-`_pP!nh z()ga#4gP^vuK!m3$uT##1yoS~q`$7OeA%~HN|rJe|o)vf04|e_ADdF`SO$)G(dCix__mXRu(ly?My{FyeomuZYU=%2`j(anL z*z=U}{Ewf(S1?17P5fSii){C9!?#K?Id!AY$HA))Z`BF3o{qk43Pd&Wo9r(k9*#sO zd}A_R{=J-s?r`kPK;EhQBZ5wgc&$%u{E1ve)?Q&mz7>wFW5sRNPAFXhtyLJA2=Vrq zfyzg96!J@GAIdhI4norZ_X1qVu{U_O;H)Ss`^9^Sr6$psHd6)!m>U-ih~3v*@voPy z*)!diEsKZbUS!s&zHAG#nhjY1QA_O%7h{*Xl;5vf-tJ@Efhx}2jH44stW7>CNG>Vf z1FA&BSw1c3O=*>AaC&Xx#P~QC@wt|-y{#o*UIMjcvJ;HrmWFaFO(C~YSTtWz`++%u+{3$BVG`YAMsxpb8 zzNxzZ=f_W^ldiHk!CvObB6~e(Zz1ft zF%A(FBG8FG5>O{CEdO9{P2p)hLpNhHD5$3@t@eeeI+$HMD0s=z=XOb>e?_+Tu`%=& z3I!py@nS4zDHExLVIK`l1E)bSr&?_%!jEh%2k9Hfa-qrs4B1Y&Ubs%Ey?YpkW`Ccu3R@O^1HX5KOu+g0Z zT=c~_j5Dz)x8wVxot?OzK(tOhk&W&HzTtT8!_X4$-9QS#aEt7dOZqA^T5^6>!Pxwi z$lXB!-%ED?>Nt0hXPonJDsX(BzEHA;Cb3i9A5|tj%&V1GH7$>9m1F7gUv;gQ&HsBs z-SBiO20h>BTGjN9Z|!0rFB&ALzPXOPc09XwO6}XRu$L+U4@Fgv4=Fyi3MYJpwO%V9 z>{HkAaovvokUG}<-l>XsnuacUHtHUZv^RUBv@$jvKF*5g>5G0qZ>EsHkLZaBkR*s7 zK}+D5F2@*&K|~@v+a=$78Knw$zbAxM3x0(_-D8NU{AO(Fi{k9O*AN#W9Q?jhf7o&c zPu=&1P_WTudcf7^1?gS2d|9DC8|jSq`b z8Zm#7`EAKwY7u{0^Lu`5IrGPGI2`bk689B8ZH49#a9MC%L!6aO)GZqtxhfMEJ}?uZ zn|C8&|7NnT4D!ViA^`LmDQ&*!c321LbK5>8KwAH_XmfexutLh8D+--q9VM?&yEC9s1V0rjBP_?VJ7IqkC`) zw8Yr-qrVI@*fdRLf9ddI-BC-bd`B6%S&w638J^tl!RizKjFU|AmH}R>9C!bNVLA%NycANXz7?LMv~q)2I;7)il)6D+J7hD&8c&P2O9qfq~JhdRDJor4P-%89+bnkvY&yEeFlFJ_mihv?8dfN$VSEaSft>6mBALEpR>&x3WwcEjks z_t6oG7dw~to2ysmLJS_}UF475uw(ejo^yIg!>Bilpx)`X=zDTeLzSVJ>@OY%*Zesm zzObM!*asK)qaDK|$CGJEpP2De*SDUBJi{zRte2kL|l6c6m8KB{I#Ha2~BQ%@89M2;d`$)lL3H5t|clTbA#g zw!`e?vJ*eG#;KL6diO{cw;Ky$XbOc?lS~iOxUE<#tFwHc{kF>@O?!L9T+?$31m{#E zVg~Ut?4t1vJV7%hW4~($f|o0_zd9D#-ZcEJlV1^7Ji~Q@lPv{=}6>=OF^5n=) zc8_Rpf&OftT)d;bUNl$kI6KC-uo*Fe`Cj)mE*J(EC0F)@3A1*7MYyVF7o%gH9Y-}UC`yKye{%D7Ftt8&P*ZvxP{-Rj9hPw4!>ZbjC zTXsE%SHo@Y1+5z0MSfj%-B+RM@rvs5^6F(K$>QG@Omfjr@@U%=Ht}QDmTxWRsd;N{ zdD5ToMBk0Xed}9^)Hd{coupaRL_Vlipj~KKWFugG=pIRxD`EV@(To7kHi!wiS3cmP zrKoY(>`h}+Q*K>8&ag&&p@DVh?%)J$UhYEgr{#>Qrhp+pEXo;M6L{E%{21h4@5vV_ukkx39p|k95>M1IIqMsHRWK&REAF=;B z%Ev(y8#*PR(;}1-&snbu!UZzk9sd1U z5Bg=~!FW@=x+3^hNbC4#-DN=)tttOz2I*o&)Nhw#O+YN01w%j5obT0nUITlSgDlSZ zIL|h|c;8>IH)KK$?JQPIT{5i!%=hVgHFY&0&#_pXTR(vI>Uc3s?@j$oORH5pyL2=^ z(|)JcKY@Qr{Ma1Ra2fkOYhHmf*(ryfJZSJKy5WA08a?9eZYcS3oKH>`Orq)ge{zqi zD^TmxvmNp0C~X6;Tdv!ytw`|{x*fU6TC$6^uhrqzFJ;^t`waQsy9>L$-KI>>Ex3s6 zBD68A?Qnk`2UaG~^>q!D`e^m|g3C)Oq8HDk`d8!481f^nZC6}OtqJer@LeL`o@4aw zH$?or9Jwjp_T(y1 zDbgo|c+GHYI~z-fhgZgl&c&f6-G*(8Le;o@Ajvs#NyD3PkpP_}&PNrta(OG&w?4ZC zav;|zA7OMi&)ckNy9bF>+whmCTb=o)yN%w{?a`JyD|MsYDMqB~9WR$*{>XgL8MBs) z6j-g|B-ZnFbnA6I%?&*BO6Oi2^#w-CgeyG%^rU7ZYMgn#?pH^iPU6sBybKqq!5f~1 z7~8U!NkQ>tLx{>f0KT8|{>~QV{^Ro8@Sx;t>4TyJ%abCh;l?L534?+IfIpC2H8X2Z zXe(9(;u3we?Jdf$ufZWURSKePrcB6H^|n2wk>rLz!o;zK6Gv_&A#g1*8iVkXEvf<6 z{Vew;+L!7jN{u%ool<+!QAAM$kA8{aW9l)V%y8spZs`>>ZLE*x(DJ5gU*p`}1LF#@ zT^BOI4mMH9;Y3Q4U`{`RI_wedFM5m0jTS@;;F5PdQ$oBhg-Ja7rwBfL*hy_83BaXHi5;!9FlrggL)pjnn_>m zZg+ptpmm-$7raCO95mz4wjaxxtQ|(z?fVwKchcfg!KpYpb5qb2L6UIM8e_^6O@&NX zdKH|&mJ%X6-fAoPE5VnbbtVIp?-7`YekXbRA3aFP1tTAROjIl#R3Pmg3&}37xPiW{UK8qWcJjGII`I>U+C^RrhVgkN)WQ#o6=NEt-1L7Z4Du2&|4NYIp-VD(e1zQo`>0k=*B+n6r&bFui+y5ni^EhpLs7v4R?XQ zjZ9HHvGqP!Yi}7*npg#d7YIAc#rarBQukSmU1fVuWMdP}mY12@63LYi@8T%L+v&Tq z%Y@)#lQw+x_yTboc`%Hud**$;6NiwWxKui6oxB{63HTw>JFl{G<5iCWS2ktOiKPms z&_K^RL|F@Jdb@r(?nj8s>oFx7o{jq{O3X^G7%cyhOvt0wHs1u@1gxO~75785uP?!F zi5TCgzMVoP3Ys}+OjKk%S852w$L3=ne43OZ@FJ(g5!vze7gzy0x|@vnM~i>9`g`eC#l*{Cg3 zhM21)FPh{KA6DikYdRn@%Q>odGF>%x1;^CIvAy;QO41fH&)g}hkFu2eM$?xq&Z^_p|%rq#vS3+NSk2Mj~#&rFi&F33Nx9lFj*2z&6wpF7v%79|&wK(-fX1 zUE&Y>I#5`R4xY&pZZWD(s}ZNEHx5B@ir>}VtT_430q*&sHuc_h*$gl_R*>zsk|_0c zPcAtoCML`C$wO7t1=0D5`+6>5=@f{|^BJKcidr@DW~k~{ zMKSi=B~X-=qz?)ZvR=)fTf6>rWd_u>LYPJZ4lI=Og9`;AX%cigbwZ2j(ZInZk4Osbl^d zG5-4}6zI`;B8153o&5Kdr#GOV5vi#?&%q`T^U03-Qr9WBB_b3GiRx-EgU2VuD<8G2 zg7-*vgAG#3`>8MzujcDJj->o zfEkb`Ko}ZQ@NXZEq$UK(Xx1=J;49DvD00fx_|DVnw=MGqt zB|d?Yv))n#-W$8d5XdSUx)}S=M7BhW57gM8VwLd?hPmC(T~fHvb(bC_-S2=p3hWK` zMy#>#jJA!c6wwZVJ zVyE}P6ALoY4et7-G*(2N#bMT%rF>%mdDh$}v8ytEgzvJct{7cB1heP-54kKf_*z@Fyz7b@aWz%^ z`JS+LKoD2vY+)i^`?9SVt^Vm$JIbqqSyp6LsT>n0%APUjuA)Z-9yzNsD5C0kIMJ5!UYK z^BBL_j)we9i7kM^&#l(IXxvC6oJI3dRDIEu-*Vc-yBjqb{|_BLPQ*w~&btm*58(sa zEic{&;g>3niXz<2bU8*n(@jgSF%K3Gz3Y4E8l%(eg=*(;{i`lQjIwK<(uC z{lx~mLC;qbOsyE@zwQOatQ3rw79F8i#?n-aKHv$DVDFlg>3XaB2XBV+TW)l8A#zmo z@T}&&s|RE3@RA_p^gKJuZF7M=uTr64uOnGXr5sb}R&Zw_vd6&tf0_)kJ6U5eRqhgEysJyWP$RWz9sq|gY6ep6Xl{UIGLt= z9y}?ox#4SrQA;=k;VO59=VK{&J1D*#N$6&4Z+VohNO2IQQI2u+he1N!`CZP{&BEf2 zs|=IkQ3w9)E$r<=b*hB)6VnHGe;53o6W7FH6E9(WFV{9k3n^~JPKknx{2am)M4uti zK2Ls)0r*JWsazceE>f1oABG#2a7VCR*6^qm&MU7%dDP6!dUAfc&&BtF+HdaDq>Jjp z@QxtLnqFF_01jM_G|hm>#Y@?{-3&C9y~)RK`B@T)#=r-CrkMY|d0r>CX$ju@<)uSO zs&w6qLJ-N%!^Dc~Yc1!JG)@0&3pD}PeFgIp1SZZKH567$iIxiH0oeGy3pBofbm@vE z&t|7nn{Bpiw13E7O4Y(H-w$0}b$F$9KRj58aT=x(&tI2-^hu@5w2m;i$9}A?VqwNB zMuyg6|M3_z&KYbi>OE*tJ4BT7GA=fso)0O&Q>}&1z_Ze{VyRGjFfl!N5Kj`7aWA7c zA?wunZvif=OHN~&;YX;6HoSqeeiY1#_O7x%+f=rG(j`3!TA$!;E;QMhTrr06!Zrh6 z3~khrX~`1iR{VbelR<30m`>^s>3oOx!a^P1f@ZBLpIp5YbT1<~`Q-SIVC95)qfUQC z&hmg)<%>(Ke(UJn_BQ&PzqfLr#|8eoYav%~aCVX@&YhD9?q1KVJQkoZuFjn|aKUd@ z;8xF6Ci=cFX!GD+@`jk(z2YGEg7Q=Mf}7nfcZG7T&~3M@EXaT7uZx#^CijJK=}f4C z=8+GYY4fgv!sshYl^=!a?(4VYvCBKbg{8R3FFh;t)8*y-!mGiH7*Ylmkw5(54@TxS z1z%?$Kl$X7cr2Of3VS_bKP;u;3rvZt#)&?u{v>t!^9k$2QPd|+tZoD21 zv+FHoM<00%ImSzQcIY-Rtn5DR$a@M5*&5pZ?WBW+gVyqIPN$bnU97eIO(L5aKOI% zVV7O^#+Xr~OhKPjH^X+i-fZJdaOtI&VuKCV!^a^~aAM@eP;Yi^VbA9&*!s0B*|GYfwPK#hFa(ArkY-e5VPVacT|0<M2i|8`ZjSNJ~_Jy>{6j z>#n&GzWa6(s;jC^PtuYf&GxCO*1jOEHUmcKnlWQWcjy1)2@?=4D?=w0#h5zU`2D2V z%AFA<-fNkopx+{o^2aHfj)2I$P6!fNm^pHs)M;rIoPK$}8d0zg&u-KWI8%iV9OOsQqlb z*;Zv`B{ta7#q?EGS7Z9LY2A6GL7Jwf7PPZ$*oZHU27Gl=kFjLm!5mxmSwI^{ZIPd{SVyVt*|G_Jk>E8PiE{CBte_83c(VlQy-WmHAm8D$~udU z4kBu3pl--=#Rqus;m0s>YMTwlw70j|w-M^Cis10J6*Wq9Y9sI5qA3j#cbzM^rIqMJV*mi?lh49l}E6jXs zsGAz=(c0Ewc^3!;S+_z6@SEF-DkMNPHI+!P42EN+Rx20*!sTdD+ETu2l{M`7J*+Gtt%Y!p?c|EDcC%HnkvGp?4%3Bm=sa zF!5g8OyyC7fQ~FHu6m|A;K-=_m!EPgcM4Z-RPS7QcJB2|0|$C0I~PaYD{cy3`J}iw zB3rm8kBstG1EemFk{hmL!41eN{jU7#x$6wjbA{RWnfwu&Tbd~!GA8R4j`mej;Z^5r z-U;K)eB`~dO7*}S%<<&D;;#Hq7&3~N%7N0Q?;<FI|f7#q1l&xn2&h$oxGhhnR=uC7_ zp@@|%L8U^1iWMo&4_VqtFIbS15gUEe{v{n9ji`uKpuJfeTvd7j1XQs7xci@vTH)S$ z+jXsw1Ol2B0JJ4q5Q}PblERe2F_rFMV_D4)>#b+=*~y>k6)t1A6n(ial*U8`I&kAH zf1~`b!BIya%mSyp(w>C`Dw-?Ts*n;Azxs{x zRBmLL43$0Qgja1v+*y>ppS|3{ln~b_=Sgb5{Plt!%m=LO_HwHLo$x4x(wa|if8jaI zGu*!Z=7oY_8$szgg|X~hytL)NrPiA&tiBDarxuRu-7VNyNPbB1p*+%CvNfmuZa5^9 zPgi$7$c}JC#5z-m?tA@l?-lWDhm&bP#YTBrX`Aj!Bkb#~!1T94P;AQQRv&__Uw-QG zNAB`ZHd2Gpm6Za;+C?Jnw;r<$349ChyQn;sQ11FoNtGg{bVVYimNt!u)znsC!o;so zSrtPm?K|2tC@mRa?QUKD6cP&!R@BmjkVZTFv8lN0@dH@J)kbT{kl#k0MW)ojkcoF9 zNaCRSm8G(`=~i1{=*Ur6XM+uK+zG$4nMJ9N42k(Zf>tI91e`qd^uGVIxDr=aJ0lf3vGdTLUzr}}R zzae34#fATODgA86?YG~6C!cy6_fUWN`z<$XNF~jzX|&ui#di3)=Uza2XNPqll(E=l;yM~sZL=Q}$A5=?_t_8s zckxBoXroQ=@h6{{9yom12vk;U?-ynjJx!*yDXR2<7SvXTnQrQVrRAEmiAYdnL$bOC zCmeh1;n-)NU63WI4n(z~BelGidc-P8n57@`m0U|B&N=5CoPEJxFl2BUBFYrC zCDs8@2>Gutd)vEV9bcjiA?onj<7P&E69!hs_zf6;ma9lv1=?5-V=QjrbQAvdz(e@F zF^H3XcPJ{dt$6042XMhHkKvIg9z#W%WTqs5#@4L87o{?+d<^sM@ox3+2*$2D`;tJih)4YnlN zBbgo-lMHZj+sW|0bze(^71u)fE;kC>I@#YuiRLM!yuMOA+_Alo05Muq3nBmWgY7YC7h#Z%uv{<<*qTw#iID~*bW*J+zY zIz!oM$AJ4WWy%bUSZuh}^MWWb9Lh|}T(9#bM{d_{9eVmc0d1yK0EMAAiOeg0GMZ_i zjtTdDW!IOuyS#C;Pk*wF@)QY0UT4Vfx#yl{=Q2`jxs?#txF};C3LBhx!ZlRPgg6@_ zeJs~_sfR>@U4*{5p@~8#Oo0(bS$PaIX3S!yg_waoVd_0A0BljRB)e^_fD-tcPNsj# z%pfzmG~d(hpgL1OyU|2m4JCAp{%VSl^?LbB5Qwn=>LFVxpD#*bp<}otfYo>^ty)d5 zO-lUMKcSgzQUXNivzZ*qRDdbSJK9^3%d&A{qyN@huVeWYmZEzK&p?ENpaGMoOeLXL zVGm%&%o!92Oe+hwf=;vXNK*o**ot%{SV3v083E;`>ZC~8bi`$sUWPKS!iZ2Q3wAOQ zx8LfO65JYkeLfYiZYThmB6>j;vj~FOP*^;q?0SZzq`(`Y@>^VBt@ z^uODo>^&E~(kXIp1Yaiqyoe%xVt89>eLv*Nxm3SkkVd=SN7-IGg-}!GHI3Nk%VL#P zR>UTou16v`6R~o(zri%aietU?SHr5SEk{q{B=Zs6dix1D{Kx~a*WSBe)aYSU+*&Yw z`V>@ESJ;u2UVWK6JY9!wShs>~Q#C>_LLXq`ucd$5p!b<)p2N%;vu%_&77OA(Pd|$- zw%F2?R~xYjM{wW0_jS*jDE_Wlu}pEZ5Djhe^!TVznv^5w=&?G>~< zv9Eq5Jwf(@luGG3>N}h|xzRFKOBte(C`w~h)NedV^zw@@VaBWm%xcusUCJ*TOwha| z=06qaWtUmTmLv`xGSE)u89#m^npzsL{cpCz-FN?u;>Tx%zP+=}!m6z)H9{{p8dqs+ zi<`0$)M$5xB#+-x#|CR8fA!T?$Fj>VOC@`n5qd#ssHl~CDURa1s2)1gz4+S}SJ zACzw*^nx}*)rh*jV0lFe2~Zi{dgpDt_x^{}o$_DS<~cJ@+S*C#Ct%Gr*1%e;uR%Ss z1naD`4whPCX_7I|zsBY^6P+3u(!14Fl`L!C$YN`U?CB46I9Rz6`KO-6q{&TZV;y$c zaR;3J$KRtx`X3X}#j@%V40FzOsbk8!HZ-)@h`jc65#(NkUds-Y589i`Cnc1GBtUY~ zp8x)_(h_K6X{#&Dqx$;Uc;~G*(a_Xvac&{`?61mYr8jnZqqBu*YS+H~>NF#vYv*_5 z?|}oV`5nUuFdw9kYg1V9lPqFXkKdw- z<=(5eHO$`%5_%2Nsho7iJ54XP*#ms;jL`e)x07p1%WKd$Z5GZv?s&7E8_HwU>sdY& z%@_&2*CpUV)2=nUTNF-UyfxrIxYm-OfI^r4{(A0AgdaK8@6QLLM?Y(Qzh`Kr; z#f|k_<)E=q%bNA=J?^A(q-WZ&_reP=VIFy%Kq8TPF8{1tQEs?d0t#DKLGDD}6~5zW zg6fRQuw;VbE;sT|GDPlF*F~mfuituKorrGVBFPhXRT>qJgTgK(ukyzcdc{qUKWChA zhRvv!jBXfGknDEI1cOl6nQ$i5pacKN8dC~bmxsp6pcD1ORQ?OCL&W;iH( z#mA*zaTf~Xxgcf>r%y=!#chI&eT-$rL{=u*PvA3uf!xEeRT z-`eIC97n9GYO763HZX8g3RaVhhgTYyRx>? zmVqC!y{!ZB{1g}!5}~EJ-8RirFLSw(`3Q39ELzz>ds=yfex@#%B3Y#3X{ z6+eeE=fYPiT}mD16*uKZ-o1Ohk9%9MXvXDD-Y)-|>m=#Ure47p_$7Pi(BS#yzDN;8 z{G6cC>-j;xbbGafP6PVz!wS8?YHzI=_gYDCQq4+b=F-6Z@>Mv`L3fl zZ@TFwthe5J*lMe-@b0_s;`7fw!*90R&W`lmdW$VkPvv*k%$d0T_S>=Qs;gRu!1?E& zZ&UT98@&Gd>$c=?>7|#p&4V?PDEmhrebnqVW9;CA55r<3YVhSp<8jDAhagT8yz6dz zPZqUjrC2KHdV)cdMEizAsG))N2;o< z#?{wdgCmYS-RwX3^UGNv%Z$KD3_Dh>Fu+BQ`@w&ffNnCW% zWlYb0IO2#SNrs=7>Pwwfxk(AGnIY6CBass808#JA3H4e9oO+=(qW-wgZgyBDT6 zB=Px|ld=1*yV*B8=#azk^wV!zd7JRX=h$nH ziR01K&`4c1jdj;v3y(eWZ|v}!?Xcdu>vp$yGOBTfSLxER5HmRwM5MF|jRgaEeev&$ zFZZTQunuOa^IvuK<(N2m0(I#ub@~n)AS;QKqM=^<0szye%{JZH65q$T_3xw+y`XyS zMp?xd-g)O8Y`Nu@Mz%%ZL?j(lPaQ;WI>{N*EEt7;*3?vxzj!jJyu6HL-Xpo%u(z?X z$wu7O8R1B*;E1FMqIj2Nq6oX(ifoFnIr1sD;zDw#cN}k%8$HwLvYttfDGb@WjtLEr zia?9cxj|M(mR%mmt%LlKpNfkk|01v&7}Zi}k$TBW$tXwW9kjH z4RV`}$&HgX?suX2b;4E3Up3UVZYF7ijh(_6j zoRl~zmo!rJq%iKf>#j!3*=(Esv(!>cBU%zOMOo81HL9llZUn9I)SfqT|DXT-2e;jJ zo9)jdzocYqVC327o->8_pa1-)5eY4Qy!qyvO&PxGs;f+))jmEq-gqOv`Q{tjyjUZN z+9X#e+}w57UAA;={q;A%t~(!s(Idy;!DpUiz9sSM>u=%2Q%=G4x8IJn)>xZF_*xwQ zyJIj|N;Um&YHnwqQ#Tkm1VaW5GG)2Gp#|@~`vF#3X%*Br)lvTnQDp+bc*@!7se%0?QYzbB~e03qgOtMzIvBac3g6;@sa(BAI?4p z5B&QP>-gDbn{Dh=r_R=9oO`3EO|^?f2ic@AUqMALHehU*)&G5XT&KB(~piXMU@H@xum?WPKbkXb8xitrO(l zyZ?dbpMM^oe)0j9S!zjKaoMG)uBr0s2tP%HI{5wf-i=dEKC!2rqA~rp;A&MwO&2v2!sYX@VS_|D3^Qle z+jBvC8;Dm3x=6+4~&qCm^!FlZoc{EM(E^5by!e6cBkveU(uV=(h%MFSqD8g z?l@_k(9_W1jo3@h2#TWWv-p*!={p`JStuj)#L>HohdDSqy{F$U&EjZ|go-F@mbL1) zWR43%a>sQ@XwX)2*O6%*6)v~|TiHwA2}-}~cyQ!j?>o05yY47*J#%pq0am(|F6Ez# zhi0k>dZzbWM}TCX;^bySD16BT*(nd)`+CRHMgFArLo(QeduTROh23;K~=hCqH$sv})FY(jsUkyE+5}<%Qy*w98Im$vC*Q&M&;Lxd@?5QwF;a zrVpi$sf4)#rUbZ1st`G%>#Rl?6&zh)Q7xN;~hID5fxl|T8 z3JFc6>*#2+07{~MBiF6%jcoK-$QY(}%CEK_rkriqC+PfbJyZ{)pcw($i1h#2`wjrR zit7FE_4oE|uj!SL03i?(Kzc{2AOfNyMJyB*3&_uc3W)euK?N*;pr8WMq$41`*HDv? zUU!ph-+jIQ&v)*d-IvX7>O$Il$=SJY?%Zj2X72f>IwW6y$aA5fR9LA~T#px%MxVkg z=QO~Ys%q^RU;$%1xg>#m4p8dqoaFG1t66K~HgHXdv=$8Kw1Dc|V?h7GS1Qc)^|Rle&LVI|t!{Hv*Hd7)kFThn?Q z4(`s*&D{f5Mi>!*24Ep;4Tr$v{dvi*v2!4xvj#X4f5ef;;Wxke4Vr`)tytBnX&`|oF{WNfy_47M zAmAu6NhnWDBC#4d+?kq7vdU5?YN4ddSu3oNxa>S-3T_vYdgF~Z>bv5}NsUb_lpNEa zJ@?vQH$P-&3gg9mCutZliffx4Zw^27FwCDnUx+ZUV9{b-hU(_5(C%*CV3||$>Gy#L z9iXG!p^#TkU79?3qE6vv$IF2S9)>S{=}W3#a}?2RpvI^&jZ7c!g~YQiA>w3KuOr!X;}DEhqC19_e9oCW8{ks6)!A>paUSN)n};t?-xojm+BbBN@VQ5yz^R}4 zEPni>pD3B*jEP4cd0gwq*s&9&4BjXC;gB$PuCa_ynX-r0O%lKhFZ{j^ewi5*FTL~< z_Sg*OyC1-~oZh8DT%NxOtLkc^hF1_?p-G_x?lH0Ki@!gsZ zNIpZNec^={;=cRt(@iJ26oL72{`u!?=Lb7>Soc`&Sl?Nn*v7GKqZ_sv42yZiI?a0i zr$7Bk<4ilgQ+DvNV~TAL-7rn88^8M1uQVT6R~a|f0d`{XWHWZ^(GQ+P#yt(LzUDXD znaKBZ@4f%QNhh6zn{K>W+Lq&`Ogt-P(CJ*MuCCIw-FVZDn7YSqn7r#`osGdX%$hYz z)4+~3c1UvLQ+D#OQ-b@YFmE_(=)2$juBP{rOD@s!!VW^VTZG}rjH}_!>w`5}G~btz zb)nd8K^!ul)0fF!a`ql^T{l0pT<^h`%br3ud~`?m+(D2q8$9$>(qfah_(7G5O0w)? zqb9#y9=DQn!s(rH+?H2YNC7JlXNd>bLGeDg*6m#$y^pfK%@U8TQzS zUuE1NPrzMhwF6fi`TTAv>;ZWWs4OqhojMb-R3S6ndgO^mE0`01RyM8~%jJZ$YgkDk z+D@ZfDe>}4e)viPdSnM5;|v6@tM4pK%ODsJpGTC7q?1=fXLl#kg*8@H^yMp zvtDzL9&QBGvyXtpJ(H0=Z6r5#@k@NzLBe;zj}1o}*aod7o6UDJxQ}n)+JI?0Fx{X^0g<@>cQxl|4i?CifHbtPNk)q2r-1Q5( zGO|7>c3Tu^e<;4a7H4bvSNPrY41X7Su$o^*@mbATk$rzqcWb$?Sl4}nb%bSM@d?AU zu!P;f#p*UdwLosITMEvu%2hrLRK`ffZ@L^*lG%_gaH--H{dg@PaUGlp9dX>xO z;S%L8L?SQWTaHe4bUI7_NLD5bnf++iOi`|1$MK&z0wc$cK+`H`3MuuJ4k7u|rcTAY z`SXMPs^(#HP_p4w1s-~^0qZ8AnO~s-Gb0xoD#p|y;ho4>g6OA|bLz*ylG`hRe5EV?` zm4r{lN#37sRnHeK*OMmiB7T1#Z@lpuI@{V&TUUd>|LqpM@!E@+`TkpY@%iVl-@g0k zJEp!R$<=4mkvNY3?5RRH=HUJJ7vSEz?!Z}Roq#5lZP*YQ_?;N7~eB4l{9Q`pu9 zj%i8x^t-)Mc5|4!bQvCb;%Pkn^s~6}#=okQv(NbocAYQ*|9JCd{NlzNBvUfjWAg5J zN{Ib0es+bl7bOS@`6e0s;~%fnSuFS8f4}O*@4WMY68T3TeONnkxNIOM+(4&|YaMmg zw3B4AQ-kRuc(N2blt@rX)_(ZIA1aX}5hkhT8f(@??(y)$AO8p!U-ARYp0fb&$@}=* zt$)X}Qoas6_#nLg<{Owfdmesv+0SwPpZ1PE2X+`Y z9#>p;Ieu`_#h5*7Hm<++Iw|wbQU*ej2J$!2v88}~{_|f@g3Wxt{r1~6ugEE1dF3S` z`KRNWYkn*7@#7~y`H{ABoZ-P!&e%c1I>6uT$mG$x%nQC3cIsVw?X}uL^W1aK>FI2o zHMDGbBYt?vkA=v8PSZuwfA78b;Jov{f&bipH;z5_U?dBJ=I!kr`1{}gE@715xo2O% z2k(D?Pkm}H%$YM=emvNKS`Ut6p1*e;Ri5!^jN(7^2_>8zW2TF;L0nn zkUD;+z9+NSiJ6^16ko3k&X>qQDwqnN*WTD(VR=!1i|iEU21N^%BW#pNPK_X4*aYG`nWWGqa6DaM9+_67^=h5o%&4p*Y(qPgot6&S8)B7|@SQ$pZ z=M{1t(4AAmp`c`j_#@&IDU(9Z-zF})Gh)GCip#@MfWo!h50`M~?t)uxaWB8v{%AN} zDjedk6n2JH5^_2u=+*(#BL>sull)M^??wfuqA?Hk!^tm>7r~IY(cf-VmeuGw4?1Bu zdQvY(3FKOjyVm@7Oa5|q7ALO$5Fci^+&Chno4J&fInU@`0%CIdm=iZgm|spuNUvQl z7;z&+v74<+NYD#(U9MRHDEtUIk{8K}Wb~i7ktFjM7j^QCR!$Y$5Mp0E#b%oTlfz0c zLdAw7NK}7Wx>%x}QY|pWrI37mOojE58%XjDcjsuxVyBMKj`!$}vbwvT3;j_HCxkU+ z0Ic!6L4STwRAq63)@PYoN5NK0I_a_Jv^lm-VwlIZ$B_4UO_ARsda0JiA*JZ5;DAQ& z9mYjWV@Xj@3U+Ey^hRiB#A1sEmBPN@2cKd_P&NgdyG>#XyFTb`g`Ey-ZhDu?$K|`6 zfXC1C(IfB$+@e@^i_V_YsoiDrz5L+AxuS?q#gU&rRFv9x#J#jm@?9>gC|6?o-h18n z&wbC}p1YqBCEkaM^6`krLn2&m$BuJq2SOO6ZgRDp1F1s=ohX$^Ni}jKE+*?QNiEyM z00#%;+e{^s>+Qe%#V_FhUG)nbcifRmmfNGvaQnFj0B8M`iVrR{iGn$9%vkKd?|w?i zNisO1&yl83n7WP|)wMO~igfE*@Bcp&9e4fIRYJDfwXp%h)oPWY0o&=s)~R;?)0>E>k!^0+Xz@lqBu!tmIN zq+D49Bo8^lTPnH~NB7yv1id8wKKT}Oh+YK5Bi!4^51%(9dJwepA`wksryVEgem-0d zsYd~MeQ58F%DZ$FnLYNHj(zt26t4aK@3GhPJ+N}QkhKRN#)x4JNJ|_Zy#GN7L&}5b zpu10B zs?j}`azZM7r44YG)Z@@Y4#I7>{0Sw#491KeDdk~^@Y@igosFoJ*R#{klQHAHS@`ec z{{=T>eE);@MA!3U-~B#?|NG$&;O9|)63$(B-=n8AnD&~};A0YpSUiFhNl?m-p`#|E ztG!Fq68ZXi!rEEjOLjwED{AU$_5A#3TN8rv{2r2y=U;mrZ@l?Bc*I}4yF>EndATmb zUDhCeTG})t?CXB1r1_c}-=}5G=!|kNu3)S73bg801?Vg3bC7;?DSjR7abX zH7{za>XB%T=)l_Ih0AqctTWH}5+YqOl!k*i^USmG(n};^6NR+R#eGuVqEct_(q0Z5 zF$6c={1?qv(jbyScAT*Tg`>9YIOL27l6uxPj+k>)mLvAs@lpUcV?629Q&3t{1y9g} z59WS^TkpIblc!C^5yu^ai+=n=y!Ou9Xl!lP-^0fYmwG2fsA>=5Cs z4|W=`gNxzt+rf5$q}Ch<&W;3*;&arRBiT2dJT2qMBaX%5MU7Hr{U|G~mOL0I_aoS4mz{9Tu}4X|0;sF6mUlBj z<3t#fU>w&M)VKQw>kr=qO&VevD}p`a3Rbj250SZ<=gu{}Ploe}ni3E0ro9nnen9(; z@t5&2zt?=8BfYD;FE;zS7j0y%zv*5G=NkU>=dRcs$Q@0wTkW?zv)b?VF&Pe@+j`8r zm}aDiWnDXIz1&o6?lvirN}}A~tLP2{pESs9dv)QQ zWP>i3ONkOBx(7QZxRlJ98Ax|7#3E^DIhsgIb2p+9QIhfjA>l4`w8uq}3?mjzqqU_= z6j>j3sEa{8p^k!pb8bf-x)DUKxspQAd!%3zkC}A=iSJ2Lgc%JoU$z(G0Is- zNkxCRDU(H6Jy7?l35L7~mjzK;&b@HD^&Rj%lfYB4<8)b0GyUA>KBr14i91K-Ic<~v zn)SFp`N>aoDmstCqr%SVpB%X+iQ)88PEVym&T09a_Ri6HP7~!+TZY4_^PEOo-%za` z2jeG=1JY4v+MlH7%yYh?(_h;foeqI<RZs% z*eKsqm#*2LKW{eb>-H&()R*Ip*I(7?^aRNVXA%qr2RfaWX`b$zisO$y z5~rSeDvtT|r}5B34{6wLd1svAQBzxwYkv0!eEl2e>GWs%#VPPq)XzNQbRE4sVE=vf zUGv=>cId%E3Z1pmtD2e$@5QZoFlNjcC0CrrOss6_hRYkm$YFJ&E+sK_>QwynXU@I{ zoI1=AR&IKD!3F2(8uu@L@iZ+vXPtGHcF1s63EKfydzQ@!6UOUV@f;8DjwFRNN%@w% zPD@>gMB@ni-Ee19Iy+;(1NO(cUpq^QCp&qrx%N6-cE#nGD$*0R zg&6sf_XaUxr^⪚m5H5-qUpCa@opOc@7vkq!wqKc{b)RSR~-^rX81oG>hI840w?geUk6ML*KgwLFX>;L!%A+znc=%VlAD`$Nh>7=x~(!3?*!WZbq%2kc1 zo*;yr887*MwLDCK@)j3Yb1xEnp|1=|iT zb>eq`*W9%Iw%cygvd5|LY$w^V!S;#mC*KkERo3e-3w@HnoW0uM4Z6Q_rj3Ukd%%kG^0&a6Rsg$s4PYJ8N2V>oKMM z7qGDr^wb5pC=_^BGsg{QVsLCZkEDDMxX}s~q?CMM+0Qi)*wC=Dnu<$B!TDHh1LxEi z!GzhjF)D6uEG#TG3{+}ZUrqbLI%ewGV6-13AoPnPJXBmh$#d%2t|pL1SjT>Q(ck&J z6-(cdR+_Ww!t#(C-~R0FNOe|9`zy+-5CI<9N>b1EEt5?ODVrk7_F}ZPw+Nw~q@yo0 zXMUh-k2%`O&8lkZs^vP2k7mzBCg}ptsE>C!`C3w%LoAts+f|_>^ci%)6<&^iKKOOf zy149*ot3@sgygVz6pr8sx!JIZpi*hvP*F5WKb1^#kMXA+<6sm}qf`=9S{WV{Qq$)0 z`_gx0hok(Qu5ZBgvZgb@_}drkG~mb@VctK(Fy+ilE#|k&px7_tmT6(yIeJEa_}dT~ zf@vuJO@Ha9z7q+b<-HijUlW#z8{Dqh;T<)7lrIj52?`cj+|F*cl5SLy4 zb9A=0=n{?7Pd}YeQgCYb<(FUHliwt%7hQCb&c0ze;#zCs+2>xs%GNdCQXw=d^)3}=!@nrz~_W$=Y`P!`nOl(lrNo$apOne-19Efd}DF=)vvD7&aA!m-lI^C zy}0+jd!>wKaMDR9f;-PIZ(54;&b2dX_yBeZGTx z?zu1UpT`fco8w2@H`sWZ4|XvLpgkLPHd0osSlKwCl1wGV zfOZ7y8)a(-+fH8}LO&3=+r5ukyeN=VL=tkDDD)R{;7Q6*jGR+yQ{C3U?z z55sfp3BDte5GrPTFEkCICn=<|&3DOmk>r#LKgk|RDv6AFuf;ILl75lE5+pfPJWbom zHrKSfByI*I$Mn~PXNV*TtRYfVUd<*=1fOBt*`D(`f?*qwG*Wn<$|}PvCg%oBr#XU( zaikkVj_DtNGaTj#VZtCuW%_uJ@iZ`TGG8*hr=U1%6K1V26KC|v#PUtvY_ z3RKio;-X7_fS>-~r4kR9hR^)keYfd2`skyTL=PEKqjA`0pZ#>LHHjZ*jx1i>sA=SR z{al~TSr!H)uFMPOH{UbM8|wm3rQi%4l5B36#ttTi*|>bU6s)|i#NB1$4w$z4RQ&p? zUtz}yJK?h@o{X1Xd=*0^oX?+p3XVPMXdHRO(el1x*n9e((q?&ey*WEbNY*(refHUB z>r{Wvdf+S*mO~OoPDSVFJv#%qaU0*&OE0~mGk7@D=e_sd!BI!=tMBcKD}Es)^>^5H z%5)rl#1Xm{KO=2mM|&5Vn|Y4BA0?p@v`N|yIN$(Hhn8#k$2#7!s=22u@;!5ny+2%{ zWzW<Ps0f~ zq&^!!I?h=UZuo*p-2}>&4KwS;j7^LFz<#YN2*B{ z+3pvU6Do3490@AGoE~pRQTeW!?`)shcCxLeQf@}}cun$2P?0v|lL{!?Sw2fb#BYl! zALd)YcS&-`unln}_>6JG@OY2m6NZ?XZwLJtsNB&Xx}hKRkA6_8XLx>Q+ zq=ml;`pw_;nS~>(LK66eFL2#5bb~~KI#MjwEoqc|V6&9> z>WNXNOc%%7ly#OnzBdvl-Ya&)GGg+JVA=?#Z(X2Eu4?x4f_)j0B)S?neIKY`UxyHV z)b-{Ak(0QmOUe)+(UHa{o6JbP_Tq%&PQ(Kb-|wVJz)cGq8fqjjr5%v`=hXPp(jZne zx1qkyIUa7s$`(BF=p*?2=TFfz@I8`PGi_YoZQdL6f$!aa=*1gVhe_Yoa99pN_)z*qi;uJ z(x#V`OFm~culWv4ogn(w3%(zMd0^_gX-`-VdCm7iF?Gzq{5I~n#EGYb2@_yy#Rb#i z5x?a-Ao49v$wxYURCQ1S&(h{I<{7}eeCcitL&`nT^VUkH_yr%TNPz#H#2W%Rg=D{h$S}hB;LrJ}u zPCv6WI^t0GZIl)`AXO+EOX_*HS$SZ4CiPUTOp`+Yn9jb9p@oIT#=$5e1nX6?3It?EeN)n}GV}J!fD#Zu;2Q2gB@_?s|xri{>}FfDyiOfac96I6;B7yhPS z{XIvRcggnvMnSp0$8hML3OoJe^M)8P59lY;Qw)y8Gp!uaH{d&BI%rR`zwdA{!KXW> z&7|2pZ{o~*eBOw8Z;UhD@P6NT8Sq`Q6M}?{pj(E^cVnjP6Le?Z1^uPTc=MeS#(%n@ zoyiwNK#1Zp$Z!ZQSIMQMT+ozS=$5cMIwD#p^Fq2R%ANPd-|2*NY_re}1bJ*gJ}3F! zCFQ4DM@|_I{pC9tr$Oc zRL`K3F=x)6i=8J;Ks?C~Om5mK?>Z$qUY;Fb1M6}e9cEm(&jyc!>s!wlSGI+vrR93` zb(f^CvWjIXEAOUDh(0?9b!(IQSor5PK@v&&&GhygP6-dRA@yJD z9jRx$3r#q~Vc2Z{*uFA6)7Bao<*^w2HZc6+ZvmA}#@~$46ZDtqFr!cmkM5{olDv_$ znd$zF2mRywWEo)?bWa7JZh7DMW5D|igZCM4K1)JnM)nv-qdJ;$QT$yq*L1^o!E~At zNt(Pze~XppzWGCf%diNVyl;p+VU%!3p>{fM7-xn-&|ivCRUeKQ5GVd5SQ*Qc#MAYOP<5>JY`hvBXiz2xQ(!;&S#A%xZ z$rzWhzoWNk^&+1{(j_`lw~%i=;Y!Mtq?1#puenfda5 z7A{(fv13O{{;^|C?BqV%Gsc5?%y-NDW&Sgd84fq&yXBT!aNc?6X@?>0Nr)M?DGM5A zdsOm0ECh8qh77G2uO%H4Cd)-UA%s{@`=VQ)ZekZIk@i5^MIO^go>*JubXG8`Ev+r6 zt#LX!_=MJ5pOcsJQpHkiHBkb&j6@tl&#*K)6amx3O(B`LPMymk7MD6%sPA2D*ZrK` z;{2w2wsEFj6sM11-DCRcAM2N?Gv=Kb_kBBGn4k2U9Z!VmEamDSXgY0pt2_4D217R&+<%K$|H<)v|d_O_Q*veUGPd{P~!HW zDpZ1iREU}H&k#R&)SW|Q`vV(^;*Z$2M(WMStM5meai9!F7#0@WD_Bnn*4@EsFN$Fl z=gmUusfke8V6uvWT9+~-d>bd6_AmIoV^I>zqSWnEBIJK_ zq#MbULokc;%e1XDi{G1Rdl@#}8lgMh<1in&$~aY^kU+-2}fgCJx1A zg=y~lPWc?e$ zX4IMf@>%*tvcNd=nZE9e<7(a|^M@wy@p;-aoqUdIr5`5W%w~YbA5%6=`i!5(Bur;P zZ<&#{g$y;HMR$z5jgzPdfo-VMDdB{PGINj7)iDs!ce>hIQC?kz?#`GV56Mm_=4WyK zFuw>VtlqNBI59oNI*@tiyvKJz`{MlS4~!y7eOjI=b4h&^ucA^tQj#ZC1%C&Gq(k_< zo~Bq#Yuei#!p4#MV#L_N5%OuiFpmR%kF*n61iemPGu@1{i9g=~QCw$DhlP1Z%pcvC zN%&Vv$d_0BO6gI9I@l_4An9kj=WoW#gvD!fkKl9s z&G>Sp+-#i3a>4cAd>`f=WHQcd5pJZ|^Srq0it-3Rc64O54Ad9MJQ0mWQCbpq-mU1& z3Mm&_kOcWmUY}<=Br4*+w9S6jxu}#A(-t}3Kh`V8heuDd{Py@KZ7}1?JT~uuDDE5@ zs4X)vb;Q&qQ&;&M(`;rtnT=2Bj`1-^ri-R4MaWaAUyj?jd{0#xD(W^Hk5 zMt@)D7PMOPM+4 znA?TakAh2-Th0t+oGFr=p14y1<#iAG4nXJ;bwcVn;-nj-`lS7rR^BCK#KR4poay&z zYSx}4Du>1JtLsifsD@e+Nj)QN+fa+G6;fGP2Wgs-Q=`{AKYC#98d5*dNc|@X)@+h` z@^5caVkpg3f<#z;uihop510;m(6{=UwDd`nW|N?AzHD*}X*}Lo3|iisloe+P?fPaA z(Q7|Y^w)^idOI8leRJNRzxaJpV4V8qTfyv`-qq6C_qqPlu)d_e-=~YiGuMohA@o@t zwWN3prUw~{+k>=7lAQt8wB}Z3rrfTANI4d}q$q+(A?qo(SAM(ISS4 zUC8;6%W!kP{*^Hc3yV(zh8PJ7?3(;#y@)m)+Ui>X^N~Fq6hY4?p@@9aPVM{HZP#D{ zGC~v;D3&h@Va(Og_t}ld8a}xAQD4i;;i#n3(};CduNot(70JxSXfwWIH>T57Vc%6s(Q#8DoVd-DD$GG!~>rv z4>z}t_PB*`yW#PB;1Bx5^y<1`x6cEQ&#kkq)-*XawM?W!9xoU2ULoR`9yixyS4y19 zL@K1wuR$VKieQKhe^~ck@iOk)y<%%&u{p7N1>~sx`i`Eb(*^yF_1MUEi^7c4)v}X6 z`Vx5lmLG-R#aUM@YoI?zl=TL`3;oIF#yaBCZyML}%m!k0Uy5E}-@K-f#Iq+qD<3eY zAIBxHeof(${|q-Yu%3>W_tm zg@wfif*qqI^`ecFBy)Y@`XJxcjB-yF=~N0yQO*;|9HQ}*m>Hy{0nbW%Hb;17utiBjI1gD>b4 za_^|V3HcL=tLkK7VX+xNEzKi;IjpGQuKjFM)}vCoq``5HB-{MZ=u++6Kyz@xR!w~_ z0`s+yx2xSMvg<4Bz?#lY7)4=i6ZquPwI*-Z+||kTT2A^p$h)}#4W}LR2m|>D$~D}M zaAO(|MV_=`Wor|!5O{tPD8<(vsR&-F7ZfG*QYVf0L~su&}V$P~?!$ zCPc~L#&e=tNPEk6d3{h5a>18r7avx_6KX}UyaWEy4tPphgtM;_jeRBHUkP`pS%hY> ztPp8}yQI-ERph$FT=Tw2a0ObsKSU(GQ2c8}%}^IQc+|RZ0gsUV5I031bmiK@!eXPq zbI(~H$!XSsyzcrh7n`~Mny7A!X|6X3J)TgH?W@c7`K@lPzPqJi_1*7z#ob}qZN&=V z^&l;mW(WNFt2&W!d%;cd%=&p9p%?e&)p~TovVGAOTO+s;l4E*u94B&1o$$ynr={n; ztW+02*Jfto2=O`@$Ix&ID%>8t`NnI=3iIcNc>{qRUzx)0_r$h*PQ8VN#nuJ0Q~c&R zr(U#-JXx}|gSoI6(jLiW+o<*1^>+>MtZFJQg#oxsQdAmVvzeu?)1O%ksxh=DijyvO z(rh9w_rp~k@-rgWA!IW?RQOB98{3XrY>kitt>s-z);$Gve5WcD!`#(T@GWHbdoG&H zAPYS~ojVtEb0pSV#%CQ(S2~`6*B>k-yC}5-q{TD~ee;Dg1vUjtLtj7F7Yuom+a7(N zY&1JXB-3)vF>tz$K^s*1A97~r6CQ44%641YYkgL2*F+zClYf0NFn8R z!uhRvTJYca(F0x=KjSKN&Ez?EkV3cgTP`*4xQv4CO}PCF(%-(@>u;BJ>8uHs)GYfBi$VaL4@KSg?Mrj}#1YOA1+r)J`!AtLhmK5_vkx zt)ounlgP4T!Vv$SG!@LXpuc<>3>5pjA?7BdC(X6uCdrPjBi3u~`Yn}6C8v_pHE>yZBqMI}dOTQ5A_Y&m4+&2U-cTNyTpG!Q zO9;IlZU4?fS3f5_ItH+jbZ4{z*K{l^pGaS=NzzzzE*$LfJ1RFITQuDzP~iChZa5-(gK<~RN7^;h#r z#Ke`7;l@KEIms`N$A?r(uEh;^4tD8c!`?I%=X0<0g_B-KFAm4r}#j}`- zMgSWo>?W{Za%>S@z=gOW*RGh|EAmR6;di!VwK6HCCwfo;X+!ose*D(QYVIxQtby2UumzG#)VqY zPv(PThCq#|<~}ktATfXoNJ<_#EV2CC#GB88FvHDArSJSqbn+5dEs^I zaD|}oKo6Y!G5OVt)qg9g-fWQ6>Pu%+#WKXV#10h6{=#yT96M;FUbxaZY4U{Hrz2=6 z4Wi7O#XGOPCO$ajcOXz{)^cH|-+wG9E_J=R*|*FYIO*;G84HW;51-`pdwvfikqElG zyAh2>kxI$8y`MI4%n6?_T=in%{dcNcwxf(&dwV<5D^?*lZxM!-m!mtAM0jWeChj>E ztCBH%)U+Jo`dTIT+(E@FWZoy=nt-r&zclqc&YmaNM@zDzzp#r}?D+i@;dfqV*okSr zgZxbJ(sc6jns(YzZ((7vQ83f5O`T(Fpn7Pb-m$Jx%dMgC(kzuPDFg5HDkPR9N{O!s>#H-}J|iF5l$d!PvFFHYS5)l6rTVds#WN`Jv&V|R z_;FJ^@-8iv%X zHc}waJ&gspOs5^akd3O>nZ?jzak&f1Dho{>ghc6_tkaxmefPE4KM@FLE5+*wr z7_>Y=(_9l&yb>a%rKM=^>_AyXIs8FC+B!N>TEg>sCFSDY`BMy&SG{?r=u7g=a)HeP zNu|DQ$>t3r^?o7sc}wcI0GLv@W={4gXMNt$z|UD&Y(My<*VLP~iNb5PMSameYRAG= zFDe&*r0!RXQ%rORX-7X+WTmB$Mnb>cBFD5!0!t#M;xXM|sBXMi(*20%J4&*za5T`VmgF_?hVU|WAJwnX&z9jsb1 zr*PGa4JP$5sWAhS`T!DQckxethqNn!ln}I2zwk}mb>EXnq`gwdvN+<%eem9lSJB?M z5>+KZ9I@X%ICTGU2>2u7M+{z%e3bJ(B~c{2oDNR-azc1X))P@B_?4CAIwPlPRR=;9 z)xt}?2+E_8?t;4k5DW$ok0(?~F~o|*hKfrt7(|YT&=Nx8*-$WjronK)_?TA4x$j&! zo2_(f`NJs18 z3X3l;c!P|b_$O{O-tvp4NvGfM(|ndJLw7WZlF|U0TRRad4NLxck%~IcI*}_v4|(s+ zI|r-(HtX3p4nmQDMZ~XPf(ZX zr-N_}WQ7ZOgqvt6Zd-pXwpgt1cW`h?eLjF(0Ql;+u0_h5K++w+7tg*BH{SL*()kkc zFOTC-*avUF@)TN@EXDA$N}PDe;W+x>Dg>n_Wm26I9!Ka4BFY3u;|XtGl#0BNQm+dg zEzL^mbtK;{XVt^+5rqOw9FW3s>_|48b&=ACdFm;T6r zW9N+AJ8lW?F%YT@psh24d?t&EvT}q1LY(BwpOYxDjfq5if?R>r)4iMT&K(v0EdKZ^gs8cZOh}%U$!*UnG&Z%O zu6$Shy?kXWe8DuTt80-;=5_6VQlb_W<&FLolX{|<)TdHuEMB}A)wMMkHKGc07Oleg zG4*KaO2d;gO=97J9u)F%Ez|FvFfFOyRBX?r-onCSfgz)IKzZ#5)Q=j2ZXrRQ zGB0X}RimoD9B!W%@fZ+`=8zF`Y5a1Fa0)vk=m@V}@O$Lh+FImA$@qU){R+n(eGK;A zYd>7}v!COmk3NE)lP?UE&-Q07U9=SOXt%C)cX3_5ka%-Hol2-_;=rRZOt`#u_J=1O zFW5#eu&>dUWS-n@B;MzYAHa$-i%(H`k})}+roTYTLsP6vxi*slB( zH+5mTO*i40XP&|3mtT%OcH3Rt zaYH>J-vgL4UVja3D^|iMvGrtg$R^@&k=W<5$fr3uTJh>%JF7ekZ;Zl+6=;%OMSs5npT#wy%+Z8*EAB+0BT7*mdx)(ul+$epI z5A=zY1^l?W;YZg7dN8-n*i{x=h?T`LKpa6jl1WS0q~m_%bcF zQm`%~8;DZF7Vme4k@^zn)VNH+*w#ySXfwC^rFA- z<)D&!s>BN#fhV4O885u{7M^?lWi&3!;f1H3!Rs&l7tcTWZ_Iw@RlNJ!fAGeO58#8h zpT)9eb0Pd3$t-um=hXDxC>d^5%(1+p5L8!JqrAKv%|gzJaM+KsQooW~?wILS5i;A4 zxoFN@#5=oD;`NF6g{VSz%M7|b2)KKvek;LrIRu*ImVR?F0LiU$?cAfAVluj-sU4;M zAVv%sijc>L&Q)FLY;J=qlS6r^MB_l>>y`9!XI&?51yW1ziu__uI7B`#_jSU)+^6aM zb~+N|p(2pX=eQ9dHxv{P{9Z3YLc{|;zi3c7G&eVcGrud#$`K9);AH^JcOm^eRlvlD zQXD@OiE~9Tj1^0kp{}9|LCHg=r6LqY`^tzeFr+)a13t@p{hH>!F^leRUOp|6u-J+r z?~nDNr%v>~&te;Mtwqh0x1Q(BT?-3~!G;;BHz2|1G=J`A6AE!384C*w3kwU2jltlO zdhyK_2BJA3ci^-T zXP(1VmtBEh|KgX(#*>J&b>PxVeu(||`jpynV>^x*+oAt?N?rhUkEox)_G=rb!AY~^z5_G z;!9up0zNC@{o;zt(cRgBfZvOoZu|?LfBtz~bnzuP?X=Ty-F4TYtE)?=Ui|AHx8m8S z{)cOS{|B6U@=3V*>fd11s#OwfQsY`xRVC>I{_&50=rVz>&Q9|9$5> z2uj|kyJL9ojkj^(c^BXdpF0JYeCPX^{oV&ibVf90`3js=tK6yQ%~N7s)`ou zu%ib%jQ7DWj#J$gh;#@kPgG#Uh!NOva)X|cp6|}X!!y(2Y?SA0`OXpG96ZRtlTD$j ztQ5Iy8sGfRcQNy$MM%3ms2?^K-#qsl*mw7xaOz2)!Fk^}4~HFb7#@4%F?=-lBOEJ) zai?8&!c|vZg=3FD7Q0W`9gCJM!d-XXrN4Kcv@_nFH46_u{v>{Q>4muF>Kn0W!5sYG z4=%=tAr1KFKW@VtZ@h+c&pjXG#*M=pZ@!HOAAJF2cfbDw{P@Q| zhCARvH_z?&_)roo$JlB&<~A-tFc824_dKib<*1|f!edW7j-`teIPd%m(VbX@zyAGi z*n96ou1uYmlq!#V%^3J0%{Ql}|v?Igo_TZY| z{|@JU^8(!{FBXg8LLv1ReEVCNBzbtz_x}&S{q5C=MkCre^3$LG6t~`bBR=|Qfi98w z-uJ(Q{r1}(H{SR!oi%XIIcMYPr=Qkxcghz|LPsKxXfmN2xN)gKDCCkj#I;kRrlwNN zfj2?ibVz~L^5)FQV13|>3|5f-kF>KJAoIGGM9-eV^Z z^N!DRwhm$9p3S7>S*9V6OfrSEyep3{B*Nn_9VC)jsZa7-EI3Q0y|o$D)m3uGdB)=p zz*U&BW12>W%`hnDy;)dni(tKD{o9guzqhcku&}VOST_b&ix(w%RVT2^PD60;eurYp z_~{tk030-Z3ijN!3NO-SS<{O)(Z!$1G|PyFO3Kf(U{?}WzXD^Oiojs5r8U&v@2CmeSI zX1p~6<3^7|q$?tddj|Ej^$3V=&Q0GQfAn!&{QZk@)DcJFYhU>qW_~mWoe}8B_em$6 zgn$t0U=TulJUHx-gRtAKyU4u`Oqei1$;PZ%iuN<= zkKx@9<_IB3<8!B;BBc8tI{N+mOE2QO>#s*Lok3-Fm4r16)zy`lJ8y}O&Xa7+o;?!{ zL+T)WRX6RcmGDXCL*WucVlkvLX*3KSsw0E3cpUp3cmQs=={nqV-@W+x<(FaJ!WN7k zI|jeK`f9xJ@=LfuNc%&NKB8fb8&!oRtx*geIz$P?4L96?0}k8|S6*>B&Oh%P$O$uP z7BW40^eAM~Nl8aii8@Khm@#9})}F!+Mu_#h)Oz3 zgmkZJZ9(ITCb&Fqw6wLMvZfj?uLt4sGWdc(!>~H|LqXI_db099J0$s(L%vA%%EeEP&K8%q%^?<>29kLSJ8d`vJXu?-QnTAS8Y|Ek+(`DKD(!d~2+)!r2vppjX2m`d@yGo z!a`I7qM&C*S#N4>MVBb=yH48?4I@Y5otZPSsId`M!v9-4yWsJ=gs^(W-xOxeo{dyC zgHj;?t!>SiG2?9v7xK-~!Ka^n7Nf_FM!2*D?|=9q=FFXo5e+5Cd)-*PVmT7|l%zF| z>iTND`sRB$?Tph=H+(2syW6q%0sG+I2k%Emq#ITB60kfIt|-IXvzH>COn|eJmn>PL zgk{>)JrGYsF>~ezs4Oo5FI6h^CXsNU5VgkyJw7OHd??lFD*Sn!GbYLiXC*+p%Irr;=zAJDQnH zR%cCEY~3J9CXrvZY?+o(f`pzOH|)sj?CjK0c@lqu9e6AcwCA(5udJ+8lh4%E)u}uB z*{uXWhq+Q836k?bz^B)2Kblr`A}xHsqce_{)=q@OAuN@8CIPD(Z_uy5={KJ>U>#%F z78Vv310jhxQhE8lWir}^P>N^zSW<6cVPRqMabkl>z4^5V15vPruv79h`Cr7j zcEKmawOmJgyO7CcarQaq;J9Ot!P#Fq7yoysUx(99|1y4c&2KSg^8PsgJKx6B&%B8Ct^}%TsxeYXKgl)8 z1Bv{OJMM@d{pd&d%x8|rTW`OC^UptD6n-EO3S#G7Cu9DKZj=f+C0QT2!#I@JR^y@{ z{TM&L>KC~1;_qYJq#c#q9`%`Hu(G`sr=58^K7IU&_|`?=L&oF6&XYz8`K}fc6T{T0 zV{yo#2jQ^84#8EwxDumAjKK2c%amYvye^CzKL%%<@eQ1O^2vI%-@ykTEXo5gcKkS0 zSJmLEtFFRlPd-JSX~I{&avI{X1R~KGH^9eY;W0URS5f(0Ra%DceeZi%uy~Pf$ama{ zC!kZ}zvq7Y;Q3cy#-|QC0C(MYFAhHPa5Rh@4u44qqayQQ-!>bdMuXr^2%Fp z;IuD)37?ktIBnWA-D82HwIq35Bh5|+DoDl3(dH71O~?KB->+qk8zQ!~wdrXV%-hEw ze;hyj;SVu!;zZp5lIwbpKmK^#1K_yhj>CTY?S~UiH~}xe{4##?o8RbWkq}NlRci#O_{5VdZoj!dZ^_$CeX3m_gOIsGsovS-- z&U*J?FEI`_Pb$WvE_js{dr^{+NDTR zO=oVfg~is3LER{io4+$%^HD!!1}e*D z!<}A$aty;r|5+GbzZW8&43gfQZcHXI5kE=homl|hTn6PKAF|1Wkkkmgz5t?$JbYmx zijfp*YJ%{jfRmGGxSE)5_()!LkR`fl#dxT5>1V(P+QAs{}N}H2Ojy@yWL)$s$W|k!1DH}kXC0MFQ+9p)P%8M zZZn3|m19Vy7ad)#h_nL3g)~PJ%kh^RZo+>1o``9C?T%)yOHL$FRZ}a3CX3tt{7dY% z(?lF{_z4ov06v=6g_3H?bI&S_s2+*dPQE7+7EU$J=^Es)KPd0fFN8mjlm}=RJC1;c z6O5Y2sNQ>_&Nmk8{pBM@QffIN$&rdg!5g&66H@io?}cU#&|?mM&eY zooWP6Z{RcBUxM|6>*>!s?>r^v%)ej!;upHF#Q1Sz5caw7^{<|TOMd)QEMDG(haY_c zKmWxq;gU4YU$7KcUU?<{{HNV=+vaFoXxRWBJN%)DEkKHyG02fp8G@Bg!yOh<-E; zgexi`d{mVG7Whlu@CJNBAY!PiFH`bBvaz_a1-@Wdo>>BaNhyYm7==a48WGO`Ng?7K zQ5L>{uFix`50Ax!n3t7f#Hi5{$4YcW5~vgc+$6-r9}2O!6U%L^6%q`dUOKL7dG{ zRoj4y+M#HVM6t3hjmp|`lvVIp0YBz7Hld?S8a#Q8LCK3;-h+~G1=8{kQ$p%oKEFzJ zUA=@6moU;|pU29M4#d-W$-h!`NdEdIzHyR3NlSYq4VTv^c^6cF$>N8NtcEWXL{~I} zwyuoiUqId!bk6~H1aS&)?4V-q*4k3<||Lt#o>)G&* zM=bu}2S3m~9tcC|*;&MyD6AJ8Ij4J?oPy6a?;Pc4J$?7xcM&cv#rrcqLQ7W!<0nnP z1d(NpE8+F~Sp5+Qdf;-i&N>|`E{_-A{r-1w)o*`=2OoVLc>ztwO$vNzn^L>N!DS1Dlq^Luqu z!HeQ|YTm0cjTB)3>ou@GZZ;QUh=@dyS_BLs${*iv6|QXNR@g&gMf2s$CgqCh7yc~OXk zG)tXo2$mun$)Q0i*N!#7;d@r#Q19^|N9bwtH?O>b68MFPb|ob)a?K6Vxt2Z|&!N0DfIvwQ&7B!>n?*@!NH@L9<}*sz zc-NnVe(Cd;A?0mYx;6ii#5PE31mVlHal_vmuEww@aMA`ArAp$Q$j$5?7Ce6@yCt0#I>}%TEfpGoe_#C1USWW>D}Bpz7%O; zyt?cl>k>}vSO4;o?a|tn7xvEvjj!#Gm zkdl0Cm2kQwoLta{jCkADm5{K)LWJs3Ql`O3`XxW)#m41FTEa|ASaI=_$ABd>Sv}e- zlVv}qOFJi`LTZH7Am{ZW<92JFha^69!)r~GgqhE05fw7e*&ZDDrSLiy%V?*E-xow& zt`m|*x67;PMpFTE|VVH0nLNBFI zgyr0+F0|EpAi3j_^m;jZFAr1XvGvAajm&RpAQ{eNdXFAthm65<&pn4d_Si$oIQM~= zHEWjEH9o@=8_Wy?{w7G+`I|Et%o=>N9EKpl=k)t~@4Z*w(W6hjf^)y~e`txcVP$74 zDr-h?X1&7Y;vN#L*HXWw`gF%2^`Q)3`_{Sm&Gk3ov@_3BKNtsg7?=(F2zD-6SZwRq zR@4k)KI^9%-6F!nheR z;S~(ca=FmMg^H!uP?(~)MIq0GCJ}&7#IOHWn=L63re3T+O#*rnLQCNq;+`Y)e9n&2 zTWsxEvjhu?(wZ!Um;HavU&l&EGI>jW=yZDp$10uieHGr6X2K;ciAM-C&zJWJfei>@ z4vN&5=P;ta3}c5(!mye>P#WA_$lYkl!-7&_6xNL-^ zlk%w&7NAp>S>1geRM$0NmnlN>zOocALHrcG`6pgoL1bgp3D+C43D!o&S(eAC1XV_d;cTt*}hC=j`Cf%Rj%6 zD{&-*6>gGN`Y-Y6Ne{1Aj~}nsM+QpEdZV9b`7ST%x3+-AQ8dhdNUjx4i19 z2PO|TARk!9wl(OCio$*f1UJDep4NZ+?YHCRn{USG(W7zCJ@??2TW-;H^(5?E%f52u zN+r;SP}ANJY7%>b8|U$wyWle%b_Q_t|J7ID#G5ldKuyC?l$BN@SQ5gj=JuXl?^|0} zqP*PMQJ)=lrBZ)V(pHU~umg74eGgRC);kU@EVff@i*3?20e-s0NN2M0olhYxx)q6> zqis2QgWoH}M4DZ9ZnI2b@GYC6u|ryl^t05Bj957mj-;FZ+4U!eT2!Kc%=}rR0P)pxB9X zt&Ol=7vD4XYX_AED(sb&Whg5P>pH!3n!Ck1M0#_>tSx4|7@t&18bfISOG^V7!t?qz zGlV1QMsjs^mEd3{<7jq;XS_#^suAK6lsH4~r!_q!K1`1tg;_U>%kcV?M(qHQda_yv zkA;F|&+HYz5p`~C$LaNtJ@yzDFJ7#tG?2uzY;q$!uBkUi({Xg3;E22tj^4A=fcsg{ zG)K;H|B6EnIYdY6M~xVc3FCLr4>XT}#tB74Q0D_^KkVy=FFO`&4W(YJJ( zXHGlkPE)9)lLYkl%qJ}*AtcB&87~r&uC6#bI+Fdm|0IQ@l#ClWPgj>P`~s56ypp5# z_LSHsbcB@oNjs8yriJ<3pPyC=A`E>^dnx}?xaCsCfaRUD6gXYmA@+qjuzGdb?!fY9 z!2C1d8g*`Xci@2sYJDQOMx7me@4x>(PC4Zi-N5hSi!a6wJM5sRAiVL$8%o?+-pw&~ z^q>Bc$eRuT`oSsvvuDr7(MKJrBNEYgHx<)5#QQi zlb}~7=&j9Ub`VU@#+W7#dX6gEuw)TRZY@F5{5*kav2@ zT{$6|CP%OfRo_o;+d7E5S}a5`3C;XX3%%B<~!V=Tv(V`@ZokF87?75()*iJ#xl>Ta#D9|Dp+5n ztr1Nzn@J<+2_O|uz%8#Z5u-bahlCXtLZ6m;Wnp1qVIkl!E`{R&W{$QoDQvb?kt>)6 zIcZ##b#0(2!mVn!;Vkz{{=`j*0+Te5`H4W4Y!S&%c5viP{!$nT6QSbwVMN@7#j;v{ zRLhI2K}gIJREU(ybqK*NiqL1Wab&ggePEEpQ%nJ4hmRJSf@xu4u{w&I;?<$8i38K7 z5W;H;Bbi2o^pcEIQ5SLUJDb+^C+TEHNTyWeoK#QlLM_+XbV^N1f6si9!p%aQ4vIYT zIU)AxBvQ$QDEvv0gye&`8$g&Bl>Yo(Z|TS1VsYXkq=Xrr7gChqF8g_ugaZ1TZnDB+ zj60^mBd^lu71Hk!!rI5bVi}b9Z^gn7dymL(l6URtE|hOW=$ZAa*N)Yv;cxHYXgUcu zp&dm9($0~3j>L1LIxfSZy&?F7+3|kt*s|5&lYt47 z-}(N@y%}EVh4ZqUO$1jL{qx?*B&bKY(|t}VX|J8R z?rUb^F{!^P_@wpbzAZFqPctBm{6Nor5+)_y-Hn_O_@HS0Az=d{VFO%b;1!bM&Sl{f z!b0~0nMT$Y&OoNQrVQjiCoG2pepHo&;CH)_6{5s=F}`WZTgI39>K8)9`}|GQEyO6p zbKeK>*O*4u7SC5UbO%>$o& zfCE8MN`3NTyS3Zm?pEC03dP-_NRi@h zDeeTPP~6?6NTC#WcZcHcPH=bqcAw`x=RM#4kuk^^B-zQ{Yu)!+*PN5^TkK}8h(d?F z%8xVdV_+Ntl{6N#?d2s6ZEv8)bn&>96*2ppvOqaq5zNh0zvmrwSKyHdP7J@%iPu7Q zHMHM$5myjnnPY5eGiRUWZt3JgXw)sgvkj-gL3TBFmuM)+x))2yG}aTMKXuGhph3TA zT2}xmV=?#%C-)z+wg=b`u==3L-^i-TYRk&G3%XyJQkO1Grg`{VP|0+`G3p%#c0DeB z_3~G)t(eEJuyvq8K4d;*Dp&AcRZDR-Y}Qp>t3ReQE#z41Cr82k9<64?$X%|&F?v^z z?4|QgDGs!*hE3a?k+?Pc{FV! zjX~Rms_Lt5E#`~8X2zhjK7t@A`V1P zD04*TUxeuL_HfXXUyH>}(I>#ZgNIKoFaIS{)E^06&G0kzKWv?gp2k|*lyZOeb0A}9 z+kd$ub05>kQw{MfaJfOy;2yvNUu0#jVK+VBU336@hi{g!W_LQtR)Sh|R1Ch=Ak~-; z8`@r`0TU@|eZ~B{j<=#dU+4vUR@Erf87N`ksIGerHb_bb)H>P<{Cv8RjEyQYje+yB zOi+u6P!rI|iL336`)Xm+8`*%AbU^IiTcV{d`P%3!iW_wJvj&XCtxWIa&> zx+PtWF=Y?M`Z-TyC5OPL&8R{IDi?wPB?f74ciyhmH>=s~P&t^2{M-g5A1h1aJ*w5S z#9j&NFgCZ2ctW)=$RZHbU_7=V&3{ybyRjn*K zUrXzBw3$@8t}WEi>hLTeIpd>eaZeHvN)!#Hn-Z$bIKSZ!>7`Hs!H!BY3@m*pT5B{(OW z-mW0(K%fDm;FEHzyxb@W=H%t;uAa~~whtS8UAbv?p@vH_&Fg zv-PA=rMrY4hgfjK=Aqi%=KC0ppW939) zav%XRU$8UMHq}H<;92rTn|?~k=>1sj(_z}xZg$SoaOvix+|^NDE^+&6WlIP9^^-N0NhOTmF!V$E`bn*{b5^Lg`(3Ft~o?k$wXq+tvgDwbf9+0w09nB|0V zwn~1tU`MNwk&wea&26^Iw{d*X6dRs2B)o(6+M>uukWe*rJeI&=cJz(k5*<-V+Pf^} zqNsZ&X2db9z>z^A66`J_c)>=a<%1ls$QIHWsc6N`TGJ~J~2BTlEKwG~4=>%7}Y7=FtsB;hwU^Jz8i2BBJ#FdqmbJ}_R6_Igs z)>fqt6fUQxFmJguiu2Zg+|`NmUDVwng+$jwW5!QP&Qs6Vw4goqd|V-x2Z0T+^YXhrb=_@fT(J1NYX_OjUyn8>s0R61JKd zl|RAMB!cct+^NYmM$!m&s&~kN(5-H3P)_121EfNXje2fiqtzqgEtc6$ovQh!QP2=3GI za%xd0tH;RRC$HIBXo!pWH!EHSeOmbn?P#G_oTrb`GLOH{%KO~NnAEm6rr`Sl{lTf3 zd=l@uG3N?t>MpEO9SnorT)i10+J2jHF;h<(k^fm1BszW|g@=Yt z*8qIc+tq&y7QlSA$=FTeCUkM4!il->K8SWcs! z52|1voJ{lg98G$yTDBt{Aidmg;q}v{ya9ceIo&QE{3P+hWfk)F6K>=7#?{>I9KlkZ_*)Q!yP!-+Da!$#H`vZ#Su7jLjx_xuIa? zYd$#rJ)l|y&T^W)v_{0YuPi|#+^iF}KDZ=>O9}Q4+#5S$1pFj|Hp?P67jwSo4dY8M zEcnsRX|LTwQ$1LW!)NW=;4-ej9l1rTjt6-{AXTVaG{zd$5Oz zxwqrksSFDljqeiJ@SnH+`_A4*pJfI6*JNf-y=`z$yd2)1czDAIMZBvQYR9i{&*~Fi z8`_vLU(Z>vY1oRS5jeA@H0Laph=BVBCn2k0T(0kp{8{}om6f}@Rwu-Wt5qs^I0;$l9&VdJGldJ^_W%)mkyLqy@z6iwA#)d{Y zhDF*o0s6zl3Q(#ih$iSoXHFO1WpcaqNF;aY*UmftG~#poolBR4O52a|!Yg02s`Z!0y$M(XNNKgP?_ z;^iqr1YTtVnvo`*pJe1V<==-*k<8`2^BWzt{m7B3OWv}okueCQB^rdAkl%)F4Z5+n z_P+EPvyX6x>m$!{J|3GiwW*c)zrCrebW;IOeg+caW2Nd6;~;Dw|1tC#qPZ47D2>|!F=qFOepkrqY5@b0~H5zU)*fQ zK7z2FLoA1ZYRYy6A^pIIX`gPv3JPb}O#roht$c_lF$PFVhTL6dzm`BJ5(%v1tz@U4 z;E2>qu;B-cK~&AsU8Q_;Qb%}=IrE#ERJw+*(BDK; zkugdHj}=U5B_t*N)_F01FQcB~ih0%Ygajil_vHIhJ$&9yoBe%mE6K|-WavVQT=HFc zfB4sk{o zT79F5_4PmyJPjHe`Wf@M6V+g9mgtzg(c=kt3R=Tj%o@}aR=Q!|$B_7h%20$R2z0*h zF3uovpp7n$9;FlRHsy8UJHF6%)dHoZrPZvktqY19E@Pq|b{ZzwxpG#WRFqYDQ^-G> z@b@zTNz%nOasR5&>QIxtdf<*3M;+)@W(Y}afOvNQe!M*Docu6?s+O0l~lNBl}3t%o&gH(2Z~H8~ZncrdD@l@*7jrRCWZ(pYX?9j-}# z6ppb$klF`Us$6ck>c$duT)fFtXfOTjmjdA;Q}tz-*kQ*SA=;k)(rTQcp=UW6nG=+G z0#QfPfx#P8ad_Ev8CZTkz6AWXSD*x{=Q?ZLd;*jvdbROEnY2NswhWr1_@r@a4rpMRyCU5*ueH^pqG9Pukb!=U4*I@RGwm*;SX z5LIbB)e+~GivI9B56yyk+19b1EB((yoRC}7D%m>$U>7^wlwxTLqZhR?EDW)gCTwc( zwnI^%P24rjo5&DdRBfWiDHvH?X2YU*kX zvGk0Ls$y%?)4BP60WH77poPnOk^_X|N9b}Odt3;D{OCM{->4dY{)Fldnqka2J=w)J z=qm+N+4h7O$?f4WY38>NQr@KpWKrHzT~J-cK_?_9Gq7(D@J`I`M(jybAW&h_6I)QF z=ofrvJ9h_gQL5Hq&ycV+S_$SI`=Th+;0iWmEbizf%JWG0efkN|0JH2~GK+<{RuO63 zHi@H!IWF*m#X6YS;ePBP&n7z5nwFY~^oj@vNDxKs`4-Fv&g2y!B*rPiD{wle#Qxl1 z?HaZ1FoJO%9>2?@69< zyXiuqpN_B3x0JY0L1^VYLx~u=9{a3k)2d4Q1KawZO8r1C6qV98yKkqi*X!e2e>iJf zSiB-1!Q(L)xFE9o0|uOam(+uf-5C-)%6%_iou@Y=I7T}F5ANdao2ucm4v^3#0m9{* zmd6w8gal}pp;zCR%QrX6PNYYzw?Yk5Ej9!q#R-fTuoY~!ZG^?bOQ?b4;piAuq zl3p#m0MKwY6>9BqRq_rXvnvQvDMvVa$Ekr!^I#72;lybMShO9byVF(bH0p6n`Mu=`nnEP z17C>%)4lmJ>~=Ik>(GTzXgocT856><8m(HyS=MyGAfGLy$NvdP^a7733<8(>96m3P zzFSMet%Rgpe3bV`&}VXVWdeoUGG7rYWy4sHMldf%AG#EUIjsDrHe`2ss{=E2Teva} zdpQ_?7Z)RG5TXV3rlK9uu~oy&`+c_l7a0FbjU&^*W=_|K=?j`pqjMq`_bbNJlChG@ zXK=#iNzE9~4Q^FB_8K3x0Ouy;0#Z{;G<>PL*IZ5!3zHY&*=m~BXV{L6%w0hedO8#T zl2uf43MfZ38|-t?ty_O0ULmozd~0gr%XEFZ+lpqCJ=r_z$PbNo{(bfPOYzwd|9oc8jUDVCv`R&K+WhMx-S&>q3_ z@ju3_=AGmE>cFd>M;V{mqDz_TQ=fS5%n=H)7;*_h|{G`H77c}Ir?3|K;{Zovi zu&zjz;7>nqgLb6fobhJ*WDIsW0*76O z&@_4hW#@mZP&W2o+BAt*n8KewR-w9>5VCn~!XpzhQu)dYx~`f?6M0=p{L$mXDy=lH z32_7bdWIy=9*zi_!avr#=*&TzW76jFsLHOHL<_1}6ufI66M9@PD%2O(v6906iWViX zNmsel3>ta?!nWz4Z(W%5>agQ!6uM+-y$fhXqMX|=h8X#nv&j(1l9;so0VTP1VXKoK zlPs(B@$I~c9g*|6=whWv)o`qJR1Mgr*Evi`mQVWFZDhY;`D?Tx?OT5MEcadB=MiO} zTwteZu8*6$-s-`1%^Uoe?C<G=ae&W!? zT0XTefO(FsDEy3k)c(3UR65@dpr4uHh1ovp1D@P{(dplS5e)O^Pm%~?4t)^1n;^+x za^~6kceKq3Y0?>sKS!M8?8fhpnhe7uq3Bzn;y}@JygL*Wy2&lb>o|^xQTAQ-pon7TbY8`JjSr5cuE0LLIT0NG~nf zwU=J^)oAQO|L-6VEFty$KqHQ&Y(MLAay!1pJ8Lf_>COmLUiMzgblaK%v4Lh)bni0r z0!vQbp-rZ=^_THH%;!z8IW}NE%u2M$JfD&h-RE8?V0tgv)NjnSztqNEuedIu01;i0 z=#y}t^|o*%`2u#662%($UGiH>YQ*3rN%Ev4u`UkgKJF|xW~ur~o=P#1bXFL3uV2D$ z^O5HZeT!J$mU08?rYYsRf`UXb$4_UAR^_2xFYf`nTV{cqc}jdCFZfmWTO0CL96DCk ziI2BbdtO0v=9E={Xv}Me5wrn>Xm^%qRXaZjipDA2HihbYCz2HPgT$!cW>zVEIQzpf zwhqify+F|vTwLC!{hW8_JsR~w^b>;m(4-;4%YANjlseHt(D&B&&4ztoOa_Bmf<{QT z@`!jrYi<{%JBGOSh3nm!#}mL~stW(b*fZHXMxo-c;;4|qYrlWwp+phQp@Ha8kVvn) z90X`qZVY~U&OP3)6!qF|Xmz+(Y727`sumu){B$-B)!v&I{iNt+*_Y$VxqekGgrdY2 zoxJ8ldYM$4r<%2eOLSD0HyHbvaQ9w`+JkRAiAlSJR*1=Wybx zF1^ISVt2oZ*B+uwDNUYeuNXd$ogYtNVIsAak0l&z;VCaJasZMhG(kEh<1n0m4*jGg-b<#`Gto&Oww7$JF zT%lT{&2*+tT~@RpP$*d2YAnY(mSf6Kk_iAwg1BcECJ6ohw^2MBW`R`vo=+0L!g z1}tHIQth-QsuC4@ZFMT~s2# zN{?%f6AlL0!-bVmM?YXJAToHlNT$|znh}&HWG(`;X-*y0x9&esUFec$C-%r{Z7ik> z%uRpZPV2tdq#_8VBy(=%N{~R{i%}Ts$BV*`F3Nj4qx5$K!#)zJgeIKwEC3wW=*}*HNtUl35qDWN)g%4&7^_q5bC@-h`V(*NE}<*#@RQi5aySzKXEg zfhE30sCxG=Wqcuz2&w*F`twb$^pNgTR|I+`^3>f8&8x!{CEm%@UYBNOZ>ae zrbGJ+5AFRP0d2fzJceoW5?fsv;;J>~3Ns_RUL|~9@u&5%f^{6~l*MAk*+7B9zVND} zp@K~6s;jTe>&{MP-Zr+jeLxn1M*=#gBIaI^D!3nxv;~fYyMJUAmr3&*P}<`q>p!Sw z_^#Fm7zS4u_sVf{A_KQQ0EBY4okx}ff>(ZNa67GgVa!z=&)gguh9@XLZR)B0BC&kE zw0^ZqS(-TXZ$|Rp>=UsF!Mm%%=oq$SqhvkTi3O;PD!bVqPJ)74a`CFCK;0+3vK;jZ zZeCPW*S-^m=e!5&Z%~rr+?LaHb|w@w_XFiUM9N(^dMwtdApH~SSMcSC@07CF%kB}h zEA+t6thLwb>}TX`!E>j(S#H*zWF=uNm)e;WZZPk`VbG7JCf#R)iXRBw!Dy1ddZLpJ z++l)=T~oHV)G`%1o}u7v1gzGjg?S&;qDFUZoq4{9FGYMS zOBmdbjcn9ae@a%DIgnZb zAaBXCyaCyUwfouIvvQr&j+aN$2$LvYK-%+=lr=grfzxgGvrTE)3=uWnV|LN#wgh13 zDu{tSrN4&`E$nrM2T58T8%>yPC_IC>X2?d;Nf-c9=QS+rzeEg;K&+`z~+x0GI6NA;>(J{kozDnVuhiPhx1N9HavdAQ5i?^*XQ$h@7O z5S<*`fueb4RIf1^h+!BkWFf!biHqWzp5tiGc+}IAO-SabCzhZPC|`yuAER~%-{bUg zH6FLyWgNRS*Tjw59KP*n+2F5$OcPclIpypBP(7iJEO22jfQ}u^50ro^U11!buY%@S z^~7OZQm4Q>?g;sTmY9gZ6x|x;s==Y+_aQ+|shebqwQFyv)&2zh;^$7v+>0{z3f~+B zmvMalfkIJJq4+&}eh!I>(-oK|&YxR84(;h>QFwDdS-+!5Y+gxdzgor|)9twtFE;s( zsAg{UZpz>#;$jijYh!p+7W3#U|3(0oeHTcvESZOJ@^(He45XREC+#N7B993nn&&;j$ z{k1X3e%TIA6C6~7HS;++v@@!7H(ccO{A*zPce0udRG8V+fD$C65l9T-6&_vsIprXvcL$-b~p8sh36OHk4=NFEcQd)Hxe5w#UrVRrDRk}I$$~Q=#Q$o7x ztn6OAY#d7Hcl3w8K6C0FwQ<>}!MuTP9>cb7RFi<^UsEI$J@mIhKt?M0!j4^>XZ2gs zvHIPQq3;neyLVxAiH^-7PzXFA40I~zt7HdmLQw4ZrMu9uGn=3QVU`gAg+gyw7ifXK zUe7LMA>y_bB+%q9K+ow?nPl7kucQsjOHH_olNVMI*p9 zMY9B_z}j|>?GVCyoyCTnSfFY4K}*j(8!P;x%0r&0nIDyZ(~0Ndm#RZw@>q9lFfhI; ztYOiTcq5`NK2FhHPa8RROGK0}V>sc0DUu^{nG)hb*A>XuNpW&=tHZD4DBat56^^}# zrun1ppZql&TM&+I^cv2(keo?TXGdtWUP%2{f4COdpN5LC{Yr;;Zy*_rPk@Ii`$?9n zO@t0fxCi8^u<*HEGiH%&JU>|cbzK!iqOU~ z&!0ip8^vE&bFppe-M`I19IM{r-N}+Zi2arx1!tQi=_`XMLnrfqz~T7G6AMn!9YiF9 zyAUhl$?olGsl{g$c0&kTKR-XB07FD_kS-x9Qp&71 z>K7?LPOXVh;EoNon~4;jYnB&=3$>hjI%TWwwbI^vk@)x}_7eAM?+;EnzcqJivW<^E*?HUd#2G~&kQztY2XQO-W z^pi@G1MAc`Iy{g80oUK>3x91J>{{=WYTlA=&SOQ*FMSx{sY+=5gvCIMa+X7p_Tf;tN?)@%0{G{EUQ8 z zvu%!n(05}9%R6FOvR@?2rL&p^3O}Hxj)mcth!5wMtFjxw$#9~`2*|qe#>scdb`hd0 z^?r^Z=2sb+R0;kD2KOhf$N!1HA_NO%H$&2t*|%o`BwrEYY=dM|Vy#@!W01!q2^t}4 zZc+J8YFW?=4L{paP*CJvWd86nD1iku(og8L$lc5nY_hSQ=S=R_+AAUv5jm+r14+dKCvE)eH@p6a(L!F{YR=DLmM85^ll$VlPW z?}|AF1%{Ku%~;@kJ6O%Qm|Rx!B9+8S*0NUug!O$1+g{_>Hb~2vq%3=!kE%}R*jyn~ zvDfllCQh3Tn~VKtt52>+4NJ~P;IlSs770wc4fy7=tz@>IssKU{_*@l;fQk=6FflkQ zAP@=97#K2p+a5_n@C>{#l6AchlDL>>_!PQE`G)dnfb}y)J;t#-%J%yaJIj^By`yo| zT5|EAufcC+1rAvcB?UHOT&5iQrAC=bjhca;be48jbrgHOh))4|5`i*3uoZb*-U*zqM6)E2Q?|*rY^ksa`k3meQ%Xy8BMB*wFi>vz-gGktK@IE)Cyl*UP4xS%uG9LV10 zwJO&jlW*CH&m-f%8auAe2|JDTr2i1pctQr0qfom9iMnY=zl^e~u>zpo#Xmnq)oJa? zw2Goy2sWwQ7D&rgh4ZqNpx(WJeZLi{-b!d$Py;$5zn|f0mA~1;5IoC(~2?lss(^{jsxl&StV@_ty=_1bamcW;u|@tfkPx4#h)=?>MQwQ@R634l=GHh6Y!? za9*OMc*{(0y}1e>p6c}Ij4kiDpgTMu>ybXi3=7Kd+A^J_2qajLlHb6?qKH(eYaZC= z7%vbt-mmJIuB+?+GaUDRg=#e0yBguN{jzO4mXtqo4JY39S7%C&Na>lSqgkAXYw$e= z#-PmSO<8qYOArMJ+FnScb1EYxA{<_NkROXaz~84;((0j?7ixu3!^mBga`dI|UdB|V zX>cbHPd~)_c0of|rbV68Xb(NKhwsN=0mM6p+hZadD>s@0$PvMI{p%R|7d$xZ`8IWG zp~nPk^;mI;I^CNe_x?BC;{7`<0-0FmzK7e6U2f1;t#4mxVMpI)t!?WmjuI(m33}%Kf=~& z(OU)ZrXGWt7Hz8t@+DIt9p2rzZa|#)^Ihk9U+kNN%Bm6c#sQy8zspr3PU2Tv3n@LD zOxplydkG&K!_Pp!$oP-7!`~^0kNroG<$!?j-cyPyG6uek#1>90S~~`w!YUS;usKJ{P-S?@c+MrwLz;q|8aFuL<#Avy#2^8mY=%%F3L<^@QbV;@p>}dL~ zGbfTtNEVt9LOAVA^@zjj$l~WCiftrb$mp=ATCD5Xu>)7;wz*r8v)pNYUG2fgxyf=Q zd8f(}EW)R6|MX!0^kD~@-$w{2l2dN$ghoKY~g_tqI~ zcsrPxVg00K30}#PEN{flDVi7xrLwcto@8sHfO7&SXsfAnqgxEheuW}U&W9u(jj)Mmk z-^T*ZiPWdqS)xkQYI9$uL1Vw#{`*;R1K!R}-%9T_y1Lz8?7%F2?A$Nc%ETPTaEG{) z7)vImw-dv(*x9$5+? zv52EE_(Yf5*9r>MQXym$ZgrqlJ@U0N9#gRn?@TIZvG6DHd0@j!=1GbM1xwtyfC>Sg z?&=4ZG&#un9Q2C9a!g!rv`;-b>m_e*0Kb1gd{i z8rT*71y$4mQh+j+pbFM^>7Q_qbB~&jUng{0*=v6pKfLZPXoW%wSMbwQ{l|poFZY6? zGM3%y>V-Cq!7@FspJ-{u#u zrsmq&LmKWO%!$7pJRbsk;;L4)xdpKnVI7{zm`Bg_xU>R}oyynzcp0iZ%rdxD^h-bP z1}pD3dX3*sg2o_w@zQ(TIz%U_r*~UABdl05B!9p{qOSrl^&Z`RnlUBmH$`*Qc7x>+ z@JoW_+kxRmMQFvb_hlz63CW3v*B!tHSJ%0XcSi!?!%p%aKcRn41tpHup5gYH{?3Z> z3Rca67^ij4S>*NC;`o9AElud4ESAj88QemNbd8#!XK`0Rcpw-vxpce|-$)^LntBS+<|#x0zqO zOYrdQCC$F06!VQRfO*CL_UX0~EtKcws;9F7FQ-$z|Lz#wLu~nC*`56A9T@@Mn>Vb& zvJ#?dHTF^unVvv9yW1qTXO8oT{5;A7QOu)AyNZd6I_|0M{qP7Aa+F_DvJ29On540Bdc*;@$-s!wb!pQ(@1{{1-NrC8tP4w7Uf5zqhm8VSFDIw;cl+&S)Y z8Mp@9i)8o(@kVg{*Amx{3^u)V3Sg#WpR^#KB`7;}@v(|cA|9Z3G6 za0hSPS~Bj@JL{mg;zqk~>xy30uWqnA_xW7A45*h_GpZnqUm-;0tNstws)Wo^bn17W zBo`vS$t##7JxegLUnO^f6cz>)GF`^S!D|q|enuDV1}Q}u*yQ)%r5v9QhIe3$daoGDbc6jj# z%a!0fYD~#EB8{v;&j$DT#XJeI4iqos9GZ=fh^RQv(S%g=8B*4pB2@~_RaGB?&*FcD zkB{0fS5?I{+`{KL@G&>6HZ=2>%}wX*jUrc>Rs%-!gYsxo!x)M~NfJlA45rv3X}#_B zF39ST-ns<@mAw?F3GDrN3EPV=0=e@}I$=@5WXG^}mG~1!7?nR{mg3~AKB2=WClu}D z^3O_kVPXOkOLyJE{}jTHdoyKlNK{uunRug_xW^gLSphyj?dQR}EPW%lLjI3gJ_N%7 z)00A)+6AUU%*vrO9NxSg@7comWm!cp`oiSsP z6v2=1;wO(Hx2;(5-cCpBVLhq`42->k!w(`;A@ftry<6Ae`?F0+BMwe20+^vxjtfKr zy2<~!sQ&VynMU@qg7<~+p-lZ#j=3gN*73rme+&X{cbUJ{x4b7Vig?nGP^W%*(?8eD z;eO}u=QI8KQ8X|sAdReuD{mnidfvT*Em1ARK4Bc)1M-W!zNg<|7y%mlWtYr{DM`Z2 zj9$IWTJp=6)Tni*?aH5l(z(22*x!vla&s5Urf}LRvbByfL4z(i3YJ7b4A%V>#KbC| z;n6irqfuQSL5&s5_!T|@KS>e-WM+5Tp4huWnHd5PYeI?(r#=lCj#7_A!fnK{E%WIF zCw{e0=lnlKCGq#)Z&m3b1KL3nvk>%~U8=Lb;LA!wNe*4J#9t&IVXyQ0O|*32^u6s0 z$|`A@BTSw6sIz@a(0Ke6x;_E>XFzA4Kj};YP^-ljvvE^C`;$AEtmI^=0=ehN#-S0e zD$cI`7smcd^;A%p@>R6O=wUJUB>@NKZx3LHuJKxJf_O zJN28n4pf0#-4d39SW0;_dgWO@2ARe(I-oj$T>%uf#$%~W3@RBOHP$RdO?<)7TL7x-6%1 zr^^qbHcHXVx4u&|AIuV;{nEf zI5K$2JKBwRW>?X(RIM9afRXeN!SmzpXXg5^7OeuzXljp8!MUfafd7N-dm92M^B31q z|D6F(9c(x7><1>@)sPm}H@*$;h(aEx6O`$Si-Oy0h+@@XmD;Z`_1)}HHyz8t6t{~; zvq|w1%z%w9sn11sCTTw*V|MDRUnKM(6$Glasl(Ar}{p0PFJN zb}>j>`E^2f+3Rw|4RDbF{FxyK&t+u|GRS$-Xj5z9xXjAJfAOU`17Bjh)@xkXRd>*z zO#XV%^UE&urTh72?_#InX15|L|Mjx5ONGGad4{XFdwH6|Pl{i$&OFyI9p@ffPCAWX zw^72HW#$dKS}#J9lGGt$E!@Mxx+JV#ol53PDF5fOM))pwP}JpQ%FKZ0l*GBw&3lP~ z2je5t&8FNS4gfDXtG=(@TGL&X!wD+^^N_O#PY(9-N*ul1{i*0$Kk0slDW0epC)2jt zTAY4jFcFPHT0mc4pFbnq)iC@Q->~}?s28@D?^TN)T%rc%xEvBq-;$s7-1hRCpTB35DW651Asa3D1##V zjDm@Z90m)V=A9Ouj{q`wU_z8UmxkE8cbVHlGK-klA`?bbRG)&n>v7Z$G24Mo)WuK}2+_8L z@wbsxtZT_bM-gFb6)v^_n-9+8enzOBPq^@|)LU<#GE%Ms^8bGMqBPf3Vfiu9?H{o0 zym$aUAgZ%QurM#Tg{Vjd`d&ip`ne9L7(Kj)%2`^t7_JnZG2pZcyvB7y+1!+xBLX$5Sxd z%?d=M<@Q9r*2?ZsO1q1I%Nag5mTFl{+q~tOr7waYxb^k{TiWjW%oyb04&egzJW$cqW!n#7%5Tn35vYF>d= zL;1_(PedtmHT=(4Qw|$}c)tlb_;cO5TWpBGe;n~i&nP=JmIY1hsCm@a!70|qO$lvZ zs2Bzw#;btC1+GVlTADch2gd0&wYc6EKT%e6eIyEBF&Wq7f*EEkG;tVIEBT!j<$kYx z7L^ioG0{w}tLk3^{pE|+i5pE;vP^o%xC=r|O3UsML7{b=S2;^j{`4E#rm&k))cbUC z#RJ-rlhKfK?UPbn}(F9AElDV-&54OaZl^`@{bHIp6zeGD?hfyMG$m|4+yv3ezSy z85mck!pX_WBj-<7r_a8mt&yX40vGtp@tKj^&-3YguA;w2klpUZn6thn)VRsjez7_A zLCE*TOFm1WF?c;b!o!~hL3FmR;^tl+-v?fHz6mw zr}6d;tOh(p9nGh0!Fu4#+(WNMpO;u^5>br}A`it(h}t!3X!_WeXb0Zs>e5!pNdY*N zIJoH(2x}Tt^c=Nm8}=4WlmvvqJu6jfAjS=hm*sh)1sL=ky4}}moKJ?c<`@m2>t20- z{oYTjmEpAUj0W2Ll^4|$&MFxFVAOqnbvf3lN+PCUrdejthd0JY7~OvN?)UJgvjalX zeVKjX*K;%?*Kt3$$5M^6v%KhaJKx827J9eMP};Lq&(pz2cOqaG^Q9IZ>nSSC3IiBe zw7;804l`dgEL#3FuMY^$E!m;rm;8iXI*Ee`#%FWsr3W1Ku4MSv8UN&g?mxMSrOeES zK4$r%y?Wib3%p(|sq}%?1Mv*Hy`u#J)9uYH?84owv^ldJX?1 z^XkrqYojtI!vtgxP#38hCM*AEQ8*J{O+`sCky1S#j34a9=f}$-EaEPUPAP?oF`4R| zVCFEjTqTyU%|;W!&^w9+?x=#fWOMjKhg|&sdb$d>sG@bPbVx{dcM8&-(jW~2LrZtJ zbc0AY4Ba3pDLF_>3=P5nLwDyL&b{aEAF!YO?Deg+zIdaCxBd7_@9OdL($eYWjGFmK z3bW8)Kos`MMt>wEvn+r9uVCY2PWD8Sp4xH%8W8x+3$3t@rEbbEm&}E*@8}xsBQ~%X zGvrlCOWpx{G_7U;Hq)eh1zo_{7McRr3+89n%T70kZE7+!n1cUEydAAUmkqc@O-)*x zM6x_-13=kW_vmke(mgdr7|iOoqoXVy2%WO>2yTv#8E2IlFw%^!7rqCz>6okJjx=rZ z%tXZc^Ny|6yi+fKcVI#o?)z==!oAHQU*Y2>T>rlFy_-&-ivc^VGQ4n_fDqO2iRzGmG)n(@gq>R&g$8<0)FQArLK<7 zKH%-wlQ%omGb(u*Fl8@erHLNl7xs3_vO2HV6v z9ws4-etT}8C(4&FgO@6pF$d*eu!b?_70uIt(xR>b|=Qiczw)gK+3V=Yx^B9Z}gQx&(%M$#}4&(-JsnrXB zrEK&4|EGQbOPLg{!anM1sm2qIC&z#_L}9ipig*j2%K0s<`v;YuIUGs$?OZNRXHNH7 zDS6+9930SFpV##e?Lb#aHWLckSV;Wj@u77R$#h|${P2MBjs2BBdTx~&%YMstRUgFODXKwl(6q1+Ya-v zs6l|hqC-Z-gWR^twgH%FcM&cx--#*y=)B?wl~#QN=lR*$yRNzt=an#Ju1O0t%4vJ& z?v7SS_`^sWA4bEGo?914=N---M%Uj^Mgd@@K2~7&708!je}6o%cEC6L0UC(LJ^M$S zXtsF%%X>T33Whv&+Pe?H@f4fH#KZC2d9Q$Tv`{ETgyU3tK)Tt~W!6Ety~%MYwM(u! z+-woqO63bA_iAU%BnWjtY-CNoKrO^9G~J@}zu%qQJoBsl4gYdW{OmS*;{v_1f}8|B zb8~d$qdKnA^M}Cq>m5rr$mZ)dZn~oWdfZ0mKKg&#NYKs z(;PA-&sqw?e>*E>g-=ElM?dQtFj|O3X`7|vi!Vw}O)qu4wc;Cfx$jJvb}Q9TJm<}G z?rZw*Ab6o$V%2x*_uDExT@uK?;)j5AE++gEAu8W<xY z;02pCon5kV7}k>|>zTA5&)|6Hi-D4Woh;%i;{!{!wQzdu7r9>{>fSIo-Q~02$+(ON zMZZJqGx_?%HDWm9#i@dA_#zQFlM#k z->8-}ou*bVlm-qEP!=5q7tM_|HgpO9zMsK#DEO`hq8t&2vrC&OqA~5xPtgf|KOSdd z^VzF6=%J>yssEeZGKSCASTJpZfHDO1{<5CwmYVt`CrfE)>&hEjzX69eoCqO2$N5MU zj@sQ*)}8%)N{BE-3QQTaiK!8I3?P6|51;5Z(z^ zm!+1-$&|21?YJ2G^$PS zI~g&_uh2YQl)l!YUsqAjM?#W|72K4?5e|Ixo{gok$Ht8O;CZNLWH;${pm5H3*oNzw zFN6W2^drmC;e~|Zs!o}2w(&i}R787=jXZ}2av7-S$kkm(JgQzhTsylDFc#7WpYvLw zfTzl;K-#c$=yZp=&QOxwzvg*>w2DeR(}e}6>Z71W>#}3Vo|bPdZ@%D+{y{es;J1lJ zeUT3EWxierz@mp5&PS;rmxo*qSqYnNF&yb| z%4;6nd4c;1{uhsRv=W@I`q4d~sZ42evV@zuF~_BLl_D`CMI!nu;#9_+x? zTt!rl_ATU$k3nx?)E2bs^_R~p&ixod=Uy;c3u`bV>XK8>6HlE$^0!<}_x`IZvO?&+ zU&u))LXcm?F(ph|F2{C5g1;ORZh(Afq(RYD$lV5SskcZ0nsFNMt5K6Xn=dnP?uU@K zomIShKK+cwFZQGN$2Ee+v8#nhiN=6Zu4jn72yM7HJB4NOAS@&icydx|3nyu{Xk^l5 z^jQv+IJ?3Et{3Hm;VJzNU8uLk+}#-)sw*&B*RIv*G%i0Rmc$ZnfOHKLQPM{lA#Ko}8*1p=?x%65&5D;NLJ)b-yXSzL9*>X8Uwusq6&pLubl+>66|ePBnDbP3A{ead zV9e2Z`jElr(7s?41|yHbH|QxoSsX=UUy0wg%L?O^gwRo?%#%3&V|- z$V{c^lvC3a*wCc9GT+UOq*k`Pf0Aa_YQmciYf^zZnv#bG{4SYjilNp;78vYF_AZ`F-7<%4ntsfG_O1U9EdR<_I^7A1`rj&0>FX!fV)uZ8y4z|E$Xe)z;iVFv`O00~Fc>)k%e z(*iPw?qzUWAD2|^m?HM20gTBLQ{^QkGJ2OpQx%T z?POCgNgcE^SdY;4J(QJL_Sr8ZE%<0p0dh|CuICEe$tg2Rg|)(A@l=oq~L6pxVTvpJ%rQt@cfw*N#;T6zJOrI{y2uz}z!I*4_EvIq)^}A(W-Cjnf=Fi`ZyIoPaR3=z+;2PG<2S?{U zxD#uOSmEMa?4OwiFOzdLPl`!|2NE``jwUdd6DqPz@t3>OM#wNqOlevY^%xyIPrymO zA4}y*JEV=`{aevvzII8vkKcPHHaDcc{V6qY1UGANv-{z=pI6r? ze3YYOtn;tk4szke?1h{rxWdx7i-4zEPK;#^o%TNW{BgizEJv4n-5sX&Q$#-s)gY@} znAX7L`Y1Uh@=upVo3&AkI{gmj)N0=M*R?Gz==S&{I?;&aXte2B+qx@7JJ%%f~<(whM7`GC!(LcsnbafNC zI%2b;>8*d8@&zkD^##<&JQUHo?y+*c7;z!?eToFJCdenaYu3MU9-#BK?kYs>i`F|f$d*dYy0 z?9YO^_31;YHN}{rx~>yN%>F_FaBoo550)|U|N8~K-W(+CNrX*u@WpR?mH7Jm)dGdW z$(Q-eC*3B0?rs`282Z8nBV2xmL=0N%>GB)G>j4A~Vo{wN;*$dQQHU3xi&iE1a?uW0 z%YT=RHiB7<*~;5-GBR@;2)wk1D&QpCmPWCLA&KG%zBR$0x*S!-@_lxQ4Fkq`+afj$ z*6$g3@OPe{#9_XtFOhebZ6^IbOzEUk?$?wrw{m9&{HxZf=rbT>F}B+*21d}|EkDvHaVH?<7M#-IlXQxn5#uuuX#&Y5 z6c1>a=HXI^c=R!8Rd98Rb#^g@)$OmQk|^a`JK0gQ`HWzri&q2e7evKH7!7C6?(C3Q zFP0M;;Vz#BB3XW3Dk#m`B`OAY7xRxsrm;LnDaKH(4ajgrXtX3!)d5)XE~DAtBHY=$+ zUu{q22VF2-Vrj@%9o#dDpDo`$uR+-&ACE$@%s>f8x3e{^rpql3ZQik^iPezj$d|V# zDOI;qb%v3C$Is|F{Q3jPttS#rwGpcP5&jJEzgY5@G^s+v%^I30(Faj6F`or@iQJ^08#f>5G{ zB9WL|Ron&(CJ|mEgDN>qF`L}O@nL>x<0r!op6&{Zk0eFo0iIMEsZ}~girq56uMNRn zalKu)M~RP%gvTI2!&6y6r~?vo_H&v#|J<;T))te~dUpWBv1(YYW|ad^lc|c}2@R!31H)HXMUSjK^ojx)6+kzj7-Uidig)Wp=}ABE;PwUrTVQ_hG9+)Sl?6zTFkl zd5KHPC_bJN{p@l;=dTw=81vl0Gck8xSRM*e-%d08(~x63Ic~ZA-)Wk6B6zZ2Qq^BP5Mb>m-~P{e zv~RIRV3Hqn6X{_q(QjDPY#CvTxrcXjLKYw9&k}4;w~OJUtvmnJyHh?j&W4Y~*7(4q zu8a=HXyKj9mTb~yAWGKf>W?F$peRZX8X%$95VIfMB=NbQ_4hs3|o!|7bAS0MHH8kGQ{L> z7IFRuW#WDkkp00zj!7wE4NbA4VN8Vxcsrx1`CoAv23(~w>@GV*S7wBx+&z9TaKgy3 z*%$fGWlaWMF)!9Bcy}!pzso0NZBuRMZxS{gl@^!+5g?ufe<4FOa2{l+czNMcq<1L# z&{py>OhX`45B>4mAQra(U(a$&Vn(3J;w85HPJ+>Y@Qz9#Ri(`9VX5MiqT?%!4~;H%oKxet&38P>JavuDI1T|>t%7d zk)25N(E>QcwvkE-FXnCth%}>$CsX%6gDruUV5=>y$<5tShPz-&&1(GN$j-8*m2ap&#b)rY@MY1UDtv7Vn%OOD}RZdKO;q-(XBviCjx@J3X& zkZLYIZWGht2E^eHO`Qy>XWG%E{-GHR^I;D9m|N1JzPp^_ftqF)?2E9Qd6(1tm3&Vb z%^?u^Ji>S^oc%hN-~?2fj{=zvK!gvb7+f^G!t>klifs|HtIcNK>=sifN& z9oJMn!+CN(65xhD9tyDbcB~7(W+D4q@0i=B-jj}Nk-+2K8D&D7EarF^J0v{IO6wIr ze4h348Dl{>6d`W2db2oFsPcqPrO2k}e40gw?#t!RBJDk>7?@U4r@t`D`>ES|+2vEr zz|Qx7vsnmTM@jW+>ciZWJXP8}P^NFc{6rC-=+b}m;Lh&R6Tm|?cb)d&vVF$C9;*@u9IN`ID(u(-3{x2gaqe9$)o}1e zvO;Q=QrYF)vQ!W|c`dW&RUP=SWfq>I%JMYxjS5j^{{e!n zsdD8r3!GZAz#92zW_W8x25RSNG{IWA*$@wM_pHJK-J5{I7)n%M>i3+I>vMR8(Z#52 zg?>7ZQotasRH@f|;q{O8*&mtCnh}Pl7NE@SS2) zy#~7ZF#b<4TpfXLbE=)ryQ3b_8;htvrlk1WI_WWh>`ZTvO!5Z;;-CKG5w77YYpEclD zmyHA{x<+ktOait1Z4(M%|$m+XBf!Wa^MdU=f#}9sLa!i@t}6 zOTpLZ>^9j8TJRiX@h(0+BkWSpi2@KgK*Rm>SZtw>X&|$%} zo9Jz^t6Qb*Hs-!NMZFBj3NG`g*2*c5t@=W#16KO&GQk5YNPgBlQd4vE>n`I|J=~nM zcDm7k+shMKgz@ltrV~O0lJSuf8o~N3FHBghb@9NyG1;!yAgNYO^GIo37@nu}Xr3*b z36(5Wk}5Pg1|nyd#c-t7M(2Lv{|dU3rGef1pACQc|9cyR?Z5t=#hB!EmOj)*AQ+L5-cpAr$)tQzd{yUY9-?f zFml&ZS|llJx6s?m@COOb3=97%B}slOYQI%U7+cy@HMf-%0JHn7vsAC6co(C4^3}zk z;~klmJCiY1I&uH@h@y-7$?MjrN>2WA#yxfg62ZB+hwm{&DXTvC&=gG9&&=6xbCMRb z92(h3T}}^BDikTyxp(~)2b1*E7no1N{!Aatg08y5Gv$(_Y3}I>X89L3Qn;b$Nx1s@ z!EVRrd1<~5pFZ`Q(Mp17BpZ3!6E^(^15UL;1*p}kJ%dv&6A0?Dsb2=0W?MpJs)uHk zw(?Q7^P5*RIO#-6OH1vUfgFA9iL!(75P>oYv3$@gvqz)CVwuHnpd2AUtJ_EEf0vEp zlTc~ibnuJj)+yz<*8tK>*infowzU-0@~`qJH<{tAu$6dHq439#<{^5kC$zMFf)TP^ zV3_&pIWOZrIc$Msw!i(~S{cPH#3X8ht4c%*QYM#vCh|zf$hpeXpIA*kuP-YV1+(Ir?TsRg7eQXzIz$GyRZvVZ7by62H%`ecp%vmg|43xr=RWa|Mdl4 ew+uAk%_F54yb1rqk>UCq*rOn;DpMPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!Tx_$3!-lMxgkPuNq4D7-dyJK{$(Q)kV?ryOG6+y9E6crIgKtj5C{chL!f8RQ1 zzjr}Y)cHBX{O|YPzUQ3Xd+oK?Uc1h5S%Bn`M;>|Pv01|HT=U2yk390&43QV&dE}8t z9-A@pLOhQ=^2lQ|MqY^Lkw+eRY{tk7@jUX#Bah7(c_E%h9(m-k8RJiGF+@6CI`f2b8uEh(ykp68Tx~Q4ZoF|kBFqM)GLI&% zMlhWm3**ijQftS;q|j(bY*2Siew+xMu>Wf?#rj$Cax9u?0hk8^rQ2UYnDuh85#(m< zugFgxeP2;j;|v&?lKmgU*PiXNRhN~bc& zhe!&~u_VGWuQ}n60-iD&p0Q{xGXi6N0SV+a%S-}xJ=%syrBZ4LV;7A^8~y($!Q3Q3 z>lFAdnISKu%;Z7jGo2!z8!9*iVE##e8Z9H*gVqz>MIw=iwh@9hG%RK!jk-tW*}i@+ z7>aS)@hVK@id=Wcay|E7M+!WV$A33AS%{k^rFE}NKpTkTcvL)KRthB-v`LrSEh#v~ zlVEx<4uysKSMO-7Dr9hV$EB_zA$9dx4Hu6?ph;3PiI_%BeZg(3=n!@g`pW!`5joe* z2h4GjhN?5No`rD8WYNGuH%Y*NZY)t6RxE1P?Q#S#!ln_L5s)wlM?vmV`a_7oo+6Mw zDa3W`0|63GCLp9iTg00|8fiR}s&%#1Du7ZD;NfIU>6}DerQ%8PxKMX^PO~08ZiGc1 z;t3>+v{1(sGZb2OtujNj*J$nQuYf|C!aNp3nohl@(yo$wJ3ypjIbiv~c?Zdjxt$ZarmZjLq|usQiX_Oyuyh4!J$+UVV&6V~F|ZouiZ{}fF1tOr^e z^V^`{CJ(XNJ?P9i(q=~!4Ej-5;G;bLt6+279|7wb3>&Vkm1sjf8edR*>NEreE82_7 zx4r$0qZH8HB^<*qWHW^u1xaCH5wu1O>EjSA;FSc%_VHL+8$28Le~WhZN5Gtu{VBq! z6}!=%ltK`+f{w7NzD7xRYgVRkbv4-U0!#;tN8^JM47=|Sxm(T$M7!L zKufv*o;&4-@4uG^AA1rmP0gDoE1YV9Mwo$+ps03p4mbc|l9u}LO1bcodt}6rQF7E# zyU41QOQlt-BDwtHt7P6!HFEF0cS-BE6&g_*!%u1ll;KT+oGJXpO#dgqj*3(N6ym;k z9GW=pylBK(ztk;QEL$CNpxk%w1G4vs5fXv0@B}bcNi;xX3rb1_H-$6|q<<2froW^R zPY@JY!~>FOpP5Y{ex#I$%au3WDX+crxx}OO(gJ>6=?MI|r2p1i%l-!+B149cfWY)a zFd;uAC4}_JC!Z|Q!jL@r*du~k5-*3*iKHYGF$t9wId#gcQ20RjBYn;ws4$@8M%p(8 z0$Gegn|1f#gAd9LH{5`_Zlyw@ZQHi8eED)|-@d)KBn(EnMO@@nzW z!BB&i6l~GqajMJh^XT*w{jlh$C3`IsZb{UEAEO&oAUf1KDK2Ryt5&U&7hZTlzWnk_ zS-EPp)YjHXS$T8WYwx|~kV6iVo?Sa5@b3i^WQRf^y`R+wTdo5e@b-3imc|Xd# z@4YK23^$3=(o!gbDH*cu5E(gg2MGiNDquKwXqaXb`kVi1aB7>=6COWABpNr{8;SM! z(@)EF*IqAs?KlF%Z+NmY5RTA>AY@mqTqW}st&$A-E6NYfon-9ZjG^_y(Jwm(8c1-l zk`bw^sh5k(;H2zy0lRI`@C^MHk6OAAKYwu-F}N~(PsmVG z3>!8S_oBkwOn>F^--SOd#9Op%iQ##3c>#@)*yxmpX$gc5t&{T6Cm%v^mr3)A=4xF~ zh#@q>?sv#x^7k`Ok!IyZ+UrA>sPLxQoQHBOKIEm-PB^d1hJx~-QGET?*V3hH7Zn1@ zL|Xh109joI&B%A(eJ7uOK2`h(OEF3r@AaV*us}yNHm*a^=&qHF9fniq9?L65MSeVs z)YfoOQ=~(e9&*eHC(1o{Lrb49N#@L5rS$b-D9;7E^DntX&N%KE2pUddK|`m;nSy{v zr;~N24{Vq#unASdvT{D02#3S#)g$jI7}$A?8#hk*XYAOq{}mlJOG%SV*o%^UnD*t@ z5Wt_1DI48w(dP(p$CBk@nG?~d`1~Qc38Rngw%blFf&d>da3DO{7_#*s*?-@?q+|Pb z7;!R&e-oIG^XoT)8o)9)}wl(ry^+5NM1> z$XybI*%E0$Aw$s4gdvRoTrh6Cqsi*_FuaSUYNzdn7o9qB<}0=O;Fr5cRD0q?J1fRxsb-hSdQ|ZHLfoMe2VEn0 z%1F+nDTak?an9>WE#G8u`AAKE1CIM-|MOtEWV z&8kXM6~71yX4AQoUZlB!p*QU~AAZCUN65m33#F>6O6`f30x62i?~P{ zjzqaVlyPztQ&(FlQ$C*}XPtGH`X#c6mm{4dlFT3gr^C38#5~Y2eUmqnuiDyLy^;oW zCyx_Mmq{y+B9HVQkF%`2+HHl?KlZ|@i|gAc7elg6IM>hZlc<-J9iJ9L`Hu!|CY{u^ z70#10%!X~o~>4H!q z5l6fMFj5eWojV-ttUIznN=k~faTXUBs}{r|EE&XTeH_x0ao7OJSZ0?58IuCWFcTNm zC_rdOrZbFb{O5vkGhX^*dVFRcs991V<$^TvBhFX^LJLb7RhYTeSOV!?;J zfF>aq=e!Gafzcl-)cMvzlvPDNG-Rg5Er4ujOy5#E;D=jEpqZ1@k(kz&gxE1K42J^j zQGwyZwv%tZ{#wbHj5J6x4gn9r6hQ|ZM8_G4rtIk-A$+VTA%6P3r#x3{j#hXJA2ZxT}LS^D^n|i zxniA=Pc@(L&Ml!{NJ!ghf3jAkbs+B=T1!}h_vkY3CW>ws?TWZ5QIM|?Kz zjNm=<%DOdW%j1t@lPGAD-oSZsF04Fa^kIj|XH!0x<;z!zAB`o$p+5fX`BiGsXq4o5 zRQzibUX|mHKMum0jAn#5B6R!Z#W7FG`R84VA#6s9OQ8M1nhe3pjz+`s=9_QG=+TEr z_wHS#ckjNk->3uRlTW6ASu6E67h zbm`Vzjy>);Y1OrtY%^dR8S~teviCu|NcUD=x%0N0HP$pa3>OWwhEL^ly?*k?1D2htt=Bv+_7hZT) z$4{jtel%W>oPYK|<%^F#gI1c5k3XIwyYIV?bnMklw%T@EdGMh}CEAeE5fi~K!w6dg z)3^<&O&S4B+S-CBsAvNbTPiJ$AJUlh&pNpO{`)bK=qcU0b(4b*I!K;+>M7kl zL3dqOfnOs$UVH5|Ir!j%wY~-p9H>(nYuB#TJWzO3kWe5p{fjTYSVoK(p>g)>*H7o_ zNl12pWbtdSx&D={9PV;GhG= zF*1Ah>_*{NP*5ZdPzFvM&0TOOV$Y-B^EeGs(xHPY5DGxn#KRStkd^7zUIq{@p zWYuc4&wxv+t2lDCHGQVV_FCUiCr2H9n0!BTIy&gIyf$f~Jn_U6xQ8~4KW3DRjVrnUH?W5SP0zm``>N-+ue8%%4AB-hSsD z>C&;YoO05M@)k!cXu!R;=qs;Im@Eq_*Fu;sktZI1Le?ytD^sU_DMuf1j7)yzeOa(3 zCMO_2#~yo>%=+vVsarlvuD$epP!v%>L(G6?yw}YJG+LXWJOn&DqgaxSk5q*%++1F0 zZ`_0qeEi`@vg^(x^*+PHM#7PfieXhc8CAG}!Zia8F)r6$b3Hn~ujGa2o|naQf0D6d z$IGmlGeMWr?6d(cYO@}51v&3Y7o&x-;To-*f}6CX&}H4wo@)TSQt)vrBEwTCeD&2= za??#WsWv-r-aM_xd+)s$9r!0&H>Lw%J+SWRmvwc^Ew^ZWk#7ti@yfbop4jO#{9ueE z-+S*p?d;z{eNo6zE-O~7(DMPo0H+SKQdb++`k^+>@D$`mabWo# zfBbP3fZu=rJvxC;Rfv8GDAPd@piJpAy(vS`sFZ9|+cq9R0?j{3Rhp3?*_0SvLX#>@VI3qVkv9s z(k0g4{&uSM+;et11hjHG{|s-x{kDbP-h%M9AY|1J3~E8UvA~qpIp>^XfqB%PKqIrl z;jrFA2w2cOtfP)PO6?6Uz4THG!ddSj94!b6y*FUo1hh8`4a@>l>oe^cCm33v>+0*R zLH+t$tLFZMh@vQSOzlVSetcYo1ldZW zJSo&c3URYOl9?2KZTc~c6<=Bm#_o@FJi zX$*L8>Ipq`!BPa_3UhN2UqFQedWEOC!KT>c<;5w zFc8Gn1s7akL15}Lk?S8FuU^r~S`aSQ!i5XxCzuw_beeCH2E*P!~-qJrb$3l}f-Tg2!qiRu*N-X5khCpQcd**_3tp<(FGW9C3sN zL1)#}*li?{LCvLYga1apd-c^ zOBSzIyLjBDM?7w)HF45->!g!Uw4xEizu=y19DEejrz@_!*m~yKC-j~e^UUMcZMWa( zJdu8B@b&`hxZ{qs(8<}>fXTDD8op8a#`~E=U=F1cEk~fLwn=VZD;Y3Q#A6bjP>^Qa$!?$ms!Ine*H#~v$SENJ;ZIzB|_Fa${UTS zvdbYi!C)kp8~N3#61Ald`^swd`Z!0=MM!AcFkS?3yEzwK1g-yZXh7xA(uSaJIHcyB zwjV?Mm{iwP>ij!T91>`ll1*E(*ZzBJ-LgDf#Dnlr_al!w3fk+(daoJ7KSyB(Joax- z6WEKBoK~O~oC~f&yz#~xIvV0|d&eDj)M*%|#W0_L{<(DT-d(oXVvEM967mZ*d4d`s zHEuJt$LR=aog9^Mq{upAeX%UOaz33SC~EyX?68AQ2hfdRU9n!Ntq&hDLZ*KGr8K0{ z;^ru(z>U!jMmWwqx>g^8k%gV=(z*x+QMYcF?&x71p|b_wc?CjTr{Op{y!et!WD0j3 z!5?=4>AP5v2Ztqeq{!(ymX*B2{4$R$GxyYUs*Y1Fc8Y`rEq|r->)%&8c4{R}OHCQw z?#QjDJB=JEHPtoX?^PHD+Y65_XxXG?G8w^WB-=RYX>Cmx*OoK2>gW&L^2u~hr@6-*mmvOsb9JoL137R49Fc4=70mi2E$=CK_NoFEEffZNq6z$#hOl^ zK7AUe3&_-*uVv$-fT7>rcHK=@E?*{z>MCutgb%`&^dbfL4w`_^FMbN7EII%TVSRX} zPm-K#lRoYwL76#MNmxod8mCg=2K7(;fdZWx;l7e+JSy*h^tzmS`eE|M0fWP_CllBB?>N1%3$0IO0iVWQ_0IuouHf+Xw{ngBXI3I$(d<6?MAb{`>0`0T(C#^{;>F+63vx=`nVK z6vC{xop#!(QAjf$8s>$dP@&*uIs^qi>w{A+6vnJ8Q)diE;l(s41ozlu4-G?i!qh9l z{MA<1svt8(@}e&Ebr9fNm5rbS>x9!Gng%`L2YRV^{9b*BjR6n+9Dn@ra^p=mNaxO- z2M*~mn@niE7q)$5j*ZANt8bX^H+zx`B0^=ovvoTjT)JdqUSUR+AFN@|a zKqKc46aa!Wl7)ZVrXV0(ejfZldE9>SK`F|>kUG@%*uAAP^=PyZSkR0q&%J5*$sv1%q%yhno&_>mtIy-tvGKoX&|t+>Zw9gB>_V zt)dX~qmMmOo_Xm-89V+JdHA7+bis}q8HF)-V6bkeEwh8AFygw!s8OR-OE-&XymGYF z5rT^vy4j&Z(0!L(c9EknO5oZEVdlVT7(e|}fUtw6;ld#oK&goEnQ;sqvaKwfGh5P; zD5;}}r=l2zfcEH5D8Gt81J;cfwBimR?MuOnE`I=Y06#+6@PodoWE6bKx$d-d>D*QR z`Hz3dlaD{4bMhBla4C2tV|NOm{Hhg;<-K>`lCE7kpp4y+w=K1-G+XrPFFkwpm9x%1 z587^xZpS4G!Apg~0%_gK5tN~zZXB?fA$LIh7@0Bd6OKJbCQllxezby|l0ERy!*a$y z|D{_}!;WH-MLYL;NmK4zN<)iZCIz7aDQ?{XJRnjBGO*)U;SK)HU?gXc7PHa-`hNV@ zyE3r%0O{VLhxF{$3-#1nI~guqb2PEsQ$mk<^QXfG0to=@p#tdj1x1<1? zV0l?fd*vSB_B%FMHa-eW`{g{gK;TQBVtnf%q!Bgr4Z+6Ba0CT5cP1F7p*u~_)|D=mHwP_&XF_EJX42~JUUImPB1P`_fXTO;GsR!GnzVgBXFBm z%d&D=yKbE>+W%Qu|>dUd{rZySSjl_Ymy)=PBoFO6L zi;IGC)zw!>?b2y7Z^jH+xv)+qzWj;ozxUzL$V&80lM2S6m5I&+DzqNs#}l<~-uNwa zaE@nM@!gb`E=KbS`2+2|D5H}j$JPO&rG{wNfDI?Lg@5Lbkua!RadEi=9Gx~ zLA{aYq#^I=hl`F}+~gt}J5pXb<+XI_QeCX%0vzko)E9S3OvZ?V3xhml^YqhCYbVYj zJ*U42))_T+3iFvWXKF{xMQlz3Xc|8)l$Xbim9{M^8b@5EWu@W|*-8OfOBW>71)~t~ zVHS0l#3(3?bf|1l$Z7qeEIfsrWjyEvyb$c|+P9UjzMLYTeEONZ_~Lkth4s+TP%j7W zx34T*vs;mcwDSjY%d}i}E0cXe+ekdv^E& zwFbT*3-Pei5Oi|ds-gLBH*~nnnESmfSTG|iMhyOhO3^qZC zZyb#*0%kEsvJ=U;3iAUGI0)MKCptAi{P4q%s*O@(3WGrzx{=2WoaY3F-_dv&3}!!9 zRFp%IuY-o{2u$QS7NfR~#(*$9n8JqM7{NwhyW2N(dFB~y%=E(pD)h(BfWkYC20%BRT0vnsl#Zj36(ZjG z3l>PA01e35vrXacf!4z!+r>83f{_NbDTJd9kHS;B`Z>Ll;V8zm;2eMq91hpk)njPf zpqf1(mUzzLn=yPMZ zUx6kE6_sLvT@?id>CL%Vc8qM`e5M9Y=o~!ihypkl95Jy@=te`ZgJvDDZdsq~EV)~P zbI{zW!fk}y@xprHd^vfSg4>L$7>*r)5!eK$WB6=@qNbT_+Inh0C4%uVeU3be3JP^k zH4WdnLia4nn!@Oe9khiw>+2gN5{}Cqx8E+4CcdUTLq*8%wjtI7lsbttprZ>)X+@dDYarASMLNm#fu{8lqfD84 z&f|~ccL;IQOmhwD2aSc=hW)^wjI?dr37XXqXg_1rdd7_JrFXAh(xPQ^Xo$rSB2Dvz z>%*l754flXxu{brZQHd%qjp1Uu2CO6mL3XubPsbpme9FYUEm|f{R%jb$i+ztTY`*4 zflaXCaq7cpX=a#B!cjy}Gf{v!OFQg%V#ez{V6q zo;iAG+paC=8Z>NL%WTt=H1MF&@R!w-M@+0M(~N`pb88;K!)g@X z0puZzjyR3*B^ad^V#E}MCQCPVXq=YVe)}DrMN2L?a&b4M<>TvXSrw5elqC>4;D<*1 z8}Iifc{Xer!y&M%)>TPe%{mD~;I3X>sqZWzEC_K^hultRKd}s6Y1N^NtXi>JvWaS8 z7gk%#(FW(k!4>RGR1SD0<8etL6sB4zY-_65!VXSeb`3T&kY1!eVLH$}{y5fabH4~^ zXEyAn*JQ}VJTh!o1hox4)B}e6+uu&Z5b*_Bv~U@Qeye2A)`PT;>Bq$ObMWM2KztZ# zq77*7*eLcLwU4~`(o6P} z`OL=6DHrY+-*3PDG(6p@^|2E$!*Mbm<1+KM1cePX{f|HXSmULk*2XJ^0vn+pCFkDX zz4qBxywC)7QX1d_Q-G)7a8F9w%#OQ^OTQ|^xqp%)z?KUd(T(r&aO9zVb!ft&3WYJB zIYmnm7mJ{?LIgIQ=#f(*&TS*m5TU`lk*8d0+FG~~1GWIyU{2y0))B6`QEd?IdeHF9 zrgM+X;>PaqxaPp&Hm6DqNOz8qs4W_L5~Mrn$}0r|>B~B%9|~(zpERsDhU0n&uN2Cx zS1v-czNigSFdIHGyuoM2%RCsc?&-$}ANt9?lHcggPB|0|Y4NzDO5?*HHE_D)Utdqb zYf)j5<}(CC#h0DVk|oP!`LadG3r2*9i_zODpiZf@;L2%DFJA!vD_}V0fgQI^yOfl- z>ma>)Zy}$2`ngR1<~!-ouCsLQ*ioV>bTWQ#<5XKfcQ`Q&jV;8>ic93($?vLr5d4@? z&oC6^$l=j`gP_)ja+bew_mhzyxF(9R}w75z6S! z7843sY9Z9LJ9X?PTW;A`9(wp;3|&iP(BNJgNqx8;Lf_UvHwLnLBpT6S9Qy`tYa2Oo zNBR2eFZHkqc}m+oZc0knxZsZ+L*t4%-R-;)hI!afxnRkKurXuCXya$Yp+B(3twoH}d10 zxw7y6b_W4{Os}DWkhstpQsAn_4H|F-g6|(FX;vm{*Q}EU^c6u^#i5140dazcC^x4% zb-I(#+Qg5GLI{e!t)zn9ct#i=>TqNDt98jRF!q%{e5)d~B{-6j8YSYe<2UpKt?{cP z0^35vbD^7{9q)|W#-Lsu4~(l8nz9j!TwEmG_;y1hSn0;87HZUQzx}p`GeW=!Ytows zw2X$%E9;hE-O(SxI0z#+c<6-N45|GaK4JPsOJrwa-l#}-@(erf1q&8v8pfW6;mlQ) z8bqgGWd1syEn4F-I&Xz?;xzGAI*@V^E6FnL46!joHe+G$7m;Qfzf%9N?n7wxnV%2PDz zY@M`=hP*;i;DR~1GK;XD0^Lb8dEy)L;RjQ7-6a-@BYtk>Mc#Y`80~U|#*r@+QRp~K_;+-J_cvCJz4I~Py6hy3y@u9P!Q zKTGbs>n>>lEk(B#IKn6rsYe5fH40DW-zJMkDq6LaFQ$G9;lEhIalSlkjikA?67DJ8 zVhJFSy{(U-xnPV3xHoY708m=Q_f~*5>=Z}~`sFB!g5&C|uht{s`|rQMrcH2{#7QTeB$r)w znJ%sx0mDv&cBhj{AKgdZwry*BE2@(}=7HB-#N#|Yin=kCu3KO-(x?AGS+;b!?$YVq6ABj4 ztRx^wH06-phiP4<_5H^HM|UVwk3PNSj@xdOQ%^ow?!M~*iN+#GBc?CHJL~Mz<*BEi z(DMew=+TEu|E>DTk;fh_Pe1jPwh^{3)(h*5ZIN}J$Daf$eG|ZwSUhR9p|PyH@4nNT zJoyc)zTQ3sm&v3oR4VVRNF;2HA2-2DC3y0ZZkAP3zZ`D0RybN|-G19W)~n+_5l4v=}EKf1=3}@E*?37sZ}>R~xVoNll(^=qxW@3_;N_|~Viv?2|0E1M!c5>^t1rCQU_ zpx0z7X(bZKN2=a>_MyA1S0=r#)Yf<-N$Z*`uCZp$_}&hi22HX_t07k3NSoJRoM2sf z;iY=dbE8QVAcHIEuSXhbkT(cv_4CLRk6TYZ`;4ZI5uDnQZia@dKnI@MoHE5e1)5uL z^z-PWkLrnB)*DYh@?@id@yE1zY7?EQ)vH%8YoC4gv7UbVX|-p31h1yPR2~SYgSkf z-gl>U_@M__!?qb@?Y_&-)>T(tZ7o^M_JF)25VN0Q9B4NNUwt*zI`PC4tzpB4Ss3YA zmtJjpT{0~(t;pX zS0V|I4N;x~CJ$z{}qYpf6?J{y#YwJNR07sR-h+Q(n1ljnb6uhjqvHIdkSrb<5+=W0St@15xjo4Z-f+?&49c z+H*5HY9k!}p)z%!Hy1R)2jcU)B%Q4huTKY!=;Z^d`DN1>!eaF6@>C->ZtcTx7s>Gh z$sR9_%}mv!q8x22-n7>s3at@bXX#pm{bJI#Fez93f_w`%=dF`3q$a%Ckx#;0qq$M zp3wSZp)}`RQ4VNTY53(=?Ky%E>6|yT;#5XbS&x3Nl#9dhSX7FN3!u#IlMy$0aO0k)_= z{P7;y)~OQ$wBQ077qy94GO2NMl*6eG)*0g>t#ju{Nk`hV&P*McI?V;$>Ce;|!)>g7 z4IdCDZl?W9bwyCiX8GyIOpk3ikIQ&Xnwm$Q_HgSL^1YxN4M#e^gg8&mz&~liT}n0q z5ijb1?Pz1**oW^Q=Q4?IS4A4>IMNIHgdbBO!*Fqxd$?H*ZvNs~-*U-m9yfP5*>u<9 zGajU$OtK#MK@tzz8u`ga8rro@D~{IS9rwEEk^>&~;=*~#vR?=6_xdps;o1#n%YRN| zru|EGmB*%I6NUIM!!!n4IC414if3c9-%-rh#`07*6cq7?AUxgNa+HuH1h-2d99(`q zndygYNMu)u*HsLmQphN50q#!ekd3dP^?EqB33db%r738m9)>qvku4tNHV)sL|pia;USbEq50@>%6Br}4t zr88`ZUVY7JF@-$s_;M%Mxp>G2jh(M8Zg_?~rD0J&Lr8)y8W!}|8q&@d20d>onSrnepF>#l2tJnw^(+MA zCGVj-bW1X>l z2%kY7n1-%dA>XQe;F)-29NNfX0S_uL zSnGHUK!9VUtJ(_}g~;Qa6StXz4378^CI(^7udLYdlQHZoKe(XrfWgTeoCjrNr!fuM zfQ)D~DZ@MrV;Z7a#N?bT?YKZ@;xR(TW=i|;5kY%0JHzuzV+1+vY+9gkv$G0eWB^So zn&7-47n@j4#GwraR*vC?v(s**L0ae$YS{4`ZE4PPQbWf-K{`-4Fh!=r)kq$)AxA{l_)MAxyf=9z=xzkJsY~X~c<$LA}Lf}Vuqvou6vWGRcz$OixbeJcC@#-%K$v-B>?W+vy50Y1r z57b-Gc}4KgzzDRBQNY6=>XDr=!$%_a`%Uy+=ZKft<&WQwx`sVZ9;ebV@D&>+qoV%J zJkX=fa}e<;A85w%Fg@BM|Fko8X*yhvbn^If_|uv=8x1R+Oh)834r=0D5aCv5))~YU zw7~{2Ljs*Nhx*0Z{?lnNj0akKs2)8zD%>iAA2yyim<5eceNh8P8ZKKqg0iE$&Uh)5 zI90&L%!WipA(N0nm@f(k1G-Z{6Kv=#zR|dNPs1?uN4v&`B`=G%=s3okVZsX*lB^zO(D+p~4ks-?#1rfqV zQwemg5Z+b_BM0OJ!|9NpFYQ8HsjPOU)acz9A?a2(6wHNuvB7e&)TR#GvC-!2j*)f5 zj)Y&&_xd5A9KInRnR+uk#A|MNg7>7Usk>ZS^P20IFn&zk7?^w76MUwC=hX<9T+koW zr5{4e0Xuda%x7-C4frk@9fpEG(a>P1nSvjXKTZo;)J{;RAcxiic|+?M$U;MpChZSm z@CZH2tLd>*f>7lLKJ1PfolOKC7djFPBQ%#Ef)<^&H{jNG6~L9$(O;I8r>}WM@0*BY z6oB}Op}AMBt(1xu6>#F{*B*hg1L0nA3T}4Vq$R~Zb4X#0jHu#38;(Bob+zoMP)_a} z*RBjSA^XK57}bTq!wAPRnL1;ca_cLP-;X~n#5V+E<1m}=DlRPKk#-0dYLR4O)k655 z4G!3$F(g8$W*!TM6)M`2DoMb<-_=YtJm}bx&PE`N`L;j^IqsRYpb=Qmh`^lWBYxV7 z&4pX%2&Q8MEgKv)Be**G}?Z|v=SoCW^d+u-`Q*zavS1mWf zbNYwcZ90yI;6b_2uSAjW5a*$(S(ldUNY{h@1;vwu@--WcBghkJ$;6;Fc?(q-XHsd2 zS#j|f`{4r(4}Zud{&0tQ`1ZprItm~BvpaAhnGC0(f^KO5O<5iu5$C}oAAUV(@L7J+ z%LBV0-Kb%qbId~Eqhb2lIMKi}$g57FkRB`-{85-7nC4S|K@w`)yb|n$Rfy4l(td|{ z0QCU}9gg!TI%#P@I?|7+2f_$Ub_BWapr*YMzNS7Ho}GfxoC#A827ES#U^u!Pe@u%z zQ+UwGbQrn9hG`i4TtURV@PHNtpl&NJXdK)Bk8 zgd_D*$gQq?M!YN^(<8n4iMcF0Z^Xeld+OSeXiU=xgust*vq&@21RcH~QIjV$VQO16 zd}}BCupEq&SGLK#0RQv&H_V9}V>2_SR2rENpdBkYp5S5$HFh35h7Opau;HFryOHvx zN$E@thJeN3HNF-VjgbCT5I9T+Ll(-U*kEZ-K4JFRK-@YMEG#V0251_zG9ff^=8s#P z*r-k8Ga4NkmW_}87=|#7hM-?#2-@cg1cp_?gz&lcOq*etCc|)^lH2nvG^7|t8EI%d zMY@L@f(K=Tyc9o-1^LD~aXTh^8iTWp5S4JyN482ed}|4XICJL3ALk+=n-Lg4+!_cv zC!$FRO*A3|XWL@L4Qcz+TLtJCDa74uq>P(MKnQVLA%zTw=@DpzB|$b;q{68yZXreE z<1uia_296bLYwuVzYYns9V3i(jus zPrs)A49#grLqECo!1!rz>W$B=b3Pk81J)VsOuY1G;>%6bES-`ifd6MKYp2uLM@{`keYgB#7TGtF9wBc}0wxCcQHqn@SjAf%iQS zlsw((f^eoV=2V)U4<^ey5+7Go7ON7)fvsIG@@P60g%6kby)2iVCf%6`->kvS1tFc2 zXM1z<1|N(^^9R2fMC<}z=_?_iG^iu*;ckED(;jUZu(PEw&*P8d->!-OHmFIMMg#6> z;xYggt}qRl&vYWY;&>n`unU=OU zCk%}?Psa)I8+XEq#I~~i*`Upab(Y7b!4QpCL-}8T@v^Bf{(mzZJ>+^e?aY978$&K{ z89(;5iHn-h_>>#n`d;$*H{w4a#Pi4_k391DcVWY>IFCH?$Rm%<2zeo%M;>|Pu^A&T z#Pi4_k32SGJ%62owBHwBv!c$+(na5lo4NG3e1`_^0Md zP{{G?IuvS~GgvOuK@t3_&nvIIB8wL_|rn1 zpQz#srU(izTcfsLLi9_ZfHOia_e#x_pWfQs!S_I$&WTr!RLsbPuPtR+Da2{0m51}+ z8O$S(JpLg5v=FDz=7$&veS4Zt8Q8CR{UvZpfdY*F8J?j3ii+mzy`ioN6!gEo;K{c; ztmos`y~Dj}Cyjd5pWj-LrTec(%(wEneZI!G=apBKO9{$U?3Al%`iSprCiyKXgl66p zEAM_iou9ijm8I$K=OBeNW<~&Gr;?N2&m+zwk39a%u}SYvY4VZl)l!Z7y6di$&Ye5R z(MKN-!3^ya0-RqE|6%5AIp&ySB_2=8(@#Gw-+%YLhS_SXL2~jbC)!asxa+QaW!9{j z&`4vlcI_G&FtDG*Vo}*~r|snM!$!l0OWy?N_Z7&(pBBrc*WZvC-%gk2Ey`uL-FK1Q zcHI?T_@#XaP-KyBM&lRc34VoS?D$vYtvBC9C(%q=RFuhy#~vXq+jo-}UU*zu_1#{E z^zSK!d^?{nA(LKwMw;~+DkHWUARoT_p-i0orex6BTztXbr8UxXxr;U4@8>R-Pd|Q3 zX3hLcU-5d#zK6-qJMJP@kzc5DXRB7ql^0wj@r)(&R;-qS7OkYbs6bkjw~&JmJ6wit z)lZhrnOW3T)A=TuwOkbp1eX zESZrYKk@*v?Mc_ktZ84%lqCr{_3-_quC7L281t;mm@!idnia^dyKFCe@3kl5EY!UD zA+x!BoIp~1f1;0XO0@W%55S3`4>~9q^wx_ z_ZtXnXx9*?-+lLuy!YNaGIFQg<+x*ymp*;^%BWHM$(CF8m&p){&prEs?6LbE`o$Q= z#P9lT(YudMHMDEjLH6Bu6s~P#$hO-^D#L|N2&_P!%NASolS2F2KMVOkKXr)OnLt+>Al?$aTSK7#G8?>rNz>{drygZ{j%L2 z`^pa6Z6_T%b(Ai>`bk-VTjqW9fsB1`x@^1aNGbJs#gk1-CR(en6utVgiy*+CmtFVR zTXq<+y$tTxPwH!{<(~T=mKBwCvcs^!66Z$%(n<07e3zpwm&Zo%jAQ&9viLU)f+Pr3P%5m>kd_NMvTS13 zy?D;Y6nYly#?A9sbjFsJ4_0!GvV9-fmQCGwe}}BB8I0FNmY{I>ENMrXeOq+hjq}tt zOpM!gN)%L7{?SWzS$NgZdgkZY)|Nac>$%FQ{j0&)SlxaFdEP*XIjfFxpwPUX!GC6S z-gsYAdpwA$&R6*`ak^IP!ZYqPja{k@!z324?OURruo*48GP3-4-m15Vw>b?oGZopfJJ zZ9i{d6b%e0Z#fr5ErLE|RrP$>Z0TPezVKQ@j^sc|^9WO?$cIWhIB>;4m zIx=v-PRPThzryiuY(&QB9@GchS73{}Iu0MId31*pRc5wmW2UB}H8L;Hb=%c2K*JgWmyR4VEhY!Wu?G-4-Hmk+j%E>_ z2yOJp_kbThZ*;h$J|du2Yg6L$G^N5Z@*3!Sm<9&_l!^#oNQ{=*p?@DM;?PeWK;%-? zZnCX-{j1xo&9YY1XuYNNwBhIX`fs8pL~U19z#rJ3ybd{&4nA7{6C}clzq^Ay zTdAp8F7EV52gU;_ZBTE6lTwoY37-Xe zz|Arb68COY2!x(!_|ec@RC#oHJ^(I55yEaVYi6vM)yL;eWlUT6TqVqVYqC1X@gk(6 z3E`H{Qi7fFYJ(c>cGLx8hIH>mEI!x~1!~w$Mv>1{FM^mt$wa&N#O9Hkx$dPC$BSk` z`eJty8mMv_SiGMviIVh`31cNOvf)qY=C`947nfyN()T2s2ID$4ElbiMZ(q@ITF`m} z*gxd=9`)kthbnx#>9)&He97wn1cDwQvWMW>~mZ6$p)De|%ivF>XdC#)jE-wkpk?o*-wti!)Ge9FCDnEl+z!5A^}A)q{`w^C9{ zb#w-`%H7{jxal|Zq<5>IZe#UF70y+?Q`1xgV#+WuXc!TguSUG_yX(wKe{`^v2Va}) ziUuMzyUeOG^nIF(6zY%_xWVXoK?36PMY$pKbH?s;##jt{1=HEQQr><#yNl(S#}V)? zR{eOkjOK>+MV&Z!I(NerIfb^e!bN7r%ZgnHJ*N9#;mU1k2yo@IKJ#XHoW^A5f2&Gw zNT;-2Ue5{3HtQ3!Mk2);z@$pGo=)2XFgblFPs;X(CIPu;h7vfzv)KAb12T0{!im8} z@*;-qFUbz4L%jIoNY5-QU+^J0yGE$y4eZ2i}*|WRp2JSgZ=Ll=3xb=$PgBA#6?du;v*B1tb#p@*D)vzao-`y=G62o~9y|k;NxJGz)A^s6C#84r+CILQzf*9T411k-^3k#+Cs+^Ay3NM=PH- zx8+RU@8@e!Ro0|Pu#fR(cKMt2)Y3Ci)`bM9=4+Sq*ifdnp2O(wsyA~%XT9}zC7@Qj z(6WtYAxabBPbFIw2-vrUs~aIntgH^Gb&)}SpbG8BqoGsJpwnqr{Y`}{;EU(4;cEY( z?d{OO;>>-ThAf9LK3DC-vx&lxU3dZ=?&*d>N=gf75MJ0^4aqKc6&c3dv79JeAFwB406Jdjz$a=_JeDNrE<1GC%SR3vt8aFiV>=SlNLXob#mnHFBAZ zJE&}0>1WkOW8ku+Qbsa;^Q!RibT;jT2Ax`fEE<~dMDQ;I2J`^IN`Izf5{gnQZnsO= z{4Jt}?ss_>siNdSCU{SB6a^Wj2H0CgIJwGMOB`6A^`*y;BkK<&6Em^rDSE)sJxvbHv~j@1x(Mp`S&y@xQ$oN1QrG z%ltbxZoenbj*ciT(uagC}V9YTkwl6zc z0}WcBfW;)!styp~hR91PnQvaUDesbrlz}}e6%!cyr_t9E)2_>iX_b3_jG<*0 zNaYP!LvJ{(fk5BnJ!MkCbt(<2?L@3p^#+;&3+x-BLy#Xp%y*PZ?w zPGs@`zsVEc%Fki`rC&y^HQZGTcKp7}GZcp@_-&%{xN!{I6(h zriTnb798M`DouuyqUX9T28V15S2uuS+5c!1>c`ocd_QxoT{Ca#Hd%vLaemcn5 z$RPyVskggcGhpgECpcd(>)E#6nqk)+T-87G7am4X5~T8jwIp`M@(8(&x4P`b^&=Pg zt7rOCQ_(F3anZpwtwodGz)DLWt^QO>3zCKR5Tho9#Gqvwk09=n#7;nt4x zMhibek|gIYcd<^9oQRB1!r%bJx1^g8H>|Y(+=t|&Az9iNYOBX?Dbm%q6oe!>H4L2n z3zzSM**+&{Vr3%Ms@Zu&-cS8N#OhFEbyJ2)$id}ls;3r%XsCP}9t`_QC0w4A5=s^! zy{D?qyhD_(4Yo&^s`YqD^x`uQf7?0_9gIkGAf5lSGSQ!h{@kiwdAk|_eilsjn+kK7 zdv=={V+-CrGX-@7ZXv&boQ34n>AfQW7 z-$H*s<7?wT!(&J@b$dz2N3?9?XrsLd?_v?hMEYi=^3A9OLeL zf0%2EuXfnzjNIhd&zsG$iy8|-znT9z*Rn;$N}R*hW)bV!(abpSJDdXnOp`PMAXIQm z4#5w$;xhzBAa89Q+m?|=oG)0ft*+PX|f zVX#mokZE&*G4r=rq$w^xL-$kuSjV&WLT*lH(KoaomRMVp14YPs>K%|?b%`C;n!;OA z1s)~?60q(MR=WTC9E`_Vo2isg_FC8SUj*Og5q9PHG zGra8TOS2mtECM3{O!|Jf@Cmq>BDT_N?C|EsUCtcIMZo5hr!VC_lZo!lYl?7K91Pc} z@s`dhli*}u1%}|)35;UT3sL7~S>B$zh_bRST?oXGvRaq$RqLlK*W2j8;?~Q4w{1%l zTu7^(?6AYYP}@7ipVM|ZzU!a z0E*$jA(|fpeo8v?jn&l(7=0RozEe!V_JKs{`ZAP_V~{P5tUNqB+k?1M55MnFdUlIa z@ZIRa^ZvzQDW^Da*!?L22^{rpTm}*4N=*q~k z>Js-OO;XK*XJ&Y+`xPJ<{2goI3vv<7*;Kf|6KgriEo)q7VJ}l?o0Y5Fw^|$A~n~H1W__f$fAWa zu6s}~#w#ujIgacQ zbCk!C$qG&tnXI0c4{b;Xhi!tZ3<-Y}8g@QEc3^XtcGq_}O~t9+On8us(Gy1iJ8T`8 zMpw9b%#O)5jf*sLl64q^$$g)*$9iG#qr?)veEuaKAaFm482S2Z`kz1?uP+q4T=)rl zh8%?Pr$|*O2sK_B(Nv9CKa448<#n00_nsOr`cH)bnGe)NRWjlw_3U6?;@e`MeI!UV z?)thxV=0F)UCEGN1H7Fx53Q`3p@NV5Ff+*U7ig7q2C_ruBYO8u2_M)IbI>UxU(MtT zL{x(ft;JC}1V;@Ep46k|78w?4ftOAq#8+9K{SC#!nT>*d?h}9Z@80`VV+_qgGaU2O zMU4k3Zj?RGrDDrNwYO#=|vDLinslT?V&RUr!A-Q+u#ule5!j zjTK~5^w*{zX(t*mvzq(~-H%Ra%9J4JfjYl`Wb~iv8-05;>2{j=nE~l+_YfuElmYN% z#|XRKL4&GcZItPoVl{nZ)7ZAh&Bq_!@90L!$$gn*CmX_ql_bebkR_q(25n)bwSqCy zqXS_C=aiP6Q`tdIFq~!NXQgNoCLF!n7ZE ze=WOns4&rM<8yOjB6FFh_Bg;xqW>7f8-L?Xt(Nkz_v>ShNo+o_Z5Kwqq-sj{pnx_< z?N@315Hg<8E4wH@ACcdBswEa~X!Y^mSLZ93gH%_Fp5TUZ|Y%LQuUKDa^ z&0W_!u@i&l)wt^$y~##d?po}6(U9?hHe07FB}nBF2@%(i>$g&6}ciEyU zU@2*%_(}!3%pJPm_oz|ploV2Ntk18+YTdD^zFHLBvCBzp8M3Eg zxeHRWbbW5agQt1}cLX_F%2EdRXE45=mkOecOTC3Hn~#a|5^=Pxro33!q^1TZoz0RH~i znzF{k3M;pMV>@e*6(7x5fmQUUOe36!d8!lD9hmF!^#@ByN81T84vPwMjcC>5aNVw# z1Y;H9XQiKK9E%I^ep{L6I;mz*c+q-0?kwqaJmdc~9K-Y|clb78d_PP9D}{$+@pG*1`oy8EF%V}!cm|AO0@f)}YiS;)+Lau>CK_kK~`CoQ@wAviWKW>|b z2#T2(0P{-OEE3-4yox;IUgJCHDQe|+7AGL_EzIm;T4iIMPNgnxDl;n1-O zqE+|1eA98mhUF_+!{su_u7b=Ii_&t`^MKE?93S;xyvray7@}2a8J@Nfr^WzAR-RE6{-=ZGQ)=*1#8% zQx0jU63wxKSMJbPqH3{ z)`or)h2*g-f%`J0ki&^Ux+? zi0dFe%zGb5r(Lfd!r4It+p5@0yTryO?FXxL9CAcfW$9j@QqypBrU?txu5vR>Tnj6x z!hpIF7#NtYO~VZbt*awQVl7FF6D8S;nN&QHIu7JOOYMS9HjlfwI`6c2-29&pA=dA+ zPZqzZPl@ix;NI>AZIW;p!08Pzk&k#bZ&ws`;4lW=sqvOLxa(CSMAypS9({PSo+62R z=)gQ;`!kdK1iAzLBZEs|+`1?Dc9AUbCMi5>D=V>cUdMkQXTJ`H!yh4re*6v5@Hc2^Co~BWh#>{k$7xAuAz8FgR7OQ5}?+{~$BATE|!?AoP_v zku_9tbcQ*6?#(&TJ007&$F~8I>oLPJ8=nIdc`mpD!N!dF+_U&}421Jc*Upu@gLD^J z#j=yz9*~YE8&J*>q`YZ`A5T9V|wp zz1eZFuh+syqfOYmhvIMAMJ(*ektw{*f~b)NRMER1Xz=#Rr4tGQe_Pb^Uj4R43+ek! zO;7WaI=~+uLo&Ywnb=2Jt4&)vQwfzr>A(&u~B{0h#69E$n7gjt!M>$IZwLorF|KN={~*&&uV+Wk;f*yw4@5wJh@~Z$Yt(Aj5V{G!e&gn~Y+^?Oe}C)J=41 zzuN~jrr%*3_hv5y^M>=J2->SsggGJ1jlG^wee5GDj=Zq#+$+w^;xbhmdRz&$UZ=v| z*do#G@xf>a2;mIjAa7xT!cMoF0lVtHXYjbF8!_qYe62TJ#$#=c*PPvieArSR?tVdK zjY0jaTn9RKizk7_2*(5vJz)sLa}2ig2UwC!KH)E=>92Qm?NcB(RsKa231@oNe@#@$dEquz#nBzgnmJbIM_6T7N*}WO z@%t@RSy7$tlE-cM#*Hq+NO0Td+Qs7|g3{!06#wWDARkCE&3IijYq>ZkMVXVILCm(G zW7h-oMG)Le9dB3SN4m1@5oPcCl%yh`AY9~k7eOgal9`Ac>;vUY;wJEh9PFalUf9Q| z+ohWUF@6}-qMy*M*G@&R@AYaq3exj%#VvXK^#Z`N9|gI)5qXw;XBT>XsVGO47d^_r zy&fDTrh32j^LJ%kT$UFmki%DmPKz_=eLV!s15GwDUPqD1jsr0oV`8aU^gI`wqCjMY z+U8{h&nLJYNU)?U!&Pyj(IuYcN#%BLE%|P~+@2~@eenI=`o*`N3xx4J`5qTl*mAtC z+9a+z@8#EQTDDYIH@$Ycl(qD#9&cOxvWk7(_}m4wbh^|%8!xHcw*BJP@jIWXv|cWe z_F>yiH*9^5>LhXj)m@OI)m|5j*M2WBFOb4$q(Kc|4$YGvwvfL?IHDcn{2ZdQ+@>w- zcl1e%^)}4zww@P`=0*r+IT<@od0*~EPjdYzPO_Y0EA=|02l#G!!RD*13D4%sk;Kgf z#)4rOCz3S`h(y9{$SHH2S^L|MmUZlu176a3p z<*FnCFQePFal?i~_dHfO`?XlH!~>}QVe|22EjFLY0pfrfGC+fJ-dUX3w!xCSCX)3^ zm0G~eGvXSf@5W(C?uZ{3dlkjybO%aSVbRt&`9!1A^JabAMe}*}-Q&aAKY}oI?2ve( zpX~ld`W}yJ=on8E^{|KO=EI}ztlsjBoloo5|Cuyt3e{IsMFwb9FCPx#_!FCLi2aFo z6*%|Y+YS?H=We!?o2sRo`bjKubnTA{aM*Aez`MgCA2%0~ii!1U4gBt7yx$&GX_o3C z2Q*=Ck0xk=d*PB8HP-Rx)m`$XEPruG=Ifj=kx6KQbUy>nb?49dNy${(Y~bh^VDj`a zbhnsRO0K;@G=a$&dXvGhGxdRkFba|H+#;Lv(aw8&c%ZDZLMNXv9J-%n z_ImS)6cS}cwi<+tOquOn&x^3fVzOaF9{Aw4V{Xv)^@dyYgZ1-Y6yuyESYr6#(b`E4 z;Jl_oe_4EaY~#9<`r79qVE*@aP+ZE}y4rl5F{b5Kdrar&8>Qo79pyxQGR&I8M*dwt z+zf3@)gN7mUM}<8D$oXnT>fUh{k&yyoLKB%;wSagKd8K;WMqmw?qOe1`@aBjJ>Xm4 zCD~IUn0l3a;<0$t3cR;vbh?}xwjH1B9_Ljpi#dTuD$&DbdrrU*B!#>;!fV6%e?GlA z#KP)o_5TtJumo23xjy`2W>cR^6kX5F@-?&9hpCj(nRm;MGe6@-$B$?iujZo|5?Uy_ z`?|GZeLxPIq%o#H<>mR0++Q*Jv$KD5W+V;4VM_J*ev$#V9jUw6te5i`jweKKFcO=^?1vxJmC96+)%_ZR?+ zd?u~E!230Lz+$~jcLq;TU1J9fr15JC(E09#VCEMdn}Nu@JzbK{M0==Tb2SYjrtTz6 z9r%F(&txdaFZIX+U#G#upE6s1-u8h4J;drF?3_|ef4!8Ie+DKPG<9K8@w`56lk(@Q z%0+rFA$8Yk3j=nM(Q`3KSgQ9E8up9ukp0|OYg;orW*5pP#s2CN0c(d)7(s3*A z%jkjQdv=`Uy5rd33S~Ib5$E2ZvGcZSkFu(^zqsklEg`QblE?ejic)n`y=hN3_hW;} zn!;!)ZcL*nzvl_*=ikpXiQE*idyG-9nw}vAbg5K=t)ta}*m=&-D<=ytaz;r=UuvZDG5 zE}Sd;l^2AV5{utn*3QCWIb30kVRn{7 zEIl|^OV@$?h7=#`ZO$c+jJI4e@9RfHeSuZBFC~y7(I}Sah`oClh#Su&?4)$Um)X{0b|~;&4Z{(j^lrqd=fD9TO@Z6SWxmO#9yk-b{*7H`~a!Ra+#(^ zcBNmkN!@A&SX5#}ii%24z&>`}x#byq?gqR&a|gR#ap@CaSo=8??))0 z9jX^ghY<47qrz?{p829&X8$;FD$w(56+=Wf zv4)FvQ{-`rwq}VQV!WPoT}6t7B8db!r$#Tef_Kn=j*3fh%VGrh4C4k8O-o1Y&~Izv z{~>NCZl$#*ez+Z^chQ{;V&g3>#=hcG$ZF2>875u7wx=|pv6Tu#&CPOJ#zqYj^zxWL zzdL%M-oHzd!oN#wT;+_fJxVbn7ekFw&F5Ua!Ucs>T0i!ou2DTz_5Gm6wb;W=`lw4hCg2v8H8NR=Grc`4Mt&IyHafIDbni zg@>?>B&5G9R=Vp9xw)>fPoH8ut8`cKJ;Qg;yZ@@mi=4vX%spvEk|>M?{iy9s<{LM7 zUSTp78G;Pophn8`c3Q~B5SW1lEH~LDq!uq4nZb@}Up`Fql~ByD3Q=QLq&St~j2dK* zr?SEFlM{_&xwVyB9Vww`xp877d*d7sPjds=FKCT46ZQsL5&^LUzo2=0I3=0LpIR0k@VgztobwGs)EL zE^8jH9`z|T;x-xVvDC;TfV5Pzbozq}qEWVc% zHEVjNT{}j`I-BFO4aY>U?|}1)6f2(CNN<&nh3+5Ca1O+&YLzhhxin0pqPy-3rr#P; zB`m49)$EslUydYrzk~1< zo>-6Q_^~6eVsqhRG1DzrR~c|T{7}Z{Bq3!~29MC8__XT7vF5XqfK|U!AaV^HLFr%) z5_sPTX?3_(!P-u1Ir%mg6ae>%4iM#xha%BW)Bc(~{$tA{$MpI&+sGqjX^9fNum^M@ zyN%Lw?1b#SS)8qQ13KUSS#xJG3Xa^r6^+%y?)ilHwjIsum<(s7BQqS$yRCL(b#0Qs zVbUe4oz7;cC5@{nbd|kM3q#Aln`PX=Kd(Hlx%zLqU%H&4{k}VD1a6HR6`GzdZ;UtP zJzqZWPy#KO6ymg-XNhyMVRlYrp@>`R6#mUw;})T@wk~SL(YZJEs=y+c4oBj|>K?6W z#w2kA;}uPi5+^|LKEJ00)97p)sjviCXi9yqEU`(tm7d7F6a540!%UC}`gIoA{B z9VD=@f%EmnpK{v1U1!DSxsW1WMBXxe92T_kD=tk>4^TU=_a6&0|M(WZpEA$p3(Xar z5&5@Z0LyVFVs_S7 zSyLC*h+WZj&7;UH_`P<_Il0MYzCnW#{$M9CbT0+yahAPmz4V+K`@$N|b^cdAUz1%m z2aJ>I)8wyes4YvD+Ul8PMpoAk#1q#qsRx<<2&V7B=`q~qeeC${(q!Lr)6#G}#vb%0 z^+N;#Hj#7|rD}LKB}y6s8I1wj!BtpIZNg;4Xuzc7(luVt2=}m97*XJf6FPE;+hD!G zl$I5P9fzY)w-NTrH%}cFT8&a{a`_a~#S0}`V$jL|CJ^cfry5^wpi7mTx9lcD}ZoMBV1`~RIblVa>F)bsIy ze`1u$VF#nFs&u>P@!t!g)jiw#wdeCq*+8ER?rF4Zf(Q~m0z%Udd?#G!JPcsZ>xIs4 z;P=&Z)#rCwzEQl0AE?8zRt6eCxuQ_w_rff0 zz+kyn!WOK`vG(^{-SPPKWK0J+)CNwb7_a|=++tl6t>5A{k$kj5MtSt$W^ZHSK!KMA zc$iLCyGFGR?X}-cKqW-iSs2`8@CIB!_N}CJm>WoWd3CC2^oC|vSwmiI^i{_*e|dTN zQvFriitjkmggV_yY!DSR#zfmUr^0fz5EQJyl8L6s># z5NRnUz_%bm6Xm%X+mYvyYu+&e7bo4kCxqf#w&>LBZ~@dEj7-dp;4ujNX1(K2f~8GP z;<@V3(Z_oaM9XvHe+oVzkB&WQ_Oeao*vX+Ijs}H%#3c$N;K$i(@n=CvIHJWkWx!S+ z>>qNP>sDUZx;r?42pQVNq|x9lACCdYk~)HT{RU^>+oGN|WPwrT*95}}u@YorfW`?d zJ^la@V8xcSga7VCGs9Yc{=cLiIDl7HsfPly8 z;C7hxZ`9w&H=J;?Uq>Uvy85=n#_)J~L31cB{Y}XIO$azXl1(j!;X9jj^WN(Xh}ag> z)-PhL7FJcavcSXAEL^m%N{_D`j(>_t16-e;x;gthw%GBP&-sWoQL|F0Xyy+NFPI|! zX{wGBA-A3W#deFAA_L}NKkhal5fZ*Qr;Orwp&25NY)Q$=JXi$KMB8@9<_u>kUG|zz z$)sHjxFLk`3TufPzYRb!Upa^3H8bM{#RTc-1*qj!^4X3OTpX`nB}RLzY7!4(vHA?< zh%Vj7nGZ2@q)e)v|CrH?3z^wexofZE8?h#cm(JAibGe*hZPyskEMp)YlMOxBMc2?V2%9s6VKvSyMbIoIQ{q;k)sG|WG`hyAQ9?`Xb+jk^|4vEsy= zGdUTdPo->p&omGHwb*;3O-?AByL~%{^Q+udbET4o(O)Dl`PjDRGvL?%`(h zWHQ;sa_pxMc6pUdnMHJf)R>v5N5k=3pFU_1zf{re?4G{L0uct*1SZW08xgH~RdU7~ zP4WaY*;HG9;BRPg`9Jrnl#7w=E)}YRc~hrZ`6-akmWLJm?eZB-RuBPK2~9@O>Tjgq z%3oj+OsouUf=HEQvr=O5aaalgj<$=iBs*9cB#tc{Q6)JEkdm0NH{dN7#RtmDi?R@$ zxU4gFr{4VBOa#*TiZUfQdBqYB=}sHGbkNFYAb2?}hl;5i>9e1< zx5n8w$g-KVb3@vWg#ZW26%ip3WN3kJpN>@|MfxoWC-2k9-lgchP8LS z2yoQdt<-N4CV@fx-oswhX-jFckZQ^CDXMOk?nqBc7R|*6>Kg$je4%g1yB{~KNFKNT zKb6{WGH6bvb4b2D#%HkuV)wWSYWH9yW%~2T&&guF@0y^pQhuu~hMp_dNP;Qw3Jy-E z+4+D|lO-HB!k;Xs)21dRH!A`!nSvz3F$f;E+RHx9L$8$}Ff$M{F^)GSf>=R{3Z_cX zdNznsIska`OMr%6jBq>1>z=E8AR+ypcJR&!m&;%P{EfDr8iKx*43;;pjA#<2F;&#Y zx$v5Y@X9gVn>>?U1_6&`_0WwA?Cb^c&6u$_vop) z2=$bX7kOm&l&r|gG77_@*V_Y~MY1@-h7kTrjFg(%0#XiFHoA2pYW9q*ftylZjt9)E zdn&#ZnQN)nC=@CKqou75DN>NhJ%9e3BsH^ipJmn-8Iz4}P-H42aE*WQH(^zC2rf4Z zSwA(pKrra%4H}8t_6-$Rgr2rCyc^@b)G2Tf_lsjtqIP|tZ#%s0Jo)bVDgK~VlNVw&081dN4 zW$6{?HAoG1Xk80^TjXMmqX5jK&HRj+GzWF*-)qb1JOnytn$#vzJWWf*jpj-`mxgL%w zyCjS=2=*1!Jk(WPja*HC2-AM2zk(!qTHJP?NU7iXzCYR6i>(BFI8NnZ71GY9&F~-A zHMWW#D7h^nop-_G)6YoSdzC|MKjpVr~usB zmW|t#xzR_0G-WdhFP}U-RwGIal@f>`OJUc}+8-M1|93N@M5PQw@dr6Gnn__pudL@s z&g9e{Iab`9y`{nm!kT|JiVs%wu}Gn!8xv6m{~r|6G(b#DAjweSKmHnaEDlzfmMbD? z;f{STAz0@V7@h!7So`3kMH$o#XiUv=!#2a~pu7WG{l3T9?gWr0UOX0IJg4rAk-bl3 z*G8qj31R`zJS`&VCaR>dKtTzu&1&e2_!+v;qQz05G;o^*sGObX;@0!8A3zGBIw&$c zl12U1m+Hn`f#>_~6CMO;iI>G-W%ZN_qCf-3+j2_!8Pp4Z%S!SAG<2WuBV}R-5-B+c zcAnsNN?OA@KzsSNg&QJRDJg~0xuM=Zz&Vv2$^YFgNwEP3>gA`!(1yl8qYH&srsSN;iwJs z7&}S@?!lYAPQ4-T8w83xBtwD8JclE<)~y>MqBy) z=p0Ye51hwpt2fZx>J@E$v3re~8D>7-FkKTewl_XHP&m0mG zcwi|%pXtF&6eFdg0tG%W3$(mlBk({6lN!9lBN{-9uh#;mLYfIF@gKwHLSw@Pm0}Nh zPlMCEFvXkR2r#2@I1OeT-ShX(ABtlYk{#|=qw8RVvkC%)Cv1Dik7)FI*9`f$6OYz- z$56R1CE;{mr$F0r*@5_SLIlt75He8T_Y6)R7z?DeWlvrX7At9<6&45}IIfvmEv!)R;Z#Y@%TvF1(=n@+PYli-foK*OfT%6PJouq2~=0Fd|+&&%+<^+5~~O3t<3Ce%$iI-V!|crZ z{LITRU+gd`6xT*|fyG9mQICmN`L|zU)(_uyp%?@($A=5YL==BA>F)awQPGF4zs$4b zxxq5bvbRJVYpG+n#hHF;zmteh>|0>HE8#mB^Kh9$NRn>cd||?avYDmsE^(s9(ECR) z>2u%Y>~;-A!5*xM8cs6$TiW~`>wBxqRI;zm-fCN5lIUFbD7rJglcdiimC;=U%RL(& zbeu>UIgS;__@Xb9Ua z4vtv+finARzDW%FWWxp%p~TH13n#~^r?bUoB`z$FFZ$=U>k*jKCK<0UiZ)YdzCh?N z>RtUU3%iRy#t$nLe6AuvcWlQa{-Qyds1Zz-*t0%-{a?7ftn93z1WyfmklXhOqzul% zG<;J`xq*Xc-lsFSR*n_=2oa7#UL!nW8QFjHk!-NnXE#BzaY#!-fEv%3=(L~m2h1Q} zWbCrnE%0}fa1D=6#x11pRtn%u6ND7Z!(DpIY(`* z|8&Mo1q^WD_hVmMW#TRldt#WdzRPbAUdMD47SxI4vE}~34eVipHvH~OH5N0~y_bZ; zLbx0hV+^L)duj38-F}%I_Q&liRRH`ocD$c?7xxp-n`Me-{+Ew(JZAAa_{I;ty87K5 zAi*PZ8n0=_pILvuefxY;C#1DP8|HA3Y}%A-gZnP6RM=d?g6H*~!yuRL!oYqCZhSfy z{>Wt^B9+=q2I z^=Dlq?1|P!rB4Mm8-ScyCEmMDRhk`(aVjP0nX!;3HRe<=KJy17>CW6mK|`u<6!1J_D)pXI+dK_ zy{?Q+OWykvULIc#SkKj2`sdfw{-e4zBY~+jPU2&G4$SOZm$cENa%d4Un2{418f=D2%Q1iYvL4y`V7=#dGz>OAI_eVy}!sxQ#-M z%fr3DG!aa2D!#W9wHuHkvzD1?|3ga6I)ov?)!-S^(s4j5_1JL zqE@Qney*78E7uDA9sEf|{@!}&g8%(-f_>gnM;zmO{@R1`-Lup{ZFiNtI(xMv1u%%d z-pN)Z__qAmfxZPg8vb*3pmG{l{@+7(iT|f+=|rCS&q%Twoq)Ly1Vw=$5%ZleFYuXB z<6q+cSqXr%?LWh#aR2u%Q&|6B?~B|AZ)S{mgx$7r6~^%aJbT7R@9BgaucuwxWgLge zYk?==_rXK~?^`12J3ik7aKK6LZHY0lOST3686WiNV7`%E^BXjp5Zr=GypSL4&j^ZsY#E%SFW9pA z#Ll5pE(PrkAspC+Zvvfug^(un#=NW#jS1zXoyX6RTOCTNTnht-gg^89AH*i{ zHJQeFwYP zm;+6X$(nrYl{rbE1pK4m(3071#vhDxX|&FDZoDy9*0#AfW&`9pt>spLKxC* zXd1J^A6jh4?Xa``kixdOv}1#Cq;8@51$hX@#DO0ZxASPnON(5ij`qd)|06K@((w8L zWxhQUP$} zdDy=OKTDSuP6q8;J8vrLbKHmx^UG%%mbCFbo2z2O zJQ)vqv3;o`tAg7JrLS`ZHBCgu8piP3Z(&pY{TA%3I{DEKhR->%!zq`uZF}=<3Sh3z zg^wE=6U2aa4sxA;=5@V?TvwAvW122`Y#fawH#fXCTH4s)@jr@97UJ~SlyN86MoO~2 z6}bgW1WWr(-fj)qWNaax8}~+{{6EG9De_URm^ThZnLFO|nggdHHN>}IF=;sfC^-GhBTz=s_c?8Hw&%Wg^-A!4TNptU9 zjCHPYoEt$q2gbVzn#aEv8>OqU+=$~wto|c#IPwpGUk-s`A(|o~i$QSln|}HQk=$ZB zK4EX$<_JLi*uHW&_Adw0R$+_0>tY)7Z-jVGzBKcA&a#}i>hPcC;D~~gE=_`*s{r;F z>>YY&*c|f<*hFvtHQ2DLW9f;;yyq5zjx>%PFC69AqaMIb8?WPTyEbaR2uDhj-%K=( z%xB`H$pNkDWdrL?gi$ic3xJz3aS_u=Tk~u`+X=87Hh(uE_bKPzj(B~TvJj001RQ(g zJ-1A1z+QR$d2FmoXtCaiItLrE`i~%&ZGI80|*nrxPh zlBt*mK;cJ$rXO!*NHm1Txa^qzdLTdgi8JI`g)SGYSXk!S5iSO7G3Jw3gqDHy$<4cc zZPYJ~5Q51iA@6?%V-dE< z(8(CWNv`o~>>cEK&Ao5*--w@CDqDAPnKn72c+d>-c6bqSJ02fYtw|!sWdwV`<_U{T}jAYJ+NbG<18n`I)3P;@xU>i z;&wLV&B-r)m~z-pct+hYyw(HqO1~z3BAMhiI2*b2F!r=dF&*dL7y~Vr6Boho#?IKQ z9plZ~`7nMAc;A>d%Ef+9Kl02iNp#0GlZHFW&iq@Dit3^TA#I@=FkcMsAe)mk_bFnnfPBPjFKFUf{fE2sYFb& zaS)e{j@L8_gnygC>5&2&!9#b*Ar(HZA*GeFfXy{Hi-bW&l#tNfdEEa1dbBuDQk|-Pfvcefq!_p6EqK%uBVw`L|2#jDvXLC!RuH@I>Jo zi^tS3ewWkmH7?{kT;Cw+B_|yN=8fTKc(2S2KfE#w%d0$ruu0TW7Q&2fjEi(8O#F!LO2)o>1->cnQgA*%Ih*=@i42G*!icG=LjB!X)UL1RpBx9Vjhf zkhmJ=!Q_W|F)(GJp}Q%!@(_931;L$()2GsyDUkNedLlvIpuj>svrWK076E@HNgJC! z1Zho}^a&~vh)Io|HWUZ?SKgt$oloY6VBEQNnM$OT76uFxjYc&L>C3ueoW?B!L6tz8 zLlLx&*txLXnD}i!c6=s%x)ZdgKjxolGj8&baU=L_%FDJ&e+1()#(-}0OGA6cNATX1 znRdL=n0N`MXTs4iPq}uafuXbEcOyGYUU_fIO*^F*?h~=N)YsOjJ$Wjgu*;D^yHWwp zeB$3$Ho$wRiv)Qd_XZ{}e-$=Ch^wxl1$1#r#OFgUE%5|=;tJv!4h6vw*;~9`4+<3) zPsody{ZfES3WX!td>)qsgN1Ala3iC`Um%D^?2y=k=N@*vPcgE zq#f^-iBVB}CINXRYHMrNKc9IeK^cx=OxV)WQnf262(Wl)2wCy^5ML}J;p%nb4S11$ zi4>y%Mc#lExI^M&-NCOffE$02xR?j6P`895am4MFES_1H(P#_}EG34&GYGoI*oa7cr0qo-LBC(z2;UI48xZ01_*Cns zQ1io`LR>o^n1X@=jf-)T9zoEWsHmvWXZj~iO!~ZMIMR(YCbP2vFb>uU?dX^8d?q}o zJP+!gd3WR9>+?d;L^TWz;~?)aJ&M4L(*cqfINET5H+(@a+-b|aQozL!FB&y{!Xf~E zV+YSNk`^g+a8*@R8h=4SA?hGv(;0b6X(wh28W$76H3|RBJIhC~Oe|-8eZ7{0ehqDC zZ)o8S1SDKr10MB(7o!>I*=ZGT$+IbPaw!RK@wRxE|C;eFd41~W0;jJ`hXyk<*hN%I@M`Xjur4kx)=qw427t8F~3*eItJR*U@5DH5Iler-nV)f$kqTqNYVN7KjW+I_kp=1ma%2b{K zD~Eo`bgVEM!_@Rgw~s#hNLsaOC1b{nQ8yys2Xm|N$cirnfn8h#+lZWb&QTC_eWbi? z7diOY1LcP~OVFU*^37LY%K861O;)X5jf!>2iq-4H;}6=M6^Gs+X+a<)0aQ54=0O=F z>l);&znvlF&6`U}tLC!fZoA0rxpUD;6w2zgYmhdC6dHVWRW&*`G%n;d1O{UJ4j^u2 zN(l5+CMC5E^_p*LzHZoik@V(vkt3x!@^REr zM=31{(vyvbG-oHstI>eiIQYyf{WGqTk`lcd_YdBCU(Wvf8K46?CgeQ{CNBsTqC<~s zzEse_Xy*bNMUh?#BN1w%UX)jtQ8?l4&dS3NJuDx*KNXE6h%!(Rzzv)9#0YC!t`#G7_c6%GQoLD+ob&;Th?>QU7UZ z<&3im^~*E~PT#TJQ^;m8vP)+nOsMW4ey>9_hB181`*p~R4>V>Qqa8qA!E#JkK;t`B^R+#$`HQ z(q!Sng|heFduv%t85lo18eVC~a3()YlliBe5$4Qu)w)Vm01D6!i%N<$KGsP9ZJCwI zI%mx_$sN!ZyiCDPJ~uM~rmc`p%==#gB>Wr5S{W;WD@-0B>KMqjw&Yca01!43a6>FhFEL55kC&I>JdZn9zxnHwpjdk2{$64Qg`>lqlsj0Ru zzW6G23&-Qg%4#cKx6ZOsVZ`&Hb?uF3TCcx8(^_4VvZj3dv9;^&2V3>ENh_OP1@|>p zJe9TTV=3gD6tb)|4D-*__?&@zw9YOgapb6HGAG%b%XG+ zQt_sOXA_7C;TdTQZ#LVg6TGw57z2=|D zb!!CUcEZ~6Th^-8tF){H%f@m+TWowbFn&`}^bR!ttiK3CV$td_7 zw1fNG20j5^XA(vfG96bmEC8TAzIKnN?j?kF;|F0IXBfR!9d!3kW*Bvfk;= zdN*y*(1`S7JwT8()`#H_beK)F1WZ^1h9Te4(2eO3hTjY}d}f@?BhxWq3~w5FK+uoj zYr^ma~0so^It_gj$uLy+A6dFmlwkzC=CzXbD!)uawl1~YK06RG7LQxhb$uZ z-FdSdI{HYNwJa zt{N$|l(Moi`RS*hWd8j5vTofv>CmBr_HOJ6+4E1IK3#id_Shhx_OOc=FP87W|Gsgk zP0;TbUwk1Se)ypreDJ}lQH&oyPA0rIS$5lP4-AztboR!@?Jb1CkleLOKKyvPbm=%y z`uA-w9a?vim&Q$!z4zQhLWL=52q(l>P>Ml=OTM4G5dH)5?e{a;Bcf+6fIfzyvV}PP zQ1Q_jTXh+E_>qU@z{3xg*5wt_wMP#v7l&p&abFZFkflqP%Hl;!bRn&{v=n6EoS<7) zg0|n!nk7{jT9-lthVBJzH!ah?n=W8JDJUwCLTC?5SFMz1p~cj|ZmX>aLxX^Z3)KO2 ztaSL`gAbG@)WC_}y?d*cL^ogvUasBS~^eS8Lk;X1B2!};gt#U72@jFt(#P|Xd&xr zs}M(4zMu00G*)Q5;0K*bg4UjFh|1#S%Vg=2#nQ56D_OB(g=%rsn4*!W^3Lqpvvq{R ze9pxvX(ecpL_SNwgOUu(?D?}Wl9?fXPmwfhTY?c^sVrNvTADR0k!ZYHvMAfC73Ar; zlEBEIMa#C(&@d`VLZh#Swu*c#LHg)Kbvm!Gun4r_@ZVnC_WS&@Y~?cK#gh7(I*inQ z)Dce*+9b7nugfd77-{_Yt$ulw5}i&wS7^utV5lLK*O)T`buhQ zYNVpPT%T)dYL&L+nPtnCX*lMSS}5Dr%9Sg0>Vs1$oVFvq86WA&ypea6Xz<@3)quPg(>{8U#~=_ot_SuyUV7iBKOw`|u|+O=(`3-OgmbJmZuB^`&1gBD(h zk+BQ>TUA|yda03ev}@**X|e6FJj^rg{;#n~LYxb9ejkRSUNp9N2E)U&cr1^+_14>R z;wdM}ZFk--ha9pmhWsV6X7xgu^xAmYcmG4=?#Cy{g{K`OtH5*@{OfvY*`kB=>e@zT z%=l7nz4cZw)kK;6_UE$uUL$1wqPcSTVW&%7O<3m7nISuk+)-YA^;LQB!3W{*1(^jw z#tP`wtCu#u8*jW(UU}tJdGW;;WQ#5O$d+67)rx!Ifd}NJmtK-Dzx-05b<5D9L($Nh z$&p7MsY0Jj!FZl{;&EBDaGCrtd#P-<-PY2)yg(u~QSk>kR9Y(^K#2Fx~lmUZxkjm=+TGk+~KV^-6SuMA1_ah8H2pk z%kbgDWZuG`8DfW-~$ejwaZq@g%@5R)4rLeo!<^S?WA>l?)m4*%j3q&lutjC zG6+g`kZggkPn;w--+ZgQ{mwfwf5Ch?;)o;U+H0?s6%aPpUw=LL_)RU}pslx3L2}of zcc3AU1zjdcuO8i{UFRNh>BZ;CD-+(4sndRxp1r!D<0zEvwm(YFJLd#RCmQ6HmnX`D z_dfwXc|oRq@ex{9q4Xcn7xk8qV~#ln`CKM%BaIhcd|s!(25z;bPKQB%=O|tq|MfTD zEN{O1fqaQ_J@V)y^5dM@vit74qt1OYXU-hC|GxX>;fEen;TdfR%b+3K=;GRAk3B7S z-gCFSG5K{U7!m2-t-DSuPWj?vx#Ny|&_>2W(5;f0-~S*(wjCxtdUltwFOHY{(N@O2 z{4(0NNZ&qND4!&uAcR6eS-y0!oPEweq!I%AKEyp`%4brI`yQZa^X3)c*^lJLn{JlZ zC%q=$&X^&s+qIYW?OMys@6dL4*&T6O=pYtJIfVF8M;|36r6qFfEw{=H@FzR1r@*zfD_US7N(Rnf-e#o!~QSONo zCTOQX{^e9~5vNhnR;Nw*LN2`cV({ED`DyV&$gxqf2%Yb(cibkgf~Vhw%$xN3MA`p< z1I6$1$m3AXKK=X)*>T4mwPVo^4egGCoI;!(%l|p3j{g?o7~-YVaSYkAR0=bn46_2iRJ>OF@{2OfB!-VR#&C*5uW8m<=Z&^@-t`FU^z$#WuDkbo>*ibUQNOc48*5#1>ABW|x~R1RLo!ck zkyTmEX(Y>f{OP-`%dWiEio}u@N2_TTo+CS4kJ)}#>zG4FTPL4+x^?wUH(0N}K2gIE zyY9McC!}U2~ll`_TOkw7&ezE>Cq`trf@c`2fSyx_miM1G4 zV)g1Z*2tZA(fe`Z##sj+bdVKxhQ^Laz*c^6$^z4g(@YF7{9oDVvEKii&~AbqlN)^pT4?YPseNiV;P z`>gfM_y?`wJ2lnWz6Xx7-hBN%y`T2+C)P!0ou&80y|>?KJ^iR%*Tmt69c#^=v&fn= zZ>e?IktbSfD^a(=ms7sBf}vt7ilH;7oX+{@KdhT>yHVXRMz&Tgn`=etzze{nm!Gk& zx#lV>mf(;%YTbVCebz@mu28qCC9|xK+a0LWIB&o5EO_E#Yk8eL=w34Kduz`eG-+LT*`-$XiY3yt!u83TwpR5!M&)eWg+Sc+Yhi2TJ_lK~5qs+7>lxo#SKNP}mCUZQCcpZ))n~*$N*CgX z1#_(~1NvAENt6|m{Tj5V6Hhq7akZ>Y-jc@YqnppW#Cq zXzNoaKlRa=6-%eBxr-ND1BVP%yO$JZPh58S<<`Apo^YNl>$=--u`ay&3cddV z@@DE(Tb6Okhf^u&kafC;=C6P~-|!po`7l%wKd17=7YIoroRmydblYG!9Fs%#KU5~a z_NG{=h|He#qjc)hRXiM4BOKRgoB2bk5v@zQWZCL!iDJ0BMgJjE!*#$SFXFbO1vH0> z4xLpgBi?@d4cT`T7c97CF9{8|vo1>h^wS~<1if;@^*71B`y4C}J@BNIVMx1fU9}GF z*^3)&zy0<))FP-s5**eM)fgU{t$2wPw`x%%WUpyq$m9~pOX)jk3mH6g8yPfs8#(oa zqv3{O8HS}6$`Qjzq%Izn0sVSPMKcV!txDN)ix$uictc90eo%_JSQWZU6`G3sie8eA-$ zlCoCi(z{=8a2OYiW74*LdwJuP=j884?Jk#HaDgmYy$Ee)(yTTa0mz9=Dw!|-Ckg8*kEuhu+lWEgG7mq(H?K-uUUj6$ZcJPkhD_t?t;g(S= z6NgEnsGJf^NqOt`(tYq?;T{Zbe%pFrUumdYA(8MJnLB@uobSjBdF@T|{j8<%zep;eF}G+_rfs!li&oOTQ+M&Cg4|mm zhaYr^TzmDkGWz6mWbwLMDQ}DX*RDn$L1|Y;qU(N=J_Gwn_x}AP8eWHyPPq(#7GGJn zR+g=tE#FO_DSPd8i0rb>AdFCtk++~ZS0PMsVN&{!*pn~pg~pwcFh+obkgv24bqZb_ zvgJS-y!Bw^QBE}uY}-XDYwc+}FADAEzD?lr%P&{W{j9UkljW<{Ni><2OD?}c?tAEA zIqbL-Wa;WP5(KZiQ8%m~*4`}ea<|^SH9VM4`fb@y3Xt!`Rn=09w$Y|@C+QA3BFIyx z@(O7QnGrJNwQ#! ztRDOUT-;8`P9lmJxKjsSSUA=@cS}I1opsJRa^lfP%c-ZHDrcW{mhR9fMY-AWJof0L z@*IRSry=gU?>-5EAqET{q*D-k?7FKw`p6^l{SPyxU;hC*?efgC&&iE9UN2KHlsoD8 zQ=}FGlgz^%8tjUK&YUlq*~KB98~4anprAx{-FuX#$)RsiX{qeA4)E!k0Y(tE z9~Em^bWHY&Ki3SnTSp*NC4mOpuRmyYw>v==R5OI4U6&G!!gAJlrFlMZIus z$rf7VC+^naZWBV&MCZwlm^|HQ%f52u_1DS6Pd%aQD=)u3NqY6|i%zdlEadmXl)Jn-1}kV`H9>=f}Pv_uYNJ zv~Jl+w?0xqVp|9X>|Hjs_4S}G`499%{ZY`-o{hhf?G_yjk+QNIIu4fS_1M4pyjfs~^9_nq)s#TC9 zw!7bvU|e@&dtsZ?cJ~*;&cSa14CW=_p-pp(FXx#^jc>o50qu94q{A6G{Fo!;-aGG? zwjDZ(+gGgHv)Z<-5cHF(U8j>_@j=iO6$ErKya7hlhpWy==H$`z|5(oij2 zYVf)Ja{Tef%gs06EUQ#tALN*OR(2Y6SMMHZyuEcEwpXw2(xr13 zx#NyIR9JIylM9(fGiT38=1~CyaGMsnnIa(^#ubgvTUL(R3`ph5H4;Nd!9|WrXo!`u z8nGz2xgD)pOI<{vhFemE5x`1lY6@uQv8061NpYT;d|%f9!Ac5aAd-Lt;QTO;6z#v? z{?f5y2YDVEaO>8sbOgc0pDx|HNXwQjrE|BgQUvY(+_TR?hgT>=wi~82r}lW$Nna*9a6G%hzEo#Xju%cX!-Ib^6@9{X@}IaM=yC};v}TkQ98EkAiaBZm1czn z_LfODAT|(Rsm}e@L))XJ$KwZW?2!~&mt<1h*KHrfC`6tkiIl8f2l@xRa?s(2$W1rj zAZ^f*Q?u^Wp}ll~cG<6QPnk3G8+rf3FCkn-rc9kGYcZyLTV(9Ji=J*n0!AvbGL_#v?I|)RJ)u8`KTmQFj~^r{ghef*@bb?0d^2#BjkCaCreo)%B>m;3F%AstOmj4q)Vp`sM9vm38PGk6OTI}EzlXDHWjHv zQaoVDq^fgJrka<7)_hq3fPBP|*22Y$)Q!3Z7xh{GE3UXg&roy+k1YZ(agq44E3O4E z70Td2{Xu81)Sy06=v3U=BZ&0v(NjM8;A5Hp;ZJB*Isv>b_P@wsYr1X02QCVN*ibXHv!O2slk!}kWT58ow-r_?<=KX8V`D_RxMk} zOXJ7Nj@$1DmyDDYmrBQ07|P+v1A*7KXIF_fc+uWG^5BzCC`0TtVrO~ovBwcd8MOMg zGJNpXQjMr%5ZdL*Ps1t1W{jvFsq58f6U^ay$O`4=#(?;~wGc9nl!e2KcXY|{pG*;?Lud$Pt? zT2`twi_}BIfOd-3EuGr8mu)sLf_0qXx7hP;* z^ABfgr2oKy5MG@mR@WfgZV!5(Lm##8-ZFpAkFxh+hsb^h?I**A42DKnF6W{eXP|T0dDnd~a%`@nMj{G9+M#Vn46%DjJd=<}CM=U)e@k}Xb1ymOxRa%% zqNVic)j@x<(l&^llvcjLicR%y~7BNr{}iYXy~df8C9sUqpJ2fW~^)U9v^juF?zUs>`mGHLI&JIEl*J zZ@mSr{T}Jte~<*xVP1O0CDN*0bItSORm(7H>MNICa*3RH;*rvQ>!E128J!|cQz0mA zCOhr0y)2$TTgu8SbU-G(GFDz4|D0^mzJu(r<4Ae=m5HzqK{+ay z)-9UJI$Kwg=B4E_u+IR5@ad?I2i!Q_svHXqYP;Qbk=~uVX_+f9a`8jSqvFSNB(2)D zk*lt_O0K|2qjSeL(it7|KqwxgFp@m_=)+{Ifm>;w_d|UV`|q`f9Cqj-a^&d4q%;u1 zh&?6~UV1^Nhz4)975J)~Gm^_n8QRWp)L&V%W-8XWKwMP9#r}vKf94q&$<3F2_Z=mf zhNv8T%u%x2$X%rG7F)>3kvq$I|2S6$bni{w79D1pbnV<(sQP+?JGqF!$(DM*4w)(95Q|B?Epv5SSQj@VurUL)x?#S{G`n!iBUc{3N5{gHfd4et%2?$u8>Z7|E{u3OEQkyY{I#^s9 z+EX(pVsQ&v3p5~hRItyw8z2CiE2Gt-hYmn{DyDYbP$%vJs0-dg4DMap17_k83Ho_5 zFAQNxRxB4p$F{2)g%3RAV#{DSl&u;=E*{*Ww(di`BpY{$nC(sm)V$pAlM9{{WcfHH zM6KH(nufN6GE+Ng0?G;PpWEa(XYGa%u`7y($f6#dW6v;wLJmlqz+o@b&@Fn<-2KS2 z4#S}R@uXiGT5&KGlmvJopkq;x4rS$ett^JJJRwL#V|IDtanvq4gj{4S`*jYILOR^D z>Z%hfS%T36(s0+J?gJ3sAuuV@@`B=73|=|pMUZfPtrR(@U6W{ddTJCM_4>$2U46Bb zLUS~D=iSd`^4sso)z@)TR!U02M{L%lM0Oif;1|kxtj34x8x| zfHxC?8%K6c;K4U?2st7RdQh23p|hnj!0BPFS+pq&#zR$=@D%D)LJYjz%#YD8UnGY- z@>qAq3Q9q!RJ|F*kzWr4yRUG4`xKg=*UQ61tb_Fh3Qs3@)?-zp9xbVX?#mEC zXvt~vIruLOiuf~V+ni(cx}+|Zkm77WXZhBl{TI7~sAD|9d2K2xEq&{^2lAVjgmaKa zr%yiPHch^eEQLaICrFUfdIm@@4gQUSynMG)u~FGGG07r63T{t9v4p|@%wskQnz1be zf}n+ICpO#bSv2RF9T6CDJ<4+GmNNjkiX!Q6*TMfSnyB(CV54<`+I){h8VpTjK|~ec z1UZy!3wOS(NKazIrUCV(%u2<;YcUA* zI`Bm;{3fIXyms*gXUmaC9w8^6at=lyFUcW??1zp8b<3mlC~yqrN+FGsqB8J96nRZx z1Oxh_gU+CESqMH0=}`!0k!0rovG)~#b`{6pbNxPlFYX~q5+Wp!;4Xn;El{*TX(^?+ z6lj6sMT@&jupl8of+s+LAW`D(o;<&9=llI;&%SpP0u9i9E&twmZ|~W&GCMmvJ3G5) z&mJgkmJQ=wd?1O30dOrl+K>jn_@--2`$rc1V|!)c=iYg?5ucr@@&Vl{>vZTdSqLKA zFNv~>Ip~5j>^B+kJrpd_K{Uoa*TrT0W21EiOq=)?odAumw3lHn+ zP%nTnRO(*n364g3`5@e0Ozm>PV#&ga3!?XW zaxvubOUe_L4AK>OAcU~iQ?O>(uuvah9QRzBSA7XwyEKCuU&SZWpfOMk#80nOj676| zQyJ!AwYJ=&$uR3^x$>bFElV!(d)V4&I1gI~VUS-mBD({G96vfRGd&j={UHdV5l}CA zLXCv_Q@|Z4BCel8#8p{^AZT9gNI;8%;t(QTXU07(0qzyvY_w)|SZC13P~|=HQGf_` zmchNYT$?wCXEmQ6!@5yGiO9T6V$y5dF&IdxP@3BiKTM-}NI&=pFN`Hr3w%VI`Z(*- zf!w?pL={AfSUWZEi2~_KFK16dmtJy@={Y$0eHgrS_Qt)lD2K`mBru+eEyK=H1Vm{J zrik!_Fd##gvQ7!g=Nf7ne1vjCxjZL?J6?1^LwlQ60#K`f2r5**s;{&nY~tq=Wy8h> zDJrRw9=&=?uWp^GYfz5Xo*9*PF8k5QAjdq!MTJFEkvREaHHY#s8_jqUP(sMVogR#% z)td#)tPuV)(C&W72-|{;(c>6UchbX`dB|=*>#c=@4=9r|ltUgWL(VaS=o4IbMkE|% z${c%3ezUfuk<#q}4=8)I`YAUw4ESn34F(?u9=1E>g6+XnoFRBAqe!P$#F4y!6Gz>$ zk_eQFAAQf8s+W1oH%ObVJ*8C`ZAgU$8bY*uIY2|{a~2@5qH~xrr9D9jV1)Cc9x2Sa zIdB#6WKvW%h0a8}DN~$uq>+#PBa{Knuy|6%oB?NHy+fu@sR)#435*?Dx>S&4qkWLb zfzQtJ$Ql)0`oUNB1X^ikp8oTj9 zt#r_=Z3w=>s|9J_V);}Mh77lz@sC85N$MSw&xHNEVVjh=?IV_G<=R#O3CTQ7040e= zfl5Uouv#DhsGbDLV2+7kpyMD6jP+4rBVEo*^-bZlI0!7%g#KH=7NaEd2ef6;kPr?o ziP(6J;xZ8wiMA+v5y|8g^;2m=CwFK`f@Vz)ryb2r$FOGZn0UI)fC;t?#Jx+#R>9)i z9BgS@0~W9~jAnTUT`!MrgrI$l6ay%{+KE_42(1a-44Bu@lov|{N5~_IAB`vIDa4us ze55r;*??j+_9d(({9zslIWcEy5ZE^KF_*oX@+^nx=ar622c~lp)FLz9&A?!8mNZqe z$^(|i?WKsJc=(}MaPLoJhDU{jdn$JipJKBi@*4yBb(Y}XHq+{YLDTDM-`D=Zdk6dKC5-Sv!)}GsXjgi2V1RpJ7)Fq8RNPIpT zD=@M+p92ffs>>{Rx(@`(GX>pS?)l3(#kX$_(^U6g%eF0 z5n2xfvi_urH6a!)hLyDyW&r)X5(yzcOdT=MaYns)GSw~GUwKEMd>L+AG)zxhjx<=h zwf_TDcUz>4U^o;02VvWaXDT|@lFr_L%kf8>3eGkHnMOOo)7*_<>CzIXWyX}cx{P}r zJT*Z+9_#;i09t@O)%?S;DUF{!igO8`NT&^`Rs~xWP6J%0ad74i^mC|!xT7w*L=Irz zW*o8e`hx%&n9n*3#AC{Hi)UGzImTEXZt3#*oA3S^Y@PZou{Ed43$+9@F`a4XX3$Jb zOa9WYKY6&!z19t&vf}zJa248AKfmtC$3X}d7~_b~@=P59tfPWq4yK`NN~kw3AdK>= z3x*mGD~*4YBi_^HgH1+9n%!#?FoMABh=47MG%S#mum`c%u)pAfd>GykL)kQ7>!bnH zFnR+?q4L*qC^cNRGD$2~G#S9&+krWN2%qAC^2Hx1AdoU!W>Xnd(g;+%tQ*VY%ogFC zIcXZALVDIh^RpO$DbqLxS$Y(gdnITUn7~cjy}2Ub8Q1e{{n%oz~6( z>1Nwg25gvm;8;E#e>g#At@F)Z4$%K;_>m;IHQdZuupEVDVycW=s&IBKOrrQO57Rhx z5EkVp)9V0$OFpW93i;*#po}iCc_4`BfYw@K2xZvZ(HcRBqUJ;te~6<`^D$KK5yC6; zAU2d$C67==17HyCS30UVqvq&bB?wRwkY1JbR-7ftl1H4{ra+@sI08A-QmMr~ z{j7@@bZeO|iOt|5)Lsv#!fmexGz9tRsCrlf;ltPx;N`*nuTS6SBemRC}T~>C~XJRSLsYvCgh?BC_!LTwbjp=HEnn* zaq>qmh6Vt6O}tFYyu_~eEEaJZ@22I2eMiY+0Dxf{%|hLD3iK1F>s7F6=zzezsB20C zU^i#kN(aHs!wZ)eZC=u%I00^w|2QZXeQ_a}OjHN&tUsFdTvn?}lZNl(_ zxRPJ~k7XwnwKff~&|0&U5T9#JC~C%JRduV8>$W;+XDv+~3H(JIFB)K!n~D3^fs#NE z5!)MErVaZM@MGv~q6PKV!5T=uRXhSrn^RT6>D4HF+s54RXbX**;=!Se9`#h^$=Yr_}*c@0u@4FA{0J^xkz%9=beLkXI%tA%5Pl zmh>A#hJSqcZ@5a(eyn-fON{leV2f~_<*yC0_XO*=_q@<)xvnEu%Rt5P8Ff+=MNj+ zH2$`NZGxW)#9=y@p__k3Xz4QwT&YyQjWd+90~?>F$BjwJJ2)fh#&1#N!B&EPJXmDB zT0X+h+aKbX)zt6%AU}r%`t$0!Wi%i^h*wii9&6MXi zf5@R|3>Q?Xxp=i!>ZOmIAwOJb^0?sM>xDmC#w)Nq_Br#%GL4yK{K{(`o${Q98#)y% zZaPDzdQD0fY=8@@6y5u#bV#G(LO%hx=x@6J55iAW;uILeu+5yytR}8$F{UW~GSs^7 z27}GwfTtB1fh>k(uNt;awXL-pBOE>xRgcK390COt905`%KwU$=Bz}b98{n)|F z{xsEC!B};~YpG?7nf#LPO}w&TJG@J?#YtcgTZ?&2uuTM@muO8Qxcn5xK4m#g&!PxT zM7mkv@@Z*GN>nz1_Cf~miU3vWL_i0x1txL9P2B{{p@2Y!=Nl-5yq3uWhHakCgf*u% zcT8hlbF7lgAiaVDjWz)`HR;k|H739bGD`!Dd>cOj{^nu4lCMqC7A=0c z*wVbnVt)xXjI$NjYr&#+VT)S>O@Z_n$6DoI>6F*nc6m-APZDhTbQ;Yc-k{Ip+C*AY zyvePrSh!a|16@$Ri^5I*ABVi!em9Wt%^j;x$8~S(-#iV0!o+E<3FEI(mRzOegAi4m z2yRLbkK@fsIvbUo6P0ADQI%vYj$d$$!mLWuHQUXoj4JS+&gCk0EZ$52wXs;dYK8EyqIfJ}o@OIo z#_N^1gak##SK@Xy7oXl(hq_vRa?ykju*iDuo6|mx2yQ*&mP}n==Cc<%DmE{dT~Lp$ z;e|sA_42A75Wu|~D$)4oBRt(KstNhvo^fnpf^F&i7XP-h`03b>nBImlr}|AKJoxc| zBYca~WBQ)?<)6vJuVOWAAz&W9|LAU$G!HM?PPj6$2{euuy@jV~0N~Z&rkSEW9ziB4 zLyGZh4#v}epeD_F&V*DT9r_GY+lmmF*}c+hZ#M%sE%EYkDtFEEYX5AF4ZpT@mM?~q zEus`7_sp67IcAwn!A+y<_q^v1qM1Tphk=K6=Nl)g-~n!y|2S;h7Q-I_?BJ}st5eKO zXKUbcfkbff#qEd!CBwbj4UJJLE^Ti*V;b=Y^FTh?Q9aN`y5ArN#fl62WQs50pgQ{P zOaNb;;D=6&i;JKX(6qoqIo3|$)|%5lpR~R6cii0@E*#soZQE#U+qP{rwr$&K8gnM< zq_K^*aT+u@^L)>F|Acpbob{Q#X3ea9?|WbO1-1}r3s~-@e#Qe2dF>(Rej1`wr20Ii zvzbguqAR)6trS%I`EYg?o4WeAe+DlV3hV3++Ou)De0eWm}vraa4^5ENT8 z_+e0D7{3@X4a|lmH+654^_Vo}F3V&LVtTHCcxbPEOd1e-*;;M`UGhuhW(g{;GN1B5W)EfF9?>hnosFLTPfZtG>{kTHXA z-I%CzTn5r>>@|BD5{HnNK9r}L zziyWjx=H{IeutD2E_0LnUJ%)D=P&4H1rtfSz_XTvIJpbj0k8e zRJ!x}(DcRQDlLG$fZX>-q?%1Y&Rh2o1q#sqe!+_eWjCeaepLZC}hW@3fixm>#>DPI@_I zMLY#GTpWIBZ*Tn;q9e>?MsLeBggU!c8Bj&v>?WiduPuHInJxIldtqueiQ;~1*a~%z z#r_3*sAe&XaE@qhvw<8NK|h<2DNrxn<27P5Iy9DW4;{w3JmXZEn$Rr^$Ba2vR#|ht zy}HQTGfn-_-3jMgPODfX>H8e17e{J8Ri?@uX1X5#*F;ofj3d(F<3)+@6sEWh3z)x= zzAMOyxi9_nwKUwHlhTOe9I58a+z;2oIjs-Lqn*sax{IsoLhvHjKNWOA&_A;m-x?E# zv-i;wT-LDA@>s@XAootH#Hy`c_y>ive}?qi=~HJUbLSx#cc=#Sj>-oy#3Z+Mv4gxI zTi-;UQ&CBn0)6`Sf{-+rwl@#n%03YLYF5L5Fk6ClVrKr8bvz6E3#5~6@q#oZg=(_~ zKRNJhgVq6KqSYc-3h^adf=Rn&*TW$)D@tl;;Lkyc!KoIEI6+_2h*weoOUp1rS)BCk z4J(rz8G?+B9IPvgN7h+ELye+wL)l_?Up|bUrd;X|Fd1Fok!CIX-)c}01WK!3+r4>z7?;wRSAzn6i& z7pj3&4t}(&`%DkE5HI|D`Nmq@xeLU zALj$Wr9iuUSk;NefK(r;S2Q9WGijsQU`nnp(Z~gDtZg8VI0Ykt%p$iWH}IUmVForh zgQX>dOrc_MA-`K$RdDdYRkoo(kt&U=I~AP1oYg*GHeC&r~`>lo7c z&bZB}JR{1Dp$;6}lnd|hpcBoWJ-b_yGbz2rx?uO_Abd|}Z<~!&2{9((%0(m>GLy}h zsCiF}c*O6)@_Is)Y{xp7;N_YNf61s{KP|Z(z1B2|m`{v;Jj>u0Ko)(kh^v9G;7tn$9}Z?uAUoiAAf1U zY{+m+jAJyGGx%>+w1^zf85757yg=4-`OoK)nnt^`;Tuedj-f$@CVD*#)x=VMu4$Ie zF+b`3twW{hZ7Ro9rlDy*aO!r1-81%^b{~Dr8{dJuGRoU&I3=4>pJapce2HmGd@VKc zaZ~34b*`t9U=b!} zrI8-8VH0WO@ZMqin7$xVa+})w_*}0lWGw}Y;ftl!Psw%&bnoz%?7KXpxiT0+m$b$}u-_QaBB4_gCb#^URCr=W$%c#5FyZ?n3_}mJBb}JiBbqTj&$_ z*^;?aA{M_d`em~AYfgy1fo|jewZQjL48SdLVAIfR(OYt=;z}m&xPD6LSV?O1mc)as z60l6=(``&TJh)&LrsEXEv2QaXsDCdamMii4RXF|20M6w+d{0@f7lI!GY-kAtJdXB2 zUmx%%LQ%~I;;7TCTIa@gMtU4eo=Azat!z8lpCI#T#V$t#oKX9 z0W3WWexJd9dB=xthhlCYRRo@La{VpkGX(tDeJ^l<--<<;4<-K)ebQjIoS%rJDLxp|hSh)!x zRx3YD^F_n*=ZthJ_i9ME+J>3Ra!msj)|_4-?MvtvB5trJQi=Ih17yfFZ>_z^0-WZI zxSTd+mI^Y^PuX&#;>fA0+q16V<|OhLi@PKuH^Q@g5P&twPSzU@DxiuAZH~XQ@Z`Zv z*Ms7!L>jhds-!eYfvUwkI=lV{HcO}SwF{&ibJo_N-vJ%|D?)_#rwkiGxjQt5#Mx=$ z%!Q|mSug2bET-ST>;~UjcxcLk%2n{+U5{!j_pk>K`pY3=Zras*fjw9)?vyY z+R5I(ca0hv?SS7}2kFSe`t_x3T&hVP^Z(6TU#vG5CWQuM{T{k60rdybD}2ekyKJnq zzD#n^G|-@AHM~LQA%LSW69HsH^Ta5?3!2wKO#ROl ziF3#l>JY)V(OZ93n+#!LxwUjz44AB@2dSTS|Am7d_gSB2cKo&xfz7&fDWCGDfv>VH zmotFmU&kfW*V*~pHGro4PHRw=1C~QsxBQHvhipGM&rag1?;jhAuA2o!eI`K`?=Z9? z?2!9`)Z@Js?iFLw$Mj15vx?ocskF>xW;J)jhVENkLC8`C=ilp)bMjQ>X*X$59^F02vfTpk8bC zlUb0`P>FyB-%3;F{YP;9;M2xhhyR6U-9u59PKS#~hch@^Z@(hZW-KXR6Pid)bqbl$65Usc~$f0Ms>g>9!V8G*llh9Yhd*i1XY zD;MgXTkQCIy}bid@#vdG@5d;Y^GZbwN!Z)%-4wCgjKi?7i4>%2y#;B&%Sw9ma};F& zSOa(5HXaAu(c59eHxA9l$<0+DQe;Q?OW2x23+F)vVLjE6Z!a=$z@$j>ACh@Z5FJ`VIU21fj@D~ zNq@ezEJ&$WM$rvUCkc6AKd$IpOq*1~Q=-922g{XI1P~A5GcE>v|1k0I`d4mypoM)$)qre@(5qg?+?37X1fu6$Yf5_Ib-&Jn&=CtEIHe(P1*Tdnx5e`uGwwf< zQ;TAnE_+wu&Hm@A%hs$Lr@-g?Y23-VRcelc*&JScg16(E?qAV;3Bj|Z`|5T`q`(uQ z{MOuiqsNMBS2= zOGIQpVn<(Bw_J1X08IJtF(rqdDAur_1kaq_9>>RcN)UFKs|5QQIHQI?v!)@T;pD;M zNR7StS5&Rg_#(wZ^3LicLyl*ktp6IUoSV#SfnHaKT6iAt>t$Tscn|TMM^-(L)_vTU zkPcj->q($bUK6R&a#dFDC&=X$Y!Z>)``+%Vm5yhm!zg(*kx#xWq>zY_=vv0mSg14` z>QevN@{#aU1uT3+$u1BIeZokfhe<>Y5$);Gz5MlTTVY_u+FF-&$Yk~Y36;>%Q={vd z4)?z9#X_8YmqThZ`ryFTr)EYdWKFL>*%?ia$ATPNjm;utIDo6p@qNH!gO1Wnxq#sx zNgsPc111}hpZx}`VwEOt*#<&pwz@*Qc6UQ075`pTk%&Xb+Y$Na5~Eo5w3eD^wVD5! z=g8xlSu5bJ$ZH`zn^{llAWNw>h14fJeZr8iYy2;$N1EOo*4kVW3jQfi=8_uJx9Plt z><^7K4WX`OME$fEHav*f7<>(#nx#U_ugKeU@3$AECvLkfx^B=zzOE(q{#%Qo502rv zE871U(%rg0C?=3CA5Tq)@sE&ihNj8y-LH4Tk<*ibyCa5k#$dg@pBQc033JYcT$6B@ z^i-9+4hKb)FA)v$DqGs-fa8p;VU8=5S)IK}wL(DshCXXEa0@WbE=JL;w8^B_GIZBk zHmo~*S#gc}Ja=RpVt}AnKpwuJH>4Zyl^?w-kS&nS2S1uB{-JM^p%hwls~(U2`$?x6 zQ!^au&G>+x*+Yz^;&EKGKRY{nfO#J*TTRQ+nc|`$2twQs6ew2tQmMWQ*VJHd~sU>j6{L7W&?h z%d?P=ztZ{fau5INfO=$|9GaRlv4)(-=u_Ch!F$S^T@I|fnha}2)HXw!{l5l=0dopk z)?h6dm%}E`hS$>$ZkUxyWmmY3l1g#)3fc*#3LI_m{n)E9EL}wlK_^z*fEHt3-IreZ zDF>X;r}nN2sHmL$J1qtAhb8F-b$ve}!(F=~kJ$fA4myHgJWt4Rk$Yv>;<)q>a;?f{ zXFw-PumkG7RX5f2p{hNFY|^(@{gCkzl&yPxrU~h5Q5#ds)TJ>#A+<$bvoTmIa>vJ+ zskx|5j@Al})y`0E!zH|C=0AVg0S7EIk_#N3$XyZXYLZN)U zFMi76v6?b8X8x+?F-Eaz2sEosC^Chm-5YRWu5Vz8Dw3%VVVbhWoT8q zHth(V7wZ3w9+sZ`<55LK(0urvlbgG=R4Y^}Kj`*Yc)Y9hu*@2UD2#Pw#(! zdP`9Vxnu%V`2BCpPsC4BUF6BOBFexw)BZ6v-9ub;bz`$_r`GRPc&pgto5lWz@#=NK zg^M_4J5{sL>{+1%S|9aVHDFR3HRm5P+M}s3noirfjN;helo95{jLfW3(`rCBb|Iyf zZwGk!LM|CeL2fuGOB7A>mhoS(@_x8U5ak@^;$%s)*w$R&x){kLy!5lXZoIBwHLzp{ zhEnL3wh)~|S9d$EI6kHH(7@p^WII!!4AcM$%N(x81Qk1nWz|=;0u>2yMwCx&->a zZhMTYxcklEn}twd?-GI|Q{Phj#}G|AW1Hzi)rjM3->~Xk(m4EX~(2)6ng2?n%Suq?i#<R2h*8_-o;E% zcMIvSwi+-?>I1i#GnD13W##mn>Z4&AH)sF34YFMaKeP{ieh71Y>^xOVyP=S(zum7j z$Kmd14w$>|gtS82yuae!omW=c9M+o6tn*JR7J_m>W5Vi0hc*MHC5__g&QVRib%R$FYBElzpz{oUdkCXAdRXQ z`$FGe>#1tTPJ71aOZ=r+Z~0s{vv){B3d>sqW zUo}ijO=|admtw2BO>|9b(98OGonN~gJnt0ffn?vv6BbIaL#_S)neJ3cr(R(x(VlG3 z%gL9DLED&^X#1{P&|j={XKM4e88(_W8_Kkrt85K;g^|I@3d*L*81rm#R=M6@UMhn}@XF%L=** zlE`5*rNRe?;d=ktR`Dh5sa1ZvL=N~fuV(}3n&om|N&yYX8r@cDaS=76<4)vfHVPyoTdBrVl>cd2t1ulJrA%q9Ml%q`scKdUCp# zi=gxgqGZrSv@RGeMUAFO41+_wo$CA6I$cJD|G|0zJ4=z8ka786I%wT5CIH4m+nh-s zkyz{_i?|=u_wv33K|Bn?_}R#<=Vt?Eg?Qd{xw^1omyhXO{_7r!Zczy!E-Gs!8gvINAo)eYB#OLY~X19dg0PZg6m#}K6x^y?Dl8JqaOGmzM zRV5?QK~>NC3ms}#6C*L1)>sML3IxxSg)%X;tZ3G|=SM5fF}c6yr*>h;Gmqz`A{D1d z*i7*FzAm~C$;gt*sHh~z-j{exsdKfK45sknFlOS-|!wh1L{gz9#D17-*vi%W{bj6;9J&b^p0QB;6Chv|mNVIQ8i6wEeb0M$fUm?oZPBX*wd!W>@8}XZJ!3DP-hQrpT3^_xy4{-xT9_Uvh2)+uzL^S z5dONJvJmuo(WK+_KFC#ql#jmfHOfL;s;acBO_e26FVA6+IT2qS%7P|!q8JgZZj!DJn@V-P#T)pC}k>(-{NG4%-xSPBiNEPrfvU zbe^D1w0B|?Ojn~ER&*-HDK4H`^yy6KN-kmEWy1mKUA4qBcMTW#NO4QL8(2~C*duJx zLu;s6QS3w_Y&g(cwZB$vO=%%6yY;Rb1j8I2iU!yM4mpPqPgqkoT})5+Sz>g#;T5ID zXC%e;$He_$11vl`gR$+NEpu!2{c>b&7JMo7#SA9rgO3F-4#NLh;V^roh0Q5V2SIss zh$Jq@V&A=JfZIiq1M!N9jq-Jijfg))til6KMlI8qFJ!jGIl^-5w_5cuIMBT`pu3~^ zXw&*ehcp0_YcsTZsd_mC7z4#9)uCyk!$kyI%h~1Y-fp0&$}y+wG4a*deZ28ZIIub% zR%p_TG5rm;8D+jUV7tDkt)3TI^|URr8U7ApvLjTs`z6t)xObNzK;Y()rYcNvQ_{uV zI`0Ngz1!*f@<=0gh!n>GVXI*$=BzGKm8iIY0vC*1;%(h|N?^d&?7mS~&KdjamFCpK z{7bFvAx(`1h^DP97l<$)HKV3gHz7$umSeFMZnJSyYWM~G$L_&>V$!-s6emq;z3}*1 zF2D4N=joOi)Y9@8*}lcnr81wqa;vdC{7c?TWE2x-zs0PpYr;Cp_F#!qOiUQ}b&Wmo z^M4Jn5t`bF2!F0KMoh9QVD(rJVqy@MXg5wQTryrem7E5t2;CpW$At>jP^;#+{IZF- z$Sbws5T_hQG3tReie)YIS0UJhu^`kxcvFXt=p+qAhysU8gQ&5}@7TD}F%4+OzowdB zly%x{!Ot1pMU8mps46|7!y1v@yTwNxM3X0e19yIIF`soOi)`JECF9Q@%Q&o zyPlB;*}?Ul?Z&KOq8APp`SKIpIr$TI7rzYRv-!rXZUR|7915olVhc&!i`JFwFJW1C z-^+j-jWU|CC~>m)sK=ePzkB{l%J^RQdhi5qb~5stG%ZD~65OXQvF-xssF5e2C#v z>AY{;;b&}DozTSa;g|bI`GBi+|16fYpYhB&&ZbY>&&5%$Am-I()5qun&n<$8#amG{ z$Tv4!9Ji^5i5>i1w3Y*KzsWkZ(xu=>^T3}*5VwxNyl`Vi8kIpEVWdz{`?VN1q}K22 zsfCI{s-QyHXBgo(&f2phy?oHkNSE)^J*VuGBfu$Xx$sd>C3{^z61VN?%-Bxse_3`Z zS?}q91d9HB4_k}!Wyal;eF&r1zxZcL!TjR##Z|bnG$^5;G|6a@>(cLGpAPvk9RYOz zUA(vXd7PLSV!Am(p`;nI&TXIh&(|q6rUf@sK6+kr?r*BYb*k{TwN^nqU(&Rn$6jih8YL$_vUrJ-YSHmjNN>N zJyTb6jo^7f@Gz(Ao|sc3&s+O#qFoTjKfm7V-K6mGol*R=WO&=CRJt&JoL^Z3zN>tk zdA!SY-X>2tlfRJ9ZTaI2vVkD_))`N8#_WAIFK`lLI*0O)IoCQIVf7kKWZa{?J%Qz| zljE!q7x_40gZ~S#H)e%bPMh@6#j{L88HJe!zUPbeNtQX40@$2Bf!2Yim~&5}AFbn{_wGa>*4!x04qtEL~M{*VSJ zkqC)3$&S{^B=17q8es*B@XH8}xjjsnm^D{ToXa;UOB0Z*`OxCO7Q^(+WQZyXbj0J& zWQ8W;C~C>jIVnWb>qSNu6D8M=7t7hS2)wiiPDRd`P$=l#&`bF!H}n!Kd$!fz3z zLAy|5e-Q_LDAIcC0cQz)LI24E`UzZ;SN$P#R2pNuH%z7<5mubN=qLExg1jek26PQh zr7m8O#}dk-eQz``%+Z=Tiv`D0`cH8SVGVoKu@`bQ_K-wUzQrqJk!7VQU|V_bUE7vo35>rBn7D(LB}}t zjzz?HdTc2^Z!~htPDz3*3>5Yzy!|@`bx-q}fVjABX_LAWR=aG~k33boaP~EdC?ryn zY#8A#WcA$VM@6RMNS~~946{v0wa5<&YaGWl$xuh1r6Yg-2$1H_QgS2vtTK4$$}ZUSK<71-h8uktuG_;Rf~rJh8~}LNjz~<&9v)4h6Y6x=cW)L^GmWB zqAMn1W6p}`2E>X^?On{Yl8~s%u}_Wt#K>1)o@U4yJaMYe)<_r4!&_~v_ubkAhd%?| zpc)7IO`m4P_O@A{QC)%|vp0d9X~8UYRq&N1ekV zNyTY~i`l{zhBEFKUP4SP0z4{{hj@|3p=4Dh7JN(5izO;u2*Ukn0;1%`R8>{pDzudZ zEj(Oej%33`p|ik9jv`5k8>7dcz_u)q`dpDlUt_zBEEVG{1N+eigd1T^)no=>Rlx&8 zac>!khnsUmuDnJR`qjNrAe7?9%U(o?zc@jG!8qy80DYZLy)0W4K0psQkVQqFYAPh+v3B3|ciPU5y&#(pRy`g~7R9=*w`rU%6xKS8{54LR zCrTQNfhdNf5@pVr%8rtzO3y%_8blW9k}5FaPSX}B9v@Yb3&z1pzLlaS^jKvp^LW06 zIquFi%T*zEoL^h90M9Kw5aXgC9UP=&+}TeZkvECf1#;P*U-DzKo%Al_0{ZzDHW1;z zH31WQzYH_}(ruR9Sq@aBNKQR8C(!XE)=HEbz3Ky~Tk?%?C~ZGQ)N4R28?g~yIK4er z(w0p>RxA__2fBicX53A%%V=m4`ZAl{aPXKsoL?$Wex zo4mU;c*x?m-9z`8+#@GP!-LOajjliW%_EwKkZe>gK8ABX&0v0ei9n>hD=mgmWj=i8R|a4#?oXkmd%W?!76>F&lA=#mMJU5g4p?L3FgCqcSi)G?m*Ga|O~EYo z`Z9Jsa7Ko*h7$x>6~pmGT`{bS1Y_Ym6T2mSAynU2KW<>Z;COB_>(MP`jE=J5IJB^- zPrpvrXKGL=klLY6hkQ5yE-lS2od{woa_XeOt5)rHX00>NyV%mP5KHSLlbpf zMeH&%fM+#`@fGUaT9;f{L6L3n4jt6uY2)F3HM z!rxT^Dwq?AjZE%8;X}1(0!B`7m+=a;$G3w}kH}rPksl~gaiqaqm*_F$Z?eTd@Az>~ z$Zxj_UZ2AO$dbr$X-Q@U{EuKh8@Sm=-1;e9Pl3=ivwkr@OpRaS)gtmTQ%Ur6dj7+6 zv%XfcH^5rUr~7yJwb;yAI;3@iT!1Z>b z^;?|Tj71z-od2-M`-2w3+7Ag*c!tw&`-8~f#%46%U8<7JYNZHtWgYT8YCViD%B;S)o|*mo}PGidAOsXi8CAw5-r3;mOMHK-J+ z7N|4CbQbUpgkdC%-Z>Ks9Y*Rl@}Ti@U&@}X1JoNG04E!n1-EQ zai^)-#h#kBy}_}Mlet>fvmG{fKe-oY;z~oA+U1L{(nCUi{~M5Pg;|~}`{wKaj++Z8 z3Hn`sBKGz?j!=1rYw#_w*cGoXR&)3i1Ux=B`%ql|og8tRYG+JED%`W?-L9{AHT)?_ z_-_HIX{1GcG_98AakM9wWR@cM7oq>=(2I9(Bm(-RMEFWWDd?>)^#sU1oS`kkxI9$S zFx?y)6J)qG>#f4 zEZuAhHKYXW2j@+MkEX0|*8_6EKP%sg!NaN(&B*+R#>y|V3E4oJ?3tPM_Uk&!vyR*y z?m12{$j>nH83Mk2p`lhNMwjW*`n`A|6YYaZNEwN(Z;3@-e+2`@ZRZFCuLr%VWfPg= zrOHuuJ>)Jn8f%03ZoQJPJ4477BoMWlb=(@#d;V-*)~+P}VMRUn<`HHq_X@-5LKE2JhXk{AEG(N#tnpwK{D0 zBSX2y`p>`#*ml$yF)q>OO^*BmKF`VNSDCYy=XJ=_tk0ThZ2-bsgV3VO>>gDC?=Kj)%%Yr%}$UrJ^Qc#5;%ya=6`h}jI>81Udv!W zu_#9%8-?6`Y+zo-3RG!A@30b~gh0it*BsqV5(R~rdW*P|c)PTAF1K zg-f{z$*ow_f$8EA_Wpn6(N5+2Yb_?V36CE^$A!r;!ayNm|}ei{+3kVYT3&$Ane}>m03wM4O*p z?6XSjLy@CL&;cjede&Cm0o=ZyA?P_~B9I z@ab>k-Sl2D-E0!In0+G!9NuM9tN5EliqIWRz{>`{4RzC|+Azmzn2S#`=$pyjM@GV= z&B`6G=HWdsawXCFG|8YYov`eA-*;!g=kjcIM23s9Ui(Wd%C0Q#O(%6pM(-{WHQ4j3 z$k?y5eJEAvQojGNRj;9xGA4hkSx(6c$KF=M zMvHl*p52B#zG?g${F-pufA#8g@^-(N>-6cH`*xaTrpRbE0olK7r<@Lrwys7NdZS?Q z-7$v6)R-Em$C?9A-mms@rCa~M{q6zY?=6Z8-4i~G+)u_MwoWN#=Kw~ z!@n7OMZpB#igx}a*SC$s z>PH_Fzjzbqax>5bfRLMgxRy?}-x6o(q@^9U-AaMV4EgnCdtY8JO-R`JuEux?6@t|{4Q$b-65aN-hVp(sf5Uo7^N zN2qCSBn9u$>1Vt3Oj&n&qOwbr6?mvLSEvxgGXj@0M)wbIt$kjqhRRLN3J~EEX!n^j z4i7Od&muHaq$22OA(Vy?EQr@yb!_I}@8$~Sr)ZDavt>e5-;x;-y-_7MDo;P!o)i7y zl7l6}d<=yNPqdbC4W#b|Ljj zC%n2}b@kV`B*$d8<5D+NOp>)PrmK(*{{st$5w@x(_@h|0v?{Tj`@Szie{rFG7VdDL zjiu}|y?@_}r5k)$I-zx9TYd&TBF+YKW2sfsmV5;o>JOO(zr-k)aw%MW`-DV@Lkl#H1yL9-$Lddcnja#Q(TzmghwhkUn$h(ZNf5dv zXEn$0LcW|IvV#xGwhB9oUpuuBpK|+g%(tbKVAhL#K!7021>Aq$>&MmjW}rVw|E_z7 z-(EoC<72G4$T?1jZlDtVaxtks0m}z+$wNjr<3= zzBNV!eoYaYALN=CEJq0+zj`l-UH(}quArHH5cH&Qka05 zCO__NBN*qBSRSFNMfOEOg9H4Vf+J7YqF8vt*P(IJ8;=fLeXvH$PIJ|Kw zIz*16%NhkB)k^j`_SzElu{ai4(PB)z3LS?_x`i4~Dh{1L_41Mey>MC&6^{zIPxOsd z1iHu&w8+}kk7M{@*&B1FRD>{P8QQSru%7IL;At_;sEX5^tzZl=bLSPI{Np2NA24RB-wH(O}ioin+3ULbNczvl1&IeQLc?nx0szQSL&l=^w&Y%V2 z59ipEFsPnctf$vEb3P&ZtlsHgn8T$T9SBbf8VoG6)=0&|%w(y0k&wgBA*KfHzRfrP z763+6lQ z)C3YqX_^S6%*8Rru+aPI(?41-;H4lvFm{*J>GQRX#||uSU!d7|sfHwW^*XYBqjng; z64U)&QjIWYSmh@dv3J@XujrZU{op zDCj>VBo5OJ-=#$0xxtd=l_qMqVRa34snN8QC$aMq5XiC(+naKCNdk?MpSxq{r}Wb> zH26&PvL|h2r-+b1Kpp$Ro2-F{7r~r|$na$8264a`Z+<)%{;hbc*Dt?FZ{{hh$Dn`} zRDTt|%-4~Y8+$OQ;}KiNQ!CAY^EG1LGmQWEKxgJ#ujwlAKc@`!P#z>?oOD#wa|Clt z?YxidT)hNw{pchnz`hZQu7k3s0}|DJK_aB3-t3w%)a|(_;PzlqIu+~WN6_Oh(NK~{ z2Dq6aNoc!1={N!g-5OrTUI^kky_#Cy?CjU6s%UqmM274>{C3Xo_w9%U}UE6FvN>Bp7oP%bt{cdkqJrIgma;7vd2_WiA53PHwxhXWTzfE}g21 z7z}jOcyPl#`ZSoquD_1eW~!d6tRAsN#luwyP{{W+=F{{LNMbN7Zktm|Sdu4{$)Ea% zC(N4KJLdGg`+&`+C;q`vy@2?2=k02;i;`-Ckyja3gdBwr-v`?{UlF=#3(6S-2*7ti zMuTY@?9fhRV?(5p#*@m;rhywEX)!j1;EtGPo{XSkM8s|EZduZ_EVr@OwS7$;a zIPiF57;k(kfO|s9QAn6J#)*=Q1xGaq#K$e16wUwI<%PcEoQwO*%7~_b;$<}~UiUhG z01+K5_+ULukJ7l84pQ$oR1pfd#PGsu1E#g;M{1Hl&5wrrD*-XD^#)ZIs(-9>7w&BF zz+k&vEToR={E}dvzlm2JKj#6sk9_1C*HC<6K0YhoLQyt6DxegP);k3S{ejbQ?c4k745G?J<(2U`Lhpt;hPQ*FXGL~}60_N<0r{bdRG)Z2ZEKe}O zhHzIaw}w)&4vbeoUmB7UdQOELPd;enT)~jcQaLwn*$6UbW>Qq&DayjjRZ`Hc+QP0&U;^wukwF=WLGDL73kJyeAP9m_$Hb&iNVW&3LzvW{+ z(^ZV`e<_9G1B%CRWbp~ZRxe(oThNi{H5NW;-#{j{;BXbIL3&~smo`ewyOB|h_%5(g z|7lJ>i-7^vw;l6m6xJ}7SSatu76wf$8A9Id`s!j𝔠7FG9oc{OE%PhnuTmS#|6~ zk7NDdIZ?xWp-ggIs+WFIH~pO)udG>0ZN2e>pE;4g#}>v`hTu+!>@KeW(*xnu@~iE% z=%1hgI`c;l2dO`SD7tT#EHQlewuTA0C-$6Eg?=Zr(v=7?KLD!{@Ck+*6>&m>C=dJe zwl7%IDAHDS9u)MU3x^|7oA%lXs9}q{;yY zRhJ`_MfX;GDjwtZu!+^AA19n}WMGoZxCYQaI`80W@ev zHDdU)m!3Eg7bx8~yo4ku7APz(Zy8J{8YJ(i8=X8b_QjqK*Z~ZVxSf|bv+ zluNF&|HxsM9ruu({n>H&$z|H=DKyPpDF`ym1sG&yDRrdKzWk&RVjwiaLXvk;`R;(h zwPw@y*wKF%iP{G_s6L~TSs?>MKIWhPx>W z4cpv6{dEJbsC5QCCNgl`@ZtO%c3+CY*5SNe6GkkJpWrGR{&&yZZj(?qU7;XowDB>& z3&yw*fp+PLiFu7Mm@bYbI%?|NfeTX%Vrcas&vB*QwgZy&-M`=WMGO~-aTDY z4lA@y;i>peP*rVN6DKZRIcvqxeX+5&?TMq`*ag$|=f#;NoKU)6rjk>e^n${uUK{G+ z)jS`*8f8_8^$*KsvRN~;WIw8yfY5$fDhvfbe8=tKL(_7$ajAZoWvpzy`qW&e z;iVyXjohm`x5D!1aeB8cSYY>by7Pe1R~KXMXSNC6IhX+bHt3>iL*52y`JlaY zke$9HfC&_7o1t=6;p9pJatJOu?NE-4%E$O+g-ZmxImL)Zv0tWW=kX2SD0(-~0ySkB z)|8+{^7#OFc^KO?#rCeS{+S5aq#t?ag9DJE6AWjPl@SIaf%Cw8_sPK$pv> zNp`h0Jj~L+dX7*4qEchUV%1u!yjvHExIgV^k~?HU-19~JI+MLPP7Qo;ytIpWl(j(c z?BZFgn1qm{U4SLEBI)n{nLuw@vr=w{ECIY@tceXvmZDO!+CU>%+8OEiv=Q(mSU&}1$m2&tWpW`?%0zC?MY%j5^tpks zI)qCVeEp#Lwog&}obGGL4*nT#Z zzsE-w{r?9ILGr$5B~snM)=}Uzkn3TbB2fg$Z-%A0u4h_NsbRNa1J)-ng5%1B>10|G z7&LS}F_+ctYi#RG26;JUPjO;Kaid`QrJ=qS*Q_q}kapr>nbq+G{OAIpBgcnBw3ew% zn1FZyam+YaBhr^hBR|5UoElmh;V8!-MH0!R(vi+WGsBb90nR7IRYh{-@MD!Xjzb4NyakTUutT&$;{F1eA-gDnn4Hy z6XLy4su9qbVEG_=Bg*k>O##YF(Bsg`0j*>zfOX@rR@ZlvmE(>^NhoP<8GDpNYay)wX4B*YlPs!O)$wg`v7@@08~7dAb(*nsEA?^Zm3h` zm`G;OrYT9L(GS2RvNuZ_NoL0M8atqI$AxLPrR9Tn$4H++17!M?Y4V$sej`&pcvI?`Kh|g-+QRS2 znHrK5Ze{gi)=^T7*{V)BGE!MtDGQgcY-%@3x8a`)MDjldzH0%l|2u&qLC_TlG!P%g z_`s|&&y1A8`|l+!I<}V=?s-^NZ&)wghYXYyI#y*#7!6t^4V!9ZEy7DMwFVc@FD)vThK5G@>WeRB+0vyF@CL+J8kRUDD&82CnvENzs-hCQ7M;GXUN&xAFO@A@ zqS4ri(D6Wn7s{f(x>}}x^R>)dxIp|xVQJf{JtQ(EzF%3vpdiD@$+orut{(2fZ zQC6y2wNT-!Pt?nzrAwrJ%eKg$1s|5n>^U=K<;wNayH__TBy=V|Bt(8H?KLQW4y@f} zvu2=!CZwW$Cn@#$W$~0r(rUZzGG+R7Sv+?Rrkg&gD6f!MLqyW4tSnr;Lh9=yGG)?K z-C@+JLpzCccL`8?F+=bb1!X<>y<&B>^w_SWD#hiC7fT=*(7}b>df|%IQjShEcgYIW zH;XB8NFICiK{?_0UrK3tSl)bpifq5*VA;My8+0vhQKLmBGGXK!(r3s}NfmkJgO6X4 zHf=gcsI*eD2@LAVI+-_rj!d081q#?BEnByd+J*+1I%9_P?bZ#Y5*%5Awhe~-aA8@s za+A!QIZM`{y~1d3J}~2RnJ5M#&KSAGH_KPf4SfWcJ?~C;fm{}&7eLgD=2kK z=15IEEv>uvLVM4ZbxYStCn!ySfR=koViC|XWri$XHV5*Sl(LexFh&wmSrL}BKHK6} zV4tj7vP5Q1o+>NXZjjEMI!UfRDl68ml=T?U=1rd_Yv#?A*4uT$3?PI_tw*1W%v-oj zzM1`%>Vno)Z6TT%mW%vSUA;=CPo4t4Z<4AOWfFq&oxNbKl!hy$Zqs79`|dlX(FsVe z?R!Z@S%thmeU?g=WBNv)R2 z-^`R+r$Tnc8tL3rh zUxtFOkU@P0$Za=XEu&HH^5q;*JkqICM|mE!yztVCGHJ?WS+Z=Y^dB%l!l4j4>m+&V zi6`ZKl=IcZFT@uvlAhad4`sn+5e#aume?tLzMw?vqVn)VkH~~CCrB!ilCJ0gb@kQq z`DdSrC+U}mAAC$c|NKkouw57F+Npy~ne~nQ<;u(CcPE@G(`L?)hwpn(KKS56S-fbO z?6c275-#;g8j8k~frW?}$X7EL$%79+Az!@ns(d!_OKH_}2kF_Nt=#aJi{z8(^JE5R zMDLB2@#8;~9zA4#=a-#{pB*9O}+otTQdHG2|5rC9@rliBqpOYFEP7%`<=Js zmDk>s!wwlPYu2un3okrRs-RT*57<%OA3t7Rc=6^K-{H!1>A3ke(1NDEus#bN%2AIB9!;oBTvZZpH7sI#(gS9Q1&|v93b--%##t%y&$7r ze^WmB^m7Rpm&h(dcElhuU7mUBN%?5}2lB<|Ur5)^ZKZp+uJXi_&&l&6-;&ugrpi)S zfE_w@mUgYHw zf)a%RG3T=}^6U$vWyXRP(gXb3Y0wVx_JptH;U`{_&p#XkgJP;ITfR(o*kNZ_pJDBD zL1?GiSgpKpC;0Z|WZ8hhv8c)~+qG>WZ;g3hmer=@-PcFU*QiTLxSjOe0Rx{WC67EX zQr;N-zP$g*D=?JekncXysbdw|JuQ(qhGdUdzMlN0Jayl_^3j;LQAS4g*kgBDHT@eo z>zs2W4x{Vsmq*IH$zRBvRV!rIVMD}^na1chKa_`_eh$2Q7qqUFZXNndn@$xnXU1fC z;_(OMqfb7Qci){NWmP58rgMe-^{+QezwHOh^0^b_>E~aBqFxRos$4o^z}feh^W?(w zPLcA)jWXtqH|2p5ugR28$IG;@K9!z39VG2w7)+h?u{`$lt1{-@2@>BhOJ*-xBIVt7 zmi>0>4;_@1IDR?rDyBt5E4)d6|L-VqPBH%}q~LPhD!n>hWLlbyNykq4des_(0C3t_ zzjwxe{Jyhx#eC=VKb`MPUb~qR#&dcw;q4yX3={L?lZn#?gggb7%&3S3$ zOYWWH-1X>#&d4`kSN|!$Je-F%y~Xw6y&HFT2rjb-Y<1JpW`a2e$| zy*l5!;UU5$P_0dkv(rUeb=JA)D^Dq62`d|O}J?E(39jE@so_fr=TKiYu# z2RfoU;on849PV6p-7V@TJoND0&YgGPuKuy3 z-f;TtwwtpliADp=o3Yf{amQWQgzB6~1Z~yeWO5N_z)m}n-Oki$)0`8IKh}Bv`KOt} zx$64sosTDf<7`ajoZnx3ne*<1Pc;0nL-%r)%^wFubDiIucbPMC${ghj`2o@u?mqr( z=N}i{?w}Gqlo_DeHa#Q=qolR@zI-k5d(z*3^!$ZQeFTUa2cBjeP zd;0-SG?G+*L#?UV@O}1mCVld;`j@YxEU*DY_w6S!Oxr|~n6{S5 z;30$I2YOiZ3l=PpOE0}tdiL%qL-*QUZo2+DS-fPitX#iVE%5^mJV5#Y-;P5D%2-&8 ztJiI48tb{sL|?0i)tJ%s`=n&Kf7*rW>KfT+?|r1IU8Rsgflyc)8@N^}Qq`&oGaa1^ z%D(&UBe7Uajz01@Suk(0);k>H)Hf#$b+zItDw9n$DY@phN9FS09U_-rcB3>JG*VR& zl->8(Tb~LLcHM25)YjKXHj$L}ZQ8<$9UzrKv{#8Q`Xe4Y|% z+rB-f(;H+V>VCqBC&=Q(i=-h^CtrN^wd}FeKv-~&F4fpoVJ=f-`3gOFj7Y5s`NCLD z!MF7?j_f{cS6xqbq)ytkZzuH;!=G;350XdjyhV;X@=!Vd{PRGA5y{`4da6wL_!ISS zT)$rW_UR*1)Ivs#cup?8$EIkV)@UmT{g2!mAGw{0!+<}cC*wuc;gsN}friy2nS_TA+Z z%%1N0$DNq|50YNJ2g`ZqT`1G1&s3W3y8BK!`j* zdY#sLF_Qw%wOukPsjaP+wUAfxXyN?1D*wf0Mfx5A*8=+X=`A(&jk>WXxv5@4-jGCM z4U$`0D}Ki>H4UU3DMLQ#gV|uaHjpX6fC2qw{`~ps|LpTm<@HxbNw1!JOCMO~C!h9P zT@K1*eVEz!Bmsih7Du4ID;F)2Glm}`3+F7*yqQfKrAN0OGN4a)$TEbhxJriXI9RG7 z?~CWmmIohvNcI@IyY$$xyPSL8xiaC?>9Tr7LK3Nj?7sV6n4#6MnwU{_VwaX=CW~1! zYnwtpSdaGSLK{R5v!)fR*GmcfGpEgxn{Rzcb{@8;^y}4IPCNBaG95F@6>B%?5^Dec znDvr4wBSJp9jGtO8J3%6RrNRhuq@j%|2JTpl(;LSc^(6v9F$hdu(vcAM!X|M@YmMG z#LMk#@TVK1vhV%}KzM6q`O4*(hJ7kW?mt}WpcwqYpcG-+rV07_FceM(%7nttb0OBP zTaS*5a6j~8xJcLR_!7Z}SiSg)gAzc8pE_x>y!P@da?k<$$nCe^F26tLPr4z+%a=;f znfY2TH?}n%YM4w*K6hP;4jQDnC+9VCi@gX}E9be<1A2|c>@kOv=rKyJJBHu>viSIOi_^Yyu_lM7&~ z?3ay8r^z!TUYDV}9wawjeSzF__q9@5UZr{0ty?S|+INB z5H?$rC~R1_4jnfRhLcm^IqU+)@o|$%26P$UE2yohlQIwhb5z&ZeW79ud?LR-U=P{8 zdv|$x)F`>~^2dp$~g)b-N6(v%R0fve!laA|i zq;~L!0(^4km0&0!aT*$+EmU4CPC6##sGGMf2K$T`@=uD9Hy+pL7NnGXEGa6HBGL}v z1IL?hzD>TE@V$8Oz z`dA40xsi>77N6y`Y}+0(%*VJMV^qLM<0IVq#zyJA!$9Gq(eB%|l`~I2PF_U6`+U;J zGHu30dG@)-B$tXxt2V7L$d#(>vHe%BUMWj3AR8{&-8~kXeg8|aO-h`JwA-o{&<#-v zjnGm)Sa%UfsJDHk)I}Sl29|P%%3^)`olT|1S5_>+a6tClb5A+r^xw(VS6!t7+_|ca z4BDYTESHC5=8Rdg0oKVQk3S~E2JIx>LuIgL_L0fcr^t*?Cd%3+tL3>7&&r}@OQjLY zrd4r;6gk|Vo|BEW8zi1hO50A|q;;zfGWN~4Wc})mve*8H$Y&GA%d0PsmQA%A< z)v$EE4p*h2_@gPQM12WQKJ%1(^UXI>(V|>({;X71l?o;-QVMP33%8JHu1KbQ{(%hZ zTOy6VO8Io+*V3?It>$gtvAdjc#u>WHVD@w~v;??8L3)e2V7tgB zwEwDQYoxI;%GGqucgL-_${FXJBLjyHlcLrg5#pDNF2799`s42~C}h>zttc-QFWSiq zMU$fG2gR|mx>k1-we8qa{Alj4rhO@O4fRUb-h1vXS6%s6nKgf*OoO#I_T7)AOZ(Q+ zs%4e@=?`Z~UClAm)MKCjj_1n5diG20-Gz@gFOB@Qe zvZ|#lT)0sA{Mw5z%F?CFq-WnA(za!V@Vx+x3Q`{CeiuTe#G@Hm@byGkr!na}a8K!t z0sSv`Jp!6H%EYfek*}xBkv;bw07D4LF+)nDjrbsyymBg1GGodN*rO5gmbZbe6U4Y+ z9!~S+nR+N(!kK?KS4O_}JdCDI7>Ho0XNx42<-R4a#2exed5^aH*f-vkiJ0y5+-WF~ zV+M?Vl7Nx)&WG>GNAJBaYuBxn@o$ciDN`}4?J-1l+V>z?xO9=MT0UDMsR-<=A}K2m z3C2z7(xtoH|G;Ci3fA?Uxhv(JcRm6oen~XeqXR&4vMK4i{f-i^HwH@zGtS!Ov!oUL zC2hM(9P(7XsYa5GDIG{Fple#U>nt@e2=Bk|VVS#l9cJ8h^6WD&%Z@#}C=M`4IJ9tx zu)0YtlphJqZJk1Xz-AHO8wL38*v;?$HLy(&HmSsuu#)`{VpT|(Zl-bn&EokoZ1-KH zed`voc-bOYv_2WS^AIRBOqnn}43`v1V?%?4!Wf-l5x(-u%TOSHk`@*26tLe8QdU+b zmtA(5Jn+DSa>8#;mf!#OG{j`2HKuVryKkraN+TE?_BiMO*{*v}*=eUCI*4#9Rv6Yx zht6%~>uHnaZ&zOrtFT6nI_yYHN&89r_Fd$Fz4w-PfQuZo6Z!aiHjmVfpkF zKP>9TNWC}^>fLtTRnoBp2A#FC-#+{54wx&i{F{t;euP|g)fF;qmqC!t9OOSC4hD#_ z7Hy?nsZUNj;n%WeLtJ**?-$akO$!+^sIR;Z1#-&Smt&B;US4?W0Xh4;i!j|k7BrsTQ3*F|(HebIS;lEaQ1E+?LTy5xdTEf`D!o;WP@u;jc&Qi5`pEt@CD!n*Cyp|d^= zU9xbw{O077r3ka7BrNlFt5(YnsDJzRZDrP+IkL;Hd!rpY$kN4&WoW;?(zbO=$Oy+r zDp!$(>sHEk1A9xy4js_ZiZIC4W7u;*_YTscb(I|VyVGUXY*^d<21)1My)acDC}E5( zRi&`HznLt*|NZZ!9GZgXAa?17cJgH9#=l)54?p;Tq@k=SN2Mj)yh!j!S!J0NmzT(y zXZ-<+Y=sQobr9O5Sa#oIcNsQ#C#itUo%OpjWWvWE%TY&yhn+gg@Zkr;`i#qQCmbiM z)^3zN_d8I!_Z``!2D77Re0yLQl-SqcUXAJBSzCDOh_CmHeBSU=gYYMsnkyg;fd&@V5(1T#CYjC_5xTGl0{Ev5H>zA|#e z)AIMfUMC-YGERE;+(9~b?jU>Yz8Cs|$O*@vB=hDjkbU>wL%MbBrn_Hu+HrvH-dVhC zwUnYi4eCEg;*mzl)UK0#_SzTLdPnKlwWr*6%WZP?)z`wPnJxq_PEMb51JG$3WkP`nr1Oi!UZ>-3g?L^|#mj@O;RjJOY%xUM;UI zpYkDwxO6J+BqMcB95@>{N3|K8b;4232cJ%L?+m0AXTXkAf=~M>st_--T(rDLoI_1RUrcE$)278T6 z5O|*jPn&=bg7X0^VQdZMhEd460k{+c!eXgLCz*5GEf2`!M1u5Y^h){K8f4HWTeb&* zbZyE1EbdvCEy30~ADDH^GE*tk0oM$EGBBmnDO5=Nht1Dx7JRjjDh=qS064JQNu}NN z=xd2+J)>PuhmmanE`*$@W$N0|VL-WwPD3ghyb&by|zLNAekV}Z^y;ZU*o7JMTFR! zQ}B*?wxn^}z_dtSZhCBh^}CQCwOJkohS+woR|8w1`Io>pEvF!zg!Pasj4&8V0>PlZ zkids<1aw;6C(W&T+@H(zblg9?3Rb{*=ba}LCQOiHk3CkR(WnFh0gdC@Bhx_;)taTB zz++Ci1uBt@G?l^QZqaT?gE0+xNdwdKP^nBNjyRr-#+O12j>g7Dc?8xH%N#y@xIFsk zqjJze2TA|_{WTpA>*6ed2Q&FFZROiLJb6vC!=V?O`jSSznS=ObEUqsl5V+PpWXMjY z9ss5#Uh+WCv`8kE7f>2n2c-*W_|~SupH-_phNtHFo*!lb2D zn?qeCS&y>7ceoT!5d!e!M9z3>V`+)hY}BHN~le}WPaMnkjYx@CM9)ZsXn1;Z-Y%iwa>)$F%@bk)Wwv$QA7h@Vx2d>^a zI?IGkL%l#>lJ5tQ9$Zm3D1FK1_^czRuZu@ws2TXkJc^5%m;p12R3e6aDSdX*7;BU` z^2RA+X~+feBa6yt7U4WAh4stCBal(FBIOZ4dNC*}KcK+TCVs6e^Cd7-j$qcr6aQk6 zTk@ajgRq3T{?E64vpgIgbm!ubNt7)m0ohc&NgwjYYa^11CRGlCC_4-~`HTgl1Y2Fw zki$%t62%AaTr6_=2FJ3=$2i*39zVg?@S(!B4fyPWydwDY*Z>Fg^New{rKy_IrAuU~ zr0(x$0H0@ZNsj%M?*f>X)TIAXuy{8sV2eVwEW0VsW?*9t4+vXN_tU@wX8%(jQ1McU zQ;^tMxx_$VgR#T#N+G4<;=>{OZ5;DXn>J0lbm^jwor`hAVXsU_;8IOI9)*A;(C8s4 z#@!*G^G zVGIVt0+U3%EE^qZdz53Qv+c#S9Arond2)dI8Vcb#0dY4s| zOQfMu*QUF4?PAjNoEGrC5k>&dFew7fJPU<`F@c9!v0su#@|<~iPny_2=&!GDlol;Z zH9hH%L>kcs0l1>3HsNkGpD!SO7zdceD4sx&eGWY3KmytKVPvn1$0P{FZ+1wbeg>&N z?*KJ$4CNgN_<`Vx)aE&DpoP51{HV=K`<_ey#{O{Xz8khliECrBRRC1twqsIJQel>t zmunn>aolauqD2d}FnJ}g6EQE9o5g3Zv>y0YU0GQPItp>{gf^dc8a4PzXH!k|!(@D6m#&t-umUGsD@5398H?d@P^oXx%GVj%YccQT;C4ai4`E zWCv`3CC|F&4{QXML*+qUFimM`sp6-i;#;IiD2;F#lqAy8u@kc#?xx}3Kx>?X6JK5T zLz(k!)2t_;2hsUpm3T6+bix&q125P?{X8`=TqGN6Vp4*#!VauV&=^7(A6jD6fOwPN z$dB~oIR~OR?s;%ou@7l{L3Ai?>*UU$dbR39fiOB8KVng&Yr9D(oFo(#cUaWdHb@z+ zro(aobvqvFX$Mg%L#xzlYHFma$|xPiS5#D>p+SHbGY+&hEkiHx=g@I8X!bw?{0=zM zfV!53(80s7@+))4;Fez%O$W}f~AAb44jx9AdGFnwx;}8APvk%I+Y)AYzu-_ z{J^ZTQB)K}dJYu)FhiMIt$dRf)zUBuh@k~-2wSl+8k3@6Ih3`D&Sj|NNF!n)t9*?; z5Hf8Zk7EER3QH8$Ye`Wt;uM{pucIH<@IjU#56tI>obYQ*4ip{VGG-gmA|;=RYu&na z`a&Js#3*kJg0O}|z@I;`vYs>+$P@CYva$mFCw(4?LE%z{fKX?t93abELe>y(`V{&d zlsM(n7%_B4wuq1Y!1z<(8)O~z@MBiO;;U;nN-+lKBGi*dEYR@ct}p`W*Lr{fX$*|P zpyemq1Udq^i^3(+$Scdx*nh1O|1K~?=YKD3vl3^+^J*0!f%g<%HZB{$c4PwYnTMU) zb|wmvReaWBVmfOX@jjcS0;8e{$cByUrK++GI)D#2*fGs?+5ox&Y4Sjc!RnwzKnsb& zMx{yo#7)Nz%Nc@IC6{F^)ib*zp<9Z~|#19s-5d;$)m?1iErr??G^Y1wgjmIarRSf3p75jbFkft#y1+~IkA3A=8h@^08Tny`z{AHc&G`X&>QTN;v*x|`fmTh^#D|ts{$u?oR%6ssRD>CGK z0yBdIm3CygH+a7~_xC|XhzHl62aN@!8(Y6QsoQ(q*(`IkV8L}x%MmI;X~UdFoj{<{ASNaPuhbfDu<_WmjI}QcXe*$D^~es)YY6gv;Y$#8ZIYxyvoVVt5;nOdui#n?u& zoyuA~^fQc>x7VA4WgXMCGp>Oe3%m&NhNUb&00E^%KntCMk%qNKrSFG;T5G`4W(CA5 zRnkr%Ek;;4jWhLP82tp^Gu|p9hUcf}mBPyUQBm-oz&Kl1(n7!GNe&&KOC=5*r^^kE z4VZctOC%c6gMH$dVsoD@t!PyWqy^>E>LecGpaiJmQDx6p@{QHrP~V{Ez3_!ATJ!-3 zJtc=0TOj0@M4U$hm^vG)i;4w&L}yXn)3V~sNBPg?EIxA}pL{yy<UJ$am1QaCX2uh!9CQCFWi3aX8W{#Xu@SrpfvR*F+SSmK5;^X==l@-$y7iEv_ z#sj%PFY2tzeqa`l7EnL16Bn08xa@>#peWD?WoxZ*wiTCZR1rey^KhvsW&nQlp<*b1 z&5L@P&*;HeKwJpCPbbWI;9OGSj4ul#!XKuLaKJ<#MPZ?!kqh>HBkMGBjG@3QmqZf4 zV+=4Ve>>nA{!u1~$H>n4HpZb$l%j?bv2Z7nA3Pvt zi=DX$9^lu}68N}1nudYx6Zv%6ux$my$$tVypqmThJ+EvGGKn3PjhJt>Qn68y^GdJ; zGLAqT%*%#jr=zg&-Y6vsxEZCXz^Q<312YXfAeo3;;Detn3O`4EwF2C9yecjL6*zIQ zTl!{wKNjQ8xCx?Uc~7^=j9Rz)3E!IUs2F( zfyz}C8aiFrACxdUs+Q@BL<$Ok4#?w#G0Yve!jX79jAjQm(9agPZgp(Go z^Lx28guE<$cr@Ei-Q{J zBVW1P!E#v`Qp*VCx8)*E#)JYru!t&oi}mc(F8gMbP>je4N9BwJ0oa!9PntLxcN#t|q8U6V!}ANX0^92}@T?2-`c%JNu_&Ct2#-m5_QTznX-P& z!_Gh}oWLn*oIHV8(lSn9s#+W_mMAP4&OCquG=N^E0~QV}_*5z`4slaj091Vu2)8cR zAgGa_+5s+fSI~wyOuZRigmM!NHImGvBn`#G=Wy(hNq9wC?%k778cpOU2D4CW29BMtPD~jAy&^o|bEzyBJVT5e9me$p^Khk#&zG zc&q{}JJds)23Iy0Kbp(^+{9(uz#0Z@H{0&KvJR9n@|UthM|$|o#y)^I_4H{N<-y1r zAF!LHA+y_th5(mJxQ2^?6`fMs6m0=<)poSB5P0fl5@k{65gf3GiimB-T^cFK9?PY? za+ytMGmvKvkPvNw@r|_HD8St=uz<-!)Q#V=4RTfrd8bk#eas7TRB>}AL#v)gKG4rT zQNMA6gu&l1-{|Dh8^Qx1lgB%AhDX`vK+5uoi_C7M41yNQd78=y^z%qqmPxw71|8T~ zzEwpWYh(&)wAICt!onve- z(nupT4W4plOC3R;68M1=Dsa+4gG$>J`MBh$Ry=zgJ3EpiiIz`4h*jf>^3S|1oAswt zee@&1NZmgHHii=60t=+YW0f+&Dlr0yp^~J6BGY(JWk)75F9~OQE_0BP>}WhEh0IPv zsqoWp6kaN4o<>MKyi(|?>;teQxs<@8L)qcE1i_92wAz?-w!_+if;dPkAF%OCWy342 z1X?dlPpgnY&pQNj(oVs^wv_N5+|@6#fiGvfuboKbn;^w z+R;Jl;?*nUhMWH`OINJWH2dtex72RhqzaA7Gu41u1(YiVLOTnD8$C}2y%EMQt*4^W zB0V0J-AFrqLme8_>;wtHQiggGKVQ>^z<}|}x1y4;#L$5`AO#_CdekiZl(!H%IqSv2 zgc5hhowv!g*If+@E+&-~6-bMY3dat@9UEDUCPjhb$mERBrAED_N2H|6MI!0{c}OgLs053*{2+XqUR!o@`&v;PW^u zr&Q3CPs%0-f-vOD3);BsLs^zxZ6`@`YDlmJ!cAr%O&Z-f*LQ{?RA8Ng;x~ zG?K#Ln|?6mPv=T444iP#jNpw?^UQ_IJW0qTm&}NdBRgj*tUr0k_T=?P0R(TG0hQM) z1a`BRCeUfzmku@ubTYl>$3d~_l{jp8a~N@Eok+CCNoQhCQeO&ioSK?y#Hkl~Ou5UK zFV!p4rP5I+9*^k#rcIml3dP!l*Iq3>=)8Kh5KSeWMx-a^Gzy9&;?B#XUUP1|)x4aP z1YIniuDZVYr3*B^mP5cyL+it`Y`s{=E#aHxixkg_jq9DWFTKc_GGm5@ckR^K$s|A@ zUlNI>%zFz!6RoaSx)QNEC!46&R~g8a>gx3jg##T(w@%-$iK1O1n#Q)yDv(#F#7CS& zyupd5Qd+)3uEEJ=5{j=bgZ6OSG{3#FIdeK-GDZHT!9&v~3X0b_^49Vh9YpJH`E3Ep z(e1eWgI%Uh7q9f70T zJKA~hf%{Fc1?FR0x~OX#>)aQdvY;ZZfA!HijZ2bO0Ja)^JfsrJ2;|}}3p$cK(b2qQ z^Xd2xoWVneI2T;<7bPc2a^bEx|If}d51Eq%8L=wwL{JM*#2SY|NMGnO{BRL8N!qu; zzE7m5J+e?bKqB7EYts&l$byGS^kr6_c$qopq#$n*@W7Vy>RV%+Q+|J@`guwwPiC}` z%cY%2q!!McDrtf3Z5`X$>MpiB6ukNgnMB5^UBiCW42|i86GQsH-ExC-*F&bQ&OPT` z=k3wv6i$aPT*WAhX=l;Gc}|Cpoi&)Xh@u$QL^+mb9Zj8#+dAa;y={eUdhMPg7p+ZN zG8|QqPs8o0X*}hRTbs~{^=q&qH~OHm#9fz4{`~E6dibkgvb|N`~${ zRNA+0BM;vHfSmdJGxUT*T1ZaRoXWRs@iOt0lu21>2;nLDdhQA-Ew7YTWu+L|>%r4G zuPw*oVqxU8y<$gBm6rCX;C5?QlE zrp%ZlORF2DysShj&`z~=^?HUn`LTWjPmN5Vo~6p)1ql+m6=H^5x5w_p~%<3C*58TY2BmP%rJ;w}<6aESXqR7B5;XUR0nMyz!*7 zvT((62~`$JAd;4~8>?kwJSuZ$&j+vCDo<%CQzj`}w8%gI{Bz|qd2Y6~I%;9D{VQO7 zQO;VnY^fGE+lg&PYn|(-q?HyM+ivpY$x0vb5I5Ig8!*E$UuUWZo`q^ra!X`IMKR=j z11!B-ovA6_WnVmQ5Qs=)Q^4ik1kglUHAR6?K{`I}GSA z#gN%ZU4zuF#VmmG18ck<kgZ_klVHE*2{L=btPs1gdT#=Ssv_GeOF=0l0~Th3bouz(T3dO zx}kc5OrA7Zj{VgyC4n|tzkaQJ_4QY}RKu@KvCX{RfVMZ=gEI%t4k$C!BT(d+A!YQ8 zBtGnBzvbEa3=^p&E2&73z^bpz#N*4$Z=j3s2x-FBDvpc}UD*-LtC-&@j< zn;c~y^3567M;}j+V@^0xKK}SKOoWmWEGm~`SmkV!SYreF^8%SSbGp`;{g`|tZFKBE zq>ugPhrqU-odTp(N~{cpn~uv8=bUqncAQb8M(F`pRM-zb_@Lf@`Q;bN(18O7%2!`~ zC67P;xV-ezOHcsQ<=A77;S@kV9QUC-_4Ly+>b2Ko@|3BvX3ZMeZTDSd>9Qqq!womc zfc^uac-zRVS+nK7`|gt=Lk8>q;vs{FC_S&gK1#ZErx4`i$tRwYC!TmhCQkf9mBz4P z!{jyK9Wi2rj2t;ql?Ml!jvYJ77hilK4?OUIo69e(&>I%rLt___4%-CMsD zL$N2nI6(2#!{d%6GK`{j4P{jF~Aqw@A( zN-LPs?!Vu@a@yHv3r{w!U%yIDKJ!A^_s}DyZIMTwef%NR`6+pM%miuMsk;p7-3iKY zzC7^6bMpKPFUi-FzLIqfUfFv{KUq9ys$6l^RWfhMD*1fkL>Ye2elp^T2W8}IZ^}z= zd?a1B>n1z&=&EbwROFn>j~MX`gmOHl;d{v!Urm(X{r(S_B8TO<=U$XoUU^MFBG96$ zrT7C}9y7}p=bUpklsI4P>Z;T6C!cy!j}YEzr=8@68*h-YW5>u_W8RdnzxrB=ODbgh z?R!e~s!ejtuaA~ro%$Q81pefP^|HsWej%5feW@&+Jxl)l=gVa7ij^`6bRWF$e!51P zN%P@(sSf^6KmC-99Wz!&zxjsDojV6guteLYp)mrP8KQ&5n{U1;d+oKSeE7lpa_@cj z>v6)Hs%z!pM;_6$Qw9te0KR;tA1L9pdD7RDwJmwJ&f9Ne3jeq3b$R8{#~wuo{Y3WJ zXK$%$QK{cgedMvH)zNbA{rAcjpNx|U zpMEU+A8-Khe=QF^bid5U;I$e?!-4znFHb)7xXhY7Lv|m&r=&4>op+vJQRqs;mB{A21<}^B2qqzj|Q+Z3)?XS+4l&-&CPL{q&RaGI(;> zVMk#QDnb9BB@aFP2>R}5`SjCIC0rDgzJ2>aQlLc9rz!i~X8bw&(sO8smtGhNCHC{P2Fq}JYzWfq>ZZzn8{k7NS)sZjCN(}mk{^D@q=l))K^)-3?i6>?B8?Q@a zB&Gue4Lg>>rJwop=gEZ^UL?mHbF}u~lTSKPsyA(vy${%5K6&>8c^Yy*{Ln+>qDwB3 zlB#m)*}aGMc^;F!$FN=Hv(G-2ZZK4MWG|l`kjFg9v%02M`v%V;dh?ApP{*d4Ffg8tQ#H=}F!kg@gQm__ zJ0qTX(0OR&Yno=(^pBkVjygj9g!zl+J7=ExN9UVw4DBbLbeuE#4U?7=s7xk-DO(aQ z<*Z-74m6mh9?rD;_S;P-hO;*=asKqTbDT*tCTd)-cHN!iCQLg)N|w{~dNbW0)_FT; zeKd#QjFYHa=Jeg;V22aFrArq$ryYNYQ@@GF>O0Q7T29=mohNVmi}TFOFKZZK_|d=B z>D;`zpF1ZVf0Q%ro7oz^Y~@_1Z@2B#&-mJS(utw1I2|YbgqL4>+PU)|H(*NJ=uDeF z+37c6pi_@@gp2=jmGjV}W*Q!iHX;w{O*wDAHOjg4(n~aa!Jc&dJ9d?Tr4~ z@Y)=ml5uKk%(VB~Yp-%1eay%fVdQJCI_F( z)19?z*6RJ7#mk)Gzx=iH_J{B3{g+>j*DK-9TkmsjzV0sga*(yRoF0RA)u}Pz4`=?# zdG6Vf@Wq|6uRibm?)<-Pwy5yoJMTI7-uDptOWcV!u5=c-a*WBpbNQvGL$1t+NnU^D zF6XBEScZXz@3_}_^7=>B|IiJ0Ik*4g?4470q+PUygN|+6w$n++ww-ir+qP}nwr$(C z%|7*wb9;Wmd2im!s{e%Erqz&*0ed?Qc0<>g~^R)%N_vIIg5)Ft$716VN;Ax@~zG z9S&pQJI?UG+FqQ392}V|WgW_LFPjH_)t{C=Z{ZC6;gjV$CpBHb&@99BjbZPq%pXc&Mmv_O_mdjcPS-ux>na3L~!|c!7Zn2Yb@Y7El)`ieq_8xlrpyJN z_l)$ZSp{Ikp3Gj9`>nHxwBzyWe7fQ(vpJgY>&6Gi5Ab+5l%CSH%_ZKpfNWZ|Iwld$ zO%xALpHmPZJ6*2G402hQfcdajiE1A6z^zO0eIGe~(=JO;0EA#n-CS00{tY0DP_?z{ zs`Ofv!`sr`a%IccBRKsET)YS1Izf$c%(%|p*Q{2-OG*sy~4L`)z znjD&|G&(fF5ghpM{Nkf(*Jgu{A7*%N$LKq+3RL%WJ+Hx}+zVz10jnhcxfwUp>UTcq{?R z9Y`e9vyqHE7>a4K&E|`$d>?0q>U^f-P!PG)lc%)CDnS$v_Luhb!?Cjw%KDO5M(r#h zMSa|e-iCA$RJy_qxFhi-f#y~V_fmLaS6l6oxV~5O4hQz56V3>H^uxzyxzPYmc9GmM zgKv+p%eEoIy7TMyQMZEJWENJVvy<(5Nudvl0x4BCPfNlhLyv3>@4>J3*P2Z-*qso4 znL^Yxnk`c}sTm0=q^hVtb&y_?;AXSVuzh_>zy#1}7CHPN(NAiSv@T{RT4*u!#OnCmSxDQfsVIWQ+t9mdztrSEpXbd-Ai)^XW!#{3Wfov29F!*dO*+N#qYlaR|(Y`NtTUW};fldj3ETCbBWw{MKPVMDZl>_~KGlX(PcIRZM zBP==LHe?&$lQ|yiz7+YP*U}#FhR$e9C-~Zfbm%Gicnmw>@|JL#ZeCBf3eE zeBwE|wT~KCkx)1FWs)JC`GscU>M72(J5gPm$d<`2p4;OcAAyos^)3sNhl%b?L*EI~ z2CJm3TEPOxV47z)u1xnNrugxKO}P1bK^ZPwXtj#Pybbgn%&y+*)6V<)C62}S#fSwk z5=njr%JG%FwRNkxX7|s!ibIAh0(rDJY59%c%lTchaWDHHJ_TNCDeqk~q2=ZF-GMU7 zbba1*9s~9|eSl-?sT_Wo0TmK&kLRS`U8h7@ky)-+-g2!@O!HMg?L9Ahx3L3!V zo<$uknkj}JL*;VrZR&air`%ePmiLHObAphBF_v@MgT!&7vX|{XZg2achSZ-Gvf2DU zZ-y!t+6>#)t=mVozMq-e4&%AU7TT7pwF+Jm*Ni|lG6oeF!SaZjhJW^bh$`4wv3#ai zC~pqJSlKUDN@lWo@=+YLh?A@gqnB2eFTP1)d1;kOWaDvadPQ%*Y&~4Bi=&Sx--ALw zFfcMnU@UMh6!;;T=6HB{K?8_*Nh3N*8n#T4laQr*TP`<56#w*DD~IBHHt;?kM0Pmt z)r;j|Ox;o;rAhM9lK?95G>l<1o`A+|wg*4J@T#VqA{CkPMJ*}0VzWkQn(bM^`}5{K zmYA4n(*qYUiX8y-?eJ?Cv@dR00j$py%&TCAhkJ!Te8#FT-ikc<%ZsW+Fy{9O=ezzE z=QpAKY)&_;2p4y54j!lq?i_|G^8yB_n}&P%ScrvF1oHm6?0$me+@KDe#J*i34Sn)* zrK%+ai3*NtZR!O27D}%FRdU|;q?2`uJcgw*NuZQg6-w$(3Y}Js{kpcaBq5Dd3f-c$ zo61?H_UUezxl`tf_1rj%!&Cj}f4Bm`^k~6O<|$e-Bv`-ndL z0YF4e^wez|qvQCeL*IV(*PCtYk|r@dkzxYi`=Ke#`rvW58-fJPXgLe=v$kE1rJ-tn zy-bQ+m4BJvH*V+KgTrD&4w@C>ONwGwD2xIkzw?d{_B;h627JDOVEjh}M_;lLRe^ny zAV;*5tdmk^#jeBw#dl9+7!q(g+IpNx#K`egh{nFT39t})w=b`$QO!zfr$j~S#r%~7 z?X@4`x$=Hu2L@Y?E4nRThPxDOynMlCwo9B0*RwsD?F7DNvDJ^f6l-c6uNAiAEXul9*>m$g%{uu7O zyBz{>@NJW0XglQNeopF*XS}nJL2-RQ-;Yja)<(z88|o$lOnGsDc~jQ2+I=S_@Lrib zFyyL=fO@^n06=Ei6?oZj)pNfu##q9{Ye>ZMYXhCBk$Y^1!SnCT%~+{3V0GZ3N=4BU zXr0Qk?)e&e)q(`X=O>FkS--5J0M0G&J+BPh52w|Pw%YEQf4c1}lolBM7S^NE3}K^m zH>K5B#ySWphoGA5G@z&@KyZ9l04p=OM4m%Y^Gs;g)1&{NPx$L1)7BW~m+kwHzB0p9 zn}upI1dV!!)uCjY|kKE*V`o!2#g$_NOio%o&bp(7gm3P zs>Y)MTmt_&s9BwPc+kCY-!u7ea6>YJ?@N^9o6ei0;7NTh;_t#(-Xc(lY6I$c&7f-a zdc{`J;ry`)sY>~OsvXAh2qkSbJ2gt4>D~G@OC;4c@`GcSlMb;oLwq}w<_NtV1Kopr zY~%WzZ{BwbVq;;Zxv3W)G7gVuzRBf@z35MR)tia0yTKX~=~tX~abCPPLQDCAG5%=p z3zN0t_D}?@$&!^R%E4EJC%~5<&p1Rd0_KYq)nA7%5XB-YmQ=N6Ls1qyO=6JtTPxzw z?{^P)vmshUkFhHKEg3iMUBm+9RDysaf|L7ZO%S?_t?iM$AvK@+7F(0C};Y<0fA?$5!iWV#rMowl8F?6i6nEV+aL ze%D4T3c)+D*v@!4+?$miFj`IsA?#8>Ts6~J zOgXxFHTWcBWtqi4kmZ2EOn=L8Y=y56u|$wW34}2W*9})(V$Z$Qp>J2ae}BFv8l)BT zJ>3N^l;~hOs51bl9qjGTEj-36Ps@tC@-%Y1FHKke8f>xA`)h){xWA|?G{^lzafw@Z zJt_f-KjJBLI+Q4UIh3C_?m%UMzw)XrET{V_csJGvEmx}s_mCHa?l_h9#b`gQdjp%S zwn4nfYd~q7BLlm>1d&X)ZF|34oOW$^@EAD}Nfp*bVNZ}KMJD=K7&ji#=VjIDSapA1=oiIt($m z?w1yicOdWs>J>^%zYxU{s;xnuv%UZI&zUz-!QnA{NWfal!(}&{jeEJDUdzonA38kl z-uC+`lY4(WB?2M$+Mp zgxEs2KAp<_em;UKhv*wjZJYEY&qtc!QIe9Z|L}s+Mw5BrB)Red-~_XP@9YRvwo@#P z6M^eUzWth@^>R?QDWWa(iK-C*=z%4=jLwWoYPuy(?0pmbahNA-AfZL!i|*b3xSU@@ zt5aug*!B6uq1h6WLQz#>)1zeUwEJ;dS!Xtx+U#Td)A4dfx%qkv2E#^g{DW)`A%YDr zaAkn?bucz)AR$T`a38cyD@EiFqzxVXwxU&dG)5AW6v&9ia}>9KAjb1J98INUD#Ym$ z2bjo^1NRHZl2g19_!V7n*p**4EM2jngB<{qA|Y;yoqI7XUI&ZW-^jE_in6{o!~M*2 zmZQ2s_&|p}(?)Flb5o>U!fbA*1fOq+zkdq5_r~JzAj*q}UCg!{f~mu$$pc!B0&o59 zf+qp8H%jFqmL}b94??meSXvHz2F9PlSilg{F8Lqmdn&v8&rRnidNb~O(rXsK9w|Z3 zbHmrenW51xNo?|=&oj*LD}MP6Nq$*{Bc=hoaPoeGSX6^J$wJVtmnW9we-znn2>=97 z9Uo@TR{_lO!2X}LdKt@Rr$qU&Spu_m_0j z;;370AdF`iQy|`UyMZBwqrzA|kZm2KT>vSCfj^fLb({UnF%SYy9?L4I3g2hQpaD?q zF|bq}>TLb5=Ao#g0V(IeP4{!P6aCD={o~^-;hheH<1` z$#@)*knwj&GviO2?JpA)lU&zr@6avZT_HwhkFjxzY~sXHFEV5Qzux*4rZo8qZI02` zCQ~XHn0LSHWK2u#I3iT`lux=&AHu5FBGkP%4f_F!%KP9Te-b03c<<=pzvM0U6NWoSo zO)eKj69(yo#weCVzSQ@zA0MyU*3kDfaG)hp_W{rpB&1dZ$+H*95>a{hOI(4|GQWbd za_)h3?a)O9szU`$cv8W?EB?G?k0~<~_an;X{py`BIr>){!>8*S88>Zyv_FZk<=n@@ zPithLX`eBUl^oPJO0J46ny$Bz;iU!dfIjRO;qr3y*J9YwJ>+^~us0yzr2UXc(`%3^ zWL?mm5;EtnUkLNP2{sYMQMCE6y`F5sX^yWzP3Hyk`BDqmM!>!k;n1~&Mw35+Buj=! z=R?{$ke+ZLuAf}`k)-tA#GlOl%J@1uKTBb=L9acCiLU#yq`=VVI;-~ZScfv@`N2h0 zTXi%DT5zvH5K#rfSLfWK~GP@U5 zjq=51LLDd5C2{`|*PT%#)YhX$j82hx2&YkCBZ@DgQ$e-3LfH2-Yc!0;aU++|FEb>J zmqPy0RdFD6H+X8^^g|Yc9Im5P;0=&m5e4V_D~}tW{3?amJJLn3niY-_{Z&+&$hHTp zjf8zOJu{4@PF(9>+|L@wN5Cvigxo6d21z;>%oqM%IwFQqJd2P~jkZt7X`w!v$6Y53 z^>;y{d^CHjqi+G&pOSoi^oz5r^}+c)^1UZ7MmQz<-j1F{gXee~{-;luQa)je3sj-+ ztJRR}ssTN46={EXX~gu4%P=9Ey4qjNUO5*gjD?Kn^X#2;(ecGh7g~4JNwo6^oxGzF znA%b#^$YDbF%j}ii`^15QI%?NsWBGMRUa$MwQ=OmKj`KI`+dTI;z7pLYrf<87REi9 zvwh$}l=q6_FEx)~Eb}S;3AlSc$NE#kyq=J8vQ}|GS{4ZhQ(#G5cyLXU;UBQs)(I#G z#J_nPY;TO%N?*`)<^`U&g(?R_f<2@uFnno46b?_TO~h-zg>)f*uV7~6eQ*C-)|&&=516z)Pp)Ss4~$6PXpOJ=}h=a z$8u-*wAN(rmFIN|{A9z}_hek3t#SE1 zhKcwzU}uX>d{72Oz(8;a0U3ubLxRXZCm!AhBnDR8)lYDQE|BLx>trU9-#AbgMo~~E z2NH;Vl$4!d8eQ6LwwkqM07M9Sm}YTbZA7mlfejmA#Y$*RSMotcY4Fg0Z^Ecv2)jh( zFF=}IooZGh;FTwLF0762yvTCaJ`C5G2kTbx%`C!ITIMHUM6sEmCcWM*E@q4r@KX3@ zM3rck>J(5L>zEz}Q7izjyq?ZIzxOAxa7E)Tur&Um4YHSYNdTXUVb7Tx9~hw_BZZ1e z%}QWFsQ9E#){5l|iRse~BQFV$8tEtxBhp+?~`Glyvm#C*T!h42Z~zL7x@!%iZZJE->QF+BuZWsk;qncDRN z4x2>vv<^WD5H}@n8&qyEN$p?4OlijlWU}qvRo9ar!R{A!vBC41`feu!avlGRLx3e! zPF;;~kHv8L_t-2tdohrk&?}(Zr?i2o1_hm(5*b#Z%}8p_p{(^Wl115X)M-Fwt=rA2 z8EKe{Bbc!wKmzP>w+Yb`&$c<+e=g(No})l8_^b6p);WL6!1@ji`G%O|2c0ffnd|T> z+gXX@2TnASOAg|P^Z1PaNt?I$vcd5RF>DxL8(@DLd@VRADAy|_$smfQxd4Mfmm)H$>X4LFv)z)Yn}$upM=id08t&t9Me7bM+|CRVY)0px?~HjD0VOrKgaC$;bQgfcAeq!1bt z*3e&pPCg;xOd_cYO0)Ha2}2*FRe~>1Lb)zv&bKomE1+oDNuh(rh)C#Af&|FFNhelm zQHLI^uIfgtbOC#Ub?m&_hK2NZp-fMd1`(0og4T-KNYH;Un~7|uAe85N`%oVJ!l=g7 z0yD1%JnDTm0@Gr@#F!J2&o@lTSO`57>nzL=DgR%E4fFbCvQ8G$O0zP zr8>JC`j;X^-Al-u*7}9EluG9tPSS69(bF1)10#+FESBqCTvqWoJPG~#V?9UMfI%T? z|H8ZpNPdL|5Ka3Lg^4hs#!Lu-N}$mgdA$#*d-SU0e+|8KXarb;nkc11z`Uh1Yg&H| zNGf#b^40|x90(Qf{fsLsVATNyjc$Pu zk`I}TCEw}rQIp{y=(c+Iqovd}B`=bZQ#SI}Db5g0FTzD7)Mh&C?w4gGV~p)4VI=#O z9>#28;^}aEOmW;34_OJsi3XN8e)gKqe0g#I%&T$ z6L3;eD$yE+EtL(sFD-vFz#CX70eQW@!a|j$!4L|XsZ&prkm-0Y!!bw1*>gaAON=KD z64I%orwx{zVI1;XFz<>GKBN`hAzUb#e|Q5;Rf_OmNXFQz{P`7!fL=UZvD>!Cn-YFD zr*1XMnw5_i2(RebSVaippVJ_lBx3}O8V!P)vvbUKEl2G){fjX|1}Z=97#@feIrv==aLMdyzj?S_Y<7cE-hn zoW9oLHzlFNC2X8SE=Ql`*~$C`{?j}S})7()9X7=`o8=17lC0zLi~eZ#W( zii{KSAK58|XoB#((gI+zIw=8I)6aG}GpgM_cn@h`QwB^_hzy`m70qW>eX4}~5u_bs zTTsA#nkL}2_c&cL5~#4Yu*j5uR!5)SXYOXeYBch{!|0%nwulD!19$f3S)onl>U2;a z-8o(41EZJ!KvvP67-T-q?CmtXRK@=tMp%c;g#F%Bo}pXTcSf^7fv-_$f5p!8AK7Di z&C7v&@P80tNvol1Er*S>0U!DRga8|MU^eNZz9lRWi?;6X7o|28dvD%0?xJ9C$j?i|8kf+Q1TE~$zuN`O2q0vdNtM+mZ?-w|iH z$WfDX1UL;iK4n@)yy_EQzTu3>fmoh&`r5+YqRC-{6V3*EU)qX~br&hrx{v^73NC7b z_%0|UEdlU(;b5uit%^1(88tFD5Cd|B-?;9v;X&}fg2MCrGZI5+~>M7 z1YE3m4n0@yiSG@I<4ce`mx4~(^CQ9=UoSrkLW2@)C?Gk6%Y1TexB98#@szbRl~XTp zz@T7AAdWpVaSyGJn5$|-`s<(RDz@V4#0q)vK^}CJ?MTf#=dJ(`1DVhZX>{oHi~KlFn|g zH4hdj;2gWtzNXyHI2V;8io}HR+l3rNU(s`vl2fJvXp2=(vsA zqQv!<4er~9ulqFC8GI@`G8dgIIK(gV9tk2DW3kQO200Zev-1{6)V`oJ@wYQ&rFqM# z19o^)uagb=Nnuyqw5ZJ)YYP-7q`Il&7boG)SJz$VrU9JZ7|93Q5YYGTsSn{=&b=+T z(E97*XvjF|wC@fOpL)!A5IAGLQpXyR;+J*-puXQzz=6}ENp&T!NVXlU@>(Y(=7 zWbk=b&?o)Nze2bO`nOL&mdG!4JsYvfGYHVOqJb~o`nXeF3KS-9o`r?EC{IiM&3L?Z zO2JH9DMlt~+Z-k{czDUQf<%jEOJ|9GSZ`5aY;CPkGvN9P?K7}ucBUHaBDOldR(AF> zD0R)91@Q9?UVofW#%LBV_UCWkYj3EmY!&Yp$5-c@E0%SP2E;Kzb>aZOh&EsXi|V|k zf|QDHO_6uaPj6>|GCB(p>J|$TniP>GVnX7uG(?w#KZ2^D5@X!yQ_?2wpC3D)zh~WV zr=x&bQ~b7aPbFr&XM48WXaD)mc%rYC+k}>)c>fr;S-7Z!HdB zYkl>=8zxwZCwLKTyu8^Z&DL}%<8eyw8E2tN3;>y)?`5Nm&z3{H*lB5UB)1rSLwspw zy1ypQgE#G$#I@0^og@!q#pTA^MTNGgSuZR^Ge%1NM{=RO(FjLvS*>_u!Lj>oP+#Rf z5vK^s%?t(z&hn2w?AzgGTzSACR=w{p)qB1KqKY0#nR>b4WNj;-g_gGLqJrMfE~4LF zWcWu|J|U)ABRf~NElXN+cbf24bzMPMY&}MzsBo}@U^G}WtHa~Cg;oZi>_YQ0#OJ;` zb-TtxsW8o~OlCUc|Ja|EIDR^I-ZkdZixH^>#gafk5x_%ZWp{B`fl%Wl!iJrbs1l6QDI9|{I?r#A@`9}_r-4HJE=C?vVN8qPA&s@2)^WKY1K1`HlOqO=Jl~h z7nHqr+iutaCIib=+~l>Vv7YPl_mMkgy+kFgP6iwL&uVCWl#qmU$9)sDi%v!HrUi?N ze5~m&1hKHg!o*#OiEL5+KZnZrADIr>HjyKb&b<=NB>=^*viHhiv?n$}Ysm8l+egv- zN%(BYcHaK}i0fvFgHDtfUhE_95(!lkQl)_}A9jydk6q9|BK2EQpORROK%sXI3*oWb z;Hk*HRF;)qAIwX< zOVoI|OIWB@i;V25IZBRd{u=jkFcoJ?v`1wSv4!jn&GM=Fh>+cp@F*@Rw!mZ8t^}~D$N6BlYFAk;Qsd4kM02?dqSuE zr8QoL|BE^l^H*JYkbojO0jR|$y^O!gP~Y@-F|9S6iLugdH61rIW?i)CkmV^WPkhD% z4*5{^s$GYJY|Iv*k&BhXP1vBmw~V9>bd{GMJ&4kzpZncHb*3 zD467sV+BzurqoRgBUYR#FCq$_Q%9CtKQpSgaCm7?3b%nrK z7?d4!H+1!O!289J)~-YQ1nWIXV^;&)JgO>`sj2^ z_EVVRiWLHS(2`GowwD^&oiSsDl>TWk`lC$kuTSz4MDt=ZUATYmq{#=kmrY-JsuawN zJ#Y+E;kW)Uil&{}yy1oHB0m-U^aA6Z6cD72d9iYtuu4xSUMPYY9F8=6|mas0#5%e(KO7%lvY)c`=e9+Ro~$C zD6%AZB&SH%4pu>8y?f|gzkBs!|qBYnL$vRTO!Xgj13PPlVAm5 zZ)Z1URNC8FFNiewj+(P+59H}WHlK0#mlf>loIlJI9#)@GiybF=gGX~JEKgJ*5A;Ok z9Ghj0!wr$=L#$jt3DZq5tU2*ZBh{`dqQ^gQt;>@i+9aCc5x4B`VTukWm0O)J?PM?6 zg-g{~57Nti%r_=3Hru6t^6Qv5JZM$eg@y^QZxKpiJ7VsifBNXNH|Ij!iNf*skHf^& zCu%cmqM4RyAF+it+6gKDY=uZ__D<% z{~RluW*mnbk+x{~e1ylqV6Q&oXkcn}!#=KyGo(7$JvwY3+8aA|i!WUn+UK=z#@~q2 za^&E+;zrMfm%yW$G7?R_QN41nXH1c=)B`79dYmmb1MXu?66f832n4X9X^+Vs6z!ku zgl2am?mcKaD&7mmbxHTaBAE20NuKnG;fiJU`-OQ(9>fzFW!S=P3XXs68e+9EW!zlXKH>{Zb4MeFgtVdA@;AvLwO|!MufD4TjQtVZ6k<;p=t7^S7OUsyCjPOXs@7a&H#CRrY>C`gA)&8j^n8 zNEl4z@IY~R{quagNVOScxbcJyc0j&X@=Dv_f>qNO+weBlu z?S_vmkM@8e3wjzYwH{RFv8<9ByHAXxS(6o5T*eRKNF9kf-!^G|V<7Mb7x2ZUi^q3z z1!HP#h2yq4n#rvi>?p+_z8FU%jN2thEQC@VqAh{ zTKgrsl|KX`cP&6g&RUrKP|Q>eVWOQB-^U4WrOFqb&qs}g!rAav9`lt!FE;eH9fhX_ z;0k~-+^NF9+UALx)o}#oo< zCz5^uJi*hF)57Me?Z)z7gi0)L7@Zt{^!6uwMu$_=uX@*Apqic!$tt%qU|J2YuJ&+J zO!NM21m1}A>_q#)>(v9Rl=i>Fpl&vs^jn=@y{)%;LF)Ov#o}DZ0feF~u+oXewk{{r)ZZtF3q;J}strD!w7TpF_iE z**k-EdG66o&V-@YJP`N6lRv-o-k*w1Y`j)$d}z~_{fjBOz->J*x!%S;ccN-!@t`tC zMKI_Fd%cbc>|StY2V=6SUihCY^kKm2Jb}_F#^%*H4cy*uJ_*D|i_YIJPX8h7c<+Nj zjuehrDED!G5`^E8yK8 z=5*RkG^}Qn2giFM0Z0TTp6O61=-GB42XxhLE}OCs#+aiF>R}SkEd8BYn|3>!42-1I zXpS>YRAUy~I0`eycKx07PNzwh@G03|AZ*K=ish`(hJj&;N3bwRuUn1;J}#@DKCXMo1ff3-q9&PvY?wy?#S=UChj+E0Aoe zj~Ck=)OU{+kH+Cn|DCR2a%ye$k7!)yRGu>T$sFo&!PE6UDc>NnJ!y>n?NY+Uvrf1t zz=$mrP^bwAVetfBPI*ZecAqeF}MkcBa)XP zp3de6i&+GQOUhYi_A|nMdrP$)HtoF^s#1TavD)P`d$2X&f4#ls01?yKSj6k!a1MOC zP_ymNcHN3pW-in@`;sLQC*O93?EvG?e7x%f-EqCgsS50teMANJBBTS)ei zF1wKd4`cD?6%^dLypDdNS~-peASq=LAVw9{qG|RrPL|2fnjw}FAZ&8Ok*b1BDP@6o znn{^?glm1)m)mtTiI6i3Z{2T*)r+as^~3`pq`0^KO?uuJ`~EN^$E(7=yk@SbDN`V; z^rVq6olaGj$oGY+tMN2Z3qu%UktGsvN6k6x8*q9ui7!j zxyL~voYwA9J)s0qDJ7VM(7~w60OyEB(7|&kida6bLwk7;$uRK#?^0UZV_eJr*p$9s zf?}H4m>L0U+908QR7=1Vf~CM$G$1K_(4V=WYBdK>i1RvW@orvfHzbn53#RAp9AW?K z5k15CIzA4g+Pb=gKI5nJ{bV#wa`ZmuH7mBY>l)VS^@(^gf=tPsHm$cWuA5X`iq%5a zAai>?0AS#9cAM?ojk4bStS|TBiHC2KGzFM~r4G>1eKF5k-*|`;*!Y!xF#IjEog7%h zDRQ*~33fhq$!8|eChvzbmN_4@9HX>S!Ht-y21~i&pQ>19`eJ<@a1`5lUtSURT6k-w(fRu))p%+ksdB-H>3MyxRHfk{yblrfQ|Kc^W1IQ z`l8@%XQwUkfThP1HMx++;n-6hgQjXn@Z5f3Ay+d=XYyjeV9XTjpZ7Ddpf}h^c%5#x z4iMZM{@%3z)cF^!PN@(1@%z@D;l_|VsNjmQS0kF_O#e%t&35edii5r{kme?M@Pjr7 zKWHX1Hi-J<7tj7yYj&_@%{#u6LWC-@&uvKO{f03`x{y@%UvQNdbDb}Pb9=|TK`k56 zHI&h#9rmVH*Zk7oX1^lfrxrV|bAB;;D?;>meqZB8D=Uz6?l`_W7?p9UQ3lcX+_9iS%zE!5g+2&V>p$kI*KM-w#4SQ{@B2#S@~~i(!lMHl(E<$ zwRSYIp|{kv!OkFNsn+R4AEo1lzxBNJtoIpQd<*^e`p<5Hsk ze=+g0{_WY8y{PG+1?PU{^_z|Ueb+Yc2@Phi`P{{Z2Z!u z{l&Sd!OT|sTO@)Hs+!(68GtM_$a(YTp2lhpKEw5i>-E~XdRY7K#MW*AN{Z2ShZnck z2-svMEoS7`u-_Dy%H;-*@=z?Ll>v0&QLdM#Z z$uN6i6IF94k9KndgZqdBNLi+;bP|E)fr;&a>zvY522}g=VuBHlUVFUe=6fkf=yufc zq@ofG8&ZC{^2PUFY=_XPU-z6&&Pg%Xs35Qt@}RNrAZ6!-r+@r3`3E1q|Fof@`7TLI z{X6EOI2_dL04q)4#Tjb^%a~^8lA$cPIIE*TkPxLBRiM5!60FE!0J5%+wHyxS0!^=0 zLz_?;3b^4u?}>-)=saj*TDnhbzX(WworfgTpW#_~(a&~vc*}q8$WrS(P*I!C72|@Y zG@`x>_PT2T-O91c?|E$a(XBl(Z>r9{53o1ee%YTh58=+_#9Vm>IgIn0Iy=}`&#bT1 z_TJPGO-NyA&11XegRZPgNk=lb_~!v^c`^H@xouW6TqP7LmJZrF*^%cL-=w0_+)8Q# zDAgfjhC5SS*E{I)F#Jb0#CyJFc!HrJCO7BbkQHL6?8wS?I}81;T*MfVbg&mn`Pas+Hb62Sb_?ZjK3Ni>+#XpD2cdaMBs)Wa3= zR&cq>fU9gYzDnh90jg3=1@u!4eIhRxyiuS$pw>ilB595FD{-B0bzXu zd>i#S0)K4hLX5!50lnH?fh2)8{ z9%>_)u*8ODcR}C}SzlRNBYu@!iIs~Sc#*#&Y5_B^F+WH@<>yZRUDcn(H)BOxg;y&D zpEFp?>~87d^(7?^^W!Ot0_KBwzw`%2j`2mgXIjOwh&JcUSbFq10{?U-!|z4Sd?ASA z2(GYRO*_tj0z#>CKQBJ2VyBZ9)xA*G*+TxX24pRD^)Dhj;S9I@I5z$(eM-UNNgcj2 zoSfX9wqa?ZrdDAIeQv2DBb)g-6){cwfJ0P-AQ9ouPcIxK4x@Cd6m-N1oO)@fUGWL9}sTZb& zf9mMj<~rP?u}Kl7O*1%83e25@gM)`@B1nkuD_UkPBmDTS;x*$9y%~JZGAL5uO9)(Y zgfC0=Sc|qb>4hg25W7i%k@96<7jC=6A6D?fHo6RLwgGpkq_Ea>FTusnDGJP%4ML>o z7g40y%!fuH5c4~QT1OI;{+I#EAI&tZ;tov0qGu^6+0^RJ>b-=`^5sdeEJ}j3+gS+o zbF1$53G<%N;CV|mr{?O3K?4TIc=yig-ZAN~?X z{V+i^Y8Lk|UN5@XLnB+pAfEo@A9HNT5z z)P$vD|Avwu7||Xq8h86^MH(oq6*W|Nj>GV9-o-`J)l4Tl&FsfIF20%<-gl7kHm$H( ztbaGUIn}OYkw~f*PI~*Av`=?R2^mmTd@}ZpiroaJG!=NH7ok8jTgSJQXPHgvmSE5< zp57M`KR?_&F+19##@R7%&EA99Y~CCVtQkTjqT@KPTRTMZIG(!irnQ$3G>3=Wp(76M z&{tWxSeA|P9X8xFCC9Q%tF&Cq)Id0i1T3}etefnH>SHktz+uh)ED&ihA-BzxPO5y- zDlICylUjl`32RZBZOLq7Gnvcz{VJuX_%xkT6NS?w!9^&0QtDGElWNoW-vS4b(rY4i zi9RmbZP@CXwD)dm3$*TkMv>PPn`DrqQIit-9%?K3|GJDjlChyxJ<2;rWl=5_y(z@D zXfjODTC-vwCqxccij*P2kCh)>aVIRIfQG7FGA!Yk{Fi1xI0np@i(h!1$T;j@70Ezp zt>kz|_R$!lNue&5{?4gPwoHyx3V-&RIcVv$R5cpKJyh#%o(BvCg^V4Xf_-LjaKlu0 zXB2&+=O{=k2PPHi!a*ONm5dNctg$%FM_J@(Cc&8Xob0yAYGXX4pnks7S66ip<2j(4PzJ7KOcND38?6mO%{*vyS@ z(kJ9UKh6l=U=5jT}`9EDYd@ zGzlWJ|L;v6^8fGuvkoJ-5(jLLv(4Y}`|^Rt?}e7#fJ#=P=3pzd_Hte@Sx^>U+~+~} z-fMOjBYZzFpB+kJAlzgt8YJTOvHmOoLiwDo=%BfARGTUD^f| z0Mcv7Y2Y*aVx@=2&baHVSxFxWy{qGAxh>0FJD^?OS^oSrK z4VvbDY>=qG8=)PWAw+ydM~;EzqWI;Gs6DdCpt0Gaq1gtT<8d~1Zt#xhj8K5MdU<`o zozuiN+0&<*!IW7yJ~`0EZl_#M24bXO?#W+5o!=Hks022N%iB4Abu*O4v5u| zbd$|-a|5Bn6<)&c5{aeSC(9}V$yG{dpG2OBPKEQ)`Oz9fI^ z1pCk~mNJegWr=3z?!up+_2x3x|5uOVdt`|(5kisW!tz9DT#K5RR%yKSAZt`*g777_ z4EgevvVN8>Nu_&?H`I5F4xtRT@Fb(!QaL%Ke+E7do)T@k70d8CHSkvk8Yl-;F$-)5 z4LE-Bp(INl3*!Tm*PolI)8dtF8 ziXZO-%`H6))O|Z#M$-38w{#bp4nDu80`HGTDb8x$JU%R*IBbGx82G_N^K^e;mV0;p z{P#~%V;b{fKoB1$m8kw}FM&d8C6`=8cR-$>QF_Sn!`89AjK7flZHL(_NL-UxxQqm7O1G>*bpGUXuCHerGyarde;W%YSW>q(L=>LrYrzuIjOD1UQV9WhB1Us#m2EV5|PD#fgU80FRDuD zuS$%9{IvPFNj8KCc=<9;R<@+Gn)kqrdvbxsjUU8@V(5mc+W+b8y#C?(x-d=t8;PAXRp2Y z+Ru8vOS`J2OkQKT0}Ex8aY?F)rBRB~5h8OF`Njc%9_weU@J-ZH!E!*zmsvD3)(=ik z6fxonMD9k|6h8yqGY}FGUHG?eaTe}}VBwMVo?P9seeKySJw?rFRkRIl)_U;A?W1cO z%=LF{zhGVsMgH0swi6V%H#w>WnWW;*FHb-VkOe8#Hm-IgDoM_~=@HetAJMpL9$G!$ z#g91x2J^XIK0il_^n?x4Ia@J7b+W=K zmcfQinRw$xm|wCPQER|Uvc1WsC3`O_`N|wxtCwFP2zdag-UGh3pv)bp)o}2&z#N;d z47qPekCbUX2(o!`scMC{m2GLl1&hduA5B=%s1SvIEDhIR+Ni^)Kx_5R1qLt+TI07P zS>+=@TdVybgI^S74kELijM&^U%Z>DV6cGl3b94;S6W5@qpMz&EtmF?Ip|{;`R9lYAZGZwU#mVlp%~CTlqf z)c*m!ulCBD?(Xh<_rDCrz6@3MD+B0$;bFl9`Bo2HUu|gy@Y%a3`2lA-C&(fyTr|>` zWcxsSg{3+p%H?xb)Qc%oeZKR;1V-g9WA!%9=vj5*0&Arn4(p95I6w{y_8J!iqY$Ki z#Ks-Arln+bYwZ;ttR)C7Y_g5^Bjzc_U-g-EdSXO=W(WU%%C4tE@hP?&!ql}7=~`>H z_C-NrnSRDO^J?gtXL0}1cZ&j*Jh_(kC+CF{r#A**Om1tMO4k$}n8uOo*L&52XsKnV z#>SW~jdP$i;``(%quH`X%@f_1Q@lV23U{?IIz-HVaTP2FNTI^7v{})(Dnmw5fB9>@wgO8jt7{( zhs`;0Ss;`RfAiU6_V40gGA{U#UE;qvCxD@+?YG1XZIY>hLx!bX8zMn$r6l~va1IZ= zoJXeRALh!up)oMBL&sZCib3JO^z!!P6&H?cvX|mCZqf~S$}EQGM8@8NT!&s`BhAj#^n&~k!t8iHV*L*g|f)ovo{9%9sjMb zc)wHCmoP-BR3p_Q^Qnz!fXR`a(pxfL_>(?3h2va3@r*r^p-5&Afy*H9FE_T_rUSw3b`O_;>ZBB~e~{!K?Y=dZzM>EVn0mZJST3 zGNiuJgy9ppAKRNBcf7cqB9`^og?#vC&;PT-jUa}0tOx)1JQ`1I;oq_ktpA1M>7!zT zbJt%{u!p70427kr@5wkBUu&r3-r6PTr0WxNmbC|r*z{69ZC_g_=&`o_nWilhQ%4t7 z;|1FH^byl12`x9;Bv z%e~nOQfB{cmBRdo4Q{1;+T|FkbRqj}GWv%<=leZqsU_(e1GLv?;FuC_eeYx+*T3WV}igr`qy;x=DX$bnI=jC(8(0a>3TG0SJ2B@US zgnrvhp8lqJgd7&aNPQhF#zFTn-_RHzvRu>NXSt*8Ya`#`*0DjqLqGicqp1fh%iKqT z$pfjDm+}iGKI?UsSDJvJt7fTmwwJ`Izi@Pg)_Y<=BvF(6n4y{{TZOwdx zvrB!eWm5`jG^ak#Gp)Vhx|$j%hBiCO_aI*dBfFErXw5sGKQSgXA8G8Jmog`ah!BV= zWwWMOoUwxe{NEQ`I`IMj`o~@kcxLBzUp#mUO5V$&;{yevOC@LiRlRSe!kA12?ste` ztTMaZ9(A_9yNMrsuXh}ee!RCt(rafZa)-<^D`~UaFFu56*7)sN1nvd+SX)Y>5ldo; ziu&EtLafQ7R(G?YPrsOc{*ux`8!(&=$MY3y7#ovGx-FxcJ?UzgAxSbK@}ki%>KwZE zs)3YGG7)JJ#B{4nhk;V^%UGnO=r^Zpn3|%|{_N2pev5~5Pxo^f$2viUZy5J@_f5L( zK;@3~Axx;NCpmrPbnZi>U!9{>zwqC|c{h2+(vH6*Ic@tA(jg3Ys3?|!@oxl_2M5u8 z>t(f%maT#}FZBh|VjHW_@c#lnEd4fShA<>*dOq^`aH*cSz+9yMIZH4V!@y+mJJP$D z%i&?JRk4S9^5rf9Jq4G?dI|wTs9ciBVP)ok1U?q!@jv}_j5qq)&nITrLcTJn!!*g{ zX@pJJm!fe){D`^MTdLb=^R7-24hO!OrbPzs`fr@+nHa-Iq2;2A_Bh`~qXWN?fD3u^ z!BrO-Pnn$D(1ly#aRWx}5DW%U1TA&J6{|qc);qI*c3p1j*lTf3Q^|j=}jMN zNvzjgvutuk4v7JXR?i$iM9BSZ`heU1dnEa5V}p&A6?yTqegHx)4bXcw_nuMdZigwu zbA+;vRIwyIVW{w#25`A&LYJiZ83l75i`XAPSm~@hGUWcQjG5A>n3e(GwIo|R@ z=?-Omh#Y>nc0YC08`LTZo^iSMxc>gq>&cJQh2JwhU4J*!8r&36KmbgiW}% zxpsc2T8`(|)pov`E}I#bNw|<@i7xv%J}J=gM{a~s1@jd|0s*H057GKEVKy zJ-uS|CYeI`FSk3;;~TP-OTQBk;+T4|^A>y2>qNH+LoKRF-e~vzPD%7tK26v%gfk{x zpS3U1(c*d+xGFM?sQ!;In^wt)6J<1EJFwnA+1&ymwML!0~XK55u z_gy#GyDlZE%^a~Wi$2{kd}NmQ6#QEm8)xIE;23p{hYQR3Id*p5+cIA68aHFYn{(=# z02rZJ<7G|S{msP{B+Jiro~bLh{S`ffmKEKUyjV&2UI=(a$h5w(xmR2it{M#P;9)f!k(J(5p#mFRu%$)dJ4w#4>JJHVQFSnq77A>fm5| zXO{~p3>E-{#E15l8=9yIAInm9A9i>(VDzO4fG<+&rm{b5@2*Te06rew=1~_;T|;k*f@Rz8G472ajf#vdn)ZptP6AuCbvE&!o9q`3NnV- zJ{3p0>XjEnwp1YMp@sv?`?l6cyAi{xnoJzc3=Nac1QvOu7O4D&DtvrR$ZS2`5VqkR zHc`0rn;8Oobvc(wv{fY?O_FItaj5gO%CcE#wN!YKQrMf6qQxy%#*g~jNH)f|ItQ+ZVza$$(g|Ls{@VNea-q;w6!xrMM2mk0X@ol;=XFH1jeEQX9h*rQe<{R ze+v%AJ+6Im(C8}0=xSK<*4{Zeel{L@;?1WllrD9@up%bp2D(xdwJvdYBW6Y=EjxZ`stXNR{sbgP`plkA)=Gy~mA zY&S}GVksN8Q1PanN-=Gn;Wl0Q&#U2B=;~nek2bde%eZ^IfodQ%WMwPcXQj?q3Hj%o z47eo5?^lZRh#!<92FS!eb`o2=%`Sm-UjHsa;KP6%% z`Kcl50ZY$|4wRl&snSiwh)Bfnfg?vmw#a}4r@Pl`xwHS^4>%5CZKGMPpGfSOzw6vo zPftPlza+@w?LLIW;W?O8!H$k_=9nW+pe+}$lOAcSKWg3 zDrF=^2if;mpSXH5#YFALYeQZF=i@>Vo}^ShJIoe*6bC+WG)W-pirGDK|3=F7hP}bevbY!G?bmr zBgP$_=d77VV|@}9w8QzL6}GftnRq_xh%CgP)%XP2nmO)-f<98Q-<9(~6Xb%H z+^=}!2#sYiJB&j&bgu8oQFCXY!Ve``hyn-WZmYNj>5KyK4Qwc(p;>u8okMt&9{R92 zoTLF3Z3(f++-9;_kJRbruSx>X(B54FCTp6fe}+B#6zltuX4OhA3F5r1q04lc07-j^ zo>{DgB~3nEZ{c}SN+Y@JU$*RRaG|v8%N9vJpA`KP$^=$$2tpJg7*$K)R7JYO+e`d@ zzfQwKQ^P6{F7;~f8IU;V8K7ldD?1C2pX}$?F`mYIRrxDs?)Sgl z;n2s>U0!xk8U~orr`Jw%y{=^iAAqA0)XEG&^lDqQy2E4P5Q3SAh@|qT-lfC~=-^K` z$X?wxqz9&4CF^k~w-Neb(%$nM+FmraaVouxA#E4-GT`~=OMTw{RcflT6f*=+T;*C5 z;l#}=cj~E4m@@2= z!tYXdAo={W5$_XSi}OEEud-`eWHz2l55r#!xTkcBGXBXjc6r?-GZhYtH*{U75GUO+ z9?QDDnvQ|>Cp#IoWIZi*3OC5lhQ%q5a0%2I8h*u^xjP+Ig;C83`q-HLSEJJ|UCSAH zMlV}guKlA?HEG(V$>nt*b%m5YoY?#02K&5LG5Z%^NVuYAR^9Bg7*8#N>BuL3z7YCj zvE#4-oe#K(M__2Rmdkkxxrcd`0*%*6bb?nHDI~op=LkyWlQ2%>V3>I#>rbN+{-VNH z5}6}~wlO1z*XO6f1Ww)46Lqj27^N8%Kew<|Orde8i|5-`VUt1) zFDnoq${*0{mKkI_YWg9`d7ZA}x4zf6fdfc+hGDr7TX zbEcbCZr3|grCOXvn!L+6JD&LV!6rTNPKNFU)Sz-9PbE#Hr`TQJ(Dn-&Z6Ks5B!KdV}W F{tx!nr-T3i literal 0 HcmV?d00001 From 6855bfed0ad25284f672f38956e0ac053d943f24 Mon Sep 17 00:00:00 2001 From: Karim El-Melhaoui Date: Mon, 23 Oct 2017 11:06:06 +0200 Subject: [PATCH 38/90] Update get-support-for-security-baselines.md Corrected SCT 4.0 to SCM 4.0 in Security Tools for Microsoft Products. --- .../get-support-for-security-baselines.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/device-security/get-support-for-security-baselines.md b/windows/device-security/get-support-for-security-baselines.md index e8b7351c12..3ccf8ae1ba 100644 --- a/windows/device-security/get-support-for-security-baselines.md +++ b/windows/device-security/get-support-for-security-baselines.md @@ -78,14 +78,14 @@ Windows Server 2008 R2 |[SP1](https://technet.microsoft.com/library/gg236605.asp | Name | Details | Security Tools | |---|---|---| -Internet Explorer 11 | [SecGuide](https://blogs.technet.microsoft.com/secguide/2014/08/13/security-baselines-for-windows-8-1-windows-server-2012-r2-and-internet-explorer-11-final/)|[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319)|[SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx)| -|Internet Explorer 10|[Technet](https://technet.microsoft.com/library/jj898540.aspx)|[SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) | -|Internet Explorer 9|[Technet](https://technet.microsoft.com/library/hh539027.aspx)|[SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) -|Internet Explorer 8|[Technet](https://technet.microsoft.com/library/ee712766.aspx)|[SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) -|Exchange Server 2010|[Technet](https://technet.microsoft.com/library/hh913521.aspx)| [SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) -|Exchange Server 2007|[Technet](https://technet.microsoft.com/library/hh913520.aspx)| [SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) -|Microsoft Office 2010|[Technet](https://technet.microsoft.com/library/gg288965.aspx)| [SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) -|Microsoft Office 2007 SP2|[Technet](https://technet.microsoft.com/library/cc500475.aspx)| [SCT 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) +Internet Explorer 11 | [SecGuide](https://blogs.technet.microsoft.com/secguide/2014/08/13/security-baselines-for-windows-8-1-windows-server-2012-r2-and-internet-explorer-11-final/)|[SCT 1.0](https://www.microsoft.com/download/details.aspx?id=55319)|[SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx)| +|Internet Explorer 10|[Technet](https://technet.microsoft.com/library/jj898540.aspx)|[SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) | +|Internet Explorer 9|[Technet](https://technet.microsoft.com/library/hh539027.aspx)|[SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) +|Internet Explorer 8|[Technet](https://technet.microsoft.com/library/ee712766.aspx)|[SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) +|Exchange Server 2010|[Technet](https://technet.microsoft.com/library/hh913521.aspx)| [SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) +|Exchange Server 2007|[Technet](https://technet.microsoft.com/library/hh913520.aspx)| [SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) +|Microsoft Office 2010|[Technet](https://technet.microsoft.com/library/gg288965.aspx)| [SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx) +|Microsoft Office 2007 SP2|[Technet](https://technet.microsoft.com/library/cc500475.aspx)| [SCM 4.0](https://technet.microsoft.com/solutionaccelerators/cc835245.aspx)
From 72d12bb34c4fd6329e8564e5f6b2970c46c94241 Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Mon, 23 Oct 2017 15:09:00 +0000 Subject: [PATCH 39/90] Merged PR 4000: Fixed typo Fixed typo --- .../windows-defender-application-guard/wd-app-guard-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md b/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md index df00907959..42ace9f60f 100644 --- a/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md +++ b/windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md @@ -13,7 +13,7 @@ ms.date: 08/11/2017 # Windows Defender Application Guard overview **Applies to:** -- Windows 10 Enterpise edition, version 1709 +- Windows 10 Enterprise edition, version 1709 The threat landscape is continually evolving. While hackers are busy developing new techniques to breach enterprise networks by compromising workstations, phishing schemes remain one of the top ways to lure employees into social engineering attacks. From 61d1172c6e9d68ea3b0285d1d2b07bf78b0e4c8e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 23 Oct 2017 11:11:48 -0700 Subject: [PATCH 40/90] typo --- ...m-integration-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md index 3e23f243aa..6947c9cd8a 100644 --- a/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md @@ -53,7 +53,7 @@ Enable security information and event management (SIEM) integration so you can p 5. Select **Generate tokens** to get an access and refresh token. > [!NOTE] - > You'll need to generate new Access token every 90 days. + > You'll need to generate a new Access token every 90 days. You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from the Windows Defender ATP portal. From 6154000187ecded14a6ff2f209aae24ff689e404 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 23 Oct 2017 11:26:18 -0700 Subject: [PATCH 41/90] update topic name --- windows/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/TOC.md b/windows/threat-protection/TOC.md index 84c4ef2208..ce3a47ceb7 100644 --- a/windows/threat-protection/TOC.md +++ b/windows/threat-protection/TOC.md @@ -18,7 +18,7 @@ ## [Windows Defender Advanced Threat Protection](windows-defender-atp\windows-defender-advanced-threat-protection.md) ### [Minimum requirements](windows-defender-atp\minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](windows-defender-atp\licensing-windows-defender-advanced-threat-protection.md) -#### [Troubleshoot onboarding and error messages](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) +#### [Troubleshoot subscription and portal access issues](windows-defender-atp\troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) ### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md) ### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) ### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) From b035b428d40676739d91ee0de3537a1136aca6ff Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 23 Oct 2017 12:08:28 -0700 Subject: [PATCH 42/90] update product name --- ...s-queue-windows-defender-advanced-threat-protection.md | 2 +- ...ibility-windows-defender-advanced-threat-protection.md | 4 ++-- ...sensors-windows-defender-advanced-threat-protection.md | 4 ++-- ...verview-windows-defender-advanced-threat-protection.md | 2 +- ...rements-windows-defender-advanced-threat-protection.md | 6 +++--- ...oarding-windows-defender-advanced-threat-protection.md | 8 ++++---- ...leshoot-windows-defender-advanced-threat-protection.md | 2 +- .../windows-defender-advanced-threat-protection.md | 2 +- 8 files changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md index 7fe267a6c1..a4b8d93002 100644 --- a/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md @@ -78,7 +78,7 @@ Reviewing the various alerts and their severity can help you decide on the appro - Others >[!NOTE] ->The Windows Defender Antivirus filter will only appear if your endpoints are using Windows Defender as the default real-time protection antimalware product. +>The Windows Defender Antivirus filter will only appear if your endpoints are using Windows Defender Antivirus as the default real-time protection antimalware product. **View**
- **Flat view** - Lists alerts individually with alerts having the latest activity displayed at the top. diff --git a/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md index e35be7bc63..38cb6ddf0f 100644 --- a/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md @@ -1,5 +1,5 @@ --- -title: Windows Defender compatibility +title: Windows Defender Antivirus compatibility description: Learn about how Windows Defender works with Windows Defender ATP and how it functions when a third-party antimalware client is used. keywords: windows defender compatibility, defender, windows defender atp search.product: eADQiWindows 10XVcnh @@ -13,7 +13,7 @@ ms.localizationpriority: high ms.date: 10/17/2017 --- -# Windows Defender compatibility +# Windows Defender Antivirus compatibility **Applies to:** diff --git a/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md index 2637d2528e..6a26c03dca 100644 --- a/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md @@ -75,8 +75,8 @@ Follow theses actions to correct known issues related to a misconfigured machine - [Ensure the telemetry and diagnostics service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-telemetry-and-diagnostics-service-is-enabled)
If the endpoints aren't reporting correctly, you might need to check that the Windows 10 telemetry and diagnostics service is set to automatically start and is running on the endpoint. -- [Ensure that Windows Defender is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-is-not-disabled-by-a-policy)
-If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Early Launch Antimalware (ELAM) driver to be enabled. +- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)
+If your endpoints are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled. If you took corrective actions and the machine status is still misconfigured, [open a support ticket](http://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409). diff --git a/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md index 68e00fed1d..677abeba7e 100644 --- a/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md @@ -112,7 +112,7 @@ You can sort the **Machines list** by the following columns: - **Active malware alerts** - Number of active malware detections reported by the machine > [!NOTE] -> The **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) as the active real-time protection antimalware product. +> The **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender Antivirus](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) as the active real-time protection antimalware product. ## Related topics diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index e389fe6cf4..8c0ade88d7 100644 --- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -127,9 +127,9 @@ When Windows Defender Antivirus is not the active antimalware in your organizati For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). -## Windows Defender Early Launch Antimalware (ELAM) driver is enabled -If you're running Windows Defender as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard. +## Windows Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled +If you're running Windows Defender Antivirus as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard. -If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender ELAM driver is enabled. For more information, see [Ensure that Windows Defender is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-is-not-disabled-by-a-policy). +If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy). >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=technet-wd-atp-minreq-belowfoldlink1) diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 6cadefb400..286271b278 100644 --- a/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -69,7 +69,7 @@ Event ID | Error Type | Resolution steps 5 | Offboarding data was found but couldn't be deleted | Check the permissions on the registry, specifically ```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection```. 10 | Onboarding data couldn't be written to registry | Check the permissions on the registry, specifically
```HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat```.
Verify that the script was ran as an administrator. 15 | Failed to start SENSE service |Check the service health (```sc query sense``` command). Make sure it's not in an intermediate state (*'Pending_Stopped'*, *'Pending_Running'*) and try to run the script again (with administrator rights).

If the endpoint is running Windows 10, version 1607 and running the command `sc query sense` returns `START_PENDING`, reboot the machine. If rebooting the machine doesn't address the issue, upgrade to KB4015217 and try onboarding again. -15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender ELAM driver, see [Ensure that Windows Defender is not disabled by a policy](#ensure-that-windows-defender-is-not-disabled-by-a-policy) for instructions. +15 | Failed to start SENSE service | If the message of the error is: System error 577 has occurred. You need to enable the Windows Defender Antivirus ELAM driver, see [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) for instructions. 30 | The script failed to wait for the service to start running | The service could have taken more time to start or has encountered errors while trying to start. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). 35 | The script failed to find needed onboarding status registry value | When the SENSE service starts for the first time, it writes onboarding status to the registry location
```HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status```.
The script failed to find it after several seconds. You can manually test it and check if it's there. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). 40 | SENSE service onboarding status is not set to **1** | The SENSE service has failed to onboard properly. For more information on events and errors related to SENSE, see [Review events and errors on endpoints with Event viewer](event-error-codes-windows-defender-advanced-threat-protection.md). @@ -129,7 +129,7 @@ If the deployment tools used does not indicate an error in the onboarding proces - [Ensure the telemetry and diagnostics service is enabled](#ensure-the-telemetry-and-diagnostics-service-is-enabled) - [Ensure the service is set to start](#ensure-the-service-is-set-to-start) - [Ensure the endpoint has an Internet connection](#ensure-the-endpoint-has-an-internet-connection) -- [Ensure that Windows Defender is not disabled by a policy](#ensure-that-windows-defender-is-not-disabled-by-a-policy) +- [Ensure that Windows Defender Antivirus is not disabled by a policy](#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy) ### View agent onboarding errors in the endpoint event log @@ -240,7 +240,7 @@ To ensure that sensor has service connectivity, follow the steps described in th If the verification fails and your environment is using a proxy to connect to the Internet, then follow the steps described in [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) topic. -### Ensure that Windows Defender is not disabled by a policy +### Ensure that Windows Defender Antivirus is not disabled by a policy **Problem**: The Windows Defender ATP service does not start after onboarding. **Symptom**: Onboarding successfully completes, but you see error 577 when trying to start the service. @@ -263,7 +263,7 @@ If the verification fails and your environment is using a proxy to connect to th 1. Open the registry ```key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender```. 2. Ensure that the value ```DisableAntiSpyware``` is not present. - ![Image of registry key for Windows Defender](images/atp-disableantispyware-regkey.png) + ![Image of registry key for Windows Defender Antivirus](images/atp-disableantispyware-regkey.png) ## Licensing requirements Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers: diff --git a/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md index b2616e4e94..61b855dcd8 100644 --- a/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md @@ -48,7 +48,7 @@ See the topic [Review events and errors on endpoints with Event Viewer](event-er If onboarding endpoints successfully completes but Windows Defender ATP does not start after a reboot and shows error 577, check that Windows Defender is not disabled by a policy. -For more information, see [Ensure that Windows Defender is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-is-not-disabled-by-a-policy). +For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy). #### Known issues with regional formats diff --git a/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index 18063807da..ec8c9e2244 100644 --- a/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -66,7 +66,7 @@ breach. You can submit files for deep analysis and receive the results without leaving the [Windows Defender ATP portal](https://securitycenter.windows.com). Windows Defender ATP works with existing Windows security technologies -on endpoints, such as Windows Defender, AppLocker, and Device Guard. It +on endpoints, such as Windows Defender Antivirus, AppLocker, and Windows Defender Device Guard. It can also work side-by-side with third-party security solutions and antimalware products. From a0add6bdf57979d921125553c9ac67a5d87cd3c6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 23 Oct 2017 14:05:23 -0700 Subject: [PATCH 43/90] features in preview --- ...ed-apis-windows-defender-advanced-threat-protection.md | 2 ++ ...reports-windows-defender-advanced-threat-protection.md | 2 +- ...preview-windows-defender-advanced-threat-protection.md | 8 +++++++- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md index 8ee8c7f559..50e19938e1 100644 --- a/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md @@ -23,6 +23,8 @@ ms.date: 10/17/2017 - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) +[!include[Prerelease information](prerelease.md)] + >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs that are part of the Microsoft Intelligence Security Graph. Those APIs will enable you to automate workflows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code). diff --git a/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md index f025daa7f6..6a11d162cc 100644 --- a/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md @@ -21,7 +21,7 @@ ms.date: 10/17/2017 - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) - +[!include[Prerelease information](prerelease.md)] >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-powerbireports-abovefoldlink) diff --git a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index c727d8143d..a9f61d94fe 100644 --- a/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -42,7 +42,13 @@ Turn on the preview experience setting to be among the first to try upcoming fea 2. Toggle the setting between **On** and **Off** and select **Save preferences**. ## Preview features -There are currently no preview features. +The following features are included in the preview release: + +- [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
+Windows Defender ATP supports the use of Power BI data connectors to enable you to connect and access Windows Defender ATP data using Microsoft Graph. + +- [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)
+ Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs that are part of the Microsoft Intelligence Security Graph. Those APIs will enable you, to automate workflows and innovate based on Windows Defender ATP capabilities. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink) From 885bdf03a0860b1b1ae6c27bf09206c00468b964 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 23 Oct 2017 15:09:41 -0700 Subject: [PATCH 44/90] Final fixes before going to staging --- .../hello-for-business/hello-features.md | 146 +++++++++++++++--- .../hello-identity-verification.md | 9 ++ .../hello-why-pin-is-better-than-password.md | 27 ---- .../hello-for-business/toc.md | 2 + 4 files changed, 132 insertions(+), 52 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-features.md b/windows/access-protection/hello-for-business/hello-features.md index c8e500f815..2e4ae4c446 100644 --- a/windows/access-protection/hello-for-business/hello-features.md +++ b/windows/access-protection/hello-for-business/hello-features.md @@ -2,7 +2,7 @@ title: Windows Hello for Business Features description: Windows Hello for Business Features ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E -keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, PIN Reset, Dynamic Lock, Multifactor Unlock +keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, PIN Reset, Dynamic Lock, Multifactor Unlock, Forgot PIN, Privileged Workstation ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -19,6 +19,7 @@ Consider these additional features you can use after your organization deploys W * [Conditional access](#conditional-access) * [Dynamic lock](#dynamic-lock) * [PIN reset](#PIN-reset) +* [Privileged workstation](#Priveleged-workstation) * [Mulitfactor Unlock](#Multifactor-unlock) @@ -50,27 +51,27 @@ The Group Policy Editor, when the policy is enabled, creates a default signal ru >[!IMPORTANT] >Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. ->``` -> -> -> ->``` +``` + + + +``` For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** attribute defaults Phones and uses the values from the following table -|:Description:|:Value:| -|-------------|-------| -|:Miscellaneous|:0:| -|:Computer|:256:| -|:Phone|:512:| -|:LAN/Network Access Point|:768:| -|:Audio/Video|:1024:| -|:Peripheral|:1280| -|:Imaging|:1536:| -|:Wearable|:1792:| -|:Toy|:2048:| -|:Health|:2304:| -|:Uncategorized|:7936:| +|Description|Value| +|:-------------|:-------:| +|Miscellaneous|0| +|Computer|256| +|Phone|512| +|LAN/Network Access Point|768| +|Audio/Video|1024| +|Peripheral|1280| +|Imaging|1536| +|Wearable|1792| +|Toy|2048| +|Health|2304| +|Uncategorized|7936| The **rssiMin** attribute value signal strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. @@ -78,6 +79,8 @@ RSSI measurements are relative and lower as the bluetooth signals between the tw ## PIN reset +### Hybrid Deployments + **Requirements:** * Azure Active Directory * Hybrid Windows Hello for Business deployment @@ -85,13 +88,13 @@ RSSI measurements are relative and lower as the bluetooth signals between the tw * Remote reset - Windows 10, version 1703 * Reset above Lock - Windows 10, version 1709 -The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables you to remotely push a PIN reset or enables users to reset their forgotten PIN above the lock screen. +The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables you to remotely push a PIN reset or enables users to reset their forgotten PIN above the lock screen without requiring reenrollment. -## Onboarding the Microsoft PIN reset service to your Intune tenant +#### Onboarding the Microsoft PIN reset service to your Intune tenant Before you can remotely reset PINs, you must onboard the Microsoft PIN reset service to your Intune or MDM tenant, and configure devices you manage. Follow these instructions to get that set up: -### Connect Intune with the PIN reset service +#### Connect Intune with the PIN reset service 1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Intune tenant. 2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
@@ -100,7 +103,7 @@ Before you can remotely reset PINs, you must onboard the Microsoft PIN reset ser ![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png) 4. Log in to [this website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent) using your Intune tenant admin credentials and, again, choose **Accept** to give consent for the service to access your account. -### Configure Windows devices to use PIN reset +#### Configure Windows devices to use PIN reset To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/en-us/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): @@ -112,12 +115,54 @@ Set the value for this CSP to **True**. Read the [Steps to reset the passcode](https://docs.microsoft.com/en-us/intune/device-windows-pin-reset#steps-to-reset-the-passcode) section to removely reset a PIN on an Intune managed device. +### On-premises Deployments + +** Requirements** +* Active Directory +* On-premises Windows Hello for Business deployment +* Reset from settings - Windows 10, version 1703 +* Reset above Lock - Windows 10, version 1709 + +On-premises deployments provide users with the ability to reset forgotton PINs either through the settings page or from above the user's lock screen. Users must know or be provider their password for authentication, must perform a second factor of authentication, and then reprovision Windows Hello for Business. + +>[!IMPORTANT] +>Users must have corporate network connectivity to domain controllers and the AD FS server to reset their PINs. + +#### Reset PIN from Settings +1. Sign-in to Windows 10, version 1703 or later using an alternate credential. +2. Open **Settings**, click **Accounts**, click **Sign-in options**. +3. Under **PIN**, click **I forgot my PIN** and follow the instructions. + +#### Reset PIN above the Lock Screen + 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in + 2. Enter your password and press enter. + 3. Follow the instructions provided by the provisioning process + 4. When finished, unlock your desktop using your newly creeated PIN. + +>[!NOTE] +> Visit the [Frequently Asked Questions](https://docs.microsoft.com/en-us/windows/access-protection/hello-for-business/hello-identity-verification#frequently-asked-questions) section of the Windows Hello for Business page and watch the **What happens when the user forgets their PIN?** video. + +## Privileged Workstation + +**Requirements** +* Hybrid and On-premises Windows Hello for Business deployments +* Domain Joined or Hybird Azure joined devices +* Windows 10, version 1709 + +The privileged workstation scenario enables administrators to perform elevated, admistrative funcions by enrolling both their non-privileged and privileged credentials on their device. + +By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, Allow enumeration of emulated smartd card for all users, you can configure a device to all this enumeration on selected devices. + +With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal workflow such as email, but can launch Microsoft Managment Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternativing between privileged and non-privileged workloads. + ## Multifactor Unlock **Requirements:** * Windows Hello for Business deployment (Hybrid or On-premises) -* Hybird Azure AD joined or Domain Joined (on-premises deploymentd) +* Hybird Azure AD joined (Hybrid deployments) +* Domain Joined (on-premises deployments) * Windows 10, version 1709 +* Bluetooth, Bluetooth capable smartphone - optional Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. @@ -130,4 +175,55 @@ Which organizations can take advanage of Multifactor unlock? Those who: * Want to retain the familiar Windows logon UX and not settle for a custom solution. >[!IMPORTANT] ->Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). \ No newline at end of file +>Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). + +You enable multifactor unlock using Group Policy. The **Configure device unlock factors** policy setting is located under **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. + +The policy setting has three components: +* First unlock factor credential provider +* Second unlock factor credential provider +* Signal rules for device unlock + +### The Basics: How it works + +First unlock factor credential provider and Second unlock credential provider are repsonsible for the bulk of the configuration. Each of these components contains a globally unqiue identifier (GUID) that represents a different Windows credential provider. With the policy setting enabled, users unlock the device using at least one credenital provider from each category before Windows allows the user to proceed to their desktop. + +The credenital providers included in the default policy settings are: + +|Credential Provider| GUID| +|:------------------|:----:| +|PIN | \{D6886603-9D2F-4EB2-B667-1971041FA96B}| +|Fingerprint | \{BEC09223-B018-416D-A0AC-523971B639F5}| +|Facial Recognition | \{8AF662BF-65A0-4D0A-A540-A338A999D36F}| +|Trusted Signal | \{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}| + +The default credential providers for the **First unlock factor credential provider** include: +* PIN +* Fingerprint +* Facial Recongition + +The default credential providers for the **Second unlock factor credential provider** include: +* Trusted Signal +* PIN + +The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. + +The default signal rules for the policy setting include the proximity of any paired bluetooth smartphone. + +To successfully reach their desktop, the user must satisfy one credential provider from each category. The order in which the user satisfies each credential provider does not matter. Therefore, using the default policy setting a user can provide: +* PIN and Fingerprint +* PIN and Facial Recognition +* Fingerprint and PIN +* Facial Recognition and Trusted Signal (bluetooth paired smartphone) + +>[!IMPORTANT] +> * PIN **must** be in at least one of the groups +> * Trusted signals **must** be combined with another credential provider +> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can be used to satisfy either category, but not both. + + + + + + + diff --git a/windows/access-protection/hello-for-business/hello-identity-verification.md b/windows/access-protection/hello-for-business/hello-identity-verification.md index 7e3e2523b8..dbe821c879 100644 --- a/windows/access-protection/hello-for-business/hello-identity-verification.md +++ b/windows/access-protection/hello-for-business/hello-identity-verification.md @@ -71,6 +71,12 @@ The table shows the minimum requirements for each deployment. ## Frequently Asked Questions +### What is the password-less strategy? + +Watch Senior Program Manager Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less** + +> [!VIDEO https://www.youtube.com/embed/mXJS615IGLM] + ### What is the user experience for Windows Hello for Business? The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. @@ -80,6 +86,9 @@ The user experience for Windows Hello for Business occurs after user sign-in, af > [!VIDEO https://www.youtube.com/embed/etXJsZb8Fso] + + + ### What happens when my user forgets their PIN? If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with the Fall Creators Update, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. diff --git a/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 345d436c6b..45ff52e819 100644 --- a/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -66,33 +66,6 @@ You can provide additional protection for laptops that don't have TPM by enablin 2. Set the number of invalid logon attempts to allow, and then click OK. - -## What if I forget my PIN? - -Starting with Windows 10, version 1703, devices managed by [Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune), are be able to reset a forgotten PIN without deleting company managed data or apps. - -### Reset forgotten PIN on Windows Phone - -To reset a forgotten pin on a Windows Phone, you will need to locate the device in the Intune portal. Once you've selected the device, click on **More > New passcode** to generate a new PIN. - -![Intune reset PIN drop-down menu](images/whfb-intune-reset-pin.jpg) - -Once you've done that, the device will receive a notification to unlock the device and you will have to provide them with the generated PIN in order to unlock the device. With the device unlocked, they user can now reset the PIN. - -![Phone unlock notification](images/whfb-pin-reset-phone-notification.png) - -### Reset forgotten PIN on desktop - -Users can reset a forgotten PIN from any Intune managed desktop device. They will need to unlock the device by other means (Password \ Smart Card \ Biometric). - -Once the device is unlocked, go to **Settings > Accounts > Sign-in options** and under **PIN** select **I forgot my PIN**. - -![Forgot my PIN in settings](images/whfb-reset-pin-settings.jpg) - -After signing-in, you will be prompted to change your PIN. - -![Reset PIN prompt](images/whfb-reset-pin-prompt.jpg) - ## Why do you need a PIN to use biometrics? Windows Hello enables biometric sign-in for Windows 10: fingerprint, iris, or facial recognition. When you set up Windows Hello, you're asked to create a PIN first. This PIN enables you to sign in using the PIN when you can’t use your preferred biometric because of an injury or because the sensor is unavailable or not working properly. diff --git a/windows/access-protection/hello-for-business/toc.md b/windows/access-protection/hello-for-business/toc.md index 66af9ca614..5a8d5dd5c3 100644 --- a/windows/access-protection/hello-for-business/toc.md +++ b/windows/access-protection/hello-for-business/toc.md @@ -42,3 +42,5 @@ #### [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) ##### [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md) #### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) + +## [Windows Hello for Businesss Feature](hello-features.md) \ No newline at end of file From 16ad3d32a0372f5ae9798404de1265f970054db7 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 23 Oct 2017 17:07:33 -0700 Subject: [PATCH 45/90] minor edits --- .../hello-for-business/hello-deployment-key-trust.md | 6 +++--- .../hello-hybrid-cert-whfb-settings-ad.md | 7 +------ .../hello-hybrid-cert-whfb-settings-adfs.md | 6 ------ .../hello-hybrid-cert-whfb-settings-dir-sync.md | 7 +------ .../hello-hybrid-cert-whfb-settings-pki.md | 5 ----- .../hello-hybrid-cert-whfb-settings-policy.md | 7 +------ .../hello-for-business/hello-hybrid-cert-whfb-settings.md | 4 ---- .../hello-hybrid-key-whfb-settings-ad.md | 4 ---- .../hello-hybrid-key-whfb-settings-dir-sync.md | 4 ---- .../hello-hybrid-key-whfb-settings-pki.md | 4 ---- .../hello-hybrid-key-whfb-settings-policy.md | 6 +----- .../hello-for-business/hello-hybrid-key-whfb-settings.md | 4 ---- .../hello-key-trust-validate-ad-prereq.md | 4 +--- 13 files changed, 8 insertions(+), 60 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-deployment-key-trust.md b/windows/access-protection/hello-for-business/hello-deployment-key-trust.md index 2d64b3973b..d924194aa8 100644 --- a/windows/access-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/access-protection/hello-for-business/hello-deployment-key-trust.md @@ -1,5 +1,5 @@ --- -title: Windows Hello for Business Deployment Guide - On Premises Certificate Key Deployment +title: Windows Hello for Business Deployment Guide - On Premises Key Deployment description: A guide to an On Premises, Certificate trust Windows Hello for Business deployment keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 @@ -11,7 +11,7 @@ ms.author: mstephen localizationpriority: high ms.date: 10/08/2017 --- -# On Premises Certificate Trust Deployment +# On Premises Key Trust Deployment **Applies to** - Windows 10 @@ -20,7 +20,7 @@ ms.date: 10/08/2017 Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in an existing environment. -Below, you can find all the infromation you will need to deploy Windows Hello for Business in a Certificate Key Model in your on-premises environment: +Below, you can find all the infromation you need to deploy Windows Hello for Business in a key trust model in your on-premises environment: 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index 27eba8dd44..981d5feaae 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -16,15 +16,10 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 ->[!div class="step-by-step"] -[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) -[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. ->[!IMPORTANT] ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. - ### Creating Security Groups Windows Hello for Business uses several security groups to simplify the deployment and managment. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index e68276a09e..54223b71a4 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -18,14 +18,8 @@ ms.date: 09/08/2017 ## Federation Services ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. ->[!div class="step-by-step"] -[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) -[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) - - The Windows Server 2016 Active Directory Fedeartion Server Certificate Registration Authority (AD FS RA) enrolls for an enrollment agent certificate. Once the registration authority verifies the certificate request, it signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 36c163ea27..38c71a7599 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -16,15 +16,10 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 ->[!div class="step-by-step"] -[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. ## Directory Synchronization ->[!IMPORTANT] ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. - In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 27ea8e8a47..d7f825257f 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -17,11 +17,6 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 -> [!div class="step-by-step"] -[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) -[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) - ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certifcates to validate the name of the server to which they are connecting and to encyrpt the data that flows them and the client computer. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 2c0b6759f9..ac4c7d3339 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -16,15 +16,10 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 -> [!div class="step-by-step"] -[< Configure AD FS](hello-hybrid-cert-whfb-settings-adfs.md) - +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. ## Policy Configuration ->[!IMPORTANT] ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. - You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 2dbfc5fda4..cc34481466 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -16,10 +16,6 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 -> [!div class="step-by-step"] -[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) - ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. You're environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 901edef2af..4a4a25924e 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -16,10 +16,6 @@ ms.date: 10/20/2017 **Applies to** - Windows 10 ->[!div class="step-by-step"] -[< Configure Windows Hello for Business](hello-hybrid-key-whfb-settings.md) -[Configure Azure AD Connect >](hello-hybrid-key-whfb-settings-dir-sync.md) - >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 69700ebc4b..7518007d20 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -16,10 +16,6 @@ ms.date: 10/20/2017 **Applies to** - Windows 10 ->[!div class="step-by-step"] -[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) - >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. ## Directory Syncrhonization diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index cb21c9a8f5..3d9691dd88 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -17,10 +17,6 @@ ms.date: 10/20/2017 **Applies to** - Windows 10 -> [!div class="step-by-step"] -[< Configure Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) -[Configure policy settings >](hello-hybrid-key-whfb-settings-policy.md) - >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certifcates to validate the name of the server to which they are connecting and to encyrpt the data that flows them and the client computer. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index bd47b15b29..75e5789a7e 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -16,14 +16,10 @@ ms.date: 10/20/2017 **Applies to** - Windows 10 -> [!div class="step-by-step"] -[< Configure PKI ](hello-hybrid-key-whfb-settings-pki.md) +>This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. ## Policy Configuration ->[!IMPORTANT] ->This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. - You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 38de12b175..591af4f0c8 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -16,10 +16,6 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 -> [!div class="step-by-step"] -[Configure Active Directory >](hello-hybrid-key-whfb-settings-ad.md) - ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. You are ready to configure your hybrid key trust environment for Windows Hello for Business. diff --git a/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 2b2c06183a..540da3aa71 100644 --- a/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -22,13 +22,11 @@ Key trust deployments need an adequate number of 2016 domain controllers to ensu The key registration process for the On-prem deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. -Ensure each site where you plan to deploy key trust Windows Hello for Business has an adequate number of Windows Server 2016 domain controllers/ - ## Create the Windows Hello for Business Users Security Global Group The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business. -Sign-in a domain controller or management workstation with Domain Admin equivalent credentials. +Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. 1. Open **Active Directory Users and Computers**. 2. Click **View** and click **Advanced Features**. From a84f120f16e9348687d14f6e17313ae76c8d93ec Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Tue, 24 Oct 2017 00:54:29 +0000 Subject: [PATCH 46/90] Merged PR 4022: small fixes to WIP for Biz --- .../waas-windows-insider-for-business-faq.md | 209 +++---- .../waas-windows-insider-for-business.md | 577 +++++++++--------- 2 files changed, 397 insertions(+), 389 deletions(-) diff --git a/windows/deployment/update/waas-windows-insider-for-business-faq.md b/windows/deployment/update/waas-windows-insider-for-business-faq.md index 499a40f62a..169e3ed2eb 100644 --- a/windows/deployment/update/waas-windows-insider-for-business-faq.md +++ b/windows/deployment/update/waas-windows-insider-for-business-faq.md @@ -1,105 +1,106 @@ ---- -title: Windows Insider Program for Business Frequently Asked Questions -description: Frequently Asked Questions and answers about the Windows Insider Program -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: DaniHalfin -ms.localizationpriority: high -ms.author: daniha ---- - -# Windows Insider Program for Business Frequently Asked Questions - - -**Applies to** - -- Windows 10 - -> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -### Are the Windows Insider Program and Windows Insider Program for Business separate programs? -No, in fact just the opposite. The Windows Insider Program was created in 2014 to help Microsoft engage with Windows Fans worldwide. Windows Insiders are the first to be able to try new Windows features that we introduce through Windows 10 Insider Preview Builds. At the same time, they can provide feedback through the Feedback Hub App which helps create even better versions of Windows for all users. The Windows Insider Program for Business enables you to incorporate Insider Preview builds into your deployment plans using your corporate credentials, deepen connections with the IT Pro community, collect feedback within your organization, and increase the visibility of your organization’s feedback – especially on features that support productivity and business needs. Together we can resolve blocking or critical issues to better support your organization’s needs sooner. Incorporating the Windows Insider Program for Business into your deployment plans enables you to prepare your organization for the next update of Windows 10, to deploy new services and tools more quickly, to help secure your applications, and to increase productivity and confidence in the stability of your environment. Windows Insider Program for Business participants collaborate with the Windows team to build and document features, infuse innovation, and plan for what’s around the bend. We’ve architected some great features together, received amazing feedback, and we’re not done. - -### What Languages are available? -Insider Preview builds are available in the following languages: English (United States), English (United Kingdom), Chinese (Simplified), Chinese (Traditional), Portuguese (Brazilian), Japanese, Russian, German, French, French (Canada), Korean, Italian, Spanish, Spanish (Latin America), Swedish, Finnish, Turkish, Arabic, Dutch, Czech, Polish, Thai, Catalan, Hindi, and Vietnamese. - -If your Windows build is not in one of the available base languages, you will not receive Insider Preview builds. - -Hindi, Catalan, and Vietnamese can only be installed as a language pack over [supported base languages](https://support.microsoft.com/help/14236/language-packs). - ->[!NOTE] -> To learn how to install a language pack, see [How to add an input language to your PC Additional](https://support.microsoft.com/instantanswers/60f32ff8-8697-4452-af7d-647439c38433/how-to-add-and-switch-input-languages-on-your-pc). - -### How do I register for the Windows Insider Program for Business? -To register for the Windows Insider Program for Business, follow the steps below using your corporate account in Azure Active Directory (AAD). This account is the same account that you use for Office 365 and other Microsoft services. - -1. Visit https://insider.windows.com and click **Get Started**. -2. Sign-in with your corporate account in AAD (username/password) and follow the on-screen registration directions. -3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds. Go to **Settings > Updates & Security > Windows Insider Program**. Click **Get Started**, enter your corporate credentials that you used to register, then follow the on-screen directions. - ->[!NOTE] ->Make sure that you have administrator rights to your machine and that it has latest Windows updates. - -### Are there any management capabilities that allow an IT admin to manage settings for a corporate environment? -Yes. Starting with Windows 10, version 1709, the Windows Insider Program for Business now enables administrators to apply the following group policies to help them manage their organization’s preview builds: - -**Manage preview builds:** Administrators can enable or prevent builds from installing on a device. You also have an option to disable preview builds once the release is public. -**Branch Readiness Level:** Administrators can set the Windows readiness level, including Fast, Slow, Release Preview Rings of Windows Insider Preview) and allows administrators to defer or pause delivery of updates. - -See more information on the [Getting started with Windows Insider Program for Business](waas-windows-insider-for-business.md#getting-started-with-windows-insider-program-for-business) section. - -### How can I find out if my corporate account is on Azure Active Directory? -On your PC, go to **Settings > Accounts > Access work or school**. If your organization has set up your corporate account in Azure Active Directory and it is connected to your PC, you will see the account listed as highlighted in the image below. - -![Device connected to Work Account](images/waas-wipfb-work-account.jpg) - -### I have more than one Azure Active Directory account. Which should I use? -Register for Windows Insider Program for Business with the same active account that you use to access your corporate email in Office 365 and other Microsoft services. To ensure you get the most benefit out of the Windows Insider Program for Business and that your company is fully represented, do not set up a separate tenant for testing activities. There will be no modifications to the AAD tenant to support Windows Insider Program for Business, and it will only be used as an authentication method. - -### Can I register multiple users from my organization at the same time for the Windows Insider Program for Business? -Yes. The Windows Insider Program for Business now allows organizations to register their domain and control settings centrally rather than require each user to register individually for Insider Preview builds. In order to register, follow instructions on the [Getting started with Windows Insider Program for Business](waas-windows-insider-for-business.md#getting-started-with-windows-insider-program-for-business) section. - -### My account is listed in Active Directory but not Azure Active Directory. Can I still register using my Active Directory credentials? -No. At this point, we are only supporting Azure Active Directory as a corporate authentication method. If you’d like to suggest or upvote another authentication method, please visit this [forum](https://answers.microsoft.com/en-us/insider/forum/insider_wintp). - -### I just want to participate as a Windows Insider. Do I still need to register with my corporate account in Azure Active Directory? -No. You can join using your Microsoft account (MSA) by following the steps below. However, please note that if you want to access the benefits of the Windows Insider Program for Business, you will need to sign-up using your corporate account in Azure Active Directory. - -1. Visit https://insider.windows.com and click Get Started. -2. Register with your Microsoft account and follow the on-screen registration directions. -3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds by going to **Settings > Updates & Security > Windows Insider Program** and entering your Microsoft account that you used to register. Now follow the on-screen directions. - ->[!NOTE] ->Make sure that you have administrator rights to your machine and that it has latest Windows updates. - -### I am already a Windows Insider. I want to switch my account from my Microsoft account to my corporate account in Azure Active Directory. How do I do this? -In just a few steps, you can switch your existing program registration from your Microsoft account to your corporate account in Azure Active Directory. - -1. Visit https://insider.windows.com. If you are signed in with your Microsoft account, sign out then sign back in to register with your corporate account in AAD. -2. On your Windows 10 PC, go to **Settings > Updates & Security > Windows Insider Program**. -3. In your account Under Windows Insider account, click **Change** to open a pop-up box. -4. Select your corporate account and click Continue to change your account. - ->[!NOTE] ->Your corporate account must be connected to the device for it to appear in the account list. - -### How do I sign into the Feedback Hub with my corporate credentials? -Sign in to the Feedback Hub using the same AAD account you are using to flight builds. - -### Am I going to lose all the feedback I submitted and badges I earned with my MSA? -No. However, your feedback will not be transferred from your MSA to your AAD account. You can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. - -### How is licensing handled for Windows 10 Insider builds? -All PCs need to have a valid Windows 10 license. This requirement applies whether the device is joined to the Windows Insider Program using a Microsoft account or an Azure Active Directory account. - -### Can I use the Software in a live operating environment? -The software is a pre-release version, and we do not recommend that organizations run Windows Insider Preview builds outside of their test environments. This software may not work the way a final version of the software will. We may change it for the final, commercial version. We also may not release a commercial version. - -### Can a single MSA or AAD account be used to register more than one PC in the program? -Yes. If each PC has a valid Windows 10 or Windows 10 Mobile license you can use your MSA on as many devices as you’d like. However, the main concern would be that within the feedback it all looks like it comes from a single user. If multiple devices are experiencing problems with a build, you’d want the ability to submit the same feedback from multiple people (or upvote the same piece of feedback). - - -## Related Topics -- [Windows Insider Program for Business](waas-windows-insider-for-business.md) +--- +title: Windows Insider Program for Business Frequently Asked Questions +description: Frequently Asked Questions and answers about the Windows Insider Program +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: DaniHalfin +ms.localizationpriority: high +ms.author: daniha +ms.date: 10/17/2017 +--- + +# Windows Insider Program for Business Frequently Asked Questions + + +**Applies to** + +- Windows 10 + +> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +### Are the Windows Insider Program and Windows Insider Program for Business separate programs? +No, in fact just the opposite. The Windows Insider Program was created in 2014 to help Microsoft engage with Windows Fans worldwide. Windows Insiders are the first to be able to try new Windows features that we introduce through Windows 10 Insider Preview Builds. At the same time, they can provide feedback through the Feedback Hub App which helps create even better versions of Windows for all users. The Windows Insider Program for Business enables you to incorporate Insider Preview builds into your deployment plans using your corporate credentials, deepen connections with the IT Pro community, collect feedback within your organization, and increase the visibility of your organization’s feedback – especially on features that support productivity and business needs. Together we can resolve blocking or critical issues to better support your organization’s needs sooner. Incorporating the Windows Insider Program for Business into your deployment plans enables you to prepare your organization for the next update of Windows 10, to deploy new services and tools more quickly, to help secure your applications, and to increase productivity and confidence in the stability of your environment. Windows Insider Program for Business participants collaborate with the Windows team to build and document features, infuse innovation, and plan for what’s around the bend. We’ve architected some great features together, received amazing feedback, and we’re not done. + +### What Languages are available? +Insider Preview builds are available in the following languages: English (United States), English (United Kingdom), Chinese (Simplified), Chinese (Traditional), Portuguese (Brazilian), Japanese, Russian, German, French, French (Canada), Korean, Italian, Spanish, Spanish (Latin America), Swedish, Finnish, Turkish, Arabic, Dutch, Czech, Polish, Thai, Catalan, Hindi, and Vietnamese. + +If your Windows build is not in one of the available base languages, you will not receive Insider Preview builds. + +Hindi, Catalan, and Vietnamese can only be installed as a language pack over [supported base languages](https://support.microsoft.com/help/14236/language-packs). + +>[!NOTE] +> To learn how to install a language pack, see [How to add an input language to your PC Additional](https://support.microsoft.com/instantanswers/60f32ff8-8697-4452-af7d-647439c38433/how-to-add-and-switch-input-languages-on-your-pc). + +### How do I register for the Windows Insider Program for Business? +To register for the Windows Insider Program for Business, follow the steps below using your corporate account in Azure Active Directory (AAD). This account is the same account that you use for Office 365 and other Microsoft services. + +1. Visit https://insider.windows.com and click **Get Started**. +2. Sign-in with your corporate account in AAD (username/password) and follow the on-screen registration directions. +3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds. Go to **Settings > Updates & Security > Windows Insider Program**. Click **Get Started**, enter your corporate credentials that you used to register, then follow the on-screen directions. + +>[!NOTE] +>Make sure that you have administrator rights to your machine and that it has latest Windows updates. + +### Are there any management capabilities that allow an IT admin to manage settings for a corporate environment? +Yes. Starting with Windows 10, version 1709, the Windows Insider Program for Business now enables administrators to apply the following group policies to help them manage their organization’s preview builds: + +**Manage preview builds:** Administrators can enable or prevent builds from installing on a device. You also have an option to disable preview builds once the release is public. +**Branch Readiness Level:** Administrators can set the Windows readiness level, including Fast, Slow, Release Preview Rings of Windows Insider Preview) and allows administrators to defer or pause delivery of updates. + +See more information on the [Getting started with Windows Insider Program for Business](waas-windows-insider-for-business.md#getting-started-with-windows-insider-program-for-business) section. + +### How can I find out if my corporate account is on Azure Active Directory? +On your PC, go to **Settings > Accounts > Access work or school**. If your organization has set up your corporate account in Azure Active Directory and it is connected to your PC, you will see the account listed as highlighted in the image below. + +![Device connected to Work Account](images/waas-wipfb-work-account.jpg) + +### I have more than one Azure Active Directory account. Which should I use? +Register for Windows Insider Program for Business with the same active account that you use to access your corporate email in Office 365 and other Microsoft services. To ensure you get the most benefit out of the Windows Insider Program for Business and that your company is fully represented, do not set up a separate tenant for testing activities. There will be no modifications to the AAD tenant to support Windows Insider Program for Business, and it will only be used as an authentication method. + +### Can I register multiple users from my organization at the same time for the Windows Insider Program for Business? +Yes. The Windows Insider Program for Business now allows organizations to register their domain and control settings centrally rather than require each user to register individually for Insider Preview builds. In order to register, follow instructions on the [Getting started with Windows Insider Program for Business](waas-windows-insider-for-business.md#getting-started-with-windows-insider-program-for-business) section. + +### My account is listed in Active Directory but not Azure Active Directory. Can I still register using my Active Directory credentials? +No. At this point, we are only supporting Azure Active Directory as a corporate authentication method. If you’d like to suggest or upvote another authentication method, please visit this [forum](https://answers.microsoft.com/en-us/insider/forum/insider_wintp). + +### I just want to participate as a Windows Insider. Do I still need to register with my corporate account in Azure Active Directory? +No. You can join using your Microsoft account (MSA) by following the steps below. However, please note that if you want to access the benefits of the Windows Insider Program for Business, you will need to sign-up using your corporate account in Azure Active Directory. + +1. Visit https://insider.windows.com and click Get Started. +2. Register with your Microsoft account and follow the on-screen registration directions. +3. Enroll your Windows 10 PC to get the latest Windows 10 Insider Preview builds by going to **Settings > Updates & Security > Windows Insider Program** and entering your Microsoft account that you used to register. Now follow the on-screen directions. + +>[!NOTE] +>Make sure that you have administrator rights to your machine and that it has latest Windows updates. + +### I am already a Windows Insider. I want to switch my account from my Microsoft account to my corporate account in Azure Active Directory. How do I do this? +In just a few steps, you can switch your existing program registration from your Microsoft account to your corporate account in Azure Active Directory. + +1. Visit https://insider.windows.com. If you are signed in with your Microsoft account, sign out then sign back in to register with your corporate account in AAD. +2. On your Windows 10 PC, go to **Settings > Updates & Security > Windows Insider Program**. +3. In your account Under Windows Insider account, click **Change** to open a pop-up box. +4. Select your corporate account and click Continue to change your account. + +>[!NOTE] +>Your corporate account must be connected to the device for it to appear in the account list. + +### How do I sign into the Feedback Hub with my corporate credentials? +Sign in to the Feedback Hub using the same AAD account you are using to flight builds. + +### Am I going to lose all the feedback I submitted and badges I earned with my MSA? +No. However, your feedback will not be transferred from your MSA to your AAD account. You can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. + +### How is licensing handled for Windows 10 Insider builds? +All PCs need to have a valid Windows 10 license. This requirement applies whether the device is joined to the Windows Insider Program using a Microsoft account or an Azure Active Directory account. + +### Can I use the Software in a live operating environment? +The software is a pre-release version, and we do not recommend that organizations run Windows Insider Preview builds outside of their test environments. This software may not work the way a final version of the software will. We may change it for the final, commercial version. We also may not release a commercial version. + +### Can a single MSA or AAD account be used to register more than one PC in the program? +Yes. If each PC has a valid Windows 10 or Windows 10 Mobile license you can use your MSA on as many devices as you’d like. However, the main concern would be that within the feedback it all looks like it comes from a single user. If multiple devices are experiencing problems with a build, you’d want the ability to submit the same feedback from multiple people (or upvote the same piece of feedback). + + +## Related Topics +- [Windows Insider Program for Business](waas-windows-insider-for-business.md) - [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) \ No newline at end of file diff --git a/windows/deployment/update/waas-windows-insider-for-business.md b/windows/deployment/update/waas-windows-insider-for-business.md index 32054cce1a..b3c5ee1517 100644 --- a/windows/deployment/update/waas-windows-insider-for-business.md +++ b/windows/deployment/update/waas-windows-insider-for-business.md @@ -1,286 +1,293 @@ ---- -title: Windows Insider Program for Business -description: Overview of the Windows Insider Program for Business -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: DaniHalfin -ms.localizationpriority: high -ms.author: daniha -ms.date: 10/17/2017 ---- - -# Windows Insider Program for Business - - -**Applies to** - -- Windows 10 - -> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) - -For many IT pros, gaining visibility into feature updates early, before they’re available to the Semi-Annual Channel, can be both intriguing and valuable for future end user communications as well as provide additional prestaging for Semi-Annual Channel devices. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test devices, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to the Semi-Annual Channel, organizations can test their deployment on test devices for compatibility validation. - -The Windows Insider Program for Business gives you the opportunity to: -* Get early access to Windows Insider Preview Builds. -* Provide feedback to Microsoft in real-time via the Feedback Hub app. -* Sign-in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. -* Register your Azure AD domain into the program, to cover all users within your organization with just one registration. -* Starting with Windows 10, version 1709, enable, disable, defer and pause the installation of preview builds through policies. -* Track feedback provided through the Feedback Hub App, across your organization. - -Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App. - -The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. - -## Getting started with Windows Insider Program for Business - -To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: - -1. [Register your organizational Azure AD account](#individual-registration) to the Windows Insider Program for Business. -2. [Register your organization's Azure AD domain](#organizational-registration) to the Windows Insider Program for Business.
**Note:** Registering user has to be a Global Administrator in the Azure AD domain. -3. [Set policies](#manage-windows-insider-preview-builds) to enable Windows Insider Preview builds and select flight rings. - ->[!IMPORTANT] ->The **Allow Telemetry** setting has to be set to 2 or higher, to receive Windows Insider preview builds. -> ->The setting is available in **Group Policy**, through **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds - Allow Telemetry** or in **MDM**, through [**System/AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). - -Below are additional details to accomplish the steps described above. - -## Register to the Windows Insider Program for Business - -Registration in the Windows Insider Program for Business can be done individually per user or for an entire organization: - -### Individual registration - ->[!IMPORTANT] ->This step is a prerequisite to register your organization's Azure AD domain. - -Navigate to the [**Getting Started**](https://insider.windows.com/en-us/getting-started/) page on [Windows Insider](https://insider.windows.com), go to **Register your organization account** and follow the instructions. - ->[!NOTE] ->Make sure your device is [connected to your company's Azure AD subscription](waas-windows-insider-for-business-faq.md#connected-to-aad). - -### Organizational registration - -This method enables to your register your entire organization to the Windows Insider Program for Business, to avoid having to register each individual user. - ->[!IMPORTANT] ->The account performing these steps has to first be registered to the program individually. Additionally, Global Administrator privileges on the Azure AD domain are required. - -1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). -2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
**Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. - ->[!NOTE] ->At this point, the Windows Insider Program for Business only supports [Azure Active Directory (Azure AD)](/azure/active-directory/active-directory-whatis) (and not Active Directory on premises) as a corporate authentication method. -> ->If your company is currently not using Azure AD – but has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. - -## Manage Windows Insider Preview builds - -Starting with Windows 10, version 1709, administrators can control how and when devices receive Windows Insider Preview builds on their devices. - -The **Manage preview builds** setting gives enables or prevents preview build installation on a device. You can also decide to stop preview builds once the release is public. -* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* -* MDM: **Update/ManagePreviewBuilds** - ->[!NOTE] ->**MDM Values for ManagePreviewBuilds**: ->* 0 - Disable preview builds ->* 1 - Disable preview builds once next release is public ->* 2 - Enable preview builds ->* 3 - Preview builds are left to user selection *(default)* - -The **Branch Readiness Level** settings allows you to choose between preview [flight rings](#flight-rings), and defer or pause the delivery of updates. -* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* -* MDM: [**Update/BranchReadinessLevel**](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) - -![Select when Preview Builds and Feature Updates are received group policy](images/waas-wipfb-policy1.png) - -If you want to manage Windows Insider preview builds prior to Windows 10, version 1709, follow these steps: - -1. Enroll your device by going to **Start > Settings > Update & security > Windows Insider Program** and selecting **Get Started**. Sign-in using the account you used to register for the Windows Insider Program. -2. After reading the privacy statement and clicking **Next**, **Confirm** and schedule a restart. -3. You are ready to install your first preview build. To do so, go to **Start** > **Settings** > **Update & security** > **Windows Insider Program** to select your Windows Insider level. The device receives the most recent Windows Insider build for the Windows Insider level you select. - ->[!NOTE] ->To enroll your PC, you’ll require administration rights on the machine and it needs to be running Windows 10, Version 1703 or later. If you are already registered in the Windows Insider Program using your Microsoft account, you’ll need to [switch enrollment to the organizational account](#how-to-switch-between-your-msa-and-your-corporate-aad-account). - ->[!TIP] ->Administrators have the option to use [Device Health](/windows/deployment/update/device-health-monitor) in Windows Analytics to monitor devices running Windows 10 Insider Preview builds. - -## Flight rings - -Flighting rings are used to evaluate the quality of our software as it is released to progressively larger audiences. We will flight a Feature Update, application, etc. to the first ring if it passes all required automated testing in the lab. The flight will continue to be evaluated against a set of criteria to ensure it is ready to progress to the next ring. - -These are the available flight rings: - -### Release Preview - -Best for Insiders who enjoy getting early access to updates for the Semi-Annual Channel, Microsoft applications, and drivers, with minimal risk to their devices, and still want to provide feedback to make Windows devices great. - -Insiders on this level receive builds of Windows just before Microsoft releases them to the Semi-Annual Channel. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. - -* The Release Preview Ring will only be visible when your Windows build version is the same as the Semi-Annual Channel. -* To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. - -### Slow - -The Slow Windows Insider level is for users who enjoy seeing new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build. - -* Builds are sent to the Slow Ring after feedback has been received from Windows Insiders within the Fast Ring and analyzed by our Engineering teams. -* These builds will include updates to fix key issues that would prevent many Windows Insiders from being able to use the build on a daily basis. -* These builds still may have issues that would be addressed in a future flight. - -### Fast - -Best for Windows Insiders who enjoy being the first to get access to builds and feature updates, with some risk to their devices in order to identify issues, and provide suggestions and ideas to make Windows software and devices great. - -* Windows Insiders with devices in the Fast Ring should be prepared for more issues that may block key activities that are important to you or may require significant workarounds. -* Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features may work on some devices but may fail in other device configurations. -* Windows Insiders should be ready to reinstall Windows using the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) when you are significantly blocked. -* Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community forum. - ->[!NOTE] ->Once your machine is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your machine will be auto-targeted for the next available flight for your selected ring. For the first build on any given machine, this may take up to 24 hours to complete. - -### How to switch between flight rings - -During your time in the Windows Insider Program, you may want to change between flight rings for any number of reasons. Starting with Windows 10, version 1709, use the **Branch Readiness Level** to switch between flight rings. -* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* -* MDM: [**Update/BranchReadinessLevel**](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) - -To switch flights prior to Windows 10, version 1709, follow these steps: - -1. Go to **Settings > Updates & Security > Windows Insider Program** -2. Under **Choose your level**, select between the following rings - - * [Windows Insider Fast](#fast) - * [Windows Insider Slow](#slow) - * [Release Preview](#release-preview) - -## How to switch between your MSA and your Corporate AAD account - -If you were using your Microsoft Account (MSA) to enroll to the Windows Insider Program, switch to your organizational account by going to **Settings > Updates & Security > Windows Insider Program**, and under **Windows Insider account** select **Change**. - -![Change Windows Insider account](images/waas-wipfb-change-user.png) - ->[!NOTE] ->If you would like to use your corporate account, your device must be connected to your corporate account in AAD for the account to appear in the account list. - -## Sharing Feedback Via the Feedback Hub -As you know a key benefit to being a Windows Insider is Feedback. It’s definitely a benefit to us, and we hope it’s a benefit to you. Feedback is vital for making changes and improvements in Windows 10. Receiving quality and actionable feedback is key in achieving these goals. - -Please use the [**Feedback Hub App**](feedback-hub://?referrer=wipForBizDocs&tabid=2) to submit your feedback to Microsoft. - -When providing feedback, please consider the following: -1. Check for existing feedback on the topic you are preparing to log. Another user may have already shared the same feedback. If they have, please “upvote” the existing feedback to help prevent duplicate submissions. Adding additional comments to existing feedback can help others by providing clarity to existing information or additional scenarios to review. -2. Provide as much information to us as possible: include reproduction steps, screenshots, any detail you think would help us experience the issue as you have, so that we can work on a fix and get it into a new build as soon as possible. - ->[!TIP] ->You can then track feedback provided by all users in your organization through the Feedback Hub. Simply filter by **My Organization**. - ->[!NOTE] ->If you signed into the Feedback Hub previously with your MSA, your feedback and badges will not be transferred to your AAD sing-in. However, you can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. - -### User consent requirement - -With the current version of the Feedback Hub app, we need the user's consent to access their AAD account profile data (We read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: - -![Feedback Hub consent to AAD pop-up](images/waas-wipfb-aad-consent.png) - -Once agreed, everything will work fine, and that user won't be prompted for permission again. - -#### Something went wrong - -The option for users to give consent for apps to access their profile data is controlled through Azure Active Directory. This means the AAD administrators have the ability to allow or block users from giving consent. - -In case the administrators blocked this option, when the user signs in with the AAD account, they will see the following error message: - -![Feedback Hub consent error message](images/waas-wipfb-aad-error.png) - -This blocks the user from signing in, which means they won't be able to use the Feedback Hub app with their AAD credentials. - -**To fix this issue**, an administrator of the AAD directory will need to enable user consent for apps to access their data. - -To do this through the **classic Azure portal**: -1. Go to https://manage.windowsazure.com/ . -2. Switch to the **Active Directory** dashboard. - ![Azure classic portal dashboard button](images/waas-wipfb-aad-classicaad.png) -3. Select the appropriate directory and go to the **Configure** tab. -4. Under the **integrated applications** section, enable **Users may give applications permissions to access their data**. - ![Azure classic portal enable consent](images/waas-wipfb-aad-classicenable.png) - -To do this through the **new Azure portal**: -1. Go to https://portal.azure.com/ . -2. Switch to the **Active Directory** dashboard. - ![Azure new portal dashboard button](images/waas-wipfb-aad-newaad.png) -3. Switch to the appropriate directory. - ![Azure new portal switch directory button](images/waas-wipfb-aad-newdirectorybutton.png) -4. Under the **Manage** section, select **User settings**. - ![Azure new portal user settings](images/waas-wipfb-aad-newusersettings.png) -5. In the **Enterprise applications** section, enable **Users can allow apps to access their data**. - ![Azure new portal enable consent](images/waas-wipfb-aad-newenable.png) - -## Not receiving Windows 10 Insider Preview build updates? - -In some cases, your PC may not update to the latest Windows Insider Preview build as expected. Here are items that you can review to troubleshoot this issue: - -### Perform a manual check for updates -Go to **Settings > Updates & Security**. Review available updates or select **Check for updates**. - ->[!NOTE] ->If you have set Active Hours, ensure your device is left turned on and signed in during the off-hours so the install process can complete. - -### Make sure Windows is activated -Go to **Settings > Updates & Security > Activation** to verify Windows is activated. - -### Make sure your corporate account in AAD is connected to your device -Open **Settings \ Accounts \ Access work or school**. If your PC is not listed as connected to your account in AAD, click Connect and enter your AAD account. - -### Make sure you have selected a flight ring -Open **Settings > Update & Security > Windows Insider Program** and select your flight ring. - -### Have you recently done a roll-back? -If so, please double-check your flight settings under **Settings > Update & Security > Windows Insider Program**. - -### Did you do a clean install? -After a clean-install and initial setup of a Microsoft or corporate account (even one that has been used previously for flighting) the appropriate targeting needs to take place for your PC. This background process is known as Compatibility Checker and will run during idle time on your PC. This process may take up to 24 hours. Please leave your PC turned on to ensure this occurs in timely manner. - -### Are there known issues for your current build? -On rare occasion, there may be an issue with a build that could lead to issues with updates being received. Please check the most recent Blog Post or reach out to the Windows Insider team on Twitter for verification (*@WindowsInsider*). You can also check the **Feedback Hub** for announcements and known issues. - -## Exiting flighting - -After you’ve tried the latest Windows Insider Preview builds, you may want to opt out. In order to do that, go to **Settings > Update & Security > Windows Insider Program** and select **Stop Insider Preview Builds**. Follow the on-screen instructions to stop flighting to your device. - -To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. - -## Unregister - -If you no longer plan to manage Windows Insider Preview policies for your organization, you will need to [unregister your domain with the Windows Insider Program](https://insider.windows.com/en-us/insiderorgleaveprogram/). - -Unregistering will not allow any other administrators at your organization to continue to set policies to manage Windows Insider Preview builds across your organization. - -Your individual registration with the Insider program will not be impacted. If you wish to leave the Insider program, see the [leave the program](https://insider.windows.com/en-us/how-to-overview/#leave-the-program) instructions. - -## Additional help resources - -* [**Windows Blog**](https://blogs.windows.com/blog/tag/windows-insider-program/) - With each new build release we publish a Windows Blog post that outlines key feature changes as well as known issues that Insiders may encounter while using the build. -* [**Microsoft Technical Community for Windows Insiders**](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) - Engage with Windows Insiders around the world in a community dedicated to the Windows Insider Program. -* [**Windows Insider Preview community forum**](https://answers.microsoft.com/en-us/insider/forum/insider_wintp) - Answers is Microsoft’s forum platform and there is an entire area dedicated to the Windows Insider Program. Insiders can filter between PC, Office, Edge, and many others. - -## Learn More -- [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) -- [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) - - -## Related Topics -- [Overview of Windows as a service](waas-overview.md) -- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) -- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) -- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) -- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) -- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) -- [Manage Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) +--- +title: Windows Insider Program for Business +description: Overview of the Windows Insider Program for Business +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: DaniHalfin +ms.localizationpriority: high +ms.author: daniha +ms.date: 10/17/2017 +--- + +# Windows Insider Program for Business + + +**Applies to** + +- Windows 10 + +> **Looking for information about Windows 10 for personal or home use?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +For many IT pros, gaining visibility into feature updates early, before they’re available to the Semi-Annual Channel, can be both intriguing and valuable for future end user communications as well as provide additional prestaging for Semi-Annual Channel devices. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test devices, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to the Semi-Annual Channel, organizations can test their deployment on test devices for compatibility validation. + +The Windows Insider Program for Business gives you the opportunity to: +* Get early access to Windows Insider Preview Builds. +* Provide feedback to Microsoft in real-time via the Feedback Hub app. +* Sign-in with corporate credentials (Azure Active Directory) and increase the visibility of your organization's feedback with Microsoft – especially on features that support your productivity and business needs. +* Register your Azure AD domain into the program, to cover all users within your organization with just one registration. +* Starting with Windows 10, version 1709, enable, disable, defer and pause the installation of preview builds through policies. +* Track feedback provided through the Feedback Hub App, across your organization. + +Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub App. + +The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. + +## Getting started with Windows Insider Program for Business + +To get started with the Windows Insider Program for Business, you can follow a few simple steps: + +1. [Register your organizational Azure AD account](#individual-registration) to the Windows Insider Program for Business. +2. [Register your organization's Azure AD domain](#organizational-registration) to the Windows Insider Program for Business.
**Note:** Registering user has to be a Global Administrator in the Azure AD domain. +3. [Set policies](#manage-windows-insider-preview-builds) to enable Windows Insider Preview builds and select flight rings. + +>[!IMPORTANT] +>The **Allow Telemetry** setting has to be set to 2 or higher, to receive Windows Insider preview builds. +> +>The setting is available in **Group Policy**, through **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds - Allow Telemetry** or in **MDM**, through [**System/AllowTelemetry**](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). + +Below are additional details to accomplish the steps described above. + +## Register to the Windows Insider Program for Business + +Registration in the Windows Insider Program for Business can be done individually per user or for an entire organization: + +### Individual registration + +>[!IMPORTANT] +>This step is a prerequisite to register your organization's Azure AD domain. + +Navigate to the [**Getting Started**](https://insider.windows.com/en-us/getting-started/) page on [Windows Insider](https://insider.windows.com), go to **Register your organization account** and follow the instructions. + +>[!NOTE] +>Make sure your device is [connected to your company's Azure AD subscription](waas-windows-insider-for-business-faq.md#connected-to-aad). + +### Organizational registration + +This method enables to your register your entire organization to the Windows Insider Program for Business, to avoid having to register each individual user. + +>[!IMPORTANT] +>The account performing these steps has to first be registered to the program individually. Additionally, Global Administrator privileges on the Azure AD domain are required. + +1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). +2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
**Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. + +>[!NOTE] +>At this point, the Windows Insider Program for Business only supports [Azure Active Directory (Azure AD)](/azure/active-directory/active-directory-whatis) (and not Active Directory on premises) as a corporate authentication method. +> +>If your company is currently not using Azure AD – but has a paid subscription to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services – you have a free subscription to Microsoft Azure Active Directory. This subscription can be used to create users for enrollment in the Windows Insider Program for Business. + +## Manage Windows Insider Preview builds + +Starting with Windows 10, version 1709, administrators can control how and when devices receive Windows Insider Preview builds on their devices. + +The **Manage preview builds** setting gives enables or prevents preview build installation on a device. You can also decide to stop preview builds once the release is public. +* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* +* MDM: **Update/ManagePreviewBuilds** + +>[!NOTE] +>**MDM Values for ManagePreviewBuilds**: +>* 0 - Disable preview builds +>* 1 - Disable preview builds once next release is public +>* 2 - Enable preview builds +>* 3 - Preview builds are left to user selection *(default)* + +The **Branch Readiness Level** settings allows you to choose between preview [flight rings](#flight-rings), and defer or pause the delivery of updates. +* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* +* MDM: [**Update/BranchReadinessLevel**](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) + +![Select when Preview Builds and Feature Updates are received group policy](images/waas-wipfb-policy1.png) + +### Individual enrollment + +If you want to manage Windows Insider preview builds prior to Windows 10, version 1709, or wish to enroll a single device, follow these steps: + +1. Enroll your device by going to **Start > Settings > Update & security > Windows Insider Program** and selecting **Get Started**. Sign-in using the account you used to register for the Windows Insider Program. +2. After reading the privacy statement and clicking **Next**, **Confirm** and schedule a restart. +3. You are ready to install your first preview build. To do so, go to **Start** > **Settings** > **Update & security** > **Windows Insider Program** to select your Windows Insider level. The device receives the most recent Windows Insider build for the Windows Insider level you select. + +>[!NOTE] +>To enroll your PC, you’ll require administration rights on the machine and it needs to be running Windows 10, Version 1703 or later. If you are already registered in the Windows Insider Program using your Microsoft account, you’ll need to [switch enrollment to the organizational account](#how-to-switch-between-your-msa-and-your-corporate-aad-account). + +>[!TIP] +>Administrators have the option to use [Device Health](/windows/deployment/update/device-health-monitor) in Windows Analytics to monitor devices running Windows 10 Insider Preview builds. + +## Flight rings + +Flighting rings are used to evaluate the quality of our software as it is released to progressively larger audiences. We will flight a Feature Update, application, etc. to the first ring if it passes all required automated testing in the lab. The flight will continue to be evaluated against a set of criteria to ensure it is ready to progress to the next ring. + +These are the available flight rings: + +### Release Preview + +Best for Insiders who enjoy getting early access to updates for the Semi-Annual Channel, Microsoft applications, and drivers, with minimal risk to their devices, and still want to provide feedback to make Windows devices great. + +Insiders on this level receive builds of Windows just before Microsoft releases them to the Semi-Annual Channel. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. + +* The Release Preview Ring will only be visible when your Windows build version is the same as the Semi-Annual Channel. +* To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. + +### Slow + +The Slow Windows Insider level is for users who enjoy seeing new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build. + +* Builds are sent to the Slow Ring after feedback has been received from Windows Insiders within the Fast Ring and analyzed by our Engineering teams. +* These builds will include updates to fix key issues that would prevent many Windows Insiders from being able to use the build on a daily basis. +* These builds still may have issues that would be addressed in a future flight. + +### Fast + +Best for Windows Insiders who enjoy being the first to get access to builds and feature updates, with some risk to their devices in order to identify issues, and provide suggestions and ideas to make Windows software and devices great. + +* Windows Insiders with devices in the Fast Ring should be prepared for more issues that may block key activities that are important to you or may require significant workarounds. +* Because we are also validating a build on a smaller set of devices before going to Fast, there is also a chance that some features may work on some devices but may fail in other device configurations. +* Windows Insiders should be ready to reinstall Windows using the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) when you are significantly blocked. +* Please remember to report any issue to us through the Windows Insider Feedback Hub or the Windows Insider community forum. + +>[!NOTE] +>Once your machine is updated to Windows 10 and you select your desired flight ring, the process known as "Compatibility check" will need to run in the background. There is no manual way to force this process to run. This process allows for the discovery of your OS type (32-bit, 64-bit), build edition (Home, Pro, Enterprise), country and language settings, and other required information. Once this process is complete, your machine will be auto-targeted for the next available flight for your selected ring. For the first build on any given machine, this may take up to 24 hours to complete. + +### How to switch between flight rings + +During your time in the Windows Insider Program, you may want to change between flight rings for any number of reasons. Starting with Windows 10, version 1709, use the **Branch Readiness Level** to switch between flight rings. +* Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* +* MDM: [**Update/BranchReadinessLevel**](/windows/client-management/mdm/policy-csp-update#update-branchreadinesslevel) + +To switch flights prior to Windows 10, version 1709, follow these steps: + +1. Go to **Settings > Updates & Security > Windows Insider Program** +2. Under **Choose your level**, select between the following rings - + * [Windows Insider Fast](#fast) + * [Windows Insider Slow](#slow) + * [Release Preview](#release-preview) + +## How to switch between your MSA and your Corporate AAD account + +If you were using your Microsoft Account (MSA) to enroll to the Windows Insider Program, switch to your organizational account by going to **Settings > Updates & Security > Windows Insider Program**, and under **Windows Insider account** select **Change**. + +![Change Windows Insider account](images/waas-wipfb-change-user.png) + +>[!NOTE] +>If you would like to use your corporate account, your device must be connected to your corporate account in AAD for the account to appear in the account list. + +## Sharing Feedback Via the Feedback Hub +As you know a key benefit to being a Windows Insider is Feedback. It’s definitely a benefit to us, and we hope it’s a benefit to you. Feedback is vital for making changes and improvements in Windows 10. Receiving quality and actionable feedback is key in achieving these goals. + +Please use the [**Feedback Hub App**](feedback-hub://?referrer=wipForBizDocs&tabid=2) to submit your feedback to Microsoft. + +When providing feedback, please consider the following: +1. Check for existing feedback on the topic you are preparing to log. Another user may have already shared the same feedback. If they have, please “upvote” the existing feedback to help prevent duplicate submissions. Adding additional comments to existing feedback can help others by providing clarity to existing information or additional scenarios to review. +2. Provide as much information to us as possible: include reproduction steps, screenshots, any detail you think would help us experience the issue as you have, so that we can work on a fix and get it into a new build as soon as possible. + +>[!TIP] +>You can then track feedback provided by all users in your organization through the Feedback Hub. Simply filter by **My Organization**. +> +>If you're signed in to the Feedback Hub App using your personal Microsoft Account (MSA), you can switch to your work account, by clicking on your account, signing out, and signing back in. + +>[!NOTE] +>If you signed into the Feedback Hub previously with your MSA, your feedback and badges will not be transferred to your AAD sing-in. However, you can switch back to your MSA account in the Feedback Hub to access feedback you’ve submitted and badges you’ve earned. + +### User consent requirement + +With the current version of the Feedback Hub app, we need the user's consent to access their AAD account profile data (We read their name, organizational tenant ID and user ID). When they sign in for the first time with the AAD account, they will see a popup asking for their permission, like this: + +![Feedback Hub consent to AAD pop-up](images/waas-wipfb-aad-consent.png) + +Once agreed, everything will work fine, and that user won't be prompted for permission again. + +#### Something went wrong + +The option for users to give consent for apps to access their profile data is controlled through Azure Active Directory. This means the AAD administrators have the ability to allow or block users from giving consent. + +In case the administrators blocked this option, when the user signs in with the AAD account, they will see the following error message: + +![Feedback Hub consent error message](images/waas-wipfb-aad-error.png) + +This blocks the user from signing in, which means they won't be able to use the Feedback Hub app with their AAD credentials. + +**To fix this issue**, an administrator of the AAD directory will need to enable user consent for apps to access their data. + +To do this through the **classic Azure portal**: +1. Go to https://manage.windowsazure.com/ . +2. Switch to the **Active Directory** dashboard. + ![Azure classic portal dashboard button](images/waas-wipfb-aad-classicaad.png) +3. Select the appropriate directory and go to the **Configure** tab. +4. Under the **integrated applications** section, enable **Users may give applications permissions to access their data**. + ![Azure classic portal enable consent](images/waas-wipfb-aad-classicenable.png) + +To do this through the **new Azure portal**: +1. Go to https://portal.azure.com/ . +2. Switch to the **Active Directory** dashboard. + ![Azure new portal dashboard button](images/waas-wipfb-aad-newaad.png) +3. Switch to the appropriate directory. + ![Azure new portal switch directory button](images/waas-wipfb-aad-newdirectorybutton.png) +4. Under the **Manage** section, select **User settings**. + ![Azure new portal user settings](images/waas-wipfb-aad-newusersettings.png) +5. In the **Enterprise applications** section, enable **Users can allow apps to access their data**. + ![Azure new portal enable consent](images/waas-wipfb-aad-newenable.png) + +## Not receiving Windows 10 Insider Preview build updates? + +In some cases, your PC may not update to the latest Windows Insider Preview build as expected. Here are items that you can review to troubleshoot this issue: + +### Perform a manual check for updates +Go to **Settings > Updates & Security**. Review available updates or select **Check for updates**. + +>[!NOTE] +>If you have set Active Hours, ensure your device is left turned on and signed in during the off-hours so the install process can complete. + +### Make sure Windows is activated +Go to **Settings > Updates & Security > Activation** to verify Windows is activated. + +### Make sure your corporate account in AAD is connected to your device +Open **Settings \ Accounts \ Access work or school**. If your PC is not listed as connected to your account in AAD, click Connect and enter your AAD account. + +### Make sure you have selected a flight ring +Open **Settings > Update & Security > Windows Insider Program** and select your flight ring. + +### Have you recently done a roll-back? +If so, please double-check your flight settings under **Settings > Update & Security > Windows Insider Program**. + +### Did you do a clean install? +After a clean-install and initial setup of a Microsoft or corporate account (even one that has been used previously for flighting) the appropriate targeting needs to take place for your PC. This background process is known as Compatibility Checker and will run during idle time on your PC. This process may take up to 24 hours. Please leave your PC turned on to ensure this occurs in timely manner. + +### Are there known issues for your current build? +On rare occasion, there may be an issue with a build that could lead to issues with updates being received. Please check the most recent Blog Post or reach out to the Windows Insider team on Twitter for verification (*@WindowsInsider*). You can also check the **Feedback Hub** for announcements and known issues. + +## Exiting flighting + +After you’ve tried the latest Windows Insider Preview builds, you may want to opt out. In order to do that, go to **Settings > Update & Security > Windows Insider Program** and select **Stop Insider Preview Builds**. Follow the on-screen instructions to stop flighting to your device. + +To go from a Preview build to the Semi-Annual Channel, use the [Media Creation Tool](http://go.microsoft.com/fwlink/?LinkId=691209) (for PC) or [Windows Device Recovery Tool](http://go.microsoft.com/fwlink/p/?LinkId=522381) (for Mobile) to reinstall Windows. + +## Unregister + +If you no longer plan to manage Windows Insider Preview policies for your organization, you will need to [unregister your domain with the Windows Insider Program](https://insider.windows.com/en-us/insiderorgleaveprogram/). + +Unregistering will not allow any other administrators at your organization to continue to set policies to manage Windows Insider Preview builds across your organization. + +Your individual registration with the Insider program will not be impacted. If you wish to leave the Insider program, see the [leave the program](https://insider.windows.com/en-us/how-to-overview/#leave-the-program) instructions. + +>[!IMPORTANT] +>Once your domain is unregistered, setting the **Branch Readiness Level** to preview builds will have no effect. Return this setting to its unconfigured state in order to enable user to control it from their device. + +## Additional help resources + +* [**Windows Blog**](https://blogs.windows.com/blog/tag/windows-insider-program/) - With each new build release we publish a Windows Blog post that outlines key feature changes as well as known issues that Insiders may encounter while using the build. +* [**Microsoft Technical Community for Windows Insiders**](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) - Engage with Windows Insiders around the world in a community dedicated to the Windows Insider Program. +* [**Windows Insider Preview community forum**](https://answers.microsoft.com/en-us/insider/forum/insider_wintp) - Answers is Microsoft’s forum platform and there is an entire area dedicated to the Windows Insider Program. Insiders can filter between PC, Office, Edge, and many others. + +## Learn More +- [Windows Insider Program for Business using Azure Active Directory](waas-windows-insider-for-business-aad.md) +- [Windows Insider Program for Business Frequently Asked Questions](waas-windows-insider-for-business-faq.md) + + +## Related Topics +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Manage Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) - [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) \ No newline at end of file From 41b3a59244a677696b2c44da9d040e936b24a424 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 23 Oct 2017 19:43:52 -0700 Subject: [PATCH 47/90] final tweeks --- .../hello-hybrid-cert-trust-devreg.md | 1 - .../hello-hybrid-cert-whfb-provision.md | 4 +++- .../hello-hybrid-cert-whfb-settings-policy.md | 8 ++++---- .../hello-hybrid-key-whfb-settings-ad.md | 2 +- .../hello-hybrid-key-whfb-settings-policy.md | 2 +- .../hello-hybrid-key-whfb-settings.md | 10 +++++----- 6 files changed, 14 insertions(+), 13 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 57457517cd..e8a2d57970 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -16,7 +16,6 @@ ms.date: 09/08/2017 **Applies to** - Windows 10 ->[!IMPORTANT] >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. You're environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index c9a094726b..3d490ebdd1 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -48,7 +48,9 @@ The provisioning flow has all the information it needs to complete the Windows H The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. AAD Connect syncrhonizes the user's key to the on-prem Active Directory. > [!IMPORTANT] -> The minimum time needed to syncrhonize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. This synchronization latency delays the certificate enrollment for the user. After the user's public key has synchronized to Active Directory, the user's certificate enrolls automatically as long as the user's session is active (actively working or locked, but still signed-in). Also, the Action Center notifies the user thier PIN is ready for use. +> The minimum time needed to syncrhonize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. +> **This synchronization latency delays the the user's ability to authenticate and use on-premises resouces until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. +> Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. > [!NOTE] > Microsoft is actively investigating ways to reduce the syncrhonization latency and delays in certificate enrollment with the goal to make certificate enrollment occur real-time. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index ac4c7d3339..342e42b0d0 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -38,7 +38,7 @@ Domain controllers automatically request a certificate from the *Domain Controll To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. -#### Create a Domain Controller Automatic Certifiacte Enrollment Group Policy object +#### Create a Domain Controller Automatic Certificate Enrollment Group Policy object Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. @@ -49,7 +49,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. 6. In the navigation pane, expand **Policies** under **Computer Configuration**. 7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +8. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties**. 9. Select **Enabled** from the **Configuration Model** list. 10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. 11. Select the **Update certificates that use certificate templates** check box. @@ -60,7 +60,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. 1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO** 3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Windows Hello for Business Group Policy @@ -128,7 +128,7 @@ The best way to deploy the Windows Hello for Business Group Policy object is to The application of the Windows Hello for Business Group Policy object uses security group filtering. This enables you to link the Group Policy object at the domain, ensuring the Group Policy object is within scope to all users. However, the security group filtering ensures only the users included in the *Windows Hello for Business Users* global group receive and apply the Group Policy object, which results in the provisioning of Windows Hello for Business. 1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO�** +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO** 3. In the **Select GPO** dialog box, select **Enable Windows Hello for Business** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. Just to reassure, linking the **Windows Hello for Business** Group Policy object to the domain ensures the Group Policy object is in scope for all domain users. However, not all users will have the policy settings applied to them. Only users who are members of the Windows Hello for Business group receive the policy settings. All others users ignore the Group Policy object. diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 4a4a25924e..034442fa81 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -18,7 +18,7 @@ ms.date: 10/20/2017 >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. -The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. +Configure the appropriate security groups to effeiciently deploy Windows Hello for Business to users. ### Creating Security Groups diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 75e5789a7e..9f795ff7fd 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -129,7 +129,7 @@ The default Windows Hello for Business enables users to enroll and use biometric PIN complexity is not specific to Windows Hello for Business. Windows 10 enables users to use PINs outside of Windows Hello for Business. PIN Complexity Group Policy settings apply to all uses of PINs, even when Windows Hello for Business is not deployed. ->[IMPORTANT] +>[!IMPORTANT] > Windows 10, version 1703, the PIN complexity Group Policy settings have moved to remove misunderstanding that PIN complexity policy settings were exclusive to Windows Hello for Business. The new location of these Group Policy settings is under **Computer Configuration\Administrative Templates\System\PIN Complexity** of the Group Policy editor. Windows 10 provides eight PIN Complexity Group Policy settings that give you granular control over PIN creation and management. You can deploy these policy settings to computers, where they affect all users creating PINs on that computer; or, you can deploy these settings to users, where they affect those users creating PINs regardless of the computer they use. If you deploy both computer and user PIN complexity Group Policy settings, the user policy settings have precedence over computer policy settings. Also, this conflict resolution is based on the last applied policy. Windows does not merge the policy settings automatically; however, you can deploy Group Policy to provide to accomplish a variety of configurations. The policy settings included are: diff --git a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 591af4f0c8..2d6fa42c14 100644 --- a/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -21,13 +21,13 @@ ms.date: 09/08/2017 You are ready to configure your hybrid key trust environment for Windows Hello for Business. > [!IMPORTANT] -> Ensure your environmenet meets all the [prerequistes](hello-hybrid-key-trust-prereqs.md) before proceeding. Review the [New Installation baseline](hello-hybrid-key-new-install.md) section of this deployment document to learn how to prepare your environment for your Windows Hello for Business deployment. +> Ensure your environment meets all the [prerequistes](hello-hybrid-key-trust-prereqs.md) before proceeding. Review the [New Installation baseline](hello-hybrid-key-new-install.md) section of this deployment document to learn how to prepare your environment for your Windows Hello for Business deployment. The configuration for Windows Hello for Business is grouped in four categories. These categories are: -* [Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -* [Public Key Infrastructure](hello-hybrid-cert-whfb-settings-pki.md) -* [Active Directory Federation Services](hello-hybrid-cert-whfb-settings-adfs.md) -* [Group Policy](hello-hybrid-cert-whfb-settings-policy.md) +* [Active Directory](hello-hybrid-key-whfb-settings-ad.md) +* [Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) +* [Public Key Infrastructure](hello-hybrid-key-whfb-settings-pki.md) +* [Group Policy](hello-hybrid-key-whfb-settings-policy.md) For the most efficent deployment, configure these technologies in order beginning with the Active Directory configuration From 1c6f4383dbfc12982b0e9132e71d40376d812976 Mon Sep 17 00:00:00 2001 From: Dos Moonen Date: Tue, 24 Oct 2017 12:03:54 +0200 Subject: [PATCH 48/90] Use consistent example URL Referring to cpandl.com as the main domain and bing.com/images as if it is a subset of resources is odd. --- ...-list-using-the-version-2-schema-and-enterprise-mode-tool.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 4cb600f972..b39bd8a25e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -83,7 +83,7 @@ The following is an example of what your XML file should look like when you’re ``` In the above example, the following is true: -- cpandl.com, as the main domain, must use IE8 Enterprise Mode. However, bing.com/images must use IE7 Enterprise Mode. +- www.cpandl.com, as the main domain, must use IE8 Enterprise Mode. However, www.cpandl.com/images must use IE7 Enterprise Mode. - contoso.com, and all of its domain paths, can use the default compatibility mode for the site. From 924a3151da3bddeb2c0527321281c62126aed5bb Mon Sep 17 00:00:00 2001 From: Andrew Baker Date: Tue, 24 Oct 2017 14:34:51 +0100 Subject: [PATCH 49/90] Update evaluate-exploit-protection.md Corrected typo --- .../evaluate-exploit-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md index 3d46ca1532..6ab98f2f63 100644 --- a/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md +++ b/windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md @@ -71,7 +71,7 @@ First, enable the mitigation using PowerShell, and then confirm that it has been Now that you know the mitigation has been enabled, you can test to see if it works and what the experience would be for an end user: -1. Type **run** in the Start menu andp ress **Enter** to open the run dialog box. +1. Type **run** in the Start menu and press **Enter** to open the run dialog box. 2. Type **iexplore.exe** and press **Enter** or click **OK** to attempt to open Internet Explorer. @@ -130,4 +130,4 @@ For further details on how audit mode works, and when you might want to use it, - [Comparison with Enhanced Mitigation Experience Toolkit](emet-exploit-protection-exploit-guard.md) - [Enable Exploit protection](enable-exploit-protection.md) - [Configure and audit Exploit protection mitigations](customize-exploit-protection.md) -- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md) \ No newline at end of file +- [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md) From d8a3a359dee5792900fbff41b0fe3173f9fc8168 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Tue, 24 Oct 2017 17:18:11 +0000 Subject: [PATCH 50/90] Merged PR 4027: Merge gp-settings-1709 to master --- .../new-policies-for-windows-10.md | 77 ++++++++++++++++++- 1 file changed, 75 insertions(+), 2 deletions(-) diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 60db3078d1..a92a034a76 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -1,6 +1,6 @@ --- title: New policies for Windows 10 (Windows 10) -description: Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. +description: Windows 10 includes the following new policies for management. ms.assetid: 1F24ABD8-A57A-45EA-BA54-2DA2238C573D keywords: ["MDM", "Group Policy"] ms.prod: w10 @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library author: jdeckerms ms.localizationpriority: high +ms.date: 10/24/2017 --- # New policies for Windows 10 @@ -18,7 +19,79 @@ ms.localizationpriority: high - Windows 10 - Windows 10 Mobile -Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://go.microsoft.com/fwlink/p/?LinkID=625081). +Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/details.aspx?id=56121). + +## New Group Policy settings in Windows 10, version 1709 + +The following Group Policy settings were added in Windows 10, version 1709: + +**Control Panel** + +- Control Panel\Allow Online Tips + +**Network** + +- Network\Network Connectivity Status Indicator\Specify global DNS +- Network\WWAN Service\WWAN UI Settings\Set Per-App Cellular Access UI Visibility +- Network\WWAN Service\Cellular Data Access\Let Windows apps access cellular data + +**System** + +- System\Device Health Attestation Service\Enable Device Health Attestation Monitoring and Reporting +- System\OS Policies\Enables Activity Feed +- System\OS Policies\Allow publishing of User Activities +- System\Power Management\Power Throttling Settings\Turn off Power Throttling +- System\Storage Health\Allow downloading updates to the Disk Failure Prediction Model +- System\Trusted Platform Module Services\Configure the system to clear the TPM if it is not in a ready state. + +**Windows Components** + +- Windows Components\App Privacy\Let Windows apps communicate with unpaired devices +- Windows Components\Data Collection and Preview Builds\Limit Enhanced diagnostic data to the minimum required by Windows Analytics +- Windows Components\Handwriting\Handwriting Panel Default Mode Docked +- Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing\Hide the button (next to the New Tab button) that opens Microsoft Edge +- Windows Components\MDM\Auto MDM Enrollment with AAD Token +- Windows Components\Messaging\Allow Message Service Cloud Sync +- Windows Components\Microsoft Edge\Always show the Books Library in Microsoft Edge +- Windows Components\Microsoft Edge\Always show the Books Library in Microsoft Edge +- Windows Components\Microsoft Edge\Provision Favorites +- Windows Components\Microsoft Edge\Provision Favorites +- Windows Components\Microsoft Edge\Prevent changes to Favorites on Microsoft Edge +- Windows Components\Microsoft Edge\Prevent changes to Favorites on Microsoft Edge +- Windows Components\Microsoft FIDO Authentication\Enable usage of FIDO devices to sign on +- Windows Components\OneDrive\Prevent OneDrive from generating network traffic until the user signs in to OneDrive +- Windows Components\Push To Install\Turn off Push To Install service +- Windows Components\Search\Allow Cloud Search +- Windows Components\Windows Defender Application Guard\Allow data persistence for Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow auditing events in Windows Defender Application Guard +- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Network Protection\Prevent users and apps from accessing dangerous websites +- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure Controlled folder access +- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules +- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Attack Surface Reduction\Exclude files and paths from Attack Surface Reduction Rules +- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure allowed applications +- Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access\Configure protected folders +- Windows Components\Windows Defender Exploit Guard\Exploit Protection\Use a common set of exploit protection settings +- Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Virus and threat protection area +- Windows Components\Windows Defender Security Center\Firewall and network protection\Hide the Firewall and network protection area +- Windows Components\Windows Defender Security Center\App and browser protection\Hide the App and browser protection area +- Windows Components\Windows Defender Security Center\App and browser protection\Prevent users from modifying settings +- Windows Components\Windows Defender Security Center\Device performance and health\Hide the Device performance and health area +- Windows Components\Windows Defender Security Center\Family options\Hide the Family options area +- Windows Components\Windows Defender Security Center\Notifications\Hide all notifications +- Windows Components\Windows Defender Security Center\Notifications\Hide non-critical notifications +- Windows Components\Windows Defender Security Center\Enterprise Customization\Configure customized notifications +- Windows Components\Windows Defender Security Center\Enterprise Customization\Configure customized contact information +- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact company name +- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact phone number or Skype ID +- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact email address or Email ID +- Windows Components\Windows Defender Security Center\Enterprise Customization\Specify contact website +- Windows Components\Windows Hello for Business\Configure device unlock factors +- Windows Components\Windows Hello for Business\Configure dynamic lock factors +- Windows Components\Windows Hello for Business\Turn off smart card emulation +- Windows Components\Windows Hello for Business\Allow enumeration of emulated smart card for all users +- Windows Components\Windows Update\Allow updates to be downloaded automatically over metered connections +- Windows Components\Windows Update\Do not allow update deferral policies to cause scans against Windows Update + ## New Group Policy settings in Windows 10, version 1703 From 903a91e0f37db62c7eb6797ea9e11537d322adf2 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 24 Oct 2017 20:21:23 +0000 Subject: [PATCH 51/90] Merged PR 4036: Add link to warranty info --- devices/surface-hub/change-history-surface-hub.md | 3 ++- devices/surface-hub/support-solutions-surface-hub.md | 5 +++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md index c669a32f82..6643499b80 100644 --- a/devices/surface-hub/change-history-surface-hub.md +++ b/devices/surface-hub/change-history-surface-hub.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: jdeckerms ms.author: jdecker -ms.date: 10/20/2017 +ms.date: 10/24/2017 ms.localizationpriority: medium --- @@ -26,6 +26,7 @@ New or changed topic | Description | [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | Clarified user sign-in on Surface Hub [Set up and use Whiteboard to Whiteboard collaboration](whiteboard-collaboration.md) | Removed **How to control and manage Whiteboard to Whiteboard collaboration** due to issues with the EnterpriseModernAppmanagement CSP losing state during End Session. | [Manage settings with an MDM provider (Surface Hub)](manage-settings-with-mdm-for-surface-hub.md) | Removed settings for managing Whiteboard collaboration. | +[Top support solutions for Surface Hub](support-solutions-surface-hub.md) | Added link to Surface Hub warranty information ## September 2017 diff --git a/devices/surface-hub/support-solutions-surface-hub.md b/devices/surface-hub/support-solutions-surface-hub.md index f6eeed64e8..6b03449a2e 100644 --- a/devices/surface-hub/support-solutions-surface-hub.md +++ b/devices/surface-hub/support-solutions-surface-hub.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: surfacehub author: kaushika-msft ms.author: jdecker -ms.date: 09/07/2017 +ms.date: 10/24/2017 ms.localizationpriority: medium --- @@ -17,6 +17,8 @@ ms.localizationpriority: medium Microsoft regularly releases both updates and solutions for Surface Hub. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface Hub devices updated. For a complete listing of the update history, see [Surface Hub update history](https://www.microsoft.com/surface/support/surface-hub/surface-hub-update-history) and [Known issues and additional information about Microsoft Surface Hub](https://support.microsoft.com/help/4025643). +>[!TIP] +>Looking for [Surface Hub warranty information](https://support.microsoft.com/help/4040687/surface-surface-documents)? These are the top Microsoft Support solutions for common issues experienced when using Surface Hub. @@ -38,7 +40,6 @@ These are the top Microsoft Support solutions for common issues experienced when - [The Connect app in Surface Hub exits unexpectedly](https://support.microsoft.com/help/3157417/the-connect-app-in-surface-hub-exits-unexpectedly) -   From 51284a58a72b5ed86161c267e4fc8aa495726535 Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Tue, 24 Oct 2017 20:57:42 +0000 Subject: [PATCH 52/90] Merged PR 4037: Add manual install instructions --- .../change-history-for-application-management.md | 8 +++++++- .../manage-windows-mixed-reality.md | 13 +++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index a8a4c9a073..ed841489c6 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -8,13 +8,19 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: jdeckerms -ms.date: 10/17/2017 +ms.date: 10/24/2017 --- # Change history for Application management in Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## October 2017 + +New or changed topic | Description +--- | --- +[Enable or block Windows Mixed Reality apps in the enterprise](manage-windows-mixed-reality.md) | Added instructions for manually installing Windows Mixed Reality + ## RELEASE: Windows 10, version 1709 The topics in this library have been updated for Windows 10, version 1709 (also known as the Fall Creators Update). The following new topic has been added: diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 69313ce229..cc3105a21f 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.localizationpriority: medium author: jdeckerms ms.author: jdecker -ms.date: 10/17/2017 +ms.date: 10/24/2017 --- # Enable or block Windows Mixed Reality apps in the enterprise @@ -29,9 +29,18 @@ To enable users to download the Windows Mixed Reality software, enterprises usin - KB3180030 - KB3197985 -Enterprises will not be able to install Windows Mixed Reality Feature on Demand (FOD) directly from WSUS. Instead, use one of the following options to install Windows Mixed Reality software: +Enterprises devices running Windows 10, version 1709, will not be able to install Windows Mixed Reality Feature on Demand (FOD) directly from WSUS. Instead, use one of the following options to install Windows Mixed Reality software: - Manually install the Mixed Reality software + + - [Download the Microsoft Windows Holographic Desktop Feature on Demand package.](http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab) + + - Open a command prompt as administrator and run the following command to install the package: + + `dism /online /add-package /packagepath:"path to the cab file"` + + - Go to **Settings** > **Update & Security** > **Windows Update** and **Check for updates**. + - IT admin can create [Side by side feature store (shared folder)](https://technet.microsoft.com/library/jj127275.aspx) From 039b41c8e5297f93dc7617f48a109666ab60afb8 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 25 Oct 2017 10:09:16 -0700 Subject: [PATCH 53/90] corrected min length when policy is disabled --- .../bitlocker/bitlocker-group-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md index 5c3968f8f7..cb8e0ad837 100644 --- a/windows/device-security/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/device-security/bitlocker/bitlocker-group-policy-settings.md @@ -347,7 +347,7 @@ This policy setting is used to set a minimum PIN length when you use an unlock m